commit ec226e83488ffa8c1d2cdbe47e5a7d24c7266fc7
Author: patchzyy <64382339+patchzyy@users.noreply.github.com>
Date:   Sun Aug 23 17:10:50 2026 +0200

    init

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..903e5cd
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,5 @@
+# Auto detect text files and perform LF normalization
+* text=auto
+
+# Patch files must stay LF: git apply matches context bytes against LF upstream sources
+*.patch -text
diff --git a/.github/ISSUE_TEMPLATE/1-crash-report.yml b/.github/ISSUE_TEMPLATE/1-crash-report.yml
new file mode 100644
index 0000000..4ebf2bd
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/1-crash-report.yml
@@ -0,0 +1,97 @@
+name: Crash / freeze report
+description: The game crashed, froze, or closed on its own.
+title: "[Crash] "
+labels: ["crash"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report! Crashes are almost impossible to fix without logs, so please fill this in fully.
+
+        **Where to find your logs** (paste the path into the File Explorer address bar):
+        - Playing through **WheelWizard** (most people): `%APPDATA%\CT-MKWII\Recomp\UserData\Logs`
+        - Installed with the standalone setup exe: `%LOCALAPPDATA%\WiiCompiled\Logs`
+
+        Every run gets its own folder. Open the **newest** one and attach (drag & drop) `console.log` and any `crash_*.txt` file from it.
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you continue
+      options:
+        - label: I'm on the latest release of WiiCompiled.
+          required: true
+        - label: I searched the existing issues and nobody has reported this crash yet.
+          required: true
+        - label: This is about the game runtime, not the WheelWizard app itself (WheelWizard problems go to their tracker - see the link on the "New issue" page).
+          required: true
+  - type: input
+    id: version
+    attributes:
+      label: WiiCompiled version
+      description: It's the very first line of `console.log` (the log you're attaching below) - it starts with `[runtime] WiiCompiled v…`.
+      placeholder: "e.g. v0.2.12"
+    validations:
+      required: true
+  - type: dropdown
+    id: when
+    attributes:
+      label: When does it crash?
+      options:
+        - During startup / before the menus
+        - In the menus
+        - When loading a race
+        - During a race (offline)
+        - During a race (online)
+        - After finishing a race / results screen
+        - Randomly / no clear pattern
+    validations:
+      required: true
+  - type: dropdown
+    id: repro
+    attributes:
+      label: How often does it happen?
+      options:
+        - Every time
+        - Most of the time
+        - Sometimes
+        - Happened only once so far
+    validations:
+      required: true
+  - type: textarea
+    id: doing
+    attributes:
+      label: What were you doing when it crashed?
+      description: Game mode, track, character/vehicle, how many players, anything you pressed right before. The more specific, the better.
+      placeholder: "e.g. Retro Rewind online room, playing SNES Mario Circuit 3, crashed right as I crossed the finish line…"
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: If you can make it crash on purpose, list the steps.
+      placeholder: |
+        1. Start the game
+        2. …
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Drag & drop `console.log` and any `crash_*.txt` from your newest run folder here, or paste the tail end of them below.
+      render: text
+    validations:
+      required: true
+  - type: input
+    id: gpu
+    attributes:
+      label: GPU + driver version
+      placeholder: "e.g. RTX 3060, driver 560.94"
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Windows version
+      placeholder: "e.g. Windows 11 24H2"
+    validations:
+      required: true
diff --git a/.github/ISSUE_TEMPLATE/2-bug-report.yml b/.github/ISSUE_TEMPLATE/2-bug-report.yml
new file mode 100644
index 0000000..00608f0
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/2-bug-report.yml
@@ -0,0 +1,91 @@
+name: In-game bug report
+description: Something looks, sounds, or behaves wrong (graphics, audio, input, online) - but the game doesn't crash.
+title: "[Bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Where to find your logs** (paste the path into the File Explorer address bar):
+        - Playing through **WheelWizard** (most people): `%APPDATA%\CT-MKWII\Recomp\UserData\Logs`
+        - Installed with the standalone setup exe: `%LOCALAPPDATA%\WiiCompiled\Logs`
+
+        Every run gets its own folder. Open the **newest** one and attach `console.log`.
+
+        For visual bugs, a screenshot or short clip helps enormously.
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you continue
+      options:
+        - label: I'm on the latest release of WiiCompiled.
+          required: true
+        - label: I searched the existing issues and nobody has reported this yet.
+          required: true
+        - label: The problem does NOT also happen on Dolphin or a real Wii (if it does, it's a game/mod issue, not a WiiCompiled issue).
+          required: true
+  - type: input
+    id: version
+    attributes:
+      label: WiiCompiled version
+      description: It's the very first line of `console.log` (see the log locations above) - it starts with `[runtime] WiiCompiled v…`.
+      placeholder: "e.g. v0.2.12"
+    validations:
+      required: true
+  - type: dropdown
+    id: category
+    attributes:
+      label: What kind of bug is it?
+      options:
+        - Graphics / visual glitch
+        - Audio
+        - Input / controllers
+        - Online / matchmaking
+        - Gameplay behaves differently than on Wii/Dolphin
+        - Save data / settings
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happens?
+      description: Describe the bug and what you expected instead.
+      placeholder: "e.g. The flag textures near the start line flicker on Coconut Mall…"
+    validations:
+      required: true
+  - type: textarea
+    id: doing
+    attributes:
+      label: What were you doing? / How to reproduce
+      description: Game mode, track, and exact steps if you can reproduce it.
+      placeholder: |
+        1. Start a VS race on …
+        2. …
+    validations:
+      required: true
+  - type: textarea
+    id: media
+    attributes:
+      label: Screenshot / video
+      description: Drag & drop images or clips here (very helpful for visual bugs).
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Attach `console.log` from your newest run folder, or paste the relevant part below.
+      render: text
+  - type: input
+    id: gpu
+    attributes:
+      label: GPU + driver version
+      placeholder: "e.g. RTX 3060, driver 560.94"
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Windows version
+      placeholder: "e.g. Windows 11 24H2"
+    validations:
+      required: true
diff --git a/.github/ISSUE_TEMPLATE/3-install-problem.yml b/.github/ISSUE_TEMPLATE/3-install-problem.yml
new file mode 100644
index 0000000..72f6828
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/3-install-problem.yml
@@ -0,0 +1,75 @@
+name: Install / update problem
+description: Installing or updating WiiCompiled through WheelWizard fails, or the game won't launch at all after installing.
+title: "[Install] "
+labels: ["setup"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Where to find the setup log** (same place whether you installed through WheelWizard or the setup exe):
+        - Press `Win+R`, type `%TEMP%` and press Enter, then find `WiiCompiled-setup.log` and attach it below.
+
+        If the install finished but the game won't start, also grab `console.log` from the newest folder in:
+        - WheelWizard: `%APPDATA%\CT-MKWII\Recomp\UserData\Logs`
+        - Standalone setup exe: `%LOCALAPPDATA%\WiiCompiled\Logs`
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you continue
+      options:
+        - label: I'm on the latest version (latest WheelWizard, or the latest `MarioKartWiiCompiled-Setup.exe` from the Releases page).
+          required: true
+        - label: I searched the existing issues and nobody has reported this yet.
+          required: true
+        - label: I have a legally obtained copy of the game and it works in Dolphin.
+          required: true
+  - type: dropdown
+    id: stage
+    attributes:
+      label: Where does it go wrong?
+      options:
+        - Starting the install from WheelWizard
+        - Selecting the game file (ISO/WBFS/RVZ rejected)
+        - During compilation / translation
+        - Install finishes but the game won't launch
+        - Updating an existing install
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: installtype
+    attributes:
+      label: How did you install?
+      options:
+        - Through WheelWizard
+        - Downloaded the setup exe myself
+        - Not sure
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happens?
+      description: The exact error message (copy the full text or screenshot it) and what you were doing when it appeared.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Setup log
+      description: Drag & drop `%TEMP%\WiiCompiled-setup.log` here, or paste the tail end of it below.
+      render: text
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Windows version
+      placeholder: "e.g. Windows 11 24H2"
+    validations:
+      required: true
+  - type: input
+    id: av
+    attributes:
+      label: Antivirus (if any besides Windows Defender)
+      placeholder: "e.g. Avast, none"
diff --git a/.github/ISSUE_TEMPLATE/4-performance.yml b/.github/ISSUE_TEMPLATE/4-performance.yml
new file mode 100644
index 0000000..670fd1d
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/4-performance.yml
@@ -0,0 +1,79 @@
+name: Performance problem
+description: Low FPS, stutters, or the game runs worse than expected.
+title: "[Perf] "
+labels: ["performance"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Where to find your logs** (paste the path into the File Explorer address bar):
+        - Playing through **WheelWizard** (most people): `%APPDATA%\CT-MKWII\Recomp\UserData\Logs`
+        - Installed with the standalone setup exe: `%LOCALAPPDATA%\WiiCompiled\Logs`
+
+        Every run gets its own folder. Open the **newest** one and attach `console.log`.
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you continue
+      options:
+        - label: I'm on the latest release of WiiCompiled.
+          required: true
+        - label: I searched the existing issues and nobody has reported this yet.
+          required: true
+        - label: I checked that nothing else was hogging the GPU/CPU (recording software, browser video, etc.).
+          required: true
+  - type: input
+    id: version
+    attributes:
+      label: WiiCompiled version
+      description: It's the very first line of `console.log` (see the log locations above) - it starts with `[runtime] WiiCompiled v…`.
+      placeholder: "e.g. v0.2.12"
+    validations:
+      required: true
+  - type: dropdown
+    id: pattern
+    attributes:
+      label: What does the problem look like?
+      options:
+        - Constant low FPS everywhere
+        - Stutters / hitches (mostly smooth, brief freezes)
+        - Only certain tracks or situations are slow
+        - Got worse after an update
+        - Slow only while recording/streaming the game window
+    validations:
+      required: true
+  - type: textarea
+    id: doing
+    attributes:
+      label: When does it happen?
+      description: Which tracks/modes, offline or online, how many players, and roughly what FPS you see.
+      placeholder: "e.g. Drops to ~40 FPS on Rainbow Road with 12 players online, fine offline…"
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Attach `console.log` from your newest run folder.
+      render: text
+  - type: input
+    id: gpu
+    attributes:
+      label: GPU + driver version
+      placeholder: "e.g. RTX 3060, driver 560.94"
+    validations:
+      required: true
+  - type: input
+    id: cpu
+    attributes:
+      label: CPU
+      placeholder: "e.g. Ryzen 5 5600"
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Windows version
+      placeholder: "e.g. Windows 11 24H2"
+    validations:
+      required: true
diff --git a/.github/ISSUE_TEMPLATE/5-feature-request.yml b/.github/ISSUE_TEMPLATE/5-feature-request.yml
new file mode 100644
index 0000000..0532e0c
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/5-feature-request.yml
@@ -0,0 +1,26 @@
+name: Feature request
+description: Suggest an improvement or new feature.
+title: "[Feature] "
+labels: ["enhancement"]
+body:
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you continue
+      options:
+        - label: I searched the existing issues and nobody has suggested this yet.
+          required: true
+        - label: This is about WiiCompiled itself, not WheelWizard or Retro Rewind content.
+          required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What would you like to see?
+      description: Describe the feature and the problem it solves for you.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Workarounds you've tried
+      description: Anything you currently do instead, if applicable.
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..db8a4da
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: WheelWizard problem (launcher UI, mod downloads, Mii/save management)
+    url: https://github.com/TeamWheelWizard/WheelWizard/issues
+    about: If the problem is in the WheelWizard app itself rather than the game runtime, report it there instead.
+  - name: Retro Rewind / track questions
+    url: https://wiki.tockdom.com/wiki/Retro_Rewind
+    about: Questions about Retro Rewind content (tracks, unlocks, online events) that also happen on Dolphin or console belong with the Retro Rewind project, not here.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..ad2796d
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,36 @@
+name: Build
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: build-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  translator:
+    name: Translator (build + test)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Restore
+        run: dotnet restore translator/Translator.sln
+
+      - name: Build
+        run: dotnet build translator/Translator.sln -c Release --no-restore
+
+      - name: Test
+        run: dotnet test translator/Translator.sln -c Release --no-build --verbosity normal
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..1c69c0a
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,71 @@
+/generated/
+/Assets/
+/assets/
+/PulsarPacks/
+*.dol
+*.rel
+*.szs
+*.arc
+*.brres
+*.thp
+*.bmg
+*.brsar
+*.breff
+*.u8
+*.carc
+*.iso
+*.rvz
+*.wbfs
+*.nkit
+*.ciso
+*.gcm
+*.wad
+Code.pul
+
+# Build output
+/build/
+/build-*/
+/dist/
+/out/
+[Bb]in/
+[Oo]bj/
+*.o
+*.obj
+*.a
+*.lib
+*.pdb
+*.ilk
+*.map
+CMakeCache.txt
+CMakeFiles/
+cmake-build-*/
+
+
+# .NET
+/translator/TestResults/
+**/TestResults/
+*.user
+*.suo
+*.userprefs
+project.lock.json
+.packages/
+
+# Launcher artifacts
+/Launcher/artifacts/
+/Launcher/dist/
+/Launcher/WiiCompiled-Setup.exe
+*.exe
+*.msi
+
+
+# Local tooling and editors
+/.vs/
+/.vscode/
+/.idea/
+/tools/
+/TEMP/
+/tmp/
+/test_output/
+*.log
+output.txt
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..610cbe3
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,58 @@
+# Contributing to WiiCompiled
+
+Thanks for wanting to help! A few ground rules
+
+## The short version
+
+- Code is judged on quality, not where it came from
+- You must be able understand and be able to explain every line you submit.
+- PR descriptions and responses must be written by you, **not** generated.
+- Accuracy is the bar for anything touching game behavior.
+
+## Code quality
+
+We don't care how your code came into existence. What we care about is whether it meets the
+project's patterns and standards, and the only way we measure that is by
+reading it.
+
+Low-quality code won't be merged, regardless of origin. AI slop and human slop
+get the same treatment.
+
+## If you use AI tools
+
+That's ok, but rules apply:
+
+1. **You must be able to explain your changes.** If a reviewer asks why a line
+   exists or what a function does and you can't answer, the PR will be closed.
+   "The AI wrote it" is not an explanation.
+2. **Write your own PR description.** The description exists so reviewers know
+   what you changed and why, in your words. Generated descriptions tend to
+   describe everything and explain nothing, and they will get your PR closed.
+
+## Pull requests
+
+- Keep PRs focused. try and keep it at 1 change per PR. 
+  Small PRs get reviewed fast.
+- Explain **what** and **why**. Reference the issue if there is one.
+- For anything affecting game behavior: identical behavior to real hardware is
+  the goal. Be prepared to show your change doesn't diverge from the original
+  game (hardware comparison, logs, whatever fits).
+- Review feedback. It's about the code, not about you ;).
+
+## Bug reports
+
+See the FAQ in the [README](README.md)
+
+## A note on related projects
+
+WiiCompiled, Wheel Wizard, and other projects in this ecosystem are developed
+independently and each has its **own** contribution rules and all have their own
+rules around AI usage. What applies here does not automatically apply there,
+and vice versa. Check each project's own CONTRIBUTING file.
+
+## Legal
+
+- Never!!! include Nintendo code, assets, or game data in a PR, an issue, or
+  anywhere else in this project. No exceptions.
+- By contributing, you agree your contributions are licensed under
+  [GPL v3.0](LICENSE), like the rest of the project.
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..61d1860
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,674 @@
+GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
\ No newline at end of file
diff --git a/Launcher/.gitignore b/Launcher/.gitignore
new file mode 100644
index 0000000..c9a6cc1
--- /dev/null
+++ b/Launcher/.gitignore
@@ -0,0 +1,4 @@
+/artifacts/
+/dist/
+**/bin/
+**/obj/
diff --git a/Launcher/Build-Installer.ps1 b/Launcher/Build-Installer.ps1
new file mode 100644
index 0000000..7792401
--- /dev/null
+++ b/Launcher/Build-Installer.ps1
@@ -0,0 +1,302 @@
+[CmdletBinding(PositionalBinding = $false)]
+param(
+    [string]$OutputDirectory = 'Launcher/dist',
+    [string]$DolphinToolPath,
+    [string]$PortableToolsDirectory = 'Launcher/artifacts/portable-tools',
+    [string]$DependencySourceDirectory = 'Launcher/artifacts/dependencies',
+    [string]$VcRuntimeDirectory,
+    [string]$ToolkitReleaseTag = $env:GITHUB_REF_NAME
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+# The canonical configure flags, and the Assert-File/Assert-Directory/Get-MkwFileSha256
+# helpers shared with LocalBuild.ps1 and Prepare-NativePrebuilt.ps1.
+. (Join-Path $PSScriptRoot 'NativeBuildFlags.ps1')
+
+if ([string]::IsNullOrWhiteSpace($DolphinToolPath)) {
+    throw 'Build-Installer.ps1 requires -DolphinToolPath pointing to DolphinTool.exe.'
+}
+
+$repoRoot = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
+$outputRoot = [IO.Path]::GetFullPath((Join-Path $repoRoot $OutputDirectory))
+$portableTools = [IO.Path]::GetFullPath((Join-Path $repoRoot $PortableToolsDirectory))
+$dependencySources = [IO.Path]::GetFullPath((Join-Path $repoRoot $DependencySourceDirectory))
+$workRoot = Join-Path $PSScriptRoot 'artifacts\installer-build'
+$publish = Join-Path $workRoot 'publish'
+$payloadRoot = Join-Path $workRoot 'payload'
+$setupProject = Join-Path $PSScriptRoot 'WiiCompiled.Setup\WiiCompiled.Setup.csproj'
+$translatorProject = Join-Path $repoRoot 'translator\src\Translator.Cli\Translator.Cli.csproj'
+$projectFile = Join-Path $repoRoot 'projects\mkwii\recomp.yml'
+
+# Everything Mario-Kart-specific in the manifest below is read from the project file rather than
+# restated here, and Test-PinnedFacts.ps1 checks the copies that cannot read it (the C++ entry
+# address, the C# endpoint constant, the lists this script and the installed host both carry).
+$pins = Get-MkwProjectPins $projectFile
+# The audit reports by throwing, which aborts this run; nothing native has been invoked yet, so
+# there is no exit code to inspect.
+& (Join-Path $PSScriptRoot 'Test-PinnedFacts.ps1') -RepositoryRoot $repoRoot
+
+function Reset-Directory([string]$Path) {
+    $full = [IO.Path]::GetFullPath($Path)
+    $allowed = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot 'artifacts')).TrimEnd('\') + '\'
+    if (-not $full.StartsWith($allowed, [StringComparison]::OrdinalIgnoreCase)) {
+        throw "Refusing to reset a directory outside Launcher/artifacts: $full"
+    }
+    if (Test-Path -LiteralPath $full) { Remove-Item -LiteralPath $full -Recurse -Force }
+    [IO.Directory]::CreateDirectory($full) | Out-Null
+}
+function Reset-OutputDirectory([string]$Path) {
+    $full = [IO.Path]::GetFullPath($Path)
+    $allowed = [IO.Path]::GetFullPath($PSScriptRoot).TrimEnd('\') + '\'
+    if (-not $full.StartsWith($allowed, [StringComparison]::OrdinalIgnoreCase)) {
+        throw "Refusing to reset an output directory outside Launcher: $full"
+    }
+    if (Test-Path -LiteralPath $full) { Remove-Item -LiteralPath $full -Recurse -Force }
+    [IO.Directory]::CreateDirectory($full) | Out-Null
+}
+function Resolve-VcRuntimeDirectory([string]$RequestedPath) {
+    if ($RequestedPath) {
+        $resolved = [IO.Path]::GetFullPath($RequestedPath)
+        Assert-File (Join-Path $resolved 'vcruntime140.dll') 'Visual C++ runtime'
+        Assert-File (Join-Path $resolved 'msvcp140.dll') 'Visual C++ standard library runtime'
+        return $resolved
+    }
+    $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+    Assert-File $vswhere 'Visual Studio locator (or pass -VcRuntimeDirectory)'
+    $installation = (& $vswhere -latest -products '*' -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath | Select-Object -First 1)
+    if (-not $installation) { throw 'Visual C++ redistributable files were not found; pass -VcRuntimeDirectory.' }
+    $redistRoot = Join-Path $installation 'VC\Redist\MSVC'
+    $candidate = Get-ChildItem -LiteralPath $redistRoot -Directory -Recurse | Where-Object {
+        $_.Parent.Name -eq 'x64' -and $_.Name -match '^Microsoft\.VC\d+\.CRT$' -and
+        (Test-Path (Join-Path $_.FullName 'vcruntime140.dll')) -and (Test-Path (Join-Path $_.FullName 'msvcp140.dll'))
+    } | Sort-Object FullName -Descending | Select-Object -First 1
+    if (-not $candidate) { throw "No redistributable x64 Visual C++ runtime was found below $redistRoot." }
+    return $candidate.FullName
+}
+function Copy-Directory([string]$Source, [string]$Destination) {
+    Assert-Directory $Source "Source directory"
+    [IO.Directory]::CreateDirectory($Destination) | Out-Null
+    Copy-Item -Path (Join-Path $Source '*') -Destination $Destination -Recurse -Force
+}
+function Compress-Zip([string]$Source, [string]$Destination, [string[]]$Entries) {
+    $tar = Join-Path $env:SystemRoot 'System32\tar.exe'
+    Assert-File $tar 'Windows archive tool'
+    if (Test-Path -LiteralPath $Destination) { Remove-Item -LiteralPath $Destination -Force }
+    & $tar -a -c -f $Destination -C $Source @Entries
+    if ($LASTEXITCODE -ne 0) { throw "ZIP creation failed with exit code $LASTEXITCODE." }
+    Assert-File $Destination 'ZIP output'
+}
+
+Assert-File $setupProject '.NET setup project'
+Assert-File $translatorProject 'Translator CLI project'
+Assert-File $DolphinToolPath 'DolphinTool'
+
+if (-not (Test-Path -LiteralPath (Join-Path $portableTools 'llvm-mingw\bin\x86_64-w64-mingw32-clang++.exe'))) {
+    & (Join-Path $PSScriptRoot 'Prepare-PortableTools.ps1') -Destination $portableTools
+    if ($LASTEXITCODE -ne 0) { throw 'Portable tool preparation failed.' }
+}
+Assert-File (Join-Path $portableTools 'CMake\bin\cmake.exe') 'Portable CMake'
+Assert-File (Join-Path $portableTools 'Ninja\ninja.exe') 'Portable Ninja'
+Assert-Directory $dependencySources 'Pinned offline dependency sources'
+# native_prebuilt carries the aurora/third-party archives the user no longer has
+# to compile (launcher/Prepare-NativePrebuilt.ps1).
+# Kept in step with InstalledLayout.DependencyNames by Test-PinnedFacts.ps1: the installed host
+# refuses to call a toolkit complete unless every one of these directories is present.
+$requiredDependencies = @('abseil-cpp','cppwinrt','dawn_prebuilt','fmt','freetype','imgui','native_prebuilt','png','SDL','sqlite3','tracy','xxhash','zlib','zstd')
+
+# The precompiled archives are only interchangeable with what the user's machine
+# compiles if both came from this toolchain and this flag set, so a stale package
+# is rebuilt here rather than shipped. Without it every installation would fall
+# back to compiling aurora from source, which is what this package exists to
+# avoid - and a mismatched one would be an ABI hazard.
+$portableClangHash = Get-MkwFileSha256 (Join-Path $portableTools 'llvm-mingw\bin\clang-22.exe')
+function Test-NativePrebuiltCurrent([string]$PackageDirectory) {
+    $provenancePath = Join-Path $PackageDirectory 'provenance.json'
+    if (-not (Test-Path -LiteralPath $provenancePath -PathType Leaf)) { return $false }
+    $provenance = Get-Content -LiteralPath $provenancePath -Raw | ConvertFrom-Json
+    # Refreshing the pinned Dawn without re-harvesting would ship archives compiled
+    # against headers that no longer describe the shipped DLL. A package predating
+    # this field cannot prove it matches, so it is treated as stale.
+    $recordedDawn = $provenance.PSObject.Properties['DawnRuntimeSha256']
+    # Same reasoning for aurora itself: this release ships aurora-main sources
+    # whose headers the user's runtime compiles against, so archives harvested
+    # before an aurora change would be linked into call sites that no longer
+    # match them.
+    $recordedAurora = $provenance.PSObject.Properties['AuroraSourceFingerprint']
+    # And for the vendored Crypto++ whose archive the package now carries: this
+    # release ships runtime/third_party sources that first-party TUs compile
+    # against, so archives harvested before a vendored change are stale.
+    $recordedThirdParty = $provenance.PSObject.Properties['ThirdPartySourceFingerprint']
+    return ($provenance.CompilerSha256 -eq $portableClangHash) -and
+           ($provenance.FlagFingerprint -eq (Get-MkwNativeFlagFingerprint)) -and
+           ($null -ne $recordedDawn) -and
+           ($recordedDawn.Value -eq (Get-MkwDawnRuntimeSha256 $dependencySources)) -and
+           ($null -ne $recordedAurora) -and
+           ($recordedAurora.Value -eq (Get-MkwAuroraSourceFingerprint (Join-Path $repoRoot 'aurora-main'))) -and
+           ($null -ne $recordedThirdParty) -and
+           ($recordedThirdParty.Value -eq (Get-MkwThirdPartySourceFingerprint (Join-Path $repoRoot 'runtime\third_party')))
+}
+$nativePrebuiltPackage = Join-Path $dependencySources 'native_prebuilt'
+if (-not (Test-NativePrebuiltCurrent $nativePrebuiltPackage)) {
+    Write-Host '[0/6] Building the precompiled aurora and third-party package...'
+    & (Join-Path $PSScriptRoot 'Prepare-NativePrebuilt.ps1') `
+        -PortableToolsDirectory $portableTools -DependencySourceDirectory $dependencySources
+    if ($LASTEXITCODE -ne 0) { throw 'Precompiled aurora package preparation failed.' }
+    if (-not (Test-NativePrebuiltCurrent $nativePrebuiltPackage)) {
+        throw 'The precompiled aurora package still does not match this toolchain and flag set.'
+    }
+}
+foreach ($name in $requiredDependencies) { Assert-Directory (Join-Path $dependencySources $name) "Pinned dependency $name" }
+$vcRuntime = Resolve-VcRuntimeDirectory $VcRuntimeDirectory
+
+Reset-Directory $workRoot
+Reset-OutputDirectory $outputRoot
+foreach ($path in @($publish,$payloadRoot)) { [IO.Directory]::CreateDirectory($path) | Out-Null }
+
+Write-Host '[1/6] Publishing self-contained CLI host and translator...'
+& dotnet publish $setupProject -c Release -r win-x64 --self-contained true `
+    -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -p:EnableCompressionInSingleFile=true `
+    -p:DebugType=None -o (Join-Path $publish 'setup')
+if ($LASTEXITCODE -ne 0) { throw "Setup publish failed with exit code $LASTEXITCODE." }
+& dotnet publish $translatorProject -c Release -r win-x64 --self-contained true `
+    -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -p:EnableCompressionInSingleFile=true `
+    -p:DebugType=None -o (Join-Path $publish 'translator')
+if ($LASTEXITCODE -ne 0) { throw "Translator publish failed with exit code $LASTEXITCODE." }
+$setupHost = Join-Path $publish 'setup\WiiCompiled.Setup.exe'
+$translator = Join-Path $publish 'translator\Translator.Cli.exe'
+Assert-File $setupHost 'Published setup host'
+Assert-File $translator 'Self-contained translator'
+
+Write-Host '[2/6] Staging the explicit, game-code-free payload allowlist...'
+# The staged layout mirrors the installed layout exactly (Toolkit, BuildWorkspace): payload
+# identities hash relative paths, so the names here are part of the fingerprint contract.
+$toolkit = Join-Path $payloadRoot 'Toolkit'
+$workspace = Join-Path $payloadRoot 'BuildWorkspace'
+[IO.Directory]::CreateDirectory($toolkit) | Out-Null
+Copy-Directory (Join-Path $portableTools 'llvm-mingw') (Join-Path $toolkit 'llvm-mingw')
+Copy-Directory (Join-Path $portableTools 'CMake') (Join-Path $toolkit 'CMake')
+Copy-Directory (Join-Path $portableTools 'Ninja') (Join-Path $toolkit 'Ninja')
+# Debuggers, Python bindings, and the CMake GUI are not part of the local build graph.
+# Leaving them out reduces the attack/dependency surface without removing compiler support files.
+foreach ($unused in @(
+    (Join-Path $toolkit 'llvm-mingw\python'),
+    (Join-Path $toolkit 'CMake\bin\cmake-gui.exe')
+)) {
+    if (Test-Path -LiteralPath $unused) { Remove-Item -LiteralPath $unused -Recurse -Force }
+}
+Get-ChildItem -LiteralPath (Join-Path $toolkit 'llvm-mingw\bin') -File |
+    Where-Object { $_.Name -like 'lldb*' -or $_.Name -like 'liblldb*' } |
+    Remove-Item -Force
+[IO.Directory]::CreateDirectory((Join-Path $toolkit 'Translator')) | Out-Null
+Copy-Item -LiteralPath $translator -Destination (Join-Path $toolkit 'Translator\Translator.Cli.exe')
+Copy-Item -LiteralPath $DolphinToolPath -Destination (Join-Path $toolkit 'DolphinTool.exe')
+[IO.Directory]::CreateDirectory((Join-Path $toolkit 'Redist')) | Out-Null
+Copy-Item -Path (Join-Path $vcRuntime '*.dll') -Destination (Join-Path $toolkit 'Redist')
+Copy-Item -Path (Join-Path $vcRuntime '*.dll') -Destination (Join-Path $toolkit 'CMake\bin')
+Copy-Item -Path (Join-Path $vcRuntime '*.dll') -Destination (Join-Path $toolkit 'Ninja')
+Copy-Item -Path (Join-Path $vcRuntime '*.dll') -Destination $toolkit
+
+Copy-Directory (Join-Path $repoRoot 'runtime') (Join-Path $workspace 'runtime')
+Copy-Directory (Join-Path $repoRoot 'aurora-main') (Join-Path $workspace 'aurora-main')
+# Source trees can contain ignored developer build directories. They are never release inputs.
+$runtimeDeveloperBuild = Join-Path $workspace 'runtime\build'
+if (Test-Path -LiteralPath $runtimeDeveloperBuild) {
+    Remove-Item -LiteralPath $runtimeDeveloperBuild -Recurse -Force
+}
+$auroraExtern = Join-Path $workspace 'aurora-main\extern'
+Get-ChildItem -LiteralPath $auroraExtern -Directory -Force | Remove-Item -Recurse -Force
+Copy-Directory (Join-Path $repoRoot 'projects\mkwii') (Join-Path $workspace 'projects\mkwii')
+Copy-Item -LiteralPath (Join-Path $PSScriptRoot 'LocalBuild.ps1') -Destination (Join-Path $workspace 'LocalBuild.ps1')
+# LocalBuild.ps1 dot-sources the canonical configure flags from this sibling.
+Copy-Item -LiteralPath (Join-Path $PSScriptRoot 'NativeBuildFlags.ps1') -Destination (Join-Path $workspace 'NativeBuildFlags.ps1')
+[IO.Directory]::CreateDirectory((Join-Path $workspace 'Dependencies')) | Out-Null
+foreach ($name in $requiredDependencies) { Copy-Directory (Join-Path $dependencySources $name) (Join-Path $workspace "Dependencies\$name") }
+
+[IO.Directory]::CreateDirectory((Join-Path $payloadRoot 'host')) | Out-Null
+Copy-Item $setupHost (Join-Path $payloadRoot 'host\WiiCompiled-Setup.exe')
+
+Write-Host '[3/6] Writing manifests and third-party license inventory...'
+[IO.Directory]::CreateDirectory((Join-Path $payloadRoot 'licenses')) | Out-Null
+Copy-Item (Join-Path $portableTools 'README-LICENSES.txt') (Join-Path $payloadRoot 'licenses\Portable-build-tools.txt')
+Copy-Item (Join-Path $repoRoot 'aurora-main\LICENSE') (Join-Path $payloadRoot 'licenses\Aurora-LICENSE.txt')
+Copy-Item (Join-Path $dependencySources 'cppwinrt\LICENSE.txt') (Join-Path $payloadRoot 'licenses\CppWinRT-LICENSE.txt')
+# The precompiled aurora/third-party archives are built from the very sources
+# already shipped under build-workspace\Dependencies and aurora-main, so they add
+# no third-party component and therefore no new license obligation.
+$dolphinLicense = Join-Path (Split-Path -Parent $DolphinToolPath) 'COPYING'
+if (Test-Path $dolphinLicense) { Copy-Item $dolphinLicense (Join-Path $payloadRoot 'licenses\Dolphin-COPYING.txt') }
+@"
+DolphinTool source offer
+
+Project and complete corresponding source: https://github.com/dolphin-emu/dolphin
+Dolphin is licensed under GPLv2+ with additional per-file SPDX licenses.
+"@ | Set-Content (Join-Path $payloadRoot 'licenses\Dolphin-SOURCE.txt') -Encoding UTF8
+@"
+Microsoft Visual C++ Runtime
+
+Redistributable x64 runtime DLLs are included app-locally for DolphinTool and third-party renderer DLLs.
+Microsoft license terms: https://visualstudio.microsoft.com/license-terms/
+"@ | Set-Content (Join-Path $payloadRoot 'licenses\Microsoft-VC-Runtime.txt') -Encoding UTF8
+# Compute the payload's content identities once, here, with the same code every installed host
+# uses. Shipping them in the manifest is what keeps user machines from re-hashing the toolkit
+# during installation; only --repair-products re-derives content identity locally.
+Write-Host 'Computing the payload content identities (hashes the staged toolkit once)...'
+$identityJson = & $setupHost --emit-payload-identities --payload-root $payloadRoot
+if ($LASTEXITCODE -ne 0) { throw "Payload identity computation failed with exit code $LASTEXITCODE." }
+$identities = ($identityJson -join '') | ConvertFrom-Json
+foreach ($required in @('ToolkitFingerprint','TranslationFingerprint','NativeToolchainFingerprint',
+    'ToolkitPackageFingerprint','RuntimeAssetsFingerprint')) {
+    if ([string]::IsNullOrWhiteSpace($identities.$required)) { throw "Payload identity output is missing $required." }
+}
+
+$manifest = [ordered]@{
+    SchemaVersion = 2
+    ProductVersion = '0.2.13'
+    ExpectedGameId = $pins.GameId
+    ExpectedDolSha256 = $pins.DolSha256
+    ExpectedRelSha256 = $pins.RelSha256
+    ToolkitReleaseTag = if ($ToolkitReleaseTag) { $ToolkitReleaseTag } else { '' }
+    BuildModel = 'local-translation-and-compilation'
+    RetroWfcPayloadUri = $pins.RetroWfcPayloadUri
+    ToolkitFingerprint = $identities.ToolkitFingerprint
+    ToolkitPackageFingerprint = $identities.ToolkitPackageFingerprint
+    RuntimeAssetsFingerprint = $identities.RuntimeAssetsFingerprint
+    TranslationFingerprint = $identities.TranslationFingerprint
+    NativeToolchainFingerprint = $identities.NativeToolchainFingerprint
+}
+$manifest | ConvertTo-Json | Set-Content (Join-Path $payloadRoot 'payload-manifest.json') -Encoding UTF8
+
+Write-Host '[4/6] Enforcing the copyright and generated-code boundary...'
+& (Join-Path $PSScriptRoot 'Test-PayloadBoundary.ps1') -PayloadRoot $payloadRoot
+if ($LASTEXITCODE -ne 0) { throw 'Payload boundary audit failed.' }
+& (Join-Path $PSScriptRoot 'Test-NativeDependencies.ps1') -PayloadRoot $payloadRoot -SetupHost $setupHost `
+    -LlvmReadobjPath (Join-Path $portableTools 'llvm-mingw\bin\llvm-readobj.exe')
+if ($LASTEXITCODE -ne 0) { throw 'Native dependency audit failed.' }
+
+Write-Host '[5/6] Creating the canonical installer payload...'
+$payloadZip = Join-Path $workRoot 'payload.zip'
+Compress-Zip $payloadRoot $payloadZip @(
+    'Toolkit','BuildWorkspace','host','licenses','payload-manifest.json')
+
+Write-Host '[6/6] Producing the single-file setup executable...'
+$outputSetup = Join-Path $outputRoot 'WiiCompiled-Setup.exe'
+Copy-Item $setupHost $outputSetup -Force
+$outputStream = [IO.File]::Open($outputSetup, [IO.FileMode]::Append, [IO.FileAccess]::Write, [IO.FileShare]::None)
+try {
+    $offset = $outputStream.Position
+    $input = [IO.File]::OpenRead($payloadZip)
+    try { $input.CopyTo($outputStream) } finally { $input.Dispose() }
+    $length = $outputStream.Position - $offset
+    $writer = [IO.BinaryWriter]::new($outputStream, [Text.Encoding]::ASCII, $true)
+    try {
+        $writer.Write([Text.Encoding]::ASCII.GetBytes('MKWCPAY1'))
+        $writer.Write([Int64]$offset)
+        $writer.Write([Int64]$length)
+    } finally { $writer.Dispose() }
+} finally { $outputStream.Dispose() }
+
+$setupItem = Get-Item -LiteralPath $outputSetup
+Write-Host ("{0}: {1} MiB; SHA-256 {2}" -f $setupItem.Name,
+    [math]::Round($setupItem.Length / 1MB, 1), (Get-MkwFileSha256 $outputSetup))
diff --git a/Launcher/LocalBuild.ps1 b/Launcher/LocalBuild.ps1
new file mode 100644
index 0000000..4ecb371
--- /dev/null
+++ b/Launcher/LocalBuild.ps1
@@ -0,0 +1,460 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string]$Workspace,
+    [Parameter(Mandatory)] [string]$Toolkit,
+    # 'both' translates once (retro-aware) and compiles the two products from one build
+    # graph, which shares every profile-neutral shard object between them. Building the
+    # legs separately recompiles all of mkw_base_shared in the second leg, because the
+    # retro-aware shard emission changes the content identity of every base_common shard.
+    [Parameter(Mandatory)] [ValidateSet('base', 'retro-rewind', 'both')] [string]$Profile,
+    [Parameter(Mandatory)] [string]$OutputDirectory,
+    [string]$BaseOutputDirectory,
+    [string]$RetroRewindPackageDirectory,
+    [string]$RetroWfcOfflineDirectory,
+    [ValidateSet('offline', 'downloaded')] [string]$RetroWfcPayloadOrigin = 'offline',
+    [switch]$SkipRetroWfcPayload,
+    # The caller's recomputed cache-reuse identities (see ToolkitFingerprint.ComputeComponents).
+    # They are compared against the provenance recorded beside the caches themselves; a missing or
+    # mismatched identity degrades that cache to a clean rebuild, never the other way around.
+    [string]$TranslationFingerprint = '',
+    [string]$NativeToolchainFingerprint = '',
+    # Discards every cache first. Used when a product was reported broken/blocked, so a possibly
+    # corrupted translation or build directory can never contribute to the repaired product.
+    [switch]$ForceCleanBuild,
+    [int]$Parallel = 0
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+# Canonical configure flags (plus Assert-File / Invoke-Checked / Get-MkwFileSha256),
+# shared with launcher/Prepare-NativePrebuilt.ps1 so the precompiled aurora/third-party
+# archives and the objects compiled here can never be produced with different settings.
+# See NativeBuildFlags.ps1; Build-Installer.ps1 stages it beside this script.
+. (Join-Path $PSScriptRoot 'NativeBuildFlags.ps1')
+
+function Resolve-NativePrebuiltDirectory([string]$DependenciesDirectory, [string]$ToolchainBin, [string]$AuroraDirectory, [string]$ThirdPartyDirectory) {
+    <#
+    The shipped precompiled aurora/third-party package, verified against its recorded provenance
+    (exact compiler, exact flags) before use. Anything unexpected falls back to building from source.
+    #>
+    $package = Join-Path $DependenciesDirectory 'native_prebuilt'
+    $provenancePath = Join-Path $package 'provenance.json'
+    if (-not (Test-Path -LiteralPath $provenancePath -PathType Leaf)) {
+        Write-Host 'MKWCBUILD: No precompiled aurora package was shipped; building it from source'
+        return ''
+    }
+    try {
+        $provenance = Get-Content -LiteralPath $provenancePath -Raw | ConvertFrom-Json
+        $compiler = Join-Path $ToolchainBin 'clang-22.exe'
+        $compilerHash = Get-MkwFileSha256 $compiler
+        if ($provenance.CompilerSha256 -ne $compilerHash) {
+            Write-Host 'MKWCBUILD: The precompiled aurora package was built by a different compiler; building it from source'
+            return ''
+        }
+        if ($provenance.FlagFingerprint -ne (Get-MkwNativeFlagFingerprint)) {
+            Write-Host 'MKWCBUILD: The precompiled aurora package was built with different flags; building it from source'
+            return ''
+        }
+        # The archives embed Dawn's headers and link its import library, so a
+        # dawn_prebuilt tree that is not the one they were harvested against is
+        # an ABI mismatch that only shows up as a crash inside the GPU backend.
+        $recordedDawn = $provenance.PSObject.Properties['DawnRuntimeSha256']
+        if ($null -eq $recordedDawn -or
+            $recordedDawn.Value -ne (Get-MkwDawnRuntimeSha256 $DependenciesDirectory)) {
+            Write-Host 'MKWCBUILD: The precompiled aurora package was built against a different Dawn; building it from source'
+            return ''
+        }
+        # The archives are aurora; the runtime compiled here calls its headers.
+        # If this workspace's aurora sources are not the ones that were harvested
+        # (a newer toolkit, or a locally modified tree), linking the package would
+        # mix two versions of aurora, so build it from source instead.
+        $recordedAurora = $provenance.PSObject.Properties['AuroraSourceFingerprint']
+        if ($null -eq $recordedAurora -or
+            $recordedAurora.Value -ne (Get-MkwAuroraSourceFingerprint $AuroraDirectory)) {
+            Write-Host 'MKWCBUILD: The precompiled aurora package was built from different aurora sources; building it from source'
+            return ''
+        }
+        # Same reasoning for the vendored Crypto++ the package also carries:
+        # first-party TUs compile against this workspace's third_party headers,
+        # so a package harvested from an older tree must not be linked here.
+        $recordedThirdParty = $provenance.PSObject.Properties['ThirdPartySourceFingerprint']
+        if ($null -eq $recordedThirdParty -or
+            $recordedThirdParty.Value -ne (Get-MkwThirdPartySourceFingerprint $ThirdPartyDirectory)) {
+            Write-Host 'MKWCBUILD: The precompiled aurora package was built from different vendored third-party sources; building it from source'
+            return ''
+        }
+    } catch {
+        Write-Host "MKWCBUILD: The precompiled aurora package could not be validated ($($_.Exception.Message)); building it from source"
+        return ''
+    }
+    Write-Host 'MKWCBUILD: Using the precompiled aurora and third-party libraries'
+    return $package
+}
+
+function Write-MkwBuildStep([string]$StepId, [string]$Message) {
+    <#
+    Announces a build step. The identifier is the contract (BuildStepIds in
+    WiiCompiled.Setup/InstallProgress.cs); the trailing sentence is only for the log.
+    #>
+    Write-Host "MKWCBUILD:STEP:${StepId} $Message"
+}
+
+function Reset-LocalDirectory([string]$Path) {
+    $full = [IO.Path]::GetFullPath($Path)
+    $root = [IO.Path]::GetFullPath($Workspace).TrimEnd('\') + '\'
+    $installRoot = [IO.Path]::GetFullPath((Split-Path -Parent $Workspace)).TrimEnd('\') + '\'
+    # The caller-supplied output destinations are legitimate reset targets by
+    # definition, wherever the caller placed them: a fresh install's operation
+    # scratch lives beside the installation directory rather than inside it.
+    $allowedDestinations = @($OutputDirectory, $BaseOutputDirectory) |
+        Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+        ForEach-Object { [IO.Path]::GetFullPath($_).TrimEnd('\') }
+    $isAllowedDestination = $allowedDestinations |
+        Where-Object { $full.TrimEnd('\').Equals($_, [StringComparison]::OrdinalIgnoreCase) }
+    if (-not $isAllowedDestination -and
+        -not $full.StartsWith($root, [StringComparison]::OrdinalIgnoreCase) -and
+        -not $full.StartsWith($installRoot, [StringComparison]::OrdinalIgnoreCase)) {
+        throw "Refusing to reset a directory outside the local build workspace: $full"
+    }
+    if (Test-Path -LiteralPath $full) { Remove-Item -LiteralPath $full -Recurse -Force }
+    [IO.Directory]::CreateDirectory($full) | Out-Null
+}
+
+$Workspace = [IO.Path]::GetFullPath($Workspace)
+$Toolkit = [IO.Path]::GetFullPath($Toolkit)
+$OutputDirectory = [IO.Path]::GetFullPath($OutputDirectory)
+if (-not [string]::IsNullOrWhiteSpace($BaseOutputDirectory)) {
+    $BaseOutputDirectory = [IO.Path]::GetFullPath($BaseOutputDirectory)
+}
+if (-not [string]::IsNullOrWhiteSpace($RetroRewindPackageDirectory)) {
+    $RetroRewindPackageDirectory = [IO.Path]::GetFullPath($RetroRewindPackageDirectory)
+}
+if (-not [string]::IsNullOrWhiteSpace($RetroWfcOfflineDirectory)) {
+    $RetroWfcOfflineDirectory = [IO.Path]::GetFullPath($RetroWfcOfflineDirectory)
+}
+$hasOfflineRetroWfc = -not [string]::IsNullOrWhiteSpace($RetroWfcOfflineDirectory)
+$buildsRetro = $Profile -in @('retro-rewind', 'both')
+if (-not $buildsRetro -and ($hasOfflineRetroWfc -or $SkipRetroWfcPayload)) {
+    throw 'Retro-WFC payload options are valid only for a Retro Rewind build.'
+}
+if ($buildsRetro -and ($hasOfflineRetroWfc -eq [bool]$SkipRetroWfcPayload)) {
+    throw 'Choose exactly one Retro-WFC mode: -RetroWfcOfflineDirectory or -SkipRetroWfcPayload.'
+}
+if (-not $buildsRetro -and -not [string]::IsNullOrWhiteSpace($RetroRewindPackageDirectory)) {
+    throw '-RetroRewindPackageDirectory is valid only for a Retro Rewind build.'
+}
+if ($Profile -eq 'both' -and [string]::IsNullOrWhiteSpace($BaseOutputDirectory)) {
+    throw "-BaseOutputDirectory is required with -Profile both; -OutputDirectory receives the Retro Rewind product."
+}
+if ($Profile -ne 'both' -and -not [string]::IsNullOrWhiteSpace($BaseOutputDirectory)) {
+    throw '-BaseOutputDirectory is valid only with -Profile both.'
+}
+$translator = Join-Path $Toolkit 'Translator\Translator.Cli.exe'
+$cmake = Join-Path $Toolkit 'CMake\bin\cmake.exe'
+$ninja = Join-Path $Toolkit 'Ninja\ninja.exe'
+$toolchainBin = Join-Path $Toolkit 'llvm-mingw\bin'
+$cc = Join-Path $toolchainBin 'x86_64-w64-mingw32-clang.exe'
+$cxx = Join-Path $toolchainBin 'x86_64-w64-mingw32-clang++.exe'
+$windres = Join-Path $toolchainBin 'x86_64-w64-mingw32-windres.exe'
+$project = Join-Path $Workspace 'projects\mkwii\recomp.yml'
+$assets = Join-Path $Workspace 'Assets'
+$generated = Join-Path $Workspace 'generated'
+$functions = Join-Path $generated 'functions'
+$baseMetadata = Join-Path $generated 'base_translation_output.json'
+$baseManifestDir = Join-Path $Workspace 'build\base'
+$baseManifest = Join-Path $baseManifestDir 'mkwii_base_manifest.json'
+$shards = Join-Path $generated 'build_shards'
+$build = Join-Path $Workspace 'native-build'
+$retroRoot = if ([string]::IsNullOrWhiteSpace($RetroRewindPackageDirectory)) {
+    Join-Path $Workspace 'PulsarPacks\completed\RetroRewind\RetroRewind6'
+} else {
+    $RetroRewindPackageDirectory
+}
+
+foreach ($required in @(
+    @($translator, 'Bundled translator'), @($cmake, 'Bundled CMake'), @($ninja, 'Bundled Ninja'),
+    @($cc, 'Bundled C compiler'), @($cxx, 'Bundled C++ compiler'), @($windres, 'Bundled resource compiler'), @($project, 'Translation project'),
+    @((Join-Path $assets 'main.dol'), 'Extracted main.dol'), @((Join-Path $assets 'StaticR.rel'), 'Extracted StaticR.rel')
+)) { Assert-File $required[0] $required[1] }
+
+# Everything Mario-Kart-specific this script needs is read from the project file rather than
+# restated here: the translation entry point below, and (through the retro-rewind profile the
+# translator loads itself) the module guest/link bases the mod translation uses.
+$pins = Get-MkwProjectPins $project
+
+# Three independent knobs: $translatorThreads (the translator's own worker threads; peak memory is
+# one heap that barely moves with thread count, so clamping it only slows translation), $translatedJobs
+# (the real RAM guard, capping concurrent clang compiles of memory-hungry translated TUs via the Ninja
+# MKW_TRANSLATED_COMPILE_JOBS pool), and $globalJobs (Ninja's overall parallelism for everything else).
+# An explicit -Parallel pins all three.
+$memoryGiB = [math]::Max(1, [math]::Floor((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB))
+if ($Parallel -gt 0) {
+    $translatorThreads = $Parallel
+    $translatedJobs = $Parallel
+    $globalJobs = $Parallel
+} else {
+    $translatorThreads = [math]::Max(1, [math]::Min([Environment]::ProcessorCount, 16))
+    $translatedJobs = [math]::Max(1, [math]::Min([Environment]::ProcessorCount,
+        [math]::Floor($memoryGiB / 2)))
+    $globalJobs = [math]::Max($translatedJobs, [Environment]::ProcessorCount)
+}
+
+$oldPath = $env:PATH
+$oldDotnet = $env:DOTNET_ROOT
+try {
+    $env:PATH = Get-MkwToolchainPath $Toolkit
+    Remove-Item Env:DOTNET_ROOT -ErrorAction SilentlyContinue
+    Push-Location $Workspace
+    try {
+        # This script is the single owner of every cache-reuse decision: it is what would misbuild.
+        # The caller only supplies the identities to compare recorded provenance against.
+        $translationProvenance = Join-Path $generated 'translation-provenance.json'
+        $toolchainProvenance = Join-Path $build 'toolchain-provenance.json'
+
+        function Get-RecordedFingerprint([string]$Path, [string]$Property) {
+            if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return '' }
+            try {
+                $record = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+                $value = $record.PSObject.Properties[$Property]
+                if ($null -eq $value -or [string]::IsNullOrWhiteSpace($value.Value)) { return '' }
+                return [string]$value.Value
+            } catch { return '' }
+        }
+
+        if ($ForceCleanBuild) {
+            Write-Host 'MKWCBUILD: A clean build was requested; discarding every translation and build cache'
+            Reset-LocalDirectory $generated
+            if (Test-Path -LiteralPath $baseManifestDir) { Remove-Item -LiteralPath $baseManifestDir -Recurse -Force }
+            if (Test-Path -LiteralPath $build) { Remove-Item -LiteralPath $build -Recurse -Force }
+        }
+
+        # Reused only when its exact inputs match, its artifacts survived, and (for a modded build) it
+        # already knows this Code.pul. Otherwise it retranslates incrementally: content-addressed
+        # outputs plus --prune-stale mean Ninja only recompiles shards whose bytes actually moved.
+        $reuseBase = $false
+        if (-not $ForceCleanBuild -and -not [string]::IsNullOrWhiteSpace($TranslationFingerprint) -and
+            (Get-RecordedFingerprint $translationProvenance 'TranslationFingerprint') -eq $TranslationFingerprint) {
+            $artifacts = @($baseMetadata, $baseManifest, (Join-Path $generated 'base_translation_sources.bin'),
+                (Join-Path $generated 'base_translation_mod_awareness.json'))
+            $reuseBase = -not ($artifacts | Where-Object { -not (Test-Path -LiteralPath $_ -PathType Leaf) })
+        }
+        if ($buildsRetro) {
+            # The translator discovers mods through the project file's workspace-relative profile
+            # paths, and both the base and the mod leg block leaf inlining at every address those
+            # profiles patch. A staged install workspace ships without any mod payload, so the
+            # selected Retro Rewind Code.pul must sit at the profile's mod_root before either leg
+            # runs - and it must be this build's pul, not the one a previous build left behind.
+            $awarenessBinaries = Join-Path $Workspace 'PulsarPacks\completed\RetroRewind\RetroRewind6\Binaries'
+            $sourcePul = Join-Path $retroRoot 'Binaries\Code.pul'
+            Assert-File $sourcePul 'Retro Rewind Code.pul'
+            [IO.Directory]::CreateDirectory($awarenessBinaries) | Out-Null
+            $stagedPul = Join-Path $awarenessBinaries 'Code.pul'
+            if (-not $stagedPul.Equals($sourcePul, [StringComparison]::OrdinalIgnoreCase)) {
+                Copy-Item -LiteralPath $sourcePul -Destination $stagedPul -Force
+            }
+        }
+
+        if ($reuseBase -and $buildsRetro) {
+            # The base translation bakes leaf-inlining and residency decisions around the mod patch
+            # sets it knew about when it ran, and it records that knowledge as a modPatchAwareness
+            # stamp. A base tree that never saw this Code.pul would silently bake vanilla code into
+            # the modded product, so it may only be reused once that has been ruled out.
+            $retroCodePul = Join-Path $retroRoot 'Binaries\Code.pul'
+            Assert-File $retroCodePul 'Retro Rewind Code.pul'
+            $pulSha = Get-MkwFileSha256 $retroCodePul
+            # The metadata file is tens of megabytes of machine-written JSON; a raw substring probe
+            # for the uniquely named stamp field avoids a multi-minute ConvertFrom-Json parse.
+            $rawMetadata = [IO.File]::ReadAllText($baseMetadata)
+            if (-not $rawMetadata.Contains('"codePulSha256":"' + $pulSha + '"')) {
+                # A different Code.pul is not automatically a different base translation: the base
+                # reads a pul for one thing, the addresses it patches, so a pul that patches the
+                # same translated functions produces the same base tree. Only the translator can
+                # decide that - it takes parsing the Kamek patch set against the recorded translated
+                # function ranges - and it fails closed, so anything but exit 0 retranslates.
+                & $translator @(
+                    'check-base-mod-awareness', '--project', $project, '--profile', 'retro-rewind',
+                    '--translation-output-metadata', $baseMetadata, '--code-pul', $retroCodePul
+                ) | Write-Host
+                if ($LASTEXITCODE -ne 0) {
+                    Write-MkwBuildStep 'retranslate-base' 'The base translation is stale; retranslating the base game for the new Code.pul'
+                    $reuseBase = $false
+                }
+            }
+        }
+
+        if ($reuseBase) {
+            Write-MkwBuildStep 'reuse-base-translation' 'Reusing the completed base translation'
+        } else {
+            # A failed translation must never leave provenance claiming the old outputs are current.
+            if (Test-Path -LiteralPath $translationProvenance) { Remove-Item -LiteralPath $translationProvenance -Force }
+            [IO.Directory]::CreateDirectory($generated) | Out-Null
+            [IO.Directory]::CreateDirectory($baseManifestDir) | Out-Null
+
+            # No --clean-outdir: shard names are content-addressed and unchanged files keep their
+            # bytes and mtimes, which is exactly what lets Ninja skip them. --prune-stale (active
+            # only without --clean-outdir) removes everything the new translation no longer emits.
+            Invoke-Checked $translator @(
+                'translate-recursive', $pins.EntryPoint, '--project', $project,
+                '--outdir', $functions, '--output-metadata', $baseMetadata,
+                '--production-source-bundle', (Join-Path $generated 'base_translation_sources.bin'),
+                '--no-function-files', '--prune-stale', '--threads', $translatorThreads
+            ) 'Translating the user-owned base game' -StepId 'translate-base'
+
+            Invoke-Checked $translator @(
+                'emit-base-manifest', '--project', $project, '--out', $baseManifestDir,
+                '--functions-dir', $functions, '--translation-output-metadata', $baseMetadata, '--region', 'P'
+            ) 'Creating the local base translation manifest' -StepId 'emit-base-manifest'
+
+            if (-not [string]::IsNullOrWhiteSpace($TranslationFingerprint)) {
+                [ordered]@{ SchemaVersion = 1; TranslationFingerprint = $TranslationFingerprint } |
+                    ConvertTo-Json | Set-Content -LiteralPath $translationProvenance -Encoding UTF8
+            }
+        }
+
+        if ($buildsRetro) {
+            $codePul = Join-Path $retroRoot 'Binaries\Code.pul'
+            Assert-File $codePul 'Retro Rewind Code.pul'
+            $retroOut = Join-Path $Workspace 'build\mods\retro_rewind_full_cpp'
+            $translateModArguments = @(
+                'translate-mod', '--project', $project, '--profile', 'retro-rewind',
+                '--base-manifest', $baseManifest, '--base-translation-output-metadata', $baseMetadata,
+                '--code-pul', $codePul, '--mod-root', $retroRoot, '--mod-name', 'Retro Rewind',
+                '--region', 'P', '--out', $retroOut, '--prefer-cached-inputs', '--emit-cpp',
+                '--threads', $translatorThreads
+            )
+            if ($SkipRetroWfcPayload) {
+                $translateModArguments += '--skip-retro-wfc'
+            } elseif (-not [string]::IsNullOrWhiteSpace($RetroWfcOfflineDirectory)) {
+                $offlineRoot = [IO.Path]::GetFullPath($RetroWfcOfflineDirectory)
+                $offlinePayload = Join-Path $offlineRoot 'binary\payload.RMCPD00.bin'
+                Assert-File $offlinePayload 'Offline Retro-WFC shared payload'
+                $translateModArguments += @('--retro-wfc-payload', $offlinePayload)
+            } else {
+                throw 'Retro Rewind requires either -RetroWfcOfflineDirectory or -SkipRetroWfcPayload.'
+            }
+            Invoke-Checked $translator $translateModArguments 'Translating the selected Retro Rewind Code.pul' `
+                -StepId 'translate-mod'
+        }
+
+        Invoke-Checked $translator @('generate-data-init', '--project', $project) `
+            'Generating local game data initialization' -StepId 'generate-data-init'
+
+        $shardArgs = @(
+            'emit-build-shards', '--project', $project, '--base-metadata', $baseMetadata,
+            '--base-functions-dir', $functions,
+            '--native-source-dir', (Join-Path $Workspace 'runtime\src'), '--out', $shards
+        )
+        if ($buildsRetro) {
+            $retroOut = Join-Path $Workspace 'build\mods\retro_rewind_full_cpp'
+            $shardArgs += @('--resolved-profile', (Join-Path $retroOut 'resolved_dispatch_profile.json'),
+                '--retro-cpp-dir', (Join-Path $retroOut 'cpp'))
+        }
+        Invoke-Checked $translator $shardArgs 'Preparing local native build shards' -StepId 'emit-build-shards'
+
+        # The build directory is kept whenever the exact toolchain that filled it is the one
+        # installed now and its CMake cache still belongs to this workspace path. Object files are
+        # only ever unsafe to reuse when the compiler/flags changed - source changes are what
+        # CMake/Ninja exist to track, so a kept directory turns a small runtime or dependency
+        # change into a recompile of just the affected objects instead of every shard.
+        if (Test-Path -LiteralPath $build) {
+            $keepNativeBuild = -not [string]::IsNullOrWhiteSpace($NativeToolchainFingerprint) -and
+                (Get-RecordedFingerprint $toolchainProvenance 'NativeToolchainFingerprint') -eq $NativeToolchainFingerprint -and
+                (Test-Path -LiteralPath (Join-Path $build 'CMakeCache.txt') -PathType Leaf)
+            if ($keepNativeBuild) {
+                # A moved workspace invalidates every absolute path in the cache; CMake would hard
+                # error rather than reconfigure. Move healing already deletes the directory for
+                # portable installs, so this only fires for hand-moved trees.
+                $expectedHome = (Join-Path $Workspace 'runtime')
+                $cacheHome = Select-String -LiteralPath (Join-Path $build 'CMakeCache.txt') `
+                    -Pattern '^CMAKE_HOME_DIRECTORY:INTERNAL=(.*)$' | Select-Object -First 1
+                if ($null -eq $cacheHome -or
+                    -not [string]::Equals([IO.Path]::GetFullPath($cacheHome.Matches[0].Groups[1].Value),
+                        [IO.Path]::GetFullPath($expectedHome), [StringComparison]::OrdinalIgnoreCase)) {
+                    $keepNativeBuild = $false
+                }
+            }
+            if ($keepNativeBuild) {
+                Write-Host 'MKWCBUILD: Reusing the incremental native build directory'
+            } else {
+                Write-Host 'MKWCBUILD: The native build cache does not belong to this toolchain; rebuilding from scratch'
+                Remove-Item -LiteralPath $build -Recurse -Force
+            }
+        }
+        $dependencies = Join-Path $Workspace 'Dependencies'
+        $nativePrebuilt = Resolve-NativePrebuiltDirectory $dependencies $toolchainBin `
+            (Join-Path $Workspace 'aurora-main') (Join-Path $Workspace 'runtime\third_party')
+        $configure = Get-MkwNativeConfigureArguments `
+            -SourceDirectory (Join-Path $Workspace 'runtime') -BuildDirectory $build `
+            -Ninja $ninja -CCompiler $cc -CxxCompiler $cxx -ResourceCompiler $windres `
+            -DependenciesDirectory $dependencies -NativePrebuiltDirectory $nativePrebuilt `
+            -AdditionalArguments @("-DMKW_TRANSLATED_COMPILE_JOBS=$translatedJobs")
+        Invoke-Checked $cmake $configure 'Configuring the bundled native toolchain' -StepId 'configure-native'
+        if (-not [string]::IsNullOrWhiteSpace($NativeToolchainFingerprint)) {
+            [ordered]@{ SchemaVersion = 1; NativeToolchainFingerprint = $NativeToolchainFingerprint } |
+                ConvertTo-Json | Set-Content -LiteralPath $toolchainProvenance -Encoding UTF8
+        }
+        $targets = switch ($Profile) {
+            'base' { @('WiiCompiled') }
+            'retro-rewind' { @('RetroRewind') }
+            'both' { @('WiiCompiled', 'RetroRewind') }
+        }
+        $buildArguments = @('--build', $build)
+        foreach ($target in $targets) { $buildArguments += @('--target', $target) }
+        $buildArguments += @('--parallel', $globalJobs)
+        Invoke-Checked $cmake $buildArguments "Compiling $($targets -join ' and ') locally" -StepId 'compile'
+
+        # Hashed once here; every published product records the same digests.
+        $dolSha = Get-MkwFileSha256 (Join-Path $assets 'main.dol')
+        $relSha = Get-MkwFileSha256 (Join-Path $assets 'StaticR.rel')
+        $compilerSha = Get-MkwFileSha256 (Join-Path $toolchainBin 'clang-22.exe')
+
+        function Publish-BuiltProduct([string]$Target, [string]$Destination, [string]$ProvenanceProfile) {
+            Reset-LocalDirectory $Destination
+            $exe = Join-Path $build "$Target.exe"
+            Assert-File $exe 'Locally compiled game executable'
+            Copy-Item -LiteralPath $exe -Destination (Join-Path $Destination "$Target.exe")
+            foreach ($name in @('dxcompiler.dll','dxil.dll','libc++.dll','libpng16.dll','libunwind.dll','libz.dll','SDL3.dll','sqlite3.dll','webgpu_dawn.dll','z.dll','noshaders.zip','dsp_coef.bin','initial_pipeline_cache.db')) {
+                $file = Join-Path $build $name
+                if (Test-Path -LiteralPath $file -PathType Leaf) { Copy-Item -LiteralPath $file -Destination $Destination }
+            }
+            $redist = Join-Path $Toolkit 'Redist'
+            if (Test-Path -LiteralPath $redist -PathType Container) {
+                Copy-Item -Path (Join-Path $redist '*.dll') -Destination $Destination -Force
+            }
+            foreach ($name in @('config','wii_bootstrap')) {
+                $directory = Join-Path $build $name
+                if (Test-Path -LiteralPath $directory -PathType Container) {
+                    Copy-Item -LiteralPath $directory -Destination (Join-Path $Destination $name) -Recurse
+                }
+            }
+            $isRetro = $ProvenanceProfile -eq 'retro-rewind'
+            $provenance = [ordered]@{
+                SchemaVersion = 1
+                Profile = $ProvenanceProfile
+                BuiltUtc = [DateTime]::UtcNow.ToString('O')
+                DolSha256 = $dolSha
+                RelSha256 = $relSha
+                CodePulSha256 = if ($isRetro) { Get-MkwFileSha256 (Join-Path $retroRoot 'Binaries\Code.pul') } else { $null }
+                RetroWfcPayloadMode = if (-not $isRetro) { $null } elseif ($SkipRetroWfcPayload) { 'skipped' } else { $RetroWfcPayloadOrigin }
+                RetroWfcPayloadSha256 = if ($isRetro -and -not $SkipRetroWfcPayload) { Get-MkwFileSha256 (Join-Path $RetroWfcOfflineDirectory 'binary\payload.RMCPD00.bin') } else { $null }
+                RetroWfcPayloadLength = if ($isRetro -and -not $SkipRetroWfcPayload) { (Get-Item -LiteralPath (Join-Path $RetroWfcOfflineDirectory 'binary\payload.RMCPD00.bin')).Length } else { $null }
+                Compiler = "llvm-mingw clang-22 sha256:$compilerSha"
+            }
+            $provenance | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $Destination 'local-build.json') -Encoding UTF8
+        }
+
+        if ($Profile -eq 'both') {
+            Publish-BuiltProduct 'WiiCompiled' $BaseOutputDirectory 'base'
+            Publish-BuiltProduct 'RetroRewind' $OutputDirectory 'retro-rewind'
+        } elseif ($Profile -eq 'retro-rewind') {
+            Publish-BuiltProduct 'RetroRewind' $OutputDirectory 'retro-rewind'
+        } else {
+            Publish-BuiltProduct 'WiiCompiled' $OutputDirectory 'base'
+        }
+        Write-Host "MKWCBUILD:OUTPUT=$OutputDirectory"
+    } finally { Pop-Location }
+} finally {
+    $env:PATH = $oldPath
+    if ($null -ne $oldDotnet) { $env:DOTNET_ROOT = $oldDotnet }
+}
diff --git a/Launcher/NativeBuildFlags.ps1 b/Launcher/NativeBuildFlags.ps1
new file mode 100644
index 0000000..f7adb3e
--- /dev/null
+++ b/Launcher/NativeBuildFlags.ps1
@@ -0,0 +1,264 @@
+# Canonical native (CMake) configure flags, plus the shared helpers (file assertions, checked
+# process spawn, file hashing) both LocalBuild.ps1 and Prepare-NativePrebuilt.ps1 dot-source.
+# They MUST stay byte-identical: the prebuilt package ships static archives linked into objects
+# the user's machine compiles, so any flag divergence is an ABI/ODR hazard, not just a rebuild.
+# The flag fingerprint below is recorded in the package provenance and re-checked before use.
+
+Set-StrictMode -Version 3.0
+
+function Assert-File([string]$Path, [string]$Description) {
+    if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { throw "$Description is missing: $Path" }
+}
+
+function Assert-Directory([string]$Path, [string]$Description) {
+    if (-not (Test-Path -LiteralPath $Path -PathType Container)) { throw "$Description is missing: $Path" }
+}
+
+function Get-MkwFileSha256([string]$Path) {
+    <#
+    Lower-case SHA-256 of one file. -LiteralPath is required: Get-FileHash treats a positional
+    path as a wildcard, so an install directory containing [, ] or * would hash the wrong file.
+    #>
+    return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+
+function Get-MkwToolchainPath([string]$ToolchainRoot) {
+    <#
+    The scrubbed PATH a bundled-toolchain build runs with. The bundled toolchain must be the only
+    one visible, or an ambient Visual Studio/MSYS install on PATH could pull in its own headers,
+    libraries, or linker. Shared by LocalBuild.ps1 and Prepare-NativePrebuilt.ps1 since the
+    installed Toolkit and the maintainer portable-tools tree share the same subdirectory layout.
+    #>
+    if ([string]::IsNullOrWhiteSpace($ToolchainRoot)) { throw 'A toolchain root is required.' }
+    $root = [IO.Path]::GetFullPath($ToolchainRoot)
+    return (@(
+        (Join-Path $root 'llvm-mingw\bin'),
+        (Join-Path $root 'CMake\bin'),
+        (Join-Path $root 'Ninja'),
+        (Join-Path $env:SystemRoot 'System32'),
+        $env:SystemRoot
+    ) -join ';')
+}
+
+function Get-MkwProjectPins([string]$ProjectFile) {
+    <#
+    The Mario Kart Wii facts pinned by projects/mkwii/recomp.yml (game identity, clean input
+    digests, translation entry point, Retro-WFC endpoint), read from one place instead of being
+    restated; Test-PinnedFacts.ps1 checks the copies that can't read YAML (C++ header, C#
+    constants) against these values. Parsing is literal, not a YAML dependency, since the file is
+    machine-written with a fixed shape.
+    #>
+    Assert-File $ProjectFile 'Translation project file'
+    $pins = [ordered]@{
+        GameId = ''; DolSha256 = ''; RelSha256 = ''; EntryPoint = ''; RetroWfcPayloadUri = ''
+    }
+    $section = ''
+    $inputKey = ''
+    foreach ($raw in [IO.File]::ReadAllLines($ProjectFile)) {
+        $line = ($raw -replace '#.*$', '')
+        if ([string]::IsNullOrWhiteSpace($line)) { continue }
+        if ($line -match '^([A-Za-z0-9_]+):') { $section = $Matches[1]; $inputKey = ''; continue }
+        if ($section -eq 'inputs' -and $line -match '^\s{2}([A-Za-z0-9_]+):\s*$') { $inputKey = $Matches[1]; continue }
+        if ($section -eq 'project' -and $line -match '^\s*game_id:\s*(\S+)\s*$') {
+            $pins.GameId = $Matches[1]
+        } elseif ($section -eq 'inputs' -and $line -match '^\s*sha256:\s*([0-9a-fA-F]{64})\s*$') {
+            if ($inputKey -eq 'dol') { $pins.DolSha256 = $Matches[1].ToLowerInvariant() }
+            elseif ($inputKey -eq 'rel') { $pins.RelSha256 = $Matches[1].ToLowerInvariant() }
+        } elseif ($section -eq 'translation' -and $pins.EntryPoint -eq '' -and
+                  $line -match '^\s*-\s*(0[xX][0-9a-fA-F]+)\s*$') {
+            $pins.EntryPoint = $Matches[1].ToLowerInvariant()
+        } elseif ($line -match '^\s*retro_wfc_payload:\s*(\S+)\s*$') {
+            $pins.RetroWfcPayloadUri = $Matches[1]
+        }
+    }
+    foreach ($name in @($pins.Keys)) {
+        if ([string]::IsNullOrWhiteSpace($pins[$name])) {
+            throw "$ProjectFile does not pin $name; the project file is not the shape this build expects."
+        }
+    }
+    return $pins
+}
+
+function Invoke-Checked([string]$FilePath, [string[]]$Arguments, [string]$Description,
+    [string]$LogPrefix = 'MKWCBUILD', [string]$StepId = '') {
+    <#
+    Runs a build tool and turns a non-zero exit code into a described failure. Start-Process -Wait
+    is deliberate: it waits for the whole process tree, since a .NET single-file bundle host may
+    hand off to an extracted child that PowerShell's call operator would not wait for. Start-Process
+    doesn't publish $LASTEXITCODE, so this sets it manually for callers that check it.
+    -StepId emits the machine-readable form the installer's progress bar consumes (BuildStepIds in
+    WiiCompiled.Setup/InstallProgress.cs); the human sentence stays on the same log line.
+    #>
+    if ($StepId) { Write-Host "${LogPrefix}:STEP:${StepId} $Description" }
+    else { Write-Host "${LogPrefix}: $Description" }
+    $quotedArguments = @($Arguments | ForEach-Object {
+        if ($_.Contains('"')) { throw "A native build argument contains an unsupported quote: $_" }
+        '"' + $_ + '"'
+    })
+    $process = Start-Process -FilePath $FilePath -ArgumentList $quotedArguments `
+        -NoNewWindow -Wait -PassThru
+    $exitCode = $process.ExitCode
+    $global:LASTEXITCODE = $exitCode
+    if ($exitCode -ne 0) { throw "$Description failed with exit code $exitCode." }
+}
+
+function Get-MkwNativeFixedConfigureFlags {
+    <#
+    The path-independent half of the configure command line, identical on every machine, which is
+    what makes one precompiled aurora/third-party package valid for all users. Path-bearing
+    arguments are added separately by Get-MkwNativeConfigureArguments and excluded from the fingerprint.
+    #>
+    return @(
+        '-DCMAKE_BUILD_TYPE=Release',
+        '-DCMAKE_SYSTEM_PROCESSOR=x86_64',
+        '-DAURORA_DAWN_PROVIDER=package', '-DAURORA_SDL3_PROVIDER=vendor',
+        '-DCMAKE_POLICY_DEFAULT_CMP0168=NEW', '-DFETCHCONTENT_FULLY_DISCONNECTED=ON',
+        '-DAWK:FILEPATH='
+    )
+}
+
+function Get-MkwNativeFlagFingerprint {
+    <#
+    .SYNOPSIS
+    SHA-256 over the canonical flag list, used to reject a stale package.
+    #>
+    $canonical = (Get-MkwNativeFixedConfigureFlags) -join "`n"
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        $bytes = $sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical))
+    } finally { $sha.Dispose() }
+    return (($bytes | ForEach-Object { $_.ToString('x2') }) -join '')
+}
+
+function Get-MkwDawnRuntimeSha256([string]$DependenciesDirectory) {
+    <#
+    SHA-256 of the pinned Dawn runtime the prebuilt aurora must match. The precompiled aurora
+    archives are compiled and linked against the pinned dawn_prebuilt tree's headers/import
+    library, but the upstream release asset is mutable (the same version tag has already served
+    two different windows-amd64 archives), so the version string alone can't prove agreement.
+    A mismatch surfaces as an access violation at surface creation, not a link error, so the
+    digest is recorded at harvest and re-checked before use. Returns '' when the tree is absent.
+    #>
+    if ([string]::IsNullOrWhiteSpace($DependenciesDirectory)) { return '' }
+    $runtime = Join-Path $DependenciesDirectory 'dawn_prebuilt\bin\webgpu_dawn.dll'
+    if (-not (Test-Path -LiteralPath $runtime -PathType Leaf)) { return '' }
+    return Get-MkwFileSha256 $runtime
+}
+
+function Get-MkwThirdPartySourceFingerprint([string]$ThirdPartyDirectory) {
+    <#
+    SHA-256 over runtime/third_party, the vendored sources behind the prebuilt package. The
+    precompiled Crypto++ archive is linked while first-party TUs compile against the same headers,
+    so a workspace whose vendored tree moved on must not consume archives harvested from an older
+    one (same reasoning as the aurora fingerprint below). Unlike that scan this hashes hidden files
+    too, since Build-Installer stages this tree with Copy-Item -Force. Returns '' when absent.
+    #>
+    if ([string]::IsNullOrWhiteSpace($ThirdPartyDirectory)) { return '' }
+    if (-not (Test-Path -LiteralPath $ThirdPartyDirectory -PathType Container)) { return '' }
+    $root = [IO.Path]::GetFullPath($ThirdPartyDirectory).TrimEnd('\')
+    $files = Get-ChildItem -LiteralPath $root -Recurse -File |
+        Sort-Object { $_.FullName.Substring($root.Length + 1).Replace('\', '/') }
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        $builder = [Text.StringBuilder]::new()
+        foreach ($file in $files) {
+            $relative = $file.FullName.Substring($root.Length + 1).Replace('\', '/')
+            $content = Get-MkwFileSha256 $file.FullName
+            [void]$builder.Append($relative).Append(' ').Append($content).Append("`n")
+        }
+        $bytes = $sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($builder.ToString()))
+    } finally { $sha.Dispose() }
+    return (($bytes | ForEach-Object { $_.ToString('x2') }) -join '')
+}
+
+function Get-MkwAuroraSourceFingerprint([string]$AuroraDirectory) {
+    <#
+    SHA-256 over the aurora sources the precompiled archives were harvested from. The compiler,
+    flag, and Dawn digests only prove the package agrees with its target environment; none notice
+    aurora itself moving on, and since the runtime calls aurora headers directly, a package
+    harvested before an aurora change links old code against new call sites (undefined symbol at
+    best, silently stale renderer at worst). extern/ is excluded because the payload ships those
+    trees separately. Returns '' when the tree is absent.
+    #>
+    if ([string]::IsNullOrWhiteSpace($AuroraDirectory)) { return '' }
+    if (-not (Test-Path -LiteralPath $AuroraDirectory -PathType Container)) { return '' }
+    $root = [IO.Path]::GetFullPath($AuroraDirectory).TrimEnd('\')
+    $excludedPrefixes = @(
+        (Join-Path $root 'extern') + '\',
+        (Join-Path $root 'build') + '\'
+    )
+    # Hidden files are skipped deliberately: Build-Installer.ps1 stages this tree
+    # with Copy-Item -Recurse (no -Force), so they never reach the payload and
+    # hashing them would make the two sides disagree by construction.
+    $files = Get-ChildItem -LiteralPath $root -Recurse -File |
+        Where-Object {
+            $full = $_.FullName
+            -not ($excludedPrefixes | Where-Object { $full.StartsWith($_, [StringComparison]::OrdinalIgnoreCase) })
+        } |
+        Sort-Object { $_.FullName.Substring($root.Length + 1).Replace('\', '/') }
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try {
+        $builder = [Text.StringBuilder]::new()
+        foreach ($file in $files) {
+            $relative = $file.FullName.Substring($root.Length + 1).Replace('\', '/')
+            $content = Get-MkwFileSha256 $file.FullName
+            [void]$builder.Append($relative).Append(' ').Append($content).Append("`n")
+        }
+        $bytes = $sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($builder.ToString()))
+    } finally { $sha.Dispose() }
+    return (($bytes | ForEach-Object { $_.ToString('x2') }) -join '')
+}
+
+function ConvertTo-MkwCMakePath([string]$Path) {
+    return [IO.Path]::GetFullPath($Path).Replace('\', '/')
+}
+
+function Get-MkwNativeConfigureArguments {
+    <# The complete `cmake` configure argument list for a local runtime build. #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)] [string]$SourceDirectory,
+        [Parameter(Mandatory)] [string]$BuildDirectory,
+        [Parameter(Mandatory)] [string]$Ninja,
+        [Parameter(Mandatory)] [string]$CCompiler,
+        [Parameter(Mandatory)] [string]$CxxCompiler,
+        [Parameter(Mandatory)] [string]$ResourceCompiler,
+        [string]$DependenciesDirectory,
+        [string]$NativePrebuiltDirectory,
+        [string[]]$AdditionalArguments = @()
+    )
+
+    $arguments = @(
+        '-S', (ConvertTo-MkwCMakePath $SourceDirectory),
+        '-B', (ConvertTo-MkwCMakePath $BuildDirectory),
+        '-G', 'Ninja',
+        "-DCMAKE_MAKE_PROGRAM=$(ConvertTo-MkwCMakePath $Ninja)",
+        "-DCMAKE_C_COMPILER=$(ConvertTo-MkwCMakePath $CCompiler)",
+        "-DCMAKE_CXX_COMPILER=$(ConvertTo-MkwCMakePath $CxxCompiler)",
+        "-DCMAKE_RC_COMPILER=$(ConvertTo-MkwCMakePath $ResourceCompiler)"
+    )
+    $arguments += Get-MkwNativeFixedConfigureFlags
+
+    if (-not [string]::IsNullOrWhiteSpace($DependenciesDirectory) -and
+        (Test-Path -LiteralPath $DependenciesDirectory -PathType Container)) {
+        $cppWinRt = Join-Path $DependenciesDirectory 'cppwinrt'
+        if (Test-Path -LiteralPath (Join-Path $cppWinRt 'winrt\base.h') -PathType Leaf) {
+            $arguments += "-DMKW_CPPWINRT_INCLUDE_DIR=$(ConvertTo-MkwCMakePath $cppWinRt)"
+        }
+        foreach ($directory in Get-ChildItem -LiteralPath $DependenciesDirectory -Directory) {
+            # native_prebuilt holds compiled output, not a FetchContent source tree.
+            if ($directory.Name -eq 'native_prebuilt') { continue }
+            # FetchContent uppercases the declared name but preserves punctuation
+            # (for example abseil-cpp -> FETCHCONTENT_SOURCE_DIR_ABSEIL-CPP).
+            $name = $directory.Name.ToUpperInvariant()
+            $arguments += "-DFETCHCONTENT_SOURCE_DIR_$name=$(ConvertTo-MkwCMakePath $directory.FullName)"
+        }
+    }
+
+    if (-not [string]::IsNullOrWhiteSpace($NativePrebuiltDirectory)) {
+        $arguments += "-DMKW_NATIVE_PREBUILT_DIR=$(ConvertTo-MkwCMakePath $NativePrebuiltDirectory)"
+    }
+
+    $arguments += $AdditionalArguments
+    return $arguments
+}
diff --git a/Launcher/Prepare-NativePrebuilt.ps1 b/Launcher/Prepare-NativePrebuilt.ps1
new file mode 100644
index 0000000..10a36b6
--- /dev/null
+++ b/Launcher/Prepare-NativePrebuilt.ps1
@@ -0,0 +1,412 @@
+# Builds the redistributable precompiled aurora + third-party package: aurora (~43% of local build
+# CPU time) and vendored Crypto++ are identical for every user, so this configures runtime/ like
+# LocalBuild.ps1 (both dot-source NativeBuildFlags.ps1), builds just that closure, and harvests the
+# archives plus a generated CMake description into launcher/artifacts/dependencies/native_prebuilt.
+[CmdletBinding(PositionalBinding = $false)]
+param(
+    [string]$PortableToolsDirectory = 'launcher/artifacts/portable-tools',
+    [string]$DependencySourceDirectory = 'launcher/artifacts/dependencies',
+    [string]$OutputDirectory,
+    [string]$StageDirectory = 'build/native-prebuilt-stage',
+    [switch]$KeepStage,
+    # Maintainer iteration aid: keep an already configured staging build so a
+    # re-harvest does not recompile aurora from scratch.
+    [switch]$ReuseStage,
+    [int]$Parallel = 0
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+. (Join-Path $PSScriptRoot 'NativeBuildFlags.ps1')
+
+$repoRoot = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
+function Full([string]$Path) {
+    if ([IO.Path]::IsPathRooted($Path)) { return [IO.Path]::GetFullPath($Path) }
+    return [IO.Path]::GetFullPath((Join-Path $repoRoot $Path))
+}
+function Normalize([string]$Path) { return ([IO.Path]::GetFullPath($Path)).Replace('\', '/') }
+function StartsWithPath([string]$Candidate, [string]$Root) {
+    $rootSlash = $Root.TrimEnd('/') + '/'
+    return $Candidate.StartsWith($rootSlash, [StringComparison]::OrdinalIgnoreCase)
+}
+function RelativeTo([string]$Candidate, [string]$Root) {
+    $rootSlash = $Root.TrimEnd('/') + '/'
+    return $Candidate.Substring($rootSlash.Length)
+}
+
+$portableTools = Full $PortableToolsDirectory
+$dependencies = Full $DependencySourceDirectory
+$stage = Full $StageDirectory
+if ([string]::IsNullOrWhiteSpace($OutputDirectory)) {
+    $OutputDirectory = Join-Path $dependencies 'native_prebuilt'
+}
+$package = Full $OutputDirectory
+
+$toolchainBin = Join-Path $portableTools 'llvm-mingw\bin'
+$cmake = Join-Path $portableTools 'CMake\bin\cmake.exe'
+$ninja = Join-Path $portableTools 'Ninja\ninja.exe'
+$cc = Join-Path $toolchainBin 'x86_64-w64-mingw32-clang.exe'
+$cxx = Join-Path $toolchainBin 'x86_64-w64-mingw32-clang++.exe'
+$windres = Join-Path $toolchainBin 'x86_64-w64-mingw32-windres.exe'
+$clangBinary = Join-Path $toolchainBin 'clang-22.exe'
+$runtimeSource = Join-Path $repoRoot 'runtime'
+$auroraSource = Join-Path $repoRoot 'aurora-main'
+
+Assert-File $cmake 'Portable CMake'
+Assert-File $ninja 'Portable Ninja'
+Assert-File $cc 'Portable C compiler'
+Assert-File $cxx 'Portable C++ compiler'
+Assert-File $windres 'Portable resource compiler'
+Assert-File $clangBinary 'Portable clang driver binary'
+Assert-Directory $dependencies 'Pinned offline dependency sources'
+Assert-Directory $auroraSource 'aurora-main source tree'
+Assert-File (Join-Path $repoRoot 'generated\build_shards\shards.cmake') `
+    'Translator shard manifest (run the developer build once so runtime/ can configure)'
+
+if ($Parallel -le 0) { $Parallel = [Environment]::ProcessorCount }
+
+# The package must never contain a stale mixture of two builds.
+if (Test-Path -LiteralPath $package) { Remove-Item -LiteralPath $package -Recurse -Force }
+[IO.Directory]::CreateDirectory($package) | Out-Null
+[IO.Directory]::CreateDirectory((Join-Path $package 'lib')) | Out-Null
+[IO.Directory]::CreateDirectory((Join-Path $package 'bin')) | Out-Null
+[IO.Directory]::CreateDirectory((Join-Path $package 'include')) | Out-Null
+
+# The staging build has to be configured without the package present, otherwise
+# the runtime would consume the very package this script is producing.
+if (-not $ReuseStage -and (Test-Path -LiteralPath $stage)) { Remove-Item -LiteralPath $stage -Recurse -Force }
+$exportDirectory = Join-Path $stage 'export'
+[IO.Directory]::CreateDirectory($exportDirectory) | Out-Null
+
+$oldPath = $env:PATH
+try {
+    $env:PATH = Get-MkwToolchainPath $portableTools
+
+    $configure = Get-MkwNativeConfigureArguments -SourceDirectory $runtimeSource -BuildDirectory $stage `
+        -Ninja $ninja -CCompiler $cc -CxxCompiler $cxx -ResourceCompiler $windres `
+        -DependenciesDirectory $dependencies `
+        -AdditionalArguments @("-DMKW_NATIVE_PREBUILT_EXPORT_DIR=$(ConvertTo-MkwCMakePath $exportDirectory)")
+    Invoke-Checked $cmake $configure 'Configuring the aurora/third-party staging build' -LogPrefix 'MKWNP'
+
+    # mkw_np_probe links exactly what mkw_runtime_common and the public products
+    # link, so building it compiles the whole redistributable closure and nothing
+    # else - and a successful link proves the harvested archives are complete.
+    Invoke-Checked $cmake @('--build', $stage, '--target', 'mkw_np_probe', '--parallel', "$Parallel") `
+        'Building the aurora/third-party closure' -LogPrefix 'MKWNP'
+} finally {
+    $env:PATH = $oldPath
+}
+
+# ---------------------------------------------------------------------------
+# Read the description CMake wrote, plus the resolved command lines Ninja holds.
+# ---------------------------------------------------------------------------
+$metaPath = Join-Path $exportDirectory 'meta.txt'
+Assert-File $metaPath 'Native prebuilt export metadata'
+$meta = @{}
+foreach ($line in Get-Content -LiteralPath $metaPath) {
+    if ($line -match '^([a-z0-9_]+)=(.*)$') { $meta[$Matches[1]] = $Matches[2] }
+}
+
+$buildNinja = Join-Path $stage 'build.ninja'
+Assert-File $buildNinja 'Generated build.ninja'
+$ninjaLines = [IO.File]::ReadAllLines($buildNinja)
+
+function Get-NinjaStatementVariables([string[]]$Lines, [string]$RulePrefix) {
+    $variables = $null
+    for ($i = 0; $i -lt $Lines.Length; $i++) {
+        $line = $Lines[$i]
+        if (-not $line.StartsWith('build ')) { continue }
+        $colon = $line.IndexOf(': ')
+        if ($colon -lt 0) { continue }
+        $rule = $line.Substring($colon + 2)
+        $space = $rule.IndexOf(' ')
+        if ($space -ge 0) { $rule = $rule.Substring(0, $space) }
+        if ($rule -ne $RulePrefix) { continue }
+        $variables = [ordered]@{}
+        for ($j = $i + 1; $j -lt $Lines.Length; $j++) {
+            $entry = $Lines[$j]
+            if ($entry -notmatch '^  ([A-Z_]+) = ?(.*)$') { break }
+            $variables[$Matches[1]] = $Matches[2]
+        }
+        break
+    }
+    if ($null -eq $variables) { throw "No Ninja statement used rule $RulePrefix." }
+    return $variables
+}
+function Get-NinjaValue($Variables, [string]$Name) {
+    if ($Variables.Contains($Name)) { return [string]$Variables[$Name] }
+    return ''
+}
+function Split-NinjaList([string]$Value) {
+    if ([string]::IsNullOrWhiteSpace($Value)) { return , [string[]]@() }
+    return , [string[]]@($Value -split '\s+' | Where-Object { $_ })
+}
+function Subtract-Ordered([string[]]$All, [string[]]$Remove) {
+    if ($null -eq $All) { return [string[]]@() }
+    $result = [Collections.Generic.List[string]]::new()
+    $pending = [Collections.Generic.List[string]]::new()
+    if ($null -ne $Remove) { foreach ($item in $Remove) { $pending.Add($item) } }
+    foreach ($item in $All) {
+        $index = $pending.IndexOf($item)
+        if ($index -ge 0) { $pending.RemoveAt($index); continue }
+        $result.Add($item)
+    }
+    return $result.ToArray()
+}
+
+$probeCompile = Get-NinjaStatementVariables $ninjaLines 'CXX_COMPILER__mkw_np_probe_unscanned_Release'
+$controlCompile = Get-NinjaStatementVariables $ninjaLines 'CXX_COMPILER__mkw_np_probe_control_unscanned_Release'
+$probeLink = Get-NinjaStatementVariables $ninjaLines 'CXX_EXECUTABLE_LINKER__mkw_np_probe_Release'
+$controlLink = Get-NinjaStatementVariables $ninjaLines 'CXX_EXECUTABLE_LINKER__mkw_np_probe_control_Release'
+
+$includeArguments = Subtract-Ordered (Split-NinjaList (Get-NinjaValue $probeCompile 'INCLUDES')) `
+    (Split-NinjaList (Get-NinjaValue $controlCompile 'INCLUDES'))
+$defineArguments = Subtract-Ordered (Split-NinjaList (Get-NinjaValue $probeCompile 'DEFINES')) `
+    (Split-NinjaList (Get-NinjaValue $controlCompile 'DEFINES'))
+$compileOptions = Subtract-Ordered (Split-NinjaList (Get-NinjaValue $probeCompile 'FLAGS')) `
+    (Split-NinjaList (Get-NinjaValue $controlCompile 'FLAGS'))
+$linkItems = Subtract-Ordered (Split-NinjaList (Get-NinjaValue $probeLink 'LINK_LIBRARIES')) `
+    (Split-NinjaList (Get-NinjaValue $controlLink 'LINK_LIBRARIES'))
+if ($includeArguments.Count -eq 0) { throw 'The aurora compile interface is empty; the probe did not link aurora.' }
+if ($linkItems.Count -eq 0) { throw 'The aurora link interface is empty; the probe did not link aurora.' }
+
+# ---------------------------------------------------------------------------
+# Harvest the built libraries.
+# ---------------------------------------------------------------------------
+$binaryRoot = Normalize $meta['binary_dir']
+$auroraRoot = Normalize $meta['aurora_dir']
+$runtimeRoot = Normalize $meta['runtime_dir']
+$dependencyRoot = Normalize $dependencies
+
+$targets = @{}
+foreach ($line in Get-Content -LiteralPath (Join-Path $exportDirectory 'targets.txt')) {
+    if ([string]::IsNullOrWhiteSpace($line)) { continue }
+    $parts = $line -split '\|'
+    if ($parts.Count -ne 4) { throw "Malformed exported target line: $line" }
+    $targets[$parts[0]] = [pscustomobject]@{
+        Name = $parts[0]; Type = $parts[1]
+        File = Normalize $parts[2]; LinkerFile = Normalize $parts[3]
+    }
+}
+
+$dawnLinkerFile = ''
+$dawnRuntimeFile = ''
+foreach ($line in Get-Content -LiteralPath (Join-Path $exportDirectory 'dawn.txt')) {
+    if ([string]::IsNullOrWhiteSpace($line)) { continue }
+    $parts = $line -split '\|'
+    $dawnRuntimeFile = Normalize $parts[1]
+    $dawnLinkerFile = Normalize $parts[2]
+}
+
+# linker-file path -> package reference, built only from libraries that were
+# actually produced by this build.
+$linkerFileToReference = @{}
+$sharedImports = [Collections.Generic.List[object]]::new()
+$copiedFiles = [Collections.Generic.List[string]]::new()
+function Copy-Harvested([string]$SourcePath, [string]$SubDirectory) {
+    $name = [IO.Path]::GetFileName($SourcePath)
+    $destination = Join-Path (Join-Path $package $SubDirectory) $name
+    if (Test-Path -LiteralPath $destination) {
+        throw "Two harvested files collide on the name ${name}: $SourcePath"
+    }
+    Copy-Item -LiteralPath $SourcePath -Destination $destination
+    $copiedFiles.Add("$SubDirectory/$name")
+    return "$SubDirectory/$name"
+}
+
+foreach ($name in ($targets.Keys | Sort-Object)) {
+    $target = $targets[$name]
+    if (-not (Test-Path -LiteralPath $target.LinkerFile -PathType Leaf)) {
+        # Not part of the closure mkw_np_probe pulled in; deliberately not shipped.
+        continue
+    }
+    $relativeLinker = Copy-Harvested $target.LinkerFile 'lib'
+    if ($target.Type -eq 'SHARED_LIBRARY') {
+        if (-not (Test-Path -LiteralPath $target.File -PathType Leaf)) {
+            throw "Shared library $name has no runtime file: $($target.File)"
+        }
+        $relativeRuntime = Copy-Harvested $target.File 'bin'
+        $sharedImports.Add([pscustomobject]@{
+            Target = "mkw_np::$name"; Runtime = $relativeRuntime; Implib = $relativeLinker })
+        $linkerFileToReference[$target.LinkerFile] = "mkw_np::$name"
+    } else {
+        $linkerFileToReference[$target.LinkerFile] = "`@PKG`@/$relativeLinker"
+    }
+}
+if ($sharedImports.Count -eq 0) { throw 'No shared libraries were harvested; the SDL/zlib/libpng DLLs would be missing.' }
+if ($dawnLinkerFile) { $linkerFileToReference[$dawnLinkerFile] = 'dawn::webgpu_dawn' }
+
+# ---------------------------------------------------------------------------
+# Rewrite the compile/link interface into workspace-relative tokens.
+# ---------------------------------------------------------------------------
+$generatedIncludeIndex = 0
+function ConvertTo-Token([string]$AbsolutePath, [string]$Kind) {
+    $path = Normalize $AbsolutePath
+    if (StartsWithPath $path $auroraRoot) { return "`@AURORA`@/$(RelativeTo $path $auroraRoot)" }
+    if (StartsWithPath $path $runtimeRoot) { return "`@RUNTIME`@/$(RelativeTo $path $runtimeRoot)" }
+    if (StartsWithPath $path $dependencyRoot) { return "`@DEPS`@/$(RelativeTo $path $dependencyRoot)" }
+    if (StartsWithPath $path $binaryRoot) {
+        if ($Kind -ne 'include') { throw "Unhandled build-tree artifact: $path" }
+        # A generated header directory (SDL_revision.h and friends). The source
+        # trees ship, but these do not exist until something configures them, so
+        # they travel inside the package.
+        $script:generatedIncludeIndex++
+        $name = 'generated{0:d2}' -f $script:generatedIncludeIndex
+        $destination = Join-Path (Join-Path $package 'include') $name
+        [IO.Directory]::CreateDirectory($destination) | Out-Null
+        Copy-Item -Path (Join-Path $path '*') -Destination $destination -Recurse -Force
+        foreach ($file in Get-ChildItem -LiteralPath $destination -Recurse -File) {
+            $copiedFiles.Add(('include/{0}/{1}' -f $name,
+                $file.FullName.Substring($destination.Length + 1).Replace('\', '/')))
+        }
+        return "`@PKG`@/include/$name"
+    }
+    throw "Path escapes every shippable root ($Kind): $path"
+}
+
+# Ninja splits "-isystem <path>" into two list entries (the vendored Crypto++
+# headers are declared SYSTEM, so they arrive that way), while plain aurora
+# includes stay glued to -I. Only the directory itself travels in the package;
+# the consumer re-emits it through INTERFACE_INCLUDE_DIRECTORIES and CMake
+# chooses the flag form per usage context.
+$packageIncludeDirectories = @()
+for ($i = 0; $i -lt $includeArguments.Count; $i++) {
+    $entry = $includeArguments[$i]
+    if ($entry.StartsWith('-I')) {
+        $packageIncludeDirectories += (ConvertTo-Token $entry.Substring(2) 'include')
+    } elseif ($entry -eq '-isystem' -and ($i + 1) -lt $includeArguments.Count) {
+        $i++
+        $packageIncludeDirectories += (ConvertTo-Token $includeArguments[$i] 'include')
+    } elseif ($entry.StartsWith('-isystem')) {
+        $packageIncludeDirectories += (ConvertTo-Token $entry.Substring('-isystem'.Length) 'include')
+    } else {
+        throw "Unexpected include argument: $entry"
+    }
+}
+
+$packageDefinitions = @($defineArguments | ForEach-Object {
+    if (-not $_.StartsWith('-D')) { throw "Unexpected define argument: $_" }
+    # Ninja carries the Windows command-line escaping; CMake re-applies it.
+    $_.Substring(2).Replace('\"', '"')
+})
+
+$packageLinkItems = @($linkItems | ForEach-Object {
+    $item = $_
+    if ($item.StartsWith('-')) { return $item }
+    $absolute = if ([IO.Path]::IsPathRooted($item)) { Normalize $item } else { Normalize (Join-Path $stage $item) }
+    if ($linkerFileToReference.ContainsKey($absolute)) { return $linkerFileToReference[$absolute] }
+    if (StartsWithPath $absolute $dependencyRoot) { return "`@DEPS`@/$(RelativeTo $absolute $dependencyRoot)" }
+    throw "Link item is neither a system library nor a harvested archive: $item"
+})
+
+# fmt's `-include cstdlib` (and anything like it) is recorded from a C++ compile
+# line, so re-scope it to C++. The runtime also assembles generated .S blobs
+# through the same targets, and a forced C++ header include would break them.
+$packageCompileOptions = @($compileOptions | ForEach-Object { "`$<`$<COMPILE_LANGUAGE:CXX>:$_>" })
+
+# ---------------------------------------------------------------------------
+# Emit the consumer-facing CMake description.
+# ---------------------------------------------------------------------------
+function Format-CMakeBlock([string]$Name, [string[]]$Items) {
+    if ($null -eq $Items -or $Items.Count -eq 0) { return "set($Name `"`")`n" }
+    $body = ($Items | ForEach-Object { '    "' + $_.Replace('\', '/').Replace('"', '\"') + '"' }) -join "`n"
+    return "set($Name`n$body)`n"
+}
+
+$generated = [Collections.Generic.List[string]]::new()
+$generated.Add('# Generated by launcher/Prepare-NativePrebuilt.ps1 - do not edit.')
+$generated.Add('#')
+$generated.Add('# Describes the precompiled aurora + third-party archives that replace a')
+$generated.Add('# from-source aurora-main build. Every path is a token resolved against the')
+$generated.Add('# consuming workspace, because the source trees still ship next to this')
+$generated.Add('# package and the runtime compiles against their headers.')
+$generated.Add('')
+$generated.Add('if(NOT MKW_NP_PACKAGE_DIR OR NOT MKW_NP_AURORA_DIR OR NOT MKW_NP_RUNTIME_DIR OR NOT MKW_NP_DEPS_DIR)')
+$generated.Add('    message(FATAL_ERROR "native_prebuilt.cmake must be included by runtime/cmake/NativePrebuilt.cmake")')
+$generated.Add('endif()')
+$generated.Add('')
+$generated.Add((Format-CMakeBlock 'MKW_NP_INCLUDE_DIRECTORIES' $packageIncludeDirectories).TrimEnd())
+$generated.Add((Format-CMakeBlock 'MKW_NP_COMPILE_DEFINITIONS' $packageDefinitions).TrimEnd())
+$generated.Add((Format-CMakeBlock 'MKW_NP_COMPILE_OPTIONS' $packageCompileOptions).TrimEnd())
+$generated.Add((Format-CMakeBlock 'MKW_NP_LINK_LIBRARIES' $packageLinkItems).TrimEnd())
+$generated.Add((Format-CMakeBlock 'MKW_NP_AURORA_TARGETS' @('aurora::gx','aurora::pad','aurora::si','aurora::vi','aurora::mtx')).TrimEnd())
+$generated.Add('')
+$generated.Add("set(MKW_NP_DAWN_CONFIG_DIR `"$(ConvertTo-Token $meta['dawn_config_dir'] 'dawn')`")")
+$generated.Add("set(MKW_NP_DAWN_VERSION `"$($meta['aurora_dawn_version'])`")")
+$generated.Add('')
+$generated.Add('# Shared third-party libraries keep imported SHARED targets so that')
+$generated.Add('# $<TARGET_RUNTIME_DLLS> still copies them next to the game executable.')
+foreach ($import in $sharedImports) {
+    $generated.Add("add_library($($import.Target) SHARED IMPORTED GLOBAL)")
+    $generated.Add("set_target_properties($($import.Target) PROPERTIES")
+    $generated.Add("    IMPORTED_LOCATION `"`${MKW_NP_PACKAGE_DIR}/$($import.Runtime)`"")
+    $generated.Add("    IMPORTED_IMPLIB `"`${MKW_NP_PACKAGE_DIR}/$($import.Implib)`")")
+}
+$generatedText = ($generated -join "`r`n") + "`r`n"
+$generatedPath = Join-Path $package 'native_prebuilt.cmake'
+[IO.File]::WriteAllText($generatedPath, $generatedText, (New-Object Text.UTF8Encoding($false)))
+
+# --- Provenance ---
+# The pinned Dawn tree is what this harvest compiled against; without its digest the
+# consumer-side ABI check would silently pass on a mismatched Dawn.
+$dawnRuntimeHash = Get-MkwDawnRuntimeSha256 $dependencies
+if (-not $dawnRuntimeHash) {
+    throw "The pinned Dawn runtime is missing: $(Join-Path $dependencies 'dawn_prebuilt\bin\webgpu_dawn.dll')"
+}
+
+$auroraSourceFingerprint = Get-MkwAuroraSourceFingerprint $auroraSource
+if (-not $auroraSourceFingerprint) {
+    throw "The aurora source tree could not be fingerprinted: $auroraSource"
+}
+
+# The harvested Crypto++ archive is consumed against this tree's headers, so it
+# is recorded for the same reason as the aurora fingerprint above.
+$thirdPartyDirectory = Join-Path $runtimeSource 'third_party'
+$thirdPartySourceFingerprint = Get-MkwThirdPartySourceFingerprint $thirdPartyDirectory
+if (-not $thirdPartySourceFingerprint) {
+    throw "The vendored third-party tree could not be fingerprinted: $thirdPartyDirectory"
+}
+
+$contents = @(Get-ChildItem -LiteralPath $package -Recurse -File | ForEach-Object {
+    [pscustomobject][ordered]@{
+        Path = $_.FullName.Substring($package.Length + 1).Replace('\', '/')
+        Bytes = $_.Length
+        Sha256 = Get-MkwFileSha256 $_.FullName
+    }
+} | Sort-Object Path)
+
+$provenance = [ordered]@{
+    SchemaVersion = 1
+    BuiltUtc = [DateTime]::UtcNow.ToString('O')
+    # A precompiled archive is only interchangeable with locally compiled objects
+    # when the compiler and the flag set are bit-for-bit the ones the user's
+    # machine will use. LocalBuild.ps1 re-checks both before consuming this.
+    CompilerSha256 = Get-MkwFileSha256 $clangBinary
+    CompilerVersion = $meta['cxx_compiler_version']
+    FlagFingerprint = Get-MkwNativeFlagFingerprint
+    DawnVersion = $meta['aurora_dawn_version']
+    # The version tag is not a content identity: the upstream prebuilt asset is
+    # mutable, so record the digest of the Dawn runtime these archives were
+    # actually compiled and linked against. Consumers re-check it.
+    DawnRuntimeSha256 = $dawnRuntimeHash
+    # libaurora_*.a is compiled from this tree, while the runtime that calls into
+    # it is compiled on the user's machine. Record what was harvested so both the
+    # release build and the local build can refuse a package aurora has outgrown.
+    AuroraSourceFingerprint = $auroraSourceFingerprint
+    ThirdPartySourceFingerprint = $thirdPartySourceFingerprint
+    Sdl3Target = $meta['aurora_sdl3_target']
+    HarvestedLibraryCount = @($linkerFileToReference.Keys).Count
+    Contents = $contents
+}
+$provenance | ConvertTo-Json -Depth 6 |
+    Set-Content -LiteralPath (Join-Path $package 'provenance.json') -Encoding UTF8
+
+if (-not $KeepStage) { Remove-Item -LiteralPath $stage -Recurse -Force }
+
+$totalBytes = ($contents | Measure-Object -Property Bytes -Sum).Sum
+Write-Host ''
+Write-Host "Native prebuilt package: $package"
+Write-Host ("  files: {0}; size: {1:n1} MiB" -f $contents.Count, ($totalBytes / 1MB))
+Write-Host ("  archives: {0}; shared imports: {1}" -f (@(Get-ChildItem (Join-Path $package 'lib') -File).Count), $sharedImports.Count)
+Write-Host ("  flag fingerprint: {0}" -f $provenance.FlagFingerprint)
diff --git a/Launcher/Prepare-PortableTools.ps1 b/Launcher/Prepare-PortableTools.ps1
new file mode 100644
index 0000000..30dda2a
--- /dev/null
+++ b/Launcher/Prepare-PortableTools.ps1
@@ -0,0 +1,74 @@
+[CmdletBinding()]
+param([string]$Destination)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+$packages = @(
+    [pscustomobject]@{
+        Name = 'llvm-mingw'; File = 'llvm-mingw-20260616-ucrt-x86_64.zip'
+        Uri = 'https://github.com/mstorsjo/llvm-mingw/releases/download/20260616/llvm-mingw-20260616-ucrt-x86_64.zip'
+        Sha256 = 'b9b68a4d276e16fa25802aaba458e4638f64b3884c290aaccdc2d87083b6ca35'
+        Root = 'llvm-mingw-20260616-ucrt-x86_64'
+    },
+    [pscustomobject]@{
+        Name = 'CMake'; File = 'cmake-4.3.3-windows-x86_64.zip'
+        Uri = 'https://github.com/Kitware/CMake/releases/download/v4.3.3/cmake-4.3.3-windows-x86_64.zip'
+        Sha256 = '935ade9e5e8723583c07f44c5592cea2a1c8f65c56ca7e07b34c025c880e0bd6'
+        Root = 'cmake-4.3.3-windows-x86_64'
+    },
+    [pscustomobject]@{
+        Name = 'Ninja'; File = 'ninja-win-1.13.2.zip'
+        Uri = 'https://github.com/ninja-build/ninja/releases/download/v1.13.2/ninja-win.zip'
+        Sha256 = '07fc8261b42b20e71d1720b39068c2e14ffcee6396b76fb7a795fb460b78dc65'
+        Root = $null
+    }
+)
+
+if (-not $Destination) { $Destination = Join-Path $PSScriptRoot 'artifacts\portable-tools' }
+$Destination = [IO.Path]::GetFullPath($Destination)
+$downloads = Join-Path $PSScriptRoot 'artifacts\downloads'
+[IO.Directory]::CreateDirectory($Destination) | Out-Null
+[IO.Directory]::CreateDirectory($downloads) | Out-Null
+
+foreach ($package in $packages) {
+    $archive = Join-Path $downloads $package.File
+    if (-not (Test-Path -LiteralPath $archive -PathType Leaf) -or
+        (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant() -ne $package.Sha256) {
+        Write-Host "Downloading $($package.Name)..."
+        $temporary = $archive + '.partial'
+        Remove-Item -LiteralPath $temporary -Force -ErrorAction SilentlyContinue
+        Invoke-WebRequest -UseBasicParsing -Uri $package.Uri -OutFile $temporary
+        $actual = (Get-FileHash -LiteralPath $temporary -Algorithm SHA256).Hash.ToLowerInvariant()
+        if ($actual -ne $package.Sha256) { throw "$($package.Name) hash mismatch: $actual" }
+        Move-Item -LiteralPath $temporary -Destination $archive -Force
+    }
+
+    $target = Join-Path $Destination $package.Name
+    if (Test-Path -LiteralPath $target -PathType Container) { continue }
+    $extract = Join-Path $Destination ('.extract-' + $package.Name)
+    if (Test-Path -LiteralPath $extract) { Remove-Item -LiteralPath $extract -Recurse -Force }
+    Expand-Archive -LiteralPath $archive -DestinationPath $extract
+    $source = if ($package.Root) { Join-Path $extract $package.Root } else { $extract }
+    if (-not (Test-Path -LiteralPath $source -PathType Container)) { throw "$($package.Name) archive layout changed." }
+    Move-Item -LiteralPath $source -Destination $target
+    if (Test-Path -LiteralPath $extract) { Remove-Item -LiteralPath $extract -Recurse -Force }
+}
+
+$license = @"
+Portable build tools bundled by WiiCompiled
+
+LLVM-MinGW 20260616 (LLVM/Clang/LLD, mingw-w64, libc++)
+  https://github.com/mstorsjo/llvm-mingw
+  Licenses are included in the llvm-mingw directory.
+
+CMake 4.3.3
+  https://cmake.org/
+  License is included in the CMake directory.
+
+Ninja 1.13.2
+  https://github.com/ninja-build/ninja
+  Apache License 2.0; see the installer license inventory.
+"@
+$license | Set-Content -LiteralPath (Join-Path $Destination 'README-LICENSES.txt') -Encoding UTF8
+Write-Host "Portable tools ready: $Destination"
diff --git a/Launcher/Prepare-Release.ps1 b/Launcher/Prepare-Release.ps1
new file mode 100644
index 0000000..8e51414
--- /dev/null
+++ b/Launcher/Prepare-Release.ps1
@@ -0,0 +1,30 @@
+[CmdletBinding(PositionalBinding = $false)]
+param(
+    [string]$DolphinToolPath,
+    [string]$PortableToolsDirectory = 'Launcher/artifacts/portable-tools',
+    [string]$DependencySourceDirectory = 'Launcher/artifacts/dependencies',
+    [string]$VcRuntimeDirectory,
+    [string]$ToolkitReleaseTag = $env:GITHUB_REF_NAME
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+if ([string]::IsNullOrWhiteSpace($DolphinToolPath)) {
+    throw 'Prepare-Release.ps1 requires -DolphinToolPath pointing to DolphinTool.exe.'
+}
+
+$arguments = @{
+    DolphinToolPath = $DolphinToolPath
+    PortableToolsDirectory = $PortableToolsDirectory
+    DependencySourceDirectory = $DependencySourceDirectory
+    ToolkitReleaseTag = $ToolkitReleaseTag
+}
+if (-not [string]::IsNullOrWhiteSpace($VcRuntimeDirectory)) {
+    $arguments.VcRuntimeDirectory = $VcRuntimeDirectory
+}
+
+& (Join-Path $PSScriptRoot 'Build-Installer.ps1') @arguments
+if ($LASTEXITCODE -ne 0) { throw "Build-Installer.ps1 failed with exit code $LASTEXITCODE." }
+
+Write-Host 'The release artifact is ready. It contains no translated game executable, game image, Code.pul, or Retro-WFC payload.'
diff --git a/Launcher/Test-NativeDependencies.ps1 b/Launcher/Test-NativeDependencies.ps1
new file mode 100644
index 0000000..a8bbe8f
--- /dev/null
+++ b/Launcher/Test-NativeDependencies.ps1
@@ -0,0 +1,69 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$PayloadRoot,
+    [Parameter(Mandatory = $true)]
+    [string]$SetupHost,
+    [Parameter(Mandatory = $true)]
+    [string]$LlvmReadobjPath
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+if (-not (Test-Path -LiteralPath $LlvmReadobjPath -PathType Leaf)) {
+    throw "Bundled llvm-readobj.exe is missing: $LlvmReadobjPath"
+}
+$llvmReadobj = [System.IO.Path]::GetFullPath($LlvmReadobjPath)
+
+$systemDlls = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+@(
+    'advapi32.dll', 'authz.dll', 'bcrypt.dll', 'combase.dll', 'comdlg32.dll', 'crypt32.dll',
+    'd3d11.dll', 'd3d12.dll', 'dbghelp.dll', 'dcomp.dll', 'dwrite.dll', 'dwmapi.dll',
+    'dxgi.dll', 'gdi32.dll', 'imm32.dll',
+    'iphlpapi.dll', 'kernel32.dll', 'mf.dll', 'mfplat.dll', 'mfreadwrite.dll', 'mfuuid.dll',
+    'ntdll.dll', 'ole32.dll', 'oleaut32.dll', 'opengl32.dll', 'powrprof.dll', 'rpcrt4.dll',
+    'secur32.dll', 'setupapi.dll', 'shell32.dll', 'shlwapi.dll', 'user32.dll', 'userenv.dll',
+    'version.dll', 'winhttp.dll', 'winmm.dll', 'wtsapi32.dll', 'ws2_32.dll', 'msvcrt.dll',
+    'netapi32.dll', 'normaliz.dll', 'psapi.dll', 'ucrtbase.dll', 'uxtheme.dll'
+) | ForEach-Object { [void]$systemDlls.Add($_) }
+
+$redistributableDlls = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+$redistDirectory = Join-Path ([System.IO.Path]::GetFullPath($PayloadRoot)) 'Toolkit\Redist'
+if (Test-Path -LiteralPath $redistDirectory -PathType Container) {
+    Get-ChildItem -LiteralPath $redistDirectory -Filter '*.dll' -File |
+        ForEach-Object { [void]$redistributableDlls.Add($_.Name) }
+}
+
+$binaries = @(
+    Get-ChildItem -LiteralPath ([System.IO.Path]::GetFullPath($PayloadRoot)) -File -Recurse |
+        Where-Object { $_.Extension -in @('.exe', '.dll') }
+)
+$binaries += Get-Item -LiteralPath ([System.IO.Path]::GetFullPath($SetupHost))
+$missing = [Collections.Generic.List[string]]::new()
+$checkedImports = 0
+
+foreach ($binary in $binaries) {
+    $output = & $llvmReadobj --coff-imports $binary.FullName 2>&1
+    if ($LASTEXITCODE -ne 0) { throw "llvm-readobj failed for $($binary.FullName).`n$output" }
+    $dependencies = @($output | ForEach-Object {
+        if ($_ -match '^\s*Name:\s+([A-Za-z0-9._-]+\.dll)\s*$') { $Matches[1] }
+    } | Sort-Object -Unique)
+    foreach ($dependency in $dependencies) {
+        $checkedImports++
+        if ($dependency.StartsWith('api-ms-', [StringComparison]::OrdinalIgnoreCase) -or
+            $dependency.StartsWith('ext-ms-', [StringComparison]::OrdinalIgnoreCase) -or
+            $systemDlls.Contains($dependency) -or
+            $redistributableDlls.Contains($dependency) -or
+            (Test-Path -LiteralPath (Join-Path $binary.DirectoryName $dependency) -PathType Leaf)) {
+            continue
+        }
+        $missing.Add("$($binary.FullName) -> $dependency")
+    }
+}
+
+if ($missing.Count -gt 0) {
+    throw "Native dependency audit found imports that are neither Windows system DLLs nor app-local:`n$($missing -join "`n")"
+}
+
+Write-Host "Native dependency audit passed: $($binaries.Count) binaries, $checkedImports imports."
diff --git a/Launcher/Test-PayloadBoundary.ps1 b/Launcher/Test-PayloadBoundary.ps1
new file mode 100644
index 0000000..79bdc3f
--- /dev/null
+++ b/Launcher/Test-PayloadBoundary.ps1
@@ -0,0 +1,43 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)] [string]$PayloadRoot)
+
+$ErrorActionPreference = 'Stop'
+$PayloadRoot = [IO.Path]::GetFullPath($PayloadRoot)
+if (-not (Test-Path -LiteralPath $PayloadRoot -PathType Container)) { throw "Payload does not exist: $PayloadRoot" }
+
+$forbiddenNames = @(
+    'WiiCompiled.exe', 'RetroRewind.exe', 'mkw_recompiled.exe',
+    'main.dol', 'StaticR.rel', 'Code.pul', 'base_translation_sources.bin',
+    'data_sections_init.cpp', 'data_sections_init_blobs.S', 'mkwii_base_manifest.json',
+    'generated_func_aliases.cpp', 'translated_function_decls.h'
+)
+$forbiddenExtensions = @('.iso', '.gcm', '.gcz', '.ciso', '.wbfs', '.wia', '.rvz', '.dol', '.rel', '.pul')
+$forbiddenSegments = @(
+    '\BuildWorkspace\generated\', '\BuildWorkspace\runtime\build\', '\GameAssets\', '\BuildWorkspace\Assets\',
+    '\BuildWorkspace\PulsarPacks\', '\BuildWorkspace\build\base\', '\BuildWorkspace\build\mods\'
+)
+$violations = [Collections.Generic.List[string]]::new()
+foreach ($file in Get-ChildItem -LiteralPath $PayloadRoot -Recurse -File) {
+    $rootPrefix = $PayloadRoot.TrimEnd('\') + '\'
+    if (-not $file.FullName.StartsWith($rootPrefix, [StringComparison]::OrdinalIgnoreCase)) {
+        throw "Payload enumeration escaped its root: $($file.FullName)"
+    }
+    $relative = '\' + $file.FullName.Substring($rootPrefix.Length).Replace('/', '\')
+    $underCompiler = $relative.StartsWith('\Toolkit\llvm-mingw\', [StringComparison]::OrdinalIgnoreCase)
+    $underPinnedDependency = $relative.StartsWith('\BuildWorkspace\Dependencies\', [StringComparison]::OrdinalIgnoreCase)
+    if ($forbiddenNames -contains $file.Name -or $forbiddenExtensions -contains $file.Extension.ToLowerInvariant()) {
+        $violations.Add($relative)
+        continue
+    }
+    if ($forbiddenSegments | Where-Object { $relative.IndexOf($_, [StringComparison]::OrdinalIgnoreCase) -ge 0 }) {
+        $violations.Add($relative)
+        continue
+    }
+    if (-not $underCompiler -and -not $underPinnedDependency -and $file.Extension -in @('.obj','.o','.lib','.a')) {
+        $violations.Add("$relative (precompiled object/library outside the licensed compiler payload)")
+    }
+}
+if ($violations.Count -gt 0) {
+    throw "Release payload contains forbidden game-derived or precompiled artifacts:`n$($violations -join "`n")"
+}
+Write-Host "Payload boundary audit passed: no translated game executable, game input, generated shard, or generated data was packaged."
diff --git a/Launcher/Test-PinnedFacts.ps1 b/Launcher/Test-PinnedFacts.ps1
new file mode 100644
index 0000000..4d97c9c
--- /dev/null
+++ b/Launcher/Test-PinnedFacts.ps1
@@ -0,0 +1,133 @@
+# Fails the release build when a fact duplicated across the repo stops agreeing with the copy
+# that owns it (recomp.yml). Scripts read pinned facts through Get-MkwProjectPins, but three
+# consumers can't read YAML (the C++ runtime header, the C# constants, hand-written lists on
+# both sides of the C#/PowerShell boundary), so those are checked here instead.
+[CmdletBinding()]
+param([string]$RepositoryRoot)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+. (Join-Path $PSScriptRoot 'NativeBuildFlags.ps1')
+
+if ([string]::IsNullOrWhiteSpace($RepositoryRoot)) {
+    $RepositoryRoot = Join-Path $PSScriptRoot '..'
+}
+$repoRoot = [IO.Path]::GetFullPath($RepositoryRoot)
+$launcher = Join-Path $repoRoot 'Launcher'
+$setup = Join-Path $launcher 'WiiCompiled.Setup'
+
+$failures = [Collections.Generic.List[string]]::new()
+function Add-Failure([string]$Message) { $failures.Add($Message) }
+
+function Read-SourceFile([string]$Path, [string]$Description) {
+    Assert-File $Path $Description
+    return [IO.File]::ReadAllText($Path)
+}
+
+function Get-CapturedValue([string]$Text, [string]$Pattern, [string]$Description) {
+    $match = [regex]::Match($Text, $Pattern)
+    if (-not $match.Success) { throw "$Description could not be located; update Test-PinnedFacts.ps1." }
+    return $match.Groups[1].Value
+}
+
+function Get-QuotedList([string]$Text, [string]$BlockPattern, [string]$ItemPattern, [string]$Description) {
+    $block = Get-CapturedValue $Text $BlockPattern $Description
+    $items = [regex]::Matches($block, $ItemPattern) | ForEach-Object { $_.Groups[1].Value }
+    if (@($items).Count -eq 0) { throw "$Description is empty; update Test-PinnedFacts.ps1." }
+    return [string[]]@($items)
+}
+
+function Compare-Set([string[]]$Expected, [string[]]$Actual, [string]$ExpectedName, [string]$ActualName) {
+    $missing = @($Expected | Where-Object { $Actual -notcontains $_ })
+    $extra = @($Actual | Where-Object { $Expected -notcontains $_ })
+    if ($missing.Count -gt 0) { Add-Failure "$ActualName is missing: $($missing -join ', ') (present in $ExpectedName)." }
+    if ($extra.Count -gt 0) { Add-Failure "$ActualName has entries $ExpectedName does not: $($extra -join ', ')." }
+}
+
+$pins = Get-MkwProjectPins (Join-Path $repoRoot 'projects\mkwii\recomp.yml')
+
+# --- The Retro-WFC endpoint: recomp.yml owns it; the installer host pins the same string so a
+# --- redirected or rewritten endpoint cannot be fetched from.
+$inputValidation = Read-SourceFile (Join-Path $setup 'InputValidation.cs') 'InputValidation.cs'
+$hostUri = Get-CapturedValue $inputValidation 'CurrentRetroWfcPayloadUri\s*=\s*"([^"]+)"' `
+    'The host Retro-WFC endpoint constant'
+if ($hostUri -cne $pins.RetroWfcPayloadUri) {
+    Add-Failure "InputValidation.CurrentRetroWfcPayloadUri is '$hostUri' but recomp.yml pins '$($pins.RetroWfcPayloadUri)'."
+}
+
+# --- The game identity: the manifest carries it, but the host also compiles a fallback for a
+# --- manifest that predates the field, and that fallback decides which disc is accepted.
+$models = Read-SourceFile (Join-Path $setup 'Models.cs') 'Models.cs'
+$hostGameId = Get-CapturedValue $models 'ExpectedGameId\s*\{\s*get;\s*set;\s*\}\s*=\s*"([^"]+)"' `
+    'The host expected game id'
+if ($hostGameId -cne $pins.GameId) {
+    Add-Failure "PayloadManifest.ExpectedGameId defaults to '$hostGameId' but recomp.yml pins '$($pins.GameId)'."
+}
+
+# --- The translation entry point: the translator is told it by LocalBuild.ps1 (which reads
+# --- recomp.yml), while the runtime enters the translated image at its own constant.
+$systemBridge = Read-SourceFile (Join-Path $repoRoot 'runtime\include\system_bridge.h') 'system_bridge.h'
+$runtimeEntry = (Get-CapturedValue $systemBridge 'kDefaultEntryAddress\s*=\s*(0[xX][0-9a-fA-F]+)' `
+    'The runtime default entry address').ToLowerInvariant()
+if ($runtimeEntry -ne $pins.EntryPoint) {
+    Add-Failure "system_bridge.h enters at $runtimeEntry but recomp.yml translates from $($pins.EntryPoint)."
+}
+
+# --- The pinned dependency set: Build-Installer.ps1 stages it, the installed host requires it.
+$installedLayout = Read-SourceFile (Join-Path $setup 'InstalledLayout.cs') 'InstalledLayout.cs'
+$buildInstaller = Read-SourceFile (Join-Path $launcher 'Build-Installer.ps1') 'Build-Installer.ps1'
+Compare-Set (Get-QuotedList $installedLayout '(?s)DependencyNames\s*=\s*\[(.*?)\]' '"([^"]+)"' `
+        'InstalledLayout.DependencyNames') `
+    (Get-QuotedList $buildInstaller '(?s)\$requiredDependencies\s*=\s*@\((.*?)\)' "'([^']+)'" `
+        'Build-Installer.ps1 $requiredDependencies') `
+    'InstalledLayout.DependencyNames' 'Build-Installer.ps1 $requiredDependencies'
+
+# --- The runtime assets copied beside a product: the host hashes exactly these names, so the build
+# --- script must publish every one of them or every product reports its support files as stale.
+$localBuild = Read-SourceFile (Join-Path $launcher 'LocalBuild.ps1') 'LocalBuild.ps1'
+$productAssets = @(Get-CapturedValue $installedLayout 'ProductBootstrapDirectoryName\s*=\s*"([^"]+)"' `
+        'The product bootstrap directory name') +
+    @(Get-QuotedList $installedLayout '(?s)ProductFileName\)\[\]\s*Files\s*=\s*\[(.*?)\n\s*\];' `
+        '\]\s*,\s*"([^"]+)"\s*\)' 'ProductRuntimeAssets.Files')
+foreach ($asset in $productAssets) {
+    if ($localBuild.IndexOf("'$asset'", [StringComparison]::Ordinal) -lt 0) {
+        Add-Failure "LocalBuild.ps1 never publishes the product runtime asset '$asset'."
+    }
+}
+
+# --- The command-line contract between the host and the build script.
+$localBuildService = Read-SourceFile (Join-Path $setup 'LocalBuildService.cs') 'LocalBuildService.cs'
+$parameterBlock = Get-CapturedValue $localBuild '(?sm)^param\((.*?)\r?\n\)' 'The LocalBuild.ps1 param block'
+$scriptParameters = [regex]::Matches($parameterBlock, '\$(\w+)') | ForEach-Object { $_.Groups[1].Value }
+# powershell.exe's own switches travel in the same argument list and are not script parameters.
+$hostSwitches = @('NoLogo', 'NoProfile', 'NonInteractive', 'ExecutionPolicy', 'File')
+$passedSwitches = [regex]::Matches($localBuildService, '"-([A-Za-z]\w*)"') |
+    ForEach-Object { $_.Groups[1].Value } | Where-Object { $hostSwitches -notcontains $_ } |
+    Sort-Object -Unique
+foreach ($switch in $passedSwitches) {
+    if ($scriptParameters -notcontains $switch) {
+        Add-Failure "LocalBuildService.cs passes -$switch, which LocalBuild.ps1 does not declare."
+    }
+}
+foreach ($mandatory in ([regex]::Matches($parameterBlock,
+        '\[Parameter\(Mandatory\)\][^$]*\$(\w+)') | ForEach-Object { $_.Groups[1].Value })) {
+    if ($passedSwitches -notcontains $mandatory) {
+        Add-Failure "LocalBuild.ps1 requires -$mandatory, which LocalBuildService.cs never passes."
+    }
+}
+
+# --- The build steps the installer's progress bar acts on.
+$installProgress = Read-SourceFile (Join-Path $setup 'InstallProgress.cs') 'InstallProgress.cs'
+$knownSteps = Get-QuotedList $installProgress '(?s)class BuildStepIds\s*\{(.*?)\n\}' `
+    'const string \w+ = "([^"]+)";' 'BuildStepIds'
+$emittedSteps = @([regex]::Matches($localBuild, "(?:-StepId|Write-MkwBuildStep)\s+'([^']+)'") |
+    ForEach-Object { $_.Groups[1].Value } | Sort-Object -Unique)
+Compare-Set $knownSteps $emittedSteps 'BuildStepIds' 'the steps LocalBuild.ps1 emits'
+
+if ($failures.Count -gt 0) {
+    throw "Pinned facts disagree between their copies:`n  $($failures -join "`n  ")"
+}
+Write-Host ("Pinned-fact audit passed: game {0}, entry {1}, endpoint {2}; dependency, runtime-asset, " -f
+    $pins.GameId, $pins.EntryPoint, $pins.RetroWfcPayloadUri) -NoNewline
+Write-Host 'build-step, and build-script parameter contracts all agree.'
diff --git a/Launcher/WiiCompiled.Setup/CancellationSignal.cs b/Launcher/WiiCompiled.Setup/CancellationSignal.cs
new file mode 100644
index 0000000..dd4848b
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/CancellationSignal.cs
@@ -0,0 +1,75 @@
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// Bridges a frontend-owned, named Windows event into the cancellation token used by setup.
+/// </summary>
+internal sealed class CancellationSignal : IDisposable
+{
+    public const string EnvironmentVariable = "MKWCOMPILED_CANCEL_EVENT";
+
+    private readonly EventWaitHandle? _event;
+    private readonly CancellationTokenSource? _source;
+    private readonly RegisteredWaitHandle? _registration;
+
+    private CancellationSignal(EventWaitHandle? @event, CancellationTokenSource? source,
+        RegisteredWaitHandle? registration)
+    {
+        _event = @event;
+        _source = source;
+        _registration = registration;
+    }
+
+    public CancellationToken Token => _source?.Token ?? CancellationToken.None;
+
+    public static CancellationSignal ObserveEnvironment()
+    {
+        var eventName = Environment.GetEnvironmentVariable(EnvironmentVariable);
+        if (eventName is null)
+            return new CancellationSignal(null, null, null);
+        if (string.IsNullOrWhiteSpace(eventName))
+            throw new InvalidOperationException(
+                $"The cancellation event named by {EnvironmentVariable} is empty.");
+
+        EventWaitHandle signal;
+        try
+        {
+            signal = EventWaitHandle.OpenExisting(eventName.Trim());
+        }
+        catch (Exception ex) when (ex is WaitHandleCannotBeOpenedException or UnauthorizedAccessException
+                                   or IOException or ArgumentException)
+        {
+            throw new InvalidOperationException(
+                $"The cancellation event named by {EnvironmentVariable} could not be opened.", ex);
+        }
+
+        var source = new CancellationTokenSource();
+        RegisteredWaitHandle registration;
+        try
+        {
+            registration = ThreadPool.RegisterWaitForSingleObject(signal, static (state, _) =>
+            {
+                try { ((CancellationTokenSource)state!).Cancel(); }
+                catch (ObjectDisposedException) { }
+            }, source, Timeout.Infinite, executeOnlyOnce: true);
+
+            // Registering and checking explicitly closes the race where the event was already set
+            // before RegisterWaitForSingleObject installed its wait.
+            if (signal.WaitOne(0)) source.Cancel();
+        }
+        catch
+        {
+            source.Dispose();
+            signal.Dispose();
+            throw;
+        }
+
+        return new CancellationSignal(signal, source, registration);
+    }
+
+    public void Dispose()
+    {
+        _registration?.Unregister(null);
+        _event?.Dispose();
+        _source?.Dispose();
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/CommandLine.cs b/Launcher/WiiCompiled.Setup/CommandLine.cs
new file mode 100644
index 0000000..ef573d6
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/CommandLine.cs
@@ -0,0 +1,191 @@
+namespace WiiCompiled.Setup;
+
+internal enum AppMode
+{
+    Help,
+    SilentInstall,
+    VerifyInputs,
+    Uninstall,
+    SilentUninstall,
+    UninstallWorker,
+    SelfTest,
+    LaunchBase,
+    LaunchRetro,
+    CheckProducts,
+    RepairProducts,
+    Version,
+    EmitPayloadIdentities
+}
+
+/// <summary>
+/// What each mode accepts. Every cross-flag rule below is expressed here once instead of as a
+/// per-mode exception list, so adding a mode cannot silently inherit another mode's inputs.
+/// </summary>
+internal sealed record ModeRules
+{
+    public string Flag { get; init; } = "this command";
+    public bool AcceptsProgressJson { get; init; }
+    public bool AcceptsGame { get; init; }
+    public bool RequiresGame { get; init; }
+    public bool AcceptsRetroDirectory { get; init; }
+    public bool RequiresRetroDirectory { get; init; }
+    public bool AcceptsPayloadMode { get; init; }
+    public bool RequiresInstallDirectory { get; init; }
+    public bool RequiresPayloadRoot { get; init; }
+    public bool AcceptsPortable { get; init; }
+}
+
+internal sealed class CommandLine
+{
+    public AppMode Mode { get; private set; } = AppMode.Help;
+    public string? GamePath { get; private set; }
+    public string? RetroDirectoryPath { get; private set; }
+    public RetroWfcPayloadMode RetroWfcPayloadMode { get; private set; }
+    public string? InstallDirectory { get; private set; }
+    public bool Quiet { get; private set; }
+    public bool ProgressJson { get; private set; }
+    public string? PayloadRootPath { get; private set; }
+    public bool Portable { get; private set; }
+
+    public static bool WantsProgressJson(string[] args) =>
+        args.Any(argument => argument.Equals("--progress-json", StringComparison.OrdinalIgnoreCase));
+
+    public static CommandLine Parse(string[] args)
+    {
+        var result = new CommandLine();
+        for (var i = 0; i < args.Length; i++)
+        {
+            switch (args[i].ToLowerInvariant())
+            {
+                case "--version": result.Mode = AppMode.Version; break;
+                case "--silent": result.Mode = AppMode.SilentInstall; break;
+                case "--verify-inputs": result.Mode = AppMode.VerifyInputs; break;
+                case "--uninstall": result.Mode = AppMode.Uninstall; break;
+                case "--silent-uninstall": result.Mode = AppMode.SilentUninstall; result.Quiet = true; break;
+                case "--uninstall-worker": result.Mode = AppMode.UninstallWorker; break;
+                case "--self-test": result.Mode = AppMode.SelfTest; break;
+                case "--launch-base": result.Mode = AppMode.LaunchBase; break;
+                case "--launch-retro": result.Mode = AppMode.LaunchRetro; break;
+                case "--check-products": result.Mode = AppMode.CheckProducts; break;
+                case "--repair-products": result.Mode = AppMode.RepairProducts; break;
+                case "--portable": result.Portable = true; break;
+                case "--emit-payload-identities": result.Mode = AppMode.EmitPayloadIdentities; break;
+                case "--payload-root": result.PayloadRootPath = RequireValue(args, ref i); break;
+                case "--quiet": result.Quiet = true; break;
+                case "--progress-json": result.ProgressJson = true; break;
+                case "--game": result.GamePath = RequireValue(args, ref i); break;
+                case "--retro-dir": result.RetroDirectoryPath = RequireValue(args, ref i); break;
+                case "--download-retro-wfc-payload":
+                    if (result.RetroWfcPayloadMode != RetroWfcPayloadMode.NotApplicable)
+                        throw new ArgumentException("Choose only one Retro-WFC payload mode.");
+                    result.RetroWfcPayloadMode = RetroWfcPayloadMode.Online;
+                    break;
+                case "--skip-retro-wfc-payload":
+                    if (result.RetroWfcPayloadMode != RetroWfcPayloadMode.NotApplicable)
+                        throw new ArgumentException("Choose only one Retro-WFC payload mode.");
+                    result.RetroWfcPayloadMode = RetroWfcPayloadMode.Skipped;
+                    break;
+                case "--install-dir": result.InstallDirectory = RequireValue(args, ref i); break;
+                default:
+                    throw new ArgumentException($"Unknown CLI option: {args[i]}");
+            }
+        }
+
+        result.Validate();
+        return result;
+    }
+
+    private static readonly Dictionary<AppMode, ModeRules> Rules = new()
+    {
+        [AppMode.SilentInstall] = new ModeRules
+        {
+            Flag = "--silent",
+            AcceptsProgressJson = true, AcceptsGame = true, RequiresGame = true,
+            AcceptsRetroDirectory = true, AcceptsPayloadMode = true,
+            AcceptsPortable = true
+        },
+        [AppMode.VerifyInputs] = new ModeRules
+        {
+            Flag = "--verify-inputs",
+            AcceptsProgressJson = true, AcceptsGame = true, RequiresGame = true,
+            AcceptsRetroDirectory = true
+        },
+        [AppMode.CheckProducts] = new ModeRules
+        {
+            Flag = "--check-products", AcceptsProgressJson = true, AcceptsRetroDirectory = true
+        },
+        [AppMode.RepairProducts] = new ModeRules
+        {
+            Flag = "--repair-products",
+            AcceptsProgressJson = true, AcceptsRetroDirectory = true, RequiresRetroDirectory = true,
+            AcceptsPayloadMode = true, RequiresInstallDirectory = true
+        },
+        [AppMode.LaunchBase] = new ModeRules { Flag = "--launch-base" },
+        [AppMode.LaunchRetro] = new ModeRules { Flag = "--launch-retro" },
+        [AppMode.Uninstall] = new ModeRules { Flag = "--uninstall", RequiresInstallDirectory = true },
+        [AppMode.SilentUninstall] = new ModeRules
+        {
+            Flag = "--silent-uninstall", RequiresInstallDirectory = true
+        },
+        [AppMode.UninstallWorker] = new ModeRules
+        {
+            Flag = "--uninstall-worker", RequiresInstallDirectory = true
+        },
+        [AppMode.EmitPayloadIdentities] = new ModeRules
+        {
+            Flag = "--emit-payload-identities", RequiresPayloadRoot = true
+        }
+    };
+
+    private void Validate()
+    {
+        var rules = Rules.GetValueOrDefault(Mode) ?? new ModeRules();
+
+        void Reject(bool present, string option)
+        {
+            if (present) throw new ArgumentException($"{option} is not valid with {rules.Flag}.");
+        }
+
+        Reject(GamePath is not null && !rules.AcceptsGame, "--game");
+        Reject(RetroDirectoryPath is not null && !rules.AcceptsRetroDirectory, "--retro-dir");
+        Reject(ProgressJson && !rules.AcceptsProgressJson, "--progress-json");
+        Reject(PayloadRootPath is not null && !rules.RequiresPayloadRoot, "--payload-root");
+        Reject(Portable && !rules.AcceptsPortable, "--portable");
+        Reject(RetroWfcPayloadMode != RetroWfcPayloadMode.NotApplicable && !rules.AcceptsPayloadMode,
+            "A Retro-WFC payload option");
+
+        if (rules.RequiresGame && string.IsNullOrWhiteSpace(GamePath))
+            throw new ArgumentException("--game is required.");
+        if (rules.RequiresRetroDirectory && string.IsNullOrWhiteSpace(RetroDirectoryPath))
+            throw new ArgumentException(
+                $"--retro-dir is required with {rules.Flag}. Supply Wheel Wizard's canonical Retro Rewind folder.");
+        if (rules.RequiresPayloadRoot && string.IsNullOrWhiteSpace(PayloadRootPath))
+            throw new ArgumentException($"--payload-root is required with {rules.Flag}.");
+
+        // A portable installation has no default location so the caller must state where that root is.
+        if (Portable && string.IsNullOrWhiteSpace(InstallDirectory))
+            throw new ArgumentException(
+                "--install-dir is required with --portable. Its parent folder becomes the portable root.");
+        if (Mode == AppMode.SilentInstall && string.IsNullOrWhiteSpace(InstallDirectory))
+            InstallDirectory = ProductInfo.DefaultInstallDirectory;
+        if (rules.RequiresInstallDirectory && string.IsNullOrWhiteSpace(InstallDirectory))
+            throw new ArgumentException($"--install-dir is required with {rules.Flag}.");
+
+        // The Retro Rewind source and a payload decision are a pair. a base-only operation
+        // has no payload to decide.
+        if (rules.AcceptsPayloadMode && RetroDirectoryPath is not null &&
+            RetroWfcPayloadMode == RetroWfcPayloadMode.NotApplicable)
+            throw new ArgumentException(
+                "Retro Rewind requires --download-retro-wfc-payload or --skip-retro-wfc-payload.");
+        if (RetroDirectoryPath is null && RetroWfcPayloadMode != RetroWfcPayloadMode.NotApplicable)
+            throw new ArgumentException(
+                "--retro-dir is required when selecting a Retro-WFC payload option.");
+    }
+
+    private static string RequireValue(string[] args, ref int index)
+    {
+        if (++index >= args.Length || string.IsNullOrWhiteSpace(args[index]))
+            throw new ArgumentException($"A value is required after {args[index - 1]}.");
+        return args[index];
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/CompileInputsFingerprint.cs b/Launcher/WiiCompiled.Setup/CompileInputsFingerprint.cs
new file mode 100644
index 0000000..8b8dc0a
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/CompileInputsFingerprint.cs
@@ -0,0 +1,183 @@
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace WiiCompiled.Setup;
+
+internal sealed record RetroRewindCompileInputs(
+    string RetroRewindRoot,
+    string CodePulSha256,
+    string CompileInputsSha256);
+
+internal static class CompileInputsFingerprint
+{
+    private const string FormatVersion = "mkwc-retro-compile-inputs-v3";
+
+    /// <summary>The exact directory name a build snapshot uses, because it is the mod root name
+    /// the translator turns into the product's relative DVD overlay root.</summary>
+    public const string PackageDirectoryName = "RetroRewind6";
+
+    public static RetroRewindCompileInputs Compute(string selectedDirectory,
+        CancellationToken cancellationToken = default)
+    {
+        var root = RetroRewindSource.ResolveRetroRewind6(selectedDirectory);
+        return new RetroRewindCompileInputs(root, ComputeCodePulSha256(root, cancellationToken),
+            ComputeCompileInputsSha256(root, cancellationToken));
+    }
+
+    public static string ComputeCodePulSha256(string retroRewindRoot,
+        CancellationToken cancellationToken = default)
+    {
+        var codePul = CodePulPath(Path.GetFullPath(retroRewindRoot));
+        if (!File.Exists(codePul)) throw MissingCodePul(retroRewindRoot);
+        cancellationToken.ThrowIfCancellationRequested();
+        return InputValidation.Sha256File(codePul);
+    }
+
+
+    /// Hashes only the translator inputs without relying on timestamps.
+    public static string ComputeCompileInputsSha256(string retroRewindRoot,
+        CancellationToken cancellationToken = default)
+    {
+        var root = Path.GetFullPath(retroRewindRoot);
+        if (!Directory.Exists(root))
+            throw new DirectoryNotFoundException($"The Retro Rewind folder is missing: {root}");
+        var codePul = CodePulPath(root);
+        if (!File.Exists(codePul)) throw MissingCodePul(root);
+
+        using var hash = IncrementalHash.CreateHash(HashAlgorithmName.SHA256);
+        AppendField(hash, FormatVersion);
+        AppendFile(hash, root, codePul, required: true, cancellationToken);
+
+        AppendTopology(hash, "topology:mod-root", root);
+        AppendTopology(hash, "topology:files", Path.Combine(root, "files"));
+
+        return Convert.ToHexString(hash.GetHashAndReset()).ToLowerInvariant();
+    }
+
+    /// <summary>
+    /// Copies just the compile inputs of a Wheel Wizard-owned Retro Rewind folder into
+    /// operation-owned scratch and proves the copy is a faithful snapshot. This is the Code.pul
+    /// </summary>
+    public static RetroRewindCompileInputs Snapshot(string selectedDirectory, string scratchDirectory,
+        CancellationToken cancellationToken = default)
+    {
+        var source = Compute(selectedDirectory, cancellationToken);
+        var destination = Path.Combine(Path.GetFullPath(scratchDirectory), PackageDirectoryName);
+        if (Directory.Exists(destination) || File.Exists(destination))
+            throw new IOException($"The compile-input snapshot destination already exists: {destination}");
+
+        CopyCompileInputs(source.RetroRewindRoot, destination, cancellationToken);
+        var snapshot = new RetroRewindCompileInputs(destination,
+            ComputeCodePulSha256(destination, cancellationToken),
+            ComputeCompileInputsSha256(destination, cancellationToken));
+        // A snapshot that hashes exactly like its source is that source; anything else means the
+        // folder was being written while it was read, which is the frontend's lease to hold.
+        if (!snapshot.CodePulSha256.Equals(source.CodePulSha256, StringComparison.OrdinalIgnoreCase) ||
+            !snapshot.CompileInputsSha256.Equals(source.CompileInputsSha256,
+                StringComparison.OrdinalIgnoreCase))
+        {
+            throw new IOException(
+                "The Retro Rewind compile inputs changed while they were being copied. " +
+                "Wait for its update to finish and retry.");
+        }
+        return snapshot;
+    }
+
+    private static void CopyCompileInputs(string root, string destination,
+        CancellationToken cancellationToken)
+    {
+        Directory.CreateDirectory(destination);
+        CopyInput(root, destination, CodePulPath(root), required: true, cancellationToken);
+        ReproduceTopology(root, destination, "files", cancellationToken);
+    }
+
+    private static void CopyInput(string root, string destination, string path, bool required,
+        CancellationToken cancellationToken)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        if (!File.Exists(path))
+        {
+            if (required) throw MissingCompileInput(path);
+            return;
+        }
+        RejectLink(path);
+        var output = Path.Combine(destination, RelativePath(root, path)
+            .Replace('/', Path.DirectorySeparatorChar));
+        Directory.CreateDirectory(Path.GetDirectoryName(output)!);
+        File.Copy(path, output, overwrite: true);
+    }
+
+
+    private static void ReproduceTopology(string root, string destination, string relative,
+        CancellationToken cancellationToken)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        var source = Path.Combine(root, relative);
+        if (!File.Exists(source) && !Directory.Exists(source)) return;
+        RejectLink(source);
+        var output = Path.Combine(destination, relative);
+        if (Directory.Exists(source)) Directory.CreateDirectory(output);
+        else File.Copy(source, output, overwrite: true);
+    }
+
+    private static void AppendFile(IncrementalHash hash, string root, string path, bool required,
+        CancellationToken cancellationToken)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        var relative = RelativePath(root, path);
+        if (!File.Exists(path))
+        {
+            if (required) throw MissingCompileInput(path);
+            AppendField(hash, "file:" + relative);
+            AppendField(hash, "absent");
+            return;
+        }
+
+        RejectLink(path);
+        AppendField(hash, "file:" + relative);
+        AppendField(hash, InputValidation.Sha256File(path));
+    }
+
+    private static void AppendTopology(IncrementalHash hash, string name, string path)
+    {
+        AppendField(hash, name);
+        if (!File.Exists(path) && !Directory.Exists(path))
+        {
+            AppendField(hash, "absent");
+            return;
+        }
+
+        var attributes = File.GetAttributes(path);
+        var kind = Directory.Exists(path) ? "directory" : "file";
+        if ((attributes & FileAttributes.ReparsePoint) != 0) kind += "+link";
+        AppendField(hash, kind);
+    }
+
+    private static void AppendField(IncrementalHash hash, string value)
+    {
+        var bytes = Encoding.UTF8.GetBytes(value);
+        Span<byte> length = stackalloc byte[sizeof(int)];
+        BinaryPrimitives.WriteInt32LittleEndian(length, bytes.Length);
+        hash.AppendData(length);
+        hash.AppendData(bytes);
+    }
+
+    private static string RelativePath(string root, string path) =>
+        Path.GetRelativePath(root, path).Replace('\\', '/');
+
+    private static string CodePulPath(string root) => Path.Combine(root, "Binaries", "Code.pul");
+
+    private static void RejectLink(string path)
+    {
+        if ((File.GetAttributes(path) & FileAttributes.ReparsePoint) != 0)
+            throw new InvalidDataException(
+                $"The Retro Rewind compile inputs contain a link instead of a regular entry: {path}");
+    }
+
+    private static InvalidDataException MissingCompileInput(string path) =>
+        new($"The Retro Rewind compile input is missing: {path}");
+
+    private static InvalidDataException MissingCodePul(string retroRewindRoot) =>
+        new($"The Retro Rewind folder is missing Binaries\\Code.pul: {retroRewindRoot}");
+}
diff --git a/Launcher/WiiCompiled.Setup/ConsoleCommands.cs b/Launcher/WiiCompiled.Setup/ConsoleCommands.cs
new file mode 100644
index 0000000..499b591
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/ConsoleCommands.cs
@@ -0,0 +1,328 @@
+using System.Text.Json;
+
+namespace WiiCompiled.Setup;
+
+internal static class ConsoleCommands
+{
+    public static int Help()
+    {
+        Console.Out.WriteLine($"{ProductInfo.Name} command-line setup {ProductInfo.Version}");
+        Console.Out.WriteLine("Wheel Wizard is the graphical interface for installing and launching WiiCompiled.");
+        Console.Out.WriteLine();
+        Console.Out.WriteLine("Commands:");
+        Console.Out.WriteLine("  --silent --game <image> --install-dir <dir> [--retro-dir <folder>] [--portable]");
+        Console.Out.WriteLine("  --verify-inputs --game <image> [--retro-dir <folder>]");
+        Console.Out.WriteLine("  --check-products [--install-dir <dir>] [--retro-dir <folder>] [--progress-json]");
+        Console.Out.WriteLine("  --repair-products --install-dir <dir> --retro-dir <folder> " +
+                             "(--download-retro-wfc-payload | --skip-retro-wfc-payload) [--progress-json]");
+        Console.Out.WriteLine("  --launch-retro | --launch-base");
+        Console.Out.WriteLine("  --uninstall --install-dir <dir>");
+        Console.Out.WriteLine("  --version");
+        return 0;
+    }
+
+    public static int Version()
+    {
+        Console.Out.WriteLine(ProductInfo.Version);
+        return 0;
+    }
+
+
+    public static int EmitPayloadIdentities(CommandLine command)
+    {
+        var root = Path.GetFullPath(command.PayloadRootPath!);
+        if (!Directory.Exists(InstalledLayout.Toolkit(root)) ||
+            !Directory.Exists(InstalledLayout.Workspace(root)))
+        {
+            throw new InvalidDataException($"{root} is not a staged payload root: expected " +
+                $"{InstalledLayout.ToolkitDirectoryName} and {InstalledLayout.WorkspaceDirectoryName} " +
+                "directories.");
+        }
+
+        var components = ToolkitFingerprint.ComputeComponents(root);
+        var identities = new PayloadIdentities(
+            components.Compile,
+            components.Translation,
+            components.NativeToolchain,
+            ToolkitFingerprint.ComputePackage(root),
+            ToolkitFingerprint.ComputeRuntimeAssets(root));
+        Console.Out.WriteLine(JsonSerializer.Serialize(identities));
+        return 0;
+    }
+
+    private sealed record PayloadIdentities(string ToolkitFingerprint, string TranslationFingerprint,
+        string NativeToolchainFingerprint, string ToolkitPackageFingerprint,
+        string RuntimeAssetsFingerprint);
+
+    public static int VerifyInputs(CommandLine command)
+    {
+        var reporter = command.ProgressJson ? new NdjsonInstallReporter() : null;
+        var temp = Path.Combine(Path.GetTempPath(), "mkwc-verify-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(temp);
+        try
+        {
+            using var payload = PayloadArchive.OpenCurrent();
+            var manifest = payload.ReadManifest();
+            var tool = Path.Combine(temp, "DolphinTool.exe");
+            payload.ExtractEntry(InstalledLayout.ToolkitEntryPrefix + "DolphinTool.exe", tool);
+            payload.ExtractDirectory(InstalledLayout.ToolkitEntryPrefix + "Redist", temp);
+            reporter?.Progress(InstallStages.Validate, "Checking the Wii disc image...", 10);
+            var header = InputValidation.ReadDiscHeaderAsync(tool, command.GamePath!).GetAwaiter().GetResult();
+            InputValidation.EnsureCompatibleDisc(header, manifest);
+
+            if (command.RetroDirectoryPath is not null)
+            {
+                reporter?.Progress(InstallStages.Validate, "Checking the Retro Rewind folder...", 80);
+                _ = CompileInputsFingerprint.Compute(command.RetroDirectoryPath);
+            }
+            reporter?.Success(command.InstallDirectory is null
+                ? ProductInfo.DefaultInstallDirectory
+                : Path.GetFullPath(command.InstallDirectory));
+            return 0;
+        }
+        catch (Exception ex) when (reporter is not null)
+        {
+            reporter.Failure(ex.Message);
+            Console.Error.WriteLine(ex);
+            return 1;
+        }
+        finally
+        {
+            reporter?.EnsureFinished("Input verification stopped before it reached a result.");
+            if (Directory.Exists(temp)) Directory.Delete(temp, recursive: true);
+        }
+    }
+
+    public static async Task<int> Install(CommandLine command, CancellationToken cancellationToken = default)
+    {
+        var logPath = Path.Combine(Path.GetTempPath(), "WiiCompiled-setup.log");
+        var logLock = new object();
+        void Log(string message)
+        {
+            lock (logLock)
+            {
+                File.AppendAllText(logPath, $"[{DateTime.Now:O}] {message}{Environment.NewLine}");
+            }
+        }
+        File.WriteAllText(logPath, $"{ProductInfo.Name} setup {ProductInfo.Version}{Environment.NewLine}");
+
+        var ndjson = command.ProgressJson ? new NdjsonInstallReporter(Log) : null;
+        IInstallReporter reporter = ndjson ?? (IInstallReporter)new ConsoleInstallReporter(Log);
+        var installDirectory = Path.GetFullPath(command.InstallDirectory!);
+        try
+        {
+            var engine = new InstallerEngine(reporter);
+            await engine.InstallAsync(new InstallOptions
+            {
+                GamePath = command.GamePath!,
+                RetroDirectoryPath = command.RetroDirectoryPath,
+                RetroWfcPayloadMode = command.RetroWfcPayloadMode,
+                InstallDirectory = installDirectory,
+                Portable = command.Portable
+            }, cancellationToken);
+            ndjson?.Success(installDirectory);
+            return 0;
+        }
+        catch (Exception ex) when (ndjson is not null)
+        {
+            // The caller reads stdout as a protocol, so the failure has to arrive as the terminal
+            // result line; the exception detail belongs on stderr and in the setup log.
+            ndjson.Failure(ex.Message);
+            Console.Error.WriteLine(ex);
+            return 1;
+        }
+        finally
+        {
+            // Nothing - not a cancellation, not a process-level abort path - may leave the caller
+            // without the one line it waits for.
+            ndjson?.EnsureFinished("The installer stopped before it reached a result.");
+        }
+    }
+
+    /// <summary>Reports whether the installed products are current, without building, mutating, networking,
+    /// or walking the Retro Rewind asset tree. Exit code 2 means work is required, not a protocol failure.</summary>
+    public static int CheckProducts(CommandLine command,
+        CancellationToken cancellationToken = default)
+    {
+        var reporter = command.ProgressJson ? new NdjsonInstallReporter() : null;
+        var installation = new Installation(string.IsNullOrWhiteSpace(command.InstallDirectory)
+            ? AppContext.BaseDirectory
+            : Path.GetFullPath(command.InstallDirectory));
+        try
+        {
+            // The lock also performs exact journal/scratch recovery. Acquire it for absent and
+            // partial roots too: a killed first install can have recoverable state even when the
+            // product executable/state file has not reached the live directory yet.
+            using var operationLock = InstallOperationLock.Acquire(installation.Root, reporter);
+            PortableInstallHealing.HealMovedInstall(installation, reporter);
+            var report = InspectProducts(installation, command.RetroDirectoryPath,
+                cancellationToken: cancellationToken);
+            Console.Out.WriteLine(command.ProgressJson
+                ? SerializeProductsReport(report)
+                : $"base: {report.Base.Reason} {report.Base.Detail}".TrimEnd());
+            if (!command.ProgressJson)
+                Console.Out.WriteLine(
+                    $"retro-rewind: {report.RetroRewind.Reason} {report.RetroRewind.Detail}".TrimEnd());
+            Console.Out.Flush();
+            reporter?.Success(installation.Root);
+            return report.RebuildRequired ? 2 : 0;
+        }
+        catch (Exception ex) when (reporter is not null)
+        {
+            reporter.Failure(ex.Message);
+            Console.Error.WriteLine(ex);
+            return 1;
+        }
+        finally
+        {
+            reporter?.EnsureFinished("The product check stopped before it reached a result.");
+        }
+    }
+
+    /// <summary>
+    /// Reconciles only the product work identified by a preceding health check. Every invocation
+    /// carries the canonical Retro Rewind folder and one payload option; the final inspection is
+    /// authoritative, so success is emitted only when every required product is current.
+    /// </summary>
+    public static async Task<int> RepairProducts(CommandLine command,
+        CancellationToken cancellationToken = default)
+    {
+        var logPath = Path.Combine(Path.GetTempPath(), "WiiCompiled-repair.log");
+        var logLock = new object();
+        void Log(string message)
+        {
+            lock (logLock)
+            {
+                File.AppendAllText(logPath, $"[{DateTime.Now:O}] {message}{Environment.NewLine}");
+            }
+        }
+
+        var ndjson = command.ProgressJson ? new NdjsonInstallReporter(Log) : null;
+        IInstallReporter reporter = ndjson is null ? new ConsoleInstallReporter(Log) : ndjson;
+        var installDirectory = Path.GetFullPath(command.InstallDirectory!);
+        var installation = new Installation(installDirectory);
+        try
+        {
+            if (!installation.IsPresent)
+                throw new InvalidOperationException(
+                    $"WiiCompiled is not installed at {installDirectory}.");
+
+            using var operationLock = InstallOperationLock.Acquire(installDirectory, reporter);
+            PortableInstallHealing.HealMovedInstall(installation, reporter);
+
+            cancellationToken.ThrowIfCancellationRequested();
+            var service = new ProductRepairService(installation, reporter);
+            using var scratch = InstallScratchSpace.CreateInsideInstall(installDirectory, reporter);
+            // Only compile inputs are copied out of the canonical installation, under the frontend's
+            // source lease. Its assets stay where they are and are read live at launch.
+            var canonicalRoot = RetroRewindSource.ResolveRetroRewind6(command.RetroDirectoryPath!);
+            var snapshot = CompileInputsFingerprint.Snapshot(canonicalRoot,
+                Path.Combine(scratch.Root, "compile-inputs"), cancellationToken);
+            var options = new ProductRepairService.ReconcileOptions
+            {
+                ScratchRoot = scratch.Root,
+                CanonicalRetroRewindRoot = canonicalRoot
+            };
+            var reconciliation = await service.RepairRetroAsync(snapshot, command.RetroWfcPayloadMode,
+                options, cancellationToken);
+            // ReconcileAsync is the completion barrier. Cancellation is observed throughout
+            // preparation and immediately before publication; a request racing with or following
+            // its uncancellable Publish/Commit must not turn committed state into a failure result.
+            // Reconciliation returns the exact payload-cache observation it proved or published, so
+            // terminal health does not hash the same payload a second time.
+            var after = InspectProducts(installation, snapshot,
+                reconciliation.CachedRetroWfcPayloadMatches);
+            if (after.RebuildRequired)
+                throw new InvalidOperationException(
+                    "Product repair completed without producing a current installation: " +
+                    after.ActionRequiredDetail);
+
+            ndjson?.Success(installDirectory);
+            return 0;
+        }
+        catch (Exception ex) when (ndjson is not null)
+        {
+            ndjson.Failure(ex is OperationCanceledException ? "Operation canceled." : ex.Message);
+            Console.Error.WriteLine(ex);
+            return 1;
+        }
+        finally
+        {
+            ndjson?.EnsureFinished("Product repair stopped before it reached a result.");
+        }
+    }
+
+    /// <summary>
+    /// The <c>products</c> record exactly as the v1 contract defines it: a typed status and a
+    /// human-readable detail per product, plus one aggregate. Nothing else is derived, because
+    /// nothing else is reported.
+    /// </summary>
+    internal sealed record ProductsReport(string InstallDirectory,
+        ProductState Base, ProductState RetroRewind)
+    {
+        public bool RebuildRequired => Base.ActionRequired || RetroRewind.ActionRequired;
+
+        public string ActionRequiredDetail => string.Join(" ",
+            new[] { Base, RetroRewind }
+                .Where(state => state.ActionRequired)
+                .Select(state => state.Detail)
+                .Where(detail => !string.IsNullOrWhiteSpace(detail)));
+    }
+
+    /// <summary>
+    /// Inspects both products against the canonical Retro Rewind installation: the caller's explicit
+    /// folder when it supplied one, otherwise the recorded <c>retro_rewind_root</c>.
+    /// </summary>
+    internal static ProductsReport InspectProducts(Installation installation,
+        string? canonicalRetroDirectory = null, bool? cachedRetroWfcPayloadMatches = null,
+        CancellationToken cancellationToken = default)
+    {
+        if (!installation.IsPresent) return AbsentReport(installation);
+        var canonical = installation.ResolveCanonicalCompileInputs(canonicalRetroDirectory,
+            out var canonicalError, cancellationToken);
+        return BuildReport(installation, canonical, canonicalError, cachedRetroWfcPayloadMatches);
+    }
+
+    /// <summary>
+    /// Builds the report from a compile-input identity the operation already observed under its
+    /// lock, so a repair does not hash the same canonical inputs at every decision boundary.
+    /// </summary>
+    internal static ProductsReport InspectProducts(Installation installation,
+        RetroRewindCompileInputs canonical, bool? cachedRetroWfcPayloadMatches = null) =>
+        installation.IsPresent
+            ? BuildReport(installation, canonical, null, cachedRetroWfcPayloadMatches)
+            : AbsentReport(installation);
+
+    private static ProductsReport AbsentReport(Installation installation) =>
+        // Probing a path nothing was installed to is a valid answer. It must not create a directory
+        // or turn the frontend's first-install probe into a repair request.
+        new(installation.Root,
+            new ProductState(ProductStatus.Absent, "WiiCompiled is not installed here."),
+            new ProductState(ProductStatus.Absent, "Retro Rewind is not installed."));
+
+    private static ProductsReport BuildReport(Installation installation,
+        RetroRewindCompileInputs? canonical, string? canonicalError,
+        bool? cachedRetroWfcPayloadMatches)
+    {
+        var toolkitFingerprint = installation.ResolveToolkitFingerprint();
+        return new ProductsReport(installation.Root,
+            installation.CheckBase(toolkitFingerprint),
+            installation.CheckRetroRewind(toolkitFingerprint, canonical, canonicalError,
+                cachedRetroWfcPayloadMatches));
+    }
+
+    /// <summary>
+    /// Emits the stable <c>products</c> record. The frontend branches on <c>status</c> only, never
+    /// on the detail text, and an unrecognized status fails closed on its side.
+    /// </summary>
+    internal static string SerializeProductsReport(ProductsReport report) =>
+        System.Text.Json.JsonSerializer.Serialize(new
+        {
+            type = "products",
+            setupVersion = ProductInfo.Version,
+            installDir = report.InstallDirectory,
+            rebuildRequired = report.RebuildRequired,
+            @base = new { status = report.Base.Reason, detail = report.Base.Detail },
+            retroRewind = new { status = report.RetroRewind.Reason, detail = report.RetroRewind.Detail }
+        });
+}
diff --git a/Launcher/WiiCompiled.Setup/FileSystemUtilities.cs b/Launcher/WiiCompiled.Setup/FileSystemUtilities.cs
new file mode 100644
index 0000000..1b662f9
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/FileSystemUtilities.cs
@@ -0,0 +1,233 @@
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// One entry of an exact regular directory tree. Directory topology is part of the content
+/// contract everywhere this walker is used: an empty directory can be a runtime-visible asset just
+/// as a regular file can be, so it must not disappear from a content identity or a staged copy.
+/// </summary>
+internal sealed record RegularTreeEntry(string RelativePath, string FullPath, bool IsDirectory,
+    bool IsEmptyDirectory, long Length);
+
+internal static class FileSystemUtilities
+{
+    public static void CopyDirectory(string source, string destination,
+        CancellationToken cancellationToken = default)
+    {
+        Directory.CreateDirectory(destination);
+        foreach (var directory in Directory.EnumerateDirectories(source, "*", SearchOption.AllDirectories))
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            Directory.CreateDirectory(Path.Combine(destination, Path.GetRelativePath(source, directory)));
+        }
+        foreach (var file in Directory.EnumerateFiles(source, "*", SearchOption.AllDirectories))
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            var output = Path.Combine(destination, Path.GetRelativePath(source, file));
+            Directory.CreateDirectory(Path.GetDirectoryName(output)!);
+            File.Copy(file, output, overwrite: true);
+        }
+    }
+
+    /// <summary>
+    /// Enumerates an exact tree without following links, sorted by forward-slash relative path.
+    /// Every directory appears exactly once and is flagged when it has no children at all.
+    /// </summary>
+    public static IReadOnlyList<RegularTreeEntry> EnumerateRegularTree(string root,
+        CancellationToken cancellationToken = default, string description = "The directory tree")
+    {
+        var rootInfo = new DirectoryInfo(Path.GetFullPath(root));
+        if (!rootInfo.Exists)
+            throw new DirectoryNotFoundException($"{description} is missing: {rootInfo.FullName}");
+        RejectReparsePoint(rootInfo, description);
+
+        var entries = new List<RegularTreeEntry>();
+        var pending = new Stack<DirectoryInfo>();
+        pending.Push(rootInfo);
+        while (pending.Count > 0)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            var directory = pending.Pop();
+            var hasChild = false;
+            foreach (var entry in directory.EnumerateFileSystemInfos())
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                RejectReparsePoint(entry, description);
+                hasChild = true;
+                switch (entry)
+                {
+                    case DirectoryInfo child:
+                        pending.Push(child);
+                        break;
+                    case FileInfo file:
+                        entries.Add(new RegularTreeEntry(Relative(rootInfo, file.FullName), file.FullName,
+                            false, false, file.Length));
+                        break;
+                    default:
+                        throw new InvalidDataException(
+                            $"{description} contains an unsupported file-system entry: {entry.FullName}");
+                }
+            }
+
+            if (directory != rootInfo)
+                entries.Add(new RegularTreeEntry(Relative(rootInfo, directory.FullName), directory.FullName,
+                    true, !hasChild, 0));
+        }
+
+        entries.Sort((left, right) => StringComparer.Ordinal.Compare(left.RelativePath, right.RelativePath));
+        return entries;
+    }
+
+    /// <summary>Removes exactly this directory, clearing attributes that would refuse deletion.</summary>
+    public static void DeleteDirectoryIfExists(string path)
+    {
+        if (!Directory.Exists(path)) return;
+        foreach (var entry in Directory.EnumerateFileSystemEntries(path, "*", SearchOption.AllDirectories))
+        {
+            try { File.SetAttributes(entry, FileAttributes.Normal); }
+            catch { }
+        }
+        try { File.SetAttributes(path, FileAttributes.Normal); }
+        catch { }
+        Directory.Delete(path, recursive: true);
+    }
+
+    /// <summary>
+    /// One comparable spelling of a path. Normalization happens before the trailing separator is
+    /// dropped, because <c>Path.GetFullPath("C:")</c> is the current directory on that drive rather
+    /// than the drive root.
+    /// </summary>
+    public static string NormalizePath(string path) =>
+        Path.TrimEndingDirectorySeparator(Path.GetFullPath(path));
+
+    /// <summary>Whether two paths name the same location, after normalization.</summary>
+    public static bool PathsEqual(string left, string right) =>
+        NormalizePath(left).Equals(NormalizePath(right), StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>Whether <paramref name="candidate"/> is <paramref name="container"/> or inside it, using a
+    /// normalized prefix check so <c>C:\Games2</c> doesn't match inside <c>C:\Games</c>.</summary>
+    public static bool PathContains(string container, string candidate)
+    {
+        container = NormalizePath(container);
+        candidate = NormalizePath(candidate);
+        return candidate.Equals(container, StringComparison.OrdinalIgnoreCase) ||
+               candidate.StartsWith(container + Path.DirectorySeparatorChar,
+                   StringComparison.OrdinalIgnoreCase);
+    }
+
+    /// <summary>Whether two paths are equal or one contains the other, after normalization.</summary>
+    public static bool PathsOverlap(string left, string right) =>
+        PathContains(left, right) || PathContains(right, left);
+
+    /// <summary>Location rules shared by install directories and portable roots (both are trees setup may
+    /// replace and uninstall may delete). <paramref name="subject"/> only names what's being rejected.</summary>
+    public static void EnsureUsableLocation(string path, string subject)
+    {
+        if (string.IsNullOrWhiteSpace(path))
+            throw new InvalidOperationException($"{subject} is required.");
+        if (path.StartsWith(@"\\", StringComparison.Ordinal))
+            throw new InvalidOperationException($"{subject} must be on a local drive, not a network path.");
+        if (path.Length > MaximumLocationLength)
+            throw new InvalidOperationException(
+                $"{subject} path is too long. Choose a path shorter than {MaximumLocationLength} characters.");
+
+        var full = NormalizePath(path);
+        var drive = Path.GetPathRoot(full);
+        if (string.IsNullOrWhiteSpace(drive) ||
+            full.Equals(NormalizePath(drive), StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidOperationException(
+                $"{subject} must be a subfolder, not the root of a drive. " +
+                "Choose a dedicated folder such as D:\\Games\\WiiCompiled\\Install.");
+        }
+
+        var windows = Environment.GetFolderPath(Environment.SpecialFolder.Windows);
+        if (!string.IsNullOrEmpty(windows) && PathContains(windows, full))
+            throw new InvalidOperationException($"{subject} cannot be inside the Windows directory.");
+
+        foreach (var folder in ReservedLocations)
+        {
+            var reserved = Environment.GetFolderPath(folder);
+            if (string.IsNullOrEmpty(reserved)) continue;
+            if (full.Equals(NormalizePath(reserved), StringComparison.OrdinalIgnoreCase))
+                throw new InvalidOperationException(
+                    $"{subject} cannot be {reserved}. Choose a dedicated folder.");
+        }
+    }
+
+    /// <summary>
+    /// The local build nests deep paths (llvm-mingw headers, CMake object directories) below the
+    /// installation, so the root itself has to stay well inside the classic path limit.
+    /// </summary>
+    private const int MaximumLocationLength = 180;
+
+    /// <summary>Well-known folders that must never <em>be</em> an installation or portable root.</summary>
+    private static readonly Environment.SpecialFolder[] ReservedLocations =
+    [
+        Environment.SpecialFolder.ProgramFiles,
+        Environment.SpecialFolder.ProgramFilesX86,
+        Environment.SpecialFolder.CommonProgramFiles,
+        Environment.SpecialFolder.System,
+        Environment.SpecialFolder.SystemX86,
+        Environment.SpecialFolder.UserProfile,
+        Environment.SpecialFolder.LocalApplicationData,
+        Environment.SpecialFolder.ApplicationData,
+        Environment.SpecialFolder.CommonApplicationData,
+        Environment.SpecialFolder.DesktopDirectory,
+        Environment.SpecialFolder.MyDocuments
+    ];
+
+    /// <summary>
+    /// Writes a file so that a reader only ever sees the old contents or the new ones: the bytes go
+    /// to a sibling temporary and are renamed over the destination, which is atomic on NTFS.
+    /// Interrupting the write leaves the temporary behind, never a truncated document.
+    /// </summary>
+    public static void WriteAtomic(string path, byte[] contents)
+    {
+        Directory.CreateDirectory(Path.GetDirectoryName(Path.GetFullPath(path))!);
+        var temporary = path + $".tmp-{Guid.NewGuid():N}";
+        try
+        {
+            File.WriteAllBytes(temporary, contents);
+            File.Move(temporary, path, overwrite: true);
+        }
+        finally
+        {
+            try { File.Delete(temporary); } catch { }
+        }
+    }
+
+    public static void WriteAtomic(string path, string contents) =>
+        WriteAtomic(path, System.Text.Encoding.UTF8.GetBytes(contents));
+
+    /// <summary>
+    /// Refuses an operation that cannot fit on the destination drive. The caller owns the allowance
+    /// it needs; this owns the one message and the one drive-readiness rule both paths report.
+    /// </summary>
+    public static void EnsureFreeSpace(string path, long required, string operationDescription)
+    {
+        var root = Path.GetPathRoot(path)
+                   ?? throw new InvalidOperationException(
+                       "The installation directory is not on a local drive.");
+        var drive = new DriveInfo(root);
+        if (!drive.IsReady)
+            throw new IOException($"The destination drive {root} is not ready.");
+        if (drive.AvailableFreeSpace < required)
+        {
+            throw new IOException(
+                $"Not enough free space on {root}. {operationDescription} needs approximately " +
+                $"{FormatGiB(required)} free, but only {FormatGiB(drive.AvailableFreeSpace)} is available.");
+        }
+    }
+
+    private static string FormatGiB(long bytes) => $"{bytes / (1024d * 1024 * 1024):0.0} GiB";
+
+    public static void RejectReparsePoint(FileSystemInfo entry, string description)
+    {
+        if ((entry.Attributes & FileAttributes.ReparsePoint) != 0)
+            throw new InvalidDataException(
+                $"{description} contains a reparse point instead of a regular entry: {entry.FullName}");
+    }
+
+    private static string Relative(DirectoryInfo root, string fullPath) =>
+        Path.GetRelativePath(root.FullName, fullPath).Replace('\\', '/');
+}
diff --git a/Launcher/WiiCompiled.Setup/GameLaunchService.cs b/Launcher/WiiCompiled.Setup/GameLaunchService.cs
new file mode 100644
index 0000000..58d10d0
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/GameLaunchService.cs
@@ -0,0 +1,64 @@
+using System.Diagnostics;
+
+namespace WiiCompiled.Setup;
+
+internal static class GameLaunchService
+{
+    public static Task<int> LaunchAsync(BuildProfile profile)
+    {
+        var installation = new Installation(AppContext.BaseDirectory);
+        using var operation = InstallOperationLock.Acquire(installation.Root);
+        // A portable installation the user moved is reconciled before anything is read from its
+        // recorded location. Launch never needs the discarded native build tree.
+        PortableInstallHealing.HealMovedInstall(installation,
+            new DelegatingInstallReporter(Console.Error.WriteLine));
+        EnsureProductIsCurrent(installation, profile);
+        return Task.FromResult(LaunchInstalledProduct(installation, profile));
+    }
+
+    private static void EnsureProductIsCurrent(Installation installation, BuildProfile profile)
+    {
+        var state = InspectProductForLaunch(installation, profile);
+
+        if (state.Status == ProductStatus.Current) return;
+        if (state.Status == ProductStatus.Absent)
+            throw new InvalidDataException(
+                "Retro Rewind is not installed. Install Retro Rewind through Wheel Wizard first.");
+
+        throw new InvalidDataException(string.IsNullOrWhiteSpace(state.Detail)
+            ? "This product must be repaired through Wheel Wizard before it can be launched."
+            : state.Detail);
+    }
+
+    /// <summary>Validates the executable, inputs, build provenance, runtime assets, payload cache, and the
+    /// canonical Retro Rewind root, so a missing/invalid root fails launch instead of starting a vanilla-looking game.</summary>
+    internal static ProductState InspectProductForLaunch(Installation installation, BuildProfile profile)
+    {
+        var toolkitFingerprint = installation.ResolveToolkitFingerprint();
+        if (profile == BuildProfile.Base)
+            return installation.CheckBase(toolkitFingerprint);
+        var canonical = installation.ResolveCanonicalCompileInputs(null, out var canonicalError);
+        return installation.CheckRetroRewind(toolkitFingerprint, canonical, canonicalError);
+    }
+
+    private static int LaunchInstalledProduct(Installation installation, BuildProfile profile)
+    {
+        var runtimeRoot = profile == BuildProfile.Base ? installation.BaseDirectory : installation.RetroDirectory;
+        var runtime = profile == BuildProfile.Base ? installation.BaseExecutable : installation.RetroExecutable;
+        if (!File.Exists(runtime))
+            throw new FileNotFoundException("The installed recomp is missing. Run the installer again.", runtime);
+        if (!File.Exists(Path.Combine(installation.GameDataDirectory, "sys", "fst.bin")))
+            throw new InvalidDataException("The installed Mario Kart Wii game data is missing. Run the installer again.");
+
+        var info = new ProcessStartInfo
+        {
+            FileName = runtime,
+            WorkingDirectory = runtimeRoot,
+            UseShellExecute = false
+        };
+        using var process = Process.Start(info) ?? throw new InvalidOperationException("Could not start the recomp.");
+        process.WaitForExit();
+        return process.ExitCode;
+    }
+
+}
diff --git a/Launcher/WiiCompiled.Setup/InputValidation.cs b/Launcher/WiiCompiled.Setup/InputValidation.cs
new file mode 100644
index 0000000..854bd37
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/InputValidation.cs
@@ -0,0 +1,304 @@
+using System.Diagnostics;
+using System.Buffers.Binary;
+using System.Net;
+using System.Security.Cryptography;
+using System.Text.Json;
+
+namespace WiiCompiled.Setup;
+
+internal static class InputValidation
+{
+    private const long MaximumRetroWfcPayloadBytes = 16L * 1024 * 1024;
+    // The payload is tens of kilobytes from a single fixed endpoint 30s is good.
+    private static readonly TimeSpan RetroWfcDownloadTimeout = TimeSpan.FromSeconds(30);
+    private static readonly TimeSpan RetroWfcRetryDelay = TimeSpan.FromSeconds(1);
+    private static readonly HashSet<string> SupportedDiscImageExtensions = new(
+        [".iso", ".gcm", ".gcz", ".ciso", ".wbfs", ".wia", ".rvz"],
+        StringComparer.OrdinalIgnoreCase);
+
+    public const string CurrentRetroWfcPayloadUri = "http://nas.play.rwfc.net/payload?g=RMCPD00";
+    private static readonly string RetroWfcOfflinePayloadFile =
+        Path.Combine("binary", "payload.RMCPD00.bin");
+
+    /// <summary>Retro-WFC production payload signing key (PROD PayloadPublicKey). Verifies
+    /// the payload past the 0x110 header; on-console stage1 pins the same key, so
+    /// rotating it upstream is a breaking release there too.</summary>
+    private static readonly byte[] RetroWfcPayloadSigningModulus = Convert.FromHexString(
+        "e6e6ce416f350422cbe26c36a67eba613dddcd27d79afd077dcc593e5319eaa6" +
+        "080293400033876d3dbdfda12c15f46ac8e4f5b40c56e7b5f67e91647d618cb9" +
+        "99c041581b86d103bd7723fceac03ad3ad5134bf611cd47dc527002596821e94" +
+        "1c9470938fea07238a84767323e4a610bd996465e59d04dae4febd915c96fc07" +
+        "39e4e818300829d78f3f2275e1f3fbd2507f1bde74f24a5285e61007b959a583" +
+        "b4820d75eca76680866efe5d79590b82c3577b796155899530e305b94b4ceef4" +
+        "428644b719df3d8540c9588f5bb02d83d3938255d1a1e073d3408163ff93a615" +
+        "a2106a03923a397aad6a29ebb43031ed06de1575c8ee2b54678fa059e025f455");
+
+    private const int RetroWfcPayloadSignedRegionOffset = 0x110;
+    private const int RetroWfcPayloadSignatureOffset = 0x10;
+    private const int RetroWfcPayloadMinimumBytes = 0x130;
+
+    public static void ValidateExtension(string gamePath)
+    {
+        if (!File.Exists(gamePath))
+            throw new FileNotFoundException("The selected game image does not exist.", gamePath);
+        var extension = Path.GetExtension(gamePath);
+        if (!SupportedDiscImageExtensions.Contains(extension))
+            throw new InvalidDataException(
+                "Select a complete Wii disc image in ISO, GCM, GCZ, CISO, WBFS, WIA, or RVZ format.");
+    }
+
+    public static async Task<DiscHeader> ReadDiscHeaderAsync(string dolphinTool, string gamePath,
+        CancellationToken cancellationToken = default)
+    {
+        ValidateExtension(gamePath);
+        var result = await ProcessRunner.RunAsync(dolphinTool,
+            ["header", "-i", Path.GetFullPath(gamePath), "-j"], null, cancellationToken);
+        if (result.ExitCode != 0)
+            throw new InvalidDataException("DolphinTool could not read this disc image. " + result.CombinedOutput.Trim());
+
+        var json = result.StandardOutput.Split(['\r', '\n'], StringSplitOptions.RemoveEmptyEntries)
+            .FirstOrDefault(line => line.TrimStart().StartsWith('{'));
+        if (json is null)
+            throw new InvalidDataException("DolphinTool did not return disc metadata.");
+        return JsonSerializer.Deserialize<DiscHeader>(json)
+               ?? throw new InvalidDataException("DolphinTool returned invalid disc metadata.");
+    }
+
+    public static void EnsureCompatibleDisc(DiscHeader header, PayloadManifest manifest)
+    {
+        if (!header.GameId.Equals(manifest.ExpectedGameId, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidDataException(
+                $"This build supports Mario Kart Wii PAL ({manifest.ExpectedGameId}). " +
+                $"The selected image is {header.GameId} ({header.InternalName}, {header.Region}).");
+        }
+    }
+
+    public static string ValidateStagedRetroWfcPayloadDirectory(string stagedDirectory,
+        RSAParameters? signingKey = null)
+    {
+        if (string.IsNullOrWhiteSpace(stagedDirectory))
+            throw new InvalidDataException("The staged Retro-WFC payload directory is missing.");
+
+        var root = Path.GetFullPath(stagedDirectory);
+        var payload = Path.Combine(root, RetroWfcOfflinePayloadFile);
+        if (!File.Exists(payload))
+            throw new InvalidDataException(
+                "The staged Retro-WFC payload directory does not contain binary\\payload.RMCPD00.bin.");
+        ValidateRetroWfcPayloadFile(payload, signingKey);
+        return root;
+    }
+
+    public static string ResolveRetroWfcPayloadFile(string stagedDirectory,
+        RSAParameters? signingKey = null) =>
+        Path.Combine(ValidateStagedRetroWfcPayloadDirectory(stagedDirectory, signingKey),
+            RetroWfcOfflinePayloadFile);
+
+    public static string ComputeRetroWfcPayloadSha256(string stagedDirectory,
+        RSAParameters? signingKey = null) =>
+        Sha256File(ResolveRetroWfcPayloadFile(stagedDirectory, signingKey));
+
+    public static void ValidateRetroWfcPayloadUri(string uriText)
+    {
+        if (!string.Equals(uriText, CurrentRetroWfcPayloadUri, StringComparison.Ordinal))
+            throw new InvalidDataException("The installer does not define the fixed Retro-WFC payload endpoint.");
+    }
+
+    public static async Task<RetroWfcPayloadSnapshot> DownloadRetroWfcPayloadAsync(string uriText,
+        string destinationDirectory,
+        CancellationToken cancellationToken)
+    {
+        ValidateRetroWfcPayloadUri(uriText);
+        var uri = new Uri(uriText, UriKind.Absolute);
+
+        var root = Path.GetFullPath(destinationDirectory);
+        var destination = Path.Combine(root, RetroWfcOfflinePayloadFile);
+        Directory.CreateDirectory(Path.GetDirectoryName(destination)!);
+        using var handler = new HttpClientHandler { AllowAutoRedirect = false };
+        using var client = new HttpClient(handler) { Timeout = Timeout.InfiniteTimeSpan };
+
+        for (var attempt = 1; attempt <= 2; attempt++)
+        {
+            try
+            {
+                return await DownloadRetroWfcPayloadAttemptAsync(client, uri, root, destination,
+                    cancellationToken);
+            }
+            catch (Exception ex) when (attempt == 1 &&
+                                       IsTransientRetroWfcDownloadFailure(ex, cancellationToken))
+            {
+                await Task.Delay(RetroWfcRetryDelay, cancellationToken);
+            }
+        }
+
+        throw new InvalidOperationException("The Retro-WFC download retry loop ended unexpectedly.");
+    }
+
+    private static async Task<RetroWfcPayloadSnapshot> DownloadRetroWfcPayloadAttemptAsync(
+        HttpClient client, Uri uri, string root, string destination, CancellationToken cancellationToken)
+    {
+        var temporary = destination + $".tmp-{Guid.NewGuid():N}";
+        using var timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        timeout.CancelAfter(RetroWfcDownloadTimeout);
+        var attemptToken = timeout.Token;
+        try
+        {
+            using var response = await client.GetAsync(uri, HttpCompletionOption.ResponseHeadersRead, attemptToken);
+            if ((int)response.StatusCode is >= 300 and < 400)
+                throw new InvalidDataException(
+                    "The fixed Retro-WFC payload endpoint redirected; refusing to fetch from a different target.");
+            response.EnsureSuccessStatusCode();
+            if (response.Content.Headers.ContentLength is > MaximumRetroWfcPayloadBytes)
+                throw new InvalidDataException("The Retro-WFC payload is unexpectedly large.");
+            await using var input = await response.Content.ReadAsStreamAsync(attemptToken);
+            long total = 0;
+            string actualSha256;
+            await using (var output = new FileStream(temporary, FileMode.CreateNew, FileAccess.Write,
+                             FileShare.None, 64 * 1024, FileOptions.Asynchronous))
+            {
+                var buffer = new byte[64 * 1024];
+                using var hash = IncrementalHash.CreateHash(HashAlgorithmName.SHA256);
+                while (true)
+                {
+                    var read = await input.ReadAsync(buffer, attemptToken);
+                    if (read == 0) break;
+                    total = checked(total + read);
+                    if (total > MaximumRetroWfcPayloadBytes)
+                        throw new InvalidDataException("The Retro-WFC payload is unexpectedly large.");
+                    hash.AppendData(buffer, 0, read);
+                    await output.WriteAsync(buffer.AsMemory(0, read), attemptToken);
+                }
+                actualSha256 = Convert.ToHexString(hash.GetHashAndReset()).ToLowerInvariant();
+            }
+            ValidateRetroWfcPayloadFile(temporary);
+            File.Move(temporary, destination, overwrite: true);
+            return new RetroWfcPayloadSnapshot(root, actualSha256, total);
+        }
+        catch (OperationCanceledException ex) when (!cancellationToken.IsCancellationRequested)
+        {
+            throw new TimeoutException(
+                $"The Retro-WFC payload download did not finish within {RetroWfcDownloadTimeout.TotalMinutes:0} minutes.",
+                ex);
+        }
+        finally
+        {
+            try { File.Delete(temporary); } catch { }
+        }
+    }
+
+    internal static bool IsTransientRetroWfcDownloadFailure(Exception exception,
+        CancellationToken cancellationToken)
+    {
+        if (cancellationToken.IsCancellationRequested) return false;
+        if (exception is TimeoutException) return true;
+        if (exception is not HttpRequestException request) return false;
+        return request.StatusCode is null or HttpStatusCode.RequestTimeout or
+               HttpStatusCode.TooManyRequests ||
+               request.StatusCode is { } status && (int)status >= 500;
+    }
+
+    private static void ValidateRetroWfcPayloadFile(string payload, RSAParameters? signingKey = null)
+    {
+        byte[] image;
+        using (var stream = File.OpenRead(payload))
+        {
+            if (stream.Length > MaximumRetroWfcPayloadBytes)
+                throw new InvalidDataException("The Retro-WFC payload is unexpectedly large.");
+            if (stream.Length < RetroWfcPayloadMinimumBytes)
+                throw new InvalidDataException("The Retro-WFC payload has an invalid header.");
+            image = new byte[stream.Length];
+            stream.ReadExactly(image);
+        }
+
+        if (!image.AsSpan(0, 12).SequenceEqual("WWFC/Payload"u8))
+            throw new InvalidDataException("The Retro-WFC payload has an invalid header.");
+        var declaredSize = BinaryPrimitives.ReadUInt32BigEndian(image.AsSpan(0x0C));
+        if (declaredSize != image.Length)
+            throw new InvalidDataException(
+                $"The Retro-WFC payload declares {declaredSize} bytes but contains {image.Length}.");
+
+        using var rsa = RSA.Create();
+        rsa.ImportParameters(signingKey ?? new RSAParameters
+        {
+            Modulus = RetroWfcPayloadSigningModulus,
+            Exponent = [0x01, 0x00, 0x01],
+        });
+        if (!rsa.VerifyData(
+                image.AsSpan(RetroWfcPayloadSignedRegionOffset),
+                image.AsSpan(RetroWfcPayloadSignatureOffset,
+                    RetroWfcPayloadSignedRegionOffset - RetroWfcPayloadSignatureOffset),
+                HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1))
+            throw new InvalidDataException(
+                "The Retro-WFC payload is not signed by the pinned Retro-WFC signing key.");
+    }
+
+    public static string Sha256File(string path)
+    {
+        using var stream = File.OpenRead(path);
+        return Convert.ToHexString(SHA256.HashData(stream)).ToLowerInvariant();
+    }
+}
+
+internal sealed record ProcessResult(int ExitCode, string StandardOutput, string StandardError)
+{
+    public string CombinedOutput => StandardOutput + Environment.NewLine + StandardError;
+}
+
+internal static class ProcessRunner
+{
+    /// <summary>Runs a redirected child process to completion. <paramref name="configure"/> sets up a
+    /// working directory or scrubbed environment; <paramref name="capture"/> is off for callers that only
+    /// forward output live, so a build's output isn't buffered in memory for nobody to read.</summary>
+    public static async Task<ProcessResult> RunAsync(string executable, IReadOnlyList<string> arguments,
+        Action<string>? output, CancellationToken cancellationToken,
+        Action<ProcessStartInfo>? configure = null, bool capture = true,
+        Action<Exception>? onTerminationFailure = null)
+    {
+        var info = new ProcessStartInfo
+        {
+            FileName = executable,
+            UseShellExecute = false,
+            CreateNoWindow = true,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true
+        };
+        foreach (var argument in arguments) info.ArgumentList.Add(argument);
+        configure?.Invoke(info);
+
+        using var process = new Process { StartInfo = info, EnableRaisingEvents = true };
+        var stdout = new List<string>();
+        var stderr = new List<string>();
+        process.OutputDataReceived += (_, e) => { if (e.Data is not null) { if (capture) stdout.Add(e.Data); output?.Invoke(e.Data); } };
+        process.ErrorDataReceived += (_, e) => { if (e.Data is not null) { if (capture) stderr.Add(e.Data); output?.Invoke(e.Data); } };
+        if (!process.Start()) throw new InvalidOperationException($"Could not start {executable}.");
+        process.BeginOutputReadLine();
+        process.BeginErrorReadLine();
+        await WaitForExitAsync(process, cancellationToken, onTerminationFailure);
+        return new ProcessResult(process.ExitCode, string.Join(Environment.NewLine, stdout),
+            string.Join(Environment.NewLine, stderr));
+    }
+
+    public static async Task WaitForExitAsync(Process process, CancellationToken cancellationToken,
+        Action<Exception>? onTerminationFailure = null)
+    {
+        try
+        {
+            await process.WaitForExitAsync(cancellationToken);
+        }
+        catch (OperationCanceledException)
+        {
+            try
+            {
+                if (!process.HasExited) process.Kill(entireProcessTree: true);
+            }
+            catch (Exception ex)
+            {
+                onTerminationFailure?.Invoke(ex);
+            }
+            await process.WaitForExitAsync(CancellationToken.None);
+            process.WaitForExit();
+            throw;
+        }
+        process.WaitForExit();
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/InstallOperationLock.cs b/Launcher/WiiCompiled.Setup/InstallOperationLock.cs
new file mode 100644
index 0000000..44f1c78
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/InstallOperationLock.cs
@@ -0,0 +1,86 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// A fail-fast, cross-process lock covering install, repair and launch operations for one install
+/// root. The lock file lives beside the installation, so replacing the installation cannot replace
+/// or release the lock that protects it.
+/// </summary>
+internal sealed class InstallOperationLock : IDisposable
+{
+    private readonly FileStream _stream;
+
+    private InstallOperationLock(FileStream stream) => _stream = stream;
+
+    public string LockPath => _stream.Name;
+
+    public static InstallOperationLock Acquire(string installDirectory, IInstallReporter? reporter = null)
+    {
+        var root = InstallOperationPaths.NormalizeRoot(installDirectory);
+        var parent = InstallOperationPaths.GetParent(root);
+        Directory.CreateDirectory(parent);
+        var path = InstallOperationPaths.GetLockPath(root);
+
+        FileStream stream;
+        try
+        {
+            stream = new FileStream(path, FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.None,
+                bufferSize: 1, FileOptions.WriteThrough);
+        }
+        catch (IOException ex)
+        {
+            throw new InvalidOperationException(
+                "Another WiiCompiled operation is already using this installation. " +
+                "Wait for the current game, install, or repair operation to finish.", ex);
+        }
+
+        try
+        {
+            InstallTransaction.Recover(root, reporter);
+            InstallScratchSpace.Recover(root, reporter);
+            return new InstallOperationLock(stream);
+        }
+        catch
+        {
+            stream.Dispose();
+            throw;
+        }
+    }
+
+    public void Dispose() => _stream.Dispose();
+}
+
+/// <summary>Deterministic paths shared by the operation lock and its recovery journal.</summary>
+internal static class InstallOperationPaths
+{
+    public static string NormalizeRoot(string installDirectory)
+    {
+        if (string.IsNullOrWhiteSpace(installDirectory))
+            throw new ArgumentException("The installation directory is required.", nameof(installDirectory));
+        return FileSystemUtilities.NormalizePath(installDirectory);
+    }
+
+    public static string GetParent(string normalizedRoot) =>
+        Directory.GetParent(normalizedRoot)?.FullName
+        ?? throw new InvalidOperationException("The installation directory must have a parent directory.");
+
+
+    public static string GetScopeId(string normalizedRoot) =>
+        HashId(16, normalizedRoot.ToUpperInvariant());
+
+    public static string HashId(int hexLength, params string[] canonicalParts) =>
+        Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(string.Join('\n', canonicalParts))))
+            .ToLowerInvariant()[..hexLength];
+
+    public static string GetLockPath(string normalizedRoot) =>
+        Path.Combine(GetParent(normalizedRoot), $".mkwc-operation-{GetScopeId(normalizedRoot)}.lock");
+
+    public static string GetJournalPath(string normalizedRoot) =>
+        Path.Combine(GetParent(normalizedRoot), $".mkwc-transaction-{GetScopeId(normalizedRoot)}.json");
+
+    public static string GetWorkRoot(string normalizedRoot, Guid transactionId) =>
+        Path.Combine(GetParent(normalizedRoot),
+            $".mkwc-transaction-{GetScopeId(normalizedRoot)}-{transactionId:N}");
+}
diff --git a/Launcher/WiiCompiled.Setup/InstallProgress.cs b/Launcher/WiiCompiled.Setup/InstallProgress.cs
new file mode 100644
index 0000000..ac1e1fb
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/InstallProgress.cs
@@ -0,0 +1,235 @@
+using System.Text.Json;
+
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// Stable stage identifiers reported by <c>--progress-json</c>. These are part of the public
+/// WheelWizard contract (docs/WHEELWIZARD_CONTRACT.md): the strings may gain new members, but an
+/// existing identifier never changes meaning.
+/// </summary>
+internal static class InstallStages
+{
+    public const string Validate = "validate";
+    public const string ExtractToolkit = "extract-toolkit";
+    public const string ExtractDisc = "extract-disc";
+    public const string PrepareRetro = "prepare-retro";
+    public const string BuildBase = "build-base";
+    public const string BuildRetro = "build-retro";
+    public const string Publish = "publish";
+}
+
+/// <summary>
+/// Where an installation reports what it is doing. Progress is coarse and monotonic; raw translator
+/// and compiler output is a diagnostic, never progress, because it is unbounded and machine-hostile.
+/// </summary>
+internal interface IInstallReporter
+{
+    void Progress(string stage, string message, int percent);
+    void Diagnostic(string line);
+}
+
+/// <summary>Reports to a caller-supplied sink; used by console and maintenance commands.</summary>
+internal sealed class DelegatingInstallReporter : IInstallReporter
+{
+    private readonly Action<string> _sink;
+
+    public DelegatingInstallReporter(Action<string> sink) => _sink = sink;
+
+    public void Progress(string stage, string message, int percent) => _sink(message);
+    public void Diagnostic(string line) => _sink(line);
+}
+
+/// <summary>
+/// The <c>--progress-json</c> protocol: one JSON object per line on stdout, nothing else on stdout,
+/// diagnostics on stderr. The terminal <c>result</c> line is written exactly once.
+/// </summary>
+internal sealed class NdjsonInstallReporter : IInstallReporter
+{
+    private static readonly JsonSerializerOptions Options = new() { WriteIndented = false };
+    private readonly Action<string>? _log;
+    private readonly object _gate = new();
+    private int _lastPercent;
+    private bool _finished;
+
+    public NdjsonInstallReporter(Action<string>? log = null) => _log = log;
+
+    public void Progress(string stage, string message, int percent)
+    {
+        lock (_gate)
+        {
+            if (_finished) return;
+            // Percentages are clamped monotonic: a caller's progress bar must never walk backwards
+            // because a later stage happened to estimate a lower number.
+            _lastPercent = Math.Clamp(Math.Max(percent, _lastPercent), 0, 99);
+            WriteLine(new { type = "progress", stage, message, percent = _lastPercent });
+        }
+        _log?.Invoke(message);
+    }
+
+    public void Diagnostic(string line)
+    {
+        Console.Error.WriteLine(line);
+        _log?.Invoke(line);
+    }
+
+    public void Success(string installDirectory)
+    {
+        lock (_gate)
+        {
+            if (_finished) return;
+            _finished = true;
+            WriteLine(new { type = "result", success = true, version = ProductInfo.Version, installDir = installDirectory });
+        }
+    }
+
+    public void Failure(string error)
+    {
+        lock (_gate)
+        {
+            if (_finished) return;
+            _finished = true;
+            WriteLine(new { type = "result", success = false, error });
+        }
+        _log?.Invoke("FAILED: " + error);
+    }
+
+    /// <summary>
+    /// The terminal result line is the caller's only completion signal, so no exit path may skip it.
+    /// Callers invoke this from a finally block; it is a no-op once a result was already written.
+    /// </summary>
+    public void EnsureFinished(string errorIfUnfinished) => Failure(errorIfUnfinished);
+
+    private static void WriteLine(object value)
+    {
+        Console.Out.WriteLine(JsonSerializer.Serialize(value, Options));
+        Console.Out.Flush();
+    }
+}
+
+/// <summary>Plain-text console reporting for a silent install without <c>--progress-json</c>.</summary>
+internal sealed class ConsoleInstallReporter : IInstallReporter
+{
+    private readonly Action<string>? _log;
+
+    public ConsoleInstallReporter(Action<string>? log = null) => _log = log;
+
+    public void Progress(string stage, string message, int percent)
+    {
+        Console.Out.WriteLine($"[{percent,3}%] {message}");
+        _log?.Invoke(message);
+    }
+
+    public void Diagnostic(string line)
+    {
+        Console.Out.WriteLine(line);
+        _log?.Invoke(line);
+    }
+}
+
+/// <summary>Build step identifiers from the bundled script's <c>MKWCBUILD:STEP:&lt;id&gt;</c> lines. The
+/// id is the contract; LocalBuild.ps1 emits these exactly and Test-PinnedFacts.ps1 fails the release if
+/// the two sets disagree, so progress never depends on matching reworded English prose.</summary>
+internal static class BuildStepIds
+{
+    public const string ReuseBaseTranslation = "reuse-base-translation";
+    public const string RetranslateBase = "retranslate-base";
+    public const string TranslateBase = "translate-base";
+    public const string EmitBaseManifest = "emit-base-manifest";
+    public const string TranslateMod = "translate-mod";
+    public const string GenerateDataInit = "generate-data-init";
+    public const string EmitBuildShards = "emit-build-shards";
+    public const string ConfigureNative = "configure-native";
+    public const string Compile = "compile";
+}
+
+/// <summary>
+/// Maps one local translate-and-compile run onto a slice of the overall percentage. The bundled
+/// build script announces every step it starts with an <c>MKWCBUILD:</c> prefix, so the slice can
+/// advance on real events instead of on a timer.
+/// </summary>
+internal sealed class BuildProgressWindow
+{
+    private const string Marker = "MKWCBUILD:";
+    private const string StepMarker = "STEP:";
+
+    /// <summary>The fraction the compile step reaches; beyond it, compiler output is a heartbeat.</summary>
+    private const double CompileFraction = 0.58;
+
+    private static readonly (string Id, double Fraction, string Message)[] Steps =
+    [
+        (BuildStepIds.ReuseBaseTranslation, 0.30, "Reusing the completed base translation"),
+        (BuildStepIds.RetranslateBase, 0.05, "The base translation is stale; retranslating it"),
+        (BuildStepIds.TranslateBase, 0.08, "Translating Mario Kart Wii"),
+        (BuildStepIds.EmitBaseManifest, 0.34, "Creating the translation manifest"),
+        (BuildStepIds.TranslateMod, 0.38, "Translating the Retro Rewind Code.pul"),
+        (BuildStepIds.GenerateDataInit, 0.44, "Generating game data initialization"),
+        (BuildStepIds.EmitBuildShards, 0.48, "Preparing the native build"),
+        (BuildStepIds.ConfigureNative, 0.52, "Configuring the bundled compiler"),
+        (BuildStepIds.Compile, CompileFraction, "Compiling the game. This is the longest step"),
+    ];
+
+    private readonly IInstallReporter _reporter;
+    private readonly string _stage;
+    private readonly int _start;
+    private readonly int _end;
+    private double _fraction;
+    private string _message = "Preparing the local build";
+    private int _reportedPercent = -1;
+
+    public BuildProgressWindow(IInstallReporter reporter, string stage, int start, int end)
+    {
+        _reporter = reporter;
+        _stage = stage;
+        _start = start;
+        _end = end;
+    }
+
+    public void Observe(string line)
+    {
+        var index = line.IndexOf(Marker, StringComparison.Ordinal);
+        if (index >= 0)
+        {
+            var text = line[(index + Marker.Length)..].Trim();
+            if (text.StartsWith(StepMarker, StringComparison.Ordinal))
+            {
+                var identifier = text[StepMarker.Length..];
+                var end = identifier.IndexOf(' ');
+                if (end >= 0) identifier = identifier[..end];
+                foreach (var (id, fraction, message) in Steps)
+                {
+                    if (!id.Equals(identifier, StringComparison.Ordinal)) continue;
+                    if (fraction > _fraction)
+                    {
+                        _fraction = fraction;
+                        _message = message;
+                        Emit();
+                    }
+                    return;
+                }
+            }
+        }
+
+        // Anything else - an unknown step identifier from a newer script, a plain MKWCBUILD note, or
+        // raw tool output - stays a diagnostic and only feeds the heartbeat below.
+        _reporter.Diagnostic(line);
+        // Compilation announces itself once and then emits thousands of compiler lines. Treat that
+        // output as a heartbeat so the slice keeps creeping forward, but only publish a progress
+        // line when the rounded percentage actually changes.
+        if (_fraction >= CompileFraction)
+        {
+            _fraction = Math.Min(0.97, _fraction + 0.0015);
+            Emit();
+        }
+    }
+
+    private void Emit()
+    {
+        var percent = Interpolate(_fraction);
+        if (percent == _reportedPercent) return;
+        _reportedPercent = percent;
+        _reporter.Progress(_stage, _message, percent);
+    }
+
+    private int Interpolate(double fraction) =>
+        (int)Math.Round(_start + (_end - _start) * Math.Clamp(fraction, 0, 1));
+}
diff --git a/Launcher/WiiCompiled.Setup/InstallScratchSpace.cs b/Launcher/WiiCompiled.Setup/InstallScratchSpace.cs
new file mode 100644
index 0000000..49aa053
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/InstallScratchSpace.cs
@@ -0,0 +1,81 @@
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// Owns one temporary directory for an install operation. The name carries the installation's scope
+/// id, so the next locked operation can remove trees left by forced process termination without
+/// touching scratch belonging to another installation.
+/// </summary>
+internal sealed class InstallScratchSpace : IDisposable
+{
+    private readonly IInstallReporter? _reporter;
+    private bool _disposed;
+
+    private InstallScratchSpace(string root, IInstallReporter? reporter)
+    {
+        Root = root;
+        _reporter = reporter;
+    }
+
+    public string Root { get; }
+
+    /// <summary>Creates staging beside the installation, suitable even when the install is absent.</summary>
+    public static InstallScratchSpace CreateSibling(string installDirectory, IInstallReporter? reporter = null) =>
+        Create(InstallOperationPaths.GetParent(InstallOperationPaths.NormalizeRoot(installDirectory)),
+            installDirectory, reporter);
+
+    /// <summary>Creates build/update output inside an existing installation.</summary>
+    public static InstallScratchSpace CreateInsideInstall(string installDirectory,
+        IInstallReporter? reporter = null)
+    {
+        var installRoot = InstallOperationPaths.NormalizeRoot(installDirectory);
+        if (!Directory.Exists(installRoot))
+            throw new DirectoryNotFoundException(
+                "An in-install scratch directory requires an existing installation root.");
+        return Create(installRoot, installDirectory, reporter);
+    }
+
+    /// <summary>Deletes scratch left by an interrupted operation. Call only while locked.</summary>
+    public static void Recover(string installDirectory, IInstallReporter? reporter = null)
+    {
+        var installRoot = InstallOperationPaths.NormalizeRoot(installDirectory);
+        foreach (var container in new[] { InstallOperationPaths.GetParent(installRoot), installRoot })
+        {
+            if (!Directory.Exists(container)) continue;
+            foreach (var leftover in Directory.EnumerateDirectories(container, Pattern(installRoot)))
+            {
+                reporter?.Diagnostic("Removing scratch space from an interrupted operation: " + leftover);
+                FileSystemUtilities.DeleteDirectoryIfExists(leftover);
+            }
+        }
+    }
+
+    public void Dispose()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        try
+        {
+            FileSystemUtilities.DeleteDirectoryIfExists(Root);
+        }
+        catch (Exception ex)
+        {
+            // The next locked operation removes this exact tree. A transient AV/file-indexer handle
+            // must not turn an already committed installation into a reported failure.
+            _reporter?.Diagnostic("Scratch cleanup is pending and will be retried: " + ex.Message);
+        }
+    }
+
+    private static InstallScratchSpace Create(string container, string installDirectory,
+        IInstallReporter? reporter)
+    {
+        var installRoot = InstallOperationPaths.NormalizeRoot(installDirectory);
+        var root = Path.Combine(container,
+            $".mkwc-scratch-{InstallOperationPaths.GetScopeId(installRoot)}-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(root);
+        reporter?.Diagnostic("Prepared exact update scratch space at " + root);
+        return new InstallScratchSpace(root, reporter);
+    }
+
+    private static string Pattern(string installRoot) =>
+        $".mkwc-scratch-{InstallOperationPaths.GetScopeId(installRoot)}-*";
+}
diff --git a/Launcher/WiiCompiled.Setup/InstallTransaction.cs b/Launcher/WiiCompiled.Setup/InstallTransaction.cs
new file mode 100644
index 0000000..230050f
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/InstallTransaction.cs
@@ -0,0 +1,369 @@
+namespace WiiCompiled.Setup;
+
+internal enum InstallTransactionEntryKind
+{
+    Directory,
+    File
+}
+
+/// <summary>An exact prepared-path to live-path replacement made by an install transaction.</summary>
+internal sealed record InstallTransactionEntry(
+    string PreparedPath,
+    string DestinationPath,
+    InstallTransactionEntryKind Kind)
+{
+    public static InstallTransactionEntry Directory(string preparedPath, string destinationPath) =>
+        new(preparedPath, destinationPath, InstallTransactionEntryKind.Directory);
+
+    public static InstallTransactionEntry File(string preparedPath, string destinationPath) =>
+        new(preparedPath, destinationPath, InstallTransactionEntryKind.File);
+}
+
+/// <summary>
+/// Publishes prepared files/directories as one recoverable operation. Destinations are journaled before the
+/// first move, so an interrupted operation rolls back on disposal or the next lock acquisition. Because every
+/// move is a same-volume rename, rollback needs no per-entry record, just backup/destination/prepared-path presence.
+/// </summary>
+internal sealed class InstallTransaction : IDisposable
+{
+    // v3 renamed the journal's version field from "Schema" to "SchemaVersion", so that every
+    // persisted document in an installation spells it the same way. A journal only exists between
+    // the first move of an update and its commit, and a document from another version has always
+    // been rejected rather than interpreted, so the rename needs no read compatibility - it only
+    // needs to be visible as a version change.
+    private const int SchemaVersion = 3;
+
+    private readonly string _journalPath;
+    private readonly IInstallReporter? _reporter;
+    private readonly TransactionJournal _journal;
+    private bool _finished;
+
+    private InstallTransaction(string journalPath, TransactionJournal journal, IInstallReporter? reporter)
+    {
+        _journalPath = journalPath;
+        _journal = journal;
+        _reporter = reporter;
+    }
+
+    public static InstallTransaction Begin(string installDirectory, IInstallReporter? reporter = null,
+        params InstallTransactionEntry[] entries)
+    {
+        var root = InstallOperationPaths.NormalizeRoot(installDirectory);
+        if (entries is null || entries.Length == 0)
+            throw new ArgumentException("At least one publish entry is required.", nameof(entries));
+
+        var journalPath = InstallOperationPaths.GetJournalPath(root);
+        if (File.Exists(journalPath))
+            throw new InvalidOperationException(
+                "This installation has an unfinished transaction. Acquire the installation operation lock " +
+                "so it can recover before beginning another transaction.");
+
+        var transactionId = Guid.NewGuid();
+        var workRoot = InstallOperationPaths.GetWorkRoot(root, transactionId);
+        var journal = new TransactionJournal
+        {
+            SchemaVersion = SchemaVersion,
+            TransactionId = transactionId,
+            InstallRoot = root,
+            WorkRoot = workRoot,
+            State = TransactionState.Prepared,
+            Entries = NormalizeEntries(root, workRoot, entries)
+        };
+
+        Directory.CreateDirectory(Path.Combine(workRoot, "backup"));
+        JsonState.Write(journalPath, journal);
+        return new InstallTransaction(journalPath, journal, reporter);
+    }
+
+    /// <summary>Moves every old destination aside and publishes every prepared entry.</summary>
+    public void Publish()
+    {
+        EnsureActive(TransactionState.Prepared);
+        try
+        {
+            foreach (var entry in _journal.Entries)
+            {
+                if (entry.OriginalExisted)
+                    Move(entry.DestinationPath, entry.BackupPath, entry.Kind);
+                Move(entry.PreparedPath, entry.DestinationPath, entry.Kind);
+            }
+
+            _journal.State = TransactionState.Published;
+            WriteJournal();
+        }
+        catch (Exception publishFailure)
+        {
+            try
+            {
+                RollBack();
+            }
+            catch (Exception rollbackFailure)
+            {
+                throw new AggregateException(
+                    "Publishing failed and the previous installation could not be fully restored. " +
+                    "The recovery journal was retained for the next operation.",
+                    publishFailure, rollbackFailure);
+            }
+            throw;
+        }
+    }
+
+    /// <summary>
+    /// Durably records the runtime configuration preimage before the caller mutates it. Recovery of
+    /// any uncommitted transaction restores this exact preimage; committed transactions retain the
+    /// new configuration. Call after <see cref="Publish"/> and before the first config write.
+    /// </summary>
+    public void RecordRuntimeConfigurationMutation(RuntimeConfigSnapshot snapshot)
+    {
+        EnsureActive(TransactionState.Published);
+        _journal.RuntimeConfigExisted = snapshot.Existed;
+        _journal.RuntimeConfigContents = snapshot.Contents;
+        _journal.RuntimeConfigMutationPlanned = true;
+        WriteJournal();
+    }
+
+    /// <summary>
+    /// Makes the published paths authoritative. Cleanup failure is non-fatal: the committed journal
+    /// makes the next lock acquisition finish deleting only this transaction's exact backup paths.
+    /// </summary>
+    public void Commit()
+    {
+        EnsureActive(TransactionState.Published);
+        _journal.State = TransactionState.Committed;
+        WriteJournal();
+        _finished = true;
+        TryCleanCommitted(_journalPath, _journal, _reporter);
+    }
+
+    public void Dispose()
+    {
+        if (_finished) return;
+        RollBack();
+    }
+
+    /// <summary>Recovers the one deterministic journal for an installation. Call only while locked.</summary>
+    public static void Recover(string installDirectory, IInstallReporter? reporter = null)
+    {
+        var root = InstallOperationPaths.NormalizeRoot(installDirectory);
+        var journalPath = InstallOperationPaths.GetJournalPath(root);
+        if (!File.Exists(journalPath)) return;
+
+        var journal = JsonState.TryRead<TransactionJournal>(journalPath)
+                      ?? throw new InvalidDataException(
+                          $"The interrupted-install journal is unreadable: {journalPath}");
+        ValidateJournal(root, journal);
+
+        if (journal.State is TransactionState.Committed or TransactionState.RolledBack)
+        {
+            reporter?.Diagnostic("Finishing cleanup from the previous completed update operation...");
+            TryCleanCommitted(journalPath, journal, reporter);
+            if (File.Exists(journalPath))
+                throw new IOException("The previous committed update's exact backup could not be removed.");
+            return;
+        }
+
+        reporter?.Diagnostic("Restoring the installation after an interrupted update...");
+        new InstallTransaction(journalPath, journal, reporter).RollBack();
+    }
+
+    private void RollBack()
+    {
+        if (_finished) return;
+        ValidateJournal(InstallOperationPaths.NormalizeRoot(_journal.InstallRoot), _journal);
+
+        foreach (var entry in _journal.Entries.AsEnumerable().Reverse())
+            RollBackEntry(entry);
+
+        if (_journal.RuntimeConfigMutationPlanned)
+        {
+            // The journal records the installation root, which is what decides whether this
+            // installation's configuration lives in its portable root or in per-user data.
+            RuntimeConfiguration.Restore(
+                RuntimeConfiguration.ResolveConfigPath(_journal.InstallRoot),
+                new RuntimeConfigSnapshot(_journal.RuntimeConfigExisted,
+                    _journal.RuntimeConfigContents ?? []));
+        }
+
+        _journal.State = TransactionState.RolledBack;
+        WriteJournal();
+        _finished = true;
+        FileSystemUtilities.DeleteDirectoryIfExists(_journal.WorkRoot);
+        File.Delete(_journalPath);
+    }
+
+    private static void RollBackEntry(TransactionJournalEntry entry)
+    {
+        var destinationExists = Exists(entry.DestinationPath, entry.Kind);
+        if (Exists(entry.BackupPath, entry.Kind))
+        {
+            if (destinationExists) Delete(entry.DestinationPath, entry.Kind);
+            Move(entry.BackupPath, entry.DestinationPath, entry.Kind);
+            return;
+        }
+
+        // No backup: either the original was never moved aside, or it has already been restored.
+        // Both leave the original in place, so only a vanished original is a failure.
+        if (entry.OriginalExisted)
+        {
+            if (!destinationExists)
+                throw new IOException($"The transaction backup is missing for {entry.DestinationPath}.");
+            return;
+        }
+
+        if (destinationExists && Exists(entry.PreparedPath, entry.Kind))
+            throw new IOException(
+                $"Both prepared and published paths exist for {entry.DestinationPath}; recovery is ambiguous.");
+        if (destinationExists) Delete(entry.DestinationPath, entry.Kind);
+    }
+
+    private static List<TransactionJournalEntry> NormalizeEntries(string root, string workRoot,
+        IReadOnlyList<InstallTransactionEntry> entries)
+    {
+        var normalized = new List<TransactionJournalEntry>(entries.Count);
+        for (var index = 0; index < entries.Count; index++)
+        {
+            var requested = entries[index];
+            var prepared = Path.GetFullPath(requested.PreparedPath);
+            var destination = Path.GetFullPath(requested.DestinationPath);
+            EnsureDestinationInScope(root, destination);
+            if (FileSystemUtilities.PathsOverlap(prepared, destination))
+                throw new InvalidOperationException("A prepared path and its destination must not overlap.");
+
+            if (!Exists(prepared, requested.Kind))
+                throw new FileNotFoundException("A prepared transaction entry is missing.", prepared);
+            if (ExistsAsOtherKind(prepared, requested.Kind))
+                throw new InvalidDataException($"The prepared path has the wrong entry type: {prepared}");
+            if (ExistsAsOtherKind(destination, requested.Kind))
+                throw new InvalidDataException($"The destination has the wrong entry type: {destination}");
+
+            foreach (var previous in normalized)
+            {
+                if (FileSystemUtilities.PathsOverlap(destination, previous.DestinationPath))
+                    throw new InvalidOperationException("Transaction destinations must not overlap.");
+                if (FileSystemUtilities.PathsOverlap(prepared, previous.PreparedPath))
+                    throw new InvalidOperationException("Transaction prepared paths must not overlap.");
+                if (FileSystemUtilities.PathsOverlap(prepared, previous.DestinationPath) ||
+                    FileSystemUtilities.PathsOverlap(destination, previous.PreparedPath))
+                    throw new InvalidOperationException("Transaction sources and destinations must not overlap.");
+            }
+
+            normalized.Add(new TransactionJournalEntry
+            {
+                PreparedPath = prepared,
+                DestinationPath = destination,
+                BackupPath = Path.Combine(workRoot, "backup", index.ToString("D4")),
+                Kind = requested.Kind,
+                OriginalExisted = Exists(destination, requested.Kind)
+            });
+        }
+        return normalized;
+    }
+
+    private static void ValidateJournal(string expectedRoot, TransactionJournal journal)
+    {
+        if (journal.SchemaVersion != SchemaVersion || journal.TransactionId == Guid.Empty)
+            throw new InvalidDataException("The interrupted-install journal has an unsupported format.");
+
+        var root = InstallOperationPaths.NormalizeRoot(journal.InstallRoot);
+        if (!root.Equals(expectedRoot, StringComparison.OrdinalIgnoreCase))
+            throw new InvalidDataException("The interrupted-install journal belongs to another installation.");
+
+        var expectedWorkRoot = InstallOperationPaths.GetWorkRoot(root, journal.TransactionId);
+        if (!Path.GetFullPath(journal.WorkRoot).Equals(expectedWorkRoot, StringComparison.OrdinalIgnoreCase))
+            throw new InvalidDataException("The interrupted-install journal has an invalid work directory.");
+        if (journal.Entries.Count == 0 || journal.Entries.Count > 64)
+            throw new InvalidDataException("The interrupted-install journal has an invalid entry count.");
+
+        for (var index = 0; index < journal.Entries.Count; index++)
+        {
+            var entry = journal.Entries[index];
+            EnsureDestinationInScope(root, Path.GetFullPath(entry.DestinationPath));
+            var expectedBackup = Path.Combine(expectedWorkRoot, "backup", index.ToString("D4"));
+            if (!Path.GetFullPath(entry.BackupPath).Equals(expectedBackup, StringComparison.OrdinalIgnoreCase))
+                throw new InvalidDataException("The interrupted-install journal has an invalid backup path.");
+        }
+    }
+
+    private static void EnsureDestinationInScope(string root, string destination)
+    {
+        if (!FileSystemUtilities.PathContains(root, destination))
+            throw new InvalidOperationException("A transaction destination must be inside its installation root.");
+    }
+
+    private void EnsureActive(TransactionState expected)
+    {
+        if (_finished || _journal.State != expected)
+            throw new InvalidOperationException("The install transaction is not in the required state.");
+    }
+
+    private void WriteJournal() => JsonState.Write(_journalPath, _journal);
+
+    private static bool Exists(string path, InstallTransactionEntryKind kind) =>
+        kind == InstallTransactionEntryKind.Directory ? Directory.Exists(path) : File.Exists(path);
+
+    private static bool ExistsAsOtherKind(string path, InstallTransactionEntryKind kind) =>
+        kind == InstallTransactionEntryKind.Directory ? File.Exists(path) : Directory.Exists(path);
+
+    private static void Move(string source, string destination, InstallTransactionEntryKind kind)
+    {
+        Directory.CreateDirectory(Path.GetDirectoryName(destination)!);
+        if (kind == InstallTransactionEntryKind.Directory) Directory.Move(source, destination);
+        else File.Move(source, destination);
+    }
+
+    private static void Delete(string path, InstallTransactionEntryKind kind)
+    {
+        if (kind == InstallTransactionEntryKind.Directory) FileSystemUtilities.DeleteDirectoryIfExists(path);
+        else File.Delete(path);
+    }
+
+    private static void TryCleanCommitted(string journalPath, TransactionJournal journal,
+        IInstallReporter? reporter)
+    {
+        try
+        {
+            FileSystemUtilities.DeleteDirectoryIfExists(journal.WorkRoot);
+            File.Delete(journalPath);
+        }
+        catch (Exception ex)
+        {
+            reporter?.Diagnostic(
+                "The update committed successfully, but its exact previous-version backup could not yet be " +
+                "removed: " + ex.Message);
+        }
+    }
+
+    private sealed class TransactionJournal
+    {
+        public TransactionJournal() { }
+
+        public int SchemaVersion { get; set; }
+        public Guid TransactionId { get; set; }
+        public string InstallRoot { get; set; } = "";
+        public string WorkRoot { get; set; } = "";
+        public TransactionState State { get; set; }
+        public List<TransactionJournalEntry> Entries { get; set; } = [];
+        public bool RuntimeConfigMutationPlanned { get; set; }
+        public bool RuntimeConfigExisted { get; set; }
+        public byte[]? RuntimeConfigContents { get; set; }
+    }
+
+    private sealed class TransactionJournalEntry
+    {
+        public TransactionJournalEntry() { }
+
+        public string PreparedPath { get; set; } = "";
+        public string DestinationPath { get; set; } = "";
+        public string BackupPath { get; set; } = "";
+        public InstallTransactionEntryKind Kind { get; set; }
+        public bool OriginalExisted { get; set; }
+    }
+
+    private enum TransactionState
+    {
+        Prepared,
+        Published,
+        Committed,
+        RolledBack
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/Installation.cs b/Launcher/WiiCompiled.Setup/Installation.cs
new file mode 100644
index 0000000..0b621ff
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/Installation.cs
@@ -0,0 +1,591 @@
+namespace WiiCompiled.Setup;
+
+/// <summary>Provenance written by the bundled build script next to every product it produces.</summary>
+internal sealed class LocalBuildProvenance
+{
+    public int SchemaVersion { get; set; }
+    public string Profile { get; set; } = "";
+    public string DolSha256 { get; set; } = "";
+    public string RelSha256 { get; set; } = "";
+    public string? CodePulSha256 { get; set; }
+    public string? RetroWfcPayloadMode { get; set; }
+    public string? RetroWfcPayloadSha256 { get; set; }
+    public long? RetroWfcPayloadLength { get; set; }
+    public string Compiler { get; set; } = "";
+
+    public const string FileName = "local-build.json";
+}
+
+/// <summary>
+/// The typed product status of the <c>--check-products</c> contract. These are the only nine answers
+/// the backend gives; see docs/WHEELWIZARD_CONTRACT.md. A frontend branches on the status alone.
+/// </summary>
+internal enum ProductStatus
+{
+    Absent,
+
+    /// <summary>The binary matches the installed toolkit and the canonical compile inputs.</summary>
+    Current,
+
+    /// <summary>The toolkit that produced the binary is no longer the installed toolkit.</summary>
+    ToolkitChanged,
+
+    /// <summary>The canonical Code.pul is not the one this binary statically embeds.</summary>
+    CodePulChanged,
+
+    /// <summary>Another translator-consumed Retro Rewind input changed.</summary>
+    CompileInputsChanged,
+
+    /// <summary>Only the cached Retro-WFC payload needs repair; no compilation.</summary>
+    PayloadChanged,
+
+    /// <summary>
+    /// The canonical Retro Rewind installation is missing or structurally invalid, so the product
+    /// can neither be trusted nor rebuilt until the frontend supplies it.
+    /// </summary>
+    InputsMissing,
+
+    /// <summary>
+    /// The product exists, but the installation cannot prove its provenance or provide the required
+    /// toolkit. A caller must repair the installation before launching it.
+    /// </summary>
+    Blocked,
+
+    /// <summary>The binary or the support files it needs are missing or unusable.</summary>
+    Broken
+}
+
+/// <summary>
+/// The result of a non-mutating product inspection. Status and detail are exactly what the wire
+/// carries: nothing is derived that is not also reported.
+/// </summary>
+internal sealed record ProductState(ProductStatus Status, string Detail)
+{
+    /// <summary>The stable machine-readable status string of the command-line contract.</summary>
+    public string Reason => Status switch
+    {
+        ProductStatus.Absent => "absent",
+        ProductStatus.Current => "current",
+        ProductStatus.ToolkitChanged => "toolkit-changed",
+        ProductStatus.CodePulChanged => "code-pul-changed",
+        ProductStatus.CompileInputsChanged => "compile-inputs-changed",
+        ProductStatus.PayloadChanged => "payload-changed",
+        ProductStatus.InputsMissing => "inputs-missing",
+        ProductStatus.Blocked => "blocked",
+        _ => "broken"
+    };
+
+    /// <summary>Whether a caller must do something before this product may be launched.</summary>
+    public bool ActionRequired => Status is not ProductStatus.Current and not ProductStatus.Absent;
+}
+
+/// <summary>
+/// The on-disk shape of an installation, plus the cheap checks a launch performs before starting a
+/// binary. Everything here is O(1), a single file hash, or the compile-input identity of the
+/// canonical Retro Rewind installation; the multi-gigabyte asset tree is never walked.
+/// </summary>
+internal sealed class Installation
+{
+    public Installation(string root) => Root = FileSystemUtilities.NormalizePath(root);
+
+    public string Root { get; }
+    public string ToolkitDirectory => InstalledLayout.Toolkit(Root);
+    public string WorkspaceDirectory => InstalledLayout.Workspace(Root);
+    public string WorkspaceAssetsDirectory => Path.Combine(WorkspaceDirectory, "Assets");
+    public string WorkspaceRetroWfcPayload => Path.Combine(WorkspaceAssetsDirectory, "OfflinePayload");
+    public string BaseDirectory => Path.Combine(Root, "Base");
+    public string BaseExecutable => Path.Combine(BaseDirectory, "WiiCompiled.exe");
+    public string RetroDirectory => Path.Combine(Root, "RetroRewind");
+    public string RetroExecutable => Path.Combine(RetroDirectory, "RetroRewind.exe");
+    public string GameDataDirectory => Path.Combine(Root, "GameAssets", "DATA");
+    public string InstallStatePath => Path.Combine(Root, InstalledLayout.InstallStateFileName);
+    public string ToolkitStatePath => Path.Combine(Root, ToolkitState.FileName);
+
+    /// <summary>The portable root this installation lives in, or null for an ordinary installation.</summary>
+    public string? PortableRootDirectory => PortableRoot.TryFind(Root);
+
+    /// <summary>
+    /// The runtime configuration this installation reads: <c>&lt;portable root&gt;\UserData\Config.toml</c>
+    /// when portable, otherwise the shared per-user file.
+    /// </summary>
+    public string ConfigPath => RuntimeConfiguration.ResolveConfigPath(Root);
+
+    /// <summary>The install directory copy of setup that acts as the CLI launcher.</summary>
+    public string SetupCopyPath => Path.Combine(Root, ProductInfo.SetupCopyName);
+
+    private const string Toolkit = InstalledLayout.ToolkitDirectoryName + "\\";
+    private const string Workspace = InstalledLayout.WorkspaceDirectoryName + "\\";
+
+    private static readonly string[] RequiredToolkitFiles =
+    [
+        Toolkit + @"Translator\Translator.Cli.exe",
+        Toolkit + @"CMake\bin\cmake.exe",
+        Toolkit + @"Ninja\ninja.exe",
+        Toolkit + @"llvm-mingw\bin\clang-22.exe",
+        Toolkit + @"llvm-mingw\bin\ld.lld.exe",
+        Toolkit + @"llvm-mingw\bin\x86_64-w64-mingw32-clang.exe",
+        Toolkit + @"llvm-mingw\bin\x86_64-w64-mingw32-clang++.exe",
+        Toolkit + @"llvm-mingw\bin\x86_64-w64-mingw32-windres.exe",
+        Workspace + "LocalBuild.ps1",
+        Workspace + "NativeBuildFlags.ps1",
+        Workspace + @"projects\mkwii\recomp.yml",
+        Workspace + @"runtime\CMakeLists.txt",
+        Workspace + @"runtime\assets\dsp\dsp_coef.bin"
+    ];
+
+    // These are the source trees and pinned dependency roots LocalBuild.ps1 consumes during every
+    // native configure/build. Presence is intentionally a cheap structural test, not another full
+    // toolkit hash on every status check. The dependency names come from the one shipped list, so a
+    // dependency added to the payload cannot be missed here.
+    private static readonly string[] RequiredNonEmptyToolkitDirectories =
+    [
+        Workspace + @"runtime\src",
+        Workspace + @"runtime\assets\wii",
+        Workspace + "aurora-main",
+        .. InstalledLayout.DependencyNames.Select(name => Workspace + @"Dependencies\" + name)
+    ];
+
+    public bool Exists => File.Exists(InstallStatePath);
+
+    /// <summary>
+    /// Whether this directory holds an installation at all. A missing or empty directory is not a
+    /// broken installation, it is simply nothing - a frontend probing a path it has not installed to
+    /// yet must get "absent", not an error.
+    /// </summary>
+    public bool IsPresent => Directory.Exists(Root) &&
+                             (Exists || File.Exists(BaseExecutable) || File.Exists(RetroExecutable));
+    /// <summary>
+    /// A cheap structural check for the programs and workspace inputs LocalBuild.ps1 actually
+    /// invokes. Product inspection intentionally does not rehash the full toolkit every time, but
+    /// it must not claim a product current when its compiler, linker, or native runtime is gone.
+    /// </summary>
+    public bool HasToolkit => RequiredToolkitFiles.All(relative => File.Exists(Path.Combine(Root, relative))) &&
+                              RequiredNonEmptyToolkitDirectories.All(relative =>
+                                  IsNonEmptyRegularDirectory(Path.Combine(Root, relative)));
+    public bool HasRetroProduct => File.Exists(RetroExecutable);
+
+    public InstallState? ReadInstallState() => JsonState.TryRead<InstallState>(InstallStatePath);
+
+    internal ToolkitState? ReadToolkitState() => JsonState.TryRead<ToolkitState>(ToolkitStatePath);
+
+    /// <summary>
+    /// The identity of the installed toolkit. Inspection never writes or adopts state: a missing
+    /// toolkit provenance record must not silently make an existing product look trustworthy.
+    /// </summary>
+    public string ResolveToolkitFingerprint()
+    {
+        var state = ReadToolkitState();
+        if (state is { SchemaVersion: 2 } && !string.IsNullOrEmpty(state.ToolkitFingerprint) &&
+            !string.IsNullOrEmpty(state.ToolkitPackageFingerprint) && HasToolkit)
+            return state.ToolkitFingerprint;
+
+        // Do not derive a replacement identity from whatever happens to be on disk. A missing or
+        // unsupported toolkit-state.json has no authoritative chain to the installed products and
+        // is therefore blocked until setup repairs it.
+        return "";
+    }
+
+    /// <summary>The recorded package identity of the installed Toolkit directory, under the same
+    /// fail-closed rules as <see cref="ResolveToolkitFingerprint"/>.</summary>
+    public string ResolveToolkitPackageFingerprint()
+    {
+        var state = ReadToolkitState();
+        if (state is { SchemaVersion: 2 } && !string.IsNullOrEmpty(state.ToolkitFingerprint) &&
+            !string.IsNullOrEmpty(state.ToolkitPackageFingerprint) && HasToolkit)
+            return state.ToolkitPackageFingerprint;
+
+        return "";
+    }
+
+    public void WriteToolkitState(string fingerprint, string packageFingerprint, string releaseTag,
+        string runtimeAssetsFingerprint = "", string translationFingerprint = "",
+        string nativeToolchainFingerprint = "") =>
+        JsonState.Write(ToolkitStatePath, new ToolkitState
+        {
+            ToolkitFingerprint = fingerprint,
+            ToolkitPackageFingerprint = packageFingerprint,
+            RuntimeAssetsFingerprint = runtimeAssetsFingerprint,
+            TranslationFingerprint = translationFingerprint,
+            NativeToolchainFingerprint = nativeToolchainFingerprint,
+            ToolkitReleaseTag = releaseTag
+        });
+
+    /// <summary>
+    /// Reads the complete product provenance. A product without the current fingerprint schema is
+    /// intentionally untrusted rather than guessed from an older, partial provenance document.
+    /// </summary>
+    public ProductFingerprint? ReadProductFingerprint(string productDirectory, string toolkitFingerprint)
+    {
+        var recorded = JsonState.TryRead<ProductFingerprint>(
+            Path.Combine(productDirectory, ProductFingerprint.FileName));
+        return recorded is { SchemaVersion: 1 } ? recorded : null;
+    }
+
+    /// <summary>
+    /// The canonical Retro Rewind install to compare against: explicit <c>--retro-dir</c> if given, else the
+    /// recorded <c>retro_rewind_root</c>. Reads only compile inputs, so it stays cheap for every status check and launch.
+    /// </summary>
+    internal RetroRewindCompileInputs? ResolveCanonicalCompileInputs(string? explicitDirectory,
+        out string? error, CancellationToken cancellationToken = default)
+    {
+        error = null;
+        var selected = string.IsNullOrWhiteSpace(explicitDirectory)
+            ? ConfiguredRetroRewindRoot
+            : explicitDirectory;
+        if (string.IsNullOrWhiteSpace(selected))
+        {
+            if (HasRetroProduct || ReadInstallState()?.RetroRewindInstalled == true)
+                error = "No canonical Retro Rewind folder is recorded for this installation. " +
+                        "Repair it with Wheel Wizard's current Retro Rewind folder.";
+            return null;
+        }
+
+        try
+        {
+            return CompileInputsFingerprint.Compute(selected, cancellationToken);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or InvalidDataException
+                                   or ArgumentException)
+        {
+            error = "The canonical Retro Rewind folder cannot be read: " + ex.Message;
+            return null;
+        }
+    }
+
+    /// <summary>The canonical Retro Rewind root the runtime reads its assets from, if one is set.</summary>
+    public string? ConfiguredRetroRewindRoot => RuntimeConfiguration.GetRetroRewindRoot(ConfigPath);
+
+    public ProductState CheckBase(string toolkitFingerprint)
+    {
+        var state = CheckBaseCore(toolkitFingerprint);
+        if (state.Status != ProductStatus.Current) return state;
+        var runtimeAssetsError = ValidateCopiedRuntimeAssets(BaseDirectory, "base", toolkitFingerprint);
+        return runtimeAssetsError is null ? state : new ProductState(ProductStatus.Broken, runtimeAssetsError);
+    }
+
+    /// <summary>
+    /// Everything about the base product except its copied support files. Repair inspects those
+    /// separately because they are republished from the installed workspace without recompiling.
+    /// </summary>
+    internal ProductState CheckBaseCore(string toolkitFingerprint)
+    {
+        if (!IsUsableExecutable(BaseExecutable))
+            return new ProductState(ProductStatus.Broken, "The base recomp executable is missing.");
+        if (!HasUsableToolkit(toolkitFingerprint))
+            return MissingToolkit();
+        var installState = ReadCurrentInstallState();
+        if (installState is null)
+            return new ProductState(ProductStatus.Blocked,
+                "The installation state is missing, unsupported, or belongs to another directory.");
+        var fingerprint = ReadProductFingerprint(BaseDirectory, toolkitFingerprint);
+        if (fingerprint is null)
+            return new ProductState(ProductStatus.Blocked,
+                "The base recomp has no current build provenance. Repair it with the current setup.");
+        if (!fingerprint.ToolkitFingerprint.Equals(toolkitFingerprint, StringComparison.Ordinal))
+            return new ProductState(ProductStatus.ToolkitChanged,
+                "The base recomp was produced by a different recompilation toolkit.");
+        var provenanceError = ValidateProductProvenance(BaseDirectory, "base", fingerprint, installState);
+        return provenanceError is null
+            ? new ProductState(ProductStatus.Current, "")
+            : new ProductState(ProductStatus.Blocked, provenanceError);
+    }
+
+    /// <summary>
+    /// Classifies the Retro Rewind product against the canonical installation's compile inputs. The
+    /// asset tree is never inspected: the runtime reads it live, so an asset-only Retro Rewind
+    /// update leaves this product current.
+    /// </summary>
+    public ProductState CheckRetroRewind(string toolkitFingerprint,
+        RetroRewindCompileInputs? canonical, string? canonicalError = null,
+        bool? cachedRetroWfcPayloadMatches = null)
+    {
+        var state = CheckRetroRewindCore(toolkitFingerprint, canonical, canonicalError,
+            cachedRetroWfcPayloadMatches);
+        if (state.Status != ProductStatus.Current) return state;
+        var runtimeAssetsError = ValidateCopiedRuntimeAssets(RetroDirectory, "retro-rewind",
+            toolkitFingerprint);
+        return runtimeAssetsError is null ? state : new ProductState(ProductStatus.Broken, runtimeAssetsError);
+    }
+
+    internal ProductState CheckRetroRewindCore(string toolkitFingerprint,
+        RetroRewindCompileInputs? canonical, string? canonicalError = null,
+        bool? cachedRetroWfcPayloadMatches = null)
+    {
+        var installState = ReadCurrentInstallState();
+        var recordedAsInstalled = installState?.RetroRewindInstalled == true;
+        if ((HasRetroProduct || recordedAsInstalled) && !HasUsableToolkit(toolkitFingerprint))
+            return MissingToolkit();
+
+        if (!HasRetroProduct)
+        {
+            return recordedAsInstalled
+                ? new ProductState(ProductStatus.Broken,
+                    "Retro Rewind is recorded as installed, but its executable is missing.")
+                : new ProductState(ProductStatus.Absent, "Retro Rewind is not installed.");
+        }
+
+        if (canonicalError is not null)
+            return new ProductState(ProductStatus.InputsMissing, canonicalError);
+
+        var fingerprint = ReadProductFingerprint(RetroDirectory, toolkitFingerprint);
+        if (fingerprint is null)
+            return new ProductState(ProductStatus.Blocked,
+                "The Retro Rewind product has no current build provenance. " +
+                "Repair it with Wheel Wizard's current Retro Rewind folder.");
+        if (!fingerprint.ToolkitFingerprint.Equals(toolkitFingerprint, StringComparison.Ordinal))
+            return new ProductState(ProductStatus.ToolkitChanged,
+                "Retro Rewind was produced by a different recompilation toolkit.");
+        if (installState is null)
+            return new ProductState(ProductStatus.Blocked,
+                "The installation state is missing, unsupported, or belongs to another directory.");
+
+        var provenanceError = ValidateProductProvenance(RetroDirectory, "retro-rewind", fingerprint,
+            installState);
+        if (provenanceError is not null)
+            return new ProductState(ProductStatus.Blocked, provenanceError);
+
+        if (string.IsNullOrWhiteSpace(fingerprint.CodePulSha256) ||
+            string.IsNullOrWhiteSpace(fingerprint.RetroRewindCompileInputsSha256) ||
+            string.IsNullOrWhiteSpace(installState.RetroRewindCodePulSha256) ||
+            string.IsNullOrWhiteSpace(installState.RetroRewindCompileInputsSha256) ||
+            !Same(installState.RetroRewindCodePulSha256, fingerprint.CodePulSha256) ||
+            !Same(installState.RetroRewindCompileInputsSha256,
+                fingerprint.RetroRewindCompileInputsSha256))
+            return new ProductState(ProductStatus.Blocked,
+                "Retro Rewind's compile-input provenance is incomplete or inconsistent. " +
+                "Repair it with Wheel Wizard's current Retro Rewind folder.");
+
+        if (canonical is not null)
+        {
+            if (!Same(canonical.CodePulSha256, fingerprint.CodePulSha256))
+                return new ProductState(ProductStatus.CodePulChanged,
+                    "The canonical Retro Rewind Code.pul changed since WiiCompiled was translated.");
+            if (!Same(canonical.CompileInputsSha256, fingerprint.RetroRewindCompileInputsSha256))
+                return new ProductState(ProductStatus.CompileInputsChanged,
+                    "Translator-consumed Retro Rewind inputs changed since WiiCompiled was built.");
+        }
+
+        if (fingerprint.RetroWfcPayloadMode == "downloaded" &&
+            CheckRetroWfcPayloadCache(fingerprint, installState, cachedRetroWfcPayloadMatches)
+                is { } payloadError)
+            return payloadError;
+
+        return new ProductState(ProductStatus.Current, "");
+    }
+
+    /// <summary>
+    /// Compares the workspace payload cache with the identity this product embeds.
+    /// <paramref name="cachedMatches"/> carries an observation the operation already paid for:
+    /// true/false skip the hash, null means nothing is known yet.
+    /// </summary>
+    private ProductState? CheckRetroWfcPayloadCache(ProductFingerprint fingerprint, InstallState installState,
+        bool? cachedMatches)
+    {
+        if (string.IsNullOrWhiteSpace(fingerprint.RetroWfcPayloadSha256) ||
+            fingerprint.RetroWfcPayloadLength <= 0 ||
+            string.IsNullOrWhiteSpace(installState.RetroWfcPayloadSha256) ||
+            installState.RetroWfcPayloadLength <= 0)
+            return new ProductState(ProductStatus.Blocked,
+                "The Retro-WFC payload provenance is incomplete.");
+        if (cachedMatches == false)
+            return new ProductState(ProductStatus.PayloadChanged,
+                "The cached Retro-WFC payload is missing or does not match the current snapshot.");
+        if (cachedMatches == true) return null;
+
+        try
+        {
+            var payload = InputValidation.ResolveRetroWfcPayloadFile(WorkspaceRetroWfcPayload);
+            if (!InputValidation.Sha256File(payload).Equals(fingerprint.RetroWfcPayloadSha256,
+                    StringComparison.OrdinalIgnoreCase) ||
+                new FileInfo(payload).Length != fingerprint.RetroWfcPayloadLength)
+                return new ProductState(ProductStatus.PayloadChanged,
+                    "The cached Retro-WFC payload is not the one this product was built with.");
+            return null;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or InvalidDataException)
+        {
+            return new ProductState(ProductStatus.PayloadChanged,
+                "The cached Retro-WFC payload is missing or invalid: " + ex.Message);
+        }
+    }
+
+    private static bool Same(string left, string right) =>
+        left.Equals(right, StringComparison.OrdinalIgnoreCase);
+
+    internal bool ProductUsesGameInputs(string productDirectory, string toolkitFingerprint,
+        string expectedDolSha256, string expectedRelSha256)
+    {
+        var fingerprint = ReadProductFingerprint(productDirectory, toolkitFingerprint);
+        return fingerprint is not null &&
+               fingerprint.DolSha256.Equals(expectedDolSha256, StringComparison.OrdinalIgnoreCase) &&
+               fingerprint.RelSha256.Equals(expectedRelSha256, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private bool HasUsableToolkit(string toolkitFingerprint) =>
+        HasToolkit && !string.IsNullOrWhiteSpace(toolkitFingerprint);
+
+    private static ProductState MissingToolkit() =>
+        new(ProductStatus.Blocked,
+            "The recompilation toolkit is missing or incomplete. Repair the setup before launching or updating products.");
+
+    private InstallState? ReadCurrentInstallState()
+    {
+        var state = ReadInstallState();
+        if (state is not { SchemaVersion: 1 } || string.IsNullOrWhiteSpace(state.InstallDir)) return null;
+        try
+        {
+            return FileSystemUtilities.PathsEqual(state.InstallDir, Root) ? state : null;
+        }
+        catch { return null; }
+    }
+
+    private string? ValidateProductProvenance(string productDirectory, string expectedProfile,
+        ProductFingerprint fingerprint, InstallState state)
+    {
+        if (!fingerprint.Profile.Equals(expectedProfile, StringComparison.Ordinal) ||
+            string.IsNullOrWhiteSpace(fingerprint.DolSha256) ||
+            string.IsNullOrWhiteSpace(fingerprint.RelSha256) ||
+            string.IsNullOrWhiteSpace(fingerprint.ExecutableSha256))
+            return $"The {expectedProfile} product provenance is incomplete.";
+
+        var executable = expectedProfile == "base" ? BaseExecutable : RetroExecutable;
+        if (!IsUsableExecutable(executable))
+            return $"The {expectedProfile} executable is missing or incomplete.";
+        try
+        {
+            if (!InputValidation.Sha256File(executable).Equals(fingerprint.ExecutableSha256,
+                    StringComparison.OrdinalIgnoreCase))
+                return $"The {expectedProfile} executable no longer matches its recorded build identity.";
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return $"The {expectedProfile} executable cannot be verified: {ex.Message}";
+        }
+
+        var dol = Path.Combine(GameDataDirectory, "sys", "main.dol");
+        var rel = Path.Combine(GameDataDirectory, "files", "rel", "StaticR.rel");
+        var fst = Path.Combine(GameDataDirectory, "sys", "fst.bin");
+        if (!File.Exists(dol) || !File.Exists(rel) || !File.Exists(fst))
+            return "The installed game assets are incomplete. Apply setup again with the disc image.";
+        try
+        {
+            var dolSha = InputValidation.Sha256File(dol);
+            var relSha = InputValidation.Sha256File(rel);
+            if (!dolSha.Equals(fingerprint.DolSha256, StringComparison.OrdinalIgnoreCase) ||
+                !relSha.Equals(fingerprint.RelSha256, StringComparison.OrdinalIgnoreCase) ||
+                !dolSha.Equals(state.DolSha256, StringComparison.OrdinalIgnoreCase) ||
+                !relSha.Equals(state.RelSha256, StringComparison.OrdinalIgnoreCase))
+                return "The installed game inputs do not match the product provenance.";
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return "The installed game inputs cannot be verified: " + ex.Message;
+        }
+
+        var local = JsonState.TryRead<LocalBuildProvenance>(
+            Path.Combine(productDirectory, LocalBuildProvenance.FileName));
+        if (local is not { SchemaVersion: 1 } ||
+            !local.Profile.Equals(expectedProfile, StringComparison.Ordinal) ||
+            !local.DolSha256.Equals(fingerprint.DolSha256, StringComparison.OrdinalIgnoreCase) ||
+            !local.RelSha256.Equals(fingerprint.RelSha256, StringComparison.OrdinalIgnoreCase))
+            return $"The {expectedProfile} executable has invalid local-build provenance.";
+        if (expectedProfile == "retro-rewind" &&
+            (!string.Equals(local.RetroWfcPayloadMode, fingerprint.RetroWfcPayloadMode,
+                 StringComparison.Ordinal) ||
+             !string.Equals(local.RetroWfcPayloadSha256 ?? "", fingerprint.RetroWfcPayloadSha256,
+                 StringComparison.OrdinalIgnoreCase) ||
+             (local.RetroWfcPayloadLength ?? 0) != fingerprint.RetroWfcPayloadLength))
+        {
+            return "The Retro Rewind executable has invalid Retro-WFC payload provenance.";
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// Runtime support files are copied beside products rather than embedded in the executable.
+    /// The installed toolkit-state is their authoritative release identity; products with missing
+    /// or altered copies cannot be declared launchable merely because their .exe still hashes.
+    /// </summary>
+    internal string? ValidateCopiedRuntimeAssets(string productDirectory, string expectedProfile,
+        string toolkitFingerprint)
+    {
+        var toolkitState = ReadToolkitState();
+        if (toolkitState is not { SchemaVersion: 2 } ||
+            !string.Equals(toolkitState.ToolkitFingerprint, toolkitFingerprint, StringComparison.Ordinal) ||
+            string.IsNullOrWhiteSpace(toolkitState.RuntimeAssetsFingerprint))
+        {
+            return "The installed runtime-asset provenance is missing or does not belong to the current toolkit.";
+        }
+
+        string? failure = null;
+        if (!ToolkitFingerprint.ProductRuntimeAssetsMatch(productDirectory,
+                toolkitState.RuntimeAssetsFingerprint, diagnostic: line => failure = line))
+        {
+            // An access-denied or half-deleted tree must not masquerade as an ordinary hash mismatch.
+            return failure ??
+                   $"The {expectedProfile} product's copied runtime assets are missing, corrupt, or stale.";
+        }
+        return null;
+    }
+
+    private static bool IsUsableExecutable(string path)
+    {
+        try { return File.Exists(path) && new FileInfo(path).Length >= 64 * 1024; }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException) { return false; }
+    }
+
+    private static bool IsNonEmptyRegularDirectory(string path)
+    {
+        try
+        {
+            if (!Directory.Exists(path)) return false;
+            var directory = new DirectoryInfo(path);
+            if ((directory.Attributes & FileAttributes.ReparsePoint) != 0) return false;
+            using var entries = Directory.EnumerateFileSystemEntries(path).GetEnumerator();
+            return entries.MoveNext();
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>The Retro-WFC payload choice this installation was built with.</summary>
+    public RetroWfcPayloadMode ResolveRetroWfcPayloadMode(string toolkitFingerprint)
+    {
+        var recorded = ReadProductFingerprint(RetroDirectory, toolkitFingerprint)?.RetroWfcPayloadMode;
+        recorded = string.IsNullOrEmpty(recorded) ? ReadInstallState()?.RetroWfcPayloadMode : recorded;
+        return recorded switch
+        {
+            "downloaded" => RetroWfcPayloadMode.Online,
+            "skipped" => RetroWfcPayloadMode.Skipped,
+            _ => RetroWfcPayloadMode.NotApplicable
+        };
+    }
+
+    public bool MatchesRetroWfcPayloadSnapshot(string toolkitFingerprint,
+        RetroWfcPayloadSnapshot snapshot)
+    {
+        var fingerprint = ReadProductFingerprint(RetroDirectory, toolkitFingerprint);
+        var state = ReadCurrentInstallState();
+        return fingerprint is { RetroWfcPayloadMode: "downloaded" } &&
+               state is { RetroWfcPayloadMode: "downloaded" } &&
+               string.Equals(fingerprint.RetroWfcPayloadSha256, snapshot.Sha256, StringComparison.Ordinal) &&
+               string.Equals(state.RetroWfcPayloadSha256, snapshot.Sha256, StringComparison.Ordinal);
+    }
+
+    public bool CachedRetroWfcPayloadMatches(RetroWfcPayloadSnapshot snapshot)
+    {
+        try
+        {
+            var payload = InputValidation.ResolveRetroWfcPayloadFile(WorkspaceRetroWfcPayload);
+            return new FileInfo(payload).Length == snapshot.ByteLength &&
+                   InputValidation.Sha256File(payload).Equals(snapshot.Sha256, StringComparison.Ordinal);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or InvalidDataException)
+        {
+            return false;
+        }
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/InstalledLayout.cs b/Launcher/WiiCompiled.Setup/InstalledLayout.cs
new file mode 100644
index 0000000..73d8efb
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/InstalledLayout.cs
@@ -0,0 +1,54 @@
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// Names of the installed/staged layout. Not cosmetic: payload and toolkit identities hash relative paths
+/// that begin with these strings, so changing one (including casing) invalidates every shipped fingerprint.
+/// Build-Installer.ps1 stages the payload with exactly these names.
+/// </summary>
+internal static class InstalledLayout
+{
+    public const string ToolkitDirectoryName = "Toolkit";
+    public const string WorkspaceDirectoryName = "BuildWorkspace";
+    public const string InstallStateFileName = "install-state.json";
+    public const string PayloadManifestFileName = "payload-manifest.json";
+
+    /// <summary>Payload entry names use forward slashes; the archive is written by tar.</summary>
+    public const string ToolkitEntryPrefix = ToolkitDirectoryName + "/";
+    public const string WorkspaceEntryPrefix = WorkspaceDirectoryName + "/";
+
+    public static string Toolkit(string root) => Path.Combine(root, ToolkitDirectoryName);
+    public static string Workspace(string root) => Path.Combine(root, WorkspaceDirectoryName);
+
+    /// <summary>
+    /// The pinned offline dependency sources shipped under <c>BuildWorkspace\Dependencies</c>. This
+    /// is the one list: Build-Installer.ps1 stages exactly these directories and
+    /// Launcher/Test-PinnedFacts.ps1 fails the release build if its copy and this one disagree.
+    /// </summary>
+    public static readonly string[] DependencyNames =
+    [
+        "abseil-cpp", "cppwinrt", "dawn_prebuilt", "fmt", "freetype", "imgui", "native_prebuilt",
+        "png", "SDL", "sqlite3", "tracy", "xxhash", "zlib", "zstd"
+    ];
+}
+
+/// <summary>
+/// Source-owned files copied verbatim beside every product. One inventory drives identity
+/// (<see cref="ToolkitFingerprint.ComputeRuntimeAssets"/>), verification, and publication. Renaming
+/// an identity key below requires bumping the fingerprint's version salt.
+/// </summary>
+internal static class ProductRuntimeAssets
+{
+    /// <summary>The bootstrap tree, copied from <c>runtime/assets/wii</c> into every product.</summary>
+    public const string SourceBootstrapDirectoryName = "wii";
+    public const string ProductBootstrapDirectoryName = "wii_bootstrap";
+
+    /// <summary>Single files, given as their path below <c>runtime/assets</c> and their product name.</summary>
+    public static readonly (string[] SourceRelativePath, string ProductFileName)[] Files =
+    [
+        (["dsp", "dsp_coef.bin"], "dsp_coef.bin"),
+        (["pipeline", "initial_pipeline_cache.db"], "initial_pipeline_cache.db")
+    ];
+
+    public static string SourceFile(string sourceAssets, string[] relativePath) =>
+        Path.Combine([sourceAssets, .. relativePath]);
+}
diff --git a/Launcher/WiiCompiled.Setup/InstallerEngine.cs b/Launcher/WiiCompiled.Setup/InstallerEngine.cs
new file mode 100644
index 0000000..cfdb9d4
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/InstallerEngine.cs
@@ -0,0 +1,523 @@
+namespace WiiCompiled.Setup;
+
+internal sealed class InstallerEngine
+{
+    private readonly IInstallReporter _reporter;
+
+    public InstallerEngine(IInstallReporter reporter) => _reporter = reporter;
+
+    public async Task InstallAsync(InstallOptions options, CancellationToken cancellationToken = default)
+    {
+        var installDirectory = Path.GetFullPath(options.InstallDirectory);
+        ValidateInstallDirectory(installDirectory);
+
+        InputValidation.ValidateExtension(options.GamePath);
+        var parent = Directory.GetParent(installDirectory)?.FullName
+                     ?? throw new InvalidOperationException("The installation directory has no parent.");
+        Directory.CreateDirectory(parent);
+
+        using var operationLock = InstallOperationLock.Acquire(installDirectory, _reporter);
+        var existing = new Installation(installDirectory);
+
+        PortableInstallHealing.HealMovedInstall(existing, _reporter);
+        var previousState = existing.ReadInstallState();
+        using var scratch = Directory.Exists(installDirectory)
+            ? InstallScratchSpace.CreateInsideInstall(installDirectory, _reporter)
+            : InstallScratchSpace.CreateSibling(installDirectory, _reporter);
+        var staging = scratch.Root;
+
+
+        const long payloadStagingAllowance = 2L * 1024 * 1024 * 1024;
+        FileSystemUtilities.EnsureFreeSpace(installDirectory, payloadStagingAllowance, "Setup");
+
+        using var payload = PayloadArchive.OpenCurrent();
+        var manifest = payload.ReadManifest();
+        var toolkit = InstalledLayout.Toolkit(staging);
+        var workspace = InstalledLayout.Workspace(staging);
+
+        var candidateToolkitFingerprint = manifest.ToolkitFingerprint;
+        var candidateToolkitPackageFingerprint = manifest.ToolkitPackageFingerprint;
+        var candidateRuntimeAssetsFingerprint = manifest.RuntimeAssetsFingerprint;
+        var installedToolkitFingerprint = existing.IsPresent
+            ? existing.ResolveToolkitFingerprint()
+            : "";
+        var installedToolkitPackageFingerprint = existing.IsPresent
+            ? existing.ResolveToolkitPackageFingerprint()
+            : "";
+        var reusableGameAssets = FindReusableGameAssets(existing, manifest);
+
+        var sameToolkit = existing.IsPresent && reusableGameAssets is not null &&
+                          installedToolkitFingerprint.Equals(candidateToolkitFingerprint,
+                              StringComparison.Ordinal);
+        var samePackageContent = existing.IsPresent &&
+                                 installedToolkitPackageFingerprint.Equals(
+                                     candidateToolkitPackageFingerprint, StringComparison.Ordinal);
+        var sameToolkitPackage = sameToolkit && samePackageContent;
+        var hadRetro = existing.HasRetroProduct || previousState?.RetroRewindInstalled == true;
+
+        var runtimeAssetsCurrent = sameToolkit && RuntimeAssetsAreCurrent(existing,
+            candidateRuntimeAssetsFingerprint, cancellationToken);
+        var installedDolphinTool = Path.Combine(existing.ToolkitDirectory, "DolphinTool.exe");
+        var extractToolkit = MustRefreshToolkit(sameToolkit, samePackageContent,
+            File.Exists(installedDolphinTool));
+        var extractWorkspace = !sameToolkit || !runtimeAssetsCurrent;
+
+        _reporter.Progress(InstallStages.ExtractToolkit,
+            "Inspecting the release's local recompilation toolkit...", 1);
+        if (extractToolkit) payload.ExtractDirectory(InstalledLayout.ToolkitDirectoryName, toolkit);
+        if (extractWorkspace)
+        {
+            payload.ExtractDirectory(InstalledLayout.WorkspaceDirectoryName, workspace);
+            WorkspaceTimestamps.MarkChangedFiles(existing.WorkspaceDirectory, workspace,
+                _reporter.Diagnostic, cancellationToken);
+        }
+        payload.ExtractEntry("host/WiiCompiled-Setup.exe",
+            Path.Combine(staging, ProductInfo.SetupCopyName));
+        payload.ExtractDirectory("licenses", Path.Combine(staging, "licenses"));
+        payload.ExtractEntry(InstalledLayout.PayloadManifestFileName,
+            Path.Combine(staging, InstalledLayout.PayloadManifestFileName));
+
+        var dolphinTool = extractToolkit ? Path.Combine(toolkit, "DolphinTool.exe") : installedDolphinTool;
+        _reporter.Progress(InstallStages.Validate, "Checking the Wii disc image...", 2);
+        var header = await InputValidation.ReadDiscHeaderAsync(dolphinTool, options.GamePath,
+            cancellationToken);
+        InputValidation.EnsureCompatibleDisc(header, manifest);
+        var canonicalRetroRoot = options.RetroDirectoryPath is null
+            ? null
+            : RetroRewindSource.ResolveRetroRewind6(options.RetroDirectoryPath);
+        ValidateRetroOptions(canonicalRetroRoot, options.RetroWfcPayloadMode, manifest);
+
+        var retroCompileInputs = canonicalRetroRoot is null
+            ? null
+            : SnapshotRetroRewindCompileInputs(canonicalRetroRoot,
+                Path.Combine(staging, "compile-inputs"), cancellationToken);
+        if (options.Portable)
+        {
+            var portableRoot = PortableRoot.Create(parent);
+            _reporter.Diagnostic($"Installing as a portable installation under {portableRoot}.");
+        }
+
+        if (sameToolkit)
+        {
+            var desiredInputDrift = ProductRepairService.FindDesiredInputDrift(existing,
+                candidateToolkitFingerprint, manifest.ExpectedDolSha256, manifest.ExpectedRelSha256);
+            if (desiredInputDrift.Retro && retroCompileInputs is null)
+                throw new InvalidOperationException(
+                    "This release changes the clean game inputs used by the installed Retro Rewind product. " +
+                    "Supply Wheel Wizard's current Retro Rewind folder explicitly so it can be rebuilt safely.");
+
+            var reconciliation = await ReconcileSameToolkitAsync(existing, retroCompileInputs,
+                canonicalRetroRoot, options.RetroWfcPayloadMode, Path.Combine(staging, "repair"),
+                manifest.ExpectedDolSha256, manifest.ExpectedRelSha256, cancellationToken);
+            var remainingCancellation = reconciliation.PublicationCommitted
+                ? CancellationToken.None
+                : cancellationToken;
+
+
+            if (!runtimeAssetsCurrent)
+                runtimeAssetsCurrent = RuntimeAssetsAreCurrent(existing,
+                    candidateRuntimeAssetsFingerprint, remainingCancellation);
+
+            remainingCancellation.ThrowIfCancellationRequested();
+            EnsureReconciliationCurrent(existing, candidateToolkitFingerprint, retroCompileInputs,
+                manifest.ExpectedDolSha256, manifest.ExpectedRelSha256,
+                reconciliation.CachedRetroWfcPayloadMatches);
+
+            var updatedState = BuildInstallState(existing.ReadInstallState(), installDirectory, manifest,
+                retroCompileInputs, canonicalRetroRoot, options.RetroWfcPayloadMode);
+            PrepareMetadata(staging, manifest, updatedState);
+            remainingCancellation.ThrowIfCancellationRequested();
+
+            var releaseEntries = new List<InstallTransactionEntry>();
+            if (!sameToolkitPackage)
+                AddComponent(releaseEntries, staging, installDirectory,
+                    InstalledLayout.ToolkitDirectoryName);
+            if (!runtimeAssetsCurrent)
+                AddRuntimeAssetPublicationEntries(releaseEntries, staging, installDirectory,
+                    updatedState.RetroRewindInstalled, candidateRuntimeAssetsFingerprint,
+                    remainingCancellation);
+            Publish(staging, installDirectory, canonicalRetroRoot, updatedState,
+                releaseEntries, remainingCancellation);
+            return;
+        }
+
+        if (hadRetro && retroCompileInputs is null)
+        {
+            throw new InvalidOperationException(
+                "The installed Retro Rewind product must be produced again. Supply Wheel Wizard's " +
+                "current Retro Rewind folder explicitly so it can be rebuilt safely.");
+        }
+
+        EnsureSufficientRemainingDiskSpace(installDirectory,
+            needsExtractedDisc: reusableGameAssets is null, needsLocalBuild: true);
+
+        if (reusableGameAssets is null)
+        {
+            await ExtractGameAssetsAsync(dolphinTool, options.GamePath,
+                Path.Combine(staging, "GameAssets"), manifest, cancellationToken);
+        }
+
+        await PublishToolkitAndReconcileProductsAsync(existing, staging, workspace, manifest,
+            previousState, options, canonicalRetroRoot, retroCompileInputs,
+            publishGameAssets: reusableGameAssets is null, cancellationToken);
+    }
+
+    /// <summary>
+    /// Whether this operation must replace the installed <c>Toolkit</c>. The shipped translator and translation
+    /// project are one unit, so <c>samePackageContent</c> alone isn't enough: <c>sameToolkit</c> tracks the compile
+    /// identity separately, since gating on package identity alone let the two disagree after the v0.2.5 healing salt bump.
+    /// </summary>
+    internal static bool MustRefreshToolkit(bool sameToolkit, bool samePackageContent,
+        bool dolphinToolPresent) =>
+        !sameToolkit || !samePackageContent || !dolphinToolPresent;
+
+    private static void AddComponent(List<InstallTransactionEntry> entries, string staging,
+        string installDirectory, string name) =>
+        entries.Add(InstallTransactionEntry.Directory(Path.Combine(staging, name),
+            Path.Combine(installDirectory, name)));
+
+    /// <summary>
+    /// Build-produced workspace directories (not shipped in a release) grafted from the installed workspace into
+    /// the staged one, carrying the base translation, native build dir, verified inputs, and Retro-WFC payload cache
+    /// across a toolkit update. Each is re-validated by the build, so stale caches degrade to a clean rebuild, never reuse.
+    /// </summary>
+    private static readonly string[] WorkspaceCacheDirectories =
+        ["generated", "build", "native-build", "Assets", "PulsarPacks"];
+
+    private async Task PublishToolkitAndReconcileProductsAsync(Installation existing, string staging,
+        string stagedWorkspace, PayloadManifest manifest, InstallState? previousState,
+        InstallOptions options, string? canonicalRetroRoot,
+        RetroRewindCompileInputs? retroCompileInputs,
+        bool publishGameAssets, CancellationToken cancellationToken)
+    {
+        var installDirectory = existing.Root;
+
+
+        foreach (var cacheDirectory in WorkspaceCacheDirectories)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            var source = Path.Combine(existing.WorkspaceDirectory, cacheDirectory);
+            if (!Directory.Exists(source)) continue;
+            var destination = Path.Combine(stagedWorkspace, cacheDirectory);
+            if (Directory.Exists(destination)) Directory.Delete(destination, recursive: true);
+            Directory.Move(source, destination);
+        }
+
+
+        var state = BuildInstallState(previousState, installDirectory, manifest,
+            compileInputs: null, canonicalRetroRoot, options.RetroWfcPayloadMode);
+        PrepareMetadata(staging, manifest, state);
+
+        cancellationToken.ThrowIfCancellationRequested();
+        var entries = new List<InstallTransactionEntry>();
+
+        AddComponent(entries, staging, installDirectory, InstalledLayout.ToolkitDirectoryName);
+        AddComponent(entries, staging, installDirectory, InstalledLayout.WorkspaceDirectoryName);
+        if (publishGameAssets) AddComponent(entries, staging, installDirectory, "GameAssets");
+
+        Publish(staging, installDirectory, canonicalRetroRoot, state,
+            entries, cancellationToken, progressPercent: 8, completionPercent: 10);
+
+        _reporter.Progress(InstallStages.BuildBase,
+            "Producing the installed products with the published toolkit...", 11);
+
+        var reconciliation = await ReconcileSameToolkitAsync(existing, retroCompileInputs,
+            canonicalRetroRoot, options.RetroWfcPayloadMode, repairScratch: null,
+            manifest.ExpectedDolSha256, manifest.ExpectedRelSha256, cancellationToken);
+        EnsureReconciliationCurrent(existing, manifest.ToolkitFingerprint, retroCompileInputs,
+            manifest.ExpectedDolSha256, manifest.ExpectedRelSha256,
+            reconciliation.CachedRetroWfcPayloadMatches);
+    }
+
+    private Task<ProductRepairService.ReconciliationResult> ReconcileSameToolkitAsync(Installation existing,
+        RetroRewindCompileInputs? retroCompileInputs, string? canonicalRetroRoot,
+        RetroWfcPayloadMode payloadMode, string? repairScratch, string expectedDolSha256,
+        string expectedRelSha256, CancellationToken cancellationToken)
+    {
+        var repair = new ProductRepairService(existing, _reporter);
+        var options = new ProductRepairService.ReconcileOptions
+        {
+            ScratchRoot = repairScratch,
+            ExpectedDolSha256 = expectedDolSha256,
+            ExpectedRelSha256 = expectedRelSha256,
+            CanonicalRetroRewindRoot = canonicalRetroRoot
+        };
+
+        return retroCompileInputs is null
+            ? repair.RepairBaseAsync(options, cancellationToken)
+            : repair.RepairRetroAsync(retroCompileInputs, payloadMode, options, cancellationToken);
+    }
+
+    private static void EnsureReconciliationCurrent(Installation installation, string toolkitFingerprint,
+        RetroRewindCompileInputs? retroCompileInputs, string expectedDolSha256, string expectedRelSha256,
+        bool? cachedRetroWfcPayloadMatches)
+    {
+        var baseState = installation.CheckBase(toolkitFingerprint);
+        var retroState = installation.CheckRetroRewind(toolkitFingerprint, retroCompileInputs,
+            canonicalError: null, cachedRetroWfcPayloadMatches);
+        var desiredInputsCurrent = installation.ProductUsesGameInputs(installation.BaseDirectory,
+                                       toolkitFingerprint, expectedDolSha256, expectedRelSha256) &&
+                                   (!installation.HasRetroProduct ||
+                                    installation.ProductUsesGameInputs(installation.RetroDirectory,
+                                        toolkitFingerprint, expectedDolSha256, expectedRelSha256));
+        if (baseState.Status == ProductStatus.Current && !retroState.ActionRequired && desiredInputsCurrent) return;
+
+        var details = string.Join(" ", new[] { baseState, retroState }
+            .Where(state => state.ActionRequired)
+            .Select(state => state.Detail)
+            .Where(detail => !string.IsNullOrWhiteSpace(detail)));
+        throw new InvalidOperationException(
+            "Product reconciliation did not produce a current installation with the release's game inputs; " +
+            "release metadata was not advanced." +
+            (string.IsNullOrWhiteSpace(details) ? "" : " " + details));
+    }
+
+    /// <summary>
+    /// Publishes the caller's component entries together with the release metadata every install and
+    /// update advances, then applies the runtime configuration this installation owns.
+    /// </summary>
+    private void Publish(string staging, string installDirectory,
+        string? canonicalRetroRoot, InstallState state,
+        List<InstallTransactionEntry> entries, CancellationToken cancellationToken,
+        int progressPercent = 95, int completionPercent = 99)
+    {
+        entries.Add(InstallTransactionEntry.Directory(Path.Combine(staging, "licenses"),
+            Path.Combine(installDirectory, "licenses")));
+        entries.Add(InstallTransactionEntry.File(Path.Combine(staging, ProductInfo.SetupCopyName),
+            Path.Combine(installDirectory, ProductInfo.SetupCopyName)));
+        entries.Add(InstallTransactionEntry.File(
+            Path.Combine(staging, InstalledLayout.PayloadManifestFileName),
+            Path.Combine(installDirectory, InstalledLayout.PayloadManifestFileName)));
+        entries.Add(InstallTransactionEntry.File(Path.Combine(staging, ToolkitState.FileName),
+            Path.Combine(installDirectory, ToolkitState.FileName)));
+        entries.Add(InstallTransactionEntry.File(
+            Path.Combine(staging, InstalledLayout.InstallStateFileName),
+            Path.Combine(installDirectory, InstalledLayout.InstallStateFileName)));
+
+        cancellationToken.ThrowIfCancellationRequested();
+        _reporter.Progress(InstallStages.Publish, "Publishing the completed installation...", progressPercent);
+        var configPath = RuntimeConfiguration.ResolveConfigPath(installDirectory);
+        var configSnapshot = RuntimeConfiguration.Capture(configPath);
+        using var transaction = InstallTransaction.Begin(installDirectory, _reporter, entries.ToArray());
+        transaction.Publish();
+        transaction.RecordRuntimeConfigurationMutation(configSnapshot);
+        RuntimeConfiguration.SetDvdRoot(configPath, Path.Combine(installDirectory, "GameAssets", "DATA"));
+        // The runtime scans this directory live for its asset overlay, so it is recorded on every
+        // operation that receives one and is never rewritten by a base-only operation.
+        if (canonicalRetroRoot is not null)
+            RuntimeConfiguration.SetRetroRewindRoot(configPath, canonicalRetroRoot);
+        transaction.Commit();
+
+        // A portable installation is owned by the folder it lives in, not by this machine. Adding a
+        // machine-wide uninstall entry for it would outlive the folder and, worse, would overwrite
+        // the entry of a normal installation on the same account.
+        if (PortableRoot.TryFind(installDirectory) is not null)
+        {
+            _reporter.Diagnostic(
+                "Portable installation: no Windows uninstall entry was registered. Remove the folder, " +
+                "or run the copied setup with --uninstall, to uninstall it.");
+        }
+        else
+        {
+            try
+            {
+                ShellIntegration.RegisterUninstaller(installDirectory, state.RetroRewindInstalled);
+                ShellIntegration.RemoveAllShortcuts();
+            }
+            catch (Exception ex)
+            {
+                _reporter.Diagnostic("The installation succeeded, but Windows uninstall registration failed: " +
+                                     ex.Message);
+            }
+        }
+
+        _reporter.Progress(InstallStages.Publish, "Installation complete.", completionPercent);
+    }
+
+    private static void PrepareMetadata(string staging, PayloadManifest manifest, InstallState state)
+    {
+        JsonState.Write(Path.Combine(staging, ToolkitState.FileName), new ToolkitState
+        {
+            ToolkitFingerprint = manifest.ToolkitFingerprint,
+            ToolkitPackageFingerprint = manifest.ToolkitPackageFingerprint,
+            RuntimeAssetsFingerprint = manifest.RuntimeAssetsFingerprint,
+            TranslationFingerprint = manifest.TranslationFingerprint,
+            NativeToolchainFingerprint = manifest.NativeToolchainFingerprint,
+            ToolkitReleaseTag = manifest.ToolkitReleaseTag
+        });
+        JsonState.Write(Path.Combine(staging, InstalledLayout.InstallStateFileName), state);
+    }
+
+    private static InstallState BuildInstallState(InstallState? previousState, string installDirectory,
+        PayloadManifest manifest, RetroRewindCompileInputs? compileInputs, string? canonicalRetroRoot,
+        RetroWfcPayloadMode payloadMode,
+        RetroWfcPayloadSnapshot? retroWfcPayloadSnapshot = null)
+    {
+        // Preserve the pre-update object for runtime-configuration rollback/ownership decisions.
+        var state = new InstallState
+        {
+            SchemaVersion = 1,
+            SetupVersion = ProductInfo.Version,
+            ProductVersion = manifest.ProductVersion,
+            InstallDir = installDirectory,
+            InstalledUtc = previousState?.InstalledUtc ?? DateTime.UtcNow,
+            RetroRewindInstalled = previousState?.RetroRewindInstalled ?? false,
+            ToolkitReleaseTag = manifest.ToolkitReleaseTag,
+            DolSha256 = manifest.ExpectedDolSha256,
+            RelSha256 = manifest.ExpectedRelSha256,
+            RetroRewindCodePulSha256 = previousState?.RetroRewindCodePulSha256 ?? "",
+            RetroRewindCompileInputsSha256 = previousState?.RetroRewindCompileInputsSha256 ?? "",
+            RetroWfcPayloadMode = previousState?.RetroWfcPayloadMode ?? "",
+            RetroWfcPayloadSha256 = previousState?.RetroWfcPayloadSha256 ?? "",
+            RetroWfcPayloadLength = previousState?.RetroWfcPayloadLength ?? 0,
+            RetroRewindRoot = canonicalRetroRoot is null
+                ? previousState?.RetroRewindRoot ?? ""
+                : Path.GetFullPath(canonicalRetroRoot)
+        };
+        if (compileInputs is not null)
+        {
+            state.RetroRewindInstalled = true;
+            state.RetroRewindCodePulSha256 = compileInputs.CodePulSha256;
+            state.RetroRewindCompileInputsSha256 = compileInputs.CompileInputsSha256;
+            state.RetroWfcPayloadMode = payloadMode == RetroWfcPayloadMode.Online
+                ? "downloaded"
+                : "skipped";
+            state.RetroWfcPayloadSha256 = payloadMode == RetroWfcPayloadMode.Online
+                ? retroWfcPayloadSnapshot?.Sha256 ?? state.RetroWfcPayloadSha256
+                : "";
+            state.RetroWfcPayloadLength = payloadMode == RetroWfcPayloadMode.Online
+                ? retroWfcPayloadSnapshot?.ByteLength ?? state.RetroWfcPayloadLength
+                : 0;
+            if (payloadMode == RetroWfcPayloadMode.Online &&
+                (string.IsNullOrWhiteSpace(state.RetroWfcPayloadSha256) || state.RetroWfcPayloadLength <= 0))
+                throw new InvalidDataException("The downloaded Retro-WFC payload snapshot is missing.");
+        }
+        return state;
+    }
+
+    /// <summary>
+    /// Captures the canonical installation's compile inputs into operation-owned staging. Only
+    /// Code.pul and the bundled Pulsar sources are copied; the asset tree stays where Wheel Wizard
+    /// owns it and is read live by the runtime through <c>retro_rewind_root</c>.
+    /// </summary>
+    private RetroRewindCompileInputs SnapshotRetroRewindCompileInputs(string canonicalRetroRoot,
+        string destination, CancellationToken cancellationToken)
+    {
+        _reporter.Progress(InstallStages.Validate, "Snapshotting the Retro Rewind compile inputs...", 3);
+        return CompileInputsFingerprint.Snapshot(canonicalRetroRoot, destination, cancellationToken);
+    }
+
+    private bool RuntimeAssetsAreCurrent(Installation installation, string expectedFingerprint,
+        CancellationToken cancellationToken)
+    {
+        var installedSource = ToolkitFingerprint.TryComputeRuntimeAssets(installation.Root, cancellationToken,
+            _reporter.Diagnostic);
+        if (!expectedFingerprint.Equals(installedSource, StringComparison.Ordinal)) return false;
+        if (File.Exists(installation.BaseExecutable) &&
+            !ToolkitFingerprint.ProductRuntimeAssetsMatch(installation.BaseDirectory, expectedFingerprint,
+                cancellationToken, _reporter.Diagnostic))
+            return false;
+        return !installation.HasRetroProduct ||
+               ToolkitFingerprint.ProductRuntimeAssetsMatch(installation.RetroDirectory,
+                   expectedFingerprint, cancellationToken, _reporter.Diagnostic);
+    }
+
+    private void AddRuntimeAssetPublicationEntries(List<InstallTransactionEntry> entries,
+        string staging, string installDirectory, bool includeRetro, string expectedFingerprint,
+        CancellationToken cancellationToken)
+    {
+        // The identity was computed from this exact operation-owned payload extraction, so the
+        // staged assets are published as they are; only repair has an installed source to re-verify.
+        var sourceAssets = Path.Combine(InstalledLayout.Workspace(staging), "runtime", "assets");
+        var products = (includeRetro ? new[] { "Base", "RetroRewind" } : new[] { "Base" })
+            .Select(product => (product, Path.Combine(installDirectory, product)));
+        RuntimeAssetPublication.AddEntries(entries, sourceAssets,
+            Path.Combine(staging, "runtime-asset-publication"), products, expectedFingerprint,
+            "publication", _reporter.Diagnostic, cancellationToken);
+
+        entries.Add(InstallTransactionEntry.Directory(sourceAssets,
+            Path.Combine(InstalledLayout.Workspace(installDirectory), "runtime", "assets")));
+    }
+
+    private static void ValidateRetroOptions(string? canonicalRetroRoot, RetroWfcPayloadMode mode,
+        PayloadManifest manifest)
+    {
+        if (canonicalRetroRoot is null && mode != RetroWfcPayloadMode.NotApplicable)
+            throw new InvalidOperationException(
+                "A Retro-WFC payload option requires the canonical Retro Rewind folder.");
+        if (canonicalRetroRoot is not null && mode == RetroWfcPayloadMode.NotApplicable)
+            throw new InvalidOperationException(
+                "Download the Retro-WFC payload, or explicitly skip the optional payload.");
+        if (canonicalRetroRoot is not null && mode == RetroWfcPayloadMode.Online)
+            InputValidation.ValidateRetroWfcPayloadUri(manifest.RetroWfcPayloadUri);
+    }
+
+    private string? FindReusableGameAssets(Installation existing, PayloadManifest manifest)
+    {
+        var dataRoot = existing.GameDataDirectory;
+        // No fst.bin simply means nothing was extracted here before; anything past that gate is an
+        // existing extraction that fails reuse, which the log must say before the expensive
+        // re-extraction quietly repairs it.
+        if (!File.Exists(Path.Combine(dataRoot, "sys", "fst.bin"))) return null;
+        try
+        {
+            ValidateExtractedGame(dataRoot, manifest);
+            return dataRoot;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or InvalidDataException)
+        {
+            _reporter.Diagnostic(
+                "The installed game assets cannot be reused; the disc will be extracted again: " + ex.Message);
+            return null;
+        }
+    }
+
+    private async Task ExtractGameAssetsAsync(string dolphinTool, string gamePath, string destination,
+        PayloadManifest manifest, CancellationToken cancellationToken)
+    {
+        _reporter.Progress(InstallStages.ExtractDisc,
+            "Extracting the game disc. This is the longest preparation step...", 6);
+        var extraction = await ProcessRunner.RunAsync(dolphinTool,
+            ["extract", "-i", Path.GetFullPath(gamePath), "-o", destination, "-g", "-q"],
+            line => { if (!string.IsNullOrWhiteSpace(line)) _reporter.Diagnostic(line); },
+            cancellationToken);
+        if (extraction.ExitCode != 0)
+            throw new InvalidDataException("Game extraction failed. " + extraction.CombinedOutput.Trim());
+        ValidateExtractedGame(Path.Combine(destination, "DATA"), manifest);
+    }
+
+    private static void ValidateExtractedGame(string dataRoot, PayloadManifest manifest)
+    {
+        var dol = Path.Combine(dataRoot, "sys", "main.dol");
+        var rel = Path.Combine(dataRoot, "files", "rel", "StaticR.rel");
+        var fst = Path.Combine(dataRoot, "sys", "fst.bin");
+        if (!File.Exists(dol) || !File.Exists(rel) || !File.Exists(fst))
+            throw new InvalidDataException("The disc extraction is missing required Mario Kart Wii files.");
+        var dolHash = InputValidation.Sha256File(dol);
+        var relHash = InputValidation.Sha256File(rel);
+        if (!dolHash.Equals(manifest.ExpectedDolSha256, StringComparison.OrdinalIgnoreCase) ||
+            !relHash.Equals(manifest.ExpectedRelSha256, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidDataException(
+                "The disc is RMCP01 but does not match the supported clean PAL revision. " +
+                "Patched or otherwise modified game code cannot be installed safely.");
+        }
+    }
+
+    private static void ValidateInstallDirectory(string path) =>
+        FileSystemUtilities.EnsureUsableLocation(path, "The installation folder");
+
+    private static void EnsureSufficientRemainingDiskSpace(string installDirectory,
+        bool needsExtractedDisc, bool needsLocalBuild)
+    {
+        const long extractedDiscAllowance = 5L * 1024 * 1024 * 1024;
+        const long localBuildAllowance = 14L * 1024 * 1024 * 1024;
+        const long safetyAllowance = 2L * 1024 * 1024 * 1024;
+        // This preflight runs after the release payload and the compile-input snapshot have already
+        // been staged. Count only work that can still allocate space from this point.
+        var required = checked((needsExtractedDisc ? extractedDiscAllowance : 0) +
+                               (needsLocalBuild ? localBuildAllowance : 0) + safetyAllowance);
+
+        FileSystemUtilities.EnsureFreeSpace(installDirectory, required, "Setup");
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/JsonState.cs b/Launcher/WiiCompiled.Setup/JsonState.cs
new file mode 100644
index 0000000..5b51fc6
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/JsonState.cs
@@ -0,0 +1,27 @@
+using System.Text.Json;
+
+namespace WiiCompiled.Setup;
+
+/// <summary>Reads and atomically writes the small JSON state documents kept inside an installation.</summary>
+internal static class JsonState
+{
+    private static readonly JsonSerializerOptions ReadOptions = new() { PropertyNameCaseInsensitive = true };
+    private static readonly JsonSerializerOptions WriteOptions = new() { WriteIndented = true };
+
+    public static T? TryRead<T>(string path) where T : class
+    {
+        try
+        {
+            return File.Exists(path) ? JsonSerializer.Deserialize<T>(File.ReadAllText(path), ReadOptions) : null;
+        }
+        catch
+        {
+            // A truncated or hand-edited state document must degrade into "unknown", which every
+            // caller already treats as "assume stale and rebuild", not into a failed launch.
+            return null;
+        }
+    }
+
+    public static void Write<T>(string path, T value) =>
+        FileSystemUtilities.WriteAtomic(path, JsonSerializer.Serialize(value, WriteOptions));
+}
diff --git a/Launcher/WiiCompiled.Setup/LocalBuildService.cs b/Launcher/WiiCompiled.Setup/LocalBuildService.cs
new file mode 100644
index 0000000..439c594
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/LocalBuildService.cs
@@ -0,0 +1,197 @@
+using System.Diagnostics;
+
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// <see cref="Both"/> runs one retro-aware translation and compiles the two products from a single
+/// build graph, sharing every profile-neutral shard object. Building the legs separately re-emits
+/// the shared base shards with retro-aware content in the second leg and recompiles all of them.
+/// </summary>
+internal enum BuildProfile { Base, RetroRewind, Both }
+
+internal sealed class LocalBuildService
+{
+    private readonly IInstallReporter _reporter;
+
+    public LocalBuildService(IInstallReporter reporter) => _reporter = reporter;
+
+    /// <summary>
+    /// Runs the bundled translate-and-compile script against <paramref name="installStaging"/>, which
+    /// holds a complete <c>Toolkit</c> and <c>BuildWorkspace</c> pair - either an installation being
+    /// staged or an existing installation being repaired in place.
+    /// </summary>
+    public async Task BuildAsync(string installStaging, BuildProfile profile, string outputDirectory,
+        RetroWfcPayloadMode retroWfcPayloadMode, string? retroWfcOfflinePayloadDirectory,
+        CancellationToken cancellationToken, ToolkitFingerprintComponents? toolkitComponents = null,
+        bool forceCleanBuild = false, BuildProgressWindow? progress = null,
+        string? retroRewindPackageDirectory = null, string? baseOutputDirectory = null)
+    {
+        var workspace = InstalledLayout.Workspace(installStaging);
+        var toolkit = InstalledLayout.Toolkit(installStaging);
+        var script = Path.Combine(workspace, "LocalBuild.ps1");
+        if (!File.Exists(script)) throw new FileNotFoundException("The local build script is missing.", script);
+
+        var buildsRetro = profile is BuildProfile.RetroRewind or BuildProfile.Both;
+        if (!buildsRetro && retroWfcPayloadMode != RetroWfcPayloadMode.NotApplicable)
+            throw new ArgumentException("The base build cannot select a Retro-WFC payload.");
+        if (buildsRetro && retroWfcPayloadMode == RetroWfcPayloadMode.NotApplicable)
+            throw new ArgumentException("The Retro Rewind build must select or explicitly skip the Retro-WFC payload.");
+        if (retroRewindPackageDirectory is not null && !buildsRetro)
+            throw new ArgumentException("Only Retro Rewind can select an explicit package snapshot.");
+        if ((profile == BuildProfile.Both) != (baseOutputDirectory is not null))
+            throw new ArgumentException("A combined build takes exactly one base output directory.");
+        if (retroRewindPackageDirectory is not null)
+            retroRewindPackageDirectory = RetroRewindSource.ResolveRetroRewind6(
+                retroRewindPackageDirectory);
+        if (retroWfcPayloadMode == RetroWfcPayloadMode.Online)
+            retroWfcOfflinePayloadDirectory =
+                InputValidation.ValidateStagedRetroWfcPayloadDirectory(retroWfcOfflinePayloadDirectory!);
+
+        var arguments = new List<string>
+        {
+            "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script,
+            "-Workspace", workspace, "-Toolkit", toolkit,
+            "-Profile", profile switch
+            {
+                BuildProfile.Base => "base",
+                BuildProfile.RetroRewind => "retro-rewind",
+                _ => "both"
+            },
+            "-OutputDirectory", outputDirectory
+        };
+        if (baseOutputDirectory is not null)
+        {
+            arguments.Add("-BaseOutputDirectory");
+            arguments.Add(baseOutputDirectory);
+        }
+        // The script is the single owner of every cache-reuse decision; these identities are the
+        // evidence it compares against the provenance it recorded with the caches themselves.
+        // Without them (or with -ForceCleanBuild) it degrades to a full clean translate and build.
+        if (toolkitComponents is not null)
+        {
+            arguments.Add("-TranslationFingerprint");
+            arguments.Add(toolkitComponents.Translation);
+            arguments.Add("-NativeToolchainFingerprint");
+            arguments.Add(toolkitComponents.NativeToolchain);
+        }
+        if (forceCleanBuild)
+            arguments.Add("-ForceCleanBuild");
+        if (retroRewindPackageDirectory is not null)
+        {
+            arguments.Add("-RetroRewindPackageDirectory");
+            arguments.Add(retroRewindPackageDirectory);
+        }
+        if (retroWfcPayloadMode == RetroWfcPayloadMode.Online)
+        {
+            arguments.Add("-RetroWfcOfflineDirectory");
+            arguments.Add(retroWfcOfflinePayloadDirectory!);
+            arguments.Add("-RetroWfcPayloadOrigin");
+            arguments.Add("downloaded");
+        }
+        else if (retroWfcPayloadMode == RetroWfcPayloadMode.Skipped)
+        {
+            arguments.Add("-SkipRetroWfcPayload");
+        }
+        // Scrubs the ambient VS environment so the bundled clang-mingw toolchain is the only one visible.
+        // The actual search path is set by LocalBuild.ps1's one canonical definition (Get-MkwToolchainPath,
+        // shared with Prepare-NativePrebuilt.ps1), not duplicated here, to avoid drift.
+        void ScrubEnvironment(ProcessStartInfo start)
+        {
+            start.WorkingDirectory = workspace;
+            foreach (var inherited in new[]
+                     { "INCLUDE", "LIB", "LIBPATH", "VSINSTALLDIR", "VCToolsInstallDir", "WindowsSdkDir" })
+                start.Environment.Remove(inherited);
+        }
+
+        void Observe(string line)
+        {
+            if (string.IsNullOrWhiteSpace(line)) return;
+            if (progress is not null) progress.Observe(line);
+            else _reporter.Diagnostic(line);
+        }
+
+        var build = await ProcessRunner.RunAsync(
+            Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System),
+                "WindowsPowerShell", "v1.0", "powershell.exe"),
+            arguments, Observe, cancellationToken, ScrubEnvironment, capture: false,
+            ex => _reporter.Diagnostic(
+                "The cancelled build process could not be terminated immediately: " + ex.Message));
+        if (build.ExitCode != 0)
+            throw new InvalidOperationException($"Local recompilation failed with exit code {build.ExitCode}. See the setup log for the failed translator or compiler command.");
+
+        var expectedOutputs = profile switch
+        {
+            BuildProfile.Base => [(outputDirectory, "WiiCompiled.exe")],
+            BuildProfile.RetroRewind => [(outputDirectory, "RetroRewind.exe")],
+            _ => new[] { (baseOutputDirectory!, "WiiCompiled.exe"), (outputDirectory, "RetroRewind.exe") }
+        };
+        foreach (var (directory, executableName) in expectedOutputs)
+        {
+            var executable = Path.Combine(directory, executableName);
+            if (!File.Exists(executable) || new FileInfo(executable).Length < 64 * 1024)
+                throw new InvalidDataException("The local build completed without producing a valid game executable.");
+            if (!File.Exists(Path.Combine(directory, "local-build.json")))
+                throw new InvalidDataException("The local build did not produce provenance information.");
+        }
+    }
+
+    /// <summary>
+    /// Records what this product was built from: <paramref name="toolkitFingerprint"/> ties it to the
+    /// translator/workspace, <paramref name="codePulSha256"/> to Retro Rewind's embedded Code.pul, so a
+    /// later launch or update can tell whether the binary is still correct.
+    /// </summary>
+    public static void WriteFingerprint(string outputDirectory, BuildProfile profile, string toolkitFingerprint,
+        string dolSha256, string relSha256, string codePulSha256, RetroWfcPayloadMode retroWfcPayloadMode,
+        string retroRewindCompileInputsSha256 = "", string retroWfcPayloadSha256 = "",
+        long retroWfcPayloadLength = 0)
+    {
+        var executable = Path.Combine(outputDirectory,
+            profile == BuildProfile.Base ? "WiiCompiled.exe" : "RetroRewind.exe");
+        if (!File.Exists(executable))
+            throw new FileNotFoundException("Cannot record build provenance because the compiled executable is missing.",
+                executable);
+        if (profile == BuildProfile.RetroRewind)
+        {
+            var local = JsonState.TryRead<LocalBuildProvenance>(
+                Path.Combine(outputDirectory, LocalBuildProvenance.FileName));
+            var expectedMode = retroWfcPayloadMode == RetroWfcPayloadMode.Online
+                ? "downloaded"
+                : "skipped";
+            if (local is not { SchemaVersion: 1 } ||
+                !string.Equals(local.DolSha256, dolSha256, StringComparison.OrdinalIgnoreCase) ||
+                !string.Equals(local.RelSha256, relSha256, StringComparison.OrdinalIgnoreCase) ||
+                !string.Equals(local.CodePulSha256, codePulSha256,
+                    StringComparison.OrdinalIgnoreCase) ||
+                !string.Equals(local.RetroWfcPayloadMode, expectedMode, StringComparison.Ordinal) ||
+                !string.Equals(local.RetroWfcPayloadSha256,
+                    retroWfcPayloadMode == RetroWfcPayloadMode.Online ? retroWfcPayloadSha256 : null,
+                    StringComparison.OrdinalIgnoreCase) ||
+                (local.RetroWfcPayloadLength ?? 0) !=
+                (retroWfcPayloadMode == RetroWfcPayloadMode.Online ? retroWfcPayloadLength : 0))
+            {
+                throw new InvalidDataException(
+                    "The local Retro Rewind build did not consume the selected Retro-WFC payload snapshot.");
+            }
+        }
+
+        var fingerprint = new ProductFingerprint
+        {
+            Profile = profile == BuildProfile.Base ? "base" : "retro-rewind",
+            ToolkitFingerprint = toolkitFingerprint,
+            DolSha256 = dolSha256,
+            RelSha256 = relSha256,
+            ExecutableSha256 = InputValidation.Sha256File(executable),
+            CodePulSha256 = codePulSha256,
+            RetroRewindCompileInputsSha256 = retroRewindCompileInputsSha256,
+            RetroWfcPayloadMode = retroWfcPayloadMode switch
+            {
+                RetroWfcPayloadMode.Online => "downloaded",
+                RetroWfcPayloadMode.Skipped => "skipped",
+                _ => ""
+            },
+            RetroWfcPayloadSha256 = retroWfcPayloadSha256,
+            RetroWfcPayloadLength = retroWfcPayloadLength
+        };
+        JsonState.Write(Path.Combine(outputDirectory, ProductFingerprint.FileName), fingerprint);
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/Models.cs b/Launcher/WiiCompiled.Setup/Models.cs
new file mode 100644
index 0000000..0ba2fae
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/Models.cs
@@ -0,0 +1,172 @@
+using System.Text.Json.Serialization;
+
+namespace WiiCompiled.Setup;
+
+internal enum RetroWfcPayloadMode
+{
+    NotApplicable,
+    Online,
+    Skipped
+}
+
+internal sealed class InstallOptions
+{
+    public required string GamePath { get; init; }
+
+    /// <summary>
+    /// The canonical Retro Rewind installation Wheel Wizard owns. Its resolved path is recorded as
+    /// <c>retro_rewind_root</c>; only its compile inputs are ever snapshotted.
+    /// </summary>
+    public string? RetroDirectoryPath { get; init; }
+
+    public RetroWfcPayloadMode RetroWfcPayloadMode { get; init; }
+    public required string InstallDirectory { get; init; }
+
+    /// <summary>
+    /// Establish a portable installation: the parent of <see cref="InstallDirectory"/> becomes the
+    /// portable root, gets the <c>portable.txt</c> marker and a <c>UserData</c> directory, and all
+    /// runtime user state and <c>[paths]</c> settings stay inside it.
+    /// </summary>
+    public bool Portable { get; init; }
+
+    public bool HasRetroRewind => RetroDirectoryPath is not null;
+}
+
+internal sealed class PayloadManifest
+{
+    public int SchemaVersion { get; set; }
+    public string ProductVersion { get; set; } = "";
+    public string ExpectedGameId { get; set; } = "RMCP01";
+    public string ExpectedDolSha256 { get; set; } = "";
+    public string ExpectedRelSha256 { get; set; } = "";
+    public string ToolkitReleaseTag { get; set; } = "";
+    public string BuildModel { get; set; } = "";
+    public string RetroWfcPayloadUri { get; set; } = "";
+
+    /// <summary>
+    /// Content identities computed once at release-build time (<c>Build-Installer.ps1 --emit-payload-identities</c>)
+    /// so install doesn't re-hash gigabytes per user; compilation alone re-derives the toolkit identity from disk.
+    /// </summary>
+    public string ToolkitFingerprint { get; set; } = "";
+    public string ToolkitPackageFingerprint { get; set; } = "";
+    public string RuntimeAssetsFingerprint { get; set; } = "";
+
+    /// <summary>
+    /// Cache-reuse subsets of <see cref="ToolkitFingerprint"/>. Empty in a pre-0.2.0 manifest,
+    /// which every consumer treats as "changed" and therefore as a full rebuild - never as reuse.
+    /// </summary>
+    public string TranslationFingerprint { get; set; } = "";
+    public string NativeToolchainFingerprint { get; set; } = "";
+}
+
+/// <summary>
+/// One validated, content-identified download in operation-owned scratch space. Callers use this
+/// exact directory for both the update decision and any resulting build.
+/// </summary>
+internal sealed record RetroWfcPayloadSnapshot(string Directory, string Sha256, long ByteLength);
+
+internal sealed class DiscHeader
+{
+    [JsonPropertyName("game_id")]
+    public string GameId { get; set; } = "";
+
+    [JsonPropertyName("internal_name")]
+    public string InternalName { get; set; } = "";
+
+    [JsonPropertyName("region")]
+    public string Region { get; set; } = "";
+
+    [JsonPropertyName("revision")]
+    public int Revision { get; set; }
+}
+
+internal sealed class InstallState
+{
+    [JsonRequired]
+    public int SchemaVersion { get; set; } = 1;
+
+    /// <summary>
+    /// The setup version that produced this installation. This is the field WheelWizard compares
+    /// against the latest published <c>v*</c> release tag; see docs/WHEELWIZARD_CONTRACT.md.
+    /// </summary>
+    public string SetupVersion { get; set; } = ProductInfo.Version;
+
+    public string ProductVersion { get; set; } = ProductInfo.Version;
+
+    /// <summary>The directory this state describes, so a frontend can confirm what it found.</summary>
+    public string InstallDir { get; set; } = "";
+
+    public DateTime InstalledUtc { get; set; } = DateTime.UtcNow;
+    public bool RetroRewindInstalled { get; set; }
+    public string ToolkitReleaseTag { get; set; } = "";
+    public string DolSha256 { get; set; } = "";
+    public string RelSha256 { get; set; } = "";
+    public string RetroRewindCodePulSha256 { get; set; } = "";
+    public string RetroRewindCompileInputsSha256 { get; set; } = "";
+    public string RetroWfcPayloadMode { get; set; } = "";
+    public string RetroWfcPayloadSha256 { get; set; } = "";
+    public long RetroWfcPayloadLength { get; set; }
+
+    /// <summary>
+    /// The <c>RetroRewind6</c> directory this installation was pointed at. The runtime's actual copy is
+    /// <c>[paths] retro_rewind_root</c>; this mirror lets uninstall drop only the setting it owns.
+    /// </summary>
+    public string RetroRewindRoot { get; set; } = "";
+}
+
+/// <summary>
+/// Written next to every locally produced product (<c>Base</c>, <c>RetroRewind</c>): the exact inputs
+/// it was built from, so launch/update can decide without re-running anything whether it's still correct.
+/// </summary>
+internal sealed class ProductFingerprint
+{
+    [JsonRequired]
+    public int SchemaVersion { get; set; } = 1;
+    public string Profile { get; set; } = "";
+    public string SetupVersion { get; set; } = ProductInfo.Version;
+    public string ToolkitFingerprint { get; set; } = "";
+    public string DolSha256 { get; set; } = "";
+    public string RelSha256 { get; set; } = "";
+    /// <summary>
+    /// Identity of the exact executable produced by this build. A valid input provenance is not
+    /// enough if a partial copy, third-party replacement, or disk corruption changed the product
+    /// after it was built.
+    /// </summary>
+    public string ExecutableSha256 { get; set; } = "";
+    public string CodePulSha256 { get; set; } = "";
+    /// <summary>
+    /// Identity of every translator-consumed Retro Rewind input this product was built from. An
+    /// asset-only change to the canonical installation does not alter it, which is exactly why an
+    /// asset-only Retro Rewind update needs no backend work at all.
+    /// </summary>
+    public string RetroRewindCompileInputsSha256 { get; set; } = "";
+    public string RetroWfcPayloadMode { get; set; } = "";
+    public string RetroWfcPayloadSha256 { get; set; } = "";
+    public long RetroWfcPayloadLength { get; set; }
+    public DateTimeOffset BuiltUtc { get; set; } = DateTimeOffset.UtcNow;
+
+    public const string FileName = "build-fingerprint.json";
+}
+
+/// <summary>
+/// Written whenever the toolkit (translator + build workspace + compiler) is installed or replaced;
+/// records compile, packaged-tool, and copied-runtime identities. Launch checks compare the compile
+/// identity against each product's <see cref="ProductFingerprint.ToolkitFingerprint"/> in O(1).
+/// </summary>
+internal sealed class ToolkitState
+{
+    [JsonRequired]
+    public int SchemaVersion { get; set; } = 2;
+    public string ToolkitFingerprint { get; set; } = "";
+    public string ToolkitPackageFingerprint { get; set; } = "";
+    /// <summary>Identity of the runtime assets copied verbatim beside each product.</summary>
+    public string RuntimeAssetsFingerprint { get; set; } = "";
+    /// <summary>Cache-reuse subsets of the compile identity; empty on a pre-0.2.0 installation.</summary>
+    public string TranslationFingerprint { get; set; } = "";
+    public string NativeToolchainFingerprint { get; set; } = "";
+    public string ToolkitReleaseTag { get; set; } = "";
+    public string SetupVersion { get; set; } = ProductInfo.Version;
+    public DateTimeOffset UpdatedUtc { get; set; } = DateTimeOffset.UtcNow;
+
+    public const string FileName = "toolkit-state.json";
+}
diff --git a/Launcher/WiiCompiled.Setup/PayloadArchive.cs b/Launcher/WiiCompiled.Setup/PayloadArchive.cs
new file mode 100644
index 0000000..3fb9055
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/PayloadArchive.cs
@@ -0,0 +1,167 @@
+using System.IO.Compression;
+using System.Text;
+using System.Text.Json;
+
+namespace WiiCompiled.Setup;
+
+internal sealed class PayloadArchive : IDisposable
+{
+    private static readonly byte[] FooterMagic = Encoding.ASCII.GetBytes("MKWCPAY1");
+    private static readonly DateTime NormalizedPayloadTimestampUtc =
+        new(2000, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+    private const int FooterSize = 24;
+    private readonly FileStream _executable;
+    private readonly SliceStream _payloadStream;
+    private readonly ZipArchive _zip;
+
+    private PayloadArchive(FileStream executable, SliceStream payloadStream, ZipArchive zip)
+    {
+        _executable = executable;
+        _payloadStream = payloadStream;
+        _zip = zip;
+    }
+
+    public static PayloadArchive OpenCurrent()
+    {
+        var path = Environment.ProcessPath ?? throw new InvalidOperationException("Cannot locate the setup executable.");
+        var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read);
+        try
+        {
+            if (stream.Length < FooterSize)
+                throw new InvalidDataException("This setup executable does not contain an installation payload.");
+
+            stream.Position = stream.Length - FooterSize;
+            using var reader = new BinaryReader(stream, Encoding.ASCII, leaveOpen: true);
+            var magic = reader.ReadBytes(FooterMagic.Length);
+            var offset = reader.ReadInt64();
+            var length = reader.ReadInt64();
+            if (!magic.SequenceEqual(FooterMagic) || offset < 0 || length <= 0 || offset + length != stream.Length - FooterSize)
+                throw new InvalidDataException("The installation payload is missing or damaged.");
+
+            var slice = new SliceStream(stream, offset, length);
+            var zip = new ZipArchive(slice, ZipArchiveMode.Read, leaveOpen: true);
+            return new PayloadArchive(stream, slice, zip);
+        }
+        catch
+        {
+            stream.Dispose();
+            throw;
+        }
+    }
+
+    public PayloadManifest ReadManifest()
+    {
+        var entry = FindEntry(InstalledLayout.PayloadManifestFileName)
+                    ?? throw new InvalidDataException("The payload manifest is missing.");
+        using var stream = entry.Open();
+        var manifest = JsonSerializer.Deserialize<PayloadManifest>(stream,
+            new JsonSerializerOptions { PropertyNameCaseInsensitive = true })
+            ?? throw new InvalidDataException("The payload manifest is invalid.");
+        if (manifest.SchemaVersion != 2)
+            throw new InvalidDataException($"Unsupported payload schema {manifest.SchemaVersion}.");
+        // The payload identities are the release-computed replacement for hashing the whole
+        // toolkit on the user's machine; a payload without them was packaged incorrectly.
+        if (string.IsNullOrWhiteSpace(manifest.ToolkitFingerprint) ||
+            string.IsNullOrWhiteSpace(manifest.ToolkitPackageFingerprint) ||
+            string.IsNullOrWhiteSpace(manifest.RuntimeAssetsFingerprint))
+            throw new InvalidDataException("The payload manifest is missing its content identities.");
+        InputValidation.ValidateRetroWfcPayloadUri(manifest.RetroWfcPayloadUri);
+        return manifest;
+    }
+
+    public void ExtractEntry(string entryName, string destination)
+    {
+        var entry = FindEntry(entryName)
+                    ?? throw new InvalidDataException($"Payload entry is missing: {entryName}");
+        Directory.CreateDirectory(Path.GetDirectoryName(destination)!);
+        using (var input = entry.Open())
+        using (var output = new FileStream(destination, FileMode.Create, FileAccess.Write, FileShare.None))
+            input.CopyTo(output);
+        NormalizeExtractedTimestamp(destination);
+    }
+
+    public void ExtractDirectory(string prefix, string destination)
+    {
+        prefix = NormalizeEntryName(prefix).TrimEnd('/') + "/";
+        var destinationRoot = Path.GetFullPath(destination).TrimEnd(Path.DirectorySeparatorChar) + Path.DirectorySeparatorChar;
+        foreach (var entry in _zip.Entries)
+        {
+            var normalizedEntry = NormalizeEntryName(entry.FullName);
+            if (!normalizedEntry.StartsWith(prefix, StringComparison.Ordinal) || normalizedEntry.EndsWith('/'))
+                continue;
+            var relative = normalizedEntry[prefix.Length..].Replace('/', Path.DirectorySeparatorChar);
+            var outputPath = Path.GetFullPath(Path.Combine(destinationRoot, relative));
+            if (!outputPath.StartsWith(destinationRoot, StringComparison.OrdinalIgnoreCase))
+                throw new InvalidDataException($"Unsafe payload path: {entry.FullName}");
+            Directory.CreateDirectory(Path.GetDirectoryName(outputPath)!);
+            entry.ExtractToFile(outputPath, overwrite: true);
+            NormalizeExtractedTimestamp(outputPath);
+        }
+    }
+
+    internal static void NormalizeExtractedTimestamp(string path) =>
+        File.SetLastWriteTimeUtc(path, NormalizedPayloadTimestampUtc);
+
+    private static string NormalizeEntryName(string value) => value.Replace('\\', '/').TrimStart('/');
+    private ZipArchiveEntry? FindEntry(string name)
+    {
+        var normalized = NormalizeEntryName(name);
+        return _zip.Entries.FirstOrDefault(entry =>
+            NormalizeEntryName(entry.FullName).Equals(normalized, StringComparison.Ordinal));
+    }
+
+    public void Dispose()
+    {
+        _zip.Dispose();
+        _payloadStream.Dispose();
+        _executable.Dispose();
+    }
+
+    private sealed class SliceStream : Stream
+    {
+        private readonly Stream _inner;
+        private readonly long _offset;
+        private readonly long _length;
+        private long _position;
+
+        public SliceStream(Stream inner, long offset, long length)
+        {
+            _inner = inner;
+            _offset = offset;
+            _length = length;
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => true;
+        public override bool CanWrite => false;
+        public override long Length => _length;
+        public override long Position { get => _position; set => Seek(value, SeekOrigin.Begin); }
+        public override void Flush() { }
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            if (_position >= _length) return 0;
+            count = (int)Math.Min(count, _length - _position);
+            lock (_inner)
+            {
+                _inner.Position = _offset + _position;
+                var read = _inner.Read(buffer, offset, count);
+                _position += read;
+                return read;
+            }
+        }
+        public override long Seek(long offset, SeekOrigin origin)
+        {
+            var next = origin switch
+            {
+                SeekOrigin.Begin => offset,
+                SeekOrigin.Current => _position + offset,
+                SeekOrigin.End => _length + offset,
+                _ => throw new ArgumentOutOfRangeException(nameof(origin))
+            };
+            if (next < 0 || next > _length) throw new IOException("Attempted to seek outside the payload.");
+            return _position = next;
+        }
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/PortableRoot.cs b/Launcher/WiiCompiled.Setup/PortableRoot.cs
new file mode 100644
index 0000000..eab3dcd
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/PortableRoot.cs
@@ -0,0 +1,143 @@
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// A portable installation is a self-contained directory tree the user can move or carry on removable media:
+/// <code>
+/// &lt;root&gt;\portable.txt   marker; its contents are irrelevant
+/// &lt;root&gt;\Install\       the installation directory
+/// &lt;root&gt;\UserData\      runtime user state (Config.toml, NAND, Cache, Logs)
+/// </code>
+/// The runtime finds the same root independently (<c>runtime/include/runtime_config.h</c>,
+/// <c>PortableRootDirectory</c>); this class must keep the same marker name, layout, and depth bound.
+/// </summary>
+internal static class PortableRoot
+{
+    public const string MarkerFileName = "portable.txt";
+    public const string UserDataDirectoryName = "UserData";
+    public const string InstallDirectoryName = "Install";
+
+    /// <summary>
+    /// Parents searched above the start directory. Kept small (installs sit 2 levels below root,
+    /// <c>&lt;root&gt;\Install\Base\game.exe</c>) so an unrelated marker far up a drive can't capture it.
+    /// </summary>
+    public const int MaximumSearchDepth = 4;
+
+    /// <summary>
+    /// The portable root <paramref name="startDirectory"/> belongs to, or null otherwise. Callers pass the
+    /// installation directory (not the running executable's location), since a downloaded setup runs from Downloads.
+    /// </summary>
+    public static string? TryFind(string startDirectory)
+    {
+        if (string.IsNullOrWhiteSpace(startDirectory)) return null;
+        string current;
+        try
+        {
+            // Normalize before trimming: "C:\" trimmed to "C:" is the current directory on that
+            // drive, not the drive root.
+            current = Normalize(startDirectory);
+        }
+        catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException)
+        {
+            return null;
+        }
+
+        for (var level = 0; level <= MaximumSearchDepth; level++)
+        {
+            if (File.Exists(Path.Combine(current, MarkerFileName))) return current;
+            var parent = Path.GetDirectoryName(current);
+            if (string.IsNullOrEmpty(parent) || parent.Equals(current, StringComparison.Ordinal)) break;
+            current = parent;
+        }
+        return null;
+    }
+
+    public static string UserDataDirectory(string root) => Path.Combine(root, UserDataDirectoryName);
+
+    /// <summary>Whether <paramref name="candidate"/> is <paramref name="root"/> or lives inside it.</summary>
+    public static bool Contains(string root, string candidate) =>
+        FileSystemUtilities.PathContains(root, candidate);
+
+    /// <summary>
+    /// Establishes the root an install is about to publish into: the marker and the user-state
+    /// directory must exist before anything resolves a configuration path, because that resolution is
+    /// what decides whether the installation writes portable or machine-wide settings.
+    /// </summary>
+    public static string Create(string root)
+    {
+        var full = Normalize(root);
+        EnsureUsableRoot(full);
+        Directory.CreateDirectory(full);
+        Directory.CreateDirectory(UserDataDirectory(full));
+        var marker = Path.Combine(full, MarkerFileName);
+        if (!File.Exists(marker))
+        {
+            File.WriteAllText(marker,
+                $"{ProductInfo.Name} portable installation." + Environment.NewLine +
+                "This marker makes the runtime keep Config.toml, NAND, Cache, and Logs in UserData\\ " +
+                "beside it instead of in %LOCALAPPDATA%." + Environment.NewLine +
+                "Delete it to make this installation use per-user application data again." +
+                Environment.NewLine);
+        }
+        return full;
+    }
+
+    /// <summary>
+    /// A portable root is deleted wholesale by the user, so like an install directory it may never be a
+    /// drive root or well-known system location; both share <see cref="FileSystemUtilities.EnsureUsableLocation"/>.
+    /// </summary>
+    public static void EnsureUsableRoot(string root) =>
+        FileSystemUtilities.EnsureUsableLocation(root, "A portable installation root");
+
+    private static string Normalize(string path) => FileSystemUtilities.NormalizePath(path);
+}
+
+/// <summary>
+/// A portable root can be moved or renamed between operations. Every installed-host operation that
+/// reads <c>install-state.json</c> passes through here first so exactly one place decides what a
+/// moved installation means, and so a non-portable installation is never touched.
+/// </summary>
+internal static class PortableInstallHealing
+{
+    /// <summary>
+    /// Reconciles a moved portable installation with its recorded location: the state file adopts the
+    /// directory it was actually found in, and the native build tree is discarded because its
+    /// CMake cache holds absolute paths from the old location. Returns whether anything was healed.
+    /// </summary>
+    public static bool HealMovedInstall(Installation installation, IInstallReporter? reporter = null)
+    {
+        // Guard: an ordinary installation that disagrees with its state file is a real problem for
+        // the operation to report, not something to silently rewrite.
+        if (PortableRoot.TryFind(installation.Root) is null) return false;
+
+        var state = installation.ReadInstallState();
+        if (state is not { SchemaVersion: 1 } || string.IsNullOrWhiteSpace(state.InstallDir)) return false;
+
+        string recorded;
+        try
+        {
+            recorded = FileSystemUtilities.NormalizePath(state.InstallDir);
+        }
+        catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException)
+        {
+            recorded = state.InstallDir;
+        }
+        if (recorded.Equals(installation.Root, StringComparison.OrdinalIgnoreCase)) return false;
+
+        var previous = state.InstallDir;
+        state.InstallDir = installation.Root;
+        JsonState.Write(installation.InstallStatePath, state);
+
+        // The configured native build directory bakes absolute source, toolchain, and output paths
+        // into CMakeCache.txt. After a move it is unusable and would fail the next configure rather
+        // than being reused, so it is removed and reconfigured from scratch on the next build.
+        var nativeBuild = Path.Combine(installation.WorkspaceDirectory, "native-build");
+        var hadNativeBuild = Directory.Exists(nativeBuild);
+        if (hadNativeBuild) FileSystemUtilities.DeleteDirectoryIfExists(nativeBuild);
+
+        reporter?.Diagnostic(
+            $"This portable installation moved from {previous} to {installation.Root}. " +
+            "The recorded location was updated" +
+            (hadNativeBuild ? " and the location-bound native build cache was discarded." : "."));
+        return true;
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/ProductRepairService.cs b/Launcher/WiiCompiled.Setup/ProductRepairService.cs
new file mode 100644
index 0000000..57769d1
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/ProductRepairService.cs
@@ -0,0 +1,646 @@
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// Reconciles installed products against the canonical Retro Rewind install Wheel Wizard owns: the
+/// toolkit compiles, the source only contributes inputs and its path (<c>retro_rewind_root</c>).
+/// </summary>
+internal sealed class ProductRepairService
+{
+    internal enum RetroWfcPayloadAction { None, PublishCacheOnly, RebuildRetro }
+
+    /// <summary>
+    /// Inputs every reconciliation entry point shares. Everything here is optional context the
+    /// caller already owns under the operation lock; the entry point decides what work is possible.
+    /// </summary>
+    internal sealed record ReconcileOptions
+    {
+        /// <summary>Operation scratch the caller owns, or null to own one for this call.</summary>
+        public string? ScratchRoot { get; init; }
+
+        /// <summary>The release's authoritative clean-disc inputs, supplied together or not at all.</summary>
+        public string? ExpectedDolSha256 { get; init; }
+        public string? ExpectedRelSha256 { get; init; }
+
+        /// <summary>
+        /// The frontend's own canonical <c>RetroRewind6</c> directory, recorded as
+        /// <c>retro_rewind_root</c>. Required by every Retro Rewind operation: the compile-input
+        /// snapshot lives in operation scratch, so it can never be the durable value.
+        /// </summary>
+        public string? CanonicalRetroRewindRoot { get; init; }
+    }
+
+    internal sealed record ReconciliationResult(
+        RetroRewindCompileInputs? CompileInputs,
+        bool PublicationCommitted,
+        /// <summary>
+        /// true when this operation proved or published the online payload cache, null when it made
+        /// no observation and the next inspection must check for itself. false is never produced
+        /// here; product inspection reserves it for a cache already proven stale.
+        /// </summary>
+        bool? CachedRetroWfcPayloadMatches);
+
+    private readonly Installation _installation;
+    private readonly IInstallReporter _reporter;
+
+    public ProductRepairService(Installation installation, IInstallReporter reporter)
+    {
+        _installation = installation;
+        _reporter = reporter;
+    }
+
+    /// <summary>
+    /// Repairs the base product and any copy-only drift the installation can fix from its own
+    /// authoritative workspace. The caller must hold <see cref="InstallOperationLock"/>.
+    /// </summary>
+    public Task<ReconciliationResult> RepairBaseAsync(ReconcileOptions options,
+        CancellationToken cancellationToken = default) =>
+        ReconcileAsync(null, RetroWfcPayloadMode.NotApplicable, options, cancellationToken);
+
+    /// <summary>
+    /// Reconciles Retro Rewind against one immutable compile-input snapshot of the canonical
+    /// installation, recompiling only what those inputs actually change.
+    /// </summary>
+    public Task<ReconciliationResult> RepairRetroAsync(RetroRewindCompileInputs snapshot,
+        RetroWfcPayloadMode payloadMode, ReconcileOptions options,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(snapshot);
+        if (payloadMode == RetroWfcPayloadMode.NotApplicable)
+            throw new InvalidOperationException(
+                "A Retro Rewind operation requires a Retro-WFC payload mode.");
+        return ReconcileAsync(snapshot, payloadMode, options, cancellationToken);
+    }
+
+    private async Task<ReconciliationResult> ReconcileAsync(RetroRewindCompileInputs? snapshot,
+        RetroWfcPayloadMode requestedPayloadMode, ReconcileOptions options,
+        CancellationToken cancellationToken)
+    {
+        if (!_installation.IsPresent)
+            throw new InvalidOperationException("WiiCompiled is not installed here.");
+        if (!_installation.HasToolkit)
+            throw new InvalidOperationException(
+                "The installed recompilation toolkit is missing. Apply the current setup release before repairing products.");
+        var expectedDolSha256 = options.ExpectedDolSha256;
+        var expectedRelSha256 = options.ExpectedRelSha256;
+        if (string.IsNullOrWhiteSpace(expectedDolSha256) != string.IsNullOrWhiteSpace(expectedRelSha256))
+            throw new ArgumentException("Both authoritative game-input hashes must be supplied together.");
+
+        var toolkitFingerprint = _installation.ResolveToolkitFingerprint();
+        if (string.IsNullOrWhiteSpace(toolkitFingerprint))
+            throw new InvalidDataException("The installed recompilation toolkit cannot be identified safely.");
+
+        using var ownedScratch = options.ScratchRoot is null
+            ? InstallScratchSpace.CreateInsideInstall(_installation.Root, _reporter)
+            : null;
+        var scratchRoot = options.ScratchRoot ?? ownedScratch!.Root;
+        Directory.CreateDirectory(scratchRoot);
+
+        RetroWfcPayloadSnapshot? payloadSnapshot = null;
+        if (requestedPayloadMode == RetroWfcPayloadMode.Online)
+        {
+            _reporter.Progress(InstallStages.PrepareRetro,
+                "Downloading the current shared Retro-WFC payload snapshot...", 3);
+            var payloadScratch = Path.Combine(scratchRoot, "retro-wfc-payload");
+            try
+            {
+                payloadSnapshot = await InputValidation.DownloadRetroWfcPayloadAsync(
+                    InputValidation.CurrentRetroWfcPayloadUri, payloadScratch, cancellationToken);
+            }
+            catch (Exception ex) when (!cancellationToken.IsCancellationRequested &&
+                                       ex is HttpRequestException or IOException or InvalidDataException
+                                           or InvalidOperationException or OperationCanceledException)
+            {
+                payloadSnapshot = RecoverInstalledRetroWfcPayload(toolkitFingerprint,
+                    Path.Combine(scratchRoot, "retro-wfc-payload-recovered"), ex, cancellationToken);
+            }
+        }
+
+
+        _reporter.Progress(InstallStages.PrepareRetro,
+            "Checking which installed products are still current...", 3);
+        var downloadedPayloadMatchesProduct = payloadSnapshot is not null &&
+                                              _installation.MatchesRetroWfcPayloadSnapshot(
+                                                  toolkitFingerprint, payloadSnapshot);
+        var cachedPayloadMatchesSnapshot = payloadSnapshot is null
+            ? (bool?)null
+            : _installation.CachedRetroWfcPayloadMatches(payloadSnapshot);
+        var payloadAction = payloadSnapshot is null
+            ? RetroWfcPayloadAction.None
+            : PlanRetroWfcPayloadReconciliation(downloadedPayloadMatchesProduct,
+                cachedPayloadMatchesSnapshot == true);
+
+        // The canonical root the runtime must read assets from. A base-only operation never changes
+        // it, so its recorded value stays exactly as the last Retro Rewind operation left it.
+        var canonicalRoot = snapshot is null
+            ? null
+            : Path.GetFullPath(options.CanonicalRetroRewindRoot ?? throw new InvalidOperationException(
+                "A Retro Rewind operation must record the canonical Retro Rewind folder."));
+        var canonicalRootChanged = canonicalRoot is not null && !RecordedCanonicalRootMatches(canonicalRoot);
+
+        var baseState = _installation.CheckBaseCore(toolkitFingerprint);
+        var retroState = _installation.CheckRetroRewindCore(toolkitFingerprint, snapshot,
+            canonicalError: null, cachedPayloadMatchesSnapshot);
+        var desiredInputDrift = FindDesiredInputDrift(_installation, toolkitFingerprint,
+            expectedDolSha256, expectedRelSha256);
+        var rebuildBase = RequiresCompilation(baseState.Status) || desiredInputDrift.Base;
+        var rebuildRetro = false;
+        var syncRetroWfcPayload = false;
+
+        if (snapshot is null)
+        {
+            if (desiredInputDrift.Retro)
+                throw new InvalidOperationException(
+                    "The release changes the clean game inputs used by the installed Retro Rewind product. " +
+                    "Supply Wheel Wizard's current Retro Rewind folder explicitly so it can be rebuilt safely.");
+            if (retroState.ActionRequired)
+                throw new InvalidOperationException(
+                    "Retro Rewind needs repair, but Wheel Wizard's current Retro Rewind folder was not supplied. " +
+                    retroState.Detail);
+        }
+        else
+        {
+            rebuildRetro = desiredInputDrift.Retro || RequiresCompilation(retroState.Status) ||
+                           retroState.Status == ProductStatus.Absent;
+            syncRetroWfcPayload = retroState.Status == ProductStatus.PayloadChanged;
+
+            if (payloadAction == RetroWfcPayloadAction.RebuildRetro)
+            {
+                rebuildRetro = true;
+                syncRetroWfcPayload = true;
+            }
+            else if (payloadAction == RetroWfcPayloadAction.PublishCacheOnly)
+            {
+                syncRetroWfcPayload = true;
+            }
+
+            var installedMode = _installation.ResolveRetroWfcPayloadMode(toolkitFingerprint);
+            if (_installation.HasRetroProduct && installedMode != RetroWfcPayloadMode.NotApplicable &&
+                installedMode != requestedPayloadMode)
+            {
+                rebuildRetro = true;
+                syncRetroWfcPayload = requestedPayloadMode == RetroWfcPayloadMode.Online;
+            }
+            if (rebuildRetro && requestedPayloadMode == RetroWfcPayloadMode.Online)
+                syncRetroWfcPayload = true;
+        }
+
+        // Copied support files are republished from the installed workspace, never recompiled. A
+        // rebuild already stages fresh copies, so only a product that is not being rebuilt needs it.
+        var syncBaseRuntimeAssets = !rebuildBase && File.Exists(_installation.BaseExecutable) &&
+                                    _installation.ValidateCopiedRuntimeAssets(_installation.BaseDirectory,
+                                        "base", toolkitFingerprint) is not null;
+        var syncRetroRuntimeAssets = !rebuildRetro && _installation.HasRetroProduct &&
+                                     _installation.ValidateCopiedRuntimeAssets(_installation.RetroDirectory,
+                                         "retro-rewind", toolkitFingerprint) is not null;
+
+        if (!rebuildBase && !rebuildRetro && !syncRetroWfcPayload && !syncBaseRuntimeAssets &&
+            !syncRetroRuntimeAssets && !canonicalRootChanged)
+        {
+            _reporter.Progress(InstallStages.Publish, "The installed products are already current.", 99);
+            return new ReconciliationResult(snapshot, PublicationCommitted: false,
+                VerifiedOnlinePayloadCache(toolkitFingerprint));
+        }
+
+        cancellationToken.ThrowIfCancellationRequested();
+        var builder = new LocalBuildService(_reporter);
+        string? baseOutput = null;
+        string? retroOutput = null;
+
+        if (rebuildBase || rebuildRetro)
+        {
+            EnsureSufficientRepairDiskSpace();
+            _reporter.Progress(InstallStages.PrepareRetro,
+                "Verifying the installed recompilation toolkit...", 4);
+            var toolkitComponents = VerifyToolkitForCompilation(toolkitFingerprint, cancellationToken);
+            RefreshTranslationAssets(expectedDolSha256, expectedRelSha256, cancellationToken);
+
+            // A broken or blocked product may mean the caches themselves are damaged, so nothing
+            // recorded on disk is allowed to contribute to the repaired product.
+            var forceCleanBuild =
+                (rebuildBase && baseState.Status is ProductStatus.Broken or ProductStatus.Blocked) ||
+                (rebuildRetro && retroState.Status is ProductStatus.Broken or ProductStatus.Blocked);
+            var (dolSha, relSha) = TranslationInputHashes();
+
+            if (rebuildBase && rebuildRetro)
+            {
+                // One retro-aware translation, one build graph, both products - the same reason the
+                // install path uses BuildProfile.Both: sequential legs would re-emit every shared
+                // base shard with retro-aware content and recompile all of them twice.
+                var compileInputs = snapshot ?? throw new InvalidOperationException(
+                    "Retro Rewind recompilation requires a compile-input snapshot.");
+                baseOutput = Path.Combine(scratchRoot, "base-output");
+                retroOutput = Path.Combine(scratchRoot, "retro-output");
+                _reporter.Progress(InstallStages.BuildBase,
+                    "Recompiling Mario Kart Wii and Retro Rewind with the installed toolkit...", 5);
+                await builder.BuildAsync(_installation.Root, BuildProfile.Both, retroOutput,
+                    requestedPayloadMode, payloadSnapshot?.Directory, cancellationToken,
+                    toolkitComponents, forceCleanBuild,
+                    progress: new BuildProgressWindow(_reporter, InstallStages.BuildBase, 5, 92),
+                    retroRewindPackageDirectory: compileInputs.RetroRewindRoot,
+                    baseOutputDirectory: baseOutput);
+                LocalBuildService.WriteFingerprint(baseOutput, BuildProfile.Base, toolkitFingerprint,
+                    dolSha, relSha, "", RetroWfcPayloadMode.NotApplicable);
+                LocalBuildService.WriteFingerprint(retroOutput, BuildProfile.RetroRewind,
+                    toolkitFingerprint, dolSha, relSha, compileInputs.CodePulSha256,
+                    requestedPayloadMode, compileInputs.CompileInputsSha256,
+                    payloadSnapshot?.Sha256 ?? "", payloadSnapshot?.ByteLength ?? 0);
+            }
+            else if (rebuildBase)
+            {
+                baseOutput = Path.Combine(scratchRoot, "base-output");
+                _reporter.Progress(InstallStages.BuildBase,
+                    "Recompiling Mario Kart Wii with the installed toolkit...", 5);
+                await builder.BuildAsync(_installation.Root, BuildProfile.Base, baseOutput,
+                    RetroWfcPayloadMode.NotApplicable, null, cancellationToken,
+                    toolkitComponents, forceCleanBuild,
+                    progress: new BuildProgressWindow(_reporter, InstallStages.BuildBase, 5, 92));
+                LocalBuildService.WriteFingerprint(baseOutput, BuildProfile.Base, toolkitFingerprint,
+                    dolSha, relSha, "", RetroWfcPayloadMode.NotApplicable);
+            }
+            else
+            {
+                var compileInputs = snapshot ?? throw new InvalidOperationException(
+                    "Retro Rewind recompilation requires a compile-input snapshot.");
+                retroOutput = Path.Combine(scratchRoot, "retro-output");
+                _reporter.Progress(InstallStages.BuildRetro,
+                    "Recompiling Retro Rewind for the canonical Code.pul...", 5);
+                await builder.BuildAsync(_installation.Root, BuildProfile.RetroRewind, retroOutput,
+                    requestedPayloadMode, payloadSnapshot?.Directory, cancellationToken,
+                    toolkitComponents, forceCleanBuild,
+                    progress: new BuildProgressWindow(_reporter, InstallStages.BuildRetro, 5, 92),
+                    retroRewindPackageDirectory: compileInputs.RetroRewindRoot);
+                LocalBuildService.WriteFingerprint(retroOutput, BuildProfile.RetroRewind,
+                    toolkitFingerprint, dolSha, relSha, compileInputs.CodePulSha256,
+                    requestedPayloadMode, compileInputs.CompileInputsSha256,
+                    payloadSnapshot?.Sha256 ?? "", payloadSnapshot?.ByteLength ?? 0);
+            }
+        }
+
+        if (retroOutput is not null)
+            PreserveProductConfig(_installation.RetroDirectory, retroOutput);
+        if (baseOutput is not null)
+            PreserveProductConfig(_installation.BaseDirectory, baseOutput);
+
+        cancellationToken.ThrowIfCancellationRequested();
+        PublishProducts(new PublicationPlan
+        {
+            BaseOutput = baseOutput,
+            RetroOutput = retroOutput,
+            CompileInputs = snapshot,
+            CanonicalRetroRewindRoot = canonicalRoot,
+            SyncBaseRuntimeAssets = syncBaseRuntimeAssets,
+            SyncRetroRuntimeAssets = syncRetroRuntimeAssets,
+            SyncRetroWfcPayload = syncRetroWfcPayload,
+            ToolkitFingerprint = toolkitFingerprint,
+            ScratchRoot = scratchRoot,
+            RequestedPayloadMode = requestedPayloadMode,
+            PayloadSnapshot = payloadSnapshot,
+            ExpectedDolSha256 = expectedDolSha256,
+            ExpectedRelSha256 = expectedRelSha256
+        }, cancellationToken);
+        _reporter.Progress(InstallStages.Publish, "Product repair complete.", 99);
+        return new ReconciliationResult(snapshot, PublicationCommitted: true,
+            VerifiedOnlinePayloadCache(toolkitFingerprint));
+    }
+
+
+    private RetroWfcPayloadSnapshot RecoverInstalledRetroWfcPayload(string toolkitFingerprint,
+        string destinationDirectory, Exception downloadFailure, CancellationToken cancellationToken)
+    {
+        InvalidOperationException Unavailable(string reason) => new(
+            "The Retro-WFC payload service is unavailable" +
+            $" ({downloadFailure.Message.TrimEnd('.')}), and {reason}" +
+            " Try again once the service is reachable.", downloadFailure);
+
+        var fingerprint = _installation.ReadProductFingerprint(_installation.RetroDirectory,
+            toolkitFingerprint);
+        var state = _installation.ReadInstallState();
+        if (fingerprint is not { RetroWfcPayloadMode: "downloaded" } ||
+            state is not { RetroWfcPayloadMode: "downloaded" } ||
+            string.IsNullOrWhiteSpace(fingerprint.RetroWfcPayloadSha256) ||
+            !fingerprint.RetroWfcPayloadSha256.Equals(state.RetroWfcPayloadSha256,
+                StringComparison.Ordinal) ||
+            fingerprint.RetroWfcPayloadLength <= 0)
+        {
+            throw Unavailable("this installation has no verified payload snapshot to fall back to.");
+        }
+
+        string cachedFile;
+        try
+        {
+            cachedFile = InputValidation.ResolveRetroWfcPayloadFile(
+                _installation.WorkspaceRetroWfcPayload);
+            cancellationToken.ThrowIfCancellationRequested();
+            if (new FileInfo(cachedFile).Length != fingerprint.RetroWfcPayloadLength ||
+                !InputValidation.Sha256File(cachedFile).Equals(fingerprint.RetroWfcPayloadSha256,
+                    StringComparison.Ordinal))
+            {
+                throw Unavailable("the installed payload snapshot no longer matches its recorded identity.");
+            }
+
+            var destination = Path.Combine(Path.GetFullPath(destinationDirectory), "binary",
+                "payload.RMCPD00.bin");
+            Directory.CreateDirectory(Path.GetDirectoryName(destination)!);
+            File.Copy(cachedFile, destination, overwrite: true);
+            var root = InputValidation.ValidateStagedRetroWfcPayloadDirectory(destinationDirectory);
+            _reporter.Diagnostic(
+                "The Retro-WFC payload service is unavailable; reusing the installation's verified " +
+                $"payload snapshot (sha256 {fingerprint.RetroWfcPayloadSha256[..12]}..., " +
+                $"{fingerprint.RetroWfcPayloadLength} bytes).");
+            return new RetroWfcPayloadSnapshot(root, fingerprint.RetroWfcPayloadSha256,
+                fingerprint.RetroWfcPayloadLength);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or InvalidDataException)
+        {
+            throw Unavailable($"the installed payload snapshot could not be reused ({ex.Message.TrimEnd('.')}).");
+        }
+    }
+
+    /// <summary>The statuses that can only be resolved by producing the product again.</summary>
+    private static bool RequiresCompilation(ProductStatus status) =>
+        status is ProductStatus.ToolkitChanged or ProductStatus.CodePulChanged or
+            ProductStatus.CompileInputsChanged or ProductStatus.InputsMissing or
+            ProductStatus.Blocked or ProductStatus.Broken;
+
+    private bool? VerifiedOnlinePayloadCache(string toolkitFingerprint) =>
+        _installation.HasRetroProduct &&
+        _installation.ResolveRetroWfcPayloadMode(toolkitFingerprint) == RetroWfcPayloadMode.Online
+            ? true
+            : null;
+
+    internal static RetroWfcPayloadAction PlanRetroWfcPayloadReconciliation(bool productMatchesSnapshot,
+        bool cacheMatchesSnapshot) =>
+        !productMatchesSnapshot ? RetroWfcPayloadAction.RebuildRetro
+        : cacheMatchesSnapshot ? RetroWfcPayloadAction.None
+        : RetroWfcPayloadAction.PublishCacheOnly;
+
+    private bool RecordedCanonicalRootMatches(string canonicalRoot)
+    {
+        var configured = _installation.ConfiguredRetroRewindRoot;
+        var recorded = _installation.ReadInstallState()?.RetroRewindRoot;
+        return configured is not null && recorded is not null &&
+               SamePath(configured, canonicalRoot) && SamePath(recorded, canonicalRoot);
+    }
+
+    private static bool SamePath(string left, string right)
+    {
+        try { return FileSystemUtilities.PathsEqual(left, right); }
+        catch { return false; }
+    }
+
+    /// <summary>Everything one reconciliation decided to publish as a single transaction.</summary>
+    private sealed record PublicationPlan
+    {
+        public string? BaseOutput { get; init; }
+        public string? RetroOutput { get; init; }
+        public RetroRewindCompileInputs? CompileInputs { get; init; }
+        public string? CanonicalRetroRewindRoot { get; init; }
+        public bool SyncBaseRuntimeAssets { get; init; }
+        public bool SyncRetroRuntimeAssets { get; init; }
+        public bool SyncRetroWfcPayload { get; init; }
+
+        public required string ToolkitFingerprint { get; init; }
+        public required string ScratchRoot { get; init; }
+        public RetroWfcPayloadMode RequestedPayloadMode { get; init; }
+        public RetroWfcPayloadSnapshot? PayloadSnapshot { get; init; }
+        public string? ExpectedDolSha256 { get; init; }
+        public string? ExpectedRelSha256 { get; init; }
+    }
+
+    private void PublishProducts(PublicationPlan plan, CancellationToken cancellationToken)
+    {
+        var entries = new List<InstallTransactionEntry>();
+        if (plan.BaseOutput is not null)
+            entries.Add(InstallTransactionEntry.Directory(plan.BaseOutput, _installation.BaseDirectory));
+        if (plan.RetroOutput is not null)
+            entries.Add(InstallTransactionEntry.Directory(plan.RetroOutput, _installation.RetroDirectory));
+
+        if (plan.SyncBaseRuntimeAssets || plan.SyncRetroRuntimeAssets)
+            AddRuntimeAssetPublicationEntries(entries, plan.ScratchRoot, plan.SyncBaseRuntimeAssets,
+                plan.SyncRetroRuntimeAssets, plan.ToolkitFingerprint, cancellationToken);
+
+        if (plan.SyncRetroWfcPayload)
+        {
+            if (plan.PayloadSnapshot is null)
+                throw new InvalidDataException("The downloaded Retro-WFC payload was not staged.");
+            entries.Add(InstallTransactionEntry.Directory(plan.PayloadSnapshot.Directory,
+                _installation.WorkspaceRetroWfcPayload));
+        }
+        if (plan.RetroOutput is not null && plan.RequestedPayloadMode == RetroWfcPayloadMode.Skipped)
+        {
+            var emptyPayload = Path.Combine(plan.ScratchRoot, "retro-wfc-payload-removed");
+            Directory.CreateDirectory(emptyPayload);
+            entries.Add(InstallTransactionEntry.Directory(emptyPayload,
+                _installation.WorkspaceRetroWfcPayload));
+        }
+
+        // Copied-runtime repair does not change product or input provenance. Publish only the
+        // authoritative support files in that case, leaving install-state byte-for-byte intact.
+        var publishState = plan.BaseOutput is not null || plan.RetroOutput is not null ||
+                           plan.CanonicalRetroRewindRoot is not null;
+        if (publishState)
+        {
+            var statePath = Path.Combine(plan.ScratchRoot, InstalledLayout.InstallStateFileName);
+            JsonState.Write(statePath, BuildUpdatedInstallState(plan.ToolkitFingerprint,
+                plan.CompileInputs, plan.CanonicalRetroRewindRoot,
+                plan.RetroOutput is null ? null : plan.RequestedPayloadMode,
+                plan.RetroOutput is null ? null : plan.PayloadSnapshot, plan.ExpectedDolSha256,
+                plan.ExpectedRelSha256));
+            entries.Add(InstallTransactionEntry.File(statePath, _installation.InstallStatePath));
+        }
+
+        cancellationToken.ThrowIfCancellationRequested();
+        var configPath = RuntimeConfiguration.ResolveConfigPath(_installation.Root);
+        var configSnapshot = RuntimeConfiguration.Capture(configPath);
+        using var transaction = InstallTransaction.Begin(_installation.Root, _reporter, entries.ToArray());
+        transaction.Publish();
+        if (plan.CanonicalRetroRewindRoot is not null)
+        {
+            transaction.RecordRuntimeConfigurationMutation(configSnapshot);
+            RuntimeConfiguration.SetRetroRewindRoot(configPath, plan.CanonicalRetroRewindRoot);
+        }
+        transaction.Commit();
+    }
+
+    private void EnsureSufficientRepairDiskSpace()
+    {
+        const long localBuildAllowance = 14L * 1024 * 1024 * 1024;
+        const long safetyAllowance = 2L * 1024 * 1024 * 1024;
+        FileSystemUtilities.EnsureFreeSpace(_installation.Root,
+            localBuildAllowance + safetyAllowance, "Local recompilation");
+    }
+
+    internal ToolkitFingerprintComponents VerifyToolkitForCompilation(string authoritativeFingerprint,
+        CancellationToken cancellationToken = default)
+    {
+        var state = _installation.ReadToolkitState();
+        if (state is not { SchemaVersion: 2 } ||
+            string.IsNullOrWhiteSpace(state.ToolkitFingerprint) ||
+            !state.ToolkitFingerprint.Equals(authoritativeFingerprint, StringComparison.Ordinal))
+        {
+            throw new InvalidDataException(
+                "The installed toolkit provenance is missing or does not match this repair operation.");
+        }
+
+        var components = ToolkitFingerprint.ComputeComponents(_installation.Root, cancellationToken);
+        if (!components.Compile.Equals(authoritativeFingerprint, StringComparison.Ordinal))
+        {
+            throw new InvalidDataException(
+                "The installed recompilation toolkit was modified or is incomplete. Apply the current setup release before compiling products.");
+        }
+        return components;
+    }
+
+    private void AddRuntimeAssetPublicationEntries(List<InstallTransactionEntry> entries,
+        string scratchRoot, bool includeBase, bool includeRetro, string toolkitFingerprint,
+        CancellationToken cancellationToken)
+    {
+        var state = _installation.ReadToolkitState();
+        if (state is not { SchemaVersion: 2 } ||
+            !state.ToolkitFingerprint.Equals(toolkitFingerprint, StringComparison.Ordinal) ||
+            string.IsNullOrWhiteSpace(state.RuntimeAssetsFingerprint))
+        {
+            throw new InvalidDataException(
+                "The installed runtime-asset provenance is missing or does not belong to the current toolkit.");
+        }
+
+        var expectedFingerprint = state.RuntimeAssetsFingerprint;
+        var sourceFingerprint = ToolkitFingerprint.ComputeRuntimeAssets(_installation.Root, cancellationToken);
+        if (!sourceFingerprint.Equals(expectedFingerprint, StringComparison.Ordinal))
+        {
+            throw new InvalidDataException(
+                "The installed BuildWorkspace runtime assets do not match their authoritative toolkit provenance.");
+        }
+
+        var products = new[]
+            {
+                (Include: includeBase, Name: "Base", Destination: _installation.BaseDirectory),
+                (Include: includeRetro, Name: "RetroRewind", Destination: _installation.RetroDirectory)
+            }
+            .Where(product => product.Include)
+            .Select(product => (product.Name, product.Destination));
+        RuntimeAssetPublication.AddEntries(entries,
+            Path.Combine(_installation.WorkspaceDirectory, "runtime", "assets"),
+            Path.Combine(scratchRoot, "runtime-asset-repair"), products, expectedFingerprint,
+            "repair", _reporter.Diagnostic, cancellationToken);
+
+        cancellationToken.ThrowIfCancellationRequested();
+        var sourceAfter = ToolkitFingerprint.ComputeRuntimeAssets(_installation.Root, cancellationToken);
+        if (!sourceAfter.Equals(sourceFingerprint, StringComparison.Ordinal))
+            throw new IOException("The installed BuildWorkspace runtime assets changed while repair was being prepared.");
+    }
+
+    private InstallState BuildUpdatedInstallState(string toolkitFingerprint,
+        RetroRewindCompileInputs? compileInputs, string? canonicalRetroRewindRoot,
+        RetroWfcPayloadMode? payloadMode = null,
+        RetroWfcPayloadSnapshot? retroWfcPayloadSnapshot = null, string? expectedDolSha256 = null,
+        string? expectedRelSha256 = null)
+    {
+        var state = _installation.ReadInstallState() ?? new InstallState { InstallDir = _installation.Root };
+        state.InstallDir = _installation.Root;
+        state.SchemaVersion = 1;
+
+        if (string.IsNullOrWhiteSpace(state.SetupVersion)) state.SetupVersion = ProductInfo.Version;
+        if (string.IsNullOrWhiteSpace(state.ProductVersion)) state.ProductVersion = state.SetupVersion;
+        if (!string.IsNullOrWhiteSpace(expectedDolSha256)) state.DolSha256 = expectedDolSha256;
+        if (!string.IsNullOrWhiteSpace(expectedRelSha256)) state.RelSha256 = expectedRelSha256;
+        state.RetroRewindInstalled = compileInputs is not null || _installation.HasRetroProduct;
+        if (compileInputs is not null)
+        {
+            state.RetroRewindCodePulSha256 = compileInputs.CodePulSha256;
+            state.RetroRewindCompileInputsSha256 = compileInputs.CompileInputsSha256;
+        }
+        if (canonicalRetroRewindRoot is not null)
+            state.RetroRewindRoot = Path.GetFullPath(canonicalRetroRewindRoot);
+        if (payloadMode is not null)
+        {
+            state.RetroWfcPayloadMode = payloadMode == RetroWfcPayloadMode.Online
+                ? "downloaded"
+                : "skipped";
+            state.RetroWfcPayloadSha256 = payloadMode == RetroWfcPayloadMode.Online
+                ? retroWfcPayloadSnapshot?.Sha256 ?? throw new InvalidDataException(
+                    "The downloaded Retro-WFC payload snapshot is missing.")
+                : "";
+            state.RetroWfcPayloadLength = payloadMode == RetroWfcPayloadMode.Online
+                ? retroWfcPayloadSnapshot!.ByteLength
+                : 0;
+        }
+        else
+        {
+            var retro = _installation.ReadProductFingerprint(_installation.RetroDirectory,
+                toolkitFingerprint);
+            if (retro is not null && !string.IsNullOrWhiteSpace(retro.RetroWfcPayloadMode))
+            {
+                state.RetroWfcPayloadMode = retro.RetroWfcPayloadMode;
+                state.RetroWfcPayloadSha256 = retro.RetroWfcPayloadSha256;
+                state.RetroWfcPayloadLength = retro.RetroWfcPayloadLength;
+            }
+        }
+        return state;
+    }
+
+    internal static (bool Base, bool Retro) FindDesiredInputDrift(Installation installation,
+        string toolkitFingerprint, string? expectedDolSha256, string? expectedRelSha256)
+    {
+        if (string.IsNullOrWhiteSpace(expectedDolSha256) || string.IsNullOrWhiteSpace(expectedRelSha256))
+            return (false, false);
+        return (
+            File.Exists(installation.BaseExecutable) &&
+            !installation.ProductUsesGameInputs(installation.BaseDirectory, toolkitFingerprint,
+                expectedDolSha256, expectedRelSha256),
+            installation.HasRetroProduct &&
+            !installation.ProductUsesGameInputs(installation.RetroDirectory, toolkitFingerprint,
+                expectedDolSha256, expectedRelSha256));
+    }
+
+
+    private void RefreshTranslationAssets(string? expectedDolSha256, string? expectedRelSha256,
+        CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrWhiteSpace(expectedDolSha256) && string.IsNullOrWhiteSpace(expectedRelSha256))
+        {
+            var state = _installation.ReadInstallState();
+            expectedDolSha256 = state is { SchemaVersion: 1 } ? state.DolSha256 : null;
+            expectedRelSha256 = state is { SchemaVersion: 1 } ? state.RelSha256 : null;
+        }
+        if (string.IsNullOrWhiteSpace(expectedDolSha256) || string.IsNullOrWhiteSpace(expectedRelSha256))
+            throw new InvalidDataException(
+                "The installed game-input provenance is missing or unsupported. Apply the current setup with the disc image.");
+
+        Directory.CreateDirectory(_installation.WorkspaceAssetsDirectory);
+        foreach (var (name, source, expectedSha256) in new[]
+                 {
+                     ("main.dol", Path.Combine(_installation.GameDataDirectory, "sys", "main.dol"), expectedDolSha256),
+                     ("StaticR.rel", Path.Combine(_installation.GameDataDirectory, "files", "rel", "StaticR.rel"),
+                         expectedRelSha256)
+                 })
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            if (!File.Exists(source))
+                throw new InvalidDataException(
+                    $"The installed Mario Kart Wii {name} is missing. Apply setup again with the disc image.");
+            if (!InputValidation.Sha256File(source).Equals(expectedSha256, StringComparison.OrdinalIgnoreCase))
+                throw new InvalidDataException(
+                    $"The installed Mario Kart Wii {name} does not match its recorded clean-disc identity. " +
+                    "Apply the current setup with the disc image.");
+
+            var workspaceInput = Path.Combine(_installation.WorkspaceAssetsDirectory, name);
+            if (File.Exists(workspaceInput) &&
+                InputValidation.Sha256File(workspaceInput)
+                    .Equals(expectedSha256, StringComparison.OrdinalIgnoreCase))
+                continue;
+            File.Copy(source, workspaceInput, overwrite: true);
+        }
+    }
+
+    private (string DolSha, string RelSha) TranslationInputHashes() =>
+        (InputValidation.Sha256File(Path.Combine(_installation.WorkspaceAssetsDirectory, "main.dol")),
+            InputValidation.Sha256File(Path.Combine(_installation.WorkspaceAssetsDirectory, "StaticR.rel")));
+
+    private static void PreserveProductConfig(string currentProduct, string preparedProduct)
+    {
+        var config = Path.Combine(currentProduct, "config");
+        if (Directory.Exists(config))
+            FileSystemUtilities.CopyDirectory(config, Path.Combine(preparedProduct, "config"));
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/Program.cs b/Launcher/WiiCompiled.Setup/Program.cs
new file mode 100644
index 0000000..7863336
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/Program.cs
@@ -0,0 +1,136 @@
+namespace WiiCompiled.Setup;
+
+using System.Runtime.InteropServices;
+
+internal static class Program
+{
+    private static int Main(string[] args)
+    {
+        var progressJson = CommandLine.WantsProgressJson(args);
+
+        try
+        {
+            PlatformChecks.EnsureSupportedHost();
+
+            if (args.Length == 0 && GetConsoleProcessList(new uint[1], 1) == 1)
+            {
+                Console.Out.WriteLine(
+                    "Mario Kart WiiCompiled is installed through Wheel Wizard - download it from " +
+                    "https://github.com/TeamWheelWizard/WheelWizard");
+                Console.ReadKey(intercept: true);
+                return 0;
+            }
+
+            CommandLine command;
+            try
+            {
+                command = CommandLine.Parse(args);
+            }
+            catch (ArgumentException ex) when (args.Length > 0)
+            {
+                // A command line was supplied, so a caller is driving this process. Rejecting the
+                // command with a modal dialog would hang that caller forever.
+                if (progressJson) new NdjsonInstallReporter().Failure(ex.Message);
+                else Console.Error.WriteLine(ex.Message);
+                return 1;
+            }
+
+            if (command.Mode == AppMode.Version)
+                return ConsoleCommands.Version();
+
+            if (command.Mode == AppMode.Help)
+                return ConsoleCommands.Help();
+
+            if (command.Mode == AppMode.SelfTest)
+                return SelfTests.Run();
+
+            if (command.Mode == AppMode.VerifyInputs)
+                return ConsoleCommands.VerifyInputs(command);
+
+            if (command.Mode == AppMode.EmitPayloadIdentities)
+                return ConsoleCommands.EmitPayloadIdentities(command);
+
+            if (command.Mode == AppMode.CheckProducts)
+            {
+                using var cancellationSignal = CancellationSignal.ObserveEnvironment();
+                return ConsoleCommands.CheckProducts(command, cancellationSignal.Token);
+            }
+
+            if (command.Mode is AppMode.LaunchBase or AppMode.LaunchRetro)
+                return GameLaunchService.LaunchAsync(
+                    command.Mode == AppMode.LaunchBase ? BuildProfile.Base : BuildProfile.RetroRewind)
+                    .GetAwaiter().GetResult();
+
+            if (command.Mode is AppMode.SilentInstall or AppMode.RepairProducts)
+            {
+                using var cancellationSignal = CancellationSignal.ObserveEnvironment();
+                return command.Mode == AppMode.SilentInstall
+                    ? ConsoleCommands.Install(command, cancellationSignal.Token).GetAwaiter().GetResult()
+                    : ConsoleCommands.RepairProducts(command, cancellationSignal.Token)
+                        .GetAwaiter().GetResult();
+            }
+
+            if (command.Mode is AppMode.Uninstall or AppMode.SilentUninstall)
+            {
+                UninstallService.StartWorker(command.InstallDirectory!,
+                    quiet: command.Mode == AppMode.SilentUninstall || command.Quiet);
+                return 0;
+            }
+
+            if (command.Mode == AppMode.UninstallWorker)
+                return UninstallService.RunWorker(command.InstallDirectory!, command.Quiet);
+
+            return ConsoleCommands.Help();
+        }
+        catch (Exception ex)
+        {
+            // A caller reading the NDJSON protocol must always receive a terminal result line, even
+            // when the failure happened before the installer was reached (a bad command line, for
+            // instance). ConsoleCommands already reports its own failures, so this only fires for
+            // errors raised outside it.
+            if (progressJson)
+            {
+                new NdjsonInstallReporter().Failure(ex.Message);
+                Console.Error.WriteLine(ex);
+            }
+            else
+            {
+                Console.Error.WriteLine(ex);
+            }
+            return 1;
+        }
+    }
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern uint GetConsoleProcessList(
+        [Out] uint[] processList,
+        uint processCount);
+}
+
+internal static class PlatformChecks
+{
+    public static void EnsureSupportedHost()
+    {
+        if (!OperatingSystem.IsWindows() || !Environment.Is64BitOperatingSystem)
+            throw new PlatformNotSupportedException("WiiCompiled requires 64-bit Windows.");
+        if (!OperatingSystem.IsWindowsVersionAtLeast(10, 0, 18362))
+            throw new PlatformNotSupportedException("WiiCompiled requires Windows 10 version 1903 or newer.");
+    }
+}
+
+internal static class ProductInfo
+{
+    public const string Name = "WiiCompiled";
+    public const string Version = "0.2.13";
+
+    /// <summary>
+    /// The setup executable is copied into the installation under this name. It is the launcher and
+    /// launch entry point named by the Wheel Wizard contract, so the name is part of that interface.
+    /// </summary>
+    public const string SetupCopyName = "WiiCompiled-Setup.exe";
+
+    public const string UninstallKey = @"Software\Microsoft\Windows\CurrentVersion\Uninstall\WiiCompiled";
+    public static string DefaultInstallDirectory =>
+        Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+            "Programs", "WiiCompiled");
+}
diff --git a/Launcher/WiiCompiled.Setup/RetroRewindSource.cs b/Launcher/WiiCompiled.Setup/RetroRewindSource.cs
new file mode 100644
index 0000000..75ea9b8
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/RetroRewindSource.cs
@@ -0,0 +1,59 @@
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// Resolves the one canonical Retro Rewind install. Wheel Wizard owns and passes it as
+/// <c>--retro-dir</c>; the backend only resolves, reads, and records it, never packages or copies it.
+/// </summary>
+internal static class RetroRewindSource
+{
+    /// <summary>
+    /// Resolves the <c>RetroRewind6</c> folder from a selection that may be the folder itself or a
+    /// parent containing exactly one <c>RetroRewind6/Binaries/Code.pul</c>.
+    /// </summary>
+    internal static string ResolveRetroRewind6(string selected)
+    {
+        if (string.IsNullOrWhiteSpace(selected))
+            throw new InvalidDataException("Choose the canonical Retro Rewind folder.");
+        var root = Path.GetFullPath(selected);
+        if (!Directory.Exists(root))
+            throw new DirectoryNotFoundException($"The Retro Rewind folder does not exist: {root}");
+
+        var candidates = new List<string> { root, Path.Combine(root, "RetroRewind6") };
+        // A folder produced by unpacking the published distribution keeps an extra wrapper directory.
+        foreach (var child in Directory.EnumerateDirectories(root))
+            candidates.Add(Path.Combine(child, "RetroRewind6"));
+
+        var matches = candidates
+            .Where(candidate => File.Exists(Path.Combine(candidate, "Binaries", "Code.pul")))
+            .Select(Path.GetFullPath)
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToList();
+
+        return matches.Count switch
+        {
+            1 => ResolveFinalDirectory(matches[0]),
+            0 => throw new InvalidDataException(
+                $"{root} does not contain RetroRewind6\\Binaries\\Code.pul. " +
+                "Select the canonical Retro Rewind folder, or the folder that contains it."),
+            _ => throw new InvalidDataException(
+                $"{root} contains more than one RetroRewind6\\Binaries\\Code.pul. " +
+                "Select the exact Retro Rewind folder to use.")
+        };
+    }
+
+    /// <summary>
+    /// Must resolve a junction/symlink RetroRewind6 to its real directory before fingerprinting: the
+    /// compile-input identity records on-disk kind, and a snapshot copy is always a real directory, so an
+    /// unresolved link can never match its own copy and installs fail forever with a misleading error.
+    /// </summary>
+    private static string ResolveFinalDirectory(string path)
+    {
+        var directory = new DirectoryInfo(path);
+        if (directory.LinkTarget is null)
+            return path;
+        var target = directory.ResolveLinkTarget(returnFinalTarget: true)?.FullName;
+        if (target is null || !Directory.Exists(target))
+            throw new InvalidDataException($"The Retro Rewind folder is a link to a missing target: {path}");
+        return target;
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/RuntimeAssetPublication.cs b/Launcher/WiiCompiled.Setup/RuntimeAssetPublication.cs
new file mode 100644
index 0000000..beb4186
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/RuntimeAssetPublication.cs
@@ -0,0 +1,46 @@
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// The one path by which a product receives its copied runtime assets, shared by install and repair.
+/// Each product gets its own moved (not copied) entry, re-verified against the authoritative identity
+/// in case the source changed mid-preparation.
+/// </summary>
+internal static class RuntimeAssetPublication
+{
+    public static void AddEntries(List<InstallTransactionEntry> entries, string sourceAssets,
+        string preparedRoot, IEnumerable<(string Name, string Destination)> products,
+        string expectedFingerprint, string operationDescription, Action<string> diagnostic,
+        CancellationToken cancellationToken)
+    {
+        foreach (var (name, destination) in products)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            var preparedProduct = Path.Combine(preparedRoot, name);
+            Directory.CreateDirectory(preparedProduct);
+            FileSystemUtilities.CopyDirectory(
+                Path.Combine(sourceAssets, ProductRuntimeAssets.SourceBootstrapDirectoryName),
+                Path.Combine(preparedProduct, ProductRuntimeAssets.ProductBootstrapDirectoryName),
+                cancellationToken);
+            foreach (var (relativePath, fileName) in ProductRuntimeAssets.Files)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                File.Copy(ProductRuntimeAssets.SourceFile(sourceAssets, relativePath),
+                    Path.Combine(preparedProduct, fileName));
+            }
+
+            if (!ToolkitFingerprint.ProductRuntimeAssetsMatch(preparedProduct, expectedFingerprint,
+                    cancellationToken, diagnostic))
+            {
+                throw new IOException(
+                    $"A copied product runtime asset changed while {operationDescription} was being prepared.");
+            }
+
+            entries.Add(InstallTransactionEntry.Directory(
+                Path.Combine(preparedProduct, ProductRuntimeAssets.ProductBootstrapDirectoryName),
+                Path.Combine(destination, ProductRuntimeAssets.ProductBootstrapDirectoryName)));
+            foreach (var (_, fileName) in ProductRuntimeAssets.Files)
+                entries.Add(InstallTransactionEntry.File(Path.Combine(preparedProduct, fileName),
+                    Path.Combine(destination, fileName)));
+        }
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/RuntimeConfiguration.cs b/Launcher/WiiCompiled.Setup/RuntimeConfiguration.cs
new file mode 100644
index 0000000..cc7a546
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/RuntimeConfiguration.cs
@@ -0,0 +1,296 @@
+using System.Globalization;
+using System.Text;
+
+namespace WiiCompiled.Setup;
+
+internal sealed record RuntimeConfigSnapshot(bool Existed, byte[] Contents);
+
+/// <summary>
+/// Reads and writes the runtime's <c>Config.toml</c>. Every entry point takes the file it operates on
+/// since its location depends on the installation (portable <c>UserData</c> vs. per-user app data);
+/// callers obtain it once via <see cref="ResolveConfigPath"/>.
+/// </summary>
+internal static class RuntimeConfiguration
+{
+    public const string ConfigFileName = "Config.toml";
+
+    /// <summary>
+    /// Ordinal, matching the runtime parser/writer (<c>runtime_config.h</c>) exactly. Case-insensitive
+    /// matching here would let setup rewrite a <c>[Paths]</c>/<c>Dvd_Root</c> spelling the runtime ignores.
+    /// </summary>
+    private const StringComparison KeyComparison = StringComparison.Ordinal;
+
+    /// <summary>The per-user configuration an ordinary (non-portable) installation shares.</summary>
+    public static string ApplicationDataConfigPath => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+        "WiiCompiled", ConfigFileName);
+
+    /// <summary>
+    /// The configuration file that governs <paramref name="installDirectory"/>. This mirrors
+    /// <c>RuntimeConfigFile::ResolveConfigPath</c> in the runtime: portable roots win, everything
+    /// else is per-user application data.
+    /// </summary>
+    public static string ResolveConfigPath(string? installDirectory)
+    {
+        if (!string.IsNullOrWhiteSpace(installDirectory) &&
+            PortableRoot.TryFind(installDirectory) is { } portableRoot)
+            return Path.Combine(PortableRoot.UserDataDirectory(portableRoot), ConfigFileName);
+        return ApplicationDataConfigPath;
+    }
+
+    public static RuntimeConfigSnapshot Capture(string configPath) =>
+        File.Exists(configPath)
+            ? new RuntimeConfigSnapshot(true, File.ReadAllBytes(configPath))
+            : new RuntimeConfigSnapshot(false, []);
+
+    public static void Restore(string configPath, RuntimeConfigSnapshot snapshot)
+    {
+        if (snapshot.Existed)
+            FileSystemUtilities.WriteAtomic(configPath, snapshot.Contents);
+        else
+            File.Delete(configPath);
+    }
+
+    internal static void SetDvdRoot(string configPath, string dvdRoot) =>
+        SetPath(configPath, "dvd_root", dvdRoot);
+
+    /// <summary>
+    /// Records the one canonical Retro Rewind installation Wheel Wizard owns. The runtime builds its
+    /// asset overlay by scanning this directory live at launch, so an asset-only Retro Rewind update
+    /// needs no backend work: the next launch simply reads the new files.
+    /// </summary>
+    internal static void SetRetroRewindRoot(string configPath, string retroRewindRoot) =>
+        SetPath(configPath, "retro_rewind_root", retroRewindRoot);
+
+    /// <summary>The canonical Retro Rewind root, or null when no installation has recorded one.</summary>
+    public static string? GetRetroRewindRoot(string configPath) =>
+        GetResolvedPath(configPath, "retro_rewind_root");
+
+    internal static void RemoveRetroRewindRootIfOwned(string configPath, string retroRewindRoot) =>
+        RemovePathIfOwned(configPath, "retro_rewind_root", retroRewindRoot);
+
+    internal static void RemoveDvdRootIfOwned(string configPath, string dvdRoot) =>
+        RemovePathIfOwned(configPath, "dvd_root", dvdRoot);
+
+    /// <summary>The raw stored text of a <c>[paths]</c> key, exactly as the file holds it.</summary>
+    internal static string? GetPath(string configPath, string key) =>
+        TryUnquoteToml(GetRawValue(configPath, "paths", key) ?? "", out var value) ? value : null;
+
+    /// <summary>
+    /// A <c>[paths]</c> value as the runtime will actually use it. The runtime resolves every relative
+    /// <c>[paths]</c> value against the directory holding <c>Config.toml</c> (never the working
+    /// directory), so the host must resolve it the same way before comparing or reading it.
+    /// </summary>
+    internal static string? GetResolvedPath(string configPath, string key)
+    {
+        var stored = GetPath(configPath, key);
+        return string.IsNullOrWhiteSpace(stored) ? null : ResolveAgainstConfig(configPath, stored);
+    }
+
+    internal static string ConfigDirectory(string configPath) =>
+        Path.GetDirectoryName(Path.GetFullPath(configPath))
+        ?? throw new InvalidOperationException($"{configPath} has no containing directory.");
+
+    internal static string ResolveAgainstConfig(string configPath, string value) =>
+        Path.GetFullPath(value, ConfigDirectory(configPath));
+
+    private static void SetPath(string configPath, string key, string value)
+    {
+        var lines = ReadLinesOrDefault(configPath);
+        SetSectionValue(lines, "paths", key, QuoteToml(FormatPathValue(configPath, value)));
+        WriteLines(configPath, lines);
+    }
+
+    /// <summary>
+    /// Paths inside the portable root are stored relative to the config directory (forward slashes,
+    /// needing no TOML escaping) so the tree keeps working if the user moves or renames the root.
+    /// Everything else, including all non-portable paths, is stored absolute.
+    /// </summary>
+    private static string FormatPathValue(string configPath, string value)
+    {
+        var full = Path.GetFullPath(value);
+        var configDirectory = ConfigDirectory(configPath);
+        if (PortableRoot.TryFind(configDirectory) is not { } root || !PortableRoot.Contains(root, full))
+            return full;
+        var relative = Path.GetRelativePath(configDirectory, full);
+        return Path.IsPathRooted(relative)
+            ? full
+            : relative.Replace(Path.DirectorySeparatorChar, '/');
+    }
+
+    private static void RemovePathIfOwned(string configPath, string key, string expectedValue)
+    {
+        if (!File.Exists(configPath)) return;
+        var lines = File.ReadAllLines(configPath).ToList();
+        var inPaths = false;
+        var changed = false;
+        for (var index = 0; index < lines.Count; index++)
+        {
+            var trimmed = RemoveComment(lines[index]).Trim();
+            if (IsSection(trimmed))
+            {
+                inPaths = trimmed.Equals("[paths]", KeyComparison);
+                continue;
+            }
+            if (!inPaths || trimmed.Length == 0) continue;
+            var equals = trimmed.IndexOf('=');
+            if (equals < 0 || !trimmed[..equals].Trim().Equals(key, KeyComparison))
+                continue;
+            if (!TryUnquoteToml(trimmed[(equals + 1)..].Trim(), out var configured)) return;
+            // A portable installation stores this relative, so ownership is decided on the path the
+            // runtime would actually resolve, not on the stored text.
+            if (!ResolveAgainstConfig(configPath, configured)
+                    .Equals(Path.GetFullPath(expectedValue), StringComparison.OrdinalIgnoreCase))
+                return;
+            lines.RemoveAt(index);
+            changed = true;
+            break;
+        }
+        if (changed) WriteLines(configPath, lines);
+    }
+
+    /// <summary>The raw TOML literal stored for a key, or null when the section or key is absent.</summary>
+    internal static string? GetRawValue(string configPath, string section, string key)
+    {
+        if (!File.Exists(configPath)) return null;
+        var header = $"[{section}]";
+        var inSection = false;
+        foreach (var line in File.ReadLines(configPath))
+        {
+            var trimmed = RemoveComment(line).Trim();
+            if (IsSection(trimmed))
+            {
+                inSection = trimmed.Equals(header, KeyComparison);
+                continue;
+            }
+            if (!inSection || trimmed.Length == 0) continue;
+            var equals = trimmed.IndexOf('=');
+            if (equals < 0 || !trimmed[..equals].Trim().Equals(key, KeyComparison)) continue;
+            return trimmed[(equals + 1)..].Trim();
+        }
+        return null;
+    }
+
+    /// <summary>
+    /// Replaces one key in one section, preserving comments, ordering, and every unrelated setting -
+    /// this file belongs to the user and to the in-game settings bar as much as to setup. A
+    /// commented-out key is deliberately not matched, matching the runtime's own writer.
+    /// </summary>
+    private static void SetSectionValue(List<string> lines, string section, string key, string value)
+    {
+        var header = $"[{section}]";
+        var sectionStart = -1;
+        var sectionEnd = lines.Count;
+        for (var index = 0; index < lines.Count; index++)
+        {
+            var trimmed = RemoveComment(lines[index]).Trim();
+            if (!IsSection(trimmed)) continue;
+            if (sectionStart >= 0)
+            {
+                sectionEnd = index;
+                break;
+            }
+            if (trimmed.Equals(header, KeyComparison)) sectionStart = index;
+        }
+        if (sectionStart < 0)
+        {
+            if (lines.Count > 0 && lines[^1].Length != 0) lines.Add("");
+            lines.Add(header);
+            lines.Add($"{key} = {value}");
+            return;
+        }
+
+        for (var index = sectionStart + 1; index < sectionEnd; index++)
+        {
+            var trimmed = RemoveComment(lines[index]).Trim();
+            if (trimmed.Length == 0) continue;
+            var equals = trimmed.IndexOf('=');
+            if (equals >= 0 && trimmed[..equals].Trim().Equals(key, KeyComparison))
+            {
+                lines[index] = $"{key} = {value}";
+                return;
+            }
+        }
+
+        // Append after the section's last real line, not after the blank line that separates it from
+        // the next header, so a generated file stays readable for the user who also edits it by hand.
+        var insertAt = sectionEnd;
+        while (insertAt > sectionStart + 1 && lines[insertAt - 1].Trim().Length == 0) insertAt--;
+        lines.Insert(insertAt, $"{key} = {value}");
+    }
+
+    private static List<string> ReadLinesOrDefault(string configPath) =>
+        File.Exists(configPath) ? File.ReadAllLines(configPath).ToList() : DefaultConfigLines();
+
+    private static void WriteLines(string configPath, List<string> lines) =>
+        FileSystemUtilities.WriteAtomic(configPath,
+            Encoding.UTF8.GetBytes(string.Join(Environment.NewLine, lines) + Environment.NewLine));
+
+    private static List<string> DefaultConfigLines() =>
+    [
+        "# WiiCompiled user configuration",
+        "",
+        "[paths]"
+    ];
+
+    private static bool IsSection(string value) =>
+        value.Length >= 2 && value[0] == '[' && value[^1] == ']';
+
+    /// <summary>
+    /// Line-for-line port of <c>RemoveComment</c> in <c>runtime_config.h</c>, including its backslash
+    /// escaping inside basic strings: without it a Windows path ending in <c>\\"</c> reads as
+    /// re-opening the quote, and the two implementations disagree about which <c>#</c> starts a comment.
+    /// </summary>
+    private static string RemoveComment(string line)
+    {
+        var inSingle = false;
+        var inDouble = false;
+        var escaped = false;
+        for (var index = 0; index < line.Length; index++)
+        {
+            var character = line[index];
+            if (inDouble && character == '\\' && !escaped)
+            {
+                escaped = true;
+                continue;
+            }
+            if (character == '\'' && !inDouble) inSingle = !inSingle;
+            else if (character == '"' && !inSingle && !escaped) inDouble = !inDouble;
+            else if (character == '#' && !inSingle && !inDouble) return line[..index];
+            escaped = false;
+        }
+        return line;
+    }
+
+    private static string QuoteToml(string value) =>
+        "\"" + value.Replace("\\", "\\\\").Replace("\"", "\\\"") + "\"";
+
+    internal static bool TryUnquoteToml(string value, out string result)
+    {
+        result = "";
+        if (value.Length < 2) return false;
+        // Literal strings carry no escapes; the runtime's parser treats them the same way.
+        if (value[0] == '\'' && value[^1] == '\'')
+        {
+            result = value[1..^1];
+            return true;
+        }
+        if (value[0] != '"' || value[^1] != '"') return false;
+        var builder = new StringBuilder(value.Length - 2);
+        for (var index = 1; index < value.Length - 1; index++)
+        {
+            if (value[index] == '\\' && index + 1 < value.Length - 1)
+            {
+                var escaped = value[++index];
+                builder.Append(escaped switch { '\\' => '\\', '"' => '"', _ => escaped });
+            }
+            else
+            {
+                builder.Append(value[index]);
+            }
+        }
+        result = builder.ToString();
+        return true;
+    }
+
+}
diff --git a/Launcher/WiiCompiled.Setup/SelfTests.cs b/Launcher/WiiCompiled.Setup/SelfTests.cs
new file mode 100644
index 0000000..cb54093
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/SelfTests.cs
@@ -0,0 +1,1494 @@
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+
+namespace WiiCompiled.Setup;
+
+internal static class SelfTests
+{
+    public static int Run()
+    {
+        var failures = new List<string>();
+        Test("ISO extension", () => TestAcceptedExtension(".iso"), failures);
+        Test("GCM extension", () => TestAcceptedExtension(".gcm"), failures);
+        Test("GCZ extension", () => TestAcceptedExtension(".gcz"), failures);
+        Test("CISO extension", () => TestAcceptedExtension(".ciso"), failures);
+        Test("WBFS extension", () => TestAcceptedExtension(".wbfs"), failures);
+        Test("WIA extension", () => TestAcceptedExtension(".wia"), failures);
+        Test("RVZ extension", () => TestAcceptedExtension(".RVZ"), failures);
+        Test("Unsupported extension", () =>
+        {
+            var path = Path.Combine(Path.GetTempPath(), Guid.NewGuid() + ".nfs");
+            File.WriteAllBytes(path, [0]);
+            try
+            {
+                try { InputValidation.ValidateExtension(path); throw new Exception("NFS was accepted."); }
+                catch (InvalidDataException) { }
+            }
+            finally { File.Delete(path); }
+        }, failures);
+        Test("Disc compatibility", () =>
+            InputValidation.EnsureCompatibleDisc(new DiscHeader { GameId = "RMCP01" },
+                new PayloadManifest { ExpectedGameId = "RMCP01" }), failures);
+        Test("Disc rejection", () =>
+        {
+            try
+            {
+                InputValidation.EnsureCompatibleDisc(new DiscHeader { GameId = "RMCJ01" },
+                    new PayloadManifest { ExpectedGameId = "RMCP01" });
+                throw new Exception("Wrong region was accepted.");
+            }
+            catch (InvalidDataException) { }
+        }, failures);
+        Test("Payload timestamp normalization", TestPayloadTimestampNormalization, failures);
+        Test("Workspace timestamp reconciliation", TestWorkspaceTimestampReconciliation, failures);
+        Test("Toolkit accompanies the workspace", TestToolkitRefreshDecision, failures);
+        Test("Retro-WFC payload snapshot reconciliation", TestRetroWfcPayloadSnapshotReconciliation, failures);
+        Test("Retro-WFC transient retry policy", TestRetroWfcTransientRetryPolicy, failures);
+        Test("Shared runtime configuration", () => TestPathSettingRoundTrip("dvd_root",
+            RuntimeConfiguration.SetDvdRoot, RuntimeConfiguration.RemoveDvdRootIfOwned), failures);
+        Test("Canonical Retro Rewind configuration", () => TestPathSettingRoundTrip("retro_rewind_root",
+            RuntimeConfiguration.SetRetroRewindRoot, RuntimeConfiguration.RemoveRetroRewindRootIfOwned),
+            failures);
+        Test("Runtime configuration key matching", TestRuntimeConfigurationKeyMatching, failures);
+        Test("Install location validation", TestInstallLocationValidation, failures);
+        Test("Command line contract", TestCommandLineContract, failures);
+        Test("Portable root discovery", TestPortableRootDiscovery, failures);
+        Test("Portable install validation failure leaves no marker",
+            TestPortableValidationFailureLeavesNoMarker, failures);
+        Test("Portable configuration path resolution", TestPortableConfigPathResolution, failures);
+        Test("Portable relative path settings", TestPortableRelativePathSettings, failures);
+        Test("Portable move healing", TestPortableMoveHealing, failures);
+        Test("Install transaction rollback", TestInstallTransactionRollback, failures);
+        Test("Install scratch recovery", TestInstallScratchRecovery, failures);
+        Test("Shortcut cleanup is best effort", TestShortcutCleanupIsBestEffort, failures);
+        Test("Canonical Retro Rewind resolution", TestCanonicalRetroRewindResolution, failures);
+        Test("Retro Rewind compile-inputs golden vector",
+            TestCompileInputsFingerprintGoldenVector, failures);
+        Test("Retro Rewind compile-inputs fingerprint", TestCompileInputsFingerprint, failures);
+        Test("Retro Rewind compile-inputs snapshot", TestCompileInputsSnapshot, failures);
+        Test("Toolkit fingerprint", TestToolkitFingerprint, failures);
+        Test("Retro Rewind inspection state machine", TestCodePulStateMachine, failures);
+        Test("Products report contract", TestProductsReport, failures);
+        foreach (var failure in failures) Console.Error.WriteLine("FAILED " + failure);
+        return failures.Count == 0 ? 0 : 1;
+    }
+
+    private static void TestAcceptedExtension(string extension)
+    {
+        var path = Path.Combine(Path.GetTempPath(), Guid.NewGuid() + extension);
+        File.WriteAllBytes(path, [0]);
+        try { InputValidation.ValidateExtension(path); } finally { File.Delete(path); }
+    }
+
+    private static void TestPayloadTimestampNormalization()
+    {
+        var path = Path.Combine(Path.GetTempPath(), "mkwc-timestamp-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            File.WriteAllText(path, "timestamp");
+            File.SetLastWriteTimeUtc(path, DateTime.UtcNow.AddDays(1));
+            PayloadArchive.NormalizeExtractedTimestamp(path);
+            if (File.GetLastWriteTimeUtc(path).Year != 2000)
+                throw new Exception("Extracted payload timestamps were not normalized.");
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+
+    private static void TestWorkspaceTimestampReconciliation()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-wsstamp-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var installed = Path.Combine(root, "Install", "BuildWorkspace");
+            var staged = Path.Combine(root, "staging", "BuildWorkspace");
+            Directory.CreateDirectory(Path.Combine(installed, "runtime", "src"));
+            Directory.CreateDirectory(Path.Combine(staged, "runtime", "src"));
+            File.WriteAllText(Path.Combine(installed, "runtime", "src", "same.cpp"), "int same();");
+            File.WriteAllText(Path.Combine(staged, "runtime", "src", "same.cpp"), "int same();");
+            File.WriteAllText(Path.Combine(installed, "runtime", "src", "edited.cpp"), "int old();");
+            File.WriteAllText(Path.Combine(staged, "runtime", "src", "edited.cpp"), "int new_();");
+            File.WriteAllText(Path.Combine(staged, "runtime", "src", "added.cpp"), "int added();");
+            foreach (var file in Directory.EnumerateFiles(staged, "*", SearchOption.AllDirectories))
+                PayloadArchive.NormalizeExtractedTimestamp(file);
+
+            WorkspaceTimestamps.MarkChangedFiles(installed, staged, _ => { });
+
+            if (File.GetLastWriteTimeUtc(Path.Combine(staged, "runtime", "src", "same.cpp")).Year != 2000)
+                throw new Exception("An unchanged workspace file lost its normalized timestamp.");
+            if (File.GetLastWriteTimeUtc(Path.Combine(staged, "runtime", "src", "edited.cpp")).Year == 2000)
+                throw new Exception("A changed workspace file kept its normalized timestamp; " +
+                                    "Ninja would never recompile it.");
+            if (File.GetLastWriteTimeUtc(Path.Combine(staged, "runtime", "src", "added.cpp")).Year == 2000)
+                throw new Exception("A new workspace file kept its normalized timestamp.");
+
+            // A fresh installation has no workspace to compare against; the pass must be a no-op.
+            WorkspaceTimestamps.MarkChangedFiles(Path.Combine(root, "absent"), staged, _ => { });
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// The translator and the project file it parses must never come from different releases. The
+    /// first case is the v0.2.5 regression: a compile-identity change republished the workspace
+    /// while an unchanged package identity retained the older toolkit.
+    /// </summary>
+    private static void TestToolkitRefreshDecision()
+    {
+        if (!InstallerEngine.MustRefreshToolkit(sameToolkit: false, samePackageContent: true,
+                dolphinToolPresent: true))
+            throw new Exception("A republished workspace kept the installed toolkit; the shipped " +
+                                "translator and project file could come from different releases.");
+        if (!InstallerEngine.MustRefreshToolkit(sameToolkit: true, samePackageContent: false,
+                dolphinToolPresent: true))
+            throw new Exception("Changed toolkit package content was not extracted.");
+        if (!InstallerEngine.MustRefreshToolkit(sameToolkit: true, samePackageContent: true,
+                dolphinToolPresent: false))
+            throw new Exception("A missing DolphinTool.exe did not force toolkit extraction.");
+        if (InstallerEngine.MustRefreshToolkit(sameToolkit: true, samePackageContent: true,
+                dolphinToolPresent: true))
+            throw new Exception("An unchanged toolkit was needlessly re-extracted.");
+    }
+
+    /// <summary>
+    /// Every <c>[paths]</c> key follows the same contract: writing preserves other settings, reads
+    /// back resolved, and uninstall removes it only while it still points at the recorded location.
+    /// </summary>
+    private static void TestPathSettingRoundTrip(string key, Action<string, string> set,
+        Action<string, string> removeIfOwned)
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"mkwc-{key}-" + Guid.NewGuid().ToString("N"));
+        var config = Path.Combine(root, "Config.toml");
+        var owned = Path.Combine(root, "Owned Location");
+        try
+        {
+            Directory.CreateDirectory(owned);
+            File.WriteAllText(config,
+                "[video]\nwidescreen = true\n\n[paths]\nunrelated_root = \"D:\\\\Elsewhere\"\n");
+            set(config, owned);
+            var updated = File.ReadAllText(config);
+            if (!updated.Contains("widescreen = true", StringComparison.Ordinal) ||
+                !updated.Contains("unrelated_root = \"D:\\\\Elsewhere\"", StringComparison.Ordinal) ||
+                !updated.Contains(key + " = ", StringComparison.Ordinal))
+                throw new Exception($"Writing {key} discarded existing runtime settings.");
+
+            var read = RuntimeConfiguration.GetResolvedPath(config, key);
+            if (read is null || !read.Equals(Path.GetFullPath(owned), StringComparison.OrdinalIgnoreCase))
+                throw new Exception($"The configured {key} did not round-trip.");
+
+            removeIfOwned(config, Path.Combine(root, "Someone Else"));
+            if (RuntimeConfiguration.GetPath(config, key) is null)
+                throw new Exception($"A {key} owned by someone else was removed.");
+            removeIfOwned(config, owned);
+            if (RuntimeConfiguration.GetPath(config, key) is not null)
+                throw new Exception($"Uninstall did not remove its owned {key} setting.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// TOML keys are case-sensitive and the runtime compares them exactly, so the host must match
+    /// case too, or it silently writes a key the runtime never reads.
+    /// </summary>
+    private static void TestRuntimeConfigurationKeyMatching()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-tomlcase-" + Guid.NewGuid().ToString("N"));
+        var config = Path.Combine(root, RuntimeConfiguration.ConfigFileName);
+        var owned = Path.Combine(root, "Owned Location");
+        try
+        {
+            Directory.CreateDirectory(owned);
+            File.WriteAllText(config, "[Paths]\r\nDvd_Root = \"D:\\\\Wrong\"\r\n");
+            RuntimeConfiguration.SetDvdRoot(config, owned);
+            if (!File.ReadAllText(config).Contains("Dvd_Root = \"D:\\\\Wrong\"", StringComparison.Ordinal))
+                throw new Exception("A differently-cased key the runtime ignores was rewritten.");
+            var written = RuntimeConfiguration.GetResolvedPath(config, "dvd_root");
+            if (written is null || !written.Equals(Path.GetFullPath(owned), StringComparison.OrdinalIgnoreCase))
+                throw new Exception("dvd_root was not written as the exactly-cased key the runtime reads.");
+
+            // An escaped quote does not end the value, so the '#' after it is data rather than the
+            // start of a comment - exactly what RemoveComment in runtime_config.h decides.
+            File.WriteAllText(config, "[paths]\r\ndvd_root = \"a\\\"#b\"\r\n");
+            if (RuntimeConfiguration.GetPath(config, "dvd_root") != "a\"#b")
+                throw new Exception("A '#' inside an escaped quoted value was treated as a comment.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// One location rule set covers both an installation directory and a portable root, so the
+    /// rejections a portable install performs are the ones an ordinary install performs too.
+    /// </summary>
+    private static void TestInstallLocationValidation()
+    {
+        void Rejects(string description, string path)
+        {
+            try
+            {
+                FileSystemUtilities.EnsureUsableLocation(path, "The installation folder");
+                throw new Exception(description + " was accepted as an install location.");
+            }
+            catch (InvalidOperationException) { }
+        }
+
+        FileSystemUtilities.EnsureUsableLocation("C:\\Games\\WiiCompiled\\Install", "The installation folder");
+        Rejects("A network path", "\\\\server\\share\\WiiCompiled");
+        Rejects("An over-long path", "C:\\" + new string('w', 200));
+        Rejects("A drive root", "C:\\");
+        Rejects("A folder inside Windows",
+            Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Windows), "WiiCompiled"));
+        Rejects("The user profile itself",
+            Environment.GetFolderPath(Environment.SpecialFolder.UserProfile));
+        // The two entry points must not have separate opinions about any of the above.
+        foreach (var rejected in new[] { "\\\\server\\share\\WiiCompiled", "C:\\" })
+        {
+            try
+            {
+                PortableRoot.EnsureUsableRoot(rejected);
+                throw new Exception($"{rejected} was accepted as a portable root.");
+            }
+            catch (InvalidOperationException) { }
+        }
+    }
+
+    private static void TestCommandLineContract()
+    {
+        void Rejects(string description, params string[] args)
+        {
+            try
+            {
+                CommandLine.Parse(args);
+                throw new Exception(description + " was accepted.");
+            }
+            catch (ArgumentException) { }
+        }
+
+        var version = CommandLine.Parse(["--version"]);
+        if (version.Mode != AppMode.Version) throw new Exception("--version was not recognised.");
+
+        var silent = CommandLine.Parse([
+            "--silent", "--game", "game.iso", "--install-dir", "C:\\Games\\MKW",
+            "--progress-json", "--retro-dir", "D:\\RetroRewind", "--skip-retro-wfc-payload"
+        ]);
+
+        if (silent.Mode != AppMode.SilentInstall || !silent.ProgressJson ||
+            silent.RetroDirectoryPath != "D:\\RetroRewind" ||
+            silent.RetroWfcPayloadMode != RetroWfcPayloadMode.Skipped)
+            throw new Exception("The silent install contract did not parse.");
+
+        var launch = CommandLine.Parse(["--launch-base"]);
+        if (launch.Mode != AppMode.LaunchBase)
+            throw new Exception("The launch contract did not parse.");
+        Rejects("runtime argument forwarding", "--launch-base", "--", "--windowed");
+
+        if (CommandLine.Parse(["--launch-retro"]).Mode != AppMode.LaunchRetro)
+            throw new Exception("--launch-retro was not recognised.");
+
+        var check = CommandLine.Parse([
+            "--check-products", "--install-dir", "C:\\Games\\MKW", "--retro-dir", "D:\\RetroRewind",
+            "--progress-json"
+        ]);
+        if (check.Mode != AppMode.CheckProducts || check.RetroDirectoryPath != "D:\\RetroRewind" ||
+            check.RetroWfcPayloadMode != RetroWfcPayloadMode.NotApplicable)
+            throw new Exception("The product check contract did not parse.");
+
+        var retroRepair = CommandLine.Parse([
+            "--repair-products", "--install-dir", "C:\\Games\\MKW", "--retro-dir", "D:\\RetroRewind",
+            "--download-retro-wfc-payload", "--progress-json"
+        ]);
+        if (retroRepair.Mode != AppMode.RepairProducts ||
+            retroRepair.RetroDirectoryPath != "D:\\RetroRewind" ||
+            retroRepair.RetroWfcPayloadMode != RetroWfcPayloadMode.Online)
+            throw new Exception("The Retro Rewind repair contract did not parse.");
+
+        Rejects("An unknown Retro Rewind source flag", "--silent", "--game", "g.iso", "--retro-zip",
+            "a.zip", "--skip-retro-wfc-payload");
+        Rejects("--progress-json outside an install", "--launch-base", "--progress-json");
+        // The NAND flag is gone: Wheel Wizard writes paths.nand_root into Config.toml itself.
+        Rejects("The removed NAND flag", "--silent", "--game", "g.iso", "--nand-dir", "D:\\Wii");
+        Rejects("A payload option without the canonical Retro Rewind folder", "--silent", "--game",
+            "g.iso", "--skip-retro-wfc-payload");
+        Rejects("A Retro Rewind folder without a payload decision", "--silent", "--game", "g.iso",
+            "--retro-dir", "b");
+        Rejects("Repair without an installation", "--repair-products", "--retro-dir", "rr",
+            "--skip-retro-wfc-payload", "--progress-json");
+        Rejects("Repair without the canonical Retro Rewind folder", "--repair-products",
+            "--install-dir", "fixed", "--progress-json");
+        Rejects("Retro Rewind repair without a payload decision", "--repair-products", "--install-dir", "fixed",
+            "--retro-dir", "rr", "--progress-json");
+        Rejects("A repair payload option without the canonical folder", "--repair-products",
+            "--install-dir", "fixed", "--skip-retro-wfc-payload", "--progress-json");
+
+        var portable = CommandLine.Parse([
+            "--silent", "--game", "game.iso", "--install-dir", "D:\\Games\\Recomp\\Install",
+            "--portable", "--progress-json"
+        ]);
+        if (portable.Mode != AppMode.SilentInstall || !portable.Portable)
+            throw new Exception("The portable install contract did not parse.");
+
+        Rejects("--portable without an install directory", "--silent", "--game", "g.iso", "--portable");
+        Rejects("--portable outside an install", "--check-products", "--install-dir", "fixed", "--portable");
+        // The config verbs are gone: WheelWizard reads and writes Config.toml directly now.
+        Rejects("The removed configuration read verb", "--get-config");
+        Rejects("The removed configuration write verb", "--set-config", "--install-dir", "fixed");
+        Rejects("A bare setting assignment", "--check-products", "video.show_fps=true");
+    }
+
+    /// <summary>
+    /// The marker walk-up is the one thing both languages must agree on. The depth bound keeps an
+    /// unrelated marker high up a drive from capturing an ordinary installation.
+    /// </summary>
+    private static void TestPortableRootDiscovery()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-portable-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var install = Path.Combine(root, "Install");
+            var deep = Path.Combine(install, "Base", "config", "a", "b", "c");
+            Directory.CreateDirectory(deep);
+
+            if (PortableRoot.TryFind(install) is not null)
+                throw new Exception("A directory without the marker was treated as portable.");
+
+            File.WriteAllText(Path.Combine(root, PortableRoot.MarkerFileName), "portable");
+            if (PortableRoot.TryFind(root) != root)
+                throw new Exception("The marker directory itself was not recognised as the root.");
+            if (PortableRoot.TryFind(install) != root)
+                throw new Exception("The install directory did not resolve to its portable root.");
+            if (PortableRoot.TryFind(Path.Combine(install, "Base", "config", "a")) != root)
+                throw new Exception("A path within the depth bound did not resolve to its portable root.");
+            if (PortableRoot.TryFind(deep) is not null)
+                throw new Exception("The portable search walked further up than its depth bound.");
+
+            if (!PortableRoot.Contains(root, Path.Combine(install, "GameAssets", "DATA")) ||
+                PortableRoot.Contains(root, Path.Combine(Path.GetTempPath(), "elsewhere")))
+                throw new Exception("Portable containment did not classify paths correctly.");
+
+            try
+            {
+                PortableRoot.EnsureUsableRoot(Path.GetPathRoot(root)!);
+                throw new Exception("A drive root was accepted as a portable root.");
+            }
+            catch (InvalidOperationException) { }
+            try
+            {
+                PortableRoot.EnsureUsableRoot(
+                    Environment.GetFolderPath(Environment.SpecialFolder.UserProfile));
+                throw new Exception("A well-known system folder was accepted as a portable root.");
+            }
+            catch (InvalidOperationException) { }
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// A rejected game image must not turn the destination's parent into a portable root. Otherwise
+    /// the marker walk-up would redirect unrelated later installs into this root's UserData.
+    /// </summary>
+    private static void TestPortableValidationFailureLeavesNoMarker()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-portable-rejected-" + Guid.NewGuid().ToString("N"));
+        var game = Path.Combine(root, "not-a-disc-image.wad");
+        try
+        {
+            Directory.CreateDirectory(root);
+            File.WriteAllBytes(game, [0]);
+            var options = new InstallOptions
+            {
+                GamePath = game,
+                InstallDirectory = Path.Combine(root, PortableRoot.InstallDirectoryName),
+                Portable = true
+            };
+
+            try
+            {
+                new InstallerEngine(new DelegatingInstallReporter(_ => { }))
+                    .InstallAsync(options).GetAwaiter().GetResult();
+                throw new Exception("An unsupported game image was accepted.");
+            }
+            catch (InvalidDataException) { }
+
+            if (File.Exists(Path.Combine(root, PortableRoot.MarkerFileName)))
+                throw new Exception("A failed portable install left its marker behind.");
+            if (Directory.Exists(PortableRoot.UserDataDirectory(root)))
+                throw new Exception("A failed portable install left its UserData directory behind.");
+            if (PortableRoot.TryFind(options.InstallDirectory) is not null)
+                throw new Exception("A failed portable install captured later installs under its parent.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static void TestShortcutCleanupIsBestEffort()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-shortcuts-" + Guid.NewGuid().ToString("N"));
+        var desktop = Path.Combine(root, "Desktop");
+        var startMenu = Path.Combine(root, "Start Menu", ProductInfo.Name);
+        try
+        {
+            Directory.CreateDirectory(desktop);
+            // File.Delete cannot delete a directory. This deterministically forces the first cleanup
+            // to fail while the remaining independently guarded targets must still be attempted.
+            Directory.CreateDirectory(Path.Combine(desktop, "WiiCompiled.lnk"));
+            var secondShortcut = Path.Combine(desktop, "Retro Rewind.lnk");
+            File.WriteAllText(secondShortcut, "shortcut");
+            Directory.CreateDirectory(startMenu);
+            File.WriteAllText(Path.Combine(startMenu, "WiiCompiled.lnk"), "shortcut");
+
+            try
+            {
+                ShellIntegration.RemoveAllShortcuts(desktop, startMenu);
+                throw new Exception("A shortcut deletion failure was not reported.");
+            }
+            catch (AggregateException) { }
+
+            if (File.Exists(secondShortcut))
+                throw new Exception("One failed shortcut deletion prevented the next file deletion.");
+            if (Directory.Exists(startMenu))
+                throw new Exception("One failed shortcut deletion prevented Start Menu cleanup.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// The configuration location is a property of the installation, not of this process: an install
+    /// under a portable root uses that root's UserData, everything else the shared per-user file.
+    /// </summary>
+    private static void TestPortableConfigPathResolution()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-portable-config-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var install = Path.Combine(root, "Install");
+            Directory.CreateDirectory(install);
+            if (!RuntimeConfiguration.ResolveConfigPath(install)
+                    .Equals(RuntimeConfiguration.ApplicationDataConfigPath, StringComparison.OrdinalIgnoreCase))
+                throw new Exception("A non-portable installation did not use per-user application data.");
+
+            var created = PortableRoot.Create(root);
+            if (!Directory.Exists(PortableRoot.UserDataDirectory(created)) ||
+                !File.Exists(Path.Combine(created, PortableRoot.MarkerFileName)))
+                throw new Exception("Creating a portable root did not produce its marker and user data.");
+
+            var expected = Path.Combine(root, PortableRoot.UserDataDirectoryName, "Config.toml");
+            if (!RuntimeConfiguration.ResolveConfigPath(install)
+                    .Equals(expected, StringComparison.OrdinalIgnoreCase))
+                throw new Exception("A portable installation did not use its own UserData configuration.");
+            if (!new Installation(install).ConfigPath.Equals(expected, StringComparison.OrdinalIgnoreCase))
+                throw new Exception("The installation did not report its portable configuration path.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// A portable installation stores every path inside its root relative to the configuration
+    /// directory, so the whole tree survives being moved. Ownership decisions must therefore compare
+    /// resolved paths, not stored text.
+    /// </summary>
+    private static void TestPortableRelativePathSettings()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-portable-paths-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            PortableRoot.Create(root);
+            var install = Path.Combine(root, "Install");
+            var config = Path.Combine(root, PortableRoot.UserDataDirectoryName, "Config.toml");
+            var dvdRoot = Path.Combine(install, "GameAssets", "DATA");
+            var outsideRetro = Path.Combine(Path.GetTempPath(), "mkwc-outside-" + Guid.NewGuid().ToString("N"));
+            var insideRetro = Path.Combine(root, "RetroRewind6");
+
+            RuntimeConfiguration.SetDvdRoot(config, dvdRoot);
+            var stored = RuntimeConfiguration.GetPath(config, "dvd_root");
+            if (stored is null || Path.IsPathRooted(stored))
+                throw new Exception("A path inside the portable root was stored absolute.");
+            if (stored.Contains('\\', StringComparison.Ordinal))
+                throw new Exception("A relative path was not stored with the canonical forward slashes.");
+            if (!RuntimeConfiguration.GetResolvedPath(config, "dvd_root")!
+                    .Equals(Path.GetFullPath(dvdRoot), StringComparison.OrdinalIgnoreCase))
+                throw new Exception("A relative dvd_root did not resolve against the configuration directory.");
+
+            RuntimeConfiguration.SetRetroRewindRoot(config, insideRetro);
+            if (Path.IsPathRooted(RuntimeConfiguration.GetPath(config, "retro_rewind_root")!))
+                throw new Exception("A Retro Rewind root inside the portable root was stored absolute.");
+            RuntimeConfiguration.SetRetroRewindRoot(config, outsideRetro);
+            if (!Path.IsPathRooted(RuntimeConfiguration.GetPath(config, "retro_rewind_root")!))
+                throw new Exception("A Retro Rewind root outside the portable root was stored relative.");
+
+            RuntimeConfiguration.RemoveDvdRootIfOwned(config, Path.Combine(install, "Elsewhere"));
+            if (RuntimeConfiguration.GetPath(config, "dvd_root") is null)
+                throw new Exception("A relative dvd_root owned by someone else was removed.");
+            RuntimeConfiguration.RemoveDvdRootIfOwned(config, dvdRoot);
+            if (RuntimeConfiguration.GetPath(config, "dvd_root") is not null)
+                throw new Exception("A relative dvd_root this installation owns was not removed.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// A portable root can be moved. Healing adopts the directory the installation was actually found
+    /// in and discards the location-bound native build cache - and must never touch a non-portable
+    /// installation, where the same disagreement is a real problem to report.
+    /// </summary>
+    private static void TestPortableMoveHealing()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-move-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var install = Path.Combine(root, "Install");
+            var nativeBuild = Path.Combine(install, "BuildWorkspace", "native-build");
+            Directory.CreateDirectory(nativeBuild);
+            File.WriteAllText(Path.Combine(nativeBuild, "CMakeCache.txt"),
+                "CMAKE_HOME_DIRECTORY:INTERNAL=D:/Old/Install/BuildWorkspace/runtime");
+            var statePath = Path.Combine(install, "install-state.json");
+            JsonState.Write(statePath, new InstallState { InstallDir = "D:\\Old\\Install" });
+
+            var plain = new Installation(install);
+            if (PortableInstallHealing.HealMovedInstall(plain))
+                throw new Exception("A non-portable installation was healed.");
+            if (!Directory.Exists(nativeBuild))
+                throw new Exception("A non-portable installation lost its native build directory.");
+
+            PortableRoot.Create(root);
+            var portable = new Installation(install);
+            if (!PortableInstallHealing.HealMovedInstall(portable))
+                throw new Exception("A moved portable installation was not healed.");
+            var healed = portable.ReadInstallState();
+            if (healed is null || !healed.InstallDir.Equals(portable.Root, StringComparison.OrdinalIgnoreCase))
+                throw new Exception("Healing did not adopt the actual installation directory.");
+            if (Directory.Exists(nativeBuild))
+                throw new Exception("Healing kept the location-bound native build cache.");
+
+            if (PortableInstallHealing.HealMovedInstall(portable))
+                throw new Exception("An installation already at its recorded location was healed again.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static void TestCanonicalRetroRewindResolution()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-retro-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var package = Path.Combine(root, "wrapper", "RetroRewind6");
+            Directory.CreateDirectory(Path.Combine(package, "Binaries"));
+            File.WriteAllText(Path.Combine(package, "Binaries", "Code.pul"), "pretend-kamek");
+            File.WriteAllText(Path.Combine(package, "version.txt"), "1.2.3");
+
+            var expected = InputValidation.Sha256File(Path.Combine(package, "Binaries", "Code.pul"));
+            // The canonical folder may be named directly, or reached through the one permitted
+            // wrapper level; all three selections resolve to exactly the same installation.
+            foreach (var selection in new[] { package, Path.Combine(root, "wrapper"), root })
+            {
+                var inputs = CompileInputsFingerprint.Compute(selection);
+                if (!inputs.RetroRewindRoot.Equals(Path.GetFullPath(package),
+                        StringComparison.OrdinalIgnoreCase))
+                    throw new Exception($"Selecting {selection} resolved to {inputs.RetroRewindRoot}.");
+                if (inputs.CodePulSha256 != expected)
+                    throw new Exception($"The Code.pul hash was wrong when selecting {selection}.");
+            }
+
+            try
+            {
+                _ = RetroRewindSource.ResolveRetroRewind6(Path.Combine(package, "Binaries"));
+                throw new Exception("A folder without Code.pul was accepted.");
+            }
+            catch (InvalidDataException) { }
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static void TestRetroWfcPayloadSnapshotReconciliation()
+    {
+        // The endpoint is pinned in exactly one place; this test must not restate it.
+        const string endpoint = InputValidation.CurrentRetroWfcPayloadUri;
+        const string shaB = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-wfc-snapshot-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            InputValidation.ValidateRetroWfcPayloadUri(endpoint);
+            try
+            {
+                InputValidation.ValidateRetroWfcPayloadUri(endpoint + "&extra=1");
+                throw new Exception("A non-canonical Retro-WFC endpoint was accepted.");
+            }
+            catch (InvalidDataException) { }
+
+            var installation = new Installation(root);
+            Directory.CreateDirectory(installation.RetroDirectory);
+            var payloadRoot = Path.Combine(root, "download");
+            var payloadPath = Path.Combine(payloadRoot, "binary", "payload.RMCPD00.bin");
+            Directory.CreateDirectory(Path.GetDirectoryName(payloadPath)!);
+            using var signingRsa = RSA.Create(2048);
+            var signingKey = signingRsa.ExportParameters(includePrivateParameters: false);
+            var bytes = new byte[0x140];
+            "WWFC/Payload"u8.CopyTo(bytes);
+            BinaryPrimitives.WriteUInt32BigEndian(bytes.AsSpan(0x0C), (uint)bytes.Length);
+            bytes[^1] = 0x5A;
+            signingRsa.SignData(bytes.AsSpan(0x110), HashAlgorithmName.SHA256,
+                RSASignaturePadding.Pkcs1).CopyTo(bytes.AsSpan(0x10));
+            File.WriteAllBytes(payloadPath, bytes);
+            _ = InputValidation.ValidateStagedRetroWfcPayloadDirectory(payloadRoot, signingKey);
+            try
+            {
+                _ = InputValidation.ValidateStagedRetroWfcPayloadDirectory(payloadRoot);
+                throw new Exception("A payload signed by a foreign key passed the pinned production key.");
+            }
+            catch (InvalidDataException) { }
+            var shaA = InputValidation.ComputeRetroWfcPayloadSha256(payloadRoot, signingKey);
+            var snapshot = new RetroWfcPayloadSnapshot(payloadRoot, shaA, bytes.Length);
+            JsonState.Write(Path.Combine(installation.RetroDirectory, ProductFingerprint.FileName),
+                new ProductFingerprint
+                {
+                    Profile = "retro-rewind", ToolkitFingerprint = "toolkit",
+                    RetroWfcPayloadMode = "downloaded", RetroWfcPayloadSha256 = shaA,
+                    RetroWfcPayloadLength = bytes.Length
+                });
+            JsonState.Write(installation.InstallStatePath, new InstallState
+            {
+                InstallDir = root, RetroWfcPayloadMode = "downloaded",
+                RetroWfcPayloadSha256 = shaA, RetroWfcPayloadLength = bytes.Length
+            });
+            if (!installation.MatchesRetroWfcPayloadSnapshot("toolkit", snapshot))
+                throw new Exception("The same downloaded payload snapshot did not produce a no-op.");
+            if (ProductRepairService.PlanRetroWfcPayloadReconciliation(productMatchesSnapshot: true,
+                    cacheMatchesSnapshot: true) != ProductRepairService.RetroWfcPayloadAction.None)
+                throw new Exception("The same downloaded snapshot did not remain a no-op.");
+            if (ProductRepairService.PlanRetroWfcPayloadReconciliation(productMatchesSnapshot: true,
+                    cacheMatchesSnapshot: false) !=
+                ProductRepairService.RetroWfcPayloadAction.PublishCacheOnly)
+                throw new Exception("A damaged local payload cache requested an unnecessary recompile.");
+
+            var changedSnapshot = snapshot with { Sha256 = shaB };
+            if (installation.MatchesRetroWfcPayloadSnapshot("toolkit", changedSnapshot))
+                throw new Exception("A changed downloaded payload snapshot did not require recompilation.");
+            if (ProductRepairService.PlanRetroWfcPayloadReconciliation(productMatchesSnapshot: false,
+                    cacheMatchesSnapshot: false) != ProductRepairService.RetroWfcPayloadAction.RebuildRetro)
+                throw new Exception("A changed payload did not rebuild Retro Rewind.");
+
+            bytes[0x0F]++;
+            File.WriteAllBytes(payloadPath, bytes);
+            try
+            {
+                _ = InputValidation.ValidateStagedRetroWfcPayloadDirectory(payloadRoot, signingKey);
+                throw new Exception("A payload with a malformed declared length was accepted.");
+            }
+            catch (InvalidDataException) { }
+
+            bytes[0x0F]--;
+            bytes[^1] ^= 1;
+            File.WriteAllBytes(payloadPath, bytes);
+            try
+            {
+                _ = InputValidation.ValidateStagedRetroWfcPayloadDirectory(payloadRoot, signingKey);
+                throw new Exception("A payload with tampered signed content was accepted.");
+            }
+            catch (InvalidDataException) { }
+
+            bytes[^1] ^= 1;
+            bytes[0] = 0;
+            File.WriteAllBytes(payloadPath, bytes);
+            try
+            {
+                _ = InputValidation.ValidateStagedRetroWfcPayloadDirectory(payloadRoot, signingKey);
+                throw new Exception("A payload with a malformed header was accepted.");
+            }
+            catch (InvalidDataException) { }
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static void TestRetroWfcTransientRetryPolicy()
+    {
+        if (!InputValidation.IsTransientRetroWfcDownloadFailure(
+                new HttpRequestException("Connection reset"), CancellationToken.None))
+            throw new Exception("A transport failure would not receive its one retry.");
+        if (!InputValidation.IsTransientRetroWfcDownloadFailure(
+                new HttpRequestException("Service unavailable", null,
+                    System.Net.HttpStatusCode.ServiceUnavailable), CancellationToken.None))
+            throw new Exception("An HTTP 5xx response would not receive its one retry.");
+        if (!InputValidation.IsTransientRetroWfcDownloadFailure(
+                new TimeoutException("Timed out"), CancellationToken.None))
+            throw new Exception("A download timeout would not receive its one retry.");
+        if (InputValidation.IsTransientRetroWfcDownloadFailure(
+                new HttpRequestException("Not found", null, System.Net.HttpStatusCode.NotFound),
+                CancellationToken.None))
+            throw new Exception("A permanent HTTP 4xx response would be retried.");
+        if (InputValidation.IsTransientRetroWfcDownloadFailure(
+                new InvalidDataException("Malformed payload"), CancellationToken.None))
+            throw new Exception("A malformed payload would be retried.");
+
+        using var cancelled = new CancellationTokenSource();
+        cancelled.Cancel();
+        if (InputValidation.IsTransientRetroWfcDownloadFailure(
+                new TimeoutException("Cancelled"), cancelled.Token))
+            throw new Exception("Caller cancellation would be retried.");
+    }
+
+    private static void TestInstallTransactionRollback()
+    {
+        var parent = Path.Combine(Path.GetTempPath(),
+            "mkwc-transaction-self-test-" + Guid.NewGuid().ToString("N"));
+        var installRoot = Path.Combine(parent, "install");
+        var liveComponent = Path.Combine(installRoot, "Component");
+        var preparedComponent = Path.Combine(parent, "prepared-component");
+        var preparedFile = Path.Combine(parent, "prepared-added.json");
+        var addedFile = Path.Combine(installRoot, "added.json");
+        try
+        {
+            Directory.CreateDirectory(Path.Combine(liveComponent, "nested"));
+            File.WriteAllText(Path.Combine(liveComponent, "nested", "original.txt"), "original-bytes");
+            File.WriteAllText(Path.Combine(installRoot, "untouched.txt"), "untouched-bytes");
+            Directory.CreateDirectory(preparedComponent);
+            File.WriteAllText(Path.Combine(preparedComponent, "replacement.txt"), "replacement-bytes");
+            File.WriteAllText(preparedFile, "new-live-file");
+
+            using (var transaction = InstallTransaction.Begin(installRoot, null,
+                       InstallTransactionEntry.Directory(preparedComponent, liveComponent),
+                       InstallTransactionEntry.File(preparedFile, addedFile)))
+            {
+                transaction.Publish();
+                if (!File.Exists(Path.Combine(liveComponent, "replacement.txt")) ||
+                    File.Exists(Path.Combine(liveComponent, "nested", "original.txt")) ||
+                    File.ReadAllText(addedFile) != "new-live-file")
+                    throw new Exception("The transaction did not publish its prepared replacements.");
+                // Deliberately omit Commit. Dispose must restore the exact pre-transaction tree.
+            }
+
+            var original = Path.Combine(liveComponent, "nested", "original.txt");
+            if (!File.Exists(original) || File.ReadAllText(original) != "original-bytes" ||
+                File.Exists(Path.Combine(liveComponent, "replacement.txt")) || File.Exists(addedFile) ||
+                Directory.Exists(preparedComponent) || File.Exists(preparedFile) ||
+                File.ReadAllText(Path.Combine(installRoot, "untouched.txt")) != "untouched-bytes")
+                throw new Exception("Disposing an uncommitted transaction did not restore the exact original tree.");
+            if (File.Exists(InstallOperationPaths.GetJournalPath(installRoot)))
+                throw new Exception("A rolled-back transaction left its journal behind.");
+        }
+        finally
+        {
+            if (Directory.Exists(parent)) Directory.Delete(parent, recursive: true);
+        }
+    }
+
+    private static void TestInstallScratchRecovery()
+    {
+        var parent = Path.Combine(Path.GetTempPath(),
+            "mkwc-scratch-self-test-" + Guid.NewGuid().ToString("N"));
+        var installRoot = Path.Combine(parent, "install");
+        var otherInstallRoot = Path.Combine(parent, "other-install");
+        InstallScratchSpace? scratch = null;
+        InstallScratchSpace? otherScratch = null;
+        try
+        {
+            Directory.CreateDirectory(installRoot);
+            Directory.CreateDirectory(otherInstallRoot);
+            scratch = InstallScratchSpace.CreateSibling(installRoot);
+            File.WriteAllText(Path.Combine(scratch.Root, "owned.txt"), "owned");
+
+            // Scratch is keyed by the installation's scope id, so a neighbouring installation's
+            // scratch lives beside it under a different prefix and must survive this recovery.
+            otherScratch = InstallScratchSpace.CreateSibling(otherInstallRoot);
+            var sentinel = Path.Combine(otherScratch.Root, "preserve.txt");
+            File.WriteAllText(sentinel, "preserve");
+
+            using (InstallOperationLock.Acquire(installRoot))
+            {
+                if (Directory.Exists(scratch.Root))
+                    throw new Exception("Lock acquisition did not recover this installation's scratch space.");
+                if (!File.Exists(sentinel) || File.ReadAllText(sentinel) != "preserve")
+                    throw new Exception("Scratch recovery removed another installation's scratch space.");
+            }
+        }
+        finally
+        {
+            scratch?.Dispose();
+            otherScratch?.Dispose();
+            if (Directory.Exists(parent)) Directory.Delete(parent, recursive: true);
+        }
+    }
+
+    private static void TestCompileInputsFingerprint()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-compile-inputs-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var package = Path.Combine(root, "RetroRewind6");
+            Directory.CreateDirectory(Path.Combine(package, "Binaries"));
+            Directory.CreateDirectory(Path.Combine(package, "RaceAssets"));
+            File.WriteAllText(Path.Combine(package, "Binaries", "Code.pul"), "code-A");
+            File.WriteAllText(Path.Combine(package, "RaceAssets", "tracks.txt"), "assets-A");
+
+            var first = CompileInputsFingerprint.Compute(package);
+            var throughParent = CompileInputsFingerprint.Compute(root);
+            if (first.CodePulSha256 != throughParent.CodePulSha256 ||
+                first.CompileInputsSha256 != throughParent.CompileInputsSha256)
+                throw new Exception("The compile identity changed when selected through its parent folder.");
+            if (first.CompileInputsSha256 != CompileInputsFingerprint.ComputeCompileInputsSha256(package))
+                throw new Exception("The compile-input hash is not deterministic.");
+
+            // The runtime reads assets live from the canonical installation, so an asset-only Retro
+            // Rewind update must not disturb any identity the backend keeps.
+            File.WriteAllText(Path.Combine(package, "RaceAssets", "tracks.txt"), "assets-B");
+            Directory.CreateDirectory(Path.Combine(package, "RaceAssets", "empty-runtime-directory"));
+            var assetsChanged = CompileInputsFingerprint.Compute(package);
+            if (assetsChanged.CodePulSha256 != first.CodePulSha256 ||
+                assetsChanged.CompileInputsSha256 != first.CompileInputsSha256)
+                throw new Exception("An asset-only Retro Rewind update changed a compile identity.");
+
+            // The registered mod directories affect compilation even when empty.
+            var files = Path.Combine(package, "files");
+            Directory.CreateDirectory(files);
+            var filesTopology = CompileInputsFingerprint.Compute(package);
+            if (filesTopology.CompileInputsSha256 == assetsChanged.CompileInputsSha256)
+                throw new Exception("The top-level files directory topology was not part of compile identity.");
+            File.WriteAllText(Path.Combine(files, "runtime-asset.bin"), "asset");
+            if (CompileInputsFingerprint.Compute(package).CompileInputsSha256 != filesTopology.CompileInputsSha256)
+                throw new Exception("A normal files asset incorrectly triggered a recompile.");
+
+            // Only Code.pul and the recorded file layout should trigger recompilation.
+            File.WriteAllText(Path.Combine(package, "unrelated.cpp"), "// ignored");
+            var straySource = CompileInputsFingerprint.Compute(package);
+            if (straySource.CodePulSha256 != filesTopology.CodePulSha256 ||
+                straySource.CompileInputsSha256 != filesTopology.CompileInputsSha256)
+                throw new Exception("A stray source file changed a compile identity.");
+
+            var codePulPath = Path.Combine(package, "Binaries", "Code.pul");
+            var linkTarget = Path.Combine(package, "Binaries", "Code.pul.copy");
+            File.WriteAllText(linkTarget, "linked");
+            File.Delete(codePulPath);
+            if (TryCreateFileLink(codePulPath, linkTarget))
+            {
+                try
+                {
+                    _ = CompileInputsFingerprint.Compute(package);
+                    throw new Exception("A linked compile input was accepted into the compile identity.");
+                }
+                catch (InvalidDataException) { }
+                finally
+                {
+                    File.Delete(codePulPath);
+                }
+            }
+
+            File.WriteAllText(codePulPath, "code-B");
+            var codeChanged = CompileInputsFingerprint.Compute(package);
+            if (codeChanged.CodePulSha256 == assetsChanged.CodePulSha256 ||
+                codeChanged.CompileInputsSha256 == assetsChanged.CompileInputsSha256)
+                throw new Exception("A Code.pul update did not change both compile identities.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// A build snapshot must copy megabytes of compile inputs, not the multi-gigabyte asset tree,
+    /// and must be provably the same inputs the canonical installation had when it was read.
+    /// </summary>
+    private static void TestCompileInputsSnapshot()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-snapshot-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var package = Path.Combine(root, "RetroRewind6");
+            Directory.CreateDirectory(Path.Combine(package, "Binaries"));
+            Directory.CreateDirectory(Path.Combine(package, "files", "Race", "Course"));
+            Directory.CreateDirectory(Path.Combine(package, "PulsarEngine", "MarioKartWii"));
+            File.WriteAllText(Path.Combine(package, "Binaries", "Code.pul"), "code-A");
+            File.WriteAllText(Path.Combine(package, "files", "Race", "Course", "beginner_course.szs"),
+                "a pretend multi-gigabyte asset");
+            File.WriteAllText(Path.Combine(package, "PulsarEngine", "MarioKartWii", "patch.cpp"), "int patch;");
+
+            var source = CompileInputsFingerprint.Compute(package);
+            var snapshot = CompileInputsFingerprint.Snapshot(package, Path.Combine(root, "scratch"));
+            if (snapshot.CodePulSha256 != source.CodePulSha256 ||
+                snapshot.CompileInputsSha256 != source.CompileInputsSha256)
+                throw new Exception("The compile-input snapshot is not identical to its source.");
+            // The mod root name becomes the product's relative DVD overlay root, so it is contractual.
+            if (Path.GetFileName(snapshot.RetroRewindRoot) != "RetroRewind6")
+                throw new Exception("The compile-input snapshot is not named RetroRewind6.");
+            if (!File.Exists(Path.Combine(snapshot.RetroRewindRoot, "Binaries", "Code.pul")))
+                throw new Exception("The compile-input snapshot is missing the Code.pul.");
+            if (File.Exists(Path.Combine(snapshot.RetroRewindRoot, "PulsarEngine", "MarioKartWii", "patch.cpp")))
+                throw new Exception("The compile-input snapshot copied Pulsar sources no build consumes.");
+            if (File.Exists(Path.Combine(snapshot.RetroRewindRoot, "files", "Race", "Course",
+                    "beginner_course.szs")))
+                throw new Exception("The compile-input snapshot copied the runtime asset tree.");
+            if (!Directory.Exists(Path.Combine(snapshot.RetroRewindRoot, "files")))
+                throw new Exception("The compile-input snapshot lost the compile-relevant files topology.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static void TestCompileInputsFingerprintGoldenVector()
+    {
+        const string expected = GoldenCompileInputsDigest;
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-vector-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            Directory.CreateDirectory(Path.Combine(root, "Binaries"));
+            Directory.CreateDirectory(Path.Combine(root, "tracks"));
+            Directory.CreateDirectory(Path.Combine(root, "empty", "nested"));
+            File.WriteAllBytes(Path.Combine(root, "Binaries", "Code.pul"), [0x00, 0x01, 0x02, 0xff]);
+            File.WriteAllBytes(Path.Combine(root, "readme.txt"),
+                System.Text.Encoding.UTF8.GetBytes("retro-rewind\n"));
+            File.WriteAllBytes(Path.Combine(root, "tracks", "course.bin"), []);
+
+            var actual = CompileInputsFingerprint.ComputeCompileInputsSha256(root);
+            if (!actual.Equals(expected, StringComparison.Ordinal))
+                throw new Exception($"Compile-inputs golden vector changed: {actual} != {expected}.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// The compile-input digest decides whether an installed product must be recompiled, so it is
+    /// pinned here: changing the hashed set or its encoding must be a deliberate edit of this value.
+    /// </summary>
+    private const string GoldenCompileInputsDigest =
+        "19b2ead4f83f030aac110b82ac801605fa81b4ed86f7be6a1b2bb9dd20147184";
+
+    private static void TestToolkitFingerprint()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-toolkit-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            CreateFakeToolkit(root);
+            var first = ToolkitFingerprint.Compute(root);
+            if (first != ToolkitFingerprint.Compute(root))
+                throw new Exception("The toolkit fingerprint is not stable.");
+
+            // A file that has nothing to do with generated code must not invalidate every install.
+            File.WriteAllText(Path.Combine(root, "Toolkit", "DolphinTool.exe"), "irrelevant");
+            if (ToolkitFingerprint.Compute(root) != first)
+                throw new Exception("An unrelated toolkit file changed the fingerprint.");
+
+            File.WriteAllText(Path.Combine(root, "Toolkit", "Translator", "Translator.Cli.exe"), "translator-v2");
+            var afterTranslator = ToolkitFingerprint.Compute(root);
+            if (afterTranslator == first)
+                throw new Exception("A new translator did not change the fingerprint.");
+
+            File.WriteAllText(Path.Combine(root, "BuildWorkspace", "runtime", "src", "main.cpp"), "int main2();");
+            var afterRuntimeSource = ToolkitFingerprint.Compute(root);
+            if (afterRuntimeSource == afterTranslator)
+                throw new Exception("A runtime source change did not change the fingerprint.");
+
+            var patch = Path.Combine(root, "BuildWorkspace", "aurora-main", "cmake", "patches",
+                "sdl3.patch");
+            Directory.CreateDirectory(Path.GetDirectoryName(patch)!);
+            File.WriteAllText(patch, "patch-v1");
+            var afterPatch = ToolkitFingerprint.Compute(root);
+            if (afterPatch == afterRuntimeSource)
+                throw new Exception("An Aurora patch consumed by the provider did not change compile identity.");
+
+            var installation = new Installation(root);
+            installation.WriteToolkitState(afterPatch, ToolkitFingerprint.ComputePackage(root),
+                "wiicompiled-v1", ToolkitFingerprint.ComputeRuntimeAssets(root));
+            var repair = new ProductRepairService(installation, new DelegatingInstallReporter(_ => { }));
+            repair.VerifyToolkitForCompilation(afterPatch);
+
+            void ExpectModifiedToolkitRejected(string description)
+            {
+                try
+                {
+                    repair.VerifyToolkitForCompilation(afterPatch);
+                    throw new Exception(description);
+                }
+                catch (InvalidDataException) { }
+            }
+
+            File.WriteAllText(patch, "patch-v2");
+            ExpectModifiedToolkitRejected("A modified mandatory Aurora patch was accepted for compilation.");
+            File.Delete(patch);
+            ExpectModifiedToolkitRejected("A deleted mandatory Aurora patch was accepted for compilation.");
+            File.WriteAllText(patch, "patch-v1");
+            repair.VerifyToolkitForCompilation(afterPatch);
+
+            var runtimeAssets = ToolkitFingerprint.ComputeRuntimeAssets(root);
+            var pipeline = Path.Combine(root, "BuildWorkspace", "runtime", "assets", "pipeline",
+                "initial_pipeline_cache.db");
+            File.WriteAllText(pipeline, "pipeline-v2");
+            if (ToolkitFingerprint.Compute(root) != afterPatch)
+                throw new Exception("A copied-only runtime asset needlessly changed compile identity.");
+            var changedRuntimeAssets = ToolkitFingerprint.ComputeRuntimeAssets(root);
+            if (changedRuntimeAssets == runtimeAssets)
+                throw new Exception("A copied runtime asset did not change its publication identity.");
+
+            var sourceEmptyDirectory = Path.Combine(root, "BuildWorkspace", "runtime", "assets", "wii",
+                "empty-runtime-directory");
+            Directory.CreateDirectory(sourceEmptyDirectory);
+            var topologyChangedRuntimeAssets = ToolkitFingerprint.ComputeRuntimeAssets(root);
+            if (topologyChangedRuntimeAssets == changedRuntimeAssets)
+                throw new Exception("An empty copied runtime-asset directory was omitted from its identity.");
+
+            // Cache-reuse subsets: translator or runtime/src changes (the translator regex-scans it
+            // for native overrides and effect contracts) invalidate translation but not toolchain,
+            // since CMake/Ninja rebuild exactly the affected objects; a compiler change invalidates
+            // only toolchain; a native_prebuilt provenance rewrite invalidates neither.
+            var components = ToolkitFingerprint.ComputeComponents(root);
+            if (components.Compile != afterPatch)
+                throw new Exception("ComputeComponents disagrees with the compile identity.");
+            File.WriteAllText(Path.Combine(root, "Toolkit", "Translator", "Translator.Cli.exe"),
+                "translator-v3");
+            var afterNewTranslator = ToolkitFingerprint.ComputeComponents(root);
+            if (afterNewTranslator.Translation == components.Translation)
+                throw new Exception("A new translator did not change the translation identity.");
+            if (afterNewTranslator.NativeToolchain != components.NativeToolchain)
+                throw new Exception("A new translator needlessly changed the native toolchain identity.");
+            File.WriteAllText(Path.Combine(root, "BuildWorkspace", "runtime", "src", "main.cpp"),
+                "int main3();");
+            var afterNewRuntime = ToolkitFingerprint.ComputeComponents(root);
+            if (afterNewRuntime.Translation == afterNewTranslator.Translation)
+                throw new Exception("A runtime source change did not change the translation identity.");
+            if (afterNewRuntime.NativeToolchain != afterNewTranslator.NativeToolchain)
+                throw new Exception("A runtime source change needlessly changed the native toolchain identity.");
+            if (afterNewRuntime.Compile == afterNewTranslator.Compile)
+                throw new Exception("A runtime source change did not change the compile identity.");
+            File.WriteAllText(Path.Combine(root, "Toolkit", "llvm-mingw", "bin", "clang-22.exe"),
+                "clang-v2");
+            var afterNewCompiler = ToolkitFingerprint.ComputeComponents(root);
+            if (afterNewCompiler.NativeToolchain == afterNewRuntime.NativeToolchain)
+                throw new Exception("A new compiler did not change the native toolchain identity.");
+            if (afterNewCompiler.Translation != afterNewRuntime.Translation)
+                throw new Exception("A new compiler needlessly changed the translation identity.");
+            File.WriteAllText(Path.Combine(root, "BuildWorkspace", "Dependencies", "native_prebuilt",
+                "provenance.json"), "{\"BuiltUtc\":\"rewritten\"}");
+            if (ToolkitFingerprint.Compute(root) != afterNewCompiler.Compile)
+                throw new Exception(
+                    "A native_prebuilt provenance rewrite needlessly changed the compile identity.");
+
+            var runtimeLink = Path.Combine(root, "BuildWorkspace", "runtime", "assets", "wii", "linked-assets");
+            if (TryCreateDirectoryLink(runtimeLink,
+                    Path.Combine(root, "BuildWorkspace", "runtime", "assets", "wii", "shared2")))
+            {
+                try
+                {
+                    try
+                    {
+                        _ = ToolkitFingerprint.ComputeRuntimeAssets(root);
+                        throw new Exception("A runtime-asset reparse point was accepted into its identity.");
+                    }
+                    catch (InvalidDataException) { }
+                }
+                finally
+                {
+                    Directory.Delete(runtimeLink);
+                }
+            }
+
+            var product = Path.Combine(root, "product");
+            Directory.CreateDirectory(product);
+            FileSystemUtilities.CopyDirectory(
+                Path.Combine(root, "BuildWorkspace", "runtime", "assets", "wii"),
+                Path.Combine(product, "wii_bootstrap"));
+            File.Copy(Path.Combine(root, "BuildWorkspace", "runtime", "assets", "dsp", "dsp_coef.bin"),
+                Path.Combine(product, "dsp_coef.bin"));
+            File.Copy(pipeline, Path.Combine(product, "initial_pipeline_cache.db"));
+            if (!ToolkitFingerprint.ProductRuntimeAssetsMatch(product, topologyChangedRuntimeAssets))
+                throw new Exception("Copied product assets did not match their normalized source identity.");
+            Directory.Delete(Path.Combine(product, "wii_bootstrap", "empty-runtime-directory"));
+            if (ToolkitFingerprint.ProductRuntimeAssetsMatch(product, topologyChangedRuntimeAssets))
+                throw new Exception("A missing copied runtime-asset directory was not detected.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static void CreateFakeToolkit(string root)
+    {
+        Directory.CreateDirectory(Path.Combine(root, "Toolkit", "Translator"));
+        Directory.CreateDirectory(Path.Combine(root, "Toolkit", "CMake", "bin"));
+        Directory.CreateDirectory(Path.Combine(root, "Toolkit", "Ninja"));
+        Directory.CreateDirectory(Path.Combine(root, "Toolkit", "llvm-mingw", "bin"));
+        Directory.CreateDirectory(Path.Combine(root, "BuildWorkspace", "projects", "mkwii"));
+        Directory.CreateDirectory(Path.Combine(root, "BuildWorkspace", "runtime", "src"));
+        Directory.CreateDirectory(Path.Combine(root, "BuildWorkspace", "runtime", "assets", "wii", "shared2",
+            "wc24"));
+        Directory.CreateDirectory(Path.Combine(root, "BuildWorkspace", "runtime", "assets", "dsp"));
+        Directory.CreateDirectory(Path.Combine(root, "BuildWorkspace", "runtime", "assets", "pipeline"));
+        var aurora = Path.Combine(root, "BuildWorkspace", "aurora-main");
+        Directory.CreateDirectory(aurora);
+        File.WriteAllText(Path.Combine(aurora, "README.md"), "aurora source");
+        foreach (var dependency in InstalledLayout.DependencyNames)
+        {
+            var directory = Path.Combine(root, "BuildWorkspace", "Dependencies", dependency);
+            Directory.CreateDirectory(directory);
+            File.WriteAllText(Path.Combine(directory, ".mkwc-layout"), dependency);
+        }
+        File.WriteAllText(Path.Combine(root, "Toolkit", "Translator", "Translator.Cli.exe"), "translator-v1");
+        File.WriteAllText(Path.Combine(root, "Toolkit", "CMake", "bin", "cmake.exe"), "cmake");
+        File.WriteAllText(Path.Combine(root, "Toolkit", "Ninja", "ninja.exe"), "ninja");
+        foreach (var executable in new[]
+                 {
+                     "clang-22.exe", "ld.lld.exe", "x86_64-w64-mingw32-clang.exe",
+                     "x86_64-w64-mingw32-clang++.exe", "x86_64-w64-mingw32-windres.exe"
+                 })
+            File.WriteAllText(Path.Combine(root, "Toolkit", "llvm-mingw", "bin", executable), executable);
+        File.WriteAllText(Path.Combine(root, "Toolkit", "DolphinTool.exe"), "tool");
+        File.WriteAllText(Path.Combine(root, "BuildWorkspace", "LocalBuild.ps1"), "# build");
+        File.WriteAllText(Path.Combine(root, "BuildWorkspace", "NativeBuildFlags.ps1"), "# flags");
+        File.WriteAllText(Path.Combine(root, "BuildWorkspace", "projects", "mkwii", "recomp.yml"), "profiles: {}");
+        File.WriteAllText(Path.Combine(root, "BuildWorkspace", "runtime", "CMakeLists.txt"), "cmake_minimum_required(VERSION 3.20)");
+        File.WriteAllText(Path.Combine(root, "BuildWorkspace", "runtime", "src", "main.cpp"), "int main();");
+        File.WriteAllText(Path.Combine(root, "BuildWorkspace", "runtime", "assets", "wii", "shared2", "wc24",
+            "bootstrap.bin"), "bootstrap");
+        File.WriteAllText(Path.Combine(root, "BuildWorkspace", "runtime", "assets", "dsp", "dsp_coef.bin"),
+            "dsp");
+        File.WriteAllText(Path.Combine(root, "BuildWorkspace", "runtime", "assets", "pipeline",
+            "initial_pipeline_cache.db"), "pipeline");
+    }
+
+    private static void CopyFakeRuntimeAssets(string root, string productDirectory)
+    {
+        var source = Path.Combine(root, "BuildWorkspace", "runtime", "assets");
+        FileSystemUtilities.CopyDirectory(Path.Combine(source, "wii"),
+            Path.Combine(productDirectory, "wii_bootstrap"));
+        File.Copy(Path.Combine(source, "dsp", "dsp_coef.bin"),
+            Path.Combine(productDirectory, "dsp_coef.bin"), overwrite: true);
+        File.Copy(Path.Combine(source, "pipeline", "initial_pipeline_cache.db"),
+            Path.Combine(productDirectory, "initial_pipeline_cache.db"), overwrite: true);
+    }
+
+    private static bool TryCreateFileLink(string linkPath, string targetPath)
+    {
+        try
+        {
+            File.CreateSymbolicLink(linkPath, targetPath);
+            return true;
+        }
+        catch (Exception ex) when (ex is UnauthorizedAccessException or IOException or NotSupportedException)
+        {
+            return false;
+        }
+    }
+
+    private static bool TryCreateDirectoryLink(string linkPath, string targetPath)
+    {
+        try
+        {
+            Directory.CreateSymbolicLink(linkPath, targetPath);
+            return true;
+        }
+        catch (Exception ex) when (ex is UnauthorizedAccessException or IOException or NotSupportedException)
+        {
+            // Developer Mode / symlink permission is not guaranteed on a user's Windows system.
+            // The identity check is still covered whenever the platform can create a link.
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// The full inspection state machine against the canonical Retro Rewind installation. The
+    /// installation itself is never copied here, exactly as in production: only its compile inputs
+    /// are ever read, and asset-only changes to it must leave the product current.
+    /// </summary>
+    private static void TestCodePulStateMachine()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-install-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            CreateFakeToolkit(root);
+            var installation = new Installation(root);
+            var fingerprint = ToolkitFingerprint.Compute(root);
+            installation.WriteToolkitState(fingerprint, ToolkitFingerprint.ComputePackage(root),
+                "wiicompiled-v1", ToolkitFingerprint.ComputeRuntimeAssets(root));
+
+            // Wheel Wizard's own Retro Rewind installation, deliberately outside the install root.
+            var canonical = Path.Combine(root, "canonical", "RetroRewind6");
+            Directory.CreateDirectory(Path.Combine(canonical, "Binaries"));
+            Directory.CreateDirectory(Path.Combine(canonical, "PulsarEngine"));
+            File.WriteAllText(Path.Combine(canonical, "Binaries", "Code.pul"), "code-pul-A");
+            File.WriteAllText(Path.Combine(canonical, "PulsarEngine", "patch.cpp"), "int patch;");
+            File.WriteAllText(Path.Combine(canonical, "asset.txt"), "asset-A");
+
+            Directory.CreateDirectory(installation.BaseDirectory);
+            Directory.CreateDirectory(installation.RetroDirectory);
+            File.WriteAllBytes(installation.BaseExecutable, new byte[64 * 1024]);
+            File.WriteAllBytes(installation.RetroExecutable, new byte[64 * 1024]);
+            CopyFakeRuntimeAssets(root, installation.BaseDirectory);
+            CopyFakeRuntimeAssets(root, installation.RetroDirectory);
+            var gameSys = Path.Combine(installation.GameDataDirectory, "sys");
+            var gameRel = Path.Combine(installation.GameDataDirectory, "files", "rel");
+            Directory.CreateDirectory(gameSys);
+            Directory.CreateDirectory(gameRel);
+            File.WriteAllText(Path.Combine(gameSys, "main.dol"), "dol");
+            File.WriteAllText(Path.Combine(gameSys, "fst.bin"), "fst");
+            File.WriteAllText(Path.Combine(gameRel, "StaticR.rel"), "rel");
+            var dolSha = InputValidation.Sha256File(Path.Combine(gameSys, "main.dol"));
+            var relSha = InputValidation.Sha256File(Path.Combine(gameRel, "StaticR.rel"));
+            var inputsA = CompileInputsFingerprint.Compute(canonical);
+            LocalBuildService.WriteFingerprint(installation.BaseDirectory, BuildProfile.Base, fingerprint,
+                dolSha, relSha, "", RetroWfcPayloadMode.NotApplicable);
+            JsonState.Write(Path.Combine(installation.BaseDirectory, LocalBuildProvenance.FileName),
+                new LocalBuildProvenance { SchemaVersion = 1, Profile = "base", DolSha256 = dolSha,
+                    RelSha256 = relSha });
+            JsonState.Write(Path.Combine(installation.RetroDirectory, ProductFingerprint.FileName),
+                new ProductFingerprint
+                {
+                    Profile = "retro-rewind", ToolkitFingerprint = fingerprint, DolSha256 = dolSha, RelSha256 = relSha,
+                    ExecutableSha256 = InputValidation.Sha256File(installation.RetroExecutable),
+                    CodePulSha256 = inputsA.CodePulSha256,
+                    RetroRewindCompileInputsSha256 = inputsA.CompileInputsSha256,
+                    RetroWfcPayloadMode = "skipped"
+                });
+            JsonState.Write(Path.Combine(installation.RetroDirectory, LocalBuildProvenance.FileName),
+                new LocalBuildProvenance { SchemaVersion = 1, Profile = "retro-rewind", DolSha256 = dolSha,
+                    RelSha256 = relSha, CodePulSha256 = inputsA.CodePulSha256,
+                    RetroWfcPayloadMode = "skipped" });
+            JsonState.Write(installation.InstallStatePath, new InstallState
+            {
+                InstallDir = root, RetroRewindInstalled = true,
+                DolSha256 = dolSha, RelSha256 = relSha,
+                RetroRewindCodePulSha256 = inputsA.CodePulSha256,
+                RetroRewindCompileInputsSha256 = inputsA.CompileInputsSha256,
+                RetroWfcPayloadMode = "skipped",
+                RetroRewindRoot = canonical
+            });
+
+            ProductState Inspect() =>
+                installation.CheckRetroRewind(installation.ResolveToolkitFingerprint(),
+                    CompileInputsFingerprint.Compute(canonical));
+
+            void Expect(ProductStatus expected, string description)
+            {
+                var inspected = Inspect();
+                if (inspected.Status != expected)
+                    throw new Exception(
+                        $"{description}: expected {expected}, got {inspected.Status}: {inspected.Detail}");
+            }
+
+            Expect(ProductStatus.Current, "A freshly built Retro Rewind");
+
+            // The whole point of the canonical-source model: assets change constantly and the
+            // runtime reads them live, so they must never make the backend rebuild anything.
+            File.WriteAllText(Path.Combine(canonical, "asset.txt"), "asset-B");
+            Directory.CreateDirectory(Path.Combine(canonical, "new-course-directory"));
+            Expect(ProductStatus.Current, "An asset-only Retro Rewind update");
+
+            var unreadableCanonical = installation.CheckRetroRewind(fingerprint, null,
+                "The canonical Retro Rewind folder cannot be read: missing.");
+            if (unreadableCanonical.Status != ProductStatus.InputsMissing ||
+                !unreadableCanonical.ActionRequired)
+                throw new Exception("A missing canonical Retro Rewind folder did not fail closed.");
+
+            var unchangedInputs = ProductRepairService.FindDesiredInputDrift(installation, fingerprint,
+                dolSha, relSha);
+            if (unchangedInputs.Base || unchangedInputs.Retro)
+                throw new Exception("Current authoritative game inputs requested an unnecessary rebuild.");
+            var changedInputs = ProductRepairService.FindDesiredInputDrift(installation, fingerprint,
+                new string('a', 64), relSha);
+            if (!changedInputs.Base || !changedInputs.Retro)
+                throw new Exception("Desired DOL drift did not force both installed products to rebuild.");
+
+            File.Delete(installation.ToolkitStatePath);
+            if (!string.IsNullOrEmpty(installation.ResolveToolkitFingerprint()) ||
+                Inspect().Status != ProductStatus.Blocked)
+                throw new Exception("A missing toolkit-state.json was inferred instead of failing closed.");
+            installation.WriteToolkitState(fingerprint, ToolkitFingerprint.ComputePackage(root),
+                "wiicompiled-v1", ToolkitFingerprint.ComputeRuntimeAssets(root));
+            Expect(ProductStatus.Current, "A restored toolkit-state.json");
+
+            var cmake = Path.Combine(root, "Toolkit", "CMake", "bin", "cmake.exe");
+            File.Delete(cmake);
+            if (!string.IsNullOrEmpty(installation.ResolveToolkitFingerprint()) ||
+                Inspect().Status != ProductStatus.Blocked)
+                throw new Exception("A missing bundled build tool did not block product inspection.");
+            File.WriteAllText(cmake, "cmake");
+            Expect(ProductStatus.Current, "A restored bundled build tool");
+
+            var auroraMarker = Path.Combine(root, "BuildWorkspace", "aurora-main", "README.md");
+            File.Delete(auroraMarker);
+            if (!string.IsNullOrEmpty(installation.ResolveToolkitFingerprint()) ||
+                Inspect().Status != ProductStatus.Blocked)
+                throw new Exception("A missing Aurora source tree did not block product inspection early.");
+            File.WriteAllText(auroraMarker, "aurora source");
+
+            var dependencyMarker = Path.Combine(root, "BuildWorkspace", "Dependencies", "fmt", ".mkwc-layout");
+            File.Delete(dependencyMarker);
+            if (!string.IsNullOrEmpty(installation.ResolveToolkitFingerprint()) ||
+                Inspect().Status != ProductStatus.Blocked)
+                throw new Exception("An empty required dependency tree did not block product inspection early.");
+            File.WriteAllText(dependencyMarker, "fmt");
+            Expect(ProductStatus.Current, "A restored required toolkit layout");
+
+            var baseDsp = Path.Combine(installation.BaseDirectory, "dsp_coef.bin");
+            File.Delete(baseDsp);
+            var missingBaseRuntimeAssets = installation.CheckBase(installation.ResolveToolkitFingerprint());
+            if (missingBaseRuntimeAssets.Status != ProductStatus.Broken ||
+                installation.CheckBaseCore(installation.ResolveToolkitFingerprint()).Status !=
+                ProductStatus.Current)
+                throw new Exception("Missing copied base runtime assets were not reported as broken.");
+
+            var retroPipeline = Path.Combine(installation.RetroDirectory, "initial_pipeline_cache.db");
+            File.Delete(retroPipeline);
+            if (Inspect().Status != ProductStatus.Broken)
+                throw new Exception("Missing copied Retro Rewind runtime assets were not reported as broken.");
+
+            // Copied support files are republished from the installed workspace: repairing them must
+            // never require the translator or the compiler.
+            using (InstallOperationLock.Acquire(root))
+            {
+                var repair = new ProductRepairService(installation, new DelegatingInstallReporter(_ => { }));
+                _ = repair.RepairBaseAsync(new ProductRepairService.ReconcileOptions())
+                    .GetAwaiter().GetResult();
+            }
+            if (!File.Exists(baseDsp) ||
+                installation.CheckBase(installation.ResolveToolkitFingerprint()).Status != ProductStatus.Current)
+                throw new Exception("Runtime-only repair did not restore the base support assets and health.");
+            if (!File.Exists(retroPipeline))
+                throw new Exception("Runtime-only repair did not restore the Retro Rewind support assets.");
+            Expect(ProductStatus.Current, "Runtime-only Retro Rewind repair");
+
+            // Pulsar sources are no longer compile inputs; only the Code.pul built from them is.
+            File.WriteAllText(Path.Combine(canonical, "PulsarEngine", "patch.cpp"), "int patched;");
+            Expect(ProductStatus.Current, "A changed Pulsar source without a Code.pul change");
+            File.WriteAllText(Path.Combine(canonical, "PulsarEngine", "patch.cpp"), "int patch;");
+
+            File.WriteAllText(Path.Combine(canonical, "Binaries", "Code.pul"), "code-pul-B");
+            Expect(ProductStatus.CodePulChanged, "A changed canonical Code.pul");
+            File.WriteAllText(Path.Combine(canonical, "Binaries", "Code.pul"), "code-pul-A");
+            Expect(ProductStatus.Current, "A restored canonical Code.pul");
+
+            var alteredExecutable = File.ReadAllBytes(installation.RetroExecutable);
+            alteredExecutable[0] = 1;
+            File.WriteAllBytes(installation.RetroExecutable, alteredExecutable);
+            var tamperedExecutable = Inspect();
+            if (tamperedExecutable.Status != ProductStatus.Blocked || !tamperedExecutable.ActionRequired)
+                throw new Exception("A modified Retro Rewind executable did not fail closed.");
+            File.WriteAllBytes(installation.RetroExecutable, new byte[64 * 1024]);
+            Expect(ProductStatus.Current, "A restored Retro Rewind executable");
+
+            File.Delete(installation.RetroExecutable);
+            Expect(ProductStatus.Broken, "A missing Retro Rewind executable");
+
+            File.WriteAllBytes(installation.RetroExecutable, new byte[64 * 1024]);
+            File.WriteAllText(Path.Combine(root, "Toolkit", "Translator", "Translator.Cli.exe"), "translator-v2");
+            installation.WriteToolkitState(ToolkitFingerprint.Compute(root),
+                ToolkitFingerprint.ComputePackage(root), "wiicompiled-v2",
+                ToolkitFingerprint.ComputeRuntimeAssets(root));
+            Expect(ProductStatus.ToolkitChanged, "A replaced translator");
+            if (installation.CheckBase(installation.ResolveToolkitFingerprint()).Status != ProductStatus.ToolkitChanged)
+                throw new Exception("A replaced translator did not invalidate the base product.");
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    /// <summary>
+    /// The frontend matches the products line's keys case-sensitively and branches on the typed
+    /// status alone, so the exact v1 shape is pinned here rather than left to a serializer default.
+    /// </summary>
+    private static void TestProductsReport()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkwc-products-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            // A path nothing was installed to must answer "absent", not fail and not ask for a rebuild.
+            var missing = ConsoleCommands.InspectProducts(new Installation(root));
+            if (missing.RebuildRequired || missing.Base.Reason != "absent" ||
+                missing.RetroRewind.Reason != "absent")
+                throw new Exception("A missing installation directory was not reported as absent.");
+            if (Directory.Exists(root))
+                throw new Exception("Inspecting a missing installation created the directory.");
+
+            Directory.CreateDirectory(root);
+            var empty = ConsoleCommands.InspectProducts(new Installation(root));
+            if (empty.RebuildRequired || empty.Base.Reason != "absent" || empty.RetroRewind.Reason != "absent")
+                throw new Exception("An empty installation directory was not reported as absent.");
+            if (File.Exists(Path.Combine(root, ToolkitState.FileName)))
+                throw new Exception("Inspecting an empty installation wrote installation state.");
+
+            var json = ConsoleCommands.SerializeProductsReport(empty);
+            foreach (var key in new[]
+                     {
+                         "\"type\":\"products\"", "\"setupVersion\":", "\"installDir\":",
+                          "\"rebuildRequired\":false", "\"base\":{\"status\":\"absent\",\"detail\":",
+                          "\"retroRewind\":{\"status\":\"absent\",\"detail\":"
+                     })
+                if (!json.Contains(key, StringComparison.Ordinal))
+                    throw new Exception($"The products line is missing {key}: {json}");
+            // v1 reports a status and a detail per product and nothing else; a frontend must not be
+            // able to read a second, possibly disagreeing, opinion out of the same record.
+            foreach (var removed in new[] { "\"health\"", "\"action\"", "\"compileRequired\"",
+                         "\"packageSyncRequired\"", "\"actionRequired\"" })
+                if (json.Contains(removed, StringComparison.Ordinal))
+                    throw new Exception($"The products line still carries {removed}: {json}");
+            foreach (var wrongCase in new[] { "\"Base\"", "\"RetroRewind\"", "\"SetupVersion\"",
+                         "\"InstallDir\"", "\"RebuildRequired\"", "\"Status\"", "\"Detail\"" })
+                if (json.Contains(wrongCase, StringComparison.Ordinal))
+                    throw new Exception($"The products line used PascalCase for {wrongCase}: {json}");
+
+            foreach (var status in new[]
+                     {
+                         ProductStatus.Absent, ProductStatus.Current, ProductStatus.ToolkitChanged,
+                         ProductStatus.CodePulChanged, ProductStatus.CompileInputsChanged,
+                         ProductStatus.PayloadChanged, ProductStatus.InputsMissing,
+                         ProductStatus.Blocked, ProductStatus.Broken
+                     })
+            {
+                var reason = new ProductState(status, "").Reason;
+                if (!new[]
+                    {
+                        "absent", "current", "toolkit-changed", "code-pul-changed",
+                        "compile-inputs-changed", "payload-changed", "inputs-missing", "blocked",
+                        "broken"
+                    }.Contains(reason, StringComparer.Ordinal))
+                    throw new Exception($"{status} reports the undeclared status {reason}.");
+            }
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static void Test(string name, Action action, List<string> failures)
+    {
+        try { action(); }
+        catch (Exception ex) { failures.Add($"{name}: {ex.Message}"); }
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/ShellIntegration.cs b/Launcher/WiiCompiled.Setup/ShellIntegration.cs
new file mode 100644
index 0000000..eeae1de
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/ShellIntegration.cs
@@ -0,0 +1,85 @@
+using Microsoft.Win32;
+
+namespace WiiCompiled.Setup;
+
+internal static class ShellIntegration
+{
+    public static void RegisterUninstaller(string installDirectory, bool retroInstalled)
+    {
+        using var key = Registry.CurrentUser.CreateSubKey(ProductInfo.UninstallKey, writable: true)
+                        ?? throw new InvalidOperationException("Could not register the uninstaller.");
+        var cli = Path.Combine(installDirectory, ProductInfo.SetupCopyName);
+        key.SetValue("DisplayName", ProductInfo.Name);
+        key.SetValue("DisplayVersion", ProductInfo.Version);
+        key.SetValue("Publisher", "WiiCompiled");
+        key.SetValue("InstallLocation", installDirectory);
+        key.SetValue("DisplayIcon", cli);
+        key.SetValue("UninstallString", $"\"{cli}\" --uninstall --install-dir \"{installDirectory}\"");
+        key.SetValue("QuietUninstallString", $"\"{cli}\" --silent-uninstall --install-dir \"{installDirectory}\"");
+        key.SetValue("NoModify", 1, RegistryValueKind.DWord);
+        key.SetValue("NoRepair", 1, RegistryValueKind.DWord);
+        key.SetValue("EstimatedSize", EstimateSizeKb(installDirectory), RegistryValueKind.DWord);
+        key.SetValue("Comments", retroInstalled ? "Includes the Retro Rewind profile" : "WiiCompiled");
+    }
+
+    public static void UnregisterUninstaller() =>
+        Registry.CurrentUser.DeleteSubKeyTree(ProductInfo.UninstallKey, throwOnMissingSubKey: false);
+
+    /// <summary>Removes shortcuts left by GUI-capable releases from before Wheel Wizard owned the UI.</summary>
+    public static void RemoveAllShortcuts()
+    {
+        var desktop = Environment.GetFolderPath(Environment.SpecialFolder.DesktopDirectory);
+        var startMenuFolder = Path.Combine(
+            Environment.GetFolderPath(Environment.SpecialFolder.StartMenu), "Programs", ProductInfo.Name);
+        RemoveAllShortcuts(desktop, startMenuFolder);
+    }
+
+    internal static void RemoveAllShortcuts(string desktop, string startMenuFolder)
+    {
+        var failures = new List<Exception>();
+        DeleteFileBestEffort(Path.Combine(desktop, "WiiCompiled.lnk"), failures);
+        DeleteFileBestEffort(Path.Combine(desktop, "Retro Rewind.lnk"), failures);
+        DeleteDirectoryBestEffort(startMenuFolder, failures);
+
+        if (failures.Count != 0)
+            throw new AggregateException("One or more WiiCompiled shortcuts could not be removed.", failures);
+    }
+
+    private static void DeleteFileBestEffort(string path, List<Exception> failures)
+    {
+        try
+        {
+            File.Delete(path);
+        }
+        catch (Exception ex)
+        {
+            failures.Add(new IOException($"Could not delete shortcut {path}: {ex.Message}", ex));
+        }
+    }
+
+    private static void DeleteDirectoryBestEffort(string path, List<Exception> failures)
+    {
+        try
+        {
+            if (Directory.Exists(path)) Directory.Delete(path, recursive: true);
+        }
+        catch (Exception ex)
+        {
+            failures.Add(new IOException($"Could not delete shortcut folder {path}: {ex.Message}", ex));
+        }
+    }
+
+    private static int EstimateSizeKb(string directory)
+    {
+        try
+        {
+            var bytes = Directory.EnumerateFiles(directory, "*", SearchOption.AllDirectories)
+                .Sum(path => new FileInfo(path).Length);
+            return (int)Math.Min(int.MaxValue, (bytes + 1023) / 1024);
+        }
+        catch
+        {
+            return 0;
+        }
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/ToolkitFingerprint.cs b/Launcher/WiiCompiled.Setup/ToolkitFingerprint.cs
new file mode 100644
index 0000000..ded4feb
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/ToolkitFingerprint.cs
@@ -0,0 +1,286 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace WiiCompiled.Setup;
+
+/// <summary>
+/// Content identity of everything that decides what the locally produced executables contain.
+/// First link of toolkit content -&gt; toolkit-state.json -&gt; per-product build-fingerprint.json:
+/// unchanged skips retranslation, any change forces a rebuild. Content-based so re-tags are free.
+/// </summary>
+internal static class ToolkitFingerprint
+{
+    // v6/native-toolchain v2 forces one clean rebuild past a Ninja stale-object bug.
+    // translation v2 added runtime/src, which the translator regex-scans for native overrides.
+    private const string Version = "mkwc-toolkit-compile-v6";
+    private const string TranslationVersion = "mkwc-toolkit-translation-v2";
+    private const string NativeToolchainVersion = "mkwc-toolkit-native-toolchain-v2";
+    private const string PackageVersion = "mkwc-toolkit-package-v1";
+    private const string RuntimeAssetsVersion = "mkwc-product-runtime-assets-v3";
+    private const string RuntimeAssetsDescription = "The product runtime assets";
+
+    private static readonly string[] SourceExtensions =
+        [".c", ".cc", ".cpp", ".cxx", ".h", ".hh", ".hpp", ".inl", ".s", ".asm",
+         ".cmake", ".txt", ".yml", ".yaml", ".toml", ".json", ".ps1", ".in", ".def", ".patch"];
+
+    /// <summary>
+    /// Inputs that decide translator output: translator, translation project, runtime sources it
+    /// scans for native override registrations/effect contracts, and the build script's translator
+    /// command lines. Unchanged means the completed base translation can be reused instead of re-run.
+    /// </summary>
+    private static readonly string[] TranslationPrefixes =
+    [
+        InstalledLayout.ToolkitEntryPrefix + "Translator/",
+        InstalledLayout.WorkspaceEntryPrefix + "projects/",
+        InstalledLayout.WorkspaceEntryPrefix + "runtime/src/"
+    ];
+
+    private static readonly string[] TranslationFiles =
+        [InstalledLayout.WorkspaceEntryPrefix + "LocalBuild.ps1"];
+
+    /// <summary>
+    /// Inputs that make compiled objects unsafe to reuse: the compiler/CMake/Ninja toolchain, the
+    /// shipped runtime DLLs, and the scripts owning configure flags. Source/dependency changes are
+    /// deliberately excluded, since CMake/Ninja already rebuild exactly the affected objects.
+    /// </summary>
+    private static readonly string[] NativeToolchainPrefixes =
+    [
+        InstalledLayout.ToolkitEntryPrefix + "llvm-mingw/",
+        InstalledLayout.ToolkitEntryPrefix + "CMake/",
+        InstalledLayout.ToolkitEntryPrefix + "Ninja/",
+        InstalledLayout.ToolkitEntryPrefix + "Redist/"
+    ];
+
+    private static readonly string[] NativeToolchainFiles =
+    [
+        InstalledLayout.WorkspaceEntryPrefix + "LocalBuild.ps1",
+        InstalledLayout.WorkspaceEntryPrefix + "NativeBuildFlags.ps1"
+    ];
+
+    /// <summary>
+    /// Fingerprint of the toolkit at <paramref name="root"/>: the staged payload root at
+    /// release-build time, or an install directory when a compile path re-verifies it. The install
+    /// path itself never computes this, it compares manifest identity against toolkit-state.json.
+    /// </summary>
+    public static string Compute(string root, CancellationToken cancellationToken = default) =>
+        ComputeComponents(root, cancellationToken).Compile;
+
+    /// <summary>
+    /// One walk, three identities: the compile identity plus its translation and native-toolchain
+    /// subsets. The subsets never gate correctness, compile identity alone decides if products are
+    /// current, they only decide how much completed work carries into the next build.
+    /// </summary>
+    public static ToolkitFingerprintComponents ComputeComponents(string root,
+        CancellationToken cancellationToken = default)
+    {
+        root = Path.GetFullPath(root);
+        var toolkit = InstalledLayout.Toolkit(root);
+        var workspace = InstalledLayout.Workspace(root);
+        var entries = new SortedDictionary<string, string>(StringComparer.Ordinal);
+
+        // DolphinTool validates/extracts the user disc but does not influence generated products.
+        // Everything else in Toolkit can affect translation, compilation, linking, or copied
+        // runtime support and therefore belongs to the compile identity.
+        AddDirectory(entries, root, toolkit, null,
+            cancellationToken,
+            file => !Path.GetFileName(file).Equals("DolphinTool.exe", StringComparison.OrdinalIgnoreCase));
+        AddFile(entries, root, Path.Combine(workspace, "LocalBuild.ps1"), cancellationToken);
+        AddFile(entries, root, Path.Combine(workspace, "NativeBuildFlags.ps1"), cancellationToken);
+        AddDirectory(entries, root, Path.Combine(workspace, "projects"), null, cancellationToken);
+        var runtime = Path.Combine(workspace, "runtime");
+        var runtimeAssets = Path.Combine(runtime, "assets");
+        // runtime/assets is copied beside the executable; it is deliberately tracked by the
+        // independent runtime-assets identity below so changing those bytes does not recompile code.
+        AddDirectory(entries, root, runtime, SourceExtensions, cancellationToken,
+            file => !FileSystemUtilities.PathContains(runtimeAssets, file));
+        AddDirectory(entries, root, Path.Combine(workspace, "aurora-main"), SourceExtensions,
+            cancellationToken);
+        // The shipped precompiled aurora archives and the pinned Dawn runtime are linked into the
+        // product, so a change there changes the binary just as surely as a translator change does.
+        // native_prebuilt's provenance.json is excluded: its Contents list already identifies every
+        // shipped byte, while its BuiltUtc stamp would make a bit-identical re-harvest look like a
+        // toolkit change and force a global user-side rebuild for nothing.
+        AddDirectory(entries, root, Path.Combine(workspace, "Dependencies"), null, cancellationToken,
+            file => !file.EndsWith(
+                Path.Combine("native_prebuilt", "provenance.json"), StringComparison.OrdinalIgnoreCase));
+
+        if (entries.Count == 0)
+            throw new InvalidDataException($"No toolkit files were found under {root}; the installation is incomplete.");
+
+        return new ToolkitFingerprintComponents(
+            BuildIdentity(Version, entries),
+            BuildSubsetIdentity(TranslationVersion, entries, TranslationPrefixes, TranslationFiles),
+            BuildSubsetIdentity(NativeToolchainVersion, entries, NativeToolchainPrefixes,
+                NativeToolchainFiles));
+    }
+
+    private static string BuildSubsetIdentity(string version, SortedDictionary<string, string> entries,
+        string[] prefixes, string[] files)
+    {
+        var subset = new SortedDictionary<string, string>(StringComparer.Ordinal);
+        foreach (var (relative, hash) in entries)
+        {
+            if (prefixes.Any(prefix => relative.StartsWith(prefix, StringComparison.Ordinal)) ||
+                files.Any(file => relative.Equals(file, StringComparison.Ordinal)))
+                subset[relative] = hash;
+        }
+        return BuildIdentity(version, subset);
+    }
+
+    /// <summary>
+    /// Content identity of the source-owned files copied verbatim beside every product. This is
+    /// intentionally independent of <see cref="Compute"/>: an asset-only release is published
+    /// transactionally without translating or compiling unchanged code.
+    /// </summary>
+    public static string ComputeRuntimeAssets(string root, CancellationToken cancellationToken = default)
+    {
+        root = Path.GetFullPath(root);
+        var assets = Path.Combine(InstalledLayout.Workspace(root), "runtime", "assets");
+        var entries = new SortedDictionary<string, string>(StringComparer.Ordinal);
+        AddMappedDirectory(entries, Path.Combine(assets, ProductRuntimeAssets.SourceBootstrapDirectoryName),
+            ProductRuntimeAssets.ProductBootstrapDirectoryName, cancellationToken);
+        foreach (var (relativePath, productFileName) in ProductRuntimeAssets.Files)
+            AddRequiredMappedFile(entries, ProductRuntimeAssets.SourceFile(assets, relativePath),
+                productFileName, cancellationToken);
+        return BuildIdentity(RuntimeAssetsVersion, entries);
+    }
+
+    public static string? TryComputeRuntimeAssets(string root, CancellationToken cancellationToken = default,
+        Action<string>? diagnostic = null)
+    {
+        try { return ComputeRuntimeAssets(root, cancellationToken); }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or InvalidDataException)
+        {
+            diagnostic?.Invoke(
+                $"The workspace runtime assets under {root} could not be fingerprinted: {ex.Message}");
+            return null;
+        }
+    }
+
+    /// <summary>Checks the actual copied product files against a source runtime-assets identity.</summary>
+    public static bool ProductRuntimeAssetsMatch(string productDirectory, string expectedFingerprint,
+        CancellationToken cancellationToken = default, Action<string>? diagnostic = null)
+    {
+        try
+        {
+            var entries = new SortedDictionary<string, string>(StringComparer.Ordinal);
+            AddMappedDirectory(entries,
+                Path.Combine(productDirectory, ProductRuntimeAssets.ProductBootstrapDirectoryName),
+                ProductRuntimeAssets.ProductBootstrapDirectoryName, cancellationToken);
+            foreach (var (_, productFileName) in ProductRuntimeAssets.Files)
+                AddRequiredMappedFile(entries, Path.Combine(productDirectory, productFileName),
+                    productFileName, cancellationToken);
+            return BuildIdentity(RuntimeAssetsVersion, entries).Equals(expectedFingerprint,
+                StringComparison.Ordinal);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or InvalidDataException)
+        {
+            diagnostic?.Invoke(
+                $"The copied runtime assets under {productDirectory} could not be verified: {ex.Message}");
+            return false;
+        }
+    }
+
+    /// <summary>Identity of the shipped Toolkit directory, including installer-only tools.</summary>
+    public static string ComputePackage(string root, CancellationToken cancellationToken = default)
+    {
+        root = Path.GetFullPath(root);
+        var entries = new SortedDictionary<string, string>(StringComparer.Ordinal);
+        AddDirectory(entries, root, InstalledLayout.Toolkit(root), null, cancellationToken);
+        if (entries.Count == 0)
+            throw new InvalidDataException($"No toolkit package files were found under {root}.");
+        return BuildIdentity(PackageVersion, entries);
+    }
+
+    /// <summary>
+    /// The toolkit is ~26,000 mostly tiny files (llvm-mingw's headers/libraries dominate), so this
+    /// walk is bound by per-file open/read overhead, not hashing throughput, minutes rather than
+    /// seconds on a cold cache under on-access antivirus. Hashing concurrently keeps a compiling
+    /// repair from taking longer to prove toolkit integrity than to translate with it.
+    /// </summary>
+    private static void AddDirectory(SortedDictionary<string, string> entries, string root, string directory,
+        string[]? extensions, CancellationToken cancellationToken = default,
+        Func<string, bool>? include = null)
+    {
+        if (!Directory.Exists(directory)) return;
+        var selected = new List<string>();
+        foreach (var file in Directory.EnumerateFiles(directory, "*", SearchOption.AllDirectories))
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            if (include is not null && !include(file)) continue;
+            if (extensions is not null &&
+                !extensions.Contains(Path.GetExtension(file), StringComparer.OrdinalIgnoreCase))
+                continue;
+            selected.Add(file);
+        }
+
+        var hashed = new System.Collections.Concurrent.ConcurrentBag<(string Relative, string Hash)>();
+        Parallel.ForEach(selected,
+            new ParallelOptions
+            {
+                CancellationToken = cancellationToken,
+                MaxDegreeOfParallelism = Math.Max(2, Environment.ProcessorCount)
+            },
+            file =>
+            {
+                if (!File.Exists(file)) return;
+                var relative = Path.GetRelativePath(root, file).Replace('\\', '/');
+                hashed.Add((relative, InputValidation.Sha256File(file)));
+            });
+        foreach (var (relative, hash) in hashed) entries[relative] = hash;
+    }
+
+    private static void AddFile(SortedDictionary<string, string> entries, string root, string file,
+        CancellationToken cancellationToken = default)
+    {
+        if (!File.Exists(file)) return;
+        cancellationToken.ThrowIfCancellationRequested();
+        var relative = Path.GetRelativePath(root, file).Replace('\\', '/');
+        entries[relative] = InputValidation.Sha256File(file);
+    }
+
+    private static void AddMappedDirectory(SortedDictionary<string, string> entries, string directory,
+        string identityRoot, CancellationToken cancellationToken)
+    {
+        if (!Directory.Exists(directory))
+            throw new InvalidDataException($"Required product runtime asset directory is missing: {directory}");
+        var tree = FileSystemUtilities.EnumerateRegularTree(directory, cancellationToken,
+            RuntimeAssetsDescription);
+        if (tree.Count == 0)
+            throw new InvalidDataException($"Required product runtime asset directory is empty: {directory}");
+        foreach (var entry in tree)
+        {
+            if (entry.IsEmptyDirectory)
+                entries[$"empty-directory:{identityRoot}/{entry.RelativePath}"] = "";
+            else if (!entry.IsDirectory)
+                entries[$"{identityRoot}/{entry.RelativePath}"] = InputValidation.Sha256File(entry.FullPath);
+        }
+    }
+
+    private static void AddRequiredMappedFile(SortedDictionary<string, string> entries, string file,
+        string identityPath, CancellationToken cancellationToken)
+    {
+        if (!File.Exists(file))
+            throw new InvalidDataException($"Required product runtime asset is missing: {file}");
+        FileSystemUtilities.RejectReparsePoint(new FileInfo(file), RuntimeAssetsDescription);
+        cancellationToken.ThrowIfCancellationRequested();
+        entries[identityPath] = InputValidation.Sha256File(file);
+    }
+
+    private static string BuildIdentity(string version, SortedDictionary<string, string> entries)
+    {
+        var builder = new StringBuilder(version).Append('\n');
+        foreach (var (relative, hash) in entries)
+            builder.Append(relative).Append('|').Append(hash).Append('\n');
+        return Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(builder.ToString())))
+            .ToLowerInvariant();
+    }
+}
+
+/// <summary>
+/// Compile identity plus the two subsets deciding cache reuse: <see cref="Compile"/> is the
+/// authoritative freshness identity, <see cref="Translation"/> decides if the base translation is
+/// still current, <see cref="NativeToolchain"/> decides if compiled objects may still be linked.
+/// </summary>
+internal sealed record ToolkitFingerprintComponents(string Compile, string Translation,
+    string NativeToolchain);
diff --git a/Launcher/WiiCompiled.Setup/UninstallService.cs b/Launcher/WiiCompiled.Setup/UninstallService.cs
new file mode 100644
index 0000000..a76a9e3
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/UninstallService.cs
@@ -0,0 +1,112 @@
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+
+namespace WiiCompiled.Setup;
+
+internal static class UninstallService
+{
+    public static void StartWorker(string installDirectory, bool quiet = false)
+    {
+        var source = Environment.ProcessPath ?? throw new InvalidOperationException("Cannot locate the uninstaller.");
+        var temporary = Path.Combine(Path.GetTempPath(), $"WiiCompiled-Uninstall-{Guid.NewGuid():N}.exe");
+        File.Copy(source, temporary, overwrite: true);
+        var info = new ProcessStartInfo
+        {
+            FileName = temporary,
+            UseShellExecute = false,
+            CreateNoWindow = true,
+            WindowStyle = ProcessWindowStyle.Hidden
+        };
+        info.ArgumentList.Add("--uninstall-worker");
+        info.ArgumentList.Add("--install-dir");
+        info.ArgumentList.Add(Path.GetFullPath(installDirectory));
+        if (quiet) info.ArgumentList.Add("--quiet");
+        _ = Process.Start(info) ?? throw new InvalidOperationException("Could not start the uninstall worker.");
+    }
+
+    public static int RunWorker(string installDirectory, bool quiet)
+    {
+        installDirectory = Path.GetFullPath(installDirectory);
+        Thread.Sleep(750);
+        TryCleanup("remove shortcuts", quiet, ShellIntegration.RemoveAllShortcuts);
+
+        // A portable installation never registered an uninstall entry, and the single machine-wide
+        // key may belong to a normal installation on the same account. Removing it here would
+        // uninstall that one from Windows' point of view.
+        bool? isPortable = null;
+        TryCleanup("determine whether the installation is portable", quiet,
+            () => isPortable = PortableRoot.TryFind(installDirectory) is not null);
+        if (isPortable == false)
+            TryCleanup("remove the Add/Remove Programs entry", quiet,
+                ShellIntegration.UnregisterUninstaller);
+
+        var installation = new Installation(installDirectory);
+        string? configPath = null;
+        TryCleanup("locate the runtime configuration", quiet,
+            () => configPath = RuntimeConfiguration.ResolveConfigPath(installDirectory));
+
+        InstallState? state = null;
+        TryCleanup("read the installation state", quiet,
+            () => state = installation.ReadInstallState());
+
+        if (configPath is not null)
+        {
+            TryCleanup("remove the installed game path from the runtime configuration", quiet,
+                () => RuntimeConfiguration.RemoveDvdRootIfOwned(configPath,
+                    Path.Combine(installDirectory, "GameAssets", "DATA")));
+        }
+
+        // Remove only this install's Retro Rewind setting; leave user-owned paths untouched.
+        if (configPath is not null && !string.IsNullOrEmpty(state?.RetroRewindRoot))
+            TryCleanup("remove the Retro Rewind path from the runtime configuration", quiet,
+                () => RuntimeConfiguration.RemoveRetroRewindRootIfOwned(configPath, state.RetroRewindRoot));
+
+        Exception? lastError = null;
+        for (var attempt = 0; attempt < 20; attempt++)
+        {
+            try
+            {
+                if (Directory.Exists(installDirectory)) Directory.Delete(installDirectory, recursive: true);
+                lastError = null;
+                break;
+            }
+            catch (Exception ex)
+            {
+                lastError = ex;
+                Thread.Sleep(250);
+            }
+        }
+
+        var current = Environment.ProcessPath;
+        if (current is not null) MoveFileEx(current, null, MoveFileFlags.DelayUntilReboot);
+        if (lastError is not null)
+        {
+            if (!quiet)
+                Console.Error.WriteLine("Uninstall could not remove every file. " + lastError.Message);
+            return 1;
+        }
+
+        if (!quiet)
+            Console.Out.WriteLine("WiiCompiled was removed from this computer.");
+        return 0;
+    }
+
+    private static void TryCleanup(string description, bool quiet, Action cleanup)
+    {
+        try
+        {
+            cleanup();
+        }
+        catch (Exception ex)
+        {
+            if (!quiet)
+                Console.Error.WriteLine($"Uninstall could not {description}; continuing. {ex.Message}");
+        }
+    }
+
+    [Flags]
+    private enum MoveFileFlags : uint { DelayUntilReboot = 0x4 }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool MoveFileEx(string existingFileName, string? newFileName, MoveFileFlags flags);
+}
diff --git a/Launcher/WiiCompiled.Setup/WiiCompiled.Setup.csproj b/Launcher/WiiCompiled.Setup/WiiCompiled.Setup.csproj
new file mode 100644
index 0000000..9ea644e
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/WiiCompiled.Setup.csproj
@@ -0,0 +1,17 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0-windows</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <AssemblyName>WiiCompiled.Setup</AssemblyName>
+    <RootNamespace>WiiCompiled.Setup</RootNamespace>
+    <ApplicationManifest>app.manifest</ApplicationManifest>
+    <Version>0.2.13</Version>
+    <Authors>patchzy</Authors>
+    <Product>WiiCompiled</Product>
+    <Description>Command-line installer and launcher for WiiCompiled</Description>
+    <DebugType>embedded</DebugType>
+    <SatelliteResourceLanguages>en</SatelliteResourceLanguages>
+  </PropertyGroup>
+</Project>
diff --git a/Launcher/WiiCompiled.Setup/WorkspaceTimestamps.cs b/Launcher/WiiCompiled.Setup/WorkspaceTimestamps.cs
new file mode 100644
index 0000000..b3a0941
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/WorkspaceTimestamps.cs
@@ -0,0 +1,61 @@
+namespace WiiCompiled.Setup;
+
+
+internal static class WorkspaceTimestamps
+{
+    public static void MarkChangedFiles(string installedWorkspace, string stagedWorkspace,
+        Action<string> diagnostic, CancellationToken cancellationToken = default)
+    {
+        if (!Directory.Exists(installedWorkspace) || !Directory.Exists(stagedWorkspace)) return;
+        installedWorkspace = Path.GetFullPath(installedWorkspace);
+        stagedWorkspace = Path.GetFullPath(stagedWorkspace);
+
+        var stampUtc = DateTime.UtcNow;
+        var changed = 0;
+        var unchanged = 0;
+        foreach (var stagedFile in Directory.EnumerateFiles(stagedWorkspace, "*",
+                     SearchOption.AllDirectories))
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            var relative = Path.GetRelativePath(stagedWorkspace, stagedFile);
+            if (FileUnchanged(Path.Combine(installedWorkspace, relative), stagedFile))
+            {
+                unchanged++;
+                continue;
+            }
+            File.SetLastWriteTimeUtc(stagedFile, stampUtc);
+            changed++;
+        }
+        diagnostic($"Marked {changed} changed workspace file(s) for recompilation; " +
+                   $"{unchanged} unchanged file(s) keep the incremental build cache valid.");
+    }
+
+    private static bool FileUnchanged(string installedFile, string stagedFile)
+    {
+        try
+        {
+            if (!File.Exists(installedFile)) return false;
+            using var installed = File.OpenRead(installedFile);
+            using var staged = File.OpenRead(stagedFile);
+            if (installed.Length != staged.Length) return false;
+            var installedBuffer = new byte[81920];
+            var stagedBuffer = new byte[81920];
+            while (true)
+            {
+                var installedRead = installed.ReadAtLeast(installedBuffer, installedBuffer.Length,
+                    throwOnEndOfStream: false);
+                var stagedRead = staged.ReadAtLeast(stagedBuffer, stagedBuffer.Length,
+                    throwOnEndOfStream: false);
+                if (installedRead != stagedRead) return false;
+                if (installedRead == 0) return true;
+                if (!installedBuffer.AsSpan(0, installedRead)
+                        .SequenceEqual(stagedBuffer.AsSpan(0, stagedRead)))
+                    return false;
+            }
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            return false;
+        }
+    }
+}
diff --git a/Launcher/WiiCompiled.Setup/app.manifest b/Launcher/WiiCompiled.Setup/app.manifest
new file mode 100644
index 0000000..abcca86
--- /dev/null
+++ b/Launcher/WiiCompiled.Setup/app.manifest
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
+  <assemblyIdentity version="1.0.0.0" name="WiiCompiled.Setup" />
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+      <requestedPrivileges>
+        <requestedExecutionLevel level="asInvoker" uiAccess="false" />
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />
+    </application>
+  </compatibility>
+  <application xmlns="urn:schemas-microsoft-com:asm.v3">
+    <windowsSettings>
+      <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
+    </windowsSettings>
+  </application>
+</assembly>
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..fcbb091
--- /dev/null
+++ b/README.md
@@ -0,0 +1,198 @@
+
+# WiiCompiled
+
+A native PC port of Mario Kart Wii, made with static recompilation.
+
+There's no emulator in the loop, no interpreter, no JIT, no PowerPC
+anywhere at runtime.
+
+> [!IMPORTANT]
+> There is no Nintendo code, no assets and no game data anywhere in this project or its releases.
+> You need your own legally dumped copy of the PAL version of the game. Setup only ships the
+> toolchain, the translation runs on your machine against your disc image, and nothing ever gets
+> uploaded.
+
+[What is a github, I just want to play](https://github.com/TeamWheelWizard/WheelWizard/releases/latest)
+
+---
+
+## What it does
+
+**Unlocked framerate with interpolation.** 
+The original game is hard-locked to 60 fps. The runtime can generate interpolated frames in between, so on a
+120/144 Hz monitor things genuinely look smoother.
+
+> [!WARNING]
+> Interpolation is experimental right now and will show artifacts in specific scenarios.
+
+**Any aspect ratio you want.** 
+Drag the window bigger, wider, whatever, the camera adjusts
+live.
+
+**Native rendering via aurora.** 
+The graphics layer is built on
+[aurora](https://github.com/encounter/aurora). Aurora is a source-level GameCube & Wii compatibility layer.
+
+**High internal resolution.** 
+Play at several times the console's resolution.
+
+**Music ducking.** 
+Start playing something else, Spotify, a YouTube video, and
+the game automatically mutes its own music until the other audio stops. Optional, if you'd
+rather it didn't. All audio that shows in your display media controls on your windows pc fall under this.
+
+**An in-game settings bar.** 
+Press **F10** while the game window has focus:
+- Internal resolution
+- FPS counter
+- Controller assignment for all four ports
+- Full per-controller button mapping
+- Volume, instant mute, and the music ducking toggle
+
+Everything you change is saved to `Config.toml` on the spot and restored next launch.
+
+**Real controller support.** 
+Controllers are fed to the game as a GameCube controller.
+The port does NOT pretend to be a Wii Remote or Classic Controller.
+Mappings are positional (`south`, `east`, `west`, `north`) rather than Xbox-labelled, so the
+same config makes sense on Xbox, PlayStation, Nintendo and generic SDL pads alike, and extra
+inputs like paddles, touchpads and share buttons show up when the hardware reports them.
+
+## Requirements
+
+- Windows 10 or 11, 64-bit
+- GPU: GTX 1650 / RX 6400 / Arc A310 or higher
+- CPU: Intel Core i5-8400 / AMD Ryzen 5 2600 (4c/6c, ~3.5GHz+) or higher
+- About 20 GB of free disk space during installation
+- A clean, unmodified **PAL `RMCP01`** disc image of Mario Kart Wii, dumped by you. ISO, GCM,
+  GCZ, CISO, WBFS, WIA and RVZ are accepted.
+
+> [!NOTE]
+> GPU/CPU minimums are set by driver support and D3D12/Vulkan feature requirements, not by the game's actual demands.
+
+Only the clean PAL revision will work. Anything else (other
+regions, patched executables) is rejected outright.
+
+> [!NOTE]
+> Nobody here will tell you where to get the game. Dumping your own disc is on you, and links to
+> game files won't be provided or tolerated.
+
+## Installing
+
+For an easy experience, use [Wheel Wizard](https://github.com/TeamWheelWizard/WheelWizard). Pick your clean PAL `RMCP01`
+image under Settings, turn on **WiiCompiled (beta)**, and hit install from the Home page.
+Wheel Wizard downloads the setup tool from this repo and walks you through install, updates and
+launching. The backend itself is deliberately command-line only, Wheel Wizard is a wrapper around it.
+
+> [!CAUTION]
+> Only take builds from this repository's
+> [Releases](https://github.com/patchzyy/Wiicompiled/releases) page. If someone's sharing an
+> installer through Discord or some random download site, don't touch it!!
+
+## Retro Rewind
+
+[Retro Rewind](https://wiki.tockdom.com/wiki/Retro_Rewind), ZPL's Mario Kart Wii mod distribution,
+can be built as its **own static profile**: instead of applying `Code.pul` as runtime patches,
+the Kamek/Pulsar code is statically translated together with the base game into a separate native
+executable.
+
+Wheel Wizard drives this too.
+
+## Building from source
+
+Owning the game is still required even if you compile everything yourself.
+
+You'll need: .NET 8 SDK, CMake, Ninja, and LLVM/Clang (the shipped build uses LLVM-MinGW targeting
+`x86-64-v3`).
+
+Build the translator:
+
+```powershell
+dotnet build translator/Translator.sln -c Release
+```
+
+The default test suite needs no binaries and no host C++ compiler, so you can hack on the
+translator without any game data around.
+
+For everything beyond that, feeding in your own `main.dol`/`StaticR.rel`, running the
+translation, generating the manifest and build graph, and compiling. see [`translator/README.md`](translator/README.md).
+
+## FAQ
+
+**Is this an emulator?**
+No. Everything is compiled to native code before you ever press play. At runtime there's nothing
+emulating a Wii CPU or GPU.
+
+**Do you provide the game?**
+No. Don't ask. Nothing in this repo or any release contains Nintendo code or assets.
+
+**Why does setup take so long?**
+Because we **don't** ship the translated binary, most other recomp projects do, but we
+don't want to risk it right now, setup has to run a static recompiler over the whole game
+and then throw a C++ compiler at the result. It's a **one-time cost** on your machine.
+
+**Which game version works?**
+Clean PAL `RMCP01`. Other regions and modified executables are **rejected**. Translating
+them against the wrong manifest would give you a subtly broken game that's miserable to debug for us.
+
+**Can I recompile other GameCube/Wii games with it?**
+The translator itself handles DOLs and RELs generically, see
+`projects/examples/generic-dol.yml`. The catch is that a *playable* port also needs a runtime:
+audio, input, GX, everything the game touches.
+
+**The game crashed / stopped with an error.**
+Errors are deliberately loud instead of quietly swallowed. Send a report along with the run log
+from `%LOCALAPPDATA%\WiiCompiled\Logs`.
+
+**Will you fix original bugs?**
+Not in the base game, behavior identical to real hardware is the goal. Only report things where this port differs
+from the original game. As for Retro Rewind, some base-game behavior **is** patched, so if it differs from the
+base game, that's normal. If Retro Rewind behavior differs between Dolphin/Wii and WiiCompiled, open an issue on GitHub.
+
+**How accurate are the physics?**
+100% - this is proven by in-game ghosts. Since ghosts are replay files based on inputs rather
+than tracked positions, matching ghosts prove the physics match across Dolphin/Wii/WiiCompiled.
+
+**Is it done?**
+Not fully. The game is in a state where everything should be playable and the physics do match
+100% with the original game, but compatibility, rendering, networking and performance are all
+actively being worked on. If you do find an issue, we strongly encourage you to open one on
+GitHub so we can take a look at it.
+
+## AI usage
+AI coding tools were used during development of this project. 
+All translated output is verified against real hardware behavior and most importantly, physics accuracy is proven synced across Wii, Dolphin, and WiiCompiled (see FAQ). 
+
+## Credits
+
+- **[aurora](https://github.com/encounter/aurora)** - the GX rendering/windowing backend this
+  project's whole graphics layer sits on. MIT licensed.
+- **[Dawn](https://dawn.googlesource.com/dawn)** - Google's WebGPU implementation, powering
+  aurora's Direct3D, Vulkan and OpenGL backends.
+- **[Dolphin Emulator](https://github.com/dolphin-emu/dolphin)** - an invaluable reference for Wii
+  hardware behavior during development, plus the source of the free DSP coefficient ROM and the
+  unmodified default WiiConnect24 bootstrap tree bundled with the runtime.
+- **[Retro Rewind](https://wiki.tockdom.com/wiki/Retro_Rewind)** by ZPL and team - the mod
+  distribution this project supports.
+- **[Wheel Wizard](https://github.com/TeamWheelWizard/WheelWizard)** - the mod manager this
+  project integrates with as a launch backend.
+- Everyone in the static recompilation community.
+
+Bundled third-party components and their licenses live in
+[`THIRD-PARTY-NOTICES.md`](THIRD-PARTY-NOTICES.md).
+
+
+## License
+
+WiiCompiled is free software: you can redistribute it and/or modify it under the terms of the
+[GNU General Public License, version 3](LICENSE) as published by the Free Software Foundation.
+
+WiiCompiled is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+General Public License for more details.
+
+Any mkwii distribution making use of WiiCompiled must be licensed under GPL v3.0.
+
+Not affiliated with, endorsed by, or associated with Nintendo. Mario Kart Wii is a trademark of
+Nintendo. No Nintendo intellectual property is contained in, distributed with, or obtainable
+through this project.
diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md
new file mode 100644
index 0000000..88fccb5
--- /dev/null
+++ b/THIRD-PARTY-NOTICES.md
@@ -0,0 +1,195 @@
+# Third-Party Notices
+
+WiiCompiled itself is licensed under the GNU General Public License v3.0
+(see [`LICENSE`](LICENSE)). It incorporates, links against, or redistributes the third-party
+components listed below. Each remains under its own license and copyright.
+
+Nothing listed here is Nintendo intellectual property. This project ships no game code, assets,
+or data of any kind - see the [README](README.md).
+
+---
+
+## Bundled in this repository
+
+### aurora - MIT
+
+Copyright (c) 2022 Luke Street.
+Source: <https://github.com/encounter/aurora> - vendored in `aurora-main/`, license text at
+`aurora-main/LICENSE`.
+
+Aurora itself vendors:
+
+- **magic_enum** 0.7.2 - MIT, Copyright (c) 2019-2021 Daniil Goncharov.
+  `aurora-main/include/magic_enum.hpp`.
+  Source: <https://github.com/Neargye/magic_enum>
+- **libogc-derived SRAM structures** - zlib-style license, Copyright (c) Michael Wiedenbauer
+  (shagkur) and Dave Murphy (WinterMute). `aurora-main/lib/card/SRAM.hpp`.
+  Source: <https://github.com/devkitPro/libogc>
+
+> [!NOTE]
+> Upstream aurora ships `assets/screenshot.png`, a rendered frame from a different Nintendo
+> title. It is intentionally omitted from this repository.
+
+### Dolphin Emulator data files - GPL-2.0-or-later
+
+Copyright (c) 2003+ Dolphin Emulator Project.
+Source: <https://github.com/dolphin-emu/dolphin> - license at
+<https://github.com/dolphin-emu/dolphin/blob/master/COPYING>
+
+Two data sets from Dolphin's `Data/Sys` tree are redistributed here under GPL-2.0-or-later:
+
+| File(s) | Upstream path | Notes |
+| --- | --- | --- |
+| `runtime/assets/dsp/dsp_coef.bin` | `Data/Sys/GC/dsp_coef.bin` | Free DSP polyphase-resampling coefficient ROM written by the Dolphin team. 4096 bytes, SHA-256 `D7741279C2E8EC5C5FB318F8FBDD6DE6BF583520D288E836A5383233A4238179`. The runtime verifies this hash at build time. |
+| `runtime/assets/wii/shared2/wc24/**` | `Data/Sys/Wii/shared2/wc24` | Dolphin's unmodified default WiiConnect24 bootstrap tree, used to seed a newly created per-user NAND on first run. It is byte-identical to the upstream directory. `nwc24dl.bin` contains Dolphin's default task list, which references Nintendo endpoints shut down in 2014; `nwc24msg.cfg` contains Dolphin's placeholder account fields, not a real user's account data. |
+
+Neither contains Nintendo executable code or game assets; both are redistributed under
+GPL-2.0-or-later from Dolphin's `Data/Sys` tree.
+
+SHA-256 hashes for the WiiConnect24 bootstrap tree:
+
+| File | SHA-256 |
+| --- | --- |
+| `runtime/assets/wii/shared2/wc24/misc.bin` | `13DD5B6B2682DEFD3B23AFD8E2983D00EDC25BD4DC28A8389380DEE0EC45A4A5` |
+| `runtime/assets/wii/shared2/wc24/nwc24dl.bin` | `057B6F840C19B41CE080318BC7E717E2B910965CE72AB781A7E319017636C38E` |
+| `runtime/assets/wii/shared2/wc24/nwc24fl.bin` | `ED94AF416C47ED3BC2C944EBCD1D734B8935D9697FEB0F7039D8FEA3EC514C18` |
+| `runtime/assets/wii/shared2/wc24/nwc24fls.bin` | `C3A4A5649D6ED2322A0DE98D2258B96A6A1D3C0179854FD21E9835D529736822` |
+| `runtime/assets/wii/shared2/wc24/nwc24msg.cbk` | `7AFEBF33EEB0035397CC74E15E892E700CD2903641D26562F5D46CFBB6171109` |
+| `runtime/assets/wii/shared2/wc24/nwc24msg.cfg` | `7AFEBF33EEB0035397CC74E15E892E700CD2903641D26562F5D46CFBB6171109` |
+| `runtime/assets/wii/shared2/wc24/mbox/Readme.txt` | `E5A888912968050C6C1D46D1C364C324684E1D15AAA62CFE36CF7FCE2C687B21` |
+| `runtime/assets/wii/shared2/wc24/mbox/wc24recv.ctl` | `EFA39268E7071941E4FE429D49C86D73BEE952DF95D91D7909C478DD1BC9050A` |
+| `runtime/assets/wii/shared2/wc24/mbox/wc24recv.mbx` | `DD2AD8C9FB38884523459963BFAEC5D5AEAA5FD20EFCDC209764D461E690E435` |
+| `runtime/assets/wii/shared2/wc24/mbox/wc24send.ctl` | `430C3795F1A0AEB198BF626A4A2FF6D123321D453807DD7B904DC3B74DB35D13` |
+| `runtime/assets/wii/shared2/wc24/mbox/wc24send.mbx` | `C248DC031CE09F7BE1E55956B6F173E79D6A47D913C22A16593C4687325692B7` |
+
+Dolphin was also used extensively as a behavioural reference during development of this project's
+hardware and IOS high-level implementations.
+
+### Dolphin Emulator Riivolution code - GPL-2.0-or-later
+
+Copyright (c) 2021 Dolphin Emulator Project.
+The runtime's Riivolution patch handling is a port of Dolphin's
+`Source/Core/DiscIO/RiivolutionParser.{h,cpp}` and the external-path resolution rules of
+`Source/Core/DiscIO/RiivolutionPatcher.cpp`, adapted in
+`runtime/include/hle/riivolution_contract.h` and `runtime/src/hle/storage/riivolution.cpp`
+(both marked `SPDX-License-Identifier: GPL-2.0-or-later`).
+Source: <https://github.com/dolphin-emu/dolphin>
+
+### pugixml - MIT
+
+Copyright (c) 2006-2025 Arseny Kapoulkine.
+The Riivolution XML reader uses pugixml 1.15, vendored in
+`runtime/third_party/pugixml` from commit `ee86beb30e4973f5feffe3ce63bfa4fbadf72f38`.
+Source and license: <https://github.com/zeux/pugixml>
+
+### Crypto++ 8.9.0 - Boost Software License 1.0 / public domain
+
+Copyright (c) 1995-2019 Wei Dai and contributors.
+The runtime uses Crypto++ for SHA-1 and sect233r1 ECDSA key derivation and signing. Its portable
+sources are vendored in `runtime/third_party/cryptopp`; assembly implementations are disabled.
+Source: <https://github.com/weidai11/cryptopp/tree/CRYPTOPP_8_9_0>. Full license text:
+`runtime/third_party/cryptopp/License.txt`.
+
+### toml11 4.4.0 - MIT
+
+Copyright (c) 2017 Toru Niina.
+The runtime configuration reader and scalar string writer use the single-header distribution,
+vendored in `runtime/third_party/toml11`.
+Source: <https://github.com/ToruNiina/toml11/tree/v4.4.0>. Full license text:
+`runtime/third_party/toml11/LICENSE`.
+
+### YamlDotNet - MIT
+
+Copyright (c) Antoine Aubry and contributors.
+Referenced by `translator/src/Translator.Core`. Source: <https://github.com/aaubry/YamlDotNet>
+
+---
+
+## Fetched at build time and redistributed in release builds
+
+These are pinned in `aurora-main/extern/CMakeLists.txt` and
+`aurora-main/cmake/AuroraDawnProvider.cmake`. They are not stored in this repository; the build
+downloads them, and release installers carry the resulting binaries. Their license texts are
+included in the installer's `licenses/` folder.
+
+| Component | Version | License | Upstream |
+| --- | --- | --- | --- |
+| Dawn (WebGPU) | `v20260603.191052` prebuilt | BSD-3-Clause | <https://dawn.googlesource.com/dawn> |
+| Tint (part of Dawn) | with Dawn | BSD-3-Clause | <https://dawn.googlesource.com/dawn> |
+| DirectXShaderCompiler (`dxcompiler.dll`) | with Dawn | NCSA / University of Illinois Open Source | <https://github.com/microsoft/DirectXShaderCompiler> |
+| SDL | 3.4.4 | zlib | <https://github.com/libsdl-org/SDL> |
+| Abseil | LTS 20240722.0 | Apache-2.0 | <https://github.com/abseil/abseil-cpp> |
+| Dear ImGui | 1.91.9b-docking | MIT | <https://github.com/ocornut/imgui> |
+| {fmt} | 11.1.4 | MIT | <https://github.com/fmtlib/fmt> |
+| xxHash | 0.8.3 | BSD-2-Clause | <https://github.com/Cyan4973/xxHash> |
+| zlib | 1.3.2 | zlib | <https://github.com/madler/zlib> |
+| libpng | 1.6.58 | PNG Reference Library License v2 | <https://github.com/pnggroup/libpng> |
+| FreeType | 2.14.3 | **FreeType License (FTL)** - see below | <https://freetype.org/> |
+| Zstandard | 1.5.7 | **BSD-3-Clause** - see below | <https://github.com/facebook/zstd> |
+| SQLite | 3.51.3 amalgamation | Public domain | <https://sqlite.org/> |
+| Tracy Profiler | pinned commit | BSD-3-Clause | <https://github.com/wolfpld/tracy> |
+| C++/WinRT | - | MIT (Microsoft) | <https://github.com/microsoft/cppwinrt> |
+
+### Dual-licensed components - elections made by this project
+
+- **FreeType** is offered under the FreeType License (FTL) or GPL-2.0. **This project elects the
+  FreeType License.** The FTL requires the following credit, which is given here and reproduced in
+  distributed builds:
+
+  > Portions of this software are copyright © 2026 The FreeType Project (www.freetype.org).
+  > All rights reserved.
+
+- **Zstandard** is offered under BSD-3-Clause or GPL-2.0. **This project elects BSD-3-Clause.**
+  Copyright (c) Meta Platforms, Inc. and affiliates.
+
+## Bundled in the setup executable's toolkit payload
+
+The distributed `WiiCompiled-Setup.exe` carries a build toolkit so that translation and
+compilation can run on a machine with nothing preinstalled. These tools are redistributed
+unmodified, with their license texts, in the installer's `licenses/` folder.
+
+| Component | License | Upstream |
+| --- | --- | --- |
+| llvm-mingw (Clang, LLD, libc++, libunwind, MinGW-w64 runtime) | Apache-2.0 with LLVM Exception; MinGW-w64 runtime under its own permissive terms; bundled GNU utilities under GPL-2.0-or-later or GPL-3.0-or-later | <https://github.com/mstorsjo/llvm-mingw> |
+| CMake | BSD-3-Clause | <https://cmake.org/> |
+| Ninja | Apache-2.0 | <https://ninja-build.org/> |
+| DolphinTool (disc image extraction) | GPL-2.0-or-later | <https://github.com/dolphin-emu/dolphin> |
+| Microsoft Visual C++ Runtime (`vcruntime140.dll`, `vcruntime140_1.dll`, `msvcp140.dll`) | Microsoft redistributable terms | Microsoft Visual Studio |
+| `dxil.dll` | Microsoft redistributable (proprietary signing library) | Microsoft |
+
+> [!IMPORTANT]
+> Several toolkit components are GPL-licensed (DolphinTool, and the GNU utilities inside
+> llvm-mingw). Their complete corresponding source is available from the upstream projects linked
+> above at their pinned versions, and this project will supply it on request for the exact versions
+> shipped in any given release. Pins live in `Launcher/Prepare-PortableTools.ps1` and
+> `Launcher/NativeBuildFlags.ps1`.
+
+---
+
+## Development-only dependencies
+
+Not redistributed in any release artifact.
+
+| Component | License |
+| --- | --- |
+| xUnit.net 2.4.2, xunit.runner.visualstudio 2.4.5 | Apache-2.0 |
+| Microsoft.NET.Test.Sdk 17.6.0 | MIT |
+| coverlet.collector 6.0.0 | MIT |
+| .NET 8 SDK | MIT |
+
+---
+
+## Reference material
+
+Not code, but the documentation this project depends on:
+
+- [WiiBrew](https://wiibrew.org/wiki/) - Wii hardware and IOS documentation.
+- [Custom Mario Kart Wiiki (Tockdom)](https://wiki.tockdom.com/) - Mario Kart Wii file formats and
+  modding documentation.
+- [Retro Rewind](https://wiki.tockdom.com/wiki/Retro_Rewind) by ZPL - the mod distribution this
+  project can build as a static profile. No Retro Rewind content is redistributed here; users
+  supply their own copy.
+
+---
+
+If you believe a component is missing or misattributed here, please open an issue.
diff --git a/aurora-main/.clang-format b/aurora-main/.clang-format
new file mode 100644
index 0000000..c144259
--- /dev/null
+++ b/aurora-main/.clang-format
@@ -0,0 +1,29 @@
+---
+BasedOnStyle: LLVM
+ColumnLimit: 120
+UseTab: Never
+TabWidth: 2
+---
+Language: Cpp
+DerivePointerAlignment: false
+PointerAlignment: Left
+AlignAfterOpenBracket: Align
+AlignConsecutiveAssignments: false
+IndentCaseLabels: false
+AllowShortBlocksOnASingleLine: Always
+AlignOperands: true
+AlignTrailingComments: true
+AlwaysBreakBeforeMultilineStrings: true
+AlwaysBreakTemplateDeclarations: Yes
+BreakConstructorInitializersBeforeComma: true
+AlwaysBreakAfterReturnType: None
+AlwaysBreakAfterDefinitionReturnType: None
+AllowShortFunctionsOnASingleLine: All
+Cpp11BracedListStyle: true
+NamespaceIndentation: None
+BinPackArguments: true
+BinPackParameters: true
+SortIncludes: false
+AccessModifierOffset: -2
+ConstructorInitializerIndentWidth: 0
+ConstructorInitializerAllOnOneLineOrOnePerLine: true
diff --git a/aurora-main/.gitignore b/aurora-main/.gitignore
new file mode 100644
index 0000000..5418932
--- /dev/null
+++ b/aurora-main/.gitignore
@@ -0,0 +1,10 @@
+.buildcache/
+.DS_Store
+.idea/
+.cache/
+.vscode/
+.vs/
+build/
+cmake-build-*/
+CMakeUserPresets.json
+out/
diff --git a/aurora-main/CMakeLists.txt b/aurora-main/CMakeLists.txt
new file mode 100644
index 0000000..8ff456f
--- /dev/null
+++ b/aurora-main/CMakeLists.txt
@@ -0,0 +1,83 @@
+cmake_minimum_required(VERSION 3.25)
+project(aurora LANGUAGES C CXX)
+if (APPLE)
+    enable_language(OBJC)
+endif()
+set(CMAKE_C_STANDARD 11)
+set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+
+option(AURORA_ENABLE_GX "Enable GX implementation and WebGPU renderer" ON)
+option(AURORA_ENABLE_DVD "Enable DVD implementation backed by nod" OFF)  # TODO: need to fix tests
+option(AURORA_ENABLE_CARD "Enable CARD implementation based on kabufuda" ON)
+option(AURORA_CACHE_USE_ZSTD "Compress WebGPU cache entries with zstd" ON)
+
+# Dependency versions
+set(AURORA_DAWN_VERSION "v20260603.191052" CACHE STRING "Dawn version tag (https://github.com/encounter/dawn-build/releases)")
+set(AURORA_SDL3_VERSION "3.4.4" CACHE STRING "SDL3 version tag (https://github.com/libsdl-org/SDL/releases)")
+set(AURORA_NOD_VERSION "v2.0.0-alpha.8" CACHE STRING "nod version tag (https://github.com/encounter/nod/releases)")
+
+# Platform-specific defaults
+if (CMAKE_CROSSCOMPILING)
+  # Cross-compiling: vendor everything, don't use system packages
+  set(_default_provider "vendor")
+  set(_default_linkage "static")
+else ()
+  set(_default_provider "auto")
+  if (WIN32)
+    set(_default_linkage "shared")
+  else ()
+    set(_default_linkage "static")
+  endif ()
+endif ()
+
+# Dawn/WebGPU (if AURORA_ENABLE_GX)
+set(AURORA_DAWN_PROVIDER "${_default_provider}" CACHE STRING
+  "How to provide Dawn: auto, vendor (build from source), system (find_package/imported), package (download prebuilt)")
+set_property(CACHE AURORA_DAWN_PROVIDER PROPERTY STRINGS auto vendor system package)
+set(AURORA_DAWN_LINKAGE "${_default_linkage}" CACHE STRING "Dawn linkage type preference")
+set_property(CACHE AURORA_DAWN_LINKAGE PROPERTY STRINGS shared static)
+
+# SDL3
+set(AURORA_SDL3_PROVIDER "${_default_provider}" CACHE STRING
+  "How to provide SDL3: auto, vendor (build from source), system (find_package/imported), or package (download prebuilt)")
+set_property(CACHE AURORA_SDL3_PROVIDER PROPERTY STRINGS auto vendor system package)
+set(AURORA_SDL3_LINKAGE "${_default_linkage}" CACHE STRING "SDL3 linkage type preference")
+set_property(CACHE AURORA_SDL3_LINKAGE PROPERTY STRINGS shared static)
+
+# nod (if AURORA_ENABLE_DVD)
+set(AURORA_NOD_PROVIDER "${_default_provider}" CACHE STRING
+  "How to provide nod: auto, vendor (build from source), system (find_package/imported), package (download prebuilt)")
+set_property(CACHE AURORA_NOD_PROVIDER PROPERTY STRINGS auto vendor system package)
+set(AURORA_NOD_LINKAGE "${_default_linkage}" CACHE STRING "nod linkage type preference")
+set_property(CACHE AURORA_NOD_LINKAGE PROPERTY STRINGS shared static)
+
+add_subdirectory(extern)
+
+include(cmake/aurora_core.cmake)
+include(cmake/aurora_os.cmake)
+if (AURORA_ENABLE_GX)
+  include(cmake/aurora_gx.cmake)
+  include(cmake/aurora_gd.cmake)
+endif ()
+include(cmake/aurora_pad.cmake)
+include(cmake/aurora_ms.cmake)
+include(cmake/aurora_si.cmake)
+include(cmake/aurora_main.cmake)
+include(cmake/aurora_mtx.cmake)
+include(cmake/aurora_vi.cmake)
+if(AURORA_ENABLE_CARD)
+  include(cmake/aurora_card.cmake)
+endif()
+if (AURORA_ENABLE_DVD)
+  include(cmake/aurora_dvd.cmake)
+endif ()
+
+if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
+  add_subdirectory(examples)
+endif ()
+
+if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND NOT CMAKE_CROSSCOMPILING)
+  enable_testing()
+  add_subdirectory(tests)
+endif ()
diff --git a/aurora-main/LICENSE b/aurora-main/LICENSE
new file mode 100644
index 0000000..baf2790
--- /dev/null
+++ b/aurora-main/LICENSE
@@ -0,0 +1,21 @@
+The MIT License
+
+Copyright (c) 2022 Luke Street
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/aurora-main/README.md b/aurora-main/README.md
new file mode 100644
index 0000000..9d16c77
--- /dev/null
+++ b/aurora-main/README.md
@@ -0,0 +1,46 @@
+<div align="center">
+  <img src="assets/aurora.png" alt="Logo" width="640">
+</div>
+<br/>
+
+Aurora is a source-level GameCube & Wii compatibility layer intended for use with game decompilation projects.
+
+Originally developed for use in [Metaforce](https://github.com/AxioDL/metaforce), a Metroid Prime reverse engineering project.
+It now powers several completed source ports, including [Dusklight](https://github.com/TwilitRealm/dusklight).
+
+### Features
+
+- Application layer using SDL3
+  - Runs on Windows, Linux, macOS, iOS, tvOS, Android
+- GX compatibility layer
+  - Graphics API support: D3D12, Vulkan, Metal
+  - Highly accurate and performant GX implementation
+  - Robust pipeline cache system with "transferable" cache support for releases
+  - Dolphin-compatible texture pack support
+  - Widescreen & resolution scaling support
+  - Custom APIs for offscreen rendering
+- PAD compatibility layer
+  - Utilizes `SDL_Gamepad` for wide controller support, including GameCube controller adapters
+  - Automatically saves and loads controller bindings and port mappings
+  - Gyro & mouse support
+- DVD compatibility layer
+  - Utilizes [nod](https://github.com/encounter/nod) to support all GameCube/Wii disc image types, including RVZ
+- CARD compatibility layer
+  - Full compatibility with Dolphin `.gci` and `.raw` for game saves
+- [Dear ImGui](https://github.com/ocornut/imgui) built-in for simple debug UIs
+
+### Graphics
+
+The GX compatibility layer is built on top of [WebGPU](https://www.w3.org/TR/webgpu/), a cross-platform graphics API
+abstraction layer. WebGPU allows targeting all major platforms simultaneously with minimal overhead. The WebGPU
+implementation used is Chromium's [Dawn](https://dawn.googlesource.com/dawn/).
+
+![Screenshot](assets/screenshot.png)
+
+### Building
+
+See [docs/building.md](docs/building.md) for build instructions, CMake integration, and configuration options.
+
+### License
+
+Aurora is licensed under the [MIT License](LICENSE).
diff --git a/aurora-main/assets/aurora.png b/aurora-main/assets/aurora.png
new file mode 100644
index 0000000..ac897bb
Binary files /dev/null and b/aurora-main/assets/aurora.png differ
diff --git a/aurora-main/cmake/AuroraCopyRuntimeDLLs.cmake b/aurora-main/cmake/AuroraCopyRuntimeDLLs.cmake
new file mode 100644
index 0000000..b4fa166
--- /dev/null
+++ b/aurora-main/cmake/AuroraCopyRuntimeDLLs.cmake
@@ -0,0 +1,55 @@
+include_guard(GLOBAL)
+
+# aurora_copy_runtime_dlls(<executable_target> [<additional_targets>...])
+#
+# POST_BUILD command that copies all TARGET_RUNTIME_DLLS from the given targets
+# next to the executable, plus any extra DLLs that Dawn loads dynamically
+# (dxcompiler.dll, dxil.dll).
+function(aurora_copy_runtime_dlls target)
+  if (NOT WIN32)
+    return()
+  endif ()
+
+  # Copy TARGET_RUNTIME_DLLS for each target
+  foreach (_t IN ITEMS ${target} ${ARGN})
+    add_custom_command(TARGET ${target} POST_BUILD
+        COMMAND ${CMAKE_COMMAND} -E copy_if_different $<TARGET_RUNTIME_DLLS:${_t}> $<TARGET_FILE_DIR:${target}>
+        COMMAND_EXPAND_LISTS
+    )
+  endforeach ()
+
+  # Copy DXC DLLs that Dawn loads via LoadLibrary at runtime
+  if (TARGET dawn::webgpu_dawn)
+    get_target_property(_dawn_loc dawn::webgpu_dawn IMPORTED_LOCATION)
+    if (NOT _dawn_loc)
+      get_target_property(_dawn_loc dawn::webgpu_dawn IMPORTED_LOCATION_RELEASE)
+    endif ()
+    if (_dawn_loc)
+      cmake_path(GET _dawn_loc PARENT_PATH _dawn_bin_dir)
+      foreach (_dll IN ITEMS dxcompiler.dll dxil.dll)
+        if (EXISTS "${_dawn_bin_dir}/${_dll}")
+          add_custom_command(TARGET ${target} POST_BUILD
+              COMMAND ${CMAKE_COMMAND} -E copy_if_different "${_dawn_bin_dir}/${_dll}" $<TARGET_FILE_DIR:${target}>
+          )
+        endif ()
+      endforeach ()
+    endif ()
+  endif ()
+endfunction()
+
+# aurora_install_runtime_dlls(<executable_target> <install_destination>)
+#
+# INSTALL rule that copies all DLLs already placed next to the built target
+# into the install destination.
+function(aurora_install_runtime_dlls target install_destination)
+  if (NOT WIN32)
+    return()
+  endif ()
+
+  install(CODE
+    "file(GLOB _aurora_runtime_dlls \"$<TARGET_FILE_DIR:${target}>/*.dll\")\n\
+if(_aurora_runtime_dlls)\n\
+  file(INSTALL DESTINATION \"${install_destination}\" TYPE FILE FILES \${_aurora_runtime_dlls})\n\
+endif()"
+  )
+endfunction()
diff --git a/aurora-main/cmake/AuroraDawnProvider.cmake b/aurora-main/cmake/AuroraDawnProvider.cmake
new file mode 100644
index 0000000..002344b
--- /dev/null
+++ b/aurora-main/cmake/AuroraDawnProvider.cmake
@@ -0,0 +1,255 @@
+include_guard(GLOBAL)
+
+# Resolve Dawn/WebGPU dependency based on AURORA_DAWN_PROVIDER and AURORA_DAWN_LINKAGE.
+#
+# After this module runs:
+#   - dawn::webgpu_dawn target is available
+#   - dawn::dawncpp_headers target is available (for tests)
+#   - DAWN_ENABLE_* backend variables are set for the target platform
+#   - AURORA_DAWN_IS_SHARED is set to TRUE/FALSE
+
+# When using a non-vendored Dawn, we don't get DAWN_ENABLE_* from its build.
+# Infer from the target platform instead.
+function(_aurora_dawn_set_platform_backends)
+  if (WIN32)
+    set(DAWN_ENABLE_D3D12 ON CACHE INTERNAL "")
+    # Disable D3D11 because this Aurora fork does not support it.
+    set(DAWN_ENABLE_D3D11 OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_VULKAN ON CACHE INTERNAL "")
+    set(DAWN_ENABLE_METAL OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_DESKTOP_GL OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_OPENGLES OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_NULL ON CACHE INTERNAL "")
+  elseif (APPLE)
+    set(DAWN_ENABLE_D3D12 OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_D3D11 OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_VULKAN OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_METAL ON CACHE INTERNAL "")
+    set(DAWN_ENABLE_DESKTOP_GL OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_OPENGLES OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_NULL ON CACHE INTERNAL "")
+  else () # Linux / other
+    set(DAWN_ENABLE_D3D12 OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_D3D11 OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_VULKAN ON CACHE INTERNAL "")
+    set(DAWN_ENABLE_METAL OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_DESKTOP_GL OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_OPENGLES OFF CACHE INTERNAL "")
+    set(DAWN_ENABLE_NULL ON CACHE INTERNAL "")
+  endif ()
+endfunction()
+
+# ── Auto: resolve provider based on platform availability ──
+set(_aurora_dawn_provider "${AURORA_DAWN_PROVIDER}")
+if (_aurora_dawn_provider STREQUAL "auto")
+  # Prebuilt Dawn packages available for: windows-{amd64,arm64}, linux-{x86_64,aarch64}, darwin-{arm64,x86_64}
+  set(_has_package FALSE)
+  if (WIN32 AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|x86_64|ARM64|aarch64)$")
+    set(_has_package TRUE)
+  elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(x86_64|aarch64)$")
+    set(_has_package TRUE)
+  elseif (APPLE AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64|x86_64)$")
+    set(_has_package TRUE)
+  endif ()
+
+  if (_has_package)
+    set(_aurora_dawn_provider "package")
+  else ()
+    set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
+    find_package(Dawn QUIET)
+    set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL OFF)
+    if (Dawn_FOUND)
+      set(_aurora_dawn_provider "system")
+    else ()
+      set(_aurora_dawn_provider "vendor")
+    endif ()
+  endif ()
+  set(AURORA_DAWN_PROVIDER "${_aurora_dawn_provider}" CACHE STRING "" FORCE)
+  message(STATUS "aurora: Dawn auto-resolved provider: ${_aurora_dawn_provider}")
+endif ()
+
+if (_aurora_dawn_provider STREQUAL "vendor")
+  # ── Vendor: FetchContent build from source ──
+  if (NOT TARGET webgpu_dawn)
+    message(STATUS "aurora: Fetching Dawn (provider=vendor, linkage=${AURORA_DAWN_LINKAGE})")
+
+    if (AURORA_DAWN_LINKAGE STREQUAL "shared")
+      set(DAWN_BUILD_MONOLITHIC_LIBRARY SHARED CACHE INTERNAL
+        "Bundle all dawn components into a single shared library.")
+    else ()
+      set(DAWN_BUILD_MONOLITHIC_LIBRARY STATIC CACHE INTERNAL
+        "Bundle all dawn components into a single static library.")
+    endif ()
+    set(DAWN_BUILD_SAMPLES OFF CACHE INTERNAL "Disable Dawn sample applications")
+    set(DAWN_BUILD_BENCHMARKS OFF CACHE INTERNAL "Disable Dawn benchmarks")
+    set(DAWN_SUPPORTS_GLFW_FOR_WINDOWING OFF CACHE INTERNAL "Disable Dawn GLFW windowing")
+    set(DAWN_ENABLE_DESKTOP_GL OFF CACHE INTERNAL "Enable compilation of the OpenGL backend")
+    set(DAWN_ENABLE_OPENGLES OFF CACHE INTERNAL "Enable compilation of the OpenGL ES backend")
+    set(DAWN_FETCH_DEPENDENCIES ON CACHE INTERNAL
+      "Use fetch_dawn_dependencies.py as an alternative to using depot_tools")
+    if (CMAKE_SYSTEM_NAME STREQUAL Linux)
+      set(DAWN_USE_WAYLAND ON CACHE INTERNAL "Enable support for Wayland surface")
+    endif ()
+    set(TINT_BUILD_TESTS OFF CACHE INTERNAL "Build tests")
+    set(TINT_BUILD_CMD_TOOLS OFF CACHE INTERNAL "Build the Tint command line tools")
+    if (NOT DEFINED CMAKE_MSVC_RUNTIME_LIBRARY OR CMAKE_MSVC_RUNTIME_LIBRARY MATCHES "DLL$")
+      set(ABSL_MSVC_STATIC_RUNTIME OFF CACHE INTERNAL "Link static runtime libraries")
+    else ()
+      set(ABSL_MSVC_STATIC_RUNTIME ON CACHE INTERNAL "Link static runtime libraries")
+    endif ()
+
+    include(FetchContent)
+    FetchContent_Declare(dawn
+      URL "https://github.com/google/dawn/archive/refs/tags/${AURORA_DAWN_VERSION}.tar.gz"
+      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      EXCLUDE_FROM_ALL
+    )
+    FetchContent_MakeAvailable(dawn)
+    if (NOT TARGET webgpu_dawn)
+      message(FATAL_ERROR "Failed to make dawn available")
+    endif ()
+  else ()
+    message(STATUS "aurora: Using existing Dawn")
+  endif ()
+
+  if (AURORA_DAWN_LINKAGE STREQUAL "shared")
+    set(AURORA_DAWN_IS_SHARED TRUE PARENT_SCOPE)
+  else ()
+    set(AURORA_DAWN_IS_SHARED FALSE PARENT_SCOPE)
+  endif ()
+
+elseif (_aurora_dawn_provider STREQUAL "system")
+  # ── System: find_package(Dawn) ──
+  message(STATUS "aurora: Using system Dawn (provider=system)")
+  if (NOT Dawn_FOUND)
+    set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
+    find_package(Dawn REQUIRED)
+    set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL OFF)
+  endif ()
+  if (NOT TARGET dawn::webgpu_dawn)
+    message(FATAL_ERROR "find_package(Dawn) succeeded but dawn::webgpu_dawn target not found")
+  endif ()
+  _aurora_dawn_set_platform_backends()
+
+  get_target_property(_dawn_type dawn::webgpu_dawn TYPE)
+  if (_dawn_type STREQUAL "SHARED_LIBRARY")
+    set(AURORA_DAWN_IS_SHARED TRUE PARENT_SCOPE)
+  else ()
+    set(AURORA_DAWN_IS_SHARED FALSE PARENT_SCOPE)
+  endif ()
+
+elseif (_aurora_dawn_provider STREQUAL "package")
+  # ── Package: download prebuilt Dawn install tree ──
+  if (NOT AURORA_DAWN_PACKAGE_URL)
+    string(TOLOWER "${CMAKE_SYSTEM_NAME}" _dawn_system)
+    string(TOLOWER "${CMAKE_SYSTEM_PROCESSOR}" _dawn_arch)
+    if (_dawn_system STREQUAL "windows")
+      if (_dawn_arch STREQUAL "x86_64")
+        set(_dawn_arch "amd64")
+      elseif (_dawn_arch STREQUAL "aarch64")
+        set(_dawn_arch "arm64")
+      endif ()
+    endif ()
+    set(AURORA_DAWN_PACKAGE_URL
+      "https://github.com/encounter/dawn-build/releases/download/${AURORA_DAWN_VERSION}/dawn-${_dawn_system}-${_dawn_arch}.tar.gz")
+
+    # A release asset is mutable: the same tag has already served two different windows-amd64 archives,
+    # and a cached extraction is never re-verified. Pin the digest for the combinations we ship.
+    if (NOT AURORA_DAWN_PACKAGE_URL_HASH
+        AND AURORA_DAWN_VERSION STREQUAL "v20260603.191052"
+        AND _dawn_system STREQUAL "windows" AND _dawn_arch STREQUAL "amd64")
+      set(AURORA_DAWN_PACKAGE_URL_HASH
+        "SHA256=7785373d569b3b0237918ec9c523239f7d0667857c5ea8242e3cdfde95e6aeab")
+    endif ()
+  endif ()
+  message(STATUS "aurora: Fetching prebuilt Dawn package from ${AURORA_DAWN_PACKAGE_URL}")
+
+  set(_dawn_prebuilt_hash_argument "")
+  if (AURORA_DAWN_PACKAGE_URL_HASH)
+    set(_dawn_prebuilt_hash_argument URL_HASH "${AURORA_DAWN_PACKAGE_URL_HASH}")
+  endif ()
+
+  include(FetchContent)
+  FetchContent_Declare(dawn_prebuilt
+    URL "${AURORA_DAWN_PACKAGE_URL}"
+    ${_dawn_prebuilt_hash_argument}
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+  )
+  FetchContent_MakeAvailable(dawn_prebuilt)
+
+  # Detect package layout: may be nested in a subdirectory
+  set(_dawn_pkg_dir "${dawn_prebuilt_SOURCE_DIR}")
+  file(GLOB _dawn_subdirs
+    "${dawn_prebuilt_SOURCE_DIR}/dawn-*"
+    "${dawn_prebuilt_SOURCE_DIR}/Dawn-*"
+  )
+  foreach (_sd IN LISTS _dawn_subdirs)
+    if (IS_DIRECTORY "${_sd}")
+      set(_dawn_pkg_dir "${_sd}")
+      break()
+    endif ()
+  endforeach ()
+  if (IS_DIRECTORY "${dawn_prebuilt_SOURCE_DIR}/dawn-install")
+    set(_dawn_pkg_dir "${dawn_prebuilt_SOURCE_DIR}/dawn-install")
+  endif ()
+
+  # Static Dawn packages may link Threads::Threads
+  find_package(Threads QUIET)
+
+  # Find DawnConfig.cmake in the package
+  set(_dawn_cmake_found FALSE)
+  foreach (_cmake_path
+    "${_dawn_pkg_dir}/lib/cmake/Dawn"
+    "${_dawn_pkg_dir}/lib64/cmake/Dawn"
+    "${_dawn_pkg_dir}/cmake/Dawn"
+    "${_dawn_pkg_dir}/cmake"
+  )
+    if (EXISTS "${_cmake_path}/DawnConfig.cmake")
+      set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
+      find_package(Dawn REQUIRED CONFIG PATHS "${_cmake_path}" NO_DEFAULT_PATH)
+      set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL OFF)
+      set(_dawn_cmake_found TRUE)
+      break()
+    endif ()
+  endforeach ()
+
+  if (NOT _dawn_cmake_found OR NOT TARGET dawn::webgpu_dawn)
+    message(FATAL_ERROR
+      "Dawn package does not contain DawnConfig.cmake.\n"
+      "Searched: ${_dawn_pkg_dir}/{lib,lib64,cmake}/cmake/Dawn/\n"
+      "The package must be a Dawn install tree built with DAWN_ENABLE_INSTALL=ON.")
+  endif ()
+
+  _aurora_dawn_set_platform_backends()
+
+  get_target_property(_dawn_pkg_type dawn::webgpu_dawn TYPE)
+  if (_dawn_pkg_type STREQUAL "SHARED_LIBRARY")
+    set(AURORA_DAWN_IS_SHARED TRUE PARENT_SCOPE)
+
+  else ()
+    set(AURORA_DAWN_IS_SHARED FALSE PARENT_SCOPE)
+  endif ()
+
+else ()
+  message(FATAL_ERROR "Invalid AURORA_DAWN_PROVIDER: ${AURORA_DAWN_PROVIDER} "
+    "(must be auto, vendor, system, or package)")
+endif ()
+
+# Ensure dawn::dawncpp_headers target exists (needed by tests).
+# When Dawn is vendored, this target is created by Dawn's CMake.
+# For package/system providers, create it from the same include dirs.
+if (NOT TARGET dawn::dawncpp_headers)
+  add_library(dawn_dawncpp_headers INTERFACE IMPORTED GLOBAL)
+  get_target_property(_dawn_inc dawn::webgpu_dawn INTERFACE_INCLUDE_DIRECTORIES)
+  if (NOT _dawn_inc)
+    if (TARGET dawn::dawn_public_config)
+      get_target_property(_dawn_inc dawn::dawn_public_config INTERFACE_INCLUDE_DIRECTORIES)
+    endif ()
+  endif ()
+  if (_dawn_inc)
+    target_include_directories(dawn_dawncpp_headers INTERFACE ${_dawn_inc})
+  else ()
+    target_link_libraries(dawn_dawncpp_headers INTERFACE dawn::webgpu_dawn)
+  endif ()
+  add_library(dawn::dawncpp_headers ALIAS dawn_dawncpp_headers)
+endif ()
diff --git a/aurora-main/cmake/AuroraNodProvider.cmake b/aurora-main/cmake/AuroraNodProvider.cmake
new file mode 100644
index 0000000..dbb9a71
--- /dev/null
+++ b/aurora-main/cmake/AuroraNodProvider.cmake
@@ -0,0 +1,150 @@
+include_guard(GLOBAL)
+
+# Resolve nod dependency based on AURORA_NOD_PROVIDER.
+#
+# After this module runs:
+#   - nod::nod target is available
+#
+# AURORA_NOD_LINKAGE controls shared vs static linkage:
+#   - "shared" (default): prefer nod::nod_shared
+#   - "static": prefer nod::nod_static
+
+# ── Auto: resolve provider based on platform availability ──
+set(_aurora_nod_provider "${AURORA_NOD_PROVIDER}")
+if (_aurora_nod_provider STREQUAL "auto")
+  # Prebuilt nod packages available for: windows-x86_64, linux-x86_64, macos-arm64
+  set(_has_package FALSE)
+  if (WIN32 AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64)$")
+    set(_has_package TRUE)
+  elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(x86_64)$")
+    set(_has_package TRUE)
+  elseif (APPLE AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64)$")
+    set(_has_package TRUE)
+  endif ()
+
+  if (_has_package)
+    set(_aurora_nod_provider "package")
+  else ()
+    find_package(nod QUIET CONFIG)
+    if (nod_FOUND)
+      set(_aurora_nod_provider "system")
+    else ()
+      set(_aurora_nod_provider "vendor")
+    endif ()
+  endif ()
+  set(AURORA_NOD_PROVIDER "${_aurora_nod_provider}" CACHE STRING "" FORCE)
+  message(STATUS "aurora: nod auto-resolved provider: ${_aurora_nod_provider}")
+endif ()
+
+if (_aurora_nod_provider STREQUAL "vendor")
+  # ── Vendor: FetchContent + Corrosion build from source ──
+  if (NOT TARGET nod::nod)
+    message(STATUS "aurora: Building nod (provider=vendor, linkage=${AURORA_NOD_LINKAGE})")
+
+    # Corrosion may default to the host Rust target triple (commonly x86_64 on
+    # Windows). Force Rust to i686 for true Win32 builds so nod and its vendored
+    # compression libraries are built for the same architecture as the C/C++ build.
+    if (WIN32 AND CMAKE_SIZEOF_VOID_P EQUAL 4)
+      set(Rust_CARGO_TARGET "i686-pc-windows-msvc" CACHE STRING "Rust target triple" FORCE)
+      set(Rust_RUSTUP_INSTALL_MISSING_TARGET ON CACHE BOOL "Allow Corrosion to install missing Rust targets" FORCE)
+      message(STATUS "aurora: forcing Rust_CARGO_TARGET=${Rust_CARGO_TARGET} for Win32 nod build")
+    endif ()
+
+    # Control whether nod builds shared, static, or both.
+    # Save/restore BUILD_SHARED_LIBS to avoid leaking into other subdirectories.
+    set(_aurora_nod_saved_bsl "${BUILD_SHARED_LIBS}")
+    if (AURORA_NOD_LINKAGE STREQUAL "static")
+      set(BUILD_SHARED_LIBS OFF)
+    else ()
+      set(BUILD_SHARED_LIBS ON)
+    endif ()
+
+    include(FetchContent)
+    FetchContent_Declare(aurora_nod
+      GIT_REPOSITORY "https://github.com/encounter/nod.git"
+      GIT_TAG "${AURORA_NOD_VERSION}"
+      GIT_SHALLOW TRUE
+      EXCLUDE_FROM_ALL
+    )
+
+    FetchContent_MakeAvailable(aurora_nod)
+    set(BUILD_SHARED_LIBS "${_aurora_nod_saved_bsl}")
+    unset(_aurora_nod_saved_bsl)
+    if (NOT TARGET nod::nod)
+      message(FATAL_ERROR "Failed to make nod available")
+    endif ()
+  else ()
+    message(STATUS "aurora: Using existing nod")
+  endif ()
+
+elseif (_aurora_nod_provider STREQUAL "system")
+  # ── System: find preinstalled nod ──
+  message(STATUS "aurora: Using system nod (provider=system, linkage=${AURORA_NOD_LINKAGE})")
+
+  if (NOT nod_FOUND)
+    set(_aurora_nod_saved_bsl "${BUILD_SHARED_LIBS}")
+    if (AURORA_NOD_LINKAGE STREQUAL "static")
+      set(BUILD_SHARED_LIBS OFF)
+    else ()
+      set(BUILD_SHARED_LIBS ON)
+    endif ()
+
+    find_package(nod REQUIRED CONFIG)
+    set(BUILD_SHARED_LIBS "${_aurora_nod_saved_bsl}")
+    unset(_aurora_nod_saved_bsl)
+  endif ()
+  if (NOT TARGET nod::nod)
+    message(FATAL_ERROR "find_package(nod) succeeded but nod::nod target not found")
+  endif ()
+  message(STATUS "aurora: Found nod via find_package(nod)")
+
+elseif (_aurora_nod_provider STREQUAL "package")
+  # ── Package: download prebuilt nod library ──
+  if (NOT AURORA_NOD_PACKAGE_URL)
+    if (WIN32 AND CMAKE_SIZEOF_VOID_P EQUAL 8)
+      set(_nod_platform "windows-x86_64")
+    elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(x86_64|AMD64|amd64)$")
+      set(_nod_platform "linux-x86_64")
+    elseif (APPLE AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(aarch64|arm64|ARM64)$")
+      set(_nod_platform "macos-arm64")
+    else ()
+      message(FATAL_ERROR
+        "AURORA_NOD_PROVIDER=package requires AURORA_NOD_PACKAGE_URL on this platform.\n"
+        "Prebuilt packages: https://github.com/encounter/nod/releases")
+    endif ()
+    set(AURORA_NOD_PACKAGE_URL
+      "https://github.com/encounter/nod/releases/download/${AURORA_NOD_VERSION}/libnod-${_nod_platform}.tar.gz")
+  endif ()
+  message(STATUS "aurora: Fetching prebuilt nod package (provider=package, linkage=${AURORA_NOD_LINKAGE})")
+
+  include(FetchContent)
+  FetchContent_Declare(nod_prebuilt
+    URL "${AURORA_NOD_PACKAGE_URL}"
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    EXCLUDE_FROM_ALL
+  )
+  FetchContent_MakeAvailable(nod_prebuilt)
+
+  # The prebuilt package ships a CMake config that creates nod::nod_shared,
+  # nod::nod_static, and a default nod::nod (based on BUILD_SHARED_LIBS).
+  # Set BUILD_SHARED_LIBS so the config selects the right default target.
+  set(_aurora_nod_saved_bsl "${BUILD_SHARED_LIBS}")
+  if (AURORA_NOD_LINKAGE STREQUAL "static")
+    set(BUILD_SHARED_LIBS OFF)
+  else ()
+    set(BUILD_SHARED_LIBS ON)
+  endif ()
+  find_package(nod REQUIRED CONFIG
+    PATHS "${nod_prebuilt_SOURCE_DIR}"
+    NO_DEFAULT_PATH
+  )
+  set(BUILD_SHARED_LIBS "${_aurora_nod_saved_bsl}")
+  unset(_aurora_nod_saved_bsl)
+  if (NOT TARGET nod::nod)
+    message(FATAL_ERROR "Prebuilt nod package did not provide nod::nod target")
+  endif ()
+
+else ()
+  message(FATAL_ERROR "Invalid AURORA_NOD_PROVIDER: ${AURORA_NOD_PROVIDER} "
+    "(must be auto, vendor, system, or package)")
+endif ()
diff --git a/aurora-main/cmake/AuroraSDL3Provider.cmake b/aurora-main/cmake/AuroraSDL3Provider.cmake
new file mode 100644
index 0000000..458d424
--- /dev/null
+++ b/aurora-main/cmake/AuroraSDL3Provider.cmake
@@ -0,0 +1,149 @@
+include_guard(GLOBAL)
+
+# Resolve SDL3 dependency based on AURORA_SDL3_PROVIDER and AURORA_SDL3_LINKAGE.
+#
+# After this module runs, the variable AURORA_SDL3_TARGET is set to the
+# appropriate target name for use in target_link_libraries() calls.
+
+# Select the SDL3 target matching the requested linkage.
+function(_aurora_sdl3_select_target)
+  if (AURORA_SDL3_LINKAGE STREQUAL "static")
+    if (TARGET SDL3::SDL3-static)
+      set(AURORA_SDL3_TARGET SDL3::SDL3-static CACHE INTERNAL "")
+      message(STATUS "aurora: Using static SDL3")
+      return()
+    elseif (TARGET SDL3::SDL3)
+      message(WARNING "aurora: Static SDL3 requested but only shared is available")
+      set(AURORA_SDL3_TARGET SDL3::SDL3 CACHE INTERNAL "")
+      message(STATUS "aurora: Using shared SDL3")
+      return()
+    endif ()
+  else ()
+    if (TARGET SDL3::SDL3)
+      set(AURORA_SDL3_TARGET SDL3::SDL3 CACHE INTERNAL "")
+      message(STATUS "aurora: Using shared SDL3")
+      return()
+    elseif (TARGET SDL3::SDL3-static)
+      message(WARNING "aurora: Shared SDL3 requested but only static is available")
+      set(AURORA_SDL3_TARGET SDL3::SDL3-static CACHE INTERNAL "")
+      message(STATUS "aurora: Using static SDL3")
+      return()
+    endif ()
+  endif ()
+  message(FATAL_ERROR "No SDL3 target found (looked for SDL3::SDL3 and SDL3::SDL3-static)")
+endfunction()
+
+# ── Auto: resolve provider based on platform availability ──
+set(_aurora_sdl3_provider "${AURORA_SDL3_PROVIDER}")
+if (_aurora_sdl3_provider STREQUAL "auto")
+  # Prebuilt SDL3 packages are available for Windows (MSVC and MinGW)
+  if (WIN32)
+    set(_aurora_sdl3_provider "package")
+  else ()
+    set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
+    find_package(SDL3 QUIET)
+    set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL OFF)
+    if (SDL3_FOUND)
+      set(_aurora_sdl3_provider "system")
+    else ()
+      set(_aurora_sdl3_provider "vendor")
+    endif ()
+  endif ()
+  set(AURORA_SDL3_PROVIDER "${_aurora_sdl3_provider}" CACHE STRING "" FORCE)
+  message(STATUS "aurora: SDL3 auto-resolved provider: ${_aurora_sdl3_provider}")
+endif ()
+
+if (_aurora_sdl3_provider STREQUAL "system")
+  # ── System: find_package(SDL3) ──
+  message(STATUS "aurora: Using system SDL3 (provider=system)")
+  if (NOT SDL3_FOUND)
+    set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
+    find_package(SDL3 REQUIRED)
+    set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL OFF)
+  endif ()
+  _aurora_sdl3_select_target()
+
+elseif (_aurora_sdl3_provider STREQUAL "package")
+  # ── Package: download custom build or official SDL3 development package ──
+  if (NOT AURORA_SDL3_PACKAGE_URL)
+    if (MINGW)
+      # WIN32 is also true for MinGW. Select the matching GNU-ABI package
+      # before considering Visual C++ packages.
+      set(AURORA_SDL3_PACKAGE_URL
+        "https://github.com/libsdl-org/SDL/releases/download/release-${AURORA_SDL3_VERSION}/SDL3-devel-${AURORA_SDL3_VERSION}-mingw.tar.gz")
+    elseif (WIN32)
+      # We have custom builds of SDL3 for Win32 x86/AMD64 with libusb support included
+      if (CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|x86)$")
+        string(TOLOWER "${CMAKE_SYSTEM_PROCESSOR}" _sdl3_arch)
+        set(AURORA_SDL3_PACKAGE_URL
+          "https://github.com/encounter/sdl3-build/releases/download/v${AURORA_SDL3_VERSION}/SDL3-windows-${_sdl3_arch}.tar.gz")
+      else ()
+        set(AURORA_SDL3_PACKAGE_URL
+          "https://github.com/libsdl-org/SDL/releases/download/release-${AURORA_SDL3_VERSION}/SDL3-devel-${AURORA_SDL3_VERSION}-VC.zip")
+      endif ()
+    else ()
+      message(FATAL_ERROR
+        "AURORA_SDL3_PROVIDER=package requires AURORA_SDL3_PACKAGE_URL on non-Windows platforms.\n"
+        "Official SDL3 packages: https://github.com/libsdl-org/SDL/releases")
+    endif ()
+  endif ()
+  message(STATUS "aurora: Fetching prebuilt SDL3 package from ${AURORA_SDL3_PACKAGE_URL}")
+
+  include(FetchContent)
+  FetchContent_Declare(sdl3_prebuilt
+    URL "${AURORA_SDL3_PACKAGE_URL}"
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+  )
+  FetchContent_MakeAvailable(sdl3_prebuilt)
+
+  set(_sdl3_search_paths
+    "${sdl3_prebuilt_SOURCE_DIR}/cmake"
+    "${sdl3_prebuilt_SOURCE_DIR}/lib/cmake/SDL3"
+    "${sdl3_prebuilt_SOURCE_DIR}"
+  )
+  file(GLOB _sdl3_subdirs "${sdl3_prebuilt_SOURCE_DIR}/SDL3-*")
+  foreach (_sd IN LISTS _sdl3_subdirs)
+    list(APPEND _sdl3_search_paths
+      "${_sd}/cmake"
+      "${_sd}/lib/cmake/SDL3"
+      "${_sd}"
+    )
+  endforeach ()
+
+  set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
+  find_package(SDL3 REQUIRED CONFIG PATHS ${_sdl3_search_paths} NO_DEFAULT_PATH)
+  set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL OFF)
+  _aurora_sdl3_select_target()
+
+elseif (_aurora_sdl3_provider STREQUAL "vendor")
+  # ── Vendor: FetchContent build from source ──
+  if (NOT TARGET SDL3-static AND NOT TARGET SDL3-shared)
+    message(STATUS "aurora: Fetching SDL3 (provider=vendor)")
+
+    if (AURORA_SDL3_LINKAGE STREQUAL "static")
+      set(SDL_STATIC ON CACHE BOOL "Build SDL3 static library" FORCE)
+      set(SDL_SHARED OFF CACHE BOOL "Build SDL3 shared library" FORCE)
+    else ()
+      set(SDL_STATIC OFF CACHE BOOL "Build SDL3 static library" FORCE)
+      set(SDL_SHARED ON CACHE BOOL "Build SDL3 shared library" FORCE)
+    endif ()
+    if (WIN32)
+      set(SDL_LIBC ON CACHE BOOL "Use the system C library" FORCE)
+    endif ()
+
+    include(FetchContent)
+    FetchContent_Declare(SDL
+      URL "https://github.com/libsdl-org/SDL/releases/download/release-${AURORA_SDL3_VERSION}/SDL3-${AURORA_SDL3_VERSION}.tar.gz"
+      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      EXCLUDE_FROM_ALL
+    )
+    FetchContent_MakeAvailable(SDL)
+  else ()
+    message(STATUS "aurora: Using existing SDL3")
+  endif ()
+  _aurora_sdl3_select_target()
+
+else ()
+  message(FATAL_ERROR "Invalid AURORA_SDL3_PROVIDER: ${AURORA_SDL3_PROVIDER} "
+    "(must be auto, vendor, system, or package)")
+endif ()
diff --git a/aurora-main/cmake/aurora_card.cmake b/aurora-main/cmake/aurora_card.cmake
new file mode 100644
index 0000000..5eace0f
--- /dev/null
+++ b/aurora-main/cmake/aurora_card.cmake
@@ -0,0 +1,17 @@
+add_library(aurora_card STATIC
+        lib/card/BlockAllocationTable.cpp
+        lib/card/CardRawFile.cpp
+        lib/card/CardGciFolder.cpp
+        lib/card/Directory.cpp
+        lib/card/DolphinCardPath.cpp
+        lib/card/File.cpp
+        lib/card/FileIO.cpp
+        lib/card/SRAM.cpp
+        lib/card/Util.cpp
+        lib/dolphin/card.cpp
+)
+add_library(aurora::card ALIAS aurora_card)
+set_target_properties(aurora_card PROPERTIES FOLDER "aurora")
+
+target_link_libraries(aurora_card PUBLIC aurora::core)
+target_include_directories(aurora_card PRIVATE include)
diff --git a/aurora-main/cmake/aurora_core.cmake b/aurora-main/cmake/aurora_core.cmake
new file mode 100644
index 0000000..3e53a62
--- /dev/null
+++ b/aurora-main/cmake/aurora_core.cmake
@@ -0,0 +1,64 @@
+add_library(aurora_core STATIC
+        lib/aurora.cpp
+        lib/input.cpp
+        lib/window.cpp
+        lib/logging.cpp
+        lib/system_info.cpp
+        lib/system_info.hpp
+)
+add_library(aurora::core ALIAS aurora_core)
+set_target_properties(aurora_core PROPERTIES FOLDER "aurora")
+
+target_compile_definitions(aurora_core PUBLIC AURORA TARGET_PC)
+target_include_directories(aurora_core PUBLIC include)
+target_link_libraries(aurora_core PUBLIC fmt::fmt ${AURORA_SDL3_TARGET} xxhash)
+target_link_libraries(aurora_core PRIVATE absl::btree absl::flat_hash_map sqlite3 TracyClient)
+if (AURORA_ENABLE_GX AND AURORA_CACHE_USE_ZSTD)
+    target_compile_definitions(aurora_core PRIVATE AURORA_CACHE_USE_ZSTD)
+    target_link_libraries(aurora_core PRIVATE libzstd_static)
+endif ()
+
+if (CMAKE_SYSTEM_NAME STREQUAL Windows)
+    # stuff for fetching system info.
+    target_link_libraries(aurora_core PRIVATE ntdll dxgi advapi32 user32)
+elseif (APPLE)
+    target_sources(aurora_core PRIVATE lib/system_info_mac.mm)
+endif ()
+
+if (AURORA_ENABLE_GX)
+    target_sources(aurora_core PRIVATE lib/imgui.cpp)
+    target_link_libraries(aurora_core PUBLIC imgui)
+endif ()
+
+if (AURORA_ENABLE_GX)
+    target_compile_definitions(aurora_core PUBLIC AURORA_ENABLE_GX WEBGPU_DAWN)
+    target_sources(aurora_core PRIVATE lib/webgpu/gpu.cpp lib/webgpu/gpu_cache.cpp lib/dawn/BackendBinding.cpp)
+    target_link_libraries(aurora_core PRIVATE dawn::webgpu_dawn)
+    if (DAWN_ENABLE_VULKAN)
+        target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_VULKAN)
+    endif ()
+    if (DAWN_ENABLE_METAL)
+        target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_METAL)
+        target_sources(aurora_core PRIVATE lib/dawn/MetalBinding.mm)
+        set_source_files_properties(lib/dawn/MetalBinding.mm PROPERTIES COMPILE_FLAGS -fobjc-arc)
+        target_link_options(aurora_core PUBLIC "LINKER:-weak_framework,Metal")
+    endif ()
+    if (DAWN_ENABLE_D3D11)
+        target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_D3D11)
+    endif ()
+    if (DAWN_ENABLE_D3D12)
+        target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_D3D12)
+    endif ()
+    if (DAWN_ENABLE_DESKTOP_GL OR DAWN_ENABLE_OPENGLES)
+        target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_OPENGL)
+        if (DAWN_ENABLE_DESKTOP_GL)
+            target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_DESKTOP_GL)
+        endif ()
+        if (DAWN_ENABLE_OPENGLES)
+            target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_OPENGLES)
+        endif ()
+    endif ()
+    if (DAWN_ENABLE_NULL)
+        target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_NULL)
+    endif ()
+endif ()
diff --git a/aurora-main/cmake/aurora_dvd.cmake b/aurora-main/cmake/aurora_dvd.cmake
new file mode 100644
index 0000000..c95f72e
--- /dev/null
+++ b/aurora-main/cmake/aurora_dvd.cmake
@@ -0,0 +1,10 @@
+include(${CMAKE_CURRENT_SOURCE_DIR}/cmake/AuroraNodProvider.cmake)
+
+add_library(aurora_dvd STATIC lib/dolphin/dvd/dvd.cpp)
+add_library(aurora::dvd ALIAS aurora_dvd)
+set_target_properties(aurora_dvd PROPERTIES FOLDER "aurora")
+
+target_compile_definitions(aurora_dvd PUBLIC AURORA TARGET_PC)
+target_include_directories(aurora_dvd PUBLIC include)
+target_link_libraries(aurora_dvd PUBLIC nod::nod ${AURORA_SDL3_TARGET})
+target_link_libraries(aurora_dvd PRIVATE fmt::fmt)
diff --git a/aurora-main/cmake/aurora_gd.cmake b/aurora-main/cmake/aurora_gd.cmake
new file mode 100644
index 0000000..80bd667
--- /dev/null
+++ b/aurora-main/cmake/aurora_gd.cmake
@@ -0,0 +1,16 @@
+add_library(aurora_gd STATIC
+        lib/dolphin/gd/GDBase.cpp
+        lib/dolphin/gd/GDGeometry.cpp
+        lib/dolphin/gd/GDIndirect.cpp
+        lib/dolphin/gd/GDLight.cpp
+        lib/dolphin/gd/GDPixel.cpp
+        lib/dolphin/gd/GDTev.cpp
+        lib/dolphin/gd/GDTexture.cpp
+        lib/dolphin/gd/GDTransform.cpp
+        lib/dolphin/gd/gd.hpp
+        lib/dolphin/gd/GDAurora.cpp
+)
+add_library(aurora::gd ALIAS aurora_gd)
+set_target_properties(aurora_gd PROPERTIES FOLDER "aurora")
+
+target_link_libraries(aurora_gd PUBLIC aurora::gx)
diff --git a/aurora-main/cmake/aurora_gx.cmake b/aurora-main/cmake/aurora_gx.cmake
new file mode 100644
index 0000000..ff740a7
--- /dev/null
+++ b/aurora-main/cmake/aurora_gx.cmake
@@ -0,0 +1,47 @@
+add_library(aurora_gx STATIC
+        lib/gfx/clear.cpp
+        lib/gfx/common.cpp
+        lib/gfx/depth_peek.cpp
+        lib/gfx/efb_ram_copy.cpp
+        lib/gfx/efb_ram_encoder.cpp
+        lib/gfx/pipeline_cache.cpp
+        lib/gfx/dds_io.cpp
+        lib/gfx/tex_copy_conv.cpp
+        lib/gfx/tex_palette_conv.cpp
+        lib/gfx/texture.cpp
+        lib/gfx/texture_convert.cpp
+        lib/gfx/texture_replacement.cpp
+        lib/gx/command_processor.cpp
+        lib/gx/fifo.cpp
+        lib/gx/frame_interpolation.cpp
+        lib/gx/gx.cpp
+        lib/gx/pipeline.cpp
+        lib/gx/shader.cpp
+        lib/gx/shader_info.cpp
+        lib/dolphin/gx/GXBump.cpp
+        lib/dolphin/gx/GXCull.cpp
+        lib/dolphin/gx/GXCpu2Efb.cpp
+        lib/dolphin/gx/GXDispList.cpp
+        lib/dolphin/gx/GXDraw.cpp
+        lib/dolphin/gx/GXExtra.cpp
+        lib/dolphin/gx/GXFifo.cpp
+        lib/dolphin/gx/GXFrameBuffer.cpp
+        lib/dolphin/gx/GXGeometry.cpp
+        lib/dolphin/gx/GXGet.cpp
+        lib/dolphin/gx/GXLighting.cpp
+        lib/dolphin/gx/GXManage.cpp
+        lib/dolphin/gx/GXPixel.cpp
+        lib/dolphin/gx/GXTev.cpp
+        lib/dolphin/gx/GXTexture.cpp
+        lib/dolphin/gx/GXTransform.cpp
+        lib/dolphin/gx/GXVert.cpp
+        lib/dolphin/gx/GXAurora.cpp
+        lib/gfx/png_io.cpp
+        lib/gfx/png_io.hpp
+)
+add_library(aurora::gx ALIAS aurora_gx)
+set_target_properties(aurora_gx PROPERTIES FOLDER "aurora")
+
+target_link_libraries(aurora_gx PUBLIC aurora::core xxhash)
+target_link_libraries(aurora_gx PRIVATE absl::btree absl::flat_hash_map dawn::webgpu_dawn sqlite3 TracyClient PNG::PNG)
+target_compile_definitions(aurora_gx PRIVATE WEBGPU_DAWN)
diff --git a/aurora-main/cmake/aurora_main.cmake b/aurora-main/cmake/aurora_main.cmake
new file mode 100644
index 0000000..b712164
--- /dev/null
+++ b/aurora-main/cmake/aurora_main.cmake
@@ -0,0 +1,6 @@
+add_library(aurora_main STATIC lib/main.cpp)
+add_library(aurora::main ALIAS aurora_main)
+set_target_properties(aurora_main PROPERTIES FOLDER "aurora")
+
+target_include_directories(aurora_main PUBLIC include)
+target_link_libraries(aurora_main PUBLIC ${AURORA_SDL3_TARGET})
diff --git a/aurora-main/cmake/aurora_ms.cmake b/aurora-main/cmake/aurora_ms.cmake
new file mode 100644
index 0000000..9df3020
--- /dev/null
+++ b/aurora-main/cmake/aurora_ms.cmake
@@ -0,0 +1,7 @@
+add_library(aurora_ms STATIC lib/dolphin/ms/mouse.cpp)
+add_library(aurora::ms ALIAS aurora_ms)
+set_target_properties(aurora_ms PROPERTIES FOLDER "aurora")
+
+target_include_directories(aurora_ms PUBLIC include)
+target_link_libraries(aurora_ms PUBLIC aurora::core)
+target_link_libraries(aurora_ms PRIVATE absl::flat_hash_map)
diff --git a/aurora-main/cmake/aurora_mtx.cmake b/aurora-main/cmake/aurora_mtx.cmake
new file mode 100644
index 0000000..580a942
--- /dev/null
+++ b/aurora-main/cmake/aurora_mtx.cmake
@@ -0,0 +1,12 @@
+add_library(aurora_mtx STATIC
+  lib/dolphin/mtx/mtx.c
+  lib/dolphin/mtx/mtxstack.c
+  lib/dolphin/mtx/mtxvec.c
+  lib/dolphin/mtx/mtx44.c
+  lib/dolphin/mtx/vec.c
+  lib/dolphin/mtx/quat.c
+)
+add_library(aurora::mtx ALIAS aurora_mtx)
+set_target_properties(aurora_mtx PROPERTIES FOLDER "aurora")
+
+target_include_directories(aurora_mtx PUBLIC include)
diff --git a/aurora-main/cmake/aurora_os.cmake b/aurora-main/cmake/aurora_os.cmake
new file mode 100644
index 0000000..77156f1
--- /dev/null
+++ b/aurora-main/cmake/aurora_os.cmake
@@ -0,0 +1,14 @@
+add_library(aurora_os STATIC lib/dolphin/os/OSInit.cpp
+        lib/dolphin/os/OSMemory.cpp
+        lib/dolphin/os/internal.hpp
+        lib/dolphin/os/OSBootInfo.cpp
+        lib/dolphin/os/OSTime.cpp
+        lib/dolphin/os/OSArena.cpp
+        lib/dolphin/os/OSAlloc.cpp
+        lib/dolphin/os/OSAddress.cpp
+        lib/dolphin/AR.cpp)
+add_library(aurora::os ALIAS aurora_os)
+set_target_properties(aurora_os PROPERTIES FOLDER "aurora")
+
+target_include_directories(aurora_os PUBLIC include)
+target_link_libraries(aurora_os PRIVATE aurora::core)
diff --git a/aurora-main/cmake/aurora_pad.cmake b/aurora-main/cmake/aurora_pad.cmake
new file mode 100644
index 0000000..5790fd0
--- /dev/null
+++ b/aurora-main/cmake/aurora_pad.cmake
@@ -0,0 +1,7 @@
+add_library(aurora_pad STATIC lib/dolphin/pad/pad.cpp)
+add_library(aurora::pad ALIAS aurora_pad)
+set_target_properties(aurora_pad PROPERTIES FOLDER "aurora")
+
+target_include_directories(aurora_pad PUBLIC include)
+target_link_libraries(aurora_pad PUBLIC aurora::core aurora::si)
+target_link_libraries(aurora_pad PRIVATE absl::flat_hash_map)
diff --git a/aurora-main/cmake/aurora_si.cmake b/aurora-main/cmake/aurora_si.cmake
new file mode 100644
index 0000000..0682c62
--- /dev/null
+++ b/aurora-main/cmake/aurora_si.cmake
@@ -0,0 +1,7 @@
+add_library(aurora_si STATIC lib/dolphin/si/si.cpp)
+add_library(aurora::si ALIAS aurora_si)
+set_target_properties(aurora_si PROPERTIES FOLDER "aurora")
+
+target_include_directories(aurora_si PUBLIC include)
+target_link_libraries(aurora_si PUBLIC aurora::core)
+target_link_libraries(aurora_si PRIVATE absl::flat_hash_map)
diff --git a/aurora-main/cmake/aurora_vi.cmake b/aurora-main/cmake/aurora_vi.cmake
new file mode 100644
index 0000000..38544af
--- /dev/null
+++ b/aurora-main/cmake/aurora_vi.cmake
@@ -0,0 +1,7 @@
+add_library(aurora_vi STATIC
+        lib/dolphin/vi/vi.cpp
+)
+add_library(aurora::vi ALIAS aurora_vi)
+set_target_properties(aurora_vi PROPERTIES FOLDER "aurora")
+
+target_link_libraries(aurora_vi PUBLIC aurora::core)
diff --git a/aurora-main/docs/building.md b/aurora-main/docs/building.md
new file mode 100644
index 0000000..ca1cabd
--- /dev/null
+++ b/aurora-main/docs/building.md
@@ -0,0 +1,55 @@
+# Building
+
+## Prerequisites
+
+- CMake 3.25 or later
+- A C++20 compatible compiler (Clang, GCC, or MSVC)
+- Git (for cloning)
+
+## Building the Examples
+
+To build Aurora's included examples:
+
+```bash
+git clone https://github.com/encounter/aurora.git
+cd aurora
+mkdir build && cd build
+cmake ..
+cmake --build . --target simple
+```
+
+The `simple` example demonstrates a minimal Aurora application with a blue screen. The built executable will be in `build/examples/simple`.
+
+## Using Aurora in Your Project
+
+Aurora is designed to be integrated as a library in GameCube/Wii decompilation projects.
+
+**CMakeLists.txt example:**
+
+```cmake
+cmake_minimum_required(VERSION 3.25)
+project(your_game)
+
+# Add Aurora as a subdirectory
+add_subdirectory(extern/aurora EXCLUDE_FROM_ALL)
+
+# Create your executable
+add_executable(your_game src/main.c)
+
+# Link against Aurora components
+target_link_libraries(your_game PRIVATE 
+    aurora::core 
+    aurora::gx 
+    aurora::main 
+    aurora::vi
+)
+```
+
+See [examples/simple.c](../examples/simple.c) for a minimal application template.
+
+## CMake Options
+
+- `AURORA_ENABLE_GX` (default: ON) - Enable GX implementation and WebGPU renderer
+- `AURORA_ENABLE_DVD` (default: OFF) - Enable DVD implementation backed by nod
+- `AURORA_ENABLE_CARD` (default: ON) - Enable CARD implementation based on kabufuda
+- `AURORA_CACHE_USE_ZSTD` (default: ON) - Compress WebGPU cache entries with zstd
diff --git a/aurora-main/examples/CMakeLists.txt b/aurora-main/examples/CMakeLists.txt
new file mode 100644
index 0000000..c5977f6
--- /dev/null
+++ b/aurora-main/examples/CMakeLists.txt
@@ -0,0 +1,4 @@
+if (AURORA_ENABLE_GX)
+  add_executable(simple simple.c)
+  target_link_libraries(simple PRIVATE aurora::core aurora::gx aurora::main aurora::vi)
+endif ()
diff --git a/aurora-main/examples/simple.c b/aurora-main/examples/simple.c
new file mode 100644
index 0000000..cb8a6c4
--- /dev/null
+++ b/aurora-main/examples/simple.c
@@ -0,0 +1,90 @@
+#include <aurora/aurora.h>
+#include <aurora/event.h>
+#include <aurora/main.h>
+#include <dolphin/gx.h>
+#include <dolphin/os.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+static void log_callback(AuroraLogLevel level, const char* module, const char* message, unsigned int len) {
+  const char* levelStr;
+  FILE* out = stdout;
+  switch (level) {
+  case LOG_DEBUG:
+    levelStr = "DEBUG";
+    break;
+  case LOG_INFO:
+    levelStr = "INFO";
+    break;
+  case LOG_WARNING:
+    levelStr = "WARNING";
+    break;
+  case LOG_ERROR:
+    levelStr = "ERROR";
+    out = stderr;
+    break;
+  case LOG_FATAL:
+    levelStr = "FATAL";
+    out = stderr;
+    break;
+  }
+  fprintf(out, "[%s: %s;%s]\n", levelStr, module, message);
+  if (level == LOG_FATAL) {
+    fflush(out);
+    abort();
+  }
+}
+
+static void draw() {
+  GXSetCopyClear(
+      (GXColor){
+          .r = 0,
+          .g = 0,
+          .b = 100,
+          .a = 255,
+      },
+      GX_MAX_Z24);
+}
+
+int main(int argc, char* argv[]) {
+  const AuroraConfig config = {
+      .appName = "Demo",
+      .logCallback = &log_callback,
+  };
+  AuroraInfo initInfo = aurora_initialize(argc, argv, &config);
+
+  bool exiting = false;
+  bool paused = false;
+  while (!exiting) {
+    const AuroraEvent* event = aurora_update();
+    while (event != NULL && event->type != AURORA_NONE) {
+      switch (event->type) {
+      case AURORA_EXIT:
+        exiting = true;
+        break;
+      case AURORA_PAUSED:
+        paused = true;
+        break;
+      case AURORA_UNPAUSED:
+        paused = false;
+        break;
+      case AURORA_WINDOW_RESIZED:
+        initInfo.windowSize = event->windowSize;
+        break;
+      default:
+        break;
+      }
+      ++event;
+    }
+    if (exiting || paused || !aurora_begin_frame()) {
+      continue;
+    }
+    draw();
+    aurora_end_frame();
+  }
+
+  aurora_shutdown();
+  return 0;
+}
diff --git a/aurora-main/extern/CMakeLists.txt b/aurora-main/extern/CMakeLists.txt
new file mode 100644
index 0000000..9d77bbb
--- /dev/null
+++ b/aurora-main/extern/CMakeLists.txt
@@ -0,0 +1,310 @@
+include(FetchContent)
+
+# Don't build tests for third party dependencies
+set(BUILD_TESTING OFF CACHE INTERNAL "Build tests")
+set(SKIP_INSTALL_ALL ON)
+if (NOT DEFINED BUILD_SHARED_LIBS)
+  set(_USE_SHARED ON)
+else ()
+  set(_USE_SHARED OFF)
+endif ()
+
+function(aurora_find_package_global)
+  set(_PREV_FIND_PACKAGE_TARGETS_GLOBAL ${CMAKE_FIND_PACKAGE_TARGETS_GLOBAL})
+  set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
+  find_package(${ARGV})
+  set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ${_PREV_FIND_PACKAGE_TARGETS_GLOBAL})
+endfunction()
+
+if (AURORA_ENABLE_GX)
+  include(${CMAKE_CURRENT_SOURCE_DIR}/../cmake/AuroraDawnProvider.cmake)
+endif ()
+
+# Abseil is needed for core libraries. It normally comes via Dawn's vendor build.
+# Otherwise prefer a system package and only fetch it as a last resort.
+if (NOT TARGET absl::flat_hash_map OR NOT TARGET absl::btree)
+  aurora_find_package_global(absl CONFIG QUIET GLOBAL)
+endif ()
+
+if (TARGET absl::flat_hash_map AND TARGET absl::btree)
+  message(STATUS "aurora: Using system/existing abseil")
+else ()
+  message(STATUS "aurora: Fetching abseil-cpp (standalone)")
+  if(NOT DEFINED CMAKE_MSVC_RUNTIME_LIBRARY OR CMAKE_MSVC_RUNTIME_LIBRARY MATCHES "DLL$")
+    set(ABSL_MSVC_STATIC_RUNTIME OFF CACHE INTERNAL "Link static runtime libraries")
+  else()
+    set(ABSL_MSVC_STATIC_RUNTIME ON CACHE INTERNAL "Link static runtime libraries")
+  endif()
+  set(ABSL_PROPAGATE_CXX_STD ON)
+  FetchContent_Declare(abseil-cpp
+    URL https://github.com/abseil/abseil-cpp/archive/refs/tags/20240722.0.tar.gz
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    EXCLUDE_FROM_ALL
+  )
+  FetchContent_MakeAvailable(abseil-cpp)
+  if (NOT TARGET absl::flat_hash_map OR NOT TARGET absl::btree)
+    message(FATAL_ERROR "Failed to make abseil-cpp available")
+  endif ()
+endif ()
+
+include(${CMAKE_CURRENT_SOURCE_DIR}/../cmake/AuroraSDL3Provider.cmake)
+
+if (NOT TARGET xxhash)
+  message(STATUS "aurora: Fetching xxhash")
+  FetchContent_Declare(xxhash
+    URL https://github.com/Cyan4973/xxHash/archive/refs/tags/v0.8.3.tar.gz
+    URL_HASH SHA256=aae608dfe8213dfd05d909a57718ef82f30722c392344583d3f39050c7f29a80
+    SOURCE_SUBDIR cmake_unofficial
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    EXCLUDE_FROM_ALL
+  )
+  set(XXHASH_BUILD_XXHSUM OFF CACHE INTERNAL "Build the xxhsum binary")
+  # xxhash uses CMAKE_DEPENDENT_OPTION(BUILD_SHARED_LIBS ...) which writes
+  # a sticky CACHE INTERNAL entry on reconfigure. Undo it afterward.
+  set(_aurora_xxhash_saved_bsl "${BUILD_SHARED_LIBS}")
+  FetchContent_MakeAvailable(xxhash)
+  unset(BUILD_SHARED_LIBS CACHE)
+  set(BUILD_SHARED_LIBS "${_aurora_xxhash_saved_bsl}")
+  unset(_aurora_xxhash_saved_bsl)
+  if (NOT TARGET xxhash)
+    message(FATAL_ERROR "Failed to make xxhash available")
+  endif ()
+else ()
+  message(STATUS "aurora: Using existing xxhash")
+endif ()
+
+if (NOT TARGET fmt)
+  message(STATUS "aurora: Fetching fmt")
+  FetchContent_Declare(fmt
+    URL https://github.com/fmtlib/fmt/archive/refs/tags/11.1.4.tar.gz
+    URL_HASH SHA256=ac366b7b4c2e9f0dde63a59b3feb5ee59b67974b14ee5dc9ea8ad78aa2c1ee1e
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    EXCLUDE_FROM_ALL
+  )
+  FetchContent_MakeAvailable(fmt)
+  if (NOT TARGET fmt)
+    message(FATAL_ERROR "Failed to make fmt available")
+  endif ()
+else ()
+  message(STATUS "aurora: Using existing fmt")
+endif ()
+
+# fmt 11.1 drops its libc++ transitive includes but still calls malloc/free without <cstdlib>.
+# Force the missing header for fmt and its consumers until the pinned release is updated.
+if (MINGW AND TARGET fmt)
+  target_compile_options(fmt PUBLIC
+    $<$<COMPILE_LANGUAGE:CXX>:-include>
+    $<$<COMPILE_LANGUAGE:CXX>:cstdlib>)
+endif ()
+
+if (AURORA_ENABLE_GX)
+  if (NOT TARGET ZLIB::ZLIB)
+    aurora_find_package_global(ZLIB QUIET)
+  endif ()
+  if (NOT TARGET ZLIB::ZLIB)
+    message(STATUS "aurora: Fetching zlib")
+    set(_AURORA_ZLIB_SHARED ${_USE_SHARED})
+    # ClangCL injects Clang's C headers into the MSVC resource compiler path, and zlib's DLL version
+    # resource then hits syntax rc.exe cannot parse. Use the resource-free static target here.
+    if (MSVC AND CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+      set(_AURORA_ZLIB_SHARED OFF)
+    endif ()
+    set(ZLIB_BUILD_SHARED ${_AURORA_ZLIB_SHARED} CACHE BOOL "Enable building zlib shared library" FORCE)
+    set(ZLIB_BUILD_TESTING OFF CACHE BOOL "Enable Zlib Examples as tests" FORCE)
+    set(ZLIB_INSTALL OFF CACHE BOOL "Enable installation of zlib" FORCE)
+    FetchContent_Declare(
+      ZLIB
+      URL https://github.com/madler/zlib/releases/download/v1.3.2/zlib-1.3.2.tar.gz
+      URL_HASH SHA256=bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16
+      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      EXCLUDE_FROM_ALL
+    )
+    FetchContent_MakeAvailable(ZLIB)
+    if (NOT TARGET ZLIB::ZLIB AND TARGET ZLIB::ZLIBSTATIC)
+      add_library(ZLIB::ZLIB ALIAS zlibstatic)
+    endif ()
+    if (NOT TARGET ZLIB::ZLIB)
+      message(FATAL_ERROR "Failed to make zlib available")
+    endif ()
+    # libpng calls find_package(ZLIB) even when zlib was already provided by FetchContent.
+    file(WRITE "${CMAKE_FIND_PACKAGE_REDIRECTS_DIR}/ZLIBConfig.cmake"
+      "set(ZLIB_FOUND TRUE)\n"
+      "set(ZLIB_INCLUDE_DIR \"${zlib_SOURCE_DIR}\")\n"
+      "set(ZLIB_INCLUDE_DIRS \"${zlib_BINARY_DIR};${zlib_SOURCE_DIR}\")\n"
+    )
+  endif ()
+
+  if (NOT TARGET PNG::PNG)
+    if (TARGET png_shared AND _USE_SHARED)
+      add_library(PNG::PNG ALIAS png_shared)
+    elseif (TARGET png_static)
+      add_library(PNG::PNG ALIAS png_static)
+    else ()
+      aurora_find_package_global(PNG QUIET)
+    endif ()
+  endif ()
+  if (NOT TARGET PNG::PNG)
+    message(STATUS "aurora: Fetching libpng")
+    set(PNG_SHARED ${_USE_SHARED} CACHE BOOL "Build libpng as a shared library" FORCE)
+    set(PNG_TESTS OFF CACHE BOOL "Build the libpng tests" FORCE)
+    set(PNG_TOOLS OFF CACHE BOOL "Build the libpng tools" FORCE)
+    FetchContent_Declare(
+      PNG
+      URL https://github.com/pnggroup/libpng/archive/refs/tags/v1.6.58.tar.gz
+      URL_HASH SHA256=A9D4DF463D36A6E5F9C29BD6F4967312D17E996C1854F3511F833924EB1993CF
+      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      EXCLUDE_FROM_ALL
+    )
+    FetchContent_MakeAvailable(PNG)
+    if (TARGET png_shared AND _USE_SHARED)
+      add_library(PNG::PNG ALIAS png_shared)
+    elseif (TARGET png_static)
+      add_library(PNG::PNG ALIAS png_static)
+    else ()
+      message(FATAL_ERROR "Failed to make libpng available")
+    endif ()
+  else ()
+    message(STATUS "aurora: Using existing libpng")
+  endif ()
+
+  aurora_find_package_global(Freetype QUIET)
+  if (NOT TARGET Freetype::Freetype)
+    message(STATUS "aurora: Fetching Freetype")
+    set(FT_DISABLE_BROTLI ON CACHE BOOL "" FORCE)
+    set(FT_DISABLE_HARFBUZZ ON CACHE BOOL "" FORCE)
+    set(FT_DISABLE_PNG ON CACHE BOOL "" FORCE)
+    FetchContent_Declare(Freetype
+      URL https://files.twilitrealm.dev/freetype-2.14.3.tar.gz
+      URL_HASH SHA256=e61b31ab26358b946e767ed7eb7f4bb2e507da1cfefeb7a8861ace7fd5c899a1
+      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      EXCLUDE_FROM_ALL
+    )
+    FetchContent_MakeAvailable(Freetype)
+    add_library(Freetype::Freetype ALIAS freetype)
+  else ()
+    message(STATUS "aurora: Using existing Freetype")
+  endif ()
+
+  if (NOT TARGET imgui)
+    message(STATUS "aurora: Fetching imgui")
+    FetchContent_Declare(imgui
+      URL https://github.com/ocornut/imgui/archive/refs/tags/v1.91.9b-docking.tar.gz
+      URL_HASH SHA256=466fdef9b18de15f0bb6e288e3d00ffa3d82200ec458ce5e4f724a161d9528a5
+      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      EXCLUDE_FROM_ALL
+    )
+    FetchContent_MakeAvailable(imgui)
+
+    add_library(imgui STATIC
+      ${imgui_SOURCE_DIR}/imgui.cpp
+      ${imgui_SOURCE_DIR}/imgui_demo.cpp
+      ${imgui_SOURCE_DIR}/imgui_draw.cpp
+      ${imgui_SOURCE_DIR}/imgui_tables.cpp
+      ${imgui_SOURCE_DIR}/imgui_widgets.cpp
+      ${imgui_SOURCE_DIR}/misc/cpp/imgui_stdlib.cpp
+    )
+    target_include_directories(imgui PUBLIC ${imgui_SOURCE_DIR})
+
+    add_library(imgui_backends STATIC
+      ${imgui_SOURCE_DIR}/backends/imgui_impl_sdl3.cpp
+      ${imgui_SOURCE_DIR}/backends/imgui_impl_sdlrenderer3.cpp
+      ${imgui_SOURCE_DIR}/backends/imgui_impl_wgpu.cpp
+    )
+    target_compile_definitions(imgui_backends PRIVATE IMGUI_IMPL_WEBGPU_BACKEND_DAWN)
+    target_link_libraries(imgui_backends PRIVATE imgui ${AURORA_SDL3_TARGET} dawn::webgpu_dawn)
+    target_link_libraries(imgui PUBLIC imgui_backends)
+
+    if (TARGET Freetype::Freetype)
+      target_sources(imgui PRIVATE ${imgui_SOURCE_DIR}/misc/freetype/imgui_freetype.cpp)
+      target_compile_definitions(imgui PUBLIC IMGUI_ENABLE_FREETYPE)
+      target_link_libraries(imgui PRIVATE Freetype::Freetype)
+    endif ()
+  else ()
+    message(STATUS "aurora: Using existing imgui")
+  endif ()
+
+  if (TARGET imgui)
+    target_include_directories(imgui PUBLIC ${PROJECT_SOURCE_DIR}/include)
+    target_compile_definitions(imgui PUBLIC IMGUI_USER_CONFIG="aurora/imgui_config.h")
+    target_sources(imgui PRIVATE ${PROJECT_SOURCE_DIR}/lib/imgui_config.cpp)
+    target_link_libraries(imgui PRIVATE ${AURORA_SDL3_TARGET})
+  endif ()
+
+  if (NOT TARGET sqlite3)
+    message(STATUS "aurora: Fetching sqlite3")
+    FetchContent_Declare(sqlite3
+      URL https://sqlite.org/2026/sqlite-amalgamation-3510300.zip
+      URL_HASH SHA256=acb1e6f5d832484bf6d32b681e858c38add8b2acdfd42ac5df24b8afb46552b4
+      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      EXCLUDE_FROM_ALL
+    )
+    FetchContent_MakeAvailable(sqlite3)
+
+    add_library(sqlite3 STATIC ${sqlite3_SOURCE_DIR}/sqlite3.c)
+    target_include_directories(sqlite3 PUBLIC ${sqlite3_SOURCE_DIR})
+  else ()
+    message(STATUS "aurora: Using existing sqlite3")
+  endif ()
+
+  if (AURORA_CACHE_USE_ZSTD)
+    if (NOT TARGET libzstd_static)
+      message(STATUS "aurora: Fetching zstd")
+      set(ZSTD_BUILD_STATIC ON)
+      set(ZSTD_BUILD_SHARED OFF)
+      set(ZSTD_BUILD_PROGRAMS OFF CACHE BOOL "BUILD PROGRAMS" FORCE)
+      set(ZSTD_BUILD_TESTS OFF CACHE BOOL "BUILD TESTS" FORCE)
+
+      if (WIN32 AND CMAKE_C_COMPILER_ID MATCHES "Clang" AND CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+        set(C_FLAG_WALL TRUE CACHE INTERNAL "")
+        set(CXX_FLAG_WALL TRUE CACHE INTERNAL "")
+        set(C_FLAG_WEXTRA TRUE CACHE INTERNAL "")
+        set(CXX_FLAG_WEXTRA TRUE CACHE INTERNAL "")
+        set(C_FLAG_WUNDEF TRUE CACHE INTERNAL "")
+        set(CXX_FLAG_WUNDEF TRUE CACHE INTERNAL "")
+        set(C_FLAG_WSHADOW TRUE CACHE INTERNAL "")
+        set(CXX_FLAG_WSHADOW TRUE CACHE INTERNAL "")
+        set(C_FLAG_WCAST_ALIGN TRUE CACHE INTERNAL "")
+        set(CXX_FLAG_WCAST_ALIGN TRUE CACHE INTERNAL "")
+        set(C_FLAG_WCAST_QUAL TRUE CACHE INTERNAL "")
+        set(CXX_FLAG_WCAST_QUAL TRUE CACHE INTERNAL "")
+        set(C_FLAG_WSTRICT_PROTOTYPES TRUE CACHE INTERNAL "")
+        set(LD_FLAG_WL_Z_NOEXECSTACK FALSE CACHE INTERNAL "")
+        set(C_FLAG_QUNUSED_ARGUMENTS TRUE CACHE INTERNAL "")
+        set(CXX_FLAG_QUNUSED_ARGUMENTS TRUE CACHE INTERNAL "")
+        set(C_FLAG_WA_NOEXECSTACK TRUE CACHE INTERNAL "")
+        set(CXX_FLAG_WA_NOEXECSTACK TRUE CACHE INTERNAL "")
+      endif()
+
+      FetchContent_Declare(zstd
+        URL https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-1.5.7.tar.gz
+        URL_HASH SHA256=eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3
+        DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+        SOURCE_SUBDIR build/cmake
+        EXCLUDE_FROM_ALL
+      )
+      FetchContent_MakeAvailable(zstd)
+    else ()
+      message(STATUS "aurora: Using existing zstd")
+    endif ()
+  endif ()
+endif ()
+
+if (NOT TARGET TracyClient)
+  message(STATUS "aurora: Fetching Tracy")
+
+  # Default to off, users can enable the cache variable if they want to use it.
+  set(TRACY_ENABLE OFF CACHE BOOL "Enable Tracy profiling")
+
+  FetchContent_Declare(
+          tracy
+          URL https://github.com/wolfpld/tracy/archive/a64b9a20294d59421a2f57aeca3c6383d8c48169.tar.gz
+          URL_HASH SHA256=24d342b5127d7f659dc3cf94f24347b348cc736f25b17a691fd7f69541937658
+          DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+          EXCLUDE_FROM_ALL
+  )
+  FetchContent_MakeAvailable(tracy)
+
+  if (NOT TARGET TracyClient)
+    message(FATAL_ERROR "Failed to make TracyClient available")
+  endif ()
+endif ()
diff --git a/aurora-main/include/aurora/aurora.h b/aurora-main/include/aurora/aurora.h
new file mode 100644
index 0000000..c3f70d2
--- /dev/null
+++ b/aurora-main/include/aurora/aurora.h
@@ -0,0 +1,172 @@
+#ifndef AURORA_AURORA_H
+#define AURORA_AURORA_H
+
+#ifdef __cplusplus
+#include <cstddef>
+#include <cstdint>
+
+extern "C" {
+#else
+#include "stdbool.h"
+#include "stddef.h"
+#include "stdint.h"
+#endif
+
+typedef enum {
+  BACKEND_AUTO,
+  BACKEND_D3D11,
+  BACKEND_D3D12,
+  BACKEND_METAL,
+  BACKEND_VULKAN,
+  BACKEND_OPENGL,
+  BACKEND_OPENGLES,
+  BACKEND_WEBGPU,
+  BACKEND_NULL,
+} AuroraBackend;
+
+typedef enum {
+  LOG_DEBUG,
+  LOG_INFO,
+  LOG_WARNING,
+  LOG_ERROR,
+  LOG_FATAL,
+} AuroraLogLevel;
+
+typedef enum {
+  AURORA_DISPLAY_MODE_WINDOWED,
+  AURORA_DISPLAY_MODE_BORDERLESS,
+  AURORA_DISPLAY_MODE_EXCLUSIVE,
+} AuroraDisplayMode;
+
+typedef struct {
+  int32_t x;
+  int32_t y;
+} AuroraWindowPos;
+
+typedef struct {
+  uint32_t width;
+  uint32_t height;
+
+  /**
+   * Width of the main GX framebuffer.
+   */
+  uint32_t fb_width;
+
+  /**
+   * Height of the main GX framebuffer.
+   */
+  uint32_t fb_height;
+
+  /**
+   * The size of the framebuffer used to present to the operating system.
+   * May differ from fb_width if Aurora is instructed to force an aspect ratio or resolution configuration.
+   */
+  uint32_t native_fb_width;
+
+  /**
+   * The size of the framebuffer used to present to the operating system.
+   * May differ from fb_height if Aurora is instructed to force an aspect ratio or resolution configuration.
+   */
+  uint32_t native_fb_height;
+  float scale;
+} AuroraWindowSize;
+
+typedef struct SDL_Window SDL_Window;
+typedef struct AuroraEvent AuroraEvent;
+
+typedef void (*AuroraLogCallback)(AuroraLogLevel level, const char* module, const char* message, unsigned int len);
+typedef void (*AuroraImGuiInitCallback)(const AuroraWindowSize* size);
+
+typedef struct {
+  const char* appName;
+  const char* userPath;
+  const char* cachePath;
+  // Read-only application resources. Defaults to SDL_GetBasePath(), which is
+  // where release builds place initial_pipeline_cache.db.
+  const char* resourcesPath;
+  AuroraBackend desiredBackend;
+  uint32_t msaa;
+  uint16_t maxTextureAnisotropy;
+  // No vsync knob exists: the swapchain is always configured for a
+  // non-blocking present mode (Immediate, else Mailbox). See best_present_mode.
+  bool startFullscreen;
+  bool allowJoystickBackgroundEvents;
+  bool pauseOnFocusLost;
+  bool allowTextureReplacements;
+  bool allowTextureDumps;
+  bool disableCopyFilter;
+  // When false, Aurora centers the first window. When true, windowPosX/Y are restored verbatim,
+  // including negative coordinates on monitors left of or above the primary display.
+  bool hasWindowPosition;
+  int32_t windowPosX;
+  int32_t windowPosY;
+  uint32_t windowWidth;
+  uint32_t windowHeight;
+  void* iconRGBA8;
+  uint32_t iconWidth;
+  uint32_t iconHeight;
+  AuroraLogCallback logCallback;
+  AuroraLogLevel logLevel;
+  AuroraImGuiInitCallback imGuiInitCallback;
+
+  /*
+   * The size of the GameCube's main memory, or MEM1 on the Wii.
+   * Note that it will not be allocated at the exact 0x80000000 address, as that cannot be guaranteed.
+   * This can be set to 0 to disable allocating this region.
+   */
+  uint32_t mem1Size;
+
+  /*
+   * The size of the GameCube's ARAM, or MEM2 on the Wii.
+   * This can be set to 0 to disable allocating this region.
+   */
+  uint32_t mem2Size;
+
+  // Optional directory for the portable GX pipeline database. When null, the
+  // database is stored in cachePath with Dawn's machine-specific cache.
+  const char* pipelineCachePath;
+} AuroraConfig;
+
+typedef struct {
+  AuroraBackend backend;
+  const char* userPath;
+  const char* cachePath;
+  SDL_Window* window;
+  AuroraWindowSize windowSize;
+} AuroraInfo;
+
+AuroraInfo aurora_initialize(int argc, char* argv[], const AuroraConfig* config);
+void aurora_shutdown();
+const AuroraEvent* aurora_update();
+bool aurora_begin_frame();
+void aurora_end_frame();
+typedef void (*AuroraFrameWorkerWaitCallback)();
+// Called from the producer thread at bounded intervals while Aurora waits for
+// the asynchronous frame worker. The callback must not enter Aurora.
+void aurora_set_frame_worker_wait_callback(AuroraFrameWorkerWaitCallback callback);
+void aurora_wait_for_frame_worker();
+bool aurora_wait_for_frame_worker_for(uint32_t timeoutMicros);
+// Absolute schedule for the next sealed frame, on steady_clock: baseNanos anchors the group and
+// intervalNanos is the period, so slot k of N+1 fires at base + k*interval/(N+1). Zeros clear it.
+void aurora_set_present_schedule(uint64_t baseNanos, uint64_t intervalNanos);
+// Reports whether the frame about to be sealed met its display boundary. Interpolation sizes its
+// slot group from this, backing off after misses. Only paced presents may report.
+void aurora_report_producer_paced(bool paced);
+void aurora_request_frame_capture(uint32_t frame, const char* outputPath);
+bool aurora_flush_efb_copies_to_ram();
+bool aurora_flush_efb_copy_to_ram(void* dest);
+
+void aurora_set_log_level(AuroraLogLevel level);
+void aurora_set_pause_on_focus_lost(bool value);
+void aurora_set_background_input(bool value);
+void aurora_set_display_mode(AuroraDisplayMode mode);
+AuroraDisplayMode aurora_get_display_mode();
+
+AuroraBackend aurora_get_backend();
+const AuroraBackend* aurora_get_available_backends(size_t* count);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/aurora/dvd.h b/aurora-main/include/aurora/dvd.h
new file mode 100644
index 0000000..4a7f53b
--- /dev/null
+++ b/aurora-main/include/aurora/dvd.h
@@ -0,0 +1,27 @@
+#ifndef AURORA_DVD_H
+#define AURORA_DVD_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdbool.h>
+#include <dolphin/types.h>
+
+/**
+ * Open a GC/Wii disc image for use by the DVD API.
+ * Must be called before DVDInit().
+ * Returns true on success, false on failure.
+ */
+bool aurora_dvd_open(const char* disc_path);
+
+/**
+ * Close the disc image and free all resources.
+ */
+void aurora_dvd_close(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/aurora/event.h b/aurora-main/include/aurora/event.h
new file mode 100644
index 0000000..46ebf40
--- /dev/null
+++ b/aurora-main/include/aurora/event.h
@@ -0,0 +1,44 @@
+#ifndef AURORA_EVENT_H
+#define AURORA_EVENT_H
+
+#include "aurora.h"
+
+#include <SDL3/SDL_events.h>
+#include <SDL3/SDL_joystick.h>
+
+#ifdef __cplusplus
+#include <cstdint>
+
+extern "C" {
+#else
+#include "stdint.h"
+#endif
+
+typedef enum {
+  AURORA_NONE,
+  AURORA_EXIT,
+  AURORA_SDL_EVENT,
+  AURORA_WINDOW_MOVED,
+  AURORA_WINDOW_RESIZED,
+  AURORA_CONTROLLER_ADDED,
+  AURORA_CONTROLLER_REMOVED,
+  AURORA_PAUSED,
+  AURORA_UNPAUSED,
+  AURORA_DISPLAY_SCALE_CHANGED,
+} AuroraEventType;
+
+struct AuroraEvent {
+  AuroraEventType type;
+  union {
+    SDL_Event sdl;
+    AuroraWindowPos windowPos;
+    AuroraWindowSize windowSize;
+    SDL_JoystickID controller;
+  };
+};
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/aurora/gfx.h b/aurora-main/include/aurora/gfx.h
new file mode 100644
index 0000000..f58252f
--- /dev/null
+++ b/aurora-main/include/aurora/gfx.h
@@ -0,0 +1,97 @@
+#ifndef AURORA_GFX_H
+#define AURORA_GFX_H
+
+#ifdef __cplusplus
+#include <cstddef>
+#include <cstdint>
+
+extern "C" {
+#else
+#include "stddef.h"
+#include "stdint.h"
+#endif
+
+#ifndef NDEBUG
+#define AURORA_GFX_DEBUG_GROUPS
+#endif
+
+void aurora_push_debug_group(const char* label);
+void aurora_pop_debug_group();
+
+typedef struct {
+  uint32_t queuedPipelines;
+  uint32_t createdPipelines;
+  uint32_t drawCallCount;
+  uint32_t mergedDrawCallCount;
+  uint32_t lastVertSize;
+  uint32_t lastUniformSize;
+  uint32_t lastIndexSize;
+  uint32_t lastStorageSize;
+  uint32_t lastTextureUploadSize;
+  uint32_t presentedFrameCount;
+  uint32_t interpolatedFrameCount;
+} AuroraStats;
+
+typedef struct {
+  uint64_t totalPresentCount;
+  uint32_t sampleCount;
+  double framesPerSecond;
+  double averageFrameTimeMs;
+  double p95FrameTimeMs;
+  double jitterMs;
+  // framesPerSecond with duplicated presentation slots scaled out, so this is the rate of frames
+  // that carried new motion. Equal to framesPerSecond when every slot replayed real interpolation.
+  double effectiveFramesPerSecond;
+} AuroraPresentTiming;
+
+const AuroraStats* aurora_get_stats();
+void aurora_get_present_timing(AuroraPresentTiming* timing);
+
+// Interpolation health: the per-frame fields describe the last sealed frame, the counters
+// accumulate since it was configured. This answers "output FPS dropped but the game held 60".
+typedef struct {
+  uint32_t targetFps;          // configured target, 0 when interpolation is off
+  uint32_t targetSamples;      // slots the pacing controller currently aims for
+  uint32_t activeSamples;      // slots latched for the latest sealed frame
+  uint32_t candidates;         // perspective draws in the latest sealed frame
+  uint32_t matchable;          // candidates whose identity also existed last frame
+  uint32_t matches;            // draws matched to the previous frame
+  uint32_t eligible;           // latest frame inserted interpolated slots
+  uint32_t replaySafe;         // latest frame could replay its command stream
+  uint64_t framesSealed;
+  uint64_t framesLowMatch;
+  uint64_t framesReplayUnsafe;
+  uint64_t slotReductions;
+  uint64_t lateSealDrops;
+} AuroraFrameInterpolationDiagnostics;
+
+void aurora_get_frame_interpolation_diagnostics(AuroraFrameInterpolationDiagnostics* diagnostics);
+
+// Generates transform-interpolated perspective frames between consecutive 60 Hz logical frames.
+// Supported targets are 0 (off), 120, 180 and 240. Guest simulation and VI timing are unchanged.
+void aurora_set_frame_interpolation_fps(uint32_t targetFps);
+uint32_t aurora_get_frame_interpolation_fps();
+
+// Newly encountered GX pipelines compile on the bounded worker queue. Draws whose pipeline is not
+// ready are skipped rather than stalling submission, and pick it up once compilation finishes.
+void aurora_set_skip_unready_pipelines(bool enabled);
+bool aurora_get_skip_unready_pipelines();
+uint32_t aurora_get_queued_pipeline_count();
+
+// Controls whether display copies bypass the Wii's vertical copy filter.
+void aurora_set_disable_copy_filter(bool disabled);
+bool aurora_get_disable_copy_filter();
+
+// Guest-RAM write tracking. `generation` changes whenever guest RAM covering a host range was
+// written (or returns AURORA_GUEST_WRITE_UNTRACKED); `notify` reports writes aurora made itself.
+#define AURORA_GUEST_WRITE_UNTRACKED UINT64_MAX
+typedef uint64_t (*AuroraGuestWriteGenerationCallback)(const void* hostPtr, size_t size);
+typedef void (*AuroraGuestWriteNotifyCallback)(const void* hostPtr, size_t size);
+void aurora_set_guest_write_hooks(AuroraGuestWriteGenerationCallback generation,
+                                  AuroraGuestWriteNotifyCallback notify);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/aurora/imgui.h b/aurora-main/include/aurora/imgui.h
new file mode 100644
index 0000000..77eba9a
--- /dev/null
+++ b/aurora-main/include/aurora/imgui.h
@@ -0,0 +1,20 @@
+#ifndef AURORA_IMGUI_H
+#define AURORA_IMGUI_H
+
+#include <imgui.h>
+
+#ifdef __cplusplus
+#include <cstdint>
+
+extern "C" {
+#else
+#include "stdint.h"
+#endif
+
+ImTextureID aurora_imgui_add_texture(uint32_t width, uint32_t height, const void* rgba8);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/aurora/imgui_config.h b/aurora-main/include/aurora/imgui_config.h
new file mode 100644
index 0000000..3e62e59
--- /dev/null
+++ b/aurora-main/include/aurora/imgui_config.h
@@ -0,0 +1,13 @@
+#pragma once
+
+#define IMGUI_DISABLE_DEFAULT_FILE_FUNCTIONS 1
+
+typedef struct SDL_IOStream SDL_IOStream;
+typedef SDL_IOStream* ImFileHandle;
+typedef unsigned long long ImU64;
+
+ImFileHandle ImFileOpen(const char* filename, const char* mode);
+bool ImFileClose(ImFileHandle file);
+ImU64 ImFileGetSize(ImFileHandle file);
+ImU64 ImFileRead(void* data, ImU64 size, ImU64 count, ImFileHandle file);
+ImU64 ImFileWrite(const void* data, ImU64 size, ImU64 count, ImFileHandle file);
diff --git a/aurora-main/include/aurora/main.h b/aurora-main/include/aurora/main.h
new file mode 100644
index 0000000..68ee67c
--- /dev/null
+++ b/aurora-main/include/aurora/main.h
@@ -0,0 +1,16 @@
+#ifndef AURORA_MAIN_H
+#define AURORA_MAIN_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int aurora_main(int argc, char* argv[]);
+
+#ifdef __cplusplus
+}
+#endif
+
+#define main aurora_main
+
+#endif
diff --git a/aurora-main/include/aurora/math.hpp b/aurora-main/include/aurora/math.hpp
new file mode 100644
index 0000000..cb15cf1
--- /dev/null
+++ b/aurora-main/include/aurora/math.hpp
@@ -0,0 +1,254 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+#ifndef AURORA_VEC2_EXTRA
+#define AURORA_VEC2_EXTRA
+#endif
+#ifndef AURORA_VEC3_EXTRA
+#define AURORA_VEC3_EXTRA
+#endif
+#ifndef AURORA_VEC4_EXTRA
+#define AURORA_VEC4_EXTRA
+#endif
+#ifndef AURORA_MAT4X4_EXTRA
+#define AURORA_MAT4X4_EXTRA
+#endif
+
+#ifndef __has_attribute
+#define __has_attribute(x) 0
+#endif
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+#if __has_attribute(vector_size) && !defined(__clang__)
+#define USE_GCC_VECTOR_EXTENSIONS
+#endif
+
+namespace aurora {
+template <typename T>
+struct Vec2 {
+  T x{};
+  T y{};
+
+  constexpr Vec2() = default;
+  constexpr Vec2(T x, T y) : x(x), y(y) {}
+  AURORA_VEC2_EXTRA
+
+  bool operator==(const Vec2& rhs) const { return x == rhs.x && y == rhs.y; }
+  bool operator!=(const Vec2& rhs) const { return !(*this == rhs); }
+};
+template <typename T>
+struct Vec3 {
+  T x{};
+  T y{};
+  T z{};
+
+  constexpr Vec3() = default;
+  constexpr Vec3(T x, T y, T z) : x(x), y(y), z(z) {}
+  AURORA_VEC3_EXTRA
+
+  bool operator==(const Vec3& rhs) const { return x == rhs.x && y == rhs.y && z == rhs.z; }
+  bool operator!=(const Vec3& rhs) const { return !(*this == rhs); }
+};
+template <typename T>
+struct Vec4 {
+#ifdef USE_GCC_VECTOR_EXTENSIONS
+  typedef T Vt __attribute__((vector_size(sizeof(T) * 4)));
+  Vt m;
+#else
+  using Vt = T[4];
+  Vt m;
+#endif
+
+  constexpr Vec4() = default;
+  constexpr Vec4(Vt m) : m(m) {}
+  constexpr Vec4(T x, T y, T z, T w) : m{x, y, z, w} {}
+  // For Vec3 with padding
+  constexpr Vec4(T x, T y, T z) : m{x, y, z, {}} {}
+  // For Vec3 -> Vec4
+  constexpr Vec4(Vec3<T> v, T w) : m{v.x, v.y, v.z, w} {}
+  AURORA_VEC4_EXTRA
+
+  inline Vec4& operator=(const Vec4& other) {
+    memcpy(&m, &other.m, sizeof(Vt));
+    return *this;
+  }
+
+  [[nodiscard]] inline T& x() { return m[0]; }
+  [[nodiscard]] inline T x() const { return m[0]; }
+  [[nodiscard]] inline T& y() { return m[1]; }
+  [[nodiscard]] inline T y() const { return m[1]; }
+  [[nodiscard]] inline T& z() { return m[2]; }
+  [[nodiscard]] inline T z() const { return m[2]; }
+  [[nodiscard]] inline T& w() { return m[3]; }
+  [[nodiscard]] inline T w() const { return m[3]; }
+  [[nodiscard]] inline T& operator[](size_t i) { return m[i]; }
+  [[nodiscard]] inline T operator[](size_t i) const { return m[i]; }
+
+  template <size_t x, size_t y, size_t z, size_t w>
+  [[nodiscard]] constexpr Vec4 shuffle() const {
+    static_assert(x < 4 && y < 4 && z < 4 && w < 4);
+#if defined(USE_GCC_VECTOR_EXTENSIONS) && __has_builtin(__builtin_shuffle)
+    typedef int Vi __attribute__((vector_size(16)));
+    return __builtin_shuffle(m, Vi{x, y, z, w});
+#else
+    return {m[x], m[y], m[z], m[w]};
+#endif
+  }
+
+  bool operator==(const Vec4& rhs) const {
+#if defined(USE_GCC_VECTOR_EXTENSIONS) && __has_builtin(__builtin_reduce_and)
+    return __builtin_reduce_and(m == rhs.m) != 0;
+#else
+    return m[0] == rhs.m[0] && m[1] == rhs.m[1] && m[2] == rhs.m[2] && m[3] == rhs.m[3];
+#endif
+  }
+  bool operator!=(const Vec4& rhs) const { return !(*this == rhs); }
+};
+template <typename T>
+[[nodiscard]] Vec4<T> operator+(const Vec4<T>& a, const Vec4<T>& b) {
+#ifdef USE_GCC_VECTOR_EXTENSIONS
+  return a.m + b.m;
+#else
+  return {a.m[0] + b.m[0], a.m[1] + b.m[1], a.m[2] + b.m[2], a.m[3] + b.m[3]};
+#endif
+}
+template <typename T>
+[[nodiscard]] Vec4<T> operator*(const Vec4<T>& a, const Vec4<T>& b) {
+#ifdef USE_GCC_VECTOR_EXTENSIONS
+  return a.m * b.m;
+#else
+  return {a.m[0] * b.m[0], a.m[1] * b.m[1], a.m[2] * b.m[2], a.m[3] * b.m[3]};
+#endif
+}
+template <typename T>
+struct Mat3x2 {
+  Vec2<T> m0{};
+  Vec2<T> m1{};
+  Vec2<T> m2{};
+
+  constexpr Mat3x2() = default;
+  constexpr Mat3x2(const Vec2<T>& m0, const Vec2<T>& m1, const Vec2<T>& m2) : m0(m0), m1(m1), m2(m2) {}
+
+  bool operator==(const Mat3x2& rhs) const { return m0 == rhs.m0 && m1 == rhs.m1 && m2 == rhs.m2; }
+  bool operator!=(const Mat3x2& rhs) const { return !(*this == rhs); }
+};
+template <typename T>
+struct Mat4x2 {
+  Vec2<T> m0{};
+  Vec2<T> m1{};
+  Vec2<T> m2{};
+  Vec2<T> m3{};
+
+  constexpr Mat4x2() = default;
+  constexpr Mat4x2(const Vec2<T>& m0, const Vec2<T>& m1, const Vec2<T>& m2, const Vec2<T>& m3)
+  : m0(m0), m1(m1), m2(m2), m3(m3) {}
+
+  inline Mat4x2 transpose() const {
+    return {
+        {m0.x, m2.x},
+        {m0.y, m2.y},
+        {m1.x, m3.x},
+        {m1.y, m3.y},
+    };
+  }
+
+  bool operator==(const Mat4x2& rhs) const { return m0 == rhs.m0 && m1 == rhs.m1 && m2 == rhs.m2 && m3 == rhs.m3; }
+  bool operator!=(const Mat4x2& rhs) const { return !(*this == rhs); }
+};
+template <typename T>
+struct Mat2x4 {
+  Vec4<T> m0{};
+  Vec4<T> m1{};
+
+  constexpr Mat2x4() = default;
+  constexpr Mat2x4(const Vec4<T>& m0, const Vec4<T>& m1, const Vec4<T>& m2) : m0(m0), m1(m1) {}
+
+  bool operator==(const Mat2x4& rhs) const { return m0 == rhs.m0 && m1 == rhs.m1; }
+  bool operator!=(const Mat2x4& rhs) const { return !(*this == rhs); }
+};
+static_assert(sizeof(Mat2x4<float>) == 32);
+template <typename T>
+struct Mat4x4;
+template <typename T>
+struct Mat3x4 {
+  Vec4<T> m0{};
+  Vec4<T> m1{};
+  Vec4<T> m2{};
+
+  constexpr Mat3x4() = default;
+  constexpr Mat3x4(const Vec4<T>& m0, const Vec4<T>& m1, const Vec4<T>& m2) : m0(m0), m1(m1), m2(m2) {}
+
+  [[nodiscard]] Mat4x4<T> to4x4() const;
+  [[nodiscard]] Mat4x4<T> toTransposed4x4() const;
+
+  bool operator==(const Mat3x4& rhs) const { return m0 == rhs.m0 && m1 == rhs.m1 && m2 == rhs.m2; }
+  bool operator!=(const Mat3x4& rhs) const { return !(*this == rhs); }
+};
+static_assert(sizeof(Mat3x4<float>) == 48);
+template <typename T>
+struct Mat4x4 {
+  Vec4<T> m0{};
+  Vec4<T> m1{};
+  Vec4<T> m2{};
+  Vec4<T> m3{};
+
+  constexpr Mat4x4() = default;
+  constexpr Mat4x4(const Vec4<T>& m0, const Vec4<T>& m1, const Vec4<T>& m2, const Vec4<T>& m3)
+  : m0(m0), m1(m1), m2(m2), m3(m3) {}
+  AURORA_MAT4X4_EXTRA
+
+  [[nodiscard]] Mat4x4 transpose() const {
+    return {
+        {m0[0], m1[0], m2[0], m3[0]},
+        {m0[1], m1[1], m2[1], m3[1]},
+        {m0[2], m1[2], m2[2], m3[2]},
+        {m0[3], m1[3], m2[3], m3[3]},
+    };
+  }
+  Mat4x4& operator=(const Mat4x4& other) = default;
+
+  Vec4<T>& operator[](size_t i) { return *(&m0 + i); }
+  const Vec4<T>& operator[](size_t i) const { return *(&m0 + i); }
+
+  bool operator==(const Mat4x4& rhs) const { return m0 == rhs.m0 && m1 == rhs.m1 && m2 == rhs.m2 && m3 == rhs.m3; }
+  bool operator!=(const Mat4x4& rhs) const { return !(*this == rhs); }
+};
+static_assert(sizeof(Mat4x4<float>) == 64);
+template <typename T>
+[[nodiscard]] Mat4x4<T> operator*(const Mat4x4<T>& a, const Mat4x4<T>& b) {
+  Mat4x4<T> out;
+  for (size_t i = 0; i < 4; ++i) {
+    *(&out.m0 + i) = a.m0 * b[i].template shuffle<0, 0, 0, 0>() + a.m1 * b[i].template shuffle<1, 1, 1, 1>() +
+                     a.m2 * b[i].template shuffle<2, 2, 2, 2>() + a.m3 * b[i].template shuffle<3, 3, 3, 3>();
+  }
+  return out;
+}
+template <typename T>
+[[nodiscard]] Mat4x4<T> Mat3x4<T>::to4x4() const {
+  return {
+      {m0[0], m0[1], m0[2], 0.f},
+      {m1[0], m1[1], m1[2], 0.f},
+      {m2[0], m2[1], m2[2], 0.f},
+      {m0[3], m1[3], m2[3], 1.f},
+  };
+}
+template <typename T>
+[[nodiscard]] Mat4x4<T> Mat3x4<T>::toTransposed4x4() const {
+  return Mat4x4<T>{
+      {m0[0], m1[0], m2[0], 0.f},
+      {m0[1], m1[1], m2[1], 0.f},
+      {m0[2], m1[2], m2[2], 0.f},
+      {m0[3], m1[3], m2[3], 1.f},
+  };
+}
+constexpr Mat4x4 Mat4x4_Identity{
+    Vec4{1.f, 0.f, 0.f, 0.f},
+    Vec4{0.f, 1.f, 0.f, 0.f},
+    Vec4{0.f, 0.f, 1.f, 0.f},
+    Vec4{0.f, 0.f, 0.f, 1.f},
+};
+} // namespace aurora
diff --git a/aurora-main/include/aurora/render_size_limits.hpp b/aurora-main/include/aurora/render_size_limits.hpp
new file mode 100644
index 0000000..20d92f3
--- /dev/null
+++ b/aurora-main/include/aurora/render_size_limits.hpp
@@ -0,0 +1,81 @@
+#pragma once
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <limits>
+
+namespace aurora::render_size_limits {
+
+struct Size {
+  uint32_t width;
+  uint32_t height;
+};
+
+// The canvas follows the window aspect however wide it gets, since the presenter stretches it and
+// a cap would distort the UI. Only the portrait side clamps, where the guest cannot fill taller.
+inline constexpr float kMaxDynamicPortraitExpansion = 6.f;
+inline constexpr float kMinDynamicAspect = (16.f / 9.f) / kMaxDynamicPortraitExpansion;
+
+// The adapter limit is an API ceiling, not an allocation budget: a 16384-wide RGBA attachment is
+// near 100 MiB. 8192 plus an 8K-UHD pixel budget keeps 8x 16:9 while avoiding device removal.
+inline constexpr uint32_t kMaxFramebufferDimension = 8192;
+inline constexpr uint64_t kMaxFramebufferPixels = 7680ull * 4320ull;
+
+inline float clamp_dynamic_aspect(float aspect) noexcept {
+  if (!std::isfinite(aspect) || aspect <= 0.f) {
+    return 1.f;
+  }
+  return std::max(aspect, kMinDynamicAspect);
+}
+
+inline Size scale_framebuffer_to_aspect(uint32_t width, uint32_t height, float scale, float requestedAspect) noexcept {
+  if (width == 0 || height == 0 || !std::isfinite(scale) || scale <= 0.f) {
+    return {std::max(width, 1u), std::max(height, 1u)};
+  }
+
+  const auto scaledWidth = std::max(1u, static_cast<uint32_t>(std::lround(static_cast<double>(width) * scale)));
+  const auto scaledHeight = std::max(1u, static_cast<uint32_t>(std::lround(static_cast<double>(height) * scale)));
+  const float aspect = clamp_dynamic_aspect(requestedAspect);
+  if (aspect >= static_cast<float>(width) / static_cast<float>(height)) {
+    return {
+        std::max(1u, static_cast<uint32_t>(std::lround(static_cast<double>(scaledHeight) * aspect))),
+        scaledHeight,
+    };
+  }
+  return {
+      scaledWidth,
+      std::max(1u, static_cast<uint32_t>(std::lround(static_cast<double>(scaledWidth) / aspect))),
+  };
+}
+
+inline Size fit_framebuffer_to_budget(uint32_t width, uint32_t height, uint32_t adapterMaxDimension) noexcept {
+  if (width == 0 || height == 0) {
+    return {width, height};
+  }
+
+  uint32_t dimensionLimit = kMaxFramebufferDimension;
+  if (adapterMaxDimension != 0 && adapterMaxDimension != std::numeric_limits<uint32_t>::max()) {
+    dimensionLimit = std::min(dimensionLimit, adapterMaxDimension);
+  }
+  dimensionLimit = std::max(dimensionLimit, 1u);
+
+  double fitScale = 1.0;
+  fitScale = std::min(fitScale, static_cast<double>(dimensionLimit) / static_cast<double>(width));
+  fitScale = std::min(fitScale, static_cast<double>(dimensionLimit) / static_cast<double>(height));
+
+  const double requestedPixels = static_cast<double>(width) * static_cast<double>(height);
+  if (requestedPixels > static_cast<double>(kMaxFramebufferPixels)) {
+    fitScale = std::min(fitScale, std::sqrt(static_cast<double>(kMaxFramebufferPixels) / requestedPixels));
+  }
+
+  if (fitScale >= 1.0) {
+    return {width, height};
+  }
+  return {
+      std::max(1u, static_cast<uint32_t>(std::floor(static_cast<double>(width) * fitScale))),
+      std::max(1u, static_cast<uint32_t>(std::floor(static_cast<double>(height) * fitScale))),
+  };
+}
+
+} // namespace aurora::render_size_limits
diff --git a/aurora-main/include/dolphin/ai.h b/aurora-main/include/dolphin/ai.h
new file mode 100644
index 0000000..84db334
--- /dev/null
+++ b/aurora-main/include/dolphin/ai.h
@@ -0,0 +1,50 @@
+#ifndef _DOLPHIN_AI_H_
+#define _DOLPHIN_AI_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*AISCallback)(u32 count);
+typedef void (*AIDCallback)();
+
+#define AI_STREAM_START 1
+#define AI_STREAM_STOP 0
+
+#define AI_SAMPLERATE_32KHZ  0
+#define AI_SAMPLERATE_48KHZ  1
+
+AIDCallback AIRegisterDMACallback(AIDCallback callback);
+void AIInitDMA(u32 start_addr, u32 length);
+BOOL AIGetDMAEnableFlag(void);
+void AIStartDMA(void);
+void AIStopDMA(void);
+u32 AIGetDMABytesLeft(void);
+u32 AIGetDMAStartAddr(void);
+u32 AIGetDMALength(void);
+BOOL AICheckInit(void);
+AISCallback AIRegisterStreamCallback(AISCallback callback);
+u32 AIGetStreamSampleCount(void);
+void AIResetStreamSampleCount(void);
+void AISetStreamTrigger(u32 trigger);
+u32 AIGetStreamTrigger(void);
+void AISetStreamPlayState(u32 state);
+u32 AIGetStreamPlayState(void);
+void AISetDSPSampleRate(u32 rate);
+u32 AIGetDSPSampleRate(void);
+void AISetStreamSampleRate(u32 rate);
+u32 AIGetStreamSampleRate(void);
+void AISetStreamVolLeft(u8 vol);
+u8 AIGetStreamVolLeft(void);
+void AISetStreamVolRight(u8 vol);
+u8 AIGetStreamVolRight(void);
+void AIInit(u8* stack);
+void AIReset(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/ar.h b/aurora-main/include/dolphin/ar.h
new file mode 100644
index 0000000..bf09f24
--- /dev/null
+++ b/aurora-main/include/dolphin/ar.h
@@ -0,0 +1,79 @@
+#ifndef _DOLPHIN_AR_H_
+#define _DOLPHIN_AR_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*ARQCallback)(uintptr_t pointerToARQRequest);
+
+struct ARQRequest {
+    /* 0x00 */ struct ARQRequest *next;
+    /* 0x04 */ u32 owner;
+    /* 0x08 */ u32 type;
+    /* 0x0C */ u32 priority;
+    /* 0x10 */ u32 source;
+    /* 0x14 */ u32 dest;
+    /* 0x18 */ u32 length;
+    /* 0x1C */ ARQCallback callback;
+};
+
+#define ARQ_DMA_ALIGNMENT 32
+
+#define ARAM_DIR_MRAM_TO_ARAM 0x00
+#define ARAM_DIR_ARAM_TO_MRAM 0x01
+
+#define ARStartDMARead(mmem, aram, len) \
+    ARStartDMA(ARAM_DIR_ARAM_TO_MRAM, mmem, aram, len)
+#define ARStartDMAWrite(mmem, aram, len) \
+    ARStartDMA(ARAM_DIR_MRAM_TO_ARAM, mmem, aram, len)
+
+typedef struct ARQRequest ARQRequest;
+
+#define ARQ_TYPE_MRAM_TO_ARAM ARAM_DIR_MRAM_TO_ARAM
+#define ARQ_TYPE_ARAM_TO_MRAM ARAM_DIR_ARAM_TO_MRAM
+
+#define ARQ_PRIORITY_LOW  0
+#define ARQ_PRIORITY_HIGH 1
+
+// AR
+ARQCallback ARRegisterDMACallback(ARQCallback callback);
+u32 ARGetDMAStatus(void);
+void ARStartDMA(u32 type, u32 mainmem_addr, u32 aram_addr, u32 length);
+u32 ARAlloc(u32 length);
+u32 ARFree(u32* length);
+BOOL ARCheckInit(void);
+u32 ARInit(u32* stack_index_addr, u32 num_entries);
+void ARReset(void);
+void ARSetSize(void);
+u32 ARGetBaseAddress(void);
+u32 ARGetSize(void);
+u32 ARGetInternalSize(void);
+void ARClear(u32 flag);
+
+/**
+ * Aurora extension: gets the memory address where ARAM is stored, for direct access.
+ */
+void* ARGetStorageAddress();
+
+// ARQ
+void ARQInit(void);
+void ARQReset(void);
+void ARQPostRequest(ARQRequest* request, u32 owner, u32 type, u32 priority, uintptr_t source, uintptr_t dest, u32 length, ARQCallback callback);
+void ARQRemoveRequest(ARQRequest* request);
+void ARQRemoveOwnerRequest(u32 owner);
+void ARQFlushQueue(void);
+void ARQSetChunkSize(u32 size);
+u32 ARQGetChunkSize(void);
+BOOL ARQCheckInit(void);
+
+u16 __ARGetInterruptStatus(void);
+void __ARClearInterrupt(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/base/PPCArch.h b/aurora-main/include/dolphin/base/PPCArch.h
new file mode 100644
index 0000000..8bdd0dd
--- /dev/null
+++ b/aurora-main/include/dolphin/base/PPCArch.h
@@ -0,0 +1,542 @@
+#ifndef _DOLPHIN_PPCARCH
+#define _DOLPHIN_PPCARCH
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define CTR     9
+#define XER     1
+#define LR      8
+
+#define UPMC1   937
+#define UPMC2   938
+#define UPMC3   941
+#define UPMC4   942
+
+#define USIA    939
+
+#define UMMCR0  936
+#define UMMCR1  940
+
+#define HID0    1008
+#define HID1    1009
+
+#define PVR     287
+
+#define IBAT0U  528
+#define IBAT0L  529
+#define IBAT1U  530
+#define IBAT1L  531
+#define IBAT2U  532
+#define IBAT2L  533
+#define IBAT3U  534
+#define IBAT3L  535
+
+#define DBAT0U  536
+#define DBAT0L  537
+#define DBAT1U  538
+#define DBAT1L  539
+#define DBAT2U  540
+#define DBAT2L  541
+#define DBAT3U  542
+#define DBAT3L  543
+
+#define SDR1    25
+
+#define SPRG0   272
+#define SPRG1   273
+#define SPRG2   274
+#define SPRG3   275
+
+#define DAR     19
+#define DSISR   18
+
+#define SRR0    26
+#define SRR1    27
+
+#define EAR     282
+
+#define DABR    1013
+
+#define TBL     284
+#define TBU     285
+
+#define L2CR    1017
+
+#define DEC     22
+
+#define IABR    1010
+
+#define PMC1    953
+#define PMC2    954
+#define PMC3    957
+#define PMC4    958
+
+#define SIA     955
+
+#define MMCR0   952
+#define MMCR1   956
+
+#define THRM1   1020
+#define THRM2   1021
+#define THRM3   1022
+
+#define ICTC    1019
+
+#define GQR0    912
+#define GQR1    913
+#define GQR2    914
+#define GQR3    915
+#define GQR4    916
+#define GQR5    917
+#define GQR6    918
+#define GQR7    919
+
+#define HID2    920
+
+#define WPAR    921
+
+#define DMA_U   922
+#define DMA_L   923
+
+#define MSR_POW         0x00040000  // Power Management
+#define MSR_ILE         0x00010000  // Interrupt Little Endian
+#define MSR_EE          0x00008000  // external interrupt
+#define MSR_PR          0x00004000  // privilege level(should be 0)
+#define MSR_FP          0x00002000  // floating point available
+#define MSR_ME          0x00001000  // machine check enable
+#define MSR_FE0         0x00000800  // floating point exception enable
+#define MSR_SE          0x00000400  // single step trace enable
+#define MSR_BE          0x00000200  // branch trace enable
+#define MSR_FE1         0x00000100  // floating point exception enable
+#define MSR_IP          0x00000040  // Exception prefix
+#define MSR_IR          0x00000020  // instruction relocate
+#define MSR_DR          0x00000010  // data relocate
+#define MSR_PM          0x00000004  // Performance monitor marked mode
+#define MSR_RI          0x00000002  // Recoverable interrupt
+#define MSR_LE          0x00000001  // Little Endian
+
+#define MSR_POW_BIT     13          // Power Management
+#define MSR_ILE_BIT     15          // Interrupt Little Endian
+#define MSR_EE_BIT      16          // external interrupt
+#define MSR_PR_BIT      17          // privilege level (should be 0)
+#define MSR_FP_BIT      18          // floating point available
+#define MSR_ME_BIT      19          // machine check enable
+#define MSR_FE0_BIT     20          // floating point exception enable
+#define MSR_SE_BIT      21          // single step trace enable
+#define MSR_BE_BIT      22          // branch trace enable
+#define MSR_FE1_BIT     23          // floating point exception enable
+#define MSR_IP_BIT      25          // Exception prefix
+#define MSR_IR_BIT      26          // instruction relocate
+#define MSR_DR_BIT      27          // data relocate
+#define MSR_PM_BIT      29          // Performance monitor marked mode
+#define MSR_RI_BIT      30          // Recoverable interrupt
+#define MSR_LE_BIT      31          // Little Endian
+
+/*---------------------------------------------------------------------------*
+    HID0 bits
+ *---------------------------------------------------------------------------*/
+#define HID0_EMCP       0x80000000u  // Enable MCP
+#define HID0_DBP        0x40000000u  // Enable 60x bus address and data parity chk
+#define HID0_EBA        0x20000000u  // Enable 60x address parity checking
+#define HID0_EBD        0x10000000u  // Enable 60x data parity checking
+#define HID0_BCLK       0x08000000u  // CLK_OUT output enable and clk selection
+#define HID0_ECLK       0x02000000u  // CLK_OUT output enable and clk selection
+#define HID0_PAR        0x01000000u  // Disable !ARTRY precharge
+#define HID0_DOZE       0x00800000u  // Doze mode enable
+#define HID0_NAP        0x00400000u  // Nap mode enable
+#define HID0_SLEEP      0x00200000u  // Sleep mode enable
+#define HID0_DPM        0x00100000u  // Dynamic power management enable
+#define HID0_NHR        0x00010000u  // Not hard reset (0 hard reset if s/w set it)
+#define HID0_ICE        0x00008000u  // Instruction cache enable
+#define HID0_DCE        0x00004000u  // Data cache enable
+#define HID0_ILOCK      0x00002000u  // ICache lock
+#define HID0_DLOCK      0x00001000u  // DCache lock
+#define HID0_ICFI       0x00000800u  // ICache flash invalidate
+#define HID0_DCFI       0x00000400u  // DCache flash invalidate
+#define HID0_SPD        0x00000200u  // Speculative cache access enable (0 enable)
+#define HID0_IFEM       0x00000100u  // Enable M bit on bus for Ifetch
+#define HID0_SGE        0x00000080u  // Store gathering enable
+#define HID0_DCFA       0x00000040u  // DCache flush assist - set before a flush
+#define HID0_BTIC       0x00000020u  // Branch target icache enable
+#define HID0_ABE        0x00000008u  // Address bcast enable
+#define HID0_BHT        0x00000004u  // Branch history table enable
+#define HID0_NOOPTI     0x00000001u  // No-op Dcache touch instructions
+
+#define HID0_ICE_BIT    16          // Instruction cache enable
+#define HID0_DCE_BIT    17          // Data cache enable
+#define HID0_ILOCK_BIT  18          // ICache lock
+#define HID0_DLOCK_BIT  19          // DCache lock
+
+#define HID2_LSQE           0x80000000  // L/S quantize enable
+#define HID2_WPE            0x40000000  // Write pipe enable
+#define HID2_PSE            0x20000000  // Paired single enable
+#define HID2_LCE            0x10000000  // Locked cache enable
+
+#define HID2_DCHERR         0x00800000  // ERROR: dcbz_l cache hit
+#define HID2_DNCERR         0x00400000  // ERROR: DMA access to normal cache
+#define HID2_DCMERR         0x00200000  // ERROR: DMA cache miss error
+#define HID2_DQOERR         0x00100000  // ERROR: DMA queue overflow
+#define HID2_DCHEE          0x00080000  // dcbz_l cache hit error enable
+#define HID2_DNCEE          0x00040000  // DMA access to normal cache error enable
+#define HID2_DCMEE          0x00020000  // DMA cache miss error error enable
+#define HID2_DQOEE          0x00010000  // DMA queue overflow error enable
+
+#define HID2_DMAQL_MASK     0x0F000000  // DMA queue length mask
+#define HID2_DMAQL_SHIFT    24          // DMA queue shift
+
+#define HID2_LSQE_BIT       0
+#define HID2_WPE_BIT        1
+#define HID2_PSE_BIT        2
+#define HID2_LCE_BIT        3
+
+#define HID2_DCHERR_BIT     8
+#define HID2_DNCERR_BIT     9
+#define HID2_DCMERR_BIT     10
+#define HID2_DQOERR_BIT     11
+#define HID2_DCHEE_BIT      12
+#define HID2_DNCEE_BIT      13
+#define HID2_DCMEE_BIT      14
+#define HID2_DQOEE_BIT      15
+
+#define GQR_LOAD_SCALE_MASK         0x3F000000  // load scale field
+#define GQR_LOAD_TYPE_MASK          0x00070000  // load type field
+#define GQR_STORE_SCALE_MASK        0x00003F00  // store scale field
+#define GQR_STORE_TYPE_MASK         0x00000007  // store type field
+
+typedef struct
+{
+    u32 _pad0       :2;
+    u32 loadScale   :6;
+    u32 _pad1       :5;
+    u32 loadType    :3;
+    u32 _pad2       :2;
+    u32 storeScale  :6;
+    u32 _pad3       :5;
+    u32 storeType   :3;
+} PPC_GQR_t;
+
+typedef union
+{
+    u32         val;
+    PPC_GQR_t   f;
+} PPC_GQR_u;
+
+
+#define DMA_U_ADDR_MASK             0xFFFFFFE0  // Start addr in memory
+#define DMA_U_LEN_U_MASK            0x0000001F  // lines to transfer (U)
+
+#define DMA_L_LC_ADDR_MASK          0xFFFFFFE0  // Start addr in LC
+#define DMA_L_LOAD                  0x00000010  // 0 - store, 1 - load
+#define DMA_L_STORE                 0x00000000  // 0 - store, 1 - load
+#define DMA_L_LEN_MASK              0x0000000C  // lines to transfer (L)
+#define DMA_L_TRIGGER               0x00000002  // 0 - cmd inactive, 1 - cmd rdy
+#define DMA_L_FLUSH                 0x00000001  // 1 - Flush DMA queue
+
+typedef struct
+{
+    u32 memAddr     :27;
+    u32 dmaLenU     :5;
+} PPC_DMA_U_t;
+
+typedef union
+{
+    u32             val;
+    PPC_DMA_U_t     f;
+} PPC_DMA_U_u;
+
+
+typedef struct
+{
+    u32 lcAddr      :27;
+    u32 dmaLd       :1;
+    u32 dmaLenL     :2;
+    u32 dmaTrigger  :1;
+    u32 dmaFlush    :1;
+} PPC_DMA_L_t;
+
+
+typedef union
+{
+    u32             val;
+    PPC_DMA_L_t     f;
+} PPC_DMA_L_u;
+
+
+#define WPAR_ADDR                   0xFFFFFFE0  // 32byte gather address
+#define WPAR_BNE                    0x00000001  // Buffer not empty (R)
+
+#define SRR1_DMA_BIT                0x00200000
+#define SRR1_L2DP_BIT               0x00100000
+
+#define L2CR_L2E                    0x80000000  // L2 Enable
+#define L2CR_L2PE                   0x40000000  // L2 data parity generation and checking enable
+
+#define L2CR_L2SIZ_256K             0x10000000  // L2 size 256K
+#define L2CR_L2SIZ_512K             0x20000000  // L2 size 512
+#define L2CR_L2SIZ_1M               0x30000000  // L2 size 1M
+
+#define L2CR_L2CLK_1_0              0x02000000  // L2 clock ratio 1
+#define L2CR_L2CLK_1_5              0x04000000  // L2 clock ratio 1.5
+#define L2CR_L2CLK_2_0              0x08000000  // L2 clock ratio 2
+#define L2CR_L2CLK_2_5              0x0A000000  // L2 clock ratio 2.5
+#define L2CR_L2CLK_3_0              0x0C000000  // L2 clock ratio 3
+
+#define L2CR_RAM_FLOW_THRU_BURST    0x00000000  // L2 RAM type flow-through sync. burst SRAM
+#define L2CR_RAM_PIPELINE_BURST     0x01000000  // L2 RAM type pipelined sync. burst SRAM
+#define L2CR_RAM_PIPELINE_LATE      0x01800000  // L2 RAM type pipelined sync. late-write SRAM
+
+#define L2CR_L2DO                   0x00400000  // Data only
+#define L2CR_L2I                    0x00200000  // Global invalidate
+#define L2CR_L2CTL                  0x00100000  // ZZ enable
+#define L2CR_L2WT                   0x00080000  // L2 write through
+#define L2CR_L2TS                   0x00040000  // L2 test support
+
+#define L2CR_L2OH_0_5               0x00000000  // L2 output hold 0.5 ns
+#define L2CR_L2OH_1_0               0x00010000  // L2 output hold 1.0 ns
+
+#define L2CR_L2SL                   0x00008000  // L2 DLL slow
+#define L2CR_L2DF                   0x00004000  // L2 differential clock
+#define L2CR_L2BYP                  0x00002000  // L2 DLL bypass
+#define L2CR_L2CS                   0x00000200  // L2 clock stop
+#define L2CR_L2DRO                  0x00000100  // L2 DLL rollover checkstop enable
+#define L2CR_L2CTR_MASK             0x000000FE  // L2 counter value mask
+#define L2CR_L2IP                   0x00000001  // L2 global invalidate in progress
+
+#define MMCR0_DIS                   0x80000000  // Disables counting unconditionally
+#define MMCR0_DP                    0x40000000  // Disables counting while in supervisor mode
+#define MMCR0_DU                    0x20000000  // Disables counting while in user mode
+#define MMCR0_DMS                   0x10000000  // Disables counting while MSR[PM] is set
+#define MMCR0_DMR                   0x08000000  // Disables counting while MSR[PM] is zero
+#define MMCR0_ENINT                 0x04000000  // Enables performance monitor interrupt signaling
+#define MMCR0_DISCOUNT              0x02000000  // Disables counting of PMCn when a performance monitor interrupt is signaled or...
+#define MMCR0_RTCSELECT_MASK        0x01800000  // 64-bit time base, bit selection enable
+#define MMCR0_RTCSELECT_63          0x00000000  // Pick bit 63 to count
+#define MMCR0_RTCSELECT_55          0x00800000  // Pick bit 55 to count
+#define MMCR0_RTCSELECT_51          0x01000000  // Pick bit 51 to count
+#define MMCR0_RTCSELECT_47          0x01800000  // Pick bit 47 to count
+#define MMCR0_INTONBITTRANS         0x00400000  // Causes interrupt signaling on bit transition from off to on
+#define MMCR0_THRESHOLD_MASK        0x003F0000  // Threshold value
+#define MMCR0_THRESHOLD(n)          ((n) << 16) // Threshold value (0 - 63)
+#define MMCR0_PMC1INTCONTROL        0x00008000  // Enables interrupt signaling due to PMC1 counter overflow
+#define MMCR0_PMC2INTCONTROL        0x00004000  // Enables interrupt signaling due to PMC2-PMC4 counter overflow
+#define MMCR0_PMCTRIGGER            0x00002000  // Can be used to trigger counting of PMC2-PMC4 after PMC1 has overflowed or...
+#define MMCR0_PMC1SELECT_MASK       0x00001FC0  // PMC1 input selector
+#define MMCR0_PMC2SELECT_MASK       0x0000003F  // PMC2 input selector
+
+#define MMCR1_PMC3SELECT_MASK       0xF8000000  // PMC3 input selector
+#define MMCR1_PMC4SELECT_MASK       0x07C00000  // PMC4 input selector
+
+#define PMC1_OV                     0x80000000  // Overflow
+#define PMC1_COUNTER                0x7FFFFFFF  // Counter value
+#define PMC2_OV                     0x80000000  // Overflow
+#define PMC2_COUNTER                0x7FFFFFFF  // Counter value
+#define PMC3_OV                     0x80000000  // Overflow
+#define PMC3_COUNTER                0x7FFFFFFF  // Counter value
+#define PMC4_OV                     0x80000000  // Overflow
+#define PMC4_COUNTER                0x7FFFFFFF  // Counter value
+
+/*---------------------------------------------------------------------------*
+    PMC1 Events
+ *---------------------------------------------------------------------------*/
+#define MMCR0_PMC1_HOLD             0x00000000  // Register holds current value
+#define MMCR0_PMC1_CYCLE            0x00000040  // Processor cycles
+#define MMCR0_PMC1_INSTRUCTION      0x00000080  // # of instructions completed.
+#define MMCR0_PMC1_TRANSITION       0x000000C0  // # of transitions for 0 to 1
+#define MMCR0_PMC1_DISPATCHED       0x00000100  // # of instructions dispatched
+#define MMCR0_PMC1_EIEIO            0x00000140  // # of eieio instructions completed
+#define MMCR0_PMC1_ITLB_CYCLE       0x00000180  // # of cycles spent performing table search op. for the ITLB
+#define MMCR0_PMC1_L2_HIT           0x000001C0  // # of access that hit the L2.
+#define MMCR0_PMC1_EA               0x00000200  // # of valid instruction EAs delivered to the memory subsystem
+#define MMCR0_PMC1_IABR             0x00000240  // # of time the address of an instruction matches the IABR
+#define MMCR0_PMC1_L1_MISS          0x00000280  // # of loads that miss the L1
+#define MMCR0_PMC1_Bx_UNRESOLVED    0x000002C0  // # of branches that are unresolved when processed
+#define MMCR0_PMC1_Bx_STALL_CYCLE   0x00000300  // # of cycles that dispatcher stalls due to a second
+                                                //      unresolved branch in the instruction stream
+#define MMCR0_PMC1_IC_FETCH_MISS    0x00000340  // # of times an instruction fetch missed the L1 Icache
+#define MMCR0_PMC2_HOLD             0x00000000  // Register holds current value
+#define MMCR0_PMC2_CYCLE            0x00000001  // Processor cycles
+#define MMCR0_PMC2_INSTRUCTION      0x00000002  // # of instructions completed
+#define MMCR0_PMC2_TRANSITION       0x00000003  // # of time-base (lower) bit transitions
+#define MMCR0_PMC2_DISPATCHED       0x00000004  // # of instructions dispatched
+#define MMCR0_PMC2_IC_MISS          0x00000005  // # of L1 instruction cache misses
+#define MMCR0_PMC2_ITLB_MISS        0x00000006  // # of ITLB misses
+#define MMCR0_PMC2_L2_I_MISS        0x00000007  // # of L2 instruction misses
+#define MMCR0_PMC2_Bx_FALL_TROUGH   0x00000008  // # of fall-through branches
+#define MMCR0_PMC2_PR_SWITCH        0x00000009  // # of MSR[PR] bit toggles
+#define MMCR0_PMC2_RESERVED_LOAD    0x0000000A  // # of reserved loads completed
+#define MMCR0_PMC2_LOAD_STORE       0x0000000B  // # of completed loads and stores
+#define MMCR0_PMC2_SNOOP            0x0000000C  // # of snoops
+#define MMCR0_PMC2_L1_CASTOUT       0x0000000D  // # of L1 castouts to L2
+#define MMCR0_PMC2_SYSTEM           0x0000000E  // # of completed system unit instructions
+#define MMCR0_PMC2_IC_FETCH_MISS    0x0000000F  // # of instruction fetch misses in the L1
+#define MMCR0_PMC2_Bx_OUT_OF_ORDER  0x00000010  // # of branches allowing out-of-order execution
+
+/*---------------------------------------------------------------------------*
+    PMC3 Events
+ *---------------------------------------------------------------------------*/
+#define MMCR1_PMC3_HOLD             0x00000000  // Register holds current value
+#define MMCR1_PMC3_CYCLE            0x08000000  // Processor cycles
+#define MMCR1_PMC3_INSTRUCTION      0x10000000  // # of instructions completed
+#define MMCR1_PMC3_TRANSITION       0x18000000  // # of time-base (lower) bit transitions
+#define MMCR1_PMC3_DISPATCHED       0x20000000  // # of instructions dispatched
+#define MMCR1_PMC3_DC_MISS          0x28000000  // # of L1 data cache misses
+#define MMCR1_PMC3_DTLB_MISS        0x30000000  // # of DTLB misses
+#define MMCR1_PMC3_L2_D_MISS        0x38000000  // # of L2 data misses
+#define MMCR1_PMC3_Bx_TAKEN         0x40000000  // # predicted branches that were taken
+#define MMCR1_PMC3_PM_SWITCH        0x48000000  // # of transitions between marked and unmarked processes
+#define MMCR1_PMC3_COND_STORE       0x50000000  // # of store conditional instructions completed
+#define MMCR1_PMC3_FPU              0x58000000  // # of instructions completed from the FPU
+#define MMCR1_PMC3_L2_SNOOP_CASTOUT 0x60000000  // # of L2 castout caused by snoops to modified lines
+#define MMCR1_PMC3_L2_HIT           0x68000000  // # of cache operations that hit in the L2 cache
+#define MMCR1_PMC3_L1_MISS_CYCLE    0x78000000  // # of cycles generated by L1 load misses
+#define MMCR1_PMC3_Bx_SECOND        0x80000000  // # of branches in the second speculative branch
+                                                //   resolved correctly
+#define MMCR1_PMC3_BPU_LR_CR        0x88000000  // # of cycles the BPU stalls due to LR or CR unresolved
+                                                //   dependencies
+
+#define MMCR1_PMC4_HOLD             0x00000000  // Register holds current value
+#define MMCR1_PMC4_CYCLE            0x00400000  // Processor cycles
+#define MMCR1_PMC4_INSTRUCTION      0x00800000  // # of instructions completed
+#define MMCR1_PMC4_TRANSITION       0x00C00000  // # of time-base (lower) bit transitions
+#define MMCR1_PMC4_DISPATCHED       0x01000000  // # of instructions dispatched
+#define MMCR1_PMC4_L2_CASTOUT       0x01400000  // # of L2 castouts
+#define MMCR1_PMC4_DTLB_CYCLE       0x01800000  // # of cycles spent performing table searches for DTLB accesses
+#define MMCR1_PMC4_Bx_MISSED        0x02000000  // # of mispredicted branches
+#define MMCR1_PMC4_COND_STORE_INT   0x02800000  // # of store conditional instructions completed
+                                                //   with reservation intact
+#define MMCR1_PMC4_SYNC             0x02C00000  // # of completed sync instructions
+#define MMCR1_PMC4_SNOOP_RETRY      0x03000000  // # of snoop request retries
+#define MMCR1_PMC4_INTEGER          0x03400000  // # of completed integer operations
+#define MMCR1_PMC4_BPU_THIRD        0x03800000  // # of cycles the BPU cannot process new branches
+                                                //   due to having two unresolved branches
+#define MMCR1_PMC4_DC_MISS          0x07C00000  // # of L1 data cache misses
+
+/*---------------------------------------------------------------------------*
+    FPSCR bits
+ *---------------------------------------------------------------------------*/
+#ifndef FPSCR_FX
+#define FPSCR_FX            0x80000000  // Exception summary
+#define FPSCR_FEX           0x40000000  // Enabled exception summary
+#define FPSCR_VX            0x20000000  // Invalid operation
+#define FPSCR_OX            0x10000000  // Overflow exception
+#define FPSCR_UX            0x08000000  // Underflow exception
+#define FPSCR_ZX            0x04000000  // Zero divide exception
+#define FPSCR_XX            0x02000000  // Inexact exception
+#define FPSCR_VXSNAN        0x01000000  // SNaN
+#define FPSCR_VXISI         0x00800000  // Infinity - Infinity
+#define FPSCR_VXIDI         0x00400000  // Infinity / Infinity
+#define FPSCR_VXZDZ         0x00200000  // 0 / 0
+#define FPSCR_VXIMZ         0x00100000  // Infinity * 0
+#define FPSCR_VXVC          0x00080000  // Invalid compare
+#define FPSCR_FR            0x00040000  // Fraction rounded
+#define FPSCR_FI            0x00020000  // Fraction inexact
+#define FPSCR_VXSOFT        0x00000400  // Software request
+#define FPSCR_VXSQRT        0x00000200  // Invalid square root
+#define FPSCR_VXCVI         0x00000100  // Invalid integer convert
+#define FPSCR_VE            0x00000080  // Invalid operation exception enable
+#define FPSCR_OE            0x00000040  // Overflow exception enable
+#define FPSCR_UE            0x00000020  // Underflow exception enable
+#define FPSCR_ZE            0x00000010  // Zero divide exception enable
+#define FPSCR_XE            0x00000008  // Inexact exception enable
+#define FPSCR_NI            0x00000004  // Non-IEEE mode
+#endif
+
+#ifndef FPSCR_FX_BIT
+#define FPSCR_FX_BIT        0           // Exception summary
+#define FPSCR_FEX_BIT       1           // Enabled exception summary
+#define FPSCR_VX_BIT        2           // Invalid operation
+#define FPSCR_OX_BIT        3           // Overflow exception
+#define FPSCR_UX_BIT        4           // Underflow exception
+#define FPSCR_ZX_BIT        5           // Zero divide exception
+#define FPSCR_XX_BIT        6           // Inexact exception
+#define FPSCR_VXSNAN_BIT    7           // SNaN
+#define FPSCR_VXISI_BIT     8           // Infinity - Infinity
+#define FPSCR_VXIDI_BIT     9           // Infinity / Infinity
+#define FPSCR_VXZDZ_BIT     10          // 0 / 0
+#define FPSCR_VXIMZ_BIT     11          // Infinity * 0
+#define FPSCR_VXVC_BIT      12          // Invalid compare
+#define FPSCR_FR_BIT        13          // Fraction rounded
+#define FPSCR_FI_BIT        14          // Fraction inexact
+#define FPSCR_VXSOFT_BIT    21          // Software request
+#define FPSCR_VXSQRT_BIT    22          // Invalid square root
+#define FPSCR_VXCVI_BIT     23          // Invalid integer convert
+#define FPSCR_VE_BIT        24          // Invalid operation exception enable
+#define FPSCR_OE_BIT        25          // Overflow exception enable
+#define FPSCR_UE_BIT        26          // Underflow exception enable
+#define FPSCR_ZE_BIT        27          // Zero divide exception enable
+#define FPSCR_XE_BIT        28          // Inexact exception enable
+#define FPSCR_NI_BIT        29          // Non-IEEE mode
+#endif
+
+union FpscrUnion {
+    f64 f;
+    struct {
+        u32 fpscr_pad;
+        u32 fpscr;
+    } u;
+};
+
+// PPCArch
+u32 PPCMfmsr();
+void PPCMtmsr(u32 newMSR);
+u32 PPCOrMsr(u32 value);
+u32 PPCMfhid0();
+void PPCMthid0(u32 newHID0);
+u32 PPCMfl2cr();
+void PPCMtl2cr(u32 newL2cr);
+void PPCMtdec(u32 newDec);
+void PPCSync();
+void PPCHalt();
+u32 PPCMffpscr();
+void PPCMtfpscr(u32 newFPSCR);
+u32 PPCMfhid2();
+void PPCMthid2(u32 newhid2);
+u32 PPCMfwpar();
+void PPCMtwpar(u32 newwpar);
+void PPCEnableSpeculation();
+void PPCDisableSpeculation();
+void PPCSetFpIEEEMode();
+void PPCSetFpNonIEEEMode();
+u32 PPCMfpmc4();
+u32 PPCMfpmc3();
+u32 PPCMfpmc1();
+void PPCMtpmc1(u32 newPmc1);
+void PPCMtpmc2(u32 newPmc1);
+void PPCMtpmc3(u32 newPmc1);
+void PPCMtpmc4(u32 newPmc1);
+void PPCMtmmcr0(u32 newMmcr0);
+void PPCMtmmcr1(u32 newMmcr0);
+void PPCMtdmaU(u32 newdmau);
+void PPCMtdmaL(u32 newdmal);
+u32 PPCMfdec(void);
+u32 PPCMfpmc2(void);
+u32 PPCAndMsr(u32 value);
+u32 PPCAndCMsr(u32 value);
+u32 PPCMfhid1();
+void PPCEieio();
+u32 PPCMfmmcr0();
+u32 PPCMfmmcr1();
+u32 PPCMfpmc2();
+u32 PPCMfsia();
+void PPCMtsia(u32 newSia);
+u32 PPCMfdmaL();
+u32 PPCMfpvr();
+u32 PPCMfdmaU();
+
+// PPCPm
+void PMBegin(void);
+void PMEnd(void);
+void PMCycles(void);
+void PML1FetchMisses(void);
+void PML1MissCycles(void);
+void PMInstructions(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_PPCARCH
diff --git a/aurora-main/include/dolphin/card.h b/aurora-main/include/dolphin/card.h
new file mode 100644
index 0000000..33b9a5d
--- /dev/null
+++ b/aurora-main/include/dolphin/card.h
@@ -0,0 +1,340 @@
+#ifndef _DOLPHIN_CARD_H_
+#define _DOLPHIN_CARD_H_
+
+#include <dolphin/os.h>
+#include <dolphin/dsp.h>
+#include <dolphin/dvd.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define CARD_FILENAME_MAX 32
+#define CARD_MAX_FILE 127
+#define CARD_ICON_MAX 8
+
+#if TARGET_PC
+
+typedef enum {
+  CARD_RAWIMAGE,
+  CARD_GCIFOLDER,
+} CARDFileType;
+
+#endif
+
+typedef void (*CARDCallback)(s32 chan, s32 result);
+
+typedef struct CARDFileInfo {
+    s32 chan;
+    s32 fileNo;
+    s32 offset;
+    s32 length;
+    u16 iBlock;
+} CARDFileInfo;
+
+typedef struct CARDDir {
+    u8 gameName[4];
+    u8 company[2];
+    u8 _padding0;
+    u8 bannerFormat;
+    u8 fileName[CARD_FILENAME_MAX];
+    u32 time;     // seconds since 01/01/2000 midnight
+    u32 iconAddr; // 0xffffffff if not used
+    u16 iconFormat;
+    u16 iconSpeed;
+    u8 permission;
+    u8 copyTimes;
+    u16 startBlock;
+    u16 length;
+    u8 _padding1[2];
+    u32 commentAddr; // 0xffffffff if not used
+} CARDDir;
+
+typedef struct CARDControl {
+    /* 0x000 */ BOOL attached;
+    /* 0x004 */ s32 result;
+    /* 0x008 */ u16 size;
+    /* 0x00A */ u16 pageSize;
+    /* 0x00C */ s32 sectorSize;
+    /* 0x010 */ u16 cBlock;
+    /* 0x012 */ u16 vendorID;
+    /* 0x014 */ s32 latency;
+    /* 0x018 */ u8 id[12];
+    /* 0x024 */ int mountStep;
+    /* 0x028 */ int formatStep;
+    /* 0x028 */ u32 scramble;
+    /* 0x02C */ DSPTaskInfo task;
+    /* 0x080 */ void* workArea;
+    /* 0x084 */ CARDDir *currentDir;
+    /* 0x088 */ u16* currentFat;
+    /* 0x08C */ OSThreadQueue threadQueue;
+    /* 0x094 */ u8 cmd[9];
+    /* 0x0A0 */ s32 cmdlen;
+    /* 0x0A4 */ volatile u32 mode;
+    /* 0x0A8 */ int retry;
+    /* 0x0AC */ int repeat;
+    /* 0x0B0 */ u32 addr;
+    /* 0x0B4 */ void* buffer;
+    /* 0x0B8 */ s32 xferred;
+    /* 0x0BC */ u16 freeNo;
+    /* 0x0BE */ u16 startBlock;
+    /* 0x0C0 */ CARDFileInfo* fileInfo;
+    /* 0x0C4 */ CARDCallback extCallback;
+    /* 0x0C8 */ CARDCallback txCallback;
+    /* 0x0CC */ CARDCallback exiCallback;
+    /* 0x0D0 */ CARDCallback apiCallback;
+    /* 0x0D4 */ CARDCallback xferCallback;
+    /* 0x0D8 */ CARDCallback eraseCallback;
+    /* 0x0DC */ CARDCallback unlockCallback;
+    /* 0x0E0 */ OSAlarm alarm;
+    /* 0x108 */ u32 cid;
+    /* 0x10C */ const DVDDiskID* diskID;
+} CARDControl;
+
+typedef struct CARDDecParam {
+    /* 0x00 */ u8* inputAddr;
+    /* 0x04 */ u32 inputLength;
+    /* 0x08 */ u32 aramAddr;
+    /* 0x0C */ u8* outputAddr;
+} CARDDecParam;
+
+typedef struct CARDID {
+    /* 0x000 */ u8 serial[32];
+    /* 0x020 */ u16 deviceID;
+    /* 0x022 */ u16 size;
+    /* 0x024 */ u16 encode;
+    /* 0x026 */ u8 padding[470];
+    /* 0x1FC */ u16 checkSum;
+    /* 0x1FE */ u16 checkSumInv;
+} CARDID;
+
+typedef struct CARDDirCheck {
+    /* 0x00 */ u8 padding0[56];
+    /* 0x38 */ u16 padding1;
+    /* 0x3A */ s16 checkCode;
+    /* 0x3C */ u16 checkSum;
+    /* 0x3E */ u16 checkSumInv;
+} CARDDirCheck;
+
+typedef struct CARDStat {
+    /* 0x00 */ char fileName[CARD_FILENAME_MAX];
+    /* 0x20 */ u32 length;
+    /* 0x24 */ u32 time;
+    /* 0x28 */ u8 gameName[4];
+    /* 0x2C */ u8 company[2];
+    /* 0x2E */ u8 bannerFormat;
+    /* 0x30 */ u32 iconAddr;
+    /* 0x34 */ u16 iconFormat;
+    /* 0x36 */ u16 iconSpeed;
+    /* 0x38 */ u32 commentAddr;
+    /* 0x3C */ u32 offsetBanner;
+    /* 0x40 */ u32 offsetBannerTlut;
+    /* 0x44 */ u32 offsetIcon[CARD_ICON_MAX];
+    /* 0x64 */ u32 offsetIconTlut;
+    /* 0x68 */ u32 offsetData;
+} CARDStat;
+
+#define CARD_ATTR_PUBLIC  0x04u
+#define CARD_ATTR_NO_COPY 0x08u
+#define CARD_ATTR_NO_MOVE 0x10u
+#define CARD_ATTR_GLOBAL  0x20u
+#define CARD_ATTR_COMPANY 0x40u
+
+#define CARD_FAT_AVAIL 0x0000u
+#define CARD_FAT_CHECKSUM 0x0000u
+#define CARD_FAT_CHECKSUMINV 0x0001u
+#define CARD_FAT_CHECKCODE 0x0002u
+#define CARD_FAT_FREEBLOCKS 0x0003u
+#define CARD_FAT_LASTSLOT 0x0004u
+
+#define CARD_WORKAREA_SIZE (5 * 8 * 1024)
+
+#define CARD_SEG_SIZE 0x200u
+#define CARD_PAGE_SIZE 0x80u
+#define CARD_MAX_SIZE 0x01000000U
+
+#define CARD_NUM_SYSTEM_BLOCK 5
+#define CARD_SYSTEM_BLOCK_SIZE (8 * 1024u)
+
+#define CARD_MAX_MOUNT_STEP (CARD_NUM_SYSTEM_BLOCK + 2)
+
+#define CARD_STAT_SPEED_END 0
+#define CARD_STAT_SPEED_FAST 1
+#define CARD_STAT_SPEED_MIDDLE 2
+#define CARD_STAT_SPEED_SLOW 3
+#define CARD_STAT_SPEED_MASK 3
+
+#define CARD_STAT_ANIM_LOOP   0
+#define CARD_STAT_ANIM_BOUNCE 4
+#define CARD_STAT_ANIM_MASK 0x4
+
+#define CARD_RESULT_UNLOCKED       1
+#define CARD_RESULT_READY          0
+#define CARD_RESULT_BUSY          -1
+#define CARD_RESULT_WRONGDEVICE   -2
+#define CARD_RESULT_NOCARD        -3
+#define CARD_RESULT_NOFILE        -4
+#define CARD_RESULT_IOERROR       -5
+#define CARD_RESULT_BROKEN        -6
+#define CARD_RESULT_EXIST         -7
+#define CARD_RESULT_NOENT         -8
+#define CARD_RESULT_INSSPACE      -9
+#define CARD_RESULT_NOPERM       -10
+#define CARD_RESULT_LIMIT        -11
+#define CARD_RESULT_NAMETOOLONG  -12
+#define CARD_RESULT_ENCODING     -13
+#define CARD_RESULT_CANCELED     -14
+#define CARD_RESULT_FATAL_ERROR -128
+
+#define CARDIsValidBlockNo(card, blockNo) ((blockNo) >= CARD_NUM_SYSTEM_BLOCK && (blockNo) < (card)->cBlock)
+
+#define CARD_READ_SIZE 512
+
+#define CARD_COMMENT_SIZE 64
+
+#define CARD_ICON_WIDTH 32
+#define CARD_ICON_HEIGHT 32
+
+#define CARD_BANNER_WIDTH 96
+#define CARD_BANNER_HEIGHT 32
+
+#define CARD_STAT_ICON_NONE 0
+#define CARD_STAT_ICON_C8 1
+#define CARD_STAT_ICON_RGB5A3 2
+#define CARD_STAT_ICON_MASK 3
+
+#define CARD_STAT_BANNER_NONE 0
+#define CARD_STAT_BANNER_C8 1
+#define CARD_STAT_BANNER_RGB5A3 2
+#define CARD_STAT_BANNER_MASK 3
+
+#define CARD_ENCODE_ANSI 0
+#define CARD_ENCODE_SJIS 1
+
+#define CARDGetDirCheck(dir) ((CARDDirCheck*)&(dir)[CARD_MAX_FILE])
+#define CARDGetBannerFormat(stat) (((stat)->bannerFormat) & CARD_STAT_BANNER_MASK)
+#define CARDGetIconAnim(stat) (((stat)->bannerFormat) & CARD_STAT_ANIM_MASK)
+#define CARDGetIconFormat(stat, n) (((stat)->iconFormat >> (2 * (n))) & CARD_STAT_ICON_MASK)
+#define CARDGetIconSpeed(stat, n) (((stat)->iconSpeed >> (2 * (n))) & CARD_STAT_SPEED_MASK)
+#define CARDSetBannerFormat(stat, f)                                                               \
+    ((stat)->bannerFormat = (u8)(((stat)->bannerFormat & ~CARD_STAT_BANNER_MASK) | (f)))
+#define CARDSetIconAnim(stat, f)                                                                   \
+    ((stat)->bannerFormat = (u8)(((stat)->bannerFormat & ~CARD_STAT_ANIM_MASK) | (f)))
+#define CARDSetIconFormat(stat, n, f)                                                              \
+    ((stat)->iconFormat =                                                                            \
+        (u16)(((stat)->iconFormat & ~(CARD_STAT_ICON_MASK << (2 * (n)))) | ((f) << (2 * (n)))))
+#define CARDSetIconSpeed(stat, n, f)                                                               \
+    ((stat)->iconSpeed =                                                                             \
+        (u16)(((stat)->iconSpeed & ~(CARD_STAT_SPEED_MASK << (2 * (n)))) | ((f) << (2 * (n)))))
+#define CARDSetIconAddress(stat, addr) ((stat)->iconAddr = (u32)(addr))
+#define CARDSetCommentAddress(stat, addr) ((stat)->commentAddr = (u32)(addr))
+#define CARDGetFileNo(fileInfo) ((fileInfo)->fileNo)
+
+extern u32 __CARDFreq;
+
+#if DEBUG
+#define CARDFreq __CARDFreq
+#else
+#define CARDFreq EXI_FREQ_16M
+#endif
+
+s32 CARDRenameAsync(s32 chan, const char* oldName, const char* newName, CARDCallback callback);
+
+// CARDBios
+#if TARGET_PC
+void CARDInit(const char* game, const char* maker);
+void CARDSetGameAndMaker(const s32 chan, const char* game, const char* maker);
+
+// pass -1 to set both
+void CARDDetectDolphin(s32 chan);
+// pass -1 to set both
+void CARDSetBasePath(const char*, s32 chan);
+void CARDSetLoadType(CARDFileType type);
+
+#else
+void CARDInit(void);
+#endif
+s32 CARDGetResultCode(s32 chan);
+s32 CARDFreeBlocks(s32 chan, s32* byteNotUsed, s32* filesNotUsed);
+s32 CARDGetEncoding(s32 chan, u16* encode);
+s32 CARDGetMemSize(s32 chan, u16* size);
+s32 CARDGetSectorSize(s32 chan, u32* size);
+const DVDDiskID* CARDGetDiskID(s32 chan);
+s32 CARDSetDiskID(s32 chan, const DVDDiskID* diskID);
+BOOL CARDSetFastMode(BOOL enable);
+BOOL CARDGetFastMode(void);
+s32 CARDGetCurrentMode(s32 chan, u32* mode);
+
+// CARDCheck
+s32 CARDCheckExAsync(s32 chan, s32* xferBytes, CARDCallback callback);
+s32 CARDCheckAsync(s32 chan, CARDCallback callback);
+s32 CARDCheckEx(s32 chan, s32* xferBytes);
+s32 CARDCheck(s32 chan);
+
+// CARDCreate
+s32 CARDCreateAsync(s32 chan, const char* fileName, u32 size, CARDFileInfo* fileInfo, CARDCallback callback);
+s32 CARDCreate(s32 chan, const char* fileName, u32 size, CARDFileInfo* fileInfo);
+
+// CARDDelete
+s32 CARDFastDeleteAsync(s32 chan, s32 fileNo, CARDCallback callback);
+s32 CARDFastDelete(s32 chan, s32 fileNo);
+s32 CARDDeleteAsync(s32 chan, const char* fileName, CARDCallback callback);
+s32 CARDDelete(s32 chan, const char* fileName);
+
+// CARDErase
+s32 CARDEraseAsync(CARDFileInfo* fileInfo, s32 length, s32 offset, CARDCallback callback);
+s32 CARDErase(CARDFileInfo* fileInfo, s32 length, s32 offset);
+
+// CARDFormat
+s32 CARDFormat(s32 chan);
+
+// CARDMount
+int CARDProbe(s32 chan);
+s32 CARDProbeEx(s32 chan, s32* memSize, s32* sectorSize);
+s32 CARDMountAsync(s32 chan, void* workArea, CARDCallback detachCallback, CARDCallback attachCallback);
+s32 CARDMount(s32 chan, void* workArea, CARDCallback detachCallback);
+s32 CARDUnmount(s32 chan);
+
+// CARDNet
+u16 CARDSetVendorID(u16 vendorID);
+u16 CARDGetVendorID();
+s32 CARDGetSerialNo(s32 chan, u64* serialNo);
+s32 CARDGetUniqueCode(s32 chan, u64* uniqueCode);
+s32 CARDGetAttributes(s32 chan, s32 fileNo, u8* attr);
+s32 CARDSetAttributesAsync(s32 chan, s32 fileNo, u8 attr, CARDCallback callback);
+s32 CARDSetAttributes(s32 chan, s32 fileNo, u8 attr);
+
+// CARDOpen
+s32 CARDFastOpen(s32 chan, s32 fileNo, CARDFileInfo* fileInfo);
+s32 CARDOpen(s32 chan, const char* fileName, CARDFileInfo* fileInfo);
+s32 CARDClose(CARDFileInfo* fileInfo);
+
+// CARDProgram
+s32 CARDProgramAsync(CARDFileInfo* fileInfo, void* buf, s32 length, s32 offset, CARDCallback callback);
+s32 CARDProgram(CARDFileInfo* fileInfo, void* buf, s32 length, s32 offset);
+
+// CARDRdwr
+s32 CARDGetXferredBytes(s32 chan);
+
+// CARDRead
+s32 CARDReadAsync(const CARDFileInfo* fileInfo, void* addr, s32 length, s32 offset, CARDCallback callback);
+s32 CARDRead(const CARDFileInfo*  fileInfo, void*  addr, s32 length, s32 offset);
+s32 CARDCancel(CARDFileInfo* fileInfo);
+
+// CARDRename
+s32 CARDRename(s32 chan, const char* oldName, const char* newName);
+
+// CARDStat
+s32 CARDGetStatus(s32 chan, s32 fileNo, CARDStat* stat);
+s32 CARDSetStatusAsync(s32 chan, s32 fileNo, const CARDStat* stat, CARDCallback callback);
+s32 CARDSetStatus(s32 chan, s32 fileNo, const CARDStat*  stat);
+
+// CARDWrite
+s32 CARDWriteAsync(const CARDFileInfo*  fileInfo, const void* addr, s32 length, s32 offset, CARDCallback callback);
+s32 CARDWrite(const CARDFileInfo* fileInfo, const void* addr, s32 length, s32 offset);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/db.h b/aurora-main/include/dolphin/db.h
new file mode 100644
index 0000000..c62f188
--- /dev/null
+++ b/aurora-main/include/dolphin/db.h
@@ -0,0 +1,22 @@
+#ifndef _DOLPHIN_DB_H_
+#define _DOLPHIN_DB_H_
+
+#include <dolphin/types.h>
+#include <dolphin/db/DBInterface.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define OS_DBINTERFACE_ADDR 0x00000040
+
+BOOL DBIsDebuggerPresent(void);
+void DBPrintf(char* str, ...);
+s32 DBQueryData(void);
+u32 DBRead(u8*, u32);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_DB_H_
diff --git a/aurora-main/include/dolphin/db/DBInterface.h b/aurora-main/include/dolphin/db/DBInterface.h
new file mode 100644
index 0000000..7bfa354
--- /dev/null
+++ b/aurora-main/include/dolphin/db/DBInterface.h
@@ -0,0 +1,31 @@
+#ifndef _DOLPHIN_DBINTERFACE_H_
+#define _DOLPHIN_DBINTERFACE_H_
+
+#include <dolphin/os.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct DBInterface {
+    u32 bPresent;
+    u32 exceptionMask;
+    void (*ExceptionDestination)(void);
+    void* exceptionReturn;
+} DBInterface;
+
+extern DBInterface* __DBInterface;
+
+void DBInit(void);
+void DBInitComm(int* inputFlagPtr, int* mtrCallback);
+void __DBExceptionDestination(void);
+void __DBExceptionDestinationAux(void);
+BOOL __DBIsExceptionMarked(__OSException exception);
+void __DBMarkException(u8 exception, int value);
+void __DBSetPresent(u32 value);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/dolphin.h b/aurora-main/include/dolphin/dolphin.h
new file mode 100644
index 0000000..f0025ed
--- /dev/null
+++ b/aurora-main/include/dolphin/dolphin.h
@@ -0,0 +1,24 @@
+#ifndef _DOLPHIN_H_
+#define _DOLPHIN_H_
+
+#include <dolphin/types.h>
+#include <dolphin/os.h>
+#include <dolphin/dsp.h>
+#include <dolphin/dvd.h>
+#include <dolphin/gx.h>
+#include <dolphin/hio.h>
+#include <dolphin/mtx.h>
+#include <dolphin/vi.h>
+#include <dolphin/card.h>
+#include <dolphin/perf.h>
+#include <dolphin/ar.h>
+#include <dolphin/base/PPCArch.h>
+#include <dolphin/db.h>
+#include <dolphin/pad.h>
+#include <dolphin/dtk.h>
+#include <dolphin/ai.h>
+// #include <dolphin/demo.h>
+#include <dolphin/exi.h>
+#include <dolphin/si.h>
+
+#endif
diff --git a/aurora-main/include/dolphin/dsp.h b/aurora-main/include/dolphin/dsp.h
new file mode 100644
index 0000000..72ffa82
--- /dev/null
+++ b/aurora-main/include/dolphin/dsp.h
@@ -0,0 +1,57 @@
+#ifndef _DOLPHIN_DSP_H_
+#define _DOLPHIN_DSP_H_
+
+#include <dolphin/os.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*DSPCallback)(void* task);
+typedef struct STRUCT_DSP_TASK DSPTaskInfo;
+
+typedef struct STRUCT_DSP_TASK {                                   
+    /* 0x00 */ volatile u32 state;
+    /* 0x04 */ volatile u32 priority;
+    /* 0x08 */ volatile u32 flags;
+    /* 0x0C */ u16* iram_mmem_addr;
+    /* 0x10 */ u32 iram_length;
+    /* 0x14 */ u32 iram_addr;
+    /* 0x18 */ u16* dram_mmem_addr;
+    /* 0x1C */ u32 dram_length;
+    /* 0x20 */ u32 dram_addr;
+    /* 0x24 */ u16 dsp_init_vector;
+    /* 0x26 */ u16 dsp_resume_vector;
+    /* 0x28 */ DSPCallback init_cb;
+    /* 0x2C */ DSPCallback res_cb;
+    /* 0x30 */ DSPCallback done_cb;
+    /* 0x34 */ DSPCallback req_cb;
+    /* 0x38 */ DSPTaskInfo* next;
+    /* 0x3C */ DSPTaskInfo* prev;
+    /* 0x40 */ OSTime t_context;
+    /* 0x48 */ OSTime t_task;
+} DSPTaskInfo;
+
+u32 DSPCheckMailToDSP(void);
+u32 DSPCheckMailFromDSP(void);
+u32 DSPReadCPUToDSPMbox(void);
+u32 DSPReadMailFromDSP(void);
+void DSPSendMailToDSP(u32 mail);
+void DSPAssertInt(void);
+void DSPInit(void);
+BOOL DSPCheckInit(void);
+void DSPReset(void);
+void DSPHalt(void);
+void DSPUnhalt(void);
+u32 DSPGetDMAStatus(void);
+DECL_WEAK DSPTaskInfo* DSPAddTask(DSPTaskInfo* task);
+DSPTaskInfo* DSPCancelTask(DSPTaskInfo* task);
+DSPTaskInfo* DSPAssertTask(DSPTaskInfo* task);
+
+DSPTaskInfo* __DSPGetCurrentTask(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/dtk.h b/aurora-main/include/dolphin/dtk.h
new file mode 100644
index 0000000..3a76a0f
--- /dev/null
+++ b/aurora-main/include/dolphin/dtk.h
@@ -0,0 +1,56 @@
+#ifndef _DOLPHIN_DTK_H_
+#define _DOLPHIN_DTK_H_
+
+#include <dolphin/dvd.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*DTKCallback)(u32 eventMask);
+typedef void (*DTKFlushCallback)(void);
+
+typedef struct DTKTrack {
+	/* 0x00 */ struct DTKTrack* prev;
+    /* 0x04 */ struct DTKTrack* next;
+    /* 0x08 */ char* fileName;
+    /* 0x0C */ u32 eventMask;
+    /* 0x10 */ DTKCallback callback;
+    /* 0x14 */ DVDFileInfo dvdFileInfo;
+} DTKTrack;
+
+#define DTK_STATE_STOP    0
+#define DTK_STATE_RUN     1
+#define DTK_STATE_PAUSE   2
+#define DTK_STATE_BUSY    3
+#define DTK_STATE_PREPARE 4
+
+#define DTK_MODE_NOREPEAT  0
+#define DTK_MODE_ALLREPEAT 1
+#define DTK_MODE_REPEAT1   2
+
+void DTKInit(void);
+void DTKShutdown(void);
+u32 DTKQueueTrack(char* fileName, DTKTrack* track, u32 eventMask, DTKCallback callback);
+u32 DTKRemoveTrack(DTKTrack* track);
+int DTKFlushTracks(DTKFlushCallback callback);
+void DTKSetSampleRate(u32 samplerate);
+void DTKSetInterruptFrequency(u32 samples);
+void DTKSetRepeatMode(u32 repeat);
+int DTKSetState(u32 state);
+int DTKNextTrack(void);
+int DTKPrevTrack(void);
+u32 DTKGetSampleRate(void);
+u32 DTKGetRepeatMode(void);
+u32 DTKGetState(void);
+u32 DTKGetPosition(void);
+u32 DTKGetInterruptFrequency(void);
+DTKTrack* DTKGetCurrentTrack(void);
+void DTKSetVolume(u8 left, u8 right);
+u16 DTKGetVolume(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/dvd.h b/aurora-main/include/dolphin/dvd.h
new file mode 100644
index 0000000..b2e1757
--- /dev/null
+++ b/aurora-main/include/dolphin/dvd.h
@@ -0,0 +1,237 @@
+#ifndef _DOLPHIN_DVD_H_
+#define _DOLPHIN_DVD_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define DVD_ASSERTMSGLINE(line, cond, msg) \
+    if (!(cond)) \
+        OSPanic(__FILE__, line, msg)
+
+#define DVD_ASSERTMSG1LINE(line, cond, msg, arg1) \
+    if (!(cond)) \
+        OSPanic(__FILE__, line, msg, arg1)
+
+#define DVD_ASSERTMSG2LINE(line, cond, msg, arg1, arg2) \
+    if (!(cond)) \
+        OSPanic(__FILE__, line, msg, arg1, arg2)
+
+#define DVD_RESULT_GOOD        0
+#define DVD_RESULT_FATAL_ERROR -1
+#define DVD_RESULT_IGNORED     -2
+#define DVD_RESULT_CANCELED    -6
+
+#define DVD_STATE_FATAL_ERROR   -1
+#define DVD_STATE_END            0
+#define DVD_STATE_BUSY           1
+#define DVD_STATE_WAITING        2
+#define DVD_STATE_COVER_CLOSED   3
+#define DVD_STATE_NO_DISK        4
+#define DVD_STATE_COVER_OPEN     5
+#define DVD_STATE_WRONG_DISK     6
+#define DVD_STATE_MOTOR_STOPPED  7
+#define DVD_STATE_PAUSING        8
+#define DVD_STATE_IGNORED        9
+#define DVD_STATE_CANCELED       10
+#define DVD_STATE_RETRY          11
+
+#define DVD_MIN_TRANSFER_SIZE    32
+
+// could be bitfields
+#define DVD_INTTYPE_TC 1
+#define DVD_INTTYPE_DE 2
+// unk type 3
+#define DVD_INTTYPE_CVR 4
+
+// DVD Commands
+#define DVD_COMMAND_NONE 0
+#define DVD_COMMAND_READ 1
+#define DVD_COMMAND_SEEK 2
+#define DVD_COMMAND_CHANGE_DISK 3
+#define DVD_COMMAND_BSREAD 4
+#define DVD_COMMAND_READID 5
+#define DVD_COMMAND_INITSTREAM 6
+#define DVD_COMMAND_CANCELSTREAM 7
+#define DVD_COMMAND_STOP_STREAM_AT_END 8
+#define DVD_COMMAND_REQUEST_AUDIO_ERROR 9
+#define DVD_COMMAND_REQUEST_PLAY_ADDR 10
+#define DVD_COMMAND_REQUEST_START_ADDR 11
+#define DVD_COMMAND_REQUEST_LENGTH 12
+#define DVD_COMMAND_AUDIO_BUFFER_CONFIG 13
+#define DVD_COMMAND_INQUIRY 14
+#define DVD_COMMAND_BS_CHANGE_DISK 15
+#define DVD_COMMAND_UNK_16 16
+
+typedef struct DVDDiskID {
+    char gameName[4];
+    char company[2];
+    u8 diskNumber;
+    u8 gameVersion;
+    u8 streaming;
+    u8 streamingBufSize;
+    u8 padding[22];
+} DVDDiskID;
+
+typedef struct DVDCommandBlock DVDCommandBlock;
+typedef void (*DVDCBCallback)(s32 result, DVDCommandBlock* block);
+typedef void (*DVDLowCallback)(u32);
+
+typedef void (*DVDCommandCheckerCallback)(u32);
+typedef void (*DVDCommandChecker)(DVDCommandBlock*, DVDCommandCheckerCallback);
+
+struct DVDCommandBlock {
+    /* 0x00 */ DVDCommandBlock* next;
+    /* 0x04 */ DVDCommandBlock* prev;
+    /* 0x08 */ u32 command;
+    /* 0x0C */ s32 state;
+    /* 0x10 */ u32 offset;
+    /* 0x14 */ u32 length;
+    /* 0x18 */ void* addr;
+    /* 0x1C */ u32 currTransferSize;
+    /* 0x20 */ u32 transferredSize;
+    /* 0x24 */ DVDDiskID* id;
+    /* 0x28 */ DVDCBCallback callback;
+    /* 0x2C */ void* userData;
+};
+
+typedef struct DVDFileInfo DVDFileInfo;
+typedef void (*DVDCallback)(s32 result, DVDFileInfo *fileInfo);
+struct DVDFileInfo {
+	/* 0x00 */ DVDCommandBlock cb;
+    /* 0x30 */ u32 startAddr;
+    /* 0x34 */ u32 length;
+    /* 0x38 */ DVDCallback callback;
+};
+
+typedef struct {
+    u32 entryNum;
+    u32 location;
+    u32 next;
+} DVDDir;
+
+typedef struct {
+    u32 entryNum;
+    BOOL isDir;
+    char* name;
+} DVDDirEntry;
+
+typedef struct DVDBB2 {
+    /* 0x00 */ u32 bootFilePosition;
+    /* 0x04 */ u32 FSTPosition;
+    /* 0x08 */ u32 FSTLength;
+    /* 0x0C */ u32 FSTMaxLength;
+    /* 0x10 */ void* FSTAddress;
+    /* 0x14 */ u32 userPosition;
+    /* 0x18 */ u32 userLength;
+    /* 0x1C */ u32 padding0;
+} DVDBB2;
+
+typedef struct DVDDriveInfo {
+    /* 0x00 */ u16 revisionLevel;
+    /* 0x02 */ u16 deviceCode;
+    /* 0x04 */ u32 releaseDate;
+    /* 0x08 */ u8 padding[24];
+} DVDDriveInfo;
+
+// DVD
+void DVDInit(void);
+int DVDReadAbsAsyncPrio(DVDCommandBlock* block, void* addr, s32 length, s32 offset, DVDCBCallback callback, s32 prio);
+int DVDSeekAbsAsyncPrio(DVDCommandBlock* block, s32 offset, DVDCBCallback callback, s32 prio);
+int DVDReadAbsAsyncForBS(DVDCommandBlock* block, void* addr, s32 length, s32 offset, DVDCBCallback callback);
+int DVDReadDiskID(DVDCommandBlock* block, DVDDiskID* diskID, DVDCBCallback callback);
+int DVDPrepareStreamAbsAsync(DVDCommandBlock* block, u32 length, u32 offset, DVDCBCallback callback);
+int DVDCancelStreamAsync(DVDCommandBlock* block, DVDCBCallback callback);
+s32 DVDCancelStream(DVDCommandBlock* block);
+int DVDStopStreamAtEndAsync(DVDCommandBlock* block, DVDCBCallback callback);
+s32 DVDStopStreamAtEnd(DVDCommandBlock* block);
+int DVDGetStreamErrorStatusAsync(DVDCommandBlock* block, DVDCBCallback callback);
+s32 DVDGetStreamErrorStatus(DVDCommandBlock* block);
+int DVDGetStreamPlayAddrAsync(DVDCommandBlock* block, DVDCBCallback callback);
+s32 DVDGetStreamPlayAddr(DVDCommandBlock* block);
+int DVDGetStreamStartAddrAsync(DVDCommandBlock* block, DVDCBCallback callback);
+s32 DVDGetStreamStartAddr(DVDCommandBlock* block);
+int DVDGetStreamLengthAsync(DVDCommandBlock* block, DVDCBCallback callback);
+s32 DVDGetStreamLength(DVDCommandBlock* block);
+int DVDChangeDiskAsyncForBS(DVDCommandBlock* block, DVDCBCallback callback);
+int DVDChangeDiskAsync(DVDCommandBlock* block, DVDDiskID* id, DVDCBCallback callback);
+s32 DVDChangeDisk(DVDCommandBlock* block, DVDDiskID* id);
+int DVDStopMotorAsync(DVDCommandBlock* block, DVDCBCallback callback);
+s32 DVDStopMotor(DVDCommandBlock* block);
+int DVDInquiryAsync(DVDCommandBlock* block, DVDDriveInfo* info, DVDCBCallback callback);
+s32 DVDInquiry(DVDCommandBlock* block, DVDDriveInfo* info);
+void DVDReset(void);
+int DVDResetRequired(void);
+s32 DVDGetCommandBlockStatus(const DVDCommandBlock* block);
+s32 DVDGetDriveStatus(void);
+BOOL DVDSetAutoInvalidation(BOOL autoInval);
+void DVDPause(void);
+void DVDResume(void);
+int DVDCancelAsync(DVDCommandBlock* block, DVDCBCallback callback);
+s32 DVDCancel(volatile DVDCommandBlock* block);
+int DVDCancelAllAsync(DVDCBCallback callback);
+s32 DVDCancelAll(void);
+DVDDiskID* DVDGetCurrentDiskID(void);
+BOOL DVDCheckDisk(void);
+
+// DVD FATAL
+int DVDSetAutoFatalMessaging(BOOL enable);
+
+// DVD FS
+s32 DVDConvertPathToEntrynum(const char* pathPtr);
+BOOL DVDFastOpen(s32 entrynum, DVDFileInfo* fileInfo);
+BOOL DVDOpen(const char* fileName, DVDFileInfo* fileInfo);
+BOOL DVDClose(DVDFileInfo* fileInfo);
+BOOL DVDGetCurrentDir(char* path, u32 maxlen);
+BOOL DVDChangeDir(const char* dirName);
+BOOL DVDReadAsyncPrio(DVDFileInfo* fileInfo, void* addr, s32 length, s32 offset,
+                      DVDCallback callback, s32 prio);
+s32 DVDReadPrio(DVDFileInfo* fileInfo, void* addr, s32 length, s32 offset, s32 prio);
+int DVDSeekAsyncPrio(DVDFileInfo* fileInfo, s32 offset, void (* callback)(s32, DVDFileInfo *), s32 prio);
+s32 DVDSeekPrio(DVDFileInfo* fileInfo, s32 offset, s32 prio);
+s32 DVDGetFileInfoStatus(const DVDFileInfo* fileInfo);
+BOOL DVDFastOpenDir(s32 entrynum, DVDDir* dir);
+int DVDOpenDir(const char* dirName, DVDDir* dir);
+int DVDReadDir(DVDDir* dir, DVDDirEntry* dirent);
+int DVDCloseDir(DVDDir* dir);
+void DVDRewindDir(DVDDir* dir);
+void* DVDGetFSTLocation(void);
+const u8* DVDGetDOLLocation(s32* out_size);
+BOOL DVDPrepareStreamAsync(DVDFileInfo* fileInfo, u32 length, u32 offset, DVDCallback callback);
+s32 DVDPrepareStream(DVDFileInfo* fileInfo, u32 length, u32 offset);
+s32 DVDGetTransferredSize(DVDFileInfo* fileinfo);
+
+#define DVDReadAsync(fileInfo, addr, length, offset, callback) \
+    DVDReadAsyncPrio((fileInfo), (addr), (length), (offset), (callback), 2)
+
+// DVD ID UTILS
+int DVDCompareDiskID(const DVDDiskID* id1, const DVDDiskID* id2);
+DVDDiskID* DVDGenerateDiskID(DVDDiskID* id, const char* game, const char* company, u8 diskNum, u8 version);
+
+// DVD LOW
+BOOL DVDLowRead(void* addr, u32 length, u32 offset, DVDLowCallback callback);
+BOOL DVDLowSeek(u32 offset, DVDLowCallback callback);
+BOOL DVDLowWaitCoverClose(DVDLowCallback callback);
+BOOL DVDLowReadDiskID(DVDDiskID* diskID, DVDLowCallback callback);
+BOOL DVDLowStopMotor(DVDLowCallback callback);
+BOOL DVDLowRequestError(DVDLowCallback callback);
+BOOL DVDLowInquiry(DVDDriveInfo* info, DVDLowCallback callback);
+BOOL DVDLowAudioStream(u32 subcmd, u32 length, u32 offset, DVDLowCallback callback);
+BOOL DVDLowRequestAudioStatus(u32 subcmd, DVDLowCallback callback);
+BOOL DVDLowAudioBufferConfig(BOOL enable, u32 size, DVDLowCallback callback);
+void DVDLowReset(void);
+DVDLowCallback DVDLowSetResetCoverCallback(DVDLowCallback callback);
+BOOL DVDLowBreak(void);
+DVDLowCallback DVDLowClearCallback(void);
+u32 DVDLowGetCoverStatus(void);
+
+// DVD QUEUE
+void DVDDumpWaitingQueue(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/exi.h b/aurora-main/include/dolphin/exi.h
new file mode 100644
index 0000000..f094c36
--- /dev/null
+++ b/aurora-main/include/dolphin/exi.h
@@ -0,0 +1,103 @@
+#ifndef _DOLPHIN_EXI_H_
+#define _DOLPHIN_EXI_H_
+
+#include <dolphin/os.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define EXI_MEMORY_CARD_59 0x00000004
+#define EXI_MEMORY_CARD_123 0x00000008
+#define EXI_MEMORY_CARD_251 0x00000010
+#define EXI_MEMORY_CARD_507 0x00000020
+
+#define EXI_MEMORY_CARD_1019 0x00000040
+#define EXI_MEMORY_CARD_2043 0x00000080
+
+#define EXI_MEMORY_CARD_1019A 0x00000140
+#define EXI_MEMORY_CARD_1019B 0x00000240
+#define EXI_MEMORY_CARD_1019C 0x00000340
+#define EXI_MEMORY_CARD_1019D 0x00000440
+#define EXI_MEMORY_CARD_1019E 0x00000540
+#define EXI_MEMORY_CARD_1019F 0x00000640
+#define EXI_MEMORY_CARD_1019G 0x00000740
+
+#define EXI_MEMORY_CARD_2043A 0x00000180
+#define EXI_MEMORY_CARD_2043B 0x00000280
+#define EXI_MEMORY_CARD_2043C 0x00000380
+#define EXI_MEMORY_CARD_2043D 0x00000480
+#define EXI_MEMORY_CARD_2043E 0x00000580
+#define EXI_MEMORY_CARD_2043F 0x00000680
+#define EXI_MEMORY_CARD_2043G 0x00000780
+
+#define EXI_USB_ADAPTER 0x01010000
+#define EXI_NPDP_GDEV 0x01020000
+
+#define EXI_MODEM  0x02020000
+#define EXI_ETHER  0x04020200
+#define EXI_MIC    0x04060000
+#define EXI_AD16   0x04120000
+#define EXI_RS232C 0x04040404
+#define EXI_ETHER_VIEWER 0x04220001
+#define EXI_STREAM_HANGER 0x04130000
+
+#define EXI_MARLIN 0x03010000
+
+#define EXI_IS_VIEWER 0x05070000
+
+#define EXI_READ  0
+#define EXI_WRITE 1
+
+#define EXI_FREQ_1M  0
+#define EXI_FREQ_2M  1
+#define EXI_FREQ_4M  2
+#define EXI_FREQ_8M  3
+#define EXI_FREQ_16M 4
+#define EXI_FREQ_32M 5
+
+typedef void (*EXICallback)(s32 chan, OSContext* context);
+typedef struct EXIControl {    
+    EXICallback exiCallback;
+    EXICallback tcCallback;
+    EXICallback extCallback;
+    volatile u32 state;
+    int immLen;
+    u8* immBuf;
+    u32 dev;
+    u32 id;
+    s32 idTime;
+    int items;
+    struct {
+        u32 dev;
+        EXICallback callback;
+    } queue[3];
+} EXIControl;
+
+EXICallback EXISetExiCallback(s32 channel, EXICallback callback);
+
+void EXIInit(void);
+BOOL EXILock(s32 channel, u32 device, EXICallback callback);
+BOOL EXIUnlock(s32 channel);
+BOOL EXISelect(s32 channel, u32 device, u32 frequency);
+BOOL EXIDeselect(s32 channel);
+BOOL EXIImm(s32 channel, void* buffer, s32 length, u32 type, EXICallback callback);
+BOOL EXIImmEx(s32 channel, void* buffer, s32 length, u32 type);
+BOOL EXIDma(s32 channel, void* buffer, s32 length, u32 type, EXICallback callback);
+BOOL EXISync(s32 channel);
+BOOL EXIProbe(s32 channel);
+s32 EXIProbeEx(s32 channel);
+BOOL EXIAttach(s32 channel, EXICallback callback);
+BOOL EXIDetach(s32 channel);
+u32 EXIGetState(s32 channel);
+s32 EXIGetID(s32 channel, u32 device, u32* id);
+void EXIProbeReset(void);
+int EXISelectSD(s32 chan, u32 dev, u32 freq);
+s32 EXIGetType(s32 chan, u32 dev, u32* type);
+char* EXIGetTypeString(u32 type);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gd.h b/aurora-main/include/dolphin/gd.h
new file mode 100644
index 0000000..d4fabfd
--- /dev/null
+++ b/aurora-main/include/dolphin/gd.h
@@ -0,0 +1,15 @@
+#ifndef _DOLPHIN_GD_H_
+#define _DOLPHIN_GD_H_
+
+#include <dolphin/gd/GDAurora.h>
+#include <dolphin/gd/GDBase.h>
+#include <dolphin/gd/GDFile.h>
+#include <dolphin/gd/GDGeometry.h>
+#include <dolphin/gd/GDIndirect.h>
+#include <dolphin/gd/GDLight.h>
+#include <dolphin/gd/GDPixel.h>
+#include <dolphin/gd/GDTev.h>
+#include <dolphin/gd/GDTexture.h>
+#include <dolphin/gd/GDTransform.h>
+
+#endif
diff --git a/aurora-main/include/dolphin/gd/GDAurora.h b/aurora-main/include/dolphin/gd/GDAurora.h
new file mode 100644
index 0000000..f898ece
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDAurora.h
@@ -0,0 +1,22 @@
+#ifndef DOLPHIN_GDAURORA_H
+#define DOLPHIN_GDAURORA_H
+
+/**
+ * Pushes a debug group to the backend graphics API. These may show in debugging tools such as RenderDoc.
+ *
+ * It is considered an error to have unpopped debug groups at the end of the frame. They will be automatically cleared.
+ * Debug groups are *not* automatically scoped to a display list.
+ */
+void GDPushDebugGroup(const char* label);
+
+/**
+ * Pop a debug group previously pushed via GXPushDebugGroup().
+ */
+void GDPopDebugGroup();
+
+/**
+ * Sends a debug marker to the backend graphics API. These may show in debugging tools such as RenderDoc.
+ */
+void GDInsertDebugMarker(const char* label);
+
+#endif // DOLPHIN_GDAURORA_H
diff --git a/aurora-main/include/dolphin/gd/GDBase.h b/aurora-main/include/dolphin/gd/GDBase.h
new file mode 100644
index 0000000..1c88333
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDBase.h
@@ -0,0 +1,177 @@
+#ifndef _DOLPHIN_GD_BASE_H
+#define _DOLPHIN_GD_BASE_H
+
+#include <dolphin/types.h>
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/gx/GXCommandList.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*GDOverflowCb)(void);
+
+typedef struct _GDLObj {
+	u8* start;
+	u32 length;
+	u8* ptr;
+	u8* top;
+} GDLObj;
+
+extern GDLObj* __GDCurrentDL;
+
+void GDInitGDLObj(GDLObj* dl, void* start, u32 length);
+void GDFlushCurrToMem(void);
+void GDPadCurr32(void);
+void GDOverflowed(void);
+void GDSetOverflowCallback(GDOverflowCb callback);
+GDOverflowCb GDGetOverflowCallback(void);
+
+inline static void GDOverflowCheck(u32 size) {
+    if (__GDCurrentDL->ptr + size > __GDCurrentDL->top) {
+        GDOverflowed();
+    }
+}
+
+inline static void __GDWrite(u8 data) {
+    *__GDCurrentDL->ptr++ = data;
+}
+
+inline static void GDWrite_data(const void* data, u32 length) {
+    GDOverflowCheck(length);
+    // The compiler realizes this is memcpy, trust.
+    const u8* dataPtr = static_cast<const u8*>(data);
+    for (u32 i = 0; i < length; i++) {
+        __GDWrite(dataPtr[i]);
+    }
+}
+
+inline static void GDWrite_u8(u8 data) {
+    GDOverflowCheck(sizeof(u8));
+    __GDWrite(data);
+}
+
+inline static void GDWrite_u16(u16 data) {
+    GDOverflowCheck(sizeof(u16));
+    __GDWrite((u8)((data >> 8)));
+    __GDWrite((u8)((data >> 0) & 0xFF));
+}
+
+inline static void GDWrite_u24(u32 data) {
+    GDOverflowCheck(3);
+    __GDWrite((u8)((data >> 16) & 0xFF));
+    __GDWrite((u8)((data >> 8) & 0xFF));
+    __GDWrite((u8)((data >> 0) & 0xFF));
+}
+
+inline static void GDWrite_u32(u32 data) {
+    GDOverflowCheck(sizeof(u32));
+    __GDWrite((u8)((data >> 24) & 0xFF));
+    __GDWrite((u8)((data >> 16) & 0xFF));
+    __GDWrite((u8)((data >> 8) & 0xFF));
+    __GDWrite((u8)((data >> 0) & 0xFF));
+}
+
+inline static void GDWrite_u64(u64 data) {
+  GDOverflowCheck(sizeof(u64));
+  __GDWrite((u8)((data >> 56) & 0xFF));
+  __GDWrite((u8)((data >> 48) & 0xFF));
+  __GDWrite((u8)((data >> 40) & 0xFF));
+  __GDWrite((u8)((data >> 32) & 0xFF));
+  __GDWrite((u8)((data >> 24) & 0xFF));
+  __GDWrite((u8)((data >> 16) & 0xFF));
+  __GDWrite((u8)((data >> 8) & 0xFF));
+  __GDWrite((u8)((data >> 0) & 0xFF));
+}
+
+inline static void GDWrite_f32(f32 data) {
+    union {
+        f32 f;
+        u32 u;
+    } fid;
+    fid.f = data;
+    GDWrite_u32(fid.u);
+}
+
+inline static void GDWriteXFCmdHdr(u16 addr, u8 len) {
+    GDWrite_u8(GX_LOAD_XF_REG);
+    GDWrite_u16(len - 1);
+    GDWrite_u16(addr);
+}
+
+inline static void GDWriteXFCmd(u16 addr, u32 val) {
+    GDWrite_u8(GX_LOAD_XF_REG);
+    GDWrite_u16(0);
+    GDWrite_u16(addr);
+    GDWrite_u32(val);
+}
+
+inline static void GDWriteXFIndxDCmd(u16 addr, u8 len, u16 index) {
+    GDWrite_u8(GX_LOAD_INDX_D);
+    GDWrite_u16(index);
+    GDWrite_u16((len - 1) << 12 | addr);
+}
+
+inline static void GDWriteXFIndxACmd(u16 addr, u8 len, u16 index) {
+    GDWrite_u8(GX_LOAD_INDX_A);
+    GDWrite_u16(index);
+    GDWrite_u16(((len - 1) << 12) | addr);
+}
+
+inline static void GDWriteXFIndxBCmd(u16 addr, u8 len, u16 index) {
+    GDWrite_u8(GX_LOAD_INDX_B);
+    GDWrite_u16(index);
+    GDWrite_u16(((len - 1) << 12) | addr);
+}
+
+inline static void GDWriteXFIndxCCmd(u16 addr, u8 len, u16 index) {
+    GDWrite_u8(GX_LOAD_INDX_C);
+    GDWrite_u16(index);
+    GDWrite_u16(((len - 1) << 12) | addr);
+}
+
+inline static void GDWriteCPCmd(u8 addr, u32 val) {
+    GDWrite_u8(GX_LOAD_CP_REG);
+    GDWrite_u8(addr);
+    GDWrite_u32(val);
+}
+
+inline static void GDWriteBPCmd(u32 regval) {
+    GDWrite_u8(GX_LOAD_BP_REG);
+    GDWrite_u32(regval);
+}
+
+inline static void GDWriteAuroraCmd(u16 subCommand) {
+  GDWrite_u8(GX_LOAD_AURORA);
+  GDWrite_u16(subCommand);
+}
+
+inline static void GDSetCurrent(GDLObj* dl) {
+    __GDCurrentDL = dl;
+}
+
+static inline u32 GDGetCurrOffset(void) {
+    return (u32)(__GDCurrentDL->ptr - __GDCurrentDL->start);
+}
+
+static inline void GDSetCurrOffset(u32 offset) {
+    __GDCurrentDL->ptr = __GDCurrentDL->start + offset;
+}
+
+static inline void* GDGetCurrPointer(void) {
+    return (void*)__GDCurrentDL->ptr;
+}
+
+static inline u8* GDGetCurrPointer2(void) {
+    return __GDCurrentDL->ptr;
+}
+
+static inline u32 GDGetGDLObjOffset(const GDLObj* dl) {
+    return (u32)(dl->ptr - dl->start);
+}
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gd/GDFile.h b/aurora-main/include/dolphin/gd/GDFile.h
new file mode 100644
index 0000000..3589fbb
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDFile.h
@@ -0,0 +1,31 @@
+#ifndef _DOLPHIN_GD_FILE_H
+#define _DOLPHIN_GD_FILE_H
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define GD_FILE_VERSION_NUMBER 0x11223344
+
+typedef struct _GDGList {
+    void* ptr;
+    u32 byteLength;
+} GDGList;
+
+typedef struct _GDFileHeader {
+    u32 versionNumber;
+    u32 numDLs;
+    u32 numPLs;
+    GDGList* DLDescArray;
+    GDGList* PLDescArray;
+} GDFileHeader;
+
+s32 GDReadDLFile(const char* fName, u32* numDLs, u32* numPLs, GDGList** DLDescArray, GDGList** PLDescArray);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gd/GDGeometry.h b/aurora-main/include/dolphin/gd/GDGeometry.h
new file mode 100644
index 0000000..ef80885
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDGeometry.h
@@ -0,0 +1,525 @@
+#ifndef _DOLPHIN_GD_GEOMETRY_H_
+#define _DOLPHIN_GD_GEOMETRY_H_
+
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// Command processor register IDs
+#define CP_REG_MTXIDXA_ID     0x30  // Matrix index A
+#define CP_REG_MTXIDXB_ID     0x40  // Matrix index B
+#define CP_REG_VCD_LO_ID      0x50  // Vertex descriptor (lo)
+#define CP_REG_VCD_HI_ID      0x60  // Vertex descriptor (hi)
+#define CP_REG_VAT_GRP0_ID    0x70  // Vertex attribute table (group 0)
+#define CP_REG_VAT_GRP1_ID    0x80  // Vertex attribute table (group 1)
+#define CP_REG_VAT_GRP2_ID    0x90  // Vertex attribute table (group 2)
+#define CP_REG_ARRAYBASE_ID   0xA0  // Vertex array start/base
+#define CP_REG_ARRAYSTRIDE_ID 0xB0  // Vertex array stride
+
+// XF locators for textures
+// Projection type [30-30]
+#define GX_XF_TEX_PROJTYPE_ST 30
+#define GX_XF_TEX_PROJTYPE_END 30
+
+// Input format [29-29]
+#define GX_XF_TEX_INPUTFORM_ST 29
+#define GX_XF_TEX_INPUTFORM_END 29
+
+// Texture gen type [25-27]
+#define GX_XF_TEX_TEXGENTYPE_ST 25
+#define GX_XF_TEX_TEXGENTYPE_END 27
+
+// Source row [20-24]
+#define GX_XF_TEX_SRCROW_ST 20
+#define GX_XF_TEX_SRCROW_END 24
+
+// Bump source texture [17-19]
+#define GX_XF_TEX_BUMPSRCTEX_ST 17
+#define GX_XF_TEX_BUMPSRCTEX_END 19
+
+// Bump source light [14-16]
+#define GX_XF_TEX_BUMPSRCLIGHT_ST 14
+#define GX_XF_TEX_BUMPSRCLIGHT_END 16
+
+// Blitting processor registers.
+#define GX_BP_REG_GENMODE 0x0  // gen mode
+
+// display copy filters
+#define GX_BP_REG_DISPCOPYFILTER0 0x1  // display copy filter 0
+#define GX_BP_REG_DISPCOPYFILTER1 0x2  // display copy filter 1
+#define GX_BP_REG_DISPCOPYFILTER2 0x3  // display copy filter 2
+#define GX_BP_REG_DISPCOPYFILTER3 0x4  // display copy filter 3
+
+// indirect matrices
+#define GX_BP_REG_INDMTX0A 0x6  // indirect matrix 0A
+#define GX_BP_REG_INDMTX0B 0x7  // indirect matrix 0B
+#define GX_BP_REG_INDMTX0C 0x8  // indirect matrix 0C
+#define GX_BP_REG_INDMTX1A 0x9  // indirect matrix 1A
+#define GX_BP_REG_INDMTX1B 0xA  // indirect matrix 1B
+#define GX_BP_REG_INDMTX1C 0xB  // indirect matrix 1C
+#define GX_BP_REG_INDMTX2A 0xC  // indirect matrix 2A
+#define GX_BP_REG_INDMTX2B 0xD  // indirect matrix 2B
+#define GX_BP_REG_INDMTX2C 0xE  // indirect matrix 2C
+#define GX_BP_REG_INDIMASK 0xF  // indirect mask
+
+// indirect TEV stages
+#define GX_BP_REG_INDTEVSTAGE0 0x10   // indirect TEV stage 0
+#define GX_BP_REG_INDTEVSTAGE1 0x11   // indirect TEV stage 1
+#define GX_BP_REG_INDTEVSTAGE2 0x12   // indirect TEV stage 2
+#define GX_BP_REG_INDTEVSTAGE3 0x13   // indirect TEV stage 3
+#define GX_BP_REG_INDTEVSTAGE4 0x14   // indirect TEV stage 4
+#define GX_BP_REG_INDTEVSTAGE5 0x15   // indirect TEV stage 5
+#define GX_BP_REG_INDTEVSTAGE6 0x16   // indirect TEV stage 6
+#define GX_BP_REG_INDTEVSTAGE7 0x17   // indirect TEV stage 7
+#define GX_BP_REG_INDTEVSTAGE8 0x18   // indirect TEV stage 8
+#define GX_BP_REG_INDTEVSTAGE9 0x19   // indirect TEV stage 9
+#define GX_BP_REG_INDTEVSTAGE10 0x1A  // indirect TEV stage 10
+#define GX_BP_REG_INDTEVSTAGE11 0x1B  // indirect TEV stage 11
+#define GX_BP_REG_INDTEVSTAGE12 0x1C  // indirect TEV stage 12
+#define GX_BP_REG_INDTEVSTAGE13 0x1D  // indirect TEV stage 13
+#define GX_BP_REG_INDTEVSTAGE14 0x1E  // indirect TEV stage 14
+#define GX_BP_REG_INDTEVSTAGE15 0x1F  // indirect TEV stage 15
+
+// performance manips
+#define GX_BP_REG_SCISSORTL 0x20    // scissor top left
+#define GX_BP_REG_SCISSORBR 0x21    // scissor bottom right
+#define GX_BP_REG_LINEPTWIDTH 0x22  // line point width
+#define GX_BP_REG_PERF0TRI 0x23     // performance 0 (triangle)
+#define GX_BP_REG_PERF0QUAD 0x24    // performance 0 (quad)
+
+// rasters
+#define GX_BP_REG_RAS1_SS0 0x25
+#define GX_BP_REG_RAS1_SS1 0x26
+#define GX_BP_REG_RAS1_IREF 0x27
+#define GX_BP_REG_RAS1_TREF0 0x28
+#define GX_BP_REG_RAS1_TREF1 0x29
+#define GX_BP_REG_RAS1_TREF2 0x2A
+#define GX_BP_REG_RAS1_TREF3 0x2B
+#define GX_BP_REG_RAS1_TREF4 0x2C
+#define GX_BP_REG_RAS1_TREF5 0x2D
+#define GX_BP_REG_RAS1_TREF6 0x2E
+#define GX_BP_REG_RAS1_TREF7 0x2F
+
+// setup sizes
+#define GX_BP_REG_SU_SSIZE0 0x30
+#define GX_BP_REG_SU_TSIZE0 0x31
+#define GX_BP_REG_SU_SSIZE1 0x32
+#define GX_BP_REG_SU_TSIZE1 0x33
+#define GX_BP_REG_SU_SSIZE2 0x34
+#define GX_BP_REG_SU_TSIZE2 0x35
+#define GX_BP_REG_SU_SSIZE3 0x36
+#define GX_BP_REG_SU_TSIZE3 0x37
+#define GX_BP_REG_SU_SSIZE4 0x38
+#define GX_BP_REG_SU_TSIZE4 0x39
+#define GX_BP_REG_SU_SSIZE5 0x3A
+#define GX_BP_REG_SU_TSIZE5 0x3B
+#define GX_BP_REG_SU_SSIZE6 0x3C
+#define GX_BP_REG_SU_TSIZE6 0x3D
+#define GX_BP_REG_SU_SSIZE7 0x3E
+#define GX_BP_REG_SU_TSIZE7 0x3F
+
+// Z and blend controls
+#define GX_BP_REG_ZMODE 0x40
+#define GX_BP_REG_BLENDMODE 0x41
+#define GX_BP_REG_DSTALPHA 0x42
+#define GX_BP_REG_ZCONTROL 0x43
+#define GX_BP_REG_FIELDMASK 0x44
+#define GX_BP_REG_DRAWDONE 0x45
+#define GX_BP_REG_PETOKEN 0x47
+#define GX_BP_REG_PETOKENINT 0x48
+
+// copying
+#define GX_BP_REG_TEXCOPYSRCXY 0x49
+#define GX_BP_REG_TEXCOPYSRCWH 0x4A
+#define GX_BP_REG_TEXCOPYDST 0x4B
+#define GX_BP_REG_DISPCOPYSTRIDE 0x4D
+#define GX_BP_REG_DISPCOPYSCALEY 0x4E
+#define GX_BP_REG_COPYCLEARAR 0x4F
+#define GX_BP_REG_COPYCLEARGB 0x50
+#define GX_BP_REG_COPYCLEARZ 0x51
+#define GX_BP_REG_COPYFILTER0 0x53
+#define GX_BP_REG_COPYFILTER1 0x54
+
+//
+#define GX_BP_REG_BOUNDINGBOX0 0x55
+#define GX_BP_REG_BOUNDINGBOX1 0x56
+
+#define GX_BP_REG_SCISSOROFFSET 0x59
+
+// texture memory
+#define GX_BP_REG_TMEMPRELOADADDR 0x60
+#define GX_BP_REG_TMEMPRELOADEVEN 0x61
+#define GX_BP_REG_TMEMPRELOADODD 0x62
+#define GX_BP_REG_TMEMPRELOADMODE 0x63
+#define GX_BP_REG_TMEMTLUTSRC 0x64
+#define GX_BP_REG_TMEMTLUTDST 0x65
+#define GX_BP_REG_TMEMTEXINVALIDATE 0x66
+
+// performance 1
+#define GX_BP_REG_PERF1 0x67
+#define GX_BP_REG_FIELDMODE 0x68
+
+// set modes
+#define GX_BP_REG_SETMODE0_TEX0 0x80
+#define GX_BP_REG_SETMODE0_TEX1 0x81
+#define GX_BP_REG_SETMODE0_TEX2 0x82
+#define GX_BP_REG_SETMODE0_TEX3 0x83
+#define GX_BP_REG_SETMODE1_TEX0 0x84
+#define GX_BP_REG_SETMODE1_TEX1 0x85
+#define GX_BP_REG_SETMODE1_TEX2 0x86
+#define GX_BP_REG_SETMODE1_TEX3 0x87
+
+// set images
+#define GX_BP_REG_SETIMAGE0_TEX0 0x88
+#define GX_BP_REG_SETIMAGE0_TEX1 0x89
+#define GX_BP_REG_SETIMAGE0_TEX2 0x8A
+#define GX_BP_REG_SETIMAGE0_TEX3 0x8B
+#define GX_BP_REG_SETIMAGE1_TEX0 0x8C
+#define GX_BP_REG_SETIMAGE1_TEX1 0x8D
+#define GX_BP_REG_SETIMAGE1_TEX2 0x8E
+#define GX_BP_REG_SETIMAGE1_TEX3 0x8F
+#define GX_BP_REG_SETIMAGE2_TEX0 0x90
+#define GX_BP_REG_SETIMAGE2_TEX1 0x91
+#define GX_BP_REG_SETIMAGE2_TEX2 0x92
+#define GX_BP_REG_SETIMAGE2_TEX3 0x93
+#define GX_BP_REG_SETIMAGE3_TEX0 0x94
+#define GX_BP_REG_SETIMAGE3_TEX1 0x95
+#define GX_BP_REG_SETIMAGE3_TEX2 0x96
+#define GX_BP_REG_SETIMAGE3_TEX3 0x97
+
+// set texture lookups
+#define GX_BP_REG_SETTLUT_TEX0 0x98
+#define GX_BP_REG_SETTLUT_TEX1 0x99
+#define GX_BP_REG_SETTLUT_TEX2 0x9A
+#define GX_BP_REG_SETTLUT_TEX3 0x9B
+
+// set modes continued
+#define GX_BP_REG_SETMODE0_TEX4 0xA0
+#define GX_BP_REG_SETMODE0_TEX5 0xA1
+#define GX_BP_REG_SETMODE0_TEX6 0xA2
+#define GX_BP_REG_SETMODE0_TEX7 0xA3
+#define GX_BP_REG_SETMODE1_TEX4 0xA4
+#define GX_BP_REG_SETMODE1_TEX5 0xA5
+#define GX_BP_REG_SETMODE1_TEX6 0xA6
+#define GX_BP_REG_SETMODE1_TEX7 0xA7
+
+// set images continued
+#define GX_BP_REG_SETIMAGE0_TEX4 0xA8
+#define GX_BP_REG_SETIMAGE0_TEX5 0xA9
+#define GX_BP_REG_SETIMAGE0_TEX6 0xAA
+#define GX_BP_REG_SETIMAGE0_TEX7 0xAB
+#define GX_BP_REG_SETIMAGE1_TEX4 0xAC
+#define GX_BP_REG_SETIMAGE1_TEX5 0xAD
+#define GX_BP_REG_SETIMAGE1_TEX6 0xAE
+#define GX_BP_REG_SETIMAGE1_TEX7 0xAF
+#define GX_BP_REG_SETIMAGE2_TEX4 0xB0
+#define GX_BP_REG_SETIMAGE2_TEX5 0xB1
+#define GX_BP_REG_SETIMAGE2_TEX6 0xB2
+#define GX_BP_REG_SETIMAGE2_TEX7 0xB3
+#define GX_BP_REG_SETIMAGE3_TEX4 0xB4
+#define GX_BP_REG_SETIMAGE3_TEX5 0xB5
+#define GX_BP_REG_SETIMAGE3_TEX6 0xB6
+#define GX_BP_REG_SETIMAGE3_TEX7 0xB7
+
+// set texture lookups continued
+#define GX_BP_REG_SETTLUT_TEX4 0xB8
+#define GX_BP_REG_SETTLUT_TEX5 0xB9
+#define GX_BP_REG_SETTLUT_TEX6 0xBA
+#define GX_BP_REG_SETTLUT_TEX7 0xBB
+
+// TEV color manips
+#define GX_BP_REG_TEVCOLORCOMBINER0 0xC0
+#define GX_BP_REG_TEVALPHACOMBINER0 0xC1
+#define GX_BP_REG_TEVCOLORCOMBINER1 0xC2
+#define GX_BP_REG_TEVALPHACOMBINER1 0xC3
+#define GX_BP_REG_TEVCOLORCOMBINER2 0xC4
+#define GX_BP_REG_TEVALPHACOMBINER2 0xC5
+#define GX_BP_REG_TEVCOLORCOMBINER3 0xC6
+#define GX_BP_REG_TEVALPHACOMBINER3 0xC7
+#define GX_BP_REG_TEVCOLORCOMBINER4 0xC8
+#define GX_BP_REG_TEVALPHACOMBINER4 0xC9
+#define GX_BP_REG_TEVCOLORCOMBINER5 0xCA
+#define GX_BP_REG_TEVALPHACOMBINER5 0xCB
+#define GX_BP_REG_TEVCOLORCOMBINER6 0xCC
+#define GX_BP_REG_TEVALPHACOMBINER6 0xCD
+#define GX_BP_REG_TEVCOLORCOMBINER7 0xCE
+#define GX_BP_REG_TEVALPHACOMBINER7 0xCF
+#define GX_BP_REG_TEVCOLORCOMBINER8 0xD0
+#define GX_BP_REG_TEVALPHACOMBINER8 0xD1
+#define GX_BP_REG_TEVCOLORCOMBINER9 0xD2
+#define GX_BP_REG_TEVALPHACOMBINER9 0xD3
+#define GX_BP_REG_TEVCOLORCOMBINER10 0xD4
+#define GX_BP_REG_TEVALPHACOMBINER10 0xD5
+#define GX_BP_REG_TEVCOLORCOMBINER11 0xD6
+#define GX_BP_REG_TEVALPHACOMBINER11 0xD7
+#define GX_BP_REG_TEVCOLORCOMBINER12 0xD8
+#define GX_BP_REG_TEVALPHACOMBINER12 0xD9
+#define GX_BP_REG_TEVCOLORCOMBINER13 0xDA
+#define GX_BP_REG_TEVALPHACOMBINER13 0xDB
+#define GX_BP_REG_TEVCOLORCOMBINER14 0xDC
+#define GX_BP_REG_TEVALPHACOMBINER14 0xDD
+#define GX_BP_REG_TEVCOLORCOMBINER15 0xDE
+#define GX_BP_REG_TEVALPHACOMBINER15 0xDF
+
+// TEV registers
+#define GX_BP_REG_TEVREG0LO 0xE0
+#define GX_BP_REG_TEVREG0HI 0xE1
+#define GX_BP_REG_TEVREG1LO 0xE2
+#define GX_BP_REG_TEVREG1HI 0xE3
+#define GX_BP_REG_TEVREG2LO 0xE4
+#define GX_BP_REG_TEVREG2HI 0xE5
+#define GX_BP_REG_TEVREG3LO 0xE6
+#define GX_BP_REG_TEVREG3HI 0xE7
+
+// fog registers
+#define GX_BP_REG_FOGRANGE 0xE8
+#define GX_BP_REG_FOGRANGEK0 0xE9
+#define GX_BP_REG_FOGRANGEK1 0xEA
+#define GX_BP_REG_FOGRANGEK2 0xEB
+#define GX_BP_REG_FOGRANGEK3 0xEC
+#define GX_BP_REG_FOGRANGEK4 0xED
+#define GX_BP_REG_FOGPARAM0 0xEE
+#define GX_BP_REG_FOGPARAM1 0xEF
+#define GX_BP_REG_FOGPARAM2 0xF0
+#define GX_BP_REG_FOGPARAM3 0xF1
+#define GX_BP_REG_FOGCOLOR 0xF2
+
+// performance manip registers
+#define GX_BP_REG_ALPHACOMPARE 0xF3
+#define GX_BP_REG_ZTEXTURE0 0xF4
+#define GX_BP_REG_ZTEXTURE1 0xF5
+
+// TEV K selectors
+#define GX_BP_REG_TEVKSEL0 0xF6
+#define GX_BP_REG_TEVKSEL1 0xF7
+#define GX_BP_REG_TEVKSEL2 0xF8
+#define GX_BP_REG_TEVKSEL3 0xF9
+#define GX_BP_REG_TEVKSEL4 0xFA
+#define GX_BP_REG_TEVKSEL5 0xFB
+#define GX_BP_REG_TEVKSEL6 0xFC
+#define GX_BP_REG_TEVKSEL7 0xFD
+
+// SS mask
+#define GX_BP_REG_SSMASK 0xFE
+
+// Transform Unit Registers
+#define GX_XF_REG_ERROR 0x1000
+#define GX_XF_REG_DIAGNOSTICS 0x1001
+#define GX_XF_REG_STATE0 0x1002
+#define GX_XF_REG_STATE1 0x1003
+#define GX_XF_REG_CLOCK 0x1004
+#define GX_XF_REG_CLIPDISABLE 0x1005
+#define GX_XF_REG_PERF0 0x1006
+#define GX_XF_REG_PERF1 0x1007
+#define GX_XF_REG_INVERTEXSPEC 0x1008
+#define GX_XF_REG_NUMCOLORS 0x1009
+#define GX_XF_REG_AMBIENT0 0x100A
+#define GX_XF_REG_AMBIENT1 0x100B
+#define GX_XF_REG_MATERIAL0 0x100C
+#define GX_XF_REG_MATERIAL1 0x100D
+#define GX_XF_REG_COLOR0CNTRL 0x100E
+#define GX_XF_REG_COLOR1CNTRL 0x100F
+#define GX_XF_REG_ALPHA0CNTRL 0x1010
+#define GX_XF_REG_ALPHA1CNTRL 0x1011
+#define GX_XF_REG_DUALTEXTRAN 0x1012
+#define GX_XF_REG_MATRIXINDEX0 0x1018
+#define GX_XF_REG_MATRIXINDEX1 0x1019
+#define GX_XF_REG_SCALEX 0x101A
+#define GX_XF_REG_SCALEY 0x101B
+#define GX_XF_REG_SCALEZ 0x101C
+#define GX_XF_REG_OFFSETX 0x101D
+#define GX_XF_REG_OFFSETY 0x101E
+#define GX_XF_REG_OFFSETZ 0x101F
+#define GX_XF_REG_PROJECTIONA 0x1020
+#define GX_XF_REG_PROJECTIONB 0x1021
+#define GX_XF_REG_PROJECTIONC 0x1022
+#define GX_XF_REG_PROJECTIOND 0x1023
+#define GX_XF_REG_PROJECTIONE 0x1024
+#define GX_XF_REG_PROJECTIONF 0x1025
+#define GX_XF_REG_PROJECTORTHO 0x1026
+#define GX_XF_REG_NUMTEX 0x103F
+#define GX_XF_REG_TEX0 0x1040
+#define GX_XF_REG_TEX1 0x1041
+#define GX_XF_REG_TEX2 0x1042
+#define GX_XF_REG_TEX3 0x1043
+#define GX_XF_REG_TEX4 0x1044
+#define GX_XF_REG_TEX5 0x1045
+#define GX_XF_REG_TEX6 0x1046
+#define GX_XF_REG_TEX7 0x1047
+#define GX_XF_REG_DUALTEX0 0x1050
+#define GX_XF_REG_DUALTEX1 0x1051
+#define GX_XF_REG_DUALTEX2 0x1052
+#define GX_XF_REG_DUALTEX3 0x1053
+#define GX_XF_REG_DUALTEX4 0x1054
+#define GX_XF_REG_DUALTEX5 0x1055
+#define GX_XF_REG_DUALTEX6 0x1056
+#define GX_XF_REG_DUALTEX7 0x1057
+
+#define CP_REG_VCD_LO(pnMtxIdx, txMtxIdxMask, posn, norm, col0, col1) \
+    ( \
+        (pnMtxIdx) << 0  | \
+        (txMtxIdxMask) << 1  | \
+        (posn) << 9  | \
+        (norm) << 11 | \
+        (col0) << 13 | \
+        (col1) << 15   \
+    )
+
+#define CP_REG_VCD_HI(tex0, tex1, tex2, tex3, tex4, tex5, tex6, tex7) \
+    ( \
+        (tex0) << 0  | \
+        (tex1) << 2  | \
+        (tex2) << 4  | \
+        (tex3) << 6  | \
+        (tex4) << 8  | \
+        (tex5) << 10 | \
+        (tex6) << 12 | \
+        (tex7) << 14   \
+    )
+
+#define CP_REG_VAT_GRP0(posCnt, posType, posFrac, nrmCnt, nrmType, c0Cnt, c0Type, c1Cnt, c1Type, tx0Cnt, tx0Type, tx0Frac, p12, nrmIdx3) \
+    ( \
+        (posCnt) << 0 | \
+        (posType) << 1 | \
+        (posFrac) << 4 | \
+        (nrmCnt) << 9 | \
+        (nrmType) << 10 | \
+        (c0Cnt) << 13 | \
+        (c0Type) << 14 | \
+        (c1Cnt) << 17 | \
+        (c1Type) << 18 | \
+        (tx0Cnt) << 21 | \
+        (tx0Type) << 22 | \
+        (tx0Frac) << 25 | \
+        (p12) << 30 | \
+        (nrmIdx3) << 31 \
+    )
+
+#define CP_REG_VAT_GRP1(tx1Cnt, tx1Type, tx1Frac, tx2Cnt, tx2Type, tx2Frac, tx3Cnt, tx3Type, tx3Frac, tx4Cnt, tx4Type, p11) \
+    ( \
+        (tx1Cnt) << 0 | \
+        (tx1Type) << 1 | \
+        (tx1Frac) << 4 | \
+        (tx2Cnt) << 9 | \
+        (tx2Type) << 10 | \
+        (tx2Frac) << 13 | \
+        (tx3Cnt) << 18 | \
+        (tx3Type) << 19 | \
+        (tx3Frac) << 22 | \
+        (tx4Cnt) << 27 | \
+        (tx4Type) << 28 | \
+        p11 << 31 \
+    )
+
+#define CP_REG_VAT_GRP2(tx4Frac, tx5Cnt, tx5Type, tx5Frac, tx6Cnt, tx6Type, tx6Frac, tx7Cnt, tx7Type, tx7Frac) \
+    ( \
+        (tx4Frac) << 0 | \
+        (tx5Cnt) << 5 | \
+        (tx5Type) << 6 | \
+        (tx5Frac) << 9 | \
+        (tx6Cnt) << 14 | \
+        (tx6Type) << 15 | \
+        (tx6Frac) << 18 | \
+        (tx7Cnt) << 23 | \
+        (tx7Type) << 24 | \
+        (tx7Frac) << 27 \
+    )
+
+// Transform unit register IDs
+#define XF_REG_ERROR_ID        0x1000
+#define XF_REG_DIAGNOSTICS_ID  0x1001
+#define XF_REG_STATE0_ID       0x1002
+#define XF_REG_STATE1_ID       0x1003
+#define XF_REG_CLOCK_ID        0x1004
+#define XF_REG_CLIPDISABLE_ID  0x1005
+#define XF_REG_PERF0_ID        0x1006
+#define XF_REG_PERF1_ID        0x1007
+#define XF_REG_INVERTEXSPEC_ID 0x1008
+#define XF_REG_NUMCOLORS_ID    0x1009
+#define XF_REG_DUALTEXTRAN_ID  0x1012
+#define XF_REG_SCALEX_ID       0x101A
+#define XF_REG_SCALEY_ID       0x101B
+#define XF_REG_SCALEZ_ID       0x101C
+#define XF_REG_OFFSETX_ID      0x101D
+#define XF_REG_OFFSETY_ID      0x101E
+#define XF_REG_OFFSETZ_ID      0x101F
+#define XF_REG_NUMTEX_ID       0x103F
+#define XF_REG_TEX0_ID         0x1040
+#define XF_REG_TEX1_ID         0x1041
+#define XF_REG_TEX2_ID         0x1042
+#define XF_REG_TEX3_ID         0x1043
+#define XF_REG_TEX4_ID         0x1044
+#define XF_REG_TEX5_ID         0x1045
+#define XF_REG_TEX6_ID         0x1046
+#define XF_REG_TEX7_ID         0x1047
+#define XF_REG_DUALTEX0_ID     0x1050
+#define XF_REG_DUALTEX1_ID     0x1051
+#define XF_REG_DUALTEX2_ID     0x1052
+#define XF_REG_DUALTEX3_ID     0x1053
+#define XF_REG_DUALTEX4_ID     0x1054
+#define XF_REG_DUALTEX5_ID     0x1055
+#define XF_REG_DUALTEX6_ID     0x1056
+#define XF_REG_DUALTEX7_ID     0x1057
+
+#define XF_REG_INVTXSPEC(ncols, nnorms, ntexs) \
+    ( \
+        (ncols) << 0 | \
+        (nnorms) << 2 | \
+        (ntexs) << 4 \
+    )
+
+#define XF_REG_TEX(proj, form, tgType, row, embossRow, embossLit) \
+    ( \
+        (proj) << 1 | \
+        (form) << 2 | \
+        (tgType) << 4 | \
+        (row) << 7 | \
+        (embossRow) << 12 | \
+        (embossLit) << 15 \
+    )
+
+#define XF_REG_DUALTEX(mtx, normalize) \
+    ( \
+        (mtx) << 0 | \
+        (normalize) << 8 \
+    )
+
+#define BP_GEN_MODE(nTexGens, nChans, nTevs, p4, nInds) \
+    ( \
+        (u32)(nTexGens) << 0 | \
+        (u32)(nChans) << 4 | \
+        (u32)(nTevs) << 10 | \
+        (u32)(p4) << 14 | \
+        (u32)(nInds) << 16 \
+    )
+
+#define BP_LP_SIZE(lineWidth, pointSize, lineOffset, pointOffset, lineHalfAspect, p5) \
+    ( \
+        (u32)(lineWidth) << 0 | \
+        (u32)(pointSize) << 8 | \
+        (u32)(lineOffset) << 16 | \
+        (u32)(pointOffset) << 19 | \
+        (u32)(lineHalfAspect) << 22 | \
+        (u32)(p5) << 24 \
+    )
+
+void GDSetVtxDescv(const GXVtxDescList* attrPtr);
+void GDSetVtxAttrFmtv(GXVtxFmt vtxfmt, const GXVtxAttrFmtList* list);
+void GDSetArraySized(GXAttr attr, void* base_ptr, u32 size, u8 stride, bool le);
+void GDSetArray(GXAttr attr, void* base_ptr, u8 stride);
+void GDSetArrayRaw(GXAttr attr, u32 base_ptr_raw, u8 stride);
+void GDPatchArrayPtr(void* base_ptr);
+void GDSetTexCoordGen(GXTexCoordID dst_coord, GXTexGenType func, GXTexGenSrc src_param, u8 normalize, u32 postmtx);
+void GDSetCullMode(GXCullMode mode);
+void GDSetGenMode(u8 nTexGens, u8 nChans, u8 nTevs);
+void GDSetGenMode2(u8 nTexGens, u8 nChans, u8 nTevs, u8 nInds, GXCullMode cm);
+void GDSetLPSize(u8 lineWidth, u8 pointSize, GXTexOffset lineOffset, GXTexOffset pointOffset, u8 lineHalfAspect);
+void GDSetCoPlanar(u8 enable);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gd/GDIndirect.h b/aurora-main/include/dolphin/gd/GDIndirect.h
new file mode 100644
index 0000000..4ca854c
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDIndirect.h
@@ -0,0 +1,91 @@
+#ifndef _DOLPHIN_GD_INDIRECT_H_
+#define _DOLPHIN_GD_INDIRECT_H_
+
+#include <dolphin/types.h>
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/mtx.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define BP_TEV_INDIRECT(ind_stage, format, bias_sel, alpha_sel, mtx_sel, wrap_s, wrap_t, utc_lod, add_prev, id) \
+    ( \
+        (u32)(ind_stage) << 0 | \
+        (u32)(format) << 2 | \
+        (u32)(bias_sel) << 4 | \
+        (u32)(alpha_sel) << 7 | \
+        (u32)(mtx_sel) << 9 | \
+        (u32)(wrap_s) << 13 | \
+        (u32)(wrap_t) << 16 | \
+        (u32)(utc_lod) << 19 | \
+        (u32)(add_prev) << 20 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_IND_MTX(m0, m1, scale_exp, id) \
+    ( \
+        (u32)(m0) << 0 | \
+        (u32)(m1) << 11 | \
+        (u32)(scale_exp) << 22 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_IND_TEXCOORD_SCALE(scaleS0, scaleT0, scaleS1, scaleT1, id) \
+    ( \
+        (u32)(scaleS0) << 0 | \
+        (u32)(scaleT0) << 4 | \
+        (u32)(scaleS1) << 8 | \
+        (u32)(scaleT1) << 12 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_IND_TEX_ORDER(map0, coord0, map1, coord1, map2, coord2, map3, coord3, id) \
+    ( \
+        (u32)(map0) << 0 | \
+        (u32)(coord0) << 3 | \
+        (u32)(map1) << 6 | \
+        (u32)(coord1) << 9 | \
+        (u32)(map2) << 12 | \
+        (u32)(coord2) << 15 | \
+        (u32)(map3) << 18 | \
+        (u32)(coord3) << 21 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_IND_MASK(mask, id) \
+    ( \
+        (u32)(mask) << 0 | \
+        (u32)(id) << 24 \
+    )
+
+void GDSetTevIndirect(GXTevStageID tev_stage, GXIndTexStageID ind_stage,
+                      GXIndTexFormat format, GXIndTexBiasSel bias_sel,
+                      GXIndTexMtxID matrix_sel, GXIndTexWrap wrap_s,
+                      GXIndTexWrap wrap_t, u8 add_prev, u8 utc_lod,
+                      GXIndTexAlphaSel alpha_sel);
+void GDSetIndTexMtx(GXIndTexMtxID mtx_id, const f32 offset[2][3], s8 scale_exp);
+void GDSetIndTexCoordScale(GXIndTexStageID indStageEven, GXIndTexScale scaleS0,
+                           GXIndTexScale scaleT0, GXIndTexScale scaleS1,
+                           GXIndTexScale scaleT1);
+void GDSetIndTexOrder(GXTexCoordID texCoord0, GXTexMapID texMap0,
+                      GXTexCoordID texCoord1, GXTexMapID texMap1,
+                      GXTexCoordID texCoord2, GXTexMapID texMap2,
+                      GXTexCoordID texCoord3, GXTexMapID texMap3);
+void GDSetTevDirect(GXTevStageID tev_stage);
+void GDSetTevIndWarp(GXTevStageID tev_stage, GXIndTexStageID ind_stage, u8 signed_offset, u8 replace_mode, GXIndTexMtxID matrix_sel);
+void GDSetTevIndTile(GXTevStageID tev_stage, GXIndTexStageID ind_stage,
+                     u16 tilesize_s, u16 tilesize_t, u16 tilespacing_s,
+                     u16 tilespacing_t, GXIndTexFormat format,
+                     GXIndTexMtxID matrix_sel, GXIndTexBiasSel bias_sel,
+                     GXIndTexAlphaSel alpha_sel);
+void GDSetTevIndBumpST(GXTevStageID tev_stage, GXIndTexStageID ind_stage, GXIndTexMtxID matrix_sel);
+void GDSetTevIndBumpXYZ(GXTevStageID tev_stage, GXIndTexStageID ind_stage, GXIndTexMtxID matrix_sel);
+void GDSetTevIndRepeat(GXTevStageID tev_stage);
+void __GDSetIndTexMask(u32 mask);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gd/GDLight.h b/aurora-main/include/dolphin/gd/GDLight.h
new file mode 100644
index 0000000..512a9d7
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDLight.h
@@ -0,0 +1,65 @@
+#ifndef _DOLPHIN_GD_LIGHT_H_
+#define _DOLPHIN_GD_LIGHT_H_
+
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define XF_LIGHT_ID          0x0600
+#define XF_LIGHT_COLOR_ID    0x0603
+#define XF_LIGHT_ATTN_ID     0x0604
+#define XF_LIGHT_DISTATTN_ID 0x0607
+#define XF_LIGHT_POS_ID      0x060A
+#define XF_LIGHT_SPEC_DIR_ID 0x060A
+#define XF_LIGHT_DIR_ID      0x060D
+
+#define XF_REG_AMBIENT0_ID     0x100A
+#define XF_REG_AMBIENT1_ID     0x100B
+#define XF_REG_MATERIAL0_ID    0x100C
+#define XF_REG_MATERIAL1_ID    0x100D
+#define XF_REG_COLOR0CNTRL_ID  0x100E
+#define XF_REG_COLOR1CNTRL_ID  0x100F
+#define XF_REG_ALPHA0CNTRL_ID  0x1010
+#define XF_REG_ALPHA1CNTRL_ID  0x1011
+
+#define XF_REG_CHAN_CTRL(matsrc, enable, lightmask0, ambsrc, diff_fn, p5, p6, lightmask4) \
+	( \
+		(u32)(matsrc) << 0 | \
+		(u32)(enable) << 1 | \
+		(u32)(lightmask0) << 2 | \
+		(u32)(ambsrc) << 6 | \
+		(u32)(diff_fn) << 7 | \
+		(u32)(p5) << 9 | \
+		(u32)(p6) << 10 | \
+		(u32)(lightmask4) << 11 \
+	)
+
+void GDSetLightAttn(GXLightID light, f32 a0, f32 a1, f32 a2, f32 k0, f32 k1, f32 k2);
+void GDSetLightSpot(GXLightID light, f32 cutoff, GXSpotFn spot_func);
+void GDSetLightDistAttn(GXLightID light, f32 ref_dist, f32 ref_br, GXDistAttnFn dist_func);
+void GDSetLightColor(GXLightID light, GXColor color);
+void GDSetLightPos(GXLightID light, f32 x, f32 y, f32 z);
+void GDSetLightDir(GXLightID light, f32 nx, f32 ny, f32 nz);
+void GDSetSpecularDirHA(GXLightID light, f32 nx, f32 ny, f32 nz, f32 hx, f32 hy, f32 hz);
+void GDSetSpecularDir(GXLightID light, f32 nx, f32 ny, f32 nz);
+void GDLoadLightObjIndx(u32 lt_obj_indx, GXLightID light);
+void GDSetChanAmbColor(GXChannelID chan, GXColor color);
+void GDSetChanMatColor(GXChannelID chan, GXColor color);
+void GDSetChanCtrl(GXChannelID chan, u8 enable, GXColorSrc amb_src,
+                   GXColorSrc mat_src, u32 light_mask, GXDiffuseFn diff_fn,
+                   GXAttnFn attn_fn);
+
+u16 __GDLightID2Index(GXLightID id);
+
+inline static u16 __GDLightID2Offset(GXLightID id) {
+	return __GDLightID2Index(id) * 16;
+}
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gd/GDPixel.h b/aurora-main/include/dolphin/gd/GDPixel.h
new file mode 100644
index 0000000..158b04e
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDPixel.h
@@ -0,0 +1,95 @@
+#ifndef _DOLPHIN_GD_PIXEL_H
+#define _DOLPHIN_GD_PIXEL_H
+
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define BP_FOG_UNK0(a, id) \
+    ( \
+        (u32)(a) << 0 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_FOG_UNK1(b_m, id) \
+    ( \
+        (u32)(b_m) << 0 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_FOG_UNK2(b_expn, id) \
+    ( \
+        (u32)(b_expn) << 0 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_FOG_UNK3(c, proj, fsel, id) \
+    ( \
+        (u32)(c) << 0 | \
+        (u32)(proj) << 20 | \
+        (u32)(fsel) << 21 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_FOG_COLOR(r, g, b, id) \
+    ( \
+        (u32)(b) << 0 | \
+        (u32)(g) << 8 | \
+        (u32)(r) << 16 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_BLEND_MODE(enable, enable_logic, enable_dither, enable_color_update, enable_alpha_update, dst_factor, src_factor, blend_sub, logic_op, id) \
+    ( \
+        (u32)(enable) << 0 | \
+        (u32)(enable_logic) << 1 | \
+        (u32)(enable_dither) << 2 | \
+        (u32)(enable_color_update) << 3 | \
+        (u32)(enable_alpha_update) << 4 | \
+        (u32)(dst_factor) << 5 | \
+        (u32)(src_factor) << 8 | \
+        (u32)(blend_sub) << 11 | \
+        (u32)(logic_op) << 12 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_Z_MODE(enable_compare, compare_fn, enable_update, id) \
+    ( \
+        (u32)(enable_compare) << 0 | \
+        (u32)(compare_fn) << 1 | \
+        (u32)(enable_update) << 4 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_DST_ALPHA(alpha, enable, id) \
+    ( \
+        (u32)(alpha) << 0 | \
+        (u32)(enable) << 8 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TOKEN(token, id) \
+    ( \
+        (u32)(token) << 0 | \
+        (u32)(id) << 24 \
+    )
+
+void GDSetFog(GXFogType type, f32 startz, f32 endz, f32 nearz, f32 farz, GXColor color);
+void GDSetBlendMode(GXBlendMode type, GXBlendFactor src_factor, GXBlendFactor dst_factor, GXLogicOp logic_op);
+void GDSetBlendModeEtc(GXBlendMode type, GXBlendFactor src_factor,
+                       GXBlendFactor dst_factor, GXLogicOp logic_op,
+                       u8 color_update_enable,
+                       u8 alpha_update_enable,
+                       u8 dither_enable);
+void GDSetZMode(u8 compare_enable, GXCompare func, u8 update_enable);
+void GDSetDstAlpha(u8 enable, u8 alpha);
+void GDSetDrawSync(u16 token);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gd/GDTev.h b/aurora-main/include/dolphin/gd/GDTev.h
new file mode 100644
index 0000000..baec8b5
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDTev.h
@@ -0,0 +1,133 @@
+#ifndef _DOLPHIN_GD_TEV_H
+#define _DOLPHIN_GD_TEV_H
+
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define BP_TEV_COLOR(d, c, b, a, bias, op, clamp, scale, out, id) \
+    ( \
+        (u32)(d) << 0 | \
+        (u32)(c) << 4 | \
+        (u32)(b) << 8 | \
+        (u32)(a) << 12 | \
+        (u32)(bias) << 16 | \
+        (u32)(op) << 18 | \
+        (u32)(clamp) << 19 | \
+        (u32)(scale) << 20 | \
+        (u32)(out) << 22 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEV_ALPHA(ras_sel, tex_sel, d, c, b, a, bias, op, clamp, scale, out, id) \
+    ( \
+        (u32)(ras_sel) << 0 | \
+        (u32)(tex_sel) << 2 | \
+        (u32)(d) << 4 | \
+        (u32)(c) << 7 | \
+        (u32)(b) << 10 | \
+        (u32)(a) << 13 | \
+        (u32)(bias) << 16 | \
+        (u32)(op) << 18 | \
+        (u32)(clamp) << 19 | \
+        (u32)(scale) << 20 | \
+        (u32)(out) << 22 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEV_COLOR_REG_RA(r, a, reg, id) \
+    ( \
+        (u32)(r) << 0 | \
+        (u32)(a) << 12 | \
+        (u32)(reg) << 23 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEV_COLOR_REG_BG(b, g, reg, id) \
+    ( \
+        (u32)(b) << 0 | \
+        (u32)(g) << 12 | \
+        (u32)(reg) << 23 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEV_KSEL(rb, ga, kcsel0, kasel0, kcsel1, kasel1, id) \
+    ( \
+        (u32)(rb) << 0 | \
+        (u32)(ga) << 2 | \
+        (u32)(kcsel0) << 4 | \
+        (u32)(kasel0) << 9 | \
+        (u32)(kcsel1) << 14 | \
+        (u32)(kasel1) << 19 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_ALPHA_COMPARE(ref0, ref1, comp0, comp1, op, id) \
+    ( \
+        (u32)(ref0) << 0 | \
+        (u32)(ref1) << 8 | \
+        (u32)(comp0) << 16 | \
+        (u32)(comp1) << 19 | \
+        (u32)(op) << 22 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_ZTEX_PARAMS_0(bias, id) \
+    ( \
+        (u32)(bias) << 0 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_ZTEX_PARAMS_1(zfmt, op, id) \
+    ( \
+        (u32)(zfmt) << 0 | \
+        (u32)(op) << 2 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEV_ORDER(map0, coord0, enable0, color0, map1, coord1, enable1, color1, id) \
+    ( \
+        (u32)(map0) << 0 | \
+        (u32)(coord0) << 3 | \
+        (u32)(enable0) << 6 | \
+        (u32)(color0) << 7 | \
+        (u32)(map1) << 12 | \
+        (u32)(coord1) << 15 | \
+        (u32)(enable1) << 18 | \
+        (u32)(color1) << 19 | \
+        (u32)(id) << 24 \
+    )
+
+void GDSetTevOp(GXTevStageID stage, GXTevMode mode);
+void GDSetTevColorCalc(GXTevStageID stage, GXTevColorArg a, GXTevColorArg b,
+                       GXTevColorArg c, GXTevColorArg d, GXTevOp op,
+                       GXTevBias bias, GXTevScale scale, u8 clamp,
+                       GXTevRegID out_reg);
+void GDSetTevAlphaCalcAndSwap(GXTevStageID stage, GXTevAlphaArg a,
+                              GXTevAlphaArg b, GXTevAlphaArg c, GXTevAlphaArg d,
+                              GXTevOp op, GXTevBias bias, GXTevScale scale,
+                              u8 clamp, GXTevRegID out_reg,
+                              GXTevSwapSel ras_sel, GXTevSwapSel tex_sel);
+void GDSetTevColor(GXTevRegID reg, GXColor color);
+void GDSetTevColorS10(GXTevRegID reg, GXColorS10 color);
+void GDSetTevKColor(GXTevKColorID reg, GXColor color);
+void GDSetTevKonstantSel(GXTevStageID evenStage, GXTevKColorSel kcsel0,
+                         GXTevKAlphaSel kasel0, GXTevKColorSel kcsel1,
+                         GXTevKAlphaSel kasel1);
+void GDSetTevSwapModeTable(GXTevSwapSel table, GXTevColorChan red,
+                           GXTevColorChan green, GXTevColorChan blue,
+                           GXTevColorChan alpha);
+void GDSetAlphaCompare(GXCompare comp0, u8 ref0, GXAlphaOp op, GXCompare comp1, u8 ref1);
+void GDSetZTexture(GXZTexOp op, GXTexFmt fmt, u32 bias);
+void GDSetTevOrder(GXTevStageID evenStage, GXTexCoordID coord0, GXTexMapID map0,
+                   GXChannelID color0, GXTexCoordID coord1, GXTexMapID map1,
+                   GXChannelID color1);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gd/GDTexture.h b/aurora-main/include/dolphin/gd/GDTexture.h
new file mode 100644
index 0000000..2370cbb
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDTexture.h
@@ -0,0 +1,127 @@
+#ifndef _DOLPHIN_GD_TEXTURE_H
+#define _DOLPHIN_GD_TEXTURE_H
+
+#include <dolphin/types.h>
+#include <dolphin/gx/GXEnum.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define BP_TEX_MODE0(wrap_s, wrap_t, mag_filt, min_filt, edge_lod, lod_bias, max_aniso, bias_clamp, id) \
+    ( \
+        (u32)(wrap_s) << 0 | \
+        (u32)(wrap_t) << 2 | \
+        (u32)(mag_filt) << 4 | \
+        (u32)(min_filt) << 5 | \
+        (u32)(edge_lod) << 8 | \
+        (u32)(lod_bias) << 9 | \
+        (u32)(max_aniso) << 19 | \
+        (u32)(bias_clamp) << 21 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEX_MODE1(min_lod, max_lod, id) \
+    ( \
+        (u32)(min_lod) << 0 | \
+        (u32)(max_lod) << 8 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_IMAGE_ATTR(width, height, format, id) \
+    ( \
+        (u32)(width) << 0 | \
+        (u32)(height) << 10 | \
+        (u32)(format) << 20 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_IMAGE_PTR(ptr, id) \
+    ( \
+        (u32)(ptr) << 0 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEX_CACHE_EVEN(tmem, size0, size1, type, id) \
+    ( \
+        (u32)(tmem) << 0 | \
+        (u32)(size0) << 15 | \
+        (u32)(size1) << 18 | \
+        (u32)(type) << 21 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEX_CACHE_ODD(tmem, size0, size1, id) \
+    ( \
+        (u32)(tmem) << 0 | \
+        (u32)(size0) << 15 | \
+        (u32)(size1) << 18 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEX_TLUT(tmem, format, id) \
+    ( \
+        (u32)(tmem) << 0 | \
+        (u32)(format) << 10 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEXCOORD_S_SCALE(s_scale, s_bias, s_wrap, line_offset, point_offset, id) \
+    ( \
+        (u32)(s_scale) << 0 | \
+        (u32)(s_bias) << 16 | \
+        (u32)(s_wrap) << 17 | \
+        (u32)(line_offset) << 18 | \
+        (u32)(point_offset) << 19 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_TEXCOORD_T_SCALE(t_scale, t_bias, t_wrap, id) \
+    ( \
+        (u32)(t_scale) << 0 | \
+        (u32)(t_bias) << 16 | \
+        (u32)(t_wrap) << 17 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_LOAD_TLUT0(ptr, id) \
+    ( \
+        (u32)(ptr) << 0 | \
+        (u32)(id) << 24 \
+    )
+
+#define BP_LOAD_TLUT1(ptr, size, id) \
+    ( \
+        (u32)(ptr) << 0 | \
+        (u32)(size) << 10 | \
+        (u32)(id) << 24 \
+    )
+
+void GDSetTexLookupMode(GXTexMapID id, GXTexWrapMode wrap_s,
+                        GXTexWrapMode wrap_t, GXTexFilter min_filt,
+                        GXTexFilter mag_filt, f32 min_lod, f32 max_lod,
+                        f32 lod_bias, u8 bias_clamp, u8 do_edge_lod,
+                        GXAnisotropy max_aniso);
+
+void GDSetTexImgAttr(GXTexMapID id, u16 width, u16 height, GXTexFmt format);
+void GDSetTexImgPtr(GXTexMapID id, void* image_ptr);
+void GDSetTexImgPtrRaw(GXTexMapID id, u32 image_ptr_raw);
+void GDPatchTexImgPtr(void* image_ptr);
+void GDSetTexCached(GXTexMapID id, u32 tmem_even, GXTexCacheSize size_even,
+                    u32 tmem_odd, GXTexCacheSize size_odd);
+void GDSetTexPreLoaded(GXTexMapID id, u32 tmem_even, u32 tmem_odd);
+void GDSetTexTlut(GXTexMapID id, u32 tmem_addr, GXTlutFmt format);
+void GDSetTexCoordScale(GXTexCoordID coord, u16 s_scale, u16 t_scale);
+void GDSetTexCoordScale2(GXTexCoordID coord, u16 s_scale, u8 s_bias,
+                         u8 s_wrap, u16 t_scale, u8 t_bias, u8 t_wrap);
+void GDSetTexCoordScaleAndTOEs(GXTexCoordID coord, u16 s_scale, u8 s_bias,
+                               u8 s_wrap, u16 t_scale, u8 t_bias, u8 t_wrap,
+                               u8 line_offset, u8 point_offset);
+void GDLoadTlut(void* tlut_ptr, u32 tmem_addr, GXTlutSize size);
+void GDLoadTlutRaw(u32 tlut_ptr_raw, u32 tmem_addr, GXTlutSize size);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gd/GDTransform.h b/aurora-main/include/dolphin/gd/GDTransform.h
new file mode 100644
index 0000000..8d0159f
--- /dev/null
+++ b/aurora-main/include/dolphin/gd/GDTransform.h
@@ -0,0 +1,56 @@
+#ifndef _DOLPHIN_GD_TRANSFORM_H_
+#define _DOLPHIN_GD_TRANSFORM_H_
+
+#include <dolphin/types.h>
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/mtx.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define CP_MTX_REG_A_ID 0x30
+#define CP_MTX_REG_B_ID 0x40
+
+#define XF_REG_MATRIXINDEX0_ID 0x1018
+#define XF_REG_MATRIXINDEX1_ID 0x1019
+#define XF_REG_PROJECTIONA_ID  0x1020
+#define XF_REG_PROJECTIONB_ID  0x1021
+#define XF_REG_PROJECTIONC_ID  0x1022
+#define XF_REG_PROJECTIOND_ID  0x1023
+#define XF_REG_PROJECTIONE_ID  0x1024
+#define XF_REG_PROJECTIONF_ID  0x1025
+#define XF_REG_PROJECTORTHO_ID 0x1026
+
+#define CP_MTX_REG_A(pn, t0, t1, t2, t3) \
+    ( \
+        (u32)(pn) << 0 | \
+        (u32)(t0) << 6 | \
+        (u32)(t1) << 12 | \
+        (u32)(t2) << 18 | \
+        (u32)(t3) << 24 \
+    )
+
+#define CP_MTX_REG_B(t4, t5, t6, t7) \
+    ( \
+        (u32)(t4) << 0 | \
+        (u32)(t5) << 6 | \
+        (u32)(t6) << 12 | \
+        (u32)(t7) << 18 \
+    )
+
+void GDLoadPosMtxImm(const Mtx mtx, u32 id);
+void GDLoadPosMtxIndx(u16 mtx_indx, u32 id);
+void GDLoadNrmMtxImm(const Mtx mtx, u32 id);
+void GDLoadNrmMtxImm3x3(const f32 mtx[3][3], u32 id);
+void GDLoadNrmMtxIndx3x3(u16 mtx_indx, u32 id);
+void GDLoadTexMtxImm(const Mtx mtx, u32 id, GXTexMtxType type);
+void GDLoadTexMtxIndx(u16 mtx_indx, u32 id, GXTexMtxType type);
+void GDSetCurrentMtx(u32 pn, u32 t0, u32 t1, u32 t2, u32 t3, u32 t4, u32 t5, u32 t6, u32 t7);
+void GDSetProjection(const Mtx44 mtx, GXProjectionType type);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gf.h b/aurora-main/include/dolphin/gf.h
new file mode 100644
index 0000000..50676ae
--- /dev/null
+++ b/aurora-main/include/dolphin/gf.h
@@ -0,0 +1,9 @@
+#ifndef _DOLPHIN_GF_H_
+#define _DOLPHIN_GF_H_
+
+#include <dolphin/gf/GFGeometry.h>
+#include <dolphin/gf/GFLight.h>
+#include <dolphin/gf/GFPixel.h>
+#include <dolphin/gf/GFTev.h>
+
+#endif
diff --git a/aurora-main/include/dolphin/gf/GFGeometry.h b/aurora-main/include/dolphin/gf/GFGeometry.h
new file mode 100644
index 0000000..c0866a5
--- /dev/null
+++ b/aurora-main/include/dolphin/gf/GFGeometry.h
@@ -0,0 +1,41 @@
+#ifndef _DOLPHIN_GF_GFGEOMETRY_H_
+#define _DOLPHIN_GF_GFGEOMETRY_H_
+
+#include <dolphin/gx.h>
+
+#define GF_GEN_MODE(nTexGens, nChans, nTevs, cm, nInds) \
+    ( \
+        (u32)(nTexGens) << 0 | \
+        (u32)(nChans) << 4 | \
+        (u32)(nTevs) << 10 | \
+        (u32)(cm) << 14 | \
+        (u32)(nInds) << 16 \
+    )
+
+static inline void GFWrite_u8(u8 data) {
+    GXCmd1u8(data);
+}
+
+static inline void GFWrite_u32(u32 data) {
+    GXCmd1u32(data);
+}
+
+static inline void GFWrite_u16(u16 data) {
+    GXCmd1u16(data);
+}
+
+static inline void GFWriteBPCmd(u32 regval) {
+    GFWrite_u8(GX_LOAD_BP_REG);
+    GFWrite_u32(regval);
+}
+
+static inline void GFWriteXFCmd(u16 addr, u32 val) {
+    GFWrite_u8(GX_LOAD_XF_REG);
+    GFWrite_u16(0);
+    GFWrite_u16(addr);
+    GFWrite_u32(val);
+}
+
+void GFSetGenMode2(u8 nTexGens, u8 nChans, u8 nTevs, u8 nInds, GXCullMode cm);
+
+#endif /* _DOLPHIN_GF_GFGEOMETRY_H_ */
diff --git a/aurora-main/include/dolphin/gf/GFLight.h b/aurora-main/include/dolphin/gf/GFLight.h
new file mode 100644
index 0000000..3c4e222
--- /dev/null
+++ b/aurora-main/include/dolphin/gf/GFLight.h
@@ -0,0 +1,8 @@
+#ifndef _DOLPHIN_GF_GFLIGHT_H
+#define _DOLPHIN_GF_GFLIGHT_H
+
+#include <dolphin/gx.h>
+
+void GFSetChanAmbColor(GXChannelID chan, GXColor color);
+
+#endif /* _DOLPHIN_GF_GFLIGHT_H */
diff --git a/aurora-main/include/dolphin/gf/GFPixel.h b/aurora-main/include/dolphin/gf/GFPixel.h
new file mode 100644
index 0000000..93b7ff9
--- /dev/null
+++ b/aurora-main/include/dolphin/gf/GFPixel.h
@@ -0,0 +1,13 @@
+#ifndef _DOLPHIN_GF_GFPIXEL_H
+#define _DOLPHIN_GF_GFPIXEL_H
+
+#include <dolphin/gx.h>
+
+void GFSetFog(GXFogType type, f32 startz, f32 endz, f32 nearz, f32 farz, GXColor color);
+void GFSetBlendModeEtc(GXBlendMode type, GXBlendFactor src_factor,
+                       GXBlendFactor dst_factor, GXLogicOp logic_op,
+                       u8 color_update_enable, u8 alpha_update_enable,
+                       u8 dither_enable);
+void GFSetZMode(u8 compare_enable, GXCompare func, u8 update_enable);
+
+#endif /* _DOLPHIN_GF_GFPIXEL_H */
diff --git a/aurora-main/include/dolphin/gf/GFTev.h b/aurora-main/include/dolphin/gf/GFTev.h
new file mode 100644
index 0000000..ade4c41
--- /dev/null
+++ b/aurora-main/include/dolphin/gf/GFTev.h
@@ -0,0 +1,8 @@
+#ifndef _DOLPHIN_GF_GFTEV_H
+#define _DOLPHIN_GF_GFTEV_H
+
+#include <dolphin/gx.h>
+
+void GFSetTevColorS10(GXTevRegID reg, GXColorS10 color);
+
+#endif /* _DOLPHIN_GF_GFTEV_H */
diff --git a/aurora-main/include/dolphin/gx.h b/aurora-main/include/dolphin/gx.h
new file mode 100644
index 0000000..b4cf7ef
--- /dev/null
+++ b/aurora-main/include/dolphin/gx.h
@@ -0,0 +1,34 @@
+#ifndef DOLPHIN_GX_H
+#define DOLPHIN_GX_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <dolphin/gx/GXAurora.h>
+#include <dolphin/gx/GXBump.h>
+#include <dolphin/gx/GXCommandList.h>
+#include <dolphin/gx/GXCpu2Efb.h>
+#include <dolphin/gx/GXCull.h>
+#include <dolphin/gx/GXDispList.h>
+#include <dolphin/gx/GXDraw.h>
+#include <dolphin/gx/GXExtra.h>
+#include <dolphin/gx/GXFifo.h>
+#include <dolphin/gx/GXFrameBuffer.h>
+#include <dolphin/gx/GXGeometry.h>
+#include <dolphin/gx/GXGet.h>
+#include <dolphin/gx/GXLighting.h>
+#include <dolphin/gx/GXManage.h>
+#include <dolphin/gx/GXPerf.h>
+#include <dolphin/gx/GXPixel.h>
+#include <dolphin/gx/GXStruct.h>
+#include <dolphin/gx/GXTev.h>
+#include <dolphin/gx/GXTexture.h>
+#include <dolphin/gx/GXTransform.h>
+#include <dolphin/gx/GXVert.h>
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXAurora.h b/aurora-main/include/dolphin/gx/GXAurora.h
new file mode 100644
index 0000000..953a19a
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXAurora.h
@@ -0,0 +1,148 @@
+#ifndef DOLPHIN_GXAURORA_H
+#define DOLPHIN_GXAURORA_H
+
+#include <dolphin/types.h>
+
+#if __cplusplus
+extern "C" {
+#endif
+
+//
+// Subcommands for GX_LOAD_AURORA.
+//
+
+/**
+ * Sets the actual render viewport in native framebuffer coordinates.
+ * Must be followed by six f32 values: left, top, width, height, nearz, farz.
+ */
+#define GX_LOAD_AURORA_VIEWPORT_RENDER 0x0001
+
+/**
+ * Sets the actual render scissor in native framebuffer coordinates.
+ * Must be followed by four u32 values: left, top, width, height.
+ */
+#define GX_LOAD_AURORA_SCISSOR_RENDER 0x0002
+
+/**
+ * Aurora equivalent of CP_REG_ARRAYBASE_ID: sets the base address and size of a vertex array.
+ * This command must be followed by a 64-bit memory address, 32-bit size, and 1-byte little-endian flag.
+ * The index of the vertex array is given by the lowest 4 bits of the command ID,
+ * e.g. writing GX_LOAD_AURORA_ARRAYBASE + 5 will set the vertex array for the sixth vertex attribute.
+ * To set strides, use the normal CP_REG_ARRAYSTRIDE_ID register.
+ */
+#define GX_LOAD_AURORA_ARRAYBASE 0x0010
+
+/**
+ * Pushes a debug group to the backend graphics API. These may show in debugging tools such as RenderDoc.
+ * Must be followed by a u16 string length and that many UTF-8 characters (no null terminator required).
+ * It is considered an error to have unpopped debug groups at the end of the frame. They will be automatically cleared.
+ */
+#define GX_LOAD_AURORA_DEBUG_GROUP_PUSH 0x0020
+
+/**
+ * Pops a previously pushed debug group.
+ * Followed by nothing.
+ */
+#define GX_LOAD_AURORA_DEBUG_GROUP_POP 0x0021
+
+/**
+ * Sends a debug marker to the backend graphics API.
+ * Must be followed by a u16 string length and that many UTF-8 characters (no null terminator required).
+ */
+#define GX_LOAD_AURORA_DEBUG_MARKER_INSERT 0x0022
+
+#define GX_LOAD_AURORA_TEXOBJ 0x0030
+
+#define GX_LOAD_AURORA_TLUT 0x0031
+
+#define GX_LOAD_AURORA_DESTROY_TEXOBJ 0x0032
+
+#define GX_LOAD_AURORA_DESTROY_TLUT 0x0033
+
+#define GX_LOAD_AURORA_DESTROY_COPY_TEX 0x0034
+
+#define GX_LOAD_AURORA_INVALIDATE_TEX_ALL 0x0035
+
+
+/*
+ * Debug marker stuff
+ */
+
+/**
+ * Pushes a debug group to the backend graphics API. These may show in debugging tools such as RenderDoc.
+ * It is considered an error to have unpopped debug groups at the end of the frame. They will be automatically cleared.
+ */
+void GXPushDebugGroup(const char* label);
+
+/**
+ * Pop a debug group previously pushed via GXPushDebugGroup().
+ */
+void GXPopDebugGroup();
+
+/**
+ * Sends a debug marker to the backend graphics API. These may show in debugging tools such as RenderDoc.
+ */
+void GXInsertDebugMarker(const char* label);
+
+typedef enum _AuroraViewportPolicy {
+  AURORA_VIEWPORT_FIT = 0,     // Preserve logical aspect in the content framebuffer
+  AURORA_VIEWPORT_STRETCH = 1, // Match content framebuffer aspect to the native surface
+  AURORA_VIEWPORT_NATIVE = 2,  // Use active framebuffer pixels directly
+} AuroraViewportPolicy;
+
+/**
+ * Configures content framebuffer sizing and how GXSetViewport/GXSetScissor parameters are applied to rendering.
+ * When AURORA_VIEWPORT_NATIVE is used, GXSetTexCopySrc/GXSetTexCopyDst will use native framebuffer resolution.
+ */
+void AuroraSetViewportPolicy(AuroraViewportPolicy policy);
+
+/**
+ * Retrieves the current content framebuffer size.
+ */
+void AuroraGetRenderSize(u32* width, u32* height);
+
+/** Retrieves the current native presentation-surface size, ignoring the GX sizing policy. */
+void AuroraGetSurfaceSize(u32* width, u32* height);
+
+/**
+ * Sets the actual render viewport in native framebuffer coordinates.
+ * Overrides the automatically scaled values set by the logical GXSetViewport.
+ */
+void GXSetViewportRender(f32 left, f32 top, f32 wd, f32 ht, f32 nearz, f32 farz);
+
+/**
+ * Sets the actual render scissor in native framebuffer coordinates.
+ * Overrides the automatically scaled values set by the logical GXSetScissor.
+ */
+void GXSetScissorRender(u32 left, u32 top, u32 wd, u32 ht);
+
+/** Maps the logical GX viewport and scissor into a centered safe area, for fixed-aspect UI bridges. */
+void GXSetViewportScissorRenderSafeArea(f32 aspect);
+
+/** Restores the viewport and scissor from logical GX state after GXSetViewportScissorRenderSafeArea. */
+void GXRestoreViewportScissorRender(void);
+
+/** Sets the texture-copy source in active render-target coordinates, for bridges that already
+ *  resolved VI/window scaling. */
+void GXSetTexCopySrcRender(u16 left, u16 top, u16 wd, u16 ht);
+
+/**
+ * Create an offscreen framebuffer and switch rendering to it.
+ * All subsequent GX rendering will target this framebuffer until GXRestoreFrameBuffer() is called.
+ * Use GXCopyTex to resolve the offscreen content into a texture.
+ */
+void GXCreateFrameBuffer(u32 width, u32 height);
+
+/**
+ * Restore rendering to the main EFB framebuffer.
+ * Must be called after GXCreateFrameBuffer() to resume normal rendering.
+ */
+void GXRestoreFrameBuffer(void);
+
+void GXApplyBPReg(u8 reg, u32 value);
+
+#if __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXBump.h b/aurora-main/include/dolphin/gx/GXBump.h
new file mode 100644
index 0000000..aa99477
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXBump.h
@@ -0,0 +1,32 @@
+#ifndef DOLPHIN_GXBUMP_H
+#define DOLPHIN_GXBUMP_H
+
+#include <dolphin/gx/GXEnum.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void GXSetTevDirect(GXTevStageID tev_stage);
+void GXSetTevIndTile(GXTevStageID tevStage, GXIndTexStageID indStage, u16 tileSizeS, u16 tileSizeT, u16 tileSizeS_exp,
+                     u16 tileSizeT_exp, GXIndTexFormat fmt, GXIndTexMtxID matrixSel, GXIndTexBiasSel biasSel,
+                     GXIndTexAlphaSel alphaSel);
+void GXSetNumIndStages(u8 nIndStages);
+#ifdef TARGET_PC
+void GXSetIndTexMtx(GXIndTexMtxID mtx_sel, const void* offset, s8 scale_exp);
+#else
+void GXSetIndTexMtx(GXIndTexMtxID mtx_sel, f32 offset[2][3], s8 scale_exp);
+#endif
+void GXSetIndTexOrder(GXIndTexStageID ind_stage, GXTexCoordID tex_coord, GXTexMapID tex_map);
+void GXSetIndTexCoordScale(GXIndTexStageID indStage, GXIndTexScale scaleS, GXIndTexScale scaleT);
+void GXSetTevIndirect(GXTevStageID tev_stage, GXIndTexStageID ind_stage, GXIndTexFormat format,
+                      GXIndTexBiasSel bias_sel, GXIndTexMtxID matrix_sel, GXIndTexWrap wrap_s, GXIndTexWrap wrap_t,
+                      GXBool add_prev, GXBool ind_lod, GXIndTexAlphaSel alpha_sel);
+void GXSetTevIndWarp(GXTevStageID tev_stage, GXIndTexStageID ind_stage, GXBool signed_offsets, GXBool replace_mode,
+                     GXIndTexMtxID matrix_sel);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXCommandList.h b/aurora-main/include/dolphin/gx/GXCommandList.h
new file mode 100644
index 0000000..069a086
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXCommandList.h
@@ -0,0 +1,41 @@
+#ifndef DOLPHIN_GXCOMMANDLIST_H
+#define DOLPHIN_GXCOMMANDLIST_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define GX_NOP 0x00
+#define GX_DRAW_QUADS 0x80
+#define GX_DRAW_TRIANGLES 0x90
+#define GX_DRAW_TRIANGLE_STRIP 0x98
+#define GX_DRAW_TRIANGLE_FAN 0xA0
+#define GX_DRAW_LINES 0xA8
+#define GX_DRAW_LINE_STRIP 0xB0
+#define GX_DRAW_POINTS 0xB8
+
+#define GX_LOAD_BP_REG              0x61
+#define GX_LOAD_CP_REG              0x08
+#define GX_LOAD_XF_REG              0x10
+#define GX_LOAD_INDX_A              0x20
+#define GX_LOAD_INDX_B              0x28
+#define GX_LOAD_INDX_C              0x30
+#define GX_LOAD_INDX_D              0x38
+
+#define GX_CMD_CALL_DL              0x40
+#define GX_CMD_INVL_VC              0x48
+
+/**
+ * Custom Aurora commands that are followed by another 2-byte identifier.
+ * See GXAurora.h for further documentation on these.
+ */
+#define GX_LOAD_AURORA              0x50
+
+#define GX_OPCODE_MASK              0xF8
+#define GX_VAT_MASK                 0x07
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXCpu2Efb.h b/aurora-main/include/dolphin/gx/GXCpu2Efb.h
new file mode 100644
index 0000000..eefbcd8
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXCpu2Efb.h
@@ -0,0 +1,22 @@
+#ifndef _DOLPHIN_GX_GXCPU2EFB_H_
+#define _DOLPHIN_GX_GXCPU2EFB_H_
+
+#include "GXEnum.h"
+
+void GXPokeAlphaMode(GXCompare func, u8 threshold);
+void GXPokeAlphaRead(GXAlphaReadMode mode);
+void GXPokeAlphaUpdate(GXBool update_enable);
+void GXPokeBlendMode(GXBlendMode type, GXBlendFactor src_factor, GXBlendFactor dst_factor, GXLogicOp op);
+void GXPokeColorUpdate(GXBool update_enable);
+void GXPokeDstAlpha(GXBool enable, u8 alpha);
+void GXPokeDither(GXBool dither);
+void GXPokeZMode(GXBool compare_enable, GXCompare func, GXBool update_enable);
+void GXPeekARGB(u16 x, u16 y, u32* color);
+void GXPokeARGB(u16 x, u16 y, u32 color);
+void GXPeekZ(u16 x, u16 y, u32* z);
+void GXPokeZ(u16 x, u16 y, u32 z);
+u32 GXCompressZ16(u32 z24, GXZFmt16 zfmt);
+u32 GXDecompressZ16(u32 z16, GXZFmt16 zfmt);
+
+
+#endif // _DOLPHIN_GX_GXCPU2EFB_H_
diff --git a/aurora-main/include/dolphin/gx/GXCull.h b/aurora-main/include/dolphin/gx/GXCull.h
new file mode 100644
index 0000000..bf2d922
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXCull.h
@@ -0,0 +1,18 @@
+#ifndef DOLPHIN_GXCULL_H
+#define DOLPHIN_GXCULL_H
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void GXSetScissor(u32 left, u32 top, u32 wd, u32 ht);
+void GXSetCullMode(GXCullMode mode);
+void GXSetCoPlanar(GXBool enable);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXDispList.h b/aurora-main/include/dolphin/gx/GXDispList.h
new file mode 100644
index 0000000..41597c1
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXDispList.h
@@ -0,0 +1,25 @@
+#ifndef DOLPHIN_GXDISPLIST_H
+#define DOLPHIN_GXDISPLIST_H
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef AURORA
+#define GXCallDisplayListNative GXCallDisplayListLE
+#else
+#define GXCallDisplayListNative GXCallDisplayList
+#endif
+
+void GXBeginDisplayList(void* list, u32 size);
+u32 GXEndDisplayList(void);
+void GXCallDisplayListLE(const void* list, u32 nbytes);
+void GXCallDisplayList(const void* list, u32 nbytes);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXDraw.h b/aurora-main/include/dolphin/gx/GXDraw.h
new file mode 100644
index 0000000..3c02a08
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXDraw.h
@@ -0,0 +1,24 @@
+#ifndef DOLPHIN_GXDRAW_H
+#define DOLPHIN_GXDRAW_H
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void GXDrawCylinder(u8 numEdges);
+void GXDrawTorus(f32 rc, u8 numc, u8 numt);
+void GXDrawSphere(u8 numMajor, u8 numMinor);
+void GXDrawCube(void);
+void GXDrawDodeca(void);
+void GXDrawOctahedron(void);
+void GXDrawIcosahedron(void);
+void GXDrawSphere1(u8 depth);
+u32 GXGenNormalTable(u8 depth, f32* table);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXEnum.h b/aurora-main/include/dolphin/gx/GXEnum.h
new file mode 100644
index 0000000..d081f45
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXEnum.h
@@ -0,0 +1,915 @@
+#ifndef DOLPHIN_GXENUM_H
+#define DOLPHIN_GXENUM_H
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef TARGET_PC
+#include <stdbool.h>
+
+typedef bool GXBool;
+#else
+typedef u8 GXBool;
+#endif
+
+#define GX_FALSE ((GXBool)0)
+#define GX_TRUE ((GXBool)1)
+
+#define GX_ENABLE ((GXBool)1)
+#define GX_DISABLE ((GXBool)0)
+
+typedef enum {
+  GX_PERSPECTIVE,
+  GX_ORTHOGRAPHIC,
+} GXProjectionType;
+
+typedef enum {
+  GX_NEVER,
+  GX_LESS,
+  GX_EQUAL,
+  GX_LEQUAL,
+  GX_GREATER,
+  GX_NEQUAL,
+  GX_GEQUAL,
+  GX_ALWAYS,
+} GXCompare;
+
+typedef enum {
+  GX_AOP_AND,
+  GX_AOP_OR,
+  GX_AOP_XOR,
+  GX_AOP_XNOR,
+  GX_MAX_ALPHAOP,
+} GXAlphaOp;
+
+typedef enum {
+  GX_ZC_LINEAR,
+  GX_ZC_NEAR,
+  GX_ZC_MID,
+  GX_ZC_FAR,
+} GXZFmt16;
+
+typedef enum {
+  GX_GM_1_0,
+  GX_GM_1_7,
+  GX_GM_2_2,
+} GXGamma;
+
+typedef enum {
+  GX_PF_RGB8_Z24,
+  GX_PF_RGBA6_Z24,
+  GX_PF_RGB565_Z16,
+  GX_PF_Z24,
+  GX_PF_Y8,
+  GX_PF_U8,
+  GX_PF_V8,
+  GX_PF_YUV420,
+} GXPixelFmt;
+
+typedef enum {
+  GX_QUADS = 0x80,
+  GX_TRIANGLES = 0x90,
+  GX_TRIANGLESTRIP = 0x98,
+  GX_TRIANGLEFAN = 0xA0,
+  GX_LINES = 0xA8,
+  GX_LINESTRIP = 0xB0,
+  GX_POINTS = 0xB8,
+} GXPrimitive;
+
+typedef enum {
+  GX_VTXFMT0,
+  GX_VTXFMT1,
+  GX_VTXFMT2,
+  GX_VTXFMT3,
+  GX_VTXFMT4,
+  GX_VTXFMT5,
+  GX_VTXFMT6,
+  GX_VTXFMT7,
+  GX_MAX_VTXFMT,
+} GXVtxFmt;
+
+typedef enum {
+  GX_VA_PNMTXIDX,
+  GX_VA_TEX0MTXIDX,
+  GX_VA_TEX1MTXIDX,
+  GX_VA_TEX2MTXIDX,
+  GX_VA_TEX3MTXIDX,
+  GX_VA_TEX4MTXIDX,
+  GX_VA_TEX5MTXIDX,
+  GX_VA_TEX6MTXIDX,
+  GX_VA_TEX7MTXIDX,
+  GX_VA_POS,
+  GX_VA_NRM,
+  GX_VA_CLR0,
+  GX_VA_CLR1,
+  GX_VA_TEX0,
+  GX_VA_TEX1,
+  GX_VA_TEX2,
+  GX_VA_TEX3,
+  GX_VA_TEX4,
+  GX_VA_TEX5,
+  GX_VA_TEX6,
+  GX_VA_TEX7,
+  GX_POS_MTX_ARRAY,
+  GX_NRM_MTX_ARRAY,
+  GX_TEX_MTX_ARRAY,
+  GX_LIGHT_ARRAY,
+  GX_VA_NBT,
+  GX_VA_MAX_ATTR,
+  GX_VA_NULL = 0xFF,
+} GXAttr;
+
+typedef enum {
+  GX_NONE,
+  GX_DIRECT,
+  GX_INDEX8,
+  GX_INDEX16,
+} GXAttrType;
+
+#define _GX_TF_CTF 0x20
+#define _GX_TF_ZTF 0x10
+
+// Aurora-specific linear texture types
+#define _GX_TF_PC 0x40
+
+typedef enum {
+  GX_TF_I4 = 0x0,
+  GX_TF_I8 = 0x1,
+  GX_TF_IA4 = 0x2,
+  GX_TF_IA8 = 0x3,
+  GX_TF_RGB565 = 0x4,
+  GX_TF_RGB5A3 = 0x5,
+  GX_TF_RGBA8 = 0x6,
+  GX_TF_CMPR = 0xE,
+
+  GX_CTF_R4 = 0x0 | _GX_TF_CTF,
+  GX_CTF_RA4 = 0x2 | _GX_TF_CTF,
+  GX_CTF_RA8 = 0x3 | _GX_TF_CTF,
+  GX_CTF_YUVA8 = 0x6 | _GX_TF_CTF,
+  GX_CTF_A8 = 0x7 | _GX_TF_CTF,
+  GX_CTF_R8 = 0x8 | _GX_TF_CTF,
+  GX_CTF_G8 = 0x9 | _GX_TF_CTF,
+  GX_CTF_B8 = 0xA | _GX_TF_CTF,
+  GX_CTF_RG8 = 0xB | _GX_TF_CTF,
+  GX_CTF_GB8 = 0xC | _GX_TF_CTF,
+
+  GX_TF_Z8 = 0x1 | _GX_TF_ZTF,
+  GX_TF_Z16 = 0x3 | _GX_TF_ZTF,
+  GX_TF_Z24X8 = 0x6 | _GX_TF_ZTF,
+
+  GX_CTF_Z4 = 0x0 | _GX_TF_ZTF | _GX_TF_CTF,
+  GX_CTF_Z8M = 0x9 | _GX_TF_ZTF | _GX_TF_CTF,
+  GX_CTF_Z8L = 0xA | _GX_TF_ZTF | _GX_TF_CTF,
+  GX_CTF_Z16L = 0xC | _GX_TF_ZTF | _GX_TF_CTF,
+
+  GX_TF_A8 = GX_CTF_A8,
+
+#ifdef TARGET_PC
+  GX_TF_R8_PC = 0x1 | _GX_TF_PC,
+  GX_TF_RGBA8_PC = 0x6 | _GX_TF_PC,
+#endif
+} GXTexFmt;
+
+typedef enum {
+  GX_TF_C4 = 0x8,
+  GX_TF_C8 = 0x9,
+  GX_TF_C14X2 = 0xa,
+} GXCITexFmt;
+
+typedef enum {
+  GX_CLAMP,
+  GX_REPEAT,
+  GX_MIRROR,
+  GX_MAX_TEXWRAPMODE,
+} GXTexWrapMode;
+
+typedef enum {
+  GX_NEAR,
+  GX_LINEAR,
+  GX_NEAR_MIP_NEAR,
+  GX_LIN_MIP_NEAR,
+  GX_NEAR_MIP_LIN,
+  GX_LIN_MIP_LIN,
+} GXTexFilter;
+
+typedef enum {
+  GX_ANISO_1,
+  GX_ANISO_2,
+  GX_ANISO_4,
+  GX_MAX_ANISOTROPY,
+} GXAnisotropy;
+
+typedef enum {
+  GX_TEXMAP0,
+  GX_TEXMAP1,
+  GX_TEXMAP2,
+  GX_TEXMAP3,
+  GX_TEXMAP4,
+  GX_TEXMAP5,
+  GX_TEXMAP6,
+  GX_TEXMAP7,
+  GX_MAX_TEXMAP,
+  GX_TEXMAP_NULL = 0xFF,
+  GX_TEX_DISABLE = 0x100,
+} GXTexMapID;
+
+typedef enum {
+  GX_TEXCOORD0,
+  GX_TEXCOORD1,
+  GX_TEXCOORD2,
+  GX_TEXCOORD3,
+  GX_TEXCOORD4,
+  GX_TEXCOORD5,
+  GX_TEXCOORD6,
+  GX_TEXCOORD7,
+  GX_MAX_TEXCOORD,
+  GX_TEXCOORD_NULL = 0xFF,
+} GXTexCoordID;
+
+typedef enum {
+  GX_TEVSTAGE0,
+  GX_TEVSTAGE1,
+  GX_TEVSTAGE2,
+  GX_TEVSTAGE3,
+  GX_TEVSTAGE4,
+  GX_TEVSTAGE5,
+  GX_TEVSTAGE6,
+  GX_TEVSTAGE7,
+  GX_TEVSTAGE8,
+  GX_TEVSTAGE9,
+  GX_TEVSTAGE10,
+  GX_TEVSTAGE11,
+  GX_TEVSTAGE12,
+  GX_TEVSTAGE13,
+  GX_TEVSTAGE14,
+  GX_TEVSTAGE15,
+  GX_MAX_TEVSTAGE,
+} GXTevStageID;
+
+typedef enum {
+  GX_MODULATE,
+  GX_DECAL,
+  GX_BLEND,
+  GX_REPLACE,
+  GX_PASSCLR,
+} GXTevMode;
+
+typedef enum {
+  GX_MTX3x4,
+  GX_MTX2x4,
+} GXTexMtxType;
+
+typedef enum {
+  GX_TG_MTX3x4,
+  GX_TG_MTX2x4,
+  GX_TG_BUMP0,
+  GX_TG_BUMP1,
+  GX_TG_BUMP2,
+  GX_TG_BUMP3,
+  GX_TG_BUMP4,
+  GX_TG_BUMP5,
+  GX_TG_BUMP6,
+  GX_TG_BUMP7,
+  GX_TG_SRTG,
+} GXTexGenType;
+
+typedef enum {
+  GX_PNMTX0 = 0,
+  GX_PNMTX1 = 3,
+  GX_PNMTX2 = 6,
+  GX_PNMTX3 = 9,
+  GX_PNMTX4 = 12,
+  GX_PNMTX5 = 15,
+  GX_PNMTX6 = 18,
+  GX_PNMTX7 = 21,
+  GX_PNMTX8 = 24,
+  GX_PNMTX9 = 27,
+} GXPosNrmMtx;
+
+typedef enum {
+  GX_TEXMTX0 = 30,
+  GX_TEXMTX1 = 33,
+  GX_TEXMTX2 = 36,
+  GX_TEXMTX3 = 39,
+  GX_TEXMTX4 = 42,
+  GX_TEXMTX5 = 45,
+  GX_TEXMTX6 = 48,
+  GX_TEXMTX7 = 51,
+  GX_TEXMTX8 = 54,
+  GX_TEXMTX9 = 57,
+  GX_IDENTITY = 60,
+} GXTexMtx;
+
+typedef enum {
+  GX_COLOR0,
+  GX_COLOR1,
+  GX_ALPHA0,
+  GX_ALPHA1,
+  GX_COLOR0A0,
+  GX_COLOR1A1,
+  GX_COLOR_ZERO,
+  GX_ALPHA_BUMP,
+  GX_ALPHA_BUMPN,
+  GX_COLOR_NULL = 0xFF,
+} GXChannelID;
+
+typedef enum {
+  GX_TG_POS,
+  GX_TG_NRM,
+  GX_TG_BINRM,
+  GX_TG_TANGENT,
+  GX_TG_TEX0,
+  GX_TG_TEX1,
+  GX_TG_TEX2,
+  GX_TG_TEX3,
+  GX_TG_TEX4,
+  GX_TG_TEX5,
+  GX_TG_TEX6,
+  GX_TG_TEX7,
+  GX_TG_TEXCOORD0,
+  GX_TG_TEXCOORD1,
+  GX_TG_TEXCOORD2,
+  GX_TG_TEXCOORD3,
+  GX_TG_TEXCOORD4,
+  GX_TG_TEXCOORD5,
+  GX_TG_TEXCOORD6,
+  GX_TG_COLOR0,
+  GX_TG_COLOR1,
+  GX_MAX_TEXGENSRC,
+} GXTexGenSrc;
+
+typedef enum {
+  GX_BM_NONE,
+  GX_BM_BLEND,
+  GX_BM_LOGIC,
+  GX_BM_SUBTRACT,
+  GX_MAX_BLENDMODE,
+} GXBlendMode;
+
+typedef enum {
+  GX_BL_ZERO,
+  GX_BL_ONE,
+  GX_BL_SRCCLR,
+  GX_BL_INVSRCCLR,
+  GX_BL_SRCALPHA,
+  GX_BL_INVSRCALPHA,
+  GX_BL_DSTALPHA,
+  GX_BL_INVDSTALPHA,
+  GX_BL_DSTCLR = GX_BL_SRCCLR,
+  GX_BL_INVDSTCLR = GX_BL_INVSRCCLR,
+} GXBlendFactor;
+
+typedef enum {
+  GX_LO_CLEAR,
+  GX_LO_AND,
+  GX_LO_REVAND,
+  GX_LO_COPY,
+  GX_LO_INVAND,
+  GX_LO_NOOP,
+  GX_LO_XOR,
+  GX_LO_OR,
+  GX_LO_NOR,
+  GX_LO_EQUIV,
+  GX_LO_INV,
+  GX_LO_REVOR,
+  GX_LO_INVCOPY,
+  GX_LO_INVOR,
+  GX_LO_NAND,
+  GX_LO_SET,
+} GXLogicOp;
+
+typedef enum {
+  GX_POS_XY = 0,
+  GX_POS_XYZ = 1,
+  GX_NRM_XYZ = 0,
+  GX_NRM_NBT = 1,
+  GX_NRM_NBT3 = 2,
+  GX_CLR_RGB = 0,
+  GX_CLR_RGBA = 1,
+  GX_TEX_S = 0,
+  GX_TEX_ST = 1,
+} GXCompCnt;
+
+typedef enum {
+  GX_U8 = 0,
+  GX_S8 = 1,
+  GX_U16 = 2,
+  GX_S16 = 3,
+  GX_F32 = 4,
+  GX_RGB565 = 0,
+  GX_RGB8 = 1,
+  GX_RGBX8 = 2,
+  GX_RGBA4 = 3,
+  GX_RGBA6 = 4,
+  GX_RGBA8 = 5,
+} GXCompType;
+
+typedef enum {
+  GX_PTTEXMTX0 = 64,
+  GX_PTTEXMTX1 = 67,
+  GX_PTTEXMTX2 = 70,
+  GX_PTTEXMTX3 = 73,
+  GX_PTTEXMTX4 = 76,
+  GX_PTTEXMTX5 = 79,
+  GX_PTTEXMTX6 = 82,
+  GX_PTTEXMTX7 = 85,
+  GX_PTTEXMTX8 = 88,
+  GX_PTTEXMTX9 = 91,
+  GX_PTTEXMTX10 = 94,
+  GX_PTTEXMTX11 = 97,
+  GX_PTTEXMTX12 = 100,
+  GX_PTTEXMTX13 = 103,
+  GX_PTTEXMTX14 = 106,
+  GX_PTTEXMTX15 = 109,
+  GX_PTTEXMTX16 = 112,
+  GX_PTTEXMTX17 = 115,
+  GX_PTTEXMTX18 = 118,
+  GX_PTTEXMTX19 = 121,
+  GX_PTIDENTITY = 125,
+} GXPTTexMtx;
+
+typedef enum {
+  GX_TEVPREV,
+  GX_TEVREG0,
+  GX_TEVREG1,
+  GX_TEVREG2,
+  GX_MAX_TEVREG,
+} GXTevRegID;
+
+typedef enum {
+  GX_DF_NONE,
+  GX_DF_SIGN,
+  GX_DF_CLAMP,
+} GXDiffuseFn;
+
+typedef enum {
+  GX_SRC_REG,
+  GX_SRC_VTX,
+} GXColorSrc;
+
+typedef enum {
+  GX_AF_SPEC,
+  GX_AF_SPOT,
+  GX_AF_NONE,
+} GXAttnFn;
+
+typedef enum {
+  GX_LIGHT0 = 0x001,
+  GX_LIGHT1 = 0x002,
+  GX_LIGHT2 = 0x004,
+  GX_LIGHT3 = 0x008,
+  GX_LIGHT4 = 0x010,
+  GX_LIGHT5 = 0x020,
+  GX_LIGHT6 = 0x040,
+  GX_LIGHT7 = 0x080,
+  GX_MAX_LIGHT = 0x100,
+  GX_LIGHT_NULL = 0,
+} GXLightID;
+
+typedef enum {
+  GX_TO_ZERO,
+  GX_TO_SIXTEENTH,
+  GX_TO_EIGHTH,
+  GX_TO_FOURTH,
+  GX_TO_HALF,
+  GX_TO_ONE,
+  GX_MAX_TEXOFFSET,
+} GXTexOffset;
+
+typedef enum {
+  GX_SP_OFF,
+  GX_SP_FLAT,
+  GX_SP_COS,
+  GX_SP_COS2,
+  GX_SP_SHARP,
+  GX_SP_RING1,
+  GX_SP_RING2,
+} GXSpotFn;
+
+typedef enum {
+  GX_DA_OFF,
+  GX_DA_GENTLE,
+  GX_DA_MEDIUM,
+  GX_DA_STEEP,
+} GXDistAttnFn;
+
+typedef enum {
+  GX_CULL_NONE,
+  GX_CULL_FRONT,
+  GX_CULL_BACK,
+  GX_CULL_ALL
+
+} GXCullMode;
+
+typedef enum { GX_TEV_SWAP0 = 0, GX_TEV_SWAP1, GX_TEV_SWAP2, GX_TEV_SWAP3, GX_MAX_TEVSWAP } GXTevSwapSel;
+
+typedef enum { GX_CH_RED = 0, GX_CH_GREEN, GX_CH_BLUE, GX_CH_ALPHA } GXTevColorChan;
+
+typedef enum _GXFogType {
+  GX_FOG_NONE = 0,
+  GX_FOG_PERSP_LIN = 2,
+  GX_FOG_PERSP_EXP = 4,
+  GX_FOG_PERSP_EXP2 = 5,
+  GX_FOG_PERSP_REVEXP = 6,
+  GX_FOG_PERSP_REVEXP2 = 7,
+  GX_FOG_ORTHO_LIN = 10,
+  GX_FOG_ORTHO_EXP = 12,
+  GX_FOG_ORTHO_EXP2 = 13,
+  GX_FOG_ORTHO_REVEXP = 14,
+  GX_FOG_ORTHO_REVEXP2 = 15,
+  GX_FOG_LIN = GX_FOG_PERSP_LIN,
+  GX_FOG_EXP = GX_FOG_PERSP_EXP,
+  GX_FOG_EXP2 = GX_FOG_PERSP_EXP2,
+  GX_FOG_REVEXP = GX_FOG_PERSP_REVEXP,
+  GX_FOG_REVEXP2 = GX_FOG_PERSP_REVEXP2,
+} GXFogType;
+
+typedef enum {
+  GX_CC_CPREV,
+  GX_CC_APREV,
+  GX_CC_C0,
+  GX_CC_A0,
+  GX_CC_C1,
+  GX_CC_A1,
+  GX_CC_C2,
+  GX_CC_A2,
+  GX_CC_TEXC,
+  GX_CC_TEXA,
+  GX_CC_RASC,
+  GX_CC_RASA,
+  GX_CC_ONE,
+  GX_CC_HALF,
+  GX_CC_KONST,
+  GX_CC_ZERO
+} GXTevColorArg;
+
+typedef enum {
+  GX_CA_APREV,
+  GX_CA_A0,
+  GX_CA_A1,
+  GX_CA_A2,
+  GX_CA_TEXA,
+  GX_CA_RASA,
+  GX_CA_KONST,
+  GX_CA_ZERO
+} GXTevAlphaArg;
+
+typedef enum {
+  GX_TEV_ADD = 0,
+  GX_TEV_SUB = 1,
+  GX_TEV_COMP_R8_GT = 8,
+  GX_TEV_COMP_R8_EQ = 9,
+  GX_TEV_COMP_GR16_GT = 10,
+  GX_TEV_COMP_GR16_EQ = 11,
+  GX_TEV_COMP_BGR24_GT = 12,
+  GX_TEV_COMP_BGR24_EQ = 13,
+  GX_TEV_COMP_RGB8_GT = 14,
+  GX_TEV_COMP_RGB8_EQ = 15,
+  GX_TEV_COMP_A8_GT = GX_TEV_COMP_RGB8_GT,
+  GX_TEV_COMP_A8_EQ = GX_TEV_COMP_RGB8_EQ
+} GXTevOp;
+
+typedef enum { GX_TB_ZERO, GX_TB_ADDHALF, GX_TB_SUBHALF, GX_MAX_TEVBIAS } GXTevBias;
+
+typedef enum { GX_CS_SCALE_1, GX_CS_SCALE_2, GX_CS_SCALE_4, GX_CS_DIVIDE_2, GX_MAX_TEVSCALE } GXTevScale;
+
+typedef enum {
+  GX_TEV_KCSEL_8_8 = 0x00,
+  GX_TEV_KCSEL_7_8 = 0x01,
+  GX_TEV_KCSEL_6_8 = 0x02,
+  GX_TEV_KCSEL_5_8 = 0x03,
+  GX_TEV_KCSEL_4_8 = 0x04,
+  GX_TEV_KCSEL_3_8 = 0x05,
+  GX_TEV_KCSEL_2_8 = 0x06,
+  GX_TEV_KCSEL_1_8 = 0x07,
+  GX_TEV_KCSEL_1 = GX_TEV_KCSEL_8_8,
+  GX_TEV_KCSEL_3_4 = GX_TEV_KCSEL_6_8,
+  GX_TEV_KCSEL_1_2 = GX_TEV_KCSEL_4_8,
+  GX_TEV_KCSEL_1_4 = GX_TEV_KCSEL_2_8,
+  GX_TEV_KCSEL_K0 = 0x0C,
+  GX_TEV_KCSEL_K1 = 0x0D,
+  GX_TEV_KCSEL_K2 = 0x0E,
+  GX_TEV_KCSEL_K3 = 0x0F,
+  GX_TEV_KCSEL_K0_R = 0x10,
+  GX_TEV_KCSEL_K1_R = 0x11,
+  GX_TEV_KCSEL_K2_R = 0x12,
+  GX_TEV_KCSEL_K3_R = 0x13,
+  GX_TEV_KCSEL_K0_G = 0x14,
+  GX_TEV_KCSEL_K1_G = 0x15,
+  GX_TEV_KCSEL_K2_G = 0x16,
+  GX_TEV_KCSEL_K3_G = 0x17,
+  GX_TEV_KCSEL_K0_B = 0x18,
+  GX_TEV_KCSEL_K1_B = 0x19,
+  GX_TEV_KCSEL_K2_B = 0x1A,
+  GX_TEV_KCSEL_K3_B = 0x1B,
+  GX_TEV_KCSEL_K0_A = 0x1C,
+  GX_TEV_KCSEL_K1_A = 0x1D,
+  GX_TEV_KCSEL_K2_A = 0x1E,
+  GX_TEV_KCSEL_K3_A = 0x1F
+} GXTevKColorSel;
+
+typedef enum {
+  GX_TEV_KASEL_8_8 = 0x00,
+  GX_TEV_KASEL_7_8 = 0x01,
+  GX_TEV_KASEL_6_8 = 0x02,
+  GX_TEV_KASEL_5_8 = 0x03,
+  GX_TEV_KASEL_4_8 = 0x04,
+  GX_TEV_KASEL_3_8 = 0x05,
+  GX_TEV_KASEL_2_8 = 0x06,
+  GX_TEV_KASEL_1_8 = 0x07,
+  GX_TEV_KASEL_1 = GX_TEV_KASEL_8_8,
+  GX_TEV_KASEL_3_4 = GX_TEV_KASEL_6_8,
+  GX_TEV_KASEL_1_2 = GX_TEV_KASEL_4_8,
+  GX_TEV_KASEL_1_4 = GX_TEV_KASEL_2_8,
+  GX_TEV_KASEL_K0_R = 0x10,
+  GX_TEV_KASEL_K1_R = 0x11,
+  GX_TEV_KASEL_K2_R = 0x12,
+  GX_TEV_KASEL_K3_R = 0x13,
+  GX_TEV_KASEL_K0_G = 0x14,
+  GX_TEV_KASEL_K1_G = 0x15,
+  GX_TEV_KASEL_K2_G = 0x16,
+  GX_TEV_KASEL_K3_G = 0x17,
+  GX_TEV_KASEL_K0_B = 0x18,
+  GX_TEV_KASEL_K1_B = 0x19,
+  GX_TEV_KASEL_K2_B = 0x1A,
+  GX_TEV_KASEL_K3_B = 0x1B,
+  GX_TEV_KASEL_K0_A = 0x1C,
+  GX_TEV_KASEL_K1_A = 0x1D,
+  GX_TEV_KASEL_K2_A = 0x1E,
+  GX_TEV_KASEL_K3_A = 0x1F
+} GXTevKAlphaSel;
+
+typedef enum { GX_KCOLOR0 = 0, GX_KCOLOR1, GX_KCOLOR2, GX_KCOLOR3, GX_MAX_KCOLOR } GXTevKColorID;
+
+typedef enum {
+  GX_ZT_DISABLE,
+  GX_ZT_ADD,
+  GX_ZT_REPLACE,
+  GX_MAX_ZTEXOP,
+} GXZTexOp;
+
+typedef enum {
+  GX_ITF_8,
+  GX_ITF_5,
+  GX_ITF_4,
+  GX_ITF_3,
+  GX_MAX_ITFORMAT,
+} GXIndTexFormat;
+
+typedef enum {
+  GX_ITB_NONE,
+  GX_ITB_S,
+  GX_ITB_T,
+  GX_ITB_ST,
+  GX_ITB_U,
+  GX_ITB_SU,
+  GX_ITB_TU,
+  GX_ITB_STU,
+  GX_MAX_ITBIAS,
+} GXIndTexBiasSel;
+
+typedef enum {
+  GX_ITBA_OFF,
+  GX_ITBA_S,
+  GX_ITBA_T,
+  GX_ITBA_U,
+  GX_MAX_ITBALPHA,
+} GXIndTexAlphaSel;
+
+typedef enum {
+  GX_ITM_OFF,
+  GX_ITM_0,
+  GX_ITM_1,
+  GX_ITM_2,
+  GX_ITM_S0 = 5,
+  GX_ITM_S1,
+  GX_ITM_S2,
+  GX_ITM_T0 = 9,
+  GX_ITM_T1,
+  GX_ITM_T2,
+} GXIndTexMtxID;
+
+typedef enum {
+  GX_ITW_OFF,
+  GX_ITW_256,
+  GX_ITW_128,
+  GX_ITW_64,
+  GX_ITW_32,
+  GX_ITW_16,
+  GX_ITW_0,
+  GX_MAX_ITWRAP,
+} GXIndTexWrap;
+
+typedef enum {
+  GX_INDTEXSTAGE0,
+  GX_INDTEXSTAGE1,
+  GX_INDTEXSTAGE2,
+  GX_INDTEXSTAGE3,
+  GX_MAX_INDTEXSTAGE,
+} GXIndTexStageID;
+
+typedef enum {
+  GX_ITS_1,
+  GX_ITS_2,
+  GX_ITS_4,
+  GX_ITS_8,
+  GX_ITS_16,
+  GX_ITS_32,
+  GX_ITS_64,
+  GX_ITS_128,
+  GX_ITS_256,
+  GX_MAX_ITSCALE,
+} GXIndTexScale;
+
+typedef enum {
+  GX_PERF0_VERTICES,
+  GX_PERF0_CLIP_VTX,
+  GX_PERF0_CLIP_CLKS,
+  GX_PERF0_XF_WAIT_IN,
+  GX_PERF0_XF_WAIT_OUT,
+  GX_PERF0_XF_XFRM_CLKS,
+  GX_PERF0_XF_LIT_CLKS,
+  GX_PERF0_XF_BOT_CLKS,
+  GX_PERF0_XF_REGLD_CLKS,
+  GX_PERF0_XF_REGRD_CLKS,
+  GX_PERF0_CLIP_RATIO,
+
+  GX_PERF0_TRIANGLES,
+  GX_PERF0_TRIANGLES_CULLED,
+  GX_PERF0_TRIANGLES_PASSED,
+  GX_PERF0_TRIANGLES_SCISSORED,
+  GX_PERF0_TRIANGLES_0TEX,
+  GX_PERF0_TRIANGLES_1TEX,
+  GX_PERF0_TRIANGLES_2TEX,
+  GX_PERF0_TRIANGLES_3TEX,
+  GX_PERF0_TRIANGLES_4TEX,
+  GX_PERF0_TRIANGLES_5TEX,
+  GX_PERF0_TRIANGLES_6TEX,
+  GX_PERF0_TRIANGLES_7TEX,
+  GX_PERF0_TRIANGLES_8TEX,
+  GX_PERF0_TRIANGLES_0CLR,
+  GX_PERF0_TRIANGLES_1CLR,
+  GX_PERF0_TRIANGLES_2CLR,
+
+  GX_PERF0_QUAD_0CVG,
+  GX_PERF0_QUAD_NON0CVG,
+  GX_PERF0_QUAD_1CVG,
+  GX_PERF0_QUAD_2CVG,
+  GX_PERF0_QUAD_3CVG,
+  GX_PERF0_QUAD_4CVG,
+  GX_PERF0_AVG_QUAD_CNT,
+
+  GX_PERF0_CLOCKS,
+  GX_PERF0_NONE,
+} GXPerf0;
+
+typedef enum {
+  GX_PERF1_TEXELS,
+  GX_PERF1_TX_IDLE,
+  GX_PERF1_TX_REGS,
+  GX_PERF1_TX_MEMSTALL,
+  GX_PERF1_TC_CHECK1_2,
+  GX_PERF1_TC_CHECK3_4,
+  GX_PERF1_TC_CHECK5_6,
+  GX_PERF1_TC_CHECK7_8,
+  GX_PERF1_TC_MISS,
+
+  GX_PERF1_VC_ELEMQ_FULL,
+  GX_PERF1_VC_MISSQ_FULL,
+  GX_PERF1_VC_MEMREQ_FULL,
+  GX_PERF1_VC_STATUS7,
+  GX_PERF1_VC_MISSREP_FULL,
+  GX_PERF1_VC_STREAMBUF_LOW,
+  GX_PERF1_VC_ALL_STALLS,
+  GX_PERF1_VERTICES,
+
+  GX_PERF1_FIFO_REQ,
+  GX_PERF1_CALL_REQ,
+  GX_PERF1_VC_MISS_REQ,
+  GX_PERF1_CP_ALL_REQ,
+
+  GX_PERF1_CLOCKS,
+  GX_PERF1_NONE,
+} GXPerf1;
+
+typedef enum {
+  GX_VC_POS = 0,
+  GX_VC_NRM = 1,
+  GX_VC_CLR0 = 2,
+  GX_VC_CLR1 = 3,
+  GX_VC_TEX0 = 4,
+  GX_VC_TEX1 = 5,
+  GX_VC_TEX2 = 6,
+  GX_VC_TEX3 = 7,
+  GX_VC_TEX4 = 8,
+  GX_VC_TEX5 = 9,
+  GX_VC_TEX6 = 10,
+  GX_VC_TEX7 = 11,
+  GX_VC_ALL = 15,
+} GXVCachePerf;
+
+typedef enum {
+  GX_CLIP_ENABLE = 0,
+  GX_CLIP_DISABLE = 1,
+} GXClipMode;
+
+typedef enum {
+  GX_CLAMP_NONE = 0,
+  GX_CLAMP_TOP = 1,
+  GX_CLAMP_BOTTOM = 2,
+} GXFBClamp;
+
+typedef enum {
+  GX_TLUT0 = 0,
+  GX_TLUT1 = 1,
+  GX_TLUT2 = 2,
+  GX_TLUT3 = 3,
+  GX_TLUT4 = 4,
+  GX_TLUT5 = 5,
+  GX_TLUT6 = 6,
+  GX_TLUT7 = 7,
+  GX_TLUT8 = 8,
+  GX_TLUT9 = 9,
+  GX_TLUT10 = 10,
+  GX_TLUT11 = 11,
+  GX_TLUT12 = 12,
+  GX_TLUT13 = 13,
+  GX_TLUT14 = 14,
+  GX_TLUT15 = 15,
+  GX_BIGTLUT0 = 16,
+  GX_BIGTLUT1 = 17,
+  GX_BIGTLUT2 = 18,
+  GX_BIGTLUT3 = 19,
+} GXTlut;
+
+typedef enum {
+  GX_TL_IA8,
+  GX_TL_RGB565,
+  GX_TL_RGB5A3,
+  GX_MAX_TLUTFMT,
+} GXTlutFmt;
+
+typedef enum {
+  GX_TLUT_16 = 1,
+  GX_TLUT_32 = 2,
+  GX_TLUT_64 = 4,
+  GX_TLUT_128 = 8,
+  GX_TLUT_256 = 16,
+  GX_TLUT_512 = 32,
+  GX_TLUT_1K = 64,
+  GX_TLUT_2K = 128,
+  GX_TLUT_4K = 256,
+  GX_TLUT_8K = 512,
+  GX_TLUT_16K = 1024,
+} GXTlutSize;
+
+typedef enum {
+    GX_READ_00,
+    GX_READ_FF,
+    GX_READ_NONE,
+} GXAlphaReadMode;
+
+typedef enum {
+  GX_TEXCACHE_32K,
+  GX_TEXCACHE_128K,
+  GX_TEXCACHE_512K,
+  GX_TEXCACHE_NONE,
+} GXTexCacheSize;
+
+typedef enum {
+  GX_MT_XF_FLUSH = 1,
+  GX_MT_DL_SAVE_CONTEXT = 2,
+  GX_MT_NULL = 0,
+} GXMiscToken;
+
+typedef enum {
+  GX_CMD_LOAD_INDX_A = 0x20,
+  GX_CMD_LOAD_INDX_B = 0x28,
+  GX_CMD_LOAD_INDX_C = 0x30,
+  GX_CMD_LOAD_INDX_D = 0x38,
+
+  GX_CMD_LOAD_CP_REG = 0x08,
+  GX_CMD_LOAD_XF_REG = 0x10,
+  GX_CMD_LOAD_BP_REG = 0x61,
+} GXCommand;
+
+typedef enum {
+  GX_CP_REG_MTXIDXA = 0x30,      // Matrix index A
+  GX_CP_REG_MTXIDXB = 0x40,      // Matrix index B
+  GX_CP_REG_VCD_LO = 0x50,       // Vertex descriptor (lo)
+  GX_CP_REG_VCD_HI = 0x60,       // Vertex descriptor (hi)
+  GX_CP_REG_VAT_GRP0 = 0x70,     // Vertex attribute table (group 0)
+  GX_CP_REG_VAT_GRP1 = 0x80,     // Vertex attribute table (group 1)
+  GX_CP_REG_VAT_GRP2 = 0x90,     // Vertex attribute table (group 2)
+  GX_CP_REG_ARRAYBASE = 0xA0,    // Vertex array start/base
+  GX_CP_REG_ARRAYSTRIDE = 0xB0,  // Vertex array stride
+} GXCPRegs;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXExtra.h b/aurora-main/include/dolphin/gx/GXExtra.h
new file mode 100644
index 0000000..27713aa
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXExtra.h
@@ -0,0 +1,30 @@
+#ifndef DOLPHIN_GXEXTRA_H
+#define DOLPHIN_GXEXTRA_H
+// Extra types for PC
+#ifdef TARGET_PC
+#include <dolphin/gx/GXStruct.h>
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct {
+  float r;
+  float g;
+  float b;
+  float a;
+} GXColorF32;
+
+void GXDestroyTexObj(GXTexObj* obj);
+void GXDestroyTlutObj(GXTlutObj* obj);
+void GXDestroyCopyTex(void* dest);
+
+void GXColor4f32(float r, float g, float b, float a);
+
+#ifdef __cplusplus
+}
+#endif
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXFifo.h b/aurora-main/include/dolphin/gx/GXFifo.h
new file mode 100644
index 0000000..8edbf04
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXFifo.h
@@ -0,0 +1,37 @@
+#ifndef DOLPHIN_GXFIFO_H
+#define DOLPHIN_GXFIFO_H
+
+#include <dolphin/gx/GXEnum.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct {
+  u8 pad[128];
+} GXFifoObj;
+
+typedef struct OSThread OSThread;
+
+void GXInitFifoBase(GXFifoObj* fifo, void* base, u32 size);
+void GXInitFifoPtrs(GXFifoObj* fifo, void* readPtr, void* writePtr);
+void GXGetFifoPtrs(GXFifoObj* fifo, void** readPtr, void** writePtr);
+OSThread *GXSetCurrentGXThread(void);
+OSThread *GXGetCurrentGXThread(void);
+GXFifoObj* GXGetCPUFifo(void);
+GXFifoObj* GXGetGPFifo(void);
+void GXSetCPUFifo(GXFifoObj* fifo);
+void GXSetGPFifo(GXFifoObj* fifo);
+void GXSaveCPUFifo(GXFifoObj* fifo);
+void GXGetFifoStatus(GXFifoObj* fifo, GXBool* overhi, GXBool* underlow, u32* fifoCount, GXBool* cpu_write,
+                     GXBool* gp_read, GXBool* fifowrap);
+void GXGetGPStatus(GXBool* overhi, GXBool* underlow, GXBool* readIdle, GXBool* cmdIdle, GXBool* brkpt);
+void GXInitFifoLimits(GXFifoObj* fifo, u32 hiWaterMark, u32 loWaterMark);
+void* GXGetFifoBase(const GXFifoObj* fifo);
+u32 GXGetFifoSize(const GXFifoObj* fifo);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXFrameBuffer.h b/aurora-main/include/dolphin/gx/GXFrameBuffer.h
new file mode 100644
index 0000000..c289cd3
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXFrameBuffer.h
@@ -0,0 +1,60 @@
+#ifndef DOLPHIN_GXFRAMEBUFFER_H
+#define DOLPHIN_GXFRAMEBUFFER_H
+
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define GX_MAX_Z24 0x00FFFFFF
+
+extern GXRenderModeObj GXNtsc240Ds;
+extern GXRenderModeObj GXNtsc240DsAa;
+extern GXRenderModeObj GXNtsc240Int;
+extern GXRenderModeObj GXNtsc240IntAa;
+extern GXRenderModeObj GXNtsc480IntDf;
+extern GXRenderModeObj GXNtsc480Int;
+extern GXRenderModeObj GXNtsc480IntAa;
+extern GXRenderModeObj GXNtsc480Prog;
+extern GXRenderModeObj GXNtsc480ProgAa;
+extern GXRenderModeObj GXMpal240Ds;
+extern GXRenderModeObj GXMpal240DsAa;
+extern GXRenderModeObj GXMpal240Int;
+extern GXRenderModeObj GXMpal240IntAa;
+extern GXRenderModeObj GXMpal480IntDf;
+extern GXRenderModeObj GXMpal480Int;
+extern GXRenderModeObj GXMpal480IntAa;
+extern GXRenderModeObj GXPal264Ds;
+extern GXRenderModeObj GXPal264DsAa;
+extern GXRenderModeObj GXPal264Int;
+extern GXRenderModeObj GXPal264IntAa;
+extern GXRenderModeObj GXPal528IntDf;
+extern GXRenderModeObj GXPal528Int;
+extern GXRenderModeObj GXPal528IntAa;
+
+void GXSetCopyClear(GXColor clear_clr, u32 clear_z);
+void GXAdjustForOverscan(GXRenderModeObj* rmin, GXRenderModeObj* rmout, u16 hor, u16 ver);
+void GXCopyDisp(void* dest, GXBool clear);
+void GXSetDispCopyGamma(GXGamma gamma);
+void GXSetDispCopySrc(u16 left, u16 top, u16 wd, u16 ht);
+void GXSetDispCopyDst(u16 wd, u16 ht);
+void GXSetCopyClamp(GXFBClamp clamp);
+void GXSetDispCopyFrame2Field(u32 mode);
+u32 GXSetDispCopyYScale(f32 vscale);
+void GXSetCopyFilter(GXBool aa, u8 sample_pattern[12][2], GXBool vf, u8 vfilter[7]);
+void GXSetPixelFmt(GXPixelFmt pix_fmt, GXZFmt16 z_fmt);
+void GXSetTexCopySrc(u16 left, u16 top, u16 wd, u16 ht);
+void GXSetTexCopyDst(u16 wd, u16 ht, GXTexFmt fmt, GXBool mipmap);
+void GXCopyTex(void* dest, GXBool clear);
+void GXClearBoundingBox(void);
+void GXReadBoundingBox(u16* left, u16* right, u16* top, u16* bottom);
+u16 GXGetNumXfbLines(u16 efbHeight, f32 yScale);
+f32 GXGetYScaleFactor(u16 efbHeight, u16 xfbHeight);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXGeometry.h b/aurora-main/include/dolphin/gx/GXGeometry.h
new file mode 100644
index 0000000..a71eb74
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXGeometry.h
@@ -0,0 +1,43 @@
+#ifndef DOLPHIN_GXGEOMETRY_H
+#define DOLPHIN_GXGEOMETRY_H
+
+#include <dolphin/gx/GXEnum.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void GXSetVtxDesc(GXAttr attr, GXAttrType type);
+void GXSetSourceVtxDesc(GXAttr attr, GXAttrType type);
+void GXSetVtxDescv(GXVtxDescList* list);
+void GXClearVtxDesc(void);
+void GXSetVtxAttrFmtv(GXVtxFmt vtxfmt, const GXVtxAttrFmtList* list);
+void GXSetVtxAttrFmt(GXVtxFmt vtxfmt, GXAttr attr, GXCompCnt cnt, GXCompType type, u8 frac);
+void GXSetNumTexGens(u8 nTexGens);
+void GXBegin(GXPrimitive type, GXVtxFmt vtxfmt, u16 nverts);
+void GXSetTexCoordGen2(GXTexCoordID dst_coord, GXTexGenType func, GXTexGenSrc src_param, u32 mtx, GXBool normalize,
+                       u32 postmtx);
+void GXSetLineWidth(u8 width, GXTexOffset texOffsets);
+void GXSetPointSize(u8 pointSize, GXTexOffset texOffsets);
+void GXEnableTexOffsets(GXTexCoordID coord, GXBool line_enable, GXBool point_enable);
+#ifdef TARGET_PC
+void GXSetArray(GXAttr attr, const void* data, u32 size, u8 stride, bool le);
+static inline void GXSetArray(GXAttr attr, const void* data, u32 size, u8 stride) {
+  GXSetArray(attr, data, size, stride, false);
+}
+#define GXSETARRAY(attr, data, size, stride, le) GXSetArray((attr), (data), (size), (stride), (le))
+#else
+void GXSetArray(GXAttr attr, const void* data, u8 stride);
+#define GXSETARRAY(attr, data, size, stride, le) GXSetArray((attr), (data), (stride))
+#endif
+void GXInvalidateVtxCache(void);
+
+static inline void GXSetTexCoordGen(GXTexCoordID dst_coord, GXTexGenType func, GXTexGenSrc src_param, u32 mtx) {
+  GXSetTexCoordGen2(dst_coord, func, src_param, mtx, GX_FALSE, GX_PTIDENTITY);
+}
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXGet.h b/aurora-main/include/dolphin/gx/GXGet.h
new file mode 100644
index 0000000..a1b7e1c
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXGet.h
@@ -0,0 +1,40 @@
+#ifndef DOLPHIN_GXGET_H
+#define DOLPHIN_GXGET_H
+
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void GXGetVtxDesc(GXAttr attr, GXAttrType* type);
+void GXGetVtxDescv(GXVtxDescList* vcd);
+void GXGetVtxAttrFmtv(GXVtxFmt fmt, GXVtxAttrFmtList* vat);
+void GXGetLineWidth(u8* width, GXTexOffset* texOffsets);
+void GXGetPointSize(u8* pointSize, GXTexOffset* texOffsets);
+void GXGetCullMode(GXCullMode* mode);
+GXBool GXGetTexObjMipMap(GXTexObj* tex_obj);
+GXTexFmt GXGetTexObjFmt(GXTexObj* tex_obj);
+u16 GXGetTexObjHeight(GXTexObj* tex_obj);
+u16 GXGetTexObjWidth(GXTexObj* tex_obj);
+GXTexWrapMode GXGetTexObjWrapS(GXTexObj* tex_obj);
+GXTexWrapMode GXGetTexObjWrapT(GXTexObj* tex_obj);
+void* GXGetTexObjData(GXTexObj* tex_obj);
+void GXGetProjectionv(f32* p);
+void GXGetLightAttnA(GXLightObj* lt_obj, f32* a0, f32* a1, f32* a2);
+void GXGetLightAttnK(GXLightObj* lt_obj, f32* k0, f32* k1, f32* k2);
+void GXGetLightPos(GXLightObj* lt_obj, f32* x, f32* y, f32* z);
+void GXGetLightDir(GXLightObj* lt_obj, f32* nx, f32* ny, f32* nz);
+void GXGetLightColor(GXLightObj* lt_obj, GXColor* color);
+void GXGetVtxAttrFmt(GXVtxFmt idx, GXAttr attr, GXCompCnt* compCnt, GXCompType* compType, u8* shift);
+u32 GXGetTexObjTlut(const GXTexObj* tex_obj);
+
+void GXGetViewportv(f32* vp);
+void GXGetScissor(u32* left, u32* top, u32* wd, u32* ht);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXLighting.h b/aurora-main/include/dolphin/gx/GXLighting.h
new file mode 100644
index 0000000..2e7ff19
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXLighting.h
@@ -0,0 +1,32 @@
+#ifndef DOLPHIN_GXLIGHTING_H
+#define DOLPHIN_GXLIGHTING_H
+
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void GXSetNumChans(u8 nChans);
+void GXSetChanCtrl(GXChannelID chan, GXBool enable, GXColorSrc amb_src, GXColorSrc mat_src, u32 light_mask,
+                   GXDiffuseFn diff_fn, GXAttnFn attn_fn);
+void GXSetChanAmbColor(GXChannelID chan, GXColor amb_color);
+void GXSetChanMatColor(GXChannelID chan, GXColor mat_color);
+
+void GXInitLightSpot(GXLightObj* lt_obj, f32 cutoff, GXSpotFn spot_func);
+void GXInitLightDistAttn(GXLightObj* lt_obj, f32 ref_distance, f32 ref_brightness, GXDistAttnFn dist_func);
+void GXInitLightPos(GXLightObj* lt_obj, f32 x, f32 y, f32 z);
+void GXInitLightDir(GXLightObj* lt_obj, f32 nx, f32 ny, f32 nz);
+void GXInitSpecularDir(GXLightObj* lt_obj, f32 nx, f32 ny, f32 nz);
+void GXInitLightColor(GXLightObj* lt_obj, GXColor color);
+void GXInitLightAttn(GXLightObj* lt_obj, f32 a0, f32 a1, f32 a2, f32 k0, f32 k1, f32 k2);
+void GXInitLightAttnA(GXLightObj* lt_obj, f32 a0, f32 a1, f32 a2);
+void GXInitLightAttnK(GXLightObj* lt_obj, f32 k0, f32 k1, f32 k2);
+void GXLoadLightObjImm(GXLightObj* lt_obj, GXLightID light);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXManage.h b/aurora-main/include/dolphin/gx/GXManage.h
new file mode 100644
index 0000000..a4d7d72
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXManage.h
@@ -0,0 +1,28 @@
+#ifndef DOLPHIN_GXMANAGE_H
+#define DOLPHIN_GXMANAGE_H
+
+#include <dolphin/gx/GXFifo.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*GXDrawSyncCallback)(u16 token);
+typedef void (*GXDrawDoneCallback)(void);
+
+GXFifoObj* GXInit(void* base, u32 size);
+GXDrawSyncCallback GXSetDrawSyncCallback(GXDrawSyncCallback cb);
+GXDrawDoneCallback GXSetDrawDoneCallback(GXDrawDoneCallback cb);
+void GXDrawDone(void);
+void GXSetDrawDone(void);
+void GXFlush(void);
+void GXPixModeSync(void);
+void GXTexModeSync(void);
+void GXSetMisc(GXMiscToken token, u32 val);
+void GXAbortFrame(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXPerf.h b/aurora-main/include/dolphin/gx/GXPerf.h
new file mode 100644
index 0000000..7859e18
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXPerf.h
@@ -0,0 +1,16 @@
+#ifndef DOLPHIN_GXPERF_H
+#define DOLPHIN_GXPERF_H
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void GXReadXfRasMetric(u32* xf_wait_in, u32* xf_wait_out, u32* ras_busy, u32* clocks);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXPixel.h b/aurora-main/include/dolphin/gx/GXPixel.h
new file mode 100644
index 0000000..db6d9d0
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXPixel.h
@@ -0,0 +1,28 @@
+#ifndef DOLPHIN_GXPIXEL_H
+#define DOLPHIN_GXPIXEL_H
+
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void GXSetFog(GXFogType type, f32 startz, f32 endz, f32 nearz, f32 farz, GXColor color);
+void GXSetFogColor(GXColor color);
+void GXSetFogRangeAdj(GXBool enable, u16 center, GXFogAdjTable *table);
+void GXSetBlendMode(GXBlendMode type, GXBlendFactor src_factor, GXBlendFactor dst_factor, GXLogicOp op);
+void GXSetColorUpdate(GXBool update_enable);
+void GXSetAlphaUpdate(GXBool update_enable);
+void GXSetZMode(GXBool compare_enable, GXCompare func, GXBool update_enable);
+void GXSetZCompLoc(GXBool before_tex);
+void GXSetPixelFmt(GXPixelFmt pix_fmt, GXZFmt16 z_fmt);
+void GXSetDither(GXBool dither);
+void GXSetDstAlpha(GXBool enable, u8 alpha);
+void GXSetFieldMask(GXBool odd_mask, GXBool even_mask);
+void GXSetFieldMode(GXBool field_mode, GXBool half_aspect_ratio);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXStruct.h b/aurora-main/include/dolphin/gx/GXStruct.h
new file mode 100644
index 0000000..fc7b16a
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXStruct.h
@@ -0,0 +1,120 @@
+#ifndef DOLPHIN_GXSTRUCT_H
+#define DOLPHIN_GXSTRUCT_H
+
+#include <dolphin/types.h>
+#include <dolphin/gx/GXEnum.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define VI_TVMODE(format, interlace) (((format) << 2) + (interlace))
+
+#define VI_INTERLACE 0
+#define VI_NON_INTERLACE 1
+#define VI_PROGRESSIVE 2
+
+#define VI_NTSC 0
+#define VI_PAL 1
+#define VI_MPAL 2
+#define VI_DEBUG 3
+#define VI_DEBUG_PAL 4
+#define VI_EURGB60 5
+
+typedef enum {
+  VI_TVMODE_NTSC_INT = VI_TVMODE(VI_NTSC, VI_INTERLACE),
+  VI_TVMODE_NTSC_DS = VI_TVMODE(VI_NTSC, VI_NON_INTERLACE),
+  VI_TVMODE_NTSC_PROG = VI_TVMODE(VI_NTSC, VI_PROGRESSIVE),
+  VI_TVMODE_PAL_INT = VI_TVMODE(VI_PAL, VI_INTERLACE),
+  VI_TVMODE_PAL_DS = VI_TVMODE(VI_PAL, VI_NON_INTERLACE),
+  VI_TVMODE_EURGB60_INT = VI_TVMODE(VI_EURGB60, VI_INTERLACE),
+  VI_TVMODE_EURGB60_DS = VI_TVMODE(VI_EURGB60, VI_NON_INTERLACE),
+  VI_TVMODE_MPAL_INT = VI_TVMODE(VI_MPAL, VI_INTERLACE),
+  VI_TVMODE_MPAL_DS = VI_TVMODE(VI_MPAL, VI_NON_INTERLACE),
+  VI_TVMODE_DEBUG_INT = VI_TVMODE(VI_DEBUG, VI_INTERLACE),
+  VI_TVMODE_DEBUG_PAL_INT = VI_TVMODE(VI_DEBUG_PAL, VI_INTERLACE),
+  VI_TVMODE_DEBUG_PAL_DS = VI_TVMODE(VI_DEBUG_PAL, VI_NON_INTERLACE)
+} VITVMode;
+
+typedef enum { VI_XFBMODE_SF = 0, VI_XFBMODE_DF } VIXFBMode;
+
+typedef struct {
+  /*0x00*/ VITVMode viTVmode;
+  /*0x04*/ u16 fbWidth;
+  /*0x06*/ u16 efbHeight;
+  /*0x08*/ u16 xfbHeight;
+  /*0x0A*/ u16 viXOrigin;
+  /*0x0C*/ u16 viYOrigin;
+  /*0x0E*/ u16 viWidth;
+  /*0x10*/ u16 viHeight;
+  /*0x14*/ VIXFBMode xFBmode;
+  /*0x18*/ u8 field_rendering;
+  u8 aa;
+  u8 sample_pattern[12][2];
+  u8 vfilter[7];
+} GXRenderModeObj;
+
+typedef struct {
+  u8 r;
+  u8 g;
+  u8 b;
+  u8 a;
+} GXColor;
+
+typedef struct {
+#ifdef TARGET_PC
+  u32 dummy[24];
+#else
+  u32 dummy[8];
+#endif
+} GXTexObj;
+
+typedef struct {
+#ifdef TARGET_PC
+  u32 dummy[12];
+#else
+  u32 dummy[3];
+#endif
+} GXTlutObj;
+
+typedef struct {
+  u32 dummy[16];
+} GXLightObj;
+
+typedef struct {
+  GXAttr attr;
+  GXAttrType type;
+} GXVtxDescList;
+
+typedef struct {
+  GXAttr attr;
+  GXCompCnt cnt;
+  GXCompType type;
+  u8 frac;
+} GXVtxAttrFmtList;
+
+typedef struct {
+  s16 r;
+  s16 g;
+  s16 b;
+  s16 a;
+} GXColorS10;
+
+typedef struct _GXTexRegion {
+  u32 dummy[4];
+} GXTexRegion;
+
+typedef struct _GXTlutRegion {
+  u32 dummy[4];
+} GXTlutRegion;
+
+typedef struct _GXFogAdjTable
+{
+    u16 r[10];
+} GXFogAdjTable;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXTev.h b/aurora-main/include/dolphin/gx/GXTev.h
new file mode 100644
index 0000000..dccd4d5
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXTev.h
@@ -0,0 +1,35 @@
+#ifndef DOLPHIN_GXTEV_H
+#define DOLPHIN_GXTEV_H
+
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void GXSetTevOp(GXTevStageID id, GXTevMode mode);
+void GXSetTevColorIn(GXTevStageID stage, GXTevColorArg a, GXTevColorArg b, GXTevColorArg c, GXTevColorArg d);
+void GXSetTevAlphaIn(GXTevStageID stage, GXTevAlphaArg a, GXTevAlphaArg b, GXTevAlphaArg c, GXTevAlphaArg d);
+void GXSetTevColorOp(GXTevStageID stage, GXTevOp op, GXTevBias bias, GXTevScale scale, GXBool clamp,
+                     GXTevRegID out_reg);
+void GXSetTevAlphaOp(GXTevStageID stage, GXTevOp op, GXTevBias bias, GXTevScale scale, GXBool clamp,
+                     GXTevRegID out_reg);
+void GXSetTevColor(GXTevRegID id, GXColor color);
+void GXSetTevColorS10(GXTevRegID id, GXColorS10 color);
+void GXSetTevKColor(GXTevKColorID id, GXColor color);
+void GXSetTevKColorSel(GXTevStageID stage, GXTevKColorSel sel);
+void GXSetTevKAlphaSel(GXTevStageID stage, GXTevKAlphaSel sel);
+void GXSetTevSwapMode(GXTevStageID stage, GXTevSwapSel ras_sel, GXTevSwapSel tex_sel);
+void GXSetTevSwapModeTable(GXTevSwapSel table, GXTevColorChan red, GXTevColorChan green, GXTevColorChan blue,
+                           GXTevColorChan alpha);
+void GXSetAlphaCompare(GXCompare comp0, u8 ref0, GXAlphaOp op, GXCompare comp1, u8 ref1);
+void GXSetZTexture(GXZTexOp op, GXTexFmt fmt, u32 bias);
+void GXSetTevOrder(GXTevStageID stage, GXTexCoordID coord, GXTexMapID map, GXChannelID color);
+void GXSetNumTevStages(u8 nStages);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXTexture.h b/aurora-main/include/dolphin/gx/GXTexture.h
new file mode 100644
index 0000000..5e7afc8
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXTexture.h
@@ -0,0 +1,49 @@
+#ifndef DOLPHIN_GXTEXTURE_H
+#define DOLPHIN_GXTEXTURE_H
+
+#include <dolphin/gx/GXEnum.h>
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef GXTexRegion* (*GXTexRegionCallback)(const GXTexObj* obj, GXTexMapID id);
+
+void GXInitTexObj(GXTexObj* obj, const void* data, u16 width, u16 height, GXTexFmt format, GXTexWrapMode wrapS,
+                  GXTexWrapMode wrapT, GXBool mipmap);
+void GXInitTexObjCI(GXTexObj* obj, const void* data, u16 width, u16 height, GXCITexFmt format, GXTexWrapMode wrapS,
+                    GXTexWrapMode wrapT, GXBool mipmap, u32 tlut);
+void GXInitTexObjData(GXTexObj* obj, const void* data);
+void GXInitTexObjLOD(GXTexObj* obj, GXTexFilter min_filt, GXTexFilter mag_filt, f32 min_lod, f32 max_lod, f32 lod_bias,
+                     GXBool bias_clamp, GXBool do_edge_lod, GXAnisotropy max_aniso);
+void GXInitTexObjFilter(GXTexObj* obj, GXTexFilter min_filt, GXTexFilter mag_filt);
+void GXInitTexObjMaxLOD(GXTexObj* obj, f32 max_lod);
+void GXInitTexObjMinLOD(GXTexObj* obj, f32 min_lod);
+void GXInitTexObjLODBias(GXTexObj* obj, f32 lod_bias);
+void GXInitTexObjBiasClamp(GXTexObj* obj, GXBool bias_clamp);
+void GXInitTexObjEdgeLOD(GXTexObj* obj, GXBool do_edge_lod);
+void GXInitTexObjMaxAniso(GXTexObj* obj, GXAnisotropy max_aniso);
+void GXInitTexObjUserData(GXTexObj* obj, void* user_data);
+void* GXGetTexObjUserData(const GXTexObj* obj);
+void GXInitTexObjTlut(GXTexObj* obj_, u32 tlut);
+void GXLoadTexObj(GXTexObj* obj, GXTexMapID id);
+u32 GXGetTexBufferSize(u16 width, u16 height, u32 format, GXBool mipmap, u8 max_lod);
+void GXInvalidateTexAll();
+void GXInitTexObjWrapMode(GXTexObj* obj, GXTexWrapMode s, GXTexWrapMode t);
+void GXInitTlutObj(GXTlutObj* obj, const void* data, GXTlutFmt format, u16 entries);
+void GXInitTlutObjData(GXTlutObj* obj, const void* data);
+void GXLoadTlut(const GXTlutObj* obj, u32 idx);
+void GXSetTexCoordScaleManually(GXTexCoordID coord, GXBool enable, u16 ss, u16 ts);
+void GXSetTexCoordCylWrap(GXTexCoordID coord, GXBool s_enable, GXBool t_enable);
+void GXSetTexCoordBias(GXTexCoordID coord, GXBool s_enable, GXBool t_enable);
+void GXInitTexCacheRegion(GXTexRegion* region, GXBool is_32b_mipmap, u32 tmem_even, GXTexCacheSize size_even,
+                          u32 tmem_odd, GXTexCacheSize size_odd);
+GXTexRegionCallback GXSetTexRegionCallback(GXTexRegionCallback callback);
+void GXInvalidateTexRegion(const GXTexRegion* region);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXTransform.h b/aurora-main/include/dolphin/gx/GXTransform.h
new file mode 100644
index 0000000..d961e5a
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXTransform.h
@@ -0,0 +1,37 @@
+#ifndef DOLPHIN_GXTRANSFORM_H
+#define DOLPHIN_GXTRANSFORM_H
+
+#include <dolphin/gx/GXEnum.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define GX_PROJECTION_SZ 7
+
+void GXProject(f32 x, f32 y, f32 z, const f32 mtx[3][4], const f32* pm, const f32* vp, f32* sx, f32* sy, f32* sz);
+void GXSetProjectionv(const f32* ptr);
+
+#ifdef TARGET_PC
+void GXSetProjection(const void* mtx, GXProjectionType type);
+void GXLoadPosMtxImm(const void* mtx, u32 id);
+void GXLoadNrmMtxImm(const void* mtx, u32 id);
+void GXLoadTexMtxImm(const void* mtx, u32 id, GXTexMtxType type);
+#else
+void GXSetProjection(f32 mtx[4][4], GXProjectionType type);
+void GXLoadPosMtxImm(f32 mtx[3][4], u32 id);
+void GXLoadNrmMtxImm(f32 mtx[3][4], u32 id);
+void GXLoadTexMtxImm(f32 mtx[][4], u32 id, GXTexMtxType type);
+#endif
+void GXSetViewport(f32 left, f32 top, f32 wd, f32 ht, f32 nearz, f32 farz);
+void GXSetCurrentMtx(u32 id);
+void GXSetViewportJitter(f32 left, f32 top, f32 wd, f32 ht, f32 nearz, f32 farz, u32 field);
+void GXSetZScaleOffset(f32 scale, f32 offset);
+void GXSetScissorBoxOffset(s32 x_off, s32 y_off);
+void GXSetClipMode(GXClipMode mode);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/gx/GXVert.h b/aurora-main/include/dolphin/gx/GXVert.h
new file mode 100644
index 0000000..355231c
--- /dev/null
+++ b/aurora-main/include/dolphin/gx/GXVert.h
@@ -0,0 +1,150 @@
+#ifndef DOLPHIN_GXVERT_H
+#define DOLPHIN_GXVERT_H
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define GXFIFO_ADDR 0xCC008000
+
+typedef union {
+  u8 u8;
+  u16 u16;
+  u32 u32;
+  u64 u64;
+  s8 s8;
+  s16 s16;
+  s32 s32;
+  s64 s64;
+  f32 f32;
+  f64 f64;
+} PPCWGPipe;
+
+#ifdef __MWERKS__
+volatile PPCWGPipe GXWGFifo : GXFIFO_ADDR;
+#else
+#define GXWGFifo (*(volatile PPCWGPipe*)GXFIFO_ADDR)
+#endif
+
+#ifdef TARGET_PC
+
+void GXPosition3f32(f32 x, f32 y, f32 z);
+void GXPosition3u16(u16 x, u16 y, u16 z);
+void GXPosition3s16(s16 x, s16 y, s16 z);
+void GXPosition3u8(u8 x, u8 y, u8 z);
+void GXPosition3s8(s8 x, s8 y, s8 z);
+
+void GXPosition2f32(f32 x, f32 y);
+void GXPosition2u16(u16 x, u16 y);
+void GXPosition2s16(s16 x, s16 y);
+void GXPosition2u8(u8 x, u8 y);
+void GXPosition2s8(s8 x, s8 y);
+
+void GXPosition1x16(u16 index);
+void GXPosition1x8(u8 index);
+
+void GXNormal3f32(f32 x, f32 y, f32 z);
+void GXNormal3u16(u16 x, u16 y, u16 z);
+void GXNormal3s16(s16 x, s16 y, s16 z);
+void GXNormal3u8(u8 x, u8 y, u8 z);
+void GXNormal3s8(s8 x, s8 y, s8 z);
+
+void GXNormal1x16(u16 index);
+void GXNormal1x8(u8 index);
+
+void GXColor4u8(u8 r, u8 g, u8 b, u8 a);
+
+void GXColor3u8(u8 r, u8 g, u8 b);
+
+void GXColor1u32(u32 clr);
+void GXColor1u16(u16 clr);
+
+void GXColor1x16(u16 index);
+void GXColor1x8(u8 index);
+
+void GXTexCoord2f32(f32 s, f32 t);
+void GXTexCoord2u16(u16 s, u16 t);
+void GXTexCoord2s16(s16 s, s16 t);
+void GXTexCoord2u8(u8 s, u8 t);
+void GXTexCoord2s8(s8 s, s8 t);
+
+void GXTexCoord1f32(f32 s);
+void GXTexCoord1u16(u16 s);
+void GXTexCoord1s16(s16 s);
+void GXTexCoord1u8(u8 s);
+void GXTexCoord1s8(s8 s);
+
+void GXTexCoord1x16(u16 index);
+void GXTexCoord1x8(u8 index);
+
+extern void GXEnd(void);
+
+#else
+
+static inline void GXPosition2f32(const f32 x, const f32 y) {
+  GXWGFifo.f32 = x;
+  GXWGFifo.f32 = y;
+}
+
+static inline void GXPosition3s16(const s16 x, const s16 y, const s16 z) {
+  GXWGFifo.s16 = x;
+  GXWGFifo.s16 = y;
+  GXWGFifo.s16 = z;
+}
+
+static inline void GXPosition3f32(const f32 x, const f32 y, const f32 z) {
+  GXWGFifo.f32 = x;
+  GXWGFifo.f32 = y;
+  GXWGFifo.f32 = z;
+}
+
+static inline void GXNormal3f32(const f32 x, const f32 y, const f32 z) {
+  GXWGFifo.f32 = x;
+  GXWGFifo.f32 = y;
+  GXWGFifo.f32 = z;
+}
+
+static inline void GXColor4u8(const u8 r, const u8 g, const u8 b, const u8 a) {
+  GXWGFifo.u8 = r;
+  GXWGFifo.u8 = g;
+  GXWGFifo.u8 = b;
+  GXWGFifo.u8 = a;
+}
+
+static inline void GXTexCoord2s16(const s16 u, const s16 v) {
+  GXWGFifo.s16 = u;
+  GXWGFifo.s16 = v;
+}
+
+static inline void GXTexCoord2f32(const f32 u, const f32 v) {
+  GXWGFifo.f32 = u;
+  GXWGFifo.f32 = v;
+}
+
+static inline void GXEnd(void) {}
+
+#endif
+
+void GXCmd1u8(const u8 x);
+void GXCmd1u16(const u16 x);
+void GXCmd1u32(const u32 x);
+void GXCmd1u64(const u64 x);
+
+void GXParam1u8(const u8 x);
+void GXParam1u16(const u16 x);
+void GXParam1u32(const u32 x);
+void GXParam1s8(const s8 x);
+void GXParam1s16(const s16 x);
+void GXParam1s32(const s32 x);
+void GXParam1f32(const f32 x);
+void GXParam3f32(const f32 x, const f32 y, const f32 z);
+void GXParam4f32(const f32 x, const f32 y, const f32 z, const f32 w);
+void GXMatrixIndex1u8(GXAttr attr, u8 index);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/hio.h b/aurora-main/include/dolphin/hio.h
new file mode 100644
index 0000000..dc83ee1
--- /dev/null
+++ b/aurora-main/include/dolphin/hio.h
@@ -0,0 +1,28 @@
+#ifndef _DOLPHIN_HIO_H_
+#define _DOLPHIN_HIO_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*HIOCallback)(void);
+typedef BOOL (*HIOEnumCallback)(s32 chan);
+
+BOOL HIOEnumDevices(HIOEnumCallback callback);
+BOOL HIOInit(s32 chan, HIOCallback callback);
+BOOL HIOInitEx(s32 chan, u32 dev, HIOCallback callback);
+BOOL HIOReadMailbox(u32* word);
+BOOL HIOWriteMailbox(u32 word);
+BOOL HIORead(u32 addr, void* buffer, s32 size);
+BOOL HIOWrite(u32 addr, void* buffer, s32 size);
+BOOL HIOReadAsync(u32 addr, void* buffer, s32 size, HIOCallback callback);
+BOOL HIOWriteAsync(u32 addr, void* buffer, s32 size, HIOCallback callback);
+BOOL HIOReadStatus(u32* status);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/hio2.h b/aurora-main/include/dolphin/hio2.h
new file mode 100644
index 0000000..46b873c
--- /dev/null
+++ b/aurora-main/include/dolphin/hio2.h
@@ -0,0 +1,45 @@
+#ifndef _REVOLUTION_HIO2_H_
+#define _REVOLUTION_HIO2_H_
+
+// Actually from revolution but who cares?
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum {
+    HIO2_DEVICE_INVALID = -1,
+    HIO2_DEVICE_UNK_0 = 0,
+    HIO2_DEVICE_UNK_1 = 1,
+    HIO2_DEVICE_UNK_2 = 2,
+} HIO2DeviceType;
+
+typedef BOOL (*HIO2EnumCallback)(HIO2DeviceType);
+typedef void (*HIO2UnkCallback)(s32);
+typedef void (*HIO2DisconnectCallback)(s32);
+
+typedef struct HIO2Control {
+    /* 0x00 */ HIO2DeviceType type;
+    /* 0x04 */ s32 chan;
+    /* 0x08 */ u32 _0x8;
+    /* 0x0C */ HIO2UnkCallback exiCallback;
+    /* 0x10 */ HIO2UnkCallback _0x10;
+    /* 0x14 */ HIO2UnkCallback _0x14;
+    /* 0x18 */ HIO2DisconnectCallback disconnectCb;
+} HIO2Control; // size 0x1C
+
+
+BOOL HIO2Init(void);
+BOOL HIO2EnumDevices(HIO2EnumCallback callback);
+s32 HIO2Open(HIO2DeviceType type, HIO2UnkCallback exiCb, HIO2DisconnectCallback disconnectCb);
+BOOL HIO2Close(s32 handle);
+BOOL HIO2Read(s32 handle, u32 addr, void* buffer, s32 size);
+BOOL HIO2Write(s32 handle, u32 addr, void* buffer, s32 size);
+void HIO2Exit(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/hw_regs.h b/aurora-main/include/dolphin/hw_regs.h
new file mode 100644
index 0000000..1f5700a
--- /dev/null
+++ b/aurora-main/include/dolphin/hw_regs.h
@@ -0,0 +1,116 @@
+#ifndef _DOLPHIN_HW_REGS_H_
+#define _DOLPHIN_HW_REGS_H_
+
+#include <dolphin/types.h>
+
+#ifdef __MWERKS__
+volatile u16 __VIRegs[59]     AT_ADDRESS(0xCC002000);
+volatile u32 __PIRegs[12]     AT_ADDRESS(0xCC003000);
+volatile u16 __MEMRegs[64]    AT_ADDRESS(0xCC004000);
+volatile u16 __DSPRegs[]      AT_ADDRESS(0xCC005000);
+volatile u32 __DIRegs[]       AT_ADDRESS(0xCC006000);
+volatile u32 __SIRegs[0x100]  AT_ADDRESS(0xCC006400);
+volatile u32 __EXIRegs[0x40]  AT_ADDRESS(0xCC006800);
+volatile u32 __AIRegs[8]      AT_ADDRESS(0xCC006C00);
+#else
+#define __VIRegs         ((volatile u16 *)0xCC002000)
+#define __PIRegs         ((volatile u32 *)0xCC003000)
+#define __MEMRegs        ((volatile u16 *)0xCC004000)
+#define __DSPRegs        ((volatile u16 *)0xCC005000)
+#define __DIRegs         ((volatile u32 *)0xCC006000)
+#define __SIRegs         ((volatile u32 *)0xCC006400)
+#define __EXIRegs        ((volatile u32 *)0xCC006800)
+#define __AIRegs         ((volatile u32 *)0xCC006C00)
+#endif
+
+// Offsets for __VIRegs
+
+// offsets for __VIRegs[i]
+#define VI_VERT_TIMING        (0)
+#define VI_DISP_CONFIG        (1)
+#define VI_HORIZ_TIMING_0L    (2)
+#define VI_HORIZ_TIMING_0U    (3)
+#define VI_HORIZ_TIMING_1L    (4)
+#define VI_HORIZ_TIMING_1U    (5)
+#define VI_VERT_TIMING_ODD    (6)
+#define VI_VERT_TIMING_ODD_U  (7)
+#define VI_VERT_TIMING_EVEN   (8)
+#define VI_VERT_TIMING_EVEN_U (9)
+
+#define VI_BBI_ODD    (10) // burst blanking interval
+#define VI_BBI_ODD_U  (11) // burst blanking interval
+#define VI_BBI_EVEN   (12) // burst blanking interval
+#define VI_BBI_EVEN_U (13) // burst blanking interval
+
+#define VI_TOP_FIELD_BASE_LEFT   (14) // top in 2d, top of left pic in 3d
+#define VI_TOP_FIELD_BASE_LEFT_U (15) // top in 2d, top of left pic in 3d
+
+#define VI_TOP_FIELD_BASE_RIGHT   (16) // top of right pic in 3d
+#define VI_TOP_FIELD_BASE_RIGHT_U (17) // top of right pic in 3d
+
+#define VI_BTTM_FIELD_BASE_LEFT   (18) // bottom in 2d, bottom of left pic in 3d
+#define VI_BTTM_FIELD_BASE_LEFT_U (19) // bottom in 2d, bottom of left pic in 3d
+
+#define VI_BTTM_FIELD_BASE_RIGHT   (20) // bottom of right pic in 3d
+#define VI_BTTM_FIELD_BASE_RIGHT_U (21) // bottom of right pic in 3d
+
+#define VI_VERT_COUNT  (22) // vertical display position
+#define VI_HORIZ_COUNT (23) // horizontal display position
+
+#define VI_DISP_INT_0  (24) // display interrupt 0L
+#define VI_DISP_INT_0U (25) // display interrupt 0U
+#define VI_DISP_INT_1  (26) // display interrupt 1L
+#define VI_DISP_INT_1U (27) // display interrupt 1U
+#define VI_DISP_INT_2  (28) // display interrupt 2L
+#define VI_DISP_INT_2U (29) // display interrupt 2U
+#define VI_DISP_INT_3  (30) // display interrupt 3L
+#define VI_DISP_INT_3U (31) // display interrupt 3U
+
+#define VI_HSW (36) // horizontal scaling width
+#define VI_HSR (37) // horizontal scaling register
+
+#define VI_FCT_0  (38) // filter coefficient table 0L
+#define VI_FCT_0U (39) // filter coefficient table 0U
+#define VI_FCT_1  (40) // filter coefficient table 1L
+#define VI_FCT_1U (41) // filter coefficient table 1U
+#define VI_FCT_2  (42) // filter coefficient table 2L
+#define VI_FCT_2U (43) // filter coefficient table 2U
+#define VI_FCT_3  (44) // filter coefficient table 3L
+#define VI_FCT_3U (45) // filter coefficient table 3U
+#define VI_FCT_4  (46) // filter coefficient table 4L
+#define VI_FCT_4U (47) // filter coefficient table 4U
+#define VI_FCT_5  (48) // filter coefficient table 5L
+#define VI_FCT_5U (49) // filter coefficient table 5U
+#define VI_FCT_6  (50) // filter coefficient table 6L
+#define VI_FCT_6U (51) // filter coefficient table 6U
+
+#define VI_CLOCK_SEL (54) // clock select
+#define VI_DTV_STAT  (55) // DTV status
+
+#define VI_WIDTH (56)
+
+// offsets for __DSPRegs[i]
+#define DSP_MAILBOX_IN_HI  (0)
+#define DSP_MAILBOX_IN_LO  (1)
+#define DSP_MAILBOX_OUT_HI (2)
+#define DSP_MAILBOX_OUT_LO (3)
+#define DSP_CONTROL_STATUS (5)
+
+#define DSP_ARAM_SIZE        (9)
+#define DSP_ARAM_MODE        (11)
+#define DSP_ARAM_REFRESH     (13)
+#define DSP_ARAM_DMA_MM_HI   (16) // Main mem address
+#define DSP_ARAM_DMA_MM_LO   (17)
+#define DSP_ARAM_DMA_ARAM_HI (18) // ARAM address
+#define DSP_ARAM_DMA_ARAM_LO (19)
+#define DSP_ARAM_DMA_SIZE_HI (20) // DMA buffer size
+#define DSP_ARAM_DMA_SIZE_LO (21)
+
+#define DSP_DMA_START_HI    (24) // DMA start address
+#define DSP_DMA_START_LO    (25)
+#define DSP_DMA_CONTROL_LEN (27)
+#define DSP_DMA_BYTES_LEFT  (29)
+
+#define DSP_DMA_START_FLAG (0x8000) // set to start DSP
+
+#endif
diff --git a/aurora-main/include/dolphin/ms.h b/aurora-main/include/dolphin/ms.h
new file mode 100644
index 0000000..0cd4c55
--- /dev/null
+++ b/aurora-main/include/dolphin/ms.h
@@ -0,0 +1,35 @@
+// Aurora exclusive API extension
+// While the GC and Wii could both technically support mice, they never received official libraries
+// This library is a theoretical implementation based loosely on PAD
+#ifndef DOLPHIN_MS_H
+#define DOLPHIN_MS_H
+#include "types.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct MSStatus {
+  f32 x;
+  f32 y;
+  f32 xrel;
+  f32 yrel;
+  u32 buttons;
+  f32 scrollX;
+  f32 scrollY;
+} MSStatus;
+
+#define MS_BUTTON_LEFT (1 << 0)
+#define MS_BUTTON_MIDDLE (1 << 1)
+#define MS_BUTTON_RIGHT (1 << 2)
+#define MS_BUTTON_X1 (1 << 3)
+#define MS_BUTTON_X2 (1 << 4)
+
+void MSPoll();
+void MSRead(MSStatus* status);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // DUSK_MS_H
diff --git a/aurora-main/include/dolphin/mtx.h b/aurora-main/include/dolphin/mtx.h
new file mode 100644
index 0000000..7172615
--- /dev/null
+++ b/aurora-main/include/dolphin/mtx.h
@@ -0,0 +1,385 @@
+#ifndef _DOLPHIN_MTX
+#define _DOLPHIN_MTX
+
+#include <dolphin/mtx/GeoTypes.h>
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if !defined(MTX_USE_PS) && !defined(MTX_USE_C) && !defined(GEKKO)
+#define MTX_USE_C
+#endif
+
+#if !defined(MTX_USE_PS) && !defined(MTX_USE_C) && defined(GEKKO)
+#ifndef _DEBUG
+#define MTX_USE_PS
+#endif
+#endif
+
+#define MTX_PTR_OFFSET 3
+
+#define MTX44_PTR_OFFSET 4
+
+typedef struct {
+  u32 numMtx;
+  MtxPtr stackBase;
+  MtxPtr stackPtr;
+} MTXStack, MtxStack, *MtxStackPtr;
+
+#define MTXDegToRad(a) ((a)*0.01745329252f)
+#define MTXRadToDeg(a) ((a)*57.29577951f)
+#define MTXRowCol(m, r, c) ((m)[(r)][(c)])
+
+void C_MTXIdentity(Mtx m);
+void C_MTXCopy(const Mtx src, Mtx dst);
+void C_MTXConcat(const Mtx a, const Mtx b, Mtx ab);
+void C_MTXConcatArray(const Mtx a, const Mtx* srcBase, Mtx* dstBase, u32 count);
+void C_MTXTranspose(const Mtx src, Mtx xPose);
+u32 C_MTXInverse(const Mtx src, Mtx inv);
+u32 C_MTXInvXpose(const Mtx src, Mtx invX);
+
+#ifdef GEKKO
+void PSMTXIdentity(Mtx m);
+void PSMTXCopy(const Mtx src, Mtx dst);
+void PSMTXConcat(const Mtx a, const Mtx b, Mtx ab);
+void PSMTXConcatArray(const Mtx a, const Mtx* srcBase, Mtx* dstBase, u32 count);
+void PSMTXTranspose(const Mtx src, Mtx xPose);
+u32 PSMTXInverse(const Mtx src, Mtx inv);
+u32 PSMTXInvXpose(const Mtx src, Mtx invX);
+#else
+#define PSMTXIdentity MTXIdentity
+#define PSMTXCopy MTXCopy
+#define PSMTXConcat MTXConcat
+#define PSMTXConcatArray MTXConcatArray
+#define PSMTXTranspose MTXTranspose
+#define PSMTXInverse MTXInverse
+#define PSMTXInvXpose MTXInvXpose
+#endif
+
+#ifdef MTX_USE_PS
+#define MTXIdentity C_MTXIdentity
+#define MTXCopy C_MTXCopy
+#define MTXConcat C_MTXConcat
+#define MTXConcatArray C_MTXConcatArray
+#define MTXTranspose C_MTXTranspose
+#define MTXInverse C_MTXInverse
+#define MTXInvXpose C_MTXInvXpose
+#else
+#define MTXIdentity C_MTXIdentity
+#define MTXCopy C_MTXCopy
+#define MTXConcat C_MTXConcat
+#define MTXConcatArray C_MTXConcatArray
+#define MTXTranspose C_MTXTranspose
+#define MTXInverse C_MTXInverse
+#define MTXInvXpose C_MTXInvXpose
+#endif
+
+void C_MTXMultVec(const Mtx m, const Vec* src, Vec* dst);
+void C_MTXMultVecArray(const Mtx m, const Vec* srcBase, Vec* dstBase, u32 count);
+void C_MTXMultVecSR(const Mtx m, const Vec* src, Vec* dst);
+void C_MTXMultVecArraySR(const Mtx m, const Vec* srcBase, Vec* dstBase, u32 count);
+void C_MTXROMultVecArray(const ROMtx m, const Vec *srcBase, Vec *dstBase, u32 count);
+
+#ifdef GEKKO
+void PSMTXMultVec(const Mtx m, const Vec* src, Vec* dst);
+void PSMTXMultVecArray(const Mtx m, const Vec* srcBase, Vec* dstBase, u32 count);
+void PSMTXMultVecSR(const Mtx m, const Vec* src, Vec* dst);
+void PSMTXMultVecArraySR(const Mtx m, const Vec* srcBase, Vec* dstBase, u32 count);
+void PSMTXMultS16VecArray(const Mtx m, const S16Vec* srcBase, Vec* dstBase, u32 count);
+
+void PSMTXROMultVecArray(const ROMtx m, const Vec *srcBase, Vec *dstBase, u32 count);
+void PSMTXROSkin2VecArray(const ROMtx m0, const ROMtx m1, const f32* wtBase, const Vec* srcBase,
+                          Vec* dstBase, u32 count);
+void PSMTXROMultS16VecArray(const ROMtx m, const S16Vec* srcBase, Vec* dstBase, u32 count);
+#else
+#define PSMTXMultVec MTXMultVec
+#define PSMTXMultVecArray MTXMultVecArray
+#define PSMTXMultVecSR MTXMultVecSR
+#define PSMTXMultVecArraySR MTXMultVecArraySR
+#define PSMTXMultS16VecArray MTXMultS16VecArray
+
+#define PSMTXROMultVecArray MTXROMultVecArray
+#define PSMTXROSkin2VecArray MTXROSkin2VecArray
+#define PSMTXROMultS16VecArray MTXROMultS16VecArray
+#endif
+
+#ifdef MTX_USE_PS
+#define MTXMultVec C_MTXMultVec
+#define MTXMultVecArray C_MTXMultVecArray
+#define MTXMultVecSR C_MTXMultVecSR
+#define MTXMultVecArraySR C_MTXMultVecArraySR
+#define MTXMultS16VecArray PSMTXMultS16VecArray
+
+#define MTXROMultVecArray C_MTXROMultVecArray
+#define MTXROSkin2VecArray PSMTXROSkin2VecArray
+#define MTXROMultS16VecArray PSMTXROMultS16VecArray
+#else // MTX_USE_C
+#define MTXMultVec C_MTXMultVec
+#define MTXMultVecArray C_MTXMultVecArray
+#define MTXMultVecSR C_MTXMultVecSR
+#define MTXMultVecArraySR C_MTXMultVecArraySR
+
+#define MTXROMultVecArray C_MTXROMultVecArray
+#endif
+
+void C_MTXQuat(Mtx m, const Quaternion* q);
+void C_MTXReflect(Mtx m, const Vec* p, const Vec* n);
+
+void C_MTXTrans(Mtx m, f32 xT, f32 yT, f32 zT);
+void C_MTXTransApply(const Mtx src, Mtx dst, f32 xT, f32 yT, f32 zT);
+void C_MTXScale(Mtx m, f32 xS, f32 yS, f32 zS);
+void C_MTXScaleApply(const Mtx src, Mtx dst, f32 xS, f32 yS, f32 zS);
+
+void C_MTXRotRad(Mtx m, char axis, f32 rad);
+void C_MTXRotTrig(Mtx m, char axis, f32 sinA, f32 cosA);
+void C_MTXRotAxisRad(Mtx m, const Vec* axis, f32 rad);
+
+void C_MTXReorder(const Mtx src, ROMtx dst);
+
+#ifdef GEKKO
+void PSMTXQuat(Mtx m, const Quaternion* q);
+void PSMTXReflect(Mtx m, const Vec* p, const Vec* n);
+
+void PSMTXTrans(Mtx m, f32 xT, f32 yT, f32 zT);
+void PSMTXTransApply(const Mtx src, Mtx dst, f32 xT, f32 yT, f32 zT);
+void PSMTXScale(Mtx m, f32 xS, f32 yS, f32 zS);
+void PSMTXScaleApply(const Mtx src, Mtx dst, f32 xS, f32 yS, f32 zS);
+
+void PSMTXRotRad(Mtx m, char axis, f32 rad);
+void PSMTXRotTrig(Mtx m, char axis, f32 sinA, f32 cosA);
+void PSMTXRotAxisRad(Mtx m, const Vec* axis, f32 rad);
+
+void PSMTXReorder(const Mtx src, ROMtx dest);
+#else
+#define PSMTXQuat MTXQuat
+#define PSMTXReflect MTXReflect
+#define PSMTXTrans MTXTrans
+#define PSMTXTransApply MTXTransApply
+#define PSMTXScale MTXScale
+#define PSMTXScaleApply MTXScaleApply
+#define PSMTXRotRad MTXRotRad
+#define PSMTXRotTrig MTXRotTrig
+#define PSMTXRotAxisRad MTXRotAxisRad
+
+#define PSMTXRotRad MTXRotRad
+#define PSMTXRotAxisRad MTXRotAxisRad
+
+#define PSMTXReorder MTXReorder
+#endif
+
+#ifdef MTX_USE_PS
+#define MTXQuat C_MTXQuat
+#define MTXReflect C_MTXReflect
+#define MTXTrans C_MTXTrans
+#define MTXTransApply C_MTXTransApply
+#define MTXScale C_MTXScale
+#define MTXScaleApply C_MTXScaleApply
+#define MTXRotRad C_MTXRotRad
+#define MTXRotTrig C_MTXRotTrig
+#define MTXRotAxisRad C_MTXRotAxisRad
+
+#define MTXRotDeg(m, axis, deg) C_MTXRotRad(m, axis, MTXDegToRad(deg))
+#define MTXRotAxisDeg(m, axis, deg) C_MTXRotAxisRad(m, axis, MTXDegToRad(deg))
+
+#define MTXReorder C_MTXReorder
+
+#else // MTX_USE_C
+#define MTXQuat C_MTXQuat
+#define MTXReflect C_MTXReflect
+#define MTXTrans C_MTXTrans
+#define MTXTransApply C_MTXTransApply
+#define MTXScale C_MTXScale
+#define MTXScaleApply C_MTXScaleApply
+#define MTXRotRad C_MTXRotRad
+#define MTXRotTrig C_MTXRotTrig
+#define MTXRotAxisRad C_MTXRotAxisRad
+
+#define MTXRotDeg(m, axis, deg) C_MTXRotRad(m, axis, MTXDegToRad(deg))
+#define MTXRotAxisDeg(m, axis, deg) C_MTXRotAxisRad(m, axis, MTXDegToRad(deg))
+
+#define MTXReorder C_MTXReorder
+
+#endif
+
+void C_MTXLookAt(Mtx m, const Point3d* camPos, const Vec* camUp, const Point3d* target);
+
+#define MTXLookAt C_MTXLookAt
+
+void C_MTXFrustum(Mtx44 m, f32 t, f32 b, f32 l, f32 r, f32 n, f32 f);
+void C_MTXPerspective(Mtx44 m, f32 fovY, f32 aspect, f32 n, f32 f);
+void C_MTXOrtho(Mtx44 m, f32 t, f32 b, f32 l, f32 r, f32 n, f32 f);
+
+#define MTXFrustum C_MTXFrustum
+#define MTXPerspective C_MTXPerspective
+#define MTXOrtho C_MTXOrtho
+
+void C_MTXLightFrustum(Mtx m, f32 t, f32 b, f32 l, f32 r, f32 n, f32 scaleS, f32 scaleT, f32 transS,
+                       f32 transT);
+
+void C_MTXLightPerspective(Mtx m, f32 fovY, f32 aspect, f32 scaleS, f32 scaleT, f32 transS,
+                           f32 transT);
+
+void C_MTXLightOrtho(Mtx m, f32 t, f32 b, f32 l, f32 r, f32 scaleS, f32 scaleT, f32 transS,
+                     f32 transT);
+
+#define MTXLightFrustum C_MTXLightFrustum
+#define MTXLightPerspective C_MTXLightPerspective
+#define MTXLightOrtho C_MTXLightOrtho
+
+void C_VECAdd(const Vec* a, const Vec* b, Vec* ab);
+void C_VECSubtract(const Vec* a, const Vec* b, Vec* a_b);
+void C_VECScale(const Vec* src, Vec* dst, f32 scale);
+void C_VECNormalize(const Vec* src, Vec* unit);
+f32 C_VECSquareMag(const Vec* v);
+f32 C_VECMag(const Vec* v);
+f32 C_VECDotProduct(const Vec* a, const Vec* b);
+void C_VECCrossProduct(const Vec* a, const Vec* b, Vec* axb);
+f32 C_VECSquareDistance(const Vec* a, const Vec* b);
+f32 C_VECDistance(const Vec* a, const Vec* b);
+void C_VECReflect(const Vec* src, const Vec* normal, Vec* dst);
+void C_VECHalfAngle(const Vec* a, const Vec* b, Vec* half);
+
+void PSVECNormalize(const Vec* src, Vec* unit);
+f32 PSVECSquareMag(const Vec* v);
+f32 PSVECMag(const Vec* v);
+f32 PSVECSquareDistance(const Vec* a, const Vec* b);
+f32 PSVECDistance(const Vec* a, const Vec* b);
+
+#ifdef GEKKO
+void PSVECAdd(const Vec* a, const Vec* b, Vec* ab);
+void PSVECSubtract(const Vec* a, const Vec* b, Vec* a_b);
+void PSVECScale(const Vec* src, Vec* dst, f32 scale);
+void PSVECNormalize(const Vec* src, Vec* unit);
+f32 PSVECSquareMag(const Vec* v);
+f32 PSVECMag(const Vec* v);
+f32 PSVECDotProduct(const Vec* a, const Vec* b);
+void PSVECCrossProduct(const Vec* a, const Vec* b, Vec* axb);
+f32 PSVECSquareDistance(const Vec* a, const Vec* b);
+f32 PSVECDistance(const Vec* a, const Vec* b);
+#else
+#define PSVECAdd VECAdd
+#define PSVECSubtract VECSubtract
+#define PSVECScale VECScale
+#define PSVECDotProduct VECDotProduct
+#define PSVECCrossProduct VECCrossProduct
+#endif
+
+#if defined(MTX_USE_PS)
+#define VECAdd C_VECAdd
+#define VECSubtract C_VECSubtract
+#define VECScale C_VECScale
+#define VECNormalize PSVECNormalize
+#define VECSquareMag PSVECSquareMag
+#define VECMag PSVECMag
+#define VECDotProduct C_VECDotProduct
+#define VECCrossProduct C_VECCrossProduct
+#define VECSquareDistance PSVECSquareDistance
+#define VECDistance PSVECDistance
+#else // MTX_USE_C
+#define VECAdd C_VECAdd
+#define VECSubtract C_VECSubtract
+#define VECScale C_VECScale
+#define VECNormalize C_VECNormalize
+#define VECSquareMag C_VECSquareMag
+#define VECMag C_VECMag
+#define VECDotProduct C_VECDotProduct
+#define VECCrossProduct C_VECCrossProduct
+#define VECSquareDistance C_VECSquareDistance
+#define VECDistance C_VECDistance
+#endif
+
+#define VECReflect C_VECReflect
+#define VECHalfAngle C_VECHalfAngle
+
+void C_QUATAdd(const Quaternion* p, const Quaternion* q, Quaternion* r);
+void C_QUATSubtract(const Quaternion* p, const Quaternion* q, Quaternion* r);
+void C_QUATMultiply(const Quaternion* p, const Quaternion* q, Quaternion* pq);
+void C_QUATDivide(const Quaternion* p, const Quaternion* q, Quaternion* r);
+void C_QUATScale(const Quaternion* q, Quaternion* r, f32 scale);
+f32 C_QUATDotProduct(const Quaternion* p, const Quaternion* q);
+void C_QUATNormalize(const Quaternion* src, Quaternion* unit);
+void C_QUATInverse(const Quaternion* src, Quaternion* inv);
+void C_QUATExp(const Quaternion* q, Quaternion* r);
+void C_QUATLogN(const Quaternion* q, Quaternion* r);
+
+void C_QUATMakeClosest(const Quaternion* q, const Quaternion* qto, Quaternion* r);
+void C_QUATRotAxisRad(Quaternion* r, const Vec* axis, f32 rad);
+void C_QUATMtx(Quaternion* r, const Mtx m);
+
+void C_QUATLerp(const Quaternion* p, const Quaternion* q, Quaternion* r, f32 t);
+void C_QUATSlerp(const Quaternion* p, const Quaternion* q, Quaternion* r, f32 t);
+void C_QUATSquad(const Quaternion* p, const Quaternion* a, const Quaternion* b, const Quaternion* q,
+                 Quaternion* r, f32 t);
+void C_QUATCompA(const Quaternion* qprev, const Quaternion* q, const Quaternion* qnext,
+                 Quaternion* a);
+
+#ifdef GEKKO
+void PSQUATAdd(const Quaternion* p, const Quaternion* q, Quaternion* r);
+void PSQUATSubtract(const Quaternion* p, const Quaternion* q, Quaternion* r);
+void PSQUATMultiply(const Quaternion* p, const Quaternion* q, Quaternion* pq);
+void PSQUATDivide(const Quaternion* p, const Quaternion* q, Quaternion* r);
+void PSQUATScale(const Quaternion* q, Quaternion* r, f32 scale);
+f32 PSQUATDotProduct(const Quaternion* p, const Quaternion* q);
+void PSQUATNormalize(const Quaternion* src, Quaternion* unit);
+void PSQUATInverse(const Quaternion* src, Quaternion* inv);
+#else
+#define PSQUATAdd QUATAdd
+#define PSQUATSubtract QUATSubtract
+#define PSQUATMultiply QUATMultiply
+#define PSQUATDivide QUATDivide
+#define PSQUATScale QUATScale
+#define PSQUATDotProduct QUATDotProduct
+#define PSQUATNormalize QUATNormalize
+#define PSQUATInverse QUATInverse
+#endif
+
+#ifdef MTX_USE_PS
+#define QUATAdd C_QUATAdd
+#define QUATSubtract C_QUATSubtract
+#define QUATMultiply C_QUATMultiply
+#define QUATDivide C_QUATDivide
+#define QUATScale C_QUATScale
+#define QUATDotProduct C_QUATDotProduct
+#define QUATNormalize C_QUATNormalize
+#define QUATInverse C_QUATInverse
+#else // MTX_USE_C
+#define QUATAdd C_QUATAdd
+#define QUATSubtract C_QUATSubtract
+#define QUATMultiply C_QUATMultiply
+#define QUATDivide C_QUATDivide
+#define QUATScale C_QUATScale
+#define QUATDotProduct C_QUATDotProduct
+#define QUATNormalize C_QUATNormalize
+#define QUATInverse C_QUATInverse
+#endif
+
+#define QUATExp C_QUATExp
+#define QUATLogN C_QUATLogN
+#define QUATMakeClosest C_QUATMakeClosest
+#define QUATRotAxisRad C_QUATRotAxisRad
+#define QUATMtx C_QUATMtx
+#define QUATLerp C_QUATLerp
+#define QUATSlerp C_QUATSlerp
+#define QUATSquad C_QUATSquad
+#define QUATCompA C_QUATCompA
+
+void MTXInitStack(MtxStack* sPtr, u32 numMtx);
+MtxPtr MTXPush(MtxStack* sPtr, const Mtx m);
+MtxPtr MTXPushFwd(MtxStack* sPtr, const Mtx m);
+MtxPtr MTXPushInv(MtxStack* sPtr, const Mtx m);
+MtxPtr MTXPushInvXpose(MtxStack* sPtr, const Mtx m);
+MtxPtr MTXPop(MtxStack* sPtr);
+MtxPtr MTXGetStackPtr(const MtxStack* sPtr);
+
+#define MTXAllocStack(sPtr, numMtx)                                                                \
+  (((MtxStackPtr)(sPtr))->stackBase = (MtxPtr)OSAlloc(((numMtx) * sizeof(Mtx))))
+
+#define MTXFreeStack(sPtr) (OSFree((void*)(((MtxStackPtr)(sPtr))->stackBase)))
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_MTX
diff --git a/aurora-main/include/dolphin/mtx/GeoTypes.h b/aurora-main/include/dolphin/mtx/GeoTypes.h
new file mode 100644
index 0000000..985c2d3
--- /dev/null
+++ b/aurora-main/include/dolphin/mtx/GeoTypes.h
@@ -0,0 +1,40 @@
+#ifndef _DOLPHIN_GEOTYPES
+#define _DOLPHIN_GEOTYPES
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+  typedef struct Vec {
+    f32 x, y, z;
+  } Vec, *VecPtr, Point3d, *Point3dPtr;
+
+  typedef struct {
+    s16 x;
+    s16 y;
+    s16 z;
+  } S16Vec, *S16VecPtr;
+
+  typedef struct {
+    f32 x, y, z, w;
+  } Quaternion, *QuaternionPtr, Qtrn, *QtrnPtr;
+
+  typedef f32 Mtx[3][4];
+
+  typedef f32 (*MtxPtr)[4];
+
+  typedef f32 ROMtx[4][3];
+
+  typedef f32 (*ROMtxPtr)[3];
+
+  typedef f32 Mtx44[4][4];
+
+  typedef f32 (*Mtx44Ptr)[4];
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_GEOTYPES
diff --git a/aurora-main/include/dolphin/mtx/mtx44ext.h b/aurora-main/include/dolphin/mtx/mtx44ext.h
new file mode 100644
index 0000000..391ea57
--- /dev/null
+++ b/aurora-main/include/dolphin/mtx/mtx44ext.h
@@ -0,0 +1,106 @@
+#include <dolphin/mtx.h>
+
+#ifndef _DOLPHIN_MTX44EXT
+#define _DOLPHIN_MTX44EXT
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void C_MTX44Identity(Mtx44 m);
+void C_MTX44Copy(const Mtx44 src, Mtx44 dst);
+void C_MTX44Concat(const Mtx44 a, const Mtx44 b, Mtx44 ab);
+void C_MTX44Transpose(const Mtx44 src, Mtx44 xPose);
+u32 C_MTX44Inverse(const Mtx44 src, Mtx44 inv);
+
+#ifdef GEKKO
+void PSMTX44Identity(Mtx44 m);
+void PSMTX44Copy(const Mtx44 src, Mtx44 dst);
+void PSMTX44Concat(const Mtx44 a, const Mtx44 b, Mtx44 ab);
+void PSMTX44Transpose(const Mtx44 src, Mtx44 xPose);
+#endif
+
+#ifdef MTX_USE_PS
+#define MTX44Identity PSMTX44Identity
+#define MTX44Copy PSMTX44Copy
+#define MTX44Concat PSMTX44Concat
+#define MTX44Transpose PSMTX44Transpose
+#else
+#define MTX44Identity C_MTX44Identity
+#define MTX44Copy C_MTX44Copy
+#define MTX44Concat C_MTX44Concat
+#define MTX44Transpose C_MTX44Transpose
+#endif
+
+#define MTX44Inverse C_MTX44Inverse
+
+void C_MTX44Trans(Mtx44 m, f32 xT, f32 yT, f32 zT);
+void C_MTX44TransApply(const Mtx44 src, Mtx44 dst, f32 xT, f32 yT, f32 zT);
+void C_MTX44Scale(Mtx44 m, f32 xS, f32 yS, f32 zS);
+void C_MTX44ScaleApply(const Mtx44 src, Mtx44 dst, f32 xS, f32 yS, f32 zS);
+
+void C_MTX44RotRad(Mtx44 m, char axis, f32 rad);
+void C_MTX44RotTrig(Mtx44 m, char axis, f32 sinA, f32 cosA);
+void C_MTX44RotAxisRad(Mtx44 m, const Vec* axis, f32 rad);
+
+#ifdef GEKKO
+void PSMTX44Trans(Mtx44 m, f32 xT, f32 yT, f32 zT);
+void PSMTX44TransApply(const Mtx44 src, Mtx44 dst, f32 xT, f32 yT, f32 zT);
+void PSMTX44Scale(Mtx44 m, f32 xS, f32 yS, f32 zS);
+void PSMTX44ScaleApply(const Mtx44 src, Mtx44 dst, f32 xS, f32 yS, f32 zS);
+
+void PSMTX44RotRad(Mtx44 m, char axis, f32 rad);
+void PSMTX44RotTrig(Mtx44 m, char axis, f32 sinA, f32 cosA);
+void PSMTX44RotAxisRad(Mtx44 m, const Vec* axis, f32 rad);
+#endif
+
+#ifdef MTX_USE_PS
+#define MTX44Trans PSMTX44Trans
+#define MTX44TransApply PSMTX44TransApply
+#define MTX44Scale PSMTX44Scale
+#define MTX44ScaleApply PSMTX44ScaleApply
+
+#define MTX44RotRad PSMTX44RotRad
+#define MTX44RotTrig PSMTX44RotTrig
+#define MTX44RotAxisRad PSMTX44RotAxisRad
+
+#else
+#define MTX44Trans C_MTX44Trans
+#define MTX44TransApply C_MTX44TransApply
+#define MTX44Scale C_MTX44Scale
+#define MTX44ScaleApply C_MTX44ScaleApply
+
+#define MTX44RotRad C_MTX44RotRad
+#define MTX44RotTrig C_MTX44RotTrig
+#define MTX44RotAxisRad C_MTX44RotAxisRad
+#endif
+
+void C_MTX44MultVec(const Mtx44 m, const Vec* src, Vec* dst);
+void C_MTX44MultVecArray(const Mtx44 m, const Vec* srcBase, Vec* dstBase, u32 count);
+void C_MTX44MultVecSR(const Mtx44 m, const Vec* src, Vec* dst);
+void C_MTX44MultVecArraySR(const Mtx44 m, const Vec* srcBase, Vec* dstBase, u32 count);
+
+#ifdef GEKKO
+void PSMTX44MultVec(const Mtx44 m, const Vec* src, Vec* dst);
+void PSMTX44MultVecArray(const Mtx44 m, const Vec* srcBase, Vec* dstBase, u32 count);
+void PSMTX44MultVecSR(const Mtx44 m, const Vec* src, Vec* dst);
+void PSMTX44MultVecArraySR(const Mtx44 m, const Vec* srcBase, Vec* dstBase, u32 count);
+#endif
+
+#ifdef MTX_USE_PS
+#define MTX44MultVec PSMTX44MultVec
+#define MTX44MultVecArray PSMTX44MultVecArray
+#define MTX44MultVecSR PSMTX44MultVecSR
+#define MTX44MultVecArraySR PSMTX44MultVecArraySR
+#else
+#define MTX44MultVec C_MTX44MultVec
+#define MTX44MultVecArray C_MTX44MultVecArray
+#define MTX44MultVecSR C_MTX44MultVecSR
+#define MTX44MultVecArraySR C_MTX44MultVecArraySR
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_MTX44EXT
diff --git a/aurora-main/include/dolphin/os.h b/aurora-main/include/dolphin/os.h
new file mode 100644
index 0000000..18f3637
--- /dev/null
+++ b/aurora-main/include/dolphin/os.h
@@ -0,0 +1,311 @@
+#ifndef _DOLPHIN_OS_H_
+#define _DOLPHIN_OS_H_
+
+#ifdef __cplusplus
+#include <cstdio>
+#else
+#include <stdio.h>
+#endif
+
+#include <dolphin/types.h>
+#include <dolphin/gx/GXStruct.h>
+
+void OSReportInit(void);
+void OSSwitchFiberEx(u32, u32, u32, u32, u32, u32);
+void OSVAttention(const char* fmt, va_list args);
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <dolphin/os/OSAlloc.h>
+#include <dolphin/os/OSCache.h>
+#include <dolphin/os/OSContext.h>
+#include <dolphin/os/OSInterrupt.h>
+#include <dolphin/os/OSModule.h>
+#include <dolphin/os/OSThread.h>
+#include <dolphin/os/OSMutex.h>
+#include <dolphin/os/OSFastCast.h>
+#include <dolphin/os/OSFont.h>
+#include <dolphin/os/OSReset.h>
+#include <dolphin/os/OSResetSW.h>
+#include <dolphin/os/OSError.h>
+#include <dolphin/os/OSTime.h>
+#include <dolphin/os/OSSerial.h>
+#include <dolphin/os/OSRtc.h>
+#include <dolphin/os/OSMessage.h>
+#include <dolphin/os/OSException.h>
+#include <dolphin/os/OSAlarm.h>
+#include <dolphin/os/OSDC.h>
+#include <dolphin/os/OSIC.h>
+#include <dolphin/os/OSLC.h>
+#include <dolphin/os/OSL2.h>
+#include <dolphin/os/OSReboot.h>
+#ifdef __MWERKS__
+#include <dolphin/os/OSExec.h>
+#endif
+#include <dolphin/os/OSMemory.h>
+#include <dolphin/os/OSSemaphore.h>
+#include <dolphin/os/OSUtf.h>
+#include <dolphin/os/OSTimer.h>
+
+// private macro, maybe shouldn't be defined here?
+#define OFFSET(addr, align) (((u32)(addr) & ((align)-1)))
+
+#ifndef __MWERKS__
+typedef struct {
+    BOOL valid;
+    u32 restartCode;
+    u32 bootDol;
+    void* regionStart;
+    void* regionEnd;
+    int argsUseDefault;
+    void* argsAddr;
+} OSExecParams;
+#endif
+
+#define DOLPHIN_ALIGNMENT 32
+
+// Upper words of the masks, since UIMM is only 16 bits
+#define OS_CACHED_REGION_PREFIX   0x8000
+#define OS_UNCACHED_REGION_PREFIX 0xC000
+#define OS_PHYSICAL_MASK 0x3FFF
+
+extern uintptr_t OSBaseAddress;
+
+#define OS_BASE_CACHED   (OSBaseAddress)
+#define OS_BASE_UNCACHED (OSBaseAddress)
+
+#ifdef __MWERKS__
+u32 __OSPhysicalMemSize AT_ADDRESS(OS_BASE_CACHED | 0x0028);
+volatile int __OSTVMode AT_ADDRESS(OS_BASE_CACHED | 0x00CC);
+OSThreadQueue __OSActiveThreadQueue AT_ADDRESS(OS_BASE_CACHED | 0x00DC);
+OSThread* __OSCurrentThread AT_ADDRESS(OS_BASE_CACHED | 0x00E4);
+u32 __OSSimulatedMemSize AT_ADDRESS(OS_BASE_CACHED | 0x00F0);
+u32 __OSBusClock AT_ADDRESS(OS_BASE_CACHED | 0x00F8);
+u32 __OSCoreClock AT_ADDRESS(OS_BASE_CACHED | 0x00FC);
+volatile u16 __OSDeviceCode AT_ADDRESS(OS_BASE_CACHED | 0x30E6);
+u16 __OSWirelessPadFixMode AT_ADDRESS(OS_BASE_CACHED | 0x30E0);
+
+// unknowns
+OSThread* __gUnkThread1 AT_ADDRESS(OS_BASE_CACHED | 0x00D8);
+int __gUnknown800030C0[2] AT_ADDRESS(OS_BASE_CACHED | 0x30C0);
+u8 __gUnknown800030E3 AT_ADDRESS(OS_BASE_CACHED | 0x30E3);
+#else
+#define __OSBusClock  (*(u32 *)(OS_BASE_CACHED + 0x00F8))
+#define __OSCoreClock (*(u32 *)(OS_BASE_CACHED + 0x00FC))
+#endif
+
+#define OS_TIMER_CLOCK_DIVIDER 4
+#define OS_BUS_CLOCK   162000000
+#define OS_CORE_CLOCK  162000000
+#define OS_TIMER_CLOCK (OS_BUS_CLOCK/OS_TIMER_CLOCK_DIVIDER)
+
+#define OSTicksToSeconds(ticks)      ((ticks)   / (OS_TIMER_CLOCK))
+#define OSTicksToMilliseconds(ticks) ((ticks)   / (OS_TIMER_CLOCK/1000))
+#define OSTicksToMicroseconds(ticks) ((ticks) * 8 / (OS_TIMER_CLOCK/125000))
+#define OSSecondsToTicks(sec)        ((sec) * (OS_TIMER_CLOCK))
+#define OSMillisecondsToTicks(msec)  ((msec) * (OS_TIMER_CLOCK / 1000))
+#define OSNanosecondsToTicks(nsec)   (((nsec) * (OS_TIMER_CLOCK / 125000)) / 8000)
+#define OSMicrosecondsToTicks(usec)  (((usec) * (OS_TIMER_CLOCK / 125000)) / 8)
+
+u32 OSGetConsoleType(void);
+void OSInit(void);
+void OSRegisterVersion(const char* id);
+
+void* OSGetArenaHi(void);
+void* OSGetArenaLo(void);
+void OSSetArenaHi(void* newHi);
+void OSSetArenaLo(void* newLo);
+void* OSAllocFromArenaLo(u32 size, u32 align);
+void* OSAllocFromArenaHi(u32 size, u32 align);
+
+u32 OSGetPhysicalMemSize(void);
+
+void __OSPSInit(void);
+void __OSFPRInit(void);
+u32 __OSGetDIConfig(void);
+
+#if 0
+void OSDefaultExceptionHandler(__OSException exception, OSContext* context);
+#endif
+
+typedef struct OSCalendarTime {
+    /* 0x00 */ int sec;
+    /* 0x04 */ int min;
+    /* 0x08 */ int hour;
+    /* 0x0C */ int mday;
+    /* 0x10 */ int mon;
+    /* 0x14 */ int year;
+    /* 0x18 */ int wday;
+    /* 0x1C */ int yday;
+    /* 0x20 */ int msec;
+    /* 0x24 */ int usec;
+} OSCalendarTime;
+
+#include <dolphin/dvd.h>
+typedef struct OSBootInfo_s {
+    DVDDiskID DVDDiskID;
+    u32 magic;
+    u32 version;
+    u32 memorySize;
+    u32 consoleType;
+    void* arenaLo;
+    void* arenaHi;
+    void* FSTLocation;
+    u32 FSTMaxLength;
+} OSBootInfo;
+
+typedef struct OSStopwatch {
+    char* name;
+    u32 hits;
+    OSTime total;
+    OSTime min;
+    OSTime max;
+    OSTime last;
+    BOOL running;
+    u32 _padding;
+} OSStopwatch;
+
+void OSInitStopwatch(OSStopwatch* sw, char* name);
+void OSStartStopwatch(OSStopwatch* sw);
+void OSStopStopwatch(OSStopwatch* sw);
+OSTime OSCheckStopwatch(OSStopwatch* sw);
+void OSResetStopwatch(OSStopwatch* sw);
+void OSDumpStopwatch(OSStopwatch* sw);
+
+OSTick OSGetTick(void);
+OSTime OSGetTime(void);
+void OSTicksToCalendarTime(OSTime ticks, OSCalendarTime* td);
+OSTime OSCalendarTimeToTicks(OSCalendarTime* td);
+BOOL OSEnableInterrupts(void);
+BOOL OSDisableInterrupts(void);
+BOOL OSRestoreInterrupts(BOOL level);
+
+#define OS_CONSOLE_MASK        0xF0000000
+#define OS_CONSOLE_RETAIL      0x00000000
+#define OS_CONSOLE_DEVELOPMENT 0x10000000
+#define OS_CONSOLE_TDEV        0x20000000
+
+#define OS_CONSOLE_RETAIL4     0x00000004
+#define OS_CONSOLE_RETAIL3     0x00000003
+#define OS_CONSOLE_RETAIL2     0x00000002
+#define OS_CONSOLE_RETAIL1     0x00000001
+#define OS_CONSOLE_TDEVHW4     0x20000007
+#define OS_CONSOLE_TDEVHW3     0x20000006
+#define OS_CONSOLE_TDEVHW2     0x20000005
+#define OS_CONSOLE_TDEVHW1     0x20000004
+#define OS_CONSOLE_DEVHW4      0x10000007
+#define OS_CONSOLE_DEVHW3      0x10000006
+#define OS_CONSOLE_DEVHW2      0x10000005
+#define OS_CONSOLE_DEVHW1      0x10000004
+#define OS_CONSOLE_MINNOW      0x10000003
+#define OS_CONSOLE_ARTHUR      0x10000002
+#define OS_CONSOLE_PC_EMULATOR 0x10000001
+#define OS_CONSOLE_EMULATOR    0x10000000
+
+#define OS_SOUND_MODE_MONO   0
+#define OS_SOUND_MODE_STEREO 1
+
+u32 OSGetSoundMode(void);
+void OSSetSoundMode(u32 mode);
+
+DECL_WEAK void OSReport(const char* msg, ...);
+DECL_WEAK void OSVReport(const char* msg, va_list list);
+DECL_WEAK void OSPanic NORETURN(const char* file, int line, const char* msg, ...);
+void OSFatal NORETURN(GXColor fg, GXColor bg, const char* msg);
+
+#define OSRoundUp32B(x)   (((uintptr_t)(x) + 32 - 1) & ~(32 - 1))
+#define OSRoundDown32B(x) (((uintptr_t)(x)) & ~(32 - 1))
+
+void* OSPhysicalToCached(u32 paddr);
+void* OSPhysicalToUncached(u32 paddr);
+u32 OSCachedToPhysical(void* caddr);
+u32 OSUncachedToPhysical(void* ucaddr);
+void* OSCachedToUncached(void* caddr);
+void* OSUncachedToCached(void* ucaddr);
+
+#if !DEBUG && !defined(TARGET_PC)
+#define OSPhysicalToCached(paddr)    ((void*) ((u32)(OS_BASE_CACHED   + (u32)(paddr))))
+#define OSPhysicalToUncached(paddr)  ((void*) ((u32)(OS_BASE_UNCACHED + (u32)(paddr))))
+#define OSCachedToPhysical(caddr)    ((u32)   ((u32)(caddr)  - OS_BASE_CACHED))
+#define OSUncachedToPhysical(ucaddr) ((u32)   ((u32)(ucaddr) - OS_BASE_UNCACHED))
+#define OSCachedToUncached(caddr)    ((void*) ((u8*)(caddr)  + (OS_BASE_UNCACHED - OS_BASE_CACHED)))
+#define OSUncachedToCached(ucaddr)   ((void*) ((u8*)(ucaddr) - (OS_BASE_UNCACHED - OS_BASE_CACHED)))
+#endif
+
+// unsorted externs
+extern OSTime __OSGetSystemTime(void);
+DECL_WEAK extern int __OSIsGcam;
+extern OSExecParams __OSRebootParams;
+extern OSTime __OSStartTime;
+extern int __OSInIPL;
+
+// helper for assert line numbers in different revisions
+#ifndef SDK_REVISION
+#define SDK_REVISION 0
+#endif
+
+#if SDK_REVISION < 1
+    #define LINE(l0, l1, l2) (l0)
+#elif SDK_REVISION < 2
+    #define LINE(l0, l1, l2) (l1)
+#else
+    #define LINE(l0, l1, l2) (l2)
+#endif
+
+#if DEBUG
+#if __MWERKS__
+
+#define ASSERTLINE(line, cond) \
+    ((cond) || (OSPanic(__FILE__, line, "Failed assertion " #cond), 0))
+
+#define ASSERTMSGLINE(line, cond, msg) \
+    ((cond) || (OSPanic(__FILE__, line, msg), 0))
+
+// This is dumb but we dont have a Metrowerks way to do variadic macros in the macro to make this done in a not scrubby way.
+#define ASSERTMSG1LINE(line, cond, msg, arg1) \
+    ((cond) || (OSPanic(__FILE__, line, msg, arg1), 0))
+
+#define ASSERTMSG2LINE(line, cond, msg, arg1, arg2) \
+    ((cond) || (OSPanic(__FILE__, line, msg, arg1, arg2), 0))
+
+#define ASSERTMSGLINEV(line, cond, ...) \
+    ((cond) || (OSPanic(__FILE__, line, __VA_ARGS__), 0))
+
+#else
+
+#define ASSERTLINE(line, cond) \
+    ((cond) || (OSPanic(__FILE__, __LINE__, "Failed assertion " #cond), 0))
+
+#define ASSERTMSGLINE(line, cond, msg) \
+    ((cond) || (OSPanic(__FILE__, __LINE__, msg), 0))
+
+    // This is dumb but we dont have a Metrowerks way to do variadic macros in the macro to make this done in a not scrubby way.
+#define ASSERTMSG1LINE(line, cond, msg, arg1) \
+    ((cond) || (OSPanic(__FILE__, __LINE__, msg, arg1), 0))
+#define ASSERTMSG2LINE(line, cond, msg, arg1, arg2) \
+    ((cond) || (OSPanic(__FILE__, __LINE__, msg, arg1, arg2), 0))
+
+#define ASSERTMSGLINEV(line, cond, ...) \
+    ((cond) || (OSPanic(__FILE__, __LINE__, __VA_ARGS__), 0))
+
+#endif
+
+#else
+#define ASSERTLINE(line, cond) (void)0
+#define ASSERTMSGLINE(line, cond, msg) (void)0
+#define ASSERTMSG1LINE(line, cond, msg, arg1) (void)0
+#define ASSERTMSG2LINE(line, cond, msg, arg1, arg2) (void)0
+#define ASSERTMSGLINEV(line, cond, ...) (void)0
+#endif
+
+#ifdef ASSERT
+#undef ASSERT
+#endif
+#define ASSERT(cond) ASSERTLINE(__LINE__, cond)
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/aurora-main/include/dolphin/os/OSAlarm.h b/aurora-main/include/dolphin/os/OSAlarm.h
new file mode 100644
index 0000000..3105039
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSAlarm.h
@@ -0,0 +1,36 @@
+#ifndef _DOLPHIN_OSALARM_H_
+#define _DOLPHIN_OSALARM_H_
+
+#include <dolphin/os.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct OSAlarm OSAlarm;
+typedef void (*OSAlarmHandler)(OSAlarm* alarm, OSContext* context);
+struct OSAlarm {
+    OSAlarmHandler handler;
+    u32 tag;
+    OSTime fire;
+    OSAlarm* prev;
+    OSAlarm* next;
+    OSTime period;
+    OSTime start;
+};
+
+BOOL OSCheckAlarmQueue(void);
+void OSInitAlarm(void);
+void OSCreateAlarm(OSAlarm* alarm);
+void OSSetAlarm(OSAlarm* alarm, OSTime tick, OSAlarmHandler handler);
+void OSSetAbsAlarm(OSAlarm* alarm, OSTime time, OSAlarmHandler handler);
+void OSSetPeriodicAlarm(OSAlarm* alarm, OSTime start, OSTime period, OSAlarmHandler handler);
+void OSCancelAlarm(OSAlarm *alarm);
+void OSSetAlarmTag(OSAlarm* alarm, u32 tag);
+void OSCancelAlarms(u32 tag);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_OSALARM_H_
diff --git a/aurora-main/include/dolphin/os/OSAlloc.h b/aurora-main/include/dolphin/os/OSAlloc.h
new file mode 100644
index 0000000..e2cecd9
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSAlloc.h
@@ -0,0 +1,34 @@
+#ifndef _DOLPHIN_OSALLOC_H_
+#define _DOLPHIN_OSALLOC_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef int OSHeapHandle;
+
+extern volatile OSHeapHandle __OSCurrHeap;
+
+void* OSAllocFromHeap(OSHeapHandle heap, u32 size);
+void* OSAllocFixed(void* rstart, void* rend);
+void OSFreeToHeap(OSHeapHandle heap, void* ptr);
+OSHeapHandle OSSetCurrentHeap(OSHeapHandle heap);
+void* OSInitAlloc(void* arenaStart, void* arenaEnd, int maxHeaps);
+OSHeapHandle OSCreateHeap(void* start, void* end);
+void OSDestroyHeap(OSHeapHandle heap);
+void OSAddToHeap(OSHeapHandle heap, void* start, void* end);
+s32 OSCheckHeap(OSHeapHandle heap);
+u32 OSReferentSize(void* ptr);
+void OSDumpHeap(OSHeapHandle heap);
+void OSVisitAllocated(void (*visitor)(void*, u32));
+
+#define OSAlloc(size) OSAllocFromHeap(__OSCurrHeap, (size))
+#define OSFree(ptr) OSFreeToHeap(__OSCurrHeap, (ptr))
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSCache.h b/aurora-main/include/dolphin/os/OSCache.h
new file mode 100644
index 0000000..89e7ce9
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSCache.h
@@ -0,0 +1,38 @@
+#ifndef _DOLPHIN_OSCACHE_H_
+#define _DOLPHIN_OSCACHE_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void DCInvalidateRange(void* addr, u32 nBytes);
+void DCFlushRange(void* addr, u32 nBytes);
+void DCStoreRange(void* addr, u32 nBytes);
+void DCFlushRangeNoSync(void* addr, u32 nBytes);
+void DCStoreRangeNoSync(void* addr, u32 nBytes);
+void DCZeroRange(void* addr, u32 nBytes);
+void DCTouchRange(void* addr, u32 nBytes);
+void ICInvalidateRange(void* addr, u32 nBytes);
+
+#define LC_BASE_PREFIX 0xE000
+#define LC_BASE (LC_BASE_PREFIX << 16)
+#define LCGetBase() ((void*)LC_BASE)
+
+void LCEnable(void);
+void LCDisable(void);
+void LCLoadBlocks(void* destTag, void* srcAddr, u32 numBlocks);
+void LCStoreBlocks(void* destAddr, void* srcTag, u32 numBlocks);
+u32 LCLoadData(void* destAddr, void* srcAddr, u32 nBytes);
+u32 LCStoreData(void* destAddr, void* srcAddr, u32 nBytes);
+u32 LCQueueLength(void);
+void LCQueueWait(u32 len);
+void LCFlushQueue(void);
+void __OSCacheInit(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSContext.h b/aurora-main/include/dolphin/os/OSContext.h
new file mode 100644
index 0000000..bf06efc
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSContext.h
@@ -0,0 +1,177 @@
+#ifndef _DOLPHIN_OSCONTEXT_H_
+#define _DOLPHIN_OSCONTEXT_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define __OS_CONTEXT_FRAME 768
+
+#define OS_CONTEXT_R0 0
+#define OS_CONTEXT_R1 4
+#define OS_CONTEXT_R2 8
+#define OS_CONTEXT_R3 12
+#define OS_CONTEXT_R4 16
+#define OS_CONTEXT_R5 20
+#define OS_CONTEXT_R6 24
+#define OS_CONTEXT_R7 28
+#define OS_CONTEXT_R8 32
+#define OS_CONTEXT_R9 36
+#define OS_CONTEXT_R10 40
+#define OS_CONTEXT_R11 44
+#define OS_CONTEXT_R12 48
+#define OS_CONTEXT_R13 52
+#define OS_CONTEXT_R14 56
+#define OS_CONTEXT_R15 60
+#define OS_CONTEXT_R16 64
+#define OS_CONTEXT_R17 68
+#define OS_CONTEXT_R18 72
+#define OS_CONTEXT_R19 76
+#define OS_CONTEXT_R20 80
+#define OS_CONTEXT_R21 84
+#define OS_CONTEXT_R22 88
+#define OS_CONTEXT_R23 92
+#define OS_CONTEXT_R24 96
+#define OS_CONTEXT_R25 100
+#define OS_CONTEXT_R26 104
+#define OS_CONTEXT_R27 108
+#define OS_CONTEXT_R28 112
+#define OS_CONTEXT_R29 116
+#define OS_CONTEXT_R30 120
+#define OS_CONTEXT_R31 124
+
+#define OS_CONTEXT_CR 128
+#define OS_CONTEXT_LR 132
+#define OS_CONTEXT_CTR 136
+#define OS_CONTEXT_XER 140
+
+#define OS_CONTEXT_FPR0 144
+#define OS_CONTEXT_FPR1 152
+#define OS_CONTEXT_FPR2 160
+#define OS_CONTEXT_FPR3 168
+#define OS_CONTEXT_FPR4 176
+#define OS_CONTEXT_FPR5 184
+#define OS_CONTEXT_FPR6 192
+#define OS_CONTEXT_FPR7 200
+#define OS_CONTEXT_FPR8 208
+#define OS_CONTEXT_FPR9 216
+#define OS_CONTEXT_FPR10 224
+#define OS_CONTEXT_FPR11 232
+#define OS_CONTEXT_FPR12 240
+#define OS_CONTEXT_FPR13 248
+#define OS_CONTEXT_FPR14 256
+#define OS_CONTEXT_FPR15 264
+#define OS_CONTEXT_FPR16 272
+#define OS_CONTEXT_FPR17 280
+#define OS_CONTEXT_FPR18 288
+#define OS_CONTEXT_FPR19 296
+#define OS_CONTEXT_FPR20 304
+#define OS_CONTEXT_FPR21 312
+#define OS_CONTEXT_FPR22 320
+#define OS_CONTEXT_FPR23 328
+#define OS_CONTEXT_FPR24 336
+#define OS_CONTEXT_FPR25 344
+#define OS_CONTEXT_FPR26 352
+#define OS_CONTEXT_FPR27 360
+#define OS_CONTEXT_FPR28 368
+#define OS_CONTEXT_FPR29 376
+#define OS_CONTEXT_FPR30 384
+#define OS_CONTEXT_FPR31 392
+
+#define OS_CONTEXT_FPSCR 400
+
+#define OS_CONTEXT_SRR0 408
+#define OS_CONTEXT_SRR1 412
+
+#define OS_CONTEXT_MODE 416
+#define OS_CONTEXT_STATE 418
+
+#define OS_CONTEXT_GQR0 420
+#define OS_CONTEXT_GQR1 424
+#define OS_CONTEXT_GQR2 428
+#define OS_CONTEXT_GQR3 432
+#define OS_CONTEXT_GQR4 436
+#define OS_CONTEXT_GQR5 440
+#define OS_CONTEXT_GQR6 444
+#define OS_CONTEXT_GQR7 448
+#define __OSCONTEXT_PADDING 452
+
+#define OS_CONTEXT_PSF0 456
+#define OS_CONTEXT_PSF1 464
+#define OS_CONTEXT_PSF2 472
+#define OS_CONTEXT_PSF3 480
+#define OS_CONTEXT_PSF4 488
+#define OS_CONTEXT_PSF5 496
+#define OS_CONTEXT_PSF6 504
+#define OS_CONTEXT_PSF7 512
+#define OS_CONTEXT_PSF8 520
+#define OS_CONTEXT_PSF9 528
+#define OS_CONTEXT_PSF10 536
+#define OS_CONTEXT_PSF11 544
+#define OS_CONTEXT_PSF12 552
+#define OS_CONTEXT_PSF13 560
+#define OS_CONTEXT_PSF14 568
+#define OS_CONTEXT_PSF15 576
+#define OS_CONTEXT_PSF16 584
+#define OS_CONTEXT_PSF17 592
+#define OS_CONTEXT_PSF18 600
+#define OS_CONTEXT_PSF19 608
+#define OS_CONTEXT_PSF20 616
+#define OS_CONTEXT_PSF21 624
+#define OS_CONTEXT_PSF22 632
+#define OS_CONTEXT_PSF23 640
+#define OS_CONTEXT_PSF24 648
+#define OS_CONTEXT_PSF25 656
+#define OS_CONTEXT_PSF26 664
+#define OS_CONTEXT_PSF27 672
+#define OS_CONTEXT_PSF28 680
+#define OS_CONTEXT_PSF29 688
+#define OS_CONTEXT_PSF30 696
+#define OS_CONTEXT_PSF31 704
+#define OS_CONTEXT_STATE_EXC 0x02u
+
+#define OS_CONTEXT_STATE_FPSAVED 0x01u
+
+typedef struct OSContext {
+#ifndef TARGET_PC
+    /* 0x000 */ u32 gpr[32];
+    /* 0x080 */ u32 cr;
+    /* 0x084 */ u32 lr;
+    /* 0x088 */ u32 ctr;
+    /* 0x08C */ u32 xer;
+    /* 0x090 */ f64 fpr[32];
+    /* 0x190 */ u32 fpscr_pad;
+    /* 0x194 */ u32 fpscr;
+    /* 0x198 */ u32 srr0;
+    /* 0x19C */ u32 srr1;
+    /* 0x1A0 */ u16 mode;
+    /* 0x1A2 */ u16 state;
+    /* 0x1A4 */ u32 gqr[8];
+    /* 0x1C4 */ u32 psf_pad;
+    /* 0x1C8 */ f64 psf[32];
+#else
+    char storage[0x2C8];
+#endif
+} OSContext;
+
+u32 OSGetStackPointer(void);
+void OSDumpContext(OSContext* context);
+void OSLoadContext(OSContext* context);
+u32 OSSaveContext(OSContext* context);
+void OSClearContext(OSContext* context);
+OSContext* OSGetCurrentContext(void);
+void OSSetCurrentContext(OSContext* context);
+void OSLoadFPUContext(OSContext* fpucontext);
+void OSSaveFPUContext(OSContext* fpucontext);
+u32 OSSwitchStack(u32 newsp);
+int OSSwitchFiber(u32 pc, u32 newsp);
+void OSInitContext(OSContext* context, u32 pc, u32 newsp);
+void OSFillFPUContext(OSContext* context);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSDC.h b/aurora-main/include/dolphin/os/OSDC.h
new file mode 100644
index 0000000..bab2d68
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSDC.h
@@ -0,0 +1,23 @@
+#ifndef _DOLPHIN_OSDC_H_
+#define _DOLPHIN_OSDC_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void DCFlashInvalidate(void);
+void DCEnable(void);
+void DCDisable(void);
+void DCFreeze(void);
+void DCUnfreeze(void);
+void DCTouchLoad(void* addr);
+void DCBlockZero(void* addr);
+void DCBlockStore(void* addr);
+void DCBlockFlush(void* addr);
+void DCBlockInvalidate(void* addr);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSError.h b/aurora-main/include/dolphin/os/OSError.h
new file mode 100644
index 0000000..32278eb
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSError.h
@@ -0,0 +1,39 @@
+#ifndef _DOLPHIN_OSERROR_H_
+#define _DOLPHIN_OSERROR_H_
+
+#include <dolphin/os/OSContext.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef u16 OSError;
+typedef void (*OSErrorHandler)(OSError error, OSContext* context, ...);
+
+#define OS_ERROR_SYSTEM_RESET        0
+#define OS_ERROR_MACHINE_CHECK       1
+#define OS_ERROR_DSI                 2
+#define OS_ERROR_ISI                 3
+#define OS_ERROR_EXTERNAL_INTERRUPT  4
+#define OS_ERROR_ALIGNMENT           5
+#define OS_ERROR_PROGRAM             6
+#define OS_ERROR_FLOATING_POINT      7
+#define OS_ERROR_DECREMENTER         8
+#define OS_ERROR_SYSTEM_CALL         9
+#define OS_ERROR_TRACE              10
+#define OS_ERROR_PERFORMACE_MONITOR 11
+#define OS_ERROR_BREAKPOINT         12
+#define OS_ERROR_SYSTEM_INTERRUPT   13
+#define OS_ERROR_THERMAL_INTERRUPT  14
+#define OS_ERROR_PROTECTION         15
+#define OS_ERROR_MAX                (OS_ERROR_PROTECTION + 1)
+
+OSErrorHandler OSSetErrorHandler(OSError error, OSErrorHandler handler);
+extern u32 __OSFpscrEnableBits;
+extern OSErrorHandler __OSErrorTable[17];
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSException.h b/aurora-main/include/dolphin/os/OSException.h
new file mode 100644
index 0000000..e9a2f22
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSException.h
@@ -0,0 +1,61 @@
+#ifndef _DOLPHIN_OSEXCEPTION_H_
+#define _DOLPHIN_OSEXCEPTION_H_
+
+#include <dolphin/os/OSContext.h>
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define __OS_EXCEPTION_SYSTEM_RESET             0
+#define __OS_EXCEPTION_MACHINE_CHECK            1
+#define __OS_EXCEPTION_DSI                      2
+#define __OS_EXCEPTION_ISI                      3
+#define __OS_EXCEPTION_EXTERNAL_INTERRUPT       4
+#define __OS_EXCEPTION_ALIGNMENT                5
+#define __OS_EXCEPTION_PROGRAM                  6
+#define __OS_EXCEPTION_FLOATING_POINT           7
+#define __OS_EXCEPTION_DECREMENTER              8
+#define __OS_EXCEPTION_SYSTEM_CALL              9
+#define __OS_EXCEPTION_TRACE                    10
+#define __OS_EXCEPTION_PERFORMACE_MONITOR       11
+#define __OS_EXCEPTION_BREAKPOINT               12
+#define __OS_EXCEPTION_SYSTEM_INTERRUPT         13
+#define __OS_EXCEPTION_THERMAL_INTERRUPT        14
+#define __OS_EXCEPTION_MEMORY_PROTECTION        15
+#define __OS_EXCEPTION_FLOATING_POINT_EXCEPTION 16
+#define __OS_EXCEPTION_MAX                      \
+        (__OS_EXCEPTION_THERMAL_INTERRUPT+1)
+
+typedef u8 __OSException;
+typedef void (*__OSExceptionHandler)(__OSException exception, OSContext* context);
+
+__OSExceptionHandler __OSSetExceptionHandler(__OSException exception, __OSExceptionHandler handler);
+__OSExceptionHandler __OSGetExceptionHandler(__OSException exception);
+
+#define OS_EXCEPTION_SAVE_GPRS(context)                                                            \
+  stw r0, OS_CONTEXT_R0(context);                                                                  \
+  stw r1, OS_CONTEXT_R1(context);                                                                  \
+  stw r2, OS_CONTEXT_R2(context);                                                                  \
+  stmw r6, OS_CONTEXT_R6(context);                                                                 \
+  mfspr r0, GQR1;                                                                                  \
+  stw r0, OS_CONTEXT_GQR1(context);                                                                \
+  mfspr r0, GQR2;                                                                                  \
+  stw r0, OS_CONTEXT_GQR2(context);                                                                \
+  mfspr r0, GQR3;                                                                                  \
+  stw r0, OS_CONTEXT_GQR3(context);                                                                \
+  mfspr r0, GQR4;                                                                                  \
+  stw r0, OS_CONTEXT_GQR4(context);                                                                \
+  mfspr r0, GQR5;                                                                                  \
+  stw r0, OS_CONTEXT_GQR5(context);                                                                \
+  mfspr r0, GQR6;                                                                                  \
+  stw r0, OS_CONTEXT_GQR6(context);                                                                \
+  mfspr r0, GQR7;                                                                                  \
+  stw r0, OS_CONTEXT_GQR7(context);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_OSEXCEPTION_H_
diff --git a/aurora-main/include/dolphin/os/OSExec.h b/aurora-main/include/dolphin/os/OSExec.h
new file mode 100644
index 0000000..af0dc4d
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSExec.h
@@ -0,0 +1,35 @@
+#ifndef _DOLPHIN_OSEXEC_H_
+#define _DOLPHIN_OSEXEC_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct {
+    BOOL valid;
+    u32 restartCode;
+    u32 bootDol;
+    void* regionStart;
+    void* regionEnd;
+    int argsUseDefault;
+    void* argsAddr;
+} OSExecParams;
+
+typedef int (*appGetNextCallback)(void*, u32*, u32*);
+typedef void (*appInitCallback)(void (*)(char*));
+typedef void* (*appGetEntryCallback)();
+typedef void (*AppLoaderCallback)(appInitCallback*, appGetNextCallback*, appGetEntryCallback*);
+
+OSExecParams* __OSExecParams AT_ADDRESS(0x800030F0);
+s32 __OSAppLoaderOffset AT_ADDRESS(0x800030F4);
+
+void OSExecv(const char* dolfile, const char** argv);
+void OSExecl(const char* dolfile, const char* arg0, ...);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSFastCast.h b/aurora-main/include/dolphin/os/OSFastCast.h
new file mode 100644
index 0000000..6c57394
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSFastCast.h
@@ -0,0 +1,40 @@
+#ifndef _DOLPHIN_OSFASTCAST_H_
+#define _DOLPHIN_OSFASTCAST_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+static inline void OSInitFastCast(void) {}
+
+static inline s16 __OSf32tos16(f32 inF) { return (s16) inF; }
+static inline void OSf32tos16(f32 *f, s16 *out) { *out = __OSf32tos16(*f); }
+
+static inline u8 __OSf32tou8(f32 inF) { return (u8)inF; }
+static inline void OSf32tou8(f32 *f, u8 *out) { *out = __OSf32tou8(*f); }
+
+static inline s8 __OSf32tos8(f32 inF) { return (s8) inF; }
+static inline void OSf32tos8(f32 *f, s8 *out) { *out = __OSf32tos8(*f); }
+
+static inline u16 __OSf32tou16(f32 inF) { return (u16) inF; }
+static inline void OSf32tou16(f32 *f, u16 *out) { *out = __OSf32tou16(*f); }
+
+static inline f32 __OSs8tof32(const s8* arg) { return (f32)*arg; }
+static inline void OSs8tof32(const s8* in, f32* out) { *out = __OSs8tof32(in); }
+
+static inline f32 __OSs16tof32(const s16* arg) { return (f32)*arg; }
+static inline void OSs16tof32(const s16* in, f32* out) { *out = __OSs16tof32(in); }
+
+static inline f32 __OSu8tof32(const u8* arg) { return (f32)*arg; }
+static inline void OSu8tof32(const u8* in, f32* out) { *out = __OSu8tof32(in); }
+
+static inline f32 __OSu16tof32(const u16* arg) { return (f32)*arg; }
+static inline void OSu16tof32(const u16* in, f32* out) { *out = __OSu16tof32(in); }
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSFont.h b/aurora-main/include/dolphin/os/OSFont.h
new file mode 100644
index 0000000..1fff41a
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSFont.h
@@ -0,0 +1,58 @@
+#ifndef _DOLPHIN_OSFONT_H_
+#define _DOLPHIN_OSFONT_H_
+
+#include <dolphin/types.h>
+#include <dolphin/os/OSUtf.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define OS_FONT_ENCODE_ANSI 0u
+#define OS_FONT_ENCODE_SJIS 1u
+#define OS_FONT_ENCODE_MAX  5u
+#define OS_FONT_SIZE_ANSI (288 + 131072)    // 9 sheets
+#define OS_FONT_SIZE_SJIS (3840 + 1179648)  // 1 sheet
+#define OS_FONT_ROM_SIZE_ANSI 0x03000
+#define OS_FONT_ROM_SIZE_SJIS 0x4D000
+
+typedef struct OSFontHeader {
+    u16 fontType;
+    u16 firstChar;
+    u16 lastChar;
+    u16 invalChar;
+    u16 ascent;
+    u16 descent;
+    u16 width;
+    u16 leading;
+    u16 cellWidth;
+    u16 cellHeight;
+    u32 sheetSize;
+    u16 sheetFormat;
+    u16 sheetColumn;
+    u16 sheetRow;
+    u16 sheetWidth;
+    u16 sheetHeight;
+    u16 widthTable;
+    u32 sheetImage;
+    u32 sheetFullSize;
+    u8 c0;
+    u8 c1;
+    u8 c2;
+    u8 c3;
+} OSFontHeader;
+
+u16 OSGetFontEncode(void);
+u16 OSSetFontEncode(u16 encode);
+BOOL OSInitFont(OSFontHeader* fontData);
+u32 OSLoadFont(OSFontHeader* fontData, void* tmp);
+char* OSGetFontTexture(const char* string, void** image, s32* x, s32* y, s32* width);
+char* OSGetFontWidth(const char* string, s32* width);
+char* OSGetFontTexel(const char* string, void* image, s32 pos, s32 stride, s32* width);
+int OSSetFontWidth(int fixed);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSIC.h b/aurora-main/include/dolphin/os/OSIC.h
new file mode 100644
index 0000000..3309d3a
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSIC.h
@@ -0,0 +1,20 @@
+#ifndef _DOLPHIN_OSIC_H_
+#define _DOLPHIN_OSIC_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void ICFlashInvalidate(void);
+void ICEnable(void);
+void ICDisable(void);
+void ICFreeze(void);
+void ICUnfreeze(void);
+void ICBlockInvalidate(void *addr);
+void ICSync(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSInterrupt.h b/aurora-main/include/dolphin/os/OSInterrupt.h
new file mode 100644
index 0000000..8fa27d2
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSInterrupt.h
@@ -0,0 +1,119 @@
+#ifndef _DOLPHIN_OSINTERRUPT_H_
+#define _DOLPHIN_OSINTERRUPT_H_
+
+#include <dolphin/types.h>
+#include <dolphin/os/OSException.h>
+#include <dolphin/os/OSTime.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef s16 __OSInterrupt;
+typedef u32  OSInterruptMask;
+
+#define __OS_INTERRUPT_MEM_0         0
+#define __OS_INTERRUPT_MEM_1         1
+#define __OS_INTERRUPT_MEM_2         2
+#define __OS_INTERRUPT_MEM_3         3
+#define __OS_INTERRUPT_MEM_ADDRESS   4
+#define __OS_INTERRUPT_DSP_AI        5
+#define __OS_INTERRUPT_DSP_ARAM      6
+#define __OS_INTERRUPT_DSP_DSP       7
+#define __OS_INTERRUPT_AI_AI         8
+#define __OS_INTERRUPT_EXI_0_EXI     9
+#define __OS_INTERRUPT_EXI_0_TC     10
+#define __OS_INTERRUPT_EXI_0_EXT    11
+#define __OS_INTERRUPT_EXI_1_EXI    12
+#define __OS_INTERRUPT_EXI_1_TC     13
+#define __OS_INTERRUPT_EXI_1_EXT    14
+#define __OS_INTERRUPT_EXI_2_EXI    15
+#define __OS_INTERRUPT_EXI_2_TC     16
+#define __OS_INTERRUPT_PI_CP        17
+#define __OS_INTERRUPT_PI_PE_TOKEN  18
+#define __OS_INTERRUPT_PI_PE_FINISH 19
+#define __OS_INTERRUPT_PI_SI        20
+#define __OS_INTERRUPT_PI_DI        21
+#define __OS_INTERRUPT_PI_RSW       22
+#define __OS_INTERRUPT_PI_ERROR     23
+#define __OS_INTERRUPT_PI_VI        24
+#define __OS_INTERRUPT_PI_DEBUG     25
+#define __OS_INTERRUPT_PI_HSP       26
+#define __OS_INTERRUPT_MAX          32
+
+#define OS_INTERRUPTMASK(interrupt) (0x80000000u >> (interrupt))
+
+#define OS_INTERRUPTMASK_MEM_0 OS_INTERRUPTMASK(__OS_INTERRUPT_MEM_0)
+#define OS_INTERRUPTMASK_MEM_1 OS_INTERRUPTMASK(__OS_INTERRUPT_MEM_1)
+#define OS_INTERRUPTMASK_MEM_2 OS_INTERRUPTMASK(__OS_INTERRUPT_MEM_2)
+#define OS_INTERRUPTMASK_MEM_3 OS_INTERRUPTMASK(__OS_INTERRUPT_MEM_3)
+#define OS_INTERRUPTMASK_MEM_ADDRESS OS_INTERRUPTMASK(__OS_INTERRUPT_MEM_ADDRESS)
+#define OS_INTERRUPTMASK_MEM_RESET                                                                 \
+    (OS_INTERRUPTMASK_MEM_0 | OS_INTERRUPTMASK_MEM_1 | OS_INTERRUPTMASK_MEM_2 |                    \
+     OS_INTERRUPTMASK_MEM_3)
+#define OS_INTERRUPTMASK_MEM                                                                       \
+  (OS_INTERRUPTMASK_MEM_0 | OS_INTERRUPTMASK_MEM_1 | OS_INTERRUPTMASK_MEM_2 |                      \
+   OS_INTERRUPTMASK_MEM_3 | OS_INTERRUPTMASK_MEM_ADDRESS)
+#define OS_INTERRUPTMASK_DSP_AI OS_INTERRUPTMASK(__OS_INTERRUPT_DSP_AI)
+#define OS_INTERRUPTMASK_DSP_ARAM OS_INTERRUPTMASK(__OS_INTERRUPT_DSP_ARAM)
+#define OS_INTERRUPTMASK_DSP_DSP OS_INTERRUPTMASK(__OS_INTERRUPT_DSP_DSP)
+#define OS_INTERRUPTMASK_DSP                                                                       \
+  (OS_INTERRUPTMASK_DSP_AI | OS_INTERRUPTMASK_DSP_ARAM | OS_INTERRUPTMASK_DSP_DSP)
+#define OS_INTERRUPTMASK_AI_AI OS_INTERRUPTMASK(__OS_INTERRUPT_AI_AI)
+#define OS_INTERRUPTMASK_AI (OS_INTERRUPTMASK_AI_AI)
+#define OS_INTERRUPTMASK_EXI_0_EXI OS_INTERRUPTMASK(__OS_INTERRUPT_EXI_0_EXI)
+#define OS_INTERRUPTMASK_EXI_0_TC OS_INTERRUPTMASK(__OS_INTERRUPT_EXI_0_TC)
+#define OS_INTERRUPTMASK_EXI_0_EXT OS_INTERRUPTMASK(__OS_INTERRUPT_EXI_0_EXT)
+#define OS_INTERRUPTMASK_EXI_0                                                                     \
+  (OS_INTERRUPTMASK_EXI_0_EXI | OS_INTERRUPTMASK_EXI_0_TC | OS_INTERRUPTMASK_EXI_0_EXT)
+#define OS_INTERRUPTMASK_EXI_1_EXI OS_INTERRUPTMASK(__OS_INTERRUPT_EXI_1_EXI)
+#define OS_INTERRUPTMASK_EXI_1_TC OS_INTERRUPTMASK(__OS_INTERRUPT_EXI_1_TC)
+#define OS_INTERRUPTMASK_EXI_1_EXT OS_INTERRUPTMASK(__OS_INTERRUPT_EXI_1_EXT)
+#define OS_INTERRUPTMASK_EXI_1                                                                     \
+  (OS_INTERRUPTMASK_EXI_1_EXI | OS_INTERRUPTMASK_EXI_1_TC | OS_INTERRUPTMASK_EXI_1_EXT)
+#define OS_INTERRUPTMASK_EXI_2_EXI OS_INTERRUPTMASK(__OS_INTERRUPT_EXI_2_EXI)
+#define OS_INTERRUPTMASK_EXI_2_TC OS_INTERRUPTMASK(__OS_INTERRUPT_EXI_2_TC)
+#define OS_INTERRUPTMASK_EXI_2 (OS_INTERRUPTMASK_EXI_2_EXI | OS_INTERRUPTMASK_EXI_2_TC)
+#define OS_INTERRUPTMASK_EXI                                                                       \
+  (OS_INTERRUPTMASK_EXI_0_EXI | OS_INTERRUPTMASK_EXI_0_TC | OS_INTERRUPTMASK_EXI_0_EXT |           \
+   OS_INTERRUPTMASK_EXI_1_EXI | OS_INTERRUPTMASK_EXI_1_TC | OS_INTERRUPTMASK_EXI_1_EXT |           \
+   OS_INTERRUPTMASK_EXI_2_EXI | OS_INTERRUPTMASK_EXI_2_TC)
+#define OS_INTERRUPTMASK_PI_PE_TOKEN OS_INTERRUPTMASK(__OS_INTERRUPT_PI_PE_TOKEN)
+#define OS_INTERRUPTMASK_PI_PE_FINISH OS_INTERRUPTMASK(__OS_INTERRUPT_PI_PE_FINISH)
+#define OS_INTERRUPTMASK_PI_PE (OS_INTERRUPTMASK_PI_PE_TOKEN | OS_INTERRUPTMASK_PI_PE_FINISH)
+#define OS_INTERRUPTMASK_PI_CP OS_INTERRUPTMASK(__OS_INTERRUPT_PI_CP)
+#define OS_INTERRUPTMASK_PI_SI OS_INTERRUPTMASK(__OS_INTERRUPT_PI_SI)
+#define OS_INTERRUPTMASK_PI_DI OS_INTERRUPTMASK(__OS_INTERRUPT_PI_DI)
+#define OS_INTERRUPTMASK_PI_RSW OS_INTERRUPTMASK(__OS_INTERRUPT_PI_RSW)
+#define OS_INTERRUPTMASK_PI_ERROR OS_INTERRUPTMASK(__OS_INTERRUPT_PI_ERROR)
+#define OS_INTERRUPTMASK_PI_VI OS_INTERRUPTMASK(__OS_INTERRUPT_PI_VI)
+#define OS_INTERRUPTMASK_PI_DEBUG OS_INTERRUPTMASK(__OS_INTERRUPT_PI_DEBUG)
+#define OS_INTERRUPTMASK_PI_HSP OS_INTERRUPTMASK(__OS_INTERRUPT_PI_HSP)
+#define OS_INTERRUPTMASK_PI                                                                        \
+  (OS_INTERRUPTMASK_PI_CP | OS_INTERRUPTMASK_PI_SI | OS_INTERRUPTMASK_PI_DI |                      \
+   OS_INTERRUPTMASK_PI_RSW | OS_INTERRUPTMASK_PI_ERROR | OS_INTERRUPTMASK_PI_VI |                  \
+   OS_INTERRUPTMASK_PI_PE_TOKEN | OS_INTERRUPTMASK_PI_PE_FINISH | OS_INTERRUPTMASK_PI_DEBUG |      \
+   OS_INTERRUPTMASK_PI_HSP)
+
+typedef void (*__OSInterruptHandler)(__OSInterrupt interrupt, OSContext* context);
+
+extern volatile __OSInterrupt __OSLastInterrupt;
+extern volatile u32 __OSLastInterruptSrr0;
+extern volatile OSTime __OSLastInterruptTime;
+
+__OSInterruptHandler __OSSetInterruptHandler(__OSInterrupt interrupt, __OSInterruptHandler handler);
+
+__OSInterruptHandler __OSGetInterruptHandler(__OSInterrupt interrupt);
+
+void __OSDispatchInterrupt(__OSException exception, OSContext* context);
+
+OSInterruptMask OSGetInterruptMask(void);
+OSInterruptMask OSSetInterruptMask(OSInterruptMask mask);
+OSInterruptMask __OSMaskInterrupts(OSInterruptMask mask);
+OSInterruptMask __OSUnmaskInterrupts(OSInterruptMask mask);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSL2.h b/aurora-main/include/dolphin/os/OSL2.h
new file mode 100644
index 0000000..01b4a62
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSL2.h
@@ -0,0 +1,20 @@
+#ifndef _DOLPHIN_OSL2_H_
+#define _DOLPHIN_OSL2_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void L2Enable(void);
+void L2Disable(void);
+void L2GlobalInvalidate(void);
+void L2SetDataOnly(BOOL dataOnly);
+void L2SetWriteThrough(BOOL writeThrough);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSLC.h b/aurora-main/include/dolphin/os/OSLC.h
new file mode 100644
index 0000000..af49708
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSLC.h
@@ -0,0 +1,19 @@
+#ifndef _DOLPHIN_OSLC_H_
+#define _DOLPHIN_OSLC_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void LCAllocOneTag(BOOL invalidate, void *tag);
+void LCAllocTags(BOOL invalidate, void *startTag, u32 numBlocks);
+void LCAlloc(void *addr, u32 nBytes);
+void LCAllocNoInvalidate(void *addr, u32 nBytes);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSMemory.h b/aurora-main/include/dolphin/os/OSMemory.h
new file mode 100644
index 0000000..a5debeb
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSMemory.h
@@ -0,0 +1,28 @@
+#ifndef _DOLPHIN_OSMEMORY_H_
+#define _DOLPHIN_OSMEMORY_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define OS_PROTECT_CHAN0 0
+#define OS_PROTECT_CHAN1 1
+#define OS_PROTECT_CHAN2 2
+#define OS_PROTECT_CHAN3 3
+
+#define OS_PROTECT_CONTROL_NONE 0x00
+#define OS_PROTECT_CONTROL_READ 0x01
+#define OS_PROTECT_CONTROL_WRITE 0x02
+#define OS_PROTECT_CONTROL_RDWR (OS_PROTECT_CONTROL_READ | OS_PROTECT_CONTROL_WRITE)
+
+void OSProtectRange(u32 chan, void* addr, u32 nBytes, u32 control);
+u32 OSGetPhysicalMemSize(void);
+u32 OSGetConsoleSimulatedMemSize(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSMessage.h b/aurora-main/include/dolphin/os/OSMessage.h
new file mode 100644
index 0000000..19743b8
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSMessage.h
@@ -0,0 +1,33 @@
+#ifndef _DOLPHIN_OSMESSAGE_H_
+#define _DOLPHIN_OSMESSAGE_H_
+
+#include <dolphin/os/OSThread.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void* OSMessage;
+
+#define OS_MESSAGE_NOBLOCK 0
+#define OS_MESSAGE_BLOCK 1
+
+typedef struct {
+  OSThreadQueue queueSend;
+  OSThreadQueue queueReceive;
+  OSMessage* msgArray;
+  s32 msgCount;
+  s32 firstIndex;
+  s32 usedCount;
+} OSMessageQueue;
+
+void OSInitMessageQueue(OSMessageQueue* mq, OSMessage* msgArray, s32 msgCount);
+BOOL OSSendMessage(OSMessageQueue* mq, OSMessage msg, s32 flags);
+BOOL OSReceiveMessage(OSMessageQueue* mq, OSMessage* msg, s32 flags);
+BOOL OSJamMessage(OSMessageQueue* mq, OSMessage msg, s32 flags);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_OSMESSAGE_H_
diff --git a/aurora-main/include/dolphin/os/OSModule.h b/aurora-main/include/dolphin/os/OSModule.h
new file mode 100644
index 0000000..6e66e9b
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSModule.h
@@ -0,0 +1,117 @@
+#ifndef _DOLPHIN_OSMODULE_H_
+#define _DOLPHIN_OSMODULE_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define OS_MODULE_VERSION 3
+typedef struct OSModuleHeader OSModuleHeader;
+
+typedef u32 OSModuleID;
+typedef struct OSModuleQueue OSModuleQueue;
+typedef struct OSModuleLink OSModuleLink;
+typedef struct OSModuleInfo OSModuleInfo;
+typedef struct OSSectionInfo OSSectionInfo;
+typedef struct OSImportInfo OSImportInfo;
+typedef struct OSRel OSRel;
+
+struct OSModuleQueue {
+    OSModuleInfo* head;
+    OSModuleInfo* tail;
+};
+
+struct OSModuleLink {
+    OSModuleInfo* next;
+    OSModuleInfo* prev;
+};
+
+struct OSModuleInfo {
+    OSModuleID id;         // unique identifier for the module
+    OSModuleLink link;     // doubly linked list of modules
+    u32 numSections;       // # of sections
+    u32 sectionInfoOffset; // offset to section info table
+    u32 nameOffset;        // offset to module name
+    u32 nameSize;          // size of module name
+    u32 version;           // version number
+};
+
+struct OSModuleHeader {
+    // CAUTION: info must be the 1st member
+    OSModuleInfo info;
+
+    // OS_MODULE_VERSION == 1
+    u32 bssSize; // total size of bss sections in bytes
+    u32 relOffset;
+    u32 impOffset;
+    u32 impSize;          // size in bytes
+    u8 prologSection;     // section # for prolog function
+    u8 epilogSection;     // section # for epilog function
+    u8 unresolvedSection; // section # for unresolved function
+    u8 bssSection;        // section # for bss section (set at run-time)
+    u32 prolog;           // prolog function offset
+    u32 epilog;           // epilog function offset
+    u32 unresolved;       // unresolved function offset
+
+    // OS_MODULE_VERSION == 2
+#if (2 <= OS_MODULE_VERSION)
+    u32 align;    // module alignment constraint
+    u32 bssAlign; // bss alignment constraint
+#endif
+
+    // OS_MODULE_VERSION == 3
+#if (3 <= OS_MODULE_VERSION)
+    u32 fixSize;
+#endif
+};
+
+#define OSGetSectionInfo(module) ((OSSectionInfo*)(((OSModuleInfo*)(module))->sectionInfoOffset))
+
+struct OSSectionInfo {
+    u32 offset;
+    u32 size;
+};
+
+// OSSectionInfo.offset bit
+#define OS_SECTIONINFO_EXEC 0x1
+#define OS_SECTIONINFO_OFFSET(offset) ((offset) & ~0x1)
+
+struct OSImportInfo {
+    OSModuleID id; // external module id
+    u32 offset;    // offset to OSRel instructions
+};
+
+struct OSRel {
+    u16 offset; // byte offset from the previous entry
+    u8 type;
+    u8 section;
+    u32 addend;
+};
+
+#define R_DOLPHIN_NOP 201     //  C9h current offset += OSRel.offset
+#define R_DOLPHIN_SECTION 202 //  CAh current section = OSRel.section
+#define R_DOLPHIN_END 203     //  CBh
+#define R_DOLPHIN_MRKREF 204  //  CCh
+
+void OSSetStringTable(void* stringTable);
+BOOL OSLink(OSModuleInfo* newModule, void* bss);
+
+#if (3 <= OS_MODULE_VERSION)
+BOOL OSLinkFixed(OSModuleInfo* newModule, void* bss);
+#endif
+
+BOOL OSUnlink(OSModuleInfo* oldModule);
+
+OSModuleInfo* OSSearchModule(void* ptr, u32* section, u32* offset);
+
+// debugger notification
+void OSNotifyLink(OSModuleInfo* module);
+void OSNotifyUnlink(OSModuleInfo* module);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSMutex.h b/aurora-main/include/dolphin/os/OSMutex.h
new file mode 100644
index 0000000..ef5565e
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSMutex.h
@@ -0,0 +1,33 @@
+#ifndef _DOLPHIN_OSMUTEX_H_
+#define _DOLPHIN_OSMUTEX_H_
+
+#include <dolphin/os/OSThread.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct OSMutex {
+    /* 0x00 */ OSThreadQueue queue;
+    /* 0x08 */ OSThread* thread;
+    /* 0x0C */ s32 count;
+    /* 0x10 */ OSMutexLink link;
+};
+
+typedef struct OSCond {
+    OSThreadQueue queue;
+} OSCond;
+
+void OSInitMutex(OSMutex* mutex);
+void OSLockMutex(OSMutex* mutex);
+void OSUnlockMutex(OSMutex* mutex);
+BOOL OSTryLockMutex(OSMutex* mutex);
+void OSInitCond(OSCond* cond);
+void OSWaitCond(OSCond* cond, OSMutex* mutex);
+void OSSignalCond(OSCond* cond);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSReboot.h b/aurora-main/include/dolphin/os/OSReboot.h
new file mode 100644
index 0000000..6509534
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSReboot.h
@@ -0,0 +1,19 @@
+#ifndef _DOLPHIN_OSREBOOT_H_
+#define _DOLPHIN_OSREBOOT_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void OSSetSaveRegion(void* start, void* end);
+void OSGetSaveRegion(void** start, void** end);
+void OSGetSavedRegion(void** start, void** end);
+void __OSReboot(u32 resetCode, u32 bootDol);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSReset.h b/aurora-main/include/dolphin/os/OSReset.h
new file mode 100644
index 0000000..8c6b27d
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSReset.h
@@ -0,0 +1,44 @@
+#ifndef _DOLPHIN_OSRESET_H_
+#define _DOLPHIN_OSRESET_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define OS_RESET_RESTART 0
+#define OS_RESET_HOTRESET 1
+#define OS_RESET_SHUTDOWN 2
+
+typedef struct OSResetFunctionInfo OSResetFunctionInfo;
+typedef struct OSResetFunctionQueue {
+  OSResetFunctionInfo* head;
+  OSResetFunctionInfo* tail;
+} OSResetFunctionQueue;
+
+typedef BOOL (*OSResetFunction)(BOOL);
+
+struct OSResetFunctionInfo {
+  OSResetFunction func;
+  u32 priority;
+  OSResetFunctionInfo* next;
+  OSResetFunctionInfo* prev;
+};
+
+#define OS_RESET_RESTART 0
+#define OS_RESET_HOTRESET 1
+#define OS_RESET_SHUTDOWN 2
+#define OS_RESETCODE_RESTART 0x80000000
+
+void OSRegisterResetFunction(OSResetFunctionInfo* info);
+void OSUnregisterResetFunction(OSResetFunctionInfo* info);
+void OSResetSystem(int reset, u32 resetCode, BOOL forceMenu);
+u32 OSGetResetCode();
+u32 OSSetBootDol(u32 dolOffset);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSResetSW.h b/aurora-main/include/dolphin/os/OSResetSW.h
new file mode 100644
index 0000000..3c630b8
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSResetSW.h
@@ -0,0 +1,20 @@
+#ifndef _DOLPHIN_OSRESETSW_H_
+#define _DOLPHIN_OSRESETSW_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*OSResetCallback)(void);
+
+OSResetCallback OSSetResetCallback(OSResetCallback callback);
+BOOL OSGetResetSwitchState(void);
+BOOL OSGetResetButtonState(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSRtc.h b/aurora-main/include/dolphin/os/OSRtc.h
new file mode 100644
index 0000000..583043f
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSRtc.h
@@ -0,0 +1,84 @@
+#ifndef _DOLPHIN_OSRTC_H_
+#define _DOLPHIN_OSRTC_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// make the assert happy
+#define OS_SOUND_MODE_MONO 0
+#define OS_SOUND_MODE_STEREO 1
+
+// make the asserts happy
+#define OS_VIDEO_MODE_NTSC 0
+#define OS_VIDEO_MODE_MPAL 2
+
+#define OS_PROGRESSIVE_MODE_OFF 0
+#define OS_PROGRESSIVE_MODE_ON  1
+
+#define OS_EURGB60_OFF 0
+#define OS_EURGB60_ON  1
+
+#define OS_LANGUAGE_ENGLISH 0
+#define OS_LANGUAGE_GERMAN  1
+#define OS_LANGUAGE_FRENCH  2
+#define OS_LANGUAGE_SPANISH 3
+#define OS_LANGUAGE_ITALIAN 4
+#define OS_LANGUAGE_DUTCH   5
+
+typedef struct OSSram {
+    u16 checkSum;
+    u16 checkSumInv;
+    u32 ead0;
+    u32 ead1;
+    u32 counterBias;
+    s8 displayOffsetH;
+    u8 ntd;
+    u8 language;
+    u8 flags;
+} OSSram;
+
+typedef struct OSSramEx {
+    u8 flashID[2][12];
+    u32 wirelessKeyboardID;
+    u16 wirelessPadID[4];
+    u8 dvdErrorCode;
+    u8 _padding0;
+    u8 flashIDCheckSum[2];
+    u16 gbs;
+    u8 _padding1[2];
+} OSSramEx;
+
+#define SRAM_SIZE (sizeof(OSSram) + sizeof(OSSramEx))
+
+typedef struct SramControl {
+    u8 sram[SRAM_SIZE];  // dummy for OSSram + OSSramEx
+    u32 offset;
+    BOOL enabled;
+    BOOL locked;
+    int sync;
+    void (*callback)();
+} SramControl;
+
+u32 OSGetSoundMode(void);
+void OSSetSoundMode(u32 mode);
+u32 OSGetVideoMode(void);
+void OSSetVideoMode(u32 mode);
+u8 OSGetLanguage(void);
+void OSSetLanguage(u8 language);
+u16 OSGetGbsMode(void);
+void OSSetGbsMode(u16 mode);
+u32 OSGetProgressiveMode(void);
+void OSSetProgressiveMode(u32 on);
+u32 OSGetEuRgb60Mode(void);
+void OSSetEuRgb60Mode(u32 on);
+u16 OSGetWirelessID(s32 chan);
+void OSSetWirelessID(s32 chan, u16 id);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_OSRTC_H_
diff --git a/aurora-main/include/dolphin/os/OSSemaphore.h b/aurora-main/include/dolphin/os/OSSemaphore.h
new file mode 100644
index 0000000..aac2381
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSSemaphore.h
@@ -0,0 +1,25 @@
+#ifndef _DOLPHIN_OSSEMAPHORE_H_
+#define _DOLPHIN_OSSEMAPHORE_H_
+
+#include <dolphin/os/OSThread.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct OSSemaphore {
+    s32 count;
+    OSThreadQueue queue;
+} OSSemaphore;
+
+void OSInitSemaphore(OSSemaphore* sem, s32 count);
+s32 OSWaitSemaphore(OSSemaphore* sem);
+s32 OSTryWaitSemaphore(OSSemaphore* sem);
+s32 OSSignalSemaphore(OSSemaphore* sem);
+s32 OSGetSemaphoreCount(OSSemaphore* sem);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_OSSEMAPHORE_H_
diff --git a/aurora-main/include/dolphin/os/OSSerial.h b/aurora-main/include/dolphin/os/OSSerial.h
new file mode 100644
index 0000000..7c38395
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSSerial.h
@@ -0,0 +1,6 @@
+#ifndef _DOLPHIN_OSSERIAL_H
+#define _DOLPHIN_OSSERIAL_H
+
+#include <dolphin/hw_regs.h>
+
+#endif // _DOLPHIN_OSSERIAL_H
diff --git a/aurora-main/include/dolphin/os/OSThread.h b/aurora-main/include/dolphin/os/OSThread.h
new file mode 100644
index 0000000..2053ff5
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSThread.h
@@ -0,0 +1,113 @@
+#ifndef _DOLPHIN_OSTHREAD_H_
+#define _DOLPHIN_OSTHREAD_H_
+
+#include <dolphin/os/OSContext.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef s32 OSPriority;
+
+typedef struct OSThread OSThread;
+typedef struct OSMutex OSMutex;
+typedef struct OSThreadQueue OSThreadQueue;
+typedef struct OSMutexQueue OSMutexQueue;
+typedef struct OSThreadLink OSThreadLink;
+typedef struct OSMutexLink OSMutexLink;
+
+struct OSThreadQueue {
+  OSThread* head;
+  OSThread* tail;
+};
+
+struct OSThreadLink {
+  OSThread* next;
+  OSThread* prev;
+};
+
+struct OSMutexQueue {
+  OSMutex* head;
+  OSMutex* tail;
+};
+
+struct OSMutexLink {
+  OSMutex* next;
+  OSMutex* prev;
+};
+
+struct OSThread {
+  /* 0x000 */ OSContext context;
+  /* 0x2C8 */ u16 state;
+  /* 0x2CA */ u16 attr;
+  /* 0x2CC */ s32 suspend;
+  /* 0x2D0 */ OSPriority priority;
+  /* 0x2D4 */ OSPriority base;
+  /* 0x2D8 */ void* val;
+  /* 0x2DC */ OSThreadQueue* queue;
+  /* 0x2E0 */ OSThreadLink link;
+  /* 0x2E8 */ OSThreadQueue queueJoin;
+  /* 0x2F0 */ OSMutex* mutex;
+  /* 0x2F4 */ OSMutexQueue queueMutex;
+  /* 0x2FC */ OSThreadLink linkActive;
+  /* 0x304 */ u8* stackBase;
+  /* 0x308 */ u8* stackEnd;
+  /* 0x30C */ s32 error;
+  /* 0x310 */ void* specific[2];
+};
+
+enum OS_THREAD_STATE {
+  OS_THREAD_STATE_READY = 1,
+  OS_THREAD_STATE_RUNNING = 2,
+  OS_THREAD_STATE_WAITING = 4,
+  OS_THREAD_STATE_MORIBUND = 8,
+};
+
+#define OS_PRIORITY_MIN 0  // highest
+#define OS_PRIORITY_MAX 31 // lowest
+#define OS_PRIORITY_IDLE OS_PRIORITY_MAX
+
+#define OS_THREAD_SPECIFIC_MAX 2
+
+#define OS_THREAD_ATTR_DETACH 0x0001u
+
+#define OS_THREAD_STACK_MAGIC 0xDEADBABE
+
+typedef void (*OSSwitchThreadCallback)(OSThread*, OSThread*);
+typedef void (*OSIdleFunction)(void*);
+
+void OSInitThreadQueue(OSThreadQueue* queue);
+void OSSleepThread(OSThreadQueue* queue);
+void OSWakeupThread(OSThreadQueue* queue);
+s32 OSSuspendThread(OSThread* thread);
+s32 OSResumeThread(OSThread* thread);
+OSThread* OSGetCurrentThread(void);
+s32 OSEnableScheduler(void);
+s32 OSDisableScheduler(void);
+void OSCancelThread(OSThread* thread);
+void OSClearStack(u8 val);
+BOOL OSIsThreadSuspended(OSThread* thread);
+BOOL OSIsThreadTerminated(OSThread* thread);
+void OSYieldThread(void);
+BOOL OSCreateThread(OSThread* thread, void* (*func)(void*), void* param, void* stack, u32 stackSize,
+                    OSPriority priority, u16 attr);
+void OSExitThread(void* val);
+BOOL OSJoinThread(OSThread* thread, void** val);
+void OSDetachThread(OSThread* thread);
+BOOL OSSetThreadPriority(OSThread* thread, OSPriority priority);
+s32 OSGetThreadPriority(OSThread* thread);
+OSThread* OSSetIdleFunction(OSIdleFunction idleFunction, void* param, void* stack, u32 stackSize);
+OSThread* OSGetIdleFunction(void);
+s32 OSCheckActiveThreads(void);
+void OSSetThreadSpecific(s32 index, void* ptr);
+void* OSGetThreadSpecific(s32 index);
+
+OSSwitchThreadCallback OSSetSwitchThreadCallback(OSSwitchThreadCallback callback);
+
+#define IsSuspended(suspend) (suspend > 0)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/os/OSTime.h b/aurora-main/include/dolphin/os/OSTime.h
new file mode 100644
index 0000000..2dc1cf2
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSTime.h
@@ -0,0 +1,49 @@
+#ifndef _DOLPHIN_OSTIME_H_
+#define _DOLPHIN_OSTIME_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef s64 OSTime;
+typedef u32 OSTick;
+
+#define OSDiffTick(tick1, tick0) ((s32)(tick1) - (s32)(tick0))
+
+// Time base frequency = 1/4 bus clock
+#define OS_TIME_SPEED (OS_BUS_CLOCK / 4)
+
+// OS time -> Real time
+#define OS_TICKS_TO_SEC(x) ((x) / (OS_TIME_SPEED))
+#define OS_TICKS_TO_MSEC(x) ((x) / (OS_TIME_SPEED / 1000))
+#define OS_TICKS_TO_USEC(x) (((x) * 8) / (OS_TIME_SPEED / 125000))
+#define OS_TICKS_TO_NSEC(x) (((x) * 8000) / (OS_TIME_SPEED / 125000))
+
+// Real time -> OS time
+#define OS_SEC_TO_TICKS(x) ((x) * (OS_TIME_SPEED))
+#define OS_MSEC_TO_TICKS(x) ((x) * (OS_TIME_SPEED / 1000))
+#define OS_USEC_TO_TICKS(x) ((x) * (OS_TIME_SPEED / 125000) / 8)
+#define OS_NSEC_TO_TICKS(x) ((x) * (OS_TIME_SPEED / 125000) / 8000)
+
+#define USEC_MAX 1000
+#define MSEC_MAX 1000
+#define MONTH_MAX 12
+#define WEEK_DAY_MAX 7
+#define YEAR_DAY_MAX 365
+
+#define SECS_IN_MIN 60
+#define SECS_IN_HOUR (SECS_IN_MIN * 60)
+#define SECS_IN_DAY (SECS_IN_HOUR * 24)
+#define SECS_IN_YEAR (SECS_IN_DAY * 365)
+
+#define BIAS 0xB2575
+
+#define __OSSystemTime (OSTime*)0x800030D8
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_OSTIME_H_
diff --git a/aurora-main/include/dolphin/os/OSTimer.h b/aurora-main/include/dolphin/os/OSTimer.h
new file mode 100644
index 0000000..490cccb
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSTimer.h
@@ -0,0 +1,21 @@
+#ifndef _DOLPHIN_OSTIMER_H_
+#define _DOLPHIN_OSTIMER_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*OSTimerCallback)(void);
+
+OSTimerCallback OSSetTimerCallback(OSTimerCallback callback);
+void OSInitTimer(u32 time, u32 mode);
+void OSStartTimer(void);
+void OSStopTimer(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_OSTIMER_H_
diff --git a/aurora-main/include/dolphin/os/OSUtf.h b/aurora-main/include/dolphin/os/OSUtf.h
new file mode 100644
index 0000000..2f721d5
--- /dev/null
+++ b/aurora-main/include/dolphin/os/OSUtf.h
@@ -0,0 +1,23 @@
+#ifndef _DOLPHIN_OSUTF_H_
+#define _DOLPHIN_OSUTF_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+char* OSUTF8to32(const char* utf8, u32* utf32);
+char* OSUTF32to8(u32 utf32, char* utf8);
+u16* OSUTF16to32(const u16* utf16, u32* utf32);
+u16* OSUTF32to16(u32 utf32, u16* utf16);
+u8 OSUTF32toANSI(u32 utf32);
+u32 OSANSItoUTF32(u8 ansi);
+u16 OSUTF32toSJIS(u32 utf32);
+u32 OSSJIStoUTF32(u16 sjis);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_OSUTF_H_
diff --git a/aurora-main/include/dolphin/pad.h b/aurora-main/include/dolphin/pad.h
new file mode 100644
index 0000000..6f821c3
--- /dev/null
+++ b/aurora-main/include/dolphin/pad.h
@@ -0,0 +1,300 @@
+#ifndef DOLPHIN_PAD_H
+#define DOLPHIN_PAD_H
+
+#include <dolphin/types.h>
+
+#define PAD_SPEC_0 0
+#define PAD_SPEC_1 1
+#define PAD_SPEC_2 2
+#define PAD_SPEC_3 3
+#define PAD_SPEC_4 4
+#define PAD_SPEC_5 5
+
+#define PAD_CHAN0 0
+#define PAD_CHAN1 1
+#define PAD_CHAN2 2
+#define PAD_CHAN3 3
+#define PAD_CHANMAX 4
+
+#define PAD_MOTOR_STOP 0
+#define PAD_MOTOR_RUMBLE 1
+#define PAD_MOTOR_STOP_HARD 2
+
+#define PAD_ERR_NONE 0
+#define PAD_ERR_NO_CONTROLLER -1
+#define PAD_ERR_NOT_READY -2
+#define PAD_ERR_TRANSFER -3
+
+#define PAD_MAX_CONTROLLERS 4
+
+#define PAD_BUTTON_LEFT 0x0001
+#define PAD_BUTTON_RIGHT 0x0002
+#define PAD_BUTTON_DOWN 0x0004
+#define PAD_BUTTON_UP 0x0008
+#define PAD_TRIGGER_Z 0x0010
+#define PAD_TRIGGER_R 0x0020
+#define PAD_TRIGGER_L 0x0040
+#define PAD_BUTTON_A 0x0100
+#define PAD_BUTTON_B 0x0200
+#define PAD_BUTTON_X 0x0400
+#define PAD_BUTTON_Y 0x0800
+#define PAD_BUTTON_MENU 0x1000
+#define PAD_BUTTON_START 0x1000
+#ifdef TARGET_PC
+#define PAD_BUTTON_BACK 0x0002000
+#define PAD_BUTTON_GUIDE 0x0004000
+#define PAD_BUTTON_MISC1 0x0008000
+#define PAD_BUTTON_MISC2 0x0010000
+#define PAD_BUTTON_MISC3 0x0020000
+#define PAD_BUTTON_MISC4 0x0040000
+#define PAD_BUTTON_MISC5 0x0080000
+#define PAD_BUTTON_MISC6 0x0100000
+#define PAD_BUTTON_RIGHT_PADDLE1 0x0200000
+#define PAD_BUTTON_LEFT_PADDLE1 0x0400000
+#define PAD_BUTTON_RIGHT_PADDLE2 0x0800000
+#define PAD_BUTTON_LEFT_PADDLE2 0x1000000
+#define PAD_BUTTON_RIGHT_STICK 0x2000000
+#define PAD_BUTTON_LEFT_STICK 0x4000000
+#define PAD_BUTTON_TOUCHPAD 0x8000000
+#define PAD_EXT_BUTTON_COUNT 15
+#endif
+
+#define PAD_BUTTON_COUNT 12
+
+// added by Aurora, not present in original SDK
+#define PAD_AXIS_LEFT_X_POS 0
+#define PAD_AXIS_LEFT_X_NEG 1
+#define PAD_AXIS_LEFT_Y_POS 2
+#define PAD_AXIS_LEFT_Y_NEG 3
+#define PAD_AXIS_RIGHT_X_POS 4
+#define PAD_AXIS_RIGHT_X_NEG 5
+#define PAD_AXIS_RIGHT_Y_POS 6
+#define PAD_AXIS_RIGHT_Y_NEG 7
+#define PAD_AXIS_TRIGGER_L 8
+#define PAD_AXIS_TRIGGER_R 9
+
+#define PAD_AXIS_COUNT 10
+
+#define PAD_CHAN0_BIT 0x80000000
+#define PAD_CHAN1_BIT 0x40000000
+#define PAD_CHAN2_BIT 0x20000000
+#define PAD_CHAN3_BIT 0x10000000
+
+#define PADButtonDown(buttonLast, button) (((buttonLast) ^ (button)) & (button))
+#define PADButtonUp(buttonLast, button) (((buttonLast) ^ (button)) & (buttonLast))
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define PAD_NATIVE_BUTTON_INVALID 0xFFFFFFFF
+
+typedef struct PADStatus {
+  u16 button;
+  s8 stickX;
+  s8 stickY;
+  s8 substickX;
+  s8 substickY;
+  union {
+    u8 triggerLeft;
+    u8 triggerL;
+  };
+  union {
+    u8 triggerRight;
+    u8 triggerR;
+  };
+  u8 analogA;
+  u8 analogB;
+  s8 err;
+#ifdef TARGET_PC
+  u32 extButton;
+#endif
+} PADStatus;
+
+typedef enum PADAxisSign {
+  AXIS_SIGN_NEGATIVE = -1,
+  AXIS_SIGN_POSITIVE = 1,
+} PADAxisSign;
+
+typedef struct PADSignedNativeAxis {
+  int32_t nativeAxis;
+  PADAxisSign sign;
+} PADSignedNativeAxis;
+
+struct SDL_Gamepad;
+
+BOOL PADInit();
+u32 PADRead(PADStatus* status);
+BOOL PADReset(u32 mask);
+BOOL PADRecalibrate(u32 mask);
+void PADClamp(PADStatus* status);
+void PADClampCircle(PADStatus* status);
+void PADControlMotor(u32 chan, u32 cmd);
+void PADSetSpec(u32 spec);
+void PADControlAllMotors(const u32* cmdArr);
+void PADSetAnalogMode(u32 mode);
+
+#ifdef TARGET_PC
+#define PAD_KEY_INVALID (-1)
+#define PAD_KEY_MOUSE_LEFT (-2)
+#define PAD_KEY_MOUSE_MIDDLE (-3)
+#define PAD_KEY_MOUSE_RIGHT (-4)
+#define PAD_KEY_MOUSE_X1 (-5)
+#define PAD_KEY_MOUSE_X2 (-6)
+typedef u16 PADButton;
+typedef u32 PADExtButton;
+typedef u16 PADAxis;
+
+typedef struct PADKeyButtonBinding {
+  s32 scancode;
+  PADButton padButton;
+} PADKeyButtonBinding;
+
+typedef struct PADKeyAxisBinding {
+  s32 scancode;
+  PADAxis padAxis;
+  s16 influence; // normalized percentage between 0 and 1
+} PADKeyAxisBinding;
+
+/* New API to facilitate controller interactions */
+typedef struct PADDeadZones {
+  bool emulateTriggers;
+  bool useDeadzones;
+  u16 stickDeadZone;
+  u16 substickDeadZone;
+  u16 leftTriggerActivationZone;
+  u16 rightTriggerActivationZone;
+} PADDeadZones;
+
+typedef struct PADButtonMapping {
+  u32 nativeButton;
+  PADButton padButton;
+} PADButtonMapping;
+
+typedef struct PADAxisMapping {
+  PADSignedNativeAxis nativeAxis;
+  s32 nativeButton;
+  PADAxis padAxis;
+} PADAxisMapping;
+
+typedef struct PADDefaultMapping {
+  PADButtonMapping buttons[PAD_BUTTON_COUNT];
+  PADAxisMapping axes[PAD_AXIS_COUNT];
+} PADDefaultMapping;
+
+/* Returns the total number of controllers */
+u32 PADCount();
+/* Returns the controller name for the given index into the controller map */
+const char* PADGetNameForControllerIndex(u32 idx);
+void PADSetPortForIndex(u32 index, u32 port);
+s32 PADGetIndexForPort(u32 port);
+void PADGetVidPid(u32 port, u32* vid, u32* pid);
+void PADClearPort(u32 port);
+const char* PADGetName(u32 port);
+void PADSetButtonMapping(u32 port, PADButtonMapping mapping);
+void PADSetAllButtonMappings(u32 port, PADButtonMapping buttons[PAD_BUTTON_COUNT]);
+PADButtonMapping* PADGetButtonMappings(u32 port, u32* buttonCount);
+void PADSetAltButtonMapping(u32 port, PADButtonMapping mapping);
+PADButtonMapping* PADGetAltButtonMappings(u32 port, u32* buttonCount);
+void PADSetAxisMapping(u32 port, PADAxisMapping mapping);
+void PADSetAllAxisMappings(u32 port, PADAxisMapping axes[PAD_AXIS_COUNT]);
+PADAxisMapping* PADGetAxisMappings(u32 port, u32* axisCount);
+void PADSerializeMappings();
+
+BOOL PADSetKeyButtonBinding(u32 port, PADKeyButtonBinding binding);
+BOOL PADSetKeyButtonBindings(u32 port, PADKeyButtonBinding bindings[PAD_BUTTON_COUNT]);
+PADKeyButtonBinding* PADGetKeyButtonBindings(u32 port, u32* buttonCount);
+BOOL PADSetKeyAxisBinding(u32 port, PADKeyAxisBinding binding);
+BOOL PADSetKeyAxisBindings(u32 port, PADKeyAxisBinding bindings[PAD_BUTTON_COUNT]);
+PADKeyAxisBinding* PADGetKeyAxisBindings(u32 port, u32* axisCount);
+void PADClearKeyBindings(u32 port);
+void PADSetKeyboardActive(u32 port, BOOL active);
+
+PADDeadZones* PADGetDeadZones(u32 port);
+const char* PADGetButtonName(PADButton);
+const char* PADGetNativeButtonName(u32 button);
+const char* PADGetAxisName(PADAxis);
+const char* PADGetAxisDirectionLabel(PADAxis);
+const char* PADGetNativeAxisName(PADSignedNativeAxis axis);
+
+BOOL PADIsGCAdapter(u32 port);
+
+/**
+ * Returns the SDL gamepad for the index into the controller map.
+ */
+struct SDL_Gamepad* PADGetSDLGamepadForIndex(u32 index);
+/* Returns the first native button which is currently pressed */
+s32 PADGetNativeButtonPressed(u32 port);
+/* Returns the first native axis which is currently pulled halfway or more */
+PADSignedNativeAxis PADGetNativeAxisPulled(u32 port);
+void PADRestoreDefaultMapping(u32 port);
+void PADBlockInput(bool block);
+
+/**
+ * Set the default controller mapping used.
+ *
+ * Must be called before PADInit.
+ */
+
+typedef enum {
+  PAD_TYPE_UNKNOWN = 0,
+  PAD_TYPE_STANDARD,
+  PAD_TYPE_XBOX360,
+  PAD_TYPE_XBOXONE,
+  PAD_TYPE_PS3,
+  PAD_TYPE_PS4,
+  PAD_TYPE_PS5,
+  PAD_TYPE_SWITCH_PROCON,
+  PAD_TYPE_JOYCON_LEFT,
+  PAD_TYPE_JOYCON_RIGHT,
+  PAD_TYPE_JOYCON_PAIR,
+  PAD_TYPE_GAMECUBE,
+  PAD_TYPE_NSO_GAMECUBE,
+} PADControllerType;
+
+void PADSetDefaultMapping(const PADDefaultMapping* mapping, PADControllerType type);
+
+BOOL PADSetColor(u32 port, u8 red, u8 green, u8 blue);
+BOOL PADGetColor(u32 port, u8* red, u8* green, u8* blue);
+
+typedef enum {
+  PAD_SENSOR_INVALID = -1,
+  PAD_SENSOR_UNKNOWN,
+  PAD_SENSOR_ACCEL,
+  PAD_SENSOR_GYRO,
+  PAD_SENSOR_ACCEL_LEFT,
+  PAD_SENSOR_GYRO_LEFT,
+  PAD_SENSOR_ACCEL_RIGHT,
+  PAD_SENSOR_GYRO_RIGHT,
+} PADSensorType;
+BOOL PADSetSensorEnabled(u32 port, PADSensorType sensor, BOOL enabled);
+
+BOOL PADHasSensor(u32 port, PADSensorType sensor);
+
+BOOL PADGetSensorData(u32 port, PADSensorType sensor, f32* data, int nValues);
+
+BOOL PADSetRumbleIntensity(u32 port, u16 low, u16 high);
+BOOL PADGetRumbleIntensity(u32 port, u16* low, u16* high);
+BOOL PADSupportsRumbleIntensity(u32 port);
+
+typedef enum PADBatteryState {
+  PAD_BATTERYSTATE_ERROR = -1,
+  PAD_BATTERYSTATE_UNKNOWN,
+  PAD_BATTERYSTATE_ON_BATTERY,
+  PAD_BATTERYSTATE_NO_BATTERY,
+  PAD_BATTERYSTATE_CHARGING,
+  PAD_BATTERYSTATE_CHARGED,
+} PADBatteryState;
+
+PADBatteryState PADGetBatteryState(u32 port, f32* perc);
+
+PADControllerType PADGetControllerType(u32 port);
+PADControllerType PADGetControllerTypeForIndex(u32 index);
+
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/perf.h b/aurora-main/include/dolphin/perf.h
new file mode 100644
index 0000000..71471a5
--- /dev/null
+++ b/aurora-main/include/dolphin/perf.h
@@ -0,0 +1,99 @@
+#ifndef _DOLPHIN_PERF_H_
+#define _DOLPHIN_PERF_H_
+
+#include <dolphin/gx.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef u8 PERFId;
+
+typedef enum  {
+    PERF_CPU_EVENT,
+    PERF_CPU_GP_EVENT,
+    PERF_GP_EVENT,
+} PerfType;
+
+typedef struct PerfSample {
+    /* 0x00 */ u8 id;
+    /* 0x04 */ u32 cpuTimeStampStart;
+    /* 0x08 */ u32 cpuTimeStampEnd;
+    /* 0x0C */ u32 gpTimeStampStart;
+    /* 0x10 */ u32 gpTimeStampEnd;
+    /* 0x14 */ int interrupted;
+    /* 0x18 */ u32 origcpuStart;
+    /* 0x1C */ u32 origgpStart;
+    /* 0x20 */ u32 cacheMisses[4];
+    /* 0x30 */ u32 instructions[4];
+    /* 0x40 */ u32 cpReq[2];
+    /* 0x48 */ u32 tcReq[2];
+    /* 0x50 */ u32 cpuRdReq[2];
+    /* 0x58 */ u32 cpuWrReq[2];
+    /* 0x60 */ u32 dspReq[2];
+    /* 0x68 */ u32 ioReq[2];
+    /* 0x70 */ u32 viReq[2];
+    /* 0x78 */ u32 peReq[2];
+    /* 0x80 */ u32 rfReq[2];
+    /* 0x88 */ u32 fiReq[2];
+    /* 0x90 */ u32 xfWaitIn[2];
+    /* 0x98 */ u32 xfWaitOut[2];
+    /* 0xA0 */ u32 rasBusy[2];
+    /* 0xA8 */ u32 rasClocks[2];
+} PerfSample;
+
+typedef struct {
+    PerfSample* samples;
+    s32 lastSample;
+    u32 end;
+    u32 cachemisscycles;
+} Frame;
+
+typedef struct {
+    char* name;
+    PerfType type; 
+    s32 currSample;
+    GXColor color;
+} PerfEvent;
+
+typedef void* (*PERFAllocator)(u32 size);
+typedef void (*PERFDeallocator)(void* block);
+typedef void (*PERFDrawCallback)(void);
+
+extern void (*GameDrawInit)();
+
+u32 PERFInit(u32 numSamples, u32 numFramesHistory, u32 numTypes, PERFAllocator allocator, PERFDeallocator deallocator, PERFDrawCallback initDraw);
+void PERFEventStart(PERFId id);
+void PERFEventEnd(PERFId id);
+void PERFSetEvent(PERFId id, char* name, PerfType type);
+void PERFStartFrame(void);
+void PERFEndFrame(void);
+void PERFStartAutoSampling(f32 msInterval);
+void PERFStopAutoSampling(void);
+
+void PERFPreDraw(void);
+void PERFDumpScreen(void);
+void PERFPostDraw(void);
+void PERFSetDrawBWBarKey(BOOL tf);
+void PERFSetDrawBWBar(BOOL tf);
+void PERFSetDrawCPUBar(BOOL tf);
+void PERFSetDrawXFBars(BOOL tf);
+void PERFSetDrawRASBar(BOOL tf);
+void PERFToggleDrawBWBarKey(void);
+void PERFToggleDrawBWBar(void);
+void PERFToggleDrawCPUBar(void);
+void PERFToggleDrawXFBars(void);
+void PERFToggleDrawRASBar(void);
+void PERFShutDown(void);
+void PERFSetDrawFrames(u32 frames);
+
+extern Frame* PERFFrames;
+extern u32 PERFCurrFrame;
+extern PerfEvent* PERFEvents;
+extern u32 PERFNumEvents;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/ppc_math.h b/aurora-main/include/dolphin/ppc_math.h
new file mode 100644
index 0000000..c8f4cb5
--- /dev/null
+++ b/aurora-main/include/dolphin/ppc_math.h
@@ -0,0 +1,136 @@
+#ifndef DOLPHIN_PPC_MATH_H
+#define DOLPHIN_PPC_MATH_H
+
+#include <math.h>
+#include <stdint.h>
+
+// frsqrte matching courtesy of Geotale, with reference to https://achurch.org/cpu-tests/ppc750cl.s
+
+struct BaseAndDec32 {
+    uint32_t base;
+    int32_t dec;
+};
+
+struct BaseAndDec64 {
+    uint64_t base;
+    int64_t dec;
+};
+
+union c32 {
+    uint32_t u;
+    float f;
+};
+
+union c64 {
+    uint64_t u;
+    double f;
+};
+
+#define EXPONENT_SHIFT_F64 ((uint64_t)52)
+#define MANTISSA_MASK_F64  ((uint64_t)0x000fffffffffffffULL)
+#define EXPONENT_MASK_F64  ((uint64_t)0x7ff0000000000000ULL)
+#define SIGN_MASK_F64      ((uint64_t)0x8000000000000000ULL)
+
+static const struct BaseAndDec64 RSQRTE_TABLE[32] = {
+    {0x69fa000000000ULL, -0x15a0000000LL},
+    {0x5f2e000000000ULL, -0x13cc000000LL},
+    {0x554a000000000ULL, -0x1234000000LL},
+    {0x4c30000000000ULL, -0x10d4000000LL},
+    {0x43c8000000000ULL, -0x0f9c000000LL},
+    {0x3bfc000000000ULL, -0x0e88000000LL},
+    {0x34b8000000000ULL, -0x0d94000000LL},
+    {0x2df0000000000ULL, -0x0cb8000000LL},
+    {0x2794000000000ULL, -0x0bf0000000LL},
+    {0x219c000000000ULL, -0x0b40000000LL},
+    {0x1bfc000000000ULL, -0x0aa0000000LL},
+    {0x16ae000000000ULL, -0x0a0c000000LL},
+    {0x11a8000000000ULL, -0x0984000000LL},
+    {0x0ce6000000000ULL, -0x090c000000LL},
+    {0x0862000000000ULL, -0x0898000000LL},
+    {0x0416000000000ULL, -0x082c000000LL},
+    {0xffe8000000000ULL, -0x1e90000000LL},
+    {0xf0a4000000000ULL, -0x1c00000000LL},
+    {0xe2a8000000000ULL, -0x19c0000000LL},
+    {0xd5c8000000000ULL, -0x17c8000000LL},
+    {0xc9e4000000000ULL, -0x1610000000LL},
+    {0xbedc000000000ULL, -0x1490000000LL},
+    {0xb498000000000ULL, -0x1330000000LL},
+    {0xab00000000000ULL, -0x11f8000000LL},
+    {0xa204000000000ULL, -0x10e8000000LL},
+    {0x9994000000000ULL, -0x0fe8000000LL},
+    {0x91a0000000000ULL, -0x0f08000000LL},
+    {0x8a1c000000000ULL, -0x0e38000000LL},
+    {0x8304000000000ULL, -0x0d78000000LL},
+    {0x7c48000000000ULL, -0x0cc8000000LL},
+    {0x75e4000000000ULL, -0x0c28000000LL},
+    {0x6fd0000000000ULL, -0x0b98000000LL},
+};
+
+#ifdef _MSC_VER
+#include <intrin.h>
+static inline uint32_t ppc_clz64(uint64_t x) {
+    unsigned long idx;
+    _BitScanReverse64(&idx, x);
+    return 63u - (uint32_t)idx;
+}
+#else
+static inline uint32_t ppc_clz64(uint64_t x) {
+    return (uint32_t)__builtin_clzll(x);
+}
+#endif
+
+static inline double frsqrte(double val) {
+    union c64 bits;
+    uint64_t mantissa;
+    int64_t exponent;
+    int sign;
+    uint32_t key;
+    uint64_t new_exp;
+    const struct BaseAndDec64 *entry;
+    union c64 result;
+
+    bits.f = val;
+    mantissa = bits.u & MANTISSA_MASK_F64;
+    exponent = (int64_t)(bits.u & EXPONENT_MASK_F64);
+    sign = (bits.u & SIGN_MASK_F64) != 0;
+
+    if (mantissa == 0 && exponent == 0) {
+        return copysign(INFINITY, bits.f);
+    }
+
+    if ((uint64_t)exponent == EXPONENT_MASK_F64) {
+        if (mantissa == 0) {
+            return sign ? NAN : 0.0;
+        }
+        return val;
+    }
+
+    if (sign) {
+        return NAN;
+    }
+
+    if (exponent == 0) {
+        uint32_t shift = ppc_clz64(mantissa) - (uint32_t)(63 - EXPONENT_SHIFT_F64);
+        mantissa <<= shift;
+        mantissa &= MANTISSA_MASK_F64;
+        exponent -= (int64_t)(shift - 1) << EXPONENT_SHIFT_F64;
+    }
+
+    key = (uint32_t)(((uint64_t)exponent | mantissa) >> 37);
+    new_exp = (((0xbfcULL << EXPONENT_SHIFT_F64) - (uint64_t)exponent) >> 1) & EXPONENT_MASK_F64;
+
+    entry = &RSQRTE_TABLE[0x1fu & (key >> 11)];
+    result.u = new_exp | (uint64_t)(entry->base + entry->dec * (int64_t)(key & 0x7ffu));
+    return result.f;
+}
+
+// One Newton-Raphson step
+static inline float ppc_rsqrte(float x) {
+    double rsqrt_d = frsqrte((double)x);
+    float nwork0 = (float)(rsqrt_d * rsqrt_d);
+    float nwork1 = (float)(rsqrt_d * 0.5);
+    nwork0 = fmaf(-nwork0, x, 3.0f);
+    return nwork0 * nwork1;
+}
+
+#endif // DOLPHIN_PPC_MATH_H
diff --git a/aurora-main/include/dolphin/si.h b/aurora-main/include/dolphin/si.h
new file mode 100644
index 0000000..02eb65a
--- /dev/null
+++ b/aurora-main/include/dolphin/si.h
@@ -0,0 +1,72 @@
+#ifndef DOLPHIN_SI_H
+#define DOLPHIN_SI_H
+
+#include <dolphin/types.h>
+
+#define SI_CHAN0 0
+#define SI_CHAN1 1
+#define SI_CHAN2 2
+#define SI_CHAN3 3
+#define SI_MAX_CHAN 4
+
+#define SI_CHAN0_BIT 0x80000000
+#define SI_CHAN1_BIT 0x40000000
+#define SI_CHAN2_BIT 0x20000000
+#define SI_CHAN3_BIT 0x10000000
+#define SI_CHAN_BIT(chn) (SI_CHAN0_BIT >> (chn))
+
+#define SI_ERROR_UNDER_RUN 0x0001
+#define SI_ERROR_OVER_RUN 0x0002
+#define SI_ERROR_COLLISION 0x0004
+#define SI_ERROR_NO_RESPONSE 0x0008
+#define SI_ERROR_WRST 0x0010
+#define SI_ERROR_RDST 0x0020
+#define SI_ERROR_UNKNOWN 0x0040
+#define SI_ERROR_BUSY 0x0080
+
+#define SI_TYPE_MASK 0x18000000u
+#define SI_TYPE_N64 0x00000000u
+#define SI_TYPE_DOLPHIN 0x08000000u
+#define SI_TYPE_GC SI_TYPE_DOLPHIN
+
+// GameCube specific
+#define SI_GC_WIRELESS 0x80000000u
+#define SI_GC_NOMOTOR 0x20000000u  // no rumble motor
+#define SI_GC_STANDARD 0x01000000u // dolphin standard controller
+
+// WaveBird specific
+#define SI_WIRELESS_RECEIVED 0x40000000u // 0: no wireless unit
+#define SI_WIRELESS_IR 0x04000000u       // 0: IR  1: RF
+#define SI_WIRELESS_STATE 0x02000000u    // 0: variable  1: fixed
+#define SI_WIRELESS_ORIGIN 0x00200000u   // 0: invalid  1: valid
+#define SI_WIRELESS_FIX_ID 0x00100000u   // 0: not fixed  1: fixed
+#define SI_WIRELESS_TYPE 0x000f0000u
+#define SI_WIRELESS_LITE_MASK 0x000c0000u // 0: normal 1: lite controller
+#define SI_WIRELESS_LITE 0x00040000u      // 0: normal 1: lite controller
+#define SI_WIRELESS_CONT_MASK 0x00080000u // 0: non-controller 1: non-controller
+#define SI_WIRELESS_CONT 0x00000000u
+#define SI_WIRELESS_ID 0x00c0ff00u
+#define SI_WIRELESS_TYPE_ID (SI_WIRELESS_TYPE | SI_WIRELESS_ID)
+
+#define SI_N64_CONTROLLER (SI_TYPE_N64 | 0x05000000)
+#define SI_N64_MIC (SI_TYPE_N64 | 0x00010000)
+#define SI_N64_KEYBOARD (SI_TYPE_N64 | 0x00020000)
+#define SI_N64_MOUSE (SI_TYPE_N64 | 0x02000000)
+#define SI_GBA (SI_TYPE_N64 | 0x00040000)
+#define SI_GC_CONTROLLER (SI_TYPE_GC | SI_GC_STANDARD)
+#define SI_GC_RECEIVER (SI_TYPE_GC | SI_GC_WIRELESS)
+#define SI_GC_WAVEBIRD (SI_TYPE_GC | SI_GC_WIRELESS | SI_GC_STANDARD | SI_WIRELESS_STATE | SI_WIRELESS_FIX_ID)
+#define SI_GC_KEYBOARD (SI_TYPE_GC | 0x00200000)
+#define SI_GC_STEERING (SI_TYPE_GC | 0x00000000)
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+u32 SIProbe(s32 chan);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/thp.h b/aurora-main/include/dolphin/thp.h
new file mode 100644
index 0000000..455afe6
--- /dev/null
+++ b/aurora-main/include/dolphin/thp.h
@@ -0,0 +1,154 @@
+#ifndef _DOLPHIN_THP_H_
+#define _DOLPHIN_THP_H_
+
+#include <dolphin/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef u8 THPSample;
+typedef s16 THPCoeff;
+typedef f32 THPQuantTab[64];
+
+typedef struct _THPHuffmanTab {
+    u8 quick[32];
+    u8 increment[32];
+    u8* Vij;
+    s32 maxCode[18];
+    s32 valPtr[18];
+    u8 Vij1;
+    u8 pad[11];
+} THPHuffmanTab;
+
+typedef struct _THPComponent {
+    u8 quantizationTableSelector;
+    u8 DCTableSelector;
+    u8 ACTableSelector;
+    THPCoeff predDC;
+} THPComponent;
+
+typedef struct _THPFileInfo {
+    THPQuantTab quantTabs[3];
+    THPHuffmanTab huffmanTabs[4];
+    THPComponent components[3];
+    u16 xPixelSize;
+    u16 yPixelSize;
+    u16 MCUsPerRow;
+    u16 decompressedY;
+    u8* c;
+    u32 currByte;
+    u32 cnt;
+    u8 validHuffmanTabs;
+    u8 RST;
+    u16 nMCU;
+    u16 currMCU;
+    u8* dLC[3];
+} THPFileInfo;
+
+typedef struct THPAudioRecordHeader {
+    u32 offsetNextChannel;
+    u32 sampleSize;
+    s16 lCoef[8][2];
+    s16 rCoef[8][2];
+    s16 lYn1;
+    s16 lYn2;
+    s16 rYn1;
+    s16 rYn2;
+} THPAudioRecordHeader;
+
+typedef struct THPAudioDecodeInfo {
+    u8* encodeData;
+    u32 offsetNibbles;
+    u8 predictor;
+    u8 scale;
+    s16 yn1;
+    s16 yn2;
+} THPAudioDecodeInfo;
+
+typedef struct THPTextureSet {
+	u8* ytexture;
+	u8* utexture;
+	u8* vtexture;
+	s32 frameNumber;
+} THPTextureSet;
+
+typedef struct THPAudioBuffer {
+	s16* buffer;
+	s16* curPtr;
+	u32 validSample;
+} THPAudioBuffer;
+
+typedef struct THPVideoInfo {
+	u32 xSize;
+	u32 ySize;
+	u32 videoType;
+} THPVideoInfo;
+
+typedef struct THPAudioInfo {
+	u32 sndChannels;
+	u32 sndFrequency;
+	u32 sndNumSamples;
+	u32 sndNumTracks;
+} THPAudioInfo;
+
+typedef struct THPFrameCompInfo {
+	u32 numComponents;
+	u8 frameComp[16];
+} THPFrameCompInfo;
+
+typedef struct THPHeader {
+	/* 0x00 */ char magic[4];
+	/* 0x04 */ u32 version;
+	/* 0x08 */ u32 bufsize;
+	/* 0x0C */ u32 audioMaxSamples;
+	/* 0x10 */ f32 frameRate;
+	/* 0x14 */ u32 numFrames;
+	/* 0x18 */ u32 firstFrameSize;
+	/* 0x1C */ u32 movieDataSize;
+	/* 0x20 */ u32 compInfoDataOffsets;
+	/* 0x24 */ u32 offsetDataOffsets;
+	/* 0x28 */ u32 movieDataOffsets;
+	/* 0x2C */ u32 finalFrameDataOffsets;
+} THPHeader;
+
+#define THP_AUDIO_BUFFER_COUNT 3
+#define THP_READ_BUFFER_COUNT  10
+#define THP_TEXTURE_SET_COUNT  3
+
+static u32 THPAudioDecode(s16* audioBuffer, u8* audioFrame, s32 flag);
+static s32 __THPAudioGetNewSample(THPAudioDecodeInfo* info);
+static void __THPAudioInitialize(THPAudioDecodeInfo* info, u8* ptr);
+
+s32 __THPAudioGetNewSample(THPAudioDecodeInfo*);
+void __THPAudioInitialize(THPAudioDecodeInfo*, u8*);
+
+static void __THPSetupBuffers(void);
+static u8 __THPReadFrameHeader(void);
+static u8 __THPReadScaneHeader(void);
+static u8 __THPReadQuantizationTable(void);
+static u8 __THPReadHuffmanTableSpecification(void);
+static void __THPHuffGenerateSizeTable(void);
+static void __THPHuffGenerateCodeTable(void);
+static void __THPHuffGenerateDecoderTables(u8 tabIndex);
+static void __THPRestartDefinition(void);
+static void __THPPrepBitStream(void);
+static void __THPDecompressYUV(void* tileY, void* tileU, void* tileV);
+static void __THPGQRRestore(void);
+static void __THPDecompressiMCURow512x448(void);
+static void __THPDecompressiMCURow640x480(void);
+static void __THPDecompressiMCURowNxN(void);
+static void __THPInverseDCTNoYPos(THPCoeff* in, u32 xPos);
+static void __THPHuffDecodeDCTCompY(THPFileInfo* info, THPCoeff* block);
+static void __THPHuffDecodeDCTCompU(THPFileInfo* info, THPCoeff* block);
+static void __THPHuffDecodeDCTCompV(THPFileInfo* info, THPCoeff* block);
+
+static void __THPInverseDCTY8(THPCoeff* in, u32 xPos);
+static void __THPGQRSetup();
+static s32 __THPHuffDecodeTab(THPFileInfo* info, THPHuffmanTab* h);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // _DOLPHIN_THP_H_
diff --git a/aurora-main/include/dolphin/types.h b/aurora-main/include/dolphin/types.h
new file mode 100644
index 0000000..48c51bf
--- /dev/null
+++ b/aurora-main/include/dolphin/types.h
@@ -0,0 +1,110 @@
+#ifndef DOLPHIN_TYPES_H
+#define DOLPHIN_TYPES_H
+
+#if _WIN64 || __LP64__
+#define BIT_64 1
+#else
+#define BIT_64 0
+#endif
+
+#ifdef TARGET_PC
+#include <stdint.h>
+typedef int8_t s8;
+typedef int16_t s16;
+typedef int32_t s32;
+typedef int64_t s64;
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+typedef uint64_t u64;
+#else
+typedef signed char s8;
+typedef signed short int s16;
+typedef signed long s32;
+typedef signed long long int s64;
+typedef unsigned char u8;
+typedef unsigned short int u16;
+typedef unsigned long u32;
+typedef unsigned long long int u64;
+#endif
+
+typedef volatile u8 vu8;
+typedef volatile u16 vu16;
+typedef volatile u32 vu32;
+typedef volatile u64 vu64;
+
+typedef volatile s8 vs8;
+typedef volatile s16 vs16;
+typedef volatile s32 vs32;
+typedef volatile s64 vs64;
+
+typedef float f32;
+typedef double f64;
+
+typedef volatile f32 vf32;
+typedef volatile f64 vf64;
+
+typedef char *Ptr;
+
+#if defined(TARGET_PC)
+#include <stdbool.h>
+typedef int BOOL;
+#ifndef FALSE
+#define FALSE 0
+#endif
+#ifndef TRUE
+#define TRUE 1
+#endif
+#endif
+
+#ifdef TARGET_PC
+#include <stddef.h>
+#else
+#ifndef NULL
+#define NULL 0
+#endif
+#endif
+#ifndef __cplusplus
+#ifndef nullptr
+#define nullptr NULL
+#endif
+#endif
+
+#if defined(__MWERKS__)
+#define AT_ADDRESS(addr) : (addr)
+#define ATTRIBUTE_ALIGN(num) __attribute__((aligned(num)))
+#elif defined(__GNUC__)
+#define AT_ADDRESS(addr)
+#define ATTRIBUTE_ALIGN(num) __attribute__((aligned(num)))
+#elif defined(_MSC_VER)
+#define AT_ADDRESS(addr)
+#define ATTRIBUTE_ALIGN(num)
+#else
+#error unknown compiler
+#endif
+
+#ifndef DECL_WEAK
+#if defined(__MWERKS__)
+#define DECL_WEAK __declspec(weak)
+#elif defined(__GNUC__)
+#define DECL_WEAK __attribute__((weak))
+#elif defined(_MSC_VER)
+#define DECL_WEAK
+#else
+#error unknown compiler
+#endif
+#endif
+
+#if TARGET_PC && __cplusplus
+#define NORETURN [[noreturn]]
+#else
+#define NORETURN
+#endif
+
+#ifdef __MWERKS__
+#define __REGISTER register
+#else
+#define __REGISTER
+#endif
+
+#endif
diff --git a/aurora-main/include/dolphin/vi.h b/aurora-main/include/dolphin/vi.h
new file mode 100644
index 0000000..377d952
--- /dev/null
+++ b/aurora-main/include/dolphin/vi.h
@@ -0,0 +1,66 @@
+#ifndef DOLPHIN_VI_H
+#define DOLPHIN_VI_H
+
+#include <dolphin/gx/GXStruct.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*VIRetraceCallback)(u32 retraceCount);
+
+void VIInit(void);
+void VIConfigure(const GXRenderModeObj *rm);
+void VIConfigurePan(u16 xOrg, u16 yOrg, u16 width, u16 height);
+void VIFlush(void);
+
+void VIWaitForRetrace(void);
+
+u32 VIGetTvFormat(void);
+u32 VIGetRetraceCount(void);
+u32 VIGetNextField(void);
+u32 VIGetDTVStatus(void);
+
+void* VIGetCurrentFrameBuffer(void);
+void* VIGetNextFrameBuffer(void);
+void VISetNextFrameBuffer(void *fb);
+void VISetBlack(BOOL black);
+
+typedef void (*VIRetraceCallback)(u32 retraceCount);
+
+VIRetraceCallback VISetPreRetraceCallback(VIRetraceCallback cb);
+VIRetraceCallback VISetPostRetraceCallback(VIRetraceCallback cb);
+
+#ifdef TARGET_PC
+void VISetWindowTitle(const char* title);
+void VISetWindowFullscreen(bool fullscreen);
+bool VIGetWindowFullscreen();
+void VISetWindowSize(uint32_t width, uint32_t height);
+void VISetWindowPosition(uint32_t x, uint32_t y);
+void VICenterWindow();
+
+/**
+ * Sets the internal framebuffer resolution to a specific scale factor of the configured EFB size.
+ * A value of 0.0f means "Auto", which will use the underlying swapchain size (usually the window size).
+ */
+void VISetFrameBufferScale(float scale);
+
+/**
+ * \brief Lock the GX framebuffer to a specific aspect ratio, without changing the native framebuffer.
+ *
+ * @param width Width part of the aspect ratio fraction.
+ * @param height Height part of the aspect ratio fraction.
+ */
+void VILockAspectRatio(int width, int height);
+
+/**
+ * \brief Undoes a previous call to VILockAspectRatio.
+ */
+void VIUnlockAspectRatio();
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/aurora-main/include/magic_enum.hpp b/aurora-main/include/magic_enum.hpp
new file mode 100644
index 0000000..18c2804
--- /dev/null
+++ b/aurora-main/include/magic_enum.hpp
@@ -0,0 +1,1135 @@
+//  __  __             _        ______                          _____
+// |  \/  |           (_)      |  ____|                        / ____|_     _
+// | \  / | __ _  __ _ _  ___  | |__   _ __  _   _ _ __ ___   | |   _| |_ _| |_
+// | |\/| |/ _` |/ _` | |/ __| |  __| | '_ \| | | | '_ ` _ \  | |  |_   _|_   _|
+// | |  | | (_| | (_| | | (__  | |____| | | | |_| | | | | | | | |____|_|   |_|
+// |_|  |_|\__,_|\__, |_|\___| |______|_| |_|\__,_|_| |_| |_|  \_____|
+//                __/ | https://github.com/Neargye/magic_enum
+//               |___/  version 0.7.2
+//
+// Licensed under the MIT License <http://opensource.org/licenses/MIT>.
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2019 - 2021 Daniil Goncharov <neargye@gmail.com>.
+//
+// Permission is hereby  granted, free of charge, to any  person obtaining a copy
+// of this software and associated  documentation files (the "Software"), to deal
+// in the Software  without restriction, including without  limitation the rights
+// to  use, copy,  modify, merge,  publish, distribute,  sublicense, and/or  sell
+// copies  of  the Software,  and  to  permit persons  to  whom  the Software  is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE  IS PROVIDED "AS  IS", WITHOUT WARRANTY  OF ANY KIND,  EXPRESS OR
+// IMPLIED,  INCLUDING BUT  NOT  LIMITED TO  THE  WARRANTIES OF  MERCHANTABILITY,
+// FITNESS FOR  A PARTICULAR PURPOSE AND  NONINFRINGEMENT. IN NO EVENT  SHALL THE
+// AUTHORS  OR COPYRIGHT  HOLDERS  BE  LIABLE FOR  ANY  CLAIM,  DAMAGES OR  OTHER
+// LIABILITY, WHETHER IN AN ACTION OF  CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE  OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+#ifndef NEARGYE_MAGIC_ENUM_HPP
+#define NEARGYE_MAGIC_ENUM_HPP
+
+#define MAGIC_ENUM_VERSION_MAJOR 0
+#define MAGIC_ENUM_VERSION_MINOR 7
+#define MAGIC_ENUM_VERSION_PATCH 2
+
+#include <array>
+#include <cassert>
+#include <cstdint>
+#include <cstddef>
+#include <iosfwd>
+#include <limits>
+#include <type_traits>
+#include <utility>
+
+#if !defined(MAGIC_ENUM_USING_ALIAS_OPTIONAL)
+#include <optional>
+#endif
+#if !defined(MAGIC_ENUM_USING_ALIAS_STRING)
+#include <string>
+#endif
+#if !defined(MAGIC_ENUM_USING_ALIAS_STRING_VIEW)
+#include <string_view>
+#endif
+
+#if defined(__clang__)
+#  pragma clang diagnostic push
+#elif defined(__GNUC__)
+#  pragma GCC diagnostic push
+#  pragma GCC diagnostic ignored "-Wmaybe-uninitialized" // May be used uninitialized 'return {};'.
+#elif defined(_MSC_VER)
+#  pragma warning(push)
+#  pragma warning(disable : 26495) // Variable 'static_string<N>::chars_' is uninitialized.
+#  pragma warning(disable : 28020) // Arithmetic overflow: Using operator '-' on a 4 byte value and then casting the result to a 8 byte value.
+#  pragma warning(disable : 26451) // The expression '0<=_Param_(1)&&_Param_(1)<=1-1' is not true at this call.
+#endif
+
+// Checks magic_enum compiler compatibility.
+#if defined(__clang__) && __clang_major__ >= 5 || defined(__GNUC__) && __GNUC__ >= 9 || defined(_MSC_VER) && _MSC_VER >= 1910
+#  undef  MAGIC_ENUM_SUPPORTED
+#  define MAGIC_ENUM_SUPPORTED 1
+#endif
+
+// Checks magic_enum compiler aliases compatibility.
+#if defined(__clang__) && __clang_major__ >= 5 || defined(__GNUC__) && __GNUC__ >= 9 || defined(_MSC_VER) && _MSC_VER >= 1920
+#  undef  MAGIC_ENUM_SUPPORTED_ALIASES
+#  define MAGIC_ENUM_SUPPORTED_ALIASES 1
+#endif
+
+// Enum value must be greater or equals than MAGIC_ENUM_RANGE_MIN. By default MAGIC_ENUM_RANGE_MIN = -128.
+// If need another min range for all enum types by default, redefine the macro MAGIC_ENUM_RANGE_MIN.
+#if !defined(MAGIC_ENUM_RANGE_MIN)
+#  define MAGIC_ENUM_RANGE_MIN -128
+#endif
+
+// Enum value must be less or equals than MAGIC_ENUM_RANGE_MAX. By default MAGIC_ENUM_RANGE_MAX = 128.
+// If need another max range for all enum types by default, redefine the macro MAGIC_ENUM_RANGE_MAX.
+#if !defined(MAGIC_ENUM_RANGE_MAX)
+#  define MAGIC_ENUM_RANGE_MAX 128
+#endif
+
+namespace magic_enum {
+
+// If need another optional type, define the macro MAGIC_ENUM_USING_ALIAS_OPTIONAL.
+#if defined(MAGIC_ENUM_USING_ALIAS_OPTIONAL)
+MAGIC_ENUM_USING_ALIAS_OPTIONAL
+#else
+using std::optional;
+#endif
+
+// If need another string_view type, define the macro MAGIC_ENUM_USING_ALIAS_STRING_VIEW.
+#if defined(MAGIC_ENUM_USING_ALIAS_STRING_VIEW)
+MAGIC_ENUM_USING_ALIAS_STRING_VIEW
+#else
+using std::string_view;
+#endif
+
+// If need another string type, define the macro MAGIC_ENUM_USING_ALIAS_STRING.
+#if defined(MAGIC_ENUM_USING_ALIAS_STRING)
+MAGIC_ENUM_USING_ALIAS_STRING
+#else
+using std::string;
+#endif
+
+namespace customize {
+
+// Enum value must be in range [MAGIC_ENUM_RANGE_MIN, MAGIC_ENUM_RANGE_MAX]. By default MAGIC_ENUM_RANGE_MIN = -128, MAGIC_ENUM_RANGE_MAX = 128.
+// If need another range for all enum types by default, redefine the macro MAGIC_ENUM_RANGE_MIN and MAGIC_ENUM_RANGE_MAX.
+// If need another range for specific enum type, add specialization enum_range for necessary enum type.
+template <typename E>
+struct enum_range {
+  static_assert(std::is_enum_v<E>, "magic_enum::customize::enum_range requires enum type.");
+  inline static constexpr int min = MAGIC_ENUM_RANGE_MIN;
+  inline static constexpr int max = MAGIC_ENUM_RANGE_MAX;
+  static_assert(max > min, "magic_enum::customize::enum_range requires max > min.");
+};
+
+static_assert(MAGIC_ENUM_RANGE_MIN <= 0, "MAGIC_ENUM_RANGE_MIN must be less or equals than 0.");
+static_assert(MAGIC_ENUM_RANGE_MIN > (std::numeric_limits<std::int16_t>::min)(), "MAGIC_ENUM_RANGE_MIN must be greater than INT16_MIN.");
+
+static_assert(MAGIC_ENUM_RANGE_MAX > 0, "MAGIC_ENUM_RANGE_MAX must be greater than 0.");
+static_assert(MAGIC_ENUM_RANGE_MAX < (std::numeric_limits<std::int16_t>::max)(), "MAGIC_ENUM_RANGE_MAX must be less than INT16_MAX.");
+
+static_assert(MAGIC_ENUM_RANGE_MAX > MAGIC_ENUM_RANGE_MIN, "MAGIC_ENUM_RANGE_MAX must be greater than MAGIC_ENUM_RANGE_MIN.");
+
+// If need custom names for enum, add specialization enum_name for necessary enum type.
+template <typename E>
+constexpr string_view enum_name(E) noexcept {
+  static_assert(std::is_enum_v<E>, "magic_enum::customize::enum_name requires enum type.");
+
+  return {};
+}
+
+} // namespace magic_enum::customize
+
+namespace detail {
+
+template <typename T>
+struct supported
+#if defined(MAGIC_ENUM_SUPPORTED) && MAGIC_ENUM_SUPPORTED || defined(MAGIC_ENUM_NO_CHECK_SUPPORT)
+    : std::true_type {};
+#else
+    : std::false_type {};
+#endif
+
+struct char_equal_to {
+  constexpr bool operator()(char lhs, char rhs) const noexcept {
+    return lhs == rhs;
+  }
+};
+
+template <std::size_t N>
+class static_string {
+ public:
+  constexpr explicit static_string(string_view str) noexcept : static_string{str, std::make_index_sequence<N>{}} {
+    assert(str.size() == N);
+  }
+
+  constexpr const char* data() const noexcept { return chars_; }
+
+  constexpr std::size_t size() const noexcept { return N; }
+
+  constexpr operator string_view() const noexcept { return {data(), size()}; }
+
+ private:
+  template <std::size_t... I>
+  constexpr static_string(string_view str, std::index_sequence<I...>) noexcept : chars_{str[I]..., '\0'} {}
+
+  char chars_[N + 1];
+};
+
+template <>
+class static_string<0> {
+ public:
+  constexpr explicit static_string(string_view) noexcept {}
+
+  constexpr const char* data() const noexcept { return nullptr; }
+
+  constexpr std::size_t size() const noexcept { return 0; }
+
+  constexpr operator string_view() const noexcept { return {}; }
+};
+
+constexpr string_view pretty_name(string_view name) noexcept {
+  for (std::size_t i = name.size(); i > 0; --i) {
+    if (!((name[i - 1] >= '0' && name[i - 1] <= '9') ||
+          (name[i - 1] >= 'a' && name[i - 1] <= 'z') ||
+          (name[i - 1] >= 'A' && name[i - 1] <= 'Z') ||
+          (name[i - 1] == '_'))) {
+      name.remove_prefix(i);
+      break;
+    }
+  }
+
+  if (name.size() > 0 && ((name.front() >= 'a' && name.front() <= 'z') ||
+                          (name.front() >= 'A' && name.front() <= 'Z') ||
+                          (name.front() == '_'))) {
+    return name;
+  }
+
+  return {}; // Invalid name.
+}
+
+constexpr std::size_t find(string_view str, char c) noexcept {
+#if defined(__clang__) && __clang_major__ < 9 && defined(__GLIBCXX__) || defined(_MSC_VER) && _MSC_VER < 1920 && !defined(__clang__)
+// https://stackoverflow.com/questions/56484834/constexpr-stdstring-viewfind-last-of-doesnt-work-on-clang-8-with-libstdc
+// https://developercommunity.visualstudio.com/content/problem/360432/vs20178-regression-c-failed-in-test.html
+  constexpr bool workaround = true;
+#else
+  constexpr bool workaround = false;
+#endif
+  if constexpr (workaround) {
+    for (std::size_t i = 0; i < str.size(); ++i) {
+      if (str[i] == c) {
+        return i;
+      }
+    }
+
+    return string_view::npos;
+  } else {
+    return str.find_first_of(c);
+  }
+}
+
+template <typename T, std::size_t N, std::size_t... I>
+constexpr std::array<std::remove_cv_t<T>, N> to_array(T (&a)[N], std::index_sequence<I...>) {
+  return {{a[I]...}};
+}
+
+template <typename BinaryPredicate>
+constexpr bool cmp_equal(string_view lhs, string_view rhs, BinaryPredicate&& p) noexcept(std::is_nothrow_invocable_r_v<bool, BinaryPredicate, char, char>) {
+#if defined(_MSC_VER) && _MSC_VER < 1920 && !defined(__clang__)
+  // https://developercommunity.visualstudio.com/content/problem/360432/vs20178-regression-c-failed-in-test.html
+  // https://developercommunity.visualstudio.com/content/problem/232218/c-constexpr-string-view.html
+  constexpr bool workaround = true;
+#else
+  constexpr bool workaround = false;
+#endif
+  constexpr bool default_predicate = std::is_same_v<std::decay_t<BinaryPredicate>, char_equal_to>;
+
+  if constexpr (default_predicate && !workaround) {
+    static_cast<void>(p);
+    return lhs == rhs;
+  } else {
+    if (lhs.size() != rhs.size()) {
+      return false;
+    }
+
+    const auto size = lhs.size();
+    for (std::size_t i = 0; i < size; ++i) {
+      if (!p(lhs[i], rhs[i])) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+}
+
+template <typename L, typename R>
+constexpr bool cmp_less(L lhs, R rhs) noexcept {
+  static_assert(std::is_integral_v<L> && std::is_integral_v<R>, "magic_enum::detail::cmp_less requires integral type.");
+
+  if constexpr (std::is_signed_v<L> == std::is_signed_v<R>) {
+    // If same signedness (both signed or both unsigned).
+    return lhs < rhs;
+  } else if constexpr (std::is_signed_v<R>) {
+    // If 'right' is negative, then result is 'false', otherwise cast & compare.
+    return rhs > 0 && lhs < static_cast<std::make_unsigned_t<R>>(rhs);
+  } else {
+    // If 'left' is negative, then result is 'true', otherwise cast & compare.
+    return lhs < 0 || static_cast<std::make_unsigned_t<L>>(lhs) < rhs;
+  }
+}
+
+template <typename I>
+constexpr I log2(I value) noexcept {
+  static_assert(std::is_integral_v<I>, "magic_enum::detail::log2 requires integral type.");
+
+  auto ret = I{0};
+  for (; value > I{1}; value >>= I{1}, ++ret) {}
+
+  return ret;
+}
+
+template <typename I>
+constexpr bool is_pow2(I x) noexcept {
+  static_assert(std::is_integral_v<I>, "magic_enum::detail::is_pow2 requires integral type.");
+
+  return x != 0 && (x & (x - 1)) == 0;
+}
+
+template <typename T>
+inline constexpr bool is_enum_v = std::is_enum_v<T> && std::is_same_v<T, std::decay_t<T>>;
+
+template <typename E>
+constexpr auto n() noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::n requires enum type.");
+#if defined(MAGIC_ENUM_SUPPORTED) && MAGIC_ENUM_SUPPORTED
+#  if defined(__clang__)
+  constexpr string_view name{__PRETTY_FUNCTION__ + 34, sizeof(__PRETTY_FUNCTION__) - 36};
+#  elif defined(__GNUC__)
+  constexpr string_view name{__PRETTY_FUNCTION__ + 49, sizeof(__PRETTY_FUNCTION__) - 51};
+#  elif defined(_MSC_VER)
+  constexpr string_view name{__FUNCSIG__ + 40, sizeof(__FUNCSIG__) - 57};
+#  endif
+  return static_string<name.size()>{name};
+#else
+  return string_view{}; // Unsupported compiler.
+#endif
+}
+
+template <typename E>
+inline constexpr auto type_name_v = n<E>();
+
+template <typename E, E V>
+constexpr auto n() noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::n requires enum type.");
+  constexpr auto custom_name = customize::enum_name<E>(V);
+
+  if constexpr (custom_name.empty()) {
+    static_cast<void>(custom_name);
+#if defined(MAGIC_ENUM_SUPPORTED) && MAGIC_ENUM_SUPPORTED
+#  if defined(__clang__) || defined(__GNUC__)
+    constexpr auto name = pretty_name({__PRETTY_FUNCTION__, sizeof(__PRETTY_FUNCTION__) - 2});
+#  elif defined(_MSC_VER)
+    constexpr auto name = pretty_name({__FUNCSIG__, sizeof(__FUNCSIG__) - 17});
+#  endif
+    return static_string<name.size()>{name};
+#else
+    return string_view{}; // Unsupported compiler.
+#endif
+  } else {
+    return static_string<custom_name.size()>{custom_name};
+  }
+}
+
+template <typename E, E V>
+inline constexpr auto enum_name_v = n<E, V>();
+
+template <typename E, auto V>
+constexpr bool is_valid() noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::is_valid requires enum type.");
+
+  return n<E, static_cast<E>(V)>().size() != 0;
+}
+
+template <typename E, int O, bool IsFlags = false, typename U = std::underlying_type_t<E>>
+constexpr E value(std::size_t i) noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::value requires enum type.");
+
+  if constexpr (IsFlags) {
+    return static_cast<E>(U{1} << static_cast<U>(static_cast<int>(i) + O));
+  } else {
+    return static_cast<E>(static_cast<int>(i) + O);
+  }
+}
+
+template <typename E, bool IsFlags, typename U = std::underlying_type_t<E>>
+constexpr int reflected_min() noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::reflected_min requires enum type.");
+
+  if constexpr (IsFlags) {
+    return 0;
+  } else {
+    constexpr auto lhs = customize::enum_range<E>::min;
+    static_assert(lhs > (std::numeric_limits<std::int16_t>::min)(), "magic_enum::enum_range requires min must be greater than INT16_MIN.");
+    constexpr auto rhs = (std::numeric_limits<U>::min)();
+
+    if constexpr (cmp_less(lhs, rhs)) {
+      return rhs;
+    } else {
+      static_assert(!is_valid<E, value<E, lhs - 1, IsFlags>(0)>(), "magic_enum::enum_range detects enum value smaller than min range size.");
+      return lhs;
+    }
+  }
+}
+
+template <typename E, bool IsFlags, typename U = std::underlying_type_t<E>>
+constexpr int reflected_max() noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::reflected_max requires enum type.");
+
+  if constexpr (IsFlags) {
+    return std::numeric_limits<U>::digits - 1;
+  } else {
+    constexpr auto lhs = customize::enum_range<E>::max;
+    static_assert(lhs < (std::numeric_limits<std::int16_t>::max)(), "magic_enum::enum_range requires max must be less than INT16_MAX.");
+    constexpr auto rhs = (std::numeric_limits<U>::max)();
+
+    if constexpr (cmp_less(lhs, rhs)) {
+      static_assert(!is_valid<E, value<E, lhs + 1, IsFlags>(0)>(), "magic_enum::enum_range detects enum value larger than max range size.");
+      return lhs;
+    } else {
+      return rhs;
+    }
+  }
+}
+
+template <typename E, bool IsFlags = false>
+inline constexpr auto reflected_min_v = reflected_min<E, IsFlags>();
+
+template <typename E, bool IsFlags = false>
+inline constexpr auto reflected_max_v = reflected_max<E, IsFlags>();
+
+template <std::size_t N>
+constexpr std::size_t values_count(const bool (&valid)[N]) noexcept {
+  auto count = std::size_t{0};
+  for (std::size_t i = 0; i < N; ++i) {
+    if (valid[i]) {
+      ++count;
+    }
+  }
+
+  return count;
+}
+
+template <typename E, bool IsFlags, int Min, std::size_t... I>
+constexpr auto values(std::index_sequence<I...>) noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::values requires enum type.");
+  constexpr bool valid[sizeof...(I)] = {is_valid<E, value<E, Min, IsFlags>(I)>()...};
+  constexpr std::size_t count = values_count(valid);
+
+  if constexpr (count > 0) {
+    E values[count] = {};
+    for (std::size_t i = 0, v = 0; v < count; ++i) {
+      if (valid[i]) {
+        values[v++] = value<E, Min, IsFlags>(i);
+      }
+    }
+
+    return to_array(values, std::make_index_sequence<count>{});
+  } else {
+    return std::array<E, 0>{};
+  }
+}
+
+template <typename E, bool IsFlags, typename U = std::underlying_type_t<E>>
+constexpr auto values() noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::values requires enum type.");
+  constexpr auto min = reflected_min_v<E, IsFlags>;
+  constexpr auto max = reflected_max_v<E, IsFlags>;
+  constexpr auto range_size = max - min + 1;
+  static_assert(range_size > 0, "magic_enum::enum_range requires valid size.");
+  static_assert(range_size < (std::numeric_limits<std::uint16_t>::max)(), "magic_enum::enum_range requires valid size.");
+
+  return values<E, IsFlags, reflected_min_v<E, IsFlags>>(std::make_index_sequence<range_size>{});
+}
+
+template <typename E, bool IsFlags = false>
+inline constexpr auto values_v = values<E, IsFlags>();
+
+template <typename E, bool IsFlags = false, typename D = std::decay_t<E>>
+using values_t = decltype((values_v<D, IsFlags>));
+
+template <typename E, bool IsFlags = false>
+inline constexpr auto count_v = values_v<E, IsFlags>.size();
+
+template <typename E, bool IsFlags = false, typename U = std::underlying_type_t<E>>
+inline constexpr auto min_v = (count_v<E, IsFlags> > 0) ? static_cast<U>(values_v<E, IsFlags>.front()) : U{0};
+
+template <typename E, bool IsFlags = false, typename U = std::underlying_type_t<E>>
+inline constexpr auto max_v = (count_v<E, IsFlags> > 0) ? static_cast<U>(values_v<E, IsFlags>.back()) : U{0};
+
+template <typename E, bool IsFlags, typename U = std::underlying_type_t<E>>
+constexpr std::size_t range_size() noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::range_size requires enum type.");
+  constexpr auto max = IsFlags ? log2(max_v<E, IsFlags>) : max_v<E, IsFlags>;
+  constexpr auto min = IsFlags ? log2(min_v<E, IsFlags>) : min_v<E, IsFlags>;
+  constexpr auto range_size = max - min + U{1};
+  static_assert(range_size > 0, "magic_enum::enum_range requires valid size.");
+  static_assert(range_size < (std::numeric_limits<std::uint16_t>::max)(), "magic_enum::enum_range requires valid size.");
+
+  return static_cast<std::size_t>(range_size);
+}
+
+template <typename E, bool IsFlags = false>
+inline constexpr auto range_size_v = range_size<E, IsFlags>();
+
+template <typename E, bool IsFlags = false>
+using index_t = std::conditional_t<range_size_v<E, IsFlags> < (std::numeric_limits<std::uint8_t>::max)(), std::uint8_t, std::uint16_t>;
+
+template <typename E, bool IsFlags = false>
+inline constexpr auto invalid_index_v = (std::numeric_limits<index_t<E, IsFlags>>::max)();
+
+template <typename E, bool IsFlags, std::size_t... I>
+constexpr auto indexes(std::index_sequence<I...>) noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::indexes requires enum type.");
+  constexpr auto min = IsFlags ? log2(min_v<E, IsFlags>) : min_v<E, IsFlags>;
+  [[maybe_unused]] auto i = index_t<E, IsFlags>{0};
+
+  return std::array<decltype(i), sizeof...(I)>{{(is_valid<E, value<E, min, IsFlags>(I)>() ? i++ : invalid_index_v<E, IsFlags>)...}};
+}
+
+template <typename E, bool IsFlags = false>
+inline constexpr auto indexes_v = indexes<E, IsFlags>(std::make_index_sequence<range_size_v<E, IsFlags>>{});
+
+template <typename E, bool IsFlags, std::size_t... I>
+constexpr auto names(std::index_sequence<I...>) noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::names requires enum type.");
+
+  return std::array<string_view, sizeof...(I)>{{enum_name_v<E, values_v<E, IsFlags>[I]>...}};
+}
+
+template <typename E, bool IsFlags = false>
+inline constexpr auto names_v = names<E, IsFlags>(std::make_index_sequence<count_v<E, IsFlags>>{});
+
+template <typename E, bool IsFlags = false, typename D = std::decay_t<E>>
+using names_t = decltype((names_v<D, IsFlags>));
+
+template <typename E, bool IsFlags, std::size_t... I>
+constexpr auto entries(std::index_sequence<I...>) noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::entries requires enum type.");
+
+  return std::array<std::pair<E, string_view>, sizeof...(I)>{{{values_v<E, IsFlags>[I], enum_name_v<E, values_v<E, IsFlags>[I]>}...}};
+}
+
+template <typename E, bool IsFlags = false>
+inline constexpr auto entries_v = entries<E, IsFlags>(std::make_index_sequence<count_v<E, IsFlags>>{});
+
+template <typename E, bool IsFlags = false, typename D = std::decay_t<E>>
+using entries_t = decltype((entries_v<D, IsFlags>));
+
+template <typename E, bool IsFlags, typename U = std::underlying_type_t<E>>
+constexpr bool is_sparse() noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::is_sparse requires enum type.");
+
+  return range_size_v<E, IsFlags> != count_v<E, IsFlags>;
+}
+
+template <typename E, bool IsFlags = false>
+inline constexpr bool is_sparse_v = is_sparse<E, IsFlags>();
+
+template <typename E, typename U = std::underlying_type_t<E>>
+constexpr std::size_t undex(U value) noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::undex requires enum type.");
+
+  if (const auto i = static_cast<std::size_t>(value - min_v<E>); value >= min_v<E> && value <= max_v<E>) {
+    if constexpr (is_sparse_v<E>) {
+      if (const auto idx = indexes_v<E>[i]; idx != invalid_index_v<E>) {
+        return idx;
+      }
+    } else {
+      return i;
+    }
+  }
+
+  return invalid_index_v<E>; // Value out of range.
+}
+
+template <typename E, typename U = std::underlying_type_t<E>>
+constexpr std::size_t endex(E value) noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::endex requires enum type.");
+
+  return undex<E>(static_cast<U>(value));
+}
+
+template <typename E, typename U = std::underlying_type_t<E>>
+constexpr U value_ors() noexcept {
+  static_assert(is_enum_v<E>, "magic_enum::detail::endex requires enum type.");
+
+  auto value = U{0};
+  for (std::size_t i = 0; i < count_v<E, true>; ++i) {
+    value |= static_cast<U>(values_v<E, true>[i]);
+  }
+
+  return value;
+}
+
+template <bool, typename T, typename R>
+struct enable_if_enum {};
+
+template <typename T, typename R>
+struct enable_if_enum<true, T, R> {
+  using type = R;
+  using D = std::decay_t<T>;
+  static_assert(supported<D>::value, "magic_enum unsupported compiler (https://github.com/Neargye/magic_enum#compiler-compatibility).");
+};
+
+template <typename T, typename R = void>
+using enable_if_enum_t = std::enable_if_t<std::is_enum_v<std::decay_t<T>>, R>;
+
+template <typename T, typename Enable = std::enable_if_t<std::is_enum_v<std::decay_t<T>>>>
+using enum_concept = T;
+
+template <typename T, bool = std::is_enum_v<T>>
+struct is_scoped_enum : std::false_type {};
+
+template <typename T>
+struct is_scoped_enum<T, true> : std::bool_constant<!std::is_convertible_v<T, std::underlying_type_t<T>>> {};
+
+template <typename T, bool = std::is_enum_v<T>>
+struct is_unscoped_enum : std::false_type {};
+
+template <typename T>
+struct is_unscoped_enum<T, true> : std::bool_constant<std::is_convertible_v<T, std::underlying_type_t<T>>> {};
+
+template <typename T, bool = std::is_enum_v<std::decay_t<T>>>
+struct underlying_type {};
+
+template <typename T>
+struct underlying_type<T, true> : std::underlying_type<std::decay_t<T>> {};
+
+} // namespace magic_enum::detail
+
+// Checks is magic_enum supported compiler.
+inline constexpr bool is_magic_enum_supported = detail::supported<void>::value;
+
+template <typename T>
+using Enum = detail::enum_concept<T>;
+
+// Checks whether T is an Unscoped enumeration type.
+// Provides the member constant value which is equal to true, if T is an [Unscoped enumeration](https://en.cppreference.com/w/cpp/language/enum#Unscoped_enumeration) type. Otherwise, value is equal to false.
+template <typename T>
+struct is_unscoped_enum : detail::is_unscoped_enum<T> {};
+
+template <typename T>
+inline constexpr bool is_unscoped_enum_v = is_unscoped_enum<T>::value;
+
+// Checks whether T is an Scoped enumeration type.
+// Provides the member constant value which is equal to true, if T is an [Scoped enumeration](https://en.cppreference.com/w/cpp/language/enum#Scoped_enumerations) type. Otherwise, value is equal to false.
+template <typename T>
+struct is_scoped_enum : detail::is_scoped_enum<T> {};
+
+template <typename T>
+inline constexpr bool is_scoped_enum_v = is_scoped_enum<T>::value;
+
+// If T is a complete enumeration type, provides a member typedef type that names the underlying type of T.
+// Otherwise, if T is not an enumeration type, there is no member type. Otherwise (T is an incomplete enumeration type), the program is ill-formed.
+template <typename T>
+struct underlying_type : detail::underlying_type<T> {};
+
+template <typename T>
+using underlying_type_t = typename underlying_type<T>::type;
+
+// Returns type name of enum.
+template <typename E>
+[[nodiscard]] constexpr auto enum_type_name() noexcept -> detail::enable_if_enum_t<E, string_view> {
+  using D = std::decay_t<E>;
+  constexpr string_view name = detail::type_name_v<D>;
+  static_assert(name.size() > 0, "Enum type does not have a name.");
+
+  return name;
+}
+
+// Returns number of enum values.
+template <typename E>
+[[nodiscard]] constexpr auto enum_count() noexcept -> detail::enable_if_enum_t<E, std::size_t> {
+  using D = std::decay_t<E>;
+
+  return detail::count_v<D>;
+}
+
+// Returns enum value at specified index.
+// No bounds checking is performed: the behavior is undefined if index >= number of enum values.
+template <typename E>
+[[nodiscard]] constexpr auto enum_value(std::size_t index) noexcept -> detail::enable_if_enum_t<E, std::decay_t<E>> {
+  using D = std::decay_t<E>;
+  static_assert(detail::count_v<D> > 0, "magic_enum requires enum implementation and valid max and min.");
+
+  if constexpr (detail::is_sparse_v<D>) {
+    return assert((index < detail::count_v<D>)), detail::values_v<D>[index];
+  } else {
+    return assert((index < detail::count_v<D>)), detail::value<D, detail::min_v<D>>(index);
+  }
+}
+
+// Returns std::array with enum values, sorted by enum value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_values() noexcept -> detail::enable_if_enum_t<E, detail::values_t<E>> {
+  using D = std::decay_t<E>;
+  static_assert(detail::count_v<D> > 0, "magic_enum requires enum implementation and valid max and min.");
+
+  return detail::values_v<D>;
+}
+
+// Returns name from static storage enum variable.
+// This version is much lighter on the compile times and is not restricted to the enum_range limitation.
+template <auto V>
+[[nodiscard]] constexpr auto enum_name() noexcept -> detail::enable_if_enum_t<decltype(V), string_view> {
+  using D = std::decay_t<decltype(V)>;
+  constexpr string_view name = detail::enum_name_v<D, V>;
+  static_assert(name.size() > 0, "Enum value does not have a name.");
+
+  return name;
+}
+
+// Returns name from enum value.
+// If enum value does not have name or value out of range, returns empty string.
+template <typename E>
+[[nodiscard]] constexpr auto enum_name(E value) noexcept -> detail::enable_if_enum_t<E, string_view> {
+  using D = std::decay_t<E>;
+
+  if (const auto i = detail::endex<D>(value); i != detail::invalid_index_v<D>) {
+    return detail::names_v<D>[i];
+  }
+
+  return {}; // Invalid value or out of range.
+}
+
+// Returns std::array with names, sorted by enum value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_names() noexcept -> detail::enable_if_enum_t<E, detail::names_t<E>> {
+  using D = std::decay_t<E>;
+  static_assert(detail::count_v<D> > 0, "magic_enum requires enum implementation and valid max and min.");
+
+  return detail::names_v<D>;
+}
+
+// Returns std::array with pairs (value, name), sorted by enum value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_entries() noexcept -> detail::enable_if_enum_t<E, detail::entries_t<E>> {
+  using D = std::decay_t<E>;
+  static_assert(detail::count_v<D> > 0, "magic_enum requires enum implementation and valid max and min.");
+
+  return detail::entries_v<D>;
+}
+
+// Obtains enum value from integer value.
+// Returns optional with enum value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_cast(underlying_type_t<E> value) noexcept -> detail::enable_if_enum_t<E, optional<std::decay_t<E>>> {
+  using D = std::decay_t<E>;
+
+  if (detail::undex<D>(value) != detail::invalid_index_v<D>) {
+    return static_cast<D>(value);
+  }
+
+  return {}; // Invalid value or out of range.
+}
+
+// Obtains enum value from name.
+// Returns optional with enum value.
+template <typename E, typename BinaryPredicate>
+[[nodiscard]] constexpr auto enum_cast(string_view value, BinaryPredicate p) noexcept(std::is_nothrow_invocable_r_v<bool, BinaryPredicate, char, char>) -> detail::enable_if_enum_t<E, optional<std::decay_t<E>>> {
+  static_assert(std::is_invocable_r_v<bool, BinaryPredicate, char, char>, "magic_enum::enum_cast requires bool(char, char) invocable predicate.");
+  using D = std::decay_t<E>;
+
+  for (std::size_t i = 0; i < detail::count_v<D>; ++i) {
+    if (detail::cmp_equal(value, detail::names_v<D>[i], p)) {
+      return enum_value<D>(i);
+    }
+  }
+
+  return {}; // Invalid value or out of range.
+}
+
+// Obtains enum value from name.
+// Returns optional with enum value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_cast(string_view value) noexcept -> detail::enable_if_enum_t<E, optional<std::decay_t<E>>> {
+  using D = std::decay_t<E>;
+
+  return enum_cast<D>(value, detail::char_equal_to{});
+}
+
+// Returns integer value from enum value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_integer(E value) noexcept -> detail::enable_if_enum_t<E, underlying_type_t<E>> {
+  return static_cast<underlying_type_t<E>>(value);
+}
+
+// Obtains index in enum values from enum value.
+// Returns optional with index.
+template <typename E>
+[[nodiscard]] constexpr auto enum_index(E value) noexcept -> detail::enable_if_enum_t<E, optional<std::size_t>> {
+  using D = std::decay_t<E>;
+
+  if (const auto i = detail::endex<D>(value); i != detail::invalid_index_v<D>) {
+    return i;
+  }
+
+  return {}; // Invalid value or out of range.
+}
+
+// Checks whether enum contains enumerator with such enum value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_contains(E value) noexcept -> detail::enable_if_enum_t<E, bool> {
+  using D = std::decay_t<E>;
+
+  return detail::endex<D>(value) != detail::invalid_index_v<D>;
+}
+
+// Checks whether enum contains enumerator with such integer value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_contains(underlying_type_t<E> value) noexcept -> detail::enable_if_enum_t<E, bool> {
+  using D = std::decay_t<E>;
+
+  return detail::undex<D>(value) != detail::invalid_index_v<D>;
+}
+
+// Checks whether enum contains enumerator with such name.
+template <typename E, typename BinaryPredicate>
+[[nodiscard]] constexpr auto enum_contains(string_view value, BinaryPredicate p) noexcept(std::is_nothrow_invocable_r_v<bool, BinaryPredicate, char, char>) -> detail::enable_if_enum_t<E, bool> {
+  static_assert(std::is_invocable_r_v<bool, BinaryPredicate, char, char>, "magic_enum::enum_contains requires bool(char, char) invocable predicate.");
+  using D = std::decay_t<E>;
+
+  return enum_cast<D>(value, std::move_if_noexcept(p)).has_value();
+}
+
+// Checks whether enum contains enumerator with such name.
+template <typename E>
+[[nodiscard]] constexpr auto enum_contains(string_view value) noexcept -> detail::enable_if_enum_t<E, bool> {
+  using D = std::decay_t<E>;
+
+  return enum_cast<D>(value).has_value();
+}
+
+namespace ostream_operators {
+
+template <typename Char, typename Traits, typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+std::basic_ostream<Char, Traits>& operator<<(std::basic_ostream<Char, Traits>& os, E value) {
+  using D = std::decay_t<E>;
+  using U = underlying_type_t<D>;
+#if defined(MAGIC_ENUM_SUPPORTED) && MAGIC_ENUM_SUPPORTED
+  if (const auto name = magic_enum::enum_name<D>(value); !name.empty()) {
+    for (const auto c : name) {
+      os.put(c);
+    }
+    return os;
+  }
+#endif
+  return (os << static_cast<U>(value));
+}
+
+template <typename Char, typename Traits, typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+std::basic_ostream<Char, Traits>& operator<<(std::basic_ostream<Char, Traits>& os, optional<E> value) {
+  return value.has_value() ? (os << value.value()) : os;
+}
+
+} // namespace magic_enum::ostream_operators
+
+namespace bitwise_operators {
+
+template <typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+constexpr E operator~(E rhs) noexcept {
+  return static_cast<E>(~static_cast<underlying_type_t<E>>(rhs));
+}
+
+template <typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+constexpr E operator|(E lhs, E rhs) noexcept {
+  return static_cast<E>(static_cast<underlying_type_t<E>>(lhs) | static_cast<underlying_type_t<E>>(rhs));
+}
+
+template <typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+constexpr E operator&(E lhs, E rhs) noexcept {
+  return static_cast<E>(static_cast<underlying_type_t<E>>(lhs) & static_cast<underlying_type_t<E>>(rhs));
+}
+
+template <typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+constexpr E operator^(E lhs, E rhs) noexcept {
+  return static_cast<E>(static_cast<underlying_type_t<E>>(lhs) ^ static_cast<underlying_type_t<E>>(rhs));
+}
+
+template <typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+constexpr E& operator|=(E& lhs, E rhs) noexcept {
+  return lhs = (lhs | rhs);
+}
+
+template <typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+constexpr E& operator&=(E& lhs, E rhs) noexcept {
+  return lhs = (lhs & rhs);
+}
+
+template <typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+constexpr E& operator^=(E& lhs, E rhs) noexcept {
+  return lhs = (lhs ^ rhs);
+}
+
+} // namespace magic_enum::bitwise_operators
+
+namespace flags {
+
+// Returns type name of enum.
+using magic_enum::enum_type_name;
+
+// Returns number of enum-flags values.
+template <typename E>
+[[nodiscard]] constexpr auto enum_count() noexcept -> detail::enable_if_enum_t<E, std::size_t> {
+  using D = std::decay_t<E>;
+
+  return detail::count_v<D, true>;
+}
+
+// Returns enum-flags value at specified index.
+// No bounds checking is performed: the behavior is undefined if index >= number of enum-flags values.
+template <typename E>
+[[nodiscard]] constexpr auto enum_value(std::size_t index) noexcept -> detail::enable_if_enum_t<E, std::decay_t<E>> {
+  using D = std::decay_t<E>;
+  static_assert(detail::count_v<D, true> > 0, "magic_enum::flags requires enum-flags implementation.");
+
+  if constexpr (detail::is_sparse_v<D, true>) {
+    return assert((index < detail::count_v<D, true>)), detail::values_v<D, true>[index];
+  } else {
+    constexpr auto min = detail::log2(detail::min_v<D, true>);
+
+    return assert((index < detail::count_v<D, true>)), detail::value<D, min, true>(index);
+  }
+}
+
+// Returns std::array with enum-flags values, sorted by enum-flags value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_values() noexcept -> detail::enable_if_enum_t<E, detail::values_t<E, true>> {
+  using D = std::decay_t<E>;
+  static_assert(detail::count_v<D, true> > 0, "magic_enum::flags requires enum-flags implementation.");
+
+  return detail::values_v<D, true>;
+}
+
+// Returns name from enum-flags value.
+// If enum-flags value does not have name or value out of range, returns empty string.
+template <typename E>
+[[nodiscard]] auto enum_name(E value) -> detail::enable_if_enum_t<E, string> {
+  using D = std::decay_t<E>;
+  using U = underlying_type_t<D>;
+
+  string name;
+  auto check_value = U{0};
+  for (std::size_t i = 0; i < detail::count_v<D, true>; ++i) {
+    if (const auto v = static_cast<U>(enum_value<D>(i)); (static_cast<U>(value) & v) != 0) {
+      check_value |= v;
+      const auto n = detail::names_v<D, true>[i];
+      if (!name.empty()) {
+        name.append(1, '|');
+      }
+      name.append(n.data(), n.size());
+    }
+  }
+
+  if (check_value != 0 && check_value == static_cast<U>(value)) {
+    return name;
+  }
+
+  return {}; // Invalid value or out of range.
+}
+
+// Returns std::array with string names, sorted by enum-flags value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_names() noexcept -> detail::enable_if_enum_t<E, detail::names_t<E, true>> {
+  using D = std::decay_t<E>;
+  static_assert(detail::count_v<D, true> > 0, "magic_enum::flags requires enum-flags implementation.");
+
+  return detail::names_v<D, true>;
+}
+
+// Returns std::array with pairs (value, name), sorted by enum-flags value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_entries() noexcept -> detail::enable_if_enum_t<E, detail::entries_t<E, true>> {
+  using D = std::decay_t<E>;
+  static_assert(detail::count_v<D, true> > 0, "magic_enum::flags requires enum-flags implementation.");
+
+  return detail::entries_v<D, true>;
+}
+
+// Obtains enum-flags value from integer value.
+// Returns optional with enum-flags value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_cast(underlying_type_t<E> value) noexcept -> detail::enable_if_enum_t<E, optional<std::decay_t<E>>> {
+  using D = std::decay_t<E>;
+  using U = underlying_type_t<D>;
+
+  if constexpr (detail::is_sparse_v<D, true>) {
+    auto check_value = U{0};
+    for (std::size_t i = 0; i < detail::count_v<D, true>; ++i) {
+      if (const auto v = static_cast<U>(enum_value<D>(i)); (value & v) != 0) {
+        check_value |= v;
+      }
+    }
+
+    if (check_value != 0 && check_value == value) {
+      return static_cast<D>(value);
+    }
+  } else {
+    constexpr auto min = detail::min_v<D, true>;
+    constexpr auto max = detail::value_ors<D>();
+
+    if (value >= min && value <= max) {
+      return static_cast<D>(value);
+    }
+  }
+
+  return {}; // Invalid value or out of range.
+}
+
+// Obtains enum-flags value from name.
+// Returns optional with enum-flags value.
+template <typename E, typename BinaryPredicate>
+[[nodiscard]] constexpr auto enum_cast(string_view value, BinaryPredicate p) noexcept(std::is_nothrow_invocable_r_v<bool, BinaryPredicate, char, char>) -> detail::enable_if_enum_t<E, optional<std::decay_t<E>>> {
+  static_assert(std::is_invocable_r_v<bool, BinaryPredicate, char, char>, "magic_enum::flags::enum_cast requires bool(char, char) invocable predicate.");
+  using D = std::decay_t<E>;
+  using U = underlying_type_t<D>;
+
+  auto result = U{0};
+  while (!value.empty()) {
+    const auto d = detail::find(value, '|');
+    const auto s = (d == string_view::npos) ? value : value.substr(0, d);
+    auto f = U{0};
+    for (std::size_t i = 0; i < detail::count_v<D, true>; ++i) {
+      if (detail::cmp_equal(s, detail::names_v<D, true>[i], p)) {
+        f = static_cast<U>(enum_value<D>(i));
+        result |= f;
+        break;
+      }
+    }
+    if (f == U{0}) {
+      return {}; // Invalid value or out of range.
+    }
+    value.remove_prefix((d == string_view::npos) ? value.size() : d + 1);
+  }
+
+  if (result == U{0}) {
+    return {}; // Invalid value or out of range.
+  } else {
+    return static_cast<D>(result);
+  }
+}
+
+// Obtains enum-flags value from name.
+// Returns optional with enum-flags value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_cast(string_view value) noexcept -> detail::enable_if_enum_t<E, optional<std::decay_t<E>>> {
+  using D = std::decay_t<E>;
+
+  return enum_cast<D>(value, detail::char_equal_to{});
+}
+
+// Returns integer value from enum value.
+using magic_enum::enum_integer;
+
+// Obtains index in enum-flags values from enum-flags value.
+// Returns optional with index.
+template <typename E>
+[[nodiscard]] constexpr auto enum_index(E value) noexcept -> detail::enable_if_enum_t<E, optional<std::size_t>> {
+  using D = std::decay_t<E>;
+  using U = underlying_type_t<D>;
+
+  if (detail::is_pow2(static_cast<U>(value))) {
+    for (std::size_t i = 0; i < detail::count_v<D, true>; ++i) {
+      if (enum_value<D>(i) == value) {
+        return i;
+      }
+    }
+  }
+
+  return {}; // Invalid value or out of range.
+}
+
+// Checks whether enum-flags contains enumerator with such enum-flags value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_contains(E value) noexcept -> detail::enable_if_enum_t<E, bool> {
+  using D = std::decay_t<E>;
+  using U = underlying_type_t<D>;
+
+  return enum_cast<D>(static_cast<U>(value)).has_value();
+}
+
+// Checks whether enum-flags contains enumerator with such integer value.
+template <typename E>
+[[nodiscard]] constexpr auto enum_contains(underlying_type_t<E> value) noexcept -> detail::enable_if_enum_t<E, bool> {
+  using D = std::decay_t<E>;
+
+  return enum_cast<D>(value).has_value();
+}
+
+// Checks whether enum-flags contains enumerator with such name.
+template <typename E, typename BinaryPredicate>
+[[nodiscard]] constexpr auto enum_contains(string_view value, BinaryPredicate p) noexcept(std::is_nothrow_invocable_r_v<bool, BinaryPredicate, char, char>) -> detail::enable_if_enum_t<E, bool> {
+  static_assert(std::is_invocable_r_v<bool, BinaryPredicate, char, char>, "magic_enum::flags::enum_contains requires bool(char, char) invocable predicate.");
+  using D = std::decay_t<E>;
+
+  return enum_cast<D>(value, std::move_if_noexcept(p)).has_value();
+}
+
+// Checks whether enum-flags contains enumerator with such name.
+template <typename E>
+[[nodiscard]] constexpr auto enum_contains(string_view value) noexcept -> detail::enable_if_enum_t<E, bool> {
+  using D = std::decay_t<E>;
+
+  return enum_cast<D>(value).has_value();
+}
+
+} // namespace magic_enum::flags
+
+namespace flags::ostream_operators {
+
+template <typename Char, typename Traits, typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+std::basic_ostream<Char, Traits>& operator<<(std::basic_ostream<Char, Traits>& os, E value) {
+  using D = std::decay_t<E>;
+  using U = underlying_type_t<D>;
+#if defined(MAGIC_ENUM_SUPPORTED) && MAGIC_ENUM_SUPPORTED
+  if (const auto name = magic_enum::flags::enum_name<D>(value); !name.empty()) {
+    for (const auto c : name) {
+      os.put(c);
+    }
+    return os;
+  }
+#endif
+  return (os << static_cast<U>(value));
+}
+
+template <typename Char, typename Traits, typename E, std::enable_if_t<std::is_enum_v<E>, int> = 0>
+std::basic_ostream<Char, Traits>& operator<<(std::basic_ostream<Char, Traits>& os, optional<E> value) {
+  return value.has_value() ? (os << value.value()) : os;
+}
+
+} // namespace magic_enum::flags::ostream_operators
+
+namespace flags::bitwise_operators {
+
+using namespace magic_enum::bitwise_operators;
+
+} // namespace magic_enum::flags::bitwise_operators
+
+} // namespace magic_enum
+
+#if defined(__clang__)
+#  pragma clang diagnostic pop
+#elif defined(__GNUC__)
+#  pragma GCC diagnostic pop
+#elif defined(_MSC_VER)
+#  pragma warning(pop)
+#endif
+
+#endif // NEARGYE_MAGIC_ENUM_HPP
diff --git a/aurora-main/lib/aurora.cpp b/aurora-main/lib/aurora.cpp
new file mode 100644
index 0000000..b679e32
--- /dev/null
+++ b/aurora-main/lib/aurora.cpp
@@ -0,0 +1,1932 @@
+#include <aurora/aurora.h>
+
+#ifdef AURORA_ENABLE_GX
+#include "gfx/common.hpp"
+#include "gfx/efb_ram_copy.hpp"
+#include "gx/fifo.hpp"
+#include "gx/shader_info.hpp"
+#include "imgui.hpp"
+#include "webgpu/gpu.hpp"
+#include <webgpu/webgpu_cpp.h>
+#endif
+
+#include "input.hpp"
+#include "internal.hpp"
+#include "window.hpp"
+
+#include <SDL3/SDL_filesystem.h>
+#include <SDL3/SDL_thread.h>
+#include <magic_enum.hpp>
+
+#include "system_info.hpp"
+#include "tracy/Tracy.hpp"
+
+#if defined(_WIN32)
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#endif
+
+#include <atomic>
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cmath>
+#include <condition_variable>
+#include <cstdio>
+#include <cstdlib>
+#include <deque>
+#include <fstream>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <string>
+#include <thread>
+#include <vector>
+
+#ifdef AURORA_ENABLE_GX
+namespace aurora::gx {
+// Producer pacing feedback for the adaptive slot count, defined in lib/gx/shader_info.cpp;
+// declared here so the C entry point at the bottom of this file can forward to it.
+void report_producer_paced(bool paced) noexcept;
+} // namespace aurora::gx
+#endif
+
+namespace aurora {
+AuroraConfig g_config;
+uint32_t g_sdlCustomEventsStart;
+char g_gameName[4];
+std::atomic<AuroraFrameWorkerWaitCallback> g_frameWorkerWaitCallback{nullptr};
+// Presentation schedule for the frame being sealed, set by the producer. Jobs carry absolute
+// deadlines derived from it, so the presenter cannot drift. Zero means present when ready.
+std::atomic<uint64_t> g_presentScheduleBaseNanos{0};
+std::atomic<uint64_t> g_presentScheduleIntervalNanos{0};
+
+namespace {
+Module Log("aurora");
+
+std::atomic<uint32_t> g_captureFrame{UINT32_MAX};
+std::string g_captureOutputPath;
+
+using PresentClock = std::chrono::steady_clock;
+
+struct PresentTimingSample {
+  PresentClock::time_point presentedAt{};
+  std::chrono::nanoseconds interval{};
+  // Slot carried a copy of the native image instead of replayed interpolation, so the present
+  // counts toward the rate but shows no new motion.
+  bool duplicated = false;
+};
+
+std::mutex g_presentTimingMutex;
+std::array<PresentTimingSample, 512> g_presentTimingSamples{};
+size_t g_presentTimingWriteIndex = 0;
+size_t g_presentTimingSampleCount = 0;
+std::optional<PresentClock::time_point> g_lastSuccessfulPresent;
+uint64_t g_totalPresentCount = 0;
+
+void wait_until_precise(PresentClock::time_point deadline) noexcept {
+  // Busy-spin tail covering the waitable timer's wakeup jitter. 150 us was not enough in
+  // practice; 400 us absorbs the observed overshoot, about 1.6 ms of one core at 240 Hz.
+  constexpr auto kSpinWindow = std::chrono::microseconds(400);
+  auto now = PresentClock::now();
+  if (now >= deadline) {
+    return;
+  }
+
+  const auto timerDeadline = deadline - now > kSpinWindow ? deadline - kSpinWindow : deadline;
+#if defined(_WIN32)
+#ifndef CREATE_WAITABLE_TIMER_HIGH_RESOLUTION
+#define CREATE_WAITABLE_TIMER_HIGH_RESOLUTION 0x00000002
+#endif
+  struct HighResolutionTimer {
+    HANDLE handle = ::CreateWaitableTimerExW(nullptr, nullptr, CREATE_WAITABLE_TIMER_HIGH_RESOLUTION,
+                                             TIMER_MODIFY_STATE | SYNCHRONIZE);
+    ~HighResolutionTimer() {
+      if (handle != nullptr) {
+        ::CloseHandle(handle);
+      }
+    }
+  };
+  static thread_local HighResolutionTimer timer;
+  if (timer.handle != nullptr && timerDeadline > now) {
+    const auto remaining100ns =
+        std::chrono::duration_cast<std::chrono::duration<int64_t, std::ratio<1, 10000000>>>(
+            timerDeadline - now);
+    LARGE_INTEGER due{};
+    due.QuadPart = -std::max<int64_t>(remaining100ns.count(), 1);
+    if (::SetWaitableTimerEx(timer.handle, &due, 0, nullptr, nullptr, nullptr, 0) != FALSE) {
+      ::WaitForSingleObject(timer.handle, INFINITE);
+    }
+  } else
+#endif
+  {
+    std::this_thread::sleep_until(timerDeadline);
+  }
+
+  while (PresentClock::now() < deadline) {
+#if defined(_WIN32)
+    YieldProcessor();
+#else
+    std::this_thread::yield();
+#endif
+  }
+}
+
+void record_successful_present(bool, uint32_t,
+                               std::chrono::nanoseconds,
+                               std::chrono::nanoseconds,
+                               std::chrono::nanoseconds,
+                               std::chrono::nanoseconds,
+                               std::chrono::nanoseconds,
+                               std::chrono::nanoseconds, bool duplicated,
+                               uint32_t, std::chrono::nanoseconds) noexcept {
+  const auto now = PresentClock::now();
+  std::chrono::nanoseconds interval{};
+  {
+    std::lock_guard lock(g_presentTimingMutex);
+    if (g_lastSuccessfulPresent) {
+      interval = std::chrono::duration_cast<std::chrono::nanoseconds>(now - *g_lastSuccessfulPresent);
+    }
+    g_lastSuccessfulPresent = now;
+    g_presentTimingSamples[g_presentTimingWriteIndex] = {
+        .presentedAt = now,
+        .interval = interval,
+        .duplicated = duplicated,
+    };
+    g_presentTimingWriteIndex = (g_presentTimingWriteIndex + 1) % g_presentTimingSamples.size();
+    g_presentTimingSampleCount = std::min(g_presentTimingSampleCount + 1, g_presentTimingSamples.size());
+    ++g_totalPresentCount;
+  }
+}
+
+AuroraPresentTiming snapshot_present_timing() noexcept {
+  constexpr auto kWindow = std::chrono::seconds(1);
+  const auto cutoff = PresentClock::now() - kWindow;
+  std::vector<double> milliseconds;
+  uint64_t totalPresentCount = 0;
+  size_t newMotionSamples = 0;
+  {
+    std::lock_guard lock(g_presentTimingMutex);
+    totalPresentCount = g_totalPresentCount;
+    milliseconds.reserve(g_presentTimingSampleCount);
+    for (size_t i = 0; i < g_presentTimingSampleCount; ++i) {
+      const auto& sample = g_presentTimingSamples[i];
+      if (sample.presentedAt >= cutoff && sample.interval.count() > 0) {
+        milliseconds.push_back(
+            std::chrono::duration<double, std::milli>(sample.interval).count());
+        if (!sample.duplicated) {
+          ++newMotionSamples;
+        }
+      }
+    }
+  }
+
+  AuroraPresentTiming result{
+      .totalPresentCount = totalPresentCount,
+      .sampleCount = static_cast<uint32_t>(milliseconds.size()),
+  };
+  if (milliseconds.empty()) {
+    return result;
+  }
+
+  double totalMilliseconds = 0.0;
+  for (const double value : milliseconds) {
+    totalMilliseconds += value;
+  }
+  result.averageFrameTimeMs = totalMilliseconds / static_cast<double>(milliseconds.size());
+  result.framesPerSecond = result.averageFrameTimeMs > 0.0 ? 1000.0 / result.averageFrameTimeMs : 0.0;
+  // Duplicated presentation slots keep the presented cadence but carry no new
+  // motion; scale them out so this reads as the rate the eye actually sees.
+  result.effectiveFramesPerSecond =
+      result.framesPerSecond *
+      (static_cast<double>(newMotionSamples) / static_cast<double>(milliseconds.size()));
+  for (const double value : milliseconds) {
+    const double difference = value - result.averageFrameTimeMs;
+    result.jitterMs += difference * difference;
+  }
+  result.jitterMs = std::sqrt(result.jitterMs / static_cast<double>(milliseconds.size()));
+  std::sort(milliseconds.begin(), milliseconds.end());
+  result.p95FrameTimeMs =
+      milliseconds[static_cast<size_t>(std::floor(static_cast<double>(milliseconds.size() - 1) * 0.95))];
+  return result;
+}
+
+// ImGui draw data lives in the shared context, so starting the next ImGui frame destroys draw
+// lists the sealed slots still replay. That is why ImGui callers wait for DONE, not SEALED.
+enum class ImGuiFramePolicy {
+  // Start ImGui's next frame as part of renderer preparation, as the
+  // synchronous path always has.
+  Immediate,
+  // Leave it unstarted; the caller owes an imgui::new_frame() once it has
+  // finished replaying this frame's draw data.
+  Deferred,
+};
+
+bool begin_frame_impl(bool pumpEvents, ImGuiFramePolicy imguiPolicy = ImGuiFramePolicy::Immediate,
+                      bool* imguiNewFrameOwed = nullptr) noexcept;
+bool begin_frame_render_state_impl(ImGuiFramePolicy imguiPolicy, bool* imguiNewFrameOwed) noexcept;
+void end_frame_impl(bool pumpEvents, bool drainFifo) noexcept;
+
+// The two publication points of a frame-worker cycle, cleared together under `mutex`. Sealed:
+// producer-shared renderer state is free again. Done: slots encoded, presented, ImGui restarted.
+enum class FrameWorkerPhase {
+  Sealed,
+  Done,
+};
+
+struct FrameWorkerState {
+  std::mutex mutex;
+  std::condition_variable cv;
+  std::thread thread;
+  std::thread::id threadId{};
+  bool started = false;
+  bool stop = false;
+  bool jobPending = false;
+  // Readiness is polled thousands of times per frame, so these flags double as a publication
+  // barrier. `sealed` is released before `ready`, and both are cleared under `mutex`.
+  std::atomic_bool sealed{true};
+  std::atomic_bool ready{true};
+  bool framePrepared = false;
+  bool prepareAllowed = false;
+};
+
+FrameWorkerState g_frameWorker;
+
+bool frame_worker_requested() noexcept {
+#ifdef AURORA_ENABLE_GX
+  static const bool enabled = [] {
+#if defined(_WIN32)
+    // RenderDoc's D3D12 layer is injected before Aurora starts and needs device and command
+    // ownership on one thread, so keep frame submission synchronous there.
+    if (::GetModuleHandleW(L"renderdoc.dll") != nullptr) {
+      return false;
+    }
+#endif
+    return true;
+  }();
+#if defined(_WIN32)
+  static const bool renderDocLoaded = ::GetModuleHandleW(L"renderdoc.dll") != nullptr;
+  if (renderDocLoaded) {
+    static const bool logged = [] {
+      Log.info("Disabled asynchronous frame submission worker for RenderDoc capture");
+      return true;
+    }();
+    (void)logged;
+  }
+#endif
+  return enabled;
+#else
+  return false;
+#endif
+}
+
+#ifdef AURORA_ENABLE_GX
+// Returns false when a stop request was observed mid-cycle.
+bool run_frame_worker_cycle(gfx::SealedFrame& sealedFrame) noexcept;
+#endif
+
+void frame_worker_main() noexcept {
+  {
+    std::lock_guard lock(g_frameWorker.mutex);
+    g_frameWorker.threadId = std::this_thread::get_id();
+  }
+
+#ifdef AURORA_ENABLE_GX
+  // Owned by the worker for its whole lifetime so the sealed pass vector and
+  // its pooled command lists keep their capacity across frames.
+  gfx::SealedFrame sealedFrame;
+#endif
+
+  for (;;) {
+    {
+      std::unique_lock lock(g_frameWorker.mutex);
+      g_frameWorker.cv.wait(lock, [] { return g_frameWorker.stop || g_frameWorker.jobPending; });
+      if (g_frameWorker.stop) {
+        break;
+      }
+      g_frameWorker.jobPending = false;
+    }
+
+    // The CPU already decoded the sealed frame at its GX boundary; the worker only owns
+    // encode/submit/present, so it never touches the producer's next FIFO buffer.
+#ifdef AURORA_ENABLE_GX
+    if (!run_frame_worker_cycle(sealedFrame)) {
+      break;
+    }
+#endif
+  }
+
+  // A stop request can unblock either wait above mid-cycle, so release both phases before
+  // stop_frame_worker() joins.
+  {
+    std::lock_guard lock(g_frameWorker.mutex);
+    g_frameWorker.sealed.store(true, std::memory_order_release);
+    g_frameWorker.ready.store(true, std::memory_order_release);
+  }
+  g_frameWorker.cv.notify_all();
+}
+
+void ensure_frame_worker_started() noexcept {
+  if (!frame_worker_requested()) {
+    return;
+  }
+  std::lock_guard lock(g_frameWorker.mutex);
+  if (g_frameWorker.started) {
+    return;
+  }
+  g_frameWorker.stop = false;
+  g_frameWorker.jobPending = false;
+  g_frameWorker.sealed.store(true, std::memory_order_release);
+  g_frameWorker.ready.store(true, std::memory_order_release);
+  g_frameWorker.prepareAllowed = false;
+  g_frameWorker.started = true;
+  g_frameWorker.thread = std::thread(frame_worker_main);
+  Log.info("Enabled bounded asynchronous frame submission worker");
+}
+
+bool frame_worker_phase_reached(FrameWorkerPhase phase) noexcept {
+  return phase == FrameWorkerPhase::Sealed ? g_frameWorker.sealed.load(std::memory_order_acquire)
+                                           : g_frameWorker.ready.load(std::memory_order_acquire);
+}
+
+bool wait_for_frame_worker_private_for(FrameWorkerPhase phase, std::chrono::microseconds timeout) noexcept;
+
+void wait_for_frame_worker_private(FrameWorkerPhase phase) noexcept {
+  constexpr auto kWaitServiceInterval = std::chrono::milliseconds(1);
+  while (!wait_for_frame_worker_private_for(phase, kWaitServiceInterval)) {
+  }
+}
+
+bool wait_for_frame_worker_private_for(FrameWorkerPhase phase, std::chrono::microseconds timeout) noexcept {
+  // Each phase's state is published before its flag is set, which keeps the common
+  // display-list path out of the worker control mutex.
+  if (frame_worker_phase_reached(phase)) {
+    return true;
+  }
+
+  std::unique_lock lock(g_frameWorker.mutex);
+  if (!g_frameWorker.started || g_frameWorker.threadId == std::this_thread::get_id()) {
+    return true;
+  }
+  if (timeout <= std::chrono::microseconds::zero()) {
+    return frame_worker_phase_reached(phase);
+  }
+
+  const bool reached =
+      g_frameWorker.cv.wait_for(lock, timeout, [phase] { return frame_worker_phase_reached(phase); });
+  if (reached) {
+    return true;
+  }
+
+  lock.unlock();
+  // Both phases service the guest's alarm/retrace pump identically; the
+  // producer must keep its own timing alive however long it waits.
+  if (const auto callback = g_frameWorkerWaitCallback.load(std::memory_order_acquire)) {
+    callback();
+  }
+  return false;
+}
+
+void stop_frame_worker() noexcept {
+  {
+    std::lock_guard lock(g_frameWorker.mutex);
+    if (!g_frameWorker.started) {
+      return;
+    }
+    g_frameWorker.stop = true;
+    g_frameWorker.prepareAllowed = true;
+  }
+  g_frameWorker.cv.notify_all();
+  if (g_frameWorker.thread.joinable()) {
+    g_frameWorker.thread.join();
+  }
+  std::lock_guard lock(g_frameWorker.mutex);
+  g_frameWorker.started = false;
+  g_frameWorker.threadId = {};
+  g_frameWorker.framePrepared = false;
+}
+
+uint32_t align_to(uint32_t value, uint32_t alignment) noexcept {
+  return (value + alignment - 1) & ~(alignment - 1);
+}
+
+void append_u16(std::ofstream& out, uint16_t value) {
+  const char bytes[] = {static_cast<char>(value), static_cast<char>(value >> 8)};
+  out.write(bytes, sizeof(bytes));
+}
+
+void append_u32(std::ofstream& out, uint32_t value) {
+  const char bytes[] = {static_cast<char>(value), static_cast<char>(value >> 8),
+                        static_cast<char>(value >> 16), static_cast<char>(value >> 24)};
+  out.write(bytes, sizeof(bytes));
+}
+
+bool write_bmp(const char* path, const uint8_t* pixels, uint32_t width, uint32_t height,
+               uint32_t bytesPerRow, bool bgra) {
+  std::ofstream out(path, std::ios::binary | std::ios::trunc);
+  if (!out) return false;
+  constexpr uint32_t pixelOffset = 14 + 40;
+  const uint32_t imageSize = width * height * 4;
+  out.write("BM", 2);
+  append_u32(out, pixelOffset + imageSize);
+  append_u16(out, 0);
+  append_u16(out, 0);
+  append_u32(out, pixelOffset);
+  append_u32(out, 40);
+  append_u32(out, width);
+  append_u32(out, height);
+  append_u16(out, 1);
+  append_u16(out, 32);
+  append_u32(out, 0);
+  append_u32(out, imageSize);
+  append_u32(out, 2835);
+  append_u32(out, 2835);
+  append_u32(out, 0);
+  append_u32(out, 0);
+  std::vector<uint8_t> row(width * 4);
+  for (uint32_t y = height; y-- > 0;) {
+    const auto* source = pixels + static_cast<size_t>(y) * bytesPerRow;
+    if (bgra) {
+      out.write(reinterpret_cast<const char*>(source), row.size());
+    } else {
+      for (uint32_t x = 0; x < width; ++x) {
+        row[x * 4 + 0] = source[x * 4 + 2];
+        row[x * 4 + 1] = source[x * 4 + 1];
+        row[x * 4 + 2] = source[x * 4 + 0];
+        row[x * 4 + 3] = source[x * 4 + 3];
+      }
+      out.write(reinterpret_cast<const char*>(row.data()), row.size());
+    }
+  }
+  return out.good();
+}
+
+#ifdef AURORA_ENABLE_GX
+// GPU
+using webgpu::g_device;
+using webgpu::g_instance;
+using webgpu::g_queue;
+using webgpu::g_surface;
+std::recursive_mutex g_rendererGpuMutex;
+std::mutex g_queueSubmitMutex;
+// Surface ownership, held apart from the renderer mutex: a presentation slot touches the surface,
+// its image and the queue, nothing recorded. Lock order is surface then renderer.
+std::mutex g_surfaceMutex;
+std::atomic<bool> g_surfaceReconfigurePending{false};
+std::atomic<bool> g_surfaceRecreatePending{false};
+
+void request_surface_reconfigure() noexcept {
+  g_surfaceReconfigurePending.store(true, std::memory_order_release);
+}
+
+void request_surface_recreate() noexcept {
+  g_surfaceRecreatePending.store(true, std::memory_order_release);
+  g_surfaceReconfigurePending.store(true, std::memory_order_release);
+}
+
+struct PendingFrameCapture {
+  wgpu::Buffer buffer;
+  uint32_t width = 0;
+  uint32_t height = 0;
+  uint32_t bytesPerRow = 0;
+  uint64_t bufferSize = 0;
+  bool bgra = false;
+  std::string path;
+};
+
+std::optional<PendingFrameCapture> encode_frame_capture(const wgpu::CommandEncoder& encoder,
+                                                        const webgpu::PresentSource& source) {
+  const uint32_t requestedFrame = g_captureFrame.load(std::memory_order_acquire);
+  const uint32_t currentFrame = gfx::current_frame();
+  if (requestedFrame == UINT32_MAX || currentFrame < requestedFrame) return std::nullopt;
+  g_captureFrame.store(UINT32_MAX, std::memory_order_release);
+  if (currentFrame != requestedFrame) {
+    Log.error("Missed requested frame capture {} (current frame {})", requestedFrame, currentFrame);
+    return std::nullopt;
+  }
+  if (!source.texture || source.size.width == 0 || source.size.height == 0) {
+    Log.error("Frame {} capture has no present-source texture", currentFrame);
+    return std::nullopt;
+  }
+  const bool bgra = source.format == wgpu::TextureFormat::BGRA8Unorm ||
+                    source.format == wgpu::TextureFormat::BGRA8UnormSrgb;
+  const bool rgba = source.format == wgpu::TextureFormat::RGBA8Unorm ||
+                    source.format == wgpu::TextureFormat::RGBA8UnormSrgb;
+  if (!bgra && !rgba) {
+    Log.error("Frame {} capture does not support texture format {}", currentFrame,
+              magic_enum::enum_name(source.format));
+    return std::nullopt;
+  }
+  const uint32_t bytesPerRow = align_to(source.size.width * 4, 256);
+  const uint64_t bufferSize = static_cast<uint64_t>(bytesPerRow) * source.size.height;
+  const wgpu::BufferDescriptor descriptor{
+      .label = "Visual validation frame capture",
+      .usage = wgpu::BufferUsage::CopyDst | wgpu::BufferUsage::MapRead,
+      .size = bufferSize,
+  };
+  auto buffer = g_device.CreateBuffer(&descriptor);
+  const wgpu::TexelCopyTextureInfo sourceInfo{
+      .texture = source.texture,
+      .mipLevel = 0,
+      .origin = {0, 0, 0},
+      .aspect = wgpu::TextureAspect::All,
+  };
+  const wgpu::TexelCopyBufferInfo destinationInfo{
+      .layout = {.offset = 0, .bytesPerRow = bytesPerRow, .rowsPerImage = source.size.height},
+      .buffer = buffer,
+  };
+  encoder.CopyTextureToBuffer(&sourceInfo, &destinationInfo, &source.size);
+  return PendingFrameCapture{
+      .buffer = std::move(buffer),
+      .width = source.size.width,
+      .height = source.size.height,
+      .bytesPerRow = bytesPerRow,
+      .bufferSize = bufferSize,
+      .bgra = bgra,
+      .path = g_captureOutputPath,
+  };
+}
+
+void complete_frame_capture(PendingFrameCapture& capture) {
+  wgpu::MapAsyncStatus mapStatus = wgpu::MapAsyncStatus::CallbackCancelled;
+  wgpu::StringView mapMessage{};
+  const auto future = capture.buffer.MapAsync(
+      wgpu::MapMode::Read, 0, capture.bufferSize, wgpu::CallbackMode::WaitAnyOnly,
+      [&mapStatus, &mapMessage](wgpu::MapAsyncStatus status, wgpu::StringView message) {
+        mapStatus = status;
+        mapMessage = message;
+      });
+  const auto waitStatus = g_instance.WaitAny(future, 5000000000);
+  if (waitStatus != wgpu::WaitStatus::Success || mapStatus != wgpu::MapAsyncStatus::Success) {
+    Log.error("Frame capture readback failed wait={} map={} message={}", magic_enum::enum_name(waitStatus),
+              magic_enum::enum_name(mapStatus), mapMessage);
+    return;
+  }
+  const auto* pixels = static_cast<const uint8_t*>(capture.buffer.GetConstMappedRange(0, capture.bufferSize));
+  if (write_bmp(capture.path.c_str(), pixels, capture.width, capture.height, capture.bytesPerRow, capture.bgra)) {
+    Log.info("Captured rendered frame to '{}' ({}x{})", capture.path, capture.width, capture.height);
+  } else {
+    Log.error("Failed to write rendered frame capture to '{}'", capture.path);
+  }
+  capture.buffer.Unmap();
+}
+#endif
+
+// AuroraBackend is an anonymous C typedef enum, which magic_enum cannot
+// reflect under this toolchain -- name it by hand for diagnostics.
+constexpr const char* backend_name(AuroraBackend backend) noexcept {
+  switch (backend) {
+  case BACKEND_AUTO:
+    return "Auto";
+  case BACKEND_D3D11:
+    return "D3D11";
+  case BACKEND_D3D12:
+    return "D3D12";
+  case BACKEND_METAL:
+    return "Metal";
+  case BACKEND_VULKAN:
+    return "Vulkan";
+  case BACKEND_OPENGL:
+    return "OpenGL";
+  case BACKEND_OPENGLES:
+    return "OpenGLES";
+  case BACKEND_WEBGPU:
+    return "WebGPU";
+  case BACKEND_NULL:
+    return "Null";
+  }
+  return "Unknown";
+}
+
+#ifdef AURORA_ENABLE_GX
+constexpr std::array PreferredBackendOrder{
+#ifdef ENABLE_BACKEND_WEBGPU
+    BACKEND_WEBGPU,
+#endif
+#ifdef DAWN_ENABLE_BACKEND_D3D12
+    BACKEND_D3D12,
+#endif
+#if defined(_WIN32) && defined(DAWN_ENABLE_BACKEND_D3D11)
+    BACKEND_D3D11,
+#endif
+#ifdef DAWN_ENABLE_BACKEND_METAL
+    BACKEND_METAL,
+#endif
+#ifdef DAWN_ENABLE_BACKEND_VULKAN
+    BACKEND_VULKAN,
+#endif
+#if !defined(_WIN32) && defined(DAWN_ENABLE_BACKEND_D3D11)
+    BACKEND_D3D11,
+#endif
+// #ifdef DAWN_ENABLE_BACKEND_DESKTOP_GL
+//     BACKEND_OPENGL,
+// #endif
+// #ifdef DAWN_ENABLE_BACKEND_OPENGLES
+//     BACKEND_OPENGLES,
+// #endif
+#ifdef DAWN_ENABLE_BACKEND_NULL
+    BACKEND_NULL,
+#endif
+};
+#else
+constexpr std::array<AuroraBackend, 0> PreferredBackendOrder{};
+#endif
+
+bool g_initialFrame = false;
+
+
+AuroraInfo initialize(int argc, char* argv[], const AuroraConfig& config) noexcept {
+  g_config = config;
+  Log.info("Aurora initializing");
+  log_system_information();
+  if (g_config.appName == nullptr) {
+    g_config.appName = "Aurora";
+  } else {
+    g_config.appName = strdup(g_config.appName);
+  }
+  if (g_config.userPath == nullptr) {
+    g_config.userPath = SDL_GetPrefPath(nullptr, g_config.appName);
+  } else {
+    g_config.userPath = strdup(g_config.userPath);
+  }
+  if (g_config.cachePath == nullptr) {
+    g_config.cachePath = SDL_GetPrefPath(nullptr, g_config.appName);
+  } else {
+    g_config.cachePath = strdup(g_config.cachePath);
+  }
+  if (g_config.resourcesPath == nullptr) {
+    g_config.resourcesPath = SDL_GetBasePath();
+  } else {
+    g_config.resourcesPath = strdup(g_config.resourcesPath);
+  }
+  if (g_config.pipelineCachePath == nullptr) {
+    g_config.pipelineCachePath = g_config.cachePath;
+  } else {
+    g_config.pipelineCachePath = strdup(g_config.pipelineCachePath);
+  }
+  if (g_config.msaa == 0) {
+    g_config.msaa = 1;
+  }
+  if (g_config.maxTextureAnisotropy == 0) {
+    g_config.maxTextureAnisotropy = 16;
+  }
+  ASSERT(window::initialize(), "Error initializing window");
+
+  g_sdlCustomEventsStart = SDL_RegisterEvents(2);
+  ASSERT(g_sdlCustomEventsStart, "Failed to allocate user events: {}", SDL_GetError());
+  ASSERT(window::initialize_event_watch(), "Error initializing SDL event watch");
+
+#ifdef AURORA_ENABLE_GX
+  /* Attempt to create a window using the calling application's desired backend */
+  const AuroraBackend requestedBackend = config.desiredBackend;
+  AuroraBackend selectedBackend = requestedBackend;
+  bool windowCreated = false;
+  if (selectedBackend != BACKEND_AUTO) {
+    Log.info("Requested graphics backend: {}", backend_name(selectedBackend));
+    if (window::create_window(selectedBackend)) {
+      if (webgpu::initialize(selectedBackend)) {
+        windowCreated = true;
+      } else {
+        window::destroy_window();
+      }
+    } else {
+      Log.error("Failed to create a window for backend {}: {}", backend_name(selectedBackend),
+                SDL_GetError());
+    }
+    if (!windowCreated) {
+      /* An explicitly requested backend that cannot be brought up falls back to the BACKEND_AUTO
+       * search instead of aborting, and the substitution is always reported. */
+      Log.error("Requested graphics backend {} is unavailable on this system; "
+                "falling back to automatic selection",
+                backend_name(requestedBackend));
+    }
+  }
+
+  if (!windowCreated) {
+    for (const auto backendType : PreferredBackendOrder) {
+      selectedBackend = backendType;
+      if (!window::create_window(selectedBackend)) {
+        continue;
+      }
+      if (webgpu::initialize(selectedBackend)) {
+        windowCreated = true;
+        break;
+      } else {
+        window::destroy_window();
+      }
+    }
+  }
+
+  ASSERT(windowCreated, "Error creating window: {}", SDL_GetError());
+  if (requestedBackend != BACKEND_AUTO && selectedBackend != requestedBackend) {
+    Log.error("Graphics backend fallback in effect: video.graphics_api requested {}, "
+              "running on {}",
+              backend_name(requestedBackend), backend_name(selectedBackend));
+  }
+
+  // Initialize SDL_Renderer for ImGui when we can't use a Dawn backend
+  if (webgpu::g_backendType == wgpu::BackendType::Null) {
+    ASSERT(window::create_renderer(), "Failed to initialize SDL renderer: {}", SDL_GetError());
+  }
+#else
+  AuroraBackend selectedBackend = BACKEND_NULL;
+  ASSERT(window::create_window(BACKEND_NULL), "Error creating window: {}", SDL_GetError());
+  ASSERT(window::create_renderer(), "Failed to initialize SDL renderer: {}", SDL_GetError());
+#endif
+
+  window::show_window();
+
+#ifdef AURORA_ENABLE_GX
+  gfx::initialize();
+
+  imgui::create_context();
+#endif
+  const auto size = window::get_window_size();
+  Log.info("Using framebuffer size {}x{} scale {}", size.fb_width, size.fb_height, size.scale);
+#ifdef AURORA_ENABLE_GX
+  if (g_config.imGuiInitCallback != nullptr) {
+    g_config.imGuiInitCallback(&size);
+  }
+  imgui::initialize();
+#endif
+
+  g_initialFrame = true;
+  g_config.desiredBackend = selectedBackend;
+  return {
+      .backend = selectedBackend,
+      .userPath = g_config.userPath,
+      .cachePath = g_config.cachePath,
+      .window = window::get_sdl_window(),
+      .windowSize = size,
+  };
+}
+
+#ifdef AURORA_ENABLE_GX
+struct AcquiredSurfaceTexture {
+  wgpu::Texture texture;
+  wgpu::TextureView view;
+};
+
+std::optional<AcquiredSurfaceTexture> acquire_surface_texture() noexcept {
+  if (!window::is_presentable()) {
+    request_surface_reconfigure();
+    return std::nullopt;
+  }
+  if (!g_surface) {
+    request_surface_reconfigure();
+    return std::nullopt;
+  }
+
+  wgpu::SurfaceTexture surfaceTexture;
+  g_surface.GetCurrentTexture(&surfaceTexture);
+  switch (surfaceTexture.status) {
+  case wgpu::SurfaceGetCurrentTextureStatus::SuccessOptimal:
+    return AcquiredSurfaceTexture{
+        .texture = surfaceTexture.texture,
+        .view = surfaceTexture.texture.CreateView(),
+    };
+  case wgpu::SurfaceGetCurrentTextureStatus::SuccessSuboptimal:
+    Log.info("Surface texture is suboptimal, deferring swapchain reconfiguration");
+    request_surface_reconfigure();
+    return AcquiredSurfaceTexture{
+        .texture = surfaceTexture.texture,
+        .view = surfaceTexture.texture.CreateView(),
+    };
+  case wgpu::SurfaceGetCurrentTextureStatus::Timeout:
+    Log.warn("Surface texture acquisition timed out");
+    return std::nullopt;
+  case wgpu::SurfaceGetCurrentTextureStatus::Outdated:
+    Log.info("Surface texture is {}, reconfiguring swapchain", magic_enum::enum_name(surfaceTexture.status));
+    request_surface_reconfigure();
+    return std::nullopt;
+  case wgpu::SurfaceGetCurrentTextureStatus::Lost:
+    Log.warn("Surface texture is {}, requesting surface recreation", magic_enum::enum_name(surfaceTexture.status));
+    request_surface_recreate();
+    return std::nullopt;
+  case wgpu::SurfaceGetCurrentTextureStatus::Error:
+    Log.warn("Surface texture is {}, deferring surface recovery", magic_enum::enum_name(surfaceTexture.status));
+    request_surface_reconfigure();
+    return std::nullopt;
+  default:
+    Log.error("Failed to get surface texture: {}", magic_enum::enum_name(surfaceTexture.status));
+    return std::nullopt;
+  }
+}
+
+struct PresentationImage {
+  webgpu::TextureWithSampler texture;
+  wgpu::BindGroup bindGroup;
+};
+
+struct PresentationJob {
+  std::shared_ptr<PresentationImage> image;
+  uint32_t logicalFrame = 0;
+  // Absolute deadline on PresentClock stamped by the producer's schedule.
+  // Default (epoch) means "present as soon as ready" (no software pacing).
+  PresentClock::time_point presentAt{};
+  bool interpolated = false;
+  // Slot carries a copy of the native image rather than a replayed interpolation. It counts as a
+  // present but not toward effectiveFramesPerSecond.
+  bool duplicated = false;
+  // Whole display periods the group slid forward at encode time (late group).
+  uint32_t slidPeriods = 0;
+};
+
+std::array<std::vector<std::shared_ptr<PresentationImage>>, gx::MaxInterpolatedFrames + 1>
+    g_presentationImagePools;
+
+std::shared_ptr<PresentationImage> acquire_presentation_image(size_t slot, uint32_t width,
+                                                              uint32_t height) {
+  auto& pool = g_presentationImagePools.at(slot);
+  // A use count of one means only the pool holds the image, so no job can be reading it. Idle
+  // images from an older surface size are dropped here instead of leaking for the run.
+  for (auto it = pool.begin(); it != pool.end();) {
+    const auto& image = *it;
+    if (image->texture.size.width == width && image->texture.size.height == height) {
+      if (image.use_count() == 1) {
+        return image;
+      }
+      ++it;
+      continue;
+    }
+    if (image.use_count() == 1) {
+      it = pool.erase(it);
+    } else {
+      ++it;
+    }
+  }
+
+  auto image = std::make_shared<PresentationImage>();
+  image->texture = webgpu::create_render_texture(width, height, false);
+  image->bindGroup = webgpu::create_copy_bind_group(image->texture);
+  pool.emplace_back(image);
+  return image;
+}
+
+bool present_presentation_job(const PresentationJob& job) {
+  ZoneScoped;
+  const auto submissionStarted = PresentClock::now();
+  // Keep the threshold far above compositor and scheduling jitter. The timings below separate a
+  // real surface stall from a bad deadline, and only the former needs a rebuild.
+  constexpr auto kSurfaceStallThreshold = std::chrono::milliseconds(250);
+  std::chrono::nanoseconds surfaceLockDuration{};
+  std::chrono::nanoseconds acquireDuration{};
+  std::chrono::nanoseconds encodeDuration{};
+  std::chrono::nanoseconds finishDuration{};
+  std::chrono::nanoseconds submitDuration{};
+  std::chrono::nanoseconds scheduleWaitDuration{};
+  std::chrono::nanoseconds presentDuration{};
+  bool presented = false;
+  if (g_surfaceReconfigurePending.load(std::memory_order_acquire) ||
+      window::native_resize_pending() || !window::is_presentable()) {
+    return false;
+  }
+  std::chrono::nanoseconds lateBy{};
+  if (job.presentAt != PresentClock::time_point{}) {
+    // How expired the deadline already is at dequeue. Positive values mean the
+    // slot cannot be paced and fires immediately, which is a burst symptom.
+    lateBy = std::chrono::duration_cast<std::chrono::nanoseconds>(PresentClock::now() -
+                                                                  job.presentAt);
+  }
+  {
+    window::SurfaceLock surfaceLock;
+    // Acquire, encode, submit and present are one unit against a configured swapchain, so the
+    // surface lock covers all of them. The renderer mutex is deliberately not taken.
+    const auto surfaceLockStarted = PresentClock::now();
+    std::unique_lock surfaceOwnership(g_surfaceMutex);
+    surfaceLockDuration = std::chrono::duration_cast<std::chrono::nanoseconds>(
+        PresentClock::now() - surfaceLockStarted);
+    // Surface contention is waiting, not encoding, so keep it out of the encode timing where a
+    // reconfigure would look like GPU command recording.
+    const auto workStarted = PresentClock::now();
+    bool surfaceSizeChanged = window::native_resize_pending();
+    if (!surfaceSizeChanged &&
+        !g_surfaceReconfigurePending.load(std::memory_order_acquire) &&
+        window::is_presentable() && g_surface) {
+      // native_window_size_matches compares the OS client size with the configured swapchain, which is
+      // what native_fb_* reports. One window query instead of SDL's per-call ones.
+      surfaceSizeChanged = !window::native_window_size_matches(
+          webgpu::g_graphicsConfig.surfaceConfiguration.width,
+          webgpu::g_graphicsConfig.surfaceConfiguration.height);
+    }
+    if (!surfaceSizeChanged && window::is_presentable()) {
+      const auto acquireStarted = PresentClock::now();
+      auto acquired = acquire_surface_texture();
+      acquireDuration =
+          std::chrono::duration_cast<std::chrono::nanoseconds>(PresentClock::now() - acquireStarted);
+      if (acquired) {
+        const wgpu::CommandEncoderDescriptor encoderDescriptor{
+            .label = "Presentation encoder",
+        };
+        const auto encoder = g_device.CreateCommandEncoder(&encoderDescriptor);
+        const std::array attachments{
+            wgpu::RenderPassColorAttachment{
+                .view = acquired->view,
+                .loadOp = wgpu::LoadOp::Clear,
+                .storeOp = wgpu::StoreOp::Store,
+            },
+        };
+        const wgpu::RenderPassDescriptor renderPassDescriptor{
+            .label = "Presentation copy pass",
+            .colorAttachmentCount = attachments.size(),
+            .colorAttachments = attachments.data(),
+        };
+        const auto pass = encoder.BeginRenderPass(&renderPassDescriptor);
+        pass.SetPipeline(webgpu::g_CopyPipeline);
+        pass.SetBindGroup(0, job.image->bindGroup, 0, nullptr);
+        pass.SetViewport(0.f, 0.f,
+                         static_cast<float>(webgpu::g_graphicsConfig.surfaceConfiguration.width),
+                         static_cast<float>(webgpu::g_graphicsConfig.surfaceConfiguration.height),
+                         0.f, 1.f);
+        pass.Draw(3);
+        pass.End();
+        const auto encodeFinished = PresentClock::now();
+        encodeDuration = std::chrono::duration_cast<std::chrono::nanoseconds>(
+            encodeFinished - workStarted - acquireDuration);
+        const wgpu::CommandBufferDescriptor cmdBufDescriptor{
+            .label = "Presentation command buffer",
+        };
+        const auto finishStarted = PresentClock::now();
+        const auto buffer = encoder.Finish(&cmdBufDescriptor);
+        finishDuration = std::chrono::duration_cast<std::chrono::nanoseconds>(
+            PresentClock::now() - finishStarted);
+        const auto submitStarted = PresentClock::now();
+        {
+          std::lock_guard submitLock(g_queueSubmitMutex);
+          g_queue.Submit(1, &buffer);
+        }
+        submitDuration = std::chrono::duration_cast<std::chrono::nanoseconds>(
+            PresentClock::now() - submitStarted);
+        // Pace the Present() call itself, not the whole unit, so acquire/encode/submit variance stays out
+        // of the cadence. Holding the image across the wait is safe while the surface lock is held.
+        if (job.presentAt != PresentClock::time_point{}) {
+          const auto scheduleWaitStarted = PresentClock::now();
+          wait_until_precise(job.presentAt);
+          scheduleWaitDuration = std::chrono::duration_cast<std::chrono::nanoseconds>(
+              PresentClock::now() - scheduleWaitStarted);
+        }
+        // A native resize can arrive after acquisition, so drop the obsolete image and let the render
+        // worker reconfigure at its ordered frame boundary.
+        if (!g_surfaceReconfigurePending.load(std::memory_order_acquire) &&
+            !window::native_resize_pending() && window::is_presentable() &&
+            window::native_window_size_matches(
+                webgpu::g_graphicsConfig.surfaceConfiguration.width,
+                webgpu::g_graphicsConfig.surfaceConfiguration.height)) {
+          const auto presentStarted = PresentClock::now();
+          wgpu::Status presentStatus;
+          {
+            std::lock_guard submitLock(g_queueSubmitMutex);
+            presentStatus = g_surface.Present();
+          }
+          presentDuration = std::chrono::duration_cast<std::chrono::nanoseconds>(
+              PresentClock::now() - presentStarted);
+          if (presentStatus == wgpu::Status::Success) {
+            presented = true;
+            record_successful_present(
+                job.interpolated, job.logicalFrame, acquireDuration, encodeDuration,
+                finishDuration, submitDuration, presentDuration,
+                std::chrono::duration_cast<std::chrono::nanoseconds>(PresentClock::now() -
+                                                                     submissionStarted),
+                job.duplicated, job.slidPeriods, lateBy);
+          } else {
+            Log.warn("Surface present failed: {}", static_cast<int>(presentStatus));
+            request_surface_reconfigure();
+          }
+        }
+        acquired.reset();
+      }
+    }
+  }
+  const auto totalDuration =
+      std::chrono::duration_cast<std::chrono::nanoseconds>(PresentClock::now() - submissionStarted);
+  constexpr int kStallRebuildThreshold = 3;
+  constexpr auto kStallRebuildCooldown = std::chrono::seconds(5);
+  static int s_consecutiveStalledPresents = 0;
+  static PresentClock::time_point s_lastStallRebuild{};
+  if (totalDuration >= kSurfaceStallThreshold) {
+    const auto surfaceWorkDuration =
+        acquireDuration + encodeDuration + finishDuration + submitDuration + presentDuration;
+    const bool surfaceStalled = surfaceWorkDuration >= kSurfaceStallThreshold;
+    bool rebuildRequested = false;
+    if (surfaceStalled) {
+      ++s_consecutiveStalledPresents;
+      const auto now = PresentClock::now();
+      if (s_consecutiveStalledPresents >= kStallRebuildThreshold &&
+          (s_lastStallRebuild == PresentClock::time_point{} ||
+           now - s_lastStallRebuild >= kStallRebuildCooldown)) {
+        s_lastStallRebuild = now;
+        s_consecutiveStalledPresents = 0;
+        rebuildRequested = true;
+      }
+    } else {
+      s_consecutiveStalledPresents = 0;
+    }
+    Log.warn("Presentation job took {:.1f} ms (surface lock {:.1f}, acquire {:.1f}, encode {:.1f}, "
+             "finish {:.1f}, submit {:.1f}, schedule wait {:.1f}, present {:.1f}){}",
+             std::chrono::duration<double, std::milli>(totalDuration).count(),
+             std::chrono::duration<double, std::milli>(surfaceLockDuration).count(),
+             std::chrono::duration<double, std::milli>(acquireDuration).count(),
+             std::chrono::duration<double, std::milli>(encodeDuration).count(),
+             std::chrono::duration<double, std::milli>(finishDuration).count(),
+             std::chrono::duration<double, std::milli>(submitDuration).count(),
+             std::chrono::duration<double, std::milli>(scheduleWaitDuration).count(),
+             std::chrono::duration<double, std::milli>(presentDuration).count(),
+             rebuildRequested ? "; rebuilding the surface" : "");
+    if (rebuildRequested) {
+      request_surface_reconfigure();
+    }
+  } else {
+    s_consecutiveStalledPresents = 0;
+  }
+  return presented;
+}
+
+struct PresenterState {
+  std::mutex mutex;
+  std::condition_variable cv;
+  std::thread thread;
+  std::deque<PresentationJob> jobs;
+  bool started = false;
+  bool stop = false;
+  bool presenting = false;
+};
+
+PresenterState g_presenter;
+std::atomic<bool> g_presenterStarted{false};
+
+void presenter_main() noexcept {
+  if (!SDL_SetCurrentThreadPriority(SDL_THREAD_PRIORITY_HIGH)) {
+    Log.warn("Could not raise the asynchronous presenter thread priority: {}", SDL_GetError());
+  }
+  for (;;) {
+    PresentationJob job;
+    {
+      std::unique_lock lock(g_presenter.mutex);
+      g_presenter.cv.wait(lock, [] { return g_presenter.stop || !g_presenter.jobs.empty(); });
+      if (g_presenter.stop && g_presenter.jobs.empty()) {
+        break;
+      }
+      job = std::move(g_presenter.jobs.front());
+      g_presenter.jobs.pop_front();
+      g_presenter.presenting = true;
+    }
+    g_presenter.cv.notify_all();
+
+    present_presentation_job(job);
+
+    {
+      std::lock_guard lock(g_presenter.mutex);
+      g_presenter.presenting = false;
+    }
+    g_presenter.cv.notify_all();
+  }
+}
+
+void ensure_presenter_started() {
+  std::lock_guard lock(g_presenter.mutex);
+  if (g_presenter.started) {
+    return;
+  }
+  g_presenter.stop = false;
+  g_presenter.presenting = false;
+  g_presenter.thread = std::thread(presenter_main);
+  g_presenter.started = true;
+  g_presenterStarted.store(true, std::memory_order_release);
+  Log.info("Enabled bounded asynchronous presentation worker");
+}
+
+void wait_for_presenter_idle() noexcept {
+  if (!g_presenterStarted.load(std::memory_order_acquire)) {
+    return;
+  }
+  std::unique_lock lock(g_presenter.mutex);
+  g_presenter.cv.wait(
+      lock, [] { return g_presenter.jobs.empty() && !g_presenter.presenting; });
+}
+
+void enqueue_presentations(std::vector<PresentationJob>&& jobs) {
+  ensure_presenter_started();
+  // Scale the bound with the group being handed over: a 240 Hz frame enqueues four jobs at once,
+  // and a bound sized for two groups blocked the frame worker on a draining one.
+  const size_t maximumQueuedJobs =
+      (std::max)(static_cast<size_t>(2 * (gx::MaxInterpolatedFrames + 1)), 3 * jobs.size());
+  std::unique_lock lock(g_presenter.mutex);
+  if (g_presenter.stop) {
+    return;
+  }
+  if (g_presenter.jobs.size() + jobs.size() > maximumQueuedJobs) {
+    // Presentation is a real-time stream, not a lossless queue: waiting for room couples the guest
+    // and audio clocks to a blocked Present(). Keep the newest group and drop obsolete images.
+    const size_t dropped = g_presenter.jobs.size();
+    g_presenter.jobs.clear();
+    if (dropped != 0) {
+      // A stuck Present can keep replacement mode active for a while.  Aggregate
+      // the warning instead of turning a driver stall into a log flood.
+      static size_t droppedSinceWarning = 0;
+      static PresentClock::time_point lastWarning{};
+      droppedSinceWarning += dropped;
+      const auto now = PresentClock::now();
+      if (lastWarning == PresentClock::time_point{} || now - lastWarning >= std::chrono::seconds(1)) {
+        Log.warn("Presenter fell behind; dropped {} stale presentation jobs", droppedSinceWarning);
+        droppedSinceWarning = 0;
+        lastWarning = now;
+      }
+    }
+  }
+  for (auto& job : jobs) {
+    g_presenter.jobs.emplace_back(std::move(job));
+  }
+  lock.unlock();
+  g_presenter.cv.notify_all();
+}
+
+void stop_presenter() noexcept {
+  if (!g_presenterStarted.load(std::memory_order_acquire)) {
+    return;
+  }
+  {
+    std::lock_guard lock(g_presenter.mutex);
+    g_presenter.stop = true;
+  }
+  g_presenter.cv.notify_all();
+  if (g_presenter.thread.joinable()) {
+    g_presenter.thread.join();
+  }
+  {
+    std::lock_guard lock(g_presenter.mutex);
+    g_presenter.jobs.clear();
+    g_presenter.started = false;
+    g_presenter.presenting = false;
+  }
+  g_presenterStarted.store(false, std::memory_order_release);
+}
+
+// `presentSource` is latched in the seal prologue: by the time this encodes, the producer's next
+// gfx::begin_frame() may already have cleared the display-copy override.
+void encode_presentation_snapshot(const wgpu::CommandEncoder& encoder,
+                                  const webgpu::PresentSource& presentSource,
+                                  const PresentationImage& image,
+                                  bool includeImGui) {
+  ZoneScoped;
+  auto viewport = webgpu::calculate_present_viewport(
+      image.texture.size.width, image.texture.size.height, presentSource.size.width,
+      presentSource.size.height);
+  float presentAspect = 0.f;
+  if (window::get_present_aspect_ratio(presentAspect)) {
+    viewport = webgpu::calculate_present_viewport_for_aspect(
+        image.texture.size.width, image.texture.size.height, presentAspect);
+  }
+  wgpu::BindGroup presentBindGroup = presentSource.bindGroup;
+  {
+    const std::array attachments{
+        wgpu::RenderPassColorAttachment{
+            .view = image.texture.view,
+            .loadOp = wgpu::LoadOp::Clear,
+            .storeOp = wgpu::StoreOp::Store,
+        },
+    };
+    const wgpu::RenderPassDescriptor renderPassDescriptor{
+        .label = "Interpolation snapshot pass",
+        .colorAttachmentCount = attachments.size(),
+        .colorAttachments = attachments.data(),
+    };
+    const auto pass = encoder.BeginRenderPass(&renderPassDescriptor);
+    pass.SetPipeline(webgpu::g_CopyPipeline);
+    pass.SetBindGroup(0, presentBindGroup, 0, nullptr);
+    pass.SetViewport(viewport.left, viewport.top, viewport.width, viewport.height,
+                     viewport.znear, viewport.zfar);
+    pass.Draw(3);
+    pass.End();
+  }
+  if (includeImGui) {
+    const std::array attachments{
+        wgpu::RenderPassColorAttachment{
+            .view = image.texture.view,
+            .loadOp = wgpu::LoadOp::Load,
+            .storeOp = wgpu::StoreOp::Store,
+        },
+    };
+    const wgpu::RenderPassDescriptor renderPassDescriptor{
+        .label = "Snapshot ImGui pass",
+        .colorAttachmentCount = attachments.size(),
+        .colorAttachments = attachments.data(),
+    };
+    const auto pass = encoder.BeginRenderPass(&renderPassDescriptor);
+    pass.SetViewport(0.f, 0.f, static_cast<float>(image.texture.size.width),
+                     static_cast<float>(image.texture.size.height), 0.f, 1.f);
+    imgui::render(pass);
+    pass.End();
+  }
+}
+#endif
+
+void shutdown() noexcept {
+  stop_frame_worker();
+#ifdef AURORA_ENABLE_GX
+  stop_presenter();
+  g_presentationImagePools = {};
+  imgui::shutdown();
+  gfx::shutdown();
+  webgpu::shutdown();
+#endif
+  input::shutdown();
+  window::shutdown();
+}
+
+const AuroraEvent* update() noexcept {
+  ZoneScoped;
+  if (g_initialFrame) {
+    g_initialFrame = false;
+    input::initialize();
+  }
+  return window::poll_events();
+}
+
+bool begin_frame_impl(bool pumpEvents, ImGuiFramePolicy imguiPolicy, bool* imguiNewFrameOwed) noexcept {
+  ZoneScoped;
+#ifdef AURORA_ENABLE_GX
+  webgpu::fail_if_device_lost();
+  if (pumpEvents) {
+    window::pump_events();
+  }
+  const bool surfaceReconfigurePending =
+      g_surfaceReconfigurePending.load(std::memory_order_acquire);
+  const bool surfaceMutationRequired =
+      surfaceReconfigurePending || !window::is_presentable() || !g_surface ||
+      window::native_resize_pending() ||
+      !window::native_window_size_matches(
+          webgpu::g_graphicsConfig.surfaceConfiguration.width,
+          webgpu::g_graphicsConfig.surfaceConfiguration.height);
+  if (surfaceMutationRequired) {
+    wait_for_presenter_idle();
+    window::SurfaceLock surfaceLock;
+    // Reconfiguring invalidates any image the presenter holds, so take the surface exclusively; a
+    // drained queue does not stop a later job. Order is surface before renderer everywhere.
+    std::lock_guard surfaceOwnership(g_surfaceMutex);
+    std::lock_guard gpuLock(g_rendererGpuMutex);
+    // Surface configuration belongs to the render thread; the SDL thread must not reconfigure Dawn
+    // while this worker is acquiring or presenting.
+    if (!window::is_presentable()) {
+      webgpu::release_surface();
+      return false;
+    }
+    if (window::is_paused()) {
+      return false;
+    }
+    const bool consumeSurfaceReconfigure =
+        g_surfaceReconfigurePending.exchange(false, std::memory_order_acq_rel);
+    const bool consumeSurfaceRecreate =
+        g_surfaceRecreatePending.exchange(false, std::memory_order_acq_rel);
+    if (!g_surface || consumeSurfaceReconfigure) {
+      // Reconfigure in place unless the surface was actually lost. See
+      // g_surfaceRecreatePending for why destroying a live surface here is fatal
+      // while a capture overlay is attached.
+      webgpu::refresh_surface(consumeSurfaceRecreate);
+      if (!g_surface) {
+        return false;
+      }
+    }
+    if (window::native_resize_pending() ||
+        !window::native_window_size_matches(webgpu::g_graphicsConfig.surfaceConfiguration.width,
+                                            webgpu::g_graphicsConfig.surfaceConfiguration.height)) {
+      window::sync_frame_buffer_size();
+    }
+  } else if (window::is_paused()) {
+    return false;
+  }
+
+  return begin_frame_render_state_impl(imguiPolicy, imguiNewFrameOwed);
+#else
+  (void)imguiPolicy;
+  (void)imguiNewFrameOwed;
+  return true;
+#endif
+}
+
+bool begin_frame_render_state_impl(ImGuiFramePolicy imguiPolicy, bool* imguiNewFrameOwed) noexcept {
+#ifdef AURORA_ENABLE_GX
+  std::lock_guard gpuLock(g_rendererGpuMutex);
+  // Note the debt before gfx::begin_frame() can fail: the synchronous path always started the
+  // ImGui frame here, and the runtime's retry loop depends on that pairing.
+  if (imguiPolicy == ImGuiFramePolicy::Immediate) {
+    imgui::new_frame(window::get_window_size());
+  } else if (imguiNewFrameOwed != nullptr) {
+    *imguiNewFrameOwed = true;
+  }
+  if (!gfx::begin_frame()) {
+    return false;
+  }
+#else
+  (void)imguiPolicy;
+  (void)imguiNewFrameOwed;
+#endif
+  return true;
+}
+
+#ifdef AURORA_ENABLE_GX
+// Everything the mutex-free encode phase needs, latched while the renderer GPU mutex is held.
+// None of it may be re-read from a global later; the producer has already begun the next frame.
+struct SealedFrameContext {
+  wgpu::CommandEncoder encoder; // slot 0's encoder; already holds the staging copies
+  webgpu::PresentSource presentSource{};
+  uint64_t scheduleBaseNanos = 0;
+  uint64_t scheduleIntervalNanos = 0;
+  uint32_t interpolatedFrameCount = 0;
+  uint32_t snapshotWidth = 1;
+  uint32_t snapshotHeight = 1;
+  uint32_t logicalFrame = 0;
+  bool interpolationActive = false;
+  bool replayInterpolatedFrames = false;
+};
+
+// Phase 1: everything that touches producer-shared renderer state. Needs g_rendererGpuMutex and
+// a FIFO already drained into the recorded pass list.
+void seal_frame_locked(gfx::SealedFrame& sealedFrame, SealedFrameContext& ctx) {
+  ZoneScopedN("Seal frame");
+  const auto encoderDescriptor = wgpu::CommandEncoderDescriptor{
+      .label = "Redraw encoder",
+  };
+  ctx.encoder = g_device.CreateCommandEncoder(&encoderDescriptor);
+  // Probe-sized CPU-consumed copies read back asynchronously. Their downscale blits push uniforms,
+  // so prepare them while the producer's staging buffers are still mapped.
+  gfx::efb_ram::seal_async_downloads();
+  gfx::end_frame(ctx.encoder);
+  gfx::g_stats.presentedFrameCount = 0;
+  gfx::g_stats.interpolatedFrameCount = 0;
+  // Latched before the producer's next gfx::begin_frame() calls
+  // gx::begin_frame_interpolation(), which resets both of these.
+  ctx.interpolatedFrameCount = gx::interpolated_frame_count();
+  ctx.interpolationActive = ctx.interpolatedFrameCount != 0;
+  ctx.replayInterpolatedFrames = ctx.interpolationActive && gx::frame_interpolation_replay_safe();
+  ctx.scheduleBaseNanos = g_presentScheduleBaseNanos.load(std::memory_order_acquire);
+  ctx.scheduleIntervalNanos = g_presentScheduleIntervalNanos.load(std::memory_order_acquire);
+  const auto windowSize = window::get_window_size();
+  ctx.snapshotWidth = (std::max)(windowSize.native_fb_width, 1u);
+  ctx.snapshotHeight = (std::max)(windowSize.native_fb_height, 1u);
+  ctx.logicalFrame = gfx::current_frame();
+  // Latched before webgpu::clear_present_source_override() in the producer's
+  // next gfx::begin_frame().
+  ctx.presentSource = webgpu::current_present_source();
+  // ImGui draw lists are built once per frame and replayed by each slot's ImGui pass, which is why
+  // the next ImGui frame cannot start until the encode phase is done.
+  imgui::render_frame_data();
+  // Drop the sealed frame's lazy RAM-readback requests while the producer is still excluded; it
+  // starts registering the next frame's as soon as SEALED is published.
+  gfx::efb_ram::cancel();
+  // Detach the recorded passes. From here the producer's list is empty and the
+  // encode phase reads only worker-private state.
+  gfx::seal_frame(sealedFrame);
+  gfx::expire_bind_group_cache();
+}
+
+// Phase 2: encode every presentation slot. Reads only `ctx` and the sealed passes, so it runs
+// without the renderer GPU mutex while the producer records the next frame.
+std::vector<PresentationJob> encode_sealed_frame(gfx::SealedFrame& sealedFrame, SealedFrameContext& ctx) {
+  ZoneScopedN("Encode sealed frame");
+  auto encoder = std::move(ctx.encoder);
+  const auto encoderDescriptor = wgpu::CommandEncoderDescriptor{
+      .label = "Redraw encoder",
+  };
+  // Absolute slot deadlines: slot k of jobCount presents at base + k * interval / jobCount. With
+  // interpolation off, pace to the boundary that just passed plus 6.5 ms; late frames free-run.
+  constexpr uint64_t kNativePresentOffsetNanos = 6'500'000;
+  const uint32_t presentationJobCount = ctx.interpolatedFrameCount + 1;
+  const auto slotPresentDeadline = [&](uint32_t slot) -> PresentClock::time_point {
+    if (ctx.scheduleBaseNanos == 0 || ctx.scheduleIntervalNanos == 0) {
+      return {};
+    }
+    if (!ctx.interpolationActive) {
+      return PresentClock::time_point{std::chrono::nanoseconds{
+          ctx.scheduleBaseNanos - ctx.scheduleIntervalNanos + kNativePresentOffsetNanos}};
+    }
+    const uint64_t offsetNanos =
+        (ctx.scheduleIntervalNanos * static_cast<uint64_t>(slot)) / presentationJobCount;
+    return PresentClock::time_point{std::chrono::nanoseconds{ctx.scheduleBaseNanos + offsetNanos}};
+  };
+  std::vector<PresentationJob> presentationJobs;
+  presentationJobs.reserve(presentationJobCount);
+
+  // Each slot is submitted as soon as it is encoded, so the GPU starts slot 0 while slot 1 is still
+  // recording. Queue order preserves the ordering the single batched buffer gave.
+  const wgpu::CommandBufferDescriptor cmdBufDescriptor{
+      .label = "Presentation slot command buffer",
+  };
+  const auto submitEncodedSlot = [&](wgpu::CommandEncoder& target) {
+    const auto buffer = target.Finish(&cmdBufDescriptor);
+    std::lock_guard submitLock(g_queueSubmitMutex);
+    g_queue.Submit(1, &buffer);
+  };
+
+  if (ctx.replayInterpolatedFrames) {
+    for (uint32_t interpolatedFrame = 0; interpolatedFrame < ctx.interpolatedFrameCount;
+         ++interpolatedFrame) {
+      gfx::render(sealedFrame, encoder, static_cast<int32_t>(interpolatedFrame), false);
+      auto image =
+          acquire_presentation_image(interpolatedFrame, ctx.snapshotWidth, ctx.snapshotHeight);
+      encode_presentation_snapshot(encoder, ctx.presentSource, *image, true);
+      presentationJobs.push_back({
+          .image = std::move(image),
+          .logicalFrame = ctx.logicalFrame,
+          .presentAt = slotPresentDeadline(interpolatedFrame),
+          .interpolated = true,
+      });
+      submitEncodedSlot(encoder);
+      encoder = g_device.CreateCommandEncoder(&encoderDescriptor);
+    }
+  }
+
+  // A demanded CPU-visible EFB readback submits a prefix of the frame, so replaying the resumed
+  // stream would mutate an already-rendered EFB. Render once, then duplicate into the slots.
+  gfx::render(sealedFrame, encoder, -1, true);
+  // The copy targets now hold this frame's resolves, so queue their readbacks on the same encoder;
+  // completion is harvested in gfx::after_submit, never waited on here.
+  gfx::efb_ram::encode_async_downloads(encoder);
+  if (!ctx.replayInterpolatedFrames) {
+    for (uint32_t interpolatedFrame = 0; interpolatedFrame < ctx.interpolatedFrameCount;
+         ++interpolatedFrame) {
+      auto image =
+          acquire_presentation_image(interpolatedFrame, ctx.snapshotWidth, ctx.snapshotHeight);
+      encode_presentation_snapshot(encoder, ctx.presentSource, *image, true);
+      presentationJobs.push_back({
+          .image = std::move(image),
+          .logicalFrame = ctx.logicalFrame,
+          .presentAt = slotPresentDeadline(interpolatedFrame),
+          .interpolated = true,
+          .duplicated = true,
+      });
+      submitEncodedSlot(encoder);
+      encoder = g_device.CreateCommandEncoder(&encoderDescriptor);
+    }
+  }
+  auto finalImage =
+      acquire_presentation_image(ctx.interpolatedFrameCount, ctx.snapshotWidth, ctx.snapshotHeight);
+  encode_presentation_snapshot(encoder, ctx.presentSource, *finalImage, true);
+  auto pendingFrameCapture = encode_frame_capture(encoder, ctx.presentSource);
+  presentationJobs.push_back({
+      .image = std::move(finalImage),
+      .logicalFrame = ctx.logicalFrame,
+      .presentAt = slotPresentDeadline(ctx.interpolatedFrameCount),
+      .interpolated = false,
+  });
+  submitEncodedSlot(encoder);
+
+  // A group that finished encoding past its anchor slides forward by whole display periods, never
+  // per slot. The cursor keeps two groups off one anchor, which bursts then holds for a period.
+  static PresentClock::time_point s_lastGroupAnchor{};
+  if (ctx.interpolationActive && ctx.scheduleIntervalNanos != 0 && !presentationJobs.empty() &&
+      presentationJobs.front().presentAt != PresentClock::time_point{}) {
+    const std::chrono::nanoseconds interval{static_cast<int64_t>(ctx.scheduleIntervalNanos)};
+    auto anchor = presentationJobs.front().presentAt;
+    const auto now = PresentClock::now();
+    if (now > anchor) {
+      const auto behind = std::chrono::duration_cast<std::chrono::nanoseconds>(now - anchor);
+      const uint64_t periods =
+          static_cast<uint64_t>(behind.count()) / ctx.scheduleIntervalNanos + 1u;
+      anchor += std::chrono::nanoseconds{static_cast<int64_t>(periods * ctx.scheduleIntervalNanos)};
+    }
+    if (s_lastGroupAnchor != PresentClock::time_point{} && anchor <= s_lastGroupAnchor) {
+      anchor = s_lastGroupAnchor + interval;
+    }
+    const auto shift =
+        std::chrono::duration_cast<std::chrono::nanoseconds>(anchor - presentationJobs.front().presentAt);
+    if (shift.count() > 0) {
+      const uint32_t slidPeriods = static_cast<uint32_t>(
+          (static_cast<uint64_t>(shift.count()) + ctx.scheduleIntervalNanos - 1u) /
+          ctx.scheduleIntervalNanos);
+      for (auto& job : presentationJobs) {
+        job.presentAt += shift;
+        job.slidPeriods = slidPeriods;
+      }
+    }
+    s_lastGroupAnchor = anchor;
+  } else {
+    // No schedule (interpolation off, boot/black presents): the grid is gone,
+    // so the cursor must not constrain the next scheduled group.
+    s_lastGroupAnchor = {};
+  }
+
+  if (pendingFrameCapture.has_value()) {
+    complete_frame_capture(*pendingFrameCapture);
+  }
+  gfx::after_submit();
+  gfx::g_stats.presentedFrameCount = static_cast<uint32_t>(presentationJobs.size());
+  gfx::g_stats.interpolatedFrameCount = ctx.interpolatedFrameCount;
+  return presentationJobs;
+}
+
+// Phase 3: hand the encoded group to whoever owns presentation.
+void publish_presentations(std::vector<PresentationJob>&& presentationJobs, bool interpolationActive) {
+  // Keep presentation on the presenter whenever the async frame worker runs, even with
+  // interpolation off, so every mode shares one surface/resize path. RenderDoc keeps the sync path.
+  if (frame_worker_requested() || interpolationActive ||
+      g_presenterStarted.load(std::memory_order_acquire)) {
+    enqueue_presentations(std::move(presentationJobs));
+  } else {
+    for (const auto& job : presentationJobs) {
+      present_presentation_job(job);
+    }
+  }
+}
+
+void record_frame_telemetry() {
+  TracyPlotConfig("aurora: lastVertSize", tracy::PlotFormatType::Memory, false, true, 0);
+  TracyPlotConfig("aurora: lastUniformSize", tracy::PlotFormatType::Memory, false, true, 0);
+  TracyPlotConfig("aurora: lastIndexSize", tracy::PlotFormatType::Memory, false, true, 0);
+  TracyPlotConfig("aurora: lastStorageSize", tracy::PlotFormatType::Memory, false, true, 0);
+  TracyPlotConfig("aurora: lastTextureUploadSize", tracy::PlotFormatType::Memory, false, true, 0);
+
+  TracyPlot("aurora: queuedPipelines", static_cast<int64_t>(gfx::g_stats.queuedPipelines));
+  TracyPlot("aurora: createdPipelines", static_cast<int64_t>(gfx::g_stats.createdPipelines));
+  TracyPlot("aurora: drawCallCount", static_cast<int64_t>(gfx::g_stats.drawCallCount));
+  TracyPlot("aurora: mergedDrawCallCount", static_cast<int64_t>(gfx::g_stats.mergedDrawCallCount));
+  TracyPlot("aurora: lastVertSize", static_cast<int64_t>(gfx::g_stats.lastVertSize));
+  TracyPlot("aurora: lastUniformSize", static_cast<int64_t>(gfx::g_stats.lastUniformSize));
+  TracyPlot("aurora: lastIndexSize", static_cast<int64_t>(gfx::g_stats.lastIndexSize));
+  TracyPlot("aurora: lastStorageSize", static_cast<int64_t>(gfx::g_stats.lastStorageSize));
+  TracyPlot("aurora: lastTextureUploadSize", static_cast<int64_t>(gfx::g_stats.lastTextureUploadSize));
+  TracyPlot("aurora: frameIndex", static_cast<int64_t>(gfx::current_frame()));
+#if defined(TRACY_ENABLE) && defined(_WIN32)
+  const auto fileTimeValue = [](const FILETIME& value) noexcept {
+    ULARGE_INTEGER result{};
+    result.LowPart = value.dwLowDateTime;
+    result.HighPart = value.dwHighDateTime;
+    return result.QuadPart;
+  };
+  FILETIME creation{}, exit{}, processKernel{}, processUser{}, threadKernel{}, threadUser{};
+  const bool processTimesAvailable =
+      GetProcessTimes(GetCurrentProcess(), &creation, &exit, &processKernel, &processUser) != FALSE;
+  const bool threadTimesAvailable =
+      GetThreadTimes(GetCurrentThread(), &creation, &exit, &threadKernel, &threadUser) != FALSE;
+  const uint64_t processCpu100ns =
+      processTimesAvailable ? fileTimeValue(processKernel) + fileTimeValue(processUser) : 0;
+  const uint64_t threadCpu100ns =
+      threadTimesAvailable ? fileTimeValue(threadKernel) + fileTimeValue(threadUser) : 0;
+  static uint64_t previousProcessCpu100ns = processCpu100ns;
+  static uint64_t previousThreadCpu100ns = threadCpu100ns;
+  TracyPlot("aurora: processCpuUsPerFrame",
+            static_cast<int64_t>((processCpu100ns - previousProcessCpu100ns) / 10));
+  TracyPlot("aurora: mainThreadCpuUsPerFrame",
+            static_cast<int64_t>((threadCpu100ns - previousThreadCpu100ns) / 10));
+  previousProcessCpu100ns = processCpu100ns;
+  previousThreadCpu100ns = threadCpu100ns;
+#endif
+  FrameMarkNamed("Aurora frame");
+}
+
+// One complete frame-worker cycle. The scene encode only leaves the renderer mutex when
+// interpolation actually inserts slots; otherwise both phases publish together.
+bool run_frame_worker_cycle(gfx::SealedFrame& sealedFrame) noexcept {
+  ZoneScopedN("Frame worker cycle");
+  webgpu::fail_if_device_lost();
+  SealedFrameContext ctx;
+  std::vector<PresentationJob> presentationJobs;
+  bool overlapEncode = false;
+  {
+    std::lock_guard gpuLock(g_rendererGpuMutex);
+    seal_frame_locked(sealedFrame, ctx);
+    overlapEncode = ctx.interpolationActive;
+    if (!overlapEncode) {
+      presentationJobs = encode_sealed_frame(sealedFrame, ctx);
+    }
+  }
+  if (!overlapEncode) {
+    publish_presentations(std::move(presentationJobs), ctx.interpolationActive);
+  }
+
+  {
+    std::unique_lock lock(g_frameWorker.mutex);
+    g_frameWorker.cv.wait(lock, [] { return g_frameWorker.stop || g_frameWorker.prepareAllowed; });
+    if (g_frameWorker.stop) {
+      return false;
+    }
+    g_frameWorker.prepareAllowed = false;
+  }
+
+  // Preparing the next frame belongs to the SEALED phase: without a fresh pass 0 and mapped
+  // staging buffers the producer's drain has nowhere to put its commands.
+  bool imguiNewFrameOwed = false;
+  const bool prepared = begin_frame_impl(
+      false, overlapEncode ? ImGuiFramePolicy::Deferred : ImGuiFramePolicy::Immediate,
+      &imguiNewFrameOwed);
+
+  {
+    std::lock_guard lock(g_frameWorker.mutex);
+    g_frameWorker.framePrepared = prepared;
+    g_frameWorker.sealed.store(true, std::memory_order_release);
+    if (!overlapEncode) {
+      g_frameWorker.ready.store(true, std::memory_order_release);
+    }
+  }
+  g_frameWorker.cv.notify_all();
+
+  if (overlapEncode) {
+    // Mutex-free: the producer drains and records the next frame in parallel, taking the renderer
+    // mutex per drain, and this phase never takes it.
+    presentationJobs = encode_sealed_frame(sealedFrame, ctx);
+    publish_presentations(std::move(presentationJobs), ctx.interpolationActive);
+    if (imguiNewFrameOwed) {
+      // Safe only now: every slot has replayed this frame's ImGui draw lists.
+      std::lock_guard gpuLock(g_rendererGpuMutex);
+      imgui::new_frame(window::get_window_size());
+    }
+    {
+      std::lock_guard lock(g_frameWorker.mutex);
+      g_frameWorker.ready.store(true, std::memory_order_release);
+    }
+    g_frameWorker.cv.notify_all();
+  }
+
+  record_frame_telemetry();
+  return true;
+}
+#endif
+
+// Synchronous frame submission: seal, encode and present inline on the calling thread. Used when
+// the frame worker is disabled (RenderDoc captures) and on the boot path.
+void end_frame_impl(bool pumpEvents, bool drainFifo) noexcept {
+  ZoneScoped;
+#ifdef AURORA_ENABLE_GX
+  webgpu::fail_if_device_lost();
+  if (pumpEvents) {
+    window::pump_events();
+  }
+  gfx::SealedFrame sealedFrame;
+  SealedFrameContext ctx;
+  std::vector<PresentationJob> presentationJobs;
+  {
+    std::lock_guard gpuLock(g_rendererGpuMutex);
+    if (drainFifo) {
+      gx::fifo::drain();
+    }
+    seal_frame_locked(sealedFrame, ctx);
+    presentationJobs = encode_sealed_frame(sealedFrame, ctx);
+  }
+  publish_presentations(std::move(presentationJobs), ctx.interpolationActive);
+  record_frame_telemetry();
+#else
+  (void)pumpEvents;
+  (void)drainFifo;
+#endif
+}
+
+bool begin_frame() noexcept {
+#ifdef AURORA_ENABLE_GX
+  // The asynchronous fast path below can return a logically prepared frame
+  // without entering begin_frame_impl(), so loss must be checked before it.
+  webgpu::fail_if_device_lost();
+#endif
+  if (!frame_worker_requested()) {
+    return begin_frame_impl(true);
+  }
+
+  ensure_frame_worker_started();
+  // SDL needs event pumping on the window-owning producer thread, and the worker passes
+  // pumpEvents=false, so keep it here even when the fast path returns early.
+  window::pump_events();
+  bool waitForSurfacePreparation = false;
+#ifdef AURORA_ENABLE_GX
+  // A surface mutation can legitimately fail preparation, and optimistic success would let GX/ImGui
+  // record into a frame that was never begun, so join this path and return its real result.
+  waitForSurfacePreparation =
+      !window::is_presentable() || !g_surface ||
+      window::native_resize_pending() || window::is_paused() ||
+      !window::native_window_size_matches(
+          webgpu::g_graphicsConfig.surfaceConfiguration.width,
+          webgpu::g_graphicsConfig.surfaceConfiguration.height);
+#endif
+  bool workerPreparationPending = false;
+  {
+    std::lock_guard lock(g_frameWorker.mutex);
+    // The runtime begins right after an asynchronous end, so treat the worker's pending begin as an
+    // active frame unless a resize needs the real preparation result.
+    if (!g_frameWorker.ready.load(std::memory_order_acquire)) {
+      g_frameWorker.prepareAllowed = true;
+      g_frameWorker.cv.notify_one();
+      if (!waitForSurfacePreparation) {
+        return true;
+      }
+      workerPreparationPending = true;
+    } else if (g_frameWorker.framePrepared) {
+      return true;
+    }
+  }
+
+  if (workerPreparationPending) {
+    // DONE, not SEALED: this only runs while the window is changing and the caller is about to act on
+    // the surface, so keep the resize path fully serialized.
+    wait_for_frame_worker_private(FrameWorkerPhase::Done);
+    std::lock_guard lock(g_frameWorker.mutex);
+    return g_frameWorker.framePrepared;
+  }
+
+  {
+    std::lock_guard lock(g_frameWorker.mutex);
+    if (g_frameWorker.framePrepared) {
+      return true;
+    }
+  }
+
+  const bool prepared = begin_frame_impl(false);
+  {
+    std::lock_guard lock(g_frameWorker.mutex);
+    g_frameWorker.framePrepared = prepared;
+  }
+  return prepared;
+}
+
+void end_frame() noexcept {
+#ifdef AURORA_ENABLE_GX
+  webgpu::fail_if_device_lost();
+#endif
+  if (!frame_worker_requested()) {
+    end_frame_impl(true, true);
+    return;
+  }
+
+  ensure_frame_worker_started();
+  // DONE: this seals another frame, which means reusing the worker's encoder
+  // state and its SealedFrame. The previous cycle must be completely finished.
+  wait_for_frame_worker_private(FrameWorkerPhase::Done);
+
+  // Seal all current GX work on the CPU while the renderer is known ready.
+  // Later FIFO writes belong exclusively to the next frame.
+  {
+    std::lock_guard gpuLock(g_rendererGpuMutex);
+    gx::fifo::drain();
+  }
+  {
+    std::lock_guard lock(g_frameWorker.mutex);
+    g_frameWorker.framePrepared = false;
+    g_frameWorker.sealed.store(false, std::memory_order_release);
+    g_frameWorker.ready.store(false, std::memory_order_release);
+    g_frameWorker.jobPending = true;
+    g_frameWorker.prepareAllowed = false;
+  }
+  g_frameWorker.cv.notify_one();
+}
+} // namespace
+
+void wait_for_frame_worker() noexcept { wait_for_frame_worker_private(FrameWorkerPhase::Done); }
+std::chrono::nanoseconds wait_for_frame_worker_sealed() noexcept {
+  if (g_frameWorker.sealed.load(std::memory_order_acquire)) {
+    return std::chrono::nanoseconds::zero();
+  }
+  const auto started = std::chrono::steady_clock::now();
+  wait_for_frame_worker_private(FrameWorkerPhase::Sealed);
+  return std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - started);
+}
+bool wait_for_frame_worker_for(std::chrono::microseconds timeout) noexcept {
+  return wait_for_frame_worker_private_for(FrameWorkerPhase::Done, timeout);
+}
+std::recursive_mutex& renderer_gpu_mutex() noexcept { return g_rendererGpuMutex; }
+} // namespace aurora
+
+// C API bindings
+AuroraInfo aurora_initialize(int argc, char* argv[], const AuroraConfig* config) {
+  return aurora::initialize(argc, argv, *config);
+}
+void aurora_shutdown() { aurora::shutdown(); }
+const AuroraEvent* aurora_update() { return aurora::update(); }
+bool aurora_begin_frame() { return aurora::begin_frame(); }
+void aurora_end_frame() { aurora::end_frame(); }
+void aurora_set_frame_worker_wait_callback(AuroraFrameWorkerWaitCallback callback) {
+  aurora::g_frameWorkerWaitCallback.store(callback, std::memory_order_release);
+}
+void aurora_wait_for_frame_worker() { aurora::wait_for_frame_worker(); }
+bool aurora_wait_for_frame_worker_for(uint32_t timeoutMicros) {
+  return aurora::wait_for_frame_worker_for(std::chrono::microseconds(timeoutMicros));
+}
+void aurora_set_present_schedule(uint64_t baseNanos, uint64_t intervalNanos) {
+  aurora::g_presentScheduleBaseNanos.store(baseNanos, std::memory_order_release);
+  aurora::g_presentScheduleIntervalNanos.store(intervalNanos, std::memory_order_release);
+}
+void aurora_report_producer_paced(bool paced) {
+#ifdef AURORA_ENABLE_GX
+  aurora::gx::report_producer_paced(paced);
+#else
+  (void)paced;
+#endif
+}
+void aurora_get_frame_interpolation_diagnostics(AuroraFrameInterpolationDiagnostics* diagnostics) {
+  if (diagnostics != nullptr) {
+    aurora::gx::get_frame_interpolation_diagnostics(*diagnostics);
+  }
+}
+
+void aurora_get_present_timing(AuroraPresentTiming* timing) {
+  if (timing != nullptr) {
+    *timing = aurora::snapshot_present_timing();
+  }
+}
+void aurora_set_frame_interpolation_fps(uint32_t targetFps) {
+#ifdef AURORA_ENABLE_GX
+  aurora::gx::set_frame_interpolation_fps(targetFps);
+#else
+  (void)targetFps;
+#endif
+}
+uint32_t aurora_get_frame_interpolation_fps() {
+#ifdef AURORA_ENABLE_GX
+  return aurora::gx::frame_interpolation_fps();
+#else
+  return 0;
+#endif
+}
+void aurora_request_frame_capture(uint32_t frame, const char* outputPath) {
+  aurora::g_captureOutputPath = outputPath != nullptr ? outputPath : "frame_capture.bmp";
+  aurora::g_captureFrame.store(frame, std::memory_order_release);
+}
+bool aurora_flush_efb_copies_to_ram() {
+#ifdef AURORA_ENABLE_GX
+  if (!aurora::gfx::efb_ram::has_pending()) {
+    return true;
+  }
+  if (!aurora::gfx::efb_ram::prepare_downloads()) {
+    return false;
+  }
+
+  // This finalizes the frame still being recorded, on the producer thread, so join the whole cycle
+  // first: the encode phase owns the previous passes, EFB targets and image pool.
+  aurora::wait_for_frame_worker();
+  // The renderer is about to submit a prefix of the active frame. Its resumed
+  // suffix cannot safely be replayed against the same mutable EFB resources.
+  aurora::gx::mark_frame_interpolation_replay_unsafe();
+  aurora::gx::fifo::drain();
+  const wgpu::CommandEncoderDescriptor encoderDescriptor{
+      .label = "GX CPU-visible EFB copy encoder",
+  };
+  auto encoder = aurora::webgpu::g_device.CreateCommandEncoder(&encoderDescriptor);
+  aurora::gfx::end_batch(encoder);
+  aurora::gfx::render(encoder);
+  aurora::gfx::efb_ram::encode_downloads(encoder);
+  const wgpu::CommandBufferDescriptor commandDescriptor{
+      .label = "GX CPU-visible EFB copy command buffer",
+  };
+  const auto commandBuffer = encoder.Finish(&commandDescriptor);
+  {
+    std::lock_guard submitLock(aurora::g_queueSubmitMutex);
+    aurora::webgpu::g_queue.Submit(1, &commandBuffer);
+  }
+  const bool copied = aurora::gfx::efb_ram::complete_downloads();
+  aurora::gfx::after_submit();
+  const bool resumed = aurora::gfx::resume_frame();
+  return copied && resumed;
+#else
+  return true;
+#endif
+}
+bool aurora_flush_efb_copy_to_ram(void* dest) {
+#ifdef AURORA_ENABLE_GX
+  if (dest == nullptr || !aurora::gfx::efb_ram::has_pending(dest) ||
+      !aurora::gfx::efb_ram::prepare_downloads(dest)) {
+    return false;
+  }
+
+  // See aurora_flush_efb_copies_to_ram: this encodes the in-progress frame on
+  // the producer thread, so the worker's overlapped encode has to be finished.
+  aurora::wait_for_frame_worker();
+  // Preserve the requested output cadence by duplicating the completed native
+  // image instead of replaying this split frame.
+  aurora::gx::mark_frame_interpolation_replay_unsafe();
+  aurora::gx::fifo::drain();
+  const wgpu::CommandEncoderDescriptor encoderDescriptor{
+      .label = "GX demanded EFB copy encoder",
+  };
+  auto encoder = aurora::webgpu::g_device.CreateCommandEncoder(&encoderDescriptor);
+  aurora::gfx::end_batch(encoder);
+  aurora::gfx::render(encoder);
+  aurora::gfx::efb_ram::encode_downloads(encoder, dest);
+  const wgpu::CommandBufferDescriptor commandDescriptor{
+      .label = "GX demanded EFB copy command buffer",
+  };
+  const auto commandBuffer = encoder.Finish(&commandDescriptor);
+  {
+    std::lock_guard submitLock(aurora::g_queueSubmitMutex);
+    aurora::webgpu::g_queue.Submit(1, &commandBuffer);
+  }
+  const bool copied = aurora::gfx::efb_ram::complete_downloads();
+  aurora::gfx::after_submit();
+  const bool resumed = aurora::gfx::resume_frame();
+  return copied && resumed;
+#else
+  (void)dest;
+  return true;
+#endif
+}
+AuroraBackend aurora_get_backend() { return aurora::g_config.desiredBackend; }
+const AuroraBackend* aurora_get_available_backends(size_t* count) {
+  if (count != nullptr) {
+    *count = aurora::PreferredBackendOrder.size();
+  }
+  return aurora::PreferredBackendOrder.data();
+}
+void aurora_set_log_level(AuroraLogLevel level) { aurora::g_config.logLevel = level; }
+void aurora_set_pause_on_focus_lost(bool value) { aurora::g_config.pauseOnFocusLost = value; }
+void aurora_set_disable_copy_filter(bool disabled) { aurora::g_config.disableCopyFilter = disabled; }
+bool aurora_get_disable_copy_filter() { return aurora::g_config.disableCopyFilter; }
+void aurora_set_background_input(bool value) {
+  aurora::g_config.allowJoystickBackgroundEvents = value;
+  aurora::window::set_background_input(value);
+}
+void aurora_set_display_mode(AuroraDisplayMode mode) { aurora::window::set_display_mode(mode); }
+AuroraDisplayMode aurora_get_display_mode() { return aurora::window::get_display_mode(); }
diff --git a/aurora-main/lib/card/BlockAllocationTable.cpp b/aurora-main/lib/card/BlockAllocationTable.cpp
new file mode 100644
index 0000000..95739bb
--- /dev/null
+++ b/aurora-main/lib/card/BlockAllocationTable.cpp
@@ -0,0 +1,106 @@
+#include "BlockAllocationTable.hpp"
+
+#include <algorithm>
+#include <vector>
+
+#include "../internal.hpp"
+#include "Util.hpp"
+
+namespace aurora::card {
+void BlockAllocationTable::swapEndian() {
+  m_checksum = bswap(m_checksum);
+  m_checksumInv = bswap(m_checksumInv);
+  m_updateCounter = bswap(m_updateCounter);
+  m_freeBlocks = bswap(m_freeBlocks);
+  m_lastAllocated = bswap(m_lastAllocated);
+  std::for_each(std::begin(m_map), std::end(m_map), [](uint16_t& val) { val = bswap(val); });
+}
+
+void BlockAllocationTable::updateChecksum() {
+  swapEndian();
+  calculateChecksumBE(reinterpret_cast<uint16_t*>(raw.data() + 4), 0xFFE, &m_checksum, &m_checksumInv);
+  swapEndian();
+}
+
+bool BlockAllocationTable::valid() const {
+  uint16_t ckSum = 0;
+  uint16_t ckSumInv = 0;
+  const_cast<BlockAllocationTable&>(*this).swapEndian();
+  calculateChecksumBE(reinterpret_cast<const uint16_t*>(raw.data() + 4), 0xFFE, &ckSum, &ckSumInv);
+  bool res = ckSum == m_checksum && ckSumInv == m_checksumInv;
+  const_cast<BlockAllocationTable&>(*this).swapEndian();
+  return res;
+}
+
+BlockAllocationTable::BlockAllocationTable(uint32_t blockCount)
+: m_checksum{0}
+, m_checksumInv{0}
+, m_updateCounter{0}
+, m_freeBlocks{static_cast<uint16_t>(blockCount - FSTBlocks)}
+, m_lastAllocated{4}
+, m_map{{}} {
+  updateChecksum();
+}
+
+uint16_t BlockAllocationTable::getNextBlock(uint16_t block) const {
+  if ((block < FSTBlocks) || (block > (BATSize - FSTBlocks)))
+    return 0xFFFF;
+
+  return m_map[block - FSTBlocks];
+}
+
+uint16_t BlockAllocationTable::nextFreeBlock(uint16_t maxBlock, uint16_t startingBlock) const {
+  if (m_freeBlocks > 0) {
+    maxBlock = std::min(maxBlock, static_cast<uint16_t>(BATSize));
+    for (uint16_t i = startingBlock; i < maxBlock; ++i)
+      if (m_map[i - FSTBlocks] == 0)
+        return i;
+
+    for (uint16_t i = FSTBlocks; i < startingBlock; ++i)
+      if (m_map[i - FSTBlocks] == 0)
+        return i;
+  }
+
+  return 0xFFFF;
+}
+
+bool BlockAllocationTable::clear(uint16_t first, uint16_t count) {
+  std::vector<uint16_t> blocks;
+  while (first != 0xFFFF && first != 0) {
+    blocks.push_back(first);
+    first = getNextBlock(first);
+  }
+  if (first > 0) {
+    size_t length = blocks.size();
+    if (length != count)
+      return false;
+
+    for (size_t i = 0; i < length; ++i)
+      m_map[blocks.at(i) - FSTBlocks] = 0;
+    m_freeBlocks += count;
+    return true;
+  }
+  return false;
+}
+
+uint16_t BlockAllocationTable::allocateBlocks(uint16_t count, uint16_t maxBlocks) {
+  uint16_t firstBlock = nextFreeBlock(maxBlocks - FSTBlocks, m_lastAllocated + 1);
+  uint16_t freeBlock = firstBlock;
+  if (freeBlock != 0xFFFF) {
+    uint16_t tmpCount = count;
+    while ((count--) > 0 && freeBlock != 0xFFFF) {
+      m_map[(freeBlock - FSTBlocks)] = 0xFFFF;
+      if (count != 0) {
+        m_map[(freeBlock - FSTBlocks)] = nextFreeBlock(maxBlocks - FSTBlocks, freeBlock + 1);
+        freeBlock = m_map[(freeBlock - FSTBlocks)];
+      }
+    }
+    if (freeBlock == 0xFFFF)
+      return 0xFFFF;
+
+    m_lastAllocated = freeBlock;
+    m_freeBlocks -= tmpCount;
+  }
+  return firstBlock;
+}
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/BlockAllocationTable.hpp b/aurora-main/lib/card/BlockAllocationTable.hpp
new file mode 100644
index 0000000..56f7a40
--- /dev/null
+++ b/aurora-main/lib/card/BlockAllocationTable.hpp
@@ -0,0 +1,39 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+
+#include "Constants.hpp"
+
+namespace aurora::card {
+class BlockAllocationTable {
+  friend class CardRawFile;
+#pragma pack(push, 4)
+  union {
+    struct {
+      uint16_t m_checksum;
+      uint16_t m_checksumInv;
+      uint16_t m_updateCounter;
+      uint16_t m_freeBlocks;
+      uint16_t m_lastAllocated;
+      std::array<uint16_t, 0xFFB> m_map;
+    };
+    std::array<uint8_t, BlockSize> raw{};
+  };
+#pragma pack(pop)
+
+  void swapEndian();
+  void updateChecksum();
+  bool valid() const;
+
+public:
+  explicit BlockAllocationTable(uint32_t blockCount = (static_cast<uint32_t>(ECardSize::Card2043Mb) * MbitToBlocks));
+  ~BlockAllocationTable() = default;
+
+  uint16_t getNextBlock(uint16_t block) const;
+  uint16_t nextFreeBlock(uint16_t maxBlock, uint16_t startingBlock) const;
+  bool clear(uint16_t first, uint16_t count);
+  uint16_t allocateBlocks(uint16_t count, uint16_t maxBlocks);
+  uint16_t numFreeBlocks() const { return m_freeBlocks; }
+};
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/CardGciFolder.cpp b/aurora-main/lib/card/CardGciFolder.cpp
new file mode 100644
index 0000000..2b06e2e
--- /dev/null
+++ b/aurora-main/lib/card/CardGciFolder.cpp
@@ -0,0 +1,429 @@
+#include "CardGciFolder.hpp"
+
+#include <filesystem>
+#include "../fs_helper.hpp"
+
+#include "Directory.hpp"
+#include "FileIO.hpp"
+#include "../internal.hpp"
+
+namespace {
+aurora::Module Log("aurora::card");
+}
+
+namespace aurora::card {
+
+CardGciFolder::GciFile* CardGciFolder::getFile(uint32_t idx) {
+  if (m_files.size() > idx) {
+    auto file = &m_files[idx];
+    if (file->opened)
+      return file;
+  }
+  return nullptr;
+}
+
+CardGciFolder::GciFile* CardGciFolder::getFile(FileHandle& fh) { return getFile(fh.getFileNo()); }
+
+const CardGciFolder::GciFile* CardGciFolder::getFile(uint32_t idx) const {
+  if (m_files.size() > idx) {
+    auto file = &m_files[idx];
+    if (file->opened)
+      return file;
+  }
+  return nullptr;
+}
+
+const CardGciFolder::GciFile* CardGciFolder::getFile(FileHandle& fh) const { return getFile(fh.getFileNo()); }
+
+CardGciFolder::CardGciFolder() {}
+
+CardGciFolder::CardGciFolder(CardGciFolder&& other) {
+  m_files = std::move(other.m_files);
+  m_bat = std::move(other.m_bat);
+  m_folderPath = other.m_folderPath;
+  m_encoding = other.m_encoding;
+
+  CardGciFolder::setCurrentGame(other.m_game);
+  CardGciFolder::setCurrentMaker(other.m_maker);
+}
+
+CardGciFolder& CardGciFolder::operator=(CardGciFolder&& other) { return *this; }
+
+void CardGciFolder::InitCard(const char* game, const char* maker) {
+  setCurrentGame(game);
+  setCurrentMaker(maker);
+}
+
+ECardResult CardGciFolder::openFile(const char* filename, FileHandle& handleOut) {
+  int idx = 0;
+  for (auto& gciFile : m_files) {
+    if (strcmp(filename, gciFile.file.m_filename) == 0) {
+      gciFile.opened = true;
+      if (gciFile.fileSize == 0)
+        gciFile.fileSize = std::filesystem::file_size(m_folderPath / gciFile.filename);
+
+      handleOut = FileHandle(idx, 0);
+      return ECardResult::READY;
+    }
+    idx++;
+  }
+
+  return ECardResult::NOCARD;
+}
+
+ECardResult CardGciFolder::openFile(uint32_t fileno, FileHandle& handleOut) {
+  if (m_files.size() > fileno) {
+    auto& gciFile = m_files[fileno];
+    handleOut = FileHandle(fileno, 0);
+    gciFile.opened = true;
+    if (gciFile.fileSize == 0)
+      gciFile.fileSize = std::filesystem::file_size(m_folderPath / gciFile.filename);
+
+    return ECardResult::READY;
+  }
+
+  return ECardResult::NOCARD;
+}
+
+ECardResult CardGciFolder::createFile(const char* filename, size_t size, FileHandle& handleOut) {
+  std::string gciFilename = fmt::format("{}-{}-{}.gci", m_maker, m_game, filename);
+  uint16_t neededBlocks = ROUND_UP_8192(size) / BlockSize;
+  size_t fileSize = sizeof(File) + size;
+  constexpr uint16_t maxBlocks = ((uint16_t)ECardSize::Card2043Mb * MbitToBlocks) - FSTBlocks;
+
+  std::vector<uint8_t> fileBuf(fileSize);
+
+  File* gciFileHeader = (File*)fileBuf.data();
+
+  std::memcpy(gciFileHeader->m_game, m_game, 4);
+  std::memcpy(gciFileHeader->m_maker, m_maker, 2);
+  strncpy(gciFileHeader->m_filename, filename, std::size(gciFileHeader->m_filename));
+
+  gciFileHeader->m_modifiedTime = static_cast<uint32_t>(getGCTime());
+  gciFileHeader->m_blockCount = neededBlocks;
+  gciFileHeader->m_firstBlock = m_bat.allocateBlocks(neededBlocks, maxBlocks);
+
+  // write big endian header for dolphin compat
+  gciFileHeader->swapEndian();
+  FileIO file(m_folderPath / gciFilename, true);
+  if (!file || !file.fileWrite(fileBuf.data(), fileBuf.size(), 0)) {
+    return ECardResult::IOERROR;
+  }
+
+  gciFileHeader->swapEndian();
+  m_files.push_back({*gciFileHeader, fileSize, reinterpret_cast<const char8_t*>(gciFilename.c_str()), false}); // push non-endian swapped header first
+  handleOut = FileHandle(m_files.size() - 1, 0);
+
+  return ECardResult::READY;
+}
+
+ECardResult CardGciFolder::closeFile(FileHandle& fh) {
+  auto file = getFile(fh);
+  if (file) {
+    file->opened = false;
+    return ECardResult::READY;
+  }
+
+  return ECardResult::NOFILE;
+}
+
+void CardGciFolder::deleteFile(const FileHandle& fh) {
+  auto file = getFile(fh.getFileNo());
+  if (!file)
+    return;
+
+  FileIO fileIO(m_folderPath / file->filename, true);
+  if (fileIO)
+    fileIO.deleteFile();
+}
+
+ECardResult CardGciFolder::deleteFile(const char* filename) { return ECardResult::NOCARD; }
+
+ECardResult CardGciFolder::deleteFile(uint32_t fileno) { return ECardResult::NOCARD; }
+
+ECardResult CardGciFolder::renameFile(const char* oldName, const char* newName) {
+  for (auto& gciFile : m_files) {
+    if (strcmp(oldName, gciFile.file.m_filename) == 0) {
+      strncpy(gciFile.file.m_filename, newName, std::size(gciFile.file.m_filename));
+      return ECardResult::READY;
+    }
+  }
+
+  return ECardResult::NOCARD;
+}
+
+ECardResult CardGciFolder::fileWrite(FileHandle& fh, const void* buf, size_t size) {
+  auto file = getFile(fh);
+  if (file) {
+    FileIO fileIO(m_folderPath / file->filename);
+    if (fileIO) {
+      if (fileIO.fileWrite(buf, size, sizeof(File) + fh.offset))
+        return ECardResult::READY;
+      return ECardResult::IOERROR;
+    }
+    return ECardResult::NOFILE;
+  }
+
+  return ECardResult::NOCARD;
+}
+
+ECardResult CardGciFolder::fileRead(FileHandle& fh, void* dst, size_t size) {
+  auto file = getFile(fh);
+  if (file) {
+    FileIO fileIO(m_folderPath / file->filename);
+    if (fileIO) {
+      if (fileIO.fileRead(dst, size, sizeof(File) + fh.offset))
+        return ECardResult::READY;
+      return ECardResult::IOERROR;
+    }
+    return ECardResult::NOFILE;
+  }
+
+  return ECardResult::NOCARD;
+}
+
+void CardGciFolder::seek(FileHandle& fh, int32_t pos, SeekOrigin whence) {
+  auto file = getFile(fh);
+  if (file) {
+    switch (whence) {
+    case SeekOrigin::Begin:
+      fh.offset = pos;
+      break;
+    case SeekOrigin::Current:
+      fh.offset += pos;
+      break;
+    case SeekOrigin::End:
+      fh.offset = file->fileSize - pos;
+      break;
+    }
+  }
+}
+
+ECardResult CardGciFolder::getStatus(const FileHandle& fh, CardStat& statOut) const {
+  return getStatus(fh.getFileNo(), statOut);
+}
+
+ECardResult CardGciFolder::getStatus(uint32_t fileNo, CardStat& statOut) const {
+  auto gciFile = getFile(fileNo);
+
+  if (!gciFile)
+    return ECardResult::NOFILE;
+  const auto file = &gciFile->file;
+
+  std::strncpy(statOut.x0_fileName, file->m_filename, 32);
+  statOut.x20_length = file->m_blockCount * BlockSize;
+  statOut.x24_time = file->m_modifiedTime;
+  memmove(statOut.x28_gameName.data(), file->m_game, 4);
+  memmove(statOut.x2c_company.data(), file->m_maker, 4);
+
+  statOut.x2e_bannerFormat = file->m_bannerFlags;
+  statOut.x30_iconAddr = file->m_iconAddress;
+  statOut.x34_iconFormat = file->m_iconFmt;
+  statOut.x36_iconSpeed = file->m_animSpeed;
+  statOut.x38_commentAddr = file->m_commentAddr;
+
+  if (file->m_iconAddress == UINT32_MAX) {
+    statOut.x3c_offsetBanner = UINT32_MAX;
+    statOut.x40_offsetBannerTlut = UINT32_MAX;
+    statOut.x44_offsetIcon.fill(UINT32_MAX);
+    statOut.x64_offsetIconTlut = UINT32_MAX;
+    statOut.x68_offsetData = file->m_commentAddr + 64;
+  } else {
+    uint32_t cur = file->m_iconAddress;
+    statOut.x3c_offsetBanner = cur;
+    cur += BannerSize(statOut.GetBannerFormat());
+    statOut.x40_offsetBannerTlut = cur;
+    cur += TlutSize(statOut.GetBannerFormat());
+    bool palette = false;
+    for (size_t i = 0; i < statOut.x44_offsetIcon.size(); ++i) {
+      statOut.x44_offsetIcon[i] = cur;
+      const EImageFormat fmt = statOut.GetIconFormat(static_cast<int>(i));
+      if (fmt == EImageFormat::C8) {
+        palette = true;
+      }
+      cur += IconSize(fmt);
+    }
+    if (palette) {
+      statOut.x64_offsetIconTlut = cur;
+      cur += TlutSize(EImageFormat::C8);
+    } else
+      statOut.x64_offsetIconTlut = UINT32_MAX;
+    statOut.x68_offsetData = cur;
+  }
+
+  return ECardResult::READY;
+}
+
+ECardResult CardGciFolder::setStatus(const FileHandle& fh, const CardStat& stat) {
+  return setStatus(fh.getFileNo(), stat);
+}
+
+ECardResult CardGciFolder::setStatus(uint32_t fileNo, const CardStat& stat) {
+  auto gciFile = getFile(fileNo);
+
+  if (!gciFile)
+    return ECardResult::NOFILE;
+  const auto file = &gciFile->file;
+
+  file->m_bannerFlags = stat.x2e_bannerFormat;
+  file->m_iconAddress = stat.x30_iconAddr;
+  file->m_iconFmt = stat.x34_iconFormat;
+  file->m_animSpeed = stat.x36_iconSpeed;
+  file->m_commentAddr = stat.x38_commentAddr;
+
+  return ECardResult::READY;
+}
+
+void CardGciFolder::setCurrentGame(const char* game) {
+  if (game != nullptr && std::strlen(game) == 4) {
+    std::memcpy(m_game, game, 4);
+  }
+}
+
+const uint8_t* CardGciFolder::getCurrentGame() const {
+  if (std::strlen(m_game) == sizeof(m_game) - 1) {
+    return reinterpret_cast<const uint8_t*>(m_game);
+  }
+
+  return nullptr;
+}
+
+void CardGciFolder::setCurrentMaker(const char* maker) {
+  if (maker != nullptr && std::strlen(maker) == 2) {
+    std::memcpy(m_maker, maker, 2);
+  }
+}
+
+const uint8_t* CardGciFolder::getCurrentMaker() const {
+  if (std::strlen(m_maker) == sizeof(m_maker) - 1) {
+    return reinterpret_cast<const uint8_t*>(m_maker);
+  }
+
+  return nullptr;
+}
+
+void CardGciFolder::getSerial(uint64_t& serial) {
+  serial = 0; // TODO
+}
+
+void CardGciFolder::getChecksum(uint16_t& checksum, uint16_t& inverse) const {
+  // TODO
+  checksum = 0;
+  inverse = 0;
+}
+
+void CardGciFolder::getFreeBlocks(int32_t& bytesNotUsed, int32_t& filesNotUsed) const {
+  bytesNotUsed = m_bat.numFreeBlocks() * BlockSize;
+  filesNotUsed = MaxFiles;
+}
+
+void CardGciFolder::getEncoding(uint16_t& encoding) const { encoding = (uint16_t)m_encoding; }
+
+void CardGciFolder::format(ECardSlot deviceId, ECardSize size, EEncoding encoding) {
+  m_encoding = encoding;
+
+  if (!std::filesystem::create_directories(m_folderPath)) {
+    Log.error("Failed to create directory: {}", fs_path_to_string(m_folderPath));
+  }
+}
+
+void CardGciFolder::commit() {
+  for (auto& gciFile : m_files) {
+    if (gciFile.opened) {
+      FileIO file(m_folderPath / gciFile.filename);
+
+      File tempFile = gciFile.file;
+      tempFile.swapEndian();
+      file.fileWrite(&tempFile, sizeof(File), 0); // update header
+    }
+  }
+}
+
+bool CardGciFolder::open(const std::filesystem::path& filepath) {
+  m_folderPath = filepath;
+
+  std::error_code ec;
+  if (!std::filesystem::exists(filepath, ec) || !std::filesystem::is_directory(filepath, ec)) {
+    if (ec) {
+      Log.warn("Failed to inspect GCI folder '{}': {}", fs_path_to_string(filepath), ec.message());
+    }
+    return false;
+  }
+
+  std::filesystem::directory_iterator it(
+      filepath, std::filesystem::directory_options::skip_permission_denied, ec);
+  if (ec) {
+    Log.warn("Failed to enumerate GCI folder '{}': {}", fs_path_to_string(filepath), ec.message());
+    return false;
+  }
+
+  const std::filesystem::directory_iterator end;
+  while (it != end) {
+    const auto path = it->path();
+    const auto status = it->status(ec);
+    if (ec) {
+      Log.warn("Failed to inspect GCI folder entry '{}': {}", fs_path_to_string(path), ec.message());
+      return false;
+    }
+    if (!std::filesystem::is_regular_file(status)) {
+      it.increment(ec);
+      if (ec) {
+        Log.warn("Failed to continue enumerating GCI folder '{}': {}", fs_path_to_string(filepath), ec.message());
+        return false;
+      }
+      continue;
+    }
+
+    if (path.extension() != ".gci") {
+      it.increment(ec);
+      if (ec) {
+        Log.warn("Failed to continue enumerating GCI folder '{}': {}", fs_path_to_string(filepath), ec.message());
+        return false;
+      }
+      continue;
+    }
+
+    FileIO file(path);
+    if (!file) {
+      Log.warn("Failed to open GCI file '{}'", fs_path_to_string(path));
+      return false;
+    }
+
+    File fileData;
+    if (!file.fileRead(&fileData, sizeof(File), 0)) {
+      Log.warn("Failed to read GCI file '{}'", fs_path_to_string(path));
+      return false;
+    }
+    fileData.swapEndian();
+
+    m_files.push_back({fileData, file.fileSize(), path.filename().u8string(), false});
+
+    it.increment(ec);
+    if (ec) {
+      Log.warn("Failed to continue enumerating GCI folder '{}': {}", fs_path_to_string(filepath), ec.message());
+      return false;
+    }
+  }
+
+  return true;
+}
+
+void CardGciFolder::close() {
+  m_files.clear();
+  m_folderPath = "";
+  m_bat = BlockAllocationTable();
+}
+
+static std::filesystem::path g_cardFileNameEmpty = "";
+
+const std::filesystem::path& CardGciFolder::cardFilename() const { return g_cardFileNameEmpty; }
+
+ECardResult CardGciFolder::getError() const { return ECardResult::READY; }
+
+ProbeResults CardGciFolder::probeCardFile(const std::filesystem::path& filename) {
+  if (!std::filesystem::exists(filename) || !std::filesystem::is_directory(filename))
+    return {ECardResult::NOCARD, 0, 0};
+  return {ECardResult::READY, static_cast<uint32_t>(ECardSize::Card2043Mb), BlockSize};
+}
+
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/CardGciFolder.hpp b/aurora-main/lib/card/CardGciFolder.hpp
new file mode 100644
index 0000000..b74c689
--- /dev/null
+++ b/aurora-main/lib/card/CardGciFolder.hpp
@@ -0,0 +1,77 @@
+#pragma once
+#include <filesystem>
+#include <vector>
+
+#include "BlockAllocationTable.hpp"
+#include "CommonData.h"
+#include "File.hpp"
+#include "ICard.hpp"
+
+namespace aurora::card {
+
+class CardGciFolder : public ICard {
+private:
+  struct GciFile {
+    File file;
+    size_t fileSize;
+    std::u8string filename;
+    bool opened = false;
+  };
+
+  std::vector<GciFile> m_files;
+  std::filesystem::path m_folderPath;
+  BlockAllocationTable m_bat;
+
+  EEncoding m_encoding = EEncoding::ASCII;
+
+  char m_game[5] = {'\0'};
+  char m_maker[3] = {'\0'};
+
+  GciFile* getFile(FileHandle& fh);
+  const GciFile* getFile(FileHandle& fh) const;
+  GciFile* getFile(uint32_t idx);
+  const GciFile* getFile(uint32_t idx) const;
+public:
+  CardGciFolder();
+  ~CardGciFolder() override = default;
+
+  CardGciFolder(const CardGciFolder& other) = delete;
+  CardGciFolder& operator=(const CardGciFolder& other) = delete;
+  CardGciFolder(CardGciFolder&& other);
+  CardGciFolder& operator=(CardGciFolder&& other);
+
+  void InitCard(const char* game, const char* maker) override;
+
+  ECardResult openFile(const char* filename, FileHandle& handleOut) override;
+  ECardResult openFile(uint32_t fileno, FileHandle& handleOut) override;
+  ECardResult createFile(const char* filename, size_t size, FileHandle& handleOut) override;
+  ECardResult closeFile(FileHandle& fh) override;
+  void deleteFile(const FileHandle& fh) override;
+  ECardResult deleteFile(const char* filename) override;
+  ECardResult deleteFile(uint32_t fileno) override;
+  ECardResult renameFile(const char* oldName, const char* newName) override;
+  ECardResult fileWrite(FileHandle& fh, const void* buf, size_t size) override;
+  ECardResult fileRead(FileHandle& fh, void* dst, size_t size) override;
+  void seek(FileHandle& fh, int32_t pos, SeekOrigin whence) override;
+  ECardResult getStatus(const FileHandle& fh, CardStat& statOut) const override;
+  ECardResult getStatus(uint32_t fileNo, CardStat& statOut) const override;
+  ECardResult setStatus(const FileHandle& fh, const CardStat& stat) override;
+  ECardResult setStatus(uint32_t fileNo, const CardStat& stat) override;
+  void setCurrentGame(const char* game) override;
+  const uint8_t* getCurrentGame() const override;
+  void setCurrentMaker(const char* maker) override;
+  const uint8_t* getCurrentMaker() const override;
+  void getSerial(uint64_t& serial) override;
+  void getChecksum(uint16_t& checksum, uint16_t& inverse) const override;
+  void getFreeBlocks(int32_t& bytesNotUsed, int32_t& filesNotUsed) const override;
+  void getEncoding(uint16_t& encoding) const override;
+  void format(ECardSlot deviceId, ECardSize size = ECardSize::Card2043Mb, EEncoding encoding = EEncoding::ASCII) override;
+  void commit() override;
+  bool open(const std::filesystem::path& filepath) override;
+  void close() override;
+  const std::filesystem::path& cardFilename() const override;
+  ECardResult getError() const override;
+  ProbeResults probeCardFile(const std::filesystem::path& filename) override;
+};
+
+}
diff --git a/aurora-main/lib/card/CardRawFile.cpp b/aurora-main/lib/card/CardRawFile.cpp
new file mode 100644
index 0000000..f897327
--- /dev/null
+++ b/aurora-main/lib/card/CardRawFile.cpp
@@ -0,0 +1,817 @@
+#include "CardRawFile.hpp"
+
+#include <algorithm>
+#include <cstdio>
+#include <cstring>
+#include <filesystem>
+#include <memory>
+
+#include "../internal.hpp"
+#include "SRAM.hpp"
+
+namespace aurora::card {
+
+static void NullFileAccess() { fprintf(stderr, "Attempted to access null file\n"); }
+
+void CardRawFile::CardHeader::_swapEndian() {
+  m_formatTime = bswap(m_formatTime);
+  m_sramBias = bswap(m_sramBias);
+  m_sramLanguage = bswap(m_sramLanguage);
+  m_unknown = bswap(m_unknown);
+  m_deviceId = bswap(m_deviceId);
+  m_sizeMb = bswap(m_sizeMb);
+  m_encoding = bswap(m_encoding);
+  m_updateCounter = bswap(m_updateCounter);
+  m_checksum = bswap(m_checksum);
+  m_checksumInv = bswap(m_checksumInv);
+}
+
+CardRawFile::CardRawFile() { m_ch.raw.fill(0xFF); }
+
+CardRawFile::CardRawFile(CardRawFile&& other) {
+  m_ch.raw = other.m_ch.raw;
+  m_filename = std::move(other.m_filename);
+  m_fileHandle = std::move(other.m_fileHandle);
+  m_dirs = std::move(other.m_dirs);
+  m_bats = std::move(other.m_bats);
+  m_currentDir = other.m_currentDir;
+  m_currentBat = other.m_currentBat;
+
+  m_maxBlock = other.m_maxBlock;
+  std::copy(std::cbegin(other.m_game), std::cend(other.m_game), std::begin(m_game));
+  std::copy(std::cbegin(other.m_maker), std::cend(other.m_maker), std::begin(m_maker));
+}
+
+CardRawFile& CardRawFile::operator=(CardRawFile&& other) {
+  close();
+
+  m_ch.raw = other.m_ch.raw;
+  m_filename = std::move(other.m_filename);
+  m_fileHandle = std::move(other.m_fileHandle);
+  m_dirs = std::move(other.m_dirs);
+  m_bats = std::move(other.m_bats);
+  m_currentDir = other.m_currentDir;
+  m_currentBat = other.m_currentBat;
+
+  m_maxBlock = other.m_maxBlock;
+  std::copy(std::cbegin(other.m_game), std::cend(other.m_game), std::begin(m_game));
+  std::copy(std::cbegin(other.m_maker), std::cend(other.m_maker), std::begin(m_maker));
+
+  return *this;
+}
+
+ECardResult CardRawFile::_pumpOpen() {
+  if (m_opened)
+    return ECardResult::READY;
+
+  if (!m_fileHandle)
+    return ECardResult::NOCARD;
+
+  m_ch._swapEndian();
+  m_maxBlock = m_ch.m_sizeMb * MbitToBlocks;
+
+  m_dirs[0].swapEndian();
+  m_dirs[1].swapEndian();
+  m_bats[0].swapEndian();
+  m_bats[1].swapEndian();
+
+  /* Check for data integrity, restoring valid data in case of corruption if possible */
+  if (!m_dirs[0].valid() && m_dirs[1].valid())
+    m_dirs[0] = m_dirs[1];
+  else if (!m_dirs[1].valid() && m_dirs[0].valid())
+    m_dirs[1] = m_dirs[0];
+  if (!m_bats[0].valid() && m_bats[1].valid())
+    m_bats[0] = m_bats[1];
+  else if (!m_bats[1].valid() && m_bats[0].valid())
+    m_bats[1] = m_bats[0];
+
+  if (m_dirs[0].data.m_updateCounter > m_dirs[1].data.m_updateCounter)
+    m_currentDir = 0;
+  else
+    m_currentDir = 1;
+
+  if (m_bats[0].m_updateCounter > m_bats[1].m_updateCounter)
+    m_currentBat = 0;
+  else
+    m_currentBat = 1;
+
+  m_opened = true;
+
+  return ECardResult::READY;
+}
+
+void CardRawFile::InitCard(const char* game, const char* maker) {
+  m_ch.raw.fill(0xFF);
+
+  if (game != nullptr && std::strlen(game) == 4) {
+    std::memcpy(m_game, game, 4);
+  }
+  if (maker != nullptr && std::strlen(maker) == 2) {
+    std::memcpy(m_maker, maker, 2);
+  }
+}
+
+CardRawFile::~CardRawFile() { CardRawFile::close(); }
+
+ECardResult CardRawFile::openFile(const char* filename, FileHandle& handleOut) {
+  const ECardResult openRes = _pumpOpen();
+  if (openRes != ECardResult::READY) {
+    return openRes;
+  }
+
+  handleOut = {};
+  const File* const f = m_dirs[m_currentDir].getFile(m_game, m_maker, filename);
+  if (!f || f->m_game[0] == 0xFF) {
+    return ECardResult::NOFILE;
+  }
+
+  const int32_t idx = m_dirs[m_currentDir].indexForFile(f);
+  if (idx != -1) {
+    handleOut = FileHandle(idx);
+    return ECardResult::READY;
+  }
+
+  return ECardResult::FATAL_ERROR;
+}
+
+ECardResult CardRawFile::openFile(uint32_t fileno, FileHandle& handleOut) {
+  ECardResult openRes = _pumpOpen();
+  if (openRes != ECardResult::READY)
+    return openRes;
+
+  handleOut = {};
+  File* f = m_dirs[m_currentDir].getFile(fileno);
+  if (!f || f->m_game[0] == 0xFF)
+    return ECardResult::NOFILE;
+  handleOut = FileHandle(fileno);
+  return ECardResult::READY;
+}
+
+void CardRawFile::_updateDirAndBat(const Directory& dir, const BlockAllocationTable& bat) {
+  m_currentDir = !m_currentDir;
+  Directory& updateDir = m_dirs[m_currentDir];
+  updateDir = dir;
+  updateDir.data.m_updateCounter++;
+  updateDir.updateChecksum();
+
+  m_currentBat = !m_currentBat;
+  BlockAllocationTable& updateBat = m_bats[m_currentBat];
+  updateBat = bat;
+  updateBat.m_updateCounter++;
+  updateBat.updateChecksum();
+
+  m_dirty = true;
+}
+
+void CardRawFile::_updateChecksum() {
+  m_ch._swapEndian();
+  calculateChecksumBE(reinterpret_cast<uint16_t*>(m_ch.raw.data()), 0xFE, &m_ch.m_checksum, &m_ch.m_checksumInv);
+  m_ch._swapEndian();
+}
+
+File* CardRawFile::_fileFromHandle(const FileHandle& fh) const {
+  if (!fh) {
+    NullFileAccess();
+    return nullptr;
+  }
+  return const_cast<Directory&>(m_dirs[m_currentDir]).getFile(fh.idx);
+}
+
+ECardResult CardRawFile::createFile(const char* filename, size_t size, FileHandle& handleOut) {
+  ECardResult openRes = _pumpOpen();
+  if (openRes != ECardResult::READY)
+    return openRes;
+
+  handleOut = {};
+
+  if (size <= 0)
+    return ECardResult::FATAL_ERROR;
+  if (strlen(filename) > 32)
+    return ECardResult::NAMETOOLONG;
+  if (m_dirs[m_currentDir].getFile(m_game, m_maker, filename))
+    return ECardResult::EXIST;
+  uint16_t neededBlocks = ROUND_UP_8192(size) / BlockSize;
+  if (neededBlocks > m_bats[m_currentBat].numFreeBlocks())
+    return ECardResult::INSSPACE;
+  if (!m_dirs[m_currentDir].hasFreeFile())
+    return ECardResult::NOENT;
+
+  Directory dir = m_dirs[m_currentDir];
+  BlockAllocationTable bat = m_bats[m_currentBat];
+  File* f = dir.getFirstFreeFile(m_game, m_maker, filename);
+  uint16_t block = bat.allocateBlocks(neededBlocks, m_maxBlock - FSTBlocks);
+  if (f && block != 0xFFFF) {
+    f->m_modifiedTime = static_cast<uint32_t>(getGCTime());
+    f->m_firstBlock = block;
+    f->m_blockCount = neededBlocks;
+
+    handleOut = FileHandle(dir.indexForFile(f));
+    _updateDirAndBat(dir, bat);
+    return ECardResult::READY;
+  }
+
+  return ECardResult::FATAL_ERROR;
+}
+
+ECardResult CardRawFile::closeFile(FileHandle& fh) {
+  fh.offset = 0;
+  return ECardResult::READY;
+}
+
+FileHandle CardRawFile::firstFile() {
+  const File* const f = m_dirs[m_currentDir].getFirstNonFreeFile(0, m_game, m_maker);
+
+  if (f == nullptr) {
+    return {};
+  }
+
+  return FileHandle(m_dirs[m_currentDir].indexForFile(f));
+}
+
+FileHandle CardRawFile::nextFile(const FileHandle& cur) {
+  if (!cur) {
+    NullFileAccess();
+    return {};
+  }
+
+  const File* const next = m_dirs[m_currentDir].getFirstNonFreeFile(cur.idx + 1, m_game, m_maker);
+  if (next == nullptr) {
+    return {};
+  }
+
+  return FileHandle(m_dirs[m_currentDir].indexForFile(next));
+}
+
+const char* CardRawFile::getFilename(const FileHandle& fh) const {
+  const File* const f = _fileFromHandle(fh);
+
+  if (f == nullptr) {
+    return nullptr;
+  }
+
+  return f->m_filename;
+}
+
+void CardRawFile::_deleteFile(File& f, BlockAllocationTable& bat) {
+  uint16_t block = f.m_firstBlock;
+  while (block != 0xFFFF) {
+    /* TODO: add a fragmentation check */
+    uint16_t nextBlock = bat.getNextBlock(block);
+    bat.clear(block, 1);
+    block = nextBlock;
+  }
+  f = File();
+}
+
+void CardRawFile::deleteFile(const FileHandle& fh) {
+  if (!fh) {
+    NullFileAccess();
+    return;
+  }
+  Directory dir = m_dirs[m_currentDir];
+  BlockAllocationTable bat = m_bats[m_currentBat];
+  _deleteFile(*dir.getFile(fh.idx), bat);
+  _updateDirAndBat(dir, bat);
+}
+
+ECardResult CardRawFile::deleteFile(const char* filename) {
+  ECardResult openRes = _pumpOpen();
+  if (openRes != ECardResult::READY)
+    return openRes;
+
+  Directory dir = m_dirs[m_currentDir];
+  File* f = dir.getFile(m_game, m_maker, filename);
+  if (!f)
+    return ECardResult::NOFILE;
+
+  BlockAllocationTable bat = m_bats[m_currentBat];
+  _deleteFile(*f, bat);
+  _updateDirAndBat(dir, bat);
+  return ECardResult::READY;
+}
+
+ECardResult CardRawFile::deleteFile(uint32_t fileno) {
+  ECardResult openRes = _pumpOpen();
+  if (openRes != ECardResult::READY)
+    return openRes;
+
+  Directory dir = m_dirs[m_currentDir];
+  File* f = dir.getFile(fileno);
+  if (!f)
+    return ECardResult::NOFILE;
+
+  BlockAllocationTable bat = m_bats[m_currentBat];
+  _deleteFile(*f, bat);
+  _updateDirAndBat(dir, bat);
+  return ECardResult::READY;
+}
+
+ECardResult CardRawFile::renameFile(const char* oldName, const char* newName) {
+  const ECardResult openRes = _pumpOpen();
+  if (openRes != ECardResult::READY) {
+    return openRes;
+  }
+
+  if (std::strlen(newName) > 32) {
+    return ECardResult::NAMETOOLONG;
+  }
+
+  Directory dir = m_dirs[m_currentDir];
+  File* f = dir.getFile(m_game, m_maker, oldName);
+  if (f == nullptr) {
+    return ECardResult::NOFILE;
+  }
+
+  if (File* replF = dir.getFile(m_game, m_maker, newName)) {
+    BlockAllocationTable bat = m_bats[m_currentBat];
+    _deleteFile(*replF, bat);
+    std::memset(f->m_filename, 0, 32);
+    std::strncpy(f->m_filename, newName, 32);
+    _updateDirAndBat(dir, bat);
+  } else {
+    std::memset(f->m_filename, 0, 32);
+    std::strncpy(f->m_filename, newName, 32);
+    _updateDirAndBat(dir, m_bats[m_currentBat]);
+  }
+  return ECardResult::READY;
+}
+
+ECardResult CardRawFile::fileWrite(FileHandle& fh, const void* buf, size_t size) {
+  ECardResult openRes = _pumpOpen();
+  if (openRes != ECardResult::READY)
+    return openRes;
+
+  if (!fh) {
+    NullFileAccess();
+    return ECardResult::NOFILE;
+  }
+  File* file = m_dirs[m_currentDir].getFile(fh.idx);
+  if (!file)
+    return ECardResult::NOFILE;
+
+  /* Block handling is a little different from cache handling,
+   * since each block can be in an arbitrary location we must
+   * first find our starting block.
+   */
+  const uint16_t blockId = static_cast<uint16_t>(fh.offset / BlockSize);
+  uint16_t block = file->m_firstBlock;
+  for (uint16_t i = 0; i < blockId; i++)
+    block = m_bats[m_currentBat].getNextBlock(block);
+
+  const uint8_t* tmpBuf = static_cast<const uint8_t*>(buf);
+  uint16_t curBlock = block;
+  uint32_t blockOffset = fh.offset % BlockSize;
+  size_t rem = size;
+  while (rem) {
+    if (curBlock == 0xFFFF)
+      return ECardResult::NOFILE;
+
+    size_t cacheSize = rem;
+    if (cacheSize + blockOffset > BlockSize)
+      cacheSize = BlockSize - blockOffset;
+    uint32_t offset = (curBlock * BlockSize) + blockOffset;
+    if (!m_fileHandle.fileWrite(tmpBuf, cacheSize, offset))
+      return ECardResult::FATAL_ERROR;
+    tmpBuf += cacheSize;
+    rem -= cacheSize;
+    blockOffset += cacheSize;
+    if (blockOffset >= BlockSize) {
+      curBlock = m_bats[m_currentBat].getNextBlock(curBlock);
+      blockOffset = 0;
+    }
+  }
+  fh.offset += size;
+
+  return ECardResult::READY;
+}
+
+ECardResult CardRawFile::fileRead(FileHandle& fh, void* dst, size_t size) {
+  ECardResult openRes = _pumpOpen();
+  if (openRes != ECardResult::READY)
+    return openRes;
+
+  if (!fh) {
+    NullFileAccess();
+    return ECardResult::NOFILE;
+  }
+  File* file = m_dirs[m_currentDir].getFile(fh.idx);
+  if (!file)
+    return ECardResult::NOFILE;
+  /* Block handling is a little different from cache handling,
+   * since each block can be in an arbitrary location we must
+   * first find our starting block.
+   */
+  const uint16_t blockId = static_cast<uint16_t>(fh.offset / BlockSize);
+  uint16_t block = file->m_firstBlock;
+  for (uint16_t i = 0; i < blockId; i++)
+    block = m_bats[m_currentBat].getNextBlock(block);
+
+  uint8_t* tmpBuf = static_cast<uint8_t*>(dst);
+  uint16_t curBlock = block;
+  uint32_t blockOffset = fh.offset % BlockSize;
+  size_t rem = size;
+  while (rem) {
+    if (curBlock == 0xFFFF)
+      return ECardResult::NOFILE;
+
+    size_t cacheSize = rem;
+    if (cacheSize + blockOffset > BlockSize)
+      cacheSize = BlockSize - blockOffset;
+    uint32_t offset = (curBlock * BlockSize) + blockOffset;
+    if (!m_fileHandle.fileRead(tmpBuf, cacheSize, offset))
+      return ECardResult::FATAL_ERROR;
+    tmpBuf += cacheSize;
+    rem -= cacheSize;
+    blockOffset += cacheSize;
+    if (blockOffset >= BlockSize) {
+      curBlock = m_bats[m_currentBat].getNextBlock(curBlock);
+      blockOffset = 0;
+    }
+  }
+  fh.offset += size;
+
+  return ECardResult::READY;
+}
+
+void CardRawFile::seek(FileHandle& fh, int32_t pos, SeekOrigin whence) {
+  if (!fh) {
+    NullFileAccess();
+    return;
+  }
+  File* file = m_dirs[m_currentDir].getFile(fh.idx);
+  if (!file)
+    return;
+
+  switch (whence) {
+  case SeekOrigin::Begin:
+    fh.offset = pos;
+    break;
+  case SeekOrigin::Current:
+    fh.offset += pos;
+    break;
+  case SeekOrigin::End:
+    fh.offset = static_cast<int32_t>(file->m_blockCount * BlockSize) - pos;
+    break;
+  }
+}
+
+int32_t CardRawFile::tell(const FileHandle& fh) const { return fh.offset; }
+
+void CardRawFile::setPublic(const FileHandle& fh, bool pub) {
+  File* file = _fileFromHandle(fh);
+  if (!file)
+    return;
+
+  if (pub)
+    file->m_permissions |= EPermissions::Public;
+  else
+    file->m_permissions &= ~EPermissions::Public;
+}
+
+bool CardRawFile::isPublic(const FileHandle& fh) const {
+  File* file = _fileFromHandle(fh);
+  if (!file)
+    return false;
+
+  return static_cast<bool>(file->m_permissions & EPermissions::Public);
+}
+
+void CardRawFile::setCanCopy(const FileHandle& fh, bool copy) const {
+  File* file = _fileFromHandle(fh);
+  if (!file)
+    return;
+
+  if (copy)
+    file->m_permissions &= ~EPermissions::NoCopy;
+  else
+    file->m_permissions |= EPermissions::NoCopy;
+}
+
+bool CardRawFile::canCopy(const FileHandle& fh) const {
+  File* file = _fileFromHandle(fh);
+  if (!file)
+    return false;
+
+  return !static_cast<bool>(file->m_permissions & EPermissions::NoCopy);
+}
+
+void CardRawFile::setCanMove(const FileHandle& fh, bool move) {
+  File* file = _fileFromHandle(fh);
+  if (!file)
+    return;
+
+  if (move)
+    file->m_permissions &= ~EPermissions::NoMove;
+  else
+    file->m_permissions |= EPermissions::NoMove;
+}
+
+bool CardRawFile::canMove(const FileHandle& fh) const {
+  File* file = _fileFromHandle(fh);
+  if (!file)
+    return false;
+
+  return !static_cast<bool>(file->m_permissions & EPermissions::NoMove);
+}
+
+ECardResult CardRawFile::getStatus(const FileHandle& fh, CardStat& statOut) const {
+  if (!fh) {
+    NullFileAccess();
+    return ECardResult::NOFILE;
+  }
+  return getStatus(fh.idx, statOut);
+}
+
+ECardResult CardRawFile::getStatus(uint32_t fileNo, CardStat& statOut) const {
+  ECardResult openRes = const_cast<CardRawFile*>(this)->_pumpOpen();
+  if (openRes != ECardResult::READY)
+    return openRes;
+
+  const File* file = const_cast<Directory&>(m_dirs[m_currentDir]).getFile(fileNo);
+  if (!file || file->m_game[0] == 0xFF)
+    return ECardResult::NOFILE;
+
+  std::strncpy(statOut.x0_fileName, file->m_filename, 32);
+  statOut.x20_length = file->m_blockCount * BlockSize;
+  statOut.x24_time = file->m_modifiedTime;
+  memmove(statOut.x28_gameName.data(), file->m_game, 4);
+  memmove(statOut.x2c_company.data(), file->m_maker, 4);
+
+  statOut.x2e_bannerFormat = file->m_bannerFlags;
+  statOut.x30_iconAddr = file->m_iconAddress;
+  statOut.x34_iconFormat = file->m_iconFmt;
+  statOut.x36_iconSpeed = file->m_animSpeed;
+  statOut.x38_commentAddr = file->m_commentAddr;
+
+  if (file->m_iconAddress == UINT32_MAX) {
+    statOut.x3c_offsetBanner = UINT32_MAX;
+    statOut.x40_offsetBannerTlut = UINT32_MAX;
+    statOut.x44_offsetIcon.fill(UINT32_MAX);
+    statOut.x64_offsetIconTlut = UINT32_MAX;
+    statOut.x68_offsetData = file->m_commentAddr + 64;
+  } else {
+    uint32_t cur = file->m_iconAddress;
+    statOut.x3c_offsetBanner = cur;
+    cur += BannerSize(statOut.GetBannerFormat());
+    statOut.x40_offsetBannerTlut = cur;
+    cur += TlutSize(statOut.GetBannerFormat());
+    bool palette = false;
+    for (size_t i = 0; i < statOut.x44_offsetIcon.size(); ++i) {
+      statOut.x44_offsetIcon[i] = cur;
+      const EImageFormat fmt = statOut.GetIconFormat(static_cast<int>(i));
+      if (fmt == EImageFormat::C8) {
+        palette = true;
+      }
+      cur += IconSize(fmt);
+    }
+    if (palette) {
+      statOut.x64_offsetIconTlut = cur;
+      cur += TlutSize(EImageFormat::C8);
+    } else
+      statOut.x64_offsetIconTlut = UINT32_MAX;
+    statOut.x68_offsetData = cur;
+  }
+
+  return ECardResult::READY;
+}
+
+ECardResult CardRawFile::setStatus(const FileHandle& fh, const CardStat& stat) {
+  if (!fh) {
+    NullFileAccess();
+    return ECardResult::NOFILE;
+  }
+  return setStatus(fh.idx, stat);
+}
+
+ECardResult CardRawFile::setStatus(uint32_t fileNo, const CardStat& stat) {
+  ECardResult openRes = _pumpOpen();
+  if (openRes != ECardResult::READY)
+    return openRes;
+
+  Directory dir = m_dirs[m_currentDir];
+  File* file = dir.getFile(fileNo);
+  if (!file || file->m_game[0] == 0xFF)
+    return ECardResult::NOFILE;
+
+  file->m_bannerFlags = stat.x2e_bannerFormat;
+  file->m_iconAddress = stat.x30_iconAddr;
+  file->m_iconFmt = stat.x34_iconFormat;
+  file->m_animSpeed = stat.x36_iconSpeed;
+  file->m_commentAddr = stat.x38_commentAddr;
+
+  _updateDirAndBat(dir, m_bats[m_currentBat]);
+  return ECardResult::READY;
+}
+
+void CardRawFile::setCurrentGame(const char* game) {
+  if (game == nullptr) {
+    std::memset(m_game, 0, sizeof(m_game));
+    return;
+  }
+
+  constexpr size_t copy_amount = sizeof(m_game) - 1;
+  if (std::strlen(game) != copy_amount) {
+    return;
+  }
+
+  std::memcpy(m_game, game, copy_amount);
+}
+
+const uint8_t* CardRawFile::getCurrentGame() const {
+  if (std::strlen(m_game) == sizeof(m_game) - 1) {
+    return reinterpret_cast<const uint8_t*>(m_game);
+  }
+
+  return nullptr;
+}
+
+void CardRawFile::setCurrentMaker(const char* maker) {
+  if (maker == nullptr) {
+    std::memset(m_maker, 0, sizeof(m_maker));
+    return;
+  }
+
+  constexpr size_t copy_amount = sizeof(m_maker) - 1;
+  if (std::strlen(maker) != copy_amount) {
+    return;
+  }
+
+  std::memcpy(m_maker, maker, copy_amount);
+}
+
+const uint8_t* CardRawFile::getCurrentMaker() const {
+  if (std::strlen(m_maker) == sizeof(m_maker) - 1) {
+    return reinterpret_cast<const uint8_t*>(m_maker);
+  }
+
+  return nullptr;
+}
+
+void CardRawFile::getSerial(uint64_t& serial) {
+  m_ch._swapEndian();
+
+  std::array<uint32_t, 8> serialBuf{};
+  for (size_t i = 0; i < serialBuf.size(); i++) {
+    serialBuf[i] = bswap(*reinterpret_cast<uint32_t*>(m_ch.raw.data() + (i * 4)));
+  }
+  serial = static_cast<uint64_t>(serialBuf[0] ^ serialBuf[2] ^ serialBuf[4] ^ serialBuf[6]) << 32 |
+           (serialBuf[1] ^ serialBuf[3] ^ serialBuf[5] ^ serialBuf[7]);
+
+  m_ch._swapEndian();
+}
+
+void CardRawFile::getChecksum(uint16_t& checksum, uint16_t& inverse) const {
+  checksum = m_ch.m_checksum;
+  inverse = m_ch.m_checksumInv;
+}
+
+void CardRawFile::getFreeBlocks(int32_t& bytesNotUsed, int32_t& filesNotUsed) const {
+  bytesNotUsed = m_bats[m_currentBat].numFreeBlocks() * 0x2000;
+  filesNotUsed = m_dirs[m_currentDir].numFreeFiles();
+}
+
+void CardRawFile::getEncoding(uint16_t& encoding) const { encoding = m_ch.m_encoding; }
+
+void CardRawFile::format(ECardSlot id, ECardSize size, EEncoding encoding) {
+  m_ch.raw.fill(0xFF);
+
+  uint64_t rand = static_cast<uint64_t>(getGCTime());
+  m_ch.m_formatTime = rand;
+  for (size_t i = 0; i < m_ch.m_serial.size(); i++) {
+    rand = (((rand * static_cast<uint64_t>(0x41c64e6d)) + static_cast<uint64_t>(0x3039)) >> 16);
+    m_ch.m_serial[i] = static_cast<uint8_t>(g_SRAM.flash_id[uint32_t(id)][i] + uint32_t(rand));
+    rand = (((rand * static_cast<uint64_t>(0x41c64e6d)) + static_cast<uint64_t>(0x3039)) >> 16);
+    rand &= static_cast<uint64_t>(0x7fffULL);
+  }
+
+  m_ch.m_sramBias = static_cast<int32_t>(bswap(g_SRAM.counter_bias));
+  m_ch.m_sramLanguage = static_cast<uint32_t>(g_SRAM.lang);
+  m_ch.m_unknown = 0; /* 1 works for slot A, 0 both */
+  m_ch.m_deviceId = 0;
+  m_ch.m_sizeMb = static_cast<uint16_t>(size);
+  m_maxBlock = m_ch.m_sizeMb * MbitToBlocks;
+  m_ch.m_encoding = static_cast<uint16_t>(encoding);
+  _updateChecksum();
+  m_dirs[0] = Directory();
+  m_dirs[1] = m_dirs[0];
+  m_bats[0] = BlockAllocationTable(static_cast<uint32_t>(size) * MbitToBlocks);
+  m_bats[1] = m_bats[0];
+  m_currentDir = 1;
+  m_currentBat = 1;
+
+  m_fileHandle = {};
+  m_fileHandle = FileIO(m_filename, true);
+
+  if (m_fileHandle) {
+    const uint32_t blockCount = (static_cast<uint32_t>(size) * MbitToBlocks) - 5;
+
+    m_tmpCh = m_ch;
+    m_tmpCh._swapEndian();
+    m_fileHandle.fileWrite(m_tmpCh.raw.data(), BlockSize, 0);
+    m_tmpDirs[0] = m_dirs[0];
+    m_tmpDirs[0].swapEndian();
+    m_fileHandle.fileWrite(m_tmpDirs[0].raw.data(), BlockSize, BlockSize * 1);
+    m_tmpDirs[1] = m_dirs[1];
+    m_tmpDirs[1].swapEndian();
+    m_fileHandle.fileWrite(m_tmpDirs[1].raw.data(), BlockSize, BlockSize * 2);
+    m_tmpBats[0] = m_bats[0];
+    m_tmpBats[0].swapEndian();
+    m_fileHandle.fileWrite(m_tmpBats[0].raw.data(), BlockSize, BlockSize * 3);
+    m_tmpBats[1] = m_bats[1];
+    m_tmpBats[1].swapEndian();
+    m_fileHandle.fileWrite(m_tmpBats[1].raw.data(), BlockSize, BlockSize * 4);
+
+    std::unique_ptr<uint8_t[]> dummyBlock;
+    dummyBlock.reset(new uint8_t[BlockSize * blockCount]);
+    memset(dummyBlock.get(), 0xFF, BlockSize * blockCount);
+    m_fileHandle.fileWrite(dummyBlock.get(), BlockSize, BlockSize * blockCount);
+    m_dirty = false;
+  }
+}
+
+ProbeResults CardRawFile::probeCardFile(const std::filesystem::path& filename) {
+  if (!std::filesystem::exists(filename))
+    return {ECardResult::NOCARD, 0, 0};
+  return {ECardResult::READY, static_cast<uint32_t>(std::filesystem::file_size(filename) / BlockSize) / MbitToBlocks,
+          BlockSize};
+}
+
+void CardRawFile::commit() {
+  if (!m_dirty)
+    return;
+  if (m_fileHandle) {
+    m_tmpCh = m_ch;
+    m_tmpCh._swapEndian();
+    m_fileHandle.fileWrite(&m_tmpCh, BlockSize, 0);
+    m_tmpDirs[0] = m_dirs[0];
+    m_tmpDirs[0].updateChecksum();
+    m_tmpDirs[0].swapEndian();
+    m_fileHandle.fileWrite(m_tmpDirs[0].raw.data(), BlockSize, BlockSize * 1);
+    m_tmpDirs[1] = m_dirs[1];
+    m_tmpDirs[1].updateChecksum();
+    m_tmpDirs[1].swapEndian();
+    m_fileHandle.fileWrite(m_tmpDirs[1].raw.data(), BlockSize, BlockSize * 2);
+    m_tmpBats[0] = m_bats[0];
+    m_tmpBats[0].updateChecksum();
+    m_tmpBats[0].swapEndian();
+    m_fileHandle.fileWrite(m_tmpBats[0].raw.data(), BlockSize, BlockSize * 3);
+    m_tmpBats[1] = m_bats[1];
+    m_tmpBats[1].updateChecksum();
+    m_tmpBats[1].swapEndian();
+    m_fileHandle.fileWrite(m_tmpBats[1].raw.data(), BlockSize, BlockSize * 4);
+    m_dirty = false;
+  }
+}
+
+bool CardRawFile::open(const std::filesystem::path& filepath) {
+  m_opened = false;
+  m_filename = filepath;
+  m_fileHandle = FileIO(m_filename);
+  if (m_fileHandle) {
+    if (!m_fileHandle.fileRead(m_ch.raw.data(), BlockSize, 0))
+      return false;
+    if (!m_fileHandle.fileRead(m_dirs[0].raw.data(), BlockSize, BlockSize * 1))
+      return false;
+    if (!m_fileHandle.fileRead(m_dirs[1].raw.data(), BlockSize, BlockSize * 2))
+      return false;
+    if (!m_fileHandle.fileRead(m_bats[0].raw.data(), BlockSize, BlockSize * 3))
+      return false;
+    if (!m_fileHandle.fileRead(m_bats[1].raw.data(), BlockSize, BlockSize * 4))
+      return false;
+    return true;
+  }
+  return false;
+}
+
+void CardRawFile::close() {
+  m_opened = false;
+  if (m_fileHandle) {
+    commit();
+    m_fileHandle = {};
+  }
+}
+
+ECardResult CardRawFile::getError() const {
+  if (!m_fileHandle)
+    return ECardResult::NOCARD;
+
+  ECardResult openRes = const_cast<CardRawFile*>(this)->_pumpOpen();
+  if (openRes != ECardResult::READY)
+    return openRes;
+
+  uint16_t ckSum, ckSumInv;
+  const_cast<CardRawFile&>(*this).m_ch._swapEndian();
+  calculateChecksumBE(reinterpret_cast<const uint16_t*>(m_ch.raw.data()), 0xFE, &ckSum, &ckSumInv);
+  bool res = ckSum == m_ch.m_checksum && ckSumInv == m_ch.m_checksumInv;
+  const_cast<CardRawFile&>(*this).m_ch._swapEndian();
+
+  if (!res)
+    return ECardResult::BROKEN;
+  if (!m_dirs[0].valid() && !m_dirs[1].valid())
+    return ECardResult::BROKEN;
+  if (!m_bats[0].valid() && !m_bats[1].valid())
+    return ECardResult::BROKEN;
+
+  return ECardResult::READY;
+}
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/CardRawFile.hpp b/aurora-main/lib/card/CardRawFile.hpp
new file mode 100644
index 0000000..c13ab2c
--- /dev/null
+++ b/aurora-main/lib/card/CardRawFile.hpp
@@ -0,0 +1,438 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+#include <string>
+
+#include "FileIO.hpp"
+#include "BlockAllocationTable.hpp"
+#include "Directory.hpp"
+#include "File.hpp"
+#include "Util.hpp"
+
+#include "CommonData.h"
+#include "ICard.hpp"
+
+namespace aurora::card {
+
+class CardRawFile : public ICard {
+#pragma pack(push, 4)
+  struct CardHeader {
+    union {
+      struct {
+        std::array<uint8_t, 12> m_serial;
+        uint64_t m_formatTime;
+        int32_t m_sramBias;
+        uint32_t m_sramLanguage;
+        uint32_t m_unknown;
+        uint16_t m_deviceId; /* 0 for Slot A, 1 for Slot B */
+        uint16_t m_sizeMb;
+        uint16_t m_encoding;
+        std::array<uint8_t, 468> padding;
+        uint16_t m_updateCounter;
+        uint16_t m_checksum;
+        uint16_t m_checksumInv;
+      };
+      std::array<uint8_t, BlockSize> raw;
+    };
+    void _swapEndian();
+  };
+#pragma pack(pop)
+
+  CardHeader m_ch;
+  CardHeader m_tmpCh;
+
+  std::filesystem::path m_filename;
+  FileIO m_fileHandle;
+  std::array<Directory, 2> m_dirs;
+  std::array<BlockAllocationTable, 2> m_bats;
+  std::array<Directory, 2> m_tmpDirs;
+  std::array<BlockAllocationTable, 2> m_tmpBats;
+  uint8_t m_currentDir;
+  uint8_t m_currentBat;
+
+  uint16_t m_maxBlock;
+  char m_game[5] = {'\0'};
+  char m_maker[3] = {'\0'};
+
+  void _updateDirAndBat(const Directory& dir, const BlockAllocationTable& bat);
+  void _updateChecksum();
+  File* _fileFromHandle(const FileHandle& fh) const;
+  void _deleteFile(File& f, BlockAllocationTable& bat);
+
+  bool m_dirty = false;
+  bool m_opened = false;
+  ECardResult _pumpOpen();
+
+public:
+  CardRawFile();
+  CardRawFile(const CardRawFile& other) = delete;
+  CardRawFile& operator=(const CardRawFile& other) = delete;
+  CardRawFile(CardRawFile&& other);
+  CardRawFile& operator=(CardRawFile&& other);
+
+  /**
+   * @brief Card
+   *
+   * @param game  The game code.
+   * @param maker The maker code.
+   */
+  void InitCard(const char* game = nullptr, const char* maker = nullptr) override;
+
+  ~CardRawFile() override;
+
+  /**
+   * @brief openFile
+   *
+   * @param[in]  filename  The name of the file to open.
+   * @param[out] handleOut Out reference that will contain the opened file handle.
+   *
+   * @return A result indicating the error status of the operation.
+   */
+  ECardResult openFile(const char* filename, FileHandle& handleOut) override;
+
+  /**
+   * @brief openFile
+   *
+   * @param[in]  fileno    The file index.
+   * @param[out] handleOut Out reference that will contain the opened file handle.
+   *
+   * @return A result indicating the error status of the operation.
+   */
+  ECardResult openFile(uint32_t fileno, FileHandle& handleOut) override;
+
+  /**
+   * @brief createFile
+   *
+   * @param[in]  filename  The name of the file to create.
+   * @param[out] handleOut Out reference that will contain the handle of the created file.
+   *
+   * @return A result indicating the error status of the operation.
+   */
+  ECardResult createFile(const char* filename, size_t size, FileHandle& handleOut) override;
+
+  /**
+   * @brief closeFile
+   *
+   * @param fh FileHandle to close
+   *
+   * @return READY
+   */
+  ECardResult closeFile(FileHandle& fh) override;
+
+  /**
+   * @brief firstFile
+   *
+   * @return The first file within this card instance. If
+   *         no file is able to be found, then an invalid
+   *         handle will be returned.
+   */
+  FileHandle firstFile();
+
+  /**
+   * @brief nextFile
+   *
+   * @param cur The file handle indicating the current file handle.
+   *
+   * @return The next file within this card. If no file can be found,
+   *         an invalid handle will be returned.
+   */
+  FileHandle nextFile(const FileHandle& cur);
+
+  /**
+   * @brief getFilename
+   *
+   * @param fh A valid file handle to retrieve the name of.
+   *
+   * @return Gets the name of the given file.
+   */
+  const char* getFilename(const FileHandle& fh) const;
+
+  /**
+   * @brief deleteFile
+   *
+   * @param fh File handle to delete.
+   */
+  void deleteFile(const FileHandle& fh) override;
+
+  /**
+   * @brief deleteFile
+   *
+   * @param filename The name of the file to delete.
+   */
+  ECardResult deleteFile(const char* filename) override;
+
+  /**
+   * @brief deleteFile
+   *
+   * @param fileno The file number indicating the file to delete.
+   */
+  ECardResult deleteFile(uint32_t fileno) override;
+
+  /**
+   * @brief renameFile
+   *
+   * @param oldName The old name of the file.
+   * @param newName The new name to assign to the file.
+   */
+  ECardResult renameFile(const char* oldName, const char* newName) override;
+
+  /**
+   * @brief write
+   *
+   * @param fh   A valid file handle to write to.
+   * @param buf  The buffer to write to the file.
+   * @param size The size of the given buffer.
+   */
+  ECardResult fileWrite(FileHandle& fh, const void* buf, size_t size) override;
+
+  /**
+   * @brief read
+   *
+   * @param fh   A valid file handle to read from.
+   * @param dst  A buffer to read data into.
+   * @param size The size of the buffer to read into.
+   */
+  ECardResult fileRead(FileHandle& fh, void* dst, size_t size) override;
+
+  /**
+   * @brief seek
+   *
+   * @param fh     A valid file handle.
+   * @param pos    The position to seek to.
+   * @param whence The origin to seek relative to.
+   */
+  void seek(FileHandle& fh, int32_t pos, SeekOrigin whence) override;
+
+  /**
+   * @brief Returns the current offset of the specified file.
+   *
+   * @param fh The file to retrieve the offset from.
+   *
+   * @return The offset or -1 if an invalid handle is passed.
+   */
+  int32_t tell(const FileHandle& fh) const;
+
+  /**
+   * @brief setPublic
+   *
+   * @param fh  The file handle to make public.
+   * @param pub Whether or not this file is public (i.e. readable by any game).
+   */
+  void setPublic(const FileHandle& fh, bool pub);
+
+  /**
+   * @brief isPublic
+   *
+   * @param fh The file handle to query.
+   *
+   * @return Whether or not this file is public (i.e. readable by any game).
+   */
+  bool isPublic(const FileHandle& fh) const;
+
+  /**
+   * @brief setCanCopy
+   *
+   * @param fh   The file handle to set as copyable.
+   * @param copy Whether or not to set the file handle as copyable.
+   */
+  void setCanCopy(const FileHandle& fh, bool copy) const;
+
+  /**
+   * @brief canCopy
+   *
+   * @param fh The file handle to query.
+   *
+   * @return Whether or not this file handle is copyable by the IPL.
+   */
+  bool canCopy(const FileHandle& fh) const;
+
+  /**
+   * @brief setCanMove
+   *
+   * @param fh   The file handle to set as moveable.
+   * @param move Whether or not to set the file handle as movable.
+   */
+  void setCanMove(const FileHandle& fh, bool move);
+
+  /**
+   * @brief canMove
+   *
+   * @param fh The file handle to query.
+   *
+   * @return whether or not the file can be moved by the IPL.
+   */
+  bool canMove(const FileHandle& fh) const;
+
+  /**
+   * @brief getStatus
+   *
+   * @param fh      Handle of requested file
+   * @param statOut Structure to fill with file stat
+   *
+   * @return NOFILE or READY
+   */
+  ECardResult getStatus(const FileHandle& fh, CardStat& statOut) const override;
+
+  /**
+   * @brief getStatus
+   *
+   * @param fileNo  Number of requested file
+   * @param statOut Structure to fill with file stat
+   *
+   * @return NOFILE or READY
+   */
+  ECardResult getStatus(uint32_t fileNo, CardStat& statOut) const override;
+
+  /**
+   * @brief setStatus
+   *
+   * @param fh   Handle of requested file
+   * @param stat Structure to access for file stat
+   *
+   * @return NOFILE or READY
+   */
+  ECardResult setStatus(const FileHandle& fh, const CardStat& stat) override;
+
+  /**
+   * @brief setStatus
+   *
+   * @param fileNo Number of requested file
+   * @param stat   Structure to access for file stat
+   *
+   * @return NOFILE or READY
+   */
+  ECardResult setStatus(uint32_t fileNo, const CardStat& stat) override;
+
+#if 0 // TODO: Async-friendly implementations
+    /**
+     * @brief Copies a file from the current Card instance to a specified Card instance
+     * @param fh The file to copy
+     * @param dest The destination Card instance
+     * @return True if successful, false otherwise
+     */
+    bool copyFileTo(FileHandle& fh, CardRawFile& dest);
+
+    /**
+     * @brief moveFileTo
+     * @param fh
+     * @param dest
+     * @return
+     */
+    bool moveFileTo(FileHandle& fh, CardRawFile& dest);
+#endif
+
+  /**
+   * @brief Sets the current game, if not null any openFile requests will only return files that match this game
+   *
+   * @param game The target game id, e.g "GM8E"
+   *
+   * @sa openFile
+   */
+  void setCurrentGame(const char* game) override;
+
+  /**
+   * @brief Returns the currently selected game.
+   *
+   * @return The selected game, or nullptr
+   */
+  const uint8_t* getCurrentGame() const override;
+
+  /**
+   * @brief Sets the current maker, if not null any openFile requests will only return files that match this maker.
+   *
+   * @param maker The target maker id, e.g "01".
+   *
+   * @sa openFile
+   */
+  void setCurrentMaker(const char* maker) override;
+
+  /**
+   * @brief Returns the currently selected maker.
+   *
+   * @return The selected maker, or nullptr.
+   */
+  const uint8_t* getCurrentMaker() const override;
+
+  /**
+   * @brief Retrieves the format assigned serial.
+   *
+   * @param[out] serial Out reference that will contain the serial number.
+   */
+  void getSerial(uint64_t& serial) override;
+
+  /**
+   * @brief Retrieves the checksum values of the Card system header.
+   *
+   * @param checksum The checksum of the system header.
+   * @param inverse  The inverse checksum of the system header.
+   */
+  void getChecksum(uint16_t& checksum, uint16_t& inverse) const override;
+
+  /**
+   * @brief Retrieves the available storage and directory space.
+   *
+   * @param bytesNotUsed Number of free bytes out.
+   * @param filesNotUsed Number of free files out.
+   */
+  void getFreeBlocks(int32_t& bytesNotUsed, int32_t& filesNotUsed) const override;
+
+  /**
+   * @brief Retrieves the current file's encoding.
+   *
+   * @param encoding File encoding out.
+   */
+  void getEncoding(uint16_t& encoding) const override;
+
+  /**
+   * @brief Formats the memory card and assigns a new serial.
+   *
+   * @param deviceId The slot to format.
+   * @param size     The desired size of the file @sa ECardSize.
+   * @param encoding The desired encoding @sa EEncoding.
+   */
+  void format(ECardSlot deviceId, ECardSize size = ECardSize::Card2043Mb, EEncoding encoding = EEncoding::ASCII) override;
+
+  /**
+   * @brief Returns basic stats about a card image without opening a handle.
+   *
+   * @return ProbeResults structure.
+   */
+  ProbeResults probeCardFile(const std::filesystem::path& filename) override;
+
+  /**
+   * @brief Writes any changes to the Card instance immediately to disk. <br />
+   * <b>Note:</b> <i>Under normal circumstances there is no need to call this function.</i>
+   */
+  void commit() override;
+
+  /**
+   * @brief Opens card image (does nothing if currently open path matches).
+   */
+  bool open(const std::filesystem::path& filepath) override;
+
+  /**
+   * @brief Commits changes to disk and closes host file.
+   */
+  void close() override;
+
+  /**
+   * @brief Access host filename of card.
+   *
+   * @return A view to the card's filename.
+   */
+  const std::filesystem::path& cardFilename() const override { return m_filename; }
+
+  /**
+   * @brief Gets card-scope error state.
+   *
+   * @return READY, BROKEN, or NOCARD
+   */
+  ECardResult getError() const override;
+
+  /**
+   * @return Whether or not the card is within a ready state.
+   */
+  explicit operator bool() const { return getError() == ECardResult::READY; }
+};
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/CommonData.h b/aurora-main/lib/card/CommonData.h
new file mode 100644
index 0000000..14caa06
--- /dev/null
+++ b/aurora-main/lib/card/CommonData.h
@@ -0,0 +1,59 @@
+#pragma once
+
+#include <array>
+
+#include "Util.hpp"
+#include "Constants.hpp"
+
+namespace aurora::card {
+
+class FileHandle {
+  friend class CardRawFile;
+  friend class CardGciFolder;
+  uint32_t idx = UINT32_MAX;
+  int32_t offset = 0;
+  explicit FileHandle(uint32_t idx) : idx(idx) {}
+
+public:
+  FileHandle() = default;
+  explicit FileHandle(uint32_t idx, int32_t offset) : idx(idx), offset(offset) {}
+
+  [[nodiscard]] uint32_t getFileNo() const { return idx; }
+  [[nodiscard]] uint32_t getOffset() const { return offset; }
+  explicit operator bool() const { return getFileNo() != UINT32_MAX; }
+};
+
+struct ProbeResults {
+  ECardResult x0_error;
+  uint32_t x4_cardSize;   /* in megabits */
+  uint32_t x8_sectorSize; /* in bytes */
+};
+
+struct CardStat {
+  /* read-only (Set by Card::getStatus) */
+  char x0_fileName[CARD_FILENAME_MAX];
+  uint32_t x20_length;
+  uint32_t x24_time; /* seconds since 01/01/2000 midnight */
+  std::array<uint8_t, 4> x28_gameName;
+  std::array<uint8_t, 2> x2c_company;
+
+  /* read/write (Set by Card::getStatus/Card::setStatus) */
+  uint8_t x2e_bannerFormat;
+  uint8_t x2f___padding;
+  uint32_t x30_iconAddr; /* offset to the banner, bannerTlut, icon, iconTlut data set. */
+  uint16_t x34_iconFormat;
+  uint16_t x36_iconSpeed;
+  uint32_t x38_commentAddr; /* offset to the pair of 32 byte character strings. */
+
+  /* read-only (Set by Card::getStatus) */
+  uint32_t x3c_offsetBanner;
+  uint32_t x40_offsetBannerTlut;
+  std::array<uint32_t, CARD_ICON_MAX> x44_offsetIcon;
+  uint32_t x64_offsetIconTlut;
+  uint32_t x68_offsetData;
+
+  EImageFormat GetBannerFormat() const { return EImageFormat(x2e_bannerFormat & 0x3); }
+  EImageFormat GetIconFormat(int idx) const { return EImageFormat((x34_iconFormat >> (idx * 2)) & 0x3); }
+};
+
+}
diff --git a/aurora-main/lib/card/Constants.hpp b/aurora-main/lib/card/Constants.hpp
new file mode 100644
index 0000000..1367e91
--- /dev/null
+++ b/aurora-main/lib/card/Constants.hpp
@@ -0,0 +1,109 @@
+#pragma once
+
+#include <cstdint>
+
+#include "Util.hpp"
+
+#define CARD_FILENAME_MAX 32
+#define CARD_ICON_MAX 8
+
+namespace aurora::card {
+constexpr uint32_t BlockSize = 0x2000;
+constexpr uint32_t MaxFiles = 127;
+constexpr uint32_t FSTBlocks = 5;
+constexpr uint32_t MbitToBlocks = 0x10;
+constexpr uint32_t BATSize = 0xFFB;
+
+/**
+ * @brief The EPermissions enum
+ */
+enum class EPermissions : uint8_t {
+  Public = (1 << 2),
+  NoCopy = (1 << 3),
+  NoMove = (1 << 4),
+  Global = (1 << 5),
+  Company = (1 << 6)
+};
+ENABLE_BITWISE_ENUM(EPermissions)
+
+enum class EImageFormat : uint8_t {
+  None,
+  C8,
+  RGB5A3,
+};
+
+enum class EAnimationType {
+  Loop = 0,
+  Bounce = 2,
+};
+
+enum class EAnimationSpeed {
+  End,
+  Fast,
+  Middle,
+  Slow,
+};
+
+enum class SeekOrigin { Begin, Current, End };
+
+/**
+ * @brief The ECardSlot enum
+ */
+enum class ECardSlot : uint16_t { SlotA, SlotB };
+
+/**
+ * @brief The ECardSize enum
+ */
+enum class ECardSize : uint16_t {
+  Card59Mb = 0x04,
+  Card123Mb = 0x08,
+  Card251Mb = 0x10,
+  Card507Mb = 0x20,
+  Card1019Mb = 0x40,
+  Card2043Mb = 0x80
+};
+
+/**
+ * @brief The EEncoding enum
+ */
+enum class EEncoding : uint16_t {
+  ASCII, /**< Standard ASCII Encoding */
+  SJIS   /**< SJIS Encoding for japanese */
+};
+
+constexpr uint32_t BannerSize(EImageFormat fmt) {
+  switch (fmt) {
+  default:
+  case EImageFormat::None:
+    return 0;
+  case EImageFormat::C8:
+    return 3584;
+  case EImageFormat::RGB5A3:
+    return 6144;
+  }
+}
+
+constexpr uint32_t IconSize(EImageFormat fmt) {
+  switch (fmt) {
+  default:
+  case EImageFormat::None:
+    return 0;
+  case EImageFormat::C8:
+    return 1024;
+  case EImageFormat::RGB5A3:
+    return 2048;
+  }
+}
+
+constexpr uint32_t TlutSize(EImageFormat fmt) {
+  switch (fmt) {
+  default:
+  case EImageFormat::None:
+  case EImageFormat::RGB5A3:
+    return 0;
+  case EImageFormat::C8:
+    return 512;
+  }
+}
+
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/Directory.cpp b/aurora-main/lib/card/Directory.cpp
new file mode 100644
index 0000000..b2a9bcb
--- /dev/null
+++ b/aurora-main/lib/card/Directory.cpp
@@ -0,0 +1,142 @@
+#include "Directory.hpp"
+
+#include <algorithm>
+#include <cstring>
+
+#include "../internal.hpp"
+#include "Util.hpp"
+
+namespace aurora::card {
+void Directory::swapEndian() {
+  std::for_each(std::begin(data.m_files), std::end(data.m_files), [](File& f) { f.swapEndian(); });
+
+  data.m_updateCounter = bswap(data.m_updateCounter);
+  data.m_checksum = bswap(data.m_checksum);
+  data.m_checksumInv = bswap(data.m_checksumInv);
+}
+
+void Directory::updateChecksum() {
+  swapEndian();
+  calculateChecksumBE(reinterpret_cast<uint16_t*>(raw.data()), 0xFFE, &data.m_checksum, &data.m_checksumInv);
+  swapEndian();
+}
+
+bool Directory::valid() const {
+  uint16_t ckSum, ckSumInv;
+  const_cast<Directory&>(*this).swapEndian();
+  calculateChecksumBE(reinterpret_cast<const uint16_t*>(raw.data()), 0xFFE, &ckSum, &ckSumInv);
+  const bool res = (ckSum == data.m_checksum && ckSumInv == data.m_checksumInv);
+  const_cast<Directory&>(*this).swapEndian();
+  return res;
+}
+
+Directory::Directory() {
+  raw.fill(0xFF);
+  data.m_updateCounter = 0;
+  updateChecksum();
+}
+
+Directory::Directory(const RawData& rawData) : raw{rawData} {}
+
+bool Directory::hasFreeFile() const {
+  return std::any_of(std::cbegin(data.m_files), std::cend(data.m_files),
+                     [](const auto& file) { return file.m_game[0] == 0xFF; });
+}
+
+int32_t Directory::numFreeFiles() const {
+  return int32_t(std::count_if(std::cbegin(data.m_files), std::cend(data.m_files),
+                               [](const auto& file) { return file.m_game[0] == 0xFF; }));
+}
+
+File* Directory::getFirstFreeFile(const char* game, const char* maker, const char* filename) {
+  const auto iter = std::find_if(std::begin(data.m_files), std::end(data.m_files),
+                                 [](const auto& file) { return file.m_game[0] == 0xFF; });
+
+  if (iter == std::end(data.m_files)) {
+    return nullptr;
+  }
+
+  *iter = File(filename);
+  if (game != nullptr && std::strlen(game) == 4) {
+    std::memcpy(iter->m_game, game, 4);
+  }
+  if (maker != nullptr && std::strlen(maker) == 2) {
+    std::memcpy(iter->m_maker, maker, 2);
+  }
+
+  return &*iter;
+}
+
+File* Directory::getFirstNonFreeFile(uint32_t start, const char* game, const char* maker) {
+  const auto iter =
+      std::find_if(std::begin(data.m_files) + start, std::end(data.m_files), [game, maker](const auto& file) {
+        if (file.m_game[0] == 0xFF) {
+          return false;
+        }
+
+        const auto* const game_ptr = reinterpret_cast<const char*>(file.m_game);
+        const auto game_size = 4;
+        if (game != nullptr && std::strlen(game) == game_size && std::strncmp(game_ptr, game, game_size) != 0) {
+          return false;
+        }
+
+        const auto* const maker_ptr = reinterpret_cast<const char*>(file.m_maker);
+        const auto maker_size = 2;
+        if (maker != nullptr && std::strlen(maker) == maker_size && std::strncmp(maker_ptr, maker, maker_size) != 0) {
+          return false;
+        }
+
+        return true;
+      });
+
+  if (iter == std::end(data.m_files)) {
+    return nullptr;
+  }
+
+  return &*iter;
+}
+
+File* Directory::getFile(const char* game, const char* maker, const char* filename) {
+  const auto iter = std::find_if(std::begin(data.m_files), std::end(data.m_files), [=](const auto& file) {
+    const auto game_size = 4;
+    if (game != nullptr && std::strlen(game) == game_size && std::memcmp(file.m_game, game, game_size) != 0) {
+      return false;
+    }
+
+    const auto maker_size = 2;
+    if (maker != nullptr && std::strlen(maker) == maker_size && std::memcmp(file.m_maker, maker, maker_size) != 0) {
+      return false;
+    }
+
+    return std::strncmp(file.m_filename, filename, 32) == 0;
+  });
+
+  if (iter == std::cend(data.m_files)) {
+    return nullptr;
+  }
+
+  return &*iter;
+}
+
+File* Directory::getFile(uint32_t idx) {
+  if (idx >= MaxFiles) {
+    return nullptr;
+  }
+
+  return &data.m_files[idx];
+}
+
+int32_t Directory::indexForFile(const File* f) const {
+  if (f == nullptr) {
+    return -1;
+  }
+
+  const auto it =
+      std::find_if(std::cbegin(data.m_files), std::cend(data.m_files), [&f](const File& file) { return f == &file; });
+  if (it == std::cend(data.m_files)) {
+    return -1;
+  }
+
+  return it - std::cbegin(data.m_files);
+}
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/Directory.hpp b/aurora-main/lib/card/Directory.hpp
new file mode 100644
index 0000000..bee9027
--- /dev/null
+++ b/aurora-main/lib/card/Directory.hpp
@@ -0,0 +1,45 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+
+#include "File.hpp"
+
+namespace aurora::card {
+class Directory {
+  friend class CardRawFile;
+
+#pragma pack(push, 4)
+  using RawData = std::array<uint8_t, BlockSize>;
+  struct Data {
+    File m_files[MaxFiles];
+    uint8_t padding[0x3a];
+    uint16_t m_updateCounter;
+    uint16_t m_checksum;
+    uint16_t m_checksumInv;
+  };
+#pragma pack(pop)
+
+  union {
+    Data data;
+    RawData raw;
+  };
+
+  void swapEndian();
+  void updateChecksum();
+  bool valid() const;
+
+public:
+  Directory();
+  explicit Directory(const RawData& rawData);
+  ~Directory() = default;
+
+  bool hasFreeFile() const;
+  int32_t numFreeFiles() const;
+  File* getFirstFreeFile(const char* game, const char* maker, const char* filename);
+  File* getFirstNonFreeFile(uint32_t start, const char* game, const char* maker);
+  File* getFile(const char* game, const char* maker, const char* filename);
+  File* getFile(uint32_t idx);
+  int32_t indexForFile(const File* f) const;
+};
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/DolphinCardPath.cpp b/aurora-main/lib/card/DolphinCardPath.cpp
new file mode 100644
index 0000000..0d0adf0
--- /dev/null
+++ b/aurora-main/lib/card/DolphinCardPath.cpp
@@ -0,0 +1,118 @@
+#include <filesystem>
+
+#include "DolphinCardPath.hpp"
+
+#if WIN32
+#include "windows.h"
+#include "winreg.h"
+#include "shlobj_core.h"
+#endif
+
+#include <SDL3/SDL_filesystem.h>
+
+#include "../internal.hpp"
+
+#if WIN32
+namespace {
+  std::string ConvertWideToANSI(const std::wstring& wstr) {
+    int count = WideCharToMultiByte(CP_ACP, 0, wstr.c_str(), wstr.length(), NULL, 0, NULL, NULL);
+    std::string str(count, 0);
+    WideCharToMultiByte(CP_ACP, 0, wstr.c_str(), -1, &str[0], count, NULL, NULL);
+    return str;
+  }
+}
+#endif
+
+namespace aurora::card {
+aurora::Module Log("aurora::card");
+
+#if WIN32
+
+#if WINDOWS_STORE
+using namespace Windows::Storage;
+#endif
+
+std::string ResolveDolphinCardPath(ECardSlot slot, const char* regionCode, bool isGciFolder) {
+#if !WINDOWS_STORE
+  /* Detect where the User directory is. There are two different cases
+   * 1. HKCU\Software\Dolphin Emulator\UserConfigPath exists
+   *    -> Use this as the user directory path
+   * 2. My Documents exists
+   *    -> Use My Documents\Dolphin Emulator as the User directory path
+   */
+
+  /* Check our registry keys */
+  HKEY hkey;
+  wchar_t configPath[MAX_PATH] = {0};
+  if (RegOpenKeyEx(HKEY_CURRENT_USER, TEXT("Software\\Dolphin Emulator"), 0, KEY_QUERY_VALUE, &hkey) == ERROR_SUCCESS) {
+    DWORD size = MAX_PATH;
+    if (RegQueryValueEx(hkey, TEXT("UserConfigPath"), nullptr, nullptr, (LPBYTE)configPath, &size) != ERROR_SUCCESS)
+      configPath[0] = 0;
+    RegCloseKey(hkey);
+  }
+
+  /* Get My Documents path in case we need it. */
+  PWSTR my_documents;
+  bool my_documents_found =
+      SUCCEEDED(SHGetKnownFolderPath(FOLDERID_Documents, 0, NULL, &my_documents));
+
+  std::wstring w_path;
+  if (configPath[0]) /* Case 1 */
+    w_path = configPath;
+  else if (my_documents_found) /* Case 2 */ {
+    w_path = my_documents;
+    w_path += L"\\Dolphin Emulator";
+  }
+  else /* Unable to find */ {
+    Log.error("Unable to find Dolphin Emulator user directory!");
+    return {};
+  }
+#else
+  StorageFolder ^ localFolder = ApplicationData::Current->LocalFolder;
+  std::string path(localFolder->Path->Data());
+#endif
+
+  std::string path;
+  if (isGciFolder) {
+    path = fmt::format("{}/GC/{}/Card {}", ConvertWideToANSI(w_path), regionCode, slot == ECardSlot::SlotA ? 'A' : 'B');
+  }else {
+    path = fmt::format("{}/GC/MemoryCard{}.{}.raw", ConvertWideToANSI(w_path), slot == ECardSlot::SlotA ? 'A' : 'B', regionCode);
+  }
+
+  if (!std::filesystem::exists(path)) {
+    Log.error("Unable to find Dolphin Card file! Search Path: {}", path);
+    return {};
+  }
+
+  return path;
+}
+#else
+static std::optional<std::string> GetPrefPath(const char* app) {
+  char* path = SDL_GetPrefPath(nullptr, app);
+  if (path == nullptr) {
+    return {};
+  }
+  std::string str{path};
+  SDL_free(path);
+  return str;
+}
+
+std::string ResolveDolphinCardPath(ECardSlot slot, const char* regionCode, bool isGciFolder) {
+  const auto dolphinPath = GetPrefPath("dolphin-emu");
+  if (!dolphinPath) {
+    return {};
+  }
+  auto path = *dolphinPath;
+  if (isGciFolder) {
+    path += fmt::format("GC/{}/Card {}", regionCode, slot == ECardSlot::SlotA ? 'A' : 'B');
+  }else {
+    path += fmt::format("GC/MemoryCard{}.{}.raw", slot == ECardSlot::SlotA ? 'A' : 'B', regionCode);
+  }
+
+  if (!std::filesystem::exists(path)) return {};
+
+  return path;
+}
+#endif
+
+}
diff --git a/aurora-main/lib/card/DolphinCardPath.hpp b/aurora-main/lib/card/DolphinCardPath.hpp
new file mode 100644
index 0000000..2a45182
--- /dev/null
+++ b/aurora-main/lib/card/DolphinCardPath.hpp
@@ -0,0 +1,9 @@
+#pragma once
+#include <optional>
+#include <string>
+
+#include "Constants.hpp"
+
+namespace aurora::card {
+std::string ResolveDolphinCardPath(ECardSlot slot, const char* regionCode, bool isGciFolder);
+}
\ No newline at end of file
diff --git a/aurora-main/lib/card/File.cpp b/aurora-main/lib/card/File.cpp
new file mode 100644
index 0000000..8be888c
--- /dev/null
+++ b/aurora-main/lib/card/File.cpp
@@ -0,0 +1,28 @@
+#include "File.hpp"
+
+#include <cstring>
+#include <iterator>
+
+#include "../internal.hpp"
+
+namespace aurora::card {
+File::File() { raw.fill(0xFF); }
+
+File::File(const RawData& rawData) : raw{rawData} {}
+
+File::File(const char* filename) {
+  raw.fill(0);
+  std::memset(m_filename, 0, std::size(m_filename));
+  std::strncpy(m_filename, filename, std::size(m_filename) - 1);
+}
+void File::swapEndian() {
+  m_modifiedTime = bswap(m_modifiedTime);
+  m_iconAddress = bswap(m_iconAddress);
+  m_iconFmt = bswap(m_iconFmt);
+  m_animSpeed = bswap(m_animSpeed);
+  m_firstBlock = bswap(m_firstBlock);
+  m_blockCount = bswap(m_blockCount);
+  m_reserved2 = bswap(m_reserved2);
+  m_commentAddr = bswap(m_commentAddr);
+}
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/File.hpp b/aurora-main/lib/card/File.hpp
new file mode 100644
index 0000000..7bb9b5d
--- /dev/null
+++ b/aurora-main/lib/card/File.hpp
@@ -0,0 +1,48 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+
+#include "Constants.hpp"
+
+namespace aurora::card {
+class File {
+  friend class IFileHandle;
+  friend class Directory;
+  friend class CardRawFile;
+  friend class CardGciFolder;
+#pragma pack(push, 4)
+  using RawData = std::array<uint8_t, 0x40>;
+  union {
+    struct {
+      uint8_t m_game[4];
+      uint8_t m_maker[2];
+      uint8_t m_reserved;
+      uint8_t m_bannerFlags;
+#if __GNUC__ && !__clang__
+      __attribute__((nonstring))
+#endif
+      char m_filename[0x20];
+      uint32_t m_modifiedTime;
+      uint32_t m_iconAddress;
+      uint16_t m_iconFmt;
+      uint16_t m_animSpeed;
+      EPermissions m_permissions;
+      int8_t m_copyCounter;
+      uint16_t m_firstBlock;
+      uint16_t m_blockCount;
+      uint16_t m_reserved2;
+      uint32_t m_commentAddr;
+    };
+    RawData raw;
+  };
+#pragma pack(pop)
+  void swapEndian();
+
+public:
+  File();
+  explicit File(const RawData& rawData);
+  explicit File(const char* filename);
+  ~File() = default;
+};
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/FileIO.cpp b/aurora-main/lib/card/FileIO.cpp
new file mode 100644
index 0000000..c19185f
--- /dev/null
+++ b/aurora-main/lib/card/FileIO.cpp
@@ -0,0 +1,124 @@
+#include "FileIO.hpp"
+
+#include <SDL3/SDL_iostream.h>
+#include <SDL3/SDL_filesystem.h>
+
+#include <cstdint>
+#include <utility>
+
+#include "../fs_helper.hpp"
+
+namespace aurora::card {
+
+FileIO::FileIO(const std::filesystem::path& filename, bool truncate) {
+  m_path = fs_path_to_string(filename);;
+  SDL_IOStream* stream = nullptr;
+
+  stream = fileOpen(m_path, truncate ? "w+b" : "r+b");
+
+  if (stream != nullptr) {
+    SDL_FlushIO(stream);
+    SDL_CloseIO(stream);
+    m_ready = true;
+  }
+}
+
+FileIO::FileIO(FileIO&& other) noexcept {
+  m_path = std::move(other.m_path);
+  m_ready = std::exchange(other.m_ready, false);
+}
+
+FileIO& FileIO::operator=(FileIO&& other) noexcept {
+  if (this != &other) {
+    m_path = std::move(other.m_path);
+    m_ready = std::exchange(other.m_ready, false);
+  }
+  return *this;
+}
+
+bool FileIO::fileRead(void* buf, size_t length, off_t offset) {
+  if (!isReady()) {
+    return false;
+  }
+
+  SDL_IOStream* stream = fileOpen(m_path, "rb");
+  if (stream == nullptr) {
+    return false;
+  }
+
+  if (SDL_SeekIO(stream, offset, SDL_IO_SEEK_SET) < 0) {
+    SDL_CloseIO(stream);
+    return false;
+  }
+
+  size_t total = 0;
+  auto* dst = static_cast<uint8_t*>(buf);
+  while (total < length) {
+    const size_t read = SDL_ReadIO(stream, dst + total, length - total);
+    if (read == 0) {
+      SDL_CloseIO(stream);
+      return false;
+    }
+    total += read;
+  }
+
+  SDL_CloseIO(stream);
+  return true;
+}
+
+bool FileIO::fileWrite(const void* buf, size_t length, off_t offset) {
+  if (!isReady()) {
+    return false;
+  }
+
+  SDL_IOStream* stream = fileOpen(m_path, "r+b");
+  if (stream == nullptr) {
+    stream = fileOpen(m_path, "w+b");
+  }
+  if (stream == nullptr) {
+    return false;
+  }
+
+  if (SDL_SeekIO(stream, offset, SDL_IO_SEEK_SET) < 0) {
+    SDL_FlushIO(stream);
+    SDL_CloseIO(stream);
+    return false;
+  }
+
+  size_t total = 0;
+  auto* src = static_cast<const uint8_t*>(buf);
+  while (total < length) {
+    const size_t written = SDL_WriteIO(stream, src + total, length - total);
+    if (written == 0) {
+      SDL_CloseIO(stream);
+      return false;
+    }
+    total += written;
+  }
+
+  SDL_FlushIO(stream);
+  SDL_CloseIO(stream);
+  return true;
+}
+
+size_t FileIO::fileSize() const {
+  SDL_PathInfo info;
+  const auto tr = fs_path_to_string(m_path);
+  if (SDL_GetPathInfo(m_path.c_str(), &info)) {
+    return info.size;
+  }
+  return 0;
+}
+
+bool FileIO::deleteFile() {
+  if (SDL_RemovePath(m_path.c_str())) {
+    m_ready = false;
+    m_path.clear();
+    return true;
+  }
+  return false;
+}
+
+FileIO::operator bool() const { return isReady(); }
+
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/FileIO.hpp b/aurora-main/lib/card/FileIO.hpp
new file mode 100644
index 0000000..98fa929
--- /dev/null
+++ b/aurora-main/lib/card/FileIO.hpp
@@ -0,0 +1,35 @@
+#pragma once
+
+#include <cstddef>
+#include <string>
+#include <filesystem>
+
+#include <SDL3/SDL_iostream.h>
+
+namespace aurora::card {
+
+class FileIO {
+  std::string m_path;
+  bool m_ready = false;
+
+  bool isReady() const { return m_ready && !m_path.empty(); };
+
+public:
+  FileIO() = default;
+  explicit FileIO(const std::filesystem::path& filename, bool truncate = false);
+  ~FileIO() = default;
+
+  FileIO(FileIO&& other) noexcept;
+  FileIO& operator=(FileIO&& other) noexcept;
+  FileIO(const FileIO& other) = delete;
+  FileIO& operator=(const FileIO& other) = delete;
+
+  static SDL_IOStream* fileOpen(const std::string& path, const char* mode) {return path.empty() ? nullptr : SDL_IOFromFile(path.c_str(), mode);}
+  bool fileRead(void* buf, size_t length, off_t offset);
+  bool fileWrite(const void* buf, size_t length, off_t offset);
+  size_t fileSize() const;
+  bool deleteFile();
+  explicit operator bool() const;
+};
+
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/ICard.hpp b/aurora-main/lib/card/ICard.hpp
new file mode 100644
index 0000000..a169d4d
--- /dev/null
+++ b/aurora-main/lib/card/ICard.hpp
@@ -0,0 +1,45 @@
+#pragma once
+
+#include "Constants.hpp"
+#include "Util.hpp"
+#include <filesystem>
+
+namespace aurora::card {
+class ICard {
+public:
+  virtual ~ICard() = default;
+
+  virtual void InitCard(const char* game = nullptr, const char* maker = nullptr) = 0;
+
+  virtual ECardResult openFile(const char* filename, FileHandle& handleOut) = 0;
+  virtual ECardResult openFile(uint32_t fileno, FileHandle& handleOut) = 0;
+  virtual ECardResult createFile(const char* filename, size_t size, FileHandle& handleOut) = 0;
+  virtual ECardResult closeFile(FileHandle& fh) = 0;
+  virtual void deleteFile(const FileHandle& fh) = 0;
+  virtual ECardResult deleteFile(const char* filename) = 0;
+  virtual ECardResult deleteFile(uint32_t fileno) = 0;
+  virtual ECardResult renameFile(const char* oldName, const char* newName) = 0;
+  virtual ECardResult fileWrite(FileHandle& fh, const void* buf, size_t size) = 0;
+  virtual ECardResult fileRead(FileHandle& fh, void* dst, size_t size) = 0;
+  virtual void seek(FileHandle& fh, int32_t pos, SeekOrigin whence) = 0;
+  virtual ECardResult getStatus(const FileHandle& fh, CardStat& statOut) const = 0;
+  virtual ECardResult getStatus(uint32_t fileNo, CardStat& statOut) const = 0;
+  virtual ECardResult setStatus(const FileHandle& fh, const CardStat& stat) = 0;
+  virtual ECardResult setStatus(uint32_t fileNo, const CardStat& stat) = 0;
+  virtual void setCurrentGame(const char* game) = 0;
+  virtual const uint8_t* getCurrentGame() const = 0;
+  virtual void setCurrentMaker(const char* maker) = 0;
+  virtual const uint8_t* getCurrentMaker() const = 0;
+  virtual void getSerial(uint64_t& serial) = 0;
+  virtual void getChecksum(uint16_t& checksum, uint16_t& inverse) const = 0;
+  virtual void getFreeBlocks(int32_t& bytesNotUsed, int32_t& filesNotUsed) const = 0;
+  virtual void getEncoding(uint16_t& encoding) const = 0;
+  virtual void format(ECardSlot deviceId, ECardSize size = ECardSize::Card2043Mb, EEncoding encoding = EEncoding::ASCII) = 0;
+  virtual void commit() = 0;
+  virtual bool open(const std::filesystem::path& filepath) = 0;
+  virtual void close() = 0;
+  virtual const std::filesystem::path& cardFilename() const = 0;
+  virtual ECardResult getError() const = 0;
+  virtual ProbeResults probeCardFile(const std::filesystem::path& filename) = 0;
+};
+}
\ No newline at end of file
diff --git a/aurora-main/lib/card/SRAM.cpp b/aurora-main/lib/card/SRAM.cpp
new file mode 100644
index 0000000..a39448f
--- /dev/null
+++ b/aurora-main/lib/card/SRAM.cpp
@@ -0,0 +1,29 @@
+#include "SRAM.hpp"
+namespace aurora::card {
+// clang-format off
+const SRAM g_SRAM =
+{{
+     0xFF, 0x6B,
+     0x00, 0x91,
+     0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00,
+     0xFF, 0xFF, 0xFF, 0x40,
+     0x00,
+     0x00,
+     0x00,
+     0x2C,
+     0x41, 0x58, 0x49, 0x4F, 0x44, 0x4C, 0x5F, 0x53, 0x4C, 0x4F, 0x54, 0x41,
+     0x41, 0x58, 0x49, 0x4F, 0x44, 0x4C, 0x5F, 0x53, 0x4C, 0x4F, 0x54, 0x42,
+     0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00,
+     0x00, 0x00,
+     0x00, 0x00,
+     0x00, 0x00,
+     0x00,
+     0x00,
+     0x6E, 0x6D,
+     0x00, 0x00,
+     0x00, 0x00
+}};
+// clang-format on
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/SRAM.hpp b/aurora-main/lib/card/SRAM.hpp
new file mode 100644
index 0000000..b035dd6
--- /dev/null
+++ b/aurora-main/lib/card/SRAM.hpp
@@ -0,0 +1,73 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+
+// Modified code taken from libogc
+
+/*-------------------------------------------------------------
+system.h -- OS functions and initialization
+Copyright (C) 2004
+Michael Wiedenbauer (shagkur)
+Dave Murphy (WinterMute)
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any
+damages arising from the use of this software.
+Permission is granted to anyone to use this software for any
+purpose, including commercial applications, and to alter it and
+redistribute it freely, subject to the following restrictions:
+1. The origin of this software must not be misrepresented; you
+must not claim that you wrote the original software. If you use
+this software in a product, an acknowledgment in the product
+documentation would be appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and
+must not be misrepresented as being the original software.
+3. This notice may not be removed or altered from any source
+distribution.
+-------------------------------------------------------------*/
+
+namespace aurora::card {
+#pragma pack(push, 1)
+union SRAMFlags {
+  uint8_t Hex;
+  struct {
+    uint8_t : 2;
+    uint8_t sound : 1;       // Audio settings; 0 = Mono, 1 = Stereo
+    uint8_t initialized : 1; // if 0, displays prompt to set language on boot and asks user to set options and time/date
+    uint8_t : 2;
+    uint8_t boot_menu : 1;   // if 1, skips logo animation and boots into the system menu regardless of if there is a
+                             // disc inserted
+    uint8_t progressive : 1; // if 1, automatically displays Progressive Scan prompt in games that support it
+  };
+};
+
+union SRAM {
+  using FlashID = std::array<std::array<uint8_t, 12>, 2>;
+
+  std::array<uint8_t, 64> p_SRAM;
+  struct // Stored configuration value from the system SRAM area
+  {
+    uint16_t checksum;      // Holds the block checksum.
+    uint16_t checksum_inv;  // Holds the inverse block checksum
+    uint32_t ead0;          // Unknown attribute
+    uint32_t ead1;          // Unknown attribute
+    uint32_t counter_bias;  // Bias value for the realtime clock
+    int8_t display_offsetH; // Pixel offset for the VI
+    uint8_t ntd;            // Unknown attribute
+    uint8_t lang;           // Language of system
+    SRAMFlags flags;        // Device and operations flag
+
+    // Stored configuration value from the extended SRAM area
+    FlashID flash_id;                       // flash_id[2][12] 96bit memorycard unlock flash ID
+    uint32_t wirelessKbd_id;                // Device ID of last connected wireless keyboard
+    std::array<uint16_t, 4> wirelessPad_id; // 16-bit device ID of last connected pad.
+    uint8_t dvderr_code;                    // last non-recoverable error from DVD interface
+    uint8_t __padding0;                     // reserved
+    std::array<uint8_t, 2> flashID_chksum;  // 8-bit checksum of unlock flash ID
+    uint32_t __padding1;                    // padding
+  };
+};
+#pragma pack(pop)
+
+extern const SRAM g_SRAM;
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/Util.cpp b/aurora-main/lib/card/Util.cpp
new file mode 100644
index 0000000..0447183
--- /dev/null
+++ b/aurora-main/lib/card/Util.cpp
@@ -0,0 +1,41 @@
+#include <ctime>
+
+#include "../internal.hpp"
+
+namespace aurora::card {
+uint64_t getGCTime() {
+  time_t sysTime, tzDST;
+
+  time(&sysTime);
+
+  // Account for DST where needed
+  tm* gmTime = localtime(&sysTime);
+  if (gmTime->tm_isdst == 1)
+    tzDST = 3600;
+  else
+    tzDST = 0;
+
+  // Lazy way to get local time in sec
+  gmTime = gmtime(&sysTime);
+  time_t tzDiff = sysTime - mktime(gmTime);
+
+  return static_cast<uint64_t>(sysTime + tzDiff + tzDST) - 0x386D4380;
+}
+
+void calculateChecksumBE(const uint16_t* data, size_t len, uint16_t* checksum, uint16_t* checksumInv) {
+  *checksum = 0;
+  *checksumInv = 0;
+  for (size_t i = 0; i < len; ++i) {
+    *checksum += bswap(data[i]);
+    *checksumInv += bswap(static_cast<uint16_t>(data[i] ^ 0xFFFF));
+  }
+
+  *checksum = bswap(*checksum);
+  *checksumInv = bswap(*checksumInv);
+  if (*checksum == 0xFFFF)
+    *checksum = 0;
+  if (*checksumInv == 0xFFFF)
+    *checksumInv = 0;
+}
+
+} // namespace aurora::card
diff --git a/aurora-main/lib/card/Util.hpp b/aurora-main/lib/card/Util.hpp
new file mode 100644
index 0000000..0875d7e
--- /dev/null
+++ b/aurora-main/lib/card/Util.hpp
@@ -0,0 +1,74 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <type_traits>
+
+#ifndef ENABLE_BITWISE_ENUM
+#define ENABLE_BITWISE_ENUM(type)                                                                                      \
+  constexpr type operator|(type a, type b) {                                                                           \
+    using T = std::underlying_type_t<type>;                                                                            \
+    return type(static_cast<T>(a) | static_cast<T>(b));                                                                \
+  }                                                                                                                    \
+  constexpr type operator&(type a, type b) {                                                                           \
+    using T = std::underlying_type_t<type>;                                                                            \
+    return type(static_cast<T>(a) & static_cast<T>(b));                                                                \
+  }                                                                                                                    \
+  constexpr type& operator|=(type& a, type b) {                                                                        \
+    using T = std::underlying_type_t<type>;                                                                            \
+    a = type(static_cast<T>(a) | static_cast<T>(b));                                                                   \
+    return a;                                                                                                          \
+  }                                                                                                                    \
+  constexpr type& operator&=(type& a, type b) {                                                                        \
+    using T = std::underlying_type_t<type>;                                                                            \
+    a = type(static_cast<T>(a) & static_cast<T>(b));                                                                   \
+    return a;                                                                                                          \
+  }                                                                                                                    \
+  constexpr type operator~(type key) {                                                                                 \
+    using T = std::underlying_type_t<type>;                                                                            \
+    return type(~static_cast<T>(key));                                                                                 \
+  }                                                                                                                    \
+  constexpr bool True(type key) {                                                                                      \
+    using T = std::underlying_type_t<type>;                                                                            \
+    return static_cast<T>(key) != 0;                                                                                   \
+  }                                                                                                                    \
+  constexpr bool False(type key) {                                                                                     \
+    using T = std::underlying_type_t<type>;                                                                            \
+    return static_cast<T>(key) == 0;                                                                                   \
+  }
+#endif
+
+#define ROUND_UP_8192(val) (((val) + 8191) & ~8191)
+
+namespace aurora::card {
+
+uint64_t getGCTime();
+
+/**
+ * @brief calculateChecksum
+ * @param data
+ * @param len
+ * @param checksum
+ * @param checksumInv
+ */
+void calculateChecksumBE(const uint16_t* data, size_t len, uint16_t* checksum, uint16_t* checksumInv);
+
+#undef NOFILE
+
+enum class ECardResult {
+  CRC_MISMATCH = -1003, /* Extension enum for Retro's CRC check */
+  FATAL_ERROR = -128,
+  ENCODING = -13,
+  NAMETOOLONG = -12,
+  INSSPACE = -9,
+  NOENT = -8,
+  EXIST = -7,
+  BROKEN = -6,
+  IOERROR = -5,
+  NOFILE = -4,
+  NOCARD = -3,
+  WRONGDEVICE = -2,
+  BUSY = -1,
+  READY = 0
+};
+} // namespace aurora::card
diff --git a/aurora-main/lib/dawn/BackendBinding.cpp b/aurora-main/lib/dawn/BackendBinding.cpp
new file mode 100644
index 0000000..bb8fba4
--- /dev/null
+++ b/aurora-main/lib/dawn/BackendBinding.cpp
@@ -0,0 +1,46 @@
+#include "BackendBinding.hpp"
+
+#include <memory>
+
+#if !defined(SDL_PLATFORM_MACOS) && !defined(SDL_PLATFORM_IOS) && !defined(SDL_PLATFORM_TVOS)
+#include <SDL3/SDL_video.h>
+#endif
+
+namespace aurora::webgpu::utils {
+std::shared_ptr<wgpu::ChainedStruct> SetupWindowAndGetSurfaceDescriptorCocoa(SDL_Window* window);
+
+std::shared_ptr<wgpu::ChainedStruct> SetupWindowAndGetSurfaceDescriptor(SDL_Window* window) {
+#if defined(SDL_PLATFORM_MACOS) || defined(SDL_PLATFORM_IOS) || defined(SDL_PLATFORM_TVOS)
+  return SetupWindowAndGetSurfaceDescriptorCocoa(window);
+#else
+  const auto props = SDL_GetWindowProperties(window);
+#if defined(SDL_PLATFORM_ANDROID)
+  std::shared_ptr<wgpu::SurfaceSourceAndroidNativeWindow> desc =
+      std::make_shared<wgpu::SurfaceSourceAndroidNativeWindow>();
+  desc->window = SDL_GetPointerProperty(props, SDL_PROP_WINDOW_ANDROID_WINDOW_POINTER, nullptr);
+  return std::move(desc);
+#elif defined(SDL_PLATFORM_WIN32)
+  std::shared_ptr<wgpu::SurfaceSourceWindowsHWND> desc = std::make_shared<wgpu::SurfaceSourceWindowsHWND>();
+  desc->hwnd = SDL_GetPointerProperty(props, SDL_PROP_WINDOW_WIN32_HWND_POINTER, nullptr);
+  desc->hinstance = SDL_GetPointerProperty(props, SDL_PROP_WINDOW_WIN32_INSTANCE_POINTER, nullptr);
+  return std::move(desc);
+#elif defined(SDL_PLATFORM_LINUX)
+  const char* driver = SDL_GetCurrentVideoDriver();
+  if (SDL_strcmp(driver, "wayland") == 0) {
+    std::shared_ptr<wgpu::SurfaceSourceWaylandSurface> desc = std::make_shared<wgpu::SurfaceSourceWaylandSurface>();
+    desc->display = SDL_GetPointerProperty(props, SDL_PROP_WINDOW_WAYLAND_DISPLAY_POINTER, nullptr);
+    desc->surface = SDL_GetPointerProperty(props, SDL_PROP_WINDOW_WAYLAND_SURFACE_POINTER, nullptr);
+    return std::move(desc);
+  }
+  if (SDL_strcmp(driver, "x11") == 0) {
+    std::shared_ptr<wgpu::SurfaceSourceXlibWindow> desc = std::make_shared<wgpu::SurfaceSourceXlibWindow>();
+    desc->display = SDL_GetPointerProperty(props, SDL_PROP_WINDOW_X11_DISPLAY_POINTER, nullptr);
+    desc->window = SDL_GetNumberProperty(props, SDL_PROP_WINDOW_X11_WINDOW_NUMBER, 0);
+    return std::move(desc);
+  }
+#endif
+  return nullptr;
+#endif
+}
+
+} // namespace aurora::webgpu::utils
diff --git a/aurora-main/lib/dawn/BackendBinding.hpp b/aurora-main/lib/dawn/BackendBinding.hpp
new file mode 100644
index 0000000..ac49d5c
--- /dev/null
+++ b/aurora-main/lib/dawn/BackendBinding.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include <memory>
+#include <webgpu/webgpu_cpp.h>
+
+struct SDL_Window;
+
+namespace aurora::webgpu::utils {
+
+std::shared_ptr<wgpu::ChainedStruct> SetupWindowAndGetSurfaceDescriptor(SDL_Window* window);
+
+} // namespace aurora::webgpu::utils
diff --git a/aurora-main/lib/dawn/MetalBinding.mm b/aurora-main/lib/dawn/MetalBinding.mm
new file mode 100644
index 0000000..421bd9e
--- /dev/null
+++ b/aurora-main/lib/dawn/MetalBinding.mm
@@ -0,0 +1,13 @@
+#include "BackendBinding.hpp"
+
+#import <Foundation/Foundation.h>
+#include <SDL3/SDL_metal.h>
+
+namespace aurora::webgpu::utils {
+std::shared_ptr<wgpu::ChainedStruct> SetupWindowAndGetSurfaceDescriptorCocoa(SDL_Window* window) {
+  SDL_MetalView view = SDL_Metal_CreateView(window);
+  std::shared_ptr<wgpu::SurfaceSourceMetalLayer> desc = std::make_shared<wgpu::SurfaceSourceMetalLayer>();
+  desc->layer = SDL_Metal_GetLayer(view);
+  return std::move(desc);
+}
+} // namespace aurora::webgpu::utils
diff --git a/aurora-main/lib/dolphin/AR.cpp b/aurora-main/lib/dolphin/AR.cpp
new file mode 100644
index 0000000..c2cb3bc
--- /dev/null
+++ b/aurora-main/lib/dolphin/AR.cpp
@@ -0,0 +1,115 @@
+#include <dolphin/ar.h>
+#include "../internal.hpp"
+#include "dolphin/os.h"
+
+static aurora::Module Log("aurora::ar");
+
+static u32 AR_StackPointer;
+static u32* AR_BlockLength;
+static u32 AR_FreeBlocks;
+static BOOL AR_init_flag;
+
+#define ARAM_STACK_START 0x4000;
+
+// ARAM emulation: allocate a large buffer to simulate the GameCube's Auxiliary RAM.
+// ARAM "addresses" are offsets into this buffer. On GameCube, ARAM is 16 MB starting
+// at a base address returned by ARInit. We emulate this by malloc'ing a buffer
+// and using a simple bump allocator (matching ARAlloc behavior on real hardware).
+static u8* sAramBuffer = nullptr;
+
+// Convert an ARAM "address" (offset) to a real host pointer
+static u8* aramToHost(u32 aramAddr) {
+  if (!sAramBuffer || aramAddr >= aurora::g_config.mem2Size) {
+    return nullptr;
+  }
+  return sAramBuffer + aramAddr;
+}
+
+u32 ARAlloc(u32 length) {
+  u32 tmp;
+
+  ASSERTMSGLINE(430, !(length & 0x1F), "ARAlloc(): length is not multiple of 32bytes!");
+  ASSERTMSGLINE(434, length <= (__AR_Size - __AR_StackPointer), "ARAlloc(): Out of ARAM!");
+  ASSERTMSGLINE(435, __AR_FreeBlocks, "ARAlloc(): No more free blocks!");
+
+  tmp = AR_StackPointer;
+  AR_StackPointer += length;
+  *AR_BlockLength = length;
+  AR_BlockLength += 1;
+  AR_FreeBlocks -= 1;
+  return tmp;
+}
+
+u32 ARFree(u32* length) {
+  AR_BlockLength -= 1;
+  if (length) {
+    *length = *AR_BlockLength;
+  }
+  AR_StackPointer -= *AR_BlockLength;
+  AR_FreeBlocks += 1;
+  return AR_StackPointer;
+}
+
+BOOL ARCheckInit(void) { return AR_init_flag; }
+
+u32 ARInit(u32* stack_index_addr, u32 num_entries) {
+  if (aurora::g_config.mem2Size == 0) {
+    Log.warn("ARInit called but no mem2Size specified in AuroraConfig. ARAM will not be available!");
+    return 0;
+  }
+
+  if (AR_init_flag == TRUE) {
+    return ARAM_STACK_START;
+  }
+
+  sAramBuffer = (u8*)calloc(1, aurora::g_config.mem2Size);
+  if (sAramBuffer) {
+    Log.debug("Initialized 0x{:X} bytes of ARAM!", aurora::g_config.mem2Size);
+  } else {
+    Log.fatal("Failed to allocate ARAM!");
+  }
+
+  AR_StackPointer = ARAM_STACK_START;
+  AR_FreeBlocks = num_entries;
+  AR_BlockLength = stack_index_addr;
+
+  AR_init_flag = TRUE;
+  return AR_StackPointer;
+}
+
+u32 ARGetSize(void) { return aurora::g_config.mem2Size; }
+
+#pragma mark ARQ
+void ARQPostRequest(ARQRequest* request, u32 owner, u32 type, u32 priority, uintptr_t source, uintptr_t dest,
+                    u32 length, ARQCallback callback) {
+  // Emulate ARAM DMA transfers using memcpy.
+  // type 0 = MRAM -> ARAM, type 1 = ARAM -> MRAM
+  if (type == ARAM_DIR_MRAM_TO_ARAM) {
+    // Main RAM -> ARAM: source is a host pointer (cast to u32), dest is an ARAM offset
+    u8* hostSrc = (u8*)(uintptr_t)source;
+    u8* aramDst = aramToHost(dest);
+    if (aramDst && hostSrc) {
+      memcpy(aramDst, hostSrc, length);
+    }
+  } else {
+    // ARAM -> Main RAM: source is an ARAM offset, dest is a host pointer (cast to u32)
+    u8* aramSrc = aramToHost(source);
+    u8* hostDst = (u8*)(uintptr_t)dest;
+    if (aramSrc && hostDst) {
+      memcpy(hostDst, aramSrc, length);
+    }
+  }
+
+  // Immediately invoke the callback (synchronous on PC, no DMA latency)
+  if (callback) {
+    callback((uintptr_t)request);
+  }
+}
+
+void ARQInit() {
+  // Nothing to do on PC - ARAM is initialized in ARInit
+}
+
+void* ARGetStorageAddress() {
+  return sAramBuffer;
+}
diff --git a/aurora-main/lib/dolphin/card.cpp b/aurora-main/lib/dolphin/card.cpp
new file mode 100644
index 0000000..626ce4f
--- /dev/null
+++ b/aurora-main/lib/dolphin/card.cpp
@@ -0,0 +1,742 @@
+#include "dolphin/card.h"
+
+#include <filesystem>
+
+#include "../internal.hpp"
+#include "dolphin/types.h"
+
+#include "../card/CardRawFile.hpp"
+#include "../card/DolphinCardPath.hpp"
+#include "../logging.hpp"
+#include "../card/CardGciFolder.hpp"
+#include "../fs_helper.hpp"
+
+namespace {
+aurora::Module Log("aurora::card");
+std::array<std::unique_ptr<aurora::card::ICard>, 2> CardChannels = {{}};
+std::array<std::filesystem::path, 2> cardPaths;
+
+constexpr uint16_t CARD_SECTOR_SIZE = 8192;
+
+const char* GetCardRegion() {
+  switch (aurora::g_gameName[3]) {
+  case 'E':
+  default:
+    return "USA";
+  case 'P':
+    return "EUR";
+  case 'J':
+    return "JAP";
+  }
+}
+
+#define GET_CARD(slot) CardChannels[slot]
+#define CARD_USE_GCI_FOLDER SelectedFileType == CARD_GCIFOLDER
+#define CARD_READY(slot) (CARD_USE_GCI_FOLDER ? true : std::filesystem::exists(CardChannels[slot]->cardFilename()))
+#define CARD_STUB Log.debug("{} is stubbed.", __FUNCTION__);
+
+bool Initialized = false;
+CARDFileType SelectedFileType = CARD_GCIFOLDER;
+bool UseFastMode = false;
+
+void CopyKabuFileHandleToDolphin(const s32 chan, const aurora::card::FileHandle& handle, CARDFileInfo* fileInfo) {
+  fileInfo->chan = chan;
+  fileInfo->fileNo = handle.getFileNo();
+  fileInfo->offset = handle.getOffset();
+}
+
+aurora::card::FileHandle CreateKabuFileHandleFromDolphin(const CARDFileInfo* fileInfo) {
+  return aurora::card::FileHandle{static_cast<u32>(fileInfo->fileNo), fileInfo->offset};
+}
+
+std::filesystem::path GetCardFullPath(const std::filesystem::path& path, const aurora::card::ECardSlot slot) {
+  if (path.empty())
+    return "";
+
+  if (CARD_USE_GCI_FOLDER) {
+    return path / GetCardRegion() / (slot == aurora::card::ECardSlot::SlotA ? "Card A" : "Card B");
+  } else {
+    return path / fmt::format("MemoryCard{}.{}.raw", slot == aurora::card::ECardSlot::SlotA ? "A" : "B", GetCardRegion());
+  }
+}
+} // namespace
+
+extern "C" {
+
+void CopyKabuStatsToDolphin(const aurora::card::CardStat& kabuStats, CARDStat* stats) {
+  memcpy(stats->fileName, kabuStats.x0_fileName, std::size(kabuStats.x0_fileName));
+  memcpy(stats->gameName, kabuStats.x28_gameName.data(), kabuStats.x28_gameName.size());
+  memcpy(stats->company, kabuStats.x2c_company.data(), kabuStats.x2c_company.size());
+  memcpy(stats->offsetIcon, kabuStats.x44_offsetIcon.data(), kabuStats.x44_offsetIcon.size());
+
+  stats->length = kabuStats.x20_length;
+  stats->time = kabuStats.x24_time;
+  stats->bannerFormat = kabuStats.x2e_bannerFormat;
+  stats->iconAddr = kabuStats.x30_iconAddr;
+  stats->iconFormat = kabuStats.x34_iconFormat;
+  stats->iconSpeed = kabuStats.x36_iconSpeed;
+  stats->commentAddr = kabuStats.x38_commentAddr;
+  stats->offsetBanner = kabuStats.x3c_offsetBanner;
+  stats->offsetBannerTlut = kabuStats.x40_offsetBannerTlut;
+  stats->offsetIconTlut = kabuStats.x64_offsetIconTlut;
+  stats->offsetData = kabuStats.x68_offsetData;
+}
+
+void CopyDolphinStatsToKabu(aurora::card::CardStat& kabuStats, const CARDStat* stats) {
+  memcpy(kabuStats.x0_fileName, stats->fileName, std::size(kabuStats.x0_fileName));
+  memcpy(kabuStats.x28_gameName.data(), stats->gameName, kabuStats.x28_gameName.size());
+  memcpy(kabuStats.x2c_company.data(), stats->company, kabuStats.x2c_company.size());
+  memcpy(kabuStats.x44_offsetIcon.data(), stats->offsetIcon, kabuStats.x44_offsetIcon.size());
+
+  kabuStats.x20_length = stats->length;
+  kabuStats.x24_time = stats->time;
+  kabuStats.x2e_bannerFormat = stats->bannerFormat;
+  kabuStats.x30_iconAddr = stats->iconAddr;
+  kabuStats.x34_iconFormat = stats->iconFormat;
+  kabuStats.x36_iconSpeed = stats->iconSpeed;
+  kabuStats.x38_commentAddr = stats->commentAddr;
+  kabuStats.x3c_offsetBanner = stats->offsetBanner;
+  kabuStats.x40_offsetBannerTlut = stats->offsetBannerTlut;
+  kabuStats.x64_offsetIconTlut = stats->offsetIconTlut;
+  kabuStats.x68_offsetData = stats->offsetData;
+}
+
+void CARDDetectDolphin(const s32 chan) {
+  if (Initialized) {
+    Log.fatal("CARDDetectDolphin() called after CARDInit()!");
+  }
+
+  if (chan == 0 || chan == 1) {
+    cardPaths[chan] =
+        aurora::card::ResolveDolphinCardPath(static_cast<aurora::card::ECardSlot>(chan), GetCardRegion(), CARD_USE_GCI_FOLDER);
+    if (cardPaths[chan].empty()) {
+      Log.error("Failed to detect Dolphin Card!");
+      return;
+    }
+    Log.info("Detected Dolphin Card at: {}", fs_path_to_string(cardPaths[chan]));
+  } else {
+    cardPaths[0] = aurora::card::ResolveDolphinCardPath(aurora::card::ECardSlot::SlotA, GetCardRegion(), CARD_USE_GCI_FOLDER);
+    cardPaths[1] = aurora::card::ResolveDolphinCardPath(aurora::card::ECardSlot::SlotB, GetCardRegion(), CARD_USE_GCI_FOLDER);
+
+    if (cardPaths[0].empty() && cardPaths[1].empty()) {
+      Log.error("Failed to detect Dolphin Card!");
+      return;
+    }
+
+    Log.info(
+      "Detected Dolphin Card at: {} and {}",
+      fs_path_to_string(cardPaths[0]),
+      fs_path_to_string(cardPaths[1]));
+  }
+}
+
+void CARDSetBasePath(const char* path, const s32 chan) {
+  if (Initialized) {
+    Log.fatal("CARDSetBasePath() called after CARDInit()!");
+  }
+
+  std::filesystem::path filePath(path);
+
+  if (filePath.has_filename() && !std::filesystem::is_directory(filePath)) {
+    filePath = filePath.remove_filename();
+    Log.warn("Path supplied a filename, discarding. New Path: {}", fs_path_to_string(filePath));
+  }
+
+  if (chan == 0 || chan == 1) {
+    cardPaths[chan] = GetCardFullPath(filePath, static_cast<aurora::card::ECardSlot>(chan));
+  } else {
+    cardPaths[0] = GetCardFullPath(filePath, aurora::card::ECardSlot::SlotA);
+    cardPaths[1] = GetCardFullPath(filePath, aurora::card::ECardSlot::SlotB);
+  }
+}
+
+void CARDSetLoadType(CARDFileType type) {
+  SelectedFileType = type;
+}
+
+void CARDInit(const char* game, const char* maker) {
+  if (Initialized) {
+    return;
+  }
+  Initialized = true;
+  Log.info("CARD API Initialized BUILT <{} {}>", __DATE__, __TIME__);
+
+  for (int i = 0; i < CardChannels.size(); ++i) {
+    switch (SelectedFileType) {
+    case CARD_RAWIMAGE:
+      CardChannels[i] = std::make_unique<aurora::card::CardRawFile>();
+      break;
+    case CARD_GCIFOLDER:
+      CardChannels[i] = std::make_unique<aurora::card::CardGciFolder>();
+      break;
+    }
+    CardChannels[i]->InitCard(game, maker);
+  }
+
+  std::filesystem::path cardWorkingDir;
+  if (aurora::g_config.userPath != nullptr)
+    cardWorkingDir = reinterpret_cast<const char8_t*>(aurora::g_config.userPath);
+  else
+    cardWorkingDir = std::filesystem::current_path();
+
+  bool loadedCard = false;
+
+  for (int i = 0; i < 2; ++i) {
+    // use default working directory if no path was supplied for card
+    if (cardPaths[i].empty()) {
+      cardPaths[i] = GetCardFullPath(cardWorkingDir, static_cast<aurora::card::ECardSlot>(i));
+    }
+
+    const auto& curPath = cardPaths[i];
+
+    std::error_code ec;
+    if (std::filesystem::exists(curPath, ec) && CardChannels[i]->open(curPath)) {
+      loadedCard = true;
+      Log.info("Loaded GC Card Image: {}", fs_path_to_string(curPath));
+    } else if (ec) {
+      Log.warn("Failed to inspect GC Card path '{}': {}", fs_path_to_string(curPath), ec.message());
+    } else if (std::filesystem::exists(curPath, ec)) {
+      Log.warn("Failed to load GC Card Image: {}", fs_path_to_string(curPath));
+    }
+  }
+
+  // create a SlotA card if no cards were loaded
+  if (!loadedCard) {
+    CardChannels[0]->open(cardPaths[0]);
+    CardChannels[0]->format(aurora::card::ECardSlot::SlotA);
+    CardChannels[0]->close();
+	CardChannels[0]->open(cardPaths[0]);
+  }
+}
+
+void CARDSetGameAndMaker(const s32 chan, const char* game, const char* maker) {
+  if (chan < 0 || chan >= 2) {
+    return;
+  }
+
+  CardChannels[chan]->setCurrentGame(game);
+  CardChannels[chan]->setCurrentMaker(maker);
+}
+
+// TODO: Investigate if this is necessary. Do some games throw an error if CARD's fast mode can't be use?
+BOOL CARDGetFastMode() { return UseFastMode; }
+
+BOOL CARDSetFastMode(const BOOL enable) {
+  const bool oldFast = UseFastMode;
+  UseFastMode = enable;
+  return oldFast;
+}
+
+s32 CARDCheck(const s32 chan) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+
+  return static_cast<s32>(card->getError());
+}
+
+s32 CARDCheckAsync(const s32 chan, const CARDCallback callback) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+  const auto res = static_cast<s32>(card->getError());
+  callback(chan, res);
+  return static_cast<s32>(card->getError());
+}
+
+s32 CARDCheckEx(const s32 chan, s32* xferBytes [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+
+  return static_cast<s32>(card->getError());
+}
+
+s32 CARDCheckExAsync(const s32 chan, s32* xferBytes [[maybe_unused]], const CARDCallback callback) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  const auto& card = GET_CARD(chan);
+  const auto res = static_cast<s32>(card->getError());
+  callback(chan, res);
+  return static_cast<s32>(card->getError());
+}
+
+s32 CARDCreate(const s32 chan, const char* fileName, const u32 size, CARDFileInfo* fileInfo) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+  const auto& card = GET_CARD(chan);
+
+  aurora::card::FileHandle handle;
+  auto res = card->createFile(fileName, size, handle);
+  if (res == aurora::card::ECardResult::READY) {
+    CopyKabuFileHandleToDolphin(chan, handle, fileInfo);
+    card->commit();
+  } else
+    Log.error("Failed to create file: {}", fileName);
+
+  return static_cast<s32>(res);
+}
+
+s32 CARDCreateAsync(const s32 chan, const char* fileName, const u32 size, CARDFileInfo* fileInfo,
+                    const CARDCallback callback) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  const auto res = CARDCreate(chan, fileName, size, fileInfo);
+  callback(chan, res);
+  return res;
+}
+
+s32 CARDDelete(const s32 chan, const char* fileName) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+  const auto res = card->deleteFile(fileName);
+
+  if (res != aurora::card::ECardResult::READY) {
+    Log.error("Failed to delete file: {}", fileName);
+  } else {
+    card->commit();
+  }
+
+  return static_cast<s32>(res);
+}
+
+s32 CARDDeleteAsync(const s32 chan, const char* fileName, const CARDCallback callback) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  const auto res = CARDDelete(chan, fileName);
+  callback(chan, res);
+  return res;
+}
+
+s32 CARDFastDelete(const s32 chan, const s32 fileNo) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+  const auto res = card->deleteFile(fileNo);
+  if (res != aurora::card::ECardResult::READY) {
+    Log.error("Failed to delete file at idx: {}", fileNo);
+  } else {
+    card->commit();
+  }
+
+  return static_cast<s32>(res);
+}
+
+s32 CARDFastDeleteAsync(const s32 chan, const s32 fileNo, const CARDCallback callback) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  const auto res = CARDFastDelete(chan, fileNo);
+  callback(chan, res);
+  return res;
+}
+
+s32 CARDFastOpen(const s32 chan, const s32 fileNo, CARDFileInfo* fileInfo) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+
+  aurora::card::FileHandle handle;
+  const auto res = card->openFile(fileNo, handle);
+  if (res == aurora::card::ECardResult::READY)
+    CopyKabuFileHandleToDolphin(chan, handle, fileInfo);
+  else
+    Log.error("Failed to open file at idx: {}", fileNo);
+
+  return static_cast<s32>(res);
+}
+
+s32 CARDFormat(s32 chan) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+  card->format(static_cast<aurora::card::ECardSlot>(chan));
+  card->commit();
+  return CARD_RESULT_READY;
+}
+
+s32 CARDFormatAsync(const s32 chan, const CARDCallback callback) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  const auto res = CARDFormat(chan);
+  callback(chan, res);
+  return res;
+}
+
+s32 CARDFreeBlocks(const s32 chan, s32* byteNotUsed, s32* filesNotUsed) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+  card->getFreeBlocks(*byteNotUsed, *filesNotUsed);
+  return CARD_RESULT_READY;
+}
+
+s32 CARDGetAttributes(const s32 chan, const s32 fileNo [[maybe_unused]], u8* attr [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  // TODO:
+  CARD_STUB
+  return CARD_RESULT_READY;
+}
+
+s32 CARDGetEncoding(const s32 chan, u16* encode) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+  card->getEncoding(*encode);
+  return CARD_RESULT_READY;
+}
+
+s32 CARDGetMemSize(const s32 chan, u16* size [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  // TODO:
+  CARD_STUB
+  return CARD_RESULT_READY;
+}
+
+s32 CARDGetResultCode(const s32 chan) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+  return static_cast<s32>(card->getError());
+}
+
+s32 CARDGetSectorSize(const s32 chan, u32* size) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  *size = CARD_SECTOR_SIZE;
+  return CARD_RESULT_READY;
+}
+
+s32 CARDGetSerialNo(const s32 chan, u64* serialNo) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+
+  const auto& card = GET_CARD(chan);
+  card->getSerial(*serialNo);
+  return CARD_RESULT_READY;
+}
+
+s32 __CARDGetStatusEx(const s32 chan, const s32 fileNo [[maybe_unused]], CARDDir* dirent [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  // TODO:
+  CARD_STUB
+  return CARD_RESULT_READY;
+}
+
+s32 CARDGetStatus(const s32 chan, s32 fileNo, CARDStat* stat) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+  const auto& card = GET_CARD(chan);
+
+  aurora::card::CardStat kabuStat;
+  const auto res = card->getStatus(fileNo, kabuStat);
+  if (res == aurora::card::ECardResult::READY)
+    CopyKabuStatsToDolphin(kabuStat, stat);
+  else
+    Log.error("Failed to get status of file at idx: {}", fileNo);
+
+  return static_cast<s32>(res);
+}
+
+s32 CARDGetXferredBytes(const s32 chan) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+  // TODO:
+  CARD_STUB
+  return CARD_RESULT_READY;
+}
+// these two funcs are out of scope for aurora::card. stubbed for now
+s32 CARDMount(const s32 chan, void* workArea [[maybe_unused]], CARDCallback detachCallback [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  
+  return CARD_RESULT_READY;
+}
+s32 CARDMountAsync(const s32 chan, void* workArea [[maybe_unused]], const CARDCallback detachCallback [[maybe_unused]],
+                   const CARDCallback attachCallback [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  return CARD_RESULT_READY;
+}
+
+s32 CARDOpen(const s32 chan, const char* fileName, CARDFileInfo* fileInfo) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+  const auto& card = GET_CARD(chan);
+
+  aurora::card::FileHandle handle;
+  const auto res = card->openFile(fileName, handle);
+  if (res == aurora::card::ECardResult::READY)
+    CopyKabuFileHandleToDolphin(chan, handle, fileInfo);
+  else
+    Log.error("Failed to open file: {}", fileName);
+
+  return static_cast<s32>(res);
+}
+
+BOOL CARDProbe(const s32 chan) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  const auto& card = GET_CARD(chan);
+
+  aurora::card::ProbeResults probeData = card->probeCardFile(cardPaths[chan]);
+  return probeData.x0_error != aurora::card::ECardResult::NOCARD ? TRUE : FALSE;
+}
+
+s32 CARDProbeEx(const s32 chan, s32* memSize, s32* sectorSize) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  const auto& card = GET_CARD(chan);
+
+  // ReSharper disable once CppUseStructuredBinding
+  const aurora::card::ProbeResults probeData = card->probeCardFile(cardPaths[chan]);
+  *memSize = probeData.x4_cardSize;
+  *sectorSize = probeData.x8_sectorSize;
+
+  return static_cast<s32>(probeData.x0_error);
+}
+
+s32 CARDRename(const s32 chan, const char* oldName, const char* newName) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+  const auto& card = GET_CARD(chan);
+
+  return static_cast<s32>(card->renameFile(oldName, newName));
+}
+
+s32 CARDRenameAsync(const s32 chan, const char* oldName, const char* newName, const CARDCallback callback) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  const auto res = CARDRename(chan, oldName, newName);
+  callback(chan, res);
+  return res;
+}
+
+s32 CARDSetAttributesAsync(const s32 chan, s32 fileNo [[maybe_unused]], u8 attr [[maybe_unused]],
+                           CARDCallback callback [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  // TODO:
+  CARD_STUB
+  return CARD_RESULT_READY;
+}
+
+s32 CARDSetAttributes(const s32 chan, s32 fileNo [[maybe_unused]], u8 attr [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  // TODO:
+  CARD_STUB
+  return CARD_RESULT_READY;
+}
+
+s32 CARDSetStatus(const s32 chan, s32 fileNo, const CARDStat* stat) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(chan))
+    return CARD_RESULT_NOCARD;
+  const auto& card = GET_CARD(chan);
+
+  aurora::card::CardStat kabuStat;
+  CopyDolphinStatsToKabu(kabuStat, stat);
+  auto res = card->setStatus(fileNo, kabuStat);
+  if (res != aurora::card::ECardResult::READY) {
+    Log.error("Failed to set status of file at idx: {}", fileNo);
+  } else {
+    card->commit();
+  }
+
+  return static_cast<s32>(res);
+}
+
+s32 __CARDSetStatusEx(const s32 chan, s32 fileNo [[maybe_unused]], CARDDir* dirent [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  // TODO:
+  CARD_STUB
+  return CARD_RESULT_READY;
+}
+
+s32 CARDSetStatusAsync(const s32 chan, const s32 fileNo, const CARDStat* stat, const CARDCallback callback) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  const auto res = CARDSetStatus(chan, fileNo, stat);
+  callback(chan, res);
+  return res;
+}
+
+s32 CARDUnmount(const s32 chan) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  // TODO:
+  return CARD_RESULT_NOCARD;
+}
+
+s32 CARDGetCurrentMode(const s32 chan, u32* mode [[maybe_unused]]) {
+  if (chan < 0 || chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  // TODO:
+  return CARD_RESULT_NOCARD;
+}
+
+s32 CARDCancel(CARDFileInfo* fileInfo [[maybe_unused]]) {
+  // TODO:ge
+  return CARD_RESULT_NOCARD;
+}
+
+s32 CARDClose(CARDFileInfo* fileInfo) {
+  if (fileInfo->chan < 0 || fileInfo->chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(fileInfo->chan))
+    return CARD_RESULT_NOCARD;
+  const auto& card = GET_CARD(fileInfo->chan);
+
+  auto handle = CreateKabuFileHandleFromDolphin(fileInfo);
+  const auto res = card->closeFile(handle);
+
+  if (res != aurora::card::ECardResult::READY)
+    Log.error("Failed to close file at idx: {}", fileInfo->fileNo);
+
+  return static_cast<s32>(res);
+}
+
+s32 CARDRead(const CARDFileInfo* fileInfo, void* addr, s32 length, const s32 offset) {
+  if (fileInfo->chan < 0 || fileInfo->chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(fileInfo->chan))
+    return CARD_RESULT_NOCARD;
+  const auto& card = GET_CARD(fileInfo->chan);
+
+  aurora::card::FileHandle handle = CreateKabuFileHandleFromDolphin(fileInfo);
+
+  card->seek(handle, offset, aurora::card::SeekOrigin::Begin);
+  auto res = card->fileRead(handle, addr, length);
+
+  if (res != aurora::card::ECardResult::READY)
+    Log.error("Failed to read {} bytes from card", length);
+
+  return static_cast<s32>(res);
+}
+
+s32 CARDReadAsync(const CARDFileInfo* fileInfo, void* addr, const s32 length, const s32 offset,
+                  const CARDCallback callback) {
+  const auto res = CARDRead(fileInfo, addr, length, offset);
+  callback(fileInfo->chan, res);
+  return res;
+}
+
+s32 CARDWrite(const CARDFileInfo* fileInfo, const void* addr, const s32 length, const s32 offset) {
+  if (fileInfo->chan < 0 || fileInfo->chan >= 2) {
+    return CARD_RESULT_FATAL_ERROR;
+  }
+  if (!CARD_READY(fileInfo->chan))
+    return CARD_RESULT_NOCARD;
+  const auto& card = GET_CARD(fileInfo->chan);
+
+  aurora::card::FileHandle handle = CreateKabuFileHandleFromDolphin(fileInfo);
+
+  card->seek(handle, offset, aurora::card::SeekOrigin::Begin);
+  auto res = card->fileWrite(handle, addr, length);
+
+  if (res != aurora::card::ECardResult::READY) {
+    Log.error("Failed to write {} bytes to card", length);
+  } else {
+    card->commit();
+  }
+
+  return static_cast<s32>(res);
+}
+
+s32 CARDWriteAsync(const CARDFileInfo* fileInfo, const void* addr, const s32 length, const s32 offset,
+                   const CARDCallback callback) {
+  const auto res = CARDWrite(fileInfo, addr, length, offset);
+  callback(fileInfo->chan, res);
+  return res;
+}
+}
diff --git a/aurora-main/lib/dolphin/dvd/dvd.cpp b/aurora-main/lib/dolphin/dvd/dvd.cpp
new file mode 100644
index 0000000..9a054b5
--- /dev/null
+++ b/aurora-main/lib/dolphin/dvd/dvd.cpp
@@ -0,0 +1,1100 @@
+#include <aurora/dvd.h>
+#include <dolphin/dvd.h>
+#include <dolphin/os.h>
+#include <nod.h>
+#include <SDL3/SDL_iostream.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <limits>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "../../internal.hpp"
+
+namespace {
+
+struct FSTEntry {
+  std::string name;
+  bool isDir = false;
+  u32 parent = 0;
+  u32 nextOrLength = 0;
+};
+
+struct IterateContext {
+  std::vector<FSTEntry>* entries = nullptr;
+  std::vector<std::pair<u32, u32>> dirStack;
+};
+
+NodHandle* s_disc = nullptr;
+NodHandle* s_partition = nullptr;
+std::vector<FSTEntry> s_fstEntries;
+s32 s_currentDir = 0;
+std::string s_currentPath = "/";
+BOOL s_autoInvalidation = FALSE;
+BOOL s_autoFatalMessaging = FALSE;
+DVDDiskID s_diskID = {};
+DVDLowCallback s_resetCoverCallback = nullptr;
+bool s_initialized = false;
+
+void clearState() {
+  if (s_partition != nullptr) {
+    nod_free(s_partition);
+    s_partition = nullptr;
+  }
+  if (s_disc != nullptr) {
+    nod_free(s_disc);
+    s_disc = nullptr;
+  }
+  s_fstEntries.clear();
+  s_currentDir = 0;
+  s_currentPath = "/";
+  s_diskID = {};
+  s_initialized = false;
+}
+
+bool isValidEntryIndex(s32 entry) { return entry >= 0 && static_cast<size_t>(entry) < s_fstEntries.size(); }
+
+bool isAligned(const void* addr, uintptr_t align) {
+  return (reinterpret_cast<uintptr_t>(addr) & (align - 1)) == 0;
+}
+
+int64_t sdlStreamReadAt(void* userData, uint64_t offset, void* out, size_t len) {
+  auto* io = static_cast<SDL_IOStream*>(userData);
+  if (io == nullptr || out == nullptr ||
+      offset > static_cast<uint64_t>(std::numeric_limits<Sint64>::max())) {
+    return -1;
+  }
+
+  if (SDL_SeekIO(io, static_cast<Sint64>(offset), SDL_IO_SEEK_SET) < 0) {
+    return -1;
+  }
+
+  size_t total = 0;
+  auto* dst = static_cast<uint8_t*>(out);
+  while (total < len) {
+    const size_t read = SDL_ReadIO(io, dst + total, len - total);
+    if (read == 0) {
+      break;
+    }
+    total += read;
+  }
+  return static_cast<int64_t>(total);
+}
+
+int64_t sdlStreamLen(void* userData) {
+  auto* io = static_cast<SDL_IOStream*>(userData);
+  if (io == nullptr) {
+    return -1;
+  }
+
+  const Sint64 size = SDL_GetIOSize(io);
+  return size < 0 ? -1 : static_cast<int64_t>(size);
+}
+
+void sdlStreamClose(void* userData) {
+  auto* io = static_cast<SDL_IOStream*>(userData);
+  if (io == nullptr) {
+    return;
+  }
+  SDL_CloseIO(io);
+}
+
+u32 fstCallback(u32 index, NodNodeKind kind, const char* name, u32 size, void* userData) {
+  auto* ctx = static_cast<IterateContext*>(userData);
+
+  while (!ctx->dirStack.empty() && index >= ctx->dirStack.back().second) {
+    ctx->dirStack.pop_back();
+  }
+
+  if (ctx->entries->size() <= index) {
+    ctx->entries->resize(index + 1);
+  }
+
+  FSTEntry& entry = (*ctx->entries)[index];
+  entry.name = (name != nullptr) ? name : "";
+  entry.isDir = (kind == NOD_NODE_KIND_DIRECTORY);
+  entry.parent = ctx->dirStack.empty() ? 0 : ctx->dirStack.back().first;
+  entry.nextOrLength = size;
+
+  if (entry.isDir) {
+    ctx->dirStack.emplace_back(index, size);
+  }
+
+  return index + 1;
+}
+
+bool rebuildFST() {
+  if (s_partition == nullptr) {
+    return false;
+  }
+
+  s_fstEntries.clear();
+  IterateContext ctx{};
+  ctx.entries = &s_fstEntries;
+  nod_partition_iterate_fst(s_partition, fstCallback, &ctx);
+
+  if (s_fstEntries.empty()) {
+    FSTEntry root;
+    root.name = "";
+    root.isDir = true;
+    root.parent = 0;
+    root.nextOrLength = 1;
+    s_fstEntries.push_back(std::move(root));
+  }
+
+  s_fstEntries[0].name.clear();
+  s_fstEntries[0].isDir = true;
+  s_fstEntries[0].parent = 0;
+  if (s_fstEntries[0].nextOrLength < 1 || s_fstEntries[0].nextOrLength > s_fstEntries.size()) {
+    s_fstEntries[0].nextOrLength = static_cast<u32>(s_fstEntries.size());
+  }
+  return true;
+}
+
+bool nameEqualsIgnoreCase(const std::string& lhs, const char* rhs, size_t rhsLen) {
+  if (lhs.size() != rhsLen) {
+    return false;
+  }
+  for (size_t i = 0; i < rhsLen; ++i) {
+    char lc = lhs[i];
+    char rc = rhs[i];
+    if (lc >= 'a' && lc <= 'z') {
+      lc = static_cast<char>(lc - 'a' + 'A');
+    }
+    if (rc >= 'a' && rc <= 'z') {
+      rc = static_cast<char>(rc - 'a' + 'A');
+    }
+    if (lc != rc) {
+      return false;
+    }
+  }
+  return true;
+}
+
+s32 findInDir(s32 dirEntry, const char* name, size_t nameLen) {
+  if (!isValidEntryIndex(dirEntry) || !s_fstEntries[dirEntry].isDir) {
+    return -1;
+  }
+
+  u32 childEnd = s_fstEntries[dirEntry].nextOrLength;
+  u32 i = static_cast<u32>(dirEntry) + 1;
+  while (i < childEnd && i < s_fstEntries.size()) {
+    if (nameEqualsIgnoreCase(s_fstEntries[i].name, name, nameLen)) {
+      return static_cast<s32>(i);
+    }
+
+    if (s_fstEntries[i].isDir) {
+      u32 next = s_fstEntries[i].nextOrLength;
+      i = (next > i) ? next : i + 1;
+    } else {
+      ++i;
+    }
+  }
+  return -1;
+}
+
+std::string buildDirPath(s32 entryNum) {
+  if (entryNum <= 0 || !isValidEntryIndex(entryNum)) {
+    return "/";
+  }
+
+  std::vector<std::string> parts;
+  s32 cur = entryNum;
+  while (cur > 0 && isValidEntryIndex(cur)) {
+    parts.push_back(s_fstEntries[cur].name);
+    s32 parent = static_cast<s32>(s_fstEntries[cur].parent);
+    if (parent == cur) {
+      break;
+    }
+    cur = parent;
+  }
+
+  std::string out = "/";
+  for (auto it = parts.rbegin(); it != parts.rend(); ++it) {
+    out += *it;
+    out += '/';
+  }
+  return out;
+}
+
+s32 readFromHandle(NodHandle* handle, void* out, s32 length, s32 offset, u32* transferredOut) {
+  if (transferredOut != nullptr) {
+    *transferredOut = 0;
+  }
+  if (handle == nullptr || out == nullptr || length < 0 || offset < 0) {
+    return DVD_RESULT_FATAL_ERROR;
+  }
+  if (length == 0) {
+    return 0;
+  }
+  if (nod_seek(handle, offset, 0) < 0) {
+    return DVD_RESULT_FATAL_ERROR;
+  }
+
+  u8* writePtr = static_cast<u8*>(out);
+  s32 totalRead = 0;
+  s32 remaining = length;
+  while (remaining > 0) {
+    const int64_t read = nod_read(handle, writePtr + totalRead, static_cast<size_t>(remaining));
+    if (read < 0) {
+      return DVD_RESULT_FATAL_ERROR;
+    }
+    if (read == 0) {
+      break;
+    }
+    totalRead += static_cast<s32>(read);
+    remaining -= static_cast<s32>(read);
+  }
+
+  if (transferredOut != nullptr) {
+    *transferredOut = static_cast<u32>(totalRead);
+  }
+  return totalRead;
+}
+
+void setCommandResult(DVDCommandBlock* block, s32 state, u32 transferred) {
+  if (block == nullptr) {
+    return;
+  }
+  block->state = state;
+  block->transferredSize = transferred;
+}
+
+s32 stateForResult(s32 result) {
+  if (result == DVD_RESULT_CANCELED) {
+    return DVD_STATE_CANCELED;
+  }
+  if (result == DVD_RESULT_IGNORED) {
+    return DVD_STATE_IGNORED;
+  }
+  return result >= 0 ? DVD_STATE_END : DVD_STATE_FATAL_ERROR;
+}
+
+bool isCommandBlockIdle(const DVDCommandBlock* block) {
+  return block != nullptr && block->state != DVD_STATE_BUSY && block->state != DVD_STATE_WAITING;
+}
+
+NodHandle* getCommandHandle(DVDCommandBlock* block) {
+  if (block != nullptr && block->userData != nullptr) {
+    return static_cast<NodHandle*>(block->userData);
+  }
+  return s_disc;
+}
+
+void beginCommand(DVDCommandBlock* block, u32 command, void* addr, u32 length, u32 offset, DVDCBCallback callback) {
+  if (block == nullptr) {
+    return;
+  }
+  block->command = command;
+  block->addr = addr;
+  block->length = length;
+  block->offset = offset;
+  block->transferredSize = 0;
+  block->callback = callback;
+  block->state = DVD_STATE_BUSY;
+}
+
+void finishCommand(DVDCommandBlock* block, s32 result, u32 transferred) {
+  setCommandResult(block, stateForResult(result), transferred);
+}
+
+int completeImmediateCommand(DVDCommandBlock* block, u32 command, s32 result, u32 transferred, DVDCBCallback callback) {
+  beginCommand(block, command, nullptr, 0, 0, callback);
+  finishCommand(block, result, transferred);
+  if (callback != nullptr) {
+    callback(result, block);
+  }
+  return TRUE;
+}
+
+void cbForReadAsync(s32 result, DVDCommandBlock* block) {
+  auto* fileInfo = reinterpret_cast<DVDFileInfo*>(reinterpret_cast<char*>(block) - offsetof(DVDFileInfo, cb));
+  ASSERTLINE(0x2ED, &fileInfo->cb == block);
+  if (fileInfo->callback != nullptr) {
+    fileInfo->callback(result, fileInfo);
+  }
+}
+
+void cbForSeekAsync(s32 result, DVDCommandBlock* block) {
+  auto* fileInfo = reinterpret_cast<DVDFileInfo*>(reinterpret_cast<char*>(block) - offsetof(DVDFileInfo, cb));
+  ASSERTLINE(0x383, &fileInfo->cb == block);
+  if (fileInfo->callback != nullptr) {
+    fileInfo->callback(result, fileInfo);
+  }
+}
+
+void cbForPrepareStreamAsync(s32 result, DVDCommandBlock* block) {
+  auto* fileInfo = reinterpret_cast<DVDFileInfo*>(reinterpret_cast<char*>(block) - offsetof(DVDFileInfo, cb));
+  ASSERTLINE(0x497, &fileInfo->cb == block);
+  if (fileInfo->callback != nullptr) {
+    fileInfo->callback(result, fileInfo);
+  }
+}
+
+} // namespace
+
+extern "C" {
+
+bool aurora_dvd_open(const char* disc_path) {
+  if (disc_path == nullptr) {
+    return false;
+  }
+
+  clearState();
+
+  SDL_IOStream* io = SDL_IOFromFile(disc_path, "rb");
+  if (io == nullptr) {
+    return false;
+  }
+
+  const NodDiscStream stream{
+      .user_data = io,
+      .read_at = sdlStreamReadAt,
+      .stream_len = sdlStreamLen,
+      .close = sdlStreamClose,
+  };
+  const NodDiscOptions options{
+      .preloader_threads = 1,
+  };
+
+  NodResult result = nod_disc_open_stream(&stream, &options, &s_disc);
+  if (result != NOD_RESULT_OK || s_disc == nullptr) {
+    clearState();
+    return false;
+  }
+
+  result = nod_disc_open_partition_kind(s_disc, NOD_PARTITION_KIND_DATA, nullptr, &s_partition);
+  if (result != NOD_RESULT_OK || s_partition == nullptr) {
+    clearState();
+    return false;
+  }
+
+  NodDiscHeader header{};
+  if (nod_disc_header(s_disc, &header) == NOD_RESULT_OK) {
+    std::memcpy(s_diskID.gameName, header.game_id, sizeof(s_diskID.gameName));
+    std::memcpy(s_diskID.company, header.game_id + sizeof(s_diskID.gameName), sizeof(s_diskID.company));
+    s_diskID.diskNumber = header.disc_num;
+    s_diskID.gameVersion = header.disc_version;
+    s_diskID.streaming = header.audio_streaming;
+    s_diskID.streamingBufSize = header.audio_stream_buf_size;
+
+    std::memcpy(aurora::g_gameName, s_diskID.gameName, sizeof(s_diskID.gameName));
+  }
+
+  if (!rebuildFST()) {
+    clearState();
+    return false;
+  }
+
+  s_currentDir = 0;
+  s_currentPath = "/";
+  s_initialized = true;
+  return true;
+}
+
+void aurora_dvd_close(void) { clearState(); }
+
+void DVDInit(void) {}
+
+const u8* DVDGetDOLLocation(s32* out_size) {
+  if (s_partition == nullptr) {
+    *out_size = 0;
+    return nullptr;
+  }
+
+  NodPartitionMeta meta{};
+
+  if (nod_partition_meta(s_partition, &meta) != NOD_RESULT_OK) {
+    *out_size = 0;
+    return nullptr;
+  }
+
+  *out_size = meta.raw_dol.size;
+  return meta.raw_dol.data;
+}
+
+int DVDReadAbsAsyncPrio(DVDCommandBlock* block, void* addr, s32 length, s32 offset, DVDCBCallback callback, s32 prio) {
+  (void)prio;
+  ASSERTMSGLINE(0x780, block, "DVDReadAbsAsync(): null pointer is specified to command block address.");
+  ASSERTMSGLINE(0x781, addr, "DVDReadAbsAsync(): null pointer is specified to addr.");
+  ASSERTMSGLINE(0x783, isAligned(addr, 32), "DVDReadAbsAsync(): address must be aligned with 32 byte boundary.");
+  ASSERTMSGLINE(0x785, !(length & (32 - 1)), "DVDReadAbsAsync(): length must be a multiple of 32.");
+  ASSERTMSGLINE(0x787, !(offset & (4 - 1)), "DVDReadAbsAsync(): offset must be a multiple of 4.");
+  ASSERTMSGLINE(0x789, length >= 0, "DVD read: negative value was specified to length of the read\n");
+
+  beginCommand(block, DVD_COMMAND_READ, addr, static_cast<u32>(length), static_cast<u32>(offset), callback);
+  u32 transferred = 0;
+  s32 result = readFromHandle(getCommandHandle(block), addr, length, offset, &transferred);
+  finishCommand(block, result, transferred);
+  if (callback != nullptr) {
+    callback(result, block);
+  }
+  const bool idle = isCommandBlockIdle(block);
+  ASSERTMSGLINE(0x793, idle, "DVDReadAbsAsync(): command block is used for processing previous request.");
+  return TRUE;
+}
+
+int DVDSeekAbsAsyncPrio(DVDCommandBlock* block, s32 offset, DVDCBCallback callback, s32 prio) {
+  (void)prio;
+  ASSERTMSGLINE(0x7AA, block, "DVDSeekAbs(): null pointer is specified to command block address.");
+  ASSERTMSGLINE(0x7AC, !(offset & (4 - 1)), "DVDSeekAbs(): offset must be a multiple of 4.");
+
+  beginCommand(block, DVD_COMMAND_SEEK, nullptr, 0, static_cast<u32>(offset), callback);
+  NodHandle* handle = getCommandHandle(block);
+  const int64_t seek = handle != nullptr ? nod_seek(handle, static_cast<int64_t>(offset), 0) : -1;
+  const s32 result = (seek < 0) ? DVD_RESULT_FATAL_ERROR : DVD_RESULT_GOOD;
+  finishCommand(block, result, 0);
+  if (callback != nullptr) {
+    callback(result, block);
+  }
+  const bool idle = isCommandBlockIdle(block);
+  ASSERTMSGLINE(0x7B3, idle, "DVDSeekAbs(): command block is used for processing previous request.");
+  return TRUE;
+}
+
+int DVDReadAbsAsyncForBS(DVDCommandBlock* block, void* addr, s32 length, s32 offset, DVDCBCallback callback) {
+  const int result = DVDReadAbsAsyncPrio(block, addr, length, offset, callback, 2);
+  if (result != FALSE && block != nullptr) {
+    block->command = DVD_COMMAND_BSREAD;
+  }
+  return result;
+}
+
+int DVDReadDiskID(DVDCommandBlock* block, DVDDiskID* diskID, DVDCBCallback callback) {
+  if (diskID != nullptr) {
+    *diskID = s_diskID;
+  }
+  if (block != nullptr) {
+    setCommandResult(block, DVD_STATE_END, 0);
+  }
+  if (callback != nullptr) {
+    callback(DVD_RESULT_GOOD, block);
+  }
+  return TRUE;
+}
+
+int DVDPrepareStreamAbsAsync(DVDCommandBlock* block, u32 length, u32 offset, DVDCBCallback callback) {
+  const bool idle = isCommandBlockIdle(block);
+  if (block == nullptr || !idle) {
+    return FALSE;
+  }
+  beginCommand(block, DVD_COMMAND_INITSTREAM, nullptr, length, offset, callback);
+  finishCommand(block, DVD_RESULT_IGNORED, 0);
+  if (callback != nullptr) {
+    callback(DVD_RESULT_IGNORED, block);
+  }
+  return TRUE;
+}
+
+int DVDCancelStreamAsync(DVDCommandBlock* block, DVDCBCallback callback) {
+  if (block != nullptr) {
+    block->state = DVD_STATE_CANCELED;
+  }
+  if (callback != nullptr) {
+    callback(DVD_RESULT_CANCELED, block);
+  }
+  return TRUE;
+}
+
+s32 DVDCancelStream(DVDCommandBlock* block) {
+  if (block != nullptr) {
+    block->state = DVD_STATE_CANCELED;
+  }
+  return DVD_RESULT_GOOD;
+}
+
+int DVDStopStreamAtEndAsync(DVDCommandBlock* block, DVDCBCallback callback) {
+  if (block != nullptr) {
+    setCommandResult(block, DVD_STATE_END, 0);
+  }
+  if (callback != nullptr) {
+    callback(DVD_RESULT_GOOD, block);
+  }
+  return TRUE;
+}
+
+s32 DVDStopStreamAtEnd(DVDCommandBlock* block) {
+  if (block != nullptr) {
+    setCommandResult(block, DVD_STATE_END, 0);
+  }
+  return DVD_RESULT_GOOD;
+}
+
+int DVDGetStreamErrorStatusAsync(DVDCommandBlock* block, DVDCBCallback callback) {
+  if (block == nullptr || !isCommandBlockIdle(block)) {
+    return FALSE;
+  }
+  return completeImmediateCommand(block, DVD_COMMAND_REQUEST_AUDIO_ERROR, DVD_RESULT_IGNORED, 0, callback);
+}
+
+s32 DVDGetStreamErrorStatus(DVDCommandBlock* block) {
+  (void)block;
+  return DVD_RESULT_IGNORED;
+}
+
+int DVDGetStreamPlayAddrAsync(DVDCommandBlock* block, DVDCBCallback callback) {
+  if (block == nullptr || !isCommandBlockIdle(block)) {
+    return FALSE;
+  }
+  return completeImmediateCommand(block, DVD_COMMAND_REQUEST_PLAY_ADDR, DVD_RESULT_IGNORED, 0, callback);
+}
+
+s32 DVDGetStreamPlayAddr(DVDCommandBlock* block) {
+  (void)block;
+  return 0;
+}
+
+int DVDGetStreamStartAddrAsync(DVDCommandBlock* block, DVDCBCallback callback) {
+  if (block == nullptr || !isCommandBlockIdle(block)) {
+    return FALSE;
+  }
+  return completeImmediateCommand(block, DVD_COMMAND_REQUEST_START_ADDR, DVD_RESULT_IGNORED, 0, callback);
+}
+
+s32 DVDGetStreamStartAddr(DVDCommandBlock* block) {
+  (void)block;
+  return 0;
+}
+
+int DVDGetStreamLengthAsync(DVDCommandBlock* block, DVDCBCallback callback) {
+  if (block == nullptr || !isCommandBlockIdle(block)) {
+    return FALSE;
+  }
+  return completeImmediateCommand(block, DVD_COMMAND_REQUEST_LENGTH, DVD_RESULT_IGNORED, 0, callback);
+}
+
+s32 DVDGetStreamLength(DVDCommandBlock* block) {
+  (void)block;
+  return 0;
+}
+
+int DVDChangeDiskAsyncForBS(DVDCommandBlock* block, DVDCBCallback callback) {
+  ASSERTMSGLINE(0xA1F, block, "DVDChangeDiskAsyncForBS(): null pointer is specified to command block address.");
+  const bool idle = isCommandBlockIdle(block);
+  ASSERTMSGLINE(0xA25, idle, "DVDChangeDiskAsyncForBS(): command block is used for processing previous request.");
+  if (block == nullptr || !idle) {
+    return FALSE;
+  }
+  return completeImmediateCommand(block, DVD_COMMAND_BS_CHANGE_DISK, DVD_RESULT_IGNORED, 0, callback);
+}
+
+int DVDChangeDiskAsync(DVDCommandBlock* block, DVDDiskID* id, DVDCBCallback callback) {
+  (void)id;
+  return DVDChangeDiskAsyncForBS(block, callback);
+}
+
+s32 DVDChangeDisk(DVDCommandBlock* block, DVDDiskID* id) {
+  (void)block;
+  (void)id;
+  return DVD_RESULT_IGNORED;
+}
+
+int DVDStopMotorAsync(DVDCommandBlock* block, DVDCBCallback callback) {
+  if (block != nullptr) {
+    setCommandResult(block, DVD_STATE_END, 0);
+  }
+  if (callback != nullptr) {
+    callback(DVD_RESULT_GOOD, block);
+  }
+  return TRUE;
+}
+
+s32 DVDStopMotor(DVDCommandBlock* block) {
+  (void)block;
+  return DVD_RESULT_GOOD;
+}
+
+int DVDInquiryAsync(DVDCommandBlock* block, DVDDriveInfo* info, DVDCBCallback callback) {
+  if (info != nullptr) {
+    std::memset(info, 0, sizeof(*info));
+  }
+  if (block != nullptr) {
+    setCommandResult(block, DVD_STATE_END, 0);
+  }
+  if (callback != nullptr) {
+    callback(DVD_RESULT_GOOD, block);
+  }
+  return TRUE;
+}
+
+s32 DVDInquiry(DVDCommandBlock* block, DVDDriveInfo* info) {
+  DVDInquiryAsync(block, info, nullptr);
+  return DVD_RESULT_GOOD;
+}
+
+void DVDReset(void) {}
+
+int DVDResetRequired(void) { return FALSE; }
+
+s32 DVDGetCommandBlockStatus(const DVDCommandBlock* block) {
+  if (block == nullptr) {
+    return DVD_STATE_END;
+  }
+  return block->state;
+}
+
+s32 DVDGetDriveStatus(void) { return s_initialized ? DVD_STATE_END : DVD_STATE_NO_DISK; }
+
+BOOL DVDSetAutoInvalidation(BOOL autoInval) {
+  BOOL prev = s_autoInvalidation;
+  s_autoInvalidation = autoInval;
+  return prev;
+}
+
+void DVDPause(void) {}
+
+void DVDResume(void) {}
+
+int DVDCancelAsync(DVDCommandBlock* block, DVDCBCallback callback) {
+  if (block != nullptr) {
+    block->state = DVD_STATE_CANCELED;
+  }
+  if (callback != nullptr) {
+    callback(DVD_RESULT_GOOD, block);
+  }
+  return TRUE;
+}
+
+s32 DVDCancel(volatile DVDCommandBlock* block) {
+  if (block != nullptr) {
+    block->state = DVD_STATE_CANCELED;
+  }
+  return DVD_RESULT_GOOD;
+}
+
+int DVDCancelAllAsync(DVDCBCallback callback) {
+  if (callback != nullptr) {
+    callback(DVD_RESULT_CANCELED, nullptr);
+  }
+  return TRUE;
+}
+
+s32 DVDCancelAll(void) { return DVD_RESULT_GOOD; }
+
+DVDDiskID* DVDGetCurrentDiskID(void) { return &s_diskID; }
+
+BOOL DVDCheckDisk(void) { return s_initialized ? TRUE : FALSE; }
+
+int DVDSetAutoFatalMessaging(BOOL enable) {
+  const BOOL prev = s_autoFatalMessaging;
+  s_autoFatalMessaging = enable;
+  return prev;
+}
+
+s32 DVDConvertPathToEntrynum(const char* pathPtr) {
+  if (!s_initialized || pathPtr == nullptr || s_fstEntries.empty()) {
+    return -1;
+  }
+
+  s32 current = 0;
+  const char* p = pathPtr;
+  if (*p == '/') {
+    ++p;
+  } else {
+    current = s_currentDir;
+  }
+
+  while (*p != '\0') {
+    while (*p == '/') {
+      ++p;
+    }
+    if (*p == '\0') {
+      break;
+    }
+
+    if (!isValidEntryIndex(current) || !s_fstEntries[current].isDir) {
+      return -1;
+    }
+
+    const char* compEnd = p;
+    while (*compEnd != '\0' && *compEnd != '/') {
+      ++compEnd;
+    }
+    size_t compLen = static_cast<size_t>(compEnd - p);
+
+    if (compLen == 1 && p[0] == '.') {
+      // no-op
+    } else if (compLen == 2 && p[0] == '.' && p[1] == '.') {
+      current = static_cast<s32>(s_fstEntries[current].parent);
+    } else {
+      const s32 found = findInDir(current, p, compLen);
+      if (found < 0) {
+        return -1;
+      }
+      current = found;
+    }
+    p = compEnd;
+  }
+
+  return current;
+}
+
+BOOL DVDFastOpen(s32 entrynum, DVDFileInfo* fileInfo) {
+  if (!s_initialized || fileInfo == nullptr || !isValidEntryIndex(entrynum) || s_partition == nullptr) {
+    return FALSE;
+  }
+  if (s_fstEntries[entrynum].isDir) {
+    return FALSE;
+  }
+
+  std::memset(fileInfo, 0, sizeof(*fileInfo));
+  fileInfo->startAddr = 0;
+  fileInfo->length = s_fstEntries[entrynum].nextOrLength;
+
+  NodHandle* handle = nullptr;
+  NodResult result = nod_partition_open_file(s_partition, static_cast<u32>(entrynum), &handle);
+  if (result != NOD_RESULT_OK || handle == nullptr) {
+    return FALSE;
+  }
+
+  fileInfo->cb.userData = handle;
+  fileInfo->cb.state = DVD_STATE_END;
+  return TRUE;
+}
+
+BOOL DVDOpen(const char* fileName, DVDFileInfo* fileInfo) {
+  s32 entrynum = DVDConvertPathToEntrynum(fileName);
+  if (entrynum < 0) {
+    return FALSE;
+  }
+  return DVDFastOpen(entrynum, fileInfo);
+}
+
+BOOL DVDClose(DVDFileInfo* fileInfo) {
+  if (fileInfo == nullptr) {
+    return FALSE;
+  }
+  if (fileInfo->cb.userData != nullptr) {
+    nod_free(static_cast<NodHandle*>(fileInfo->cb.userData));
+    fileInfo->cb.userData = nullptr;
+  }
+  fileInfo->cb.state = DVD_STATE_END;
+  return TRUE;
+}
+
+BOOL DVDGetCurrentDir(char* path, u32 maxlen) {
+  if (path == nullptr || maxlen == 0) {
+    return FALSE;
+  }
+  const size_t len = s_currentPath.size();
+  const size_t copyLen = (len >= maxlen) ? (maxlen - 1) : len;
+  std::memcpy(path, s_currentPath.c_str(), copyLen);
+  path[copyLen] = '\0';
+  return TRUE;
+}
+
+BOOL DVDChangeDir(const char* dirName) {
+  s32 entry = DVDConvertPathToEntrynum(dirName);
+  if (!isValidEntryIndex(entry) || !s_fstEntries[entry].isDir) {
+    return FALSE;
+  }
+  s_currentDir = entry;
+  s_currentPath = buildDirPath(entry);
+  return TRUE;
+}
+
+BOOL DVDReadAsyncPrio(DVDFileInfo* fileInfo, void* addr, s32 length, s32 offset, DVDCallback callback, s32 prio) {
+  ASSERTMSGLINE(0x2C7, fileInfo, "DVDReadAsync(): null pointer is specified to file info address  ");
+  ASSERTMSGLINE(0x2C8, addr, "DVDReadAsync(): null pointer is specified to addr  ");
+
+  ASSERTMSGLINE(0x2D5, (0 <= offset) && (offset <= static_cast<s32>(fileInfo->length)),
+                "DVDReadAsync(): specified area is out of the file  ");
+  ASSERTMSGLINE(0x2DB, (0 <= offset + length) && (offset + length < static_cast<s32>(fileInfo->length) + DVD_MIN_TRANSFER_SIZE),
+                "DVDReadAsync(): specified area is out of the file  ");
+
+  fileInfo->callback = callback;
+  DVDReadAbsAsyncPrio(&fileInfo->cb, addr, length, offset, cbForReadAsync, prio);
+  return TRUE;
+}
+
+s32 DVDReadPrio(DVDFileInfo* fileInfo, void* addr, s32 length, s32 offset, s32 prio) {
+  if (!DVDReadAsyncPrio(fileInfo, addr, length, offset, nullptr, prio)) {
+    return DVD_RESULT_FATAL_ERROR;
+  }
+  if (fileInfo->cb.state == DVD_STATE_END) {
+    return static_cast<s32>(fileInfo->cb.transferredSize);
+  }
+  if (fileInfo->cb.state == DVD_STATE_CANCELED) {
+    return DVD_RESULT_CANCELED;
+  }
+  return DVD_RESULT_FATAL_ERROR;
+}
+
+int DVDSeekAsyncPrio(DVDFileInfo* fileInfo, s32 offset, void (*callback)(s32, DVDFileInfo*), s32 prio) {
+  ASSERTMSGLINE(0x368, fileInfo, "DVDSeek(): null pointer is specified to file info address  ");
+  ASSERTMSGLINE(0x36C, !(offset & 3), "DVDSeek(): offset must be multiple of 4 byte  ");
+
+  ASSERTMSGLINE(0x371, (0 <= offset) && (offset <= static_cast<s32>(fileInfo->length)),
+                "DVDSeek(): offset is out of the file  ");
+
+  fileInfo->callback = callback;
+  DVDSeekAbsAsyncPrio(&fileInfo->cb, offset, cbForSeekAsync, prio);
+  return 1;
+}
+
+s32 DVDSeekPrio(DVDFileInfo* fileInfo, s32 offset, s32 prio) {
+  if (!DVDSeekAsyncPrio(fileInfo, offset, nullptr, prio)) {
+    return DVD_RESULT_FATAL_ERROR;
+  }
+  if (fileInfo->cb.state == DVD_STATE_END) {
+    return DVD_RESULT_GOOD;
+  }
+  if (fileInfo->cb.state == DVD_STATE_CANCELED) {
+    return DVD_RESULT_CANCELED;
+  }
+  return DVD_RESULT_FATAL_ERROR;
+}
+
+s32 DVDGetFileInfoStatus(const DVDFileInfo* fileInfo) {
+  if (fileInfo == nullptr) {
+    return DVD_STATE_END;
+  }
+  return fileInfo->cb.state;
+}
+
+BOOL DVDFastOpenDir(s32 entrynum, DVDDir* dir) {
+  if (!isValidEntryIndex(entrynum) || dir == nullptr || !s_fstEntries[entrynum].isDir) {
+    return FALSE;
+  }
+  dir->entryNum = static_cast<u32>(entrynum);
+  dir->location = static_cast<u32>(entrynum) + 1;
+  dir->next = s_fstEntries[entrynum].nextOrLength;
+  return TRUE;
+}
+
+int DVDOpenDir(const char* dirName, DVDDir* dir) {
+  s32 entrynum = DVDConvertPathToEntrynum(dirName);
+  if (entrynum < 0) {
+    return FALSE;
+  }
+  return DVDFastOpenDir(entrynum, dir);
+}
+
+int DVDReadDir(DVDDir* dir, DVDDirEntry* dirent) {
+  if (dir == nullptr || dirent == nullptr) {
+    return FALSE;
+  }
+  if (dir->location >= dir->next || dir->location >= s_fstEntries.size()) {
+    return FALSE;
+  }
+
+  const u32 index = dir->location;
+  FSTEntry& entry = s_fstEntries[index];
+  dirent->entryNum = index;
+  dirent->isDir = entry.isDir ? TRUE : FALSE;
+  dirent->name = entry.name.empty() ? nullptr : entry.name.data();
+
+  if (entry.isDir) {
+    const u32 next = entry.nextOrLength;
+    dir->location = (next > index) ? next : index + 1;
+  } else {
+    dir->location = index + 1;
+  }
+  return TRUE;
+}
+
+int DVDCloseDir(DVDDir* dir) {
+  (void)dir;
+  return TRUE;
+}
+
+void DVDRewindDir(DVDDir* dir) {
+  if (dir == nullptr) {
+    return;
+  }
+  dir->location = dir->entryNum + 1;
+}
+
+void* DVDGetFSTLocation(void) {
+  if (s_fstEntries.empty()) {
+    return nullptr;
+  }
+  return s_fstEntries.data();
+}
+
+BOOL DVDPrepareStreamAsync(DVDFileInfo* fileInfo, u32 length, u32 offset, DVDCallback callback) {
+  ASSERTMSGLINE(0x46C, fileInfo, "DVDPrepareStreamAsync(): NULL file info was specified");
+  if (fileInfo == nullptr || fileInfo->cb.userData == nullptr) {
+    return FALSE;
+  }
+  if (length == 0) {
+    length = fileInfo->length - offset;
+  }
+  const uint64_t end = static_cast<uint64_t>(offset) + static_cast<uint64_t>(length);
+  if (!(offset < fileInfo->length && end <= fileInfo->length)) {
+    OSPanic(__FILE__, 0x484,
+            "DVDPrepareStreamAsync(): The area specified (offset(0x%x), length(0x%x)) is out of the file", offset,
+            length);
+    return FALSE;
+  }
+  fileInfo->callback = callback;
+  return DVDPrepareStreamAbsAsync(&fileInfo->cb, length, offset, cbForPrepareStreamAsync);
+}
+
+s32 DVDPrepareStream(DVDFileInfo* fileInfo, u32 length, u32 offset) {
+  (void)fileInfo;
+  (void)length;
+  (void)offset;
+  return DVD_RESULT_IGNORED;
+}
+
+s32 DVDGetTransferredSize(DVDFileInfo* fileinfo) {
+  if (fileinfo == nullptr) {
+    return 0;
+  }
+  return static_cast<s32>(fileinfo->cb.transferredSize);
+}
+
+int DVDCompareDiskID(const DVDDiskID* id1, const DVDDiskID* id2) {
+  if (id1 == nullptr || id2 == nullptr) {
+    return FALSE;
+  }
+
+  if (id1->gameName[0] != 0 && id2->gameName[0] != 0 && std::memcmp(id1->gameName, id2->gameName, 4) != 0) {
+    return 0;
+  }
+
+  if (id1->company[0] == 0 || id2->company[0] == 0 || std::memcmp(id1->company, id2->company, 2) != 0) {
+    return 0;
+  }
+
+  if (id1->diskNumber != 0xFF && id2->diskNumber != 0xFF && id1->diskNumber != id2->diskNumber) {
+    return 0;
+  }
+
+  if (id1->gameVersion != 0xFF && id2->gameVersion != 0xFF && id1->gameVersion != id2->gameVersion) {
+    return 0;
+  }
+
+  return 1;
+}
+
+DVDDiskID* DVDGenerateDiskID(DVDDiskID* id, const char* game, const char* company, u8 diskNum, u8 version) {
+  if (id == nullptr) {
+    return nullptr;
+  }
+  std::memset(id, 0, sizeof(*id));
+  if (game != nullptr) {
+    std::memcpy(id->gameName, game, 4);
+  }
+  if (company != nullptr) {
+    std::memcpy(id->company, company, 2);
+  }
+  id->diskNumber = diskNum;
+  id->gameVersion = version;
+  return id;
+}
+
+BOOL DVDLowRead(void* addr, u32 length, u32 offset, DVDLowCallback callback) {
+  u32 transferred = 0;
+  s32 result = readFromHandle(s_disc, addr, static_cast<s32>(length), static_cast<s32>(offset), &transferred);
+  if (callback != nullptr) {
+    callback(static_cast<u32>((result >= 0) ? DVD_RESULT_GOOD : DVD_RESULT_FATAL_ERROR));
+  }
+  return TRUE;
+}
+
+BOOL DVDLowSeek(u32 offset, DVDLowCallback callback) {
+  const int64_t seek = s_disc != nullptr ? nod_seek(s_disc, static_cast<int64_t>(offset), 0) : -1;
+  if (callback != nullptr) {
+    callback(static_cast<u32>((seek >= 0) ? DVD_RESULT_GOOD : DVD_RESULT_FATAL_ERROR));
+  }
+  return TRUE;
+}
+
+BOOL DVDLowWaitCoverClose(DVDLowCallback callback) {
+  if (callback != nullptr) {
+    callback(0);
+  }
+  return TRUE;
+}
+
+BOOL DVDLowReadDiskID(DVDDiskID* diskID, DVDLowCallback callback) {
+  if (diskID != nullptr) {
+    *diskID = s_diskID;
+  }
+  if (callback != nullptr) {
+    callback(0);
+  }
+  return TRUE;
+}
+
+BOOL DVDLowStopMotor(DVDLowCallback callback) {
+  if (callback != nullptr) {
+    callback(0);
+  }
+  return TRUE;
+}
+
+BOOL DVDLowRequestError(DVDLowCallback callback) {
+  if (callback != nullptr) {
+    callback(0);
+  }
+  return TRUE;
+}
+
+BOOL DVDLowInquiry(DVDDriveInfo* info, DVDLowCallback callback) {
+  if (info != nullptr) {
+    std::memset(info, 0, sizeof(*info));
+  }
+  if (callback != nullptr) {
+    callback(0);
+  }
+  return TRUE;
+}
+
+BOOL DVDLowAudioStream(u32 subcmd, u32 length, u32 offset, DVDLowCallback callback) {
+  (void)subcmd;
+  (void)length;
+  (void)offset;
+  if (callback != nullptr) {
+    callback(0);
+  }
+  return TRUE;
+}
+
+BOOL DVDLowRequestAudioStatus(u32 subcmd, DVDLowCallback callback) {
+  (void)subcmd;
+  if (callback != nullptr) {
+    callback(0);
+  }
+  return TRUE;
+}
+
+BOOL DVDLowAudioBufferConfig(BOOL enable, u32 size, DVDLowCallback callback) {
+  (void)enable;
+  (void)size;
+  if (callback != nullptr) {
+    callback(0);
+  }
+  return TRUE;
+}
+
+void DVDLowReset(void) {
+  if (s_resetCoverCallback != nullptr) {
+    s_resetCoverCallback(0);
+  }
+}
+
+DVDLowCallback DVDLowSetResetCoverCallback(DVDLowCallback callback) {
+  DVDLowCallback previous = s_resetCoverCallback;
+  s_resetCoverCallback = callback;
+  return previous;
+}
+
+BOOL DVDLowBreak(void) { return TRUE; }
+
+DVDLowCallback DVDLowClearCallback(void) {
+  DVDLowCallback previous = s_resetCoverCallback;
+  s_resetCoverCallback = nullptr;
+  return previous;
+}
+
+u32 DVDLowGetCoverStatus(void) { return s_initialized ? 0 : 1; }
+
+void DVDDumpWaitingQueue(void) {}
+
+} // extern "C"
diff --git a/aurora-main/lib/dolphin/gd/GDAurora.cpp b/aurora-main/lib/dolphin/gd/GDAurora.cpp
new file mode 100644
index 0000000..14bbbee
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/GDAurora.cpp
@@ -0,0 +1,32 @@
+#include <limits>
+
+#include "gd.hpp"
+#include "dolphin/gd/GDAurora.h"
+#include "dolphin/gd/GDBase.h"
+#include "dolphin/gx/GXAurora.h"
+
+static void GDWriteString(const char* label) {
+  auto length = strlen(label);
+
+  if (length > std::numeric_limits<u16>::max()) {
+    Log.warn("Debug marker size over u16 max, truncating");
+    length = std::numeric_limits<u16>::max();
+  }
+
+  GDWrite_u16(length);
+  GDWrite_data(label, length);
+}
+
+void GDPushDebugGroup(const char* label) {
+  GDWriteAuroraCmd(GX_LOAD_AURORA_DEBUG_GROUP_PUSH);
+  GDWriteString(label);
+}
+
+void GDPopDebugGroup() {
+  GDWriteAuroraCmd(GX_LOAD_AURORA_DEBUG_GROUP_POP);
+}
+
+void GDInsertDebugMarker(const char* label) {
+  GDWriteAuroraCmd(GX_LOAD_AURORA_DEBUG_MARKER_INSERT);
+  GDWriteString(label);
+}
diff --git a/aurora-main/lib/dolphin/gd/GDBase.cpp b/aurora-main/lib/dolphin/gd/GDBase.cpp
new file mode 100644
index 0000000..da0bdb5
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/GDBase.cpp
@@ -0,0 +1,46 @@
+#include <dolphin/gd.h>
+#include <dolphin/os.h>
+#include "gd.hpp"
+
+GDLObj* __GDCurrentDL = NULL;
+static GDOverflowCb overflowcb = NULL;
+
+void GDInitGDLObj(GDLObj* dl, void* start, u32 length) {
+    ASSERTMSGLINE(40, !((u32)start & 0x1F), "start must be aligned to 32 bytes");
+    ASSERTMSGLINE(41, !((u32)length & 0x1F), "length must be aligned to 32 bytes");
+    dl->start = (u8*)start;
+    dl->ptr = (u8*)start;
+    dl->top = (u8*)start + length;
+    dl->length = length;
+}
+
+void GDFlushCurrToMem(void) {
+    DCFlushRange(__GDCurrentDL->start, __GDCurrentDL->length);
+}
+
+void GDPadCurr32(void) {
+    uintptr_t n;
+
+    n = (uintptr_t)__GDCurrentDL->ptr & 0x1F;
+    if (n != 0) {
+        for (; n < 32; n = n + 1) {
+            __GDWrite(0);
+        }
+    }
+}
+
+void GDOverflowed(void) {
+    if (overflowcb) {
+        (*overflowcb)();
+    } else {
+        Log.fatal("GDWrite: display list overflowed");
+    }
+}
+
+void GDSetOverflowCallback(GDOverflowCb callback) {
+    overflowcb = callback;
+}
+
+GDOverflowCb GDGetOverflowCallback(void) {
+    return overflowcb;
+}
diff --git a/aurora-main/lib/dolphin/gd/GDGeometry.cpp b/aurora-main/lib/dolphin/gd/GDGeometry.cpp
new file mode 100644
index 0000000..194a1b5
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/GDGeometry.cpp
@@ -0,0 +1,435 @@
+#include <cassert>
+#include <dolphin/gd.h>
+#include <dolphin/os.h>
+
+#include "dolphin/gx/GXAurora.h"
+
+void GDSetVtxDescv(const GXVtxDescList* attrPtr) {
+    u32 nnorms = 0;
+    u32 ncols = 0;
+    u32 ntexs = 0;
+    u32 pnMtxIdx = GX_NONE;
+    u32 txMtxIdxMask = 0;
+    u32 posn = GX_DIRECT;
+    u32 norm = GX_NONE;
+    u32 col0 = GX_NONE;
+    u32 col1 = GX_NONE;
+    u32 tex0 = GX_NONE;
+    u32 tex1 = GX_NONE;
+    u32 tex2 = GX_NONE;
+    u32 tex3 = GX_NONE;
+    u32 tex4 = GX_NONE;
+    u32 tex5 = GX_NONE;
+    u32 tex6 = GX_NONE;
+    u32 tex7 = GX_NONE;
+
+    for (; attrPtr->attr != GX_VA_NULL; ++attrPtr) {
+        ASSERTMSGLINE(91, attrPtr->attr >= GX_VA_PNMTXIDX && attrPtr->attr <= GX_VA_MAX_ATTR, "GDSetVtxDescv: invalid attribute");
+        ASSERTMSGLINE(95, attrPtr->type >= GX_NONE && attrPtr->type <= GX_INDEX16, "GDSetVtxDescv: invalid type");
+
+        ASSERTMSGLINE(101, attrPtr->attr >= GX_VA_PNMTXIDX && attrPtr->attr <= GX_VA_TEX7MTXIDX ? (attrPtr->type == 0 || attrPtr->type == 1) : TRUE, "GDSetVtxDescv: invalid type for given attribute");
+
+        switch (attrPtr->attr) {
+        case GX_VA_PNMTXIDX:
+            pnMtxIdx = attrPtr->type;
+            break;
+        case GX_VA_TEX0MTXIDX:
+            txMtxIdxMask = (txMtxIdxMask & ~0x1) | (attrPtr->type << 0);
+            break;
+        case GX_VA_TEX1MTXIDX:
+            txMtxIdxMask = (txMtxIdxMask & ~0x2) | (attrPtr->type << 1);
+            break;
+        case GX_VA_TEX2MTXIDX:
+            txMtxIdxMask = (txMtxIdxMask & ~0x4) | (attrPtr->type << 2);
+            break;
+        case GX_VA_TEX3MTXIDX:
+            txMtxIdxMask = (txMtxIdxMask & ~0x8) | (attrPtr->type << 3);
+            break;
+        case GX_VA_TEX4MTXIDX:
+            txMtxIdxMask = (txMtxIdxMask & ~0x10) | (attrPtr->type << 4);
+            break;
+        case GX_VA_TEX5MTXIDX:
+            txMtxIdxMask = (txMtxIdxMask & ~0x20) | (attrPtr->type << 5);
+            break;
+        case GX_VA_TEX6MTXIDX:
+            txMtxIdxMask = (txMtxIdxMask & ~0x40) | (attrPtr->type << 6);
+            break;
+        case GX_VA_TEX7MTXIDX:
+            txMtxIdxMask = (txMtxIdxMask & ~0x80) | (attrPtr->type << 7);
+            break;
+        case GX_VA_POS:
+            posn = attrPtr->type;
+            break;
+        case GX_VA_NRM:
+            if (attrPtr->type != GX_NONE) {
+                norm = attrPtr->type;
+                nnorms = 1;
+            }
+            break;
+        case GX_VA_NBT:
+            if (attrPtr->type != GX_NONE) {
+                norm = attrPtr->type;
+                nnorms = 2;
+            }
+            break;
+        case GX_VA_CLR0:
+            col0 = attrPtr->type;
+            ncols += (col0 != GX_NONE);
+            break;
+        case GX_VA_CLR1:
+            col1 = attrPtr->type;
+            ncols += (col1 != GX_NONE);
+            break;
+        case GX_VA_TEX0:
+            tex0 = attrPtr->type;
+            ntexs += (tex0 != GX_NONE);
+            break;
+        case GX_VA_TEX1:
+            tex1 = attrPtr->type;
+            ntexs += (tex1 != GX_NONE);
+            break;
+        case GX_VA_TEX2:
+            tex2 = attrPtr->type;
+            ntexs += (tex2 != GX_NONE);
+            break;
+        case GX_VA_TEX3:
+            tex3 = attrPtr->type;
+            ntexs += (tex3 != GX_NONE);
+            break;
+        case GX_VA_TEX4:
+            tex4 = attrPtr->type;
+            ntexs += (tex4 != GX_NONE);
+            break;
+        case GX_VA_TEX5:
+            tex5 = attrPtr->type;
+            ntexs += (tex5 != GX_NONE);
+            break;
+        case GX_VA_TEX6:
+            tex6 = attrPtr->type;
+            ntexs += (tex6 != GX_NONE);
+            break;
+        case GX_VA_TEX7:
+            tex7 = attrPtr->type;
+            ntexs += (tex7 != GX_NONE);
+            break;
+        }
+    }
+
+    GDWriteCPCmd(CP_REG_VCD_LO_ID, CP_REG_VCD_LO(pnMtxIdx, txMtxIdxMask, posn, norm, col0, col1));
+    GDWriteCPCmd(CP_REG_VCD_HI_ID, CP_REG_VCD_HI(tex0, tex1, tex2, tex3, tex4, tex5, tex6, tex7));
+    GDWriteXFCmd(XF_REG_INVERTEXSPEC_ID, XF_REG_INVTXSPEC(ncols, nnorms, ntexs));
+}
+
+void GDSetVtxAttrFmtv(GXVtxFmt vtxfmt, const GXVtxAttrFmtList* list) {
+    u32 posCnt = GX_POS_XYZ;
+    u32 posType = GX_F32;
+    u32 posFrac = 0;
+
+    u32 nrmCnt = GX_NRM_XYZ;
+    u32 nrmType = GX_F32;
+    u32 nrmIdx3 = 0;
+
+    u32 c0Cnt = GX_CLR_RGBA;
+    u32 c0Type = GX_RGBA8;
+
+    u32 c1Cnt = GX_CLR_RGBA;
+    u32 c1Type = GX_RGBA8;
+
+    u32 tx0Cnt = GX_TEX_ST;
+    u32 tx0Type = GX_F32;
+    u32 tx0Frac = 0;
+
+    u32 tx1Cnt = GX_TEX_ST;
+    u32 tx1Type = GX_F32;
+    u32 tx1Frac = 0;
+
+    u32 tx2Cnt = GX_TEX_ST;
+    u32 tx2Type = GX_F32;
+    u32 tx2Frac = 0;
+
+    u32 tx3Cnt = GX_TEX_ST;
+    u32 tx3Type = GX_F32;
+    u32 tx3Frac = 0;
+
+    u32 tx4Cnt = GX_TEX_ST;
+    u32 tx4Type = GX_F32;
+    u32 tx4Frac = 0;
+
+    u32 tx5Cnt = GX_TEX_ST;
+    u32 tx5Type = GX_F32;
+    u32 tx5Frac = 0;
+
+    u32 tx6Cnt = GX_TEX_ST;
+    u32 tx6Type = GX_F32;
+    u32 tx6Frac = 0;
+
+    u32 tx7Cnt = GX_TEX_ST;
+    u32 tx7Type = GX_F32;
+    u32 tx7Frac = 0;
+
+    ASSERTMSGLINE(221, vtxfmt < GX_MAX_VTXFMT, "GDSetVtxAttrFmtv: invalid vtx fmt");
+
+    for (; list->attr != GX_VA_NULL; ++list) {
+        ASSERTMSGLINE(226, list->attr >= GX_VA_POS && list->attr <= GX_VA_TEX7, "GDSetVtxAttrFmtv: invalid attribute");
+        ASSERTMSGLINE(227, list->frac < 32, "GDSetVtxAttrFmtv: invalid frac value");
+
+        switch (list->attr) {
+        case GX_VA_POS:
+            posCnt = list->cnt;
+            posType = list->type;
+            posFrac = list->frac;
+            break;
+        case GX_VA_NRM:
+        case GX_VA_NBT:
+            nrmType = list->type;
+            if (list->cnt == GX_NRM_NBT3) {
+                nrmCnt = GX_NRM_NBT;
+                nrmIdx3 = 1;
+            } else {
+                nrmCnt = list->cnt;
+                nrmIdx3 = 0;
+            }
+            break;
+        case GX_VA_CLR0:
+            c0Cnt = list->cnt;
+            c0Type = list->type;
+            break;
+        case GX_VA_CLR1:
+            c1Cnt = list->cnt;
+            c1Type = list->type;
+            break;
+        case GX_VA_TEX0:
+            tx0Cnt = list->cnt;
+            tx0Type = list->type;
+            tx0Frac = list->frac;
+            break;
+        case GX_VA_TEX1:
+            tx1Cnt = list->cnt;
+            tx1Type = list->type;
+            tx1Frac = list->frac;
+            break;
+        case GX_VA_TEX2:
+            tx2Cnt = list->cnt;
+            tx2Type = list->type;
+            tx2Frac = list->frac;
+            break;
+        case GX_VA_TEX3:
+            tx3Cnt = list->cnt;
+            tx3Type = list->type;
+            tx3Frac = list->frac;
+            break;
+        case GX_VA_TEX4:
+            tx4Cnt = list->cnt;
+            tx4Type = list->type;
+            tx4Frac = list->frac;
+            break;
+        case GX_VA_TEX5:
+            tx5Cnt = list->cnt;
+            tx5Type = list->type;
+            tx5Frac = list->frac;
+            break;
+        case GX_VA_TEX6:
+            tx6Cnt = list->cnt;
+            tx6Type = list->type;
+            tx6Frac = list->frac;
+            break;
+        case GX_VA_TEX7:
+            tx7Cnt = list->cnt;
+            tx7Type = list->type;
+            tx7Frac = list->frac;
+        }
+    }
+
+    GDWriteCPCmd(vtxfmt + CP_REG_VAT_GRP0_ID, CP_REG_VAT_GRP0(posCnt, posType, posFrac, nrmCnt, nrmType, c0Cnt, c0Type, c1Cnt, c1Type, tx0Cnt, tx0Type, tx0Frac, 1, nrmIdx3));
+    GDWriteCPCmd(vtxfmt + CP_REG_VAT_GRP1_ID, CP_REG_VAT_GRP1(tx1Cnt, tx1Type, tx1Frac, tx2Cnt, tx2Type, tx2Frac, tx3Cnt, tx3Type, tx3Frac, tx4Cnt, tx4Type, 1));
+    GDWriteCPCmd(vtxfmt + CP_REG_VAT_GRP2_ID, CP_REG_VAT_GRP2(tx4Frac, tx5Cnt, tx5Type, tx5Frac, tx6Cnt, tx6Type, tx6Frac, tx7Cnt, tx7Type, tx7Frac));
+}
+
+void GDSetArraySized(GXAttr attr, void* base_ptr, u32 size, u8 stride, bool le) {
+  s32 cpAttr;
+  if (attr == GX_VA_NBT) {
+    cpAttr = 1;
+  } else {
+    cpAttr = attr - GX_VA_POS;
+  }
+
+  assert((cpAttr & ~0xF) == 0);
+
+  GDWriteAuroraCmd(cpAttr + GX_LOAD_AURORA_ARRAYBASE);
+  GDWrite_u64((u64)base_ptr);
+  GDWrite_u32(size);
+  GDWrite_u8(le ? 1 : 0);
+
+  GDWriteCPCmd(cpAttr + CP_REG_ARRAYSTRIDE_ID, stride);
+}
+
+void GDSetArray(GXAttr, void*, u8) {
+    OSPanic(__FILE__, __LINE__, "GDSetArray is not supported on Aurora");
+}
+
+void GDSetArrayRaw(GXAttr, u32, u8) {
+    OSPanic(__FILE__, __LINE__, "GDSetArrayRaw is not supported on Aurora");
+}
+
+void GDPatchArrayPtr(void* base_ptr) {
+    GDWrite_u32(OSCachedToPhysical(base_ptr));
+}
+
+void GDSetTexCoordGen(GXTexCoordID dst_coord, GXTexGenType func, GXTexGenSrc src_param, u8 normalize, u32 postmtx) {
+    u32 form;
+    u32 tgType;
+    u32 proj;
+    u32 row;
+    u32 embossRow;
+    u32 embossLit;
+    
+    form = 0;
+    proj = 0;
+    row = 5;
+    embossRow = 5;
+    embossLit = 0;
+
+    ASSERTMSGLINE(432, dst_coord < GX_MAX_TEXCOORD, "GDSetTexCoordGen: invalid texcoord ID");
+
+    switch(src_param) {
+    case GX_TG_POS:
+        row = 0;
+        form = 1;
+        break;
+    case GX_TG_NRM:
+        row = 1;
+        form = 1;
+        break;
+    case GX_TG_BINRM:
+        row = 3;
+        form = 1;
+        break;
+    case GX_TG_TANGENT:
+        row = 4;
+        form = 1;
+        break;
+    case GX_TG_COLOR0:
+        row = 2;
+        break;
+    case GX_TG_COLOR1:
+        row = 2;
+        break;
+    case GX_TG_TEX0:
+        row = 5;
+        break;
+    case GX_TG_TEX1:
+        row = 6;
+        break;
+    case GX_TG_TEX2:
+        row = 7;
+        break;
+    case GX_TG_TEX3:
+        row = 8;
+        break;
+    case GX_TG_TEX4:
+        row = 9;
+        break;
+    case GX_TG_TEX5:
+        row = 10;
+        break;
+    case GX_TG_TEX6:
+        row = 11;
+        break;
+    case GX_TG_TEX7:
+        row = 12;
+        break;
+    case GX_TG_TEXCOORD0:
+        embossRow = 0;
+        break;
+    case GX_TG_TEXCOORD1:
+        embossRow = 1;
+        break;
+    case GX_TG_TEXCOORD2:
+        embossRow = 2;
+        break;
+    case GX_TG_TEXCOORD3:
+        embossRow = 3;
+        break;
+    case GX_TG_TEXCOORD4:
+        embossRow = 4;
+        break;
+    case GX_TG_TEXCOORD5:
+        embossRow = 5;
+        break;
+    case GX_TG_TEXCOORD6:
+        embossRow = 6;
+        break;
+    default:
+        ASSERTMSGLINE(457, 0, "GDSetTexCoordGen: invalid texgen source");
+        break;
+    }
+
+    switch (func) {
+    case GX_TG_MTX2x4:
+        tgType = 0;
+        break;
+    case GX_TG_MTX3x4:
+        tgType = 0;
+        proj = 1;
+        break;
+    case GX_TG_BUMP0:
+    case GX_TG_BUMP1:
+    case GX_TG_BUMP2:
+    case GX_TG_BUMP3:
+    case GX_TG_BUMP4:
+    case GX_TG_BUMP5:
+    case GX_TG_BUMP6:
+    case GX_TG_BUMP7:
+        ASSERTMSGLINE(481, src_param >= GX_TG_TEXCOORD0 && src_param <= GX_TG_TEXCOORD6, "GDSetTexCoordGen: invalid emboss source");
+        tgType = 1;
+        embossLit = func - GX_TG_BUMP0;
+        break;
+    case GX_TG_SRTG:
+        if (src_param == GX_TG_COLOR0) {
+            tgType = 2;
+        } else {
+            tgType = 3;
+        }
+        break;
+    default:
+        ASSERTMSGLINE(495, 0, "GDSetTexCoordGen: invalid texgen function");
+        break;
+    }
+    
+    GDWriteXFCmd(dst_coord + XF_REG_TEX0_ID, XF_REG_TEX(proj, form, tgType, row, embossRow, embossLit));
+    GDWriteXFCmd(dst_coord + XF_REG_DUALTEX0_ID, XF_REG_DUALTEX(postmtx - 0x40, normalize));
+}
+
+void GDSetCullMode(GXCullMode mode) {
+    static u8 cm2hw[4] = { 0, 2, 1, 3 };
+
+    GDWriteBPCmd(0xFE00C000);
+    GDWriteBPCmd(cm2hw[mode] << 14);
+}
+
+void GDSetGenMode(u8 nTexGens, u8 nChans, u8 nTevs) {
+    GDWriteBPCmd(0xFE003C3F);
+    GDWriteBPCmd(BP_GEN_MODE(nTexGens, nChans, nTevs - 1, 0, 0));
+
+    GDWriteXFCmd(XF_REG_NUMCOLORS_ID, nChans);
+    GDWriteXFCmd(XF_REG_NUMTEX_ID, nTexGens);
+}
+
+void GDSetGenMode2(u8 nTexGens, u8 nChans, u8 nTevs, u8 nInds, GXCullMode cm) {
+    static u8 cm2hw[4] = { 0, 2, 1, 3 };
+
+    GDWriteBPCmd(0xFE07FC3F);
+    GDWriteBPCmd(BP_GEN_MODE(nTexGens, nChans, nTevs - 1, cm2hw[cm], nInds));
+
+    GDWriteXFCmd(XF_REG_NUMCOLORS_ID, nChans);
+    GDWriteXFCmd(XF_REG_NUMTEX_ID, nTexGens);
+}
+
+void GDSetLPSize(u8 lineWidth, u8 pointSize, GXTexOffset lineOffset, GXTexOffset pointOffset, u8 lineHalfAspect) {
+    GDWriteBPCmd(BP_LP_SIZE(lineWidth, pointSize, lineOffset, pointOffset, lineHalfAspect, 0x22));
+}
+
+void GDSetCoPlanar(u8 enable) {
+    GDWriteBPCmd(0xFE080000);
+    GDWriteBPCmd(enable << 19);
+}
diff --git a/aurora-main/lib/dolphin/gd/GDIndirect.cpp b/aurora-main/lib/dolphin/gd/GDIndirect.cpp
new file mode 100644
index 0000000..50add72
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/GDIndirect.cpp
@@ -0,0 +1,270 @@
+#include <dolphin/gd.h>
+#include <dolphin/os.h>
+
+void GDSetTevIndirect(GXTevStageID tev_stage, GXIndTexStageID ind_stage,
+                      GXIndTexFormat format, GXIndTexBiasSel bias_sel,
+                      GXIndTexMtxID matrix_sel, GXIndTexWrap wrap_s,
+                      GXIndTexWrap wrap_t, u8 add_prev, u8 utc_lod,
+                      GXIndTexAlphaSel alpha_sel) {
+    GDWriteBPCmd(BP_TEV_INDIRECT(
+        ind_stage & 3,
+        format & 3,
+        bias_sel & 7,
+        alpha_sel & 3,
+        matrix_sel & 0xF,
+        wrap_s & 7,
+        wrap_t & 7,
+        utc_lod & 1,
+        add_prev & 1,
+        0x10 + (tev_stage & 0xF)
+    ));
+}
+
+void GDSetIndTexMtx(GXIndTexMtxID mtx_id, const f32 offset[2][3], s8 scale_exp) {
+    u32 id_offset;
+
+    switch (mtx_id) {
+    case GX_ITM_0:
+        id_offset = 0;
+        break;
+    case GX_ITM_1:
+        id_offset = 3;
+        break;
+    case GX_ITM_2:
+        id_offset = 6;
+        break;
+    default:
+        ASSERTMSGLINE(111, 0, "GDSetIndTexMtx: Invalid matrix id");
+        break;
+    }
+
+    scale_exp += 17;
+
+    GDWriteBPCmd(BP_IND_MTX(
+        (s32)(offset[0][0] * 0x400) & 0x7FF,
+        (s32)(offset[1][0] * 0x400) & 0x7FF,
+        scale_exp & 3,
+        6 + id_offset
+    ));
+
+    GDWriteBPCmd(BP_IND_MTX(
+        (s32)(offset[0][1] * 0x400) & 0x7FF,
+        (s32)(offset[1][1] * 0x400) & 0x7FF,
+        (scale_exp >> 2) & 3,
+        7 + id_offset
+    ));
+
+    GDWriteBPCmd(BP_IND_MTX(
+        (s32)(offset[0][2] * 0x400) & 0x7FF,
+        (s32)(offset[1][2] * 0x400) & 0x7FF,
+        (scale_exp >> 4) & 3,
+        8 + id_offset
+    ));
+}
+
+void GDSetIndTexCoordScale(GXIndTexStageID indStageEven, GXIndTexScale scaleS0,
+                           GXIndTexScale scaleT0, GXIndTexScale scaleS1,
+                           GXIndTexScale scaleT1) {
+    GDWriteBPCmd(BP_IND_TEXCOORD_SCALE(
+        scaleS0 & 0xF,
+        scaleT0 & 0xF,
+        scaleS1 & 0xF,
+        scaleT1 & 0xF,
+        0x25 + ((indStageEven >> 1) & 1)
+    ));
+}
+
+void GDSetIndTexOrder(GXTexCoordID texCoord0, GXTexMapID texMap0,
+                      GXTexCoordID texCoord1, GXTexMapID texMap1,
+                      GXTexCoordID texCoord2, GXTexMapID texMap2,
+                      GXTexCoordID texCoord3, GXTexMapID texMap3) {
+    GDWriteBPCmd(BP_IND_TEX_ORDER(
+        texMap0 & 7,
+        texCoord0 & 7,
+        texMap1 & 7,
+        texCoord1 & 7,
+        texMap2 & 7,
+        texCoord2 & 7,
+        texMap3 & 7,
+        texCoord3 & 7,
+        0x27
+    ));
+}
+
+void GDSetTevDirect(GXTevStageID tev_stage) {
+    GDSetTevIndirect(tev_stage, GX_INDTEXSTAGE0, GX_ITF_8, GX_ITB_NONE, GX_ITM_OFF, GX_ITW_OFF, GX_ITW_OFF, 0, 0, GX_ITBA_OFF);
+}
+
+void GDSetTevIndWarp(GXTevStageID tev_stage, GXIndTexStageID ind_stage, u8 signed_offset, u8 replace_mode, GXIndTexMtxID matrix_sel) {
+    GXIndTexWrap wrap;
+    wrap = replace_mode ? GX_ITW_0 : GX_ITW_OFF;
+
+    GDSetTevIndirect(tev_stage,
+                     ind_stage,
+                     GX_ITF_8,
+                     signed_offset ? GX_ITB_STU : GX_ITB_NONE,
+                     matrix_sel,
+                     wrap,
+                     wrap,
+                     0,
+                     0,
+                     GX_ITBA_OFF);
+}
+
+void GDSetTevIndTile(GXTevStageID tev_stage, GXIndTexStageID ind_stage,
+                     u16 tilesize_s, u16 tilesize_t, u16 tilespacing_s,
+                     u16 tilespacing_t, GXIndTexFormat format,
+                     GXIndTexMtxID matrix_sel, GXIndTexBiasSel bias_sel,
+                     GXIndTexAlphaSel alpha_sel) {
+    GXIndTexWrap wrap_s;
+    GXIndTexWrap wrap_t;
+    f32 mtx[2][3];
+
+    switch (tilesize_s) {
+    case 256:
+        wrap_s = GX_ITW_256;
+        break;  
+    case 128:
+        wrap_s = GX_ITW_128;
+        break;  
+    case 64:
+        wrap_s = GX_ITW_64;
+        break;  
+    case 32:
+        wrap_s = GX_ITW_32;
+        break;  
+    case 16:
+        wrap_s = GX_ITW_16;
+        break;  
+    default:
+        ASSERTMSGLINE(268, 0, "GDSetTevIndTile: Invalid tilesize for S coordinate");
+        wrap_s = GX_ITW_OFF;
+        break;
+    }
+
+    switch (tilesize_t) {
+    case 256:
+        wrap_t = GX_ITW_256;
+        break;  
+    case 128:
+        wrap_t = GX_ITW_128;
+        break;  
+    case 64:
+        wrap_t = GX_ITW_64;
+        break;  
+    case 32:
+        wrap_t = GX_ITW_32;
+        break;  
+    case 16:
+        wrap_t = GX_ITW_16;
+        break;  
+    default:
+        ASSERTMSGLINE(280, 0, "GDSetTevIndTile: Invalid tilesize for T coordinate");
+        wrap_t = GX_ITW_OFF;
+        break;
+    }
+
+    mtx[0][0] = (f32)tilespacing_s / 0x400;
+    mtx[0][1] = mtx[0][2] = 0.0f;
+
+    mtx[1][1] = (f32)tilespacing_t / 0x400;
+    mtx[1][0] = mtx[1][2] = 0.0f;
+    GDSetIndTexMtx(matrix_sel, mtx, 10); 
+    
+    GDSetTevIndirect(tev_stage,
+                     ind_stage,
+                     format,
+                     bias_sel,
+                     matrix_sel,
+                     wrap_s,
+                     wrap_t,
+                     0,
+                     1,
+                     alpha_sel);
+}
+
+void GDSetTevIndBumpST(GXTevStageID tev_stage, GXIndTexStageID ind_stage, GXIndTexMtxID matrix_sel) {
+    GXIndTexMtxID sm;
+    GXIndTexMtxID tm;
+
+    switch(matrix_sel) {
+    case GX_ITM_0:
+        sm = GX_ITM_S0;
+        tm = GX_ITM_T0;
+        break;
+    case GX_ITM_1:
+        sm = GX_ITM_S1;
+        tm = GX_ITM_T1;
+        break;
+    case GX_ITM_2:
+        sm = GX_ITM_S2;
+        tm = GX_ITM_T2;
+        break;
+    default:
+        ASSERTMSGLINE(332, 0, "GDSetTevIndBumpST: Invalid matrix selection");
+        break;
+    }
+
+    GDSetTevIndirect(tev_stage,
+                     ind_stage,
+                     GX_ITF_8,
+                     GX_ITB_ST,
+                     sm,
+                     GX_ITW_0,
+                     GX_ITW_0,
+                     0,
+                     0,
+                     GX_ITBA_OFF);
+
+    GDSetTevIndirect((GXTevStageID)(tev_stage + 1),
+                     ind_stage,
+                     GX_ITF_8,
+                     GX_ITB_ST,
+                     tm,
+                     GX_ITW_0,
+                     GX_ITW_0,
+                     1,
+                     0,
+                     GX_ITBA_OFF);
+
+    GDSetTevIndirect((GXTevStageID)(tev_stage + 2),
+                     ind_stage,
+                     GX_ITF_8,
+                     GX_ITB_NONE,
+                     GX_ITM_OFF,
+                     GX_ITW_OFF,
+                     GX_ITW_OFF,
+                     1,
+                     0,
+                     GX_ITBA_OFF);
+}
+
+void GDSetTevIndBumpXYZ(GXTevStageID tev_stage, GXIndTexStageID ind_stage, GXIndTexMtxID matrix_sel) {
+    GDSetTevIndirect(tev_stage,
+                     ind_stage,
+                     GX_ITF_8,
+                     GX_ITB_STU,
+                     matrix_sel,
+                     GX_ITW_OFF,
+                     GX_ITW_OFF,
+                     0,
+                     0,
+                     GX_ITBA_OFF);
+}
+
+void GDSetTevIndRepeat(GXTevStageID tev_stage) {
+    GDSetTevIndirect(tev_stage,
+                     GX_INDTEXSTAGE0,
+                     GX_ITF_8,
+                     GX_ITB_NONE,
+                     GX_ITM_OFF,
+                     GX_ITW_0,
+                     GX_ITW_0,
+                     1,
+                     0,
+                     GX_ITBA_OFF);
+}
+
+void __GDSetIndTexMask(u32 mask) {
+    GDWriteBPCmd(BP_IND_MASK(mask & 0xFF, 0xF));
+}
diff --git a/aurora-main/lib/dolphin/gd/GDLight.cpp b/aurora-main/lib/dolphin/gd/GDLight.cpp
new file mode 100644
index 0000000..c036032
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/GDLight.cpp
@@ -0,0 +1,216 @@
+#include <dolphin/gd.h>
+#include <bit>
+#include <numbers>
+#include <cmath>
+
+void GDSetLightAttn(GXLightID light, f32 a0, f32 a1, f32 a2, f32 k0, f32 k1, f32 k2) {
+    GDWriteXFCmdHdr(__GDLightID2Offset(light) + XF_LIGHT_ATTN_ID, 6);
+    GDWrite_f32(a0);
+    GDWrite_f32(a1);
+    GDWrite_f32(a2);
+    GDWrite_f32(k0);
+    GDWrite_f32(k1);
+    GDWrite_f32(k2);
+}
+
+void GDSetLightSpot(GXLightID light, f32 cutoff, GXSpotFn spot_func) {
+    f32 a0;
+    f32 a1;
+    f32 a2;
+    f32 r;
+    f32 d;
+    f32 cr;
+
+    if (cutoff <= 0.0f || cutoff > 90.0f) {
+        spot_func = GX_SP_OFF;
+    }
+
+    r = std::numbers::pi_v<f32> * cutoff / 180.0f;
+    cr = cosf(r);
+
+    switch(spot_func) {
+    case GX_SP_FLAT:
+        a0 = -1000.0f * cr;
+        a1 = 1000.0f;
+        a2 = 0.0f;
+        break;
+    case GX_SP_COS:
+        a0 = -cr / (1.0f - cr);
+        a1 = 1.0f / (1.0f - cr);
+        a2 = 0.0f;
+        break;
+    case GX_SP_COS2:
+        a0 = 0.0f;
+        a1 = -cr / (1.0f - cr);
+        a2 = 1.0f / (1.0f - cr);
+        break;
+    case GX_SP_SHARP:
+        d = (1.0f - cr) * (1.0f - cr);
+        a0 = (cr * (cr - 2.0f)) / d;
+        a1 = 2.0f / d;
+        a2 = -1.0f / d;
+        break;
+    case GX_SP_RING1:
+        d = (1.0f - cr) * (1.0f - cr);
+        a0 = (-4.0f * cr) / d;
+        a1 = (4.0f * (1.0f + cr)) / d;
+        a2 = -4.0f / d;
+        break;
+    case GX_SP_RING2:
+        d = (1.0f - cr) * (1.0f - cr);
+        a0 = 1.0f - (2.0f * cr * cr) / d;
+        a1 = (4.0f * cr) / d;
+        a2 = -2.0f / d;
+        break;
+    case GX_SP_OFF:
+    default:
+        a0 = 1.0f;
+        a1 = 0.0f;
+        a2 = 0.0f;
+        break;
+    }
+
+    GDWriteXFCmdHdr(__GDLightID2Offset(light) + XF_LIGHT_ATTN_ID, 3);
+    GDWrite_f32(a0);
+    GDWrite_f32(a1);
+    GDWrite_f32(a2);
+}
+
+void GDSetLightDistAttn(GXLightID light, f32 ref_dist, f32 ref_br, GXDistAttnFn dist_func) {
+    f32 k0;
+    f32 k1;
+    f32 k2;
+
+    if (ref_dist < 0.0f || ref_br <= 0.0f || ref_br >= 1.0f) {
+        dist_func = GX_DA_OFF;
+    }
+
+    switch (dist_func) {
+    case GX_DA_GENTLE:
+        k0 = 1.0f;
+        k1 = (1.0f - ref_br) / (ref_br * ref_dist);
+        k2 = 0.0f;
+        break;
+    case GX_DA_MEDIUM:
+        k0 = 1.0f;
+        k1 = (0.5f * (1.0f - ref_br)) / (ref_br * ref_dist);
+        k2 = (0.5f * (1.0f - ref_br)) / (ref_dist * (ref_br * ref_dist));
+        break;
+    case GX_DA_STEEP:
+        k0 = 1.0f;
+        k1 = 0.0f;
+        k2 = (1.0f - ref_br) / (ref_dist * (ref_br * ref_dist));
+        break;
+    case GX_DA_OFF:
+    default:
+        k0 = 1.0f;
+        k1 = 0.0f;
+        k2 = 0.0f;
+        break;
+    }
+
+    GDWriteXFCmdHdr(__GDLightID2Offset(light) + XF_LIGHT_DISTATTN_ID, 3);
+    GDWrite_f32(k0);
+    GDWrite_f32(k1);
+    GDWrite_f32(k2);
+}
+
+void GDSetLightColor(GXLightID light, GXColor color) {
+    GDWriteXFCmd(__GDLightID2Offset(light) + XF_LIGHT_COLOR_ID, color.r << 24 | color.g << 16 | color.b << 8 | color.a);
+}
+
+void GDSetLightPos(GXLightID light, f32 x, f32 y, f32 z) {
+    GDWriteXFCmdHdr(__GDLightID2Offset(light) + XF_LIGHT_POS_ID, 3);
+    GDWrite_f32(x);
+    GDWrite_f32(y);
+    GDWrite_f32(z);
+}
+
+void GDSetLightDir(GXLightID light, f32 nx, f32 ny, f32 nz) {
+    GDWriteXFCmdHdr(__GDLightID2Offset(light) + XF_LIGHT_DIR_ID, 3);
+    GDWrite_f32(nx);
+    GDWrite_f32(ny);
+    GDWrite_f32(nz);
+}
+
+void GDSetSpecularDirHA(GXLightID light, f32 nx, f32 ny, f32 nz, f32 hx, f32 hy, f32 hz) {
+    f32 px;
+    f32 py;
+    f32 pz;
+    px = 1000000000000000000.0f * -nx;
+    py = 1000000000000000000.0f * -ny;
+    pz = 1000000000000000000.0f * -nz;
+
+    GDWriteXFCmdHdr(__GDLightID2Offset(light) + XF_LIGHT_SPEC_DIR_ID, 6);
+    GDWrite_f32(px);
+    GDWrite_f32(py);
+    GDWrite_f32(pz);
+    GDWrite_f32(hx);
+    GDWrite_f32(hy);
+    GDWrite_f32(hz);
+}
+
+void GDSetSpecularDir(GXLightID light, f32 nx, f32 ny, f32 nz) {
+    f32 px;
+    f32 py;
+    f32 pz;
+    f32 hx;
+    f32 hy;
+    f32 hz;
+    f32 mag;
+
+    hx = -nx;
+    hy = -ny;
+    hz = 1.0f + -nz;
+
+    mag = hx * hx + hy * hy + hz * hz;
+    if (mag != 0.0f) {
+        mag = 1.0f / sqrtf(mag);
+    }
+    
+    hx = hx * mag;
+    hy = hy * mag;
+    hz = hz * mag;
+    px = 1000000000000000000.0f * -nx;
+    py = 1000000000000000000.0f * -ny;
+    pz = 1000000000000000000.0f * -nz;
+
+    GDWriteXFCmdHdr(__GDLightID2Offset(light) + XF_LIGHT_SPEC_DIR_ID, 6);
+    GDWrite_f32(px);
+    GDWrite_f32(py);
+    GDWrite_f32(pz);
+    GDWrite_f32(hx);
+    GDWrite_f32(hy);
+    GDWrite_f32(hz);
+}
+
+void GDLoadLightObjIndx(u32 lt_obj_indx, GXLightID light) {
+    GDWriteXFIndxDCmd(__GDLightID2Offset(light) + XF_LIGHT_ID, 0x10, lt_obj_indx);
+}
+
+void GDSetChanAmbColor(GXChannelID chan, GXColor color) {
+    GDWriteXFCmd((chan & 1) + XF_REG_AMBIENT0_ID, color.r << 24 | color.g << 16 | color.b << 8 | color.a);
+}
+
+void GDSetChanMatColor(GXChannelID chan, GXColor color) {
+    GDWriteXFCmd((chan & 1) + XF_REG_MATERIAL0_ID, color.r << 24 | color.g << 16 | color.b << 8 | color.a);
+}
+
+void GDSetChanCtrl(GXChannelID chan, u8 enable, GXColorSrc amb_src, GXColorSrc mat_src, u32 light_mask, GXDiffuseFn diff_fn, GXAttnFn attn_fn) {
+    u32 reg;
+
+    reg = XF_REG_CHAN_CTRL(mat_src, enable, light_mask & 0xF, amb_src, attn_fn == GX_AF_SPEC ? GX_DF_NONE : diff_fn, attn_fn != GX_AF_NONE, attn_fn != GX_AF_SPEC, (light_mask >> 4) & 0xF);
+    GDWriteXFCmd((chan & 3) + XF_REG_COLOR0CNTRL_ID, reg);
+
+    if (chan == 4 || chan == 5) {
+        GDWriteXFCmd(chan + XF_REG_MATERIAL0_ID, reg);
+    }
+}
+
+u16 __GDLightID2Index(GXLightID id) {
+  u16 idx = 0x1F - std::countl_zero((u32) id);
+  if (idx > 7) {
+    idx = 0;
+  }
+  return idx;
+}
diff --git a/aurora-main/lib/dolphin/gd/GDPixel.cpp b/aurora-main/lib/dolphin/gd/GDPixel.cpp
new file mode 100644
index 0000000..c18cf77
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/GDPixel.cpp
@@ -0,0 +1,118 @@
+#include <dolphin/gd.h>
+#include <dolphin/os.h>
+
+void GDSetFog(GXFogType type, f32 startz, f32 endz, f32 nearz, f32 farz, GXColor color) {
+    f32 A;
+    f32 B;
+    f32 B_mant;
+    f32 C;
+    f32 A_f;
+    u32 b_expn;
+    u32 b_m;
+    u32 a_hex;
+    u32 c_hex;
+    u32 fsel;
+    u32 proj;
+
+    ASSERTMSGLINE(62, farz >= 0.0f, "GDSetFog: The farz should be positive value");
+    ASSERTMSGLINE(63, farz >= nearz, "GDSetFog: The farz should be larger than nearz");
+
+    fsel = type & 7;
+    proj = (type >> 3) & 1;
+
+    if (proj != 0) {
+        if (farz == nearz || endz == startz) {
+            A_f = 0.0f;
+            C = 0.0f;
+        } else {
+            A = 1.0f / (endz - startz);
+            A_f = (farz - nearz) * A;
+            C = (startz - nearz) * A;
+        }
+
+        b_expn = 0;
+        b_m = 0;
+    } else {
+        if (farz == nearz || endz == startz) {
+            A = 0.0f;
+            B = 0.5f;
+            C = 0.0f;
+        } else {
+            A = (farz * nearz) / ((farz - nearz) * (endz - startz));
+            B = farz / (farz - nearz);
+            C = startz / (endz - startz);
+        }
+    
+        B_mant = B;
+        b_expn = 1;
+    
+        while (B_mant > 1.0) {
+            B_mant *= 0.5f;
+            b_expn++;
+        }
+    
+        while (B_mant > 0.0f && B_mant < 0.5) {
+            B_mant *= 2.0f;
+            b_expn--;
+        }
+    
+        A_f = A / (1 << b_expn);
+        b_m = (u32) (8388638.0f * B_mant);
+    }
+
+    a_hex = *(u32*)&A_f;
+    c_hex = *(u32*)&C;
+
+    GDWriteBPCmd(BP_FOG_UNK0(a_hex >> 12, 0xEE));
+    GDWriteBPCmd(BP_FOG_UNK1(b_m, 0xEF));
+    GDWriteBPCmd(BP_FOG_UNK2(b_expn, 0xF0));
+    GDWriteBPCmd(BP_FOG_UNK3(c_hex >> 12, proj, fsel, 0xF1));
+    GDWriteBPCmd(BP_FOG_COLOR(color.r, color.g, color.b, 0xF2));
+}
+
+void GDSetBlendMode(GXBlendMode type, GXBlendFactor src_factor, GXBlendFactor dst_factor, GXLogicOp logic_op) {
+    GDWriteBPCmd(0xFE00FFE3);
+    GDWriteBPCmd(BP_BLEND_MODE(
+        type == GX_BM_BLEND || type == GX_BM_SUBTRACT,
+        type == GX_BM_LOGIC,
+        0,
+        0,
+        0,
+        dst_factor,
+        src_factor,
+        type == GX_BM_SUBTRACT,
+        logic_op,
+        0x41
+    ));
+}
+
+void GDSetBlendModeEtc(GXBlendMode type, GXBlendFactor src_factor,
+                       GXBlendFactor dst_factor, GXLogicOp logic_op,
+                       u8 color_update_enable, u8 alpha_update_enable,
+                       u8 dither_enable) {
+    GDWriteBPCmd(BP_BLEND_MODE(
+        type == GX_BM_BLEND || type == GX_BM_SUBTRACT,
+        type == GX_BM_LOGIC,
+        dither_enable,
+        color_update_enable,
+        alpha_update_enable,
+        dst_factor,
+        src_factor,
+        type == GX_BM_SUBTRACT,
+        logic_op,
+        0x41
+    ));
+}
+
+void GDSetZMode(u8 compare_enable, GXCompare func, u8 update_enable) {
+    GDWriteBPCmd(BP_Z_MODE(compare_enable, func, update_enable, 0x40));
+}
+
+void GDSetDstAlpha(u8 enable, u8 alpha) {
+    GDWriteBPCmd(BP_DST_ALPHA(alpha, enable, 0x42));
+}
+
+void GDSetDrawSync(u16 token) {
+    GDWriteBPCmd(BP_TOKEN(token, 0x48));
+    GDWriteBPCmd(BP_TOKEN(token, 0x47));
+}
diff --git a/aurora-main/lib/dolphin/gd/GDTev.cpp b/aurora-main/lib/dolphin/gd/GDTev.cpp
new file mode 100644
index 0000000..69803e8
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/GDTev.cpp
@@ -0,0 +1,159 @@
+#include <dolphin/gd.h>
+#include <dolphin/os.h>
+
+void GDSetTevOp(GXTevStageID stage, GXTevMode mode) {
+    GXTevColorArg carg = GX_CC_RASC;
+    GXTevAlphaArg aarg = GX_CA_RASA;
+
+    if (stage != GX_TEVSTAGE0) {
+        carg = GX_CC_CPREV;
+        aarg = GX_CA_APREV;
+    }
+
+    switch (mode) {
+    case GX_MODULATE:
+        GDSetTevColorCalc(stage, GX_CC_ZERO, GX_CC_TEXC, carg, GX_CC_ZERO, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV);
+        GDSetTevAlphaCalcAndSwap(stage, GX_CA_ZERO, GX_CA_TEXA, aarg, GX_CA_ZERO, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV, GX_TEV_SWAP0, GX_TEV_SWAP0);
+        break;
+    case GX_DECAL:
+        GDSetTevColorCalc(stage, carg, GX_CC_TEXC, GX_CC_TEXA, GX_CC_ZERO, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV);
+        GDSetTevAlphaCalcAndSwap(stage, GX_CA_ZERO, GX_CA_ZERO, GX_CA_ZERO, aarg, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV, GX_TEV_SWAP0, GX_TEV_SWAP0);
+        break;
+    case GX_BLEND:
+        GDSetTevColorCalc(stage, carg, GX_CC_ONE, GX_CC_TEXC, GX_CC_ZERO, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV);
+        GDSetTevAlphaCalcAndSwap(stage, GX_CA_ZERO, GX_CA_TEXA, aarg, GX_CA_ZERO, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV, GX_TEV_SWAP0, GX_TEV_SWAP0);
+        break;
+    case GX_REPLACE:
+        GDSetTevColorCalc(stage, GX_CC_ZERO, GX_CC_ZERO, GX_CC_ZERO, GX_CC_TEXC, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV);
+        GDSetTevAlphaCalcAndSwap(stage, GX_CA_ZERO, GX_CA_ZERO, GX_CA_ZERO, GX_CA_TEXA, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV, GX_TEV_SWAP0, GX_TEV_SWAP0);
+        break;
+    case GX_PASSCLR:
+        GDSetTevColorCalc(stage, GX_CC_ZERO, GX_CC_ZERO, GX_CC_ZERO, carg, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV);
+        GDSetTevAlphaCalcAndSwap(stage, GX_CA_ZERO, GX_CA_ZERO, GX_CA_ZERO, aarg, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, 1, GX_TEVPREV, GX_TEV_SWAP0, GX_TEV_SWAP0);
+        break;
+    default:
+        ASSERTMSGLINE(110, 0, "GDSetTevOp: Invalid Tev Mode");
+        break;
+    }
+}
+
+void GDSetTevColorCalc(GXTevStageID stage, GXTevColorArg a, GXTevColorArg b,
+                       GXTevColorArg c, GXTevColorArg d, GXTevOp op,
+                       GXTevBias bias, GXTevScale scale, u8 clamp,
+                       GXTevRegID out_reg) {
+    if (op <= GX_TEV_SUB) {
+        GDWriteBPCmd(BP_TEV_COLOR(d, c, b, a, bias, op & 1, clamp, scale, out_reg, stage * 2 + 0xC0));
+    } else {
+        GDWriteBPCmd(BP_TEV_COLOR(d, c, b, a, 3, op & 1, clamp, (op >> 1) & 3, out_reg, stage * 2 + 0xC0));
+    }
+}
+
+void GDSetTevAlphaCalcAndSwap(GXTevStageID stage, GXTevAlphaArg a,
+                              GXTevAlphaArg b, GXTevAlphaArg c, GXTevAlphaArg d,
+                              GXTevOp op, GXTevBias bias, GXTevScale scale,
+                              u8 clamp, GXTevRegID out_reg,
+                              GXTevSwapSel ras_sel, GXTevSwapSel tex_sel) {
+    if (op <= GX_TEV_SUB) {
+        GDWriteBPCmd(BP_TEV_ALPHA(ras_sel, tex_sel, d, c, b, a, bias, op & 1, clamp, scale, out_reg, stage * 2 + 0xC1));
+    } else {
+        GDWriteBPCmd(BP_TEV_ALPHA(ras_sel, tex_sel, d, c, b, a, 3, op & 1, clamp, (op >> 1) & 3, out_reg, stage * 2 + 0xC1));
+    }
+}
+
+void GDSetTevColor(GXTevRegID reg, GXColor color) {
+    u32 regRA;
+    u32 regBG;
+
+    regRA = BP_TEV_COLOR_REG_RA(color.r, color.a, 0, 0xE0 + reg * 2);
+    regBG = BP_TEV_COLOR_REG_BG(color.b, color.g, 0, 0xE1 + reg * 2);
+
+    GDWriteBPCmd(regRA);
+    GDWriteBPCmd(regBG);
+    GDWriteBPCmd(regBG);
+    GDWriteBPCmd(regBG);
+}
+
+void GDSetTevColorS10(GXTevRegID reg, GXColorS10 color) {
+    u32 regRA;
+    u32 regBG;
+
+    regRA = BP_TEV_COLOR_REG_RA(color.r & 0x7FF, color.a & 0x7FF, 0, 0xE0 + reg * 2);
+    regBG = BP_TEV_COLOR_REG_BG(color.b & 0x7FF, color.g & 0x7FF, 0, 0xE1 + reg * 2);
+
+    GDWriteBPCmd(regRA);
+    GDWriteBPCmd(regBG);
+    GDWriteBPCmd(regBG);
+    GDWriteBPCmd(regBG);
+}
+
+void GDSetTevKColor(GXTevKColorID reg, GXColor color) {
+    u32 regRA;
+    u32 regBG;
+
+    regRA = BP_TEV_COLOR_REG_RA(color.r, color.a, 1, 0xE0 + reg * 2);
+    regBG = BP_TEV_COLOR_REG_BG(color.b, color.g, 1, 0xE1 + reg * 2);
+
+    GDWriteBPCmd(regRA);
+    GDWriteBPCmd(regBG);
+}
+
+void GDSetTevKonstantSel(GXTevStageID evenStage, GXTevKColorSel kcsel0,
+                         GXTevKAlphaSel kasel0, GXTevKColorSel kcsel1,
+                         GXTevKAlphaSel kasel1) {
+    GDWriteBPCmd(0xFEFFFFF0);
+    GDWriteBPCmd(BP_TEV_KSEL(0, 0, kcsel0, kasel0, kcsel1, kasel1, evenStage / 2 + 0xF6));
+}
+
+void GDSetTevSwapModeTable(GXTevSwapSel table, GXTevColorChan red,
+                           GXTevColorChan green, GXTevColorChan blue,
+                           GXTevColorChan alpha) {
+    GDWriteBPCmd(0xFE00000F);
+    GDWriteBPCmd(BP_TEV_KSEL(red, green, 0, 0, 0, 0, table * 2 + 0xF6));
+
+    GDWriteBPCmd(0xFE00000F);
+    GDWriteBPCmd(BP_TEV_KSEL(blue, alpha, 0, 0, 0, 0, table * 2 + 0xF7));
+}
+
+void GDSetAlphaCompare(GXCompare comp0, u8 ref0, GXAlphaOp op, GXCompare comp1, u8 ref1) {
+    GDWriteBPCmd(BP_ALPHA_COMPARE(ref0, ref1, comp0, comp1, op, 0xF3));
+}
+
+void GDSetZTexture(GXZTexOp op, GXTexFmt fmt, u32 bias) {
+    u32 zfmt;
+
+    switch (fmt) {
+    case GX_TF_Z8:
+        zfmt = 0;
+        break;
+    case GX_TF_Z16:
+        zfmt = 1;
+        break;
+    case GX_TF_Z24X8:
+        zfmt = 2;
+        break;
+    default:
+        ASSERTMSGLINE(399, 0, "GDSetZTexture: Invalid format");
+        zfmt = 2;
+        break;
+    }
+
+    GDWriteBPCmd(BP_ZTEX_PARAMS_0(bias, 0xF4));
+    GDWriteBPCmd(BP_ZTEX_PARAMS_1(zfmt, op, 0xF5));
+}
+
+void GDSetTevOrder(GXTevStageID evenStage, GXTexCoordID coord0, GXTexMapID map0,
+                   GXChannelID color0, GXTexCoordID coord1, GXTexMapID map1,
+                   GXChannelID color1) {
+    static u8 c2r[] = { 0, 1, 0, 1, 0, 1, 7, 5, 6, 0, 0, 0, 0, 0, 0, 7 };
+    GDWriteBPCmd(BP_TEV_ORDER(
+        map0 & 7,
+        coord0 & 7,
+        map0 != GX_TEXMAP_NULL && !(map0 & GX_TEX_DISABLE),
+        c2r[color0 & 0xF],
+        map1 & 7,
+        coord1 & 7,
+        map1 != GX_TEXMAP_NULL && !(map1 & GX_TEX_DISABLE),
+        c2r[color1 & 0xF],
+        evenStage / 2 + 0x28
+    ));
+}
diff --git a/aurora-main/lib/dolphin/gd/GDTexture.cpp b/aurora-main/lib/dolphin/gd/GDTexture.cpp
new file mode 100644
index 0000000..c3c1a6c
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/GDTexture.cpp
@@ -0,0 +1,104 @@
+#include <dolphin/gd.h>
+#include <dolphin/os.h>
+
+u8 GD2HWFiltConv[] = {0, 4, 1, 5, 2, 6};
+
+u8 GDTexMode0Ids[8] = {128, 129, 130, 131, 160, 161, 162, 163};
+u8 GDTexMode1Ids[8] = {132, 133, 134, 135, 164, 165, 166, 167};
+u8 GDTexImage0Ids[8] = {136, 137, 138, 139, 168, 169, 170, 171};
+u8 GDTexImage1Ids[8] = {140, 141, 142, 143, 172, 173, 174, 175};
+u8 GDTexImage2Ids[8] = {144, 145, 146, 147, 176, 177, 178, 179};
+u8 GDTexImage3Ids[8] = {148, 149, 150, 151, 180, 181, 182, 183};
+u8 GDTexTlutIds[8] = {152, 153, 154, 155, 184, 185, 186, 187};
+
+void GDSetTexLookupMode(GXTexMapID id, GXTexWrapMode wrap_s,
+                        GXTexWrapMode wrap_t, GXTexFilter min_filt,
+                        GXTexFilter mag_filt, f32 min_lod, f32 max_lod,
+                        f32 lod_bias, u8 bias_clamp, u8 do_edge_lod,
+                        GXAnisotropy max_aniso) {
+    GDWriteBPCmd(BP_TEX_MODE0(wrap_s, wrap_t, mag_filt == TRUE, GD2HWFiltConv[min_filt], !do_edge_lod, (u8)(32.0f * lod_bias), max_aniso, bias_clamp, GDTexMode0Ids[id]));
+    GDWriteBPCmd(BP_TEX_MODE1((u8)(16.0f * min_lod), (u8)(16.0f * max_lod), GDTexMode1Ids[id]));
+}
+
+void GDSetTexImgAttr(GXTexMapID id, u16 width, u16 height, GXTexFmt format) {
+    GDWriteBPCmd(BP_IMAGE_ATTR(width - 1, height - 1, format, GDTexImage0Ids[id]));
+}
+
+void GDSetTexImgPtr(GXTexMapID id, void* image_ptr) {
+    GDWriteBPCmd(BP_IMAGE_PTR(OSCachedToPhysical(image_ptr) >> 5, GDTexImage3Ids[id]));
+}
+
+void GDSetTexImgPtrRaw(GXTexMapID id, u32 image_ptr_raw) {
+    GDWriteBPCmd(BP_IMAGE_PTR(image_ptr_raw, GDTexImage3Ids[id]));
+}
+
+void GDPatchTexImgPtr(void* image_ptr) {
+    GDWrite_u24(OSCachedToPhysical(image_ptr) >> 5);
+}
+
+void GDSetTexCached(GXTexMapID id, u32 tmem_even, GXTexCacheSize size_even,
+                    u32 tmem_odd, GXTexCacheSize size_odd) {
+    GDWriteBPCmd(BP_TEX_CACHE_EVEN(tmem_even >> 5, size_even + 3, size_even + 3, 0, GDTexImage1Ids[id]));
+
+    if (size_odd != 3 && tmem_odd < 0x100000) {
+        GDWriteBPCmd(BP_TEX_CACHE_ODD(tmem_odd >> 5, size_odd + 3, size_odd + 3, GDTexImage2Ids[id]));
+    }
+}
+
+
+void GDSetTexPreLoaded(GXTexMapID id, u32 tmem_even, u32 tmem_odd) {
+    GDWriteBPCmd(BP_TEX_CACHE_EVEN(tmem_even >> 5, 0, 0, 1, GDTexImage1Ids[id]));
+
+    if (tmem_odd < 0x100000) {
+        GDWriteBPCmd(BP_TEX_CACHE_ODD(tmem_odd >> 5, 0, 0, GDTexImage2Ids[id]));
+    }
+}
+
+void GDSetTexTlut(GXTexMapID id, u32 tmem_addr, GXTlutFmt format) {
+    GDWriteBPCmd(BP_TEX_TLUT((tmem_addr - 0x80000) >> 9, format, GDTexTlutIds[id]));
+}
+
+void GDSetTexCoordScale(GXTexCoordID coord, u16 s_scale, u16 t_scale) {
+    GDWriteBPCmd(0xFE00FFFF);
+    GDWriteBPCmd(BP_TEXCOORD_S_SCALE(s_scale - 1, 0, 0, 0, 0, coord * 2 + 0x30));
+
+    GDWriteBPCmd(0xFE00FFFF);
+    GDWriteBPCmd(BP_TEXCOORD_T_SCALE(t_scale - 1, 0, 0, coord * 2 + 0x31));
+}
+
+void GDSetTexCoordScale2(GXTexCoordID coord, u16 s_scale, u8 s_bias,
+                         u8 s_wrap, u16 t_scale, u8 t_bias, u8 t_wrap) {
+    GDWriteBPCmd(0xFE03FFFF);
+    GDWriteBPCmd(BP_TEXCOORD_S_SCALE(s_scale - 1, s_bias, s_wrap, 0, 0, coord * 2 + 0x30));
+    GDWriteBPCmd(BP_TEXCOORD_T_SCALE(t_scale - 1, t_bias, t_wrap, coord * 2 + 0x31));
+}
+
+void GDSetTexCoordScaleAndTOEs(GXTexCoordID coord, u16 s_scale, u8 s_bias,
+                               u8 s_wrap, u16 t_scale, u8 t_bias, u8 t_wrap,
+                               u8 line_offset, u8 point_offset) {
+    GDWriteBPCmd(BP_TEXCOORD_S_SCALE(s_scale - 1, s_bias, s_wrap, line_offset, point_offset, coord * 2 + 0x30));
+    GDWriteBPCmd(BP_TEXCOORD_T_SCALE(t_scale - 1, t_bias, t_wrap, coord * 2 + 0x31));
+}
+
+void GDLoadTlut(void* tlut_ptr, u32 tmem_addr, GXTlutSize size) {
+    ASSERTMSGLINE(488, !(tmem_addr & 0x1ff), "GDLoadTlut: invalid TMEM pointer");
+    ASSERTMSGLINE(489, size <= 0x400, "GDLoadTlut: invalid TLUT size");
+
+    GDWriteBPCmd(0xFEFFFF00);
+    GDWriteBPCmd(0xF000000);
+    GDWriteBPCmd(BP_LOAD_TLUT0(OSCachedToPhysical(tlut_ptr) >> 5, 0x64));
+    GDWriteBPCmd(BP_LOAD_TLUT1((tmem_addr - 0x80000) >> 9, size, 0x65));
+    GDWriteBPCmd(0xFEFFFF00);
+    GDWriteBPCmd(0xF000000);
+}
+
+void GDLoadTlutRaw(u32 tlut_ptr_raw, u32 tmem_addr, GXTlutSize size) {
+    ASSERTMSGLINE(527, size <= 0x400, "GDLoadTlut: invalid TLUT size");
+
+    GDWriteBPCmd(0xFEFFFF00);
+    GDWriteBPCmd(0xF000000);
+    GDWriteBPCmd(BP_LOAD_TLUT0(tlut_ptr_raw, 0x64));
+    GDWriteBPCmd(BP_LOAD_TLUT1((tmem_addr - 0x80000) >> 9, size, 0x65));
+    GDWriteBPCmd(0xFEFFFF00);
+    GDWriteBPCmd(0xF000000);
+}
diff --git a/aurora-main/lib/dolphin/gd/GDTransform.cpp b/aurora-main/lib/dolphin/gd/GDTransform.cpp
new file mode 100644
index 0000000..9ac9c66
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/GDTransform.cpp
@@ -0,0 +1,127 @@
+#include <dolphin/gd.h>
+#include <dolphin/os.h>
+
+void GDLoadPosMtxImm(const Mtx mtx, u32 id) {
+    GDWriteXFCmdHdr(4 * id, 12);
+    GDWrite_f32(mtx[0][0]);
+    GDWrite_f32(mtx[0][1]);
+    GDWrite_f32(mtx[0][2]);
+    GDWrite_f32(mtx[0][3]);
+    GDWrite_f32(mtx[1][0]);
+    GDWrite_f32(mtx[1][1]);
+    GDWrite_f32(mtx[1][2]);
+    GDWrite_f32(mtx[1][3]);
+    GDWrite_f32(mtx[2][0]);
+    GDWrite_f32(mtx[2][1]);
+    GDWrite_f32(mtx[2][2]);
+    GDWrite_f32(mtx[2][3]);
+}
+
+void GDLoadPosMtxIndx(u16 mtx_indx, u32 id) {
+    GDWriteXFIndxACmd(4 * id, 12, mtx_indx);
+}
+
+void GDLoadNrmMtxImm(const Mtx mtx, u32 id) {
+    GDWriteXFCmdHdr(id * 3 + 0x400, 9);
+    GDWrite_f32(mtx[0][0]);
+    GDWrite_f32(mtx[0][1]);
+    GDWrite_f32(mtx[0][2]);
+    GDWrite_f32(mtx[1][0]);
+    GDWrite_f32(mtx[1][1]);
+    GDWrite_f32(mtx[1][2]);
+    GDWrite_f32(mtx[2][0]);
+    GDWrite_f32(mtx[2][1]);
+    GDWrite_f32(mtx[2][2]);
+}
+
+void GDLoadNrmMtxImm3x3(const f32 mtx[3][3], u32 id) {
+    GDWriteXFCmdHdr(id * 3 + 0x400, 9);
+    GDWrite_f32(mtx[0][0]);
+    GDWrite_f32(mtx[0][1]);
+    GDWrite_f32(mtx[0][2]);
+    GDWrite_f32(mtx[1][0]);
+    GDWrite_f32(mtx[1][1]);
+    GDWrite_f32(mtx[1][2]);
+    GDWrite_f32(mtx[2][0]);
+    GDWrite_f32(mtx[2][1]);
+    GDWrite_f32(mtx[2][2]);
+}
+
+void GDLoadNrmMtxIndx3x3(u16 mtx_indx, u32 id) {
+    GDWriteXFIndxBCmd(id * 3 + 0x400, 9, mtx_indx);
+}
+
+void GDLoadTexMtxImm(const Mtx mtx, u32 id, GXTexMtxType type) {
+    u16 addr;
+    u8 count;
+
+    if (id >= 0x40) {
+        ASSERTMSGLINE(178, type == GX_MTX3x4, "GDLoadTexMtxImm: invalid matrix type");
+        addr = ((id - 0x40) << 2) + 0x500;
+        count = 12;
+    } else {
+        addr = 4 * id;
+        count = type == GX_MTX2x4 ? 8 : 12;
+    }
+
+    GDWriteXFCmdHdr(addr,count);
+    GDWrite_f32(mtx[0][0]);
+    GDWrite_f32(mtx[0][1]);
+    GDWrite_f32(mtx[0][2]);
+    GDWrite_f32(mtx[0][3]);
+    GDWrite_f32(mtx[1][0]);
+    GDWrite_f32(mtx[1][1]);
+    GDWrite_f32(mtx[1][2]);
+    GDWrite_f32(mtx[1][3]);
+
+    if (type == GX_MTX3x4) {
+        GDWrite_f32(mtx[2][0]);
+        GDWrite_f32(mtx[2][1]);
+        GDWrite_f32(mtx[2][2]);
+        GDWrite_f32(mtx[2][3]);
+    }
+}
+
+void GDLoadTexMtxIndx(u16 mtx_indx, u32 id, GXTexMtxType type) {
+    u16 addr;
+    u8 count;
+
+    if (id >= 0x40) {
+        ASSERTMSGLINE(227, type == GX_MTX3x4, "GDLoadTexMtxIndx: invalid matrix type");
+        addr = ((id - 0x40) << 2) + 0x500;
+        count = 12;
+    } else {
+        addr = 4 * id;
+        count = type == GX_MTX2x4 ? 8 : 12;
+    }
+
+    GDWriteXFIndxCCmd(addr, count, mtx_indx);
+}
+
+void GDSetCurrentMtx(u32 pn, u32 t0, u32 t1, u32 t2, u32 t3, u32 t4, u32 t5, u32 t6, u32 t7) {
+    u32 regA;
+    u32 regB;
+
+    regA = CP_MTX_REG_A(pn, t0, t1, t2, t3);
+    regB = CP_MTX_REG_B(t4, t5, t6, t7);
+
+    GDWriteCPCmd(CP_MTX_REG_A_ID, regA);
+    GDWriteCPCmd(CP_MTX_REG_B_ID, regB);
+    GDWriteXFCmdHdr(XF_REG_MATRIXINDEX0_ID, 2);
+    GDWrite_u32(regA);
+    GDWrite_u32(regB);
+}
+
+void GDSetProjection(const Mtx44 mtx, GXProjectionType type) {
+    u32 c;
+    c = type == GX_ORTHOGRAPHIC ? 3 : 2;
+
+    GDWriteXFCmdHdr(XF_REG_PROJECTIONA_ID, 7);
+    GDWrite_f32(mtx[0][0]);
+    GDWrite_f32(mtx[0][c]);
+    GDWrite_f32(mtx[1][1]);
+    GDWrite_f32(mtx[1][c]);
+    GDWrite_f32(mtx[2][2]);
+    GDWrite_f32(mtx[2][3]);
+    GDWrite_u32(type);
+}
diff --git a/aurora-main/lib/dolphin/gd/gd.hpp b/aurora-main/lib/dolphin/gd/gd.hpp
new file mode 100644
index 0000000..0f69c24
--- /dev/null
+++ b/aurora-main/lib/dolphin/gd/gd.hpp
@@ -0,0 +1,5 @@
+#pragma once
+
+#include "../../internal.hpp"
+
+static aurora::Module Log("aurora::gd");
diff --git a/aurora-main/lib/dolphin/gx/GXAurora.cpp b/aurora-main/lib/dolphin/gx/GXAurora.cpp
new file mode 100644
index 0000000..11b87c1
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXAurora.cpp
@@ -0,0 +1,175 @@
+#include "dolphin/gx/GXAurora.h"
+
+#include <algorithm>
+#include <cmath>
+#include <limits>
+
+#include "__gx.h"
+#include "gx.hpp"
+#include "../../window.hpp"
+
+#include "../../gfx/common.hpp"
+#include "../../gx/fifo.hpp"
+
+// Single definition for the `Log` that gx.hpp declares for this directory.
+aurora::Module Log("aurora::gx");
+
+static void GXWriteString(const char* label) {
+  auto length = strlen(label);
+
+  if (length > std::numeric_limits<u16>::max()) {
+    Log.warn("Debug marker size over u16 max, truncating");
+    length = std::numeric_limits<u16>::max();
+  }
+
+  GX_WRITE_U16(length);
+  GX_WRITE_DATA(label, length);
+}
+
+void GXPushDebugGroup(const char* label) {
+  GX_WRITE_AURORA(GX_LOAD_AURORA_DEBUG_GROUP_PUSH);
+  GXWriteString(label);
+}
+
+void GXPopDebugGroup() { GX_WRITE_AURORA(GX_LOAD_AURORA_DEBUG_GROUP_POP); }
+
+void GXInsertDebugMarker(const char* label) {
+  GX_WRITE_AURORA(GX_LOAD_AURORA_DEBUG_MARKER_INSERT);
+  GXWriteString(label);
+}
+
+void AuroraSetViewportPolicy(AuroraViewportPolicy policy) {
+  const bool changed = g_gxState.viewportPolicy != policy;
+  if (changed) {
+    // Finish commands using the old framebuffer mapping before changing it.
+    aurora::gx::fifo::drain();
+  }
+  g_gxState.viewportPolicy = policy;
+  aurora::window::set_frame_buffer_aspect_fit(policy == AURORA_VIEWPORT_FIT);
+  aurora::window::set_present_surface_fill(policy == AURORA_VIEWPORT_STRETCH);
+  if (changed) {
+    // Reapply the guest viewport and scissor after a resize.
+    aurora::gx::set_logical_viewport(g_gxState.logicalViewport);
+    aurora::gx::set_logical_scissor(g_gxState.logicalScissor);
+  }
+}
+
+void AuroraGetRenderSize(u32* width, u32* height) {
+  // The guest CPU thread uses this safe render-size value outside render passes.
+  const auto renderSize = aurora::gfx::get_frame_buffer_size();
+  if (width != nullptr) {
+    *width = renderSize.x;
+  }
+  if (height != nullptr) {
+    *height = renderSize.y;
+  }
+}
+
+void AuroraGetSurfaceSize(u32* width, u32* height) {
+  const auto windowSize = aurora::window::get_window_size();
+  if (width != nullptr) {
+    *width = windowSize.native_fb_width;
+  }
+  if (height != nullptr) {
+    *height = windowSize.native_fb_height;
+  }
+}
+
+void GXSetViewportRender(f32 left, f32 top, f32 wd, f32 ht, f32 nearz, f32 farz) {
+  GX_WRITE_AURORA(GX_LOAD_AURORA_VIEWPORT_RENDER);
+  GX_WRITE_F32(left);
+  GX_WRITE_F32(top);
+  GX_WRITE_F32(wd);
+  GX_WRITE_F32(ht);
+  GX_WRITE_F32(nearz);
+  GX_WRITE_F32(farz);
+}
+
+void GXSetScissorRender(u32 left, u32 top, u32 wd, u32 ht) {
+  GX_WRITE_AURORA(GX_LOAD_AURORA_SCISSOR_RENDER);
+  GX_WRITE_U32(left);
+  GX_WRITE_U32(top);
+  GX_WRITE_U32(wd);
+  GX_WRITE_U32(ht);
+}
+
+namespace {
+void WriteMappedRenderState(const aurora::gx::MappedRenderState& mapped) {
+  GXSetViewportRender(mapped.viewport.left, mapped.viewport.top, mapped.viewport.width, mapped.viewport.height,
+                      mapped.viewport.znear, mapped.viewport.zfar);
+  GXSetScissorRender(static_cast<u32>(std::max(mapped.scissor.x, 0)),
+                     static_cast<u32>(std::max(mapped.scissor.y, 0)),
+                     static_cast<u32>(std::max(mapped.scissor.width, 0)),
+                     static_cast<u32>(std::max(mapped.scissor.height, 0)));
+}
+} // namespace
+
+void GXSetViewportScissorRenderSafeArea(f32 aspect) {
+  const auto [targetWidth, targetHeight] = aurora::gfx::get_render_target_size();
+  if (targetWidth == 0 || targetHeight == 0 || !std::isfinite(aspect) || aspect <= 0.0f) {
+    return;
+  }
+
+  // Apply queued viewport changes before direct layout draws use the safe area.
+  aurora::gx::fifo::drain();
+  auto mapped = aurora::gx::map_logical_render_state();
+  const float targetAspect = static_cast<float>(targetWidth) / static_cast<float>(targetHeight);
+
+  float safeLeft = 0.0f;
+  float safeTop = 0.0f;
+  float safeWidth = static_cast<float>(targetWidth);
+  float safeHeight = static_cast<float>(targetHeight);
+  if (targetAspect > aspect) {
+    safeWidth = safeHeight * aspect;
+    safeLeft = (static_cast<float>(targetWidth) - safeWidth) * 0.5f;
+  } else if (targetAspect < aspect) {
+    safeHeight = safeWidth / aspect;
+    safeTop = (static_cast<float>(targetHeight) - safeHeight) * 0.5f;
+  }
+
+  const float scaleX = safeWidth / static_cast<float>(targetWidth);
+  const float scaleY = safeHeight / static_cast<float>(targetHeight);
+  mapped.viewport.left = safeLeft + mapped.viewport.left * scaleX;
+  mapped.viewport.top = safeTop + mapped.viewport.top * scaleY;
+  mapped.viewport.width *= scaleX;
+  mapped.viewport.height *= scaleY;
+
+  const float scissorLeft = safeLeft + static_cast<float>(mapped.scissor.x) * scaleX;
+  const float scissorTop = safeTop + static_cast<float>(mapped.scissor.y) * scaleY;
+  const float scissorRight =
+      safeLeft + static_cast<float>(mapped.scissor.x + mapped.scissor.width) * scaleX;
+  const float scissorBottom =
+      safeTop + static_cast<float>(mapped.scissor.y + mapped.scissor.height) * scaleY;
+  const int32_t left = std::clamp(static_cast<int32_t>(std::floor(scissorLeft)), 0,
+                                  static_cast<int32_t>(targetWidth));
+  const int32_t top = std::clamp(static_cast<int32_t>(std::floor(scissorTop)), 0,
+                                 static_cast<int32_t>(targetHeight));
+  const int32_t right = std::clamp(static_cast<int32_t>(std::ceil(scissorRight)), left,
+                                   static_cast<int32_t>(targetWidth));
+  const int32_t bottom = std::clamp(static_cast<int32_t>(std::ceil(scissorBottom)), top,
+                                    static_cast<int32_t>(targetHeight));
+  mapped.scissor = {left, top, right - left, bottom - top};
+
+  WriteMappedRenderState(mapped);
+}
+
+void GXRestoreViewportScissorRender() {
+  // Run queued GX draws before leaving the direct layout safe area.
+  aurora::gx::fifo::drain();
+  WriteMappedRenderState(aurora::gx::map_logical_render_state());
+}
+
+void GXSetTexCopySrcRender(u16 left, u16 top, u16 wd, u16 ht) {
+  aurora::gx::g_gxState.texCopySrc = {left, top, wd, ht};
+  aurora::gx::g_gxState.texCopySrcRenderSpace = true;
+}
+
+void GXCreateFrameBuffer(u32 width, u32 height) {
+  aurora::gx::fifo::drain();
+  aurora::gfx::begin_offscreen(width, height);
+}
+
+void GXRestoreFrameBuffer() {
+  aurora::gx::fifo::drain();
+  aurora::gfx::end_offscreen();
+}
diff --git a/aurora-main/lib/dolphin/gx/GXBump.cpp b/aurora-main/lib/dolphin/gx/GXBump.cpp
new file mode 100644
index 0000000..511bcfe
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXBump.cpp
@@ -0,0 +1,213 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+extern "C" {
+void GXSetNumIndStages(u8 num) {
+  SET_REG_FIELD(0, __gx->genMode, 3, 16, num);
+  __gx->dirtyState |= 6; // gen mode dirty + BP mask dirty
+}
+
+void GXSetIndTexOrder(GXIndTexStageID indStage, GXTexCoordID texCoord, GXTexMapID texMap) {
+  switch (indStage) {
+  case GX_INDTEXSTAGE0:
+    SET_REG_FIELD(0, __gx->iref, 3, 0, texMap);
+    SET_REG_FIELD(0, __gx->iref, 3, 3, texCoord);
+    break;
+  case GX_INDTEXSTAGE1:
+    SET_REG_FIELD(0, __gx->iref, 3, 6, texMap);
+    SET_REG_FIELD(0, __gx->iref, 3, 9, texCoord);
+    break;
+  case GX_INDTEXSTAGE2:
+    SET_REG_FIELD(0, __gx->iref, 3, 12, texMap);
+    SET_REG_FIELD(0, __gx->iref, 3, 15, texCoord);
+    break;
+  case GX_INDTEXSTAGE3:
+    SET_REG_FIELD(0, __gx->iref, 3, 18, texMap);
+    SET_REG_FIELD(0, __gx->iref, 3, 21, texCoord);
+    break;
+  }
+  GX_WRITE_RAS_REG(__gx->iref);
+  __gx->bpSent = 1;
+  __gx->dirtyState |= 3; // SU tex regs + BP mask dirty
+}
+
+void GXSetIndTexCoordScale(GXIndTexStageID indStage, GXIndTexScale scaleS, GXIndTexScale scaleT) {
+  if (indStage < GX_INDTEXSTAGE2) {
+    switch (indStage) {
+    case GX_INDTEXSTAGE0:
+      SET_REG_FIELD(0, __gx->IndTexScale0, 4, 0, scaleS);
+      SET_REG_FIELD(0, __gx->IndTexScale0, 4, 4, scaleT);
+      break;
+    case GX_INDTEXSTAGE1:
+      SET_REG_FIELD(0, __gx->IndTexScale0, 4, 8, scaleS);
+      SET_REG_FIELD(0, __gx->IndTexScale0, 4, 12, scaleT);
+      break;
+    }
+    GX_WRITE_RAS_REG(__gx->IndTexScale0);
+  } else {
+    switch (indStage) {
+    case GX_INDTEXSTAGE2:
+      SET_REG_FIELD(0, __gx->IndTexScale1, 4, 0, scaleS);
+      SET_REG_FIELD(0, __gx->IndTexScale1, 4, 4, scaleT);
+      break;
+    case GX_INDTEXSTAGE3:
+      SET_REG_FIELD(0, __gx->IndTexScale1, 4, 8, scaleS);
+      SET_REG_FIELD(0, __gx->IndTexScale1, 4, 12, scaleT);
+      break;
+    }
+    GX_WRITE_RAS_REG(__gx->IndTexScale1);
+  }
+  __gx->bpSent = 1;
+}
+
+void GXSetIndTexMtx(GXIndTexMtxID id, const void* offset, s8 scaleExp) {
+  u32 idx = 0;
+  if (id >= GX_ITM_0 && id <= GX_ITM_2) {
+    idx = id - GX_ITM_0;
+  } else if (id >= GX_ITM_S0 && id <= GX_ITM_S2) {
+    idx = id - GX_ITM_S0;
+  } else if (id >= GX_ITM_T0 && id <= GX_ITM_T2) {
+    idx = id - GX_ITM_T0;
+  }
+
+  const auto* mtx = reinterpret_cast<const f32*>(offset);
+  s32 adjScale = scaleExp + 17;
+
+  // Write 3 BP registers for the 2x3 matrix
+
+  // Column 0: m[0][0] and m[1][0]
+  u32 reg0 = 0;
+  s32 m00 = static_cast<s32>(1024.0f * mtx[0]) & 0x7FF;
+  s32 m10 = static_cast<s32>(1024.0f * mtx[3]) & 0x7FF;
+  SET_REG_FIELD(0, reg0, 11, 0, m00);
+  SET_REG_FIELD(0, reg0, 11, 11, m10);
+  SET_REG_FIELD(0, reg0, 2, 22, adjScale & 3);
+  SET_REG_FIELD(0, reg0, 8, 24, idx * 3 + 6);
+  GX_WRITE_RAS_REG(reg0);
+
+  // Column 1: m[0][1] and m[1][1]
+  u32 reg1 = 0;
+  s32 m01 = static_cast<s32>(1024.0f * mtx[1]) & 0x7FF;
+  s32 m11 = static_cast<s32>(1024.0f * mtx[4]) & 0x7FF;
+  SET_REG_FIELD(0, reg1, 11, 0, m01);
+  SET_REG_FIELD(0, reg1, 11, 11, m11);
+  SET_REG_FIELD(0, reg1, 2, 22, (adjScale >> 2) & 3);
+  SET_REG_FIELD(0, reg1, 8, 24, idx * 3 + 7);
+  GX_WRITE_RAS_REG(reg1);
+
+  // Column 2: m[0][2] and m[1][2]
+  u32 reg2 = 0;
+  s32 m02 = static_cast<s32>(1024.0f * mtx[2]) & 0x7FF;
+  s32 m12 = static_cast<s32>(1024.0f * mtx[5]) & 0x7FF;
+  SET_REG_FIELD(0, reg2, 11, 0, m02);
+  SET_REG_FIELD(0, reg2, 11, 11, m12);
+  SET_REG_FIELD(0, reg2, 2, 22, (adjScale >> 4) & 3);
+  SET_REG_FIELD(0, reg2, 8, 24, idx * 3 + 8);
+  GX_WRITE_RAS_REG(reg2);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevIndirect(GXTevStageID tevStage, GXIndTexStageID indStage, GXIndTexFormat fmt, GXIndTexBiasSel biasSel,
+                      GXIndTexMtxID matrixSel, GXIndTexWrap wrapS, GXIndTexWrap wrapT, GXBool addPrev, GXBool indLod,
+                      GXIndTexAlphaSel alphaSel) {
+  // BP register: tev_stage + 0x10
+  u32 reg = 0;
+  SET_REG_FIELD(0, reg, 2, 0, indStage);
+  SET_REG_FIELD(0, reg, 2, 2, fmt);
+  SET_REG_FIELD(0, reg, 3, 4, biasSel);
+  SET_REG_FIELD(0, reg, 2, 7, alphaSel);
+  SET_REG_FIELD(0, reg, 4, 9, matrixSel);
+  SET_REG_FIELD(0, reg, 3, 13, wrapS);
+  SET_REG_FIELD(0, reg, 3, 16, wrapT);
+  SET_REG_FIELD(0, reg, 1, 19, indLod);
+  SET_REG_FIELD(0, reg, 1, 20, addPrev);
+  SET_REG_FIELD(0, reg, 8, 24, tevStage + 16);
+  GX_WRITE_RAS_REG(reg);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevDirect(GXTevStageID stageId) {
+  GXSetTevIndirect(stageId, GX_INDTEXSTAGE0, GX_ITF_8, GX_ITB_NONE, GX_ITM_OFF, GX_ITW_OFF, GX_ITW_OFF, GX_FALSE,
+                   GX_FALSE, GX_ITBA_OFF);
+}
+
+void GXSetTevIndWarp(GXTevStageID tevStage, GXIndTexStageID indStage, GXBool signedOffsets, GXBool replaceMode,
+                     GXIndTexMtxID matrixSel) {
+  const auto wrap = replaceMode ? GX_ITW_0 : GX_ITW_OFF;
+  const auto biasSel = signedOffsets ? GX_ITB_STU : GX_ITB_NONE;
+  GXSetTevIndirect(tevStage, indStage, GX_ITF_8, biasSel, matrixSel, wrap, wrap, false, false, GX_ITBA_OFF);
+}
+
+void GXSetTevIndRepeat(GXTevStageID tevStage) {
+  GXSetTevIndirect(tevStage, GX_INDTEXSTAGE0, GX_ITF_8, GX_ITB_NONE, GX_ITM_OFF, GX_ITW_0, GX_ITW_0, GX_TRUE,
+                   GX_FALSE, GX_ITBA_OFF);
+}
+
+void GXSetTevIndBumpXYZ(GXTevStageID tevStage, GXIndTexStageID indStage, GXIndTexMtxID matrixSel) {
+  GXSetTevIndirect(tevStage, indStage, GX_ITF_8, GX_ITB_STU, matrixSel, GX_ITW_OFF, GX_ITW_OFF, GX_FALSE, GX_FALSE,
+                   GX_ITBA_OFF);
+}
+
+void GXSetTevIndBumpST(GXTevStageID tevStage, GXIndTexStageID indStage, GXIndTexMtxID matrixSel) {
+  GXIndTexMtxID sMtx, tMtx;
+  switch (matrixSel) {
+  case GX_ITM_0:
+    sMtx = GX_ITM_S0;
+    tMtx = GX_ITM_T0;
+    break;
+  case GX_ITM_1:
+    sMtx = GX_ITM_S1;
+    tMtx = GX_ITM_T1;
+    break;
+  case GX_ITM_2:
+    sMtx = GX_ITM_S2;
+    tMtx = GX_ITM_T2;
+    break;
+  default:
+    sMtx = GX_ITM_OFF;
+    tMtx = GX_ITM_OFF;
+    break;
+  }
+  // Stage 0: STU bias, S-dynamic matrix, wrap=0/0
+  GXSetTevIndirect(tevStage, indStage, GX_ITF_8, GX_ITB_STU, sMtx, GX_ITW_0, GX_ITW_0, GX_FALSE, GX_FALSE,
+                   GX_ITBA_OFF);
+  // Stage 1: STU bias, T-dynamic matrix, wrap=0/0, add prev
+  GXSetTevIndirect(static_cast<GXTevStageID>(tevStage + 1), indStage, GX_ITF_8, GX_ITB_STU, tMtx, GX_ITW_0, GX_ITW_0,
+                   GX_TRUE, GX_FALSE, GX_ITBA_OFF);
+  // Stage 2: no bias, matrix off, wrap off, add prev
+  GXSetTevIndirect(static_cast<GXTevStageID>(tevStage + 2), indStage, GX_ITF_8, GX_ITB_NONE, GX_ITM_OFF, GX_ITW_OFF,
+                   GX_ITW_OFF, GX_TRUE, GX_FALSE, GX_ITBA_OFF);
+}
+
+void GXSetTevIndTile(GXTevStageID tevStage, GXIndTexStageID indStage, u16 tileSizeS, u16 tileSizeT, u16 tileSizeS_exp,
+                     u16 tileSizeT_exp, GXIndTexFormat fmt, GXIndTexMtxID matrixSel, GXIndTexBiasSel biasSel,
+                     GXIndTexAlphaSel alphaSel) {
+  // Convert tile size exponents to wrap modes
+  auto sizeToWrap = [](u16 sizeExp) -> GXIndTexWrap {
+    switch (sizeExp) {
+    case 8: return GX_ITW_256;
+    case 7: return GX_ITW_128;
+    case 6: return GX_ITW_64;
+    case 5: return GX_ITW_32;
+    case 4: return GX_ITW_16;
+    default: return GX_ITW_0;
+    }
+  };
+  GXIndTexWrap wrapS = sizeToWrap(tileSizeS_exp);
+  GXIndTexWrap wrapT = sizeToWrap(tileSizeT_exp);
+
+  // Set up the indirect matrix for tiling
+  f32 mtx[2][3] = {};
+  s8 scaleExp = 0;
+  if (biasSel == GX_ITB_S || biasSel == GX_ITB_ST || biasSel == GX_ITB_SU || biasSel == GX_ITB_STU) {
+    mtx[0][0] = static_cast<f32>(tileSizeS);
+    scaleExp = tileSizeS_exp;
+  }
+  if (biasSel == GX_ITB_T || biasSel == GX_ITB_ST || biasSel == GX_ITB_TU || biasSel == GX_ITB_STU) {
+    mtx[1][1] = static_cast<f32>(tileSizeT);
+    scaleExp = tileSizeT_exp;
+  }
+  GXSetIndTexMtx(matrixSel, mtx, scaleExp);
+  GXSetTevIndirect(tevStage, indStage, fmt, biasSel, matrixSel, wrapS, wrapT, GX_FALSE, GX_FALSE, alphaSel);
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXCpu2Efb.cpp b/aurora-main/lib/dolphin/gx/GXCpu2Efb.cpp
new file mode 100644
index 0000000..9815bd4
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXCpu2Efb.cpp
@@ -0,0 +1,20 @@
+#include "gx.hpp"
+
+#include "../../gfx/depth_peek.hpp"
+
+#include <dolphin/gx/GXCpu2Efb.h>
+
+void GXPeekZ(u16 x, u16 y, u32* z) {
+  aurora::gfx::depth_peek::poll();
+
+  if (z != nullptr) {
+    u32 value = 0;
+    if (aurora::gfx::depth_peek::read_latest(x, y, value)) {
+      *z = value;
+    } else {
+      *z = g_gxState.clearDepth & 0x00ffffffu;
+    }
+  }
+
+  aurora::gfx::depth_peek::request_snapshot();
+}
diff --git a/aurora-main/lib/dolphin/gx/GXCull.cpp b/aurora-main/lib/dolphin/gx/GXCull.cpp
new file mode 100644
index 0000000..0611778
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXCull.cpp
@@ -0,0 +1,60 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+extern "C" {
+
+void GXSetScissor(u32 left, u32 top, u32 width, u32 height) {
+  const u32 tp = top + 342;
+  const u32 lf = left + 342;
+  const u32 bm = tp + height - 1;
+  const u32 rt = lf + width - 1;
+
+  SET_REG_FIELD(0, __gx->suScis0, 11, 0, tp);
+  SET_REG_FIELD(0, __gx->suScis0, 11, 12, lf);
+  SET_REG_FIELD(0, __gx->suScis1, 11, 0, bm);
+  SET_REG_FIELD(0, __gx->suScis1, 11, 12, rt);
+
+  GX_WRITE_RAS_REG(__gx->suScis0);
+  GX_WRITE_RAS_REG(__gx->suScis1);
+  __gx->bpSent = 1;
+}
+
+// TODO GXSetScissorBoxOffset
+
+void GXSetCullMode(GXCullMode mode) {
+  // Swap front/back to match hardware convention
+  GXCullMode hwMode;
+  switch (mode) {
+  case GX_CULL_FRONT:
+    hwMode = GX_CULL_BACK;
+    break;
+  case GX_CULL_BACK:
+    hwMode = GX_CULL_FRONT;
+    break;
+  default:
+    hwMode = mode;
+    break;
+  }
+  SET_REG_FIELD(0, __gx->genMode, 2, 14, hwMode);
+  __gx->dirtyState |= 4; // gen mode dirty
+}
+
+void GXSetClipMode(GXClipMode mode) {
+  GX_WRITE_XF_REG(5, mode);
+  __gx->bpSent = 1;
+}
+
+void GXSetCoPlanar(GXBool enable) {
+  u32 reg;
+  SET_REG_FIELD(0, __gx->genMode, 1, 19, enable);
+
+  // This sets a mask that causes only one bit to be updated in genMode on the next write.
+  reg = 0x0008000;
+  SET_REG_FIELD(0, reg, 8, 24, 0xFE);
+  SET_REG_FIELD(0, reg, 24, 0, 1 << 19);
+  GX_WRITE_RAS_REG(reg);
+
+  // immediately flush
+  GX_WRITE_RAS_REG(__gx->genMode);
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXDispList.cpp b/aurora-main/lib/dolphin/gx/GXDispList.cpp
new file mode 100644
index 0000000..bf22212
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXDispList.cpp
@@ -0,0 +1,89 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+#include "../../gx/command_processor.hpp"
+#include "../../gx/fifo.hpp"
+
+#include <cstring>
+
+static __GXData_struct sSavedGXData;
+
+extern "C" {
+void GXBeginDisplayList(void* list, u32 size) {
+  CHECK(!aurora::gx::fifo::in_display_list(), "Display list began twice!");
+
+  // Flush any pending dirty state before recording
+  if (__gx->dirtyState != 0) {
+    __GXSetDirtyState();
+  }
+
+  // Save current shadow register state if requested
+  if (__gx->dlSaveContext != 0) {
+    std::memcpy(&sSavedGXData, __gx, sizeof(sSavedGXData));
+  }
+
+  __gx->inDispList = 1;
+
+  // Redirect FIFO writes to the user-provided buffer
+  aurora::gx::fifo::begin_display_list(static_cast<u8*>(list), size);
+}
+
+u32 GXEndDisplayList() {
+  // Flush any pending dirty state into the display list
+  if (__gx->dirtyState != 0) {
+    __GXSetDirtyState();
+  }
+
+  // End FIFO redirection and get the byte count (ROUNDUP32)
+  u32 bytesWritten = aurora::gx::fifo::end_display_list();
+
+  // Restore saved shadow register state
+  if (__gx->dlSaveContext != 0) {
+    std::memcpy(__gx, &sSavedGXData, sizeof(*__gx));
+  }
+
+  __gx->inDispList = 0;
+
+  return bytesWritten;
+}
+
+void GXCallDisplayList(const void* data, u32 nbytes) {
+  // Flush any pending dirty state before calling
+  if (__gx->dirtyState != 0) {
+    __GXSetDirtyState();
+  }
+
+  // Flush pending primitives
+  if (*reinterpret_cast<u32*>(&__gx->vNum) != 0) {
+    __GXSendFlushPrim();
+  }
+
+  // Nested display-list calls add bytes instead of changing live renderer state.
+  if (aurora::gx::fifo::in_display_list()) {
+    aurora::gx::fifo::write_data(data, nbytes);
+    return;
+  }
+
+  // Decode the display list immediately while its borrowed resources are valid.
+  aurora::gx::fifo::drain();
+  aurora::gx::fifo::process(static_cast<const u8*>(data), nbytes, true);
+}
+
+void GXCallDisplayListLE(const void* data, u32 nbytes) {
+  // Flush any pending dirty state before calling
+  if (__gx->dirtyState != 0) {
+    __GXSetDirtyState();
+  }
+
+  // Flush pending primitives
+  if (*reinterpret_cast<u32*>(&__gx->vNum) != 0) {
+    __GXSendFlushPrim();
+  }
+
+  // Decode little-endian lists separately after finishing the normal FIFO work.
+  aurora::gx::fifo::drain();
+
+  // Process the display list through the command processor (little-endian)
+  aurora::gx::fifo::process(static_cast<const u8*>(data), nbytes, false);
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXDraw.cpp b/aurora-main/lib/dolphin/gx/GXDraw.cpp
new file mode 100644
index 0000000..314104c
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXDraw.cpp
@@ -0,0 +1,549 @@
+#include "gx.hpp"
+
+extern "C" {
+
+static GXVtxDescList vcd[27];
+static GXVtxAttrFmtList vat[27];
+
+static void GetVertState(void) {
+    GXGetVtxDescv(vcd);
+    GXGetVtxAttrFmtv(GX_VTXFMT3, vat);
+    GXClearVtxDesc();
+    GXSetVtxDesc(GX_VA_POS, GX_DIRECT);
+    GXSetVtxDesc(GX_VA_NRM, GX_DIRECT);
+    GXSetVtxAttrFmt(GX_VTXFMT3, GX_VA_POS, GX_POS_XYZ, GX_F32, 0);
+    GXSetVtxAttrFmt(GX_VTXFMT3, GX_VA_NRM, GX_NRM_XYZ, GX_F32, 0);
+}
+
+static void RestoreVertState(void) {
+    GXSetVtxDescv(vcd);
+    GXSetVtxAttrFmtv(GX_VTXFMT3, vat);
+}
+
+static void vsub(f32 p1[3], f32 p2[3], f32 u[3]) {
+    u32 i;
+
+    for (i = 0; i < 3; i++) {
+        u[i] = p2[i] - p1[i];
+    }
+}
+
+static void vcross(f32 u[3], f32 v[3], f32 n[3]) {
+    f32 n1[3];
+
+    n1[0] = (u[1] * v[2]) - (u[2] * v[1]);
+    n1[1] = (u[2] * v[0]) - (u[0] * v[2]);
+    n1[2] = (u[0] * v[1]) - (u[1] * v[0]);
+    n[0] = n1[0];
+    n[1] = n1[1];
+    n[2] = n1[2];
+}
+
+static void normalize(f32 v[3]) {
+    f32 d = sqrtf((v[0] * v[0]) + (v[1] * v[1]) + (v[2] * v[2]));
+
+    CHECK(d != 0.0f, "normalize: zero length vector");
+    v[0] /= d;
+    v[1] /= d;
+    v[2] /= d;
+}
+
+static void myvertex(f32 v[3], f32 n[3]) {
+    GXPosition3f32(v[0], v[1], v[2]);
+    GXNormal3f32(n[0], n[1], n[2]);
+}
+
+static void DumpTriangle(f32 v0[3], f32 v1[3], f32 v2[3]) {
+    GXBegin(GX_TRIANGLES, GX_VTXFMT3, 3);
+    myvertex(v0, v0);
+    myvertex(v1, v1);
+    myvertex(v2, v2);
+    GXEnd();
+}
+
+static void Subdivide(u8 depth, f32 v0[3], f32 v1[3], f32 v2[3]) {
+    f32 v01[3];
+    f32 v12[3];
+    f32 v20[3];
+    u32 i;
+
+    if (depth == 0) {
+        DumpTriangle(v0, v1, v2);
+        return;
+    }
+
+    for (i = 0; i < 3; i++) {
+        v01[i] = v0[i] + v1[i];
+        v12[i] = v1[i] + v2[i];
+        v20[i] = v2[i] + v0[i];
+    }
+
+    normalize(v01);
+    normalize(v12);
+    normalize(v20);
+    Subdivide(depth - 1, v0, v01, v20);
+    Subdivide(depth - 1, v1, v12, v01);
+    Subdivide(depth - 1, v2, v20, v12);
+    Subdivide(depth - 1, v01, v12, v20);
+}
+
+static void SubDivTriangle(u8 depth, u8 i, f32 (*data)[3], u8 (*ndx)[3]) {
+    f32 *x0 = data[ndx[i][0]];
+    f32 *x1 = data[ndx[i][1]];
+    f32 *x2 = data[ndx[i][2]];
+
+    Subdivide(depth, x0, x1, x2);
+}
+
+void GXDrawCylinder(u8 numEdges) {
+    s32 i;
+    f32 top;
+    f32 bottom;
+    f32 x[100];
+    f32 y[100];
+    f32 angle;
+
+    top = 1.0f;
+    bottom = -top;
+    CHECK(numEdges <= 99, "GXDrawCylinder: too many edges");
+
+    GetVertState();
+
+    for (i = 0; i <= numEdges; i++) {
+        angle = (3.1415927f * (2.0f * i)) / numEdges;
+        x[i] = cosf(angle);
+        y[i] = sinf(angle);
+    }
+
+    GXBegin(GX_TRIANGLESTRIP, GX_VTXFMT3, (numEdges + 1) * 2);
+    for (i = 0; i <= numEdges; i++) {
+        GXPosition3f32(x[i], y[i], bottom);
+        GXNormal3f32(x[i], y[i], 0.0f);
+        GXPosition3f32(x[i], y[i], top);
+        GXNormal3f32(x[i], y[i], 0.0f);
+
+    }
+    GXEnd();
+
+    GXBegin(GX_TRIANGLEFAN, GX_VTXFMT3, numEdges + 2);
+    GXPosition3f32(0.0f, 0.0f, top);
+    GXNormal3f32(0.0f, 0.0f, 1.0f);
+    for (i = 0; i <= numEdges; i++) {
+        GXPosition3f32(x[i], -y[i], top);
+        GXNormal3f32(0.0f, 0.0f, 1.0f);
+
+    }
+    GXEnd();
+
+    GXBegin(GX_TRIANGLEFAN, GX_VTXFMT3, numEdges + 2);
+    GXPosition3f32(0.0f, 0.0f, bottom);
+    GXNormal3f32(0.0f, 0.0f, -1.0f);
+    for (i = 0; i <= numEdges; i++) {
+        GXPosition3f32(x[i], y[i], bottom);
+        GXNormal3f32(0.0f, 0.0f, -1.0f);
+    }
+    GXEnd();
+
+    RestoreVertState();
+}
+
+void GXDrawTorus(f32 rc, u8 numc, u8 numt) {
+    GXAttrType ttype;
+    s32 i, j, k;
+    f32 s, t;
+    f32 x, y, z;
+    f32 twopi = 6.2831855f;
+    f32 rt;
+
+    CHECK(rc < 1.0f, "GXDrawTorus: doughnut too fat");
+
+    rt = 1.0f - rc;
+    GXGetVtxDesc(GX_VA_TEX0, &ttype);
+    GetVertState();
+
+    if (ttype != GX_NONE) {
+        GXSetVtxDesc(GX_VA_TEX0, GX_DIRECT);
+        GXSetVtxAttrFmt(GX_VTXFMT3, GX_VA_TEX0, GX_TEX_ST, GX_F32, 0);
+    }
+
+    for (i = 0; i < numc; i++) {
+        GXBegin(GX_TRIANGLESTRIP, GX_VTXFMT3, (numt + 1) * 2);
+        for (j = 0; j <= numt; j++) {
+            for (k = 1; k >= 0; k--) {
+                s = (i + k) % numc;
+                t = j % numt;
+                x = (rt - rc * cosf(s * twopi / numc)) * cosf(t * twopi / numt);
+                y = (rt - rc * cosf(s * twopi / numc)) * sinf(t * twopi / numt);
+                z = rc * sinf(s * twopi / numc);
+                GXPosition3f32(x, y, z);
+                x = -cosf(t * twopi / numt) * cosf(s * twopi / numc);
+                y = -sinf(t * twopi / numt) * cosf(s * twopi / numc);
+                z = sinf(s * twopi / numc);
+                GXNormal3f32(x, y, z);
+                if (ttype != GX_NONE) {
+                    GXTexCoord2f32((i + k) / (f32)numc, j / (f32)numt);
+                }
+            }
+        }
+        GXEnd();
+    }
+    RestoreVertState();
+}
+
+void GXDrawSphere(u8 numMajor, u8 numMinor) {
+    GXAttrType ttype;
+    f32 radius = 1.0f;
+    f32 majorStep = 3.1415927f / numMajor;
+    f32 minorStep = 6.2831855f / numMinor;
+    s32 i, j;
+    f32 a, b;
+    f32 r0, r1;
+    f32 z0, z1;
+    f32 c;
+    f32 x, y;
+
+    GXGetVtxDesc(GX_VA_TEX0, &ttype);
+    GetVertState();
+
+    if (ttype != GX_NONE) {
+        GXSetVtxDesc(GX_VA_TEX0, GX_DIRECT);
+        GXSetVtxAttrFmt(GX_VTXFMT3, GX_VA_TEX0, GX_TEX_ST, GX_RGBA6, 0);
+    }
+
+    for (i = 0; i < numMajor; i++) {
+        a = i * majorStep;
+        b = a + majorStep;
+        r0 = radius * sinf(a);
+        r1 = radius * sinf(b);
+        z0 = radius * cosf(a);
+        z1 = radius * cosf(b);
+        GXBegin(GX_TRIANGLESTRIP, GX_VTXFMT3, (numMinor + 1) * 2);
+        for (j = 0; j <= numMinor; j++) {
+            c = j * minorStep;
+            x = cosf(c);
+            y = sinf(c);
+            GXPosition3f32(x * r1, y * r1, z1);
+            GXNormal3f32((x * r1) / radius, (y * r1) / radius, z1 / radius);
+            if (ttype != GX_NONE) {
+                GXTexCoord2f32((f32)j / (f32)numMinor, (f32)(i + 1) / (f32)numMajor);
+            }
+            GXPosition3f32(x * r0, y * r0, z0);
+            GXNormal3f32((x * r0) / radius, (y * r0) / radius, z0 / radius);
+            if (ttype != GX_NONE) {
+                GXTexCoord2f32((f32)j / (f32)numMinor, (f32)i / (f32)numMajor);
+            }
+        }
+        GXEnd();
+    }
+    RestoreVertState();
+}
+
+static void GXDrawCubeFace(f32 nx, f32 ny, f32 nz, f32 tx, f32 ty, f32 tz, f32 bx, f32 by, f32 bz, GXAttrType binormal, GXAttrType texture) {
+    GXPosition3f32(0.57735026f * (nx + tx + bx), 0.57735026f * (ny + ty + by), 0.57735026f * (nz + tz + bz));
+    GXNormal3f32(nx, ny, nz);
+
+    if (binormal != GX_NONE) {
+        GXNormal3f32(tx, ty, tz);
+        GXNormal3f32(bx, by, bz);
+    }
+
+    if (texture != GX_NONE) {
+        GXTexCoord2s8(1, 1);
+    }
+
+    GXPosition3f32(0.57735026f * (nx - tx + bx), 0.57735026f * (ny - ty + by), 0.57735026f * (nz - tz + bz));
+    GXNormal3f32(nx, ny, nz);
+
+    if (binormal != GX_NONE) {
+        GXNormal3f32(tx, ty, tz);
+        GXNormal3f32(bx, by, bz);
+    }
+
+    if (texture != GX_NONE) {
+        GXTexCoord2s8(0, 1);
+    }
+
+    GXPosition3f32(0.57735026f * (nx - tx - bx), 0.57735026f * (ny - ty - by), 0.57735026f * (nz - tz - bz));
+    GXNormal3f32(nx, ny, nz);
+
+    if (binormal != GX_NONE) {
+        GXNormal3f32(tx, ty, tz);
+        GXNormal3f32(bx, by, bz);
+    }
+
+    if (texture != GX_NONE) {
+        GXTexCoord2s8(0, 0);
+    }
+
+    GXPosition3f32(0.57735026f * (nx + tx - bx), 0.57735026f * (ny + ty - by), 0.57735026f * (nz + tz - bz));
+    GXNormal3f32(nx, ny, nz);
+
+    if (binormal != GX_NONE) {
+        GXNormal3f32(tx, ty, tz);
+        GXNormal3f32(bx, by, bz);
+    }
+
+    if (texture != GX_NONE) {
+        GXTexCoord2s8(1, 0);
+    }
+}
+
+void GXDrawCube(void) {
+    GXAttrType ntype;
+    GXAttrType ttype;
+
+    GXGetVtxDesc(GX_VA_NBT, &ntype);
+    GXGetVtxDesc(GX_VA_TEX0, &ttype);
+    GetVertState();
+    if (ntype != GX_NONE) {
+        GXSetVtxDesc(GX_VA_NBT, GX_DIRECT);
+        GXSetVtxAttrFmt(GX_VTXFMT3, GX_VA_NBT, GX_TEX_ST, GX_RGBA6, 0);
+    }
+    if (ttype != GX_NONE) {
+        GXSetVtxDesc(GX_VA_TEX0, GX_DIRECT);
+        GXSetVtxAttrFmt(GX_VTXFMT3, GX_VA_TEX0, GX_TEX_ST, GX_RGB8, 0);
+    }
+
+    GXBegin(GX_QUADS, GX_VTXFMT3, 24);
+    GXDrawCubeFace(-1.0f, 0.0f, 0.0f, 0.0f, 0.0f, -1.0f, 0.0f, 1.0f, 0.0f, ntype, ttype);
+    GXDrawCubeFace(1.0f, 0.0f, 0.0f, 0.0f, 1.0f, 0.0f, 0.0f, 0.0f, -1.0f, ntype, ttype);
+    GXDrawCubeFace(0.0f, -1.0f, 0.0f, -1.0f, 0.0f, 0.0f, 0.0f, 0.0f, 1.0f, ntype, ttype);
+    GXDrawCubeFace(0.0f, 1.0f, 0.0f, 0.0f, 0.0f, 1.0f, -1.0f, 0.0f, 0.0f, ntype, ttype);
+    GXDrawCubeFace(0.0f, 0.0f, -1.0f, 0.0f, -1.0f, 0.0f, 1.0f, 0.0f, 0.0f, ntype, ttype);
+    GXDrawCubeFace(0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 0.0f, 0.0f, -1.0f, 0.0f, ntype, ttype);
+    GXEnd();
+
+    RestoreVertState();
+}
+
+static u32 polygons[12][5] = {
+    {  0, 12, 10, 11, 16 },
+    {  1, 17,  8,  9, 13 },
+    {  2, 14,  9,  8, 18 },
+    {  3, 19, 11, 10, 15 },
+    {  4, 14,  2,  3, 15 },
+    {  5, 12,  0,  1, 13 },
+    {  6, 17,  1,  0, 16 },
+    {  7, 19,  3,  2, 18 },
+    {  8, 17,  6,  7, 18 },
+    {  9, 14,  4,  5, 13 },
+    { 10, 12,  5,  4, 15 },
+    { 11, 19,  7,  6, 16 },
+};
+
+static f32 verts[20][3] = {
+    { -0.809015f,  0.0f,       0.309015f },
+    { -0.809015f,  0.0f,      -0.309015f },
+    {  0.809015f,  0.0f,      -0.309015f },
+    {  0.809015f,  0.0f,       0.309015f },
+    {  0.309015f, -0.809015f,  0.0f },
+    { -0.309015f, -0.809015f,  0.0f },
+    { -0.309015f,  0.809015f,  0 },
+    {  0.309015f,  0.809015f,  0 },
+    {  0.0f,       0.309015f, -0.809015f },
+    {  0.0f,      -0.309015f, -0.809015f },
+    {  0.0f,      -0.309015f,  0.809015f },
+    {  0.0f,       0.309015f,  0.809015f },
+    { -0.5f,      -0.5f,       0.5 },
+    { -0.5f,      -0.5f,      -0.5 },
+    {  0.5f,      -0.5f,      -0.5 },
+    {  0.5f,      -0.5f,       0.5 },
+    { -0.5f,       0.5f,       0.5 },
+    { -0.5f,       0.5f,      -0.5 },
+    {  0.5f,       0.5f,      -0.5 },
+    {  0.5f,       0.5f,       0.5 },
+};
+
+void GXDrawDodeca(void) {
+    u32 i;
+    f32 *p0;
+    f32 *p1;
+    f32 *p2;
+    f32 u[3];
+    f32 v[3];
+    f32 n[3];
+
+    GetVertState();
+    for (i = 0; i < 12; i++) {
+        p0 = verts[polygons[i][0]];
+        p1 = verts[polygons[i][1]];
+        p2 = verts[polygons[i][2]];
+        vsub(p1, p2, u);
+        vsub(p1, p0, v);
+        vcross(u, v, n);
+        normalize(n);
+        GXBegin(GX_TRIANGLEFAN, GX_VTXFMT3, 5);
+        myvertex(verts[polygons[i][4]], n);
+        myvertex(verts[polygons[i][3]], n);
+        myvertex(p2, n);
+        myvertex(p1, n);
+        myvertex(p0, n);
+        GXEnd();
+    }
+    RestoreVertState();
+}
+
+static f32 odata[6][3] = {
+    {  1.0f,  0.0f,  0.0f },
+    { -1.0f,  0.0f,  0.0f },
+    {  0.0f,  1.0f,  0.0f },
+    {  0.0f, -1.0f,  0.0f },
+    {  0.0f,  0.0f,  1.0f },
+    {  0.0f,  0.0f, -1.0f },
+};
+
+static u8 ondex[8][3] = {
+    { 0, 4, 2 },
+    { 1, 2, 4 },
+    { 0, 3, 4 },
+    { 1, 4, 3 },
+    { 0, 2, 5 },
+    { 1, 5, 2 },
+    { 0, 5, 3 },
+    { 1, 3, 5 },
+};
+
+void GXDrawOctahedron(void) {
+    s32 i;
+
+    GetVertState();
+    for (i = 7; i >= 0; i--) {
+        SubDivTriangle(0, i, odata, ondex);
+    }
+    RestoreVertState();
+}
+
+static f32 idata[12][3] = {
+    { -0.5257311f,  0.0f,        0.8506508f },
+    {  0.5257311f,  0.0f,        0.8506508f },
+    { -0.5257311f,  0.0f,       -0.8506508f },
+    {  0.5257311f,  0.0f,       -0.8506508f },
+    {  0.0f,        0.8506508f,  0.5257311f },
+    {  0.0f,        0.8506508f, -0.5257311f },
+    {  0.0f,       -0.8506508f,  0.5257311f },
+    {  0.0f,       -0.8506508f, -0.5257311f },
+    {  0.8506508f,  0.5257311f,  0.0f },
+    { -0.8506508f,  0.5257311f,  0.0f },
+    {  0.8506508f, -0.5257311f,  0.0f },
+    { -0.8506508f, -0.5257311f,  0.0f },
+};
+
+static u8 uindex[20][3] = {
+    {  0,  4,  1 },
+    {  0,  9,  4 },
+    {  9,  5,  4 },
+    {  4,  5,  8 },
+    {  4,  8,  1 },
+    {  8, 10,  1 },
+    {  8,  3, 10 },
+    {  5,  3,  8 },
+    {  5,  2,  3 },
+    {  2,  7,  3 },
+    {  7, 10,  3 },
+    {  7,  6, 10 },
+    {  7, 11,  6 },
+    { 11,  0,  6 },
+    {  0,  1,  6 },
+    {  6,  1, 10 },
+    {  9,  0, 11 },
+    {  9, 11,  2 },
+    {  9,  2,  5 },
+    {  7,  2, 11 },
+};
+
+void GXDrawIcosahedron(void) {
+    s32 i;
+
+    GetVertState();
+    for (i = 19; i >= 0; i--) {
+        SubDivTriangle(0, i, idata, uindex);
+    }
+    RestoreVertState();
+}
+
+void GXDrawSphere1(u8 depth) {
+    s32 i;
+
+    GetVertState();
+    for (i = 19; i >= 0; i--) {
+        SubDivTriangle(depth, i, idata, uindex);
+    }
+    RestoreVertState();
+}
+
+static u32 CmpNormal32(f32 n1[3], f32 n2[3]) {
+    u32 i;
+
+    for (i = 0; i < 3; i++) {
+        if (n1[i] != n2[i])
+            return FALSE;
+    }
+    return TRUE;
+}
+
+static u32 nrm_cnt;
+static f32* nrm_tab;
+
+static void AddNormal(f32 n[3]) {
+    u32 indx;
+    u32 i;
+
+    for (i = 0; i < nrm_cnt; i++) {
+        if (CmpNormal32(n, &nrm_tab[i * 3]))
+            return;
+    }
+    indx = nrm_cnt * 3;
+    nrm_tab[indx + 0] = n[0];
+    nrm_tab[indx + 1] = n[1];
+    nrm_tab[indx + 2] = n[2];
+    nrm_cnt++;
+}
+
+static void SubdivideNrm(u8 depth, f32 v0[3], f32 v1[3], f32 v2[3]) {
+    f32 v01[3];
+    f32 v12[3];
+    f32 v20[3];
+    u32 i;
+
+    if (depth == 0) {
+        AddNormal(v0);
+        AddNormal(v1);
+        AddNormal(v2);
+        return;
+    }
+
+    for (i = 0; i < 3; i++) {
+        v01[i] = v0[i] + v1[i];
+        v12[i] = v1[i] + v2[i];
+        v20[i] = v2[i] + v0[i];
+    }
+
+    normalize(v01);
+    normalize(v12);
+    normalize(v20);
+    SubdivideNrm(depth - 1, v0, v01, v20);
+    SubdivideNrm(depth - 1, v1, v12, v01);
+    SubdivideNrm(depth - 1, v2, v20, v12);
+    SubdivideNrm(depth - 1, v01, v12, v20);
+}
+
+static void SubDivNrm(u8 depth, u8 i, f32 (*data)[3], u8 (*ndx)[3]) {
+    f32* x0 = data[ndx[i][0]];
+    f32* x1 = data[ndx[i][1]];
+    f32* x2 = data[ndx[i][2]];
+
+    SubdivideNrm(depth, x0, x1, x2);
+}
+
+u32 GXGenNormalTable(u8 depth, f32* table) {
+    s32 i;
+
+    nrm_cnt = 0;
+    nrm_tab = table;
+    for (i = 7; i >= 0; i--) {
+        SubDivNrm(depth, i, odata, ondex);
+    }
+
+    return nrm_cnt;
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXExtra.cpp b/aurora-main/lib/dolphin/gx/GXExtra.cpp
new file mode 100644
index 0000000..32c0a79
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXExtra.cpp
@@ -0,0 +1,27 @@
+#include "gx.hpp"
+#include "__gx.h"
+#include "dolphin/gx/GXAurora.h"
+
+extern "C" {
+void GXDestroyTexObj(GXTexObj* obj_) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  // Destroying a GX texture descriptor must not discard cached texture pixels.
+  obj->texObjId = 0;
+}
+
+void GXDestroyTlutObj(GXTlutObj* obj_) {
+  auto* obj = reinterpret_cast<GXTlutObj_*>(obj_);
+  if (obj->tlutObjId != 0) {
+    GX_WRITE_AURORA(GX_LOAD_AURORA_DESTROY_TLUT);
+    GX_WRITE_U32(obj->tlutObjId);
+  }
+  obj->tlutObjId = 0;
+}
+
+void GXDestroyCopyTex(void* dest) {
+  if (dest != nullptr) {
+    GX_WRITE_AURORA(GX_LOAD_AURORA_DESTROY_COPY_TEX);
+    GX_WRITE_U64(reinterpret_cast<u64>(dest));
+  }
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXFifo.cpp b/aurora-main/lib/dolphin/gx/GXFifo.cpp
new file mode 100644
index 0000000..ab86547
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXFifo.cpp
@@ -0,0 +1,50 @@
+#include "gx.hpp"
+
+extern "C" {
+
+static GXFifoObj* GPFifo;
+static GXFifoObj* CPUFifo;
+
+void GXGetGPStatus(GXBool* overhi, GXBool* underlow, GXBool* readIdle, GXBool* cmdIdle, GXBool* brkpt) {
+  *overhi = *underlow = *readIdle = *cmdIdle = *brkpt = false;
+  *readIdle = true;
+}
+
+// TODO GXGetFifoStatus
+
+void GXGetFifoPtrs(GXFifoObj* fifo, void** readPtr, void** writePtr) {
+  *readPtr = NULL;
+  *writePtr = NULL;
+}
+
+GXFifoObj* GXGetCPUFifo() { return CPUFifo; }
+
+GXFifoObj* GXGetGPFifo() { return GPFifo; }
+
+// TODO GXGetFifoBase
+// TODO GXGetFifoSize
+// TODO GXGetFifoLimits
+// TODO GXSetBreakPtCallback
+// TODO GXEnableBreakPt
+// TODO GXDisableBreakPt
+
+void GXInitFifoBase(GXFifoObj* fifo, void* base, u32 size) {}
+
+void GXInitFifoPtrs(GXFifoObj* fifo, void* readPtr, void* writePtr) {}
+
+// TODO GXInitFifoLimits
+
+void GXSetCPUFifo(GXFifoObj* fifo) { CPUFifo = fifo; }
+
+void GXSetGPFifo(GXFifoObj* fifo) { GPFifo = fifo; }
+
+void GXSaveCPUFifo(GXFifoObj* fifo) {}
+
+// TODO GXSaveGPFifo
+// TODO GXRedirectWriteGatherPipe
+// TODO GXRestoreWriteGatherPipe
+// TODO GXSetCurrentGXThread
+// TODO GXGetCurrentGXThread
+// TODO GXGetOverflowCount
+// TODO GXResetOverflowCount
+}
\ No newline at end of file
diff --git a/aurora-main/lib/dolphin/gx/GXFrameBuffer.cpp b/aurora-main/lib/dolphin/gx/GXFrameBuffer.cpp
new file mode 100644
index 0000000..abd9f6c
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXFrameBuffer.cpp
@@ -0,0 +1,595 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+#include "../../gfx/tex_copy_conv.hpp"
+#include "../../gfx/efb_ram_copy.hpp"
+#include "../../gfx/texture.hpp"
+#include "../../gx/fifo.hpp"
+#include "../../internal.hpp"
+#include "../../window.hpp"
+#include "../../gfx/clear.hpp"
+#include "../../webgpu/gpu.hpp"
+#include "../vi/vi_internal.hpp"
+
+#include <algorithm>
+#include <cmath>
+#include <cstdio>
+#include <cstdlib>
+
+namespace {
+struct CopyClearState {
+  bool clearColor = false;
+  bool clearAlpha = false;
+  bool clearDepth = false;
+  aurora::Vec4<float> clearColorValue{0.f, 0.f, 0.f, 1.f};
+};
+
+CopyClearState get_copy_clear_state(GXBool clear) {
+  if (!clear) {
+    return {};
+  }
+
+  CopyClearState state{
+      .clearColor = g_gxState.colorUpdate,
+      .clearAlpha = g_gxState.alphaUpdate,
+      .clearDepth = g_gxState.depthUpdate,
+      .clearColorValue = g_gxState.clearColor,
+  };
+
+  if (!aurora::gx::render_target_has_alpha(g_gxState.pixelFmt)) {
+    // RGB and depth EFB formats do not have an alpha channel to clear.
+    state.clearAlpha = false;
+  }
+
+  return state;
+}
+
+struct CopySourceRect {
+  aurora::gfx::ClipRect clearRect;
+  aurora::Vec4<float> sampleRect;
+};
+
+CopySourceRect map_texture_copy_source(const aurora::gfx::ClipRect& source, bool renderSpace) {
+  if (renderSpace || g_gxState.viewportPolicy == AURORA_VIEWPORT_NATIVE) {
+    return {
+        .clearRect = source,
+        .sampleRect = {static_cast<float>(source.x), static_cast<float>(source.y), static_cast<float>(source.width),
+                       static_cast<float>(source.height)},
+    };
+  }
+
+  const auto [logicalWidth, logicalHeight] = aurora::gx::logical_fb_size();
+  const auto [targetWidth, targetHeight] = aurora::gfx::get_render_target_size();
+  if (logicalWidth == 0 || logicalHeight == 0 || targetWidth == 0 || targetHeight == 0) {
+    return {
+        .clearRect = source,
+        .sampleRect = {static_cast<float>(source.x), static_cast<float>(source.y), static_cast<float>(source.width),
+                       static_cast<float>(source.height)},
+    };
+  }
+
+  struct MappedEdge {
+    float sample;
+    int32_t nearest;
+  };
+  const auto mapEdge = [](int32_t edge, uint32_t logicalSize, uint32_t targetSize) {
+    // Round scaled copy edges consistently to avoid seams and off-by-one pixels.
+    const int64_t numerator = static_cast<int64_t>(edge) * static_cast<int64_t>(targetSize);
+    const int64_t denominator = static_cast<int64_t>(logicalSize);
+    const int64_t quotient = numerator / denominator;
+    const int64_t remainder = numerator % denominator;
+    const int64_t remainderMagnitude = remainder < 0 ? -remainder : remainder;
+    const int64_t roundingThreshold = (denominator + 1) / 2;
+    const int64_t nearestValue =
+        quotient + (remainderMagnitude >= roundingThreshold ? (numerator < 0 ? -1 : 1) : 0);
+    return MappedEdge{
+        .sample = static_cast<float>(static_cast<double>(numerator) / static_cast<double>(denominator)),
+        .nearest = static_cast<int32_t>(nearestValue),
+    };
+  };
+  const auto left = mapEdge(source.x, logicalWidth, targetWidth);
+  const auto top = mapEdge(source.y, logicalHeight, targetHeight);
+  const auto right = mapEdge(source.x + source.width, logicalWidth, targetWidth);
+  const auto bottom = mapEdge(source.y + source.height, logicalHeight, targetHeight);
+  return {
+      .clearRect =
+          {
+              .x = left.nearest,
+              .y = top.nearest,
+              .width = std::max<int32_t>(right.nearest - left.nearest, 1),
+              .height = std::max<int32_t>(bottom.nearest - top.nearest, 1),
+          },
+      .sampleRect = {left.sample, top.sample, right.sample - left.sample, bottom.sample - top.sample},
+  };
+}
+
+
+
+
+
+u32 pack_copy_filter_samples(u8 reg, const std::array<std::array<u8, 2>, 12>& samplePattern, size_t first) {
+  u32 value = static_cast<u32>(reg) << 24;
+  for (size_t i = 0; i < 6; ++i) {
+    const size_t sample = first + i;
+    const u8 component = samplePattern[sample / 2][sample % 2] & 0x0fu;
+    value |= static_cast<u32>(component) << (i * 4);
+  }
+  return value;
+}
+
+u32 pack_copy_filter0(const std::array<u8, 7>& vfilter) {
+  return 0x53000000u | (static_cast<u32>(vfilter[0] & 0x3fu) << 0) |
+         (static_cast<u32>(vfilter[1] & 0x3fu) << 6) | (static_cast<u32>(vfilter[2] & 0x3fu) << 12) |
+         (static_cast<u32>(vfilter[3] & 0x3fu) << 18);
+}
+
+u32 pack_copy_filter1(const std::array<u8, 7>& vfilter) {
+  return 0x54000000u | (static_cast<u32>(vfilter[4] & 0x3fu) << 0) |
+         (static_cast<u32>(vfilter[5] & 0x3fu) << 6) | (static_cast<u32>(vfilter[6] & 0x3fu) << 12);
+}
+
+std::array<u32, 3> combined_copy_filter_coefficients(const std::array<u8, 7>& vfilter) {
+  if (!g_gxState.copyFilterVf) {
+    return {0, 64, 0};
+  }
+
+  return {
+      static_cast<u32>(vfilter[0]) + static_cast<u32>(vfilter[1]),
+      static_cast<u32>(vfilter[2]) + static_cast<u32>(vfilter[3]) + static_cast<u32>(vfilter[4]),
+      static_cast<u32>(vfilter[5]) + static_cast<u32>(vfilter[6]),
+  };
+}
+
+aurora::Vec2<uint32_t> scale_copy_dst(u32 logicalWidth, u32 logicalHeight) {
+  if (g_gxState.viewportPolicy == AURORA_VIEWPORT_NATIVE) {
+    return {logicalWidth, logicalHeight};
+  }
+
+  const auto [logicalFbWidth, logicalFbHeight] = aurora::gx::logical_fb_size();
+  const auto [targetWidth, targetHeight] = aurora::gfx::get_render_target_size();
+  if (logicalFbWidth == 0 || logicalFbHeight == 0 || targetWidth == 0 || targetHeight == 0) {
+    return {logicalWidth, logicalHeight};
+  }
+
+  const float scaleX = static_cast<float>(targetWidth) / static_cast<float>(logicalFbWidth);
+  const float scaleY = static_cast<float>(targetHeight) / static_cast<float>(logicalFbHeight);
+  const auto scaledWidth = std::max<u32>(static_cast<u32>(std::lround(static_cast<float>(logicalWidth) * scaleX)), 1);
+  const auto scaledHeight = std::max<u32>(static_cast<u32>(std::lround(static_cast<float>(logicalHeight) * scaleY)), 1);
+  return {scaledWidth, scaledHeight};
+}
+
+aurora::gfx::TextureHandle create_copy_texture(u32 width, u32 height, GXTexFmt texCopyFmt) {
+  if (aurora::gfx::tex_copy_conv::needs_conversion(texCopyFmt)) {
+    return aurora::gfx::new_conv_texture(width, height, texCopyFmt, "Copy Conv Texture");
+  }
+
+  const auto fmt = texCopyFmt == GX_TF_RGB565 ? GX_TF_RGB565 : GX_TF_RGBA8;
+  return aurora::gfx::new_render_texture(width, height, fmt, "Resolved Texture");
+}
+
+  // Reuse retired copy targets to avoid unbounded GPU texture allocation.
+struct CopyTexturePoolEntry {
+  aurora::gx::GXState::CopyTextureKey key;
+  u32 scaledWidth = 0;
+  u32 scaledHeight = 0;
+  aurora::gfx::TextureHandle handle;
+};
+std::vector<CopyTexturePoolEntry> g_copyTexturePool;
+  // Keep only a few reusable copy targets per destination.
+constexpr size_t kCopyTexturePoolPerKey = 3;
+
+aurora::gfx::TextureHandle acquire_copy_texture(const aurora::gx::GXState::CopyTextureKey& key, u32 width, u32 height,
+                                                GXTexFmt texCopyFmt) {
+  size_t sameKey = 0;
+  for (auto it = g_copyTexturePool.begin(); it != g_copyTexturePool.end();) {
+    if (!(it->key == key)) {
+      ++it;
+      continue;
+    }
+    // Discard retired targets when their internal resolution changes.
+    if ((it->scaledWidth != width || it->scaledHeight != height) && it->handle.use_count() <= 1) {
+      it = g_copyTexturePool.erase(it);
+      continue;
+    }
+    ++sameKey;
+    if (it->scaledWidth == width && it->scaledHeight == height && it->handle.use_count() == 1) {
+      return it->handle;
+    }
+    ++it;
+  }
+
+  auto handle = create_copy_texture(width, height, texCopyFmt);
+  if (sameKey < kCopyTexturePoolPerKey) {
+    g_copyTexturePool.push_back({key, width, height, handle});
+  }
+  return handle;
+}
+
+u16 get_num_xfb_lines_internal(u16 efbHeight, u32 iScale) {
+  CHECK(efbHeight != 0, "GXGetNumXfbLines requires non-zero EFB height");
+  CHECK(iScale != 0, "invalid XFB line scale");
+
+  const u32 count = static_cast<u32>(efbHeight - 1u) * 0x100u;
+  u32 realHeight = (count / iScale) + 1u;
+
+  u32 reducedScale = iScale;
+  if (reducedScale > 0x80u && reducedScale < 0x100u) {
+    while ((reducedScale & 1u) == 0u) {
+      reducedScale >>= 1;
+    }
+    if (reducedScale != 0u && (efbHeight % reducedScale) == 0u) {
+      ++realHeight;
+    }
+  }
+
+  return static_cast<u16>(std::min<u32>(realHeight, 0x400u));
+}
+
+u32 y_scale_to_integer(f32 yScale) {
+  CHECK(yScale > 0.f, "GX display copy y-scale must be positive");
+  return static_cast<u32>(256.f / yScale) & 0x1ffu;
+}
+
+} // namespace
+
+namespace aurora::gx {
+void prune_copy_texture_pool(const void* dest) noexcept {
+  if (dest == nullptr) {
+    g_copyTexturePool.clear();
+    return;
+  }
+  std::erase_if(g_copyTexturePool, [dest](const CopyTexturePoolEntry& entry) { return entry.key.dest == dest; });
+}
+} // namespace aurora::gx
+
+extern "C" {
+GXRenderModeObj GXNtsc480IntDf = {
+    VI_TVMODE_NTSC_INT,
+    640,
+    480,
+    480,
+    40,
+    0,
+    640,
+    480,
+    VI_XFBMODE_DF,
+    0,
+    0,
+    {6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6},
+    {8, 8, 10, 12, 10, 8, 8},
+};
+GXRenderModeObj GXNtsc480Int = {
+    VI_TVMODE_NTSC_INT,
+    640,
+    480,
+    480,
+    40,
+    0,
+    640,
+    480,
+    VI_XFBMODE_DF,
+    0,
+    0,
+    {6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6},
+    {0, 0, 21, 22, 21, 0, 0},
+};
+GXRenderModeObj GXPal528IntDf = {
+    VI_TVMODE_PAL_INT,
+    704,
+    528,
+    480,
+    40,
+    0,
+    640,
+    480,
+    VI_XFBMODE_DF,
+    0,
+    0,
+    {6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6},
+    {8, 8, 10, 12, 10, 8, 8},
+};
+GXRenderModeObj GXMpal480IntDf = {
+    VI_TVMODE_PAL_INT,
+    640,
+    480,
+    480,
+    40,
+    0,
+    640,
+    480,
+    VI_XFBMODE_DF,
+    0,
+    0,
+    {6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6},
+    {8, 8, 10, 12, 10, 8, 8},
+};
+
+void GXAdjustForOverscan(GXRenderModeObj* rmin, GXRenderModeObj* rmout, u16 hor, u16 ver) {
+  *rmout = *rmin;
+  const auto renderSize = aurora::gfx::get_render_target_size();
+  rmout->fbWidth = static_cast<u16>(std::min<uint32_t>(renderSize.x, UINT16_MAX));
+  rmout->efbHeight = static_cast<u16>(std::min<uint32_t>(renderSize.y, UINT16_MAX));
+  rmout->xfbHeight = static_cast<u16>(std::min<uint32_t>(renderSize.y, UINT16_MAX));
+}
+
+void GXSetDispCopySrc(u16 left, u16 top, u16 wd, u16 ht) {
+  g_gxState.dispCopySrc = {left, top, wd, ht};
+  GX_WRITE_RAS_REG(0x49000000u | ((static_cast<u32>(top) & 0x3ffu) << 10) | (static_cast<u32>(left) & 0x3ffu));
+  GX_WRITE_RAS_REG(0x4a000000u | (((static_cast<u32>(ht) - 1u) * 0x400u) & 0x000ffc00u) |
+                   ((static_cast<u32>(wd) - 1u) & 0x3ffu));
+}
+
+void GXSetTexCopySrc(u16 left, u16 top, u16 wd, u16 ht) {
+  g_gxState.texCopySrc = {left, top, wd, ht};
+  g_gxState.texCopySrcRenderSpace = false;
+}
+
+void GXSetDispCopyDst(u16 wd, u16 ht) {
+  g_gxState.dispCopyDstWidth = wd;
+  g_gxState.dispCopyDstHeight = ht;
+  GX_WRITE_RAS_REG(0x4d000000u | ((((static_cast<u32>(wd) & 0x7fffu) << 1) >> 5) & 0x3ffu));
+}
+
+void GXSetTexCopyDst(u16 wd, u16 ht, GXTexFmt fmt, GXBool mipmap) {
+  g_gxState.texCopyFmt = fmt;
+  g_gxState.texCopyDstWidth = wd;
+  g_gxState.texCopyDstHeight = ht;
+  g_gxState.texCopyHalfScale = mipmap != GX_FALSE;
+}
+
+void GXSetDispCopyFrame2Field(u32 mode) {
+  g_gxState.dispCopyFrame2Field = mode & 3;
+}
+
+void GXSetCopyClamp(GXFBClamp clamp) {
+  g_gxState.copyClamp = static_cast<GXFBClamp>(static_cast<u32>(clamp) & 3);
+}
+
+u32 GXSetDispCopyYScale(f32 vscale) {
+  const u32 iScale = y_scale_to_integer(vscale);
+  g_gxState.dispCopyYScale = vscale;
+  GX_WRITE_RAS_REG(0x4e000000u | iScale);
+  __gx->bpSent = 0;
+  return get_num_xfb_lines_internal(static_cast<u16>(g_gxState.dispCopySrc.height), iScale);
+}
+
+void GXSetCopyClear(GXColor color, u32 depth) {
+  // BP 0x4F: clear color R + A
+  u32 reg0 = 0;
+  SET_REG_FIELD(0, reg0, 8, 0, color.r);
+  SET_REG_FIELD(0, reg0, 8, 8, color.a);
+  SET_REG_FIELD(0, reg0, 8, 24, 0x4F);
+  GX_WRITE_RAS_REG(reg0);
+
+  // BP 0x50: clear color B + G
+  u32 reg1 = 0;
+  SET_REG_FIELD(0, reg1, 8, 0, color.b);
+  SET_REG_FIELD(0, reg1, 8, 8, color.g);
+  SET_REG_FIELD(0, reg1, 8, 24, 0x50);
+  GX_WRITE_RAS_REG(reg1);
+
+  // BP 0x51: clear Z (24-bit)
+  u32 reg2 = 0;
+  SET_REG_FIELD(0, reg2, 24, 0, depth);
+  SET_REG_FIELD(0, reg2, 8, 24, 0x51);
+  GX_WRITE_RAS_REG(reg2);
+  __gx->bpSent = 1;
+}
+
+void GXSetCopyFilter(GXBool aa, u8 sample_pattern[12][2], GXBool vf, u8 vfilter[7]) {
+  g_gxState.copyFilterAa = aa;
+  g_gxState.copyFilterVf = vf;
+  if (sample_pattern) {
+    for (size_t i = 0; i < g_gxState.copyFilterSamplePattern.size(); ++i) {
+      g_gxState.copyFilterSamplePattern[i][0] = sample_pattern[i][0];
+      g_gxState.copyFilterSamplePattern[i][1] = sample_pattern[i][1];
+    }
+  }
+  if (vfilter) {
+    for (size_t i = 0; i < g_gxState.copyFilterVFilter.size(); ++i) {
+      g_gxState.copyFilterVFilter[i] = vfilter[i];
+    }
+  }
+
+  if (!aa) {
+    for (auto& sample : g_gxState.copyFilterSamplePattern) {
+      sample = {6, 6};
+    }
+  }
+  if (!vf) {
+    g_gxState.copyFilterVFilter = {0, 0, 21, 22, 21, 0, 0};
+  }
+
+  GX_WRITE_RAS_REG(pack_copy_filter_samples(0x01, g_gxState.copyFilterSamplePattern, 0));
+  GX_WRITE_RAS_REG(pack_copy_filter_samples(0x02, g_gxState.copyFilterSamplePattern, 6));
+  GX_WRITE_RAS_REG(pack_copy_filter_samples(0x03, g_gxState.copyFilterSamplePattern, 12));
+  GX_WRITE_RAS_REG(pack_copy_filter_samples(0x04, g_gxState.copyFilterSamplePattern, 18));
+  GX_WRITE_RAS_REG(pack_copy_filter0(g_gxState.copyFilterVFilter));
+  GX_WRITE_RAS_REG(pack_copy_filter1(g_gxState.copyFilterVFilter));
+  __gx->bpSent = 0;
+}
+
+void GXSetDispCopyGamma(GXGamma gamma) {
+  g_gxState.dispCopyGamma = static_cast<GXGamma>(static_cast<u32>(gamma) & 3u);
+  g_gxState.bpRegCache[0x52] = (g_gxState.bpRegCache[0x52] & ~(3u << 7)) |
+                               ((static_cast<u32>(g_gxState.dispCopyGamma) & 3u) << 7);
+}
+
+void GXCopyDisp(void* dest, GXBool clear) {
+  (void)dest;
+  // Finish queued commands before this copy reads live EFB state.
+  if (aurora::gx::fifo::get_buffer_size() != 0) {
+    aurora::gx::fifo::drain();
+  }
+  const auto rect = aurora::gx::map_logical_scissor(g_gxState.dispCopySrc);
+  const auto logicalDstWidth =
+      std::max<u32>(g_gxState.dispCopyDstWidth != 0 ? g_gxState.dispCopyDstWidth : static_cast<u32>(g_gxState.dispCopySrc.width), 1);
+  const auto logicalDstHeight =
+      std::max<u32>(g_gxState.dispCopyDstHeight != 0 ? g_gxState.dispCopyDstHeight : static_cast<u32>(g_gxState.dispCopySrc.height), 1);
+  const auto [dstWidth, dstHeight] = scale_copy_dst(logicalDstWidth, logicalDstHeight);
+
+  if (!g_gxState.displayCopyTexture || g_gxState.displayCopyWidth != dstWidth ||
+      g_gxState.displayCopyHeight != dstHeight) {
+    g_gxState.displayCopyTexture = aurora::gfx::new_render_texture(dstWidth, dstHeight, GX_TF_RGBA8, "Display Copy");
+    g_gxState.displayCopyWidth = dstWidth;
+    g_gxState.displayCopyHeight = dstHeight;
+  }
+
+  const auto clearState = get_copy_clear_state(clear);
+  auto copyFilter = combined_copy_filter_coefficients(g_gxState.copyFilterVFilter);
+  if (aurora::g_config.disableCopyFilter) {
+    copyFilter = {0, copyFilter[0] + copyFilter[1] + copyFilter[2], 0};
+  }
+  aurora::gfx::resolve_pass(g_gxState.displayCopyTexture, rect, clearState.clearColor, clearState.clearAlpha,
+                            clearState.clearDepth, clearState.clearColorValue, aurora::gx::clear_depth_value(),
+                            GX_TF_RGBA8, nullptr, false, &copyFilter, false,
+                            static_cast<float>(rect.height) / std::max<float>(g_gxState.dispCopySrc.height, 1.0f),
+                            (g_gxState.copyClamp & GX_CLAMP_TOP) != 0,
+                            (g_gxState.copyClamp & GX_CLAMP_BOTTOM) != 0);
+  aurora::gx::set_display_copy_present_source();
+}
+
+void GXCopyTex(void* dest, GXBool clear) {
+  // Texture copies must see all earlier draws and state changes.
+  if (aurora::gx::fifo::get_buffer_size() != 0) {
+    aurora::gx::fifo::drain();
+  }
+  const auto sourceRect = map_texture_copy_source(g_gxState.texCopySrc, g_gxState.texCopySrcRenderSpace);
+  const auto rect = sourceRect.clearRect;
+  // Keep guest dimensions for cache identity while preserving scaled GPU detail.
+  const auto logicalDstWidth = std::max<u32>(g_gxState.texCopyDstWidth, 1);
+  const auto logicalDstHeight = std::max<u32>(g_gxState.texCopyDstHeight, 1);
+  const auto [scaledDstWidth, scaledDstHeight] = scale_copy_dst(logicalDstWidth, logicalDstHeight);
+  const auto texCopyFmt = g_gxState.texCopyFmt;
+  const bool sourceHasAlpha = aurora::gx::render_target_has_alpha(g_gxState.pixelFmt);
+  const bool forceOpaqueAlpha = !sourceHasAlpha && !aurora::gx::is_depth_format(texCopyFmt);
+  const auto resolveFmt = texCopyFmt;
+
+  const aurora::gx::GXState::CopyTextureKey key{
+      .dest = dest,
+      .width = logicalDstWidth,
+      .height = logicalDstHeight,
+      .format = texCopyFmt,
+  };
+  // Keep one live copy per destination and retire stale GPU textures.
+  for (auto cacheIt = g_gxState.copyTextureCache.begin(); cacheIt != g_gxState.copyTextureCache.end();) {
+    if (cacheIt->first.dest == dest && !(cacheIt->first == key)) {
+      g_gxState.copyTextureCache.erase(cacheIt++);
+    } else {
+      ++cacheIt;
+    }
+  }
+  auto it = g_gxState.copyTextureCache.find(key);
+  if (it == g_gxState.copyTextureCache.end()) {
+    auto handle = acquire_copy_texture(key, scaledDstWidth, scaledDstHeight, texCopyFmt);
+    it = g_gxState.copyTextureCache.emplace(key, aurora::gx::GXState::CopyTextureRef{.handle = handle, .revision = 0}).first;
+  }
+  auto& handle = it->second;
+  const u32 currentFrame = aurora::gfx::current_frame();
+  const bool sampledThisFrame = handle.sampledThisFrame && handle.lastSampledFrame == currentFrame;
+  const bool scaledSizeChanged = !handle.handle || handle.handle->size.width != scaledDstWidth ||
+                                 handle.handle->size.height != scaledDstHeight;
+  auto clearState = get_copy_clear_state(clear);
+  if (sampledThisFrame || scaledSizeChanged) {
+    const u32 revision = handle.revision;
+    const u32 lastProducedFrame = handle.lastProducedFrame;
+    handle = aurora::gx::GXState::CopyTextureRef{
+        .handle = acquire_copy_texture(key, scaledDstWidth, scaledDstHeight, texCopyFmt),
+        .revision = revision,
+        .lastProducedFrame = lastProducedFrame,
+    };
+  }
+
+  const bool alphaUpdate = g_gxState.alphaUpdate && aurora::gx::render_target_has_alpha(g_gxState.pixelFmt);
+  if (alphaUpdate && g_gxState.dstAlpha != UINT32_MAX) {
+    if (!clear) {
+      // TODO: Confirm how this copy should handle alpha without changing the EFB.
+    }
+    // Clear alpha with a pipeline that matches the pass sample count.
+    aurora::gfx::push_draw_command(aurora::gfx::clear::DrawData{
+        .pipeline = aurora::gfx::pipeline_ref(aurora::gfx::clear::PipelineConfig{
+            .msaaSamples = aurora::gfx::get_sample_count(),
+            .clearColor = false,
+            .clearAlpha = true,
+            .clearDepth = false,
+        }),
+        .color = wgpu::Color{0.f, 0.f, 0.f, g_gxState.dstAlpha / 255.f},
+    });
+  }
+  if (aurora::gx::render_target_has_alpha(g_gxState.pixelFmt)) {
+    clearState.clearAlpha = clear && alphaUpdate;
+  }
+  const auto copyFilter = combined_copy_filter_coefficients(g_gxState.copyFilterVFilter);
+  // Skip only recurring color copies so one-shot copies are never lost.
+  const bool producedConsecutively = handle.revision != 0 && currentFrame - handle.lastProducedFrame <= 1;
+  const bool persistentCopy = !aurora::gx::is_depth_format(texCopyFmt) && !producedConsecutively;
+  aurora::gfx::resolve_pass(handle.handle, rect, clearState.clearColor, clearState.clearAlpha, clearState.clearDepth,
+                            clearState.clearColorValue, aurora::gx::clear_depth_value(), resolveFmt,
+                            &sourceRect.sampleRect, g_gxState.texCopyHalfScale, &copyFilter, forceOpaqueAlpha,
+                            sourceRect.sampleRect.w() / std::max<float>(g_gxState.texCopySrc.height, 1.0f),
+                            (g_gxState.copyClamp & GX_CLAMP_TOP) != 0,
+                            (g_gxState.copyClamp & GX_CLAMP_BOTTOM) != 0, persistentCopy);
+  ++handle.revision;
+  handle.lastProducedFrame = currentFrame;
+  handle.width = logicalDstWidth;
+  handle.height = logicalDstHeight;
+  handle.format = texCopyFmt;
+  handle.dataSize = GXGetTexBufferSize(static_cast<u16>(logicalDstWidth), static_cast<u16>(logicalDstHeight), texCopyFmt, GX_FALSE, 0);
+  aurora::gx::notify_copy_texture_created();
+  g_gxState.copyTextures[dest] = handle;
+  // Keep the GPU copy and download it only if guest code reads the destination.
+  aurora::gfx::efb_ram::schedule(dest, logicalDstWidth, logicalDstHeight, texCopyFmt, handle.handle);
+}
+
+void GXClearBoundingBox() {
+  g_gxState.boundingBox = {1023, 0, 1023, 0};
+  GX_WRITE_RAS_REG(0x550003FFu);
+  GX_WRITE_RAS_REG(0x560003FFu);
+  __gx->bpSent = 0;
+}
+
+void GXReadBoundingBox(u16* left, u16* right, u16* top, u16* bottom) {
+  if (left) {
+    *left = g_gxState.boundingBox[0];
+  }
+  if (right) {
+    *right = g_gxState.boundingBox[1];
+  }
+  if (top) {
+    *top = g_gxState.boundingBox[2];
+  }
+  if (bottom) {
+    *bottom = g_gxState.boundingBox[3];
+  }
+}
+
+u16 GXGetNumXfbLines(u16 efbHeight, f32 yScale) {
+  return get_num_xfb_lines_internal(efbHeight, y_scale_to_integer(yScale));
+}
+
+f32 GXGetYScaleFactor(u16 efbHeight, u16 xfbHeight) {
+  CHECK(efbHeight != 0, "GXGetYScaleFactor requires non-zero EFB height");
+  CHECK(xfbHeight != 0 && xfbHeight <= 1024, "GXGetYScaleFactor requires 1..1024 XFB lines");
+
+  u32 targetHeight = xfbHeight;
+  f32 yScale = static_cast<f32>(targetHeight) / static_cast<f32>(efbHeight);
+  u16 realHeight = GXGetNumXfbLines(efbHeight, yScale);
+
+  while (realHeight > xfbHeight && targetHeight > 1) {
+    --targetHeight;
+    yScale = static_cast<f32>(targetHeight) / static_cast<f32>(efbHeight);
+    realHeight = GXGetNumXfbLines(efbHeight, yScale);
+  }
+
+  f32 resultScale = yScale;
+  while (realHeight < xfbHeight && targetHeight < 1024) {
+    resultScale = yScale;
+    ++targetHeight;
+    yScale = static_cast<f32>(targetHeight) / static_cast<f32>(efbHeight);
+    realHeight = GXGetNumXfbLines(efbHeight, yScale);
+  }
+
+  return resultScale;
+}
+
+}
diff --git a/aurora-main/lib/dolphin/gx/GXGeometry.cpp b/aurora-main/lib/dolphin/gx/GXGeometry.cpp
new file mode 100644
index 0000000..2e54e10
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXGeometry.cpp
@@ -0,0 +1,455 @@
+#include "gx.hpp"
+#include "__gx.h"
+#include "dolphin/gd/GDGeometry.h"
+#include "../../gx/fifo.hpp"
+
+static inline void SETVCDATTR(GXAttr attr, GXAttrType type) {
+  switch (attr) {
+  case GX_VA_PNMTXIDX:
+    SET_REG_FIELD(0, __gx->vcdLo, 1, 0, type);
+    break;
+  case GX_VA_TEX0MTXIDX:
+    SET_REG_FIELD(0, __gx->vcdLo, 1, 1, type);
+    break;
+  case GX_VA_TEX1MTXIDX:
+    SET_REG_FIELD(0, __gx->vcdLo, 1, 2, type);
+    break;
+  case GX_VA_TEX2MTXIDX:
+    SET_REG_FIELD(0, __gx->vcdLo, 1, 3, type);
+    break;
+  case GX_VA_TEX3MTXIDX:
+    SET_REG_FIELD(0, __gx->vcdLo, 1, 4, type);
+    break;
+  case GX_VA_TEX4MTXIDX:
+    SET_REG_FIELD(0, __gx->vcdLo, 1, 5, type);
+    break;
+  case GX_VA_TEX5MTXIDX:
+    SET_REG_FIELD(0, __gx->vcdLo, 1, 6, type);
+    break;
+  case GX_VA_TEX6MTXIDX:
+    SET_REG_FIELD(0, __gx->vcdLo, 1, 7, type);
+    break;
+  case GX_VA_TEX7MTXIDX:
+    SET_REG_FIELD(0, __gx->vcdLo, 1, 8, type);
+    break;
+  case GX_VA_POS:
+    SET_REG_FIELD(0, __gx->vcdLo, 2, 9, type);
+    break;
+  case GX_VA_NRM:
+    __gx->hasNrms = (type != 0);
+    if (type != GX_NONE) {
+      __gx->nrmType = type;
+    }
+    break;
+  case GX_VA_NBT:
+    __gx->hasBiNrms = (type != 0);
+    if (type != GX_NONE) {
+      __gx->nrmType = type;
+    }
+    break;
+  case GX_VA_CLR0:
+    SET_REG_FIELD(0, __gx->vcdLo, 2, 13, type);
+    break;
+  case GX_VA_CLR1:
+    SET_REG_FIELD(0, __gx->vcdLo, 2, 15, type);
+    break;
+  case GX_VA_TEX0:
+    SET_REG_FIELD(0, __gx->vcdHi, 2, 0, type);
+    break;
+  case GX_VA_TEX1:
+    SET_REG_FIELD(0, __gx->vcdHi, 2, 2, type);
+    break;
+  case GX_VA_TEX2:
+    SET_REG_FIELD(0, __gx->vcdHi, 2, 4, type);
+    break;
+  case GX_VA_TEX3:
+    SET_REG_FIELD(0, __gx->vcdHi, 2, 6, type);
+    break;
+  case GX_VA_TEX4:
+    SET_REG_FIELD(0, __gx->vcdHi, 2, 8, type);
+    break;
+  case GX_VA_TEX5:
+    SET_REG_FIELD(0, __gx->vcdHi, 2, 10, type);
+    break;
+  case GX_VA_TEX6:
+    SET_REG_FIELD(0, __gx->vcdHi, 2, 12, type);
+    break;
+  case GX_VA_TEX7:
+    SET_REG_FIELD(0, __gx->vcdHi, 2, 14, type);
+    break;
+  default:
+    break;
+  }
+}
+
+static inline void SETVAT(u32* va, u32* vb, u32* vc, GXAttr attr, GXCompCnt cnt, GXCompType type, u8 frac) {
+  switch (attr) {
+  case GX_VA_POS:
+    SET_REG_FIELD(0, *va, 1, 0, cnt);
+    SET_REG_FIELD(0, *va, 3, 1, type);
+    SET_REG_FIELD(0, *va, 5, 4, frac);
+    break;
+  case GX_VA_NRM:
+  case GX_VA_NBT:
+    SET_REG_FIELD(0, *va, 3, 10, type);
+    if (cnt == GX_NRM_NBT3) {
+      SET_REG_FIELD(0, *va, 1, 9, 1);
+      SET_REG_FIELD(0, *va, 1, 31, 1);
+    } else {
+      SET_REG_FIELD(0, *va, 1, 9, cnt);
+      SET_REG_FIELD(0, *va, 1, 31, 0);
+    }
+    break;
+  case GX_VA_CLR0:
+    SET_REG_FIELD(0, *va, 1, 13, cnt);
+    SET_REG_FIELD(0, *va, 3, 14, type);
+    break;
+  case GX_VA_CLR1:
+    SET_REG_FIELD(0, *va, 1, 17, cnt);
+    SET_REG_FIELD(0, *va, 3, 18, type);
+    break;
+  case GX_VA_TEX0:
+    SET_REG_FIELD(0, *va, 1, 21, cnt);
+    SET_REG_FIELD(0, *va, 3, 22, type);
+    SET_REG_FIELD(0, *va, 5, 25, frac);
+    break;
+  case GX_VA_TEX1:
+    SET_REG_FIELD(0, *vb, 1, 0, cnt);
+    SET_REG_FIELD(0, *vb, 3, 1, type);
+    SET_REG_FIELD(0, *vb, 5, 4, frac);
+    break;
+  case GX_VA_TEX2:
+    SET_REG_FIELD(0, *vb, 1, 9, cnt);
+    SET_REG_FIELD(0, *vb, 3, 10, type);
+    SET_REG_FIELD(0, *vb, 5, 13, frac);
+    break;
+  case GX_VA_TEX3:
+    SET_REG_FIELD(0, *vb, 1, 18, cnt);
+    SET_REG_FIELD(0, *vb, 3, 19, type);
+    SET_REG_FIELD(0, *vb, 5, 22, frac);
+    break;
+  case GX_VA_TEX4:
+    SET_REG_FIELD(0, *vb, 1, 27, cnt);
+    SET_REG_FIELD(0, *vb, 3, 28, type);
+    SET_REG_FIELD(0, *vc, 5, 0, frac);
+    break;
+  case GX_VA_TEX5:
+    SET_REG_FIELD(0, *vc, 1, 5, cnt);
+    SET_REG_FIELD(0, *vc, 3, 6, type);
+    SET_REG_FIELD(0, *vc, 5, 9, frac);
+    break;
+  case GX_VA_TEX6:
+    SET_REG_FIELD(0, *vc, 1, 14, cnt);
+    SET_REG_FIELD(0, *vc, 3, 15, type);
+    SET_REG_FIELD(0, *vc, 5, 18, frac);
+    break;
+  case GX_VA_TEX7:
+    SET_REG_FIELD(0, *vc, 1, 23, cnt);
+    SET_REG_FIELD(0, *vc, 3, 24, type);
+    SET_REG_FIELD(0, *vc, 5, 27, frac);
+    break;
+  default:
+    break;
+  }
+}
+
+static inline bool AuroraVtxDescDiffers(GXAttr attr, GXAttrType type) {
+  return attr >= GX_VA_PNMTXIDX && attr < GX_VA_MAX_ATTR && g_gxState.vtxDesc[attr] != type;
+}
+
+static inline bool AuroraVtxAttrFmtDiffers(GXVtxFmt vtxfmt, GXAttr attr, GXCompCnt cnt, GXCompType type, u8 frac) {
+  if (vtxfmt < GX_VTXFMT0 || vtxfmt >= GX_MAX_VTXFMT || attr < GX_VA_POS || attr >= GX_VA_MAX_ATTR) {
+    return true;
+  }
+  const auto& fmt = g_gxState.vtxFmts[vtxfmt].attrs[attr];
+  return fmt.cnt != cnt || fmt.type != type || fmt.frac != frac;
+}
+
+extern "C" {
+
+void GXSetVtxDesc(GXAttr attr, GXAttrType type) {
+  const u32 oldVcdLo = __gx->vcdLo;
+  const u32 oldVcdHi = __gx->vcdHi;
+  const u8 oldHasNrms = __gx->hasNrms;
+  const u8 oldHasBiNrms = __gx->hasBiNrms;
+  const u32 oldNrmType = __gx->nrmType;
+  const bool auroraStateChanged = AuroraVtxDescDiffers(attr, type);
+
+  SETVCDATTR(attr, type);
+  if (__gx->hasNrms || __gx->hasBiNrms) {
+    SET_REG_FIELD(0, __gx->vcdLo, 2, 11, __gx->nrmType);
+  } else {
+    SET_REG_FIELD(0, __gx->vcdLo, 2, 11, 0);
+  }
+  if (aurora::gx::fifo::in_display_list() || auroraStateChanged || __gx->vcdLo != oldVcdLo ||
+      __gx->vcdHi != oldVcdHi || __gx->hasNrms != oldHasNrms || __gx->hasBiNrms != oldHasBiNrms ||
+      __gx->nrmType != oldNrmType) {
+    __gx->dirtyState |= 8;
+  }
+}
+
+void GXSetSourceVtxDesc(GXAttr attr, GXAttrType type) {
+  if (attr >= GX_VA_PNMTXIDX && attr < GX_VA_MAX_ATTR) {
+    g_gxState.sourceVtxDesc[attr] = type;
+  }
+}
+
+void GXSetVtxDescv(GXVtxDescList* list) {
+  const u32 oldVcdLo = __gx->vcdLo;
+  const u32 oldVcdHi = __gx->vcdHi;
+  const u8 oldHasNrms = __gx->hasNrms;
+  const u8 oldHasBiNrms = __gx->hasBiNrms;
+  const u32 oldNrmType = __gx->nrmType;
+  bool auroraStateChanged = false;
+
+  while (list->attr != GX_VA_NULL) {
+    auroraStateChanged = auroraStateChanged || AuroraVtxDescDiffers(list->attr, list->type);
+    SETVCDATTR(list->attr, list->type);
+    ++list;
+  }
+  if (__gx->hasNrms || __gx->hasBiNrms) {
+    SET_REG_FIELD(0, __gx->vcdLo, 2, 11, __gx->nrmType);
+  } else {
+    SET_REG_FIELD(0, __gx->vcdLo, 2, 11, 0);
+  }
+  if (aurora::gx::fifo::in_display_list() || auroraStateChanged || __gx->vcdLo != oldVcdLo ||
+      __gx->vcdHi != oldVcdHi || __gx->hasNrms != oldHasNrms || __gx->hasBiNrms != oldHasBiNrms ||
+      __gx->nrmType != oldNrmType) {
+    __gx->dirtyState |= 8;
+  }
+}
+
+void GXClearVtxDesc() {
+  __gx->vcdLo = 0;
+  SET_REG_FIELD(0, __gx->vcdLo, 2, 9, 1); // GX_VA_POS = GX_DIRECT
+  __gx->vcdHi = 0;
+  __gx->hasNrms = 0;
+  __gx->hasBiNrms = 0;
+  __gx->dirtyState |= 8;
+}
+
+void GXSetVtxAttrFmt(GXVtxFmt vtxfmt, GXAttr attr, GXCompCnt cnt, GXCompType type, u8 frac) {
+  CHECK(vtxfmt >= GX_VTXFMT0 && vtxfmt < GX_MAX_VTXFMT, "invalid vtxfmt {}", underlying(vtxfmt));
+  CHECK(attr >= GX_VA_POS && attr < GX_VA_MAX_ATTR, "invalid attr {}", underlying(attr));
+
+  u32* va = &__gx->vatA[vtxfmt];
+  u32* vb = &__gx->vatB[vtxfmt];
+  u32* vc = &__gx->vatC[vtxfmt];
+  const u32 oldVa = *va;
+  const u32 oldVb = *vb;
+  const u32 oldVc = *vc;
+  const bool auroraStateChanged = AuroraVtxAttrFmtDiffers(vtxfmt, attr, cnt, type, frac);
+  SETVAT(va, vb, vc, attr, cnt, type, frac);
+  if (aurora::gx::fifo::in_display_list() || auroraStateChanged || *va != oldVa || *vb != oldVb ||
+      *vc != oldVc) {
+    __gx->dirtyState |= 0x10;
+    __gx->dirtyVAT |= static_cast<u8>(1 << vtxfmt);
+  }
+}
+
+void GXSetVtxAttrFmtv(GXVtxFmt vtxfmt, const GXVtxAttrFmtList* list) {
+  CHECK(vtxfmt >= GX_VTXFMT0 && vtxfmt < GX_MAX_VTXFMT, "invalid vtxfmt {}", underlying(vtxfmt));
+  CHECK(list != nullptr, "null vtx attr fmt list");
+
+  u32* va = &__gx->vatA[vtxfmt];
+  u32* vb = &__gx->vatB[vtxfmt];
+  u32* vc = &__gx->vatC[vtxfmt];
+  const u32 oldVa = *va;
+  const u32 oldVb = *vb;
+  const u32 oldVc = *vc;
+  bool auroraStateChanged = false;
+  while (list->attr != GX_VA_NULL) {
+    CHECK(list->attr >= GX_VA_POS && list->attr < GX_VA_MAX_ATTR, "invalid attr {}", underlying(list->attr));
+    auroraStateChanged =
+        auroraStateChanged || AuroraVtxAttrFmtDiffers(vtxfmt, list->attr, list->cnt, list->type, list->frac);
+    SETVAT(va, vb, vc, list->attr, list->cnt, list->type, list->frac);
+    ++list;
+  }
+
+  if (aurora::gx::fifo::in_display_list() || auroraStateChanged || *va != oldVa || *vb != oldVb ||
+      *vc != oldVc) {
+    __gx->dirtyState |= 0x10;
+    __gx->dirtyVAT |= static_cast<u8>(1 << vtxfmt);
+  }
+}
+
+void GXSetArray(GXAttr attr, const void* data, u32 size, u8 stride, bool le) {
+  GXAttr cpAttr = static_cast<GXAttr>(attr);
+  if (attr == GX_VA_NBT) {
+    cpAttr = GX_VA_NRM;
+  }
+  u32 cpIdx = cpAttr - GX_VA_POS;
+
+  assert((cpIdx & ~0xF) == 0);
+
+  // Write array base
+  GX_WRITE_AURORA(GX_LOAD_AURORA_ARRAYBASE | cpIdx);
+  GX_WRITE_U64(reinterpret_cast<u64>(data));
+  GX_WRITE_U32(size);
+  GX_WRITE_U8(le ? 1 : 0);
+
+  // Write array stride
+  GX_WRITE_CP_REG(CP_REG_ARRAYSTRIDE_ID | cpIdx, stride);
+}
+
+void GXSetTexCoordGen2(GXTexCoordID dst, GXTexGenType type, GXTexGenSrc src, u32 mtx, GXBool normalize, u32 postMtx) {
+  CHECK(dst >= GX_TEXCOORD0 && dst <= GX_TEXCOORD7, "invalid tex coord {}", underlying(dst));
+
+  u32 reg = 0;
+  u32 row = 5;
+  u32 form = 0;
+
+  switch (src) {
+  case GX_TG_POS:
+    row = 0;
+    form = 1;
+    break;
+  case GX_TG_NRM:
+    row = 1;
+    form = 1;
+    break;
+  case GX_TG_BINRM:
+    row = 3;
+    form = 1;
+    break;
+  case GX_TG_TANGENT:
+    row = 4;
+    form = 1;
+    break;
+  case GX_TG_COLOR0:
+    row = 2;
+    break;
+  case GX_TG_COLOR1:
+    row = 2;
+    break;
+  case GX_TG_TEX0:
+    row = 5;
+    break;
+  case GX_TG_TEX1:
+    row = 6;
+    break;
+  case GX_TG_TEX2:
+    row = 7;
+    break;
+  case GX_TG_TEX3:
+    row = 8;
+    break;
+  case GX_TG_TEX4:
+    row = 9;
+    break;
+  case GX_TG_TEX5:
+    row = 10;
+    break;
+  case GX_TG_TEX6:
+    row = 11;
+    break;
+  case GX_TG_TEX7:
+    row = 12;
+    break;
+  default:
+    break;
+  }
+
+  switch (type) {
+  case GX_TG_MTX2x4:
+    SET_REG_FIELD(0, reg, 1, 1, 0);
+    SET_REG_FIELD(0, reg, 1, 2, form);
+    SET_REG_FIELD(0, reg, 3, 4, 0);
+    SET_REG_FIELD(0, reg, 5, 7, row);
+    break;
+  case GX_TG_MTX3x4:
+    SET_REG_FIELD(0, reg, 1, 1, 1);
+    SET_REG_FIELD(0, reg, 1, 2, form);
+    SET_REG_FIELD(0, reg, 3, 4, 0);
+    SET_REG_FIELD(0, reg, 5, 7, row);
+    break;
+  case GX_TG_SRTG:
+    SET_REG_FIELD(0, reg, 1, 1, 0);
+    SET_REG_FIELD(0, reg, 1, 2, form);
+    if (src == GX_TG_COLOR0) {
+      SET_REG_FIELD(0, reg, 3, 4, 2);
+    } else {
+      SET_REG_FIELD(0, reg, 3, 4, 3);
+    }
+    SET_REG_FIELD(0, reg, 5, 7, 2);
+    break;
+  default:
+    // Bump mapping types
+    if (type >= 2 && type <= 9) {
+      SET_REG_FIELD(0, reg, 1, 1, 0);
+      SET_REG_FIELD(0, reg, 1, 2, form);
+      SET_REG_FIELD(0, reg, 3, 4, 1);
+      SET_REG_FIELD(0, reg, 5, 7, row);
+      SET_REG_FIELD(0, reg, 3, 12, src - 12);
+      SET_REG_FIELD(0, reg, 3, 15, type - 2);
+    }
+    break;
+  }
+
+  GX_WRITE_XF_REG(dst + 0x40, reg);
+
+  // Post-transform register
+  u32 postReg = 0;
+  SET_REG_FIELD(0, postReg, 6, 0, postMtx - 64);
+  SET_REG_FIELD(0, postReg, 1, 8, normalize);
+  GX_WRITE_XF_REG(dst + 0x50, postReg);
+
+  // Update matrix index shadows
+  switch (dst) {
+  case GX_TEXCOORD0:
+    SET_REG_FIELD(0, __gx->matIdxA, 6, 6, mtx);
+    break;
+  case GX_TEXCOORD1:
+    SET_REG_FIELD(0, __gx->matIdxA, 6, 12, mtx);
+    break;
+  case GX_TEXCOORD2:
+    SET_REG_FIELD(0, __gx->matIdxA, 6, 18, mtx);
+    break;
+  case GX_TEXCOORD3:
+    SET_REG_FIELD(0, __gx->matIdxA, 6, 24, mtx);
+    break;
+  case GX_TEXCOORD4:
+    SET_REG_FIELD(0, __gx->matIdxB, 6, 0, mtx);
+    break;
+  case GX_TEXCOORD5:
+    SET_REG_FIELD(0, __gx->matIdxB, 6, 6, mtx);
+    break;
+  case GX_TEXCOORD6:
+    SET_REG_FIELD(0, __gx->matIdxB, 6, 12, mtx);
+    break;
+  default:
+    SET_REG_FIELD(0, __gx->matIdxB, 6, 18, mtx);
+    break;
+  }
+  __GXSetMatrixIndex(static_cast<GXAttr>(dst + 1));
+}
+
+void GXSetNumTexGens(u8 num) {
+  SET_REG_FIELD(0, __gx->genMode, 4, 0, num);
+  GX_WRITE_XF_REG(0x3F, num);
+  __gx->dirtyState |= 4;
+}
+
+void GXInvalidateVtxCache() { GX_WRITE_U8(0x48); }
+
+void GXSetLineWidth(u8 width, GXTexOffset offs) {
+  SET_REG_FIELD(0, __gx->lpSize, 8, 0, width);
+  SET_REG_FIELD(0, __gx->lpSize, 3, 16, offs);
+  GX_WRITE_RAS_REG(__gx->lpSize);
+  __gx->bpSent = 1;
+}
+
+void GXSetPointSize(u8 pointSize, GXTexOffset texOffsets) {
+  SET_REG_FIELD(0, __gx->lpSize, 8, 8, pointSize);
+  SET_REG_FIELD(0, __gx->lpSize, 3, 19, texOffsets);
+  GX_WRITE_RAS_REG(__gx->lpSize);
+  __gx->bpSent = 1;
+}
+
+void GXEnableTexOffsets(GXTexCoordID coord, GXBool line_enable, GXBool point_enable) {
+  SET_REG_FIELD(0, __gx->suTs0[coord], 1, 18, line_enable);
+  SET_REG_FIELD(0, __gx->suTs0[coord], 1, 19, point_enable);
+  GX_WRITE_RAS_REG(__gx->suTs0[coord]);
+  __gx->bpSent = 1;
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXGet.cpp b/aurora-main/lib/dolphin/gx/GXGet.cpp
new file mode 100644
index 0000000..ccefbbc
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXGet.cpp
@@ -0,0 +1,337 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+#include "../../gfx/common.hpp"
+#include "../../gfx/texture.hpp"
+
+extern "C" {
+
+static inline u8 GetFracForNrm(GXCompType type) {
+  switch (type) {
+  case GX_S8:
+    return 6;
+  case GX_S16:
+    return 14;
+  default:
+    return 0;
+  }
+}
+
+void GXGetVtxDesc(GXAttr attr, GXAttrType* type) {
+  CHECK(type != nullptr, "null vtx desc output");
+
+  u32 cpType = 0;
+  switch (attr) {
+  case GX_VA_PNMTXIDX:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 1, 0);
+    break;
+  case GX_VA_TEX0MTXIDX:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 1, 1);
+    break;
+  case GX_VA_TEX1MTXIDX:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 1, 2);
+    break;
+  case GX_VA_TEX2MTXIDX:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 1, 3);
+    break;
+  case GX_VA_TEX3MTXIDX:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 1, 4);
+    break;
+  case GX_VA_TEX4MTXIDX:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 1, 5);
+    break;
+  case GX_VA_TEX5MTXIDX:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 1, 6);
+    break;
+  case GX_VA_TEX6MTXIDX:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 1, 7);
+    break;
+  case GX_VA_TEX7MTXIDX:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 1, 8);
+    break;
+  case GX_VA_POS:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 2, 9);
+    break;
+  case GX_VA_NRM:
+    cpType = __gx->hasNrms ? GET_REG_FIELD(__gx->vcdLo, 2, 11) : GX_NONE;
+    break;
+  case GX_VA_NBT:
+    cpType = __gx->hasBiNrms ? GET_REG_FIELD(__gx->vcdLo, 2, 11) : GX_NONE;
+    break;
+  case GX_VA_CLR0:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 2, 13);
+    break;
+  case GX_VA_CLR1:
+    cpType = GET_REG_FIELD(__gx->vcdLo, 2, 15);
+    break;
+  case GX_VA_TEX0:
+    cpType = GET_REG_FIELD(__gx->vcdHi, 2, 0);
+    break;
+  case GX_VA_TEX1:
+    cpType = GET_REG_FIELD(__gx->vcdHi, 2, 2);
+    break;
+  case GX_VA_TEX2:
+    cpType = GET_REG_FIELD(__gx->vcdHi, 2, 4);
+    break;
+  case GX_VA_TEX3:
+    cpType = GET_REG_FIELD(__gx->vcdHi, 2, 6);
+    break;
+  case GX_VA_TEX4:
+    cpType = GET_REG_FIELD(__gx->vcdHi, 2, 8);
+    break;
+  case GX_VA_TEX5:
+    cpType = GET_REG_FIELD(__gx->vcdHi, 2, 10);
+    break;
+  case GX_VA_TEX6:
+    cpType = GET_REG_FIELD(__gx->vcdHi, 2, 12);
+    break;
+  case GX_VA_TEX7:
+    cpType = GET_REG_FIELD(__gx->vcdHi, 2, 14);
+    break;
+  default:
+    break;
+  }
+
+  *type = static_cast<GXAttrType>(cpType);
+}
+
+void GXGetVtxDescv(GXVtxDescList* vcd) {
+  CHECK(vcd != nullptr, "null vtx desc list");
+
+  GXVtxDescList* out = vcd;
+  for (GXAttr attr = GX_VA_PNMTXIDX; attr <= GX_VA_TEX7; attr = static_cast<GXAttr>(attr + 1), ++out) {
+    out->attr = attr;
+    GXGetVtxDesc(attr, &out->type);
+  }
+  out->attr = GX_VA_NBT;
+  GXGetVtxDesc(GX_VA_NBT, &out->type);
+  ++out;
+  out->attr = GX_VA_NULL;
+}
+
+void GXGetVtxAttrFmt(GXVtxFmt idx, GXAttr attr, GXCompCnt* compCnt, GXCompType* compType, u8* shift) {
+  CHECK(compCnt != nullptr && compType != nullptr && shift != nullptr, "null vtx attr fmt output");
+
+  const u32 va = __gx->vatA[idx];
+  const u32 vb = __gx->vatB[idx];
+  const u32 vc = __gx->vatC[idx];
+
+  switch (attr) {
+  case GX_VA_POS:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(va, 1, 0));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 1));
+    *shift = static_cast<u8>(GET_REG_FIELD(va, 5, 4));
+    return;
+  case GX_VA_NRM:
+  case GX_VA_NBT:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(va, 1, 9));
+    if (*compCnt == GX_TEX_ST && GET_REG_FIELD(va, 1, 31) != 0) {
+      *compCnt = GX_NRM_NBT3;
+    }
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 10));
+    *shift = GetFracForNrm(*compType);
+    return;
+  case GX_VA_CLR0:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(va, 1, 13));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 14));
+    *shift = 0;
+    return;
+  case GX_VA_CLR1:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(va, 1, 17));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 18));
+    *shift = 0;
+    return;
+  case GX_VA_TEX0:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(va, 1, 21));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 22));
+    *shift = static_cast<u8>(GET_REG_FIELD(va, 5, 25));
+    return;
+  case GX_VA_TEX1:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(vb, 1, 0));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(vb, 3, 1));
+    *shift = static_cast<u8>(GET_REG_FIELD(vb, 5, 4));
+    return;
+  case GX_VA_TEX2:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(vb, 1, 9));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(vb, 3, 10));
+    *shift = static_cast<u8>(GET_REG_FIELD(vb, 5, 13));
+    return;
+  case GX_VA_TEX3:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(vb, 1, 18));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(vb, 3, 19));
+    *shift = static_cast<u8>(GET_REG_FIELD(vb, 5, 22));
+    return;
+  case GX_VA_TEX4:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(vb, 1, 27));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(vb, 3, 28));
+    *shift = static_cast<u8>(GET_REG_FIELD(vc, 5, 0));
+    return;
+  case GX_VA_TEX5:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(vc, 1, 5));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(vc, 3, 6));
+    *shift = static_cast<u8>(GET_REG_FIELD(vc, 5, 9));
+    return;
+  case GX_VA_TEX6:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(vc, 1, 14));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(vc, 3, 15));
+    *shift = static_cast<u8>(GET_REG_FIELD(vc, 5, 18));
+    return;
+  case GX_VA_TEX7:
+    *compCnt = static_cast<GXCompCnt>(GET_REG_FIELD(vc, 1, 23));
+    *compType = static_cast<GXCompType>(GET_REG_FIELD(vc, 3, 24));
+    *shift = static_cast<u8>(GET_REG_FIELD(vc, 5, 27));
+    return;
+  default:
+    *compCnt = GX_TEX_ST;
+    *compType = GX_RGB565;
+    *shift = 0;
+    return;
+  }
+}
+
+void GXGetVtxAttrFmtv(GXVtxFmt fmt, GXVtxAttrFmtList* vat) {
+  CHECK(vat != nullptr, "null vtx attr fmt list");
+
+  GXVtxAttrFmtList* out = vat;
+  for (GXAttr attr = GX_VA_POS; attr <= GX_VA_TEX7; attr = static_cast<GXAttr>(attr + 1), ++out) {
+    out->attr = attr;
+    GXGetVtxAttrFmt(fmt, attr, &out->cnt, &out->type, &out->frac);
+  }
+  out->attr = GX_VA_NULL;
+}
+
+void GXGetLineWidth(u8* width, GXTexOffset* texOffsets) {
+  CHECK(width != nullptr && texOffsets != nullptr, "null line width output");
+
+  *width = static_cast<u8>(GET_REG_FIELD(__gx->lpSize, 8, 0));
+  *texOffsets = static_cast<GXTexOffset>(GET_REG_FIELD(__gx->lpSize, 3, 16));
+}
+
+void GXGetPointSize(u8* pointSize, GXTexOffset* texOffsets) {
+  CHECK(pointSize != nullptr && texOffsets != nullptr, "null point size output");
+
+  *pointSize = static_cast<u8>(GET_REG_FIELD(__gx->lpSize, 8, 8));
+  *texOffsets = static_cast<GXTexOffset>(GET_REG_FIELD(__gx->lpSize, 3, 19));
+}
+
+void GXGetViewportv(f32 *vp) {
+  CHECK(vp != nullptr, "null viewport output");
+
+  vp[0] = __gx->vpLeft;
+  vp[1] = __gx->vpTop;
+  vp[2] = __gx->vpWd;
+  vp[3] = __gx->vpHt;
+  vp[4] = __gx->vpNearz;
+  vp[5] = __gx->vpFarz;
+}
+
+void GXGetProjectionv(f32* p) {
+  p[0] = __gx->projType == GX_PERSPECTIVE ? 0.0f : 1.0f;
+  p[1] = __gx->projMtx[0];
+  p[2] = __gx->projMtx[1];
+  p[3] = __gx->projMtx[2];
+  p[4] = __gx->projMtx[3];
+  p[5] = __gx->projMtx[4];
+  p[6] = __gx->projMtx[5];
+}
+
+void GXGetScissor(u32* left, u32* top, u32* wd, u32* ht) {
+  CHECK(left != nullptr && top != nullptr && wd != nullptr && ht != nullptr, "null scissor output");
+
+  const u32 tp = GET_REG_FIELD(__gx->suScis0, 11, 0);
+  const u32 lf = GET_REG_FIELD(__gx->suScis0, 11, 12);
+  const u32 bm = GET_REG_FIELD(__gx->suScis1, 11, 0);
+  const u32 rt = GET_REG_FIELD(__gx->suScis1, 11, 12);
+
+  *left = lf - 342;
+  *top = tp - 342;
+  *wd = rt - lf + 1;
+  *ht = bm - tp + 1;
+}
+
+void GXGetCullMode(GXCullMode* mode) {
+  CHECK(mode != nullptr, "null cull mode output");
+
+  const auto hwMode = static_cast<GXCullMode>(GET_REG_FIELD(__gx->genMode, 2, 14));
+  switch (hwMode) {
+  case GX_CULL_FRONT:
+    *mode = GX_CULL_BACK;
+    break;
+  case GX_CULL_BACK:
+    *mode = GX_CULL_FRONT;
+    break;
+  default:
+    *mode = hwMode;
+    break;
+  }
+}
+
+void GXGetLightAttnA(GXLightObj* light_, float* a0, float* a1, float* a2) {
+  auto* light = reinterpret_cast<const GXLightObj_*>(light_);
+  *a0 = light->a0;
+  *a1 = light->a1;
+  *a2 = light->a2;
+}
+
+void GXGetLightAttnK(GXLightObj* light_, float* k0, float* k1, float* k2) {
+  auto* light = reinterpret_cast<const GXLightObj_*>(light_);
+  *k0 = light->k0;
+  *k1 = light->k1;
+  *k2 = light->k2;
+}
+
+void GXGetLightPos(GXLightObj* light_, float* x, float* y, float* z) {
+  auto* light = reinterpret_cast<const GXLightObj_*>(light_);
+  *x = light->px;
+  *y = light->py;
+  *z = light->pz;
+}
+
+void GXGetLightDir(GXLightObj* light_, float* nx, float* ny, float* nz) {
+  auto* light = reinterpret_cast<const GXLightObj_*>(light_);
+  *nx = -light->nx;
+  *ny = -light->ny;
+  *nz = -light->nz;
+}
+
+void GXGetLightColor(GXLightObj* light_, GXColor* col) {
+  auto* light = reinterpret_cast<const GXLightObj_*>(light_);
+  *col = light->color;
+}
+
+void* GXGetTexObjData(GXTexObj* tex_obj) {
+  return const_cast<void*>(reinterpret_cast<const GXTexObj_*>(tex_obj)->data);
+}
+
+u16 GXGetTexObjWidth(GXTexObj* tex_obj) { return static_cast<u16>(reinterpret_cast<const GXTexObj_*>(tex_obj)->width()); }
+
+u16 GXGetTexObjHeight(GXTexObj* tex_obj) { return static_cast<u16>(reinterpret_cast<const GXTexObj_*>(tex_obj)->height()); }
+
+GXTexFmt GXGetTexObjFmt(GXTexObj* tex_obj) {
+  return static_cast<GXTexFmt>(reinterpret_cast<const GXTexObj_*>(tex_obj)->format());
+}
+
+GXTexWrapMode GXGetTexObjWrapS(GXTexObj* tex_obj) { return reinterpret_cast<const GXTexObj_*>(tex_obj)->wrap_s(); }
+
+GXTexWrapMode GXGetTexObjWrapT(GXTexObj* tex_obj) { return reinterpret_cast<const GXTexObj_*>(tex_obj)->wrap_t(); }
+
+GXBool GXGetTexObjMipMap(GXTexObj* tex_obj) { return reinterpret_cast<const GXTexObj_*>(tex_obj)->has_mips(); }
+
+// TODO GXGetTexObjAll
+// TODO GXGetTexObjMinFilt
+// TODO GXGetTexObjMagFilt
+// TODO GXGetTexObjMinLOD
+// TODO GXGetTexObjMaxLOD
+// TODO GXGetTexObjLODBias
+// TODO GXGetTexObjBiasClamp
+// TODO GXGetTexObjEdgeLOD
+// TODO GXGetTexObjMaxAniso
+// TODO GXGetTexObjLODAll
+u32 GXGetTexObjTlut(const GXTexObj* tex_obj) { return reinterpret_cast<const GXTexObj_*>(tex_obj)->tlut; }
+// TODO GXGetTlutObjData
+// TODO GXGetTlutObjFmt
+// TODO GXGetTlutObjNumEntries
+// TODO GXGetTlutObjAll
+// TODO GXGetTexRegionAll
+// TODO GXGetTlutRegionAll
+}
diff --git a/aurora-main/lib/dolphin/gx/GXLighting.cpp b/aurora-main/lib/dolphin/gx/GXLighting.cpp
new file mode 100644
index 0000000..f7331c6
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXLighting.cpp
@@ -0,0 +1,291 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+extern "C" {
+void GXInitLightAttn(GXLightObj* light_, float a0, float a1, float a2, float k0, float k1, float k2) {
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->a0 = a0;
+  light->a1 = a1;
+  light->a2 = a2;
+  light->k0 = k0;
+  light->k1 = k1;
+  light->k2 = k2;
+}
+
+void GXInitLightAttnA(GXLightObj* light_, float a0, float a1, float a2) {
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->a0 = a0;
+  light->a1 = a1;
+  light->a2 = a2;
+}
+
+void GXInitLightAttnK(GXLightObj* light_, float k0, float k1, float k2) {
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->k0 = k0;
+  light->k1 = k1;
+  light->k2 = k2;
+}
+
+void GXInitLightSpot(GXLightObj* light_, float cutoff, GXSpotFn spotFn) {
+  if (cutoff <= 0.f || cutoff > 90.f) {
+    spotFn = GX_SP_OFF;
+  }
+
+  float cr = std::cos((cutoff * M_PIF) / 180.f);
+  float a0 = 1.f;
+  float a1 = 0.f;
+  float a2 = 0.f;
+  switch (spotFn) {
+  default:
+    break;
+  case GX_SP_FLAT:
+    a0 = -1000.f * cr;
+    a1 = 1000.f;
+    a2 = 0.f;
+    break;
+  case GX_SP_COS:
+    a0 = -cr / (1.f - cr);
+    a1 = 1.f / (1.f - cr);
+    a2 = 0.f;
+    break;
+  case GX_SP_COS2:
+    a0 = 0.f;
+    a1 = -cr / (1.f - cr);
+    a2 = 1.f / (1.f - cr);
+    break;
+  case GX_SP_SHARP: {
+    const float d = (1.f - cr) * (1.f - cr);
+    a0 = cr * (cr - 2.f) / d;
+    a1 = 2.f / d;
+    a2 = -1.f / d;
+    break;
+  }
+  case GX_SP_RING1: {
+    const float d = (1.f - cr) * (1.f - cr);
+    a0 = -4.f * cr / d;
+    a1 = 4.f * (1.f + cr) / d;
+    a2 = -4.f / d;
+    break;
+  }
+  case GX_SP_RING2: {
+    const float d = (1.f - cr) * (1.f - cr);
+    a0 = 1.f - 2.f * cr * cr / d;
+    a1 = 4.f * cr / d;
+    a2 = -2.f / d;
+    break;
+  }
+  }
+
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->a0 = a0;
+  light->a1 = a1;
+  light->a2 = a2;
+}
+
+void GXInitLightDistAttn(GXLightObj* light_, float refDistance, float refBrightness, GXDistAttnFn distFunc) {
+  if (refDistance < 0.f || refBrightness < 0.f || refBrightness >= 1.f) {
+    distFunc = GX_DA_OFF;
+  }
+  float k0 = 1.f;
+  float k1 = 0.f;
+  float k2 = 0.f;
+  switch (distFunc) {
+  case GX_DA_GENTLE:
+    k0 = 1.0f;
+    k1 = (1.0f - refBrightness) / (refBrightness * refDistance);
+    k2 = 0.0f;
+    break;
+  case GX_DA_MEDIUM:
+    k0 = 1.0f;
+    k1 = 0.5f * (1.0f - refBrightness) / (refBrightness * refDistance);
+    k2 = 0.5f * (1.0f - refBrightness) / (refBrightness * refDistance * refDistance);
+    break;
+  case GX_DA_STEEP:
+    k0 = 1.0f;
+    k1 = 0.0f;
+    k2 = (1.0f - refBrightness) / (refBrightness * refDistance * refDistance);
+    break;
+  case GX_DA_OFF:
+    k0 = 1.0f;
+    k1 = 0.0f;
+    k2 = 0.0f;
+    break;
+  }
+
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->k0 = k0;
+  light->k1 = k1;
+  light->k2 = k2;
+}
+
+void GXInitLightPos(GXLightObj* light_, float x, float y, float z) {
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->px = x;
+  light->py = y;
+  light->pz = z;
+}
+
+void GXInitLightColor(GXLightObj* light_, GXColor col) {
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->color = col;
+}
+
+void GXLoadLightObjImm(GXLightObj* light_, GXLightID id) {
+  u32 idx = std::log2<u32>(id);
+  auto* light = reinterpret_cast<const GXLightObj_*>(light_);
+
+  // XF bulk write: 16 values at light base address
+  // Light addresses: 0x600 + idx * 0x10
+  u32 addr = 0x600 + idx * 0x10;
+  u32 reg = addr | (0xF << 16); // 16-1=15 values
+
+  // Convert color to packed u32 for XF
+  u32 colorPacked = (static_cast<u32>(light->color.r) << 24) | (static_cast<u32>(light->color.g) << 16) |
+                    (static_cast<u32>(light->color.b) << 8) | static_cast<u32>(light->color.a);
+
+  GX_WRITE_U8(0x10);
+  GX_WRITE_U32(reg);
+  // Padding (3 u32s)
+  GX_WRITE_U32(0);
+  GX_WRITE_U32(0);
+  GX_WRITE_U32(0);
+  // Color
+  GX_WRITE_U32(colorPacked);
+  // Cosine attenuation (a0, a1, a2)
+  GX_WRITE_F32(light->a0);
+  GX_WRITE_F32(light->a1);
+  GX_WRITE_F32(light->a2);
+  // Distance attenuation (k0, k1, k2)
+  GX_WRITE_F32(light->k0);
+  GX_WRITE_F32(light->k1);
+  GX_WRITE_F32(light->k2);
+  // Position (px, py, pz)
+  GX_WRITE_F32(light->px);
+  GX_WRITE_F32(light->py);
+  GX_WRITE_F32(light->pz);
+  // Direction (nx, ny, nz)
+  GX_WRITE_F32(light->nx);
+  GX_WRITE_F32(light->ny);
+  GX_WRITE_F32(light->nz);
+}
+
+void GXSetChanAmbColor(GXChannelID id, GXColor color) {
+  if (id == GX_COLOR0A0) {
+    GXSetChanAmbColor(GX_COLOR0, color);
+    GXSetChanAmbColor(GX_ALPHA0, color);
+    return;
+  } else if (id == GX_COLOR1A1) {
+    GXSetChanAmbColor(GX_COLOR1, color);
+    GXSetChanAmbColor(GX_ALPHA1, color);
+    return;
+  }
+  CHECK(id >= GX_COLOR0 && id <= GX_ALPHA1, "bad channel {}", static_cast<int>(id));
+
+  // XF ambient color registers: 0x100A (chan 0), 0x100B (chan 1)
+  u32 packed = (static_cast<u32>(color.r) << 24) | (static_cast<u32>(color.g) << 16) |
+               (static_cast<u32>(color.b) << 8) | static_cast<u32>(color.a);
+  if (id == GX_COLOR0 || id == GX_ALPHA0) {
+    __gx->ambColor[0] = packed;
+    GX_WRITE_XF_REG(0xA, packed);
+  } else {
+    __gx->ambColor[1] = packed;
+    GX_WRITE_XF_REG(0xB, packed);
+  }
+  __gx->bpSent = 0;
+}
+
+void GXSetChanMatColor(GXChannelID id, GXColor color) {
+  if (id == GX_COLOR0A0) {
+    GXSetChanMatColor(GX_COLOR0, color);
+    GXSetChanMatColor(GX_ALPHA0, color);
+    return;
+  } else if (id == GX_COLOR1A1) {
+    GXSetChanMatColor(GX_COLOR1, color);
+    GXSetChanMatColor(GX_ALPHA1, color);
+    return;
+  }
+  CHECK(id >= GX_COLOR0 && id <= GX_ALPHA1, "bad channel {}", static_cast<int>(id));
+
+  // XF material color registers: 0x100C (chan 0), 0x100D (chan 1)
+  u32 packed = (static_cast<u32>(color.r) << 24) | (static_cast<u32>(color.g) << 16) |
+               (static_cast<u32>(color.b) << 8) | static_cast<u32>(color.a);
+  if (id == GX_COLOR0 || id == GX_ALPHA0) {
+    __gx->matColor[0] = packed;
+    GX_WRITE_XF_REG(0xC, packed);
+  } else {
+    __gx->matColor[1] = packed;
+    GX_WRITE_XF_REG(0xD, packed);
+  }
+  __gx->bpSent = 0;
+}
+
+void GXSetNumChans(u8 num) {
+  SET_REG_FIELD(0, __gx->genMode, 3, 4, num);
+  GX_WRITE_XF_REG(9, num);
+  __gx->dirtyState |= 4;
+}
+
+void GXInitLightDir(GXLightObj* light_, float nx, float ny, float nz) {
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->nx = -nx;
+  light->ny = -ny;
+  light->nz = -nz;
+}
+
+void GXInitSpecularDir(GXLightObj* light_, float nx, float ny, float nz) {
+  float hx = -nx;
+  float hy = -ny;
+  float hz = (-nz + 1.0f);
+  float mag = ((hx * hx) + (hy * hy) + (hz * hz));
+  if (mag != 0.0f) {
+    mag = 1.0f / sqrtf(mag);
+  }
+
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->px = (nx * GX_LARGE_NUMBER);
+  light->py = (ny * GX_LARGE_NUMBER);
+  light->pz = (nz * GX_LARGE_NUMBER);
+  light->nx = hx * mag;
+  light->ny = hy * mag;
+  light->nz = hz * mag;
+}
+
+void GXInitSpecularDirHA(GXLightObj* light_, float nx, float ny, float nz, float hx, float hy, float hz) {
+  auto* light = reinterpret_cast<GXLightObj_*>(light_);
+  light->px = (nx * GX_LARGE_NUMBER);
+  light->py = (ny * GX_LARGE_NUMBER);
+  light->pz = (nz * GX_LARGE_NUMBER);
+  light->nx = hx;
+  light->ny = hy;
+  light->nz = hz;
+}
+
+void GXSetChanCtrl(GXChannelID id, bool lightingEnabled, GXColorSrc ambSrc, GXColorSrc matSrc, u32 lightState,
+                   GXDiffuseFn diffFn, GXAttnFn attnFn) {
+  if (id == GX_COLOR0A0) {
+    GXSetChanCtrl(GX_COLOR0, lightingEnabled, ambSrc, matSrc, lightState, diffFn, attnFn);
+    GXSetChanCtrl(GX_ALPHA0, lightingEnabled, ambSrc, matSrc, lightState, diffFn, attnFn);
+    return;
+  } else if (id == GX_COLOR1A1) {
+    GXSetChanCtrl(GX_COLOR1, lightingEnabled, ambSrc, matSrc, lightState, diffFn, attnFn);
+    GXSetChanCtrl(GX_ALPHA1, lightingEnabled, ambSrc, matSrc, lightState, diffFn, attnFn);
+    return;
+  }
+  CHECK(id >= GX_COLOR0 && id <= GX_ALPHA1, "bad channel {}", static_cast<int>(id));
+
+  // Build XF channel control register
+  u32 reg = 0;
+  SET_REG_FIELD(0, reg, 1, 0, matSrc);
+  SET_REG_FIELD(0, reg, 1, 1, lightingEnabled);
+  SET_REG_FIELD(0, reg, 4, 2, lightState & 0xF); // lights 0-3
+  SET_REG_FIELD(0, reg, 1, 6, ambSrc);
+  SET_REG_FIELD(0, reg, 2, 7, (attnFn == GX_AF_SPEC) ? GX_DF_NONE : diffFn);
+  SET_REG_FIELD(0, reg, 1, 9, (attnFn != GX_AF_NONE));   // raw XF attn bit 0
+  SET_REG_FIELD(0, reg, 1, 10, (attnFn != GX_AF_SPEC));  // raw XF attn bit 1
+  SET_REG_FIELD(0, reg, 4, 11, (lightState >> 4) & 0xF); // lights 4-7
+
+  // XF channel control registers: 0x100E-0x1011
+  GX_WRITE_XF_REG(0xE + id, reg);
+  __gx->bpSent = 0;
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXManage.cpp b/aurora-main/lib/dolphin/gx/GXManage.cpp
new file mode 100644
index 0000000..80b3b92
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXManage.cpp
@@ -0,0 +1,502 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+#include "../../gx/fifo.hpp"
+
+#include <cstring>
+
+// Global shadow register instance
+static __GXData_struct sGXData;
+__GXData_struct* __gx = &sGXData;
+static GXFifoObj sFifoObj;
+
+extern "C" {
+static GXDrawDoneCallback DrawDoneCB = nullptr;
+
+GXFifoObj* GXInit(void* base, u32 size) {
+  GXRenderModeObj* rmode;
+  f32 identity_mtx[3][4];
+  GXColor clear = {64, 64, 64, 255};
+  GXColor black = {0, 0, 0, 0};
+  GXColor white = {255, 255, 255, 255};
+  u32 i;
+
+  std::memset(&sGXData, 0, sizeof(sGXData));
+  __gx = &sGXData;
+  __gx->inDispList = 0;
+  __gx->dlSaveContext = 1;
+  __gx->tcsManEnab = 0;
+  __gx->vNum = 0;
+
+  // Initialize FIFO subsystem
+  aurora::gx::fifo::init();
+  GXInitFifoBase(&sFifoObj, base, size);
+  GXSetCPUFifo(&sFifoObj);
+  GXSetGPFifo(&sFifoObj);
+
+  // Initialize shadow registers: genMode, bpMask, lpSize
+  __gx->genMode = 0;
+  SET_REG_FIELD(0, __gx->genMode, 8, 24, 0x00);
+  __gx->bpMask = 0xFF;
+  SET_REG_FIELD(0, __gx->bpMask, 8, 24, 0x0F);
+  __gx->lpSize = 0;
+  SET_REG_FIELD(0, __gx->lpSize, 8, 24, 0x22);
+
+  // TEV / tref / ksel shadow registers
+  for (i = 0; i < 16; i++) {
+    __gx->tevc[i] = 0;
+    __gx->teva[i] = 0;
+    __gx->tref[i / 2] = 0;
+    __gx->texmapId[i] = GX_TEXMAP_NULL;
+    SET_REG_FIELD(0, __gx->tevc[i], 8, 24, 0xC0 + i * 2);
+    SET_REG_FIELD(0, __gx->teva[i], 8, 24, 0xC1 + i * 2);
+    SET_REG_FIELD(0, __gx->tevKsel[i / 2], 8, 24, 0xF6 + i / 2);
+    SET_REG_FIELD(0, __gx->tref[i / 2], 8, 24, 0x28 + i / 2);
+  }
+
+  // iref and SU texture scale registers
+  __gx->iref = 0;
+  SET_REG_FIELD(0, __gx->iref, 8, 24, 0x27);
+  for (i = 0; i < 8; i++) {
+    __gx->suTs0[i] = 0;
+    __gx->suTs1[i] = 0;
+    SET_REG_FIELD(0, __gx->suTs0[i], 8, 24, 0x30 + i * 2);
+    SET_REG_FIELD(0, __gx->suTs1[i], 8, 24, 0x31 + i * 2);
+  }
+
+  // Other BP command byte init
+  SET_REG_FIELD(0, __gx->suScis0, 8, 24, 0x20);
+  SET_REG_FIELD(0, __gx->suScis1, 8, 24, 0x21);
+  SET_REG_FIELD(0, __gx->cmode0, 8, 24, 0x41);
+  SET_REG_FIELD(0, __gx->cmode1, 8, 24, 0x42);
+  SET_REG_FIELD(0, __gx->zmode, 8, 24, 0x40);
+  SET_REG_FIELD(0, __gx->peCtrl, 8, 24, 0x43);
+  SET_REG_FIELD(0, __gx->IndTexScale0, 8, 24, 0x25);
+  SET_REG_FIELD(0, __gx->IndTexScale1, 8, 24, 0x26);
+
+  __gx->dirtyState = 0;
+  __gx->dirtyVAT = 0;
+
+  // VAT initialization: set default bits and write vatB to CP
+  for (i = 0; i < GX_MAX_VTXFMT; i++) {
+    SET_REG_FIELD(0, __gx->vatA[i], 1, 30, 1);
+    SET_REG_FIELD(0, __gx->vatB[i], 1, 31, 1);
+    GX_WRITE_U8(8);
+    GX_WRITE_U8(i | 0x80);
+    GX_WRITE_U32(__gx->vatB[i]);
+  }
+
+  // XF register init: error/mode control + dual-tex transform
+  {
+    u32 reg1 = 0;
+    u32 reg2 = 0;
+    SET_REG_FIELD(0, reg1, 1, 0, 1);
+    SET_REG_FIELD(0, reg1, 1, 1, 1);
+    SET_REG_FIELD(0, reg1, 1, 2, 1);
+    SET_REG_FIELD(0, reg1, 1, 3, 1);
+    SET_REG_FIELD(0, reg1, 1, 4, 1);
+    SET_REG_FIELD(0, reg1, 1, 5, 1);
+    GX_WRITE_XF_REG(0, reg1);
+    SET_REG_FIELD(0, reg2, 1, 0, 1);
+    GX_WRITE_XF_REG(0x12, reg2);
+  }
+
+  // BP 0x58 register init
+  {
+    u32 reg = 0;
+    SET_REG_FIELD(0, reg, 1, 0, 1);
+    SET_REG_FIELD(0, reg, 1, 1, 1);
+    SET_REG_FIELD(0, reg, 1, 2, 1);
+    SET_REG_FIELD(0, reg, 1, 3, 1);
+    SET_REG_FIELD(0, reg, 8, 24, 0x58);
+    GX_WRITE_RAS_REG(reg);
+  }
+
+  // Default render mode (NTSC)
+  rmode = &GXNtsc480IntDf;
+
+  // Default state initialization via API calls
+  GXSetCopyClear(clear, 0xFFFFFF);
+  GXSetTexCoordGen(GX_TEXCOORD0, GX_TG_MTX2x4, GX_TG_TEX0, 0x3C);
+  GXSetTexCoordGen(GX_TEXCOORD1, GX_TG_MTX2x4, GX_TG_TEX1, 0x3C);
+  GXSetTexCoordGen(GX_TEXCOORD2, GX_TG_MTX2x4, GX_TG_TEX2, 0x3C);
+  GXSetTexCoordGen(GX_TEXCOORD3, GX_TG_MTX2x4, GX_TG_TEX3, 0x3C);
+  GXSetTexCoordGen(GX_TEXCOORD4, GX_TG_MTX2x4, GX_TG_TEX4, 0x3C);
+  GXSetTexCoordGen(GX_TEXCOORD5, GX_TG_MTX2x4, GX_TG_TEX5, 0x3C);
+  GXSetTexCoordGen(GX_TEXCOORD6, GX_TG_MTX2x4, GX_TG_TEX6, 0x3C);
+  GXSetTexCoordGen(GX_TEXCOORD7, GX_TG_MTX2x4, GX_TG_TEX7, 0x3C);
+  GXSetNumTexGens(1);
+  GXClearVtxDesc();
+  GXInvalidateVtxCache();
+  GXSetLineWidth(6, GX_TO_ZERO);
+  GXSetPointSize(6, GX_TO_ZERO);
+  GXEnableTexOffsets(GX_TEXCOORD0, GX_DISABLE, GX_DISABLE);
+  GXEnableTexOffsets(GX_TEXCOORD1, GX_DISABLE, GX_DISABLE);
+  GXEnableTexOffsets(GX_TEXCOORD2, GX_DISABLE, GX_DISABLE);
+  GXEnableTexOffsets(GX_TEXCOORD3, GX_DISABLE, GX_DISABLE);
+  GXEnableTexOffsets(GX_TEXCOORD4, GX_DISABLE, GX_DISABLE);
+  GXEnableTexOffsets(GX_TEXCOORD5, GX_DISABLE, GX_DISABLE);
+  GXEnableTexOffsets(GX_TEXCOORD6, GX_DISABLE, GX_DISABLE);
+  GXEnableTexOffsets(GX_TEXCOORD7, GX_DISABLE, GX_DISABLE);
+
+  // Identity matrix
+  identity_mtx[0][0] = 1.0f;
+  identity_mtx[0][1] = 0.0f;
+  identity_mtx[0][2] = 0.0f;
+  identity_mtx[0][3] = 0.0f;
+  identity_mtx[1][0] = 0.0f;
+  identity_mtx[1][1] = 1.0f;
+  identity_mtx[1][2] = 0.0f;
+  identity_mtx[1][3] = 0.0f;
+  identity_mtx[2][0] = 0.0f;
+  identity_mtx[2][1] = 0.0f;
+  identity_mtx[2][2] = 1.0f;
+  identity_mtx[2][3] = 0.0f;
+  GXLoadPosMtxImm(identity_mtx, GX_PNMTX0);
+  GXLoadNrmMtxImm(identity_mtx, GX_PNMTX0);
+  GXSetCurrentMtx(GX_PNMTX0);
+  GXLoadTexMtxImm(identity_mtx, GX_IDENTITY, GX_MTX3x4);
+  GXLoadTexMtxImm(identity_mtx, GX_PTIDENTITY, GX_MTX3x4);
+
+  GXSetViewport(0.0f, 0.0f, rmode->fbWidth, rmode->xfbHeight, 0.0f, 1.0f);
+  GXSetCoPlanar(GX_DISABLE);
+  GXSetCullMode(GX_CULL_BACK);
+  GXSetClipMode(GX_CLIP_ENABLE);
+  GXSetScissor(0, 0, rmode->fbWidth, rmode->efbHeight);
+  // GXSetScissorBoxOffset(0, 0);
+
+  GXSetNumChans(0);
+  GXSetChanCtrl(GX_COLOR0A0, GX_DISABLE, GX_SRC_REG, GX_SRC_VTX, GX_LIGHT_NULL, GX_DF_NONE, GX_AF_NONE);
+  GXSetChanAmbColor(GX_COLOR0A0, black);
+  GXSetChanMatColor(GX_COLOR0A0, white);
+  GXSetChanCtrl(GX_COLOR1A1, GX_DISABLE, GX_SRC_REG, GX_SRC_VTX, GX_LIGHT_NULL, GX_DF_NONE, GX_AF_NONE);
+  GXSetChanAmbColor(GX_COLOR1A1, black);
+  GXSetChanMatColor(GX_COLOR1A1, white);
+
+  GXInvalidateTexAll();
+  // __gx->nextTexRgn = 0;
+  // for (i = 0; i < 8; i++)
+  //   GXInitTexCacheRegion(&__gx->TexRegions[i], 0, i * 0x8000, 0, 0x80000 + i * 0x8000, 0);
+  // __gx->nextTexRgnCI = 0;
+  // for (i = 0; i < 4; i++)
+  //   GXInitTexCacheRegion(&__gx->TexRegionsCI[i], 0, (i * 2 + 8) * 0x8000, 0, (i * 2 + 9) * 0x8000, 0);
+  // for (i = 0; i < 16; i++)
+  //   GXInitTlutRegion(&__gx->TlutRegions[i], 0xC0000 + i * 0x2000, 16);
+  // for (i = 0; i < 4; i++)
+  //   GXInitTlutRegion(&__gx->TlutRegions[i + 16], 0xE0000 + i * 0x8000, 64);
+  // GXSetTexRegionCallback(__GXDefaultTexRegionCallback);
+  // GXSetTlutRegionCallback(__GXDefaultTlutRegionCallback);
+
+  GXSetTevOrder(GX_TEVSTAGE0, GX_TEXCOORD0, GX_TEXMAP0, GX_COLOR0A0);
+  GXSetTevOrder(GX_TEVSTAGE1, GX_TEXCOORD1, GX_TEXMAP1, GX_COLOR0A0);
+  GXSetTevOrder(GX_TEVSTAGE2, GX_TEXCOORD2, GX_TEXMAP2, GX_COLOR0A0);
+  GXSetTevOrder(GX_TEVSTAGE3, GX_TEXCOORD3, GX_TEXMAP3, GX_COLOR0A0);
+  GXSetTevOrder(GX_TEVSTAGE4, GX_TEXCOORD4, GX_TEXMAP4, GX_COLOR0A0);
+  GXSetTevOrder(GX_TEVSTAGE5, GX_TEXCOORD5, GX_TEXMAP5, GX_COLOR0A0);
+  GXSetTevOrder(GX_TEVSTAGE6, GX_TEXCOORD6, GX_TEXMAP6, GX_COLOR0A0);
+  GXSetTevOrder(GX_TEVSTAGE7, GX_TEXCOORD7, GX_TEXMAP7, GX_COLOR0A0);
+  GXSetTevOrder(GX_TEVSTAGE8, GX_TEXCOORD_NULL, GX_TEXMAP_NULL, GX_COLOR_NULL);
+  GXSetTevOrder(GX_TEVSTAGE9, GX_TEXCOORD_NULL, GX_TEXMAP_NULL, GX_COLOR_NULL);
+  GXSetTevOrder(GX_TEVSTAGE10, GX_TEXCOORD_NULL, GX_TEXMAP_NULL, GX_COLOR_NULL);
+  GXSetTevOrder(GX_TEVSTAGE11, GX_TEXCOORD_NULL, GX_TEXMAP_NULL, GX_COLOR_NULL);
+  GXSetTevOrder(GX_TEVSTAGE12, GX_TEXCOORD_NULL, GX_TEXMAP_NULL, GX_COLOR_NULL);
+  GXSetTevOrder(GX_TEVSTAGE13, GX_TEXCOORD_NULL, GX_TEXMAP_NULL, GX_COLOR_NULL);
+  GXSetTevOrder(GX_TEVSTAGE14, GX_TEXCOORD_NULL, GX_TEXMAP_NULL, GX_COLOR_NULL);
+  GXSetTevOrder(GX_TEVSTAGE15, GX_TEXCOORD_NULL, GX_TEXMAP_NULL, GX_COLOR_NULL);
+
+  GXSetNumTevStages(1);
+  GXSetTevOp(GX_TEVSTAGE0, GX_REPLACE);
+  GXSetAlphaCompare(GX_ALWAYS, 0, GX_AOP_AND, GX_ALWAYS, 0);
+  GXSetZTexture(GX_ZT_DISABLE, GX_TF_Z8, 0);
+
+  for (i = GX_TEVSTAGE0; i < GX_MAX_TEVSTAGE; i++) {
+    GXSetTevKColorSel(static_cast<GXTevStageID>(i), GX_TEV_KCSEL_1_4);
+    GXSetTevKAlphaSel(static_cast<GXTevStageID>(i), GX_TEV_KASEL_1);
+    GXSetTevSwapMode(static_cast<GXTevStageID>(i), GX_TEV_SWAP0, GX_TEV_SWAP0);
+  }
+  GXSetTevSwapModeTable(GX_TEV_SWAP0, GX_CH_RED, GX_CH_GREEN, GX_CH_BLUE, GX_CH_ALPHA);
+  GXSetTevSwapModeTable(GX_TEV_SWAP1, GX_CH_RED, GX_CH_RED, GX_CH_RED, GX_CH_ALPHA);
+  GXSetTevSwapModeTable(GX_TEV_SWAP2, GX_CH_GREEN, GX_CH_GREEN, GX_CH_GREEN, GX_CH_ALPHA);
+  GXSetTevSwapModeTable(GX_TEV_SWAP3, GX_CH_BLUE, GX_CH_BLUE, GX_CH_BLUE, GX_CH_ALPHA);
+
+  for (i = GX_TEVSTAGE0; i < GX_MAX_TEVSTAGE; i++)
+    GXSetTevDirect(static_cast<GXTevStageID>(i));
+  GXSetNumIndStages(0);
+  GXSetIndTexCoordScale(GX_INDTEXSTAGE0, GX_ITS_1, GX_ITS_1);
+  GXSetIndTexCoordScale(GX_INDTEXSTAGE1, GX_ITS_1, GX_ITS_1);
+  GXSetIndTexCoordScale(GX_INDTEXSTAGE2, GX_ITS_1, GX_ITS_1);
+  GXSetIndTexCoordScale(GX_INDTEXSTAGE3, GX_ITS_1, GX_ITS_1);
+
+  GXSetFog(GX_FOG_NONE, 0.0f, 1.0f, 0.1f, 1.0f, black);
+  GXSetFogRangeAdj(GX_DISABLE, 0, nullptr);
+  GXSetBlendMode(GX_BM_NONE, GX_BL_SRCALPHA, GX_BL_INVSRCALPHA, GX_LO_CLEAR);
+  GXSetColorUpdate(GX_ENABLE);
+  GXSetAlphaUpdate(GX_ENABLE);
+  GXSetZMode(GX_TRUE, GX_LEQUAL, GX_TRUE);
+  GXSetZCompLoc(GX_TRUE);
+  GXSetDither(GX_ENABLE);
+  GXSetDstAlpha(GX_DISABLE, 0);
+  GXSetPixelFmt(GX_PF_RGB8_Z24, GX_ZC_LINEAR);
+  GXSetFieldMask(GX_ENABLE, GX_ENABLE);
+  GXSetFieldMode(rmode->field_rendering, ((rmode->viHeight == 2 * rmode->xfbHeight) ? GX_ENABLE : GX_DISABLE));
+
+  GXSetDispCopySrc(0, 0, rmode->fbWidth, rmode->efbHeight);
+  GXSetDispCopyDst(rmode->fbWidth, rmode->efbHeight);
+  GXSetDispCopyYScale(static_cast<f32>(rmode->xfbHeight) / static_cast<f32>(rmode->efbHeight));
+  // GXSetCopyClamp(static_cast<GXFBClamp>(GX_CLAMP_TOP | GX_CLAMP_BOTTOM));
+  GXSetCopyFilter(rmode->aa, rmode->sample_pattern, GX_TRUE, rmode->vfilter);
+  GXSetDispCopyGamma(GX_GM_1_0);
+  // GXSetDispCopyFrame2Field(GX_COPY_PROGRESSIVE);
+  // GXClearBoundingBox();
+
+  // GXPokeColorUpdate(GX_TRUE);
+  // GXPokeAlphaUpdate(GX_TRUE);
+  // GXPokeDither(GX_FALSE);
+  // GXPokeBlendMode(GX_BM_NONE, GX_BL_ZERO, GX_BL_ONE, GX_LO_SET);
+  // GXPokeAlphaMode(GX_ALWAYS, 0);
+  // GXPokeAlphaRead(GX_READ_FF);
+  // GXPokeDstAlpha(GX_DISABLE, 0);
+  // GXPokeZMode(GX_TRUE, GX_ALWAYS, GX_TRUE);
+
+  return &sFifoObj;
+}
+
+void GXDrawDone() {
+  aurora::gx::fifo::drain();
+  if (DrawDoneCB != nullptr)
+    DrawDoneCB();
+}
+
+void GXSetDrawDone() {
+  aurora::gx::fifo::drain();
+  if (DrawDoneCB != nullptr)
+    DrawDoneCB();
+}
+
+GXDrawDoneCallback GXSetDrawDoneCallback(GXDrawDoneCallback cb) {
+  GXDrawDoneCallback old = DrawDoneCB;
+  DrawDoneCB = cb;
+  return old;
+}
+
+void GXFlush() {
+  if (__gx->dirtyState) {
+    __GXSetDirtyState();
+  }
+}
+
+void GXPixModeSync() {
+  GX_WRITE_RAS_REG(__gx->peCtrl);
+  __gx->bpSent = 1;
+}
+
+void GXTexModeSync() {
+  GX_WRITE_RAS_REG(0x63000000);
+  __gx->bpSent = 1;
+}
+
+// Dirty state flush functions
+
+void __GXSetDirtyState() {
+  if (__gx->dirtyState & 1) {
+    __GXSetSUTexRegs();
+  }
+  if (__gx->dirtyState & 2) {
+    __GXUpdateBPMask();
+  }
+  if (__gx->dirtyState & 4) {
+    __GXSetGenMode();
+  }
+  if (__gx->dirtyState & 8) {
+    __GXSetVCD();
+  }
+  if (__gx->dirtyState & 0x10) {
+    __GXSetVAT();
+  }
+  __gx->dirtyState = 0;
+}
+
+void __GXSetGenMode() {
+  GX_WRITE_RAS_REG(__gx->genMode);
+  __gx->bpSent = 1;
+}
+
+void __GXSendFlushPrim() {
+  // Originally a dummy triangle strip to push the GP through the FIFO and flush pending BP
+  // register changes. We can skip the FIFO writes and just clear the bpSent flag.
+
+  // GX_WRITE_U8(0x98);
+  // GX_WRITE_U16(__gx->vNum);
+  // for (u32 i = 0; i < __gx->vNum * __gx->vLim; i += 4) {
+  //   GX_WRITE_U32(0);
+  // }
+
+  __gx->bpSent = 0;
+}
+
+void __GXSetVCD() {
+  // Write VCD lo and hi to CP registers
+  GX_WRITE_SOME_REG4(8, 0x50, __gx->vcdLo, -12);
+  GX_WRITE_SOME_REG4(8, 0x60, __gx->vcdHi, -12);
+
+  // Write XF vertex specs
+  u32 nCols = 0;
+  nCols = GET_REG_FIELD(__gx->vcdLo, 2, 13) ? 1 : 0;
+  nCols += GET_REG_FIELD(__gx->vcdLo, 2, 15) ? 1 : 0;
+  u32 nNrm = __gx->hasBiNrms ? 2 : __gx->hasNrms ? 1 : 0;
+  u32 nTex = 0;
+  nTex += GET_REG_FIELD(__gx->vcdHi, 2, 0) ? 1 : 0;
+  nTex += GET_REG_FIELD(__gx->vcdHi, 2, 2) ? 1 : 0;
+  nTex += GET_REG_FIELD(__gx->vcdHi, 2, 4) ? 1 : 0;
+  nTex += GET_REG_FIELD(__gx->vcdHi, 2, 6) ? 1 : 0;
+  nTex += GET_REG_FIELD(__gx->vcdHi, 2, 8) ? 1 : 0;
+  nTex += GET_REG_FIELD(__gx->vcdHi, 2, 10) ? 1 : 0;
+  nTex += GET_REG_FIELD(__gx->vcdHi, 2, 12) ? 1 : 0;
+  nTex += GET_REG_FIELD(__gx->vcdHi, 2, 14) ? 1 : 0;
+  u32 reg = (nCols) | (nNrm << 2) | (nTex << 4);
+  GX_WRITE_XF_REG(8, reg);
+  __gx->bpSent = 0;
+
+  // Calculate vertex data limit for flush prim
+  if (__gx->vNum != 0) {
+    static u8 tbl1[] = {0, 4, 1, 2};
+    static u8 tbl2[] = {0, 8, 1, 2};
+    static u8 tbl3[] = {0, 12, 1, 2};
+
+    u32 vl = __gx->vcdLo;
+    u32 vh = __gx->vcdHi;
+    u32 vlm = 0;
+    vlm = GET_REG_FIELD(vl, 1, 0);
+    vlm += static_cast<u8>(GET_REG_FIELD(vl, 1, 1));
+    vlm += static_cast<u8>(GET_REG_FIELD(vl, 1, 2));
+    vlm += static_cast<u8>(GET_REG_FIELD(vl, 1, 3));
+    vlm += static_cast<u8>(GET_REG_FIELD(vl, 1, 4));
+    vlm += static_cast<u8>(GET_REG_FIELD(vl, 1, 5));
+    vlm += static_cast<u8>(GET_REG_FIELD(vl, 1, 6));
+    vlm += static_cast<u8>(GET_REG_FIELD(vl, 1, 7));
+    vlm += static_cast<u8>(GET_REG_FIELD(vl, 1, 8));
+    vlm += tbl3[static_cast<u8>(GET_REG_FIELD(vl, 2, 9))];
+    u32 b = (__gx->hasBiNrms << 1) + 1;
+    vlm += tbl3[static_cast<u8>(GET_REG_FIELD(vl, 2, 11))] * b;
+    vlm += tbl1[static_cast<u8>(GET_REG_FIELD(vl, 2, 13))];
+    vlm += tbl1[static_cast<u8>(GET_REG_FIELD(vl, 2, 15))];
+    vlm += tbl2[static_cast<u8>(GET_REG_FIELD(vh, 2, 0))];
+    vlm += tbl2[static_cast<u8>(GET_REG_FIELD(vh, 2, 2))];
+    vlm += tbl2[static_cast<u8>(GET_REG_FIELD(vh, 2, 4))];
+    vlm += tbl2[static_cast<u8>(GET_REG_FIELD(vh, 2, 6))];
+    vlm += tbl2[static_cast<u8>(GET_REG_FIELD(vh, 2, 8))];
+    vlm += tbl2[static_cast<u8>(GET_REG_FIELD(vh, 2, 10))];
+    vlm += tbl2[static_cast<u8>(GET_REG_FIELD(vh, 2, 12))];
+    vlm += tbl2[static_cast<u8>(GET_REG_FIELD(vh, 2, 14))];
+    __gx->vLim = vlm;
+  }
+}
+
+void __GXSetVAT() {
+  for (u8 i = 0; i < 8; i++) {
+    if (__gx->dirtyVAT & (1 << i)) {
+      GX_WRITE_SOME_REG4(8, i | 0x70, __gx->vatA[i], i - 12);
+      GX_WRITE_SOME_REG4(8, i | 0x80, __gx->vatB[i], i - 12);
+      GX_WRITE_SOME_REG4(8, i | 0x90, __gx->vatC[i], i - 12);
+    }
+  }
+  __gx->dirtyVAT = 0;
+}
+
+static void __SetSURegs(u32 tmap, u32 tcoord) {
+  // Copy texture dimensions from tImage0 to SU registers
+  u32 w = GET_REG_FIELD(__gx->tImage0[tmap], 10, 0);
+  u32 h = GET_REG_FIELD(__gx->tImage0[tmap], 10, 10);
+  SET_REG_FIELD(0, __gx->suTs0[tcoord], 16, 0, w);
+  SET_REG_FIELD(0, __gx->suTs1[tcoord], 16, 0, h);
+  // Bias from wrap mode
+  u8 s_bias = GET_REG_FIELD(__gx->tMode0[tmap], 2, 0) == 1;
+  u8 t_bias = GET_REG_FIELD(__gx->tMode0[tmap], 2, 2) == 1;
+  SET_REG_FIELD(0, __gx->suTs0[tcoord], 1, 16, s_bias);
+  SET_REG_FIELD(0, __gx->suTs1[tcoord], 1, 16, t_bias);
+  GX_WRITE_RAS_REG(__gx->suTs0[tcoord]);
+  GX_WRITE_RAS_REG(__gx->suTs1[tcoord]);
+  __gx->bpSent = 1;
+}
+
+void __GXSetSUTexRegs() {
+  // SU texture size/bias registers for each active TEV and indirect stage, skipping coords with
+  // manual scale (tcsManEnab). If all coords are manual (0xFF), skip entirely.
+  if (__gx->tcsManEnab == 0xFF) {
+    return;
+  }
+
+  u32 nStages = GET_REG_FIELD(__gx->genMode, 4, 10) + 1;
+  u32 nIndStages = GET_REG_FIELD(__gx->genMode, 3, 16);
+
+  // Indirect texture stages
+  for (u32 i = 0; i < nIndStages; i++) {
+    u32 tmap, coord;
+    switch (i) {
+    case 0:
+      tmap = GET_REG_FIELD(__gx->iref, 3, 0);
+      coord = GET_REG_FIELD(__gx->iref, 3, 3);
+      break;
+    case 1:
+      tmap = GET_REG_FIELD(__gx->iref, 3, 6);
+      coord = GET_REG_FIELD(__gx->iref, 3, 9);
+      break;
+    case 2:
+      tmap = GET_REG_FIELD(__gx->iref, 3, 12);
+      coord = GET_REG_FIELD(__gx->iref, 3, 15);
+      break;
+    default:
+      tmap = GET_REG_FIELD(__gx->iref, 3, 18);
+      coord = GET_REG_FIELD(__gx->iref, 3, 21);
+      break;
+    }
+    if (!(__gx->tcsManEnab & (1 << coord))) {
+      __SetSURegs(tmap, coord);
+    }
+  }
+
+  // Direct TEV stages
+  for (u32 i = 0; i < nStages; i++) {
+    u32* ptref = &__gx->tref[i / 2];
+    u32 map = __gx->texmapId[i];
+    u32 tmap = map & ~0x100u;
+    u32 coord;
+    if (i & 1) {
+      coord = GET_REG_FIELD(*ptref, 3, 15);
+    } else {
+      coord = GET_REG_FIELD(*ptref, 3, 3);
+    }
+    if (tmap != 0xFF && !(__gx->tcsManEnab & (1 << coord)) && (__gx->texmapValid & (1u << i))) {
+      __SetSURegs(tmap, coord);
+    }
+  }
+}
+
+void __GXUpdateBPMask() {
+  // Mark texture maps used by indirect texture stages in the BP mask
+  u32 nIndStages = GET_REG_FIELD(__gx->genMode, 3, 16);
+  u32 newImask = 0;
+
+  for (u32 i = 0; i < nIndStages; i++) {
+    u32 tmap = GET_REG_FIELD(__gx->iref, 3, i * 6);
+    newImask |= 1u << tmap;
+  }
+
+  if (static_cast<u8>(__gx->bpMask) != static_cast<u8>(newImask)) {
+    SET_REG_FIELD(0, __gx->bpMask, 8, 0, newImask);
+    GX_WRITE_RAS_REG(__gx->bpMask);
+    __gx->bpSent = 1;
+  }
+}
+
+void __GXSetMatrixIndex(GXAttr matIdxAttr) {
+  if (matIdxAttr < GX_VA_TEX4MTXIDX) {
+    GX_WRITE_SOME_REG4(8, 0x30, __gx->matIdxA, -12);
+    GX_WRITE_XF_REG(24, __gx->matIdxA);
+  } else {
+    GX_WRITE_SOME_REG4(8, 0x40, __gx->matIdxB, -12);
+    GX_WRITE_XF_REG(25, __gx->matIdxB);
+  }
+  __gx->bpSent = 0;
+}
+};
diff --git a/aurora-main/lib/dolphin/gx/GXPixel.cpp b/aurora-main/lib/dolphin/gx/GXPixel.cpp
new file mode 100644
index 0000000..d4f3fb5
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXPixel.cpp
@@ -0,0 +1,247 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+#include <cmath>
+
+extern "C" {
+void GXSetFog(GXFogType type, float startZ, float endZ, float nearZ, float farZ, GXColor color) {
+  // Compute fog coefficients matching SDK.
+  const bool orthographic = (static_cast<u32>(type) & 0x8u) != 0;
+  f32 a = 0.0f;
+  f32 c = 0.0f;
+  u32 b_m = 0;
+  u32 b_s = 0;
+
+  if (!orthographic) {
+    f32 A;
+    f32 B;
+    f32 C;
+    if (farZ == nearZ || endZ == startZ) {
+      A = 0.0f;
+      B = 0.5f;
+      C = 0.0f;
+    } else {
+      A = (farZ * nearZ) / ((farZ - nearZ) * (endZ - startZ));
+      B = farZ / (farZ - nearZ);
+      C = startZ / (endZ - startZ);
+    }
+
+    // Normalize B mantissa.
+    f32 B_mant = B;
+    int B_expn = 0;
+    while (B_mant > 1.0f) {
+      B_mant *= 0.5f;
+      B_expn++;
+    }
+    while (B_mant > 0.0f && B_mant < 0.5f) {
+      B_mant *= 2.0f;
+      B_expn--;
+    }
+
+    a = std::ldexp(A, -(B_expn + 1));
+    b_m = static_cast<u32>(8.388638e6f * B_mant);
+    b_s = static_cast<u32>(B_expn + 1) & 0x1Fu;
+    c = C;
+  } else if (farZ != nearZ && endZ != startZ) {
+    const f32 invDepthRange = 1.0f / (endZ - startZ);
+    a = invDepthRange * (farZ - nearZ);
+    c = invDepthRange * (startZ - nearZ);
+  }
+
+  u32 a_hex, c_hex;
+  std::memcpy(&a_hex, &a, sizeof(a_hex));
+  std::memcpy(&c_hex, &c, sizeof(c_hex));
+
+  // BP FOG0 (0xEE) - A parameter
+  u32 fog0 = 0;
+  SET_REG_FIELD(0, fog0, 11, 0, (a_hex >> 12) & 0x7FF);
+  SET_REG_FIELD(0, fog0, 8, 11, (a_hex >> 23) & 0xFF);
+  SET_REG_FIELD(0, fog0, 1, 19, (a_hex >> 31));
+  SET_REG_FIELD(0, fog0, 8, 24, 0xEE);
+
+  // BP FOG1 (0xEF) - B mantissa
+  u32 fog1 = 0;
+  SET_REG_FIELD(0, fog1, 24, 0, b_m);
+  SET_REG_FIELD(0, fog1, 8, 24, 0xEF);
+
+  // BP FOG2 (0xF0) - B scale
+  u32 fog2 = 0;
+  SET_REG_FIELD(0, fog2, 5, 0, b_s);
+  SET_REG_FIELD(0, fog2, 8, 24, 0xF0);
+
+  // BP FOG3 (0xF1) - C parameter + type
+  u32 fog3 = 0;
+  SET_REG_FIELD(0, fog3, 11, 0, (c_hex >> 12) & 0x7FF);
+  SET_REG_FIELD(0, fog3, 8, 11, (c_hex >> 23) & 0xFF);
+  SET_REG_FIELD(0, fog3, 1, 19, (c_hex >> 31));
+  SET_REG_FIELD(0, fog3, 1, 20, orthographic ? 1 : 0);
+  SET_REG_FIELD(0, fog3, 3, 21, static_cast<u32>(type) & 0x7u);
+  SET_REG_FIELD(0, fog3, 8, 24, 0xF1);
+
+  // BP FOGCLR (0xF2) - color
+  u32 fogclr = 0;
+  SET_REG_FIELD(0, fogclr, 8, 0, color.b);
+  SET_REG_FIELD(0, fogclr, 8, 8, color.g);
+  SET_REG_FIELD(0, fogclr, 8, 16, color.r);
+  SET_REG_FIELD(0, fogclr, 8, 24, 0xF2);
+
+  GX_WRITE_RAS_REG(fog0);
+  GX_WRITE_RAS_REG(fog1);
+  GX_WRITE_RAS_REG(fog2);
+  GX_WRITE_RAS_REG(fog3);
+  GX_WRITE_RAS_REG(fogclr);
+  __gx->bpSent = 1;
+}
+
+void GXSetFogColor(GXColor color) {
+  // BP FOGCLR (0xF2)
+  u32 fogclr = 0;
+  SET_REG_FIELD(0, fogclr, 8, 0, color.b);
+  SET_REG_FIELD(0, fogclr, 8, 8, color.g);
+  SET_REG_FIELD(0, fogclr, 8, 16, color.r);
+  SET_REG_FIELD(0, fogclr, 8, 24, 0xF2);
+  GX_WRITE_RAS_REG(fogclr);
+  __gx->bpSent = 1;
+}
+
+void GXSetFogRangeAdj(GXBool enable, u16 center, GXFogAdjTable* table) {
+  u32 i;
+  u32 range_adj;
+  u32 range_c;
+
+  if (enable) {
+    for (i = 0; i < 10; i += 2) {
+      range_adj = 0;
+      SET_REG_FIELD(0x10D, range_adj, 12, 0, table->r[i]);
+      SET_REG_FIELD(0x10E, range_adj, 12, 12, table->r[i + 1]);
+      SET_REG_FIELD(0x10F, range_adj, 8, 24, (i >> 1) + 0xE9);
+      GX_WRITE_RAS_REG(range_adj);
+    }
+  }
+  range_c = 0;
+  SET_REG_FIELD(0x115, range_c, 10, 0, center + 342);
+  SET_REG_FIELD(0x116, range_c, 1, 10, enable);
+  SET_REG_FIELD(0x117, range_c, 8, 24, 0xE8);
+  GX_WRITE_RAS_REG(range_c);
+  __gx->bpSent = 1;
+}
+
+void GXSetBlendMode(GXBlendMode mode, GXBlendFactor src, GXBlendFactor dst, GXLogicOp op) {
+  SET_REG_FIELD(0, __gx->cmode0, 1, 0, (mode == GX_BM_BLEND || mode == GX_BM_SUBTRACT));
+  SET_REG_FIELD(0, __gx->cmode0, 1, 11, (mode == GX_BM_SUBTRACT));
+  SET_REG_FIELD(0, __gx->cmode0, 1, 1, (mode == GX_BM_LOGIC));
+  SET_REG_FIELD(0, __gx->cmode0, 4, 12, op);
+  SET_REG_FIELD(0, __gx->cmode0, 3, 8, src);
+  SET_REG_FIELD(0, __gx->cmode0, 3, 5, dst);
+  GX_WRITE_RAS_REG(__gx->cmode0);
+  __gx->bpSent = 1;
+}
+
+void GXSetColorUpdate(GXBool enabled) {
+  SET_REG_FIELD(0, __gx->cmode0, 1, 3, enabled);
+  GX_WRITE_RAS_REG(__gx->cmode0);
+  __gx->bpSent = 1;
+}
+
+void GXSetAlphaUpdate(bool enabled) {
+  SET_REG_FIELD(0, __gx->cmode0, 1, 4, enabled);
+  GX_WRITE_RAS_REG(__gx->cmode0);
+  __gx->bpSent = 1;
+}
+
+void GXSetZMode(bool compare_enable, GXCompare func, bool update_enable) {
+  SET_REG_FIELD(0, __gx->zmode, 1, 0, compare_enable);
+  SET_REG_FIELD(0, __gx->zmode, 3, 1, func);
+  SET_REG_FIELD(0, __gx->zmode, 1, 4, update_enable);
+  GX_WRITE_RAS_REG(__gx->zmode);
+  __gx->bpSent = 1;
+}
+
+void GXSetZCompLoc(GXBool before_tex) {
+  SET_REG_FIELD(0, __gx->peCtrl, 1, 6, before_tex);
+  GX_WRITE_RAS_REG(__gx->peCtrl);
+  __gx->bpSent = 1;
+}
+
+void GXSetPixelFmt(GXPixelFmt pix_fmt, GXZFmt16 z_fmt) {
+  u32 oldPeCtrl = __gx->peCtrl;
+  u8 hwPixelFmt = 0;
+
+  switch (pix_fmt) {
+  case GX_PF_RGB8_Z24:
+    hwPixelFmt = 0;
+    break;
+  case GX_PF_RGBA6_Z24:
+    hwPixelFmt = 1;
+    break;
+  case GX_PF_RGB565_Z16:
+    hwPixelFmt = 2;
+    break;
+  case GX_PF_Z24:
+    hwPixelFmt = 3;
+    break;
+  case GX_PF_Y8:
+  case GX_PF_U8:
+  case GX_PF_V8:
+    hwPixelFmt = 4;
+    break;
+  case GX_PF_YUV420:
+    hwPixelFmt = 5;
+    break;
+  default:
+    UNLIKELY FATAL("GXSetPixelFmt: unsupported pixel format {}", static_cast<u32>(pix_fmt));
+  }
+
+  SET_REG_FIELD(0, __gx->peCtrl, 3, 0, hwPixelFmt);
+  SET_REG_FIELD(0, __gx->peCtrl, 3, 3, z_fmt);
+  if (oldPeCtrl != __gx->peCtrl) {
+    GX_WRITE_RAS_REG(__gx->peCtrl);
+    SET_REG_FIELD(0, __gx->genMode, 1, 9, pix_fmt == GX_PF_RGB565_Z16);
+    __gx->dirtyState |= 4;
+  }
+
+  if (hwPixelFmt == 4) {
+    SET_REG_FIELD(0, __gx->cmode1, 2, 9, (static_cast<u32>(pix_fmt) - GX_PF_Y8) & 0x3);
+    GX_WRITE_RAS_REG(__gx->cmode1);
+  }
+
+  __gx->bpSent = 1;
+}
+
+void GXSetDither(GXBool dither) {
+  SET_REG_FIELD(0, __gx->cmode0, 1, 2, dither);
+  GX_WRITE_RAS_REG(__gx->cmode0);
+  __gx->bpSent = 1;
+}
+
+void GXSetDstAlpha(bool enabled, u8 value) {
+  SET_REG_FIELD(0, __gx->cmode1, 8, 0, value);
+  SET_REG_FIELD(0, __gx->cmode1, 1, 8, enabled);
+  GX_WRITE_RAS_REG(__gx->cmode1);
+  __gx->bpSent = 1;
+}
+
+void GXSetFieldMask(GXBool odd_mask, GXBool even_mask) {
+  u32 reg;
+
+  reg = 0;
+  SET_REG_FIELD(0x1FB, reg, 1, 0, even_mask);
+  SET_REG_FIELD(0x1FC, reg, 1, 1, odd_mask);
+  SET_REG_FIELD(0x1FD, reg, 8, 24, 0x44);
+  GX_WRITE_RAS_REG(reg);
+  __gx->bpSent = 1;
+}
+
+void GXSetFieldMode(GXBool field_mode, GXBool half_aspect_ratio) {
+  u32 reg;
+
+  SET_REG_FIELD(0x21A, __gx->lpSize, 1, 22, half_aspect_ratio);
+  GX_WRITE_RAS_REG(__gx->lpSize);
+  __GXFlushTextureState();
+
+  SET_REG_FIELD(0, reg, 8, 24, 0x68);
+  SET_REG_FIELD(0, reg, 1, 0, field_mode);
+  GX_WRITE_RAS_REG(reg);
+  __GXFlushTextureState();
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXTev.cpp b/aurora-main/lib/dolphin/gx/GXTev.cpp
new file mode 100644
index 0000000..8b021fe
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXTev.cpp
@@ -0,0 +1,267 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+extern "C" {
+void GXSetTevOp(GXTevStageID id, GXTevMode mode) {
+  GXTevColorArg inputColor = GX_CC_RASC;
+  GXTevAlphaArg inputAlpha = GX_CA_RASA;
+  if (id != GX_TEVSTAGE0) {
+    inputColor = GX_CC_CPREV;
+    inputAlpha = GX_CA_APREV;
+  }
+  switch (mode) {
+  case GX_MODULATE:
+    GXSetTevColorIn(id, GX_CC_ZERO, GX_CC_TEXC, inputColor, GX_CC_ZERO);
+    GXSetTevAlphaIn(id, GX_CA_ZERO, GX_CA_TEXA, inputAlpha, GX_CA_ZERO);
+    break;
+  case GX_DECAL:
+    GXSetTevColorIn(id, inputColor, GX_CC_TEXC, GX_CC_TEXA, GX_CC_ZERO);
+    GXSetTevAlphaIn(id, GX_CA_ZERO, GX_CA_ZERO, GX_CA_ZERO, inputAlpha);
+    break;
+  case GX_BLEND:
+    GXSetTevColorIn(id, inputColor, GX_CC_ONE, GX_CC_TEXC, GX_CC_ZERO);
+    GXSetTevAlphaIn(id, GX_CA_ZERO, GX_CA_TEXA, inputAlpha, GX_CA_ZERO);
+    break;
+  case GX_REPLACE:
+    GXSetTevColorIn(id, GX_CC_ZERO, GX_CC_ZERO, GX_CC_ZERO, GX_CC_TEXC);
+    GXSetTevAlphaIn(id, GX_CA_ZERO, GX_CA_ZERO, GX_CA_ZERO, GX_CA_TEXA);
+    break;
+  case GX_PASSCLR:
+    GXSetTevColorIn(id, GX_CC_ZERO, GX_CC_ZERO, GX_CC_ZERO, inputColor);
+    GXSetTevAlphaIn(id, GX_CA_ZERO, GX_CA_ZERO, GX_CA_ZERO, inputAlpha);
+    break;
+  }
+  GXSetTevColorOp(id, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, GX_TRUE, GX_TEVPREV);
+  GXSetTevAlphaOp(id, GX_TEV_ADD, GX_TB_ZERO, GX_CS_SCALE_1, GX_TRUE, GX_TEVPREV);
+}
+
+void GXSetTevColorIn(GXTevStageID stageId, GXTevColorArg a, GXTevColorArg b, GXTevColorArg c, GXTevColorArg d) {
+  u32* reg = &__gx->tevc[stageId];
+  SET_REG_FIELD(0, *reg, 4, 12, a);
+  SET_REG_FIELD(0, *reg, 4, 8, b);
+  SET_REG_FIELD(0, *reg, 4, 4, c);
+  SET_REG_FIELD(0, *reg, 4, 0, d);
+  GX_WRITE_RAS_REG(*reg);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevAlphaIn(GXTevStageID stageId, GXTevAlphaArg a, GXTevAlphaArg b, GXTevAlphaArg c, GXTevAlphaArg d) {
+  u32* reg = &__gx->teva[stageId];
+  SET_REG_FIELD(0, *reg, 3, 13, a);
+  SET_REG_FIELD(0, *reg, 3, 10, b);
+  SET_REG_FIELD(0, *reg, 3, 7, c);
+  SET_REG_FIELD(0, *reg, 3, 4, d);
+  GX_WRITE_RAS_REG(*reg);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevColorOp(GXTevStageID stageId, GXTevOp op, GXTevBias bias, GXTevScale scale, bool clamp,
+                     GXTevRegID outReg) {
+  u32* reg = &__gx->tevc[stageId];
+  SET_REG_FIELD(0, *reg, 1, 18, op & 1);
+  if (op <= 1) {
+    SET_REG_FIELD(0, *reg, 2, 20, scale);
+    SET_REG_FIELD(0, *reg, 2, 16, bias);
+  } else {
+    SET_REG_FIELD(0, *reg, 2, 20, (op >> 1) & 3);
+    SET_REG_FIELD(0, *reg, 2, 16, 3);
+  }
+  SET_REG_FIELD(0, *reg, 1, 19, clamp);
+  SET_REG_FIELD(0, *reg, 2, 22, outReg);
+  GX_WRITE_RAS_REG(*reg);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevAlphaOp(GXTevStageID stageId, GXTevOp op, GXTevBias bias, GXTevScale scale, bool clamp,
+                     GXTevRegID outReg) {
+  u32* reg = &__gx->teva[stageId];
+  SET_REG_FIELD(0, *reg, 1, 18, op & 1);
+  if (op <= 1) {
+    SET_REG_FIELD(0, *reg, 2, 20, scale);
+    SET_REG_FIELD(0, *reg, 2, 16, bias);
+  } else {
+    SET_REG_FIELD(0, *reg, 2, 20, (op >> 1) & 3);
+    SET_REG_FIELD(0, *reg, 2, 16, 3);
+  }
+  SET_REG_FIELD(0, *reg, 1, 19, clamp);
+  SET_REG_FIELD(0, *reg, 2, 22, outReg);
+  GX_WRITE_RAS_REG(*reg);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevColor(GXTevRegID id, GXColor color) {
+  CHECK(id >= GX_TEVPREV && id < GX_MAX_TEVREG, "bad tevreg {}", static_cast<int>(id));
+
+  // Write BP registers (RA + BG pairs) - needed for display list capture
+  u32 regRA = 0;
+  SET_REG_FIELD(0, regRA, 11, 0, color.r);
+  SET_REG_FIELD(0, regRA, 11, 12, color.a);
+  SET_REG_FIELD(0, regRA, 8, 24, 0xE0 + id * 2);
+  u32 regBG = 0;
+  SET_REG_FIELD(0, regBG, 11, 0, color.b);
+  SET_REG_FIELD(0, regBG, 11, 12, color.g);
+  SET_REG_FIELD(0, regBG, 8, 24, 0xE1 + id * 2);
+  GX_WRITE_RAS_REG(regRA);
+  GX_WRITE_RAS_REG(regBG);
+  // NOTE: the SDK writes regBG three more times here for hardware timing. The value does not
+  // change and our software command processor needs no sync delay, so skip them.
+  __gx->bpSent = 1;
+}
+
+void GXSetTevColorS10(GXTevRegID id, GXColorS10 color) {
+  // Write BP registers (RA + BG pairs) - needed for display list capture
+  u32 regRA = 0;
+  SET_REG_FIELD(0, regRA, 11, 0, color.r & 0x7FF);
+  SET_REG_FIELD(0, regRA, 11, 12, color.a & 0x7FF);
+  SET_REG_FIELD(0, regRA, 8, 24, 0xE0 + id * 2);
+  u32 regBG = 0;
+  SET_REG_FIELD(0, regBG, 11, 0, color.b & 0x7FF);
+  SET_REG_FIELD(0, regBG, 11, 12, color.g & 0x7FF);
+  SET_REG_FIELD(0, regBG, 8, 24, 0xE1 + id * 2);
+  GX_WRITE_RAS_REG(regRA);
+  GX_WRITE_RAS_REG(regBG);
+  // NOTE: the SDK writes regBG three more times here for hardware timing. The value does not
+  // change and our software command processor needs no sync delay, so skip them.
+  __gx->bpSent = 1;
+}
+
+void GXSetAlphaCompare(GXCompare comp0, u8 ref0, GXAlphaOp op, GXCompare comp1, u8 ref1) {
+  // BP register 0xF3
+  u32 reg = 0;
+  SET_REG_FIELD(0, reg, 8, 0, ref0);
+  SET_REG_FIELD(0, reg, 8, 8, ref1);
+  SET_REG_FIELD(0, reg, 3, 16, comp0);
+  SET_REG_FIELD(0, reg, 3, 19, comp1);
+  SET_REG_FIELD(0, reg, 2, 22, op);
+  SET_REG_FIELD(0, reg, 8, 24, 0xF3);
+  GX_WRITE_RAS_REG(reg);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevOrder(GXTevStageID id, GXTexCoordID tcid, GXTexMapID tmid, GXChannelID cid) {
+  // Channel ID mapping to hardware register values
+  static const u8 c2r[] = {0, 1, 0, 1, 0, 1, 7, 5, 6};
+  u32* ptref = &__gx->tref[id / 2];
+  __gx->texmapId[id] = tmid;
+
+  u32 tmap = tmid & ~0x100u;
+  tmap = (tmap >= GX_MAX_TEXMAP) ? GX_TEXMAP0 : tmap;
+  const bool texCoordValid = tcid < GX_MAX_TEXCOORD;
+  if (texCoordValid) {
+    __gx->texmapValid |= 1u << id;
+  } else {
+    __gx->texmapValid &= ~(1u << id);
+  }
+  u32 tcoord = texCoordValid ? tcid : GX_TEXCOORD0;
+  u32 chanHw = (cid == GX_COLOR_NULL) ? 7 : c2r[cid];
+
+  if (id & 1) {
+    SET_REG_FIELD(0, *ptref, 3, 12, tmap);
+    SET_REG_FIELD(0, *ptref, 3, 15, tcoord);
+    SET_REG_FIELD(0, *ptref, 3, 19, chanHw);
+    SET_REG_FIELD(0, *ptref, 1, 18, (tmid != GX_TEXMAP_NULL && !(tmid & 0x100)));
+  } else {
+    SET_REG_FIELD(0, *ptref, 3, 0, tmap);
+    SET_REG_FIELD(0, *ptref, 3, 3, tcoord);
+    SET_REG_FIELD(0, *ptref, 3, 7, chanHw);
+    SET_REG_FIELD(0, *ptref, 1, 6, (tmid != GX_TEXMAP_NULL && !(tmid & 0x100)));
+  }
+
+  GX_WRITE_RAS_REG(*ptref);
+  __gx->bpSent = 1;
+  __gx->dirtyState |= 1; // SU tex regs dirty
+}
+
+void GXSetZTexture(GXZTexOp op, GXTexFmt fmt, u32 bias) {
+  u32 zfmt;
+  switch (fmt) {
+  case GX_TF_Z8:
+    zfmt = 0;
+    break;
+  case GX_TF_Z16:
+    zfmt = 1;
+    break;
+  case GX_TF_Z24X8:
+    zfmt = 2;
+    break;
+  default:
+    zfmt = 2;
+    break;
+  }
+
+  GX_WRITE_RAS_REG(0xF4000000u | (bias & 0x00FFFFFFu));
+  GX_WRITE_RAS_REG(0xF5000000u | ((static_cast<u32>(op) & 0x3u) << 2) | (zfmt & 0x3u));
+  __gx->bpSent = 1;
+}
+
+void GXSetNumTevStages(u8 num) {
+  SET_REG_FIELD(0, __gx->genMode, 4, 10, num - 1);
+  __gx->dirtyState |= 4; // gen mode dirty
+}
+
+void GXSetTevKColor(GXTevKColorID id, GXColor color) {
+  CHECK(id >= GX_KCOLOR0 && id < GX_MAX_KCOLOR, "bad kcolor {}", static_cast<int>(id));
+
+  // Write BP registers (RA + BG pairs with bit 23 set for K color)
+  u32 regRA = 0;
+  SET_REG_FIELD(0, regRA, 8, 0, color.r);
+  SET_REG_FIELD(0, regRA, 8, 12, color.a);
+  SET_REG_FIELD(0, regRA, 4, 20, 8); // K color flag
+  SET_REG_FIELD(0, regRA, 8, 24, 0xE0 + id * 2);
+  u32 regBG = 0;
+  SET_REG_FIELD(0, regBG, 8, 0, color.b);
+  SET_REG_FIELD(0, regBG, 8, 12, color.g);
+  SET_REG_FIELD(0, regBG, 4, 20, 8); // K color flag
+  SET_REG_FIELD(0, regBG, 8, 24, 0xE1 + id * 2);
+  GX_WRITE_RAS_REG(regRA);
+  GX_WRITE_RAS_REG(regBG);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevKColorSel(GXTevStageID id, GXTevKColorSel sel) {
+  // tevKsel registers: 2 stages per register
+  u32 kselIdx = id / 2;
+  if (id & 1) {
+    SET_REG_FIELD(0, __gx->tevKsel[kselIdx], 5, 14, sel);
+  } else {
+    SET_REG_FIELD(0, __gx->tevKsel[kselIdx], 5, 4, sel);
+  }
+  GX_WRITE_RAS_REG(__gx->tevKsel[kselIdx]);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevKAlphaSel(GXTevStageID id, GXTevKAlphaSel sel) {
+  u32 kselIdx = id / 2;
+  if (id & 1) {
+    SET_REG_FIELD(0, __gx->tevKsel[kselIdx], 5, 19, sel);
+  } else {
+    SET_REG_FIELD(0, __gx->tevKsel[kselIdx], 5, 9, sel);
+  }
+  GX_WRITE_RAS_REG(__gx->tevKsel[kselIdx]);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevSwapMode(GXTevStageID stageId, GXTevSwapSel rasSel, GXTevSwapSel texSel) {
+  // Swap mode is stored in teva register
+  u32* reg = &__gx->teva[stageId];
+  SET_REG_FIELD(0, *reg, 2, 0, rasSel);
+  SET_REG_FIELD(0, *reg, 2, 2, texSel);
+  GX_WRITE_RAS_REG(*reg);
+  __gx->bpSent = 1;
+}
+
+void GXSetTevSwapModeTable(GXTevSwapSel id, GXTevColorChan red, GXTevColorChan green, GXTevColorChan blue,
+                           GXTevColorChan alpha) {
+  CHECK(id >= GX_TEV_SWAP0 && id < GX_MAX_TEVSWAP, "bad tev swap sel {}", static_cast<int>(id));
+  // Swap table is stored in tevKsel registers
+  u32 kselIdx = id * 2;
+  SET_REG_FIELD(0, __gx->tevKsel[kselIdx], 2, 0, red);
+  SET_REG_FIELD(0, __gx->tevKsel[kselIdx], 2, 2, green);
+  GX_WRITE_RAS_REG(__gx->tevKsel[kselIdx]);
+
+  SET_REG_FIELD(0, __gx->tevKsel[kselIdx + 1], 2, 0, blue);
+  SET_REG_FIELD(0, __gx->tevKsel[kselIdx + 1], 2, 2, alpha);
+  GX_WRITE_RAS_REG(__gx->tevKsel[kselIdx + 1]);
+  __gx->bpSent = 1;
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXTexture.cpp b/aurora-main/lib/dolphin/gx/GXTexture.cpp
new file mode 100644
index 0000000..684ba79
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXTexture.cpp
@@ -0,0 +1,484 @@
+#include "gx.hpp"
+#include "__gx.h"
+
+#include "../../gfx/texture.hpp"
+#include "../../gfx/texture_replacement.hpp"
+#include "dolphin/gx/GXAurora.h"
+
+#include <absl/container/flat_hash_map.h>
+
+#include <algorithm>
+#include <cstddef>
+#include <utility>
+
+#include "tracy/Tracy.hpp"
+
+namespace {
+constexpr u8 GXTexMode0Ids[8] = {0x80, 0x81, 0x82, 0x83, 0xA0, 0xA1, 0xA2, 0xA3};
+constexpr u8 GXTexMode1Ids[8] = {0x84, 0x85, 0x86, 0x87, 0xA4, 0xA5, 0xA6, 0xA7};
+constexpr u8 GXTexImage0Ids[8] = {0x88, 0x89, 0x8A, 0x8B, 0xA8, 0xA9, 0xAA, 0xAB};
+constexpr u8 GXTexImage1Ids[8] = {0x8C, 0x8D, 0x8E, 0x8F, 0xAC, 0xAD, 0xAE, 0xAF};
+constexpr u8 GXTexImage2Ids[8] = {0x90, 0x91, 0x92, 0x93, 0xB0, 0xB1, 0xB2, 0xB3};
+constexpr u8 GXTexImage3Ids[8] = {0x94, 0x95, 0x96, 0x97, 0xB4, 0xB5, 0xB6, 0xB7};
+constexpr u8 GXTexTlutIds[8] = {0x98, 0x99, 0x9A, 0x9B, 0xB8, 0xB9, 0xBA, 0xBB};
+constexpr u8 GX2HWFiltConv[6] = {0x00, 0x04, 0x01, 0x05, 0x02, 0x06};
+
+u32 sNextTexObjId = 1;
+u32 sNextTlutObjId = 1;
+
+u32 next_tex_obj_id() {
+  if (sNextTexObjId == 0) {
+    FATAL("texObj ID overflow");
+  }
+  return sNextTexObjId++;
+}
+
+u32 next_tlut_obj_id() {
+  if (sNextTlutObjId == 0) {
+    FATAL("tlutObj ID overflow");
+  }
+  return sNextTlutObjId++;
+}
+
+  // Give each palette buffer a stable ID so its GPU cache can be reused.
+struct TlutIdentity {
+  const void* data = nullptr;
+  u32 format = 0;
+  u32 entries = 0;
+
+  bool operator==(const TlutIdentity& rhs) const noexcept {
+    return data == rhs.data && format == rhs.format && entries == rhs.entries;
+  }
+
+  template <typename H>
+  friend H AbslHashValue(H h, const TlutIdentity& key) {
+    return H::combine(std::move(h), key.data, key.format, key.entries);
+  }
+};
+
+struct TlutIdentityRecord {
+  u32 objId = 0;
+  u32 dataVersion = 0;
+  u64 digest = 0;
+};
+
+  // Limit cached palette IDs; evicted palettes are safely uploaded again.
+constexpr size_t MaxTlutIdentities = 4096;
+absl::flat_hash_map<TlutIdentity, TlutIdentityRecord> sTlutIdentities;
+
+  // Use separate high-range versions when a palette points to a new buffer.
+u32 sNextRepointedTlutDataVersion = 0;
+
+u32 next_repointed_tlut_data_version() {
+  if (sNextRepointedTlutDataVersion == 0x7FFFFFFFu) {
+    sNextRepointedTlutDataVersion = 0;
+  }
+  return 0x80000000u | ++sNextRepointedTlutDataVersion;
+}
+
+std::pair<u32, u32> resolve_tlut_identity(const void* data, GXTlutFmt format, u16 entries) {
+  if (data == nullptr || entries == 0) {
+    return {next_tlut_obj_id(), 1};
+  }
+
+  const auto digest =
+      static_cast<u64>(aurora::xxh3_hash_s(data, static_cast<size_t>(entries) * sizeof(u16)));
+  if (sTlutIdentities.size() >= MaxTlutIdentities) {
+    sTlutIdentities.clear();
+  }
+
+  const TlutIdentity key{
+      .data = data,
+      .format = static_cast<u32>(format),
+      .entries = entries,
+  };
+  auto [it, inserted] = sTlutIdentities.try_emplace(key);
+  auto& record = it->second;
+  if (inserted) {
+    record.objId = next_tlut_obj_id();
+    record.dataVersion = 1;
+    record.digest = digest;
+  } else if (record.digest != digest) {
+    // Same buffer, different palette: invalidate everything keyed on this ID.
+    record.digest = digest;
+    if (record.dataVersion >= 0x7FFFFFFFu) {
+      record.dataVersion = 1;
+    } else {
+      ++record.dataVersion;
+    }
+  }
+  return {record.objId, record.dataVersion};
+}
+
+int __cntlzw(unsigned int val) {
+  if (val == 0)
+    return 32; // PowerPC returns 32 if the input is 0
+#ifdef _MSC_VER
+  unsigned long idx;
+  _BitScanReverse(&idx, val);
+  return 31 - (int)idx;
+#else
+  return __builtin_clz(val);
+#endif
+}
+
+void init_texobj_common(GXTexObj_& obj, const void* data, u16 width, u16 height, u32 format, GXTexWrapMode wrapS,
+                        GXTexWrapMode wrapT, GXBool mipmap) {
+  obj = {};
+  obj.mWidth = width;
+  obj.mHeight = height;
+  obj.mFormat = format;
+  obj.tlut = GX_TLUT0;
+  obj.flags = 2;
+  obj.texObjId = next_tex_obj_id();
+  obj.texDataVersion = 1;
+
+  SET_REG_FIELD(0, obj.mode0, 2, 0, wrapS);
+  SET_REG_FIELD(0, obj.mode0, 2, 2, wrapT);
+  SET_REG_FIELD(0, obj.mode0, 1, 4, 1);
+  if (mipmap) {
+    obj.flags |= 1;
+    obj.mode0 = (obj.mode0 & 0xFFFFFF1F) | 0xC0;
+    const u32 maxDim = std::max(width, height);
+    const u8 lmax = static_cast<u8>(16.0f * static_cast<float>(31 - __cntlzw(maxDim)));
+    SET_REG_FIELD(0, obj.mode1, 8, 8, lmax);
+  } else {
+    obj.mode0 = (obj.mode0 & 0xFFFFFF1F) | 0x80;
+  }
+  SET_REG_FIELD(0, obj.image0, 10, 0, static_cast<u32>(width - 1));
+  SET_REG_FIELD(0, obj.image0, 10, 10, static_cast<u32>(height - 1));
+  SET_REG_FIELD(0, obj.image0, 4, 20, format & 0xF);
+
+  obj.data = data;
+}
+
+void emit_loaded_texobj_metadata(const GXTexObj_& obj, GXTexMapID id) {
+  GX_WRITE_AURORA(GX_LOAD_AURORA_TEXOBJ);
+  GX_WRITE_U8(static_cast<u8>(id));
+  GX_WRITE_U64(reinterpret_cast<u64>(obj.data));
+  GX_WRITE_U32(obj.width());
+  GX_WRITE_U32(obj.height());
+  GX_WRITE_U32(obj.format());
+  GX_WRITE_U32(static_cast<u32>(obj.tlut));
+  GX_WRITE_U8(static_cast<u8>(obj.has_mips()));
+  GX_WRITE_U32(obj.texObjId);
+  GX_WRITE_U32(obj.texDataVersion);
+}
+
+void emit_loaded_tlut_metadata(const GXTlutObj_& obj, u32 idx) {
+  GX_WRITE_AURORA(GX_LOAD_AURORA_TLUT);
+  GX_WRITE_U8(static_cast<u8>(idx));
+  GX_WRITE_U64(reinterpret_cast<u64>(obj.data));
+  GX_WRITE_U32(static_cast<u32>(obj.format));
+  GX_WRITE_U16(obj.numEntries);
+  GX_WRITE_U32(obj.tlutObjId);
+  GX_WRITE_U32(obj.tlutDataVersion);
+}
+} // namespace
+
+extern "C" {
+void GXInitTexObj(GXTexObj* obj_, const void* data, u16 width, u16 height, GXTexFmt format, GXTexWrapMode wrapS,
+                  GXTexWrapMode wrapT, GXBool mipmap) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  init_texobj_common(*obj, data, width, height, format, wrapS, wrapT, mipmap);
+}
+
+void GXInitTexObjCI(GXTexObj* obj_, const void* data, u16 width, u16 height, GXCITexFmt format, GXTexWrapMode wrapS,
+                    GXTexWrapMode wrapT, GXBool mipmap, u32 tlut) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  init_texobj_common(*obj, data, width, height, format, wrapS, wrapT, mipmap);
+  obj->tlut = static_cast<GXTlut>(tlut);
+  obj->flags &= ~2u;
+}
+
+void GXInitTexObjLOD(GXTexObj* obj_, GXTexFilter minFilt, GXTexFilter magFilt, float minLod, float maxLod,
+                     float lodBias, GXBool biasClamp, GXBool doEdgeLod, GXAnisotropy maxAniso) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  const float clampedBias = std::clamp(lodBias, -4.0f, 3.99f);
+  const auto lbias = static_cast<u8>(32.0f * clampedBias);
+  SET_REG_FIELD(0, obj->mode0, 8, 9, lbias);
+  SET_REG_FIELD(0, obj->mode0, 1, 4, magFilt == GX_LINEAR ? 1 : 0);
+  SET_REG_FIELD(0, obj->mode0, 3, 5, GX2HWFiltConv[minFilt]);
+  SET_REG_FIELD(0, obj->mode0, 1, 8, doEdgeLod ? 0 : 1);
+  obj->mode0 &= 0xFFFDFFFF;
+  obj->mode0 &= 0xFFFBFFFF;
+  SET_REG_FIELD(0, obj->mode0, 2, 19, maxAniso);
+  SET_REG_FIELD(0, obj->mode0, 1, 21, biasClamp);
+
+  const auto clampedMin = std::clamp(minLod, 0.0f, 10.0f);
+  const auto clampedMax = std::clamp(maxLod, 0.0f, 10.0f);
+  SET_REG_FIELD(0, obj->mode1, 8, 0, static_cast<u8>(16.0f * clampedMin));
+  SET_REG_FIELD(0, obj->mode1, 8, 8, static_cast<u8>(16.0f * clampedMax));
+}
+
+void GXInitTexObjData(GXTexObj* obj_, const void* data) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  obj->data = data;
+  ++obj->texDataVersion;
+}
+
+void GXInitTexObjWrapMode(GXTexObj* obj_, GXTexWrapMode wrapS, GXTexWrapMode wrapT) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  SET_REG_FIELD(0, obj->mode0, 2, 0, wrapS);
+  SET_REG_FIELD(0, obj->mode0, 2, 2, wrapT);
+}
+
+void GXInitTexObjTlut(GXTexObj* obj_, u32 tlut) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  obj->tlut = static_cast<GXTlut>(tlut);
+}
+
+void GXInitTexObjFilter(GXTexObj* obj_, GXTexFilter minFilt, GXTexFilter magFilt) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  SET_REG_FIELD(0, obj->mode0, 3, 5, GX2HWFiltConv[minFilt]);
+  SET_REG_FIELD(0, obj->mode0, 1, 4, magFilt == GX_LINEAR ? 1 : 0);
+}
+
+void GXInitTexObjMaxLOD(GXTexObj* obj_, float maxLod) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  const auto clampedMax = std::clamp(maxLod, 0.0f, 10.0f);
+  SET_REG_FIELD(0, obj->mode1, 8, 8, static_cast<u8>(16.0f * clampedMax));
+}
+
+void GXInitTexObjMinLOD(GXTexObj* obj_, float minLod) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  const auto clampedMin = std::clamp(minLod, 0.0f, 10.0f);
+  SET_REG_FIELD(0, obj->mode1, 8, 0, static_cast<u8>(16.0f * clampedMin));
+}
+
+void GXInitTexObjLODBias(GXTexObj* obj_, float lodBias) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  const float clampedBias = std::clamp(lodBias, -4.0f, 3.99f);
+  const auto lbias = static_cast<u8>(32.0f * clampedBias);
+  SET_REG_FIELD(0, obj->mode0, 8, 9, lbias);
+}
+
+void GXInitTexObjBiasClamp(GXTexObj* obj_, GXBool biasClamp) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  SET_REG_FIELD(0, obj->mode0, 1, 21, biasClamp);
+}
+
+void GXInitTexObjEdgeLOD(GXTexObj* obj_, GXBool doEdgeLod) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  SET_REG_FIELD(0, obj->mode0, 1, 8, doEdgeLod ? 0 : 1);
+}
+
+void GXInitTexObjMaxAniso(GXTexObj* obj_, GXAnisotropy maxAniso) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  SET_REG_FIELD(0, obj->mode0, 2, 19, maxAniso);
+}
+
+void GXInitTexObjUserData(GXTexObj* obj_, void* userData) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  obj->userData = userData;
+}
+
+void* GXGetTexObjUserData(const GXTexObj* obj_) {
+  const auto* obj = reinterpret_cast<const GXTexObj_*>(obj_);
+  return const_cast<void*>(obj->userData);
+}
+
+void GXLoadTexObj(GXTexObj* obj_, GXTexMapID id) {
+  auto* obj = reinterpret_cast<GXTexObj_*>(obj_);
+  SET_REG_FIELD(0, obj->mode0, 8, 24, GXTexMode0Ids[id]);
+  SET_REG_FIELD(0, obj->mode1, 8, 24, GXTexMode1Ids[id]);
+  SET_REG_FIELD(0, obj->image0, 8, 24, GXTexImage0Ids[id]);
+
+  u32 image1 = 0;
+  u32 image2 = 0;
+  SET_REG_FIELD(0, image1, 8, 24, GXTexImage1Ids[id]);
+  SET_REG_FIELD(0, image2, 8, 24, GXTexImage2Ids[id]);
+  SET_REG_FIELD(0, obj->image3, 8, 24, GXTexImage3Ids[id]);
+
+  GX_WRITE_RAS_REG(obj->mode0);
+  GX_WRITE_RAS_REG(obj->mode1);
+  GX_WRITE_RAS_REG(obj->image0);
+  GX_WRITE_RAS_REG(image1);
+  GX_WRITE_RAS_REG(image2);
+  GX_WRITE_RAS_REG(obj->image3);
+
+  if ((obj->flags & 2) == 0) {
+    u32 tlut = 0;
+    SET_REG_FIELD(0, tlut, 10, 0, static_cast<u32>(obj->tlut));
+    SET_REG_FIELD(0, tlut, 8, 24, GXTexTlutIds[id]);
+    GX_WRITE_RAS_REG(tlut);
+  }
+
+  __gx->tImage0[id] = obj->image0;
+  __gx->tMode0[id] = obj->mode0;
+  __gx->dirtyState |= 1;
+  __gx->bpSent = 1;
+
+  emit_loaded_texobj_metadata(*obj, id);
+}
+
+u32 GXGetTexBufferSize(u16 width, u16 height, u32 fmt, GXBool mips, u8 maxLod) {
+  if (fmt == GX_TF_R8_PC || fmt == GX_TF_RGBA8_PC) {
+    const u32 bytesPerPixel = fmt == GX_TF_R8_PC ? 1u : 4u;
+    const u32 mipCount = mips ? static_cast<u32>(maxLod) + 1u : 1u;
+    u64 byteCount = 0;
+    for (u32 mip = 0; mip < mipCount; ++mip) {
+      byteCount += static_cast<u64>(width) * height * bytesPerPixel;
+      if (width == 1 && height == 1) {
+        break;
+      }
+      width = std::max<u16>(width / 2, 1);
+      height = std::max<u16>(height / 2, 1);
+    }
+    CHECK(byteCount <= UINT32_MAX, "GXGetTexBufferSize: linear PC texture is too large ({} bytes)", byteCount);
+    return static_cast<u32>(byteCount);
+  }
+
+  s32 shiftX = 0;
+  s32 shiftY = 0;
+  switch (fmt) {
+  case GX_TF_I4:
+  case GX_TF_C4:
+  case GX_TF_CMPR:
+  case GX_CTF_R4:
+  case GX_CTF_Z4:
+    shiftX = 3;
+    shiftY = 3;
+    break;
+  case GX_TF_I8:
+  case GX_TF_IA4:
+  case GX_TF_C8:
+  case GX_TF_Z8:
+  case GX_CTF_RA4:
+  case GX_CTF_A8:
+  case GX_CTF_R8:
+  case GX_CTF_G8:
+  case GX_CTF_B8:
+  case GX_CTF_Z8M:
+  case GX_CTF_Z8L:
+    shiftX = 3;
+    shiftY = 2;
+    break;
+  case GX_TF_IA8:
+  case GX_TF_RGB565:
+  case GX_TF_RGB5A3:
+  case GX_TF_RGBA8:
+  case GX_TF_C14X2:
+  case GX_TF_Z16:
+  case GX_TF_Z24X8:
+  case GX_CTF_RA8:
+  case GX_CTF_RG8:
+  case GX_CTF_GB8:
+  case GX_CTF_Z16L:
+    shiftX = 2;
+    shiftY = 2;
+    break;
+  default:
+    break;
+  }
+  u32 bitSize = fmt == GX_TF_RGBA8 || fmt == GX_TF_Z24X8 ? 64 : 32;
+  u32 bufLen = 0;
+  if (mips) {
+    const u32 mipCount = static_cast<u32>(maxLod) + 1;
+    for (u32 mip = 0; mip < mipCount; ++mip) {
+      const u32 tileX = ((width + (1 << shiftX) - 1) >> shiftX);
+      const u32 tileY = ((height + (1 << shiftY) - 1) >> shiftY);
+      bufLen += bitSize * tileX * tileY;
+
+      if (width == 1 && height == 1) {
+        return bufLen;
+      }
+
+      width = (width < 2) ? 1 : width / 2;
+      height = (height < 2) ? 1 : height / 2;
+    }
+  } else {
+    const u32 tileX = ((width + (1 << shiftX) - 1) >> shiftX);
+    const u32 tileY = ((height + (1 << shiftY) - 1) >> shiftY);
+    bufLen = bitSize * tileX * tileY;
+  }
+
+  return bufLen;
+}
+
+void GXInitTlutObj(GXTlutObj* obj_, const void* data, GXTlutFmt format, u16 entries) {
+  memset(obj_, 0, sizeof(GXTlutObj));
+  auto* obj = reinterpret_cast<GXTlutObj_*>(obj_);
+  obj->data = data;
+  obj->format = format;
+  obj->numEntries = entries;
+  const auto [tlutObjId, tlutDataVersion] = resolve_tlut_identity(data, format, entries);
+  obj->tlutObjId = tlutObjId;
+  obj->tlutDataVersion = tlutDataVersion;
+
+  SET_REG_FIELD(0, obj->tlut, 2, 10, format);
+  SET_REG_FIELD(0, obj->loadTlut0, 8, 24, 0x64);
+  aurora::gfx::texture_replacement::register_tlut(obj_, data, format, entries);
+}
+
+void GXInitTlutObjData(GXTlutObj* obj_, const void* data) {
+  auto* obj = reinterpret_cast<GXTlutObj_*>(obj_);
+  obj->data = data;
+  obj->tlutDataVersion = next_repointed_tlut_data_version();
+}
+
+void GXLoadTlut(const GXTlutObj* obj_, u32 idx) {
+  auto* obj = reinterpret_cast<const GXTlutObj_*>(obj_);
+  __GXFlushTextureState();
+  GX_WRITE_RAS_REG(obj->loadTlut0);
+
+  u32 loadTlut1 = 0;
+  SET_REG_FIELD(0, loadTlut1, 10, 0, idx);
+  SET_REG_FIELD(0, loadTlut1, 10, 10, obj->numEntries - 1);
+  SET_REG_FIELD(0, loadTlut1, 8, 24, 0x65);
+  GX_WRITE_RAS_REG(loadTlut1);
+  __GXFlushTextureState();
+
+  aurora::gfx::texture_replacement::load_tlut(obj_, idx);
+  emit_loaded_tlut_metadata(*obj, idx);
+}
+
+// TODO GXInitTexCacheRegion
+// TODO GXInitTexPreLoadRegion
+// TODO GXInitTlutRegion
+// TODO GXInvalidateTexRegion
+
+void GXInvalidateTexAll() {
+  GX_WRITE_AURORA(GX_LOAD_AURORA_INVALIDATE_TEX_ALL);
+}
+
+// TODO GXPreLoadEntireTexture
+// TODO GXSetTexRegionCallback
+// TODO GXSetTlutRegionCallback
+// TODO GXLoadTexObjPreLoaded
+void GXSetTexCoordScaleManually(GXTexCoordID coord, GXBool enable, u16 ss, u16 ts) {
+  __gx->tcsManEnab = (__gx->tcsManEnab & ~(1 << coord)) | (enable << coord);
+  if (enable) {
+    SET_REG_FIELD(0, __gx->suTs0[coord], 16, 0, static_cast<u16>(ss - 1));
+    SET_REG_FIELD(0, __gx->suTs1[coord], 16, 0, static_cast<u16>(ts - 1));
+    GX_WRITE_RAS_REG(__gx->suTs0[coord]);
+    GX_WRITE_RAS_REG(__gx->suTs1[coord]);
+    __gx->bpSent = 1;
+  }
+}
+
+void GXSetTexCoordCylWrap(GXTexCoordID coord, GXBool s_enable, GXBool t_enable) {
+  SET_REG_FIELD(0, __gx->suTs0[coord], 1, 17, s_enable);
+  SET_REG_FIELD(0, __gx->suTs1[coord], 1, 17, t_enable);
+  if (__gx->tcsManEnab & (1 << coord)) {
+    GX_WRITE_RAS_REG(__gx->suTs0[coord]);
+    GX_WRITE_RAS_REG(__gx->suTs1[coord]);
+    __gx->bpSent = 1;
+  }
+}
+
+void GXSetTexCoordBias(GXTexCoordID coord, GXBool s_enable, GXBool t_enable) {
+  SET_REG_FIELD(0, __gx->suTs0[coord], 1, 16, s_enable);
+  SET_REG_FIELD(0, __gx->suTs1[coord], 1, 16, t_enable);
+  if (__gx->tcsManEnab & (1 << coord)) {
+    GX_WRITE_RAS_REG(__gx->suTs0[coord]);
+    GX_WRITE_RAS_REG(__gx->suTs1[coord]);
+    __gx->bpSent = 1;
+  }
+}
+
+void __GXFlushTextureState() {
+  GX_WRITE_RAS_REG(__gx->bpMask);
+  __gx->bpSent = 1;
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXTransform.cpp b/aurora-main/lib/dolphin/gx/GXTransform.cpp
new file mode 100644
index 0000000..b881d38
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXTransform.cpp
@@ -0,0 +1,216 @@
+#include "gx.hpp"
+#include "__gx.h"
+#include "dolphin/mtx/GeoTypes.h"
+
+static inline void CacheProjectionVector(const f32* ptr, GXProjectionType type) {
+  __gx->projType = type;
+  for (int i = 0; i < 6; ++i) {
+    __gx->projMtx[i] = ptr[i + 1];
+  }
+}
+
+extern "C" {
+
+void GXSetProjection(const void* mtx_, GXProjectionType type) {
+  const auto& mtx = *reinterpret_cast<const aurora::Mat4x4<float>*>(mtx_);
+  const f32 projVec[] = {
+      static_cast<f32>(type == GX_ORTHOGRAPHIC),
+      mtx[0][0],
+      type == GX_ORTHOGRAPHIC ? mtx[0][3] : mtx[0][2],
+      mtx[1][1],
+      type == GX_ORTHOGRAPHIC ? mtx[1][3] : mtx[1][2],
+      mtx[2][2],
+      mtx[2][3],
+  };
+  CacheProjectionVector(projVec, type);
+
+  // XF bulk write: 6 params + projection type at 0x1020-0x1026
+  GX_WRITE_U8(0x10);
+  GX_WRITE_U32(0x00061020);
+  GX_WRITE_XF_REG_F(32, __gx->projMtx[0]);
+  GX_WRITE_XF_REG_F(33, __gx->projMtx[1]);
+  GX_WRITE_XF_REG_F(34, __gx->projMtx[2]);
+  GX_WRITE_XF_REG_F(35, __gx->projMtx[3]);
+  GX_WRITE_XF_REG_F(36, __gx->projMtx[4]);
+  GX_WRITE_XF_REG_F(37, __gx->projMtx[5]);
+  GX_WRITE_XF_REG_2(38, __gx->projType);
+  __gx->bpSent = 0;
+}
+
+void GXSetProjectionv(const f32* ptr) {
+  CHECK(ptr != nullptr, "null projection vector");
+
+  const GXProjectionType type = ptr[0] == 0.0f ? GX_PERSPECTIVE : GX_ORTHOGRAPHIC;
+  CacheProjectionVector(ptr, type);
+
+  // XF bulk write: 6 params + projection type at 0x1020-0x1026
+  GX_WRITE_U8(0x10);
+  GX_WRITE_U32(0x00061020);
+  for (int i = 0; i < 6; ++i) {
+    GX_WRITE_F32(__gx->projMtx[i]);
+  }
+  GX_WRITE_U32(__gx->projType);
+  __gx->bpSent = 0;
+}
+
+void GXLoadPosMtxImm(const void* mtx_, u32 id) {
+  CHECK(id >= GX_PNMTX0 && id <= GX_PNMTX9, "invalid pn mtx {}", static_cast<int>(id));
+  const auto* mtx = reinterpret_cast<const f32*>(mtx_);
+
+  GX_WRITE_U8(0x10);
+  GX_WRITE_U32((id * 4) | 0xB0000);
+  for (int i = 0; i < 12; i++) {
+    GX_WRITE_F32(mtx[i]);
+  }
+}
+
+void GXLoadNrmMtxImm(const void* mtx_, u32 id) {
+  CHECK(id >= GX_PNMTX0 && id <= GX_PNMTX9, "invalid pn mtx {}", static_cast<int>(id));
+  const auto* mtx = reinterpret_cast<const f32*>(mtx_);
+
+  GX_WRITE_U8(0x10);
+  GX_WRITE_U32((id * 3 + 0x400) | 0x80000);
+  // Write 3x3 from 3x4 matrix (skip translation column)
+  GX_WRITE_F32(mtx[0]);
+  GX_WRITE_F32(mtx[1]);
+  GX_WRITE_F32(mtx[2]);
+  GX_WRITE_F32(mtx[4]);
+  GX_WRITE_F32(mtx[5]);
+  GX_WRITE_F32(mtx[6]);
+  GX_WRITE_F32(mtx[8]);
+  GX_WRITE_F32(mtx[9]);
+  GX_WRITE_F32(mtx[10]);
+}
+
+void GXSetCurrentMtx(u32 id) {
+  CHECK(id >= GX_PNMTX0 && id <= GX_PNMTX9, "invalid pn mtx {}", id);
+  SET_REG_FIELD(0, __gx->matIdxA, 6, 0, id);
+  __GXSetMatrixIndex(GX_VA_PNMTXIDX);
+}
+
+void GXLoadTexMtxImm(const void* mtx_, u32 id, GXTexMtxType type) {
+  CHECK((id >= GX_TEXMTX0 && id <= GX_IDENTITY) || (id >= GX_PTTEXMTX0 && id <= GX_PTIDENTITY), "invalid tex mtx {}",
+        id);
+
+  u32 addr;
+  if (id >= GX_PTTEXMTX0) {
+    addr = (id - GX_PTTEXMTX0) * 4 + 0x500;
+    CHECK(type == GX_MTX3x4, "invalid pt mtx type {}", underlying(type));
+  } else {
+    addr = id * 4;
+  }
+
+  u32 count = (type == GX_MTX2x4) ? 8 : 12;
+  u32 reg = addr | ((count - 1) << 16);
+
+  GX_WRITE_U8(0x10);
+  GX_WRITE_U32(reg);
+
+  const auto* mtx = reinterpret_cast<const f32*>(mtx_);
+  for (u32 i = 0; i < count; i++) {
+    GX_WRITE_F32(mtx[i]);
+  }
+}
+
+void GXSetViewport(float left, float top, float width, float height, float nearZ, float farZ) {
+  GXSetViewportJitter(left, top, width, height, nearZ, farZ, 1);
+}
+
+void GXSetViewportJitter(float left, float top, float width, float height, float nearZ, float farZ, u32 field) {
+  float sx;
+  float sy;
+  float sz;
+  float ox;
+  float oy;
+  float oz;
+  float zmin;
+  float zmax;
+
+  if (field == 0) {
+    top -= 0.5f;
+  }
+
+  sx = width / 2.0f;
+  sy = -height / 2.0f;
+  ox = 340.0f + (left + width / 2.0f);
+  oy = 340.0f + (top + height / 2.0f);
+  zmin = 1.6777215e7f * nearZ;
+  zmax = 1.6777215e7f * farZ;
+  sz = zmax - zmin;
+  oz = zmax;
+
+  __gx->vpLeft = left;
+  __gx->vpTop = top;
+  __gx->vpWd = width;
+  __gx->vpHt = height;
+  __gx->vpNearz = nearZ;
+  __gx->vpFarz = farZ;
+
+  GX_WRITE_U8(0x10);
+  GX_WRITE_U32(0x0005101A);
+  GX_WRITE_XF_REG_F(26, sx);
+  GX_WRITE_XF_REG_F(27, sy);
+  GX_WRITE_XF_REG_F(28, sz);
+  GX_WRITE_XF_REG_F(29, ox);
+  GX_WRITE_XF_REG_F(30, oy);
+  GX_WRITE_XF_REG_F(31, oz);
+  __gx->bpSent = 0;
+}
+
+void GXProject(f32 x, f32 y, f32 z, const f32 mtx[3][4], const f32* pm, const f32* vp, f32* sx,
+               f32* sy, f32* sz) {
+  Vec peye;
+  f32 xc;
+  f32 yc;
+  f32 zc;
+  f32 wc;
+
+  peye.x = mtx[0][3] + ((mtx[0][2] * z) + ((mtx[0][0] * x) + (mtx[0][1] * y)));
+  peye.y = mtx[1][3] + ((mtx[1][2] * z) + ((mtx[1][0] * x) + (mtx[1][1] * y)));
+  peye.z = mtx[2][3] + ((mtx[2][2] * z) + ((mtx[2][0] * x) + (mtx[2][1] * y)));
+  if (pm[0] == 0.0f) {
+    xc = (peye.x * pm[1]) + (peye.z * pm[2]);
+    yc = (peye.y * pm[3]) + (peye.z * pm[4]);
+    zc = pm[6] + (peye.z * pm[5]);
+    wc = 1.0f / -peye.z;
+  } else {
+    xc = pm[2] + (peye.x * pm[1]);
+    yc = pm[4] + (peye.y * pm[3]);
+    zc = pm[6] + (peye.z * pm[5]);
+    wc = 1.0f;
+  }
+  *sx = (vp[2] / 2.0f) + (vp[0] + (wc * (xc * vp[2] / 2.0f)));
+  *sy = (vp[3] / 2.0f) + (vp[1] + (wc * (-yc * vp[3] / 2.0f)));
+  *sz = vp[5] + (wc * (zc * (vp[5] - vp[4])));
+}
+
+// TODO GXLoadPosMtxIndx
+// TODO GXLoadNrmMtxImm3x3
+// TODO GXLoadNrmMtxIndx3x3
+// TODO GXLoadTexMtxIndx
+void GXSetZScaleOffset(f32 scale, f32 offset) {
+  g_gxState.zScale = scale;
+  g_gxState.zOffset = offset;
+  constexpr f32 z24Scale = 16777215.0f;
+  const f32 sz = z24Scale * offset;
+  const f32 oz = 1.0f + z24Scale * scale;
+
+  GX_WRITE_U8(0x10);
+  GX_WRITE_U32(0x101c);
+  GX_WRITE_F32(sz);
+  GX_WRITE_U8(0x10);
+  GX_WRITE_U32(0x101f);
+  GX_WRITE_F32(oz);
+  __gx->bpSent = 0;
+}
+
+void GXSetScissorBoxOffset(s32 x_off, s32 y_off) {
+  g_gxState.scissorOffsetX = x_off;
+  g_gxState.scissorOffsetY = y_off;
+
+  const u32 reg = 0x59000000u | (((static_cast<u32>(y_off + 0x156) * 0x200u) & 0x000ffc00u)) |
+                  ((static_cast<u32>(x_off + 0x156) >> 1) & 0x000003ffu);
+  GX_WRITE_RAS_REG(reg);
+  __gx->bpSent = 0;
+}
+}
diff --git a/aurora-main/lib/dolphin/gx/GXVert.cpp b/aurora-main/lib/dolphin/gx/GXVert.cpp
new file mode 100644
index 0000000..6f71945
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/GXVert.cpp
@@ -0,0 +1,733 @@
+#include "gx.hpp"
+#include "__gx.h"
+#include "../../gx/fifo.hpp"
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <cstdint>
+#include <limits>
+
+// Track vertex count between GXBegin/GXEnd for mismatch detection
+static u16 sBeginNVerts = 0;
+static u32 sBeginFifoSize = 0;
+static GXPrimitive sBeginPrimitive = GX_TRIANGLES;
+static GXVtxFmt sBeginVtxFmt = GX_VTXFMT0;
+static bool sInBegin = false;
+static GXAttr sWriteAttr = GX_VA_NULL;
+static u32 sWriteAttrComps = 0;
+
+namespace {
+
+static u8 normal_frac_bits(GXCompType type) {
+  switch (type) {
+  case GX_U8:
+    return 7;
+  case GX_S8:
+    return 6;
+  case GX_U16:
+    return 15;
+  case GX_S16:
+    return 14;
+  default:
+    return 0;
+  }
+}
+
+struct ActiveAttrFmt {
+  GXCompCnt cnt = GX_POS_XYZ;
+  GXCompType type = GX_F32;
+  u8 frac = 0;
+};
+
+enum class ScalarKind {
+  Float,
+  Signed,
+  Unsigned,
+};
+
+struct Scalar {
+  ScalarKind kind = ScalarKind::Float;
+  float f = 0.0f;
+  int32_t s = 0;
+  uint32_t u = 0;
+};
+
+static Scalar scalar_f32(float value) {
+  return Scalar{.kind = ScalarKind::Float, .f = value, .s = static_cast<int32_t>(value), .u = static_cast<uint32_t>(value)};
+}
+
+static Scalar scalar_u32(uint32_t value) {
+  return Scalar{.kind = ScalarKind::Unsigned, .f = static_cast<float>(value), .s = static_cast<int32_t>(value), .u = value};
+}
+
+static Scalar scalar_s32(int32_t value) {
+  return Scalar{.kind = ScalarKind::Signed, .f = static_cast<float>(value), .s = value, .u = static_cast<uint32_t>(value)};
+}
+
+static bool is_matrix_index_attr(GXAttr attr) {
+  return attr >= GX_VA_PNMTXIDX && attr <= GX_VA_TEX7MTXIDX;
+}
+
+static bool is_color_attr(GXAttr attr) {
+  return attr == GX_VA_CLR0 || attr == GX_VA_CLR1;
+}
+
+static bool is_tex_attr(GXAttr attr) {
+  return attr >= GX_VA_TEX0 && attr <= GX_VA_TEX7;
+}
+
+static GXAttrType active_attr_type(GXAttr attr) {
+  switch (attr) {
+  case GX_VA_PNMTXIDX:
+  case GX_VA_TEX0MTXIDX:
+  case GX_VA_TEX1MTXIDX:
+  case GX_VA_TEX2MTXIDX:
+  case GX_VA_TEX3MTXIDX:
+  case GX_VA_TEX4MTXIDX:
+  case GX_VA_TEX5MTXIDX:
+  case GX_VA_TEX6MTXIDX:
+  case GX_VA_TEX7MTXIDX:
+    return GET_REG_FIELD(__gx->vcdLo, 1, underlying(attr)) ? GX_DIRECT : GX_NONE;
+  case GX_VA_POS:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdLo, 2, 9));
+  case GX_VA_NRM:
+    return (__gx->hasNrms || __gx->hasBiNrms) ? static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdLo, 2, 11)) : GX_NONE;
+  case GX_VA_CLR0:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdLo, 2, 13));
+  case GX_VA_CLR1:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdLo, 2, 15));
+  case GX_VA_TEX0:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdHi, 2, 0));
+  case GX_VA_TEX1:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdHi, 2, 2));
+  case GX_VA_TEX2:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdHi, 2, 4));
+  case GX_VA_TEX3:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdHi, 2, 6));
+  case GX_VA_TEX4:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdHi, 2, 8));
+  case GX_VA_TEX5:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdHi, 2, 10));
+  case GX_VA_TEX6:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdHi, 2, 12));
+  case GX_VA_TEX7:
+    return static_cast<GXAttrType>(GET_REG_FIELD(__gx->vcdHi, 2, 14));
+  default:
+    return GX_NONE;
+  }
+}
+
+static ActiveAttrFmt active_attr_fmt(GXVtxFmt fmt, GXAttr attr) {
+  ActiveAttrFmt out{};
+  const u32 va = __gx->vatA[fmt];
+  const u32 vb = __gx->vatB[fmt];
+  const u32 vc = __gx->vatC[fmt];
+
+  switch (attr) {
+  case GX_VA_POS:
+    out.cnt = GET_REG_FIELD(va, 1, 0) ? GX_POS_XYZ : GX_POS_XY;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 1));
+    out.frac = static_cast<u8>(GET_REG_FIELD(va, 5, 4));
+    break;
+  case GX_VA_NRM:
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 10));
+    if (GET_REG_FIELD(va, 1, 31)) {
+      out.cnt = GX_NRM_NBT3;
+    } else {
+      out.cnt = GET_REG_FIELD(va, 1, 9) ? GX_NRM_NBT : GX_NRM_XYZ;
+    }
+    out.frac = normal_frac_bits(out.type);
+    break;
+  case GX_VA_CLR0:
+    out.cnt = GET_REG_FIELD(va, 1, 13) ? GX_CLR_RGBA : GX_CLR_RGB;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 14));
+    out.frac = 0;
+    break;
+  case GX_VA_CLR1:
+    out.cnt = GET_REG_FIELD(va, 1, 17) ? GX_CLR_RGBA : GX_CLR_RGB;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 18));
+    out.frac = 0;
+    break;
+  case GX_VA_TEX0:
+    out.cnt = GET_REG_FIELD(va, 1, 21) ? GX_TEX_ST : GX_TEX_S;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(va, 3, 22));
+    out.frac = static_cast<u8>(GET_REG_FIELD(va, 5, 25));
+    break;
+  case GX_VA_TEX1:
+    out.cnt = GET_REG_FIELD(vb, 1, 0) ? GX_TEX_ST : GX_TEX_S;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(vb, 3, 1));
+    out.frac = static_cast<u8>(GET_REG_FIELD(vb, 5, 4));
+    break;
+  case GX_VA_TEX2:
+    out.cnt = GET_REG_FIELD(vb, 1, 9) ? GX_TEX_ST : GX_TEX_S;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(vb, 3, 10));
+    out.frac = static_cast<u8>(GET_REG_FIELD(vb, 5, 13));
+    break;
+  case GX_VA_TEX3:
+    out.cnt = GET_REG_FIELD(vb, 1, 18) ? GX_TEX_ST : GX_TEX_S;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(vb, 3, 19));
+    out.frac = static_cast<u8>(GET_REG_FIELD(vb, 5, 22));
+    break;
+  case GX_VA_TEX4:
+    out.cnt = GET_REG_FIELD(vb, 1, 27) ? GX_TEX_ST : GX_TEX_S;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(vb, 3, 28));
+    out.frac = static_cast<u8>(GET_REG_FIELD(vc, 5, 0));
+    break;
+  case GX_VA_TEX5:
+    out.cnt = GET_REG_FIELD(vc, 1, 5) ? GX_TEX_ST : GX_TEX_S;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(vc, 3, 6));
+    out.frac = static_cast<u8>(GET_REG_FIELD(vc, 5, 9));
+    break;
+  case GX_VA_TEX6:
+    out.cnt = GET_REG_FIELD(vc, 1, 14) ? GX_TEX_ST : GX_TEX_S;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(vc, 3, 15));
+    out.frac = static_cast<u8>(GET_REG_FIELD(vc, 5, 18));
+    break;
+  case GX_VA_TEX7:
+    out.cnt = GET_REG_FIELD(vc, 1, 23) ? GX_TEX_ST : GX_TEX_S;
+    out.type = static_cast<GXCompType>(GET_REG_FIELD(vc, 3, 24));
+    out.frac = static_cast<u8>(GET_REG_FIELD(vc, 5, 27));
+    break;
+  default:
+    break;
+  }
+  return out;
+}
+
+static u32 expected_component_count(GXAttr attr, const ActiveAttrFmt& fmt, GXAttrType type) {
+  if (is_matrix_index_attr(attr) || is_color_attr(attr)) {
+    return 1;
+  }
+  if (type == GX_INDEX8 || type == GX_INDEX16) {
+    return (attr == GX_VA_NRM && fmt.cnt == GX_NRM_NBT3) ? 3u : 1u;
+  }
+  if (attr == GX_VA_POS) {
+    return fmt.cnt == GX_POS_XY ? 2u : 3u;
+  }
+  if (attr == GX_VA_NRM) {
+    return (fmt.cnt == GX_NRM_NBT || fmt.cnt == GX_NRM_NBT3) ? 9u : 3u;
+  }
+  if (is_tex_attr(attr)) {
+    return fmt.cnt == GX_TEX_S ? 1u : 2u;
+  }
+  return 1;
+}
+
+  // Cache decoded vertex settings and refresh them when their GX registers change.
+struct AttrCacheEntry {
+  ActiveAttrFmt fmt{};
+  GXAttrType type = GX_NONE;
+  u32 expected = 1;
+  GXAttr next = GX_VA_NULL;
+};
+
+struct VtxStateCache {
+  bool valid = false;
+  GXVtxFmt vtxFmt = GX_VTXFMT0;
+  u32 vcdLo = 0;
+  u32 vcdHi = 0;
+  u32 vatA = 0;
+  u32 vatB = 0;
+  u32 vatC = 0;
+  u8 hasNrms = 0;
+  u8 hasBiNrms = 0;
+  GXAttr first = GX_VA_NULL;
+  std::array<AttrCacheEntry, GX_VA_MAX_ATTR> attrs{};
+};
+
+static VtxStateCache sVtxCache;
+
+static void rebuild_vtx_cache(GXVtxFmt vtxFmt) {
+  sVtxCache.valid = true;
+  sVtxCache.vtxFmt = vtxFmt;
+  sVtxCache.vcdLo = __gx->vcdLo;
+  sVtxCache.vcdHi = __gx->vcdHi;
+  sVtxCache.vatA = __gx->vatA[vtxFmt];
+  sVtxCache.vatB = __gx->vatB[vtxFmt];
+  sVtxCache.vatC = __gx->vatC[vtxFmt];
+  sVtxCache.hasNrms = __gx->hasNrms;
+  sVtxCache.hasBiNrms = __gx->hasBiNrms;
+
+  for (int i = 0; i < GX_VA_MAX_ATTR; ++i) {
+    const auto attr = static_cast<GXAttr>(i);
+    AttrCacheEntry& entry = sVtxCache.attrs[i];
+    entry.type = active_attr_type(attr);
+    entry.fmt = active_attr_fmt(vtxFmt, attr);
+    entry.expected = expected_component_count(attr, entry.fmt, entry.type);
+    entry.next = GX_VA_NULL;
+  }
+
+  GXAttr running = GX_VA_NULL;
+  for (int i = GX_VA_TEX7; i >= GX_VA_PNMTXIDX; --i) {
+    sVtxCache.attrs[i].next = running;
+    if (sVtxCache.attrs[i].type != GX_NONE) {
+      running = static_cast<GXAttr>(i);
+    }
+  }
+  sVtxCache.first = running;
+}
+
+static inline void ensure_vtx_cache(GXVtxFmt vtxFmt) {
+  if (sVtxCache.valid && sVtxCache.vtxFmt == vtxFmt && sVtxCache.vcdLo == __gx->vcdLo &&
+      sVtxCache.vcdHi == __gx->vcdHi && sVtxCache.vatA == __gx->vatA[vtxFmt] &&
+      sVtxCache.vatB == __gx->vatB[vtxFmt] && sVtxCache.vatC == __gx->vatC[vtxFmt] &&
+      sVtxCache.hasNrms == __gx->hasNrms && sVtxCache.hasBiNrms == __gx->hasBiNrms) {
+    return;
+  }
+  rebuild_vtx_cache(vtxFmt);
+}
+
+static inline const AttrCacheEntry& attr_cache(GXAttr attr) {
+  static const AttrCacheEntry kDisabled{};
+  const auto idx = static_cast<u32>(attr);
+  return idx < GX_VA_MAX_ATTR ? sVtxCache.attrs[idx] : kDisabled;
+}
+
+static void reset_attr_writer() {
+  sWriteAttr = sVtxCache.first;
+  sWriteAttrComps = 0;
+}
+
+static GXAttr select_implicit_attr(GXAttr first, GXAttr last) {
+  if (sInBegin && sWriteAttr >= first && sWriteAttr <= last && attr_cache(sWriteAttr).type != GX_NONE) {
+    return sWriteAttr;
+  }
+  if (sInBegin) {
+    for (int i = static_cast<int>(sWriteAttr); i <= static_cast<int>(last); ++i) {
+      const auto attr = static_cast<GXAttr>(i);
+      if (attr >= first && attr_cache(attr).type != GX_NONE) {
+        sWriteAttr = attr;
+        sWriteAttrComps = 0;
+        return attr;
+      }
+    }
+  }
+  for (int i = static_cast<int>(first); i <= static_cast<int>(last); ++i) {
+    const auto attr = static_cast<GXAttr>(i);
+    if (attr_cache(attr).type != GX_NONE) {
+      sWriteAttr = attr;
+      sWriteAttrComps = 0;
+      return attr;
+    }
+  }
+  return first;
+}
+
+static void align_explicit_attr(GXAttr attr) {
+  if (!sInBegin || sWriteAttr == attr) {
+    return;
+  }
+  sWriteAttr = attr;
+  sWriteAttrComps = 0;
+}
+
+static void advance_attr(GXAttr attr, u32 compsWritten) {
+  if (!sInBegin) {
+    return;
+  }
+  const AttrCacheEntry& entry = attr_cache(attr);
+  sWriteAttrComps += compsWritten;
+  if (sWriteAttrComps < entry.expected) {
+    return;
+  }
+  sWriteAttr = entry.next;
+  sWriteAttrComps = 0;
+  if (sWriteAttr == GX_VA_NULL) {
+    reset_attr_writer();
+  }
+}
+
+static int64_t encode_float_component(float value, bool isSigned, u8 bits, u8 frac) {
+  if (!std::isfinite(value)) {
+    value = 0.0f;
+  }
+  const double scaled = static_cast<double>(value) * static_cast<double>(uint64_t{1} << frac);
+  const double rounded = std::round(scaled);
+  if (isSigned) {
+    const int64_t minVal = -(int64_t{1} << (bits - 1));
+    const int64_t maxVal = (int64_t{1} << (bits - 1)) - 1;
+    return std::clamp(static_cast<int64_t>(rounded), minVal, maxVal);
+  }
+  const int64_t maxVal = (int64_t{1} << bits) - 1;
+  return std::clamp(static_cast<int64_t>(rounded), int64_t{0}, maxVal);
+}
+
+static int64_t scalar_to_signed_raw(const Scalar& value, u8 bits, u8 frac) {
+  if (value.kind == ScalarKind::Float) {
+    return encode_float_component(value.f, true, bits, frac);
+  }
+  const int64_t raw = value.kind == ScalarKind::Signed ? value.s : static_cast<int64_t>(value.u);
+  const int64_t minVal = -(int64_t{1} << (bits - 1));
+  const int64_t maxVal = (int64_t{1} << (bits - 1)) - 1;
+  return std::clamp(raw, minVal, maxVal);
+}
+
+static uint64_t scalar_to_unsigned_raw(const Scalar& value, u8 bits, u8 frac) {
+  if (value.kind == ScalarKind::Float) {
+    return static_cast<uint64_t>(encode_float_component(value.f, false, bits, frac));
+  }
+  const uint64_t raw = value.kind == ScalarKind::Signed ? static_cast<uint64_t>(std::max(value.s, int32_t{0})) : value.u;
+  const uint64_t maxVal = (uint64_t{1} << bits) - 1;
+  return std::min(raw, maxVal);
+}
+
+static float scalar_to_float(const Scalar& value) {
+  if (value.kind == ScalarKind::Float) {
+    return value.f;
+  }
+  if (value.kind == ScalarKind::Signed) {
+    return static_cast<float>(value.s);
+  }
+  return static_cast<float>(value.u);
+}
+
+static void write_numeric_component(const ActiveAttrFmt& fmt, const Scalar& value) {
+  switch (fmt.type) {
+  case GX_U8:
+    GX_WRITE_U8(static_cast<u8>(scalar_to_unsigned_raw(value, 8, fmt.frac)));
+    break;
+  case GX_S8:
+    GX_WRITE_U8(static_cast<u8>(static_cast<int8_t>(scalar_to_signed_raw(value, 8, fmt.frac))));
+    break;
+  case GX_U16:
+    GX_WRITE_U16(static_cast<u16>(scalar_to_unsigned_raw(value, 16, fmt.frac)));
+    break;
+  case GX_S16:
+    GX_WRITE_U16(static_cast<u16>(static_cast<int16_t>(scalar_to_signed_raw(value, 16, fmt.frac))));
+    break;
+  case GX_F32:
+  default:
+    GX_WRITE_F32(scalar_to_float(value));
+    break;
+  }
+}
+
+template <size_t N>
+static void write_numeric_attr(GXAttr attr, const std::array<Scalar, N>& values) {
+  ensure_vtx_cache(sBeginVtxFmt);
+  align_explicit_attr(attr);
+  const AttrCacheEntry& entry = attr_cache(attr);
+  if (entry.type == GX_NONE) {
+    return;
+  }
+  if (entry.type == GX_INDEX8 || entry.type == GX_INDEX16) {
+    return;
+  }
+  const u32 expected = entry.expected;
+  const u32 remaining = expected > sWriteAttrComps ? expected - sWriteAttrComps : expected;
+  const u32 count = std::min<u32>(static_cast<u32>(values.size()), remaining);
+  for (u32 i = 0; i < count; ++i) {
+    write_numeric_component(entry.fmt, values[i]);
+  }
+  advance_attr(attr, count);
+}
+
+static u8 clamp_color_float(float value) {
+  if (!std::isfinite(value)) {
+    return 0;
+  }
+  return static_cast<u8>(std::clamp(std::round(value * 255.0f), 0.0f, 255.0f));
+}
+
+static u8 quantize_unorm(u8 value, u8 bits) {
+  const u32 maxValue = (1u << bits) - 1u;
+  return static_cast<u8>((static_cast<u32>(value) * maxValue + 127u) / 255u);
+}
+
+static void write_color_attr(u8 r, u8 g, u8 b, u8 a) {
+  ensure_vtx_cache(sBeginVtxFmt);
+  const GXAttr attr = select_implicit_attr(GX_VA_CLR0, GX_VA_CLR1);
+  const AttrCacheEntry& entry = attr_cache(attr);
+  if (entry.type == GX_NONE) {
+    return;
+  }
+  if (entry.type == GX_INDEX8 || entry.type == GX_INDEX16) {
+    return;
+  }
+
+  const ActiveAttrFmt& fmt = entry.fmt;
+  switch (fmt.type) {
+  case GX_RGB565: {
+    const u16 packed = static_cast<u16>((quantize_unorm(r, 5) << 11) | (quantize_unorm(g, 6) << 5) |
+                                        quantize_unorm(b, 5));
+    GX_WRITE_U16(packed);
+    break;
+  }
+  case GX_RGB8:
+    GX_WRITE_U8(r);
+    GX_WRITE_U8(g);
+    GX_WRITE_U8(b);
+    break;
+  case GX_RGBX8:
+    GX_WRITE_U8(r);
+    GX_WRITE_U8(g);
+    GX_WRITE_U8(b);
+    GX_WRITE_U8(0xFF);
+    break;
+  case GX_RGBA4: {
+    const u16 packed = static_cast<u16>((quantize_unorm(r, 4) << 12) | (quantize_unorm(g, 4) << 8) |
+                                        (quantize_unorm(b, 4) << 4) | quantize_unorm(a, 4));
+    GX_WRITE_U16(packed);
+    break;
+  }
+  case GX_RGBA6: {
+    const u32 packed = (quantize_unorm(r, 6) << 18) | (quantize_unorm(g, 6) << 12) |
+                       (quantize_unorm(b, 6) << 6) | quantize_unorm(a, 6);
+    GX_WRITE_U8(static_cast<u8>((packed >> 16) & 0xFF));
+    GX_WRITE_U8(static_cast<u8>((packed >> 8) & 0xFF));
+    GX_WRITE_U8(static_cast<u8>(packed & 0xFF));
+    break;
+  }
+  case GX_RGBA8:
+  default:
+    GX_WRITE_U8(r);
+    GX_WRITE_U8(g);
+    GX_WRITE_U8(b);
+    GX_WRITE_U8(a);
+    break;
+  }
+  advance_attr(attr, 1);
+}
+
+template <size_t N>
+static void write_tex_attr(const std::array<Scalar, N>& values) {
+  ensure_vtx_cache(sBeginVtxFmt);
+  const GXAttr attr = select_implicit_attr(GX_VA_TEX0, GX_VA_TEX7);
+  write_numeric_attr(attr, values);
+}
+
+static void write_index_attr(GXAttr attr, u16 index, bool index16) {
+  ensure_vtx_cache(sBeginVtxFmt);
+  if (attr == GX_VA_TEX0) {
+    attr = select_implicit_attr(GX_VA_TEX0, GX_VA_TEX7);
+  } else if (attr == GX_VA_CLR0) {
+    attr = select_implicit_attr(GX_VA_CLR0, GX_VA_CLR1);
+  } else {
+    align_explicit_attr(attr);
+  }
+
+  const GXAttrType type = attr_cache(attr).type;
+  if (type == GX_INDEX16 || (type != GX_INDEX8 && index16)) {
+    GX_WRITE_U16(index);
+  } else {
+    GX_WRITE_U8(static_cast<u8>(index));
+  }
+  advance_attr(attr, 1);
+}
+
+} // namespace
+
+extern "C" {
+
+void GXBegin(GXPrimitive primitive, GXVtxFmt vtxFmt, u16 nVerts) {
+  CHECK(!sInBegin, "GXBegin: called without matching GXEnd");
+
+  // Flush dirty state before starting a draw
+  if (__gx->dirtyState != 0) {
+    __GXSetDirtyState();
+  }
+
+  // Flush pending primitives if needed
+  if (*reinterpret_cast<u32*>(&__gx->vNum) != 0) {
+    __GXSendFlushPrim();
+  }
+
+  GX_WRITE_U8(vtxFmt | primitive);
+  GX_WRITE_U16(nVerts);
+
+  // Record state for vertex count validation in GXEnd
+  sBeginNVerts = nVerts;
+  sBeginFifoSize = aurora::gx::fifo::get_buffer_size();
+  sBeginPrimitive = primitive;
+  sBeginVtxFmt = vtxFmt;
+  sInBegin = true;
+  ensure_vtx_cache(vtxFmt);
+  reset_attr_writer();
+}
+
+void GXEnd() {
+  if (sInBegin) {
+    u32 bytesWritten = aurora::gx::fifo::get_buffer_size() - sBeginFifoSize;
+    if (sBeginNVerts > 0 && bytesWritten > 0) {
+      u32 vtxSize = bytesWritten / sBeginNVerts;
+      u32 remainder = bytesWritten % sBeginNVerts;
+      if (remainder != 0) {
+        Log.warn("GXEnd: vertex data not evenly divisible: {} bytes for {} vertices prim={} fmt={} "
+                 "vcdLo=0x{:08x} vcdHi=0x{:08x} vatA=0x{:08x} vatB=0x{:08x} vatC=0x{:08x}",
+                 bytesWritten, sBeginNVerts, underlying(sBeginPrimitive), underlying(sBeginVtxFmt),
+                 __gx->vcdLo, __gx->vcdHi, __gx->vatA[sBeginVtxFmt], __gx->vatB[sBeginVtxFmt],
+                 __gx->vatC[sBeginVtxFmt]);
+      }
+      u32 actualVerts = (vtxSize > 0) ? bytesWritten / vtxSize : 0;
+      CHECK(actualVerts == sBeginNVerts,
+            "GXEnd: vertex count mismatch: GXBegin declared {} vertices ({}B each, {}B total) "
+            "but {} bytes were written ({} vertices)",
+            sBeginNVerts, vtxSize, sBeginNVerts * vtxSize, bytesWritten, actualVerts);
+    }
+    sInBegin = false;
+    sWriteAttr = GX_VA_NULL;
+    sWriteAttrComps = 0;
+  }
+  if (!aurora::gx::fifo::in_display_list()) {
+    aurora::gx::fifo::drain();
+  }
+}
+
+void GXPosition3f32(f32 x, f32 y, f32 z) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_f32(x), scalar_f32(y), scalar_f32(z)});
+}
+
+void GXPosition3u16(u16 x, u16 y, u16 z) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_u32(x), scalar_u32(y), scalar_u32(z)});
+}
+
+void GXPosition3s16(s16 x, s16 y, s16 z) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_s32(x), scalar_s32(y), scalar_s32(z)});
+}
+
+void GXPosition3u8(u8 x, u8 y, u8 z) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_u32(x), scalar_u32(y), scalar_u32(z)});
+}
+
+void GXPosition3s8(s8 x, s8 y, s8 z) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_s32(x), scalar_s32(y), scalar_s32(z)});
+}
+
+void GXPosition2f32(f32 x, f32 y) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_f32(x), scalar_f32(y)});
+}
+
+void GXPosition2u16(u16 x, u16 y) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_u32(x), scalar_u32(y)});
+}
+
+void GXPosition2s16(s16 x, s16 y) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_s32(x), scalar_s32(y)});
+}
+
+void GXPosition2u8(u8 x, u8 y) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_u32(x), scalar_u32(y)});
+}
+
+void GXPosition2s8(s8 x, s8 y) {
+  write_numeric_attr(GX_VA_POS, std::array{scalar_s32(x), scalar_s32(y)});
+}
+
+void GXPosition1x16(u16 idx) { write_index_attr(GX_VA_POS, idx, true); }
+
+void GXPosition1x8(u8 idx) { write_index_attr(GX_VA_POS, idx, false); }
+
+void GXNormal3f32(f32 x, f32 y, f32 z) {
+  write_numeric_attr(GX_VA_NRM, std::array{scalar_f32(x), scalar_f32(y), scalar_f32(z)});
+}
+
+void GXNormal3u16(u16 x, u16 y, u16 z) {
+  write_numeric_attr(GX_VA_NRM, std::array{scalar_u32(x), scalar_u32(y), scalar_u32(z)});
+}
+
+void GXNormal3s16(s16 x, s16 y, s16 z) {
+  write_numeric_attr(GX_VA_NRM, std::array{scalar_s32(x), scalar_s32(y), scalar_s32(z)});
+}
+
+void GXNormal3u8(u8 x, u8 y, u8 z) {
+  write_numeric_attr(GX_VA_NRM, std::array{scalar_u32(x), scalar_u32(y), scalar_u32(z)});
+}
+
+void GXNormal3s8(s8 x, s8 y, s8 z) {
+  write_numeric_attr(GX_VA_NRM, std::array{scalar_s32(x), scalar_s32(y), scalar_s32(z)});
+}
+
+void GXNormal1x16(u16 index) { write_index_attr(GX_VA_NRM, index, true); }
+
+void GXNormal1x8(u8 index) { write_index_attr(GX_VA_NRM, index, false); }
+
+void GXColor4f32(f32 r, f32 g, f32 b, f32 a) {
+  write_color_attr(clamp_color_float(r), clamp_color_float(g), clamp_color_float(b), clamp_color_float(a));
+}
+
+void GXColor4u8(u8 r, u8 g, u8 b, u8 a) {
+  write_color_attr(r, g, b, a);
+}
+
+void GXColor3u8(u8 r, u8 g, u8 b) {
+  write_color_attr(r, g, b, 0xFF);
+}
+
+void GXColor1u32(u32 clr) {
+  write_color_attr(static_cast<u8>((clr >> 24) & 0xFF), static_cast<u8>((clr >> 16) & 0xFF),
+                   static_cast<u8>((clr >> 8) & 0xFF), static_cast<u8>(clr & 0xFF));
+}
+
+void GXColor1u16(u16 clr) {
+  const u8 r = static_cast<u8>(((clr >> 11) & 0x1F) * 255 / 31);
+  const u8 g = static_cast<u8>(((clr >> 5) & 0x3F) * 255 / 63);
+  const u8 b = static_cast<u8>((clr & 0x1F) * 255 / 31);
+  write_color_attr(r, g, b, 0xFF);
+}
+
+void GXColor1x16(u16 index) { write_index_attr(GX_VA_CLR0, index, true); }
+
+void GXColor1x8(u8 index) { write_index_attr(GX_VA_CLR0, index, false); }
+
+void GXTexCoord2f32(f32 s, f32 t) {
+  write_tex_attr(std::array{scalar_f32(s), scalar_f32(t)});
+}
+
+void GXTexCoord2u16(u16 s, u16 t) {
+  write_tex_attr(std::array{scalar_u32(s), scalar_u32(t)});
+}
+
+void GXTexCoord2s16(s16 s, s16 t) {
+  write_tex_attr(std::array{scalar_s32(s), scalar_s32(t)});
+}
+
+void GXTexCoord2u8(u8 s, u8 t) {
+  write_tex_attr(std::array{scalar_u32(s), scalar_u32(t)});
+}
+
+void GXTexCoord2s8(s8 s, s8 t) {
+  write_tex_attr(std::array{scalar_s32(s), scalar_s32(t)});
+}
+
+void GXTexCoord1f32(f32 s) { write_tex_attr(std::array{scalar_f32(s)}); }
+
+void GXTexCoord1u16(u16 s) { write_tex_attr(std::array{scalar_u32(s)}); }
+
+void GXTexCoord1s16(s16 s) { write_tex_attr(std::array{scalar_s32(s)}); }
+
+void GXTexCoord1u8(u8 s) { write_tex_attr(std::array{scalar_u32(s)}); }
+
+void GXTexCoord1s8(s8 s) { write_tex_attr(std::array{scalar_s32(s)}); }
+
+void GXTexCoord1x16(u16 index) { write_index_attr(GX_VA_TEX0, index, true); }
+
+void GXTexCoord1x8(u8 index) { write_index_attr(GX_VA_TEX0, index, false); }
+
+void GXMatrixIndex1u8(GXAttr attr, u8 index) { write_index_attr(attr, index, false); }
+
+void GXCmd1u8(const u8 x) { aurora::gx::fifo::write_u8(x); }
+void GXCmd1u16(const u16 x) { aurora::gx::fifo::write_u16(x); }
+void GXCmd1u32(const u32 x) { aurora::gx::fifo::write_u32(x); }
+void GXCmd1u64(const u64 x) { aurora::gx::fifo::write_u64(x); }
+
+void GXParam1u8(const u8 x) { aurora::gx::fifo::write_u8(x); }
+void GXParam1u16(const u16 x) { aurora::gx::fifo::write_u16(x); }
+void GXParam1u32(const u32 x) { aurora::gx::fifo::write_u32(x); }
+void GXParam1s8(const s8 x) { aurora::gx::fifo::write_u8(static_cast<uint8_t>(x)); }
+void GXParam1s16(const s16 x) { aurora::gx::fifo::write_u16(static_cast<uint16_t>(x)); }
+void GXParam1s32(const s32 x) { aurora::gx::fifo::write_u32(static_cast<uint32_t>(x)); }
+void GXParam1f32(const f32 x) { aurora::gx::fifo::write_f32(x); }
+void GXParam3f32(const f32 x, const f32 y, const f32 z) {
+  aurora::gx::fifo::write_f32(x);
+  aurora::gx::fifo::write_f32(y);
+  aurora::gx::fifo::write_f32(z);
+}
+void GXParam4f32(const f32 x, const f32 y, const f32 z, const f32 w) {
+  aurora::gx::fifo::write_f32(x);
+  aurora::gx::fifo::write_f32(y);
+  aurora::gx::fifo::write_f32(z);
+  aurora::gx::fifo::write_f32(w);
+}
+
+} // extern "C"
diff --git a/aurora-main/lib/dolphin/gx/__gx.h b/aurora-main/lib/dolphin/gx/__gx.h
new file mode 100644
index 0000000..460791e
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/__gx.h
@@ -0,0 +1,179 @@
+#pragma once
+
+#include <dolphin/gx.h>
+
+#include "../../gx/fifo.hpp"
+
+#define GX_WRITE_U8(ub) aurora::gx::fifo::write_u8(static_cast<uint8_t>(ub))
+#define GX_WRITE_DATA(data, length) aurora::gx::fifo::write_data(data, length)
+#define GX_WRITE_U16(us) aurora::gx::fifo::write_u16(static_cast<uint16_t>(us))
+#define GX_WRITE_U32(ui) aurora::gx::fifo::write_u32(static_cast<uint32_t>(ui))
+#define GX_WRITE_U64(ui) aurora::gx::fifo::write_u64(static_cast<uint64_t>(ui))
+#define GX_WRITE_F32(f) aurora::gx::fifo::write_f32(static_cast<float>(f))
+
+// XF register write: opcode 0x10, address in XF space (0x1000+addr), then value
+#define GX_WRITE_XF_REG(addr, value)                                                                                   \
+  do {                                                                                                                 \
+    GX_WRITE_U8(0x10);                                                                                                 \
+    GX_WRITE_U32(0x1000 + (addr));                                                                                     \
+    GX_WRITE_U32(value);                                                                                               \
+  } while (0)
+
+// XF register write for u32 data (no address header - used in bulk writes)
+#define GX_WRITE_XF_REG_2(addr, value)                                                                                 \
+  do {                                                                                                                 \
+    GX_WRITE_U32(value);                                                                                               \
+  } while (0)
+
+// XF register write for f32 data (no address header - used in bulk writes)
+#define GX_WRITE_XF_REG_F(addr, value)                                                                                 \
+  do {                                                                                                                 \
+    GX_WRITE_F32(value);                                                                                               \
+  } while (0)
+
+// BP (RAS) register write: opcode 0x61, then 32-bit value (upper 8 bits = reg ID)
+#define GX_WRITE_RAS_REG(value)                                                                                        \
+  do {                                                                                                                 \
+    GX_WRITE_U8(0x61);                                                                                                 \
+    GX_WRITE_U32(value);                                                                                               \
+  } while (0)
+
+// CP register write with base/stride tracking for indexed arrays
+// GX_WRITE_SOME_REG2: CP array base address
+#define GX_WRITE_SOME_REG2(a, b, c, addr)                                                                              \
+  do {                                                                                                                 \
+    GX_WRITE_U8(a);                                                                                                    \
+    GX_WRITE_U8(b);                                                                                                    \
+    GX_WRITE_U32(c);                                                                                                   \
+  } while (0)
+
+// GX_WRITE_SOME_REG3: CP array stride
+#define GX_WRITE_SOME_REG3(a, b, c, addr)                                                                              \
+  do {                                                                                                                 \
+    GX_WRITE_U8(a);                                                                                                    \
+    GX_WRITE_U8(b);                                                                                                    \
+    GX_WRITE_U32(c);                                                                                                   \
+  } while (0)
+
+// GX_WRITE_SOME_REG4: generic CP register write (VCD, VAT, matrix index)
+#define GX_WRITE_SOME_REG4(a, b, c, addr)                                                                              \
+  do {                                                                                                                 \
+    GX_WRITE_U8(a);                                                                                                    \
+    GX_WRITE_U8(b);                                                                                                    \
+    GX_WRITE_U32(c);                                                                                                   \
+  } while (0)
+
+#define GET_REG_FIELD(reg, size, shift) (static_cast<int>(((reg) >> (shift)) & ((1 << (size)) - 1)))
+
+#define SET_REG_FIELD(line, reg, size, shift, val)                                                                     \
+  do {                                                                                                                 \
+    (reg) = ((u32)(reg) & ~(((1u << (size)) - 1) << (shift))) | ((u32)(val) << (shift));                               \
+  } while (0)
+
+#define GX_WRITE_AURORA(cmd)     \
+  do {                           \
+    GX_WRITE_U8(GX_LOAD_AURORA); \
+    GX_WRITE_U16(cmd);           \
+  } while (0)
+
+#define GX_WRITE_CP_REG(addr, value)  \
+  do {                                \
+  GX_WRITE_U8(GX_LOAD_CP_REG);        \
+  GX_WRITE_U8(addr);                  \
+  GX_WRITE_U32(value);                \
+  } while (0)
+
+// This shadow register struct contains the GX state Aurora needs on PC.
+struct __GXData_struct {
+  u16 vNum;         // vertex count for flush prim
+  u16 bpSent;       // BP register was sent (need flush prim before next draw)
+  u32 vLim;         // vertex data size limit (bytes per vertex for flush prim)
+
+  u32 vcdLo;        // vertex component descriptor low
+  u32 vcdHi;        // vertex component descriptor high
+
+  u32 vatA[8];      // vertex attribute table A (per vtxfmt)
+  u32 vatB[8];      // vertex attribute table B
+  u32 vatC[8];      // vertex attribute table C
+
+  u32 lpSize;       // line/point size register
+
+  u32 matIdxA;      // matrix index A (pnmtx + texmtx 0-3)
+  u32 matIdxB;      // matrix index B (texmtx 4-7)
+
+  u32 ambColor[2];  // ambient colors (XF registers)
+  u32 matColor[2];  // material colors (XF registers)
+
+  u32 suTs0[8];     // SU texture S0 registers
+  u32 suTs1[8];     // SU texture S1 registers
+  u8 tcsManEnab;    // bitmask: manual tex coord scale enabled per coord
+  u32 suScis0;      // scissor top-left
+  u32 suScis1;      // scissor bottom-right
+
+  u32 tref[8];      // TEV texture/color reference (2 stages per register)
+  u32 iref;         // indirect texture reference
+  u32 bpMask;       // BP mask register
+
+  u32 IndTexScale0; // indirect texture scale 0 (stages 0-1)
+  u32 IndTexScale1; // indirect texture scale 1 (stages 2-3)
+
+  u32 tevc[16];     // TEV color combiner registers
+  u32 teva[16];     // TEV alpha combiner registers
+  u32 tevKsel[8];   // TEV K color/alpha selection
+
+  u32 cmode0;       // blend mode register
+  u32 cmode1;       // destination alpha register
+  u32 zmode;        // Z-buffer mode register
+  u32 peCtrl;       // pixel engine control
+
+  u32 genMode;      // general mode (numTexGens, numChans, numTevStages, cullMode, numIndStages)
+
+  u32 tImage0[8];   // texture image 0 registers
+  u32 tMode0[8];    // texture mode 0 registers
+  u32 texmapId[16]; // texture map ID tracking
+  u32 texmapValid;  // bitmask of TEV stages with a valid texture coordinate
+
+  GXAttrType nrmType; // normal attribute type
+  u8 hasNrms;       // has normal vectors
+  u8 hasBiNrms;     // has binormal vectors
+
+  u32 projType;     // projection type (perspective/orthographic)
+  f32 projMtx[6];   // projection matrix (6 params)
+
+  f32 vpLeft;       // viewport left
+  f32 vpTop;        // viewport top
+  f32 vpWd;         // viewport width
+  f32 vpHt;         // viewport height
+  f32 vpNearz;      // viewport near Z
+  f32 vpFarz;       // viewport far Z
+
+  u8 fgRange;       // fog range adjustment enabled
+  f32 fgSideX;      // fog range side X
+
+  u8 inDispList;    // currently recording a display list
+  u8 dlSaveContext; // save/restore context around display lists
+  u8 dirtyVAT;      // bitmask of dirty VAT entries
+
+  u32 dirtyState;   // dirty state flags:
+                    // bit 0: SU tex regs
+                    // bit 1: BP mask
+                    // bit 2: gen mode
+                    // bit 3: VCD
+                    // bit 4: VAT
+};
+
+extern __GXData_struct* __gx;
+
+extern "C" {
+
+// Dirty state flush functions
+void __GXSetVCD();
+void __GXSetVAT();
+void __GXUpdateBPMask();
+void __GXSetSUTexRegs();
+void __GXSetDirtyState();
+void __GXSetGenMode();
+void __GXSetMatrixIndex(GXAttr matIdxAttr);
+void __GXSendFlushPrim();
+void __GXFlushTextureState();
+};
diff --git a/aurora-main/lib/dolphin/gx/gx.hpp b/aurora-main/lib/dolphin/gx/gx.hpp
new file mode 100644
index 0000000..0319df0
--- /dev/null
+++ b/aurora-main/lib/dolphin/gx/gx.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "../../internal.hpp"
+#include "../../gx/gx.hpp"
+
+// Defined once in GXAurora.cpp. The FATAL/CHECK/TRY macros resolve `Log` unqualified, so it stays
+// at global scope like the rest of this header's using-declarations.
+extern aurora::Module Log;
+
+using aurora::gx::g_gxState;
diff --git a/aurora-main/lib/dolphin/ms/mouse.cpp b/aurora-main/lib/dolphin/ms/mouse.cpp
new file mode 100644
index 0000000..a5b95f7
--- /dev/null
+++ b/aurora-main/lib/dolphin/ms/mouse.cpp
@@ -0,0 +1,33 @@
+#include "dolphin/ms.h"
+#include <SDL3/SDL_mouse.h>
+
+#include "../../input.hpp"
+
+extern "C" {
+static MSStatus gStatus{};
+
+void MSPoll() {
+  const uint32_t buttons = SDL_GetGlobalMouseState(&gStatus.x, &gStatus.y);
+  SDL_GetRelativeMouseState(&gStatus.xrel, &gStatus.yrel);
+  aurora::input::get_mouse_scroll(&gStatus.scrollX, &gStatus.scrollY);
+
+  gStatus.buttons = 0;
+  if (buttons & SDL_BUTTON_LEFT) {
+    gStatus.buttons |= MS_BUTTON_LEFT;
+  }
+  if (buttons & SDL_BUTTON_MIDDLE) {
+    gStatus.buttons |= MS_BUTTON_MIDDLE;
+  }
+  if (buttons & SDL_BUTTON_RIGHT) {
+    gStatus.buttons |= MS_BUTTON_RIGHT;
+  }
+  if (buttons & SDL_BUTTON_X1) {
+    gStatus.buttons |= MS_BUTTON_X1;
+  }
+  if (buttons & SDL_BUTTON_X2) {
+    gStatus.buttons |= MS_BUTTON_X2;
+  }
+}
+
+void MSRead(MSStatus* status) { *status = gStatus; }
+}
\ No newline at end of file
diff --git a/aurora-main/lib/dolphin/mtx/mtx.c b/aurora-main/lib/dolphin/mtx/mtx.c
new file mode 100644
index 0000000..ba2796d
--- /dev/null
+++ b/aurora-main/lib/dolphin/mtx/mtx.c
@@ -0,0 +1,618 @@
+#include <dolphin/mtx.h>
+
+#include <assert.h>
+#include <math.h>
+
+void C_MTXIdentity(Mtx m) {
+  assert(m && "MtxIdentity():  NULL Mtx 'm' ");
+  m[0][0] = 1;
+  m[0][1] = 0;
+  m[0][2] = 0;
+  m[0][3] = 0;
+  m[1][0] = 0;
+  m[1][1] = 1;
+  m[1][2] = 0;
+  m[1][3] = 0;
+  m[2][0] = 0;
+  m[2][1] = 0;
+  m[2][2] = 1;
+  m[2][3] = 0;
+}
+
+void C_MTXCopy(const Mtx src, Mtx dst) {
+  assert(src && "MTXCopy():  NULL MtxPtr 'src' ");
+  assert(dst && "MTXCopy():  NULL MtxPtr 'dst' ");
+  if (src != dst) {
+    dst[0][0] = src[0][0];
+    dst[0][1] = src[0][1];
+    dst[0][2] = src[0][2];
+    dst[0][3] = src[0][3];
+    dst[1][0] = src[1][0];
+    dst[1][1] = src[1][1];
+    dst[1][2] = src[1][2];
+    dst[1][3] = src[1][3];
+    dst[2][0] = src[2][0];
+    dst[2][1] = src[2][1];
+    dst[2][2] = src[2][2];
+    dst[2][3] = src[2][3];
+  }
+}
+
+void C_MTXConcat(const Mtx a, const Mtx b, Mtx ab) {
+  Mtx mTmp;
+  MtxPtr m;
+
+  assert(a && "MTXConcat():  NULL MtxPtr 'a'  ");
+  assert(b && "MTXConcat():  NULL MtxPtr 'b'  ");
+  assert(ab && "MTXConcat():  NULL MtxPtr 'ab' ");
+
+  if (ab == a || ab == b) {
+    m = mTmp;
+  } else {
+    m = ab;
+  }
+
+  m[0][0] =       0 +  a[0][2] * b[2][0] + ((a[0][0] * b[0][0]) + (a[0][1] * b[1][0]));
+  m[0][1] =       0 +  a[0][2] * b[2][1] + ((a[0][0] * b[0][1]) + (a[0][1] * b[1][1]));
+  m[0][2] =       0 +  a[0][2] * b[2][2] + ((a[0][0] * b[0][2]) + (a[0][1] * b[1][2]));
+  m[0][3] = a[0][3] + (a[0][2] * b[2][3] +  (a[0][0] * b[0][3]  + (a[0][1] * b[1][3])));
+
+  m[1][0] =       0 +  a[1][2] * b[2][0] + ((a[1][0] * b[0][0]) + (a[1][1] * b[1][0]));
+  m[1][1] =       0 +  a[1][2] * b[2][1] + ((a[1][0] * b[0][1]) + (a[1][1] * b[1][1]));
+  m[1][2] =       0 +  a[1][2] * b[2][2] + ((a[1][0] * b[0][2]) + (a[1][1] * b[1][2]));
+  m[1][3] = a[1][3] + (a[1][2] * b[2][3] +  (a[1][0] * b[0][3]  + (a[1][1] * b[1][3])));
+
+  m[2][0] =       0 +  a[2][2] * b[2][0] + ((a[2][0] * b[0][0]) + (a[2][1] * b[1][0]));
+  m[2][1] =       0 +  a[2][2] * b[2][1] + ((a[2][0] * b[0][1]) + (a[2][1] * b[1][1]));
+  m[2][2] =       0 +  a[2][2] * b[2][2] + ((a[2][0] * b[0][2]) + (a[2][1] * b[1][2]));
+  m[2][3] = a[2][3] + (a[2][2] * b[2][3] +  (a[2][0] * b[0][3]  + (a[2][1] * b[1][3])));
+
+  if (m == mTmp) {
+    C_MTXCopy(mTmp, ab);
+  }
+}
+
+void C_MTXConcatArray(const Mtx a, const Mtx* srcBase, Mtx* dstBase, u32 count) {
+  u32 i;
+
+  assert(a != 0 && "MTXConcatArray(): NULL MtxPtr 'a' ");
+  assert(srcBase != 0 && "MTXConcatArray(): NULL MtxPtr 'srcBase' ");
+  assert(dstBase != 0 && "MTXConcatArray(): NULL MtxPtr 'dstBase' ");
+  assert(count > 1 && "MTXConcatArray(): count must be greater than 1.");
+
+  for (i = 0; i < count; i++) {
+    C_MTXConcat(a, *srcBase, *dstBase);
+    srcBase++;
+    dstBase++;
+  }
+}
+
+void C_MTXTranspose(const Mtx src, Mtx xPose) {
+  Mtx mTmp;
+  MtxPtr m;
+
+  assert(src && "MTXTranspose():  NULL MtxPtr 'src' ");
+  assert(xPose && "MTXTranspose():  NULL MtxPtr 'xPose' ");
+
+  if (src == xPose) {
+    m = mTmp;
+  } else {
+    m = xPose;
+  }
+
+  m[0][0] = src[0][0];
+  m[0][1] = src[1][0];
+  m[0][2] = src[2][0];
+  m[0][3] = 0;
+  m[1][0] = src[0][1];
+  m[1][1] = src[1][1];
+  m[1][2] = src[2][1];
+  m[1][3] = 0;
+  m[2][0] = src[0][2];
+  m[2][1] = src[1][2];
+  m[2][2] = src[2][2];
+  m[2][3] = 0;
+  if (m == mTmp) {
+    C_MTXCopy(mTmp, xPose);
+  }
+}
+
+u32 C_MTXInverse(const Mtx src, Mtx inv) {
+  Mtx mTmp;
+  MtxPtr m;
+  f32 det;
+
+  assert(src && "MTXInverse():  NULL MtxPtr 'src' ");
+  assert(inv && "MTXInverse():  NULL MtxPtr 'inv' ");
+
+  if (src == inv) {
+    m = mTmp;
+  } else {
+    m = inv;
+  }
+  det = ((((src[2][1] * (src[0][2] * src[1][0]))
+        + ((src[2][2] * (src[0][0] * src[1][1]))
+         + (src[2][0] * (src[0][1] * src[1][2]))))
+         - (src[0][2] * (src[2][0] * src[1][1])))
+         - (src[2][2] * (src[1][0] * src[0][1])))
+         - (src[1][2] * (src[0][0] * src[2][1]));
+  if (0 == det) {
+    return 0;
+  }
+  det = 1 / det;
+  m[0][0] = (det * +((src[1][1] * src[2][2]) - (src[2][1] * src[1][2])));
+  m[0][1] = (det * -((src[0][1] * src[2][2]) - (src[2][1] * src[0][2])));
+  m[0][2] = (det * +((src[0][1] * src[1][2]) - (src[1][1] * src[0][2])));
+
+  m[1][0] = (det * -((src[1][0] * src[2][2]) - (src[2][0] * src[1][2])));
+  m[1][1] = (det * +((src[0][0] * src[2][2]) - (src[2][0] * src[0][2])));
+  m[1][2] = (det * -((src[0][0] * src[1][2]) - (src[1][0] * src[0][2])));
+
+  m[2][0] = (det * +((src[1][0] * src[2][1]) - (src[2][0] * src[1][1])));
+  m[2][1] = (det * -((src[0][0] * src[2][1]) - (src[2][0] * src[0][1])));
+  m[2][2] = (det * +((src[0][0] * src[1][1]) - (src[1][0] * src[0][1])));
+
+  m[0][3] = ((-m[0][0] * src[0][3]) - (m[0][1] * src[1][3])) - (m[0][2] * src[2][3]);
+  m[1][3] = ((-m[1][0] * src[0][3]) - (m[1][1] * src[1][3])) - (m[1][2] * src[2][3]);
+  m[2][3] = ((-m[2][0] * src[0][3]) - (m[2][1] * src[1][3])) - (m[2][2] * src[2][3]);
+
+  if (m == mTmp) {
+    C_MTXCopy(mTmp, inv);
+  }
+  return 1;
+}
+
+u32 C_MTXInvXpose(const Mtx src, Mtx invX) {
+  Mtx mTmp;
+  MtxPtr m;
+  f32 det;
+
+  assert(src && "MTXInvXpose(): NULL MtxPtr 'src' ");
+  assert(invX && "MTXInvXpose(): NULL MtxPtr 'invX' ");
+
+  if (src == invX) {
+    m = mTmp;
+  } else {
+    m = invX;
+  }
+  det = ((((src[2][1] * (src[0][2] * src[1][0]))
+        + ((src[2][2] * (src[0][0] * src[1][1]))
+        +  (src[2][0] * (src[0][1] * src[1][2]))))
+        -  (src[0][2] * (src[2][0] * src[1][1])))
+        -  (src[2][2] * (src[1][0] * src[0][1])))
+        -  (src[1][2] * (src[0][0] * src[2][1]));
+  if (0 == det) {
+    return 0;
+  }
+  det = 1 / det;
+  m[0][0] = (det * +((src[1][1] * src[2][2]) - (src[2][1] * src[1][2])));
+  m[0][1] = (det * -((src[1][0] * src[2][2]) - (src[2][0] * src[1][2])));
+  m[0][2] = (det * +((src[1][0] * src[2][1]) - (src[2][0] * src[1][1])));
+
+  m[1][0] = (det * -((src[0][1] * src[2][2]) - (src[2][1] * src[0][2])));
+  m[1][1] = (det * +((src[0][0] * src[2][2]) - (src[2][0] * src[0][2])));
+  m[1][2] = (det * -((src[0][0] * src[2][1]) - (src[2][0] * src[0][1])));
+
+  m[2][0] = (det * +((src[0][1] * src[1][2]) - (src[1][1] * src[0][2])));
+  m[2][1] = (det * -((src[0][0] * src[1][2]) - (src[1][0] * src[0][2])));
+  m[2][2] = (det * +((src[0][0] * src[1][1]) - (src[1][0] * src[0][1])));
+
+  m[0][3] = 0;
+  m[1][3] = 0;
+  m[2][3] = 0;
+
+  if (m == mTmp) {
+    C_MTXCopy(mTmp, invX);
+  }
+  return 1;
+}
+
+void C_MTXTrans(Mtx m, f32 xT, f32 yT, f32 zT) {
+  assert(m && "MTXTrans():  NULL MtxPtr 'm' ");
+  m[0][0] = 1;
+  m[0][1] = 0;
+  m[0][2] = 0;
+  m[0][3] = xT;
+  m[1][0] = 0;
+  m[1][1] = 1;
+  m[1][2] = 0;
+  m[1][3] = yT;
+  m[2][0] = 0;
+  m[2][1] = 0;
+  m[2][2] = 1;
+  m[2][3] = zT;
+}
+
+void C_MTXFrustum(Mtx44 m, f32 t, f32 b, f32 l, f32 r, f32 n, f32 f) {
+  f32 tmp;
+
+  assert(m && "MTXFrustum():  NULL Mtx44Ptr 'm' ");
+  assert(t != b && "MTXFrustum():  't' and 'b' clipping planes are equal ");
+  assert(l != r && "MTXFrustum():  'l' and 'r' clipping planes are equal ");
+  assert(n != f && "MTXFrustum():  'n' and 'f' clipping planes are equal ");
+  tmp = 1 / (r - l);
+  m[0][0] = (2 * n * tmp);
+  m[0][1] = 0;
+  m[0][2] = (tmp * (r + l));
+  m[0][3] = 0;
+  tmp = 1 / (t - b);
+  m[1][0] = 0;
+  m[1][1] = (2 * n * tmp);
+  m[1][2] = (tmp * (t + b));
+  m[1][3] = 0;
+  m[2][0] = 0;
+  m[2][1] = 0;
+  tmp = 1 / (f - n);
+  m[2][2] = (-n * tmp);
+  m[2][3] = (tmp * -(f * n));
+  m[3][0] = 0;
+  m[3][1] = 0;
+  m[3][2] = -1;
+  m[3][3] = 0;
+}
+
+void C_MTXOrtho(Mtx44 m, f32 t, f32 b, f32 l, f32 r, f32 n, f32 f) {
+  f32 tmp;
+
+  assert(m && "MTXOrtho():  NULL Mtx44Ptr 'm' ");
+  assert(t != b && "MTXOrtho():  't' and 'b' clipping planes are equal ");
+  assert(l != r && "MTXOrtho():  'l' and 'r' clipping planes are equal ");
+  assert(n != f && "MTXOrtho():  'n' and 'f' clipping planes are equal ");
+  tmp = 1 / (r - l);
+  m[0][0] = 2 * tmp;
+  m[0][1] = 0;
+  m[0][2] = 0;
+  m[0][3] = (tmp * -(r + l));
+  tmp = 1 / (t - b);
+  m[1][0] = 0;
+  m[1][1] = 2 * tmp;
+  m[1][2] = 0;
+  m[1][3] = (tmp * -(t + b));
+  m[2][0] = 0;
+  m[2][1] = 0;
+  tmp = 1 / (f - n);
+  m[2][2] = (-1 * tmp);
+  m[2][3] = (-f * tmp);
+  m[3][0] = 0;
+  m[3][1] = 0;
+  m[3][2] = 0;
+  m[3][3] = 1;
+}
+
+void C_MTXQuat(Mtx m, const Quaternion* q) {
+  f32 s;
+  f32 xs;
+  f32 ys;
+  f32 zs;
+  f32 wx;
+  f32 wy;
+  f32 wz;
+  f32 xx;
+  f32 xy;
+  f32 xz;
+  f32 yy;
+  f32 yz;
+  f32 zz;
+
+  assert(m && "MTXQuat():  NULL MtxPtr 'm' ");
+  assert(q && "MTXQuat():  NULL QuaternionPtr 'q' ");
+  assert(q->x || q->y || q->z || q->w && "MTXQuat():  zero-value quaternion ");
+  s = 2 / ((q->w * q->w) + ((q->z * q->z) + ((q->x * q->x) + (q->y * q->y))));
+  xs = q->x * s;
+  ys = q->y * s;
+  zs = q->z * s;
+  wx = q->w * xs;
+  wy = q->w * ys;
+  wz = q->w * zs;
+  xx = q->x * xs;
+  xy = q->x * ys;
+  xz = q->x * zs;
+  yy = q->y * ys;
+  yz = q->y * zs;
+  zz = q->z * zs;
+  m[0][0] = (1 - (yy + zz));
+  m[0][1] = (xy - wz);
+  m[0][2] = (xz + wy);
+  m[0][3] = 0;
+  m[1][0] = (xy + wz);
+  m[1][1] = (1 - (xx + zz));
+  m[1][2] = (yz - wx);
+  m[1][3] = 0;
+  m[2][0] = (xz - wy);
+  m[2][1] = (yz + wx);
+  m[2][2] = (1 - (xx + yy));
+  m[2][3] = 0;
+}
+
+void C_MTXReflect(Mtx m, const Vec* p, const Vec* n) {
+  f32 vxy;
+  f32 vxz;
+  f32 vyz;
+  f32 pdotn;
+
+  vxy = -2 * n->x * n->y;
+  vxz = -2 * n->x * n->z;
+  vyz = -2 * n->y * n->z;
+  pdotn = 2 * C_VECDotProduct(p, n);
+  m[0][0] = (1 - (2 * n->x * n->x));
+  m[0][1] = vxy;
+  m[0][2] = vxz;
+  m[0][3] = (pdotn * n->x);
+  m[1][0] = vxy;
+  m[1][1] = (1 - (2 * n->y * n->y));
+  m[1][2] = vyz;
+  m[1][3] = (pdotn * n->y);
+  m[2][0] = vxz;
+  m[2][1] = vyz;
+  m[2][2] = (1 - (2 * n->z * n->z));
+  m[2][3] = (pdotn * n->z);
+}
+
+void C_MTXTransApply(const Mtx src, Mtx dst, f32 xT, f32 yT, f32 zT) {
+  assert(src && "MTXTransApply(): NULL MtxPtr 'src' ");
+  assert(dst && "MTXTransApply(): NULL MtxPtr 'src' "); //! wrong assert string
+
+  if (src != dst) {
+    dst[0][0] = src[0][0];
+    dst[0][1] = src[0][1];
+    dst[0][2] = src[0][2];
+    dst[1][0] = src[1][0];
+    dst[1][1] = src[1][1];
+    dst[1][2] = src[1][2];
+    dst[2][0] = src[2][0];
+    dst[2][1] = src[2][1];
+    dst[2][2] = src[2][2];
+  }
+
+  dst[0][3] = (src[0][3] + xT);
+  dst[1][3] = (src[1][3] + yT);
+  dst[2][3] = (src[2][3] + zT);
+}
+
+void C_MTXScale(Mtx m, f32 xS, f32 yS, f32 zS) {
+  assert(m && "MTXScale():  NULL MtxPtr 'm' ");
+  m[0][0] = xS;
+  m[0][1] = 0;
+  m[0][2] = 0;
+  m[0][3] = 0;
+  m[1][0] = 0;
+  m[1][1] = yS;
+  m[1][2] = 0;
+  m[1][3] = 0;
+  m[2][0] = 0;
+  m[2][1] = 0;
+  m[2][2] = zS;
+  m[2][3] = 0;
+}
+
+void C_MTXScaleApply(const Mtx src, Mtx dst, f32 xS, f32 yS, f32 zS) {
+  assert(src && "MTXScaleApply(): NULL MtxPtr 'src' ");
+  assert(dst && "MTXScaleApply(): NULL MtxPtr 'dst' ");
+  dst[0][0] = (src[0][0] * xS);
+  dst[0][1] = (src[0][1] * xS);
+  dst[0][2] = (src[0][2] * xS);
+  dst[0][3] = (src[0][3] * xS);
+  dst[1][0] = (src[1][0] * yS);
+  dst[1][1] = (src[1][1] * yS);
+  dst[1][2] = (src[1][2] * yS);
+  dst[1][3] = (src[1][3] * yS);
+  dst[2][0] = (src[2][0] * zS);
+  dst[2][1] = (src[2][1] * zS);
+  dst[2][2] = (src[2][2] * zS);
+  dst[2][3] = (src[2][3] * zS);
+}
+
+void C_MTXRotRad(Mtx m, char axis, f32 rad) {
+  f32 sinA;
+  f32 cosA;
+
+  assert(m && "MTXRotRad():  NULL MtxPtr 'm' ");
+  sinA = sinf(rad);
+  cosA = cosf(rad);
+  C_MTXRotTrig(m, axis, sinA, cosA);
+}
+
+void C_MTXRotTrig(Mtx m, char axis, f32 sinA, f32 cosA) {
+  assert(m && "MTXRotTrig():  NULL MtxPtr 'm' ");
+  switch(axis) {
+  case 'x':
+  case 'X':
+    m[0][0] = 1;
+    m[0][1] = 0;
+    m[0][2] = 0;
+    m[0][3] = 0;
+    m[1][0] = 0;
+    m[1][1] = cosA;
+    m[1][2] = -sinA;
+    m[1][3] = 0;
+    m[2][0] = 0;
+    m[2][1] = sinA;
+    m[2][2] = cosA;
+    m[2][3] = 0;
+    break;
+  case 'y':
+  case 'Y':
+    m[0][0] = cosA;
+    m[0][1] = 0;
+    m[0][2] = sinA;
+    m[0][3] = 0;
+    m[1][0] = 0;
+    m[1][1] = 1;
+    m[1][2] = 0;
+    m[1][3] = 0;
+    m[2][0] = -sinA;
+    m[2][1] = 0;
+    m[2][2] = cosA;
+    m[2][3] = 0;
+    break;
+  case 'z':
+  case 'Z':
+    m[0][0] = cosA;
+    m[0][1] = -sinA;
+    m[0][2] = 0;
+    m[0][3] = 0;
+    m[1][0] = sinA;
+    m[1][1] = cosA;
+    m[1][2] = 0;
+    m[1][3] = 0;
+    m[2][0] = 0;
+    m[2][1] = 0;
+    m[2][2] = 1;
+    m[2][3] = 0;
+    break;
+  default:
+    assert(0 && "MTXRotTrig():  invalid 'axis' value ");
+    break;
+  }
+}
+
+void C_MTXRotAxisRad(Mtx m, const Vec* axis, f32 rad) {
+  Vec vN;
+  f32 s;
+  f32 c;
+  f32 t;
+  f32 x;
+  f32 y;
+  f32 z;
+  f32 xSq;
+  f32 ySq;
+  f32 zSq;
+
+  assert(m && "MTXRotAxisRad():  NULL MtxPtr 'm' ");
+  assert(axis && "MTXRotAxisRad():  NULL VecPtr 'axis' ");
+
+  s = sinf(rad);
+  c = cosf(rad);
+  t = 1 - c;
+  C_VECNormalize(axis, &vN);
+  x = vN.x;
+  y = vN.y;
+  z = vN.z;
+  xSq = (x * x);
+  ySq = (y * y);
+  zSq = (z * z);
+  m[0][0] = (c + (t * xSq));
+  m[0][1] = (y * (t * x)) - (s * z);
+  m[0][2] = (z * (t * x)) + (s * y);
+  m[0][3] = 0;
+  m[1][0] = ((y * (t * x)) + (s * z));
+  m[1][1] = (c + (t * ySq));
+  m[1][2] = ((z * (t * y)) - (s * x));
+  m[1][3] = 0;
+  m[2][0] = ((z * (t * x)) - (s * y));
+  m[2][1] = ((z * (t * y)) + (s * x));
+  m[2][2] = (c + (t * zSq));
+  m[2][3] = 0;
+}
+
+void C_MTXReorder(const Mtx src, ROMtx dst)
+{
+  u32 i;
+  u32 j;
+  for (i = 0; i < 3; i++) {
+    for (j = 0; j < 4; j++) {
+      dst[j][i] = src[i][j];
+    }
+  }
+}
+
+void C_MTXLookAt(Mtx m, const Point3d* camPos, const Vec* camUp, const Point3d* target) {
+  Vec vLook;
+  Vec vRight;
+  Vec vUp;
+
+  assert(m && "MTXLookAt():  NULL MtxPtr 'm' ");
+  assert(camPos && "MTXLookAt():  NULL VecPtr 'camPos' ");
+  assert(camUp && "MTXLookAt():  NULL VecPtr 'camUp' ");
+  assert(target && "MTXLookAt():  NULL Point3dPtr 'target' ");
+
+  vLook.x = camPos->x - target->x;
+  vLook.y = camPos->y - target->y;
+  vLook.z = camPos->z - target->z;
+  VECNormalize(&vLook, &vLook);
+  VECCrossProduct(camUp, &vLook, &vRight);
+  VECNormalize(&vRight, &vRight);
+  VECCrossProduct(&vLook, &vRight, &vUp);
+  m[0][0] = vRight.x;
+  m[0][1] = vRight.y;
+  m[0][2] = vRight.z;
+  m[0][3] = -((camPos->z * vRight.z) + ((camPos->x * vRight.x) + (camPos->y * vRight.y)));
+  m[1][0] = vUp.x;
+  m[1][1] = vUp.y;
+  m[1][2] = vUp.z;
+  m[1][3] = -((camPos->z * vUp.z) + ((camPos->x * vUp.x) + (camPos->y * vUp.y)));
+  m[2][0] = vLook.x;
+  m[2][1] = vLook.y;
+  m[2][2] = vLook.z;
+  m[2][3] = -((camPos->z * vLook.z) + ((camPos->x * vLook.x) + (camPos->y * vLook.y)));
+}
+
+void C_MTXLightFrustum(Mtx m, f32 t, f32 b, f32 l, f32 r, f32 n, f32 scaleS, f32 scaleT, f32 transS, f32 transT) {
+  f32 tmp;
+
+  assert(m && "MTXLightFrustum():  NULL MtxPtr 'm' ");
+  assert((t != b) && "MTXLightFrustum():  't' and 'b' clipping planes are equal ");
+  assert((l != r) && "MTXLightFrustum():  'l' and 'r' clipping planes are equal ");
+
+  tmp = 1 / (r - l);
+  m[0][0] = (scaleS * (2 * n * tmp));
+  m[0][1] = 0;
+  m[0][2] = (scaleS * (tmp * (r + l))) - transS;
+  m[0][3] = 0;
+  tmp = 1 / (t - b);
+  m[1][0] = 0;
+  m[1][1] = (scaleT * (2 * n * tmp));
+  m[1][2] = (scaleT * (tmp * (t + b))) - transT;
+  m[1][3] = 0;
+  m[2][0] = 0;
+  m[2][1] = 0;
+  m[2][2] = -1;
+  m[2][3] = 0;
+}
+
+void C_MTXLightPerspective(Mtx m, f32 fovY, f32 aspect, f32 scaleS, f32 scaleT, f32 transS, f32 transT) {
+  f32 angle;
+  f32 cot;
+
+  assert(m && "MTXLightPerspective():  NULL MtxPtr 'm' ");
+  assert((fovY > 0.0) && (fovY < 180.0) && "MTXLightPerspective():  'fovY' out of range ");
+  assert(0 != aspect && "MTXLightPerspective():  'aspect' is 0 ");
+
+  angle = (0.5f * fovY);
+  angle = MTXDegToRad(angle);
+  cot = 1 / tanf(angle);
+  m[0][0] = (scaleS * (cot / aspect));
+  m[0][1] = 0;
+  m[0][2] = -transS;
+  m[0][3] = 0;
+  m[1][0] = 0;
+  m[1][1] = (cot * scaleT);
+  m[1][2] = -transT;
+  m[1][3] = 0;
+  m[2][0] = 0;
+  m[2][1] = 0;
+  m[2][2] = -1;
+  m[2][3] = 0;
+}
+
+void C_MTXLightOrtho(Mtx m, f32 t, f32 b, f32 l, f32 r, f32 scaleS, f32 scaleT, f32 transS, f32 transT) {
+  f32 tmp;
+
+  assert(m && "MTXLightOrtho():  NULL MtxPtr 'm' ");
+  assert((t != b) && "MTXLightOrtho():  't' and 'b' clipping planes are equal ");
+  assert((l != r) && "MTXLightOrtho():  'l' and 'r' clipping planes are equal ");
+  tmp = 1 / (r - l);
+  m[0][0] = (2 * tmp * scaleS);
+  m[0][1] = 0;
+  m[0][2] = 0;
+  m[0][3] = (transS + (scaleS * (tmp * -(r + l))));
+  tmp = 1/ (t - b);
+  m[1][0] = 0;
+  m[1][1] = (2 * tmp * scaleT);
+  m[1][2] = 0;
+  m[1][3] = (transT + (scaleT * (tmp * -(t + b))));
+  m[2][0] = 0;
+  m[2][1] = 0;
+  m[2][2] = 0;
+  m[2][3] = 1;
+}
diff --git a/aurora-main/lib/dolphin/mtx/mtx44.c b/aurora-main/lib/dolphin/mtx/mtx44.c
new file mode 100644
index 0000000..1ca47cf
--- /dev/null
+++ b/aurora-main/lib/dolphin/mtx/mtx44.c
@@ -0,0 +1,34 @@
+#include <assert.h>
+#include <math.h>
+#include <dolphin/mtx/mtx44ext.h>
+
+void C_MTXPerspective(Mtx44 m, f32 fovY, f32 aspect, f32 n, f32 f) {
+  f32 angle;
+  f32 cot;
+  f32 tmp;
+
+  assert(m && "MTXPerspective():  NULL Mtx44Ptr 'm' ");
+  assert((fovY > 0.0) && (fovY < 180.0) && "MTXPerspective():  'fovY' out of range ");
+  assert(0.0f != aspect && "MTXPerspective():  'aspect' is 0 ");
+
+  angle = (0.5f * fovY);
+  angle = MTXDegToRad(angle);
+  cot = 1 / tanf(angle);
+  m[0][0] = (cot / aspect);
+  m[0][1] = 0;
+  m[0][2] = 0;
+  m[0][3] = 0;
+  m[1][0] = 0;
+  m[1][1] = (cot);
+  m[1][2] = 0;
+  m[1][3] = 0;
+  m[2][0] = 0;
+  m[2][1] = 0;
+  tmp = 1 / (f - n);
+  m[2][2] = (-n * tmp);
+  m[2][3] = (tmp * -(f * n));
+  m[3][0] = 0;
+  m[3][1] = 0;
+  m[3][2] = -1;
+  m[3][3] = 0;
+}
\ No newline at end of file
diff --git a/aurora-main/lib/dolphin/mtx/mtxstack.c b/aurora-main/lib/dolphin/mtx/mtxstack.c
new file mode 100644
index 0000000..c026935
--- /dev/null
+++ b/aurora-main/lib/dolphin/mtx/mtxstack.c
@@ -0,0 +1,108 @@
+#include <assert.h>
+#include <stdint.h>
+#include <dolphin/mtx.h>
+
+void MTXInitStack(MTXStack* sPtr, u32 numMtx) {
+    assert(sPtr && "MTXInitStack():  NULL MtxStackPtr 'sPtr' ");
+    assert(sPtr->stackBase && "MTXInitStack():  'sPtr' contains a NULL ptr to stack memory ");
+    assert(numMtx && "MTXInitStack():  'numMtx' is 0 ");
+
+    sPtr->numMtx = numMtx;
+    sPtr->stackPtr = 0;
+}
+
+MtxPtr MTXPush(MTXStack* sPtr, const Mtx m) {
+    assert(sPtr && "MTXPush():  NULL MtxStackPtr 'sPtr' ");
+    assert(sPtr->stackBase && "MTXPush():  'sPtr' contains a NULL ptr to stack memory ");
+    assert(m && "MTXPush():  NULL MtxPtr 'm' ");
+
+    if (sPtr->stackPtr == NULL) {
+        sPtr->stackPtr = sPtr->stackBase;
+        MTXCopy(m, sPtr->stackPtr);
+    } else {
+        assert(((((uintptr_t)sPtr->stackPtr - (uintptr_t)sPtr->stackBase) / 16) / 3) < (sPtr->numMtx - 1) && "MTXPush():  stack overflow ");
+        MTXCopy(m, sPtr->stackPtr + 3);
+        sPtr->stackPtr += 3;
+    }
+
+    return sPtr->stackPtr;
+}
+
+MtxPtr MTXPushFwd(MTXStack* sPtr, const Mtx m) {
+    assert(sPtr && "MTXPushFwd():  NULL MtxStackPtr 'sPtr' ");
+    assert(sPtr->stackBase && "MTXPushFwd():  'sPtr' contains a NULL ptr to stack memory ");
+    assert(m && "MTXPushFwd():  NULL MtxPtr 'm' ");
+
+    if (sPtr->stackPtr == NULL) {
+        sPtr->stackPtr = sPtr->stackBase;
+        MTXCopy(m, sPtr->stackPtr);
+    } else {
+        assert(((((uintptr_t)sPtr->stackPtr - (uintptr_t)sPtr->stackBase) / 16) / 3) < (sPtr->numMtx - 1) && "MTXPushFwd():  stack overflow");
+        MTXConcat(sPtr->stackPtr, m, sPtr->stackPtr + 3);
+        sPtr->stackPtr += 3;
+    }
+
+    return sPtr->stackPtr;
+}
+
+MtxPtr MTXPushInv(MTXStack* sPtr, const Mtx m) {
+    Mtx mInv;
+    assert(sPtr && "MTXPushInv():  NULL MtxStackPtr 'sPtr' ");
+    assert(sPtr->stackBase && "MTXPushInv():  'sPtr' contains a NULL ptr to stack memory ");
+    assert(m && "MTXPushInv():  NULL MtxPtr 'm' ");
+
+    MTXInverse(m, mInv);
+    if (sPtr->stackPtr == NULL) {
+        sPtr->stackPtr = sPtr->stackBase;
+        MTXCopy(mInv, sPtr->stackPtr);
+    } else {
+        assert(((((uintptr_t)sPtr->stackPtr - (uintptr_t)sPtr->stackBase) / 16) / 3) < (sPtr->numMtx - 1) && "MTXPushInv():  stack overflow");
+        MTXConcat(mInv, sPtr->stackPtr, sPtr->stackPtr + 3);
+        sPtr->stackPtr += 3;
+    }
+
+    return sPtr->stackPtr;
+}
+
+MtxPtr MTXPushInvXpose(MTXStack* sPtr, const Mtx m) {
+    Mtx mIT;
+    assert(sPtr && "MTXPushInvXpose():  NULL MtxStackPtr 'sPtr' ");
+    assert(sPtr->stackBase && "MTXPushInvXpose():  'sPtr' contains a NULL ptr to stack memory ");
+    assert(m && "MTXPushInvXpose():  NULL MtxPtr 'm' ");
+
+    MTXInverse(m, mIT);
+    MTXTranspose(mIT, mIT);
+    if (sPtr->stackPtr == NULL) {
+        sPtr->stackPtr = sPtr->stackBase;
+        MTXCopy(mIT, sPtr->stackPtr);
+    } else {
+        assert(((((uintptr_t)sPtr->stackPtr - (uintptr_t)sPtr->stackBase) / 16) / 3) < (sPtr->numMtx - 1) && "MTXPushInvXpose():  stack overflow ");
+        MTXConcat(sPtr->stackPtr, mIT, sPtr->stackPtr + 3);
+        sPtr->stackPtr += 3;
+    }
+
+    return sPtr->stackPtr;
+}
+
+MtxPtr MTXPop(MTXStack* sPtr) {
+    assert(sPtr && "MTXPop():  NULL MtxStackPtr 'sPtr' ");
+    assert(sPtr->stackBase && "MTXPop():  'sPtr' contains a NULL ptr to stack memory ");
+    
+    if (sPtr->stackPtr == NULL) {
+        return NULL;
+    }
+
+    if (sPtr->stackBase == sPtr->stackPtr) {
+        sPtr->stackPtr = NULL;
+        return NULL;
+    }
+
+    sPtr->stackPtr -= 3;
+    return sPtr->stackPtr;
+}
+
+MtxPtr MTXGetStackPtr(const MTXStack* sPtr) {
+    assert(sPtr && "MTXGetStackPtr():  NULL MtxStackPtr 'sPtr' ");
+    assert(sPtr->stackBase && "MTXGetStackPtr():  'sPtr' contains a NULL ptr to stack memory ");
+    return sPtr->stackPtr;
+}
diff --git a/aurora-main/lib/dolphin/mtx/mtxvec.c b/aurora-main/lib/dolphin/mtx/mtxvec.c
new file mode 100644
index 0000000..fcb32e0
--- /dev/null
+++ b/aurora-main/lib/dolphin/mtx/mtxvec.c
@@ -0,0 +1,95 @@
+#include <assert.h>
+#include <dolphin/mtx.h>
+
+void C_MTXMultVec(const Mtx m, const Vec* src, Vec* dst) {
+  Vec vTmp;
+
+  assert(m && "MTXMultVec():  NULL MtxPtr 'm' ");
+  assert(src && "MTXMultVec():  NULL VecPtr 'src' ");
+  assert(dst && "MTXMultVec():  NULL VecPtr 'dst' ");
+
+  vTmp.x = m[0][3] + ((m[0][2] * src->z) + ((m[0][0] * src->x) + (m[0][1] * src->y)));
+  vTmp.y = m[1][3] + ((m[1][2] * src->z) + ((m[1][0] * src->x) + (m[1][1] * src->y)));
+  vTmp.z = m[2][3] + ((m[2][2] * src->z) + ((m[2][0] * src->x) + (m[2][1] * src->y)));
+  dst->x = vTmp.x;
+  dst->y = vTmp.y;
+  dst->z = vTmp.z;
+}
+
+void C_MTXMultVecArray(const Mtx m, const Vec* srcBase, Vec* dstBase, u32 count) {
+  u32 i;
+  Vec vTmp;
+
+  assert(m && "MTXMultVecArray():  NULL MtxPtr 'm' ");
+  assert(srcBase && "MTXMultVecArray():  NULL VecPtr 'srcBase' ");
+  assert(dstBase && "MTXMultVecArray():  NULL VecPtr 'dstBase' ");
+  assert(count > 1 && "MTXMultVecArray():  count must be greater than 1.");
+
+  for(i = 0; i < count; i++) {
+    vTmp.x = m[0][3] + ((m[0][2] * srcBase->z) + ((m[0][0] * srcBase->x) + (m[0][1] * srcBase->y)));
+    vTmp.y = m[1][3] + ((m[1][2] * srcBase->z) + ((m[1][0] * srcBase->x) + (m[1][1] * srcBase->y)));
+    vTmp.z = m[2][3] + ((m[2][2] * srcBase->z) + ((m[2][0] * srcBase->x) + (m[2][1] * srcBase->y)));
+    dstBase->x = vTmp.x;
+    dstBase->y = vTmp.y;
+    dstBase->z = vTmp.z;
+    srcBase++;
+    dstBase++;
+  }
+}
+
+void C_MTXMultVecSR(const Mtx m, const Vec* src, Vec* dst) {
+  Vec vTmp;
+
+  assert(m && "MTXMultVecSR():  NULL MtxPtr 'm' ");
+  assert(src && "MTXMultVecSR():  NULL VecPtr 'src' ");
+  assert(dst && "MTXMultVecSR():  NULL VecPtr 'dst' ");
+
+  vTmp.x = (m[0][2] * src->z) + ((m[0][0] * src->x) + (m[0][1] * src->y));
+  vTmp.y = (m[1][2] * src->z) + ((m[1][0] * src->x) + (m[1][1] * src->y));
+  vTmp.z = (m[2][2] * src->z) + ((m[2][0] * src->x) + (m[2][1] * src->y));
+  dst->x = vTmp.x;
+  dst->y = vTmp.y;
+  dst->z = vTmp.z;
+}
+
+void C_MTXMultVecArraySR(const Mtx m, const Vec* srcBase, Vec* dstBase, u32 count) {
+  u32 i;
+  Vec vTmp;
+
+  assert(m && "MTXMultVecArraySR():  NULL MtxPtr 'm' ");
+  assert(srcBase && "MTXMultVecArraySR():  NULL VecPtr 'srcBase' ");
+  assert(dstBase && "MTXMultVecArraySR():  NULL VecPtr 'dstBase' ");
+  assert(count > 1 && "MTXMultVecArraySR():  count must be greater than 1.");
+
+  for(i = 0; i < count; i++) {
+    vTmp.x = (m[0][2] * srcBase->z) + ((m[0][0] * srcBase->x) + (m[0][1] * srcBase->y));
+    vTmp.y = (m[1][2] * srcBase->z) + ((m[1][0] * srcBase->x) + (m[1][1] * srcBase->y));
+    vTmp.z = (m[2][2] * srcBase->z) + ((m[2][0] * srcBase->x) + (m[2][1] * srcBase->y));
+    dstBase->x = vTmp.x;
+    dstBase->y = vTmp.y;
+    dstBase->z = vTmp.z;
+    srcBase++;
+    dstBase++;
+  }
+}
+
+void C_MTXROMultVecArray(const ROMtx m, const Vec *srcBase, Vec *dstBase, u32 count)
+{
+  u32 i;
+  Vec vTmp;
+
+  assert(m && "MTXROMultVecArray():  NULL MtxPtr 'm' ");
+  assert(srcBase && "MTXROMultVecArray():  NULL VecPtr 'srcBase' ");
+  assert(dstBase && "MTXROMultVecArray():  NULL VecPtr 'dstBase' ");
+
+  for(i = 0; i < count; i++) {
+    vTmp.x = (m[0][0] * srcBase->x) + (m[1][0] * srcBase->y) + (m[2][0] * srcBase->z) + m[3][0];
+    vTmp.y = (m[0][1] * srcBase->x) + (m[1][1] * srcBase->y) + (m[2][1] * srcBase->z) + m[3][1];
+    vTmp.z = (m[0][2] * srcBase->x) + (m[1][2] * srcBase->y) + (m[2][2] * srcBase->z) + m[3][2];
+    dstBase->x = vTmp.x;
+    dstBase->y = vTmp.y;
+    dstBase->z = vTmp.z;
+    srcBase++;
+    dstBase++;
+  }
+}
diff --git a/aurora-main/lib/dolphin/mtx/quat.c b/aurora-main/lib/dolphin/mtx/quat.c
new file mode 100644
index 0000000..80966d6
--- /dev/null
+++ b/aurora-main/lib/dolphin/mtx/quat.c
@@ -0,0 +1,313 @@
+#include <assert.h>
+#include <math.h>
+#include <dolphin/mtx.h>
+
+void C_QUATAdd(const Quaternion* p, const Quaternion* q, Quaternion* r) {
+  assert(p && "QUATAdd():  NULL QuaternionPtr 'p' ");
+  assert(q && "QUATAdd():  NULL QuaternionPtr 'q' ");
+  assert(r && "QUATAdd():  NULL QuaternionPtr 'r' ");
+
+  r->x = p->x + q->x;
+  r->y = p->y + q->y;
+  r->z = p->z + q->z;
+  r->w = p->w + q->w;
+}
+
+void C_QUATSubtract(const Quaternion* p, const Quaternion* q, Quaternion* r) {
+  assert(p && "QUATSubtract():  NULL QuaternionPtr 'p' ");
+  assert(q && "QUATSubtract():  NULL QuaternionPtr 'q' ");
+  assert(r && "QUATSubtract():  NULL QuaternionPtr 'r' ");
+
+  r->x = p->x - q->x;
+  r->y = p->y - q->y;
+  r->z = p->z - q->z;
+  r->w = p->w - q->w;
+}
+
+void C_QUATMultiply(const Quaternion* p, const Quaternion* q, Quaternion* pq) {
+  Quaternion* r;
+  Quaternion pqTmp;
+
+  assert(p && "QUATMultiply():  NULL QuaternionPtr 'p' ");
+  assert(q && "QUATMultiply():  NULL QuaternionPtr 'q' ");
+  assert(pq && "QUATMultiply():  NULL QuaternionPtr 'pq' ");
+
+  if (p == pq || q == pq){
+    r = &pqTmp;
+  } else {
+    r = pq;
+  }
+
+  r->w = (p->w * q->w) - (p->x * q->x) - (p->y * q->y) - (p->z * q->z);
+  r->x = (p->w * q->x) + (p->x * q->w) + (p->y * q->z) - (p->z * q->y);
+  r->y = (p->w * q->y) + (p->y * q->w) + (p->z * q->x) - (p->x * q->z);
+  r->z = (p->w * q->z) + (p->z * q->w) + (p->x * q->y) - (p->y * q->x);
+
+  if (r == &pqTmp) {
+    *pq = pqTmp;
+  }
+}
+
+void C_QUATDivide(const Quaternion* p, const Quaternion* q, Quaternion* r) {
+  Quaternion qtmp;
+  assert(p && "QUATDivide():  NULL QuaternionPtr 'p' ");
+  assert(q && "QUATDivide():  NULL QuaternionPtr 'q' ");
+  assert(r && "QUATDivide():  NULL QuaternionPtr 'r' ");
+
+  C_QUATInverse(q, &qtmp);
+  C_QUATMultiply(&qtmp, p, r);
+}
+
+void C_QUATScale(const Quaternion* q, Quaternion* r, f32 scale) {
+  assert(q && "QUATScale():  NULL QuaternionPtr 'q' ");
+  assert(r && "QUATScale():  NULL QuaternionPtr 'r' ");
+
+  r->x = q->x * scale;
+  r->y = q->y * scale;
+  r->z = q->z * scale;
+  r->w = q->w * scale;
+}
+
+f32 C_QUATDotProduct(const Quaternion* p, const Quaternion* q) {
+  assert(p && "QUATDotProduct():  NULL QuaternionPtr 'p' ");
+  assert(q && "QUATDotProduct():  NULL QuaternionPtr 'q' ");
+
+  return (q->x * p->x) + (q->y * p->y) + (q->z * p->z) + (q->w * p->w);
+}
+
+void C_QUATNormalize(const Quaternion* src, Quaternion* unit) {
+  f32 mag;
+  assert(src && "QUATNormalize():  NULL QuaternionPtr 'src' ");
+  assert(unit && "QUATNormalize():  NULL QuaternionPtr 'unit' ");
+
+  mag = (src->x * src->x) + (src->y * src->y) + (src->z * src->z) + (src->w * src->w);
+  if (mag >= 0.00001f) {
+    mag = 1.0f / sqrtf(mag);
+
+    unit->x = src->x * mag;
+    unit->y = src->y * mag;
+    unit->z = src->z * mag;
+    unit->w = src->w * mag;
+  } else {
+    unit->x = unit->y = unit->z = unit->w = 0.0f;
+  }
+}
+
+void C_QUATInverse(const Quaternion* src, Quaternion* inv) {
+  f32 mag, norminv;
+  assert(src && "QUATInverse():  NULL QuaternionPtr 'src' ");
+  assert(inv && "QUATInverse():  NULL QuaternionPtr 'inv' ");
+
+  mag = (src->x * src->x) + (src->y * src->y) + (src->z * src->z) + (src->w * src->w);
+  if (mag == 0.0f) {
+    mag = 1.0f;
+  }
+
+  norminv = 1.0f / mag;
+  inv->x = -src->x * norminv;
+  inv->y = -src->y * norminv;
+  inv->z = -src->z * norminv;
+  inv->w =  src->w * norminv;
+}
+
+void C_QUATExp(const Quaternion* q, Quaternion* r)  {
+  f32 theta, scale;
+  assert(q && "QUATExp():  NULL QuaternionPtr 'q' ");
+  assert(r && "QUATExp():  NULL QuaternionPtr 'r' ");
+  assert(q->w == 0.0f && "QUATExp():  'q' is not a pure quaternion. ");
+
+  theta = sqrtf((q->x * q->x) + (q->y * q->y) + (q->z * q->z));
+  scale = 1.0f;
+
+  if (theta > 0.00001f) {
+    scale = sinf(theta) / theta;
+  }
+
+  r->x = scale * q->x;
+  r->y = scale * q->y;
+  r->z = scale * q->z;
+  r->w = cosf(theta);
+}
+
+void C_QUATLogN(const Quaternion* q, Quaternion* r) {
+  f32 theta, scale;
+  assert(q && "QUATLogN():  NULL QuaternionPtr 'q' ");
+  assert(r && "QUATLogN():  NULL QuaternionPtr 'r' ");
+
+  scale = (q->x * q->x) + (q->y * q->y) + (q->z * q->z);
+
+  scale = sqrtf(scale);
+  theta = atan2f(scale, q->w);
+
+  if (scale > 0.0f) {
+    scale = theta / scale;
+  }
+
+  r->x = scale * q->x;
+  r->y = scale * q->y;
+  r->z = scale * q->z;
+  r->w = 0.0f;
+}
+
+
+void C_QUATMakeClosest(const Quaternion* q, const Quaternion* qto, Quaternion* r) {
+  f32 dot;
+  assert(q && "QUATMakeClosest():  NULL QuaternionPtr 'q' ");
+  assert(qto && "QUATMakeClosest():  NULL QuaternionPtr 'qto' ");
+  assert(r && "QUATMakeClosest():  NULL QuaternionPtr 'r' ");
+
+  dot = (q->x * qto->x) + (q->y * qto->y) + (q->z * qto->z) + (q->w * qto->w);
+  if (dot < 0.0f) {
+    r->x = -q->x;
+    r->y = -q->y;
+    r->z = -q->z;
+    r->w = -q->w;
+  } else {
+    *r = *q;
+  }
+}
+
+void C_QUATRotAxisRad(Quaternion* r, const Vec* axis, f32 rad) {
+  f32 half, sh, ch;
+  Vec nAxis;
+
+  assert(r && "QUATRotAxisRad():  NULL QuaternionPtr 'r' ");
+  assert(axis && "QUATRotAxisRad():  NULL VecPtr 'axis' ");
+
+  VECNormalize(axis, &nAxis);
+
+  half = rad * 0.5f;
+  sh = sinf(half);
+  ch = cosf(half);
+
+  r->x = sh * nAxis.x;
+  r->y = sh * nAxis.y;
+  r->z = sh * nAxis.z;
+  r->w = ch;
+}
+
+void C_QUATMtx(Quaternion* r, const Mtx m) {
+  f32 tr,s;
+  s32 i, j, k;
+  s32 nxt[3] = {1, 2, 0};
+  f32 q[3];
+
+  assert(r && "QUATMtx():  NULL QuaternionPtr 'r' ");
+  assert(m && "QUATMtx():  NULL MtxPtr 'm' ");
+
+  tr = m[0][0] + m[1][1] + m[2][2];
+  if (tr > 0.0f) {
+    s = sqrtf(tr + 1.0f);
+    r->w = s * 0.5f;
+    s = 0.5f / s;
+
+    r->x = (m[2][1] - m[1][2]) * s;
+    r->y = (m[0][2] - m[2][0]) * s;
+    r->z = (m[1][0] - m[0][1]) * s;
+  } else  {
+    i = 0;
+    if (m[1][1] > m[0][0]) {
+      i = 1;
+    }
+
+    if (m[2][2] > m[i][i]) {
+      i = 2;
+    }
+
+    j = nxt[i];
+    k = nxt[j];
+
+    s = sqrtf((m[i][i] - (m[j][j] + m[k][k])) + 1.0f);
+    q[i] = s * 0.5f;
+
+    if (s != 0.0f) {
+      s = 0.5f / s;
+    }
+
+    r->w = (m[k][j] - m[j][k]) * s;
+    q[j] = (m[i][j] + m[j][i]) * s;
+    q[k] = (m[i][k] + m[k][i]) * s;
+
+    r->x = q[0];
+    r->y = q[1];
+    r->z = q[2];
+  }
+}
+
+void C_QUATLerp(const Quaternion* p, const Quaternion* q, Quaternion* r, f32 t) {
+  assert(p && "QUATLerp():  NULL QuaternionPtr 'p' ");
+  assert(q && "QUATLerp():  NULL QuaternionPtr 'q' ");
+  assert(r && "QUATLerp():  NULL QuaternionPtr 'r' ");
+
+  r->x = t * (q->x - p->x) + p->x;
+  r->y = t * (q->y - p->y) + p->y;
+  r->z = t * (q->z - p->z) + p->z;
+  r->w = t * (q->w - p->w) + p->w;
+}
+
+void C_QUATSlerp(const Quaternion* p, const Quaternion* q, Quaternion* r, f32 t) {
+    f32 theta, sin_th, cos_th;
+    f32 tp, tq;
+
+    assert(p && "QUATSlerp():  NULL QuaternionPtr 'p' ");
+    assert(q && "QUATSlerp():  NULL QuaternionPtr 'q' ");
+    assert(r && "QUATSlerp():  NULL QuaternionPtr 'r' ");
+
+    cos_th = p->x * q->x + p->y * q->y + p->z * q->z + p->w * q->w;
+    tq = 1.0f;
+
+    if (cos_th < 0.0f) {
+        cos_th = -cos_th;
+        tq = -tq;
+    }
+
+    if (cos_th <= 0.99999f) {
+        theta = acosf(cos_th);
+        sin_th = sinf(theta);
+
+        tp = sinf((1.0f - t) * theta) / sin_th;
+        tq *= sinf(t * theta) / sin_th;
+    } else {
+        tp = 1.0f - t;
+        tq *= t;
+    }
+
+    r->x = (tp * p->x) + (tq * q->x);
+    r->y = (tp * p->y) + (tq * q->y);
+    r->z = (tp * p->z) + (tq * q->z);
+    r->w = (tp * p->w) + (tq * q->w);
+}
+
+void C_QUATSquad(const Quaternion* p, const Quaternion* a, const Quaternion* b, const Quaternion* q, Quaternion* r, f32 t) {
+    Quaternion pq, ab;
+    f32 t2;
+
+    assert(p && "QUATSquad():  NULL QuaternionPtr 'p' ");
+    assert(a && "QUATSquad():  NULL QuaternionPtr 'a' ");
+    assert(b && "QUATSquad():  NULL QuaternionPtr 'b' ");
+    assert(q && "QUATSquad():  NULL QuaternionPtr 'q' ");
+    assert(r && "QUATSquad():  NULL QuaternionPtr 'r' ");
+
+    t2 = 2.0f * t * (1.0f - t);
+    C_QUATSlerp(p, q, &pq, t);
+    C_QUATSlerp(a, b, &ab, t);
+    C_QUATSlerp(&pq, &ab, r, t2);
+}
+
+void C_QUATCompA(const Quaternion* qprev, const Quaternion* q, const Quaternion* qnext, Quaternion* a) {
+    Quaternion qm, qp, lqm, lqp, qpqm, exq;
+
+    assert(qprev && "QUATCompA():  NULL QuaternionPtr 'qprev' ");
+    assert(q && "QUATCompA():  NULL QuaternionPtr 'q' ");
+    assert(qnext && "QUATCompA():  NULL QuaternionPtr 'qnext' ");
+    assert(a && "QUATCompA():  NULL QuaternionPtr 'a' ");
+
+    C_QUATDivide(qprev, q, &qm);
+    C_QUATLogN(&qm, &lqm);
+    C_QUATDivide(qnext, q, &qp);
+    C_QUATLogN(&qp, &lqp);
+    C_QUATAdd(&lqp, &lqm, &qpqm);
+    C_QUATScale(&qpqm, &qpqm, -0.25f);
+    C_QUATExp(&qpqm, &exq);
+    C_QUATMultiply(q, &exq, a);
+}
diff --git a/aurora-main/lib/dolphin/mtx/vec.c b/aurora-main/lib/dolphin/mtx/vec.c
new file mode 100644
index 0000000..6dc1467
--- /dev/null
+++ b/aurora-main/lib/dolphin/mtx/vec.c
@@ -0,0 +1,191 @@
+#include <assert.h>
+#include <math.h>
+#include <dolphin/mtx.h>
+#include <dolphin/ppc_math.h>
+
+void C_VECAdd(const Vec* a, const Vec* b, Vec* ab) {
+  assert(a && "VECAdd():  NULL VecPtr 'a' ");
+  assert(b && "VECAdd():  NULL VecPtr 'b' ");
+  assert(ab && "VECAdd():  NULL VecPtr 'ab' ");
+  ab->x = a->x + b->x;
+  ab->y = a->y + b->y;
+  ab->z = a->z + b->z;
+}
+
+void C_VECSubtract(const Vec* a, const Vec* b, Vec* a_b) {
+  assert(a && "VECSubtract():  NULL VecPtr 'a' ");
+  assert(b && "VECSubtract():  NULL VecPtr 'b' ");
+  assert(a_b && "VECSubtract():  NULL VecPtr 'a_b' ");
+  a_b->x = a->x - b->x;
+  a_b->y = a->y - b->y;
+  a_b->z = a->z - b->z;
+}
+
+void C_VECScale(const Vec* src, Vec* dst, f32 scale) {
+  assert(src && "VECScale():  NULL VecPtr 'src' ");
+  assert(dst && "VECScale():  NULL VecPtr 'dst' ");
+  dst->x = (src->x * scale);
+  dst->y = (src->y * scale);
+  dst->z = (src->z * scale);
+}
+
+void C_VECNormalize(const Vec* src, Vec* unit) {
+  f32 mag;
+
+  assert(src && "VECNormalize():  NULL VecPtr 'src' ");
+  assert(unit && "VECNormalize():  NULL VecPtr 'unit' ");
+
+  mag = (src->z * src->z) + ((src->x * src->x) + (src->y * src->y));
+  assert(0.0f != mag && "VECNormalize():  zero magnitude vector ");
+
+  mag = 1.0f/ sqrtf(mag);
+  unit->x = src->x * mag;
+  unit->y = src->y * mag;
+  unit->z = src->z * mag;
+}
+
+void PSVECNormalize(const Vec* src, Vec* unit) {
+  f32 sqsum;
+  f32 rsqrt;
+
+  assert(src && "VECNormalize():  NULL VecPtr 'src' ");
+  assert(unit && "VECNormalize():  NULL VecPtr 'unit' ");
+
+  sqsum = (src->z * src->z + src->x * src->x) + src->y * src->y;
+  assert(0.0f != sqsum && "VECNormalize():  zero magnitude vector ");
+
+  rsqrt = ppc_rsqrte(sqsum);
+  unit->x = src->x * rsqrt;
+  unit->y = src->y * rsqrt;
+  unit->z = src->z * rsqrt;
+}
+
+f32 C_VECSquareMag(const Vec* v) {
+  f32 sqmag;
+
+  assert(v && "VECMag():  NULL VecPtr 'v' ");
+
+  sqmag = v->z * v->z + ((v->x * v->x) + (v->y * v->y));
+  return sqmag;
+}
+
+f32 PSVECSquareMag(const Vec* v) {
+  assert(v && "VECMag():  NULL VecPtr 'v' ");
+  return (v->z * v->z + v->x * v->x) + v->y * v->y;
+}
+
+f32 C_VECMag(const Vec* v) {
+  return sqrtf(C_VECSquareMag(v));
+}
+
+f32 PSVECMag(const Vec* v) {
+  f32 sqmag;
+  sqmag = PSVECSquareMag(v);
+  if (sqmag == 0.0f) {
+    return 0.0f;
+  }
+  return sqmag * ppc_rsqrte(sqmag);
+}
+
+f32 C_VECDotProduct(const Vec* a, const Vec* b) {
+  f32 dot;
+
+  assert(a && "VECDotProduct():  NULL VecPtr 'a' ");
+  assert(b && "VECDotProduct():  NULL VecPtr 'b' ");
+  dot = (a->z * b->z) + ((a->x * b->x) + (a->y * b->y));
+  return dot;
+}
+
+void C_VECCrossProduct(const Vec* a, const Vec* b, Vec* axb) {
+  Vec vTmp;
+
+  assert(a && "VECCrossProduct():  NULL VecPtr 'a' ");
+  assert(b && "VECCrossProduct():  NULL VecPtr 'b' ");
+  assert(axb && "VECCrossProduct():  NULL VecPtr 'axb' ");
+
+  vTmp.x = (a->y * b->z) - (a->z * b->y);
+  vTmp.y = (a->z * b->x) - (a->x * b->z);
+  vTmp.z = (a->x * b->y) - (a->y * b->x);
+  axb->x = vTmp.x;
+  axb->y = vTmp.y;
+  axb->z = vTmp.z;
+}
+
+void C_VECHalfAngle(const Vec* a, const Vec* b, Vec* half) {
+  Vec aTmp;
+  Vec bTmp;
+  Vec hTmp;
+
+  assert(a && "VECHalfAngle():  NULL VecPtr 'a' ");
+  assert(b && "VECHalfAngle():  NULL VecPtr 'b' ");
+  assert(half && "VECHalfAngle():  NULL VecPtr 'half' ");
+
+  aTmp.x = -a->x;
+  aTmp.y = -a->y;
+  aTmp.z = -a->z;
+  bTmp.x = -b->x;
+  bTmp.y = -b->y;
+  bTmp.z = -b->z;
+
+  VECNormalize(&aTmp, &aTmp);
+  VECNormalize(&bTmp, &bTmp);
+  VECAdd(&aTmp, &bTmp, &hTmp);
+
+  if (VECDotProduct(&hTmp, &hTmp) > 0.0f) {
+    VECNormalize(&hTmp, half);
+    return;
+  }
+  *half = hTmp;
+}
+
+void C_VECReflect(const Vec* src, const Vec* normal, Vec* dst) {
+  f32 cosA;
+  Vec uI;
+  Vec uN;
+
+  assert(src && "VECReflect():  NULL VecPtr 'src' ");
+  assert(normal && "VECReflect():  NULL VecPtr 'normal' ");
+  assert(dst && "VECReflect():  NULL VecPtr 'dst' ");
+
+  uI.x = -src->x;
+  uI.y = -src->y;
+  uI.z = -src->z;
+
+  VECNormalize(&uI, &uI);
+  VECNormalize(normal, &uN);
+
+  cosA = VECDotProduct(&uI, &uN);
+  dst->x = (2.0f * uN.x * cosA) - uI.x;
+  dst->y = (2.0f * uN.y * cosA) - uI.y;
+  dst->z = (2.0f * uN.z * cosA) - uI.z;
+  VECNormalize(dst, dst);
+}
+
+f32 C_VECSquareDistance(const Vec* a, const Vec* b) {
+  Vec diff;
+
+  diff.x = a->x - b->x;
+  diff.y = a->y - b->y;
+  diff.z = a->z - b->z;
+  return (diff.z * diff.z) + ((diff.x * diff.x) + (diff.y * diff.y));
+}
+
+f32 PSVECSquareDistance(const Vec* a, const Vec* b) {
+  f32 dx = a->x - b->x;
+  f32 dy = a->y - b->y;
+  f32 dz = a->z - b->z;
+  return (dx * dx + dy * dy) + dz * dz;
+}
+
+f32 C_VECDistance(const Vec* a, const Vec* b) {
+  return sqrtf(C_VECSquareDistance(a, b));
+}
+
+f32 PSVECDistance(const Vec* a, const Vec* b) {
+  f32 sqdist;
+  sqdist = PSVECSquareDistance(a, b);
+  if (sqdist == 0.0f) {
+    return 0.0f;
+  }
+  return sqdist * ppc_rsqrte(sqdist);
+}
diff --git a/aurora-main/lib/dolphin/os/OSAddress.cpp b/aurora-main/lib/dolphin/os/OSAddress.cpp
new file mode 100644
index 0000000..8ca1b4a
--- /dev/null
+++ b/aurora-main/lib/dolphin/os/OSAddress.cpp
@@ -0,0 +1,41 @@
+#include "internal.hpp"
+#include <dolphin/os.h>
+
+#include <cassert>
+
+#if NDEBUG
+#undef OSPhysicalToCached
+#undef OSPhysicalToUncached
+#undef OSCachedToPhysical
+#undef OSUncachedToPhysical
+#undef OSCachedToUncached
+#undef OSUncachedToCached
+#endif
+
+void* OSPhysicalToCached(u32 paddr) {
+  assert (paddr <= aurora::g_config.mem1Size);
+  return POINTER_ADD(MEM1Start, paddr);
+}
+
+void* OSPhysicalToUncached(u32 paddr) {
+  return OSPhysicalToCached(paddr);
+}
+
+u32 OSCachedToPhysical(void* caddr) {
+  assert (caddr >= MEM1Start && caddr <= MEM1End);
+
+  return (reinterpret_cast<uintptr_t>(caddr) - reinterpret_cast<uintptr_t>(MEM1Start));
+}
+
+u32 OSUncachedToPhysical(void* ucaddr) {
+  return OSCachedToPhysical(ucaddr);
+}
+
+void* OSCachedToUncached(void* caddr) {
+  return caddr;
+}
+
+void* OSUncachedToCached(void* ucaddr) {
+  return ucaddr;
+}
+
diff --git a/aurora-main/lib/dolphin/os/OSAlloc.cpp b/aurora-main/lib/dolphin/os/OSAlloc.cpp
new file mode 100644
index 0000000..790e300
--- /dev/null
+++ b/aurora-main/lib/dolphin/os/OSAlloc.cpp
@@ -0,0 +1,564 @@
+#include <dolphin/os.h>
+
+#include <cstddef>
+#include <cstdint>
+
+#include "../../logging.hpp"
+
+extern "C" volatile OSHeapHandle __OSCurrHeap = -1;
+
+namespace {
+
+constexpr u32 kAlignment = 32;
+constexpr u32 kHeaderSize = 32;
+constexpr u32 kMinObjectSize = 64;
+
+struct HeapDesc;
+
+struct alignas(32) Cell {
+  Cell* prev;
+  Cell* next;
+  s32 size;
+  HeapDesc* owner;
+};
+
+static_assert(sizeof(Cell) == kHeaderSize, "Cell header must stay 32 bytes");
+
+struct HeapDesc {
+  s32 size;
+  Cell* freeList;
+  Cell* allocated;
+};
+
+static aurora::Module AllocLog("aurora::os::alloc");
+
+static HeapDesc* sHeapArray = nullptr;
+static int sNumHeaps = 0;
+static u8* sArenaStart = nullptr;
+static u8* sArenaEnd = nullptr;
+
+static uintptr_t roundUp32(const uintptr_t value) {
+  return (value + (kAlignment - 1)) & ~(static_cast<uintptr_t>(kAlignment - 1));
+}
+
+static uintptr_t roundDown32(const uintptr_t value) {
+  return value & ~(static_cast<uintptr_t>(kAlignment - 1));
+}
+
+static bool inArena(const void* ptr) {
+  if (sArenaStart == nullptr || sArenaEnd == nullptr) {
+    return false;
+  }
+  const auto p = reinterpret_cast<uintptr_t>(ptr);
+  return p >= reinterpret_cast<uintptr_t>(sArenaStart) && p < reinterpret_cast<uintptr_t>(sArenaEnd);
+}
+
+static bool validHeapHandle(const OSHeapHandle heap) {
+  return sHeapArray != nullptr && heap >= 0 && heap < sNumHeaps && sHeapArray[heap].size >= 0;
+}
+
+static Cell* addFront(Cell* list, Cell* cell) {
+  cell->prev = nullptr;
+  cell->next = list;
+  if (list != nullptr) {
+    list->prev = cell;
+  }
+  return cell;
+}
+
+static Cell* extract(Cell* list, Cell* cell) {
+  if (cell->next != nullptr) {
+    cell->next->prev = cell->prev;
+  }
+  if (cell->prev != nullptr) {
+    cell->prev->next = cell->next;
+    return list;
+  }
+  return cell->next;
+}
+
+static bool containsCell(Cell* list, Cell* cell) {
+  for (Cell* it = list; it != nullptr; it = it->next) {
+    if (it == cell) {
+      return true;
+    }
+  }
+  return false;
+}
+
+static Cell* insertAndCoalesce(Cell* list, Cell* cell) {
+  Cell* prev = nullptr;
+  Cell* next = list;
+  while (next != nullptr && next < cell) {
+    prev = next;
+    next = next->next;
+  }
+
+  cell->prev = prev;
+  cell->next = next;
+  if (prev != nullptr) {
+    prev->next = cell;
+  } else {
+    list = cell;
+  }
+  if (next != nullptr) {
+    next->prev = cell;
+  }
+
+  if (cell->next != nullptr) {
+    auto* right = cell->next;
+    if (reinterpret_cast<u8*>(cell) + cell->size == reinterpret_cast<u8*>(right)) {
+      cell->size += right->size;
+      cell->next = right->next;
+      if (right->next != nullptr) {
+        right->next->prev = cell;
+      }
+    }
+  }
+
+  if (cell->prev != nullptr) {
+    auto* left = cell->prev;
+    if (reinterpret_cast<u8*>(left) + left->size == reinterpret_cast<u8*>(cell)) {
+      left->size += cell->size;
+      left->next = cell->next;
+      if (cell->next != nullptr) {
+        cell->next->prev = left;
+      }
+      return list;
+    }
+  }
+
+  return list;
+}
+
+static bool validateBlockRange(const uintptr_t start, const uintptr_t end) {
+  if (start >= end) {
+    return false;
+  }
+  if (sArenaStart == nullptr || sArenaEnd == nullptr) {
+    return false;
+  }
+  return start >= reinterpret_cast<uintptr_t>(sArenaStart)
+      && end <= reinterpret_cast<uintptr_t>(sArenaEnd)
+      && (end - start) >= kMinObjectSize;
+}
+
+static void dropTinyCell(HeapDesc& hd, Cell* cell) {
+  hd.freeList = extract(hd.freeList, cell);
+  hd.size -= cell->size;
+}
+
+static void carveRangeFromHeap(HeapDesc& hd, uintptr_t carveStart, uintptr_t carveEnd) {
+  Cell* cell = hd.freeList;
+  while (cell != nullptr) {
+    Cell* nextCell = cell->next;
+    const auto cellStart = reinterpret_cast<uintptr_t>(cell);
+    const auto cellEnd = cellStart + static_cast<uintptr_t>(cell->size);
+
+    const auto overlapStart = carveStart > cellStart ? carveStart : cellStart;
+    const auto overlapEnd = carveEnd < cellEnd ? carveEnd : cellEnd;
+    if (overlapStart >= overlapEnd) {
+      cell = nextCell;
+      continue;
+    }
+
+    const auto removed = static_cast<s32>(overlapEnd - overlapStart);
+    hd.size -= removed;
+
+    const bool cutHead = overlapStart == cellStart;
+    const bool cutTail = overlapEnd == cellEnd;
+
+    if (cutHead && cutTail) {
+      hd.freeList = extract(hd.freeList, cell);
+    } else if (cutHead) {
+      auto* newCell = reinterpret_cast<Cell*>(overlapEnd);
+      newCell->size = static_cast<s32>(cellEnd - overlapEnd);
+      newCell->owner = nullptr;
+      newCell->prev = cell->prev;
+      newCell->next = cell->next;
+      if (newCell->prev != nullptr) {
+        newCell->prev->next = newCell;
+      } else {
+        hd.freeList = newCell;
+      }
+      if (newCell->next != nullptr) {
+        newCell->next->prev = newCell;
+      }
+      if (newCell->size < static_cast<s32>(kMinObjectSize)) {
+        dropTinyCell(hd, newCell);
+      }
+    } else if (cutTail) {
+      cell->size = static_cast<s32>(overlapStart - cellStart);
+      if (cell->size < static_cast<s32>(kMinObjectSize)) {
+        dropTinyCell(hd, cell);
+      }
+    } else {
+      const auto leftSize = static_cast<s32>(overlapStart - cellStart);
+      const auto rightSize = static_cast<s32>(cellEnd - overlapEnd);
+      if (leftSize >= static_cast<s32>(kMinObjectSize) && rightSize >= static_cast<s32>(kMinObjectSize)) {
+        auto* right = reinterpret_cast<Cell*>(overlapEnd);
+        right->size = rightSize;
+        right->owner = nullptr;
+        right->prev = cell;
+        right->next = cell->next;
+        if (right->next != nullptr) {
+          right->next->prev = right;
+        }
+        cell->next = right;
+        cell->size = leftSize;
+      } else if (leftSize >= static_cast<s32>(kMinObjectSize)) {
+        cell->size = leftSize;
+      } else if (rightSize >= static_cast<s32>(kMinObjectSize)) {
+        auto* right = reinterpret_cast<Cell*>(overlapEnd);
+        right->size = rightSize;
+        right->owner = nullptr;
+        right->prev = cell->prev;
+        right->next = cell->next;
+        if (right->prev != nullptr) {
+          right->prev->next = right;
+        } else {
+          hd.freeList = right;
+        }
+        if (right->next != nullptr) {
+          right->next->prev = right;
+        }
+      } else {
+        hd.freeList = extract(hd.freeList, cell);
+      }
+    }
+
+    cell = nextCell;
+  }
+}
+
+} // namespace
+
+extern "C" {
+
+void* OSInitAlloc(void* arenaStart, void* arenaEnd, int maxHeaps) {
+  if (arenaStart == nullptr || arenaEnd == nullptr || maxHeaps <= 0) {
+    return nullptr;
+  }
+
+  auto start = reinterpret_cast<uintptr_t>(arenaStart);
+  auto end = reinterpret_cast<uintptr_t>(arenaEnd);
+  if (start >= end) {
+    return nullptr;
+  }
+
+  const auto arrayBytes = static_cast<uintptr_t>(maxHeaps) * sizeof(HeapDesc);
+  if ((end - start) < arrayBytes + kMinObjectSize) {
+    return nullptr;
+  }
+
+  sHeapArray = reinterpret_cast<HeapDesc*>(arenaStart);
+  sNumHeaps = maxHeaps;
+  for (int i = 0; i < sNumHeaps; ++i) {
+    sHeapArray[i].size = -1;
+    sHeapArray[i].freeList = nullptr;
+    sHeapArray[i].allocated = nullptr;
+  }
+
+  __OSCurrHeap = -1;
+  sArenaStart = reinterpret_cast<u8*>(roundUp32(start + arrayBytes));
+  sArenaEnd = reinterpret_cast<u8*>(roundDown32(end));
+  if (sArenaEnd <= sArenaStart || static_cast<uintptr_t>(sArenaEnd - sArenaStart) < kMinObjectSize) {
+    sHeapArray = nullptr;
+    sNumHeaps = 0;
+    sArenaStart = nullptr;
+    sArenaEnd = nullptr;
+    return nullptr;
+  }
+
+  return sArenaStart;
+}
+
+OSHeapHandle OSCreateHeap(void* start, void* end) {
+  if (sHeapArray == nullptr) {
+    return -1;
+  }
+
+  const auto blockStart = roundUp32(reinterpret_cast<uintptr_t>(start));
+  const auto blockEnd = roundDown32(reinterpret_cast<uintptr_t>(end));
+  if (!validateBlockRange(blockStart, blockEnd)) {
+    return -1;
+  }
+
+  for (OSHeapHandle heap = 0; heap < sNumHeaps; ++heap) {
+    auto& hd = sHeapArray[heap];
+    if (hd.size >= 0) {
+      continue;
+    }
+
+    hd.size = static_cast<s32>(blockEnd - blockStart);
+    hd.allocated = nullptr;
+    hd.freeList = reinterpret_cast<Cell*>(blockStart);
+    hd.freeList->prev = nullptr;
+    hd.freeList->next = nullptr;
+    hd.freeList->size = hd.size;
+    hd.freeList->owner = nullptr;
+    return heap;
+  }
+
+  return -1;
+}
+
+void OSDestroyHeap(OSHeapHandle heap) {
+  if (!validHeapHandle(heap)) {
+    return;
+  }
+
+  auto& hd = sHeapArray[heap];
+  hd.size = -1;
+  hd.freeList = nullptr;
+  hd.allocated = nullptr;
+  if (__OSCurrHeap == heap) {
+    __OSCurrHeap = -1;
+  }
+}
+
+void OSAddToHeap(OSHeapHandle heap, void* start, void* end) {
+  if (!validHeapHandle(heap)) {
+    return;
+  }
+
+  const auto blockStart = roundUp32(reinterpret_cast<uintptr_t>(start));
+  const auto blockEnd = roundDown32(reinterpret_cast<uintptr_t>(end));
+  if (!validateBlockRange(blockStart, blockEnd)) {
+    return;
+  }
+
+  auto& hd = sHeapArray[heap];
+  auto* cell = reinterpret_cast<Cell*>(blockStart);
+  cell->prev = nullptr;
+  cell->next = nullptr;
+  cell->size = static_cast<s32>(blockEnd - blockStart);
+  cell->owner = nullptr;
+  hd.freeList = insertAndCoalesce(hd.freeList, cell);
+  hd.size += cell->size;
+}
+
+void* OSAllocFromHeap(OSHeapHandle heap, u32 size) {
+  if (!validHeapHandle(heap) || size == 0) {
+    return nullptr;
+  }
+
+  auto& hd = sHeapArray[heap];
+  const auto requested = static_cast<s32>(roundUp32(static_cast<uintptr_t>(size) + kHeaderSize));
+
+  Cell* cell = hd.freeList;
+  while (cell != nullptr && cell->size < requested) {
+    cell = cell->next;
+  }
+  if (cell == nullptr) {
+    return nullptr;
+  }
+
+  const auto leftover = cell->size - requested;
+  if (leftover < static_cast<s32>(kMinObjectSize)) {
+    hd.freeList = extract(hd.freeList, cell);
+  } else {
+    auto* split = reinterpret_cast<Cell*>(reinterpret_cast<u8*>(cell) + requested);
+    split->size = leftover;
+    split->owner = nullptr;
+    split->prev = cell->prev;
+    split->next = cell->next;
+    if (split->prev != nullptr) {
+      split->prev->next = split;
+    } else {
+      hd.freeList = split;
+    }
+    if (split->next != nullptr) {
+      split->next->prev = split;
+    }
+    cell->size = requested;
+  }
+
+  cell->owner = &hd;
+  hd.allocated = addFront(hd.allocated, cell);
+  return reinterpret_cast<u8*>(cell) + kHeaderSize;
+}
+
+void OSFreeToHeap(OSHeapHandle heap, void* ptr) {
+  if (!validHeapHandle(heap) || ptr == nullptr) {
+    return;
+  }
+  if (!inArena(ptr) || (reinterpret_cast<uintptr_t>(ptr) & (kAlignment - 1)) != 0) {
+    return;
+  }
+
+  auto& hd = sHeapArray[heap];
+  auto* cell = reinterpret_cast<Cell*>(reinterpret_cast<u8*>(ptr) - kHeaderSize);
+  if (cell->owner != &hd || !containsCell(hd.allocated, cell)) {
+    return;
+  }
+
+  hd.allocated = extract(hd.allocated, cell);
+  cell->owner = nullptr;
+  hd.freeList = insertAndCoalesce(hd.freeList, cell);
+}
+
+OSHeapHandle OSSetCurrentHeap(OSHeapHandle heap) {
+  const auto prev = __OSCurrHeap;
+  if (heap == -1 || validHeapHandle(heap)) {
+    __OSCurrHeap = heap;
+  }
+  return prev;
+}
+
+void* OSAllocFixed(void* rstart, void* rend) {
+  if (sHeapArray == nullptr || rstart == nullptr || rend == nullptr) {
+    return nullptr;
+  }
+
+  for (int i = 0; i < sNumHeaps; ++i) {
+    if (sHeapArray[i].size >= 0 && sHeapArray[i].allocated != nullptr) {
+      return nullptr;
+    }
+  }
+
+  const auto fixedStart = roundDown32(reinterpret_cast<uintptr_t>(rstart));
+  const auto fixedEnd = roundUp32(reinterpret_cast<uintptr_t>(rend));
+  if (fixedStart >= fixedEnd) {
+    return nullptr;
+  }
+  if (fixedStart < reinterpret_cast<uintptr_t>(sArenaStart)
+      || fixedEnd > reinterpret_cast<uintptr_t>(sArenaEnd)) {
+    return nullptr;
+  }
+
+  for (int i = 0; i < sNumHeaps; ++i) {
+    auto& hd = sHeapArray[i];
+    if (hd.size >= 0) {
+      carveRangeFromHeap(hd, fixedStart, fixedEnd);
+    }
+  }
+
+  return reinterpret_cast<void*>(fixedStart);
+}
+
+s32 OSCheckHeap(OSHeapHandle heap) {
+  if (!validHeapHandle(heap)) {
+    return -1;
+  }
+
+  auto& hd = sHeapArray[heap];
+  s32 total = 0;
+  s32 freeBytes = 0;
+
+  if (hd.allocated != nullptr && hd.allocated->prev != nullptr) {
+    return -1;
+  }
+
+  for (Cell* cell = hd.allocated; cell != nullptr; cell = cell->next) {
+    if (!inArena(cell)
+        || (reinterpret_cast<uintptr_t>(cell) & (kAlignment - 1)) != 0
+        || cell->size < static_cast<s32>(kMinObjectSize)
+        || (cell->size & (kAlignment - 1)) != 0
+        || cell->owner != &hd
+        || (cell->next != nullptr && cell->next->prev != cell)) {
+      return -1;
+    }
+    total += cell->size;
+    if (total <= 0 || total > hd.size) {
+      return -1;
+    }
+  }
+
+  if (hd.freeList != nullptr && hd.freeList->prev != nullptr) {
+    return -1;
+  }
+
+  for (Cell* cell = hd.freeList; cell != nullptr; cell = cell->next) {
+    if (!inArena(cell)
+        || (reinterpret_cast<uintptr_t>(cell) & (kAlignment - 1)) != 0
+        || cell->size < static_cast<s32>(kMinObjectSize)
+        || (cell->size & (kAlignment - 1)) != 0
+        || cell->owner != nullptr
+        || (cell->next != nullptr && cell->next->prev != cell)) {
+      return -1;
+    }
+    if (cell->next != nullptr) {
+      if (reinterpret_cast<uintptr_t>(cell) + static_cast<uintptr_t>(cell->size)
+          > reinterpret_cast<uintptr_t>(cell->next)) {
+        return -1;
+      }
+    }
+
+    total += cell->size;
+    freeBytes += cell->size - static_cast<s32>(kHeaderSize);
+    if (total <= 0 || total > hd.size) {
+      return -1;
+    }
+  }
+
+  if (total != hd.size) {
+    return -1;
+  }
+  return freeBytes;
+}
+
+u32 OSReferentSize(void* ptr) {
+  if (ptr == nullptr || !inArena(ptr) || (reinterpret_cast<uintptr_t>(ptr) & (kAlignment - 1)) != 0) {
+    return 0;
+  }
+  auto* cell = reinterpret_cast<Cell*>(reinterpret_cast<u8*>(ptr) - kHeaderSize);
+  if (cell->owner == nullptr) {
+    return 0;
+  }
+  return static_cast<u32>(cell->size - static_cast<s32>(kHeaderSize));
+}
+
+void OSDumpHeap(OSHeapHandle heap) {
+  AllocLog.info("OSDumpHeap({})", heap);
+  if (!validHeapHandle(heap)) {
+    AllocLog.info("--------Invalid");
+    return;
+  }
+
+  auto& hd = sHeapArray[heap];
+  if (OSCheckHeap(heap) < 0) {
+    AllocLog.info("--------Broken");
+    return;
+  }
+
+  AllocLog.info("addr\tsize\t\tend\t\tprev\t\tnext");
+  AllocLog.info("--------Allocated");
+  for (Cell* cell = hd.allocated; cell != nullptr; cell = cell->next) {
+    AllocLog.info("{}\t{}\t{}\t{}\t{}",
+                  reinterpret_cast<void*>(cell),
+                  cell->size,
+                  reinterpret_cast<void*>(reinterpret_cast<u8*>(cell) + cell->size),
+                  reinterpret_cast<void*>(cell->prev),
+                  reinterpret_cast<void*>(cell->next));
+  }
+
+  AllocLog.info("--------Free");
+  for (Cell* cell = hd.freeList; cell != nullptr; cell = cell->next) {
+    AllocLog.info("{}\t{}\t{}\t{}\t{}",
+                  reinterpret_cast<void*>(cell),
+                  cell->size,
+                  reinterpret_cast<void*>(reinterpret_cast<u8*>(cell) + cell->size),
+                  reinterpret_cast<void*>(cell->prev),
+                  reinterpret_cast<void*>(cell->next));
+  }
+}
+
+void OSVisitAllocated(void (*visitor)(void*, u32)) {
+  if (visitor == nullptr || sHeapArray == nullptr) {
+    return;
+  }
+
+  for (int heap = 0; heap < sNumHeaps; ++heap) {
+    auto& hd = sHeapArray[heap];
+    if (hd.size < 0) {
+      continue;
+    }
+    for (Cell* cell = hd.allocated; cell != nullptr; cell = cell->next) {
+      visitor(reinterpret_cast<u8*>(cell) + kHeaderSize,
+              static_cast<u32>(cell->size - static_cast<s32>(kHeaderSize)));
+    }
+  }
+}
+
+} // extern "C"
diff --git a/aurora-main/lib/dolphin/os/OSArena.cpp b/aurora-main/lib/dolphin/os/OSArena.cpp
new file mode 100644
index 0000000..5eeb861
--- /dev/null
+++ b/aurora-main/lib/dolphin/os/OSArena.cpp
@@ -0,0 +1,58 @@
+#include <cassert>
+
+#include "internal.hpp"
+
+#include <dolphin/os.h>
+
+#define ROUND64(n, a) (((u64)(n) + (a)-1) & ~(u64)((a)-1))
+#define TRUNC64(n, a) (((u64)(n)) & ~(u64)((a)-1))
+
+static void* ArenaLow;
+static void* ArenaHigh;
+
+void* OSGetArenaHi() {
+  return ArenaHigh;
+}
+
+void* OSGetArenaLo() {
+  return ArenaLow;
+}
+
+void OSSetArenaHi(void* newHi) {
+  assert(newHi <= MEM1End && newHi >= MEM1Start);
+  ArenaHigh = newHi;
+}
+
+void OSSetArenaLo(void* newLo) {
+  assert(newLo <= MEM1End && newLo >= MEM1Start);
+  ArenaLow = newLo;
+}
+
+void* OSAllocFromArenaLo(const u32 size, const u32 align) {
+  void* ptr = OSGetArenaLo();
+  auto arenaLo = static_cast<u8*>(ptr = reinterpret_cast<void*>(ROUND64(ptr, align)));
+  arenaLo += size;
+  arenaLo = reinterpret_cast<u8*>(ROUND64(arenaLo, align));
+  OSSetArenaLo(arenaLo);
+  return ptr;
+}
+
+void* OSAllocFromArenaHi(const u32 size, const u32 align) {
+  void* ptr;
+
+  auto arenaHi = static_cast<u8*>(OSGetArenaHi());
+  arenaHi = reinterpret_cast<u8*>(TRUNC64(arenaHi, align));
+  arenaHi -= size;
+  arenaHi = static_cast<u8*>(ptr = reinterpret_cast<void*>(TRUNC64(arenaHi, align)));
+  OSSetArenaHi(arenaHi);
+  return ptr;
+}
+
+void AuroraInitArena() {
+  if (MEM1Start == nullptr) {
+    return;
+  }
+
+  OSSetArenaLo(static_cast<u8*>(MEM1Start) + ARENA_START_OFFSET);
+  OSSetArenaHi(MEM1End);
+}
diff --git a/aurora-main/lib/dolphin/os/OSBootInfo.cpp b/aurora-main/lib/dolphin/os/OSBootInfo.cpp
new file mode 100644
index 0000000..e13af46
--- /dev/null
+++ b/aurora-main/lib/dolphin/os/OSBootInfo.cpp
@@ -0,0 +1,12 @@
+#include "internal.hpp"
+#include <dolphin/os.h>
+
+void AuroraFillBootInfo() {
+  if (OSBaseAddress == 0) {
+    return;
+  }
+
+  const auto info = static_cast<OSBootInfo*>(OSPhysicalToCached(0));
+
+  info->memorySize = aurora::g_config.mem1Size;
+}
diff --git a/aurora-main/lib/dolphin/os/OSInit.cpp b/aurora-main/lib/dolphin/os/OSInit.cpp
new file mode 100644
index 0000000..361dd32
--- /dev/null
+++ b/aurora-main/lib/dolphin/os/OSInit.cpp
@@ -0,0 +1,18 @@
+#include "internal.hpp"
+
+#include <dolphin/os.h>
+
+static bool AlreadyInitialized;
+
+void OSInit() {
+  if (AlreadyInitialized) {
+    return;
+  }
+
+  AlreadyInitialized = true;
+
+  AuroraOSInitMemory();
+  AuroraFillBootInfo();
+  AuroraInitClock();
+  AuroraInitArena();
+}
diff --git a/aurora-main/lib/dolphin/os/OSMemory.cpp b/aurora-main/lib/dolphin/os/OSMemory.cpp
new file mode 100644
index 0000000..dc5c429
--- /dev/null
+++ b/aurora-main/lib/dolphin/os/OSMemory.cpp
@@ -0,0 +1,148 @@
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#define NOMINMAX
+#include <Windows.h>
+#endif
+
+#include "fmt/base.h"
+
+#include <cassert>
+
+#include "internal.hpp"
+#include <dolphin/os.h>
+#include "dolphin/types.h"
+
+#if !NDEBUG && (INTPTR_MAX > INT32_MAX)
+#define GUARD_MEMORY 1
+#endif
+
+uintptr_t OSBaseAddress = 0;
+
+void* MEM1Start;
+void* MEM1End;
+
+static void GuardGCMemory();
+static void* AllocMEM1(u32 size);
+
+void AuroraOSInitMemory() {
+  GuardGCMemory();
+
+  if (aurora::g_config.mem1Size > 0) {
+    MEM1Start = AllocMEM1(aurora::g_config.mem1Size);
+    MEM1End = reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(MEM1Start) + aurora::g_config.mem1Size);
+    OSBaseAddress = reinterpret_cast<uintptr_t>(MEM1Start);
+  }
+}
+
+#if GUARD_MEMORY
+static uintptr_t GetAllocationGranularity() {
+#if _WIN32
+  SYSTEM_INFO sysInfo;
+  GetSystemInfo(&sysInfo);
+
+  return sysInfo.dwAllocationGranularity;
+#else
+  // TODO: posix impl
+  return 0;
+#endif
+}
+
+static void TryGuardRegion(const uintptr_t start, const uintptr_t end, char const* const name) {
+#if _WIN32
+  assert(start != 0);
+  const auto addr = VirtualAlloc(
+      reinterpret_cast<LPVOID>(start),
+      end - start,
+      MEM_RESERVE,
+      PAGE_NOACCESS);
+
+  if (addr == nullptr) {
+    Log.debug("Unable to guard memory region: {}", name);
+  } else {
+    assert(addr == reinterpret_cast<LPVOID>(start));
+    Log.debug("Successfully guarded memory range: {:08X}-{:08X} ({})", start, end, name);
+  }
+#else
+  // TODO: posix impl
+#endif
+}
+
+static void GuardGCMemory() {
+  // Reserve the normal GC/Wii memory map so accesses are 100% guaranteed to fail.
+  // https://www.gc-forever.com/yagcd/chap5.html#sec5.11
+  // https://wiibrew.org/wiki/Memory_map
+
+  // We can't quite map at address 0 (for good reasons) but we *can* map at the next granularity over!
+  TryGuardRegion(0x00000000 + GetAllocationGranularity(), 0x017fffff, "MEM1 Physical");
+  TryGuardRegion(0x80000000, 0x817fffff, "MEM1 Logical (cached)");
+  TryGuardRegion(0xC0000000, 0xC17fffff, "MEM1 Logical (uncached)");
+  TryGuardRegion(0x10000000, 0x18000000, "MEM2 Physical");
+  TryGuardRegion(0x90000000, 0x98000000, "MEM2 Logical (cached)");
+  TryGuardRegion(0xD0000000, 0xD8000000, "MEM2 Logical (uncached)");
+  TryGuardRegion(0x08000000, 0x08300000, "EFB Physical");
+  TryGuardRegion(0xC8000000, 0xC8300000, "EFB Logical");
+  TryGuardRegion(0x0D000000, 0x0D008000, "Hollywood HW registers Physical");
+  TryGuardRegion(0xCD000000, 0xCD008000, "Hollywood HW registers Logical");
+  TryGuardRegion(0x0C000000, 0x0C008020, "Broadway/GC HW registers Physical");
+  TryGuardRegion(0xCC000000, 0xCC008020, "Broadway/GC HW registers Logical");
+  TryGuardRegion(0xe0000000, 0xe0003fff, "GC L2 cache");
+  TryGuardRegion(0xfff00000, 0xffffffff, "GC IPL");
+}
+#else
+static void GuardGCMemory() { }
+#endif
+
+#if _WIN64 && !NDEBUG
+static void* AllocMEM1(u32 size) {
+  // Allocate an entire 32-bit's worth of memory and allocate the real MEM1 in that.
+  // This way, if a 64-bit pointer gets truncated to 32-bit, it will still fall in our guard pages.
+
+  void* bulkChunk = VirtualAlloc(
+    nullptr,
+    8ll * 1024 * 1024 * 1024,
+    MEM_RESERVE,
+    PAGE_NOACCESS);
+
+  if (bulkChunk == nullptr) {
+    DWORD err = GetLastError();
+    fmt::memory_buffer msg;
+    fmt::format_system_error(
+      msg,
+      static_cast<int>(err),
+      "Failed to allocate bulk chunk for MEM1");
+    Log.fatal("{}", fmt::to_string(msg));
+  }
+
+  uintptr_t memSpace = (reinterpret_cast<uintptr_t>(bulkChunk) | 0xFFFFFFFF) + 1;
+  void* mem1Address = reinterpret_cast<void*>(memSpace + 0x80000000);
+
+  Log.debug("Reserved memory map at {:016X}-{:016X}", memSpace, memSpace + 0xFFFFFFFF);
+  Log.debug(
+    "MEM1 at {:016X}-{:016X}",
+    reinterpret_cast<uintptr_t>(mem1Address),
+    reinterpret_cast<uintptr_t>(mem1Address) + size);
+
+  void* result = VirtualAlloc(mem1Address, size, MEM_COMMIT, PAGE_READWRITE);
+  if (result == nullptr) {
+    DWORD err = GetLastError();
+    fmt::memory_buffer msg;
+    fmt::format_system_error(
+      msg,
+      static_cast<int>(err),
+      "Failed to commit memory for MEM1");
+    Log.fatal("{}", fmt::to_string(msg));
+  }
+
+  assert(result == mem1Address);
+  return result;
+}
+#else
+static void* AllocMEM1(u32 size) {
+  return calloc(1, size);
+}
+#endif
+
+u32 OSGetPhysicalMemSize() {
+  const auto info = static_cast<OSBootInfo*>(OSPhysicalToCached(0));
+  return info->memorySize;
+}
diff --git a/aurora-main/lib/dolphin/os/OSTime.cpp b/aurora-main/lib/dolphin/os/OSTime.cpp
new file mode 100644
index 0000000..37689ef
--- /dev/null
+++ b/aurora-main/lib/dolphin/os/OSTime.cpp
@@ -0,0 +1,178 @@
+#include <chrono>
+#include <ctime>
+
+#include "internal.hpp"
+#include <dolphin/os.h>
+
+static const int YearDays[MONTH_MAX] = {0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334};
+
+static const int LeapYearDays[MONTH_MAX] = {0, 31, 60, 91, 121, 152, 182, 213, 244, 274, 305, 335};
+
+namespace chrono = std::chrono;
+using SystemTime = chrono::time_point<chrono::system_clock>;
+using TickDuration = chrono::duration<s64, std::ratio<1, OS_TIMER_CLOCK>>;
+
+static const SystemTime startupTime = chrono::system_clock::now();
+static const chrono::time_point<chrono::steady_clock> startupSteadyTime = chrono::steady_clock::now();
+
+OSTick OSGetTick() {
+    return OSGetTime() & 0xFFFFFFFF;
+}
+
+OSTime OSGetTime() {
+    // System time is provided in the number of timer ticks since 2000-01-01 00:00:00
+    // Use time_t arithmetic to avoid chrono duration_cast overflow issues on some platforms.
+
+    // GCN epoch: 2000-01-01 00:00:00 UTC = 946684800 seconds after Unix epoch
+    static constexpr s64 gcnEpochUnix = 946684800LL;
+
+    // Get current wall-clock time
+    auto elapsed = chrono::steady_clock::now() - startupSteadyTime;
+    auto currentTime = startupTime + chrono::duration_cast<chrono::system_clock::duration>(elapsed);
+
+    // Convert to seconds since Unix epoch, then offset to GCN epoch
+    auto sinceUnix = chrono::duration_cast<chrono::microseconds>(currentTime.time_since_epoch());
+    s64 totalMicros = sinceUnix.count();
+
+    // Apply local timezone offset
+    std::time_t wallClock = chrono::system_clock::to_time_t(currentTime);
+    std::tm localTm{};
+    std::tm gmTm{};
+#if defined(_WIN32)
+    localtime_s(&localTm, &wallClock);
+    gmtime_s(&gmTm, &wallClock);
+#else
+    localtime_r(&wallClock, &localTm);
+    gmtime_r(&wallClock, &gmTm);
+#endif
+    // Compute UTC offset in seconds
+    s64 utcOffsetSec = static_cast<s64>(mktime(&localTm)) - static_cast<s64>(mktime(&gmTm));
+
+    s64 secondsSinceGcnEpoch = (totalMicros / 1000000LL) - gcnEpochUnix + utcOffsetSec;
+    s64 remainderMicros = totalMicros % 1000000LL;
+
+    s64 ticksFromSeconds = secondsSinceGcnEpoch * static_cast<s64>(OS_TIMER_CLOCK);
+    s64 ticksFromRemainder = remainderMicros * static_cast<s64>(OS_TIMER_CLOCK) / 1000000LL;
+
+    return ticksFromSeconds + ticksFromRemainder;
+}
+
+void AuroraInitClock() {
+  if (OSBaseAddress == 0) {
+    return;
+  }
+
+  __OSBusClock = OS_TIMER_CLOCK * OS_TIMER_CLOCK_DIVIDER;
+}
+
+
+static int IsLeapYear(int year) {
+    return (year % 4 == 0 && year % 100 != 0) || (year % 400 == 0);
+}
+
+static int GetYearDays(int year, int mon) {
+    const int* md = (IsLeapYear(year)) ? LeapYearDays : YearDays;
+
+    return md[mon];
+}
+
+static int GetLeapDays(int year) {
+    ASSERT(0 <= year);
+    
+    if (year < 1) {
+        return 0;
+    }
+    return (year + 3) / 4 - (year - 1) / 100 + (year - 1) / 400;
+}
+
+static void GetDates(int days, OSCalendarTime* td) {
+    int year;
+    int n;
+    int month;
+    const int* md;
+
+    ASSERT(0 <= days);
+
+    td->wday = (days + 6) % WEEK_DAY_MAX;
+
+    for (year = days / YEAR_DAY_MAX;
+         days < (n = year * YEAR_DAY_MAX + GetLeapDays(year)); year--) {
+        ;
+    }
+
+    days -= n;
+    td->year = year;
+    td->yday = days;
+
+    md = IsLeapYear(year) ? LeapYearDays : YearDays;
+    for (month = MONTH_MAX; days < md[--month];) {
+        ;
+    }
+    td->mon = month;
+    td->mday = days - md[month] + 1;
+}
+
+void OSTicksToCalendarTime(OSTime ticks, OSCalendarTime* td) {
+    int days;
+    int secs;
+    OSTime d;
+
+    d = ticks % OS_SEC_TO_TICKS(1);    
+    if (d < 0) {
+        d += OS_SEC_TO_TICKS(1);
+        ASSERT(0 <= d);
+    }
+
+    td->usec = OS_TICKS_TO_USEC(d) % USEC_MAX;
+    td->msec = OS_TICKS_TO_MSEC(d) % MSEC_MAX;
+
+    ASSERT(0 <= td->usec);
+    ASSERT(0 <= td->msec);
+
+    ticks -= d;
+
+    ASSERT(ticks % OSSecondsToTicks(1) == 0);
+    ASSERT(0 <= OSTicksToSeconds(ticks) / 86400 + BIAS && OSTicksToSeconds(ticks) / 86400 + BIAS <= INT_MAX);
+
+    days = (OS_TICKS_TO_SEC(ticks) / SECS_IN_DAY) + BIAS;    
+    secs = OS_TICKS_TO_SEC(ticks) % SECS_IN_DAY;
+    if (secs < 0) {
+        days -= 1;
+        secs += SECS_IN_DAY;
+        ASSERT(0 <= secs);
+    }
+
+    GetDates(days, td);
+    td->hour = secs / 60 / 60;
+    td->min = secs / 60 % 60;
+    td->sec = secs % 60;
+}
+
+OSTime OSCalendarTimeToTicks(OSCalendarTime* td) {
+    OSTime secs;
+    int ov_mon;
+    int mon;
+    int year;
+
+    ov_mon = td->mon / MONTH_MAX;
+    mon = td->mon - (ov_mon * MONTH_MAX);
+
+    if (mon < 0) {
+        mon += MONTH_MAX;
+        ov_mon--;
+    }
+
+    ASSERT((ov_mon <= 0 && 0 <= td->year + ov_mon) || (0 < ov_mon && td->year <= INT_MAX - ov_mon));
+    
+    year = td->year + ov_mon;
+
+    secs = (OSTime)SECS_IN_YEAR * year +
+           (OSTime)SECS_IN_DAY * (GetLeapDays(year) + GetYearDays(year, mon) + td->mday - 1) +
+           (OSTime)SECS_IN_HOUR * td->hour +
+           (OSTime)SECS_IN_MIN * td->min +
+           td->sec -
+           (OSTime)0xEB1E1BF80ULL;
+
+    return OS_SEC_TO_TICKS(secs) + OS_MSEC_TO_TICKS((OSTime)td->msec) +
+           OS_USEC_TO_TICKS((OSTime)td->usec);
+}
diff --git a/aurora-main/lib/dolphin/os/internal.hpp b/aurora-main/lib/dolphin/os/internal.hpp
new file mode 100644
index 0000000..b4311ea
--- /dev/null
+++ b/aurora-main/lib/dolphin/os/internal.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "../../internal.hpp"
+#include <dolphin/types.h>
+
+static aurora::Module Log("aurora::os");
+
+constexpr uintptr_t ARENA_START_OFFSET = 0x4000;
+
+extern void* MEM1Start;
+extern void* MEM1End;
+
+void AuroraOSInitMemory();
+void AuroraFillBootInfo();
+void AuroraInitClock();
+void AuroraInitArena();
diff --git a/aurora-main/lib/dolphin/pad/pad.cpp b/aurora-main/lib/dolphin/pad/pad.cpp
new file mode 100644
index 0000000..6ae8ecb
--- /dev/null
+++ b/aurora-main/lib/dolphin/pad/pad.cpp
@@ -0,0 +1,1729 @@
+#include "../../input.hpp"
+#include "../../internal.hpp"
+#include <dolphin/pad.h>
+#include <dolphin/si.h>
+#include <SDL3/SDL_mouse.h>
+
+#include <array>
+#include <sys/stat.h>
+#include <ranges>
+
+namespace {
+constexpr int32_t k_mappingsFileVersion = 3;
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsStandard{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsXBox360{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsXBoxOne{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsPS3{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsPS4{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsPS5{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsGamecube{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {SDL_GAMEPAD_BUTTON_MISC3, PAD_TRIGGER_L},
+    {SDL_GAMEPAD_BUTTON_MISC4, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsNSOGamecube{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_BACK, PAD_TRIGGER_Z},
+    {SDL_GAMEPAD_BUTTON_LEFT_SHOULDER, PAD_TRIGGER_L},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsProCon{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsJoyConRight{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsJoyConLeft{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADButtonMapping, PAD_BUTTON_COUNT> g_defaultButtonsJoyPair{{
+    {SDL_GAMEPAD_BUTTON_SOUTH, PAD_BUTTON_A},
+    {SDL_GAMEPAD_BUTTON_EAST, PAD_BUTTON_B},
+    {SDL_GAMEPAD_BUTTON_WEST, PAD_BUTTON_X},
+    {SDL_GAMEPAD_BUTTON_NORTH, PAD_BUTTON_Y},
+    {SDL_GAMEPAD_BUTTON_START, PAD_BUTTON_START},
+    {SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, PAD_TRIGGER_Z},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_L},
+    {PAD_NATIVE_BUTTON_INVALID, PAD_TRIGGER_R},
+    {SDL_GAMEPAD_BUTTON_DPAD_UP, PAD_BUTTON_UP},
+    {SDL_GAMEPAD_BUTTON_DPAD_DOWN, PAD_BUTTON_DOWN},
+    {SDL_GAMEPAD_BUTTON_DPAD_LEFT, PAD_BUTTON_LEFT},
+    {SDL_GAMEPAD_BUTTON_DPAD_RIGHT, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADKeyButtonBinding, PAD_BUTTON_COUNT> g_defaultKeys{{
+    {PAD_KEY_INVALID, PAD_BUTTON_A},
+    {PAD_KEY_INVALID, PAD_BUTTON_B},
+    {PAD_KEY_INVALID, PAD_BUTTON_X},
+    {PAD_KEY_INVALID, PAD_BUTTON_Y},
+    {PAD_KEY_INVALID, PAD_BUTTON_START},
+    {PAD_KEY_INVALID, PAD_TRIGGER_Z},
+    {PAD_KEY_INVALID, PAD_TRIGGER_L},
+    {PAD_KEY_INVALID, PAD_TRIGGER_R},
+    {PAD_KEY_INVALID, PAD_BUTTON_UP},
+    {PAD_KEY_INVALID, PAD_BUTTON_DOWN},
+    {PAD_KEY_INVALID, PAD_BUTTON_LEFT},
+    {PAD_KEY_INVALID, PAD_BUTTON_RIGHT},
+}};
+
+std::array<PADKeyAxisBinding, PAD_AXIS_COUNT> g_defaultKeyAxis{{
+    {PAD_KEY_INVALID, PAD_AXIS_LEFT_X_POS, 0},
+    {PAD_KEY_INVALID, PAD_AXIS_LEFT_X_NEG, 0},
+    {PAD_KEY_INVALID, PAD_AXIS_LEFT_Y_POS, 0},
+    {PAD_KEY_INVALID, PAD_AXIS_LEFT_Y_NEG, 0},
+    {PAD_KEY_INVALID, PAD_AXIS_RIGHT_X_POS, 0},
+    {PAD_KEY_INVALID, PAD_AXIS_RIGHT_X_NEG, 0},
+    {PAD_KEY_INVALID, PAD_AXIS_RIGHT_Y_POS, 0},
+    {PAD_KEY_INVALID, PAD_AXIS_RIGHT_Y_NEG, 0},
+    {PAD_KEY_INVALID, PAD_AXIS_TRIGGER_L, 0},
+    {PAD_KEY_INVALID, PAD_AXIS_TRIGGER_R, 0},
+}};
+
+std::array<PADAxisMapping, PAD_AXIS_COUNT> g_defaultAxes{{
+    {{SDL_GAMEPAD_AXIS_LEFTX, AXIS_SIGN_POSITIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_LEFT_X_POS},
+    {{SDL_GAMEPAD_AXIS_LEFTX, AXIS_SIGN_NEGATIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_LEFT_X_NEG},
+    // SDL's gamepad y-axis is inverted from GC's
+    {{SDL_GAMEPAD_AXIS_LEFTY, AXIS_SIGN_NEGATIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_LEFT_Y_POS},
+    {{SDL_GAMEPAD_AXIS_LEFTY, AXIS_SIGN_POSITIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_LEFT_Y_NEG},
+    {{SDL_GAMEPAD_AXIS_RIGHTX, AXIS_SIGN_POSITIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_RIGHT_X_POS},
+    {{SDL_GAMEPAD_AXIS_RIGHTX, AXIS_SIGN_NEGATIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_RIGHT_X_NEG},
+    // see above
+    {{SDL_GAMEPAD_AXIS_RIGHTY, AXIS_SIGN_NEGATIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_RIGHT_Y_POS},
+    {{SDL_GAMEPAD_AXIS_RIGHTY, AXIS_SIGN_POSITIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_RIGHT_Y_NEG},
+    {{SDL_GAMEPAD_AXIS_LEFT_TRIGGER, AXIS_SIGN_POSITIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_TRIGGER_L},
+    {{SDL_GAMEPAD_AXIS_RIGHT_TRIGGER, AXIS_SIGN_POSITIVE}, SDL_GAMEPAD_BUTTON_INVALID, PAD_AXIS_TRIGGER_R},
+}};
+
+template <typename T, size_t N>
+constexpr const std::array<T, N>& toStdArray(const T (&array)[N]) {
+  static_assert(sizeof(array) == sizeof(std::array<T, N>));
+  return reinterpret_cast<const std::array<T, N>&>(array);
+}
+
+struct PADKeyboardState {
+  std::array<PADKeyButtonBinding, PAD_BUTTON_COUNT> m_buttonMapping{};
+  std::array<PADKeyAxisBinding, PAD_AXIS_COUNT> m_axisMapping{};
+  bool m_mappingsSet = false;
+};
+
+std::array<PADKeyboardState, PAD_MAX_CONTROLLERS> g_keyboardBindings;
+
+struct PADCLampRegion {
+  uint8_t minTrigger;
+  uint8_t maxTrigger;
+  int8_t minStick;
+  int8_t maxStick;
+  int8_t xyStick;
+  int8_t minSubstick;
+  int8_t maxSubstick;
+  int8_t xySubstick;
+  int8_t radStick;
+  int8_t radSubstick;
+};
+
+constexpr PADCLampRegion ClampRegion{
+    // Triggers
+    30,
+    180,
+
+    // Left stick
+    15,
+    72,
+    40,
+
+    // Right stick
+    15,
+    59,
+    31,
+
+    // Stick radii
+    56,
+    44,
+};
+
+bool g_initialized;
+bool g_keyboardBindingsLoaded = false;
+bool g_blockPAD = false;
+bool g_suppressHeldOnRead = false;
+std::array<PADButton, PAD_CHANMAX> g_suppressedButtons{};
+std::array<bool, PAD_CHANMAX> g_suppressLeftTrigger{};
+std::array<bool, PAD_CHANMAX> g_suppressRightTrigger{};
+
+bool is_mouse_scancode(const s32 scancode) { return scancode < PAD_KEY_INVALID; }
+bool is_mouse_button_pressed(const s32 scancode) {
+  const int32_t buttonNum = -(scancode + 1);
+  if (buttonNum < 1 || buttonNum > 5) {
+    return false;
+  }
+  float x, y;
+  const auto buttons = SDL_GetMouseState(&x, &y);
+  return (buttons & 1u << (buttonNum - 1)) != 0u;
+}
+} // namespace
+
+void PADSetSpec(u32 spec [[maybe_unused]]) {}
+
+static void load_keyboard_bindings();
+static void save_keyboard_bindings();
+
+// ReSharper disable once CppDFAConstantFunctionResult
+BOOL PADInit() {
+  if (g_initialized) {
+    return true;
+  }
+  g_initialized = true;
+
+  std::ranges::for_each(g_keyboardBindings, [](auto& state) {
+    state.m_buttonMapping = g_defaultKeys;
+    state.m_axisMapping = g_defaultKeyAxis;
+  });
+
+  return true;
+}
+
+BOOL PADRecalibrate(u32 mask [[maybe_unused]]) { return true; }
+
+BOOL PADReset(u32 mask [[maybe_unused]]) { return true; }
+
+void PADSetAnalogMode(u32 mode [[maybe_unused]]) {}
+
+aurora::input::GameController* __PADGetControllerForIndex(const u32 idx) /*  NOLINT(*-reserved-identifier) */
+{
+  if (idx >= aurora::input::g_GameControllers.size()) {
+    return nullptr;
+  }
+
+  uint32_t tmp = 0;
+  auto iter = aurora::input::g_GameControllers.begin();
+  while (tmp < idx) {
+    ++iter;
+    ++tmp;
+  }
+  if (iter == aurora::input::g_GameControllers.end()) {
+    return nullptr;
+  }
+
+  return &iter->second;
+}
+
+u32 PADCount() { return aurora::input::g_GameControllers.size(); }
+
+const char* PADGetNameForControllerIndex(const u32 idx) {
+  const auto* ctrl = __PADGetControllerForIndex(idx);
+  if (ctrl == nullptr) {
+    return nullptr;
+  }
+
+  return SDL_GetGamepadName(ctrl->m_controller);
+}
+
+void PADSetPortForIndex(const u32 idx, const u32 port) {
+  const auto* ctrl = __PADGetControllerForIndex(idx);
+  if (ctrl == nullptr) {
+    return;
+  }
+
+  const int32_t oldPort = SDL_GetGamepadPlayerIndex(ctrl->m_controller);
+  if (const auto* dest = aurora::input::get_controller_for_player(port); dest != nullptr && dest != ctrl) {
+    SDL_SetGamepadPlayerIndex(dest->m_controller, -1);
+  }
+  if (oldPort >= 0 && oldPort != port) {
+    aurora::input::persist_controller_for_player(oldPort, nullptr);
+  }
+  SDL_SetGamepadPlayerIndex(ctrl->m_controller, static_cast<Sint32>(port));
+  aurora::input::persist_controller_for_player(port, ctrl);
+}
+
+int32_t PADGetIndexForPort(const u32 port) {
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return -1;
+  }
+  int32_t index = 0;
+  for (auto iter = aurora::input::g_GameControllers.begin(); iter != aurora::input::g_GameControllers.end();
+       ++iter, ++index) {
+    if (&iter->second == ctrl) {
+      break;
+    }
+  }
+
+  return index;
+}
+
+void PADClearPort(const u32 port) {
+  aurora::input::persist_controller_for_player(port, nullptr);
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return;
+  }
+  SDL_SetGamepadPlayerIndex(ctrl->m_controller, -1);
+}
+
+// Secondary bindings live only in memory; the runtime re-applies them from its
+// config after every (re)load, so any mapping reset also clears them.
+static void reset_alt_button_mapping(aurora::input::GameController* controller) {
+  for (size_t i = 0; i < PAD_BUTTON_COUNT; ++i) {
+    controller->m_altButtonMapping[i] = {PAD_NATIVE_BUTTON_INVALID, controller->m_buttonMapping[i].padButton};
+  }
+}
+
+void __PADSetDefaultMapping(aurora::input::GameController* controller) /*  NOLINT(*-reserved-identifier) */
+{
+  switch (SDL_GetGamepadType(controller->m_controller)) {
+  case SDL_GAMEPAD_TYPE_XBOX360:
+    controller->m_buttonMapping = g_defaultButtonsXBox360;
+    break;
+  case SDL_GAMEPAD_TYPE_XBOXONE:
+    controller->m_buttonMapping = g_defaultButtonsXBoxOne;
+    break;
+  case SDL_GAMEPAD_TYPE_STANDARD:
+    controller->m_buttonMapping = g_defaultButtonsStandard;
+    break;
+  case SDL_GAMEPAD_TYPE_PS3:
+    controller->m_buttonMapping = g_defaultButtonsPS3;
+    break;
+  case SDL_GAMEPAD_TYPE_PS4:
+    controller->m_buttonMapping = g_defaultButtonsPS4;
+    break;
+  case SDL_GAMEPAD_TYPE_PS5:
+    controller->m_buttonMapping = g_defaultButtonsPS5;
+    break;
+  case SDL_GAMEPAD_TYPE_NINTENDO_SWITCH_PRO:
+    if (controller->m_pid == 0x2073) {
+      controller->m_buttonMapping = g_defaultButtonsNSOGamecube;
+    } else {
+      controller->m_buttonMapping = g_defaultButtonsProCon;
+    }
+    break;
+  case SDL_GAMEPAD_TYPE_NINTENDO_SWITCH_JOYCON_RIGHT:
+    controller->m_buttonMapping = g_defaultButtonsJoyConRight;
+    break;
+  case SDL_GAMEPAD_TYPE_NINTENDO_SWITCH_JOYCON_LEFT:
+    controller->m_buttonMapping = g_defaultButtonsJoyConLeft;
+    break;
+  case SDL_GAMEPAD_TYPE_GAMECUBE:
+    controller->m_buttonMapping = g_defaultButtonsGamecube;
+    break;
+  default:
+    controller->m_buttonMapping = g_defaultButtonsStandard;
+    break;
+  }
+  reset_alt_button_mapping(controller);
+}
+
+static bool is_valid_native_axis(const PADSignedNativeAxis axis) {
+  return axis.nativeAxis == -1 ||
+         (axis.nativeAxis >= 0 && axis.nativeAxis < SDL_GAMEPAD_AXIS_COUNT &&
+          (axis.sign == AXIS_SIGN_POSITIVE || axis.sign == AXIS_SIGN_NEGATIVE));
+}
+
+static PADDeadZones default_dead_zones(const aurora::input::GameController& controller) {
+  return {
+      .emulateTriggers = !(controller.m_isGameCube ||
+                           (SDL_GetGamepadType(controller.m_controller) == SDL_GAMEPAD_TYPE_NINTENDO_SWITCH_PRO &&
+                            controller.m_pid == 0x2073)),
+      .useDeadzones = true,
+      .stickDeadZone = 8000,
+      .substickDeadZone = 8000,
+      .leftTriggerActivationZone = 31150,
+      .rightTriggerActivationZone = 31150,
+  };
+}
+
+static void sanitize_dead_zones(aurora::input::GameController* controller, const int32_t playerIndex) {
+  PADDeadZones& deadZones = controller->m_deadZones;
+  const bool invalid =
+      deadZones.stickDeadZone > SDL_JOYSTICK_AXIS_MAX || deadZones.substickDeadZone > SDL_JOYSTICK_AXIS_MAX ||
+      deadZones.leftTriggerActivationZone > SDL_JOYSTICK_AXIS_MAX ||
+      deadZones.rightTriggerActivationZone > SDL_JOYSTICK_AXIS_MAX;
+  if (!invalid) {
+    return;
+  }
+
+  aurora::input::Log.warn("__PADLoadMapping port={}: invalid deadzone data in file, resetting to defaults",
+                          playerIndex);
+  deadZones = default_dead_zones(*controller);
+}
+
+void __PADLoadMapping(aurora::input::GameController* controller) /*  NOLINT(*-reserved-identifier) */ {
+  int32_t playerIndex = SDL_GetGamepadPlayerIndex(controller->m_controller);
+  if (playerIndex == -1) {
+    return;
+  }
+
+  std::string basePath{aurora::g_config.userPath};
+  if (!controller->m_mappingLoaded) {
+    __PADSetDefaultMapping(controller);
+    controller->m_axisMapping = g_defaultAxes;
+  }
+
+  controller->m_mappingLoaded = true;
+
+  const auto path = fmt::format("{}/{}_{:04X}_{:04X}.controller", basePath, PADGetName(playerIndex), controller->m_vid,
+                                controller->m_pid);
+  SDL_IOStream* file = SDL_IOFromFile(path.c_str(), "rb");
+  if (file == nullptr) {
+    return;
+  }
+
+  uint32_t magic = 0;
+  SDL_ReadU32LE(file, &magic);
+  if (magic != SBIG('CTRL')) {
+    aurora::input::Log.warn("Invalid controller mapping magic!");
+    SDL_CloseIO(file);
+    return;
+  }
+
+  uint32_t version = 0;
+  SDL_ReadU32LE(file, &version);
+  if (version != k_mappingsFileVersion) {
+    aurora::input::Log.warn("Invalid controller mapping version! (Expected {0}, found {1})", k_mappingsFileVersion,
+                            version);
+    SDL_CloseIO(file);
+    return;
+  }
+
+  bool isGameCube = false;
+  SDL_ReadIO(file, &isGameCube, sizeof(bool));
+  SDL_SeekIO(file, SDL_TellIO(file) + 31 & ~31, SDL_IO_SEEK_SET);
+  const auto dataStart = SDL_TellIO(file);
+  if (dataStart == -1) {
+    aurora::input::Log.warn("Unable to seek in controller bindings! Path: \"{}\"", path);
+    SDL_CloseIO(file);
+    return;
+  }
+  if (isGameCube) {
+    constexpr uint32_t dzSecLen = sizeof(PADDeadZones);
+    constexpr uint32_t btnSecLen = sizeof(PADButtonMapping) * PAD_BUTTON_COUNT;
+    constexpr uint32_t axisSecLen = sizeof(PADAxisMapping) * PAD_AXIS_COUNT;
+    SDL_SeekIO(file, dataStart + (dzSecLen + btnSecLen + axisSecLen) * playerIndex, SDL_IO_SEEK_SET);
+  }
+
+  SDL_ReadIO(file, &controller->m_deadZones, sizeof(PADDeadZones));
+  SDL_ReadIO(file, &controller->m_buttonMapping, sizeof(PADButtonMapping) * PAD_BUTTON_COUNT);
+  SDL_ReadIO(file, &controller->m_axisMapping, sizeof(PADAxisMapping) * PAD_AXIS_COUNT);
+  if (!isGameCube) {
+    SDL_ReadIO(file, &controller->m_rumbleIntensityLow, sizeof(u16));
+    SDL_ReadIO(file, &controller->m_rumbleIntensityHigh, sizeof(u16));
+  }
+  SDL_CloseIO(file);
+  sanitize_dead_zones(controller, playerIndex);
+
+  bool axisCorrupt = false;
+  for (uint32_t i = 0; i < PAD_AXIS_COUNT; ++i) {
+    if (controller->m_axisMapping[i].padAxis != static_cast<PADAxis>(i) ||
+        !is_valid_native_axis(controller->m_axisMapping[i].nativeAxis)) {
+      axisCorrupt = true;
+      break;
+    }
+  }
+  if (axisCorrupt) {
+    aurora::input::Log.warn("__PADLoadMapping port={}: corrupt axis data in file, resetting axes to defaults",
+                            playerIndex);
+    controller->m_axisMapping = g_defaultAxes;
+  }
+
+  bool buttonCorrupt = false;
+  for (uint32_t i = 0; i < PAD_BUTTON_COUNT; ++i) {
+    if (controller->m_buttonMapping[i].padButton == 0) {
+      buttonCorrupt = true;
+      break;
+    }
+  }
+  if (buttonCorrupt) {
+    aurora::input::Log.warn("__PADLoadMapping port={}: corrupt button data in file, resetting buttons to defaults",
+                            playerIndex);
+    __PADSetDefaultMapping(controller);
+  }
+  reset_alt_button_mapping(controller);
+}
+
+static void EnsureMappingLoaded(aurora::input::GameController* controller) {
+  if (!controller->m_mappingLoaded) {
+    __PADLoadMapping(controller);
+  }
+}
+
+static Sint16 _get_axis_value(const aurora::input::GameController* controller, //  NOLINT(*-reserved-identifier)
+                              PADAxis axis) {
+  const auto iter =
+      std::ranges::find_if(controller->m_axisMapping, [axis](const auto& pair) { return pair.padAxis == axis; });
+  if (iter == controller->m_axisMapping.end()) {
+    return 0;
+  }
+
+  if (iter->nativeAxis.nativeAxis != -1) {
+    const auto [nativeAxis, sign] = iter->nativeAxis;
+    const auto value = SDL_GetGamepadAxis(controller->m_controller, static_cast<SDL_GamepadAxis>(nativeAxis));
+    if (sign == AXIS_SIGN_POSITIVE) {
+      return value > 0 ? value : 0;
+    }
+    if (value >= 0) {
+      return 0;
+    }
+    // Clamp before negating so SDL's -32768 minimum fits in Sint16.
+    return static_cast<Sint16>(value == SDL_JOYSTICK_AXIS_MIN ? SDL_JOYSTICK_AXIS_MAX : -value);
+  }
+
+  assert(iter->nativeButton != -1);
+  if (SDL_GetGamepadButton(controller->m_controller, static_cast<SDL_GamepadButton>(iter->nativeButton))) {
+    return SDL_JOYSTICK_AXIS_MAX;
+  }
+  return 0;
+}
+
+static void neutralize_status(PADStatus& status) {
+  status.button = 0;
+  status.stickX = 0;
+  status.stickY = 0;
+  status.substickX = 0;
+  status.substickY = 0;
+  status.triggerLeft = 0;
+  status.triggerRight = 0;
+  status.analogA = 0;
+  status.analogB = 0;
+}
+
+static void apply_unblock_suppression(PADStatus& status, const u32 port, const bool captureHeldInput) {
+  if (captureHeldInput) {
+    g_suppressedButtons[port] |= status.button;
+    g_suppressLeftTrigger[port] = g_suppressLeftTrigger[port] || status.triggerLeft > ClampRegion.minTrigger;
+    g_suppressRightTrigger[port] = g_suppressRightTrigger[port] || status.triggerRight > ClampRegion.minTrigger;
+  }
+
+  g_suppressedButtons[port] &= status.button;
+  status.button &= ~g_suppressedButtons[port];
+
+  if (g_suppressLeftTrigger[port]) {
+    if (status.triggerLeft <= ClampRegion.minTrigger) {
+      g_suppressLeftTrigger[port] = false;
+    } else {
+      status.triggerLeft = 0;
+    }
+  }
+
+  if (g_suppressRightTrigger[port]) {
+    if (status.triggerRight <= ClampRegion.minTrigger) {
+      g_suppressRightTrigger[port] = false;
+    } else {
+      status.triggerRight = 0;
+    }
+  }
+}
+
+u32 PADRead(PADStatus* status) {
+  if (!g_keyboardBindingsLoaded) {
+    g_keyboardBindingsLoaded = true;
+    load_keyboard_bindings();
+  }
+
+  int numKeys = 0;
+  const bool* kbState = SDL_GetKeyboardState(&numKeys);
+  const bool captureHeldInput = g_suppressHeldOnRead && !g_blockPAD;
+  g_suppressHeldOnRead = false;
+
+  uint32_t rumbleSupport = 0;
+  for (uint32_t i = 0; i < PAD_CHANMAX; ++i) {
+    memset(&status[i], 0, sizeof(PADStatus));
+    auto controller = aurora::input::get_controller_for_player(i);
+    if (controller == nullptr && !g_keyboardBindings[i].m_mappingsSet) {
+      status[i].err = PAD_ERR_NO_CONTROLLER;
+      g_suppressedButtons[i] = 0;
+      g_suppressLeftTrigger[i] = false;
+      g_suppressRightTrigger[i] = false;
+      continue;
+    }
+
+    status[i].err = PAD_ERR_NONE;
+    if (g_keyboardBindings[i].m_mappingsSet) {
+      std::ranges::for_each(
+          g_keyboardBindings[i].m_buttonMapping, [&kbState, &i, &status](const PADKeyButtonBinding& mapping) {
+            if (mapping.scancode > PAD_KEY_INVALID && kbState[mapping.scancode]) {
+              status[i].button |= mapping.padButton;
+            } else if (is_mouse_scancode(mapping.scancode) && is_mouse_button_pressed(mapping.scancode)) {
+              status[i].button |= mapping.padButton;
+            }
+          });
+
+      int lx = 0, ly = 0, rx = 0, ry = 0, tl = 0, tr = 0;
+      for (const auto& binding : g_keyboardBindings[i].m_axisMapping) {
+        bool pressed = false;
+        if (binding.scancode > PAD_KEY_INVALID) {
+          pressed = binding.scancode < numKeys && kbState[binding.scancode];
+        } else if (is_mouse_scancode(binding.scancode)) {
+          pressed = is_mouse_button_pressed(binding.scancode);
+        }
+        if (!pressed) {
+          continue;
+        }
+        switch (binding.padAxis) {
+        case PAD_AXIS_LEFT_X_POS:
+          lx += 127;
+          break;
+        case PAD_AXIS_LEFT_X_NEG:
+          lx -= 127;
+          break;
+        case PAD_AXIS_LEFT_Y_POS:
+          ly += 127;
+          break;
+        case PAD_AXIS_LEFT_Y_NEG:
+          ly -= 127;
+          break;
+        case PAD_AXIS_RIGHT_X_POS:
+          rx += 127;
+          break;
+        case PAD_AXIS_RIGHT_X_NEG:
+          rx -= 127;
+          break;
+        case PAD_AXIS_RIGHT_Y_POS:
+          ry += 127;
+          break;
+        case PAD_AXIS_RIGHT_Y_NEG:
+          ry -= 127;
+          break;
+        case PAD_AXIS_TRIGGER_L:
+          tl += 255;
+          break;
+        case PAD_AXIS_TRIGGER_R:
+          tr += 255;
+          break;
+        default:
+          break;
+        }
+      }
+      status[i].stickX = static_cast<s8>(std::clamp(static_cast<int>(status[i].stickX) + lx, -127, 127));
+      status[i].stickY = static_cast<s8>(std::clamp(static_cast<int>(status[i].stickY) + ly, -127, 127));
+      status[i].substickX = static_cast<s8>(std::clamp(static_cast<int>(status[i].substickX) + rx, -127, 127));
+      status[i].substickY = static_cast<s8>(std::clamp(static_cast<int>(status[i].substickY) + ry, -127, 127));
+      status[i].triggerLeft = static_cast<u8>(std::min(static_cast<int>(status[i].triggerLeft) + tl, 255));
+      status[i].triggerRight = static_cast<u8>(std::min(static_cast<int>(status[i].triggerRight) + tr, 255));
+    }
+
+    if (controller) {
+      EnsureMappingLoaded(controller);
+      bool leftTriggerSet = false;
+      bool rightTriggerSet = false;
+      std::ranges::for_each(controller->m_buttonMapping, [&controller, &i, &status, &leftTriggerSet,
+                                                          &rightTriggerSet](const auto& mapping) {
+        if (SDL_GetGamepadButton(controller->m_controller, static_cast<SDL_GamepadButton>(mapping.nativeButton))) {
+          status[i].button |= mapping.padButton;
+        }
+
+        if (mapping.padButton == PAD_TRIGGER_L && mapping.nativeButton != PAD_NATIVE_BUTTON_INVALID) {
+          leftTriggerSet = true;
+        }
+        if (mapping.padButton == PAD_TRIGGER_R && mapping.nativeButton != PAD_NATIVE_BUTTON_INVALID) {
+          rightTriggerSet = true;
+        }
+      });
+
+      std::ranges::for_each(controller->m_altButtonMapping, [&controller, &i, &status, &leftTriggerSet,
+                                                             &rightTriggerSet](const auto& mapping) {
+        if (mapping.nativeButton == PAD_NATIVE_BUTTON_INVALID) {
+          return;
+        }
+        if (SDL_GetGamepadButton(controller->m_controller, static_cast<SDL_GamepadButton>(mapping.nativeButton))) {
+          status[i].button |= mapping.padButton;
+        }
+
+        if (mapping.padButton == PAD_TRIGGER_L) {
+          leftTriggerSet = true;
+        }
+        if (mapping.padButton == PAD_TRIGGER_R) {
+          rightTriggerSet = true;
+        }
+      });
+
+      // TODO: Add serializable mappings for these (probably not necessary)?
+      static constexpr std::array<std::pair<SDL_GamepadButton, PADExtButton>, PAD_EXT_BUTTON_COUNT> kExtButtonMappings{{
+          {SDL_GAMEPAD_BUTTON_BACK, PAD_BUTTON_BACK},
+          {SDL_GAMEPAD_BUTTON_GUIDE, PAD_BUTTON_GUIDE},
+          {SDL_GAMEPAD_BUTTON_MISC1, PAD_BUTTON_MISC1},
+          {SDL_GAMEPAD_BUTTON_MISC2, PAD_BUTTON_MISC2},
+          {SDL_GAMEPAD_BUTTON_MISC3, PAD_BUTTON_MISC3},
+          {SDL_GAMEPAD_BUTTON_MISC4, PAD_BUTTON_MISC4},
+          {SDL_GAMEPAD_BUTTON_MISC5, PAD_BUTTON_MISC5},
+          {SDL_GAMEPAD_BUTTON_MISC6, PAD_BUTTON_MISC6},
+          {SDL_GAMEPAD_BUTTON_RIGHT_PADDLE1, PAD_BUTTON_RIGHT_PADDLE1},
+          {SDL_GAMEPAD_BUTTON_LEFT_PADDLE1, PAD_BUTTON_LEFT_PADDLE1},
+          {SDL_GAMEPAD_BUTTON_RIGHT_PADDLE2, PAD_BUTTON_RIGHT_PADDLE2},
+          {SDL_GAMEPAD_BUTTON_LEFT_PADDLE2, PAD_BUTTON_LEFT_PADDLE2},
+          {SDL_GAMEPAD_BUTTON_RIGHT_STICK, PAD_BUTTON_RIGHT_STICK},
+          {SDL_GAMEPAD_BUTTON_LEFT_STICK, PAD_BUTTON_LEFT_STICK},
+          {SDL_GAMEPAD_BUTTON_TOUCHPAD, PAD_BUTTON_TOUCHPAD},
+      }};
+
+      for (const auto& [native, button] : kExtButtonMappings) {
+        if (SDL_GetGamepadButton(controller->m_controller, native)) {
+          status[i].extButton |= button;
+        }
+      }
+
+      const auto xlPos = _get_axis_value(controller, PAD_AXIS_LEFT_X_POS);
+      const auto xlNeg = _get_axis_value(controller, PAD_AXIS_LEFT_X_NEG);
+      const auto ylPos = _get_axis_value(controller, PAD_AXIS_LEFT_Y_POS);
+      const auto ylNeg = _get_axis_value(controller, PAD_AXIS_LEFT_Y_NEG);
+
+      auto xl = static_cast<Sint16>(xlPos - xlNeg);
+      auto yl = static_cast<Sint16>(ylPos - ylNeg);
+      if (controller->m_deadZones.useDeadzones) {
+        if (std::abs(xl) > controller->m_deadZones.stickDeadZone) {
+          xl /= 256;
+        } else {
+          xl = 0;
+        }
+        if (std::abs(yl) > controller->m_deadZones.stickDeadZone) {
+          yl /= 256;
+        } else {
+          yl = 0;
+        }
+      } else {
+        xl /= 256;
+        yl /= 256;
+      }
+
+      status[i].stickX = static_cast<int8_t>(xl);
+      status[i].stickY = static_cast<int8_t>(yl);
+
+      const auto xrPos = _get_axis_value(controller, PAD_AXIS_RIGHT_X_POS);
+      const auto xrNeg = _get_axis_value(controller, PAD_AXIS_RIGHT_X_NEG);
+      const auto yrPos = _get_axis_value(controller, PAD_AXIS_RIGHT_Y_POS);
+      const auto yrNeg = _get_axis_value(controller, PAD_AXIS_RIGHT_Y_NEG);
+
+      auto xr = static_cast<Sint16>(xrPos - xrNeg);
+      auto yr = static_cast<Sint16>(yrPos - yrNeg);
+      if (controller->m_deadZones.useDeadzones) {
+        if (std::abs(xr) > controller->m_deadZones.substickDeadZone) {
+          xr /= 256;
+        } else {
+          xr = 0;
+        }
+
+        if (std::abs(yr) > controller->m_deadZones.substickDeadZone) {
+          yr /= 256;
+        } else {
+          yr = 0;
+        }
+      } else {
+        xr /= 256;
+        yr /= 256;
+      }
+
+      status[i].substickX = static_cast<int8_t>(xr);
+      status[i].substickY = static_cast<int8_t>(yr);
+
+      Sint16 tl = std::max(static_cast<Sint16>(0), _get_axis_value(controller, PAD_AXIS_TRIGGER_L));
+      Sint16 tr = std::max(static_cast<Sint16>(0), _get_axis_value(controller, PAD_AXIS_TRIGGER_R));
+
+      if (controller->m_deadZones.emulateTriggers) {
+        if (!leftTriggerSet && tl > controller->m_deadZones.leftTriggerActivationZone) {
+          status[i].button |= PAD_TRIGGER_L;
+        }
+        if (!rightTriggerSet && tr > controller->m_deadZones.rightTriggerActivationZone) {
+          status[i].button |= PAD_TRIGGER_R;
+        }
+      }
+      tl /= 128;
+      tr /= 128;
+
+      status[i].triggerLeft = static_cast<int8_t>(tl);
+      status[i].triggerRight = static_cast<int8_t>(tr);
+
+      if (controller->m_hasRumble) {
+        rumbleSupport |= PAD_CHAN0_BIT >> i;
+      }
+
+      // Update the LED colors when they exist and the controller is read (which should happen once per frame in most
+      // games)
+      if (controller->m_hasRgbLed && controller->m_isColorDirty) {
+        SDL_SetGamepadLED(controller->m_controller, controller->m_ledRed, controller->m_ledGreen,
+                          controller->m_ledBlue);
+        controller->m_isColorDirty = false;
+      }
+    }
+
+    if (g_blockPAD) {
+      neutralize_status(status[i]);
+    } else {
+      apply_unblock_suppression(status[i], i, captureHeldInput);
+    }
+  }
+  return rumbleSupport;
+}
+
+void PADControlMotor(const u32 chan, const u32 cmd) {
+  const auto controller = aurora::input::get_controller_for_player(chan);
+  const auto instance = aurora::input::get_instance_for_player(chan);
+  if (controller == nullptr) {
+    return;
+  }
+
+  if (controller->m_isGameCube) {
+    if (cmd == PAD_MOTOR_STOP) {
+      aurora::input::controller_rumble(instance, 0, 1, 0);
+    } else if (cmd == PAD_MOTOR_RUMBLE) {
+      aurora::input::controller_rumble(instance, 1, 1, 0);
+    } else if (cmd == PAD_MOTOR_STOP_HARD) {
+      aurora::input::controller_rumble(instance, 0, 0, 0);
+    }
+  } else {
+    if (cmd == PAD_MOTOR_STOP) {
+      aurora::input::controller_rumble(instance, 0, 0, 1);
+    } else if (cmd == PAD_MOTOR_RUMBLE) {
+      aurora::input::controller_rumble(instance, controller->m_rumbleIntensityLow, controller->m_rumbleIntensityHigh,
+                                       0);
+    } else if (cmd == PAD_MOTOR_STOP_HARD) {
+      aurora::input::controller_rumble(instance, 0, 0, 0);
+    }
+  }
+}
+
+void PADControlAllMotors(const u32* cmdArr) {
+  for (u32 i = 0; i < PAD_CHANMAX; ++i) {
+    PADControlMotor(i, cmdArr[i]);
+  }
+}
+
+void ClampTrigger(u8* trigger, const u8 min, const u8 max) {
+  if (*trigger <= min) {
+    *trigger = 0;
+  } else {
+    if (*trigger > max) {
+      *trigger = max;
+    }
+    *trigger -= min;
+  }
+}
+
+void ClampCircle(s8* px, s8* py, const s8 radius, const s8 min) {
+  int x = *px; // NOLINT(*-str34-c)
+  int y = *py; // NOLINT(*-str34-c)
+
+  if (-min < x && x < min) {
+    x = 0;
+  } else if (0 < x) {
+    x -= min;
+  } else {
+    x += min;
+  }
+
+  if (-min < y && y < min) {
+    y = 0;
+  } else if (0 < y) {
+    y -= min;
+  } else {
+    y += min;
+  }
+
+  if (const int squared = x * x + y * y; radius * radius < squared) {
+    const auto length = static_cast<int32_t>(std::sqrt(squared));
+    x = x * radius / length;
+    y = y * radius / length;
+  }
+
+  *px = static_cast<int8_t>(x);
+  *py = static_cast<int8_t>(y);
+}
+
+void ClampStick(s8* px, s8* py, const s8 max, const s8 xy, const s8 min) {
+  int32_t x = *px; // NOLINT(*-str34-c)
+  int32_t y = *py; // NOLINT(*-str34-c)
+
+  int32_t signX = 0;
+  if (0 <= x) {
+    signX = 1;
+  } else {
+    signX = -1;
+    x = -x;
+  }
+
+  int8_t signY = 0;
+  if (0 <= y) {
+    signY = 1;
+  } else {
+    signY = -1;
+    y = -y;
+  }
+
+  if (x <= min) {
+    x = 0;
+  } else {
+    x -= min;
+  }
+  if (y <= min) {
+    y = 0;
+  } else {
+    y -= min;
+  }
+
+  if (x == 0 && y == 0) {
+    *px = *py = 0;
+    return;
+  }
+
+  x = x * max / (INT8_MAX - min);
+  y = y * max / (INT8_MAX - min);
+
+  if (xy * y <= xy * x) {
+    if (const int32_t d = xy * x + (max - xy) * y; xy * max < d) {
+      x = xy * max * x / d;
+      y = xy * max * y / d;
+    }
+  } else {
+    if (const int32_t d = xy * y + (max - xy) * x; xy * max < d) {
+      x = xy * max * x / d;
+      y = xy * max * y / d;
+    }
+  }
+
+  *px = static_cast<s8>(signX * x);
+  *py = static_cast<s8>(signY * y);
+}
+
+void PADClamp(PADStatus* status) {
+  for (uint32_t i = 0; i < PAD_CHANMAX; ++i) {
+    if (status[i].err != PAD_ERR_NONE) {
+      continue;
+    }
+
+    ClampStick(&status[i].stickX, &status[i].stickY, ClampRegion.maxStick, ClampRegion.xyStick, ClampRegion.minStick);
+    ClampStick(&status[i].substickX, &status[i].substickY, ClampRegion.maxSubstick, ClampRegion.xySubstick,
+               ClampRegion.minSubstick);
+    ClampTrigger(&status[i].triggerLeft, ClampRegion.minTrigger, ClampRegion.maxTrigger);
+    ClampTrigger(&status[i].triggerRight, ClampRegion.minTrigger, ClampRegion.maxTrigger);
+  }
+}
+
+void PADClampCircle(PADStatus* status) {
+  for (uint32_t i = 0; i < PAD_CHANMAX; ++i) {
+    if (status[i].err != PAD_ERR_NONE) {
+      continue;
+    }
+
+    ClampCircle(&status[i].stickX, &status[i].stickY, ClampRegion.radStick, ClampRegion.minStick);
+    ClampCircle(&status[i].substickX, &status[i].substickY, ClampRegion.radSubstick, ClampRegion.minSubstick);
+    ClampTrigger(&status[i].triggerLeft, ClampRegion.minTrigger, ClampRegion.maxTrigger);
+    ClampTrigger(&status[i].triggerRight, ClampRegion.minTrigger, ClampRegion.maxTrigger);
+  }
+}
+
+void PADGetVidPid(const u32 port, u32* vid, u32* pid) {
+  *vid = 0;
+  *pid = 0;
+  const auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    return;
+  }
+
+  *vid = controller->m_vid;
+  *pid = controller->m_pid;
+}
+
+const char* PADGetName(const u32 port) {
+  const auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    return nullptr;
+  }
+
+  return SDL_GetGamepadName(controller->m_controller);
+}
+
+void PADSetButtonMapping(const u32 port, const PADButtonMapping mapping) {
+  auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    return;
+  }
+
+  const auto iter = std::ranges::find_if(controller->m_buttonMapping,
+                                         [mapping](const auto& pair) { return mapping.padButton == pair.padButton; });
+  if (iter == controller->m_buttonMapping.end()) {
+    return;
+  }
+
+  *iter = mapping;
+}
+
+void PADSetAllButtonMappings(const u32 port, const PADButtonMapping buttons[PAD_BUTTON_COUNT]) {
+  for (uint32_t i = 0; i < PAD_BUTTON_COUNT; ++i) {
+    PADSetButtonMapping(port, buttons[i]);
+  }
+}
+
+PADButtonMapping* PADGetButtonMappings(const u32 port, u32* buttonCount) {
+  auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    *buttonCount = 0;
+    return nullptr;
+  }
+
+  EnsureMappingLoaded(controller);
+
+  *buttonCount = PAD_BUTTON_COUNT;
+  return controller->m_buttonMapping.data();
+}
+
+void PADSetAltButtonMapping(const u32 port, const PADButtonMapping mapping) {
+  auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    return;
+  }
+
+  const auto iter = std::ranges::find_if(controller->m_altButtonMapping,
+                                         [mapping](const auto& pair) { return mapping.padButton == pair.padButton; });
+  if (iter == controller->m_altButtonMapping.end()) {
+    return;
+  }
+
+  *iter = mapping;
+}
+
+PADButtonMapping* PADGetAltButtonMappings(const u32 port, u32* buttonCount) {
+  auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    *buttonCount = 0;
+    return nullptr;
+  }
+
+  EnsureMappingLoaded(controller);
+  *buttonCount = PAD_BUTTON_COUNT;
+  return controller->m_altButtonMapping.data();
+}
+
+void PADSetAxisMapping(const u32 port, const PADAxisMapping mapping) {
+  auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    return;
+  }
+
+  const auto iter = std::ranges::find_if(controller->m_axisMapping,
+                                         [mapping](const auto& pair) { return mapping.padAxis == pair.padAxis; });
+  if (iter == controller->m_axisMapping.end()) {
+    return;
+  }
+
+  *iter = mapping;
+}
+
+void PADSetAllAxisMappings(const u32 port, const PADAxisMapping axes[PAD_AXIS_COUNT]) {
+  for (uint32_t i = 0; i < PAD_AXIS_COUNT; ++i) {
+    PADSetAxisMapping(port, axes[i]);
+  }
+}
+
+PADAxisMapping* PADGetAxisMappings(const u32 port, u32* axisCount) {
+  auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    *axisCount = 0;
+    return nullptr;
+  }
+
+  EnsureMappingLoaded(controller);
+  *axisCount = PAD_AXIS_COUNT;
+  return controller->m_axisMapping.data();
+}
+
+BOOL PADSetKeyButtonBinding(const u32 port, const PADKeyButtonBinding binding) {
+  if (port >= PAD_MAX_CONTROLLERS) {
+    return FALSE;
+  }
+
+  for (auto& state = g_keyboardBindings[port]; auto& [scancode, padButton] : state.m_buttonMapping) {
+    if (padButton == binding.padButton) {
+      scancode = binding.scancode;
+      return TRUE;
+    }
+  }
+
+  return FALSE;
+}
+
+BOOL PADSetKeyButtonBindings(const u32 port, PADKeyButtonBinding bindings[PAD_BUTTON_COUNT]) {
+  for (uint32_t i = 0; i < PAD_BUTTON_COUNT; ++i) {
+    if (!PADSetKeyButtonBinding(port, bindings[i])) {
+      return FALSE;
+    }
+  }
+  return TRUE;
+}
+
+PADKeyButtonBinding* PADGetKeyButtonBindings(const u32 port, u32* buttonCount) {
+  if (port >= PAD_MAX_CONTROLLERS || !g_keyboardBindings[port].m_mappingsSet) {
+    return nullptr;
+  }
+  auto& state = g_keyboardBindings[port];
+  *buttonCount = PAD_BUTTON_COUNT;
+  return state.m_buttonMapping.data();
+}
+
+BOOL PADSetKeyAxisBinding(const u32 port, const PADKeyAxisBinding binding) {
+  if (port >= PAD_MAX_CONTROLLERS) {
+    return FALSE;
+  }
+
+  for (auto& state = g_keyboardBindings[port]; auto& b : state.m_axisMapping) {
+    if (b.padAxis == binding.padAxis) {
+      b.scancode = binding.scancode;
+      return TRUE;
+    }
+  }
+
+  return FALSE;
+}
+BOOL PADSetKeyAxisBindings(const u32 port, PADKeyAxisBinding bindings[PAD_BUTTON_COUNT]) {
+  for (uint32_t i = 0; i < PAD_AXIS_COUNT; ++i) {
+    if (!PADSetKeyAxisBinding(port, bindings[i])) {
+      return FALSE;
+    }
+  }
+  return TRUE;
+}
+
+PADKeyAxisBinding* PADGetKeyAxisBindings(const u32 port, u32* axisCount) {
+  if (port >= PAD_MAX_CONTROLLERS || !g_keyboardBindings[port].m_mappingsSet) {
+    return nullptr;
+  }
+  auto& state = g_keyboardBindings[port];
+  *axisCount = PAD_AXIS_COUNT;
+  return state.m_axisMapping.data();
+}
+
+void PADSetKeyboardActive(const u32 port, const BOOL active) {
+  if (port >= PAD_MAX_CONTROLLERS) {
+    return;
+  }
+  g_keyboardBindings[port].m_mappingsSet = active != FALSE;
+}
+
+void PADClearKeyBindings(const u32 port) {
+  if (port >= PAD_MAX_CONTROLLERS) {
+    return;
+  }
+  g_keyboardBindings[port].m_buttonMapping = g_defaultKeys;
+  g_keyboardBindings[port].m_axisMapping = g_defaultKeyAxis;
+  g_keyboardBindings[port].m_mappingsSet = false;
+}
+
+constexpr uint32_t k_keyboardMagic = SBIG('KBND');
+constexpr int32_t k_keyboardVersion = 3;
+
+static void load_keyboard_bindings() {
+  const auto filePath = std::filesystem::path{aurora::g_config.userPath} / "keyboard_bindings.dat";
+  SDL_IOStream* file = SDL_IOFromFile(filePath.string().c_str(), "rb");
+  if (file == nullptr) {
+    return;
+  }
+
+  uint32_t magic = 0;
+  SDL_ReadU32LE(file, &magic);
+  if (magic != k_keyboardMagic) {
+    aurora::input::Log.warn("keyboard_bindings.dat: invalid magic");
+    SDL_CloseIO(file);
+    return;
+  }
+
+  uint32_t version = 0;
+  SDL_ReadU32LE(file, &version);
+  if (version != k_keyboardVersion) {
+    aurora::input::Log.warn("keyboard_bindings.dat: version mismatch (expected {}, got {})", k_keyboardVersion,
+                            version);
+    SDL_CloseIO(file);
+    return;
+  }
+
+  const int64_t dataStart = SDL_TellIO(file) + 31 & ~31;
+  SDL_SeekIO(file, dataStart, SDL_IO_SEEK_SET);
+
+  for (uint32_t port = 0; port < g_keyboardBindings.size(); ++port) {
+    auto& [buttonMapping, axisMapping, mappingsSet] = g_keyboardBindings[port];
+    SDL_ReadIO(file, &mappingsSet, sizeof(bool));
+    SDL_ReadIO(file, buttonMapping.data(), sizeof(PADKeyButtonBinding) * PAD_BUTTON_COUNT);
+    SDL_ReadIO(file, axisMapping.data(), sizeof(PADKeyAxisBinding) * PAD_AXIS_COUNT);
+
+    bool kbButtonCorrupt = false;
+    for (uint32_t i = 0; i < PAD_BUTTON_COUNT; ++i) {
+      if (buttonMapping[i].padButton != g_defaultKeys[i].padButton) {
+        kbButtonCorrupt = true;
+        break;
+      }
+    }
+    if (kbButtonCorrupt) {
+      aurora::input::Log.warn("keyboard_bindings.dat port={}: corrupt button identifiers, resetting to defaults", port);
+      buttonMapping = g_defaultKeys;
+    }
+
+    bool kbAxisCorrupt = false;
+    for (uint32_t i = 0; i < PAD_AXIS_COUNT; ++i) {
+      if (axisMapping[i].padAxis != g_defaultKeyAxis[i].padAxis) {
+        kbAxisCorrupt = true;
+        break;
+      }
+    }
+    if (kbAxisCorrupt) {
+      aurora::input::Log.warn("keyboard_bindings.dat port={}: corrupt axis identifiers, resetting to defaults", port);
+      axisMapping = g_defaultKeyAxis;
+    }
+
+    if (mappingsSet) {
+      const bool anyBound =
+          std::ranges::any_of(buttonMapping,
+                              [](const PADKeyButtonBinding& b) { return b.scancode != PAD_KEY_INVALID; }) ||
+          std::ranges::any_of(axisMapping, [](const PADKeyAxisBinding& b) { return b.scancode != PAD_KEY_INVALID; });
+      if (!anyBound) {
+        mappingsSet = false;
+      }
+    }
+  }
+  SDL_CloseIO(file);
+}
+
+static void save_keyboard_bindings() {
+  const auto filePath = std::filesystem::path{aurora::g_config.userPath} / "keyboard_bindings.dat";
+  SDL_IOStream* file = SDL_IOFromFile(filePath.string().c_str(), "wb");
+  if (file == nullptr) {
+    aurora::input::Log.warn("save_keyboard_bindings: failed to open {} for writing", filePath.string());
+    return;
+  }
+
+  SDL_WriteU32LE(file, k_keyboardMagic);
+  SDL_WriteS32LE(file, k_keyboardVersion);
+
+  const int64_t dataStart = SDL_TellIO(file) + 31 & ~31;
+  SDL_SeekIO(file, dataStart, SDL_IO_SEEK_SET);
+
+  for (const auto& [buttonMapping, axisMapping, mappingsSet] : g_keyboardBindings) {
+    SDL_WriteU8(file, mappingsSet);
+    SDL_WriteIO(file, buttonMapping.data(), sizeof(PADKeyButtonBinding) * PAD_BUTTON_COUNT);
+    SDL_WriteIO(file, axisMapping.data(), sizeof(PADKeyAxisBinding) * PAD_AXIS_COUNT);
+  }
+  SDL_CloseIO(file);
+}
+
+void __PADWriteDeadZones(SDL_IOStream* file, // NOLINT(*-reserved-identifier)
+                         const aurora::input::GameController& controller) {
+  SDL_WriteIO(file, &controller.m_deadZones, sizeof(PADDeadZones));
+}
+
+void PADSerializeMappings() {
+  const std::filesystem::path basePath{aurora::g_config.userPath};
+
+  for (auto& controller : aurora::input::g_GameControllers | std::views::values) {
+    EnsureMappingLoaded(&controller);
+    const auto filePath =
+        basePath / fmt::format("{}_{:04X}_{:04X}.controller", aurora::input::controller_name(controller.m_index),
+                               controller.m_vid, controller.m_pid);
+    std::string filePathStr = filePath.string();
+
+    // don't truncate the file if it already exists
+    const char* openMode = std::filesystem::exists(filePath) ? "r+b" : "wb";
+    SDL_IOStream* file = SDL_IOFromFile(filePathStr.c_str(), openMode);
+    if (file == nullptr) {
+      return;
+    }
+    SDL_SeekIO(file, 0, SDL_IO_SEEK_SET);
+
+    // write header
+    constexpr uint32_t magic = SBIG('CTRL');
+    SDL_WriteU32LE(file, magic);
+    SDL_WriteU32LE(file, k_mappingsFileVersion);
+    SDL_WriteU8(file, controller.m_isGameCube);
+
+    // start writing data at next 32-byte aligned offset
+    const int64_t dataStart = SDL_TellIO(file) + 31 & ~31;
+    if (dataStart == -1) {
+      aurora::input::Log.warn("Unable to seek in controller bindings! Path: \"{}\"", filePath.string());
+      return;
+    }
+    SDL_SeekIO(file, dataStart, SDL_IO_SEEK_SET);
+    if (controller.m_isGameCube) {
+      // GameCube adapters expose 4 input devices with the same vid/pid, we store all 4 in the same file
+      const auto port = aurora::input::player_index(controller.m_index);
+      constexpr int64_t dzSecLen = sizeof(PADDeadZones);
+      constexpr int64_t btnSecLen = sizeof(PADButtonMapping) * PAD_BUTTON_COUNT;
+      constexpr int64_t axisSecLen = sizeof(PADAxisMapping) * PAD_AXIS_COUNT;
+      // skip to offset in file for this particular port
+      SDL_SeekIO(file, dataStart + (dzSecLen + btnSecLen + axisSecLen) * port, SDL_IO_SEEK_SET);
+    }
+    __PADWriteDeadZones(file, controller);
+    SDL_WriteIO(file, controller.m_buttonMapping.data(), sizeof(PADButtonMapping) * PAD_BUTTON_COUNT);
+    SDL_WriteIO(file, controller.m_axisMapping.data(), sizeof(PADAxisMapping) * PAD_AXIS_COUNT);
+
+    if (!controller.m_isGameCube) {
+      SDL_WriteIO(file, &controller.m_rumbleIntensityLow, sizeof(u16));
+      SDL_WriteIO(file, &controller.m_rumbleIntensityHigh, sizeof(u16));
+    }
+    SDL_CloseIO(file);
+  }
+
+  save_keyboard_bindings();
+}
+
+PADDeadZones* PADGetDeadZones(const u32 port) {
+  auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    return nullptr;
+  }
+  return &controller->m_deadZones;
+}
+
+static constexpr std::array<std::pair<PADButton, std::string_view>, PAD_BUTTON_COUNT> skButtonNames = {{
+    {PAD_BUTTON_LEFT, "Left"sv},
+    {PAD_BUTTON_RIGHT, "Right"sv},
+    {PAD_BUTTON_DOWN, "Down"sv},
+    {PAD_BUTTON_UP, "Up"sv},
+    {PAD_TRIGGER_Z, "Z"sv},
+    {PAD_TRIGGER_R, "R"sv},
+    {PAD_TRIGGER_L, "L"sv},
+    {PAD_BUTTON_A, "A"sv},
+    {PAD_BUTTON_B, "B"sv},
+    {PAD_BUTTON_X, "X"sv},
+    {PAD_BUTTON_Y, "Y"sv},
+    {PAD_BUTTON_START, "Start"sv},
+}};
+
+static constexpr std::array<std::pair<PADButton, std::string_view>, PAD_AXIS_COUNT> skAxisNames = {{
+    {PAD_AXIS_LEFT_X_POS, "Left X+"sv},
+    {PAD_AXIS_LEFT_X_NEG, "Left X-"sv},
+    {PAD_AXIS_LEFT_Y_POS, "Left Y+"sv},
+    {PAD_AXIS_LEFT_Y_NEG, "Left Y-"sv},
+    {PAD_AXIS_RIGHT_X_POS, "Right X+"sv},
+    {PAD_AXIS_RIGHT_X_NEG, "Right X-"sv},
+    {PAD_AXIS_RIGHT_Y_POS, "Right Y+"sv},
+    {PAD_AXIS_RIGHT_Y_NEG, "Right Y-"sv},
+    {PAD_AXIS_TRIGGER_L, "Trigger L"sv},
+    {PAD_AXIS_TRIGGER_R, "Trigger R"sv},
+}};
+
+static constexpr std::array<std::pair<PADButton, std::string_view>, PAD_AXIS_COUNT> skAxisDirLabels = {{
+    {PAD_AXIS_LEFT_X_POS, "Right"sv},
+    {PAD_AXIS_LEFT_X_NEG, "Left"sv},
+    {PAD_AXIS_LEFT_Y_POS, "Up"sv},
+    {PAD_AXIS_LEFT_Y_NEG, "Down"sv},
+    {PAD_AXIS_RIGHT_X_POS, "Right"sv},
+    {PAD_AXIS_RIGHT_X_NEG, "Left"sv},
+    {PAD_AXIS_RIGHT_Y_POS, "Up"sv},
+    {PAD_AXIS_RIGHT_Y_NEG, "Down"sv},
+    {PAD_AXIS_TRIGGER_L, "N/A"sv},
+    {PAD_AXIS_TRIGGER_R, "N/A"sv},
+}};
+
+const char* PADGetButtonName(const PADButton button) {
+
+  if (const auto iter =
+          std::ranges::find_if(skButtonNames, [&button](const auto& pair) { return button == pair.first; });
+      iter != skButtonNames.end()) {
+    return iter->second.data();
+  }
+
+  return nullptr;
+}
+
+const char* PADGetNativeButtonName(u32 button) {
+  return SDL_GetGamepadStringForButton(static_cast<SDL_GamepadButton>(button));
+}
+
+const char* PADGetAxisName(const PADAxis axis) {
+  if (const auto it = std::ranges::find_if(skAxisNames, [&axis](const auto& pair) { return axis == pair.first; });
+      it != skAxisNames.end()) {
+    return it->second.data();
+  }
+
+  return nullptr;
+}
+
+const char* PADGetAxisDirectionLabel(const PADAxis axis) {
+  if (const auto it = std::ranges::find_if(skAxisDirLabels, [&axis](const auto& pair) { return axis == pair.first; });
+      it != skAxisDirLabels.end()) {
+    return it->second.data();
+  }
+
+  return nullptr;
+}
+
+const char* PADGetNativeAxisName(PADSignedNativeAxis axis) {
+  return SDL_GetGamepadStringForAxis(static_cast<SDL_GamepadAxis>(axis.nativeAxis));
+}
+
+int32_t PADGetNativeButtonPressed(const u32 port) {
+  const auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    return -1;
+  }
+
+  for (int32_t i = 0; i < SDL_GAMEPAD_BUTTON_COUNT; ++i) {
+    if (SDL_GetGamepadButton(controller->m_controller, static_cast<SDL_GamepadButton>(i)) != 0u) {
+      return i;
+    }
+  }
+  return -1;
+}
+
+PADSignedNativeAxis PADGetNativeAxisPulled(const u32 port) {
+  const auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    return {-1, AXIS_SIGN_POSITIVE};
+  }
+
+  for (int32_t i = 0; i < SDL_GAMEPAD_AXIS_COUNT; ++i) {
+    const auto axisVal = SDL_GetGamepadAxis(controller->m_controller, static_cast<SDL_GamepadAxis>(i));
+    if (axisVal >= 16384) {
+      return {i, AXIS_SIGN_POSITIVE};
+    }
+
+    if (axisVal <= -16384) {
+      // SDL3 triggers rest at -32768, so skip their negative direction.
+      if (i == SDL_GAMEPAD_AXIS_LEFT_TRIGGER || i == SDL_GAMEPAD_AXIS_RIGHT_TRIGGER) {
+        continue;
+      }
+      return {i, AXIS_SIGN_NEGATIVE};
+    }
+  }
+  return {-1, AXIS_SIGN_POSITIVE};
+}
+
+void PADRestoreDefaultMapping(const u32 port) {
+  auto* controller = aurora::input::get_controller_for_player(port);
+  if (controller == nullptr) {
+    return;
+  }
+  __PADSetDefaultMapping(controller);
+  controller->m_axisMapping = g_defaultAxes;
+}
+
+void PADBlockInput(const bool block) {
+  if (g_blockPAD && !block) {
+    g_suppressHeldOnRead = true;
+  }
+  g_blockPAD = block;
+}
+
+SDL_Gamepad* PADGetSDLGamepadForIndex(const u32 index) {
+  const auto* ctrl = __PADGetControllerForIndex(index);
+  if (ctrl == nullptr) {
+    return nullptr;
+  }
+
+  return ctrl->m_controller;
+}
+
+void PADSetDefaultMapping(const PADDefaultMapping* mapping, const PADControllerType type) {
+  if (g_initialized) {
+    aurora::input::Log.fatal("PADSetDefaultMapping called after PADInit()!");
+  }
+
+  switch (type) {
+  case PAD_TYPE_STANDARD:
+    g_defaultButtonsStandard = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_XBOX360:
+    g_defaultButtonsXBox360 = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_XBOXONE:
+    g_defaultButtonsXBoxOne = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_PS3:
+    g_defaultButtonsPS3 = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_PS4:
+    g_defaultButtonsPS4 = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_PS5:
+    g_defaultButtonsPS5 = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_SWITCH_PROCON:
+    g_defaultButtonsProCon = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_JOYCON_LEFT:
+    g_defaultButtonsJoyConLeft = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_JOYCON_RIGHT:
+    g_defaultButtonsJoyConRight = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_JOYCON_PAIR:
+    g_defaultButtonsJoyPair = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_GAMECUBE:
+    g_defaultButtonsGamecube = toStdArray(mapping->buttons);
+    break;
+  case PAD_TYPE_NSO_GAMECUBE:
+    g_defaultButtonsNSOGamecube = toStdArray(mapping->buttons);
+    break;
+  default:
+    break;
+  }
+  g_defaultAxes = toStdArray(mapping->axes);
+}
+
+BOOL PADSetColor(const u32 port, const u8 red, const u8 green, const u8 blue) {
+  const auto ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return FALSE;
+  }
+
+  ctrl->m_ledRed = red;
+  ctrl->m_ledGreen = green;
+  ctrl->m_ledBlue = blue;
+  ctrl->m_isColorDirty = true;
+  return true;
+}
+
+BOOL PADGetColor(const u32 port, u8* red, u8* green, u8* blue) {
+  const auto ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return FALSE;
+  }
+
+  *red = ctrl->m_ledRed;
+  *green = ctrl->m_ledGreen;
+  *blue = ctrl->m_ledBlue;
+  return TRUE;
+}
+
+BOOL PADSetSensorEnabled(const u32 port, const PADSensorType sensor, const BOOL enabled) {
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+
+  if (ctrl == nullptr) {
+    return FALSE;
+  }
+
+  return SDL_SetGamepadSensorEnabled(ctrl->m_controller, static_cast<SDL_SensorType>(sensor), enabled ? true : false)
+             ? TRUE
+             : FALSE;
+}
+
+BOOL PADHasSensor(const u32 port, const PADSensorType sensor) {
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return FALSE;
+  }
+
+  return SDL_GamepadHasSensor(ctrl->m_controller, static_cast<SDL_SensorType>(sensor)) ? TRUE : FALSE;
+}
+
+BOOL PADGetSensorData(const u32 port, const PADSensorType sensor, f32* data, const int nValues) {
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return FALSE;
+  }
+
+  return SDL_GetGamepadSensorData(ctrl->m_controller, static_cast<SDL_SensorType>(sensor), data, nValues);
+}
+
+BOOL PADSetRumbleIntensity(const u32 port, const u16 low, const u16 high) {
+  auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr || ctrl->m_isGameCube || !ctrl->m_hasRumble) {
+    return FALSE;
+  }
+  ctrl->m_rumbleIntensityLow = low;
+  ctrl->m_rumbleIntensityHigh = high;
+
+  return TRUE;
+}
+
+BOOL PADGetRumbleIntensity(const u32 port, u16* low, u16* high) {
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr || ctrl->m_isGameCube || !ctrl->m_hasRumble) {
+    *low = 0;
+    *high = 0;
+    return FALSE;
+  }
+
+  *low = ctrl->m_rumbleIntensityLow;
+  *high = ctrl->m_rumbleIntensityHigh;
+  return TRUE;
+}
+
+BOOL PADSupportsRumbleIntensity(const u32 port) {
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return FALSE;
+  }
+
+  return !ctrl->m_isGameCube && ctrl->m_hasRumble;
+}
+
+BOOL PADIsGCAdapter(const u32 port) {
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return FALSE;
+  }
+  return ctrl->m_isGameCube;
+}
+
+PADBatteryState PADGetBatteryState(const u32 port, f32* perc) {
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return PAD_BATTERYSTATE_ERROR;
+  }
+
+  int tmp = 0;
+  const auto ret = SDL_GetGamepadPowerInfo(ctrl->m_controller, &tmp);
+  if (tmp != -1) {
+    *perc = static_cast<float>(tmp) / 100.f;
+  } else {
+    *perc = static_cast<float>(tmp);
+  }
+  return static_cast<PADBatteryState>(ret);
+}
+
+PADControllerType PADGetControllerType(const u32 port) {
+  const auto* ctrl = aurora::input::get_controller_for_player(port);
+  if (ctrl == nullptr) {
+    return PAD_TYPE_UNKNOWN;
+  }
+
+  auto type = SDL_GetGamepadType(ctrl->m_controller);
+  return static_cast<PADControllerType>(type);
+}
+
+PADControllerType PADGetControllerTypeForIndex(const u32 index) {
+  const auto* ctrl = __PADGetControllerForIndex(index);
+  if (ctrl == nullptr) {
+    return PAD_TYPE_UNKNOWN;
+  }
+
+  auto type = SDL_GetGamepadType(ctrl->m_controller);
+  if (type == SDL_GAMEPAD_TYPE_NINTENDO_SWITCH_PRO && ctrl->m_pid == 0x2073) {
+    return PAD_TYPE_NSO_GAMECUBE;
+  }
+  return static_cast<PADControllerType>(type);
+}
diff --git a/aurora-main/lib/dolphin/si/si.cpp b/aurora-main/lib/dolphin/si/si.cpp
new file mode 100644
index 0000000..6164105
--- /dev/null
+++ b/aurora-main/lib/dolphin/si/si.cpp
@@ -0,0 +1,20 @@
+#include <dolphin/si.h>
+#include "../../input.hpp"
+
+#include <SDL3/SDL_power.h>
+
+uint32_t SIProbe(int32_t chan) {
+  auto* const controller = aurora::input::get_controller_for_player(chan);
+  if (controller == nullptr) {
+    return SI_ERROR_NO_RESPONSE;
+  }
+
+  if (controller->m_isGameCube) {
+    auto level = SDL_GetJoystickPowerInfo(SDL_GetGamepadJoystick(controller->m_controller), nullptr);
+    if (level == SDL_POWERSTATE_UNKNOWN) {
+      return SI_GC_WAVEBIRD;
+    }
+  }
+
+  return SI_GC_CONTROLLER;
+}
diff --git a/aurora-main/lib/dolphin/vi/vi.cpp b/aurora-main/lib/dolphin/vi/vi.cpp
new file mode 100644
index 0000000..d036b86
--- /dev/null
+++ b/aurora-main/lib/dolphin/vi/vi.cpp
@@ -0,0 +1,96 @@
+#include <dolphin/vi.h>
+
+#include "../../window.hpp"
+#include "aurora/math.hpp"
+#include "vi_internal.hpp"
+
+#include <algorithm>
+#include <atomic>
+#include <optional>
+
+namespace aurora::vi {
+std::optional<GXRenderModeObj> g_renderMode;
+namespace {
+std::atomic<float> g_presentAspectCorrection{1.f};
+
+float calculate_present_aspect_correction(const GXRenderModeObj& rm) noexcept {
+  if (rm.viWidth == 0 || rm.viHeight == 0) {
+    return 1.f;
+  }
+
+  // Dolphin derives the displayed aspect from the VI active region instead of assuming an exact
+  // 4:3 or 16:9 signal. These are its BT.601 active sample and line counts.
+  const auto format = (static_cast<uint32_t>(rm.viTVmode) >> 2) & 0x7u;
+  const bool pal = format == VI_PAL || format == VI_DEBUG_PAL;
+  const float nominalActiveWidth =
+      pal ? 864.f * (52.f / 64.f) : 858.f * (52.655555f / 63.555555f);
+  const float nominalActiveHeight = pal ? 576.f : 486.f;
+  const float horizontalFill = static_cast<float>(rm.viWidth) / nominalActiveWidth;
+  const float verticalFill = static_cast<float>(rm.viHeight) / nominalActiveHeight;
+  return horizontalFill / verticalFill;
+}
+} // namespace
+
+Vec2<uint32_t> render_mode_size() noexcept {
+  if (!g_renderMode) {
+    return {640, 528};
+  }
+  // GX has a fixed 640x528 EFB workspace. Games can configure a narrower visible framebuffer, but
+  // effects such as MKW's DOF use the remaining EFB area as scratch.
+  return {std::max<uint32_t>(g_renderMode->fbWidth, 640), std::max<uint32_t>(g_renderMode->efbHeight, 528)};
+}
+
+void configure(const GXRenderModeObj* rm) noexcept {
+  const auto oldSize = render_mode_size();
+  if (rm == nullptr) {
+    g_renderMode.reset();
+  } else {
+    g_renderMode = *rm;
+    g_presentAspectCorrection.store(calculate_present_aspect_correction(*rm), std::memory_order_release);
+  }
+  if (rm == nullptr) {
+    g_presentAspectCorrection.store(1.f, std::memory_order_release);
+  }
+  if (render_mode_size() != oldSize) {
+    window::request_frame_buffer_resize();
+  }
+}
+
+Vec2<uint32_t> configured_fb_size() noexcept {
+  return render_mode_size();
+}
+
+Vec2<uint32_t> visible_fb_size() noexcept {
+  if (!g_renderMode) {
+    return {640, 528};
+  }
+  return {g_renderMode->fbWidth, g_renderMode->efbHeight};
+}
+
+float present_aspect_correction() noexcept {
+  return g_presentAspectCorrection.load(std::memory_order_acquire);
+}
+} // namespace aurora::vi
+
+extern "C" {
+void VIInit() {}
+void VIConfigure(const GXRenderModeObj* rm) { aurora::vi::configure(rm); }
+void VIConfigurePan(u16 xOrg, u16 yOrg, u16 width, u16 height) {
+  (void)xOrg;
+  (void)yOrg;
+  (void)width;
+  (void)height;
+}
+u32 VIGetTvFormat() { return 0; }
+void VIFlush() {}
+
+void VISetWindowTitle(const char* title) { aurora::window::set_title(title); }
+void VISetWindowFullscreen(bool fullscreen) { aurora::window::set_fullscreen(fullscreen); }
+bool VIGetWindowFullscreen() { return aurora::window::get_fullscreen(); }
+void VISetWindowSize(uint32_t width, uint32_t height) { aurora::window::set_window_size(width, height); }
+void VISetWindowPosition(uint32_t x, uint32_t y) { aurora::window::set_window_position(x, y); }
+void VICenterWindow() { aurora::window::center_window(); }
+void VISetFrameBufferScale(float scale) { aurora::window::set_frame_buffer_scale(scale); }
+void VILockAspectRatio(int width, int height) { aurora::window::lock_present_aspect_ratio(width, height); }
+void VIUnlockAspectRatio() { aurora::window::unlock_present_aspect_ratio(); }
+}
diff --git a/aurora-main/lib/dolphin/vi/vi_internal.hpp b/aurora-main/lib/dolphin/vi/vi_internal.hpp
new file mode 100644
index 0000000..d4fe1f6
--- /dev/null
+++ b/aurora-main/lib/dolphin/vi/vi_internal.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include <dolphin/gx/GXStruct.h>
+
+#include <cstdint>
+
+#include <aurora/math.hpp>
+
+namespace aurora::vi {
+void configure(const GXRenderModeObj* rm) noexcept;
+Vec2<uint32_t> configured_fb_size() noexcept;
+Vec2<uint32_t> visible_fb_size() noexcept;
+float present_aspect_correction() noexcept;
+} // namespace aurora::vi
diff --git a/aurora-main/lib/fs_helper.hpp b/aurora-main/lib/fs_helper.hpp
new file mode 100644
index 0000000..ffb3ffa
--- /dev/null
+++ b/aurora-main/lib/fs_helper.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include <filesystem>
+
+/**
+ * Converts a std::filesystem::path to a std::string, UTF-8, without exploding on Windows.
+ */
+inline std::string fs_path_to_string(const std::filesystem::path& path) {
+  const auto u8str = path.u8string();
+  return { reinterpret_cast<const char*>(u8str.c_str()) };
+}
diff --git a/aurora-main/lib/gfx/clear.cpp b/aurora-main/lib/gfx/clear.cpp
new file mode 100644
index 0000000..f5964f9
--- /dev/null
+++ b/aurora-main/lib/gfx/clear.cpp
@@ -0,0 +1,162 @@
+#include "clear.hpp"
+
+#include "../webgpu/gpu.hpp"
+#include "tracy/Tracy.hpp"
+
+#include <algorithm>
+#include <array>
+
+namespace {
+wgpu::ColorWriteMask clear_write_mask(bool clearColor, bool clearAlpha) {
+  auto writeMask = wgpu::ColorWriteMask::None;
+  if (clearColor) {
+    writeMask |= wgpu::ColorWriteMask::Red | wgpu::ColorWriteMask::Green | wgpu::ColorWriteMask::Blue;
+  }
+  if (clearAlpha) {
+    writeMask |= wgpu::ColorWriteMask::Alpha;
+  }
+  return writeMask;
+}
+} // namespace
+
+namespace aurora::gfx::clear {
+
+using webgpu::g_device;
+using webgpu::g_graphicsConfig;
+
+wgpu::RenderPipeline create_pipeline(const PipelineConfig& config) {
+  ZoneScoped;
+  wgpu::ShaderSourceWGSL sourceDescriptor{};
+  sourceDescriptor.code = R"""(
+struct VertexOutput {
+    @builtin(position) pos: vec4<f32>,
+};
+
+struct ClearUniform {
+    depth: f32,
+};
+
+struct FragmentOutput {
+    @location(0) color: vec4<f32>,
+    @builtin(frag_depth) depth: f32,
+};
+
+@group(1) @binding(0) var<uniform> clear: ClearUniform;
+
+var<private> pos: array<vec2<f32>, 3> = array<vec2<f32>, 3>(
+    vec2(-1.0, 1.0),
+    vec2(-1.0, -3.0),
+    vec2(3.0, 1.0),
+);
+
+@vertex
+fn vs_main(@builtin(vertex_index) vtxIdx: u32) -> VertexOutput {
+    var out: VertexOutput;
+    out.pos = vec4<f32>(pos[vtxIdx], 0.0, 1.0);
+    return out;
+}
+
+@fragment
+fn fs_main() -> FragmentOutput {
+    var out: FragmentOutput;
+    out.color = vec4<f32>(1.0);
+    out.depth = clear.depth;
+    return out;
+}
+)""";
+  const wgpu::ShaderModuleDescriptor moduleDescriptor{
+      .nextInChain = &sourceDescriptor,
+      .label = "EFB Clear Module",
+  };
+  auto module = g_device.CreateShaderModule(&moduleDescriptor);
+  const std::array layouts{
+      g_staticBindGroupLayout,
+      g_uniformBindGroupLayout,
+  };
+  const wgpu::PipelineLayoutDescriptor layoutDescriptor{
+      .label = "EFB Clear Pipeline Layout",
+      .bindGroupLayoutCount = layouts.size(),
+      .bindGroupLayouts = layouts.data(),
+  };
+  auto pipelineLayout = g_device.CreatePipelineLayout(&layoutDescriptor);
+  constexpr wgpu::BlendState blendState{
+      .color =
+          wgpu::BlendComponent{
+              .operation = wgpu::BlendOperation::Add,
+              .srcFactor = wgpu::BlendFactor::Constant,
+              .dstFactor = wgpu::BlendFactor::Zero,
+          },
+      .alpha =
+          wgpu::BlendComponent{
+              .operation = wgpu::BlendOperation::Add,
+              .srcFactor = wgpu::BlendFactor::Constant,
+              .dstFactor = wgpu::BlendFactor::Zero,
+          },
+  };
+  const wgpu::ColorTargetState colorTarget{
+      .format = g_graphicsConfig.surfaceConfiguration.format,
+      .blend = &blendState,
+      .writeMask = clear_write_mask(config.clearColor, config.clearAlpha),
+  };
+  const wgpu::FragmentState fragmentState{
+      .module = module,
+      .entryPoint = "fs_main",
+      .targetCount = 1,
+      .targets = &colorTarget,
+  };
+  const wgpu::DepthStencilState depthStencil{
+      .format = g_graphicsConfig.depthFormat,
+      .depthWriteEnabled = config.clearDepth,
+      .depthCompare = wgpu::CompareFunction::Always,
+  };
+  const auto label = fmt::format("EFB Clear Pipeline (color {}, alpha {}, depth {})", config.clearColor,
+                                 config.clearAlpha, config.clearDepth);
+  const wgpu::RenderPipelineDescriptor pipelineDescriptor{
+      .label = label.c_str(),
+      .layout = pipelineLayout,
+      .vertex =
+          wgpu::VertexState{
+              .module = module,
+              .entryPoint = "vs_main",
+          },
+      .primitive =
+          wgpu::PrimitiveState{
+              .topology = wgpu::PrimitiveTopology::TriangleList,
+          },
+      .depthStencil = &depthStencil,
+      .multisample =
+          wgpu::MultisampleState{
+              .count = config.msaaSamples,
+          },
+      .fragment = &fragmentState,
+  };
+  return g_device.CreateRenderPipeline(&pipelineDescriptor);
+}
+
+void render(const DrawData& data, const wgpu::RenderPassEncoder& pass, const wgpu::Extent3D& targetSize,
+            PipelineRef& currentPipeline) {
+  if (!bind_pipeline(data.pipeline, pass, currentPipeline)) {
+    return;
+  }
+
+  const std::array offsets{data.uniformRange.offset};
+  pass.SetBindGroup(1, g_uniformBindGroup, offsets.size(), offsets.data());
+  pass.SetBlendConstant(&data.color);
+  pass.SetViewport(0.f, 0.f, static_cast<float>(targetSize.width), static_cast<float>(targetSize.height), 0.f, 1.f);
+  if (data.useScissor) {
+    const auto x = static_cast<uint32_t>(std::clamp<int32_t>(data.scissor.x, 0, static_cast<int32_t>(targetSize.width)));
+    const auto y = static_cast<uint32_t>(std::clamp<int32_t>(data.scissor.y, 0, static_cast<int32_t>(targetSize.height)));
+    const auto right = static_cast<uint32_t>(std::clamp<int32_t>(
+        data.scissor.x + data.scissor.width, 0, static_cast<int32_t>(targetSize.width)));
+    const auto bottom = static_cast<uint32_t>(std::clamp<int32_t>(
+        data.scissor.y + data.scissor.height, 0, static_cast<int32_t>(targetSize.height)));
+    if (right <= x || bottom <= y) {
+      return;
+    }
+    pass.SetScissorRect(x, y, right - x, bottom - y);
+  } else {
+    pass.SetScissorRect(0, 0, targetSize.width, targetSize.height);
+  }
+  pass.Draw(3);
+}
+} // namespace aurora::gfx::clear
diff --git a/aurora-main/lib/gfx/clear.hpp b/aurora-main/lib/gfx/clear.hpp
new file mode 100644
index 0000000..7aed97f
--- /dev/null
+++ b/aurora-main/lib/gfx/clear.hpp
@@ -0,0 +1,31 @@
+#pragma once
+
+#include "common.hpp"
+
+#include <webgpu/webgpu_cpp.h>
+
+namespace aurora::gfx::clear {
+struct DrawData {
+  PipelineRef pipeline;
+  Range uniformRange;
+  wgpu::Color color;
+  float depth = 0.f;
+  bool useScissor = false;
+  ClipRect scissor{};
+};
+
+constexpr uint32_t ClearPipelineConfigVersion = 3;
+struct PipelineConfig {
+  uint32_t version = ClearPipelineConfigVersion;
+  uint32_t msaaSamples = 1;
+  bool clearColor = true;
+  bool clearAlpha = true;
+  bool clearDepth = true;
+  uint8_t _pad = 0;
+};
+static_assert(std::has_unique_object_representations_v<PipelineConfig>);
+
+wgpu::RenderPipeline create_pipeline(const PipelineConfig& config);
+void render(const DrawData& data, const wgpu::RenderPassEncoder& pass, const wgpu::Extent3D& targetSize,
+            PipelineRef& currentPipeline);
+} // namespace aurora::gfx::clear
diff --git a/aurora-main/lib/gfx/common.cpp b/aurora-main/lib/gfx/common.cpp
new file mode 100644
index 0000000..1bb1bb4
--- /dev/null
+++ b/aurora-main/lib/gfx/common.cpp
@@ -0,0 +1,1632 @@
+#include "common.hpp"
+#include "../gx/shader_info.hpp"
+
+#include "clear.hpp"
+#include "depth_peek.hpp"
+#include "efb_ram_copy.hpp"
+#include "../internal.hpp"
+#include "../webgpu/gpu.hpp"
+#include "../gx/pipeline.hpp"
+#include "pipeline_cache.hpp"
+#include "tex_copy_conv.hpp"
+#include "tex_palette_conv.hpp"
+#include "texture_replacement.hpp"
+#include "texture.hpp"
+#include "../window.hpp"
+
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cmath>
+#include <cstdlib>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <ranges>
+
+#include <absl/container/flat_hash_map.h>
+#include <magic_enum.hpp>
+
+#include "tracy/Tracy.hpp"
+
+namespace aurora::gfx {
+static Module Log("aurora::gfx");
+
+using webgpu::g_device;
+using webgpu::g_instance;
+using webgpu::g_queue;
+
+#ifdef AURORA_GFX_DEBUG_GROUPS
+std::vector<std::string> g_debugGroupStack;
+std::vector<std::string> g_debugMarkers;
+#endif
+
+constexpr uint64_t StagingBufferSize = UniformBufferSize + VertexBufferSize + IndexBufferSize + StorageBufferSize +
+                                       (UseTextureBuffer ? TextureUploadSize : 0);
+
+struct ShaderDrawCommand {
+  ShaderType type;
+  union {
+    clear::DrawData clear;
+    gx::DrawData gx;
+  };
+};
+enum class CommandType {
+  SetViewport,
+  SetScissor,
+  Draw,
+  DebugMarker,
+};
+struct Command {
+  CommandType type;
+#ifdef AURORA_GFX_DEBUG_GROUPS
+  std::vector<std::string> debugGroupStack;
+#endif
+  union Data {
+    Viewport setViewport;
+    ClipRect setScissor;
+    ShaderDrawCommand draw;
+    size_t debugMarkerIndex;
+  } data;
+};
+} // namespace aurora::gfx
+
+void aurora_set_guest_write_hooks(AuroraGuestWriteGenerationCallback generation,
+                                  AuroraGuestWriteNotifyCallback notify) {
+  aurora::g_guestWriteGenerationHook = generation;
+  aurora::g_guestWriteNotifyHook = notify;
+}
+
+namespace aurora {
+// For types that we can't ensure are safe to hash with has_unique_object_representations,
+// we create specialized methods to handle them. Note that these are highly dependent on
+// the structure definition, which could easily change with Dawn updates.
+template <>
+inline HashType xxh3_hash(const WGPUBindGroupDescriptor& input, HashType seed) {
+  constexpr auto offset = offsetof(WGPUBindGroupDescriptor, layout); // skip nextInChain, label
+  const auto hash = xxh3_hash_s(reinterpret_cast<const u8*>(&input) + offset,
+                                sizeof(WGPUBindGroupDescriptor) - offset - sizeof(void*) /* skip entries */, seed);
+  const size_t entryBytes = sizeof(WGPUBindGroupEntry) * input.entryCount;
+  // The entries are hashed unseeded so they stay off XXH3's seeded long path;
+  // the descriptor head still carries the caller's seed.
+  return hash_combine(hash, xxh3_hash_s(input.entries, entryBytes));
+}
+template <>
+inline HashType xxh3_hash(const wgpu::SamplerDescriptor& input, HashType seed) {
+  constexpr auto offset = offsetof(wgpu::SamplerDescriptor, addressModeU); // skip nextInChain, label
+  return xxh3_hash_s(reinterpret_cast<const u8*>(&input) + offset,
+                     sizeof(wgpu::SamplerDescriptor) - offset - 2 /* skip padding */, seed);
+}
+} // namespace aurora
+
+namespace aurora::gfx {
+namespace {
+struct CachedBindGroup {
+  wgpu::BindGroup bindGroup;
+  uint32_t lastUsedFrame = 0;
+};
+
+constexpr uint32_t BindGroupCacheRetainFrames = 32;
+constexpr uint32_t BindGroupCacheSweepPeriod = 16;
+} // namespace
+
+static absl::flat_hash_map<BindGroupRef, CachedBindGroup> g_cachedBindGroups;
+// Bind groups dropped from the cache by clear_caches() while a sealed frame's recorded draws
+// still reference them. Ownership moves here and is released at the next seal.
+static std::vector<CachedBindGroup> g_retiredBindGroups;
+static absl::flat_hash_map<SamplerRef, wgpu::Sampler> g_cachedSamplers;
+
+static ByteBuffer g_verts;
+static ByteBuffer g_uniforms;
+static ByteBuffer g_indices;
+static ByteBuffer g_storage;
+static ByteBuffer g_textureUpload;
+wgpu::Buffer g_vertexBuffer;
+wgpu::Buffer g_uniformBuffer;
+wgpu::Buffer g_indexBuffer;
+wgpu::Buffer g_storageBuffer;
+constexpr size_t FrameSlotCount = 3;
+static std::array<wgpu::Buffer, FrameSlotCount> g_stagingBuffers;
+static size_t currentStagingBuffer = 0;
+enum class BufferMapState {
+  Unmapped,
+  Mapping,
+  Mapped,
+};
+static std::atomic s_mappingState{BufferMapState::Unmapped};
+static wgpu::Limits g_cachedLimits;
+// Advanced once per logical frame in the seal prologue, under the renderer GPU mutex and with the
+// producer blocked, so every later reader sees a value that no longer moves.
+static uint32_t g_frameIndex = UINT32_MAX;
+wgpu::BindGroupLayout g_staticBindGroupLayout;
+wgpu::BindGroup g_staticBindGroup;
+wgpu::BindGroupLayout g_uniformBindGroupLayout;
+wgpu::BindGroup g_uniformBindGroup;
+
+// for imgui debug
+AuroraStats g_stats{};
+uint32_t g_drawCallCount = 0;
+uint32_t g_mergedDrawCallCount = 0;
+
+using CommandList = std::vector<Command>;
+struct RenderPass {
+  wgpu::TextureView colorView;
+  wgpu::TextureView resolveView; // MSAA resolve target; null if msaaSamples == 1
+  wgpu::TextureView depthView;
+  wgpu::Texture copySourceTexture;
+  wgpu::TextureView copySourceView;
+  wgpu::TextureView copySourceDepthView;
+  wgpu::Extent3D targetSize;
+  uint32_t msaaSamples = 1;
+
+  TextureHandle resolveTarget;
+  TextureHandle resolveSourceSnapshot;
+  GXTexFmt resolveFormat = GX_TF_RGBA8;
+  ClipRect resolveRect;
+  ClipRect resolveSnapshotRect;
+  Vec4<float> resolveSourceRect;
+  Range resolveUniformRange;
+  std::array<u32, 3> resolveCopyFilterCoefficients{0, 64, 0};
+  Vec4<float> clearColorValue{0.f, 0.f, 0.f, 0.f};
+  float clearDepthValue = 1.f;
+  CommandList commands;
+  bool clearColor = true;
+  bool clearDepth = true;
+  // The resolve destination outlives the frame with no re-issue path (one-shot
+  // bake), so this pass may not drop draws even in skip-unready-pipelines mode.
+  bool requireReadyPipelines = false;
+  bool resolveHalfScale = false;
+  bool resolveCopyFilterActive = false;
+  bool resolveForceOpaqueAlpha = false;
+  bool resolveNeedsConversion = false;
+  bool resolveNeedsShaderSampling = false;
+  bool resolveLinearSampling = false;
+  bool snapshotColorResolveSource = false;
+  std::vector<tex_palette_conv::ConvRequest> paletteConvs;
+};
+static std::vector<RenderPass> g_renderPasses;
+static u32 g_currentRenderPass = UINT32_MAX;
+
+// Recycle command storage: discarding passes used to free their command lists too, so each frame
+// rebuilt hundreds of KB from zero capacity. The passes themselves are cheap to recreate.
+using CommandListPool = std::vector<CommandList>;
+static CommandListPool g_commandListPool;
+static constexpr size_t MaxPooledCommandLists = 32;
+// The pool is the only recording storage both sides touch, a few pointer moves per frame, so a
+// plain mutex is cheaper than the alternatives and keeps the vector's invariants.
+static std::mutex g_commandListPoolMutex;
+
+static CommandList acquire_command_list() noexcept {
+  std::lock_guard lock{g_commandListPoolMutex};
+  if (g_commandListPool.empty()) {
+    return {};
+  }
+  CommandList list = std::move(g_commandListPool.back());
+  g_commandListPool.pop_back();
+  list.clear();
+  return list;
+}
+
+static void release_command_list(CommandList&& list) noexcept {
+  if (list.capacity() == 0) {
+    return;
+  }
+  std::lock_guard lock{g_commandListPoolMutex};
+  if (g_commandListPool.size() >= MaxPooledCommandLists) {
+    return;
+  }
+  list.clear();
+  g_commandListPool.emplace_back(std::move(list));
+}
+
+static void release_render_pass(RenderPass& pass) noexcept { release_command_list(std::move(pass.commands)); }
+
+static void recycle_render_passes(std::vector<RenderPass>& passes) noexcept {
+  for (auto& pass : passes) {
+    release_render_pass(pass);
+  }
+  passes.clear();
+}
+
+struct SealedFrameData {
+  std::vector<RenderPass> passes;
+};
+
+SealedFrame::SealedFrame() : m_data(std::make_unique<SealedFrameData>()) {}
+SealedFrame::~SealedFrame() = default;
+SealedFrame::SealedFrame(SealedFrame&&) noexcept = default;
+SealedFrame& SealedFrame::operator=(SealedFrame&&) noexcept = default;
+
+static RenderPass& push_render_pass(RenderPass&& pass) {
+  auto& out = g_renderPasses.emplace_back(std::move(pass));
+  if (out.commands.capacity() == 0) {
+    out.commands = acquire_command_list();
+  }
+  return out;
+}
+// The producer may build the next frame's GX stream while the worker prepares the target, and
+// this is the only renderer-owned property that path queries, so publish it explicitly.
+static std::atomic_bool g_inOffscreen{false};
+static std::optional<RenderPass> g_suspendedEfbPass;
+static Viewport g_suspendedEfbViewport;
+static ClipRect g_suspendedEfbScissor;
+
+static void discard_suspended_efb_pass() noexcept {
+  if (g_suspendedEfbPass) {
+    release_render_pass(*g_suspendedEfbPass);
+    g_suspendedEfbPass.reset();
+  }
+}
+
+static bool has_current_render_pass() noexcept { return g_currentRenderPass < g_renderPasses.size(); }
+static webgpu::TextureWithSampler g_offscreenColor;
+static webgpu::TextureWithSampler g_offscreenDepth;
+
+struct ResolveSourceSnapshotPool {
+  TextureHandle entry;
+};
+
+// Snapshot resources live in the same safe frame slots as the mapped staging buffers, and copies
+// within a frame are ordered, so one grow-only snapshot serves every resolve in that slot.
+static std::array<ResolveSourceSnapshotPool, FrameSlotCount> g_resolveSourceSnapshotPools;
+static size_t g_recordingSnapshotSlot = 0;
+
+static TextureHandle new_resolve_source_snapshot(wgpu::Extent3D size, wgpu::TextureFormat format) noexcept {
+  const wgpu::TextureDescriptor textureDescriptor{
+      .label = "GX Copy Source Snapshot",
+      .usage = wgpu::TextureUsage::TextureBinding | wgpu::TextureUsage::CopyDst,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = format,
+      .mipLevelCount = 1,
+      .sampleCount = 1,
+  };
+  auto texture = g_device.CreateTexture(&textureDescriptor);
+  constexpr wgpu::TextureViewDescriptor viewDescriptor{
+      .label = "GX Copy Source Snapshot view",
+      .dimension = wgpu::TextureViewDimension::e2D,
+  };
+  auto textureView = texture.CreateView(&viewDescriptor);
+  wgpu::TextureView sampleTextureView = textureView;
+  return std::make_shared<TextureRef>(std::move(texture), std::move(sampleTextureView), std::move(textureView), size,
+                                      format, 1, GX_TF_RGBA8);
+}
+
+static TextureHandle acquire_resolve_source_snapshot(uint32_t width, uint32_t height) noexcept {
+  auto& pool = g_resolveSourceSnapshotPools[g_recordingSnapshotSlot];
+  const auto format = webgpu::g_graphicsConfig.surfaceConfiguration.format;
+
+  if (pool.entry && pool.entry->size.width >= width && pool.entry->size.height >= height &&
+      pool.entry->format == format) {
+    return pool.entry;
+  }
+
+  const wgpu::Extent3D size{
+      std::max(width, pool.entry ? pool.entry->size.width : 0u),
+      std::max(height, pool.entry ? pool.entry->size.height : 0u),
+      1,
+  };
+  pool.entry = new_resolve_source_snapshot(size, format);
+  return pool.entry;
+}
+
+struct ResolveSamplingPlan {
+  bool needsConversion = false;
+  bool needsShaderSampling = false;
+  bool usesLinearSampling = false;
+};
+
+static ResolveSamplingPlan make_resolve_sampling_plan(const TextureHandle& target, GXTexFmt format,
+                                                       const ClipRect& resolveRect, const Vec4<float>& sourceRect,
+                                                       bool halfScale, bool copyFilterActive,
+                                                       bool forceOpaqueAlpha) noexcept {
+  const auto differs = [](float lhs, float rhs) { return std::abs(lhs - rhs) > 0.01f; };
+  const auto differsFromDst = [&](uint32_t dst, float src) {
+    return differs(static_cast<float>(dst), src);
+  };
+  const bool sourceMatchesIntegerRect =
+      !differs(sourceRect.x(), static_cast<float>(resolveRect.x)) &&
+      !differs(sourceRect.y(), static_cast<float>(resolveRect.y)) &&
+      !differs(sourceRect.z(), static_cast<float>(resolveRect.width)) &&
+      !differs(sourceRect.w(), static_cast<float>(resolveRect.height));
+  const bool dstMatchesSource = target && !differsFromDst(target->size.width, sourceRect.z()) &&
+                                !differsFromDst(target->size.height, sourceRect.w());
+  const bool needsShaderSampling =
+      halfScale || copyFilterActive || forceOpaqueAlpha || !sourceMatchesIntegerRect || !dstMatchesSource;
+  return {
+      .needsConversion = tex_copy_conv::needs_conversion(format),
+      .needsShaderSampling = needsShaderSampling,
+      .usesLinearSampling = halfScale || (needsShaderSampling && !copyFilterActive),
+  };
+}
+
+static ClipRect calculate_resolve_snapshot_rect(const wgpu::Extent3D& targetSize,
+                                                const Vec4<float>& sourceRect,
+                                                const ResolveSamplingPlan& samplingPlan,
+                                                bool copyFilterActive) noexcept {
+  const ClipRect fullTarget{
+      .x = 0,
+      .y = 0,
+      .width = static_cast<int32_t>(targetSize.width),
+      .height = static_cast<int32_t>(targetSize.height),
+  };
+  // Shader-sampled and converted copies can feed effects that read outside the copy rectangle
+  // (MKW's DOF chain), so keep those full-target. Exact copies have a closed, crop-safe footprint.
+  if (samplingPlan.needsConversion ||
+      samplingPlan.needsShaderSampling ||
+      targetSize.width == 0 || targetSize.height == 0 ||
+      !std::isfinite(sourceRect.x()) || !std::isfinite(sourceRect.y()) ||
+      !std::isfinite(sourceRect.z()) || !std::isfinite(sourceRect.w()) ||
+      sourceRect.z() <= 0.0f || sourceRect.w() <= 0.0f) {
+    return fullTarget;
+  }
+
+  // Linear sampling can touch one neighbor on every edge. The vertical GX
+  // copy filter explicitly samples the previous and next rows.
+  const int32_t haloX = samplingPlan.usesLinearSampling ? 1 : 0;
+  const int32_t haloY = (samplingPlan.usesLinearSampling || copyFilterActive) ? 1 : 0;
+  const int32_t targetWidth = static_cast<int32_t>(targetSize.width);
+  const int32_t targetHeight = static_cast<int32_t>(targetSize.height);
+  const int32_t left = std::clamp(static_cast<int32_t>(std::floor(sourceRect.x())) - haloX, 0, targetWidth - 1);
+  const int32_t top = std::clamp(static_cast<int32_t>(std::floor(sourceRect.y())) - haloY, 0, targetHeight - 1);
+  const int32_t right = std::clamp(static_cast<int32_t>(std::ceil(sourceRect.x() + sourceRect.z())) + haloX,
+                                   left + 1, targetWidth);
+  const int32_t bottom = std::clamp(static_cast<int32_t>(std::ceil(sourceRect.y() + sourceRect.w())) + haloY,
+                                    top + 1, targetHeight);
+  return {
+      .x = left,
+      .y = top,
+      .width = right - left,
+      .height = bottom - top,
+  };
+}
+
+static void set_efb_targets(RenderPass& pass) {
+  pass.colorView = webgpu::g_frameBuffer.view;
+  pass.resolveView = webgpu::g_graphicsConfig.msaaSamples > 1 ? webgpu::g_frameBufferResolved.view : nullptr;
+  pass.depthView = webgpu::g_depthBuffer.view;
+  pass.copySourceTexture =
+      webgpu::g_graphicsConfig.msaaSamples > 1 ? webgpu::g_frameBufferResolved.texture : webgpu::g_frameBuffer.texture;
+  pass.copySourceView =
+      webgpu::g_graphicsConfig.msaaSamples > 1 ? webgpu::g_frameBufferResolved.view : webgpu::g_frameBuffer.view;
+  pass.copySourceDepthView = webgpu::g_depthBuffer.view;
+  pass.targetSize = webgpu::g_frameBuffer.size;
+  pass.msaaSamples = webgpu::g_graphicsConfig.msaaSamples;
+}
+
+struct OffscreenCacheKey {
+  uint32_t width;
+  uint32_t height;
+
+  bool operator==(const OffscreenCacheKey& rhs) const { return width == rhs.width && height == rhs.height; }
+  template <typename H>
+  friend H AbslHashValue(H h, const OffscreenCacheKey& key) {
+    return H::combine(std::move(h), key.width, key.height);
+  }
+};
+struct OffscreenCacheEntry {
+  webgpu::TextureWithSampler color;
+  webgpu::TextureWithSampler depth;
+};
+static absl::flat_hash_map<OffscreenCacheKey, OffscreenCacheEntry> g_offscreenCache;
+std::vector<TextureUpload> g_textureUploads;
+
+static inline void push_command(CommandType type, const Command::Data& data) {
+  if (!has_current_render_pass())
+    UNLIKELY {
+      Log.warn("Dropping command {}", magic_enum::enum_name(type));
+      return;
+    }
+  g_renderPasses[g_currentRenderPass].commands.push_back({
+      .type = type,
+#ifdef AURORA_GFX_DEBUG_GROUPS
+      .debugGroupStack = g_debugGroupStack,
+#endif
+      .data = data,
+  });
+}
+
+template <>
+gx::DrawData* get_last_draw_command() {
+  if (g_currentRenderPass >= g_renderPasses.size()) {
+    return nullptr;
+  }
+  auto& last = g_renderPasses[g_currentRenderPass].commands.back();
+  if (last.type != CommandType::Draw || last.data.draw.type != ShaderType::GX) {
+    return nullptr;
+  }
+  return &last.data.draw.gx;
+}
+
+static void push_draw_command(ShaderDrawCommand data) {
+  push_command(CommandType::Draw, Command::Data{.draw = data});
+  ++g_drawCallCount;
+}
+
+Vec2<uint32_t> get_frame_buffer_size() noexcept {
+  if (webgpu::g_frameBuffer.size.width != 0 && webgpu::g_frameBuffer.size.height != 0) {
+    return {webgpu::g_frameBuffer.size.width, webgpu::g_frameBuffer.size.height};
+  }
+  const auto windowSize = window::get_window_size();
+  return {windowSize.fb_width, windowSize.fb_height};
+}
+
+// Render-thread only: the frame worker recycles g_renderPasses in end_frame, so an off-thread
+// read is a use-after-free rather than a stale value. Use get_frame_buffer_size() instead.
+Vec2<uint32_t> get_render_target_size() noexcept {
+  if (g_currentRenderPass < g_renderPasses.size()) {
+    const auto& size = g_renderPasses[g_currentRenderPass].targetSize;
+    return {size.width, size.height};
+  }
+  return get_frame_buffer_size();
+}
+
+static Viewport g_cachedViewport;
+void set_viewport(const Viewport& cmd) noexcept {
+  if (cmd != g_cachedViewport) {
+    push_command(CommandType::SetViewport, Command::Data{.setViewport = cmd});
+    g_cachedViewport = cmd;
+  }
+}
+
+static ClipRect g_cachedScissor;
+void set_scissor(const ClipRect& cmd) noexcept {
+  if (cmd != g_cachedScissor) {
+    push_command(CommandType::SetScissor, Command::Data{.setScissor = cmd});
+    g_cachedScissor = cmd;
+  }
+}
+
+template <>
+void push_draw_command(clear::DrawData data) {
+  if (data.uniformRange.size == 0) {
+    const std::array clearUniform{
+        std::clamp(data.depth, 0.f, 1.f),
+        0.f,
+        0.f,
+        0.f,
+    };
+    data.uniformRange = push_uniform(clearUniform);
+  }
+  push_draw_command(ShaderDrawCommand{.type = ShaderType::Clear, .clear = data});
+}
+
+template <>
+PipelineRef pipeline_ref(const clear::PipelineConfig& config) {
+  return find_pipeline(ShaderType::Clear, config, [=] { return create_pipeline(config); });
+}
+
+void resolve_pass(TextureHandle texture, ClipRect rect, bool clearColor, bool clearAlpha, bool clearDepth,
+                  Vec4<float> clearColorValue, float clearDepthValue, GXTexFmt resolveFormat,
+                  const Vec4<float>* sourceRectPixels, bool halfScale,
+                  const std::array<u32, 3>* copyFilterCoefficients, bool forceOpaqueAlpha,
+                  float copyFilterRowStride, bool clampTop, bool clampBottom, bool persistentCopy) {
+  // Resolve current render pass
+  if (!has_current_render_pass()) {
+    Log.warn("Dropping resolve pass without an active render pass");
+    return;
+  }
+  auto& prevPass = g_renderPasses[g_currentRenderPass];
+  const auto targetWidth = static_cast<int32_t>(prevPass.targetSize.width);
+  const auto targetHeight = static_cast<int32_t>(prevPass.targetSize.height);
+  if (targetWidth <= 0 || targetHeight <= 0) {
+    Log.warn("Dropping resolve pass with invalid target size {}x{}", targetWidth, targetHeight);
+    return;
+  }
+  Vec4<float> sourceRect = sourceRectPixels != nullptr
+                               ? *sourceRectPixels
+                               : Vec4<float>{static_cast<float>(rect.x), static_cast<float>(rect.y),
+                                             static_cast<float>(rect.width), static_cast<float>(rect.height)};
+  if (targetWidth > 0 && targetHeight > 0) {
+    const int32_t left = std::clamp(rect.x, 0, targetWidth - 1);
+    const int32_t top = std::clamp(rect.y, 0, targetHeight - 1);
+    const int32_t right = std::clamp(rect.x + rect.width, left + 1, targetWidth);
+    const int32_t bottom = std::clamp(rect.y + rect.height, top + 1, targetHeight);
+    rect = {
+        .x = left,
+        .y = top,
+        .width = right - left,
+        .height = bottom - top,
+    };
+
+    const float srcW = static_cast<float>(targetWidth);
+    const float srcH = static_cast<float>(targetHeight);
+    const float srcLeft = std::clamp(sourceRect.x(), 0.0f, srcW);
+    const float srcTop = std::clamp(sourceRect.y(), 0.0f, srcH);
+    const float srcRight = std::clamp(sourceRect.x() + sourceRect.z(), srcLeft, srcW);
+    const float srcBottom = std::clamp(sourceRect.y() + sourceRect.w(), srcTop, srcH);
+    sourceRect = {srcLeft, srcTop, std::max(srcRight - srcLeft, 1.0f), std::max(srcBottom - srcTop, 1.0f)};
+  }
+  prevPass.resolveTarget = std::move(texture);
+  prevPass.requireReadyPipelines = persistentCopy;
+  prevPass.resolveRect = rect;
+  prevPass.resolveSourceRect = sourceRect;
+  prevPass.resolveFormat = resolveFormat;
+  prevPass.resolveHalfScale = halfScale;
+  prevPass.resolveForceOpaqueAlpha = forceOpaqueAlpha;
+  prevPass.resolveCopyFilterCoefficients =
+      copyFilterCoefficients != nullptr ? *copyFilterCoefficients : std::array<u32, 3>{0, 64, 0};
+  prevPass.resolveCopyFilterActive = prevPass.resolveCopyFilterCoefficients[0] != 0 ||
+                                     prevPass.resolveCopyFilterCoefficients[1] != 64 ||
+                                     prevPass.resolveCopyFilterCoefficients[2] != 0;
+  const auto samplingPlan = make_resolve_sampling_plan(
+      prevPass.resolveTarget, resolveFormat, rect, sourceRect, halfScale,
+      prevPass.resolveCopyFilterActive, forceOpaqueAlpha);
+  prevPass.resolveNeedsConversion = samplingPlan.needsConversion;
+  prevPass.resolveNeedsShaderSampling = samplingPlan.needsShaderSampling;
+  prevPass.resolveLinearSampling = samplingPlan.usesLinearSampling;
+  prevPass.snapshotColorResolveSource =
+      !gx::is_depth_format(resolveFormat) && (clearColor || clearAlpha || clearDepth);
+  Vec4<float> uniformSourceRect = sourceRect;
+  float srcW = static_cast<float>(prevPass.targetSize.width);
+  float srcH = static_cast<float>(prevPass.targetSize.height);
+  if (prevPass.snapshotColorResolveSource) {
+    prevPass.resolveSnapshotRect = calculate_resolve_snapshot_rect(
+        prevPass.targetSize, sourceRect, samplingPlan, prevPass.resolveCopyFilterActive);
+    prevPass.resolveSourceSnapshot = acquire_resolve_source_snapshot(
+        static_cast<uint32_t>(prevPass.resolveSnapshotRect.width),
+        static_cast<uint32_t>(prevPass.resolveSnapshotRect.height));
+    uniformSourceRect = {
+        sourceRect.x() - static_cast<float>(prevPass.resolveSnapshotRect.x),
+        sourceRect.y() - static_cast<float>(prevPass.resolveSnapshotRect.y),
+        sourceRect.z(), sourceRect.w()};
+    srcW = static_cast<float>(prevPass.resolveSourceSnapshot->size.width);
+    srcH = static_cast<float>(prevPass.resolveSourceSnapshot->size.height);
+  }
+  // GX's copy-clamp bits pin every vertical filter tap to the first or last source texel; without
+  // it a filtered copy at internal resolution samples an unrelated EFB row as a visible border.
+  const float clampTopPixels = clampTop ? uniformSourceRect.y() : 0.0f;
+  const float clampBottomPixels =
+      clampBottom ? uniformSourceRect.y() + uniformSourceRect.w() : srcH;
+  const float clampTopUv = (clampTopPixels + 0.5f) / srcH;
+  const float clampBottomUv = (clampBottomPixels - 0.5f) / srcH;
+  // Push UV transform uniform for tex_copy_conv (crop region in UV space)
+  const std::array resolveUniform{
+      uniformSourceRect.x() / srcW,
+      uniformSourceRect.y() / srcH,
+      uniformSourceRect.z() / srcW,
+      uniformSourceRect.w() / srcH,
+      static_cast<float>(prevPass.resolveCopyFilterCoefficients[0]),
+      static_cast<float>(prevPass.resolveCopyFilterCoefficients[1]),
+      static_cast<float>(prevPass.resolveCopyFilterCoefficients[2]),
+      prevPass.resolveCopyFilterActive ? 1.0f : 0.0f,
+      prevPass.resolveForceOpaqueAlpha ? 1.0f : 0.0f,
+      std::max(copyFilterRowStride, 1.0f),
+      clampTopUv,
+      clampBottomUv,
+  };
+  prevPass.resolveUniformRange = push_uniform(resolveUniform);
+  const bool clearFullTarget = rect.x <= 0 && rect.y <= 0 &&
+                               rect.width >= static_cast<int32_t>(prevPass.targetSize.width) &&
+                               rect.height >= static_cast<int32_t>(prevPass.targetSize.height);
+  const bool useAttachmentColorClear = clearFullTarget && clearColor && clearAlpha;
+  const bool useAttachmentDepthClear = clearFullTarget && clearDepth;
+
+  // Populate new render pass from previous
+  const auto msaaSamples = prevPass.msaaSamples;
+  RenderPass newPass{
+      .colorView = prevPass.colorView,
+      .resolveView = prevPass.resolveView,
+      .depthView = prevPass.depthView,
+      .copySourceTexture = prevPass.copySourceTexture,
+      .copySourceView = prevPass.copySourceView,
+      .copySourceDepthView = prevPass.copySourceDepthView,
+      .targetSize = prevPass.targetSize,
+      .msaaSamples = msaaSamples,
+      .clearColorValue = clearColorValue,
+      .clearDepthValue = clearDepthValue,
+      .clearColor = useAttachmentColorClear,
+      .clearDepth = useAttachmentDepthClear,
+  };
+  push_render_pass(std::move(newPass));
+  ++g_currentRenderPass;
+
+  if ((!useAttachmentColorClear && (clearColor || clearAlpha)) || (!useAttachmentDepthClear && clearDepth)) {
+    // GX copy clears cover the copied EFB rectangle, not always the whole target, so use a scissored
+    // clear draw unless the load op can clear all of it.
+    push_draw_command(clear::DrawData{
+        .pipeline = pipeline_ref(clear::PipelineConfig{
+            .msaaSamples = msaaSamples,
+            .clearColor = clearColor,
+            .clearAlpha = clearAlpha,
+            .clearDepth = clearDepth,
+        }),
+        .color =
+            wgpu::Color{
+                .r = clearColorValue.x(),
+                .g = clearColorValue.y(),
+                .b = clearColorValue.z(),
+                .a = clearColorValue.w(),
+            },
+        .depth = clearDepthValue,
+        .useScissor = !clearFullTarget,
+        .scissor = rect,
+    });
+  }
+  push_command(CommandType::SetViewport, Command::Data{.setViewport = g_cachedViewport});
+  push_command(CommandType::SetScissor, Command::Data{.setScissor = g_cachedScissor});
+}
+
+void queue_palette_conv(tex_palette_conv::ConvRequest req) {
+  if (!has_current_render_pass()) {
+    Log.warn("Dropping palette conversion without an active render pass");
+    return;
+  }
+  g_renderPasses[g_currentRenderPass].paletteConvs.push_back(std::move(req));
+}
+
+bool is_offscreen() noexcept { return g_inOffscreen; }
+
+uint32_t get_sample_count() noexcept {
+  if (!has_current_render_pass()) {
+    return webgpu::g_graphicsConfig.msaaSamples;
+  }
+  return g_renderPasses[g_currentRenderPass].msaaSamples;
+}
+
+void clear_caches() noexcept {
+  g_offscreenCache.clear();
+  // Retire rather than free; see g_retiredBindGroups.
+  g_retiredBindGroups.reserve(g_retiredBindGroups.size() + g_cachedBindGroups.size());
+  for (auto& entry : g_cachedBindGroups) {
+    g_retiredBindGroups.emplace_back(std::move(entry.second));
+  }
+  g_cachedBindGroups.clear();
+}
+
+static OffscreenCacheEntry get_offscreen_textures(uint32_t width, uint32_t height) {
+  OffscreenCacheKey key{width, height};
+  if (const auto it = g_offscreenCache.find(key); it != g_offscreenCache.end()) {
+    return it->second;
+  }
+  const auto colorFormat = webgpu::g_graphicsConfig.surfaceConfiguration.format;
+  const wgpu::Extent3D size{width, height, 1};
+  const wgpu::TextureDescriptor colorDesc{
+      .label = "Offscreen Color",
+      .usage = wgpu::TextureUsage::RenderAttachment | wgpu::TextureUsage::TextureBinding | wgpu::TextureUsage::CopySrc |
+               wgpu::TextureUsage::CopyDst,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = colorFormat,
+      .mipLevelCount = 1,
+      .sampleCount = 1,
+  };
+  auto colorTexture = g_device.CreateTexture(&colorDesc);
+  auto colorView = colorTexture.CreateView();
+  webgpu::TextureWithSampler color{
+      .texture = std::move(colorTexture),
+      .view = std::move(colorView),
+      .size = size,
+      .format = colorFormat,
+  };
+  const auto depthFormat = webgpu::g_graphicsConfig.depthFormat;
+  const wgpu::TextureDescriptor depthDesc{
+      .label = "Offscreen Depth",
+      .usage = wgpu::TextureUsage::RenderAttachment,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = depthFormat,
+      .mipLevelCount = 1,
+      .sampleCount = 1,
+  };
+  auto depthTexture = g_device.CreateTexture(&depthDesc);
+  auto depthView = depthTexture.CreateView();
+  webgpu::TextureWithSampler depth{
+      .texture = std::move(depthTexture),
+      .view = std::move(depthView),
+      .size = size,
+      .format = depthFormat,
+  };
+  OffscreenCacheEntry entry{
+      .color = std::move(color),
+      .depth = std::move(depth),
+  };
+  auto [insertIt, _] = g_offscreenCache.emplace(key, std::move(entry));
+  return insertIt->second;
+}
+
+void begin_offscreen(uint32_t width, uint32_t height) {
+  ZoneScoped;
+  CHECK(g_currentRenderPass != UINT32_MAX, "begin_offscreen called outside of a frame");
+
+  // If the current EFB pass has no resolve target, its output is unobservable.
+  // Suspend it so that we can resume it after the offscreen pass.
+  if (!g_inOffscreen) {
+    auto& currentPass = g_renderPasses[g_currentRenderPass];
+    if (!currentPass.resolveTarget) {
+      g_suspendedEfbPass = std::move(currentPass);
+      g_renderPasses.pop_back();
+      --g_currentRenderPass;
+    }
+    g_suspendedEfbViewport = g_cachedViewport;
+    g_suspendedEfbScissor = g_cachedScissor;
+  }
+
+  // Create offscreen textures
+  auto offscreenEntry = get_offscreen_textures(width, height);
+  g_offscreenColor = std::move(offscreenEntry.color);
+  g_offscreenDepth = std::move(offscreenEntry.depth);
+
+  // Start a new pass with offscreen targets
+  RenderPass newPass{
+      .colorView = g_offscreenColor.view,
+      .depthView = g_offscreenDepth.view,
+      .copySourceTexture = g_offscreenColor.texture,
+      .copySourceView = g_offscreenColor.view,
+      .copySourceDepthView = g_offscreenDepth.view,
+      .targetSize = {width, height, 1},
+      .msaaSamples = 1,
+      .clearColorValue = {0.f, 0.f, 0.f, 0.f},
+      .clearDepthValue = 1.f,
+      .clearColor = true,
+      .clearDepth = true,
+  };
+  push_render_pass(std::move(newPass));
+  ++g_currentRenderPass;
+
+  g_inOffscreen = true;
+
+  g_cachedViewport = {0.f, 0.f, static_cast<float>(width), static_cast<float>(height), 0.f, 1.f};
+  g_cachedScissor = {0, 0, static_cast<int32_t>(width), static_cast<int32_t>(height)};
+  push_command(CommandType::SetViewport, Command::Data{.setViewport = g_cachedViewport});
+  push_command(CommandType::SetScissor, Command::Data{.setScissor = g_cachedScissor});
+}
+
+void end_offscreen() {
+  ZoneScoped;
+  CHECK(g_inOffscreen, "end_offscreen called without begin_offscreen");
+
+  g_inOffscreen = false;
+  g_offscreenColor = {};
+  g_offscreenDepth = {};
+
+  // Resume suspended EFB pass, or start a new one (load existing content)
+  if (g_suspendedEfbPass) {
+    // Keeps its own recorded commands.
+    g_renderPasses.emplace_back(std::move(*g_suspendedEfbPass));
+    g_suspendedEfbPass.reset();
+  } else {
+    auto& pass = push_render_pass(RenderPass{});
+    pass.clearColor = false;
+    pass.clearDepth = false;
+  }
+  ++g_currentRenderPass;
+  set_efb_targets(g_renderPasses[g_currentRenderPass]);
+
+  g_cachedViewport = g_suspendedEfbViewport;
+  g_cachedScissor = g_suspendedEfbScissor;
+  push_command(CommandType::SetViewport, Command::Data{.setViewport = g_cachedViewport});
+  push_command(CommandType::SetScissor, Command::Data{.setScissor = g_cachedScissor});
+}
+
+template <>
+void push_draw_command(gx::DrawData data) {
+  push_draw_command(ShaderDrawCommand{.type = ShaderType::GX, .gx = data});
+}
+
+template <>
+PipelineRef pipeline_ref(const gx::PipelineConfig& config) {
+  return find_pipeline(ShaderType::GX, config, [=] { return create_pipeline(config); });
+}
+
+void initialize() {
+  g_frameIndex = 0;
+  depth_peek::initialize();
+  tex_copy_conv::initialize();
+  tex_palette_conv::initialize();
+  texture_replacement::initialize();
+
+  // For uniform & storage buffer offset alignments
+  g_device.GetLimits(&g_cachedLimits);
+
+  const auto createBuffer = [](wgpu::Buffer& out, wgpu::BufferUsage usage, uint64_t size, const char* label) {
+    if (size <= 0) {
+      return;
+    }
+    const wgpu::BufferDescriptor descriptor{
+        .label = label,
+        .usage = usage,
+        .size = size,
+    };
+    out = g_device.CreateBuffer(&descriptor);
+  };
+  createBuffer(g_uniformBuffer, wgpu::BufferUsage::Uniform | wgpu::BufferUsage::CopyDst, UniformBufferSize,
+               "Shared Uniform Buffer");
+  createBuffer(g_vertexBuffer, wgpu::BufferUsage::Storage | wgpu::BufferUsage::CopyDst, VertexBufferSize,
+               "Shared Vertex Buffer");
+  createBuffer(g_indexBuffer, wgpu::BufferUsage::Index | wgpu::BufferUsage::CopyDst, IndexBufferSize,
+               "Shared Index Buffer");
+  createBuffer(g_storageBuffer, wgpu::BufferUsage::Storage | wgpu::BufferUsage::CopyDst, StorageBufferSize,
+               "Shared Storage Buffer");
+  for (int i = 0; i < g_stagingBuffers.size(); ++i) {
+    const auto label = fmt::format("Staging Buffer {}", i);
+    createBuffer(g_stagingBuffers[i], wgpu::BufferUsage::MapWrite | wgpu::BufferUsage::CopySrc, StagingBufferSize,
+                 label.c_str());
+  }
+  currentStagingBuffer = 0;
+  s_mappingState.store(BufferMapState::Unmapped, std::memory_order_release);
+  map_staging_buffer();
+
+  {
+    constexpr std::array layoutEntries{
+        // Vertex data buffer
+        wgpu::BindGroupLayoutEntry{
+            .binding = 0,
+            .visibility = wgpu::ShaderStage::Vertex,
+            .buffer =
+                wgpu::BufferBindingLayout{
+                    .type = wgpu::BufferBindingType::ReadOnlyStorage,
+                },
+        },
+        // Storage data buffer
+        wgpu::BindGroupLayoutEntry{
+            .binding = 1,
+            .visibility = wgpu::ShaderStage::Vertex,
+            .buffer =
+                wgpu::BufferBindingLayout{
+                    .type = wgpu::BufferBindingType::ReadOnlyStorage,
+                },
+        },
+    };
+    const wgpu::BindGroupLayoutDescriptor layoutDesc{
+        .label = "Static bind group layout",
+        .entryCount = layoutEntries.size(),
+        .entries = layoutEntries.data(),
+    };
+    g_staticBindGroupLayout = g_device.CreateBindGroupLayout(&layoutDesc);
+    const std::array entries{
+        wgpu::BindGroupEntry{
+            .binding = 0,
+            .buffer = g_vertexBuffer,
+        },
+        wgpu::BindGroupEntry{
+            .binding = 1,
+            .buffer = g_storageBuffer,
+        },
+    };
+    const wgpu::BindGroupDescriptor bindGroupDescriptor{
+        .label = "Static bind group",
+        .layout = g_staticBindGroupLayout,
+        .entryCount = entries.size(),
+        .entries = entries.data(),
+    };
+    g_staticBindGroup = g_device.CreateBindGroup(&bindGroupDescriptor);
+  }
+
+  {
+    constexpr std::array layoutEntries{
+        // Uniform buffer (dynamic offset)
+        wgpu::BindGroupLayoutEntry{
+            .binding = 0,
+            .visibility = wgpu::ShaderStage::Vertex | wgpu::ShaderStage::Fragment,
+            .buffer =
+                wgpu::BufferBindingLayout{
+                    .type = wgpu::BufferBindingType::Uniform,
+                    .hasDynamicOffset = true,
+                },
+        },
+    };
+    const wgpu::BindGroupLayoutDescriptor layoutDesc{
+        .label = "Uniform bind group layout",
+        .entryCount = layoutEntries.size(),
+        .entries = layoutEntries.data(),
+    };
+    g_uniformBindGroupLayout = g_device.CreateBindGroupLayout(&layoutDesc);
+    const std::array entries{
+        wgpu::BindGroupEntry{
+            .binding = 0,
+            .buffer = g_uniformBuffer,
+            .size = gx::MaxUniformSize,
+        },
+    };
+    const wgpu::BindGroupDescriptor bindGroupDescriptor{
+        .label = "Uniform bind group",
+        .layout = g_uniformBindGroupLayout,
+        .entryCount = entries.size(),
+        .entries = entries.data(),
+    };
+    g_uniformBindGroup = g_device.CreateBindGroup(&bindGroupDescriptor);
+  }
+
+  gx::initialize();
+  initialize_pipeline_cache();
+}
+
+void shutdown() {
+  shutdown_pipeline_cache();
+  gx::clear_shader_module_cache();
+  efb_ram::shutdown();
+  depth_peek::shutdown();
+  tex_copy_conv::shutdown();
+  tex_palette_conv::shutdown();
+  texture_replacement::shutdown();
+  gx::shutdown();
+
+  g_textureUploads.clear();
+  g_cachedBindGroups.clear();
+  g_retiredBindGroups.clear();
+  g_cachedSamplers.clear();
+  g_vertexBuffer = {};
+  g_uniformBuffer = {};
+  g_indexBuffer = {};
+  g_storageBuffer = {};
+  g_stagingBuffers.fill({});
+  for (auto& pool : g_resolveSourceSnapshotPools) {
+    pool.entry.reset();
+  }
+  discard_suspended_efb_pass();
+  g_renderPasses.clear();
+  g_commandListPool.clear();
+  g_currentRenderPass = UINT32_MAX;
+  g_offscreenCache.clear();
+  g_offscreenColor = {};
+  g_offscreenDepth = {};
+  g_staticBindGroup = {};
+  g_staticBindGroupLayout = {};
+  g_uniformBindGroup = {};
+  g_uniformBindGroupLayout = {};
+  g_inOffscreen = false;
+  g_frameIndex = UINT32_MAX;
+  currentStagingBuffer = 0;
+  s_mappingState.store(BufferMapState::Unmapped, std::memory_order_release);
+}
+
+void map_staging_buffer() {
+  auto expected = BufferMapState::Unmapped;
+  if (!s_mappingState.compare_exchange_strong(expected, BufferMapState::Mapping, std::memory_order_acq_rel,
+                                              std::memory_order_acquire)) {
+    return;
+  }
+
+  g_stagingBuffers[currentStagingBuffer].MapAsync(
+      wgpu::MapMode::Write, 0, StagingBufferSize, wgpu::CallbackMode::AllowSpontaneous,
+      [](wgpu::MapAsyncStatus status, wgpu::StringView message) {
+        if (status == wgpu::MapAsyncStatus::CallbackCancelled || status == wgpu::MapAsyncStatus::Aborted) {
+          Log.warn("Buffer mapping {}: {}", magic_enum::enum_name(status), message);
+          s_mappingState.store(BufferMapState::Unmapped, std::memory_order_release);
+          return;
+        }
+        ASSERT(status == wgpu::MapAsyncStatus::Success, "Buffer mapping failed: {} {}", magic_enum::enum_name(status),
+               message);
+        s_mappingState.store(BufferMapState::Mapped, std::memory_order_release);
+      });
+}
+
+static bool begin_frame_impl(bool clearEfb) {
+  ZoneScoped;
+  {
+    ZoneScopedN("Wait for buffer map");
+    map_staging_buffer();
+    while (true) {
+      const auto mappingState = s_mappingState.load(std::memory_order_acquire);
+      if (mappingState == BufferMapState::Mapped) {
+        break;
+      }
+      if (mappingState == BufferMapState::Unmapped) {
+        // Frame begin failed because the staging map was aborted; the caller's retry loop drops the frame
+        // and any one-shot bakes recorded into it. Rate-limited.
+        static uint32_t s_beginFrameMapFailCount = 0;
+        if (s_beginFrameMapFailCount < 64 || (s_beginFrameMapFailCount & 255) == 0) {
+          Log.warn("begin_frame aborted: staging buffer unmapped (frame={} occurrences={})", g_frameIndex,
+                   s_beginFrameMapFailCount + 1);
+        }
+        ++s_beginFrameMapFailCount;
+        return false;
+      }
+      g_instance.ProcessEvents();
+    }
+  }
+  g_recordingSnapshotSlot = currentStagingBuffer;
+  size_t bufferOffset = 0;
+  const auto& stagingBuf = g_stagingBuffers[currentStagingBuffer];
+  const auto mapBuffer = [&](ByteBuffer& buf, uint64_t size) {
+    if (size <= 0) {
+      return;
+    }
+    buf = ByteBuffer{static_cast<u8*>(stagingBuf.GetMappedRange(bufferOffset, size)), static_cast<size_t>(size)};
+    bufferOffset += size;
+  };
+  mapBuffer(g_verts, VertexBufferSize);
+  mapBuffer(g_uniforms, UniformBufferSize);
+  mapBuffer(g_indices, IndexBufferSize);
+  mapBuffer(g_storage, StorageBufferSize);
+  if constexpr (UseTextureBuffer) {
+    mapBuffer(g_textureUpload, TextureUploadSize);
+  }
+
+  g_drawCallCount = 0;
+  g_mergedDrawCallCount = 0;
+  if (clearEfb) {
+    gx::begin_frame_interpolation();
+  }
+  discard_suspended_efb_pass();
+  webgpu::clear_present_source_override();
+
+  push_render_pass(RenderPass{});
+  set_efb_targets(g_renderPasses[0]);
+  g_renderPasses[0].clearColorValue = gx::g_gxState.clearColor;
+  g_renderPasses[0].clearDepthValue = gx::clear_depth_value();
+  g_renderPasses[0].clearColor = clearEfb;
+  g_renderPasses[0].clearDepth = clearEfb;
+  g_currentRenderPass = 0;
+  // Refresh paired render viewport/scissor from logical state in case the FB size changed.
+  const auto mappedRenderState = gx::map_logical_render_state();
+  const bool renderStateChanged = gx::g_gxState.renderViewport != mappedRenderState.viewport ||
+                                  gx::g_gxState.renderScissor != mappedRenderState.scissor;
+  gx::g_gxState.renderViewport = mappedRenderState.viewport;
+  gx::g_gxState.renderScissor = mappedRenderState.scissor;
+  gx::g_gxState.stateDirty = gx::g_gxState.stateDirty || renderStateChanged;
+  g_cachedViewport = mappedRenderState.viewport;
+  g_cachedScissor = mappedRenderState.scissor;
+  push_command(CommandType::SetViewport, Command::Data{.setViewport = g_cachedViewport});
+  push_command(CommandType::SetScissor, Command::Data{.setScissor = g_cachedScissor});
+  begin_pipeline_frame();
+  return true;
+}
+
+bool begin_frame() { return begin_frame_impl(true); }
+
+bool resume_frame() { return begin_frame_impl(false); }
+
+void abort_frame() noexcept {
+  efb_ram::cancel();
+  efb_ram::abort_async();
+  g_verts.release();
+  g_uniforms.release();
+  g_indices.release();
+  g_storage.release();
+  if constexpr (UseTextureBuffer) {
+    g_textureUploads.clear();
+    g_textureUpload.release();
+  }
+  if (s_mappingState.load(std::memory_order_acquire) == BufferMapState::Mapped) {
+    // Pending interpolation tasks hold raw pointers into the mapped staging
+    // range; they must be dropped before the buffer is unmapped and rotated.
+    gx::drop_pending_frame_interpolation_uniforms();
+    g_stagingBuffers[currentStagingBuffer].Unmap();
+    s_mappingState.store(BufferMapState::Unmapped, std::memory_order_release);
+    currentStagingBuffer = (currentStagingBuffer + 1) % g_stagingBuffers.size();
+    map_staging_buffer();
+  }
+  recycle_render_passes(g_renderPasses);
+  g_currentRenderPass = UINT32_MAX;
+  discard_suspended_efb_pass();
+  g_inOffscreen = false;
+  for (auto& array : gx::g_gxState.arrays) {
+    array.cachedRange = {};
+  }
+  webgpu::clear_present_source_override();
+  end_pipeline_frame();
+}
+
+static void end_batch_impl(const wgpu::CommandEncoder& cmd, bool advanceFrame) {
+  ZoneScoped;
+  ASSERT(!g_inOffscreen, "end_frame called while offscreen rendering is active");
+  if (advanceFrame) {
+    gx::finalize_frame_interpolation();
+  } else {
+    // Mid-frame batch split: the staging buffer is about to be unmapped and rotated, so pending
+    // interpolation tasks pointing into it would dangle. Tie the clear to the rotation itself.
+    gx::drop_pending_frame_interpolation_uniforms();
+  }
+  g_uniforms.append_zeroes(gx::MaxUniformSize); // Pad the end of the buffer
+  uint64_t bufferOffset = 0;
+  const auto writeBuffer = [&](ByteBuffer& buf, wgpu::Buffer& out, uint64_t size, std::string_view label) {
+    const auto writeSize = buf.size(); // Only need to copy this many bytes
+    if (writeSize > 0) {
+      cmd.CopyBufferToBuffer(g_stagingBuffers[currentStagingBuffer], bufferOffset, out, 0, AURORA_ALIGN(writeSize, 4));
+      buf.release();
+    }
+    bufferOffset += size;
+    return writeSize;
+  };
+  g_stagingBuffers[currentStagingBuffer].Unmap();
+  s_mappingState.store(BufferMapState::Unmapped, std::memory_order_release);
+  g_stats.drawCallCount = g_drawCallCount;
+  g_stats.mergedDrawCallCount = g_mergedDrawCallCount;
+  g_stats.lastVertSize = writeBuffer(g_verts, g_vertexBuffer, VertexBufferSize, "Vertex");
+  g_stats.lastUniformSize = writeBuffer(g_uniforms, g_uniformBuffer, UniformBufferSize, "Uniform");
+  g_stats.lastIndexSize = writeBuffer(g_indices, g_indexBuffer, IndexBufferSize, "Index");
+  g_stats.lastStorageSize = writeBuffer(g_storage, g_storageBuffer, StorageBufferSize, "Storage");
+  if constexpr (UseTextureBuffer) {
+    g_stats.lastTextureUploadSize = g_textureUpload.size();
+    {
+      // Perform texture copies
+      for (const auto& item : g_textureUploads) {
+        const wgpu::TexelCopyBufferInfo buf{
+            .layout =
+                wgpu::TexelCopyBufferLayout{
+                    .offset = item.layout.offset + bufferOffset,
+                    .bytesPerRow = AURORA_ALIGN(item.layout.bytesPerRow, 256),
+                    .rowsPerImage = item.layout.rowsPerImage,
+                },
+            .buffer = g_stagingBuffers[currentStagingBuffer],
+        };
+        cmd.CopyBufferToTexture(&buf, &item.tex, &item.size);
+      }
+      g_textureUploads.clear();
+      g_textureUpload.release();
+    }
+  }
+  currentStagingBuffer = (currentStagingBuffer + 1) % g_stagingBuffers.size();
+  map_staging_buffer();
+  g_currentRenderPass = UINT32_MAX;
+  for (auto& array : gx::g_gxState.arrays) {
+    array.cachedRange = {};
+  }
+  end_pipeline_frame();
+  if (advanceFrame) {
+    ++g_frameIndex;
+  }
+}
+
+void end_frame(const wgpu::CommandEncoder& cmd) { end_batch_impl(cmd, true); }
+
+void end_batch(const wgpu::CommandEncoder& cmd) { end_batch_impl(cmd, false); }
+
+uint32_t current_frame() noexcept { return g_frameIndex; }
+
+// The only place that erases from g_cachedBindGroups, whose handles the frame being encoded still
+// holds, so it runs in the seal prologue with the renderer mutex held and the producer excluded.
+void expire_bind_group_cache() noexcept {
+  if (g_cachedBindGroups.empty() || g_frameIndex == UINT32_MAX || g_frameIndex % BindGroupCacheSweepPeriod != 0) {
+    return;
+  }
+
+  ZoneScoped;
+  for (auto it = g_cachedBindGroups.begin(); it != g_cachedBindGroups.end();) {
+    if (g_frameIndex - it->second.lastUsedFrame > BindGroupCacheRetainFrames) {
+      g_cachedBindGroups.erase(it++);
+    } else {
+      ++it;
+    }
+  }
+}
+
+// Debug labels for the render passes. Formatting them per pass per slot costs a heap-allocating
+// fmt::format for a name nothing reads outside a capture.
+static const char* render_pass_label(u32 index) noexcept {
+  static constexpr std::array<const char*, 16> kRenderPassLabels{
+      "Render pass 0",  "Render pass 1",  "Render pass 2",  "Render pass 3",
+      "Render pass 4",  "Render pass 5",  "Render pass 6",  "Render pass 7",
+      "Render pass 8",  "Render pass 9",  "Render pass 10", "Render pass 11",
+      "Render pass 12", "Render pass 13", "Render pass 14", "Render pass 15",
+  };
+  return index < kRenderPassLabels.size() ? kRenderPassLabels[index] : "Render pass";
+}
+
+static void render_pass_impl(const wgpu::RenderPassEncoder& pass, const std::vector<RenderPass>& passes, u32 idx,
+                             int32_t interpolatedFrame);
+
+static void render_impl(std::vector<RenderPass>& renderPasses, wgpu::CommandEncoder& cmd, int32_t interpolatedFrame,
+                        bool finalize) {
+  ZoneScoped;
+  // Palette conversions, MSAA resolves and EFB copies depend on sealed frame state, not on the
+  // interpolation weight, so encode them on the native render and let replay slots sample them.
+  const bool encodeTextureBakes = interpolatedFrame < 0;
+  for (u32 i = 0; i < renderPasses.size(); ++i) {
+    const auto& passInfo = renderPasses[i];
+    if (encodeTextureBakes) {
+      for (const auto& conv : passInfo.paletteConvs) {
+        tex_palette_conv::run(cmd, conv);
+      }
+    }
+    const bool hasRenderWork = passInfo.clearColor || passInfo.clearDepth || !passInfo.commands.empty();
+    if (i == renderPasses.size() - 1) {
+      ASSERT(!passInfo.resolveTarget, "Final render pass must not have resolve target");
+    } else if (!(passInfo.resolveTarget && encodeTextureBakes) && !hasRenderWork) {
+      // Skip only empty intermediate passes: offscreen and scratch passes with resolves still have to
+      // run for later samplers, and on a replay slot a resolve-only pass has nothing to encode.
+      continue;
+    }
+
+    const std::array attachments{
+        wgpu::RenderPassColorAttachment{
+            .view = passInfo.colorView,
+            .resolveTarget = passInfo.resolveView,
+            .loadOp = passInfo.clearColor ? wgpu::LoadOp::Clear : wgpu::LoadOp::Load,
+            .storeOp = wgpu::StoreOp::Store,
+            .clearValue =
+                {
+                    .r = passInfo.clearColorValue.x(),
+                    .g = passInfo.clearColorValue.y(),
+                    .b = passInfo.clearColorValue.z(),
+                    .a = passInfo.clearColorValue.w(),
+                },
+        },
+    };
+    const wgpu::RenderPassDepthStencilAttachment depthStencilAttachment{
+        .view = passInfo.depthView,
+        .depthLoadOp = passInfo.clearDepth ? wgpu::LoadOp::Clear : wgpu::LoadOp::Load,
+        .depthStoreOp = wgpu::StoreOp::Store,
+        .depthClearValue = passInfo.clearDepthValue,
+    };
+    const wgpu::RenderPassDescriptor renderPassDescriptor{
+        .label = render_pass_label(i),
+        .colorAttachmentCount = attachments.size(),
+        .colorAttachments = attachments.data(),
+        .depthStencilAttachment = &depthStencilAttachment,
+    };
+
+    auto pass = cmd.BeginRenderPass(&renderPassDescriptor);
+    render_pass_impl(pass, renderPasses, i, interpolatedFrame);
+    pass.End();
+
+    if (finalize && i == renderPasses.size() - 1) {
+      depth_peek::encode_frame_snapshot(cmd, passInfo.copySourceDepthView, passInfo.targetSize, passInfo.msaaSamples);
+    }
+
+    if (passInfo.resolveTarget) {
+      const bool isDepth = gx::is_depth_format(passInfo.resolveFormat);
+      wgpu::Texture resolveSourceTexture = passInfo.copySourceTexture;
+      wgpu::TextureView resolveSourceView = isDepth ? passInfo.copySourceDepthView : passInfo.copySourceView;
+      if (passInfo.snapshotColorResolveSource && passInfo.resolveSourceSnapshot) {
+        const wgpu::TexelCopyTextureInfo src{
+            .texture = passInfo.copySourceTexture,
+            .origin = wgpu::Origin3D{
+                .x = static_cast<uint32_t>(passInfo.resolveSnapshotRect.x),
+                .y = static_cast<uint32_t>(passInfo.resolveSnapshotRect.y),
+            },
+        };
+        const wgpu::TexelCopyTextureInfo dst{
+            .texture = passInfo.resolveSourceSnapshot->texture,
+        };
+        const wgpu::Extent3D size{
+            .width = static_cast<uint32_t>(passInfo.resolveSnapshotRect.width),
+            .height = static_cast<uint32_t>(passInfo.resolveSnapshotRect.height),
+            .depthOrArrayLayers = 1,
+        };
+        cmd.CopyTextureToTexture(&src, &dst, &size);
+        resolveSourceTexture = passInfo.resolveSourceSnapshot->texture;
+        resolveSourceView = passInfo.resolveSourceSnapshot->sampleTextureView;
+      }
+      if (isDepth && passInfo.msaaSamples > 1) {
+        Log.fatal("Depth tex copies from multisampled EFB targets are not supported");
+      }
+      const tex_copy_conv::ConvRequest convReq{
+          .fmt = passInfo.resolveFormat,
+          .srcView = resolveSourceView,
+          .uniformRange = passInfo.resolveUniformRange,
+          .dst = passInfo.resolveTarget,
+          .sampleFilter = passInfo.resolveLinearSampling
+                              ? tex_copy_conv::SampleFilter::Linear
+                              : tex_copy_conv::SampleFilter::Nearest,
+          .forceOpaqueAlpha = passInfo.resolveForceOpaqueAlpha,
+      };
+      if (passInfo.resolveNeedsConversion) {
+        tex_copy_conv::run(cmd, convReq);
+      } else if (passInfo.resolveNeedsShaderSampling) {
+        tex_copy_conv::blit(cmd, convReq);
+      } else {
+        const wgpu::TexelCopyTextureInfo src{
+            .texture = resolveSourceTexture,
+            .origin =
+                wgpu::Origin3D{
+                    .x = static_cast<uint32_t>(passInfo.resolveRect.x -
+                                               (passInfo.snapshotColorResolveSource
+                                                    ? passInfo.resolveSnapshotRect.x : 0)),
+                    .y = static_cast<uint32_t>(passInfo.resolveRect.y -
+                                               (passInfo.snapshotColorResolveSource
+                                                    ? passInfo.resolveSnapshotRect.y : 0)),
+                },
+        };
+        const wgpu::TexelCopyTextureInfo dst{
+            .texture = passInfo.resolveTarget->texture,
+        };
+        const wgpu::Extent3D size{
+            .width = static_cast<uint32_t>(passInfo.resolveRect.width),
+            .height = static_cast<uint32_t>(passInfo.resolveRect.height),
+            .depthOrArrayLayers = 1,
+        };
+        cmd.CopyTextureToTexture(&src, &dst, &size);
+      }
+    }
+  }
+  if (finalize) {
+    recycle_render_passes(renderPasses);
+  }
+
+#if defined(AURORA_GFX_DEBUG_GROUPS)
+  if (finalize && !g_debugGroupStack.empty()) {
+    for (auto& it : std::ranges::reverse_view(g_debugGroupStack)) {
+      Log.warn("Debug group was not popped at end of frame: {}", it);
+    }
+    g_debugGroupStack.clear();
+  }
+
+  if (finalize && g_debugMarkers.size() > 0) {
+    g_debugMarkers.clear();
+  }
+#endif
+}
+
+void seal_frame(SealedFrame& out) noexcept {
+  ZoneScoped;
+  // The encode that could still have been holding these has completed: the
+  // producer joins the worker's DONE phase before it seals another frame.
+  g_retiredBindGroups.clear();
+  auto& passes = out.data().passes;
+  // The previous cycle already recycled these, so this normally just hands the empty vector, its
+  // capacity included, back to the producer.
+  recycle_render_passes(passes);
+  passes.swap(g_renderPasses);
+  g_currentRenderPass = UINT32_MAX;
+}
+
+void render(SealedFrame& frame, wgpu::CommandEncoder& cmd, int32_t interpolatedFrame, bool finalize) {
+  render_impl(frame.data().passes, cmd, interpolatedFrame, finalize);
+}
+
+void render(wgpu::CommandEncoder& cmd, int32_t interpolatedFrame, bool finalize) {
+  render_impl(g_renderPasses, cmd, interpolatedFrame, finalize);
+  if (finalize) {
+    g_currentRenderPass = UINT32_MAX;
+    expire_bind_group_cache();
+  }
+}
+
+void after_submit() noexcept {
+  depth_peek::after_submit();
+  efb_ram::after_submit();
+  // Retire this frame's completed GPU work. Dawn only reclaims destroyed resources inside a device
+  // tick, and a frame that never ticks keeps every released image and its memory for the run.
+  if (g_instance) {
+    g_instance.ProcessEvents();
+  }
+}
+
+static void render_pass_impl(const wgpu::RenderPassEncoder& pass, const std::vector<RenderPass>& renderPasses, u32 idx,
+                             int32_t interpolatedFrame) {
+  // Per-invocation, not per-process: two encoders can be recording at once.
+  gx::DrawEncodeState encodeState{};
+  encodeState.boundTextureBindGroup = gx::g_emptyTextureBindGroup.Get();
+#ifdef AURORA_GFX_DEBUG_GROUPS
+  std::vector<std::string> lastDebugGroupStack;
+#endif
+
+  // Bind static bind group for the whole pass
+  pass.SetBindGroup(0, g_staticBindGroup);
+  pass.SetBindGroup(2, gx::g_emptyTextureBindGroup);
+
+  for (const auto& cmd : renderPasses[idx].commands) {
+#ifdef AURORA_GFX_DEBUG_GROUPS
+    {
+      size_t firstDiff = lastDebugGroupStack.size();
+      for (size_t i = 0; i < lastDebugGroupStack.size(); ++i) {
+        if (i >= cmd.debugGroupStack.size() || cmd.debugGroupStack[i] != lastDebugGroupStack[i]) {
+          firstDiff = i;
+          break;
+        }
+      }
+      for (size_t i = firstDiff; i < lastDebugGroupStack.size(); ++i) {
+        pass.PopDebugGroup();
+      }
+      for (size_t i = firstDiff; i < cmd.debugGroupStack.size(); ++i) {
+        pass.PushDebugGroup(cmd.debugGroupStack[i].c_str());
+      }
+      lastDebugGroupStack = cmd.debugGroupStack;
+    }
+#endif
+    switch (cmd.type) {
+    case CommandType::SetViewport: {
+      const auto& vp = cmd.data.setViewport;
+      // WebGPU requires 0 <= minDepth <= maxDepth <= 1, and the guest's (near, far) order is already
+      // reproduced in clip space. Passing the raw swapped pair diverged per backend in release builds.
+      const float minDepth = std::clamp(std::min(vp.znear, vp.zfar), 0.0f, 1.0f);
+      const float maxDepth = std::clamp(std::max(vp.znear, vp.zfar), 0.0f, 1.0f);
+      pass.SetViewport(vp.left, vp.top, vp.width, vp.height, minDepth, maxDepth);
+    } break;
+    case CommandType::SetScissor: {
+      const auto& sc = cmd.data.setScissor;
+      const auto& size = renderPasses[idx].targetSize;
+      const auto left = std::clamp(sc.x, 0, static_cast<int32_t>(size.width));
+      const auto top = std::clamp(sc.y, 0, static_cast<int32_t>(size.height));
+      const auto right =
+          std::clamp(sc.x + sc.width, left, static_cast<int32_t>(size.width));
+      const auto bottom =
+          std::clamp(sc.y + sc.height, top, static_cast<int32_t>(size.height));
+      pass.SetScissorRect(static_cast<uint32_t>(left), static_cast<uint32_t>(top),
+                          static_cast<uint32_t>(right - left), static_cast<uint32_t>(bottom - top));
+    } break;
+    case CommandType::Draw: {
+      const auto& draw = cmd.data.draw;
+      switch (draw.type) {
+      case ShaderType::GX: {
+        const gfx::Range* uniformOverride = nullptr;
+        if (interpolatedFrame >= 0 &&
+            static_cast<size_t>(interpolatedFrame) < draw.gx.interpolatedUniformRanges.size() &&
+            draw.gx.interpolatedUniformRanges[interpolatedFrame].size != 0) {
+          uniformOverride = &draw.gx.interpolatedUniformRanges[interpolatedFrame];
+        }
+        gx::render(draw.gx, pass, encodeState, renderPasses[idx].requireReadyPipelines, uniformOverride);
+      } break;
+      case ShaderType::Clear:
+        clear::render(draw.clear, pass, renderPasses[idx].targetSize, encodeState.currentPipeline);
+        break;
+      }
+    } break;
+    case CommandType::DebugMarker: {
+#if defined(AURORA_GFX_DEBUG_GROUPS)
+      pass.InsertDebugMarker(wgpu::StringView(g_debugMarkers[cmd.data.debugMarkerIndex]));
+#endif
+    } break;
+    }
+  }
+
+#ifdef AURORA_GFX_DEBUG_GROUPS
+  for (size_t i = 0; i < lastDebugGroupStack.size(); ++i) {
+    pass.PopDebugGroup();
+  }
+#endif
+}
+
+bool bind_pipeline(PipelineRef ref, const wgpu::RenderPassEncoder& pass, PipelineRef& currentPipeline,
+                   bool requireReady) {
+  if (ref == currentPipeline) {
+    return true;
+  }
+  wgpu::RenderPipeline pipeline;
+  bool pipelineReady;
+  if (!skip_unready_pipelines()) {
+    pipelineReady = wait_pipeline(ref, pipeline);
+  } else if (requireReady) {
+    // The pass resolves into a persistent texture (a one-shot bake such as MKW's minimap), so a
+    // skipped draw would never be re-issued. These run behind loads, not mid-race.
+    pipelineReady = wait_pipeline_for_persistent_pass(ref, pipeline);
+  } else {
+    pipelineReady = try_pipeline(ref, pipeline);
+  }
+  if (!pipelineReady) {
+    return false;
+  }
+  pass.SetPipeline(pipeline);
+  currentPipeline = ref;
+  return true;
+}
+
+static inline Range push(ByteBuffer& target, const uint8_t* data, size_t length, size_t alignment) {
+  size_t padding = 0;
+  if (alignment != 0) {
+    const size_t remainder = length % alignment;
+    if (remainder != 0) {
+      padding = alignment - remainder;
+    }
+  }
+  auto begin = target.size();
+  if (length == 0) {
+    length = alignment;
+    target.append_zeroes(alignment);
+  } else {
+    target.append(data, length);
+    if (padding > 0) {
+      target.append_zeroes(padding);
+    }
+  }
+  return {static_cast<uint32_t>(begin), static_cast<uint32_t>(length + padding)};
+}
+static inline Range map(ByteBuffer& target, size_t length, size_t alignment) {
+  size_t padding = 0;
+  if (alignment != 0) {
+    const size_t remainder = length % alignment;
+    if (remainder != 0) {
+      padding = alignment - remainder;
+    }
+  }
+  auto begin = target.size();
+  if (length == 0) {
+    length = alignment;
+    target.append_zeroes(length);
+  } else {
+    // The caller fills [0, length); only the alignment padding needs clearing,
+    // otherwise it hands the next frame's readers whatever was there before.
+    target.append_uninitialized(length);
+    target.append_zeroes(padding);
+  }
+  return {static_cast<uint32_t>(begin), static_cast<uint32_t>(length + padding)};
+}
+Range push_verts(const uint8_t* data, size_t length) { return push(g_verts, data, length, 0); }
+Range push_indices(const uint8_t* data, size_t length) { return push(g_indices, data, length, 0); }
+Range push_uniform(const uint8_t* data, size_t length) {
+  return push(g_uniforms, data, length, g_cachedLimits.minUniformBufferOffsetAlignment);
+}
+Range push_storage(const uint8_t* data, size_t length) {
+  return push(g_storage, data, length, g_cachedLimits.minStorageBufferOffsetAlignment);
+}
+Range push_texture_data(const uint8_t* data, size_t length, u32 bytesPerRow, u32 rowsPerImage) {
+  // For CopyBufferToTexture, we need an alignment of 256 per row (see Dawn kTextureBytesPerRowAlignment)
+  const auto copyBytesPerRow = AURORA_ALIGN(bytesPerRow, 256);
+  const auto range = map(g_textureUpload, copyBytesPerRow * rowsPerImage, 0);
+  u8* dst = g_textureUpload.data() + range.offset;
+  for (u32 i = 0; i < rowsPerImage; ++i) {
+    memcpy(dst, data, bytesPerRow);
+    data += bytesPerRow;
+    dst += copyBytesPerRow;
+  }
+  return range;
+}
+std::pair<ByteBuffer, Range> map_verts(size_t length) {
+  const auto range = map(g_verts, length, 4);
+  return {ByteBuffer{g_verts.data() + range.offset, range.size}, range};
+}
+std::pair<ByteBuffer, Range> map_indices(size_t length) {
+  const auto range = map(g_indices, length, 4);
+  return {ByteBuffer{g_indices.data() + range.offset, range.size}, range};
+}
+std::pair<ByteBuffer, Range> map_uniform(size_t length) {
+  const auto range = map(g_uniforms, length, g_cachedLimits.minUniformBufferOffsetAlignment);
+  return {ByteBuffer{g_uniforms.data() + range.offset, range.size}, range};
+}
+std::pair<ByteBuffer, Range> copy_uniform(Range source) {
+  const auto destination = map(g_uniforms, source.size, g_cachedLimits.minUniformBufferOffsetAlignment);
+  std::memcpy(g_uniforms.data() + destination.offset, g_uniforms.data() + source.offset, source.size);
+  return {ByteBuffer{g_uniforms.data() + destination.offset, destination.size}, destination};
+}
+std::pair<ByteBuffer, Range> map_storage(size_t length) {
+  const auto range = map(g_storage, length, g_cachedLimits.minStorageBufferOffsetAlignment);
+  return {ByteBuffer{g_storage.data() + range.offset, range.size}, range};
+}
+
+BindGroupRef bind_group_ref(const WGPUBindGroupDescriptor& descriptor) {
+  const auto id = xxh3_hash(descriptor);
+  const auto it = g_cachedBindGroups.find(id);
+  if (it == g_cachedBindGroups.end()) {
+    auto bg = wgpu::BindGroup::Acquire(wgpuDeviceCreateBindGroup(g_device.Get(), &descriptor));
+    g_cachedBindGroups.emplace(id, CachedBindGroup{
+                                       .bindGroup = std::move(bg),
+                                       .lastUsedFrame = g_frameIndex,
+                                   });
+  } else {
+    it->second.lastUsedFrame = g_frameIndex;
+  }
+  return id;
+}
+
+wgpu::BindGroup& find_bind_group(BindGroupRef id) {
+  const auto it = g_cachedBindGroups.find(id);
+  CHECK(it != g_cachedBindGroups.end(), "get_bind_group: failed to locate {:x}", id);
+  return it->second.bindGroup;
+}
+
+wgpu::Sampler& sampler_ref(const wgpu::SamplerDescriptor& descriptor) {
+  const auto id = xxh3_hash(descriptor);
+  auto it = g_cachedSamplers.find(id);
+  if (it == g_cachedSamplers.end()) {
+    it = g_cachedSamplers.try_emplace(id, g_device.CreateSampler(&descriptor)).first;
+  }
+  return it->second;
+}
+
+uint32_t align_uniform(uint32_t value) { return AURORA_ALIGN(value, g_cachedLimits.minUniformBufferOffsetAlignment); }
+
+void insert_debug_marker(std::string label) {
+#if defined(AURORA_GFX_DEBUG_GROUPS)
+  auto idx = g_debugMarkers.size();
+  g_debugMarkers.emplace_back(std::move(label));
+  push_command(CommandType::DebugMarker, {.debugMarkerIndex = idx});
+#endif
+}
+
+} // namespace aurora::gfx
+
+void aurora::gfx::push_debug_group(std::string label) {
+#if defined(AURORA_GFX_DEBUG_GROUPS)
+  g_debugGroupStack.push_back(std::move(label));
+#endif
+}
+void aurora_push_debug_group(const char* label) {
+#ifdef AURORA_GFX_DEBUG_GROUPS
+  aurora::gfx::g_debugGroupStack.emplace_back(label);
+#endif
+}
+void aurora_pop_debug_group() {
+#ifdef AURORA_GFX_DEBUG_GROUPS
+  if (aurora::gfx::g_debugGroupStack.empty()) {
+    aurora::gfx::Log.error("Debug group stack underflowed!");
+    return;
+  }
+
+  aurora::gfx::g_debugGroupStack.pop_back();
+#endif
+}
+
+const AuroraStats* aurora_get_stats() { return &aurora::gfx::g_stats; }
diff --git a/aurora-main/lib/gfx/common.hpp b/aurora-main/lib/gfx/common.hpp
new file mode 100644
index 0000000..e0a24a3
--- /dev/null
+++ b/aurora-main/lib/gfx/common.hpp
@@ -0,0 +1,407 @@
+#pragma once
+
+#include "../internal.hpp"
+#include "../webgpu/gpu.hpp"
+
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <array>
+#include <memory>
+#include <type_traits>
+#include <utility>
+
+#include <aurora/gfx.h>
+#include <aurora/math.hpp>
+#include <dolphin/gx/GXEnum.h>
+#include <webgpu/webgpu_cpp.h>
+#define XXH_STATIC_LINKING_ONLY
+#include <xxhash.h>
+
+namespace aurora {
+#if INTPTR_MAX == INT32_MAX
+using HashType = XXH32_hash_t;
+#else
+using HashType = XXH64_hash_t;
+#endif
+static inline HashType xxh3_hash_s(const void* input, size_t len, HashType seed = 0) {
+  return static_cast<HashType>(XXH3_64bits_withSeed(input, len, seed));
+}
+template <typename T>
+static inline HashType xxh3_hash(const T& input, HashType seed = 0) {
+  // Validate that the type has no padding bytes, which can easily cause
+  // hash mismatches. This also disallows floats, but that's okay for us.
+  static_assert(std::has_unique_object_representations_v<T>);
+  return xxh3_hash_s(&input, sizeof(T), seed);
+}
+
+// Folds two 64-bit hashes. Chaining them instead drops XXH3 onto its seeded long path past 240
+// bytes, and that path regenerates a 192-byte secret on every call.
+static inline HashType hash_combine(HashType lhs, HashType rhs) {
+  uint64_t mixed = static_cast<uint64_t>(lhs) ^ (static_cast<uint64_t>(rhs) + 0x9E3779B97F4A7C15ull +
+                                                 (static_cast<uint64_t>(lhs) << 6) + (static_cast<uint64_t>(lhs) >> 2));
+  mixed ^= mixed >> 33;
+  mixed *= 0xFF51AFD7ED558CCDull;
+  mixed ^= mixed >> 29;
+  return static_cast<HashType>(mixed);
+}
+
+// Guest-RAM write tracking hooks (see aurora_set_guest_write_hooks). A digest samples the
+// generation before reading the bytes, so a racing write costs an extra digest, never a skipped one.
+inline constexpr uint64_t kGuestWriteUntracked = AURORA_GUEST_WRITE_UNTRACKED;
+inline AuroraGuestWriteGenerationCallback g_guestWriteGenerationHook = nullptr;
+inline AuroraGuestWriteNotifyCallback g_guestWriteNotifyHook = nullptr;
+
+inline uint64_t guest_write_generation(const void* data, size_t size) noexcept {
+  if (g_guestWriteGenerationHook == nullptr || data == nullptr || size == 0) {
+    return kGuestWriteUntracked;
+  }
+  return g_guestWriteGenerationHook(data, size);
+}
+
+inline void notify_guest_write(const void* data, size_t size) noexcept {
+  if (g_guestWriteNotifyHook == nullptr || data == nullptr || size == 0) {
+    return;
+  }
+  g_guestWriteNotifyHook(data, size);
+}
+
+// True when `stored` was taken over the same untouched bytes, so its digest still describes them.
+// The untracked sentinel never matches: a source aurora cannot watch is always re-digested.
+inline bool guest_write_generation_matches(uint64_t stored, uint64_t current) noexcept {
+  return current != kGuestWriteUntracked && stored == current;
+}
+
+class Hasher {
+public:
+  explicit Hasher(const XXH64_hash_t seed = 0) {
+    XXH3_INITSTATE(&state);
+    XXH3_64bits_reset_withSeed(&state, seed);
+  }
+
+  void update(const void* data, const size_t size) { XXH3_64bits_update(&state, data, size); }
+
+  template <typename T>
+  void update(const T& data) {
+    static_assert(std::has_unique_object_representations_v<T>);
+    update(&data, sizeof(T));
+  }
+
+  [[nodiscard]] XXH64_hash_t digest() const { return XXH3_64bits_digest(&state); }
+
+private:
+  XXH3_state_t state;
+};
+
+class ByteBuffer {
+public:
+  ByteBuffer() noexcept = default;
+  explicit ByteBuffer(size_t size) noexcept
+  : m_data(static_cast<uint8_t*>(calloc(1, size))), m_length(size), m_capacity(size) {}
+  explicit ByteBuffer(uint8_t* data, size_t size) noexcept : m_data(data), m_capacity(size), m_owned(false) {}
+  ~ByteBuffer() noexcept {
+    if (m_data != nullptr && m_owned) {
+      free(m_data);
+    }
+  }
+  ByteBuffer(ByteBuffer&& rhs) noexcept
+  : m_data(rhs.m_data), m_length(rhs.m_length), m_capacity(rhs.m_capacity), m_owned(rhs.m_owned) {
+    rhs.m_data = nullptr;
+    rhs.m_length = 0;
+    rhs.m_capacity = 0;
+    rhs.m_owned = true;
+  }
+  ByteBuffer& operator=(ByteBuffer&& rhs) noexcept {
+    if (m_data != nullptr && m_owned) {
+      free(m_data);
+    }
+    m_data = rhs.m_data;
+    m_length = rhs.m_length;
+    m_capacity = rhs.m_capacity;
+    m_owned = rhs.m_owned;
+    rhs.m_data = nullptr;
+    rhs.m_length = 0;
+    rhs.m_capacity = 0;
+    rhs.m_owned = true;
+    return *this;
+  }
+  ByteBuffer(ByteBuffer const&) = delete;
+  ByteBuffer& operator=(ByteBuffer const&) = delete;
+  operator ArrayRef<uint8_t>() const noexcept { return {m_data, m_length}; }
+
+  [[nodiscard]] uint8_t* data() noexcept { return m_data; }
+  [[nodiscard]] const uint8_t* data() const noexcept { return m_data; }
+  [[nodiscard]] size_t size() const noexcept { return m_length; }
+  [[nodiscard]] bool empty() const noexcept { return m_length == 0; }
+
+  void append(const void* data, size_t size) {
+    resize(m_length + size, false);
+    memcpy(m_data + m_length, data, size);
+    m_length += size;
+  }
+
+  template <typename T>
+  void append(const T& obj) {
+    append(&obj, sizeof(T));
+  }
+
+  void append_zeroes(size_t size) {
+    resize(m_length + size, true);
+    m_length += size;
+  }
+
+  // Extend the buffer without clearing the new bytes. Only for callers that overwrite the whole
+  // region: the mapped staging buffers are megabytes of write-combine memory.
+  void append_uninitialized(size_t size) {
+    resize(m_length + size, false);
+    m_length += size;
+  }
+
+  void release() {
+    if (m_data != nullptr && m_owned) {
+      free(m_data);
+    }
+    m_data = nullptr;
+    m_length = 0;
+    m_capacity = 0;
+    m_owned = true;
+  }
+
+  void clear() {
+    m_length = 0;
+  }
+
+  void reserve_extra(size_t size) { resize(m_length + size, true); }
+
+  ByteBuffer clone() const {
+    ByteBuffer clone{m_length};
+    std::memcpy(clone.data(), m_data, m_length);
+    return clone;
+  }
+
+private:
+  uint8_t* m_data = nullptr;
+  size_t m_length = 0;
+  size_t m_capacity = 0;
+  bool m_owned = true;
+
+  // `size` is the total capacity needed. When `zeroed` is set, [m_length, size) has to read back as
+  // zero on every branch; the early return used to leave the previous frame's bytes in the padding.
+  void resize(size_t size, bool zeroed) {
+    if (size == 0) {
+      clear();
+      return;
+    }
+    const size_t zeroBegin = m_length;
+    if (m_data == nullptr) {
+      if (zeroed) {
+        m_data = static_cast<uint8_t*>(calloc(1, size));
+      } else {
+        m_data = static_cast<uint8_t*>(malloc(size));
+      }
+      m_owned = true;
+      m_capacity = size;
+      // calloc already cleared the whole allocation.
+      return;
+    }
+    if (size > m_capacity) {
+      if (!m_owned) {
+        abort();
+      }
+      // Exponential expansion to avoid O(n^2) time complexity.
+      size_t capacity = size;
+      if (capacity < m_capacity * 2) {
+        capacity = m_capacity * 2;
+      }
+      m_data = static_cast<uint8_t*>(realloc(m_data, capacity));
+      m_capacity = capacity;
+    }
+    if (zeroed && size > zeroBegin) {
+      memset(m_data + zeroBegin, 0, size - zeroBegin);
+    }
+  }
+};
+} // namespace aurora
+
+namespace aurora::gfx {
+inline constexpr bool UseTextureBuffer = false;
+inline constexpr uint64_t UniformBufferSize = 25165824;  // 24mb
+inline constexpr uint64_t VertexBufferSize = 3145728;    // 3mb
+inline constexpr uint64_t IndexBufferSize = 2097152;     // 2mb
+inline constexpr uint64_t StorageBufferSize = 8388608;   // 8mb
+inline constexpr uint64_t TextureUploadSize = 25165824;  // 24mb
+
+extern AuroraStats g_stats;
+extern uint32_t g_drawCallCount;
+extern uint32_t g_mergedDrawCallCount;
+extern wgpu::Buffer g_vertexBuffer;
+extern wgpu::Buffer g_uniformBuffer;
+extern wgpu::Buffer g_indexBuffer;
+extern wgpu::Buffer g_storageBuffer;
+extern wgpu::BindGroupLayout g_staticBindGroupLayout;
+extern wgpu::BindGroup g_staticBindGroup;
+extern wgpu::BindGroupLayout g_uniformBindGroupLayout;
+extern wgpu::BindGroup g_uniformBindGroup;
+
+using BindGroupRef = HashType;
+using PipelineRef = HashType;
+using SamplerRef = HashType;
+using ShaderRef = HashType;
+struct Range {
+  uint32_t offset = 0;
+  uint32_t size = 0;
+
+  bool operator==(const Range& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+  bool operator!=(const Range& rhs) const { return !(*this == rhs); }
+};
+
+struct ClipRect {
+  int32_t x;
+  int32_t y;
+  int32_t width;
+  int32_t height;
+
+  bool operator==(const ClipRect& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+  bool operator!=(const ClipRect& rhs) const { return !(*this == rhs); }
+};
+
+using webgpu::Viewport;
+
+struct TextureRef;
+using TextureHandle = std::shared_ptr<TextureRef>;
+
+enum class ShaderType : uint8_t {
+  Clear = 0,
+  GX = 1,
+};
+
+void initialize();
+void shutdown();
+
+bool begin_frame();
+bool resume_frame();
+void abort_frame() noexcept;
+void end_frame(const wgpu::CommandEncoder& cmd);
+void end_batch(const wgpu::CommandEncoder& cmd);
+uint32_t current_frame() noexcept;
+
+// One frame's recorded render passes, detached from the guest-visible
+// recording state. The contents are private to common.cpp.
+struct SealedFrameData;
+
+// Owns the recorded passes of a sealed frame, touched only by the thread that sealed it.
+// seal_frame() runs with the producer excluded, and the object is reused to keep its capacity.
+class SealedFrame {
+public:
+  SealedFrame();
+  ~SealedFrame();
+  SealedFrame(SealedFrame&&) noexcept;
+  SealedFrame& operator=(SealedFrame&&) noexcept;
+  SealedFrame(const SealedFrame&) = delete;
+  SealedFrame& operator=(const SealedFrame&) = delete;
+
+  [[nodiscard]] SealedFrameData& data() const noexcept { return *m_data; }
+
+private:
+  std::unique_ptr<SealedFrameData> m_data;
+};
+
+// Detach the recorded passes of the frame that just ended into `out`. Must be
+// called with the renderer GPU mutex held; see SealedFrame.
+void seal_frame(SealedFrame& out) noexcept;
+
+// Encode a sealed frame. Never touches the producer-visible recording state,
+// so this may run concurrently with the producer's FIFO drains.
+void render(SealedFrame& frame, wgpu::CommandEncoder& cmd, int32_t interpolatedFrame = -1, bool finalize = true);
+
+// Encode the frame that is still being recorded. Only for the synchronous
+// EFB-readback split path, which runs on the producer thread.
+void render(wgpu::CommandEncoder& cmd, int32_t interpolatedFrame = -1, bool finalize = true);
+
+// Sweep bind groups that have not been used for a while. Mutates the cache the producer inserts
+// into, so it may only run with the producer excluded, inside the seal prologue.
+void expire_bind_group_cache() noexcept;
+void after_submit() noexcept;
+void map_staging_buffer();
+// `persistentCopy` marks resolves whose destination outlives the frame with no re-issue path, so
+// the pass waits for its pipelines instead of dropping draws that would be baked in permanently.
+void resolve_pass(TextureHandle texture, ClipRect rect, bool clearColor, bool clearAlpha, bool clearDepth,
+                  Vec4<float> clearColorValue, float clearDepthValue, GXTexFmt resolveFormat = GX_TF_RGBA8,
+                  const Vec4<float>* sourceRectPixels = nullptr, bool halfScale = false,
+                  const std::array<u32, 3>* copyFilterCoefficients = nullptr, bool forceOpaqueAlpha = false,
+                  float copyFilterRowStride = 1.0f, bool clampTop = false, bool clampBottom = false,
+                  bool persistentCopy = false);
+
+void begin_offscreen(uint32_t width, uint32_t height);
+void end_offscreen();
+bool is_offscreen() noexcept;
+uint32_t get_sample_count() noexcept;
+void clear_caches() noexcept;
+
+namespace tex_palette_conv {
+struct ConvRequest;
+} // namespace tex_palette_conv
+void queue_palette_conv(tex_palette_conv::ConvRequest req);
+
+Range push_verts(const uint8_t* data, size_t length);
+template <typename T>
+static Range push_verts(ArrayRef<T> data) {
+  return push_verts(reinterpret_cast<const uint8_t*>(data.data()), data.size() * sizeof(T));
+}
+Range push_indices(const uint8_t* data, size_t length);
+template <typename T>
+static Range push_indices(ArrayRef<T> data) {
+  return push_indices(reinterpret_cast<const uint8_t*>(data.data()), data.size() * sizeof(T));
+}
+Range push_uniform(const uint8_t* data, size_t length);
+template <typename T>
+static Range push_uniform(const T& data) {
+  return push_uniform(reinterpret_cast<const uint8_t*>(&data), sizeof(T));
+}
+Range push_storage(const uint8_t* data, size_t length);
+template <typename T>
+static Range push_storage(ArrayRef<T> data) {
+  return push_storage(reinterpret_cast<const uint8_t*>(data.data()), data.size() * sizeof(T));
+}
+template <typename T>
+static Range push_storage(const T& data) {
+  return push_storage(reinterpret_cast<const uint8_t*>(&data), sizeof(T));
+}
+Range push_texture_data(const uint8_t* data, size_t length, uint32_t bytesPerRow, uint32_t rowsPerImage);
+std::pair<ByteBuffer, Range> map_verts(size_t length);
+std::pair<ByteBuffer, Range> map_indices(size_t length);
+std::pair<ByteBuffer, Range> map_uniform(size_t length);
+std::pair<ByteBuffer, Range> copy_uniform(Range source);
+std::pair<ByteBuffer, Range> map_storage(size_t length);
+
+template <typename State>
+const State& get_state();
+template <typename DrawData>
+void push_draw_command(DrawData data);
+template <typename DrawData>
+DrawData* get_last_draw_command();
+
+template <typename PipelineConfig>
+PipelineRef pipeline_ref(const PipelineConfig& config);
+// `currentPipeline` is the caller's per-pass dedupe slot; as a file-static, two concurrent encoders
+// skipped each other's SetPipeline. `requireReady` refuses the skip-unready shortcut for bakes.
+bool bind_pipeline(PipelineRef ref, const wgpu::RenderPassEncoder& pass, PipelineRef& currentPipeline,
+                   bool requireReady = false);
+
+BindGroupRef bind_group_ref(const WGPUBindGroupDescriptor& descriptor);
+wgpu::BindGroup& find_bind_group(BindGroupRef id);
+
+wgpu::Sampler& sampler_ref(const wgpu::SamplerDescriptor& descriptor);
+
+uint32_t align_uniform(uint32_t value);
+
+Vec2<uint32_t> get_render_target_size() noexcept;
+// Same value as get_render_target_size() outside a render pass, but never
+// touches the frame worker's render-pass list, so it is safe off-thread.
+Vec2<uint32_t> get_frame_buffer_size() noexcept;
+void set_viewport(const Viewport& viewport) noexcept;
+void set_scissor(const ClipRect& scissor) noexcept;
+
+void push_debug_group(std::string label);
+void insert_debug_marker(std::string label);
+} // namespace aurora::gfx
diff --git a/aurora-main/lib/gfx/dds_io.cpp b/aurora-main/lib/gfx/dds_io.cpp
new file mode 100644
index 0000000..84eecc2
--- /dev/null
+++ b/aurora-main/lib/gfx/dds_io.cpp
@@ -0,0 +1,256 @@
+#include "dds_io.hpp"
+
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+
+#include "texture.hpp"
+
+namespace aurora::gfx::dds {
+struct ParsedDDSLayout {
+  wgpu::TextureFormat format = wgpu::TextureFormat::Undefined;
+  size_t dataOffset = 0;
+};
+
+struct DDSPixelFormat {
+  uint32_t size;
+  uint32_t flags;
+  uint32_t fourCC;
+  uint32_t rgbBitCount;
+  uint32_t rBitMask;
+  uint32_t gBitMask;
+  uint32_t bBitMask;
+  uint32_t aBitMask;
+};
+static_assert(sizeof(DDSPixelFormat) == 32);
+
+struct DDSHeader {
+  uint32_t size;
+  uint32_t flags;
+  uint32_t height;
+  uint32_t width;
+  uint32_t pitchOrLinearSize;
+  uint32_t depth;
+  uint32_t mipMapCount;
+  uint32_t reserved1[11];
+  DDSPixelFormat ddspf;
+  uint32_t caps;
+  uint32_t caps2;
+  uint32_t caps3;
+  uint32_t caps4;
+  uint32_t reserved2;
+};
+static_assert(sizeof(DDSHeader) == 124);
+
+struct DDSHeaderDX10 {
+  uint32_t dxgiFormat;
+  uint32_t resourceDimension;
+  uint32_t miscFlag;
+  uint32_t arraySize;
+  uint32_t miscFlags2;
+};
+static_assert(sizeof(DDSHeaderDX10) == 20);
+
+constexpr uint32_t kDDSMagic = 0x20534444; // "DDS"
+
+bool ensure_directory(const std::filesystem::path& dir) noexcept {
+  std::error_code ec;
+  std::filesystem::create_directories(dir, ec);
+  return !ec;
+}
+
+bool write_binary_file(const std::filesystem::path& path, ArrayRef<uint8_t> data) noexcept {
+  if (!ensure_directory(path.parent_path())) {
+    return false;
+  }
+
+  std::ofstream out(path, std::ios::binary | std::ios::trunc);
+  if (!out) {
+    return false;
+  }
+
+  out.write(reinterpret_cast<const char*>(data.data()), data.size());
+  return static_cast<bool>(out);
+}
+
+std::optional<ByteBuffer> read_binary_file(const std::filesystem::path& path) noexcept {
+  std::ifstream file(path, std::ios::binary | std::ios::ate);
+  if (!file) {
+    return std::nullopt;
+  }
+
+  const auto size = static_cast<size_t>(file.tellg());
+  if (size == 0) {
+    return std::nullopt;
+  }
+
+  ByteBuffer bytes{size};
+  file.seekg(0, std::ios::beg);
+  file.read(reinterpret_cast<char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
+  if (!file) {
+    return std::nullopt;
+  }
+
+  return bytes;
+}
+
+bool validate_dds_header(const DDSHeader& header) noexcept {
+  if (header.size != sizeof(DDSHeader) || header.ddspf.size != sizeof(DDSPixelFormat)) {
+    return false;
+  }
+  if (header.width == 0 || header.height == 0) {
+    return false;
+  }
+  if ((header.caps2 & (0x00000200 | 0x00200000)) != 0) { // Unsupported
+    return false;
+  }
+  return true;
+}
+
+std::optional<wgpu::TextureFormat> resolve_dx10_format(uint32_t dxgiFormat) noexcept {
+  switch (dxgiFormat) {
+  case 28:
+    return wgpu::TextureFormat::RGBA8Unorm;
+  case 87:
+    return wgpu::TextureFormat::BGRA8Unorm;
+  case 71:
+    return wgpu::TextureFormat::BC1RGBAUnorm;
+  case 77:
+    return wgpu::TextureFormat::BC3RGBAUnorm;
+  case 83:
+    return wgpu::TextureFormat::BC5RGUnorm;
+  case 98:
+    return wgpu::TextureFormat::BC7RGBAUnorm;
+  default:
+    return std::nullopt;
+  }
+}
+
+std::optional<ParsedDDSLayout> resolve_dds_layout(ArrayRef<uint8_t> bytes, const DDSHeader& header) noexcept {
+  ParsedDDSLayout out{.dataOffset = sizeof(uint32_t) + sizeof(DDSHeader)};
+
+  if ((header.ddspf.flags & 0x00000004) != 0) { // DDS has FourCC
+    switch (header.ddspf.fourCC) {
+    case 0x31545844:
+      out.format = wgpu::TextureFormat::BC1RGBAUnorm;
+      return out;
+    case 0x35545844:
+      out.format = wgpu::TextureFormat::BC3RGBAUnorm;
+      return out;
+    case 0x32495441:
+      out.format = wgpu::TextureFormat::BC5RGUnorm;
+      return out;
+    case 0x30315844: {
+      if (bytes.size() < out.dataOffset + sizeof(DDSHeaderDX10)) {
+        return std::nullopt;
+      }
+      const auto* dx10 = reinterpret_cast<const DDSHeaderDX10*>(bytes.data() + out.dataOffset);
+      out.dataOffset += sizeof(DDSHeaderDX10);
+      if (dx10->resourceDimension != 3 || dx10->arraySize != 1) {
+        return std::nullopt;
+      }
+      const auto format = resolve_dx10_format(dx10->dxgiFormat);
+      if (!format.has_value()) {
+        return std::nullopt;
+      }
+      out.format = *format;
+      return out;
+    }
+    default:
+      return std::nullopt;
+    }
+  }
+
+  if ((header.ddspf.flags & 0x00000040) != 0 && header.ddspf.rgbBitCount == 32) {
+    if (header.ddspf.rBitMask == 0x000000FF && header.ddspf.gBitMask == 0x0000FF00 &&
+        header.ddspf.bBitMask == 0x00FF0000 && header.ddspf.aBitMask == 0xFF000000) {
+      out.format = wgpu::TextureFormat::RGBA8Unorm;
+      return out;
+    }
+    if (header.ddspf.rBitMask == 0x00FF0000 && header.ddspf.gBitMask == 0x0000FF00 &&
+        header.ddspf.bBitMask == 0x000000FF && header.ddspf.aBitMask == 0xFF000000) {
+      out.format = wgpu::TextureFormat::BGRA8Unorm;
+      return out;
+    }
+  }
+
+  return std::nullopt;
+}
+
+std::optional<ConvertedTexture> parse_dds_bytes(ArrayRef<uint8_t> bytes) noexcept {
+  if (bytes.size() < sizeof(uint32_t) + sizeof(DDSHeader)) {
+    return std::nullopt;
+  }
+
+  const uint32_t magic = *reinterpret_cast<const uint32_t*>(bytes.data());
+  if (magic != kDDSMagic) {
+    return std::nullopt;
+  }
+
+  const auto* header = reinterpret_cast<const DDSHeader*>(bytes.data() + sizeof(uint32_t));
+  if (!validate_dds_header(*header)) {
+    return std::nullopt;
+  }
+
+  const auto parsedLayout = resolve_dds_layout(bytes, *header);
+  if (!parsedLayout.has_value()) {
+    return std::nullopt;
+  }
+
+  const uint32_t mipCount = 1u;
+  const auto expectedSize = calc_texture_size(parsedLayout->format, header->width, header->height, mipCount);
+  if (expectedSize == 0 || parsedLayout->dataOffset + expectedSize > bytes.size()) {
+    return std::nullopt;
+  }
+
+  ByteBuffer data{expectedSize};
+  std::memcpy(data.data(), bytes.data() + parsedLayout->dataOffset, expectedSize);
+  return ConvertedTexture{
+      .format = parsedLayout->format,
+      .width = header->width,
+      .height = header->height,
+      .mips = mipCount,
+      .data = std::move(data),
+  };
+}
+
+std::optional<ConvertedTexture> load_dds_file(const std::filesystem::path& path) noexcept {
+  const auto bytes = read_binary_file(path);
+  if (!bytes.has_value()) {
+    return std::nullopt;
+  }
+  return parse_dds_bytes(*bytes);
+}
+
+ByteBuffer encode_rgba8_dds(uint32_t width, uint32_t height, ArrayRef<uint8_t> pixels) {
+  DDSHeader header{};
+  header.size = sizeof(DDSHeader);
+  header.flags = 0x1 | 0x2 | 0x4 | 0x1000 | 0x8;
+  header.height = height;
+  header.width = width;
+  header.pitchOrLinearSize = width * 4;
+  header.mipMapCount = 1;
+  header.ddspf = {
+      .size = sizeof(DDSPixelFormat),
+      .flags = 0x00000040 | 0x00000001,
+      .fourCC = 0,
+      .rgbBitCount = 32,
+      .rBitMask = 0x000000FF,
+      .gBitMask = 0x0000FF00,
+      .bBitMask = 0x00FF0000,
+      .aBitMask = 0xFF000000,
+  };
+  header.caps = 0x00001000;
+
+  ByteBuffer bytes{sizeof(uint32_t) + sizeof(DDSHeader) + pixels.size()};
+  std::memcpy(bytes.data(), &kDDSMagic, sizeof(kDDSMagic));
+  std::memcpy(bytes.data() + sizeof(uint32_t), &header, sizeof(header));
+  std::memcpy(bytes.data() + sizeof(uint32_t) + sizeof(DDSHeader), pixels.data(), pixels.size());
+  return bytes;
+}
+
+bool write_rgba8_dds(const std::filesystem::path& path, uint32_t width, uint32_t height,
+                     ArrayRef<uint8_t> pixels) noexcept {
+  return write_binary_file(path, encode_rgba8_dds(width, height, pixels));
+}
+} // namespace aurora::gfx::dds
diff --git a/aurora-main/lib/gfx/dds_io.hpp b/aurora-main/lib/gfx/dds_io.hpp
new file mode 100644
index 0000000..2f275f2
--- /dev/null
+++ b/aurora-main/lib/gfx/dds_io.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "common.hpp"
+#include "texture_convert.hpp"
+
+#include <filesystem>
+#include <optional>
+
+namespace aurora::gfx::dds {
+std::optional<ConvertedTexture> parse_dds_bytes(ArrayRef<uint8_t> bytes) noexcept;
+std::optional<ConvertedTexture> load_dds_file(const std::filesystem::path& path) noexcept;
+ByteBuffer encode_rgba8_dds(uint32_t width, uint32_t height, ArrayRef<uint8_t> pixels);
+bool write_rgba8_dds(const std::filesystem::path& path, uint32_t width, uint32_t height, ArrayRef<u8> pixels) noexcept;
+
+std::optional<ByteBuffer> read_binary_file(const std::filesystem::path& path) noexcept;
+
+} // namespace aurora::gfx::dds
diff --git a/aurora-main/lib/gfx/depth_peek.cpp b/aurora-main/lib/gfx/depth_peek.cpp
new file mode 100644
index 0000000..b41ee92
--- /dev/null
+++ b/aurora-main/lib/gfx/depth_peek.cpp
@@ -0,0 +1,469 @@
+#include "depth_peek.hpp"
+
+#include "../dolphin/vi/vi_internal.hpp"
+#include "../gx/gx.hpp"
+#include "../webgpu/gpu.hpp"
+
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <mutex>
+#include <string>
+
+#include <magic_enum.hpp>
+#include <tracy/Tracy.hpp>
+
+namespace aurora::gfx::depth_peek {
+namespace {
+Module Log("aurora::gfx::depth_peek");
+
+using webgpu::g_device;
+using webgpu::g_instance;
+using webgpu::g_queue;
+
+using Clock = std::chrono::steady_clock;
+
+constexpr size_t SlotCount = 3;
+constexpr uint32_t WorkgroupSizeX = 8;
+constexpr uint32_t WorkgroupSizeY = 8;
+constexpr uint32_t DepthPeekSnapshotHz = 30;
+constexpr auto SnapshotInterval = std::chrono::nanoseconds{1'000'000'000 / DepthPeekSnapshotHz};
+
+struct Params {
+  uint32_t dstWidth = 0;
+  uint32_t dstHeight = 0;
+  uint32_t srcWidth = 0;
+  uint32_t srcHeight = 0;
+  float offsetX = 0.f;
+  float offsetY = 0.f;
+  float scaleX = 1.f;
+  float scaleY = 1.f;
+};
+static_assert(sizeof(Params) == 32);
+
+struct LatestSnapshot {
+  uint32_t width = 0;
+  uint32_t height = 0;
+  std::vector<uint32_t> data;
+};
+
+enum class SlotState : uint8_t {
+  Available,
+  CopySubmitted,
+  MapPending,
+};
+
+struct Slot {
+  wgpu::Buffer storageBuffer;
+  wgpu::Buffer readbackBuffer;
+  wgpu::Buffer paramsBuffer;
+  uint32_t width = 0;
+  uint32_t height = 0;
+  uint64_t byteSize = 0;
+  SlotState state = SlotState::Available;
+};
+
+struct PendingMap {
+  size_t slotIdx = 0;
+  wgpu::Buffer readbackBuffer;
+  uint64_t byteSize = 0;
+};
+
+std::array<Slot, SlotCount> g_slots;
+size_t g_nextSlot = 0;
+wgpu::BindGroupLayout g_bindGroupLayout;
+wgpu::ComputePipeline g_pipeline;
+bool g_snapshotRequested = false;
+Clock::time_point g_nextSnapshotTime;
+LatestSnapshot g_latest;
+std::mutex g_mutex;
+
+constexpr std::string_view ShaderPreamble = R"(
+struct Params {
+    dstSize: vec2u,
+    srcSize: vec2u,
+    offset: vec2f,
+    scale: vec2f,
+};
+
+@group(0) @binding(1) var<storage, read_write> out_z: array<u32>;
+@group(0) @binding(2) var<uniform> params: Params;
+)"sv;
+
+constexpr std::string_view ReversedZBody = R"(
+fn gx_z24(depth: f32) -> u32 {
+    return min(u32(clamp(depth, 0.0, 1.0) * 16777216.0), 0x00ffffffu);
+}
+)"sv;
+
+constexpr std::string_view ForwardZBody = R"(
+fn gx_z24(depth: f32) -> u32 {
+    return min(u32(clamp(depth, 0.0, 1.0) * 16777215.0 + 0.5), 0x00ffffffu);
+}
+)"sv;
+
+constexpr std::string_view ShaderMain = R"(
+@group(0) @binding(0) var src: texture_depth_2d;
+
+fn load_depth(coord: vec2i) -> f32 {
+    return textureLoad(src, coord, 0);
+}
+
+@compute @workgroup_size(8, 8, 1)
+fn cs_main(@builtin(global_invocation_id) id: vec3u) {
+    if (id.x >= params.dstSize.x || id.y >= params.dstSize.y) {
+        return;
+    }
+
+    let dstCenter = vec2f(vec2u(id.xy)) + vec2f(0.5, 0.5);
+    let srcPixel = clamp(vec2i(floor(params.offset + dstCenter * params.scale)), vec2i(0, 0),
+                         vec2i(params.srcSize) - vec2i(1, 1));
+    let depth = load_depth(srcPixel);
+    out_z[id.y * params.dstSize.x + id.x] = gx_z24(depth);
+}
+)"sv;
+
+std::string build_shader_source() {
+  std::string source;
+  source.reserve(ShaderPreamble.size() + ReversedZBody.size() + ShaderMain.size());
+  source += ShaderPreamble;
+  source += gx::UseReversedZ ? ReversedZBody : ForwardZBody;
+  source += ShaderMain;
+  return source;
+}
+
+wgpu::ComputePipeline create_pipeline(const wgpu::BindGroupLayout& bindGroupLayout, const char* label) {
+  const auto shaderSource = build_shader_source();
+  const wgpu::ShaderSourceWGSL wgslSource{wgpu::ShaderSourceWGSL::Init{
+      .code = shaderSource.c_str(),
+  }};
+  const wgpu::ShaderModuleDescriptor moduleDescriptor{
+      .nextInChain = &wgslSource,
+      .label = label,
+  };
+  const auto module = g_device.CreateShaderModule(&moduleDescriptor);
+
+  const wgpu::PipelineLayoutDescriptor layoutDescriptor{
+      .bindGroupLayoutCount = 1,
+      .bindGroupLayouts = &bindGroupLayout,
+  };
+  const auto pipelineLayout = g_device.CreatePipelineLayout(&layoutDescriptor);
+  const wgpu::ComputePipelineDescriptor pipelineDescriptor{
+      .label = label,
+      .layout = pipelineLayout,
+      .compute =
+          wgpu::ComputeState{
+              .module = module,
+              .entryPoint = "cs_main",
+          },
+  };
+  return g_device.CreateComputePipeline(&pipelineDescriptor);
+}
+
+wgpu::BindGroupLayout create_bind_group_layout(const char* label) {
+  constexpr std::array entries{
+      wgpu::BindGroupLayoutEntry{
+          .binding = 0,
+          .visibility = wgpu::ShaderStage::Compute,
+          .texture =
+              wgpu::TextureBindingLayout{
+                  .sampleType = wgpu::TextureSampleType::Depth,
+                  .viewDimension = wgpu::TextureViewDimension::e2D,
+              },
+      },
+      wgpu::BindGroupLayoutEntry{
+          .binding = 1,
+          .visibility = wgpu::ShaderStage::Compute,
+          .buffer =
+              wgpu::BufferBindingLayout{
+                  .type = wgpu::BufferBindingType::Storage,
+              },
+      },
+      wgpu::BindGroupLayoutEntry{
+          .binding = 2,
+          .visibility = wgpu::ShaderStage::Compute,
+          .buffer =
+              wgpu::BufferBindingLayout{
+                  .type = wgpu::BufferBindingType::Uniform,
+              },
+      },
+  };
+  const wgpu::BindGroupLayoutDescriptor descriptor{
+      .label = label,
+      .entryCount = entries.size(),
+      .entries = entries.data(),
+  };
+  return g_device.CreateBindGroupLayout(&descriptor);
+}
+
+Params make_params(wgpu::Extent3D sourceSize, Vec2<uint32_t> dstSize) noexcept {
+  Params params{
+      .dstWidth = dstSize.x,
+      .dstHeight = dstSize.y,
+      .srcWidth = sourceSize.width,
+      .srcHeight = sourceSize.height,
+  };
+
+  if (gx::g_gxState.viewportPolicy == AURORA_VIEWPORT_NATIVE) {
+    return params;
+  }
+
+  const auto logicalSize = vi::configured_fb_size();
+  if (logicalSize.x == 0 || logicalSize.y == 0 || sourceSize.width == 0 || sourceSize.height == 0) {
+    return params;
+  }
+
+  const bool stretch = gx::g_gxState.viewportPolicy == AURORA_VIEWPORT_STRETCH;
+  const float scaleX = static_cast<float>(sourceSize.width) / static_cast<float>(logicalSize.x);
+  const float scaleY = static_cast<float>(sourceSize.height) / static_cast<float>(logicalSize.y);
+  const float scale = std::min(scaleX, scaleY);
+  params.scaleX = stretch ? scaleX : scale;
+  params.scaleY = stretch ? scaleY : scale;
+  params.offsetX =
+      stretch ? 0.f : (static_cast<float>(sourceSize.width) - static_cast<float>(logicalSize.x) * scale) * 0.5f;
+  params.offsetY =
+      stretch ? 0.f : (static_cast<float>(sourceSize.height) - static_cast<float>(logicalSize.y) * scale) * 0.5f;
+  return params;
+}
+
+bool ensure_slot(Slot& slot, uint32_t width, uint32_t height) {
+  const uint64_t byteSize = static_cast<uint64_t>(width) * static_cast<uint64_t>(height) * sizeof(uint32_t);
+  if (slot.storageBuffer && slot.width == width && slot.height == height && slot.byteSize == byteSize) {
+    return true;
+  }
+
+  slot.storageBuffer = {};
+  slot.readbackBuffer = {};
+  slot.paramsBuffer = {};
+  slot.width = width;
+  slot.height = height;
+  slot.byteSize = byteSize;
+
+  if (byteSize == 0 || byteSize > UINT32_MAX) {
+    return false;
+  }
+
+  const wgpu::BufferDescriptor storageDescriptor{
+      .label = "Depth Peek Storage Buffer",
+      .usage = wgpu::BufferUsage::Storage | wgpu::BufferUsage::CopySrc,
+      .size = byteSize,
+  };
+  slot.storageBuffer = g_device.CreateBuffer(&storageDescriptor);
+
+  const wgpu::BufferDescriptor readbackDescriptor{
+      .label = "Depth Peek Readback Buffer",
+      .usage = wgpu::BufferUsage::MapRead | wgpu::BufferUsage::CopyDst,
+      .size = byteSize,
+  };
+  slot.readbackBuffer = g_device.CreateBuffer(&readbackDescriptor);
+
+  const wgpu::BufferDescriptor paramsDescriptor{
+      .label = "Depth Peek Params Buffer",
+      .usage = wgpu::BufferUsage::Uniform | wgpu::BufferUsage::CopyDst,
+      .size = sizeof(Params),
+  };
+  slot.paramsBuffer = g_device.CreateBuffer(&paramsDescriptor);
+  return slot.storageBuffer && slot.readbackBuffer && slot.paramsBuffer;
+}
+
+Slot* find_available_slot(uint32_t width, uint32_t height) {
+  for (size_t i = 0; i < g_slots.size(); ++i) {
+    const size_t idx = (g_nextSlot + i) % g_slots.size();
+    auto& slot = g_slots[idx];
+    if (slot.state != SlotState::Available) {
+      continue;
+    }
+    if (!ensure_slot(slot, width, height)) {
+      continue;
+    }
+    g_nextSlot = (idx + 1) % g_slots.size();
+    return &slot;
+  }
+  return nullptr;
+}
+
+void complete_slot(size_t slotIdx, wgpu::MapAsyncStatus status, wgpu::StringView message) {
+  std::lock_guard lock{g_mutex};
+  auto& slot = g_slots[slotIdx];
+  if (status == wgpu::MapAsyncStatus::Success) {
+    const auto valueCount = static_cast<size_t>(slot.width) * static_cast<size_t>(slot.height);
+    const auto* mapped =
+        static_cast<const uint32_t*>(slot.readbackBuffer.GetConstMappedRange(0, valueCount * sizeof(uint32_t)));
+    if (mapped != nullptr) {
+      g_latest.width = slot.width;
+      g_latest.height = slot.height;
+      g_latest.data.assign(mapped, mapped + valueCount);
+    }
+    slot.readbackBuffer.Unmap();
+  } else if (status != wgpu::MapAsyncStatus::CallbackCancelled && status != wgpu::MapAsyncStatus::Aborted) {
+    Log.warn("Depth Peek readback mapping failed {}: {}", magic_enum::enum_name(status), message);
+  }
+  slot.state = SlotState::Available;
+}
+} // namespace
+
+void initialize() {
+  g_bindGroupLayout = create_bind_group_layout("Depth Peek Bind Group Layout");
+  g_pipeline = create_pipeline(g_bindGroupLayout, "Depth Peek Pipeline");
+}
+
+void shutdown() {
+  testing::reset();
+  g_pipeline = {};
+  g_bindGroupLayout = {};
+  for (auto& slot : g_slots) {
+    slot = {};
+  }
+}
+
+void request_snapshot() noexcept {
+  std::lock_guard lock{g_mutex};
+  g_snapshotRequested = true;
+}
+
+bool read_latest(uint16_t x, uint16_t y, uint32_t& z) noexcept {
+  std::lock_guard lock{g_mutex};
+  if (x >= g_latest.width || y >= g_latest.height || g_latest.data.empty()) {
+    return false;
+  }
+  z = g_latest.data[static_cast<size_t>(y) * g_latest.width + x] & 0x00ffffffu;
+  return true;
+}
+
+void poll() noexcept {
+  if (g_instance) {
+    g_instance.ProcessEvents();
+  }
+}
+
+void encode_frame_snapshot(const wgpu::CommandEncoder& cmd, const wgpu::TextureView& depthView,
+                           wgpu::Extent3D sourceSize, uint32_t msaaSamples) noexcept {
+  ZoneScoped;
+  const auto now = Clock::now();
+  {
+    std::lock_guard lock{g_mutex};
+    if (!g_snapshotRequested || now < g_nextSnapshotTime) {
+      return;
+    }
+    g_snapshotRequested = false;
+    g_nextSnapshotTime = now + SnapshotInterval;
+  }
+
+  const auto dstSize = vi::configured_fb_size();
+  if (!depthView || dstSize.x == 0 || dstSize.y == 0 || sourceSize.width == 0 || sourceSize.height == 0) {
+    return;
+  }
+  if (msaaSamples > 1) {
+    Log.fatal("Depth Peek from multisampled EFB targets is not supported");
+  }
+
+  const Params params = make_params(sourceSize, dstSize);
+  wgpu::Buffer storageBuffer;
+  wgpu::Buffer readbackBuffer;
+  wgpu::Buffer paramsBuffer;
+  uint64_t byteSize = 0;
+  {
+    std::lock_guard lock{g_mutex};
+    auto* slot = find_available_slot(dstSize.x, dstSize.y);
+    if (slot == nullptr) {
+      return;
+    }
+    slot->state = SlotState::CopySubmitted;
+    storageBuffer = slot->storageBuffer;
+    readbackBuffer = slot->readbackBuffer;
+    paramsBuffer = slot->paramsBuffer;
+    byteSize = slot->byteSize;
+  }
+
+  g_queue.WriteBuffer(paramsBuffer, 0, &params, sizeof(params));
+
+  const std::array bindGroupEntries{
+      wgpu::BindGroupEntry{
+          .binding = 0,
+          .textureView = depthView,
+      },
+      wgpu::BindGroupEntry{
+          .binding = 1,
+          .buffer = storageBuffer,
+          .size = byteSize,
+      },
+      wgpu::BindGroupEntry{
+          .binding = 2,
+          .buffer = paramsBuffer,
+          .size = sizeof(Params),
+      },
+  };
+  const wgpu::BindGroupDescriptor bindGroupDescriptor{
+      .label = "Depth Peek Bind Group",
+      .layout = g_bindGroupLayout,
+      .entryCount = bindGroupEntries.size(),
+      .entries = bindGroupEntries.data(),
+  };
+  const auto bindGroup = g_device.CreateBindGroup(&bindGroupDescriptor);
+
+  const wgpu::ComputePassDescriptor passDescriptor{
+      .label = "Depth Peek Compute Pass",
+  };
+  const auto pass = cmd.BeginComputePass(&passDescriptor);
+  pass.SetPipeline(g_pipeline);
+  pass.SetBindGroup(0, bindGroup);
+  pass.DispatchWorkgroups((dstSize.x + WorkgroupSizeX - 1) / WorkgroupSizeX,
+                          (dstSize.y + WorkgroupSizeY - 1) / WorkgroupSizeY);
+  pass.End();
+
+  cmd.CopyBufferToBuffer(storageBuffer, 0, readbackBuffer, 0, byteSize);
+}
+
+void after_submit() noexcept {
+  std::vector<PendingMap> pendingMaps;
+  {
+    std::lock_guard lock{g_mutex};
+    for (size_t i = 0; i < g_slots.size(); ++i) {
+      auto& slot = g_slots[i];
+      if (slot.state != SlotState::CopySubmitted) {
+        continue;
+      }
+      slot.state = SlotState::MapPending;
+      pendingMaps.push_back({
+          .slotIdx = i,
+          .readbackBuffer = slot.readbackBuffer,
+          .byteSize = slot.byteSize,
+      });
+    }
+  }
+
+  for (const auto& pending : pendingMaps) {
+    pending.readbackBuffer.MapAsync(
+        wgpu::MapMode::Read, 0, pending.byteSize, wgpu::CallbackMode::AllowSpontaneous,
+        [slotIdx = pending.slotIdx](wgpu::MapAsyncStatus status, wgpu::StringView message) {
+          complete_slot(slotIdx, status, message);
+        });
+  }
+}
+
+namespace testing {
+void reset() noexcept {
+  std::lock_guard lock{g_mutex};
+  g_snapshotRequested = false;
+  g_nextSlot = 0;
+  g_nextSnapshotTime = {};
+  g_latest = {};
+  for (auto& slot : g_slots) {
+    slot.state = SlotState::Available;
+  }
+}
+
+bool snapshot_requested() noexcept {
+  std::lock_guard lock{g_mutex};
+  return g_snapshotRequested;
+}
+
+void set_latest(uint32_t width, uint32_t height, const std::vector<uint32_t>& data) {
+  std::lock_guard lock{g_mutex};
+  g_latest.width = width;
+  g_latest.height = height;
+  g_latest.data = data;
+}
+} // namespace testing
+
+} // namespace aurora::gfx::depth_peek
diff --git a/aurora-main/lib/gfx/depth_peek.hpp b/aurora-main/lib/gfx/depth_peek.hpp
new file mode 100644
index 0000000..0f6fec9
--- /dev/null
+++ b/aurora-main/lib/gfx/depth_peek.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "common.hpp"
+
+#include <vector>
+
+namespace aurora::gfx::depth_peek {
+
+void initialize();
+void shutdown();
+
+void request_snapshot() noexcept;
+bool read_latest(uint16_t x, uint16_t y, uint32_t& z) noexcept;
+void poll() noexcept;
+
+void encode_frame_snapshot(const wgpu::CommandEncoder& cmd, const wgpu::TextureView& depthView,
+                           wgpu::Extent3D sourceSize, uint32_t msaaSamples) noexcept;
+void after_submit() noexcept;
+
+namespace testing {
+void reset() noexcept;
+bool snapshot_requested() noexcept;
+void set_latest(uint32_t width, uint32_t height, const std::vector<uint32_t>& data);
+} // namespace testing
+
+} // namespace aurora::gfx::depth_peek
diff --git a/aurora-main/lib/gfx/efb_ram_copy.cpp b/aurora-main/lib/gfx/efb_ram_copy.cpp
new file mode 100644
index 0000000..34d507b
--- /dev/null
+++ b/aurora-main/lib/gfx/efb_ram_copy.cpp
@@ -0,0 +1,451 @@
+#include "efb_ram_copy.hpp"
+
+#include "efb_ram_encoder.hpp"
+#include "tex_copy_conv.hpp"
+#include "../internal.hpp"
+#include "../webgpu/gpu.hpp"
+
+#include <algorithm>
+#include <array>
+#include <cstring>
+#include <mutex>
+#include <unordered_map>
+#include <vector>
+
+#include <magic_enum.hpp>
+
+namespace aurora::gfx::efb_ram {
+namespace {
+
+Module Log("aurora::gfx::efb_ram");
+
+using webgpu::g_device;
+using webgpu::g_instance;
+
+// A CPU-consumed EFB copy this small is the lens-flare occlusion probe (4x4 Z24X8, 64 bytes).
+// Resolving it synchronously stalls the producer and kills interpolation, so read it back async.
+constexpr size_t kAsyncReadbackMaxBytes = 256;
+// Each destination keeps its readback buffer forever. Only a handful are expected, and the cap
+// stops an unexpected pattern of one-shot destinations from leaking GPU buffers.
+constexpr size_t kMaxAsyncSlots = 32;
+
+struct PendingCopy {
+  void* dest = nullptr;
+  uint32_t width = 0;
+  uint32_t height = 0;
+  GXTexFmt format = GX_TF_RGBA8;
+  TextureHandle texture;
+  TextureHandle nativeTexture;
+  Range nativeBlitUniform;
+};
+
+struct Download {
+  PendingCopy copy;
+  wgpu::Buffer buffer;
+  uint32_t bytesPerRow = 0;
+  uint64_t bufferSize = 0;
+};
+
+enum class AsyncState : uint8_t {
+  Idle,
+  CopySubmitted,
+  MapPending,
+};
+
+// One readback per destination address, reused for that destination's lifetime: the probe hits
+// the same buffer every frame, so pooling avoids a per-frame allocation.
+struct AsyncSlot {
+  wgpu::Buffer buffer;
+  TextureHandle nativeTexture;
+  uint64_t bufferSize = 0;
+  uint32_t bytesPerRow = 0;
+  // Latched at encode time and read by the map callback.
+  void* dest = nullptr;
+  GXTexFmt format = GX_TF_RGBA8;
+  uint32_t width = 0;
+  uint32_t height = 0;
+  uint32_t hostWidth = 0;
+  uint32_t hostHeight = 0;
+  HostPixelOrder order = HostPixelOrder::RGBA;
+  AsyncState state = AsyncState::Idle;
+};
+
+std::vector<PendingCopy> g_pending;
+std::vector<Download> g_downloads;
+
+// Recorded by the producer, moved to the worker-private sealed list while the
+// producer is excluded.
+std::vector<PendingCopy> g_asyncPending;
+std::vector<PendingCopy> g_asyncSealed;
+
+std::mutex g_asyncMutex;
+std::unordered_map<void*, AsyncSlot> g_asyncSlots;
+uint32_t g_asyncMapsInFlight = 0;
+
+uint32_t align_to(uint32_t value, uint32_t alignment) noexcept { return (value + alignment - 1) & ~(alignment - 1); }
+
+// An internally scaled copy cannot be read back directly, so blit it down to native-resolution
+// RGBA8 first. Pushes a uniform, so it must run while the staging buffers are still mapped.
+void ensure_native_texture(PendingCopy& pending, TextureHandle* cache = nullptr) noexcept {
+  if (pending.texture->size.width == pending.width && pending.texture->size.height == pending.height) {
+    return;
+  }
+  if (pending.nativeTexture) {
+    return;
+  }
+  if (cache != nullptr && *cache && (*cache)->size.width == pending.width &&
+      (*cache)->size.height == pending.height) {
+    pending.nativeTexture = *cache;
+  } else {
+    pending.nativeTexture = new_conv_texture(pending.width, pending.height, GX_TF_RGBA8, "GX EFB RAM native readback");
+    if (cache != nullptr) {
+      *cache = pending.nativeTexture;
+    }
+  }
+  const std::array nativeBlitUniform{
+      0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 64.0f, 0.0f, 0.0f, 0.0f, 1.0f, 0.0f, 0.0f,
+  };
+  pending.nativeBlitUniform = push_uniform(nativeBlitUniform);
+}
+
+void encode_native_blit(const wgpu::CommandEncoder& encoder, const PendingCopy& pending) noexcept {
+  const tex_copy_conv::ConvRequest blitRequest{
+      .fmt = GX_TF_RGBA8,
+      .srcView = pending.texture->sampleTextureView,
+      .uniformRange = pending.nativeBlitUniform,
+      .dst = pending.nativeTexture,
+      .sampleFilter = pending.format == GX_TF_Z16 || pending.format == GX_TF_Z24X8
+                          ? tex_copy_conv::SampleFilter::Nearest
+                          : tex_copy_conv::SampleFilter::Linear,
+  };
+  tex_copy_conv::blit(encoder, blitRequest);
+}
+
+HostPixelOrder texture_pixel_order(const TextureHandle& texture) noexcept {
+  return texture->format == wgpu::TextureFormat::BGRA8Unorm ? HostPixelOrder::BGRA : HostPixelOrder::RGBA;
+}
+
+void complete_async_slot(void* dest, wgpu::MapAsyncStatus status, wgpu::StringView message) noexcept {
+  std::lock_guard lock{g_asyncMutex};
+  if (g_asyncMapsInFlight > 0) {
+    --g_asyncMapsInFlight;
+  }
+  const auto it = g_asyncSlots.find(dest);
+  if (it == g_asyncSlots.end()) {
+    return;
+  }
+  auto& slot = it->second;
+  if (status == wgpu::MapAsyncStatus::Success) {
+    const auto* pixels = static_cast<const uint8_t*>(slot.buffer.GetConstMappedRange(0, slot.bufferSize));
+    if (pixels != nullptr) {
+      // Writes guest RAM from the event-queue thread while the guest may be reading it. The only
+      // consumer min/maxes depth for a fade factor, so a torn tile just mixes two frames' depths.
+      const size_t outputSize = encoded_size(slot.format, slot.width, slot.height);
+      if (!encode(slot.dest, outputSize, slot.format, slot.width, slot.height, pixels, slot.hostWidth, slot.hostHeight,
+                  slot.bytesPerRow, slot.order)) {
+        Log.error("Failed to encode async EFB RAM copy format=0x{:x} size={}x{}", static_cast<unsigned>(slot.format),
+                  slot.width, slot.height);
+      }
+      // Guest RAM written from outside the embedder, so nothing bumps its write generation and a
+      // texture cached over this range would keep its digest.
+      notify_guest_write(slot.dest, outputSize);
+    }
+    slot.buffer.Unmap();
+  } else if (status != wgpu::MapAsyncStatus::CallbackCancelled && status != wgpu::MapAsyncStatus::Aborted) {
+    Log.warn("Async EFB RAM readback mapping failed {}: {}", magic_enum::enum_name(status), message);
+  }
+  slot.state = AsyncState::Idle;
+}
+
+// Runs the completion callbacks for maps whose GPU work has finished. Must not
+// be called while g_asyncMutex is held: complete_async_slot takes it.
+void drain_async_events() noexcept {
+  {
+    std::lock_guard lock{g_asyncMutex};
+    if (g_asyncMapsInFlight == 0) {
+      return;
+    }
+  }
+  if (g_instance) {
+    g_instance.ProcessEvents();
+  }
+}
+
+} // namespace
+
+void schedule(void* dest, uint32_t width, uint32_t height, GXTexFmt format, TextureHandle texture) noexcept {
+  if (dest == nullptr || width == 0 || height == 0 || !texture) {
+    return;
+  }
+  if (!supports_format(format)) {
+    Log.fatal("Unsupported CPU-visible EFB copy format 0x{:x}", static_cast<unsigned>(format));
+  }
+
+  PendingCopy request{
+      .dest = dest,
+      .width = width,
+      .height = height,
+      .format = format,
+      .texture = std::move(texture),
+  };
+
+  const size_t encodedSize = encoded_size(format, width, height);
+  // Offscreen copies resolve on a separate pass list that the sealed frame's
+  // native render does not replay, so they stay on the lazy path.
+  bool async = !is_offscreen() && encodedSize != 0 && encodedSize <= kAsyncReadbackMaxBytes;
+  if (async) {
+    std::lock_guard lock{g_asyncMutex};
+    const auto it = g_asyncSlots.find(dest);
+    if (it == g_asyncSlots.end()) {
+      if (g_asyncSlots.size() >= kMaxAsyncSlots) {
+        async = false;
+      } else {
+        g_asyncSlots.try_emplace(dest);
+        // No readback has landed here yet. 0xff decodes to far Z, which the probe reads as unobstructed
+        // so a new flare fades in; zero-filled RAM would decode as fully occluded.
+        std::memset(dest, 0xff, encodedSize);
+        notify_guest_write(dest, encodedSize);
+      }
+    }
+  }
+
+  auto& list = async ? g_asyncPending : g_pending;
+  if (auto it = std::find_if(list.begin(), list.end(),
+                             [dest](const PendingCopy& pending) { return pending.dest == dest; });
+      it != list.end()) {
+    *it = std::move(request);
+  } else {
+    list.push_back(std::move(request));
+  }
+}
+
+bool has_pending(void* dest) noexcept {
+  if (dest == nullptr) return !g_pending.empty() || !g_downloads.empty();
+  return std::any_of(g_pending.begin(), g_pending.end(),
+                     [dest](const PendingCopy& pending) { return pending.dest == dest; }) ||
+         std::any_of(g_downloads.begin(), g_downloads.end(),
+                     [dest](const Download& download) { return download.copy.dest == dest; });
+}
+
+bool prepare_downloads(void* dest) noexcept {
+  bool found = false;
+  for (auto& pending : g_pending) {
+    if (dest != nullptr && pending.dest != dest) continue;
+    found = true;
+    ensure_native_texture(pending);
+  }
+  return found;
+}
+
+void encode_downloads(const wgpu::CommandEncoder& encoder, void* dest) noexcept {
+  if (!g_downloads.empty()) {
+    Log.fatal("Attempted to encode new EFB RAM downloads before completing the previous batch");
+  }
+
+  g_downloads.reserve(g_pending.size());
+  for (auto it = g_pending.begin(); it != g_pending.end();) {
+    if (dest != nullptr && it->dest != dest) {
+      ++it;
+      continue;
+    }
+    PendingCopy pending = std::move(*it);
+    it = g_pending.erase(it);
+    if (pending.nativeTexture) {
+      encode_native_blit(encoder, pending);
+    }
+    const auto& texture = pending.nativeTexture ? pending.nativeTexture : pending.texture;
+    const uint32_t bytesPerRow = align_to(texture->size.width * 4, 256);
+    const uint64_t bufferSize = static_cast<uint64_t>(bytesPerRow) * texture->size.height;
+    const wgpu::BufferDescriptor descriptor{
+        .label = "GX EFB RAM copy readback",
+        .usage = wgpu::BufferUsage::CopyDst | wgpu::BufferUsage::MapRead,
+        .size = bufferSize,
+    };
+    auto buffer = g_device.CreateBuffer(&descriptor);
+    const wgpu::TexelCopyTextureInfo source{
+        .texture = texture->texture,
+        .mipLevel = 0,
+        .origin = {0, 0, 0},
+        .aspect = wgpu::TextureAspect::All,
+    };
+    const wgpu::TexelCopyBufferInfo destination{
+        .layout =
+            wgpu::TexelCopyBufferLayout{
+                .offset = 0,
+                .bytesPerRow = bytesPerRow,
+                .rowsPerImage = texture->size.height,
+            },
+        .buffer = buffer,
+    };
+    encoder.CopyTextureToBuffer(&source, &destination, &texture->size);
+    g_downloads.push_back({
+        .copy = std::move(pending),
+        .buffer = std::move(buffer),
+        .bytesPerRow = bytesPerRow,
+        .bufferSize = bufferSize,
+    });
+  }
+}
+
+bool complete_downloads() noexcept {
+  bool success = true;
+  for (auto& download : g_downloads) {
+    wgpu::MapAsyncStatus mapStatus = wgpu::MapAsyncStatus::CallbackCancelled;
+    wgpu::StringView mapMessage{};
+    const auto future =
+        download.buffer.MapAsync(wgpu::MapMode::Read, 0, download.bufferSize, wgpu::CallbackMode::WaitAnyOnly,
+                                 [&mapStatus, &mapMessage](wgpu::MapAsyncStatus status, wgpu::StringView message) {
+                                   mapStatus = status;
+                                   mapMessage = message;
+                                 });
+    const auto waitStatus = g_instance.WaitAny(future, 5000000000);
+    if (waitStatus != wgpu::WaitStatus::Success || mapStatus != wgpu::MapAsyncStatus::Success) {
+      Log.error("EFB RAM readback failed wait={} map={} message={}", magic_enum::enum_name(waitStatus),
+                magic_enum::enum_name(mapStatus), mapMessage);
+      success = false;
+      continue;
+    }
+
+    const auto* pixels = static_cast<const uint8_t*>(download.buffer.GetConstMappedRange(0, download.bufferSize));
+    const auto& readbackTexture = download.copy.nativeTexture ? download.copy.nativeTexture : download.copy.texture;
+    const auto order = texture_pixel_order(readbackTexture);
+    const size_t outputSize = encoded_size(download.copy.format, download.copy.width, download.copy.height);
+    if (!encode(download.copy.dest, outputSize, download.copy.format, download.copy.width, download.copy.height, pixels,
+                readbackTexture->size.width, readbackTexture->size.height, download.bytesPerRow, order)) {
+      Log.error("Failed to encode EFB RAM copy format=0x{:x} size={}x{}", static_cast<unsigned>(download.copy.format),
+                download.copy.width, download.copy.height);
+      success = false;
+    }
+    notify_guest_write(download.copy.dest, outputSize);
+    download.buffer.Unmap();
+  }
+  g_downloads.clear();
+  return success;
+}
+
+void cancel() noexcept {
+  g_pending.clear();
+  g_downloads.clear();
+  g_asyncPending.clear();
+}
+
+void seal_async_downloads() noexcept {
+  {
+    std::lock_guard lock{g_asyncMutex};
+    for (auto& pending : g_asyncPending) {
+      const auto it = g_asyncSlots.find(pending.dest);
+      ensure_native_texture(pending, it != g_asyncSlots.end() ? &it->second.nativeTexture : nullptr);
+    }
+  }
+  g_asyncSealed = std::move(g_asyncPending);
+  g_asyncPending.clear();
+}
+
+void encode_async_downloads(const wgpu::CommandEncoder& encoder) noexcept {
+  if (g_asyncSealed.empty()) {
+    return;
+  }
+  // Retire the previous frame's map first so its slot is free here, otherwise a single-slot
+  // destination could only be sampled every other frame.
+  drain_async_events();
+  std::lock_guard lock{g_asyncMutex};
+  for (auto& pending : g_asyncSealed) {
+    const auto it = g_asyncSlots.find(pending.dest);
+    if (it == g_asyncSlots.end()) {
+      continue;
+    }
+    auto& slot = it->second;
+    // Only one readback per destination may be outstanding and the previous map still owns the pooled
+    // buffer. Dropping this request just leaves the guest on a slightly older probe.
+    if (slot.state != AsyncState::Idle) {
+      continue;
+    }
+    if (pending.nativeTexture) {
+      encode_native_blit(encoder, pending);
+    }
+    const auto& texture = pending.nativeTexture ? pending.nativeTexture : pending.texture;
+    const uint32_t bytesPerRow = align_to(texture->size.width * 4, 256);
+    const uint64_t bufferSize = static_cast<uint64_t>(bytesPerRow) * texture->size.height;
+    if (!slot.buffer || slot.bufferSize != bufferSize) {
+      const wgpu::BufferDescriptor descriptor{
+          .label = "GX EFB RAM async readback",
+          .usage = wgpu::BufferUsage::CopyDst | wgpu::BufferUsage::MapRead,
+          .size = bufferSize,
+      };
+      slot.buffer = g_device.CreateBuffer(&descriptor);
+      slot.bufferSize = bufferSize;
+    }
+    if (!slot.buffer) {
+      continue;
+    }
+    const wgpu::TexelCopyTextureInfo source{
+        .texture = texture->texture,
+        .mipLevel = 0,
+        .origin = {0, 0, 0},
+        .aspect = wgpu::TextureAspect::All,
+    };
+    const wgpu::TexelCopyBufferInfo destination{
+        .layout =
+            wgpu::TexelCopyBufferLayout{
+                .offset = 0,
+                .bytesPerRow = bytesPerRow,
+                .rowsPerImage = texture->size.height,
+            },
+        .buffer = slot.buffer,
+    };
+    encoder.CopyTextureToBuffer(&source, &destination, &texture->size);
+    slot.bytesPerRow = bytesPerRow;
+    slot.dest = pending.dest;
+    slot.format = pending.format;
+    slot.width = pending.width;
+    slot.height = pending.height;
+    slot.hostWidth = texture->size.width;
+    slot.hostHeight = texture->size.height;
+    slot.order = texture_pixel_order(texture);
+    slot.state = AsyncState::CopySubmitted;
+  }
+  g_asyncSealed.clear();
+}
+
+void after_submit() noexcept {
+  struct PendingMap {
+    void* dest;
+    wgpu::Buffer buffer;
+    uint64_t bufferSize;
+  };
+  std::vector<PendingMap> pendingMaps;
+  {
+    std::lock_guard lock{g_asyncMutex};
+    for (auto& [dest, slot] : g_asyncSlots) {
+      if (slot.state != AsyncState::CopySubmitted) {
+        continue;
+      }
+      slot.state = AsyncState::MapPending;
+      ++g_asyncMapsInFlight;
+      pendingMaps.push_back({dest, slot.buffer, slot.bufferSize});
+    }
+  }
+
+  for (const auto& pending : pendingMaps) {
+    pending.buffer.MapAsync(wgpu::MapMode::Read, 0, pending.bufferSize, wgpu::CallbackMode::AllowSpontaneous,
+                            [dest = pending.dest](wgpu::MapAsyncStatus status, wgpu::StringView message) {
+                              complete_async_slot(dest, status, message);
+                            });
+  }
+
+  // Nothing else pumps the WebGPU event queue on this thread, so a completed map would sit
+  // unharvested with its slot busy. ProcessEvents does not block.
+  drain_async_events();
+}
+
+void abort_async() noexcept { g_asyncSealed.clear(); }
+
+void shutdown() noexcept {
+  cancel();
+  g_asyncSealed.clear();
+  std::lock_guard lock{g_asyncMutex};
+  g_asyncSlots.clear();
+  g_asyncMapsInFlight = 0;
+}
+
+} // namespace aurora::gfx::efb_ram
diff --git a/aurora-main/lib/gfx/efb_ram_copy.hpp b/aurora-main/lib/gfx/efb_ram_copy.hpp
new file mode 100644
index 0000000..6a20279
--- /dev/null
+++ b/aurora-main/lib/gfx/efb_ram_copy.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "common.hpp"
+#include "texture.hpp"
+
+#include <dolphin/gx/GXEnum.h>
+
+namespace aurora::gfx::efb_ram {
+
+void schedule(void* dest, uint32_t width, uint32_t height, GXTexFmt format, TextureHandle texture) noexcept;
+bool has_pending(void* dest = nullptr) noexcept;
+bool prepare_downloads(void* dest = nullptr) noexcept;
+void encode_downloads(const wgpu::CommandEncoder& encoder, void* dest = nullptr) noexcept;
+bool complete_downloads() noexcept;
+void cancel() noexcept;
+
+// Frame-latent readbacks for probe-sized CPU-consumed copies: they ride the frame's own encode and
+// land in guest RAM a frame later. Per frame, from the worker: seal, encode, then after_submit.
+void seal_async_downloads() noexcept;
+void encode_async_downloads(const wgpu::CommandEncoder& encoder) noexcept;
+void after_submit() noexcept;
+// Drops requests sealed for a frame that will never be encoded.
+void abort_async() noexcept;
+void shutdown() noexcept;
+
+} // namespace aurora::gfx::efb_ram
diff --git a/aurora-main/lib/gfx/efb_ram_encoder.cpp b/aurora-main/lib/gfx/efb_ram_encoder.cpp
new file mode 100644
index 0000000..f57486c
--- /dev/null
+++ b/aurora-main/lib/gfx/efb_ram_encoder.cpp
@@ -0,0 +1,211 @@
+#include "efb_ram_encoder.hpp"
+
+#include <algorithm>
+#include <array>
+#include <cstring>
+
+namespace aurora::gfx::efb_ram {
+namespace {
+
+struct Pixel {
+  uint8_t r;
+  uint8_t g;
+  uint8_t b;
+  uint8_t a;
+};
+
+struct BlockInfo {
+  uint32_t width;
+  uint32_t height;
+  uint32_t bytes;
+};
+
+enum class Layout {
+  I4,
+  I8,
+  IA4,
+  IA8,
+  RGB565,
+  RGB5A3,
+  RGBA8,
+};
+
+bool describe(GXTexFmt format, Layout& layout, BlockInfo& block) noexcept {
+  switch (format) {
+  case GX_TF_I4:
+  case GX_CTF_R4:
+    layout = Layout::I4;
+    block = {8, 8, 32};
+    return true;
+  case GX_TF_I8:
+  case GX_CTF_A8:
+  case GX_CTF_R8:
+  case GX_CTF_G8:
+  case GX_CTF_B8:
+    layout = Layout::I8;
+    block = {8, 4, 32};
+    return true;
+  case GX_TF_IA4:
+  case GX_CTF_RA4:
+    layout = Layout::IA4;
+    block = {8, 4, 32};
+    return true;
+  case GX_TF_IA8:
+  case GX_TF_Z16:
+  case GX_CTF_RA8:
+  case GX_CTF_RG8:
+  case GX_CTF_GB8:
+    layout = Layout::IA8;
+    block = {4, 4, 32};
+    return true;
+  case GX_TF_RGB565:
+    layout = Layout::RGB565;
+    block = {4, 4, 32};
+    return true;
+  case GX_TF_RGB5A3:
+    layout = Layout::RGB5A3;
+    block = {4, 4, 32};
+    return true;
+  case GX_TF_RGBA8:
+  case GX_TF_Z24X8:
+    layout = Layout::RGBA8;
+    block = {4, 4, 64};
+    return true;
+  default:
+    return false;
+  }
+}
+
+Pixel read_pixel(const uint8_t* pixels, uint32_t hostWidth, uint32_t hostHeight, uint32_t bytesPerRow,
+                 HostPixelOrder order, uint32_t guestX, uint32_t guestY, uint32_t guestWidth,
+                 uint32_t guestHeight) noexcept {
+  const uint32_t clampedGuestX = std::min(guestX, guestWidth - 1);
+  const uint32_t clampedGuestY = std::min(guestY, guestHeight - 1);
+  const uint64_t sampleXNumerator = (static_cast<uint64_t>(clampedGuestX) * 2 + 1) * hostWidth;
+  const uint64_t sampleYNumerator = (static_cast<uint64_t>(clampedGuestY) * 2 + 1) * hostHeight;
+  const uint32_t hostX =
+      std::min<uint32_t>(static_cast<uint32_t>(sampleXNumerator / (guestWidth * 2ull)), hostWidth - 1);
+  const uint32_t hostY =
+      std::min<uint32_t>(static_cast<uint32_t>(sampleYNumerator / (guestHeight * 2ull)), hostHeight - 1);
+  const auto* src = pixels + static_cast<size_t>(hostY) * bytesPerRow + static_cast<size_t>(hostX) * 4;
+  if (order == HostPixelOrder::BGRA) {
+    return {src[2], src[1], src[0], src[3]};
+  }
+  return {src[0], src[1], src[2], src[3]};
+}
+
+void write_be16(uint8_t*& dst, uint16_t value) noexcept {
+  *dst++ = static_cast<uint8_t>(value >> 8);
+  *dst++ = static_cast<uint8_t>(value);
+}
+
+} // namespace
+
+bool supports_format(GXTexFmt format) noexcept {
+  Layout layout{};
+  BlockInfo block{};
+  return describe(format, layout, block);
+}
+
+size_t encoded_size(GXTexFmt format, uint32_t width, uint32_t height) noexcept {
+  Layout layout{};
+  BlockInfo block{};
+  if (width == 0 || height == 0 || !describe(format, layout, block)) {
+    return 0;
+  }
+  const uint64_t blocksX = (static_cast<uint64_t>(width) + block.width - 1) / block.width;
+  const uint64_t blocksY = (static_cast<uint64_t>(height) + block.height - 1) / block.height;
+  const uint64_t size = blocksX * blocksY * block.bytes;
+  return size <= SIZE_MAX ? static_cast<size_t>(size) : 0;
+}
+
+bool encode(void* dstValue, size_t dstSize, GXTexFmt format, uint32_t guestWidth, uint32_t guestHeight,
+            const uint8_t* hostPixels, uint32_t hostWidth, uint32_t hostHeight, uint32_t hostBytesPerRow,
+            HostPixelOrder order) noexcept {
+  Layout layout{};
+  BlockInfo block{};
+  const size_t required = encoded_size(format, guestWidth, guestHeight);
+  if (dstValue == nullptr || hostPixels == nullptr || required == 0 || dstSize < required || hostWidth == 0 ||
+      hostHeight == 0 || hostBytesPerRow < hostWidth * 4 || !describe(format, layout, block)) {
+    return false;
+  }
+
+  auto* dst = static_cast<uint8_t*>(dstValue);
+  std::memset(dst, 0, required);
+  const uint32_t blocksX = (guestWidth + block.width - 1) / block.width;
+  const uint32_t blocksY = (guestHeight + block.height - 1) / block.height;
+
+  for (uint32_t blockY = 0; blockY < blocksY; ++blockY) {
+    for (uint32_t blockX = 0; blockX < blocksX; ++blockX) {
+      uint8_t* blockDst = dst + (static_cast<size_t>(blockY) * blocksX + blockX) * block.bytes;
+      if (layout == Layout::RGBA8) {
+        uint8_t* ar = blockDst;
+        uint8_t* gb = blockDst + 32;
+        for (uint32_t y = 0; y < 4; ++y) {
+          for (uint32_t x = 0; x < 4; ++x) {
+            const Pixel pixel = read_pixel(hostPixels, hostWidth, hostHeight, hostBytesPerRow, order, blockX * 4 + x,
+                                           blockY * 4 + y, guestWidth, guestHeight);
+            *ar++ = pixel.a;
+            *ar++ = pixel.r;
+            *gb++ = pixel.g;
+            *gb++ = pixel.b;
+          }
+        }
+        continue;
+      }
+
+      uint8_t* out = blockDst;
+      for (uint32_t y = 0; y < block.height; ++y) {
+        if (layout == Layout::I4) {
+          for (uint32_t x = 0; x < block.width; x += 2) {
+            const Pixel first =
+                read_pixel(hostPixels, hostWidth, hostHeight, hostBytesPerRow, order, blockX * block.width + x,
+                           blockY * block.height + y, guestWidth, guestHeight);
+            const Pixel second =
+                read_pixel(hostPixels, hostWidth, hostHeight, hostBytesPerRow, order, blockX * block.width + x + 1,
+                           blockY * block.height + y, guestWidth, guestHeight);
+            *out++ = static_cast<uint8_t>((first.r & 0xf0) | (second.r >> 4));
+          }
+          continue;
+        }
+
+        for (uint32_t x = 0; x < block.width; ++x) {
+          const Pixel pixel = read_pixel(hostPixels, hostWidth, hostHeight, hostBytesPerRow, order,
+                                         blockX * block.width + x, blockY * block.height + y, guestWidth, guestHeight);
+          switch (layout) {
+          case Layout::I8:
+            *out++ = pixel.r;
+            break;
+          case Layout::IA4:
+            *out++ = static_cast<uint8_t>((pixel.a & 0xf0) | (pixel.r >> 4));
+            break;
+          case Layout::IA8:
+            *out++ = pixel.a;
+            *out++ = pixel.r;
+            break;
+          case Layout::RGB565: {
+            const uint16_t packed =
+                static_cast<uint16_t>(((pixel.r >> 3) << 11) | ((pixel.g >> 2) << 5) | (pixel.b >> 3));
+            write_be16(out, packed);
+            break;
+          }
+          case Layout::RGB5A3: {
+            const uint16_t packed =
+                pixel.a >= 224
+                    ? static_cast<uint16_t>(0x8000 | ((pixel.r >> 3) << 10) | ((pixel.g >> 3) << 5) | (pixel.b >> 3))
+                    : static_cast<uint16_t>(((pixel.a >> 5) << 12) | ((pixel.r >> 4) << 8) | ((pixel.g >> 4) << 4) |
+                                            (pixel.b >> 4));
+            write_be16(out, packed);
+            break;
+          }
+          default:
+            return false;
+          }
+        }
+      }
+    }
+  }
+  return true;
+}
+
+} // namespace aurora::gfx::efb_ram
diff --git a/aurora-main/lib/gfx/efb_ram_encoder.hpp b/aurora-main/lib/gfx/efb_ram_encoder.hpp
new file mode 100644
index 0000000..85982b4
--- /dev/null
+++ b/aurora-main/lib/gfx/efb_ram_encoder.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include <dolphin/gx/GXEnum.h>
+
+#include <cstddef>
+#include <cstdint>
+
+namespace aurora::gfx::efb_ram {
+
+enum class HostPixelOrder : uint8_t {
+  RGBA,
+  BGRA,
+};
+
+bool supports_format(GXTexFmt format) noexcept;
+size_t encoded_size(GXTexFmt format, uint32_t width, uint32_t height) noexcept;
+
+// Encodes a decoded host texture back into the tiled layout a GX EFB copy writes. Host dimensions
+// may be internally scaled; guest dimensions are always the native copy dimensions.
+bool encode(void* dst, size_t dstSize, GXTexFmt format, uint32_t guestWidth, uint32_t guestHeight,
+            const uint8_t* hostPixels, uint32_t hostWidth, uint32_t hostHeight, uint32_t hostBytesPerRow,
+            HostPixelOrder order) noexcept;
+
+} // namespace aurora::gfx::efb_ram
diff --git a/aurora-main/lib/gfx/pipeline_cache.cpp b/aurora-main/lib/gfx/pipeline_cache.cpp
new file mode 100644
index 0000000..83358ff
--- /dev/null
+++ b/aurora-main/lib/gfx/pipeline_cache.cpp
@@ -0,0 +1,1300 @@
+#include "pipeline_cache.hpp"
+
+#include "clear.hpp"
+#include "../gx/pipeline.hpp"
+#include "../sqlite_utils.hpp"
+#include "../webgpu/gpu.hpp"
+
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <deque>
+#include <filesystem>
+#include <limits>
+#include <mutex>
+#include <thread>
+#include <vector>
+
+#include <SDL3/SDL_iostream.h>
+#include <absl/container/flat_hash_map.h>
+#include <absl/container/flat_hash_set.h>
+#include <fmt/format.h>
+#include <tracy/Tracy.hpp>
+
+namespace aurora::gfx {
+static Module Log("aurora::gfx::pipeline_cache");
+
+constexpr int PipelineCacheSchema = 1;
+constexpr const char* InitialPipelineCacheName = "initial_pipeline_cache.db";
+constexpr const char* SdlVfsName = "aurora_pipeline_cache_sdl_vfs";
+
+struct CachedPipeline {
+  wgpu::RenderPipeline pipeline;
+  uint32_t firstFrameUsed = UINT32_MAX;
+};
+
+struct PendingPipeline {
+  PipelineRef hash;
+  uint32_t firstFrameUsed = UINT32_MAX;
+  NewPipelineCallback create;
+};
+
+struct PipelineCacheWrite {
+  ShaderType type;
+  PipelineRef hash;
+  uint32_t configVersion;
+  ByteBuffer config;
+  uint32_t firstFrameUsed = UINT32_MAX;
+};
+
+struct SdlVfsSqliteFile {
+  sqlite3_file base;
+  SDL_IOStream* io = nullptr;
+};
+
+static std::mutex g_pipelineMutex;
+static bool g_hasPipelineThread = false;
+static bool g_pipelineFrameActive = false;
+static std::atomic_bool g_skipUnreadyGxPipelines = false;
+static size_t g_pipelinesPerFrame = 0;
+// Keep first-use compilation bounded. The render command stream remains ordered;
+// it waits for a queued pipeline only when the corresponding draw is consumed.
+constexpr size_t MaxQueuedPipelineBuilds = 256;
+// First-use compilation works best as a short parallel burst. Leave two logical processors for the
+// render and game threads, and cap large hosts to limit driver submissions and memory use.
+constexpr size_t ReservedLogicalProcessors = 2;
+constexpr size_t MaxPipelineWorkers = 22;
+// Cached clear and GX pipelines are prewarmed using the full worker pool.
+constexpr size_t MaxBackgroundPipelineWorkers = MaxPipelineWorkers;
+// For synchronous pipeline fallback (OpenGL)
+#ifdef NDEBUG
+constexpr size_t BuildPipelinesPerFrame = 5;
+#else
+constexpr size_t BuildPipelinesPerFrame = 1;
+#endif
+static std::vector<std::thread> g_pipelineThreads;
+static bool g_pipelineThreadEnd = false;
+static size_t g_activeBackgroundPipelineWorkers = 0;
+static std::condition_variable g_pipelineCv;
+static absl::flat_hash_map<PipelineRef, CachedPipeline> g_pipelines;
+static std::deque<PendingPipeline> g_priorityPipelines;
+static std::deque<PendingPipeline> g_backgroundPipelines;
+static absl::flat_hash_set<PipelineRef> g_pendingPipelines;
+
+static sqlite3* g_pipelineCacheDb = nullptr;
+static sqlite3_stmt* g_pipelineCacheLoadStmt = nullptr;
+static sqlite3_stmt* g_pipelineCacheUpsertStmt = nullptr;
+static bool g_pipelineCacheBroken = false;
+static std::thread g_pipelineCacheWriterThread;
+static std::condition_variable g_pipelineCacheWriterCv;
+static std::mutex g_pipelineCacheWriterMutex;
+static std::deque<PipelineCacheWrite> g_pipelineCacheWriteQueue;
+static absl::flat_hash_set<PipelineRef> g_pipelineCachePendingWrites;
+static bool g_pipelineCacheWriterStop = false;
+static int g_sdlVfsRegisterResult = SQLITE_ERROR;
+
+static SdlVfsSqliteFile* sdl_vfs_file(sqlite3_file* file) {
+  return reinterpret_cast<SdlVfsSqliteFile*>(file);
+}
+
+static sqlite3_vfs* default_vfs(sqlite3_vfs* vfs) {
+  return static_cast<sqlite3_vfs*>(vfs->pAppData);
+}
+
+static int sdl_vfs_close(sqlite3_file* file) {
+  auto* vfsFile = sdl_vfs_file(file);
+  if (vfsFile->io != nullptr) {
+    SDL_CloseIO(vfsFile->io);
+    vfsFile->io = nullptr;
+  }
+  return SQLITE_OK;
+}
+
+static int sdl_vfs_read(sqlite3_file* file, void* buffer, int amount, sqlite3_int64 offset) {
+  auto* vfsFile = sdl_vfs_file(file);
+  if (vfsFile->io == nullptr || offset < 0 || amount < 0) {
+    return SQLITE_IOERR_READ;
+  }
+  if (SDL_SeekIO(vfsFile->io, offset, SDL_IO_SEEK_SET) < 0) {
+    return SQLITE_IOERR_SEEK;
+  }
+
+  auto* dst = static_cast<uint8_t*>(buffer);
+  int total = 0;
+  while (total < amount) {
+    const size_t read = SDL_ReadIO(vfsFile->io, dst + total, static_cast<size_t>(amount - total));
+    if (read == 0) {
+      if (SDL_GetIOStatus(vfsFile->io) == SDL_IO_STATUS_EOF) {
+        std::memset(dst + total, 0, static_cast<size_t>(amount - total));
+        return SQLITE_IOERR_SHORT_READ;
+      }
+      return SQLITE_IOERR_READ;
+    }
+    if (read > static_cast<size_t>(std::numeric_limits<int>::max() - total)) {
+      return SQLITE_IOERR_READ;
+    }
+    total += static_cast<int>(read);
+  }
+  return SQLITE_OK;
+}
+
+static int sdl_vfs_write(sqlite3_file*, const void*, int, sqlite3_int64) { return SQLITE_READONLY; }
+
+static int sdl_vfs_truncate(sqlite3_file*, sqlite3_int64) { return SQLITE_READONLY; }
+
+static int sdl_vfs_sync(sqlite3_file*, int) { return SQLITE_OK; }
+
+static int sdl_vfs_file_size(sqlite3_file* file, sqlite3_int64* size) {
+  auto* vfsFile = sdl_vfs_file(file);
+  if (vfsFile->io == nullptr || size == nullptr) {
+    return SQLITE_IOERR_FSTAT;
+  }
+
+  const auto ioSize = SDL_GetIOSize(vfsFile->io);
+  if (ioSize < 0) {
+    return SQLITE_IOERR_FSTAT;
+  }
+  *size = static_cast<sqlite3_int64>(ioSize);
+  return SQLITE_OK;
+}
+
+static int sdl_vfs_lock(sqlite3_file*, int) { return SQLITE_OK; }
+
+static int sdl_vfs_unlock(sqlite3_file*, int) { return SQLITE_OK; }
+
+static int sdl_vfs_check_reserved_lock(sqlite3_file*, int* reserved) {
+  if (reserved != nullptr) {
+    *reserved = 0;
+  }
+  return SQLITE_OK;
+}
+
+static int sdl_vfs_file_control(sqlite3_file*, int op, void* arg) {
+  switch (op) {
+  case SQLITE_FCNTL_LOCKSTATE:
+    *static_cast<int*>(arg) = SQLITE_LOCK_NONE;
+    return SQLITE_OK;
+  case SQLITE_FCNTL_HAS_MOVED:
+    *static_cast<int*>(arg) = 0;
+    return SQLITE_OK;
+  case SQLITE_FCNTL_SIZE_HINT:
+    return SQLITE_OK;
+  default:
+    return SQLITE_NOTFOUND;
+  }
+}
+
+static int sdl_vfs_sector_size(sqlite3_file*) { return 4096; }
+
+static int sdl_vfs_device_characteristics(sqlite3_file*) {
+  return SQLITE_IOCAP_IMMUTABLE | SQLITE_IOCAP_UNDELETABLE_WHEN_OPEN;
+}
+
+static constexpr sqlite3_io_methods SdlVfsIoMethods{
+    .iVersion = 1,
+    .xClose = sdl_vfs_close,
+    .xRead = sdl_vfs_read,
+    .xWrite = sdl_vfs_write,
+    .xTruncate = sdl_vfs_truncate,
+    .xSync = sdl_vfs_sync,
+    .xFileSize = sdl_vfs_file_size,
+    .xLock = sdl_vfs_lock,
+    .xUnlock = sdl_vfs_unlock,
+    .xCheckReservedLock = sdl_vfs_check_reserved_lock,
+    .xFileControl = sdl_vfs_file_control,
+    .xSectorSize = sdl_vfs_sector_size,
+    .xDeviceCharacteristics = sdl_vfs_device_characteristics,
+};
+
+static int sdl_vfs_open(sqlite3_vfs*, sqlite3_filename name, sqlite3_file* file, int flags, int* outFlags) {
+  auto* vfsFile = sdl_vfs_file(file);
+  vfsFile->base.pMethods = nullptr;
+  vfsFile->io = nullptr;
+
+  if (name == nullptr || (flags & SQLITE_OPEN_READWRITE) != 0 || (flags & SQLITE_OPEN_READONLY) == 0) {
+    return SQLITE_CANTOPEN;
+  }
+
+  vfsFile->io = SDL_IOFromFile(name, "rb");
+  if (vfsFile->io == nullptr) {
+    return SQLITE_CANTOPEN;
+  }
+
+  vfsFile->base.pMethods = &SdlVfsIoMethods;
+  if (outFlags != nullptr) {
+    *outFlags = SQLITE_OPEN_READONLY;
+  }
+  return SQLITE_OK;
+}
+
+static int sdl_vfs_delete(sqlite3_vfs*, const char*, int) { return SQLITE_READONLY; }
+
+static int sdl_vfs_access(sqlite3_vfs*, const char* name, int flags, int* result) {
+  if (result == nullptr) {
+    return SQLITE_IOERR_ACCESS;
+  }
+  if (name == nullptr || flags == SQLITE_ACCESS_READWRITE) {
+    *result = 0;
+    return SQLITE_OK;
+  }
+
+  auto* io = SDL_IOFromFile(name, "rb");
+  *result = io != nullptr ? 1 : 0;
+  if (io != nullptr) {
+    SDL_CloseIO(io);
+  }
+  return SQLITE_OK;
+}
+
+static int sdl_vfs_full_pathname(sqlite3_vfs*, const char* name, int outSize, char* out) {
+  if (name == nullptr || out == nullptr || outSize <= 0) {
+    return SQLITE_CANTOPEN;
+  }
+  sqlite3_snprintf(outSize, out, "%s", name);
+  return SQLITE_OK;
+}
+
+static void* sdl_vfs_dl_open(sqlite3_vfs*, const char*) { return nullptr; }
+
+static void sdl_vfs_dl_error(sqlite3_vfs*, int bytes, char* message) {
+  if (message != nullptr && bytes > 0) {
+    sqlite3_snprintf(bytes, message, "%s", "Dynamic loading is unsupported");
+  }
+}
+
+static void (*sdl_vfs_dl_sym(sqlite3_vfs*, void*, const char*))(void) { return nullptr; }
+
+static void sdl_vfs_dl_close(sqlite3_vfs*, void*) {}
+
+static int sdl_vfs_randomness(sqlite3_vfs* vfs, int bytes, char* out) {
+  if (auto* base = default_vfs(vfs); base != nullptr && base->xRandomness != nullptr) {
+    return base->xRandomness(base, bytes, out);
+  }
+  if (out != nullptr && bytes > 0) {
+    std::memset(out, 0, static_cast<size_t>(bytes));
+  }
+  return bytes;
+}
+
+static int sdl_vfs_sleep(sqlite3_vfs* vfs, int microseconds) {
+  if (auto* base = default_vfs(vfs); base != nullptr && base->xSleep != nullptr) {
+    return base->xSleep(base, microseconds);
+  }
+  return microseconds;
+}
+
+static int sdl_vfs_current_time(sqlite3_vfs* vfs, double* time) {
+  if (auto* base = default_vfs(vfs); base != nullptr && base->xCurrentTime != nullptr) {
+    return base->xCurrentTime(base, time);
+  }
+  if (time != nullptr) {
+    *time = 2440587.5;
+  }
+  return SQLITE_OK;
+}
+
+static int sdl_vfs_get_last_error(sqlite3_vfs*, int, char*) { return SQLITE_OK; }
+
+static bool register_sdl_vfs() {
+  static std::once_flag registerOnce;
+  std::call_once(registerOnce, [] {
+    auto* baseVfs = sqlite3_vfs_find(nullptr);
+    static sqlite3_vfs sdlVfs{
+        .iVersion = 1,
+        .szOsFile = static_cast<int>(sizeof(SdlVfsSqliteFile)),
+        .mxPathname = 4096,
+        .pNext = nullptr,
+        .zName = SdlVfsName,
+        .pAppData = baseVfs,
+        .xOpen = sdl_vfs_open,
+        .xDelete = sdl_vfs_delete,
+        .xAccess = sdl_vfs_access,
+        .xFullPathname = sdl_vfs_full_pathname,
+        .xDlOpen = sdl_vfs_dl_open,
+        .xDlError = sdl_vfs_dl_error,
+        .xDlSym = sdl_vfs_dl_sym,
+        .xDlClose = sdl_vfs_dl_close,
+        .xRandomness = sdl_vfs_randomness,
+        .xSleep = sdl_vfs_sleep,
+        .xCurrentTime = sdl_vfs_current_time,
+        .xGetLastError = sdl_vfs_get_last_error,
+    };
+    g_sdlVfsRegisterResult = sqlite3_vfs_register(&sdlVfs, 0);
+  });
+  return g_sdlVfsRegisterResult == SQLITE_OK;
+}
+
+#if defined(__cpp_lib_atomic_ref)
+static std::atomic_ref queuedPipelines{g_stats.queuedPipelines};
+static std::atomic_ref createdPipelines{g_stats.createdPipelines};
+#else
+struct AtomicStatRef {
+  uint32_t& ref;
+  void operator++() { __atomic_fetch_add(&ref, 1, __ATOMIC_RELAXED); }
+  void operator--() { __atomic_fetch_sub(&ref, 1, __ATOMIC_RELAXED); }
+  void operator++(int) { __atomic_fetch_add(&ref, 1, __ATOMIC_RELAXED); }
+  void operator--(int) { __atomic_fetch_sub(&ref, 1, __ATOMIC_RELAXED); }
+  void operator=(uint32_t val) { __atomic_store_n(&ref, val, __ATOMIC_RELAXED); }
+  uint32_t load() const { return __atomic_load_n(&ref, __ATOMIC_RELAXED); }
+};
+static AtomicStatRef queuedPipelines{g_stats.queuedPipelines};
+static AtomicStatRef createdPipelines{g_stats.createdPipelines};
+#endif
+
+template <typename PipelineConfig>
+static PipelineCacheWrite make_pipeline_cache_write(ShaderType type, PipelineRef hash, const PipelineConfig& config,
+                                                    uint32_t firstFrameUsed) {
+  static_assert(std::has_unique_object_representations_v<PipelineConfig>);
+
+  PipelineCacheWrite write{
+      .type = type,
+      .hash = hash,
+      .configVersion = config.version,
+      .config = ByteBuffer(sizeof(config)),
+      .firstFrameUsed = firstFrameUsed,
+  };
+  std::memcpy(write.config.data(), &config, sizeof(config));
+  return write;
+}
+
+static void enqueue_pipeline_cache_write(PipelineCacheWrite write) {
+  if (g_pipelineCacheBroken || g_pipelineCacheDb == nullptr) {
+    return;
+  }
+
+  {
+    std::lock_guard lock{g_pipelineCacheWriterMutex};
+    if (!g_pipelineCachePendingWrites.insert(write.hash).second) {
+      return;
+    }
+    g_pipelineCacheWriteQueue.emplace_back(std::move(write));
+  }
+  g_pipelineCacheWriterCv.notify_one();
+}
+
+template <typename Queue>
+static auto find_pending_pipeline(Queue& queue, PipelineRef hash) {
+  return std::find_if(queue.begin(), queue.end(), [=](const PendingPipeline& pending) { return pending.hash == hash; });
+}
+
+static PendingPipeline* touch_pending_pipeline(PipelineRef hash, bool prioritize) {
+  auto priorityIt = find_pending_pipeline(g_priorityPipelines, hash);
+  if (priorityIt != g_priorityPipelines.end()) {
+    return &*priorityIt;
+  }
+
+  auto backgroundIt = find_pending_pipeline(g_backgroundPipelines, hash);
+  if (backgroundIt == g_backgroundPipelines.end()) {
+    return nullptr;
+  }
+
+  if (!prioritize) {
+    return &*backgroundIt;
+  }
+
+  g_priorityPipelines.emplace_back(std::move(*backgroundIt));
+  g_backgroundPipelines.erase(backgroundIt);
+  return &g_priorityPipelines.back();
+}
+
+// A persistent resolve is the last chance to complete its producing draw, so promote its queued
+// build ahead of first-use work. One already taken by a worker is compiling and has no entry.
+static bool promote_pending_pipeline_for_wait(PipelineRef hash) {
+  auto priorityIt = find_pending_pipeline(g_priorityPipelines, hash);
+  if (priorityIt != g_priorityPipelines.end()) {
+    if (priorityIt != g_priorityPipelines.begin()) {
+      PendingPipeline pending = std::move(*priorityIt);
+      g_priorityPipelines.erase(priorityIt);
+      g_priorityPipelines.emplace_front(std::move(pending));
+    }
+    return true;
+  }
+
+  auto backgroundIt = find_pending_pipeline(g_backgroundPipelines, hash);
+  if (backgroundIt == g_backgroundPipelines.end()) {
+    return false;
+  }
+  PendingPipeline pending = std::move(*backgroundIt);
+  g_backgroundPipelines.erase(backgroundIt);
+  g_priorityPipelines.emplace_front(std::move(pending));
+  return true;
+}
+
+template <typename Queue>
+static bool remove_pending_pipeline(Queue& queue, PipelineRef hash) {
+  const auto it = find_pending_pipeline(queue, hash);
+  if (it == queue.end()) {
+    return false;
+  }
+  queue.erase(it);
+  return true;
+}
+
+template <typename PipelineConfig>
+static PipelineRef find_pipeline_impl(ShaderType type, const PipelineConfig& config, NewPipelineCallback&& cb,
+                                      bool persist, std::optional<uint32_t> firstFrameUsedOverride) {
+  ZoneScoped;
+
+  const PipelineRef hash = xxh3_hash(config, static_cast<HashType>(type));
+  const uint32_t firstFrameUsed = firstFrameUsedOverride.value_or(current_frame());
+  const bool cachePreload = firstFrameUsedOverride.has_value();
+  bool notifyWorker = false;
+  bool syncCreate = false;
+  bool removedPending = false;
+  bool notifyWaiters = false;
+  std::optional<PipelineCacheWrite> cacheWrite;
+  {
+    std::scoped_lock guard{g_pipelineMutex};
+    const bool deferGxPipeline = g_hasPipelineThread && g_pipelineFrameActive && type == ShaderType::GX;
+    const bool skipUnreadyGxPipeline = deferGxPipeline && g_skipUnreadyGxPipelines.load(std::memory_order_relaxed);
+    auto pipelineIt = g_pipelines.find(hash);
+    if (pipelineIt != g_pipelines.end()) {
+      if (persist && firstFrameUsed < pipelineIt->second.firstFrameUsed) {
+        pipelineIt->second.firstFrameUsed = firstFrameUsed;
+        cacheWrite = make_pipeline_cache_write(type, hash, config, firstFrameUsed);
+      }
+    } else if (g_pendingPipelines.contains(hash)) {
+      auto* pending = touch_pending_pipeline(hash, g_pipelineFrameActive);
+      if (pending != nullptr && firstFrameUsed < pending->firstFrameUsed) {
+        pending->firstFrameUsed = firstFrameUsed;
+        if (persist) {
+          cacheWrite = make_pipeline_cache_write(type, hash, config, firstFrameUsed);
+        }
+      }
+      if (g_pipelineFrameActive && !deferGxPipeline) {
+        syncCreate = true;
+      }
+    } else {
+      if (g_pipelineFrameActive && !deferGxPipeline) {
+        syncCreate = true;
+      } else {
+        if (!cachePreload && deferGxPipeline && g_pendingPipelines.size() >= MaxQueuedPipelineBuilds &&
+            !g_backgroundPipelines.empty()) {
+          g_pendingPipelines.erase(g_backgroundPipelines.back().hash);
+          g_backgroundPipelines.pop_back();
+          --queuedPipelines;
+        }
+
+        // Keep the pipeline queued past the cap rather than compiling synchronously: the recorded draw
+        // references this hash forever, and dropping it baked one-shot EFB copies incomplete.
+        if (!cachePreload && g_pendingPipelines.size() >= MaxQueuedPipelineBuilds && !skipUnreadyGxPipeline) {
+          syncCreate = true;
+        } else {
+          auto& targetQueue = deferGxPipeline ? g_priorityPipelines : g_backgroundPipelines;
+          targetQueue.emplace_back(PendingPipeline{
+              .hash = hash,
+              .firstFrameUsed = firstFrameUsed,
+              .create = std::move(cb),
+          });
+          g_pendingPipelines.insert(hash);
+          ++queuedPipelines;
+          if (persist) {
+            cacheWrite = make_pipeline_cache_write(type, hash, config, firstFrameUsed);
+          }
+          notifyWorker = true;
+        }
+      }
+    }
+  }
+
+  if (syncCreate) {
+    const auto pipeline = cb();
+    {
+      std::scoped_lock guard{g_pipelineMutex};
+      removedPending = remove_pending_pipeline(g_priorityPipelines, hash);
+      removedPending = remove_pending_pipeline(g_backgroundPipelines, hash) || removedPending;
+      if (removedPending) {
+        g_pendingPipelines.erase(hash);
+      }
+      auto [it, inserted] = g_pipelines.try_emplace(hash, CachedPipeline{
+                                                              .pipeline = pipeline,
+                                                              .firstFrameUsed = firstFrameUsed,
+                                                          });
+      if (!inserted && persist && firstFrameUsed < it->second.firstFrameUsed) {
+        it->second.firstFrameUsed = firstFrameUsed;
+      }
+      if (inserted) {
+        ++createdPipelines;
+      }
+      if (persist) {
+        cacheWrite = make_pipeline_cache_write(type, hash, config, firstFrameUsed);
+      }
+      notifyWaiters = true;
+    }
+  }
+
+  if (cacheWrite) {
+    enqueue_pipeline_cache_write(std::move(*cacheWrite));
+  }
+
+  if (notifyWorker) {
+    g_pipelineCv.notify_one();
+  }
+  if (notifyWaiters) {
+    g_pipelineCv.notify_all();
+  }
+  if (removedPending) {
+    --queuedPipelines;
+  }
+
+  return hash;
+}
+
+static void pipeline_cache_abort() {
+  g_pipelineCacheBroken = true;
+  if (g_pipelineCacheLoadStmt != nullptr) {
+    sqlite3_finalize(g_pipelineCacheLoadStmt);
+    g_pipelineCacheLoadStmt = nullptr;
+  }
+  if (g_pipelineCacheUpsertStmt != nullptr) {
+    sqlite3_finalize(g_pipelineCacheUpsertStmt);
+    g_pipelineCacheUpsertStmt = nullptr;
+  }
+  if (g_pipelineCacheDb != nullptr) {
+    sqlite3_close(g_pipelineCacheDb);
+    g_pipelineCacheDb = nullptr;
+  }
+}
+
+static bool write_pipeline_cache_record(const PipelineCacheWrite& write);
+
+static std::string pipeline_cache_seed_path() {
+  if (g_config.resourcesPath == nullptr || g_config.resourcesPath[0] == '\0') {
+    return InitialPipelineCacheName;
+  }
+
+  std::string path{g_config.resourcesPath};
+  if (path.back() != '/' && path.back() != '\\') {
+    path += '/';
+  }
+  path += InitialPipelineCacheName;
+  return path;
+}
+
+static sqlite3* open_pipeline_cache_seed_db(const std::string& path) {
+  if (!register_sdl_vfs()) {
+    Log.warn("Failed to register SDL pipeline cache seed VFS");
+    return nullptr;
+  }
+
+  sqlite3* seedDb = nullptr;
+  const auto ret =
+      sqlite3_open_v2(path.c_str(), &seedDb, SQLITE_OPEN_READONLY | SQLITE_OPEN_PRIVATECACHE, SdlVfsName);
+  if (ret != SQLITE_OK) {
+    if (seedDb != nullptr) {
+      sqlite3_close(seedDb);
+    }
+    Log.info("No bundled initial pipeline cache found at '{}'", path);
+    return nullptr;
+  }
+
+  bool schemaMatch = false;
+  const auto schemaQuery = fmt::format("SELECT 1 FROM aurora_schema WHERE value = {}", PipelineCacheSchema);
+  const auto schemaRet =
+      sqlite::exec(seedDb, schemaQuery.c_str(), [&schemaMatch](int, char**, char**) { schemaMatch = true; });
+  if (schemaRet != SQLITE_OK) {
+    Log.warn("Failed to read bundled pipeline cache schema from '{}': {}", path, sqlite3_errmsg(seedDb));
+    sqlite3_close(seedDb);
+    return nullptr;
+  }
+  if (!schemaMatch) {
+    Log.warn("Bundled pipeline cache '{}' does not use schema version {}", path, PipelineCacheSchema);
+    sqlite3_close(seedDb);
+    return nullptr;
+  }
+
+  return seedDb;
+}
+
+static void seed_pipeline_cache() {
+  if (g_pipelineCacheBroken || g_pipelineCacheDb == nullptr || g_pipelineCacheUpsertStmt == nullptr) {
+    return;
+  }
+
+  const auto seedPath = pipeline_cache_seed_path();
+  sqlite3* seedDb = open_pipeline_cache_seed_db(seedPath);
+  if (seedDb == nullptr) {
+    return;
+  }
+
+  sqlite3_stmt* seedStmt = nullptr;
+  auto closeSeed = [&] {
+    if (seedStmt != nullptr) {
+      sqlite3_finalize(seedStmt);
+      seedStmt = nullptr;
+    }
+    sqlite3_close(seedDb);
+  };
+
+  auto ret = sqlite3_prepare_v3(seedDb,
+                                "SELECT type, hash, config_version, config_size, config, first_frame_used "
+                                "FROM pipeline_cache",
+                                -1, 0, &seedStmt, nullptr);
+  if (ret != SQLITE_OK) {
+    Log.warn("Failed to read bundled pipeline cache rows from '{}': {}", seedPath, sqlite3_errmsg(seedDb));
+    closeSeed();
+    return;
+  }
+
+  bool writeFailed = false;
+  bool readFailed = false;
+  uint32_t mergedRows = 0;
+  uint32_t skippedRows = 0;
+  {
+    sqlite::Transaction tx(g_pipelineCacheDb, Log, true);
+    if (!tx) {
+      Log.error("Failed to begin pipeline cache seed transaction");
+      closeSeed();
+      pipeline_cache_abort();
+      return;
+    }
+
+    while ((ret = sqlite3_step(seedStmt)) == SQLITE_ROW) {
+      const auto typeValue = sqlite3_column_int(seedStmt, 0);
+      const auto hashValue = sqlite3_column_int64(seedStmt, 1);
+      const auto configVersionValue = sqlite3_column_int(seedStmt, 2);
+      const auto configSizeValue = sqlite3_column_int(seedStmt, 3);
+      const auto* configBlob = static_cast<const uint8_t*>(sqlite3_column_blob(seedStmt, 4));
+      const auto configBlobSize = sqlite3_column_bytes(seedStmt, 4);
+      const auto firstFrameUsedValue = sqlite3_column_int64(seedStmt, 5);
+      constexpr auto MaxShaderTypeValue = std::numeric_limits<std::underlying_type_t<ShaderType>>::max();
+      if (typeValue < 0 || typeValue > MaxShaderTypeValue || configVersionValue < 0 || configSizeValue < 0 ||
+          configSizeValue != configBlobSize || (configBlobSize > 0 && configBlob == nullptr) ||
+          firstFrameUsedValue < 0 || firstFrameUsedValue > std::numeric_limits<uint32_t>::max()) {
+        ++skippedRows;
+        continue;
+      }
+
+      PipelineCacheWrite write{
+          .type = static_cast<ShaderType>(typeValue),
+          .hash = static_cast<PipelineRef>(hashValue),
+          .configVersion = static_cast<uint32_t>(configVersionValue),
+          .config = ByteBuffer(static_cast<size_t>(configBlobSize)),
+          .firstFrameUsed = static_cast<uint32_t>(firstFrameUsedValue),
+      };
+      if (configBlobSize > 0) {
+        std::memcpy(write.config.data(), configBlob, static_cast<size_t>(configBlobSize));
+      }
+
+      if (!write_pipeline_cache_record(write)) {
+        writeFailed = true;
+        break;
+      }
+      ++mergedRows;
+    }
+
+    if (!writeFailed && ret != SQLITE_DONE) {
+      Log.warn("Failed while reading bundled pipeline cache rows from '{}': {}", seedPath, sqlite3_errmsg(seedDb));
+      readFailed = true;
+    }
+
+    if (!writeFailed && !readFailed) {
+      tx.commit();
+    }
+  }
+
+  closeSeed();
+
+  if (writeFailed) {
+    pipeline_cache_abort();
+    return;
+  }
+
+  if (!readFailed) {
+    Log.info("Seeded pipeline cache from '{}' ({} rows merged, {} rows skipped)", seedPath, mergedRows,
+             skippedRows);
+  }
+}
+
+static bool prepare_pipeline_cache_db() {
+  if (g_pipelineCacheBroken) {
+    return false;
+  }
+  if (g_pipelineCacheDb != nullptr) {
+    return true;
+  }
+
+  const auto path = (std::filesystem::path{g_config.pipelineCachePath} / "pipeline_cache.db").string();
+  auto ret = sqlite3_open(path.c_str(), &g_pipelineCacheDb);
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to open pipeline cache database: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    pipeline_cache_abort();
+    return false;
+  }
+
+  ret = sqlite::exec(g_pipelineCacheDb, "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL;");
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to set pipeline cache pragmas: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    pipeline_cache_abort();
+    return false;
+  }
+
+  bool schemaFailed = false;
+  {
+    sqlite::Transaction tx(g_pipelineCacheDb, Log, true);
+    if (!tx) {
+      Log.error("Failed to begin pipeline cache schema transaction");
+      schemaFailed = true;
+    } else {
+      ret = sqlite::exec(g_pipelineCacheDb, "CREATE TABLE IF NOT EXISTS aurora_schema(value INTEGER);");
+      if (ret != SQLITE_OK) {
+        Log.error("Failed to create pipeline cache schema table: {}", sqlite3_errmsg(g_pipelineCacheDb));
+        schemaFailed = true;
+      }
+    }
+
+    bool schemaMatch = false;
+    if (!schemaFailed) {
+      const auto schemaQuery = fmt::format("SELECT 1 FROM aurora_schema WHERE value = {}", PipelineCacheSchema);
+      ret = sqlite::exec(g_pipelineCacheDb, schemaQuery.c_str(),
+                         [&schemaMatch](int, char**, char**) { schemaMatch = true; });
+      if (ret != SQLITE_OK) {
+        Log.error("Failed to read pipeline cache schema version: {}", sqlite3_errmsg(g_pipelineCacheDb));
+        schemaFailed = true;
+      }
+    }
+
+    if (!schemaFailed && !schemaMatch) {
+      const auto schemaSql = fmt::format(
+          R"(DROP TABLE IF EXISTS pipeline_cache;
+CREATE TABLE pipeline_cache (
+  type INTEGER NOT NULL,
+  hash INTEGER NOT NULL,
+  config_version INTEGER NOT NULL,
+  config_size INTEGER NOT NULL,
+  config BLOB NOT NULL,
+  first_frame_used INTEGER NOT NULL,
+  PRIMARY KEY (type, hash)
+);
+CREATE INDEX pipeline_cache_load_order_idx
+  ON pipeline_cache(type, config_version, first_frame_used);
+DELETE FROM aurora_schema;
+INSERT INTO aurora_schema VALUES ({});)",
+          PipelineCacheSchema);
+      ret = sqlite::exec(g_pipelineCacheDb, schemaSql.c_str());
+      if (ret != SQLITE_OK) {
+        Log.error("Failed to initialize pipeline cache schema: {}", sqlite3_errmsg(g_pipelineCacheDb));
+        schemaFailed = true;
+      }
+    }
+
+    if (!schemaFailed) {
+      tx.commit();
+    }
+  }
+
+  if (schemaFailed) {
+    pipeline_cache_abort();
+    return false;
+  }
+
+  ret = sqlite3_prepare_v3(g_pipelineCacheDb,
+                           "SELECT hash, config, first_frame_used FROM pipeline_cache "
+                           "WHERE type = ? AND config_version = ? "
+                           "ORDER BY first_frame_used ASC, rowid ASC",
+                           -1, SQLITE_PREPARE_PERSISTENT, &g_pipelineCacheLoadStmt, nullptr);
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to prepare pipeline cache load statement: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    pipeline_cache_abort();
+    return false;
+  }
+
+  ret = sqlite3_prepare_v3(
+      g_pipelineCacheDb,
+      "INSERT INTO pipeline_cache (type, hash, config_version, config_size, config, first_frame_used) "
+      "VALUES (?, ?, ?, ?, ?, ?) "
+      "ON CONFLICT(type, hash) DO UPDATE SET "
+      "config_version = excluded.config_version, "
+      "config_size = excluded.config_size, "
+      "config = excluded.config, "
+      "first_frame_used = MIN(pipeline_cache.first_frame_used, excluded.first_frame_used)",
+      -1, SQLITE_PREPARE_PERSISTENT, &g_pipelineCacheUpsertStmt, nullptr);
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to prepare pipeline cache upsert statement: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    pipeline_cache_abort();
+    return false;
+  }
+
+  seed_pipeline_cache();
+  if (g_pipelineCacheBroken) {
+    return false;
+  }
+
+  return true;
+}
+
+static void prune_old_pipeline_cache_versions() {
+  if (!prepare_pipeline_cache_db()) {
+    return;
+  }
+
+  const auto clearDelete = fmt::format("DELETE FROM pipeline_cache WHERE type = {} AND config_version < {}",
+                                       underlying(ShaderType::Clear), clear::ClearPipelineConfigVersion);
+  auto ret = sqlite::exec(g_pipelineCacheDb, clearDelete.c_str());
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to prune clear pipeline cache rows: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    pipeline_cache_abort();
+    return;
+  }
+
+  const auto gxDelete = fmt::format("DELETE FROM pipeline_cache WHERE type = {} AND config_version < {}",
+                                    underlying(ShaderType::GX), gx::GXPipelineConfigVersion);
+  ret = sqlite::exec(g_pipelineCacheDb, gxDelete.c_str());
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to prune GX pipeline cache rows: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    pipeline_cache_abort();
+  }
+}
+
+static bool write_pipeline_cache_record(const PipelineCacheWrite& write) {
+  const auto fail = [&]() {
+    sqlite3_reset(g_pipelineCacheUpsertStmt);
+    sqlite3_clear_bindings(g_pipelineCacheUpsertStmt);
+    return false;
+  };
+
+  auto ret = sqlite3_bind_int(g_pipelineCacheUpsertStmt, 1, underlying(write.type));
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to bind pipeline cache type: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    return fail();
+  }
+  ret = sqlite3_bind_int64(g_pipelineCacheUpsertStmt, 2, static_cast<sqlite3_int64>(write.hash));
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to bind pipeline cache hash: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    return fail();
+  }
+  ret = sqlite3_bind_int(g_pipelineCacheUpsertStmt, 3, static_cast<int>(write.configVersion));
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to bind pipeline cache config version: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    return fail();
+  }
+  ret = sqlite3_bind_int(g_pipelineCacheUpsertStmt, 4, static_cast<int>(write.config.size()));
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to bind pipeline cache config size: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    return fail();
+  }
+  ret = sqlite3_bind_blob64(g_pipelineCacheUpsertStmt, 5, write.config.data(), write.config.size(), SQLITE_TRANSIENT);
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to bind pipeline cache config blob: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    return fail();
+  }
+  ret = sqlite3_bind_int64(g_pipelineCacheUpsertStmt, 6, static_cast<sqlite3_int64>(write.firstFrameUsed));
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to bind pipeline cache first-frame-used: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    return fail();
+  }
+
+  ret = sqlite3_step(g_pipelineCacheUpsertStmt);
+  if (ret != SQLITE_DONE) {
+    Log.error("Failed to upsert pipeline cache row: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    return fail();
+  }
+
+  sqlite3_reset(g_pipelineCacheUpsertStmt);
+  sqlite3_clear_bindings(g_pipelineCacheUpsertStmt);
+  return true;
+}
+
+static void pipeline_cache_writer() {
+#ifdef TRACY_ENABLE
+  tracy::SetThreadName("Pipeline cache writer thread");
+#endif
+
+  while (true) {
+    std::deque<PipelineCacheWrite> batch;
+    {
+      std::unique_lock lock{g_pipelineCacheWriterMutex};
+      g_pipelineCacheWriterCv.wait(lock,
+                                   [] { return g_pipelineCacheWriterStop || !g_pipelineCacheWriteQueue.empty(); });
+      if (g_pipelineCacheWriterStop && g_pipelineCacheWriteQueue.empty()) {
+        return;
+      }
+      batch.swap(g_pipelineCacheWriteQueue);
+      g_pipelineCachePendingWrites.clear();
+    }
+
+    bool writeFailed = false;
+    {
+      sqlite::Transaction tx(g_pipelineCacheDb, Log, true);
+      if (!tx) {
+        Log.error("Failed to begin pipeline cache write transaction");
+        writeFailed = true;
+      } else {
+        for (const auto& write : batch) {
+          if (!write_pipeline_cache_record(write)) {
+            writeFailed = true;
+            break;
+          }
+        }
+
+        if (!writeFailed) {
+          tx.commit();
+        }
+      }
+    }
+
+    if (writeFailed) {
+      pipeline_cache_abort();
+      return;
+    }
+  }
+}
+
+// Boot prewarm telemetry: how long the cached-recipe rebuild takes and how well the
+// Dawn blob cache served it. Logged once, when the launch queue first drains.
+static std::atomic_bool g_prewarmActive{false};
+static std::chrono::steady_clock::time_point g_prewarmStart{};
+static uint32_t g_prewarmCount = 0;
+
+static void note_pipeline_queue_drained() {
+  // Every drained burst (boot prewarm, later first-use compiles) is a natural point to
+  // persist the monolithic Vulkan pipeline cache; Dawn skips the write when it is clean.
+  webgpu::serialize_pipeline_caches();
+  if (!g_prewarmActive.exchange(false, std::memory_order_acq_rel)) {
+    return;
+  }
+  const auto elapsed =
+      std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::steady_clock::now() - g_prewarmStart);
+  const auto stats = webgpu::blob_cache_stats();
+  Log.info("Pipeline prewarm finished: {} pipelines in {:.1f} s (Dawn blob cache: {}/{} hits, {} stores, {:.1f} MiB "
+           "loaded)",
+           g_prewarmCount, elapsed.count() / 1000.0, stats.hits, stats.lookups, stats.stores,
+           static_cast<double>(stats.hitBytes) / (1024.0 * 1024.0));
+}
+
+static void compile_pending_pipeline(PendingPipeline pending) {
+  auto result = pending.create();
+  {
+    std::lock_guard lock{g_pipelineMutex};
+    const auto [_, inserted] = g_pipelines.try_emplace(pending.hash, CachedPipeline{
+                                                                         .pipeline = std::move(result),
+                                                                         .firstFrameUsed = pending.firstFrameUsed,
+                                                                     });
+    g_pendingPipelines.erase(pending.hash);
+    if (inserted) {
+      ++createdPipelines;
+    }
+  }
+  g_pipelineCv.notify_all();
+  --queuedPipelines;
+  if (queuedPipelines.load() == 0) {
+    note_pipeline_queue_drained();
+  }
+}
+
+static void pipeline_worker() {
+#ifdef TRACY_ENABLE
+  tracy::SetThreadName("Pipeline compilation thread");
+#endif
+
+  while (true) {
+    PendingPipeline pending;
+    bool background = false;
+    {
+      std::unique_lock lock{g_pipelineMutex};
+      g_pipelineCv.wait(lock, [] {
+        return !g_priorityPipelines.empty() ||
+               (!g_backgroundPipelines.empty() &&
+                g_activeBackgroundPipelineWorkers < MaxBackgroundPipelineWorkers) ||
+               g_pipelineThreadEnd;
+      });
+      if (g_pipelineThreadEnd) {
+        return;
+      }
+      background = g_priorityPipelines.empty();
+      auto& source = background ? g_backgroundPipelines : g_priorityPipelines;
+      pending = std::move(source.front());
+      source.pop_front();
+      if (background) {
+        ++g_activeBackgroundPipelineWorkers;
+      }
+    }
+    compile_pending_pipeline(std::move(pending));
+    if (background) {
+      {
+        std::lock_guard lock{g_pipelineMutex};
+        --g_activeBackgroundPipelineWorkers;
+      }
+      g_pipelineCv.notify_all();
+    }
+  }
+}
+
+static void build_synchronous_pipelines_for_frame() {
+  while (g_pipelinesPerFrame < BuildPipelinesPerFrame) {
+    PendingPipeline pending;
+    {
+      std::lock_guard lock{g_pipelineMutex};
+      if (g_priorityPipelines.empty() && g_backgroundPipelines.empty()) {
+        return;
+      }
+      auto& source = !g_priorityPipelines.empty() ? g_priorityPipelines : g_backgroundPipelines;
+      pending = std::move(source.front());
+      source.pop_front();
+    }
+    compile_pending_pipeline(std::move(pending));
+    ++g_pipelinesPerFrame;
+  }
+}
+
+static size_t pipeline_worker_count() {
+  const size_t logicalProcessors = std::thread::hardware_concurrency();
+  if (logicalProcessors == 0) {
+    return 1;
+  }
+  const size_t availableWorkers =
+      logicalProcessors > ReservedLogicalProcessors ? logicalProcessors - ReservedLogicalProcessors : 1;
+  return std::clamp(availableWorkers, size_t{1}, MaxPipelineWorkers);
+}
+
+template <typename PipelineConfig, typename CreateFn>
+static void load_pipeline_cache_entries(ShaderType type, uint32_t configVersion, CreateFn&& create) {
+  if (!prepare_pipeline_cache_db()) {
+    return;
+  }
+
+  auto ret = sqlite3_bind_int(g_pipelineCacheLoadStmt, 1, underlying(type));
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to bind pipeline cache load type: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    pipeline_cache_abort();
+    return;
+  }
+  ret = sqlite3_bind_int(g_pipelineCacheLoadStmt, 2, static_cast<int>(configVersion));
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to bind pipeline cache load config version: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    pipeline_cache_abort();
+    return;
+  }
+
+  while ((ret = sqlite3_step(g_pipelineCacheLoadStmt)) == SQLITE_ROW) {
+    const auto storedHash = static_cast<PipelineRef>(sqlite3_column_int64(g_pipelineCacheLoadStmt, 0));
+    const auto* configBlob = static_cast<const uint8_t*>(sqlite3_column_blob(g_pipelineCacheLoadStmt, 1));
+    const auto configSize = sqlite3_column_bytes(g_pipelineCacheLoadStmt, 1);
+    const auto firstFrameUsed = static_cast<uint32_t>(sqlite3_column_int64(g_pipelineCacheLoadStmt, 2));
+    if (configSize != static_cast<int>(sizeof(PipelineConfig)) || (configSize != 0 && configBlob == nullptr)) {
+      continue;
+    }
+    if (xxh3_hash_s(configBlob, static_cast<size_t>(configSize), static_cast<HashType>(type)) != storedHash) {
+      Log.warn("Skipping cached pipeline configuration with mismatched content hash");
+      continue;
+    }
+    PipelineConfig config;
+    std::memcpy(&config, configBlob, sizeof(config));
+    if (config.version != configVersion) {
+      continue;
+    }
+    if constexpr (std::is_same_v<PipelineConfig, gx::PipelineConfig>) {
+      if (!gx::valid_pipeline_config(config)) {
+        Log.warn("Skipping invalid cached GX pipeline configuration");
+        continue;
+      }
+    }
+
+    find_pipeline_impl(type, config, [=] { return create(config); }, false, firstFrameUsed);
+  }
+
+  if (ret != SQLITE_DONE) {
+    Log.error("Failed to read pipeline cache rows: {}", sqlite3_errmsg(g_pipelineCacheDb));
+    pipeline_cache_abort();
+  }
+
+  sqlite3_reset(g_pipelineCacheLoadStmt);
+  sqlite3_clear_bindings(g_pipelineCacheLoadStmt);
+}
+
+static void load_pipeline_cache() {
+  if (!prepare_pipeline_cache_db()) {
+    return;
+  }
+  prune_old_pipeline_cache_versions();
+  if (g_pipelineCacheBroken) {
+    return;
+  }
+  load_pipeline_cache_entries<clear::PipelineConfig>(ShaderType::Clear, clear::ClearPipelineConfigVersion,
+                                                     clear::create_pipeline);
+  load_pipeline_cache_entries<gx::PipelineConfig>(ShaderType::GX, gx::GXPipelineConfigVersion,
+                                                  gx::create_pipeline);
+  const auto queued = queuedPipelines.load();
+  if (queued > 0) {
+    g_prewarmCount = queued;
+    g_prewarmStart = std::chrono::steady_clock::now();
+    g_prewarmActive.store(true, std::memory_order_release);
+  }
+}
+
+static void start_pipeline_cache_writer() {
+  if (!prepare_pipeline_cache_db()) {
+    return;
+  }
+
+  g_pipelineCacheWriterStop = false;
+  g_pipelineCacheWriterThread = std::thread(pipeline_cache_writer);
+}
+
+static void stop_pipeline_cache_writer() {
+  if (g_pipelineCacheWriterThread.joinable()) {
+    {
+      std::lock_guard lock{g_pipelineCacheWriterMutex};
+      g_pipelineCacheWriterStop = true;
+    }
+    g_pipelineCacheWriterCv.notify_one();
+    g_pipelineCacheWriterThread.join();
+  } else {
+    g_pipelineCacheWriterStop = false;
+  }
+
+  g_pipelineCacheWriteQueue.clear();
+  g_pipelineCachePendingWrites.clear();
+}
+
+template <>
+PipelineRef find_pipeline(ShaderType type, const clear::PipelineConfig& config, NewPipelineCallback&& cb) {
+  return find_pipeline_impl(type, config, std::move(cb), true, std::nullopt);
+}
+
+template <>
+PipelineRef find_pipeline(ShaderType type, const gx::PipelineConfig& config, NewPipelineCallback&& cb) {
+  return find_pipeline_impl(type, config, std::move(cb), true, std::nullopt);
+}
+
+void initialize_pipeline_cache() {
+  g_pipelineCacheBroken = false;
+  g_pipelineCacheWriterStop = false;
+  g_pipelineFrameActive = false;
+  g_pipelineThreadEnd = false;
+  g_activeBackgroundPipelineWorkers = 0;
+
+  if (webgpu::g_backendType == wgpu::BackendType::OpenGL || webgpu::g_backendType == wgpu::BackendType::OpenGLES ||
+      webgpu::g_backendType == wgpu::BackendType::WebGPU) {
+    g_hasPipelineThread = false;
+  } else {
+    g_hasPipelineThread = true;
+    const size_t workerCount = pipeline_worker_count();
+    g_pipelineThreads.reserve(workerCount);
+    for (size_t i = 0; i < workerCount; ++i) {
+      g_pipelineThreads.emplace_back(pipeline_worker);
+    }
+    Log.info("Enabled {} priority pipeline compilation workers ({} background prewarm)",
+             workerCount, MaxBackgroundPipelineWorkers);
+  }
+
+  load_pipeline_cache();
+  if (!g_pipelineCacheBroken) {
+    start_pipeline_cache_writer();
+  }
+}
+
+void shutdown_pipeline_cache() {
+  if (g_hasPipelineThread) {
+    {
+      std::lock_guard lock{g_pipelineMutex};
+      g_pipelineThreadEnd = true;
+    }
+    g_pipelineCv.notify_all();
+    for (auto& thread : g_pipelineThreads) {
+      thread.join();
+    }
+  }
+  g_pipelineThreads.clear();
+  g_hasPipelineThread = false;
+  g_activeBackgroundPipelineWorkers = 0;
+
+  stop_pipeline_cache_writer();
+  pipeline_cache_abort();
+  g_pipelineCacheBroken = false;
+  g_pipelineFrameActive = false;
+  g_pipelinesPerFrame = 0;
+  g_pipelines.clear();
+  g_priorityPipelines.clear();
+  g_backgroundPipelines.clear();
+  g_pendingPipelines.clear();
+
+  queuedPipelines = 0;
+  createdPipelines = 0;
+}
+
+void begin_pipeline_frame() {
+  g_pipelineFrameActive = true;
+  if (!g_hasPipelineThread) {
+    g_pipelinesPerFrame = 0;
+  }
+}
+
+void end_pipeline_frame() {
+  g_pipelineFrameActive = false;
+  if (!g_hasPipelineThread) {
+    build_synchronous_pipelines_for_frame();
+  }
+}
+
+void set_skip_unready_pipelines(bool enabled) noexcept {
+  g_skipUnreadyGxPipelines.store(enabled, std::memory_order_relaxed);
+}
+
+bool skip_unready_pipelines() noexcept { return g_skipUnreadyGxPipelines.load(std::memory_order_relaxed); }
+
+uint32_t queued_pipeline_count() noexcept {
+#if defined(__cpp_lib_atomic_ref)
+  return queuedPipelines.load(std::memory_order_relaxed);
+#else
+  return queuedPipelines.load();
+#endif
+}
+
+bool try_pipeline(PipelineRef ref, wgpu::RenderPipeline& pipeline) {
+  std::scoped_lock lock{g_pipelineMutex};
+  const auto it = g_pipelines.find(ref);
+  if (it == g_pipelines.end()) {
+    return false;
+  }
+  pipeline = it->second.pipeline;
+  return true;
+}
+
+static bool wait_pipeline_impl(PipelineRef ref, wgpu::RenderPipeline& pipeline, bool fatalIfMissing,
+                               bool persistentPass) {
+  std::unique_lock lock{g_pipelineMutex};
+  if (!g_pipelines.contains(ref) && g_pendingPipelines.contains(ref)) {
+    ZoneScopedN("wait_pipeline");
+    const auto finished = [ref] {
+      return g_pipelines.contains(ref) || !g_pendingPipelines.contains(ref) || g_pipelineThreadEnd;
+    };
+    if (persistentPass) {
+      if (promote_pending_pipeline_for_wait(ref)) {
+        g_pipelineCv.notify_all();
+      }
+      // A persistent resolve is the last chance to produce its texture, so timing out here corrupts it
+      // permanently. Only a pass marked requireReadyPipelines takes this path.
+    }
+    g_pipelineCv.wait(lock, finished);
+  }
+  const auto it = g_pipelines.find(ref);
+  if (it == g_pipelines.end()) {
+    lock.unlock();
+    if (fatalIfMissing) {
+      Log.fatal("Pipeline 0x{:x} is unavailable at its ordered draw boundary", static_cast<uint64_t>(ref));
+    }
+    Log.error("Pipeline 0x{:x} is unavailable for a persistent resolve pass; dropping its draw",
+              static_cast<uint64_t>(ref));
+    return false;
+  }
+  pipeline = it->second.pipeline;
+  return true;
+}
+
+bool wait_pipeline(PipelineRef ref, wgpu::RenderPipeline& pipeline) {
+  return wait_pipeline_impl(ref, pipeline, true, false);
+}
+
+bool wait_pipeline_for_persistent_pass(PipelineRef ref, wgpu::RenderPipeline& pipeline) {
+  return wait_pipeline_impl(ref, pipeline, false, true);
+}
+
+} // namespace aurora::gfx
+
+void aurora_set_skip_unready_pipelines(const bool enabled) { aurora::gfx::set_skip_unready_pipelines(enabled); }
+
+bool aurora_get_skip_unready_pipelines() { return aurora::gfx::skip_unready_pipelines(); }
+
+uint32_t aurora_get_queued_pipeline_count() { return aurora::gfx::queued_pipeline_count(); }
diff --git a/aurora-main/lib/gfx/pipeline_cache.hpp b/aurora-main/lib/gfx/pipeline_cache.hpp
new file mode 100644
index 0000000..737e531
--- /dev/null
+++ b/aurora-main/lib/gfx/pipeline_cache.hpp
@@ -0,0 +1,36 @@
+#pragma once
+
+#include "common.hpp"
+
+#include <functional>
+
+namespace aurora::gfx::clear {
+struct PipelineConfig;
+} // namespace aurora::gfx::clear
+
+namespace aurora::gx {
+struct PipelineConfig;
+} // namespace aurora::gx
+
+namespace aurora::gfx {
+
+using NewPipelineCallback = std::function<wgpu::RenderPipeline()>;
+
+void initialize_pipeline_cache();
+void shutdown_pipeline_cache();
+void begin_pipeline_frame();
+void end_pipeline_frame();
+void set_skip_unready_pipelines(bool enabled) noexcept;
+bool skip_unready_pipelines() noexcept;
+uint32_t queued_pipeline_count() noexcept;
+
+template <typename Config>
+PipelineRef find_pipeline(ShaderType type, const Config& config, NewPipelineCallback&& cb);
+
+bool wait_pipeline(PipelineRef ref, wgpu::RenderPipeline& pipeline);
+bool try_pipeline(PipelineRef ref, wgpu::RenderPipeline& pipeline);
+// Waits indefinitely for a draw about to be committed to a persistent texture with no re-issue
+// path. Separate from wait_pipeline so skip-unready mode never becomes blocking for other passes.
+bool wait_pipeline_for_persistent_pass(PipelineRef ref, wgpu::RenderPipeline& pipeline);
+
+} // namespace aurora::gfx
diff --git a/aurora-main/lib/gfx/png_io.cpp b/aurora-main/lib/gfx/png_io.cpp
new file mode 100644
index 0000000..ea3ac62
--- /dev/null
+++ b/aurora-main/lib/gfx/png_io.cpp
@@ -0,0 +1,102 @@
+#include "png_io.hpp"
+
+#include <fstream>
+
+#include "dds_io.hpp"
+#include "png.h"
+#include "../fs_helper.hpp"
+
+static aurora::Module Log("aurora::gfx::png");
+
+namespace aurora::gfx::png {
+
+struct PngStructs {
+  png_structp pStruct;
+  png_infop pInfo;
+  std::ifstream file;
+
+  ~PngStructs() {
+    png_destroy_read_struct(&pStruct, &pInfo, nullptr);
+  }
+};
+
+static void readPngData(png_structp png, png_bytep data, const size_t length) {
+  auto structs = static_cast<PngStructs*>(png_get_io_ptr(png));
+  structs->file.read(reinterpret_cast<char*>(data), static_cast<std::streamsize>(length));
+
+  if (structs->file.eof() || structs->file.fail()) {
+    png_error(png, "file read failed!");
+  }
+}
+
+std::optional<ConvertedTexture>
+load_png_file(const std::filesystem::path& path) noexcept {
+  PngStructs structs{};
+
+  structs.file = std::move(std::ifstream(path, std::ifstream::in | std::ifstream::binary));
+  if (!structs.file) {
+    Log.error("failed to open file: {}", fs_path_to_string(path));
+    return std::nullopt;
+  }
+
+  structs.pStruct = png_create_read_struct(PNG_LIBPNG_VER_STRING, nullptr, nullptr, nullptr);
+  if (!structs.pStruct) {
+    Log.error("png_create_read_struct failed");
+    return std::nullopt;
+  }
+
+  structs.pInfo = png_create_info_struct(structs.pStruct);
+  if (!structs.pInfo) {
+    Log.error("png_create_info_struct failed");
+    return std::nullopt;
+  }
+
+  // I'm scared of putting any locals after that setjmp.
+  std::vector<png_bytep> rowPointers;
+  ByteBuffer imageData{};
+  png_uint_32 width, height;
+  int bit_depth, color_type, interlace_type, compression_type, filter_type;
+  size_t rowBytes;
+  int i;
+
+  if (setjmp(png_jmpbuf(structs.pStruct))) {
+    Log.error("libpng encountered an error");
+    return std::nullopt;
+  }
+
+  png_set_read_fn(structs.pStruct, &structs, readPngData);
+  png_read_info(structs.pStruct, structs.pInfo);
+
+  if (!png_get_IHDR(structs.pStruct, structs.pInfo, &width, &height, &bit_depth, &color_type, &interlace_type, &compression_type, &filter_type)) {
+    Log.error("libpng unable to read IHDR");
+    return std::nullopt;
+  }
+
+  // Always read as RGBA8.
+  png_set_gray_to_rgb(structs.pStruct);
+  png_set_filler(structs.pStruct, 0xFF, PNG_FILLER_AFTER);
+  png_set_expand(structs.pStruct);
+  png_set_strip_16(structs.pStruct);
+
+  png_read_update_info(structs.pStruct, structs.pInfo);
+  rowBytes = png_get_rowbytes(structs.pStruct, structs.pInfo);
+  rowPointers.resize(height);
+
+  imageData.append_zeroes(rowBytes * height);
+
+  for (i = 0; i < height; i++) {
+    rowPointers[i] = imageData.data() + i * rowBytes;
+  }
+
+  png_read_image(structs.pStruct, rowPointers.data());
+  png_read_end(structs.pStruct, nullptr);
+
+  return ConvertedTexture{
+    .format = wgpu::TextureFormat::RGBA8Unorm,
+    .width = width,
+    .height = height,
+    .mips = 1,
+    .data = std::move(imageData)
+  };
+}
+}
\ No newline at end of file
diff --git a/aurora-main/lib/gfx/png_io.hpp b/aurora-main/lib/gfx/png_io.hpp
new file mode 100644
index 0000000..a0f32a7
--- /dev/null
+++ b/aurora-main/lib/gfx/png_io.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include <filesystem>
+#include <optional>
+
+#include "texture_convert.hpp"
+
+namespace aurora::gfx::png {
+std::optional<ConvertedTexture> load_png_file(const std::filesystem::path& path) noexcept;
+}
diff --git a/aurora-main/lib/gfx/tex_copy_conv.cpp b/aurora-main/lib/gfx/tex_copy_conv.cpp
new file mode 100644
index 0000000..c5e8171
--- /dev/null
+++ b/aurora-main/lib/gfx/tex_copy_conv.cpp
@@ -0,0 +1,607 @@
+#include "tex_copy_conv.hpp"
+#include "tex_copy_format_contract.hpp"
+
+#include "../internal.hpp"
+#include "../gx/gx.hpp"
+#include "../webgpu/gpu.hpp"
+#include "texture.hpp"
+#include "../gx/gx_fmt.hpp"
+
+#include <absl/container/flat_hash_map.h>
+
+#include "texture_convert.hpp"
+
+using namespace std::string_literals;
+
+namespace aurora::gfx::tex_copy_conv {
+static Module Log("aurora::gfx::tex_copy_conv");
+
+using webgpu::g_device;
+
+static constexpr std::string_view ShaderPreamble = R"(
+@group(0) @binding(0) var src_samp: sampler;
+@group(0) @binding(1) var src: texture_2d<f32>;
+
+struct UVTransform {
+    offset: vec2f,
+    scale: vec2f,
+    copy_filter: vec4f,
+    flags: vec4f,
+};
+@group(0) @binding(2) var<uniform> uv_xf: UVTransform;
+
+struct VertexOutput {
+    @builtin(position) pos: vec4f,
+    @location(0) uv: vec2f,
+};
+
+var<private> positions: array<vec2f, 3> = array(
+    vec2f(-1.0, 1.0),
+    vec2f(-1.0, -3.0),
+    vec2f(3.0, 1.0),
+);
+var<private> uvs: array<vec2f, 3> = array(
+    vec2f(0.0, 0.0),
+    vec2f(0.0, 2.0),
+    vec2f(2.0, 0.0),
+);
+
+@vertex fn vs_main(@builtin(vertex_index) vi: u32) -> VertexOutput {
+    var out: VertexOutput;
+    out.pos = vec4f(positions[vi], 0.0, 1.0);
+    out.uv = uvs[vi] * uv_xf.scale + uv_xf.offset;
+    return out;
+}
+
+fn intensity(rgb: vec3f) -> f32 {
+    // ITU-R BT.601 luma coefficients
+    return dot(rgb, vec3f(0.257, 0.504, 0.098)) + 16.0 / 255.0;
+}
+
+fn quantize4(v: f32) -> f32 {
+    return floor(v * 16.0) / 15.0;
+}
+
+fn apply_opaque_alpha(c: vec4f) -> vec4f {
+    if (uv_xf.flags.x != 0.0) {
+        return vec4f(c.rgb, 1.0);
+    }
+    return c;
+}
+
+fn clamp_copy_uv(uv: vec2f) -> vec2f {
+    return vec2f(uv.x, clamp(uv.y, uv_xf.flags.z, uv_xf.flags.w));
+}
+
+fn sample_copy(uv: vec2f) -> vec4f {
+    let current = textureSample(src, src_samp, clamp_copy_uv(uv));
+    if (uv_xf.copy_filter.w == 0.0) {
+        return apply_opaque_alpha(current);
+    }
+
+    let tex_size = vec2f(textureDimensions(src));
+    let pixel_size = vec2f(1.0, 1.0) / tex_size;
+    let row_stride = max(uv_xf.flags.y, 1.0);
+    let prev = textureSample(src, src_samp,
+        clamp_copy_uv(uv - vec2f(0.0, pixel_size.y * row_stride)));
+    let next = textureSample(src, src_samp,
+        clamp_copy_uv(uv + vec2f(0.0, pixel_size.y * row_stride)));
+    let prev_rgb = floor(prev.rgb * 255.0 + vec3f(0.5));
+    let current_rgb = floor(current.rgb * 255.0 + vec3f(0.5));
+    let next_rgb = floor(next.rgb * 255.0 + vec3f(0.5));
+    let filtered_rgb = min(
+        floor((prev_rgb * uv_xf.copy_filter.x +
+               current_rgb * uv_xf.copy_filter.y +
+               next_rgb * uv_xf.copy_filter.z) / 64.0),
+        vec3f(255.0));
+    let filtered = vec4f(filtered_rgb / 255.0, current.a);
+    return apply_opaque_alpha(filtered);
+}
+)"sv;
+
+static const std::string DepthShaderPreamble = R"(
+@group(0) @binding(0) var src: texture_depth_2d;
+
+struct UVTransform {
+    offset: vec2f,
+    scale: vec2f,
+    copy_filter: vec4f,
+    flags: vec4f,
+};
+@group(0) @binding(1) var<uniform> uv_xf: UVTransform;
+
+struct VertexOutput {
+    @builtin(position) pos: vec4f,
+    @location(0) uv: vec2f,
+};
+
+var<private> positions: array<vec2f, 3> = array(
+    vec2f(-1.0, 1.0),
+    vec2f(-1.0, -3.0),
+    vec2f(3.0, 1.0),
+);
+var<private> uvs: array<vec2f, 3> = array(
+    vec2f(0.0, 0.0),
+    vec2f(0.0, 2.0),
+    vec2f(2.0, 0.0),
+);
+
+@vertex fn vs_main(@builtin(vertex_index) vi: u32) -> VertexOutput {
+    var out: VertexOutput;
+    out.pos = vec4f(positions[vi], 0.0, 1.0);
+    out.uv = uvs[vi] * uv_xf.scale + uv_xf.offset;
+    return out;
+}
+)"s + (gx::UseReversedZ ? R"(
+fn gx_z24_at_coord(unclamped_coord: vec2i) -> u32 {
+    let tex_size = vec2i(textureDimensions(src));
+    let coord = clamp(unclamped_coord, vec2i(0), tex_size - vec2i(1));
+    let depth = textureLoad(src, coord, 0);
+    return min(u32(clamp(depth, 0.0, 1.0) * 16777216.0), 0x00ffffffu);
+}
+)"s
+                        : R"(
+fn gx_z24_at_coord(unclamped_coord: vec2i) -> u32 {
+    let tex_size = vec2i(textureDimensions(src));
+    let coord = clamp(unclamped_coord, vec2i(0), tex_size - vec2i(1));
+    let depth = textureLoad(src, coord, 0);
+    return min(u32(clamp(depth, 0.0, 1.0) * 16777215.0 + 0.5), 0x00ffffffu);
+}
+)"s) + R"(
+fn gx_depth_bytes(z24: u32) -> vec3u {
+    return vec3u((z24 >> 16u) & 0xffu, (z24 >> 8u) & 0xffu, z24 & 0xffu);
+}
+
+fn clamp_copy_coord(coord: vec2i, tex_size: vec2i) -> vec2i {
+    let top = i32(floor(uv_xf.flags.z * f32(tex_size.y)));
+    let bottom = i32(floor(uv_xf.flags.w * f32(tex_size.y)));
+    return vec2i(coord.x, clamp(coord.y, top, bottom));
+}
+
+fn sample_depth_copy(uv: vec2f) -> vec4u {
+    let tex_size = vec2i(textureDimensions(src));
+    let current_coord = clamp_copy_coord(vec2i(floor(uv * vec2f(tex_size))), tex_size);
+    let current = gx_depth_bytes(gx_z24_at_coord(current_coord));
+    if (uv_xf.copy_filter.w == 0.0) {
+        return vec4u(current, 255u);
+    }
+
+    // GX applies its vertical copy filter to depth copies too, filtering the high/middle/low Z bytes
+    // independently before the destination format picks bytes. Alpha is unfiltered and 255.
+    let row_stride = max(i32(round(uv_xf.flags.y)), 1);
+    let prev = gx_depth_bytes(gx_z24_at_coord(
+        clamp_copy_coord(current_coord - vec2i(0, row_stride), tex_size)));
+    let next = gx_depth_bytes(gx_z24_at_coord(
+        clamp_copy_coord(current_coord + vec2i(0, row_stride), tex_size)));
+    let coefficients = vec3u(uv_xf.copy_filter.xyz);
+    let combined = prev * coefficients.x + current * coefficients.y + next * coefficients.z;
+    var filtered = combined >> vec3u(6u);
+
+    // The copy-filter accumulator wraps to nine bits when coefficients can
+    // produce values at or above 512, before saturating to an eight-bit byte.
+    if (coefficients.x + coefficients.y + coefficients.z >= 128u) {
+        filtered = filtered & vec3u(0x1ffu);
+    }
+    filtered = min(filtered, vec3u(255u));
+    return vec4u(filtered, 255u);
+}
+)"s;
+
+// Passthrough blit (for scaling)
+static constexpr std::string_view FragPassthrough = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    return sample_copy(in.uv);
+}
+)"sv;
+
+// GX_TF_I4: 4-bit intensity -> R8Unorm (quantized)
+static constexpr std::string_view FragI4 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let rgb = sample_copy(in.uv).rgb;
+    let i = quantize4(intensity(rgb));
+    return vec4f(i, i, i, i);
+}
+)"sv;
+
+// GX_TF_I8: 8-bit intensity -> R8Unorm
+static constexpr std::string_view FragI8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let rgb = sample_copy(in.uv).rgb;
+    let i = intensity(rgb);
+    return vec4f(i, i, i, i);
+}
+)"sv;
+
+// GX_TF_IA4: 4-bit intensity + 4-bit alpha -> RG8Unorm
+static constexpr std::string_view FragIA4 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let c = sample_copy(in.uv);
+    let i = quantize4(intensity(c.rgb));
+    let a = quantize4(c.a);
+    return vec4f(i, i, i, a);
+}
+)"sv;
+
+// GX_TF_IA8: 8-bit intensity + 8-bit alpha -> RG8Unorm
+static constexpr std::string_view FragIA8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let c = sample_copy(in.uv);
+    let i = intensity(c.rgb);
+    return vec4f(i, i, i, c.a);
+}
+)"sv;
+
+// GX_TF_RGB565: Blit alpha to 1.0
+static constexpr std::string_view FragRGB565 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let c = sample_copy(in.uv);
+    return vec4f(c.rgb, 1.0);
+}
+)"sv;
+
+// GX_CTF_R4: 4-bit red -> R8Unorm
+static constexpr std::string_view FragR4 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let r = quantize4(sample_copy(in.uv).r);
+    return vec4f(r, r, r, r);
+}
+)"sv;
+
+// GX_CTF_RA4: 4-bit red + 4-bit alpha -> RG8Unorm
+static constexpr std::string_view FragRA4 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let c = sample_copy(in.uv);
+    let r = quantize4(c.r);
+    return vec4f(r, r, r, quantize4(c.a));
+}
+)"sv;
+
+// GX_CTF_RA8: 8-bit red + 8-bit alpha -> RG8Unorm
+static constexpr std::string_view FragRA8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let c = sample_copy(in.uv);
+    return vec4f(c.r, c.r, c.r, c.a);
+}
+)"sv;
+
+// GX_CTF_A8: 8-bit alpha -> R8Unorm
+static constexpr std::string_view FragA8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let a = sample_copy(in.uv).a;
+    return vec4f(a, a, a, a);
+}
+)"sv;
+
+// GX_CTF_R8: 8-bit red -> R8Unorm
+static constexpr std::string_view FragR8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let r = sample_copy(in.uv).r;
+    return vec4f(r, r, r, r);
+}
+)"sv;
+
+// GX_CTF_G8: 8-bit green -> R8Unorm
+static constexpr std::string_view FragG8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let g = sample_copy(in.uv).g;
+    return vec4f(g, g, g, g);
+}
+)"sv;
+
+// GX_CTF_B8: 8-bit blue -> R8Unorm
+static constexpr std::string_view FragB8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let b = sample_copy(in.uv).b;
+    return vec4f(b, b, b, b);
+}
+)"sv;
+
+// GX_CTF_RG8: 8-bit red + 8-bit green -> RG8Unorm
+static constexpr std::string_view FragRG8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let c = sample_copy(in.uv);
+    return vec4f(c.r, c.r, c.r, c.g);
+}
+)"sv;
+
+// GX_CTF_GB8: 8-bit green + 8-bit blue -> RG8Unorm
+static constexpr std::string_view FragGB8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let c = sample_copy(in.uv);
+    return vec4f(c.g, c.g, c.g, c.b);
+}
+)"sv;
+
+// GX_TF_Z8 stores the high-Z byte in I8 storage, which samples as intensity
+// replicated across all four channels.
+static constexpr std::string_view FragZ8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let depth_bytes = sample_depth_copy(in.uv);
+    let z8 = f32(depth_bytes.r) / 255.0;
+    return vec4f(z8, z8, z8, z8);
+}
+)"sv;
+
+// GX_TF_Z16 is the depth RA8 copy path: depth samples have opaque alpha and their high-Z byte in
+// red, so the encoded [A, R] pair samples through IA8 as high-Z intensity with opaque alpha.
+static constexpr std::string_view FragZ16 = detail::Z16FragmentShader;
+
+// GX_TF_Z24X8 uses the RGBA8 storage shape for copies, with the 24-bit depth
+// value available to z-texture sampling through RGB.
+static constexpr std::string_view FragZ24X8 = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let depth_bytes = sample_depth_copy(in.uv);
+    let r = f32(depth_bytes.r) / 255.0;
+    let g = f32(depth_bytes.g) / 255.0;
+    let b = f32(depth_bytes.b) / 255.0;
+    return vec4f(r, g, b, 1.0);
+}
+)"sv;
+
+struct ConvPipeline {
+  GXTexFmt fmt;
+  std::string_view fragShader;
+  wgpu::TextureFormat outputFormat;
+  const char* label;
+};
+
+static constexpr std::array ConvPipelines{
+    ConvPipeline{GX_TF_I4, FragI4, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv I4"},
+    ConvPipeline{GX_TF_I8, FragI8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv I8"},
+    ConvPipeline{GX_TF_IA4, FragIA4, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv IA4"},
+    ConvPipeline{GX_TF_IA8, FragIA8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv IA8"},
+    ConvPipeline{GX_TF_RGB565, FragRGB565, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv RGB565"},
+    ConvPipeline{GX_CTF_R4, FragR4, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv R4"},
+    ConvPipeline{GX_CTF_RA4, FragRA4, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv RA4"},
+    ConvPipeline{GX_CTF_RA8, FragRA8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv RA8"},
+    ConvPipeline{GX_CTF_A8, FragA8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv A8"},
+    ConvPipeline{GX_CTF_R8, FragR8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv R8"},
+    ConvPipeline{GX_CTF_G8, FragG8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv G8"},
+    ConvPipeline{GX_CTF_B8, FragB8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv B8"},
+    ConvPipeline{GX_CTF_RG8, FragRG8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv RG8"},
+    ConvPipeline{GX_CTF_GB8, FragGB8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv GB8"},
+};
+
+static constexpr std::array DepthConvPipelines{
+    ConvPipeline{GX_TF_Z8, FragZ8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv Z8"},
+    ConvPipeline{GX_TF_Z16, FragZ16, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv Z16"},
+    ConvPipeline{GX_TF_Z24X8, FragZ24X8, wgpu::TextureFormat::RGBA8Unorm, "TexCopyConv Z24X8"},
+};
+
+static wgpu::BindGroupLayout g_bindGroupLayout;
+static wgpu::BindGroupLayout g_depthBindGroupLayout;
+static wgpu::Sampler g_nearestSampler;
+static wgpu::Sampler g_linearSampler;
+static absl::flat_hash_map<GXTexFmt, wgpu::RenderPipeline> g_pipelines;
+static wgpu::RenderPipeline g_blitPipeline;
+
+static wgpu::RenderPipeline create_pipeline(const ConvPipeline& conv, const std::string_view shaderPreamble,
+                                            const wgpu::BindGroupLayout& bindGroupLayout) {
+  std::string shaderSource;
+  shaderSource.reserve(shaderPreamble.size() + conv.fragShader.size());
+  shaderSource += shaderPreamble;
+  shaderSource += conv.fragShader;
+
+  const wgpu::ShaderSourceWGSL wgslSource{wgpu::ShaderSourceWGSL::Init{
+      .code = shaderSource.c_str(),
+  }};
+  const wgpu::ShaderModuleDescriptor moduleDescriptor{
+      .nextInChain = &wgslSource,
+      .label = conv.label,
+  };
+  const auto module = g_device.CreateShaderModule(&moduleDescriptor);
+
+  const std::array colorTargets{wgpu::ColorTargetState{
+      .format = conv.outputFormat,
+  }};
+  const wgpu::FragmentState fragmentState{
+      .module = module,
+      .entryPoint = "fs_main",
+      .targetCount = colorTargets.size(),
+      .targets = colorTargets.data(),
+  };
+
+  const wgpu::PipelineLayoutDescriptor layoutDescriptor{
+      .bindGroupLayoutCount = 1,
+      .bindGroupLayouts = &bindGroupLayout,
+  };
+  const auto pipelineLayout = g_device.CreatePipelineLayout(&layoutDescriptor);
+
+  const wgpu::RenderPipelineDescriptor pipelineDescriptor{
+      .label = conv.label,
+      .layout = pipelineLayout,
+      .vertex =
+          wgpu::VertexState{
+              .module = module,
+              .entryPoint = "vs_main",
+          },
+      .primitive =
+          wgpu::PrimitiveState{
+              .topology = wgpu::PrimitiveTopology::TriangleList,
+          },
+      .fragment = &fragmentState,
+  };
+  return g_device.CreateRenderPipeline(&pipelineDescriptor);
+}
+
+bool needs_conversion(const GXTexFmt fmt) { return g_pipelines.contains(fmt); }
+
+void initialize() {
+  static constexpr std::array bindGroupLayoutEntries{
+      wgpu::BindGroupLayoutEntry{
+          .binding = 0,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .sampler =
+              wgpu::SamplerBindingLayout{
+                  .type = wgpu::SamplerBindingType::Filtering,
+              },
+      },
+      wgpu::BindGroupLayoutEntry{
+          .binding = 1,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .texture =
+              wgpu::TextureBindingLayout{
+                  .sampleType = wgpu::TextureSampleType::Float,
+                  .viewDimension = wgpu::TextureViewDimension::e2D,
+              },
+      },
+      wgpu::BindGroupLayoutEntry{
+          .binding = 2,
+          .visibility = wgpu::ShaderStage::Vertex | wgpu::ShaderStage::Fragment,
+          .buffer =
+              wgpu::BufferBindingLayout{
+                  .type = wgpu::BufferBindingType::Uniform,
+              },
+      },
+  };
+  static constexpr wgpu::BindGroupLayoutDescriptor bindGroupLayoutDescriptor{
+      .label = "TexCopyConv Bind Group Layout",
+      .entryCount = bindGroupLayoutEntries.size(),
+      .entries = bindGroupLayoutEntries.data(),
+  };
+  g_bindGroupLayout = g_device.CreateBindGroupLayout(&bindGroupLayoutDescriptor);
+
+  static constexpr std::array depthBindGroupLayoutEntries{
+      wgpu::BindGroupLayoutEntry{
+          .binding = 0,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .texture =
+              wgpu::TextureBindingLayout{
+                  .sampleType = wgpu::TextureSampleType::Depth,
+                  .viewDimension = wgpu::TextureViewDimension::e2D,
+              },
+      },
+      wgpu::BindGroupLayoutEntry{
+          .binding = 1,
+          .visibility = wgpu::ShaderStage::Vertex | wgpu::ShaderStage::Fragment,
+          .buffer =
+              wgpu::BufferBindingLayout{
+                  .type = wgpu::BufferBindingType::Uniform,
+              },
+      },
+  };
+  static constexpr wgpu::BindGroupLayoutDescriptor depthBindGroupLayoutDescriptor{
+      .label = "TexCopyConv Depth Bind Group Layout",
+      .entryCount = depthBindGroupLayoutEntries.size(),
+      .entries = depthBindGroupLayoutEntries.data(),
+  };
+  g_depthBindGroupLayout = g_device.CreateBindGroupLayout(&depthBindGroupLayoutDescriptor);
+
+  g_blitPipeline = create_pipeline(
+      {GX_TF_RGBA8, FragPassthrough, webgpu::g_graphicsConfig.surfaceConfiguration.format, "TexCopyConv Blit"},
+      ShaderPreamble, g_bindGroupLayout);
+  for (const auto& conv : ConvPipelines) {
+    g_pipelines[conv.fmt] = create_pipeline(conv, ShaderPreamble, g_bindGroupLayout);
+    if (conv.outputFormat != to_wgpu(conv.fmt)) {
+      Log.fatal("Output format mismatch for {}", conv.fmt);
+    }
+  }
+  for (const auto& conv : DepthConvPipelines) {
+    g_pipelines[conv.fmt] = create_pipeline(conv, DepthShaderPreamble, g_depthBindGroupLayout);
+    if (conv.outputFormat != to_wgpu(conv.fmt)) {
+      Log.fatal("Output format mismatch for {}", conv.fmt);
+    }
+  }
+
+  static constexpr wgpu::SamplerDescriptor nearestSamplerDescriptor{
+      .label = "TexCopyConv Nearest Sampler",
+      .magFilter = wgpu::FilterMode::Nearest,
+      .minFilter = wgpu::FilterMode::Nearest,
+  };
+  g_nearestSampler = g_device.CreateSampler(&nearestSamplerDescriptor);
+
+  static constexpr wgpu::SamplerDescriptor linearSamplerDescriptor{
+      .label = "TexCopyConv Linear Sampler",
+      .magFilter = wgpu::FilterMode::Linear,
+      .minFilter = wgpu::FilterMode::Linear,
+  };
+  g_linearSampler = g_device.CreateSampler(&linearSamplerDescriptor);
+}
+
+void shutdown() {
+  g_pipelines.clear();
+  g_blitPipeline = {};
+  g_bindGroupLayout = {};
+  g_depthBindGroupLayout = {};
+  g_nearestSampler = {};
+  g_linearSampler = {};
+}
+
+static void execute(const wgpu::CommandEncoder& cmd, const ConvRequest& req, const wgpu::RenderPipeline& pipeline) {
+  wgpu::BindGroup bindGroup;
+  if (gx::is_depth_format(req.fmt)) {
+    const std::array bindGroupEntries{
+        wgpu::BindGroupEntry{
+            .binding = 0,
+            .textureView = req.srcView,
+        },
+        wgpu::BindGroupEntry{
+            .binding = 1,
+            .buffer = g_uniformBuffer,
+            .offset = req.uniformRange.offset,
+            .size = req.uniformRange.size,
+        },
+    };
+    const wgpu::BindGroupDescriptor bindGroupDescriptor{
+        .layout = g_depthBindGroupLayout,
+        .entryCount = bindGroupEntries.size(),
+        .entries = bindGroupEntries.data(),
+    };
+    bindGroup = g_device.CreateBindGroup(&bindGroupDescriptor);
+  } else {
+    const auto& sampler = req.sampleFilter == SampleFilter::Linear ? g_linearSampler : g_nearestSampler;
+    const std::array bindGroupEntries{
+        wgpu::BindGroupEntry{
+            .binding = 0,
+            .sampler = sampler,
+        },
+        wgpu::BindGroupEntry{
+            .binding = 1,
+            .textureView = req.srcView,
+        },
+        wgpu::BindGroupEntry{
+            .binding = 2,
+            .buffer = g_uniformBuffer,
+            .offset = req.uniformRange.offset,
+            .size = req.uniformRange.size,
+        },
+    };
+    const wgpu::BindGroupDescriptor bindGroupDescriptor{
+        .layout = g_bindGroupLayout,
+        .entryCount = bindGroupEntries.size(),
+        .entries = bindGroupEntries.data(),
+    };
+    bindGroup = g_device.CreateBindGroup(&bindGroupDescriptor);
+  }
+
+  const std::array colorAttachments{
+      wgpu::RenderPassColorAttachment{
+          .view = req.dst->attachmentTextureView,
+          .loadOp = wgpu::LoadOp::Clear,
+          .storeOp = wgpu::StoreOp::Store,
+          .clearValue = {0.0, 0.0, 0.0, 0.0},
+      },
+  };
+  const wgpu::RenderPassDescriptor renderPassDescriptor{
+      .label = "TexCopyConv Pass",
+      .colorAttachmentCount = colorAttachments.size(),
+      .colorAttachments = colorAttachments.data(),
+  };
+  const auto pass = cmd.BeginRenderPass(&renderPassDescriptor);
+  pass.SetPipeline(pipeline);
+  pass.SetBindGroup(0, bindGroup);
+  pass.Draw(3);
+  pass.End();
+}
+
+void run(const wgpu::CommandEncoder& cmd, const ConvRequest& req) {
+  const auto it = g_pipelines.find(req.fmt);
+  if (it == g_pipelines.end()) {
+    Log.fatal("No copy conversion pipeline for format {}", static_cast<int>(req.fmt));
+  }
+  execute(cmd, req, it->second);
+}
+
+void blit(const wgpu::CommandEncoder& cmd, const ConvRequest& req) { execute(cmd, req, g_blitPipeline); }
+
+} // namespace aurora::gfx::tex_copy_conv
diff --git a/aurora-main/lib/gfx/tex_copy_conv.hpp b/aurora-main/lib/gfx/tex_copy_conv.hpp
new file mode 100644
index 0000000..29965be
--- /dev/null
+++ b/aurora-main/lib/gfx/tex_copy_conv.hpp
@@ -0,0 +1,30 @@
+#pragma once
+
+#include "common.hpp"
+
+#include <dolphin/gx/GXEnum.h>
+
+namespace aurora::gfx::tex_copy_conv {
+
+enum class SampleFilter : uint8_t {
+  Nearest,
+  Linear,
+};
+
+struct ConvRequest {
+  GXTexFmt fmt;
+  wgpu::TextureView srcView; // View of resolved EFB / offscreen color/depth
+  Range uniformRange;        // UV transform uniform (offset + scale)
+  TextureHandle dst;         // Destination texture
+  SampleFilter sampleFilter = SampleFilter::Nearest;
+  bool forceOpaqueAlpha = false;
+};
+
+bool needs_conversion(GXTexFmt fmt);
+
+void initialize();
+void shutdown();
+void run(const wgpu::CommandEncoder& cmd, const ConvRequest& req);
+void blit(const wgpu::CommandEncoder& cmd, const ConvRequest& req);
+
+} // namespace aurora::gfx::tex_copy_conv
diff --git a/aurora-main/lib/gfx/tex_copy_format_contract.hpp b/aurora-main/lib/gfx/tex_copy_format_contract.hpp
new file mode 100644
index 0000000..be10c9a
--- /dev/null
+++ b/aurora-main/lib/gfx/tex_copy_format_contract.hpp
@@ -0,0 +1,23 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+#include <string_view>
+
+namespace aurora::gfx::tex_copy_conv::detail {
+
+// GX_TF_Z16 selects the depth RA8 copy format: the encoder writes alpha (255) then the high-Z
+// byte, so sampling as IA8 gives high-Z as intensity. Middle and low depth bytes are not stored.
+constexpr std::array<std::uint8_t, 4> z16_ra8_as_ia8_rgba(std::uint8_t high) noexcept {
+  return {high, high, high, 0xff};
+}
+
+inline constexpr std::string_view Z16FragmentShader = R"(
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let depth_bytes = sample_depth_copy(in.uv);
+    let i = f32(depth_bytes.r) / 255.0;
+    return vec4f(i, i, i, 1.0);
+}
+)";
+
+} // namespace aurora::gfx::tex_copy_conv::detail
diff --git a/aurora-main/lib/gfx/tex_palette_conv.cpp b/aurora-main/lib/gfx/tex_palette_conv.cpp
new file mode 100644
index 0000000..842cca3
--- /dev/null
+++ b/aurora-main/lib/gfx/tex_palette_conv.cpp
@@ -0,0 +1,260 @@
+#include "tex_palette_conv.hpp"
+
+#include "../internal.hpp"
+#include "../webgpu/gpu.hpp"
+#include "texture.hpp"
+
+#include <vector>
+
+namespace aurora::gfx::tex_palette_conv {
+static Module Log("aurora::gfx::tex_palette_conv");
+
+using webgpu::g_device;
+
+static constexpr std::string_view ShaderPreambleVtx = R"(
+struct VertexOutput {
+    @builtin(position) pos: vec4f,
+    @location(0) uv: vec2f,
+};
+
+var<private> positions: array<vec2f, 3> = array(
+    vec2f(-1.0, 1.0),
+    vec2f(-1.0, -3.0),
+    vec2f(3.0, 1.0),
+);
+var<private> uvs: array<vec2f, 3> = array(
+    vec2f(0.0, 0.0),
+    vec2f(0.0, 2.0),
+    vec2f(2.0, 0.0),
+);
+
+@vertex fn vs_main(@builtin(vertex_index) vi: u32) -> VertexOutput {
+    var out: VertexOutput;
+    out.pos = vec4f(positions[vi], 0.0, 1.0);
+    out.uv = uvs[vi];
+    return out;
+}
+
+fn intensity(rgb: vec3f) -> f32 {
+    // ITU-R BT.601 luma coefficients
+    return dot(rgb, vec3f(0.257, 0.504, 0.098)) + 16.0 / 255.0;
+}
+)"sv;
+
+// Direct: R16Sint index texture + TLUT -> RGBA8
+static constexpr std::string_view ShaderDirect = R"(
+@group(0) @binding(0) var src_samp: sampler;
+@group(0) @binding(1) var src: texture_2d<i32>;
+@group(0) @binding(2) var tlut: texture_2d<f32>;
+
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let texSize = vec2f(textureDimensions(src));
+    let coord = vec2i(floor(in.uv * texSize));
+    let idx = textureLoad(src, coord, 0).r;
+    return textureLoad(tlut, vec2i(idx, 0), 0);
+}
+)"sv;
+
+// FromFloat8: f32 texture (R8Unorm) -> 8-bit index -> TLUT -> RGBA8
+static constexpr std::string_view ShaderFromFloat8 = R"(
+@group(0) @binding(0) var src_samp: sampler;
+@group(0) @binding(1) var src: texture_2d<f32>;
+@group(0) @binding(2) var tlut: texture_2d<f32>;
+
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let texSize = vec2f(textureDimensions(src));
+    let coord = vec2i(floor(in.uv * texSize));
+    let r = textureLoad(src, coord, 0).r;
+    return textureLoad(tlut, vec2i(i32(r * 255.0), 0), 0);
+}
+)"sv;
+
+// FromFloat4: f32 texture (R8Unorm) -> 4-bit index -> TLUT -> RGBA8
+static constexpr std::string_view ShaderFromFloat4 = R"(
+@group(0) @binding(0) var src_samp: sampler;
+@group(0) @binding(1) var src: texture_2d<f32>;
+@group(0) @binding(2) var tlut: texture_2d<f32>;
+
+@fragment fn fs_main(in: VertexOutput) -> @location(0) vec4f {
+    let texSize = vec2f(textureDimensions(src));
+    let coord = vec2i(floor(in.uv * texSize));
+    let r = textureLoad(src, coord, 0).r;
+    return textureLoad(tlut, vec2i(i32(r * 15.0), 0), 0);
+}
+)"sv;
+
+struct PipelineInfo {
+  wgpu::RenderPipeline pipeline;
+  wgpu::BindGroupLayout bindGroupLayout;
+};
+
+static PipelineInfo g_directPipeline;
+static PipelineInfo g_fromFloat8Pipeline;
+static PipelineInfo g_fromFloat4Pipeline;
+static wgpu::Sampler g_sampler;
+
+static PipelineInfo create_pipeline(std::string_view fragBindingsAndShader, wgpu::TextureSampleType srcSampleType,
+                                    const char* label) {
+  std::string shaderSource;
+  shaderSource.reserve(ShaderPreambleVtx.size() + fragBindingsAndShader.size());
+  shaderSource += ShaderPreambleVtx;
+  shaderSource += fragBindingsAndShader;
+
+  wgpu::ShaderSourceWGSL wgslSource{};
+  wgslSource.code = shaderSource.c_str();
+  const wgpu::ShaderModuleDescriptor moduleDescriptor{
+      .nextInChain = &wgslSource,
+      .label = label,
+  };
+  auto module = g_device.CreateShaderModule(&moduleDescriptor);
+
+  const std::array bindGroupLayoutEntries{
+      wgpu::BindGroupLayoutEntry{
+          .binding = 0,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .sampler =
+              wgpu::SamplerBindingLayout{
+                  .type = wgpu::SamplerBindingType::NonFiltering,
+              },
+      },
+      wgpu::BindGroupLayoutEntry{
+          .binding = 1,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .texture =
+              wgpu::TextureBindingLayout{
+                  .sampleType = srcSampleType,
+                  .viewDimension = wgpu::TextureViewDimension::e2D,
+              },
+      },
+      wgpu::BindGroupLayoutEntry{
+          .binding = 2,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .texture =
+              wgpu::TextureBindingLayout{
+                  .sampleType = wgpu::TextureSampleType::Float,
+                  .viewDimension = wgpu::TextureViewDimension::e2D,
+              },
+      },
+  };
+  const auto bindGroupLayoutLabel = fmt::format("{} Bind Group Layout", label);
+  const wgpu::BindGroupLayoutDescriptor bindGroupLayoutDescriptor{
+      .label = bindGroupLayoutLabel.c_str(),
+      .entryCount = bindGroupLayoutEntries.size(),
+      .entries = bindGroupLayoutEntries.data(),
+  };
+  auto bindGroupLayout = g_device.CreateBindGroupLayout(&bindGroupLayoutDescriptor);
+
+  const wgpu::PipelineLayoutDescriptor layoutDescriptor{
+      .bindGroupLayoutCount = 1,
+      .bindGroupLayouts = &bindGroupLayout,
+  };
+  auto pipelineLayout = g_device.CreatePipelineLayout(&layoutDescriptor);
+
+  constexpr std::array colorTargets{wgpu::ColorTargetState{
+      .format = wgpu::TextureFormat::RGBA8Unorm,
+  }};
+  const wgpu::FragmentState fragmentState{
+      .module = module,
+      .entryPoint = "fs_main",
+      .targetCount = colorTargets.size(),
+      .targets = colorTargets.data(),
+  };
+  const wgpu::RenderPipelineDescriptor pipelineDescriptor{
+      .label = label,
+      .layout = pipelineLayout,
+      .vertex =
+          wgpu::VertexState{
+              .module = module,
+              .entryPoint = "vs_main",
+          },
+      .primitive =
+          wgpu::PrimitiveState{
+              .topology = wgpu::PrimitiveTopology::TriangleList,
+          },
+      .fragment = &fragmentState,
+  };
+
+  return PipelineInfo{
+      .pipeline = g_device.CreateRenderPipeline(&pipelineDescriptor),
+      .bindGroupLayout = std::move(bindGroupLayout),
+  };
+}
+
+static const PipelineInfo& pipeline_for_variant(Variant variant) {
+  switch (variant) {
+  case Variant::Direct:
+    return g_directPipeline;
+  case Variant::FromFloat8:
+    return g_fromFloat8Pipeline;
+  case Variant::FromFloat4:
+    return g_fromFloat4Pipeline;
+  }
+  FATAL("invalid palette conv variant {}", static_cast<int>(variant));
+}
+
+void initialize() {
+  g_directPipeline = create_pipeline(ShaderDirect, wgpu::TextureSampleType::Sint, "TexPaletteConv Direct");
+  g_fromFloat8Pipeline =
+      create_pipeline(ShaderFromFloat8, wgpu::TextureSampleType::UnfilterableFloat, "TexPaletteConv FromFloat8");
+  g_fromFloat4Pipeline =
+      create_pipeline(ShaderFromFloat4, wgpu::TextureSampleType::UnfilterableFloat, "TexPaletteConv FromFloat4");
+  constexpr wgpu::SamplerDescriptor samplerDesc{
+      .label = "TexPaletteConv Sampler",
+      .magFilter = wgpu::FilterMode::Nearest,
+      .minFilter = wgpu::FilterMode::Nearest,
+  };
+  g_sampler = g_device.CreateSampler(&samplerDesc);
+}
+
+void shutdown() {
+  g_directPipeline = {};
+  g_fromFloat8Pipeline = {};
+  g_fromFloat4Pipeline = {};
+  g_sampler = {};
+}
+
+void run(const wgpu::CommandEncoder& cmd, const ConvRequest& req) {
+  const auto& [pipeline, bindGroupLayout] = pipeline_for_variant(req.variant);
+
+  const std::array bindGroupEntries{
+      wgpu::BindGroupEntry{
+          .binding = 0,
+          .sampler = g_sampler,
+      },
+      wgpu::BindGroupEntry{
+          .binding = 1,
+          .textureView = req.src->sampleTextureView,
+      },
+      wgpu::BindGroupEntry{
+          .binding = 2,
+          .textureView = req.tlut->sampleTextureView,
+      },
+  };
+  const wgpu::BindGroupDescriptor bindGroupDescriptor{
+      .layout = bindGroupLayout,
+      .entryCount = bindGroupEntries.size(),
+      .entries = bindGroupEntries.data(),
+  };
+  const auto bindGroup = g_device.CreateBindGroup(&bindGroupDescriptor);
+
+  const std::array colorAttachments{
+      wgpu::RenderPassColorAttachment{
+          .view = req.dst->attachmentTextureView,
+          .loadOp = wgpu::LoadOp::Clear,
+          .storeOp = wgpu::StoreOp::Store,
+          .clearValue = {0.0, 0.0, 0.0, 0.0},
+      },
+  };
+  const wgpu::RenderPassDescriptor renderPassDescriptor{
+      .label = "TexPaletteConv Pass",
+      .colorAttachmentCount = colorAttachments.size(),
+      .colorAttachments = colorAttachments.data(),
+  };
+  const auto pass = cmd.BeginRenderPass(&renderPassDescriptor);
+  pass.SetPipeline(pipeline);
+  pass.SetBindGroup(0, bindGroup);
+  pass.Draw(3);
+  pass.End();
+}
+
+} // namespace aurora::gfx::tex_palette_conv
diff --git a/aurora-main/lib/gfx/tex_palette_conv.hpp b/aurora-main/lib/gfx/tex_palette_conv.hpp
new file mode 100644
index 0000000..fca8a38
--- /dev/null
+++ b/aurora-main/lib/gfx/tex_palette_conv.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "common.hpp"
+
+namespace aurora::gfx::tex_palette_conv {
+
+enum class Variant : uint8_t {
+  Direct,     // R16Sint index texture -> TLUT -> RGBA8
+  FromFloat8, // f32 texture, R channel * 255 -> 8-bit index -> TLUT -> RGBA8
+  FromFloat4, // f32 texture, R channel * 15 -> 4-bit index -> TLUT -> RGBA8
+};
+
+struct ConvRequest {
+  Variant variant;
+  TextureHandle src;
+  TextureHandle dst;
+  TextureHandle tlut;
+};
+
+void initialize();
+void shutdown();
+void run(const wgpu::CommandEncoder& cmd, const ConvRequest& req);
+
+} // namespace aurora::gfx::tex_palette_conv
diff --git a/aurora-main/lib/gfx/texture.cpp b/aurora-main/lib/gfx/texture.cpp
new file mode 100644
index 0000000..f465f36
--- /dev/null
+++ b/aurora-main/lib/gfx/texture.cpp
@@ -0,0 +1,303 @@
+#include "common.hpp"
+
+#include "../internal.hpp"
+#include "../webgpu/gpu.hpp"
+#include "aurora/aurora.h"
+#include "texture.hpp"
+#include "texture_convert.hpp"
+#include "../gx/gx_fmt.hpp"
+
+#include <algorithm>
+#include <cstdint>
+#include <memory>
+#include <utility>
+
+#include <fmt/format.h>
+#include <magic_enum.hpp>
+#include <tracy/Tracy.hpp>
+#include <webgpu/webgpu_cpp.h>
+
+namespace aurora::gfx {
+using webgpu::g_device;
+using webgpu::g_queue;
+
+namespace {
+Module Log("aurora::gfx");
+
+constexpr u32 div_ceil(u32 value, u32 divisor) noexcept { return (value + divisor - 1) / divisor; }
+
+uint32_t clamp_mip_count(uint32_t width, uint32_t height, uint32_t mips, const char* label) noexcept {
+  const uint32_t maxMips = max_texture_mip_count(width, height);
+  const uint32_t safeMips = std::clamp(mips, 1u, maxMips);
+  if (safeMips != mips) {
+    Log.warn("{}: clamping mip count {} to {} for {}x{} texture", label, mips, safeMips, width, height);
+  }
+  return safeMips;
+}
+
+wgpu::Extent3D physical_size(wgpu::Extent3D size, TextureFormatInfo info) {
+  const uint32_t width = ((size.width + info.blockWidth - 1) / info.blockWidth) * info.blockWidth;
+  const uint32_t height = ((size.height + info.blockHeight - 1) / info.blockHeight) * info.blockHeight;
+  return {.width = width, .height = height, .depthOrArrayLayers = size.depthOrArrayLayers};
+}
+} // namespace
+
+TextureFormatInfo format_info(wgpu::TextureFormat format) noexcept {
+  switch (format) {
+    DEFAULT_FATAL("unimplemented texture format {}", magic_enum::enum_name(format));
+  case wgpu::TextureFormat::R8Unorm:
+    return {1, 1, 1, false};
+  case wgpu::TextureFormat::RG8Unorm:
+  case wgpu::TextureFormat::R16Sint:
+    return {1, 1, 2, false};
+  case wgpu::TextureFormat::RGBA8Unorm:
+  case wgpu::TextureFormat::BGRA8Unorm:
+  case wgpu::TextureFormat::R32Float:
+    return {1, 1, 4, false};
+  case wgpu::TextureFormat::BC1RGBAUnorm:
+    return {4, 4, 8, true};
+  case wgpu::TextureFormat::BC3RGBAUnorm:
+  case wgpu::TextureFormat::BC5RGUnorm:
+  case wgpu::TextureFormat::BC7RGBAUnorm:
+    return {4, 4, 16, true};
+  }
+}
+
+uint64_t calc_texture_size(wgpu::TextureFormat format, u32 width, u32 height, u32 mips) noexcept {
+  const auto info = format_info(format);
+  uint64_t total = 0;
+  for (uint32_t mip = 0; mip < mips; ++mip) {
+    const uint32_t mipWidth = std::max(width >> mip, 1u);
+    const uint32_t mipHeight = std::max(height >> mip, 1u);
+    const uint64_t widthBlocks = div_ceil(mipWidth, info.blockWidth);
+    const uint64_t heightBlocks = div_ceil(mipHeight, info.blockHeight);
+    const uint64_t mipBytes = widthBlocks * heightBlocks * info.blockSize;
+    total += mipBytes;
+  }
+  return total;
+}
+
+TextureHandle new_static_texture_2d(uint32_t width, uint32_t height, uint32_t mips, u32 format, ArrayRef<uint8_t> data,
+                                    bool tlut, const char* label) noexcept {
+  ZoneScoped;
+
+  mips = clamp_mip_count(width, height, mips, label);
+  auto handle = new_dynamic_texture_2d(width, height, mips, format, label);
+  auto& ref = *handle;
+
+  ConvertedTexture converted;
+  if (ref.gxFormat != InvalidTextureFormat) {
+    if (tlut) {
+      CHECK(ref.size.height == 1, "new_static_texture_2d[{}]: expected tlut height 1, got {}", label, ref.size.height);
+      CHECK(ref.mipCount == 1, "new_static_texture_2d[{}]: expected tlut mipCount 1, got {}", label, ref.mipCount);
+      converted = convert_tlut(ref.gxFormat, ref.size.width, data);
+    } else {
+      converted = convert_texture(ref.gxFormat, ref.size.width, ref.size.height, ref.mipCount, data);
+    }
+    if (!converted.data.empty()) {
+      data = converted.data;
+      ref.hasArbitraryMips = converted.hasArbitraryMips;
+    }
+  }
+
+  uint32_t offset = 0;
+  for (uint32_t mip = 0; mip < mips; ++mip) {
+    const wgpu::Extent3D mipSize{
+        .width = std::max(ref.size.width >> mip, 1u),
+        .height = std::max(ref.size.height >> mip, 1u),
+        .depthOrArrayLayers = ref.size.depthOrArrayLayers,
+    };
+    const auto info = format_info(ref.format);
+    const auto physicalSize = physical_size(mipSize, info);
+    const uint32_t widthBlocks = physicalSize.width / info.blockWidth;
+    const uint32_t heightBlocks = physicalSize.height / info.blockHeight;
+    const uint32_t bytesPerRow = widthBlocks * info.blockSize;
+    const uint32_t dataSize = bytesPerRow * heightBlocks * mipSize.depthOrArrayLayers;
+    if (offset > data.size() || dataSize > data.size() - offset) {
+      Log.warn("new_static_texture_2d[{}]: stopping at mip {}: expected at least {} bytes, got {}", label, mip,
+               static_cast<size_t>(offset) + dataSize, data.size());
+      return handle;
+    }
+    const wgpu::TexelCopyTextureInfo dstView{
+        .texture = ref.texture,
+        .mipLevel = mip,
+    };
+    if constexpr (UseTextureBuffer) {
+      const auto range = push_texture_data(data.data() + offset, dataSize, bytesPerRow, heightBlocks);
+      const wgpu::TexelCopyBufferLayout dataLayout{
+          .offset = range.offset,
+          .bytesPerRow = bytesPerRow,
+          .rowsPerImage = heightBlocks,
+      };
+      g_textureUploads.emplace_back(dataLayout, std::move(dstView), physicalSize);
+    } else {
+      const wgpu::TexelCopyBufferLayout dataLayout{
+          .bytesPerRow = bytesPerRow,
+          .rowsPerImage = heightBlocks,
+      };
+      g_queue.WriteTexture(&dstView, data.data() + offset, dataSize, &dataLayout, &physicalSize);
+    }
+    offset += dataSize;
+  }
+  if (data.size() != UINT32_MAX && offset < data.size()) {
+    Log.warn("new_static_texture_2d[{}]: texture used {} bytes, but given {} bytes", label, offset, data.size());
+  }
+  return handle;
+}
+
+TextureHandle new_dynamic_texture_2d(uint32_t width, uint32_t height, uint32_t mips, u32 gxFormat,
+                                     const char* label) noexcept {
+  ZoneScopedS(3);
+  mips = clamp_mip_count(width, height, mips, label);
+  const auto wgpuFormat = to_wgpu(gxFormat);
+  const wgpu::Extent3D size{
+      .width = width,
+      .height = height,
+      .depthOrArrayLayers = 1,
+  };
+  const wgpu::TextureDescriptor textureDescriptor{
+      .label = label,
+      .usage = wgpu::TextureUsage::TextureBinding | wgpu::TextureUsage::CopyDst,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = wgpuFormat,
+      .mipLevelCount = mips,
+      .sampleCount = 1,
+  };
+  auto texture = g_device.CreateTexture(&textureDescriptor);
+  const auto viewLabel = fmt::format("{} view", label);
+  wgpu::TextureViewDescriptor textureViewDescriptor{
+      .label = viewLabel.c_str(),
+      .format = wgpuFormat,
+      .dimension = wgpu::TextureViewDimension::e2D,
+      .mipLevelCount = mips,
+  };
+  auto textureView = texture.CreateView(&textureViewDescriptor);
+  return std::make_shared<TextureRef>(std::move(texture), std::move(textureView), wgpu::TextureView{}, size, wgpuFormat,
+                                      mips, gxFormat);
+}
+
+TextureHandle new_render_texture(uint32_t width, uint32_t height, u32 gxFormat, const char* label) noexcept {
+  ZoneScoped;
+
+  const auto wgpuFormat = webgpu::g_graphicsConfig.surfaceConfiguration.format;
+  const wgpu::Extent3D size{
+      .width = width,
+      .height = height,
+      .depthOrArrayLayers = 1,
+  };
+  const wgpu::TextureDescriptor textureDescriptor{
+      .label = label,
+      .usage = wgpu::TextureUsage::TextureBinding | wgpu::TextureUsage::CopySrc | wgpu::TextureUsage::CopyDst |
+               wgpu::TextureUsage::RenderAttachment,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = wgpuFormat,
+      .mipLevelCount = 1,
+      .sampleCount = 1,
+  };
+  auto texture = g_device.CreateTexture(&textureDescriptor);
+
+  // Create texture view for color attachments
+  const auto viewLabel = fmt::format("{} view", label);
+  wgpu::TextureViewDescriptor textureViewDescriptor{
+      .label = viewLabel.c_str(),
+      .format = wgpuFormat,
+      .dimension = wgpu::TextureViewDimension::e2D,
+  };
+  auto attachmentTextureView = texture.CreateView(&textureViewDescriptor);
+  wgpu::TextureView sampleTextureView = attachmentTextureView;
+  return std::make_shared<TextureRef>(std::move(texture), std::move(sampleTextureView),
+                                      std::move(attachmentTextureView), size, wgpuFormat, 1, gxFormat);
+}
+
+TextureHandle new_conv_texture(uint32_t width, uint32_t height, u32 gxFormat, const char* label) noexcept {
+  ZoneScoped;
+
+  const auto wgpuFormat = to_wgpu(gxFormat);
+  const wgpu::Extent3D size{
+      .width = width,
+      .height = height,
+      .depthOrArrayLayers = 1,
+  };
+  const wgpu::TextureDescriptor textureDescriptor{
+      .label = label,
+      .usage = wgpu::TextureUsage::TextureBinding | wgpu::TextureUsage::CopySrc |
+               wgpu::TextureUsage::RenderAttachment,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = wgpuFormat,
+      .mipLevelCount = 1,
+      .sampleCount = 1,
+  };
+  auto texture = g_device.CreateTexture(&textureDescriptor);
+
+  // Create texture view for color attachments
+  const auto viewLabel = fmt::format("{} view", label);
+  wgpu::TextureViewDescriptor textureViewDescriptor{
+      .label = viewLabel.c_str(),
+      .format = wgpuFormat,
+      .dimension = wgpu::TextureViewDimension::e2D,
+  };
+  auto attachmentTextureView = texture.CreateView(&textureViewDescriptor);
+  wgpu::TextureView sampleTextureView = attachmentTextureView;
+  return std::make_shared<TextureRef>(std::move(texture), std::move(sampleTextureView),
+                                      std::move(attachmentTextureView), size, wgpuFormat, 1, gxFormat);
+}
+
+void write_texture(TextureRef& ref, ArrayRef<uint8_t> data) noexcept {
+  ZoneScoped;
+
+  ConvertedTexture converted;
+  if (ref.gxFormat != InvalidTextureFormat) {
+    converted = convert_texture(ref.gxFormat, ref.size.width, ref.size.height, ref.mipCount, data);
+    ref.hasArbitraryMips = converted.hasArbitraryMips;
+    if (!converted.data.empty()) {
+      data = converted.data;
+    }
+  }
+
+  uint32_t offset = 0;
+  for (uint32_t mip = 0; mip < ref.mipCount; ++mip) {
+    const wgpu::Extent3D mipSize{
+        .width = std::max(ref.size.width >> mip, 1u),
+        .height = std::max(ref.size.height >> mip, 1u),
+        .depthOrArrayLayers = ref.size.depthOrArrayLayers,
+    };
+    const auto info = format_info(ref.format);
+    const auto physicalSize = physical_size(mipSize, info);
+    const uint32_t widthBlocks = physicalSize.width / info.blockWidth;
+    const uint32_t heightBlocks = physicalSize.height / info.blockHeight;
+    const uint32_t bytesPerRow = widthBlocks * info.blockSize;
+    const uint32_t dataSize = bytesPerRow * heightBlocks * mipSize.depthOrArrayLayers;
+    if (offset > data.size() || dataSize > data.size() - offset) {
+      Log.warn("write_texture: stopping at mip {}: expected at least {} bytes, got {}", mip,
+               static_cast<size_t>(offset) + dataSize, data.size());
+      return;
+    }
+    const wgpu::TexelCopyTextureInfo dstView{
+        .texture = ref.texture,
+        .mipLevel = mip,
+    };
+    if constexpr (UseTextureBuffer) {
+      const auto range = push_texture_data(data.data() + offset, dataSize, bytesPerRow, heightBlocks);
+      const wgpu::TexelCopyBufferLayout dataLayout{
+          .offset = range.offset,
+          .bytesPerRow = bytesPerRow,
+          .rowsPerImage = heightBlocks,
+      };
+      g_textureUploads.emplace_back(dataLayout, std::move(dstView), physicalSize);
+    } else {
+      const wgpu::TexelCopyBufferLayout dataLayout{
+          .bytesPerRow = bytesPerRow,
+          .rowsPerImage = heightBlocks,
+      };
+      g_queue.WriteTexture(&dstView, data.data() + offset, dataSize, &dataLayout, &physicalSize);
+    }
+    offset += dataSize;
+  }
+  if (data.size() != UINT32_MAX && offset < data.size()) {
+    Log.warn("write_texture: texture used {} bytes, but given {} bytes", offset, data.size());
+  }
+}
+} // namespace aurora::gfx
diff --git a/aurora-main/lib/gfx/texture.hpp b/aurora-main/lib/gfx/texture.hpp
new file mode 100644
index 0000000..4c1d4cc
--- /dev/null
+++ b/aurora-main/lib/gfx/texture.hpp
@@ -0,0 +1,147 @@
+#pragma once
+#include <dolphin/gx.h>
+
+#include <utility>
+
+#include "common.hpp"
+
+namespace aurora::gfx {
+constexpr uint32_t max_texture_mip_count(uint32_t width, uint32_t height) noexcept {
+  uint32_t dimension = std::max(width, height);
+  uint32_t count = 1;
+  while (dimension > 1) {
+    dimension >>= 1;
+    ++count;
+  }
+  return count;
+}
+
+struct TextureUpload {
+  wgpu::TexelCopyBufferLayout layout;
+  wgpu::TexelCopyTextureInfo tex;
+  wgpu::Extent3D size;
+
+  TextureUpload(wgpu::TexelCopyBufferLayout layout, wgpu::TexelCopyTextureInfo tex, wgpu::Extent3D size) noexcept
+  : layout(layout), tex(std::move(tex)), size(size) {}
+};
+extern std::vector<TextureUpload> g_textureUploads;
+
+struct TextureFormatInfo {
+  uint8_t blockWidth;
+  uint8_t blockHeight;
+  uint8_t blockSize;
+  bool compressed;
+};
+TextureFormatInfo format_info(wgpu::TextureFormat format) noexcept;
+uint64_t calc_texture_size(wgpu::TextureFormat format, uint32_t width, uint32_t height, uint32_t mips) noexcept;
+
+constexpr u32 InvalidTextureFormat = -1;
+struct TextureRef {
+  wgpu::Texture texture;
+  wgpu::TextureView sampleTextureView;
+  wgpu::TextureView attachmentTextureView;
+  wgpu::Extent3D size;
+  wgpu::TextureFormat format;
+  uint32_t mipCount;
+  u32 gxFormat;
+  bool hasArbitraryMips = false;
+  bool isReplacement = false;
+
+  TextureRef(wgpu::Texture texture, wgpu::TextureView sampleTextureView, wgpu::TextureView attachmentTextureView,
+             wgpu::Extent3D size, wgpu::TextureFormat format, uint32_t mipCount, u32 gxFormat)
+  : texture(std::move(texture))
+  , sampleTextureView(std::move(sampleTextureView))
+  , attachmentTextureView(std::move(attachmentTextureView))
+  , size(size)
+  , format(format)
+  , mipCount(mipCount)
+  , gxFormat(gxFormat) {}
+};
+
+TextureHandle new_static_texture_2d(uint32_t width, uint32_t height, uint32_t mips, u32 gxFormat,
+                                    ArrayRef<uint8_t> data, bool tlut, const char* label) noexcept;
+TextureHandle new_dynamic_texture_2d(uint32_t width, uint32_t height, uint32_t mips, u32 gxFormat,
+                                     const char* label) noexcept;
+TextureHandle new_render_texture(uint32_t width, uint32_t height, u32 gxFormat, const char* label) noexcept;
+TextureHandle new_conv_texture(uint32_t width, uint32_t height, u32 gxFormat, const char* label) noexcept;
+void write_texture(TextureRef& ref, ArrayRef<uint8_t> data) noexcept;
+}; // namespace aurora::gfx
+
+struct GXTexObj_ {
+  u32 mode0 = 0;
+  u32 mode1 = 0;
+  u32 image0 = UINT32_MAX;
+  u32 image3 = 0;
+  const void* userData = nullptr;
+  const void* data = nullptr;
+  u32 mWidth = 0;
+  u32 mHeight = 0;
+  u32 mFormat = aurora::gfx::InvalidTextureFormat;
+  GXTlut tlut = GX_TLUT0;
+  u32 texObjId = 0;
+  u32 texDataVersion = 0;
+  u8 flags = 0;
+
+  static constexpr u32 get_bits(u32 reg, u32 size, u32 shift) noexcept { return (reg >> shift) & ((1u << size) - 1); }
+
+  u32 width() const noexcept { return mWidth != 0 ? mWidth : get_bits(image0, 10, 0) + 1 & 0x3FF; }
+  u32 height() const noexcept { return mHeight != 0 ? mHeight : get_bits(image0, 10, 10) + 1 & 0x3FF; }
+  u32 raw_format() const noexcept { return get_bits(image0, 4, 20); }
+  u32 format() const noexcept { return mFormat != aurora::gfx::InvalidTextureFormat ? mFormat : raw_format(); }
+  GXTexWrapMode wrap_s() const noexcept { return static_cast<GXTexWrapMode>(get_bits(mode0, 2, 0)); }
+  GXTexWrapMode wrap_t() const noexcept { return static_cast<GXTexWrapMode>(get_bits(mode0, 2, 2)); }
+  GXTexFilter min_filter() const noexcept {
+    constexpr GXTexFilter kHwToGxFilter[8] = {
+        GX_NEAR, GX_NEAR_MIP_NEAR, GX_NEAR_MIP_LIN, GX_NEAR, GX_LINEAR, GX_LIN_MIP_NEAR, GX_LIN_MIP_LIN, GX_NEAR,
+    };
+    return kHwToGxFilter[get_bits(mode0, 3, 5)];
+  }
+  GXTexFilter mag_filter() const noexcept { return get_bits(mode0, 1, 4) != 0 ? GX_LINEAR : GX_NEAR; }
+  GXBool has_mips() const noexcept { return (flags & 1u) != 0 ? GX_TRUE : GX_FALSE; }
+  u32 mip_count() const noexcept {
+    if (!has_mips()) {
+      return 1;
+    }
+    const u32 requested = std::max<u32>(static_cast<u32>(max_lod()) + 1, 1u);
+    return std::min(requested, aurora::gfx::max_texture_mip_count(width(), height()));
+  }
+  GXBool do_edge_lod() const noexcept { return get_bits(mode0, 1, 8) == 0 ? GX_TRUE : GX_FALSE; }
+  float lod_bias() const noexcept { return static_cast<float>(static_cast<int8_t>(get_bits(mode0, 8, 9))) / 32.0f; }
+  GXAnisotropy max_aniso() const noexcept { return static_cast<GXAnisotropy>(get_bits(mode0, 2, 19)); }
+  GXBool bias_clamp() const noexcept { return get_bits(mode0, 1, 21) != 0 ? GX_TRUE : GX_FALSE; }
+  float min_lod() const noexcept { return static_cast<float>(get_bits(mode1, 8, 0)) / 16.0f; }
+  float max_lod() const noexcept { return static_cast<float>(get_bits(mode1, 8, 8)) / 16.0f; }
+
+  // Custom flag for texture caching
+  bool no_cache() const noexcept { return (flags & 0x80) != 0; }
+  void set_no_cache(bool value) noexcept { flags = value ? flags | 0x80 : flags & ~0x80; }
+};
+static_assert(sizeof(GXTexObj_) <= sizeof(GXTexObj), "GXTexObj too small!");
+struct GXTlutObj_ {
+  u32 tlut = 0;
+  u32 loadTlut0 = 0;
+  u16 numEntries = 0;
+  const void* data = nullptr;
+  GXTlutFmt format = GX_TL_IA8;
+  u32 tlutObjId = 0;
+  u32 tlutDataVersion = 0;
+  u8 flags = 0;
+
+  // Custom flag for texture caching
+  bool no_cache() const noexcept { return (flags & 0x80) != 0; }
+  void set_no_cache(bool value) noexcept { flags = value ? flags | 0x80 : flags & ~0x80; }
+};
+static_assert(sizeof(GXTlutObj_) <= sizeof(GXTlutObj), "GXTlutObj too small!");
+
+namespace aurora::gfx {
+struct TextureBind {
+  TextureHandle ref;
+  GXTexObj_ texObj;
+
+  TextureBind() noexcept = default;
+  TextureBind(const GXTexObj_& obj, TextureHandle handle) noexcept : ref(std::move(handle)), texObj(obj) {}
+  void reset() noexcept { ref.reset(); }
+  [[nodiscard]] wgpu::SamplerDescriptor get_descriptor() const noexcept;
+  operator bool() const noexcept { return ref.operator bool(); }
+};
+} // namespace aurora::gfx
diff --git a/aurora-main/lib/gfx/texture_convert.cpp b/aurora-main/lib/gfx/texture_convert.cpp
new file mode 100644
index 0000000..f61bbeb
--- /dev/null
+++ b/aurora-main/lib/gfx/texture_convert.cpp
@@ -0,0 +1,726 @@
+#include "texture_convert.hpp"
+
+#include "../internal.hpp"
+#include "../gx/gx_fmt.hpp"
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <limits>
+#include <optional>
+#include <vector>
+
+namespace aurora::gfx {
+static Module Log("aurora::gfx");
+
+struct RGBA8 {
+  uint8_t r;
+  uint8_t g;
+  uint8_t b;
+  uint8_t a;
+};
+
+namespace {
+constexpr float kArbMipThreshold = 15.0f;
+
+size_t calc_size_rgba8(uint32_t width, uint32_t height) {
+  return static_cast<size_t>(width) * static_cast<size_t>(height) * sizeof(RGBA8);
+}
+
+size_t calc_offset_rgba8(uint32_t x, uint32_t y, uint32_t width) {
+  return (static_cast<size_t>(y) * static_cast<size_t>(width) + static_cast<size_t>(x)) * sizeof(RGBA8);
+}
+
+/**
+ * Downscales RGBA8 data using a simple box filter.
+ */
+ByteBuffer downscale(const uint8_t* src, uint32_t srcWidth, uint32_t srcHeight, uint32_t dstWidth, uint32_t dstHeight) {
+  ByteBuffer dst{calc_size_rgba8(dstWidth, dstHeight)};
+  auto* dstPixels = dst.data();
+  for (uint32_t y = 0; y < dstHeight; ++y) {
+    const uint32_t srcY0 = std::min(y * 2, srcHeight - 1);
+    const uint32_t srcY1 = std::min(srcY0 + 1, srcHeight - 1);
+    for (uint32_t x = 0; x < dstWidth; ++x) {
+      const uint32_t srcX0 = std::min(x * 2, srcWidth - 1);
+      const uint32_t srcX1 = std::min(srcX0 + 1, srcWidth - 1);
+      const size_t sampleOffsets[4] = {
+          calc_offset_rgba8(srcX0, srcY0, srcWidth),
+          calc_offset_rgba8(srcX1, srcY0, srcWidth),
+          calc_offset_rgba8(srcX0, srcY1, srcWidth),
+          calc_offset_rgba8(srcX1, srcY1, srcWidth),
+      };
+      uint8_t* out = dstPixels + calc_offset_rgba8(x, y, dstWidth);
+      for (size_t channel = 0; channel < 4; ++channel) {
+        uint32_t sum = 0;
+        for (const size_t offset : sampleOffsets) {
+          sum += src[offset + channel];
+        }
+        out[channel] = static_cast<uint8_t>((sum + 2) / 4);
+      }
+    }
+  }
+  return dst;
+}
+
+float avg_diff(const uint8_t* lhs, const uint8_t* rhs, uint32_t width, uint32_t height) {
+  double diffSum = 0.0;
+  const size_t byteCount = calc_size_rgba8(width, height);
+  for (size_t i = 0; i < byteCount; ++i) {
+    const int diff = static_cast<int>(lhs[i]) - static_cast<int>(rhs[i]);
+    diffSum += static_cast<double>(diff * diff);
+  }
+  const double sampleCount = static_cast<double>(width) * static_cast<double>(height) * 4.0;
+  return static_cast<float>(std::sqrt(diffSum / sampleCount) / 2.56);
+}
+
+/**
+ * Attempts to detect whether the mipmaps of a texture are manually-authored, which is sometimes used for mipmap-based
+ * distance effects. This is achieved by downscaling the mipmaps using a box filter and comparing the average pixel
+ * difference between the original and downscaled mipmaps.
+ */
+bool arb_mip_check(uint32_t width, uint32_t height, uint32_t mips, ArrayRef<uint8_t> data) {
+  if (mips < 2) {
+    return false;
+  }
+
+  const uint32_t maxMips = max_texture_mip_count(width, height);
+  if (mips > maxMips) {
+    Log.warn("arb_mip_check: mip count {} exceeds the {} levels supported by {}x{}", mips, maxMips, width, height);
+    return false;
+  }
+
+  struct MipLevel {
+    const uint8_t* data;
+    uint32_t width;
+    uint32_t height;
+  };
+  std::vector<MipLevel> levels;
+  levels.reserve(mips);
+
+  size_t offset = 0;
+  for (uint32_t mip = 0; mip < mips; ++mip) {
+    const size_t mipSize = calc_size_rgba8(width, height);
+    if (offset > data.size() || mipSize > data.size() - offset) {
+      Log.warn("arb_mip_check: expected at least {} bytes, got {}", offset + mipSize, data.size());
+      return false;
+    }
+    levels.push_back({data.data() + offset, width, height});
+    offset += mipSize;
+    width = std::max(width >> 1, 1u);
+    height = std::max(height >> 1, 1u);
+  }
+
+  ByteBuffer downscaled;
+  float totalDiff = 0.0f;
+  for (uint32_t mip = 0; mip + 1 < mips; ++mip) {
+    const uint8_t* src = mip == 0 ? levels[mip].data : downscaled.data();
+    downscaled = downscale(src, levels[mip].width, levels[mip].height, levels[mip + 1].width,
+                           levels[mip + 1].height);
+    totalDiff += avg_diff(levels[mip + 1].data, downscaled.data(), levels[mip + 1].width,
+                          levels[mip + 1].height);
+  }
+  return (totalDiff / static_cast<float>(mips - 1)) > kArbMipThreshold;
+}
+} // namespace
+
+// http://www.mindcontrol.org/~hplus/graphics/expand-bits.html
+template <uint8_t v>
+constexpr uint8_t ExpandTo8(uint8_t n) {
+  if constexpr (v == 3) {
+    return (n << (8 - 3)) | (n << (8 - 6)) | (n >> (9 - 8));
+  } else {
+    return (n << (8 - v)) | (n >> ((v * 2) - 8));
+  }
+}
+
+constexpr uint8_t S3TCBlend(uint32_t a, uint32_t b) {
+  return static_cast<uint8_t>((((a << 1) + a) + ((b << 2) + b)) >> 3);
+}
+
+constexpr uint8_t HalfBlend(uint8_t a, uint8_t b) {
+  return static_cast<uint8_t>((static_cast<uint32_t>(a) + static_cast<uint32_t>(b)) >> 1);
+}
+
+static size_t ComputeMippedTexelCount(uint32_t w, uint32_t h, uint32_t mips) {
+  size_t ret = w * h;
+  for (uint32_t i = mips; i > 1; --i) {
+    if (w > 1) {
+      w /= 2;
+    }
+    if (h > 1) {
+      h /= 2;
+    }
+    ret += w * h;
+  }
+  return ret;
+}
+
+static std::optional<size_t> RequiredTextureDataSize(u32 format, uint32_t width, uint32_t height, uint32_t mips) {
+  if (width == 0 || height == 0 || mips == 0) {
+    return std::nullopt;
+  }
+
+  uint32_t blockWidth = 1;
+  uint32_t blockHeight = 1;
+  uint32_t blockSize = 0;
+  switch (format) {
+    DEFAULT_FATAL("RequiredTextureDataSize: unknown texture format {}", format);
+  case GX_TF_R8_PC:
+    blockSize = 1;
+    break;
+  case GX_TF_RGBA8_PC:
+    blockSize = 4;
+    break;
+  case GX_TF_I4:
+  case GX_TF_C4:
+  case GX_TF_CMPR:
+    blockWidth = 8;
+    blockHeight = 8;
+    blockSize = 32;
+    break;
+  case GX_TF_I8:
+  case GX_TF_IA4:
+  case GX_TF_C8:
+  case GX_TF_Z8:
+    blockWidth = 8;
+    blockHeight = 4;
+    blockSize = 32;
+    break;
+  case GX_TF_IA8:
+  case GX_TF_RGB565:
+  case GX_TF_RGB5A3:
+  case GX_TF_C14X2:
+  case GX_TF_Z16:
+    blockWidth = 4;
+    blockHeight = 4;
+    blockSize = 32;
+    break;
+  case GX_TF_RGBA8:
+  case GX_TF_Z24X8:
+    blockWidth = 4;
+    blockHeight = 4;
+    blockSize = 64;
+    break;
+  }
+
+  size_t total = 0;
+  for (uint32_t mip = 0; mip < mips; ++mip) {
+    const size_t widthBlocks = (static_cast<size_t>(width) + blockWidth - 1) / blockWidth;
+    const size_t heightBlocks = (static_cast<size_t>(height) + blockHeight - 1) / blockHeight;
+    if (widthBlocks > std::numeric_limits<size_t>::max() / heightBlocks ||
+        widthBlocks * heightBlocks > (std::numeric_limits<size_t>::max() - total) / blockSize) {
+      return std::nullopt;
+    }
+    total += widthBlocks * heightBlocks * blockSize;
+    width = std::max(width >> 1, 1u);
+    height = std::max(height >> 1, 1u);
+  }
+  return total;
+}
+
+template <typename T>
+concept TextureDecoder = requires(T) {
+  typename T::Source;
+  typename T::Target;
+  { T::Frac } -> std::convertible_to<uint32_t>;
+  { T::BlockWidth } -> std::convertible_to<uint32_t>;
+  { T::BlockHeight } -> std::convertible_to<uint32_t>;
+  { T::decode_texel(std::declval<typename T::Target*>(), std::declval<const typename T::Source*>(), 0u) };
+};
+
+template <TextureDecoder T>
+static ByteBuffer DecodeTiled(uint32_t width, uint32_t height, uint32_t mips, ArrayRef<uint8_t> data) {
+  const size_t texelCount = ComputeMippedTexelCount(width, height, mips);
+  ByteBuffer buf{texelCount * sizeof(typename T::Target)};
+
+  uint32_t w = width;
+  uint32_t h = height;
+  auto* targetMip = reinterpret_cast<typename T::Target*>(buf.data());
+  const auto* in = reinterpret_cast<const typename T::Source*>(data.data());
+  for (uint32_t mip = 0; mip < mips; ++mip) {
+    const uint32_t bwidth = (w + (T::BlockWidth - 1)) / T::BlockWidth;
+    const uint32_t bheight = (h + (T::BlockHeight - 1)) / T::BlockHeight;
+    for (uint32_t by = 0; by < bheight; ++by) {
+      const uint32_t baseY = by * T::BlockHeight;
+      const uint32_t numRows = std::min(h - baseY, T::BlockHeight);
+      for (uint32_t bx = 0; bx < bwidth; ++bx) {
+        const uint32_t baseX = bx * T::BlockWidth;
+        for (uint32_t y = 0; y < numRows; ++y) {
+          auto* target = targetMip + (baseY + y) * w + baseX;
+          const auto n = std::min(w - baseX, T::BlockWidth);
+          for (uint32_t x = 0; x < n; ++x) {
+            T::decode_texel(target, in, x);
+          }
+          in += T::BlockWidth / T::Frac;
+        }
+        const uint32_t extraY = T::BlockHeight - numRows;
+        in += T::BlockWidth * extraY / T::Frac;
+      }
+    }
+    targetMip += w * h;
+    if (w > 1) {
+      w /= 2;
+    }
+    if (h > 1) {
+      h /= 2;
+    }
+  }
+
+  return buf;
+}
+
+template <TextureDecoder T>
+static ByteBuffer DecodeLinear(uint32_t width, ArrayRef<uint8_t> data) {
+  ByteBuffer buf{width * sizeof(typename T::Target)};
+  auto* target = reinterpret_cast<typename T::Target*>(buf.data());
+  const auto* in = reinterpret_cast<const typename T::Source*>(data.data());
+  for (uint32_t x = 0; x < width; ++x) {
+    T::decode_texel(target, in, x);
+  }
+  return buf;
+}
+
+struct TextureDecoderI4 {
+  using Source = uint8_t;
+  using Target = RGBA8;
+
+  static constexpr uint32_t Frac = 2;
+  static constexpr uint32_t BlockWidth = 8;
+  static constexpr uint32_t BlockHeight = 8;
+
+  static void decode_texel(Target* target, const Source* in, const uint32_t x) {
+    const uint8_t intensity = ExpandTo8<4>(in[x / 2] >> (x & 1 ? 0 : 4) & 0xf);
+    target[x].r = intensity;
+    target[x].g = intensity;
+    target[x].b = intensity;
+    target[x].a = intensity;
+  }
+};
+
+struct TextureDecoderI8 {
+  using Source = uint8_t;
+  using Target = RGBA8;
+
+  static constexpr uint32_t Frac = 1;
+  static constexpr uint32_t BlockWidth = 8;
+  static constexpr uint32_t BlockHeight = 4;
+
+  static void decode_texel(Target* target, const Source* in, const uint32_t x) {
+    const uint8_t intensity = in[x];
+    target[x].r = intensity;
+    target[x].g = intensity;
+    target[x].b = intensity;
+    target[x].a = intensity;
+  }
+};
+
+struct TextureDecoderIA4 {
+  using Source = uint8_t;
+  using Target = RGBA8;
+
+  static constexpr uint32_t Frac = 1;
+  static constexpr uint32_t BlockWidth = 8;
+  static constexpr uint32_t BlockHeight = 4;
+
+  static void decode_texel(Target* target, const Source* in, const uint32_t x) {
+    const uint8_t intensity = ExpandTo8<4>(in[x] & 0xf);
+    target[x].r = intensity;
+    target[x].g = intensity;
+    target[x].b = intensity;
+    target[x].a = ExpandTo8<4>(in[x] >> 4);
+  }
+};
+
+struct TextureDecoderIA8 {
+  using Source = uint16_t;
+  using Target = RGBA8;
+
+  static constexpr uint32_t Frac = 1;
+  static constexpr uint32_t BlockWidth = 4;
+  static constexpr uint32_t BlockHeight = 4;
+
+  static void decode_texel(Target* target, const Source* in, const uint32_t x) {
+    const uint8_t intensity = in[x] >> 8;
+    target[x].r = intensity;
+    target[x].g = intensity;
+    target[x].b = intensity;
+    target[x].a = in[x] & 0xff;
+  }
+};
+
+struct TextureDecoderC4 {
+  using Source = uint8_t;
+  using Target = uint16_t;
+
+  static constexpr uint32_t Frac = 2;
+  static constexpr uint32_t BlockWidth = 8;
+  static constexpr uint32_t BlockHeight = 8;
+
+  static void decode_texel(Target* target, const Source* in, const uint32_t x) {
+    target[x] = in[x / 2] >> (x & 1 ? 0 : 4) & 0xf;
+  }
+};
+
+struct TextureDecoderC8 {
+  using Source = uint8_t;
+  using Target = uint16_t;
+
+  static constexpr uint32_t Frac = 1;
+  static constexpr uint32_t BlockWidth = 8;
+  static constexpr uint32_t BlockHeight = 4;
+
+  static void decode_texel(Target* target, const Source* in, const uint32_t x) { target[x] = in[x]; }
+};
+
+struct TextureDecoderC14X2 {
+  using Source = uint16_t;
+  using Target = uint16_t;
+
+  static constexpr uint32_t Frac = 1;
+  static constexpr uint32_t BlockWidth = 4;
+  static constexpr uint32_t BlockHeight = 4;
+
+  static void decode_texel(Target* target, const Source* in, const uint32_t x) { target[x] = bswap(in[x]) & 0x3fff; }
+};
+
+struct TextureDecoderRGB565 {
+  using Source = uint16_t;
+  using Target = RGBA8;
+
+  static constexpr uint32_t Frac = 1;
+  static constexpr uint32_t BlockWidth = 4;
+  static constexpr uint32_t BlockHeight = 4;
+
+  static void decode_texel(Target* target, const Source* in, const uint32_t x) {
+    const auto texel = bswap(in[x]);
+    target[x].r = ExpandTo8<5>(texel >> 11 & 0x1f);
+    target[x].g = ExpandTo8<6>(texel >> 5 & 0x3f);
+    target[x].b = ExpandTo8<5>(texel & 0x1f);
+    target[x].a = 0xff;
+  }
+};
+
+struct TextureDecoderRGB5A3 {
+  using Source = uint16_t;
+  using Target = RGBA8;
+
+  static constexpr uint32_t Frac = 1;
+  static constexpr uint32_t BlockWidth = 4;
+  static constexpr uint32_t BlockHeight = 4;
+
+  static void decode_texel(Target* target, const Source* in, const uint32_t x) {
+    const auto texel = bswap(in[x]);
+    if ((texel & 0x8000) != 0) {
+      target[x].r = ExpandTo8<5>(texel >> 10 & 0x1f);
+      target[x].g = ExpandTo8<5>(texel >> 5 & 0x1f);
+      target[x].b = ExpandTo8<5>(texel & 0x1f);
+      target[x].a = 0xff;
+    } else {
+      target[x].r = ExpandTo8<4>(texel >> 8 & 0xf);
+      target[x].g = ExpandTo8<4>(texel >> 4 & 0xf);
+      target[x].b = ExpandTo8<4>(texel & 0xf);
+      target[x].a = ExpandTo8<3>(texel >> 12 & 0x7);
+    }
+  }
+};
+
+static ByteBuffer BuildRGBA8FromGCN(uint32_t width, uint32_t height, uint32_t mips, ArrayRef<uint8_t> data) {
+  const size_t texelCount = ComputeMippedTexelCount(width, height, mips);
+  ByteBuffer buf{sizeof(RGBA8) * texelCount};
+
+  uint32_t w = width;
+  uint32_t h = height;
+  auto* targetMip = reinterpret_cast<RGBA8*>(buf.data());
+  const uint8_t* in = data.data();
+  for (uint32_t mip = 0; mip < mips; ++mip) {
+    const uint32_t bwidth = (w + 3) / 4;
+    const uint32_t bheight = (h + 3) / 4;
+    for (uint32_t by = 0; by < bheight; ++by) {
+      const uint32_t baseY = by * 4;
+      for (uint32_t bx = 0; bx < bwidth; ++bx) {
+        const uint32_t baseX = bx * 4;
+        for (uint32_t c = 0; c < 2; ++c) {
+          for (uint32_t y = 0; y < 4; ++y) {
+            for (size_t x = 0; x < 4; ++x) {
+              if (baseX + x >= w || baseY + y >= h) {
+                continue;
+              }
+              RGBA8* target = targetMip + (baseY + y) * w + baseX;
+              if (c != 0) {
+                target[x].g = in[x * 2];
+                target[x].b = in[x * 2 + 1];
+              } else {
+                target[x].a = in[x * 2];
+                target[x].r = in[x * 2 + 1];
+              }
+            }
+            in += 8;
+          }
+        }
+      }
+    }
+    targetMip += w * h;
+    if (w > 1) {
+      w /= 2;
+    }
+    if (h > 1) {
+      h /= 2;
+    }
+  }
+
+  return buf;
+}
+
+static ByteBuffer BuildRGBA8FromCMPR(uint32_t width, uint32_t height, uint32_t mips, ArrayRef<uint8_t> data) {
+  const size_t texelCount = ComputeMippedTexelCount(width, height, mips);
+  ByteBuffer buf{sizeof(RGBA8) * texelCount};
+
+  uint32_t h = height;
+  uint32_t w = width;
+  uint8_t* dst = buf.data();
+  const uint8_t* src = data.data();
+  for (uint32_t mip = 0; mip < mips; ++mip) {
+    for (uint32_t yy = 0; yy < h; yy += 8) {
+      for (uint32_t xx = 0; xx < w; xx += 8) {
+        for (uint32_t yb = 0; yb < 8; yb += 4) {
+          for (uint32_t xb = 0; xb < 8; xb += 4) {
+            // CMPR difference: Big-endian color1/2
+            const uint16_t color1 = bswap(*reinterpret_cast<const uint16_t*>(src));
+            const uint16_t color2 = bswap(*reinterpret_cast<const uint16_t*>(src + 2));
+            src += 4;
+
+            // Fill in first two colors in color table.
+            std::array<uint8_t, 16> color_table{};
+
+            color_table[0] = ExpandTo8<5>(static_cast<uint8_t>((color1 >> 11) & 0x1F));
+            color_table[1] = ExpandTo8<6>(static_cast<uint8_t>((color1 >> 5) & 0x3F));
+            color_table[2] = ExpandTo8<5>(static_cast<uint8_t>(color1 & 0x1F));
+            color_table[3] = 0xFF;
+
+            color_table[4] = ExpandTo8<5>(static_cast<uint8_t>((color2 >> 11) & 0x1F));
+            color_table[5] = ExpandTo8<6>(static_cast<uint8_t>((color2 >> 5) & 0x3F));
+            color_table[6] = ExpandTo8<5>(static_cast<uint8_t>(color2 & 0x1F));
+            color_table[7] = 0xFF;
+            if (color1 > color2) {
+              // Predict gradients.
+              color_table[8] = S3TCBlend(color_table[4], color_table[0]);
+              color_table[9] = S3TCBlend(color_table[5], color_table[1]);
+              color_table[10] = S3TCBlend(color_table[6], color_table[2]);
+              color_table[11] = 0xFF;
+
+              color_table[12] = S3TCBlend(color_table[0], color_table[4]);
+              color_table[13] = S3TCBlend(color_table[1], color_table[5]);
+              color_table[14] = S3TCBlend(color_table[2], color_table[6]);
+              color_table[15] = 0xFF;
+            } else {
+              color_table[8] = HalfBlend(color_table[0], color_table[4]);
+              color_table[9] = HalfBlend(color_table[1], color_table[5]);
+              color_table[10] = HalfBlend(color_table[2], color_table[6]);
+              color_table[11] = 0xFF;
+
+              // CMPR difference: GX fills with an alpha 0 midway point here.
+              color_table[12] = color_table[8];
+              color_table[13] = color_table[9];
+              color_table[14] = color_table[10];
+              color_table[15] = 0;
+            }
+
+            for (uint32_t y = 0; y < 4; ++y) {
+              uint8_t bits = src[y];
+              for (uint32_t x = 0; x < 4; ++x) {
+                if (xx + xb + x >= w || yy + yb + y >= h) {
+                  continue;
+                }
+                uint8_t* dstOffs = dst + ((yy + yb + y) * w + (xx + xb + x)) * 4;
+                const uint8_t* colorTableOffs = &color_table[static_cast<size_t>((bits >> 6) & 3) * 4];
+                memcpy(dstOffs, colorTableOffs, 4);
+                bits <<= 2;
+              }
+            }
+            src += 4;
+          }
+        }
+      }
+    }
+    dst += w * h * 4;
+    if (w > 1) {
+      w /= 2;
+    }
+    if (h > 1) {
+      h /= 2;
+    }
+  }
+
+  return buf;
+}
+
+ConvertedTexture convert_texture(u32 format, uint32_t width, uint32_t height, uint32_t mips, ArrayRef<uint8_t> data) {
+  const uint32_t maxMips = max_texture_mip_count(width, height);
+  const uint32_t safeMips = std::clamp(mips, 1u, maxMips);
+  if (safeMips != mips) {
+    Log.warn("convert_texture: clamping mip count {} to {} for {}x{} texture", mips, safeMips, width, height);
+    mips = safeMips;
+  }
+
+  const auto requiredDataSize = RequiredTextureDataSize(format, width, height, mips);
+  if (!requiredDataSize) {
+    Log.warn("convert_texture: invalid {}x{} texture with {} mip levels", width, height, mips);
+    return {};
+  }
+  if (*requiredDataSize > data.size()) {
+    Log.warn("convert_texture: invalid data size {} for {}x{} texture with {} mip levels (expected at least {} bytes)",
+             data.size(), width, height, mips, *requiredDataSize);
+    return {};
+  }
+
+  ByteBuffer converted;
+  switch (format) {
+    DEFAULT_FATAL("convert_texture: unknown texture format {}", format);
+  case GX_TF_R8_PC:
+    converted = DecodeLinear<TextureDecoderI8>(static_cast<uint32_t>(ComputeMippedTexelCount(width, height, mips)),
+                                                data);
+    break;
+  case GX_TF_RGBA8_PC:
+    return {}; // No conversion
+  case GX_TF_I4:
+    converted = DecodeTiled<TextureDecoderI4>(width, height, mips, data);
+    break;
+  case GX_TF_I8:
+  case GX_TF_Z8:
+    converted = DecodeTiled<TextureDecoderI8>(width, height, mips, data);
+    break;
+  case GX_TF_IA4:
+    converted = DecodeTiled<TextureDecoderIA4>(width, height, mips, data);
+    break;
+  case GX_TF_IA8:
+  case GX_TF_Z16:
+    converted = DecodeTiled<TextureDecoderIA8>(width, height, mips, data);
+    break;
+  case GX_TF_C4:
+    converted = DecodeTiled<TextureDecoderC4>(width, height, mips, data);
+    break;
+  case GX_TF_C8:
+    converted = DecodeTiled<TextureDecoderC8>(width, height, mips, data);
+    break;
+  case GX_TF_C14X2:
+    converted = DecodeTiled<TextureDecoderC14X2>(width, height, mips, data);
+    break;
+  case GX_TF_RGB565:
+    converted = DecodeTiled<TextureDecoderRGB565>(width, height, mips, data);
+    break;
+  case GX_TF_RGB5A3:
+    converted = DecodeTiled<TextureDecoderRGB5A3>(width, height, mips, data);
+    break;
+  case GX_TF_RGBA8:
+  case GX_TF_Z24X8:
+    converted = BuildRGBA8FromGCN(width, height, mips, data);
+    break;
+  case GX_TF_CMPR:
+    converted = BuildRGBA8FromCMPR(width, height, mips, data);
+    break;
+  }
+  const auto wgpuFormat = to_wgpu(format);
+  bool hasArbitraryMips = false;
+  if (wgpuFormat == wgpu::TextureFormat::RGBA8Unorm && mips > 1) {
+    hasArbitraryMips = arb_mip_check(width, height, mips, converted);
+  }
+  return {
+      .format = wgpuFormat,
+      .width = width,
+      .height = height,
+      .mips = mips,
+      .data = std::move(converted),
+      .hasArbitraryMips = hasArbitraryMips,
+  };
+}
+
+ConvertedTexture convert_tlut(u32 format, uint32_t width, ArrayRef<uint8_t> data) {
+  const size_t requiredDataSize = static_cast<size_t>(width) * sizeof(uint16_t);
+  if (requiredDataSize > data.size()) {
+    Log.warn("convert_tlut: invalid data size {} for {} entries (expected at least {} bytes)", data.size(), width,
+             requiredDataSize);
+    return {};
+  }
+
+  ByteBuffer converted;
+  switch (format) {
+    DEFAULT_FATAL("convert_tlut: unsupported tlut format {}", format);
+  case GX_TF_IA8: // GX_TL_IA8
+    converted = DecodeLinear<TextureDecoderIA8>(width, data);
+    break;
+  case GX_TF_RGB565: // GX_TL_RGB565
+    converted = DecodeLinear<TextureDecoderRGB565>(width, data);
+    break;
+  case GX_TF_RGB5A3: // GX_TL_RGB5A3
+    converted = DecodeLinear<TextureDecoderRGB5A3>(width, data);
+    break;
+  }
+  return {
+      .format = wgpu::TextureFormat::RGBA8Unorm,
+      .width = width,
+      .height = 1,
+      .mips = 1,
+      .data = std::move(converted),
+  };
+}
+
+GXTexFmt tlut_texture_format(GXTlutFmt format) noexcept {
+  switch (format) {
+    DEFAULT_FATAL("tlut_texture_format: unsupported tlut format {}", format);
+  case GX_TL_IA8:
+    return GX_TF_IA8;
+  case GX_TL_RGB565:
+    return GX_TF_RGB565;
+  case GX_TL_RGB5A3:
+    return GX_TF_RGB5A3;
+  }
+}
+
+ConvertedTexture convert_texture_palette(u32 textureFormat, uint32_t width, uint32_t height, uint32_t mips,
+                                         ArrayRef<uint8_t> textureData, GXTlutFmt tlutFormat, uint16_t tlutEntries,
+                                         ArrayRef<uint8_t> tlutData) {
+  const auto indices = convert_texture(textureFormat, width, height, mips, textureData);
+  if (indices.data.empty()) {
+    return {};
+  }
+  mips = indices.mips;
+  const auto palette = convert_tlut(tlut_texture_format(tlutFormat), tlutEntries, tlutData);
+  if (palette.data.empty()) {
+    return {};
+  }
+
+  ByteBuffer pixels;
+  pixels.reserve_extra(indices.data.size() / sizeof(u16) * 4);
+
+  const auto* indexData = reinterpret_cast<const u16*>(indices.data.data());
+  const uint32_t baseWidth = width;
+  const uint32_t baseHeight = height;
+  size_t offset = 0;
+  for (u32 mip = 0; mip < mips; ++mip) {
+    const size_t pixelCount = static_cast<size_t>(width) * height;
+    for (size_t i = 0; i < pixelCount; ++i) {
+      const u32 index = indexData[offset + i];
+      if (index >= tlutEntries) {
+        constexpr uint8_t transparent[4] = {0, 0, 0, 0};
+        pixels.append(transparent, sizeof(transparent));
+        continue;
+      }
+      const size_t src = static_cast<size_t>(index) * 4;
+      pixels.append(palette.data.data() + src, 4);
+    }
+    offset += pixelCount;
+    width = std::max(width >> 1, 1u);
+    height = std::max(height >> 1, 1u);
+  }
+
+  bool hasArbitraryMips = arb_mip_check(baseWidth, baseHeight, mips, pixels);
+  return {
+      .format = wgpu::TextureFormat::RGBA8Unorm,
+      .width = baseWidth,
+      .height = baseHeight,
+      .mips = mips,
+      .data = std::move(pixels),
+      .hasArbitraryMips = hasArbitraryMips,
+  };
+}
+} // namespace aurora::gfx
diff --git a/aurora-main/lib/gfx/texture_convert.hpp b/aurora-main/lib/gfx/texture_convert.hpp
new file mode 100644
index 0000000..aff4da8
--- /dev/null
+++ b/aurora-main/lib/gfx/texture_convert.hpp
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "common.hpp"
+#include "texture.hpp"
+#include "../webgpu/gpu.hpp"
+
+namespace aurora::gfx {
+static constexpr wgpu::TextureFormat to_wgpu(u32 gxFormat) {
+  switch (gxFormat) {
+  case GX_TF_C4:
+  case GX_TF_C8:
+  case GX_TF_C14X2:
+    return wgpu::TextureFormat::R16Sint;
+  default:
+    return wgpu::TextureFormat::RGBA8Unorm;
+  }
+}
+
+struct ConvertedTexture {
+  wgpu::TextureFormat format;
+  uint32_t width;
+  uint32_t height;
+  uint32_t mips = 1;
+  ByteBuffer data;
+  bool hasArbitraryMips = false;
+};
+
+ConvertedTexture convert_texture(u32 format, uint32_t width, uint32_t height, uint32_t mips, ArrayRef<uint8_t> data);
+ConvertedTexture convert_texture_palette(u32 textureFormat, uint32_t width, uint32_t height, uint32_t mips,
+                                         ArrayRef<uint8_t> textureData, GXTlutFmt tlutFormat, uint16_t tlutEntries,
+                                         ArrayRef<uint8_t> tlutData);
+ConvertedTexture convert_tlut(u32 format, uint32_t width, ArrayRef<uint8_t> data);
+GXTexFmt tlut_texture_format(GXTlutFmt format) noexcept;
+} // namespace aurora::gfx
diff --git a/aurora-main/lib/gfx/texture_replacement.cpp b/aurora-main/lib/gfx/texture_replacement.cpp
new file mode 100644
index 0000000..5307691
--- /dev/null
+++ b/aurora-main/lib/gfx/texture_replacement.cpp
@@ -0,0 +1,800 @@
+#include "texture_replacement.hpp"
+
+#include "../internal.hpp"
+#include "../gx/gx.hpp"
+#include "../webgpu/gpu.hpp"
+#include "dds_io.hpp"
+#include "texture_convert.hpp"
+
+#include <absl/container/flat_hash_map.h>
+#include <absl/container/flat_hash_set.h>
+#include <fmt/format.h>
+#include <tracy/Tracy.hpp>
+
+#include <algorithm>
+#include <array>
+#include <charconv>
+#include <cstring>
+#include <filesystem>
+#include <list>
+#include <memory>
+#include <optional>
+#include <string_view>
+
+#include "png_io.hpp"
+#include "../fs_helper.hpp"
+
+using namespace aurora::gx;
+using aurora::webgpu::g_device;
+
+namespace aurora::gfx::texture_replacement {
+Module Log("aurora::gfx::texture_replacement");
+
+struct RuntimeTextureKey {
+  uint64_t textureHash = 0;
+  uint64_t tlutHash = 0;
+  uint32_t width = 0;
+  uint32_t height = 0;
+  bool hasTlut = false;
+  uint32_t format = 0;
+
+  bool operator==(const RuntimeTextureKey& rhs) const = default;
+
+  template <typename H>
+  friend H AbslHashValue(H h, const RuntimeTextureKey& key) {
+    return H::combine(std::move(h), key.textureHash, key.tlutHash, key.width, key.height, key.hasTlut, key.format);
+  }
+};
+
+struct TlutMetadata {
+  uint32_t size = 0;
+  uint32_t format = 0;
+  uint16_t entries = 0;
+  bool valid = false;
+  // Object the palette was registered from. GXLoadTlut consumes the registration, so this is what
+  // lets the same object be loaded into more than one hardware slot.
+  const GXTlutObj* source = nullptr;
+  ByteBuffer data;
+};
+
+struct CachedReplacement {
+  gfx::TextureHandle handle;
+  uint64_t bytes = 0;
+  std::list<RuntimeTextureKey>::iterator lruIt;
+};
+
+struct ReplacementIndexEntry {
+  std::filesystem::path path;
+};
+
+absl::flat_hash_map<RuntimeTextureKey, ReplacementIndexEntry> s_replacementIndex;
+absl::flat_hash_map<RuntimeTextureKey, CachedReplacement> s_replacementCache;
+absl::flat_hash_set<RuntimeTextureKey> s_failedKeys;
+absl::flat_hash_set<RuntimeTextureKey> s_reportedMisses;
+absl::flat_hash_map<const GXTlutObj*, TlutMetadata> s_pendingTluts;
+std::array<TlutMetadata, MaxTluts> s_loadedTluts{};
+std::list<RuntimeTextureKey> s_replacementLru;
+std::filesystem::path s_replacementRoot;
+std::filesystem::path s_dumpRoot;
+uint64_t s_replacementCacheBytes = 0;
+constexpr uint64_t kReplacementCacheBudgetBytes = 4294967296; // 4GB, reasonable for modern hardware?
+constexpr uint64_t kReplacementWildcardTextureHash = 0xFFFFFFFFFFFFFFFFull;
+constexpr uint64_t kReplacementWildcardTlutHash = 0xFFFFFFFFFFFFFFFEull;
+
+bool iequals_ascii(std::string_view lhs, std::string_view rhs) noexcept {
+  if (lhs.size() != rhs.size()) {
+    return false;
+  }
+  for (size_t i = 0; i < lhs.size(); ++i) {
+    if (std::tolower(static_cast<unsigned char>(lhs[i])) != std::tolower(static_cast<unsigned char>(rhs[i]))) {
+      return false;
+    }
+  }
+  return true;
+}
+
+bool is_relative_to(const std::filesystem::path& path, const std::filesystem::path& root) noexcept {
+  if (root.empty()) {
+    return false;
+  }
+  auto pathIt = path.begin();
+  auto rootIt = root.begin();
+  for (; rootIt != root.end(); ++rootIt, ++pathIt) {
+    if (pathIt == path.end() || !iequals_ascii(fs_path_to_string(*pathIt), fs_path_to_string(*rootIt))) {
+      return false;
+    }
+  }
+  return true;
+}
+
+bool is_sidecar_mip(std::string_view stem) noexcept {
+  constexpr std::string_view tag = "_mip";
+  size_t i = stem.size();
+  while (i > 0 && stem[i - 1] >= '0' && stem[i - 1] <= '9') {
+    --i;
+  }
+
+  if (i == stem.size() || i < tag.size()) {
+    return false;
+  }
+
+  return stem.substr(i - tag.size(), tag.size()) == tag;
+}
+
+std::optional<uint64_t> parse_hex(std::string_view text) noexcept {
+  if (text.empty()) {
+    return std::nullopt;
+  }
+  uint64_t value = 0;
+  for (const char ch : text) {
+    value <<= 4;
+    if (ch >= '0' && ch <= '9') {
+      value |= static_cast<uint64_t>(ch - '0');
+    } else if (ch >= 'a' && ch <= 'f') {
+      value |= static_cast<uint64_t>(ch - 'a' + 10);
+    } else if (ch >= 'A' && ch <= 'F') {
+      value |= static_cast<uint64_t>(ch - 'A' + 10);
+    } else {
+      return std::nullopt;
+    }
+  }
+  return value;
+}
+
+std::optional<uint32_t> parse_u32(std::string_view text, int base = 10) noexcept {
+  if (text.empty()) {
+    return std::nullopt;
+  }
+
+  uint32_t value = 0;
+  const auto* begin = text.data();
+  const auto* end = begin + text.size();
+  const auto [ptr, ec] = std::from_chars(begin, end, value, base);
+  if (ec != std::errc{} || ptr != end) {
+    return std::nullopt;
+  }
+  return value;
+}
+
+std::optional<std::pair<uint32_t, uint32_t>> parse_dimensions(std::string_view text) noexcept {
+  const size_t sep = text.find('x');
+  if (sep == std::string_view::npos) {
+    return std::nullopt;
+  }
+
+  const auto width = parse_u32(text.substr(0, sep));
+  const auto height = parse_u32(text.substr(sep + 1));
+  if (!width.has_value() || !height.has_value()) {
+    return std::nullopt;
+  }
+  return std::pair{*width, *height};
+}
+
+uint32_t texture_base_level_size(const GXTexObj_& obj) noexcept {
+  switch (obj.format()) {
+  case GX_TF_R8_PC:
+    return obj.width() * obj.height();
+  case GX_TF_RGBA8_PC:
+    return obj.width() * obj.height() * 4;
+  default:
+    return GXGetTexBufferSize(obj.width(), obj.height(), obj.format(), false, 0);
+  }
+}
+
+std::optional<uint64_t> compute_referenced_tlut_hash(const GXTexObj_& obj) noexcept {
+  if (!is_palette_format(obj.format()) || obj.tlut >= s_loadedTluts.size()) {
+    return std::nullopt;
+  }
+
+  const auto& tlut = s_loadedTluts[obj.tlut];
+  const uint32_t textureSize = texture_base_level_size(obj);
+  const auto* textureData = static_cast<const uint8_t*>(obj.data);
+  if (!tlut.valid || textureData == nullptr || textureSize == 0) {
+    return std::nullopt;
+  }
+
+  uint32_t minIndex = 0xffff;
+  uint32_t maxIndex = 0;
+  switch (obj.format()) {
+  case GX_TF_C4:
+    for (uint32_t i = 0; i < textureSize; ++i) {
+      const uint32_t lowNibble = textureData[i] & 0xf;
+      const uint32_t highNibble = textureData[i] >> 4;
+      minIndex = std::min({minIndex, lowNibble, highNibble});
+      maxIndex = std::max({maxIndex, lowNibble, highNibble});
+    }
+    break;
+  case GX_TF_C8:
+    for (uint32_t i = 0; i < textureSize; ++i) {
+      const uint32_t index = textureData[i];
+      minIndex = std::min(minIndex, index);
+      maxIndex = std::max(maxIndex, index);
+    }
+    break;
+  case GX_TF_C14X2:
+    for (uint32_t i = 0; i + sizeof(uint16_t) <= textureSize; i += sizeof(uint16_t)) {
+      uint16_t value = 0;
+      std::memcpy(&value, textureData + i, sizeof(value));
+      const uint32_t index = bswap(value) & 0x3fff;
+      minIndex = std::min(minIndex, index);
+      maxIndex = std::max(maxIndex, index);
+    }
+    break;
+  default:
+    return std::nullopt;
+  }
+
+  size_t tlutSize = 2 * (static_cast<size_t>(maxIndex) + 1 - minIndex);
+  const size_t tlutOffset = 2 * static_cast<size_t>(minIndex);
+  if (tlutOffset + tlutSize > tlut.data.size()) {
+    return std::nullopt;
+  }
+  return XXH64(tlut.data.data() + tlutOffset, tlutSize, 0);
+}
+
+const TlutMetadata* get_loaded_tlut(const GXTexObj_& obj) noexcept {
+  if (!is_palette_format(obj.format()) || obj.tlut >= s_loadedTluts.size()) {
+    return nullptr;
+  }
+
+  const auto& tlut = s_loadedTluts[obj.tlut];
+  return tlut.valid ? &tlut : nullptr;
+}
+
+bool ensure_directory(const std::filesystem::path& dir) noexcept {
+  std::error_code ec;
+  std::filesystem::create_directories(dir, ec);
+  return !ec;
+}
+
+RuntimeTextureKey build_runtime_key(const GXTexObj_& obj) noexcept {
+  RuntimeTextureKey key{
+      .width = obj.width(),
+      .height = obj.height(),
+      .hasTlut = is_palette_format(obj.format()),
+      .format = obj.format(),
+  };
+
+  const uint32_t textureSize = texture_base_level_size(obj);
+  if (obj.data != nullptr && textureSize != 0) {
+    key.textureHash = XXH64(obj.data, textureSize, 0);
+  }
+  if (key.hasTlut) {
+    key.tlutHash = compute_referenced_tlut_hash(obj).value_or(0);
+  }
+  return key;
+}
+
+std::string format_replacement_filename(const RuntimeTextureKey& key) {
+  if (key.hasTlut) {
+    return fmt::format("tex1_{}x{}_{:016x}_{:016x}_{}.dds", key.width, key.height,
+                       key.textureHash, key.tlutHash, key.format);
+  }
+  return fmt::format("tex1_{}x{}_{:016x}_{}.dds", key.width, key.height, key.textureHash, key.format);
+}
+
+std::optional<RuntimeTextureKey> parse_replacement_filename(std::string_view filename) noexcept {
+  const size_t dot = filename.rfind('.');
+  if (dot == std::string_view::npos) {
+    return std::nullopt;
+  }
+
+  if (!iequals_ascii(filename.substr(dot), ".dds") && !iequals_ascii(filename.substr(dot), ".png")) {
+    return std::nullopt;
+  }
+
+  const std::string_view stem = filename.substr(0, dot);
+  constexpr std::string_view prefix = "tex1_";
+  if (!stem.starts_with(prefix)) {
+    return std::nullopt;
+  }
+
+  std::array<std::string_view, 6> parts{};
+  size_t partCount = 0;
+  size_t offset = 0;
+  bool consumedAll = false;
+  while (offset <= stem.size() && partCount < parts.size()) {
+    const size_t next = stem.find('_', offset);
+    parts[partCount++] = stem.substr(offset, next == std::string_view::npos ? stem.size() - offset : next - offset);
+    if (next == std::string_view::npos) {
+      consumedAll = true;
+      break;
+    }
+    offset = next + 1;
+  }
+  if (!consumedAll || partCount < 4 || partCount > 6 || parts[0] != "tex1") {
+    return std::nullopt;
+  }
+
+  const auto dimensions = parse_dimensions(parts[1]);
+  if (!dimensions.has_value()) {
+    return std::nullopt;
+  }
+
+  size_t index = 2;
+  if (parts[index] == "m") {
+    ++index;
+  }
+
+  size_t remaining = partCount - index;
+  if (remaining != 2 && remaining != 3) {
+    return std::nullopt;
+  }
+
+  uint64_t textureHash = 0;
+  if (parts[index] == "$") {
+    textureHash = kReplacementWildcardTextureHash;
+  } else {
+    const auto parsedTex = parse_hex(parts[index]);
+    if (!parsedTex.has_value()) {
+      return std::nullopt;
+    }
+    textureHash = *parsedTex;
+  }
+
+  auto formatPart = parts[partCount - 1];
+  if (formatPart == "arb") {
+    formatPart = parts[partCount - 2];
+    remaining -= 1;
+  }
+  const auto format = parse_u32(formatPart);
+  if (!format.has_value()) {
+    return std::nullopt;
+  }
+
+  uint64_t tlutHash = 0;
+  const bool hasTlut = remaining == 3;
+  if (hasTlut) {
+    const std::string_view tlutPart = parts[index + 1];
+    if (tlutPart == "$") {
+      tlutHash = kReplacementWildcardTlutHash;
+    } else {
+      const auto parsedTlutHash = parse_hex(tlutPart);
+      if (!parsedTlutHash.has_value()) {
+        return std::nullopt;
+      }
+      tlutHash = *parsedTlutHash;
+    }
+  }
+
+  return RuntimeTextureKey{
+      .textureHash = textureHash,
+      .tlutHash = tlutHash,
+      .width = dimensions->first,
+      .height = dimensions->second,
+      .hasTlut = hasTlut,
+      .format = *format,
+  };
+}
+
+static std::optional<ConvertedTexture> load_texture_file(const std::filesystem::path& path) {
+  if (path.extension() == ".png") {
+    return png::load_png_file(path);
+  } else {
+    return dds::load_dds_file(path);
+  }
+}
+
+constexpr bool isUnsupportedTextureFormat(const ConvertedTexture& texture) {
+  switch (texture.format) {
+  case wgpu::TextureFormat::BC1RGBAUnorm:
+  case wgpu::TextureFormat::BC1RGBAUnormSrgb:
+  case wgpu::TextureFormat::BC2RGBAUnorm:
+  case wgpu::TextureFormat::BC2RGBAUnormSrgb:
+  case wgpu::TextureFormat::BC3RGBAUnorm:
+  case wgpu::TextureFormat::BC3RGBAUnormSrgb:
+  case wgpu::TextureFormat::BC4RUnorm:
+  case wgpu::TextureFormat::BC4RSnorm:
+  case wgpu::TextureFormat::BC5RGUnorm:
+  case wgpu::TextureFormat::BC5RGSnorm:
+  case wgpu::TextureFormat::BC6HRGBUfloat:
+  case wgpu::TextureFormat::BC6HRGBFloat:
+  case wgpu::TextureFormat::BC7RGBAUnorm:
+  case wgpu::TextureFormat::BC7RGBAUnormSrgb:
+    return !webgpu::g_bcTexturesSupported;
+  default:
+    return false;
+  }
+}
+
+std::optional<ConvertedTexture> load_replacement(const ReplacementIndexEntry& entry) noexcept {
+  auto base = load_texture_file(entry.path);
+  if (!base.has_value()) {
+    Log.warn("texture_replacement: failed to load texture {}", fs_path_to_string(entry.path));
+    return std::nullopt;
+  }
+  if (isUnsupportedTextureFormat(base.value())) {
+    Log.warn(
+      "texture_replacement: failed to load texture {} due to unsupported format: {}",
+      fs_path_to_string(entry.path),
+      static_cast<uint32_t>(base->format));
+    return std::nullopt;
+  }
+
+  std::vector<ConvertedTexture> more;
+  std::error_code ec;
+  for (uint32_t mipLevel = 1;; ++mipLevel) {
+    const auto mipPath = entry.path.parent_path() / fmt::format("{}_mip{}{}", fs_path_to_string(entry.path.stem()), mipLevel, fs_path_to_string(entry.path.extension()));
+    if (!std::filesystem::is_regular_file(mipPath, ec)) {
+      break;
+    }
+
+    auto lvl = load_texture_file(mipPath);
+    const uint32_t ew = std::max(base->width >> mipLevel, 1u);
+    const uint32_t eh = std::max(base->height >> mipLevel, 1u);
+    const bool ok = lvl.has_value() && lvl->format == base->format && lvl->width == ew && lvl->height == eh;
+    if (!ok) {
+      if (!lvl.has_value()) {
+        Log.warn("texture_replacement: could not load mip {}", fs_path_to_string(mipPath));
+      } else {
+        Log.warn("texture_replacement: expected {}x{} for mip {}, got {}x{}", ew, eh, fs_path_to_string(mipPath),
+                 lvl->width, lvl->height);
+      }
+
+      break;
+    }
+    more.push_back(std::move(*lvl));
+  }
+
+  if (more.empty()) {
+    return base;
+  }
+
+  const uint32_t mips = 1u + static_cast<uint32_t>(more.size());
+  const uint64_t n = calc_texture_size(base->format, base->width, base->height, mips);
+  if (n == 0) {
+    return std::nullopt;
+  }
+
+  ByteBuffer blob{static_cast<size_t>(n)};
+  uint8_t* const dst = blob.data();
+  uint64_t o = 0;
+  const auto append = [&](const ByteBuffer& d) noexcept -> bool {
+    if (o + d.size() > n) {
+      return false;
+    }
+    std::memcpy(dst + o, d.data(), d.size());
+    o += d.size();
+    return true;
+  };
+  if (!append(base->data)) {
+    return std::nullopt;
+  }
+  for (const auto& mip : more) {
+    if (!append(mip.data)) {
+      return std::nullopt;
+    }
+  }
+  if (o != n) {
+    return std::nullopt;
+  }
+
+  return ConvertedTexture{
+      .format = base->format,
+      .width = base->width,
+      .height = base->height,
+      .mips = mips,
+      .data = std::move(blob),
+  };
+}
+
+void touch_cached_replacement(decltype(s_replacementCache)::iterator it) noexcept {
+  if (it->second.lruIt != s_replacementLru.begin()) {
+    s_replacementLru.splice(s_replacementLru.begin(), s_replacementLru, it->second.lruIt);
+    it->second.lruIt = s_replacementLru.begin();
+  }
+}
+
+void evict_replacement_cache_if_needed() noexcept {
+  while (s_replacementCacheBytes > kReplacementCacheBudgetBytes && !s_replacementLru.empty()) {
+    const RuntimeTextureKey key = s_replacementLru.back();
+    s_replacementLru.pop_back();
+
+    const auto it = s_replacementCache.find(key);
+    if (it == s_replacementCache.end()) {
+      continue;
+    }
+
+    const uint64_t entryBytes = it->second.bytes;
+    s_replacementCache.erase(it);
+    s_replacementCacheBytes -= std::min(s_replacementCacheBytes, entryBytes);
+  }
+}
+
+void build_index() noexcept {
+  if (!g_config.allowTextureReplacements) {
+    return;
+  }
+
+  auto userPath = std::filesystem::path{reinterpret_cast<const char8_t*>(g_config.userPath)};
+  auto cachePath = std::filesystem::path{reinterpret_cast<const char8_t*>(g_config.cachePath)};
+
+  s_replacementRoot = userPath / "texture_replacements";
+  s_dumpRoot = cachePath / "texture_dumps";
+
+  if (!ensure_directory(s_replacementRoot)) {
+    return;
+  }
+  if (g_config.allowTextureDumps && !ensure_directory(s_dumpRoot)) {
+    return;
+  }
+
+  std::error_code ec;
+  for (std::filesystem::recursive_directory_iterator it(
+           s_replacementRoot,
+           std::filesystem::directory_options::skip_permission_denied |
+               std::filesystem::directory_options::follow_directory_symlink,
+           ec);
+       it != std::filesystem::recursive_directory_iterator(); it.increment(ec)) {
+    if (ec) {
+      break;
+    }
+
+    if (!it->is_regular_file()) {
+      continue;
+    }
+
+    const auto& path = it->path();
+
+    if (is_relative_to(path, s_dumpRoot)) {
+      continue;
+    }
+
+    if (!iequals_ascii(fs_path_to_string(path.extension()), ".dds") && !iequals_ascii(fs_path_to_string(path.extension()), ".png")) {
+      continue;
+    }
+
+    if (is_sidecar_mip(fs_path_to_string(path.stem()))) {
+      continue;
+    }
+
+    const auto parsed = parse_replacement_filename(fs_path_to_string(path.filename()));
+    if (!parsed.has_value()) {
+      continue;
+    }
+
+    s_replacementIndex.try_emplace(*parsed, path);
+  }
+
+  Log.info("Indexed {} texture replacements", s_replacementIndex.size());
+}
+
+const ReplacementIndexEntry* find_replacement_path(const RuntimeTextureKey& key) noexcept {
+  if (const auto it = s_replacementIndex.find(key); it != s_replacementIndex.end()) {
+    return &it->second;
+  }
+
+  if (key.hasTlut) {
+    RuntimeTextureKey tlutWildcardKey = key;
+    tlutWildcardKey.tlutHash = kReplacementWildcardTlutHash;
+    if (const auto it = s_replacementIndex.find(tlutWildcardKey); it != s_replacementIndex.end()) {
+      return &it->second;
+    }
+  }
+
+  RuntimeTextureKey textureWildcardKey = key;
+  textureWildcardKey.textureHash = kReplacementWildcardTextureHash;
+  if (const auto it = s_replacementIndex.find(textureWildcardKey); it != s_replacementIndex.end()) {
+    return &it->second;
+  }
+
+  return nullptr;
+}
+
+const gfx::TextureHandle* find_cached_replacement(const RuntimeTextureKey& key) noexcept {
+  const auto cached = s_replacementCache.find(key);
+  if (cached == s_replacementCache.end()) {
+    return nullptr;
+  }
+
+  touch_cached_replacement(cached);
+  return &cached->second.handle;
+}
+
+gfx::TextureHandle load_replacement_texture(const RuntimeTextureKey& key, const ReplacementIndexEntry& entry) noexcept {
+  const auto replacement = load_replacement(entry);
+  if (!replacement.has_value()) {
+    s_failedKeys.insert(key);
+    return {};
+  }
+
+  const auto label = fmt::format("TextureReplacement {}", format_replacement_filename(key));
+  const wgpu::Extent3D size{
+      .width = replacement->width,
+      .height = replacement->height,
+      .depthOrArrayLayers = 1,
+  };
+  const wgpu::TextureDescriptor textureDescriptor{
+      .label = label.c_str(),
+      .usage = wgpu::TextureUsage::TextureBinding | wgpu::TextureUsage::CopyDst,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = replacement->format,
+      .mipLevelCount = replacement->mips,
+      .sampleCount = 1,
+  };
+  auto texture = g_device.CreateTexture(&textureDescriptor);
+  const auto viewLabel = fmt::format("{} view", label);
+  const wgpu::TextureViewDescriptor textureViewDescriptor{
+      .label = viewLabel.c_str(),
+      .format = replacement->format,
+      .dimension = wgpu::TextureViewDimension::e2D,
+      .mipLevelCount = replacement->mips,
+  };
+  auto textureView = texture.CreateView(&textureViewDescriptor);
+  auto handle = std::make_shared<gfx::TextureRef>(std::move(texture), std::move(textureView), wgpu::TextureView{}, size,
+                                                  replacement->format, replacement->mips, gfx::InvalidTextureFormat);
+  handle->isReplacement = true;
+  gfx::write_texture(*handle, replacement->data);
+  return handle;
+}
+
+void cache_replacement(const RuntimeTextureKey& key, const gfx::TextureHandle& handle) noexcept {
+  const uint64_t replacementBytes =
+      calc_texture_size(handle->format, handle->size.width, handle->size.height, handle->mipCount);
+  s_replacementLru.push_front(key);
+  s_replacementCache.emplace(
+      key, CachedReplacement{.handle = handle, .bytes = replacementBytes, .lruIt = s_replacementLru.begin()});
+  s_replacementCacheBytes += replacementBytes;
+  evict_replacement_cache_if_needed();
+}
+
+bool dump_editable_texture_dds(const RuntimeTextureKey& key, const GXTexObj_& obj) noexcept {
+  const ArrayRef<uint8_t> texData{static_cast<const uint8_t*>(obj.data), UINT32_MAX};
+  const uint32_t texWidth = obj.width();
+  const uint32_t texHeight = obj.height();
+
+  ConvertedTexture pixels;
+  if (is_palette_format(obj.format())) {
+    const TlutMetadata* tlut = get_loaded_tlut(obj);
+    if (tlut == nullptr) {
+      return false;
+    }
+    pixels =
+        convert_texture_palette(obj.format(), texWidth, texHeight, 1, texData, static_cast<GXTlutFmt>(tlut->format),
+                                tlut->entries, {tlut->data.data(), tlut->data.size()});
+  } else {
+    pixels = convert_texture(obj.format(), texWidth, texHeight, 1, texData);
+  }
+
+  const uint64_t rgbaBytes = calc_texture_size(wgpu::TextureFormat::RGBA8Unorm, texWidth, texHeight, 1);
+
+  if (pixels.data.empty() || pixels.format != wgpu::TextureFormat::RGBA8Unorm || pixels.data.size() != rgbaBytes) {
+    return false;
+  }
+
+  const auto path = s_dumpRoot / format_replacement_filename(key);
+  return dds::write_rgba8_dds(path, texWidth, texHeight, pixels.data);
+}
+
+bool report_missing_key(const RuntimeTextureKey& key, const GXTexObj_& obj) noexcept {
+  if (!s_reportedMisses.insert(key).second) {
+    return false;
+  }
+
+  if (g_config.allowTextureDumps) {
+    dump_editable_texture_dds(key, obj);
+  }
+  return true;
+}
+
+void initialize() noexcept { build_index(); }
+
+void shutdown() noexcept {
+  s_replacementIndex.clear();
+  s_replacementCache.clear();
+  s_failedKeys.clear();
+  s_reportedMisses.clear();
+  s_pendingTluts.clear();
+  for (auto& tlut : s_loadedTluts) {
+    tlut = {};
+  }
+  s_replacementLru.clear();
+  s_replacementCacheBytes = 0;
+  s_replacementRoot.clear();
+  s_dumpRoot.clear();
+}
+
+// Mirrors of the guest palettes, kept only so find_replacement can hash and the DDS dump decode a
+// CI palette. The renderer uploads from the guest pointer, so skip this work when replacement is off.
+void register_tlut(const GXTlutObj* obj, const void* data, GXTlutFmt format, uint16_t entries) noexcept {
+  if (!g_config.allowTextureReplacements) {
+    return;
+  }
+  if (obj == nullptr || data == nullptr) {
+    return;
+  }
+
+  // A registration is only consumed by a matching load_tlut, and the map is keyed by a guest address
+  // the game may free and reuse, so a table this large means stale entries: drop them wholesale.
+  constexpr size_t kMaxPendingTluts = 4096;
+  if (s_pendingTluts.size() >= kMaxPendingTluts && !s_pendingTluts.contains(obj)) {
+    s_pendingTluts.clear();
+  }
+
+  const size_t sz = static_cast<size_t>(entries) * 2;
+  ByteBuffer buffer{sz};
+  std::memcpy(buffer.data(), static_cast<const uint8_t*>(data), sz);
+  s_pendingTluts[obj] = {
+      .size = static_cast<uint32_t>(entries) * 2,
+      .format = static_cast<uint32_t>(format),
+      .entries = entries,
+      .valid = true,
+      .source = obj,
+      .data = std::move(buffer),
+  };
+}
+
+void load_tlut(const GXTlutObj* obj, uint32_t idx) noexcept {
+  if (!g_config.allowTextureReplacements) {
+    return;
+  }
+  if (idx >= s_loadedTluts.size()) {
+    return;
+  }
+
+  // Consume the pending registration. The map is keyed by a guest object address that can be freed
+  // or reused at any time, and entries used to live until shutdown.
+  if (const auto it = s_pendingTluts.find(obj); it != s_pendingTluts.end()) {
+    s_loadedTluts[idx] = std::move(it->second);
+    s_pendingTluts.erase(it);
+    return;
+  }
+
+  // The same object may legally be loaded into several hardware slots; only the first load finds the
+  // pending entry, so recover the palette from whichever slot already holds it.
+  for (const auto& loaded : s_loadedTluts) {
+    if (!loaded.valid || loaded.source != obj) {
+      continue;
+    }
+    s_loadedTluts[idx] = {
+        .size = loaded.size,
+        .format = loaded.format,
+        .entries = loaded.entries,
+        .valid = loaded.valid,
+        .source = loaded.source,
+        .data = loaded.data.clone(),
+    };
+    return;
+  }
+
+  s_loadedTluts[idx] = {};
+}
+
+std::optional<TextureHandle> find_replacement(const GXTexObj_& obj) noexcept {
+  ZoneScoped;
+
+  if (!g_config.allowTextureReplacements) {
+    return std::nullopt;
+  }
+
+  const RuntimeTextureKey key = build_runtime_key(obj);
+  const auto* path = find_replacement_path(key);
+  if (path == nullptr) {
+    report_missing_key(key, obj);
+    return std::nullopt;
+  }
+
+  if (const auto* cached = find_cached_replacement(key); cached != nullptr) {
+    return *cached;
+  }
+
+  if (s_failedKeys.contains(key)) {
+    return std::nullopt;
+  }
+
+  auto handle = load_replacement_texture(key, *path);
+  if (!handle) {
+    return std::nullopt;
+  }
+
+  cache_replacement(key, handle);
+  return handle;
+}
+
+std::string build_texture_replacement_name(const GXTexObj_& obj) noexcept {
+  const RuntimeTextureKey key = build_runtime_key(obj);
+  return format_replacement_filename(key);
+}
+
+} // namespace aurora::gfx::texture_replacement
diff --git a/aurora-main/lib/gfx/texture_replacement.hpp b/aurora-main/lib/gfx/texture_replacement.hpp
new file mode 100644
index 0000000..4b9ee06
--- /dev/null
+++ b/aurora-main/lib/gfx/texture_replacement.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "texture.hpp"
+#include <optional>
+
+namespace aurora::gfx::texture_replacement {
+void initialize() noexcept;
+void shutdown() noexcept;
+void register_tlut(const GXTlutObj* obj, const void* data, GXTlutFmt format, uint16_t entries) noexcept;
+void load_tlut(const GXTlutObj* obj, uint32_t idx) noexcept;
+std::optional<TextureHandle> find_replacement(const GXTexObj_& obj) noexcept;
+std::string build_texture_replacement_name(const GXTexObj_& obj) noexcept;
+} // namespace aurora::gfx::texture_replacement
diff --git a/aurora-main/lib/gx/command_processor.cpp b/aurora-main/lib/gx/command_processor.cpp
new file mode 100644
index 0000000..5f69705
--- /dev/null
+++ b/aurora-main/lib/gx/command_processor.cpp
@@ -0,0 +1,2449 @@
+#include "command_processor.hpp"
+
+#include "../gfx/common.hpp"
+#include "../dolphin/gx/__gx.h"
+#include "../gfx/texture_replacement.hpp"
+#include "dolphin/gx/GXAurora.h"
+#include "gx.hpp"
+#include "gx_fmt.hpp"
+#include "pipeline.hpp"
+#include "shader_info.hpp"
+#include "../internal.hpp"
+
+#include <absl/container/flat_hash_map.h>
+#include <tracy/Tracy.hpp>
+
+#include <algorithm>
+#include <chrono>
+#include <cmath>
+#include <cstdio>
+#include <cstring>
+#include <mutex>
+#include <optional>
+#include <vector>
+
+namespace aurora::gx::fifo {
+static Module Log("aurora::gx::fifo");
+
+using IndexBuffer = std::vector<u16>;
+
+static u32 prepare_idx_template(IndexBuffer& buf, GXPrimitive prim, u16 vtxCount) {
+  size_t writePos = 0;
+  if (prim == GX_QUADS) {
+    // Retain the existing incomplete-quad behavior: every started group emits a complete six-index quad.
+    buf.resize(((static_cast<u32>(vtxCount) + 3u) / 4u) * 6u);
+
+    for (u16 v = 0; v < vtxCount; v += 4) {
+      const u16 idx0 = v;
+      const u16 idx1 = static_cast<u16>(v + 1);
+      const u16 idx2 = static_cast<u16>(v + 2);
+      const u16 idx3 = static_cast<u16>(v + 3);
+      buf[writePos++] = idx0;
+      buf[writePos++] = idx1;
+      buf[writePos++] = idx2;
+      buf[writePos++] = idx2;
+      buf[writePos++] = idx3;
+      buf[writePos++] = idx0;
+    }
+  } else if (prim == GX_TRIANGLES) {
+    buf.resize(vtxCount);
+    for (u16 v = 0; v < vtxCount; ++v) {
+      buf[writePos++] = v;
+    }
+  } else if (prim == GX_TRIANGLEFAN) {
+    const u32 indexCount = vtxCount <= 3 ? vtxCount : 3u + (static_cast<u32>(vtxCount) - 3u) * 3u;
+    buf.resize(indexCount);
+    for (u16 v = 0; v < vtxCount; ++v) {
+      if (v < 3) {
+        buf[writePos++] = v;
+        continue;
+      }
+      buf[writePos++] = 0;
+      buf[writePos++] = static_cast<u16>(v - 1);
+      buf[writePos++] = v;
+    }
+  } else if (prim == GX_TRIANGLESTRIP) {
+    const u32 indexCount = vtxCount <= 3 ? vtxCount : 3u + (static_cast<u32>(vtxCount) - 3u) * 3u;
+    buf.resize(indexCount);
+    for (u16 v = 0; v < vtxCount; ++v) {
+      if (v < 3) {
+        buf[writePos++] = v;
+        continue;
+      }
+      if ((v & 1) == 0) {
+        buf[writePos++] = static_cast<u16>(v - 2);
+        buf[writePos++] = static_cast<u16>(v - 1);
+      } else {
+        buf[writePos++] = static_cast<u16>(v - 1);
+        buf[writePos++] = static_cast<u16>(v - 2);
+      }
+      buf[writePos++] = v;
+    }
+  } else if (prim == GX_LINES || prim == GX_LINESTRIP || prim == GX_POINTS) {
+    buf = {0, 1, 3, 3, 2, 0};
+    writePos = 6;
+  } else
+    UNLIKELY FATAL("unsupported primitive type {}", static_cast<u32>(prim));
+  CHECK(writePos == buf.size(), "index template size mismatch ({} != {})", writePos, buf.size());
+  return static_cast<u32>(writePos);
+}
+
+// GX FIFO opcodes - use CP_ prefix to avoid clashing with GXCommandList.h macros
+static constexpr u8 CP_CMD_NOP = GX_NOP;
+static constexpr u8 CP_CMD_LOAD_CP_REG = GX_LOAD_CP_REG;
+static constexpr u8 CP_CMD_LOAD_XF_REG = GX_LOAD_XF_REG;
+static constexpr u8 CP_CMD_LOAD_INDX_A = GX_LOAD_INDX_A;
+static constexpr u8 CP_CMD_LOAD_INDX_B = GX_LOAD_INDX_B;
+static constexpr u8 CP_CMD_LOAD_INDX_C = GX_LOAD_INDX_C;
+static constexpr u8 CP_CMD_LOAD_INDX_D = GX_LOAD_INDX_D;
+static constexpr u8 CP_CMD_CALL_DL = GX_CMD_CALL_DL;
+static constexpr u8 CP_CMD_INVAL_VTX = GX_CMD_INVL_VC;
+static constexpr u8 CP_CMD_LOAD_BP_REG = GX_LOAD_BP_REG & GX_OPCODE_MASK;
+
+// Primitive type mask
+static constexpr u8 CP_OPCODE_MASK = GX_OPCODE_MASK;
+static constexpr u8 CP_VAT_MASK = GX_VAT_MASK;
+static constexpr u8 CP_PRIMITIVE_START = 0x80;
+static constexpr u8 CP_PRIMITIVE_END = 0xBF;
+
+// Read helpers for big/little endian
+#if _MSC_VER
+template<typename T>
+__forceinline // Yes, this was necessary.
+inline T unaligned_load(const T* ptr) {
+  return *static_cast<const __unaligned T*>(ptr);
+}
+#else
+template<typename T>
+inline T unaligned_load(const T* ptr) {
+  T copy;
+  memcpy(&copy, ptr, sizeof(T));
+  return copy;
+}
+#endif
+
+static inline u16 read_u16(const u8* ptr, bool bigEndian) {
+  const u16 val = unaligned_load(reinterpret_cast<const u16*>(ptr));
+  if (bigEndian) {
+    return bswap(val);
+  }
+  return val;
+}
+
+static inline u32 read_u32(const u8* ptr, bool bigEndian) {
+  const u32 val = unaligned_load(reinterpret_cast<const u32*>(ptr));
+  if (bigEndian) {
+    return bswap(val);
+  }
+  return val;
+}
+
+static bool is_draw_cmd(u8 cmd) {
+  return cmd >= CP_PRIMITIVE_START && cmd <= CP_PRIMITIVE_END;
+}
+
+static GXPrimitive primitive_from_draw_cmd(u8 cmd) {
+  switch (cmd & CP_OPCODE_MASK) {
+  case GX_DRAW_QUADS:
+  case 0x88:
+    return GX_QUADS;
+  case GX_DRAW_TRIANGLES:
+    return GX_TRIANGLES;
+  case GX_DRAW_TRIANGLE_STRIP:
+    return GX_TRIANGLESTRIP;
+  case GX_DRAW_TRIANGLE_FAN:
+    return GX_TRIANGLEFAN;
+  case GX_DRAW_LINES:
+    return GX_LINES;
+  case GX_DRAW_LINE_STRIP:
+    return GX_LINESTRIP;
+  case GX_DRAW_POINTS:
+    return GX_POINTS;
+  default:
+    UNLIKELY FATAL("unsupported primitive command 0x{:02X}", cmd);
+  }
+}
+
+
+
+
+static u32 bp_get(u32 reg, u32 size, u32 shift);
+static inline f32 read_f32(const u8* ptr, bool bigEndian);
+
+static GXPixelFmt decode_pixel_fmt(u32 peCtrl, u32 cmode1) {
+  switch (bp_get(peCtrl, 3, 0)) {
+  case 0:
+    return GX_PF_RGB8_Z24;
+  case 1:
+    return GX_PF_RGBA6_Z24;
+  case 2:
+    return GX_PF_RGB565_Z16;
+  case 3:
+    return GX_PF_Z24;
+  case 4:
+    switch (bp_get(cmode1, 2, 9)) {
+    case 0:
+      return GX_PF_Y8;
+    case 1:
+      return GX_PF_U8;
+    case 2:
+      return GX_PF_V8;
+    default:
+      Log.warn("command_processor: unsupported cmode1 pixel subtype {}", bp_get(cmode1, 2, 9));
+      return GX_PF_Y8;
+    }
+  case 5:
+    return GX_PF_YUV420;
+  default:
+    Log.warn("command_processor: unsupported PE pixel format {}", bp_get(peCtrl, 3, 0));
+    return GX_PF_RGB8_Z24;
+  }
+}
+
+static inline u64 read_u64(const u8* ptr, bool bigEndian) {
+  u64 loaded;
+  // Unaligned-safe load
+  memcpy(&loaded, ptr, sizeof(u64));
+
+  if (bigEndian) {
+    return bswap(loaded);
+  }
+
+  return loaded;
+}
+
+struct TexBpRegMapping {
+  u8 texMapId;
+  enum class Kind : uint8_t { Mode0, Mode1, Image0, Image1, Image2, Image3, Tlut } kind;
+};
+
+static std::optional<TexBpRegMapping> decode_tex_bp_reg(u32 regId) {
+  constexpr std::array mode0Ids{0x80u, 0x81u, 0x82u, 0x83u, 0xA0u, 0xA1u, 0xA2u, 0xA3u};
+  constexpr std::array mode1Ids{0x84u, 0x85u, 0x86u, 0x87u, 0xA4u, 0xA5u, 0xA6u, 0xA7u};
+  constexpr std::array image0Ids{0x88u, 0x89u, 0x8Au, 0x8Bu, 0xA8u, 0xA9u, 0xAAu, 0xABu};
+  constexpr std::array image1Ids{0x8Cu, 0x8Du, 0x8Eu, 0x8Fu, 0xACu, 0xADu, 0xAEu, 0xAFu};
+  constexpr std::array image2Ids{0x90u, 0x91u, 0x92u, 0x93u, 0xB0u, 0xB1u, 0xB2u, 0xB3u};
+  constexpr std::array image3Ids{0x94u, 0x95u, 0x96u, 0x97u, 0xB4u, 0xB5u, 0xB6u, 0xB7u};
+  constexpr std::array tlutIds{0x98u, 0x99u, 0x9Au, 0x9Bu, 0xB8u, 0xB9u, 0xBAu, 0xBBu};
+
+  for (u8 i = 0; i < MaxTextures; ++i) {
+    if (regId == mode0Ids[i]) {
+      return TexBpRegMapping{.texMapId = i, .kind = TexBpRegMapping::Kind::Mode0};
+    }
+    if (regId == mode1Ids[i]) {
+      return TexBpRegMapping{.texMapId = i, .kind = TexBpRegMapping::Kind::Mode1};
+    }
+    if (regId == image0Ids[i]) {
+      return TexBpRegMapping{.texMapId = i, .kind = TexBpRegMapping::Kind::Image0};
+    }
+    if (regId == image1Ids[i]) {
+      return TexBpRegMapping{.texMapId = i, .kind = TexBpRegMapping::Kind::Image1};
+    }
+    if (regId == image2Ids[i]) {
+      return TexBpRegMapping{.texMapId = i, .kind = TexBpRegMapping::Kind::Image2};
+    }
+    if (regId == image3Ids[i]) {
+      return TexBpRegMapping{.texMapId = i, .kind = TexBpRegMapping::Kind::Image3};
+    }
+    if (regId == tlutIds[i]) {
+      return TexBpRegMapping{.texMapId = i, .kind = TexBpRegMapping::Kind::Tlut};
+    }
+  }
+  return std::nullopt;
+}
+
+// Helper to convert packed RGBA8 to Vec4<float>
+static Vec4<float> unpack_color(u32 packed) {
+  return {
+      static_cast<float>(packed >> 24 & 0xFF) / 255.f,
+      static_cast<float>(packed >> 16 & 0xFF) / 255.f,
+      static_cast<float>(packed >> 8 & 0xFF) / 255.f,
+      static_cast<float>(packed & 0xFF) / 255.f,
+  };
+}
+
+static inline f32 read_f32(const u8* ptr, bool bigEndian) {
+  u32 bits = read_u32(ptr, bigEndian);
+  f32 val;
+  std::memcpy(&val, &bits, sizeof(val));
+  return val;
+}
+
+// Marks draw state dirty *and* invalidates the resolved-pipeline memo.
+static inline void mark_pipeline_state_dirty() noexcept {
+  g_gxState.stateDirty = true;
+  g_gxState.pipelineStateGeneration = next_gx_state_epoch();
+}
+
+// Rejects a malformed XF write in release builds.
+#define XF_REQUIRE(cond, msg, ...)                                                                                     \
+  do {                                                                                                                 \
+    if (!(cond)) UNLIKELY {                                                                                            \
+      CHECK(cond, msg, ##__VA_ARGS__);                                                                                  \
+      Log.warn(msg, ##__VA_ARGS__);                                                                                     \
+      return true;                                                                                                     \
+    }                                                                                                                  \
+  } while (0)
+
+static bool copy_xf_data(u32 addr, const u8* data, u32 len, bool bigEndian) {
+  if (addr < 0x78) {
+    // Position matrices (0x0000 - 0x0077)
+    u32 mtxIdx = addr / 12;
+    u32 startOffset = addr % 12;
+    // We only support full writes to matrices
+    XF_REQUIRE(mtxIdx < MaxPnMtx, "XF: PosMtx copy oob; mtxIdx={}", mtxIdx);
+    XF_REQUIRE(startOffset == 0 && len == 12, "XF: PosMtx sub-copy unsupported: offs={}, len={}", startOffset, len);
+    auto& mtx = g_gxState.pnMtx[mtxIdx].pos;
+    f32* flat = reinterpret_cast<f32*>(&mtx);
+    for (u32 i = 0; i < len; i++) {
+      flat[i] = read_f32(data + i * 4, bigEndian);
+    }
+    g_gxState.stateDirty = true;
+    return true;
+  } else if (addr < 0x0F0) {
+    // Texture matrices (0x078-0x0EF)
+    u32 texBase = addr - 0x078;
+    u32 mtxIdx = texBase / 12;
+    u32 startOffset = texBase % 12;
+    XF_REQUIRE(mtxIdx < MaxTexMtx, "XF TexMtx copy oob; mtxIdx={}", mtxIdx);
+    XF_REQUIRE(startOffset == 0 && (len == 8 || len == 12), "XF TexMtx sub-copy unsupported: offs={}, len={}",
+               startOffset, len);
+
+    // Determine if 2x4 or 3x4 from count
+    auto& mtx = g_gxState.texMtxs[mtxIdx];
+    f32* flat = reinterpret_cast<f32*>(&mtx);
+    for (u32 i = 0; i < len; i++) {
+      flat[i] = read_f32(data + i * 4, bigEndian);
+    }
+    g_gxState.stateDirty = true;
+    return true;
+  } else if (addr >= 0x400 && addr < 0x45A) {
+    // Normal matrices (0x400-0x459)
+    u32 nrmBase = addr - 0x400;
+    u32 mtxIdx = nrmBase / 9;
+    u32 startOffset = nrmBase % 9;
+    // We only support full writes to matrices
+    XF_REQUIRE(mtxIdx < MaxPnMtx, "XF: NrmMtx copy oob; mtxIdx={}", mtxIdx);
+    XF_REQUIRE(startOffset == 0 && len == 9, "XF: NrmMtx sub-copy unsupported: offs={}, len={}", startOffset, len);
+    auto& mtx = g_gxState.pnMtx[mtxIdx].nrm;
+    f32* flat = reinterpret_cast<f32*>(&mtx);
+    for (u32 i = 0; i < len; i++) {
+      u32 xfIdx = i;
+      u32 row = xfIdx / 3;
+      u32 col = xfIdx % 3;
+      if (row < 3) {
+        flat[row * 4 + col] = read_f32(data + i * 4, bigEndian);
+      }
+    }
+    g_gxState.stateDirty = true;
+    return true;
+  } else if (addr >= 0x500 && addr < 0x5F0) {
+    // Post-transform texture matrices (0x500-0x5EF)
+    u32 ptBase = addr - 0x500;
+    u32 mtxIdx = ptBase / 12;
+    u32 startOffset = ptBase % 12;
+    XF_REQUIRE(mtxIdx < MaxPTTexMtx, "XF: PTTexMtx copy oob; mtxIdx={}", mtxIdx);
+    XF_REQUIRE(startOffset == 0 && len == 12, "XF: PTTexMtx sub-copy unsupported: offs={}, len={}", startOffset, len);
+    auto& mtx = g_gxState.ptTexMtxs[mtxIdx];
+    f32* flat = reinterpret_cast<f32*>(&mtx);
+    for (u32 i = 0; i < len; i++) {
+      flat[startOffset + i] = read_f32(data + i * 4, bigEndian);
+    }
+    g_gxState.stateDirty = true;
+    return true;
+  } else if (addr >= 0x600 && addr < 0x680) {
+    // Lights (0x600-0x67F) - 8 lights, 16 values each
+    u32 lightBase = addr - 0x600;
+    u32 lightIdx = lightBase / 0x10;
+    u32 startOffset = lightBase % 0x10;
+    XF_REQUIRE(lightIdx < GX::MaxLights, "XF: Light copy oob; lightIdx={}", lightIdx);
+    XF_REQUIRE(startOffset + len <= 0x10,
+               "XF: Light copy that crosses across light boundaries unsupported: offs={}, len={}", startOffset, len);
+    auto& light = g_gxState.lights[lightIdx];
+    for (u32 i = 0; i < len; i++) {
+      u32 field = startOffset + i;
+      f32 val = read_f32(data + i * 4, bigEndian);
+      u32 ival = read_u32(data + i * 4, bigEndian);
+      switch (field) {
+      case 3: // Color (packed u32)
+        light.color = unpack_color(ival);
+        break;
+      case 4:
+        light.cosAtt[0] = val;
+        break; // a0
+      case 5:
+        light.cosAtt[1] = val;
+        break; // a1
+      case 6:
+        light.cosAtt[2] = val;
+        break; // a2
+      case 7:
+        light.distAtt[0] = val;
+        break; // k0
+      case 8:
+        light.distAtt[1] = val;
+        break; // k1
+      case 9:
+        light.distAtt[2] = val;
+        break; // k2
+      case 10:
+        light.pos[0] = val;
+        break; // px
+      case 11:
+        light.pos[1] = val;
+        break; // py
+      case 12:
+        light.pos[2] = val;
+        break; // pz
+      case 13:
+        light.dir[0] = val;
+        break; // nx
+      case 14:
+        light.dir[1] = val;
+        break; // ny
+      case 15:
+        light.dir[2] = val;
+        break; // nz
+      default:
+        break; // padding (0-2)
+      }
+    }
+    g_gxState.preparedLightsDirty = true;
+    g_gxState.stateDirty = true;
+    return true;
+  }
+  return false;
+}
+
+static void apply_xf_viewport() {
+  const auto& vp = g_gxState.xfViewport;
+  const f32 sx = vp[0];
+  const f32 sy = vp[1];
+  const f32 sz = vp[2];
+  const f32 ox = vp[3];
+  const f32 oy = vp[4];
+  const f32 oz = vp[5];
+  const f32 width = sx * 2.0f;
+  const f32 height = -sy * 2.0f;
+  constexpr f32 z24Scale = 16777216.0f;
+
+  set_logical_viewport({
+      .left = ox - 340.0f - width / 2.0f,
+      .top = oy - 340.0f - height / 2.0f,
+      .width = width,
+      .height = height,
+      .znear = (oz - sz) / z24Scale,
+      .zfar = oz / z24Scale,
+  });
+}
+
+static void apply_xf_projection() {
+  const auto& raw = g_gxState.xfProjection;
+  auto& proj = g_gxState.proj;
+  proj = {};
+  proj.m0[0] = raw[0];
+  proj.m1[1] = raw[2];
+  proj.m2[2] = raw[4];
+  proj.m2[3] = raw[5];
+
+  if (g_gxState.projType == GX_ORTHOGRAPHIC) {
+    proj.m0[3] = raw[1];
+    proj.m1[3] = raw[3];
+    proj.m3[3] = 1.0f;
+  } else {
+    proj.m0[2] = raw[1];
+    proj.m1[2] = raw[3];
+    proj.m3[2] = -1.0f;
+  }
+
+  g_gxState.stateDirty = true;
+}
+
+// Forward declarations for register handlers
+static void handle_bp(u32 value, bool bigEndian);
+static void handle_cp(u8 addr, u32 value, bool bigEndian);
+static void handle_xf(const u8* data, u32& pos, u32 size, bool bigEndian);
+static bool handle_draw(u8 cmd, const u8* data, u32& pos, u32 size, bool bigEndian);
+static bool handle_aurora(const u8* data, u32& pos, u32 size, bool bigEndian);
+
+void process(const u8* data, u32 size, bool bigEndian) {
+  ZoneScoped;
+  // Everything decoded here mutates renderer state (GX state, the recorded command lists and the mapped staging buffers), so take the renderer GPU mutex once for the whole drain rather than once per draw command.
+  std::lock_guard gpuLock(aurora::renderer_gpu_mutex());
+  u32 pos = 0;
+
+  while (pos < size) {
+    u8 cmd = data[pos++];
+    u8 opcode = cmd & CP_OPCODE_MASK;
+    // Log.warn("Processing opcode {:02x} at pos {} (size {})", opcode, pos - 1, size);
+
+    switch (opcode) {
+    case CP_CMD_NOP:
+      continue;
+
+    case CP_CMD_LOAD_BP_REG: {
+      CHECK(pos + 4 <= size, "BP reg read overrun");
+      u32 value = read_u32(data + pos, bigEndian);
+      pos += 4;
+      handle_bp(value, bigEndian);
+      break;
+    }
+
+    case CP_CMD_LOAD_CP_REG: {
+      CHECK(pos + 5 <= size, "CP reg read overrun");
+      u8 addr = data[pos++];
+      u32 value = read_u32(data + pos, bigEndian);
+      pos += 4;
+      handle_cp(addr, value, bigEndian);
+      break;
+    }
+
+    case CP_CMD_LOAD_XF_REG: {
+      handle_xf(data, pos, size, bigEndian);
+      break;
+    }
+
+    case CP_CMD_LOAD_INDX_A:
+    case CP_CMD_LOAD_INDX_B:
+    case CP_CMD_LOAD_INDX_C:
+    case CP_CMD_LOAD_INDX_D: {
+      ZoneScopedN("LOAD_INDX");
+      CHECK(pos + 4 <= size, "indexed XF read overrun");
+      const u32 value = read_u32(data + pos, bigEndian);
+      pos += 4;
+
+      const u32 arrayType = GX_POS_MTX_ARRAY + ((opcode - CP_CMD_LOAD_INDX_A) / 0x08);
+      const u32 srcArrayIdx = value >> 16;
+      const u16 len = static_cast<u16>(((value >> 12) & 0x0f) + 1);
+      const u16 dstAddr = static_cast<u16>(value & 0x0fff);
+      auto const& array = g_gxState.arrays[arrayType];
+      const u32 byteOffset = srcArrayIdx * array.stride;
+      const u32 byteCount = static_cast<u32>(len) * 4u;
+      if (array.data == nullptr || array.stride == 0 || byteOffset + byteCount > array.size) {
+        static u32 invalidIndexedXfLogCount = 0;
+        if (invalidIndexedXfLogCount < 16) {
+          Log.warn("Skipping indexed XF load with invalid source array: array={} idx={} stride={} offset={} bytes={} "
+                   "size={} dst=0x{:04X}",
+                   arrayType, srcArrayIdx, array.stride, byteOffset, byteCount, array.size, dstAddr);
+          ++invalidIndexedXfLogCount;
+        }
+        break;
+      }
+      u8* srcData = ((u8*)array.data) + byteOffset;
+      if (!copy_xf_data(dstAddr, srcData, len, bigEndian)) {
+#ifndef NDEBUG
+        Log.debug("Unimplemented indexed XF load (opcode 0x{:02X}, dstAddr=0x{:04X})", opcode, dstAddr);
+#endif
+      }
+      break;
+    }
+
+    case CP_CMD_CALL_DL: {
+      // Call display list: 8 bytes (address + size)
+      CHECK(pos + 8 <= size, "call DL read overrun");
+      Log.warn("Ignoring nested GX_CMD_CALL_DL");
+      pos += 8;
+      break;
+    }
+
+    case CP_CMD_INVAL_VTX: {
+      // GXInvalidateVtxCache tells the GPU that CPU-written indexed vertex arrays must be observed by subsequent draws.
+      for (int i = GX_VA_POS; i <= GX_VA_TEX7; ++i) {
+        g_gxState.arrays[i].cachedRange = {};
+      }
+      break;
+    }
+
+    case GX_LOAD_AURORA: {
+      if (!handle_aurora(data, pos, size, bigEndian)) {
+        return;
+      }
+      break;
+    }
+
+    default:
+      // Draw commands occupy the full 0x80-0xBF range.
+      if (is_draw_cmd(cmd)) {
+        if (!handle_draw(cmd, data, pos, size, bigEndian)) {
+          return;
+        }
+      } else {
+        static u32 unknownLogCount = 0;
+        if (unknownLogCount < 16) {
+          // Hex dump surrounding bytes for debugging
+          u32 dumpStart = (pos > 17) ? pos - 17 : 0;
+          u32 dumpEnd = (pos + 16 < size) ? pos + 16 : size;
+          std::string hex;
+          for (u32 i = dumpStart; i < dumpEnd; i++) {
+            if (i == pos - 1)
+              hex += fmt::format("[{:02x}]", data[i]);
+            else
+              hex += fmt::format(" {:02x}", data[i]);
+          }
+          Log.warn("  hex dump (pos {}-{}):{}", dumpStart, dumpEnd - 1, hex);
+          Log.warn("command_processor: unknown opcode 0x{:02X} at pos {}", cmd, pos - 1);
+          ++unknownLogCount;
+        }
+      }
+      break;
+    }
+  }
+}
+
+// Helper to extract bit fields from a 32-bit register
+inline static u32 bp_get(u32 reg, u32 size, u32 shift) { return reg >> shift & (1u << size) - 1; }
+
+static u8 normal_frac_bits(GXCompType type) {
+  switch (type) {
+  case GX_U8:
+    return 7;
+  case GX_S8:
+    return 6;
+  case GX_U16:
+    return 15;
+  case GX_S16:
+    return 14;
+  default:
+    return 0;
+  }
+}
+
+static void refresh_copy_filter_flags() {
+  bool aa = false;
+  for (const auto& sample : g_gxState.copyFilterSamplePattern) {
+    aa |= sample[0] != 6 || sample[1] != 6;
+  }
+  g_gxState.copyFilterAa = aa;
+
+  static constexpr std::array<u8, 7> DefaultVFilter{0, 0, 21, 22, 21, 0, 0};
+  bool vf = false;
+  for (size_t i = 0; i < DefaultVFilter.size(); ++i) {
+    vf |= g_gxState.copyFilterVFilter[i] != DefaultVFilter[i];
+  }
+  g_gxState.copyFilterVf = vf;
+}
+
+// BP register handler - decodes BP (RAS/pixel engine) register writes and updates g_gxState
+static void handle_bp(u32 value, bool bigEndian) {
+  u32 regId = (value >> 24) & 0xFF;
+  // Mask off the register ID from the value for field extraction
+  // (the regId is stored in bits 24-31, data is in bits 0-23)
+
+  if (regId == 0xFE) {
+    g_gxState.bpRegCache[regId] = value & 0x00FFFFFF;
+    return;
+  } else {
+    const u32 ssMask = g_gxState.bpRegCache[0xFE];
+    // A preceding 0xFE write is rare; the common path only has to prove the mask is already wide open.
+    if (ssMask != 0x00FFFFFF) UNLIKELY {
+      g_gxState.bpRegCache[0xFE] = 0x00FFFFFF;
+    }
+    const u32 merged = (g_gxState.bpRegCache[regId] & ~ssMask) | (value & ssMask);
+    value = (regId << 24) | (merged & 0x00FFFFFF);
+    if (g_gxState.bpRegCache[regId] == value) return;
+    g_gxState.bpRegCache[regId] = value;
+  }
+  // TEV color combiner stages (0xC0, 0xC2, 0xC4, ... 0xDE)
+  if (regId >= 0xC0 && regId <= 0xDE && (regId & 1) == 0) {
+    u32 stage = (regId - 0xC0) / 2;
+    if (stage < MaxTevStages) {
+      auto& s = g_gxState.tevStages[stage];
+      s.colorPass.d = static_cast<GXTevColorArg>(bp_get(value, 4, 0));
+      s.colorPass.c = static_cast<GXTevColorArg>(bp_get(value, 4, 4));
+      s.colorPass.b = static_cast<GXTevColorArg>(bp_get(value, 4, 8));
+      s.colorPass.a = static_cast<GXTevColorArg>(bp_get(value, 4, 12));
+      s.colorOp.clamp = bp_get(value, 1, 19) != 0;
+      s.colorOp.outReg = static_cast<GXTevRegID>(bp_get(value, 2, 22));
+      if (bp_get(value, 2, 16) == 3) {
+        // Bias==3 means compare mode: reconstruct GXTevOp enum (8 + 3-bit hw value)
+        u32 hwOp = bp_get(value, 1, 18) | (bp_get(value, 2, 20) << 1);
+        s.colorOp.op = static_cast<GXTevOp>(hwOp + 8);
+        s.colorOp.bias = GX_TB_ZERO;
+        s.colorOp.scale = GX_CS_SCALE_1;
+      } else {
+        // Normal mode: bit18 is op (0=ADD, 1=SUB), bits16-17 is bias, bits20-21 is scale
+        s.colorOp.op = static_cast<GXTevOp>(bp_get(value, 1, 18));
+        s.colorOp.bias = static_cast<GXTevBias>(bp_get(value, 2, 16));
+        s.colorOp.scale = static_cast<GXTevScale>(bp_get(value, 2, 20));
+      }
+      mark_pipeline_state_dirty();
+    }
+    return;
+  }
+
+  // TEV alpha combiner stages (0xC1, 0xC3, 0xC5, ... 0xDF)
+  if (regId >= 0xC1 && regId <= 0xDF && (regId & 1) == 1) {
+    u32 stage = (regId - 0xC1) / 2;
+    if (stage < MaxTevStages) {
+      auto& s = g_gxState.tevStages[stage];
+      s.tevSwapRas = static_cast<GXTevSwapSel>(bp_get(value, 2, 0));
+      s.tevSwapTex = static_cast<GXTevSwapSel>(bp_get(value, 2, 2));
+      s.alphaPass.d = static_cast<GXTevAlphaArg>(bp_get(value, 3, 4));
+      s.alphaPass.c = static_cast<GXTevAlphaArg>(bp_get(value, 3, 7));
+      s.alphaPass.b = static_cast<GXTevAlphaArg>(bp_get(value, 3, 10));
+      s.alphaPass.a = static_cast<GXTevAlphaArg>(bp_get(value, 3, 13));
+      s.alphaOp.clamp = bp_get(value, 1, 19) != 0;
+      s.alphaOp.outReg = static_cast<GXTevRegID>(bp_get(value, 2, 22));
+      if (bp_get(value, 2, 16) == 3) {
+        u32 hwOp = bp_get(value, 1, 18) | (bp_get(value, 2, 20) << 1);
+        s.alphaOp.op = static_cast<GXTevOp>(hwOp + 8);
+        s.alphaOp.bias = GX_TB_ZERO;
+        s.alphaOp.scale = GX_CS_SCALE_1;
+      } else {
+        s.alphaOp.op = static_cast<GXTevOp>(bp_get(value, 1, 18));
+        s.alphaOp.bias = static_cast<GXTevBias>(bp_get(value, 2, 16));
+        s.alphaOp.scale = static_cast<GXTevScale>(bp_get(value, 2, 20));
+      }
+      mark_pipeline_state_dirty();
+    }
+    return;
+  }
+
+  switch (regId) {
+  // genMode (0x00)
+  case 0x00: {
+    g_gxState.numTexGens = bp_get(value, 4, 0);
+    g_gxState.numChans = bp_get(value, 3, 4);
+    // genMode owns the same numTexGens/numChans that XF 0x3F/0x09 decode, so the XF cache can no longer vouch for those two slots.
+    g_gxState.invalidateXfReg(0x3F);
+    g_gxState.invalidateXfReg(0x09);
+    g_gxState.numTevStages = bp_get(value, 4, 10) + 1;
+    u32 hwCull = bp_get(value, 2, 14);
+    // Swap front/back to match GX convention
+    switch (hwCull) {
+    case GX_CULL_FRONT:
+      g_gxState.cullMode = GX_CULL_BACK;
+      break;
+    case GX_CULL_BACK:
+      g_gxState.cullMode = GX_CULL_FRONT;
+      break;
+    default:
+      g_gxState.cullMode = static_cast<GXCullMode>(hwCull);
+      break;
+    }
+    g_gxState.numIndStages = bp_get(value, 3, 16);
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // Display copy sample pattern (0x01-0x04), six 4-bit samples per BP reg.
+  case 0x01:
+  case 0x02:
+  case 0x03:
+  case 0x04: {
+    const size_t first = static_cast<size_t>(regId - 0x01) * 6;
+    for (size_t i = 0; i < 6; ++i) {
+      const size_t sample = first + i;
+      g_gxState.copyFilterSamplePattern[sample / 2][sample % 2] = static_cast<u8>(bp_get(value, 4, i * 4));
+    }
+    refresh_copy_filter_flags();
+    break;
+  }
+
+  // Indirect texture mask (0x0F).
+  case 0x0F:
+    g_gxState.indTexMask = static_cast<u8>(value & 0xFF);
+    g_gxState.stateDirty = true;
+    break;
+
+  // TEV indirect stages (0x10-0x1F)
+  case 0x10:
+  case 0x11:
+  case 0x12:
+  case 0x13:
+  case 0x14:
+  case 0x15:
+  case 0x16:
+  case 0x17:
+  case 0x18:
+  case 0x19:
+  case 0x1A:
+  case 0x1B:
+  case 0x1C:
+  case 0x1D:
+  case 0x1E:
+  case 0x1F: {
+    u32 stage = regId - 0x10;
+    if (stage < MaxTevStages) {
+      auto& s = g_gxState.tevStages[stage];
+      s.indTexStage = static_cast<GXIndTexStageID>(bp_get(value, 2, 0));
+      s.indTexFormat = static_cast<GXIndTexFormat>(bp_get(value, 2, 2));
+      s.indTexBiasSel = static_cast<GXIndTexBiasSel>(bp_get(value, 3, 4));
+      s.indTexAlphaSel = static_cast<GXIndTexAlphaSel>(bp_get(value, 2, 7));
+      s.indTexMtxId = static_cast<GXIndTexMtxID>(bp_get(value, 4, 9));
+      s.indTexWrapS = static_cast<GXIndTexWrap>(bp_get(value, 3, 13));
+      s.indTexWrapT = static_cast<GXIndTexWrap>(bp_get(value, 3, 16));
+      s.indTexUseOrigLOD = bp_get(value, 1, 19) != 0;
+      s.indTexAddPrev = bp_get(value, 1, 20) != 0;
+      mark_pipeline_state_dirty();
+    }
+    break;
+  }
+
+  // Scissor registers (0x20, 0x21)
+  case 0x20:
+  case 0x21: {
+    const u32 scis0 = g_gxState.bpRegCache[0x20];
+    const u32 scis1 = g_gxState.bpRegCache[0x21];
+    const int32_t tp = static_cast<int32_t>(bp_get(scis0, 11, 0)) - 342;
+    const int32_t lf = static_cast<int32_t>(bp_get(scis0, 11, 12)) - 342;
+    const int32_t bm = static_cast<int32_t>(bp_get(scis1, 11, 0)) - 342;
+    const int32_t rt = static_cast<int32_t>(bp_get(scis1, 11, 12)) - 342;
+    const int32_t wd = std::max(rt - lf + 1, 0);
+    const int32_t ht = std::max(bm - tp + 1, 0);
+    set_logical_scissor({lf, tp, wd, ht});
+    break;
+  }
+
+  // Line/point size (0x22)
+  case 0x22: {
+    g_gxState.lineWidth = static_cast<u8>(bp_get(value, 8, 0));
+    g_gxState.pointSize = static_cast<u8>(bp_get(value, 8, 8));
+    g_gxState.lineTexOffset = static_cast<GXTexOffset>(bp_get(value, 3, 16));
+    g_gxState.pointTexOffset = static_cast<GXTexOffset>(bp_get(value, 3, 19));
+    g_gxState.lineHalfAspect = bp_get(value, 1, 22) != 0;
+    g_gxState.stateDirty = true;
+    break;
+  }
+
+  // Indirect texture scale (0x25, 0x26)
+  case 0x25: {
+    if (MaxIndStages > 0) {
+      g_gxState.indStages[0].scaleS = static_cast<GXIndTexScale>(bp_get(value, 4, 0));
+      g_gxState.indStages[0].scaleT = static_cast<GXIndTexScale>(bp_get(value, 4, 4));
+    }
+    if (MaxIndStages > 1) {
+      g_gxState.indStages[1].scaleS = static_cast<GXIndTexScale>(bp_get(value, 4, 8));
+      g_gxState.indStages[1].scaleT = static_cast<GXIndTexScale>(bp_get(value, 4, 12));
+    }
+    mark_pipeline_state_dirty();
+    break;
+  }
+  case 0x26: {
+    if (MaxIndStages > 2) {
+      g_gxState.indStages[2].scaleS = static_cast<GXIndTexScale>(bp_get(value, 4, 0));
+      g_gxState.indStages[2].scaleT = static_cast<GXIndTexScale>(bp_get(value, 4, 4));
+    }
+    if (MaxIndStages > 3) {
+      g_gxState.indStages[3].scaleS = static_cast<GXIndTexScale>(bp_get(value, 4, 8));
+      g_gxState.indStages[3].scaleT = static_cast<GXIndTexScale>(bp_get(value, 4, 12));
+    }
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // Indirect texture reference (0x27)
+  case 0x27: {
+    for (u32 i = 0; i < MaxIndStages; i++) {
+      g_gxState.indStages[i].texMapId = static_cast<GXTexMapID>(bp_get(value, 3, i * 6));
+      g_gxState.indStages[i].texCoordId = static_cast<GXTexCoordID>(bp_get(value, 3, i * 6 + 3));
+    }
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // TEV order / tref (0x28-0x2F) - 2 stages per register
+  case 0x28:
+  case 0x29:
+  case 0x2A:
+  case 0x2B:
+  case 0x2C:
+  case 0x2D:
+  case 0x2E:
+  case 0x2F: {
+    u32 idx = regId - 0x28;
+    u32 stage0 = idx * 2;
+    u32 stage1 = idx * 2 + 1;
+
+    // Channel ID reverse mapping from hardware to GX
+    static const GXChannelID r2c[] = {GX_COLOR0A0, GX_COLOR1A1,   GX_COLOR0A0,    GX_COLOR1A1,
+                                      GX_COLOR0A0, GX_ALPHA_BUMP, GX_ALPHA_BUMPN, GX_COLOR_ZERO};
+
+    if (stage0 < MaxTevStages) {
+      auto& s = g_gxState.tevStages[stage0];
+      s.texMapId = static_cast<GXTexMapID>(bp_get(value, 3, 0));
+      s.texCoordId = static_cast<GXTexCoordID>(bp_get(value, 3, 3));
+      // bit 6 = tex enable
+      if (!bp_get(value, 1, 6)) {
+        s.texMapId = GX_TEXMAP_NULL;
+      }
+      u32 chanHw = bp_get(value, 3, 7);
+      s.channelId = (chanHw < 8) ? r2c[chanHw] : GX_COLOR_NULL;
+    }
+    if (stage1 < MaxTevStages) {
+      auto& s = g_gxState.tevStages[stage1];
+      s.texMapId = static_cast<GXTexMapID>(bp_get(value, 3, 12));
+      s.texCoordId = static_cast<GXTexCoordID>(bp_get(value, 3, 15));
+      if (!bp_get(value, 1, 18)) {
+        s.texMapId = GX_TEXMAP_NULL;
+      }
+      u32 chanHw = bp_get(value, 3, 19);
+      s.channelId = (chanHw < 8) ? r2c[chanHw] : GX_COLOR_NULL;
+    }
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // Z mode (0x40)
+  case 0x40: {
+    g_gxState.depthCompare = bp_get(value, 1, 0) != 0;
+    g_gxState.depthFunc = static_cast<GXCompare>(bp_get(value, 3, 1));
+    g_gxState.depthUpdate = bp_get(value, 1, 4) != 0;
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // Blend mode / cmode0 (0x41)
+  case 0x41: {
+    bool blendEn = bp_get(value, 1, 0) != 0;
+    bool logicEn = bp_get(value, 1, 1) != 0;
+    bool dither = bp_get(value, 1, 2) != 0;
+    g_gxState.colorUpdate = bp_get(value, 1, 3) != 0;
+    g_gxState.alphaUpdate = bp_get(value, 1, 4) != 0;
+    g_gxState.blendFacDst = static_cast<GXBlendFactor>(bp_get(value, 3, 5));
+    g_gxState.blendFacSrc = static_cast<GXBlendFactor>(bp_get(value, 3, 8));
+    bool subtract = bp_get(value, 1, 11) != 0;
+    g_gxState.blendOp = static_cast<GXLogicOp>(bp_get(value, 4, 12));
+
+    if (subtract) {
+      g_gxState.blendMode = GX_BM_SUBTRACT;
+    } else if (blendEn) {
+      g_gxState.blendMode = GX_BM_BLEND;
+    } else if (logicEn) {
+      g_gxState.blendMode = GX_BM_LOGIC;
+    } else {
+      g_gxState.blendMode = GX_BM_NONE;
+    }
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // Dst alpha / cmode1 (0x42)
+  case 0x42: {
+    u8 alpha = bp_get(value, 8, 0);
+    bool enabled = bp_get(value, 1, 8) != 0;
+    g_gxState.dstAlpha = enabled ? alpha : UINT32_MAX;
+    g_gxState.pixelFmt = decode_pixel_fmt(g_gxState.bpRegCache[0x43], value);
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // PE control (0x43) - pixel format, z format, zcomp location
+  case 0x43: {
+    g_gxState.pixelFmt = decode_pixel_fmt(value, g_gxState.bpRegCache[0x42]);
+    g_gxState.zFmt = static_cast<GXZFmt16>(bp_get(value, 3, 3));
+    g_gxState.zCompLocBeforeTex = bp_get(value, 1, 6) != 0;
+    mark_pipeline_state_dirty();
+    break;
+  }
+  case 0x44:
+    g_gxState.fieldMask = value & 0x3u;
+    break;
+
+  // Bounding box clear/update registers (0x55, 0x56)
+  case 0x55:
+  case 0x56: {
+    const u32 offset = (regId & 2u);
+    g_gxState.boundingBox[offset] = static_cast<u16>(value & 0x3ffu);
+    g_gxState.boundingBox[offset + 1] = static_cast<u16>((value >> 10) & 0x3ffu);
+    break;
+  }
+  case 0x58:
+    g_gxState.revBits = value & 0x00FFFFFFu;
+    break;
+
+  // Scissor box offset (0x59)
+  case 0x59: {
+    g_gxState.scissorOffsetX = static_cast<s32>(((value & 0x3ffu) << 1) - 0x156u);
+    g_gxState.scissorOffsetY = static_cast<s32>(((value & 0xffc00u) >> 9) - 0x156u);
+    set_logical_scissor(g_gxState.logicalScissor);
+    break;
+  }
+
+  // TLUT load address / execute (0x64, 0x65)
+  case 0x64:
+    break;
+  case 0x65: {
+    const auto idx = bp_get(value, 10, 0);
+    if (idx < MaxTluts) {
+      auto& slot = g_gxState.loadedTluts[idx];
+      slot.loadTlut0 = g_gxState.bpRegCache[0x64];
+      slot.numEntries = static_cast<u16>(bp_get(value, 10, 10) + 1);
+    }
+    break;
+  }
+  case 0x68:
+    g_gxState.fieldMode = value & 0x1u;
+    break;
+
+  // Alpha compare (0xF3)
+  case 0xF3: {
+    g_gxState.alphaCompare.ref0 = bp_get(value, 8, 0);
+    g_gxState.alphaCompare.ref1 = bp_get(value, 8, 8);
+    g_gxState.alphaCompare.comp0 = static_cast<GXCompare>(bp_get(value, 3, 16));
+    g_gxState.alphaCompare.comp1 = static_cast<GXCompare>(bp_get(value, 3, 19));
+    g_gxState.alphaCompare.op = static_cast<GXAlphaOp>(bp_get(value, 2, 22));
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // TEV K color/alpha select (0xF6-0xFD)
+  case 0xF6:
+  case 0xF7:
+  case 0xF8:
+  case 0xF9:
+  case 0xFA:
+  case 0xFB:
+  case 0xFC:
+  case 0xFD: {
+    u32 kselIdx = regId - 0xF6;
+    // Swap table entries (packed into pairs of ksel registers)
+    if (kselIdx < MaxTevSwap * 2) {
+      u32 swapIdx = kselIdx / 2;
+      if (kselIdx & 1) {
+        g_gxState.tevSwapTable[swapIdx].blue = static_cast<GXTevColorChan>(bp_get(value, 2, 0));
+        g_gxState.tevSwapTable[swapIdx].alpha = static_cast<GXTevColorChan>(bp_get(value, 2, 2));
+      } else {
+        g_gxState.tevSwapTable[swapIdx].red = static_cast<GXTevColorChan>(bp_get(value, 2, 0));
+        g_gxState.tevSwapTable[swapIdx].green = static_cast<GXTevColorChan>(bp_get(value, 2, 2));
+      }
+    }
+    // K color/alpha selection for 2 stages per register
+    u32 stage0 = kselIdx * 2;
+    u32 stage1 = kselIdx * 2 + 1;
+    if (stage0 < MaxTevStages) {
+      g_gxState.tevStages[stage0].kcSel = static_cast<GXTevKColorSel>(bp_get(value, 5, 4));
+      g_gxState.tevStages[stage0].kaSel = static_cast<GXTevKAlphaSel>(bp_get(value, 5, 9));
+    }
+    if (stage1 < MaxTevStages) {
+      g_gxState.tevStages[stage1].kcSel = static_cast<GXTevKColorSel>(bp_get(value, 5, 14));
+      g_gxState.tevStages[stage1].kaSel = static_cast<GXTevKAlphaSel>(bp_get(value, 5, 19));
+    }
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // Fog A/B parameters (0xEE-0xF0)
+  // FOG0 (0xEE): A parameter - sign(1)|exp(8)|mantissa(11) partial IEEE 754 float
+  case 0xEE: {
+    g_gxState.fog.fog0Raw = value;
+    u32 a_mant = bp_get(value, 11, 0);
+    u32 a_exp = bp_get(value, 8, 11);
+    u32 a_sign = bp_get(value, 1, 19);
+    u32 a_bits = (a_sign << 31) | (a_exp << 23) | (a_mant << 12);
+    std::memcpy(&g_gxState.fog.aRaw, &a_bits, sizeof(g_gxState.fog.aRaw));
+    u32 b_s = g_gxState.fog.fog2Raw & 0x1F;
+    g_gxState.fog.a = std::ldexp(g_gxState.fog.aRaw, static_cast<int>(b_s));
+    g_gxState.stateDirty = true;
+    break;
+  }
+  // FOG1 (0xEF): B mantissa (24-bit)
+  case 0xEF: {
+    g_gxState.fog.fog1Raw = value;
+    g_gxState.fog.bMagnitude = bp_get(value, 24, 0);
+    u32 b_s = g_gxState.fog.fog2Raw & 0x1F;
+    float B_mant = static_cast<float>(g_gxState.fog.bMagnitude) / 8388638.0f;
+    g_gxState.fog.b = std::ldexp(B_mant, static_cast<int>(b_s) - 1);
+    g_gxState.stateDirty = true;
+    break;
+  }
+  // FOG2 (0xF0): B shift/exponent (5-bit)
+  case 0xF0: {
+    g_gxState.fog.fog2Raw = value;
+    u32 b_s = bp_get(value, 5, 0);
+    g_gxState.fog.bShift = b_s;
+    u32 a_mant = bp_get(g_gxState.fog.fog0Raw, 11, 0);
+    u32 a_exp = bp_get(g_gxState.fog.fog0Raw, 8, 11);
+    u32 a_sign = bp_get(g_gxState.fog.fog0Raw, 1, 19);
+    u32 a_bits = (a_sign << 31) | (a_exp << 23) | (a_mant << 12);
+    std::memcpy(&g_gxState.fog.aRaw, &a_bits, sizeof(g_gxState.fog.aRaw));
+    g_gxState.fog.a = std::ldexp(g_gxState.fog.aRaw, static_cast<int>(b_s));
+    g_gxState.fog.bMagnitude = bp_get(g_gxState.fog.fog1Raw, 24, 0);
+    float B_mant = static_cast<float>(g_gxState.fog.bMagnitude) / 8388638.0f;
+    g_gxState.fog.b = std::ldexp(B_mant, static_cast<int>(b_s) - 1);
+    g_gxState.stateDirty = true;
+    break;
+  }
+
+  // Fog type + C parameter from FOG3 (0xF1)
+  case 0xF1: {
+    const u32 fogFunc = bp_get(value, 3, 21);
+    const u32 fogProj = bp_get(value, 1, 20);
+    GXFogType fogType = static_cast<GXFogType>(fogFunc | (fogProj << 3));
+    g_gxState.fog.type = fogType;
+    // Decode C parameter (same partial float encoding as A)
+    u32 c_mant = bp_get(value, 11, 0);
+    u32 c_exp = bp_get(value, 8, 11);
+    u32 c_sign = bp_get(value, 1, 19);
+    u32 c_bits = (c_sign << 31) | (c_exp << 23) | (c_mant << 12);
+    std::memcpy(&g_gxState.fog.c, &c_bits, sizeof(g_gxState.fog.c));
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // Fog color from FOGCLR (0xF2)
+  case 0xF2: {
+    u8 b = bp_get(value, 8, 0);
+    u8 g = bp_get(value, 8, 8);
+    u8 r = bp_get(value, 8, 16);
+    g_gxState.fog.color = {
+        static_cast<float>(r) / 255.f,
+        static_cast<float>(g) / 255.f,
+        static_cast<float>(b) / 255.f,
+        1.f,
+    };
+    g_gxState.stateDirty = true;
+    break;
+  }
+
+  // TEV and K color registers (0xE0-0xE7): even are RA, odd are BG.
+  // Bit 23 selects a K color register over a TEV color register.
+  case 0xE0:
+  case 0xE1:
+  case 0xE2:
+  case 0xE3:
+  case 0xE4:
+  case 0xE5:
+  case 0xE6:
+  case 0xE7: {
+    u32 idx = (regId - 0xE0) / 2;
+    bool isRA = (regId & 1) == 0;
+    bool isKColor = bp_get(value, 1, 23) != 0;
+
+    if (isKColor) {
+      // K color register (8-bit components)
+      if (idx < GX_MAX_KCOLOR) {
+        auto& kc = g_gxState.kcolors[idx];
+        if (isRA) {
+          kc[0] = static_cast<float>(bp_get(value, 8, 0)) / 255.f;  // R
+          kc[3] = static_cast<float>(bp_get(value, 8, 12)) / 255.f; // A
+        } else {
+          kc[2] = static_cast<float>(bp_get(value, 8, 0)) / 255.f;  // B
+          kc[1] = static_cast<float>(bp_get(value, 8, 12)) / 255.f; // G
+        }
+        g_gxState.stateDirty = true;
+      }
+    } else {
+      // TEV color register (11-bit signed components)
+      if (idx < MaxTevRegs) {
+        auto& cr = g_gxState.colorRegs[idx];
+        if (isRA) {
+          // 11-bit signed: sign-extend from 11 bits
+          s32 r = bp_get(value, 11, 0);
+          if (r & 0x400)
+            r |= ~0x7FF; // sign extend
+          s32 a = bp_get(value, 11, 12);
+          if (a & 0x400)
+            a |= ~0x7FF;
+          cr[0] = static_cast<float>(r) / 255.f;
+          cr[3] = static_cast<float>(a) / 255.f;
+        } else {
+          s32 b = bp_get(value, 11, 0);
+          if (b & 0x400)
+            b |= ~0x7FF;
+          s32 g = bp_get(value, 11, 12);
+          if (g & 0x400)
+            g |= ~0x7FF;
+          cr[2] = static_cast<float>(b) / 255.f;
+          cr[1] = static_cast<float>(g) / 255.f;
+        }
+        g_gxState.stateDirty = true;
+      }
+    }
+    break;
+  }
+
+  // Indirect texture matrices (0x06-0x0E), three consecutive registers per 3x2 matrix:
+  // matrix 0 at 0x06, matrix 1 at 0x09, matrix 2 at 0x0C.
+  case 0x06:
+  case 0x07:
+  case 0x08:
+  case 0x09:
+  case 0x0A:
+  case 0x0B:
+  case 0x0C:
+  case 0x0D:
+  case 0x0E: {
+    u32 idx = (regId - 0x06) / 3;    // matrix index (0-2)
+    u32 column = (regId - 0x06) % 3; // column index (0-2)
+    auto& info = g_gxState.indTexMtxs[idx];
+
+    // Decode one packed matrix column: [m[0][column], m[1][column]].
+    s32 col0 = bp_get(value, 11, 0);
+    if (col0 & 0x400)
+      col0 |= ~0x7FF; // sign-extend from 11 bits
+    s32 col1 = bp_get(value, 11, 11);
+    if (col1 & 0x400)
+      col1 |= ~0x7FF;
+
+    auto& packedColumn = column == 0 ? info.mtx.m0 : (column == 1 ? info.mtx.m1 : info.mtx.m2);
+    packedColumn.x = static_cast<float>(col0) / 1024.0f;
+    packedColumn.y = static_cast<float>(col1) / 1024.0f;
+
+    // Accumulate the indirect matrix scale exponent. The SDK writes two bits per column, but the
+    // hardware ignores the third column's top bit, leaving 5 bits for adjScale = scaleExp + 17.
+    u32 scaleBits = bp_get(value, 2, 22);
+    u32 shift = column * 2;
+    if (column == 2) {
+      info.adjScaleRaw = (info.adjScaleRaw & ~(1u << shift)) | ((scaleBits & 1u) << shift);
+    } else {
+      info.adjScaleRaw = (info.adjScaleRaw & ~(3u << shift)) | (scaleBits << shift);
+    }
+    info.scaleExp = static_cast<s8>(info.adjScaleRaw) - 17;
+
+    g_gxState.stateDirty = true;
+    break;
+  }
+
+  // SU texture coordinate scale registers (0x30-0x3F): even (suTs0) carry S-axis scale, bias, cyl
+  // wrap and line/point offset; odd (suTs1) carry the T-axis equivalents.
+  case 0x30:
+  case 0x31:
+  case 0x32:
+  case 0x33:
+  case 0x34:
+  case 0x35:
+  case 0x36:
+  case 0x37:
+  case 0x38:
+  case 0x39:
+  case 0x3A:
+  case 0x3B:
+  case 0x3C:
+  case 0x3D:
+  case 0x3E:
+  case 0x3F: {
+    u32 coordIdx = (regId - 0x30) / 2;
+    bool isT = (regId & 1) != 0;
+    auto& tcs = g_gxState.texCoordScales[coordIdx];
+    if (isT) {
+      tcs.scaleT = static_cast<u16>(bp_get(value, 16, 0));
+      tcs.biasT = bp_get(value, 1, 16) != 0;
+      tcs.cylWrapT = bp_get(value, 1, 17) != 0;
+    } else {
+      tcs.scaleS = static_cast<u16>(bp_get(value, 16, 0));
+      tcs.biasS = bp_get(value, 1, 16) != 0;
+      tcs.cylWrapS = bp_get(value, 1, 17) != 0;
+      tcs.lineOffset = bp_get(value, 1, 18) != 0;
+      tcs.pointOffset = bp_get(value, 1, 19) != 0;
+    }
+    g_gxState.stateDirty = true;
+    break;
+  }
+
+  // Copy clear color (0x4F-0x50) and depth (0x51)
+  case 0x49: {
+    g_gxState.dispCopySrc.x = static_cast<int32_t>(bp_get(value, 10, 0));
+    g_gxState.dispCopySrc.y = static_cast<int32_t>(bp_get(value, 10, 10));
+    break;
+  }
+  case 0x4A: {
+    g_gxState.dispCopySrc.width = static_cast<int32_t>(bp_get(value, 10, 0) + 1u);
+    g_gxState.dispCopySrc.height = static_cast<int32_t>(bp_get(value, 10, 10) + 1u);
+    break;
+  }
+  case 0x4D: {
+    g_gxState.dispCopyDstWidth = static_cast<u16>(((bp_get(value, 10, 0) << 5) + 31u) >> 1);
+    break;
+  }
+  case 0x4E: {
+    const u32 iScale = bp_get(value, 9, 0);
+    if (iScale != 0) {
+      g_gxState.dispCopyYScale = 256.f / static_cast<float>(iScale);
+    }
+    break;
+  }
+  case 0x4F: {
+    u8 r = bp_get(value, 8, 0);
+    u8 a = bp_get(value, 8, 8);
+    g_gxState.clearColor[0] = static_cast<float>(r) / 255.f;
+    g_gxState.clearColor[3] = static_cast<float>(a) / 255.f;
+    g_gxState.stateDirty = true;
+    break;
+  }
+  case 0x50: {
+    u8 b = bp_get(value, 8, 0);
+    u8 g = bp_get(value, 8, 8);
+    g_gxState.clearColor[2] = static_cast<float>(b) / 255.f;
+    g_gxState.clearColor[1] = static_cast<float>(g) / 255.f;
+    g_gxState.stateDirty = true;
+    break;
+  }
+  case 0x51: {
+    g_gxState.clearDepth = bp_get(value, 24, 0);
+    g_gxState.stateDirty = true;
+    break;
+  }
+  case 0xF4: {
+    g_gxState.zTextureBias = value & 0x00FFFFFFu;
+    mark_pipeline_state_dirty();
+    break;
+  }
+  case 0xF5: {
+    g_gxState.zTextureFmt = static_cast<u8>(bp_get(value, 2, 0));
+    g_gxState.zTextureOp = static_cast<GXZTexOp>(bp_get(value, 2, 2));
+    mark_pipeline_state_dirty();
+    break;
+  }
+  case 0x52: {
+    g_gxState.copyClamp = static_cast<GXFBClamp>(bp_get(value, 2, 0));
+    g_gxState.texCopyFmt = static_cast<GXTexFmt>(bp_get(value, 4, 3));
+    g_gxState.dispCopyGamma = static_cast<GXGamma>(bp_get(value, 2, 7));
+    g_gxState.texCopyHalfScale = bp_get(value, 1, 9) != 0;
+    g_gxState.dispCopyFrame2Field = bp_get(value, 2, 12);
+    break;
+  }
+  case 0x53: {
+    g_gxState.copyFilterVFilter[0] = static_cast<u8>(bp_get(value, 6, 0));
+    g_gxState.copyFilterVFilter[1] = static_cast<u8>(bp_get(value, 6, 6));
+    g_gxState.copyFilterVFilter[2] = static_cast<u8>(bp_get(value, 6, 12));
+    g_gxState.copyFilterVFilter[3] = static_cast<u8>(bp_get(value, 6, 18));
+    refresh_copy_filter_flags();
+    break;
+  }
+  case 0x54: {
+    g_gxState.copyFilterVFilter[4] = static_cast<u8>(bp_get(value, 6, 0));
+    g_gxState.copyFilterVFilter[5] = static_cast<u8>(bp_get(value, 6, 6));
+    g_gxState.copyFilterVFilter[6] = static_cast<u8>(bp_get(value, 6, 12));
+    refresh_copy_filter_flags();
+    break;
+  }
+  case 0xE8:
+  case 0xE9:
+  case 0xEA:
+  case 0xEB:
+  case 0xEC:
+  case 0xED:
+    g_gxState.fogRange[regId - 0xE8] = value & 0x00FFFFFFu;
+    mark_pipeline_state_dirty();
+    break;
+
+  default:
+    if (const auto mapping = decode_tex_bp_reg(regId); mapping.has_value()) {
+      auto& slot = g_gxState.loadedTextures[mapping->texMapId];
+      bool changed = false;
+      switch (mapping->kind) {
+      case TexBpRegMapping::Kind::Mode0:
+        changed = slot.mode0 != value;
+        if (changed) {
+          slot.mode0 = value;
+        }
+        break;
+      case TexBpRegMapping::Kind::Mode1:
+        changed = slot.mode1 != value;
+        if (changed) {
+          slot.mode1 = value;
+        }
+        break;
+      case TexBpRegMapping::Kind::Image0:
+        changed = slot.image0 != value;
+        if (changed) {
+          slot.image0 = value;
+          slot.mWidth = 0;
+          slot.mHeight = 0;
+          slot.mFormat = gfx::InvalidTextureFormat;
+        }
+        break;
+      case TexBpRegMapping::Kind::Image3:
+        changed = slot.image3 != value;
+        if (changed) {
+          slot.image3 = value;
+        }
+        break;
+      case TexBpRegMapping::Kind::Tlut:
+        // TLUT region's TMEM offset
+        break;
+      case TexBpRegMapping::Kind::Image1:
+      case TexBpRegMapping::Kind::Image2:
+        // GXTexRegion regs
+        break;
+      }
+      if (changed) {
+        g_gxState.stateDirty = true;
+      }
+    } else {
+#ifndef NDEBUG
+      Log.debug("Unhandled BP register 0x{:02X} (value 0x{:06X})", regId, value & 0xFFFFFF);
+#endif
+    }
+    break;
+  }
+}
+
+extern "C" void GXApplyBPReg(u8 reg, u32 value) {
+  handle_bp((static_cast<u32>(reg) << 24) | (value & 0x00FFFFFFu), true);
+}
+
+static bool cacheable_cp_register(u8 addr) {
+  return addr == 0x30 || addr == 0x40 || addr == 0x50 || addr == 0x60 || (addr >= 0x70 && addr <= 0x97);
+}
+
+static std::array<u32, 0x100> s_cpRegisterCache{};
+static std::array<bool, 0x100> s_cpRegisterCacheValid{};
+
+void reset_cp_register_cache() {
+  s_cpRegisterCache.fill(0);
+  s_cpRegisterCacheValid.fill(false);
+}
+
+static bool cp_register_write_unchanged(u8 addr, u32 value) {
+  if (!cacheable_cp_register(addr)) return false;
+
+  if (s_cpRegisterCacheValid[addr] && s_cpRegisterCache[addr] == value) {
+    return true;
+  }
+  s_cpRegisterCacheValid[addr] = true;
+  s_cpRegisterCache[addr] = value;
+  return false;
+}
+
+// CP register handler - decodes CP register writes and updates g_gxState
+static void handle_cp(u8 addr, u32 value, bool bigEndian) {
+  if (cp_register_write_unchanged(addr, value)) return;
+
+  switch (addr) {
+  // VCD low (0x50)
+  case 0x50: {
+    auto& vd = g_gxState.vtxDesc;
+    auto& svd = g_gxState.sourceVtxDesc;
+    vd[GX_VA_PNMTXIDX] = static_cast<GXAttrType>(bp_get(value, 1, 0));
+    vd[GX_VA_TEX0MTXIDX] = static_cast<GXAttrType>(bp_get(value, 1, 1));
+    vd[GX_VA_TEX1MTXIDX] = static_cast<GXAttrType>(bp_get(value, 1, 2));
+    vd[GX_VA_TEX2MTXIDX] = static_cast<GXAttrType>(bp_get(value, 1, 3));
+    vd[GX_VA_TEX3MTXIDX] = static_cast<GXAttrType>(bp_get(value, 1, 4));
+    vd[GX_VA_TEX4MTXIDX] = static_cast<GXAttrType>(bp_get(value, 1, 5));
+    vd[GX_VA_TEX5MTXIDX] = static_cast<GXAttrType>(bp_get(value, 1, 6));
+    vd[GX_VA_TEX6MTXIDX] = static_cast<GXAttrType>(bp_get(value, 1, 7));
+    vd[GX_VA_TEX7MTXIDX] = static_cast<GXAttrType>(bp_get(value, 1, 8));
+    vd[GX_VA_POS] = static_cast<GXAttrType>(bp_get(value, 2, 9));
+    vd[GX_VA_NRM] = static_cast<GXAttrType>(bp_get(value, 2, 11));
+    vd[GX_VA_CLR0] = static_cast<GXAttrType>(bp_get(value, 2, 13));
+    vd[GX_VA_CLR1] = static_cast<GXAttrType>(bp_get(value, 2, 15));
+    for (int attr = GX_VA_PNMTXIDX; attr <= GX_VA_CLR1; ++attr) {
+      svd[attr] = vd[attr];
+    }
+    mark_pipeline_state_dirty();
+    g_gxState.clearVtxSizeCache();
+    break;
+  }
+
+  // VCD high (0x60)
+  case 0x60: {
+    auto& vd = g_gxState.vtxDesc;
+    auto& svd = g_gxState.sourceVtxDesc;
+    vd[GX_VA_TEX0] = static_cast<GXAttrType>(bp_get(value, 2, 0));
+    vd[GX_VA_TEX1] = static_cast<GXAttrType>(bp_get(value, 2, 2));
+    vd[GX_VA_TEX2] = static_cast<GXAttrType>(bp_get(value, 2, 4));
+    vd[GX_VA_TEX3] = static_cast<GXAttrType>(bp_get(value, 2, 6));
+    vd[GX_VA_TEX4] = static_cast<GXAttrType>(bp_get(value, 2, 8));
+    vd[GX_VA_TEX5] = static_cast<GXAttrType>(bp_get(value, 2, 10));
+    vd[GX_VA_TEX6] = static_cast<GXAttrType>(bp_get(value, 2, 12));
+    vd[GX_VA_TEX7] = static_cast<GXAttrType>(bp_get(value, 2, 14));
+    for (int attr = GX_VA_TEX0; attr <= GX_VA_TEX7; ++attr) {
+      svd[attr] = vd[attr];
+    }
+    mark_pipeline_state_dirty();
+    g_gxState.clearVtxSizeCache();
+    break;
+  }
+
+  // Matrix index A (0x30)
+  case 0x30: {
+    g_gxState.currentPnMtx = bp_get(value, 6, 0) / 3;
+    for (u32 i = 0; i < 4 && i < MaxTexCoord; i++) {
+      auto texMtx = static_cast<GXTexMtx>(bp_get(value, 6, 6 + i * 6));
+      assert(texMtx >= 0 && texMtx <= GXTexMtx::GX_IDENTITY);
+      g_gxState.tcgs[i].mtx = texMtx;
+    }
+    // Same matrix indices as XF 0x18, written from a different bank.
+    g_gxState.invalidateXfReg(0x18);
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  // Matrix index B (0x40)
+  case 0x40: {
+    for (u32 i = 0; i < 4 && (i + 4) < MaxTexCoord; i++) {
+      auto texMtx = static_cast<GXTexMtx>(bp_get(value, 6, i * 6));
+      assert(texMtx >= 0 && texMtx <= GXTexMtx::GX_IDENTITY);
+      g_gxState.tcgs[i + 4].mtx = texMtx;
+    }
+    // Same matrix indices as XF 0x19, written from a different bank.
+    g_gxState.invalidateXfReg(0x19);
+    mark_pipeline_state_dirty();
+    break;
+  }
+
+  default:
+    // VAT A registers (0x70-0x77)
+    if (addr >= 0x70 && addr <= 0x77) {
+      u32 fmt = addr - 0x70;
+      auto& vf = g_gxState.vtxFmts[fmt];
+      vf.attrs[GX_VA_POS].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 0));
+      vf.attrs[GX_VA_POS].type = static_cast<GXCompType>(bp_get(value, 3, 1));
+      vf.attrs[GX_VA_POS].frac = static_cast<u8>(bp_get(value, 5, 4));
+      vf.attrs[GX_VA_NRM].type = static_cast<GXCompType>(bp_get(value, 3, 10));
+      if (bp_get(value, 1, 31) != 0) {
+        vf.attrs[GX_VA_NRM].cnt = GX_NRM_NBT3;
+      } else {
+        vf.attrs[GX_VA_NRM].cnt = bp_get(value, 1, 9) != 0 ? GX_NRM_NBT : GX_NRM_XYZ;
+      }
+      vf.attrs[GX_VA_NRM].frac = normal_frac_bits(vf.attrs[GX_VA_NRM].type);
+      vf.attrs[GX_VA_CLR0].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 13));
+      vf.attrs[GX_VA_CLR0].type = static_cast<GXCompType>(bp_get(value, 3, 14));
+      vf.attrs[GX_VA_CLR0].frac = 0;
+      vf.attrs[GX_VA_CLR1].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 17));
+      vf.attrs[GX_VA_CLR1].type = static_cast<GXCompType>(bp_get(value, 3, 18));
+      vf.attrs[GX_VA_CLR1].frac = 0;
+      vf.attrs[GX_VA_TEX0].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 21));
+      vf.attrs[GX_VA_TEX0].type = static_cast<GXCompType>(bp_get(value, 3, 22));
+      vf.attrs[GX_VA_TEX0].frac = static_cast<u8>(bp_get(value, 5, 25));
+      mark_pipeline_state_dirty();
+      g_gxState.clearVtxSizeCache();
+    }
+    // VAT B registers (0x80-0x87)
+    else if (addr >= 0x80 && addr <= 0x87) {
+      u32 fmt = addr - 0x80;
+      auto& vf = g_gxState.vtxFmts[fmt];
+      vf.attrs[GX_VA_TEX1].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 0));
+      vf.attrs[GX_VA_TEX1].type = static_cast<GXCompType>(bp_get(value, 3, 1));
+      vf.attrs[GX_VA_TEX1].frac = static_cast<u8>(bp_get(value, 5, 4));
+      vf.attrs[GX_VA_TEX2].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 9));
+      vf.attrs[GX_VA_TEX2].type = static_cast<GXCompType>(bp_get(value, 3, 10));
+      vf.attrs[GX_VA_TEX2].frac = static_cast<u8>(bp_get(value, 5, 13));
+      vf.attrs[GX_VA_TEX3].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 18));
+      vf.attrs[GX_VA_TEX3].type = static_cast<GXCompType>(bp_get(value, 3, 19));
+      vf.attrs[GX_VA_TEX3].frac = static_cast<u8>(bp_get(value, 5, 22));
+      vf.attrs[GX_VA_TEX4].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 27));
+      vf.attrs[GX_VA_TEX4].type = static_cast<GXCompType>(bp_get(value, 3, 28));
+      // TEX4 frac is in VAT C
+      mark_pipeline_state_dirty();
+      g_gxState.clearVtxSizeCache();
+    }
+    // VAT C registers (0x90-0x97)
+    else if (addr >= 0x90 && addr <= 0x97) {
+      u32 fmt = addr - 0x90;
+      auto& vf = g_gxState.vtxFmts[fmt];
+      vf.attrs[GX_VA_TEX4].frac = static_cast<u8>(bp_get(value, 5, 0));
+      vf.attrs[GX_VA_TEX5].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 5));
+      vf.attrs[GX_VA_TEX5].type = static_cast<GXCompType>(bp_get(value, 3, 6));
+      vf.attrs[GX_VA_TEX5].frac = static_cast<u8>(bp_get(value, 5, 9));
+      vf.attrs[GX_VA_TEX6].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 14));
+      vf.attrs[GX_VA_TEX6].type = static_cast<GXCompType>(bp_get(value, 3, 15));
+      vf.attrs[GX_VA_TEX6].frac = static_cast<u8>(bp_get(value, 5, 18));
+      vf.attrs[GX_VA_TEX7].cnt = static_cast<GXCompCnt>(bp_get(value, 1, 23));
+      vf.attrs[GX_VA_TEX7].type = static_cast<GXCompType>(bp_get(value, 3, 24));
+      vf.attrs[GX_VA_TEX7].frac = static_cast<u8>(bp_get(value, 5, 27));
+      mark_pipeline_state_dirty();
+      g_gxState.clearVtxSizeCache();
+    }
+    // Array base addresses (0xA0-0xAF)
+    else if (addr >= 0xA0 && addr <= 0xAF) {
+      Log.error("CP_REG_ARRAYBASE_ID is not supported on Aurora. Use GX_LOAD_AURORA_ARRAYBASE instead.");
+    }
+    // Array strides (0xB0-0xBF)
+    else if (addr >= 0xB0 && addr <= 0xBF) {
+      u32 attrIdx = addr - 0xB0 + GX_VA_POS;
+      if (attrIdx < GX_VA_MAX_ATTR) {
+        auto& array = g_gxState.arrays[attrIdx];
+        const auto newStride = static_cast<u8>(value);
+        if (array.stride != newStride) {
+          array.stride = newStride;
+          mark_pipeline_state_dirty();
+        }
+      }
+    }
+    break;
+  }
+}
+
+// XF register handler - decodes XF (transform unit) register writes and updates g_gxState
+static void handle_xf(const u8* data, u32& pos, u32 size, bool bigEndian) {
+  // These bounds must hold in release too: CHECK() is a no-op under NDEBUG, so relying on it alone let a truncated guest display list read past `data`.
+  if (pos > size || size - pos < 4) UNLIKELY {
+      CHECK(false, "XF header read overrun");
+      pos = size;
+      return;
+    }
+  u32 header = read_u32(data + pos, bigEndian);
+  pos += 4;
+
+  u32 count = ((header >> 16) & 0xFFFF) + 1;
+  u32 addr = header & 0xFFFF;
+  u32 dataBytes = count * 4;
+  // Log.warn("  xf: addr {:04x} count {} dataBytes {} pos {} -> {}", addr, count, dataBytes, pos, pos + dataBytes);
+  if (size - pos < dataBytes) UNLIKELY {
+      CHECK(false, "XF data read overrun: need {} bytes at pos {}", dataBytes, pos);
+      pos = size;
+      return;
+    }
+
+  const u8* xfData = data + pos;
+
+  if (copy_xf_data(addr, xfData, count, bigEndian)) {
+    // copy_xf_data handled everything.
+  } else if (addr >= 0x1000) {
+    // XF registers (0x1000+)
+    u32 xfAddr = addr - 0x1000;
+    bool viewportUpdated = false;
+    bool projectionUpdated = false;
+    for (u32 i = 0; i < count; i++) {
+      u32 reg = xfAddr + i;
+      u32 val = read_u32(xfData + i * 4, bigEndian);
+
+      // Skip register writes that decode to state we already hold.
+      const bool cacheable = reg < g_gxState.xfRegCache.size();
+      const bool unchanged = cacheable && g_gxState.xfRegMatches(reg, val);
+      if (cacheable) g_gxState.storeXfReg(reg, val);
+      // Viewport (0x1A-0x1F) and projection (0x20-0x26) keep their unconditional apply below; only the banks that already had skip semantics and the TexGen bank drop out here.
+      if (unchanged && (reg <= 0x19 || reg >= 0x3F)) continue;
+
+      switch (reg) {
+      case 0x00:
+        g_gxState.xfError = val;
+        break;
+      case 0x08:
+        // XF vertex specs (numColors, numNormals, numTexCoords) - informational
+        break;
+      case 0x09:
+        // numChans
+        g_gxState.numChans = val;
+        g_gxState.stateDirty = true;
+        break;
+      case 0x0A:
+        // Ambient color 0
+        g_gxState.colorChannelState[GX_COLOR0].ambColor = unpack_color(val);
+        g_gxState.colorChannelState[GX_ALPHA0].ambColor = unpack_color(val);
+        g_gxState.stateDirty = true;
+        break;
+      case 0x0B:
+        // Ambient color 1
+        g_gxState.colorChannelState[GX_COLOR1].ambColor = unpack_color(val);
+        g_gxState.colorChannelState[GX_ALPHA1].ambColor = unpack_color(val);
+        g_gxState.stateDirty = true;
+        break;
+      case 0x0C:
+        // Material color 0
+        g_gxState.colorChannelState[GX_COLOR0].matColor = unpack_color(val);
+        g_gxState.colorChannelState[GX_ALPHA0].matColor = unpack_color(val);
+        g_gxState.stateDirty = true;
+        break;
+      case 0x0D:
+        // Material color 1
+        g_gxState.colorChannelState[GX_COLOR1].matColor = unpack_color(val);
+        g_gxState.colorChannelState[GX_ALPHA1].matColor = unpack_color(val);
+        g_gxState.stateDirty = true;
+        break;
+      case 0x0E:
+      case 0x0F:
+      case 0x10:
+      case 0x11: {
+        // Channel control registers
+        u32 chanId = reg - 0x0E;
+        if (chanId < MaxColorChannels) {
+          auto& chan = g_gxState.colorChannelConfig[chanId];
+          chan.matSrc = static_cast<GXColorSrc>(bp_get(val, 1, 0));
+          chan.lightingEnabled = bp_get(val, 1, 1) != 0;
+          u32 lightsLo = bp_get(val, 4, 2);
+          chan.ambSrc = static_cast<GXColorSrc>(bp_get(val, 1, 6));
+          chan.diffFn = static_cast<GXDiffuseFn>(bp_get(val, 2, 7));
+          u32 lightsHi = bp_get(val, 4, 11);
+          switch (bp_get(val, 2, 9)) {
+          case 1:
+            chan.attnFn = GX_AF_SPEC;
+            break;
+          case 3:
+            chan.attnFn = GX_AF_SPOT;
+            break;
+          case 0:
+          case 2:
+          default:
+            chan.attnFn = GX_AF_NONE;
+            break;
+          }
+          u32 lightMask = lightsLo | (lightsHi << 4);
+          g_gxState.colorChannelState[chanId].lightMask = GX::LightMask{lightMask};
+          mark_pipeline_state_dirty();
+        }
+        break;
+      }
+      case 0x12:
+        g_gxState.dualTex = val;
+        mark_pipeline_state_dirty();
+        break;
+      case 0x18: {
+        // Matrix index A: PnMtx + TexCoord0-3 matrix indices
+        g_gxState.currentPnMtx = bp_get(val, 6, 0) / 3;
+        for (u32 i = 0; i < 4 && i < MaxTexCoord; i++) {
+          auto texMtx = static_cast<GXTexMtx>(bp_get(val, 6, 6 + i * 6));
+          assert(texMtx >= 0 && texMtx <= GXTexMtx::GX_IDENTITY);
+          g_gxState.tcgs[i].mtx = texMtx;
+        }
+        mark_pipeline_state_dirty();
+        break;
+      }
+      case 0x19: {
+        // Matrix index B: TexCoord4-7 matrix indices
+        for (u32 i = 0; i < 4 && (i + 4) < MaxTexCoord; i++) {
+          g_gxState.tcgs[i + 4].mtx = static_cast<GXTexMtx>(bp_get(val, 6, i * 6));
+        }
+        mark_pipeline_state_dirty();
+        break;
+      }
+      case 0x1A:
+      case 0x1B:
+      case 0x1C:
+      case 0x1D:
+      case 0x1E:
+      case 0x1F: {
+        // Viewport: sx, sy, sz, ox, oy, oz at XF 0x101A-0x101F
+        const u32 vpOff = reg - 0x1A;
+        g_gxState.xfViewport[vpOff] = read_f32(xfData + i * 4, bigEndian);
+        viewportUpdated = true;
+        break;
+      }
+      case 0x20:
+      case 0x21:
+      case 0x22:
+      case 0x23:
+      case 0x24:
+      case 0x25:
+      case 0x26: {
+        // Projection: 6 params + type at XF 0x1020-0x1026
+        const u32 projOff = reg - 0x20;
+        if (projOff < g_gxState.xfProjection.size()) {
+          g_gxState.xfProjection[projOff] = read_f32(xfData + i * 4, bigEndian);
+        } else {
+          g_gxState.projType = static_cast<GXProjectionType>(val);
+        }
+        projectionUpdated = true;
+        break;
+      }
+      case 0x3F:
+        // numTexGens
+        g_gxState.numTexGens = val;
+        mark_pipeline_state_dirty();
+        break;
+      default:
+        // TexGen config (0x40-0x4F) and post-transform (0x50-0x5F)
+        if (reg >= 0x40 && reg <= 0x4F) {
+          u32 tcIdx = reg - 0x40;
+          if (tcIdx < MaxTexCoord) {
+            auto& tcg = g_gxState.tcgs[tcIdx];
+            bool proj = bp_get(val, 1, 1) != 0;
+            u32 form = bp_get(val, 1, 2);
+            u32 tgType = bp_get(val, 3, 4);
+            u32 srcRow = bp_get(val, 5, 7);
+            tcg.inputFormAB11 = form == 0;
+
+            if (tgType == 0) {
+              tcg.type = proj ? GX_TG_MTX3x4 : GX_TG_MTX2x4;
+            } else if (tgType == 1) {
+              // Bump mapping
+              tcg.type = static_cast<GXTexGenType>(bp_get(val, 3, 15) + 2);
+            } else if (tgType == 2 || tgType == 3) {
+              tcg.type = GX_TG_SRTG;
+            }
+
+            // Decode source from row
+            static const GXTexGenSrc rowToSrc[] = {GX_TG_POS,  GX_TG_NRM,  GX_TG_COLOR0, GX_TG_BINRM, GX_TG_TANGENT,
+                                                   GX_TG_TEX0, GX_TG_TEX1, GX_TG_TEX2,   GX_TG_TEX3,  GX_TG_TEX4,
+                                                   GX_TG_TEX5, GX_TG_TEX6, GX_TG_TEX7};
+            if (srcRow < 13) {
+              tcg.src = rowToSrc[srcRow];
+            }
+            mark_pipeline_state_dirty();
+          }
+        } else if (reg >= 0x50 && reg <= 0x5F) {
+          u32 tcIdx = reg - 0x50;
+          if (tcIdx < MaxTexCoord) {
+            g_gxState.tcgs[tcIdx].postMtx = static_cast<GXPTTexMtx>(bp_get(val, 6, 0) + 64);
+            g_gxState.tcgs[tcIdx].normalize = bp_get(val, 1, 8) != 0;
+            mark_pipeline_state_dirty();
+          }
+        } else {
+#ifndef NDEBUG
+          Log.debug("Unhandled XF register 0x{:04X} (value 0x{:08X})", reg, val);
+#endif
+        }
+        break;
+      }
+    }
+    if (viewportUpdated) {
+      apply_xf_viewport();
+    }
+    if (projectionUpdated) {
+      apply_xf_projection();
+    }
+  }
+
+  pos += dataBytes;
+}
+
+static void handle_draw_overrun(u8 cmd, u16 vtxCount, u32 vtxSize, u32 totalVtxBytes, const u8* data, const u32& pos,
+                                u32 size) {
+  static u32 truncatedDrawLogCount = 0;
+  if (truncatedDrawLogCount >= 64) {
+    if (truncatedDrawLogCount == 64) {
+      Log.warn("suppressing further truncated draw diagnostics");
+    }
+    ++truncatedDrawLogCount;
+    return;
+  }
+  ++truncatedDrawLogCount;
+
+  // Hex dump around the draw command for debugging
+  u32 cmdPos = pos - 2 - 1; // opcode byte position (before vtxCount and pos++)
+  u32 dumpStart = (cmdPos > 16) ? cmdPos - 16 : 0;
+  u32 dumpEnd = (cmdPos + 32 < size) ? cmdPos + 32 : size;
+  std::string hex;
+  for (u32 i = dumpStart; i < dumpEnd; i++) {
+    if (i == cmdPos)
+      hex += fmt::format("[{:02x}]", data[i]);
+    else
+      hex += fmt::format(" {:02x}", data[i]);
+  }
+  Log.warn("  hex dump around truncated draw cmd (pos {}-{}):{}", dumpStart, dumpEnd - 1, hex);
+  const auto fmt = static_cast<GXVtxFmt>(cmd & CP_VAT_MASK);
+  const auto& vtxFmt = g_gxState.vtxFmts[fmt];
+  Log.warn("  truncated draw cmd=0x{:02X} fmt={} vtxCount={} vtxSize={} desc pn={} pos={} nrm={} clr0={} clr1={} "
+            "tex0={} tex1={} tex2={} tex3={} tex4={} tex5={} tex6={} tex7={}",
+            cmd, static_cast<u32>(fmt), vtxCount, vtxSize, g_gxState.vtxDesc[GX_VA_PNMTXIDX],
+            g_gxState.vtxDesc[GX_VA_POS], g_gxState.vtxDesc[GX_VA_NRM], g_gxState.vtxDesc[GX_VA_CLR0],
+            g_gxState.vtxDesc[GX_VA_CLR1], g_gxState.vtxDesc[GX_VA_TEX0], g_gxState.vtxDesc[GX_VA_TEX1],
+            g_gxState.vtxDesc[GX_VA_TEX2], g_gxState.vtxDesc[GX_VA_TEX3], g_gxState.vtxDesc[GX_VA_TEX4],
+            g_gxState.vtxDesc[GX_VA_TEX5], g_gxState.vtxDesc[GX_VA_TEX6], g_gxState.vtxDesc[GX_VA_TEX7]);
+  Log.warn("  fmt {} attrs pos({},{}) nrm({},{}) clr0({},{}) tex0({},{}) tex1({},{})",
+            static_cast<u32>(fmt), static_cast<u32>(vtxFmt.attrs[GX_VA_POS].cnt),
+            static_cast<u32>(vtxFmt.attrs[GX_VA_POS].type), static_cast<u32>(vtxFmt.attrs[GX_VA_NRM].cnt),
+            static_cast<u32>(vtxFmt.attrs[GX_VA_NRM].type), static_cast<u32>(vtxFmt.attrs[GX_VA_CLR0].cnt),
+            static_cast<u32>(vtxFmt.attrs[GX_VA_CLR0].type), static_cast<u32>(vtxFmt.attrs[GX_VA_TEX0].cnt),
+            static_cast<u32>(vtxFmt.attrs[GX_VA_TEX0].type), static_cast<u32>(vtxFmt.attrs[GX_VA_TEX1].cnt),
+            static_cast<u32>(vtxFmt.attrs[GX_VA_TEX1].type));
+  Log.warn("stopping FIFO decode at truncated draw: need {} bytes at pos {}, have {}", totalVtxBytes, pos, size);
+}
+
+// Draw command handler - parses vertices inline and caches results
+static u32 calculate_last_vtx_size(GXVtxFmt fmt) {
+  u32 vtxSize = 0;
+  const auto& vtxFmt = g_gxState.vtxFmts[fmt];
+  for (int i = GX_VA_PNMTXIDX; i <= GX_VA_TEX7; ++i) {
+    const auto attr = static_cast<GXAttr>(i);
+    const auto& attrFmt = vtxFmt.attrs[i];
+    switch (g_gxState.vtxDesc[i]) {
+    case GX_NONE:
+      break;
+    case GX_DIRECT: {
+      vtxSize += comp_type_size(attr, attrFmt.type) * comp_cnt_count(attr, attrFmt.cnt);
+      break;
+    }
+    case GX_INDEX8:
+      vtxSize += (attr == GX_VA_NRM && attrFmt.cnt == GX_NRM_NBT3) ? 3 : 1;
+      break;
+    case GX_INDEX16:
+      vtxSize += (attr == GX_VA_NRM && attrFmt.cnt == GX_NRM_NBT3) ? 6 : 2;
+      break;
+    }
+  }
+
+  g_gxState.lastVtxFmt = fmt;
+  g_gxState.lastVtxSize = vtxSize;
+
+  return vtxSize;
+}
+
+static void handle_draw_unmerged(GXPrimitive prim, GXVtxFmt fmt, u16 vtxCount,
+                                 gfx::Range vertRange, uint16_t usedPnMtxMask,
+                                 HashType matrixTopologySignature,
+                                 HashType geometrySignature, bool interpolationIdentityActive);
+
+// The per-draw geometry signature, matrix-usage mask and draw-identity hashes exist purely to feed frame interpolation (build_uniform consumes them only after its `frame_interpolation_fps() == 0` early-out).
+static inline bool frame_interpolation_identity_needed() noexcept {
+  return frame_interpolation_active() && g_gxState.projType == GX_PERSPECTIVE;
+}
+
+static uint32_t matrix_index_prefix_size(GXVtxFmt fmt) noexcept {
+  const auto& vtxFmt = g_gxState.vtxFmts[fmt];
+  uint32_t size = 0;
+  for (int i = GX_VA_PNMTXIDX; i < GX_VA_POS; ++i) {
+    const auto attr = static_cast<GXAttr>(i);
+    switch (g_gxState.vtxDesc[i]) {
+    case GX_NONE:
+      break;
+    case GX_DIRECT:
+      size += comp_type_size(attr, vtxFmt.attrs[i].type) *
+              comp_cnt_count(attr, vtxFmt.attrs[i].cnt);
+      break;
+    case GX_INDEX8:
+      ++size;
+      break;
+    case GX_INDEX16:
+      size += 2;
+      break;
+    }
+  }
+  return size;
+}
+
+static HashType draw_geometry_signature(GXVtxFmt fmt, const uint8_t* vertices,
+                                        uint16_t vtxCount, uint32_t vtxStride) noexcept {
+  Hasher hasher;
+  hasher.update(vtxCount);
+  hasher.update(vtxStride);
+
+  // Matrix-index bytes select an instance's current XF palette slots, so they are deliberately excluded from mesh identity.
+  const uint32_t matrixPrefix = std::min(matrix_index_prefix_size(fmt), vtxStride);
+  if (matrixPrefix == 0) {
+    // Most draws have no direct matrix-index prefix.
+    hasher.update(vertices, static_cast<size_t>(vtxCount) * vtxStride);
+  } else {
+    for (uint16_t vertex = 0; vertex < vtxCount; ++vertex) {
+      hasher.update(vertices + static_cast<size_t>(vertex) * vtxStride + matrixPrefix,
+                    vtxStride - matrixPrefix);
+    }
+  }
+
+  // Identical index streams can address different vertex arrays.
+  for (int i = GX_VA_POS; i <= GX_VA_TEX7; ++i) {
+    if (g_gxState.vtxDesc[i] != GX_INDEX8 && g_gxState.vtxDesc[i] != GX_INDEX16) {
+      continue;
+    }
+    const auto& array = g_gxState.arrays[i];
+    const auto attribute = static_cast<uint32_t>(i);
+    const auto source = reinterpret_cast<uintptr_t>(array.data);
+    hasher.update(attribute);
+    hasher.update(source);
+    hasher.update(array.stride);
+  }
+  return static_cast<HashType>(hasher.digest());
+}
+
+struct PnMtxUsage {
+  uint16_t mask = 0;
+  HashType topologySignature = 0;
+};
+
+// Slot mask only.
+static uint16_t pn_mtx_mask(const uint8_t* vertices, uint16_t vtxCount,
+                            uint32_t vtxStride) noexcept {
+  if (g_gxState.vtxDesc[GX_VA_PNMTXIDX] != GX_DIRECT) {
+    return static_cast<uint16_t>(1u << std::min<uint32_t>(g_gxState.currentPnMtx, MaxPnMtx - 1));
+  }
+  uint16_t mask = 0;
+  for (uint16_t vertex = 0; vertex < vtxCount; ++vertex) {
+    const uint32_t matrixIndex = vertices[static_cast<size_t>(vertex) * vtxStride] / 3u;
+    if (matrixIndex < MaxPnMtx) {
+      mask |= static_cast<uint16_t>(1u << matrixIndex);
+    }
+  }
+  return mask;
+}
+
+static PnMtxUsage pn_mtx_usage(const uint8_t* vertices, uint16_t vtxCount,
+                               uint32_t vtxStride) noexcept {
+  if (g_gxState.vtxDesc[GX_VA_PNMTXIDX] != GX_DIRECT) {
+    const uint32_t matrixIndex = std::min<uint32_t>(g_gxState.currentPnMtx, MaxPnMtx - 1);
+    return {
+        .mask = static_cast<uint16_t>(1u << matrixIndex),
+        // There is no vertex matrix-index topology in this path.
+        .topologySignature = 0,
+    };
+  }
+
+  Hasher topologyHasher;
+  topologyHasher.update(vtxCount);
+  uint16_t mask = 0;
+  for (uint16_t vertex = 0; vertex < vtxCount; ++vertex) {
+    // GX matrix-index attributes precede every other vertex attribute and are always one byte.
+    const uint8_t rawMatrixIndex = vertices[static_cast<size_t>(vertex) * vtxStride];
+    topologyHasher.update(rawMatrixIndex);
+    const uint32_t matrixIndex = rawMatrixIndex / 3u;
+    if (matrixIndex < MaxPnMtx) {
+      mask |= static_cast<uint16_t>(1u << matrixIndex);
+    }
+  }
+  return {
+      .mask = mask,
+      .topologySignature = static_cast<HashType>(topologyHasher.digest()),
+  };
+}
+
+// Whether the most recent unmerged draw recorded an interpolation snapshot, so a draw merged into it knows there is a snapshot to extend.
+static bool s_lastDrawRecordedInterpolation = false;
+
+struct CachedIndexTemplate {
+  bool valid = false;
+  GXPrimitive prim = static_cast<GXPrimitive>(0);
+  u16 vtxCount = 0;
+  u32 indexCount = 0;
+  IndexBuffer indices{};
+};
+
+static const CachedIndexTemplate& cached_index_template(GXPrimitive prim, u16 vtxCount) {
+  // Topology expansion is immutable for a primitive/count pair.
+  constexpr size_t CacheSize = 256;
+  static std::array<CachedIndexTemplate, CacheSize> cache{};
+  const u32 key = (static_cast<u32>(underlying(prim)) << 16) | vtxCount;
+  auto& entry = cache[(key ^ (key >> 9)) & (CacheSize - 1)];
+  if (entry.valid && entry.prim == prim && entry.vtxCount == vtxCount) LIKELY {
+    return entry;
+  }
+
+  entry.valid = true;
+  entry.prim = prim;
+  entry.vtxCount = vtxCount;
+  entry.indexCount = prepare_idx_template(entry.indices, prim, vtxCount);
+  return entry;
+}
+
+static IndexBuffer handle_draw_idx_buf;
+
+static ArrayRef<u16> offset_index_template(const CachedIndexTemplate& indexTemplate,
+                                           u16 vtxStart) {
+  // Grow-only: resizing down and back up made every merge zero-fill the buffer before the transform immediately overwrote it.
+  const size_t count = indexTemplate.indices.size();
+  if (handle_draw_idx_buf.size() < count) {
+    handle_draw_idx_buf.resize(count);
+  }
+  const u16* src = indexTemplate.indices.data();
+  u16* dst = handle_draw_idx_buf.data();
+  for (size_t i = 0; i < count; ++i) {
+    dst[i] = static_cast<u16>(src[i] + vtxStart);
+  }
+  return {dst, count};
+}
+
+struct CachedPipelineState {
+  gfx::PipelineRef ref = 0;
+  HashType configHash = 0;
+  // Carried here so the draw can be recorded without keeping the PipelineConfig that produced it alive; it is the only field of the config the draw itself still needs.
+  u32 dstAlpha = UINT32_MAX;
+  ShaderInfo shaderInfo{};
+};
+
+static const CachedPipelineState& cached_pipeline_state(const PipelineConfig& config) {
+  constexpr size_t CacheSize = 1024;
+  struct Entry {
+    bool valid = false;
+    PipelineConfig config{};
+    CachedPipelineState state{};
+  };
+  static std::array<Entry, CacheSize> cache{};
+
+  const HashType hash = xxh3_hash(config, static_cast<HashType>(gfx::ShaderType::GX));
+  auto& entry = cache[hash & (CacheSize - 1)];
+  if (entry.valid && entry.state.configHash == hash &&
+      std::memcmp(&entry.config, &config, sizeof(config)) == 0) LIKELY {
+    return entry.state;
+  }
+
+  entry.valid = true;
+  entry.config = config;
+  entry.state = {
+      .ref = gfx::pipeline_ref(config),
+      .configHash = hash,
+      .dstAlpha = config.dstAlpha,
+      .shaderInfo = build_shader_info(config.shaderConfig),
+  };
+  return entry.state;
+}
+
+// Resolving a pipeline the long way costs a ~2.7KB zero-init, a full populate_pipeline_config, an XXH3 over the whole config and a memcmp against the hash-indexed slot -- roughly 11KB of memory traffic for a result that is almost always identical to the previous draw's.
+static const CachedPipelineState& resolve_pipeline_state(GXPrimitive prim, GXVtxFmt fmt) {
+  struct Memo {
+    const CachedPipelineState* state = nullptr;
+    u32 generation = 0;
+    u32 sampleCount = 0;
+    GXPrimitive prim = static_cast<GXPrimitive>(0);
+    GXVtxFmt fmt = static_cast<GXVtxFmt>(0);
+  };
+  static Memo memo{};
+
+  const u32 sampleCount = gfx::get_sample_count();
+  const u32 generation = g_gxState.pipelineStateGeneration;
+  if (memo.state != nullptr && memo.generation == generation && memo.sampleCount == sampleCount &&
+      memo.prim == prim && memo.fmt == fmt) LIKELY {
+    return *memo.state;
+  }
+
+  PipelineConfig config{};
+  populate_pipeline_config(config, prim, fmt);
+  // cached_pipeline_state hands back a reference into a fixed direct-mapped table, so the address stays valid; the entry it points at can only be rewritten by another call to that function, and every such call goes through this miss path and replaces the memo in the same breath.
+  const CachedPipelineState& state = cached_pipeline_state(config);
+  memo = Memo{
+      .state = &state,
+      .generation = generation,
+      .sampleCount = sampleCount,
+      .prim = prim,
+      .fmt = fmt,
+  };
+  return state;
+}
+
+bool submit_raw_draw(GXPrimitive prim, GXVtxFmt fmt, const uint8_t* vertices, uint16_t vtxCount,
+                     uint32_t vertexBytes) {
+  ZoneScoped;
+  if (vertices == nullptr || vtxCount == 0 || vertexBytes == 0) {
+    return false;
+  }
+
+  if (__gx->dirtyState != 0) UNLIKELY {
+    __GXSetDirtyState();
+  }
+
+  // Raw bridge draws consume live decoded GX state that is also maintained by the HLE producer.
+  drain();
+
+  u32 vtxSize;
+  if (g_gxState.lastVtxFmt == fmt) LIKELY {
+    vtxSize = g_gxState.lastVtxSize;
+  } else UNLIKELY {
+    vtxSize = calculate_last_vtx_size(fmt);
+  }
+
+  const u32 expectedVertexBytes = static_cast<u32>(vtxCount) * vtxSize;
+  if (expectedVertexBytes == 0 || expectedVertexBytes != vertexBytes) {
+    static uint32_t rawVertexSizeMismatchCount = 0;
+    if (rawVertexSizeMismatchCount++ < 64) {
+      Log.warn("raw draw vertex-size mismatch prim={} fmt={} count={} cached_stride={} expected={} supplied={}",
+               static_cast<uint32_t>(prim), static_cast<uint32_t>(fmt), vtxCount, vtxSize,
+               expectedVertexBytes, vertexBytes);
+    }
+    return false;
+  }
+
+  // This entry point bypasses process(), so it owns the renderer lock itself.
+  std::lock_guard gpuLock(aurora::renderer_gpu_mutex());
+  const gfx::Range vertRange = gfx::push_verts(vertices, vertexBytes);
+  const bool interpolationIdentityActive = frame_interpolation_identity_needed();
+  const PnMtxUsage matrixUsage = interpolationIdentityActive
+                                     ? pn_mtx_usage(vertices, vtxCount, vtxSize)
+                                     : PnMtxUsage{};
+  handle_draw_unmerged(prim, fmt, vtxCount, vertRange,
+                       matrixUsage.mask, matrixUsage.topologySignature,
+                       interpolationIdentityActive ? draw_geometry_signature(fmt, vertices, vtxCount, vtxSize) : 0,
+                       interpolationIdentityActive);
+  return true;
+}
+
+static bool handle_draw(u8 cmd, const u8* data, u32& pos, u32 size, bool bigEndian) {
+  ZoneScoped;
+  GXVtxFmt fmt = static_cast<GXVtxFmt>(cmd & CP_VAT_MASK);
+  GXPrimitive prim = primitive_from_draw_cmd(cmd);
+
+  if (pos + 2 > size) {
+    return false;
+  }
+  u16 vtxCount = read_u16(data + pos, bigEndian);
+  pos += 2;
+
+  u32 vtxSize;
+  if (g_gxState.lastVtxFmt == fmt) LIKELY {
+    vtxSize = g_gxState.lastVtxSize;
+  } else UNLIKELY {
+    vtxSize = calculate_last_vtx_size(fmt);
+  }
+
+  u32 totalVtxBytes = vtxCount * vtxSize;
+  if (pos + totalVtxBytes > size) UNLIKELY {
+    handle_draw_overrun(cmd, vtxCount, vtxSize, totalVtxBytes, data, pos, size);
+    return false;
+  }
+
+
+  // Push raw vertex data to buffer
+  const uint8_t* vertices = data + pos;
+  gfx::Range vertRange = gfx::push_verts(vertices, totalVtxBytes);
+  pos += totalVtxBytes;
+
+  // Try to merge with previous draw call
+  if (!g_gxState.stateDirty) LIKELY {
+    auto* lastDraw = gfx::get_last_draw_command<DrawData>();
+    // Only if the previous draw call was a single instance draw (no lines/points handling)
+    if (lastDraw != nullptr && prim != GX_LINES && prim != GX_LINESTRIP && prim != GX_POINTS &&
+        lastDraw->instanceCount == 1) LIKELY {
+      const auto& indexTemplate = cached_index_template(prim, vtxCount);
+      const auto indices = offset_index_template(indexTemplate, lastDraw->vtxCount);
+      const u32 numIndices = indexTemplate.indexCount;
+      const gfx::Range idxRange = gfx::push_indices(indices);
+      CHECK(lastDraw->vertRange.offset + lastDraw->vertRange.size == vertRange.offset,
+            "Non-consecutive vertex ranges ({} < {})", lastDraw->vertRange.offset + lastDraw->vertRange.size,
+            vertRange.offset);
+      CHECK(lastDraw->idxRange.offset + lastDraw->idxRange.size == idxRange.offset,
+            "Non-consecutive index ranges ({} < {})", lastDraw->idxRange.offset + lastDraw->idxRange.size,
+            idxRange.offset);
+      lastDraw->vertRange.size += vertRange.size;
+      lastDraw->idxRange.size += idxRange.size;
+      lastDraw->vtxCount += vtxCount;
+      lastDraw->indexCount += numIndices;
+      ++gfx::g_mergedDrawCallCount;
+      // This primitive now renders through the draw we merged into, so its palette slots belong to that draw's interpolation snapshot as well.
+      if (s_lastDrawRecordedInterpolation) UNLIKELY {
+        extend_interpolation_draw(pn_mtx_mask(vertices, vtxCount, vtxSize));
+      }
+      return true;
+    }
+  }
+
+  const bool interpolationIdentityActive = frame_interpolation_identity_needed();
+  const PnMtxUsage matrixUsage = interpolationIdentityActive
+                                     ? pn_mtx_usage(vertices, vtxCount, vtxSize)
+                                     : PnMtxUsage{};
+  handle_draw_unmerged(prim, fmt, vtxCount, vertRange,
+                       matrixUsage.mask, matrixUsage.topologySignature,
+                       interpolationIdentityActive ? draw_geometry_signature(fmt, vertices, vtxCount, vtxSize) : 0,
+                       interpolationIdentityActive);
+  return true;
+}
+
+static void handle_draw_unmerged(GXPrimitive prim, GXVtxFmt fmt, u16 vtxCount,
+                                 gfx::Range vertRange, uint16_t usedPnMtxMask,
+                                 HashType matrixTopologySignature,
+                                 HashType geometrySignature, bool interpolationIdentityActive) {
+  ZoneScoped;
+  // GX_CULL_ALL rasterizes nothing on hardware - no color, no depth.
+  if (g_gxState.cullMode == GX_CULL_ALL && prim != GX_LINES && prim != GX_LINESTRIP && prim != GX_POINTS)
+      UNLIKELY {
+    // Leave stateDirty alone: the next draw re-resolving its pipeline is the safe direction, and nothing about this draw reached the GPU.
+    return;
+  }
+  // Callers hold the renderer GPU mutex for the whole drain (process() and submit_raw_draw); taking it again per draw only cost a recursive re-entry.
+  const auto& indexTemplate = cached_index_template(prim, vtxCount);
+  const u32 numIndices = indexTemplate.indexCount;
+  const gfx::Range idxRange = gfx::push_indices(ArrayRef<u16>{
+      indexTemplate.indices.data(), indexTemplate.indices.size()});
+
+  // Build pipeline, bind groups, and push draw command
+  BindGroupRanges ranges{};
+  for (int i = GX_VA_POS; i <= GX_VA_TEX7; ++i) {
+    if (g_gxState.vtxDesc[i] != GX_INDEX8 && g_gxState.vtxDesc[i] != GX_INDEX16) {
+      continue;
+    }
+    auto& array = g_gxState.arrays[i];
+    if (array.cachedRange.size > 0) {
+      ranges.vaRanges[i - GX_VA_POS] = array.cachedRange;
+    } else {
+      const auto range = gfx::push_storage(static_cast<const uint8_t*>(array.data), array.size);
+      ranges.vaRanges[i - GX_VA_POS] = range;
+      array.cachedRange = range;
+    }
+  }
+
+  const auto& pipelineState = resolve_pipeline_state(prim, fmt);
+  const auto& info = pipelineState.shaderInfo;
+
+  resolve_sampled_textures(info);
+
+  const auto bindGroups = build_bind_groups(info);
+
+  const auto pipeline = pipelineState.ref;
+
+  // Draw-identity hashing only feeds frame interpolation, and only for perspective draws: build_uniform reads the identity exclusively past its `!perspective || frame_interpolation_fps() == 0` early-out.
+  FrameInterpolationDrawIdentity drawIdentity{};
+  if (interpolationIdentityActive) UNLIKELY {
+    const HashType drawShape = static_cast<HashType>(vtxCount) |
+                               (static_cast<HashType>(underlying(prim)) << 16) |
+                               (static_cast<HashType>(underlying(fmt)) << 24);
+    const HashType pipelineDrawSignature = xxh3_hash(pipelineState.configHash, drawShape);
+    const HashType textureSignature = xxh3_hash(bindGroups.textureBindGroup);
+    const HashType materialAndTopology =
+        xxh3_hash(matrixTopologySignature,
+                  xxh3_hash(bindGroups.textureBindGroup, pipelineDrawSignature));
+    drawIdentity = FrameInterpolationDrawIdentity{
+        .combined = xxh3_hash(geometrySignature, materialAndTopology),
+        .pipeline = pipelineDrawSignature,
+        .texture = textureSignature,
+        .matrixTopology = matrixTopologySignature,
+    };
+  }
+  const auto uniformRanges =
+      build_uniform(info, vertRange.offset, ranges, drawIdentity, interpolationIdentityActive,
+                    usedPnMtxMask);
+  s_lastDrawRecordedInterpolation = interpolationIdentityActive;
+
+  uint32_t instanceCount = 1;
+  if (prim == GX_LINES) {
+    instanceCount = vtxCount / 2;
+  } else if (prim == GX_LINESTRIP) {
+    instanceCount = vtxCount - 1;
+  } else if (prim == GX_POINTS) {
+    instanceCount = vtxCount;
+  }
+  gfx::push_draw_command(DrawData{
+      .pipeline = pipeline,
+      .vertRange = vertRange,
+      .idxRange = idxRange,
+      .uniformRange = uniformRanges.current,
+      .interpolatedUniformRanges = uniformRanges.interpolated,
+      .vtxCount = vtxCount,
+      .indexCount = numIndices,
+      .instanceCount = instanceCount,
+      .bindGroups = bindGroups,
+      .dstAlpha = pipelineState.dstAlpha,
+  });
+  g_gxState.stateDirty = false;
+}
+
+std::string read_string(const u8* data, u32& pos, u32 size, bool bigEndian) {
+  CHECK(pos + 2 <= size, "Aurora string length read overrun");
+  const u16 length = read_u16(data + pos, bigEndian);
+  pos += 2;
+
+  CHECK(pos + length <= size, "Aurora string read overrun");
+  std::string str(reinterpret_cast<const char*>(data) + pos, length);
+  pos += length;
+  return str;
+}
+
+bool handle_aurora(const u8* data, u32& pos, u32 size, bool bigEndian) {
+  ZoneScoped;
+  if (pos + 2 > size) {
+    return false;
+  }
+  u16 subCmd = read_u16(data + pos, bigEndian);
+  pos += 2;
+
+  // Setting of vertex array bases.
+  if (subCmd == GX_LOAD_AURORA_VIEWPORT_RENDER) {
+    CHECK(pos + 24 <= size, "GX_LOAD_AURORA_VIEWPORT_RENDER read overrun");
+    const f32 left = read_f32(data + pos, bigEndian);
+    pos += 4;
+    const f32 top = read_f32(data + pos, bigEndian);
+    pos += 4;
+    const f32 width = read_f32(data + pos, bigEndian);
+    pos += 4;
+    const f32 height = read_f32(data + pos, bigEndian);
+    pos += 4;
+    const f32 nearZ = read_f32(data + pos, bigEndian);
+    pos += 4;
+    const f32 farZ = read_f32(data + pos, bigEndian);
+    pos += 4;
+    set_render_viewport({
+        .left = left,
+        .top = top,
+        .width = width,
+        .height = height,
+        .znear = nearZ,
+        .zfar = farZ,
+    });
+  } else if (subCmd == GX_LOAD_AURORA_SCISSOR_RENDER) {
+    CHECK(pos + 16 <= size, "GX_LOAD_AURORA_SCISSOR_RENDER read overrun");
+    const int32_t left = static_cast<int32_t>(read_u32(data + pos, bigEndian));
+    pos += 4;
+    const int32_t top = static_cast<int32_t>(read_u32(data + pos, bigEndian));
+    pos += 4;
+    const int32_t width = static_cast<int32_t>(read_u32(data + pos, bigEndian));
+    pos += 4;
+    const int32_t height = static_cast<int32_t>(read_u32(data + pos, bigEndian));
+    pos += 4;
+    set_render_scissor({left, top, width, height});
+  } else if (subCmd >= GX_LOAD_AURORA_ARRAYBASE && subCmd <= (GX_LOAD_AURORA_ARRAYBASE | 0x0f)) {
+    CHECK(pos + 13 <= size, "GX_LOAD_AURORA_ARRAYBASE read overrun");
+    u32 attrIdx = subCmd - GX_LOAD_AURORA_ARRAYBASE + GX_VA_POS;
+
+    u64 arrayAddr = read_u64(data + pos, bigEndian);
+    pos += 8;
+    u32 arraySize = read_u32(data + pos, bigEndian);
+    pos += 4;
+    bool le = data[pos] == 1;
+    pos += 1;
+
+    auto& array = g_gxState.arrays[attrIdx];
+    const auto newData = reinterpret_cast<void*>(arrayAddr);
+    if (array.data != newData || array.size != arraySize || array.le != le) {
+      array.data = newData;
+      array.size = arraySize;
+      array.le = le;
+      // Only drop the cached upload when the backing array actually changes.
+      array.cachedRange = {};
+      mark_pipeline_state_dirty();
+    }
+  } else if (subCmd == GX_LOAD_AURORA_TEXOBJ) {
+    CHECK(pos + 34 <= size, "GX_LOAD_AURORA_TEXOBJ read overrun");
+    const auto texMapId = data[pos];
+    pos += 1;
+    CHECK(texMapId < MaxTextures, "invalid texture map id {}", texMapId);
+    auto& slot = g_gxState.loadedTextures[texMapId];
+    GXTexObj_ next = slot;
+    next.data = reinterpret_cast<const void*>(read_u64(data + pos, bigEndian));
+    pos += 8;
+    next.mWidth = read_u32(data + pos, bigEndian);
+    pos += 4;
+    next.mHeight = read_u32(data + pos, bigEndian);
+    pos += 4;
+    next.mFormat = static_cast<GXTexFmt>(read_u32(data + pos, bigEndian));
+    pos += 4;
+    next.tlut = static_cast<GXTlut>(read_u32(data + pos, bigEndian));
+    pos += 4;
+    if (data[pos] != 0) {
+      next.flags |= 1u;
+    } else {
+      next.flags &= ~1u;
+    }
+    pos += 1;
+    next.texObjId = read_u32(data + pos, bigEndian);
+    pos += 4;
+    next.texDataVersion = read_u32(data + pos, bigEndian);
+    pos += 4;
+    next.set_no_cache(false); // Reset no-cache flag
+    const bool changed = slot.data != next.data || slot.mWidth != next.mWidth || slot.mHeight != next.mHeight ||
+                         slot.mFormat != next.mFormat || slot.tlut != next.tlut || slot.flags != next.flags ||
+                         slot.texObjId != next.texObjId || slot.texDataVersion != next.texDataVersion;
+    slot = next;
+    if (changed) {
+      g_gxState.stateDirty = true;
+    }
+  } else if (subCmd == GX_LOAD_AURORA_TLUT) {
+    CHECK(pos + 23 <= size, "GX_LOAD_AURORA_TLUT read overrun");
+    const auto idx = data[pos];
+    pos += 1;
+    CHECK(idx < MaxTluts, "invalid tlut slot {}", idx);
+    auto& slot = g_gxState.loadedTluts[idx];
+    slot.data = reinterpret_cast<const void*>(read_u64(data + pos, bigEndian));
+    pos += 8;
+    slot.format = static_cast<GXTlutFmt>(read_u32(data + pos, bigEndian));
+    pos += 4;
+    slot.numEntries = read_u16(data + pos, bigEndian);
+    pos += 2;
+    slot.tlutObjId = read_u32(data + pos, bigEndian);
+    pos += 4;
+    slot.tlutDataVersion = read_u32(data + pos, bigEndian);
+    pos += 4;
+    slot.set_no_cache(false); // Reset no-cache flag
+    g_gxState.stateDirty = true;
+  } else if (subCmd == GX_LOAD_AURORA_DESTROY_TEXOBJ) {
+    CHECK(pos + 4 <= size, "GX_LOAD_AURORA_DESTROY_TEXOBJ read overrun");
+    evict_texture_object(read_u32(data + pos, bigEndian));
+    pos += 4;
+  } else if (subCmd == GX_LOAD_AURORA_DESTROY_TLUT) {
+    CHECK(pos + 4 <= size, "GX_LOAD_AURORA_DESTROY_TLUT read overrun");
+    evict_tlut_object(read_u32(data + pos, bigEndian));
+    pos += 4;
+  } else if (subCmd == GX_LOAD_AURORA_DESTROY_COPY_TEX) {
+    CHECK(pos + 8 <= size, "GX_LOAD_AURORA_DESTROY_COPY_TEX read overrun");
+    evict_copy_texture(reinterpret_cast<const void*>(read_u64(data + pos, bigEndian)));
+    pos += 8;
+  } else if (subCmd == GX_LOAD_AURORA_INVALIDATE_TEX_ALL) {
+    invalidate_static_texture_cache();
+  } else if (subCmd == GX_LOAD_AURORA_DEBUG_GROUP_PUSH) {
+    auto label = read_string(data, pos, size, bigEndian);
+    gfx::push_debug_group(std::move(label));
+  } else if (subCmd == GX_LOAD_AURORA_DEBUG_GROUP_POP) {
+    aurora_pop_debug_group();
+  } else if (subCmd == GX_LOAD_AURORA_DEBUG_MARKER_INSERT) {
+    auto label = read_string(data, pos, size, bigEndian);
+    gfx::insert_debug_marker(std::move(label));
+  }
+
+  else {
+    static u32 unknownAuroraLogCount = 0;
+    if (unknownAuroraLogCount < 16) {
+      Log.warn("Unknown Aurora subcommand: {:04X}; stopping FIFO decode", subCmd);
+      ++unknownAuroraLogCount;
+    }
+    return false;
+  }
+  return true;
+}
+
+} // namespace aurora::gx::fifo
diff --git a/aurora-main/lib/gx/command_processor.hpp b/aurora-main/lib/gx/command_processor.hpp
new file mode 100644
index 0000000..0e15ad5
--- /dev/null
+++ b/aurora-main/lib/gx/command_processor.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "dolphin/gx/GXEnum.h"
+#include "../internal.hpp"
+
+namespace aurora::gx::fifo {
+
+// Reset the CP write-deduplication state whenever the GX shadow state is reinitialized.
+void reset_cp_register_cache();
+
+// Process a buffer of GX FIFO commands
+void process(const uint8_t* data, uint32_t size, bool bigEndian);
+
+// Submit already-packed direct vertex bytes against the current GX state.
+bool submit_raw_draw(GXPrimitive prim, GXVtxFmt fmt, const uint8_t* vertices, uint16_t vtxCount,
+                     uint32_t vertexBytes);
+
+} // namespace aurora::gx::fifo
diff --git a/aurora-main/lib/gx/fifo.cpp b/aurora-main/lib/gx/fifo.cpp
new file mode 100644
index 0000000..9b4dcc0
--- /dev/null
+++ b/aurora-main/lib/gx/fifo.cpp
@@ -0,0 +1,94 @@
+#include "fifo.hpp"
+#include "command_processor.hpp"
+#include "../internal.hpp"
+
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+#include "tracy/Tracy.hpp"
+
+namespace aurora::gx::fifo {
+static Module Log("aurora::gx::fifo");
+
+namespace detail {
+uint8_t* sBufferData = nullptr;
+uint32_t sBufferSize = 0;
+uint32_t sBufferCapacity = 0;
+bool sInDisplayList = false;
+uint8_t* sDlBuffer = nullptr;
+uint32_t sDlSize = 0;
+uint32_t sDlWritePos = 0;
+} // namespace detail
+
+void init() {
+  constexpr uint32_t initialCapacity = 64 * 1024;
+  reset_cp_register_cache();
+  free(detail::sBufferData);
+  detail::sBufferData = static_cast<uint8_t*>(malloc(initialCapacity));
+  detail::sBufferSize = 0;
+  detail::sBufferCapacity = initialCapacity;
+  detail::sInDisplayList = false;
+  detail::sDlBuffer = nullptr;
+  detail::sDlSize = 0;
+  detail::sDlWritePos = 0;
+}
+
+void write_data_grow(const void* data, uint32_t length) {
+  uint32_t needed = detail::sBufferSize + length;
+  uint32_t newCap = std::max(detail::sBufferCapacity * 2, needed);
+  detail::sBufferData = static_cast<uint8_t*>(realloc(detail::sBufferData, newCap));
+  std::memcpy(detail::sBufferData + detail::sBufferSize, data, length);
+  detail::sBufferSize = needed;
+  detail::sBufferCapacity = newCap;
+}
+
+void begin_display_list(uint8_t* buf, uint32_t size) {
+  detail::sInDisplayList = true;
+  detail::sDlBuffer = buf;
+  detail::sDlSize = size;
+  detail::sDlWritePos = 0;
+}
+
+uint32_t end_display_list() {
+  detail::sInDisplayList = false;
+  uint32_t bytesWritten = detail::sDlWritePos;
+  uint32_t padded = (bytesWritten + 31) & ~31u;
+  while (detail::sDlWritePos < padded && detail::sDlWritePos < detail::sDlSize) {
+    detail::sDlBuffer[detail::sDlWritePos++] = 0;
+  }
+  detail::sDlBuffer = nullptr;
+  detail::sDlSize = 0;
+  detail::sDlWritePos = 0;
+  return padded;
+}
+
+bool in_display_list() { return detail::sInDisplayList; }
+
+// How much of the producer's frame is spent blocked before it may decode the next batch of GX commands.
+static void note_drain_wait(uint64_t nanos) noexcept {
+  ZoneScopedN("FIFO drain wait");
+  TracyPlot("aurora: fifoDrainWaitUs", static_cast<int64_t>(nanos / 1000));
+}
+
+void drain() {
+  // SEALED, not DONE.
+  const auto waited = aurora::wait_for_frame_worker_sealed();
+  if (waited.count() > 0) UNLIKELY {
+    note_drain_wait(static_cast<uint64_t>(waited.count()));
+  }
+  if (detail::sBufferSize == 0) {
+    return;
+  }
+  process(detail::sBufferData, detail::sBufferSize, true);
+  detail::sBufferSize = 0;
+}
+
+const uint8_t* get_buffer_data() { return detail::sBufferData; }
+uint32_t get_buffer_size() { return detail::sBufferSize; }
+void clear_buffer() {
+  detail::sBufferSize = 0;
+}
+
+} // namespace aurora::gx::fifo
diff --git a/aurora-main/lib/gx/fifo.hpp b/aurora-main/lib/gx/fifo.hpp
new file mode 100644
index 0000000..b01ea45
--- /dev/null
+++ b/aurora-main/lib/gx/fifo.hpp
@@ -0,0 +1,89 @@
+#pragma once
+
+#include "../internal.hpp"
+
+#include <cstring>
+
+namespace aurora::gx::fifo {
+
+namespace detail {
+extern uint8_t* sBufferData;
+extern uint32_t sBufferSize;
+extern uint32_t sBufferCapacity;
+extern bool sInDisplayList;
+extern uint8_t* sDlBuffer;
+extern uint32_t sDlSize;
+extern uint32_t sDlWritePos;
+} // namespace detail
+
+void init();
+
+// Out-of-line slow path: grows internal buffer then appends data
+void write_data_grow(const void* data, uint32_t length);
+
+inline void write_data(const void* data, const uint32_t length) {
+  if (!detail::sInDisplayList)
+    LIKELY {
+      if (detail::sBufferSize + length <= detail::sBufferCapacity)
+        LIKELY {
+          std::memcpy(detail::sBufferData + detail::sBufferSize, data, length);
+          detail::sBufferSize += length;
+          return;
+        }
+      write_data_grow(data, length);
+    }
+  else if (detail::sDlWritePos + length <= detail::sDlSize) {
+    std::memcpy(detail::sDlBuffer + detail::sDlWritePos, data, length);
+    detail::sDlWritePos += length;
+  }
+}
+
+inline void write_u8(const uint8_t val) {
+  if (!detail::sInDisplayList)
+    LIKELY {
+      if (detail::sBufferSize < detail::sBufferCapacity)
+        LIKELY {
+          detail::sBufferData[detail::sBufferSize++] = val;
+          return;
+        }
+      write_data_grow(&val, 1);
+    }
+  else if (detail::sDlWritePos < detail::sDlSize) {
+    detail::sDlBuffer[detail::sDlWritePos++] = val;
+  }
+}
+
+inline void write_u16(const uint16_t val) {
+  const auto out = bswap(val);
+  write_data(&out, sizeof(out));
+}
+
+inline void write_u32(const uint32_t val) {
+  const auto out = bswap(val);
+  write_data(&out, sizeof(out));
+}
+
+inline void write_u64(const uint64_t val) {
+  const auto out = bswap(val);
+  write_data(&out, sizeof(out));
+}
+
+inline void write_f32(const float val) {
+  const auto out = bswap(val);
+  write_data(&out, sizeof(out));
+}
+
+// Display list recording
+void begin_display_list(uint8_t* buf, uint32_t size);
+uint32_t end_display_list();
+bool in_display_list();
+
+// Drain the internal FIFO buffer through the command processor
+void drain();
+
+// Internal buffer inspection
+const uint8_t* get_buffer_data();
+uint32_t get_buffer_size();
+void clear_buffer();
+
+} // namespace aurora::gx::fifo
diff --git a/aurora-main/lib/gx/frame_interpolation.cpp b/aurora-main/lib/gx/frame_interpolation.cpp
new file mode 100644
index 0000000..b0283ec
--- /dev/null
+++ b/aurora-main/lib/gx/frame_interpolation.cpp
@@ -0,0 +1,1523 @@
+#include "frame_interpolation.hpp"
+
+#include "../internal.hpp"
+#include "aurora/gfx.h"
+
+// Guest matrices really do carry NaN/Inf, and the isfinite guards here keep them
+// out of the MatchEdge sort. Needs -fno-finite-math-only (see runtime/CMakeLists.txt).
+#if defined(__FINITE_MATH_ONLY__) && __FINITE_MATH_ONLY__
+#error "frame_interpolation.cpp must be compiled with -fno-finite-math-only; its NaN filtering is load-bearing for memory safety (see comment above)."
+#endif
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cmath>
+#include <condition_variable>
+#include <cstring>
+#include <functional>
+#include <limits>
+#include <memory>
+#include <mutex>
+#include <thread>
+#include <unordered_map>
+#include <vector>
+
+namespace aurora::gx {
+namespace detail {
+std::atomic_uint32_t g_frameInterpolationFps{0};
+} // namespace detail
+
+namespace {
+static Module Log("aurora::gx::interp");
+
+// Diagnostics for aurora_get_frame_interpolation_diagnostics. Individually atomic:
+// one writer, and a torn read is harmless for an overlay.
+std::atomic_uint32_t s_diagCandidates{0};
+std::atomic_uint32_t s_diagMatchable{0};
+std::atomic_uint32_t s_diagMatches{0};
+std::atomic_bool s_diagEligible{false};
+std::atomic_bool s_diagReplaySafe{true};
+std::atomic_uint64_t s_diagFramesSealed{0};
+std::atomic_uint64_t s_diagFramesLowMatch{0};
+std::atomic_uint64_t s_diagFramesReplayUnsafe{0};
+std::atomic_uint64_t s_diagSlotReductions{0};
+std::atomic_uint64_t s_diagLateSealDrops{0};
+// Persistent worker pool for the per-sample interpolation tasks. libc++ has no
+// parallel execution policies, so without it the seal loop runs serially. Leaked.
+class InterpolationWorkerPool {
+public:
+  static InterpolationWorkerPool& instance() {
+    static InterpolationWorkerPool* pool = new InterpolationWorkerPool();
+    return *pool;
+  }
+
+  // Runs fn(index) for every index in [0, count). Returns once every index has
+  // been processed. Not reentrant; only the producer/seal thread dispatches.
+  template <typename Fn>
+  void run(size_t count, const Fn& fn) {
+    if (count == 0) {
+      return;
+    }
+    if (m_workers.empty()) {
+      for (size_t i = 0; i < count; ++i) {
+        fn(i);
+      }
+      return;
+    }
+    {
+      // Job state and the generation bump publish under one lock, so a late worker
+      // can never observe a half-written job.
+      std::lock_guard lock(m_mutex);
+      m_invoke = [&fn](size_t index) { fn(index); };
+      m_count.store(count, std::memory_order_relaxed);
+      m_next.store(0, std::memory_order_relaxed);
+      m_remaining.store(count, std::memory_order_relaxed);
+      ++m_generation;
+    }
+    m_wake.notify_all();
+    consume();
+    // Wait for stragglers to leave consume() entirely, not just finish their chunks,
+    // so the next dispatch can safely reset the shared counters.
+    while (m_remaining.load(std::memory_order_acquire) != 0 ||
+           m_active.load(std::memory_order_acquire) != 0) {
+      std::this_thread::yield();
+    }
+    m_invoke = nullptr;
+  }
+
+private:
+  static constexpr size_t kChunk = 16;
+
+  InterpolationWorkerPool() {
+    const unsigned hardware = std::thread::hardware_concurrency();
+    // The caller helps too. Cap the helpers: tasks are short memcpy+math, so dispatch
+    // overhead and memory bandwidth dominate past a few threads.
+    const unsigned helpers = hardware > 2 ? std::min(hardware - 1, 6u) : 0;
+    m_workers.reserve(helpers);
+    for (unsigned i = 0; i < helpers; ++i) {
+      m_workers.emplace_back([this] { worker_loop(); });
+    }
+  }
+
+  void consume() {
+    const size_t count = m_count.load(std::memory_order_relaxed);
+    while (true) {
+      const size_t begin = m_next.fetch_add(kChunk, std::memory_order_relaxed);
+      if (begin >= count) {
+        return;
+      }
+      const size_t end = std::min(begin + kChunk, count);
+      for (size_t index = begin; index < end; ++index) {
+        m_invoke(index);
+      }
+      m_remaining.fetch_sub(end - begin, std::memory_order_release);
+    }
+  }
+
+  void worker_loop() {
+    uint64_t seenGeneration = 0;
+    while (true) {
+      {
+        std::unique_lock lock(m_mutex);
+        m_wake.wait(lock, [&] { return m_generation != seenGeneration; });
+        seenGeneration = m_generation;
+        // Counted under the mutex: when the dispatcher sees m_active == 0 every worker is
+        // parked or has not read the current generation, so a counter reset is safe.
+        m_active.fetch_add(1, std::memory_order_relaxed);
+      }
+      consume();
+      m_active.fetch_sub(1, std::memory_order_release);
+    }
+  }
+
+  std::vector<std::thread> m_workers;
+  std::mutex m_mutex;
+  std::condition_variable m_wake;
+  uint64_t m_generation = 0;
+  std::function<void(size_t)> m_invoke;
+  std::atomic_size_t m_count{0};
+  std::atomic_size_t m_next{0};
+  std::atomic_size_t m_remaining{0};
+  std::atomic_size_t m_active{0};
+};
+struct FrameTransformSnapshot {
+  Mat4x4<float> projection{};
+  Mat3x4<float> position{};
+  Mat3x4<float> normal{};
+  uint16_t usedMatrixMask = 1;
+  struct IndexedMatrices {
+    std::array<Mat3x4<float>, MaxPnMtx> position{};
+    std::array<Mat3x4<float>, MaxPnMtx> normal{};
+    // Content hash of each used slot's position/normal pair. A mesh split across draws
+    // repeats bone matrices byte for byte, so the seal can pair slots across draws.
+    std::array<HashType, MaxPnMtx> slotHash{};
+  };
+  std::unique_ptr<IndexedMatrices> indexedMatrices;
+};
+
+struct FrameTransformEntry {
+  FrameInterpolationDrawIdentity identity;
+  FrameTransformSnapshot transform;
+  // Constant-velocity prediction of a non-indexed transform, so repeated meshes match
+  // on where they will be. Not for indexed draws: PNMTXIDX slot identity pairs those.
+  Mat3x4<float> predictedPosition{};
+  bool hasPrediction = false;
+};
+
+struct Quaternion {
+  float x = 0.0f;
+  float y = 0.0f;
+  float z = 0.0f;
+  float w = 1.0f;
+};
+
+struct PendingUniformInterpolation {
+  size_t currentTransformIndex = 0;
+  const uint8_t* sourceUniformData = nullptr;
+  uint8_t* uniformData = nullptr;
+  size_t uniformSize = 0;
+  size_t projectionOffset = 0;
+  size_t positionOffset = 0;
+  size_t normalOffset = 0;
+  size_t currentMatrix = 0;
+  uint32_t numerator = 0;
+  uint32_t denominator = 1;
+  bool indexedMatrices = false;
+};
+
+std::vector<FrameTransformEntry> s_previousFrameTransforms;
+std::vector<FrameTransformEntry> s_currentFrameTransforms;
+std::unordered_map<HashType, std::vector<size_t>> s_previousTransformIndices;
+std::unordered_map<HashType, std::vector<size_t>> s_currentTransformIndices;
+std::unordered_map<HashType, std::vector<size_t>> s_previousStableTransformIndices;
+std::unordered_map<HashType, std::vector<size_t>> s_currentStableTransformIndices;
+
+// Free list for the indexed-matrix snapshots; per-draw heap allocation was the
+// hottest cost in this path. Unused slots keep stale data, consumers mask first.
+std::vector<std::unique_ptr<FrameTransformSnapshot::IndexedMatrices>> s_indexedMatricesPool;
+constexpr size_t kMaximumPooledIndexedMatrices = 4096;
+
+std::unique_ptr<FrameTransformSnapshot::IndexedMatrices> acquire_indexed_matrices() {
+  if (s_indexedMatricesPool.empty()) {
+    return std::make_unique<FrameTransformSnapshot::IndexedMatrices>();
+  }
+  auto block = std::move(s_indexedMatricesPool.back());
+  s_indexedMatricesPool.pop_back();
+  return block;
+}
+
+void recycle_transform_entries(std::vector<FrameTransformEntry>& entries) noexcept {
+  for (auto& entry : entries) {
+    if (entry.transform.indexedMatrices &&
+        s_indexedMatricesPool.size() < kMaximumPooledIndexedMatrices) {
+      s_indexedMatricesPool.push_back(std::move(entry.transform.indexedMatrices));
+    }
+  }
+  entries.clear();
+}
+
+// Whether the frame in s_previousFrameTransforms recorded any palette draw;
+// record_interpolation_draw uses it to decide whether staging can pay off.
+bool s_previousFrameHasIndexedMatrices = false;
+
+// Hands the frame that just sealed to the next frame's matching and returns
+// the retiring one's matrix blocks to the pool.
+void retire_frame_transforms() noexcept {
+  s_previousFrameHasIndexedMatrices =
+      std::any_of(s_currentFrameTransforms.begin(), s_currentFrameTransforms.end(),
+                  [](const FrameTransformEntry& entry) noexcept {
+                    return static_cast<bool>(entry.transform.indexedMatrices);
+                  });
+  s_previousFrameTransforms.swap(s_currentFrameTransforms);
+  recycle_transform_entries(s_currentFrameTransforms);
+}
+
+// clear() destroys every node, so empty the vectors in place and let a stable scene
+// reuse them. Fall back to a real clear once the map outgrows the live set.
+void clear_index_map_keep_nodes(std::unordered_map<HashType, std::vector<size_t>>& map,
+                                size_t liveEntries) {
+  if (map.size() > liveEntries + 256) {
+    map.clear();
+    return;
+  }
+  for (auto& entry : map) {
+    entry.second.clear();
+  }
+}
+uint32_t s_perspectiveCandidates = 0;
+// Candidates that also existed last frame. Freshly spawned effects have no partner
+// by definition, so counting them measured spawn churn instead of matcher health.
+uint32_t s_perspectiveMatchable = 0;
+uint32_t s_perspectiveMatches = 0;
+std::vector<PendingUniformInterpolation> s_pendingUniformInterpolations;
+std::atomic_bool s_hasInterpolatedFrame{false};
+std::atomic_bool s_frameInterpolationReplaySafe{true};
+uint32_t s_previousInterpolationFps = 0;
+
+// Adaptive slot count: the target moves at most one step per pacing window, while
+// s_activeInterpolationSamples is latched per frame and must not move mid-frame.
+std::atomic_uint32_t s_interpolationSampleTarget{0};
+std::atomic_uint32_t s_activeInterpolationSamples{0};
+
+// Set when the producer already overran its retrace budget; the next seal then skips
+// inserted slots for that one frame, which helps the late frame catch back up.
+std::atomic_bool s_dropInterpolationAtSeal{false};
+
+// Windowed backstop for sustained overload. The wide reduce/restore gap is the
+// hysteresis, so a scene that can sustain N slots settles there instead of flapping.
+std::atomic_uint32_t s_pacingWindowFrames{0};
+std::atomic_uint32_t s_pacingWindowMisses{0};
+constexpr uint32_t kPacingWindowFrames = 60; // ~1 second of guest frames
+constexpr uint32_t kPacingReducePercent = 75;
+constexpr uint32_t kPacingRestorePercent = 25;
+
+uint32_t maximum_interpolation_samples() noexcept {
+  const uint32_t targetFps = frame_interpolation_fps();
+  if (targetFps == 0) {
+    return 0;
+  }
+  return std::min(targetFps / 60 - 1, MaxInterpolatedFrames);
+}
+
+constexpr float kMinimumScale = 1.0e-5f;
+constexpr float kMaximumTranslationPerFrame = 1500.0f;
+constexpr float kMinimumQuaternionDot = 0.70710678f;
+constexpr size_t kNoPreparedPair = std::numeric_limits<size_t>::max();
+
+HashType combine_identity(HashType first, HashType second) noexcept {
+  return xxh3_hash(second, first);
+}
+
+HashType stable_identity(const FrameInterpolationDrawIdentity& identity) noexcept {
+  return combine_identity(combine_identity(identity.pipeline, identity.texture),
+                          identity.matrixTopology);
+}
+
+float dot3(const std::array<float, 3>& a, const std::array<float, 3>& b) noexcept {
+  return a[0] * b[0] + a[1] * b[1] + a[2] * b[2];
+}
+
+std::array<float, 3> cross3(const std::array<float, 3>& a, const std::array<float, 3>& b) noexcept {
+  return {
+      a[1] * b[2] - a[2] * b[1],
+      a[2] * b[0] - a[0] * b[2],
+      a[0] * b[1] - a[1] * b[0],
+  };
+}
+
+Quaternion quaternion_from_rotation(const std::array<std::array<float, 3>, 3>& m) noexcept {
+  Quaternion q;
+  const float trace = m[0][0] + m[1][1] + m[2][2];
+  if (trace > 0.0f) {
+    const float s = std::sqrt(trace + 1.0f) * 2.0f;
+    q.w = 0.25f * s;
+    q.x = (m[2][1] - m[1][2]) / s;
+    q.y = (m[0][2] - m[2][0]) / s;
+    q.z = (m[1][0] - m[0][1]) / s;
+  } else if (m[0][0] > m[1][1] && m[0][0] > m[2][2]) {
+    const float s = std::sqrt(1.0f + m[0][0] - m[1][1] - m[2][2]) * 2.0f;
+    q.w = (m[2][1] - m[1][2]) / s;
+    q.x = 0.25f * s;
+    q.y = (m[0][1] + m[1][0]) / s;
+    q.z = (m[0][2] + m[2][0]) / s;
+  } else if (m[1][1] > m[2][2]) {
+    const float s = std::sqrt(1.0f + m[1][1] - m[0][0] - m[2][2]) * 2.0f;
+    q.w = (m[0][2] - m[2][0]) / s;
+    q.x = (m[0][1] + m[1][0]) / s;
+    q.y = 0.25f * s;
+    q.z = (m[1][2] + m[2][1]) / s;
+  } else {
+    const float s = std::sqrt(1.0f + m[2][2] - m[0][0] - m[1][1]) * 2.0f;
+    q.w = (m[1][0] - m[0][1]) / s;
+    q.x = (m[0][2] + m[2][0]) / s;
+    q.y = (m[1][2] + m[2][1]) / s;
+    q.z = 0.25f * s;
+  }
+  return q;
+}
+
+bool decompose_affine(const Mat3x4<float>& matrix, std::array<std::array<float, 3>, 3>& rotation,
+                      std::array<float, 3>& scale, std::array<float, 3>& translation,
+                      Quaternion& quaternion) noexcept {
+  const std::array<Vec4<float>, 3> rows{matrix.m0, matrix.m1, matrix.m2};
+  // V*T*R*S puts non-uniform model scale on the columns, so scale must be read off the
+  // columns; row extraction misreads R*S as shear whenever the rotation tilts an axis.
+  for (size_t row = 0; row < 3; ++row) {
+    translation[row] = rows[row].w();
+    if (!std::isfinite(translation[row])) {
+      return false;
+    }
+  }
+  for (size_t column = 0; column < 3; ++column) {
+    const float x = rows[0][column];
+    const float y = rows[1][column];
+    const float z = rows[2][column];
+    scale[column] = std::sqrt(x * x + y * y + z * z);
+    if (!std::isfinite(scale[column]) || scale[column] < kMinimumScale) {
+      return false;
+    }
+    rotation[0][column] = x / scale[column];
+    rotation[1][column] = y / scale[column];
+    rotation[2][column] = z / scale[column];
+  }
+
+  const auto rotationColumn = [&rotation](size_t column) noexcept {
+    return std::array<float, 3>{rotation[0][column], rotation[1][column], rotation[2][column]};
+  };
+  if (std::abs(dot3(rotationColumn(0), rotationColumn(1))) > 0.05f ||
+      std::abs(dot3(rotationColumn(0), rotationColumn(2))) > 0.05f ||
+      std::abs(dot3(rotationColumn(1), rotationColumn(2))) > 0.05f) {
+    return false;
+  }
+
+  const float determinant = dot3(rotation[0], cross3(rotation[1], rotation[2]));
+  if (!std::isfinite(determinant) || std::abs(std::abs(determinant) - 1.0f) > 0.1f) {
+    return false;
+  }
+  if (determinant < 0.0f) {
+    scale[0] = -scale[0];
+    for (size_t row = 0; row < 3; ++row) {
+      rotation[row][0] = -rotation[row][0];
+    }
+  }
+
+  quaternion = quaternion_from_rotation(rotation);
+  return std::isfinite(quaternion.x) && std::isfinite(quaternion.y) && std::isfinite(quaternion.z) &&
+         std::isfinite(quaternion.w);
+}
+
+std::array<std::array<float, 3>, 3> rotation_from_quaternion(const Quaternion& q) noexcept {
+  const float xx = q.x * q.x;
+  const float yy = q.y * q.y;
+  const float zz = q.z * q.z;
+  const float xy = q.x * q.y;
+  const float xz = q.x * q.z;
+  const float yz = q.y * q.z;
+  const float wx = q.w * q.x;
+  const float wy = q.w * q.y;
+  const float wz = q.w * q.z;
+  return {{
+      {{1.0f - 2.0f * (yy + zz), 2.0f * (xy - wz), 2.0f * (xz + wy)}},
+      {{2.0f * (xy + wz), 1.0f - 2.0f * (xx + zz), 2.0f * (yz - wx)}},
+      {{2.0f * (xz - wy), 2.0f * (yz + wx), 1.0f - 2.0f * (xx + yy)}},
+  }};
+}
+
+struct PreparedAffinePair {
+  Mat3x4<float> previous{};
+  Mat3x4<float> current{};
+  std::array<float, 3> previousScale{};
+  std::array<float, 3> currentScale{};
+  std::array<float, 3> previousTranslation{};
+  std::array<float, 3> currentTranslation{};
+  Quaternion previousQuaternion{};
+  Quaternion currentQuaternion{};
+  bool linear = false;
+  bool identical = false;
+  bool valid = false;
+};
+
+struct PreparedTransformInterpolation {
+  size_t nonIndexedPairOffset = kNoPreparedPair;
+  std::array<size_t, MaxPnMtx> indexedPairOffsets{};
+  // Previous-frame entry the projection interpolates from. For a draw that borrowed
+  // its matrices from a sibling, that is the sibling's partner.
+  size_t previousProjectionEntry = kNoPreparedPair;
+  bool indexedValid = false;
+
+  PreparedTransformInterpolation() {
+    indexedPairOffsets.fill(kNoPreparedPair);
+  }
+};
+
+PreparedAffinePair prepare_affine_pair(const Mat3x4<float>& previous,
+                                       const Mat3x4<float>& current) noexcept {
+  PreparedAffinePair pair{.previous = previous, .current = current};
+  if (std::memcmp(&previous, &current, sizeof(current)) == 0) {
+    pair.identical = true;
+    pair.valid = true;
+    return pair;
+  }
+
+  std::array<std::array<float, 3>, 3> previousRotation{};
+  std::array<std::array<float, 3>, 3> currentRotation{};
+  if (!decompose_affine(previous, previousRotation, pair.previousScale,
+                        pair.previousTranslation, pair.previousQuaternion) ||
+      !decompose_affine(current, currentRotation, pair.currentScale,
+                        pair.currentTranslation, pair.currentQuaternion)) {
+    return pair;
+  }
+
+  float translationDeltaSquared = 0.0f;
+  for (size_t i = 0; i < 3; ++i) {
+    const float delta = pair.currentTranslation[i] - pair.previousTranslation[i];
+    translationDeltaSquared += delta * delta;
+  }
+  if (!std::isfinite(translationDeltaSquared) ||
+      translationDeltaSquared > kMaximumTranslationPerFrame * kMaximumTranslationPerFrame) {
+    return pair;
+  }
+
+  float quaternionDot = pair.previousQuaternion.x * pair.currentQuaternion.x +
+                        pair.previousQuaternion.y * pair.currentQuaternion.y +
+                        pair.previousQuaternion.z * pair.currentQuaternion.z +
+                        pair.previousQuaternion.w * pair.currentQuaternion.w;
+  if (quaternionDot < 0.0f) {
+    pair.currentQuaternion.x = -pair.currentQuaternion.x;
+    pair.currentQuaternion.y = -pair.currentQuaternion.y;
+    pair.currentQuaternion.z = -pair.currentQuaternion.z;
+    pair.currentQuaternion.w = -pair.currentQuaternion.w;
+    quaternionDot = -quaternionDot;
+  }
+  if (!std::isfinite(quaternionDot) || quaternionDot < kMinimumQuaternionDot) {
+    return pair;
+  }
+  pair.valid = true;
+  return pair;
+}
+
+// Indexed matrices are final palette transforms, so interpolate coefficients instead
+// of decomposing: ((1-t)M0 + tM1)v keeps a shared mesh boundary shared.
+PreparedAffinePair prepare_indexed_pair(const Mat3x4<float>& previous,
+                                        const Mat3x4<float>& current) noexcept {
+  PreparedAffinePair pair{
+      .previous = previous,
+      .current = current,
+      .linear = true,
+  };
+  if (std::memcmp(&previous, &current, sizeof(current)) == 0) {
+    pair.identical = true;
+    pair.valid = true;
+    return pair;
+  }
+
+  const std::array<Vec4<float>, 3> previousRows{previous.m0, previous.m1, previous.m2};
+  const std::array<Vec4<float>, 3> currentRows{current.m0, current.m1, current.m2};
+  for (size_t row = 0; row < 3; ++row) {
+    for (size_t column = 0; column < 4; ++column) {
+      if (!std::isfinite(previousRows[row][column]) ||
+          !std::isfinite(currentRows[row][column])) {
+        return pair;
+      }
+    }
+  }
+
+  const float dx = current.m0.w() - previous.m0.w();
+  const float dy = current.m1.w() - previous.m1.w();
+  const float dz = current.m2.w() - previous.m2.w();
+  const float translationDeltaSquared = dx * dx + dy * dy + dz * dz;
+  if (!(translationDeltaSquared <=
+        kMaximumTranslationPerFrame * kMaximumTranslationPerFrame)) {
+    return pair;
+  }
+  pair.valid = true;
+  return pair;
+}
+
+bool evaluate_affine_pair(const PreparedAffinePair& pair, float weight,
+                          Mat3x4<float>& output) noexcept {
+  if (!pair.valid || pair.identical) {
+    output = pair.current;
+    return pair.valid;
+  }
+
+  if (pair.linear) {
+    const std::array<const Vec4<float>*, 3> previousRows{
+        &pair.previous.m0, &pair.previous.m1, &pair.previous.m2};
+    const std::array<const Vec4<float>*, 3> currentRows{
+        &pair.current.m0, &pair.current.m1, &pair.current.m2};
+    const std::array<Vec4<float>*, 3> outputRows{&output.m0, &output.m1, &output.m2};
+    for (size_t row = 0; row < 3; ++row) {
+      for (size_t column = 0; column < 4; ++column) {
+        const float before = (*previousRows[row])[column];
+        (*outputRows[row])[column] =
+            before + ((*currentRows[row])[column] - before) * weight;
+      }
+    }
+    return true;
+  }
+
+  // Consecutive 60 Hz transforms stay in one hemisphere and within 90 degrees, so
+  // normalized lerp is stable and skips three transcendentals per matrix.
+  const float previousWeight = 1.0f - weight;
+  const float currentWeight = weight;
+  Quaternion interpolated{
+      pair.previousQuaternion.x * previousWeight + pair.currentQuaternion.x * currentWeight,
+      pair.previousQuaternion.y * previousWeight + pair.currentQuaternion.y * currentWeight,
+      pair.previousQuaternion.z * previousWeight + pair.currentQuaternion.z * currentWeight,
+      pair.previousQuaternion.w * previousWeight + pair.currentQuaternion.w * currentWeight,
+  };
+  const float quaternionLength = std::sqrt(interpolated.x * interpolated.x +
+                                           interpolated.y * interpolated.y +
+                                           interpolated.z * interpolated.z +
+                                           interpolated.w * interpolated.w);
+  if (!std::isfinite(quaternionLength) || quaternionLength < kMinimumScale) {
+    output = pair.current;
+    return false;
+  }
+  interpolated.x /= quaternionLength;
+  interpolated.y /= quaternionLength;
+  interpolated.z /= quaternionLength;
+  interpolated.w /= quaternionLength;
+
+  const auto interpolatedRotation = rotation_from_quaternion(interpolated);
+  std::array<float, 3> interpolatedScale{};
+  std::array<float, 3> interpolatedTranslation{};
+  for (size_t i = 0; i < 3; ++i) {
+    interpolatedScale[i] = pair.previousScale[i] +
+                           (pair.currentScale[i] - pair.previousScale[i]) * weight;
+    interpolatedTranslation[i] =
+        pair.previousTranslation[i] +
+        (pair.currentTranslation[i] - pair.previousTranslation[i]) * weight;
+  }
+  // Column scale mirrors decompose_affine: the reconstruction is R*S, with
+  // each scale component applied down its column.
+  output = {
+      {interpolatedRotation[0][0] * interpolatedScale[0],
+       interpolatedRotation[0][1] * interpolatedScale[1],
+       interpolatedRotation[0][2] * interpolatedScale[2], interpolatedTranslation[0]},
+      {interpolatedRotation[1][0] * interpolatedScale[0],
+       interpolatedRotation[1][1] * interpolatedScale[1],
+       interpolatedRotation[1][2] * interpolatedScale[2], interpolatedTranslation[1]},
+      {interpolatedRotation[2][0] * interpolatedScale[0],
+       interpolatedRotation[2][1] * interpolatedScale[1],
+       interpolatedRotation[2][2] * interpolatedScale[2], interpolatedTranslation[2]},
+  };
+  return true;
+}
+
+bool interpolate_affine_impl(const Mat3x4<float>& previous, const Mat3x4<float>& current,
+                             float weight, Mat3x4<float>& output) noexcept {
+  return evaluate_affine_pair(prepare_affine_pair(previous, current), weight, output);
+}
+
+Mat4x4<float> interpolate_projection(const Mat4x4<float>& previous, const Mat4x4<float>& current,
+                                     float weight) noexcept {
+  Mat4x4<float> result = current;
+  for (size_t row = 0; row < 4; ++row) {
+    for (size_t column = 0; column < 4; ++column) {
+      const float before = previous[row][column];
+      const float after = current[row][column];
+      if (std::isfinite(before) && std::isfinite(after)) {
+        result[row][column] = before + (after - before) * weight;
+      }
+    }
+  }
+  return result;
+}
+} // namespace
+
+bool interpolate_transform(const Mat3x4<float>& previous, const Mat3x4<float>& current,
+                           float weight, Mat3x4<float>& output) noexcept {
+  return interpolate_affine_impl(previous, current, std::clamp(weight, 0.0f, 1.0f), output);
+}
+
+bool interpolate_transform_midpoint(const Mat3x4<float>& previous, const Mat3x4<float>& current,
+                                    Mat3x4<float>& output) noexcept {
+  return interpolate_transform(previous, current, 0.5f, output);
+}
+
+bool interpolate_indexed_transform(const Mat3x4<float>& previous,
+                                   const Mat3x4<float>& current, float weight,
+                                   Mat3x4<float>& output) noexcept {
+  return evaluate_affine_pair(prepare_indexed_pair(previous, current),
+                              std::clamp(weight, 0.0f, 1.0f), output);
+}
+
+float transform_match_distance_squared(const Mat3x4<float>& previous,
+                                       const Mat3x4<float>& current) noexcept {
+  // Translation dominates in game units; the 3x3 part only breaks ties between
+  // repeated meshes at the same origin.
+  double distance = 0.0;
+  const std::array<Vec4<float>, 3> previousRows{previous.m0, previous.m1, previous.m2};
+  const std::array<Vec4<float>, 3> currentRows{current.m0, current.m1, current.m2};
+  for (size_t row = 0; row < 3; ++row) {
+    for (size_t column = 0; column < 4; ++column) {
+      const double before = previousRows[row][column];
+      const double after = currentRows[row][column];
+      if (!std::isfinite(before) || !std::isfinite(after)) {
+        return std::numeric_limits<float>::infinity();
+      }
+      const double delta = after - before;
+      distance += delta * delta;
+    }
+  }
+  if (!std::isfinite(distance) || distance > std::numeric_limits<float>::max()) {
+    return std::numeric_limits<float>::infinity();
+  }
+  return static_cast<float>(distance);
+}
+
+namespace {
+// Translation-only delta, matching the kMaximumTranslationPerFrame gate. Non-finite
+// inputs propagate NaN; callers compare with `<=` so NaN fails the gate.
+float translation_delta_squared(const Mat3x4<float>& previous,
+                                const Mat3x4<float>& current) noexcept {
+  const float dx = current.m0.w() - previous.m0.w();
+  const float dy = current.m1.w() - previous.m1.w();
+  const float dz = current.m2.w() - previous.m2.w();
+  return dx * dx + dy * dy + dz * dz;
+}
+
+// 2*current - previous. Not a valid rigid transform, but it is only a matching
+// reference and its one-frame error stays far below instance spacing.
+Mat3x4<float> extrapolate_transform(const Mat3x4<float>& previous,
+                                    const Mat3x4<float>& current) noexcept {
+  Mat3x4<float> predicted{};
+  const std::array<const Vec4<float>*, 3> previousRows{&previous.m0, &previous.m1, &previous.m2};
+  const std::array<const Vec4<float>*, 3> currentRows{&current.m0, &current.m1, &current.m2};
+  const std::array<Vec4<float>*, 3> predictedRows{&predicted.m0, &predicted.m1, &predicted.m2};
+  for (size_t row = 0; row < 3; ++row) {
+    for (size_t column = 0; column < 4; ++column) {
+      (*predictedRows[row])[column] =
+          2.0f * (*currentRows[row])[column] - (*previousRows[row])[column];
+    }
+  }
+  return predicted;
+}
+} // namespace
+
+float snapshot_match_distance_squared(const FrameTransformEntry& previousEntry,
+                                      const FrameTransformSnapshot& current) noexcept {
+  const FrameTransformSnapshot& previous = previousEntry.transform;
+  if (static_cast<bool>(previous.indexedMatrices) != static_cast<bool>(current.indexedMatrices)) {
+    return std::numeric_limits<float>::infinity();
+  }
+  if (!current.indexedMatrices) {
+    // Match against the predicted position, falling back to the last known one for
+    // entries with no motion history.
+    const Mat3x4<float>& reference =
+        previousEntry.hasPrediction ? previousEntry.predictedPosition : previous.position;
+    return transform_match_distance_squared(reference, current.position);
+  }
+
+  if (previous.usedMatrixMask == 0 || current.usedMatrixMask == 0) {
+    return std::numeric_limits<float>::infinity();
+  }
+
+  // PNMTXIDX is an absolute palette slot baked into the vertices, so nearest matching
+  // swaps joint histories. A changed mask has no safe correspondence: leave the draw.
+  if (previous.usedMatrixMask != current.usedMatrixMask) {
+    return std::numeric_limits<float>::infinity();
+  }
+
+  double distance = 0.0;
+  size_t matchedMatrices = 0;
+  for (size_t currentIndex = 0; currentIndex < MaxPnMtx; ++currentIndex) {
+    if ((current.usedMatrixMask & (1u << currentIndex)) == 0) {
+      continue;
+    }
+    const float matrixDistance = transform_match_distance_squared(
+        previous.indexedMatrices->position[currentIndex],
+        current.indexedMatrices->position[currentIndex]);
+    if (!std::isfinite(matrixDistance)) {
+      return std::numeric_limits<float>::infinity();
+    }
+    distance += matrixDistance;
+    ++matchedMatrices;
+  }
+  if (matchedMatrices == 0 || !std::isfinite(distance) ||
+      distance > std::numeric_limits<float>::max()) {
+    return std::numeric_limits<float>::infinity();
+  }
+  return static_cast<float>(distance / static_cast<double>(matchedMatrices));
+}
+
+void set_frame_interpolation_fps(uint32_t targetFps) noexcept {
+  if (targetFps != 120 && targetFps != 180 && targetFps != 240) {
+    targetFps = 0;
+  }
+  detail::g_frameInterpolationFps.store(targetFps, std::memory_order_release);
+  // Start at the configured quality; the controller only ever backs off from here.
+  s_interpolationSampleTarget.store(targetFps == 0 ? 0u : std::min(targetFps / 60 - 1, MaxInterpolatedFrames),
+                                    std::memory_order_release);
+  s_dropInterpolationAtSeal.store(false, std::memory_order_release);
+  s_pacingWindowFrames.store(0, std::memory_order_release);
+  s_pacingWindowMisses.store(0, std::memory_order_release);
+  // A reconfiguration starts a fresh diagnostic window.
+  s_diagFramesSealed.store(0, std::memory_order_relaxed);
+  s_diagFramesLowMatch.store(0, std::memory_order_relaxed);
+  s_diagFramesReplayUnsafe.store(0, std::memory_order_relaxed);
+  s_diagSlotReductions.store(0, std::memory_order_relaxed);
+  s_diagLateSealDrops.store(0, std::memory_order_relaxed);
+}
+
+void report_producer_paced(bool paced) noexcept {
+  const uint32_t maximumSamples = maximum_interpolation_samples();
+  if (maximumSamples == 0) {
+    s_dropInterpolationAtSeal.store(false, std::memory_order_release);
+    s_pacingWindowFrames.store(0, std::memory_order_release);
+    s_pacingWindowMisses.store(0, std::memory_order_release);
+    s_interpolationSampleTarget.store(0, std::memory_order_release);
+    return;
+  }
+
+  // Per-frame decision, no streaks: a late frame seals without its inserted slots and
+  // the next one is back at full count. See s_dropInterpolationAtSeal.
+  s_dropInterpolationAtSeal.store(!paced, std::memory_order_release);
+
+  const uint32_t frames = s_pacingWindowFrames.load(std::memory_order_acquire) + 1;
+  const uint32_t misses =
+      s_pacingWindowMisses.load(std::memory_order_acquire) + (paced ? 0u : 1u);
+  if (frames < kPacingWindowFrames) {
+    s_pacingWindowFrames.store(frames, std::memory_order_release);
+    s_pacingWindowMisses.store(misses, std::memory_order_release);
+    return;
+  }
+  // Window complete: adjust the target one step at most, then start over. At
+  // one decision per window this cannot spam the log or flap within a second.
+  uint32_t target =
+      std::min(s_interpolationSampleTarget.load(std::memory_order_acquire), maximumSamples);
+  if (misses * 100u >= frames * kPacingReducePercent) {
+    if (target > 0) {
+      --target;
+      s_diagSlotReductions.fetch_add(1, std::memory_order_relaxed);
+      Log.info("interpolation slots reduced to {}: {}/{} frames overran their retrace budget",
+               target, misses, frames);
+    }
+  } else if (misses * 100u <= frames * kPacingRestorePercent) {
+    if (target < maximumSamples) {
+      ++target;
+      Log.info("interpolation slots restored to {}: {}/{} frames overran their retrace budget",
+               target, misses, frames);
+    }
+  }
+  s_interpolationSampleTarget.store(target, std::memory_order_release);
+  s_pacingWindowFrames.store(0, std::memory_order_release);
+  s_pacingWindowMisses.store(0, std::memory_order_release);
+}
+
+void begin_frame_interpolation() noexcept {
+  const uint32_t targetFps = frame_interpolation_fps();
+  if (targetFps != s_previousInterpolationFps) {
+    recycle_transform_entries(s_previousFrameTransforms);
+    s_previousInterpolationFps = targetFps;
+  }
+  // Latch the slot count for the frame starting here; see s_activeInterpolationSamples
+  // for why it cannot move again until the seal.
+  s_activeInterpolationSamples.store(
+      std::min(s_interpolationSampleTarget.load(std::memory_order_acquire),
+               maximum_interpolation_samples()),
+      std::memory_order_release);
+  // Normally empty (finalize swapped and recycled); an aborted frame can leave
+  // entries behind, whose matrix blocks go back to the pool here.
+  recycle_transform_entries(s_currentFrameTransforms);
+  // Keep buckets, nodes and capacities across frames so a stable race scene does not
+  // pay thousands of small allocations every frame.
+  clear_index_map_keep_nodes(s_previousTransformIndices, s_previousFrameTransforms.size());
+  clear_index_map_keep_nodes(s_previousStableTransformIndices, s_previousFrameTransforms.size());
+  for (size_t i = 0; i < s_previousFrameTransforms.size(); ++i) {
+    const auto& identity = s_previousFrameTransforms[i].identity;
+    s_previousTransformIndices[identity.combined].push_back(i);
+    s_previousStableTransformIndices[stable_identity(identity)].push_back(i);
+  }
+  clear_index_map_keep_nodes(s_currentTransformIndices, s_previousFrameTransforms.size());
+  clear_index_map_keep_nodes(s_currentStableTransformIndices, s_previousFrameTransforms.size());
+  s_pendingUniformInterpolations.clear();
+  s_perspectiveCandidates = 0;
+  s_perspectiveMatchable = 0;
+  s_perspectiveMatches = 0;
+  s_hasInterpolatedFrame.store(false, std::memory_order_release);
+  s_frameInterpolationReplaySafe.store(true, std::memory_order_release);
+}
+
+void finalize_frame_interpolation() noexcept {
+  // A frame reported late seals without inserted slots, so the encode phase renders
+  // the native frame only. Its transforms still seed the next frame's matching.
+  if (s_dropInterpolationAtSeal.exchange(false, std::memory_order_acq_rel)) {
+    s_diagLateSealDrops.fetch_add(1, std::memory_order_relaxed);
+    s_hasInterpolatedFrame.store(false, std::memory_order_release);
+    s_pendingUniformInterpolations.clear();
+    retire_frame_transforms();
+    return;
+  }
+  // Below this bound a direct all-pairs build is cheaper than setting up the
+  // spatial grid; the produced edge set is identical either way.
+  constexpr size_t kAllPairsEdgeLimit = 1024;
+  // Bounds the all-pairs cost for indexed groups, which have no single translation to
+  // bucket on. Non-indexed groups of any size use the grid instead.
+  constexpr size_t kMaximumAssignmentEdges = 16384;
+  // Hard bound for the grid path; only a swarm co-located within one cell reaches it,
+  // which is the CPU-deformed shape the ordered fallback exists for.
+  constexpr size_t kMaximumGridEdges = 65536;
+
+  struct MatchEdge {
+    float distance = std::numeric_limits<float>::infinity();
+    size_t previous = SIZE_MAX;
+    size_t current = SIZE_MAX;
+  };
+
+  // Frame-persistent matching scratch: sized to the frame's draw count, so a
+  // stable scene performs no matching allocations at all after warm-up.
+  static std::vector<size_t> currentToPrevious;
+  static std::vector<uint8_t> previousMatched;
+  static std::vector<uint8_t> currentMatched;
+  static std::vector<size_t> groupCurrentIndices;
+  static std::vector<size_t> groupPreviousIndices;
+  static std::vector<MatchEdge> edges;
+  static std::unordered_map<uint64_t, std::vector<uint32_t>> gridCells;
+  currentToPrevious.assign(s_currentFrameTransforms.size(), SIZE_MAX);
+  previousMatched.assign(s_previousFrameTransforms.size(), 0);
+  currentMatched.assign(s_currentFrameTransforms.size(), 0);
+
+  // Quantizes a translation onto the matching grid. Cell size equals the gate distance,
+  // so every acceptable pair lies within one cell along every axis.
+  constexpr uint64_t kInvalidCell = std::numeric_limits<uint64_t>::max();
+  const auto translation_cell = [](const Mat3x4<float>& m) noexcept -> uint64_t {
+    const float x = m.m0.w();
+    const float y = m.m1.w();
+    const float z = m.m2.w();
+    if (!std::isfinite(x) || !std::isfinite(y) || !std::isfinite(z)) {
+      return kInvalidCell;
+    }
+    constexpr float kInverseCell = 1.0f / kMaximumTranslationPerFrame;
+    constexpr int64_t kBias = int64_t{1} << 20;
+    const int64_t cx = static_cast<int64_t>(std::floor(x * kInverseCell)) + kBias;
+    const int64_t cy = static_cast<int64_t>(std::floor(y * kInverseCell)) + kBias;
+    const int64_t cz = static_cast<int64_t>(std::floor(z * kInverseCell)) + kBias;
+    // One cell of margin at each field edge so the +-1 neighbor arithmetic cannot borrow
+    // into the next packed coordinate.
+    if (cx < 1 || cy < 1 || cz < 1 || cx >= (kBias << 1) - 1 || cy >= (kBias << 1) - 1 ||
+        cz >= (kBias << 1) - 1) {
+      return kInvalidCell;
+    }
+    return (static_cast<uint64_t>(cx) << 42) | (static_cast<uint64_t>(cy) << 21) |
+           static_cast<uint64_t>(cz);
+  };
+
+  const auto matchGroups =
+      [&](const auto& currentGroups, const auto& previousGroups,
+          bool allowOrderedFallback) {
+    for (const auto& [signature, allCurrentIndices] : currentGroups) {
+      if (allCurrentIndices.empty()) {
+        continue;
+      }
+      const auto previousIt = previousGroups.find(signature);
+      if (previousIt == previousGroups.end() || previousIt->second.empty()) {
+        continue;
+      }
+      groupCurrentIndices.clear();
+      groupPreviousIndices.clear();
+      for (const size_t index : allCurrentIndices) {
+        if (!currentMatched[index]) {
+          groupCurrentIndices.push_back(index);
+        }
+      }
+      for (const size_t index : previousIt->second) {
+        if (!previousMatched[index]) {
+          groupPreviousIndices.push_back(index);
+        }
+      }
+      if (groupCurrentIndices.empty() || groupPreviousIndices.empty()) {
+        continue;
+      }
+
+      // A unique draw has no identity ambiguity. Keep the conservative
+      // interpolation fallback for malformed/non-finite matrices.
+      if (groupPreviousIndices.size() == 1 && groupCurrentIndices.size() == 1) {
+        currentToPrevious[groupCurrentIndices.front()] = groupPreviousIndices.front();
+        previousMatched[groupPreviousIndices.front()] = 1;
+        currentMatched[groupCurrentIndices.front()] = 1;
+        continue;
+      }
+
+      // Drop pairs past the translation gate (`<=` also drops a NaN delta): they can only
+      // render as a snap, and matching them steals a neighbor's true partner.
+      const auto appendEdge = [&](size_t previousIndex, size_t currentIndex) {
+        const auto& previousEntry = s_previousFrameTransforms[previousIndex];
+        const auto& currentSnapshot = s_currentFrameTransforms[currentIndex].transform;
+        if (!previousEntry.transform.indexedMatrices && !currentSnapshot.indexedMatrices &&
+            !(translation_delta_squared(previousEntry.transform.position,
+                                        currentSnapshot.position) <=
+              kMaximumTranslationPerFrame * kMaximumTranslationPerFrame)) {
+          return;
+        }
+        const float distance = snapshot_match_distance_squared(previousEntry, currentSnapshot);
+        if (std::isfinite(distance)) {
+          edges.push_back({
+              .distance = distance,
+              .previous = previousIndex,
+              .current = currentIndex,
+          });
+        }
+      };
+
+      const auto orderedFallback = [&] {
+        // GX preserves submission order for these draws, so pair the leftovers in order
+        // once exact identities have claimed their instances.
+        if (!allowOrderedFallback) {
+          return;
+        }
+        const size_t pairCount = std::min(groupPreviousIndices.size(), groupCurrentIndices.size());
+        for (size_t i = 0; i < pairCount; ++i) {
+          // Submission order shifts when the transparent sort reorders or culling drops an
+          // instance; leave over-gate pairs unmatched so they snap instead of sweeping.
+          const auto& previousEntry = s_previousFrameTransforms[groupPreviousIndices[i]];
+          const auto& currentEntry = s_currentFrameTransforms[groupCurrentIndices[i]];
+          if (!previousEntry.transform.indexedMatrices &&
+              !currentEntry.transform.indexedMatrices &&
+              !(translation_delta_squared(previousEntry.transform.position,
+                                          currentEntry.transform.position) <=
+                kMaximumTranslationPerFrame * kMaximumTranslationPerFrame)) {
+            continue;
+          }
+          currentToPrevious[groupCurrentIndices[i]] = groupPreviousIndices[i];
+          previousMatched[groupPreviousIndices[i]] = 1;
+          currentMatched[groupCurrentIndices[i]] = 1;
+        }
+      };
+
+      edges.clear();
+      const size_t allPairsEdges = groupPreviousIndices.size() * groupCurrentIndices.size();
+      if (allPairsEdges <= kAllPairsEdgeLimit) {
+        for (const size_t currentIndex : groupCurrentIndices) {
+          for (const size_t previousIndex : groupPreviousIndices) {
+            appendEdge(previousIndex, currentIndex);
+          }
+        }
+      } else {
+        // Grid buckets need one translation per entry, which mixed or skinned groups lack,
+        // so those stay on the bounded all-pairs path.
+        bool gridable = true;
+        for (const size_t index : groupCurrentIndices) {
+          if (s_currentFrameTransforms[index].transform.indexedMatrices) {
+            gridable = false;
+            break;
+          }
+        }
+        if (gridable) {
+          for (const size_t index : groupPreviousIndices) {
+            if (s_previousFrameTransforms[index].transform.indexedMatrices) {
+              gridable = false;
+              break;
+            }
+          }
+        }
+        if (!gridable) {
+          if (groupPreviousIndices.size() > kMaximumAssignmentEdges / groupCurrentIndices.size()) {
+            orderedFallback();
+            continue;
+          }
+          for (const size_t currentIndex : groupCurrentIndices) {
+            for (const size_t previousIndex : groupPreviousIndices) {
+              appendEdge(previousIndex, currentIndex);
+            }
+          }
+        } else {
+          // Previous entries are matched against their predicted position, so bucket them by
+          // that same reference (see snapshot_match_distance_squared).
+          gridCells.clear();
+          for (const size_t previousIndex : groupPreviousIndices) {
+            const auto& previousEntry = s_previousFrameTransforms[previousIndex];
+            const Mat3x4<float>& reference = previousEntry.hasPrediction
+                                                 ? previousEntry.predictedPosition
+                                                 : previousEntry.transform.position;
+            const uint64_t cell = translation_cell(reference);
+            if (cell == kInvalidCell) {
+              continue;
+            }
+            gridCells[cell].push_back(static_cast<uint32_t>(previousIndex));
+          }
+          bool overflowed = false;
+          for (const size_t currentIndex : groupCurrentIndices) {
+            const auto& position = s_currentFrameTransforms[currentIndex].transform.position;
+            const uint64_t cell = translation_cell(position);
+            if (cell == kInvalidCell) {
+              continue;
+            }
+            for (int64_t dx = -1; dx <= 1 && !overflowed; ++dx) {
+              for (int64_t dy = -1; dy <= 1 && !overflowed; ++dy) {
+                for (int64_t dz = -1; dz <= 1 && !overflowed; ++dz) {
+                  const uint64_t neighbor = cell + (static_cast<uint64_t>(dx) << 42) +
+                                            (static_cast<uint64_t>(dy) << 21) +
+                                            static_cast<uint64_t>(dz);
+                  const auto cellIt = gridCells.find(neighbor);
+                  if (cellIt == gridCells.end()) {
+                    continue;
+                  }
+                  for (const uint32_t previousIndex : cellIt->second) {
+                    appendEdge(previousIndex, currentIndex);
+                    if (edges.size() > kMaximumGridEdges) {
+                      overflowed = true;
+                      break;
+                    }
+                  }
+                }
+              }
+            }
+            if (overflowed) {
+              break;
+            }
+          }
+          if (overflowed) {
+            orderedFallback();
+            continue;
+          }
+        }
+      }
+
+      std::sort(edges.begin(), edges.end(), [](const MatchEdge& lhs, const MatchEdge& rhs) {
+        return lhs.distance < rhs.distance;
+      });
+      for (const auto& edge : edges) {
+        if (previousMatched[edge.previous] || currentMatched[edge.current]) {
+          continue;
+        }
+        currentToPrevious[edge.current] = edge.previous;
+        previousMatched[edge.previous] = 1;
+        currentMatched[edge.current] = 1;
+      }
+    }
+  };
+  matchGroups(s_currentTransformIndices, s_previousTransformIndices, false);
+  matchGroups(s_currentStableTransformIndices, s_previousStableTransformIndices, true);
+
+  s_perspectiveMatches = static_cast<uint32_t>(std::count_if(
+      currentToPrevious.begin(), currentToPrevious.end(),
+      [](size_t previousIndex) { return previousIndex != SIZE_MAX; }));
+  // Interpolation never pauses on match quality: an unmatched draw just renders its
+  // end-frame state, while a ratio gate flapped the whole output cadence instead.
+  const bool eligible = frame_interpolation_fps() != 0;
+
+  // Overlay observability: the live match ratio, and how often the scene sits in
+  // low-match territory where inserted slots mostly duplicate draws.
+  {
+    constexpr uint32_t kLowMatchPercent = 55;
+    const bool replaySafe = frame_interpolation_replay_safe();
+    s_diagCandidates.store(s_perspectiveCandidates, std::memory_order_relaxed);
+    s_diagMatchable.store(s_perspectiveMatchable, std::memory_order_relaxed);
+    s_diagMatches.store(s_perspectiveMatches, std::memory_order_relaxed);
+    s_diagEligible.store(eligible, std::memory_order_relaxed);
+    s_diagReplaySafe.store(replaySafe, std::memory_order_relaxed);
+    if (eligible) {
+      s_diagFramesSealed.fetch_add(1, std::memory_order_relaxed);
+      if (s_perspectiveMatchable != 0 &&
+          s_perspectiveMatches * 100 < s_perspectiveMatchable * kLowMatchPercent) {
+        s_diagFramesLowMatch.fetch_add(1, std::memory_order_relaxed);
+      }
+      if (!replaySafe) {
+        s_diagFramesReplayUnsafe.fetch_add(1, std::memory_order_relaxed);
+      }
+    }
+  }
+
+  // Only ordinary one-matrix draws use motion prediction. Indexed draws keep the slot
+  // identity encoded by PNMTXIDX and are prepared as one coherent draw below.
+  constexpr float kMaximumPredictionSeedDeltaSquared =
+      kMaximumTranslationPerFrame * kMaximumTranslationPerFrame;
+  for (size_t currentIndex = 0; currentIndex < currentToPrevious.size(); ++currentIndex) {
+    const size_t previousIndex = currentToPrevious[currentIndex];
+    if (previousIndex == SIZE_MAX) {
+      continue;
+    }
+    auto& currentEntry = s_currentFrameTransforms[currentIndex];
+    const auto& previousEntry = s_previousFrameTransforms[previousIndex];
+    if (currentEntry.transform.indexedMatrices || previousEntry.transform.indexedMatrices) {
+      continue;
+    }
+    // Seed the next frame's matching with a constant-velocity reference, but never from
+    // a pair the interpolator would reject as a teleport (`<=` so NaN fails too).
+    if (translation_delta_squared(previousEntry.transform.position,
+                                  currentEntry.transform.position) <=
+        kMaximumPredictionSeedDeltaSquared) {
+      currentEntry.predictedPosition = extrapolate_transform(previousEntry.transform.position,
+                                                             currentEntry.transform.position);
+      currentEntry.hasPrediction = true;
+    }
+  }
+
+  if (eligible) {
+    // Prepare each matched pair once: every sample of a draw shares the same
+    // previous/current matrices. A flat vector keeps the sample tasks parallel.
+    std::vector<PreparedTransformInterpolation> preparedTransforms(s_currentFrameTransforms.size());
+    std::vector<uint8_t> preparedTransformState(s_currentFrameTransforms.size(), 0);
+    std::vector<PreparedAffinePair> preparedPairs;
+    preparedPairs.reserve(s_pendingUniformInterpolations.size() * 2);
+
+    const auto appendPreparedPair = [&](const Mat3x4<float>& previousPosition,
+                                        const Mat3x4<float>& currentPosition,
+                                        const Mat3x4<float>& previousNormal,
+                                        const Mat3x4<float>& currentNormal,
+                                        bool indexed) {
+      const size_t pairOffset = preparedPairs.size();
+      preparedPairs.push_back(indexed ? prepare_indexed_pair(previousPosition, currentPosition)
+                                      : prepare_affine_pair(previousPosition, currentPosition));
+      preparedPairs.push_back(indexed ? prepare_indexed_pair(previousNormal, currentNormal)
+                                      : prepare_affine_pair(previousNormal, currentNormal));
+      return pairOffset;
+    };
+
+    // Content-keyed palette pairing: a mesh split across draws repeats bone matrices byte
+    // for byte, so a chunk with no partner of its own can borrow a sibling's.
+    static std::vector<int32_t> paletteDrawIndex; // draw -> compact palette index
+    static std::vector<uint32_t> paletteDraws;    // compact palette index -> draw
+    paletteDrawIndex.assign(s_currentFrameTransforms.size(), -1);
+    paletteDraws.clear();
+    for (size_t drawIndex = 0; drawIndex < s_currentFrameTransforms.size(); ++drawIndex) {
+      const auto& transform = s_currentFrameTransforms[drawIndex].transform;
+      if (!transform.indexedMatrices || transform.usedMatrixMask == 0) {
+        continue;
+      }
+      paletteDrawIndex[drawIndex] = static_cast<int32_t>(paletteDraws.size());
+      paletteDraws.push_back(static_cast<uint32_t>(drawIndex));
+    }
+
+    struct PaletteSlotKey {
+      HashType hash = 0;
+      uint32_t palette = 0;
+      uint32_t slot = 0;
+    };
+    struct ResolvedSlot {
+      const Mat3x4<float>* position = nullptr;
+      const Mat3x4<float>* normal = nullptr;
+    };
+    static std::vector<PaletteSlotKey> paletteSlotKeys;
+    static std::vector<ResolvedSlot> resolvedSlots;
+    static std::vector<size_t> resolvedProjectionEntry;
+    paletteSlotKeys.clear();
+    resolvedSlots.assign(paletteDraws.size() * MaxPnMtx, ResolvedSlot{});
+    resolvedProjectionEntry.assign(paletteDraws.size(), kNoPreparedPair);
+
+    for (uint32_t palette = 0; palette < paletteDraws.size(); ++palette) {
+      const auto& transform = s_currentFrameTransforms[paletteDraws[palette]].transform;
+      for (uint32_t slot = 0; slot < MaxPnMtx; ++slot) {
+        if ((transform.usedMatrixMask & (1u << slot)) == 0) {
+          continue;
+        }
+        paletteSlotKeys.push_back({transform.indexedMatrices->slotHash[slot], palette, slot});
+      }
+    }
+    std::sort(paletteSlotKeys.begin(), paletteSlotKeys.end(),
+              [](const PaletteSlotKey& lhs, const PaletteSlotKey& rhs) {
+                if (lhs.hash != rhs.hash) {
+                  return lhs.hash < rhs.hash;
+                }
+                if (lhs.palette != rhs.palette) {
+                  return lhs.palette < rhs.palette;
+                }
+                return lhs.slot < rhs.slot;
+              });
+
+    for (size_t runStart = 0; runStart < paletteSlotKeys.size();) {
+      size_t runEnd = runStart + 1;
+      while (runEnd < paletteSlotKeys.size() &&
+             paletteSlotKeys[runEnd].hash == paletteSlotKeys[runStart].hash) {
+        ++runEnd;
+      }
+      // Where this matrix was last frame, per the draws that did match. Partners that
+      // disagree mean no single previous pose, so the coupled unit duplicates.
+      const Mat3x4<float>* sourcePosition = nullptr;
+      const Mat3x4<float>* sourceNormal = nullptr;
+      size_t sourceEntry = kNoPreparedPair;
+      HashType sourceHash = 0;
+      bool ambiguous = false;
+      for (size_t keyIndex = runStart; keyIndex < runEnd && !ambiguous; ++keyIndex) {
+        const uint32_t drawIndex = paletteDraws[paletteSlotKeys[keyIndex].palette];
+        const size_t previousIndex = currentToPrevious[drawIndex];
+        if (previousIndex >= s_previousFrameTransforms.size()) {
+          continue;
+        }
+        const auto& current = s_currentFrameTransforms[drawIndex].transform;
+        const auto& previous = s_previousFrameTransforms[previousIndex].transform;
+        // A slot index is an absolute palette address, which is why it pairs matched draws
+        // and why a changed layout invalidates every slot as a source.
+        if (!previous.indexedMatrices || previous.usedMatrixMask != current.usedMatrixMask) {
+          continue;
+        }
+        const uint32_t slot = paletteSlotKeys[keyIndex].slot;
+        const HashType candidateHash = previous.indexedMatrices->slotHash[slot];
+        if (sourcePosition == nullptr) {
+          sourcePosition = &previous.indexedMatrices->position[slot];
+          sourceNormal = &previous.indexedMatrices->normal[slot];
+          sourceHash = candidateHash;
+          sourceEntry = previousIndex;
+        } else if (candidateHash != sourceHash) {
+          ambiguous = true;
+        }
+      }
+      if (ambiguous || sourcePosition == nullptr) {
+        runStart = runEnd;
+        continue;
+      }
+      for (size_t keyIndex = runStart; keyIndex < runEnd; ++keyIndex) {
+        const auto& key = paletteSlotKeys[keyIndex];
+        resolvedSlots[static_cast<size_t>(key.palette) * MaxPnMtx + key.slot] = {sourcePosition,
+                                                                                sourceNormal};
+        if (resolvedProjectionEntry[key.palette] == kNoPreparedPair) {
+          resolvedProjectionEntry[key.palette] = sourceEntry;
+        }
+      }
+      runStart = runEnd;
+    }
+
+    for (const auto& task : s_pendingUniformInterpolations) {
+      if (task.currentTransformIndex >= preparedTransformState.size() ||
+          preparedTransformState[task.currentTransformIndex] != 0) {
+        continue;
+      }
+      preparedTransformState[task.currentTransformIndex] = 1;
+
+      const auto& current = s_currentFrameTransforms[task.currentTransformIndex].transform;
+      auto& prepared = preparedTransforms[task.currentTransformIndex];
+      if (task.indexedMatrices) {
+        const int32_t palette = paletteDrawIndex[task.currentTransformIndex];
+        if (palette < 0) {
+          continue;
+        }
+        prepared.previousProjectionEntry = resolvedProjectionEntry[palette];
+        // A palette is one deformation unit: interpolating only the resolved slots cracks
+        // the mesh, so any unresolved slot duplicates the whole current draw.
+        bool allSlotsValid = true;
+        for (size_t slot = 0; slot < MaxPnMtx; ++slot) {
+          if ((current.usedMatrixMask & (1u << slot)) == 0) {
+            continue;
+          }
+          const auto& resolved = resolvedSlots[static_cast<size_t>(palette) * MaxPnMtx + slot];
+          if (resolved.position == nullptr) {
+            allSlotsValid = false;
+            break;
+          }
+          const size_t pairOffset =
+              appendPreparedPair(*resolved.position, current.indexedMatrices->position[slot],
+                                 *resolved.normal, current.indexedMatrices->normal[slot], true);
+          prepared.indexedPairOffsets[slot] = pairOffset;
+          if (!preparedPairs[pairOffset].valid || !preparedPairs[pairOffset + 1].valid) {
+            allSlotsValid = false;
+            break;
+          }
+        }
+        prepared.indexedValid = allSlotsValid;
+      } else {
+        const size_t previousTransformIndex = currentToPrevious[task.currentTransformIndex];
+        if (previousTransformIndex >= s_previousFrameTransforms.size()) {
+          continue;
+        }
+        const auto& previous = s_previousFrameTransforms[previousTransformIndex].transform;
+        prepared.previousProjectionEntry = previousTransformIndex;
+        prepared.nonIndexedPairOffset = appendPreparedPair(
+            previous.position, current.position, previous.normal, current.normal, false);
+      }
+    }
+
+    const auto interpolatePendingUniform = [&](const auto& task) {
+      if (task.currentTransformIndex >= s_currentFrameTransforms.size()) {
+        return;
+      }
+
+      const auto& current = s_currentFrameTransforms[task.currentTransformIndex].transform;
+      std::memcpy(task.uniformData, task.sourceUniformData, task.uniformSize);
+      const auto& prepared = preparedTransforms[task.currentTransformIndex];
+      if (task.indexedMatrices && !prepared.indexedValid) {
+        return;
+      }
+      // The projection comes from whichever previous entry supplied the transforms, which
+      // for a borrowed palette is a sibling's partner.
+      const size_t previousTransformIndex = prepared.previousProjectionEntry;
+      if (previousTransformIndex >= s_previousFrameTransforms.size()) {
+        return;
+      }
+      const auto& previous = s_previousFrameTransforms[previousTransformIndex].transform;
+      const float weight =
+          static_cast<float>(task.numerator) / static_cast<float>(task.denominator);
+      const auto interpolatedProjection =
+          interpolate_projection(previous.projection, current.projection, weight);
+      std::memcpy(task.uniformData + task.projectionOffset, &interpolatedProjection,
+                  sizeof(interpolatedProjection));
+
+      const auto interpolateMatrixSlot = [&](size_t currentIndex, size_t pairOffset) {
+        if (pairOffset == kNoPreparedPair) {
+          return;
+        }
+        Mat3x4<float> interpolatedPosition{};
+        Mat3x4<float> interpolatedNormal{};
+        evaluate_affine_pair(preparedPairs[pairOffset], weight, interpolatedPosition);
+        evaluate_affine_pair(preparedPairs[pairOffset + 1], weight, interpolatedNormal);
+        std::memcpy(task.uniformData + task.positionOffset + currentIndex * sizeof(Mat3x4<float>),
+                    &interpolatedPosition, sizeof(interpolatedPosition));
+        std::memcpy(task.uniformData + task.normalOffset + currentIndex * sizeof(Mat3x4<float>),
+                    &interpolatedNormal, sizeof(interpolatedNormal));
+      };
+      if (task.indexedMatrices) {
+        if (!current.indexedMatrices) {
+          return;
+        }
+        for (size_t currentIndex = 0; currentIndex < MaxPnMtx; ++currentIndex) {
+          if ((current.usedMatrixMask & (1u << currentIndex)) == 0) {
+            continue;
+          }
+          interpolateMatrixSlot(currentIndex, prepared.indexedPairOffsets[currentIndex]);
+        }
+      } else {
+        interpolateMatrixSlot(task.currentMatrix, prepared.nonIndexedPairOffset);
+      }
+    };
+    // A handful of tasks costs more to schedule than to run. The pool stands in for
+    // std::execution::par, which libc++ does not provide at all.
+    constexpr size_t kMinimumParallelInterpolationTasks = 64;
+    if (s_pendingUniformInterpolations.size() < kMinimumParallelInterpolationTasks) {
+      std::for_each(s_pendingUniformInterpolations.begin(), s_pendingUniformInterpolations.end(),
+                    interpolatePendingUniform);
+    } else {
+      InterpolationWorkerPool::instance().run(
+          s_pendingUniformInterpolations.size(),
+          [&](size_t index) { interpolatePendingUniform(s_pendingUniformInterpolations[index]); });
+    }
+  }
+  s_hasInterpolatedFrame.store(eligible, std::memory_order_release);
+  s_pendingUniformInterpolations.clear();
+  // The index maps are emptied node-preservingly by the next
+  // begin_frame_interpolation.
+  retire_frame_transforms();
+}
+
+void get_frame_interpolation_diagnostics(AuroraFrameInterpolationDiagnostics& diagnostics) noexcept {
+  diagnostics.targetFps = frame_interpolation_fps();
+  diagnostics.targetSamples = std::min(s_interpolationSampleTarget.load(std::memory_order_acquire),
+                                       maximum_interpolation_samples());
+  diagnostics.activeSamples = s_activeInterpolationSamples.load(std::memory_order_acquire);
+  diagnostics.candidates = s_diagCandidates.load(std::memory_order_relaxed);
+  diagnostics.matchable = s_diagMatchable.load(std::memory_order_relaxed);
+  diagnostics.matches = s_diagMatches.load(std::memory_order_relaxed);
+  diagnostics.eligible = s_diagEligible.load(std::memory_order_relaxed) ? 1 : 0;
+  diagnostics.replaySafe = s_diagReplaySafe.load(std::memory_order_relaxed) ? 1 : 0;
+  diagnostics.framesSealed = s_diagFramesSealed.load(std::memory_order_relaxed);
+  diagnostics.framesLowMatch = s_diagFramesLowMatch.load(std::memory_order_relaxed);
+  diagnostics.framesReplayUnsafe = s_diagFramesReplayUnsafe.load(std::memory_order_relaxed);
+  diagnostics.slotReductions = s_diagSlotReductions.load(std::memory_order_relaxed);
+  diagnostics.lateSealDrops = s_diagLateSealDrops.load(std::memory_order_relaxed);
+}
+
+bool has_interpolated_frame() noexcept {
+  return s_hasInterpolatedFrame.load(std::memory_order_acquire);
+}
+
+uint32_t interpolated_frame_count() noexcept {
+  if (!has_interpolated_frame()) {
+    return 0;
+  }
+  // The count latched when this frame began recording, not the configured maximum:
+  // build_uniform staged exactly this many ranges for every draw.
+  return s_activeInterpolationSamples.load(std::memory_order_acquire);
+}
+
+void drop_pending_frame_interpolation_uniforms() noexcept {
+  // Pending tasks hold raw pointers into the mapped uniform staging range, so anything
+  // that unmaps or rotates that buffer first has to drop the tasks.
+  s_pendingUniformInterpolations.clear();
+}
+
+void mark_frame_interpolation_replay_unsafe() noexcept {
+  s_frameInterpolationReplaySafe.store(false, std::memory_order_release);
+  // Marking the frame unsafe rotates the staging buffer mid-frame, and the seal then
+  // duplicates slots instead of replaying, so drop the copies staged so far.
+  drop_pending_frame_interpolation_uniforms();
+}
+
+bool frame_interpolation_replay_safe() noexcept {
+  return s_frameInterpolationReplaySafe.load(std::memory_order_acquire);
+}
+
+void extend_interpolation_draw(uint16_t usedPnMtxMask) noexcept {
+  if (s_currentFrameTransforms.empty()) {
+    return;
+  }
+  auto& snapshot = s_currentFrameTransforms.back().transform;
+  if (!snapshot.indexedMatrices) {
+    // One-matrix draws all read the current matrix index, which a merge cannot
+    // have changed either.
+    return;
+  }
+  const uint16_t addedSlots = static_cast<uint16_t>(usedPnMtxMask & ~snapshot.usedMatrixMask);
+  if (addedSlots == 0) {
+    return;
+  }
+  for (size_t slot = 0; slot < MaxPnMtx; ++slot) {
+    if ((addedSlots & (1u << slot)) == 0) {
+      continue;
+    }
+    snapshot.indexedMatrices->position[slot] = g_gxState.pnMtx[slot].pos;
+    snapshot.indexedMatrices->normal[slot] = g_gxState.pnMtx[slot].nrm;
+    snapshot.indexedMatrices->slotHash[slot] =
+        xxh3_hash_s(&g_gxState.pnMtx[slot].pos, sizeof(Mat3x4<float>),
+                    xxh3_hash_s(&g_gxState.pnMtx[slot].nrm, sizeof(Mat3x4<float>)));
+  }
+  snapshot.usedMatrixMask |= addedSlots;
+}
+
+std::array<gfx::Range, MaxInterpolatedFrames> record_interpolation_draw(
+    const FrameInterpolationDrawIdentity& identity, const Mat4x4<float>& projection,
+    uint16_t usedPnMtxMask, const InterpolatedUniformLayout& uniformLayout) noexcept {
+  FrameTransformSnapshot snapshot{
+      .projection = projection,
+      .usedMatrixMask = usedPnMtxMask,
+  };
+  if (uniformLayout.indexedMatrices) {
+    snapshot.indexedMatrices = acquire_indexed_matrices();
+    // Only the used slots are copied; consumers mask with usedMatrixMask, so the stale
+    // pool contents of unused slots are never read.
+    for (size_t i = 0; i < MaxPnMtx; ++i) {
+      if ((usedPnMtxMask & (1u << i)) == 0) {
+        continue;
+      }
+      snapshot.indexedMatrices->position[i] = g_gxState.pnMtx[i].pos;
+      snapshot.indexedMatrices->normal[i] = g_gxState.pnMtx[i].nrm;
+      snapshot.indexedMatrices->slotHash[i] =
+          xxh3_hash_s(&g_gxState.pnMtx[i].pos, sizeof(Mat3x4<float>),
+                      xxh3_hash_s(&g_gxState.pnMtx[i].nrm, sizeof(Mat3x4<float>)));
+    }
+  } else {
+    const size_t currentMatrix = std::min<size_t>(g_gxState.currentPnMtx, MaxPnMtx - 1);
+    snapshot.position = g_gxState.pnMtx[currentMatrix].pos;
+    snapshot.normal = g_gxState.pnMtx[currentMatrix].nrm;
+  }
+
+  const size_t currentTransformIndex = s_currentFrameTransforms.size();
+  s_currentFrameTransforms.emplace_back(FrameTransformEntry{
+      .identity = identity,
+      .transform = std::move(snapshot),
+  });
+  s_currentTransformIndices[identity.combined].push_back(currentTransformIndex);
+  const HashType stableIdentity = stable_identity(identity);
+  s_currentStableTransformIndices[stableIdentity].push_back(currentTransformIndex);
+
+  std::array<gfx::Range, MaxInterpolatedFrames> interpolatedRanges{};
+  ++s_perspectiveCandidates;
+  const auto exactPrevious = s_previousTransformIndices.find(identity.combined);
+  const auto stablePrevious = s_previousStableTransformIndices.find(stableIdentity);
+  const bool hasPreviousPartner =
+      (exactPrevious != s_previousTransformIndices.end() && !exactPrevious->second.empty()) ||
+      (stablePrevious != s_previousStableTransformIndices.end() && !stablePrevious->second.empty());
+  if (hasPreviousPartner) {
+    ++s_perspectiveMatchable;
+  }
+  // A skinned draw with no identity partner can still borrow sibling transforms at
+  // seal time, so stage copies whenever the previous frame held any palette.
+  const bool stageInterpolation =
+      hasPreviousPartner ||
+      (uniformLayout.indexedMatrices && s_previousFrameHasIndexedMatrices);
+  // A frame already split by a submitted prefix duplicates its slots instead of
+  // replaying, so staging copies for the resumed suffix would only waste space.
+  if (frame_interpolation_replay_safe() && stageInterpolation) {
+    const uint32_t sampleCount = s_activeInterpolationSamples.load(std::memory_order_acquire);
+    for (uint32_t sample = 0; sample < sampleCount; ++sample) {
+      auto [interpolatedBuffer, interpolatedRange] = gfx::map_uniform(uniformLayout.uniformSize);
+      s_pendingUniformInterpolations.push_back({
+          .currentTransformIndex = currentTransformIndex,
+          .sourceUniformData = uniformLayout.sourceUniformData,
+          .uniformData = interpolatedBuffer.data(),
+          .uniformSize = uniformLayout.uniformSize,
+          .projectionOffset = uniformLayout.projectionOffset,
+          .positionOffset = uniformLayout.positionOffset,
+          .normalOffset = uniformLayout.normalOffset,
+          .currentMatrix = uniformLayout.currentMatrix,
+          .numerator = sample + 1,
+          .denominator = sampleCount + 1,
+          .indexedMatrices = uniformLayout.indexedMatrices,
+      });
+      interpolatedRanges[sample] = interpolatedRange;
+    }
+  }
+  return interpolatedRanges;
+}
+} // namespace aurora::gx
diff --git a/aurora-main/lib/gx/frame_interpolation.hpp b/aurora-main/lib/gx/frame_interpolation.hpp
new file mode 100644
index 0000000..b38ffed
--- /dev/null
+++ b/aurora-main/lib/gx/frame_interpolation.hpp
@@ -0,0 +1,89 @@
+#pragma once
+
+#include "gx.hpp"
+
+#include "aurora/gfx.h"
+
+#include <atomic>
+
+// Frame interpolation: generates intermediate presentation frames between two consecutive 60 Hz
+// guest frames by re-staging each perspective draw's uniform block with interpolated transforms.
+namespace aurora::gx {
+constexpr uint32_t MaxInterpolatedFrames = 3;
+
+// Identifies a draw across frames. `combined` includes the geometry signature and is exact, while
+// `pipeline`/`texture` is the material-only fallback for meshes whose vertex data changes.
+struct FrameInterpolationDrawIdentity {
+  HashType combined = 0;
+  HashType pipeline = 0;
+  HashType texture = 0;
+  // Hash of the per-vertex PNMTXIDX stream. Matrix values animate, but this topology decides which
+  // absolute palette slot each vertex reads, so it must match across a pair.
+  HashType matrixTopology = 0;
+};
+
+// Where the transforms live inside a draw's staged uniform block. Offsets are
+// relative to the start of the mapped range.
+struct InterpolatedUniformLayout {
+  const uint8_t* sourceUniformData = nullptr;
+  size_t uniformSize = 0;
+  size_t projectionOffset = 0;
+  size_t positionOffset = 0;
+  size_t normalOffset = 0;
+  // Slot the live matrix occupies; a compacted position region holds it at 0.
+  size_t currentMatrix = 0;
+  bool indexedMatrices = false;
+};
+
+namespace detail {
+// Defined in frame_interpolation.cpp, exposed so the early-outs below stay inline: the shipped
+// build compiles shards without LTO, so a cross-TU call would land on every draw in the frame.
+extern std::atomic_uint32_t g_frameInterpolationFps;
+} // namespace detail
+
+// 0 when interpolation is disabled; otherwise the configured target (120/180/240).
+inline uint32_t frame_interpolation_fps() noexcept {
+  return detail::g_frameInterpolationFps.load(std::memory_order_acquire);
+}
+inline bool frame_interpolation_active() noexcept { return frame_interpolation_fps() != 0; }
+
+void set_frame_interpolation_fps(uint32_t targetFps) noexcept;
+
+// Feedback for the adaptive slot controller: whether the producer met its
+// retrace boundary for the frame that just presented.
+void report_producer_paced(bool paced) noexcept;
+
+void begin_frame_interpolation() noexcept;
+void finalize_frame_interpolation() noexcept;
+// Fills the observability snapshot behind aurora_get_frame_interpolation_diagnostics.
+void get_frame_interpolation_diagnostics(AuroraFrameInterpolationDiagnostics& diagnostics) noexcept;
+bool has_interpolated_frame() noexcept;
+uint32_t interpolated_frame_count() noexcept;
+void mark_frame_interpolation_replay_unsafe() noexcept;
+// Drops the interpolation tasks staged into the currently mapped uniform range. Required of
+// anything that unmaps or rotates that range before the frame is finalized.
+void drop_pending_frame_interpolation_uniforms() noexcept;
+bool frame_interpolation_replay_safe() noexcept;
+
+// Records one perspective draw and maps its intermediate uniform copies, returning the mapped
+// range per slot (empty when the draw has no counterpart). Called by build_uniform.
+std::array<gfx::Range, MaxInterpolatedFrames> record_interpolation_draw(
+    const FrameInterpolationDrawIdentity& identity, const Mat4x4<float>& projection,
+    uint16_t usedPnMtxMask, const InterpolatedUniformLayout& uniformLayout) noexcept;
+
+// Folds a merged draw back into the snapshot of the draw it joined. aurora renders merged
+// primitives through the first one's uniform block, so without this the merged-in bones tear.
+void extend_interpolation_draw(uint16_t usedPnMtxMask) noexcept;
+
+bool interpolate_transform(const Mat3x4<float>& previous, const Mat3x4<float>& current,
+                           float weight, Mat3x4<float>& output) noexcept;
+bool interpolate_transform_midpoint(const Mat3x4<float>& previous, const Mat3x4<float>& current,
+                                    Mat3x4<float>& output) noexcept;
+// Matrix palettes are already-composed skinning transforms, so interpolating their coefficients
+// keeps shared boundaries intact. Ordinary one-matrix draws keep the rigid TRS path above.
+bool interpolate_indexed_transform(const Mat3x4<float>& previous,
+                                   const Mat3x4<float>& current, float weight,
+                                   Mat3x4<float>& output) noexcept;
+float transform_match_distance_squared(const Mat3x4<float>& previous,
+                                       const Mat3x4<float>& current) noexcept;
+} // namespace aurora::gx
diff --git a/aurora-main/lib/gx/gx.cpp b/aurora-main/lib/gx/gx.cpp
new file mode 100644
index 0000000..bf9d696
--- /dev/null
+++ b/aurora-main/lib/gx/gx.cpp
@@ -0,0 +1,2149 @@
+#include "gx.hpp"
+
+#include "pipeline.hpp"
+#include "texture_bind_group_cache_key.hpp"
+#include "../dolphin/vi/vi_internal.hpp"
+#include "../webgpu/gpu.hpp"
+#include "../internal.hpp"
+#include "../gfx/common.hpp"
+#include "../gfx/tex_palette_conv.hpp"
+#include "../gfx/texture.hpp"
+#include "../gfx/texture_convert.hpp"
+#include "../gfx/texture_replacement.hpp"
+#include "gx_fmt.hpp"
+
+#include <absl/container/flat_hash_map.h>
+#include <absl/container/flat_hash_set.h>
+#include <tracy/Tracy.hpp>
+
+#include <algorithm>
+#include <cfloat>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <mutex>
+#include <optional>
+#include <utility>
+#include <vector>
+
+static aurora::Module Log("aurora::gx");
+
+namespace aurora::gx {
+using webgpu::g_device;
+using webgpu::g_graphicsConfig;
+
+namespace {
+
+
+
+
+
+
+} // namespace
+
+static GXState make_default_gx_state() {
+  GXState state{};
+  for (size_t i = 0; i < state.tcgs.size(); ++i) {
+    state.tcgs[i].src = static_cast<GXTexGenSrc>(GX_TG_TEX0 + i);
+  }
+  return state;
+}
+
+GXState g_gxState = make_default_gx_state();
+
+static wgpu::Sampler sEmptySampler;
+static wgpu::Texture sEmptyTexture;
+static wgpu::TextureView sEmptyTextureView;
+static std::mutex sBindGroupLayoutMutex;
+static absl::flat_hash_map<u32, wgpu::BindGroupLayout> sUniformBindGroupLayouts;
+static absl::flat_hash_map<u32, std::pair<wgpu::BindGroupLayout, wgpu::BindGroupLayout>> sTextureBindGroupLayouts;
+static wgpu::BindGroupLayout sTextureBindGroupLayout;
+static wgpu::BindGroupLayout sSamplerBindGroupLayout;
+static wgpu::PipelineLayout sPipelineLayout;
+wgpu::BindGroup g_emptyTextureBindGroup;
+static u64 s_copyTextureStateRevision = 1;
+static u64 s_staticTextureCacheValidationRevision = 1;
+
+// GXInvalidateTexAll means "the guest may have rewritten texture memory, so re-check anything cached from it before trusting it again".
+static u64 s_textureCacheStamps = 0;
+
+// Marks a cache artifact as reusable at the current validation revision.
+static inline void note_texture_cache_stamp() noexcept { ++s_textureCacheStamps; }
+
+static std::array<u64, MaxTextures> s_lastNoCopyResolveRevision{};
+static void mark_copy_texture_cache_changed() noexcept;
+static size_t static_texture_source_cache_size() noexcept;
+static size_t static_palette_texture_source_cache_size() noexcept;
+static size_t texture_object_cache_size() noexcept;
+
+struct TextureResolveIdentity {
+  const void* data = nullptr;
+  u32 mode0 = 0;
+  u32 mode1 = 0;
+  u32 image0 = 0;
+  u32 image3 = 0;
+  u32 width = 0;
+  u32 height = 0;
+  u32 format = 0;
+  GXTlut tlut = GX_TLUT0;
+  u32 texObjId = 0;
+  u32 texDataVersion = 0;
+  u8 flags = 0;
+
+  bool operator==(const TextureResolveIdentity& rhs) const = default;
+  template <typename H>
+  friend H AbslHashValue(H h, const TextureResolveIdentity& identity) {
+    return H::combine(std::move(h), identity.data, identity.mode0, identity.mode1, identity.image0,
+                      identity.image3, identity.width, identity.height, identity.format, identity.tlut,
+                      identity.texObjId, identity.texDataVersion, identity.flags);
+  }
+};
+static std::array<TextureResolveIdentity, MaxTextures> s_lastTextureResolveIdentity{};
+static std::array<bool, MaxTextures> s_lastTextureResolveIdentityValid{};
+
+struct TextureResolveIdentityCacheEntry {
+  bool valid = false;
+  size_t hash = 0;
+  u64 copyTextureRevision = 0;
+  // Revision this binding was last proved good at.
+  u64 validationRevision = 0;
+  TextureResolveIdentity identity{};
+  gfx::TextureBind binding{};
+};
+
+// ponytail: A fixed direct-mapped cache avoids allocator/hash-table overhead.
+static std::array<TextureResolveIdentityCacheEntry, 2048> s_textureResolveIdentityCache{};
+
+static TextureResolveIdentity make_texture_resolve_identity(const GXTexObj_& obj) noexcept {
+  return {
+      .data = obj.data,
+      .mode0 = obj.mode0,
+      .mode1 = obj.mode1,
+      .image0 = obj.image0,
+      .image3 = obj.image3,
+      .width = obj.width(),
+      .height = obj.height(),
+      .format = obj.format(),
+      .tlut = obj.tlut,
+      .texObjId = obj.texObjId,
+      .texDataVersion = obj.texDataVersion,
+      .flags = obj.flags,
+  };
+}
+
+namespace {
+struct DynamicPaletteKey {
+  const void* sourceIdentity = nullptr;
+  u32 width = 0;
+  u32 height = 0;
+  u32 format = 0;
+
+  bool operator==(const DynamicPaletteKey& rhs) const = default;
+  template <typename H>
+  friend H AbslHashValue(H h, const DynamicPaletteKey& key) {
+    return H::combine(std::move(h), key.sourceIdentity, key.width, key.height, key.format);
+  }
+};
+
+struct DynamicPaletteEntry {
+  gfx::TextureHandle handle;
+  u32 sourceRevision = 0;
+  u32 tlutDataVersion = 0;
+};
+
+struct CachedTextureEntry {
+  gfx::TextureHandle handle;
+  u32 texDataVersion = 0;
+  u32 tlutObjId = 0;
+  u32 tlutDataVersion = 0;
+  // Revision the underlying source bytes were last proved good at.
+  u64 validationRevision = 0;
+};
+
+struct StaticTextureKey {
+  const void* data = nullptr;
+  u32 width = 0;
+  u32 height = 0;
+  u32 mips = 0;
+  u32 format = 0;
+  u32 texDataVersion = 0;
+
+  bool operator==(const StaticTextureKey& rhs) const = default;
+  template <typename H>
+  friend H AbslHashValue(H h, const StaticTextureKey& key) {
+    return H::combine(std::move(h), key.data, key.width, key.height, key.mips, key.format, key.texDataVersion);
+  }
+};
+
+static std::array<StaticTextureKey, MaxTextures> s_lastStaticSourceResolveKey{};
+static std::array<bool, MaxTextures> s_lastStaticSourceResolveKeyValid{};
+static std::array<u64, MaxTextures> s_lastStaticSourceNoCopyRevision{};
+
+struct StaticPaletteTextureKey {
+  StaticTextureKey texture;
+  const void* tlutData = nullptr;
+  u32 tlutFormat = 0;
+  u32 tlutEntries = 0;
+  u32 tlutDataVersion = 0;
+
+  bool operator==(const StaticPaletteTextureKey& rhs) const = default;
+  template <typename H>
+  friend H AbslHashValue(H h, const StaticPaletteTextureKey& key) {
+    return H::combine(std::move(h), key.texture, key.tlutData, key.tlutFormat, key.tlutEntries, key.tlutDataVersion);
+  }
+};
+
+// Revalidation used to keep a full byte-for-byte copy of every cached source and memcmp against it.
+struct StaticTextureSourceEntry {
+  gfx::TextureHandle handle;
+  u64 digest = 0;
+  u32 sourceSize = 0;
+  u64 validationRevision = 0;
+  u64 sourceGeneration = kGuestWriteUntracked;
+};
+
+struct StaticPaletteTextureSourceEntry {
+  gfx::TextureHandle handle;
+  u64 textureDigest = 0;
+  u64 tlutDigest = 0;
+  u32 textureSize = 0;
+  u32 tlutSize = 0;
+  u64 validationRevision = 0;
+  u64 textureGeneration = kGuestWriteUntracked;
+  u64 tlutGeneration = kGuestWriteUntracked;
+};
+
+struct CachedTlutTextureEntry {
+  gfx::TextureHandle handle;
+  u32 tlutDataVersion = 0;
+  u64 digest = 0;
+  u64 validationRevision = 0;
+  u64 generation = kGuestWriteUntracked;
+};
+
+struct TlutObjectCache {
+  CachedTlutTextureEntry tlutTexture;
+  absl::flat_hash_map<DynamicPaletteKey, DynamicPaletteEntry> dynamicPaletteTextures;
+  absl::flat_hash_set<u32> staticTextureUsers;
+};
+
+absl::flat_hash_map<u32, CachedTextureEntry> s_textureObjectCaches;
+absl::flat_hash_map<u32, TlutObjectCache> s_tlutObjectCaches;
+absl::flat_hash_map<StaticTextureKey, StaticTextureSourceEntry> s_staticTextureSourceCache;
+absl::flat_hash_map<StaticPaletteTextureKey, StaticPaletteTextureSourceEntry> s_staticPaletteTextureSourceCache;
+absl::flat_hash_map<u32, StaticTextureKey> s_texObjSourceKeys;
+absl::flat_hash_map<u32, StaticPaletteTextureKey> s_texObjPaletteSourceKeys;
+
+// A repeated bind of the same texture object re-derives the same source key and re-stores it into the map above on every resolve.
+template <typename Key>
+struct TexObjSourceKeyMemo {
+  struct Slot {
+    u32 texObjId = 0;
+    Key key{};
+  };
+  std::array<Slot, 8> slots{};
+
+  [[nodiscard]] bool matches(u32 texObjId, const Key& key) const {
+    const auto& slot = slots[texObjId & (slots.size() - 1)];
+    return slot.texObjId == texObjId && slot.key == key;
+  }
+  void store(u32 texObjId, const Key& key) {
+    auto& slot = slots[texObjId & (slots.size() - 1)];
+    slot.texObjId = texObjId;
+    slot.key = key;
+  }
+  void forget(u32 texObjId) {
+    auto& slot = slots[texObjId & (slots.size() - 1)];
+    if (slot.texObjId == texObjId) {
+      slot.texObjId = 0;
+    }
+  }
+  void reset() {
+    for (auto& slot : slots) {
+      slot.texObjId = 0;
+    }
+  }
+};
+
+TexObjSourceKeyMemo<StaticTextureKey> s_texObjSourceKeyMemo;
+TexObjSourceKeyMemo<StaticPaletteTextureKey> s_texObjPaletteSourceKeyMemo;
+
+void record_tex_obj_source_key(u32 texObjId, const StaticTextureKey& key) noexcept {
+  if (s_texObjSourceKeyMemo.matches(texObjId, key)) {
+    return;
+  }
+  s_texObjSourceKeys[texObjId] = key;
+  s_texObjSourceKeyMemo.store(texObjId, key);
+}
+
+void record_tex_obj_palette_source_key(u32 texObjId, const StaticPaletteTextureKey& key) noexcept {
+  if (s_texObjPaletteSourceKeyMemo.matches(texObjId, key)) {
+    return;
+  }
+  s_texObjPaletteSourceKeys[texObjId] = key;
+  s_texObjPaletteSourceKeyMemo.store(texObjId, key);
+}
+
+} // namespace
+
+static size_t static_texture_source_cache_size() noexcept { return s_staticTextureSourceCache.size(); }
+static size_t static_palette_texture_source_cache_size() noexcept { return s_staticPaletteTextureSourceCache.size(); }
+static size_t texture_object_cache_size() noexcept { return s_textureObjectCaches.size(); }
+
+namespace {
+
+struct StaticSourceFrontCacheEntry {
+  bool valid = false;
+  size_t hash = 0;
+  u64 validationRevision = 0;
+  StaticTextureKey key{};
+  gfx::TextureHandle handle;
+};
+
+static std::array<StaticSourceFrontCacheEntry, 256> s_staticSourceFrontCache;
+
+static gfx::TextureHandle lookup_static_source_front_cache(const StaticTextureKey& key, size_t hash) noexcept {
+  const auto& entry = s_staticSourceFrontCache[hash & (s_staticSourceFrontCache.size() - 1)];
+  if (entry.valid && entry.validationRevision == s_staticTextureCacheValidationRevision && entry.hash == hash &&
+      entry.key == key) {
+    return entry.handle;
+  }
+  return {};
+}
+
+static void store_static_source_front_cache(const StaticTextureKey& key, size_t hash,
+                                            const gfx::TextureHandle& handle) noexcept {
+  auto& entry = s_staticSourceFrontCache[hash & (s_staticSourceFrontCache.size() - 1)];
+  entry.valid = true;
+  entry.hash = hash;
+  entry.validationRevision = s_staticTextureCacheValidationRevision;
+  entry.key = key;
+  entry.handle = handle;
+  note_texture_cache_stamp();
+}
+
+static void clear_static_source_front_cache() noexcept {
+  for (auto& entry : s_staticSourceFrontCache) {
+    entry.valid = false;
+    entry.handle.reset();
+  }
+}
+
+static u32 static_texture_data_size(const StaticTextureKey& key) noexcept {
+  if (key.data == nullptr || key.width == 0 || key.height == 0 || key.mips == 0) {
+    return 0;
+  }
+  return GXGetTexBufferSize(static_cast<u16>(key.width), static_cast<u16>(key.height), key.format,
+                            key.mips > 1 ? GX_TRUE : GX_FALSE, static_cast<u8>(key.mips - 1));
+}
+
+static u64 digest_source_bytes(const void* data, size_t size) noexcept {
+  if (data == nullptr || size == 0) {
+    return 0;
+  }
+  return static_cast<u64>(xxh3_hash_s(data, size));
+}
+
+static bool source_matches_digest(const void* data, size_t size, u64 digest, u32 expectedSize) noexcept {
+  if (data == nullptr || size != expectedSize) {
+    return false;
+  }
+  return digest_source_bytes(data, size) == digest;
+}
+
+// A source whose generation still matches the one recorded beside its digest cannot have been written since, so the digest is skipped.
+static bool validate_static_texture_source_entry(const StaticTextureKey& key,
+                                                 StaticTextureSourceEntry& entry) noexcept {
+  if (entry.validationRevision == s_staticTextureCacheValidationRevision) {
+    return true;
+  }
+  const u32 dataSize = static_texture_data_size(key);
+  const u64 generation = guest_write_generation(key.data, dataSize);
+  if (dataSize == entry.sourceSize && guest_write_generation_matches(entry.sourceGeneration, generation)) {
+    entry.validationRevision = s_staticTextureCacheValidationRevision;
+    note_texture_cache_stamp();
+    return true;
+  }
+  if (!source_matches_digest(key.data, dataSize, entry.digest, entry.sourceSize)) {
+    return false;
+  }
+  entry.sourceGeneration = generation;
+  entry.validationRevision = s_staticTextureCacheValidationRevision;
+  note_texture_cache_stamp();
+  return true;
+}
+
+static bool validate_static_palette_texture_source_entry(const StaticPaletteTextureKey& key,
+                                                        StaticPaletteTextureSourceEntry& entry) noexcept {
+  if (entry.validationRevision == s_staticTextureCacheValidationRevision) {
+    return true;
+  }
+  const u32 textureDataSize = static_texture_data_size(key.texture);
+  const size_t tlutDataSize = static_cast<size_t>(key.tlutEntries) * sizeof(u16);
+  const u64 textureGeneration = guest_write_generation(key.texture.data, textureDataSize);
+  const u64 tlutGeneration = guest_write_generation(key.tlutData, tlutDataSize);
+  const bool skippable = textureDataSize == entry.textureSize && tlutDataSize == entry.tlutSize &&
+                         guest_write_generation_matches(entry.textureGeneration, textureGeneration) &&
+                         guest_write_generation_matches(entry.tlutGeneration, tlutGeneration);
+  if (!skippable) {
+    const bool textureOk =
+        source_matches_digest(key.texture.data, textureDataSize, entry.textureDigest, entry.textureSize);
+    const bool tlutOk = source_matches_digest(key.tlutData, tlutDataSize, entry.tlutDigest, entry.tlutSize);
+    if (!textureOk || !tlutOk) {
+      return false;
+    }
+    entry.textureGeneration = textureGeneration;
+    entry.tlutGeneration = tlutGeneration;
+  }
+  entry.validationRevision = s_staticTextureCacheValidationRevision;
+  note_texture_cache_stamp();
+  return true;
+}
+
+static StaticTextureSourceEntry make_static_texture_source_entry(const StaticTextureKey& key,
+                                                                const gfx::TextureHandle& handle) {
+  const u32 dataSize = static_texture_data_size(key);
+  const u64 generation = guest_write_generation(key.data, dataSize);
+  note_texture_cache_stamp();
+  return {
+      .handle = handle,
+      .digest = digest_source_bytes(key.data, dataSize),
+      .sourceSize = dataSize,
+      .validationRevision = s_staticTextureCacheValidationRevision,
+      .sourceGeneration = generation,
+  };
+}
+
+static StaticPaletteTextureSourceEntry make_static_palette_texture_source_entry(
+    const StaticPaletteTextureKey& key, const gfx::TextureHandle& handle) {
+  const u32 textureDataSize = static_texture_data_size(key.texture);
+  const size_t tlutDataSize = static_cast<size_t>(key.tlutEntries) * sizeof(u16);
+  const u64 textureGeneration = guest_write_generation(key.texture.data, textureDataSize);
+  const u64 tlutGeneration = guest_write_generation(key.tlutData, tlutDataSize);
+  note_texture_cache_stamp();
+  return {
+      .handle = handle,
+      .textureDigest = digest_source_bytes(key.texture.data, textureDataSize),
+      .tlutDigest = digest_source_bytes(key.tlutData, tlutDataSize),
+      .textureSize = textureDataSize,
+      .tlutSize = static_cast<u32>(tlutDataSize),
+      .validationRevision = s_staticTextureCacheValidationRevision,
+      .textureGeneration = textureGeneration,
+      .tlutGeneration = tlutGeneration,
+  };
+}
+
+DynamicPaletteKey make_dynamic_palette_key(const GXTexObj_& obj, const GXState::CopyTextureRef& source) {
+  return {
+      .sourceIdentity = source.handle.get(),
+      .width = obj.width(),
+      .height = obj.height(),
+      .format = obj.format(),
+  };
+}
+
+StaticTextureKey make_static_texture_key(const GXTexObj_& obj) {
+  return {
+      .data = obj.data,
+      .width = obj.width(),
+      .height = obj.height(),
+      .mips = obj.mip_count(),
+      .format = obj.format(),
+      .texDataVersion = obj.texDataVersion,
+  };
+}
+
+StaticPaletteTextureKey make_static_palette_texture_key(const GXTexObj_& obj, const GXTlutObj_& tlut) {
+  return {
+      .texture = make_static_texture_key(obj),
+      .tlutData = tlut.data,
+      .tlutFormat = static_cast<u32>(tlut.format),
+      .tlutEntries = tlut.numEntries,
+      .tlutDataVersion = tlut.tlutDataVersion,
+  };
+}
+
+bool can_cache_static_texture_upload(const GXTexObj_& obj) noexcept {
+  // THP movie frames are decoded into reused guest buffers and uploaded as YUVA.
+  return obj.format() != GX_CTF_YUVA8;
+}
+
+void clear_texture_dependency(u32 texObjId, u32 tlutObjId) {
+  if (texObjId == 0 || tlutObjId == 0) {
+    return;
+  }
+  if (auto it = s_tlutObjectCaches.find(tlutObjId); it != s_tlutObjectCaches.end()) {
+    it->second.staticTextureUsers.erase(texObjId);
+    if (!it->second.tlutTexture.handle && it->second.dynamicPaletteTextures.empty() &&
+        it->second.staticTextureUsers.empty()) {
+      s_tlutObjectCaches.erase(it);
+    }
+  }
+}
+
+void store_cached_texture(const GXTexObj_& obj, gfx::TextureHandle handle, u32 tlutObjId = 0, u32 tlutDataVersion = 0) {
+  if (obj.texObjId == 0) {
+    return;
+  }
+
+  auto& entry = s_textureObjectCaches[obj.texObjId];
+  if (entry.tlutObjId != tlutObjId) {
+    clear_texture_dependency(obj.texObjId, entry.tlutObjId);
+  }
+
+  entry.handle = std::move(handle);
+  entry.texDataVersion = obj.texDataVersion;
+  entry.tlutObjId = tlutObjId;
+  entry.tlutDataVersion = tlutDataVersion;
+  entry.validationRevision = s_staticTextureCacheValidationRevision;
+  note_texture_cache_stamp();
+
+  if (tlutObjId != 0) {
+    s_tlutObjectCaches[tlutObjId].staticTextureUsers.insert(obj.texObjId);
+  }
+}
+
+gfx::TextureHandle get_tlut_texture(const GXTlutObj_& tlut) {
+  const size_t tlutSize = static_cast<size_t>(tlut.numEntries) * sizeof(u16);
+  if (tlut.tlutObjId != 0) {
+    auto& cache = s_tlutObjectCaches[tlut.tlutObjId];
+    auto& cached = cache.tlutTexture;
+    if (cached.handle && cached.tlutDataVersion == tlut.tlutDataVersion) {
+      if (cached.validationRevision == s_staticTextureCacheValidationRevision) {
+        return cached.handle;
+      }
+      // GXInvalidateTexAll: the guest may have rewritten this palette in place without re-running GXInitTlutObj, which is the only thing that moves tlutDataVersion.
+      bool stillValid = true;
+      if (tlut.data != nullptr) {
+        const u64 generation = guest_write_generation(tlut.data, tlutSize);
+        if (!guest_write_generation_matches(cached.generation, generation)) {
+          stillValid = digest_source_bytes(tlut.data, tlutSize) == cached.digest;
+          cached.generation = generation;
+        }
+      }
+      if (stillValid) {
+        cached.validationRevision = s_staticTextureCacheValidationRevision;
+        note_texture_cache_stamp();
+        return cached.handle;
+      }
+    }
+    cache.dynamicPaletteTextures.clear();
+    for (const u32 texObjId : cache.staticTextureUsers) {
+      s_textureObjectCaches.erase(texObjId);
+    }
+    cache.staticTextureUsers.clear();
+  }
+
+  const auto handle =
+      gfx::new_static_texture_2d(tlut.numEntries, 1, 1, gfx::tlut_texture_format(tlut.format),
+                                 {static_cast<const u8*>(tlut.data), tlutSize}, true, "Loaded TLUT");
+  if (tlut.tlutObjId != 0) {
+    auto& cache = s_tlutObjectCaches[tlut.tlutObjId];
+    const u64 generation = guest_write_generation(tlut.data, tlutSize);
+    cache.tlutTexture.handle = handle;
+    cache.tlutTexture.tlutDataVersion = tlut.tlutDataVersion;
+    cache.tlutTexture.digest = digest_source_bytes(tlut.data, tlutSize);
+    cache.tlutTexture.generation = generation;
+    cache.tlutTexture.validationRevision = s_staticTextureCacheValidationRevision;
+    note_texture_cache_stamp();
+  }
+  return handle;
+}
+
+gfx::TextureHandle resolve_static_texture(const GXTexObj_& obj) {
+  ZoneScoped;
+  const bool canCacheUpload = !obj.no_cache() && can_cache_static_texture_upload(obj);
+
+  if (canCacheUpload && obj.texObjId != 0) {
+    if (const auto it = s_textureObjectCaches.find(obj.texObjId); it != s_textureObjectCaches.end()) {
+      const auto& entry = it->second;
+      if (entry.handle && entry.texDataVersion == obj.texDataVersion && entry.tlutObjId == 0 &&
+          entry.validationRevision == s_staticTextureCacheValidationRevision) {
+        return entry.handle;
+      }
+    }
+  }
+
+  const bool canUseSourceCache = canCacheUpload && obj.data != nullptr;
+  const StaticTextureKey sourceKey = canUseSourceCache ? make_static_texture_key(obj) : StaticTextureKey{};
+  const size_t sourceHash = canUseSourceCache ? absl::Hash<StaticTextureKey>{}(sourceKey) : 0;
+  if (canUseSourceCache) {
+    if (auto handle = lookup_static_source_front_cache(sourceKey, sourceHash)) {
+      if (obj.texObjId != 0) {
+        record_tex_obj_source_key(obj.texObjId, sourceKey);
+      }
+      return handle;
+    }
+    if (auto it = s_staticTextureSourceCache.find(sourceKey); it != s_staticTextureSourceCache.end()) {
+      if (!validate_static_texture_source_entry(sourceKey, it->second)) {
+        s_staticTextureSourceCache.erase(it);
+        clear_static_source_front_cache();
+      } else {
+        const auto& handle = it->second.handle;
+        if (obj.texObjId != 0) {
+          record_tex_obj_source_key(obj.texObjId, sourceKey);
+        }
+        store_static_source_front_cache(sourceKey, sourceHash, handle);
+        return handle;
+      }
+    }
+  }
+
+  gfx::TextureHandle handle;
+  if (const auto replacement = gfx::texture_replacement::find_replacement(obj); replacement.has_value()) {
+    handle = *replacement;
+  } else {
+#if DEBUG
+    const auto name = gfx::texture_replacement::build_texture_replacement_name(obj);
+    const auto nameStr = name.c_str();
+#else
+    const auto nameStr = "GX Static Texture";
+#endif
+    const u32 dataSize = GXGetTexBufferSize(static_cast<u16>(obj.width()), static_cast<u16>(obj.height()),
+                                            obj.format(), obj.has_mips(),
+                                            obj.has_mips() ? static_cast<u8>(obj.mip_count() - 1) : 0);
+    handle = gfx::new_static_texture_2d(obj.width(), obj.height(), obj.mip_count(), obj.format(),
+                                        {static_cast<const uint8_t*>(obj.data), dataSize}, false, nameStr);
+  }
+  if (canCacheUpload) {
+    store_cached_texture(obj, handle);
+    if (canUseSourceCache) {
+      if (s_staticTextureSourceCache.size() >= 512) {
+        absl::erase_if(s_staticTextureSourceCache, [](const auto& item) { return item.second.handle.use_count() <= 1; });
+        clear_static_source_front_cache();
+      }
+      s_staticTextureSourceCache[sourceKey] = make_static_texture_source_entry(sourceKey, handle);
+      store_static_source_front_cache(sourceKey, sourceHash, handle);
+      if (obj.texObjId != 0) {
+        record_tex_obj_source_key(obj.texObjId, sourceKey);
+      }
+    }
+  }
+  return handle;
+}
+
+gfx::TextureHandle resolve_static_palette_texture(const GXTexObj_& obj, const GXTlutObj_& tlut) {
+  ZoneScoped;
+
+  if (obj.texObjId != 0) {
+    if (const auto it = s_textureObjectCaches.find(obj.texObjId); it != s_textureObjectCaches.end()) {
+      const auto& entry = it->second;
+      if (entry.handle && entry.texDataVersion == obj.texDataVersion && entry.tlutObjId == tlut.tlutObjId &&
+          entry.tlutDataVersion == tlut.tlutDataVersion &&
+          entry.validationRevision == s_staticTextureCacheValidationRevision) {
+        return entry.handle;
+      }
+    }
+  }
+
+  const bool canUseSourceCache = !obj.no_cache() && !tlut.no_cache() && obj.data != nullptr && tlut.data != nullptr;
+  const StaticPaletteTextureKey sourceKey =
+      canUseSourceCache ? make_static_palette_texture_key(obj, tlut) : StaticPaletteTextureKey{};
+  if (canUseSourceCache) {
+    if (auto it = s_staticPaletteTextureSourceCache.find(sourceKey);
+        it != s_staticPaletteTextureSourceCache.end()) {
+      if (!validate_static_palette_texture_source_entry(sourceKey, it->second)) {
+        s_staticPaletteTextureSourceCache.erase(it);
+      } else {
+        const auto& handle = it->second.handle;
+        if (obj.texObjId != 0) {
+          store_cached_texture(obj, handle, tlut.tlutObjId, tlut.tlutDataVersion);
+          record_tex_obj_palette_source_key(obj.texObjId, sourceKey);
+        }
+        return handle;
+      }
+    }
+  }
+
+  gfx::TextureHandle handle;
+  if (const auto replacement = gfx::texture_replacement::find_replacement(obj); replacement.has_value()) {
+    handle = *replacement;
+  } else {
+    const u32 dataSize = GXGetTexBufferSize(static_cast<u16>(obj.width()), static_cast<u16>(obj.height()),
+                                            obj.format(), obj.has_mips(),
+                                            obj.has_mips() ? static_cast<u8>(obj.mip_count() - 1) : 0);
+    auto converted = gfx::convert_texture_palette(
+        obj.format(), obj.width(), obj.height(), obj.mip_count(), {static_cast<const u8*>(obj.data), dataSize},
+        tlut.format, tlut.numEntries, {static_cast<const u8*>(tlut.data), static_cast<size_t>(tlut.numEntries) * 2});
+    if (converted.data.empty()) {
+      return {};
+    }
+    handle =
+        gfx::new_static_texture_2d(obj.width(), obj.height(), obj.mip_count(), GX_TF_RGBA8_PC,
+                                   {converted.data.data(), converted.data.size()}, false, "GX Static Palette Texture");
+    handle->hasArbitraryMips = converted.hasArbitraryMips;
+  }
+  if (!obj.no_cache() && !tlut.no_cache()) {
+    store_cached_texture(obj, handle, tlut.tlutObjId, tlut.tlutDataVersion);
+    if (canUseSourceCache) {
+      if (s_staticPaletteTextureSourceCache.size() >= 256) {
+        absl::erase_if(s_staticPaletteTextureSourceCache, [](const auto& item) { return item.second.handle.use_count() <= 1; });
+      }
+      s_staticPaletteTextureSourceCache[sourceKey] = make_static_palette_texture_source_entry(sourceKey, handle);
+      if (obj.texObjId != 0) {
+        record_tex_obj_palette_source_key(obj.texObjId, sourceKey);
+      }
+    }
+  }
+  return handle;
+}
+
+gfx::TextureHandle resolve_dynamic_palette_texture(const GXTexObj_& obj, const GXState::CopyTextureRef& source,
+                                                   const GXTlutObj_& tlut) {
+  ZoneScoped;
+
+  const auto tlutHandle = get_tlut_texture(tlut);
+  auto& tlutCache = s_tlutObjectCaches[tlut.tlutObjId];
+  if (tlutCache.dynamicPaletteTextures.size() >= 32) {
+    absl::erase_if(tlutCache.dynamicPaletteTextures, [](const auto& item) { return item.second.handle.use_count() <= 1; });
+  }
+  auto& entry = tlutCache.dynamicPaletteTextures[make_dynamic_palette_key(obj, source)];
+  if (!entry.handle) {
+    // Use source size instead of target (logical) size
+    entry.handle = gfx::new_conv_texture(source.handle->size.width, source.handle->size.height, GX_TF_RGBA8,
+                                         "GX Dynamic Palette Texture");
+  }
+  if (entry.sourceRevision != source.revision || entry.tlutDataVersion != tlut.tlutDataVersion) {
+    gfx::queue_palette_conv({
+        .variant = obj.format() == GX_TF_C4 ? gfx::tex_palette_conv::Variant::FromFloat4
+                                            : gfx::tex_palette_conv::Variant::FromFloat8,
+        .src = source.handle,
+        .dst = entry.handle,
+        .tlut = tlutHandle,
+    });
+    entry.sourceRevision = source.revision;
+    entry.tlutDataVersion = tlut.tlutDataVersion;
+  }
+  return entry.handle;
+}
+
+u32 resolved_format_for_handle(const gfx::TextureHandle& handle) {
+  if (!handle) {
+    return GX_TF_RGBA8;
+  }
+  if (handle->gxFormat != gfx::InvalidTextureFormat) {
+    return handle->gxFormat;
+  }
+  return GX_TF_RGBA8_PC;
+}
+} // namespace
+
+Vec2<uint32_t> logical_fb_size() noexcept {
+  return gfx::is_offscreen() ? gfx::get_render_target_size() : vi::configured_fb_size();
+}
+
+namespace {
+struct ScissorRange {
+  s32 offset = 0;
+  s32 start = 0;
+  s32 end = 0;
+};
+
+struct ScissorRect {
+  gfx::ClipRect rect{};
+  s32 xOff = 0;
+  s32 yOff = 0;
+};
+
+std::array<ScissorRange, 9> compute_scissor_ranges(s32 start, s32 end, s32 offset, s32 efbDim, u32& count) noexcept {
+  std::array<ScissorRange, 9> ranges{};
+  count = 0;
+  for (s32 extraOff = -4096; extraOff <= 4096; extraOff += 1024) {
+    const s32 newOff = offset + extraOff;
+    const s32 newStart = std::clamp(start - newOff, 0, efbDim);
+    const s32 newEnd = std::clamp(end - newOff + 1, 0, efbDim);
+    if (newStart < newEnd && count < ranges.size()) {
+      ranges[count++] = {
+          .offset = newOff,
+          .start = newStart,
+          .end = newEnd,
+      };
+    }
+  }
+  return ranges;
+}
+
+int scissor_viewport_area(const ScissorRect& rect, const gfx::Viewport& viewport) noexcept {
+  const float viewportLeft = std::min(viewport.left, viewport.left + viewport.width);
+  const float viewportRight = std::max(viewport.left, viewport.left + viewport.width);
+  const float viewportTop = std::min(viewport.top, viewport.top + viewport.height);
+  const float viewportBottom = std::max(viewport.top, viewport.top + viewport.height);
+
+  const float left = std::clamp(static_cast<float>(rect.rect.x + rect.xOff), viewportLeft, viewportRight);
+  const float right =
+      std::clamp(static_cast<float>(rect.rect.x + rect.rect.width + rect.xOff), viewportLeft, viewportRight);
+  const float top = std::clamp(static_cast<float>(rect.rect.y + rect.yOff), viewportTop, viewportBottom);
+  const float bottom =
+      std::clamp(static_cast<float>(rect.rect.y + rect.rect.height + rect.yOff), viewportTop, viewportBottom);
+
+  return static_cast<int>(std::max(right - left, 0.0f) * std::max(bottom - top, 0.0f));
+}
+
+int scissor_area(const ScissorRect& rect) noexcept {
+  return rect.rect.width * rect.rect.height;
+}
+
+ScissorRect best_scissor_rect(const gfx::ClipRect& logicalScissor, const gfx::Viewport& logicalViewport) noexcept {
+  if (logicalScissor.width <= 0 || logicalScissor.height <= 0) {
+    return {
+        .rect = {1000, 1000, 1, 1},
+        .xOff = 0,
+        .yOff = 0,
+    };
+  }
+
+  const auto [logicalFbWidth, logicalFbHeight] = logical_fb_size();
+  const s32 efbWidth = static_cast<s32>(logicalFbWidth);
+  const s32 efbHeight = static_cast<s32>(logicalFbHeight);
+  const s32 left = logicalScissor.x;
+  const s32 right = logicalScissor.x + logicalScissor.width - 1;
+  const s32 top = logicalScissor.y;
+  const s32 bottom = logicalScissor.y + logicalScissor.height - 1;
+
+  u32 xCount = 0;
+  u32 yCount = 0;
+  const auto xRanges = compute_scissor_ranges(left, right, g_gxState.scissorOffsetX, efbWidth, xCount);
+  const auto yRanges = compute_scissor_ranges(top, bottom, g_gxState.scissorOffsetY, efbHeight, yCount);
+  if (xCount == 0 || yCount == 0) {
+    return {
+        .rect = {1000, 1000, 1, 1},
+        .xOff = 0,
+        .yOff = 0,
+    };
+  }
+
+  std::optional<ScissorRect> best;
+  for (u32 x = 0; x < xCount; ++x) {
+    for (u32 y = 0; y < yCount; ++y) {
+      const ScissorRect candidate{
+          .rect =
+              {
+                  .x = xRanges[x].start,
+                  .y = yRanges[y].start,
+                  .width = xRanges[x].end - xRanges[x].start,
+                  .height = yRanges[y].end - yRanges[y].start,
+              },
+          .xOff = xRanges[x].offset,
+          .yOff = yRanges[y].offset,
+      };
+      if (!best) {
+        best = candidate;
+        continue;
+      }
+
+      const int candidateViewportArea = scissor_viewport_area(candidate, logicalViewport);
+      const int bestViewportArea = scissor_viewport_area(*best, logicalViewport);
+      if (candidateViewportArea > bestViewportArea ||
+          (candidateViewportArea == bestViewportArea && scissor_area(candidate) > scissor_area(*best))) {
+        best = candidate;
+      }
+    }
+  }
+
+  return *best;
+}
+
+float logical_to_target_x(float value) noexcept {
+  const auto [logicalFbWidth, logicalFbHeight] = logical_fb_size();
+  const auto [targetWidth, targetHeight] = gfx::get_render_target_size();
+  if (logicalFbWidth == 0 || logicalFbHeight == 0 || targetWidth == 0 || targetHeight == 0) {
+    return value;
+  }
+  return value * static_cast<float>(targetWidth) / static_cast<float>(logicalFbWidth);
+}
+
+float logical_to_target_y(float value) noexcept {
+  const auto [logicalFbWidth, logicalFbHeight] = logical_fb_size();
+  const auto [targetWidth, targetHeight] = gfx::get_render_target_size();
+  if (logicalFbWidth == 0 || logicalFbHeight == 0 || targetWidth == 0 || targetHeight == 0) {
+    return value;
+  }
+  return value * static_cast<float>(targetHeight) / static_cast<float>(logicalFbHeight);
+}
+
+gfx::ClipRect scale_logical_scissor_rect(const gfx::ClipRect& logicalScissor) noexcept {
+  if (g_gxState.viewportPolicy == AURORA_VIEWPORT_NATIVE) {
+    return logicalScissor;
+  }
+
+  const auto [targetWidth, targetHeight] = gfx::get_render_target_size();
+  const float left = logical_to_target_x(static_cast<float>(logicalScissor.x));
+  const float top = logical_to_target_y(static_cast<float>(logicalScissor.y));
+  const float right = logical_to_target_x(static_cast<float>(logicalScissor.x + logicalScissor.width));
+  const float bottom = logical_to_target_y(static_cast<float>(logicalScissor.y + logicalScissor.height));
+
+  const auto mappedLeft = std::clamp(static_cast<int32_t>(std::floor(left)), 0, static_cast<int32_t>(targetWidth));
+  const auto mappedTop = std::clamp(static_cast<int32_t>(std::floor(top)), 0, static_cast<int32_t>(targetHeight));
+  const auto mappedRight =
+      std::clamp(static_cast<int32_t>(std::ceil(right)), mappedLeft, static_cast<int32_t>(targetWidth));
+  const auto mappedBottom =
+      std::clamp(static_cast<int32_t>(std::ceil(bottom)), mappedTop, static_cast<int32_t>(targetHeight));
+
+  return {
+      .x = mappedLeft,
+      .y = mappedTop,
+      .width = mappedRight - mappedLeft,
+      .height = mappedBottom - mappedTop,
+  };
+}
+
+} // namespace
+
+MappedRenderState map_logical_render_state() noexcept {
+  if (g_gxState.viewportPolicy == AURORA_VIEWPORT_NATIVE) {
+    return {
+        .viewport = g_gxState.logicalViewport,
+        .scissor = g_gxState.logicalScissor,
+    };
+  }
+
+  const auto bestScissor = best_scissor_rect(g_gxState.logicalScissor, g_gxState.logicalViewport);
+  const gfx::Viewport shiftedViewport{
+      .left = g_gxState.logicalViewport.left - static_cast<float>(bestScissor.xOff),
+      .top = g_gxState.logicalViewport.top - static_cast<float>(bestScissor.yOff),
+      .width = g_gxState.logicalViewport.width,
+      .height = g_gxState.logicalViewport.height,
+      .znear = g_gxState.logicalViewport.znear,
+      .zfar = g_gxState.logicalViewport.zfar,
+  };
+
+  return {
+      .viewport = map_logical_viewport(shiftedViewport),
+      .scissor = scale_logical_scissor_rect(bestScissor.rect),
+  };
+}
+
+namespace {
+void apply_logical_render_state() noexcept {
+  const auto mapped = map_logical_render_state();
+  set_render_viewport(mapped.viewport);
+  set_render_scissor(mapped.scissor);
+}
+} // namespace
+
+gfx::Viewport map_logical_viewport(const gfx::Viewport& logicalViewport) noexcept {
+  if (g_gxState.viewportPolicy == AURORA_VIEWPORT_NATIVE) {
+    return logicalViewport;
+  }
+
+  const auto [logicalFbWidth, logicalFbHeight] = logical_fb_size();
+  const auto [targetWidth, targetHeight] = gfx::get_render_target_size();
+  if (logicalFbWidth == 0 || logicalFbHeight == 0 || targetWidth == 0 || targetHeight == 0) {
+    return logicalViewport;
+  }
+
+  const float scaleX = static_cast<float>(targetWidth) / static_cast<float>(logicalFbWidth);
+  const float scaleY = static_cast<float>(targetHeight) / static_cast<float>(logicalFbHeight);
+  return {
+      .left = logicalViewport.left * scaleX,
+      .top = logicalViewport.top * scaleY,
+      .width = logicalViewport.width * scaleX,
+      .height = logicalViewport.height * scaleY,
+      .znear = logicalViewport.znear,
+      .zfar = logicalViewport.zfar,
+  };
+}
+
+gfx::ClipRect map_logical_scissor(const gfx::ClipRect& logicalScissor) noexcept {
+  if (g_gxState.viewportPolicy == AURORA_VIEWPORT_NATIVE) {
+    return logicalScissor;
+  }
+
+  const auto [logicalFbWidth, logicalFbHeight] = logical_fb_size();
+  const auto [targetWidth, targetHeight] = gfx::get_render_target_size();
+  if (logicalFbWidth == 0 || logicalFbHeight == 0 || targetWidth == 0 || targetHeight == 0) {
+    return logicalScissor;
+  }
+
+  return scale_logical_scissor_rect(logicalScissor);
+}
+
+void set_logical_viewport(const gfx::Viewport& viewport) noexcept {
+  const bool changed = viewport != g_gxState.logicalViewport;
+  g_gxState.logicalViewport = viewport;
+  g_gxState.stateDirty = g_gxState.stateDirty || changed;
+  apply_logical_render_state();
+}
+
+void set_render_viewport(const gfx::Viewport& viewport) noexcept {
+  if (viewport == g_gxState.renderViewport) {
+    return;
+  }
+  g_gxState.renderViewport = viewport;
+  g_gxState.stateDirty = true;
+  gfx::set_viewport(viewport);
+}
+
+void set_logical_scissor(const gfx::ClipRect& scissor) noexcept {
+  g_gxState.logicalScissor = scissor;
+  apply_logical_render_state();
+}
+
+void set_render_scissor(const gfx::ClipRect& scissor) noexcept {
+  g_gxState.renderScissor = scissor;
+  gfx::set_scissor(scissor);
+}
+
+const gfx::TextureBind& get_texture(GXTexMapID id) noexcept { return g_gxState.textures[static_cast<size_t>(id)]; }
+
+void evict_texture_object(u32 texObjId) noexcept {
+  if (const auto it = s_textureObjectCaches.find(texObjId); it != s_textureObjectCaches.end()) {
+    clear_texture_dependency(texObjId, it->second.tlutObjId);
+    s_textureObjectCaches.erase(it);
+  }
+  if (const auto it = s_texObjSourceKeys.find(texObjId); it != s_texObjSourceKeys.end()) {
+    s_staticTextureSourceCache.erase(it->second);
+    s_texObjSourceKeys.erase(it);
+    s_texObjSourceKeyMemo.forget(texObjId);
+    clear_static_source_front_cache();
+  }
+  if (const auto it = s_texObjPaletteSourceKeys.find(texObjId); it != s_texObjPaletteSourceKeys.end()) {
+    s_staticPaletteTextureSourceCache.erase(it->second);
+    s_texObjPaletteSourceKeys.erase(it);
+    s_texObjPaletteSourceKeyMemo.forget(texObjId);
+  }
+  // If there is a loaded slot with this ID, mark it as no_cache to avoid inserting it when it's resolved.
+  // This also handles the case where the texture was created, loaded, and immediately destroyed before we resolved it.
+  for (auto& obj : g_gxState.loadedTextures) {
+    if (obj.texObjId == texObjId) {
+      obj.set_no_cache(true);
+    }
+  }
+}
+
+void evict_tlut_object(u32 tlutObjId) noexcept {
+  // Only the conversions that actually depend on this palette are dropped.
+  if (const auto it = s_tlutObjectCaches.find(tlutObjId); it != s_tlutObjectCaches.end()) {
+    for (const u32 texObjId : it->second.staticTextureUsers) {
+      s_textureObjectCaches.erase(texObjId);
+      if (const auto keyIt = s_texObjPaletteSourceKeys.find(texObjId); keyIt != s_texObjPaletteSourceKeys.end()) {
+        s_staticPaletteTextureSourceCache.erase(keyIt->second);
+        s_texObjPaletteSourceKeys.erase(keyIt);
+        s_texObjPaletteSourceKeyMemo.forget(texObjId);
+      }
+    }
+    s_tlutObjectCaches.erase(it);
+  }
+  // If there is a loaded slot with this ID, mark it as no_cache to avoid inserting it when it's resolved.
+  // This also handles the case where the texture was created, loaded, and immediately destroyed before we resolved it.
+  for (auto& obj : g_gxState.loadedTluts) {
+    if (obj.tlutObjId == tlutObjId) {
+      obj.set_no_cache(true);
+    }
+  }
+}
+
+// GXInitTexObj mints a fresh object id per call and nothing ever emits DESTROY_TEXOBJ, so the texture object memo used to be bounded only by the fact that GXInvalidateTexAll dropped it six times a frame.
+constexpr u64 kTextureCacheIdleRevisions = 128;
+constexpr size_t kTextureObjectCacheSoftLimit = 1024;
+constexpr size_t kTlutObjectCacheSoftLimit = 512;
+constexpr size_t kTexObjSourceKeySoftLimit = 2048;
+
+static void prune_idle_texture_caches() noexcept {
+  const u64 revision = s_staticTextureCacheValidationRevision;
+  // An idle entry stays idle, so there is nothing to gain from sweeping on every bump (six a frame).
+  if (revision % (kTextureCacheIdleRevisions / 2) != 0) {
+    return;
+  }
+  if (s_textureObjectCaches.size() >= kTextureObjectCacheSoftLimit) {
+    std::vector<std::pair<u32, u32>> retired;
+    for (const auto& [texObjId, entry] : s_textureObjectCaches) {
+      if (revision - entry.validationRevision > kTextureCacheIdleRevisions) {
+        retired.emplace_back(texObjId, entry.tlutObjId);
+      }
+    }
+    for (const auto& [texObjId, tlutObjId] : retired) {
+      clear_texture_dependency(texObjId, tlutObjId);
+      s_textureObjectCaches.erase(texObjId);
+    }
+  }
+
+  if (s_tlutObjectCaches.size() >= kTlutObjectCacheSoftLimit) {
+    // Only drop palettes nothing depends on: an entry with users still records which cached conversions have to be thrown away when its bytes change.
+    absl::erase_if(s_tlutObjectCaches, [revision](const auto& item) {
+      const auto& cache = item.second;
+      return cache.staticTextureUsers.empty() && cache.dynamicPaletteTextures.empty() &&
+             (!cache.tlutTexture.handle || cache.tlutTexture.handle.use_count() <= 1) &&
+             revision - cache.tlutTexture.validationRevision > kTextureCacheIdleRevisions;
+    });
+  }
+
+  // The source-key maps exist only so evict_texture_object can find the static source entry a texObjId last resolved to, and nothing else ever retires them -- with GXInitTexObj minting a fresh id per call they otherwise grow for the lifetime of the process.
+  if (s_texObjSourceKeys.size() >= kTexObjSourceKeySoftLimit) {
+    absl::erase_if(s_texObjSourceKeys, [](const auto& item) { return !s_textureObjectCaches.contains(item.first); });
+    s_texObjSourceKeyMemo.reset();
+  }
+  if (s_texObjPaletteSourceKeys.size() >= kTexObjSourceKeySoftLimit) {
+    absl::erase_if(s_texObjPaletteSourceKeys,
+                   [](const auto& item) { return !s_textureObjectCaches.contains(item.first); });
+    s_texObjPaletteSourceKeyMemo.reset();
+  }
+}
+
+void invalidate_static_texture_cache() noexcept {
+  // Nothing has been marked reusable since the last bump, so every entry in every tier is already stale at the current revision.
+  if (s_textureCacheStamps == 0) {
+    return;
+  }
+
+  ++s_staticTextureCacheValidationRevision;
+  s_textureCacheStamps = 0;
+  if (s_staticTextureCacheValidationRevision == 0) {
+    // Unreachable with a 64-bit counter, but if it ever wraps, no stamped revision may survive into the reused revision.
+    s_staticTextureCacheValidationRevision = 1;
+    s_textureObjectCaches.clear();
+    s_tlutObjectCaches.clear();
+    s_staticTextureSourceCache.clear();
+    s_staticPaletteTextureSourceCache.clear();
+    s_texObjSourceKeys.clear();
+    s_texObjPaletteSourceKeys.clear();
+    s_texObjSourceKeyMemo.reset();
+    s_texObjPaletteSourceKeyMemo.reset();
+    clear_static_source_front_cache();
+    for (auto& entry : s_textureResolveIdentityCache) {
+      entry.valid = false;
+      entry.binding.reset();
+    }
+  }
+
+  // Everything else is revision-gated: the texture object memo, the TLUT textures (re-proved by palette digest), the static source front cache and the resolve identity cache all miss on the new revision without being torn down, so the bump costs one increment instead of dropping GPU textures and rebuilding hash tables.
+  s_lastTextureResolveIdentityValid.fill(false);
+  s_lastNoCopyResolveRevision.fill(0);
+  s_lastStaticSourceResolveKeyValid.fill(false);
+  s_lastStaticSourceNoCopyRevision.fill(0);
+  prune_idle_texture_caches();
+  g_gxState.stateDirty = true;
+}
+
+void clear_copy_texture_cache() noexcept {
+  g_gxState.copyTextures.clear();
+  g_gxState.copyTextureCache.clear();
+  prune_copy_texture_pool(nullptr);
+  mark_copy_texture_cache_changed();
+  clear_display_copy_cache();
+  for (auto& [_, cache] : s_tlutObjectCaches) {
+    cache.dynamicPaletteTextures.clear();
+  }
+}
+
+void clear_display_copy_cache() noexcept {
+  g_gxState.displayCopyTexture.reset();
+  g_gxState.displayCopyBindGroup = {};
+  g_gxState.displayCopyWidth = 0;
+  g_gxState.displayCopyHeight = 0;
+}
+
+void set_display_copy_present_source() noexcept {
+  if (!g_gxState.displayCopyTexture) {
+    return;
+  }
+
+  g_gxState.displayCopyBindGroup = webgpu::create_copy_bind_group(g_gxState.displayCopyTexture->sampleTextureView,
+                                                                  webgpu::present_source().sampler);
+  webgpu::set_present_source_override(g_gxState.displayCopyBindGroup, g_gxState.displayCopyTexture->texture,
+                                      g_gxState.displayCopyTexture->size, g_gxState.displayCopyTexture->format);
+}
+
+void evict_copy_texture(const void* dest) noexcept {
+  // Dynamic palette textures are keyed on the copy texture's raw TextureRef pointer; evicting the copy without them leaves entries that can match a recycled allocation at the same address and serve a stale conversion.
+  absl::flat_hash_set<const void*> sourceIdentities;
+  bool changed = false;
+  if (const auto it = g_gxState.copyTextures.find(dest); it != g_gxState.copyTextures.end()) {
+    if (it->second.handle) {
+      sourceIdentities.insert(it->second.handle.get());
+    }
+    g_gxState.copyTextures.erase(it);
+    changed = true;
+  }
+  for (auto it = g_gxState.copyTextureCache.begin(); it != g_gxState.copyTextureCache.end();) {
+    if (it->first.dest == dest) {
+      if (it->second.handle) {
+        sourceIdentities.insert(it->second.handle.get());
+      }
+      g_gxState.copyTextureCache.erase(it++);
+      changed = true;
+    } else {
+      ++it;
+    }
+  }
+  if (!sourceIdentities.empty()) {
+    for (auto& [_, cache] : s_tlutObjectCaches) {
+      for (auto it = cache.dynamicPaletteTextures.begin(); it != cache.dynamicPaletteTextures.end();) {
+        if (sourceIdentities.contains(it->first.sourceIdentity)) {
+          cache.dynamicPaletteTextures.erase(it++);
+        } else {
+          ++it;
+        }
+      }
+    }
+  }
+  prune_copy_texture_pool(dest);
+  if (changed) {
+    mark_copy_texture_cache_changed();
+  }
+}
+
+static void mark_copy_texture_cache_changed() noexcept {
+  ++s_copyTextureStateRevision;
+  if (s_copyTextureStateRevision == 0) {
+    s_copyTextureStateRevision = 1;
+    s_lastNoCopyResolveRevision.fill(0);
+  }
+}
+
+void mark_copy_texture_sampled(const void* copyDest, GXState::CopyTextureRef& copyRef) noexcept {
+  const auto frame = gfx::current_frame();
+  copyRef.lastSampledFrame = frame;
+  copyRef.sampledThisFrame = true;
+
+  if (auto it = g_gxState.copyTextures.find(copyDest);
+      it != g_gxState.copyTextures.end() && it->second.handle == copyRef.handle) {
+    it->second.lastSampledFrame = frame;
+    it->second.sampledThisFrame = true;
+  }
+
+  const GXState::CopyTextureKey key{
+      .dest = copyDest,
+      .width = copyRef.width,
+      .height = copyRef.height,
+      .format = copyRef.format,
+  };
+  if (auto it = g_gxState.copyTextureCache.find(key); it != g_gxState.copyTextureCache.end() &&
+      it->second.handle == copyRef.handle) {
+    it->second.lastSampledFrame = frame;
+    it->second.sampledThisFrame = true;
+  }
+
+}
+
+bool copy_ref_matches_texobj(const GXState::CopyTextureRef& copyRef, const GXTexObj_& obj) noexcept {
+  return copyRef && copyRef.width == obj.width() && copyRef.height == obj.height() &&
+         copy_texture_format_compatible(copyRef.format, obj.format());
+}
+
+void notify_copy_texture_created() noexcept {
+  mark_copy_texture_cache_changed();
+}
+
+
+GXState::CopyTextureRef* find_cached_copy_texture(const void* copyDest, const GXTexObj_& obj) noexcept {
+  const GXState::CopyTextureKey key{
+      .dest = copyDest,
+      .width = obj.width(),
+      .height = obj.height(),
+      .format = static_cast<GXTexFmt>(obj.format()),
+  };
+  auto cached = g_gxState.copyTextureCache.find(key);
+  if (cached == g_gxState.copyTextureCache.end() || !cached->second) {
+    return nullptr;
+  }
+  mark_copy_texture_sampled(copyDest, cached->second);
+  return &cached->second;
+}
+
+GXState::CopyTextureRef* find_copy_texture_for_texobj(const GXTexObj_& obj) noexcept {
+  if (obj.data == nullptr) {
+    return nullptr;
+  }
+
+  if (auto* cached = find_cached_copy_texture(obj.data, obj)) {
+    return cached;
+  }
+
+  const auto exact = g_gxState.copyTextures.find(obj.data);
+  if (exact != g_gxState.copyTextures.end() && copy_ref_matches_texobj(exact->second, obj)) {
+    mark_copy_texture_sampled(obj.data, exact->second);
+    return &exact->second;
+  }
+  // A guest allocation can be recycled while an old GPU-only EFB copy still exists.
+  return nullptr;
+}
+
+void resolve_sampled_textures(const ShaderInfo& info) noexcept {
+  ZoneScoped;
+
+  for (u32 i = 0; i < MaxTextures; ++i) {
+    if (!info.sampledTextures.test(i)) {
+      continue;
+    }
+
+    GXTexObj_ obj = g_gxState.loadedTextures[i];
+    auto& textureBind = g_gxState.textures[i];
+    const TextureResolveIdentity identity = make_texture_resolve_identity(obj);
+    // obj is unchanged between here and the memo checks below, so the two former can_cache_static_texture_upload(obj) calls are one value.
+    const bool canCacheUpload = can_cache_static_texture_upload(obj);
+    const bool sameResolvedTexture = canCacheUpload && s_lastTextureResolveIdentityValid[i] &&
+                                     s_lastTextureResolveIdentity[i] == identity;
+    // The primary per-texmap memo below consumes neither the source key nor its hash, so building them ahead of it wasted make_static_texture_key on the hottest path (same texture bound across consecutive draws).
+    if (sameResolvedTexture && s_lastNoCopyResolveRevision[i] == s_copyTextureStateRevision) {
+      continue;
+    }
+    const bool canUseStaticSourceKey =
+        !is_palette_format(obj.format()) && canCacheUpload && !obj.no_cache() &&
+        obj.data != nullptr;
+    const StaticTextureKey staticSourceKey =
+        canUseStaticSourceKey ? make_static_texture_key(obj) : StaticTextureKey{};
+    const size_t identityHash = canUseStaticSourceKey ? absl::Hash<TextureResolveIdentity>{}(identity) : 0;
+    if (canUseStaticSourceKey) {
+      const auto& entry = s_textureResolveIdentityCache[identityHash & (s_textureResolveIdentityCache.size() - 1)];
+      if (entry.valid && entry.hash == identityHash && entry.copyTextureRevision == s_copyTextureStateRevision &&
+          entry.validationRevision == s_staticTextureCacheValidationRevision && entry.identity == identity &&
+          entry.binding) {
+        textureBind = entry.binding;
+        note_texture_cache_stamp();
+        s_lastTextureResolveIdentity[i] = identity;
+        s_lastTextureResolveIdentityValid[i] = true;
+        s_lastNoCopyResolveRevision[i] = s_copyTextureStateRevision;
+        s_lastStaticSourceResolveKey[i] = staticSourceKey;
+        s_lastStaticSourceResolveKeyValid[i] = true;
+        s_lastStaticSourceNoCopyRevision[i] = s_copyTextureStateRevision;
+        continue;
+      }
+    }
+    if (canUseStaticSourceKey && textureBind.ref && s_lastStaticSourceResolveKeyValid[i] &&
+        s_lastStaticSourceResolveKey[i] == staticSourceKey &&
+        s_lastStaticSourceNoCopyRevision[i] == s_copyTextureStateRevision) {
+      obj.mFormat = resolved_format_for_handle(textureBind.ref);
+      textureBind.texObj = obj;
+      s_lastTextureResolveIdentity[i] = identity;
+      s_lastTextureResolveIdentityValid[i] = true;
+      s_lastNoCopyResolveRevision[i] = s_copyTextureStateRevision;
+      note_texture_cache_stamp();
+      continue;
+    }
+
+    GXState::CopyTextureRef* copyRef = find_copy_texture_for_texobj(obj);
+    if (sameResolvedTexture) {
+      if (copyRef == nullptr) {
+        s_lastNoCopyResolveRevision[i] = s_copyTextureStateRevision;
+        continue;
+      }
+      if (!is_palette_format(obj.format()) && textureBind.ref == copyRef->handle) {
+        s_lastNoCopyResolveRevision[i] = 0;
+        continue;
+      }
+    }
+
+    gfx::TextureHandle handle;
+    if (is_palette_format(obj.format())) {
+      const auto tlutIdx = static_cast<size_t>(obj.tlut);
+      if (tlutIdx < g_gxState.loadedTluts.size()) {
+        const auto& tlut = g_gxState.loadedTluts[tlutIdx];
+        if (tlut.data != nullptr) {
+          if (copyRef != nullptr) {
+            handle = resolve_dynamic_palette_texture(obj, *copyRef, tlut);
+          } else if (obj.data != nullptr) {
+            handle = resolve_static_palette_texture(obj, tlut);
+          }
+        }
+      }
+    } else if (copyRef != nullptr) {
+      handle = copyRef->handle;
+    } else if (obj.data != nullptr) {
+      handle = resolve_static_texture(obj);
+    }
+
+    obj.mFormat = resolved_format_for_handle(handle);
+    textureBind = gfx::TextureBind{obj, std::move(handle)};
+    // The per-texmap memo below lets a later draw reuse this binding without touching guest memory again, including for no_cache textures that never reach any of the stamped caches above, so it has to count as a stamp.
+    note_texture_cache_stamp();
+    s_lastTextureResolveIdentity[i] = identity;
+    s_lastTextureResolveIdentityValid[i] = true;
+    s_lastNoCopyResolveRevision[i] = (copyRef == nullptr) ? s_copyTextureStateRevision : 0;
+    s_lastStaticSourceResolveKeyValid[i] = canUseStaticSourceKey && copyRef == nullptr;
+    if (s_lastStaticSourceResolveKeyValid[i]) {
+      s_lastStaticSourceResolveKey[i] = staticSourceKey;
+      s_lastStaticSourceNoCopyRevision[i] = s_copyTextureStateRevision;
+      auto& entry = s_textureResolveIdentityCache[identityHash & (s_textureResolveIdentityCache.size() - 1)];
+      entry.valid = true;
+      entry.hash = identityHash;
+      entry.copyTextureRevision = s_copyTextureStateRevision;
+      entry.validationRevision = s_staticTextureCacheValidationRevision;
+      entry.identity = identity;
+      entry.binding = textureBind;
+      note_texture_cache_stamp();
+    } else {
+      s_lastStaticSourceNoCopyRevision[i] = 0;
+    }
+  }
+}
+
+static inline wgpu::BlendFactor to_blend_factor(GXBlendFactor fac, bool isDst, bool alphaComponent) {
+  switch (fac) {
+    DEFAULT_FATAL("invalid blend factor {}", underlying(fac));
+  case GX_BL_ZERO:
+    return wgpu::BlendFactor::Zero;
+  case GX_BL_ONE:
+    return wgpu::BlendFactor::One;
+  case GX_BL_SRCCLR: // + GX_BL_DSTCLR
+    if (alphaComponent) {
+      return isDst ? wgpu::BlendFactor::SrcAlpha : wgpu::BlendFactor::DstAlpha;
+    }
+    if (isDst) {
+      return wgpu::BlendFactor::Src;
+    } else {
+      return wgpu::BlendFactor::Dst;
+    }
+  case GX_BL_INVSRCCLR: // + GX_BL_INVDSTCLR
+    if (alphaComponent) {
+      return isDst ? wgpu::BlendFactor::OneMinusSrcAlpha : wgpu::BlendFactor::OneMinusDstAlpha;
+    }
+    if (isDst) {
+      return wgpu::BlendFactor::OneMinusSrc;
+    } else {
+      return wgpu::BlendFactor::OneMinusDst;
+    }
+  case GX_BL_SRCALPHA:
+    return wgpu::BlendFactor::SrcAlpha;
+  case GX_BL_INVSRCALPHA:
+    return wgpu::BlendFactor::OneMinusSrcAlpha;
+  case GX_BL_DSTALPHA:
+    return wgpu::BlendFactor::DstAlpha;
+  case GX_BL_INVDSTALPHA:
+    return wgpu::BlendFactor::OneMinusDstAlpha;
+  }
+}
+
+static inline GXBlendFactor remove_dst_alpha_usage(GXBlendFactor fac) {
+  switch (fac) {
+  case GX_BL_DSTALPHA:
+    return GX_BL_ONE;
+  case GX_BL_INVDSTALPHA:
+    return GX_BL_ZERO;
+  default:
+    return fac;
+  }
+}
+
+static inline wgpu::CompareFunction to_compare_function(GXCompare func) {
+  switch (func) {
+    DEFAULT_FATAL("invalid depth fn {}", underlying(func));
+  case GX_NEVER:
+    return wgpu::CompareFunction::Never;
+  case GX_LESS:
+    return wgpu::CompareFunction::Less;
+  case GX_EQUAL:
+    return wgpu::CompareFunction::Equal;
+  case GX_LEQUAL:
+    return wgpu::CompareFunction::LessEqual;
+  case GX_GREATER:
+    return wgpu::CompareFunction::Greater;
+  case GX_NEQUAL:
+    return wgpu::CompareFunction::NotEqual;
+  case GX_GEQUAL:
+    return wgpu::CompareFunction::GreaterEqual;
+  case GX_ALWAYS:
+    return wgpu::CompareFunction::Always;
+  }
+}
+
+static inline wgpu::BlendState to_blend_state(GXBlendMode mode, GXBlendFactor srcFac, GXBlendFactor dstFac,
+                                              GXLogicOp op, GXPixelFmt pixelFmt, u32 dstAlpha) {
+  wgpu::BlendComponent colorBlendComponent;
+  switch (mode) {
+    DEFAULT_FATAL("unsupported blend mode {}", underlying(mode));
+  case GX_BM_NONE:
+    colorBlendComponent = {
+        .operation = wgpu::BlendOperation::Add,
+        .srcFactor = wgpu::BlendFactor::One,
+        .dstFactor = wgpu::BlendFactor::Zero,
+    };
+    break;
+  case GX_BM_BLEND:
+    if (!render_target_has_alpha(pixelFmt)) {
+      srcFac = remove_dst_alpha_usage(srcFac);
+      dstFac = remove_dst_alpha_usage(dstFac);
+    }
+    colorBlendComponent = {
+        .operation = wgpu::BlendOperation::Add,
+        .srcFactor = to_blend_factor(srcFac, false, false),
+        .dstFactor = to_blend_factor(dstFac, true, false),
+    };
+    break;
+  case GX_BM_SUBTRACT:
+    colorBlendComponent = {
+        .operation = wgpu::BlendOperation::ReverseSubtract,
+        .srcFactor = wgpu::BlendFactor::One,
+        .dstFactor = wgpu::BlendFactor::One,
+    };
+    break;
+  case GX_BM_LOGIC:
+    switch (op) {
+    default:
+      // WebGPU exposes blend factors, but not fixed-function integer logic ops.
+      colorBlendComponent = {
+          .operation = wgpu::BlendOperation::Add,
+          .srcFactor = wgpu::BlendFactor::One,
+          .dstFactor = wgpu::BlendFactor::Zero,
+      };
+      break;
+    case GX_LO_CLEAR:
+      colorBlendComponent = {
+          .operation = wgpu::BlendOperation::Add,
+          .srcFactor = wgpu::BlendFactor::Zero,
+          .dstFactor = wgpu::BlendFactor::Zero,
+      };
+      break;
+    case GX_LO_AND:
+    case GX_LO_REVAND:
+    case GX_LO_XOR:
+    case GX_LO_NOR:
+    case GX_LO_EQUIV:
+    case GX_LO_INV:
+    case GX_LO_REVOR:
+    case GX_LO_INVCOPY:
+    case GX_LO_INVOR:
+    case GX_LO_NAND:
+    case GX_LO_COPY:
+    case GX_LO_SET:
+      colorBlendComponent = {
+          .operation = wgpu::BlendOperation::Add,
+          .srcFactor = wgpu::BlendFactor::One,
+          .dstFactor = wgpu::BlendFactor::Zero,
+      };
+      break;
+    case GX_LO_INVAND:
+      colorBlendComponent = {
+          .operation = wgpu::BlendOperation::Add,
+          .srcFactor = wgpu::BlendFactor::Zero,
+          .dstFactor = wgpu::BlendFactor::OneMinusSrc,
+      };
+      break;
+    case GX_LO_NOOP:
+      colorBlendComponent = {
+          .operation = wgpu::BlendOperation::Add,
+          .srcFactor = wgpu::BlendFactor::Zero,
+          .dstFactor = wgpu::BlendFactor::One,
+      };
+      break;
+    case GX_LO_OR:
+      // WebGPU has no fixed-function integer logic op.
+      colorBlendComponent = {
+          .operation = wgpu::BlendOperation::Max,
+          .srcFactor = wgpu::BlendFactor::One,
+          .dstFactor = wgpu::BlendFactor::One,
+      };
+      break;
+    }
+    break;
+  }
+  wgpu::BlendComponent alphaBlendComponent;
+  if (dstAlpha != UINT32_MAX) {
+    alphaBlendComponent = wgpu::BlendComponent{
+        .operation = wgpu::BlendOperation::Add,
+        .srcFactor = wgpu::BlendFactor::Constant,
+        .dstFactor = wgpu::BlendFactor::Zero,
+    };
+  } else if (mode == GX_BM_BLEND) {
+    alphaBlendComponent = wgpu::BlendComponent{
+        .operation = wgpu::BlendOperation::Add,
+        .srcFactor = to_blend_factor(srcFac, false, true),
+        .dstFactor = to_blend_factor(dstFac, true, true),
+    };
+  } else {
+    alphaBlendComponent = colorBlendComponent;
+  }
+  return {
+      .color = colorBlendComponent,
+      .alpha = alphaBlendComponent,
+  };
+}
+
+static inline bool effective_alpha_update(GXPixelFmt pixelFmt, bool alphaUpdate) {
+  return alphaUpdate && render_target_has_alpha(pixelFmt);
+}
+
+static inline u32 effective_dst_alpha(GXPixelFmt pixelFmt, bool alphaUpdate, u32 dstAlpha) {
+  return effective_alpha_update(pixelFmt, alphaUpdate) ? dstAlpha : UINT32_MAX;
+}
+
+static inline wgpu::ColorWriteMask to_write_mask(bool colorUpdate, bool alphaUpdate) {
+  wgpu::ColorWriteMask writeMask = wgpu::ColorWriteMask::None;
+  if (colorUpdate) {
+    writeMask |= wgpu::ColorWriteMask::Red | wgpu::ColorWriteMask::Green | wgpu::ColorWriteMask::Blue;
+  }
+  if (alphaUpdate) {
+    writeMask |= wgpu::ColorWriteMask::Alpha;
+  }
+  return writeMask;
+}
+
+static inline wgpu::PrimitiveState to_primitive_state(GXCullMode gx_cullMode) {
+  auto cullMode = wgpu::CullMode::None;
+  switch (gx_cullMode) {
+    DEFAULT_FATAL("unsupported cull mode {}", underlying(gx_cullMode));
+  case GX_CULL_FRONT:
+    cullMode = wgpu::CullMode::Front;
+    break;
+  case GX_CULL_BACK:
+    cullMode = wgpu::CullMode::Back;
+    break;
+  case GX_CULL_ALL:
+    // todo: remove? since all calls get dropped anyways
+    cullMode = wgpu::CullMode::Front;
+    break;
+  case GX_CULL_NONE:
+    break;
+  }
+  return {
+      .topology = wgpu::PrimitiveTopology::TriangleList,
+      .stripIndexFormat = wgpu::IndexFormat::Undefined,
+      .frontFace = wgpu::FrontFace::CW,
+      .cullMode = cullMode,
+  };
+}
+
+wgpu::RenderPipeline build_pipeline(const PipelineConfig& config, ArrayRef<wgpu::VertexBufferLayout> vtxBuffers,
+                                    wgpu::ShaderModule shader, const char* label) noexcept {
+  ZoneScoped;
+  const wgpu::DepthStencilState depthStencil{
+      .format = g_graphicsConfig.depthFormat,
+      .depthWriteEnabled = config.depthUpdate,
+      .depthCompare = config.depthCompare ? to_compare_function(config.depthFunc) : wgpu::CompareFunction::Always,
+  };
+  const auto blendState = to_blend_state(config.blendMode, config.blendFacSrc, config.blendFacDst, config.blendOp,
+                                         config.pixelFmt, config.dstAlpha);
+  const std::array colorTargets{wgpu::ColorTargetState{
+      .format = g_graphicsConfig.surfaceConfiguration.format,
+      .blend = &blendState,
+      .writeMask = to_write_mask(config.colorUpdate, config.alphaUpdate),
+  }};
+  const wgpu::FragmentState fragmentState{
+      .module = shader,
+      .entryPoint = "fs_main",
+      .targetCount = colorTargets.size(),
+      .targets = colorTargets.data(),
+  };
+  const wgpu::RenderPipelineDescriptor descriptor{
+      .label = label,
+      .layout = sPipelineLayout,
+      .vertex =
+          {
+              .module = shader,
+              .entryPoint = "vs_main",
+              .bufferCount = static_cast<uint32_t>(vtxBuffers.size()),
+              .buffers = vtxBuffers.data(),
+          },
+      .primitive = to_primitive_state(config.cullMode),
+      .depthStencil = &depthStencil,
+      .multisample =
+          wgpu::MultisampleState{
+              .count = config.msaaSamples,
+          },
+      .fragment = &fragmentState,
+  };
+  return g_device.CreateRenderPipeline(&descriptor);
+}
+
+u8 comp_type_size(GXAttr attr, GXCompType type) noexcept {
+  switch (attr) {
+  case GX_VA_PNMTXIDX:
+  case GX_VA_TEX0MTXIDX:
+  case GX_VA_TEX1MTXIDX:
+  case GX_VA_TEX2MTXIDX:
+  case GX_VA_TEX3MTXIDX:
+  case GX_VA_TEX4MTXIDX:
+  case GX_VA_TEX5MTXIDX:
+  case GX_VA_TEX6MTXIDX:
+  case GX_VA_TEX7MTXIDX:
+    return 1;
+  case GX_VA_CLR0:
+  case GX_VA_CLR1:
+    switch (type) {
+    case GX_RGB565:
+    case GX_RGBA4:
+      return 2;
+    case GX_RGB8:
+    case GX_RGBA6:
+      return 3;
+    case GX_RGBX8:
+    case GX_RGBA8:
+      return 4;
+    }
+  default:
+    switch (type) {
+    case GX_U8:
+    case GX_S8:
+      return 1;
+    case GX_U16:
+    case GX_S16:
+      return 2;
+    case GX_F32:
+      return 4;
+    default:
+      Log.fatal("comp_type_size: Unsupported component type {}", type);
+    }
+  }
+}
+
+u8 comp_cnt_count(GXAttr attr, GXCompCnt cnt) noexcept {
+  switch (attr) {
+  case GX_VA_PNMTXIDX:
+  case GX_VA_TEX0MTXIDX:
+  case GX_VA_TEX1MTXIDX:
+  case GX_VA_TEX2MTXIDX:
+  case GX_VA_TEX3MTXIDX:
+  case GX_VA_TEX4MTXIDX:
+  case GX_VA_TEX5MTXIDX:
+  case GX_VA_TEX6MTXIDX:
+  case GX_VA_TEX7MTXIDX:
+    return 1;
+  case GX_VA_POS:
+    switch (cnt) {
+    case GX_POS_XY:
+      return 2;
+    case GX_POS_XYZ:
+      return 3;
+    default:
+      break;
+    }
+    break;
+  case GX_VA_NRM:
+    switch (cnt) {
+    case GX_NRM_XYZ:
+      return 3;
+    case GX_NRM_NBT:
+    case GX_NRM_NBT3:
+      return 9;
+    default:
+      break;
+    }
+    break;
+  case GX_VA_CLR0:
+  case GX_VA_CLR1:
+    return 1;
+  case GX_VA_TEX0:
+  case GX_VA_TEX1:
+  case GX_VA_TEX2:
+  case GX_VA_TEX3:
+  case GX_VA_TEX4:
+  case GX_VA_TEX5:
+  case GX_VA_TEX6:
+  case GX_VA_TEX7:
+    switch (cnt) {
+    case GX_TEX_S:
+      return 1;
+    case GX_TEX_ST:
+      return 2;
+    default:
+      break;
+    }
+    break;
+  default:
+    break;
+  }
+  Log.fatal("comp_cnt_count: Unsupported attr/cnt {} {}", attr, cnt);
+}
+
+static u8 index_attr_size(GXAttr attr, GXCompCnt cnt, GXAttrType type) noexcept {
+  const u8 indexSize = type == GX_INDEX16 ? 2 : 1;
+  if (attr == GX_VA_NRM && cnt == GX_NRM_NBT3) {
+    return indexSize * 3;
+  }
+  return indexSize;
+}
+
+void populate_pipeline_config(PipelineConfig& config, GXPrimitive primitive, GXVtxFmt fmt) noexcept {
+  ZoneScoped;
+
+  const auto& vtxFmt = g_gxState.vtxFmts[fmt];
+  // GX applies integer logic ops in the PE after fog.
+  config.shaderConfig.fogType = effective_pipeline_fog_type(
+      g_gxState.fog.type, g_gxState.zTextureOp, g_gxState.zCompLocBeforeTex,
+      g_gxState.blendMode, g_gxState.blendOp);
+  config.shaderConfig.fogRangeAdjust =
+      config.shaderConfig.fogType != GX_FOG_NONE && (g_gxState.fogRange[0] & (1u << 10)) != 0;
+  u8 vtxOffset = 0;
+  for (int i = GX_VA_PNMTXIDX; i <= GX_VA_TEX7; ++i) {
+    const auto attr = static_cast<GXAttr>(i);
+    const auto type = g_gxState.vtxDesc[i];
+    auto& mapping = config.shaderConfig.attrs[i];
+    if (type == GX_NONE) {
+      mapping = {};
+      continue;
+    }
+    const auto& attrFmt = vtxFmt.attrs[i];
+    const auto cnt = comp_cnt_count(attr, attrFmt.cnt);
+    mapping = AttrConfig{
+        .attrType = static_cast<u8>(type),
+        .cnt = cnt,
+        .compType = static_cast<u8>(attrFmt.type),
+        .offset = vtxOffset,
+        .stride = 0,
+        .frac = attrFmt.frac,
+        .le = false,
+        .nrmIndexCount = static_cast<u8>(attr == GX_VA_NRM && attrFmt.cnt == GX_NRM_NBT3 ? 3 : 1),
+    };
+    switch (type) {
+    case GX_DIRECT: {
+      vtxOffset += comp_type_size(attr, attrFmt.type) * cnt;
+      break;
+    }
+    case GX_INDEX8:
+      mapping.stride = g_gxState.arrays[i].stride;
+      mapping.le = g_gxState.arrays[i].le;
+      vtxOffset += index_attr_size(attr, attrFmt.cnt, type);
+      break;
+    case GX_INDEX16:
+      mapping.stride = g_gxState.arrays[i].stride;
+      mapping.le = g_gxState.arrays[i].le;
+      vtxOffset += index_attr_size(attr, attrFmt.cnt, type);
+      break;
+    default:
+      Log.fatal("populate_pipeline_config: Invalid vertex type {}", type);
+    }
+  }
+  config.shaderConfig.vtxStride = vtxOffset;
+  if (primitive == GX_LINES) {
+    config.shaderConfig.lineMode = 1;
+  } else if (primitive == GX_LINESTRIP) {
+    config.shaderConfig.lineMode = 2;
+  } else if (primitive == GX_POINTS) {
+    config.shaderConfig.lineMode = 3;
+  } else {
+    config.shaderConfig.lineMode = 0;
+  }
+  config.shaderConfig.dualTexEnabled = (g_gxState.dualTex & 1u) != 0;
+  config.shaderConfig.tevSwapTable = g_gxState.tevSwapTable;
+  for (u8 i = 0; i < g_gxState.numTevStages; ++i) {
+    config.shaderConfig.tevStages[i] = g_gxState.tevStages[i];
+  }
+  config.shaderConfig.tevStageCount = g_gxState.numTevStages;
+  config.shaderConfig.numTexGens = g_gxState.numTexGens;
+  if (g_gxState.zTextureOp != GX_ZT_DISABLE && !g_gxState.zCompLocBeforeTex) {
+    config.shaderConfig.zTexture = (g_gxState.zTextureBias & 0x00FFFFFFu) |
+                                    ((static_cast<u32>(g_gxState.zTextureFmt) & 0x3u) << 24) |
+                                    ((static_cast<u32>(g_gxState.zTextureOp) & 0x3u) << 26);
+  }
+  for (u8 i = 0; i < g_gxState.numIndStages; ++i) {
+    config.shaderConfig.indStages[i] = g_gxState.indStages[i];
+  }
+  config.shaderConfig.numIndStages = g_gxState.numIndStages;
+  for (u8 i = 0; i < MaxColorChannels; ++i) {
+    const auto& cc = g_gxState.colorChannelConfig[i];
+    if (cc.lightingEnabled) {
+      config.shaderConfig.colorChannels[i] = cc;
+    } else {
+      // Only matSrc matters when lighting disabled
+      config.shaderConfig.colorChannels[i] = {
+          .matSrc = cc.matSrc,
+      };
+    }
+  }
+  for (u8 i = 0; i < MaxTexCoord; ++i) {
+    config.shaderConfig.tcgs[i].src = static_cast<GXTexGenSrc>(GX_TG_TEX0 + i);
+  }
+  for (u8 i = 0; i < g_gxState.numTexGens; ++i) {
+    config.shaderConfig.tcgs[i] = g_gxState.tcgs[i];
+  }
+  config.shaderConfig.alphaCompare = {};
+  if (g_gxState.alphaCompare) {
+    config.shaderConfig.alphaCompare = g_gxState.alphaCompare;
+  }
+  // The remaining fields are assigned in place.
+  config.version = GXPipelineConfigVersion;
+  config.msaaSamples = gfx::get_sample_count();
+  config.depthFunc = g_gxState.depthFunc;
+  config.cullMode = config.shaderConfig.lineMode == 0 ? g_gxState.cullMode : GX_CULL_NONE;
+  config.blendMode = g_gxState.blendMode;
+  config.blendFacSrc = g_gxState.blendFacSrc;
+  config.blendFacDst = g_gxState.blendFacDst;
+  config.blendOp = g_gxState.blendOp;
+  config.pixelFmt = g_gxState.pixelFmt;
+  config.dstAlpha = effective_dst_alpha(g_gxState.pixelFmt, g_gxState.alphaUpdate, g_gxState.dstAlpha);
+  config.depthCompare = g_gxState.depthCompare;
+  config.depthUpdate = g_gxState.depthUpdate;
+  config.alphaUpdate = effective_alpha_update(g_gxState.pixelFmt, g_gxState.alphaUpdate);
+  config.colorUpdate = g_gxState.colorUpdate;
+}
+
+static TextureBindGroupCacheKey make_texture_bind_group_cache_key(const ShaderInfo& info) noexcept {
+  TextureBindGroupCacheKey key{
+      .sampledTextures = info.sampledTextures.to_ullong(),
+      .sampledIndTextures = info.sampledIndTextures.to_ullong(),
+  };
+  for (u32 i = 0; i < MaxTextures; ++i) {
+    if (!info.sampledTextures[i] && !info.sampledIndTextures[i]) {
+      continue;
+    }
+    const auto& tex = g_gxState.textures[i];
+    if (!tex) {
+      continue;
+    }
+    const u32 refState = (tex.ref->isReplacement ? 1u : 0u) | (tex.ref->hasArbitraryMips ? 2u : 0u) |
+                         (tex.ref->mipCount << 8);
+    set_texture_bind_group_cache_slot(key, i, tex.ref->sampleTextureView.Get(), tex.texObj.mode0,
+                                      tex.texObj.mode1, refState);
+  }
+  return key;
+}
+
+static HashType hash_texture_bind_group_cache_key(const TextureBindGroupCacheKey& key) noexcept {
+  // The key is a 176-byte POD with no padding, so one hash over the whole thing replaces the six chained XXH3 calls this used to make per draw.
+  static_assert(std::has_unique_object_representations_v<TextureBindGroupCacheKey>);
+  return xxh3_hash(key);
+}
+
+static GXBindGroups build_bind_groups_uncached(const ShaderInfo& info) noexcept {
+  ZoneScoped;
+
+  if (!info.sampledTextures.any() && !info.sampledIndTextures.any()) {
+    // Don't bother re-binding anything
+    return {};
+  }
+
+  // Using C WGPU types instead of C++ wrappers to avoid destructor overhead
+  std::array<WGPUBindGroupEntry, MaxTextures * 2> textureEntries{};
+  for (u32 i = 0; i < MaxTextures; ++i) {
+    const auto& tex = g_gxState.textures[i];
+    WGPUBindGroupEntry& textureEntry = textureEntries[i * 2];
+    WGPUBindGroupEntry& samplerEntry = textureEntries[i * 2 + 1];
+    textureEntry.binding = i * 2;
+    samplerEntry.binding = i * 2 + 1;
+    if (tex && (info.sampledTextures[i] || info.sampledIndTextures[i])) {
+      textureEntry.textureView = tex.ref->sampleTextureView.Get();
+      samplerEntry.sampler = gfx::sampler_ref(tex.get_descriptor()).Get();
+    } else {
+      textureEntry.textureView = sEmptyTextureView.Get();
+      samplerEntry.sampler = sEmptySampler.Get();
+    }
+  }
+  const WGPUBindGroupDescriptor textureBindGroupDescriptor{
+      .label = {"GX Texture Bind Group", WGPU_STRLEN},
+      .layout = sTextureBindGroupLayout.Get(),
+      .entryCount = textureEntries.size(),
+      .entries = textureEntries.data(),
+  };
+  const auto ref = gfx::bind_group_ref(textureBindGroupDescriptor);
+  return {
+      .textureBindGroup = ref,
+      .resolvedTextureBindGroup = gfx::find_bind_group(ref).Get(),
+  };
+}
+
+GXBindGroups build_bind_groups(const ShaderInfo& info) noexcept {
+  ZoneScoped;
+
+  if (!info.sampledTextures.any() && !info.sampledIndTextures.any()) {
+    return {};
+  }
+
+  constexpr size_t CacheSize = 1024;
+  struct Entry {
+    bool valid = false;
+    u32 frame = 0;
+    HashType hash = 0;
+    TextureBindGroupCacheKey key{};
+    GXBindGroups bindGroups{};
+  };
+  static std::array<Entry, CacheSize> cache{};
+
+  const auto key = make_texture_bind_group_cache_key(info);
+  const HashType hash = hash_texture_bind_group_cache_key(key);
+  const u32 frame = gfx::current_frame();
+  auto& entry = cache[hash & (CacheSize - 1)];
+  if (entry.valid && entry.frame == frame && entry.hash == hash && entry.key == key) {
+    return entry.bindGroups;
+  }
+
+  const auto bindGroups = build_bind_groups_uncached(info);
+  entry.valid = true;
+  entry.frame = frame;
+  entry.hash = hash;
+  entry.key = key;
+  entry.bindGroups = bindGroups;
+  return bindGroups;
+}
+
+void initialize() noexcept {
+  {
+    std::array<wgpu::BindGroupLayoutEntry, MaxTextures * 2> textureEntries;
+    for (u32 i = 0; i < MaxTextures; ++i) {
+      textureEntries[i * 2] = {
+          .binding = i * 2,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .texture =
+              {
+                  .sampleType = wgpu::TextureSampleType::Float,
+                  .viewDimension = wgpu::TextureViewDimension::e2D,
+              },
+      };
+      textureEntries[i * 2 + 1] = {
+          .binding = i * 2 + 1,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .sampler = {.type = wgpu::SamplerBindingType::Filtering},
+      };
+    }
+    const wgpu::BindGroupLayoutDescriptor descriptor{
+        .label = "GX Texture Bind Group Layout",
+        .entryCount = textureEntries.size(),
+        .entries = textureEntries.data(),
+    };
+    sTextureBindGroupLayout = g_device.CreateBindGroupLayout(&descriptor);
+  }
+  {
+    constexpr wgpu::SamplerDescriptor descriptor{.label = "Empty sampler"};
+    sEmptySampler = gfx::sampler_ref(descriptor);
+  }
+  {
+    constexpr wgpu::TextureDescriptor descriptor{
+        .label = "Empty texture",
+        .usage = wgpu::TextureUsage::TextureBinding,
+        .size = {1, 1},
+        .format = wgpu::TextureFormat::RGBA8Unorm,
+    };
+    sEmptyTexture = g_device.CreateTexture(&descriptor);
+    sEmptyTextureView = sEmptyTexture.CreateView();
+  }
+  {
+    std::array<wgpu::BindGroupEntry, MaxTextures * 2> entries;
+    for (u32 i = 0; i < MaxTextures; ++i) {
+      entries[i * 2] = {
+          .binding = i * 2,
+          .textureView = sEmptyTextureView,
+      };
+      entries[i * 2 + 1] = {
+          .binding = i * 2 + 1,
+          .sampler = sEmptySampler,
+      };
+    }
+    const wgpu::BindGroupDescriptor desc{
+        .label = "GX Empty Texture Bind Group",
+        .layout = sTextureBindGroupLayout,
+        .entryCount = entries.size(),
+        .entries = entries.data(),
+    };
+    g_emptyTextureBindGroup = g_device.CreateBindGroup(&desc);
+  }
+  {
+    const std::array layouts{
+        gfx::g_staticBindGroupLayout,
+        gfx::g_uniformBindGroupLayout,
+        sTextureBindGroupLayout,
+    };
+    const wgpu::PipelineLayoutDescriptor desc{
+        .label = "GX Pipeline Layout",
+        .bindGroupLayoutCount = layouts.size(),
+        .bindGroupLayouts = layouts.data(),
+    };
+    sPipelineLayout = g_device.CreatePipelineLayout(&desc);
+  }
+}
+
+void shutdown() noexcept {
+  // TODO we should probably store this all in g_state.gx instead
+  sSamplerBindGroupLayout = {};
+  sTextureBindGroupLayout = {};
+  {
+    std::lock_guard lock{sBindGroupLayoutMutex};
+    sUniformBindGroupLayouts.clear();
+    sTextureBindGroupLayouts.clear();
+  }
+  for (auto& item : g_gxState.textures) {
+    item.ref.reset();
+  }
+  s_textureObjectCaches.clear();
+  s_tlutObjectCaches.clear();
+  s_staticTextureSourceCache.clear();
+  s_staticPaletteTextureSourceCache.clear();
+  s_texObjSourceKeys.clear();
+  s_texObjPaletteSourceKeys.clear();
+  s_texObjSourceKeyMemo.reset();
+  s_texObjPaletteSourceKeyMemo.reset();
+  clear_static_source_front_cache();
+  // The resolve identity cache holds texture references too; it is revision gated rather than cleared during normal operation, so it has to be dropped explicitly here.
+  for (auto& entry : s_textureResolveIdentityCache) {
+    entry.valid = false;
+    entry.binding.reset();
+  }
+  s_lastTextureResolveIdentityValid.fill(false);
+  s_lastStaticSourceResolveKeyValid.fill(false);
+  g_gxState.loadedTextures.fill({});
+  g_gxState.loadedTluts.fill({});
+  clear_copy_texture_cache();
+}
+} // namespace aurora::gx
+
+static wgpu::AddressMode wgpu_address_mode(GXTexWrapMode mode) {
+  switch (mode) {
+    DEFAULT_FATAL("invalid wrap mode {}", underlying(mode));
+  case GX_CLAMP:
+    return wgpu::AddressMode::ClampToEdge;
+  case GX_REPEAT:
+    return wgpu::AddressMode::Repeat;
+  case GX_MIRROR:
+    return wgpu::AddressMode::MirrorRepeat;
+  }
+}
+
+static std::pair<wgpu::FilterMode, wgpu::MipmapFilterMode> wgpu_filter_mode(GXTexFilter filter) {
+  switch (filter) {
+    DEFAULT_FATAL("invalid filter mode {}", static_cast<int>(filter));
+  case GX_NEAR:
+    return {wgpu::FilterMode::Nearest, wgpu::MipmapFilterMode::Undefined};
+  case GX_LINEAR:
+    return {wgpu::FilterMode::Linear, wgpu::MipmapFilterMode::Undefined};
+  case GX_NEAR_MIP_NEAR:
+    return {wgpu::FilterMode::Nearest, wgpu::MipmapFilterMode::Nearest};
+  case GX_LIN_MIP_NEAR:
+    return {wgpu::FilterMode::Linear, wgpu::MipmapFilterMode::Nearest};
+  case GX_NEAR_MIP_LIN:
+    return {wgpu::FilterMode::Nearest, wgpu::MipmapFilterMode::Linear};
+  case GX_LIN_MIP_LIN:
+    return {wgpu::FilterMode::Linear, wgpu::MipmapFilterMode::Linear};
+  }
+}
+
+static u16 wgpu_aniso(GXAnisotropy aniso) {
+  switch (aniso) {
+    DEFAULT_FATAL("invalid aniso {}", static_cast<int>(aniso));
+  case GX_ANISO_1:
+  case GX_MAX_ANISOTROPY:
+    return 1;
+  case GX_ANISO_2:
+    return std::max<u16>(aurora::webgpu::g_graphicsConfig.textureAnisotropy / 2, 1);
+  case GX_ANISO_4:
+    return std::max<u16>(aurora::webgpu::g_graphicsConfig.textureAnisotropy, 1);
+  }
+}
+
+static bool supports_wgpu_aniso(wgpu::FilterMode magFilter, wgpu::FilterMode minFilter,
+                                wgpu::MipmapFilterMode mipFilter) {
+  return magFilter == wgpu::FilterMode::Linear && minFilter == wgpu::FilterMode::Linear &&
+         mipFilter == wgpu::MipmapFilterMode::Linear;
+}
+
+wgpu::SamplerDescriptor aurora::gfx::TextureBind::get_descriptor() const noexcept {
+  auto [minFilter, mipFilter] = wgpu_filter_mode(texObj.min_filter());
+  const auto [magFilter, _] = wgpu_filter_mode(texObj.mag_filter());
+  float minLod = texObj.min_lod();
+  float maxLod = texObj.max_lod();
+  if (ref && ref->isReplacement) {
+    minFilter = wgpu::FilterMode::Linear;
+    mipFilter = wgpu::MipmapFilterMode::Linear;
+    minLod = 0.f;
+    maxLod = static_cast<float>(std::max(ref->mipCount, 1u) - 1u);
+  } else if (ref && ref->hasArbitraryMips && mipFilter != wgpu::MipmapFilterMode::Undefined) {
+    mipFilter = wgpu::MipmapFilterMode::Linear;
+  } else if (mipFilter == wgpu::MipmapFilterMode::Undefined) {
+    minLod = 0.f;
+    maxLod = 0.f;
+  }
+  u16 maxAnisotropy = wgpu_aniso(texObj.max_aniso());
+  if (maxAnisotropy > 1 && !supports_wgpu_aniso(magFilter, minFilter, mipFilter)) {
+    maxAnisotropy = 1;
+  }
+  return {
+      .label = "Generated Filtering Sampler",
+      .addressModeU = wgpu_address_mode(texObj.wrap_s()),
+      .addressModeV = wgpu_address_mode(texObj.wrap_t()),
+      .addressModeW = wgpu::AddressMode::Repeat,
+      .magFilter = magFilter,
+      .minFilter = minFilter,
+      .mipmapFilter = mipFilter,
+      .lodMinClamp = minLod,
+      .lodMaxClamp = maxLod,
+      .maxAnisotropy = maxAnisotropy,
+  };
+} // namespace aurora::gx
diff --git a/aurora-main/lib/gx/gx.hpp b/aurora-main/lib/gx/gx.hpp
new file mode 100644
index 0000000..185e0851
--- /dev/null
+++ b/aurora-main/lib/gx/gx.hpp
@@ -0,0 +1,767 @@
+#pragma once
+#include <dolphin/gx.h>
+#include <aurora/math.hpp>
+
+#include "../internal.hpp"
+#include "../gfx/common.hpp"
+#include "../gfx/texture.hpp"
+
+#include <absl/container/flat_hash_map.h>
+#include <algorithm>
+#include <type_traits>
+#include <cstring>
+#include <bitset>
+#include <memory>
+#include <array>
+#include <cfloat>
+#include <cmath>
+
+#define M_PIF 3.14159265358979323846f
+
+namespace GX {
+constexpr u8 MaxLights = 8;
+using LightMask = std::bitset<MaxLights>;
+} // namespace GX
+
+struct GXLightObj_ {
+  GXColor color;
+  float a0 = 1.f;
+  float a1 = 0.f;
+  float a2 = 0.f;
+  float k0 = 1.f;
+  float k1 = 0.f;
+  float k2 = 0.f;
+  float px = 0.f;
+  float py = 0.f;
+  float pz = 0.f;
+  float nx = 0.f;
+  float ny = 0.f;
+  float nz = 0.f;
+};
+static_assert(sizeof(GXLightObj_) <= sizeof(GXLightObj), "GXLightObj too small!");
+
+#if GX_IS_WII
+constexpr float GX_LARGE_NUMBER = -1.0e+18f;
+#else
+constexpr float GX_LARGE_NUMBER = -1048576.0f;
+#endif
+
+namespace aurora::gx {
+constexpr bool UsePerPixelLighting = false;
+constexpr bool UseReversedZ = true;
+
+constexpr u32 MaxTextures = GX_MAX_TEXMAP;
+constexpr u32 MaxTluts = 20;
+constexpr u32 MaxTevStages = GX_MAX_TEVSTAGE;
+constexpr u32 MaxColorChannels = 4;
+constexpr u32 MaxTevRegs = 4; // TEVPREV, TEVREG0-2
+constexpr u32 MaxKColors = GX_MAX_KCOLOR;
+constexpr u32 MaxTexMtx = 10;
+constexpr u32 MaxPTTexMtx = 20;
+constexpr u32 MaxTexCoord = GX_MAX_TEXCOORD;
+constexpr u32 MaxVtxAttr = GX_VA_MAX_ATTR;
+constexpr u32 MaxTevSwap = GX_MAX_TEVSWAP;
+constexpr u32 MaxIndStages = GX_MAX_INDTEXSTAGE;
+constexpr u32 MaxIndTexMtxs = 3;
+constexpr u32 MaxVtxFmt = GX_MAX_VTXFMT;
+constexpr u32 MaxPnMtx = (GX_PNMTX9 / 3) + 1;
+// Position and texture matrices share one shader array (`ubuf.postex_mtx`), mirroring XF matrix memory: rows 0..29 (slots 0..9) are position matrices and rows 30..59 (slots 10..19) are texture matrices.
+constexpr u32 MaxPostexMtx = MaxPnMtx + MaxTexMtx;
+constexpr u32 MaxIndexAttr = 12; // VA_POS -> VA_TEX7
+constexpr u32 MaxUniformSize = 3840;
+
+extern wgpu::BindGroup g_emptyTextureBindGroup;
+
+template <typename Arg, Arg Default>
+struct TevPass {
+  Arg a = Default;
+  Arg b = Default;
+  Arg c = Default;
+  Arg d = Default;
+
+  bool operator==(const TevPass& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+  bool operator!=(const TevPass& rhs) const { return !(*this == rhs); }
+};
+static_assert(std::has_unique_object_representations_v<TevPass<GXTevColorArg, GX_CC_ZERO>>);
+static_assert(std::has_unique_object_representations_v<TevPass<GXTevAlphaArg, GX_CA_ZERO>>);
+struct TevOp {
+  GXTevOp op = GX_TEV_ADD;
+  GXTevBias bias = GX_TB_ZERO;
+  GXTevScale scale = GX_CS_SCALE_1;
+  GXTevRegID outReg = GX_TEVPREV;
+  bool clamp = true;
+  u8 _p1 = 0;
+  u8 _p2 = 0;
+  u8 _p3 = 0;
+
+  bool operator==(const TevOp& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+  bool operator!=(const TevOp& rhs) const { return !(*this == rhs); }
+};
+static_assert(std::has_unique_object_representations_v<TevOp>);
+struct TevStage {
+  TevPass<GXTevColorArg, GX_CC_ZERO> colorPass;
+  TevPass<GXTevAlphaArg, GX_CA_ZERO> alphaPass;
+  TevOp colorOp;
+  TevOp alphaOp;
+  GXTevKColorSel kcSel = GX_TEV_KCSEL_1;
+  GXTevKAlphaSel kaSel = GX_TEV_KASEL_1;
+  GXTexCoordID texCoordId = GX_TEXCOORD_NULL;
+  GXTexMapID texMapId = GX_TEXMAP_NULL;
+  GXChannelID channelId = GX_COLOR_NULL;
+  GXTevSwapSel tevSwapRas = GX_TEV_SWAP0;
+  GXTevSwapSel tevSwapTex = GX_TEV_SWAP0;
+  GXIndTexStageID indTexStage = GX_INDTEXSTAGE0;
+  GXIndTexFormat indTexFormat = GX_ITF_8;
+  GXIndTexBiasSel indTexBiasSel = GX_ITB_NONE;
+  GXIndTexAlphaSel indTexAlphaSel = GX_ITBA_OFF;
+  GXIndTexMtxID indTexMtxId = GX_ITM_OFF;
+  GXIndTexWrap indTexWrapS = GX_ITW_OFF;
+  GXIndTexWrap indTexWrapT = GX_ITW_OFF;
+  bool indTexUseOrigLOD = false;
+  bool indTexAddPrev = false;
+  u8 _p1 = 0;
+  u8 _p2 = 0;
+
+  bool operator==(const TevStage& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+  bool operator!=(const TevStage& rhs) const { return !(*this == rhs); }
+};
+static_assert(std::has_unique_object_representations_v<TevStage>);
+struct IndStage {
+  GXTexCoordID texCoordId;
+  GXTexMapID texMapId;
+  GXIndTexScale scaleS;
+  GXIndTexScale scaleT;
+};
+static_assert(std::has_unique_object_representations_v<IndStage>);
+// For shader generation
+struct ColorChannelConfig {
+  GXColorSrc matSrc = GX_SRC_REG;
+  GXColorSrc ambSrc = GX_SRC_REG;
+  GXDiffuseFn diffFn = GX_DF_NONE;
+  GXAttnFn attnFn = GX_AF_NONE;
+  bool lightingEnabled = false;
+  u8 _p1 = 0;
+  u8 _p2 = 0;
+  u8 _p3 = 0;
+
+  bool operator==(const ColorChannelConfig& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+  bool operator!=(const ColorChannelConfig& rhs) const { return !(*this == rhs); }
+};
+static_assert(std::has_unique_object_representations_v<ColorChannelConfig>);
+// For uniform generation
+struct ColorChannelState {
+  Vec4<float> matColor;
+  Vec4<float> ambColor;
+  GX::LightMask lightMask;
+};
+struct TcgConfig {
+  GXTexGenType type = GX_TG_MTX2x4;
+  GXTexGenSrc src = GX_MAX_TEXGENSRC;
+  GXTexMtx mtx = GX_IDENTITY;
+  GXPTTexMtx postMtx = GX_PTIDENTITY;
+  bool normalize = false;
+  bool inputFormAB11 = false;
+  u8 _p2 = 0;
+  u8 _p3 = 0;
+
+  bool operator==(const TcgConfig& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+  bool operator!=(const TcgConfig& rhs) const { return !(*this == rhs); }
+};
+static_assert(std::has_unique_object_representations_v<TcgConfig>);
+struct FogState {
+  GXFogType type = GX_FOG_NONE;
+  float a = 0.f;
+  float b = 0.5f;
+  float c = 0.f;
+  float aRaw = 0.f;
+  Vec4<float> color;
+  // Raw encoded register values for A/B reconstruction across separate BP writes
+  u32 fog0Raw = 0; // 0xEE: encoded A parameter
+  u32 fog1Raw = 0; // 0xEF: B mantissa
+  u32 fog2Raw = 0; // 0xF0: B shift
+  u32 bMagnitude = 1;
+  u32 bShift = 1;
+
+  bool operator==(const FogState& rhs) const {
+    return type == rhs.type && a == rhs.a && b == rhs.b && c == rhs.c && aRaw == rhs.aRaw && color == rhs.color &&
+           bMagnitude == rhs.bMagnitude && bShift == rhs.bShift;
+  }
+  bool operator!=(const FogState& rhs) const { return !(*this == rhs); }
+};
+struct TevSwap {
+  GXTevColorChan red = GX_CH_RED;
+  GXTevColorChan green = GX_CH_GREEN;
+  GXTevColorChan blue = GX_CH_BLUE;
+  GXTevColorChan alpha = GX_CH_ALPHA;
+
+  bool operator==(const TevSwap& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+  bool operator!=(const TevSwap& rhs) const { return !(*this == rhs); }
+  explicit operator bool() const { return !(*this == TevSwap{}); }
+};
+static_assert(std::has_unique_object_representations_v<TevSwap>);
+struct AlphaCompare {
+  GXCompare comp0 = GX_ALWAYS;
+  u32 ref0 = 0; // would be u8 but extended to avoid padding bytes
+  GXAlphaOp op = GX_AOP_AND;
+  GXCompare comp1 = GX_ALWAYS;
+  u32 ref1 = 0;
+
+  bool operator==(const AlphaCompare& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+  bool operator!=(const AlphaCompare& rhs) const { return !(*this == rhs); }
+  explicit operator bool() const { return comp0 != GX_ALWAYS || comp1 != GX_ALWAYS; }
+};
+static_assert(std::has_unique_object_representations_v<AlphaCompare>);
+struct IndTexMtxInfo {
+  Mat3x2<float> mtx;
+  s8 scaleExp = 0;
+  // Accumulated adjScale bits from BP registers (2 bits per row, 3 rows)
+  u8 adjScaleRaw = 0;
+
+  bool operator==(const IndTexMtxInfo& rhs) const { return mtx == rhs.mtx && scaleExp == rhs.scaleExp; }
+  bool operator!=(const IndTexMtxInfo& rhs) const { return !(*this == rhs); }
+};
+struct TexCoordScale {
+  u16 scaleS = 0; // texture width - 1
+  u16 scaleT = 0; // texture height - 1
+  bool biasS = false;
+  bool biasT = false;
+  bool cylWrapS = false;
+  bool cylWrapT = false;
+  bool lineOffset = false;
+  bool pointOffset = false;
+
+  bool operator==(const TexCoordScale& rhs) const {
+    return scaleS == rhs.scaleS && scaleT == rhs.scaleT && biasS == rhs.biasS && biasT == rhs.biasT &&
+           cylWrapS == rhs.cylWrapS && cylWrapT == rhs.cylWrapT && lineOffset == rhs.lineOffset &&
+           pointOffset == rhs.pointOffset;
+  }
+  bool operator!=(const TexCoordScale& rhs) const { return !(*this == rhs); }
+};
+struct VtxAttrFmt {
+  GXCompCnt cnt;
+  GXCompType type;
+  u8 frac;
+  u8 _p1 = 0;
+  u8 _p2 = 0;
+  u8 _p3 = 0;
+};
+static_assert(std::has_unique_object_representations_v<VtxAttrFmt>);
+struct VtxFmt {
+  std::array<VtxAttrFmt, MaxVtxAttr> attrs;
+};
+static_assert(std::has_unique_object_representations_v<VtxFmt>);
+struct PnMtx {
+  Mat3x4<float> pos;
+  Mat3x4<float> nrm;
+};
+static_assert(sizeof(PnMtx) == sizeof(Mat3x4<float>) * 2);
+struct Light {
+  Vec4<float> pos{0.f, 0.f, 0.f};
+  Vec4<float> dir{0.f, 0.f, 0.f};
+  Vec4<float> color{0.f, 0.f, 0.f, 0.f};
+  Vec4<float> cosAtt{0.f, 0.f, 0.f};
+  Vec4<float> distAtt{0.f, 0.f, 0.f};
+
+  bool operator==(const Light& rhs) const {
+    return pos == rhs.pos && dir == rhs.dir && color == rhs.color && cosAtt == rhs.cosAtt && distAtt == rhs.distAtt;
+  }
+  bool operator!=(const Light& rhs) const { return !(*this == rhs); }
+};
+static_assert(sizeof(Light) == 80);
+struct Fog {
+  Vec4<float> color;
+  float a = 0.f;
+  float b = 0.5f;
+  float c = 0.f;
+  float pad = FLT_MAX;
+  Vec4<float> rangeBase;
+  std::array<Vec4<float>, 3> rangeK;
+};
+static_assert(sizeof(Fog) == 96);
+struct AttrArray {
+  const void* data;
+  u32 size;
+  u8 stride;
+  bool le = true;
+  gfx::Range cachedRange;
+};
+inline bool operator==(const AttrArray& lhs, const AttrArray& rhs) {
+  return lhs.data == rhs.data && lhs.size == rhs.size && lhs.stride == rhs.stride && lhs.le == rhs.le;
+}
+inline bool operator!=(const AttrArray& lhs, const AttrArray& rhs) { return !(lhs == rhs); }
+
+// Stamps GXState::pipelineStateGeneration, both when a GXState is constructed and on every pipeline-state write.
+inline u32 next_gx_state_epoch() noexcept {
+  static u32 epoch = 0;
+  return ++epoch;
+}
+
+struct GXState {
+  struct CopyTextureRef {
+    gfx::TextureHandle handle;
+    u32 revision = 0;
+    u32 lastProducedFrame = 0;
+    u32 lastSampledFrame = 0;
+    u32 width = 0;
+    u32 height = 0;
+    u32 dataSize = 0;
+    GXTexFmt format = GX_TF_I4;
+    bool sampledThisFrame = false;
+
+    operator bool() const noexcept { return handle.operator bool(); }
+  };
+  std::array<PnMtx, MaxPnMtx> pnMtx;
+  u32 currentPnMtx;
+  Mat4x4<float> proj;
+  GXProjectionType projType; // for GXGetProjectionv
+  FogState fog;
+  GXCullMode cullMode = GX_CULL_BACK;
+  u8 lineWidth = 0;
+  u8 pointSize = 0;
+  GXTexOffset lineTexOffset = GX_TO_ZERO;
+  GXTexOffset pointTexOffset = GX_TO_ZERO;
+  bool lineHalfAspect = false;
+  GXBlendMode blendMode = GX_BM_NONE;
+  GXBlendFactor blendFacSrc = GX_BL_SRCALPHA;
+  GXBlendFactor blendFacDst = GX_BL_INVSRCALPHA;
+  GXLogicOp blendOp = GX_LO_CLEAR;
+  GXCompare depthFunc = GX_LEQUAL;
+  Vec4<float> clearColor{0.f, 0.f, 0.f, 1.f};
+  u32 clearDepth = 0xFFFFFF;
+  GXPixelFmt pixelFmt = GX_PF_RGB8_Z24;
+  GXZFmt16 zFmt = GX_ZC_LINEAR;
+  bool zCompLocBeforeTex = false;
+  GXZTexOp zTextureOp = GX_ZT_DISABLE;
+  u8 zTextureFmt = 0;
+  u32 zTextureBias = 0;
+  u32 dstAlpha; // u8; UINT32_MAX = disabled
+  AlphaCompare alphaCompare;
+  std::array<Vec4<float>, MaxTevRegs> colorRegs;
+  std::array<Vec4<float>, GX_MAX_KCOLOR> kcolors;
+  std::array<ColorChannelConfig, MaxColorChannels> colorChannelConfig;
+  std::array<ColorChannelState, MaxColorChannels> colorChannelState;
+  std::array<Light, GX::MaxLights> lights;
+  // Light direction sanitization/normalization is independent of the draw.
+  std::array<Light, GX::MaxLights> preparedLights;
+  bool preparedLightsDirty = true;
+  std::array<TevStage, MaxTevStages> tevStages;
+  std::array<gfx::TextureBind, MaxTextures> textures;
+  std::array<GXTexObj_, MaxTextures> loadedTextures;
+  std::array<GXTlutObj_, MaxTluts> loadedTluts;
+  AuroraViewportPolicy viewportPolicy = AURORA_VIEWPORT_FIT;
+  gfx::Viewport logicalViewport{0.f, 0.f, 640.f, 480.f, 0.f, 1.f};
+  gfx::Viewport renderViewport{0.f, 0.f, 640.f, 480.f, 0.f, 1.f};
+  gfx::ClipRect logicalScissor{0, 0, 640, 480};
+  gfx::ClipRect renderScissor{0, 0, 640, 480};
+  std::array<float, 6> xfViewport{320.f, -240.f, 16777215.f, 660.f, 580.f, 16777215.f};
+  std::array<float, 6> xfProjection{};
+  std::array<Mat3x4<float>, MaxTexMtx> texMtxs;
+  std::array<Mat3x4<float>, MaxPTTexMtx> ptTexMtxs;
+  std::array<TcgConfig, MaxTexCoord> tcgs;
+  std::array<TexCoordScale, MaxTexCoord> texCoordScales;
+  u16 lastVtxSize = 0;
+  GXVtxFmt lastVtxFmt = GX_MAX_VTXFMT;
+  std::array<GXAttrType, MaxVtxAttr> vtxDesc;
+  std::array<GXAttrType, MaxVtxAttr> sourceVtxDesc;
+  std::array<VtxFmt, MaxVtxFmt> vtxFmts;
+  std::array<TevSwap, MaxTevSwap> tevSwapTable{
+      TevSwap{},
+      TevSwap{GX_CH_RED, GX_CH_RED, GX_CH_RED, GX_CH_ALPHA},
+      TevSwap{GX_CH_GREEN, GX_CH_GREEN, GX_CH_GREEN, GX_CH_ALPHA},
+      TevSwap{GX_CH_BLUE, GX_CH_BLUE, GX_CH_BLUE, GX_CH_ALPHA},
+  };
+  std::array<IndStage, MaxIndStages> indStages;
+  std::array<IndTexMtxInfo, MaxIndTexMtxs> indTexMtxs;
+  u8 indTexMask = 0;
+  std::array<u16, 4> boundingBox{1023, 0, 1023, 0};
+  std::array<AttrArray, MaxVtxAttr> arrays;
+  gfx::ClipRect texCopySrc;
+  gfx::ClipRect dispCopySrc;
+  bool texCopySrcRenderSpace = false;
+  GXTexFmt texCopyFmt;
+  u16 texCopyDstWidth = 0;
+  u16 texCopyDstHeight = 0;
+  bool texCopyHalfScale = false;
+  u16 dispCopyDstWidth = 640;
+  u16 dispCopyDstHeight = 480;
+  f32 dispCopyYScale = 1.f;
+  GXGamma dispCopyGamma = GX_GM_1_0;
+  GXBool copyFilterAa = GX_FALSE;
+  GXBool copyFilterVf = GX_FALSE;
+  std::array<std::array<u8, 2>, 12> copyFilterSamplePattern{};
+  std::array<u8, 7> copyFilterVFilter{};
+  GXFBClamp copyClamp = GX_CLAMP_NONE;
+  u32 dispCopyFrame2Field = 0;
+  u32 fieldMask = 0;
+  u32 fieldMode = 0;
+  u32 revBits = 0;
+  std::array<u32, 6> fogRange{};
+  u32 xfError = 0;
+  u32 dualTex = 0;
+  float zScale = 1.f;
+  float zOffset = 0.f;
+  s32 scissorOffsetX = 0;
+  s32 scissorOffsetY = 0;
+  struct CopyTextureKey {
+    const void* dest = nullptr;
+    u32 width = 0;
+    u32 height = 0;
+    GXTexFmt format = GX_TF_I4;
+
+    bool operator==(const CopyTextureKey& rhs) const {
+      return dest == rhs.dest && width == rhs.width && height == rhs.height && format == rhs.format;
+    }
+
+    template <typename H>
+    friend H AbslHashValue(H h, const CopyTextureKey& key) {
+      return H::combine(std::move(h), key.dest, key.width, key.height, key.format);
+    }
+  };
+  absl::flat_hash_map<const void*, CopyTextureRef> copyTextures;
+  absl::flat_hash_map<CopyTextureKey, CopyTextureRef> copyTextureCache;
+  gfx::TextureHandle displayCopyTexture;
+  wgpu::BindGroup displayCopyBindGroup;
+  u32 displayCopyWidth = 0;
+  u32 displayCopyHeight = 0;
+  bool depthCompare = true;
+  bool depthUpdate = true;
+  bool colorUpdate = true;
+  bool alphaUpdate = true;
+  u8 numChans = 0;
+  u8 numIndStages = 0;
+  u8 numTevStages = 0;
+  u8 numTexGens = 0;
+  bool stateDirty = true;
+  // Bumped by the decoded register writes that feed populate_pipeline_config, and by nothing else.
+  u32 pipelineStateGeneration = next_gx_state_epoch();
+  std::array<u32, 0x100> bpRegCache = [] {
+    std::array<u32, 0x100> regs{};
+    regs[0xFE] = 0x00FFFFFF;
+    return regs;
+  }();
+  // Covers XF 0x00-0x5F: the scalar bank, viewport/projection, and the TexGen and post-transform registers that every material's display list re-emits.
+  std::array<u32, 0x60> xfRegCache{};
+  std::array<u64, 2> xfRegCacheValid{};
+
+  [[nodiscard]] bool xfRegMatches(u32 reg, u32 val) const {
+    return (xfRegCacheValid[reg >> 6] >> (reg & 63) & 1) != 0 && xfRegCache[reg] == val;
+  }
+  void storeXfReg(u32 reg, u32 val) {
+    xfRegCache[reg] = val;
+    xfRegCacheValid[reg >> 6] |= u64{1} << (reg & 63);
+  }
+  // For state that another register bank writes behind the XF cache's back.
+  void invalidateXfReg(u32 reg) { xfRegCacheValid[reg >> 6] &= ~(u64{1} << (reg & 63)); }
+
+  void clearVtxSizeCache() { lastVtxFmt = GX_MAX_VTXFMT; }
+};
+extern GXState g_gxState;
+struct ShaderInfo;
+struct MappedRenderState {
+  gfx::Viewport viewport{};
+  gfx::ClipRect scissor{};
+};
+
+void initialize() noexcept;
+void shutdown() noexcept;
+void clear_copy_texture_cache() noexcept;
+void clear_display_copy_cache() noexcept;
+void set_display_copy_present_source() noexcept;
+void evict_copy_texture(const void* dest) noexcept;
+// Drops retired GX copy targets so they cannot outlive the destination they were recycled for.
+void prune_copy_texture_pool(const void* dest) noexcept;
+void evict_texture_object(u32 texObjId) noexcept;
+void evict_tlut_object(u32 tlutObjId) noexcept;
+void invalidate_static_texture_cache() noexcept;
+Vec2<uint32_t> logical_fb_size() noexcept;
+MappedRenderState map_logical_render_state() noexcept;
+gfx::Viewport map_logical_viewport(const gfx::Viewport& logicalViewport) noexcept;
+gfx::ClipRect map_logical_scissor(const gfx::ClipRect& logicalScissor) noexcept;
+void set_logical_viewport(const gfx::Viewport& viewport) noexcept;
+void set_render_viewport(const gfx::Viewport& viewport) noexcept;
+void set_logical_scissor(const gfx::ClipRect& scissor) noexcept;
+void set_render_scissor(const gfx::ClipRect& scissor) noexcept;
+const gfx::TextureBind& get_texture(GXTexMapID id) noexcept;
+void resolve_sampled_textures(const ShaderInfo& info) noexcept;
+
+inline float clear_depth_value() {
+  return std::min(static_cast<float>(g_gxState.clearDepth) / 16777216.f, 16777215.f / 16777216.f);
+}
+
+inline bool render_target_has_alpha(GXPixelFmt pixelFmt) noexcept { return pixelFmt == GX_PF_RGBA6_Z24; }
+
+inline float indirect_matrix_scale_multiplier(s8 scaleExp) {
+  return std::exp2f(static_cast<float>(scaleExp));
+}
+
+inline s32 indirect_matrix_mantissa(float value) noexcept {
+  return static_cast<s32>(std::lround(value * 1024.0f));
+}
+
+inline s32 indirect_matrix_shift(s8 scaleExp) noexcept { return -static_cast<s32>(scaleExp); }
+
+static inline bool is_palette_format(u32 fmt) { return fmt == GX_TF_C4 || fmt == GX_TF_C8 || fmt == GX_TF_C14X2; }
+static inline bool is_depth_format(u32 fmt) {
+  return fmt == GX_TF_Z8 || fmt == GX_TF_Z16 || fmt == GX_TF_Z24X8 || fmt == GX_CTF_Z4 || fmt == GX_CTF_Z8M ||
+         fmt == GX_CTF_Z8L || fmt == GX_CTF_Z16L;
+}
+static inline bool copy_texture_format_compatible(GXTexFmt copyFmt, u32 sampleFmt) noexcept {
+  if (static_cast<u32>(copyFmt) == sampleFmt) {
+    return true;
+  }
+
+  switch (copyFmt) {
+  case GX_CTF_R4:
+    return sampleFmt == GX_TF_I4;
+  case GX_CTF_R8:
+  case GX_CTF_G8:
+  case GX_CTF_B8:
+  case GX_CTF_A8:
+    return sampleFmt == GX_TF_I8 || sampleFmt == GX_TF_A8;
+  case GX_CTF_RA4:
+    return sampleFmt == GX_TF_IA4;
+  case GX_CTF_RA8:
+  case GX_CTF_RG8:
+  case GX_CTF_GB8:
+  case GX_TF_Z16:
+    return sampleFmt == GX_TF_IA8;
+  case GX_CTF_YUVA8:
+    return sampleFmt == GX_TF_RGBA8;
+  case GX_TF_Z24X8:
+    return sampleFmt == GX_TF_RGBA8;
+  default:
+    return false;
+  }
+}
+
+struct AttrConfig {
+  u8 attrType = GX_NONE; // GXAttrType
+  u8 cnt = 0xFF;         // Actual count; not GXCompCnt
+  u8 compType = 0xFF;    // GXCompType
+  u8 offset = 0;         // Offset within vertex
+  u8 stride = 0;         // Array stride
+  u8 frac = 0;
+  bool le = true;
+  u8 nrmIndexCount = 0;  // GX_NRM_NBT3 stores three separate normal/tangent/binormal indices.
+};
+struct ShaderConfig {
+  u8 fogType = GX_FOG_NONE;
+  u8 vtxStride = 0;
+  u8 lineMode : 2 = 0; // 1 = GX_LINES, 2 = GX_LINESTRIP, 3 = GX_POINTS
+  u8 dualTexEnabled : 1 = 0;
+  u8 fogRangeAdjust : 1 = 0;
+  u8 pad1 : 4 = 0;
+  u8 numTexGens = 0;
+  u32 zTexture = 0; // bias[0:23], format[24:25], op[26:27]; 0 disables shader depth output.
+  std::array<AttrConfig, MaxVtxAttr> attrs;
+  std::array<TevSwap, MaxTevSwap> tevSwapTable;
+  std::array<TevStage, MaxTevStages> tevStages;
+  u32 tevStageCount = 0;
+  std::array<ColorChannelConfig, MaxColorChannels> colorChannels;
+  std::array<TcgConfig, MaxTexCoord> tcgs;
+  AlphaCompare alphaCompare;
+  std::array<IndStage, MaxIndStages> indStages{};
+  u32 numIndStages = 0;
+
+  bool operator==(const ShaderConfig& rhs) const { return memcmp(this, &rhs, sizeof(*this)) == 0; }
+};
+static_assert(std::has_unique_object_representations_v<ShaderConfig>);
+
+// GX supplies an opaque white color when a draw omits vertex colors.
+inline int shader_vertex_color_attr(const ShaderConfig& config, u32 channel) noexcept {
+  const bool hasColor0 = config.attrs[GX_VA_CLR0].attrType != GX_NONE;
+  const bool hasColor1 = config.attrs[GX_VA_CLR1].attrType != GX_NONE;
+  if (channel == 0) {
+    if (hasColor0) {
+      return GX_VA_CLR0;
+    }
+    if (hasColor1) {
+      return GX_VA_CLR1;
+    }
+  } else if (channel == 1 && hasColor0 && hasColor1) {
+    return GX_VA_CLR1;
+  }
+  return -1;
+}
+
+// The indirect TEV coordinate is persistent across stages.
+inline bool tev_stage_needs_fixed_texcoord_state(const ShaderConfig& config, u32 stageIdx) noexcept {
+  if (stageIdx >= config.tevStageCount) {
+    return false;
+  }
+
+  const auto& stage = config.tevStages[stageIdx];
+  const bool hasCoordOperation = stage.indTexMtxId != GX_ITM_OFF || stage.indTexWrapS != GX_ITW_OFF ||
+                                 stage.indTexWrapT != GX_ITW_OFF || stage.indTexAddPrev;
+  const bool feedsNextAddPrev =
+      stageIdx + 1 < config.tevStageCount && config.tevStages[stageIdx + 1].indTexAddPrev;
+  return hasCoordOperation || feedsNextAddPrev;
+}
+
+inline bool tev_stage_has_texture_map(const TevStage& stage) noexcept {
+  return stage.texMapId != GX_TEXMAP_NULL && stage.texMapId < MaxTextures;
+}
+
+// Returns -1 for GX_ITW_OFF, an integer fixed-point mask for the wrapping modes, and 0 for GX_ITW_0.
+inline int tev_indirect_wrap_mask(GXIndTexWrap wrap) noexcept {
+  switch (wrap) {
+  case GX_ITW_OFF:
+    return -1;
+  case GX_ITW_256:
+    return (256 << 7) - 1;
+  case GX_ITW_128:
+    return (128 << 7) - 1;
+  case GX_ITW_64:
+    return (64 << 7) - 1;
+  case GX_ITW_32:
+    return (32 << 7) - 1;
+  case GX_ITW_16:
+    return (16 << 7) - 1;
+  case GX_ITW_0:
+    return 0;
+  default:
+    return underlying(wrap) >= underlying(GX_ITW_0) ? 0 : -2;
+  }
+}
+
+inline constexpr s32 tev_s24_wrap(s32 value) noexcept {
+  const u32 wrapped = static_cast<u32>(value) & 0x00ffffffu;
+  return (wrapped & 0x00800000u) != 0 ? static_cast<s32>(wrapped) - 0x01000000
+                                      : static_cast<s32>(wrapped);
+}
+
+// GX falls back to texcoord 0 when a TEV order names GX_TEXCOORD_NULL or a coordinate beyond the configured texgen count.
+inline int tev_effective_texcoord(const ShaderConfig& config, GXTexCoordID texCoordId) noexcept {
+  if (config.numTexGens == 0) {
+    return -1;
+  }
+
+  const u32 rawTexCoord = underlying(texCoordId);
+  return rawTexCoord < config.numTexGens && rawTexCoord < MaxTexCoord ? static_cast<int>(rawTexCoord) : 0;
+}
+
+inline bool tev_stage_combiner_uses_texture(const TevStage& stage) noexcept {
+  const auto& color = stage.colorPass;
+  const auto& alpha = stage.alphaPass;
+  return color.a == GX_CC_TEXC || color.a == GX_CC_TEXA || color.b == GX_CC_TEXC ||
+         color.b == GX_CC_TEXA || color.c == GX_CC_TEXC || color.c == GX_CC_TEXA ||
+         color.d == GX_CC_TEXC || color.d == GX_CC_TEXA || alpha.a == GX_CA_TEXA ||
+         alpha.b == GX_CA_TEXA || alpha.c == GX_CA_TEXA || alpha.d == GX_CA_TEXA;
+}
+
+struct TevStageTextureDependency {
+  int texCoordId = -1;
+  int texMapId = -1;
+  bool needsFixedTexcoordState = false;
+  bool combinerUsesTexture = false;
+  bool canSampleTexture = false;
+};
+
+inline bool tev_texture_sample_enabled(const TevStageTextureDependency& dependency,
+                                       bool sampleRequested) noexcept {
+  return sampleRequested && dependency.canSampleTexture;
+}
+
+// Pure TEV order/dependency analysis used by both ShaderInfo and WGSL generation.
+inline TevStageTextureDependency tev_stage_texture_dependency(const ShaderConfig& config,
+                                                               u32 stageIdx) noexcept {
+  if (stageIdx >= config.tevStageCount) {
+    return {};
+  }
+
+  const auto& stage = config.tevStages[stageIdx];
+  TevStageTextureDependency dependency{
+      .texCoordId = tev_effective_texcoord(config, stage.texCoordId),
+      .texMapId = tev_stage_has_texture_map(stage) ? static_cast<int>(underlying(stage.texMapId)) : -1,
+      .needsFixedTexcoordState = tev_stage_needs_fixed_texcoord_state(config, stageIdx),
+      .combinerUsesTexture = tev_stage_combiner_uses_texture(stage),
+  };
+  dependency.canSampleTexture = dependency.texCoordId >= 0 && dependency.texMapId >= 0;
+  return dependency;
+}
+
+inline bool shader_uses_fixed_texcoord_state(const ShaderConfig& config) noexcept {
+  for (u32 i = 0; i < config.tevStageCount; ++i) {
+    if (tev_stage_texture_dependency(config, i).needsFixedTexcoordState) {
+      return true;
+    }
+  }
+  return false;
+}
+
+inline bool tev_z_texture_enabled(const ShaderConfig& config) noexcept {
+  return ((config.zTexture >> 26) & 0x3u) != GX_ZT_DISABLE;
+}
+
+inline int tev_z_texture_stage(const ShaderConfig& config) noexcept {
+  if (!tev_z_texture_enabled(config)) {
+    return -1;
+  }
+  for (int i = static_cast<int>(config.tevStageCount) - 1; i >= 0; --i) {
+    if (tev_stage_texture_dependency(config, static_cast<u32>(i)).canSampleTexture) {
+      return i;
+    }
+  }
+  return -1;
+}
+
+struct PipelineConfig;
+
+struct GXBindGroups {
+  gfx::BindGroupRef textureBindGroup;
+  // Bind group resolved at draw-build time so that gx::render does not have to hash-map the ref again for every draw.
+  WGPUBindGroup resolvedTextureBindGroup = nullptr;
+};
+// Which matrix-memory slots a generated shader can actually read, and where each one lives in the compacted uniform arrays.
+struct UniformMatrixLayout {
+  // `postexSlots`/`nrmSlots` entry meaning "the matrix selected by the current matrix index", which is only known per draw.
+  static constexpr u8 kCurrentPnMtx = 0xFE;
+  // `postexRemap` entry for a slot that this shader never reads.
+  static constexpr u8 kAbsent = 0xFF;
+
+  // Compact index -> absolute postex slot (or kCurrentPnMtx).
+  std::array<u8, MaxPostexMtx> postexSlots{};
+  // Absolute postex slot -> compact index (or kAbsent).
+  std::array<u8, MaxPostexMtx> postexRemap{};
+  // Compact index -> absolute position slot (or kCurrentPnMtx).
+  std::array<u8, MaxPnMtx> nrmSlots{};
+  u8 postexCount = 0;
+  u8 nrmCount = 0;
+  // Position slots 0..MaxPnMtx-1 are uploaded 1:1 at compact indices 0..9, so `current_pnmtx` and any per-vertex index need no remapping.
+  bool absolutePosRegion = false;
+};
+// Output info from shader generation
+struct ShaderInfo {
+  std::bitset<MaxTexCoord> sampledTexCoords;
+  std::bitset<MaxTextures> sampledTextures;
+  std::bitset<MaxKColors> sampledKColors;
+  std::bitset<MaxColorChannels / 2> sampledColorChannels;
+  // TEV color and alpha outputs are independently addressable.
+  std::bitset<MaxTevRegs> loadsTevRegRgb;
+  std::bitset<MaxTevRegs> loadsTevRegAlpha;
+  std::bitset<MaxTevRegs> writesTevRegRgb;
+  std::bitset<MaxTevRegs> writesTevRegAlpha;
+  std::bitset<MaxPTTexMtx> usesPTTexMtx;
+  std::bitset<MaxVtxAttr> indexAttr;
+  std::bitset<MaxIndStages> usedIndStages;
+  std::bitset<MaxTextures> sampledIndTextures;
+  std::bitset<MaxIndTexMtxs> usedIndTexMtxs;
+  UniformMatrixLayout matrixLayout;
+  u32 uniformSize = 0;
+  bool usesFog : 1 = false;
+  bool lightingEnabled : 1 = false;
+  u8 lineMode : 2 = 0;
+};
+struct BindGroupRanges {
+  std::array<gfx::Range, MaxIndexAttr> vaRanges{};
+};
+void populate_pipeline_config(PipelineConfig& config, GXPrimitive primitive, GXVtxFmt fmt) noexcept;
+wgpu::RenderPipeline build_pipeline(const PipelineConfig& config, ArrayRef<wgpu::VertexBufferLayout> vtxBuffers,
+                                    wgpu::ShaderModule shader, const char* label) noexcept;
+wgpu::ShaderModule build_shader(const ShaderConfig& config) noexcept;
+GXBindGroups build_bind_groups(const ShaderInfo& info) noexcept;
+void notify_copy_texture_created() noexcept;
+
+u8 comp_type_size(GXAttr attr, GXCompType type) noexcept;
+u8 comp_cnt_count(GXAttr attr, GXCompCnt cnt) noexcept;
+} // namespace aurora::gx
diff --git a/aurora-main/lib/gx/gx_fmt.hpp b/aurora-main/lib/gx/gx_fmt.hpp
new file mode 100644
index 0000000..ca1fb33
--- /dev/null
+++ b/aurora-main/lib/gx/gx_fmt.hpp
@@ -0,0 +1,952 @@
+#pragma once
+
+#include "../internal.hpp"
+
+#include <dolphin/gx/GXEnum.h>
+#include <fmt/format.h>
+#include <string>
+
+inline std::string format_as(const GXTevOp& op) {
+  switch (op) {
+  case GX_TEV_ADD:
+    return "GX_TEV_ADD";
+  case GX_TEV_SUB:
+    return "GX_TEV_SUB";
+  case GX_TEV_COMP_R8_GT:
+    return "GX_TEV_COMP_R8_GT";
+  case GX_TEV_COMP_R8_EQ:
+    return "GX_TEV_COMP_R8_EQ";
+  case GX_TEV_COMP_GR16_GT:
+    return "GX_TEV_COMP_GR16_GT";
+  case GX_TEV_COMP_GR16_EQ:
+    return "GX_TEV_COMP_GR16_EQ";
+  case GX_TEV_COMP_BGR24_GT:
+    return "GX_TEV_COMP_BGR24_GT";
+  case GX_TEV_COMP_BGR24_EQ:
+    return "GX_TEV_COMP_BGR24_EQ";
+  case GX_TEV_COMP_RGB8_GT:
+    return "GX_TEV_COMP_RGB8_GT";
+  case GX_TEV_COMP_RGB8_EQ:
+    return "GX_TEV_COMP_RGB8_EQ";
+  default:
+    return fmt::format("GXTevOp({})", underlying(op));
+  }
+}
+
+inline std::string format_as(const GXTevColorArg& arg) {
+  switch (arg) {
+  case GX_CC_CPREV:
+    return "GX_CC_CPREV";
+  case GX_CC_APREV:
+    return "GX_CC_APREV";
+  case GX_CC_C0:
+    return "GX_CC_C0";
+  case GX_CC_A0:
+    return "GX_CC_A0";
+  case GX_CC_C1:
+    return "GX_CC_C1";
+  case GX_CC_A1:
+    return "GX_CC_A1";
+  case GX_CC_C2:
+    return "GX_CC_C2";
+  case GX_CC_A2:
+    return "GX_CC_A2";
+  case GX_CC_TEXC:
+    return "GX_CC_TEXC";
+  case GX_CC_TEXA:
+    return "GX_CC_TEXA";
+  case GX_CC_RASC:
+    return "GX_CC_RASC";
+  case GX_CC_RASA:
+    return "GX_CC_RASA";
+  case GX_CC_ONE:
+    return "GX_CC_ONE";
+  case GX_CC_HALF:
+    return "GX_CC_HALF";
+  case GX_CC_KONST:
+    return "GX_CC_KONST";
+  case GX_CC_ZERO:
+    return "GX_CC_ZERO";
+  default:
+    return fmt::format("GXTevColorArg({})", underlying(arg));
+  }
+}
+
+inline std::string format_as(const GXTevAlphaArg& arg) {
+  switch (arg) {
+  case GX_CA_APREV:
+    return "GX_CA_APREV";
+  case GX_CA_A0:
+    return "GX_CA_A0";
+  case GX_CA_A1:
+    return "GX_CA_A1";
+  case GX_CA_A2:
+    return "GX_CA_A2";
+  case GX_CA_TEXA:
+    return "GX_CA_TEXA";
+  case GX_CA_RASA:
+    return "GX_CA_RASA";
+  case GX_CA_KONST:
+    return "GX_CA_KONST";
+  case GX_CA_ZERO:
+    return "GX_CA_ZERO";
+  default:
+    return fmt::format("GXTevAlphaArg({})", underlying(arg));
+  }
+}
+
+inline std::string format_as(const GXTexGenSrc& src) {
+  switch (src) {
+  case GX_TG_POS:
+    return "GX_TG_POS";
+  case GX_TG_NRM:
+    return "GX_TG_NRM";
+  case GX_TG_BINRM:
+    return "GX_TG_BINRM";
+  case GX_TG_TANGENT:
+    return "GX_TG_TANGENT";
+  case GX_TG_TEX0:
+    return "GX_TG_TEX0";
+  case GX_TG_TEX1:
+    return "GX_TG_TEX1";
+  case GX_TG_TEX2:
+    return "GX_TG_TEX2";
+  case GX_TG_TEX3:
+    return "GX_TG_TEX3";
+  case GX_TG_TEX4:
+    return "GX_TG_TEX4";
+  case GX_TG_TEX5:
+    return "GX_TG_TEX5";
+  case GX_TG_TEX6:
+    return "GX_TG_TEX6";
+  case GX_TG_TEX7:
+    return "GX_TG_TEX7";
+  case GX_TG_TEXCOORD0:
+    return "GX_TG_TEXCOORD0";
+  case GX_TG_TEXCOORD1:
+    return "GX_TG_TEXCOORD1";
+  case GX_TG_TEXCOORD2:
+    return "GX_TG_TEXCOORD2";
+  case GX_TG_TEXCOORD3:
+    return "GX_TG_TEXCOORD3";
+  case GX_TG_TEXCOORD4:
+    return "GX_TG_TEXCOORD4";
+  case GX_TG_TEXCOORD5:
+    return "GX_TG_TEXCOORD5";
+  case GX_TG_TEXCOORD6:
+    return "GX_TG_TEXCOORD6";
+  case GX_TG_COLOR0:
+    return "GX_TG_COLOR0";
+  case GX_TG_COLOR1:
+    return "GX_TG_COLOR1";
+  default:
+    return fmt::format("GXTexGenSrc({})", underlying(src));
+  }
+}
+
+inline std::string format_as(const GXTexGenType& type) {
+  switch (type) {
+  case GX_TG_MTX2x4:
+    return "GX_TG_MTX2x4";
+  case GX_TG_MTX3x4:
+    return "GX_TG_MTX3x4";
+  case GX_TG_BUMP0:
+    return "GX_TG_BUMP0";
+  case GX_TG_BUMP1:
+    return "GX_TG_BUMP1";
+  case GX_TG_BUMP2:
+    return "GX_TG_BUMP2";
+  case GX_TG_BUMP3:
+    return "GX_TG_BUMP3";
+  case GX_TG_BUMP4:
+    return "GX_TG_BUMP4";
+  case GX_TG_BUMP5:
+    return "GX_TG_BUMP5";
+  case GX_TG_BUMP6:
+    return "GX_TG_BUMP6";
+  case GX_TG_BUMP7:
+    return "GX_TG_BUMP7";
+  case GX_TG_SRTG:
+    return "GX_TG_SRTG";
+  default:
+    return fmt::format("GXTexGenType({})", underlying(type));
+  }
+}
+
+inline std::string format_as(const GXTevBias& bias) {
+  switch (bias) {
+  case GX_TB_ZERO:
+    return "GX_TB_ZERO";
+  case GX_TB_ADDHALF:
+    return "GX_TB_ADDHALF";
+  case GX_TB_SUBHALF:
+    return "GX_TB_SUBHALF";
+  default:
+    return fmt::format("GXTevBias({})", underlying(bias));
+  }
+}
+
+inline std::string format_as(const GXTevScale& scale) {
+  switch (scale) {
+  case GX_CS_SCALE_1:
+    return "GX_CS_SCALE_1";
+  case GX_CS_SCALE_2:
+    return "GX_CS_SCALE_2";
+  case GX_CS_SCALE_4:
+    return "GX_CS_SCALE_4";
+  case GX_CS_DIVIDE_2:
+    return "GX_CS_DIVIDE_2";
+  default:
+    return fmt::format("GXTevScale({})", underlying(scale));
+  }
+}
+
+inline std::string format_as(const GXTevRegID& reg) {
+  switch (reg) {
+  case GX_TEVPREV:
+    return "GX_TEVPREV";
+  case GX_TEVREG0:
+    return "GX_TEVREG0";
+  case GX_TEVREG1:
+    return "GX_TEVREG1";
+  case GX_TEVREG2:
+    return "GX_TEVREG2";
+  default:
+    return fmt::format("GXTevRegID({})", underlying(reg));
+  }
+}
+
+inline std::string format_as(const GXTevKColorSel& sel) {
+  switch (sel) {
+  case GX_TEV_KCSEL_8_8:
+    return "GX_TEV_KCSEL_8_8";
+  case GX_TEV_KCSEL_7_8:
+    return "GX_TEV_KCSEL_7_8";
+  case GX_TEV_KCSEL_6_8:
+    return "GX_TEV_KCSEL_6_8";
+  case GX_TEV_KCSEL_5_8:
+    return "GX_TEV_KCSEL_5_8";
+  case GX_TEV_KCSEL_4_8:
+    return "GX_TEV_KCSEL_4_8";
+  case GX_TEV_KCSEL_3_8:
+    return "GX_TEV_KCSEL_3_8";
+  case GX_TEV_KCSEL_2_8:
+    return "GX_TEV_KCSEL_2_8";
+  case GX_TEV_KCSEL_1_8:
+    return "GX_TEV_KCSEL_1_8";
+  case GX_TEV_KCSEL_K0:
+    return "GX_TEV_KCSEL_K0";
+  case GX_TEV_KCSEL_K1:
+    return "GX_TEV_KCSEL_K1";
+  case GX_TEV_KCSEL_K2:
+    return "GX_TEV_KCSEL_K2";
+  case GX_TEV_KCSEL_K3:
+    return "GX_TEV_KCSEL_K3";
+  case GX_TEV_KCSEL_K0_R:
+    return "GX_TEV_KCSEL_K0_R";
+  case GX_TEV_KCSEL_K1_R:
+    return "GX_TEV_KCSEL_K1_R";
+  case GX_TEV_KCSEL_K2_R:
+    return "GX_TEV_KCSEL_K2_R";
+  case GX_TEV_KCSEL_K3_R:
+    return "GX_TEV_KCSEL_K3_R";
+  case GX_TEV_KCSEL_K0_G:
+    return "GX_TEV_KCSEL_K0_G";
+  case GX_TEV_KCSEL_K1_G:
+    return "GX_TEV_KCSEL_K1_G";
+  case GX_TEV_KCSEL_K2_G:
+    return "GX_TEV_KCSEL_K2_G";
+  case GX_TEV_KCSEL_K3_G:
+    return "GX_TEV_KCSEL_K3_G";
+  case GX_TEV_KCSEL_K0_B:
+    return "GX_TEV_KCSEL_K0_B";
+  case GX_TEV_KCSEL_K1_B:
+    return "GX_TEV_KCSEL_K1_B";
+  case GX_TEV_KCSEL_K2_B:
+    return "GX_TEV_KCSEL_K2_B";
+  case GX_TEV_KCSEL_K3_B:
+    return "GX_TEV_KCSEL_K3_B";
+  case GX_TEV_KCSEL_K0_A:
+    return "GX_TEV_KCSEL_K0_A";
+  case GX_TEV_KCSEL_K1_A:
+    return "GX_TEV_KCSEL_K1_A";
+  case GX_TEV_KCSEL_K2_A:
+    return "GX_TEV_KCSEL_K2_A";
+  case GX_TEV_KCSEL_K3_A:
+    return "GX_TEV_KCSEL_K3_A";
+  default:
+    return fmt::format("GXTevKColorSel({})", underlying(sel));
+  }
+}
+
+inline std::string format_as(const GXTevKAlphaSel& sel) {
+  switch (sel) {
+  case GX_TEV_KASEL_8_8:
+    return "GX_TEV_KASEL_8_8";
+  case GX_TEV_KASEL_7_8:
+    return "GX_TEV_KASEL_7_8";
+  case GX_TEV_KASEL_6_8:
+    return "GX_TEV_KASEL_6_8";
+  case GX_TEV_KASEL_5_8:
+    return "GX_TEV_KASEL_5_8";
+  case GX_TEV_KASEL_4_8:
+    return "GX_TEV_KASEL_4_8";
+  case GX_TEV_KASEL_3_8:
+    return "GX_TEV_KASEL_3_8";
+  case GX_TEV_KASEL_2_8:
+    return "GX_TEV_KASEL_2_8";
+  case GX_TEV_KASEL_1_8:
+    return "GX_TEV_KASEL_1_8";
+  case GX_TEV_KASEL_K0_R:
+    return "GX_TEV_KASEL_K0_R";
+  case GX_TEV_KASEL_K1_R:
+    return "GX_TEV_KASEL_K1_R";
+  case GX_TEV_KASEL_K2_R:
+    return "GX_TEV_KASEL_K2_R";
+  case GX_TEV_KASEL_K3_R:
+    return "GX_TEV_KASEL_K3_R";
+  case GX_TEV_KASEL_K0_G:
+    return "GX_TEV_KASEL_K0_G";
+  case GX_TEV_KASEL_K1_G:
+    return "GX_TEV_KASEL_K1_G";
+  case GX_TEV_KASEL_K2_G:
+    return "GX_TEV_KASEL_K2_G";
+  case GX_TEV_KASEL_K3_G:
+    return "GX_TEV_KASEL_K3_G";
+  case GX_TEV_KASEL_K0_B:
+    return "GX_TEV_KASEL_K0_B";
+  case GX_TEV_KASEL_K1_B:
+    return "GX_TEV_KASEL_K1_B";
+  case GX_TEV_KASEL_K2_B:
+    return "GX_TEV_KASEL_K2_B";
+  case GX_TEV_KASEL_K3_B:
+    return "GX_TEV_KASEL_K3_B";
+  case GX_TEV_KASEL_K0_A:
+    return "GX_TEV_KASEL_K0_A";
+  case GX_TEV_KASEL_K1_A:
+    return "GX_TEV_KASEL_K1_A";
+  case GX_TEV_KASEL_K2_A:
+    return "GX_TEV_KASEL_K2_A";
+  case GX_TEV_KASEL_K3_A:
+    return "GX_TEV_KASEL_K3_A";
+  default:
+    return fmt::format("GXTevKAlphaSel({})", underlying(sel));
+  }
+}
+
+inline std::string format_as(const GXTevSwapSel& sel) {
+  switch (sel) {
+  case GX_TEV_SWAP0:
+    return "GX_TEV_SWAP0";
+  case GX_TEV_SWAP1:
+    return "GX_TEV_SWAP1";
+  case GX_TEV_SWAP2:
+    return "GX_TEV_SWAP2";
+  case GX_TEV_SWAP3:
+    return "GX_TEV_SWAP3";
+  default:
+    return fmt::format("GXTevSwapSel({})", underlying(sel));
+  }
+}
+
+inline std::string format_as(const GXTexMapID& id) {
+  switch (id) {
+  case GX_TEXMAP0:
+    return "GX_TEXMAP0";
+  case GX_TEXMAP1:
+    return "GX_TEXMAP1";
+  case GX_TEXMAP2:
+    return "GX_TEXMAP2";
+  case GX_TEXMAP3:
+    return "GX_TEXMAP3";
+  case GX_TEXMAP4:
+    return "GX_TEXMAP4";
+  case GX_TEXMAP5:
+    return "GX_TEXMAP5";
+  case GX_TEXMAP6:
+    return "GX_TEXMAP6";
+  case GX_TEXMAP7:
+    return "GX_TEXMAP7";
+  case GX_TEXMAP_NULL:
+    return "GX_TEXMAP_NULL";
+  case GX_TEX_DISABLE:
+    return "GX_TEX_DISABLE";
+  default:
+    return fmt::format("GXTexMapID({})", underlying(id));
+  }
+}
+
+inline std::string format_as(const GXChannelID& id) {
+  switch (id) {
+  case GX_COLOR0:
+    return "GX_COLOR0";
+  case GX_COLOR1:
+    return "GX_COLOR1";
+  case GX_ALPHA0:
+    return "GX_ALPHA0";
+  case GX_ALPHA1:
+    return "GX_ALPHA1";
+  case GX_COLOR0A0:
+    return "GX_COLOR0A0";
+  case GX_COLOR1A1:
+    return "GX_COLOR1A1";
+  case GX_COLOR_ZERO:
+    return "GX_COLOR_ZERO";
+  case GX_ALPHA_BUMP:
+    return "GX_ALPHA_BUMP";
+  case GX_ALPHA_BUMPN:
+    return "GX_ALPHA_BUMPN";
+  case GX_COLOR_NULL:
+    return "GX_COLOR_NULL";
+  default:
+    return fmt::format("GXChannelID({})", underlying(id));
+  }
+}
+
+inline std::string format_as(const GXColorSrc& src) {
+  switch (src) {
+  case GX_SRC_REG:
+    return "GX_SRC_REG";
+  case GX_SRC_VTX:
+    return "GX_SRC_VTX";
+  default:
+    return fmt::format("GXColorSrc({})", underlying(src));
+  }
+}
+
+inline std::string format_as(const GXTexMtx& mtx) {
+  switch (mtx) {
+  case GX_TEXMTX0:
+    return "GX_TEXMTX0";
+  case GX_TEXMTX1:
+    return "GX_TEXMTX1";
+  case GX_TEXMTX2:
+    return "GX_TEXMTX2";
+  case GX_TEXMTX3:
+    return "GX_TEXMTX3";
+  case GX_TEXMTX4:
+    return "GX_TEXMTX4";
+  case GX_TEXMTX5:
+    return "GX_TEXMTX5";
+  case GX_TEXMTX6:
+    return "GX_TEXMTX6";
+  case GX_TEXMTX7:
+    return "GX_TEXMTX7";
+  case GX_TEXMTX8:
+    return "GX_TEXMTX8";
+  case GX_TEXMTX9:
+    return "GX_TEXMTX9";
+  case GX_IDENTITY:
+    return "GX_IDENTITY";
+  default:
+    return fmt::format("GXTexMtx({})", underlying(mtx));
+  }
+}
+
+inline std::string format_as(const GXPTTexMtx& mtx) {
+  switch (mtx) {
+  case GX_PTTEXMTX0:
+    return "GX_PTTEXMTX0";
+  case GX_PTTEXMTX1:
+    return "GX_PTTEXMTX1";
+  case GX_PTTEXMTX2:
+    return "GX_PTTEXMTX2";
+  case GX_PTTEXMTX3:
+    return "GX_PTTEXMTX3";
+  case GX_PTTEXMTX4:
+    return "GX_PTTEXMTX4";
+  case GX_PTTEXMTX5:
+    return "GX_PTTEXMTX5";
+  case GX_PTTEXMTX6:
+    return "GX_PTTEXMTX6";
+  case GX_PTTEXMTX7:
+    return "GX_PTTEXMTX7";
+  case GX_PTTEXMTX8:
+    return "GX_PTTEXMTX8";
+  case GX_PTTEXMTX9:
+    return "GX_PTTEXMTX9";
+  case GX_PTTEXMTX10:
+    return "GX_PTTEXMTX10";
+  case GX_PTTEXMTX11:
+    return "GX_PTTEXMTX11";
+  case GX_PTTEXMTX12:
+    return "GX_PTTEXMTX12";
+  case GX_PTTEXMTX13:
+    return "GX_PTTEXMTX13";
+  case GX_PTTEXMTX14:
+    return "GX_PTTEXMTX14";
+  case GX_PTTEXMTX15:
+    return "GX_PTTEXMTX15";
+  case GX_PTTEXMTX16:
+    return "GX_PTTEXMTX16";
+  case GX_PTTEXMTX17:
+    return "GX_PTTEXMTX17";
+  case GX_PTTEXMTX18:
+    return "GX_PTTEXMTX18";
+  case GX_PTTEXMTX19:
+    return "GX_PTTEXMTX19";
+  case GX_PTIDENTITY:
+    return "GX_PTIDENTITY";
+  default:
+    return fmt::format("GXPTTexMtx({})", underlying(mtx));
+  }
+}
+
+inline std::string format_as(const GXCompare& comp) {
+  switch (comp) {
+  case GX_NEVER:
+    return "GX_NEVER";
+  case GX_LESS:
+    return "GX_LESS";
+  case GX_EQUAL:
+    return "GX_EQUAL";
+  case GX_LEQUAL:
+    return "GX_LEQUAL";
+  case GX_GREATER:
+    return "GX_GREATER";
+  case GX_NEQUAL:
+    return "GX_NEQUAL";
+  case GX_GEQUAL:
+    return "GX_GEQUAL";
+  case GX_ALWAYS:
+    return "GX_ALWAYS";
+  default:
+    return fmt::format("GXCompare({})", underlying(comp));
+  }
+}
+
+inline std::string format_as(const GXAlphaOp& op) {
+  switch (op) {
+  case GX_AOP_AND:
+    return "GX_AOP_AND";
+  case GX_AOP_OR:
+    return "GX_AOP_OR";
+  case GX_AOP_XOR:
+    return "GX_AOP_XOR";
+  case GX_AOP_XNOR:
+    return "GX_AOP_XNOR";
+  default:
+    return fmt::format("GXAlphaOp({})", underlying(op));
+  }
+}
+
+inline std::string format_as(const GXFogType& type) {
+  switch (type) {
+  case GX_FOG_NONE:
+    return "GX_FOG_NONE";
+  case GX_FOG_PERSP_LIN:
+    return "GX_FOG_PERSP_LIN";
+  case GX_FOG_PERSP_EXP:
+    return "GX_FOG_PERSP_EXP";
+  case GX_FOG_PERSP_EXP2:
+    return "GX_FOG_PERSP_EXP2";
+  case GX_FOG_PERSP_REVEXP:
+    return "GX_FOG_PERSP_REVEXP";
+  case GX_FOG_PERSP_REVEXP2:
+    return "GX_FOG_PERSP_REVEXP2";
+  case GX_FOG_ORTHO_LIN:
+    return "GX_FOG_ORTHO_LIN";
+  case GX_FOG_ORTHO_EXP:
+    return "GX_FOG_ORTHO_EXP";
+  case GX_FOG_ORTHO_EXP2:
+    return "GX_FOG_ORTHO_EXP2";
+  case GX_FOG_ORTHO_REVEXP:
+    return "GX_FOG_ORTHO_REVEXP";
+  case GX_FOG_ORTHO_REVEXP2:
+    return "GX_FOG_ORTHO_REVEXP2";
+  default:
+    return fmt::format("GXFogType({})", underlying(type));
+  }
+}
+
+inline std::string format_as(const GXTexCoordID& id) {
+  switch (id) {
+  case GX_TEXCOORD0:
+    return "GX_TEXCOORD0";
+  case GX_TEXCOORD1:
+    return "GX_TEXCOORD1";
+  case GX_TEXCOORD2:
+    return "GX_TEXCOORD2";
+  case GX_TEXCOORD3:
+    return "GX_TEXCOORD3";
+  case GX_TEXCOORD4:
+    return "GX_TEXCOORD4";
+  case GX_TEXCOORD5:
+    return "GX_TEXCOORD5";
+  case GX_TEXCOORD6:
+    return "GX_TEXCOORD6";
+  case GX_TEXCOORD7:
+    return "GX_TEXCOORD7";
+  case GX_TEXCOORD_NULL:
+    return "GX_TEXCOORD_NULL";
+  default:
+    return fmt::format("GXTexCoordID({})", underlying(id));
+  }
+}
+
+inline std::string format_as(const GXIndTexStageID& id) {
+  switch (id) {
+  case GX_INDTEXSTAGE0:
+    return "GX_INDTEXSTAGE0";
+  case GX_INDTEXSTAGE1:
+    return "GX_INDTEXSTAGE1";
+  case GX_INDTEXSTAGE2:
+    return "GX_INDTEXSTAGE2";
+  case GX_INDTEXSTAGE3:
+    return "GX_INDTEXSTAGE3";
+  default:
+    return fmt::format("GXIndTexStageID({})", underlying(id));
+  }
+}
+
+inline std::string format_as(const GXIndTexFormat& fmt_) {
+  switch (fmt_) {
+  case GX_ITF_8:
+    return "GX_ITF_8";
+  case GX_ITF_5:
+    return "GX_ITF_5";
+  case GX_ITF_4:
+    return "GX_ITF_4";
+  case GX_ITF_3:
+    return "GX_ITF_3";
+  default:
+    return fmt::format("GXIndTexFormat({})", underlying(fmt_));
+  }
+}
+
+inline std::string format_as(const GXIndTexBiasSel& sel) {
+  switch (sel) {
+  case GX_ITB_NONE:
+    return "GX_ITB_NONE";
+  case GX_ITB_S:
+    return "GX_ITB_S";
+  case GX_ITB_T:
+    return "GX_ITB_T";
+  case GX_ITB_ST:
+    return "GX_ITB_ST";
+  case GX_ITB_U:
+    return "GX_ITB_U";
+  case GX_ITB_SU:
+    return "GX_ITB_SU";
+  case GX_ITB_TU:
+    return "GX_ITB_TU";
+  case GX_ITB_STU:
+    return "GX_ITB_STU";
+  default:
+    return fmt::format("GXIndTexBiasSel({})", underlying(sel));
+  }
+}
+
+inline std::string format_as(const GXIndTexAlphaSel& sel) {
+  switch (sel) {
+  case GX_ITBA_OFF:
+    return "GX_ITBA_OFF";
+  case GX_ITBA_S:
+    return "GX_ITBA_S";
+  case GX_ITBA_T:
+    return "GX_ITBA_T";
+  case GX_ITBA_U:
+    return "GX_ITBA_U";
+  default:
+    return fmt::format("GXIndTexAlphaSel({})", underlying(sel));
+  }
+}
+
+inline std::string format_as(const GXIndTexMtxID& id) {
+  switch (id) {
+  case GX_ITM_OFF:
+    return "GX_ITM_OFF";
+  case GX_ITM_0:
+    return "GX_ITM_0";
+  case GX_ITM_1:
+    return "GX_ITM_1";
+  case GX_ITM_2:
+    return "GX_ITM_2";
+  case GX_ITM_S0:
+    return "GX_ITM_S0";
+  case GX_ITM_S1:
+    return "GX_ITM_S1";
+  case GX_ITM_S2:
+    return "GX_ITM_S2";
+  case GX_ITM_T0:
+    return "GX_ITM_T0";
+  case GX_ITM_T1:
+    return "GX_ITM_T1";
+  case GX_ITM_T2:
+    return "GX_ITM_T2";
+  default:
+    return fmt::format("GXIndTexMtxID({})", underlying(id));
+  }
+}
+
+inline std::string format_as(const GXIndTexWrap& wrap) {
+  switch (wrap) {
+  case GX_ITW_OFF:
+    return "GX_ITW_OFF";
+  case GX_ITW_256:
+    return "GX_ITW_256";
+  case GX_ITW_128:
+    return "GX_ITW_128";
+  case GX_ITW_64:
+    return "GX_ITW_64";
+  case GX_ITW_32:
+    return "GX_ITW_32";
+  case GX_ITW_16:
+    return "GX_ITW_16";
+  case GX_ITW_0:
+    return "GX_ITW_0";
+  default:
+    return fmt::format("GXIndTexWrap({})", underlying(wrap));
+  }
+}
+
+inline std::string format_as(const GXIndTexScale& scale) {
+  switch (scale) {
+  case GX_ITS_1:
+    return "GX_ITS_1";
+  case GX_ITS_2:
+    return "GX_ITS_2";
+  case GX_ITS_4:
+    return "GX_ITS_4";
+  case GX_ITS_8:
+    return "GX_ITS_8";
+  case GX_ITS_16:
+    return "GX_ITS_16";
+  case GX_ITS_32:
+    return "GX_ITS_32";
+  case GX_ITS_64:
+    return "GX_ITS_64";
+  case GX_ITS_128:
+    return "GX_ITS_128";
+  case GX_ITS_256:
+    return "GX_ITS_256";
+  default:
+    return fmt::format("GXIndTexScale({})", underlying(scale));
+  }
+}
+
+inline std::string format_as(const GXPrimitive& prim) {
+  switch (prim) {
+  case GX_QUADS:
+    return "GX_QUADS";
+  case GX_TRIANGLES:
+    return "GX_TRIANGLES";
+  case GX_TRIANGLESTRIP:
+    return "GX_TRIANGLESTRIP";
+  case GX_TRIANGLEFAN:
+    return "GX_TRIANGLEFAN";
+  case GX_LINES:
+    return "GX_LINES";
+  case GX_LINESTRIP:
+    return "GX_LINESTRIP";
+  case GX_POINTS:
+    return "GX_POINTS";
+  default:
+    return fmt::format("GXPrimitive({})", underlying(prim));
+  }
+}
+
+inline std::string format_as(const GXAttr& attr) {
+  switch (attr) {
+  case GX_VA_PNMTXIDX:
+    return "GX_VA_PNMTXIDX";
+  case GX_VA_TEX0MTXIDX:
+    return "GX_VA_TEX0MTXIDX";
+  case GX_VA_TEX1MTXIDX:
+    return "GX_VA_TEX1MTXIDX";
+  case GX_VA_TEX2MTXIDX:
+    return "GX_VA_TEX2MTXIDX";
+  case GX_VA_TEX3MTXIDX:
+    return "GX_VA_TEX3MTXIDX";
+  case GX_VA_TEX4MTXIDX:
+    return "GX_VA_TEX4MTXIDX";
+  case GX_VA_TEX5MTXIDX:
+    return "GX_VA_TEX5MTXIDX";
+  case GX_VA_TEX6MTXIDX:
+    return "GX_VA_TEX6MTXIDX";
+  case GX_VA_TEX7MTXIDX:
+    return "GX_VA_TEX7MTXIDX";
+  case GX_VA_POS:
+    return "GX_VA_POS";
+  case GX_VA_NRM:
+    return "GX_VA_NRM";
+  case GX_VA_CLR0:
+    return "GX_VA_CLR0";
+  case GX_VA_CLR1:
+    return "GX_VA_CLR1";
+  case GX_VA_TEX0:
+    return "GX_VA_TEX0";
+  case GX_VA_TEX1:
+    return "GX_VA_TEX1";
+  case GX_VA_TEX2:
+    return "GX_VA_TEX2";
+  case GX_VA_TEX3:
+    return "GX_VA_TEX3";
+  case GX_VA_TEX4:
+    return "GX_VA_TEX4";
+  case GX_VA_TEX5:
+    return "GX_VA_TEX5";
+  case GX_VA_TEX6:
+    return "GX_VA_TEX6";
+  case GX_VA_TEX7:
+    return "GX_VA_TEX7";
+  case GX_POS_MTX_ARRAY:
+    return "GX_POS_MTX_ARRAY";
+  case GX_NRM_MTX_ARRAY:
+    return "GX_NRM_MTX_ARRAY";
+  case GX_TEX_MTX_ARRAY:
+    return "GX_TEX_MTX_ARRAY";
+  case GX_LIGHT_ARRAY:
+    return "GX_LIGHT_ARRAY";
+  case GX_VA_NBT:
+    return "GX_VA_NBT";
+  case GX_VA_NULL:
+    return "GX_VA_NULL";
+  default:
+    return fmt::format("GXAttr({})", underlying(attr));
+  }
+}
+
+inline std::string format_as(const GXCompCnt& cnt) {
+  switch (cnt) {
+  case GX_POS_XY:
+    return "GX_POS_XY|GX_NRM_XYZ|GX_CLR_RGB|GX_TEX_S";
+  case GX_POS_XYZ:
+    return "GX_POS_XYZ|GX_NRM_NBT|GX_CLR_RGBA|GX_TEX_ST";
+  case GX_NRM_NBT3:
+    return "GX_NRM_NBT3";
+  default:
+    return fmt::format("GXCompCnt({})", underlying(cnt));
+  }
+}
+
+inline std::string format_as(const GXCompType& type) {
+  switch (type) {
+  case GX_U8:
+    return "GX_U8|GX_RGB565";
+  case GX_S8:
+    return "GX_S8|GX_RGB8";
+  case GX_U16:
+    return "GX_U16|GX_RGBX8";
+  case GX_S16:
+    return "GX_S16|GX_RGBA4";
+  case GX_F32:
+    return "GX_F32|GX_RGBA6";
+  case GX_RGBA8:
+    return "GX_RGBA8";
+  default:
+    return fmt::format("GXCompType({})", underlying(type));
+  }
+}
+
+inline std::string format_as(const GXAttrType& type) {
+  switch (type) {
+  case GX_NONE:
+    return "GX_NONE";
+  case GX_DIRECT:
+    return "GX_DIRECT";
+  case GX_INDEX8:
+    return "GX_INDEX8";
+  case GX_INDEX16:
+    return "GX_INDEX16";
+  default:
+    return fmt::format("GXAttrType({})", underlying(type));
+  }
+}
+
+inline std::string format_as(const GXVtxFmt& fmt) {
+  switch (fmt) {
+  case GX_VTXFMT0:
+    return "GX_VTXFMT0";
+  case GX_VTXFMT1:
+    return "GX_VTXFMT1";
+  case GX_VTXFMT2:
+    return "GX_VTXFMT2";
+  case GX_VTXFMT3:
+    return "GX_VTXFMT3";
+  case GX_VTXFMT4:
+    return "GX_VTXFMT4";
+  case GX_VTXFMT5:
+    return "GX_VTXFMT5";
+  case GX_VTXFMT6:
+    return "GX_VTXFMT6";
+  case GX_VTXFMT7:
+    return "GX_VTXFMT7";
+  default:
+    return fmt::format("GXVtxFmt({})", underlying(fmt));
+  }
+}
+
+inline std::string format_as(const GXTexFmt& fmt) {
+  switch (fmt) {
+  case GX_TF_I4:
+    return "GX_TF_I4";
+  case GX_TF_I8:
+    return "GX_TF_I8";
+  case GX_TF_IA4:
+    return "GX_TF_IA4";
+  case GX_TF_IA8:
+    return "GX_TF_IA8";
+  case GX_TF_RGB565:
+    return "GX_TF_RGB565";
+  case GX_TF_RGB5A3:
+    return "GX_TF_RGB5A3";
+  case GX_TF_RGBA8:
+    return "GX_TF_RGBA8";
+  case GX_TF_CMPR:
+    return "GX_TF_CMPR";
+  case GX_CTF_R4:
+    return "GX_CTF_R4";
+  case GX_CTF_RA4:
+    return "GX_CTF_RA4";
+  case GX_CTF_RA8:
+    return "GX_CTF_RA8";
+  case GX_CTF_YUVA8:
+    return "GX_CTF_YUVA8";
+  case GX_CTF_A8:
+    return "GX_CTF_A8";
+  case GX_CTF_R8:
+    return "GX_CTF_R8";
+  case GX_CTF_G8:
+    return "GX_CTF_G8";
+  case GX_CTF_B8:
+    return "GX_CTF_B8";
+  case GX_CTF_RG8:
+    return "GX_CTF_RG8";
+  case GX_CTF_GB8:
+    return "GX_CTF_GB8";
+  case GX_TF_Z8:
+    return "GX_TF_Z8";
+  case GX_TF_Z16:
+    return "GX_TF_Z16";
+  case GX_TF_Z24X8:
+    return "GX_TF_Z24X8";
+  case GX_CTF_Z4:
+    return "GX_CTF_Z4";
+  case GX_CTF_Z8M:
+    return "GX_CTF_Z8M";
+  case GX_CTF_Z8L:
+    return "GX_CTF_Z8L";
+  case GX_CTF_Z16L:
+    return "GX_CTF_Z16L";
+  case GX_TF_R8_PC:
+    return "GX_TF_R8_PC";
+  case GX_TF_RGBA8_PC:
+    return "GX_TF_RGBA8_PC";
+  default:
+    return fmt::format("GXTexFmt({})", underlying(fmt));
+  }
+}
+
+inline std::string format_as(const GXTlutFmt& fmt) {
+  switch (fmt) {
+  case GX_TL_IA8:
+    return "GX_TL_IA8";
+  case GX_TL_RGB565:
+    return "GX_TL_RGB565";
+  case GX_TL_RGB5A3:
+    return "GX_TL_RGB5A3";
+  default:
+    return fmt::format("GXTlutFmt({})", underlying(fmt));
+  }
+}
diff --git a/aurora-main/lib/gx/pipeline.cpp b/aurora-main/lib/gx/pipeline.cpp
new file mode 100644
index 0000000..9b1571e
--- /dev/null
+++ b/aurora-main/lib/gx/pipeline.cpp
@@ -0,0 +1,96 @@
+#include "pipeline.hpp"
+
+#include "../webgpu/gpu.hpp"
+#include "gx_fmt.hpp"
+#include "shader_info.hpp"
+#include "tracy/Tracy.hpp"
+
+#include <condition_variable>
+#include <memory>
+#include <mutex>
+
+#include <absl/container/flat_hash_map.h>
+
+namespace aurora::gx {
+static Module Log("aurora::gx");
+
+namespace {
+struct ShaderConfigHash {
+  size_t operator()(const ShaderConfig& config) const noexcept { return static_cast<size_t>(xxh3_hash(config)); }
+};
+
+struct CachedShaderModule {
+  std::condition_variable ready;
+  wgpu::ShaderModule module;
+  bool compiling = true;
+};
+
+std::mutex sShaderModuleCacheMutex;
+absl::flat_hash_map<ShaderConfig, std::shared_ptr<CachedShaderModule>, ShaderConfigHash> sShaderModuleCache;
+
+wgpu::ShaderModule cached_shader_module(const ShaderConfig& config) {
+  std::shared_ptr<CachedShaderModule> entry;
+  {
+    std::unique_lock lock{sShaderModuleCacheMutex};
+    const auto it = sShaderModuleCache.find(config);
+    if (it == sShaderModuleCache.end()) {
+      entry = std::make_shared<CachedShaderModule>();
+      sShaderModuleCache.emplace(config, entry);
+    } else {
+      entry = it->second;
+      entry->ready.wait(lock, [&] { return !entry->compiling; });
+      return entry->module;
+    }
+  }
+
+  auto module = build_shader(config);
+  {
+    std::lock_guard lock{sShaderModuleCacheMutex};
+    entry->module = module;
+    entry->compiling = false;
+  }
+  entry->ready.notify_all();
+  return module;
+}
+} // namespace
+
+wgpu::RenderPipeline create_pipeline(const PipelineConfig& config) {
+  ZoneScoped;
+  const auto shader = cached_shader_module(config.shaderConfig);
+  return build_pipeline(config, {}, shader, "GX Pipeline");
+}
+
+void clear_shader_module_cache() {
+  std::lock_guard lock{sShaderModuleCacheMutex};
+  sShaderModuleCache.clear();
+}
+
+void render(const DrawData& data, const wgpu::RenderPassEncoder& pass, DrawEncodeState& state,
+            bool requireReadyPipeline, const gfx::Range* uniformRangeOverride) {
+  if (!gfx::bind_pipeline(data.pipeline, pass, state.currentPipeline, requireReadyPipeline)) {
+    return;
+  }
+
+  // An interpolated presentation slot re-encodes the identical draw with only this range replaced; overriding here avoids copying the whole DrawData per draw per slot.
+  const gfx::Range& uniformRange = uniformRangeOverride != nullptr ? *uniformRangeOverride : data.uniformRange;
+  const std::array offsets{uniformRange.offset};
+  pass.SetBindGroup(1, gfx::g_uniformBindGroup, offsets.size(), offsets.data());
+  // Resolved when the draw was recorded; see GXBindGroups.
+  if (data.bindGroups.resolvedTextureBindGroup != nullptr &&
+      data.bindGroups.resolvedTextureBindGroup != state.boundTextureBindGroup) {
+    wgpuRenderPassEncoderSetBindGroup(pass.Get(), 2, data.bindGroups.resolvedTextureBindGroup, 0, nullptr);
+    state.boundTextureBindGroup = data.bindGroups.resolvedTextureBindGroup;
+  }
+  if (data.dstAlpha != UINT32_MAX) {
+    const wgpu::Color color{0.f, 0.f, 0.f, data.dstAlpha / 255.f};
+    pass.SetBlendConstant(&color);
+  }
+  if (!state.indexBufferBound) {
+    // Bound once for the pass; draws select their range with firstIndex below.
+    pass.SetIndexBuffer(gfx::g_indexBuffer, wgpu::IndexFormat::Uint16, 0, wgpu::kWholeSize);
+    state.indexBufferBound = true;
+  }
+  pass.DrawIndexed(data.indexCount, data.instanceCount,
+                   static_cast<uint32_t>(data.idxRange.offset / sizeof(uint16_t)));
+}
+} // namespace aurora::gx
diff --git a/aurora-main/lib/gx/pipeline.hpp b/aurora-main/lib/gx/pipeline.hpp
new file mode 100644
index 0000000..92a9e4d
--- /dev/null
+++ b/aurora-main/lib/gx/pipeline.hpp
@@ -0,0 +1,79 @@
+#pragma once
+
+#include "../gfx/common.hpp"
+#include "shader_info.hpp"
+
+namespace aurora::gx {
+struct DrawData {
+  gfx::PipelineRef pipeline;
+  gfx::Range vertRange;
+  gfx::Range idxRange;
+  gfx::Range uniformRange;
+  std::array<gfx::Range, MaxInterpolatedFrames> interpolatedUniformRanges;
+  uint32_t vtxCount;
+  uint32_t indexCount;
+  uint32_t instanceCount;
+  GXBindGroups bindGroups;
+  uint32_t dstAlpha;
+};
+
+constexpr uint32_t GXPipelineConfigVersion = 19;
+
+constexpr GXFogType effective_pipeline_fog_type(GXFogType fogType, GXZTexOp zTextureOp,
+                                                bool zCompLocBeforeTex, GXBlendMode blendMode,
+                                                GXLogicOp logicOp) noexcept {
+  const bool usesLateZTexture = zTextureOp != GX_ZT_DISABLE && !zCompLocBeforeTex;
+  const bool usesUnsupportedLogicFog =
+      blendMode == GX_BM_LOGIC && logicOp != GX_LO_OR;
+  return usesLateZTexture && usesUnsupportedLogicFog ? GX_FOG_NONE : fogType;
+}
+
+struct PipelineConfig {
+  uint32_t version = GXPipelineConfigVersion;
+  uint32_t msaaSamples = 1;
+  ShaderConfig shaderConfig;
+  GXCompare depthFunc;
+  GXCullMode cullMode;
+  GXBlendMode blendMode;
+  GXBlendFactor blendFacSrc, blendFacDst;
+  GXLogicOp blendOp;
+  GXPixelFmt pixelFmt;
+  uint32_t dstAlpha;
+  bool depthCompare, depthUpdate, alphaUpdate, colorUpdate;
+};
+static_assert(std::has_unique_object_representations_v<PipelineConfig>);
+
+inline bool valid_pipeline_config(const PipelineConfig& config) noexcept {
+  const auto in_range = [](auto value, auto maximum) {
+    using Value = decltype(value);
+    return static_cast<std::underlying_type_t<Value>>(value) >= 0 &&
+           static_cast<std::underlying_type_t<Value>>(value) <=
+               static_cast<std::underlying_type_t<Value>>(maximum);
+  };
+  const bool validSamples = config.msaaSamples == 1 || config.msaaSamples == 2 ||
+                            config.msaaSamples == 4 || config.msaaSamples == 8;
+  return config.version == GXPipelineConfigVersion && validSamples &&
+         in_range(config.depthFunc, GX_ALWAYS) && in_range(config.cullMode, GX_CULL_ALL) &&
+         in_range(config.blendMode, GX_BM_SUBTRACT) &&
+         in_range(config.blendFacSrc, GX_BL_INVDSTALPHA) &&
+         in_range(config.blendFacDst, GX_BL_INVDSTALPHA) &&
+         in_range(config.blendOp, GX_LO_SET) && in_range(config.pixelFmt, GX_PF_YUV420);
+}
+
+wgpu::RenderPipeline create_pipeline([[maybe_unused]] const PipelineConfig& config);
+void clear_shader_module_cache();
+
+// Per-pass encoder state carried across the draws of one render pass, so the replay loop can elide Dawn calls that would re-bind what is already bound.
+struct DrawEncodeState {
+  gfx::PipelineRef currentPipeline = UINTPTR_MAX;
+  // The bind group currently occupying slot 2.
+  WGPUBindGroup boundTextureBindGroup = nullptr;
+  // The pass-wide index buffer binding is established lazily by the first indexed draw; every draw then addresses it with firstIndex instead of a per-draw SetIndexBuffer.
+  bool indexBufferBound = false;
+};
+
+void render(const DrawData& data, const wgpu::RenderPassEncoder& pass, DrawEncodeState& state,
+            bool requireReadyPipeline, const gfx::Range* uniformRangeOverride = nullptr);
+
+void queue_surface(const u8* dlStart, uint32_t dlSize, bool bigEndian) noexcept;
+} // namespace aurora::gx
diff --git a/aurora-main/lib/gx/shader.cpp b/aurora-main/lib/gx/shader.cpp
new file mode 100644
index 0000000..4806f1f
--- /dev/null
+++ b/aurora-main/lib/gx/shader.cpp
@@ -0,0 +1,2064 @@
+#include "../gfx/common.hpp"
+
+#include "../internal.hpp"
+#include "../webgpu/gpu.hpp"
+#include "gx.hpp"
+#include "gx_fmt.hpp"
+#include "shader_info.hpp"
+
+#include <dolphin/gx/GXEnum.h>
+
+#include <array>
+#include <mutex>
+#include <string_view>
+#include <utility>
+
+#include "tracy/Tracy.hpp"
+
+namespace aurora::gx {
+using namespace fmt::literals;
+using namespace std::string_literals;
+using namespace std::string_view_literals;
+
+static Module Log("aurora::gfx::gx");
+
+
+static inline std::string_view chan_comp(GXTevColorChan chan) noexcept {
+  switch (chan) {
+  case GX_CH_RED:
+    return "r";
+  case GX_CH_GREEN:
+    return "g";
+  case GX_CH_BLUE:
+    return "b";
+  case GX_CH_ALPHA:
+    return "a";
+  default:
+    return "?";
+  }
+}
+
+static bool is_alpha_bump_channel(GXChannelID id) noexcept { return id == GX_ALPHA_BUMP || id == GX_ALPHA_BUMPN; }
+
+static std::string_view disabled_texture_color(const ShaderConfig& config) noexcept {
+  return config.numTexGens == 0 ? "vec3f(0.0)"sv : "vec3f(1.0)"sv;
+}
+
+static std::string_view disabled_texture_alpha(const ShaderConfig& config) noexcept {
+  return config.numTexGens == 0 ? "0.0"sv : "1.0"sv;
+}
+
+static std::string tev_mask_expr(const std::string& value, u32 mask) {
+  // t_IndTexCoord is already expanded into the 0..255 indirect sample domain.
+  return fmt::format("(f32(u32({}) & 0x{:X}u) / 255.0)", value, mask);
+}
+
+static std::string alpha_bump_sel(size_t stageIdx, const ShaderConfig& config, const TevStage& stage) {
+  if (stage.indTexStage >= config.numIndStages || stage.indTexAlphaSel == GX_ITBA_OFF) {
+    return "0.0";
+  }
+
+  std::string baseCoord;
+  switch (stage.indTexAlphaSel) {
+    DEFAULT_FATAL("invalid indTexAlphaSel {} for stage {}", underlying(stage.indTexAlphaSel), stageIdx);
+  case GX_ITBA_S:
+    baseCoord = fmt::format("t_IndTexCoord{}.x", underlying(stage.indTexStage));
+    break;
+  case GX_ITBA_T:
+    baseCoord = fmt::format("t_IndTexCoord{}.y", underlying(stage.indTexStage));
+    break;
+  case GX_ITBA_U:
+    baseCoord = fmt::format("t_IndTexCoord{}.z", underlying(stage.indTexStage));
+    break;
+  case GX_ITBA_OFF:
+    return "0.0";
+  }
+
+  switch (stage.indTexFormat) {
+    DEFAULT_FATAL("invalid indirect format {} for stage {}", underlying(stage.indTexFormat), stageIdx);
+  case GX_ITF_8:
+    return tev_mask_expr(baseCoord, 0xF8u);
+  case GX_ITF_5:
+    return tev_mask_expr(baseCoord, 0xE0u);
+  case GX_ITF_4:
+    return tev_mask_expr(baseCoord, 0xF0u);
+  case GX_ITF_3:
+    return tev_mask_expr(baseCoord, 0xF8u);
+  }
+}
+
+u8 color_channel(GXChannelID id) noexcept {
+  switch (id) {
+    DEFAULT_FATAL("unimplemented color channel {}", id);
+  case GX_COLOR0:
+  case GX_ALPHA0:
+  case GX_COLOR0A0:
+    return 0;
+  case GX_COLOR1:
+  case GX_ALPHA1:
+  case GX_COLOR1A1:
+    return 1;
+  }
+}
+
+static std::string color_arg_reg(GXTevColorArg arg, size_t stageIdx, const ShaderConfig& config,
+                                 const TevStage& stage) {
+  switch (arg) {
+    DEFAULT_FATAL("invalid color arg {}", underlying(arg));
+  case GX_CC_CPREV:
+    return "prev.rgb";
+  case GX_CC_APREV:
+    return "vec3f(prev.a)";
+  case GX_CC_C0:
+    return "tevreg0.rgb";
+  case GX_CC_A0:
+    return "vec3f(tevreg0.a)";
+  case GX_CC_C1:
+    return "tevreg1.rgb";
+  case GX_CC_A1:
+    return "vec3f(tevreg1.a)";
+  case GX_CC_C2:
+    return "tevreg2.rgb";
+  case GX_CC_A2:
+    return "vec3f(tevreg2.a)";
+  case GX_CC_TEXC: {
+    if (!tev_stage_texture_dependency(config, static_cast<u32>(stageIdx)).canSampleTexture) {
+      return std::string(disabled_texture_color(config));
+    }
+    const auto& swap = config.tevSwapTable[stage.tevSwapTex];
+    return fmt::format("sampled{}.{}{}{}", stageIdx, chan_comp(swap.red), chan_comp(swap.green), chan_comp(swap.blue));
+  }
+  case GX_CC_TEXA: {
+    if (!tev_stage_texture_dependency(config, static_cast<u32>(stageIdx)).canSampleTexture) {
+      return fmt::format("vec3f({})", disabled_texture_alpha(config));
+    }
+    const auto& swap = config.tevSwapTable[stage.tevSwapTex];
+    return fmt::format("vec3f(sampled{}.{})", stageIdx, chan_comp(swap.alpha));
+  }
+  case GX_CC_RASC: {
+    // CHECK(stage.channelId != GX_COLOR_NULL, "unmapped color channel for stage {}", stageIdx);
+    if (stage.channelId == GX_COLOR_ZERO || stage.channelId == GX_COLOR_NULL) {
+      return "vec3f(0.0)";
+    }
+    if (is_alpha_bump_channel(stage.channelId)) {
+      std::string alpha = alpha_bump_sel(stageIdx, config, stage);
+      if (stage.channelId == GX_ALPHA_BUMPN) {
+        alpha = fmt::format("({} * (255.0 / 248.0))", alpha);
+      }
+      return fmt::format("vec3f({})", alpha);
+    }
+    u32 idx = color_channel(stage.channelId);
+    const auto& swap = config.tevSwapTable[stage.tevSwapRas];
+    return fmt::format("rast{}.{}{}{}", idx, chan_comp(swap.red), chan_comp(swap.green), chan_comp(swap.blue));
+  }
+  case GX_CC_RASA: {
+    // CHECK(stage.channelId != GX_COLOR_NULL, "unmapped color channel for stage {}", stageIdx);
+    if (stage.channelId == GX_COLOR_ZERO || stage.channelId == GX_COLOR_NULL) {
+      return "vec3f(0.0)";
+    }
+    if (is_alpha_bump_channel(stage.channelId)) {
+      std::string alpha = alpha_bump_sel(stageIdx, config, stage);
+      if (stage.channelId == GX_ALPHA_BUMPN) {
+        alpha = fmt::format("({} * (255.0 / 248.0))", alpha);
+      }
+      return fmt::format("vec3f({})", alpha);
+    }
+    u32 idx = color_channel(stage.channelId);
+    const auto& swap = config.tevSwapTable[stage.tevSwapRas];
+    return fmt::format("vec3f(rast{}.{})", idx, chan_comp(swap.alpha));
+  }
+  case GX_CC_ONE:
+    return "vec3f(1.0)";
+  case GX_CC_HALF:
+    return "vec3f(0.5)";
+  case GX_CC_KONST: {
+    switch (stage.kcSel) {
+      DEFAULT_FATAL("invalid kcSel {}", underlying(stage.kcSel));
+    case GX_TEV_KCSEL_8_8:
+      return "vec3f(1.0)";
+    case GX_TEV_KCSEL_7_8:
+      return "vec3f(7.0/8.0)";
+    case GX_TEV_KCSEL_6_8:
+      return "vec3f(6.0/8.0)";
+    case GX_TEV_KCSEL_5_8:
+      return "vec3f(5.0/8.0)";
+    case GX_TEV_KCSEL_4_8:
+      return "vec3f(4.0/8.0)";
+    case GX_TEV_KCSEL_3_8:
+      return "vec3f(3.0/8.0)";
+    case GX_TEV_KCSEL_2_8:
+      return "vec3f(2.0/8.0)";
+    case GX_TEV_KCSEL_1_8:
+      return "vec3f(1.0/8.0)";
+    case GX_TEV_KCSEL_K0:
+      return "ubuf.kcolor0.rgb";
+    case GX_TEV_KCSEL_K1:
+      return "ubuf.kcolor1.rgb";
+    case GX_TEV_KCSEL_K2:
+      return "ubuf.kcolor2.rgb";
+    case GX_TEV_KCSEL_K3:
+      return "ubuf.kcolor3.rgb";
+    case GX_TEV_KCSEL_K0_R:
+      return "vec3f(ubuf.kcolor0.r)";
+    case GX_TEV_KCSEL_K1_R:
+      return "vec3f(ubuf.kcolor1.r)";
+    case GX_TEV_KCSEL_K2_R:
+      return "vec3f(ubuf.kcolor2.r)";
+    case GX_TEV_KCSEL_K3_R:
+      return "vec3f(ubuf.kcolor3.r)";
+    case GX_TEV_KCSEL_K0_G:
+      return "vec3f(ubuf.kcolor0.g)";
+    case GX_TEV_KCSEL_K1_G:
+      return "vec3f(ubuf.kcolor1.g)";
+    case GX_TEV_KCSEL_K2_G:
+      return "vec3f(ubuf.kcolor2.g)";
+    case GX_TEV_KCSEL_K3_G:
+      return "vec3f(ubuf.kcolor3.g)";
+    case GX_TEV_KCSEL_K0_B:
+      return "vec3f(ubuf.kcolor0.b)";
+    case GX_TEV_KCSEL_K1_B:
+      return "vec3f(ubuf.kcolor1.b)";
+    case GX_TEV_KCSEL_K2_B:
+      return "vec3f(ubuf.kcolor2.b)";
+    case GX_TEV_KCSEL_K3_B:
+      return "vec3f(ubuf.kcolor3.b)";
+    case GX_TEV_KCSEL_K0_A:
+      return "vec3f(ubuf.kcolor0.a)";
+    case GX_TEV_KCSEL_K1_A:
+      return "vec3f(ubuf.kcolor1.a)";
+    case GX_TEV_KCSEL_K2_A:
+      return "vec3f(ubuf.kcolor2.a)";
+    case GX_TEV_KCSEL_K3_A:
+      return "vec3f(ubuf.kcolor3.a)";
+    }
+  }
+  case GX_CC_ZERO:
+    return "vec3f(0.0)";
+  }
+}
+
+static std::string alpha_arg_reg(GXTevAlphaArg arg, size_t stageIdx, const ShaderConfig& config,
+                                 const TevStage& stage) {
+  switch (arg) {
+    DEFAULT_FATAL("invalid alpha arg {}", underlying(arg));
+  case GX_CA_APREV:
+    return "prev.a";
+  case GX_CA_A0:
+    return "tevreg0.a";
+  case GX_CA_A1:
+    return "tevreg1.a";
+  case GX_CA_A2:
+    return "tevreg2.a";
+  case GX_CA_TEXA: {
+    if (!tev_stage_texture_dependency(config, static_cast<u32>(stageIdx)).canSampleTexture) {
+      return std::string(disabled_texture_alpha(config));
+    }
+    const auto& swap = config.tevSwapTable[stage.tevSwapTex];
+    return fmt::format("sampled{}.{}", stageIdx, chan_comp(swap.alpha));
+  }
+  case GX_CA_RASA: {
+    // CHECK(stage.channelId != GX_COLOR_NULL, "unmapped color channel for stage {}", stageIdx);
+    if (stage.channelId == GX_COLOR_ZERO || stage.channelId == GX_COLOR_NULL) {
+      return "0.0";
+    }
+    if (is_alpha_bump_channel(stage.channelId)) {
+      std::string alpha = alpha_bump_sel(stageIdx, config, stage);
+      if (stage.channelId == GX_ALPHA_BUMPN) {
+        alpha = fmt::format("({} * (255.0 / 248.0))", alpha);
+      }
+      return alpha;
+    }
+    u32 idx = color_channel(stage.channelId);
+    const auto& swap = config.tevSwapTable[stage.tevSwapRas];
+    return fmt::format("rast{}.{}", idx, chan_comp(swap.alpha));
+  }
+  case GX_CA_KONST: {
+    switch (stage.kaSel) {
+      DEFAULT_FATAL("invalid kaSel {}", underlying(stage.kaSel));
+    case GX_TEV_KASEL_8_8:
+      return "1.0";
+    case GX_TEV_KASEL_7_8:
+      return "(7.0/8.0)";
+    case GX_TEV_KASEL_6_8:
+      return "(6.0/8.0)";
+    case GX_TEV_KASEL_5_8:
+      return "(5.0/8.0)";
+    case GX_TEV_KASEL_4_8:
+      return "(4.0/8.0)";
+    case GX_TEV_KASEL_3_8:
+      return "(3.0/8.0)";
+    case GX_TEV_KASEL_2_8:
+      return "(2.0/8.0)";
+    case GX_TEV_KASEL_1_8:
+      return "(1.0/8.0)";
+    case GX_TEV_KASEL_K0_R:
+      return "ubuf.kcolor0.r";
+    case GX_TEV_KASEL_K1_R:
+      return "ubuf.kcolor1.r";
+    case GX_TEV_KASEL_K2_R:
+      return "ubuf.kcolor2.r";
+    case GX_TEV_KASEL_K3_R:
+      return "ubuf.kcolor3.r";
+    case GX_TEV_KASEL_K0_G:
+      return "ubuf.kcolor0.g";
+    case GX_TEV_KASEL_K1_G:
+      return "ubuf.kcolor1.g";
+    case GX_TEV_KASEL_K2_G:
+      return "ubuf.kcolor2.g";
+    case GX_TEV_KASEL_K3_G:
+      return "ubuf.kcolor3.g";
+    case GX_TEV_KASEL_K0_B:
+      return "ubuf.kcolor0.b";
+    case GX_TEV_KASEL_K1_B:
+      return "ubuf.kcolor1.b";
+    case GX_TEV_KASEL_K2_B:
+      return "ubuf.kcolor2.b";
+    case GX_TEV_KASEL_K3_B:
+      return "ubuf.kcolor3.b";
+    case GX_TEV_KASEL_K0_A:
+      return "ubuf.kcolor0.a";
+    case GX_TEV_KASEL_K1_A:
+      return "ubuf.kcolor1.a";
+    case GX_TEV_KASEL_K2_A:
+      return "ubuf.kcolor2.a";
+    case GX_TEV_KASEL_K3_A:
+      return "ubuf.kcolor3.a";
+    }
+  }
+  case GX_CA_ZERO:
+    return "0.0";
+  }
+}
+
+static std::string tev_bias_i32(GXTevBias bias) {
+  switch (bias) {
+    DEFAULT_FATAL("invalid tev bias {}", underlying(bias));
+  case GX_TB_ZERO:
+    return "0";
+  case GX_TB_ADDHALF:
+    return "128";
+  case GX_TB_SUBHALF:
+    return "-128";
+  }
+}
+
+static std::string tev_scale_index(GXTevScale scale) {
+  switch (scale) {
+    DEFAULT_FATAL("invalid tev scale {}", underlying(scale));
+  case GX_CS_SCALE_1:
+    return "0u";
+  case GX_CS_SCALE_2:
+    return "1u";
+  case GX_CS_SCALE_4:
+    return "2u";
+  case GX_CS_DIVIDE_2:
+    return "3u";
+  }
+}
+
+static std::string tev_regular_op(GXTevOp op, GXTevBias bias, GXTevScale scale, std::string_view a,
+                                  std::string_view b, std::string_view c, std::string_view d,
+                                  std::string_view suffix) {
+  CHECK(op == GX_TEV_ADD || op == GX_TEV_SUB, "invalid regular tev op {}", underlying(op));
+  return fmt::format("tev_regular_{4}({0}, {1}, {2}, {3}, {5}, {6}, {7})", a, b, c, d, suffix,
+                     tev_bias_i32(bias), tev_scale_index(scale), op == GX_TEV_SUB ? "true" : "false");
+}
+
+static std::string tev_op(GXTevOp op, GXTevBias bias, GXTevScale scale, std::string_view a, std::string_view b,
+                          std::string_view c, std::string_view d, std::string_view zero,
+                          std::string_view suffix) {
+  switch (op) {
+    DEFAULT_FATAL("unimplemented tev op {}", underlying(op));
+  case GX_TEV_ADD:
+  case GX_TEV_SUB:
+    return tev_regular_op(op, bias, scale, a, b, c, d, suffix);
+  case GX_TEV_COMP_R8_GT:
+    return fmt::format("select({3}, {2}, round({0}.r * 255.0) > round({1}.r * 255.0)) + {4}", a, b, c, zero, d);
+  case GX_TEV_COMP_R8_EQ:
+    return fmt::format("select({3}, {2}, round({0}.r * 255.0) == round({1}.r * 255.0)) + {4}", a, b, c, zero, d);
+  case GX_TEV_COMP_GR16_GT:
+    return fmt::format(
+        "select({3}, {2}, round(dot({0}.rg * 255.0, vec2(1.0, 256.0))) > round(dot({1}.rg * 255.0, vec2(1.0, 256.0))))"
+        " + {4}",
+        a, b, c, zero, d);
+  case GX_TEV_COMP_GR16_EQ:
+    return fmt::format(
+        "select({3}, {2}, round(dot({0}.rg * 255.0, vec2(1.0, 256.0))) == round(dot({1}.rg * 255.0, vec2(1.0, 256.0))))"
+        " + {4}",
+        a, b, c, zero, d);
+  case GX_TEV_COMP_BGR24_GT:
+    return fmt::format(
+        "select({3}, {2}, round(dot({0}.rgb * 255.0, vec3(1.0, 256.0, 65536.0))) > round(dot({1}.rgb * 255.0, "
+        "vec3(1.0, 256.0, 65536.0)))) + {4}",
+        a, b, c, zero, d);
+  case GX_TEV_COMP_BGR24_EQ:
+    return fmt::format(
+        "select({3}, {2}, round(dot({0}.rgb * 255.0, vec3(1.0, 256.0, 65536.0))) == round(dot({1}.rgb * 255.0, "
+        "vec3(1.0, 256.0, 65536.0)))) + {4}",
+        a, b, c, zero, d);
+  case GX_TEV_COMP_RGB8_GT:
+    return fmt::format("select({3}, {2}, round({0} * 255.0) > round({1} * 255.0)) + {4}", a, b, c, zero, d);
+  case GX_TEV_COMP_RGB8_EQ:
+    return fmt::format("select({3}, {2}, round({0} * 255.0) == round({1} * 255.0)) + {4}", a, b, c, zero, d);
+  }
+}
+
+static std::string tev_color_op(GXTevOp op, GXTevBias bias, GXTevScale scale, bool clamp,
+                                std::string_view a, std::string_view b, std::string_view c, std::string_view d) {
+  const auto overflow = [](std::string_view reg) { return fmt::format("tev_overflow_vec3f({})", reg); };
+  std::string expr = tev_op(op, bias, scale, overflow(a), overflow(b), overflow(c), d, "vec3(0)"sv, "vec3f"sv);
+  return clamp ? fmt::format("clamp({}, vec3f(0.0), vec3f(1.0))", expr)
+               : fmt::format("clamp({}, vec3f(-1024.0 / 255.0), vec3f(1023.0 / 255.0))", expr);
+}
+
+static bool alpha_compare_uses_color_inputs(GXTevOp op) noexcept {
+  switch (op) {
+  case GX_TEV_COMP_R8_GT:
+  case GX_TEV_COMP_R8_EQ:
+  case GX_TEV_COMP_GR16_GT:
+  case GX_TEV_COMP_GR16_EQ:
+  case GX_TEV_COMP_BGR24_GT:
+  case GX_TEV_COMP_BGR24_EQ:
+    return true;
+  default:
+    return false;
+  }
+}
+
+static std::string tev_alpha_op(GXTevOp op, GXTevBias bias, GXTevScale scale, bool clamp,
+                                std::string_view a, std::string_view b, std::string_view c, std::string_view d,
+                                std::string_view colorA, std::string_view colorB) {
+  const auto scalarOverflow = [](std::string_view reg) { return fmt::format("tev_overflow_f32({})", reg); };
+  std::string expr;
+  if (alpha_compare_uses_color_inputs(op)) {
+    const auto colorOverflow = [](std::string_view reg) { return fmt::format("tev_overflow_vec3f({})", reg); };
+    // GX alpha compares R8/GR16/BGR24 using the color combiner's A/B inputs, while C and D remain the scalar alpha-combiner inputs.
+    expr = tev_op(op, bias, scale, colorOverflow(colorA), colorOverflow(colorB), scalarOverflow(c), d, "0.0"sv,
+                  "f32"sv);
+  } else {
+    // The numeric RGB8 op aliases are the alpha combiner's A8 compares and therefore continue to compare scalar alpha A/B inputs here.
+    expr = tev_op(op, bias, scale, scalarOverflow(a), scalarOverflow(b), scalarOverflow(c), d, "0.0"sv, "f32"sv);
+  }
+  return clamp ? fmt::format("clamp({}, 0.0, 1.0)", expr) : fmt::format("clamp({}, -1024.0 / 255.0, 1023.0 / 255.0)", expr);
+}
+
+struct AlphaCompareExpr {
+  std::string expr;
+  int constant = -1;
+};
+
+static AlphaCompareExpr alpha_compare_const(bool value) { return {value ? "true"s : "false"s, value ? 1 : 0}; }
+
+static AlphaCompareExpr alpha_compare_not(const AlphaCompareExpr& expr) {
+  if (expr.constant != -1) {
+    return alpha_compare_const(expr.constant == 0);
+  }
+  return {fmt::format("!{}", expr.expr), -1};
+}
+
+static AlphaCompareExpr alpha_compare_and(const AlphaCompareExpr& lhs, const AlphaCompareExpr& rhs) {
+  if (lhs.constant == 0 || rhs.constant == 0) {
+    return alpha_compare_const(false);
+  }
+  if (lhs.constant == 1) {
+    return rhs;
+  }
+  if (rhs.constant == 1) {
+    return lhs;
+  }
+  return {fmt::format("({} && {})", lhs.expr, rhs.expr), -1};
+}
+
+static AlphaCompareExpr alpha_compare_or(const AlphaCompareExpr& lhs, const AlphaCompareExpr& rhs) {
+  if (lhs.constant == 1 || rhs.constant == 1) {
+    return alpha_compare_const(true);
+  }
+  if (lhs.constant == 0) {
+    return rhs;
+  }
+  if (rhs.constant == 0) {
+    return lhs;
+  }
+  return {fmt::format("({} || {})", lhs.expr, rhs.expr), -1};
+}
+
+static AlphaCompareExpr alpha_compare_xor(const AlphaCompareExpr& lhs, const AlphaCompareExpr& rhs) {
+  if (lhs.constant != -1 && rhs.constant != -1) {
+    return alpha_compare_const(lhs.constant != rhs.constant);
+  }
+  if (lhs.constant == 0) {
+    return rhs;
+  }
+  if (rhs.constant == 0) {
+    return lhs;
+  }
+  if (lhs.constant == 1) {
+    return alpha_compare_not(rhs);
+  }
+  if (rhs.constant == 1) {
+    return alpha_compare_not(lhs);
+  }
+  return {fmt::format("({} != {})", lhs.expr, rhs.expr), -1};
+}
+
+static AlphaCompareExpr alpha_compare_xnor(const AlphaCompareExpr& lhs, const AlphaCompareExpr& rhs) {
+  if (lhs.constant != -1 && rhs.constant != -1) {
+    return alpha_compare_const(lhs.constant == rhs.constant);
+  }
+  if (lhs.constant == 0) {
+    return alpha_compare_not(rhs);
+  }
+  if (rhs.constant == 0) {
+    return alpha_compare_not(lhs);
+  }
+  if (lhs.constant == 1) {
+    return rhs;
+  }
+  if (rhs.constant == 1) {
+    return lhs;
+  }
+  return {fmt::format("({} == {})", lhs.expr, rhs.expr), -1};
+}
+
+static AlphaCompareExpr alpha_compare(GXCompare comp, u8 ref) {
+  const auto iref = static_cast<u32>(ref);
+  switch (comp) {
+  default:
+    return alpha_compare_const(true);
+  case GX_NEVER:
+    return alpha_compare_const(false);
+  case GX_LESS:
+    if (ref == 0) {
+      return alpha_compare_const(false);
+    }
+    return {fmt::format("(alphaCompare < {}u)", iref), -1};
+  case GX_LEQUAL:
+    if (ref == 255) {
+      return alpha_compare_const(true);
+    }
+    return {fmt::format("(alphaCompare <= {}u)", iref), -1};
+  case GX_EQUAL:
+    return {fmt::format("(alphaCompare == {}u)", iref), -1};
+  case GX_NEQUAL:
+    return {fmt::format("(alphaCompare != {}u)", iref), -1};
+  case GX_GEQUAL:
+    if (ref == 0) {
+      return alpha_compare_const(true);
+    }
+    return {fmt::format("(alphaCompare >= {}u)", iref), -1};
+  case GX_GREATER:
+    if (ref == 255) {
+      return alpha_compare_const(false);
+    }
+    return {fmt::format("(alphaCompare > {}u)", iref), -1};
+  case GX_ALWAYS:
+    return alpha_compare_const(true);
+  }
+}
+
+static inline std::string vtx_attr(const ShaderConfig& config, GXAttr attr) {
+  const auto type = config.attrs[attr].attrType;
+  if (type == GX_NONE) {
+    if (attr == GX_VA_PNMTXIDX) {
+      return "ubuf.current_pnmtx";
+    }
+    if (attr == GX_VA_NRM) {
+      // Default normal
+      return "vec3f(1.0, 0.0, 0.0)"s;
+    }
+    if (attr == GX_VA_CLR0 || attr == GX_VA_CLR1) {
+      return "vec4f(1.0)"s;
+    }
+    if (attr >= GX_VA_TEX0 && attr <= GX_VA_TEX7) {
+      return "vec2f(0.0, 0.0)"s;
+    }
+    UNLIKELY FATAL("unmapped vtx attr {}", underlying(attr));
+  }
+  if (attr == GX_VA_POS) {
+    return "in_pos"s;
+  }
+  if (attr == GX_VA_NRM) {
+    return "in_nrm"s;
+  }
+  if (attr == GX_VA_CLR0 || attr == GX_VA_CLR1) {
+    const auto idx = attr - GX_VA_CLR0;
+    return fmt::format("in_clr{}", idx);
+  }
+  if (attr >= GX_VA_TEX0 && attr <= GX_VA_TEX7) {
+    const auto idx = attr - GX_VA_TEX0;
+    return fmt::format("in_tex{}_uv", idx);
+  }
+  if (attr == GX_VA_PNMTXIDX) {
+    return "in_pnmtxidx"s;
+  }
+  if (attr >= GX_VA_TEX0MTXIDX && attr <= GX_VA_TEX7MTXIDX) {
+    const auto idx = attr - GX_VA_TEX0MTXIDX;
+    return fmt::format("in_texmtxidx{}", idx);
+  }
+  UNLIKELY FATAL("unhandled vtx attr {}", underlying(attr));
+}
+
+static std::string vertex_color_attr(const ShaderConfig& config, u32 channel) {
+  const int attr = shader_vertex_color_attr(config, channel);
+  return attr >= 0 ? vtx_attr(config, static_cast<GXAttr>(attr)) : "vec4f(1.0)"s;
+}
+
+constexpr std::array<std::string_view, GX_CC_ZERO + 1> TevColorArgNames{
+    "CPREV"sv, "APREV"sv, "C0"sv,   "A0"sv,   "C1"sv,  "A1"sv,   "C2"sv,    "A2"sv,
+    "TEXC"sv,  "TEXA"sv,  "RASC"sv, "RASA"sv, "ONE"sv, "HALF"sv, "KONST"sv, "ZERO"sv,
+};
+constexpr std::array<std::string_view, GX_CA_ZERO + 1> TevAlphaArgNames{
+    "APREV"sv, "A0"sv, "A1"sv, "A2"sv, "TEXA"sv, "RASA"sv, "KONST"sv, "ZERO"sv,
+};
+
+auto fetch_attr(const AttrConfig& mapping, std::string_view buf, std::string_view offs, bool le, u8 cntOverride = 0) -> std::string {
+  const u8 cnt = cntOverride != 0 ? cntOverride : mapping.cnt;
+  switch (mapping.compType) {
+  case GX_U8:
+    return fmt::format("fetch_u8_{}(&{}, {}, {}, {})", cnt, buf, offs, mapping.frac, le);
+  case GX_S8:
+    return fmt::format("fetch_s8_{}(&{}, {}, {}, {})", cnt, buf, offs, mapping.frac, le);
+  case GX_U16:
+    return fmt::format("fetch_u16_{}(&{}, {}, {}, {})", cnt, buf, offs, mapping.frac, le);
+  case GX_S16:
+    return fmt::format("fetch_s16_{}(&{}, {}, {}, {})", cnt, buf, offs, mapping.frac, le);
+  case GX_F32:
+    return fmt::format("fetch_f32_{}(&{}, {}, {})", cnt, buf, offs, le);
+  case GX_RGBA8:
+    return fmt::format("unpack4x8unorm(load_u32_raw(&{}, {}))", buf, offs);
+  default:
+    Log.fatal("fetch_attr: Unimplemented {}", static_cast<GXCompType>(mapping.compType));
+  }
+}
+
+auto fetch_color_attr(const AttrConfig& mapping, std::string_view buf, std::string_view offs, bool le) -> std::string {
+  switch (mapping.compType) {
+  case GX_RGB565:
+    return fmt::format("fetch_rgb565(&{}, {}, {})", buf, offs, le);
+  case GX_RGB8:
+    return fmt::format("fetch_rgb8(&{}, {}, {})", buf, offs, le);
+  case GX_RGBX8:
+    return fmt::format("fetch_rgbx8(&{}, {}, {})", buf, offs, le);
+  case GX_RGBA4:
+    return fmt::format("fetch_rgba4(&{}, {}, {})", buf, offs, le);
+  case GX_RGBA6:
+    return fmt::format("fetch_rgba6(&{}, {}, {})", buf, offs, le);
+  case GX_RGBA8:
+    return fmt::format("fetch_rgba8(&{}, {}, {})", buf, offs, le);
+  default:
+    Log.fatal("fetch_color_attr: Unimplemented {}", static_cast<GXCompType>(mapping.compType));
+  }
+}
+
+auto attr_load(const ShaderConfig& config, GXAttr attr, std::string_view vidx) -> std::string;
+
+static u32 attr_comp_type_size(u8 compType) noexcept {
+  switch (static_cast<GXCompType>(compType)) {
+  case GX_U8:
+  case GX_S8:
+    return 1;
+  case GX_U16:
+  case GX_S16:
+    return 2;
+  case GX_F32:
+    return 4;
+  default:
+    Log.fatal("attr_comp_type_size: Unimplemented {}", static_cast<GXCompType>(compType));
+  }
+}
+
+static std::string offset_plus(std::string_view offs, u32 add) {
+  if (add == 0) {
+    return std::string(offs);
+  }
+  return fmt::format("({} + {}u)", offs, add);
+}
+
+auto normal_group_load(const ShaderConfig& config, u8 group, std::string_view vidx) -> std::string {
+  const auto& mapping = config.attrs[GX_VA_NRM];
+  if (mapping.attrType == GX_NONE || mapping.cnt != 9) {
+    return attr_load(config, GX_VA_NRM, vidx);
+  }
+
+  auto buf = "vbuf"sv;
+  auto offs = fmt::format("ubuf.vtx_start + {} * {}u + {}u", vidx, config.vtxStride, mapping.offset);
+  auto le = false; // Vertex buffer is always big endian (for now)
+  const bool indexedNbt3 =
+      mapping.nrmIndexCount == 3 && (mapping.attrType == GX_INDEX8 || mapping.attrType == GX_INDEX16);
+  const u32 groupOffset = indexedNbt3 ? 0 : group * 3u * attr_comp_type_size(mapping.compType);
+
+  if (mapping.attrType == GX_INDEX8) {
+    const std::string indexOffs = offset_plus(offs, mapping.nrmIndexCount == 3 ? group : 0);
+    offs = fmt::format("ubuf.array_start[{}] + raw_fetch_u8_1(&{}, {}) * {}u + {}u", GX_VA_NRM - GX_VA_POS, buf,
+                       indexOffs, mapping.stride, groupOffset);
+    buf = "abuf"sv;
+    le = mapping.le;
+  } else if (mapping.attrType == GX_INDEX16) {
+    const std::string indexOffs = offset_plus(offs, mapping.nrmIndexCount == 3 ? group * 2u : 0);
+    offs = fmt::format("ubuf.array_start[{}] + raw_fetch_u16_1(&{}, {}, {}) * {}u + {}u", GX_VA_NRM - GX_VA_POS,
+                       buf, indexOffs, le, mapping.stride, groupOffset);
+    buf = "abuf"sv;
+    le = mapping.le;
+  } else {
+    offs = offset_plus(offs, groupOffset);
+  }
+
+  return fetch_attr(mapping, buf, offs, le, 3);
+}
+
+auto attr_load(const ShaderConfig& config, GXAttr attr, std::string_view vidx) -> std::string {
+  const auto& mapping = config.attrs[attr];
+  if (mapping.attrType == GX_NONE) {
+    return vtx_attr(config, attr);
+  }
+  auto buf = "vbuf"sv;
+  auto offs = fmt::format("ubuf.vtx_start + {} * {}u + {}u", vidx, config.vtxStride, mapping.offset);
+  auto le = false; // Vertex buffer is always big endian (for now)
+  if (mapping.attrType == GX_INDEX8) {
+    offs = fmt::format("ubuf.array_start[{}] + raw_fetch_u8_1(&{}, {}) * {}u", attr - GX_VA_POS, buf, offs,
+                       mapping.stride);
+    buf = "abuf"sv;
+    le = mapping.le;
+  } else if (mapping.attrType == GX_INDEX16) {
+    offs = fmt::format("ubuf.array_start[{}] + raw_fetch_u16_1(&{}, {}, {}) * {}u", attr - GX_VA_POS, buf, offs, le,
+                       mapping.stride);
+    buf = "abuf"sv;
+    le = mapping.le;
+  }
+  switch (attr) {
+  case GX_VA_PNMTXIDX:
+    return fmt::format("(raw_fetch_u8_1(&{}, {}) / 3u)", buf, offs);
+  case GX_VA_TEX0MTXIDX:
+  case GX_VA_TEX1MTXIDX:
+  case GX_VA_TEX2MTXIDX:
+  case GX_VA_TEX3MTXIDX:
+  case GX_VA_TEX4MTXIDX:
+  case GX_VA_TEX5MTXIDX:
+  case GX_VA_TEX6MTXIDX:
+  case GX_VA_TEX7MTXIDX:
+    return fmt::format("raw_fetch_u8_1(&{}, {})", buf, offs);
+  case GX_VA_POS: {
+    const auto posLoad = fetch_attr(mapping, buf, offs, le);
+    if (mapping.cnt == 2) {
+      return fmt::format("vec3f({}, 0.0)", posLoad);
+    }
+    return posLoad;
+  }
+  case GX_VA_NRM:
+    return fetch_attr(mapping, buf, offs, le, mapping.cnt == 9 ? 3 : 0);
+  case GX_VA_CLR0:
+  case GX_VA_CLR1:
+    return fetch_color_attr(mapping, buf, offs, le);
+  case GX_VA_TEX0:
+  case GX_VA_TEX1:
+  case GX_VA_TEX2:
+  case GX_VA_TEX3:
+  case GX_VA_TEX4:
+  case GX_VA_TEX5:
+  case GX_VA_TEX6:
+  case GX_VA_TEX7: {
+    const auto texLoad = fetch_attr(mapping, buf, offs, le);
+    if (mapping.cnt == 1) {
+      return fmt::format("vec2f({}, 0.0)", texLoad);
+    }
+    return texLoad;
+  }
+  default:
+    Log.fatal("attr_load: Unimplemented {}", attr);
+  }
+}
+
+auto lighting_func(const ShaderConfig& config, const ColorChannelConfig& cc, u8 i, bool alpha) -> std::string {
+  std::string_view swizzle = alpha ? ".a"sv : ".rgb"sv;
+  std::string_view intType = alpha ? "i32"sv : "vec3i"sv;
+  std::string_view floatType = alpha ? "f32"sv : "vec3f"sv;
+  std::string_view intZero = alpha ? "0"sv : "vec3i(0)"sv;
+  std::string_view intMax = alpha ? "255"sv : "vec3i(255)"sv;
+  std::string_view shift7 = alpha ? "7u"sv : "vec3u(7u)"sv;
+  std::string_view shift8 = alpha ? "8u"sv : "vec3u(8u)"sv;
+  std::string outVar;
+  std::string_view posVar;
+  if (UsePerPixelLighting) {
+    outVar = fmt::format("rast{}", i);
+    posVar = "in.mv_pos"sv;
+  } else {
+    outVar = fmt::format("out.cc{}", i);
+    posVar = "mv_pos"sv;
+  }
+  std::string ambSrc, matSrc;
+  if (cc.ambSrc == GX_SRC_VTX) {
+    if (UsePerPixelLighting) {
+      ambSrc = fmt::format("in.clr{}", i);
+    } else {
+      ambSrc = vertex_color_attr(config, i);
+    }
+  } else if (cc.ambSrc == GX_SRC_REG) {
+    ambSrc = fmt::format("ubuf.cc{0}{1}_amb", i, alpha ? "a"sv : ""sv);
+  }
+  if (cc.matSrc == GX_SRC_VTX) {
+    if (UsePerPixelLighting) {
+      matSrc = fmt::format("in.clr{}", i);
+    } else {
+      matSrc = vertex_color_attr(config, i);
+    }
+  } else if (cc.matSrc == GX_SRC_REG) {
+    matSrc = fmt::format("ubuf.cc{0}{1}_mat", i, alpha ? "a"sv : ""sv);
+  }
+  if (!cc.lightingEnabled) {
+    // The XF lighting block consumes and produces 8-bit channel values even when lighting is disabled.
+    if (alpha) {
+      return fmt::format("\n    {0}.a = f32(i32(round({1}.a * 255.0))) / 255.0;", outVar, matSrc);
+    }
+    return fmt::format("\n    {0} = vec4f(vec3f(vec3i(round({1}.rgb * 255.0))) / 255.0, 1.0);", outVar,
+                       matSrc);
+  }
+  GXDiffuseFn diffFn = cc.diffFn;
+  std::string lightAttnFn;
+  if (cc.attnFn == GX_AF_NONE) {
+    lightAttnFn = "attn = 1.0;"s;
+  } else if (cc.attnFn == GX_AF_SPOT) {
+    lightAttnFn = fmt::format(R"""(
+          var cosine = max(0.0, dot(ldir, light.dir));
+          var cos_attn = dot(light.cos_att, vec3f(1.0, cosine, cosine * cosine));
+          var dist_attn = dot(light.dist_att, vec3f(1.0, dist, dist2));
+          attn = max(0.0, cos_attn / dist_attn);)""");
+  } else if (cc.attnFn == GX_AF_SPEC) {
+    std::string_view normal = UsePerPixelLighting ? "in.mv_nrm"sv : "mv_nrm"sv;
+    std::string dist_attn = diffFn != GX_DF_NONE
+                                ? "dot(normalize(light.dist_att), vec3f(1.0, attn, attn * attn))"
+                                : "dot(light.dist_att, vec3f(1.0, attn, attn * attn))";
+    lightAttnFn = fmt::format(R"""(
+          attn = select(0.0, max(0.0, dot({0}, light.dir)), dot({0}, ldir) >= 0.0);
+          var cos_attn = dot(light.cos_att, vec3f(1.0, attn, attn * attn));
+          var dist_attn = {1};
+          attn = select(select(0.0, 1.0, cos_attn > 0.0), max(0.0, cos_attn / dist_attn), dist_attn != 0.0);)""",
+                              normal, dist_attn);
+  }
+  std::string_view normal = UsePerPixelLighting ? "in.mv_nrm"sv : "mv_nrm"sv;
+  std::string lightDirSetup;
+  if (cc.attnFn == GX_AF_NONE) {
+    lightDirSetup = fmt::format(R"""(
+          var ldir = light.pos - {0};
+          var dist2 = dot(ldir, ldir);
+          var dist = sqrt(dist2);
+          ldir = select({1}, ldir / max(dist, 1e-20), dist > 0.0);)""",
+                           posVar, normal);
+  } else {
+    lightDirSetup = fmt::format(R"""(
+          var ldir = light.pos - {0};
+          var dist2 = dot(ldir, ldir);
+          var dist = sqrt(dist2);
+          ldir = ldir / dist;)""",
+                           posVar);
+  }
+  std::string_view lightDiffFn;
+  if (diffFn == GX_DF_NONE) {
+    lightDiffFn = "1.0"sv;
+  } else if (diffFn == GX_DF_SIGN) {
+    if (UsePerPixelLighting) {
+      lightDiffFn = "dot(ldir, in.mv_nrm)"sv;
+    } else {
+      lightDiffFn = "dot(ldir, mv_nrm)"sv;
+    }
+  } else if (diffFn == GX_DF_CLAMP) {
+    if (UsePerPixelLighting) {
+      lightDiffFn = "max(0.0, dot(ldir, in.mv_nrm))"sv;
+    } else {
+      lightDiffFn = "max(0.0, dot(ldir, mv_nrm))"sv;
+    }
+  }
+  const auto outputTarget = alpha ? fmt::format("{}.a", outVar) : outVar;
+  const auto outputValue =
+      alpha
+          ? fmt::format("f32((material * (lacc + (lacc >> {}))) >> {}) / 255.0", shift7, shift8)
+          : fmt::format("vec4f(vec3f((material * (lacc + (lacc >> {}))) >> {}) / 255.0, 1.0)", shift7,
+                        shift8);
+  return fmt::format(R"""(
+    {{
+      var lighting = {11}(round({5}{8} * 255.0));
+      for (var i = 0u; i < {1}u; i++) {{
+          if ((ubuf.lightState{0}{9} & (1u << i)) == 0u) {{ continue; }}
+          var light = ubuf.lights[i];{10}
+          var attn: f32;{2}
+          var diff = {3};
+          lighting = lighting + {11}(round(attn * diff * light.color{8} * 255.0));
+      }}
+      let lacc = clamp(lighting, {13}, {14});
+      let material = {11}(round({4}{8} * 255.0));
+      {15} = {16};
+    }})""",
+                     i, GX::MaxLights, lightAttnFn, lightDiffFn, matSrc, ambSrc, posVar, outVar, swizzle,
+                     alpha ? "a"sv : ""sv, lightDirSetup, intType, floatType, intZero, intMax, outputTarget,
+                     outputValue);
+}
+
+wgpu::ShaderModule build_shader(const ShaderConfig& config) noexcept {
+  ZoneScoped;
+  const auto hash = xxh3_hash(config);
+  const auto info = build_shader_info(config);
+
+  std::string uniformPre;
+  std::string uniBufAttrs;
+  std::string texBindings;
+  std::string vtxOutAttrs;
+  std::string vtxInAttrs;
+  std::string vtxXfrAttrsPre;
+  std::string vtxXfrAttrs;
+  size_t vtxOutIdx = 0;
+
+  // Load points for line/point expansion
+  std::string_view vidxAttr = "vidx"sv;
+  if (config.lineMode != 0) {
+    vtxInAttrs += ",\n    @builtin(instance_index) iidx: u32";
+    uniBufAttrs +=
+        "\n    line_width: f32,"
+        "\n    line_aspect_y: f32,"
+        "\n    line_tex_offset: f32,"
+        "\n    line_texcoord_mask: u32,";
+    if (config.lineMode == 3) {
+      // GX_POINTS: each instance = one vertex, expand to quad
+      vtxXfrAttrsPre += fmt::format(
+          "\n    let in_vidx = iidx;"
+          "\n    let in_pos = {};"
+          "\n    let in_pnmtxidx = {};"
+          "\n    let mv_pos = vec4f(in_pos, 1.0) * ubuf.postex_mtx[in_pnmtxidx];",
+          attr_load(config, GX_VA_POS, "in_vidx"sv), attr_load(config, GX_VA_PNMTXIDX, "in_vidx"sv));
+    } else {
+      // GX_LINES / GX_LINESTRIP: each instance = two vertices, expand to quad
+      vtxXfrAttrsPre += fmt::format(
+          "\n    let use_b = vidx >= 2u;"
+          "\n    let vidx_a = iidx * {}u;"
+          "\n    let vidx_b = vidx_a + 1u;"
+          "\n    let in_vidx = select(vidx_a, vidx_b, use_b);"
+          "\n    let pos_a = {};"
+          "\n    let pos_b = {};"
+          "\n    let in_pos = select(pos_a, pos_b, use_b);"
+          "\n    let pnmtxidx_a = {};"
+          "\n    let pnmtxidx_b = {};"
+          "\n    let in_pnmtxidx = select(pnmtxidx_a, pnmtxidx_b, use_b);"
+          "\n    let mv_pos_a = vec4f(pos_a, 1.0) * ubuf.postex_mtx[pnmtxidx_a];"
+          "\n    let mv_pos_b = vec4f(pos_b, 1.0) * ubuf.postex_mtx[pnmtxidx_b];"
+          "\n    let mv_pos = select(mv_pos_a, mv_pos_b, use_b);",
+          config.lineMode == 1 ? 2 : 1, attr_load(config, GX_VA_POS, "vidx_a"sv),
+          attr_load(config, GX_VA_POS, "vidx_b"sv), attr_load(config, GX_VA_PNMTXIDX, "vidx_a"sv),
+          attr_load(config, GX_VA_PNMTXIDX, "vidx_b"sv));
+    }
+    vidxAttr = "in_vidx"sv;
+  } else if (config.attrs[GX_VA_PNMTXIDX].attrType == GX_NONE) {
+    vtxXfrAttrsPre += "\n    let in_pnmtxidx = ubuf.current_pnmtx;";
+  }
+
+  // Load vertex attributes
+  for (GXAttr attr = GX_VA_PNMTXIDX; attr <= GX_VA_TEX7; attr = static_cast<GXAttr>(attr + 1)) {
+    const auto attrType = config.attrs[attr].attrType;
+    if (attrType == GX_NONE) {
+      continue;
+    }
+    // in_pnmtxidx and in_pos written above for line mode
+    if ((attr != GX_VA_PNMTXIDX && attr != GX_VA_POS) || config.lineMode == 0) {
+      vtxXfrAttrsPre += fmt::format("\n    let {} = {};", vtx_attr(config, attr), attr_load(config, attr, vidxAttr));
+    }
+  }
+
+  if (config.lineMode == 0) {
+    vtxXfrAttrsPre += fmt::format(
+        "\n    let mv_pos = vec4f({}, 1.0) * ubuf.postex_mtx[in_pnmtxidx];"
+        "\n    out.pos = vec4f(mv_pos, 1.0) * ubuf.proj;",
+        vtx_attr(config, GX_VA_POS));
+  } else if (config.lineMode == 3) {
+    // GX_POINTS: expand single vertex to axis-aligned screen-space square
+    vtxXfrAttrsPre +=
+        "\n    let clip = vec4f(mv_pos, 1.0) * ubuf.proj;"
+        "\n    let viewport_scale = ubuf.render_viewport_size / max(ubuf.logical_viewport_size, vec2f(1.0));"
+        "\n    let point_size = ubuf.line_width * min(viewport_scale.x, viewport_scale.y);"
+        "\n    let x_sign = select(-1.0, 1.0, (vidx & 1u) != 0u);"
+        "\n    let y_sign = select(-1.0, 1.0, vidx >= 2u);"
+        "\n    let offset_px = vec2f(x_sign, y_sign) * (point_size / 2.0);"
+        "\n    let offset_ndc = (offset_px * 2.0) / ubuf.render_viewport_size;"
+        "\n    out.pos = vec4f(clip.xy + offset_ndc * clip.w, clip.zw);";
+  } else {
+    // GX_LINES / GX_LINESTRIP: expand line segment perpendicular to direction
+    vtxXfrAttrsPre +=
+        "\n    let clip_a = vec4f(mv_pos_a, 1.0) * ubuf.proj;"
+        "\n    let clip_b = vec4f(mv_pos_b, 1.0) * ubuf.proj;"
+        "\n    let ndc_a = clip_a.xy / clip_a.w;"
+        "\n    let ndc_b = clip_b.xy / clip_b.w;"
+        "\n    let viewport_scale = ubuf.render_viewport_size / max(ubuf.logical_viewport_size, vec2f(1.0));"
+        "\n    let delta_px = (ndc_b - ndc_a) / 2.0 * ubuf.render_viewport_size;"
+        "\n    let dir_px = select(vec2f(1.0, 0.0), normalize(delta_px), dot(delta_px, delta_px) > 1e-10);"
+        "\n    let perp_px = vec2f(-dir_px.y, dir_px.x);"
+        "\n    let line_width = ubuf.line_width * min(viewport_scale.x, viewport_scale.y);"
+        "\n    let offset_px = perp_px * (line_width / 2.0) * select(-1.0, 1.0, (vidx & 1u) != 0u);"
+        "\n    let offset_ndc = (offset_px * 2.0) / ubuf.render_viewport_size;"
+        "\n    let clip_base = select(clip_a, clip_b, use_b);"
+        "\n    out.pos = vec4f(clip_base.xy + offset_ndc * clip_base.w, clip_base.zw);";
+  }
+  if constexpr (UseReversedZ) {
+    vtxXfrAttrsPre += "\n    out.pos.z = -out.pos.z;";
+  } else {
+    vtxXfrAttrsPre += "\n    out.pos.z += out.pos.w;";
+  }
+  // GX rasterizes at a 7/12 pixel center when antialiasing is disabled, while WebGPU rasterizes at 1/2.
+  vtxXfrAttrsPre +=
+      "\n    let gx_pixel_center_correction = "
+      "vec2f(-1.0, 1.0) / (6.0 * max(abs(ubuf.render_viewport_size), vec2f(1.0)));"
+      "\n    out.pos = vec4f(out.pos.xy + out.pos.w * gx_pixel_center_correction, out.pos.zw);";
+  vtxXfrAttrsPre += fmt::format(
+      "\n    let nrm_tmp = vec4f({}, 0.0) * ubuf.nrm_mtx[in_pnmtxidx];"
+      "\n    let mv_nrm = select(nrm_tmp, normalize(nrm_tmp), dot(nrm_tmp, nrm_tmp) > 1e-10);",
+      vtx_attr(config, GX_VA_NRM));
+
+  uniBufAttrs += "\n    proj: mat4x4f,";
+  // Only the matrix slots this shader can read are uploaded, in compacted order; see UniformMatrixLayout.
+  uniBufAttrs += fmt::format("\n    postex_mtx: array<mat3x4f, {}>,", info.matrixLayout.postexCount);
+  uniBufAttrs += fmt::format("\n    nrm_mtx: array<mat3x4f, {}>,", info.matrixLayout.nrmCount);
+  std::string fragmentFnPre;
+  std::string fragmentFn;
+  const int zTexStage = tev_z_texture_stage(config);
+  const bool usesZTextureDepth = tev_z_texture_enabled(config);
+  std::array<bool, MaxTexCoord> emittedFixedTexCoord{};
+  const auto fixed_texcoord_name = [&](u32 texCoordId) {
+    if (!emittedFixedTexCoord[texCoordId]) {
+      fragmentFnPre += fmt::format(
+          "\n    let tex{0}_fixed_uv = vec2i(tex{0}_uv * ubuf.texcoord{0}_scale.xy * 128.0);", texCoordId);
+      emittedFixedTexCoord[texCoordId] = true;
+    }
+    return fmt::format("tex{}_fixed_uv", texCoordId);
+  };
+
+  static std::array regName{"prev"sv, "tevreg0"sv, "tevreg1"sv, "tevreg2"sv};
+  for (u32 idx = 0; idx < config.tevStageCount; ++idx) {
+    const auto& stage = config.tevStages[idx];
+    std::string colorA = color_arg_reg(stage.colorPass.a, idx, config, stage);
+    std::string colorB = color_arg_reg(stage.colorPass.b, idx, config, stage);
+    fragmentFn += fmt::format("\n    // TEV stage {}", idx);
+    if (alpha_compare_uses_color_inputs(stage.alphaOp.op)) {
+      const std::string colorAName = fmt::format("tev_stage{}_color_a", idx);
+      const std::string colorBName = fmt::format("tev_stage{}_color_b", idx);
+      // The color result is emitted before the alpha result below.
+      fragmentFn += fmt::format("\n    let {0} = {1};\n    let {2} = {3};", colorAName, colorA, colorBName, colorB);
+      colorA = colorAName;
+      colorB = colorBName;
+    }
+    {
+      std::string_view outReg = regName[stage.colorOp.outReg];
+      std::string op = tev_color_op(
+          stage.colorOp.op, stage.colorOp.bias, stage.colorOp.scale, stage.colorOp.clamp, colorA, colorB,
+          color_arg_reg(stage.colorPass.c, idx, config, stage), color_arg_reg(stage.colorPass.d, idx, config, stage));
+      fragmentFn += fmt::format("\n    {0} = vec4f({1}, {0}.a);", outReg, op);
+    }
+    {
+      std::string_view outReg = regName[stage.alphaOp.outReg];
+      std::string op = tev_alpha_op(
+          stage.alphaOp.op, stage.alphaOp.bias, stage.alphaOp.scale, stage.alphaOp.clamp,
+          alpha_arg_reg(stage.alphaPass.a, idx, config, stage), alpha_arg_reg(stage.alphaPass.b, idx, config, stage),
+          alpha_arg_reg(stage.alphaPass.c, idx, config, stage), alpha_arg_reg(stage.alphaPass.d, idx, config, stage),
+          colorA, colorB);
+      fragmentFn += fmt::format("\n    {0}.a = {1};", outReg, op);
+    }
+  }
+
+  {
+    const auto& lastStage = config.tevStages[config.tevStageCount - 1];
+    if (lastStage.colorOp.outReg != 0) {
+      fragmentFn += fmt::format("\n    prev = vec4f({0}.rgb, prev.a);", regName[lastStage.colorOp.outReg]);
+    }
+    if (lastStage.alphaOp.outReg != 0) {
+      fragmentFn += fmt::format("\n    prev.a = {0}.a;", regName[lastStage.alphaOp.outReg]);
+    }
+  }
+
+  const auto loadsTevRegs = info.loadsTevRegRgb | info.loadsTevRegAlpha;
+  const auto writesTevRegs = info.writesTevRegRgb | info.writesTevRegAlpha;
+  if (loadsTevRegs.test(0)) {
+    uniBufAttrs += "\n    tevprev: vec4f,";
+    fragmentFnPre += "\n    var prev = ubuf.tevprev;";
+  } else {
+    fragmentFnPre += "\n    var prev: vec4f;";
+  }
+  for (int i = 1 /* Skip TEVPREV */; i < loadsTevRegs.size(); ++i) {
+    if (loadsTevRegs.test(i)) {
+      uniBufAttrs += fmt::format("\n    tevreg{}: vec4f,", i - 1);
+      fragmentFnPre += fmt::format("\n    var tevreg{0} = ubuf.tevreg{0};", i - 1);
+    } else if (writesTevRegs.test(i)) {
+      fragmentFnPre += fmt::format("\n    var tevreg{0}: vec4f;", i - 1);
+    }
+  }
+
+  if (info.lightingEnabled) {
+    uniBufAttrs += fmt::format(FMT_STRING(R"""(
+    lights: array<Light, {}>,
+    lightState0: u32,
+    lightState1: u32,
+    lightState0a: u32,
+    lightState1a: u32,)"""),
+                               GX::MaxLights);
+    uniformPre +=
+        "\n"
+        "struct Light {\n"
+        "    pos: vec3f,\n"
+        "    dir: vec3f,\n"
+        "    color: vec4f,\n"
+        "    cos_att: vec3f,\n"
+        "    dist_att: vec3f,\n"
+        "};";
+    if (UsePerPixelLighting) {
+      vtxOutAttrs += fmt::format("\n    @location({}) mv_pos: vec3f,", vtxOutIdx++);
+      vtxOutAttrs += fmt::format("\n    @location({}) mv_nrm: vec3f,", vtxOutIdx++);
+      vtxXfrAttrs += fmt::format(FMT_STRING(R"""(
+    out.mv_pos = mv_pos;
+    out.mv_nrm = mv_nrm;)"""));
+    }
+  }
+
+  for (int i = 0; i < info.sampledColorChannels.size(); ++i) {
+    if (!info.sampledColorChannels.test(i)) {
+      continue;
+    }
+
+    const auto& cc = config.colorChannels[i];
+    const auto& cca = config.colorChannels[i + GX_ALPHA0];
+    if (cc.lightingEnabled && cc.ambSrc == GX_SRC_REG) {
+      uniBufAttrs += fmt::format("\n    cc{0}_amb: vec4f,", i);
+    }
+    if (cc.matSrc == GX_SRC_REG) {
+      uniBufAttrs += fmt::format("\n    cc{0}_mat: vec4f,", i);
+    }
+    if (cca.lightingEnabled && cca.ambSrc == GX_SRC_REG) {
+      uniBufAttrs += fmt::format("\n    cc{0}a_amb: vec4f,", i);
+    }
+    if (cca.matSrc == GX_SRC_REG) {
+      uniBufAttrs += fmt::format("\n    cc{0}a_mat: vec4f,", i);
+    }
+
+    // Output vertex color if necessary
+    if (UsePerPixelLighting) {
+      if ((cc.lightingEnabled && cc.ambSrc == GX_SRC_VTX) || cc.matSrc == GX_SRC_VTX ||
+          (cca.lightingEnabled && cca.ambSrc == GX_SRC_VTX) || cca.matSrc == GX_SRC_VTX) {
+        vtxOutAttrs += fmt::format("\n    @location({}) clr{}: vec4f,", vtxOutIdx++, i);
+        vtxXfrAttrs += fmt::format("\n    out.clr{} = {};", i, vertex_color_attr(config, i));
+      }
+    }
+
+    if (UsePerPixelLighting) {
+      fragmentFnPre += fmt::format("\n    var rast{}: vec4f;", i);
+      fragmentFnPre += lighting_func(config, cc, i, false);
+      fragmentFnPre += lighting_func(config, cca, i, true);
+    } else {
+      vtxOutAttrs += fmt::format("\n    @location({}) cc{}: vec4f,", vtxOutIdx++, i);
+      vtxXfrAttrs += lighting_func(config, cc, i, false);
+      vtxXfrAttrs += lighting_func(config, cca, i, true);
+      fragmentFnPre += fmt::format("\n    var rast{0} = in.cc{0};", i);
+    }
+  }
+  for (int i = 0; i < info.sampledKColors.size(); ++i) {
+    if (info.sampledKColors.test(i)) {
+      uniBufAttrs += fmt::format("\n    kcolor{}: vec4f,", i);
+    }
+  }
+  for (int i = 0; i < info.sampledTexCoords.size(); ++i) {
+    if (!info.sampledTexCoords.test(i)) {
+      continue;
+    }
+    const auto& tcg = config.tcgs[i];
+    if (tcg.type == GX_TG_MTX3x4) {
+      vtxOutAttrs += fmt::format("\n    @location({}) tex{}_uvw: vec3f,", vtxOutIdx++, i);
+    } else {
+      vtxOutAttrs += fmt::format("\n    @location({}) tex{}_uv: vec2f,", vtxOutIdx++, i);
+    }
+    if (tcg.src >= GX_TG_TEX0 && tcg.src <= GX_TG_TEX7) {
+      vtxXfrAttrs += fmt::format("\n    var tc{} = vec4f({}, 1.0, 1.0);", i,
+                                 vtx_attr(config, GXAttr(GX_VA_TEX0 + (tcg.src - GX_TG_TEX0))));
+    } else if (tcg.src == GX_MAX_TEXGENSRC) {
+      vtxXfrAttrs += fmt::format("\n    var tc{} = vec4f({}, 1.0, 1.0);", i,
+                                 vtx_attr(config, GXAttr(GX_VA_TEX0 + i)));
+    } else if (tcg.src == GX_TG_POS) {
+      vtxXfrAttrs += fmt::format("\n    var tc{} = vec4f({}, 1.0);", i, vtx_attr(config, GX_VA_POS));
+    } else if (tcg.src == GX_TG_NRM) {
+      vtxXfrAttrs += fmt::format("\n    var tc{} = vec4f({}, 1.0);", i, vtx_attr(config, GX_VA_NRM));
+    } else if (tcg.src == GX_TG_BINRM) {
+      // GX source row 3 is Dolphin's tangent group in NBT normal arrays.
+      vtxXfrAttrs += fmt::format("\n    var tc{} = vec4f({}, 1.0);", i, normal_group_load(config, 1, vidxAttr));
+    } else if (tcg.src == GX_TG_TANGENT) {
+      // GX source row 4 is Dolphin's binormal group in NBT normal arrays.
+      vtxXfrAttrs += fmt::format("\n    var tc{} = vec4f({}, 1.0);", i, normal_group_load(config, 2, vidxAttr));
+    } else if (tcg.src == GX_TG_COLOR0) {
+      vtxXfrAttrs += fmt::format("\n    var tc{} = vec4f({}.rgb, 1.0);", i, vtx_attr(config, GX_VA_CLR0));
+    } else if (tcg.src == GX_TG_COLOR1) {
+      vtxXfrAttrs += fmt::format("\n    var tc{} = vec4f({}.rgb, 1.0);", i, vtx_attr(config, GX_VA_CLR1));
+    } else
+      UNLIKELY FATAL("unhandled tcg src {}", underlying(tcg.src));
+    if (tcg.inputFormAB11) {
+      vtxXfrAttrs += fmt::format("\n    tc{}.z = 1.0;", i);
+    }
+    if (tcg.type == GX_TG_MTX2x4 || tcg.type == GX_TG_MTX3x4) {
+      if (info.indexAttr.test(GX_VA_TEX0MTXIDX + i)) {
+        vtxXfrAttrs += fmt::format("\n    var tc{0}_tmp = tc{0} * ubuf.postex_mtx[in_texmtxidx{0} / 3u];", i);
+      } else if (tcg.mtx == GX_IDENTITY) {
+        vtxXfrAttrs += fmt::format("\n    var tc{0}_tmp = tc{0}.xyz;", i);
+      } else {
+        const u32 texMtxSlot = (tcg.mtx) / 3;
+        const u32 texMtxIdx = texMtxSlot < MaxPostexMtx ? info.matrixLayout.postexRemap[texMtxSlot]
+                                                        : texMtxSlot;
+        CHECK(texMtxIdx != UniformMatrixLayout::kAbsent,
+              "texgen {} matrix slot {} missing from the uniform layout", i, texMtxSlot);
+        vtxXfrAttrs += fmt::format("\n    var tc{0}_tmp = tc{0} * ubuf.postex_mtx[{1}];", i, texMtxIdx);
+      }
+      if (tcg.type == GX_TG_MTX2x4) {
+        vtxXfrAttrs += fmt::format("\n    tc{0}_tmp.z = 1.0f;", i);
+      }
+    } else if (tcg.type == GX_TG_SRTG) {
+      vtxXfrAttrs += fmt::format("\n    var tc{0}_tmp = vec3f(tc{0}.xy, 1.0f);", i);
+    }
+    if (config.dualTexEnabled && tcg.normalize) {
+      vtxXfrAttrs += fmt::format("\n    tc{0}_tmp = normalize(tc{0}_tmp);", i);
+    }
+    if (!config.dualTexEnabled || tcg.postMtx == GX_PTIDENTITY) {
+      vtxXfrAttrs += fmt::format("\n    var tc{0}_proj = tc{0}_tmp;", i);
+    } else {
+      u32 postMtxIdx = (tcg.postMtx - GX_PTTEXMTX0) / 3;
+      vtxXfrAttrs +=
+          fmt::format("\n    var tc{0}_proj = vec4f(tc{0}_tmp.xyz, 1.0) * ubuf.postmtx[{1}];", i, postMtxIdx);
+    }
+    if (tcg.type == GX_TG_MTX2x4 || tcg.type == GX_TG_MTX3x4) {
+      vtxXfrAttrs += fmt::format(
+          "\n    if (tc{0}_proj.z == 0.0) {{"
+          "\n      tc{0}_proj.x = clamp(tc{0}_proj.x / 2.0, -1.0, 1.0);"
+          "\n      tc{0}_proj.y = clamp(tc{0}_proj.y / 2.0, -1.0, 1.0);"
+          "\n    }}",
+          i);
+    }
+    // Apply line/point tex offset
+    if (config.lineMode == 3) {
+      // GX_POINTS: offset S for right columns, T for bottom rows
+      vtxXfrAttrs += fmt::format(
+          "\n    if ((ubuf.line_texcoord_mask & (1u << {0})) != 0u) {{"
+          "\n        if ((vidx & 1u) != 0u) {{ tc{0}_proj.x += ubuf.line_tex_offset; }}"
+          "\n        if (vidx >= 2u) {{ tc{0}_proj.y += ubuf.line_tex_offset; }}"
+          "\n    }}",
+          i);
+    } else if (config.lineMode != 0) {
+      // GX_LINES / GX_LINESTRIP: offset one axis for perpendicular side
+      vtxXfrAttrs += fmt::format(
+          "\n    if ((ubuf.line_texcoord_mask & (1u << {0})) != 0u && (vidx & 1u) != 0u) {{"
+          "\n        tc{0}_proj.y += ubuf.line_tex_offset;"
+          "\n    }}",
+          i);
+    }
+    if (tcg.type == GX_TG_MTX3x4) {
+      vtxXfrAttrs += fmt::format("\n    out.tex{0}_uvw = tc{0}_proj.xyz;", i);
+      fragmentFnPre += fmt::format(
+          "\n    var tex{0}_uv = in.tex{0}_uvw.xy;"
+          "\n    if (in.tex{0}_uvw.z != 0.0) {{"
+          "\n      tex{0}_uv = in.tex{0}_uvw.xy / in.tex{0}_uvw.z;"
+          "\n    }}",
+          i);
+    } else {
+      vtxXfrAttrs += fmt::format("\n    out.tex{0}_uv = tc{0}_proj.xy;", i);
+      fragmentFnPre += fmt::format("\n    var tex{0}_uv = in.tex{0}_uv.xy;", i);
+    }
+  }
+  // Multiple TEV stages may reference the same indirect stage,
+  // so we sample each indirect texture only once.
+  const auto ind_scale_shift = [](const GXIndTexScale s) -> u32 {
+    switch (s) {
+    case GX_ITS_1:
+      return 0;
+    case GX_ITS_2:
+      return 1;
+    case GX_ITS_4:
+      return 2;
+    case GX_ITS_8:
+      return 3;
+    case GX_ITS_16:
+      return 4;
+    case GX_ITS_32:
+      return 5;
+    case GX_ITS_64:
+      return 6;
+    case GX_ITS_128:
+      return 7;
+    case GX_ITS_256:
+      return 8;
+    default:
+      FATAL("unhandled indirect scale {}", underlying(s));
+    }
+  };
+  for (int i = 0; i < info.usedIndStages.size(); ++i) {
+    if (!info.usedIndStages.test(i)) {
+      continue;
+    }
+    const auto& indStage = config.indStages[i];
+    const int effectiveIndTexCoord = tev_effective_texcoord(config, indStage.texCoordId);
+    const std::string indFixedUv =
+        effectiveIndTexCoord >= 0 ? fixed_texcoord_name(static_cast<u32>(effectiveIndTexCoord)) : "vec2i(0)";
+    fragmentFnPre += fmt::format(
+        "\n    // Indirect stage {0}"
+        "\n    let ind{0}_sample_fixed = {5} >> vec2u({3}u, {4}u);"
+        "\n    let t_IndTexCoord{0} = tev_byte_vec3f(textureSampleBias(tex{2}, tex{2}_samp, "
+        "vec2f(ind{0}_sample_fixed) / (ubuf.tex{2}_size_bias.xy * 128.0), ubuf.tex{2}_size_bias.z).abg);",
+        i, effectiveIndTexCoord, underlying(indStage.texMapId), ind_scale_shift(indStage.scaleS),
+        ind_scale_shift(indStage.scaleT), indFixedUv);
+  }
+  const bool usesFixedTexcoordState = shader_uses_fixed_texcoord_state(config);
+  if (usesFixedTexcoordState) {
+    fragmentFnPre += "\n    var t_TexCoord = vec2i(0);";
+  }
+  for (int i = 0; i < config.tevStageCount; ++i) {
+    const auto& stage = config.tevStages[i];
+    const auto textureDependency = tev_stage_texture_dependency(config, static_cast<u32>(i));
+    const bool needsIndirectCoord = stage.indTexMtxId != GX_ITM_OFF;
+    const bool hasIndirectStage = stage.indTexStage < config.numIndStages;
+    const bool needsTevTexCoord = textureDependency.needsFixedTexcoordState;
+    const bool needsTextureSample = textureDependency.combinerUsesTexture || static_cast<int>(i) == zTexStage;
+    const bool willSampleTexture = tev_texture_sample_enabled(textureDependency, needsTextureSample);
+    if (!needsTevTexCoord && !needsTextureSample) {
+      continue;
+    }
+    const bool hasBaseCoord = textureDependency.texCoordId >= 0;
+    std::string uvIn;
+    if (needsTevTexCoord) {
+      fragmentFnPre += fmt::format("\n    // TEV stage {} indirect", i);
+
+      // Apply indirect texture matrix (produces an S17.7 fixed-point offset).
+      std::string indirectOffsetFixed;
+      if (needsIndirectCoord && hasIndirectStage) {
+        u32 fmtShift = 0;
+        switch (stage.indTexFormat) {
+        case GX_ITF_8:
+          break;
+        case GX_ITF_5:
+          fmtShift = 3;
+          break;
+        case GX_ITF_4:
+          fmtShift = 4;
+          break;
+        case GX_ITF_3:
+          fmtShift = 5;
+          break;
+        default:
+          FATAL("unhandled indirect format {}", underlying(stage.indTexFormat));
+        }
+        if (fmtShift == 0) {
+          fragmentFnPre += fmt::format("\n    var ind{0}_coord = t_IndTexCoord{1};", i, underlying(stage.indTexStage));
+        } else {
+          fragmentFnPre += fmt::format("\n    var ind{0}_coord = t_IndTexCoord{1} >> vec3u({2}u);", i,
+                                       underlying(stage.indTexStage), fmtShift);
+        }
+
+        if (stage.indTexBiasSel != GX_ITB_NONE) {
+          auto bias = stage.indTexFormat == GX_ITF_8 ? "-128"sv : "1"sv;
+          auto biasS = "0"sv, biasT = "0"sv, biasU = "0"sv;
+          if (stage.indTexBiasSel == GX_ITB_S || stage.indTexBiasSel == GX_ITB_ST || stage.indTexBiasSel == GX_ITB_SU ||
+              stage.indTexBiasSel == GX_ITB_STU) {
+            biasS = "1"sv;
+          }
+          if (stage.indTexBiasSel == GX_ITB_T || stage.indTexBiasSel == GX_ITB_ST || stage.indTexBiasSel == GX_ITB_TU ||
+              stage.indTexBiasSel == GX_ITB_STU) {
+            biasT = "1"sv;
+          }
+          if (stage.indTexBiasSel == GX_ITB_U || stage.indTexBiasSel == GX_ITB_SU || stage.indTexBiasSel == GX_ITB_TU ||
+              stage.indTexBiasSel == GX_ITB_STU) {
+            biasU = "1"sv;
+          }
+          fragmentFnPre += fmt::format("\n    ind{0}_coord = ind{0}_coord + vec3i({1}, {2}, {3}) * {4};", i, biasS,
+                                       biasT, biasU, bias);
+        }
+
+        const auto appendScaleShift = [&](u32 mtxIdx) {
+          fragmentFnPre += fmt::format(
+              "\n    let ind{0}_shift = ubuf.ind_mtx[{1}].z;"
+              "\n    if (ind{0}_shift >= 0) {{"
+              "\n      ind{0}_offset_fixed = ind{0}_offset_fixed >> vec2u(u32(ind{0}_shift));"
+              "\n    }} else {{"
+              "\n      ind{0}_offset_fixed = ind{0}_offset_fixed << vec2u(u32(-ind{0}_shift));"
+              "\n    }}",
+              i, mtxIdx * 2 + 1);
+          indirectOffsetFixed = fmt::format("ind{}_offset_fixed", i);
+        };
+
+        if (stage.indTexMtxId >= GX_ITM_0 && stage.indTexMtxId <= GX_ITM_2) {
+          // Static 2x3 matrix: integer dot products, then the hardware's fixed >>3 and exponent shift sequence.
+          u32 mtxIdx = stage.indTexMtxId - GX_ITM_0;
+          fragmentFnPre += fmt::format(
+              "\n    let ind{0}_c0 = ubuf.ind_mtx[{1}];"
+              "\n    let ind{0}_c1 = ubuf.ind_mtx[{2}];"
+              "\n    var ind{0}_offset_fixed = vec2i("
+              "\n      (ind{0}_c0.x * ind{0}_coord.x + ind{0}_c0.z * ind{0}_coord.y + "
+              "ind{0}_c1.x * ind{0}_coord.z) >> 3u,"
+              "\n      (ind{0}_c0.y * ind{0}_coord.x + ind{0}_c0.w * ind{0}_coord.y + "
+              "ind{0}_c1.y * ind{0}_coord.z) >> 3u);",
+              i, mtxIdx * 2, mtxIdx * 2 + 1);
+          appendScaleShift(mtxIdx);
+        } else if (stage.indTexMtxId >= GX_ITM_S0 && stage.indTexMtxId <= GX_ITM_S2 && hasBaseCoord) {
+          // Dynamic S: (fixed UV * indirect S) >> 8, then exponent shift.
+          u32 mtxIdx = stage.indTexMtxId - GX_ITM_S0;
+          u32 regTexCoord = static_cast<u32>(textureDependency.texCoordId);
+          const auto fixedUv = fixed_texcoord_name(regTexCoord);
+          fragmentFnPre += fmt::format(
+              "\n    var ind{0}_offset_fixed = ({1} * vec2i(ind{0}_coord.x)) >> vec2u(8u);", i, fixedUv);
+          appendScaleShift(mtxIdx);
+        } else if (stage.indTexMtxId >= GX_ITM_T0 && stage.indTexMtxId <= GX_ITM_T2 && hasBaseCoord) {
+          // Dynamic T: (fixed UV * indirect T) >> 8, then exponent shift.
+          u32 mtxIdx = stage.indTexMtxId - GX_ITM_T0;
+          u32 regTexCoord = static_cast<u32>(textureDependency.texCoordId);
+          const auto fixedUv = fixed_texcoord_name(regTexCoord);
+          fragmentFnPre += fmt::format(
+              "\n    var ind{0}_offset_fixed = ({1} * vec2i(ind{0}_coord.y)) >> vec2u(8u);", i, fixedUv);
+          appendScaleShift(mtxIdx);
+        }
+      }
+
+      // Wrap base coord and combine with the indirect translation.
+      auto wrap_comp = [](GXIndTexWrap wrap, std::string&& coord) -> std::string {
+        const int mask = tev_indirect_wrap_mask(wrap);
+        if (mask == -1) {
+          return std::move(coord);
+        }
+        if (mask == 0) {
+          return "0";
+        }
+        CHECK(mask > 0, "invalid indirect wrap {}", underlying(wrap));
+        return fmt::format("({} & {})", coord, mask);
+      };
+      std::string baseCoordExpr = "vec2i(0)";
+      if (hasBaseCoord) {
+        u32 texCoordId = static_cast<u32>(textureDependency.texCoordId);
+        baseCoordExpr = fixed_texcoord_name(texCoordId);
+      }
+      const std::string wrappedExpr =
+          fmt::format("vec2i({}, {})", wrap_comp(stage.indTexWrapS, fmt::format("{}.x", baseCoordExpr)),
+                      wrap_comp(stage.indTexWrapT, fmt::format("{}.y", baseCoordExpr)));
+      std::string finalCoord = wrappedExpr;
+      if (!indirectOffsetFixed.empty()) {
+        finalCoord = fmt::format("{} + ({})", wrappedExpr, indirectOffsetFixed);
+      }
+
+      if (usesFixedTexcoordState) {
+        if (stage.indTexAddPrev) {
+          fragmentFnPre += fmt::format("\n    t_TexCoord += {};", finalCoord);
+        } else {
+          fragmentFnPre += fmt::format("\n    t_TexCoord = {};", finalCoord);
+        }
+        fragmentFnPre += "\n    t_TexCoord = tev_s24_fixed_vec2i(t_TexCoord);";
+
+        // ShaderInfo only emits texN_size_bias and texture bindings for a texture that can actually be sampled.
+        if (willSampleTexture) {
+          u32 texMapId = static_cast<u32>(textureDependency.texMapId);
+          fragmentFnPre += fmt::format(
+              "\n    var ind{0}_uv = vec2f(t_TexCoord) / (ubuf.tex{1}_size_bias.xy * 128.0);", i, texMapId);
+          uvIn = fmt::format("ind{0}_uv", i);
+        }
+      }
+    }
+    if (!willSampleTexture) {
+      continue;
+    }
+    if (uvIn.empty()) {
+      // No indirect texturing
+      const auto fixedUv = fixed_texcoord_name(static_cast<u32>(textureDependency.texCoordId));
+      uvIn = fmt::format("vec2f(tev_s24_fixed_vec2i({0})) / (ubuf.tex{1}_size_bias.xy * 128.0)", fixedUv,
+                         textureDependency.texMapId);
+    }
+    fragmentFnPre +=
+        fmt::format("\n    var sampled{0} = textureSampleBias(tex{1}, tex{1}_samp, {2}, ubuf.tex{1}_size_bias.z);", i,
+                    textureDependency.texMapId, uvIn);
+  }
+
+  std::string fogDepthExpr = UseReversedZ ? "in.pos.z" : "(1.0 - in.pos.z)";
+  std::string fogZCoordExpr =
+      fmt::format("u32(round(clamp({}, 0.0, 1.0) * 16777216.0))", fogDepthExpr);
+  if (usesZTextureDepth) {
+    const u32 zTexBias = config.zTexture & 0x00FFFFFFu;
+    const u32 zTexFmt = (config.zTexture >> 24) & 0x3u;
+    const u32 zTexOp = (config.zTexture >> 26) & 0x3u;
+    const std::string zTexSample = zTexStage >= 0 ? fmt::format("sampled{}", zTexStage) : "vec4f(0.0)";
+
+    fragmentFn += fmt::format(
+        "\n    // Z texture"
+        "\n    let ztexSample = clamp({0}, vec4f(0.0), vec4f(1.0)) * 255.0;"
+        "\n    let ztexRaw = vec4u(round(ztexSample));",
+        zTexSample);
+    switch (zTexFmt) {
+    case 0:
+      fragmentFn += fmt::format("\n    var ztexCoord = ({0}u + ztexRaw.a) & 0x00ffffffu;", zTexBias);
+      break;
+    case 1:
+      fragmentFn +=
+          fmt::format("\n    var ztexCoord = ({0}u + ((ztexRaw.a << 8u) | ztexRaw.r)) & 0x00ffffffu;", zTexBias);
+      break;
+    case 2:
+    default:
+      fragmentFn += fmt::format(
+          "\n    var ztexCoord = ({0}u + ((ztexRaw.r << 16u) | (ztexRaw.g << 8u) | ztexRaw.b)) & 0x00ffffffu;",
+          zTexBias);
+      break;
+    }
+    if (zTexOp == GX_ZT_ADD) {
+      fragmentFn += fmt::format(
+          "\n    let oldZ = u32(round(clamp({0}, 0.0, 1.0) * 16777216.0));"
+          "\n    ztexCoord = (ztexCoord + oldZ) & 0x00ffffffu;",
+          UseReversedZ ? "in.pos.z" : "(1.0 - in.pos.z)");
+    }
+    fragmentFn += "\n    let ztexDepth = f32(ztexCoord) / 16777216.0;";
+    fogZCoordExpr = "ztexCoord";
+  }
+
+  if (info.usesPTTexMtx.any())
+    uniBufAttrs += fmt::format("\n    postmtx: array<mat3x4f, {}>,", MaxPTTexMtx);
+  if (info.usesFog) {
+    uniformPre +=
+        "\n"
+        "struct Fog {\n"
+        "    color: vec4f,\n"
+        "    a: f32,\n"
+        "    b: f32,\n"
+        "    c: f32,\n"
+        "    pad: f32,\n"
+        "    range_base: vec4f,\n"
+        "    range_k: array<vec4f, 3>,\n"
+        "}";
+    uniBufAttrs += "\n    fog: Fog,";
+
+    if ((config.fogType & 0x8u) == 0) {
+      fragmentFn += fmt::format(
+          "\n    // Fog"
+          "\n    let fogZCoord = {};"
+          "\n    let fogShiftedZ = fogZCoord >> u32(ubuf.fog.pad);"
+          "\n    var fogZe = (ubuf.fog.a * 16777216.0) / (ubuf.fog.b - f32(fogShiftedZ));",
+          fogZCoordExpr);
+    } else {
+      fragmentFn += fmt::format(
+          "\n    // Fog"
+          "\n    let fogZCoord = {};"
+          "\n    var fogZe = ubuf.fog.a * f32(fogZCoord) / 16777216.0;",
+          fogZCoordExpr);
+    }
+    if (config.fogRangeAdjust) {
+      fragmentFn +=
+          "\n    let fogRangeOffset = (2.0 * (in.pos.x / ubuf.fog.range_base.y)) - 1.0 - ubuf.fog.range_base.x;"
+          "\n    let fogRangeFloatIndex = clamp(9.0 - abs(fogRangeOffset) * 9.0, 0.0, 9.0);"
+          "\n    let fogRangeIndexLower = u32(fogRangeFloatIndex);"
+          "\n    let fogRangeIndexUpper = fogRangeIndexLower + 1u;"
+          "\n    let fogRangeKLower = ubuf.fog.range_k[fogRangeIndexLower >> 2u][fogRangeIndexLower & 3u];"
+          "\n    let fogRangeKUpper = ubuf.fog.range_k[fogRangeIndexUpper >> 2u][fogRangeIndexUpper & 3u];"
+          "\n    let fogRangeK = mix(fogRangeKLower, fogRangeKUpper, fract(fogRangeFloatIndex));"
+          "\n    fogZe *= sqrt(fogRangeOffset * fogRangeOffset + fogRangeK * fogRangeK) / fogRangeK;";
+    }
+    fragmentFn += "\n    var fogF = clamp(fogZe - ubuf.fog.c, 0.0, 1.0);";
+    switch (config.fogType) {
+      DEFAULT_FATAL("invalid fog type {}", config.fogType);
+    case static_cast<GXFogType>(1):
+    case static_cast<GXFogType>(3):
+    case GX_FOG_PERSP_LIN:
+    case static_cast<GXFogType>(9):
+    case static_cast<GXFogType>(11):
+    case GX_FOG_ORTHO_LIN:
+      fragmentFn += "\n    var fogZ = fogF;";
+      break;
+    case GX_FOG_PERSP_EXP:
+    case GX_FOG_ORTHO_EXP:
+      fragmentFn += "\n    var fogZ = 1.0 - exp2(-8.0 * fogF);";
+      break;
+    case GX_FOG_PERSP_EXP2:
+    case GX_FOG_ORTHO_EXP2:
+      fragmentFn += "\n    var fogZ = 1.0 - exp2(-8.0 * fogF * fogF);";
+      break;
+    case GX_FOG_PERSP_REVEXP:
+    case GX_FOG_ORTHO_REVEXP:
+      fragmentFn += "\n    var fogZ = exp2(-8.0 * (1.0 - fogF));";
+      break;
+    case GX_FOG_PERSP_REVEXP2:
+    case GX_FOG_ORTHO_REVEXP2:
+      fragmentFn +=
+          "\n    fogF = 1.0 - fogF;"
+          "\n    var fogZ = exp2(-8.0 * fogF * fogF);";
+      break;
+    }
+    fragmentFn += "\n    prev = vec4f(mix(prev.rgb, ubuf.fog.color.rgb, clamp(fogZ, 0.0, 1.0)), prev.a);";
+  }
+  if (info.usedIndTexMtxs.any()) {
+    uniBufAttrs += "\n    ind_mtx: array<vec4i, 6>,";
+  }
+  for (int i = 0; i < info.sampledTexCoords.size(); ++i) {
+    if (info.sampledTexCoords.test(i)) {
+      uniBufAttrs += fmt::format("\n    texcoord{}_scale: vec4f,", i);
+    }
+  }
+  for (int i = 0; i < info.sampledTextures.size(); ++i) {
+    if (!info.sampledTextures.test(i)) {
+      continue;
+    }
+    uniBufAttrs += fmt::format("\n    tex{}_size_bias: vec4f,", i);
+    texBindings += fmt::format(
+        "\n@group(2) @binding({1})\n"
+        "var tex{0}: texture_2d<f32>;\n"
+        "@group(2) @binding({2})\n"
+        "var tex{0}_samp: sampler;",
+        i, i * 2, i * 2 + 1);
+  }
+  fragmentFn += "\n    prev = tev_overflow_vec4f(prev);";
+  if (config.alphaCompare) {
+    const auto comp0 = alpha_compare(config.alphaCompare.comp0, config.alphaCompare.ref0);
+    const auto comp1 = alpha_compare(config.alphaCompare.comp1, config.alphaCompare.ref1);
+    AlphaCompareExpr pass;
+    switch (config.alphaCompare.op) {
+    default:
+      pass = alpha_compare_and(comp0, comp1);
+      break;
+    case GX_AOP_AND:
+      pass = alpha_compare_and(comp0, comp1);
+      break;
+    case GX_AOP_OR:
+      pass = alpha_compare_or(comp0, comp1);
+      break;
+    case GX_AOP_XOR:
+      pass = alpha_compare_xor(comp0, comp1);
+      break;
+    case GX_AOP_XNOR:
+      pass = alpha_compare_xnor(comp0, comp1);
+      break;
+    }
+    const auto discard = alpha_compare_not(pass);
+    if (discard.constant == 1) {
+      fragmentFn += "\n    // Alpha compare\n    discard;";
+    } else if (discard.constant != 0) {
+      fragmentFn += "\n    // Alpha compare"
+                    "\n    let alphaCompare = u32(round(clamp(prev.a, 0.0, 1.0) * 255.0));";
+      fragmentFn += fmt::format("\n    if ({}) {{ discard; }}", discard.expr);
+    }
+  }
+
+  std::string fragmentReturnType = "@location(0) vec4f";
+  std::string fragmentReturn = "    return prev;";
+  if (usesZTextureDepth) {
+    uniformPre +=
+        "\n"
+        "struct FragmentOutput {\n"
+        "    @location(0) color: vec4f,\n"
+        "    @builtin(frag_depth) depth: f32,\n"
+        "};";
+
+    fragmentFn += fmt::format("\n    let fragDepth = {}ztexDepth;", UseReversedZ ? "" : "1.0 - ");
+    fragmentReturnType = "FragmentOutput";
+    fragmentReturn =
+        "    var out: FragmentOutput;\n"
+        "    out.color = prev;\n"
+        "    out.depth = fragDepth;\n"
+        "    return out;";
+  }
+
+  const auto shaderSource = fmt::format(R"""(
+fn bswap32(v: u32, le: bool) -> u32 {{
+  if (le) {{
+    return v;
+  }}
+  return ((v & 0x000000FFu) << 24u) |
+         ((v & 0x0000FF00u) << 8u) |
+         ((v & 0x00FF0000u) >> 8u) |
+         ((v & 0xFF000000u) >> 24u);
+}}
+
+fn bswap16(v: u32, le: bool) -> u32 {{
+  return select(((v & 0xFFu) << 8u) | (v >> 8u), v, le);
+}}
+
+fn load_u8(p: ptr<storage, array<u32>>, byte_off: u32) -> u32 {{
+  let word = p[byte_off / 4u];
+  let shift = (byte_off & 3u) * 8u;
+  return (word >> shift) & 0xFFu;
+}}
+
+fn load_u32_raw(p: ptr<storage, array<u32>>, byte_off: u32) -> u32 {{
+  let word_idx = byte_off >> 2u;
+  let sub = byte_off & 3u;
+  let lo = p[word_idx];
+  if (sub == 0u) {{
+    return lo;
+  }}
+  let hi = p[word_idx + 1u];
+  let shift = sub * 8u;
+  return (lo >> shift) | (hi << (32u - shift));
+}}
+
+fn load_u16(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> u32 {{
+  let word_idx = byte_off >> 2u;
+  let sub = byte_off & 3u;
+  let word = p[word_idx];
+  if (sub <= 2u) {{
+    return bswap16(extractBits(word, sub * 8u, 16u), le);
+  }}
+  let next = p[word_idx + 1u];
+  let raw = extractBits(word, 24u, 8u) | (extractBits(next, 0u, 8u) << 8u);
+  return bswap16(raw, le);
+}}
+
+fn load_u24(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> u32 {{
+  let raw = load_u32_raw(p, byte_off) & 0x00FFFFFFu;
+  if (le) {{
+    return raw;
+  }}
+  return ((raw & 0x0000FFu) << 16u) |
+         (raw & 0x00FF00u) |
+         ((raw & 0xFF0000u) >> 16u);
+}}
+
+fn load_u32(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> u32 {{
+  return bswap32(load_u32_raw(p, byte_off), le);
+}}
+
+fn load_f32(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> f32 {{
+  return bitcast<f32>(load_u32(p, byte_off, le));
+}}
+
+fn raw_fetch_u8_1(p: ptr<storage, array<u32>>, byte_off: u32) -> u32 {{
+  return load_u8(p, byte_off);
+}}
+
+fn raw_fetch_u8_2(p: ptr<storage, array<u32>>, byte_off: u32) -> vec2u {{
+  let word_idx = byte_off >> 2u;
+  let sub = byte_off & 3u;
+  let word = p[word_idx];
+  if (sub <= 2u) {{
+    let shift = sub * 8u;
+    return vec2u(
+      extractBits(word, shift + 0u, 8u),
+      extractBits(word, shift + 8u, 8u),
+    );
+  }}
+  let next = p[word_idx + 1u];
+  return vec2u(
+    extractBits(word, 24u, 8u),
+    extractBits(next, 0u, 8u),
+  );
+}}
+
+fn raw_fetch_u8_3(p: ptr<storage, array<u32>>, byte_off: u32) -> vec3u {{
+  let raw = load_u32_raw(p, byte_off);
+  return vec3u(
+    extractBits(raw, 0u, 8u),
+    extractBits(raw, 8u, 8u),
+    extractBits(raw, 16u, 8u),
+  );
+}}
+
+fn raw_fetch_u8_4(p: ptr<storage, array<u32>>, byte_off: u32) -> vec4u {{
+  let raw = load_u32_raw(p, byte_off);
+  return vec4u(
+    extractBits(raw, 0u, 8u),
+    extractBits(raw, 8u, 8u),
+    extractBits(raw, 16u, 8u),
+    extractBits(raw, 24u, 8u),
+  );
+}}
+
+fn raw_fetch_u16_1(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> u32 {{
+  return load_u16(p, byte_off, le);
+}}
+
+fn raw_fetch_u16_2(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec2u {{
+  return vec2u(
+    load_u16(p, byte_off + 0u, le),
+    load_u16(p, byte_off + 2u, le),
+  );
+}}
+
+fn raw_fetch_u16_3(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec3u {{
+  return vec3u(
+    load_u16(p, byte_off + 0u, le),
+    load_u16(p, byte_off + 2u, le),
+    load_u16(p, byte_off + 4u, le),
+  );
+}}
+
+fn raw_fetch_u16_4(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec4u {{
+  return vec4u(
+    load_u16(p, byte_off + 0u, le),
+    load_u16(p, byte_off + 2u, le),
+    load_u16(p, byte_off + 4u, le),
+    load_u16(p, byte_off + 6u, le),
+  );
+}}
+
+fn raw_fetch_f32_1(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> f32 {{
+  return load_f32(p, byte_off, le);
+}}
+
+fn raw_fetch_f32_2(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec2f {{
+  return vec2f(
+    load_f32(p, byte_off + 0u, le),
+    load_f32(p, byte_off + 4u, le),
+  );
+}}
+
+fn raw_fetch_f32_3(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec3f {{
+  return vec3f(
+    load_f32(p, byte_off + 0u, le),
+    load_f32(p, byte_off + 4u, le),
+    load_f32(p, byte_off + 8u, le),
+  );
+}}
+
+fn raw_fetch_f32_4(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec4f {{
+  return vec4f(
+    load_f32(p, byte_off + 0u, le),
+    load_f32(p, byte_off + 4u, le),
+    load_f32(p, byte_off + 8u, le),
+    load_f32(p, byte_off + 12u, le),
+  );
+}}
+
+fn fetch_u8_1(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> f32 {{
+  let v = raw_fetch_u8_1(p, byte_off);
+  return f32(v) / f32(1u << frac);
+}}
+
+fn fetch_s8_1(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> f32 {{
+  let v = (bitcast<i32>(raw_fetch_u8_1(p, byte_off)) << 24) >> 24;
+  return f32(v) / f32(1u << frac);
+}}
+
+fn fetch_u8_2(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec2f {{
+  let v = raw_fetch_u8_2(p, byte_off);
+  return vec2f(v) / f32(1u << frac);
+}}
+
+fn fetch_s8_2(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec2f {{
+  let v = (bitcast<vec2i>(raw_fetch_u8_2(p, byte_off)) << vec2u(24u)) >> vec2u(24u);
+  return vec2f(v) / f32(1u << frac);
+}}
+
+fn fetch_u8_3(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec3f {{
+  let v = raw_fetch_u8_3(p, byte_off);
+  return vec3f(v) / f32(1u << frac);
+}}
+
+fn fetch_s8_3(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec3f {{
+  let v = (bitcast<vec3i>(raw_fetch_u8_3(p, byte_off)) << vec3u(24u)) >> vec3u(24u);
+  return vec3f(v) / f32(1u << frac);
+}}
+
+fn fetch_u8_4(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec4f {{
+  let v = raw_fetch_u8_4(p, byte_off);
+  return vec4f(v) / f32(1u << frac);
+}}
+
+fn fetch_s8_4(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec4f {{
+  let v = (bitcast<vec4i>(raw_fetch_u8_4(p, byte_off)) << vec4u(24u)) >> vec4u(24u);
+  return vec4f(v) / f32(1u << frac);
+}}
+
+fn fetch_u16_1(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> f32 {{
+  let v = raw_fetch_u16_1(p, byte_off, le);
+  return f32(v) / f32(1u << frac);
+}}
+
+fn fetch_s16_1(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> f32 {{
+  let v = bitcast<i32>(raw_fetch_u16_1(p, byte_off, le) << 16u) >> 16;
+  return f32(v) / f32(1u << frac);
+}}
+
+fn fetch_u16_2(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec2f {{
+  let v = raw_fetch_u16_2(p, byte_off, le);
+  return vec2f(v) / f32(1u << frac);
+}}
+
+fn fetch_s16_2(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec2f {{
+  let v = (bitcast<vec2i>(raw_fetch_u16_2(p, byte_off, le)) << vec2u(16u)) >> vec2u(16u);
+  return vec2f(v) / f32(1u << frac);
+}}
+
+fn fetch_u16_3(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec3f {{
+  let v = raw_fetch_u16_3(p, byte_off, le);
+  return vec3f(v) / f32(1u << frac);
+}}
+
+fn fetch_s16_3(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec3f {{
+  let v = (bitcast<vec3i>(raw_fetch_u16_3(p, byte_off, le)) << vec3u(16u)) >> vec3u(16u);
+  return vec3f(v) / f32(1u << frac);
+}}
+
+fn fetch_u16_4(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec4f {{
+  let v = raw_fetch_u16_4(p, byte_off, le);
+  return vec4f(v) / f32(1u << frac);
+}}
+
+fn fetch_s16_4(p: ptr<storage, array<u32>>, byte_off: u32, frac: u32, le: bool) -> vec4f {{
+  let v = (bitcast<vec4i>(raw_fetch_u16_4(p, byte_off, le)) << vec4u(16u)) >> vec4u(16u);
+  return vec4f(v) / f32(1u << frac);
+}}
+
+fn fetch_f32_1(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> f32 {{
+  return raw_fetch_f32_1(p, byte_off, le);
+}}
+
+fn fetch_f32_2(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec2f {{
+  return raw_fetch_f32_2(p, byte_off, le);
+}}
+
+fn fetch_f32_3(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec3f {{
+  return raw_fetch_f32_3(p, byte_off, le);
+}}
+
+fn fetch_f32_4(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec4f {{
+  return raw_fetch_f32_4(p, byte_off, le);
+}}
+
+fn fetch_rgb565(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec4f {{
+  let v = load_u16(p, byte_off, le);
+  return vec4f(
+    f32((v >> 11u) & 0x1Fu) / f32(0x1Fu),
+    f32((v >>  5u) & 0x3Fu) / f32(0x3Fu),
+    f32((v >>  0u) & 0x1Fu) / f32(0x1Fu),
+    1.0,
+  );
+}}
+
+fn fetch_rgb8(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec4f {{
+  let v = raw_fetch_u8_3(p, byte_off);
+  return vec4f(f32(v.x), f32(v.y), f32(v.z), 255.0) / 255.0;
+}}
+
+fn fetch_rgbx8(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec4f {{
+  let v = raw_fetch_u8_4(p, byte_off);
+  return vec4f(f32(v.x), f32(v.y), f32(v.z), 255.0) / 255.0;
+}}
+
+fn fetch_rgba4(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec4f {{
+  let v = load_u16(p, byte_off, le);
+  return vec4f(
+    f32((v >> 12u) & 0x0Fu) / f32(0x0Fu),
+    f32((v >>  8u) & 0x0Fu) / f32(0x0Fu),
+    f32((v >>  4u) & 0x0Fu) / f32(0x0Fu),
+    f32((v >>  0u) & 0x0Fu) / f32(0x0Fu),
+  );
+}}
+
+fn fetch_rgba6(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec4f {{
+  let v = load_u24(p, byte_off, le);
+  return vec4f(
+    f32((v >> 18u) & 0x3Fu) / f32(0x3Fu),
+    f32((v >> 12u) & 0x3Fu) / f32(0x3Fu),
+    f32((v >>  6u) & 0x3Fu) / f32(0x3Fu),
+    f32((v >>  0u) & 0x3Fu) / f32(0x3Fu),
+  );
+}}
+
+fn fetch_rgba8(p: ptr<storage, array<u32>>, byte_off: u32, le: bool) -> vec4f {{
+  let v = raw_fetch_u8_4(p, byte_off);
+  return vec4f(v) / 255.0;
+}}
+
+fn tev_overflow_f32(in: f32) -> f32 {{
+  let byte_space = in * 255.0;
+  return (byte_space - floor(byte_space / 256.0) * 256.0) / 255.0;
+}}
+
+fn tev_overflow_vec3f(in: vec3f) -> vec3f {{
+  let byte_space = in * 255.0;
+  return (byte_space - floor(byte_space / 256.0) * 256.0) / 255.0;
+}}
+
+fn tev_overflow_vec4f(in: vec4f) -> vec4f {{
+  let byte_space = in * 255.0;
+  return (byte_space - floor(byte_space / 256.0) * 256.0) / 255.0;
+}}
+
+fn tev_s24_fixed_vec2i(in: vec2i) -> vec2i {{
+  return (in << vec2u(8u)) >> vec2u(8u);
+}}
+
+fn tev_byte_f32(in: f32) -> i32 {{
+  return i32(round(in * 255.0));
+}}
+
+fn tev_byte_vec3f(in: vec3f) -> vec3i {{
+  return vec3i(round(in * 255.0));
+}}
+
+fn tev_regular_i32(a: i32, b: i32, c: i32, d: i32, bias: i32, scale: u32, is_sub: bool) -> i32 {{
+  var d_part = d + bias;
+  var lerp_part = (a << 8u) + (b - a) * (c + (c >> 7u));
+  if (scale == 1u) {{
+    d_part = d_part << 1u;
+    lerp_part = lerp_part << 1u;
+  }}
+  if (scale == 2u) {{
+    d_part = d_part << 2u;
+    lerp_part = lerp_part << 2u;
+  }}
+  if (scale != 3u) {{
+    lerp_part += select(128, 127, is_sub);
+  }}
+  let lerp = lerp_part >> 8u;
+  var result = select(d_part + lerp, d_part - lerp, is_sub);
+  if (scale == 3u) {{
+    result = result >> 1u;
+  }}
+  return result;
+}}
+
+fn tev_regular_f32(a: f32, b: f32, c: f32, d: f32, bias: i32, scale: u32, is_sub: bool) -> f32 {{
+  return f32(tev_regular_i32(tev_byte_f32(a), tev_byte_f32(b), tev_byte_f32(c), tev_byte_f32(d), bias, scale, is_sub)) /
+         255.0;
+}}
+
+fn tev_regular_vec3f(a: vec3f, b: vec3f, c: vec3f, d: vec3f, bias: i32, scale: u32, is_sub: bool) -> vec3f {{
+  let ai = tev_byte_vec3f(a);
+  let bi = tev_byte_vec3f(b);
+  let ci = tev_byte_vec3f(c);
+  let di = tev_byte_vec3f(d);
+  return vec3f(
+    f32(tev_regular_i32(ai.x, bi.x, ci.x, di.x, bias, scale, is_sub)) / 255.0,
+    f32(tev_regular_i32(ai.y, bi.y, ci.y, di.y, bias, scale, is_sub)) / 255.0,
+    f32(tev_regular_i32(ai.z, bi.z, ci.z, di.z, bias, scale, is_sub)) / 255.0,
+  );
+}}
+
+{8}
+
+struct Uniform {{
+    vtx_start: u32,
+    current_pnmtx: u32,
+    render_viewport_size: vec2f,
+    logical_viewport_size: vec2f,
+    pad: vec2u,
+    array_start: array<u32, 12>,{0}
+}};
+@group(0) @binding(0)
+var<storage, read> vbuf: array<u32>;
+@group(0) @binding(1)
+var<storage, read> abuf: array<u32>;
+@group(1) @binding(0)
+var<uniform> ubuf: Uniform;{1}
+
+struct VertexOutput {{
+    @builtin(position) pos: vec4f,{2}
+}};
+
+@vertex
+fn vs_main(
+    @builtin(vertex_index) vidx: u32{3}
+) -> VertexOutput {{
+    var out: VertexOutput;{7}{4}
+    return out;
+}}
+
+@fragment
+fn fs_main(in: VertexOutput) -> {9} {{{6}{5}
+{10}
+}}
+)""",
+                                        uniBufAttrs, texBindings, vtxOutAttrs, vtxInAttrs, vtxXfrAttrs, fragmentFn,
+                                        fragmentFnPre, vtxXfrAttrsPre, uniformPre, fragmentReturnType,
+                                        fragmentReturn);
+  wgpu::ShaderSourceWGSL wgslDescriptor{};
+  wgslDescriptor.code = shaderSource.c_str();
+  const auto label = fmt::format("GX Shader {:x}", hash);
+  const auto shaderDescriptor = wgpu::ShaderModuleDescriptor{
+      .nextInChain = &wgslDescriptor,
+      .label = label.c_str(),
+  };
+  return webgpu::g_device.CreateShaderModule(&shaderDescriptor);
+}
+} // namespace aurora::gx
diff --git a/aurora-main/lib/gx/shader_info.cpp b/aurora-main/lib/gx/shader_info.cpp
new file mode 100644
index 0000000..3c21e4f
--- /dev/null
+++ b/aurora-main/lib/gx/shader_info.cpp
@@ -0,0 +1,738 @@
+#include "shader_info.hpp"
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <bitset>
+#include <chrono>
+#include <cmath>
+#include <cstdio>
+#include <cstring>
+#if !defined(_LIBCPP_VERSION)
+#include <execution>
+#endif
+#include <limits>
+#include <memory>
+#include <unordered_map>
+#include <vector>
+
+#include <tracy/Tracy.hpp>
+
+namespace aurora::gx {
+// TODO: remove, just for testing
+bool enableLodBias = true;
+
+namespace {
+Module Log("aurora::gx");
+
+bool is_alpha_bump_channel(GXChannelID id) { return id == GX_ALPHA_BUMP || id == GX_ALPHA_BUMPN; }
+
+bool sampled_color_channel(GXChannelID id, size_t& out) {
+  switch (id) {
+  case GX_COLOR0:
+  case GX_ALPHA0:
+  case GX_COLOR0A0:
+    out = 0;
+    return true;
+  case GX_COLOR1:
+  case GX_ALPHA1:
+  case GX_COLOR1A1:
+    out = 1;
+    return true;
+  default:
+    return false;
+  }
+}
+
+Fog fog_uniform() {
+  const auto& state = g_gxState.fog;
+  Fog fog{
+      .color = state.color,
+      .a = state.aRaw,
+      .b = static_cast<float>(state.bMagnitude),
+      .c = state.c,
+      .pad = static_cast<float>(state.bShift),
+  };
+
+  const u32 rangeBase = g_gxState.fogRange[0];
+  const bool rangeEnabled = (rangeBase & (1u << 10)) != 0;
+  float rangeWidth = std::abs(g_gxState.xfViewport[0]) * 2.0f;
+  if (rangeWidth <= 0.0f) {
+    rangeWidth = 1.0f;
+  }
+  const int rangeCenter = static_cast<int>(rangeBase & 0x3ffu) - 342;
+  const float screenSpaceCenter = rangeEnabled ? ((static_cast<float>(rangeCenter) / rangeWidth) * 2.0f) - 1.0f
+                                               : 0.0f;
+  fog.rangeBase = {screenSpaceCenter, rangeEnabled ? rangeWidth : 1.0f, 0.0f, 0.0f};
+
+  std::array<float, 12> rangeK{};
+  size_t kIndex = 0;
+  for (size_t i = 1; i < g_gxState.fogRange.size(); ++i) {
+    const u32 packed = g_gxState.fogRange[i];
+    rangeK[kIndex++] = static_cast<float>((packed >> 12) & 0xfffu) / 64.0f;
+    rangeK[kIndex++] = static_cast<float>(packed & 0xfffu) / 64.0f;
+  }
+  rangeK[10] = rangeK[9];
+  rangeK[11] = rangeK[9];
+  for (size_t i = 0; i < fog.rangeK.size(); ++i) {
+    fog.rangeK[i] = {rangeK[i * 4 + 0], rangeK[i * 4 + 1], rangeK[i * 4 + 2], rangeK[i * 4 + 3]};
+  }
+  return fog;
+}
+
+float sanitize_light_dir_component(float value) noexcept {
+  u32 bits = 0;
+  std::memcpy(&bits, &value, sizeof(bits));
+  if ((bits & 0x7f800000u) != 0x7f800000u) {
+    return value;
+  }
+  if ((bits & 0x007fffffu) != 0) {
+    return 0.0f;
+  }
+  return (bits & 0x80000000u) != 0 ? -1.0f : 1.0f;
+}
+} // namespace
+
+Light prepare_shader_light(Light light) noexcept {
+  if (std::fabs(light.distAtt[0]) < 0.00001f && std::fabs(light.distAtt[1]) < 0.00001f &&
+      std::fabs(light.distAtt[2]) < 0.00001f) {
+    light.distAtt[0] = 0.00001f;
+  }
+
+  const double normSq = static_cast<double>(light.dir[0]) * static_cast<double>(light.dir[0]) +
+                        static_cast<double>(light.dir[1]) * static_cast<double>(light.dir[1]) +
+                        static_cast<double>(light.dir[2]) * static_cast<double>(light.dir[2]);
+  if (normSq == 0.0) {
+    light.dir[0] = 0.0f;
+    light.dir[1] = 0.0f;
+    light.dir[2] = 0.0f;
+    return light;
+  }
+  const double invNorm = 1.0 / std::sqrt(normSq);
+  // Aurora is built with fast-math, under which std::isnan/std::isinf may be optimized away.
+  light.dir[0] = sanitize_light_dir_component(static_cast<float>(light.dir[0] * invNorm));
+  light.dir[1] = sanitize_light_dir_component(static_cast<float>(light.dir[1] * invNorm));
+  light.dir[2] = sanitize_light_dir_component(static_cast<float>(light.dir[2] * invNorm));
+  return light;
+}
+
+namespace {
+Vec4<float> texture_size_bias(const gfx::TextureBind& tex) {
+  auto width = static_cast<float>(tex.texObj.width());
+  auto height = static_cast<float>(tex.texObj.height());
+  const auto vpBias =
+      enableLodBias && tex.ref && tex.ref->hasArbitraryMips
+          ? log2(std::min(g_gxState.renderViewport.width / std::max(g_gxState.logicalViewport.width, 1.f),
+                          g_gxState.renderViewport.height / std::max(g_gxState.logicalViewport.height, 1.f)))
+          : 0.f;
+  return {width, height, tex.texObj.lod_bias() + vpBias, 0.0f};
+}
+
+Vec4<float> texcoord_scale(const TexCoordScale& scale) {
+  return {static_cast<float>(scale.scaleS) + 1.0f, static_cast<float>(scale.scaleT) + 1.0f,
+          scale.biasS ? 1.0f : 0.0f, scale.biasT ? 1.0f : 0.0f};
+}
+
+void mark_texture_sample(const TevStageTextureDependency& dependency, ShaderInfo& info) {
+  if (!dependency.canSampleTexture) {
+    return;
+  }
+  info.sampledTexCoords.set(static_cast<size_t>(dependency.texCoordId));
+  info.sampledTextures.set(static_cast<size_t>(dependency.texMapId));
+}
+
+void mark_tev_reg_read(GXTevRegID reg, bool alpha, ShaderInfo& info) {
+  auto& writes = alpha ? info.writesTevRegAlpha : info.writesTevRegRgb;
+  auto& loads = alpha ? info.loadsTevRegAlpha : info.loadsTevRegRgb;
+  if (!writes.test(reg)) {
+    loads.set(reg);
+  }
+}
+
+void color_arg_reg_info(GXTevColorArg arg, const TevStage& stage,
+                        const TevStageTextureDependency& textureDependency, ShaderInfo& info) {
+  switch (arg) {
+  case GX_CC_CPREV:
+    mark_tev_reg_read(GX_TEVPREV, false, info);
+    break;
+  case GX_CC_APREV:
+    mark_tev_reg_read(GX_TEVPREV, true, info);
+    break;
+  case GX_CC_C0:
+    mark_tev_reg_read(GX_TEVREG0, false, info);
+    break;
+  case GX_CC_A0:
+    mark_tev_reg_read(GX_TEVREG0, true, info);
+    break;
+  case GX_CC_C1:
+    mark_tev_reg_read(GX_TEVREG1, false, info);
+    break;
+  case GX_CC_A1:
+    mark_tev_reg_read(GX_TEVREG1, true, info);
+    break;
+  case GX_CC_C2:
+    mark_tev_reg_read(GX_TEVREG2, false, info);
+    break;
+  case GX_CC_A2:
+    mark_tev_reg_read(GX_TEVREG2, true, info);
+    break;
+  case GX_CC_TEXC:
+  case GX_CC_TEXA:
+    mark_texture_sample(textureDependency, info);
+    break;
+  case GX_CC_RASC:
+  case GX_CC_RASA:
+    if (stage.channelId != GX_COLOR_NULL && stage.channelId != GX_COLOR_ZERO &&
+        !is_alpha_bump_channel(stage.channelId)) {
+      size_t channel = 0;
+      if (sampled_color_channel(stage.channelId, channel)) {
+        info.sampledColorChannels.set(channel);
+      }
+    }
+    break;
+  case GX_CC_KONST:
+    switch (stage.kcSel) {
+    case GX_TEV_KCSEL_K0:
+    case GX_TEV_KCSEL_K0_R:
+    case GX_TEV_KCSEL_K0_G:
+    case GX_TEV_KCSEL_K0_B:
+    case GX_TEV_KCSEL_K0_A:
+      info.sampledKColors.set(0);
+      break;
+    case GX_TEV_KCSEL_K1:
+    case GX_TEV_KCSEL_K1_R:
+    case GX_TEV_KCSEL_K1_G:
+    case GX_TEV_KCSEL_K1_B:
+    case GX_TEV_KCSEL_K1_A:
+      info.sampledKColors.set(1);
+      break;
+    case GX_TEV_KCSEL_K2:
+    case GX_TEV_KCSEL_K2_R:
+    case GX_TEV_KCSEL_K2_G:
+    case GX_TEV_KCSEL_K2_B:
+    case GX_TEV_KCSEL_K2_A:
+      info.sampledKColors.set(2);
+      break;
+    case GX_TEV_KCSEL_K3:
+    case GX_TEV_KCSEL_K3_R:
+    case GX_TEV_KCSEL_K3_G:
+    case GX_TEV_KCSEL_K3_B:
+    case GX_TEV_KCSEL_K3_A:
+      info.sampledKColors.set(3);
+      break;
+    default:
+      break;
+    }
+    break;
+  default:
+    break;
+  }
+}
+
+void alpha_arg_reg_info(GXTevAlphaArg arg, const TevStage& stage,
+                        const TevStageTextureDependency& textureDependency, ShaderInfo& info) {
+  switch (arg) {
+  case GX_CA_APREV:
+    mark_tev_reg_read(GX_TEVPREV, true, info);
+    break;
+  case GX_CA_A0:
+    mark_tev_reg_read(GX_TEVREG0, true, info);
+    break;
+  case GX_CA_A1:
+    mark_tev_reg_read(GX_TEVREG1, true, info);
+    break;
+  case GX_CA_A2:
+    mark_tev_reg_read(GX_TEVREG2, true, info);
+    break;
+  case GX_CA_TEXA:
+    mark_texture_sample(textureDependency, info);
+    break;
+  case GX_CA_RASA:
+    if (stage.channelId != GX_COLOR_NULL && stage.channelId != GX_COLOR_ZERO &&
+        !is_alpha_bump_channel(stage.channelId)) {
+      size_t channel = 0;
+      if (sampled_color_channel(stage.channelId, channel)) {
+        info.sampledColorChannels.set(channel);
+      }
+    }
+    break;
+  case GX_CA_KONST:
+    switch (stage.kaSel) {
+    case GX_TEV_KASEL_K0_R:
+    case GX_TEV_KASEL_K0_G:
+    case GX_TEV_KASEL_K0_B:
+    case GX_TEV_KASEL_K0_A:
+      info.sampledKColors.set(0);
+      break;
+    case GX_TEV_KASEL_K1_R:
+    case GX_TEV_KASEL_K1_G:
+    case GX_TEV_KASEL_K1_B:
+    case GX_TEV_KASEL_K1_A:
+      info.sampledKColors.set(1);
+      break;
+    case GX_TEV_KASEL_K2_R:
+    case GX_TEV_KASEL_K2_G:
+    case GX_TEV_KASEL_K2_B:
+    case GX_TEV_KASEL_K2_A:
+      info.sampledKColors.set(2);
+      break;
+    case GX_TEV_KASEL_K3_R:
+    case GX_TEV_KASEL_K3_G:
+    case GX_TEV_KASEL_K3_B:
+    case GX_TEV_KASEL_K3_A:
+      info.sampledKColors.set(3);
+      break;
+    default:
+      break;
+    }
+    break;
+  default:
+    break;
+  }
+}
+} // namespace
+
+ShaderInfo build_shader_info(const ShaderConfig& config) noexcept {
+  ZoneScoped;
+
+  ShaderInfo info{
+      // vtx_start, current_pnmtx, render/logical viewport size, array_start, pad, proj
+      .uniformSize = 4 + 4 + 8 + 8 + 8 + 48 + 64,
+  };
+
+  if (config.lineMode != 0) {
+    info.uniformSize += 4 + 4 + 4 + 4; // line_width, line_aspect_y, line_tex_offset, line_texcoord_mask
+    info.lineMode = config.lineMode;
+  }
+
+  for (int attr = 0; attr < config.attrs.size(); attr++) {
+    const auto attrType = config.attrs[attr].attrType;
+    if ((attr == GX_VA_PNMTXIDX || (attr >= GX_VA_TEX0MTXIDX && attr <= GX_VA_TEX7MTXIDX)) && attrType == GX_DIRECT) {
+      info.indexAttr.set(attr);
+    } else if (attrType == GX_INDEX8 || attrType == GX_INDEX16) {
+      info.indexAttr.set(attr);
+    }
+  }
+
+  for (int i = 0; i < config.tevStageCount; ++i) {
+    const auto& stage = config.tevStages[i];
+    const auto textureDependency = tev_stage_texture_dependency(config, static_cast<u32>(i));
+    // Color pass
+    color_arg_reg_info(stage.colorPass.a, stage, textureDependency, info);
+    color_arg_reg_info(stage.colorPass.b, stage, textureDependency, info);
+    color_arg_reg_info(stage.colorPass.c, stage, textureDependency, info);
+    color_arg_reg_info(stage.colorPass.d, stage, textureDependency, info);
+    info.writesTevRegRgb.set(stage.colorOp.outReg);
+
+    // Alpha pass
+    alpha_arg_reg_info(stage.alphaPass.a, stage, textureDependency, info);
+    alpha_arg_reg_info(stage.alphaPass.b, stage, textureDependency, info);
+    alpha_arg_reg_info(stage.alphaPass.c, stage, textureDependency, info);
+    alpha_arg_reg_info(stage.alphaPass.d, stage, textureDependency, info);
+    info.writesTevRegAlpha.set(stage.alphaOp.outReg);
+  }
+  if (const int zTexStage = tev_z_texture_stage(config); zTexStage >= 0) {
+    mark_texture_sample(tev_stage_texture_dependency(config, static_cast<u32>(zTexStage)), info);
+  }
+  for (int i = 0; i < config.tevStageCount; ++i) {
+    const auto& stage = config.tevStages[i];
+    const auto textureDependency = tev_stage_texture_dependency(config, static_cast<u32>(i));
+
+    // Coordinate state is independent of whether this stage has an enabled texture map.
+    if (textureDependency.needsFixedTexcoordState && textureDependency.texCoordId >= 0) {
+      info.sampledTexCoords.set(static_cast<size_t>(textureDependency.texCoordId));
+    }
+
+    // Skip if not enabled
+    if (stage.indTexStage >= config.numIndStages) {
+      continue;
+    }
+    const bool usesIndStage = stage.indTexMtxId != GX_ITM_OFF || is_alpha_bump_channel(stage.channelId);
+    if (!usesIndStage) {
+      continue;
+    }
+    info.usedIndStages.set(stage.indTexStage);
+    const auto& indStage = config.indStages[stage.indTexStage];
+    if (indStage.texMapId < MaxTextures) {
+      info.sampledTextures.set(indStage.texMapId);
+      info.sampledIndTextures.set(indStage.texMapId);
+    }
+    const int effectiveIndTexCoord = tev_effective_texcoord(config, indStage.texCoordId);
+    if (effectiveIndTexCoord >= 0) {
+      info.sampledTexCoords.set(static_cast<size_t>(effectiveIndTexCoord));
+    }
+    // Track which indirect matrix is used
+    if (stage.indTexMtxId >= GX_ITM_0 && stage.indTexMtxId <= GX_ITM_2) {
+      info.usedIndTexMtxs.set(stage.indTexMtxId - GX_ITM_0);
+    } else if (stage.indTexMtxId >= GX_ITM_S0 && stage.indTexMtxId <= GX_ITM_S2) {
+      info.usedIndTexMtxs.set(stage.indTexMtxId - GX_ITM_S0);
+    } else if (stage.indTexMtxId >= GX_ITM_T0 && stage.indTexMtxId <= GX_ITM_T2) {
+      info.usedIndTexMtxs.set(stage.indTexMtxId - GX_ITM_T0);
+    }
+  }
+
+  const auto loadsTevRegs = info.loadsTevRegRgb | info.loadsTevRegAlpha;
+  info.uniformSize += loadsTevRegs.count() * sizeof(Vec4<float>);
+  for (int i = 0; i < info.sampledColorChannels.size(); ++i) {
+    if (info.sampledColorChannels.test(i)) {
+      const auto& cc = config.colorChannels[i];
+      const auto& cca = config.colorChannels[i + GX_ALPHA0];
+      if (cc.lightingEnabled || cca.lightingEnabled) {
+        info.lightingEnabled = true;
+      }
+    }
+  }
+  if (info.lightingEnabled) {
+    // Lights + light state for all channels
+    info.uniformSize += 16 + sizeof(Light) * GX::MaxLights;
+  }
+  for (int i = 0; i < info.sampledColorChannels.size(); ++i) {
+    if (info.sampledColorChannels.test(i)) {
+      const auto& cc = config.colorChannels[i];
+      if (cc.lightingEnabled && cc.ambSrc == GX_SRC_REG) {
+        info.uniformSize += sizeof(Vec4<float>);
+      }
+      if (cc.matSrc == GX_SRC_REG) {
+        info.uniformSize += sizeof(Vec4<float>);
+      }
+      const auto& cca = config.colorChannels[i + GX_ALPHA0];
+      if (cca.lightingEnabled && cca.ambSrc == GX_SRC_REG) {
+        info.uniformSize += sizeof(Vec4<float>);
+      }
+      if (cca.matSrc == GX_SRC_REG) {
+        info.uniformSize += sizeof(Vec4<float>);
+      }
+    }
+  }
+  info.uniformSize += info.sampledKColors.count() * sizeof(Vec4<float>);
+  for (int i = 0; i < info.sampledTexCoords.size(); ++i) {
+    if (!info.sampledTexCoords.test(i)) {
+      continue;
+    }
+    const auto& tcg = config.tcgs[i];
+    if (config.dualTexEnabled && tcg.postMtx != GX_PTIDENTITY) {
+      u32 postMtxIdx = (tcg.postMtx - GX_PTTEXMTX0) / 3;
+      info.usesPTTexMtx.set(postMtxIdx);
+    }
+  }
+  if (info.usesPTTexMtx.any())
+    info.uniformSize += sizeof(Mat3x4<float>) * MaxPTTexMtx;
+
+  // Resolve the matrix slots this shader can read.
+  {
+    auto& layout = info.matrixLayout;
+    layout.postexRemap.fill(UniformMatrixLayout::kAbsent);
+
+    const bool dynamicPnMtx = config.attrs[GX_VA_PNMTXIDX].attrType != GX_NONE;
+    bool dynamicTexMtx = false;
+    std::bitset<MaxPostexMtx> literalSlots;
+    for (size_t i = 0; i < info.sampledTexCoords.size(); ++i) {
+      if (!info.sampledTexCoords.test(i)) {
+        continue;
+      }
+      const auto& tcg = config.tcgs[i];
+      if (tcg.type != GX_TG_MTX2x4 && tcg.type != GX_TG_MTX3x4) {
+        continue;
+      }
+      if (info.indexAttr.test(GX_VA_TEX0MTXIDX + i)) {
+        // A per-vertex texture matrix index addresses raw matrix memory and can name any row, including the position rows.
+        dynamicTexMtx = true;
+        continue;
+      }
+      if (tcg.mtx == GX_IDENTITY) {
+        continue;
+      }
+      const u32 slot = static_cast<u32>(tcg.mtx) / 3;
+      if (slot >= MaxPostexMtx) {
+        // Out of range for the shader array; preserve the uncompacted layout rather than inventing a different (still invalid) index.
+        dynamicTexMtx = true;
+        continue;
+      }
+      literalSlots.set(slot);
+    }
+
+    // At most MaxPostexMtx entries can ever be pushed: the absolute layout pushes the ten position slots plus at most ten texture slots, and the compacted layout pushes the current matrix plus at most one literal slot per texgen.
+    const auto pushPostex = [&](u8 slot) {
+      CHECK(layout.postexCount < layout.postexSlots.size(), "postex matrix layout overflow");
+      layout.postexSlots[layout.postexCount++] = slot;
+    };
+    const auto pushNrm = [&](u8 slot) {
+      CHECK(layout.nrmCount < layout.nrmSlots.size(), "normal matrix layout overflow");
+      layout.nrmSlots[layout.nrmCount++] = slot;
+    };
+
+    layout.absolutePosRegion = dynamicPnMtx || dynamicTexMtx;
+    if (!layout.absolutePosRegion) {
+      // Compact slot 0 always holds the matrix selected by the current matrix index; build_uniform writes 0 into `current_pnmtx` to match.
+      pushPostex(UniformMatrixLayout::kCurrentPnMtx);
+      pushNrm(UniformMatrixLayout::kCurrentPnMtx);
+    }
+    for (u32 slot = 0; slot < MaxPnMtx; ++slot) {
+      if (!layout.absolutePosRegion && !literalSlots.test(slot)) {
+        continue;
+      }
+      layout.postexRemap[slot] = layout.postexCount;
+      pushPostex(static_cast<u8>(slot));
+      if (layout.absolutePosRegion) {
+        // The normal array is indexed by the same expression as the position array, so its compact indices have to line up with the position slots.
+        pushNrm(static_cast<u8>(slot));
+      }
+    }
+    for (u32 slot = MaxPnMtx; slot < MaxPostexMtx; ++slot) {
+      if (!dynamicTexMtx && !literalSlots.test(slot)) {
+        continue;
+      }
+      layout.postexRemap[slot] = layout.postexCount;
+      pushPostex(static_cast<u8>(slot));
+    }
+    // `postex_mtx[in_pnmtxidx]` and `nrm_mtx[in_pnmtxidx]` are emitted unconditionally, so neither array can ever be empty.
+    info.uniformSize += sizeof(Mat3x4<float>) * (layout.postexCount + layout.nrmCount);
+  }
+  if (config.fogType != GX_FOG_NONE) {
+    info.usesFog = true;
+    info.uniformSize += sizeof(Fog);
+  }
+  if (info.usedIndTexMtxs.any()) {
+    info.uniformSize += MaxIndTexMtxs * 2 * sizeof(Vec4<s32>);
+  }
+  info.uniformSize += info.sampledTexCoords.count() * sizeof(Vec4<float>);
+  info.uniformSize += info.sampledTextures.count() * sizeof(Vec4<float>);
+  info.uniformSize = gfx::align_uniform(info.uniformSize);
+  if (info.uniformSize > MaxUniformSize) {
+    Log.fatal("Uniform size exceeds maximum: {} > {}", info.uniformSize, MaxUniformSize);
+  }
+  return info;
+}
+
+static f32 tex_offset(GXTexOffset offs) noexcept {
+  switch (offs) {
+    DEFAULT_FATAL("invalid tex offset {}", underlying(offs));
+  case GX_TO_ZERO:
+    return 0.f;
+  case GX_TO_SIXTEENTH:
+    return 1.f / 16.f;
+  case GX_TO_EIGHTH:
+    return 1.f / 8.f;
+  case GX_TO_FOURTH:
+    return 1.f / 4.f;
+  case GX_TO_HALF:
+    return 1.f / 2.f;
+  case GX_TO_ONE:
+    return 1.f;
+  }
+}
+
+static u32 point_texcoord_mask() noexcept {
+  u32 mask = 0;
+  for (int i = 0; i < MaxTexCoord; ++i) {
+    if (g_gxState.texCoordScales[i].pointOffset) {
+      mask |= 1 << i;
+    }
+  }
+  return mask;
+}
+
+static u32 line_texcoord_mask() noexcept {
+  u32 mask = 0;
+  for (int i = 0; i < MaxTexCoord; ++i) {
+    if (g_gxState.texCoordScales[i].lineOffset) {
+      mask |= 1 << i;
+    }
+  }
+  return mask;
+}
+
+namespace {
+// Largest possible staged prefix: scalar head (80) + line/point block (16) + projection matrix + every matrix the uncompacted layout can hold.
+constexpr size_t kStagedUniformBytes =
+    96 + sizeof(Mat4x4<float>) + sizeof(Mat3x4<float>) * (MaxPostexMtx + MaxPnMtx);
+
+// The host viewport always receives the normalized GX depth window (render_pass_impl clamps to minDepth <= maxDepth).
+static Mat4x4<float> effective_projection() noexcept {
+  const auto& vp = g_gxState.renderViewport;
+  const bool flip = (vp.znear <= vp.zfar) == UseReversedZ;
+  Mat4x4<float> proj = g_gxState.proj;
+  if (flip) {
+    for (size_t i = 0; i < 4; ++i) {
+      proj.m2.m[i] = -(proj.m2.m[i] + proj.m3.m[i]);
+    }
+  }
+  return proj;
+}
+} // namespace
+
+UniformRanges build_uniform(const ShaderInfo& info, u32 vtxStart, const BindGroupRanges& ranges,
+                            const FrameInterpolationDrawIdentity& drawIdentity, bool perspective,
+                            uint16_t usedPnMtxMask) noexcept {
+  ZoneScoped;
+
+  auto [buf, range] = gfx::map_uniform(info.uniformSize);
+
+  const auto& layout = info.matrixLayout;
+  // `postex_mtx[current_pnmtx]` indexes raw matrix memory, so a current-matrix index of 10 or more selects a texture matrix; the normal array only covers the position rows and clamps.
+  const u32 currentPostexSlot = std::min<u32>(g_gxState.currentPnMtx, MaxPostexMtx - 1);
+  const u32 currentNrmSlot = std::min<u32>(g_gxState.currentPnMtx, MaxPnMtx - 1);
+
+  // The mapped uniform range lives in write-combine memory, which wants long sequential stores.
+  alignas(16) std::array<uint8_t, kStagedUniformBytes> staged;
+  size_t stagedSize = 0;
+  const auto stage = [&](const void* data, size_t size) noexcept {
+    std::memcpy(staged.data() + stagedSize, data, size);
+    stagedSize += size;
+  };
+  const auto stage_u32 = [&](u32 value) noexcept { stage(&value, sizeof(value)); };
+  const auto stage_f32 = [&](f32 value) noexcept { stage(&value, sizeof(value)); };
+
+  stage_u32(vtxStart);
+  // With a compacted position region the live matrix is uploaded to slot 0, so every `postex_mtx[in_pnmtxidx]` / `nrm_mtx[in_pnmtxidx]` read has to resolve to 0 as well.
+  stage_u32(layout.absolutePosRegion ? g_gxState.currentPnMtx : 0u);
+  stage_f32(g_gxState.renderViewport.width);
+  stage_f32(g_gxState.renderViewport.height);
+  stage_f32(g_gxState.logicalViewport.width);
+  stage_f32(g_gxState.logicalViewport.height);
+  std::memset(staged.data() + stagedSize, 0, 8); // pad
+  stagedSize += 8;
+  for (const auto& vaRange : ranges.vaRanges) {
+    stage_u32(vaRange.offset);
+  }
+  if (info.lineMode != 0) {
+    if (info.lineMode == 3) { // GX_POINTS
+      stage_f32(static_cast<f32>(g_gxState.pointSize) / 6.f);
+      stage_f32(1.0f);
+      stage_f32(tex_offset(g_gxState.pointTexOffset));
+      stage_u32(point_texcoord_mask());
+    } else { // GX_LINES / GX_LINESTRIP
+      stage_f32(static_cast<f32>(g_gxState.lineWidth) / 6.f);
+      stage_f32(g_gxState.lineHalfAspect ? 0.5f : 1.f);
+      stage_f32(tex_offset(g_gxState.lineTexOffset));
+      stage_u32(line_texcoord_mask());
+    }
+  }
+  const size_t projectionOffset = stagedSize;
+  const Mat4x4<float> effectiveProj = effective_projection();
+  stage(&effectiveProj, sizeof(effectiveProj));
+
+  const size_t positionOffset = stagedSize;
+  for (u32 i = 0; i < layout.postexCount; ++i) {
+    const u32 slot =
+        layout.postexSlots[i] == UniformMatrixLayout::kCurrentPnMtx ? currentPostexSlot
+                                                                    : layout.postexSlots[i];
+    stage(slot < MaxPnMtx ? &g_gxState.pnMtx[slot].pos : &g_gxState.texMtxs[slot - MaxPnMtx],
+          sizeof(Mat3x4<float>));
+  }
+
+  const size_t normalOffset = stagedSize;
+  for (u32 i = 0; i < layout.nrmCount; ++i) {
+    const u32 slot = layout.nrmSlots[i] == UniformMatrixLayout::kCurrentPnMtx ? currentNrmSlot
+                                                                             : layout.nrmSlots[i];
+    stage(&g_gxState.pnMtx[slot].nrm, sizeof(Mat3x4<float>));
+  }
+  buf.append(staged.data(), stagedSize);
+
+  const auto loadsTevRegs = info.loadsTevRegRgb | info.loadsTevRegAlpha;
+  for (int i = 0; i < loadsTevRegs.size(); ++i) {
+    if (loadsTevRegs.test(i)) {
+      buf.append(g_gxState.colorRegs[i]);
+    }
+  }
+  if (info.lightingEnabled) {
+    // Sanitizing and normalizing light directions is substantially more expensive than copying the uniform data, while lights normally remain unchanged across many draws.
+    static_assert(sizeof(g_gxState.lights) == 80 * GX::MaxLights);
+    if (g_gxState.preparedLightsDirty) {
+      for (size_t i = 0; i < g_gxState.preparedLights.size(); ++i) {
+        g_gxState.preparedLights[i] = prepare_shader_light(g_gxState.lights[i]);
+      }
+      g_gxState.preparedLightsDirty = false;
+    }
+    buf.append(g_gxState.preparedLights);
+    // Light state for all channels
+    for (int i = 0; i < 4; ++i) {
+      buf.append<u32>(g_gxState.colorChannelState[i].lightMask.to_ulong());
+    }
+  }
+  for (int i = 0; i < info.sampledColorChannels.size(); ++i) {
+    if (!info.sampledColorChannels.test(i)) {
+      continue;
+    }
+    const auto& ccc = g_gxState.colorChannelConfig[i];
+    const auto& ccs = g_gxState.colorChannelState[i];
+    if (ccc.lightingEnabled && ccc.ambSrc == GX_SRC_REG) {
+      buf.append(ccs.ambColor);
+    }
+    if (ccc.matSrc == GX_SRC_REG) {
+      buf.append(ccs.matColor);
+    }
+    const auto& ccca = g_gxState.colorChannelConfig[i + GX_ALPHA0];
+    const auto& ccsa = g_gxState.colorChannelState[i + GX_ALPHA0];
+    if (ccca.lightingEnabled && ccca.ambSrc == GX_SRC_REG) {
+      buf.append(ccsa.ambColor);
+    }
+    if (ccca.matSrc == GX_SRC_REG) {
+      buf.append(ccsa.matColor);
+    }
+  }
+  for (int i = 0; i < info.sampledKColors.size(); ++i) {
+    if (info.sampledKColors.test(i)) {
+      buf.append(g_gxState.kcolors[i]);
+    }
+  }
+  if (info.usesPTTexMtx.any()) {
+    for (int i = 0; i < info.usesPTTexMtx.size(); ++i) {
+      buf.append(g_gxState.ptTexMtxs[i]);
+    }
+  }
+  if (info.usesFog) {
+    buf.append(fog_uniform());
+  }
+  if (info.usedIndTexMtxs.any()) {
+    for (int i = 0; i < MaxIndTexMtxs; ++i) {
+      const auto& mtx = g_gxState.indTexMtxs[i];
+      buf.append(Vec4<s32>{indirect_matrix_mantissa(mtx.mtx.m0.x), indirect_matrix_mantissa(mtx.mtx.m0.y),
+                           indirect_matrix_mantissa(mtx.mtx.m1.x), indirect_matrix_mantissa(mtx.mtx.m1.y)});
+      buf.append(Vec4<s32>{indirect_matrix_mantissa(mtx.mtx.m2.x), indirect_matrix_mantissa(mtx.mtx.m2.y),
+                           indirect_matrix_shift(mtx.scaleExp), 0});
+    }
+  }
+  for (int i = 0; i < info.sampledTexCoords.size(); ++i) {
+    if (info.sampledTexCoords.test(i)) {
+      buf.append(texcoord_scale(g_gxState.texCoordScales[i]));
+    }
+  }
+  for (int i = 0; i < info.sampledTextures.size(); ++i) {
+    if (!info.sampledTextures.test(i)) {
+      continue;
+    }
+    const auto& tex = get_texture(static_cast<GXTexMapID>(i));
+    // CHECK(tex, "unbound texture {}", i);
+    buf.append(texture_size_bias(tex));
+  }
+
+  if (!perspective || frame_interpolation_fps() == 0) {
+    g_gxState.stateDirty = false;
+    return {
+        .current = range,
+        .interpolated = {},
+    };
+  }
+
+  const auto interpolatedRanges = record_interpolation_draw(
+      drawIdentity, effectiveProj, usedPnMtxMask,
+      InterpolatedUniformLayout{
+          .sourceUniformData = buf.data(),
+          .uniformSize = range.size,
+          .projectionOffset = projectionOffset,
+          .positionOffset = positionOffset,
+          .normalOffset = normalOffset,
+          // A compacted position region holds the current matrix at slot 0.
+          .currentMatrix = layout.absolutePosRegion
+                               ? std::min<size_t>(g_gxState.currentPnMtx, MaxPnMtx - 1)
+                               : 0,
+          .indexedMatrices = info.indexAttr.test(GX_VA_PNMTXIDX),
+      });
+  g_gxState.stateDirty = false;
+  return {
+      .current = range,
+      .interpolated = interpolatedRanges,
+  };
+}
+} // namespace aurora::gx
diff --git a/aurora-main/lib/gx/shader_info.hpp b/aurora-main/lib/gx/shader_info.hpp
new file mode 100644
index 0000000..6b8e329
--- /dev/null
+++ b/aurora-main/lib/gx/shader_info.hpp
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "gx.hpp"
+// MaxInterpolatedFrames / FrameInterpolationDrawIdentity, and the interpolation API that build_uniform feeds.
+#include "frame_interpolation.hpp"
+
+namespace aurora::gx {
+struct UniformRanges {
+  gfx::Range current;
+  std::array<gfx::Range, MaxInterpolatedFrames> interpolated;
+};
+
+ShaderInfo build_shader_info(const ShaderConfig& config) noexcept;
+Light prepare_shader_light(Light light) noexcept;
+UniformRanges build_uniform(const ShaderInfo& info, uint32_t vtxStart, const BindGroupRanges& ranges,
+                            const FrameInterpolationDrawIdentity& drawIdentity, bool perspective,
+                            uint16_t usedPnMtxMask = 1) noexcept;
+u8 color_channel(GXChannelID id) noexcept;
+}; // namespace aurora::gx
diff --git a/aurora-main/lib/gx/texture_bind_group_cache_key.hpp b/aurora-main/lib/gx/texture_bind_group_cache_key.hpp
new file mode 100644
index 0000000..5cb78a0
--- /dev/null
+++ b/aurora-main/lib/gx/texture_bind_group_cache_key.hpp
@@ -0,0 +1,31 @@
+#pragma once
+
+#include <dolphin/gx.h>
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+
+namespace aurora::gx {
+
+struct TextureBindGroupCacheKey {
+  std::uint64_t sampledTextures = 0;
+  std::uint64_t sampledIndTextures = 0;
+  std::array<const void*, GX_MAX_TEXMAP> textureViews{};
+  std::array<std::uint32_t, GX_MAX_TEXMAP> mode0{};
+  std::array<std::uint32_t, GX_MAX_TEXMAP> mode1{};
+  std::array<std::uint32_t, GX_MAX_TEXMAP> refState{};
+
+  bool operator==(const TextureBindGroupCacheKey&) const = default;
+};
+
+inline void set_texture_bind_group_cache_slot(TextureBindGroupCacheKey& key, std::size_t slot,
+                                              const void* textureView, std::uint32_t mode0,
+                                              std::uint32_t mode1, std::uint32_t refState) noexcept {
+  key.textureViews[slot] = textureView;
+  key.mode0[slot] = mode0;
+  key.mode1[slot] = mode1;
+  key.refState[slot] = refState;
+}
+
+} // namespace aurora::gx
diff --git a/aurora-main/lib/imgui.cpp b/aurora-main/lib/imgui.cpp
new file mode 100644
index 0000000..6129e37
--- /dev/null
+++ b/aurora-main/lib/imgui.cpp
@@ -0,0 +1,253 @@
+#include "imgui.hpp"
+
+#include <cstddef>
+#include <cmath>
+#include <filesystem>
+#include <string>
+#include <vector>
+
+#include <webgpu/webgpu_cpp.h>
+#include <SDL3/SDL_events.h>
+#include <SDL3/SDL_render.h>
+
+#include "internal.hpp"
+#include "webgpu/gpu.hpp"
+#include "window.hpp"
+
+#define IMGUI_IMPL_WEBGPU_BACKEND_DAWN
+#include "backends/imgui_impl_sdl3.h"
+#include "backends/imgui_impl_sdlrenderer3.h"
+#include "backends/imgui_impl_wgpu.h"
+#include "tracy/Tracy.hpp"
+
+namespace aurora::imgui {
+static float g_scale;
+static std::string g_imguiLog{};
+static bool g_useSdlRenderer = false;
+// Set once ImGui::Render() has produced this frame's draw data. Interpolation encodes up to four
+// ImGui passes per frame, and every one of them used to rebuild the draw lists from scratch.
+static bool g_frameDataBuilt = false;
+
+static std::vector<SDL_Texture*> g_sdlTextures;
+static std::vector<wgpu::Texture> g_wgpuTextures;
+
+void remove_legacy_ini_file(const char* basePath) noexcept {
+  if (basePath == nullptr || *basePath == '\0') {
+    return;
+  }
+
+  std::error_code ec;
+  std::filesystem::remove(std::filesystem::path{basePath} / "imgui.ini", ec);
+}
+
+void create_context() noexcept {
+  IMGUI_CHECKVERSION();
+  ImGui::CreateContext();
+  ImGuiIO& io = ImGui::GetIO();
+  io.ConfigFlags |= ImGuiConfigFlags_NavEnableGamepad;
+  remove_legacy_ini_file(g_config.userPath);
+  remove_legacy_ini_file(g_config.cachePath);
+  g_imguiLog = std::string{g_config.cachePath} + "/imgui.log";
+  io.IniFilename = nullptr;
+  io.LogFilename = g_imguiLog.c_str();
+  ImGui::LoadIniSettingsFromMemory("", 0);
+  io.WantSaveIniSettings = false;
+}
+
+void initialize() noexcept {
+  ZoneScoped;
+  SDL_Renderer* renderer = window::get_sdl_renderer();
+  ImGui_ImplSDL3_InitForSDLRenderer(window::get_sdl_window(), renderer);
+  g_useSdlRenderer = renderer != nullptr;
+  if (g_useSdlRenderer) {
+    ImGui_ImplSDLRenderer3_Init(renderer);
+  } else {
+    ImGui_ImplWGPU_InitInfo info;
+    info.Device = webgpu::g_device.Get();
+    info.RenderTargetFormat = static_cast<WGPUTextureFormat>(webgpu::g_graphicsConfig.surfaceConfiguration.format);
+    // Interpolation records up to four ImGui passes in one command buffer, so keep three logical
+    // frames of renderer resources to stop them overwriting each other's vertex/index buffers.
+    info.NumFramesInFlight = 12;
+    ImGui_ImplWGPU_Init(&info);
+  }
+}
+
+void shutdown() noexcept {
+  ZoneScoped;
+  if (g_useSdlRenderer) {
+    ImGui_ImplSDLRenderer3_Shutdown();
+  } else {
+    ImGui_ImplWGPU_Shutdown();
+  }
+  ImGui_ImplSDL3_Shutdown();
+  ImGui::DestroyContext();
+  for (const auto& texture : g_sdlTextures) {
+    SDL_DestroyTexture(texture);
+  }
+  g_sdlTextures.clear();
+  g_wgpuTextures.clear();
+}
+
+void process_event(const SDL_Event& event) noexcept {
+  auto renderEvent = event;
+  if (g_useSdlRenderer) {
+    if (SDL_Renderer* renderer = window::get_sdl_renderer()) {
+      SDL_ConvertEventToRenderCoordinates(renderer, &renderEvent);
+    }
+  }
+  ImGui_ImplSDL3_ProcessEvent(&renderEvent);
+}
+
+bool wants_capture_event(const SDL_Event& event) noexcept {
+  if (ImGui::GetCurrentContext() == nullptr) {
+    return false;
+  }
+
+  const ImGuiIO& io = ImGui::GetIO();
+  switch (event.type) {
+  case SDL_EVENT_MOUSE_MOTION:
+  case SDL_EVENT_MOUSE_BUTTON_DOWN:
+  case SDL_EVENT_MOUSE_BUTTON_UP:
+  case SDL_EVENT_MOUSE_WHEEL:
+  case SDL_EVENT_FINGER_DOWN:
+  case SDL_EVENT_FINGER_MOTION:
+  case SDL_EVENT_FINGER_UP:
+  case SDL_EVENT_FINGER_CANCELED:
+    return io.WantCaptureMouse;
+  case SDL_EVENT_KEY_DOWN:
+  case SDL_EVENT_KEY_UP:
+  case SDL_EVENT_TEXT_INPUT:
+    return io.WantCaptureKeyboard || io.WantTextInput;
+  default:
+    return false;
+  }
+}
+
+void new_frame(const AuroraWindowSize& size) noexcept {
+  ZoneScoped;
+  ImVec2 framebufferScale{
+      size.width > 0 ? static_cast<float>(size.native_fb_width) / static_cast<float>(size.width) : 1.0f,
+      size.height > 0 ? static_cast<float>(size.native_fb_height) / static_cast<float>(size.height) : 1.0f,
+  };
+  ImVec2 displaySize{static_cast<float>(size.width), static_cast<float>(size.height)};
+
+  if (g_useSdlRenderer) {
+    if (SDL_Renderer* renderer = window::get_sdl_renderer()) {
+      float renderScaleX = 1.0f;
+      float renderScaleY = 1.0f;
+      SDL_GetRenderScale(renderer, &renderScaleX, &renderScaleY);
+      if (renderScaleX > 0.0f && renderScaleY > 0.0f &&
+          (std::fabs(renderScaleX - 1.0f) > 0.0001f || std::fabs(renderScaleY - 1.0f) > 0.0001f)) {
+        int outputWidth = static_cast<int>(size.native_fb_width);
+        int outputHeight = static_cast<int>(size.native_fb_height);
+        SDL_GetRenderOutputSize(renderer, &outputWidth, &outputHeight);
+        displaySize = {
+            static_cast<float>(outputWidth) / renderScaleX,
+            static_cast<float>(outputHeight) / renderScaleY,
+        };
+        framebufferScale = {renderScaleX, renderScaleY};
+      }
+    }
+    ImGui_ImplSDLRenderer3_NewFrame();
+    g_scale = size.scale;
+  } else {
+    if (g_scale != size.scale) {
+      if (g_scale > 0.f) {
+        ImGui_ImplWGPU_CreateDeviceObjects();
+      }
+      g_scale = size.scale;
+    }
+    if (!ImGui::GetIO().Fonts->IsBuilt()) {
+      ImGui_ImplWGPU_CreateDeviceObjects();
+    }
+    ImGui_ImplWGPU_NewFrame();
+  }
+  ImGui_ImplSDL3_NewFrame();
+
+  ImGuiIO& io = ImGui::GetIO();
+  io.DisplayFramebufferScale = framebufferScale;
+  ImGui::GetIO().DisplaySize = displaySize;
+  ImGui::NewFrame();
+  g_frameDataBuilt = false;
+}
+
+void render_frame_data() noexcept {
+  ZoneScoped;
+  if (g_frameDataBuilt) {
+    return;
+  }
+  ImGui::Render();
+  auto* data = ImGui::GetDrawData();
+  data->FramebufferScale = ImGui::GetIO().DisplayFramebufferScale;
+  g_frameDataBuilt = true;
+}
+
+void render(const wgpu::RenderPassEncoder& pass) noexcept {
+  ZoneScoped;
+  render_frame_data();
+
+  auto* data = ImGui::GetDrawData();
+  if (g_useSdlRenderer) {
+    SDL_Renderer* renderer = window::get_sdl_renderer();
+    SDL_RenderClear(renderer);
+    ImGui_ImplSDLRenderer3_RenderDrawData(data, renderer);
+    SDL_RenderPresent(renderer);
+  } else {
+    pass.PushDebugGroup("Aurora: Dear Imgui");
+    ImGui_ImplWGPU_RenderDrawData(data, pass.Get());
+    pass.PopDebugGroup();
+  }
+}
+
+ImTextureID add_texture(uint32_t width, uint32_t height, const uint8_t* data) noexcept {
+  if (SDL_Renderer* renderer = window::get_sdl_renderer()) {
+    SDL_Texture* texture = SDL_CreateTexture(renderer, SDL_PIXELFORMAT_RGBA32, SDL_TEXTUREACCESS_STATIC, width, height);
+    SDL_UpdateTexture(texture, nullptr, data, width * 4);
+    SDL_SetTextureScaleMode(texture, SDL_SCALEMODE_LINEAR);
+    g_sdlTextures.push_back(texture);
+    return reinterpret_cast<ImTextureID>(texture);
+  }
+  const wgpu::Extent3D size{
+      .width = width,
+      .height = height,
+      .depthOrArrayLayers = 1,
+  };
+  const wgpu::TextureDescriptor textureDescriptor{
+      .label = "imgui texture",
+      .usage = wgpu::TextureUsage::TextureBinding | wgpu::TextureUsage::CopyDst,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = wgpu::TextureFormat::RGBA8Unorm,
+      .mipLevelCount = 1,
+      .sampleCount = 1,
+  };
+  const wgpu::TextureViewDescriptor textureViewDescriptor{
+      .label = "imgui texture view",
+      .format = wgpu::TextureFormat::RGBA8Unorm,
+      .dimension = wgpu::TextureViewDimension::e2D,
+      .mipLevelCount = WGPU_MIP_LEVEL_COUNT_UNDEFINED,
+      .arrayLayerCount = WGPU_ARRAY_LAYER_COUNT_UNDEFINED,
+  };
+  auto texture = webgpu::g_device.CreateTexture(&textureDescriptor);
+  auto textureView = texture.CreateView(&textureViewDescriptor);
+  {
+    const wgpu::TexelCopyTextureInfo dstView{
+        .texture = texture,
+    };
+    const wgpu::TexelCopyBufferLayout dataLayout{
+        .bytesPerRow = 4 * width,
+        .rowsPerImage = height,
+    };
+    webgpu::g_queue.WriteTexture(&dstView, data, width * height * 4, &dataLayout, &size);
+  }
+  g_wgpuTextures.push_back(texture);
+  return reinterpret_cast<ImTextureID>(textureView.MoveToCHandle());
+}
+} // namespace aurora::imgui
+
+// C bindings
+extern "C" {
+ImTextureID aurora_imgui_add_texture(uint32_t width, uint32_t height, const void* rgba8) {
+  return aurora::imgui::add_texture(width, height, static_cast<const uint8_t*>(rgba8));
+}
+}
diff --git a/aurora-main/lib/imgui.hpp b/aurora-main/lib/imgui.hpp
new file mode 100644
index 0000000..908a122
--- /dev/null
+++ b/aurora-main/lib/imgui.hpp
@@ -0,0 +1,23 @@
+#pragma once
+
+#include <aurora/event.h>
+
+union SDL_Event;
+
+namespace wgpu {
+class RenderPassEncoder;
+} // namespace wgpu
+
+namespace aurora::imgui {
+void create_context() noexcept;
+void initialize() noexcept;
+void shutdown() noexcept;
+
+void process_event(const SDL_Event& event) noexcept;
+bool wants_capture_event(const SDL_Event& event) noexcept;
+void new_frame(const AuroraWindowSize& size) noexcept;
+// Build this frame's ImGui draw data. Idempotent for the rest of the frame: the lists are built
+// once and every presentation slot replays them. Reset by new_frame.
+void render_frame_data() noexcept;
+void render(const wgpu::RenderPassEncoder& pass) noexcept;
+} // namespace aurora::imgui
diff --git a/aurora-main/lib/imgui_config.cpp b/aurora-main/lib/imgui_config.cpp
new file mode 100644
index 0000000..e06eecb
--- /dev/null
+++ b/aurora-main/lib/imgui_config.cpp
@@ -0,0 +1,61 @@
+#include <aurora/imgui_config.h>
+
+#include <SDL3/SDL_iostream.h>
+
+#include <cstdint>
+
+ImFileHandle ImFileOpen(const char* filename, const char* mode) {
+  if (filename == nullptr || mode == nullptr) {
+    return nullptr;
+  }
+  return SDL_IOFromFile(filename, mode);
+}
+
+bool ImFileClose(ImFileHandle file) { return file == nullptr || SDL_CloseIO(file); }
+
+ImU64 ImFileGetSize(ImFileHandle file) {
+  if (file == nullptr) {
+    return static_cast<ImU64>(-1);
+  }
+  const Sint64 size = SDL_GetIOSize(file);
+  if (size < 0) {
+    return static_cast<ImU64>(-1);
+  }
+  return static_cast<ImU64>(size);
+}
+
+ImU64 ImFileRead(void* data, ImU64 size, ImU64 count, ImFileHandle file) {
+  ImU64 byteCount = size * count;
+  if (file == nullptr || data == nullptr || byteCount == 0) {
+    return 0;
+  }
+
+  ImU64 totalRead = 0;
+  auto* dst = static_cast<uint8_t*>(data);
+  while (totalRead < byteCount) {
+    const size_t read = SDL_ReadIO(file, dst + totalRead, byteCount - totalRead);
+    if (read == 0) {
+      return totalRead / size;
+    }
+    totalRead += read;
+  }
+  return count;
+}
+
+ImU64 ImFileWrite(const void* data, ImU64 size, ImU64 count, ImFileHandle file) {
+  ImU64 byteCount = size * count;
+  if (file == nullptr || data == nullptr || byteCount == 0) {
+    return 0;
+  }
+
+  ImU64 totalWritten = 0;
+  auto* src = static_cast<const std::uint8_t*>(data);
+  while (totalWritten < byteCount) {
+    const size_t written = SDL_WriteIO(file, src + totalWritten, byteCount - totalWritten);
+    if (written == 0) {
+      return totalWritten / size;
+    }
+    totalWritten += written;
+  }
+  return count;
+}
diff --git a/aurora-main/lib/input.cpp b/aurora-main/lib/input.cpp
new file mode 100644
index 0000000..e5a2f56
--- /dev/null
+++ b/aurora-main/lib/input.cpp
@@ -0,0 +1,480 @@
+#include "input.hpp"
+#include "internal.hpp"
+
+#include "magic_enum.hpp"
+
+#include <SDL3/SDL_haptic.h>
+#include <SDL3/SDL_properties.h>
+#include <SDL3/SDL.h>
+#include <SDL3/SDL_filesystem.h>
+#include <SDL3/SDL_iostream.h>
+
+#include <absl/container/flat_hash_map.h>
+#include <algorithm>
+#include <array>
+#include <string>
+#include <utility>
+
+using namespace std::string_view_literals;
+
+namespace aurora::input {
+Module Log("aurora::input");
+absl::flat_hash_map<Uint32, GameController> g_GameControllers;
+
+namespace {
+constexpr uint32_t kPortPreferencesMagic = SBIG('CPRT');
+constexpr uint32_t kPortPreferencesVersion = 2;
+constexpr uint32_t kMaxPersistedStringLength = 256;
+
+enum class PortPreferenceState : uint8_t {
+  Unset = 0,
+  None = 1,
+  Controller = 2,
+};
+
+struct ControllerIdentity {
+  std::string guid;
+  std::string serial;
+};
+
+struct PortPreference {
+  PortPreferenceState state = PortPreferenceState::Unset;
+  ControllerIdentity identity;
+};
+
+std::array<PortPreference, PAD_MAX_CONTROLLERS> g_portPreferences;
+bool g_portPreferencesLoaded = false;
+
+std::string port_preferences_path() {
+  if (g_config.userPath == nullptr) {
+    return {};
+  }
+
+  std::string path{g_config.userPath};
+  if (!path.empty() && path.back() != '/' && path.back() != '\\') {
+    path += '/';
+  }
+  path += "controller_ports.dat";
+  return path;
+}
+
+std::string normalize_serial(const char* serial) {
+  std::string normalized;
+  if (serial == nullptr) {
+    return normalized;
+  }
+
+  for (const char* c = serial; *c != '\0'; ++c) {
+    if (*c == ':' || *c == '-') {
+      continue;
+    }
+    normalized += *c >= 'A' && *c <= 'Z' ? static_cast<char>(*c - 'A' + 'a') : *c;
+  }
+  return normalized;
+}
+
+bool serial_matches(const std::string& saved, const std::string& current) {
+  return !saved.empty() && !current.empty() && normalize_serial(saved.c_str()) == normalize_serial(current.c_str());
+}
+
+ControllerIdentity controller_identity(const GameController& controller) {
+  ControllerIdentity identity;
+  char guid[33] = {};
+  SDL_GUIDToString(SDL_GetGamepadGUIDForID(SDL_GetGamepadID(controller.m_controller)), guid, sizeof(guid));
+  identity.guid = guid;
+  identity.serial = normalize_serial(SDL_GetGamepadSerial(controller.m_controller));
+  return identity;
+}
+
+bool read_exact(SDL_IOStream* file, void* dst, size_t size) {
+  auto* bytes = static_cast<uint8_t*>(dst);
+  size_t total = 0;
+  while (total < size) {
+    const size_t read = SDL_ReadIO(file, bytes + total, size - total);
+    if (read == 0) {
+      return false;
+    }
+    total += read;
+  }
+  return true;
+}
+
+bool write_exact(SDL_IOStream* file, const void* src, size_t size) {
+  auto* bytes = static_cast<const uint8_t*>(src);
+  size_t total = 0;
+  while (total < size) {
+    const size_t written = SDL_WriteIO(file, bytes + total, size - total);
+    if (written == 0) {
+      return false;
+    }
+    total += written;
+  }
+  return true;
+}
+
+template <typename T>
+bool read_value(SDL_IOStream* file, T& value) {
+  return read_exact(file, &value, sizeof(value));
+}
+
+template <typename T>
+bool write_value(SDL_IOStream* file, const T& value) {
+  return write_exact(file, &value, sizeof(value));
+}
+
+bool read_string(SDL_IOStream* file, std::string& value) {
+  uint32_t size = 0;
+  if (!read_value(file, size) || size > kMaxPersistedStringLength) {
+    return false;
+  }
+
+  value.resize(size);
+  return size == 0 || read_exact(file, value.data(), size);
+}
+
+bool write_string(SDL_IOStream* file, const std::string& value) {
+  const uint32_t size = static_cast<uint32_t>(std::min<size_t>(value.size(), kMaxPersistedStringLength));
+  return write_value(file, size) && (size == 0 || write_exact(file, value.data(), size));
+}
+
+bool read_identity(SDL_IOStream* file, ControllerIdentity& identity) {
+  return read_string(file, identity.guid) && read_string(file, identity.serial);
+}
+
+bool write_identity(SDL_IOStream* file, const ControllerIdentity& identity) {
+  return write_string(file, identity.guid) && write_string(file, identity.serial);
+}
+
+bool read_port_preferences_file(std::array<PortPreference, PAD_MAX_CONTROLLERS>& preferences) {
+  const auto path = port_preferences_path();
+  if (path.empty()) {
+    return true;
+  }
+
+  SDL_IOStream* file = SDL_IOFromFile(path.c_str(), "rb");
+  if (file == nullptr) {
+    return true;
+  }
+
+  uint32_t magic = 0;
+  uint32_t version = 0;
+  bool ok = read_value(file, magic) && read_value(file, version) && magic == kPortPreferencesMagic &&
+            version == kPortPreferencesVersion;
+
+  for (auto& preference : preferences) {
+    uint8_t state = 0;
+    ControllerIdentity identity;
+    ok = ok && read_value(file, state) && state <= static_cast<uint8_t>(PortPreferenceState::Controller) &&
+         read_identity(file, identity);
+    if (ok) {
+      preference.state = static_cast<PortPreferenceState>(state);
+      preference.identity = std::move(identity);
+    }
+  }
+
+  SDL_CloseIO(file);
+  if (!ok) {
+    Log.warn("Ignoring invalid controller port preference file '{}'", path);
+  }
+  return ok;
+}
+
+void ensure_port_preferences_loaded() {
+  if (g_portPreferencesLoaded) {
+    return;
+  }
+
+  std::array<PortPreference, PAD_MAX_CONTROLLERS> preferences;
+  if (read_port_preferences_file(preferences)) {
+    g_portPreferences = std::move(preferences);
+  }
+  g_portPreferencesLoaded = true;
+}
+
+void save_port_preferences() {
+  const auto path = port_preferences_path();
+  if (path.empty()) {
+    return;
+  }
+
+  if (!SDL_CreateDirectory(g_config.userPath)) {
+    Log.warn("Failed to create controller port preference directory '{}': {}", g_config.userPath, SDL_GetError());
+    return;
+  }
+
+  SDL_IOStream* file = SDL_IOFromFile(path.c_str(), "wb");
+  if (file == nullptr) {
+    Log.warn("Failed to open controller port preference file '{}': {}", path, SDL_GetError());
+    return;
+  }
+
+  bool ok = write_value(file, kPortPreferencesMagic) && write_value(file, kPortPreferencesVersion);
+  for (const auto& preference : g_portPreferences) {
+    const auto state = static_cast<uint8_t>(preference.state);
+    ok = ok && write_value(file, state) && write_identity(file, preference.identity);
+  }
+
+  if (!SDL_FlushIO(file)) {
+    ok = false;
+  }
+  if (!SDL_CloseIO(file)) {
+    ok = false;
+  }
+  if (!ok) {
+    Log.warn("Failed to write controller port preference file '{}': {}", path, SDL_GetError());
+  }
+}
+
+enum class IdentityMatch {
+  None,
+  Fallback,
+  Exact,
+};
+
+IdentityMatch identity_match(const ControllerIdentity& saved, const ControllerIdentity& current) {
+  if (saved.guid.empty()) {
+    return IdentityMatch::None;
+  }
+  if (saved.guid == current.guid) {
+    return saved.serial.empty() || serial_matches(saved.serial, current.serial) ? IdentityMatch::Exact
+                                                                                : IdentityMatch::None;
+  }
+  if (!serial_matches(saved.serial, current.serial)) {
+    return IdentityMatch::None;
+  }
+
+  // Attempt to match against VID/PID as a fallback if the GUID changes
+  uint16_t savedVendor = 0;
+  uint16_t savedProduct = 0;
+  uint16_t currentVendor = 0;
+  uint16_t currentProduct = 0;
+  SDL_GetJoystickGUIDInfo(SDL_StringToGUID(saved.guid.c_str()), &savedVendor, &savedProduct, nullptr, nullptr);
+  SDL_GetJoystickGUIDInfo(SDL_StringToGUID(current.guid.c_str()), &currentVendor, &currentProduct, nullptr, nullptr);
+  return savedVendor != 0 && savedVendor == currentVendor && savedProduct != 0 && savedProduct == currentProduct
+             ? IdentityMatch::Fallback
+             : IdentityMatch::None;
+}
+
+bool is_instance_claimed(const std::array<Uint32, PAD_MAX_CONTROLLERS>& claimedControllers, size_t claimedCount,
+                         Uint32 instance) {
+  return std::find(claimedControllers.begin(), claimedControllers.begin() + claimedCount, instance) !=
+         claimedControllers.begin() + claimedCount;
+}
+
+void apply_port_preferences() noexcept {
+  ensure_port_preferences_loaded();
+  if (!std::any_of(g_portPreferences.begin(), g_portPreferences.end(),
+                   [](const auto& preference) { return preference.state != PortPreferenceState::Unset; })) {
+    return;
+  }
+
+  for (auto& [instance, controller] : g_GameControllers) {
+    const int32_t player = SDL_GetGamepadPlayerIndex(controller.m_controller);
+    if (player >= 0 && player < PAD_MAX_CONTROLLERS && g_portPreferences[player].state != PortPreferenceState::Unset) {
+      // Keep SDL's default player assignment from taking explicitly configured ports
+      SDL_SetGamepadPlayerIndex(controller.m_controller, -1);
+    }
+  }
+
+  std::array<Uint32, PAD_MAX_CONTROLLERS> claimedControllers{};
+  size_t claimedCount = 0;
+  for (uint32_t port = 0; port < g_portPreferences.size(); ++port) {
+    const auto& preference = g_portPreferences[port];
+    if (preference.state != PortPreferenceState::Controller) {
+      continue;
+    }
+
+    Uint32 fallbackInstance = 0;
+    GameController* fallbackController = nullptr;
+    for (auto& [instance, controller] : g_GameControllers) {
+      if (is_instance_claimed(claimedControllers, claimedCount, instance)) {
+        continue;
+      }
+
+      switch (identity_match(preference.identity, controller_identity(controller))) {
+      case IdentityMatch::Exact:
+        SDL_SetGamepadPlayerIndex(controller.m_controller, static_cast<int32_t>(port));
+        claimedControllers[claimedCount++] = instance;
+        fallbackController = nullptr;
+        break;
+      case IdentityMatch::Fallback:
+        // Prefer any later exact match before claiming a fallback candidate
+        if (fallbackController == nullptr) {
+          fallbackInstance = instance;
+          fallbackController = &controller;
+        }
+        continue;
+      case IdentityMatch::None:
+        continue;
+      }
+      break;
+    }
+
+    if (fallbackController != nullptr) {
+      SDL_SetGamepadPlayerIndex(fallbackController->m_controller, static_cast<int32_t>(port));
+      claimedControllers[claimedCount++] = fallbackInstance;
+    }
+  }
+}
+} // namespace
+
+GameController* get_controller_for_player(uint32_t player) noexcept {
+  for (auto& [which, controller] : g_GameControllers) {
+    if (player_index(which) == player) {
+      return &controller;
+    }
+  }
+
+  return nullptr;
+}
+
+Sint32 get_instance_for_player(uint32_t player) noexcept {
+  for (const auto& [which, controller] : g_GameControllers) {
+    if (player_index(which) == player) {
+      return which;
+    }
+  }
+
+  return {};
+}
+
+SDL_JoystickID add_controller(SDL_JoystickID which) noexcept {
+  if (g_GameControllers.contains(which)) {
+    return which;
+  }
+  auto* ctrl = SDL_OpenGamepad(which);
+  if (ctrl != nullptr) {
+    GameController controller;
+    controller.m_controller = ctrl;
+    controller.m_index = which;
+    controller.m_vid = SDL_GetGamepadVendor(ctrl);
+    controller.m_pid = SDL_GetGamepadProduct(ctrl);
+    if (controller.m_vid == 0x05ac /* USB_VENDOR_APPLE */ && controller.m_pid == 3) {
+      // Ignore Apple TV remote
+      SDL_CloseGamepad(ctrl);
+      return -1;
+    }
+    controller.m_isGameCube = controller.m_vid == 0x057E && controller.m_pid == 0x0337;
+    if (controller.m_isGameCube ||
+        (SDL_GetGamepadType(ctrl) == SDL_GAMEPAD_TYPE_NINTENDO_SWITCH_PRO && controller.m_pid == 0x2073)) {
+      controller.m_deadZones.emulateTriggers = false;
+    }
+    const auto props = SDL_GetGamepadProperties(ctrl);
+    controller.m_hasRumble = SDL_GetBooleanProperty(props, SDL_PROP_GAMEPAD_CAP_RUMBLE_BOOLEAN, true);
+    controller.m_hasRgbLed = SDL_GetBooleanProperty(props, SDL_PROP_GAMEPAD_CAP_RGB_LED_BOOLEAN, false);
+    SDL_JoystickID instance = SDL_GetJoystickID(SDL_GetGamepadJoystick(ctrl));
+    g_GameControllers[instance] = controller;
+    apply_port_preferences();
+    return instance;
+  }
+
+  return -1;
+}
+
+void remove_controller(Uint32 instance) noexcept {
+  if (auto it = g_GameControllers.find(instance); it != g_GameControllers.end()) {
+    SDL_CloseGamepad(it->second.m_controller);
+    g_GameControllers.erase(it);
+    apply_port_preferences();
+  }
+}
+
+bool is_gamecube(Uint32 instance) noexcept {
+  if (auto it = g_GameControllers.find(instance); it != g_GameControllers.end()) {
+    return it->second.m_isGameCube;
+  }
+  return false;
+}
+
+int32_t player_index(Uint32 instance) noexcept {
+  if (auto it = g_GameControllers.find(instance); it != g_GameControllers.end()) {
+    const int player = SDL_GetGamepadPlayerIndex(it->second.m_controller);
+    return player >= 0 ? player : it->second.m_playerIndex;
+  }
+  return -1;
+}
+
+void set_player_index(Uint32 instance, Sint32 index) noexcept {
+  if (auto it = g_GameControllers.find(instance); it != g_GameControllers.end()) {
+    SDL_SetGamepadPlayerIndex(it->second.m_controller, index);
+    it->second.m_playerIndex = index;
+  }
+}
+
+std::string controller_name(Uint32 instance) noexcept {
+  if (auto it = g_GameControllers.find(instance); it != g_GameControllers.end()) {
+    const auto* name = SDL_GetGamepadName(it->second.m_controller);
+    if (name != nullptr) {
+      return {name};
+    }
+  }
+  return {};
+}
+
+bool controller_has_rumble(Uint32 instance) noexcept {
+  if (auto it = g_GameControllers.find(instance); it != g_GameControllers.end()) {
+    return it->second.m_hasRumble;
+  }
+  return false;
+}
+
+void controller_rumble(uint32_t instance, uint16_t low_freq_intensity, uint16_t high_freq_intensity,
+                       uint16_t duration_ms) noexcept {
+  if (auto it = g_GameControllers.find(instance); it != g_GameControllers.end()) {
+    SDL_RumbleGamepad(it->second.m_controller, low_freq_intensity, high_freq_intensity, duration_ms);
+  }
+}
+
+uint32_t controller_count() noexcept { return g_GameControllers.size(); }
+
+void persist_controller_for_player(uint32_t player, const GameController* controller) noexcept {
+  if (player >= PAD_MAX_CONTROLLERS) {
+    return;
+  }
+
+  ensure_port_preferences_loaded();
+  if (controller != nullptr) {
+    g_portPreferences[player].state = PortPreferenceState::Controller;
+    g_portPreferences[player].identity = controller_identity(*controller);
+  } else {
+    g_portPreferences[player].state = PortPreferenceState::None;
+    g_portPreferences[player].identity = {};
+  }
+  save_port_preferences();
+}
+
+void initialize() noexcept {
+  /* Make sure we initialize everything input related now, this will automatically add all of the connected controllers
+   * as expected */
+  ASSERT(SDL_Init(SDL_INIT_HAPTIC | SDL_INIT_JOYSTICK | SDL_INIT_GAMEPAD), "Failed to initialize SDL subsystems: {}",
+         SDL_GetError());
+}
+
+struct MouseScrollStatus {
+  float scrollX;
+  float scrollY;
+};
+
+static MouseScrollStatus g_MouseStatus;
+
+void set_mouse_scroll(const float scrollX, const float scrollY) noexcept {
+  g_MouseStatus.scrollX = scrollX;
+  g_MouseStatus.scrollY = scrollY;
+}
+
+void get_mouse_scroll(float* scrollX, float* scrollY) noexcept {
+  *scrollX = g_MouseStatus.scrollX;
+  *scrollY = g_MouseStatus.scrollY;
+}
+
+void shutdown() noexcept {
+  // Upon shutdown we want to ensure all controllers are in a default state, so force all rumble supporting controllers
+  // to shut off their rumble motors.
+  for (const auto& controller : g_GameControllers) {
+    if (!controller.second.m_hasRumble) {
+      continue;
+    }
+    controller_rumble(controller.first, 0, 0, 0);
+  }
+}
+} // namespace aurora::input
diff --git a/aurora-main/lib/input.hpp b/aurora-main/lib/input.hpp
new file mode 100644
index 0000000..b839865
--- /dev/null
+++ b/aurora-main/lib/input.hpp
@@ -0,0 +1,71 @@
+#pragma once
+
+#include <string>
+#include <array>
+#include "dolphin/pad.h" // For PADDeaZones and PADButtonMapping
+#include "SDL3/SDL_gamepad.h"
+#include "SDL3/SDL_keyboard.h"
+#include "SDL3/SDL_keycode.h"
+#include "SDL3/SDL_mouse.h"
+#include "logging.hpp"
+
+#include <absl/container/flat_hash_map.h>
+
+namespace aurora::input {
+extern Module Log;
+
+struct GameController {
+  SDL_Gamepad* m_controller = nullptr;
+  bool m_isGameCube = false;
+  Sint32 m_index = -1;
+  Sint32 m_playerIndex = -1;
+  bool m_hasRumble = false;
+  PADDeadZones m_deadZones{
+      .emulateTriggers = true,
+      .useDeadzones = true,
+      .stickDeadZone = 8000,
+      .substickDeadZone = 8000,
+      .leftTriggerActivationZone = 31150,
+      .rightTriggerActivationZone = 31150,
+  };
+  uint16_t m_vid = 0;
+  uint16_t m_pid = 0;
+  std::array<PADButtonMapping, PAD_BUTTON_COUNT> m_buttonMapping{};
+  // Secondary binding per GC button; not persisted in .controller files, the
+  // runtime re-applies it from its own config whenever a controller attaches.
+  std::array<PADButtonMapping, PAD_BUTTON_COUNT> m_altButtonMapping{};
+  std::array<PADAxisMapping, PAD_AXIS_COUNT> m_axisMapping{};
+  uint16_t m_rumbleIntensityLow = 32767;
+  uint16_t m_rumbleIntensityHigh = 32767;
+  bool m_mappingLoaded = false;
+  constexpr bool operator==(const GameController& other) const {
+    return m_controller == other.m_controller && m_index == other.m_index;
+  }
+  uint8_t m_ledRed = 0xFF;
+  uint8_t m_ledGreen = 0xFF;
+  uint8_t m_ledBlue = 0xFF;
+  bool m_isColorDirty = true;
+  bool m_hasRgbLed = false;
+};
+
+GameController* get_controller_for_player(uint32_t player) noexcept;
+Sint32 get_instance_for_player(uint32_t player) noexcept;
+SDL_JoystickID add_controller(SDL_JoystickID which) noexcept;
+void remove_controller(Uint32 instance) noexcept;
+Sint32 player_index(Uint32 instance) noexcept;
+void set_player_index(Uint32 instance, Sint32 index) noexcept;
+std::string controller_name(Uint32 instance) noexcept;
+bool is_gamecube(Uint32 instance) noexcept;
+bool controller_has_rumble(Uint32 instance) noexcept;
+void controller_rumble(uint32_t instance, uint16_t low_freq_intensity, uint16_t high_freq_intensity,
+                       uint16_t duration_ms) noexcept;
+uint32_t controller_count() noexcept;
+void initialize() noexcept;
+void persist_controller_for_player(uint32_t player, const GameController* controller) noexcept;
+extern absl::flat_hash_map<Uint32, GameController> g_GameControllers;
+
+void set_mouse_scroll(float scrollX, float scrollY) noexcept;
+void get_mouse_scroll(float* scrollX, float* scrollY) noexcept;
+
+void shutdown() noexcept;
+} // namespace aurora::input
diff --git a/aurora-main/lib/internal.hpp b/aurora-main/lib/internal.hpp
new file mode 100644
index 0000000..20169a4
--- /dev/null
+++ b/aurora-main/lib/internal.hpp
@@ -0,0 +1,197 @@
+#pragma once
+
+#include "logging.hpp" // IWYU pragma: keep
+
+#include <aurora/aurora.h>
+
+#include <array>
+#include <cassert>
+#include <chrono>
+#include <cstdint>
+#include <mutex>
+#include <type_traits>
+#include <vector>
+
+using namespace std::string_view_literals;
+
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#ifndef SBIG
+#define SBIG(q)                                                                                                        \
+  (((q) & 0x000000FF) << 24 | ((q) & 0x0000FF00) << 8 | ((q) & 0x00FF0000) >> 8 | ((q) & 0xFF000000) >> 24)
+#endif
+#else
+#ifndef SBIG
+#define SBIG(q) (q)
+#endif
+#endif
+
+template <typename T>
+  requires(sizeof(T) == sizeof(uint16_t) && std::is_arithmetic_v<T>)
+constexpr T bswap(T val) noexcept {
+  union {
+    uint16_t u;
+    T t;
+  } v{.t = val};
+#if __GNUC__
+  v.u = __builtin_bswap16(v.u);
+#elif _WIN32
+  v.u = _byteswap_ushort(v.u);
+#else
+  v.u = (v.u << 8) | ((v.u >> 8) & 0xFF);
+#endif
+  return v.t;
+}
+
+template <typename T>
+  requires(sizeof(T) == sizeof(uint32_t) && std::is_arithmetic_v<T>)
+constexpr T bswap(T val) noexcept {
+  union {
+    uint32_t u;
+    T t;
+  } v{.t = val};
+#if __GNUC__
+  v.u = __builtin_bswap32(v.u);
+#elif _WIN32
+  v.u = _byteswap_ulong(v.u);
+#else
+  v.u = ((v.u & 0x0000FFFF) << 16) | ((v.u & 0xFFFF0000) >> 16) | ((v.u & 0x00FF00FF) << 8) | ((v.u & 0xFF00FF00) >> 8);
+#endif
+  return v.t;
+}
+
+template <typename T>
+  requires(sizeof(T) == sizeof(uint64_t) && std::is_arithmetic_v<T>)
+constexpr T bswap(T val) noexcept {
+  union {
+    uint64_t u;
+    T t;
+  } v{.t = val};
+#if __GNUC__
+  v.u = __builtin_bswap64(v.u);
+#elif _WIN32
+  v.u = _byteswap_uint64(v.u);
+#else
+  static_assert(false, "bswap 64bit not implemented on this target");
+#endif
+  return v.t;
+}
+
+template <typename T>
+  requires(std::is_enum_v<T>)
+auto underlying(T value) -> std::underlying_type_t<T> {
+  return static_cast<std::underlying_type_t<T>>(value);
+}
+
+#define AURORA_ALIGN(x, a) (((x) + ((a) - 1)) & ~((a) - 1))
+
+#define POINTER_ADD_TYPE(type_, ptr_, offset_) ((type_)((uintptr_t)(ptr_) + (uintptr_t)(offset_)))
+#define POINTER_ADD(ptr_, offset_) POINTER_ADD_TYPE(decltype(ptr_), ptr_, offset_)
+
+#if !defined(__has_cpp_attribute)
+#define __has_cpp_attribute(name) 0
+#endif
+#if __has_cpp_attribute(unlikely)
+#define UNLIKELY [[unlikely]]
+#else
+#define UNLIKELY
+#endif
+#if __has_cpp_attribute(likely)
+#define LIKELY [[likely]]
+#else
+#define LIKELY
+#endif
+#define FATAL(msg, ...) Log.fatal(msg, ##__VA_ARGS__);
+#define ASSERT(cond, msg, ...)                                                                                         \
+  if (!(cond))                                                                                                         \
+  UNLIKELY FATAL(msg, ##__VA_ARGS__)
+#ifdef NDEBUG
+#define CHECK(cond, msg, ...)
+#else
+#define CHECK(cond, msg, ...) ASSERT(cond, msg, ##__VA_ARGS__)
+#endif
+#define DEFAULT_FATAL(msg, ...) UNLIKELY default : FATAL(msg, ##__VA_ARGS__)
+#define TRY(cond, msg, ...)                                                                                            \
+  if (!(cond))                                                                                                         \
+    UNLIKELY {                                                                                                         \
+      Log.error(msg, ##__VA_ARGS__);                                                                                   \
+      return false;                                                                                                    \
+    }
+#define TRY_WARN(cond, msg, ...)                                                                                       \
+  if (!(cond))                                                                                                         \
+    UNLIKELY { Log.warn(msg, ##__VA_ARGS__); }
+
+#define UNIMPLEMENTED() FATAL("UNIMPLEMENTED: {}", __FUNCTION__)
+
+namespace aurora {
+extern AuroraConfig g_config;
+extern uint32_t g_sdlCustomEventsStart;
+extern char g_gameName[4];
+
+// wait_for_frame_worker() joins the DONE phase (ImGui, surface, sealing another frame need this).
+// wait_for_frame_worker_sealed() joins only SEALED, which is what the FIFO drain uses.
+void wait_for_frame_worker() noexcept;
+std::chrono::nanoseconds wait_for_frame_worker_sealed() noexcept;
+bool wait_for_frame_worker_for(std::chrono::microseconds timeout) noexcept;
+std::recursive_mutex& renderer_gpu_mutex() noexcept;
+
+template <typename T>
+class ArrayRef {
+public:
+  using value_type = std::remove_cvref_t<T>;
+  using pointer = value_type*;
+  using const_pointer = const value_type*;
+  using reference = value_type&;
+  using const_reference = const value_type&;
+  using iterator = const_pointer;
+  using const_iterator = const_pointer;
+  using reverse_iterator = std::reverse_iterator<iterator>;
+  using const_reverse_iterator = std::reverse_iterator<const_iterator>;
+  using size_type = std::size_t;
+  using difference_type = std::ptrdiff_t;
+
+  ArrayRef() = default;
+  explicit ArrayRef(const T& one) : ptr(&one), length(1) {}
+  ArrayRef(const T* data, size_t length) : ptr(data), length(length) {}
+  ArrayRef(const T* begin, const T* end) : ptr(begin), length(end - begin) {}
+  template <size_t N>
+  constexpr ArrayRef(const T (&arr)[N]) : ptr(arr), length(N) {}
+  template <size_t N>
+  constexpr ArrayRef(const std::array<T, N>& arr) : ptr(arr.data()), length(arr.size()) {}
+  ArrayRef(const std::vector<T>& vec) : ptr(vec.data()), length(vec.size()) {}
+
+  const T* data() const { return ptr; }
+  size_t size() const { return length; }
+  bool empty() const { return length == 0; }
+
+  const T& front() const {
+    assert(!empty());
+    return ptr[0];
+  }
+  const T& back() const {
+    assert(!empty());
+    return ptr[length - 1];
+  }
+  const T& operator[](size_t i) const {
+    assert(i < length && "Invalid index!");
+    return ptr[i];
+  }
+
+  iterator begin() const { return ptr; }
+  iterator end() const { return ptr + length; }
+
+  reverse_iterator rbegin() const { return reverse_iterator(end()); }
+  reverse_iterator rend() const { return reverse_iterator(begin()); }
+
+  /// Disallow accidental assignment from a temporary.
+  template <typename U>
+  std::enable_if_t<std::is_same<U, T>::value, ArrayRef<T>>& operator=(U&& Temporary) = delete;
+
+  /// Disallow accidental assignment from a temporary.
+  template <typename U>
+  std::enable_if_t<std::is_same<U, T>::value, ArrayRef<T>>& operator=(std::initializer_list<U>) = delete;
+
+private:
+  const T* ptr = nullptr;
+  size_t length = 0;
+};
+} // namespace aurora
diff --git a/aurora-main/lib/logging.cpp b/aurora-main/lib/logging.cpp
new file mode 100644
index 0000000..609d5d2
--- /dev/null
+++ b/aurora-main/lib/logging.cpp
@@ -0,0 +1,78 @@
+#include "logging.hpp"
+
+#include <fmt/base.h>
+#include <fmt/format.h>
+#include <aurora/aurora.h>
+
+#include <cstdio>
+#include <string>
+#include <string_view>
+
+#if defined(_WIN32)
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <windows.h>
+#endif
+
+namespace aurora {
+extern AuroraConfig g_config;
+
+void Module::show_fatal_dialog(const char* module, std::string_view message) noexcept {
+  try {
+    std::string body = "Aurora stopped because of a fatal renderer error";
+    if (module != nullptr && module[0] != '\0') {
+      body += " in ";
+      body += module;
+    }
+    body += ":\n\n";
+    body.append(message.data(), message.size());
+    body += "\n\nSee the console and log files for more details.";
+#if defined(_WIN32)
+    ::MessageBoxA(nullptr, body.c_str(), "Aurora fatal error",
+                  MB_OK | MB_ICONERROR | MB_SETFOREGROUND | MB_TASKMODAL);
+#else
+    std::fprintf(stderr, "[aurora] fatal dialog: %s\n", body.c_str());
+#endif
+  } catch (...) {
+    // Fatal reporting must never hide the original abort.
+  }
+}
+
+void log_internal(const AuroraLogLevel level, const char* module, const char* message,
+                  const unsigned int len) noexcept {
+  if (module == nullptr) {
+    module = "";
+  }
+  if (g_config.logCallback == nullptr) {
+    fmt::println(stderr, "[{}] [{}] {}", level, module, std::string_view(message, len));
+  } else {
+    g_config.logCallback(level, module, message, len);
+  }
+}
+} // namespace aurora
+
+auto fmt::formatter<AuroraLogLevel>::format(const AuroraLogLevel level, format_context& ctx) const
+    -> format_context::iterator {
+  std::string_view name = "unknown";
+  switch (level) {
+  case LOG_DEBUG:
+    name = "debug";
+    break;
+  case LOG_INFO:
+    name = "info";
+    break;
+  case LOG_WARNING:
+    name = "warning";
+    break;
+  case LOG_ERROR:
+    name = "error";
+    break;
+  case LOG_FATAL:
+    name = "fatal";
+    break;
+  default:
+    break;
+  }
+  return formatter<std::string_view>::format(name, ctx);
+}
diff --git a/aurora-main/lib/logging.hpp b/aurora-main/lib/logging.hpp
new file mode 100644
index 0000000..13f9314
--- /dev/null
+++ b/aurora-main/lib/logging.hpp
@@ -0,0 +1,68 @@
+#pragma once
+
+#include <aurora/aurora.h>
+
+#include <fmt/base.h>
+#include <fmt/format.h>
+
+#include <cstdlib>
+#include <string_view>
+
+namespace aurora {
+void log_internal(AuroraLogLevel level, const char* module, const char* message, unsigned int len) noexcept;
+
+extern AuroraConfig g_config;
+
+struct Module {
+  const char* name;
+  explicit Module(const char* name) noexcept : name(name) {}
+
+  template <typename... T>
+  void report(const AuroraLogLevel level, fmt::format_string<T...> fmt, T&&... args) noexcept {
+    if (g_config.logLevel > level) return;
+
+    auto message = fmt::format(fmt, std::forward<T>(args)...);
+    log_internal(level, name, message.c_str(), static_cast<unsigned int>(message.size()));
+  }
+
+  template <typename... T>
+  void debug(fmt::format_string<T...> fmt, T&&... args) noexcept {
+    report(LOG_DEBUG, fmt, std::forward<T>(args)...);
+  }
+
+  template <typename... T>
+  void info(fmt::format_string<T...> fmt, T&&... args) noexcept {
+    report(LOG_INFO, fmt, std::forward<T>(args)...);
+  }
+
+  template <typename... T>
+  void warn(fmt::format_string<T...> fmt, T&&... args) noexcept {
+    report(LOG_WARNING, fmt, std::forward<T>(args)...);
+  }
+
+  template <typename... T>
+  void error(fmt::format_string<T...> fmt, T&&... args) noexcept {
+    report(LOG_ERROR, fmt, std::forward<T>(args)...);
+  }
+
+  template <typename... T>
+  [[noreturn]] void fatal(fmt::format_string<T...> fmt, T&&... args) noexcept {
+    auto message = fmt::format(fmt, std::forward<T>(args)...);
+    log_internal(LOG_FATAL, name, message.c_str(), static_cast<unsigned int>(message.size()));
+    // Embedders can provide a fatal log callback, which the runtime uses for its own crash dialog.
+    // Standalone Aurora builds fall back to logging.cpp's native one.
+    if (g_config.logCallback == nullptr) {
+      show_fatal_dialog(name, message);
+    }
+    std::abort();
+  }
+
+private:
+  static void show_fatal_dialog(const char* module, std::string_view message) noexcept;
+};
+} // namespace aurora
+
+template <>
+struct fmt::formatter<AuroraLogLevel> : formatter<std::string_view> {
+  auto format(AuroraLogLevel level, format_context& ctx) const -> format_context::iterator;
+};
diff --git a/aurora-main/lib/main.cpp b/aurora-main/lib/main.cpp
new file mode 100644
index 0000000..8a7fbee
--- /dev/null
+++ b/aurora-main/lib/main.cpp
@@ -0,0 +1,6 @@
+#include <aurora/main.h>
+#undef main
+
+#include <SDL3/SDL_main.h>
+
+int main(int argc, char** argv) { return aurora_main(argc, argv); }
diff --git a/aurora-main/lib/sqlite_utils.hpp b/aurora-main/lib/sqlite_utils.hpp
new file mode 100644
index 0000000..38db46b
--- /dev/null
+++ b/aurora-main/lib/sqlite_utils.hpp
@@ -0,0 +1,77 @@
+#pragma once
+
+#include "internal.hpp"
+
+#include <sqlite3.h>
+
+namespace aurora::sqlite {
+
+inline int exec(sqlite3* db, const char* sql) { return sqlite3_exec(db, sql, nullptr, nullptr, nullptr); }
+
+template <typename T>
+int exec(sqlite3* db, const char* sql, T callback, char** errmsg = nullptr) {
+  return sqlite3_exec(
+      db, sql,
+      [](void* cb, int argc, char** argv, char** columns) -> int {
+        auto& fp = *static_cast<T*>(cb);
+        if constexpr (std::is_same_v<decltype(fp(0, 0, 0)), void>) {
+          fp(argc, argv, columns);
+          return 0;
+        } else {
+          return fp(argc, argv, columns);
+        }
+      },
+      &callback, errmsg);
+}
+
+class Transaction {
+public:
+  Transaction(sqlite3* db, Module& log, bool immediate = false) : m_db(db), m_log(log) {
+    const auto type = immediate ? "BEGIN IMMEDIATE" : "BEGIN";
+    const auto ret = sqlite3_exec(m_db, type, nullptr, nullptr, nullptr);
+    if (ret != SQLITE_OK) {
+      m_log.error("Failed to start transaction: {}", sqlite3_errmsg(m_db));
+      return;
+    }
+    m_active = true;
+  }
+
+  Transaction(const Transaction&) = delete;
+  Transaction& operator=(const Transaction&) = delete;
+  Transaction(Transaction&&) = delete;
+  Transaction& operator=(Transaction&&) = delete;
+
+  ~Transaction() {
+    if (!m_active) {
+      return;
+    }
+
+    const auto ret = sqlite3_exec(m_db, "ROLLBACK", nullptr, nullptr, nullptr);
+    if (ret != SQLITE_OK) {
+      m_log.error("Failed to roll back transaction (uh oh?): {}", sqlite3_errmsg(m_db));
+    }
+  }
+
+  void commit() {
+    if (!m_active) {
+      return;
+    }
+
+    const auto ret = sqlite3_exec(m_db, "COMMIT", nullptr, nullptr, nullptr);
+    if (ret != SQLITE_OK) {
+      m_log.error("Failed to commit transaction: {}", sqlite3_errmsg(m_db));
+      return;
+    }
+
+    m_active = false;
+  }
+
+  explicit operator bool() const { return m_active; }
+
+private:
+  sqlite3* m_db = nullptr;
+  Module& m_log;
+  bool m_active = false;
+};
+
+} // namespace aurora::sqlite
diff --git a/aurora-main/lib/system_info.cpp b/aurora-main/lib/system_info.cpp
new file mode 100644
index 0000000..15a58d4
--- /dev/null
+++ b/aurora-main/lib/system_info.cpp
@@ -0,0 +1,368 @@
+#include "system_info.hpp"
+#include "internal.hpp"
+
+#if _WIN32
+#define WIN32_LEAN_AND_MEAN 1
+#include <windows.h>
+#include <dxgi.h>
+
+template<typename T>
+class ComPtr {
+public:
+  ComPtr() = default;
+  ComPtr(const ComPtr&) = delete;
+  ComPtr& operator=(const ComPtr&) = delete;
+  ~ComPtr() { reset(); }
+
+  T* Get() const { return value; }
+  T* operator->() const { return value; }
+  T** Put() {
+    reset();
+    return &value;
+  }
+
+private:
+  void reset() {
+    if (value != nullptr) {
+      value->Release();
+      value = nullptr;
+    }
+  }
+
+  T* value = nullptr;
+};
+typedef LONG NTSTATUS, *PNTSTATUS;
+extern "C" NTSYSAPI NTSTATUS NTAPI RtlGetVersion(PRTL_OSVERSIONINFOEXW lpVersionInformation);
+#elif __APPLE__
+#include "sys/sysctl.h"
+#elif linux
+#include <ranges>
+#include <fstream>
+#include <filesystem>
+#include <sys/sysinfo.h>
+#endif
+
+
+using namespace std::string_literals;
+
+namespace aurora {
+
+static constexpr auto Unknown = "Unknown";
+
+static Module Log("aurora::system_info");
+
+static std::string GetOSVersion();
+static std::string GetCpuModel();
+static uint64_t GetMemoryAmount();
+static void LogMisc();
+
+void log_system_information() {
+  Log.info("CPU model: {}", GetCpuModel());
+  const auto memSize = GetMemoryAmount() / 1024 / 1024;
+  Log.info("Memory: {} MiB", memSize);
+
+#if defined(__x86_64__) || defined(_M_X64) || defined(_M_X64)
+  Log.info("Architecture: x86_64");
+#elif defined(__aarch64__) || defined(_M_ARM64)
+  Log.info("Architecture: aarch64");
+#else
+  Log.info("Architecture: Unknown");
+#endif
+
+  Log.info("OS: {}", GetOSVersion());
+  LogMisc();
+}
+
+#if _WIN32
+static std::string wideStringToUtf8(std::wstring_view str) {
+  const auto size = WideCharToMultiByte(
+    CP_UTF8,
+    0,
+    str.data(),
+    static_cast<int>(str.size()),
+    nullptr,
+    0,
+    nullptr,
+    nullptr
+    );
+
+  std::string result{};
+  result.resize(size);
+
+  WideCharToMultiByte(
+    CP_UTF8,
+    0,
+    str.data(),
+    static_cast<int>(str.size()),
+    result.data(),
+    static_cast<int>(result.size()),
+    nullptr,
+    nullptr
+    );
+
+  return result;
+}
+
+std::string GetCpuModel() {
+  HKEY key = nullptr;
+  const auto opened = RegOpenKeyExW(
+    HKEY_LOCAL_MACHINE,
+    L"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0",
+    0,
+    KEY_QUERY_VALUE,
+    &key);
+  if (opened != ERROR_SUCCESS) {
+    Log.error("Unable to open the processor registry key");
+    return Unknown;
+  }
+
+  wchar_t value[256]{};
+  DWORD type = 0;
+  DWORD size = sizeof(value);
+  const auto queried = RegQueryValueExW(
+    key,
+    L"ProcessorNameString",
+    nullptr,
+    &type,
+    reinterpret_cast<BYTE*>(value),
+    &size);
+  RegCloseKey(key);
+  if (queried != ERROR_SUCCESS || (type != REG_SZ && type != REG_EXPAND_SZ)) {
+    Log.error("Unable to read the processor name");
+    return Unknown;
+  }
+
+  const auto length = wcsnlen(value, sizeof(value) / sizeof(value[0]));
+  return wideStringToUtf8(std::wstring_view(value, length));
+}
+
+uint64_t GetMemoryAmount() {
+  MEMORYSTATUSEX status;
+  status.dwLength = sizeof(status);
+  GlobalMemoryStatusEx(&status);
+
+  return status.ullTotalPhys;
+}
+
+std::string GetOSVersion() {
+  RTL_OSVERSIONINFOEXW info = {};
+  info.dwOSVersionInfoSize = sizeof(info);
+  auto result = RtlGetVersion(&info);
+  if (result != 0) {
+    Log.error("RtlGetVersion failed");
+    return Unknown;
+  }
+
+  return fmt::format(
+    "Microsoft Windows {}.{} build {}",
+    info.dwMajorVersion,
+    info.dwMinorVersion,
+    info.dwBuildNumber);
+}
+
+static void LogGpus() {
+  ComPtr<IDXGIFactory1> factory;
+  auto result = CreateDXGIFactory1(
+    __uuidof(IDXGIFactory1),
+    reinterpret_cast<void**>(factory.Put()));
+  if (FAILED(result)) {
+    Log.error("Unable to create IDXGIFactory1");
+    return;
+  }
+
+  for (UINT i = 0;;i++) {
+    ComPtr<IDXGIAdapter1> adapter;
+    result = factory->EnumAdapters1(i, adapter.Put());
+    if (result == DXGI_ERROR_NOT_FOUND)
+      break;
+
+    DXGI_ADAPTER_DESC1 desc{};
+    adapter->GetDesc1(&desc);
+
+    std::wstring descName(desc.Description, wcsnlen(desc.Description, 128));
+    Log.info("Detected GPU: {}", wideStringToUtf8(descName));
+  }
+}
+
+void LogMisc() {
+  LogGpus();
+}
+
+#elif __APPLE__
+
+static std::string sysCtlToString(const char* name) {
+  size_t length;
+  auto err = sysctlbyname(name, nullptr, &length, nullptr, 0);
+  if (err) {
+    Log.error("sysctlbyname failed: %d", err);
+    return Unknown;
+  }
+
+  std::string value;
+  value.resize(length);
+  err = sysctlbyname(name, value.data(), &length, nullptr, 0);
+  if (err) {
+    Log.error("second sysctlbyname failed: %d", err);
+    return Unknown;
+  }
+
+  if (value[length - 1] == '\0')
+    value.pop_back();
+
+  return value;
+}
+
+std::string GetCpuModel() {
+  return sysCtlToString("machdep.cpu.brand_string");
+}
+
+uint64_t GetMemoryAmount() {
+  uint64_t result;
+  size_t size = sizeof(result);
+  const auto err = sysctlbyname("hw.memsize", &result, &size, nullptr, 0);
+  if (err) {
+    Log.error("sysctlbyname failed: %d", err);
+    return 0;
+  }
+
+  return result;
+}
+
+std::string GetOSVersion() {
+#if TARGET_OS_MAC
+  constexpr auto name = "macOS";
+#elif TARGET_OS_IOS
+  constexpr auto name = "iOS";
+#elif TARGET_OS_TV
+  constexpr auto name = "tvOS";
+#elif
+  constexpr auto name = Unknown;
+#endif
+
+  return fmt::format("{} {}", name, system_info::getSystemVersionString());
+}
+
+void LogMisc() {
+  // Nada.
+}
+#elif linux
+
+// https://stackoverflow.com/questions/216823/how-can-i-trim-a-stdstring
+static void ltrim(std::string &s) {
+  s.erase(s.begin(), std::ranges::find_if(s.begin(), s.end(), [](unsigned char ch) {
+    return !std::isspace(ch);
+  }));
+}
+static void rtrim(std::string &s) {
+    s.erase(std::ranges::find_if(s.rbegin(), s.rend(), [](unsigned char ch) {
+        return !std::isspace(ch);
+    }).base(), s.end());
+}
+inline std::string trim(std::string str) {
+  ltrim(str);
+  rtrim(str);
+  return std::move(str);
+}
+
+std::string GetCpuModel() {
+  std::ifstream cpuInfo("/proc/cpuinfo");
+  if (!cpuInfo)
+  {
+    Log.error("Failed to open /proc/cpuinfo");
+    return Unknown;
+  }
+
+  while (!cpuInfo.bad() && !cpuInfo.eof()) {
+    std::string line;
+    std::getline(cpuInfo, line);
+
+    const auto colon = line.find(':');
+    if (colon == std::string::npos) {
+      continue;
+    }
+
+    auto left = trim(line.substr(0, colon));
+    auto right = trim(line.substr(colon + 1));
+
+    if (left == "model name") {
+      return right;
+    }
+  }
+
+  return Unknown;
+}
+
+uint64_t GetMemoryAmount() {
+  struct sysinfo info{};
+  sysinfo(&info);
+
+  return info.totalram;
+}
+
+std::string GetOSVersion() {
+  auto path = "/etc/os-release";
+  if (!std::filesystem::exists(path)) {
+    path = "/usr/lib/os-release";
+  }
+
+  std::ifstream releaseInfo(path);
+  if (!releaseInfo)
+  {
+    Log.error("Failed to open /etc/os-release or /usr/lib/os-release");
+    return Unknown;
+  }
+
+  std::string name, version;
+
+  while (!releaseInfo.bad() && !releaseInfo.eof()) {
+    std::string line;
+    std::getline(releaseInfo, line);
+
+    const auto split = line.find('=');
+    if (split == std::string::npos) {
+      continue;
+    }
+
+    auto left = trim(line.substr(0, split));
+    auto right = trim(line.substr(split + 1));
+
+    if (right[0] == '"' && right[right.size()-1] == '"') {
+      right = right.substr(1, right.size()-2);
+    }
+
+    if (left == "NAME") {
+      name = right;
+    } else if (left == "VERSION") {
+      version = right;
+    }
+  }
+
+  if (name.empty()) {
+    return Unknown;
+  }
+
+  return fmt::format("{} {}", name, version);
+}
+
+void LogMisc() {
+
+}
+#else
+std::string GetCpuModel() {
+  return Unknown;
+}
+
+uint64_t GetMemoryAmount() {
+  return 0;
+}
+
+std::string GetOSVersion() {
+  return Unknown;
+}
+
+void LogMisc() {
+
+}
+#endif
+
+} // namespace aurora
diff --git a/aurora-main/lib/system_info.hpp b/aurora-main/lib/system_info.hpp
new file mode 100644
index 0000000..6dda15e
--- /dev/null
+++ b/aurora-main/lib/system_info.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include <string>
+
+namespace aurora {
+  void log_system_information();
+
+  namespace system_info {
+#if __APPLE__
+    std::string getSystemVersionString();
+#endif
+  }
+}
\ No newline at end of file
diff --git a/aurora-main/lib/system_info_mac.mm b/aurora-main/lib/system_info_mac.mm
new file mode 100644
index 0000000..113ac47
--- /dev/null
+++ b/aurora-main/lib/system_info_mac.mm
@@ -0,0 +1,10 @@
+#include "system_info.hpp"
+#include <Foundation/NSProcessInfo.h>
+#include <Foundation/NSString.h>
+
+namespace aurora::system_info {
+    std::string getSystemVersionString() {
+        NSString * str = [[NSProcessInfo processInfo] operatingSystemVersionString];
+        return [str UTF8String];
+    }
+}
\ No newline at end of file
diff --git a/aurora-main/lib/webgpu/gpu.cpp b/aurora-main/lib/webgpu/gpu.cpp
new file mode 100644
index 0000000..e2fe351
--- /dev/null
+++ b/aurora-main/lib/webgpu/gpu.cpp
@@ -0,0 +1,966 @@
+#include "gpu.hpp"
+
+#include <array>
+#include <algorithm>
+#include <atomic>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <mutex>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include <aurora/aurora.h>
+#include <aurora/gfx.h>
+#include <aurora/render_size_limits.hpp>
+#include <magic_enum.hpp>
+#include <webgpu/webgpu_cpp.h>
+
+#include "../gfx/common.hpp"
+#include "../internal.hpp"
+#include "../window.hpp"
+#include "../dolphin/vi/vi_internal.hpp"
+
+#if defined(WEBGPU_DAWN) && !defined(__MINGW32__)
+#include "../dawn/BackendBinding.hpp"
+#include <dawn/native/DawnNative.h>
+#elif defined(WEBGPU_DAWN)
+#include "../dawn/BackendBinding.hpp"
+#endif
+
+#if defined(WEBGPU_DAWN) && defined(_WIN32)
+#include <windows.h>
+#endif
+
+namespace aurora::gx {
+void clear_display_copy_cache() noexcept;
+} // namespace aurora::gx
+namespace aurora::gfx {
+void clear_offscreen_cache();
+} // namespace aurora::gfx
+
+namespace aurora::webgpu {
+static Module Log("aurora::gpu");
+
+wgpu::Device g_device;
+wgpu::Queue g_queue;
+wgpu::Surface g_surface;
+wgpu::BackendType g_backendType;
+GraphicsConfig g_graphicsConfig;
+TextureWithSampler g_frameBuffer;
+TextureWithSampler g_frameBufferResolved;
+TextureWithSampler g_depthBuffer;
+
+// EFB -> XFB copy pipeline
+static wgpu::BindGroupLayout g_CopyBindGroupLayout;
+wgpu::RenderPipeline g_CopyPipeline;
+wgpu::BindGroup g_CopyBindGroup;
+static bool g_presentSourceOverrideActive = false;
+static wgpu::BindGroup g_presentSourceOverrideBindGroup;
+static wgpu::Texture g_presentSourceOverrideTexture;
+static wgpu::Extent3D g_presentSourceOverrideSize{};
+static wgpu::TextureFormat g_presentSourceOverrideFormat = wgpu::TextureFormat::Undefined;
+
+static wgpu::Adapter g_adapter;
+wgpu::Instance g_instance;
+static wgpu::AdapterInfo g_adapterInfo;
+static wgpu::SurfaceCapabilities g_surfaceCapabilities;
+bool g_bcTexturesSupported;
+// Written by Dawn's device-loss callback and consumed at ordered frame boundaries. Keep the
+// callback free of logging, allocation, teardown and renderer state mutation.
+static std::atomic_bool g_deviceLost{false};
+static std::atomic<wgpu::DeviceLostReason> g_deviceLostReason{wgpu::DeviceLostReason::Unknown};
+// The reason enum is almost always `Unknown`, while Dawn's message carries the real cause, so
+// keep a truncated copy. Written with a plain memcpy, published by the g_deviceLost store.
+static std::array<char, 256> g_deviceLostMessage{};
+// Errors raised before initialize() completes must not be fatal: the backend fallback loop retries
+// the next backend, and a broken ICD can raise uncaptured errors mid-probe.
+static std::atomic_bool g_initialized{false};
+
+namespace {
+
+struct RenderTargetSize {
+  uint32_t width;
+  uint32_t height;
+};
+
+RenderTargetSize clamp_render_target_size(uint32_t width, uint32_t height) noexcept {
+  const uint32_t maxDimension = g_graphicsConfig.maxTextureDimension2D;
+  if (width == 0 || height == 0 || maxDimension == 0 || maxDimension == WGPU_LIMIT_U32_UNDEFINED ||
+      (width <= maxDimension && height <= maxDimension)) {
+    return {width, height};
+  }
+
+  // Keep the requested aspect while fitting both axes inside the adapter's maximum 2D texture size.
+  // 64-bit arithmetic so a large window cannot wrap during the scale.
+  if (width > maxDimension) {
+    height = std::max(1u, static_cast<uint32_t>((static_cast<uint64_t>(height) * maxDimension) / width));
+    width = maxDimension;
+  }
+  if (height > maxDimension) {
+    width = std::max(1u, static_cast<uint32_t>((static_cast<uint64_t>(width) * maxDimension) / height));
+    height = maxDimension;
+  }
+  return {width, height};
+}
+
+RenderTargetSize clamp_frame_buffer_size(uint32_t width, uint32_t height) noexcept {
+  const auto adapterClamped = clamp_render_target_size(width, height);
+  const auto budgeted =
+      render_size_limits::fit_framebuffer_to_budget(adapterClamped.width, adapterClamped.height,
+                                                    g_graphicsConfig.maxTextureDimension2D);
+  return {budgeted.width, budgeted.height};
+}
+
+// V-Sync is never enabled: the guest drives its own pacing, and blocking in Present() couples the
+// whole machine to the monitor (a 120 FPS target on a 75 Hz display runs in slow motion).
+wgpu::PresentMode best_present_mode() {
+  const auto supports = [](const wgpu::PresentMode candidate) {
+    for (size_t i = 0; i < g_surfaceCapabilities.presentModeCount; ++i) {
+      if (g_surfaceCapabilities.presentModes[i] == candidate) {
+        return true;
+      }
+    }
+    return false;
+  };
+  // Vulkan prefers Mailbox, every other backend Immediate. Under window capture the Vulkan driver
+  // cannot flip and Immediate leaks about a megabyte per present until the device is lost.
+  const bool preferMailbox = g_backendType == wgpu::BackendType::Vulkan;
+  if (preferMailbox && supports(wgpu::PresentMode::Mailbox)) {
+    return wgpu::PresentMode::Mailbox;
+  }
+  if (supports(wgpu::PresentMode::Immediate)) {
+    return wgpu::PresentMode::Immediate;
+  }
+  if (g_backendType != wgpu::BackendType::Metal && supports(wgpu::PresentMode::Mailbox)) {
+    return wgpu::PresentMode::Mailbox;
+  }
+  // Mailbox is preferred over Fifo because Fifo caps presentation at the refresh rate and every slot
+  // deadline after the first is missed. Reaching this means neither is offered, so say so loudly.
+  Log.warn("Surface supports neither Immediate nor Mailbox; falling back to Fifo. Presentation "
+           "is capped at the display refresh rate, so the game may run slower than its own "
+           "pace and frame interpolation cannot exceed the refresh rate.");
+  return wgpu::PresentMode::Fifo;
+}
+
+wgpu::TextureFormat to_linear(wgpu::TextureFormat format) {
+  if (format == wgpu::TextureFormat::RGBA8UnormSrgb) {
+    return wgpu::TextureFormat::RGBA8Unorm;
+  }
+  if (format == wgpu::TextureFormat::BGRA8UnormSrgb) {
+    return wgpu::TextureFormat::BGRA8Unorm;
+  }
+  return format;
+}
+
+wgpu::TextureFormat best_surface_format() {
+  if (g_surfaceCapabilities.formatCount == 0) {
+    return wgpu::TextureFormat::Undefined;
+  }
+  for (size_t i = 0; i < g_surfaceCapabilities.formatCount; ++i) {
+    const auto format = to_linear(g_surfaceCapabilities.formats[i]);
+    if (format == wgpu::TextureFormat::RGBA8Unorm || format == wgpu::TextureFormat::BGRA8Unorm) {
+      return format;
+    }
+  }
+  return g_surfaceCapabilities.formats[0];
+}
+
+} // namespace
+
+TextureWithSampler create_render_texture(uint32_t width, uint32_t height, bool multisampled) {
+  const auto renderTargetSize = clamp_render_target_size(width, height);
+  const wgpu::Extent3D size{
+      .width = renderTargetSize.width,
+      .height = renderTargetSize.height,
+      .depthOrArrayLayers = 1,
+  };
+  const auto format = g_graphicsConfig.surfaceConfiguration.format;
+  uint32_t sampleCount = 1;
+  if (multisampled) {
+    sampleCount = g_graphicsConfig.msaaSamples;
+  }
+  if (width == 0 || height == 0) {
+    Log.fatal("Invalid render texture size! {}x{}, multisampled {}, format {}", width, height, static_cast<uint32_t>(format), multisampled);
+  }
+  const wgpu::TextureDescriptor textureDescriptor{
+      .label = "Render texture",
+      .usage = wgpu::TextureUsage::RenderAttachment | wgpu::TextureUsage::TextureBinding | wgpu::TextureUsage::CopySrc |
+               wgpu::TextureUsage::CopyDst,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = format,
+      .mipLevelCount = 1,
+      .sampleCount = sampleCount,
+  };
+  auto texture = g_device.CreateTexture(&textureDescriptor);
+
+  constexpr wgpu::TextureViewDescriptor viewDescriptor{
+      .label = "Render texture view",
+      .dimension = wgpu::TextureViewDimension::e2D,
+  };
+  auto view = texture.CreateView(&viewDescriptor);
+
+  constexpr wgpu::SamplerDescriptor samplerDescriptor{
+      .label = "Render sampler",
+      .addressModeU = wgpu::AddressMode::ClampToEdge,
+      .addressModeV = wgpu::AddressMode::ClampToEdge,
+      .addressModeW = wgpu::AddressMode::ClampToEdge,
+      .magFilter = wgpu::FilterMode::Linear,
+      .minFilter = wgpu::FilterMode::Linear,
+      .mipmapFilter = wgpu::MipmapFilterMode::Linear,
+      .lodMinClamp = 0.f,
+      .lodMaxClamp = 1000.f,
+      .maxAnisotropy = 1,
+  };
+  auto sampler = g_device.CreateSampler(&samplerDescriptor);
+
+  return {
+      .texture = std::move(texture),
+      .view = std::move(view),
+      .size = size,
+      .format = format,
+      .sampler = std::move(sampler),
+  };
+}
+
+const TextureWithSampler& present_source() noexcept {
+  return g_graphicsConfig.msaaSamples > 1 ? g_frameBufferResolved : g_frameBuffer;
+}
+
+PresentSource current_present_source() noexcept {
+  if (g_presentSourceOverrideActive && g_presentSourceOverrideBindGroup != nullptr) {
+    return {
+        .bindGroup = g_presentSourceOverrideBindGroup,
+        .texture = g_presentSourceOverrideTexture,
+        .size = g_presentSourceOverrideSize,
+        .format = g_presentSourceOverrideFormat,
+    };
+  }
+
+  return {
+      .bindGroup = g_CopyBindGroup,
+      .texture = present_source().texture,
+      .size = present_source().size,
+      .format = present_source().format,
+  };
+}
+
+void set_present_source_override(wgpu::BindGroup bindGroup, wgpu::Texture texture, wgpu::Extent3D size,
+                                 wgpu::TextureFormat format) noexcept {
+  g_presentSourceOverrideBindGroup = std::move(bindGroup);
+  g_presentSourceOverrideTexture = std::move(texture);
+  g_presentSourceOverrideSize = size;
+  g_presentSourceOverrideFormat = format;
+  g_presentSourceOverrideActive = true;
+}
+
+void clear_present_source_override() noexcept {
+  g_presentSourceOverrideActive = false;
+  g_presentSourceOverrideBindGroup = {};
+  g_presentSourceOverrideTexture = {};
+  g_presentSourceOverrideSize = {};
+  g_presentSourceOverrideFormat = wgpu::TextureFormat::Undefined;
+}
+
+Viewport calculate_present_viewport_for_aspect(uint32_t surface_width, uint32_t surface_height,
+                                               float content_aspect) noexcept {
+  if (surface_width == 0 || surface_height == 0 || !(content_aspect > 0.f)) {
+    return {};
+  }
+
+  uint32_t viewport_width = surface_width;
+  uint32_t viewport_height = std::min<uint32_t>(
+      surface_height, std::max<uint32_t>(1u, static_cast<uint32_t>(std::lround(static_cast<double>(viewport_width) *
+                                                                               static_cast<double>(1.f / content_aspect)))));
+  if (viewport_height == surface_height) {
+    viewport_width = std::min<uint32_t>(
+        surface_width, std::max<uint32_t>(1u, static_cast<uint32_t>(std::lround(static_cast<double>(viewport_height) *
+                                                                                static_cast<double>(content_aspect)))));
+  }
+
+  return {
+      .left = static_cast<float>((surface_width - viewport_width) / 2),
+      .top = static_cast<float>((surface_height - viewport_height) / 2),
+      .width = static_cast<float>(viewport_width),
+      .height = static_cast<float>(viewport_height),
+      .znear = 0.f,
+      .zfar = 1.f,
+  };
+}
+
+Viewport calculate_present_viewport(uint32_t surface_width, uint32_t surface_height, uint32_t content_width,
+                                    uint32_t content_height) noexcept {
+  if (content_width == 0 || content_height == 0) {
+    return {};
+  }
+  return calculate_present_viewport_for_aspect(
+      surface_width, surface_height, static_cast<float>(content_width) / static_cast<float>(content_height));
+}
+
+static TextureWithSampler create_depth_texture(uint32_t width, uint32_t height) {
+  const auto renderTargetSize = clamp_render_target_size(width, height);
+  const wgpu::Extent3D size{
+      .width = renderTargetSize.width,
+      .height = renderTargetSize.height,
+      .depthOrArrayLayers = 1,
+  };
+  const auto format = g_graphicsConfig.depthFormat;
+  const wgpu::TextureDescriptor textureDescriptor{
+      .label = "Depth texture",
+      .usage = wgpu::TextureUsage::RenderAttachment | wgpu::TextureUsage::TextureBinding,
+      .dimension = wgpu::TextureDimension::e2D,
+      .size = size,
+      .format = format,
+      .mipLevelCount = 1,
+      .sampleCount = g_graphicsConfig.msaaSamples,
+  };
+  auto texture = g_device.CreateTexture(&textureDescriptor);
+
+  const wgpu::TextureViewDescriptor viewDescriptor{
+      .label = "Depth texture view",
+      .dimension = wgpu::TextureViewDimension::e2D,
+  };
+  auto view = texture.CreateView(&viewDescriptor);
+
+  const wgpu::SamplerDescriptor samplerDescriptor{
+      .label = "Depth sampler",
+      .addressModeU = wgpu::AddressMode::ClampToEdge,
+      .addressModeV = wgpu::AddressMode::ClampToEdge,
+      .addressModeW = wgpu::AddressMode::ClampToEdge,
+      .magFilter = wgpu::FilterMode::Linear,
+      .minFilter = wgpu::FilterMode::Linear,
+      .mipmapFilter = wgpu::MipmapFilterMode::Linear,
+      .lodMinClamp = 0.f,
+      .lodMaxClamp = 1000.f,
+      .maxAnisotropy = 1,
+  };
+  auto sampler = g_device.CreateSampler(&samplerDescriptor);
+
+  return {
+      .texture = std::move(texture),
+      .view = std::move(view),
+      .size = size,
+      .format = format,
+      .sampler = std::move(sampler),
+  };
+}
+
+void create_copy_pipeline() {
+  wgpu::ShaderSourceWGSL sourceDescriptor{};
+  sourceDescriptor.code = R"""(
+@group(0) @binding(0)
+var efb_sampler: sampler;
+@group(0) @binding(1)
+var efb_texture: texture_2d<f32>;
+
+struct VertexOutput {
+    @builtin(position) pos: vec4<f32>,
+    @location(0) uv: vec2<f32>,
+};
+
+var<private> pos: array<vec2<f32>, 3> = array<vec2<f32>, 3>(
+    vec2(-1.0, 1.0),
+    vec2(-1.0, -3.0),
+    vec2(3.0, 1.0),
+);
+var<private> uvs: array<vec2<f32>, 3> = array<vec2<f32>, 3>(
+    vec2(0.0, 0.0),
+    vec2(0.0, 2.0),
+    vec2(2.0, 0.0),
+);
+
+@vertex
+fn vs_main(@builtin(vertex_index) vtxIdx: u32) -> VertexOutput {
+    var out: VertexOutput;
+    out.pos = vec4<f32>(pos[vtxIdx], 0.0, 1.0);
+    out.uv = uvs[vtxIdx];
+    return out;
+}
+
+@fragment
+fn fs_main(in: VertexOutput) -> @location(0) vec4<f32> {
+    let color = textureSample(efb_texture, efb_sampler, in.uv);
+    return vec4(color.rgb, 1.0);
+}
+)""";
+  const wgpu::ShaderModuleDescriptor moduleDescriptor{
+      .nextInChain = &sourceDescriptor,
+      .label = "XFB Copy Module",
+  };
+  auto module = g_device.CreateShaderModule(&moduleDescriptor);
+  const std::array colorTargets{wgpu::ColorTargetState{
+      .format = g_graphicsConfig.surfaceConfiguration.format,
+      .writeMask = wgpu::ColorWriteMask::All,
+  }};
+  const wgpu::FragmentState fragmentState{
+      .module = module,
+      .entryPoint = "fs_main",
+      .targetCount = colorTargets.size(),
+      .targets = colorTargets.data(),
+  };
+  const std::array bindGroupLayoutEntries{
+      wgpu::BindGroupLayoutEntry{
+          .binding = 0,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .sampler =
+              wgpu::SamplerBindingLayout{
+                  .type = wgpu::SamplerBindingType::Filtering,
+              },
+      },
+      wgpu::BindGroupLayoutEntry{
+          .binding = 1,
+          .visibility = wgpu::ShaderStage::Fragment,
+          .texture =
+              wgpu::TextureBindingLayout{
+                  .sampleType = wgpu::TextureSampleType::Float,
+                  .viewDimension = wgpu::TextureViewDimension::e2D,
+              },
+      },
+  };
+  const wgpu::BindGroupLayoutDescriptor bindGroupLayoutDescriptor{
+      .entryCount = bindGroupLayoutEntries.size(),
+      .entries = bindGroupLayoutEntries.data(),
+  };
+  g_CopyBindGroupLayout = g_device.CreateBindGroupLayout(&bindGroupLayoutDescriptor);
+  const wgpu::PipelineLayoutDescriptor layoutDescriptor{
+      .bindGroupLayoutCount = 1,
+      .bindGroupLayouts = &g_CopyBindGroupLayout,
+  };
+  auto pipelineLayout = g_device.CreatePipelineLayout(&layoutDescriptor);
+  const wgpu::RenderPipelineDescriptor pipelineDescriptor{
+      .layout = pipelineLayout,
+      .vertex =
+          wgpu::VertexState{
+              .module = module,
+              .entryPoint = "vs_main",
+          },
+      .primitive =
+          wgpu::PrimitiveState{
+              .topology = wgpu::PrimitiveTopology::TriangleList,
+          },
+      .multisample =
+          wgpu::MultisampleState{
+              .count = 1,
+              .mask = UINT32_MAX,
+          },
+      .fragment = &fragmentState,
+  };
+  g_CopyPipeline = g_device.CreateRenderPipeline(&pipelineDescriptor);
+}
+
+wgpu::BindGroup create_copy_bind_group(wgpu::TextureView sourceView, wgpu::Sampler sampler) {
+  const std::array bindGroupEntries{
+      wgpu::BindGroupEntry{
+          .binding = 0,
+          .sampler = sampler,
+      },
+      wgpu::BindGroupEntry{
+          .binding = 1,
+          .textureView = sourceView,
+      },
+  };
+  const wgpu::BindGroupDescriptor bindGroupDescriptor{
+      .layout = g_CopyBindGroupLayout,
+      .entryCount = bindGroupEntries.size(),
+      .entries = bindGroupEntries.data(),
+  };
+  return g_device.CreateBindGroup(&bindGroupDescriptor);
+}
+
+wgpu::BindGroup create_copy_bind_group(const TextureWithSampler& source) {
+  return create_copy_bind_group(source.view, source.sampler);
+}
+
+static wgpu::BackendType to_wgpu_backend(AuroraBackend backend) {
+  switch (backend) {
+  case BACKEND_WEBGPU:
+    return wgpu::BackendType::WebGPU;
+  case BACKEND_D3D11:
+    return wgpu::BackendType::D3D11;
+  case BACKEND_D3D12:
+    return wgpu::BackendType::D3D12;
+  case BACKEND_METAL:
+    return wgpu::BackendType::Metal;
+  case BACKEND_VULKAN:
+    return wgpu::BackendType::Vulkan;
+  case BACKEND_OPENGL:
+    return wgpu::BackendType::OpenGL;
+  case BACKEND_OPENGLES:
+    return wgpu::BackendType::OpenGLES;
+  default:
+    return wgpu::BackendType::Null;
+  }
+}
+
+static bool create_surface() {
+  SDL_Window* window = window::get_sdl_window();
+  if (window == nullptr) {
+    Log.error("Failed to create surface: no window");
+    return false;
+  }
+  const auto chainedDescriptor = utils::SetupWindowAndGetSurfaceDescriptor(window);
+  if (!chainedDescriptor) {
+    Log.error("Failed to create surface descriptor for current window");
+    return false;
+  }
+  const wgpu::SurfaceDescriptor surfaceDescriptor{
+      .nextInChain = chainedDescriptor.get(),
+      .label = "Surface",
+  };
+  release_surface();
+  g_surface = g_instance.CreateSurface(&surfaceDescriptor);
+  if (!g_surface) {
+    Log.error("Failed to create surface");
+    return false;
+  }
+  return true;
+}
+
+bool initialize(AuroraBackend auroraBackend) {
+  if (!g_instance) {
+    Log.info("Creating WebGPU instance");
+    const std::array requiredInstanceFeatures{
+        wgpu::InstanceFeatureName::TimedWaitAny,
+    };
+    wgpu::InstanceDescriptor instanceDescriptor{
+        .requiredFeatureCount = requiredInstanceFeatures.size(),
+        .requiredFeatures = requiredInstanceFeatures.data(),
+    };
+#if defined(WEBGPU_DAWN) && !defined(__MINGW32__)
+    // DawnNative.h's C++ constructor has an MSVC ABI that cannot cross into llvm-mingw, and the
+    // descriptor only restates Dawn's defaults, so use the public WebGPU descriptor here.
+    dawn::native::DawnInstanceDescriptor dawnInstanceDescriptor;
+    dawnInstanceDescriptor.backendValidationLevel = dawn::native::BackendValidationLevel::Disabled;
+    instanceDescriptor.nextInChain = &dawnInstanceDescriptor;
+#endif
+    g_instance = wgpu::CreateInstance(&instanceDescriptor);
+    if (!g_instance) {
+      Log.error("Failed to create WebGPU instance");
+      return false;
+    }
+  }
+  const wgpu::BackendType backend = to_wgpu_backend(auroraBackend);
+  Log.info("Attempting to initialize {}", magic_enum::enum_name(backend));
+  // One call is one backend attempt. aurora::initialize() retries without calling shutdown(), so a
+  // leftover adapter would pass the `if (!g_adapter)` guard and mismatch adapter with device.
+  g_queue = {};
+  g_device = {};
+  g_deviceLostReason.store(wgpu::DeviceLostReason::Unknown, std::memory_order_relaxed);
+  g_deviceLost.store(false, std::memory_order_release);
+  g_adapter = {};
+  g_backendType = wgpu::BackendType::Undefined;
+  {
+    window::SurfaceLock surfaceLock;
+    if (!create_surface()) {
+      return false;
+    }
+  }
+  {
+    const wgpu::RequestAdapterOptions options{
+        .powerPreference = wgpu::PowerPreference::HighPerformance,
+        .backendType = backend,
+        .compatibleSurface = g_surface,
+    };
+    const auto future = g_instance.RequestAdapter(
+        &options, wgpu::CallbackMode::WaitAnyOnly,
+        [](wgpu::RequestAdapterStatus status, wgpu::Adapter adapter, wgpu::StringView message) {
+          if (status == wgpu::RequestAdapterStatus::Success) {
+            g_adapter = std::move(adapter);
+          } else {
+            Log.warn("Adapter request failed: {}", message);
+          }
+        });
+    const auto status = g_instance.WaitAny(future, 5000000000);
+    if (status != wgpu::WaitStatus::Success) {
+      Log.error("Failed to create {} adapter: {}", magic_enum::enum_name(backend),
+                magic_enum::enum_name(status));
+      return false;
+    }
+    if (!g_adapter) {
+      Log.error("No {} adapter is available on this system", magic_enum::enum_name(backend));
+      return false;
+    }
+  }
+  g_adapter.GetInfo(&g_adapterInfo);
+  g_backendType = g_adapterInfo.backendType;
+  const auto backendName = magic_enum::enum_name(g_backendType);
+  auto adapterName = g_adapterInfo.device;
+  if (adapterName.IsUndefined()) {
+    adapterName = wgpu::StringView("Unknown");
+  }
+  auto description = g_adapterInfo.description;
+  if (description.IsUndefined()) {
+    description = wgpu::StringView("Unknown");
+  }
+  Log.info("Graphics adapter information\n  API: {}\n  Device: {} ({})\n  Driver: {}", backendName, adapterName,
+           magic_enum::enum_name(g_adapterInfo.adapterType), description);
+
+  uint32_t maxTextureDimension2D = 0;
+  {
+    wgpu::Limits supportedLimits{};
+    g_adapter.GetLimits(&supportedLimits);
+    maxTextureDimension2D = supportedLimits.maxTextureDimension2D;
+    const wgpu::Limits requiredLimits{
+        // Use "best" supported limits
+        .maxTextureDimension1D = supportedLimits.maxTextureDimension1D == 0 ? WGPU_LIMIT_U32_UNDEFINED
+                                                                            : supportedLimits.maxTextureDimension1D,
+        .maxTextureDimension2D = supportedLimits.maxTextureDimension2D == 0 ? WGPU_LIMIT_U32_UNDEFINED
+                                                                            : supportedLimits.maxTextureDimension2D,
+        .maxTextureDimension3D = supportedLimits.maxTextureDimension3D == 0 ? WGPU_LIMIT_U32_UNDEFINED
+                                                                            : supportedLimits.maxTextureDimension3D,
+        .maxTextureArrayLayers = supportedLimits.maxTextureArrayLayers == 0 ? WGPU_LIMIT_U32_UNDEFINED
+                                                                            : supportedLimits.maxTextureArrayLayers,
+        .maxDynamicStorageBuffersPerPipelineLayout = supportedLimits.maxDynamicStorageBuffersPerPipelineLayout == 0
+                                                         ? WGPU_LIMIT_U32_UNDEFINED
+                                                         : supportedLimits.maxDynamicStorageBuffersPerPipelineLayout,
+        .maxStorageBuffersPerShaderStage = supportedLimits.maxStorageBuffersPerShaderStage == 0
+                                               ? WGPU_LIMIT_U32_UNDEFINED
+                                               : supportedLimits.maxStorageBuffersPerShaderStage,
+        .minUniformBufferOffsetAlignment =
+            supportedLimits.minUniformBufferOffsetAlignment < 64 ? 64 : supportedLimits.minUniformBufferOffsetAlignment,
+        .minStorageBufferOffsetAlignment =
+            supportedLimits.minStorageBufferOffsetAlignment < 16 ? 16 : supportedLimits.minStorageBufferOffsetAlignment,
+    };
+    Log.info(
+        "Using limits:"
+        "\n  maxTextureDimension1D: {}"
+        "\n  maxTextureDimension2D: {}"
+        "\n  maxTextureDimension3D: {}"
+        "\n  maxTextureArrayLayers: {}"
+        "\n  maxDynamicStorageBuffersPerPipelineLayout: {}"
+        "\n  maxStorageBuffersPerShaderStage: {}"
+        "\n  minUniformBufferOffsetAlignment: {}"
+        "\n  minStorageBufferOffsetAlignment: {}",
+        requiredLimits.maxTextureDimension1D, requiredLimits.maxTextureDimension2D,
+        requiredLimits.maxTextureDimension3D, requiredLimits.maxTextureArrayLayers,
+        requiredLimits.maxDynamicStorageBuffersPerPipelineLayout, requiredLimits.maxStorageBuffersPerShaderStage,
+        requiredLimits.minUniformBufferOffsetAlignment, requiredLimits.minStorageBufferOffsetAlignment);
+    std::vector<wgpu::FeatureName> requiredFeatures;
+    bool implicitDeviceSynchronizationSupported = false;
+    wgpu::SupportedFeatures supportedFeatures;
+    g_adapter.GetFeatures(&supportedFeatures);
+    for (size_t i = 0; i < supportedFeatures.featureCount; ++i) {
+      const auto feature = supportedFeatures.features[i];
+      if (feature == wgpu::FeatureName::TextureCompressionBC) {
+        g_bcTexturesSupported = true;
+        requiredFeatures.push_back(feature);
+      }
+      // The presenter calls device and queue methods while the frame worker encodes, which Dawn only
+      // supports with this feature; without it the two race inside the device's dynamic uploader.
+      if (feature == wgpu::FeatureName::ImplicitDeviceSynchronization) {
+        implicitDeviceSynchronizationSupported = true;
+        requiredFeatures.push_back(feature);
+      }
+    }
+    if (!implicitDeviceSynchronizationSupported) {
+      Log.warn(
+          "Adapter does not support ImplicitDeviceSynchronization; multi-threaded presentation is "
+          "not safe on this device.");
+    }
+#ifdef WEBGPU_DAWN
+    wgpu::DawnCacheDeviceDescriptor cacheDescriptor({
+        .isolationKey = nullptr,
+        .loadDataFunction = load_from_cache,
+        .storeDataFunction = store_to_cache,
+        .functionUserdata = nullptr,
+    });
+
+    std::vector<const char*> enableToggles{
+    /* clang-format off */
+#if _WIN32
+      "use_dxc",
+#ifndef NDEBUG
+      "emit_hlsl_debug_symbols",
+#endif
+#endif
+#ifndef ANDROID
+      "use_user_defined_labels_in_backend",
+#endif
+      "disable_symbol_renaming",
+      "enable_immediate_error_handling",
+        /* clang-format on */
+    };
+#ifdef NDEBUG
+    enableToggles.push_back("skip_validation");
+    enableToggles.push_back("disable_robustness");
+#endif
+    if (g_backendType == wgpu::BackendType::Vulkan) {
+      enableToggles.push_back("vulkan_monolithic_pipeline_cache");
+    }
+    const wgpu::DawnTogglesDescriptor togglesDescriptor({
+        .nextInChain = &cacheDescriptor,
+        .enabledToggleCount = enableToggles.size(),
+        .enabledToggles = enableToggles.data(),
+    });
+#endif
+    wgpu::DeviceDescriptor deviceDescriptor;
+#ifdef WEBGPU_DAWN
+    deviceDescriptor.nextInChain = &togglesDescriptor;
+#endif
+    deviceDescriptor.requiredFeatureCount = requiredFeatures.size();
+    deviceDescriptor.requiredFeatures = requiredFeatures.data();
+    deviceDescriptor.requiredLimits = &requiredLimits;
+    deviceDescriptor.SetUncapturedErrorCallback(
+        [](const wgpu::Device& device, wgpu::ErrorType type, wgpu::StringView message) {
+          if (g_initialized.load(std::memory_order_acquire)) {
+            FATAL("WebGPU error {}: {}", underlying(type), message);
+          } else {
+            Log.warn("WebGPU error {}: {}", underlying(type), message);
+          }
+        });
+    deviceDescriptor.SetDeviceLostCallback(wgpu::CallbackMode::AllowSpontaneous,
+                                           [](const wgpu::Device& device, wgpu::DeviceLostReason reason,
+                                              wgpu::StringView message) {
+                                             (void)device;
+                                             // Shutdown and backend retry release the final
+                                             // device reference here too, not a real failure.
+                                             if (reason == wgpu::DeviceLostReason::Destroyed) {
+                                               return;
+                                             }
+                                             // Via string_view, so Dawn resolves a
+                                             // WGPU_STRLEN length instead of SIZE_MAX.
+                                             const std::string_view text{message};
+                                             const size_t copied =
+                                                 std::min(text.size(), g_deviceLostMessage.size() - 1);
+                                             if (copied > 0) {
+                                               std::memcpy(g_deviceLostMessage.data(), text.data(), copied);
+                                             }
+                                             g_deviceLostMessage[copied] = '\0';
+                                             g_deviceLostReason.store(reason, std::memory_order_relaxed);
+                                             g_deviceLost.store(true, std::memory_order_release);
+                                           });
+    const auto future =
+        g_adapter.RequestDevice(&deviceDescriptor, wgpu::CallbackMode::WaitAnyOnly,
+                                [](wgpu::RequestDeviceStatus status, wgpu::Device device, wgpu::StringView message) {
+                                  if (status == wgpu::RequestDeviceStatus::Success) {
+                                    g_device = std::move(device);
+                                  } else {
+                                    Log.warn("Device request failed: {}", message);
+                                  }
+                                });
+    const auto status = g_instance.WaitAny(future, 5000000000);
+    if (status != wgpu::WaitStatus::Success) {
+      Log.error("Failed to create device: {}", magic_enum::enum_name(status));
+      return false;
+    }
+    if (!g_device) {
+      return false;
+    }
+    g_device.SetLoggingCallback([](wgpu::LoggingType type, wgpu::StringView message) {
+      AuroraLogLevel level = LOG_FATAL;
+      switch (type) {
+      case wgpu::LoggingType::Verbose:
+        level = LOG_DEBUG;
+        break;
+      case wgpu::LoggingType::Info:
+        level = LOG_INFO;
+        break;
+      case wgpu::LoggingType::Warning:
+        level = LOG_WARNING;
+        break;
+      case wgpu::LoggingType::Error:
+        level = LOG_ERROR;
+        break;
+      default:
+        break;
+      }
+      Log.report(level, "WebGPU message: {}", message);
+    });
+  }
+  g_queue = g_device.GetQueue();
+
+  const wgpu::Status status = g_surface.GetCapabilities(g_adapter, &g_surfaceCapabilities);
+  if (status != wgpu::Status::Success) {
+    Log.error("Failed to get surface capabilities: {}", magic_enum::enum_name(status));
+    return false;
+  }
+  if (g_surfaceCapabilities.formatCount == 0) {
+    Log.error("Surface has no formats");
+    return false;
+  }
+  if (g_surfaceCapabilities.presentModeCount == 0) {
+    Log.error("Surface has no present modes");
+    return false;
+  }
+  auto surfaceFormat = best_surface_format();
+  auto presentMode = best_present_mode();
+  Log.info("Using surface format {}, present mode {}", magic_enum::enum_name(surfaceFormat),
+           magic_enum::enum_name(presentMode));
+  const auto size = window::get_window_size();
+  g_graphicsConfig = GraphicsConfig{
+      .surfaceConfiguration =
+          wgpu::SurfaceConfiguration{
+              .format = surfaceFormat,
+              .usage = wgpu::TextureUsage::RenderAttachment | wgpu::TextureUsage::CopySrc,
+              .width = size.native_fb_width,
+              .height = size.native_fb_height,
+              .presentMode = presentMode,
+          },
+      .depthFormat = wgpu::TextureFormat::Depth32Float,
+      .msaaSamples = g_config.msaa,
+      .textureAnisotropy = g_config.maxTextureAnisotropy,
+      .maxTextureDimension2D = maxTextureDimension2D,
+  };
+  create_copy_pipeline();
+  {
+    window::SurfaceLock surfaceLock;
+    resize_swapchain(size.fb_width, size.fb_height, size.native_fb_width, size.native_fb_height, true);
+  }
+  g_initialized.store(true, std::memory_order_release);
+  return true;
+}
+
+void fail_if_device_lost() noexcept {
+  if (!g_deviceLost.load(std::memory_order_acquire)) {
+    return;
+  }
+
+  // Several frame-owning threads can observe loss, so serialize escalation: one thread logs and the
+  // rest wait for termination instead of submitting more work to a lost device.
+  static std::mutex fatalMutex;
+  const std::lock_guard lock(fatalMutex);
+  const auto reason = g_deviceLostReason.load(std::memory_order_relaxed);
+  const char* const detail = g_deviceLostMessage.data();
+  if (detail[0] != '\0') {
+    Log.fatal("WebGPU device was lost ({}: {}). Rendering cannot continue safely; restart the application.",
+              magic_enum::enum_name(reason), detail);
+  } else {
+    Log.fatal("WebGPU device was lost ({}). Rendering cannot continue safely; restart the application.",
+              magic_enum::enum_name(reason));
+  }
+}
+
+void serialize_pipeline_caches() noexcept {
+#if defined(WEBGPU_DAWN) && defined(_WIN32)
+  if (!g_device || g_backendType != wgpu::BackendType::Vulkan) {
+    return;
+  }
+  using PerformIdleTasksFn = void(*)(const wgpu::Device*);
+  static const auto performIdleTasks = []() -> PerformIdleTasksFn {
+    const HMODULE dawnModule = GetModuleHandleW(L"webgpu_dawn.dll");
+    if (dawnModule == nullptr) {
+      return nullptr;
+    }
+    return reinterpret_cast<PerformIdleTasksFn>(reinterpret_cast<void*>(
+        GetProcAddress(dawnModule, "?PerformIdleTasks@native@dawn@@YAXAEBVDevice@wgpu@@@Z")));
+  }();
+  if (performIdleTasks != nullptr) {
+    performIdleTasks(&g_device);
+  }
+#endif
+}
+
+void shutdown() {
+  serialize_pipeline_caches();
+  g_initialized.store(false, std::memory_order_release);
+  g_CopyBindGroupLayout = {};
+  g_CopyPipeline = {};
+  g_CopyBindGroup = {};
+  g_frameBuffer = {};
+  g_frameBufferResolved = {};
+  g_depthBuffer = {};
+  g_queue = {};
+  g_surface = {};
+  g_device = {};
+  g_adapter = {};
+  g_instance = {};
+
+  cache_shutdown();
+}
+
+void release_surface() noexcept {
+  const bool hadSurface = static_cast<bool>(g_surface);
+  if (g_surface) {
+    g_surface.Unconfigure();
+  }
+  g_surface = {};
+  if (hadSurface && g_instance && g_device && g_queue) {
+    const auto future = g_queue.OnSubmittedWorkDone(
+        wgpu::CallbackMode::WaitAnyOnly, [](wgpu::QueueWorkDoneStatus, wgpu::StringView) {});
+    g_instance.WaitAny(future, 1000000000);
+  }
+}
+
+bool refresh_surface(bool recreate) {
+  if (!g_instance || !g_device) {
+    return false;
+  }
+  if (!window::is_presentable()) {
+    release_surface();
+    return false;
+  }
+  if ((!g_surface || recreate) && !create_surface()) {
+    return false;
+  }
+  uint32_t width = g_graphicsConfig.surfaceConfiguration.width;
+  uint32_t height = g_graphicsConfig.surfaceConfiguration.height;
+  uint32_t native_width = width;
+  uint32_t native_height = height;
+  if (window::get_sdl_window() != nullptr) {
+    const auto size = window::get_window_size();
+    width = size.fb_width;
+    height = size.fb_height;
+    native_width = size.native_fb_width;
+    native_height = size.native_fb_height;
+  }
+  if (width != 0 && height != 0) {
+    resize_swapchain(width, height, native_width, native_height, true);
+  }
+  return true;
+}
+
+void resize_swapchain(uint32_t width, uint32_t height, uint32_t native_width, uint32_t native_height, bool force) {
+  if (!g_surface || !g_device || width == 0 || height == 0 || native_height == 0 || native_width == 0) {
+    return;
+  }
+
+  uint32_t render_width = width;
+  uint32_t render_height = height;
+  const auto [efbWidth, efbHeight] = vi::configured_fb_size();
+  if (efbWidth != 0 && efbHeight != 0) {
+    render_width = std::max(render_width, efbWidth);
+    render_height = std::max(render_height, efbHeight);
+  }
+
+  const auto requestedRenderSize = RenderTargetSize{render_width, render_height};
+  const auto clampedRenderSize = clamp_frame_buffer_size(render_width, render_height);
+  render_width = clampedRenderSize.width;
+  render_height = clampedRenderSize.height;
+  if (requestedRenderSize.width != render_width || requestedRenderSize.height != render_height) {
+    Log.warn(
+        "Render target {}x{} exceeds the safe framebuffer budget (adapter max {}, practical max {} / {} "
+        "pixels); clamping to {}x{}",
+        requestedRenderSize.width, requestedRenderSize.height, g_graphicsConfig.maxTextureDimension2D,
+        render_size_limits::kMaxFramebufferDimension, render_size_limits::kMaxFramebufferPixels, render_width,
+        render_height);
+  }
+
+  const bool sizeChanged = g_graphicsConfig.surfaceConfiguration.width != native_width ||
+                           g_graphicsConfig.surfaceConfiguration.height != native_height ||
+                           g_frameBuffer.size.width != render_width || g_frameBuffer.size.height != render_height;
+  if (!force && !sizeChanged) {
+    return;
+  }
+  if (sizeChanged) {
+    gx::clear_display_copy_cache();
+    gfx::clear_caches();
+    clear_present_source_override();
+  }
+  g_graphicsConfig.surfaceConfiguration.width = native_width;
+  g_graphicsConfig.surfaceConfiguration.height = native_height;
+  auto surfaceConfiguration = g_graphicsConfig.surfaceConfiguration;
+  surfaceConfiguration.device = g_device;
+  g_surface.Configure(&surfaceConfiguration);
+  if (!sizeChanged) {
+    // Forced reconfigure at an unchanged size (present-mode change or recreated surface). The
+    // offscreen targets are not swapchain images, so reallocating them would only stall the frame.
+    return;
+  }
+  g_frameBuffer = create_render_texture(render_width, render_height, true);
+  g_frameBufferResolved = create_render_texture(render_width, render_height, false);
+  g_depthBuffer = create_depth_texture(render_width, render_height);
+  g_CopyBindGroup = create_copy_bind_group(present_source());
+}
+} // namespace aurora::webgpu
diff --git a/aurora-main/lib/webgpu/gpu.hpp b/aurora-main/lib/webgpu/gpu.hpp
new file mode 100644
index 0000000..7b96e95
--- /dev/null
+++ b/aurora-main/lib/webgpu/gpu.hpp
@@ -0,0 +1,100 @@
+#pragma once
+
+#include <aurora/aurora.h>
+#include <aurora/math.hpp>
+
+#include "wgpu.hpp"
+
+#include <array>
+#include <cstdint>
+
+struct SDL_Window;
+
+namespace aurora::webgpu {
+struct GraphicsConfig {
+  wgpu::SurfaceConfiguration surfaceConfiguration;
+  wgpu::TextureFormat depthFormat;
+  uint32_t msaaSamples;
+  uint16_t textureAnisotropy;
+  uint32_t maxTextureDimension2D;
+};
+struct TextureWithSampler {
+  wgpu::Texture texture;
+  wgpu::TextureView view;
+  wgpu::Extent3D size;
+  wgpu::TextureFormat format;
+  wgpu::Sampler sampler;
+};
+struct PresentSource {
+  wgpu::BindGroup bindGroup;
+  wgpu::Texture texture;
+  wgpu::Extent3D size;
+  wgpu::TextureFormat format;
+};
+struct Viewport {
+  float left;
+  float top;
+  float width;
+  float height;
+  float znear;
+  float zfar;
+
+  bool operator==(const Viewport& rhs) const {
+    return left == rhs.left && top == rhs.top && width == rhs.width && height == rhs.height && znear == rhs.znear &&
+           zfar == rhs.zfar;
+  }
+  bool operator!=(const Viewport& rhs) const { return !(*this == rhs); }
+};
+
+extern wgpu::Device g_device;
+extern wgpu::Queue g_queue;
+extern wgpu::Surface g_surface;
+extern wgpu::BackendType g_backendType;
+extern GraphicsConfig g_graphicsConfig;
+extern TextureWithSampler g_frameBuffer;
+extern TextureWithSampler g_frameBufferResolved;
+extern TextureWithSampler g_depthBuffer;
+extern wgpu::RenderPipeline g_CopyPipeline;
+extern wgpu::BindGroup g_CopyBindGroup;
+extern wgpu::Instance g_instance;
+extern bool g_bcTexturesSupported;
+
+bool initialize(AuroraBackend backend);
+void shutdown();
+// Device-loss callbacks may run on a Dawn-managed thread and only publish loss state; frame
+// threads call this at ordered boundaries to turn it into the one user-visible fatal error.
+void fail_if_device_lost() noexcept;
+void release_surface() noexcept;
+bool refresh_surface(bool recreate = true);
+void resize_swapchain(uint32_t width, uint32_t height, uint32_t native_width, uint32_t native_height,
+                      bool force = false);
+TextureWithSampler create_render_texture(uint32_t width, uint32_t height, bool multisampled);
+const TextureWithSampler& present_source() noexcept;
+PresentSource current_present_source() noexcept;
+void set_present_source_override(wgpu::BindGroup bindGroup, wgpu::Texture texture, wgpu::Extent3D size,
+                                 wgpu::TextureFormat format) noexcept;
+void clear_present_source_override() noexcept;
+wgpu::BindGroup create_copy_bind_group(const TextureWithSampler& source);
+wgpu::BindGroup create_copy_bind_group(wgpu::TextureView sourceView, wgpu::Sampler sampler);
+Viewport calculate_present_viewport(uint32_t surface_width, uint32_t surface_height, uint32_t content_width,
+                                    uint32_t content_height) noexcept;
+Viewport calculate_present_viewport_for_aspect(uint32_t surface_width, uint32_t surface_height,
+                                               float content_aspect) noexcept;
+void draw_clear(const wgpu::RenderPassEncoder& pass, bool clearColor, bool clearAlpha, bool clearDepth,
+                const Vec4<float>& clearColorValue, float clearDepthValue);
+
+size_t load_from_cache(void const* key, size_t keySize, void* value, size_t valueSize, void* userdata);
+void store_to_cache(void const* key, size_t keySize, void const* value, size_t valueSize, void* userdata);
+void cache_shutdown();
+
+struct BlobCacheStats {
+  uint64_t lookups;
+  uint64_t hits;
+  uint64_t stores;
+  uint64_t hitBytes;
+};
+BlobCacheStats blob_cache_stats() noexcept;
+// Persists the monolithic Vulkan pipeline cache into the blob cache (no-op elsewhere).
+void serialize_pipeline_caches() noexcept;
+
+} // namespace aurora::webgpu
diff --git a/aurora-main/lib/webgpu/gpu_cache.cpp b/aurora-main/lib/webgpu/gpu_cache.cpp
new file mode 100644
index 0000000..b2a477b
--- /dev/null
+++ b/aurora-main/lib/webgpu/gpu_cache.cpp
@@ -0,0 +1,422 @@
+#include <atomic>
+#include <cstring>
+#include <ctime>
+#include <mutex>
+#include <string>
+#include <filesystem>
+#include <vector>
+
+#include "../fs_helper.hpp"
+#include "../internal.hpp"
+#include "../sqlite_utils.hpp"
+#include "gpu.hpp"
+
+#include <sqlite3.h>
+#include <fmt/format.h>
+#if defined(AURORA_CACHE_USE_ZSTD)
+#include <zstd.h>
+#endif
+#define XXH_STATIC_LINKING_ONLY
+#include <xxhash.h>
+
+namespace aurora::webgpu {
+static Module Log("aurora::gpu::cache");
+
+static sqlite3* db;
+static sqlite3_stmt* load_stmt;
+static sqlite3_stmt* store_stmt;
+static sqlite3_stmt* touch_stmt;
+static bool cache_broken;
+static std::mutex cache_mutex;
+#if defined(AURORA_CACHE_USE_ZSTD)
+static std::vector<uint8_t> compress_buffer;
+#endif
+
+// Schema 3 added last_used (whole days since the Unix epoch) so stale blobs can be
+// pruned: config-version bumps and driver updates change every Dawn cache key, and
+// without an age column the orphaned rows accumulate forever (observed 1.6 GB).
+// Schema 4 is a content reset for the vulkan_monolithic_pipeline_cache switch, which
+// obsoletes every per-pipeline blob at once.
+constexpr int CACHE_SCHEMA = 4;
+constexpr int64_t PruneAfterDays = 30;
+// Rows whose last_used lags today are collected in memory and written in one batch at
+// shutdown: the load path sits inside a read transaction that is always rolled back,
+// and day granularity makes anything more eager pointless.
+
+static std::atomic<uint64_t> g_lookups{0};
+static std::atomic<uint64_t> g_hits{0};
+static std::atomic<uint64_t> g_stores{0};
+static std::atomic<uint64_t> g_hitBytes{0};
+static std::vector<XXH128_hash_t> g_pendingTouches;
+
+static int64_t days_now() { return static_cast<int64_t>(std::time(nullptr) / 86400); }
+
+static void init_abort() {
+  cache_broken = true;
+  sqlite3_close(db);
+  db = nullptr;
+}
+
+static int check(int ret) {
+  if (ret != SQLITE_OK) {
+    Log.error("SQLite operation failed: {}", sqlite3_errmsg(db));
+  }
+
+  return ret;
+}
+
+enum class SchemaState { Match, Mismatch, Error };
+
+static SchemaState check_schema() {
+  auto ret = sqlite::exec(db, "CREATE TABLE IF NOT EXISTS aurora_schema(value INTEGER);");
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to create schema table: {}", sqlite3_errmsg(db));
+    return SchemaState::Error;
+  }
+
+  bool match = false;
+  const auto cmd = fmt::format("SELECT * FROM aurora_schema WHERE value = {}", CACHE_SCHEMA);
+  ret = sqlite::exec(db, cmd.c_str(), [&match](int, char**, char**) { match = true; }, nullptr);
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to check schema table: {}", sqlite3_errmsg(db));
+    return SchemaState::Error;
+  }
+  return match ? SchemaState::Match : SchemaState::Mismatch;
+}
+
+static bool create_schema() {
+  sqlite::Transaction tx(db, Log, true);
+  if (!tx) {
+    Log.error("Failed to open schema transaction: {}", sqlite3_errmsg(db));
+    return false;
+  }
+  const auto cmd = fmt::format(
+      R"(CREATE TABLE IF NOT EXISTS aurora_schema(value INTEGER);
+DROP TABLE IF EXISTS cache;
+CREATE TABLE cache (
+  key BLOB PRIMARY KEY NOT NULL,
+  value BLOB NOT NULL,
+  size INTEGER NOT NULL,
+  compressed INTEGER NOT NULL,
+  last_used INTEGER NOT NULL DEFAULT 0
+);
+DELETE FROM aurora_schema;
+INSERT INTO aurora_schema VALUES ({});)",
+      CACHE_SCHEMA);
+  const auto ret = sqlite::exec(db, cmd.c_str());
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to create schema: {}", sqlite3_errmsg(db));
+    return false;
+  }
+  tx.commit();
+  return true;
+}
+
+static void prune_stale_rows() {
+  const auto cmd = fmt::format("DELETE FROM cache WHERE last_used < {}", days_now() - PruneAfterDays);
+  auto ret = sqlite::exec(db, cmd.c_str());
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to prune stale cache rows: {}", sqlite3_errmsg(db));
+    return;
+  }
+  const auto pruned = sqlite3_changes(db);
+  if (pruned > 0) {
+    Log.info("Pruned {} stale Dawn cache blobs (unused for {}+ days)", pruned, PruneAfterDays);
+  }
+  // Freed pages are only reused, never returned to the filesystem, so compact when a
+  // meaningful amount was dropped. Blobs run hundreds of KB each, making even a few
+  // hundred rows a noticeable slice of the file.
+  if (pruned > 256) {
+    ret = sqlite::exec(db, "VACUUM;");
+    if (ret != SQLITE_OK) {
+      Log.warn("Failed to vacuum Dawn cache after pruning: {}", sqlite3_errmsg(db));
+    }
+  }
+}
+
+static bool cache_init_core() {
+  Log.debug("SQLite version {}", sqlite3_libversion());
+
+  const auto path = std::filesystem::path{reinterpret_cast<const char8_t*>(g_config.cachePath)} / "dawn_cache.db";
+  std::string file = fs_path_to_string(path);
+  Log.debug("Using dawn cache at {}", file);
+  auto ret = sqlite3_open(file.c_str(), &db);
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to open database: {}", sqlite3_errmsg(db));
+    return false;
+  }
+
+  // WAL mode + NORMAL = no need for disk syncs, consistent but not durable is fine.
+  ret = sqlite::exec(db, "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL;");
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to set pragmas: {}", sqlite3_errmsg(db));
+    return false;
+  }
+
+  switch (check_schema()) {
+  case SchemaState::Match:
+    prune_stale_rows();
+    break;
+  case SchemaState::Mismatch: {
+    // Dropping the table would leave the freed pages inside the file, so a schema
+    // change deletes the database outright; pre-schema-3 files had grown unbounded.
+    Log.info("Dawn cache schema changed; recreating '{}'", file);
+    sqlite3_close(db);
+    db = nullptr;
+    std::error_code ec;
+    std::filesystem::remove(path, ec);
+    std::filesystem::remove(std::filesystem::path{file + "-wal"}, ec);
+    std::filesystem::remove(std::filesystem::path{file + "-shm"}, ec);
+    ret = sqlite3_open(file.c_str(), &db);
+    if (ret != SQLITE_OK) {
+      Log.error("Failed to recreate database: {}", sqlite3_errmsg(db));
+      return false;
+    }
+    ret = sqlite::exec(db, "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL;");
+    if (ret != SQLITE_OK) {
+      Log.error("Failed to set pragmas: {}", sqlite3_errmsg(db));
+      return false;
+    }
+    if (!create_schema()) {
+      return false;
+    }
+    break;
+  }
+  case SchemaState::Error:
+    return false;
+  }
+
+  ret = sqlite3_prepare_v3(db, "SELECT value, size, compressed, last_used FROM cache WHERE key = ?", -1,
+                           SQLITE_PREPARE_PERSISTENT, &load_stmt, nullptr);
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to prepare statement: {}", sqlite3_errmsg(db));
+    return false;
+  }
+
+  ret = sqlite3_prepare_v3(db, "REPLACE INTO cache (key, value, size, compressed, last_used) VALUES (?, ?, ?, ?, ?)",
+                           -1, SQLITE_PREPARE_PERSISTENT, &store_stmt, nullptr);
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to prepare statement: {}", sqlite3_errmsg(db));
+    return false;
+  }
+
+  ret = sqlite3_prepare_v3(db, "UPDATE cache SET last_used = ? WHERE key = ?", -1, SQLITE_PREPARE_PERSISTENT,
+                           &touch_stmt, nullptr);
+  if (ret != SQLITE_OK) {
+    Log.error("Failed to prepare statement: {}", sqlite3_errmsg(db));
+    return false;
+  }
+
+  return true;
+}
+
+// Caller holds cache_mutex. Writes the queued last_used refreshes in one transaction.
+static void flush_touches() {
+  if (g_pendingTouches.empty() || db == nullptr || touch_stmt == nullptr) {
+    return;
+  }
+
+  sqlite::Transaction tx(db, Log, true);
+  if (!tx) {
+    Log.error("Failed to open touch transaction");
+    g_pendingTouches.clear();
+    return;
+  }
+  const auto today = days_now();
+  for (const auto& keyHash : g_pendingTouches) {
+    check(sqlite3_bind_int64(touch_stmt, 1, today));
+    check(sqlite3_bind_blob(touch_stmt, 2, &keyHash, sizeof(keyHash), SQLITE_TRANSIENT));
+    if (sqlite3_step(touch_stmt) != SQLITE_DONE) {
+      Log.error("Failed to refresh cache row age: {}", sqlite3_errmsg(db));
+    }
+    check(sqlite3_reset(touch_stmt));
+  }
+  g_pendingTouches.clear();
+  tx.commit();
+}
+
+static bool cache_init() {
+  if (cache_broken) {
+    return false;
+  }
+
+  if (db) {
+    return true;
+  }
+
+  if (!cache_init_core()) {
+    Log.error("SQLite DB init failed");
+    init_abort();
+    return false;
+  }
+
+  Log.debug("SQLite cache init succeeded");
+
+  return true;
+}
+
+size_t load_from_cache(void const* key, size_t keySize, void* value, size_t valueSize, void*) {
+  std::lock_guard lock(cache_mutex);
+
+  if (!cache_init()) {
+    return 0;
+  }
+
+  sqlite::Transaction tx(db, Log);
+  if (!tx) {
+    Log.error("Failed to open load transaction");
+    return 0;
+  }
+
+  // Dawn probes with value == nullptr for the size first, then fetches; count each
+  // probe as one logical lookup so the hit rate reads per-entry.
+  if (value == nullptr) {
+    g_lookups.fetch_add(1, std::memory_order_relaxed);
+  }
+
+  const auto keyHash = XXH128(key, keySize, 0);
+  check(sqlite3_bind_blob(load_stmt, 1, &keyHash, sizeof(keyHash), SQLITE_TRANSIENT));
+
+  const auto ret = sqlite3_step(load_stmt);
+  size_t foundSize;
+  if (ret == SQLITE_ROW) {
+    // Hit
+    const auto foundPtr = sqlite3_column_blob(load_stmt, 0);
+    foundSize = sqlite3_column_int64(load_stmt, 1);
+    const bool compressed = sqlite3_column_int(load_stmt, 2) != 0;
+    if (value == nullptr) {
+      g_hits.fetch_add(1, std::memory_order_relaxed);
+    } else {
+      g_hitBytes.fetch_add(static_cast<uint64_t>(foundSize), std::memory_order_relaxed);
+    }
+    if (sqlite3_column_int64(load_stmt, 3) != days_now()) {
+      g_pendingTouches.push_back(keyHash);
+    }
+
+    if (value && valueSize == foundSize) {
+      if (compressed) {
+#if defined(AURORA_CACHE_USE_ZSTD)
+        const auto compSize = sqlite3_column_bytes(load_stmt, 0);
+        const auto zstdRet = ZSTD_decompress(value, valueSize, foundPtr, compSize);
+        if (ZSTD_isError(zstdRet)) {
+          Log.error("zstd decompression error: {}", ZSTD_getErrorName(zstdRet));
+          foundSize = 0;
+        } else if (zstdRet != foundSize) {
+          Log.error("zstd decompression size mismatch: expected {}, got {}", foundSize, zstdRet);
+          foundSize = 0;
+        }
+#else
+        Log.error("Cache entry is zstd-compressed but zstd support is disabled");
+        foundSize = 0;
+#endif
+      } else {
+        if (foundSize != 0 && !foundPtr) {
+          Log.error("Cache entry is missing raw value data");
+          foundSize = 0;
+        } else if (foundSize != 0) {
+          std::memcpy(value, foundPtr, foundSize);
+        }
+      }
+    }
+  } else if (ret == SQLITE_DONE) {
+    // Miss
+    foundSize = 0;
+  } else {
+    Log.error("Looking up cache key failed: {}", sqlite3_errmsg(db));
+    return 0;
+  }
+
+  check(sqlite3_reset(load_stmt));
+
+  return foundSize;
+}
+
+void store_to_cache(void const* key, size_t keySize, void const* value, size_t valueSize, void*) {
+  std::lock_guard lock(cache_mutex);
+
+  if (!cache_init()) {
+    return;
+  }
+
+  sqlite::Transaction tx(db, Log, true);
+  if (!tx) {
+    Log.error("Failed to open store transaction");
+    return;
+  }
+
+  const void* storedValue = value;
+  sqlite3_uint64 storedValueSize = valueSize;
+  int compressed = 0;
+#if defined(AURORA_CACHE_USE_ZSTD)
+  const auto bound = ZSTD_compressBound(valueSize);
+  if (ZSTD_isError(bound)) {
+    Log.error("Failed to calculate ZSTD_compressBound: {}", ZSTD_getErrorName(bound));
+    return;
+  }
+
+  if (compress_buffer.size() < bound) {
+    compress_buffer.resize(bound);
+  }
+
+  const auto compressRet = ZSTD_compress(compress_buffer.data(), compress_buffer.size(), value, valueSize, 0);
+  if (ZSTD_isError(compressRet)) {
+    Log.error("ZSTD compression error: {}", ZSTD_getErrorName(compressRet));
+    return;
+  }
+
+  if (compressRet < valueSize) {
+    storedValue = compress_buffer.data();
+    storedValueSize = compressRet;
+    compressed = 1;
+  }
+#endif
+
+  const auto keyHash = XXH128(key, keySize, 0);
+  check(sqlite3_bind_blob64(store_stmt, 1, &keyHash, sizeof(keyHash), SQLITE_TRANSIENT));
+  check(
+      sqlite3_bind_blob64(store_stmt, 2, storedValue, storedValueSize, compressed ? SQLITE_STATIC : SQLITE_TRANSIENT));
+  check(sqlite3_bind_int64(store_stmt, 3, static_cast<sqlite3_int64>(valueSize)));
+  check(sqlite3_bind_int(store_stmt, 4, compressed));
+  check(sqlite3_bind_int64(store_stmt, 5, days_now()));
+  g_stores.fetch_add(1, std::memory_order_relaxed);
+
+  const auto ret = sqlite3_step(store_stmt);
+  if (ret != SQLITE_DONE) {
+    // Error or something
+    Log.error("Failed to insert row: {}", sqlite3_errmsg(db));
+    return;
+  }
+
+  check(sqlite3_reset(store_stmt));
+  check(sqlite3_bind_null(store_stmt, 2));
+  check(sqlite3_bind_null(store_stmt, 4));
+
+  tx.commit();
+}
+
+void cache_shutdown() {
+  std::lock_guard lock(cache_mutex);
+#if defined(AURORA_CACHE_USE_ZSTD)
+  compress_buffer.clear();
+#endif
+  flush_touches();
+  check(sqlite3_finalize(load_stmt));
+  check(sqlite3_finalize(store_stmt));
+  check(sqlite3_finalize(touch_stmt));
+  load_stmt = nullptr;
+  store_stmt = nullptr;
+  touch_stmt = nullptr;
+  check(sqlite3_close(db));
+  db = nullptr;
+}
+
+BlobCacheStats blob_cache_stats() noexcept {
+  return BlobCacheStats{
+      .lookups = g_lookups.load(std::memory_order_relaxed),
+      .hits = g_hits.load(std::memory_order_relaxed),
+      .stores = g_stores.load(std::memory_order_relaxed),
+      .hitBytes = g_hitBytes.load(std::memory_order_relaxed),
+  };
+}
+
+} // namespace aurora::webgpu
diff --git a/aurora-main/lib/webgpu/wgpu.hpp b/aurora-main/lib/webgpu/wgpu.hpp
new file mode 100644
index 0000000..ba7ebea
--- /dev/null
+++ b/aurora-main/lib/webgpu/wgpu.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include <webgpu/webgpu_cpp.h>
+
+#include <string_view>
+
+static inline bool operator==(const wgpu::Extent3D& lhs, const wgpu::Extent3D& rhs) {
+  return lhs.width == rhs.width && lhs.height == rhs.height && lhs.depthOrArrayLayers == rhs.depthOrArrayLayers;
+}
+static inline bool operator!=(const wgpu::Extent3D& lhs, const wgpu::Extent3D& rhs) { return !(lhs == rhs); }
+
+namespace wgpu {
+inline std::string_view format_as(wgpu::StringView str) { return str; }
+} // namespace wgpu
diff --git a/aurora-main/lib/window.cpp b/aurora-main/lib/window.cpp
new file mode 100644
index 0000000..37d64be
--- /dev/null
+++ b/aurora-main/lib/window.cpp
@@ -0,0 +1,809 @@
+#include "window.hpp"
+
+#ifdef AURORA_ENABLE_GX
+#include "imgui.hpp"
+#include "webgpu/gpu.hpp"
+#endif
+#include "input.hpp"
+#include "internal.hpp"
+
+#include <aurora/aurora.h>
+#include <aurora/event.h>
+#include <aurora/gfx.h>
+#include <aurora/render_size_limits.hpp>
+#include <SDL3/SDL_error.h>
+#include <SDL3/SDL_events.h>
+#include <SDL3/SDL_keyboard.h>
+#include <SDL3/SDL_properties.h>
+#include <SDL3/SDL_render.h>
+#include <SDL3/SDL_surface.h>
+#include <SDL3/SDL_video.h>
+#include <SDL3/SDL_init.h>
+#include <SDL3/SDL_hints.h>
+#include <SDL3/SDL_stdinc.h>
+#include <SDL3/SDL_pixels.h>
+#if defined(_WIN32)
+#include <windows.h>
+#endif
+
+#if defined(SDL_PLATFORM_ANDROID)
+#include <jni.h>
+extern "C" void Android_LockActivityMutex(void);
+extern "C" void Android_UnlockActivityMutex(void);
+#endif
+
+#include <algorithm>
+#include <atomic>
+#include <vector>
+
+#include "dolphin/vi/vi_internal.hpp"
+
+namespace aurora::window {
+namespace {
+Module Log("aurora::window");
+
+SDL_Window* g_window;
+SDL_Renderer* g_renderer;
+float g_frameBufferScale = 0.f;
+bool g_frameBufferAspectFit = true;
+bool g_presentSurfaceFill = false;
+int g_presentAspectWidth = 0;
+int g_presentAspectHeight = 0;
+AuroraWindowSize g_windowSize;
+std::vector<AuroraEvent> g_events;
+std::atomic_bool g_backgrounded = false;
+std::atomic_bool g_nativeResizePending = false;
+std::atomic<AuroraDisplayMode> g_displayMode{AURORA_DISPLAY_MODE_WINDOWED};
+#if defined(SDL_PLATFORM_ANDROID)
+std::atomic_bool g_surfaceReady = false;
+#else
+std::atomic_bool g_surfaceReady = true;
+#endif
+bool g_lastPaused = false;
+bool g_gotFocus = false;
+#if defined(_WIN32)
+WNDPROC g_prevWindowProc = nullptr;
+// Native window handle captured once when the hook is installed. The presenter checks the native
+// size several times per slot, which used to be an SDL lookup for a handle that never changes.
+HWND g_nativeWindowHandle = nullptr;
+// Packed native client size ((width << 32) | height) kept by the window procedure; zero means
+// unknown. Atomic because that procedure runs on the SDL thread while the presenter reads it.
+std::atomic<uint64_t> g_nativeClientSize{0};
+
+constexpr uint64_t pack_native_size(uint32_t width, uint32_t height) noexcept {
+  return (static_cast<uint64_t>(width) << 32) | static_cast<uint64_t>(height);
+}
+
+LRESULT CALLBACK aurora_window_proc(HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) {
+  bool sizeChanged = msg == WM_SIZE;
+  if (msg == WM_WINDOWPOSCHANGED) {
+    const auto* pos = reinterpret_cast<const WINDOWPOS*>(lparam);
+    sizeChanged = pos != nullptr && (pos->flags & SWP_NOSIZE) == 0;
+  }
+  if (sizeChanged) {
+    g_nativeResizePending.store(true, std::memory_order_release);
+    if (msg == WM_SIZE) {
+      // WM_SIZE carries the new client size directly.
+      g_nativeClientSize.store(pack_native_size(static_cast<uint32_t>(LOWORD(lparam)),
+                                                static_cast<uint32_t>(HIWORD(lparam))),
+                               std::memory_order_release);
+    } else {
+      // WM_WINDOWPOSCHANGED carries no client size. Invalidate before forwarding: DefWindowProc turns
+      // it into a nested WM_SIZE through this procedure, which refills the cache authoritatively.
+      g_nativeClientSize.store(0, std::memory_order_release);
+    }
+  }
+  if (g_prevWindowProc == nullptr) {
+    return DefWindowProc(hwnd, msg, wparam, lparam);
+  }
+  return CallWindowProc(g_prevWindowProc, hwnd, msg, wparam, lparam);
+}
+
+void install_window_proc_hook() noexcept {
+  const auto props = SDL_GetWindowProperties(g_window);
+  auto* hwnd = static_cast<HWND>(SDL_GetPointerProperty(props, SDL_PROP_WINDOW_WIN32_HWND_POINTER, nullptr));
+  if (hwnd == nullptr) {
+    return;
+  }
+  g_nativeWindowHandle = hwnd;
+  g_nativeClientSize.store(0, std::memory_order_release);
+  g_prevWindowProc = reinterpret_cast<WNDPROC>(SetWindowLongPtr(hwnd, GWLP_WNDPROC,
+                                                                reinterpret_cast<LONG_PTR>(aurora_window_proc)));
+}
+
+void uninstall_window_proc_hook() noexcept {
+  if (g_window == nullptr || g_prevWindowProc == nullptr) {
+    g_nativeWindowHandle = nullptr;
+    g_nativeClientSize.store(0, std::memory_order_release);
+    return;
+  }
+  const auto props = SDL_GetWindowProperties(g_window);
+  auto* hwnd = static_cast<HWND>(SDL_GetPointerProperty(props, SDL_PROP_WINDOW_WIN32_HWND_POINTER, nullptr));
+  if (hwnd != nullptr) {
+    SetWindowLongPtr(hwnd, GWLP_WNDPROC, reinterpret_cast<LONG_PTR>(g_prevWindowProc));
+  }
+  g_prevWindowProc = nullptr;
+  g_nativeWindowHandle = nullptr;
+  g_nativeClientSize.store(0, std::memory_order_release);
+}
+#endif
+
+// Native client size of the window without going through SDL. Returns false when the platform has
+// no cheap native query, in which case callers fall back to get_window_size().
+bool query_native_client_size(uint32_t& width, uint32_t& height) noexcept {
+#if defined(_WIN32)
+  const uint64_t cached = g_nativeClientSize.load(std::memory_order_acquire);
+  if (cached != 0) {
+    width = static_cast<uint32_t>(cached >> 32);
+    height = static_cast<uint32_t>(cached & 0xffffffffull);
+    return true;
+  }
+  if (g_nativeWindowHandle != nullptr) {
+    RECT client{};
+    if (GetClientRect(g_nativeWindowHandle, &client) != 0) {
+      width = static_cast<uint32_t>(std::max<LONG>(client.right - client.left, 0));
+      height = static_cast<uint32_t>(std::max<LONG>(client.bottom - client.top, 0));
+      if (width != 0 && height != 0) {
+        g_nativeClientSize.store(pack_native_size(width, height), std::memory_order_release);
+      }
+      return true;
+    }
+  }
+#else
+  (void)width;
+  (void)height;
+#endif
+  return false;
+}
+
+bool operator==(const AuroraWindowSize& lhs, const AuroraWindowSize& rhs) {
+  return lhs.width == rhs.width && lhs.height == rhs.height && lhs.fb_width == rhs.fb_width &&
+         lhs.fb_height == rhs.fb_height && lhs.native_fb_height == rhs.native_fb_height &&
+         lhs.native_fb_width == rhs.native_fb_width && lhs.scale == rhs.scale;
+}
+
+Vec2<int> scale_frame_buffer_to_aspect(int w, int h, float scale, float aspect) {
+  if (w <= 0 || h <= 0) {
+    return {std::max(w, 1), std::max(h, 1)};
+  }
+  const auto size = render_size_limits::scale_framebuffer_to_aspect(
+      static_cast<uint32_t>(w), static_cast<uint32_t>(h), scale, aspect);
+  return {static_cast<int>(size.width), static_cast<int>(size.height)};
+}
+
+void resize_swapchain() noexcept {
+#if defined(SDL_PLATFORM_ANDROID)
+  SurfaceLock surfaceLock;
+#endif
+  // Consume only requests that preceded this synchronization; a native resize arriving mid-rebuild
+  // stays flagged for the next ordered frame boundary.
+  g_nativeResizePending.exchange(false, std::memory_order_acq_rel);
+  const auto size = get_window_size();
+  if (size == g_windowSize) {
+    return;
+  }
+  if (size.scale != g_windowSize.scale) {
+    if (g_windowSize.scale > 0.f) {
+      Log.info("Display scale changed to {}", size.scale);
+    }
+  }
+  g_windowSize = size;
+  if (g_renderer != nullptr) {
+    SDL_SetRenderLogicalPresentation(g_renderer, static_cast<int>(size.native_fb_width),
+                                     static_cast<int>(size.native_fb_height), SDL_LOGICAL_PRESENTATION_DISABLED);
+    SDL_SetRenderScale(g_renderer, size.scale, size.scale);
+  }
+#ifdef AURORA_ENABLE_GX
+  webgpu::resize_swapchain(size.fb_width, size.fb_height, size.native_fb_width, size.native_fb_height);
+#endif
+}
+
+void set_window_icon() noexcept {
+  if (g_config.iconRGBA8 == nullptr) {
+    return;
+  }
+  auto* iconSurface =
+      SDL_CreateSurfaceFrom(static_cast<int>(g_config.iconWidth), static_cast<int>(g_config.iconHeight),
+                            SDL_GetPixelFormatForMasks(32, 0x000000ff, 0x0000ff00, 0x00ff0000, 0xff000000),
+                            g_config.iconRGBA8, static_cast<int>(4 * g_config.iconWidth));
+  ASSERT(iconSurface != nullptr, "Failed to create icon surface: {}", SDL_GetError());
+  TRY_WARN(SDL_SetWindowIcon(g_window, iconSurface), "Failed to set window icon: {}", SDL_GetError());
+  SDL_DestroySurface(iconSurface);
+}
+
+bool SDLCALL lifecycle_event_watch(void*, SDL_Event* event) {
+  switch (event->type) {
+  case SDL_EVENT_WINDOW_RESIZED:
+  case SDL_EVENT_WINDOW_PIXEL_SIZE_CHANGED:
+  case SDL_EVENT_WINDOW_DISPLAY_SCALE_CHANGED:
+    g_nativeResizePending.store(true, std::memory_order_release);
+    break;
+#if defined(SDL_PLATFORM_ANDROID) || defined(SDL_PLATFORM_APPLE)
+  case SDL_EVENT_WINDOW_MINIMIZED:
+    g_backgrounded.store(true, std::memory_order_relaxed);
+    break;
+  case SDL_EVENT_WINDOW_RESTORED:
+    g_backgrounded.store(false, std::memory_order_relaxed);
+    break;
+#endif
+  default:
+    break;
+  }
+  return true;
+}
+
+void sync_paused() {
+  const bool paused = is_paused();
+  if (g_lastPaused == paused) {
+    return;
+  }
+  g_lastPaused = paused;
+  g_events.push_back(AuroraEvent{
+      .type = paused ? AURORA_PAUSED : AURORA_UNPAUSED,
+  });
+}
+
+bool is_alt_enter_event(const SDL_Event& event) noexcept {
+  if (event.type != SDL_EVENT_KEY_DOWN || event.key.repeat) {
+    return false;
+  }
+
+  const SDL_Keymod altMask = static_cast<SDL_Keymod>(SDL_KMOD_LALT | SDL_KMOD_RALT | SDL_KMOD_ALT);
+  return event.key.key == SDLK_RETURN && (event.key.mod & altMask) != 0;
+}
+
+void process_event(SDL_Event& event) {
+#ifdef AURORA_ENABLE_GX
+  imgui::process_event(event);
+#endif
+
+  switch (event.type) {
+  case SDL_EVENT_KEY_DOWN:
+    if (is_alt_enter_event(event)) {
+      set_display_mode(get_fullscreen() ? AURORA_DISPLAY_MODE_WINDOWED : AURORA_DISPLAY_MODE_BORDERLESS);
+      g_nativeResizePending.store(true, std::memory_order_release);
+    }
+    break;
+  case SDL_EVENT_WINDOW_MOVED: {
+    g_events.push_back(AuroraEvent{
+        .type = AURORA_WINDOW_MOVED,
+        .windowPos = {.x = event.window.data1, .y = event.window.data2},
+    });
+    break;
+  }
+  case SDL_EVENT_WINDOW_DISPLAY_SCALE_CHANGED: {
+    g_events.push_back(AuroraEvent{
+        .type = AURORA_DISPLAY_SCALE_CHANGED,
+        .windowSize = get_window_size(),
+    });
+    break;
+  }
+  case SDL_EVENT_WINDOW_RESIZED:
+  case SDL_EVENT_WINDOW_PIXEL_SIZE_CHANGED: {
+    g_events.push_back(AuroraEvent{
+        .type = AURORA_WINDOW_RESIZED,
+        .windowSize = get_window_size(),
+    });
+    break;
+  }
+  case SDL_EVENT_GAMEPAD_ADDED: {
+    auto instance = input::add_controller(event.gdevice.which);
+    g_events.push_back(AuroraEvent{
+        .type = AURORA_CONTROLLER_ADDED,
+        .controller = instance,
+    });
+    break;
+  }
+  case SDL_EVENT_GAMEPAD_REMOVED: {
+    input::remove_controller(event.gdevice.which);
+    g_events.push_back(AuroraEvent{
+        .type = AURORA_CONTROLLER_REMOVED,
+        .controller = event.gdevice.which,
+    });
+    break;
+  }
+  case SDL_EVENT_MOUSE_WHEEL:
+    input::set_mouse_scroll(event.wheel.x, event.wheel.y);
+    break;
+  case SDL_EVENT_QUIT:
+    g_events.push_back(AuroraEvent{
+        .type = AURORA_EXIT,
+    });
+    break;
+  default:
+    if (event.type == g_sdlCustomEventsStart + CustomEvent::FutureResize) {
+      // The request flag is set before this wakeup is queued. Renderer resource mutation belongs to
+      // begin/end_frame_impl, which may be running on the frame worker.
+      g_events.push_back(AuroraEvent{
+          .type = AURORA_WINDOW_RESIZED,
+          .windowSize = get_window_size(),
+      });
+    } else if (event.type == g_sdlCustomEventsStart + CustomEvent::RefreshSurface) {
+      // This event only wakes the window loop; the frame worker applies the pending surface
+      // configuration at its next ordered frame boundary.
+    }
+    break;
+  }
+
+  sync_paused();
+  g_events.push_back(AuroraEvent{
+      .type = AURORA_SDL_EVENT,
+      .sdl = event,
+  });
+}
+} // namespace
+
+const AuroraEvent* poll_events() {
+  g_events.clear();
+  SDL_Event event;
+  // Clear out the previous scroll values to prevent ghost input
+  input::set_mouse_scroll(0, 0);
+  if (is_paused()) {
+    if (SDL_WaitEvent(&event)) {
+      process_event(event);
+    } else {
+      Log.warn("SDL_WaitEvent failed: {}", SDL_GetError());
+    }
+  }
+  while (SDL_PollEvent(&event)) {
+    process_event(event);
+  }
+  g_events.push_back(AuroraEvent{
+      .type = AURORA_NONE,
+  });
+  return g_events.data();
+}
+
+bool create_window(AuroraBackend backend) {
+  SDL_WindowFlags flags = SDL_WINDOW_HIGH_PIXEL_DENSITY;
+#if TARGET_OS_IOS || TARGET_OS_TV
+  flags |= SDL_WINDOW_FULLSCREEN;
+#else
+  flags |= SDL_WINDOW_HIDDEN | SDL_WINDOW_RESIZABLE;
+  if (g_config.startFullscreen) {
+    flags |= SDL_WINDOW_FULLSCREEN;
+  }
+#endif
+  switch (backend) {
+#ifdef AURORA_ENABLE_GX
+#ifdef DAWN_ENABLE_BACKEND_VULKAN
+  case BACKEND_VULKAN:
+    flags |= SDL_WINDOW_VULKAN;
+    break;
+#endif
+#ifdef DAWN_ENABLE_BACKEND_METAL
+  case BACKEND_METAL:
+    flags |= SDL_WINDOW_METAL;
+    break;
+#endif
+#ifdef DAWN_ENABLE_BACKEND_OPENGL
+  case BACKEND_OPENGL:
+  case BACKEND_OPENGLES:
+    flags |= SDL_WINDOW_OPENGL;
+    break;
+#endif
+#endif
+  default:
+    break;
+  }
+  auto width = static_cast<Sint32>(g_config.windowWidth);
+  auto height = static_cast<Sint32>(g_config.windowHeight);
+  if (width == 0 || height == 0) {
+    width = 1280;
+    height = 960;
+  }
+  if (width < 640) {
+    width = 640;
+  }
+  if (height < 480) {
+    height = 480;
+  }
+
+  const Sint32 posX = g_config.hasWindowPosition ? g_config.windowPosX : SDL_WINDOWPOS_CENTERED;
+  const Sint32 posY = g_config.hasWindowPosition ? g_config.windowPosY : SDL_WINDOWPOS_CENTERED;
+
+  const auto props = SDL_CreateProperties();
+  TRY(SDL_SetStringProperty(props, SDL_PROP_WINDOW_CREATE_TITLE_STRING, g_config.appName), "Failed to set {}: {}",
+      SDL_PROP_WINDOW_CREATE_TITLE_STRING, SDL_GetError());
+  TRY(SDL_SetNumberProperty(props, SDL_PROP_WINDOW_CREATE_X_NUMBER, posX), "Failed to set {}: {}",
+      SDL_PROP_WINDOW_CREATE_X_NUMBER, SDL_GetError());
+  TRY(SDL_SetNumberProperty(props, SDL_PROP_WINDOW_CREATE_Y_NUMBER, posY), "Failed to set {}: {}",
+      SDL_PROP_WINDOW_CREATE_Y_NUMBER, SDL_GetError());
+  TRY(SDL_SetNumberProperty(props, SDL_PROP_WINDOW_CREATE_WIDTH_NUMBER, width), "Failed to set {}: {}",
+      SDL_PROP_WINDOW_CREATE_WIDTH_NUMBER, SDL_GetError());
+  TRY(SDL_SetNumberProperty(props, SDL_PROP_WINDOW_CREATE_HEIGHT_NUMBER, height), "Failed to set {}: {}",
+      SDL_PROP_WINDOW_CREATE_HEIGHT_NUMBER, SDL_GetError());
+  TRY(SDL_SetNumberProperty(props, SDL_PROP_WINDOW_CREATE_FLAGS_NUMBER, flags), "Failed to set {}: {}",
+      SDL_PROP_WINDOW_CREATE_FLAGS_NUMBER, SDL_GetError());
+  g_window = SDL_CreateWindowWithProperties(props);
+  if (g_window == nullptr) {
+    Log.error("Failed to create window: {}", SDL_GetError());
+    return false;
+  }
+  SDL_SetWindowMinimumSize(g_window, 640, 480);
+  g_displayMode.store(g_config.startFullscreen ? AURORA_DISPLAY_MODE_BORDERLESS : AURORA_DISPLAY_MODE_WINDOWED,
+                      std::memory_order_release);
+#if defined(_WIN32)
+  install_window_proc_hook();
+#endif
+  set_window_icon();
+  return true;
+}
+
+bool create_renderer() {
+  if (g_window == nullptr) {
+    return false;
+  }
+  const auto props = SDL_CreateProperties();
+  TRY(SDL_SetPointerProperty(props, SDL_PROP_RENDERER_CREATE_WINDOW_POINTER, g_window), "Failed to set {}: {}",
+      SDL_PROP_RENDERER_CREATE_WINDOW_POINTER, SDL_GetError());
+  // Never vsync: presentation must not throttle the guest's own pacing.
+  TRY(SDL_SetNumberProperty(props, SDL_PROP_RENDERER_CREATE_PRESENT_VSYNC_NUMBER, SDL_RENDERER_VSYNC_DISABLED),
+      "Failed to set {}: {}", SDL_PROP_RENDERER_CREATE_PRESENT_VSYNC_NUMBER, SDL_GetError());
+  g_renderer = SDL_CreateRendererWithProperties(props);
+  if (g_renderer == nullptr) {
+    Log.error("Failed to create renderer: {}", SDL_GetError());
+    return false;
+  }
+  return true;
+}
+
+void destroy_window() {
+#if defined(_WIN32)
+  uninstall_window_proc_hook();
+#endif
+  if (g_renderer != nullptr) {
+    SDL_DestroyRenderer(g_renderer);
+    g_renderer = nullptr;
+  }
+  if (g_window != nullptr) {
+    SDL_DestroyWindow(g_window);
+    g_window = nullptr;
+  }
+}
+
+void show_window() {
+  if (g_window != nullptr) {
+    TRY_WARN(SDL_ShowWindow(g_window), "Failed to show window: {}", SDL_GetError());
+  }
+}
+
+bool initialize() {
+  /* We don't want to initialize anything input related here, otherwise the add events will get lost to the void */
+  TRY(SDL_SetHint(SDL_HINT_ORIENTATIONS, "LandscapeLeft LandscapeRight"), "Error setting {}: {}", SDL_HINT_ORIENTATIONS,
+      SDL_GetError());
+  TRY(SDL_InitSubSystem(SDL_INIT_EVENTS | SDL_INIT_VIDEO), "Error initializing SDL: {}", SDL_GetError());
+
+#if !defined(_WIN32) && !defined(__APPLE__)
+  TRY(SDL_SetHint(SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR, "0"), "Error setting {}: {}",
+      SDL_HINT_VIDEO_X11_NET_WM_BYPASS_COMPOSITOR, SDL_GetError());
+#endif
+  TRY(SDL_SetHint(SDL_HINT_SCREENSAVER_INHIBIT_ACTIVITY_NAME, g_config.appName), "Error setting {}: {}",
+      SDL_HINT_SCREENSAVER_INHIBIT_ACTIVITY_NAME, SDL_GetError());
+  TRY(SDL_SetHint(SDL_HINT_JOYSTICK_HIDAPI_GAMECUBE_RUMBLE_BRAKE, "1"), "Error setting {}: {}",
+      SDL_HINT_JOYSTICK_HIDAPI_GAMECUBE_RUMBLE_BRAKE, SDL_GetError());
+
+  TRY(SDL_DisableScreenSaver(), "Error disabling screensaver: {}", SDL_GetError());
+  if (g_config.allowJoystickBackgroundEvents) {
+    TRY(SDL_SetHint(SDL_HINT_JOYSTICK_ALLOW_BACKGROUND_EVENTS, "1"), "Error setting {}: {}",
+        SDL_HINT_JOYSTICK_ALLOW_BACKGROUND_EVENTS, SDL_GetError());
+  }
+
+  return true;
+}
+
+bool initialize_event_watch() {
+  TRY(SDL_AddEventWatch(lifecycle_event_watch, nullptr), "Error adding SDL event watch: {}", SDL_GetError());
+  return true;
+}
+
+void shutdown() {
+  SDL_RemoveEventWatch(lifecycle_event_watch, nullptr);
+  destroy_window();
+  TRY_WARN(SDL_EnableScreenSaver(), "Error enabling screensaver: {}", SDL_GetError());
+  SDL_Quit();
+}
+
+AuroraWindowSize get_window_size() {
+  int width = 0;
+  int height = 0;
+  int native_fb_w = 0;
+  int native_fb_h = 0;
+  ASSERT(SDL_GetWindowSize(g_window, &width, &height), "Failed to get window size: {}", SDL_GetError());
+  ASSERT(SDL_GetWindowSizeInPixels(g_window, &native_fb_w, &native_fb_h), "Failed to get window size in pixels: {}",
+         SDL_GetError());
+
+  int fb_w = native_fb_w;
+  int fb_h = native_fb_h;
+  const auto [baseW, baseH] = vi::configured_fb_size();
+  if (g_frameBufferAspectFit && baseW > 0 && baseH > 0) {
+    float renderScale = g_frameBufferScale > 0.f ? g_frameBufferScale : 1.f;
+    if (g_frameBufferScale <= 0.f) {
+      renderScale = std::min(static_cast<float>(native_fb_w) / static_cast<float>(baseW),
+                             static_cast<float>(native_fb_h) / static_cast<float>(baseH));
+      if (renderScale < 1.f) {
+        renderScale = 1.f;
+      }
+    }
+    fb_w = std::max(1, static_cast<int>(std::lround(static_cast<float>(baseW) * renderScale)));
+    fb_h = std::max(1, static_cast<int>(std::lround(static_cast<float>(baseH) * renderScale)));
+  } else if (g_frameBufferScale > 0.f && baseW > 0 && baseH > 0) {
+    const auto [scaledW, scaledH] =
+        scale_frame_buffer_to_aspect(static_cast<int>(baseW), static_cast<int>(baseH), g_frameBufferScale,
+                                     static_cast<float>(fb_w) / static_cast<float>(fb_h));
+    fb_w = scaledW;
+    fb_h = scaledH;
+  }
+
+  const float scale = SDL_GetWindowDisplayScale(g_window);
+  return {
+      .width = static_cast<uint32_t>(width),
+      .height = static_cast<uint32_t>(height),
+      .fb_width = static_cast<uint32_t>(fb_w),
+      .fb_height = static_cast<uint32_t>(fb_h),
+      .native_fb_width = static_cast<uint32_t>(native_fb_w),
+      .native_fb_height = static_cast<uint32_t>(native_fb_h),
+      .scale = scale,
+  };
+}
+
+SDL_Window* get_sdl_window() { return g_window; }
+
+SDL_Renderer* get_sdl_renderer() { return g_renderer; }
+
+bool is_paused() noexcept {
+  if (!is_presentable()) {
+    return true;
+  }
+  const auto flags = SDL_GetWindowFlags(g_window);
+  if ((flags & SDL_WINDOW_HIDDEN) != 0u) {
+    return true;
+  }
+  // Wait until the window has received focus before respecting pauseOnFocusLost
+  if (!g_gotFocus) {
+    g_gotFocus = (flags & SDL_WINDOW_INPUT_FOCUS) != 0u;
+    return false;
+  }
+  return g_config.pauseOnFocusLost && ((flags & SDL_WINDOW_INPUT_FOCUS) == 0u || (flags & SDL_WINDOW_MINIMIZED) != 0u);
+}
+
+bool is_presentable() noexcept {
+  return g_window != nullptr && !g_backgrounded.load(std::memory_order_acquire) &&
+         g_surfaceReady.load(std::memory_order_acquire);
+}
+
+void pump_events() noexcept {
+  if (g_window != nullptr) {
+    SDL_SyncWindow(g_window);
+  }
+  SDL_PumpEvents();
+}
+
+bool native_resize_pending() noexcept { return g_nativeResizePending.load(std::memory_order_acquire); }
+
+bool native_window_size_matches(uint32_t width, uint32_t height) noexcept {
+  if (g_window == nullptr || width == 0 || height == 0) {
+    return true;
+  }
+  uint32_t nativeWidth = 0;
+  uint32_t nativeHeight = 0;
+  if (query_native_client_size(nativeWidth, nativeHeight)) {
+    return nativeWidth == width && nativeHeight == height;
+  }
+  const auto size = get_window_size();
+  return size.native_fb_width == width && size.native_fb_height == height;
+}
+
+void set_surface_ready(bool ready) noexcept { g_surfaceReady.store(ready, std::memory_order_release); }
+
+SurfaceLock::SurfaceLock() noexcept {
+#if defined(SDL_PLATFORM_ANDROID)
+  Android_LockActivityMutex();
+#endif
+}
+
+SurfaceLock::~SurfaceLock() {
+#if defined(SDL_PLATFORM_ANDROID)
+  Android_UnlockActivityMutex();
+#endif
+}
+
+bool push_custom_event(CustomEvent eventType) {
+  SDL_Event event{.type = g_sdlCustomEventsStart + eventType};
+  return SDL_PushEvent(&event);
+}
+
+void set_title(const char* title) {
+  TRY_WARN(SDL_SetWindowTitle(g_window, title), "Failed to set window title: {}", SDL_GetError());
+}
+
+void set_fullscreen(bool fullscreen) {
+  set_display_mode(fullscreen ? AURORA_DISPLAY_MODE_BORDERLESS : AURORA_DISPLAY_MODE_WINDOWED);
+}
+
+bool get_fullscreen() { return (SDL_GetWindowFlags(g_window) & SDL_WINDOW_FULLSCREEN) != 0u; }
+
+void set_display_mode(AuroraDisplayMode mode) {
+  if (g_window == nullptr) {
+    return;
+  }
+  if (mode < AURORA_DISPLAY_MODE_WINDOWED || mode > AURORA_DISPLAY_MODE_EXCLUSIVE) {
+    Log.warn("Ignoring invalid display mode {}", static_cast<int>(mode));
+    return;
+  }
+  const AuroraDisplayMode currentMode = g_displayMode.load(std::memory_order_acquire);
+  // Exclusive mode is re-applied even when already active: the desired refresh
+  // rate tracks the frame interpolation target, which can change at runtime.
+  if (mode == currentMode && mode != AURORA_DISPLAY_MODE_EXCLUSIVE) {
+    return;
+  }
+
+  bool success = true;
+  if (mode == AURORA_DISPLAY_MODE_WINDOWED) {
+    success = SDL_SetWindowFullscreen(g_window, false);
+    if (success) {
+      success = SDL_SetWindowFullscreenMode(g_window, nullptr);
+    }
+  } else if (mode == AURORA_DISPLAY_MODE_BORDERLESS) {
+    if (SDL_GetWindowFullscreenMode(g_window) != nullptr) {
+      success = SDL_SetWindowFullscreen(g_window, false);
+    }
+    if (success) {
+      success = SDL_SetWindowFullscreenMode(g_window, nullptr);
+    }
+    if (success) {
+      success = SDL_SetWindowFullscreen(g_window, true);
+    }
+  } else {
+    const SDL_DisplayID display = SDL_GetDisplayForWindow(g_window);
+    const SDL_DisplayMode* desktop = display != 0 ? SDL_GetDesktopDisplayMode(display) : nullptr;
+    const uint32_t interpolationFps = aurora_get_frame_interpolation_fps();
+    const float targetHz = interpolationFps > 60 ? static_cast<float>(interpolationFps) : 60.0f;
+    SDL_DisplayMode closest{};
+    if (desktop == nullptr ||
+        !SDL_GetClosestFullscreenDisplayMode(display, desktop->w, desktop->h, targetHz, true, &closest)) {
+      Log.warn("No exclusive fullscreen mode near {:.0f} Hz is available: {}", targetHz, SDL_GetError());
+      return;
+    }
+    const SDL_DisplayMode* active = SDL_GetWindowFullscreenMode(g_window);
+    if (mode == currentMode && active != nullptr && active->w == closest.w && active->h == closest.h &&
+        active->refresh_rate == closest.refresh_rate) {
+      return;
+    }
+    if (get_fullscreen() && mode != currentMode) {
+      success = SDL_SetWindowFullscreen(g_window, false);
+    }
+    if (success) {
+      success = SDL_SetWindowFullscreenMode(g_window, &closest);
+    }
+    if (success) {
+      success = SDL_SetWindowFullscreen(g_window, true);
+    }
+    if (success) {
+      Log.info("Exclusive fullscreen requested at {}x{} {:.3f} Hz", closest.w, closest.h, closest.refresh_rate);
+    }
+  }
+
+  if (!success) {
+    Log.warn("Failed to change display mode: {}", SDL_GetError());
+    return;
+  }
+  g_displayMode.store(mode, std::memory_order_release);
+  g_nativeResizePending.store(true, std::memory_order_release);
+  TRY_WARN(push_custom_event(CustomEvent::FutureResize), "Failed to queue fullscreen resize event: {}",
+           SDL_GetError());
+}
+
+AuroraDisplayMode get_display_mode() { return g_displayMode.load(std::memory_order_acquire); }
+
+void set_window_size(uint32_t width, uint32_t height) {
+  TRY_WARN(SDL_RestoreWindow(g_window), "Failed to un-maximize window: {}", SDL_GetError());
+  TRY_WARN(SDL_SetWindowSize(g_window, width, height), "Failed to set window size: {}", SDL_GetError());
+}
+
+void set_window_position(uint32_t x, uint32_t y) {
+  TRY_WARN(SDL_SetWindowPosition(g_window, x, y), "Failed to set window position: {}", SDL_GetError());
+}
+
+void center_window() {
+  TRY_WARN(SDL_SetWindowPosition(g_window, SDL_WINDOWPOS_CENTERED, SDL_WINDOWPOS_CENTERED),
+           "Failed to center window: {}", SDL_GetError());
+}
+
+void sync_frame_buffer_size() noexcept {
+  if (g_window != nullptr) {
+    resize_swapchain();
+  }
+}
+
+static void push_future_resize_event() {
+  TRY_WARN(push_custom_event(CustomEvent::FutureResize), "Failed to push SDL event for future resize: {}",
+           SDL_GetError());
+}
+
+void request_frame_buffer_resize() {
+  if (g_window != nullptr) {
+    // Publish the request before waking the SDL loop: the render worker consumes it at an ordered
+    // frame boundary, and the main thread must never recreate WebGPU targets mid-frame.
+    g_nativeResizePending.store(true, std::memory_order_release);
+    push_future_resize_event();
+  }
+}
+
+void set_frame_buffer_scale(float scale) {
+  if (scale < 0.f) {
+    scale = 0.f;
+  }
+  if (g_frameBufferScale == scale) {
+    return;
+  }
+  g_frameBufferScale = scale;
+  request_frame_buffer_resize();
+}
+
+void set_frame_buffer_aspect_fit(bool fit) {
+  if (g_frameBufferAspectFit == fit) {
+    return;
+  }
+
+  g_frameBufferAspectFit = fit;
+  request_frame_buffer_resize();
+}
+
+void set_present_surface_fill(bool fill) {
+  g_presentSurfaceFill = fill;
+}
+
+void lock_present_aspect_ratio(int width, int height) {
+  if (width <= 0 || height <= 0) {
+    unlock_present_aspect_ratio();
+    return;
+  }
+  if (g_presentAspectWidth == width && g_presentAspectHeight == height) {
+    return;
+  }
+  g_presentAspectWidth = width;
+  g_presentAspectHeight = height;
+}
+
+void unlock_present_aspect_ratio() {
+  g_presentAspectWidth = 0;
+  g_presentAspectHeight = 0;
+}
+
+bool get_present_aspect_ratio(float& aspect) noexcept {
+  if (g_presentSurfaceFill && g_window != nullptr) {
+    // Queried once per presentation snapshot; use the cached native client size
+    // instead of re-entering SDL for a value the window procedure already knows.
+    uint32_t nativeWidth = 0;
+    uint32_t nativeHeight = 0;
+    if (query_native_client_size(nativeWidth, nativeHeight) && nativeWidth > 0 && nativeHeight > 0) {
+      aspect = static_cast<float>(nativeWidth) / static_cast<float>(nativeHeight);
+      return true;
+    }
+    int width = 0;
+    int height = 0;
+    if (SDL_GetWindowSizeInPixels(g_window, &width, &height) && width > 0 && height > 0) {
+      aspect = static_cast<float>(width) / static_cast<float>(height);
+      return true;
+    }
+  }
+  if (g_presentAspectWidth <= 0 || g_presentAspectHeight <= 0) {
+    aspect = 0.f;
+    return false;
+  }
+  aspect = (static_cast<float>(g_presentAspectWidth) / static_cast<float>(g_presentAspectHeight)) *
+           vi::present_aspect_correction();
+  return aspect > 0.f;
+}
+
+void set_background_input(bool value) { SDL_SetHint(SDL_HINT_JOYSTICK_ALLOW_BACKGROUND_EVENTS, value ? "1" : "0"); }
+
+} // namespace aurora::window
+
+#if defined(SDL_PLATFORM_ANDROID)
+extern "C" JNIEXPORT void JNICALL Java_org_libsdl_app_SDLSurface_auroraNativeSetSurfaceReady(JNIEnv*, jclass,
+                                                                                             jboolean ready) {
+  aurora::window::set_surface_ready(ready == JNI_TRUE);
+}
+#endif
diff --git a/aurora-main/lib/window.hpp b/aurora-main/lib/window.hpp
new file mode 100644
index 0000000..22d249f
--- /dev/null
+++ b/aurora-main/lib/window.hpp
@@ -0,0 +1,64 @@
+#pragma once
+
+#include <aurora/aurora.h>
+#include <aurora/event.h>
+
+struct SDL_Window;
+struct SDL_Renderer;
+
+namespace aurora::window {
+
+enum class CustomEvent {
+  FutureResize,
+  RefreshSurface,
+  End,
+};
+static Uint32 operator+(Uint32 lhs, CustomEvent rhs) { return lhs + static_cast<Uint32>(rhs); }
+
+// On Android in particular, we need to hold a mutex around critical areas like surface creation
+// and presentation, so that the SDLActivity doesn't destroy the surface out from underneath us.
+class SurfaceLock {
+public:
+  SurfaceLock() noexcept;
+  ~SurfaceLock();
+
+  SurfaceLock(const SurfaceLock&) = delete;
+  SurfaceLock& operator=(const SurfaceLock&) = delete;
+};
+
+bool initialize();
+bool initialize_event_watch();
+bool push_custom_event(CustomEvent eventType);
+void shutdown();
+bool create_window(AuroraBackend backend);
+bool create_renderer();
+void destroy_window();
+void show_window();
+AuroraWindowSize get_window_size();
+const AuroraEvent* poll_events();
+SDL_Window* get_sdl_window();
+SDL_Renderer* get_sdl_renderer();
+bool is_paused() noexcept;
+bool is_presentable() noexcept;
+void pump_events() noexcept;
+bool native_resize_pending() noexcept;
+bool native_window_size_matches(uint32_t width, uint32_t height) noexcept;
+void set_surface_ready(bool ready) noexcept;
+void set_title(const char* title);
+void set_fullscreen(bool fullscreen);
+bool get_fullscreen();
+void set_display_mode(AuroraDisplayMode mode);
+AuroraDisplayMode get_display_mode();
+void set_window_size(uint32_t width, uint32_t height);
+void set_window_position(uint32_t x, uint32_t y);
+void center_window();
+void sync_frame_buffer_size() noexcept;
+void request_frame_buffer_resize();
+void set_frame_buffer_scale(float scale);
+void set_frame_buffer_aspect_fit(bool fit);
+void set_present_surface_fill(bool fill);
+void lock_present_aspect_ratio(int width, int height);
+void unlock_present_aspect_ratio();
+bool get_present_aspect_ratio(float& aspect) noexcept;
+void set_background_input(bool value);
+}; // namespace aurora::window
diff --git a/aurora-main/tests/CMakeLists.txt b/aurora-main/tests/CMakeLists.txt
new file mode 100644
index 0000000..9e224a0
--- /dev/null
+++ b/aurora-main/tests/CMakeLists.txt
@@ -0,0 +1,95 @@
+include(FetchContent)
+include(GoogleTest)
+
+if (NOT TARGET gtest)
+  FetchContent_Declare(googletest
+    URL https://github.com/google/googletest/archive/refs/tags/v1.17.0.tar.gz
+    URL_HASH SHA256=65fab701d9829d38cb77c14acdc431d2108bfdbf8979e40eb8ae567edf10b27c
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    EXCLUDE_FROM_ALL
+  )
+  FetchContent_MakeAvailable(googletest)
+endif ()
+
+if (AURORA_ENABLE_GX)
+  # GX FIFO round-trip tests
+  # Compile GX sources directly to avoid pulling in the full renderer/WebGPU runtime
+  add_executable(gx_fifo_tests
+    gx_fifo_test.cpp
+    gx_test_stubs.cpp
+    texture_bind_group_cache_key_test.cpp
+    ../lib/gfx/efb_ram_encoder.cpp
+    # GX API implementations (encoders)
+    ../lib/dolphin/gx/GXBump.cpp
+    ../lib/dolphin/gx/GXCull.cpp
+    ../lib/dolphin/gx/GXCpu2Efb.cpp
+    ../lib/dolphin/gx/GXDispList.cpp
+    ../lib/dolphin/gx/GXDraw.cpp
+    ../lib/dolphin/gx/GXExtra.cpp
+    ../lib/dolphin/gx/GXFifo.cpp
+    ../lib/dolphin/gx/GXFrameBuffer.cpp
+    ../lib/dolphin/gx/GXGeometry.cpp
+    ../lib/dolphin/gx/GXGet.cpp
+    ../lib/dolphin/gx/GXLighting.cpp
+    ../lib/dolphin/gx/GXManage.cpp
+    ../lib/dolphin/gx/GXAurora.cpp
+    ../lib/dolphin/gx/GXPixel.cpp
+    ../lib/dolphin/gx/GXTev.cpp
+    ../lib/dolphin/gx/GXTexture.cpp
+    ../lib/dolphin/gx/GXTransform.cpp
+    ../lib/dolphin/gx/GXVert.cpp
+    # FIFO/command processor (encoder + decoder)
+    ../lib/gx/fifo.cpp
+    ../lib/gx/command_processor.cpp
+    ../lib/gx/shader_info.cpp
+    ../lib/gx/frame_interpolation.cpp
+  )
+
+  target_include_directories(gx_fifo_tests PRIVATE
+    ../include
+    ../lib
+    ../lib/dolphin/gx
+  )
+
+  target_compile_definitions(gx_fifo_tests PRIVATE AURORA TARGET_PC)
+
+  target_link_libraries(gx_fifo_tests PRIVATE
+    gtest
+    gtest_main
+    fmt::fmt
+    xxhash
+    absl::flat_hash_map
+    absl::btree
+    dawn::dawncpp_headers
+    TracyClient
+    ${AURORA_SDL3_TARGET}
+  )
+
+  gtest_discover_tests(gx_fifo_tests)
+endif () # AURORA_ENABLE_GX
+
+# DVD API tests
+if (TARGET aurora::dvd)
+  add_executable(dvd_tests test_dvd.cpp)
+  target_link_libraries(dvd_tests PRIVATE aurora::dvd gtest gtest_main)
+
+  # Pass disc image path as a compile definition if provided
+  if (DEFINED DVD_TEST_IMAGE AND EXISTS "${DVD_TEST_IMAGE}")
+    target_compile_definitions(dvd_tests PRIVATE DVD_TEST_IMAGE="${DVD_TEST_IMAGE}")
+  endif ()
+
+  gtest_discover_tests(dvd_tests)
+endif ()
+
+add_executable(os_alloc_tests
+  os_alloc_test.cpp
+  os_test_globals.cpp
+  ../lib/dolphin/os/OSAlloc.cpp
+  ../lib/logging.cpp
+)
+target_include_directories(os_alloc_tests PRIVATE
+  ../include
+)
+target_compile_definitions(os_alloc_tests PRIVATE AURORA TARGET_PC)
+target_link_libraries(os_alloc_tests PRIVATE gtest gtest_main fmt::fmt)
+gtest_discover_tests(os_alloc_tests)
diff --git a/aurora-main/tests/gx_fifo_test.cpp b/aurora-main/tests/gx_fifo_test.cpp
new file mode 100644
index 0000000..5aea9bb
--- /dev/null
+++ b/aurora-main/tests/gx_fifo_test.cpp
@@ -0,0 +1,4948 @@
+// GX FIFO encode/decode round-trip tests: call a GX function, capture the FIFO bytes, reset
+// g_gxState, feed them to command_processor::process(), then check the decoded state.
+
+#include "gx_test_common.hpp"
+#include "gfx/efb_ram_encoder.hpp"
+#include "gfx/tex_copy_format_contract.hpp"
+#include "gx/shader_info.hpp"
+#include "gx/pipeline.hpp"
+#include "__gx.h"
+
+#include <algorithm>
+#include <cmath>
+#include <initializer_list>
+#include <limits>
+
+using aurora::gx::g_gxState;
+
+TEST(GXPipelineConfig, RejectsInvalidDeserializedEnums) {
+  aurora::gx::PipelineConfig config{};
+  EXPECT_TRUE(aurora::gx::valid_pipeline_config(config));
+
+  config.depthFunc = static_cast<GXCompare>(0x009F01F2);
+  EXPECT_FALSE(aurora::gx::valid_pipeline_config(config));
+}
+
+TEST(GXPipelineConfig, FoggedLateZLogicOrPreservesEggDofMask) {
+  EXPECT_EQ(aurora::gx::effective_pipeline_fog_type(GX_FOG_PERSP_LIN, GX_ZT_REPLACE,
+                                                    false, GX_BM_LOGIC, GX_LO_OR),
+            GX_FOG_PERSP_LIN);
+
+  // Keep the existing defensive suppression for late-Z mask passes whose
+  // integer logic operation still has only an inexact WebGPU fallback.
+  EXPECT_EQ(aurora::gx::effective_pipeline_fog_type(GX_FOG_PERSP_LIN, GX_ZT_REPLACE,
+                                                    false, GX_BM_LOGIC, GX_LO_COPY),
+            GX_FOG_NONE);
+
+  // Logic fallbacks do not require this workaround when Z-texturing is early.
+  EXPECT_EQ(aurora::gx::effective_pipeline_fog_type(GX_FOG_PERSP_LIN, GX_ZT_REPLACE,
+                                                    true, GX_BM_LOGIC, GX_LO_COPY),
+            GX_FOG_PERSP_LIN);
+}
+
+TEST(GXShaderInfo, ShaderLightSanitizesNonFiniteDirectionForUniforms) {
+  aurora::gx::Light light{};
+  light.dir = {
+      std::numeric_limits<float>::quiet_NaN(),
+      std::numeric_limits<float>::infinity(),
+      -std::numeric_limits<float>::infinity(),
+  };
+
+  const auto sanitized = aurora::gx::prepare_shader_light(light);
+  EXPECT_FLOAT_EQ(sanitized.dir[0], 0.0f);
+  EXPECT_FLOAT_EQ(sanitized.dir[1], 0.0f);
+  EXPECT_FLOAT_EQ(sanitized.dir[2], 0.0f);
+
+  light.dir = {3.0f, 4.0f, 0.0f};
+  const auto normalized = aurora::gx::prepare_shader_light(light);
+  EXPECT_FLOAT_EQ(normalized.dir[0], 0.6f);
+  EXPECT_FLOAT_EQ(normalized.dir[1], 0.8f);
+  EXPECT_FLOAT_EQ(normalized.dir[2], 0.0f);
+
+  light.dir = {0.0f, 0.0f, 0.0f};
+  const auto zero = aurora::gx::prepare_shader_light(light);
+  EXPECT_FLOAT_EQ(zero.dir[0], 0.0f);
+  EXPECT_FLOAT_EQ(zero.dir[1], 0.0f);
+  EXPECT_FLOAT_EQ(zero.dir[2], 0.0f);
+}
+
+TEST(GXLighting, SpotCoefficientsAndPositionGetterMatchRevolutionSdk) {
+  GXLightObj light{};
+  GXInitLightSpot(&light, 60.0f, GX_SP_SHARP);
+
+  float a0 = 0.0f;
+  float a1 = 0.0f;
+  float a2 = 0.0f;
+  GXGetLightAttnA(&light, &a0, &a1, &a2);
+  EXPECT_NEAR(a0, -3.0f, 0.00001f);
+  EXPECT_NEAR(a1, 8.0f, 0.00001f);
+  EXPECT_NEAR(a2, -4.0f, 0.00001f);
+
+  GXInitLightSpot(&light, 60.0f, GX_SP_RING1);
+  GXGetLightAttnA(&light, &a0, &a1, &a2);
+  EXPECT_NEAR(a0, -8.0f, 0.00001f);
+  EXPECT_NEAR(a1, 24.0f, 0.00001f);
+  EXPECT_NEAR(a2, -16.0f, 0.00001f);
+
+  GXInitLightPos(&light, 10.0f, 20.0f, 30.0f);
+  float x = 0.0f;
+  float y = 0.0f;
+  float z = 0.0f;
+  GXGetLightPos(&light, &x, &y, &z);
+  EXPECT_FLOAT_EQ(x, 10.0f);
+  EXPECT_FLOAT_EQ(y, 20.0f);
+  EXPECT_FLOAT_EQ(z, 30.0f);
+}
+
+TEST(EfbRamEncoderContract, Z24X8WritesNativeFourByFourArGbPlanes) {
+  std::array<u8, 4 * 4 * 4> rgba{};
+  for (u32 i = 0; i < 16; ++i) {
+    rgba[i * 4 + 0] = static_cast<u8>(0x10 + i); // high Z
+    rgba[i * 4 + 1] = static_cast<u8>(0x40 + i); // middle Z
+    rgba[i * 4 + 2] = static_cast<u8>(0x80 + i); // low Z
+    rgba[i * 4 + 3] = 0xff;
+  }
+
+  std::array<u8, 64> encoded{};
+  ASSERT_TRUE(aurora::gfx::efb_ram::encode(
+      encoded.data(), encoded.size(), GX_TF_Z24X8, 4, 4, rgba.data(), 4, 4, 16,
+      aurora::gfx::efb_ram::HostPixelOrder::RGBA));
+  EXPECT_EQ(aurora::gfx::efb_ram::encoded_size(GX_TF_Z24X8, 4, 4), encoded.size());
+
+  for (u32 i = 0; i < 16; ++i) {
+    EXPECT_EQ(encoded[i * 2 + 0], 0xff) << "AR plane texel " << i;
+    EXPECT_EQ(encoded[i * 2 + 1], 0x10 + i) << "AR plane texel " << i;
+    EXPECT_EQ(encoded[32 + i * 2 + 0], 0x40 + i) << "GB plane texel " << i;
+    EXPECT_EQ(encoded[32 + i * 2 + 1], 0x80 + i) << "GB plane texel " << i;
+
+    const u32 depth = (static_cast<u32>(encoded[i * 2 + 1]) << 16) |
+                      (static_cast<u32>(encoded[32 + i * 2 + 0]) << 8) |
+                      encoded[32 + i * 2 + 1];
+    EXPECT_EQ(depth, ((0x10u + i) << 16) | ((0x40u + i) << 8) | (0x80u + i));
+  }
+}
+
+static bool has_bp_write(const std::vector<u8>& bytes, u8 reg) {
+  const std::array<u8, 2> pattern{0x61, reg};
+  return std::search(bytes.begin(), bytes.end(), pattern.begin(), pattern.end()) != bytes.end();
+}
+
+static void expect_fog_raw_fields_match_decoded_state() {
+  const float expectedA = std::ldexp(g_gxState.fog.aRaw, static_cast<int>(g_gxState.fog.bShift));
+  const float bMant = static_cast<float>(g_gxState.fog.bMagnitude) / 8388638.0f;
+  const float expectedB = std::ldexp(bMant, static_cast<int>(g_gxState.fog.bShift) - 1);
+  EXPECT_NEAR(g_gxState.fog.a, expectedA, std::max(std::abs(g_gxState.fog.a) * 1e-3f, 1e-6f));
+  EXPECT_NEAR(g_gxState.fog.b, expectedB, std::max(std::abs(g_gxState.fog.b) * 1e-3f, 1e-6f));
+}
+
+static bool has_aurora_cmd(const std::vector<u8>& bytes, u16 cmd) {
+  const std::array<u8, 3> pattern{GX_LOAD_AURORA, static_cast<u8>(cmd >> 8), static_cast<u8>(cmd & 0xFF)};
+  return std::search(bytes.begin(), bytes.end(), pattern.begin(), pattern.end()) != bytes.end();
+}
+
+static std::vector<u8> bp_cmd(u8 reg, u32 value) {
+  return {0x61, reg, static_cast<u8>((value >> 16) & 0xFF), static_cast<u8>((value >> 8) & 0xFF),
+          static_cast<u8>(value & 0xFF)};
+}
+
+static std::vector<u8> cp_cmd(u8 reg, u32 value) {
+  return {0x08, reg, static_cast<u8>((value >> 24) & 0xFF), static_cast<u8>((value >> 16) & 0xFF),
+          static_cast<u8>((value >> 8) & 0xFF), static_cast<u8>(value & 0xFF)};
+}
+
+static std::vector<u8> xf_cmd(u16 addr, std::initializer_list<u32> values) {
+  std::vector<u8> bytes;
+  bytes.reserve(5 + values.size() * 4);
+  bytes.push_back(0x10);
+
+  const u32 header = ((static_cast<u32>(values.size() - 1) & 0xFFFFu) << 16) | addr;
+  bytes.push_back(static_cast<u8>((header >> 24) & 0xFF));
+  bytes.push_back(static_cast<u8>((header >> 16) & 0xFF));
+  bytes.push_back(static_cast<u8>((header >> 8) & 0xFF));
+  bytes.push_back(static_cast<u8>(header & 0xFF));
+
+  for (const u32 value : values) {
+    bytes.push_back(static_cast<u8>((value >> 24) & 0xFF));
+    bytes.push_back(static_cast<u8>((value >> 16) & 0xFF));
+    bytes.push_back(static_cast<u8>((value >> 8) & 0xFF));
+    bytes.push_back(static_cast<u8>(value & 0xFF));
+  }
+  return bytes;
+}
+
+static u32 read_be32_at(const std::vector<u8>& bytes, size_t offset) {
+  return (static_cast<u32>(bytes[offset]) << 24) | (static_cast<u32>(bytes[offset + 1]) << 16) |
+         (static_cast<u32>(bytes[offset + 2]) << 8) | static_cast<u32>(bytes[offset + 3]);
+}
+
+TEST(FrameInterpolationContract, RequiresStablePerspectiveDrawSequence) {
+  const auto resetInterpolation = [] {
+    aurora::gx::set_frame_interpolation_fps(0);
+    aurora::gx::begin_frame_interpolation();
+  };
+  const auto buildFrame = [](const aurora::gx::ShaderInfo& info, aurora::HashType signatureBase,
+                             bool perspective, bool reverse = false) {
+    aurora::gx::begin_frame_interpolation();
+    aurora::gx::BindGroupRanges ranges{};
+    uint32_t interpolatedUniforms = 0;
+    for (uint32_t i = 0; i < 8; ++i) {
+      const uint32_t signatureOffset = reverse ? 7 - i : i;
+      const aurora::gx::FrameInterpolationDrawIdentity identity{
+          .combined = signatureBase + signatureOffset,
+          .pipeline = signatureBase,
+          .texture = 1,
+      };
+      const auto uniforms = aurora::gx::build_uniform(info, 0, ranges, identity, perspective);
+      interpolatedUniforms += static_cast<uint32_t>(std::count_if(
+          uniforms.interpolated.begin(), uniforms.interpolated.end(),
+          [](const aurora::gfx::Range& range) { return range.size != 0; }));
+    }
+    aurora::gx::finalize_frame_interpolation();
+    return interpolatedUniforms;
+  };
+
+  resetInterpolation();
+  aurora::gx::set_frame_interpolation_fps(120);
+  const auto info = aurora::gx::build_shader_info({});
+
+  // Slots are inserted whenever interpolation is configured, so a frame with no matches just fills
+  // them with duplicates. The staged uniform counts below are what verify the matching.
+  EXPECT_EQ(buildFrame(info, 100, true), 0u);
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+
+  EXPECT_EQ(buildFrame(info, 100, true), 8u);
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+  EXPECT_EQ(aurora::gx::interpolated_frame_count(), 1u);
+  EXPECT_TRUE(aurora::gx::frame_interpolation_replay_safe());
+
+  EXPECT_EQ(buildFrame(info, 100, true, true), 8u);
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+
+  aurora::gx::mark_frame_interpolation_replay_unsafe();
+  EXPECT_FALSE(aurora::gx::frame_interpolation_replay_safe());
+  EXPECT_EQ(aurora::gx::interpolated_frame_count(), 1u);
+
+  aurora::gx::set_frame_interpolation_fps(180);
+  EXPECT_EQ(buildFrame(info, 250, true), 0u);
+  EXPECT_TRUE(aurora::gx::frame_interpolation_replay_safe());
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+  EXPECT_EQ(buildFrame(info, 250, true), 16u);
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+  EXPECT_EQ(aurora::gx::interpolated_frame_count(), 2u);
+
+  aurora::gx::set_frame_interpolation_fps(120);
+  EXPECT_EQ(buildFrame(info, 200, true), 0u);
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+
+  EXPECT_EQ(buildFrame(info, 200, false), 0u);
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+
+  aurora::gx::set_frame_interpolation_fps(240);
+  EXPECT_EQ(buildFrame(info, 300, true), 0u);
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+  EXPECT_EQ(buildFrame(info, 300, true), 24u);
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+  EXPECT_EQ(aurora::gx::interpolated_frame_count(), 3u);
+
+  // CPU-deformed draws change their vertex bytes every frame, so their stable pipeline and texture
+  // identity still has to retain transform history for the camera and model matrices.
+  aurora::gx::set_frame_interpolation_fps(120);
+  const auto buildDeformedFrame = [&](aurora::HashType geometryEpoch) {
+    aurora::gx::begin_frame_interpolation();
+    aurora::gx::BindGroupRanges ranges{};
+    uint32_t interpolatedUniforms = 0;
+    for (uint32_t i = 0; i < 8; ++i) {
+      const aurora::gx::FrameInterpolationDrawIdentity identity{
+          .combined = geometryEpoch + i,
+          .pipeline = 42,
+          .texture = 7,
+      };
+      const auto uniforms = aurora::gx::build_uniform(info, 0, ranges, identity, true);
+      interpolatedUniforms += static_cast<uint32_t>(std::count_if(
+          uniforms.interpolated.begin(), uniforms.interpolated.end(),
+          [](const aurora::gfx::Range& range) { return range.size != 0; }));
+    }
+    aurora::gx::finalize_frame_interpolation();
+    return interpolatedUniforms;
+  };
+  EXPECT_EQ(buildDeformedFrame(400), 0u);
+  EXPECT_EQ(buildDeformedFrame(500), 8u);
+  EXPECT_TRUE(aurora::gx::has_interpolated_frame());
+
+  resetInterpolation();
+}
+
+TEST(FrameInterpolationContract, DecomposesRotationScaleAndTranslation) {
+  const aurora::Mat3x4<float> previous{
+      {1.0f, 0.0f, 0.0f, 0.0f},
+      {0.0f, 1.0f, 0.0f, 0.0f},
+      {0.0f, 0.0f, 1.0f, 0.0f},
+  };
+  const aurora::Mat3x4<float> current{
+      {0.0f, -2.0f, 0.0f, 10.0f},
+      {2.0f, 0.0f, 0.0f, 20.0f},
+      {0.0f, 0.0f, 2.0f, 30.0f},
+  };
+  aurora::Mat3x4<float> midpoint{};
+  ASSERT_TRUE(aurora::gx::interpolate_transform_midpoint(previous, current, midpoint));
+
+  const float expectedAxis = std::sqrt(0.5f) * 1.5f;
+  EXPECT_NEAR(midpoint.m0.x(), expectedAxis, 1.0e-5f);
+  EXPECT_NEAR(midpoint.m0.y(), -expectedAxis, 1.0e-5f);
+  EXPECT_NEAR(midpoint.m1.x(), expectedAxis, 1.0e-5f);
+  EXPECT_NEAR(midpoint.m1.y(), expectedAxis, 1.0e-5f);
+  EXPECT_NEAR(midpoint.m2.z(), 1.5f, 1.0e-5f);
+  EXPECT_FLOAT_EQ(midpoint.m0.w(), 5.0f);
+  EXPECT_FLOAT_EQ(midpoint.m1.w(), 10.0f);
+  EXPECT_FLOAT_EQ(midpoint.m2.w(), 15.0f);
+
+  aurora::Mat3x4<float> quarter{};
+  aurora::Mat3x4<float> threeQuarter{};
+  ASSERT_TRUE(aurora::gx::interpolate_transform(previous, current, 0.25f, quarter));
+  ASSERT_TRUE(aurora::gx::interpolate_transform(previous, current, 0.75f, threeQuarter));
+  EXPECT_FLOAT_EQ(quarter.m0.w(), 2.5f);
+  EXPECT_FLOAT_EQ(quarter.m1.w(), 5.0f);
+  EXPECT_FLOAT_EQ(quarter.m2.w(), 7.5f);
+  EXPECT_FLOAT_EQ(threeQuarter.m0.w(), 7.5f);
+  EXPECT_FLOAT_EQ(threeQuarter.m1.w(), 15.0f);
+  EXPECT_FLOAT_EQ(threeQuarter.m2.w(), 22.5f);
+}
+
+TEST(FrameInterpolationContract, IndexedPaletteInterpolationPreservesSharedSeams) {
+  const aurora::Mat3x4<float> identity{
+      {1.0f, 0.0f, 0.0f, 0.0f},
+      {0.0f, 1.0f, 0.0f, 0.0f},
+      {0.0f, 0.0f, 1.0f, 0.0f},
+  };
+  const aurora::Mat3x4<float> quarterTurn{
+      {0.0f, -1.0f, 0.0f, 0.0f},
+      {1.0f, 0.0f, 0.0f, 0.0f},
+      {0.0f, 0.0f, 1.0f, 0.0f},
+  };
+  const aurora::Mat3x4<float> translatedPrevious{
+      {1.0f, 0.0f, 0.0f, 1.0f},
+      {0.0f, 1.0f, 0.0f, 0.0f},
+      {0.0f, 0.0f, 1.0f, 0.0f},
+  };
+  const aurora::Mat3x4<float> translatedCurrent{
+      {1.0f, 0.0f, 0.0f, 0.0f},
+      {0.0f, 1.0f, 0.0f, 1.0f},
+      {0.0f, 0.0f, 1.0f, 0.0f},
+  };
+
+  aurora::Mat3x4<float> rotatedMidpoint{};
+  aurora::Mat3x4<float> translatedMidpoint{};
+  ASSERT_TRUE(aurora::gx::interpolate_indexed_transform(
+      identity, quarterTurn, 0.5f, rotatedMidpoint));
+  ASSERT_TRUE(aurora::gx::interpolate_indexed_transform(
+      translatedPrevious, translatedCurrent, 0.5f, translatedMidpoint));
+
+  const auto transformPoint = [](const aurora::Mat3x4<float>& matrix,
+                                 const std::array<float, 3>& point) {
+    return std::array<float, 3>{
+        matrix.m0.x() * point[0] + matrix.m0.y() * point[1] +
+            matrix.m0.z() * point[2] + matrix.m0.w(),
+        matrix.m1.x() * point[0] + matrix.m1.y() * point[1] +
+            matrix.m1.z() * point[2] + matrix.m1.w(),
+        matrix.m2.x() * point[0] + matrix.m2.y() * point[1] +
+            matrix.m2.z() * point[2] + matrix.m2.w(),
+    };
+  };
+
+  // Two representations of the same seam point that agree at both real frames, so coefficient
+  // interpolation has to keep them coincident; a rigid decompose would pull them apart.
+  const auto rotatedSeam = transformPoint(rotatedMidpoint, {1.0f, 0.0f, 0.0f});
+  const auto translatedSeam = transformPoint(translatedMidpoint, {0.0f, 0.0f, 0.0f});
+  for (size_t component = 0; component < rotatedSeam.size(); ++component) {
+    EXPECT_FLOAT_EQ(rotatedSeam[component], translatedSeam[component]);
+  }
+  EXPECT_FLOAT_EQ(rotatedSeam[0], 0.5f);
+  EXPECT_FLOAT_EQ(rotatedSeam[1], 0.5f);
+
+  // Composed palette matrices may legitimately contain shear, so the indexed path interpolates it
+  // instead of rejecting the matrix and snapping those vertices to the new frame.
+  const aurora::Mat3x4<float> sheared{
+      {1.0f, 0.5f, 0.0f, 4.0f},
+      {0.0f, 1.0f, 0.0f, 0.0f},
+      {0.0f, 0.0f, 1.0f, 0.0f},
+  };
+  aurora::Mat3x4<float> shearedMidpoint{};
+  ASSERT_TRUE(aurora::gx::interpolate_indexed_transform(
+      identity, sheared, 0.5f, shearedMidpoint));
+  EXPECT_FLOAT_EQ(shearedMidpoint.m0.y(), 0.25f);
+  EXPECT_FLOAT_EQ(shearedMidpoint.m0.w(), 2.0f);
+}
+
+TEST(FrameInterpolationContract, IndexedPaletteHistoryKeepsAbsoluteVertexSlots) {
+  constexpr uint16_t usedMask = (1u << 0) | (1u << 1);
+  constexpr size_t projectionOffset = 0;
+  constexpr size_t positionOffset = sizeof(aurora::Mat4x4<float>);
+  constexpr size_t normalOffset =
+      positionOffset + aurora::gx::MaxPnMtx * sizeof(aurora::Mat3x4<float>);
+  constexpr size_t uniformSize =
+      normalOffset + aurora::gx::MaxPnMtx * sizeof(aurora::Mat3x4<float>);
+  const aurora::gx::FrameInterpolationDrawIdentity identity{
+      .combined = 0x1234,
+      .pipeline = 0x5678,
+      .texture = 0x9abc,
+      .matrixTopology = 0xdef0,
+  };
+  const aurora::Mat4x4<float> projection{};
+  const auto matrixAt = [](float x) {
+    return aurora::Mat3x4<float>{
+        {1.0f, 0.0f, 0.0f, x},
+        {0.0f, 1.0f, 0.0f, 0.0f},
+        {0.0f, 0.0f, 1.0f, 0.0f},
+    };
+  };
+  const auto recordFrame = [&](const aurora::gx::FrameInterpolationDrawIdentity& drawIdentity,
+                               float slot0X, float slot1X,
+                               std::array<uint8_t, uniformSize>& source) {
+    g_gxState.pnMtx[0].pos = matrixAt(slot0X);
+    g_gxState.pnMtx[1].pos = matrixAt(slot1X);
+    g_gxState.pnMtx[0].nrm = matrixAt(0.0f);
+    g_gxState.pnMtx[1].nrm = matrixAt(0.0f);
+    std::memcpy(source.data() + positionOffset, &g_gxState.pnMtx[0].pos,
+                sizeof(aurora::Mat3x4<float>));
+    std::memcpy(source.data() + positionOffset + sizeof(aurora::Mat3x4<float>),
+                &g_gxState.pnMtx[1].pos, sizeof(aurora::Mat3x4<float>));
+    std::memcpy(source.data() + normalOffset, &g_gxState.pnMtx[0].nrm,
+                sizeof(aurora::Mat3x4<float>));
+    std::memcpy(source.data() + normalOffset + sizeof(aurora::Mat3x4<float>),
+                &g_gxState.pnMtx[1].nrm, sizeof(aurora::Mat3x4<float>));
+    return aurora::gx::record_interpolation_draw(
+        drawIdentity, projection, usedMask,
+        aurora::gx::InterpolatedUniformLayout{
+            .sourceUniformData = source.data(),
+            .uniformSize = source.size(),
+            .projectionOffset = projectionOffset,
+            .positionOffset = positionOffset,
+            .normalOffset = normalOffset,
+            .currentMatrix = 0,
+            .indexedMatrices = true,
+        });
+  };
+
+  aurora::gx::set_frame_interpolation_fps(0);
+  aurora::gx::begin_frame_interpolation();
+  aurora::gx::set_frame_interpolation_fps(120);
+
+  std::array<uint8_t, uniformSize> previousSource{};
+  aurora::gx::begin_frame_interpolation();
+  recordFrame(identity, 0.0f, 100.0f, previousSource);
+  aurora::gx::finalize_frame_interpolation();
+
+  // Current slot 0 is spatially nearest previous slot 1 and vice versa. The old nearest-unused
+  // heuristic crossed them even though vertex PNMTXIDX bytes address absolute slots 0 and 1.
+  aurora::gfx::testing::reset_uniform_allocations();
+  std::array<uint8_t, uniformSize> currentSource{};
+  aurora::gx::begin_frame_interpolation();
+  const auto ranges = recordFrame(identity, 90.0f, 10.0f, currentSource);
+  ASSERT_NE(ranges[0].size, 0u);
+  aurora::gx::finalize_frame_interpolation();
+
+  const auto& interpolated = aurora::gfx::testing::uniform_allocation(0);
+  ASSERT_EQ(interpolated.size(), uniformSize);
+  aurora::Mat3x4<float> slot0Midpoint{};
+  aurora::Mat3x4<float> slot1Midpoint{};
+  std::memcpy(static_cast<void*>(&slot0Midpoint), interpolated.data() + positionOffset,
+              sizeof(slot0Midpoint));
+  std::memcpy(static_cast<void*>(&slot1Midpoint),
+              interpolated.data() + positionOffset + sizeof(slot0Midpoint),
+              sizeof(slot1Midpoint));
+  EXPECT_FLOAT_EQ(slot0Midpoint.m0.w(), 45.0f);
+  EXPECT_FLOAT_EQ(slot1Midpoint.m0.w(), 55.0f);
+
+  // A changed vertex-to-slot topology is not recoverable from matrix values, so it must not fall
+  // into the coarse material-only bucket even when the used mask is unchanged.
+  auto changedTopology = identity;
+  ++changedTopology.combined;
+  ++changedTopology.matrixTopology;
+  aurora::gfx::testing::reset_uniform_allocations();
+  std::array<uint8_t, uniformSize> changedSource{};
+  aurora::gx::begin_frame_interpolation();
+  const auto changedRanges = recordFrame(changedTopology, 91.0f, 9.0f, changedSource);
+  EXPECT_EQ(changedRanges[0].size, 0u);
+  aurora::gx::finalize_frame_interpolation();
+
+  aurora::gx::set_frame_interpolation_fps(0);
+  aurora::gx::begin_frame_interpolation();
+  aurora::gfx::testing::reset_uniform_allocations();
+}
+
+TEST(FrameInterpolationContract, RepeatedDrawsMatchByTransformInsteadOfDrawOrder) {
+  const aurora::Mat3x4<float> left{
+      {1.0f, 0.0f, 0.0f, -500.0f},
+      {0.0f, 1.0f, 0.0f, 0.0f},
+      {0.0f, 0.0f, 1.0f, 1000.0f},
+  };
+  const aurora::Mat3x4<float> right{
+      {1.0f, 0.0f, 0.0f, 500.0f},
+      {0.0f, 1.0f, 0.0f, 0.0f},
+      {0.0f, 0.0f, 1.0f, 1000.0f},
+  };
+  const aurora::Mat3x4<float> currentRight{
+      {0.9998f, 0.0f, 0.02f, 496.0f},
+      {0.0f, 1.0f, 0.0f, 1.0f},
+      {-0.02f, 0.0f, 0.9998f, 997.0f},
+  };
+
+  // A transparent sorter may submit right then left this frame after left then right last frame.
+  // The signatures are identical, so spatial continuity has to pick the historical transform.
+  EXPECT_LT(aurora::gx::transform_match_distance_squared(right, currentRight),
+            aurora::gx::transform_match_distance_squared(left, currentRight));
+}
+
+TEST(VertexColorContract, MissingAndSparseColorsFollowGxRasterDefaults) {
+  aurora::gx::ShaderConfig config{};
+
+  EXPECT_EQ(aurora::gx::shader_vertex_color_attr(config, 0), -1);
+  EXPECT_EQ(aurora::gx::shader_vertex_color_attr(config, 1), -1);
+
+  config.attrs[GX_VA_CLR1].attrType = GX_DIRECT;
+  EXPECT_EQ(aurora::gx::shader_vertex_color_attr(config, 0), GX_VA_CLR1);
+  EXPECT_EQ(aurora::gx::shader_vertex_color_attr(config, 1), -1);
+
+  config.attrs[GX_VA_CLR0].attrType = GX_DIRECT;
+  EXPECT_EQ(aurora::gx::shader_vertex_color_attr(config, 0), GX_VA_CLR0);
+  EXPECT_EQ(aurora::gx::shader_vertex_color_attr(config, 1), GX_VA_CLR1);
+
+  config.attrs[GX_VA_CLR1].attrType = GX_NONE;
+  EXPECT_EQ(aurora::gx::shader_vertex_color_attr(config, 0), GX_VA_CLR0);
+  EXPECT_EQ(aurora::gx::shader_vertex_color_attr(config, 1), -1);
+}
+
+TEST(TevTexcoordStateContract, DirectStageFeedsFollowingAddPrevInFixedPoint) {
+  aurora::gx::ShaderConfig config{};
+  config.numTexGens = 2;
+  config.numIndStages = 1;
+  config.tevStageCount = 2;
+  config.indStages[0].texCoordId = GX_TEXCOORD0;
+  config.indStages[0].texMapId = GX_TEXMAP0;
+  config.indStages[0].scaleS = GX_ITS_1;
+  config.indStages[0].scaleT = GX_ITS_1;
+
+  config.tevStages[0].texCoordId = GX_TEXCOORD1;
+  config.tevStages[0].texMapId = GX_TEXMAP_NULL;
+  config.tevStages[0].indTexMtxId = GX_ITM_OFF;
+  config.tevStages[1].indTexMtxId = GX_ITM_1;
+  config.tevStages[1].indTexAddPrev = true;
+  config.tevStages[1].indTexWrapS = GX_ITW_0;
+  config.tevStages[1].indTexWrapT = GX_ITW_0;
+  config.tevStages[1].texCoordId = GX_TEXCOORD_NULL;
+  config.tevStages[1].texMapId = GX_TEXMAP1;
+  config.tevStages[1].colorPass.d = GX_CC_TEXC;
+
+  // Stage 0 is direct and stage 1 consumes the coordinate it establishes. Disabling stage 1's
+  // texture map does not stop that update, so its GX_TEXCOORD_NULL resolves to coord 0.
+  const auto directDependency = aurora::gx::tev_stage_texture_dependency(config, 0);
+  const auto indirectDependency = aurora::gx::tev_stage_texture_dependency(config, 1);
+  EXPECT_EQ(directDependency.texCoordId, 1);
+  EXPECT_EQ(directDependency.texMapId, -1);
+  EXPECT_TRUE(directDependency.needsFixedTexcoordState);
+  EXPECT_FALSE(directDependency.canSampleTexture);
+  EXPECT_EQ(indirectDependency.texCoordId, 0);
+  EXPECT_EQ(indirectDependency.texMapId, 1);
+  EXPECT_TRUE(indirectDependency.needsFixedTexcoordState);
+  EXPECT_TRUE(indirectDependency.combinerUsesTexture);
+  EXPECT_TRUE(indirectDependency.canSampleTexture);
+  EXPECT_TRUE(aurora::gx::shader_uses_fixed_texcoord_state(config));
+
+  // The production ShaderInfo implementation, not the old empty stub: both effective coords, the
+  // regular texture and the indirect lookup have to appear in the binding contract.
+  const auto info = aurora::gx::build_shader_info(config);
+  EXPECT_TRUE(info.sampledTexCoords.test(0));
+  EXPECT_TRUE(info.sampledTexCoords.test(1));
+  EXPECT_TRUE(info.sampledTextures.test(0));
+  EXPECT_TRUE(info.sampledTextures.test(1));
+  EXPECT_TRUE(info.usedIndStages.test(0));
+  EXPECT_TRUE(info.usedIndTexMtxs.test(GX_ITM_1 - GX_ITM_0));
+  EXPECT_EQ(aurora::gx::tev_indirect_wrap_mask(GX_ITW_256), 0x7fff);
+  EXPECT_EQ(aurora::gx::tev_indirect_wrap_mask(static_cast<GXIndTexWrap>(GX_MAX_ITWRAP)), 0);
+  EXPECT_EQ(aurora::gx::indirect_matrix_mantissa(0.5f), 512);
+  EXPECT_EQ(aurora::gx::indirect_matrix_mantissa(-0.5f), -512);
+  EXPECT_EQ(aurora::gx::indirect_matrix_shift(3), -3);
+  EXPECT_EQ(aurora::gx::indirect_matrix_shift(-5), 5);
+  EXPECT_EQ(aurora::gx::tev_s24_wrap(0x007fffff), 0x007fffff);
+  EXPECT_EQ(aurora::gx::tev_s24_wrap(0x00800000), -0x00800000);
+  EXPECT_EQ(aurora::gx::tev_s24_wrap(-0x00800000), -0x00800000);
+  EXPECT_EQ(aurora::gx::tev_s24_wrap(-0x00800001), 0x007fffff);
+
+  config.tevStages[1].texMapId = GX_TEXMAP_NULL;
+  EXPECT_FALSE(aurora::gx::tev_stage_texture_dependency(config, 1).canSampleTexture);
+  config.tevStages[1].texMapId = GX_TEXMAP1;
+
+  // No regular texture lookup occurs with zero texgens, but an enabled
+  // indirect stage still samples its texture at the literal zero coordinate.
+  config.numTexGens = 0;
+  EXPECT_EQ(aurora::gx::tev_stage_texture_dependency(config, 1).texCoordId, -1);
+  EXPECT_FALSE(aurora::gx::tev_stage_texture_dependency(config, 1).canSampleTexture);
+  const auto zeroTexgenInfo = aurora::gx::build_shader_info(config);
+  EXPECT_FALSE(zeroTexgenInfo.sampledTexCoords.any());
+  EXPECT_TRUE(zeroTexgenInfo.sampledTextures.test(0));
+  EXPECT_FALSE(zeroTexgenInfo.sampledTextures.test(1));
+  // WGSL must likewise avoid producing a regular-texture UV expression for
+  // stage 1: tex1_size_bias is intentionally absent from this uniform layout.
+  const auto zeroTexgenDependency = aurora::gx::tev_stage_texture_dependency(config, 1);
+  EXPECT_FALSE(aurora::gx::tev_texture_sample_enabled(zeroTexgenDependency,
+                                                      zeroTexgenDependency.combinerUsesTexture));
+
+  // A standalone direct stage still uses the normalized fast path.
+  config.numTexGens = 2;
+  config.tevStageCount = 1;
+  config.tevStages[1] = {};
+  config.tevStages[0].texMapId = GX_TEXMAP1;
+  config.tevStages[0].colorPass.d = GX_CC_TEXC;
+  const auto directSampleDependency = aurora::gx::tev_stage_texture_dependency(config, 0);
+  EXPECT_FALSE(directSampleDependency.needsFixedTexcoordState);
+  EXPECT_TRUE(directSampleDependency.combinerUsesTexture);
+  EXPECT_TRUE(directSampleDependency.canSampleTexture);
+  const auto directInfo = aurora::gx::build_shader_info(config);
+  EXPECT_TRUE(directInfo.sampledTexCoords.test(1));
+  EXPECT_TRUE(directInfo.sampledTextures.test(1));
+
+  // Z-texture remains enabled even without a regular source stage; the shader
+  // applies its bias/op to a zero raw texture value in that case.
+  config.tevStages[0].texMapId = GX_TEXMAP_NULL;
+  config.tevStages[0].colorPass.d = GX_CC_ZERO;
+  config.zTexture = static_cast<u32>(GX_ZT_REPLACE) << 26;
+  EXPECT_TRUE(aurora::gx::tev_z_texture_enabled(config));
+  EXPECT_EQ(aurora::gx::tev_z_texture_stage(config), -1);
+
+}
+
+TEST(TevRegisterLivenessContract, RgbWriteDoesNotHideSameStageOldAlphaRead) {
+  aurora::gx::ShaderConfig config{};
+  config.tevStageCount = 1;
+  config.tevStages[0].colorOp.outReg = GX_TEVREG0;
+  config.tevStages[0].alphaPass.d = GX_CA_A0;
+
+  const auto info = aurora::gx::build_shader_info(config);
+  EXPECT_TRUE(info.writesTevRegRgb.test(GX_TEVREG0));
+  EXPECT_FALSE(info.writesTevRegAlpha.test(GX_TEVREG0));
+  EXPECT_FALSE(info.loadsTevRegRgb.test(GX_TEVREG0));
+  EXPECT_TRUE(info.loadsTevRegAlpha.test(GX_TEVREG0));
+}
+
+TEST(TevRegisterLivenessContract, TracksOppositeHalvesIndependentlyAcrossStages) {
+  aurora::gx::ShaderConfig config{};
+  config.tevStageCount = 2;
+  config.tevStages[0].colorOp.outReg = GX_TEVREG0;
+  config.tevStages[0].alphaOp.outReg = GX_TEVREG1;
+  config.tevStages[1].colorPass.a = GX_CC_C1;
+  config.tevStages[1].alphaPass.a = GX_CA_A0;
+
+  const auto info = aurora::gx::build_shader_info(config);
+  EXPECT_TRUE(info.loadsTevRegAlpha.test(GX_TEVREG0));
+  EXPECT_FALSE(info.loadsTevRegRgb.test(GX_TEVREG0));
+  EXPECT_TRUE(info.loadsTevRegRgb.test(GX_TEVREG1));
+  EXPECT_FALSE(info.loadsTevRegAlpha.test(GX_TEVREG1));
+}
+
+TEST(TevRegisterLivenessContract, PacksOneUniformWhenBothHalvesNeedInitialValue) {
+  aurora::gx::ShaderConfig baseline{};
+  baseline.tevStageCount = 1;
+
+  auto config = baseline;
+  config.tevStages[0].colorPass.a = GX_CC_C0;
+  config.tevStages[0].alphaPass.a = GX_CA_A0;
+
+  const auto baselineInfo = aurora::gx::build_shader_info(baseline);
+  const auto info = aurora::gx::build_shader_info(config);
+  EXPECT_TRUE(info.loadsTevRegRgb.test(GX_TEVREG0));
+  EXPECT_TRUE(info.loadsTevRegAlpha.test(GX_TEVREG0));
+  EXPECT_EQ(info.uniformSize, baselineInfo.uniformSize + sizeof(aurora::Vec4<float>));
+}
+
+// BP registers (direct FIFO writes, no dirty state flush needed)
+
+// --- GXSetBlendMode (BP 0x41) ---
+
+TEST_F(GXFifoTest, BlendMode_Blend_SrcAlpha) {
+  GXSetBlendMode(GX_BM_BLEND, GX_BL_SRCALPHA, GX_BL_INVSRCALPHA, GX_LO_NOOP);
+  auto bytes = capture_fifo();
+
+  // Validate encoding: BP opcode 0x61, register ID 0x41
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0x41);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.blendMode, GX_BM_BLEND);
+  EXPECT_EQ(g_gxState.blendFacSrc, GX_BL_SRCALPHA);
+  EXPECT_EQ(g_gxState.blendFacDst, GX_BL_INVSRCALPHA);
+}
+
+TEST_F(GXFifoTest, BlendMode_None) {
+  GXSetBlendMode(GX_BM_NONE, GX_BL_ZERO, GX_BL_ZERO, GX_LO_CLEAR);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  // Pre-set to something else to prove the decode works
+  g_gxState.blendMode = GX_BM_BLEND;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.blendMode, GX_BM_NONE);
+}
+
+TEST_F(GXFifoTest, BlendMode_Subtract) {
+  GXSetBlendMode(GX_BM_SUBTRACT, GX_BL_ONE, GX_BL_ONE, GX_LO_NOOP);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.blendMode, GX_BM_SUBTRACT);
+}
+
+TEST_F(GXFifoTest, BlendMode_Logic) {
+  GXSetBlendMode(GX_BM_LOGIC, GX_BL_ONE, GX_BL_ZERO, GX_LO_XOR);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.blendMode, GX_BM_LOGIC);
+  EXPECT_EQ(g_gxState.blendOp, GX_LO_XOR);
+}
+
+TEST_F(GXFifoTest, BpMask_AppliesOnlyToNextWrite) {
+  std::vector<u8> bytes;
+  auto mask = bp_cmd(0xFE, 1u << 19);
+  auto genMode = bp_cmd(0x00, 1u << 19);
+  auto cullAndInd = bp_cmd(0x00, (2u << 14) | (3u << 16));
+  bytes.insert(bytes.end(), mask.begin(), mask.end());
+  bytes.insert(bytes.end(), genMode.begin(), genMode.end());
+  bytes.insert(bytes.end(), cullAndInd.begin(), cullAndInd.end());
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.bpRegCache[0x00] & (1u << 19), 0u);
+  EXPECT_EQ(g_gxState.cullMode, GX_CULL_FRONT);
+  EXPECT_EQ(g_gxState.numIndStages, 3u);
+}
+
+TEST_F(GXFifoTest, IndirectTextureMask_DecodesWithoutChangingBpWriteMask) {
+  auto bytes = bp_cmd(0x0F, 0x5A);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.indTexMask, 0x5Au);
+  EXPECT_EQ(g_gxState.bpRegCache[0x0F], 0x0F00005Au);
+  EXPECT_EQ(g_gxState.bpRegCache[0xFE], 0x00FFFFFFu);
+}
+
+// --- GXSetColorUpdate / GXSetAlphaUpdate (BP 0x41 cmode0) ---
+
+TEST_F(GXFifoTest, ColorUpdate_Disabled) {
+  GXSetColorUpdate(GX_FALSE);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  g_gxState.colorUpdate = true;
+  decode_fifo(bytes);
+
+  EXPECT_FALSE(g_gxState.colorUpdate);
+}
+
+TEST_F(GXFifoTest, AlphaUpdate_Disabled) {
+  GXSetAlphaUpdate(false);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  g_gxState.alphaUpdate = true;
+  decode_fifo(bytes);
+
+  EXPECT_FALSE(g_gxState.alphaUpdate);
+}
+
+// --- GXSetZMode (BP 0x40) ---
+
+TEST_F(GXFifoTest, ZMode_LessNoUpdate) {
+  GXSetZMode(true, GX_LESS, false);
+  auto bytes = capture_fifo();
+
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0x40);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_TRUE(g_gxState.depthCompare);
+  EXPECT_EQ(g_gxState.depthFunc, GX_LESS);
+  EXPECT_FALSE(g_gxState.depthUpdate);
+}
+
+TEST_F(GXFifoTest, ZMode_AlwaysUpdate) {
+  GXSetZMode(true, GX_ALWAYS, true);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_TRUE(g_gxState.depthCompare);
+  EXPECT_EQ(g_gxState.depthFunc, GX_ALWAYS);
+  EXPECT_TRUE(g_gxState.depthUpdate);
+}
+
+TEST_F(GXFifoTest, ZMode_Disabled) {
+  GXSetZMode(false, GX_NEVER, false);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_FALSE(g_gxState.depthCompare);
+  EXPECT_EQ(g_gxState.depthFunc, GX_NEVER);
+  EXPECT_FALSE(g_gxState.depthUpdate);
+}
+
+TEST_F(GXFifoTest, ZTexture_ReplaceZ24X8) {
+  GXSetZTexture(GX_ZT_REPLACE, GX_TF_Z24X8, 0x123456);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_bp_write(bytes, 0xF4));
+  EXPECT_TRUE(has_bp_write(bytes, 0xF5));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.zTextureBias, 0x123456u);
+  EXPECT_EQ(g_gxState.zTextureFmt, 2u);
+  EXPECT_EQ(g_gxState.zTextureOp, GX_ZT_REPLACE);
+}
+
+// --- GXSetAlphaCompare (BP 0xF3) ---
+
+TEST_F(GXFifoTest, AlphaCompare_GreaterThan128) {
+  GXSetAlphaCompare(GX_GREATER, 128, GX_AOP_AND, GX_ALWAYS, 0);
+  auto bytes = capture_fifo();
+
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0xF3);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.alphaCompare.comp0, GX_GREATER);
+  EXPECT_EQ(g_gxState.alphaCompare.ref0, 128u);
+  EXPECT_EQ(g_gxState.alphaCompare.op, GX_AOP_AND);
+  EXPECT_EQ(g_gxState.alphaCompare.comp1, GX_ALWAYS);
+  EXPECT_EQ(g_gxState.alphaCompare.ref1, 0u);
+}
+
+TEST_F(GXFifoTest, AlphaCompare_OrGequal) {
+  GXSetAlphaCompare(GX_GEQUAL, 64, GX_AOP_OR, GX_LEQUAL, 200);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.alphaCompare.comp0, GX_GEQUAL);
+  EXPECT_EQ(g_gxState.alphaCompare.ref0, 64u);
+  EXPECT_EQ(g_gxState.alphaCompare.op, GX_AOP_OR);
+  EXPECT_EQ(g_gxState.alphaCompare.comp1, GX_LEQUAL);
+  EXPECT_EQ(g_gxState.alphaCompare.ref1, 200u);
+}
+
+// --- GXSetDstAlpha (BP 0x42) ---
+
+TEST_F(GXFifoTest, DstAlpha_Enabled) {
+  GXSetDstAlpha(true, 0x80);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  g_gxState.dstAlpha = UINT32_MAX;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.dstAlpha, 0x80u);
+}
+
+TEST_F(GXFifoTest, DstAlpha_Disabled) {
+  GXSetDstAlpha(false, 0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  g_gxState.dstAlpha = 0x80;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.dstAlpha, UINT32_MAX);
+}
+
+// --- GXSetPixelFmt (BP 0x43, 0x42 + genMode flush) ---
+
+TEST_F(GXFifoTest, PixelFmt_Rgb565Z16_Decode) {
+  GXSetPixelFmt(GX_PF_RGB565_Z16, GX_ZC_FAR);
+  auto bytes = flush_and_capture();
+
+  EXPECT_TRUE(has_bp_write(bytes, 0x43));
+  EXPECT_TRUE(has_bp_write(bytes, 0x00));
+
+  reset_gx_state();
+  g_gxState.pixelFmt = GX_PF_RGB8_Z24;
+  g_gxState.zFmt = GX_ZC_LINEAR;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.pixelFmt, GX_PF_RGB565_Z16);
+  EXPECT_EQ(g_gxState.zFmt, GX_ZC_FAR);
+  EXPECT_TRUE(g_gxState.zCompLocBeforeTex);
+}
+
+TEST_F(GXFifoTest, PixelFmt_U8_Decode) {
+  GXSetPixelFmt(GX_PF_U8, GX_ZC_MID);
+  auto bytes = flush_and_capture();
+
+  EXPECT_TRUE(has_bp_write(bytes, 0x43));
+  EXPECT_TRUE(has_bp_write(bytes, 0x42));
+  EXPECT_TRUE(has_bp_write(bytes, 0x00));
+
+  reset_gx_state();
+  g_gxState.pixelFmt = GX_PF_RGB8_Z24;
+  g_gxState.zFmt = GX_ZC_LINEAR;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.pixelFmt, GX_PF_U8);
+  EXPECT_EQ(g_gxState.zFmt, GX_ZC_MID);
+  EXPECT_EQ(g_gxState.dstAlpha, UINT32_MAX);
+  EXPECT_TRUE(g_gxState.zCompLocBeforeTex);
+}
+
+// TEV registers (direct FIFO writes)
+
+// --- GXSetTevColorIn / GXSetTevAlphaIn ---
+
+TEST_F(GXFifoTest, TevColorIn_Stage0) {
+  GXSetTevColorIn(GX_TEVSTAGE0, GX_CC_ZERO, GX_CC_TEXC, GX_CC_RASC, GX_CC_ZERO);
+  auto bytes = capture_fifo();
+
+  // BP opcode 0x61, register 0xC0 (stage 0 color)
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0xC0);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  EXPECT_EQ(s.colorPass.a, GX_CC_ZERO);
+  EXPECT_EQ(s.colorPass.b, GX_CC_TEXC);
+  EXPECT_EQ(s.colorPass.c, GX_CC_RASC);
+  EXPECT_EQ(s.colorPass.d, GX_CC_ZERO);
+}
+
+TEST_F(GXFifoTest, TevAlphaIn_Stage0) {
+  GXSetTevAlphaIn(GX_TEVSTAGE0, GX_CA_ZERO, GX_CA_TEXA, GX_CA_RASA, GX_CA_ZERO);
+  auto bytes = capture_fifo();
+
+  // BP opcode 0x61, register 0xC1 (stage 0 alpha)
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0xC1);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  EXPECT_EQ(s.alphaPass.a, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.b, GX_CA_TEXA);
+  EXPECT_EQ(s.alphaPass.c, GX_CA_RASA);
+  EXPECT_EQ(s.alphaPass.d, GX_CA_ZERO);
+}
+
+TEST_F(GXFifoTest, TevAlphaIn_Stage5) {
+  GXSetTevAlphaIn(GX_TEVSTAGE5, GX_CA_APREV, GX_CA_A0, GX_CA_KONST, GX_CA_ZERO);
+  auto bytes = capture_fifo();
+
+  // Stage 5 alpha register = 0xC1 + 5*2 = 0xCB
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0xCB);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[5];
+  EXPECT_EQ(s.alphaPass.a, GX_CA_APREV);
+  EXPECT_EQ(s.alphaPass.b, GX_CA_A0);
+  EXPECT_EQ(s.alphaPass.c, GX_CA_KONST);
+  EXPECT_EQ(s.alphaPass.d, GX_CA_ZERO);
+}
+
+TEST_F(GXFifoTest, TevColorIn_Stage7) {
+  GXSetTevColorIn(GX_TEVSTAGE7, GX_CC_C0, GX_CC_A0, GX_CC_KONST, GX_CC_CPREV);
+  auto bytes = capture_fifo();
+
+  // Stage 7 color register = 0xC0 + 7*2 = 0xCE
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0xCE);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[7];
+  EXPECT_EQ(s.colorPass.a, GX_CC_C0);
+  EXPECT_EQ(s.colorPass.b, GX_CC_A0);
+  EXPECT_EQ(s.colorPass.c, GX_CC_KONST);
+  EXPECT_EQ(s.colorPass.d, GX_CC_CPREV);
+}
+
+// --- GXSetTevOp (convenience wrapper over ColorIn/AlphaIn/ColorOp/AlphaOp) ---
+// GXSetTevOp emits 4 BP writes: tevc (colorIn+colorOp) and teva (alphaIn+alphaOp).
+
+TEST_F(GXFifoTest, TevOp_Modulate_Stage0) {
+  GXSetTevOp(GX_TEVSTAGE0, GX_MODULATE);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  // Modulate: color = ZERO, TEXC, RASC, ZERO (stage 0 uses RASC/RASA)
+  EXPECT_EQ(s.colorPass.a, GX_CC_ZERO);
+  EXPECT_EQ(s.colorPass.b, GX_CC_TEXC);
+  EXPECT_EQ(s.colorPass.c, GX_CC_RASC);
+  EXPECT_EQ(s.colorPass.d, GX_CC_ZERO);
+  // Modulate: alpha = ZERO, TEXA, RASA, ZERO
+  EXPECT_EQ(s.alphaPass.a, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.b, GX_CA_TEXA);
+  EXPECT_EQ(s.alphaPass.c, GX_CA_RASA);
+  EXPECT_EQ(s.alphaPass.d, GX_CA_ZERO);
+  // Op = ADD, bias = ZERO, scale = 1, clamp = true, outReg = TEVPREV
+  EXPECT_EQ(s.colorOp.op, GX_TEV_ADD);
+  EXPECT_EQ(s.colorOp.bias, GX_TB_ZERO);
+  EXPECT_EQ(s.colorOp.scale, GX_CS_SCALE_1);
+  EXPECT_TRUE(s.colorOp.clamp);
+  EXPECT_EQ(s.colorOp.outReg, GX_TEVPREV);
+  EXPECT_EQ(s.alphaOp.op, GX_TEV_ADD);
+  EXPECT_EQ(s.alphaOp.bias, GX_TB_ZERO);
+  EXPECT_EQ(s.alphaOp.scale, GX_CS_SCALE_1);
+  EXPECT_TRUE(s.alphaOp.clamp);
+  EXPECT_EQ(s.alphaOp.outReg, GX_TEVPREV);
+}
+
+TEST_F(GXFifoTest, TevOp_Modulate_Stage1) {
+  // Non-stage-0 uses CPREV/APREV instead of RASC/RASA
+  GXSetTevOp(GX_TEVSTAGE1, GX_MODULATE);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[1];
+  EXPECT_EQ(s.colorPass.a, GX_CC_ZERO);
+  EXPECT_EQ(s.colorPass.b, GX_CC_TEXC);
+  EXPECT_EQ(s.colorPass.c, GX_CC_CPREV);
+  EXPECT_EQ(s.colorPass.d, GX_CC_ZERO);
+  EXPECT_EQ(s.alphaPass.a, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.b, GX_CA_TEXA);
+  EXPECT_EQ(s.alphaPass.c, GX_CA_APREV);
+  EXPECT_EQ(s.alphaPass.d, GX_CA_ZERO);
+}
+
+TEST_F(GXFifoTest, TevOp_Replace) {
+  GXSetTevOp(GX_TEVSTAGE0, GX_REPLACE);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  // Replace: color = ZERO, ZERO, ZERO, TEXC
+  EXPECT_EQ(s.colorPass.a, GX_CC_ZERO);
+  EXPECT_EQ(s.colorPass.b, GX_CC_ZERO);
+  EXPECT_EQ(s.colorPass.c, GX_CC_ZERO);
+  EXPECT_EQ(s.colorPass.d, GX_CC_TEXC);
+  // Replace: alpha = ZERO, ZERO, ZERO, TEXA
+  EXPECT_EQ(s.alphaPass.a, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.b, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.c, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.d, GX_CA_TEXA);
+}
+
+TEST_F(GXFifoTest, TevOp_Decal) {
+  GXSetTevOp(GX_TEVSTAGE0, GX_DECAL);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  // Decal: color = RASC, TEXC, TEXA, ZERO
+  EXPECT_EQ(s.colorPass.a, GX_CC_RASC);
+  EXPECT_EQ(s.colorPass.b, GX_CC_TEXC);
+  EXPECT_EQ(s.colorPass.c, GX_CC_TEXA);
+  EXPECT_EQ(s.colorPass.d, GX_CC_ZERO);
+  // Decal: alpha = ZERO, ZERO, ZERO, RASA
+  EXPECT_EQ(s.alphaPass.a, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.b, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.c, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.d, GX_CA_RASA);
+}
+
+TEST_F(GXFifoTest, TevOp_Blend) {
+  GXSetTevOp(GX_TEVSTAGE0, GX_BLEND);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  // Blend: color = RASC, ONE, TEXC, ZERO
+  EXPECT_EQ(s.colorPass.a, GX_CC_RASC);
+  EXPECT_EQ(s.colorPass.b, GX_CC_ONE);
+  EXPECT_EQ(s.colorPass.c, GX_CC_TEXC);
+  EXPECT_EQ(s.colorPass.d, GX_CC_ZERO);
+  // Blend: alpha = ZERO, TEXA, RASA, ZERO
+  EXPECT_EQ(s.alphaPass.a, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.b, GX_CA_TEXA);
+  EXPECT_EQ(s.alphaPass.c, GX_CA_RASA);
+  EXPECT_EQ(s.alphaPass.d, GX_CA_ZERO);
+}
+
+TEST_F(GXFifoTest, TevOp_PassClr) {
+  GXSetTevOp(GX_TEVSTAGE0, GX_PASSCLR);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  // PassClr: color = ZERO, ZERO, ZERO, RASC
+  EXPECT_EQ(s.colorPass.a, GX_CC_ZERO);
+  EXPECT_EQ(s.colorPass.b, GX_CC_ZERO);
+  EXPECT_EQ(s.colorPass.c, GX_CC_ZERO);
+  EXPECT_EQ(s.colorPass.d, GX_CC_RASC);
+  // PassClr: alpha = ZERO, ZERO, ZERO, RASA
+  EXPECT_EQ(s.alphaPass.a, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.b, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.c, GX_CA_ZERO);
+  EXPECT_EQ(s.alphaPass.d, GX_CA_RASA);
+}
+
+// --- GXSetTevColorOp / GXSetTevAlphaOp ---
+
+TEST_F(GXFifoTest, TevColorOp_Sub_Scale2_Reg1) {
+  GXSetTevColorOp(GX_TEVSTAGE0, GX_TEV_SUB, GX_TB_ADDHALF, GX_CS_SCALE_2, GX_TRUE, GX_TEVREG1);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  EXPECT_EQ(s.colorOp.op, GX_TEV_SUB);
+  EXPECT_EQ(s.colorOp.bias, GX_TB_ADDHALF);
+  EXPECT_EQ(s.colorOp.scale, GX_CS_SCALE_2);
+  EXPECT_TRUE(s.colorOp.clamp);
+  EXPECT_EQ(s.colorOp.outReg, GX_TEVREG1);
+}
+
+TEST_F(GXFifoTest, TevAlphaOp_Add_NoClamp_Reg2) {
+  GXSetTevAlphaOp(GX_TEVSTAGE0, GX_TEV_ADD, GX_TB_SUBHALF, GX_CS_DIVIDE_2, GX_FALSE, GX_TEVREG2);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  EXPECT_EQ(s.alphaOp.op, GX_TEV_ADD);
+  EXPECT_EQ(s.alphaOp.bias, GX_TB_SUBHALF);
+  EXPECT_EQ(s.alphaOp.scale, GX_CS_DIVIDE_2);
+  EXPECT_FALSE(s.alphaOp.clamp);
+  EXPECT_EQ(s.alphaOp.outReg, GX_TEVREG2);
+}
+
+TEST_F(GXFifoTest, TevColorOp_CompareR8GT) {
+  // Compare ops (op > 1) use a different encoding: bias=3, scale encodes compare mode
+  GXSetTevColorOp(GX_TEVSTAGE0, GX_TEV_COMP_R8_GT, GX_TB_ZERO, GX_CS_SCALE_1, GX_TRUE, GX_TEVPREV);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  EXPECT_EQ(s.colorOp.op, GX_TEV_COMP_R8_GT);
+  // Decoder normalizes compare mode: bias=ZERO, scale=SCALE_1
+  EXPECT_EQ(s.colorOp.bias, GX_TB_ZERO);
+  EXPECT_EQ(s.colorOp.scale, GX_CS_SCALE_1);
+  EXPECT_EQ(s.colorOp.outReg, GX_TEVPREV);
+}
+
+TEST_F(GXFifoTest, TevColorOp_CompareGR16EQ) {
+  GXSetTevColorOp(GX_TEVSTAGE0, GX_TEV_COMP_GR16_EQ, GX_TB_ZERO, GX_CS_SCALE_1, GX_TRUE, GX_TEVREG0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  EXPECT_EQ(s.colorOp.op, GX_TEV_COMP_GR16_EQ);
+  EXPECT_EQ(s.colorOp.outReg, GX_TEVREG0);
+}
+
+TEST_F(GXFifoTest, TevAlphaOp_CompareRGB8GT) {
+  GXSetTevAlphaOp(GX_TEVSTAGE0, GX_TEV_COMP_RGB8_GT, GX_TB_ZERO, GX_CS_SCALE_1, GX_TRUE, GX_TEVPREV);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  // GX_TEV_COMP_RGB8_GT is the same enum value for alpha as GX_TEV_COMP_A8_GT
+  EXPECT_EQ(s.alphaOp.op, GX_TEV_COMP_RGB8_GT);
+  EXPECT_EQ(s.alphaOp.bias, GX_TB_ZERO);
+  EXPECT_EQ(s.alphaOp.scale, GX_CS_SCALE_1);
+}
+
+TEST_F(GXFifoTest, TevColorOp_CompareBGR24GT) {
+  GXSetTevColorOp(GX_TEVSTAGE2, GX_TEV_COMP_BGR24_GT, GX_TB_ZERO, GX_CS_SCALE_1, GX_TRUE, GX_TEVREG1);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[2];
+  EXPECT_EQ(s.colorOp.op, GX_TEV_COMP_BGR24_GT);
+  EXPECT_EQ(s.colorOp.bias, GX_TB_ZERO);
+  EXPECT_EQ(s.colorOp.scale, GX_CS_SCALE_1);
+  EXPECT_EQ(s.colorOp.outReg, GX_TEVREG1);
+}
+
+TEST_F(GXFifoTest, TevColorOp_CompareRGB8EQ) {
+  GXSetTevColorOp(GX_TEVSTAGE0, GX_TEV_COMP_RGB8_EQ, GX_TB_ZERO, GX_CS_SCALE_1, GX_TRUE, GX_TEVPREV);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  EXPECT_EQ(s.colorOp.op, GX_TEV_COMP_RGB8_EQ);
+  EXPECT_EQ(s.colorOp.outReg, GX_TEVPREV);
+}
+
+TEST_F(GXFifoTest, TevAlphaOp_CompareA8EQ) {
+  GXSetTevAlphaOp(GX_TEVSTAGE1, GX_TEV_COMP_RGB8_EQ, GX_TB_ZERO, GX_CS_SCALE_1, GX_TRUE, GX_TEVREG2);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[1];
+  // For alpha, GX_TEV_COMP_RGB8_EQ maps to A8_EQ
+  EXPECT_EQ(s.alphaOp.op, GX_TEV_COMP_RGB8_EQ);
+  EXPECT_EQ(s.alphaOp.outReg, GX_TEVREG2);
+}
+
+// --- GXSetTevColorS10 ---
+
+TEST_F(GXFifoTest, TevColorS10_Positive) {
+  GXColorS10 col = {511, 256, 100, 0};
+  GXSetTevColorS10(GX_TEVREG0, col);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // S10 values are encoded as 11-bit signed and decoded to float/255
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][0], 511.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][1], 256.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][2], 100.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][3], 0.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, TevColorS10_Negative) {
+  GXColorS10 col = {-128, -1, 0, 255};
+  GXSetTevColorS10(GX_TEVPREV, col);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVPREV][0], -128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVPREV][1], -1.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVPREV][2], 0.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVPREV][3], 255.f / 255.f, 1.f / 255.f);
+}
+
+// --- GXSetTevKColorSel / GXSetTevKAlphaSel ---
+
+TEST_F(GXFifoTest, TevKColorSel_Stage0_K0) {
+  GXSetTevKColorSel(GX_TEVSTAGE0, GX_TEV_KCSEL_K0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tevStages[0].kcSel, GX_TEV_KCSEL_K0);
+}
+
+TEST_F(GXFifoTest, TevKColorSel_Stage1_K2_R) {
+  GXSetTevKColorSel(GX_TEVSTAGE1, GX_TEV_KCSEL_K2_R);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tevStages[1].kcSel, GX_TEV_KCSEL_K2_R);
+}
+
+TEST_F(GXFifoTest, TevKAlphaSel_Stage0_K1_A) {
+  GXSetTevKAlphaSel(GX_TEVSTAGE0, GX_TEV_KASEL_K1_A);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tevStages[0].kaSel, GX_TEV_KASEL_K1_A);
+}
+
+TEST_F(GXFifoTest, TevKAlphaSel_Stage3_K3_B) {
+  GXSetTevKAlphaSel(GX_TEVSTAGE3, GX_TEV_KASEL_K3_B);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tevStages[3].kaSel, GX_TEV_KASEL_K3_B);
+}
+
+TEST_F(GXFifoTest, TevKColorSel_DoesNotCorruptSwapTable) {
+  // Regression: tevKsel shadow registers share bits with swap table entries.
+  // Setting K color selection must not zero out the swap table bits.
+  GXSetTevKColorSel(GX_TEVSTAGE0, GX_TEV_KCSEL_K0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // Swap table 0 should remain identity (initialized in GXInit)
+  EXPECT_EQ(g_gxState.tevSwapTable[0].red, GX_CH_RED);
+  EXPECT_EQ(g_gxState.tevSwapTable[0].green, GX_CH_GREEN);
+  EXPECT_EQ(g_gxState.tevSwapTable[0].blue, GX_CH_BLUE);
+  EXPECT_EQ(g_gxState.tevSwapTable[0].alpha, GX_CH_ALPHA);
+  // K color selection should still be set
+  EXPECT_EQ(g_gxState.tevStages[0].kcSel, GX_TEV_KCSEL_K0);
+}
+
+// --- GXSetTevSwapMode ---
+
+TEST_F(GXFifoTest, TevSwapMode_Stage0) {
+  GXSetTevSwapMode(GX_TEVSTAGE0, GX_TEV_SWAP1, GX_TEV_SWAP2);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tevStages[0].tevSwapRas, GX_TEV_SWAP1);
+  EXPECT_EQ(g_gxState.tevStages[0].tevSwapTex, GX_TEV_SWAP2);
+}
+
+TEST_F(GXFifoTest, TevSwapMode_Stage3) {
+  GXSetTevSwapMode(GX_TEVSTAGE3, GX_TEV_SWAP3, GX_TEV_SWAP0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tevStages[3].tevSwapRas, GX_TEV_SWAP3);
+  EXPECT_EQ(g_gxState.tevStages[3].tevSwapTex, GX_TEV_SWAP0);
+}
+
+// --- GXSetTevSwapModeTable ---
+
+TEST_F(GXFifoTest, TevSwapModeTable_Swap1_AllRed) {
+  GXSetTevSwapModeTable(GX_TEV_SWAP1, GX_CH_RED, GX_CH_RED, GX_CH_RED, GX_CH_ALPHA);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tevSwapTable[GX_TEV_SWAP1].red, GX_CH_RED);
+  EXPECT_EQ(g_gxState.tevSwapTable[GX_TEV_SWAP1].green, GX_CH_RED);
+  EXPECT_EQ(g_gxState.tevSwapTable[GX_TEV_SWAP1].blue, GX_CH_RED);
+  EXPECT_EQ(g_gxState.tevSwapTable[GX_TEV_SWAP1].alpha, GX_CH_ALPHA);
+}
+
+TEST_F(GXFifoTest, TevSwapModeTable_Swap2_Swizzle) {
+  GXSetTevSwapModeTable(GX_TEV_SWAP2, GX_CH_BLUE, GX_CH_GREEN, GX_CH_RED, GX_CH_ALPHA);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tevSwapTable[GX_TEV_SWAP2].red, GX_CH_BLUE);
+  EXPECT_EQ(g_gxState.tevSwapTable[GX_TEV_SWAP2].green, GX_CH_GREEN);
+  EXPECT_EQ(g_gxState.tevSwapTable[GX_TEV_SWAP2].blue, GX_CH_RED);
+  EXPECT_EQ(g_gxState.tevSwapTable[GX_TEV_SWAP2].alpha, GX_CH_ALPHA);
+}
+
+// --- GXSetTevOrder (BP 0x28-0x2F) ---
+
+TEST_F(GXFifoTest, TevOrder_Stage0) {
+  GXSetTevOrder(GX_TEVSTAGE0, GX_TEXCOORD0, GX_TEXMAP0, GX_COLOR0A0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  EXPECT_EQ(s.texMapId, GX_TEXMAP0);
+  EXPECT_EQ(s.texCoordId, GX_TEXCOORD0);
+  EXPECT_EQ(s.channelId, GX_COLOR0A0);
+}
+
+TEST_F(GXFifoTest, TevOrder_Stage1_OddStage) {
+  // Odd stages use different bit positions within the tref register
+  GXSetTevOrder(GX_TEVSTAGE1, GX_TEXCOORD2, GX_TEXMAP3, GX_COLOR1A1);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[1];
+  EXPECT_EQ(s.texMapId, GX_TEXMAP3);
+  EXPECT_EQ(s.texCoordId, GX_TEXCOORD2);
+  EXPECT_EQ(s.channelId, GX_COLOR1A1);
+}
+
+TEST_F(GXFifoTest, TevOrder_Stage0_TexNull) {
+  GXSetTevOrder(GX_TEVSTAGE0, GX_TEXCOORD_NULL, GX_TEXMAP_NULL, GX_COLOR0A0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& s = g_gxState.tevStages[0];
+  EXPECT_EQ(s.texMapId, GX_TEXMAP_NULL);
+  EXPECT_EQ(s.channelId, GX_COLOR0A0);
+}
+
+// --- GXSetTevKColor (BP 0xE0-0xE7, K color flag) ---
+
+TEST_F(GXFifoTest, TevKColor_K0) {
+  GXColor kc = {255, 128, 64, 32};
+  GXSetTevKColor(GX_KCOLOR0, kc);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // K colors are stored as float (0-1 range), 8-bit precision
+  EXPECT_NEAR(g_gxState.kcolors[0][0], 255.f / 255.f, 1.f / 255.f); // R
+  EXPECT_NEAR(g_gxState.kcolors[0][1], 128.f / 255.f, 1.f / 255.f); // G
+  EXPECT_NEAR(g_gxState.kcolors[0][2], 64.f / 255.f, 1.f / 255.f);  // B
+  EXPECT_NEAR(g_gxState.kcolors[0][3], 32.f / 255.f, 1.f / 255.f);  // A
+}
+
+TEST_F(GXFifoTest, TevKColor_K1) {
+  GXColor kc = {0, 255, 0, 128};
+  GXSetTevKColor(GX_KCOLOR1, kc);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.kcolors[1][0], 0.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.kcolors[1][1], 255.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.kcolors[1][2], 0.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.kcolors[1][3], 128.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, TevKColor_K2) {
+  GXColor kc = {10, 20, 30, 40};
+  GXSetTevKColor(GX_KCOLOR2, kc);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.kcolors[2][0], 10.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.kcolors[2][1], 20.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.kcolors[2][2], 30.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.kcolors[2][3], 40.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, TevKColor_K3) {
+  GXColor kc = {200, 150, 100, 50};
+  GXSetTevKColor(GX_KCOLOR3, kc);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.kcolors[3][0], 200.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.kcolors[3][1], 150.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.kcolors[3][2], 100.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.kcolors[3][3], 50.f / 255.f, 1.f / 255.f);
+}
+
+// GXSetTevColor (BP 0xE0-0xE7): the side channel stores float while the FIFO encodes 11-bit
+// signed, so the decoded value comes back with reduced precision.
+
+TEST_F(GXFifoTest, TevColor_Reg0) {
+  GXColor col = {200, 100, 50, 255};
+  GXSetTevColor(GX_TEVREG0, col);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // 11-bit signed encoding, so values should round-trip within 8-bit range
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][0], 200.f / 255.f, 1.f / 255.f); // R
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][1], 100.f / 255.f, 1.f / 255.f); // G
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][2], 50.f / 255.f, 1.f / 255.f);  // B
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][3], 255.f / 255.f, 1.f / 255.f); // A
+}
+
+TEST_F(GXFifoTest, TevColor_Prev) {
+  GXColor col = {128, 64, 32, 16};
+  GXSetTevColor(GX_TEVPREV, col);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVPREV][0], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVPREV][1], 64.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVPREV][2], 32.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVPREV][3], 16.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, TevColor_Reg1) {
+  GXColor col = {0, 128, 255, 192};
+  GXSetTevColor(GX_TEVREG1, col);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG1][0], 0.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG1][1], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG1][2], 255.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG1][3], 192.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, TevColor_Reg2) {
+  GXColor col = {1, 2, 3, 4};
+  GXSetTevColor(GX_TEVREG2, col);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG2][0], 1.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG2][1], 2.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG2][2], 3.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG2][3], 4.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, TevColorS10_Reg1) {
+  GXColorS10 col = {300, -50, 0, 255};
+  GXSetTevColorS10(GX_TEVREG1, col);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG1][0], 300.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG1][1], -50.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG1][2], 0.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG1][3], 255.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, TevColorS10_Reg2) {
+  GXColorS10 col = {-1024, 1023, 128, -256};
+  GXSetTevColorS10(GX_TEVREG2, col);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG2][0], -1024.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG2][1], 1023.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG2][2], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG2][3], -256.f / 255.f, 1.f / 255.f);
+}
+
+// CP registers (require __GXSetDirtyState() flush)
+
+// --- GXClearVtxDesc ---
+
+TEST_F(GXFifoTest, ClearVtxDesc_ClearsAll) {
+  // Set every attribute to something non-default
+  GXSetVtxDesc(GX_VA_PNMTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX0MTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX1MTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX2MTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX3MTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX4MTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX5MTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX6MTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX7MTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_POS, GX_INDEX16);
+  GXSetVtxDesc(GX_VA_NRM, GX_INDEX8);
+  GXSetVtxDesc(GX_VA_CLR0, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_CLR1, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX0, GX_INDEX16);
+  GXSetVtxDesc(GX_VA_TEX1, GX_INDEX8);
+  GXSetVtxDesc(GX_VA_TEX2, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX3, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX4, GX_INDEX16);
+  GXSetVtxDesc(GX_VA_TEX5, GX_INDEX8);
+  GXSetVtxDesc(GX_VA_TEX6, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX7, GX_DIRECT);
+  // Discard the dirty state from above
+  aurora::gx::fifo::clear_buffer();
+
+  // Now clear and flush
+  GXClearVtxDesc();
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  // Pre-fill g_gxState with non-zero to prove decode clears them
+  for (int i = 0; i < GX_VA_MAX_ATTR; ++i) {
+    g_gxState.vtxDesc[i] = GX_INDEX16;
+  }
+  decode_fifo(bytes);
+
+  // After GXClearVtxDesc: POS = GX_DIRECT, everything else = GX_NONE
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_PNMTXIDX], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX0MTXIDX], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX1MTXIDX], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX2MTXIDX], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX3MTXIDX], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX4MTXIDX], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX5MTXIDX], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX6MTXIDX], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX7MTXIDX], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_POS], GX_DIRECT);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_NRM], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_CLR0], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_CLR1], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX0], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX1], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX2], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX3], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX4], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX5], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX6], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX7], GX_NONE);
+}
+
+// --- GXSetVtxDesc / GXClearVtxDesc ---
+
+TEST_F(GXFifoTest, VtxDesc_PosAndNrm_Direct) {
+  GXClearVtxDesc();
+  GXSetVtxDesc(GX_VA_POS, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_NRM, GX_DIRECT);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_POS], GX_DIRECT);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_NRM], GX_DIRECT);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_CLR0], GX_NONE);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX0], GX_NONE);
+}
+
+TEST_F(GXFifoTest, VtxDesc_Indexed) {
+  GXClearVtxDesc();
+  GXSetVtxDesc(GX_VA_POS, GX_INDEX16);
+  GXSetVtxDesc(GX_VA_NRM, GX_INDEX16);
+  GXSetVtxDesc(GX_VA_CLR0, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX0, GX_INDEX8);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_POS], GX_INDEX16);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_NRM], GX_INDEX16);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_CLR0], GX_DIRECT);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX0], GX_INDEX8);
+  EXPECT_EQ(g_gxState.sourceVtxDesc[GX_VA_POS], GX_INDEX16);
+  EXPECT_EQ(g_gxState.sourceVtxDesc[GX_VA_NRM], GX_INDEX16);
+  EXPECT_EQ(g_gxState.sourceVtxDesc[GX_VA_CLR0], GX_DIRECT);
+  EXPECT_EQ(g_gxState.sourceVtxDesc[GX_VA_TEX0], GX_INDEX8);
+}
+
+TEST_F(GXFifoTest, SourceVtxDesc_DoesNotChangeEmittedLayout) {
+  GXClearVtxDesc();
+  GXSetVtxDesc(GX_VA_POS, GX_DIRECT);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+  GXSetSourceVtxDesc(GX_VA_POS, GX_INDEX16);
+
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_POS], GX_DIRECT);
+  EXPECT_EQ(g_gxState.sourceVtxDesc[GX_VA_POS], GX_INDEX16);
+}
+
+TEST_F(GXFifoTest, VtxDesc_MtxIdx) {
+  GXClearVtxDesc();
+  GXSetVtxDesc(GX_VA_PNMTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_TEX0MTXIDX, GX_DIRECT);
+  GXSetVtxDesc(GX_VA_POS, GX_DIRECT);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_PNMTXIDX], GX_DIRECT);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_TEX0MTXIDX], GX_DIRECT);
+  EXPECT_EQ(g_gxState.vtxDesc[GX_VA_POS], GX_DIRECT);
+}
+
+TEST_F(GXFifoTest, GetVtxDesc_UsesShadowState) {
+  GXClearVtxDesc();
+  GXSetVtxDesc(GX_VA_POS, GX_INDEX16);
+  GXSetVtxDesc(GX_VA_NBT, GX_DIRECT);
+
+  GXAttrType posType = GX_NONE;
+  GXAttrType nbtType = GX_NONE;
+  GXVtxDescList vcd[24]{};
+  GXGetVtxDesc(GX_VA_POS, &posType);
+  GXGetVtxDesc(GX_VA_NBT, &nbtType);
+  GXGetVtxDescv(vcd);
+
+  EXPECT_EQ(posType, GX_INDEX16);
+  EXPECT_EQ(nbtType, GX_DIRECT);
+  EXPECT_EQ(vcd[GX_VA_POS].attr, GX_VA_POS);
+  EXPECT_EQ(vcd[GX_VA_POS].type, GX_INDEX16);
+  EXPECT_EQ(vcd[GX_VA_TEX7 + 1].attr, GX_VA_NBT);
+  EXPECT_EQ(vcd[GX_VA_TEX7 + 1].type, GX_DIRECT);
+  EXPECT_EQ(vcd[GX_VA_TEX7 + 2].attr, GX_VA_NULL);
+}
+
+// --- GXSetVtxAttrFmt ---
+
+TEST_F(GXFifoTest, VtxAttrFmt_PosF32) {
+  GXSetVtxAttrFmt(GX_VTXFMT0, GX_VA_POS, GX_POS_XYZ, GX_F32, 0);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& vf = g_gxState.vtxFmts[GX_VTXFMT0];
+  EXPECT_EQ(vf.attrs[GX_VA_POS].cnt, GX_POS_XYZ);
+  EXPECT_EQ(vf.attrs[GX_VA_POS].type, GX_F32);
+  EXPECT_EQ(vf.attrs[GX_VA_POS].frac, 0);
+}
+
+TEST_F(GXFifoTest, VtxAttrFmt_NrmS16) {
+  GXSetVtxAttrFmt(GX_VTXFMT0, GX_VA_NRM, GX_NRM_XYZ, GX_S16, 0);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& vf = g_gxState.vtxFmts[GX_VTXFMT0];
+  EXPECT_EQ(vf.attrs[GX_VA_NRM].cnt, GX_NRM_XYZ);
+  EXPECT_EQ(vf.attrs[GX_VA_NRM].type, GX_S16);
+  EXPECT_EQ(vf.attrs[GX_VA_NRM].frac, 14);
+}
+
+TEST_F(GXFifoTest, VtxAttrFmt_NrmU8UsesUnsignedScale) {
+  GXSetVtxAttrFmt(GX_VTXFMT0, GX_VA_NRM, GX_NRM_XYZ, GX_S16, 0);
+  (void)flush_and_capture();
+  GXSetVtxAttrFmt(GX_VTXFMT0, GX_VA_NRM, GX_NRM_XYZ, GX_U8, 0);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& vf = g_gxState.vtxFmts[GX_VTXFMT0];
+  EXPECT_EQ(vf.attrs[GX_VA_NRM].cnt, GX_NRM_XYZ);
+  EXPECT_EQ(vf.attrs[GX_VA_NRM].type, GX_U8);
+  EXPECT_EQ(vf.attrs[GX_VA_NRM].frac, 7);
+}
+
+TEST_F(GXFifoTest, NormalU8DirectPreservesUnsignedRawBytes) {
+  GXClearVtxDesc();
+  GXSetVtxDesc(GX_VA_NRM, GX_DIRECT);
+  GXSetVtxAttrFmt(GX_VTXFMT0, GX_VA_NRM, GX_NRM_XYZ, GX_U8, 0);
+  aurora::gx::fifo::clear_buffer();
+
+  GXNormal3u8(0xFF, 0x80, 0x01);
+  const auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 3u);
+  EXPECT_EQ(bytes[0], 0xFF);
+  EXPECT_EQ(bytes[1], 0x80);
+  EXPECT_EQ(bytes[2], 0x01);
+}
+
+TEST_F(GXFifoTest, VtxAttrFmt_NrmNBT3PreservesIndex3Bit) {
+  GXSetVtxAttrFmt(GX_VTXFMT0, GX_VA_NRM, GX_NRM_NBT3, GX_S16, 0);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& vf = g_gxState.vtxFmts[GX_VTXFMT0];
+  EXPECT_EQ(vf.attrs[GX_VA_NRM].cnt, GX_NRM_NBT3);
+  EXPECT_EQ(vf.attrs[GX_VA_NRM].type, GX_S16);
+}
+
+TEST_F(GXFifoTest, VtxAttrFmt_Tex0_S16_Frac8) {
+  GXSetVtxAttrFmt(GX_VTXFMT0, GX_VA_TEX0, GX_TEX_ST, GX_S16, 8);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& vf = g_gxState.vtxFmts[GX_VTXFMT0];
+  EXPECT_EQ(vf.attrs[GX_VA_TEX0].cnt, GX_TEX_ST);
+  EXPECT_EQ(vf.attrs[GX_VA_TEX0].type, GX_S16);
+  EXPECT_EQ(vf.attrs[GX_VA_TEX0].frac, 8);
+}
+
+TEST_F(GXFifoTest, VtxAttrFmt_Clr0_RGBA8) {
+  GXSetVtxAttrFmt(GX_VTXFMT0, GX_VA_CLR0, GX_CLR_RGBA, GX_RGBA8, 0);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& vf = g_gxState.vtxFmts[GX_VTXFMT0];
+  EXPECT_EQ(vf.attrs[GX_VA_CLR0].cnt, GX_CLR_RGBA);
+  EXPECT_EQ(vf.attrs[GX_VA_CLR0].type, GX_RGBA8);
+}
+
+TEST_F(GXFifoTest, VtxAttrFmt_MultipleTexCoords) {
+  GXSetVtxAttrFmt(GX_VTXFMT1, GX_VA_TEX0, GX_TEX_ST, GX_F32, 0);
+  GXSetVtxAttrFmt(GX_VTXFMT1, GX_VA_TEX1, GX_TEX_ST, GX_U16, 15);
+  GXSetVtxAttrFmt(GX_VTXFMT1, GX_VA_TEX2, GX_TEX_ST, GX_S16, 8);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& vf = g_gxState.vtxFmts[GX_VTXFMT1];
+  EXPECT_EQ(vf.attrs[GX_VA_TEX0].type, GX_F32);
+  EXPECT_EQ(vf.attrs[GX_VA_TEX1].type, GX_U16);
+  EXPECT_EQ(vf.attrs[GX_VA_TEX1].frac, 15);
+  EXPECT_EQ(vf.attrs[GX_VA_TEX2].type, GX_S16);
+  EXPECT_EQ(vf.attrs[GX_VA_TEX2].frac, 8);
+}
+
+TEST_F(GXFifoTest, GetVtxAttrFmt_UsesShadowState) {
+  GXSetVtxAttrFmt(GX_VTXFMT2, GX_VA_NRM, GX_NRM_NBT3, GX_S16, 0);
+  GXSetVtxAttrFmt(GX_VTXFMT2, GX_VA_TEX4, GX_TEX_ST, GX_U16, 11);
+
+  GXCompCnt cnt = GX_POS_XY;
+  GXCompType type = GX_U8;
+  u8 frac = 0;
+  GXVtxAttrFmtList vat[13]{};
+
+  GXGetVtxAttrFmt(GX_VTXFMT2, GX_VA_NRM, &cnt, &type, &frac);
+  EXPECT_EQ(cnt, GX_NRM_NBT3);
+  EXPECT_EQ(type, GX_S16);
+  EXPECT_EQ(frac, 14);
+
+  GXGetVtxAttrFmtv(GX_VTXFMT2, vat);
+  EXPECT_EQ(vat[GX_VA_NRM - GX_VA_POS].attr, GX_VA_NRM);
+  EXPECT_EQ(vat[GX_VA_NRM - GX_VA_POS].cnt, GX_NRM_NBT3);
+  EXPECT_EQ(vat[GX_VA_NRM - GX_VA_POS].type, GX_S16);
+  EXPECT_EQ(vat[GX_VA_TEX4 - GX_VA_POS].attr, GX_VA_TEX4);
+  EXPECT_EQ(vat[GX_VA_TEX4 - GX_VA_POS].type, GX_U16);
+  EXPECT_EQ(vat[GX_VA_TEX4 - GX_VA_POS].frac, 11);
+  EXPECT_EQ(vat[12].attr, GX_VA_NULL);
+}
+
+// --- GXSetArray (Aurora array-base command + CP stride command) ---
+
+TEST_F(GXFifoTest, SetArray_Pos_EncodesAuroraArrayBaseAndStride) {
+  u8 posData[32]{};
+  u8 oldData[8]{};
+
+  GXSetArray(GX_VA_POS, posData, sizeof(posData), 12, false);
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 22u);
+  EXPECT_EQ(bytes[0], GX_LOAD_AURORA);
+  EXPECT_EQ(bytes[1], 0x00);
+  EXPECT_EQ(bytes[2], GX_LOAD_AURORA_ARRAYBASE);
+
+  const auto expect_be64 = [&](size_t offset, u64 value) {
+    for (size_t i = 0; i < 8; ++i) {
+      EXPECT_EQ(bytes[offset + i], static_cast<u8>((value >> (56 - i * 8)) & 0xFF));
+    }
+  };
+  const auto expect_be32 = [&](size_t offset, u32 value) {
+    for (size_t i = 0; i < 4; ++i) {
+      EXPECT_EQ(bytes[offset + i], static_cast<u8>((value >> (24 - i * 8)) & 0xFF));
+    }
+  };
+
+  expect_be64(3, static_cast<u64>(reinterpret_cast<uintptr_t>(posData)));
+  expect_be32(11, sizeof(posData));
+  EXPECT_EQ(bytes[15], 0);
+  EXPECT_EQ(bytes[16], GX_LOAD_CP_REG);
+  EXPECT_EQ(bytes[17], GX_CP_REG_ARRAYSTRIDE);
+  expect_be32(18, 12);
+
+  reset_gx_state();
+  gxState().arrays[GX_VA_POS].data = oldData;
+  gxState().arrays[GX_VA_POS].size = sizeof(oldData);
+  gxState().arrays[GX_VA_POS].stride = 2;
+  gxState().arrays[GX_VA_POS].cachedRange.offset = 4;
+  gxState().arrays[GX_VA_POS].cachedRange.size = 8;
+  gxState().stateDirty = false;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(gxState().arrays[GX_VA_POS].data, posData);
+  EXPECT_EQ(gxState().arrays[GX_VA_POS].size, sizeof(posData));
+  EXPECT_EQ(gxState().arrays[GX_VA_POS].stride, 12);
+  EXPECT_FALSE(gxState().arrays[GX_VA_POS].le);
+  EXPECT_EQ(gxState().arrays[GX_VA_POS].cachedRange.offset, 0u);
+  EXPECT_EQ(gxState().arrays[GX_VA_POS].cachedRange.size, 0u);
+  EXPECT_TRUE(gxState().stateDirty);
+}
+
+TEST_F(GXFifoTest, SetArray_Nbt_UsesNrmCommandSlotAndState) {
+  u8 nbtData[96]{};
+  u8 untouchedData[24]{};
+
+  GXSetArray(GX_VA_NBT, nbtData, sizeof(nbtData), 36, false);
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 22u);
+  EXPECT_EQ(bytes[0], GX_LOAD_AURORA);
+  EXPECT_EQ(bytes[1], 0x00);
+  EXPECT_EQ(bytes[2], GX_LOAD_AURORA_ARRAYBASE | 0x01);
+  EXPECT_EQ(bytes[15], 0);
+  EXPECT_EQ(bytes[16], GX_LOAD_CP_REG);
+  EXPECT_EQ(bytes[17], GX_CP_REG_ARRAYSTRIDE | 0x01);
+
+  reset_gx_state();
+  gxState().arrays[GX_VA_NRM].cachedRange.offset = 12;
+  gxState().arrays[GX_VA_NRM].cachedRange.size = 48;
+  gxState().arrays[GX_VA_NBT].data = untouchedData;
+  gxState().arrays[GX_VA_NBT].size = sizeof(untouchedData);
+  gxState().arrays[GX_VA_NBT].stride = 24;
+  gxState().stateDirty = false;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(gxState().arrays[GX_VA_NRM].data, nbtData);
+  EXPECT_EQ(gxState().arrays[GX_VA_NRM].size, sizeof(nbtData));
+  EXPECT_EQ(gxState().arrays[GX_VA_NRM].stride, 36);
+  EXPECT_FALSE(gxState().arrays[GX_VA_NRM].le);
+  EXPECT_EQ(gxState().arrays[GX_VA_NRM].cachedRange.offset, 0u);
+  EXPECT_EQ(gxState().arrays[GX_VA_NRM].cachedRange.size, 0u);
+  EXPECT_TRUE(gxState().stateDirty);
+
+  EXPECT_EQ(gxState().arrays[GX_VA_NBT].data, untouchedData);
+  EXPECT_EQ(gxState().arrays[GX_VA_NBT].size, sizeof(untouchedData));
+  EXPECT_EQ(gxState().arrays[GX_VA_NBT].stride, 24);
+}
+
+TEST_F(GXFifoTest, SetArray_LittleEndianFlag_UpdatesStateAndClearsCachedRange) {
+  u8 clrData[16]{};
+
+  GXSetArray(GX_VA_CLR0, clrData, sizeof(clrData), 4, true);
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 22u);
+  EXPECT_EQ(bytes[0], GX_LOAD_AURORA);
+  EXPECT_EQ(bytes[1], 0x00);
+  EXPECT_EQ(bytes[2], GX_LOAD_AURORA_ARRAYBASE | (GX_VA_CLR0 - GX_VA_POS));
+  EXPECT_EQ(bytes[15], 1);
+  EXPECT_EQ(bytes[16], GX_LOAD_CP_REG);
+  EXPECT_EQ(bytes[17], GX_CP_REG_ARRAYSTRIDE | (GX_VA_CLR0 - GX_VA_POS));
+
+  reset_gx_state();
+  gxState().arrays[GX_VA_CLR0].data = clrData;
+  gxState().arrays[GX_VA_CLR0].size = sizeof(clrData);
+  gxState().arrays[GX_VA_CLR0].stride = 4;
+  gxState().arrays[GX_VA_CLR0].le = false;
+  gxState().arrays[GX_VA_CLR0].cachedRange.offset = 3;
+  gxState().arrays[GX_VA_CLR0].cachedRange.size = 9;
+  gxState().stateDirty = false;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(gxState().arrays[GX_VA_CLR0].data, clrData);
+  EXPECT_EQ(gxState().arrays[GX_VA_CLR0].size, sizeof(clrData));
+  EXPECT_EQ(gxState().arrays[GX_VA_CLR0].stride, 4);
+  EXPECT_TRUE(gxState().arrays[GX_VA_CLR0].le);
+  EXPECT_EQ(gxState().arrays[GX_VA_CLR0].cachedRange.offset, 0u);
+  EXPECT_EQ(gxState().arrays[GX_VA_CLR0].cachedRange.size, 0u);
+  EXPECT_TRUE(gxState().stateDirty);
+}
+
+TEST_F(GXFifoTest, InvalidateVtxCache_DropsAllIndexedArrayUploads) {
+  for (int i = GX_VA_POS; i <= GX_VA_TEX7; ++i) {
+    gxState().arrays[i].cachedRange.offset = static_cast<u32>(i * 32);
+    gxState().arrays[i].cachedRange.size = static_cast<u32>(i + 1);
+  }
+
+  const std::vector<u8> command{GX_CMD_INVL_VC};
+  decode_fifo(command);
+
+  for (int i = GX_VA_POS; i <= GX_VA_TEX7; ++i) {
+    EXPECT_EQ(gxState().arrays[i].cachedRange.offset, 0u);
+    EXPECT_EQ(gxState().arrays[i].cachedRange.size, 0u);
+  }
+}
+
+TEST_F(GXFifoTest, LoadTexObj_EncodesSdkBpBurstAndAuroraMetadata) {
+  alignas(32) u8 image[64]{};
+  GXTexObj obj{};
+  GXInitTexObj(&obj, image, 8, 8, GX_TF_RGB5A3, GX_REPEAT, GX_MIRROR, GX_FALSE);
+
+  GXLoadTexObj(&obj, GX_TEXMAP2);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_bp_write(bytes, 0x82));
+  EXPECT_TRUE(has_bp_write(bytes, 0x86));
+  EXPECT_TRUE(has_bp_write(bytes, 0x8A));
+  EXPECT_TRUE(has_bp_write(bytes, 0x8E));
+  EXPECT_TRUE(has_bp_write(bytes, 0x92));
+  EXPECT_TRUE(has_bp_write(bytes, 0x96));
+  EXPECT_TRUE(has_aurora_cmd(bytes, GX_LOAD_AURORA_TEXOBJ));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  const auto& slot = gxState().loadedTextures[GX_TEXMAP2];
+  EXPECT_EQ(slot.data, image);
+  EXPECT_EQ(slot.width(), 8u);
+  EXPECT_EQ(slot.height(), 8u);
+  EXPECT_EQ(slot.format(), GX_TF_RGB5A3);
+  EXPECT_FALSE(slot.has_mips());
+  EXPECT_EQ(slot.mode0 >> 24, 0x82u);
+  EXPECT_EQ(slot.mode1 >> 24, 0x86u);
+  EXPECT_EQ(slot.image0 >> 24, 0x8Au);
+  EXPECT_EQ(slot.image3 >> 24, 0x96u);
+  EXPECT_NE(slot.texObjId, 0u);
+  EXPECT_EQ(slot.texDataVersion, 1u);
+}
+
+TEST(GXTextureMipCount, ClampsLodToTheDimensionsFullMipChain) {
+  alignas(32) u8 image[64]{};
+
+  GXTexObj small{};
+  GXInitTexObj(&small, image, 8, 8, GX_TF_I4, GX_CLAMP, GX_CLAMP, GX_TRUE);
+  GXInitTexObjMaxLOD(&small, 10.0f);
+  const auto& smallRef = reinterpret_cast<const GXTexObj_&>(small);
+  EXPECT_EQ(smallRef.mip_count(), 4u);
+
+  GXTexObj large{};
+  GXInitTexObj(&large, image, 1024, 1024, GX_TF_I4, GX_CLAMP, GX_CLAMP, GX_TRUE);
+  GXInitTexObjMaxLOD(&large, 10.0f);
+  const auto& largeRef = reinterpret_cast<const GXTexObj_&>(large);
+  EXPECT_EQ(largeRef.mip_count(), 11u);
+}
+
+TEST_F(GXFifoTest, LoadTexObjPcFormat_PreservesFullFormatMetadata) {
+  alignas(32) u8 image[64]{};
+  GXTexObj obj{};
+  GXInitTexObj(&obj, image, 8, 8, GX_TF_RGBA8_PC, GX_REPEAT, GX_REPEAT, GX_FALSE);
+
+  EXPECT_EQ(GXGetTexObjFmt(&obj), GX_TF_RGBA8_PC);
+
+  GXLoadTexObj(&obj, GX_TEXMAP3);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_aurora_cmd(bytes, GX_LOAD_AURORA_TEXOBJ));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  const auto& slot = gxState().loadedTextures[GX_TEXMAP3];
+  EXPECT_EQ(slot.width(), 8u);
+  EXPECT_EQ(slot.height(), 8u);
+  EXPECT_EQ(slot.format(), GX_TF_RGBA8_PC);
+  EXPECT_EQ(slot.raw_format(), static_cast<u32>(GX_TF_RGBA8));
+}
+
+TEST_F(GXFifoTest, RawDrawDrainsQueuedMaterialStateWithoutDeferredDirtyBits) {
+  __GXSetDirtyState();
+  aurora::gx::fifo::clear_buffer();
+
+  constexpr GXColor color = {200, 100, 50, 255};
+  GXSetTevColor(GX_TEVREG0, color);
+
+  // TEV register writes are complete FIFO commands, not deferred SDK state.
+  // They therefore leave dirtyState clear while still preceding the draw.
+  ASSERT_EQ(__gx->dirtyState, 0u);
+  ASSERT_GT(aurora::gx::fifo::get_buffer_size(), 0u);
+
+  // The raw bridge receives vertices that are already packed according to the
+  // active VAT. Seed its size cache so this test can isolate FIFO ordering.
+  g_gxState.lastVtxFmt = GX_VTXFMT0;
+  g_gxState.lastVtxSize = 1;
+  const std::array<u8, 4> vertices{};
+
+  ASSERT_TRUE(aurora::gx::fifo::submit_raw_draw(GX_QUADS, GX_VTXFMT0, vertices.data(), 4,
+                                                static_cast<uint32_t>(vertices.size())));
+  EXPECT_EQ(aurora::gx::fifo::get_buffer_size(), 0u);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][0], 200.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][1], 100.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][2], 50.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.colorRegs[GX_TEVREG0][3], 255.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, DisplayListCallWhileRecordingInlinesNestedCommands) {
+  std::array<u8, 64> outer{};
+  const std::array<u8, 3> nested{GX_NOP, GX_NOP, GX_NOP};
+
+  __GXSetDirtyState();
+  aurora::gx::fifo::clear_buffer();
+  GXBeginDisplayList(outer.data(), static_cast<u32>(outer.size()));
+  GXCallDisplayList(nested.data(), static_cast<u32>(nested.size()));
+  const u32 bytes = GXEndDisplayList();
+
+  EXPECT_EQ(bytes, 32u);
+  EXPECT_TRUE(std::equal(nested.begin(), nested.end(), outer.begin()));
+  EXPECT_EQ(aurora::gx::fifo::get_buffer_size(), 0u);
+}
+
+TEST_F(GXFifoTest, DirectEfbCopiesDrainQueuedCommands) {
+  aurora::gx::fifo::write_u8(GX_NOP);
+  ASSERT_GT(aurora::gx::fifo::get_buffer_size(), 0u);
+  GXCopyDisp(nullptr, GX_FALSE);
+  EXPECT_EQ(aurora::gx::fifo::get_buffer_size(), 0u);
+
+  std::array<u8, 64> copyDest{};
+  aurora::gx::fifo::write_u8(GX_NOP);
+  ASSERT_GT(aurora::gx::fifo::get_buffer_size(), 0u);
+  GXCopyTex(copyDest.data(), GX_FALSE);
+  EXPECT_EQ(aurora::gx::fifo::get_buffer_size(), 0u);
+}
+
+TEST_F(GXFifoTest, RawDrawPreservesHorizontalXzQuadVertices) {
+  __GXSetDirtyState();
+  aurora::gx::fifo::clear_buffer();
+  aurora::gfx::testing::use_real_vertex_format_helpers(true);
+
+  g_gxState.lastVtxFmt = GX_VTXFMT0;
+  g_gxState.lastVtxSize = 14;
+  g_gxState.vtxDesc[GX_VA_POS] = GX_DIRECT;
+  g_gxState.vtxDesc[GX_VA_TEX0] = GX_DIRECT;
+  auto& fmt = g_gxState.vtxFmts[GX_VTXFMT0];
+  fmt.attrs[GX_VA_POS].cnt = GX_POS_XYZ;
+  fmt.attrs[GX_VA_POS].type = GX_F32;
+  fmt.attrs[GX_VA_TEX0].cnt = GX_TEX_ST;
+  fmt.attrs[GX_VA_TEX0].type = GX_U8;
+
+  std::vector<u8> vertices;
+  const auto append_f32_be = [&](float value) {
+    u32 bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    vertices.push_back(static_cast<u8>(bits >> 24));
+    vertices.push_back(static_cast<u8>(bits >> 16));
+    vertices.push_back(static_cast<u8>(bits >> 8));
+    vertices.push_back(static_cast<u8>(bits));
+  };
+  const auto append_vertex = [&](float x, float y, float z, u8 s, u8 t) {
+    append_f32_be(x);
+    append_f32_be(y);
+    append_f32_be(z);
+    vertices.push_back(s);
+    vertices.push_back(t);
+  };
+
+  append_vertex(-53.659431f, 0.27f, -53.659435f, 0, 1);
+  append_vertex(-53.659431f, 0.27f, 53.659435f, 0, 0);
+  append_vertex(53.659431f, 0.27f, 53.659435f, 1, 0);
+  append_vertex(53.659431f, 0.27f, -53.659435f, 1, 1);
+  const auto expected = vertices;
+
+  ASSERT_TRUE(aurora::gx::fifo::submit_raw_draw(
+      GX_QUADS, GX_VTXFMT0, vertices.data(), 4, static_cast<uint32_t>(vertices.size())));
+  EXPECT_EQ(aurora::gfx::testing::last_pushed_vertices(), expected);
+}
+
+static void append_test_draw(std::vector<u8>& fifo, GXPrimitive primitive, u16 count) {
+  fifo.push_back(static_cast<u8>(primitive) | static_cast<u8>(GX_VTXFMT0));
+  fifo.push_back(static_cast<u8>(count >> 8));
+  fifo.push_back(static_cast<u8>(count));
+  for (u16 vertex = 0; vertex < count; ++vertex) {
+    fifo.push_back(static_cast<u8>(vertex));
+  }
+}
+
+TEST_F(GXFifoTest, DrawTopologyTemplatesPreserveExactGxIndexOrder) {
+  g_gxState.lastVtxFmt = GX_VTXFMT0;
+  g_gxState.lastVtxSize = 1;
+  g_gxState.stateDirty = true;
+
+  const auto decodeAndReadIndices = [&](GXPrimitive primitive, u16 count) {
+    std::vector<u8> fifo;
+    append_test_draw(fifo, primitive, count);
+    decode_fifo(fifo);
+    return aurora::gfx::testing::last_pushed_indices();
+  };
+
+  EXPECT_EQ(decodeAndReadIndices(GX_QUADS, 8),
+            (std::vector<u16>{0, 1, 2, 2, 3, 0, 4, 5, 6, 6, 7, 4}));
+  g_gxState.stateDirty = true;
+  EXPECT_EQ(decodeAndReadIndices(GX_TRIANGLES, 6),
+            (std::vector<u16>{0, 1, 2, 3, 4, 5}));
+  g_gxState.stateDirty = true;
+  EXPECT_EQ(decodeAndReadIndices(GX_TRIANGLEFAN, 5),
+            (std::vector<u16>{0, 1, 2, 0, 2, 3, 0, 3, 4}));
+  g_gxState.stateDirty = true;
+  EXPECT_EQ(decodeAndReadIndices(GX_TRIANGLEFAN, 2),
+            (std::vector<u16>{0, 1}));
+  g_gxState.stateDirty = true;
+  EXPECT_EQ(decodeAndReadIndices(GX_TRIANGLESTRIP, 6),
+            (std::vector<u16>{0, 1, 2, 2, 1, 3, 2, 3, 4, 4, 3, 5}));
+  g_gxState.stateDirty = true;
+  EXPECT_TRUE(decodeAndReadIndices(GX_TRIANGLESTRIP, 0).empty());
+  g_gxState.stateDirty = true;
+  EXPECT_EQ(decodeAndReadIndices(GX_LINES, 2),
+            (std::vector<u16>{0, 1, 3, 3, 2, 0}));
+}
+
+TEST_F(GXFifoTest, MergedDrawOffsetsCachedTopologyWithoutJoiningPrimitives) {
+  g_gxState.lastVtxFmt = GX_VTXFMT0;
+  g_gxState.lastVtxSize = 1;
+  g_gxState.stateDirty = true;
+  aurora::gfx::testing::use_draw_command_tracking(true);
+
+  std::vector<u8> fifo;
+  append_test_draw(fifo, GX_TRIANGLES, 3);
+  append_test_draw(fifo, GX_TRIANGLES, 3);
+  decode_fifo(fifo);
+
+  EXPECT_EQ(aurora::gfx::g_mergedDrawCallCount, 1u);
+  EXPECT_EQ(aurora::gfx::testing::last_pushed_indices(),
+            (std::vector<u16>{3, 4, 5}));
+}
+
+TEST_F(GXFifoTest, TexBufferSize_UsesExactLinearPcFormatSizes) {
+  EXPECT_EQ(GXGetTexBufferSize(8, 4, GX_TF_R8_PC, GX_FALSE, 0), 32u);
+  EXPECT_EQ(GXGetTexBufferSize(8, 4, GX_TF_RGBA8_PC, GX_FALSE, 0), 128u);
+  EXPECT_EQ(GXGetTexBufferSize(8, 4, GX_TF_R8_PC, GX_TRUE, 2), 42u);
+  EXPECT_EQ(GXGetTexBufferSize(8, 4, GX_TF_RGBA8_PC, GX_TRUE, 2), 168u);
+}
+
+TEST_F(GXFifoTest, InvalidateTexAll_EmitsAuroraCacheInvalidationAndDirtiesState) {
+  GXInvalidateTexAll();
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_aurora_cmd(bytes, GX_LOAD_AURORA_INVALIDATE_TEX_ALL));
+
+  reset_gx_state();
+  gxState().stateDirty = false;
+  decode_fifo(bytes);
+  EXPECT_TRUE(gxState().stateDirty);
+}
+
+TEST_F(GXFifoTest, TexObjRawDimensions_WrapAtTenBitBoundary) {
+  auto& slot = gxState().loadedTextures[GX_TEXMAP0];
+  slot.image0 = (0x3FFu << 0) | (0x3FFu << 10);
+  slot.mWidth = 0;
+  slot.mHeight = 0;
+
+  EXPECT_EQ(slot.width(), 0u);
+  EXPECT_EQ(slot.height(), 0u);
+}
+
+TEST_F(GXFifoTest, TexObjExplicitDimensions_DoNotWrapAtTenBitBoundary) {
+  auto& slot = gxState().loadedTextures[GX_TEXMAP0];
+  slot.image0 = (0x3FFu << 0) | (0x3FFu << 10);
+  slot.mWidth = 1024;
+  slot.mHeight = 1024;
+
+  EXPECT_EQ(slot.width(), 1024u);
+  EXPECT_EQ(slot.height(), 1024u);
+}
+
+TEST_F(GXFifoTest, LoadTexObjCiAndTlut_PopulatesTextureAndTlutSlots) {
+  alignas(32) u8 image[64]{};
+  alignas(32) u16 palette[16]{};
+  GXTexObj texObj{};
+  GXTlutObj tlutObj{};
+
+  GXInitTexObjCI(&texObj, image, 8, 8, GX_TF_C4, GX_CLAMP, GX_CLAMP, GX_FALSE, GX_TLUT3);
+  GXInitTlutObj(&tlutObj, palette, GX_TL_RGB565, 16);
+
+  GXLoadTexObj(&texObj, GX_TEXMAP1);
+  GXLoadTlut(&tlutObj, GX_TLUT3);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_bp_write(bytes, 0x81));
+  EXPECT_TRUE(has_bp_write(bytes, 0x85));
+  EXPECT_TRUE(has_bp_write(bytes, 0x89));
+  EXPECT_TRUE(has_bp_write(bytes, 0x8D));
+  EXPECT_TRUE(has_bp_write(bytes, 0x91));
+  EXPECT_TRUE(has_bp_write(bytes, 0x95));
+  EXPECT_TRUE(has_bp_write(bytes, 0x99));
+  EXPECT_TRUE(has_aurora_cmd(bytes, GX_LOAD_AURORA_TEXOBJ));
+  EXPECT_TRUE(has_aurora_cmd(bytes, GX_LOAD_AURORA_TLUT));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  const auto& texSlot = gxState().loadedTextures[GX_TEXMAP1];
+  EXPECT_EQ(texSlot.data, image);
+  EXPECT_EQ(texSlot.width(), 8u);
+  EXPECT_EQ(texSlot.height(), 8u);
+  EXPECT_EQ(texSlot.format(), GX_TF_C4);
+  EXPECT_EQ(texSlot.tlut, GX_TLUT3);
+
+  const auto& tlutSlot = gxState().loadedTluts[GX_TLUT3];
+  EXPECT_EQ(tlutSlot.data, palette);
+  EXPECT_EQ(tlutSlot.format, GX_TL_RGB565);
+  EXPECT_EQ(tlutSlot.numEntries, 16u);
+  EXPECT_NE(tlutSlot.tlutObjId, 0u);
+  EXPECT_EQ(tlutSlot.tlutDataVersion, 1u);
+}
+
+TEST_F(GXFifoTest, DestroyTexObj_DoesNotEvictTextureDataAndClearsIdentity) {
+  alignas(32) u8 image[64]{};
+  GXTexObj obj{};
+  GXInitTexObj(&obj, image, 8, 8, GX_TF_RGB5A3, GX_REPEAT, GX_REPEAT, GX_FALSE);
+  GXDestroyTexObj(&obj);
+  auto bytes = capture_fifo();
+
+  EXPECT_FALSE(has_aurora_cmd(bytes, GX_LOAD_AURORA_DESTROY_TEXOBJ));
+  EXPECT_EQ(reinterpret_cast<const GXTexObj_*>(&obj)->texObjId, 0u);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+}
+
+TEST_F(GXFifoTest, DestroyTexObj_DoesNotPoisonLoadedSlotCache) {
+  alignas(32) u8 imageA[64]{};
+  alignas(32) u8 imageB[64]{};
+  GXTexObj objA{};
+  GXTexObj objB{};
+
+  GXInitTexObj(&objA, imageA, 8, 8, GX_TF_RGB5A3, GX_REPEAT, GX_REPEAT, GX_FALSE);
+  GXLoadTexObj(&objA, GX_TEXMAP2);
+  auto loadABytes = capture_fifo();
+  const auto destroyedTexObjId = reinterpret_cast<const GXTexObj_*>(&objA)->texObjId;
+
+  GXDestroyTexObj(&objA);
+  auto destroyBytes = capture_fifo();
+
+  GXInitTexObj(&objB, imageB, 8, 8, GX_TF_RGB565, GX_CLAMP, GX_CLAMP, GX_FALSE);
+  GXLoadTexObj(&objB, GX_TEXMAP2);
+  auto loadBBytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(loadABytes);
+  auto& slot = gxState().loadedTextures[GX_TEXMAP2];
+  EXPECT_EQ(slot.texObjId, destroyedTexObjId);
+  EXPECT_FALSE(slot.no_cache());
+
+  decode_fifo(destroyBytes);
+  EXPECT_EQ(slot.texObjId, destroyedTexObjId);
+  EXPECT_FALSE(slot.no_cache());
+
+  decode_fifo(loadBBytes);
+  EXPECT_EQ(slot.data, imageB);
+  EXPECT_EQ(slot.format(), GX_TF_RGB565);
+  EXPECT_FALSE(slot.no_cache());
+}
+
+TEST_F(GXFifoTest, DestroyTlutObj_EmitsAuroraDestroyCommandAndClearsIdentity) {
+  alignas(32) u16 palette[16]{};
+  GXTlutObj obj{};
+  GXInitTlutObj(&obj, palette, GX_TL_RGB565, 16);
+  GXDestroyTlutObj(&obj);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_aurora_cmd(bytes, GX_LOAD_AURORA_DESTROY_TLUT));
+  EXPECT_EQ(reinterpret_cast<const GXTlutObj_*>(&obj)->tlutObjId, 0u);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+}
+
+TEST_F(GXFifoTest, DestroyTlutObj_MarksLoadedSlotNoCacheUntilReloaded) {
+  alignas(32) u16 paletteA[16]{};
+  alignas(32) u16 paletteB[16]{};
+  GXTlutObj objA{};
+  GXTlutObj objB{};
+
+  GXInitTlutObj(&objA, paletteA, GX_TL_RGB565, 16);
+  GXLoadTlut(&objA, GX_TLUT3);
+  auto loadABytes = capture_fifo();
+  const auto destroyedTlutObjId = reinterpret_cast<const GXTlutObj_*>(&objA)->tlutObjId;
+
+  GXDestroyTlutObj(&objA);
+  auto destroyBytes = capture_fifo();
+
+  GXInitTlutObj(&objB, paletteB, GX_TL_IA8, 16);
+  GXLoadTlut(&objB, GX_TLUT3);
+  auto loadBBytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(loadABytes);
+  auto& slot = gxState().loadedTluts[GX_TLUT3];
+  EXPECT_EQ(slot.tlutObjId, destroyedTlutObjId);
+  EXPECT_FALSE(slot.no_cache());
+
+  decode_fifo(destroyBytes);
+  EXPECT_EQ(slot.tlutObjId, destroyedTlutObjId);
+  EXPECT_TRUE(slot.no_cache());
+
+  decode_fifo(loadBBytes);
+  EXPECT_EQ(slot.data, paletteB);
+  EXPECT_EQ(slot.format, GX_TL_IA8);
+  EXPECT_FALSE(slot.no_cache());
+}
+
+TEST_F(GXFifoTest, DestroyCopyTex_EmitsAuroraDestroyCommand) {
+  alignas(32) u8 image[32]{};
+
+  GXDestroyCopyTex(image);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_aurora_cmd(bytes, GX_LOAD_AURORA_DESTROY_COPY_TEX));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+}
+
+TEST_F(GXFifoTest, DestroyCopyTex_RemovesActiveCopyTextureAndCacheEntriesForPointer) {
+  alignas(32) u8 imageA[32]{};
+  alignas(32) u8 imageB[32]{};
+
+  const aurora::gx::GXState::CopyTextureRef ref{.revision = 1};
+  gxState().copyTextures[imageA] = ref;
+  gxState().copyTextures[imageB] = ref;
+  gxState().copyTextureCache.emplace(
+      aurora::gx::GXState::CopyTextureKey{.dest = imageA, .width = 32, .height = 32, .format = GX_TF_I4}, ref);
+  gxState().copyTextureCache.emplace(
+      aurora::gx::GXState::CopyTextureKey{.dest = imageA, .width = 64, .height = 64, .format = GX_TF_I8}, ref);
+  gxState().copyTextureCache.emplace(
+      aurora::gx::GXState::CopyTextureKey{.dest = imageB, .width = 32, .height = 32, .format = GX_TF_I4}, ref);
+
+  GXDestroyCopyTex(imageA);
+  auto bytes = capture_fifo();
+
+  decode_fifo(bytes);
+
+  EXPECT_FALSE(gxState().copyTextures.contains(imageA));
+  EXPECT_TRUE(gxState().copyTextures.contains(imageB));
+  for (const auto& [key, _] : gxState().copyTextureCache) {
+    EXPECT_NE(key.dest, imageA);
+  }
+  EXPECT_EQ(gxState().copyTextureCache.size(), 1u);
+}
+
+// BP genMode (requires __GXSetDirtyState() flush)
+
+// --- GXSetCullMode ---
+
+TEST_F(GXFifoTest, CullMode_Back) {
+  GXSetCullMode(GX_CULL_BACK);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  g_gxState.cullMode = GX_CULL_NONE;
+  decode_fifo(bytes);
+
+  // The encoder swaps front/back for hardware, and decoder swaps back
+  EXPECT_EQ(g_gxState.cullMode, GX_CULL_BACK);
+}
+
+TEST_F(GXFifoTest, CullMode_Front) {
+  GXSetCullMode(GX_CULL_FRONT);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.cullMode, GX_CULL_FRONT);
+}
+
+TEST_F(GXFifoTest, CullMode_None) {
+  GXSetCullMode(GX_CULL_NONE);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  g_gxState.cullMode = GX_CULL_BACK;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.cullMode, GX_CULL_NONE);
+}
+
+TEST_F(GXFifoTest, GetLinePointCullShadowState) {
+  GXSetLineWidth(12, GX_TO_ZERO);
+  GXSetPointSize(34, GX_TO_ONE);
+  GXSetCullMode(GX_CULL_FRONT);
+
+  u8 lineWidth = 0;
+  u8 pointSize = 0;
+  GXTexOffset lineOffs = GX_TO_ZERO;
+  GXTexOffset pointOffs = GX_TO_ZERO;
+  GXCullMode cullMode = GX_CULL_NONE;
+
+  GXGetLineWidth(&lineWidth, &lineOffs);
+  GXGetPointSize(&pointSize, &pointOffs);
+  GXGetCullMode(&cullMode);
+
+  EXPECT_EQ(lineWidth, 12);
+  EXPECT_EQ(lineOffs, GX_TO_ZERO);
+  EXPECT_EQ(pointSize, 34);
+  EXPECT_EQ(pointOffs, GX_TO_ONE);
+  EXPECT_EQ(cullMode, GX_CULL_FRONT);
+}
+
+TEST_F(GXFifoTest, LinePointSize_Decode) {
+  GXSetLineWidth(12, GX_TO_ZERO);
+  GXSetPointSize(34, GX_TO_ONE);
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 10u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0x22);
+  EXPECT_EQ(bytes[5], 0x61);
+  EXPECT_EQ(bytes[6], 0x22);
+
+  reset_gx_state();
+  g_gxState.lineWidth = 1;
+  g_gxState.pointSize = 2;
+  g_gxState.lineTexOffset = GX_TO_ONE;
+  g_gxState.pointTexOffset = GX_TO_ZERO;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.lineWidth, 12u);
+  EXPECT_EQ(g_gxState.lineTexOffset, GX_TO_ZERO);
+  EXPECT_EQ(g_gxState.pointSize, 34u);
+  EXPECT_EQ(g_gxState.pointTexOffset, GX_TO_ONE);
+}
+
+// --- GXSetNumTevStages / GXSetNumTexGens / GXSetNumChans ---
+
+TEST_F(GXFifoTest, NumTevStages) {
+  GXSetNumTevStages(4);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.numTevStages, 4u);
+}
+
+TEST_F(GXFifoTest, NumTexGens) {
+  GXSetNumTexGens(3);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.numTexGens, 3u);
+}
+
+TEST_F(GXFifoTest, NumChans) {
+  GXSetNumChans(2);
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.numChans, 2u);
+}
+
+// XF registers (direct FIFO writes)
+
+// --- GXLoadPosMtxImm (XF 0x000-0x077) ---
+
+TEST_F(GXFifoTest, LoadPosMtxImm_Identity) {
+  // 3x4 identity matrix
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 1.0f;
+  mtx.m1[1] = 1.0f;
+  mtx.m2[2] = 1.0f;
+
+  GXLoadPosMtxImm(&mtx, GX_PNMTX0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.pnMtx[0].pos;
+  EXPECT_FLOAT_EQ(decoded.m0[0], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[3], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], 0.0f);
+}
+
+TEST_F(GXFifoTest, LoadPosMtxImm_Translation) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 1.0f;
+  mtx.m1[1] = 1.0f;
+  mtx.m2[2] = 1.0f;
+  mtx.m0[3] = 10.0f;
+  mtx.m1[3] = 20.0f;
+  mtx.m2[3] = 30.0f;
+
+  GXLoadPosMtxImm(&mtx, GX_PNMTX3);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.pnMtx[3].pos;
+  EXPECT_FLOAT_EQ(decoded.m0[0], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[3], 10.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], 20.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], 30.0f);
+}
+
+// --- GXLoadNrmMtxImm (XF 0x400-0x459) ---
+
+TEST_F(GXFifoTest, LoadNrmMtxImm_Identity) {
+  // 3x4 matrix with 3x3 identity (translation column ignored by encoder)
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 1.0f;
+  mtx.m1[1] = 1.0f;
+  mtx.m2[2] = 1.0f;
+
+  GXLoadNrmMtxImm(&mtx, GX_PNMTX0);
+  auto bytes = capture_fifo();
+
+  // XF opcode 0x10
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x10);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.pnMtx[0].nrm;
+  EXPECT_FLOAT_EQ(decoded.m0[0], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 1.0f);
+}
+
+TEST_F(GXFifoTest, LoadNrmMtxImm_ArbitraryValues) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 0.5f;  mtx.m0[1] = -0.5f; mtx.m0[2] = 0.7f;  mtx.m0[3] = 999.0f;
+  mtx.m1[0] = 0.3f;  mtx.m1[1] = 0.8f;  mtx.m1[2] = -0.1f; mtx.m1[3] = 888.0f;
+  mtx.m2[0] = -0.6f; mtx.m2[1] = 0.2f;  mtx.m2[2] = 0.9f;  mtx.m2[3] = 777.0f;
+
+  GXLoadNrmMtxImm(&mtx, GX_PNMTX0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.pnMtx[0].nrm;
+  // 3x3 portion should round-trip
+  EXPECT_FLOAT_EQ(decoded.m0[0], 0.5f);
+  EXPECT_FLOAT_EQ(decoded.m0[1], -0.5f);
+  EXPECT_FLOAT_EQ(decoded.m0[2], 0.7f);
+  EXPECT_FLOAT_EQ(decoded.m1[0], 0.3f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 0.8f);
+  EXPECT_FLOAT_EQ(decoded.m1[2], -0.1f);
+  EXPECT_FLOAT_EQ(decoded.m2[0], -0.6f);
+  EXPECT_FLOAT_EQ(decoded.m2[1], 0.2f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 0.9f);
+  // Translation column is NOT written by the encoder, so it stays zeroed
+  EXPECT_FLOAT_EQ(decoded.m0[3], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], 0.0f);
+}
+
+TEST_F(GXFifoTest, LoadNrmMtxImm_DifferentSlot) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 2.0f;
+  mtx.m1[1] = 3.0f;
+  mtx.m2[2] = 4.0f;
+
+  GXLoadNrmMtxImm(&mtx, GX_PNMTX3);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.pnMtx[3].nrm;
+  EXPECT_FLOAT_EQ(decoded.m0[0], 2.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 3.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 4.0f);
+}
+
+TEST_F(GXFifoTest, LoadNrmMtxImm_Isolation) {
+  // Loading nrm into slot 0 should not affect slot 1 or the pos matrix
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 11.0f;
+  mtx.m1[1] = 22.0f;
+  mtx.m2[2] = 33.0f;
+
+  GXLoadNrmMtxImm(&mtx, GX_PNMTX0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // Slot 0 nrm should have our values
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[0].nrm.m0[0], 11.0f);
+  // Slot 0 pos should remain zeroed (nrm write doesn't touch pos)
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[0].pos.m0[0], 0.0f);
+  // Slot 1 nrm should remain zeroed
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[1].nrm.m0[0], 0.0f);
+}
+
+TEST_F(GXFifoTest, LoadNrmMtxImm_WithPosMtx) {
+  // Load both pos and nrm into the same slot, verify both decode correctly
+  aurora::Mat3x4<float> posMtx{};
+  posMtx.m0[0] = 1.0f;
+  posMtx.m1[1] = 1.0f;
+  posMtx.m2[2] = 1.0f;
+  posMtx.m0[3] = 5.0f;
+  posMtx.m1[3] = 10.0f;
+  posMtx.m2[3] = 15.0f;
+
+  aurora::Mat3x4<float> nrmMtx{};
+  nrmMtx.m0[0] = 0.5f;
+  nrmMtx.m1[1] = 0.5f;
+  nrmMtx.m2[2] = 0.5f;
+
+  GXLoadPosMtxImm(&posMtx, GX_PNMTX0);
+  GXLoadNrmMtxImm(&nrmMtx, GX_PNMTX0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // Position matrix
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[0].pos.m0[0], 1.0f);
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[0].pos.m0[3], 5.0f);
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[0].pos.m1[3], 10.0f);
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[0].pos.m2[3], 15.0f);
+  // Normal matrix
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[0].nrm.m0[0], 0.5f);
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[0].nrm.m1[1], 0.5f);
+  EXPECT_FLOAT_EQ(g_gxState.pnMtx[0].nrm.m2[2], 0.5f);
+}
+
+// --- GXLoadTexMtxImm 3x4 (XF 0x078-0x0EF) ---
+
+TEST_F(GXFifoTest, LoadTexMtx3x4_Identity) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 1.0f;
+  mtx.m1[1] = 1.0f;
+  mtx.m2[2] = 1.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_TEXMTX0, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x10);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.texMtxs[0];
+  EXPECT_FLOAT_EQ(decoded.m0[0], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[3], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], 0.0f);
+}
+
+TEST_F(GXFifoTest, LoadTexMtx3x4_ArbitraryValues) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 2.0f;  mtx.m0[1] = 0.5f;  mtx.m0[2] = 0.0f;  mtx.m0[3] = 10.0f;
+  mtx.m1[0] = -0.5f; mtx.m1[1] = 3.0f;  mtx.m1[2] = 0.0f;  mtx.m1[3] = 20.0f;
+  mtx.m2[0] = 0.0f;  mtx.m2[1] = 0.0f;  mtx.m2[2] = 1.5f;  mtx.m2[3] = -5.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_TEXMTX0, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.texMtxs[0];
+  EXPECT_FLOAT_EQ(decoded.m0[0], 2.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[1], 0.5f);
+  EXPECT_FLOAT_EQ(decoded.m0[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[3], 10.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[0], -0.5f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 3.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], 20.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 1.5f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], -5.0f);
+}
+
+TEST_F(GXFifoTest, LoadTexMtx3x4_DifferentSlot) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 7.0f;
+  mtx.m1[1] = 8.0f;
+  mtx.m2[2] = 9.0f;
+  mtx.m2[3] = 42.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_TEXMTX5, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // GX_TEXMTX5 = 45, addr = 45*4 = 180 = 0xB4, index = (0xB4 - 0x78) / 12 = 5
+  auto& decoded = g_gxState.texMtxs[5];
+  EXPECT_FLOAT_EQ(decoded.m0[0], 7.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 8.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 9.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], 42.0f);
+}
+
+TEST_F(GXFifoTest, LoadTexMtx3x4_LastSlot) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 11.0f;
+  mtx.m1[1] = 22.0f;
+  mtx.m2[2] = 33.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_TEXMTX9, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.texMtxs[9];
+  EXPECT_FLOAT_EQ(decoded.m0[0], 11.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 22.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 33.0f);
+}
+
+TEST_F(GXFifoTest, LoadTexMtx3x4_Isolation) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 50.0f;
+  mtx.m1[1] = 60.0f;
+  mtx.m2[2] = 70.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_TEXMTX0, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_FLOAT_EQ(g_gxState.texMtxs[0].m0[0], 50.0f);
+  // Slot 1 should remain zeroed
+  EXPECT_FLOAT_EQ(g_gxState.texMtxs[1].m0[0], 0.0f);
+  EXPECT_FLOAT_EQ(g_gxState.texMtxs[1].m1[1], 0.0f);
+}
+
+// --- GXLoadTexMtxImm 2x4 (XF 0x078-0x0EF) ---
+
+TEST_F(GXFifoTest, LoadTexMtx2x4_Identity) {
+  // 2x4 identity: row0 = [1,0,0,0], row1 = [0,1,0,0]
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 1.0f;
+  mtx.m1[1] = 1.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_TEXMTX0, GX_MTX2x4);
+  auto bytes = capture_fifo();
+
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x10);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.texMtxs[0];
+  // First two rows should round-trip
+  EXPECT_FLOAT_EQ(decoded.m0[0], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[3], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], 0.0f);
+  // Third row not written by 2x4, should be zeroed
+  EXPECT_FLOAT_EQ(decoded.m2[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], 0.0f);
+}
+
+TEST_F(GXFifoTest, LoadTexMtx2x4_ArbitraryValues) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 0.5f;  mtx.m0[1] = -1.0f; mtx.m0[2] = 0.25f; mtx.m0[3] = 100.0f;
+  mtx.m1[0] = 3.0f;  mtx.m1[1] = 0.0f;  mtx.m1[2] = -2.5f; mtx.m1[3] = -50.0f;
+  // Row 2 values should be ignored by the encoder
+  mtx.m2[0] = 999.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_TEXMTX0, GX_MTX2x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.texMtxs[0];
+  EXPECT_FLOAT_EQ(decoded.m0[0], 0.5f);
+  EXPECT_FLOAT_EQ(decoded.m0[1], -1.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[2], 0.25f);
+  EXPECT_FLOAT_EQ(decoded.m0[3], 100.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[0], 3.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[2], -2.5f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], -50.0f);
+  // Row 2 should be zeroed (only 8 floats written)
+  EXPECT_FLOAT_EQ(decoded.m2[0], 0.0f);
+}
+
+TEST_F(GXFifoTest, LoadTexMtx2x4_DifferentSlot) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 4.0f;
+  mtx.m0[3] = 15.0f;
+  mtx.m1[1] = 5.0f;
+  mtx.m1[3] = 25.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_TEXMTX3, GX_MTX2x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.texMtxs[3];
+  EXPECT_FLOAT_EQ(decoded.m0[0], 4.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[3], 15.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 5.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], 25.0f);
+}
+
+TEST_F(GXFifoTest, LoadTexMtx2x4_Isolation) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 10.0f;
+  mtx.m1[1] = 20.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_TEXMTX0, GX_MTX2x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_FLOAT_EQ(g_gxState.texMtxs[0].m0[0], 10.0f);
+  EXPECT_FLOAT_EQ(g_gxState.texMtxs[0].m1[1], 20.0f);
+  // Slot 1 should remain zeroed
+  EXPECT_FLOAT_EQ(g_gxState.texMtxs[1].m0[0], 0.0f);
+  EXPECT_FLOAT_EQ(g_gxState.texMtxs[1].m1[1], 0.0f);
+}
+
+// --- GXSetProjection (XF 0x1020-0x1026) ---
+
+TEST_F(GXFifoTest, Projection_Perspective) {
+  aurora::Mat4x4<float> proj{};
+  proj.m0[0] = 1.5f; // near / (right - left) * 2
+  proj.m0[2] = 0.1f;
+  proj.m1[1] = 2.0f; // near / (top - bottom) * 2
+  proj.m1[2] = 0.2f;
+  proj.m2[2] = -1.002f;
+  proj.m2[3] = -0.2002f;
+  proj.m3[2] = -1.0f;
+
+  GXSetProjection(&proj, GX_PERSPECTIVE);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.projType, GX_PERSPECTIVE);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m0[0], 1.5f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m0[2], 0.1f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m1[1], 2.0f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m1[2], 0.2f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m2[2], -1.002f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m2[3], -0.2002f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m3[2], -1.0f);
+}
+
+TEST_F(GXFifoTest, Projection_Orthographic) {
+  aurora::Mat4x4<float> proj{};
+  proj.m0[0] = 2.0f / 640.0f;
+  proj.m0[3] = -1.0f;
+  proj.m1[1] = 2.0f / 480.0f;
+  proj.m1[3] = -1.0f;
+  proj.m2[2] = -1.0f / 10000.0f;
+  proj.m2[3] = 0.0f;
+  proj.m3[3] = 1.0f;
+
+  GXSetProjection(&proj, GX_ORTHOGRAPHIC);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.projType, GX_ORTHOGRAPHIC);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m0[0], 2.0f / 640.0f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m0[3], -1.0f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m1[1], 2.0f / 480.0f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m1[3], -1.0f);
+  EXPECT_FLOAT_EQ(g_gxState.proj.m3[3], 1.0f);
+}
+
+TEST_F(GXFifoTest, GetProjectionAndScissorShadowState) {
+  const f32 proj[] = {0.0f, 1.5f, 0.1f, 2.0f, 0.2f, -1.002f, -0.2002f};
+  f32 outProj[7]{};
+  u32 left = 0, top = 0, width = 0, height = 0;
+
+  GXSetProjectionv(proj);
+  GXSetScissor(16, 24, 320, 240);
+  GXGetProjectionv(outProj);
+  GXGetScissor(&left, &top, &width, &height);
+
+  for (size_t i = 0; i < 7; ++i) {
+    EXPECT_FLOAT_EQ(outProj[i], proj[i]);
+  }
+  EXPECT_EQ(left, 16u);
+  EXPECT_EQ(top, 24u);
+  EXPECT_EQ(width, 320u);
+  EXPECT_EQ(height, 240u);
+}
+
+TEST_F(GXFifoTest, Scissor_EncodesBpAndDecodesLogicalState) {
+  GXSetScissor(16, 24, 320, 240);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_bp_write(bytes, 0x20));
+  EXPECT_TRUE(has_bp_write(bytes, 0x21));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.logicalScissor.x, 16);
+  EXPECT_EQ(g_gxState.logicalScissor.y, 24);
+  EXPECT_EQ(g_gxState.logicalScissor.width, 320);
+  EXPECT_EQ(g_gxState.logicalScissor.height, 240);
+}
+
+TEST_F(GXFifoTest, ScissorBoxOffset_EncodesBp59AndDecodesState) {
+  GXSetScissorBoxOffset(1024, 0);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_bp_write(bytes, 0x59));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.scissorOffsetX, 1024);
+  EXPECT_EQ(g_gxState.scissorOffsetY, 0);
+}
+
+TEST_F(GXFifoTest, GetViewportShadowState) {
+  f32 vp[6]{};
+
+  GXSetViewport(10.0f, 20.0f, 640.0f, 480.0f, 0.1f, 1.0f);
+  GXGetViewportv(vp);
+  EXPECT_FLOAT_EQ(vp[0], 10.0f);
+  EXPECT_FLOAT_EQ(vp[1], 20.0f);
+  EXPECT_FLOAT_EQ(vp[2], 640.0f);
+  EXPECT_FLOAT_EQ(vp[3], 480.0f);
+  EXPECT_FLOAT_EQ(vp[4], 0.1f);
+  EXPECT_FLOAT_EQ(vp[5], 1.0f);
+
+  GXSetViewportJitter(30.0f, 40.0f, 320.0f, 240.0f, 0.2f, 0.9f, 0);
+  GXGetViewportv(vp);
+  EXPECT_FLOAT_EQ(vp[0], 30.0f);
+  EXPECT_FLOAT_EQ(vp[1], 39.5f);
+  EXPECT_FLOAT_EQ(vp[2], 320.0f);
+  EXPECT_FLOAT_EQ(vp[3], 240.0f);
+  EXPECT_FLOAT_EQ(vp[4], 0.2f);
+  EXPECT_FLOAT_EQ(vp[5], 0.9f);
+}
+
+TEST_F(GXFifoTest, Viewport_DecodesLogicalViewportState) {
+  GXSetViewport(10.0f, 20.0f, 640.0f, 480.0f, 0.1f, 1.0f);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_FLOAT_EQ(g_gxState.logicalViewport.left, 10.0f);
+  EXPECT_FLOAT_EQ(g_gxState.logicalViewport.top, 20.0f);
+  EXPECT_FLOAT_EQ(g_gxState.logicalViewport.width, 640.0f);
+  EXPECT_FLOAT_EQ(g_gxState.logicalViewport.height, 480.0f);
+  EXPECT_FLOAT_EQ(g_gxState.renderViewport.left, 10.0f);
+  EXPECT_FLOAT_EQ(g_gxState.renderViewport.top, 20.0f);
+  EXPECT_FLOAT_EQ(g_gxState.renderViewport.width, 640.0f);
+  EXPECT_FLOAT_EQ(g_gxState.renderViewport.height, 480.0f);
+}
+
+TEST_F(GXFifoTest, ViewportRender_EncodesAuroraOverride) {
+  GXSetViewportRender(100.0f, 50.0f, 1280.0f, 720.0f, 0.0f, 1.0f);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_aurora_cmd(bytes, GX_LOAD_AURORA_VIEWPORT_RENDER));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_FLOAT_EQ(g_gxState.renderViewport.left, 100.0f);
+  EXPECT_FLOAT_EQ(g_gxState.renderViewport.top, 50.0f);
+  EXPECT_FLOAT_EQ(g_gxState.renderViewport.width, 1280.0f);
+  EXPECT_FLOAT_EQ(g_gxState.renderViewport.height, 720.0f);
+}
+
+TEST_F(GXFifoTest, ScissorRender_EncodesAuroraOverride) {
+  GXSetScissorRender(100, 40, 800, 600);
+  auto bytes = capture_fifo();
+
+  EXPECT_TRUE(has_aurora_cmd(bytes, GX_LOAD_AURORA_SCISSOR_RENDER));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.renderScissor.x, 100);
+  EXPECT_EQ(g_gxState.renderScissor.y, 40);
+  EXPECT_EQ(g_gxState.renderScissor.width, 800);
+  EXPECT_EQ(g_gxState.renderScissor.height, 600);
+}
+
+// --- GXLoadLightObjImm (XF 0x600-0x67F) ---
+
+TEST_F(GXFifoTest, LoadLightObjImm_Light0_BasicColor) {
+  GXLightObj lightObj;
+  GXInitLightPos(&lightObj, 100.0f, 200.0f, 300.0f);
+  GXInitLightDir(&lightObj, 0.0f, -1.0f, 0.0f);
+  GXInitLightColor(&lightObj, {255, 128, 64, 255});
+  GXInitLightAttn(&lightObj, 1.0f, 0.0f, 0.0f, 1.0f, 0.0f, 0.0f);
+
+  GXLoadLightObjImm(&lightObj, GX_LIGHT0);
+  auto bytes = capture_fifo();
+
+  // XF bulk write: opcode 0x10
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x10);
+
+  reset_gx_state();
+  g_gxState.preparedLightsDirty = false;
+  decode_fifo(bytes);
+  EXPECT_TRUE(g_gxState.preparedLightsDirty);
+
+  auto& light = g_gxState.lights[0];
+  // Color
+  EXPECT_NEAR(light.color[0], 255.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[1], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[2], 64.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[3], 255.f / 255.f, 1.f / 255.f);
+  // Position
+  EXPECT_FLOAT_EQ(light.pos[0], 100.0f);
+  EXPECT_FLOAT_EQ(light.pos[1], 200.0f);
+  EXPECT_FLOAT_EQ(light.pos[2], 300.0f);
+  // Direction (GXInitLightDir negates)
+  EXPECT_FLOAT_EQ(light.dir[0], 0.0f);
+  EXPECT_FLOAT_EQ(light.dir[1], 1.0f);
+  EXPECT_FLOAT_EQ(light.dir[2], 0.0f);
+  // Cosine attenuation
+  EXPECT_FLOAT_EQ(light.cosAtt[0], 1.0f);
+  EXPECT_FLOAT_EQ(light.cosAtt[1], 0.0f);
+  EXPECT_FLOAT_EQ(light.cosAtt[2], 0.0f);
+  // Distance attenuation
+  EXPECT_FLOAT_EQ(light.distAtt[0], 1.0f);
+  EXPECT_FLOAT_EQ(light.distAtt[1], 0.0f);
+  EXPECT_FLOAT_EQ(light.distAtt[2], 0.0f);
+}
+
+TEST_F(GXFifoTest, LoadLightObjImm_Light3_Attenuation) {
+  GXLightObj lightObj;
+  GXInitLightPos(&lightObj, -50.0f, 0.0f, 75.0f);
+  GXInitLightDir(&lightObj, 1.0f, 0.0f, 0.0f);
+  GXInitLightColor(&lightObj, {0, 255, 0, 128});
+  GXInitLightAttn(&lightObj, 0.5f, 0.3f, 0.2f, 1.0f, 0.01f, 0.001f);
+
+  GXLoadLightObjImm(&lightObj, GX_LIGHT3);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& light = g_gxState.lights[3];
+  EXPECT_NEAR(light.color[0], 0.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[1], 255.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[2], 0.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[3], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_FLOAT_EQ(light.pos[0], -50.0f);
+  EXPECT_FLOAT_EQ(light.pos[1], 0.0f);
+  EXPECT_FLOAT_EQ(light.pos[2], 75.0f);
+  EXPECT_FLOAT_EQ(light.dir[0], -1.0f);
+  EXPECT_FLOAT_EQ(light.dir[1], 0.0f);
+  EXPECT_FLOAT_EQ(light.dir[2], 0.0f);
+  EXPECT_FLOAT_EQ(light.cosAtt[0], 0.5f);
+  EXPECT_FLOAT_EQ(light.cosAtt[1], 0.3f);
+  EXPECT_FLOAT_EQ(light.cosAtt[2], 0.2f);
+  EXPECT_FLOAT_EQ(light.distAtt[0], 1.0f);
+  EXPECT_FLOAT_EQ(light.distAtt[1], 0.01f);
+  EXPECT_FLOAT_EQ(light.distAtt[2], 0.001f);
+}
+
+TEST_F(GXFifoTest, LoadLightObjImm_Light7_LastLight) {
+  GXLightObj lightObj;
+  GXInitLightPos(&lightObj, 0.0f, 1000.0f, 0.0f);
+  GXInitLightDir(&lightObj, 0.0f, 0.0f, -1.0f);
+  GXInitLightColor(&lightObj, {128, 128, 128, 255});
+  GXInitLightAttn(&lightObj, 1.0f, 0.0f, 0.0f, 1.0f, 0.0f, 0.0f);
+
+  GXLoadLightObjImm(&lightObj, GX_LIGHT7);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& light = g_gxState.lights[7];
+  EXPECT_NEAR(light.color[0], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[1], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[2], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[3], 255.f / 255.f, 1.f / 255.f);
+  EXPECT_FLOAT_EQ(light.pos[0], 0.0f);
+  EXPECT_FLOAT_EQ(light.pos[1], 1000.0f);
+  EXPECT_FLOAT_EQ(light.pos[2], 0.0f);
+  EXPECT_FLOAT_EQ(light.dir[0], 0.0f);
+  EXPECT_FLOAT_EQ(light.dir[1], 0.0f);
+  EXPECT_FLOAT_EQ(light.dir[2], 1.0f);
+}
+
+TEST_F(GXFifoTest, LoadLightObjImm_SpotLight) {
+  GXLightObj lightObj;
+  GXInitLightPos(&lightObj, 10.0f, 20.0f, 30.0f);
+  GXInitLightDir(&lightObj, 0.0f, -1.0f, 0.0f);
+  GXInitLightSpot(&lightObj, 45.0f, GX_SP_COS);
+  GXInitLightDistAttn(&lightObj, 100.0f, 0.5f, GX_DA_MEDIUM);
+  GXInitLightColor(&lightObj, {255, 255, 255, 255});
+
+  GXLoadLightObjImm(&lightObj, GX_LIGHT1);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& light = g_gxState.lights[1];
+  EXPECT_NEAR(light.color[0], 1.0f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[1], 1.0f, 1.f / 255.f);
+  EXPECT_NEAR(light.color[2], 1.0f, 1.f / 255.f);
+  EXPECT_FLOAT_EQ(light.pos[0], 10.0f);
+  EXPECT_FLOAT_EQ(light.pos[1], 20.0f);
+  EXPECT_FLOAT_EQ(light.pos[2], 30.0f);
+  // GX_SP_COS with cutoff=45: cr = cos(45 * pi / 180)
+  // a0 = -cr/(1-cr), a1 = 1/(1-cr), a2 = 0
+  float cr = std::cos(45.0f * M_PIF / 180.0f);
+  EXPECT_FLOAT_EQ(light.cosAtt[0], -cr / (1.0f - cr));
+  EXPECT_FLOAT_EQ(light.cosAtt[1], 1.0f / (1.0f - cr));
+  EXPECT_FLOAT_EQ(light.cosAtt[2], 0.0f);
+  // GX_DA_MEDIUM with refDist=100, refBright=0.5:
+  // k0 = 1, k1 = 0.5*(1-b)/(b*d), k2 = 0.5*(1-b)/(b*d*d)
+  EXPECT_FLOAT_EQ(light.distAtt[0], 1.0f);
+  EXPECT_FLOAT_EQ(light.distAtt[1], 0.5f * 0.5f / (0.5f * 100.0f));
+  EXPECT_FLOAT_EQ(light.distAtt[2], 0.5f * 0.5f / (0.5f * 100.0f * 100.0f));
+}
+
+// --- GXSetChanCtrl (XF 0x100E-0x1011) ---
+
+TEST_F(GXFifoTest, ChanCtrl_Color0_LightingEnabled) {
+  GXSetChanCtrl(GX_COLOR0, true, GX_SRC_REG, GX_SRC_VTX, GX_LIGHT0 | GX_LIGHT1, GX_DF_CLAMP, GX_AF_SPOT);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& cfg = g_gxState.colorChannelConfig[GX_COLOR0];
+  EXPECT_TRUE(cfg.lightingEnabled);
+  EXPECT_EQ(cfg.matSrc, GX_SRC_VTX);
+  EXPECT_EQ(cfg.ambSrc, GX_SRC_REG);
+  EXPECT_EQ(cfg.diffFn, GX_DF_CLAMP);
+  EXPECT_EQ(cfg.attnFn, GX_AF_SPOT);
+
+  // Light mask should be 0x03 (lights 0 and 1)
+  auto& state = g_gxState.colorChannelState[GX_COLOR0];
+  EXPECT_TRUE(state.lightMask[0]);
+  EXPECT_TRUE(state.lightMask[1]);
+  EXPECT_FALSE(state.lightMask[2]);
+}
+
+TEST_F(GXFifoTest, ChanCtrl_Alpha0_NoLighting) {
+  GXSetChanCtrl(GX_ALPHA0, false, GX_SRC_VTX, GX_SRC_REG, 0, GX_DF_NONE, GX_AF_NONE);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& cfg = g_gxState.colorChannelConfig[GX_ALPHA0];
+  EXPECT_FALSE(cfg.lightingEnabled);
+  EXPECT_EQ(cfg.matSrc, GX_SRC_REG);
+  EXPECT_EQ(cfg.ambSrc, GX_SRC_VTX);
+  EXPECT_EQ(cfg.attnFn, GX_AF_NONE);
+}
+
+TEST_F(GXFifoTest, ChanCtrl_Color1_SpecularLighting) {
+  GXSetChanCtrl(GX_COLOR1, true, GX_SRC_REG, GX_SRC_REG, GX_LIGHT2 | GX_LIGHT5, GX_DF_SIGN, GX_AF_SPEC);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& cfg = g_gxState.colorChannelConfig[GX_COLOR1];
+  EXPECT_TRUE(cfg.lightingEnabled);
+  EXPECT_EQ(cfg.matSrc, GX_SRC_REG);
+  EXPECT_EQ(cfg.ambSrc, GX_SRC_REG);
+  EXPECT_EQ(cfg.diffFn, GX_DF_NONE);
+  EXPECT_EQ(cfg.attnFn, GX_AF_SPEC);
+
+  auto& state = g_gxState.colorChannelState[GX_COLOR1];
+  EXPECT_FALSE(state.lightMask[0]);
+  EXPECT_FALSE(state.lightMask[1]);
+  EXPECT_TRUE(state.lightMask[2]);
+  EXPECT_FALSE(state.lightMask[3]);
+  EXPECT_FALSE(state.lightMask[4]);
+  EXPECT_TRUE(state.lightMask[5]);
+}
+
+TEST_F(GXFifoTest, ChanCtrl_EncodesHardwareAttenuationField) {
+  GXSetChanCtrl(GX_COLOR0, true, GX_SRC_REG, GX_SRC_REG, GX_LIGHT0, GX_DF_SIGN, GX_AF_SPEC);
+  auto specBytes = capture_fifo();
+  ASSERT_GE(specBytes.size(), 9u);
+  EXPECT_EQ((read_be32_at(specBytes, 5) >> 7) & 0x3u, static_cast<u32>(GX_DF_NONE));
+  EXPECT_EQ((read_be32_at(specBytes, 5) >> 9) & 0x3u, 1u);
+
+  GXSetChanCtrl(GX_COLOR0, true, GX_SRC_REG, GX_SRC_REG, GX_LIGHT0, GX_DF_CLAMP, GX_AF_SPOT);
+  auto spotBytes = capture_fifo();
+  ASSERT_GE(spotBytes.size(), 9u);
+  EXPECT_EQ((read_be32_at(spotBytes, 5) >> 9) & 0x3u, 3u);
+
+  GXSetChanCtrl(GX_COLOR0, true, GX_SRC_REG, GX_SRC_REG, GX_LIGHT0, GX_DF_NONE, GX_AF_NONE);
+  auto noneBytes = capture_fifo();
+  ASSERT_GE(noneBytes.size(), 9u);
+  EXPECT_EQ((read_be32_at(noneBytes, 5) >> 9) & 0x3u, 2u);
+}
+
+TEST_F(GXFifoTest, ChanCtrl_DecodesRawHardwareAttenuationField) {
+  reset_gx_state();
+  decode_fifo(xf_cmd(0x100E, {1u << 9}));
+  EXPECT_EQ(g_gxState.colorChannelConfig[GX_COLOR0].attnFn, GX_AF_SPEC);
+
+  reset_gx_state();
+  decode_fifo(xf_cmd(0x100E, {2u << 9}));
+  EXPECT_EQ(g_gxState.colorChannelConfig[GX_COLOR0].attnFn, GX_AF_NONE);
+
+  reset_gx_state();
+  decode_fifo(xf_cmd(0x100E, {3u << 9}));
+  EXPECT_EQ(g_gxState.colorChannelConfig[GX_COLOR0].attnFn, GX_AF_SPOT);
+
+  reset_gx_state();
+  decode_fifo(xf_cmd(0x100E, {0u << 9}));
+  EXPECT_EQ(g_gxState.colorChannelConfig[GX_COLOR0].attnFn, GX_AF_NONE);
+}
+
+TEST_F(GXFifoTest, ChanCtrl_Color0A0_Compound) {
+  // GX_COLOR0A0 should set both GX_COLOR0 and GX_ALPHA0
+  GXSetChanCtrl(GX_COLOR0A0, true, GX_SRC_REG, GX_SRC_VTX, GX_LIGHT0, GX_DF_CLAMP, GX_AF_SPOT);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // Both COLOR0 and ALPHA0 should be configured identically
+  auto& cfgC = g_gxState.colorChannelConfig[GX_COLOR0];
+  EXPECT_TRUE(cfgC.lightingEnabled);
+  EXPECT_EQ(cfgC.matSrc, GX_SRC_VTX);
+  EXPECT_EQ(cfgC.ambSrc, GX_SRC_REG);
+  EXPECT_EQ(cfgC.diffFn, GX_DF_CLAMP);
+  EXPECT_EQ(cfgC.attnFn, GX_AF_SPOT);
+
+  auto& cfgA = g_gxState.colorChannelConfig[GX_ALPHA0];
+  EXPECT_TRUE(cfgA.lightingEnabled);
+  EXPECT_EQ(cfgA.matSrc, GX_SRC_VTX);
+  EXPECT_EQ(cfgA.ambSrc, GX_SRC_REG);
+  EXPECT_EQ(cfgA.attnFn, GX_AF_SPOT);
+
+  EXPECT_TRUE(g_gxState.colorChannelState[GX_COLOR0].lightMask[0]);
+  EXPECT_TRUE(g_gxState.colorChannelState[GX_ALPHA0].lightMask[0]);
+}
+
+TEST_F(GXFifoTest, ChanCtrl_Color1A1_Compound) {
+  GXSetChanCtrl(GX_COLOR1A1, false, GX_SRC_VTX, GX_SRC_VTX, 0, GX_DF_NONE, GX_AF_NONE);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& cfgC = g_gxState.colorChannelConfig[GX_COLOR1];
+  EXPECT_FALSE(cfgC.lightingEnabled);
+  EXPECT_EQ(cfgC.ambSrc, GX_SRC_VTX);
+  EXPECT_EQ(cfgC.matSrc, GX_SRC_VTX);
+
+  auto& cfgA = g_gxState.colorChannelConfig[GX_ALPHA1];
+  EXPECT_FALSE(cfgA.lightingEnabled);
+  EXPECT_EQ(cfgA.ambSrc, GX_SRC_VTX);
+  EXPECT_EQ(cfgA.matSrc, GX_SRC_VTX);
+}
+
+// --- GXSetTexCoordGen2 (XF 0x1040-0x105F) ---
+
+TEST_F(GXFifoTest, TexCoordGen_Mtx2x4_Tex0) {
+  GXSetTexCoordGen2(GX_TEXCOORD0, GX_TG_MTX2x4, GX_TG_TEX0, GX_TEXMTX0, GX_FALSE, GX_PTIDENTITY);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& tcg = g_gxState.tcgs[GX_TEXCOORD0];
+  EXPECT_EQ(tcg.type, GX_TG_MTX2x4);
+  EXPECT_EQ(tcg.src, GX_TG_TEX0);
+  EXPECT_EQ(tcg.mtx, GX_TEXMTX0);
+  EXPECT_EQ(tcg.postMtx, GX_PTIDENTITY);
+}
+
+TEST_F(GXFifoTest, TexCoordGen_Mtx3x4_Nrm) {
+  GXSetTexCoordGen2(GX_TEXCOORD1, GX_TG_MTX3x4, GX_TG_NRM, GX_TEXMTX0, GX_TRUE, GX_PTTEXMTX0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& tcg = g_gxState.tcgs[GX_TEXCOORD1];
+  EXPECT_EQ(tcg.type, GX_TG_MTX3x4);
+  EXPECT_EQ(tcg.src, GX_TG_NRM);
+  EXPECT_EQ(tcg.mtx, GX_TEXMTX0);
+  EXPECT_TRUE(tcg.normalize);
+  EXPECT_EQ(tcg.postMtx, GX_PTTEXMTX0);
+}
+
+TEST_F(GXFifoTest, TexCoordGen_SRTG_Color0) {
+  GXSetTexCoordGen2(GX_TEXCOORD0, GX_TG_SRTG, GX_TG_COLOR0, GX_TEXMTX0, GX_FALSE, GX_PTIDENTITY);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& tcg = g_gxState.tcgs[GX_TEXCOORD0];
+  EXPECT_EQ(tcg.type, GX_TG_SRTG);
+  EXPECT_EQ(tcg.mtx, GX_TEXMTX0);
+}
+
+TEST_F(GXFifoTest, TexCoordGen_NonZeroMtx) {
+  GXSetTexCoordGen2(GX_TEXCOORD0, GX_TG_MTX3x4, GX_TG_TEX0, GX_TEXMTX3, GX_FALSE, GX_PTTEXMTX5);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& tcg = g_gxState.tcgs[GX_TEXCOORD0];
+  EXPECT_EQ(tcg.type, GX_TG_MTX3x4);
+  EXPECT_EQ(tcg.src, GX_TG_TEX0);
+  EXPECT_EQ(tcg.mtx, GX_TEXMTX3);
+  EXPECT_EQ(tcg.postMtx, GX_PTTEXMTX5);
+}
+
+TEST_F(GXFifoTest, TexCoordGen_MultipleCoords) {
+  GXSetTexCoordGen2(GX_TEXCOORD0, GX_TG_MTX3x4, GX_TG_TEX0, GX_TEXMTX0, GX_FALSE, GX_PTTEXMTX0);
+  GXSetTexCoordGen2(GX_TEXCOORD1, GX_TG_MTX3x4, GX_TG_TEX1, GX_TEXMTX1, GX_FALSE, GX_PTTEXMTX1);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tcgs[0].mtx, GX_TEXMTX0);
+  EXPECT_EQ(g_gxState.tcgs[0].postMtx, GX_PTTEXMTX0);
+  EXPECT_EQ(g_gxState.tcgs[0].src, GX_TG_TEX0);
+  EXPECT_EQ(g_gxState.tcgs[1].mtx, GX_TEXMTX1);
+  EXPECT_EQ(g_gxState.tcgs[1].postMtx, GX_PTTEXMTX1);
+  EXPECT_EQ(g_gxState.tcgs[1].src, GX_TG_TEX1);
+}
+
+TEST_F(GXFifoTest, TexCoordGen_HighCoord_MatIdxB) {
+  // TexCoord4+ uses matIdxB
+  GXSetTexCoordGen2(GX_TEXCOORD4, GX_TG_MTX2x4, GX_TG_TEX4, GX_TEXMTX5, GX_FALSE, GX_PTTEXMTX3);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& tcg = g_gxState.tcgs[GX_TEXCOORD4];
+  EXPECT_EQ(tcg.type, GX_TG_MTX2x4);
+  EXPECT_EQ(tcg.src, GX_TG_TEX4);
+  EXPECT_EQ(tcg.mtx, GX_TEXMTX5);
+  EXPECT_EQ(tcg.postMtx, GX_PTTEXMTX3);
+}
+
+TEST_F(GXFifoTest, TexCoordGen_Identity) {
+  GXSetTexCoordGen2(GX_TEXCOORD0, GX_TG_MTX2x4, GX_TG_TEX0, GX_IDENTITY, GX_FALSE, GX_PTIDENTITY);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& tcg = g_gxState.tcgs[GX_TEXCOORD0];
+  EXPECT_EQ(tcg.mtx, GX_IDENTITY);
+  EXPECT_EQ(tcg.postMtx, GX_PTIDENTITY);
+}
+
+TEST_F(GXFifoTest, MatrixIndexA_DecodesTexMatricesFromCpPacket) {
+  const u32 value = (GX_PNMTX3 << 0) | (GX_TEXMTX3 << 6) | (GX_TEXMTX4 << 12) | (GX_IDENTITY << 18) |
+                    (GX_TEXMTX7 << 24);
+  auto bytes = cp_cmd(0x30, value);
+
+  reset_gx_state();
+  g_gxState.tcgs[0].mtx = GX_IDENTITY;
+  g_gxState.tcgs[1].mtx = GX_IDENTITY;
+  g_gxState.tcgs[2].mtx = GX_TEXMTX0;
+  g_gxState.tcgs[3].mtx = GX_IDENTITY;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.currentPnMtx, 3u);
+  EXPECT_EQ(g_gxState.tcgs[0].mtx, GX_TEXMTX3);
+  EXPECT_EQ(g_gxState.tcgs[1].mtx, GX_TEXMTX4);
+  EXPECT_EQ(g_gxState.tcgs[2].mtx, GX_IDENTITY);
+  EXPECT_EQ(g_gxState.tcgs[3].mtx, GX_TEXMTX7);
+}
+
+TEST_F(GXFifoTest, MatrixIndexB_DecodesTexMatricesFromCpPacket) {
+  const u32 value = (GX_TEXMTX4 << 0) | (GX_TEXMTX5 << 6) | (GX_IDENTITY << 12) | (GX_TEXMTX9 << 18);
+  auto bytes = cp_cmd(0x40, value);
+
+  reset_gx_state();
+  g_gxState.tcgs[4].mtx = GX_IDENTITY;
+  g_gxState.tcgs[5].mtx = GX_IDENTITY;
+  g_gxState.tcgs[6].mtx = GX_TEXMTX0;
+  g_gxState.tcgs[7].mtx = GX_IDENTITY;
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.tcgs[4].mtx, GX_TEXMTX4);
+  EXPECT_EQ(g_gxState.tcgs[5].mtx, GX_TEXMTX5);
+  EXPECT_EQ(g_gxState.tcgs[6].mtx, GX_IDENTITY);
+  EXPECT_EQ(g_gxState.tcgs[7].mtx, GX_TEXMTX9);
+}
+
+// --- GXSetChanAmbColor / GXSetChanMatColor (XF 0x100A-0x100D) ---
+
+TEST_F(GXFifoTest, ChanAmbColor_Color0) {
+  GXColor amb = {64, 128, 192, 255};
+  GXSetChanAmbColor(GX_COLOR0, amb);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& state = g_gxState.colorChannelState[GX_COLOR0];
+  EXPECT_NEAR(state.ambColor[0], 64.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.ambColor[1], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.ambColor[2], 192.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.ambColor[3], 255.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, ChanMatColor_Color0) {
+  GXColor mat = {255, 0, 128, 64};
+  GXSetChanMatColor(GX_COLOR0, mat);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& state = g_gxState.colorChannelState[GX_COLOR0];
+  EXPECT_NEAR(state.matColor[0], 255.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.matColor[1], 0.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.matColor[2], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.matColor[3], 64.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, ChanAmbColor_Color1) {
+  GXColor amb = {10, 20, 30, 40};
+  GXSetChanAmbColor(GX_COLOR1, amb);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& state = g_gxState.colorChannelState[GX_COLOR1];
+  EXPECT_NEAR(state.ambColor[0], 10.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.ambColor[1], 20.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.ambColor[2], 30.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.ambColor[3], 40.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, ChanMatColor_Color1) {
+  GXColor mat = {100, 150, 200, 250};
+  GXSetChanMatColor(GX_COLOR1, mat);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& state = g_gxState.colorChannelState[GX_COLOR1];
+  EXPECT_NEAR(state.matColor[0], 100.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.matColor[1], 150.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.matColor[2], 200.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(state.matColor[3], 250.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, ChanAmbColor_Color0A0_Compound) {
+  // GX_COLOR0A0 should write to both COLOR0 and ALPHA0 XF registers
+  GXColor amb = {80, 160, 240, 128};
+  GXSetChanAmbColor(GX_COLOR0A0, amb);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& stateC = g_gxState.colorChannelState[GX_COLOR0];
+  EXPECT_NEAR(stateC.ambColor[0], 80.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(stateC.ambColor[1], 160.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(stateC.ambColor[2], 240.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(stateC.ambColor[3], 128.f / 255.f, 1.f / 255.f);
+  // ALPHA0 shares the same XF register as COLOR0, so should match
+  auto& stateA = g_gxState.colorChannelState[GX_ALPHA0];
+  EXPECT_NEAR(stateA.ambColor[0], 80.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(stateA.ambColor[3], 128.f / 255.f, 1.f / 255.f);
+}
+
+TEST_F(GXFifoTest, ChanMatColor_Color1A1_Compound) {
+  GXColor mat = {32, 64, 96, 128};
+  GXSetChanMatColor(GX_COLOR1A1, mat);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& stateC = g_gxState.colorChannelState[GX_COLOR1];
+  EXPECT_NEAR(stateC.matColor[0], 32.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(stateC.matColor[1], 64.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(stateC.matColor[2], 96.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(stateC.matColor[3], 128.f / 255.f, 1.f / 255.f);
+
+  auto& stateA = g_gxState.colorChannelState[GX_ALPHA1];
+  EXPECT_NEAR(stateA.matColor[0], 32.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(stateA.matColor[3], 128.f / 255.f, 1.f / 255.f);
+}
+
+// GXSetFog (BP 0xEE-0xF2): fog A/B/C parameters, type and color
+
+// --- Fog with perspective linear fog, typical parameters ---
+TEST_F(GXFifoTest, Fog_PerspLin_Typical) {
+  GXColor fogColor = {128, 200, 255, 255};
+  GXSetFog(GX_FOG_PERSP_LIN, 100.f, 900.f, 0.1f, 1000.f, fogColor);
+  auto bytes = capture_fifo();
+
+  // Should produce 5 BP writes (0xEE-0xF2): 5 * 5 = 25 bytes
+  ASSERT_EQ(bytes.size(), 25u);
+  // Verify BP opcodes and register IDs
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0xEE);
+  EXPECT_EQ(bytes[5], 0x61);
+  EXPECT_EQ(bytes[6], 0xEF);
+  EXPECT_EQ(bytes[10], 0x61);
+  EXPECT_EQ(bytes[11], 0xF0);
+  EXPECT_EQ(bytes[15], 0x61);
+  EXPECT_EQ(bytes[16], 0xF1);
+  EXPECT_EQ(bytes[20], 0x61);
+  EXPECT_EQ(bytes[21], 0xF2);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // Compute expected A, B, C from the SDK formula
+  float nearZ = 0.1f, farZ = 1000.f, startZ = 100.f, endZ = 900.f;
+  float A = (farZ * nearZ) / ((farZ - nearZ) * (endZ - startZ));
+  float B = farZ / (farZ - nearZ);
+  float C = startZ / (endZ - startZ);
+
+  // Allow tolerance for encoding precision loss (11-bit mantissa)
+  EXPECT_NEAR(g_gxState.fog.a, A, std::abs(A) * 1e-3f);
+  EXPECT_NEAR(g_gxState.fog.b, B, std::abs(B) * 1e-3f);
+  EXPECT_NEAR(g_gxState.fog.c, C, std::abs(C) * 1e-3f);
+  expect_fog_raw_fields_match_decoded_state();
+  EXPECT_EQ(g_gxState.fog.type, GX_FOG_PERSP_LIN);
+  EXPECT_NEAR(g_gxState.fog.color[0], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.fog.color[1], 200.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.fog.color[2], 255.f / 255.f, 1.f / 255.f);
+}
+
+// --- Orthographic fog keeps the projection bit and uses the SDK ortho coefficients ---
+TEST_F(GXFifoTest, Fog_OrthoLin_Typical) {
+  GXColor fogColor = {128, 200, 255, 255};
+  GXSetFog(GX_FOG_ORTHO_LIN, 100.f, 900.f, 0.1f, 1000.f, fogColor);
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 25u);
+  const u32 fog3 = (static_cast<u32>(bytes[16]) << 24) | (static_cast<u32>(bytes[17]) << 16) |
+                   (static_cast<u32>(bytes[18]) << 8) | static_cast<u32>(bytes[19]);
+  EXPECT_EQ((fog3 >> 20) & 1u, 1u);
+  EXPECT_EQ((fog3 >> 21) & 7u, static_cast<u32>(GX_FOG_LIN));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  float nearZ = 0.1f, farZ = 1000.f, startZ = 100.f, endZ = 900.f;
+  float A = (farZ - nearZ) / (endZ - startZ);
+  float C = (startZ - nearZ) / (endZ - startZ);
+
+  EXPECT_NEAR(g_gxState.fog.a, A, std::abs(A) * 1e-3f);
+  EXPECT_FLOAT_EQ(g_gxState.fog.b, 0.f);
+  EXPECT_NEAR(g_gxState.fog.c, C, std::abs(C) * 1e-3f);
+  expect_fog_raw_fields_match_decoded_state();
+  EXPECT_EQ(g_gxState.fog.type, GX_FOG_ORTHO_LIN);
+}
+
+// --- Fog with degenerate parameters (nearZ == farZ) ---
+TEST_F(GXFifoTest, Fog_Degenerate_EqualDepths) {
+  GXColor fogColor = {0, 0, 0, 255};
+  GXSetFog(GX_FOG_PERSP_EXP, 0.f, 100.f, 10.f, 10.f, fogColor);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // When nearZ == farZ, SDK sets A=0, B=0.5, C=0
+  EXPECT_FLOAT_EQ(g_gxState.fog.a, 0.f);
+  EXPECT_NEAR(g_gxState.fog.b, 0.5f, 1e-3f);
+  EXPECT_FLOAT_EQ(g_gxState.fog.c, 0.f);
+  expect_fog_raw_fields_match_decoded_state();
+  EXPECT_EQ(g_gxState.fog.type, GX_FOG_PERSP_EXP);
+}
+
+// --- Fog type: none ---
+TEST_F(GXFifoTest, Fog_None) {
+  GXColor fogColor = {64, 64, 64, 255};
+  GXSetFog(GX_FOG_NONE, 0.f, 0.f, 0.f, 0.f, fogColor);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.fog.type, GX_FOG_NONE);
+  EXPECT_FLOAT_EQ(g_gxState.fog.a, 0.f);
+  EXPECT_NEAR(g_gxState.fog.b, 0.5f, 1e-3f);
+  EXPECT_FLOAT_EQ(g_gxState.fog.c, 0.f);
+  expect_fog_raw_fields_match_decoded_state();
+  EXPECT_NEAR(g_gxState.fog.color[0], 64.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.fog.color[1], 64.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.fog.color[2], 64.f / 255.f, 1.f / 255.f);
+}
+
+// --- Fog with perspective reverse exponential squared type ---
+TEST_F(GXFifoTest, Fog_PerspRevExp2) {
+  GXColor fogColor = {255, 0, 0, 255};
+  GXSetFog(GX_FOG_PERSP_REVEXP2, 50.f, 500.f, 1.f, 1000.f, fogColor);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  float nearZ = 1.f, farZ = 1000.f, startZ = 50.f, endZ = 500.f;
+  float A = (farZ * nearZ) / ((farZ - nearZ) * (endZ - startZ));
+  float B = farZ / (farZ - nearZ);
+  float C = startZ / (endZ - startZ);
+
+  EXPECT_NEAR(g_gxState.fog.a, A, std::abs(A) * 1e-3f);
+  EXPECT_NEAR(g_gxState.fog.b, B, std::abs(B) * 1e-3f);
+  EXPECT_NEAR(g_gxState.fog.c, C, std::abs(C) * 1e-3f);
+  expect_fog_raw_fields_match_decoded_state();
+  EXPECT_EQ(g_gxState.fog.type, GX_FOG_PERSP_REVEXP2);
+  EXPECT_NEAR(g_gxState.fog.color[0], 1.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.fog.color[1], 0.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.fog.color[2], 0.f, 1.f / 255.f);
+}
+
+// GXSetIndTexMtx (BP 0x06-0x0E): indirect texture matrix parameters
+
+// --- IndTexMtx 0 with half-scale diagonal matrix ---
+// Note: 11-bit signed range limits values to [-1.0, 0.999], so 1.0 is not representable.
+TEST_F(GXFifoTest, IndTexMtx0_HalfScale) {
+  f32 mtx[2][3] = {
+      {0.5f, 0.0f, 0.0f},
+      {0.0f, 0.5f, 0.0f},
+  };
+  GXSetIndTexMtx(GX_ITM_0, mtx, 0);
+  auto bytes = capture_fifo();
+
+  // Should produce 3 BP writes: 3 * 5 = 15 bytes
+  ASSERT_EQ(bytes.size(), 15u);
+  // Verify BP opcodes and register IDs (0x06, 0x07, 0x08 for matrix 0)
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0x06);
+  EXPECT_EQ(bytes[5], 0x61);
+  EXPECT_EQ(bytes[6], 0x07);
+  EXPECT_EQ(bytes[10], 0x61);
+  EXPECT_EQ(bytes[11], 0x08);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  const auto& info = g_gxState.indTexMtxs[0];
+  // 11-bit fixed-point (1/1024) precision
+  float tol = 1.0f / 1024.0f;
+  EXPECT_NEAR(info.mtx.m0.x, 0.5f, tol);
+  EXPECT_NEAR(info.mtx.m0.y, 0.0f, tol);
+  EXPECT_NEAR(info.mtx.m1.x, 0.0f, tol);
+  EXPECT_NEAR(info.mtx.m1.y, 0.5f, tol);
+  EXPECT_NEAR(info.mtx.m2.x, 0.0f, tol);
+  EXPECT_NEAR(info.mtx.m2.y, 0.0f, tol);
+  EXPECT_EQ(info.scaleExp, 0);
+}
+
+// --- IndTexMtx 1 with fractional values and positive scale ---
+TEST_F(GXFifoTest, IndTexMtx1_FractionalWithScale) {
+  f32 mtx[2][3] = {
+      {0.5f, 0.25f, -0.125f},
+      {-0.5f, 0.75f, 0.0f},
+  };
+  GXSetIndTexMtx(GX_ITM_1, mtx, 3);
+  auto bytes = capture_fifo();
+
+  // Register IDs for matrix 1: 0x09, 0x0A, 0x0B
+  ASSERT_EQ(bytes.size(), 15u);
+  EXPECT_EQ(bytes[1], 0x09);
+  EXPECT_EQ(bytes[6], 0x0A);
+  EXPECT_EQ(bytes[11], 0x0B);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  const auto& info = g_gxState.indTexMtxs[1];
+  float tol = 1.0f / 1024.0f;
+  EXPECT_NEAR(info.mtx.m0.x, 0.5f, tol);
+  EXPECT_NEAR(info.mtx.m0.y, -0.5f, tol);
+  EXPECT_NEAR(info.mtx.m1.x, 0.25f, tol);
+  EXPECT_NEAR(info.mtx.m1.y, 0.75f, tol);
+  EXPECT_NEAR(info.mtx.m2.x, -0.125f, tol);
+  EXPECT_NEAR(info.mtx.m2.y, 0.0f, tol);
+  EXPECT_EQ(info.scaleExp, 3);
+}
+
+// --- IndTexMtx 2 with negative scale exponent ---
+TEST_F(GXFifoTest, IndTexMtx2_NegativeScale) {
+  f32 mtx[2][3] = {
+      {0.0f, 0.0f, 0.0f},
+      {0.0f, 0.0f, 0.0f},
+  };
+  GXSetIndTexMtx(GX_ITM_2, mtx, -5);
+  auto bytes = capture_fifo();
+
+  // Register IDs for matrix 2: 0x0C, 0x0D, 0x0E
+  ASSERT_EQ(bytes.size(), 15u);
+  EXPECT_EQ(bytes[1], 0x0C);
+  EXPECT_EQ(bytes[6], 0x0D);
+  EXPECT_EQ(bytes[11], 0x0E);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  const auto& info = g_gxState.indTexMtxs[2];
+  EXPECT_EQ(info.scaleExp, -5);
+}
+
+TEST_F(GXFifoTest, IndTexMtxScaleMultiplier_MatchesHardwareExponent) {
+  EXPECT_FLOAT_EQ(aurora::gx::indirect_matrix_scale_multiplier(0), 1.0f);
+  EXPECT_FLOAT_EQ(aurora::gx::indirect_matrix_scale_multiplier(3), 8.0f);
+  EXPECT_FLOAT_EQ(aurora::gx::indirect_matrix_scale_multiplier(-5), 0.03125f);
+}
+
+TEST_F(GXFifoTest, IndTexMtxDynamicAliases_MapToSameSlotsAsSdk) {
+  f32 mtxS[2][3] = {
+      {0.25f, 0.0f, 0.0f},
+      {0.0f, 0.25f, 0.0f},
+  };
+  f32 mtxT[2][3] = {
+      {0.5f, 0.0f, 0.0f},
+      {0.0f, 0.5f, 0.0f},
+  };
+
+  GXSetIndTexMtx(GX_ITM_S1, mtxS, 2);
+  GXSetIndTexMtx(GX_ITM_T2, mtxT, -3);
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 30u);
+  EXPECT_EQ(bytes[1], 0x09);
+  EXPECT_EQ(bytes[6], 0x0A);
+  EXPECT_EQ(bytes[11], 0x0B);
+  EXPECT_EQ(bytes[16], 0x0C);
+  EXPECT_EQ(bytes[21], 0x0D);
+  EXPECT_EQ(bytes[26], 0x0E);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  constexpr float tol = 1.0f / 1024.0f;
+  EXPECT_NEAR(g_gxState.indTexMtxs[1].mtx.m0.x, 0.25f, tol);
+  EXPECT_NEAR(g_gxState.indTexMtxs[1].mtx.m1.y, 0.25f, tol);
+  EXPECT_EQ(g_gxState.indTexMtxs[1].scaleExp, 2);
+  EXPECT_NEAR(g_gxState.indTexMtxs[2].mtx.m0.x, 0.5f, tol);
+  EXPECT_NEAR(g_gxState.indTexMtxs[2].mtx.m1.y, 0.5f, tol);
+  EXPECT_EQ(g_gxState.indTexMtxs[2].scaleExp, -3);
+}
+
+// --- IndTexMtx 0 does not affect matrix 1 ---
+TEST_F(GXFifoTest, IndTexMtx0_Isolation) {
+  f32 mtx0[2][3] = {
+      {0.5f, 0.0f, 0.0f},
+      {0.0f, 0.5f, 0.0f},
+  };
+  f32 mtx1[2][3] = {
+      {-1.0f, 0.0f, 0.0f},
+      {0.0f, -1.0f, 0.0f},
+  };
+  GXSetIndTexMtx(GX_ITM_0, mtx0, 1);
+  GXSetIndTexMtx(GX_ITM_1, mtx1, -2);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  float tol = 1.0f / 1024.0f;
+  // Matrix 0
+  EXPECT_NEAR(g_gxState.indTexMtxs[0].mtx.m0.x, 0.5f, tol);
+  EXPECT_NEAR(g_gxState.indTexMtxs[0].mtx.m1.y, 0.5f, tol);
+  EXPECT_EQ(g_gxState.indTexMtxs[0].scaleExp, 1);
+  // Matrix 1
+  EXPECT_NEAR(g_gxState.indTexMtxs[1].mtx.m0.x, -1.0f, tol);
+  EXPECT_NEAR(g_gxState.indTexMtxs[1].mtx.m1.y, -1.0f, tol);
+  EXPECT_EQ(g_gxState.indTexMtxs[1].scaleExp, -2);
+}
+
+// SU texture coordinate scale (BP 0x30-0x3F)
+
+// --- GXSetTexCoordScaleManually sets width/height ---
+TEST_F(GXFifoTest, TexCoordScale_Manual_Coord0) {
+  GXSetTexCoordScaleManually(GX_TEXCOORD0, GX_TRUE, 256, 128);
+  auto bytes = capture_fifo();
+
+  // Two BP writes (suTs0 + suTs1): 2 * 5 = 10 bytes
+  ASSERT_EQ(bytes.size(), 10u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0x30); // suTs0[0]
+  EXPECT_EQ(bytes[5], 0x61);
+  EXPECT_EQ(bytes[6], 0x31); // suTs1[0]
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  const auto& tcs = g_gxState.texCoordScales[0];
+  EXPECT_EQ(tcs.scaleS, 255u); // width - 1
+  EXPECT_EQ(tcs.scaleT, 127u); // height - 1
+}
+
+// --- GXSetTexCoordScaleManually for coord 3 ---
+TEST_F(GXFifoTest, TexCoordScale_Manual_Coord3) {
+  GXSetTexCoordScaleManually(GX_TEXCOORD3, GX_TRUE, 512, 512);
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 10u);
+  EXPECT_EQ(bytes[1], 0x36); // suTs0[3] = 0x30 + 3*2
+  EXPECT_EQ(bytes[6], 0x37); // suTs1[3] = 0x31 + 3*2
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  const auto& tcs = g_gxState.texCoordScales[3];
+  EXPECT_EQ(tcs.scaleS, 511u);
+  EXPECT_EQ(tcs.scaleT, 511u);
+}
+
+// --- GXSetTexCoordScaleManually with bias and cyl wrap ---
+TEST_F(GXFifoTest, TexCoordScale_BiasAndCylWrap) {
+  // Enable manual mode first, then set bias and cyl wrap
+  GXSetTexCoordScaleManually(GX_TEXCOORD0, GX_TRUE, 64, 64);
+  capture_fifo(); // discard
+
+  GXSetTexCoordBias(GX_TEXCOORD0, GX_TRUE, GX_FALSE);
+  auto biasBytes = capture_fifo();
+
+  GXSetTexCoordCylWrap(GX_TEXCOORD0, GX_FALSE, GX_TRUE);
+  auto cylBytes = capture_fifo();
+
+  // Each writes 2 BP regs
+  ASSERT_EQ(biasBytes.size(), 10u);
+  ASSERT_EQ(cylBytes.size(), 10u);
+
+  reset_gx_state();
+  decode_fifo(biasBytes);
+  decode_fifo(cylBytes);
+
+  const auto& tcs = g_gxState.texCoordScales[0];
+  EXPECT_TRUE(tcs.biasS);
+  EXPECT_FALSE(tcs.biasT);
+  EXPECT_FALSE(tcs.cylWrapS);
+  EXPECT_TRUE(tcs.cylWrapT);
+}
+
+// --- GXEnableTexOffsets ---
+TEST_F(GXFifoTest, TexCoordScale_TexOffsets) {
+  GXEnableTexOffsets(GX_TEXCOORD2, GX_TRUE, GX_TRUE);
+  auto bytes = capture_fifo();
+
+  // One BP write (suTs0 only): 5 bytes
+  ASSERT_EQ(bytes.size(), 5u);
+  EXPECT_EQ(bytes[1], 0x34); // suTs0[2] = 0x30 + 2*2
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  const auto& tcs = g_gxState.texCoordScales[2];
+  EXPECT_TRUE(tcs.lineOffset);
+  EXPECT_TRUE(tcs.pointOffset);
+}
+
+TEST_F(GXFifoTest, TexCoordScale_TexOffsets_Disabled) {
+  GXEnableTexOffsets(GX_TEXCOORD2, GX_FALSE, GX_FALSE);
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 5u);
+  EXPECT_EQ(bytes[1], 0x34);
+
+  reset_gx_state();
+  g_gxState.texCoordScales[2].lineOffset = true;
+  g_gxState.texCoordScales[2].pointOffset = true;
+  decode_fifo(bytes);
+
+  const auto& tcs = g_gxState.texCoordScales[2];
+  EXPECT_FALSE(tcs.lineOffset);
+  EXPECT_FALSE(tcs.pointOffset);
+}
+
+// --- Coord isolation: writing coord 0 doesn't affect coord 1 ---
+TEST_F(GXFifoTest, TexCoordScale_Isolation) {
+  GXSetTexCoordScaleManually(GX_TEXCOORD0, GX_TRUE, 100, 200);
+  GXSetTexCoordScaleManually(GX_TEXCOORD1, GX_TRUE, 300, 400);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.texCoordScales[0].scaleS, 99u);
+  EXPECT_EQ(g_gxState.texCoordScales[0].scaleT, 199u);
+  EXPECT_EQ(g_gxState.texCoordScales[1].scaleS, 299u);
+  EXPECT_EQ(g_gxState.texCoordScales[1].scaleT, 399u);
+}
+
+// GXSetCopyClear (BP 0x4F-0x51): clear color and depth
+
+TEST_F(GXFifoTest, DispCopyState_EncodesBpAndYScale) {
+  GXSetDispCopySrc(4, 8, 640, 480);
+  GXSetDispCopyDst(640, 480);
+  const u32 lines = GXSetDispCopyYScale(1.0f);
+  auto bytes = capture_fifo();
+
+  EXPECT_EQ(lines, 480u);
+  EXPECT_TRUE(has_bp_write(bytes, 0x49));
+  EXPECT_TRUE(has_bp_write(bytes, 0x4A));
+  EXPECT_TRUE(has_bp_write(bytes, 0x4D));
+  EXPECT_TRUE(has_bp_write(bytes, 0x4E));
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.dispCopySrc.x, 4);
+  EXPECT_EQ(g_gxState.dispCopySrc.y, 8);
+  EXPECT_EQ(g_gxState.dispCopySrc.width, 640);
+  EXPECT_EQ(g_gxState.dispCopySrc.height, 480);
+  EXPECT_NEAR(g_gxState.dispCopyYScale, 1.0f, 0.001f);
+}
+
+TEST_F(GXFifoTest, DispCopyYScaleHelpers_MatchIdentityScale) {
+  EXPECT_EQ(GXGetNumXfbLines(480, 1.0f), 480u);
+  EXPECT_NEAR(GXGetYScaleFactor(480, 480), 1.0f, 0.001f);
+}
+
+TEST_F(GXFifoTest, CopyFilter_EncodesAndDecodesAaAndVerticalFilter) {
+  u8 samples[12][2] = {};
+  for (size_t i = 0; i < 12; ++i) {
+    samples[i][0] = static_cast<u8>((i * 2) & 0x0f);
+    samples[i][1] = static_cast<u8>((i * 2 + 1) & 0x0f);
+  }
+  u8 vfilter[7] = {1, 2, 3, 4, 5, 6, 7};
+
+  GXSetCopyFilter(GX_TRUE, samples, GX_TRUE, vfilter);
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 30u);
+  EXPECT_EQ(bytes[1], 0x01);
+  EXPECT_EQ(bytes[6], 0x02);
+  EXPECT_EQ(bytes[11], 0x03);
+  EXPECT_EQ(bytes[16], 0x04);
+  EXPECT_EQ(bytes[21], 0x53);
+  EXPECT_EQ(bytes[26], 0x54);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_TRUE(g_gxState.copyFilterAa);
+  EXPECT_TRUE(g_gxState.copyFilterVf);
+  for (size_t i = 0; i < 12; ++i) {
+    EXPECT_EQ(g_gxState.copyFilterSamplePattern[i][0], samples[i][0]);
+    EXPECT_EQ(g_gxState.copyFilterSamplePattern[i][1], samples[i][1]);
+  }
+  for (size_t i = 0; i < 7; ++i) {
+    EXPECT_EQ(g_gxState.copyFilterVFilter[i], vfilter[i]);
+  }
+}
+
+TEST_F(GXFifoTest, CopyFilter_DisabledUsesSdkFallbackCoefficients) {
+  u8 samples[12][2] = {};
+  u8 vfilter[7] = {};
+
+  GXSetCopyFilter(GX_FALSE, samples, GX_FALSE, vfilter);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_FALSE(g_gxState.copyFilterAa);
+  EXPECT_FALSE(g_gxState.copyFilterVf);
+  for (const auto& sample : g_gxState.copyFilterSamplePattern) {
+    EXPECT_EQ(sample[0], 6u);
+    EXPECT_EQ(sample[1], 6u);
+  }
+  const std::array<u8, 7> expectedVFilter{0, 0, 21, 22, 21, 0, 0};
+  EXPECT_EQ(g_gxState.copyFilterVFilter, expectedVFilter);
+}
+
+TEST_F(GXFifoTest, DispCopyGamma_UpdatesCopyTriggerShadowBits) {
+  GXSetDispCopyGamma(GX_GM_2_2);
+
+  EXPECT_EQ(g_gxState.dispCopyGamma, GX_GM_2_2);
+  EXPECT_EQ((g_gxState.bpRegCache[0x52] >> 7) & 3u, static_cast<u32>(GX_GM_2_2));
+}
+
+TEST_F(GXFifoTest, CopyTrigger_DecodesClampGammaFormatHalfScaleAndFrameMode) {
+  const u32 value = (static_cast<u32>(GX_CLAMP_TOP) << 0) | (static_cast<u32>(GX_TF_RGBA8) << 3) |
+                    (static_cast<u32>(GX_GM_1_7) << 7) | (1u << 9) | (2u << 12);
+  auto bytes = bp_cmd(0x52, value);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.copyClamp, GX_CLAMP_TOP);
+  EXPECT_EQ(g_gxState.texCopyFmt, GX_TF_RGBA8);
+  EXPECT_EQ(g_gxState.dispCopyGamma, GX_GM_1_7);
+  EXPECT_TRUE(g_gxState.texCopyHalfScale);
+  EXPECT_EQ(g_gxState.dispCopyFrame2Field, 2u);
+}
+
+TEST_F(GXFifoTest, CopyTexClearTruePassesScratchRectAndUpdateMasksToResolve) {
+  std::array<u8, 152 * 114 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+  gxState().colorUpdate = true;
+  gxState().alphaUpdate = true;
+  gxState().depthUpdate = true;
+  gxState().dstAlpha = UINT32_MAX;
+  gxState().clearColor = {64.f / 255.f, 128.f / 255.f, 192.f / 255.f, 32.f / 255.f};
+  gxState().clearDepth = 0x123456;
+
+  GXSetTexCopySrc(336, 300, 152, 114);
+  GXSetTexCopyDst(152, 114, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_TRUE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  const auto& resolve = records.front();
+  EXPECT_EQ(resolve.rect, (aurora::gfx::ClipRect{336, 300, 152, 114}));
+  ASSERT_TRUE(resolve.sourceRectPixels.has_value());
+  EXPECT_EQ(resolve.sourceRectPixels->x(), 336.f);
+  EXPECT_EQ(resolve.sourceRectPixels->y(), 300.f);
+  EXPECT_EQ(resolve.sourceRectPixels->z(), 152.f);
+  EXPECT_EQ(resolve.sourceRectPixels->w(), 114.f);
+  EXPECT_TRUE(resolve.clearColor);
+  EXPECT_TRUE(resolve.clearAlpha);
+  EXPECT_TRUE(resolve.clearDepth);
+  EXPECT_NEAR(resolve.clearColorValue.x(), 64.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(resolve.clearColorValue.y(), 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(resolve.clearColorValue.z(), 192.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(resolve.clearColorValue.w(), 32.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(resolve.clearDepthValue, 0x123456 / 16777216.f, 1.f / 16777216.f);
+  EXPECT_EQ(resolve.resolveFormat, GX_TF_RGBA8);
+  EXPECT_FALSE(resolve.halfScale);
+  EXPECT_FALSE(resolve.forceOpaqueAlpha);
+  EXPECT_EQ(gxState().copyTextures.at(image.data()).revision, 1u);
+}
+
+TEST_F(GXFifoTest, CopyTexColorFormatMarksResolvePersistent) {
+  std::array<u8, 152 * 114 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(336, 300, 152, 114);
+  GXSetTexCopyDst(152, 114, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  EXPECT_TRUE(records.front().persistentCopy);
+}
+
+TEST_F(GXFifoTest, RecurringColorCopyKeepsLaterResolveSkippable) {
+  std::array<u8, 152 * 114 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(336, 300, 152, 114);
+  GXSetTexCopyDst(152, 114, GX_TF_RGBA8, GX_FALSE);
+  aurora::gfx::testing::set_current_frame(10);
+  GXCopyTex(image.data(), GX_FALSE);
+  aurora::gfx::testing::set_current_frame(11);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 2u);
+  EXPECT_TRUE(records[0].persistentCopy);
+  EXPECT_FALSE(records[1].persistentCopy);
+}
+
+TEST_F(GXFifoTest, ColorCopyAfterFrameGapRegainsPersistentProtection) {
+  std::array<u8, 152 * 114 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(336, 300, 152, 114);
+  GXSetTexCopyDst(152, 114, GX_TF_RGBA8, GX_FALSE);
+  aurora::gfx::testing::set_current_frame(10);
+  GXCopyTex(image.data(), GX_FALSE);
+  aurora::gfx::testing::set_current_frame(12);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 2u);
+  EXPECT_TRUE(records[0].persistentCopy);
+  EXPECT_TRUE(records[1].persistentCopy);
+}
+
+TEST_F(GXFifoTest, CopyTexDepthFormatKeepsResolveSkippable) {
+  std::array<u8, 4 * 4 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(0, 0, 4, 4);
+  GXSetTexCopyDst(4, 4, GX_TF_Z24X8, GX_FALSE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  EXPECT_FALSE(records.front().persistentCopy);
+}
+
+TEST_F(GXFifoTest, CopyDispResolveIsNotPersistent) {
+  GXSetDispCopySrc(0, 0, 32, 32);
+  GXSetDispCopyDst(32, 32);
+  GXCopyDisp(nullptr, GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  EXPECT_FALSE(records.front().persistentCopy);
+}
+
+TEST_F(GXFifoTest, CopyTexMipmapDstRequestsHalfScaleResolve) {
+  std::array<u8, 76 * 57 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(336, 300, 152, 114);
+  GXSetTexCopyDst(76, 57, GX_TF_RGBA8, GX_TRUE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  const auto& resolve = records.front();
+  EXPECT_EQ(resolve.rect, (aurora::gfx::ClipRect{336, 300, 152, 114}));
+  ASSERT_TRUE(resolve.sourceRectPixels.has_value());
+  EXPECT_EQ(resolve.sourceRectPixels->x(), 336.f);
+  EXPECT_EQ(resolve.sourceRectPixels->y(), 300.f);
+  EXPECT_EQ(resolve.sourceRectPixels->z(), 152.f);
+  EXPECT_EQ(resolve.sourceRectPixels->w(), 114.f);
+  EXPECT_TRUE(resolve.halfScale);
+  EXPECT_TRUE(gxState().texCopyHalfScale);
+  EXPECT_EQ(gxState().copyTextures.at(image.data()).width, 76u);
+  EXPECT_EQ(gxState().copyTextures.at(image.data()).height, 57u);
+}
+
+TEST_F(GXFifoTest, CopyTexRetainsInternalResolutionInGpuCopyAndGuestDimensionsInCache) {
+  std::array<u8, 152 * 114 * 4> image{};
+  aurora::gfx::testing::set_framebuffer_sizes(640, 528, 2560, 2112);
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(336, 300, 152, 114);
+  GXSetTexCopyDst(152, 114, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  const auto& resolve = records.front();
+  EXPECT_EQ(resolve.rect, (aurora::gfx::ClipRect{1344, 1200, 608, 456}));
+  ASSERT_TRUE(resolve.sourceRectPixels.has_value());
+  EXPECT_EQ(resolve.sourceRectPixels->x(), 1344.f);
+  EXPECT_EQ(resolve.sourceRectPixels->y(), 1200.f);
+  EXPECT_EQ(resolve.sourceRectPixels->z(), 608.f);
+  EXPECT_EQ(resolve.sourceRectPixels->w(), 456.f);
+  ASSERT_TRUE(resolve.texture);
+  EXPECT_EQ(resolve.texture->size.width, 608u);
+  EXPECT_EQ(resolve.texture->size.height, 456u);
+  EXPECT_FLOAT_EQ(resolve.copyFilterRowStride, 4.0f);
+
+  const auto& copy = gxState().copyTextures.at(image.data());
+  EXPECT_EQ(copy.width, 152u);
+  EXPECT_EQ(copy.height, 114u);
+  EXPECT_EQ(copy.dataSize, GXGetTexBufferSize(152, 114, GX_TF_RGBA8, GX_FALSE, 0));
+}
+
+TEST_F(GXFifoTest, CopyTexUsesExactRationalScaledEdgesBeforeClearing) {
+  std::array<u8, 32 * 32 * 4> image{};
+  // float32 evaluates 7 * (62 / 14) just below 31. Without stabilizing
+  // the rational copy edges, floor() expands this clear to begin at x/y 30.
+  aurora::gfx::testing::set_framebuffer_sizes(14, 14, 62, 62);
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(7, 7, 7, 7);
+  GXSetTexCopyDst(31, 31, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_TRUE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  const auto& resolve = records.front();
+  EXPECT_EQ(resolve.rect, (aurora::gfx::ClipRect{31, 31, 31, 31}));
+  ASSERT_TRUE(resolve.sourceRectPixels.has_value());
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->x(), 31.0f);
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->y(), 31.0f);
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->z(), 31.0f);
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->w(), 31.0f);
+}
+
+TEST_F(GXFifoTest, CopyTexClearDoesNotOverlapFractionalLeftEdge) {
+  std::array<u8, 152 * 114 * 4> image{};
+  // MKW split-screen scratch-copy geometry from the regression capture: the scaled source edge is
+  // x=492.975, so flooring clears column 492 while the matching viewport rasterizes from 493.
+  aurora::gfx::testing::set_framebuffer_sizes(640, 528, 939, 528);
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(336, 300, 152, 114);
+  GXSetTexCopyDst(152, 114, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_TRUE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  const auto& resolve = records.front();
+  EXPECT_EQ(resolve.rect, (aurora::gfx::ClipRect{493, 300, 223, 114}));
+  ASSERT_TRUE(resolve.sourceRectPixels.has_value());
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->x(), 492.975f);
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->y(), 300.0f);
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->z(), 223.0125f);
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->w(), 114.0f);
+}
+
+TEST_F(GXFifoTest, CopyTexClearBoundsRemainExactAtSixTimesInternalResolution) {
+  std::array<u8, 152 * 114 * 4> image{};
+  aurora::gfx::testing::set_framebuffer_sizes(640, 528, 3840, 3168);
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(336, 300, 152, 114);
+  GXSetTexCopyDst(152, 114, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_TRUE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  const auto& resolve = records.front();
+  EXPECT_EQ(resolve.rect, (aurora::gfx::ClipRect{2016, 1800, 912, 684}));
+  ASSERT_TRUE(resolve.sourceRectPixels.has_value());
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->x(), 2016.0f);
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->y(), 1800.0f);
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->z(), 912.0f);
+  EXPECT_FLOAT_EQ(resolve.sourceRectPixels->w(), 684.0f);
+}
+
+TEST_F(GXFifoTest, CopyTexRecreatesGpuCopyWhenInternalResolutionChanges) {
+  std::array<u8, 64 * 64 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+  GXSetTexCopySrc(0, 0, 64, 64);
+  GXSetTexCopyDst(64, 64, GX_TF_RGBA8, GX_FALSE);
+
+  GXCopyTex(image.data(), GX_FALSE);
+  const auto* nativeHandle = gxState().copyTextures.at(image.data()).handle.get();
+  ASSERT_NE(nativeHandle, nullptr);
+  EXPECT_EQ(nativeHandle->size.width, 64u);
+
+  aurora::gfx::testing::set_framebuffer_sizes(640, 480, 1280, 960);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& scaledCopy = gxState().copyTextures.at(image.data());
+  ASSERT_TRUE(scaledCopy.handle);
+  EXPECT_NE(scaledCopy.handle.get(), nativeHandle);
+  EXPECT_EQ(scaledCopy.handle->size.width, 128u);
+  EXPECT_EQ(scaledCopy.handle->size.height, 128u);
+  EXPECT_EQ(scaledCopy.width, 64u);
+  EXPECT_EQ(scaledCopy.height, 64u);
+  EXPECT_EQ(scaledCopy.revision, 2u);
+}
+
+TEST_F(GXFifoTest, CopyTexPassesVerticalCopyFilterCoefficientsToResolve) {
+  std::array<u8, 32 * 32 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+  u8 vfilter[7] = {3, 5, 7, 11, 13, 17, 19};
+
+  GXSetCopyFilter(GX_FALSE, nullptr, GX_TRUE, vfilter);
+  GXSetTexCopySrc(0, 0, 32, 32);
+  GXSetTexCopyDst(32, 32, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  EXPECT_EQ(records.front().copyFilterCoefficients, (std::array<u32, 3>{8, 31, 36}));
+}
+
+TEST_F(GXFifoTest, CopyTexPassesVerticalCopyClampToResolve) {
+  std::array<u8, 32 * 32 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetCopyClamp(GX_CLAMP_TOP);
+  GXSetTexCopySrc(8, 12, 32, 32);
+  GXSetTexCopyDst(32, 32, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  EXPECT_TRUE(records.front().clampTop);
+  EXPECT_FALSE(records.front().clampBottom);
+}
+
+TEST_F(GXFifoTest, CopyDispCanDisableSpatialCopyFilterWithoutChangingBrightness) {
+  u8 vfilter[7] = {3, 5, 7, 11, 13, 17, 19};
+  aurora::g_config.disableCopyFilter = true;
+
+  GXSetCopyFilter(GX_FALSE, nullptr, GX_TRUE, vfilter);
+  GXSetDispCopySrc(0, 0, 32, 32);
+  GXSetDispCopyDst(32, 32);
+  GXCopyDisp(nullptr, GX_FALSE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  EXPECT_EQ(records.front().copyFilterCoefficients, (std::array<u32, 3>{0, 75, 0}));
+}
+
+TEST_F(GXFifoTest, CopyTexDepthZ16PreservesVerticalCopyFilterForConversion) {
+  std::array<u8, 32 * 32 * 2> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+  u8 vfilter[7] = {21, 0, 0, 22, 0, 21, 0};
+
+  GXSetCopyFilter(GX_FALSE, nullptr, GX_TRUE, vfilter);
+  EXPECT_TRUE(gxState().copyFilterVf);
+  EXPECT_EQ(gxState().copyFilterVFilter, (std::array<u8, 7>{21, 0, 0, 22, 0, 21, 0}));
+  GXSetTexCopySrc(0, 0, 32, 32);
+  GXSetTexCopyDst(32, 32, GX_TF_Z16, GX_FALSE);
+  EXPECT_EQ(gxState().copyFilterVFilter, (std::array<u8, 7>{21, 0, 0, 22, 0, 21, 0}));
+  GXCopyTex(image.data(), GX_FALSE);
+  EXPECT_EQ(gxState().copyFilterVFilter, (std::array<u8, 7>{21, 0, 0, 22, 0, 21, 0}));
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  EXPECT_EQ(records.front().resolveFormat, GX_TF_Z16);
+  EXPECT_EQ(records.front().copyFilterCoefficients, (std::array<u32, 3>{21, 22, 21}));
+  EXPECT_FALSE(records.front().forceOpaqueAlpha);
+  EXPECT_EQ(gxState().copyTextures.at(image.data()).format, GX_TF_Z16);
+}
+
+TEST_F(GXFifoTest, CopyTexDepthZ16UsesRa8Ia8Semantics) {
+  constexpr auto rgba = aurora::gfx::tex_copy_conv::detail::z16_ra8_as_ia8_rgba(0x12);
+  EXPECT_EQ(rgba, (std::array<std::uint8_t, 4>{0x12, 0x12, 0x12, 0xff}));
+
+  constexpr auto shader = aurora::gfx::tex_copy_conv::detail::Z16FragmentShader;
+  EXPECT_NE(shader.find("let i = f32(depth_bytes.r)"), std::string_view::npos);
+  EXPECT_NE(shader.find("return vec4f(i, i, i, 1.0)"), std::string_view::npos);
+}
+
+TEST_F(GXFifoTest, CopyTexClearTrueNoOpsWhenAllUpdateMasksAreDisabled) {
+  std::array<u8, 64 * 64 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+  gxState().colorUpdate = false;
+  gxState().alphaUpdate = false;
+  gxState().depthUpdate = false;
+  gxState().dstAlpha = UINT32_MAX;
+
+  GXSetTexCopySrc(8, 16, 64, 64);
+  GXSetTexCopyDst(64, 64, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_TRUE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  EXPECT_FALSE(records.front().clearColor);
+  EXPECT_FALSE(records.front().clearAlpha);
+  EXPECT_FALSE(records.front().clearDepth);
+}
+
+TEST_F(GXFifoTest, CopyTexClearTrueRgbTargetKeepsFormatAndForcesOpaqueCopiedAlpha) {
+  std::array<u8, 32 * 32 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGB8_Z24;
+  gxState().colorUpdate = true;
+  gxState().alphaUpdate = false;
+  gxState().depthUpdate = false;
+  gxState().dstAlpha = UINT32_MAX;
+  gxState().clearColor = {0.2f, 0.4f, 0.6f, 0.25f};
+
+  GXSetTexCopySrc(0, 0, 32, 32);
+  GXSetTexCopyDst(32, 32, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_TRUE);
+
+  const auto& records = aurora::gfx::testing::resolve_pass_records();
+  ASSERT_EQ(records.size(), 1u);
+  EXPECT_TRUE(records.front().clearColor);
+  EXPECT_FALSE(records.front().clearAlpha);
+  EXPECT_FALSE(records.front().clearDepth);
+  EXPECT_NEAR(records.front().clearColorValue.x(), 0.2f, 1.f / 255.f);
+  EXPECT_NEAR(records.front().clearColorValue.y(), 0.4f, 1.f / 255.f);
+  EXPECT_NEAR(records.front().clearColorValue.z(), 0.6f, 1.f / 255.f);
+  EXPECT_EQ(records.front().clearColorValue.w(), 0.25f);
+  EXPECT_EQ(records.front().resolveFormat, GX_TF_RGBA8);
+  EXPECT_TRUE(records.front().forceOpaqueAlpha);
+}
+
+TEST_F(GXFifoTest, CopyTexSameTargetReusesHostTextureUntilSampledThisFrame) {
+  std::array<u8, 64 * 64 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(0, 0, 64, 64);
+  GXSetTexCopyDst(64, 64, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& first = gxState().copyTextures.at(image.data());
+  ASSERT_TRUE(first.handle);
+  const auto* firstHandle = first.handle.get();
+  EXPECT_EQ(first.revision, 1u);
+
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& second = gxState().copyTextures.at(image.data());
+  EXPECT_EQ(second.handle.get(), firstHandle);
+  EXPECT_EQ(second.revision, 2u);
+}
+
+TEST_F(GXFifoTest, CopyTexSameFrameSampledTargetGetsFreshHostTexture) {
+  std::array<u8, 64 * 64 * 4> image{};
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(0, 0, 64, 64);
+  GXSetTexCopyDst(64, 64, GX_TF_RGBA8, GX_FALSE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const aurora::gx::GXState::CopyTextureKey key{
+      .dest = image.data(),
+      .width = 64,
+      .height = 64,
+      .format = GX_TF_RGBA8,
+  };
+  const auto& first = gxState().copyTextures.at(image.data());
+  ASSERT_TRUE(first.handle);
+  const auto* firstHandle = first.handle.get();
+
+  auto& cached = gxState().copyTextureCache.at(key);
+  cached.lastSampledFrame = aurora::gfx::current_frame();
+  cached.sampledThisFrame = true;
+
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const auto& second = gxState().copyTextures.at(image.data());
+  ASSERT_TRUE(second.handle);
+  EXPECT_NE(second.handle.get(), firstHandle);
+  EXPECT_EQ(second.revision, 2u);
+}
+
+TEST_F(GXFifoTest, CopyTexSameTargetDifferentShapeRetiresHistoricalCacheEntry) {
+  std::vector<u8> image(608 * 456 * 4);
+  gxState().pixelFmt = GX_PF_RGBA6_Z24;
+
+  GXSetTexCopySrc(0, 0, 608, 456);
+  GXSetTexCopyDst(608, 456, GX_TF_RGB565, GX_FALSE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const aurora::gx::GXState::CopyTextureKey fullKey{
+      .dest = image.data(),
+      .width = 608,
+      .height = 456,
+      .format = GX_TF_RGB565,
+  };
+  const auto& fullCopy = gxState().copyTextureCache.at(fullKey);
+  ASSERT_TRUE(fullCopy.handle);
+  const auto* fullHandle = fullCopy.handle.get();
+
+  GXSetTexCopySrc(0, 0, 304, 228);
+  GXSetTexCopyDst(304, 228, GX_TF_RGBA8, GX_TRUE);
+  GXCopyTex(image.data(), GX_FALSE);
+
+  const aurora::gx::GXState::CopyTextureKey halfKey{
+      .dest = image.data(),
+      .width = 304,
+      .height = 228,
+      .format = GX_TF_RGBA8,
+  };
+  const auto& halfCopy = gxState().copyTextureCache.at(halfKey);
+  ASSERT_TRUE(halfCopy.handle);
+
+  EXPECT_FALSE(gxState().copyTextureCache.contains(fullKey));
+  EXPECT_EQ(gxState().copyTextureCache.size(), 1u);
+  EXPECT_NE(halfCopy.handle.get(), fullHandle);
+  EXPECT_EQ(gxState().copyTextures.at(image.data()).handle.get(), halfCopy.handle.get());
+  EXPECT_EQ(gxState().copyTextures.at(image.data()).width, 304u);
+  EXPECT_EQ(gxState().copyTextures.at(image.data()).height, 228u);
+  EXPECT_EQ(gxState().copyTextures.at(image.data()).format, GX_TF_RGBA8);
+}
+
+TEST_F(GXFifoTest, CopyTexCtfFormatsCanBackCompatibleTextureFormats) {
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_CTF_R4, GX_TF_I4));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_CTF_R8, GX_TF_I8));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_CTF_G8, GX_TF_I8));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_CTF_B8, GX_TF_I8));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_CTF_RA4, GX_TF_IA4));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_CTF_RA8, GX_TF_IA8));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_CTF_RG8, GX_TF_IA8));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_CTF_GB8, GX_TF_IA8));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_TF_Z16, GX_TF_IA8));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_CTF_YUVA8, GX_TF_RGBA8));
+  EXPECT_TRUE(aurora::gx::copy_texture_format_compatible(GX_TF_Z24X8, GX_TF_RGBA8));
+  EXPECT_FALSE(aurora::gx::copy_texture_format_compatible(GX_CTF_R8, GX_TF_RGBA8));
+}
+
+TEST_F(GXFifoTest, FieldMaskModeRevBitsAndFogRange_DecodeKnownBpState) {
+  std::vector<u8> bytes;
+  const auto fieldMask = bp_cmd(0x44, 0x03);
+  const auto revBits = bp_cmd(0x58, 0x0F);
+  const auto fieldMode = bp_cmd(0x68, 0x01);
+  const auto fogRangeBase = bp_cmd(0xE8, 0x0156);
+  const auto fogRangeK0 = bp_cmd(0xE9, 0x123456);
+  bytes.insert(bytes.end(), fieldMask.begin(), fieldMask.end());
+  bytes.insert(bytes.end(), revBits.begin(), revBits.end());
+  bytes.insert(bytes.end(), fieldMode.begin(), fieldMode.end());
+  bytes.insert(bytes.end(), fogRangeBase.begin(), fogRangeBase.end());
+  bytes.insert(bytes.end(), fogRangeK0.begin(), fogRangeK0.end());
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.fieldMask, 0x03u);
+  EXPECT_EQ(g_gxState.revBits, 0x0Fu);
+  EXPECT_EQ(g_gxState.fieldMode, 0x01u);
+  EXPECT_EQ(g_gxState.fogRange[0], 0x0156u);
+  EXPECT_EQ(g_gxState.fogRange[1], 0x123456u);
+}
+
+TEST_F(GXFifoTest, XfErrorAndDualTex_DecodeKnownRawState) {
+  std::vector<u8> bytes;
+  const auto xfError = xf_cmd(0x1000, {0x3F});
+  const auto dualTex = xf_cmd(0x1012, {0x01});
+  bytes.insert(bytes.end(), xfError.begin(), xfError.end());
+  bytes.insert(bytes.end(), dualTex.begin(), dualTex.end());
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.xfError, 0x3Fu);
+  EXPECT_EQ(g_gxState.dualTex, 0x01u);
+}
+
+TEST_F(GXFifoTest, ClearBoundingBox_EncodesBpAndDecodesFallbackExtents) {
+  GXClearBoundingBox();
+  auto bytes = capture_fifo();
+
+  ASSERT_EQ(bytes.size(), 10u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0x55);
+  EXPECT_EQ(bytes[5], 0x61);
+  EXPECT_EQ(bytes[6], 0x56);
+
+  reset_gx_state();
+  g_gxState.boundingBox = {1, 2, 3, 4};
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.boundingBox[0], 1023u);
+  EXPECT_EQ(g_gxState.boundingBox[1], 0u);
+  EXPECT_EQ(g_gxState.boundingBox[2], 1023u);
+  EXPECT_EQ(g_gxState.boundingBox[3], 0u);
+}
+
+TEST_F(GXFifoTest, ReadBoundingBox_ReturnsTrackedState) {
+  g_gxState.boundingBox = {10, 20, 30, 40};
+
+  u16 left = 0;
+  u16 right = 0;
+  u16 top = 0;
+  u16 bottom = 0;
+  GXReadBoundingBox(&left, &right, &top, &bottom);
+
+  EXPECT_EQ(left, 10u);
+  EXPECT_EQ(right, 20u);
+  EXPECT_EQ(top, 30u);
+  EXPECT_EQ(bottom, 40u);
+}
+
+// --- Clear color and depth round-trip ---
+TEST_F(GXFifoTest, CopyClear_ColorAndDepth) {
+  GXColor color = {64, 128, 192, 255};
+  GXSetCopyClear(color, 0x00ABCDEF);
+  auto bytes = capture_fifo();
+
+  // 3 BP writes: 3 * 5 = 15 bytes
+  ASSERT_EQ(bytes.size(), 15u);
+  EXPECT_EQ(bytes[0], 0x61);
+  EXPECT_EQ(bytes[1], 0x4F); // R + A
+  EXPECT_EQ(bytes[5], 0x61);
+  EXPECT_EQ(bytes[6], 0x50); // B + G
+  EXPECT_EQ(bytes[10], 0x61);
+  EXPECT_EQ(bytes[11], 0x51); // Z
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.clearColor[0], 64.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.clearColor[1], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.clearColor[2], 192.f / 255.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.clearColor[3], 255.f / 255.f, 1.f / 255.f);
+  EXPECT_EQ(g_gxState.clearDepth, 0x00ABCDEFu);
+}
+
+// --- Clear with black and zero depth ---
+TEST_F(GXFifoTest, CopyClear_BlackZeroDepth) {
+  GXColor color = {0, 0, 0, 0};
+  GXSetCopyClear(color, 0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.clearColor[0], 0.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.clearColor[1], 0.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.clearColor[2], 0.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.clearColor[3], 0.f, 1.f / 255.f);
+  EXPECT_EQ(g_gxState.clearDepth, 0u);
+}
+
+// --- Clear with max depth ---
+TEST_F(GXFifoTest, CopyClear_MaxDepth) {
+  GXColor color = {255, 255, 255, 128};
+  GXSetCopyClear(color, 0xFFFFFF);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_NEAR(g_gxState.clearColor[0], 1.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.clearColor[1], 1.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.clearColor[2], 1.f, 1.f / 255.f);
+  EXPECT_NEAR(g_gxState.clearColor[3], 128.f / 255.f, 1.f / 255.f);
+  EXPECT_EQ(g_gxState.clearDepth, 0xFFFFFFu);
+}
+
+TEST_F(GXFifoTest, PeekZ_ReturnsClearDepthFallbackAndRequestsSnapshot) {
+  g_gxState.clearDepth = 0x123456;
+
+  u32 z = 0;
+  GXPeekZ(10, 20, &z);
+
+  EXPECT_EQ(z, 0x123456u);
+  EXPECT_TRUE(aurora::gfx::depth_peek::testing::snapshot_requested());
+}
+
+TEST_F(GXFifoTest, PeekZ_ReturnsLatestCompletedSnapshot) {
+  aurora::gfx::depth_peek::testing::set_latest(2, 2, {0x000001, 0x000002, 0x000003, 0x01000004});
+
+  u32 z = 0;
+  GXPeekZ(1, 1, &z);
+
+  EXPECT_EQ(z, 0x000004u);
+  EXPECT_TRUE(aurora::gfx::depth_peek::testing::snapshot_requested());
+}
+
+TEST_F(GXFifoTest, PeekZ_OutOfRangeReturnsClearDepthFallback) {
+  g_gxState.clearDepth = 0xabcdef;
+  aurora::gfx::depth_peek::testing::set_latest(1, 1, {0x000001});
+
+  u32 z = 0;
+  GXPeekZ(1, 0, &z);
+
+  EXPECT_EQ(z, 0xabcdefu);
+  EXPECT_TRUE(aurora::gfx::depth_peek::testing::snapshot_requested());
+}
+
+// Composite tests (multiple state changes in a single FIFO stream)
+
+TEST_F(GXFifoTest, Composite_BlendAndZMode) {
+  GXSetBlendMode(GX_BM_BLEND, GX_BL_SRCALPHA, GX_BL_INVSRCALPHA, GX_LO_NOOP);
+  GXSetZMode(true, GX_LEQUAL, true);
+  GXSetAlphaCompare(GX_GREATER, 128, GX_AOP_AND, GX_ALWAYS, 0);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.blendMode, GX_BM_BLEND);
+  EXPECT_EQ(g_gxState.blendFacSrc, GX_BL_SRCALPHA);
+  EXPECT_EQ(g_gxState.blendFacDst, GX_BL_INVSRCALPHA);
+
+  EXPECT_TRUE(g_gxState.depthCompare);
+  EXPECT_EQ(g_gxState.depthFunc, GX_LEQUAL);
+  EXPECT_TRUE(g_gxState.depthUpdate);
+
+  EXPECT_EQ(g_gxState.alphaCompare.comp0, GX_GREATER);
+  EXPECT_EQ(g_gxState.alphaCompare.ref0, 128u);
+}
+
+// --- GXLoadTexMtxImm for PTTexMtx (XF 0x500-0x5EF) ---
+
+TEST_F(GXFifoTest, LoadPTTexMtx_Identity) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 1.0f;
+  mtx.m1[1] = 1.0f;
+  mtx.m2[2] = 1.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_PTTEXMTX0, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  // XF opcode 0x10, addr = (64 - 64) * 4 + 0x500 = 0x500, count = 12
+  ASSERT_GE(bytes.size(), 5u);
+  EXPECT_EQ(bytes[0], 0x10);
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.ptTexMtxs[0];
+  EXPECT_FLOAT_EQ(decoded.m0[0], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[3], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 1.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], 0.0f);
+}
+
+TEST_F(GXFifoTest, LoadPTTexMtx_ArbitraryValues) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 2.0f;  mtx.m0[1] = 0.5f;  mtx.m0[2] = 0.0f;  mtx.m0[3] = 10.0f;
+  mtx.m1[0] = -0.5f; mtx.m1[1] = 3.0f;  mtx.m1[2] = 0.0f;  mtx.m1[3] = 20.0f;
+  mtx.m2[0] = 0.0f;  mtx.m2[1] = 0.0f;  mtx.m2[2] = 1.5f;  mtx.m2[3] = -5.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_PTTEXMTX0, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.ptTexMtxs[0];
+  EXPECT_FLOAT_EQ(decoded.m0[0], 2.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[1], 0.5f);
+  EXPECT_FLOAT_EQ(decoded.m0[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m0[3], 10.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[0], -0.5f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 3.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[2], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[3], 20.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[0], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 1.5f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], -5.0f);
+}
+
+TEST_F(GXFifoTest, LoadPTTexMtx_DifferentSlots) {
+  aurora::Mat3x4<float> mtx0{};
+  mtx0.m0[0] = 1.0f;
+  mtx0.m1[1] = 1.0f;
+  mtx0.m2[2] = 1.0f;
+
+  aurora::Mat3x4<float> mtx5{};
+  mtx5.m0[0] = 5.0f;
+  mtx5.m1[1] = 6.0f;
+  mtx5.m2[2] = 7.0f;
+  mtx5.m0[3] = 100.0f;
+
+  GXLoadTexMtxImm(&mtx0, GX_PTTEXMTX0, GX_MTX3x4);
+  GXLoadTexMtxImm(&mtx5, GX_PTTEXMTX5, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // Slot 0
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[0].m0[0], 1.0f);
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[0].m1[1], 1.0f);
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[0].m2[2], 1.0f);
+
+  // Slot 5: GX_PTTEXMTX5 = 79, index = (79 - 64) / 3 = 5
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[5].m0[0], 5.0f);
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[5].m1[1], 6.0f);
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[5].m2[2], 7.0f);
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[5].m0[3], 100.0f);
+}
+
+TEST_F(GXFifoTest, LoadPTTexMtx_LastSlot) {
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 42.0f;
+  mtx.m1[1] = 43.0f;
+  mtx.m2[2] = 44.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_PTTEXMTX19, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  auto& decoded = g_gxState.ptTexMtxs[19];
+  EXPECT_FLOAT_EQ(decoded.m0[0], 42.0f);
+  EXPECT_FLOAT_EQ(decoded.m1[1], 43.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[2], 44.0f);
+  // Other elements should be zero (from reset)
+  EXPECT_FLOAT_EQ(decoded.m0[1], 0.0f);
+  EXPECT_FLOAT_EQ(decoded.m2[3], 0.0f);
+}
+
+TEST_F(GXFifoTest, LoadPTTexMtx_Isolation) {
+  // Loading PTTexMtx0 should not affect PTTexMtx1
+  aurora::Mat3x4<float> mtx{};
+  mtx.m0[0] = 99.0f;
+  mtx.m1[1] = 88.0f;
+  mtx.m2[2] = 77.0f;
+
+  GXLoadTexMtxImm(&mtx, GX_PTTEXMTX0, GX_MTX3x4);
+  auto bytes = capture_fifo();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  // Slot 0 should have our values
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[0].m0[0], 99.0f);
+  // Slot 1 should remain zeroed
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[1].m0[0], 0.0f);
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[1].m1[1], 0.0f);
+  EXPECT_FLOAT_EQ(g_gxState.ptTexMtxs[1].m2[2], 0.0f);
+}
+
+// Composite / multi-command tests
+
+TEST_F(GXFifoTest, Composite_TevSetup) {
+  // Set up a simple 1-stage TEV that passes through texture color
+  GXSetNumTevStages(1);
+  GXSetTevOrder(GX_TEVSTAGE0, GX_TEXCOORD0, GX_TEXMAP0, GX_COLOR0A0);
+  GXSetTevColorIn(GX_TEVSTAGE0, GX_CC_ZERO, GX_CC_ZERO, GX_CC_ZERO, GX_CC_TEXC);
+  GXSetTevAlphaIn(GX_TEVSTAGE0, GX_CA_ZERO, GX_CA_ZERO, GX_CA_ZERO, GX_CA_TEXA);
+
+  // TEV order writes to dirty state, so flush before capture
+  auto bytes = flush_and_capture();
+
+  reset_gx_state();
+  decode_fifo(bytes);
+
+  EXPECT_EQ(g_gxState.numTevStages, 1u);
+  EXPECT_EQ(g_gxState.tevStages[0].texMapId, GX_TEXMAP0);
+  EXPECT_EQ(g_gxState.tevStages[0].texCoordId, GX_TEXCOORD0);
+  EXPECT_EQ(g_gxState.tevStages[0].channelId, GX_COLOR0A0);
+  EXPECT_EQ(g_gxState.tevStages[0].colorPass.d, GX_CC_TEXC);
+  EXPECT_EQ(g_gxState.tevStages[0].alphaPass.d, GX_CA_TEXA);
+}
diff --git a/aurora-main/tests/gx_test_common.hpp b/aurora-main/tests/gx_test_common.hpp
new file mode 100644
index 0000000..7d37c52
--- /dev/null
+++ b/aurora-main/tests/gx_test_common.hpp
@@ -0,0 +1,95 @@
+#pragma once
+
+#include <gtest/gtest.h>
+
+#include <dolphin/gx.h>
+
+#include "gx/gx.hpp"
+#include "gx/fifo.hpp"
+#include "gx/command_processor.hpp"
+#include "gfx/depth_peek.hpp"
+#include "internal.hpp"
+
+#include <array>
+#include <cstring>
+#include <optional>
+#include <vector>
+
+// Forward declare dirty state flush
+extern "C" void __GXSetDirtyState();
+
+namespace aurora::gfx::testing {
+struct ResolvePassRecord {
+  TextureHandle texture;
+  ClipRect rect;
+  bool clearColor = false;
+  bool clearAlpha = false;
+  bool clearDepth = false;
+  Vec4<float> clearColorValue{0.f, 0.f, 0.f, 0.f};
+  float clearDepthValue = 0.f;
+  GXTexFmt resolveFormat = GX_TF_RGBA8;
+  std::optional<Vec4<float>> sourceRectPixels;
+  bool halfScale = false;
+  std::array<u32, 3> copyFilterCoefficients{0, 64, 0};
+  bool forceOpaqueAlpha = false;
+  float copyFilterRowStride = 1.0f;
+  bool clampTop = false;
+  bool clampBottom = false;
+  bool persistentCopy = false;
+};
+
+void reset_resolve_pass_records() noexcept;
+const std::vector<ResolvePassRecord>& resolve_pass_records() noexcept;
+void set_current_frame(uint32_t frame) noexcept;
+void set_framebuffer_sizes(uint32_t logicalWidth, uint32_t logicalHeight,
+                           uint32_t targetWidth, uint32_t targetHeight) noexcept;
+void reset_vertex_push_record() noexcept;
+const std::vector<uint8_t>& last_pushed_vertices() noexcept;
+const std::vector<uint16_t>& last_pushed_indices() noexcept;
+void reset_uniform_allocations() noexcept;
+const std::vector<uint8_t>& uniform_allocation(size_t index) noexcept;
+void use_draw_command_tracking(bool enabled) noexcept;
+void use_real_vertex_format_helpers(bool enabled) noexcept;
+} // namespace aurora::gfx::testing
+
+class GXFifoTest : public ::testing::Test {
+protected:
+  void SetUp() override {
+    aurora::gfx::testing::set_current_frame(0);
+    aurora::gfx::testing::set_framebuffer_sizes(640, 480, 640, 480);
+    GXInit(nullptr, 0);
+    aurora::gx::fifo::clear_buffer();
+    aurora::gx::g_gxState = aurora::gx::GXState{};
+    aurora::g_config.disableCopyFilter = false;
+    aurora::gfx::depth_peek::testing::reset();
+    aurora::gfx::testing::reset_resolve_pass_records();
+    aurora::gfx::testing::reset_vertex_push_record();
+    aurora::gfx::testing::use_real_vertex_format_helpers(false);
+  }
+
+  // Copy the internal FIFO buffer contents and clear it
+  std::vector<u8> capture_fifo() {
+    auto size = aurora::gx::fifo::get_buffer_size();
+    auto* data = aurora::gx::fifo::get_buffer_data();
+    std::vector<u8> bytes(data, data + size);
+    aurora::gx::fifo::clear_buffer();
+    return bytes;
+  }
+
+  // Reset g_gxState to default-constructed state
+  void reset_gx_state() { aurora::gx::g_gxState = aurora::gx::GXState{}; }
+
+  // Decode a captured FIFO byte stream through the command processor
+  void decode_fifo(const std::vector<u8>& bytes) {
+    aurora::gx::fifo::process(bytes.data(), static_cast<u32>(bytes.size()), true);
+  }
+
+  // Flush dirty state, then capture the FIFO buffer
+  std::vector<u8> flush_and_capture() {
+    __GXSetDirtyState();
+    return capture_fifo();
+  }
+
+  // Convenience reference to g_gxState
+  aurora::gx::GXState& gxState() { return aurora::gx::g_gxState; }
+};
diff --git a/aurora-main/tests/gx_test_stubs.cpp b/aurora-main/tests/gx_test_stubs.cpp
new file mode 100644
index 0000000..32bf6bd
--- /dev/null
+++ b/aurora-main/tests/gx_test_stubs.cpp
@@ -0,0 +1,553 @@
+// Stubs for renderer symbols the GX/FIFO/command_processor code references but that live in the
+// full renderer, so the test binary links without the WebGPU runtime.
+
+#include "gx/gx.hpp"
+#include "gfx/clear.hpp"
+#include "gfx/common.hpp"
+#include "gfx/depth_peek.hpp"
+#include "gfx/efb_ram_copy.hpp"
+#include "gfx/tex_copy_conv.hpp"
+#include "gfx/tex_palette_conv.hpp"
+#include "gfx/texture.hpp"
+#include "gx/pipeline.hpp"
+#include "gx/shader_info.hpp"
+#include "internal.hpp"
+#include "webgpu/gpu.hpp"
+
+#include <cstdio>
+#include <cmath>
+#include <cstring>
+#include <deque>
+#include <memory>
+#include <optional>
+#include <utility>
+#include <vector>
+#include <fmt/format.h>
+
+namespace {
+aurora::Vec2<uint32_t> s_logicalFbSize{640, 480};
+aurora::Vec2<uint32_t> s_renderTargetSize{640, 480};
+uint32_t s_currentFrame = 0;
+std::vector<uint8_t> s_lastPushedVertices;
+std::vector<uint16_t> s_lastPushedIndices;
+std::optional<aurora::gx::DrawData> s_lastGxDraw;
+bool s_trackDrawCommands = false;
+bool s_useRealVertexFormatHelpers = false;
+std::deque<std::vector<uint8_t>> s_uniformAllocations;
+} // namespace
+
+// --- aurora::g_config ---
+namespace aurora {
+AuroraConfig g_config{};
+void wait_for_frame_worker() noexcept {}
+std::chrono::nanoseconds wait_for_frame_worker_sealed() noexcept { return {}; }
+bool wait_for_frame_worker_for(std::chrono::microseconds) noexcept { return true; }
+std::recursive_mutex& renderer_gpu_mutex() noexcept {
+  static std::recursive_mutex mutex;
+  return mutex;
+}
+} // namespace aurora
+
+extern "C" bool aurora_wait_for_frame_worker_for(uint32_t) { return true; }
+
+// --- aurora::log_internal ---
+namespace aurora {
+void log_internal(AuroraLogLevel level, const char* module, const char* message, unsigned int len) noexcept {
+  fprintf(stderr, "[%d] %s: %.*s\n", static_cast<int>(level), module, len, message);
+}
+void Module::show_fatal_dialog(const char*, std::string_view) noexcept {}
+} // namespace aurora
+
+namespace aurora::window {
+void set_present_surface_fill(bool) {}
+} // namespace aurora::window
+
+// --- fmt::formatter<AuroraLogLevel> ---
+auto fmt::formatter<AuroraLogLevel>::format(AuroraLogLevel level, format_context& ctx) const
+    -> format_context::iterator {
+  return fmt::format_to(ctx.out(), "{}", static_cast<int>(level));
+}
+
+// --- GPU buffers (default-constructed, not used in tests) ---
+namespace aurora::gfx {
+AuroraStats g_stats;
+wgpu::Buffer g_vertexBuffer;
+wgpu::Buffer g_uniformBuffer;
+wgpu::Buffer g_indexBuffer;
+wgpu::Buffer g_storageBuffer;
+uint32_t g_drawCallCount = 0;
+uint32_t g_mergedDrawCallCount = 0;
+} // namespace aurora::gfx
+
+namespace aurora::webgpu {
+GraphicsConfig g_graphicsConfig{};
+} // namespace aurora::webgpu
+
+// --- GXState (the real instance -- tests validate this) ---
+namespace aurora::gx {
+GXState g_gxState{};
+void notify_copy_texture_created() noexcept {}
+} // namespace aurora::gx
+
+namespace aurora::vi {
+Vec2<uint32_t> configured_fb_size() noexcept { return s_logicalFbSize; }
+void configure(const GXRenderModeObj*) noexcept {}
+} // namespace aurora::vi
+
+// --- Texture uploads ---
+namespace aurora::gfx {
+std::vector<TextureUpload> g_textureUploads;
+} // namespace aurora::gfx
+
+namespace aurora::gfx::efb_ram {
+void schedule(void*, uint32_t, uint32_t, GXTexFmt, TextureHandle) noexcept {}
+} // namespace aurora::gfx::efb_ram
+
+// --- get_texture ---
+namespace aurora::gx {
+const gfx::TextureBind& get_texture(GXTexMapID id) noexcept { return g_gxState.textures[id]; }
+void evict_texture_object(u32 texObjId) noexcept {
+  for (auto& obj : g_gxState.loadedTextures) {
+    if (obj.texObjId == texObjId) {
+      obj.set_no_cache(true);
+    }
+  }
+}
+void evict_tlut_object(u32 tlutObjId) noexcept {
+  for (auto& obj : g_gxState.loadedTluts) {
+    if (obj.tlutObjId == tlutObjId) {
+      obj.set_no_cache(true);
+    }
+  }
+}
+void invalidate_static_texture_cache() noexcept {
+  for (auto& texture : g_gxState.textures) {
+    texture.reset();
+  }
+  g_gxState.stateDirty = true;
+}
+void evict_copy_texture(const void* dest) noexcept {
+  g_gxState.copyTextures.erase(dest);
+  for (auto it = g_gxState.copyTextureCache.begin(); it != g_gxState.copyTextureCache.end();) {
+    if (it->first.dest == dest) {
+      g_gxState.copyTextureCache.erase(it++);
+    } else {
+      ++it;
+    }
+  }
+}
+void set_display_copy_present_source() noexcept {}
+void shutdown() noexcept {}
+Vec2<uint32_t> logical_fb_size() noexcept { return s_logicalFbSize; }
+gfx::Viewport map_logical_viewport(const gfx::Viewport& logicalViewport) noexcept {
+  const float scaleX = static_cast<float>(s_renderTargetSize.x) / static_cast<float>(s_logicalFbSize.x);
+  const float scaleY = static_cast<float>(s_renderTargetSize.y) / static_cast<float>(s_logicalFbSize.y);
+  return {
+      .left = logicalViewport.left * scaleX,
+      .top = logicalViewport.top * scaleY,
+      .width = logicalViewport.width * scaleX,
+      .height = logicalViewport.height * scaleY,
+      .znear = logicalViewport.znear,
+      .zfar = logicalViewport.zfar,
+  };
+}
+gfx::ClipRect map_logical_scissor(const gfx::ClipRect& logicalScissor) noexcept {
+  const auto mapped = map_logical_viewport({
+      .left = static_cast<float>(logicalScissor.x),
+      .top = static_cast<float>(logicalScissor.y),
+      .width = static_cast<float>(logicalScissor.width),
+      .height = static_cast<float>(logicalScissor.height),
+      .znear = 0.0f,
+      .zfar = 1.0f,
+  });
+  const auto left = static_cast<int32_t>(std::floor(mapped.left));
+  const auto top = static_cast<int32_t>(std::floor(mapped.top));
+  const auto right = static_cast<int32_t>(std::ceil(mapped.left + mapped.width));
+  const auto bottom = static_cast<int32_t>(std::ceil(mapped.top + mapped.height));
+  return {left, top, right - left, bottom - top};
+}
+MappedRenderState map_logical_render_state() noexcept {
+  return {
+      .viewport = map_logical_viewport(g_gxState.logicalViewport),
+      .scissor = map_logical_scissor(g_gxState.logicalScissor),
+  };
+}
+void set_logical_viewport(const gfx::Viewport& viewport) noexcept {
+  g_gxState.logicalViewport = viewport;
+  set_render_viewport(map_logical_viewport(viewport));
+}
+void set_render_viewport(const gfx::Viewport& viewport) noexcept { g_gxState.renderViewport = viewport; }
+void set_logical_scissor(const gfx::ClipRect& scissor) noexcept {
+  g_gxState.logicalScissor = scissor;
+  set_render_scissor(map_logical_scissor(scissor));
+}
+void set_render_scissor(const gfx::ClipRect& scissor) noexcept { g_gxState.renderScissor = scissor; }
+} // namespace aurora::gx
+
+// --- Shader/pipeline stubs ---
+namespace aurora::gx {
+void populate_pipeline_config(PipelineConfig& config, GXPrimitive primitive, GXVtxFmt fmt) noexcept {
+  // No-op for tests
+}
+GXBindGroups build_bind_groups(const ShaderInfo& info) noexcept { return {}; }
+void resolve_sampled_textures(const ShaderInfo& info) noexcept {}
+u8 color_channel(GXChannelID id) noexcept { return 0; }
+u8 comp_type_size(GXAttr attr, GXCompType type) noexcept {
+  if (!s_useRealVertexFormatHelpers) {
+    return 0;
+  }
+  switch (attr) {
+  case GX_VA_PNMTXIDX:
+  case GX_VA_TEX0MTXIDX:
+  case GX_VA_TEX1MTXIDX:
+  case GX_VA_TEX2MTXIDX:
+  case GX_VA_TEX3MTXIDX:
+  case GX_VA_TEX4MTXIDX:
+  case GX_VA_TEX5MTXIDX:
+  case GX_VA_TEX6MTXIDX:
+  case GX_VA_TEX7MTXIDX:
+    return 1;
+  case GX_VA_CLR0:
+  case GX_VA_CLR1:
+    switch (type) {
+    case GX_RGB565:
+    case GX_RGBA4:
+      return 2;
+    case GX_RGB8:
+    case GX_RGBA6:
+      return 3;
+    case GX_RGBX8:
+    case GX_RGBA8:
+      return 4;
+    default:
+      return 0;
+    }
+  default:
+    switch (type) {
+    case GX_U8:
+    case GX_S8:
+      return 1;
+    case GX_U16:
+    case GX_S16:
+      return 2;
+    case GX_F32:
+      return 4;
+    default:
+      return 0;
+    }
+  }
+}
+u8 comp_cnt_count(GXAttr attr, GXCompCnt cnt) noexcept {
+  if (!s_useRealVertexFormatHelpers) {
+    return 0;
+  }
+  switch (attr) {
+  case GX_VA_PNMTXIDX:
+  case GX_VA_TEX0MTXIDX:
+  case GX_VA_TEX1MTXIDX:
+  case GX_VA_TEX2MTXIDX:
+  case GX_VA_TEX3MTXIDX:
+  case GX_VA_TEX4MTXIDX:
+  case GX_VA_TEX5MTXIDX:
+  case GX_VA_TEX6MTXIDX:
+  case GX_VA_TEX7MTXIDX:
+    return 1;
+  case GX_VA_POS:
+    return cnt == GX_POS_XY ? 2 : cnt == GX_POS_XYZ ? 3 : 0;
+  case GX_VA_NRM:
+    return cnt == GX_NRM_XYZ ? 3 : (cnt == GX_NRM_NBT || cnt == GX_NRM_NBT3) ? 9 : 0;
+  case GX_VA_CLR0:
+  case GX_VA_CLR1:
+    return 1;
+  case GX_VA_TEX0:
+  case GX_VA_TEX1:
+  case GX_VA_TEX2:
+  case GX_VA_TEX3:
+  case GX_VA_TEX4:
+  case GX_VA_TEX5:
+  case GX_VA_TEX6:
+  case GX_VA_TEX7:
+    return cnt == GX_TEX_S ? 1 : cnt == GX_TEX_ST ? 2 : 0;
+  default:
+    return 0;
+  }
+}
+} // namespace aurora::gx
+
+// --- Buffer push stubs ---
+namespace aurora::gfx {
+Range push_verts(const uint8_t* data, size_t length) {
+  s_lastPushedVertices.assign(data, data + length);
+  return {};
+}
+Range push_indices(const uint8_t* data, size_t length) {
+  CHECK(length % sizeof(uint16_t) == 0, "unaligned test index upload");
+  s_lastPushedIndices.resize(length / sizeof(uint16_t));
+  std::memcpy(s_lastPushedIndices.data(), data, length);
+  return {};
+}
+Range push_uniform(const uint8_t* data, size_t length) { return {}; }
+Range push_storage(const uint8_t* data, size_t length) { return {}; }
+std::pair<ByteBuffer, Range> map_uniform(size_t length) {
+  s_uniformAllocations.emplace_back(length, 0);
+  auto& uniformBytes = s_uniformAllocations.back();
+  return {ByteBuffer{uniformBytes.data(), uniformBytes.size()},
+          Range{static_cast<uint32_t>(s_uniformAllocations.size() - 1),
+                static_cast<uint32_t>(length)}};
+}
+std::pair<ByteBuffer, Range> copy_uniform(Range source) {
+  return map_uniform(source.size);
+}
+uint32_t align_uniform(uint32_t value) { return (value + 255u) & ~255u; }
+
+Vec2<uint32_t> get_render_target_size() noexcept { return s_renderTargetSize; }
+Vec2<uint32_t> get_frame_buffer_size() noexcept { return s_renderTargetSize; }
+uint32_t current_frame() noexcept { return s_currentFrame; }
+// The command processor keys its resolved-pipeline memo on this. The test build never changes
+// render targets, so a fixed single-sample target matches what pipeline_ref would produce.
+uint32_t get_sample_count() noexcept { return 1; }
+void set_viewport(const Viewport& viewport) noexcept {}
+void set_scissor(uint32_t x, uint32_t y, uint32_t w, uint32_t h) noexcept {}
+} // namespace aurora::gfx
+
+namespace aurora::gfx::testing {
+void set_current_frame(uint32_t frame) noexcept { s_currentFrame = frame; }
+
+void reset_vertex_push_record() noexcept {
+  s_lastPushedVertices.clear();
+  s_lastPushedIndices.clear();
+  s_lastGxDraw.reset();
+  s_trackDrawCommands = false;
+  g_mergedDrawCallCount = 0;
+}
+const std::vector<uint8_t>& last_pushed_vertices() noexcept {
+  return s_lastPushedVertices;
+}
+const std::vector<uint16_t>& last_pushed_indices() noexcept {
+  return s_lastPushedIndices;
+}
+void reset_uniform_allocations() noexcept {
+  s_uniformAllocations.clear();
+}
+const std::vector<uint8_t>& uniform_allocation(size_t index) noexcept {
+  CHECK(index < s_uniformAllocations.size(), "uniform test allocation {} out of range {}", index,
+        s_uniformAllocations.size());
+  return s_uniformAllocations[index];
+}
+void use_draw_command_tracking(bool enabled) noexcept {
+  s_trackDrawCommands = enabled;
+  s_lastGxDraw.reset();
+}
+void use_real_vertex_format_helpers(bool enabled) noexcept {
+  s_useRealVertexFormatHelpers = enabled;
+}
+} // namespace aurora::gfx::testing
+
+// --- Pipeline/draw command stubs ---
+namespace aurora::gfx {
+template <>
+PipelineRef pipeline_ref<clear::PipelineConfig>(const clear::PipelineConfig& config) {
+  return 0;
+}
+template <>
+void push_draw_command<clear::DrawData>(clear::DrawData data) {
+  // No-op
+}
+template <>
+PipelineRef pipeline_ref<gx::PipelineConfig>(const gx::PipelineConfig& config) {
+  return 0;
+}
+template <>
+void push_draw_command<gx::DrawData>(gx::DrawData data) {
+  if (s_trackDrawCommands) {
+    s_lastGxDraw = std::move(data);
+  }
+}
+template <>
+gx::DrawData* get_last_draw_command() {
+  return s_trackDrawCommands && s_lastGxDraw.has_value() ? &*s_lastGxDraw : nullptr;
+}
+} // namespace aurora::gfx
+
+// --- TextureBind::get_descriptor ---
+namespace aurora::gfx {
+wgpu::SamplerDescriptor TextureBind::get_descriptor() const noexcept { return wgpu::SamplerDescriptor{}; }
+} // namespace aurora::gfx
+
+// --- Texture creation/write/replacement stubs ---
+namespace aurora::gfx {
+namespace testing {
+struct ResolvePassRecord {
+  TextureHandle texture;
+  ClipRect rect;
+  bool clearColor = false;
+  bool clearAlpha = false;
+  bool clearDepth = false;
+  Vec4<float> clearColorValue{0.f, 0.f, 0.f, 0.f};
+  float clearDepthValue = 0.f;
+  GXTexFmt resolveFormat = GX_TF_RGBA8;
+  std::optional<Vec4<float>> sourceRectPixels;
+  bool halfScale = false;
+  std::array<u32, 3> copyFilterCoefficients{0, 64, 0};
+  bool forceOpaqueAlpha = false;
+  float copyFilterRowStride = 1.0f;
+  bool clampTop = false;
+  bool clampBottom = false;
+  bool persistentCopy = false;
+};
+
+namespace {
+std::vector<ResolvePassRecord> s_resolvePassRecords;
+} // namespace
+
+void reset_resolve_pass_records() noexcept { s_resolvePassRecords.clear(); }
+
+const std::vector<ResolvePassRecord>& resolve_pass_records() noexcept { return s_resolvePassRecords; }
+
+void set_framebuffer_sizes(uint32_t logicalWidth, uint32_t logicalHeight,
+                           uint32_t targetWidth, uint32_t targetHeight) noexcept {
+  s_logicalFbSize = {logicalWidth, logicalHeight};
+  s_renderTargetSize = {targetWidth, targetHeight};
+}
+} // namespace testing
+
+TextureHandle new_static_texture_2d(uint32_t width, uint32_t height, uint32_t mips, u32 gxFormat,
+                                    ArrayRef<uint8_t> data, bool tlut, const char* label) noexcept {
+  return {};
+}
+TextureHandle new_dynamic_texture_2d(uint32_t width, uint32_t height, uint32_t mips, u32 gxFormat,
+                                     const char* label) noexcept {
+  return {};
+}
+TextureHandle new_render_texture(uint32_t width, uint32_t height, u32 gxFormat, const char* label) noexcept {
+  return std::make_shared<TextureRef>(wgpu::Texture{}, wgpu::TextureView{}, wgpu::TextureView{},
+                                      wgpu::Extent3D{width, height, 1}, wgpu::TextureFormat::RGBA8Unorm, 1, gxFormat);
+}
+TextureHandle new_conv_texture(uint32_t width, uint32_t height, u32 gxFormat, const char* label) noexcept {
+  return std::make_shared<TextureRef>(wgpu::Texture{}, wgpu::TextureView{}, wgpu::TextureView{},
+                                      wgpu::Extent3D{width, height, 1}, wgpu::TextureFormat::RGBA8Unorm, 1, gxFormat);
+}
+void write_texture(const TextureRef& ref, ArrayRef<uint8_t> data) noexcept {}
+void resolve_pass(TextureHandle texture, ClipRect rect, bool clearColor, bool clearAlpha, bool clearDepth,
+                  Vec4<float> clearColorValue, float clearDepthValue, GXTexFmt resolveFormat,
+                  const Vec4<float>* sourceRectPixels, bool halfScale,
+                  const std::array<u32, 3>* copyFilterCoefficients, bool forceOpaqueAlpha,
+                  float copyFilterRowStride, bool clampTop, bool clampBottom, bool persistentCopy) {
+  testing::ResolvePassRecord record;
+  record.texture = std::move(texture);
+  record.rect = rect;
+  record.clearColor = clearColor;
+  record.clearAlpha = clearAlpha;
+  record.clearDepth = clearDepth;
+  record.clearColorValue = clearColorValue;
+  record.clearDepthValue = clearDepthValue;
+  record.resolveFormat = resolveFormat;
+  record.sourceRectPixels = sourceRectPixels != nullptr ? std::make_optional(*sourceRectPixels) : std::nullopt;
+  record.halfScale = halfScale;
+  record.copyFilterCoefficients =
+      copyFilterCoefficients != nullptr ? *copyFilterCoefficients : std::array<u32, 3>{0, 64, 0};
+  record.forceOpaqueAlpha = forceOpaqueAlpha;
+  record.copyFilterRowStride = copyFilterRowStride;
+  record.clampTop = clampTop;
+  record.clampBottom = clampBottom;
+  record.persistentCopy = persistentCopy;
+  testing::s_resolvePassRecords.push_back(std::move(record));
+}
+void queue_palette_conv(tex_palette_conv::ConvRequest req) {}
+void begin_offscreen(uint32_t width, uint32_t height) {}
+void end_offscreen() {}
+bool is_offscreen() noexcept { return false; }
+} // namespace aurora::gfx
+
+namespace aurora::gfx::depth_peek {
+namespace {
+bool s_snapshotRequested = false;
+uint32_t s_width = 0;
+uint32_t s_height = 0;
+std::vector<uint32_t> s_data;
+} // namespace
+
+void initialize() {}
+void shutdown() {}
+void request_snapshot() noexcept { s_snapshotRequested = true; }
+void poll() noexcept {}
+void encode_frame_snapshot(const wgpu::CommandEncoder& cmd, const wgpu::TextureView& depthView,
+                           wgpu::Extent3D sourceSize, uint32_t msaaSamples) noexcept {}
+void after_submit() noexcept {}
+
+bool read_latest(uint16_t x, uint16_t y, uint32_t& z) noexcept {
+  if (x >= s_width || y >= s_height || s_data.empty()) {
+    return false;
+  }
+  z = s_data[static_cast<size_t>(y) * s_width + x] & 0x00ffffffu;
+  return true;
+}
+
+namespace testing {
+void reset() noexcept {
+  s_snapshotRequested = false;
+  s_width = 0;
+  s_height = 0;
+  s_data.clear();
+}
+
+bool snapshot_requested() noexcept { return s_snapshotRequested; }
+
+void set_latest(uint32_t width, uint32_t height, const std::vector<uint32_t>& data) {
+  s_width = width;
+  s_height = height;
+  s_data = data;
+}
+} // namespace testing
+} // namespace aurora::gfx::depth_peek
+
+namespace aurora::gfx::tex_copy_conv {
+bool needs_conversion(GXTexFmt fmt) { return false; }
+} // namespace aurora::gfx::tex_copy_conv
+
+namespace aurora::gfx::tex_palette_conv {
+void queue(ConvRequest req) {}
+} // namespace aurora::gfx::tex_palette_conv
+
+namespace aurora::gfx::texture_replacement {
+u32 compute_texture_upload_size(const GXTexObj_& obj) noexcept { return 0; }
+void register_tlut(const GXTlutObj*, const void*, GXTlutFmt, u16) noexcept {}
+void load_tlut(const GXTlutObj*, u32) noexcept {}
+std::optional<TextureHandle> find_replacement(const GXTexObj_&) noexcept { return std::nullopt; }
+} // namespace aurora::gfx::texture_replacement
+
+// --- Window stub ---
+#include "../lib/window.hpp"
+namespace aurora::window {
+AuroraWindowSize get_window_size() { return {640, 480, 640, 480, 640, 480, 1.0f}; }
+void set_frame_buffer_aspect_fit(bool) {}
+} // namespace aurora::window
+
+// --- WebGPU C API stubs (prevent linker errors from wgpu:: destructors) ---
+extern "C" {
+void wgpuDeviceRelease(WGPUDevice) {}
+void wgpuQueueRelease(WGPUQueue) {}
+void wgpuSurfaceRelease(WGPUSurface) {}
+void wgpuBufferRelease(WGPUBuffer) {}
+void wgpuTextureRelease(WGPUTexture) {}
+void wgpuTextureViewRelease(WGPUTextureView) {}
+void wgpuSamplerRelease(WGPUSampler) {}
+void wgpuShaderModuleRelease(WGPUShaderModule) {}
+void wgpuRenderPipelineRelease(WGPURenderPipeline) {}
+void wgpuBindGroupRelease(WGPUBindGroup) {}
+void wgpuBindGroupLayoutRelease(WGPUBindGroupLayout) {}
+void wgpuPipelineLayoutRelease(WGPUPipelineLayout) {}
+void wgpuInstanceRelease(WGPUInstance) {}
+void wgpuDeviceAddRef(WGPUDevice) {}
+void wgpuQueueAddRef(WGPUQueue) {}
+void wgpuSurfaceAddRef(WGPUSurface) {}
+void wgpuBufferAddRef(WGPUBuffer) {}
+void wgpuTextureAddRef(WGPUTexture) {}
+void wgpuTextureViewAddRef(WGPUTextureView) {}
+void wgpuInstanceAddRef(WGPUInstance) {}
+}
+
+void aurora::gfx::push_debug_group(std::string) {}
+void aurora_push_debug_group(const char*) {}
+void aurora_pop_debug_group() {}
+void aurora::gfx::insert_debug_marker(std::string) {}
diff --git a/aurora-main/tests/os_alloc_test.cpp b/aurora-main/tests/os_alloc_test.cpp
new file mode 100644
index 0000000..2811210
--- /dev/null
+++ b/aurora-main/tests/os_alloc_test.cpp
@@ -0,0 +1,106 @@
+#include <dolphin/os.h>
+
+#include <gtest/gtest.h>
+
+#include <array>
+#include <cstdint>
+
+namespace {
+
+constexpr std::size_t kArenaBytes = 64 * 1024;
+
+std::array<std::uint8_t, kArenaBytes> gArena{};
+
+void resetAllocator(int maxHeaps = 8) {
+  std::fill(gArena.begin(), gArena.end(), 0);
+  void* start = gArena.data();
+  void* end = gArena.data() + gArena.size();
+  ASSERT_NE(OSInitAlloc(start, end, maxHeaps), nullptr);
+  EXPECT_EQ(OSSetCurrentHeap(-1), -1);
+}
+
+} // namespace
+
+TEST(OSAlloc, InitCreateAllocFreeCheck) {
+  resetAllocator();
+
+  OSHeapHandle heap = OSCreateHeap(gArena.data() + 512, gArena.data() + 4096);
+  ASSERT_GE(heap, 0);
+
+  EXPECT_EQ(OSSetCurrentHeap(heap), -1);
+
+  void* p = OSAllocFromHeap(heap, 96);
+  ASSERT_NE(p, nullptr);
+  EXPECT_EQ(reinterpret_cast<std::uintptr_t>(p) & 31u, 0u);
+  EXPECT_GE(OSReferentSize(p), 96u);
+
+  s32 freeBefore = OSCheckHeap(heap);
+  EXPECT_GE(freeBefore, 0);
+
+  OSFreeToHeap(heap, p);
+  s32 freeAfter = OSCheckHeap(heap);
+  EXPECT_GE(freeAfter, freeBefore);
+}
+
+TEST(OSAlloc, AddToHeapMakesSpaceAvailable) {
+  resetAllocator();
+
+  OSHeapHandle heap = OSCreateHeap(gArena.data() + 0x1000, gArena.data() + 0x2000);
+  ASSERT_GE(heap, 0);
+
+  void* p1 = OSAllocFromHeap(heap, 0xD00);
+  ASSERT_NE(p1, nullptr);
+
+  void* p2 = OSAllocFromHeap(heap, 0x400);
+  EXPECT_EQ(p2, nullptr);
+
+  OSAddToHeap(heap, gArena.data() + 0x3000, gArena.data() + 0x3800);
+
+  p2 = OSAllocFromHeap(heap, 0x400);
+  EXPECT_NE(p2, nullptr);
+}
+
+TEST(OSAlloc, AllocFixedCarvesRangeFromHeap) {
+  resetAllocator();
+
+  OSHeapHandle heap = OSCreateHeap(gArena.data() + 0x2000, gArena.data() + 0x5000);
+  ASSERT_GE(heap, 0);
+
+  s32 freeBefore = OSCheckHeap(heap);
+  ASSERT_GT(freeBefore, 0);
+
+  void* fixed = OSAllocFixed(gArena.data() + 0x3000, gArena.data() + 0x3400);
+  ASSERT_NE(fixed, nullptr);
+
+  s32 freeAfter = OSCheckHeap(heap);
+  EXPECT_GE(freeBefore, freeAfter);
+}
+
+TEST(OSAlloc, SetCurrentHeapReturnsPrevious) {
+  resetAllocator();
+
+  OSHeapHandle heapA = OSCreateHeap(gArena.data() + 0x1000, gArena.data() + 0x2000);
+  OSHeapHandle heapB = OSCreateHeap(gArena.data() + 0x3000, gArena.data() + 0x4000);
+  ASSERT_GE(heapA, 0);
+  ASSERT_GE(heapB, 0);
+
+  EXPECT_EQ(OSSetCurrentHeap(heapA), -1);
+  EXPECT_EQ(OSSetCurrentHeap(heapB), heapA);
+
+  void* p = OSAlloc(128);
+  ASSERT_NE(p, nullptr);
+  OSFree(p);
+
+  EXPECT_GE(OSCheckHeap(heapB), 0);
+}
+
+TEST(OSAlloc, DestroyHeapInvalidatesHandle) {
+  resetAllocator();
+
+  OSHeapHandle heap = OSCreateHeap(gArena.data() + 0x1000, gArena.data() + 0x2000);
+  ASSERT_GE(heap, 0);
+
+  OSDestroyHeap(heap);
+  EXPECT_LT(OSCheckHeap(heap), 0);
+  EXPECT_EQ(OSAllocFromHeap(heap, 64), nullptr);
+}
diff --git a/aurora-main/tests/os_test_globals.cpp b/aurora-main/tests/os_test_globals.cpp
new file mode 100644
index 0000000..40e4355
--- /dev/null
+++ b/aurora-main/tests/os_test_globals.cpp
@@ -0,0 +1,5 @@
+#include <aurora/aurora.h>
+
+namespace aurora {
+AuroraConfig g_config{};
+}
diff --git a/aurora-main/tests/test_dvd.cpp b/aurora-main/tests/test_dvd.cpp
new file mode 100644
index 0000000..b48f877
--- /dev/null
+++ b/aurora-main/tests/test_dvd.cpp
@@ -0,0 +1,288 @@
+#include <dolphin/dvd.h>
+#include <aurora/dvd.h>
+
+#include <gtest/gtest.h>
+
+#include <cstdio>
+#include <cstring>
+#include <vector>
+
+// =============================================================================
+// Tests that do NOT require a disc image
+// =============================================================================
+
+TEST(DVDStubs, Constants) {
+  EXPECT_EQ(DVD_STATE_END, 0);
+  EXPECT_EQ(DVD_STATE_BUSY, 1);
+  EXPECT_EQ(DVD_STATE_CANCELED, 10);
+  EXPECT_EQ(DVD_RESULT_GOOD, 0);
+  EXPECT_EQ(DVD_RESULT_FATAL_ERROR, -1);
+  EXPECT_EQ(DVD_RESULT_CANCELED, -6);
+}
+
+TEST(DVDStubs, StructSizes) {
+  EXPECT_GT(sizeof(DVDDiskID), 0u);
+  EXPECT_GT(sizeof(DVDCommandBlock), 0u);
+  EXPECT_GT(sizeof(DVDFileInfo), 0u);
+  EXPECT_GT(sizeof(DVDDir), 0u);
+  EXPECT_GT(sizeof(DVDDirEntry), 0u);
+  EXPECT_GE(sizeof(DVDFileInfo), sizeof(DVDCommandBlock));
+}
+
+TEST(DVDStubs, InitWithoutDisc) { DVDInit(); }
+
+TEST(DVDStubs, GetDriveStatus) { EXPECT_EQ(DVDGetDriveStatus(), DVD_STATE_NO_DISK); }
+
+TEST(DVDStubs, Reset) { DVDReset(); }
+
+TEST(DVDStubs, ResetRequired) { EXPECT_EQ(DVDResetRequired(), FALSE); }
+
+TEST(DVDStubs, PauseResume) {
+  DVDPause();
+  DVDResume();
+}
+
+TEST(DVDStubs, AutoInvalidation) {
+  BOOL prev = DVDSetAutoInvalidation(TRUE);
+  EXPECT_EQ(prev, FALSE);
+  prev = DVDSetAutoInvalidation(FALSE);
+  EXPECT_EQ(prev, TRUE);
+  prev = DVDSetAutoInvalidation(FALSE);
+  EXPECT_EQ(prev, FALSE);
+}
+
+TEST(DVDStubs, Cancel) {
+  DVDCommandBlock block{};
+  block.state = DVD_STATE_BUSY;
+  s32 result = DVDCancel(&block);
+  EXPECT_EQ(result, 0);
+  EXPECT_EQ(block.state, DVD_STATE_CANCELED);
+}
+
+TEST(DVDStubs, CancelAsync) {
+  DVDCommandBlock block{};
+  block.state = DVD_STATE_BUSY;
+  DVDCancelAsync(&block, [](s32, DVDCommandBlock*) {});
+  EXPECT_EQ(block.state, DVD_STATE_CANCELED);
+}
+
+TEST(DVDStubs, CancelAll) { EXPECT_EQ(DVDCancelAll(), DVD_RESULT_GOOD); }
+
+TEST(DVDStubs, SeekStubs) {
+  DVDFileInfo fi{};
+  fi.cb.state = DVD_STATE_BUSY;
+  s32 result = DVDSeekPrio(&fi, 0, 2);
+  EXPECT_EQ(result, DVD_RESULT_FATAL_ERROR);
+  EXPECT_EQ(fi.cb.state, DVD_STATE_FATAL_ERROR);
+
+  fi.cb.state = DVD_STATE_BUSY;
+  BOOL ok = DVDSeekAsyncPrio(&fi, 0, [](s32, DVDFileInfo*) {}, 2);
+  EXPECT_EQ(ok, TRUE);
+  EXPECT_EQ(fi.cb.state, DVD_STATE_FATAL_ERROR);
+}
+
+TEST(DVDStubs, GetFSTLocation) { EXPECT_EQ(DVDGetFSTLocation(), nullptr); }
+
+TEST(DVDStubs, GetCurrentDiskID) {
+  DVDDiskID* id = DVDGetCurrentDiskID();
+  EXPECT_NE(id, nullptr);
+}
+
+TEST(DVDStubs, FileInfoStatus) {
+  DVDFileInfo fi{};
+  fi.cb.state = DVD_STATE_END;
+  EXPECT_EQ(DVDGetFileInfoStatus(&fi), DVD_STATE_END);
+  fi.cb.state = DVD_STATE_BUSY;
+  EXPECT_EQ(DVDGetFileInfoStatus(&fi), DVD_STATE_BUSY);
+}
+
+TEST(DVDStubs, TransferredSize) {
+  DVDFileInfo fi{};
+  fi.cb.transferredSize = 1234;
+  EXPECT_EQ(DVDGetTransferredSize(&fi), 1234);
+}
+
+TEST(DVDStubs, CommandBlockStatus) {
+  DVDCommandBlock block{};
+  block.state = DVD_STATE_WAITING;
+  EXPECT_EQ(DVDGetCommandBlockStatus(&block), DVD_STATE_WAITING);
+}
+
+// =============================================================================
+// Without a disc: operations should fail gracefully
+// =============================================================================
+
+TEST(DVDNoDisc, OpenFails) {
+  DVDFileInfo fi{};
+  EXPECT_EQ(DVDOpen("test.bin", &fi), FALSE);
+}
+
+TEST(DVDNoDisc, FastOpenFails) {
+  DVDFileInfo fi{};
+  EXPECT_EQ(DVDFastOpen(0, &fi), FALSE);
+}
+
+TEST(DVDNoDisc, CloseNullHandle) {
+  DVDFileInfo fi{};
+  fi.cb.userData = nullptr;
+  fi.cb.state = DVD_STATE_BUSY;
+  EXPECT_EQ(DVDClose(&fi), TRUE);
+  EXPECT_EQ(fi.cb.state, DVD_STATE_END);
+}
+
+TEST(DVDNoDisc, OpenDirFails) {
+  DVDDir dir{};
+  EXPECT_EQ(DVDOpenDir("/", &dir), FALSE);
+}
+
+TEST(DVDNoDisc, CloseDir) {
+  DVDDir dir{};
+  EXPECT_EQ(DVDCloseDir(&dir), TRUE);
+}
+
+TEST(DVDNoDisc, ChangeDirFails) { EXPECT_EQ(DVDChangeDir("/"), FALSE); }
+
+TEST(DVDNoDisc, ConvertPathFails) { EXPECT_EQ(DVDConvertPathToEntrynum("/test"), -1); }
+
+TEST(DVDNoDisc, GetCurrentDir) {
+  char buf[256];
+  EXPECT_EQ(DVDGetCurrentDir(buf, sizeof(buf)), TRUE);
+  EXPECT_STREQ(buf, "/");
+}
+
+// =============================================================================
+// Tests that require a disc image (conditionally compiled)
+// =============================================================================
+
+#ifdef DVD_TEST_IMAGE
+
+class DVDDiscTest : public ::testing::Test {
+protected:
+  static void SetUpTestSuite() {
+    ASSERT_TRUE(aurora_dvd_open(DVD_TEST_IMAGE));
+    DVDInit();
+  }
+
+  static void TearDownTestSuite() { aurora_dvd_close(); }
+};
+
+// Helper: find the first file entry in root by iterating the directory.
+// Returns the entry number and fills fileName, or returns -1 if none found.
+static s32 findFirstRootFile(char* fileName, size_t fileNameSize) {
+  DVDDir dir{};
+  if (!DVDOpenDir("/", &dir))
+    return -1;
+
+  DVDDirEntry dirent{};
+  s32 fileEntry = -1;
+  while (DVDReadDir(&dir, &dirent)) {
+    if (!dirent.isDir) {
+      fileEntry = static_cast<s32>(dirent.entryNum);
+      std::snprintf(fileName, fileNameSize, "/%s", dirent.name);
+      break;
+    }
+  }
+  DVDCloseDir(&dir);
+  return fileEntry;
+}
+
+TEST_F(DVDDiscTest, ConvertPathRoot) { EXPECT_EQ(DVDConvertPathToEntrynum("/"), 0); }
+
+TEST_F(DVDDiscTest, ConvertPathDotDotDot) {
+  EXPECT_EQ(DVDConvertPathToEntrynum("."), 0);
+  EXPECT_EQ(DVDConvertPathToEntrynum(".."), 0);
+}
+
+TEST_F(DVDDiscTest, ConvertPathInvalid) {
+  EXPECT_EQ(DVDConvertPathToEntrynum("/nonexistent_file_that_should_not_exist"), -1);
+}
+
+TEST_F(DVDDiscTest, OpenDirRoot) {
+  DVDDir dir{};
+  EXPECT_EQ(DVDOpenDir("/", &dir), TRUE);
+  EXPECT_EQ(dir.entryNum, 0u);
+  EXPECT_EQ(dir.location, 1u);
+
+  DVDDirEntry dirent{};
+  BOOL hasEntry = DVDReadDir(&dir, &dirent);
+  if (hasEntry) {
+    EXPECT_NE(dirent.name, nullptr);
+    EXPECT_GT(std::strlen(dirent.name), 0u);
+  }
+  DVDCloseDir(&dir);
+}
+
+TEST_F(DVDDiscTest, ChangeDirRoot) {
+  EXPECT_EQ(DVDChangeDir("/"), TRUE);
+  char buf[256];
+  DVDGetCurrentDir(buf, sizeof(buf));
+  EXPECT_STREQ(buf, "/");
+}
+
+TEST_F(DVDDiscTest, OpenCloseFile) {
+  char fileName[256] = {};
+  s32 fileEntry = findFirstRootFile(fileName, sizeof(fileName));
+  if (fileEntry < 0) {
+    GTEST_SKIP() << "No files in root directory";
+  }
+
+  DVDFileInfo fi{};
+  EXPECT_EQ(DVDOpen(fileName, &fi), TRUE);
+  EXPECT_GT(fi.length, 0u);
+  EXPECT_EQ(fi.cb.state, DVD_STATE_END);
+  EXPECT_EQ(DVDClose(&fi), TRUE);
+
+  EXPECT_EQ(DVDFastOpen(fileEntry, &fi), TRUE);
+  EXPECT_EQ(DVDClose(&fi), TRUE);
+}
+
+TEST_F(DVDDiscTest, ReadFile) {
+  char fileName[256] = {};
+  if (findFirstRootFile(fileName, sizeof(fileName)) < 0) {
+    GTEST_SKIP() << "No files in root directory";
+  }
+
+  DVDFileInfo fi{};
+  ASSERT_EQ(DVDOpen(fileName, &fi), TRUE);
+
+  u32 readSize = fi.length < 32 ? fi.length : 32;
+  std::vector<u8> buf(readSize);
+  s32 bytesRead = DVDReadPrio(&fi, buf.data(), static_cast<s32>(readSize), 0, 2);
+  EXPECT_EQ(bytesRead, static_cast<s32>(readSize));
+  EXPECT_EQ(DVDGetTransferredSize(&fi), static_cast<s32>(readSize));
+
+  DVDClose(&fi);
+}
+
+TEST_F(DVDDiscTest, ReadAsync) {
+  char fileName[256] = {};
+  if (findFirstRootFile(fileName, sizeof(fileName)) < 0) {
+    GTEST_SKIP() << "No files in root directory";
+  }
+
+  DVDFileInfo fi{};
+  ASSERT_EQ(DVDOpen(fileName, &fi), TRUE);
+
+  u32 readSize = fi.length < 32 ? fi.length : 32;
+  std::vector<u8> buf(readSize);
+  BOOL ok = DVDReadAsyncPrio(&fi, buf.data(), static_cast<s32>(readSize), 0, [](s32, DVDFileInfo*) {}, 2);
+  EXPECT_EQ(ok, TRUE);
+  EXPECT_EQ(DVDGetTransferredSize(&fi), static_cast<s32>(readSize));
+
+  DVDClose(&fi);
+}
+
+TEST_F(DVDDiscTest, DiskID) {
+  DVDDiskID* id = DVDGetCurrentDiskID();
+  ASSERT_NE(id, nullptr);
+  bool hasGameName = false;
+  for (int i = 0; i < 4; i++) {
+    if (id->gameName[i] != '\0') {
+      hasGameName = true;
+      break;
+    }
+  }
+  EXPECT_TRUE(hasGameName);
+}
+
+#endif // DVD_TEST_IMAGE
diff --git a/aurora-main/tests/texture_bind_group_cache_key_test.cpp b/aurora-main/tests/texture_bind_group_cache_key_test.cpp
new file mode 100644
index 0000000..9a28086
--- /dev/null
+++ b/aurora-main/tests/texture_bind_group_cache_key_test.cpp
@@ -0,0 +1,44 @@
+#include "gx/texture_bind_group_cache_key.hpp"
+
+#include <gtest/gtest.h>
+
+#include <array>
+#include <cstddef>
+#include <new>
+
+namespace aurora::gx {
+namespace {
+
+TEST(TextureBindGroupCacheKeyTest, DistinctViewsDoNotAliasWhenWrapperStorageIsReused) {
+  struct SimulatedTextureRef {
+    const void* sampleTextureView;
+  };
+
+  alignas(SimulatedTextureRef) std::array<std::byte, sizeof(SimulatedTextureRef)> wrapperStorage{};
+  int firstView = 0;
+  int secondView = 0;
+
+  TextureBindGroupCacheKey first{
+      .sampledTextures = 1,
+  };
+  TextureBindGroupCacheKey second = first;
+  auto* firstWrapper = new (wrapperStorage.data()) SimulatedTextureRef{&firstView};
+  const void* const reusedWrapperAddress = firstWrapper;
+  set_texture_bind_group_cache_slot(first, 0, firstWrapper->sampleTextureView, 0x1234, 0x5678, 0x9abc);
+  firstWrapper->~SimulatedTextureRef();
+
+  auto* secondWrapper = new (wrapperStorage.data()) SimulatedTextureRef{&secondView};
+  set_texture_bind_group_cache_slot(second, 0, secondWrapper->sampleTextureView, 0x1234, 0x5678, 0x9abc);
+
+  // A freed TextureRef wrapper can be reconstructed at the same allocator
+  // address in one frame. The old key therefore saw these bindings as equal.
+  EXPECT_EQ(reusedWrapperAddress, static_cast<const void*>(secondWrapper));
+  EXPECT_NE(first, second);
+
+  TextureBindGroupCacheKey sameView = first;
+  EXPECT_EQ(first, sameView);
+  secondWrapper->~SimulatedTextureRef();
+}
+
+} // namespace
+} // namespace aurora::gx
diff --git a/projects/examples/generic-dol.yml b/projects/examples/generic-dol.yml
new file mode 100644
index 0000000..bc49597
--- /dev/null
+++ b/projects/examples/generic-dol.yml
@@ -0,0 +1,40 @@
+schema_version: 1
+workspace_root: ../..
+
+project:
+  id: external-generic-dol
+  display_name: External Generic DOL
+
+memory:
+  base: 0x80000000
+  size: 0x01800000
+
+  # Required by every command that emits RuntimeConfig.h. These are the r13/r2
+  # Small Data Area bases your DOL's boot code installs: disassemble the lis/ori
+  # pairs in __init_registers (the first `bl` from the entry point) and paste the
+  # two constants here. The translator does not guess them.
+  # sda_base: 0x00000000   # _SDA_BASE_  (r13)
+  # sda2_base: 0x00000000  # _SDA2_BASE_ (r2)
+
+inputs:
+  # Set RECOMP_GENERIC_DOL to a legally obtained GameCube/Wii main.dol.
+  dol:
+    path: "%RECOMP_GENERIC_DOL%"
+
+translation:
+  allow_unsupported_instructions: true
+  # Optional. With no function_map the recursive pass seeds from the entry point
+  # only and discovers the rest through the call graph; there are no heuristic
+  # function-start scans to fall back on.
+  # function_map:
+  #   path: my-game/MAP.txt
+
+runtime:
+  native_abi_directories: []
+
+output:
+  root: build/generic-dol
+  functions: functions
+  runtime_config: RuntimeConfig.h
+  data_initializer: data_sections_init.cpp
+  base_manifest: base/base_manifest.json
diff --git a/projects/mkwii/MAP.txt b/projects/mkwii/MAP.txt
new file mode 100644
index 0000000..98c8a56
--- /dev/null
+++ b/projects/mkwii/MAP.txt
@@ -0,0 +1,29792 @@
+800018a8 0x800018a8
+80001d50 0x80001d50
+80001d6c 0x80001d6c
+80001d90 0x80001d90
+80001dc0 0x80001dc0
+80001de8 0x80001de8
+80001dec 0x80001dec
+80001e14 0x80001e14
+80001e30 0x80001e30
+80001f1c 0x80001f1c
+80001f40 0x80001f40
+80001f54 0x80001f54
+80002440 0x80002440
+8000245c 0x8000245c
+8000249c __TRKreset
+80005f34 memcpy
+80005f84 __fill_mem
+80006038 memset
+80006068 __check_pad3
+80006090 __set_debug_bba
+8000609c __get_debug_bba
+800060a4 __start
+80006210 __init_registers
+800062a0 __init_data
+80006348 __init_hardware
+8000636c __flush_cache
+800063a0 0x800063a0
+800072c0 StrapScene::__ct
+800073f0 RKScene::__dt
+80007448 StrapScene::__dt
+800074a4 StrapScene::LinkModule
+800074d8 StrapScene::enter
+800077c8 StrapScene::CheckInput
+800079d0 StrapScene::calc
+80007bc0 EGG::ColorFader::getStatus
+80007bc8 StrapScene::draw
+80007f2c StrapScene::exit
+80007f34 EGG::Scene::outgoing_child_create
+80007f38 EGG::Scene::incoming_child_destroy
+80007f3c EGG::Scene::reinit
+80007f40 EGG::Scene::exit
+80007f44 EGG::Scene::enter
+80007f48 EGG::Scene::draw
+80007f4c EGG::Scene::calc
+80007f50 getContentArcNameByIdx
+80007f64 0x80007f64
+80007f7c DiscError::__ct
+80007fac DiscError::__dt
+80008004 setDiscReadErrorMessage
+800080f4 0x800080f4
+800080f8 DiscInfoMessageData_printError
+80008bd0 nw4r::ut::Color::__dt
+80008c10 DiscCheckThread::create
+80008cb0 DiscCheckThread::__dt
+80008d18 DvdThread_main
+80008e20 DiscCheckThread::halt
+80008e74 DiscInfo_printError
+80008e7c 0x80008e7c
+80008e80 0x80008e80
+80008e84 RKSystem::GetStaticInstance
+80008e90 RKSystem::WPADAlloc
+80008eb0 RKSystem::WPADFree
+80008ef0 RKSystem::Main
+80008fac RKSystem::GetSystemHeap
+80008fb4 EGG::TSystem::Initialize
+80009190 EGG::TSystem::InitRenderMode
+80009194 RKSystem::Initialize
+8000951c RKSystem::Run
+80009818 EGG::TSystem::GetDisplay
+80009820 EGG::TSystem::OnBeginFrame
+80009824 EGG::TSystem::OnEndFrame
+80009828 EGG::TSystem::GetSceneMgr
+80009830 EGG::TSystem::GetPerfView
+80009844 RKSceneManager::ChangeSceneByCreatorAfterFadeOut
+8000984c RKSceneManager::calcCurrentFader
+80009984 RKSceneManager::calc
+80009988 RKSceneManager::draw
+8000998c RKSceneManager::drawCurrentFaderImpl
+8000999c RKSceneManager::calcCurrentFaderImpl
+800099ac EGG::TSystem::GetVideo
+800099b4 EGG::TSystem::GetSystemHeap
+800099bc EGG::TSystem::GetXfbMgr
+800099c4 EGG::TSystem::GetAudioMgr
+800099cc __sinit_\RKSystem_cpp
+80009b40 EGG::Vector3f::__dt
+80009b80 EGG::Vector2f::__dt
+80009bc0 ExpHeapGroup::SetHeapsGroupId
+80009c24 ExpHeapGroup::CalculateGroupSizeRecords
+80009c8c RKParameterFile::__ct
+80009ce0 RKParameterFile::__dt
+80009d6c RKParameterFile::AddParameter
+80009ddc RKParameterFile::ReadParameterFile
+80009ef8 RamStream::__dt
+80009f50 RKParameterFile::vf_0x18
+80009f54 RKParameterFile::vf_0x14
+80009f58 RKParameterFile::vf_0x10
+80009f5c ModuleLinker::Disposer__dt
+80009ff0 ModuleLinker::Create
+8000a000 0x8000a000
+8000a06c ModuleLinker::0x8000a06c
+8000a070 ModuleLinker::0x8000a070
+8000a074 ModuleLinker::__dt
+8000a188 ModuleLinker::Link
+8000a3f8 ModuleLinker::CallModule
+8000a440 ModuleLinker::Report
+8000a550 RKSceneCreator::create
+8000a5a8 RKSceneCreator::destroy
+8000a5d0 SystemManager::create
+8000a624 SystemManager::__dt
+8000a688 SystemManager::__ct
+8000a8f0 SystemManager::PrepareLaunch
+8000ab88 SystemManager::LoadMapFile
+8000ac50 SystemManager::Init
+8000af78 SystemManager::GetCountry
+8000afec SystemManager::GetLongitude
+8000b0a0 SystemManager::GetLatitude
+8000b154 SystemManager::Shutdown
+8000b188 SystemManager::ReturnToMenu
+8000b1bc SystemManager::RestartGame
+8000b1f4 0x8000b1f4
+8000b210 0x8000b210
+8000b22c SystemManager::SetSystemPowerCallbacks
+8000b26c SystemManager::HandlePowerState
+8000b2d8 SystemManager::GetGameId
+8000b2e0 SystemManager::GenerateGameId
+8000b308 SystemManager::RipFromDiscAsync
+8000b370 SystemManager::RipFromDiscImpl
+8000b53c SystemManager::ProcessRipRequest
+8000b5c8 SystemManager::RipFromDisc(heap)
+8000b5f0 SystemManager::RipFromDisc(no heap)
+8000b610 SystemManager::GetDisplayModeType
+8000b654 SystemManager::StopAllControllerMotors
+8000b6b0 Main
+8000b6b4 __DBMtrHandler
+8000b6d8 __DBIntrHandler
+8000b6fc DBInitComm
+8000b758 DBInitInterrupts
+8000b7ac DBQueryData
+8000b850 DBRead
+8000b8d0 DBWrite
+8000b9e0 DBOpen
+8000b9e4 DBClose
+8000b9e8 __EXI2Imm
+8000bcd0 __DBEXIInit
+8000bd8c __DBEXIReadReg
+8000beb0 __DBEXIWriteReg
+8000bfb4 __DBEXIReadRam
+8000c094 __DBEXIWriteRam
+8000c174 _ftell
+8000c21c ftell
+8000c220 _fseek
+8000c3e4 fseek
+8000c3e8 rewind
+8000c430 atexit
+8000c434 Block_link
+8000c584 SubBlock_merge_next
+8000c62c deallocate_from_fixed_pools
+8000c818 free
+8000c948 __close_all
+8000c9ec __flush_line_buffered_output_files
+8000ca70 __flush_all
+8000cadc __ull2dec
+8000cbb8 __timesdec
+8000ce40 __str2dec
+8000cf2c __two_exp
+8000cf68 __two_exp_switch
+8000cf6c __two_exp_caseD_ffffffc0
+8000cf80 __two_exp_caseD_ffffffcb
+8000cf98 __two_exp_caseD_ffffffe0
+8000cfb0 __two_exp_caseD_fffffff0
+8000cfc8 __two_exp_caseD_fffffff8
+8000cfe0 __two_exp_caseD_fffffff9
+8000cff8 __two_exp_caseD_fffffffa
+8000d010 __two_exp_caseD_fffffffb
+8000d028 __two_exp_caseD_fffffffc
+8000d040 __two_exp_caseD_fffffffd
+8000d058 __two_exp_caseD_fffffffe
+8000d070 __two_exp_caseD_ffffffff
+8000d088 __two_exp_caseD_0
+8000d0a0 __two_exp_caseD_1
+8000d0b8 __two_exp_caseD_2
+8000d0d0 __two_exp_caseD_3
+8000d0e8 __two_exp_caseD_4
+8000d100 __two_exp_caseD_5
+8000d118 __two_exp_caseD_6
+8000d130 __two_exp_caseD_7
+8000d148 __two_exp_caseD_8
+8000d160 __two_exp_caseD_ffffffc1
+8000d298 __equals_dec
+8000d37c __less_dec
+8000d47c __minus_dec
+8000d998 __num2dec_internal
+8000dafc __num2dec
+8000dc9c __dec2num
+8000e434 __prep_buffer
+8000e45c __load_buffer
+8000e558 __flush_buffer
+8000e610 fread
+8000e614 __fread
+8000e954 __fwrite
+8000ec5c fclose
+8000ed18 fflush
+8000ee4c __msl_strnicmp
+8000ef04 __fpclassifyf
+8000ef64 __signbitd
+8000ef7c __fpclassifyd
+8000eff8 mbtowc
+8000f010 __mbtowc_noconv
+8000f05c __wctomb_noconv
+8000f078 mbstowcs
+8000f138 wcstombs
+8000f1f0 memmove
+8000f2bc memchr
+8000f2e8 __memrchr
+8000f314 memcmp
+8000f360 __copy_longs_aligned
+8000f41c __copy_longs_rev_aligned
+8000f4c4 __copy_longs_unaligned
+8000f584 __copy_longs_rev_unaligned
+8000f630 __stdio_atexit
+8000f640 parse_format
+8000f9d0 parse_format_switch
+8000f9d4 parse_format_caseD_58
+8000fa1c parse_format_caseD_46
+8000fa64 parse_format_caseD_41
+8000fab0 parse_format_caseD_47
+8000fac4 parse_format_caseD_45
+8000fb14 parse_format_caseD_70
+8000fb38 parse_format_caseD_63
+8000fb70 parse_format_caseD_73
+8000fb80 0x8000fb80
+8000fb9c 0x8000fb80_caseD_6e
+8000fbb4 0x8000fb80_caseD_42
+8000fbfc long2str
+8000fe34 longlong2str
+80010000 0x80010000
+800100e4 double2hex
+80010138 0x80010138
+800104b4 round_decimal
+800105dc float2str
+80010d74 _pformatter
+80010dbc 0x80010dbc
+80010e74 _pformatter_switch
+80010e78 _pformatter_caseD_64
+80010fd4 _pformatter_caseD_58
+80011130 _pformatter_caseD_45
+800111a0 _pformatter_caseD_41
+80011210 _pformatter_caseD_73
+80011334 _pformatter_caseD_6e
+800113ec _pformatter_caseD_63
+8001140c _pformatter_caseD_25
+8001141c _pformatter_caseD_26
+80011620 __FileWrite
+80011678 __StringWrite
+800116e4 printf
+800117b0 vprintf
+8001182c vsnprintf
+800118b4 vsprintf
+80011938 snprintf
+80011a2c sprintf
+80011b00 qsort
+80011c70 rand
+80011c90 srand
+80011c98 parse_format
+80011f6c parse_format_switch
+80011f70 parse_format_caseD_58
+80011f88 parse_format_caseD_41
+80011fd0 parse_format_caseD_70
+80011fe4 parse_format_caseD_63
+80012010 parse_format_caseD_73
+800120c8 parse_format_caseD_5b
+800122b4 parse_format_caseD_42
+800122bc parse_format_caseD_6e
+80012320 __sformatter
+8001237c 0x8001237c
+800125a4 __sformatter_switch
+800125a8 __sformatter_caseD_64
+800125b0 __sformatter_caseD_69
+800126f0 __sformatter_switch
+800126f4 __sformatter_caseD_0
+800126fc __sformatter_caseD_1
+80012704 __sformatter_caseD_2
+8001270c __sformatter_caseD_3
+80012714 __sformatter_caseD_4
+80012728 __sformatter_caseD_5
+80012730 __sformatter_caseD_6
+80012738 __sformatter_caseD_7
+8001275c __sformatter_caseD_6f
+80012764 __sformatter_caseD_75
+8001276c __sformatter_caseD_58
+80012888 __sformatter_switch
+8001288c __sformatter_caseD_0
+80012894 __sformatter_caseD_1
+8001289c __sformatter_caseD_2
+800128a4 __sformatter_caseD_3
+800128ac __sformatter_caseD_4
+800128c0 __sformatter_caseD_5
+800128c8 __sformatter_caseD_6
+800128d0 __sformatter_caseD_7
+800128f4 __sformatter_caseD_41
+8001299c __sformatter_caseD_63
+80012b48 __sformatter_caseD_25
+80012bf0 __sformatter_caseD_73
+80012c94 __sformatter_caseD_5b
+80012efc __sformatter_caseD_6e
+80012f6c __sformatter_caseD_26
+80012fb8 __StringRead
+80013040 sscanf
+80013108 raise
+80013120 strcpy
+800131e0 strncpy
+80013224 strcat
+80013250 strncat
+8001329c strcmp
+800133b8 strncmp
+800133f8 strchr
+80013428 strcspn
+800134cc strtok
+800135f0 strstr
+8001365c __strtold
+80014990 atof
+800149ec __strtoul
+80014e00 __strtoull
+800152a8 strtoul
+80015350 strtol
+8001543c atoi
+80015500 __write_console
+800155d0 0x800155d0
+800155d8 fwide
+80015650 wmemcpy
+80015658 wmemchr
+80015680 parse_format
+800159d0 parse_format_switch
+800159d4 parse_format_caseD_58
+80015a18 parse_format_caseD_46
+80015a64 parse_format_caseD_41
+80015ab4 parse_format_caseD_47
+80015ac8 parse_format_caseD_45
+80015b1c parse_format_caseD_70
+80015b40 parse_format_caseD_63
+80015b7c parse_format_caseD_73
+80015bac parse_format_caseD_6e
+80015bc4 parse_format_caseD_42
+80015c10 long2str
+80015e54 longlong2str
+80016110 double2hex
+80016568 round_decimal
+80016690 float2str
+80016e1c __wpformatter
+80016e68 0x80016e68
+80016f2c __wpformatter_switch
+80016f30 __wpformatter_caseD_64
+8001708c __wpformatter_caseD_58
+800171e8 __wpformatter_caseD_45
+80017264 __wpformatter_caseD_41
+800172e0 __wpformatter_caseD_73
+8001748c __wpformatter_caseD_6e
+80017544 __wpformatter_caseD_63
+8001759c __wpformatter_caseD_25
+800175ac __wpformatter_caseD_26
+800177a8 __wStringWrite
+80017814 swprintf
+8001790c vswprintf
+80017998 wcslen
+800179b4 wcscpy
+800179d0 wcsncpy
+80017a14 wcscmp
+80017a48 wcschr
+80017a74 __ieee754_acos
+80017d40 __ieee754_asin
+80017fd8 __ieee754_atan2
+80018230 __ieee754_fmod
+80018560 __ieee754_log
+80018814 __ieee754_log10
+80018928 __ieee754_pow
+8001913c __ieee754_rem_pio2
+800194c0 __ieee754_sqrt
+80019708 __kernel_cos
+80019818 __kernel_rem_pio2
+8001aed0 __kernel_sin
+8001af90 __kernel_tan
+8001b1e0 nan
+8001b1e4 scalbn
+8001b1e8 atan
+8001b418 ceil
+8001b564 copysign
+8001b590 cos
+8001b658 floor
+8001b7a8 frexp
+8001b830 ldexp
+8001b99c modf
+8001ba98 sin
+8001bb64 tan
+8001bbdc acos
+8001bbe0 asin
+8001bbe4 atan2
+8001bbe8 fmod
+8001bbec log10
+8001bbf0 pow
+8001bbf4 sqrt
+8001bbf8 stricmp
+8001bc98 strncasecmp
+8001bc9c strcasecmp
+8001bd3c CBGetBytesAvailableForRead
+8001bd44 CircleBufferInitialize
+8001bd68 CircleBufferWriteBytes
+8001be70 CircleBufferReadBytes
+8001bf7c MWEnterCriticalSection
+8001bfac MWExitCriticalSection
+8001bfb4 gdev_cc_initialize
+8001bff0 0x8001bff0
+8001bff8 0x8001bff8
+8001c01c 0x8001c01c
+8001c024 gdev_cc_read
+8001c0d8 gdev_cc_write
+8001c14c gdev_cc_pre_continue
+8001c170 gdev_cc_post_stop
+8001c194 gdev_cc_peek
+8001c208 gdev_cc_initinterrupts
+8001c22c TRK_DispatchMessage
+8001c270 TRK_DispatchMessage_switch
+8001c274 TRK_DispatchMessage_caseD_1
+8001c284 TRK_DispatchMessage_caseD_2
+8001c294 TRK_DispatchMessage_caseD_3
+8001c2a4 TRK_DispatchMessage_caseD_7
+8001c2b4 TRK_DispatchMessage_caseD_10
+8001c2c4 TRK_DispatchMessage_caseD_11
+8001c2d4 TRK_DispatchMessage_caseD_12
+8001c2e4 TRK_DispatchMessage_caseD_13
+8001c2f4 TRK_DispatchMessage_caseD_18
+8001c304 TRK_DispatchMessage_caseD_19
+8001c314 TRK_DispatchMessage_caseD_1a
+8001c324 TRK_DispatchMessage_caseD_17
+8001c330 TRK_DispatchMessage_caseD_0
+8001c34c InitMetroTRK
+8001c3e4 InitMetroTRK_BBA
+8001c478 EnableMetroTRKInterrupts
+8001c47c TRKTargetTranslate
+8001c4e4 __TRK_copy_vectors
+8001c618 TRKInitializeTarget
+8001c660 __TRKreset
+8001c670 TRKLoadContext
+8001c6f8 TRKEXICallBack
+8001c730 InitMetroTRKCommTable
+8001c868 TRKUARTInterruptHandler
+8001c86c TRK_InitializeIntDrivenUART
+8001c8ec TRKPollUART
+8001c900 TRKReadUARTN
+8001c93c TRK_WriteUARTN
+8001c978 ReserveEXI2Port
+8001c98c UnreserveEXI2Port
+8001c9a0 0x8001c9a0
+8001c9b8 InitializeProgramEndTrap
+8001ca0c TRK_flush_cache
+8001ca44 TRK_main
+8001ca80 TRK_NubMainLoop
+8001cb6c TRK_memcpy
+8001cca8 TRK_memset
+8001cdd0 TRKSaveExtended1Block
+8001cf94 TRKRestoreExtended1Block
+8001d0f8 TRK_MessageSend
+8001d15c TRK_InitializeMessageBuffers
+8001d17c TRK_GetFreeBuffer
+8001d218 TRKGetBuffer
+8001d23c TRK_ReleaseBuffer
+8001d264 TRKResetBuffer
+8001d28c TRK_SetBufferPosition
+8001d2bc TRK_AppendBuffer
+8001d360 TRK_ReadBuffer
+8001d3f0 TRKAppendBuffer1_ui32
+8001d4c0 TRKAppendBuffer1_ui64
+8001d5b4 TRKAppendBuffer_ui8
+8001d618 TRKAppendBuffer_ui32
+8001d708 TRKReadBuffer1_ui64
+8001d7e8 TRKReadBuffer_ui8
+8001d880 TRKReadBuffer_ui32
+8001d968 GetTRKConnected
+8001d970 TRK_DoConnect
+8001d9e0 TRKDoDisconnect
+8001da68 TRKDoReset
+8001dad4 TRKDoOverride
+8001db40 TRKDoReadMemory
+8001dccc TRKDoReadMemory_switch
+8001dcd0 TRKDoReadMemory_caseD_702
+8001dcd8 TRKDoReadMemory_caseD_700
+8001dce0 TRKDoReadMemory_caseD_704
+8001dce8 TRKDoReadMemory_caseD_705
+8001dcf0 TRKDoReadMemory_caseD_706
+8001dcf8 TRKDoReadMemory_caseD_701
+8001dd74 TRKDoWriteMemory
+8001dedc TRKDoWriteMemory_switch
+8001dee0 TRKDoWriteMemory_caseD_702
+8001dee8 TRKDoWriteMemory_caseD_700
+8001def0 TRKDoWriteMemory_caseD_704
+8001def8 TRKDoWriteMemory_caseD_705
+8001df00 TRKDoWriteMemory_caseD_706
+8001df08 TRKDoWriteMemory_caseD_701
+8001df84 TRKDoReadRegisters
+8001e180 TRKDoWriteRegisters
+8001e420 TRKDoContinue
+8001e4e4 TRKDoStep
+8001e768 TRKDoStop
+8001e820 TRKDoSetOption
+8001e8ec __read_console
+8001e954 __TRK_write_console
+8001e9bc __read_file
+8001e9c4 __access_file
+8001e9cc 0x8001e9cc
+8001ea78 TRKDoNotifyStopped
+8001eb08 TRKInitializeEventQueue
+8001eb2c TRKGetNextEvent
+8001ebb8 TRKPostEvent
+8001ec84 TRKConstructEvent
+8001ec9c TRKDestructEvent
+8001eca4 TRK_InitializeNub
+8001ed50 TRK_TerminateNub
+8001ed74 TRK_board_display
+8001ed80 TRK_InitializeEndian
+8001edf4 TRKTestForPacket
+8001eec0 TRKGetInput
+8001eeec TRKProcessInput
+8001ef2c TRKInitializeSerialHandler
+8001ef34 TRKTerminateSerialHandler
+8001ef3c TRK_strlen
+8001ef58 TRK_SuppAccessFile
+8001f14c TRK_RequestSend
+8001f274 HandleOpenFileSupportRequest
+8001f38c HandleCloseFileSupportRequest
+8001f470 HandlePositionFileSupportRequest
+8001f57c TRKTargetContinue
+8001f5b0 SetUseSerialIO
+8001f5b8 GetUseSerialIO
+8001f5c0 __TRK_get_MSR
+8001f5c8 __TRK_set_MSR
+8001f5d0 TRKValidMemory32
+8001f6c8 TRK_ppc_memcpy
+8001f794 TRKTargetAccessMemory
+8001f8e4 TRKTargetAccessDefault
+8001f9dc TRKTargetAccessFP
+8001fb18 TRKTargetAccessExtended1
+8001fc7c TRKTargetAccessExtended2
+80020000 0x80020000
+8002001c 0x8002001c
+800200d4 TRKSwapAndGo
+800201ec TRKTargetInterrupt
+80020248 TRKTargetAddStopInfo
+8002037c TRKTargetAddExceptionInfo
+80020418 TRKTargetCheckStep
+80020534 TRKTargetSingleStep
+8002055c 0x8002055c
+800205b8 TRKTargetStepOutOfRange
+80020628 TRKTargetGetPC
+80020638 TRKTargetSupportRequest
+80020800 0x80020800
+8002082c TRKTargetStopped
+8002083c TRKTargetSetStopped
+8002084c TRKTargetStop
+80020864 TRKPPCAccessSPR
+80020940 TRKPPCAccessPairedSingleRegister
+800209e8 ReadFPSCR
+80020a0c WriteFPSCR
+80020a30 TRKPPCAccessFPRegister
+80020bf8 TRKPPCAccessSpecialReg
+80020c60 TRKTargetSetInputPendingPtr
+80020c70 GetThreadInfo
+80020d00 TRKAccessFile
+80020d08 0x80020d08
+80020d10 0x80020d10
+80020d18 0x80020d18
+80020d20 __sys_free
+80020dd8 __register_fragment
+80020e0c __unregister_fragment
+80020e34 __construct_new_array
+80020f38 __partial_array_destructor::__dt
+80020ff4 __construct_array
+800210ec __destroy_array
+80021164 __destroy_new_array
+800211e4 __init_cpp_exceptions
+80021220 __fini_cpp_exceptions
+80021254 strlen
+80021270 __va_arg
+80021338 __register__global_object
+80021350 __destroy__global_chain
+80021360 0x80021360
+8002137c 0x8002137c
+80021398 __register_atexit
+800213e4 __ptmf_test
+80021414 __ptmf_cmpr
+80021450 __ptmf_scall
+80021478 __cvt_fp2unsigned
+800214d4 __save_fpr
+800214f8 _save_fpr_23
+8002150c _save_fpr_28
+80021520 __restore_fpr
+80021544 _rest_fpr_23
+80021558 _rest_fpr_28
+8002156c _save_gpr_14
+80021570 _save_gpr_15
+80021574 _save_gpr_16
+80021578 _save_gpr_17
+8002157c _save_gpr_18
+80021580 _save_gpr_19
+80021584 _save_gpr_20
+80021588 _save_gpr_21
+8002158c _save_gpr_22
+80021590 _save_gpr_23
+80021594 _save_gpr_24
+80021598 _save_gpr_25
+8002159c _save_gpr_26
+800215a0 _save_gpr_27
+800215b8 _rest_gpr_14
+800215bc _rest_gpr_15
+800215c0 _rest_gpr_16
+800215c4 _rest_gpr_17
+800215c8 _rest_gpr_18
+800215cc _rest_gpr_19
+800215d0 _rest_gpr_20
+800215d4 _rest_gpr_21
+800215d8 _rest_gpr_22
+800215dc _rest_gpr_23
+800215e0 _rest_gpr_24
+800215e4 _rest_gpr_25
+800215e8 _rest_gpr_26
+800215ec _rest_gpr_27
+80021604 __div2u
+800216f0 __div2i
+80021828 __mod2u
+8002190c __mod2i
+80021a18 __shl2i
+80021a3c __shr2u
+80021a60 __cvt_ull_db
+80021b00 __cvt_dbl_ull
+80021ba8 0x80021ba8
+80021bb0 nw4r::db::DirectPrint_Init
+80021c70 nw4r::db::DirectPrint_IsActive
+80021ca0 nw4r::db::DirectPrint_EraseXfb
+80021e30 nw4r::db::DirectPrint_ChangeXfb
+80021e70 nw4r::db::DirectPrint_StoreCache
+80021e90 nw4r::db::DirectPrint_DrawString
+80021f80 nw4r::db::DrawStringToXfb
+800220e0 nw4r::db::DrawStringLineToXfb
+800221c0 nw4r::db::DrawCharToXfb
+80022480 nw4r::db::DirectPrint_SetupFB
+80022670 nw4r::db::RemoveConsoleFromList_
+80022720 nw4r::db::Console_Create
+800228d0 nw4r::db::Console_Destroy
+80022900 nw4r::db::DoDrawConsole_
+80022ab0 nw4r::db::Console_DrawDirect
+80022b30 nw4r::db::PrintToBuffer_
+80022ee0 nw4r::db::Console_VFPrintf
+80022fc0 nw4r::db::Console_Printf
+800230e0 nw4r::db::Console_GetTotalLines
+80023150 nw4r::db::Exception_Init
+80023240 nw4r::db::ErrorHandler_
+80023380 nw4r::db::RunThread_
+80023410 nw4r::db::DumpException_
+800235a0 nw4r::db::Exception_Printf_
+80023680 nw4r::db::PrintContext_
+80023980 nw4r::db::ShowMainInfo_
+80023bc0 nw4r::db::ShowGPRMap_
+80023c70 nw4r::db::ShowFloat_
+80024080 nw4r::db::Exception_SetConsole
+800240a0 nw4r::db::Exception_SetUserCallback
+800240c0 nw4r::db::DbgPrintBase::GetInstance
+800240d0 nw4r::db::DbgPrintBase::Initialize
+80024190 nw4r::db::DbgPrintBase::Initialize
+80024250 nw4r::db::DbgPrintBase::SetFont
+80024260 nw4r::db::DbgPrintBase::GetFont
+80024270 nw4r::db::DbgPrintBase::SetTextColor
+800242a0 nw4r::db::DbgPrintBase::GetTextColor
+800242d0 nw4r::db::DbgPrintBase::SetFontSize
+800242e0 nw4r::db::DbgPrintBase::GetFontSize
+800242f0 nw4r::db::DbgPrintBase::SetVisible
+80024300 nw4r::db::DbgPrintBase::IsVisible
+80024310 nw4r::db::DbgPrintBase::Registerf
+80024420 nw4r::db::DbgPrintBase::Registerf
+80024540 nw4r::db::DbgPrintBase::VRegisterf
+80024610 nw4r::db::DbgPrintBase::Register
+800246c0 nw4r::db::DbgPrintBase::Registf
+800247d0 nw4r::db::DbgPrintBase::Registf
+80024870 0x80024868
+800248f0 nw4r::db::DbgPrintBase::VRegistf
+800249c0 nw4r::db::DbgPrintBase::Reset
+800249d0 0x800249d0
+80024a70 nw4r::db::DbgPrintBase::Flush
+80024c10 nw4r::db::DbgPrintBase::Flush
+80024cd0 nw4r::db::DbgPrintBase::__ct
+80024d40 nw4r::db::DbgPrintBase::__dt
+80024d90 nw4r::db::DbgPrintBase::Unregister
+80024db0 0x80024db0
+80024df0 nw4r::db::DbgPrintBase::SetBuffer
+80024e20 nw4r::db::DbgPrintBase::ReleaseBuffer
+80024e80 nw4r::db::DbgPrintBase::Operator.new
+80024ed0 nw4r::db::DbgPrintBase::GetInstance
+80024ef0 nw4r::db::DbgPrintBase::Initialize
+80024fb0 nw4r::db::DbgPrintBase::Initialize
+80025070 nw4r::db::DbgPrintBase::SetFont
+80025080 nw4r::db::DbgPrintBase::GetFont
+80025090 nw4r::db::DbgPrintBase::SetTextColor
+800250c0 nw4r::db::DbgPrintBase::GetTextColor
+800250f0 nw4r::db::DbgPrintBase::SetFontSize
+80025100 nw4r::db::DbgPrintBase::GetFontSize
+80025110 nw4r::db::DbgPrintBase::SetVisible
+80025120 nw4r::db::DbgPrintBase::IsVisible
+80025130 nw4r::db::DbgPrintBase::Registerf
+80025240 nw4r::db::DbgPrintBase::Registerf
+80025360 nw4r::db::DbgPrintBase::VRegisterf
+80025430 nw4r::db::DbgPrintBase::Register
+800254e0 nw4r::db::DbgPrintBase::Registf
+800255f0 nw4r::db::DbgPrintBase::Registf
+80025710 nw4r::db::DbgPrintBase::VRegistf
+800257e0 nw4r::db::DbgPrintBase::Reset
+800257f0 0x800257f0
+80025890 nw4r::db::DbgPrintBase::Flush
+800259d0 0x800259d0
+80025a30 nw4r::db::DbgPrintBase::Flush
+80025af0 nw4r::db::DbgPrintBase::__ct
+80025b60 nw4r::db::DbgPrintBase::__dt
+80025bb0 nw4r::db::DbgPrintBase::Unregister
+80025bd0 0x80025bd0
+80025c10 nw4r::db::DbgPrintBase::SetBuffer
+80025c40 nw4r::db::DbgPrintBase::ReleaseBuffer
+80025ca0 nw4r::db::DbgPrintBase::Operator.new
+80025cf0 nw4r::db::DbgPrintBase::Operator.delete
+80025d00 nw4r::db::Assertion_Printf_
+80025dc0 PrintExceptionTrace
+80025e70 nw4r::db::VPanic
+80025fb0 nw4r_db_Panic
+80026050 nw4r::db::VWarning
+80026200 nw4r::db::WarningAlarmFunc_
+80026220 nw4r::ef::DrawOrder::Draw
+800262b0 nw4r::ef::DrawOrder::Add
+80026330 nw4r::ef::DrawOrder::Remove
+80026340 nw4r::ef::Effect::__ct
+800263b0 nw4r::ef::Effect::__dt
+80026410 nw4r::ef::Effect::Initialize
+80026550 nw4r::ef::Effect::Closing
+80026560 0x80026560
+80026570 0x80026570
+80026680 nw4r::ef::Effect::CreateEmitter
+80026780 nw4r::ef::Effect::RetireEmitter
+80026810 nw4r::ef::Effect::RetireEmitterAll
+800268e0 nw4r::ef::Effect::RetireParticleAll
+80026970 nw4r::ef::Effect::Calc
+80026d60 nw4r::ef::Effect::Draw
+80026d90 nw4r::ef::Effect::GetRootEmitter
+80026da0 nw4r::ef::Effect::GetNumEmitter
+80026db0 nw4r::ef::Effect::GetEmitter
+80026dc0 nw4r::ef::Effect::ForeachParticleManager
+80026e50 nw4r::ef::Effect::ForeachEmitterFrom
+80026f30 nw4r::ef::Effect::SetRootMtx
+80026fa0 nw4r::ef::Effect::CreateEmitter
+800270a0 nw4r::ef::EffectSystem::__dt
+80027130 nw4r::ef::EffectSystem::GetInstance
+80027140 nw4r::ef::EffectSystem::Initialize
+80027250 nw4r::ef::ActivityList::__ct
+800272a0 nw4r::ef::EffectSystem::Closing
+80027310 nw4r::ef::EffectSystem::CreateEffect(name)
+80027380 nw4r::ef::EffectSystem::CreateEffect(res)
+800274b0 nw4r::ef::EffectSystem::RetireEffectAll
+800275a0 nw4r::ef::EffectSystem::RetireEmitterAll
+80027630 nw4r::ef::EffectSystem::RetireParticleAll
+800276c0 nw4r::ef::EffectSystem::Draw
+80027750 nw4r::ef::EffectSystem::SetProcessCamera
+800277e0 nw4r::ef::Swap
+80027830 nw4r::ef::EffectSystem::SortEffect
+800279b0 nw4r::ef::EffectSystem::SortEffectOperatorZ
+80027ab0 __sinit_\ef_effectsystem_cpp
+80027be0 nw4r::ef::Emitter::__ct
+80027c40 nw4r::ef::Emitter::__dt
+80027c80 nw4r::ef::Emitter::RetireParticleAll
+80027d10 nw4r::ef::Emitter::DestroyFunc
+80027d20 0x80027d20
+80027e10 nw4r::ef::Emitter::Closing
+80027ec0 nw4r::ef::Emitter::RetireParticleManagerAll
+80027f90 nw4r::ef::Emitter::InitializeDatas
+80028260 nw4r::ef::Emitter::Initialize
+800283d0 nw4r::ef::Emitter::CreateEmitter
+800286b0 nw4r::ef::Emitter::CreateEmitterTmp
+80028d90 nw4r::ef::GetLODratio
+80028e90 nw4r::ef::Emitter::Emission
+800292e0 nw4r::ef::Emitter::CalcEmitter
+800294a0 nw4r::ef::Emitter::CalcParticle
+80029530 nw4r::ef::Emitter::CalcEmission
+80029650 nw4r::ef::Emitter::CalcBillboard
+80029830 nw4r::ef::Emitter::RestructMatrix
+80029a60 nw4r::ef::Emitter::CalcGlobalMtx
+80029bb0 nw4r::ef::Emitter::SetMtxDirty
+80029cc0 nw4r::ef::Emitter::GetNumParticleManager
+80029cd0 nw4r::ef::Emitter::GetParticleManager
+80029ce0 nw4r::ef::ForeachParticleManagerSub
+80029d30 nw4r::ef::Emitter::ForeachParticleManager
+80029e20 nw4r::ef::AnimCurveExecuteU8
+8002b100 nw4r::ef::AnimCurveExecuteF32
+8002c0b0 nw4r::ef::AnimCurveExecuteRotate
+8002d160 nw4r::ef::AnimCurveExecuteTexture
+8002d730 nw4r::ef::CreateChild
+8002d8a0 nw4r::ef::AnimCurveExecuteChild
+8002e660 nw4r::ef::AnimBakedExecuteU8
+8002e9b0 nw4r::ef::AnimBakedExecuteF32
+8002ed00 nw4r::ef::GetTypePositionSphere
+8002ee20 nw4r::ef::GetTypePositionCube
+8002ef00 nw4r::ef::GetTypePositionCylinder
+8002efd0 nw4r::ef::GetTypePositionCircle
+8002f0e0 nw4r::ef::GetTypePositionRectangle
+8002f1d0 nw4r::ef::GetTypePositionPlane
+8002f280 nw4r::ef::CrossCheckPlane
+8002f720 nw4r::ef::CrossCheckRectangle
+8002fcc0 nw4r::ef::CrossCheckCircle
+80030250 nw4r::ef::CrossCheckSphere
+80030890 nw4r::ef::CrossCheckCylinder
+80031080 nw4r::ef::CrossCheckCube
+800317c0 nw4r::ef::CrossCheck
+80031be0 nw4r::ef::CalcPostField
+80032440 nw4r::ef::Particle::__ct
+80032450 nw4r::ef::Particle::__dt
+80032490 nw4r::ef::Particle::SendClosing
+800324a0 nw4r::ef::Particle::DestroyFunc
+800324b0 nw4r::ef::ParticleParameter::Initialize
+800327d0 nw4r::ef::Particle::Initialize
+800331f0 nw4r::ef::Particle::GetAlphaFlick
+80033430 nw4r::ef::ParticleManager::__ct
+80033490 nw4r::ef::ParticleManager::SendClosing
+800334a0 nw4r::ef::ParticleManager::DestroyFunc
+800334b0 nw4r::ef::ParticleManager::Closing
+80033540 nw4r::ef::ParticleManager::RetireParticleAll
+800335f0 nw4r::ef::ParticleManager::Initialize
+80033740 nw4r::ef::ParticleManager::__dt
+80033780 nw4r::ef::ParticleManager::CreateParticle
+800338b0 nw4r::ef::ParticleManager::Calc
+80034f80 nw4r::ef::ParticleManager::Draw
+80035260 nw4r::ef::ParticleManager::CalcGlobalMtx
+80035340 nw4r::ef::ParticleManager::BeginCalc
+800353b0 nw4r::ef::ParticleManager::EndCalc
+80035400 nw4r::ef::ParticleManager::BeginDraw
+80035500 nw4r::ef::ParticleManager::EndDraw
+80035510 nw4r::ef::ParticleManager::Draw_ModifyColor
+80035930 __sinit_\ef_particlemanager_cpp
+80035940 nw4r::ef::Resource::GetInstance
+80035950 nw4r::ef::BreffRelocate
+80035ac0 nw4r::ef::BreffSearchName
+80035b80 nw4r::ef::BreffIndexOf
+80035c20 nw4r::ef::BreftRelocate
+80035cb0 nw4r::ef::BreftSearchName
+80035d70 nw4r::ef::Resource::Add
+80035df0 nw4r::ef::Resource::FindEmitter
+80035eb0 nw4r::ef::Resource::FindEmitter
+80035f60 nw4r::ef::Resource::AddTexture
+80035fe0 nw4r::ef::Resource::RelocateCurveTexture
+80036100 nw4r::ef::Resource::RelocateCurveChild
+80036200 nw4r::ef::Resource::RelocateCommand
+80036440 nw4r::ef::Resource::RemoveEffectProject
+800364e0 nw4r::ef::Resource::RemoveTextureProject
+80036580 __sinit_\ef_resource_cpp
+800365d0 nw4r::ef::UtlistToArray
+80036660 nw4r::ef::GetDirMtxY
+80036770 nw4r::ef::MtxGetRotationMtx
+80036890 nw4r::ef::MtxGetRotation
+80036a00 nw4r::ef::MtxGetTranslate
+80036a20 nw4r::ef::MtxGetScale
+80036f00 nw4r::ef::Normalize
+80036f70 nw4r::ef::_PSSinCosRad
+80036ff0 nw4r::ef::PSSinCosRad
+80037070 nw4r::ef::Rotation2VecY
+800371c0 nw4r::ef::PSMTX34RotXYZRad
+80037340 nw4r::ef::MTX34ScaleNonZero
+800373c0 nw4r::ef::MTX34ScaleNonZero
+80037450 nw4r::ef::MTX34ScaleInv
+80037500 nw4r::ef::MTXColLen
+80037560 nw4r::ef::HandleBase::__ct
+80037570 nw4r::ef::HandleBase::Operator=(HandleBase)
+80037590 nw4r::ef::HandleBase::Operator=(LinkedObject)
+800375c0 nw4r::ef::HandleBase::IsValid
+800375f0 nw4r::ef::HandleBase::GetPtr
+80037630 nw4r::ef::EmitterForm::CalcVelocity
+80037b00 nw4r::ef::EmitterForm::CalcLife
+80037be0 nw4r::ef::CreationQueue::__ct
+80037bf0 nw4r::ef::CreationQueue::AddParticleCreation
+80037d70 nw4r::ef::CreationQueue::AddEmitterCreation
+80037ef0 nw4r::ef::CreationQueue::Execute
+80038030 nw4r::ef::EmitFormBuilder::Create
+800380b0 __sinit_\ef_emform_cpp
+80038110 nw4r::ef::EmitterFormPoint::Emission
+80038460 nw4r::ef::EmitterFormLine::Emission
+800387a0 nw4r::ef::EmitterFormDisc::Emission
+80038cd0 nw4r::ef::EmitterFormSphere::Emission
+80039530 nw4r::ef::EmitterFormCylinder::EmissionSub
+80039990 nw4r::ef::EmitterFormCylinder::Emission
+80039ce0 nw4r::ef::EmitterFormTorus::Emission
+8003a320 nw4r::ef::EmitterFormCube::EmissionSub
+8003a660 nw4r::ef::EmitterFormCube::Emission
+8003bf30 nw4r::ef::DrawStrategyBuilder::Create
+8003c0b0 nw4r::ef::DrawStrategyImpl::__ct
+8003c3c0 nw4r::ef::DrawStrategyImpl::Initialize
+8003c4a0 nw4r::ef::DrawStrategyImpl::_InitTev
+8003c790 nw4r::ef::DrawStrategyImpl::_InitColor
+8003cb60 nw4r::ef::DrawStrategyImpl::SetupGP
+8003d000 nw4r::ef::DrawStrategyImpl::_SetupTevReg
+8003d830 nw4r::ef::DrawStrategyImpl::_SetupTexture
+8003dea0 nw4r::ef::DrawStrategyImpl::GetGetFirstDrawParticle
+8003dec0 nw4r::ef::DrawStrategyImpl::GetGetNextDrawParticle
+8003dee0 nw4r::ef::DrawStrategyImpl::GetFirstDrawParticle_EldersFirst
+8003df10 nw4r::ef::DrawStrategyImpl::GetFirstDrawParticle_YoungersFirst
+8003df60 nw4r::ef::DrawStrategyImpl::GetNextDrawParticle_EldersFirst
+8003df90 nw4r::ef::DrawStrategyImpl::GetNextDrawParticle_YoungersFirst
+8003dfc0 nw4r::ef::DrawStrategyImpl::AheadContext::__ct
+8003e1e0 nw4r::ef::DrawStrategyImpl::__dt
+8003e220 __sinit_\ef_drawstrategyimpl_cpp
+8003e2b0 nw4r::ef::DrawBillboardStrategy::__ct
+8003e2f0 nw4r::ef::DrawBillboardStrategy::Draw
+8003e330 nw4r::ef::DrawBillboardStrategy::DrawNormalBillboard
+8003edf0 nw4r::ef::DrawBillboardStrategy::DrawYBillboard
+8003f720 nw4r::ef::DrawBillboardStrategy::DrawDirectionalB
+8003ffb0 nw4r::ef::DrawBillboardStrategy::InitGraphics
+80040080 nw4r::ef::DrawBillboardStrategy::GetCalcAheadFunc
+80040100 nw4r::ef::DrawStrategyImpl::CalcAhead_Speed
+800401e0 nw4r::ef::DrawStrategyImpl::CalcAhead_EmitterCent
+800402a0 nw4r::ef::DrawStrategyImpl::CalcAhead_EmitterDesi
+800402c0 nw4r::ef::DrawStrategyImpl::CalcAhead_Particle
+800403e0 nw4r::ef::DrawStrategyImpl::CalcAhead_ParticleBot
+80040650 nw4r::ef::DrawBillboardStrategy::__dt
+80040690 nw4r::ef::DrawDirectionalStrategy::DrawDirectiona
+800406d0 nw4r::ef::DrawQuad
+80040810 nw4r::math::VEC3::__ct
+80040820 nw4r::math::VEC3Transform
+80040860 0x80040860
+80040870 nw4r::ef::DrawQuad
+80040a10 nw4r::ef::DrawDirectionalStrategy::Draw
+80040b20 nw4r::ef::EmitterResource::GetEmitterDrawSetting
+80040b30 nw4r::ef::DrawDirectionalStrategy::DrawDirectiona
+800418b0 nw4r::math::MTX34::__ct
+800418c0 nw4r::ef::DrawInfo::GetViewMtxCooked
+80041a90 nw4r::math::MTX34Mult
+80041ad0 nw4r::math::VEC3::Operator=
+80041af0 nw4r::math::VEC3::__ct
+80041b00 nw4r::ef::DrawStrategyImpl::Normalize
+80041b70 nw4r::math::VEC3Dot
+80041b90 nw4r::ef::DrawStrategyImpl::GetYoungestParticle
+80041ba0 nw4r::ef::DrawStrategyImpl::GetElderParticle
+80041bb0 nw4r::ef::Particle::Draw_GetSizeX
+80041c30 nw4r::ef::Particle::Draw_GetSizeY
+80041d10 nw4r::ef::Particle::GetMoveDir
+80041d60 nw4r::math::FSqrt
+80041db0 nw4r::ef::CalcRotate
+80042120 nw4r::math::MTX34::__ct
+80042170 nw4r::ef::CalcLocalTransform
+80042370 nw4r::math::VEC3Cross
+800423b0 nw4r::ef::DrawDirectionalStrategy::DrawDirectiona
+800429f0 nw4r::ef::DrawDirectionalStrategy::InitGraphics
+80042ab0 nw4r::ef::DrawDirectionalStrategy::GetCalcAheadFu
+80042b40 nw4r::ef::DrawStrategyImpl::CalcAhead_NoDesign
+80042b70 nw4r::ef::DrawDirectionalStrategy::~DrawDirection
+80042bb0 nw4r::ef::DrawFreeStrategy::__ct
+80042bf0 nw4r::ef::DrawQuad
+80042d30 nw4r::ef::DrawFreeStrategy::Draw
+80043670 nw4r::ef::DrawFreeStrategy::__dt
+800436b0 nw4r::ef::DrawLineStrategy::__ct
+800436f0 nw4r::ef::DrawLineStrategy::Draw
+80043d70 nw4r::ef::DrawLineStrategy::__dt
+80043db0 nw4r::ef::DrawPointStrategy::__ct
+80043df0 nw4r::ef::DrawPointStrategy::Draw
+80044290 nw4r::ef::DrawPointStrategy::__dt
+800442d0 nw4r::ef::DrawStripeStrategy::__ct
+80044310 nw4r::ef::DrawStripeStrategy::DrawStripe
+80044650 nw4r::ef::DrawStrategyImpl::GetNumDrawParticle
+80044660 nw4r::ef::DrawStripeStrategy::GetStripeTexmapType
+80044670 nw4r::math::FInv
+80044690 nw4r::ef::DrawStripeStrategy::DrawParticle
+80044b30 GXEnd
+80044b40 nw4r::ef::DrawStripeStrategy::CalcVertexTube
+80045040 nw4r::ef::DrawStripeStrategy::DrawTubeSegment
+80045420 nw4r::ef::DrawStripeStrategy::DrawStripeTube_Conn
+800456e0 nw4r::ef::DrawStripeStrategy::DrawStripeTube_Conn
+80045a20 nw4r::ef::DrawStripeStrategy::DrawStripeTube_Conn
+80045de0 nw4r::ef::DrawStripeStrategy::DrawStripeTube
+80045fd0 nw4r::ef::DrawStripeStrategy::Draw
+80046840 nw4r::ef::DrawStripeStrategy::GetInitialPrevAxis
+80046990 nw4r::ef::DrawStripeStrategy::GetCalcAheadFunc
+80046a40 0x80046a3c
+80046a50 0x80046a48
+80046a60 nw4r::ef::DrawStripeStrategy::CalcAhead_Particle_
+80046b80 nw4r::ef::DrawStripeStrategy::CalcAhead_ParticleB
+80046df0 nw4r::ef::DrawStripeStrategy::CalcAhead_ParticleB
+800470b0 nw4r::ef::DrawStripeStrategy::CalcAhead_ParticleB
+800472e0 nw4r::ef::DrawStripeStrategy::__dt
+80047320 nw4r::ef::DrawSmoothStripeStrategy::DrawSmoothStr
+80047360 nw4r::ef::DrawSmoothStripeStrategy::CalcVertex
+80047750 nw4r::ef::DrawSmoothStripeStrategy::CalcVertexTub
+80047c50 nw4r::ef::DrawSmoothStripeStrategy::DrawSection_B
+80047f20 nw4r::math::VEC3::Operator+
+80047f50 nw4r::ef::DrawSmoothStripeStrategy::DrawSectionEn
+80048170 nw4r::ef::DrawSmoothStripeStrategy::DrawSectionTu
+80048c30 GXEnd
+80048c40 nw4r::ef::DrawSmoothStripeStrategy::DrawSmoothStr
+80048f90 nw4r::ef::DrawSmoothStripeStrategy::GetDrawOrder
+80048fa0 nw4r::ef::DrawSmoothStripeStrategy::GetStripeTexm
+80048fb0 nw4r::ef::DrawSmoothStripeStrategy::Vertex::Verte
+80048fc0 nw4r::ef::DrawSmoothStripeStrategy::DrawSmoothStr
+800493e0 nw4r::ef::DrawSmoothStripeStrategy::DrawSmoothStr
+800495d0 0x800495c8
+80049880 nw4r::ef::DrawStrategyImpl::GetYoungestDrawPartic
+800498d0 nw4r::math::VEC3::Operator-
+80049900 nw4r::math::VEC3::Operator+=
+80049930 nw4r::ef::DrawSmoothStripeStrategy::Vertex::Verte
+80049970 nw4r::ef::DrawSmoothStripeStrategy::Vertex::Opera
+800499b0 nw4r::ef::DrawSmoothStripeStrategy::DrawSmoothStr
+80049cb0 nw4r::ef::DrawSmoothStripeStrategy::DrawSmoothStr
+8004a060 nw4r::ef::DrawSmoothStripeStrategy::DrawSmoothStr
+8004a5e0 nw4r::ef::DrawSmoothStripeStrategy::DrawSmoothStr
+8004a7f0 nw4r::ef::DrawSmoothStripeStrategy::Draw
+8004b1a0 nw4r::ef::DrawSmoothStripeStrategy::GetInitialPre
+8004b2f0 nw4r::ef::DrawSmoothStripeStrategy::GetCalcAheadF
+8004b3a0 0x8004b39c
+8004b3b0 0x8004b3a8
+8004b3c0 nw4r::ef::DrawSmoothStripeStrategy::CalcAhead_Par
+8004b4e0 nw4r::ef::DrawSmoothStripeStrategy::CalcAhead_Par
+8004b750 nw4r::ef::DrawSmoothStripeStrategy::CalcAhead_Par
+8004ba10 nw4r::ef::DrawSmoothStripeStrategy::CalcAhead_Par
+8004bc40 nw4r::ef::DrawSmoothStripeStrategy::~DrawSmoothSt
+8004bc80 nw4r::ef::ResEmitter::GetEmitTrack
+8004bcb0 nw4r::ef::ResAnimCurve::SetStop
+8004bce0 nw4r::g3d::ResName::Operator==
+8004bd30 nw4r::g3d::detail::ResWriteBPCmd
+8004bd60 nw4r::g3d::detail::ResWriteBPCmd
+8004bdc0 nw4r::g3d::detail::ResWriteCPCmd
+8004bdf0 nw4r::g3d::detail::ResWriteXFCmd
+8004be30 nw4r::g3d::detail::ResWriteSSMask
+8004be90 nw4r::g3d::ResDic::Get
+8004bf70 nw4r::g3d::ResDic::Get
+8004c050 ResDic_operator[]
+8004c0d0 ResDic_operator[]
+8004c140 nw4r::g3d::ResDic::GetIndex
+8004c1d0 nw4r::g3d::ResDic::GetIndex
+8004c240 nw4r::g3d::ResFile::GetResMdl(name)
+8004c2b0 nw4r::g3d::ResFile::GetResMdl(idx)
+8004c350 nw4r::g3d::ResFile::GetResMdl(u32 idx)
+8004c3f0 nw4r::g3d::ResFile::GetResMdlNumEntries
+8004c460 nw4r::g3d::ResFile::GetResPltt
+8004c4e0 nw4r::g3d::ResFile::GetResTex
+8004c550 nw4r::g3d::ResFile::GetResTex
+8004c5d0 nw4r::g3d::ResFile::GetResTex(idx)
+8004c670 nw4r::g3d::ResFile::GetResTex(u32 idx)
+8004c710 nw4r::g3d::ResFile::GetResTexNumEntries
+8004c780 nw4r::g3d::ResFile::GetResAnmChr(name)
+8004c7f0 nw4r::g3d::ResFile::GetResAnmChr(ResName)
+8004c890 nw4r::g3d::ResFile::GetResAnmChrNumEntries
+8004c900 nw4r::g3d::ResFile::GetResAnmClr(name)
+8004c970 nw4r::g3d::ResFile::GetResAnmClr(ResName)
+8004ca10 nw4r::g3d::ResFile::GetResAnmClrNumEntries
+8004ca80 nw4r::g3d::ResFile::GetResAnmTexPat(name)
+8004caf0 nw4r::g3d::ResFile::GetResAnmTexPat(ResName)
+8004cb90 nw4r::g3d::ResFile::GetResAnmTexPatNumEntries
+8004cc00 nw4r::g3d::ResFile::GetResAnmTexSrt(name)
+8004cc70 nw4r::g3d::ResFile::GetResAnmTexSrt(ResName)
+8004cd10 nw4r::g3d::ResFile::GetResAnmTexSrtNumEntries
+8004cd80 nw4r::g3d::ResFile::GetResAnmShp(name)
+8004cdf0 nw4r::g3d::ResFile::GetResAnmShp(ResName)
+8004ce90 nw4r::g3d::ResFile::GetResAnmShpNumEntries
+8004cf00 nw4r::g3d::ResFile::GetResAnmScn
+8004cf70 nw4r::g3d::ResFile::HasResMdl
+8004cfc0 nw4r::g3d::ResFile::HasResAnmChr
+8004d010 nw4r::g3d::ResFile::HasResAnmVis
+8004d060 nw4r::g3d::ResFile::HasResAnmClr
+8004d0b0 nw4r::g3d::ResFile::HasResAnmTexPat
+8004d100 nw4r::g3d::ResFile::HasResAnmTexSrt
+8004d150 nw4r::g3d::ResFile::HasResAnmShp
+8004d1a0 nw4r::g3d::ResFile::HasResAnmScn
+8004d1f0 nw4r::g3d::ResFile::Bind
+8004d430 nw4r::g3d::ResFile::Release
+8004d630 nw4r::g3d::ResFile::Init
+8004d900 nw4r::g3d::ResFile::CheckRevision
+8004e250 nw4r::g3d::ResMdl::GetResByteCode
+8004e2a0 nw4r::g3d::ResMdl::GetResNode(name)
+8004e2f0 nw4r::g3d::ResMdl::GetResNode(ResName)
+8004e340 nw4r::g3d::ResMdl::GetResNode(idx)
+8004e3a0 nw4r::g3d::ResMdl::GetResNode(u32 idx)
+8004e400 nw4r::g3d::ResMdl::GetResNodeNumEntries
+8004e440 nw4r::g3d::ResMdl::GetResVtxPos
+8004e490 nw4r::g3d::ResMdl::GetResVtxPos
+8004e4f0 nw4r::g3d::ResMdl::GetResVtxPos
+8004e550 nw4r::g3d::ResMdl::GetResVtxPosNumEntries
+8004e590 nw4r::g3d::ResMdl::GetResVtxNrm
+8004e5e0 nw4r::g3d::ResMdl::GetResVtxNrm
+8004e640 nw4r::g3d::ResMdl::GetResVtxNrm
+8004e6a0 nw4r::g3d::ResMdl::GetResVtxNrmNumEntries
+8004e6e0 nw4r::g3d::ResMdl::GetResVtxClr
+8004e730 nw4r::g3d::ResMdl::GetResVtxClr
+8004e790 nw4r::g3d::ResMdl::GetResVtxClr
+8004e7f0 nw4r::g3d::ResMdl::GetResVtxClrNumEntries
+8004e830 nw4r::g3d::ResMdl::GetResVtxTexCoord
+8004e890 nw4r::g3d::ResMdl::GetResVtxFurPos
+8004e8f0 nw4r::g3d::ResMdl::GetResMat(name)
+8004e940 nw4r::g3d::ResMdl::GetResMat(resname)
+8004e990 nw4r::g3d::ResMdl::GetResMat(idx)
+8004e9f0 nw4r::g3d::ResMdl::GetResMat(u32 idx)
+8004ea50 nw4r::g3d::ResMdl::GetResMatNumEntries
+8004ea90 nw4r::g3d::ResMdl::GetResShp
+8004eaf0 nw4r::g3d::ResMdl::GetResShp
+8004eb50 nw4r::g3d::ResMdl::GetResShpNumEntries
+8004eb90 nw4r::g3d::ResMdl::GetResTexPlttInfoOffsetFromTexName
+8004ebf0 nw4r::g3d::ResMdl::GetResTexPlttInfoOffsetFromTexNameNumEntries
+8004ec30 nw4r::g3d::ResMdl::Bind
+8004ed40 nw4r::g3d::ResMdl::Release
+8004ee30 nw4r::g3d::ResMdl::Init
+8004f3d0 nw4r::g3d::ResShp::GetResVtxPos
+8004f420 nw4r::g3d::ResShp::GetResVtxNrm
+8004f480 nw4r::g3d::ResShp::GetResVtxClr
+8004f4f0 nw4r::g3d::ResShp::GetResVtxFurPos
+8004f550 nw4r::g3d::ResShp::Init
+8004f710 0x8004f70c
+8004f8e0 nw4r::g3d::ResShp::CallPrePrimitiveDisplayList
+8004f9c0 0x8004f9c0
+8004fa30 nw4r::g3d::ResTev::GXSetTevSwapModeTable
+8004fae0 nw4r::g3d::ResTev::GXSetTevSwapMode
+8004fb40 nw4r::g3d::ResTev::GXSetTevAlphaIn
+8004fbd0 nw4r::g3d::ResTev::GXSetTevAlphaOp
+8004fc80 nw4r::g3d::ResTev::GXSetTevKColorSel
+8004fd10 nw4r::g3d::ResTev::GXSetTevKAlphaSel
+8004fda0 nw4r::g3d::ResTev::GXGetTevOrder
+8004fe70 nw4r::g3d::ResTev::GXSetTevOrder
+8004ff90 nw4r::g3d::ResTev::GXGetTevColorOp
+80050070 nw4r::g3d::ResTev::GXSetTevColorIn
+80050100 nw4r::g3d::ResTev::GXSetTevColorOp
+800501b0 nw4r::g3d::ResTev::GXGetIndTexOrder
+80050250 nw4r::g3d::ResTev::SetNumTevStages
+80050340 nw4r::g3d::ResTev::CallDisplayList
+800503a0 nw4r::g3d::ResTev::CopyTo
+80050410 nw4r::g3d::ResTev::DCStore
+80050430 nw4r::g3d::ResMat::GetParent
+80050450 nw4r::g3d::ResMatPix::DCStore
+80050470 nw4r::g3d::ResMatTevColor::DCStore
+80050490 nw4r::g3d::ResMatIndMtxAndScale::DCStore
+800504b0 nw4r::g3d::ResMatTexCoordGen::DCStore
+800504d0 0x800504d0
+80050500 0x80050500
+80050530 nw4r::g3d::ResMatPix::CopyTo
+80050570 nw4r::g3d::ResMatTevColor::CopyTo
+800505b0 nw4r::g3d::ResMatIndMtxAndScale::CopyTo
+800505f0 nw4r::g3d::ResMatTexCoordGen::CopyTo
+80050630 nw4r::g3d::ResTexObj::GetTexObj
+80050660 nw4r::g3d::ResTexObj::GetTexObj
+80050690 nw4r::g3d::ResTexObj::IsValidTexObj
+800506d0 SetTextureUsed
+80050700 nw4r::g3d::ResTexObj::CopyTo
+80050790 nw4r::g3d::ResTlutObj::GetTlut
+800507c0 nw4r::g3d::ResTlutObj::GetTlut
+800507f0 nw4r::g3d::ResTlutObj::IsValidTlut
+80050830 nw4r::g3d::ResTlutObj::CopyTo
+800508c0 nw4r::g3d::ResTexSrt::CopyTo
+800509a0 0x800509a0
+80050a20 0x80050a20
+80050a70 0x80050a70
+80050af0 nw4r::g3d::ResGenMode::GXSetNumTexGens
+80050b10 nw4r::g3d::ResGenMode::GXSetNumTexStages
+80050b30 nw4r::g3d::ResGenMode::GXSetCullMode
+80050b50 nw4r::g3d::ResGenMode::CopyTo
+80050b90 nw4r::g3d::ResMatMisc::GXGetZCompLoc
+80050bb0 nw4r::g3d::ResMatMisc::SetLightSetIdx
+80050be0 nw4r::g3d::ResMatMisc::GetLightSetIdx
+80050c00 nw4r::g3d::ResMatMisc::GetFogIdx
+80050c20 nw4r::g3d::ResMatMisc::GetIndirectTexMtxCalcMetho
+80050c70 nw4r::g3d::ResMatMisc::CopyTo
+80050ce0 nw4r::g3d::ResMatFur::GetLyrRate
+80050da0 nw4r::g3d::ResMatPix::GXSetZMode
+80050dc0 nw4r::g3d::ResMatPix::GXSetDstAlpha
+80050de0 nw4r::g3d::ResMatTevColor::GXGetTevColor
+80050ea0 nw4r::g3d::ResMatTevColor::GXSetTevColor
+80050f40 nw4r::g3d::ResMatTevColor::GXGetTevKColor
+80051000 nw4r::g3d::ResMatTevColor::GXSetTevKColor
+80051090 nw4r::g3d::ResMatIndMtxAndScale::CallDisplayList
+800510d0 nw4r::g3d::ResMatIndMtxAndScale::GXGetIndTexMtx
+80051390 nw4r::g3d::ResMatIndMtxAndScale::GXGetIndTexMtx
+80051580 nw4r::g3d::ResMatIndMtxAndScale::GXSetIndTexMtx
+800516f0 nw4r::g3d::ResMatChan::GXGetChanMatColor
+80051730 nw4r::g3d::ResMatChan::GXGetChanCtrl
+800517f0 nw4r::g3d::ResMatChan::CopyTo
+80051850 nw4r::g3d::ResMatTexCoordGen::CallDisplayList
+80051920 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2
+80051ad0 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2
+80051b34 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_switch
+80051b38 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_0
+80051b44 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_1
+80051b50 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_2
+80051b5c nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_3
+80051b68 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_13
+80051b70 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_14
+80051b78 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_4
+80051b80 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_5
+80051b88 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_6
+80051b90 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_7
+80051b98 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_8
+80051ba0 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_9
+80051ba8 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_a
+80051bb0 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_b
+80051bb8 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_c
+80051bc0 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_d
+80051bc8 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_e
+80051bd0 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_f
+80051bd8 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_10
+80051be0 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_11
+80051be8 nw4r::g3d::ResMatTexCoordGen::GXGetTexCoordGen2_caseD_12
+80051c40 0x80051c3c
+80051cd0 nw4r::g3d::ResMat::Bind
+80051da0 nw4r::g3d::ResMat::Release
+80051e40 nw4r::g3d::ResMat::ForceBindTex
+80052090 nw4r::g3d::ResMat::ReleaseTex
+80052190 nw4r::g3d::ResMat::Init
+800521c0 nw4r::g3d::ResMat::GetResTev
+800521e0 nw4r::g3d::ResMat::GetResMatFur
+80052200 nw4r::g3d::ResTexPlttInfo::Bind
+800524c0 nw4r::g3d::ResVtxPos::SetArray
+80052500 nw4r::g3d::ResVtxPos::GetArray
+80052540 nw4r::g3d::ResVtxPos::CopyTo
+800525a0 0x800525a0
+800525e0 0x800525e0
+80052620 nw4r::g3d::ResVtxNrm::CopyTo
+80052680 0x80052680
+800526c0 nw4r::g3d::ResVtxClr::GetArray
+80052700 nw4r::g3d::ResVtxClr::CopyTo
+80052760 0x80052760
+800527a0 0x800527a0
+80052820 nw4r::g3d::ResVtxPos::DCStore
+80052840 nw4r::g3d::ResVtxNrm::DCStore
+80052860 nw4r::g3d::ResVtxClr::DCStore
+80052880 nw4r::g3d::ResVtxTexCoord::DCStore
+800528a0 nw4r::g3d::ResVtxFurVec::DCStore
+800528c0 nw4r::g3d::ResVtxFurPos::DCStore
+800528e0 0x800528e0
+80052900 0x80052900
+80052930 nw4r::g3d::ResTex::GetTexObjParam
+800529f0 nw4r::g3d::ResTex::GetTexObjCIParam
+80052ab0 0x80052ab0
+80052ae0 nw4r::g3d::ResTex::Init
+80052af0 nw4r::g3d::ResNode::PatchChrAnmResult
+80052c90 nw4r::g3d::ResNode::CalcChrAnmResult
+80052e00 nw4r::g3d::ResNode::SetScale
+80052eb0 nw4r::g3d::ResNode::SetTranslate
+80052f40 nw4r::g3d::ResNode::SetRotate
+80052fd0 nw4r::g3d::detail::GetResKeyFrameAnmResult
+80053110 nw4r::g3d::detail::GetResColorAnmResult
+80053220 nw4r::g3d::ResAnmClr::GetAnmResult
+80053390 nw4r::g3d::@unnamed@g3d_resanmtexpat_cpp@::Search
+80053450 nw4r::g3d::ResAnmTexPat::GetAnmResult
+800535d0 nw4r::g3d::ResAnmTexPat::Bind
+80053740 nw4r::g3d::ResAnmTexPat::Release
+800538e0 0x800538e0
+80053d00 0x80053d00
+80053fb0 0x80053fb0
+800540f0 0x800540f0
+80054270 0x80054270
+80054460 0x80054460
+80054ed0 0x80054ed0
+80055130 nw4r::g3d::ResAnmChr::GetAnmResult_
+80055150 nw4r::g3d::ResAnmChr::GetAnmResult_T
+800551e0 nw4r::g3d::ResAnmChr::GetAnmResult_R
+80055250 nw4r::g3d::ResAnmChr::GetAnmResult_S
+80055290 nw4r::g3d::ResAnmChr::GetAnmResult_RT
+80055340 nw4r::g3d::ResAnmChr::GetAnmResult_SR
+800553e0 nw4r::g3d::ResAnmChr::GetAnmResult_ST
+80055480 nw4r::g3d::ResAnmChr::GetAnmResult_SRT
+80055540 nw4r::g3d::ResAnmChr::GetAnmResult
+800555c0 nw4r::g3d::ChrAnmResult::GetScale
+80055600 nw4r::g3d::ChrAnmResult::GetRotTrans
+800556b0 nw4r::g3d::ChrAnmResult::SetRotTrans
+80055840 nw4r::g3d::ResLightSet::Bind
+800559b0 nw4r::g3d::ResAnmAmbLight::GetAnmResult
+80055a80 0x80055a80
+80055e70 0x80055e70
+80055fd0 nw4r::g3d::ResAnmCamera::GetAnmResult
+800562e0 nw4r::g3d::ResAnmScn::HasResAnmAmbLight
+80056340 nw4r::g3d::ResAnmScn::HasResAnmLight
+800563a0 nw4r::g3d::ResAnmScn::GetResLightSetNumEntries
+80056420 nw4r::g3d::ResAnmScn::GetResAnmAmbLight(ResName)
+800564b0 nw4r::g3d::ResAnmScn::GetResAnmAmbLight(idx)
+80056560 nw4r::g3d::ResAnmScn::GetResAnmAmbLightNumEntries
+800565e0 nw4r::g3d::ResAnmScn::GetResAnmLight(ResName)
+80056670 nw4r::g3d::ResAnmScn::GetResAnmLight(idx)
+80056720 nw4r::g3d::ResAnmScn::GetResAnmLightNumEntries
+800567a0 nw4r::g3d::ResAnmScn::GetResAnmFog
+80056850 nw4r::g3d::ResAnmScn::GetResAnmFogNumEntries
+800568d0 nw4r::g3d::ResAnmScn::GetResAnmCamera
+80056980 nw4r::g3d::ResAnmScn::GetResAnmCameraNumEntries
+80056a00 nw4r::g3d::ResAnmScn::GetResLightSetByRefNumber(u32)
+80056a50 nw4r::g3d::ResAnmScn::GetResLightSetByRefNumber(int)
+80056aa0 nw4r::g3d::ResAnmScn::GetResAnmAmbLightByRefNumber
+80056af0 nw4r::g3d::ResAnmScn::GetResAnmLightByRefNumber
+80056b40 nw4r::g3d::ResAnmScn::GetResAnmFogByRefNumber
+80056b90 nw4r::g3d::ResAnmScn:GetResAnmCameraByRefNumber(u32)
+80056be0 nw4r::g3d::ResAnmScn:GetResAnmCameraByRefNumber(int)
+80056c30 nw4r::g3d::ResAnmScn::Bind
+80056da0 0x80056da0
+80056f10 nw4r::g3d::ApplyVisAnmResult
+80056fd0 nw4r::g3d::ApplyVisAnmResult
+80057060 0x80057060
+80057080 0x80057080
+800570c0 0x800570c0
+800570d0 0x800570c8
+800570e0 0x800570d8
+800570f0 0x800570e4
+80057130 0x80057130
+800571a0 0x80057194
+80057290 0x8005728c
+800573b0 0x800573b0
+80057410 0x80057410
+80057490 0x80057488
+80057520 0x80057518
+80057580 0x80057574
+80057610 0x80057608
+80057670 0x80057664
+80057770 0x80057764
+80057830 0x80057828
+800578b0 0x800578b0
+800579f0 0x800579e4
+80057aa0 0x80057aa0
+80057c90 0x80057c90
+80057d50 0x80057d50
+80057d60 0x80057d58
+80057e20 0x80057e14
+80057e30 0x80057e28
+80057f10 0x80057f10
+80058010 0x80058008
+80058090 0x80058084
+800580e0 nw4r::g3d::ApplyClrAnmResult
+800585a0 0x80058594
+80058610 0x80058608
+80058660 0x80058660
+80058690 0x80058690
+800586a0 0x8005869c
+800586f0 0x800586e4
+80058770 0x8005876c
+800587e0 0x800587d8
+80058810 0x80058810
+80058820 0x8005881c
+80058890 0x80058888
+800588c0 0x800588c0
+800588d0 0x800588cc
+80058900 0x80058900
+80058910 0x80058910
+80058930 nw4r::g3d::AnmObjTexPat::Release
+80058970 nw4r::g3d::AnmObjTexPat::Attach
+80058980 nw4r::g3d::AnmObjTexPat::Detach
+80058990 nw4r::g3d::AnmObjTexPat::DetachAll
+800589a0 nw4r::g3d::AnmObjTexPat::__dt
+800589e0 nw4r::g3d::AnmObjTexPatNode::__dt
+80058a50 nw4r::g3d::AnmObjTexPatNode::Attach
+80058b40 nw4r::g3d::AnmObjTexPatNode::Detach
+80058c60 nw4r::g3d::AnmObjTexPatNode::DetachAll
+80058cc0 nw4r::g3d::AnmObjTexPatNode::UpdateFrame
+80058d40 nw4r::g3d::AnmObjTexPatNode::SetFrame
+80058dd0 nw4r::g3d::AnmObjTexPatNode::GetFrame
+80058e30 nw4r::g3d::AnmObjTexPatNode::SetUpdateRate
+80058ec0 nw4r::g3d::AnmObjTexPatNode::GetUpdateRate
+80058f20 nw4r::g3d::AnmObjTexPatNode::Bind
+80059020 nw4r::g3d::AnmObjTexPatNode::Release
+800590e0 nw4r::g3d::AnmObjTexPatNode::G3dProc
+80059160 nw4r::g3d::AnmObjTexPatOverride::Construct
+800592a0 nw4r::g3d::AnmObjTexPatOverride::GetResult
+80059360 nw4r::g3d::AnmObjTexPatRes::Construct
+80059550 nw4r::g3d::AnmObjTexPatRes::SetFrame
+80059610 nw4r::g3d::AnmObjTexPatRes::GetFrame
+80059620 nw4r::g3d::AnmObjTexPatRes::SetUpdateRate
+800596e0 nw4r::g3d::AnmObjTexPatRes::GetUpdateRate
+800596f0 nw4r::g3d::AnmObjTexPatRes::UpdateFrame
+800597d0 nw4r::g3d::AnmObjTexPatRes::Bind
+800598d0 nw4r::g3d::AnmObjTexPatRes::GetResult
+80059950 nw4r::g3d::AnmObjTexPatRes::G3dProc
+800599a0 nw4r::g3d::ApplyTexPatAnmResult
+80059ba0 nw4r::g3d::AnmObjTexPatRes::IsDerivedFrom
+80059c10 nw4r::g3d::AnmObjTexPat::IsDerivedFrom
+80059c60 nw4r::g3d::AnmObjTexPatRes::GetTypeName
+80059c90 nw4r::g3d::AnmObjTexPatRes::GetTypeObj
+80059ca0 nw4r::g3d::AnmObjTexPatRes::__dt
+80059cf0 nw4r::g3d::AnmObjTexPatOverride::IsDerivedFrom
+80059d70 nw4r::g3d::AnmObjTexPatNode::IsDerivedFrom
+80059de0 nw4r::g3d::AnmObjTexPatOverride::GetTypeName
+80059e10 nw4r::g3d::AnmObjTexPatOverride::GetTypeObj
+80059e20 nw4r::g3d::AnmObjTexPatOverride::__dt
+80059e90 nw4r::g3d::AnmObjTexPatNode::GetTypeName
+80059ec0 nw4r::g3d::AnmObjTexPatNode::GetTypeObj
+80059ed0 nw4r::g3d::AnmObjTexPat::GetTypeName
+80059f00 nw4r::g3d::AnmObjTexPat::GetTypeObj
+80059f10 0x80059f10
+80059f30 0x80059f30
+80059f70 0x80059f70
+80059f80 0x80059f78
+80059f90 0x80059f88
+80059fa0 0x80059f94
+80059fe0 0x80059fe0
+8005a050 0x8005a044
+8005a140 0x8005a13c
+8005a260 0x8005a260
+8005a2c0 0x8005a2c0
+8005a340 0x8005a338
+8005a3d0 0x8005a3c8
+8005a430 0x8005a424
+8005a4c0 0x8005a4b8
+8005a520 0x8005a514
+8005a620 0x8005a614
+8005a6e0 0x8005a6d8
+8005a760 0x8005a760
+8005a8a0 0x8005a894
+8005a950 0x8005a950
+8005ab40 nw4r::g3d::AnmObjTexSrtRes::SetFrame
+8005ac00 0x8005ac00
+8005ac10 0x8005ac08
+8005acd0 0x8005acc4
+8005ace0 0x8005acd8
+8005adc0 0x8005adc0
+8005aec0 0x8005aeb8
+8005af40 0x8005af34
+8005af90 0x8005af90
+8005b030 0x8005b030
+8005b1e0 0x8005b1dc
+8005b250 0x8005b248
+8005b2a0 0x8005b2a0
+8005b2d0 0x8005b2d0
+8005b2e0 0x8005b2dc
+8005b330 0x8005b324
+8005b3b0 0x8005b3ac
+8005b420 0x8005b418
+8005b450 0x8005b450
+8005b460 0x8005b45c
+8005b4d0 0x8005b4c8
+8005b500 0x8005b500
+8005b510 0x8005b50c
+8005b540 0x8005b540
+8005b550 nw4r::g3d::AnmObjChr::Release
+8005b590 nw4r::g3d::AnmObjChr::Attach
+8005b5a0 nw4r::g3d::AnmObjChr::Attach
+8005b5b0 nw4r::g3d::AnmObjChr::SetWeight
+8005b5c0 nw4r::g3d::AnmObjChr::GetWeight
+8005b5d0 nw4r::g3d::AnmObjChr::DetachAll
+8005b5e0 nw4r::g3d::AnmObjChr::__dt
+8005b620 nw4r::g3d::AnmObjChrNode::__dt
+8005b690 nw4r::g3d::AnmObjChrNode::Attach
+8005b780 nw4r::g3d::AnmObjChrNode::Detach
+8005b8a0 nw4r::g3d::AnmObjChrNode::DetachAll
+8005b900 nw4r::g3d::AnmObjChrNode::UpdateFrame
+8005b980 nw4r::g3d::AnmObjChrNode::SetFrame
+8005ba10 nw4r::g3d::AnmObjChrNode::GetFrame
+8005ba70 nw4r::g3d::AnmObjChrNode::SetUpdateRate
+8005bb00 0x8005baf8
+8005bb60 nw4r::g3d::AnmObjChrNode::Bind
+8005bc60 nw4r::g3d::AnmObjChrNode::Bind(BindOption)
+8005bd70 nw4r::g3d::AnmObjChrNode::Release
+8005be30 nw4r::g3d::AnmObjChrNode::Release(BindOption)
+8005bf80 nw4r::g3d::AnmObjChrNode::G3dProc
+8005c000 nw4r::g3d::AnmObjChrBlend::Construct
+8005c180 nw4r::g3d::AnmObjChrBlend::GetResult
+8005c7c0 nw4r::g3d::AnmObjChrBlend::SetWeight
+8005c7d0 nw4r::g3d::AnmObjChrBlend::GetWeight
+8005c7e0 nw4r::g3d::AnmObjChrRes::Construct
+8005c9d0 nw4r::g3d::AnmObjChrRes::SetFrame
+8005ca90 nw4r::g3d::AnmObjChrRes::GetFrame
+8005caa0 nw4r::g3d::AnmObjChrRes::SetUpdateRate
+8005cb60 nw4r::g3d::AnmObjChrRes::GetUpdateRate
+8005cb70 nw4r::g3d::AnmObjChrRes::UpdateFrame
+8005cc50 nw4r::g3d::AnmObjChrRes::Bind
+8005cd60 nw4r::g3d::AnmObjChrRes::Bind(BindOption)
+8005cf60 nw4r::g3d::AnmObjChrRes::Release(BindOption)
+8005d130 nw4r::g3d::AnmObjChrRes::GetResult
+8005d1b0 nw4r::g3d::AnmObjChrRes::G3dProc
+8005d200 nw4r::g3d::AnmObjChrRes::IsDerivedFrom
+8005d270 nw4r::g3d::AnmObjChr::IsDerivedFrom
+8005d2c0 nw4r::g3d::AnmObjChrRes::GetTypeName
+8005d2f0 nw4r::g3d::AnmObjChrRes::GetTypeObj
+8005d300 nw4r::g3d::AnmObjChrRes::__dt
+8005d350 nw4r::g3d::AnmObjChrBlend::IsDerivedFrom
+8005d3d0 nw4r::g3d::AnmObjChrNode::IsDerivedFrom
+8005d440 nw4r::g3d::AnmObjChrBlend::GetTypeName
+8005d470 nw4r::g3d::AnmObjChrBlend::GetTypeObj
+8005d480 nw4r::g3d::AnmObjChrBlend::__dt
+8005d4f0 nw4r::g3d::AnmObjChrNode::GetTypeName
+8005d520 nw4r::g3d::AnmObjChrNode::GetTypeObj
+8005d530 nw4r::g3d::AnmObjChr::GetTypeName
+8005d560 nw4r::g3d::AnmObjChr::GetTypeObj
+8005d570 0x8005d570
+8005d590 0x8005d590
+8005d5d0 0x8005d5d0
+8005d5e0 0x8005d5d8
+8005d5f0 0x8005d5e8
+8005d600 0x8005d5f4
+8005d610 0x8005d608
+8005d620 0x8005d614
+8005d660 0x8005d660
+8005d6d0 0x8005d6c4
+8005d7c0 0x8005d7bc
+8005d8e0 0x8005d8e0
+8005d940 0x8005d940
+8005d9c0 0x8005d9b8
+8005da50 0x8005da48
+8005dab0 0x8005daa4
+8005db40 0x8005db38
+8005dba0 0x8005db94
+8005dca0 0x8005dc94
+8005dd60 0x8005dd58
+8005dde0 0x8005dde0
+8005df60 0x8005df58
+8005e270 0x8005e270
+8005e280 0x8005e280
+8005e290 0x8005e290
+8005e4d0 0x8005e4d0
+8005e5a0 0x8005e594
+8005e5b0 0x8005e5a8
+8005e670 0x8005e668
+8005e680 0x8005e678
+8005e770 0x8005e764
+8005e930 0x8005e924
+8005e9b0 0x8005e9a8
+8005ea00 0x8005e9f4
+8005ea70 0x8005ea68
+8005eac0 0x8005eac0
+8005eaf0 0x8005eaf0
+8005eb00 0x8005eafc
+8005eb50 0x8005eb44
+8005ebd0 0x8005ebcc
+8005ec40 0x8005ec38
+8005ec70 0x8005ec70
+8005ec80 0x8005ec7c
+8005ecf0 0x8005ece8
+8005ed20 0x8005ed20
+8005ed30 0x8005ed2c
+8005ed60 0x8005ed60
+8005ed70 0x8005ed70
+8005ee40 0x8005ee38
+8005eff0 nw4r::g3d::AnmScn::GetLightSetting
+8005f320 0x8005f318
+8005f330 0x8005f328
+8005f340 0x8005f338
+8005f380 0x8005f37c
+8005f390 0x8005f390
+8005f3a0 0x8005f3a0
+8005f3b0 0x8005f3b0
+8005f3c0 0x8005f3bc
+8005f3d0 0x8005f3d0
+8005f3e0 0x8005f3e0
+8005f3f0 0x8005f3ec
+8005f400 0x8005f3fc
+8005f410 0x8005f40c
+8005f420 0x8005f41c
+8005f430 nw4r::g3d::AnmScnRes::Construct
+8005f5d0 nw4r::g3d::AnmScnRes::__ct
+8005f6e0 0x8005f6d4
+8005f720 nw4r::g3d::AnmScnRes::SetFrame
+8005f780 0x8005f778
+8005f790 0x8005f788
+8005f7c0 0x8005f7b4
+8005f7d0 0x8005f7c8
+8005f850 0x8005f848
+8005f8a0 0x8005f894
+8005f9e0 0x8005f9d8
+8005fa50 0x8005fa48
+8005fbe0 nw4r::g3d::AnmScnRes::GetFog
+8005fc90 nw4r::g3d::AnmScnRes::GetCamera
+8005fdf0 0x8005fde4
+8005fe90 0x8005fe84
+8005fec0 0x8005feb4
+8005ff20 0x8005ff1c
+8005ffb0 0x8005ffac
+80060040 0x8006003c
+80060080 0x80060078
+800600d0 0x800600d0
+80060250 0x80060244
+800602a0 0x800602a0
+800602e0 0x800602d8
+80060310 0x80060310
+80060320 0x8006031c
+80060350 0x80060350
+80060360 nw4r::g3d::G3dObj::__dt
+800603b0 nw4r::g3d::G3dObj::Destroy
+80060430 nw4r::g3d::G3dObj::DetachFromParent
+80060490 nw4r::g3d::G3dObj::IsDerivedFrom
+800604b0 nw4r::g3d::G3dObj::GetTypeName
+800604e0 nw4r::g3d::G3dObj::GetTypeObj
+800604f0 0x800604ec
+80060500 nw4r::g3d::PlayPolicy_Loop
+80060570 nw4r::g3d::AnmObj::SetAnmFlag
+800605a0 nw4r::g3d::AnmObj::TestAnmFlag
+800605c0 nw4r::g3d::fifo::GDSetGenMode2
+80060640 0x80060640
+80060670 Fifo_GDSetTexCoordScale2
+800606e0 nw4r::g3d::fifo::GDSetIndTexMtx
+80060980 0x80060980
+800609e0 0x800609e0
+80060a60 0x80060a60
+80060ae0 nw4r::g3d::tmem::SetTMemLayout
+80060be0 TexRegionCallback(_GXTexObj_*
+80060cb0 0x80060ca4
+80060ce0 setTexRegion_(TMemCachePlan)
+80060e40 nw4r::g3d::detail::Copy32ByteBlocks
+80060f20 nw4r::g3d::detail::ZeroMemory32ByteBlocks
+80060ff0 nw4r::g3d::detail::ZeroMemory16ByteBlocks
+80061080 0x80061074
+80061460 0x80061458
+80061570 0x80061570
+800619b0 nw4r::g3d::detail::ScnDependentMtxFunc::DefaultMa
+800619c0 nw4r::g3d::G3DState::IndTexMtxInfo::FifoSend
+80061a30 0x80061a30
+80061a70 0x80061a70
+80061a80 0x80061a80
+80061b80 0x80061b80
+80061c90 0x80061c88
+80061fb0 nw4r::g3d::G3DState::CameraMtxState::CameraMtxSta
+80062050 nw4r::g3d::G3DState::LoadResMatMisc
+800620c0 nw4r::g3d::G3DState::LoadResTexObj
+80062330 nw4r::g3d::G3DState::LoadResTlutObj
+80062480 nw4r::g3d::G3DState::LoadResGenMode
+80062650 nw4r::g3d::G3DState::LoadResTev
+80062860 nw4r::g3d::G3DState::LoadResMatPix
+80062910 nw4r::g3d::G3DState::LoadResMatTevColor
+800629c0 nw4r::g3d::G3DState::LoadResMatIndMtxAndScale
+80062a80 nw4r::g3d::G3DState::LoadResMatIndMtxAndScale
+80062c50 nw4r::g3d::G3DState::LoadResMatChan
+80063380 nw4r::g3d::G3DState::LoadResMatTexCoordGen
+80063410 nw4r::g3d::G3DState::LoadResTexSrt
+800636c0 0x800636c0
+80063870 0x80063870
+80063bc0 nw4r::g3d::G3DState::SetViewPosNrmMtxArray
+80063c50 0x80063c50
+80063d20 nw4r::g3d::G3DState::SetScnDependentTexMtxFunc
+80063d90 nw4r::g3d::G3DState::GetScnDependentTexMtxFunc
+80063df0 0x80063de4
+80063e30 0x80063e30
+80063e40 0x80063e40
+80063ee0 nw4r::g3d::G3DState::LoadFog
+80063fa0 0x80063fa0
+80063fb0 0x80063fb0
+80063fe0 nw4r::g3d::G3DState::LoadLightSet
+80064040 nw4r::g3d::G3DState::LoadLightSet
+800640d0 nw4r::g3d::G3DState::SetCameraProjMtx
+80064180 nw4r::g3d::G3DState::GetCameraMtxPtr
+800641a0 0x800641a0
+80064210 nw4r::g3d::G3DState::GetCameraMtxPtr
+80064240 nw4r::g3d::G3DState::SetRenderModeObj
+80064440 nw4r::g3d::G3DState::GetRenderModeObj
+80064450 nw4r::g3d::G3DState::Invalidate
+800645a0 nw4r::g3d::G3DState::IndMtxOpStd::SetNrmMapMtx
+80064700 nw4r::g3d::G3DState::IndMtxOpStd::Reset
+80064750 nw4r::g3d::G3DState::IndMtxOpStd::__cl
+800648c0 __sinit_g3d_state_cpp
+80064b30 nw4r::g3d::detail::LoadMaterial
+80064fd0 0x80064fd0
+80065880 0x80065880
+80065930 0x80065930
+80065a00 0x800659f8
+80065c40 0x80065c34
+80065f20 0x80065f1c
+80066200 0x800661f4
+80066580 0x8006657c
+80066800 0x800667f8
+80066aa0 0x80066aa0
+80066dd0 0x80066dd0
+80067270 0x80067270
+800677d0 0x800677d0
+80067860 0x80067860
+800678c0 0x800678c0
+800678d0 nw4r::g3d::detail::workmem::GetMtxIDTemporary
+800678e0 0x800678e0
+800678f0 0x800678f0
+80067900 0x80067900
+80067910 0x80067910
+80067920 nw4r::g3d::WorldMtxManip::SetScale
+800679a0 nw4r::g3d::CalcWorld
+80067f70 0x80067f70
+80068250 0x80068250
+80068260 0x80068260
+80068770 0x80068770
+80068940 nw4r::g3d::DrawResMdlLoop(byteCode)
+80068a80 nw4r::g3d::DrawResMdlLoop(byteCode, rep)
+80068c50 nw4r::g3d::DrawResMdlLoop(MdlZ)
+80068d60 nw4r::g3d::DrawResMdlLoop(MdlZ, rep)
+80068ec0 nw4r::g3d::SetUpMdlZ
+80069000 nw4r::g3d::DrawResMdlDirectly
+80069230 0x80069228
+80069270 0x8006926c
+800692e0 0x800692e0
+800698a0 0x800698a0
+80069e60 0x80069e60
+8006a0c0 nw4r::g3d::Camera::__ct
+8006a0d0 nw4r::g3d::Camera::Init
+8006a120 nw4r::g3d::Camera::Init
+8006a240 nw4r::g3d::Camera::SetPosition
+8006a270 nw4r::g3d::Camera::SetPosition
+8006a2b0 nw4r::g3d::Camera::SetPosture
+8006a4d0 nw4r::g3d::Camera::SetCameraMtxDirectly
+8006a520 nw4r::g3d::Camera::SetPerspective
+8006a560 nw4r::g3d::Camera::SetOrtho
+8006a5a0 nw4r::g3d::Camera::SetProjectionMtxDirectly
+8006a5f0 nw4r::g3d::Camera::SetScissor
+8006a610 nw4r::g3d::Camera::SetScissorBoxOffset
+8006a630 nw4r::g3d::Camera::SetViewport
+8006a6d0 nw4r::g3d::Camera::SetViewportZRange
+8006a6f0 nw4r::g3d::Camera::GetViewport
+8006a760 nw4r::g3d::Camera::GetCameraMtx
+8006a7c0 nw4r::g3d::Camera::GetProjectionMtx
+8006a8a0 nw4r::g3d::Camera::GetProjectionTexMtx
+8006a970 nw4r::g3d::Camera::GetEnvironmentTexMtx
+8006a9f0 nw4r::g3d::Camera::GXSetViewport
+8006aa80 nw4r::g3d::Camera::GXSetProjection
+8006ab50 nw4r::g3d::Camera::GXSetScissor
+8006ab80 nw4r::g3d::Camera::GXSetScissorBoxOffset
+8006aba0 0x8006aba0
+8006afc0 0x8006afc0
+8006b120 nw4r::g3d::detail::dcc::CalcWorldMtx_Basic
+8006b290 0x8006b288
+8006b2d0 0x8006b2c8
+8006b370 0x8006b364
+8006b3b0 0x8006b3a8
+8006b470 0x8006b46c
+8006b520 0x8006b520
+8006b570 0x8006b570
+8006b650 0x8006b64c
+8006b6d0 0x8006b6c8
+8006b7a0 0x8006b7a0
+8006b800 0x8006b800
+8006b830 0x8006b828
+8006b9d0 0x8006b9c4
+8006bb20 0x8006bb20
+8006bbb0 0x8006bba8
+8006bd60 0x8006bd60
+8006be00 nw4r::g3d::detail::dcc::CalcWorldMtx_Maya_SSC_App
+8006bfa0 0x8006bf94
+8006bfe0 0x8006bfd8
+8006c070 0x8006c068
+8006c0b0 0x8006c0a8
+8006c150 0x8006c150
+8006c220 0x8006c218
+8006c270 0x8006c270
+8006c340 0x8006c338
+8006c3c0 0x8006c3b8
+8006c4d0 0x8006c4d0
+8006c500 0x8006c4f4
+8006c640 0x8006c63c
+8006c770 0x8006c76c
+8006c800 0x8006c7f8
+8006c960 0x8006c960
+8006ca00 nw4r::g3d::detail::dcc::CalcWorldMtx_Xsi
+8006cbc0 0x8006cbb4
+8006cc10 0x8006cc08
+8006ccc0 0x8006ccbc
+8006cd00 0x8006ccf8
+8006cdc0 0x8006cdb4
+8006ce90 0x8006ce8c
+8006cef0 0x8006cee8
+8006cfc0 0x8006cfbc
+8006d040 0x8006d040
+8006d170 0x8006d164
+8006d1a0 0x8006d194
+8006d2f0 0x8006d2e4
+8006d430 0x8006d430
+8006d480 0x8006d474
+8006d4d0 0x8006d4c4
+8006d640 0x8006d640
+8006d6e0 nw4r::g3d::ScnObj::CalcWorldMtx
+8006d790 nw4r::g3d::ScnObj::CalcViewMtx
+8006d7b0 nw4r::g3d::ScnObj::__ct
+8006d8a0 nw4r::g3d::ScnObj::__dt
+8006d920 nw4r::g3d::ScnObj::SetScnObjOption
+8006d940 nw4r::g3d::ScnObj::SetScnObjOption_caseD_1
+8006d968 nw4r::g3d::ScnObj::SetScnObjOption_caseD_2
+8006d990 nw4r::g3d::ScnObj::SetScnObjOption_caseD_3
+8006d9b8 nw4r::g3d::ScnObj::SetScnObjOption_caseD_4
+8006d9e0 nw4r::g3d::ScnObj::SetScnObjOption_caseD_5
+8006da08 nw4r::g3d::ScnObj::SetScnObjOption_caseD_6
+8006da30 nw4r::g3d::ScnObj::SetScnObjOption_caseD_7
+8006da58 nw4r::g3d::ScnObj::SetScnObjOption_caseD_8
+8006da80 nw4r::g3d::ScnObj::SetScnObjOption_caseD_9
+8006daa8 nw4r::g3d::ScnObj::SetScnObjOption_caseD_0
+8006dac0 nw4r::g3d::ScnObj::GetScnObjOption
+8006daf0 nw4r::g3d::ScnObj::GetScnObjOption_caseD_1
+8006db00 nw4r::g3d::ScnObj::GetScnObjOption_caseD_2
+8006db10 nw4r::g3d::ScnObj::GetScnObjOption_caseD_3
+8006db20 nw4r::g3d::ScnObj::GetScnObjOption_caseD_4
+8006db30 nw4r::g3d::ScnObj::GetScnObjOption_caseD_5
+8006db40 nw4r::g3d::ScnObj::GetScnObjOption_caseD_6
+8006db50 nw4r::g3d::ScnObj::GetScnObjOption_caseD_7
+8006db60 nw4r::g3d::ScnObj::GetScnObjOption_caseD_8
+8006db70 nw4r::g3d::ScnObj::GetScnObjOption_caseD_9
+8006db80 nw4r::g3d::ScnObj::GetScnObjOption_caseD_0
+8006db90 nw4r::g3d::ScnObj::SetMtx
+8006dc20 nw4r::g3d::ScnObj::SetMtx
+8006dc80 nw4r::g3d::ScnObj::GetMtx
+8006dcd0 nw4r::g3d::ScnObj::GetValueForSortOpa
+8006dce0 nw4r::g3d::ScnObj::GetValueForSortXlu
+8006dcf0 nw4r::g3d::ScnObj::SetPriorityDrawOpa
+8006dd20 nw4r::g3d::ScnObj::SetPriorityDrawXlu
+8006dd50 nw4r::g3d::ScnObj::EnableScnObjCallbackTiming
+8006dd90 nw4r::g3d::ScnObj::EnableScnObjCallbackExecOp
+8006ddb0 nw4r::g3d::ScnObj::SetBoundingVolume
+8006de40 nw4r::g3d::ScnObj::GetBoundingVolume
+8006dea0 nw4r::g3d::ScnLeaf::ForEach
+8006dee0 nw4r::g3d::ScnLeaf::SetScnObjOption
+8006df20 nw4r::g3d::ScnLeaf::GetScnObjOption
+8006df70 nw4r::g3d::ScnObj::CalcWorldMtx
+8006e070 nw4r::g3d::ScnLeaf::GetScaleProperty
+8006e0b0 nw4r::g3d::ScnLeaf::DefG3dProcScnLeaf
+8006e390 nw4r::g3d::ScnGroup::Construct
+8006e450 nw4r::g3d::ScnGroup::ForEach
+8006e590 nw4r::g3d::ScnGroup::ScnGroup_G3DPROC_GATHER_SCNOBJ
+8006e6b0 nw4r::g3d::ScnGroup::G3dProc
+8006e6f0 nw4r::g3d::ScnGroup::DefG3dProcScnGroup
+8006eb60 nw4r::g3d::ScnGroup::Insert
+8006ecf0 nw4r::g3d::ScnGroup::Remove(idx)
+8006edb0 nw4r::g3d::ScnGroup::Remove(ScnObj)
+8006ee40 nw4r::g3d::ScnGroup::__ct
+8006eeb0 nw4r::g3d::ScnGroup::__dt
+8006ef70 nw4r::g3d::ScnGroup::IsDerivedFrom
+8006efc0 nw4r::g3d::G3dObj::IsDerivedFrom
+8006f000 nw4r::g3d::ScnGroup::GetTypeNameStatic
+8006f030 nw4r::g3d::ScnGroup::GetTypeObjStatic
+8006f040 nw4r::g3d::ScnLeaf::IsDerivedFrom
+8006f090 nw4r::g3d::ScnLeaf::GetTypeNameStatic
+8006f0c0 nw4r::g3d::ScnLeaf::GetTypeObjStatic
+8006f0d0 nw4r::g3d::ScnLeaf::destruct
+8006f160 nw4r::g3d::ScnObj::GetTypeNameStatic
+8006f190 nw4r::g3d::ScnObj::GetTypeObjStatic
+8006f1a0 nw4r::g3d::ScnRoot::Construct
+8006f2e0 nw4r::g3d::ScnRoot::G3dProc
+8006f390 nw4r::g3d::ScnRoot::GetCamera
+8006f3f0 nw4r::g3d::ScnRoot::GetCurrentCamera
+8006f430 nw4r::g3d::ScnRoot::SetCurrentCamera
+8006f440 nw4r::g3d::ScnRoot::GetFog
+8006f4a0 nw4r::g3d::ScnRoot::GetLightSet
+8006f4f0 nw4r::g3d::ScnRoot::SetAnmScn
+8006f590 nw4r::g3d::ScnRoot::UpdateFrame
+8006f600 0x8006f600
+8006f830 nw4r::g3d::ScnRoot::CalcAnmScn
+8006f9c0 nw4r::g3d::ScnRoot::CalcWorld
+8006fa10 nw4r::g3d::ScnRoot::CalcMaterial
+8006fa30 nw4r::g3d::ScnRoot::CalcVtx
+8006fa50 nw4r::g3d::ScnRoot::CalcView
+8006fad0 nw4r::g3d::ScnRoot::GatherDrawScnObj
+8006fbc0 nw4r::g3d::ScnRoot::ZSort
+8006fc20 nw4r::g3d::ScnRoot::DrawOpa
+8006fca0 nw4r::g3d::ScnRoot::DrawXlu
+8006fd20 nw4r::g3d::ScnRoot::ForceDrawMode
+8006fd50 nw4r::g3d::ScnRoot::__ct
+8006fe50 0x8006fe4c
+8006fed0 nw4r::g3d::ScnObjGather::Add
+8006fff0 nw4r::g3d::ScnObjGather::ZSort
+80070050 0x80070050
+80070090 0x80070090
+800700d0 std::sort(void_(nw4r::g3d::ScnObj_**
+80070450 std::sort(void_(nw4r::g3d::ScnObj_**
+800707d0 std::__sort132(void_(nw4r::g3d::ScnObj_**
+800708d0 nw4r::g3d::ScnObjGather::Sort
+80070930 nw4r::g3d::@unnamed@g3d_scnroot_cpp@::LessByGetVa
+800709c0 nw4r::g3d::@unnamed@g3d_scnroot_cpp@::LessByGetVa
+80070a50 nw4r::g3d::ScnObjGather::Sort(CompFuncs)
+80070ac0 nw4r::g3d::ScnObjGather::DrawOpa
+80070b50 nw4r::g3d::ScnObjGather::DraxXlu
+80070be0 nw4r::g3d::ScnObjGather::CheckScnObj
+80070bf0 nw4r::g3d::ScnObjGather::__ct
+80070c20 nw4r::g3d::ScnObjGather::Clear
+80070c30 nw4r::g3d::ScnObjGather::__dt
+80070c70 0x80070c70
+80070ce0 0x80070cd8
+80070d10 0x80070d10
+80070d20 nw4r::g3d::ScnMdlSimple::Construct
+80070ec0 nw4r::g3d::ScnMdlSimple::ScnMdlSmpl_CalcPosture
+80071120 nw4r::g3d::ScnMdlSimple::ScnMdlSmpl_G3DPROC_GATHER_SCNOBJ
+80071160 nw4r::g3d::ScnMdlSimple::ScnMdlSmpl_G3DPROC_CALC_
+800714b0 nw4r::g3d::ScnMdlSimple::G3dProc
+80071d40 nw4r::g3d::ScnMdlSimple::SetScnObjOption
+80071d80 nw4r::g3d::ScnMdlSimple::GetScnObjOption
+80071dc0 nw4r::g3d::ScnMdlSimple::GetScnMtxPos
+80071f00 nw4r::g3d::ScnMdlSimple::SetAnmObj
+80072510 nw4r::g3d::ScnMdlSimple::RemoveAnmObj
+80072690 nw4r::g3d::ScnMdlSimple::RemoveAnmObj
+80072770 nw4r::g3d::ScnMdlSimple::GetAnmObj
+800727d0 nw4r::g3d::ScnMdlSimple::GetAnmObj
+80072830 nw4r::g3d::ScnMdlSimple::UpdateFrame
+800728f0 nw4r::g3d::ScnMdlSimple::EnableScnMdlCallbackTiming
+80072930 nw4r::g3d::ScnMdlSimple::DisableScnMdlCallbackTiming
+80072970 nw4r::g3d::ScnMdlSimple::GetViewPosMtxArray
+800729a0 nw4r::g3d::ScnMdlSimple::GetViewNrmMtxArray
+800729e0 nw4r::g3d::ScnMdlSimple::GetViewTexMtxArray
+80072a20 nw4r::g3d::ScnMdlSimple::GetByteCode
+80072a70 0x80072a70
+80072c90 nw4r::g3d::ScnMdlSimple::destruct
+80072db0 nw4r::g3d::ScnMdlSimple::IsDerivedFrom
+80072e20 nw4r::g3d::ScnMdlSimple::GetTypeNameStatic
+80072e50 nw4r::g3d::ScnMdlSimple::GetTypeObj
+80072e60 nw4r::g3d::ScnMdl::CopiedMatAccess::GetResTexObj
+80072eb0 nw4r::g3d::ScnMdl::CopiedMatAccess::GetResMatTevColor
+80072f00 nw4r::g3d::ScnMdl::CopiedMatAccess::GetResTexSrtEx
+80072f60 nw4r::g3d::ScnMdl::CopiedMatAccess::GetResMatMiscEx
+80072fc0 nw4r::g3d::ScnMdl::CopiedMatAccess::GetResMatTevColorEx
+80073040 nw4r::g3d::ScnMdl::CopiedMatAccess::GetResTevEx
+800730b0 nw4r::g3d::ScnMdl::CopiedMatAccess::__ct
+80073330 nw4r::g3d::ScnMdl::CopiedVisAccess::IsVisible
+800733b0 nw4r::g3d::ScnMdl::CopiedVisAccess::CopiedVisAcce
+80073470 nw4r::g3d::ScnMdl::Construct
+80074000 nw4r::g3d::ScnMdl::ScnMdl_G3DPROC_CALC_MAT
+80074770 nw4r::g3d::ScnMdl::G3dProc
+80074c20 nw4r::g3d::ScnMdl::SetScnObjOption
+80074c60 nw4r::g3d::ScnMdl::GetScnObjOption
+80074ca0 nw4r::g3d::ScnMdl::InitBuffer
+80075040 nw4r::g3d::ScnMdl::CleanMatBuffer
+80075380 nw4r::g3d::ScnMdl::SetAnmObj
+800754f0 nw4r::g3d::ScnMdl::RemoveAnmObj
+800756f0 nw4r::g3d::ScnMdl::RemoveAnmObj
+80075740 nw4r::g3d::ScnMdl::GetAnmObj
+80075760 nw4r::g3d::ScnMdl::GetAnmObj
+80075780 nw4r::g3d::ScnMdl::__dt
+800757f0 nw4r::g3d::ScnMdl::IsDerivedFrom
+80075870 nw4r::g3d::ScnMdl::GetTypeNameStatic
+800758a0 nw4r::g3d::ScnMdl::GetTypeObjStatic
+800758b0 0x800758ac
+800758c0 0x800758b8
+800759f0 nw4r::g3d::ScnObjGatherExScnMdl::DrawOpa
+80075a20 nw4r::g3d::ScnObjGatherExScnMdl::DrawXlu
+80075a50 nw4r::g3d::ScnObjGatherExScnMdl::CheckScnObj
+80075bd0 nw4r::g3d::ScnObjGatherExScnMdl::GetResMdl
+80075be0 nw4r::g3d::ScnObjGatherExScnMdl::DrawLoop
+80075fd0 nw4r::g3d::ScnObjGatherExScnMdl::HasEqualTarget
+80076060 nw4r::g3d::ScnObjGatherExScnMdl::TypeID
+80076070 nw4r::g3d::ScnGroupEx::Construct
+800761d0 nw4r::g3d::ScnGroupEx::SetResMdl
+80076210 0x8007620c
+80076250 nw4r::g3d::ScnGroupEx::G3dProc
+80076580 nw4r::g3d::ScnGroupEx::__dt
+800765c0 nw4r::g3d::ScnObjGatherExScnMdl::SetResMdl
+80076670 nw4r::g3d::ScnObjGatherExScnMdl::__dt
+800766b0 0x800766b0
+800766c0 0x800766b4
+800766d0 0x800766c4
+800766e0 0x800766d4
+800766f0 0x800766e4
+80076700 0x800766f4
+80076710 nw4r::g3d::ScnGroupEx::IsDerivedFrom
+80076780 nw4r::g3d::ScnGroupEx::GetTypeName
+800767b0 nw4r::g3d::ScnGroupEx::GetTypeObj
+800767c0 nw4r::g3d::ScnMdl1Mat1Shp::Construct
+800768e0 nw4r::g3d::ScnMdl1Mat1Shp::G3dProc
+80076bd0 nw4r::g3d::ScnMdl1Mat1Shp::IsDerivedFrom
+80076c40 nw4r::g3d::ScnMdl1Mat1Shp::GetTypeName
+80076c70 nw4r::g3d::ScnMdl1Mat1Shp::GetTypeObj
+80076c80 nw4r::g3d::ScnMdl1Mat1Shp::__dt
+80076cc0 nw4r::g3d::CalcMaterialDirectly
+800770d0 nw4r::g3d::G3dInit
+800771c0 nw4r::g3d::G3dReset
+800771d0 nw4r::g3d::ScnProc::Construct
+800772e0 nw4r::g3d::ScnProc::G3dProc
+800773e0 nw4r::g3d::ScnProc::IsDerivedFrom
+80077450 nw4r::g3d::ScnProc::GetTypeName
+80077480 nw4r::g3d::ScnProc::GetTypeObj
+80077490 nw4r::g3d::ScnProc::__dt
+800774d0 nw4r::g3d::Fog::__ct
+800774e0 nw4r::g3d::Fog::Init
+80077550 nw4r::g3d::Fog::CopyTo
+800775b0 nw4r::g3d::Fog::SetFogRangeAdjParam
+800775d0 nw4r::g3d::Fog::SetGP
+80077660 nw4r::g3d::LightObj::Clear
+80077680 nw4r::g3d::LightObj::InitLightColor
+800776d0 nw4r::g3d::LightObj::InitLightPos
+80077710 nw4r::g3d::LightObj::InitLightDir
+80077750 nw4r::g3d::LightObj::InitLightSpot
+80077790 nw4r::g3d::LightObj::InitLightAttnA
+800777d0 nw4r::g3d::LightObj::InitLightDistAttn
+80077810 nw4r::g3d::LightObj::InitLightAttnK
+80077850 nw4r::g3d::LightObj::InitSpecularDir
+80077890 nw4r::g3d::LightObj::InitLightShininess
+800778f0 nw4r::g3d::LightObj::GetLightPos
+80077910 nw4r::g3d::LightObj::GetLightDir
+80077930 nw4r::g3d::LightSetting::__ct
+80077d70 nw4r::g3d::LightSetting::Import
+80077f10 nw4r::g3d::LightSetting::ApplyViewMtx
+80078030 nw4r::g3d::LightSet::SelectLightObj
+800780a0 nw4r::g3d::LightSet::SelectAmbLightObj
+80078110 nw4r::g3d::CalcVtx
+80078920 nw4r::lyt::LytInit
+80078980 nw4r::lyt::Pane::__ct
+80078ac0 nw4r::lyt::Pane::__dt
+80078c00 nw4r::lyt::Pane::AppendChild
+80078c50 nw4r::lyt::Pane::GetPaneRect
+80078ce0 nw4r::lyt::Pane::GetVtxColor
+80078cf0 nw4r::lyt::Pane::SetVtxColor
+80078d00 nw4r::lyt::Pane::GetColorElement
+80078d30 nw4r::lyt::Pane::SetColorElement
+80078d60 nw4r::lyt::Pane::GetVtxColorElement
+80078d70 nw4r::lyt::Pane::SetVtxColorElement
+80078d80 nw4r::lyt::Pane::FindPaneByName
+80078e30 nw4r::lyt::Pane::FindMaterialByName
+80078ef0 nw4r::lyt::Pane::CalculateMtx
+800791f0 nw4r::lyt::Pane::Draw
+80079280 nw4r::lyt::Pane::DrawSelf
+80079290 nw4r::lyt::Pane::Animate
+80079320 nw4r::lyt::Pane::AnimateSelf
+800793e0 nw4r::lyt::Pane::BindAnimation
+80079400 nw4r::lyt::Pane::UnbindAnimation
+80079490 nw4r::lyt::Pane::UnbindAllAnimation
+800794b0 nw4r::lyt::UnbindAnimationSelf
+80079510 nw4r::lyt::Pane::AddAnimationLink
+80079550 nw4r::lyt::Pane::FindAnimationLinkSelf
+80079560 nw4r::lyt::Pane::FindAnimationLinkSelf
+80079570 nw4r::lyt::Pane::SetAnimationEnable
+80079670 nw4r::lyt::Pane::SetAnimationEnable
+80079770 nw4r::lyt::Pane::LoadMtx
+800797d0 nw4r::lyt::Pane::GetVtxPos
+800798a0 nw4r::lyt::Pane::GetMaterialNum
+800798c0 nw4r::lyt::Pane::GetMaterial
+800798d0 nw4r::lyt::Pane::GetMaterial
+800798f0 nw4r::lyt::Pane::GetRuntimeTypeInfo
+80079900 0x80079900
+80079910 nw4r::lyt::Group::__ct
+80079980 nw4r::lyt::Group::__ct
+80079aa0 nw4r::lyt::Group::__dt
+80079b50 nw4r::lyt::Group::AppendPane
+80079be0 nw4r::lyt::GroupContainer::__dt
+80079cb0 nw4r::lyt::GroupContainer::AppendGroup
+80079cf0 nw4r::lyt::GroupContainer::FindGroupByName
+80079d70 nw4r::lyt::SetTagProcessorImpl
+80079f30 nw4r::lyt::IsIncludeAnimationGroupRef
+8007a000 nw4r::lyt::Layout::__ct
+8007a040 nw4r::lyt::Layout::__dt
+8007a170 nw4r::lyt::Layout::Build
+8007a4c0 nw4r::lyt::Layout::CreateAnimTransform
+8007a540 nw4r::lyt::Layout::CreateAnimTransform
+8007a5a0 nw4r::lyt::Layout::CreateAnimTransform
+8007a630 nw4r::lyt::Layout::BindAnimation
+8007a660 nw4r::lyt::Layout::UnbindAnimation
+8007a690 nw4r::lyt::Layout::UnbindAllAnimation
+8007a6b0 nw4r::lyt::Layout::BindAnimationAuto
+8007a940 nw4r::lyt::Layout::SetAnimationEnable
+8007a970 nw4r::lyt::Layout::CalculateMtx
+8007a990 nw4r::lyt::Layout::Draw
+8007a9b0 nw4r::lyt::Layout::Animate
+8007a9d0 nw4r::lyt::Layout::SetTagProcessor
+8007ab90 nw4r::lyt::Layout::BuildPaneObj
+8007ad80 nw4r::ut::Color::__ct
+8007ad90 nw4r::lyt::Picture::__ct
+8007aee0 nw4r::lyt::Picture::__dt
+8007afc0 nw4r::lyt::Picture::Append
+8007b180 nw4r::lyt::Picture::GetVtxColor
+8007b1b0 nw4r::lyt::Picture::SetVtxColor
+8007b1e0 nw4r::lyt::Picture::GetVtxColorElement
+8007b200 nw4r::lyt::Picture::SetVtxColorElement
+8007b220 nw4r::lyt::Picture::DrawSelf
+8007b300 nw4r::lyt::Picture::GetRuntimeTypeInfo
+8007b310 __sinit_\lyt_picture_cpp
+8007b320 nw4r::lyt::TextBox::__ct
+8007b610 nw4r::lyt::TextBox::__dt
+8007b7b0 nw4r::lyt::TextBox::GetVtxColor
+8007b7e0 nw4r::lyt::TextBox::SetVtxColor
+8007b830 nw4r::lyt::TextBox::GetVtxColorElement
+8007b850 nw4r::lyt::TextBox::SetVtxColorElement
+8007b870 nw4r::lyt::TextBox::DrawSelf
+8007bf50 0x8007bf50
+8007c330 0x8007c330
+8007c370 nw4r::lyt::TextBox::GetStringBufferLength
+8007c3a0 nw4r::lyt::TextBox::AllocStringBuffer
+8007c470 nw4r::lyt::TextBox::FreeStringBuffer
+8007c4c0 nw4r::lyt::TextBox::SetString
+8007c5a0 nw4r::lyt::TextBox::SetString
+8007c670 nw4r::ut::Font__dt
+8007c6b0 nw4r::lyt::TextBox::LoadMtx
+8007c740 0x8007c740
+8007cab0 0x8007cab0
+8007cc10 nw4r::lyt::TextBox::GetRuntimeTypeInfo
+8007cc20 0x8007cc18
+8007cc30 nw4r::lyt::Window::__ct
+8007cec0 nw4r::lyt::Window::__dt
+8007d010 nw4r::lyt::Window::FindMaterialByName
+8007d110 nw4r::lyt::Window::GetVtxColor
+8007d140 nw4r::lyt::Window::SetVtxColor
+8007d170 nw4r::lyt::Window::GetVtxColorElement
+8007d190 nw4r::lyt::Window::SetVtxColorElement
+8007d1b0 nw4r::lyt::Window::DrawSelf
+8007d2f0 nw4r::lyt::Window::AnimateSelf
+8007d380 nw4r::lyt::Window::UnbindAnimationSelf
+8007d410 nw4r::lyt::Window::DrawContent
+8007d520 nw4r::lyt::Window::DrawFrame
+8007db00 nw4r::lyt::Window::DrawFrame4
+8007e250 nw4r::lyt::Window::DrawFrame8
+8007f0a0 nw4r::lyt::Window::GetFrameSize
+8007f1a0 nw4r::lyt::Window:GetMaterialNum
+8007f1b0 nw4r::lyt::Window::GetMaterial
+8007f1e0 nw4r::lyt::Window::GetFrameMaterial
+8007f210 nw4r::lyt::Window::GetContent
+8007f220 0x8007f220
+8007f230 0x8007f228
+8007f240 Bounding_construct
+8007f280 0x8007f27c
+8007f2e0 0x8007f2d8
+8007f2f0 nw4r::lyt::Window::GetRuntimeTypeInfo
+8007f300 __sinit_\lyt_bounding_cpp
+8007f310 0x8007f310
+8007f420 0x8007f420
+8007f620 nw4r::math::VEC2::__as
+8007f640 nw4r::ut::LinkList::__ct
+8007f660 nw4r::lyt::Material::__ct
+8007fcd0 _GXColorS10::Operator=
+8007fd00 nw4r::ut::Color::Operator=
+8007fd10 nw4r::lyt::MaterialResourceNum::GetTexMapNum
+8007fd20 nw4r::lyt::MaterialResourceNum::GetTexSRTNum
+8007fd30 nw4r::lyt::MaterialResourceNum::GetCoordGenNum
+8007fd40 nw4r::lyt::MaterialResourceNum::GetChanCtrlNum
+8007fd50 nw4r::lyt::MaterialResourceNum::GetMapColNum
+8007fd60 nw4r::lyt::MaterialResourceNum::HasTevSwapTable
+8007fd70 nw4r::lyt::MaterialResourceNum::HasAlphaCompare
+8007fd80 nw4r::lyt::MaterialResourceNum::HasBlendMode
+8007fd90 nw4r::lyt::MaterialResourceNum::GetIndTexStageNum
+8007fda0 nw4r::lyt::MaterialResourceNum::GetIndTexStageNum
+8007fdb0 0x8007fdb0
+8007fdc0 0x8007fdc0
+8007fde0 nw4r::lyt::res::TexMap::GetWarpModeS
+8007fdf0 nw4r::lyt::res::TexMap::GetWarpModeT
+8007fe00 0x8007fe00
+8007fe20 nw4r::lyt::res::TexMap::GetMinFilter
+8007fe40 nw4r::lyt::res::TexMap::GetMagFilter
+8007fe60 0x8007fe60
+8007fe90 0x8007fe90
+8007fec0 0x8007fec0
+8007fef0 nw4r::lyt::TevSwapMode::__as
+8007ff00 nw4r::lyt::TexSRT::operator_=
+8007ff30 0x8007ff30
+8007ff60 0x8007ff60
+80080000 0x80080000
+80080010 0x80080010
+80080040 0x80080040
+80080070 0x80080070
+80080080 0x80080080
+80080090 nw4r::snd::DvdSoundArchive::OpenExtStream
+800800a0 0x800800a0
+800800b0 0x800800b0
+800800c0 0x800800c0
+800800d0 0x800800d0
+800800e0 nw4r::lyt::detail::ConvertOffsToPtr<char>
+800800f0 nw4r::lyt::detail::ConvertOffsToPtr<res::Texture>
+80080100 0x80080100
+80080110 0x80080110
+80080120 0x80080120
+80080130 nw4r::lyt::detail::ConvertOffsToPtr<nw4r::lyt::re
+80080140 nw4r::lyt::Material::Init
+800801b0 nw4r::lyt::Material::__dt
+80080260 nw4r::lyt::Material::ReserveGXMem
+80080990 nw4r::lyt::Material::GetTexMapAry
+800809a0 nw4r::lyt::Material::GetTexMapAry(const)
+800809b0 0x800809b0
+800809d0 nw4r::lyt::Material::GetTexSRTAry
+800809f0 nw4r::lyt::Material::GetTexCoordGenAry
+80080a20 nw4r::lyt::Material::GetChanCtrlAry
+80080a50 nw4r::lyt::Material::GetMatColAry
+80080a90 nw4r::lyt::Material::GetTevSwapAry
+80080ad0 0x80080ad0
+80080b20 0x80080b20
+80080b70 nw4r::lyt::Material::GetBlendModePtr
+80080bc0 nw4r::lyt::Material::GetIndirectStageAry
+80080c20 nw4r::lyt::Material::GetIndTexSRTAry
+80080c80 nw4r::lyt::Material::GetTevStageAry
+80080cf0 nw4r::lyt::Material::SetName
+80080d30 nw4r::lyt::Material::SetTextureNum
+80080dc0 nw4r::lyt::Material::SetTexCoordGenNum
+80080e50 nw4r::lyt::Material::SetTevStageNum
+80080f80 nw4r::lyt::Material::SetIndStageNum
+80081050 nw4r::lyt::Material::SetColorElement
+80081210 nw4r::lyt::Material::SetupGX
+800820b0 nw4r::lyt::Material::BindAnimation
+800820d0 nw4r::lyt::Material::UnbindAnimation
+800820e0 nw4r::lyt::Material::UnbindAllAnimation
+80082100 nw4r::lyt::Material::Animate
+80082180 nw4r::lyt::Material::AddAnimationLink
+800821c0 nw4r::lyt::Material::FindAnimationLink
+800821d0 nw4r::lyt::Material::FindAnimationLink
+800821e0 nw4r::lyt::Material::SetAnimationEnable
+80082230 nw4r::lyt::Material::SetAnimationEnable
+80082280 nw4r::lyt::detail::GetTextureSize
+800822f0 nw4r::lyt::TexMap::Get
+800823e0 nw4r::lyt::TexMap::Get
+80082400 nw4r::lyt::TexMap::Set
+80082550 nw4r::lyt::TexMap::ReplaceImage
+80082620 nw4r::lyt::DrawInfo::__ct
+800826a0 nw4r::lyt::DrawInfo::__dt
+800826e0 nw4r::lyt::AnimTransform::GetStepCurveValue
+800827d0 nw4r::lyt::AnimTransform::GetHermiteCurveValue
+80082990 nw4r::lyt::AnimTransform::__dt
+800829d0 nw4r::lyt::AnimTransform::GetFrameSize
+800829e0 nw4r::lyt::AnimTransform::IsLoopData
+80082a00 nw4r::lyt::AnimTransformBasic::__ct
+80082a40 nw4r::lyt::AnimTransformBasic::__dt
+80082ad0 nw4r::lyt::AnimTransformBasic::SetResource
+80082af0 nw4r::lyt::AnimTransformBasic::SetResource
+80082c60 nw4r::lyt::AnimTransformBasic::Bind
+80082e30 nw4r::lyt::AnimTransformBasic::Bind
+80082f50 nw4r::lyt::AnimTransformBasic::Animate
+80083130 nw4r::lyt::AnimTransformBasic::Animate
+80083420 nw4r::lyt::AnimResource::__ct
+80083440 nw4r::lyt::AnimResource::Set
+80083550 nw4r::lyt::AnimResource::GetGroupNum
+80083570 nw4r::lyt::AnimResource::GetGroupArray
+80083590 nw4r::lyt::AnimResource::IsDescendingBind
+800835b0 nw4r::lyt::AnimResource::GetAnimationShareInfoNum
+800835d0 nw4r::lyt::AnimResource::GetAnimationShareInfoArr
+800835f0 nw4r::lyt::AnimResource::CalcAnimationNum
+800836d0 nw4r::lyt::AnimResource::CalcAnimationNum
+80083740 nw4r::lyt::detail::AnimPaneTree::Init
+80083780 nw4r::lyt::detail::AnimPaneTree::Set
+800839e0 nw4r::lyt::detail::AnimPaneTree::Bind
+80083c20 nw4r::lyt::detail::UnbindAnimationLink
+80083cb0 nw4r::lyt::ResourceAccessor::__dt
+80083cf0 nw4r::lyt::ResourceAccessor::__ct
+80083d00 0x80083d00
+80083d10 nw4r::lyt::ArcResourceAccessor::FindNameResource
+80083de0 nw4r::lyt::ArcResourceAccessor::GetResourceSub
+80083f20 nw4r::lyt::FontRefLink::__ct
+80083f40 nw4r::lyt::FontRefLink::Set
+80083f80 nw4r::lyt::ArcResourceAccessor::Attach
+80084000 nw4r::lyt::ArcResourceLink::Set
+80084070 nw4r::lyt::MultiArcResourceAccessor::__ct
+800840e0 nw4r::lyt::MultiArcResourceAccessor::__dt
+80084170 nw4r::lyt::MultiArcResourceAccessor::Attach
+800841b0 nw4r::lyt::MultiArcResourceAccessor::GetResource
+80084230 nw4r::lyt::MultiArcResourceAccessor::AttachFont
+80084270 nw4r::lyt::MultiArcResourceAccessor::GetFont
+800842e0 nw4r::lyt::detail::EqualsResName
+80084310 nw4r::lyt::detail::EqualsMaterialName
+80084340 nw4r::lyt::detail::TestFileHeader
+80084370 nw4r::lyt::TexCoordAry::__ct
+80084390 nw4r::lyt::TexCoordAry::Free
+800843e0 nw4r::lyt::TexCoordAry::Reserve
+80084480 nw4r::lyt::TexCoordAry::SetSize
+80084570 nw4r::lyt::TexCoordAry::Copy
+80084610 nw4r::lyt::detail::IsModulateVertexColor
+80084680 nw4r::lyt::detail::MultipleAlpha
+800846d0 SetVertexFormat
+80084780 0x8008477c
+800847c0 nw4r::lyt::detail::DrawQuad
+80084d20 nw4r::lyt::detail::DrawQuad
+80084e90 nw4r::lyt::BindAnimation
+80084f00 nw4r::math::detail::FExp
+80084fa0 nw4r::math::detail::FLog
+80085040 nw4r::math::FrSqrt
+80085070 nw4r::math::Hermite
+800850b0 nw4r::math::CntBit1
+80085110 nw4r::math::SinFIdx
+80085180 nw4r::math::CosFIdx
+800851e0 nw4r::math::SinCosFIdx
+80085250 nw4r::math::AtanFIdx
+800853c0 nw4r::math::Atan2FIdx
+80085580 nw4r::math::VEC3Maximize
+800855c0 nw4r::math::VEC3Minimize
+80085600 nw4r::math::MTX33Identity
+80085630 nw4r::math::MTX34ToMTX33
+80085670 MTX34InvTranspose__Q24nw4r4mathFPQ34nw4r4math5MTX
+80085740 nw4r::math::MTX34Zero
+80085760 MTX34Mult__Q24nw4r4mathFPQ34nw4r4math5MTX34PCQ34n
+800857b0 nw4r::math::MTX34Scale
+80085810 nw4r::math::MTX34Trans
+80085880 MTX34MAdd__Q24nw4r4mathFPQ34nw4r4math5MTX34fPCQ34
+80085900 nw4r::math::MTX34RotAxisFIdx
+80085940 nw4r::math::MTX34RotXYZFIdx
+80085ab0 nw4r::math::VEC3TransformNormal
+80085b40 nw4r::math::MTX44Identity
+80085b80 nw4r::math::MTX44Copy
+80085bd0 nw4r::math::AABB::Set
+80085c90 nw4r::math::AABB::Set
+80085e70 nw4r::math::FRUSTUM::Set(fovy)
+80085f30 nw4r::math::FRUSTUM::Set(4 dirs)
+80086610 nw4r::math::FRUSTUM::IntersectAABB_Ex
+800867c0 nw4r::math::SolveEquation2
+80086920 nw4r::snd::FxReverbHiDpl2::__dt
+800869a0 nw4r::snd::FxReverbStdDpl2::__dt
+80086a20 0x80086a1c
+80086aa0 0x80086a9c
+80086b20 nw4r::snd::detail::AnimSoundImpl::__ct
+80086ba0 nw4r::snd::detail::AnimSoundImpl::__dt
+80086c70 nw4r::snd::detail::AnimSoundImpl::Setup
+80086d70 nw4r::snd::detail::AnimSoundImpl::UpdateFrame
+80086ea0 nw4r::snd::detail::AnimSoundImpl::UpdateForward
+800870c0 nw4r::snd::detail::AnimSoundImpl::UpdateBackward
+80087340 nw4r::snd::detail::AnimSoundImpl::UpdateTrigger
+800875c0 nw4r::snd::detail::AnimSoundImpl::UpdateForwardRa
+800878d0 nw4r::snd::detail::AnimSoundImpl::UpdateBackwardR
+80087be0 nw4r::snd::detail::AnimSoundImpl::StartEvent
+80087d80 nw4r::snd::detail::AnimSoundImpl::HoldEvent
+80087f50 nw4r::snd::detail::AnimEventPlayer::__ct
+80087f70 nw4r::snd::detail::AnimEventPlayer::__dt
+80088000 nw4r::snd::detail::WriteSoundId
+80088100 nw4r::snd::detail::AnimSoundFileReader::__ct
+80088110 nw4r::snd::detail::AnimSoundFileReader::Setup
+80088180 nw4r::snd::detail::AnimSoundFileReader::Shutdown
+80088190 nw4r::snd::detail::AnimSoundFileReader::GetEventC
+800881e0 nw4r::snd::detail::AnimSoundFileReader::GetEventR
+80088240 nw4r::snd::detail::AnimSoundFileReader::GetEvent
+800882c0 nw4r::snd::detail::AxManager::__ct
+80088770 nw4r::ut::LinkList::__ct
+80088790 nw4r::ut::LinkList::__dt
+800887f0 nw4r::snd::detail::AxManager::GetInstance
+80088860 nw4r::snd::detail::AxManager::__dt
+800888e0 nw4r::snd::detail::AxManager::Init
+80088920 0x80088914
+800889c0 nw4r::snd::detail::AxManager::Shutdown
+80088a70 nw4r::snd::detail::AxManager::GetOutputVolume
+80088ae0 nw4r::snd::detail::AxManager::Update
+80088eb0 nw4r::snd::detail::AxManager::GetZeroBufferAddres
+80088ec0 nw4r::snd::detail::AxManager::RegisterCallback
+80088f30 nw4r::snd::detail::AxManager::UnregisterCallback
+80088f90 nw4r::snd::detail::AxManager::SetOutputMode
+800890a0 nw4r::snd::detail::AxManager::GetOutputMode
+800890b0 nw4r::snd::detail::AxManager::AxCallbackFunc
+80089210 nw4r::snd::detail::AxManager::AppendEffect
+80089400 nw4r::snd::detail::AxManager::ClearEffect
+800894d0 nw4r::snd::detail::AxManager::ShutdownEffect
+800895d0 nw4r::snd::detail::AxManager::AuxCallbackFunc
+800899b0 nw4r::snd::detail::AxManager::PrepareReset
+80089a00 0x800899f4
+80089a80 nw4r::snd::detail::AxManager::AiDmaCallbackFunc
+80089bb0 nw4r::snd::detail::AxVoice::__ct
+80089c00 nw4r::snd::detail::AxVoice::__dt
+80089c40 nw4r::snd::detail::AxVoice::Setup
+80089cc0 nw4r::snd::detail::AxVoice::IsPlayFinished
+80089e00 nw4r::snd::detail::AxVoice::SetLoopStart
+80089f20 nw4r::snd::detail::AxVoice::SetLoopEnd
+8008a050 nw4r::snd::detail::AxVoice::SetLoopFlag
+8008a0f0 nw4r::snd::detail::AxVoice::StopAtPoint
+8008a2f0 nw4r::snd::detail::AxVoice::IsDataAddressCoverd
+8008a390 nw4r::snd::detail::AxVoice::GetCurrentPlayingSamp
+8008a540 nw4r::snd::detail::AxVoice::VoiceCallback
+8008a5a0 nw4r::snd::detail::AxVoice::GetSampleByDspAddress
+8008a610 nw4r::snd::detail::AxVoice::SetPriority
+8008a630 nw4r::snd::detail::AxVoice::SetVoiceType
+8008a690 nw4r::snd::detail::AxVoice::EnableRemote
+8008a6f0 nw4r::snd::detail::AxVoice::ResetDelta
+8008a840 nw4r::snd::detail::AxVoice::SetAddr
+8008ac00 nw4r::snd::detail::AxVoice::SetSrcType
+8008ace0 nw4r::snd::detail::AxVoice::SetAdpcm
+8008ae30 nw4r::snd::detail::AxVoice::IsNeedNextUpdate
+8008af60 nw4r::snd::detail::AxVoice::SetAdpcmLoop
+8008b040 nw4r::snd::detail::AxVoice::SetMix
+8008b660 nw4r::snd::detail::AxVoice::SetRmtMix
+8008b6f0 nw4r::snd::detail::AxVoice::SetSrc
+8008b8c0 nw4r::snd::detail::AxVoice::SetVe
+8008b9a0 nw4r::snd::detail::AxVoice::SetLpf
+8008bb30 nw4r::snd::detail::AxVoice::SetRemoteFilter
+8008bcc0 nw4r::snd::detail::AxVoice::CalcOffsetAdpcmParam
+8008bd70 0x8008bd70
+8008be00 nw4r::snd::detail::AxVoiceParamBlock::Sync
+8008bfb0 nw4r::snd::detail::AxVoiceParamBlock::Set
+8008bfe0 nw4r::snd::detail::AxVoiceParamBlock::SetVoiceMix
+8008c260 nw4r::snd::detail::AxVoiceParamBlock::SetVoiceSrc
+8008c340 nw4r::snd::detail::AxVoiceParamBlock::SetVoiceRmt
+8008c530 nw4r::snd::detail::AxVoiceParamBlock::SetVoiceRmt
+8008c540 0x8008c538
+8008c6c0 nw4r::snd::detail::AxVoiceManager::GetInstance
+8008c770 nw4r::snd::detail::AxVoiceManager::~AxVoiceManage
+8008c800 nw4r::snd::detail::AxVoiceManager::GetRequiredMem
+8008c810 nw4r::snd::detail::AxVoiceManager::Setup
+8008c8c0 nw4r::snd::detail::AxVoiceManager::Shutdown
+8008cb60 nw4r::snd::detail::AxVoiceManager::AcquireAxVoice
+8008ce30 nw4r::snd::detail::AxVoiceManager::FreeAxVoice
+8008cf00 nw4r::snd::detail::AxVoiceManager::ReserveForFree
+8008cfa0 nw4r::snd::detail::AxVoiceManager::FreeAllReserve
+8008d120 nw4r::snd::detail::AxFxImpl::CreateHeap
+8008d190 nw4r::snd::detail::AxFxImpl::DestroyHeap
+8008d1e0 nw4r::snd::detail::AxFxImpl::HookAlloc
+8008d240 nw4r::snd::detail::AxFxImpl::RestoreAlloc
+8008d280 nw4r::snd::detail::AxFxImpl::Alloc
+8008d2e0 nw4r::snd::detail::AxFxImpl::Free
+8008d320 nw4r::snd::detail::Bank::__ct
+8008d360 nw4r::snd::detail::Bank::__dt
+8008d3a0 nw4r::snd::detail::Bank::NoteOn
+8008d5a0 nw4r::snd::detail::BankFileReader::__ct
+8008d630 nw4r::snd::detail::BankFileReader::GetInstParam
+8008d740 nw4r::snd::detail::BankFileReader::ReadInstInfo
+8008d8e0 nw4r::snd::detail::BankFileReader::GetReferenceToSubRegion
+8008da00 nw4r::snd::detail::BankFileReader::ReadWaveInfo
+8008dc60 nw4r::snd::detail::BasicPlayer::__ct
+8008df60 nw4r::snd::detail::BasicPlayer::InitParam
+8008e040 nw4r::snd::detail::BasicPlayer::SetFxSend
+8008e050 nw4r::snd::detail::BasicPlayer::GetFxSend
+8008e060 nw4r::snd::detail::BasicPlayer::SetRemoteOutVolume
+8008e070 nw4r::snd::detail::BasicPlayer::GetRemoteOutVolume
+8008e080 nw4r::snd::detail::BasicPlayer::GetRemoteSend
+8008e090 nw4r::snd::detail::BasicPlayer::GetRemoteFxSend
+8008e0a0 nw4r::snd::detail::BasicPlayer::__dt
+8008e0e0 nw4r::snd::detail::BasicSound::__ct
+8008e170 0x8008e16c
+8008e1c0 nw4r::snd::detail::BasicSound::InitParam
+8008e310 nw4r::snd::detail::BasicSound::StartPrepared
+8008e330 nw4r::snd::detail::BasicSound::Stop
+8008e520 nw4r::snd::detail::BasicSound::Pause
+8008e780 nw4r::snd::detail::BasicSound::SetAutoStopCounter
+8008e7a0 nw4r::snd::detail::BasicSound::FadeIn
+8008e8b0 nw4r::snd::detail::BasicSound::IsPause
+8008e8d0 nw4r::snd::detail::BasicSound::Update
+8008eee0 nw4r::snd::detail::BasicSound::UpdateMoveValue
+8008ef20 nw4r::snd::detail::BasicSound::UpdateParam
+8008f2c0 nw4r::snd::detail::BasicSound::Shutdown
+8008f430 nw4r::snd::detail::BasicSound::AttachPlayerHeap
+8008f440 nw4r::snd::detail::BasicSound::DetachPlayerHeap
+8008f450 nw4r::snd::detail::BasicSound::AttachSoundPlayer
+8008f460 nw4r::snd::detail::BasicSound::DetachSoundPlayer
+8008f470 nw4r::snd::detail::BasicSound::AttachSoundActor
+8008f480 nw4r::snd::detail::BasicSound::DetachSoundActor
+8008f490 nw4r::snd::detail::BasicSound::AttachExternalSound
+8008f4a0 nw4r::snd::detail::BasicSound::DetachExternalSound
+8008f4b0 nw4r::snd::detail::BasicSound::GetVoiceOutCount
+8008f4c0 nw4r::snd::detail::BasicSound::SetPlayerPriority
+8008f520 nw4r::snd::detail::BasicSound::OnUpdatePlayerPriority
+8008f530 nw4r::snd::detail::BasicSound::SetInitialVolume
+8008f560 nw4r::snd::detail::BasicSound::SetVolume
+8008f610 nw4r::snd::detail::BasicSound::SetPitch
+8008f620 nw4r::snd::detail::BasicSound::SetPan
+8008f630 nw4r::snd::detail::BasicSound::SetLpfFreq
+8008f640 nw4r::snd::detail::BasicSound::SetOutputLine
+8008f650 nw4r::snd::detail::BasicSound::SetRemoteOutVolume
+8008f690 nw4r::snd::detail::BasicSound::SetFxSend
+8008f6a0 nw4r::snd::detail::BasicSound::SetRemoteFilter
+8008f6e0 nw4r::snd::detail::BasicSound::SetPanMode
+8008f720 nw4r::snd::detail::BasicSound::SetPanCurve
+8008f760 nw4r::snd::detail::BasicSound::SetAmbientInfo
+8008f830 nw4r::snd::detail::BasicSound::GetAmbientPriority
+8008f870 nw4r::snd::detail::BasicSound::IsAttachedGeneralHandle
+8008f890 nw4r::snd::detail::BasicSound::IsAttachedTempGeneralHandle
+8008f8b0 nw4r::snd::detail::BasicSound::DetachGeneralHandle
+8008f8c0 nw4r::snd::detail::BasicSound::DetachTempGeneralHandle
+8008f8d0 nw4r::snd::detail::BasicSound::SetId
+8008f910 nw4r::snd::detail::BasicSound::__dt
+8008f950 nw4r::snd::detail::BasicSound::GetRuntimeTypeInfo
+8008f960 0x8008f958
+8008f970 nw4r::snd::detail::ChannelManager::GetInstance
+8008f9f0 nw4r::snd::detail::ChannelManager::__dt
+8008fa50 nw4r::snd::detail::ChannelManager::GetRequiredMemSize
+8008fa60 nw4r::snd::detail::ChannelManager::Setup
+8008fb00 nw4r::snd::detail::ChannelManager::Shutdown
+8008fc80 nw4r::snd::detail::ChannelManager::UpdateAllChannel
+8008fce0 nw4r::snd::detail::Channel::InitParam
+8008fe10 nw4r::snd::detail::Channel::Update
+80090000 0x80090000
+800905b0 nw4r::snd::detail::Channel::Start
+80090630 nw4r::snd::detail::Channel::Release
+800906a0 nw4r::snd::detail::Channel::NoteOff
+80090720 nw4r::snd::detail::Channel::Stop
+80090850 nw4r::snd::detail::Channel::UpdateSweep
+80090870 nw4r::snd::detail::Channel::SetSweepParam
+80090890 nw4r::snd::detail::Channel::VoiceCallbackFunc
+800909e0 nw4r::snd::detail::Channel::AllocChannel
+80090be0 nw4r::snd::detail::Channel::FreeChannel
+80090c00 nw4r::snd::detail::DisposeCallbackManager::GetInstance
+80090ca0 0x80090c94
+80090d00 nw4r::snd::detail::DisposeCallbackManager::RegisterDisposeCallback
+80090d30 nw4r::snd::detail::DisposeCallbackManager::UnregisterDisposeCallback
+80090d40 nw4r::snd::detail::DisposeCallbackManager::Dispose
+80090e80 nw4r::snd::detail::DisposeCallbackManager::DisposeWave
+80090fc0 nw4r::snd::DvdSoundArchive::__ct
+80091010 nw4r::snd::DvdSoundArchive::__dt
+80091090 nw4r::snd::DvdSoundArchive::Open
+800911d0 nw4r::snd::DvdSoundArchive::Close
+80091210 nw4r::snd::DvdSoundArchive::OpenStream
+800912c0 nw4r::snd::DvdSoundArchive::OpenExtStream
+80091380 nw4r::snd::DvdSoundArchive::detail_GetRequiredStreamBufferSize
+80091390 nw4r::snd::DvdSoundArchive::LoadHeader
+80091420 nw4r::snd::DvdSoundArchive::LoadLabelStringData
+800914b0 nw4r::snd::DvdSoundArchive::DvdFileStream::Read
+800914e0 nw4r::snd::DvdSoundArchive::DvdFileStream::Seek
+80091560 nw4r::ut::DvdFileStream::GetBufferAlign
+80091570 nw4r::ut::DvdFileStream::GetSizeAlign
+80091580 nw4r::ut::DvdFileStream::GetOffsetAlign
+80091590 nw4r::ut::DvdFileStream::CanCancel
+800915a0 nw4r::ut::DvdFileStream::CanWrite
+800915b0 nw4r::ut::DvdFileStream::CanRead
+800915c0 nw4r::ut::DvdFileStream::CanSeek
+800915d0 nw4r::ut::DvdFileStream::IsBusy
+800915e0 nw4r::ut::DvdLockedFileStream::CanAsync
+800915f0 nw4r::ut::DvdLockedFileStream::PeekAsync
+80091600 nw4r::ut::DvdLockedFileStream::ReadAsync
+80091610 nw4r::ut::DvdLockedFileStream::GetRuntimeTypeInfo
+80091620 nw4r::snd::DvdSoundArchive::DvdFileStream::GetSize
+80091630 nw4r::snd::DvdSoundArchive::DvdFileStream::Tell
+80091640 nw4r::snd::DvdSoundArchive::detail_GetWaveDataFileAddress
+80091650 nw4r::snd::DvdSoundArchive::detail_GetFileAddress
+80091660 nw4r::snd::DvdSoundArchive::DvdFileStream::__dt
+800916c0 nw4r::snd::detail::EnvGenerator::__ct
+80091710 0x80091710
+80091750 0x80091750
+80091770 0x80091770
+800917a0 0x800917a0
+80091900 0x80091900
+80091920 0x80091920
+80091940 0x80091940
+800919e0 0x800919e0
+800919f0 0x800919f0
+80091a90 nw4r::snd::detail::ExternalSoundPlayer::__ct
+80091ac0 nw4r::snd::detail::ExternalSoundPlayer::__dt
+80091b60 nw4r::snd::detail::ExternalSoundPlayer::DetachSoundActorAll
+80091bc0 nw4r::snd::detail::ExternalSoundPlayer::AppendSound
+80091d70 nw4r::snd::detail::ExternalSoundPlayer::SetPlayableSoundCount
+80091e30 nw4r::snd::detail::ExternalSoundPlayer::RemoveSound
+80091e80 nw4r::snd::detail::ExternalSoundPlayer::detail_CanPlaySound
+80091f50 nw4r::snd::detail::FrameHeap::__ct
+80091f80 0x80091f80
+80092090 nw4r::snd::detail::FrameHeap::Create
+80092230 nw4r::snd::detail::FrameHeap::Destroy
+80092320 0x80092320
+80092450 nw4r::snd::detail::FrameHeap::Alloc
+80092500 nw4r::snd::detail::FrameHeap::SaveState
+800925d0 nw4r::snd::detail::FrameHeap::LoadState
+80092800 nw4r::snd::detail::FrameHeap::GetCurrentLevel
+80092810 nw4r::snd::detail::FrameHeap::GetFreeSize
+80092850 0x80092850
+80092860 0x80092860
+800928f0 0x800928f0
+80092920 0x8009291c
+80092930 0x80092930
+80092940 0x80092940
+80092a00 0x80092a00
+80092a70 0x80092a70
+80092c20 0x80092c14
+80092c80 0x80092c78
+80092d00 0x80092d00
+80092d90 0x80092d90
+80092df0 0x80092de4
+80092e00 0x80092e00
+80092e10 0x80092e10
+80092f40 0x80092f40
+80092fc0 0x80092fc0
+800931c0 0x800931bc
+80093260 0x80093260
+800932d0 0x800932d0
+80093360 0x80093360
+80093390 0x8009338c
+800933a0 0x800933a0
+800933b0 0x800933b0
+80093470 0x80093470
+800934e0 0x800934e0
+800936d0 0x800936cc
+80093730 0x80093728
+800937b0 0x800937b0
+80093840 0x80093840
+800938a0 0x80093894
+800938b0 0x800938b0
+800938c0 0x800938c0
+800939f0 0x800939f0
+80093a70 0x80093a70
+80093cd0 0x80093ccc
+80093d70 0x80093d70
+80093de0 nw4r::snd::FxReverbHi::__ct
+80093eb0 nw4r::snd::FxReverbHi::GetRequiredMemSize
+80093ee0 0x80093edc
+80093ef0 0x80093ef0
+80093f00 0x80093f00
+80093fc0 0x80093fc0
+80094030 nw4r::snd::FxReverbHi::SetParam
+80094300 0x800942fc
+80094360 0x80094358
+800943e0 nw4r::snd::FxReverbHiDpl2::__ct
+800944b0 nw4r::snd::FxReverbHiDpl2::GetRequiredMemSize
+80094510 nw4r::snd::FxReverbHiDpl2::AssignWorkBuffer
+80094520 nw4r::snd::FxReverbHiDpl2::ReleaseWorkBuffer
+80094530 nw4r::snd::FxReverbHiDpl2::StartUp
+80094660 nw4r::snd::FxReverbHiDpl2::Shutdown
+800946e0 nw4r::snd::FxReverbHiDpl2::SetParam
+80094a40 nw4r::snd::FxReverbHiDpl2::UpdateBuffer
+80094ae0 nw4r::snd::FxReverbHiDpl2::OnChangeOutputMode
+80094b50 0x80094b50
+80094c20 0x80094c20
+80094c50 0x80094c4c
+80094c60 0x80094c60
+80094c70 0x80094c70
+80094d30 0x80094d30
+80094da0 0x80094da0
+80095040 0x80095038
+800950a0 0x80095098
+80095120 nw4r::snd::FxReverbStdDpl2::__ct
+800951f0 nw4r::snd::FxReverbStdDpl2::GetRequiredMemSize
+80095250 nw4r::snd::FxReverbStdDpl2::AssignWorkBuffer
+80095260 nw4r::snd::FxReverbStdDpl2::ReleaseWorkBuffer
+80095270 nw4r::snd::FxReverbStdDpl2::StartUp
+800953a0 nw4r::snd::FxReverbStdDpl2::Shutdown
+80095420 nw4r::snd::FxReverbStdDpl2::SetParam
+80095740 nw4r::snd::FxReverbStdDpl2::UpdateBuffer
+800957e0 nw4r::snd::FxReverbStdDpl2::OnChangeOutputMode
+80095850 nw4r::snd::detail::PoolImpl::CreateImpl
+800959a0 nw4r::snd::detail::PoolImpl::DestroyImpl
+80095a30 nw4r::snd::detail::PoolImpl::CountImpl
+80095a90 nw4r::snd::detail::PoolImpl::AllocImpl
+80095af0 nw4r::snd::detail::PoolImpl::FreeImpl
+80095b40 nw4r::snd::detail::LfoParam::Init
+80095b70 0x80095b70
+80095b90 0x80095b90
+80095c30 0x80095c30
+80095d50 0x80095d48
+80095d60 0x80095d58
+80095d70 0x80095d68
+80095d80 nw4r::snd::MemorySoundArchive::__ct
+80095dd0 nw4r::snd::MemorySoundArchive::__dt
+80095e30 nw4r::snd::MemorySoundArchive::Setup
+80095eb0 0x80095eb0
+80095ec0 0x80095ec0
+80095f70 0x80095f70
+80096020 0x80096020
+80096080 0x80096080
+80096090 0x80096088
+800960a0 0x80096098
+800960c0 0x800960b4
+80096120 0x80096118
+80096170 0x80096168
+80096180 0x80096178
+80096190 0x80096188
+800961a0 0x80096198
+800961b0 0x800961a8
+800961c0 0x800961b8
+800961d0 0x800961c8
+800961e0 0x800961d8
+800961f0 0x800961e8
+80096230 nw4r::snd::detail::SeqPlayer::OnUpdateFrameSoundThread
+80096240 nw4r::snd::detail::SeqPlayer::OnShutdownSoundThread
+80096250 nw4r::snd::detail::SeqPlayer::InvalidateWaveData
+80096260 nw4r::snd::detail::SoundThread::PlayerCallback::OnUpdateVoiceSoundThread
+80096270 nw4r::snd::detail::SeqPlayer::IsPause
+80096280 nw4r::snd::detail::SeqPlayer::IsStarted
+80096290 nw4r::snd::detail::SeqPlayer::IsActive
+800962a0 nw4r::snd::detail::SeqPlayer::InvalidateWaveData(thunk)
+800962b0 nw4r::snd::detail::SeqPlayer::InvalidateData(thunk)
+800962c0 nw4r::snd::detail::SeqPlayer::OnShutdownSoundThread(thunk)
+800962d0 nw4r::snd::detail::SeqPlayer::OnUpdateFrameSoundThread(thunk)
+800962e0 0x800962e0
+80096970 0x80096970
+800969c0 0x80096970_switch
+800969c4 0x80096970_caseD_e1
+800969e4 0x80096970_caseD_b0
+800969ec 0x80096970_caseD_81
+80096a04 0x80096970_caseD_dd
+80096a14 0x80096970_caseD_c1
+80096a60 0x80096970_caseD_d5
+80096a68 0x80096970_caseD_c2
+80096a70 0x80096970_caseD_c3
+80096a78 0x80096970_caseD_c4
+80096a80 0x80096970_caseD_c5
+80096a88 0x80096970_caseD_c0
+80096ae4 0x80096970_caseD_dc
+80096af0 0x80096970_caseD_d7
+80096b48 0x80096970_caseD_c6
+80096b50 0x80096970_caseD_c7
+80096b64 0x80096970_caseD_cf
+80096b6c 0x80096970_caseD_ca
+80096b98 0x80096970_caseD_cb
+80096bc4 0x80096970_caseD_cc
+80096bcc 0x80096970_caseD_cd
+80096bd4 0x80096970_caseD_e0
+80096be4 0x80096970_caseD_e3
+80096c10 0x80096970_caseD_d0
+80096c18 0x80096970_caseD_d1
+80096c20 0x80096970_caseD_d2
+80096c28 0x80096970_caseD_d3
+80096c30 0x80096970_caseD_b1
+80096c3c 0x80096970_caseD_df
+80096c60 0x80096970_caseD_c8
+80096c88 0x80096970_caseD_b2
+80096cb4 0x80096970_caseD_c9
+80096ccc 0x80096970_caseD_ce
+80096ce0 0x80096970_caseD_d8
+80096ce8 0x80096970_caseD_d9
+80096cf0 0x80096970_caseD_da
+80096cf8 0x80096970_caseD_de
+80096d00 0x80096970_caseD_db
+80096d08 0x80096970_caseD_d6
+80096db4 0x80096970_caseD_88
+80096df4 0x80096970_caseD_89
+80096e04 0x80096970_caseD_8a
+80096e44 0x80096970_caseD_fd
+80096e94 0x80096970_caseD_d4
+80096ecc 0x80096970_caseD_fc
+80096fa4 0x80096970_switch
+80096fa8 0x80096970_caseD_80
+80096fb0 0x80096970_caseD_81
+80096fc0 0x80096970_caseD_82
+80096fd0 0x80096970_caseD_83
+80096fe0 0x80096970_caseD_84
+80096ff8 0x80096970_caseD_85
+80097024 0x80096970_caseD_86
+80097064 0x80096970_caseD_87
+80097074 0x80096970_caseD_88
+80097084 0x80096970_caseD_89
+80097094 0x80096970_caseD_8a
+800970a4 0x80096970_caseD_8b
+800970c4 0x80096970_caseD_90
+800970dc 0x80096970_caseD_91
+800970f8 0x80096970_caseD_92
+80097118 0x80096970_caseD_93
+80097134 0x80096970_caseD_94
+80097154 0x80096970_caseD_95
+8009716c 0x80096970_caseD_82
+80097190 0x80097184
+800971b0 0x800971b0
+80097320 0x80097320
+80097360 0x80097360
+800973a0 0x8009739c
+800973c0 0x800973c0
+80097420 0x80097418
+80097490 0x80097488
+80097500 0x80097500
+80097510 0x80097510
+80097520 0x80097520
+80097530 0x80097530
+80097570 nw4r::snd::NandSoundArchive::__ct
+800975c0 nw4r::snd::NandSoundArchive::__dt
+80097650 0x80097650
+80097790 0x80097790
+800977e0 0x800977dc
+800978a0 0x80097898
+80097980 0x8009797c
+800979e0 0x800979d8
+800979f0 0x800979f0
+80097ab0 0x80097ab0
+80097b60 0x80097b60
+80097c10 0x80097c10
+80097ca0 0x80097c94
+80097cf0 0x80097cec
+80097d20 0x80097d20
+80097d30 0x80097d28
+80097d40 0x80097d38
+80097d50 0x80097d48
+80097d60 0x80097d58
+80097d70 0x80097d68
+80097d80 0x80097d78
+80097d90 0x80097d88
+80097da0 0x80097d98
+80097db0 0x80097da8
+80097dc0 0x80097db8
+80097dd0 0x80097dc8
+80097de0 0x80097de0
+80097df0 0x80097de8
+80097e00 nw4r::snd::PlayerHeap::__ct
+80097e30 nw4r::snd::PlayerHeap::__dt
+80097f00 nw4r::snd::PlayerHeap::Create
+80097f30 nw4r::snd::PlayerHeap::Alloc
+80097f60 nw4r::snd::PlayerHeap::Clear
+80097ff0 0x80097ff0
+80098000 0x80098000
+80098010 0x80098010
+80098020 0x80098020
+800980a0 0x800980a0
+80098160 nw4r::snd::RemoteSpeaker::Shutdown
+80098210 0x80098210
+80098230 0x80098230
+80098310 0x80098310
+80098620 0x80098618
+80098730 nw4r::snd::detail::RemoteSpeakerManager::SpeakerOnCallback
+80098820 0x80098818
+80098910 0x80098908
+80098960 0x80098958
+800989d0 nw4r::snd::detail::RemoteSpeakerManager::GetInstance
+80098a70 nw4r::snd::detail::RemoteSpeakerManager::GetRemoteSpeaker
+80098a80 nw4r::snd::detail::RemoteSpeakerManager::Setup
+80098b20 0x80098b20
+80098b70 0x80098b64
+80098c70 nw4r::snd::detail::SeqFileReader::__ct
+80098ce0 nw4r::snd::detail::SeqFileReader::GetBaseAddress
+80098cf0 nw4r::snd::detail::SeqFileReader::ReadOffsetByLab
+80098db0 nw4r::snd::detail::SeqPlayer::__ct
+80098ef0 nw4r::snd::detail::SeqPlayer::__dt
+80099080 nw4r::snd::detail::SeqPlayer::InitParam
+800991a0 nw4r::snd::detail::SeqPlayer::Setup
+80099440 nw4r::snd::detail::SeqPlayer::SetSeqData
+800994c0 nw4r::snd::detail::SeqPlayer::Start
+80099530 nw4r::snd::detail::SeqPlayer::Stop
+80099680 nw4r::snd::detail::SeqPlayer::Pause
+80099710 nw4r::snd::detail::SeqPlayer::Skip
+800997d0 nw4r::snd::detail::SeqPlayer::SetTempoRatio
+800997e0 nw4r::snd::detail::SeqPlayer::SetChannelPriority
+800997f0 nw4r::snd::detail::SeqPlayer::SetReleasePriorityFix
+80099800 nw4r::snd::detail::SeqPlayer::SetLocalVariable
+80099810 nw4r::snd::detail::SeqPlayer::SetGlobalVariable
+80099880 nw4r::snd::detail::SeqPlayer::SetTrackVolume
+80099960 nw4r::snd::detail::SeqPlayer::SetTrackPitch
+80099a40 nw4r::snd::detail::SeqPlayer::InvalidateData
+80099c00 nw4r::snd::detail::SeqPlayer::GetPlayerTrack
+80099c20 nw4r::snd::detail::SeqPlayer::ParseNextTick
+80099d50 nw4r::snd::detail::SeqPlayer::GetVariablePtr
+80099d90 nw4r::snd::detail::SeqPlayer::Update
+80099ea0 nw4r::snd::detail::SeqPlayer::UpdateTick
+8009a110 nw4r::snd::detail::SeqPlayer::SkipTick
+8009a3b0 nw4r::snd::detail::SeqPlayer::NoteOn
+8009a3e0 nw4r::snd::detail::SeqPlayer::NoteOn
+8009a3f0 nw4r::snd::detail::SeqPlayer::__dt(thunk)
+8009a400 nw4r::snd::detail::SeqPlayer::__dt(thunk)
+8009a410 nw4r::snd::detail::SeqSound::__ct
+8009a4b0 nw4r::snd::detail::SeqSound::SeqLoadTask::__dt
+8009a510 nw4r::snd::detail::SeqSound::InitParam
+8009a550 nw4r::snd::detail::SeqSound::Setup
+8009a5d0 nw4r::snd::detail::SeqSound::Prepare(raw)
+8009a640 nw4r::snd::detail::SeqSound::Prepare(fileStream)
+8009a740 nw4r::snd::detail::SeqSound::NotifyLoadAsyncEndSeqData
+8009a7c0 nw4r::snd::detail::SeqSound::Shutdown
+8009a8a0 nw4r::snd::detail::SeqSound::__dt
+8009a910 nw4r::snd::detail::SeqSound::SetTempoRatio
+8009a920 nw4r::snd::detail::SeqSound::SetChannelPriority
+8009a930 nw4r::snd::detail::SeqSound::SetReleasePriorityFix
+8009a940 nw4r::snd::detail::SeqSound::OnUpdatePlayerPriority
+8009aa30 nw4r::snd::detail::SeqSound::SetTrackVolume
+8009aa40 nw4r::snd::detail::SeqSound::SetTrackPitch
+8009aa50 nw4r::snd::detail::SeqSound::WriteVariable
+8009aa80 nw4r::snd::detail::SeqSound::WriteGlobalVariable
+8009aab0 nw4r::snd::detail::SeqSound::GetTick
+8009aad0 nw4r::snd::detail::SeqSound::IsAttachedTempSpecialHandle
+8009aaf0 nw4r::snd::detail::SeqSound::DetachTempSpecialHandle
+8009ab00 nw4r::snd::detail::SeqSound::SeqLoadTask::Execute
+8009ac00 nw4r::snd::detail::SeqSound::SeqLoadTask::Cancel
+8009ac30 nw4r::snd::detail::SeqSound::SeqLoadTask::OnCancel
+8009ac60 nw4r::snd::detail::SeqSound::GetBasicPlayer(const)
+8009ac70 nw4r::snd::detail::SeqSound::GetBasicPlayer
+8009ac80 nw4r::snd::detail::SeqSound::IsPrepared
+8009ac90 nw4r::snd::detail::SeqSound::GetRuntimeTypeInfo
+8009aca0 0x8009ac98
+8009acb0 nw4r::snd::SeqSoundHandle::__ct
+8009adc0 nw4r::snd::SeqSoundHandle::DetachSound
+8009ae00 nw4r::snd::detail::SeqTrack::SetPlayerTrackNo
+8009ae10 nw4r::snd::detail::SeqTrack::__ct
+8009aea0 nw4r::snd::detail::SeqTrack::__dt
+8009afb0 nw4r::snd::detail::SeqTrack::InitParam
+8009b150 nw4r::snd::detail::SeqTrack::SetSeqData
+8009b160 nw4r::snd::detail::SeqTrack::Open
+8009b180 nw4r::snd::detail::SeqTrack::Close
+8009b250 nw4r::snd::detail::SeqTrack::UpdateChannelLength
+8009b320 nw4r::snd::detail::SeqTrack::ParseNextTick
+8009b4a0 nw4r::snd::detail::SeqTrack::ReleaseAllChannel
+8009b530 nw4r::snd::detail::SeqTrack::PauseAllChannel
+8009b5d0 nw4r::snd::detail::SeqTrack::UpdateChannelParam
+8009bba0 nw4r::snd::detail::SeqTrack::FreeAllChannem
+8009bc10 nw4r::snd::detail::SeqTrack::ChannelCallbackFunc
+8009bd00 nw4r::snd::detail::SeqTrack::SetMute
+8009be70 nw4r::snd::detail::SeqTrack::SetVolume
+8009be80 nw4r::snd::detail::SeqTrack::SetPitch
+8009be90 nw4r::snd::detail::SeqTrack::GetVariablePtr
+8009beb0 nw4r::snd::detail::SeqTrack::NoteOn
+8009c2a0 nw4r::snd::Sound3DActor::__ct
+8009c330 nw4r::snd::Sound3DActor::__dt
+8009c410 nw4r::snd::Sound3DActor::SetupSound
+8009c590 nw4r::snd::Sound3DActor::SetPosition
+8009c5e0 nw4r::snd::Sound3DActor::SetVelocity
+8009c600 nw4r::snd::Sound3DActor::detail_UpdateAmbientArg
+8009c640 nw4r::snd::Sound3DActor::detail_UpdateAmbientArg(thunk)
+8009c650 nw4r::snd::Sound3DActor::__dt(thunk)
+8009c660 0x8009c660
+8009c790 0x8009c790
+8009c8f0 0x8009c8f0
+8009ca90 0x8009ca90
+8009cdd0 0x8009cdd0
+8009cf50 0x8009cf50
+8009d070 nw4r::snd::Sound3DEngine::__ct
+8009d0a0 nw4r::snd::Sound3DEngine::UpdateAmbientParam(updateFlag)
+8009d220 nw4r::snd::Sound3DEngine::UpdateAmbientParam(voiceOutCount)
+8009d280 nw4r::snd::Sound3DEngine::GetAmbientPriority
+8009d500 nw4r::snd::Sound3DEngine::GetRequiredVoiceOutCount
+8009d510 nw4r::snd::Sound3DEngine::__dt
+8009d550 nw4r::snd::Sound3DListener::__ct
+8009d5c0 nw4r::snd::Sound3DListener::SetMatrix
+8009d820 nw4r::snd::Sound3DListener::ResetMatrix
+8009d870 nw4r::snd::Sound3DListener::SetInteriorSize
+8009d880 nw4r::snd::Sound3DListener::SetMaxVolumeDistance
+8009d890 nw4r::snd::Sound3DListener::SetUnitDistance
+8009d8a0 nw4r::snd::Sound3DManager::__ct
+8009d900 nw4r::snd::Sound3DManager::GetRequiredMemSize
+8009d960 nw4r::snd::Sound3DManager::Setup
+8009d9a0 nw4r::snd::Sound3DManager::SetEngine
+8009d9b0 nw4r::snd::Sound3DManager::detail_UpdateAmbientParam
+8009da00 nw4r::snd::Sound3DManager::detail_GetAmbientPriority
+8009da40 nw4r::snd::Sound3DManager::detail_GetRequiredVoiceOutCount
+8009da80 nw4r::snd::Sound3DManager::detail_AllocAmbientArg
+8009daf0 nw4r::snd::Sound3DManager::detail_FreeAmbientArg
+8009db10 nw4r::snd::Sound3DParam::__ct
+8009db40 nw4r::snd::Sound3DManager::__dt
+8009dba0 0x8009dba0
+8009dbb0 nw4r::snd::Sound3DManager::detail_FreeAmbientArg(thunk)
+8009dbc0 nw4r::snd::Sound3DManager::detail_AllocAmbientArg(thunk)
+8009dbd0 nw4r::snd::Sound3DManager::__dt(thunk)
+8009dbe0 nw4r::snd::SoundActor::__ct
+8009dca0 nw4r::snd::SoundActor::__dt
+8009dd50 nw4r::snd::SoundActor::SetupSound
+8009dd70 nw4r::snd::SoundActor::detail_SetupSoundWithAmbientInfo
+8009dd90 nw4r::snd::SoundActor::detail_SetupSound
+8009ddd0 nw4r::snd::SoundActor::ConvertLabelStringToSoundId
+8009ddf0 nw4r::snd::SoundArchivePlayer::ConvertLabelStringTo
+8009de00 nw4r::snd::SoundArchive::__ct
+8009de30 nw4r::snd::SoundArchive::__dt
+8009de70 nw4r::snd::SoundArchive:IsAvailable
+8009de90 nw4r::snd::SoundArchive::Setup
+8009dea0 nw4r::snd::SoundArchive::Shutdown
+8009dec0 nw4r::snd::SoundArchive::GetPlayerCount
+8009ded0 nw4r::snd::SoundArchive::GetGroupCount
+8009dee0 nw4r::snd::SoundArchive::GetGroupLabelString
+8009def0 nw4r::snd::SoundArchive::GetBankLabelString
+8009df00 nw4r::snd::SoundArchive::ConvertLabelStringToSoundId
+8009df10 nw4r::snd::SoundArchive::ConvertLabelStringToGroupId
+8009df20 nw4r::snd::SoundArchive::GetSoundUserParam
+8009df30 nw4r::snd::SoundArchive::GetSoundType
+8009df40 nw4r::snd::SoundArchive::ReadSoundInfo
+8009df50 nw4r::snd::SoundArchive::detail_ReadSeqSoundInfo
+8009df60 nw4r::snd::SoundArchive::detail_ReadStrmSoundInfo
+8009df70 nw4r::snd::SoundArchive::detail_ReadWaveSoundInfo
+8009df80 nw4r::snd::SoundArchive::ReadPlayerInfo
+8009df90 nw4r::snd::SoundArchive::ReadSoundArchivePlayerInfo
+8009dfa0 nw4r::snd::SoundArchive::detail_ReadSound3DParam
+8009dfb0 nw4r::snd::SoundArchive::ReadBankInfo
+8009dfc0 nw4r::snd::SoundArchive::ReadGroupInfo
+8009dfd0 nw4r::snd::SoundArchive::detail_ReadGroupItemInfo
+8009dfe0 nw4r::snd::SoundArchive::detail_GetFileCount
+8009dff0 nw4r::snd::SoundArchive::detail_ReadFileInfo
+8009e000 nw4r::snd::SoundArchive::detail_ReadFilePos
+8009e010 nw4r::snd::SoundArchive::detail_OpenFileStream
+8009e240 nw4r::snd::SoundArchive::detail_OpenFileWaveDataStream
+8009e3d0 nw4r::snd::SoundArchive::detail_OpenGroupStream
+8009e4f0 nw4r::snd::SoundArchive::detail_OpenGroupWaveData
+8009e610 nw4r::snd::SoundArchive::SetExternalFileRoot
+8009e690 nw4r::snd::detail::SoundArchiveFileReader::__ct
+8009e6c0 nw4r::snd::detail::SoundArchiveFileReader::Init
+8009e770 nw4r::snd::detail::SoundArchiveFileReader::SetStringChunk
+8009e820 nw4r::snd::detail::SoundArchiveFileReader::SetInfoChunk
+8009e830 nw4r::snd::detail::SoundArchiveFileReader::GetSoundType
+8009e920 nw4r::snd::detail::SoundArchiveFileReader::ReadSoundInfo
+8009ea50 nw4r::snd::detail::SoundArchiveFileReader::ReadSound3DParam
+8009eb60 nw4r::snd::detail::SoundArchiveFileReader::ReadSeqSoundInfo
+8009ec10 nw4r::snd::detail::SoundArchiveFileReader::ReadStrmSoundInfo
+8009ece0 nw4r::snd::detail::SoundArchiveFileReader::ReadWaveSoundInfo
+8009ed80 nw4r::snd::detail::SoundArchiveFileReader::ReadBankInfo
+8009ee30 nw4r::snd::detail::SoundArchiveFileReader::ReadPlayerInfo
+8009eef0 nw4r::snd::detail::SoundArchiveFileReader::ReadGroupInfo
+8009f000 nw4r::snd::detail::SoundArchiveFileReader::ReadGroupItemInfo
+8009f140 nw4r::snd::detail::SoundArchiveFileReader::ReadSoundArchivePlayerInfo
+8009f1d0 nw4r::snd::detail::SoundArchiveFileReader::GetPlayerCount
+8009f210 nw4r::snd::detail::SoundArchiveFileReader::GetGroupCount
+8009f260 nw4r::snd::detail::SoundArchiveFileReader:GetGroupLabelString
+8009f340 nw4r::snd::detail::SoundArchiveFileReader:GetBankLabelString
+8009f420 nw4r::snd::detail::SoundArchiveFileReader::GetSoundUserParam
+8009f4e0 nw4r::snd::detail::SoundArchiveFileReader::GetFileCount
+8009f520 nw4r::snd::SoundArchiveFileReader::ReadFileInfo
+8009f620 nw4r::snd::detail::SoundArchiveFileReader::ReadFilePos
+8009f740 nw4r::snd::SoundArchiveFileReader::ConvertLabelStringToId
+8009f890 nw4r::snd::SoundArchiveFileReader::impl_GetSoundInfoOffset
+8009f990 nw4r::snd::detail::SoundArchiveLoader::__ct
+8009f9d0 nw4r::snd::detail::SoundArchiveLoader::__dt
+8009fa10 nw4r::snd::detail::SoundArchiveLoader::LoadGroup
+8009fff0 0x8009fff0
+800a0180 nw4r::snd::detail::SoundArchiveLoader::LoadFile(Allocatable)
+800a0260 nw4r::snd::detail::SoundArchiveLoader::ReadWaveDataFile
+800a0420 nw4r::snd::detail::SoundArchiveLoader::LoadWaveDataFile
+800a0500 nw4r::snd::SoundArchivePlayer::__ct
+800a0630 nw4r::snd::SoundArchivePlayer::SeqNoteOnCallback::__dt
+800a0670 nw4r::snd::SoundArchivePlayer::WsdCallback::__dt
+800a06b0 0x800a06b0
+800a06d0 nw4r::ut::LinkList::__dt
+800a0730 0x800a0728
+800a0750 nw4r::ut::LinkList::__dt
+800a07b0 0x800a07a8
+800a07d0 nw4r::ut::LinkList::__dt
+800a0830 nw4r::snd::SoundArchivePlayer::__dt
+800a08f0 nw4r::snd::SoundArchivePlayer::IsAvailable
+800a0910 nw4r::snd::SoundArchivePlayer::Setup
+800a0a20 nw4r::snd::SoundArchivePlayer::Shutdown
+800a0b50 nw4r::snd::SoundArchivePlayer::GetRequiredMemSize
+800a0c90 nw4r::snd::SoundArchivePlayer::GetRequiredStrmBufferSize
+800a0ce0 nw4r::snd::SoundArchivePlayer::SetupMram
+800a0f80 nw4r::snd::SoundArchivePlayer::CreatePlayerHeap
+800a1050 nw4r::snd::SoundArchivePlayer::SetupSoundPlayer
+800a1180 nw4r::snd::SoundArchivePlayer::Update
+800a1540 nw4r::snd::SoundArchivePlayer::GetSoundArchive
+800a1550 nw4r::snd::SoundArchivePlayer::GetSoundPlayer
+800a1560 nw4r::snd::SoundArchivePlayer::GetFileAddress
+800a16b0 nw4r::snd::SoundArchivePlayer::GetFileWaveDataAddress
+800a1800 nw4r::snd::SoundArchivePlayer::detail_SetupSound
+800a1820 nw4r::snd::SoundArchivePlayer::SetupSoundImpl
+800a2260 nw4r::snd::SoundArchivePlayer::PrepareSeqImpl
+800a25c0 nw4r::snd::SoundArchivePlayer::PrepareStrmImpl
+800a2770 nw4r::snd::SoundArchivePlayer::PrepareWaveSoundImpl
+800a28b0 nw4r::snd::SoundArchivePlayer::LoadGroup(id)
+800a2a20 nw4r::snd::SoundArchivePlayer::LoadGroup(str)
+800a2a90 nw4r::snd::SoundArchivePlayer::InvalidateData
+800a2af0 nw4r::snd::SoundArchivePlayer::InvalidateWaveData
+800a2b50 nw4r::snd::SoundArchivePlayer::SeqNoteOnCallback::NoteOn
+800a2c80 nw4r::snd::SoundArchivePlayer::WsdCallback::GetWaveSoundData
+800a2d80 nw4r::snd::SoundArchivePlayer::ConvertLabelStringToSoundId(thunk)
+800a2d90 nw4r::snd::SoundArchivePlayer::SetupSound(thunk)
+800a2da0 nw4r::snd::SoundArchivePlayer::__dt(thunk)
+800a2db0 nw4r::snd::SoundHandle::detail_AttachSoundAsTempHandle
+800a2e30 nw4r::snd::SoundHandle::detail_AttachSound
+800a2e80 nw4r::snd::SoundHandle::DetachSound
+800a2ed0 nw4r::snd::SoundHeap::__ct
+800a2f20 nw4r::snd::SoundHeap::__dt
+800a2f90 nw4r::snd::SoundHeap::Create
+800a2fa0 nw4r::snd::SoundHeap::Destroy
+800a2fb0 nw4r::snd::SoundHeap::Alloc(virtual)
+800a3020 nw4r::snd::SoundHeap::Alloc
+800a3090 0x800a3090
+800a3100 nw4r::snd::SoundHeap::SaveState
+800a3160 nw4r::snd::SoundHeap::LoadState
+800a31e0 0x800a31d4
+800a3250 nw4r::snd::SoundPlayer::_ct
+800a32f0 0x800a32ec
+800a3310 0x800a3310
+800a3370 nw4r::snd::SoundPlayer::_dt
+800a3450 nw4r::snd::SoundPlayer::Update
+800a34d0 nw4r::snd::SoundPlayer::StopAllSound
+800a3550 nw4r::snd::SoundPlayer::PauseAllSound
+800a35e0 nw4r::snd::SoundPlayer::SetVolume
+800a3610 nw4r::snd::SoundPlayer::nw4r::snd::SoundPlayer::GetVo
+800a3620 nw4r::snd::SoundPlayer::detail_SortPriorityList
+800a3720 nw4r::snd::SoundPlayer::detail_SortPriorityList
+800a38b0 0x800a38a4
+800a38d0 nw4r::snd::SoundPlayer::detail_Append
+800a3ab0 nw4r::snd::SoundPlayer::detail_Remove
+800a3b40 nw4r::snd::SoundPlayer::SetPlayableSound
+800a3bd0 nw4r::snd::SoundPlayer::detail_SetPlayableSoundLimit
+800a3be0 SoundPlayer::detail_CanPlaySound
+800a3cc0 nw4r::snd::SoundPlayer::detail_AppendPlayerHeap
+800a3d30 nw4r::snd::SoundPlayer::detail_AllocPlayerHeap
+800a3de0 nw4r::snd::SoundPlayer::detail_FreePlayerHeap
+800a3e80 nw4r::snd::SoundStartable::detail_StartSound
+800a3ee0 nw4r::snd::SoundStartable::detail_StartSound(str)
+800a3f90 nw4r::snd::SoundStartable::detail_HoldSound
+800a4040 nw4r::snd::SoundStartable::detail_HoldSound(str)
+800a4130 nw4r::snd::SoundStartable::detail_PrepareSound
+800a4150 nw4r::snd::SoundSystem::InitSoundSystem
+800a41a0 nw4r::snd::SoundSystem::GetRequiredMemSize
+800a4220 nw4r::snd::SoundSystem::InitSoundSystem
+800a43d0 nw4r::snd::SoundSystem::ShutdownSoundSystem
+800a4450 nw4r::snd::SoundSystem::IsInitializedSoundSystem
+800a4460 nw4r::snd::SoundSystem::WaitForResetReady
+800a44e0 __sinit_\snd_SoundSystem_cpp
+800a4530 nw4r::snd::detail::SoundThread::GetInstance
+800a4600 nw4r::snd::detail::SoundThread::__dt
+800a4670 nw4r::snd::detail::SoundThread::Create
+800a47b0 nw4r::snd::detail::SoundThread::Shutdown
+800a48b0 nw4r::snd::detail::SoundThread::AxCallbackFunc
+800a49c0 nw4r::snd::detail::SoundThread::SoundThreadFunc
+800a4a20 nw4r::snd::detail::SoundThread::RegisterPlayerCallback
+800a4a90 nw4r::snd::detail::SoundThread::UnregisterPlayerCallback
+800a4af0 nw4r::snd::detail::SoundThread::FrameProcess
+800a4c50 nw4r::snd::detail::StrmBufferPool::Setup
+800a4cd0 nw4r::snd::detail::StrmBufferPool::Shutdown
+800a4d20 nw4r::snd::detail::StrmBufferPool::Alloc
+800a4e10 nw4r::snd::detail::StrmBufferPool::Free
+800a4e90 nw4r::snd::detail::StrmFileReader::__ct
+800a4ea0 nw4r::snd::detail::StrmFileReader::ReadStrmInfo
+800a4fb0 nw4r::snd::detail::StrmFileReader::ReadStrmTrackInfo
+800a5270 nw4r::snd::detail::StrmFileLoader::LoadFileHeader
+800a5440 nw4r::snd::detail::StrmFileLoader::GetChannelCount
+800a5490 nw4r::snd::detail::StrmFileLoader::ReadStrmInfo
+800a54d0 nw4r::snd::detail::StrmFileLoader::ReadStrmTrackInfo
+800a5510 nw4r::snd::detail::StrmFileLoader::ReadAdpcmInfo
+800a56a0 nw4r::snd::detail::StrmFileLoader::ReadAdpcBlockData
+800a5860 nw4r::snd::detail::StrmPlayer::__ct
+800a5960 nw4r::snd::detail::StrmPlayer::StrmHeaderLoadTask::__dt
+800a59c0 nw4r::snd::detail::StrmPlayer::StrmDataLoadTask::__dt
+800a5a20 nw4r::snd::detail::StrmPlayer::__dt
+800a5b20 nw4r::snd::detail::StrmPlayer::Setup
+800a5d40 nw4r::snd::detail::StrmPlayer::Shutdown
+800a5dd0 nw4r::snd::detail::StrmPlayer::Prepare
+800a5eb0 nw4r::snd::detail::StrmPlayer::Start
+800a6250 nw4r::snd::detail::StrmPlayer::Stop
+800a6420 nw4r::snd::detail::StrmPlayer::Pause
+800a6490 nw4r::snd::detail::StrmPlayer::ReadStrmDataInfo
+800a6530 nw4r::snd::detail::StrmPlayer::InitParam
+800a6670 nw4r::snd::detail::StrmPlayer::LoadHeader
+800a6970 nw4r::snd::detail::StrmPlayer::LoadStreamData
+800a6be0 nw4r::snd::detail::StrmPlayer::SetupPlayer
+800a6de0 nw4r::snd::detail::StrmPlayer::AllocVoices
+800a6ed0 nw4r::snd::detail::StrmPlayer::Update
+800a7090 nw4r::snd::detail::StrmPlayer::UpdateVoiceParams
+800a7410 nw4r::snd::detail::StrmPlayer::UpdateBuffer
+800a75b0 nw4r::snd::detail::StrmPlayer::UpdateLoopAdress
+800a76c0 nw4r::snd::detail::StrmPlayer::UpdatePlayingBlockIndex
+800a78c0 nw4r::snd::detail::StrmPlayer::UpdateDataLoopAddress
+800a7a20 nw4r::snd::detail::StrmPlayer::SetLoopEndToZeroBuffer
+800a7b10 nw4r::snd::detail::StrmPlayer::UpdateLoadingBlockIndex
+800a7d40 nw4r::snd::detail::StrmPlayer::UpdatePauseStatus
+800a7e00 nw4r::snd::detail::StrmPlayer::CalcStartOffset
+800a7f20 nw4r::snd::detail::StrmPlayer::VoiceCallbackFunc
+800a7fc0 nw4r::snd::detail::StrmPlayer::SetTrackVolume
+800a8050 nw4r::snd::detail::StrmPlayer::GetPlayerTrack
+800a8070 nw4r::snd::detail::StrmPlayer::StrmHeaderLoadTask::Execute
+800a80c0 nw4r::snd::detail::StrmPlayer::StrmHeaderLoadTask::Cancel
+800a80d0 nw4r::snd::detail::StrmPlayer::StrmHeaderLoadTask::OnCancel
+800a8180 nw4r::snd::detail::StrmPlayer::StrmDataLoadTask::_ct
+800a81d0 nw4r::snd::detail::StrmPlayer::StrmDataLoadTask::Execute
+800a82a0 nw4r::snd::detail::StrmPlayer::StrmDataLoadTask::Cancel
+800a8330 nw4r::snd::detail::StrmPlayer::StrmDataLoadTask::OnCancel
+800a83e0 nw4r::snd::detail::StrmPlayer::OnUpdateFrameSoundThread
+800a83f0 nw4r::snd::detail::StrmPlayer::OnUpdateVoiceSoundThread
+800a8400 nw4r::snd::detail::StrmPlayer::OnShutdownSoundThread
+800a8410 nw4r::snd::detail::StrmPlayer::IsPause
+800a8420 nw4r::snd::detail::StrmPlayer::IsStarted
+800a8430 nw4r::snd::detail::StrmPlayer::IsActive
+800a8440 nw4r::snd::detail::StrmPlayer::OnShutdownSoundThread
+800a8450 nw4r::snd::detail::StrmPlayer::OnUpdateVoiceSoundThread
+800a8460 nw4r::snd::detail::StrmPlayer::OnUpdateFrameSoundThread
+800a8470 nw4r::snd::detail::StrmPlayer::__dt(thunk)
+800a8480 nw4r::snd::detail::StrmSound::__ct
+800a8680 nw4r::snd::detail::StrmSound::InitParam
+800a87c0 nw4r::snd::detail::StrmSound::Setup
+800a8840 nw4r::snd::detail::StrmSound::Prepare
+800a88a0 nw4r::snd::detail::StrmSound::UpdateMoveValue
+800a8920 nw4r::snd::detail::StrmSound::UpdateParam
+800a8a00 nw4r::snd::detail::StrmSound::SetTrackVolume
+800a8b70 nw4r::snd::detail::StrmSound::Shutdown
+800a8c10 nw4r::snd::detail::StrmSound::__dt
+800a8c70 nw4r::snd::detail::StrmSound::OnUpdatePlayerPriority
+800a8d60 nw4r::snd::detail::StrmSound::IsAttachedTempSpecialHandle
+800a8d80 nw4r::snd::detail::StrmSound::DetachTempSpecialHandle
+800a8d90 nw4r::snd::detail::StrmSound::GetBasicPlayer(const)
+800a8da0 nw4r::snd::detail::StrmSound::GetBasicPlayer
+800a8db0 nw4r::snd::detail::StrmSound::IsPrepared
+800a8dc0 nw4r::snd::detail::StrmSound::GetRuntimeTypeInfo
+800a8dd0 0x800a8dc8
+800a8de0 nw4r::snd::StrmSoundHandle::__ct
+800a8ef0 nw4r::snd::StrmSoundHandle::DetachSound
+800a8f30 nw4r::snd::detail::Task::__dt
+800a8f70 nw4r::snd::detail::TaskManager::GetInstance
+800a9010 0x800a900c
+800a9080 0x800a9074
+800a90e0 0x800a90d8
+800a9100 nw4r::snd::detail::TaskManager::AppendTask
+800a9180 nw4r::snd::detail::TaskManager::PopTask
+800a92e0 0x800a92e0
+800a93f0 nw4r::snd::detail::TaskManager::ExecuteTask
+800a9470 nw4r::snd::detail::TaskManager::CancelTask
+800a9570 nw4r::snd::detail::TaskManager::CancelAllTask
+800a9660 nw4r::snd::detail::TaskManager::WaitTask
+800a96d0 nw4r::snd::detail::TaskManager::CancelWaitTask
+800a9720 nw4r::snd::detail::TaskThread::__ct
+800a9740 nw4r::snd::detail::TaskThread::__dt
+800a97c0 nw4r::snd::detail::TaskThread::Create
+800a9890 nw4r::snd::detail::TaskThread::__dt
+800a98f0 nw4r::snd::detail::TaskThread::ThreadFunc
+800a9950 nw4r::snd::detail::Voice::__ct
+800a9bc0 nw4r::snd::detail::Voice::__dt
+800a9c70 nw4r::snd::detail::Voice::InitParam
+800a9d20 nw4r::snd::detail::Voice::StopFinished
+800a9dc0 nw4r::snd::detail::Voice::Calc
+800a9f60 nw4r::snd::detail::Voice::Update
+800aa1a0 nw4r::snd::detail::Voice::Acquire
+800aa3e0 nw4r::snd::detail::Voice::Free
+800aa4b0 nw4r::snd::detail::Voice::Setup
+800aa730 nw4r::snd::detail::Voice::Start
+800aa750 nw4r::snd::detail::Voice::Stop
+800aa820 nw4r::snd::detail::Voice::Pause
+800aa840 nw4r::snd::detail::Voice::GetFormat
+800aa860 nw4r::snd::detail::Voice::SetVolume
+800aa8b0 nw4r::snd::detail::Voice::SetVeVolume
+800aa960 nw4r::snd::detail::Voice::SetPitch
+800aa980 nw4r::snd::detail::Voice::SetPanMode
+800aa9a0 nw4r::snd::detail::Voice::SetPanCurve
+800aa9c0 nw4r::snd::detail::Voice::SetPan
+800aa9e0 nw4r::snd::detail::Voice::SetSurroundPan
+800aaa00 nw4r::snd::detail::Voice::SetLpfFreq
+800aaa50 nw4r::snd::detail::Voice::SetRemoteFilter
+800aaa90 nw4r::snd::detail::Voice::SetOutputLine
+800aaab0 nw4r::snd::detail::Voice::SetMainOutVolume
+800aab00 nw4r::snd::detail::Voice::SetMainSend
+800aab50 nw4r::snd::detail::Voice::SetFxSend
+800aaba0 nw4r::snd::detail::Voice::SetRemoteOutVolume
+800aabf0 nw4r::snd::detail::Voice::SetRemoteOutVolume2
+800aac40 nw4r::snd::detail::Voice::SetRemoteOutVolume
+800aac90 nw4r::snd::detail::Voice::SetVoiceOutParam
+800aace0 nw4r::snd::detail::Voice::SetPriority
+800aad80 nw4r::snd::detail::Voice::UpdateVoicesPriority
+800aae10 nw4r::snd::detail::Voice::SetAdpcmLoop
+800aae90 nw4r::snd::detail::Voice::GetCurrentPlayingSample
+800aaeb0 nw4r::snd::detail::Voice::SetLoopStart
+800aaf30 nw4r::snd::detail::Voice::SetLoopEnd
+800aafb0 nw4r::snd::detail::Voice::SetLoopFlag
+800ab040 nw4r::snd::detail::Voice::StopAtPoi
+800ab0c0 nw4r::snd::detail::Voice::SetVoiceType
+800ab150 nw4r::snd::detail::Voice::CalcAxSrc
+800ab210 nw4r::snd::detail::Voice::CalcAxVe
+800ab300 nw4r::snd::detail::Voice::CalcAxMix
+800ab3f0 nw4r::snd::detail::Voice::ResetDelta
+800ab470 nw4r::snd::detail::Voice::AxVoiceCallbackFunc
+800ab5c0 nw4r::snd::detail::Voice::TransformDpl2Pan
+800ab760 nw4r::snd::detail::Voice::CalcMixParam
+800ab954 0x800ab954
+800ab95c 0x800ab95c
+800ab96c 0x800ab96c
+800ab980 0x800ab980
+800ab98c 0x800ab98c
+800ab99c 0x800ab99c
+800ab9b0 0x800ab9b0
+800ab9bc 0x800ab9bc
+800ab9d0 0x800ab9d0
+800ac2e0 nw4r::snd::detail::Voice::InvalidateWaveData
+800ac430 nw4r::snd::detail::Voice::InvalidateData
+800ac440 nw4r::snd::detail::VoiceManager::GetInstance
+800ac4d0 nw4r::snd::detail::VoiceManager::__dt
+800ac540 0x800ac540
+800ac550 nw4r::snd::detail::VoiceManager::Setup
+800ac600 nw4r::snd::detail::VoiceManager::Shutdown
+800ac6e0 nw4r::snd::detail::VoiceManager::AllocVoice
+800ac8a0 nw4r::snd::detail::VoiceManager::FreeVoice
+800ac940 nw4r::snd::detail::VoiceManager::UpdateAllVoices
+800ac9f0 nw4r::snd::detail::VoiceManager::NotifyVoiceUpdate
+800aca60 nw4r::snd::detail::VoiceManager::ChangeVoicePriority
+800acb70 0x800acb70
+800acbf0 0x800acbf0
+800acda0 0x800acda0
+800ace00 0x800ace00
+800acee0 0x800acee0
+800acf80 0x800acf80
+800acff0 0x800acff0
+800ad050 nw4r::snd::detail::Util::CalcRandom
+800ad080 nw4r::snd::detail::Util::GetDataRefAddressImpl
+800ad0b0 nw4r::snd::detail::Util::GetDataRefAddressImpl(const)
+800ad0e0 nw4r::snd::detail::WaveArchiveReader::__ct
+800ad160 nw4r::snd::detail::WaveArchiveReader::GetWaveFile
+800ad1f0 nw4r::snd::detail::WaveFileReader::__ct(rawFile)
+800ad210 nw4r::snd::detail::WaveFileReader::__ct(rawInfo)
+800ad220 nw4r::snd::detail::WaveFileReader::ReadWaveInfo
+800ad430 nw4r::snd::detail::WaveFileReader::GetWaveDataAddress
+800ad4a0 nw4r::snd::detail::WaveSound::__ct
+800ad510 nw4r::snd::detail::WsdPlayer::__dt
+800ad550 nw4r::snd::detail::WaveSound::Prepare
+800ad5f0 nw4r::snd::detail::WaveSound::Shutdown
+800ad690 nw4r::snd::detail::WaveSound::__dt
+800ad6d0 nw4r::snd::detail::WaveSound::SetChannelPriority
+800ad6e0 nw4r::snd::detail::WaveSound::SetReleasePriorityFix
+800ad6f0 nw4r::snd::detail::WaveSound::OnUpdatePlayerPriority
+800ad7e0 nw4r::snd::detail::WaveSound::IsAttachedTempSpecialHandle
+800ad800 nw4r::snd::detail::WaveSound::DetachTempSpecialHandle
+800ad810 nw4r::snd::detail::WaveSound::GetBasicPlayer(const)
+800ad820 nw4r::snd::detail::WaveSound::GetBasicPlayer
+800ad830 nw4r::snd::detail::WaveSound::IsPrepared
+800ad840 nw4r::snd::detail::WaveSound::GetRuntimeTypeInfo
+800ad850 0x800ad848
+800ad860 nw4r::snd::detail::WaveSoundHandle::__ct
+800ad970 nw4r::snd::detail::WaveSoundHandle::DetachSound
+800ad9b0 nw4r::snd::detail::WsdFileReader::__ct
+800ada40 nw4r::snd::detail::WsdFileReader::ReadWaveSoundInfo
+800adb60 nw4r::snd::detail::WsdFileReader::ReadWaveSoundNoteInfo
+800adc80 nw4r::snd::detail::WsdFileReader::ReadWaveInfo
+800add80 nw4r::snd::detail::WsdPlayer::__ct
+800addf0 nw4r::snd::detail::WsdPlayer::InitParam
+800adea0 nw4r::snd::detail::WsdPlayer::Prepare
+800ae040 nw4r::snd::detail::WsdPlayer::Start
+800ae0b0 nw4r::snd::detail::WsdPlayer::Stop
+800ae1e0 nw4r::snd::detail::WsdPlayer::Pause
+800ae2c0 nw4r::snd::detail::WsdPlayer::InvalidateData
+800ae420 nw4r::snd::detail::WsdPlayer::GetPlaySamplePosition
+800ae490 nw4r::snd::detail::WsdPlayer::Update
+800ae740 nw4r::snd::detail::WsdPlayer::StartChannel
+800ae900 nw4r::snd::detail::WsdPlayer::UpdateChannel
+800aed70 nw4r::snd::detail::WsdPlayer::CloseChannel
+800aede0 nw4r::snd::detail::WsdPlayer::OnUpdateFrameSoundThread
+800aedf0 nw4r::snd::detail::WsdPlayer::OnShutdownSoundThread
+800aee00 0x800aee00
+800aee10 nw4r::snd::detail::WsdPlayer::IsPause
+800aee30 nw4r::snd::detail::WsdPlayer::IsStarted
+800aee50 nw4r::snd::detail::WsdPlayer::IsActive
+800aee70 nw4r::snd::detail::WsdPlayer::InvalidateWaveData(thunk)
+800aee80 nw4r::snd::detail::WsdPlayer::InvalidateData(thunk)
+800aee90 nw4r::snd::detail::WsdPlayer::__dt(thunk)
+800aeea0 nw4r::snd::detail::WsdPlayer::OnShutdownSoundThread(thunk)
+800aeeb0 nw4r::snd::detail::WsdPlayer::OnUpdateFrameSoundThread(thunk)
+800aeec0 nw4r::snd::detail::WsdPlayer::__dt(thunk)
+800aeec8 0x800aeec8
+800aeed0 nw4r::snd::detail::DecodeDspAdpcm
+800aeee0 nw4r::snd::detail::WsdPlayer::InvalidateWaveData
+800aef60 nw4r::ut::List_Init
+800aef80 nw4r::ut::List_Append
+800aeff0 nw4r_ut_List_Insert
+800af110 nw4r::ut::List_Remove
+800af180 nw4r::ut::List_GetNext
+800af1a0 nw4r::ut::List_GetPrev
+800af1c0 nw4r_ut_List_GetNth
+800af210 nw4r::ut::detail::LinkListImpl::__dt
+800af2a0 nw4r::ut::detail::LinkListImpl::Erase
+800af2f0 nw4r::ut::detail::LinkListImpl::Clear
+800af340 nw4r::ut::detail::LinkListImpl::Insert
+800af370 nw4r::ut::detail::LinkListImpl::Erase
+800af3a0 nw4r::ut::IsValidBinaryFile
+800af420 nw4r::ut::CharStrmReader::ReadNextCharUTF8
+800af4a0 nw4r::ut::CharStrmReader::ReadNextCharUTF16
+800af4c0 nw4r::ut::CharStrmReader::ReadNextCharCP1252
+800af4e0 nw4r::ut::CharStrmReader::ReadNextCharSJIS
+800af540 0x800af540
+800af550 0x800af550
+800af590 0x800af590
+800af6c0 0x800af6bc
+800af8b0 0x800af8a4
+800af920 0x800af914
+800af9f0 0x800af9f0
+800afa00 0x800afa00
+800afa40 0x800afa40
+800afb70 0x800afb6c
+800afd60 0x800afd54
+800afdd0 0x800afdc4
+800afea0 nw4r::ut::IOStream::ReadAsync
+800afeb0 nw4r::ut::IOStream::Write
+800afec0 nw4r::ut::IOStream::WriteAsync
+800afed0 nw4r::ut::IOStream::IsBusy
+800afee0 0x800afed8
+800afef0 nw4r::ut::FileStream::Cancel
+800aff00 nw4r::ut::FileStream::CancelAsync
+800aff10 nw4r::ut::FileStream::FilePosition::Skip
+800aff80 nw4r::ut::FileStream::FilePosition::Append
+800affd0 nw4r::ut::FileStream::FilePosition::Seek
+800b0060 __sinit_\ut_FileStream_cpp
+800b0070 nw4r::ut::DvdFileStream::DvdAsyncCallback_
+800b00a0 nw4r::ut::DvdFileStream::DvdCBAsyncCallback_
+800b00d0 nw4r::ut::DvdFileStream::__ct(entryNum)
+800b0190 nw4r::ut::DvdFileStream::__ct(DVDFileInfo)
+800b02c0 nw4r::ut::DvdFileStream::__dt
+800b0340 nw4r::ut::DvdFileStream::Close
+800b0390 nw4r::ut::DvdFileStream::Read
+800b0420 nw4r::ut::DvdFileStream::ReadAsync
+800b0520 nw4r::ut::DvdFileStream::Peek
+800b0560 nw4r::ut::DvdFileStream::PeekAsync
+800b05e0 nw4r::ut::DvdFileStream::Seek
+800b05f0 nw4r::ut::DvdFileStream::Cancel
+800b0600 nw4r::ut::DvdFileStream::CancelAsync
+800b0660 nw4r::ut::DvdFileStream::CanAsync
+800b0670 nw4r::ut::DvdFileStream::GetSize
+800b0680 nw4r::ut::DvdFileStream::Tell
+800b0690 nw4r::ut::DvdFileStream::GetRuntimeTypeInfo
+800b06a0 __sinit_\ut_DvdFileStream_cpp
+800b06b0 nw4r::ut::DvdLockedFileStream::__ct(EntryNum)
+800b0740 nw4r::ut::DvdLockedFileStream::__ct(DVDFileInfo)
+800b07d0 nw4r::ut::DvdLockedFileStream::__dt
+800b0830 nw4r::ut::DvdLockedFileStream::Close
+800b0870 nw4r::ut::DvdLockedFileStream::Read
+800b0950 nw4r::ut::DvdLockedFileStream::Peek
+800b0a30 nw4r::ut::DvdLockedFileStream::Cancel
+800b0a90 __sinit_\ut_DvdLockedFileStream_cpp
+800b0aa0 0x800b0a9c
+800b0ad0 nw4r::ut::NandFileStream::__ct
+800b0b40 nw4r::ut::NandFileStream::__ct
+800b0bb0 nw4r::ut::NandFileStream::__dt
+800b0c30 nw4r::ut::NandFileStream::Open
+800b0d20 nw4r::ut::NandFileStream::Open
+800b14a0 0x800b1494
+800b14f0 nw4r::ut::NandFileStream::Read
+800b1570 0x800b156c
+800b1620 0x800b1614
+800b16a0 0x800b169c
+800b1750 0x800b1750
+800b1760 0x800b1760
+800b1770 0x800b1768
+800b1780 0x800b1778
+800b1790 nw4r::ut::LC::Enable
+800b17f0 nw4r::ut::LC::Disable
+800b1870 nw4r::ut::LC::Lock
+800b18e0 nw4r::ut::LC::Unlock
+800b1920 0x800b1920
+800b1930 0x800b1930
+800b1940 thunk_0x801a18dc
+800b1950 0x800b1950
+800b1970 nw4r::ut::Font::InitReaderFunc
+800b1a00 0x800b19f4
+800b1a20 nw4r::ut::RomFont::__ct
+800b1a80 nw4r::ut::RomFont::__dt
+800b1ac0 nw4r::ut::RomFont::Unload
+800b1ae0 nw4r::ut::RomFont::GetWidth
+800b1af0 nw4r::ut::RomFont::GetHeight
+800b1b50 nw4r::ut::RomFont::GetAscent
+800b1b60 nw4r::ut::RomFont::GetDescent
+800b1b70 nw4r::ut::RomFont::GetBaselinePos
+800b1b80 nw4r::ut::RomFont::GetCellHeight
+800b1b90 nw4r::ut::RomFont::GetCellWidth
+800b1ba0 nw4r::ut::RomFont::GetMaxCharWidth
+800b1bb0 nw4r::ut::RomFont::GetType
+800b1bc0 nw4r::ut::RomFont::GetTextureFormat
+800b1bd0 nw4r::ut::RomFont::GetLineFeed
+800b1be0 nw4r::ut::RomFont::GetDefaultCharWidths
+800b1c00 nw4r::ut::RomFont::SetDefaultCharWidths
+800b1c20 nw4r::ut::RomFont::SetAlternateChar
+800b1cb0 nw4r::ut::RomFont::SetLineFeed
+800b1cc0 nw4r::ut::RomFont::GetCharWidth
+800b1d50 nw4r::ut::RomFont::GetCharWidths
+800b1da0 nw4r::ut::RomFont::GetGlyph
+800b1ea0 nw4r::ut::RomFont::HasGlyph
+800b1f60 nw4r::ut::RomFont::GetEncoding
+800b1f90 nw4r::ut::detail::ResFontBase::__ct
+800b1ff0 nw4r::ut::detail::ResFontBase::__dt
+800b2030 nw4r::ut::detail::ResFontBase::SetResourceBuffer
+800b2040 nw4r::ut::detail::ResFontBase::GetWidth
+800b2050 nw4r::ut::detail::ResFontBase::GetHeight
+800b2060 nw4r::ut::detail::ResFontBase::GetAscent
+800b2070 nw4r::ut::detail::ResFontBase::GetDescent
+800b2090 nw4r::ut::detail::ResFontBase::GetBaselinePos
+800b20b0 nw4r::ut::detail::ResFontBase::GetCellHeight
+800b20c0 nw4r::ut::detail::ResFontBase::GetCellWidth
+800b20d0 nw4r::ut::detail::ResFontBase::GetMaxCharWidth
+800b20e0 nw4r::ut::detail::ResFontBase::GetType
+800b20f0 nw4r::ut::detail::ResFontBase::GetTextureFormat
+800b2100 nw4r::ut::detail::ResFontBase::GetLineFeed
+800b2110 nw4r::ut::detail::ResFontBase::GetDefaultCharWidths
+800b2130 nw4r::ut::detail::ResFontBase::SetDefaultCharWidths
+800b2150 nw4r::ut::detail::ResFontBase::SetAlternateChar
+800b2210 nw4r::ut::detail::ResFontBase::SetLineFeed
+800b2220 nw4r::ut::detail::ResFontBase::GetCharWidth
+800b2270 nw4r::ut::detail::ResFontBase::GetCharWidths
+800b2390 nw4r::ut::detail::ResFontBase::GetGlyph
+800b2460 nw4r::ut::detail::ResFontBase::HasGlyph
+800b2520 nw4r::ut::detail::ResFontBase::GetEncoding
+800b2530 nw4r::ut::detail::ResFontBase::GetGlyphIndex
+800b25f0 nw4r::ut::detail::ResFontBase::FindGlyphIndex
+800b26c0 nw4r::ut::detail::ResFontBase::GetCharWidthsFromIndex
+800b2720 nw4r::ut::detail::ResFontBase::GetGlyphFromIndex
+800b2830 nw4r::ut::ResFont::_ct
+800b2870 nw4r::ut::ResFont::__dt
+800b28d0 nw4r::ut::ResFont::SetResource
+800b2a20 nw4r::ut::ResFont::Rebuild
+800b2b30 0x800b2b30
+800b2eb0 0x800b2eb0
+800b2ef0 0x800b2ef0
+800b38d0 0x800b38d0
+800b39a0 0x800b39a0
+800b3a20 0x800b3a20
+800b3a80 0x800b3a80
+800b3ae0 0x800b3ae0
+800b3b40 0x800b3b40
+800b3c70 0x800b3c70
+800b3ef0 nw4r::ut::CharWriter::UpdateVertexColor
+800b4040 nw4r::ut::CharWriter::SetupGXWithColorMapping
+800b4380 nw4r::ut::TextWriterBase::__ct
+800b43e0 nw4r::ut::TextWriterBase::__dt
+800b4440 0x800b4438
+800b44d0 0x800b44d0
+800b4550 0x800b454c
+800b48d0 0x800b48c4
+800b4c50 0x800b4c44
+800b4fa0 0x800b4fa0
+800b5290 0x800b5290
+800b5540 0x800b5534
+800b57f0 0x800b57e4
+800b5a80 0x800b5a80
+800b5d60 0x800b5d60
+800b5fe0 0x800b5fe0
+800b61f0 0x800b61e4
+800b6300 0x800b62fc
+800b63b0 0x800b63a8
+800b63d0 0x800b63d0
+800b65f0 0x800b65f0
+800b6c80 0x800b6c74
+800b6c90 0x800b6c90
+800b6da0 0x800b6da0
+800b77d0 0x800b77d0
+800b7f00 0x800b7f00
+800b7f20 nw4r::ut::TextWriterBase::__ct
+800b7f80 nw4r::ut::TextWriterBase::__dt
+800b7fd8 0x800b7fd8
+800b7fe0 0x800b7fe0
+800b8070 0x800b8070
+800b80ec 0x800b80ec
+800b80f0 0x800b80f0
+800b8464 0x800b8464
+800b8470 0x800b8470
+800b87e4 0x800b87e4
+800b87f0 0x800b87f0
+800b8b40 0x800b8b40
+800b8e30 0x800b8e30
+800b90d4 0x800b90d4
+800b90e0 0x800b90e0
+800b9384 0x800b9384
+800b9390 0x800b9390
+800b9618 0x800b9618
+800b9620 0x800b9620
+800b9900 0x800b9900
+800b9b7c 0x800b9b7c
+800b9b80 0x800b9b80
+800b9d84 0x800b9d84
+800b9d90 0x800b9d90
+800b9e9c 0x800b9e9c
+800b9ea0 0x800b9ea0
+800b9f48 0x800b9f48
+800b9f50 0x800b9f50
+800b9f70 0x800b9f70
+800ba18c 0x800ba18c
+800ba190 0x800ba190
+800ba814 0x800ba814
+800ba828 0x800ba828
+800ba830 0x800ba830
+800ba950 0x800ba950
+800bb3a0 0x800bb3a0
+800bbad0 0x800bbad0
+800bbae8 0x800bbae8
+800bbaf0 0x800bbaf0
+800bbb80 RFL::GetWorkSize
+800bbba0 RFL::Init
+800bbf10 RFL::InitRes
+800bbfb0 RFLExit
+800bc138 bootloadDB2Res_
+800bc140 0x800bc140
+800bc370 RFL::Available
+800bc390 RFL::iAlloc
+800bc3b0 RFL::iAlloc32
+800bc3d0 RFL::iFree
+800bc3e0 RFL::iGetDBManager
+800bc400 RFL::iGetHDBManager
+800bc420 RFL::iGetLoader
+800bc440 RFLi::GetWorking
+800bc460 RFLiSetWorking
+800bc470 RFL::iGetManager
+800bc480 RFLGetAsyncStatus
+800bc510 RFLGetLastReason
+800bc540 RFL::WaitAsync
+800bc5e0 RFLiGetAccInfo
+800bc610 RFLiGetCtrlBufManager
+800bc630 RFLiGetUseDeluxTex
+800bc650 RFLiGetLastReason
+800bc670 RFLiSetFileBroken
+800bc6a0 RFLiNotFoundError
+800bc6c0 RFLiNeedRepairError
+800bc6e0 RFL::GetArcFilePath
+800bc6f0 RFLiInitLoader
+800bc810 parseOnmemoryRes_
+800bc990 0x800bc990
+800bcab0 0x800bcab0
+800bcac0 loadResRead1stcallback_
+800bcbb0 loadResGetlengthcallback_
+800bcc50 loadResOpencallback_
+800bccc0 RFLiLoadResourceHeaderAsync
+800bcd60 getNANDFile_
+800bcef0 RFLiGetTexSize
+800bd060 RFLiLoadTexture
+800bd190 RFLiGetShpTexSize
+800bd300 RFLiLoadShpTexture
+800bd430 RFLiGetShapeSize
+800bd5a0 RFLiLoadShape
+800bd6d0 RFLFreeCachedResource
+800bd740 RFLIsResourceCached
+800bd790 RFLiInitAccessInfo
+800bd810 RFLiExitAccessInfo
+800bd860 thunk_0x800bc440
+800bd870 RFLiStartWorking
+800bd8c0 RFLiEndWorkingReason
+800bd940 RFLiEndWorking
+800bd9c0 0x800bd9c0
+800bda10 opencallback_
+800bda64 opencallback__switch
+800bda68 opencallback__caseD_0
+800bdab8 opencallback__caseD_fffffff1
+800bdb08 opencallback__caseD_fffffff4
+800bdc08 opencallback__caseD_fffffff2
+800bdc90 0x800bdc90
+800bdef0 0x800bdef0
+800be150 RFLiOpenAsync
+800be4a0 0x800be4a0
+800be6c0 0x800be6c0
+800be940 RFLiReadAsync
+800beae0 0x800beae0
+800bed40 0x800bed40
+800bed50 0x800bed40
+800befc0 retryWriteSeek_
+800bf1e0 writeseekcallback_
+800bf570 RFLiWriteAsync
+800bf780 0x800bf780
+800bf8e0 RFLiCloseAsync
+800bfa70 getlengthcallback_
+800bfbc0 RFLiGetLengthAsync
+800bfd40 0x800bfd40
+800bfeb0 RFLiDeleteAsync
+800c0060 createdircallback2_
+800c01d0 createdircallback1_
+800c0420 RFLiCreateSaveDirAsync
+800c05b0 RFLiGetExpressionNum
+800c0690 RFLInitCharModel
+800c0700 RFLiInitCharModel
+800c0a70 RFL::SetMtx
+800c0ac0 RFL::SetExpression
+800c0ad0 RFL::GetFavoriteColor
+800c0af0 RFLiGetFacelineColor
+800c0b20 RFL::LoadDrawSetting
+800c0e10 RFL::DrawOpa
+800c0e20 RFL::DrawXlu
+800c0e30 RFLLoadVertexSetting
+800c0ed0 RFLLoadMaterialSetting
+800c0f90 RFL::DrawOpaCore
+800c14a0 RFL::DrawXluCore
+800c1730 RFLiInitCharModelRes
+800c1e40 RFLiInitShapeRes
+800c2430 RFLiInitTexRes
+800c2550 RFLiSetupCopyTex
+800c2680 0x800c2680
+800c3700 RFLiSetup2DCameraAndParam
+800c38e0 RFLiSetTev4Mouth
+800c3b30 RFLiSetTev4Eye
+800c3de0 0x800c3de0
+800c4300 RFLiCapture
+800c4b70 RFLiDrawQuad
+800c4d60 RFLiGetMaxMaskRsl
+800c4dc0 RFLiGetMaskBufSize
+800c4e00 RFLMakeIcon
+800c4e80 0x800c4e80
+800c53a0 0x800c53a0
+800c53e0 0x800c53e0
+800c5420 0x800c5420
+800c5500 0x800c5500
+800c5550 0x800c5550
+800c55c0 0x800c55c0
+800c5680 0x800c5680
+800c57c0 0x800c57c0
+800c57d0 0x800c57d0
+800c58c0 0x800c58c0
+800c59b0 0x800c59b0
+800c59e0 0x800c59e0
+800c5ae0 0x800c5ae0
+800c5c20 0x800c5c20
+800c5c90 0x800c5c90
+800c5cb0 0x800c5cb0
+800c5cd0 0x800c5cd0
+800c5e90 0x800c5e90
+800c6010 0x800c6010
+800c60f0 0x800c60f0
+800c61a0 0x800c61a0
+800c6220 0x800c6220
+800c62a0 0x800c62a0
+800c6380 0x800c6380
+800c6390 0x800c6390
+800c63e0 0x800c63e0
+800c6450 0x800c6450
+800c64c0 bootloadDBcallback_
+800c65f0 0x800c65f0
+800c6700 0x800c6700
+800c67d0 0x800c67d0
+800c6800 0x800c6800
+800c686c 0x800c686c
+800c6870 0x800c6870
+800c68f0 0x800c68f0
+800c6990 0x800c6990
+800c6af0 RFLiGetCharData
+800c6c60 RFL::iConvertRaw2InfoCore
+800c6e20 RFL::iConvertRaw2Info
+800c6e70 RFL::iConvertHRaw2Info
+800c6ec0 RFL::iConvertInfo2RawCore
+800c7070 RFL::iConvertInfo2Raw
+800c70c0 RFL::iConvertInfo2HRaw
+800c7100 RFL::iConvertRaw2HRaw
+800c7160 0x800c7160
+800c71e0 0x800c71e0
+800c7290 RFL::IsAvailableOfficialData
+800c72d0 0x800c72d0
+800c72f0 RFL::iIsSameID
+800c7490 RFL::iIsValidID
+800c74d0 0x800c74d0
+800c7590 0x800c7590
+800c75f0 RFL::SearchOfficialData
+800c76d0 0x800c76d0
+800c7740 0x800c7740
+800c77d0 0x800c77d0
+800c7860 0x800c7860
+800c78d0 RFL::CalcCRC16
+800c79c0 0x800c79c0
+800c7b70 0x800c7b70
+800c7c40 0x800c7c40
+800c7df0 RFLGetStoreData
+800c7ee0 0x800c7ee0
+800c8090 0x800c8090
+800c80f0 0x800c80f0
+800c8214 0x800c8214
+800c8220 0x800c8220
+800c84e0 0x800c84e0
+800c85a0 0x800c85a0
+800c8680 0x800c8680
+800c8690 0x800c8690
+800c8780 RFL::IsAvailableControllerData
+800c8850 RFL::GetMiddleDBBufferSize
+800c8860 RFL::InitMiddleDB
+800c8920 0x800c8920
+800c8b70 0x800c8b70
+800c8cf0 0x800c8cf0
+800c8e90 0x800c8e90
+800c8fd0 0x800c8fd0
+800c9170 0x800c9170
+800c9450 0x800c9450
+800c9550 RFL::UpdateMiddleDBAsync
+800c95b0 RFL::iUpdateMiddleDBAsync
+800c9710 RFL::GetMiddleDBStoredSize
+800c9720 0x800c9720
+800c97c0 RFL::SetMiddleDBRandomMask
+800c97e0 RFL::SetMiddleDBHiddenMask
+800c9810 RFL::iAddMiddleDBUserData
+800c9920 RFL::AddMiddleDBStoreData
+800c99b0 0x800c99b0
+800c9b00 0x800c9b00
+800ca520 0x800ca520
+800ca660 0x800ca660
+800ca7d0 0x800ca7d0
+800ca800 0x800ca800
+800ca820 RFL::SearchDefaultData
+800ca8c0 RFL::iCheckValidInfo
+800cad30 0x800cad30
+800cad60 0x800cad60
+800cae70 0x800cae70
+800cb010 0x800cb010
+800cb2b0 0x800cb2b0
+800cb3e0 0x800cb3e0
+800cb550 0x800cb550
+800cb6a0 RFLiPickupCharInfo
+800cb7e0 RFL::GetAdditionalInfo
+800cb840 RFL::iCheckValidRaw
+800cb8b0 RFL::CheckValidRaw
+800cb920 0x800cb920
+800cba40 0x800cba40
+800cba90 0x800cba90
+800cbb4c 0x800cbb4c
+800cbb50 0x800cbb50
+800cbb84 0x800cbb84
+800cbb90 0x800cbb90
+800cbbc0 0x800cbbc0
+800cbd10 0x800cbd10
+800cbd50 0x800cbd50
+800cbde4 0x800cbde4
+800cbdf0 0x800cbdf0
+800cbe2c 0x800cbe2c
+800cbe30 0x800cbe30
+800cbea0 0x800cbea0
+800cbfb0 RFL::InitWiFiPacket
+800cc048 RFL::SetToWiFiPacket
+800cc050 0x800cc050
+800cc190 RFL::GetWifiInfoBufferSize
+800cc1b0 RFL::InitWiFiInformation
+800cc280 RFL::SetReceivedPacketWithoutFlush
+800cc3b0 RFL::iGetWiFiPacket
+800cc3f0 0x800cc3f0
+800cc480 0x800cc480
+800cc490 0x800cc490
+800cc4a0 0x800cc4a0
+800cc550 RFL::WiFiInfo2MiddleDB
+800cc6f0 RFL::WiFiInfo2Raw
+800cc7e4 DWC_Base64Encode
+800cc974 DWC_Base64Decode
+800ccb4c DWC_GetLastError
+800ccb64 DWC_GetLastErrorEx
+800ccb9c DWC_GetLastErrorEx_switch
+800ccba0 DWC_GetLastErrorEx_caseD_2
+800ccbac DWC_GetLastErrorEx_caseD_6
+800ccbd4 DWC_GetLastErrorEx_caseD_7
+800ccbe0 DWC_GetLastErrorEx_caseD_a
+800ccbec DWC_GetLastErrorEx_caseD_1
+800ccbf8 DWC_GetLastErrorEx_caseD_e
+800ccc04 DWC_GetLastErrorEx_caseD_11
+800ccc10 DWC_GetLastErrorEx_caseD_10
+800ccc1c DWC_GetLastErrorEx_caseD_12
+800ccc28 DWC_GetLastErrorEx_caseD_0
+800ccc38 DWC_ClearError
+800ccc54 DWCi_IsError
+800ccc68 DWCi_SetError
+800ccc80 DWC_Init
+800ccd58 DWC_Shutdown
+800ccdac DWCi_GetGamecode
+800ccdb4 DWCi_SetMemFunc
+800ccdc0 DWC_Alloc
+800cce24 DWC_AllocEx
+800cce80 DWC_Free
+800cce9c DWCi_GsMalloc
+800ccf04 DWCi_GsRealloc
+800ccfd4 DWCi_GsFree
+800ccff8 DWCi_GsMemalign
+800cd060 DWC_SetReportLevel
+800cd068 DWC_Printf
+800cd3b0 DWC_InitGHTTP
+800cd3f4 DWC_ShutdownGHTTP
+800cd4a8 DWC_ProcessGHTTP
+800cd4e0 GHTTPCompletedCallback
+800cd63c GHTTPProgressCallback
+800cd66c DWC_GHTTPNewPost
+800cd6d4 DWC_PostGHTTPData
+800cd864 DWC_GetGHTTPDataEx
+800cdae4 DWCi_HandleGHTTPError
+800cdb54 DWCi_HandleGHTTPError_switch
+800cdb58 DWCi_HandleGHTTPError_caseD_fffffff8
+800cdb60 DWCi_HandleGHTTPError_caseD_fffffff9
+800cdb68 DWCi_HandleGHTTPError_caseD_fffffffa
+800cdb70 DWCi_HandleGHTTPError_caseD_fffffffb
+800cdb78 DWCi_HandleGHTTPError_caseD_fffffffe
+800cdb80 DWCi_HandleGHTTPError_caseD_1
+800cdb8c DWCi_HandleGHTTPError_caseD_2
+800cdb94 DWCi_HandleGHTTPError_caseD_3
+800cdb9c DWCi_HandleGHTTPError_caseD_4
+800cdba4 DWCi_HandleGHTTPError_caseD_5
+800cdbac DWCi_HandleGHTTPError_caseD_6
+800cdbb4 DWCi_HandleGHTTPError_caseD_7
+800cdbbc DWCi_HandleGHTTPError_caseD_8
+800cdbc4 DWCi_HandleGHTTPError_caseD_d
+800cdbcc DWCi_HandleGHTTPError_caseD_f
+800cdbd4 DWCi_HandleGHTTPError_caseD_10
+800cdbdc DWCi_HandleGHTTPError_caseD_11
+800cdbe0 DWCi_HandleGHTTPError_caseD_0
+800cdc0c DWCi_RemoveDWCGHTTPParamEntry
+800cdc98 DWC_SetCommonKeyValueString
+800cdcf0 DWC_AddCommonKeyValueString
+800cdd80 DWC_GetCommonValueString
+800cded8 DWCi_GetMathRand32
+800ce020 DWCi_WStrlen
+800ce044 DWC_GetFriendStatusSC
+800ce190 DWC::GetFriendStatusData
+800ce24c DWC::SetOwnStatusData
+800ce2e4 DWC::CanChangeFriendList
+800ce314 DWC::DeleteBuddyFriendData
+800ce3ec DWC_SetBuddyFriendCallback
+800ce414 DWCi_FriendInit
+800ce4e4 DWCi_FriendProcess
+800ce7a8 DWCi_UpdateServersAsync
+800ce838 DWCi_StopFriendProcess
+800ce8d0 DWCi_GPRecvBuddyRequestCallback
+800ce960 DWCi_GPRecvBuddyAuthCallback
+800ce9e4 DWCi_GPRecvBuddyStatusCallback
+800ceb00 DWCi_GetProfileIDFromList
+800ceb6c DWCi_GetFriendListIndex
+800cec34 DWCi_InitGPProcessCount
+800cec74 DWCi_SetGPStatus
+800ced8c DWCi_ShutdownFriend
+800ced98 DWCi_UpdateFriendReq
+800cf0a4 DWCi_RefreshFriendListForth
+800cf230 DWCi_RefreshFriendListAll
+800cf414 DWCi_GetBuddyFriendStatus
+800cf4e0 DWCi_HandleGPError
+800cf608 DWCi_HandlePersError
+800cf664 DWCi_HandlePersError_switch
+800cf668 DWCi_HandlePersError_caseD_1
+800cf674 DWCi_HandlePersError_caseD_2
+800cf680 DWCi_HandlePersError_caseD_3
+800cf68c DWCi_HandlePersError_caseD_5
+800cf698 DWCi_HandlePersError_caseD_7
+800cf6a0 DWCi_HandlePersError_caseD_4
+800cf75c DWCi_GPProfileSearchCallback
+800cfa68 DWCi_GPGetInfoCallback_RecvBuddyRequest
+800cfc98 DWCi_GPGetInfoCallback_RecvAuthMessage
+800cff40 DWCi_BeginCloseStatsConnection
+800cff4c DWCi_EndCloseStatsConnection
+800cff58 DWCi_LoginInit
+800d00ac DWCi_LoginAsync
+800d00f8 DWCi_LoginProcess
+800d0274 DWCi_GetUserData
+800d0290 DWCi_StopLogin
+800d0314 DWCi_ShutdownLogin
+800d0348 DWCi_HandleGPError
+800d045c DWCi_GPConnectCallback
+800d065c DWCi_RemoteLogin
+800d0828 DWCi_RemoteLoginProcess
+800d0a74 DWCi_GPGetInfoCallback
+800d0cdc DWCi_CheckLogin
+800d0d04 DWCi_GetLoginTicket
+800d0d68 DWC_InitFriendsMatch
+800d0fec DWC_ShutdownFriendsMatch
+800d115c DWC_ProcessFriendsMatch
+800d13f8 DWC_LoginAsync
+800d1754 DWC_UpdateServersAsync
+800d1840 DWC::ConnectToAnybodyAsync
+800d1984 DWC_SetupGameServer
+800d1ab4 DWC_ConnectToGameServerAsync
+800d1d68 DWC_SetConnectionClosedCallback
+800d1d90 DWC_CloseAllConnectionsHard
+800d2000 DWC::CloseConnectionHard
+800d2158 DWC_GetNumConnectionHost
+800d2170 DWC_GetMyAid
+800d21bc DWC_GetAidList
+800d225c DWC_GetDirectConnectedAIDBitmap
+800d24b4 DWC_GetAidBitmap
+800d2644 DWC_IsValidAid
+800d26cc DWC_GetState
+800d26e8 DWC_GetServerAid
+800d2760 DWC_IsServerMyself
+800d2808 DWCi_GT2Startup
+800d2900 DWCi_GetGT2Connection
+800d299c DWCi_GetConnectionAid
+800d29d0 DWCi_GT2GetConnectionListIdx
+800d2a74 DWCi_GetGT2ConnectionByIdx
+800d2a88 DWCi_GetGT2ConnectionByProfileID
+800d2b10 DWCI_GetConnectionInfoByIdx
+800d2b24 DWC_isValidAid
+800d2ba0 DWC_ConnectToGameServerFromGroupID
+800d2cd4 DWCi_HandleGPError
+800d2e4c DWCi_HandleGT2Error
+800d2ea4 DWCi_HandleGT2Error_switch
+800d2ea8 DWCi_HandleGT2Error_caseD_1
+800d2eb4 DWCi_HandleGT2Error_caseD_2
+800d2ec4 DWCi_HandleGT2Error_caseD_3
+800d2ed0 DWCi_HandleGT2Error_caseD_4
+800d2edc DWCi_HandleGT2Error_caseD_6
+800d2ee8 DWCi_HandleGT2Error_caseD_7
+800d2ef0 DWCi_HandleGT2Error_caseD_7
+800d2f1c DWCi_LoginCallback
+800d2fbc DWCi_UpdateServersCallback
+800d2ff0 DWCi_MatchedCallback
+800d31d8 DWCi_GPErrorCallback
+800d3648 DWCi_GPRecvBuddyMessageCallback
+800d37b8 DWCi_GT2ReceivedCallback
+800d37bc DWCi_GT2ClosedProcess
+800d3f20 DWCi_GT2ClosedCallback
+800d3f2c DWCi_GT2PingCallback
+800d3f84 DWCi_GT2SocketErrorCallback
+800d3fe0 DWCi_GetServerOrSubServerAID
+800d4080 DWCi_NNFreeNegotiateList
+800d409c DWC_RegisterMatchingStatus
+800d4164 DWC_CancelMatch
+800d41f4 DWC_IsValidMatchCancel
+800d4258 DWC::AddMatchKeyInt
+800d45f4 DWC::AddMatchKeyString
+800d4994 DWC_GetGroupId
+800d49b0 DWC_RequestSuspendMatchAsync
+800d49b4 DWC_GetSuspendMatch
+800d4ac8 DWC_GetConnectionUserData
+800d4bbc DWCi_MatchInit
+800d4e58 DWCi_QR2Startup
+800d4fe4 DWCi_ConnectToAnybodyAsync
+800d54a0 DWCi_SetupGameServer
+800d577c DWCi_ConnectToGameServerAsync
+800d6194 DWCi_ConnectToGameServerFromGroupId
+800d6424 DWCi_MatchProcess
+800d64c4 DWCi_MatchProcess_switch
+800d64c8 DWCi_MatchProcess_caseD_3
+800d6a00 DWCi_MatchProcess_caseD_14
+800d6aa8 DWCi_MatchProcess_caseD_5
+800d6e90 DWCi_MatchProcess_caseD_d
+800d7094 DWCi_MatchProcess_caseD_8
+800d7674 DWCi_MatchProcess_caseD_9
+800d7a48 DWCi_MatchProcess_caseD_a
+800d7de4 DWCi_MatchProcess_caseD_b
+800d7fcc DWCi_MatchProcess_caseD_1
+800d86e4 DWCi_GT2UnrecognizedMessageCallback
+800d8858 DWCi_GT2ConnectAttemptCallback
+800d8e78 DWCi_GT2ConnectedCallback
+800d9420 DWCi_MatchGPRecvBuddyMsgCallback
+800d9510 DWCi_StopMatch
+800d9688 DWCi_ClearQR2Key
+800d96e8 DWCi_ProcessMatchSynPacket
+800da6b8 DWCi_ProcessMatchPollingPacket
+800da83c DWCi_ProcessMatchClosing
+800dac9c DWCi_ProcessMatchSCClosing
+800dacd4 DWCi_GPSetServerStatus
+800dad9c DWCi_ShutdownMatch
+800dae44 DWCi_IsShutdownMatch
+800dae54 DWCi_ResetMatchParam
+800db2f8 DWCi_SetMatchCommonParam
+800db418 DWCi_CloseMatch
+800db614 DWCi_SBUpdateAsync
+800db784 DWCi_SBUpdateAsync_switch
+800db788 DWCi_SBUpdateAsync_caseD_2
+800db838 DWCi_SBUpdateAsync_caseD_14
+800db860 DWCi_SBUpdateAsync_caseD_8
+800db884 DWCi_SBUpdateAsync_caseD_b
+800db8b8 DWCi_SBUpdateAsync_caseD_0
+800db9a8 DWCi_NNStartupAsync
+800dbd38 DWCi_SendMatchCommand
+800dc234 DWCi_ProcessRecvMatchCommand
+800de6b8 DWCi_CheckResvCommand
+800de988 DWCi_CheckResvCommand_Sub
+800dec24 DWCi_ProcessResvOK
+800deddc DWCi_SendResvCommand
+800df094 DWCi_RetryReserving
+800df3fc DWCi_CancelPreConnectedServerProcessWithResetLevel
+800df74c DWCi_RestartFromTimeout
+800dfb04 DWCi_PostProcessConnection
+800e09ac DWCi_DoCancelMatch
+800e0f90 DWCi_RestartFromCancel
+800e12a0 DWCi_CloseShutdownClientSC
+800e1590 DWCi_SendMatchSynPacket
+800e1944 DWCi_ProcessMatchSynTimeout
+800e1cac DWCi_ProcessCancelMatchSynCommand
+800e23a4 DWCi_ProcessCancelMatchSynTimeout
+800e27ac DWCi_HandleGPError
+800e2990 DWCi_HandleSBError
+800e2b98 DWCi_HandleQR2Error
+800e2df0 DWCi_HandleNNError
+800e2fc4 DWCi_HandleGT2Error
+800e3020 DWCi_HandleGT2Error_switch
+800e3024 DWCi_HandleGT2Error_caseD_1
+800e3030 DWCi_HandleGT2Error_caseD_2
+800e3040 DWCi_HandleGT2Error_caseD_3
+800e304c DWCi_HandleGT2Error_caseD_4
+800e3058 DWCi_HandleGT2Error_caseD_6
+800e3064 DWCi_HandleGT2Error_caseD_7
+800e306c DWCi_HandleGT2Error_caseD_7
+800e31c0 DWCi_SBCallback
+800e4600 DWCi_SBPrintServerData
+800e48c8 DWCi_EvaluateServers
+800e4ad0 DWCi_RandomizeServers
+800e4c88 DWCi_QR2ServerKeyCallback
+800e551c DWCi_QR2PlayerKeyCallback
+800e5520 DWCi_QR2TeamKeyCallback
+800e5524 DWCi_QR2KeyListCallback
+800e562c DWCi_QR2CountCallback
+800e5634 DWCi_QR2AddErrorCallback
+800e5644 0x800e5644
+800e569c DWCi_QR2PublicAddrCallback
+800e5708 DWCi_QR2NatnegCallback
+800e5830 DWCi_HandleGT2UnreliableMatchCommandMessage
+800e59a0 DWCi_QR2ClientMsgCallback
+800e5b58 DWCi_NNProgressCallback
+800e5b70 DWCi_NNCompletedCallback
+800e6974 DWCi_SendServerDownQuery
+800e6a8c DWCi_IsBackupMine
+800e6b10 DWCi_SetupGameServer_InterChange
+800e6d90 DWCi_SendServerPolling
+800e6fa0 DWCi_ProcessRequestMatch
+800e73a8 DWCi_StartMatch
+800e7798 DWCi_RequestSuspendMatchAsync
+800e7ae0 DWCi_IsServerChanging
+800e7b08 DWCi_GetMatchCntExt
+800e7b10 DWCi_SetMatchStatus
+800e7bf8 DWCi_IsServerChangeEnabled
+800e7c14 DWCi_NodeInfoList_Clear
+800e7c28 DWCi_NodeInfoList_GetCount
+800e7c34 DWCi_NodeInfoList_RemoveAid
+800e7d18 DWCi_NodeInfoList_RemoveProfileID
+800e7dfc DWCi_NodeInfoList_GetMyNodeInfo
+800e7e4c DWCi_NodeInfoList_GetServerNodeInfo
+800e7e6c DWCi_NodeInfoList_GetNodeInfoForIndex
+800e7e94 DWCi_NodeInfoList_GetNodeInfoForProfileId
+800e7ee0 DWCi_NodeInfoList_GetNodeInfoForAid
+800e7f2c DWCi_NodeInfoList_GetFreeAid
+800e7f98 DWCi_GetNextMeshMakeTryTick
+800e8138 DWCi_StopMeshMaking
+800e8380 DWCi_SendReliable
+800e8654 DWC_SendUnreliable
+800e8750 DWC_SetRecvBuffer
+800e8780 DWC_SetUserRecvCallback
+800e87a0 DWC_SetSendSplitMax
+800e87c8 DWCi_InitTransport
+800e8814 DWCi_RecvCallback
+800e88f8 DWCi_PingCallback
+800e8950 DWCi_TransportProcess
+800e8cec DWCi_ClearTransConnection
+800e8d68 DWCi_ShutdownTransport
+800e8d74 DWCi_ResetLastSomeDataRecvTimeByAid
+800e8db4 DWCi_SendUnreliable
+800e8f70 DWCs_HandleReliableMessage
+800e91cc DWCs_HandleUnreliableMessage
+800e9414 DWCi_Np_SetInitFlag
+800e941c DWCi_Np_CPUCopyFast
+800e94f8 DWCi_Np_CPUCopyFast_switch
+800e94fc DWCi_Np_CPUCopyFast_caseD_1
+800e950c DWCi_Np_CPUCopyFast_caseD_2
+800e951c DWCi_Np_CPUCopyFast_caseD_3
+800e952c DWCi_Np_CPUCopyFast_caseD_4
+800e953c DWCi_Np_CPUCopyFast_caseD_5
+800e954c DWCi_Np_CPUCopyFast_caseD_6
+800e955c DWCi_Np_CPUCopyFast_caseD_7
+800e978c DWCi_Np_CPUCopyFast_switch
+800e9790 DWCi_Np_CPUCopyFast_caseD_f
+800e97a0 DWCi_Np_CPUCopyFast_caseD_e
+800e97b0 DWCi_Np_CPUCopyFast_caseD_d
+800e97c0 DWCi_Np_CPUCopyFast_caseD_c
+800e97d0 DWCi_Np_CPUCopyFast_caseD_b
+800e97e0 DWCi_Np_CPUCopyFast_caseD_a
+800e97f0 DWCi_Np_CPUCopyFast_caseD_9
+800e9800 DWCi_Np_CPUCopyFast_caseD_8
+800e9810 DWCi_Np_CPUCopyFast_caseD_7
+800e9820 DWCi_Np_CPUCopyFast_caseD_6
+800e9830 DWCi_Np_CPUCopyFast_caseD_5
+800e9840 DWCi_Np_CPUCopyFast_caseD_4
+800e9850 DWCi_Np_CPUCopyFast_caseD_3
+800e9860 DWCi_Np_CPUCopyFast_caseD_2
+800e9870 DWCi_Np_CPUCopyFast_caseD_1
+800e9880 DWCi_Np_CPUCopyFast_caseD_0
+800e99b8 DWCi_Np_CPUCopyFast_switch
+800e99bc DWCi_Np_CPUCopyFast_caseD_7
+800e99cc DWCi_Np_CPUCopyFast_caseD_6
+800e99dc DWCi_Np_CPUCopyFast_caseD_5
+800e99ec DWCi_Np_CPUCopyFast_caseD_4
+800e99fc DWCi_Np_CPUCopyFast_caseD_3
+800e9a0c DWCi_Np_CPUCopyFast_caseD_2
+800e9a1c DWCi_Np_CPUCopyFast_caseD_1
+800e9a2c DWCi_Np_CPUCopyFast_caseD_0
+800e9a80 DWCi_Np_CPUCopyFast_caseD_0
+800e9c60 DWCi_Np_CPUCopyFast_switch
+800e9c64 DWCi_Np_CPUCopyFast_caseD_7
+800e9c7c DWCi_Np_CPUCopyFast_caseD_6
+800e9c94 DWCi_Np_CPUCopyFast_caseD_5
+800e9cac DWCi_Np_CPUCopyFast_caseD_4
+800e9cc4 DWCi_Np_CPUCopyFast_caseD_3
+800e9cdc DWCi_Np_CPUCopyFast_caseD_2
+800e9cf4 DWCi_Np_CPUCopyFast_caseD_1
+800e9d0c DWCi_Np_CPUCopyFast_caseD_0
+800e9d30 DWCi_Np_CPUCopyFast_switch
+800e9d34 DWCi_Np_CPUCopyFast_caseD_7
+800e9d44 DWCi_Np_CPUCopyFast_caseD_6
+800e9d54 DWCi_Np_CPUCopyFast_caseD_5
+800e9d64 DWCi_Np_CPUCopyFast_caseD_4
+800e9d74 DWCi_Np_CPUCopyFast_caseD_3
+800e9d84 DWCi_Np_CPUCopyFast_caseD_2
+800e9d94 DWCi_Np_CPUCopyFast_caseD_1
+800e9d9c DWCi_Np_CPUCopyFast_caseD_0
+800e9da0 DWCi_Np_GetTimeInSeconds
+800e9de8 DWCi_Np_GetConsoleid
+800e9f00 DWCi_Np_GetConsoleName
+800e9f08 DWCi_Np_GetAppGameName
+800e9f0c MATHi_CRC8InitTable
+800e9fac MATHi_CRC32InitTableRev
+800ea04c MATH_CalcCRC8
+800ea11c MATH_CalcCRC32
+800ea260 DWC_GdbInitialize
+800ea4d4 DWC_GdbShutdown
+800ea560 DWC_GdbProcess
+800ea594 DWC_GdbGetState
+800ea5d0 DWC_GdbCreateRecordAsync
+800ea71c DWC_GdbUpdateRecordAsync
+800ea86c DWC_GdbDownloadFileAsync
+800ea9f4 DWC_GdbGetMyRecordsAsync
+800eab48 DWC_GdbSearchRecordsAsync
+800eace8 DWCi_GdbGetFileResultError
+800ead0c 0x800ead0c
+800ead18 0x800ead18
+800ead20 0x800ead20
+800ead28 0x800ead28
+800ead30 0x800ead30
+800ead38 0x800ead38
+800ead40 0x800ead40
+800ead48 0x800ead48
+800ead88 DWCi_GdbPrintf
+800eae58 DWCi_GdbCheckStateForAsyncProcess
+800eaf54 DWCi_GdbSakeRequestCallback
+800eb05c DWCi_GdbSakeRequestCallback_switch
+800eb060 DWCi_GdbSakeRequestCallback_caseD_2
+800eb0a4 DWCi_GdbSakeRequestCallback_caseD_3
+800eb0d4 DWCi_GdbSakeRequestCallback_caseD_4
+800eb108 DWCi_GdbSakeRequestCallback_caseD_7
+800eb14c DWCi_GdbSakeRequestCallback_caseD_8
+800eb1a0 DWCi_GdbSakeRequestCallback_caseD_9
+800eb1e4 DWCi_GdbSakeRequestCallback_caseD_a
+800eb218 DWCi_GdbSakeRequestCallback_caseD_b
+800eb25c DWCi_GdbSakeRequestCallback_caseD_c
+800eb2dc DWCi_GdbSakeRequestCallback_caseD_d
+800eb318 DWCi_GdbSakeRequestCallback_caseD_0
+800eb344 DWCi_GdbGHTTPPostCallback
+800eb46c DWCi_GdbGHTTPPostCallback_switch
+800eb470 DWCi_GdbGHTTPPostCallback_caseD_0
+800eb47c DWCi_GdbGHTTPPostCallback_caseD_1
+800eb484 DWCi_GdbGHTTPPostCallback_caseD_2
+800eb48c DWCi_GdbGHTTPPostCallback_caseD_3
+800eb494 DWCi_GdbGHTTPPostCallback_caseD_4
+800eb49c DWCi_GdbGHTTPPostCallback_caseD_5
+800eb4a4 DWCi_GdbGHTTPPostCallback_caseD_6
+800eb4ac DWCi_GdbGHTTPPostCallback_caseD_7
+800eb59c DWCi_GdbGHTTPGetCallback
+800eb630 DWCi_GdbStartRequestResultToError
+800eb654 DWCi_GdbStartRequestResultToError_switch
+800eb658 DWCi_GdbStartRequestResultToError_caseD_0
+800eb668 DWCi_GdbStartRequestResultToError_caseD_1
+800eb670 DWCi_GdbStartRequestResultToError_caseD_2
+800eb680 DWCi_GdbStartRequestResultToError_caseD_3
+800eb688 DWCi_GdbStartRequestResultToError_caseD_4
+800eb690 DWCi_GdbStartRequestResultToError_caseD_5
+800eb698 DWCi_GdbStartRequestResultToError_caseD_6
+800eb6a0 DWCi_GdbStartRequestResultToError_caseD_7
+800eb6a8 DWCi_GdbStartRequestResultToError_caseD_8
+800eb6b0 DWCi_GdbStartRequestResultToError_caseD_9
+800eb6b8 DWCi_GdbStartRequestResultToError_caseD_a
+800eb6c0 DWCi_GdbStartRequestResultToError_caseD_b
+800eb6c8 DWCi_GdbStartRequestResultToError_caseD_c
+800eb6d0 DWCi_GdbStartRequestResultToError_caseD_d
+800eb6d8 DWCi_GdbStartRequestResultToError_caseD_e
+800eb6e8 DWCi_GdbRequestResultToAsyncResult
+800eb70c DWCi_GdbRequestResultToAsyncResult_switch
+800eb710 DWCi_GdbRequestResultToAsyncResult_caseD_0
+800eb720 DWCi_GdbRequestResultToAsyncResult_caseD_1
+800eb728 DWCi_GdbRequestResultToAsyncResult_caseD_2
+800eb730 DWCi_GdbRequestResultToAsyncResult_caseD_3
+800eb738 DWCi_GdbRequestResultToAsyncResult_caseD_4
+800eb740 DWCi_GdbRequestResultToAsyncResult_caseD_5
+800eb748 DWCi_GdbRequestResultToAsyncResult_caseD_6
+800eb758 DWCi_GdbRequestResultToAsyncResult_caseD_7
+800eb760 DWCi_GdbRequestResultToAsyncResult_caseD_8
+800eb768 DWCi_GdbRequestResultToAsyncResult_caseD_9
+800eb770 DWCi_GdbRequestResultToAsyncResult_caseD_a
+800eb778 DWCi_GdbRequestResultToAsyncResult_caseD_b
+800eb780 DWCi_GdbRequestResultToAsyncResult_caseD_c
+800eb788 DWCi_GdbRequestResultToAsyncResult_caseD_d
+800eb790 DWCi_GdbRequestResultToAsyncResult_caseD_e
+800eb798 DWCi_GdbRequestResultToAsyncResult_caseD_f
+800eb7a0 DWCi_GdbRequestResultToAsyncResult_caseD_10
+800eb7a8 DWCi_GdbRequestResultToAsyncResult_caseD_11
+800eb7b0 DWCi_GdbRequestResultToAsyncResult_caseD_12
+800eb7b8 DWCi_GdbRequestResultToAsyncResult_caseD_13
+800eb7c0 DWCi_GdbRequestResultToAsyncResult_caseD_14
+800eb7c8 DWCi_GdbRequestResultToAsyncResult_caseD_15
+800eb7d0 DWCi_GdbRequestResultToAsyncResult_caseD_16
+800eb7e0 DWCi_CfReset
+800eb830 DWCi_Acc_GetUserId
+800eb840 DWCi_Acc_GetPlayerId
+800eb848 DWCi_Acc_SetUserId
+800eb868 DWCi_Acc_SetPlayerId
+800eb870 DWC::IsBuddyFriendData
+800eb894 DWC_GetFriendDataType
+800eb8a0 DWCi_SetBuddyFriendData
+800eb8d8 DWC::CheckFriendKey
+800eba5c DWCi_Acc_LoginIdToUserName
+800ebbe4 DWCi_Acc_CreateUserData
+800ebe3c DWCi_Acc_CreateTempLoginId
+800ebf04 DWCi_Acc_CheckConsoleUserId
+800ebf54 DWCi_Acc_IsValidLoginId
+800ebf6c DWCi_Acc_IsAuthentic
+800ebf84 DWC::IsValidFriendData
+800ebf9c DWC::CreateUserData
+800ebfd4 DWC::CheckUserData
+800ec150 DWC::CheckHasProfile
+800ec184 DWCi_Acc_SetLoginIdToUserData
+800ec314 DWC::CheckDirtyFlag
+800ec320 DWC::ClearDirtyFlag
+800ec324 0x800ec324
+800ec498 DWC::GetGsProfileId
+800ec6bc DWC::CreateFriendKey
+800ec764 DWC::CreateFriendKeyToken
+800ec7dc DWC_SetGsProfileId
+800ec844 DWC_LoginIdToUserName
+800ec9cc DWC::IsEqualFriendData
+800eca8c DWCi_Auth_InitInterface
+800ecafc DWCi_Auth_StartAuthentication
+800ecca4 DWCi_Auth_Prof_StartAuthentication
+800ecd80 DWCi_Auth_AbortAuthentication
+800ecf20 DWCi_Auth_ProcessAuthentication
+800ecf5c DWCi_Auth_ProcessAuthentication_switch
+800ecf60 DWCi_Auth_ProcessAuthentication_caseD_1
+800ecfa4 DWCi_Auth_ProcessAuthentication_caseD_2
+800ecfcc DWCi_Auth_ProcessAuthentication_caseD_3
+800ecff4 DWCi_Auth_ProcessAuthentication_caseD_4
+800ed084 DWCi_Auth_ProcessAuthentication_caseD_5
+800ed0a8 DWCi_Auth_ProcessAuthentication_caseD_6
+800ed0d0 DWCi_Auth_ProcessAuthentication_caseD_7
+800ed0f4 DWCi_Auth_ProcessAuthentication_caseD_8
+800ed138 DWCi_Auth_ProcessAuthentication_caseD_9
+800ed16c DWCi_Auth_ProcessAuthentication_caseD_a
+800ed260 DWCi_Auth_ProcessAuthentication_caseD_b
+800ed28c DWCi_Auth_ProcessAuthentication_caseD_c
+800ed2b4 DWCi_Auth_ProcessAuthentication_caseD_d
+800ed2e0 DWCi_Auth_ProcessAuthentication_caseD_e
+800ed308 DWCi_Auth_ProcessAuthentication_caseD_f
+800ed348 DWCi_Auth_ProcessAuthentication_caseD_10
+800ed3a4 DWCi_Auth_ProcessAuthentication_caseD_11
+800ed3c8 DWCi_Auth_ProcessAuthentication_caseD_12
+800ed3f0 DWCi_Auth_ProcessAuthentication_caseD_13
+800ed430 DWCi_Auth_ProcessAuthentication_caseD_14
+800ed524 DWCi_Auth_ProcessAuthentication_caseD_15
+800ed53c DWCi_Auth_ProcessAuthentication_caseD_16
+800ed560 DWCi_Auth_ProcessAuthentication_caseD_17
+800ed5a8 DWCi_Auth_ProcessAuthentication_caseD_0
+800ed5c0 DWCi_IsAuthFinished
+800ed5fc DWCi_IsAuthSucceeded
+800ed614 DWCi_Auth_GetErrorCode
+800ed620 DWCi_Auth_GetGameSpyToken
+800ed66c DWCi_Auth_GetConsoleUserId
+800ed680 DWCi_Auth_GetIngamesnCheckResult
+800ed690 DWCi_Auth_GetProfResult
+800ed69c nand_callback
+800ed6b4 0x800ed6b4
+800ed6d0 0x800ed6d0
+800ed6e8 DWCi_Auth_SendRequest
+800ee22c DWCi_Auth_HandleResponse
+800eeb6c DWCi_Auth_EndProcess
+800eebc4 DWCi_Auth_HandleNandResult
+800eecec DWC_GetIngamesnCheckResult
+800eecf0 DWCi_CheckProfanityAsync
+800eefb8 DWC_CheckProfanityProcess
+800ef30c DWC_CheckProfanityAsync
+800ef378 ArrayNew
+800ef414 ArrayFree
+800ef4a8 ArrayLength
+800ef4b0 ArrayNth
+800ef4e0 ArrayAppend
+800ef604 ArrayInsertSorted
+800ef784 ArrayRemoveAt
+800ef830 ArrayDeleteAt
+800ef920 ArrayReplaceAt
+800ef9d8 ArraySort
+800ef9f0 ArraySearch
+800efb88 ArrayMapBackwards
+800efc24 ArrayMapBackwards2
+800efcc8 ArrayClear
+800efdcc TableNew
+800efde8 TableNew2
+800efe8c TableFree
+800eff08 TableCount
+800eff90 TableEnter
+800f0000 0x800f0000
+800f0038 TableRemove
+800f00dc TableLookup
+800f017c TableMapSafe
+800f01e8 TableMapSafe2
+800f0264 MD5Update
+800f0350 MD5Transform
+800f0e08 MD5Digest
+800f118c socket
+800f11c4 closesocket
+800f11f8 shutdown
+800f122c bind
+800f12a4 connect
+800f1308 recv
+800f1340 recvfrom
+800f13a0 send
+800f13d4 sendto
+800f1454 setsockopt
+800f1488 getsockname
+800f14e4 inet_addr
+800f151c GOAGetLastError
+800f1524 GSISocketSelect
+800f164c gethostbyname
+800f1bc8 SetSockBlocking
+800f1c40 SetReceiveBufferSize
+800f1c9c CanReceiveOnSocket
+800f1ce4 CanSendOnSocket
+800f1d2c getlocalhost
+800f1ee0 IsPrivateIP
+800f1f58 gsiInterlockedIncrement
+800f1fa0 gsiInterlockedDecrement
+800f1fe8 gsiInitializeCriticalSection
+800f1fec gsiEnterCriticalSection
+800f1ff0 gsiLeaveCriticalSection
+800f1ff4 0x800f1ff4
+800f1ff8 gsiTimeInSec
+800f2048 gsiResolveHostnameThread
+800f2104 gsiStartResolvingHostname
+800f2238 gsiCancelResolvingHostname
+800f2300 gsiGetResolvedIP
+800f23f4 goastrdup
+800f2464 _strlwr
+800f24c0 SocketStartUp
+800f24c4 SocketShutDown
+800f24c8 current_time
+800f2510 msleep
+800f254c gsiSecondsToDate
+800f27b4 gsiDateToSeconds
+800f2ec8 Util_RandSeed
+800f2ee0 Util_RandInt
+800f2f54 B64Decode
+800f3278 B64Encode
+800f3484 B64DecodeLen
+800f3528 B64InitEncodeStream
+800f3538 B64EncodeStream
+800f3844 gsiMemoryCallbacksSet
+800f3860 gsimalloc
+800f3870 gsirealloc
+800f3884 gsifree
+800f38a4 GS::IStartAvailableCheckA
+800f3a20 GS::IAvailableCheckThink
+800f3bf8 gsiCoreAtExitShutdown
+800f3c08 gsCoreInitialize
+800f3d10 gsCoreTaskThink
+800f3f2c gsCoreThink
+800f4024 gsCoreShutdown
+800f4114 gsCoreIsShutdown
+800f4148 gsiCoreExecuteTask
+800f41dc gsiCoreCreateTask
+800f4234 gsiExecuteSoap
+800f432c gsiSoapTaskHttpCompletedCallback
+800f43c4 gsiSoapTaskThink
+800f4400 gsiSoapTaskExecute
+800f44b0 gsiSoapTaskCancel
+800f4504 gsiSoapTaskCallback
+800f4524 gsiSoapTaskCleanup
+800f458c _ReadUCS2CharFromUTF8String
+800f4680 _UCS2CharToUTF8String
+800f46e8 _UTF8ToUCS2ConversionLengthOnly
+800f4774 UTF8ToUCS2StringAlloc
+800f47e4 UTF8ToUCS2StringLen
+800f489c gsUdpRemotePeerCompare
+800f48a4 0x800f48a4
+800f48ac 0x800f48ac
+800f48bc 0x800f48bc
+800f48f0 gsUdpRemotePeerCompare2
+800f490c gsUdpSocketError
+800f49ac gsUdpClosedRoutingCB
+800f4afc gsUdpConnectedRoutingCB
+800f4d28 gsUdpPingRoutingCB
+800f4e24 gsUdpReceivedRoutingCB
+800f4f54 gsUdpUnrecognizedMsgCB
+800f4fe8 gsUdpConnAttemptCB
+800f5144 gsUdpEngineIsInitialized
+800f5154 gsUdpEngineInitialize
+800f52c8 gsUdpEngineGetPeerState
+800f5374 gsUdpEngineStartTalkingToPeer
+800f5580 gsUdpEngineSendMessage
+800f56c4 gsUdpEngineThink
+800f5708 gsUdpEngineShutdown
+800f576c gsUdpEngineGetLocalPort
+800f5790 gsUdpEngineAddMsgHandler
+800f587c gsUdpEngineRemoveMsgHandler
+800f591c gsUdpEngineNoMoreMsgHandlers
+800f5964 gsUdpEngineNoApp
+800f59e4 gsUdpEngineGetPeerOutBufferFreeSpace
+800f5a6c gsXmlCreateStreamWriter
+800f618c gsXmlCreateStreamReader
+800f6244 gsXmlParseBuffer
+800f62c8 gsXmlFreeWriter
+800f6300 gsXmlFreeReader
+800f6340 gsXmlCloseWriter
+800f6440 gsiXmlUtilElementFree
+800f6444 gsiXmlUtilAttributeFree
+800f6448 gsXmlWriterGetData
+800f6450 gsXmlWriterGetDataLength
+800f6458 gsiXmlUtilParseElement
+800f6d34 gsiXmlUtilParseName
+800f6d4c 0x800f6d4c
+800f6f60 gsiXmlUtilParseString
+800f70d0 gsiXmlUtilDecodeString
+800f7528 gsXmlWriteOpenTag
+800f7834 gsXmlWriteCloseTag
+800f7bc0 gsXmlWriteStringElement
+800f82a0 gsXmlWriteUnicodeStringElement
+800f8a3c gsXmlWriteIntElement
+800f9170 gsXmlWriteFloatElement
+800f98a0 gsXmlWriteBase64BinaryElement
+800fa00c gsXmlWriteDateTimeElement
+800fa774 gsiXmlUtilWriteXmlSafeString
+800fad2c gsXmlMoveToStart
+800fad40 gsXmlMoveToNext
+800fadd4 gsXmlMoveToParent
+800fae70 gsXmlMoveToChild
+800faf38 gsXmlReadChildAsString
+800fb014 gsXmlReadChildAsStringNT
+800fb0b8 gsXmlReadChildAsHexBinary
+800fb26c gsXmlReadChildAsBase64Binary
+800fb394 gsXmlReadChildAsInt
+800fb478 gsXmlReadChildAsDateTimeElement
+800fb5ac gsXmlReadChildAsFloat
+800fb694 gsiXmlUtilTagMatches
+800fb778 gsXmlCountChildren
+800fb78c 0x800fb78c
+800fb828 gpInitialize
+800fb854 gpDestroy
+800fb874 gpProcess
+800fb8b0 gpSetCallback
+800fb920 gpConnectPreAuthenticatedA
+800fba4c gpDisconnect
+800fbaa8 gpProfileSearchA
+800fbb78 gpGetInfo
+800fbc58 gpSetInfosA
+800fbcc8 gpSendBuddyRequestA
+800fbe38 gpAuthBuddyRequest
+800fbea8 gpDenyBuddyRequest
+800fbfa0 gpGetNumBuddies
+800fbfe8 gpGetBuddyStatus
+800fc1c0 gpGetBuddyIndex
+800fc2a4 gpIsBuddy
+800fc364 gpDeleteBuddy
+800fc3ec gpSetStatusA
+800fc614 gpSendBuddyMessageA
+800fc6b0 gpGetReversBuddiesList
+800fc788 gpGetLoginTicket
+800fc7d4 gpiInitialize
+800fc9a0 gpiDestroy
+800fc9fc gpiResetProfile
+800fca1c gpiReset
+800fcc64 gpiProcessConnectionManager
+800fcfbc gpiProcess
+800fd160 gpiProcessRecvBuddyMessage
+800fdc4c gpiProcessRecvBuddyStatusInfo
+800fe2f8 gpiSendServerBuddyMessage
+800fe3ec gpiSendBuddyMessage
+800fe5a4 gpiBuddyHandleKeyRequest
+800fe648 gpiBuddyHandleKeyReply
+800fea64 gpiAuthBuddyRequest
+800febd4 gpiFixBuddyIndices
+800fec20 gpiDeleteBuddy
+800fedbc 0x800fedbc
+800fee90 gpiAppendCharToBuffer
+800fef38 gpiAppendStringToBufferLen
+800ff014 gpiAppendStringToBuffer
+800ff070 gpiAppendIntToBuffer
+800ff0d0 gpiSendData
+800ff1d4 gpiSendOrBufferChar
+800ff1dc gpiSendOrBufferStringLenToPeer
+800ff2f4 gpiSendOrBufferString
+800ff350 gpiRecvToBuffer
+800ff498 gpiSendFromBuffer
+800ff598 gpiSendBufferToPeer
+800ff6f0 gpiReadMessageFromBuffer
+800ff844 gpiClipBufferToPosition
+800ff8c4 gpiCallErrorCallback
+800ff984 gpiAddCallback
+800ffa54 gpiCallCallback
+800ffd08 gpiProcessCallbacks
+800ffe28 gpiStartConnect
+80100000 0x80100000
+80100150 gpiConnect
+801003a4 gpiSendLogin
+801007dc gpiSendNewuser
+801009fc gpiProcessConnect
+80101088 gpiCheckConnect
+80101128 gpiDisconnectCleanupProfile
+801012b8 gpiDisconnect
+80101470 gpiIsValidDate
+801014cc gpiIsValidDate_switch
+801014d0 gpiIsValidDate_caseD_0
+801014dc gpiIsValidDate_caseD_1
+801014ec gpiIsValidDate_caseD_4
+801014fc gpiIsValidDate_caseD_2
+801015d4 gpiInfoCacheToArg
+80101810 gpiProcessGetInfo
+801020d0 gpiAddLocalInfo
+801021e4 gpiSetInfoi
+80102228 gpiSetInfoi_switch
+8010222c gpiSetInfoi_caseD_708
+801022a4 gpiSetInfoi_caseD_70b
+801023cc gpiSetInfoi_caseD_706
+8010242c gpiSetInfoi_caseD_70c
+8010248c gpiSetInfoi_caseD_70d
+801024ec gpiSetInfoi_caseD_70e
+80102554 gpiSetInfoi_caseD_710
+801025bc gpiSetInfoi_caseD_712
+80102624 gpiSetInfoi_caseD_713
+80102684 gpiSetInfoi_caseD_714
+801026e4 gpiSetInfoi_caseD_715
+80102750 gpiSetInfoi_caseD_718
+801027b0 gpiSetInfoi_caseD_719
+80102810 gpiSetInfoi_caseD_71a
+80102870 gpiSetInfoi_caseD_71b
+801028d0 gpiSetInfoi_caseD_71c
+80102930 gpiSetInfoi_caseD_71d
+80102990 gpiSetInfoi_caseD_71e
+801029f0 gpiSetInfoi_caseD_707
+80102a24 gpiSetInfos
+80102a8c gpiSetInfos_switch
+80102a90 gpiSetInfos_caseD_700
+80102b1c gpiSetInfos_caseD_701
+80102ba8 gpiSetInfos_caseD_702
+80102c3c gpiSetInfos_caseD_703
+80102cd4 gpiSetInfos_caseD_704
+80102d34 gpiSetInfos_caseD_705
+80102d94 gpiSetInfos_caseD_707
+80102df4 gpiSetInfos_caseD_708
+80102e54 gpiSetInfos_caseD_709
+80102ed8 gpiSetInfos_caseD_70b
+80102fa4 gpiSetInfos_caseD_706
+80103004 gpiSetInfos_caseD_70d
+80103028 gpiSetInfos_caseD_70e
+8010304c gpiSetInfos_caseD_70f
+801030ac gpiSetInfos_caseD_710
+801030d0 gpiSetInfos_caseD_711
+80103130 gpiSetInfos_caseD_712
+80103154 gpiSetInfos_caseD_714
+80103178 gpiSetInfos_caseD_715
+8010319c gpiSetInfos_caseD_716
+801031fc gpiSetInfos_caseD_717
+8010325c gpiSetInfos_caseD_718
+801032bc gpiSetInfos_caseD_719
+8010331c gpiSetInfos_caseD_71a
+8010337c gpiSetInfos_caseD_71b
+801033dc gpiSetInfos_caseD_71c
+8010343c gpiSetInfos_caseD_71d
+8010349c gpiSetInfos_caseD_71e
+801034fc gpiSetInfos_caseD_70a
+80103534 gpiSendGetInfo
+801035f8 gpiGetInfo
+80103834 gpiFreeInfoCache
+80103908 gpiStatusInfoKeyFree
+80103954 gpiStatusInfoKeysInit
+801039c4 gpiStatusInfoKeysDestroy
+80103a04 gpiStatusInfoKeyCompFunc
+80103a10 gpiStatusInfoAddKey
+80103aac gpiStatusInfoSetKey
+80103b64 gpiStatusInfoCheckKey
+80103c0c gpiSaveKeysToBuffer
+80103f70 gpiFailedOpCallback
+80103fd0 gpiFailedOpCallback_switch
+80103fd4 gpiFailedOpCallback_caseD_0
+80104064 gpiFailedOpCallback_caseD_1
+801040d8 gpiFailedOpCallback_caseD_5
+8010414c gpiFailedOpCallback_caseD_2
+801041c0 gpiFailedOpCallback_caseD_3
+8010423c gpiFailedOpCallback_caseD_4
+801042b0 gpiFailedOpCallback_caseD_6
+80104348 gpiAddOperation
+80104428 gpiDestroyOperation
+801044c8 gpiRemoveOperation
+80104514 gpiFindOperationByID
+80104564 gpiOperationsAreBlocking
+801045a4 gpiProcessOperation
+801045dc gpiProcessOperation_switch
+801045e0 gpiProcessOperation_caseD_0
+801045ec gpiProcessOperation_caseD_1
+801045f8 gpiProcessOperation_caseD_5
+80104604 gpiProcessOperation_caseD_2
+80104610 gpiProcessOperation_caseD_4
+8010461c gpiProcessOperation_caseD_6
+80104624 gpiProcessOperation_caseD_3
+80104648 gpiProcessPeerInitiatingConnection
+80104998 gpiProcessPeerAcceptingConnection
+80104bb4 gpiPeerSendMessages
+80104c98 gpiProcessPeerConnected
+80104ffc gpiCheckTimedOutPeerOperations
+801050fc gpiDestroyPeer
+80105164 gpiRemovePeer
+80105274 gpiProcessPeers
+801053b8 gpiGetPeerByProfile
+801053e4 gpiFreeMessage
+8010541c gpiAddPeer
+801054f0 gpiPeerGetSig
+80105578 gpiPeerStartConnect
+80105694 gpiPeerAddMessage
+80105810 gpiPeerStartTransferMessage
+80105888 gpiPeerFinishTransferMessage
+80105998 gpiPeerLeftCallback
+80105a28 gpiPeerMessageCallback
+80105ba8 gpiPeerAcceptedCallback
+80105c64 gpiPeerPingReplyCallback
+80105c68 gpiPeerAddOp
+80105cc0 gpiPeerRemoveOp
+80105d54 gpiProfilesTableHash
+80105d68 gpiProfilesTableCompare
+80105d78 gpiProfilesTableFree
+80105e94 gpiInitProfiles
+80105efc gpiProcessNewProfile
+80106084 gpiProfileListAdd
+80106158 gpiGetProfile
+801061ac gpiProcessDeleteProfle
+801062ec gpiRemoveProfileByID
+80106338 gpiRemoveProfile
+80106344 gpiCheckProfileForUser
+801063d0 gpiFindProfileByUser
+80106458 gsiProfileMapCallback
+80106478 gpiProfileMap
+801064c0 gpiCheckForBuddy
+80106518 gpiFindBuddy
+80106574 gpiRemoveBuddyStatus
+801065c8 gpiRemoveBuddyStatusInfo
+80106640 gpiCanFreeProfile
+8010669c gpiStartProfileSearch
+8010686c gpiInitSearchData
+80106958 gpiProfileSearch
+80106be8 gpiOthersBuddyList
+80106ce8 gpiProcessSearch
+801089e8 gpiProcessSearches
+80108b38 gpiHandleTransferMessage
+80108c20 gpiProcessRegisterUniqueNick
+80108d4c gpiProcessRegisterCdKey
+80108e78 strzcpy
+80108ebc gpiCheckForError
+80108fb4 gpiValueForKey
+80109060 gpiCheckSocketConnect
+8010914c gpiReadKeyAndValue
+80109330 gpiSetError
+80109380 gpiSetErrorString
+801093bc gpiEncodeString
+8010945c gti2GetChallenge
+8010956c gti2GetResponse
+8010975c gti2CheckResponse
+80109820 gti2AllocateBuffer
+80109878 gti2GetBufferFreeSpace
+80109888 gti2BufferWriteByte
+801098a0 gti2BufferWriteUShort
+801098cc gti2BufferWriteData
+80109958 gti2BufferShorten
+801099c4 gti2SocketErrorCallback
+80109a58 gti2ConnectAttemptCallback
+80109b40 gti2ConnectedCallback
+80109c1c gti2ReceivedCallback
+80109cf4 gti2ClosedCallback
+80109db0 gti2PingCallback
+80109e6c gti2SendFilterCallback
+80109f74 gti2ReceiveFilterCallback
+8010a07c gti2DumpCallback
+8010a178 gti2UnrecognizedMessageCallback
+8010a244 gti2NewOutgoingConnection
+8010a298 gti2NewIncomingConnection
+8010a2ec gti2StartConnectionAttempt
+8010a3c0 gti2AcceptConnection
+8010a464 gti2RejectConnection
+8010a4cc gti2ConnectionSendData
+8010a528 gti2CheckTimeout
+8010a624 gti2ConnectionThink
+8010a770 gti2CloseConnection
+8010a818 gti2ConnectionClosed
+8010a874 gti2ConnectionCleanup
+8010a918 gt2CreateSocket
+8010a920 gt2CloseSocket
+8010a964 gt2Think
+8010a9b0 gt2Listen
+8010a9b4 gt2Accept
+8010a9b8 gt2Reject
+8010a9bc gt2Connect
+8010ab64 gt2Send
+8010ac60 gti2CloseAllConnectionsHardMap
+8010ac68 0x8010ac68
+8010ac74 gt2CloseAllConnectionsHard
+8010ac88 gt2GetConnectionState
+8010acbc gt2GetRemoteIP
+8010acc4 gt2GetRemotePort
+8010accc gt2GetLocalIP
+8010acd4 gt2GetLocalPort
+8010acdc gt2GetOutgoingBufferSize
+8010ace4 gt2GetOutgoingBufferFreeSpace
+8010acf4 gt2GetSocketSOCKET
+8010acfc gt2SetUnrecognizedMessageCallback
+8010ad04 gt2SetConnectionData
+8010ad0c gt2GetConnectionData
+8010ad14 gti2HandleESN
+8010ae44 gti2HandleServerChallenge
+8010b178 gti2HandleClientResponse
+8010b480 gti2DeliverReliableMessage
+8010bc3c gti2IncomingBufferMessageCompare
+8010bc50 gti2BufferIncomingMessage
+8010bdfc gti2HandleReliableMessage
+8010c24c gti2HandleNack
+8010c434 gti2HandleUnreliableMessage
+8010c6fc gti2HandleMessage
+8010cb90 gti2HandleConnectionReset
+8010cda8 gti2HandleHostUnreachable
+8010ced8 gti2ReceiveMessages
+8010d124 gti2BeginReliableMessage
+8010d4b8 gti2SendClientChallenge
+8010d59c gti2SendAccept
+8010d664 gti2SendReject
+8010d758 gti2SendClose
+8010d820 gti2SendKeepAlive
+8010d8e8 gti2SendAppUnreliable
+8010da14 gti2SendAck
+8010dad8 gti2SendNack
+8010dbcc gti2SendClosed
+8010dc84 gti2ResendMessage
+8010dd40 gti2Send
+8010de30 gti2ConnectionHash
+8010de50 gti2ConnectionCompare
+8010de84 gti2ConnectionFree
+8010de8c gti2SocketFindConnection
+8010ded8 gti2CreateSocket
+8010e110 gti2CloseSocket
+8010e17c gti2NewSocketConnection
+8010e3f0 gti2FreeSocketConnection
+8010e4bc gti2SocketSend
+8010e6d8 gti2SocketConnectionsThinkMap
+8010e7f4 gti2SocketConnectionsThink
+8010e840 gti2FreeClosedConnections
+8010e930 gti2SocketError
+8010e9c0 gt2AddressToString
+8010eaa4 gt2StringToAddress
+8010ec48 gti2MessageCheck
+8010ecac qr2_init_socketA
+8010ef1c qr2_register_natneg_callback
+8010ef30 qr2_register_clientmessage_callback
+8010ef44 qr2_register_publicaddress_callback
+8010ef58 qr2_think
+8010f070 qr2_check_queries
+8010f12c qr2_check_send_heartbeat
+8010f240 qr2_send_statechanged
+8010f2b4 qr2_shutdown
+8010f354 qr2_keybuffer_add
+8010f394 qr2_buffer_add_int
+8010f434 qr2_buffer_addA
+8010f4b8 0x8010f4b8
+8010f4cc get_sockaddrin
+8010f5b0 gs_encode
+8010f748 gs_encrypt
+8010fb34 qr_build_partial_query_reply
+8010fe48 qr_build_split_query_reply
+80110190 qr_process_query
+80110350 qr_process_client_message
+80110494 qr2_process_ip_verify
+80110720 qr2_parse_queryA
+80110804 qr2_parse_queryA_switch
+80110808 qr2_parse_queryA_caseD_9
+80110824 qr2_parse_queryA_caseD_0
+801108d8 qr2_parse_queryA_caseD_1
+80110a90 qr2_parse_queryA_caseD_2
+80110acc qr2_parse_queryA_caseD_4
+80110b90 qr2_parse_queryA_caseD_6
+80110d7c qr2_parse_queryA_caseD_8
+80110d80 qr2_parse_queryA_caseD_3
+80110db8 send_keepalive
+80110e2c send_heartbeat
+8011156c qr2_internal_is_master_only_key
+801115d4 qr2_register_keyA
+801115fc ghiResizeBuffer
+8011167c ghiInitBuffer
+80111778 ghiInitFixedBuffer
+801117f0 ghiFreeBuffer
+80111850 ghiAppendDataToBuffer
+801119c0 ghiEncryptDataToBuffer
+80111b98 ghiAppendHeaderToBuffer
+80111c40 ghiAppendCharToBuffer
+80111d78 ghiAppendIntToBuffer
+80111dc4 ghiResetBuffer
+80111de8 ghiSendBufferedData
+80111f0c ghiCallCompletedCallback
+80111f94 ghiCallProgressCallback
+80111fcc ghiCallPostCallback
+8011202c ghiCreateLock
+80112030 ghiFreeLock
+80112034 ghiLock
+80112038 ghiUnlock
+8011203c ghiDecryptReceivedData
+8011218c ghiDoReceive
+80112348 ghiDoSend
+8011248c ghiTrySendThenBuffer
+801125c8 ghiFindFreeSlot
+801126d4 ghiNewConnection
+80112898 ghiFreeConnection
+80112a0c ghiRequestToConnection
+80112a7c ghiEnumConnections
+80112b08 ghiRedirectConnection
+80112c4c ghiCleanupConnections
+80112d14 ghttpSetRequestEncryptionEngine
+80112e40 ghiEncryptorSslInitFunc
+80112f20 ghiEncryptorSslCleanupFunc
+80112f90 ghiEncryptorSslStartFunc
+80113030 ghiEncryptorSslEncryptSend
+8011309c ghiEncryptorSslDecryptRecv
+8011311c ghiEncryptorSslEncryptFunc
+80113124 ghiEncryptorSslDecryptFunc
+8011312c ghiHandleStatus
+801131ec ghiProcessConnection
+80113388 ghttpStartup
+801133d8 ghttpCleanup
+80113434 ghttpGetExA
+8011364c ghttpPostA
+80113670 0x80113670
+80113814 ghttpThink
+80113820 ghttpRequestThink
+80113858 ghttpCancelRequest
+80113884 ghttpGetHeaders
+801138e8 ghttpSetMaxRecvTime
+80113920 ghttpNewPost
+80113924 ghttpPostSetAutoFree
+80113934 ghttpFreePost
+80113944 ghttpPostAddFileFromMemoryA
+801139ac ghttpPostAddXml
+801139b0 ghiPostDataFree
+80113a54 ghiNewPost
+80113ae4 ghiIsPostAutoFree
+80113aec ghiFreePost
+80113b24 ghiPostAddFileFromMemory
+80113c14 ghiPostAddXml
+80113c70 ghiPostGetContentType
+80113ccc ghiPostGetNoFilesContentLength
+80113d90 ghiPostGetHasFilesContentLength
+80114110 ghiPostStateInit
+801141cc ghiPostInitState
+80114398 ghiPostCleanupState
+80114474 ghiPostStringStateDoPosting
+80114620 ghiPostXmlStateDoPosting
+801147c0 ghiPostFileDiskStateDoPosting
+80114900 ghiPostFileMemoryStateDoPosting
+80114b1c ghiPostStateDoPosting
+80115138 ghiPostDoPosting
+80115384 ghiParseURL
+80115530 ghiDoSocketInit
+80115634 ghiDoHostLookup
+80115738 ghiDoLookupPending
+801157d8 ghiDoConnecting
+80115a34 ghiDoSecuringSession
+80115c08 ghiDoSendingRequest
+80115ef4 ghiDoPosting
+80115fec ghiDoWaiting
+801160a4 ghiParseStatus
+801161bc ghiDoReceivingStatus
+8011634c ghiDeliverIncomingFileData
+80116430 ghiProcessIncomingFileData
+8011669c ghiDoReceivingHeaders
+80116c4c ghiDoReceivingFile
+80116dd4 BucketNew
+80116f24 BucketSet
+80117040 BucketAdd
+801173e4 BucketSub
+80117650 BucketMult
+801178b4 BucketDiv
+80117b20 BucketConcat
+80117ca8 BucketAvg
+80117f6c CloseStatsConnection
+80118194 IsStatsConnected
+801181ac PersistThink
+80118660 ProcessGetData
+80118b8c ProcessStatement
+80119818 CallReqCallback
+8011996c ServerOpInt
+801199f8 ServerOpFloat
+80119a84 ServerOpString
+80119b14 TeamOpInt
+80119bf8 TeamOpFloat
+80119cd8 TeamOpString
+80119db4 PlayerOpInt
+80119e98 PlayerOpFloat
+80119f78 PlayerOpString
+8011a054 AddressToString
+8011a138 GetLocalIP
+8011a1d4 Think
+8011a500 NatifyThink
+8011a504 DetermineNatType
+8011a7c4 NNFreeNegotiateList
+8011a7f8 GetLocalIP
+8011a894 StartReport
+8011aa88 SendInitPackets
+8011ad38 CheckNatifyStatus
+8011ae3c NNBeginNegotiationWithSocket
+8011b158 NNCancel
+8011b204 NegotiateThink
+8011b718 NNThink
+8011b78c ProcessConnectPacket
+8011b9d8 ProcessPingPacket
+8011bd50 ProcessInitPacket
+8011bf54 NNProcessData
+8011c10c keyrand
+8011c1b4 GOACryptInit
+8011c460 GOADecrypt
+8011c540 FIFORemove
+8011c5b4 QEStartQuery
+8011c834 SBQueryEngineInit
+8011c8d4 SBQueryEngineSetPublicIP
+8011c8dc SBEngineHaltUpdates
+8011c8fc SBEngineCleanup
+8011c950 SBQueryEngineUpdateServer
+8011ca4c ParseSingleQR2Reply
+8011cc3c ProcessIncomingReplies
+8011ce38 SBQueryEngineThink
+8011cfb4 SBQueryEngineAddQueryKey
+8011cfd4 SBQueryEngineRemoveServerFromFIFOs
+8011d024 RefStringHash
+8011d098 RefStringFree
+8011d0a4 0x8011d0a4
+8011d0ac SBRefStrHash
+8011d104 SBRefStrHashCleanup
+8011d148 SBServerFree
+8011d188 SBServerAddKeyValue
+8011d1e4 SBServerAddIntKeyValue
+8011d254 SBServerGetStringValueA
+8011d2b0 SBServerGetIntValueA
+8011d3d4 SBServerGetFloatValueA
+8011d448 SBServerGetPublicAddress
+8011d474 SBServerGetPublicInetAddress
+8011d47c SBServerGetPublicQueryPort
+8011d484 SBServerGetPublicQueryPortNBO
+8011d48c SBServerHasPrivateAddress
+8011d498 SBServerGetPrivateAddress
+8011d4c4 SBServerGetPrivateInetAddress
+8011d4cc SBServerGetPrivateQueryPort
+8011d4d4 SBServerSetNext
+8011d4dc SBServerGetNext
+8011d4e4 SBServerParseKeyVals
+8011d6b0 SBServerParseQR2FullKeysSingle
+8011d8a4 SBServerParseQR2FullKeysSplit
+8011db20 KeyValFree
+8011db60 KeyValHashKey
+8011dbd4 KeyValCompareKey
+8011dbfc SBAllocServer
+8011dcc4 SBServerSetFlags
+8011dccc SBServerSetPrivateAddr
+8011dcd8 SBServerSetICMPIP
+8011dce0 SBServerSetState
+8011dce8 SBServerGetState
+8011dcf0 SBIsNullServer
+8011dd04 ListCallback
+8011dd44 ListCallback_switch
+8011dd48 ListCallback_caseD_0
+8011ddfc ListCallback_caseD_1
+8011de40 ListCallback_caseD_2
+8011de78 ListCallback_caseD_3
+8011dec4 ListCallback_caseD_5
+8011dee4 ListCallback_caseD_6
+8011def0 ListCallback_caseD_4
+8011df3c EngineCallback
+8011e038 ServerBrowserNewA
+8011e11c ServerBrowserFree
+8011e15c ServerBrowserBeginUpdate2
+8011e2a0 ServerBrowserLimitUpdateA
+8011e2ac ServerBrowserSendMessageToServerA
+8011e314 ServerBrowserSendNatNegotiateCookieToServerA
+8011e384 ServerBrowserRemoveServer
+8011e3c8 ServerBrowserThink
+8011e3fc ServerBrowserClear
+8011e43c ServerBrowserState
+8011e480 ServerBrowserGetServer
+8011e488 ServerBrowserCount
+8011e490 ServerBrowserSortA
+8011e510 ServerBrowserGetMyPublicIPAddr
+8011e518 prevKeyCompare
+8011e6a8 IntKeyCompare
+8011e744 FloatKeyCompare
+8011e81c StrCaseKeyCompare
+8011e8c0 StrNoCaseKeyCompare
+8011e964 SBServerListSort
+8011ead0 SBServerListFindServer
+8011eb58 SBServerListRemoveAt
+8011ebf8 0x8011ebf8
+8011ec20 SBServerListClear
+8011ecfc SBRefStr
+8011ed84 SBReleaseStr
+8011ede4 NTSLengthSB
+8011ee1c SBServerListInit
+8011ef34 ServerListConnect
+8011f0c0 SendWithRetry
+8011f45c SBServerListConnectAndQuery
+8011f95c SBServerListDisconnect
+8011fac8 SBServerListCleanup
+8011fcf8 FullRulesPresent
+8011fdd0 AllKeysPresent
+8011ff08 ParseServer
+801201d8 IncomingListParseServer
+80120394 ProcessMainListData
+80120cb8 ProcessPushKeyList
+80120e90 ProcessPlayerSearch
+80121054 ProcessMaploop
+80121224 ProcessPushServer
+801213d4 ProcessAdHocData
+80121824 ProcessIncomingData
+80121afc SBSendMessageToServer
+80121c00 SBSendNatNegotiateCookieToServer
+80121ca8 ProcessLanData
+80121e40 SBListThink
+80121eec sakeStartup
+80121f74 sakeShutdown
+80121f78 sakeSetGame
+80121fd8 sakeSetProfile
+80122020 sakeGetStartRequestResult
+80122028 sakeCreateRecord
+801220a4 sakeUpdateRecord
+80122120 sakeSearchForRecords
+8012219c sakeGetMyRecords
+80122218 sakeSetFileDownloadURL
+8012225c sakeGetFileDownloadURL
+80122328 sakeSetFileUploadURL
+8012236c sakeGetFileResultFromHeaders
+80122418 sakeGetFileIdFromHeaders
+8012249c sakeiInitRequest
+8012256c sakeiFreeRequest
+80122570 sakeiCheckSakeResult
+8012279c sakeiSoapCallback
+80122944 sakeiSetupRequest
+80122a84 sakeiStartRequest
+80122b18 sakeiValidateRequestFields
+80122bdc sakeiFillSoapRequestFieldValues
+80122efc sakeiCreateRecordValidateInput
+80122f48 sakeiCreateRecordFillSoapRequest
+80122fa4 sakeiCreateRecordProcessSoapResponse
+80122fe8 sakeiUpdateRecordValidateInput
+80122ff4 0x80122ff4
+80123038 sakeiUpdateRecordFillSoapRequest
+801230ac sakeiDeleteRecordValidateInput
+801230b8 0x801230b8
+801230d4 sakeiDeleteRecordFillSoapRequest
+80123138 sakeiReadOutputRecords
+8012365c sakeiFreeOutputRecords
+80123724 sakeiSearchForRecordsValidateInput
+801237c4 sakeiSearchForRecordsFillSoapRequest
+80123964 sakeiSearchForRecordsFreeData
+8012397c 0x8012397c
+801239a0 sakeiGetMyRecordsValidateInput
+801239ac 0x801239ac
+80123a24 sakeiGetMyRecordsFillSoapRequest
+80123ad4 sakeiGetMyRecordsFreeData
+80123aec 0x80123aec
+80123b10 sakeiGetSpecificRecordsValidateInput
+80123b1c 0x80123b1c
+80123bbc sakeiGetSpecificRecordsFillSoapRequest
+80123cb8 sakeiGetSpecificRecordsFreeData
+80123cd0 0x80123cd0
+80123cf4 sakeiGetRandomRecordValidateInput
+80123d6c sakeiGetRandomRecordFillSoapRequest
+80123e4c sakeiGetRandomRecordProcessSoapResponse
+80123ed8 sakeiGetRandomRecordFreeData
+80123f88 AIRegisterDMACallback
+80123fcc AIInitDMA
+80124048 AIStartDMA
+8012405c AIGetDMABytesLeft
+8012406c AIGetDMAStartAddr
+80124084 AIGetDMALength
+80124094 AICheckInit
+8012409c AIGetDSPSampleRate
+801240b0 AIInit
+80124230 __AIDHandler
+801242d8 __AICallbackStackSwitch
+8012433c __AI_SRC_INIT
+80124500 ARC::InitHandle
+801245a0 ARC::Open
+80124844 ARC::FastOpen
+80124894 ARC::ConvertPathToEntrynum
+80124af8 ent::ryToPath
+80124cc0 ARC::GetStartAddrInMem
+80124cd4 ARC::GetStartOffset
+80124cdc ARC::GetLength
+80124ce4 ARC::Close
+80124cec ARC::ChangeDir
+80124d44 ARC::OpenDir
+80124dc0 ARC::ReadDir
+80124e78 ARC::CloseDir
+80124e80 AXInit
+80124ed4 AXIsInit
+80124edc __AXGetStackHead
+80124ef0 __AXServiceCallbackStack
+80124f9c __AXAllocInit
+8012504c __AXPushFreeStack
+80125068 __AXPushCallbackStack
+80125078 __AXRemoveFromStack
+801250fc AXFreeVoice
+80125178 AXAcquireVoice
+801252f8 AXSetVoicePriority
+80125394 __AXAuxInit
+801254a8 __AXGetAuxAInput
+801254dc __AXGetAuxAOutput
+801254f8 __AXGetAuxAInputDpl2
+80125518 __AXGetAuxAOutputDpl2R
+80125538 __AXGetAuxAOutputDpl2Ls
+80125558 __AXGetAuxAOutputDpl2Rs
+80125578 __AXGetAuxBInput
+801255ac __AXGetAuxBOutput
+801255c8 __AXGetAuxBInputDpl2
+801255e8 __AXGetAuxBOutputDpl2R
+80125608 __AXGetAuxBOutputDpl2Ls
+80125628 __AXGetAuxBOutputDpl2Rs
+80125648 __AXGetAuxCInput
+8012567c __AXGetAuxCOutput
+80125698 __AXProcessAux
+80125a44 AXRegisterAuxACallback
+80125aa8 AXRegisterAuxBCallback
+80125b0c AXRegisterAuxCCallback
+80125b70 AXGetAuxACallback
+80125b84 AXGetAuxBCallback
+80125b98 AXGetAuxCCallback
+80125bac __AXGetCommandListCycles
+80125bb4 __AXGetCommandListAddress
+80125be4 __AXNextFrame
+801265a4 __AXClInit
+801265e0 AXSetMode
+801265e8 AXGetMode
+801265f0 AXGetAuxAReturnVolume
+801265f8 AXGetAuxBReturnVolume
+80126600 AXGetAuxCReturnVolume
+80126608 AXSetMasterVolume
+80126620 AXSetAuxAReturnVolume
+80126628 AXSetAuxBReturnVolume
+80126630 AXSetAuxCReturnVolume
+80126638 __AXOutNewFrame
+80126898 __AXOutAiCallback
+80126948 __AXDSPInitCallback
+80126954 __AXDSPResumeCallback
+801269a8 __AXDSPRequestCallback
+801269b8 0x801269b8
+801269bc __AXOutInitDSP
+80126aac __AXOutInit
+80126ca4 AXRegisterCallback
+80126ce8 AXRmtGetSamplesLeft
+80126d14 AXRmtGetSamples
+80126dd8 AXRmtAdvancePtr
+80126e30 __AXGetStudio
+80126e3c __AXDepopFadeMain
+80126ea8 __AXDepopFadeRmt
+80126f14 __AXPrintStudio
+8012708c __AXSPBInit
+801270e4 __AXDepopVoice
+80127250 __AXGetNumVoices
+80127258 __AXServiceVPB
+801277a8 __AXSyncPBs
+80127ab8 __AXGetPBs
+80127ac0 __AXSetPBDefault
+80127b00 __AXVPBInit
+80127b30 0x80127b30
+80127db8 AXSetVoiceState
+80127e28 AXSetVoiceAddr
+80127f20 AXGetLpfCoefs
+80127fdc AXSetMaxDspCycles
+80127fe4 AXGetMaxVoices
+80127fec __AXGetCurrentProfile
+80128018 0x80128018
+8012802c AXFXReverbHiInit
+80128090 AXFXReverbHiShutdown
+801280b4 AXFXReverbHiCallback
+801280b8 AXFXReverbHiExpGetMemSize
+80128140 AXFXReverbHiExpInit
+801282dc AXFXReverbHiExpSettings
+801283ac AXFXReverbHiExpSettingsUpdate
+80128460 AXFXReverbHiExpShutdown
+801284b4 AXFXReverbHiCallback
+801289d0 __AllocDelayLine
+80128b44 __BzeroDelayLines
+80128c68 __FreeDelayLine
+80128d7c __InitParams
+801290a0 AXFXReverbHiExpGetMemSizeDpl2
+8012912c AXFXReverbHiExpInitDpl2
+801292ec AXFXReverbHiExpSettingsDpl2
+801293bc 0x801293bc
+80129470 AXFXReverbHiExpShutdownDpl2
+801294c4 AXFXReverbHiExpCallbackDpl2
+80129a74 AXFXReverbHiExpDpl2__AllocDelayLine
+80129be8 AXFXReverbHiExpDpl2__BzeroDelayLines
+80129d0c AXFXReverbHiExpDpl2__FreeDelayLine
+80129e20 AXFXReverbHiExpDpl2__InitParams
+8012a154 0x8012a154
+8012a17c 0x8012a17c
+8012a440 0x8012a440
+8012a5c0 0x8012a5c0
+8012a6c4 0x8012a6c4
+8012a770 0x8012a770
+8012a9e8 0x8012a9e8
+8012abdc 0x8012abdc
+8012ac04 0x8012ac04
+8012ae28 0x8012ae28
+8012af4c 0x8012af4c
+8012b01c 0x8012b01c
+8012b0ac 0x8012b0ac
+8012b2c4 0x8012b2c4
+8012b47c AXFXReverbStdExpGetMemSize
+8012b4dc AXFXReverbStdExpInit
+8012b658 AXFXReverbStdExpSettings
+8012b728 AXFXReverbStdExpSettingsUpdate
+8012b7dc AXFXReverbStdExpShutdown
+8012b830 AXFXReverbStdExpCallback
+8012bb9c AXFXReverbStdExp__AllocDelayLine
+8012bce0 AXFXReverbStdExp__BzeroDelayLines
+8012bde0 AXFXReverbStdExp__FreeDelayLine
+8012bed0 AXFXReverbStdExp__InitParams
+8012c17c 0x8012c17c
+8012c1dc 0x8012c1dc
+8012c374 0x8012c374
+8012c444 0x8012c444
+8012c4f8 0x8012c4f8
+8012c54c 0x8012c54c
+8012c8d0 0x8012c8d0
+8012ca14 0x8012ca14
+8012cb14 0x8012cb14
+8012cc04 0x8012cc04
+8012ceb4 0x8012ceb4
+8012cec0 0x8012cec0
+8012d11c 0x8012d11c
+8012d2cc 0x8012d2cc
+8012d35c 0x8012d35c
+8012d6bc 0x8012d6bc
+8012d8b4 0x8012d8b4
+8012d9b8 0x8012d9b8
+8012d9c4 0x8012d9c4
+8012dc3c 0x8012dc3c
+8012ddec 0x8012ddec
+8012de7c 0x8012de7c
+8012e200 0x8012e200
+8012e408 0x8012e408
+8012e50c 0x8012e50c
+8012e518 0x8012e518
+8012e52c __AXFXFreeFunction
+8012e538 0x8012e538
+8012e544 AXFXSetHooks
+8012e550 RVL::AXFXGetHooks
+8012e564 PPCMfmsr
+8012e56c PPCMtmsr
+8012e574 PPCMfhid0
+8012e57c PPCMthid0
+8012e584 PPCMfl2cr
+8012e58c PPCMtl2cr
+8012e594 PPCMtdec
+8012e59c PPCSync
+8012e5a4 PPCHalt
+8012e5a8 0x8012e5a8
+8012e5b8 PPCMtmmcr0
+8012e5c0 PPCMtmmcr1
+8012e5c8 PPCMtpmc1
+8012e5d0 PPCMtpmc2
+8012e5d8 PPCMtpmc3
+8012e5e0 PPCMtpmc4
+8012e5e8 PPCMffpscr
+8012e608 PPCMtfpscr
+8012e630 PPCMfhid2
+8012e638 PPCMthid2
+8012e640 PPCMfwpar
+8012e64c PPCMtwpar
+8012e654 PPCDisableSpeculation
+8012e67c PPCSetFpNonIEEEMode
+8012e684 PPCMthid4
+8012e6d4 gki_init_free_queue
+8012e8f4 gki_buffer_init
+8012eba0 GKI_init_q
+8012ebb4 GKI_getbuf
+8012ed54 GKI_getpoolbuf
+8012ee3c GKI_freebuf
+8012efac GKI_get_buf_size
+8012eff0 GKI_send_msg
+8012f1ac GKI_read_mbox
+8012f25c GKI_enqueue
+8012f398 GKI_enqueue_head
+8012f4d8 GKI_dequeue
+8012f578 GKI_remove_from_queue
+8012f63c GKI_getfirst
+8012f644 GKI_getnext
+8012f660 GKI_queue_is_empty
+8012f670 GKI_create_pool
+8012f9b8 GKI_delete_pool
+8012fb18 gki_timers_init
+8012fbd4 GKI_get_tick_count
+8012fbe8 GKI_start_timer
+8012fd38 GKI_stop_timer
+8012fdc0 GKI_init_timer_list
+8012fdd4 GKI_update_timer_list
+8012fe60 GKI_add_to_timer_list
+8012ff4c GKI_remove_from_timer_list
+80130000 0x80130000
+80130070 GKI_init
+80130100 GKI_shutdown
+801301a8 GKI_run
+801301ac GKI_sched_lock
+801301b0 GKI_sched_unlock
+801301b4 GKI_delay
+801301b8 GKI_send_event
+8013025c GKI_get_taskid
+80130264 GKI_enable
+80130288 GKI_disable
+801302cc GKI_exception
+801302d0 GKI_os_malloc
+801302fc GKI_os_free
+80130300 hcisu_h2_usb_cback
+80130324 hcisu_h2_receive_msg
+801306bc hcisu_h2_send_msg_now
+80130868 hcisu_h2_init
+80130894 hcisu_h2_open
+801308fc hcisu_h2_close
+80130930 hcisu_h2_send
+80130960 hcisu_h2_handle_event
+8013099c __ntd_get_allocated_mem_size
+801309a8 uusb_CloseDeviceCB
+80130a3c uusb_ReadIntrDataCB
+80130b50 uusb_ReadBulkDataCB
+80130cec uusb_issue_intr_read
+80130db8 uusb_WriteCtrlDataCB
+80130ea4 uusb_WriteBulkDataCB
+80130f84 UUSB_Register
+8013118c UUSB_Open
+80131294 UUSB_Read
+8013129c UUSB_Write
+801314b0 UUSB_Close
+8013155c UUSB_Unregister
+801315a0 bte_hcisu_send
+801315c0 bte_hcisu_task
+80131624 bte_hcisu_close
+80131648 bta_ci_hci_msg_handler
+80131658 BTE_InitStack
+80131684 LogMsg
+80131740 LogMsg_0
+80131758 LogMsg_1
+80131770 LogMsg_2
+80131788 LogMsg_3
+801317a0 LogMsg_4
+801317b8 LogMsg_5
+801317d0 LogMsg_6
+801317e8 BTUInterruptHandler
+80131800 BTA_Init
+801318dc BTA_CleanUp
+80131940 btu_task_init
+80131980 btu_task_msg_handler
+80131d0c btu_start_timer
+80131d7c btu_stop_timer
+80131d90 bdcpy
+80131dc4 bdcmp
+80131e64 bta_sys_rm_register
+80131e74 bta_sys_compress_register
+80131e84 bta_sys_pm_register
+80131e94 bta_sys_conn_open
+80131f58 bta_sys_conn_close
+8013201c bta_sys_sco_close
+80132050 bta_sys_idle
+80132084 bta_sys_busy
+801320b8 bta_sys_init
+8013211c bta_sys_event
+80132208 bta_sys_timer_update
+80132228 bta_sys_register
+8013223c bta_sys_sendmsg
+80132258 bta_sys_start_timer
+80132278 bta_sys_stop_timer
+8013228c bta_sys_disable
+801322f4 bta_sys_set_trace_level
+801322fc ptim_init
+80132348 ptim_timer_update
+801323fc ptim_start_timer
+8013249c ptim_stop_timer
+801324dc utl_freebuf
+80132520 bta_dm_enable
+80132630 bta_dm_disable
+801326e0 bta_dm_disable_timer_cback
+8013279c bta_dm_set_dev_name
+801327a4 bta_dm_set_visibility
+801327ec bta_dm_bond
+8013285c bta_dm_pin_reply
+801328f8 bta_dm_auth_reply
+801329cc bta_dm_search_start
+80132a2c bta_dm_search_cancel
+80132ab0 bta_dm_discover
+80132bc4 bta_dm_inq_cmpl
+80132de8 bta_dm_rmt_name
+80132f54 bta_dm_disc_rmt_name
+80132fb8 bta_dm_sdp_result
+80133220 bta_dm_search_cmpl
+80133238 bta_dm_disc_result
+80133288 bta_dm_search_result
+80133310 bta_dm_search_timer_cback
+8013335c bta_dm_free_sdp_db
+801333a0 bta_dm_queue_search
+801333e8 bta_dm_queue_disc
+80133430 bta_dm_search_clear_queue
+80133474 bta_dm_search_cancel_cmpl
+801334b8 bta_dm_search_cancel_transac_cmpl
+80133514 bta_dm_search_cancel_notify
+8013352c bta_dm_find_services
+801336cc bta_dm_discover_next_device
+801337ac bta_dm_sdp_callback
+801337f4 bta_dm_inq_results_cb
+80133884 bta_dm_inq_cmpl_cb
+801338d0 bta_dm_service_search_remname_cback
+80133910 bta_dm_remname_cback
+8013399c bta_dm_disc_remname_cback
+80133a24 bta_dm_cancel_rmt_name
+80133a28 bta_dm_authorize_cback
+80133af0 bta_dm_pinname_cback
+80133bb0 bta_dm_pin_cback
+80133ce0 bta_dm_link_key_request_cback
+80133ce8 bta_dm_new_link_key_cback
+80133d84 bta_dm_authentication_complete_cback
+80133e08 bta_dm_local_addr_cback
+80133e30 bta_dm_signal_strength
+80133e6c bta_dm_signal_strength_timer_cback
+80133f60 bta_dm_acl_change_cback
+80133fd0 bta_dm_acl_change
+80134250 bta_dm_disable_conn_down_timer_cback
+8013426c bta_dm_rssi_cback
+801342d8 bta_dm_link_quality_cback
+80134344 bta_dm_l2cap_server_compress_cback
+80134428 bta_dm_compress_cback
+80134660 bta_dm_rm_cback
+80134768 bta_dm_keep_acl
+801347ec bta_dm_reset_complete
+80134808 0x80134808
+8013480c bta_dm_send_hci_reset
+8013485c BTA_EnableBluetooth
+801348e4 BTA_DisableBluetooth
+8013491c BTA_DmIsDeviceUp
+80134954 BTA_DmSetDeviceName
+801349b8 BTA_DmSetVisibility
+80134a10 BTA_DmSearch
+80134a94 BTA_DmSearchCancel
+80134acc BTA_DmPinReply
+80134b58 BTA_DmAddDevice
+80134c48 BTA_DmRemoveDevice
+80134c90 BTA_DmSendHciReset
+80134cc8 bta_dm_sm_execute
+80134d60 bta_dm_search_sm_execute
+80134d98 0x80134d98
+80134e28 bta_dm_init_pm
+80134e90 bta_dm_disable_pm
+80134ea8 bta_dm_pm_cback
+80135228 bta_dm_pm_set_mode
+801355a8 bta_dm_pm_btm_cback
+80135620 bta_dm_pm_timer_cback
+80135718 bta_dm_pm_btm_status
+80135838 bta_dm_pm_timer
+80135844 bta_hh_api_enable
+801359b8 bta_hh_api_disable
+80135abc bta_hh_disc_cmpl
+80135b60 bta_hh_sdp_cback
+80135c94 bta_hh_start_sdp
+80135e28 bta_hh_sdp_cmpl
+80135f90 bta_hh_api_disc_act
+80135ff8 bta_hh_open_cmpl_act
+80136120 bta_hh_open_act
+801361d8 bta_hh_data_act
+80136230 bta_hh_handsk_act
+80136284 bta_hh_handsk_act_switch
+80136288 bta_hh_handsk_act_caseD_4
+80136290 bta_hh_handsk_act_caseD_5
+80136298 bta_hh_handsk_act_caseD_6
+801362a0 bta_hh_handsk_act_caseD_7
+801362a8 bta_hh_handsk_act_caseD_8
+801362b0 bta_hh_handsk_act_caseD_9
+801362b8 bta_hh_handsk_act_caseD_2
+801362c0 bta_hh_handsk_act_caseD_0
+801362f4 bta_hh_handsk_act_switch
+801362f8 bta_hh_handsk_act_caseD_4
+80136378 bta_hh_handsk_act_caseD_5
+801363e8 bta_hh_handsk_act_caseD_2
+80136454 bta_hh_handsk_act_caseD_0
+80136498 bta_hh_ctrl_dat_act
+801364f8 bta_hh_ctrl_dat_act_switch
+801364fc bta_hh_ctrl_dat_act_caseD_4
+80136504 bta_hh_ctrl_dat_act_caseD_5
+8013650c bta_hh_ctrl_dat_act_caseD_6
+80136514 bta_hh_ctrl_dat_act_caseD_7
+8013651c bta_hh_ctrl_dat_act_caseD_8
+80136524 bta_hh_ctrl_dat_act_caseD_9
+8013652c bta_hh_ctrl_dat_act_caseD_2
+80136534 bta_hh_ctrl_dat_act_caseD_0
+801365dc bta_hh_ctrl_dat_act_switch
+801365e0 bta_hh_ctrl_dat_act_caseD_4
+801365e8 bta_hh_ctrl_dat_act_caseD_5
+801365f0 bta_hh_ctrl_dat_act_caseD_6
+801365f8 bta_hh_ctrl_dat_act_caseD_7
+80136600 bta_hh_ctrl_dat_act_caseD_8
+80136608 bta_hh_ctrl_dat_act_caseD_9
+80136610 bta_hh_ctrl_dat_act_caseD_2
+80136618 bta_hh_ctrl_dat_act_caseD_0
+80136690 bta_hh_close_act
+80136890 bta_hh_get_dscp_act
+801368ac bta_hh_maint_dev_act
+80136a10 bta_hh_get_acl_q_info
+80136b2c bta_hh_write_dev_act
+80136cf4 bta_hh_cback
+80136d54 bta_hh_cback_switch
+80136d58 bta_hh_cback_caseD_0
+80136d60 bta_hh_cback_caseD_1
+80136d68 bta_hh_cback_caseD_2
+80136d70 bta_hh_cback_caseD_3
+80136d78 bta_hh_cback_caseD_4
+80136d80 bta_hh_cback_caseD_5
+80136d88 bta_hh_cback_caseD_6
+80136d90 bta_hh_cback_caseD_7
+80136d98 bta_hh_cback_caseD_8
+80136dcc bta_hh_cback_switch
+80136dd0 bta_hh_cback_caseD_0
+80136dd8 bta_hh_cback_caseD_1
+80136de0 bta_hh_cback_caseD_3
+80136de8 bta_hh_cback_caseD_7
+80136df0 bta_hh_cback_caseD_5
+80136df8 bta_hh_cback_caseD_4
+80136e04 bta_hh_cback_caseD_8
+80136f3c bta_hh_cback_caseD_2
+80136f8c BTA_HhEnable
+80137014 BTA_HhDisable
+8013704c BTA_HhClose
+801370b0 BTA_HhOpen
+80137164 BTA_HhSendData
+801371f4 BTA_HhAddDev
+8013729c BTA_HhRemoveDev
+80137308 BTA_HhGetAclQueueInfo
+8013735c bta_hh_sm_execute
+801376b0 bta_hh_hdl_event
+801377fc bta_hh_evt_code
+80137824 bta_hh_evt_code_switch
+80137828 bta_hh_evt_code_caseD_170d
+80137830 bta_hh_evt_code_caseD_170c
+80137838 bta_hh_evt_code_caseD_1700
+80137840 bta_hh_evt_code_caseD_1701
+80137848 bta_hh_evt_code_caseD_1702
+80137850 bta_hh_evt_code_caseD_1703
+80137858 bta_hh_evt_code_caseD_1706
+80137860 bta_hh_evt_code_caseD_1704
+80137868 bta_hh_evt_code_caseD_1705
+80137870 bta_hh_evt_code_caseD_1708
+80137878 bta_hh_evt_code_caseD_1707
+80137880 bta_hh_evt_code_caseD_170f
+80137888 bta_hh_evt_code_caseD_170a
+80137890 bta_hh_evt_code_caseD_1709
+80137898 bta_hh_evt_code_caseD_170b
+801378a0 bta_hh_evt_code_caseD_170e
+801378b0 bta_hh_find_cb
+801379ec bta_hh_clean_up_kdev
+80137a6c bta_hh_add_device_to_list
+80137b28 bta_hh_tod_spt
+80137b7c bta_hh_trace_dev_db
+80137c5c btm_acl_init
+80137c78 btm_handle_to_acl_index
+80137cfc btm_acl_created
+80138010 btm_acl_removed
+801380d4 btm_acl_device_down
+80138138 BTM_SwitchRole
+80138354 btm_acl_encrypt_change
+801384c4 BTM_SetLinkPolicy
+801386b4 BTM_SetDefaultLinkPolicy
+801386c4 btm_read_link_policy_complete
+801387c8 btm_read_remote_version_complete
+80138854 btm_read_remote_features_complete
+80138a80 BTM_SetDefaultLinkSuperTout
+80138a90 BTM_IsAclConnectionUp
+80138b68 BTM_GetNumAclLinks
+80138bc4 btm_get_acl_disc_reason_code
+80138bd4 BTM_GetHCIConnHandle
+80138c70 btm_process_clk_off_comp_evt
+80138d0c btm_acl_role_changed
+80138f00 btm_acl_timeout
+80138f5c btm_get_max_packet_size
+801390fc BTM_AclRegisterForChanges
+80139140 btm_qos_setup_complete
+80139218 BTM_ReadRSSI
+80139354 BTM_ReadLinkQuality
+80139490 btm_read_rssi_complete
+801395ac btm_read_link_quality_complete
+801396c4 btm_remove_acl
+80139780 btm_chg_all_acl_pkt_types
+801399a0 BTM_SecAddDevice
+80139b28 BTM_SecDeleteDevice
+80139bd4 BTM_SecReadDevName
+80139c74 btm_sec_alloc_dev
+80139d94 btm_find_dev_by_handle
+80139e4c btm_find_dev
+80139ed4 btm_find_oldest_dev
+8013a06c btm_dev_init
+8013a10c btm_db_reset
+8013a1bc BTM_DeviceReset
+8013a258 BTM_SendHciReset
+8013a300 BTM_IsDeviceUp
+8013a31c BTM_SetAfhChannels
+8013a40c btm_dev_timeout
+8013a6a4 btm_reset_complete
+8013a868 btm_read_hci_buf_size_complete
+8013a930 btm_read_local_version_complete
+8013a9ec btm_read_local_features_complete
+8013aee8 BTM_SetLocalDeviceName
+8013afa0 btm_read_local_name_complete
+8013b02c BTM_ReadLocalDeviceAddr
+8013b06c btm_read_local_addr_complete
+8013b0b4 BTM_ReadLocalVersion
+8013b100 BTM_SetDeviceClass
+8013b180 BTM_ReadDeviceClass
+8013b190 BTM_ReadLocalFeatures
+8013b1a0 BTM_RegisterForDeviceStatusNotif
+8013b1b8 BTM_VendorSpecificCommand
+8013b2b4 btm_vsc_complete
+8013b320 BTM_RegisterForVSEvents
+8013b358 btm_vendor_specific_evt
+8013b3f0 BTM_WritePageTimeout
+8013b490 BTM_ReadStoredLinkKey
+8013b568 BTM_WriteStoredLinkKey
+8013b638 BTM_DeleteStoredLinkKey
+8013b708 btm_read_stored_link_key_complete
+8013b784 0x8013b784
+8013b7e0 btm_delete_stored_link_key_complete
+8013b848 btm_return_link_keys_evt
+8013b9d4 btm_report_device_status
+8013b9f4 btm_discovery_db_init
+8013ba6c btm_discovery_db_reset
+8013bb24 btm_discovery_timeout
+8013bb28 BTM_SetDiscoverability
+8013bdac BTM_SetInquiryScanType
+8013be5c BTM_SetPageScanType
+8013bf0c BTM_SetInquiryMode
+8013bfa4 BTM_SetConnectability
+8013c12c BTM_IsInquiryActive
+8013c13c BTM_CancelInquiry
+8013c244 BTM_StartInquiry
+8013c3f8 BTM_ReadRemoteDeviceName
+8013c4e0 BTM_CancelRemoteDeviceName
+8013c558 BTM_InqDbRead
+8013c618 BTM_InqDbFirst
+8013c6d0 BTM_InqDbNext
+8013c80c BTM_ClearInqDb
+8013c8dc btm_inq_db_reset
+8013ca74 btm_inq_db_init
+8013ca78 btm_inq_find_bdaddr
+8013cb54 btm_inq_db_new
+8013cc58 btm_set_inq_event_filter
+8013cd3c btm_event_filter_complete
+8013cf5c btm_process_inq_results
+8013d1d4 btm_process_inq_complete
+8013d2d8 btm_initiate_rem_name
+8013d428 btm_process_remote_name
+8013d580 btm_inq_rmt_name_failed
+8013d5c0 btm_init
+8013d61c BTM_PmRegister
+8013d6d8 BTM_SetPowerMode
+8013d8a8 BTM_ReadPowerMode
+8013d960 btm_pm_reset
+8013d9d8 btm_pm_sm_alloc
+8013da28 btm_pm_compare_modes
+8013dc44 btm_pm_get_set_mode
+8013dda4 btm_pm_snd_md_req
+8013dfd8 btm_pm_proc_cmd_status
+8013e088 btm_pm_proc_mode_change
+8013e2b0 btm_sco_init
+8013e2f4 btm_esco_conn_rsp
+8013e4d0 btm_sco_chk_pend_unpark
+8013e65c btm_sco_conn_req
+8013e83c btm_sco_connected
+8013e9dc BTM_RemoveSco
+8013ea94 btm_remove_sco_links
+8013eb18 btm_sco_removed
+8013ec2c btm_sco_acl_removed
+8013ece0 btm_route_sco_data
+8013ece4 BTM_ChangeEScoLinkParms
+8013ee8c btm_esco_proc_conn_chg
+8013ef90 btm_is_sco_active
+8013f000 btm_num_sco_links_active
+8013f060 btm_is_sco_active_by_bdaddr
+8013f0e8 BTM_SecRegister
+8013f160 BTM_SecAddRmtNameNotifyCallback
+8013f1b0 BTM_SecDeleteRmtNameNotifyCallback
+8013f204 BTM_SetPinType
+8013f2b4 BTM_SetSecurityLevel
+8013f4dc BTM_PINCodeReply
+8013f5a0 BTM_DeviceAuthorized
+8013f77c BTM_SecBond
+8013fb48 btm_sec_l2cap_access_req
+8013ffac btm_sec_mx_access_request
+80140248 btm_sec_conn_req
+80140374 btm_sec_init
+80140390 btm_sec_dev_reset
+801403d0 btm_sec_abort_access_req
+80140484 btm_sec_rmt_name_request_complete
+8014076c btm_sec_auth_complete
+80140ab0 btm_sec_mkey_comp_event
+80140bac btm_sec_encrypt_change
+80140ce8 btm_sec_is_bonding
+80140d28 btm_sec_connected
+801411a8 btm_sec_disconnect
+80141264 btm_sec_disconnected
+801413a0 btm_sec_link_key_notification
+8014154c btm_sec_link_key_request
+8014167c btm_sec_pin_code_request_timeout
+801416f0 btm_sec_pin_code_request
+80141a4c btm_sec_update_clock_offset
+80141a9c btm_sec_execute_procedure
+80141e7c btm_sec_start_authorization
+80141f98 btm_sec_collision_timeout
+80142078 btm_read_trusted_mask
+801420ac btu_hcif_process_event
+80142664 btu_hcif_send_cmd
+801427f0 btu_hcif_connection_comp_evt
+801428cc btu_hcif_connection_request_evt
+80142958 btu_hcif_qos_setup_comp_evt
+80142a58 btu_hcif_esco_connection_comp_evt
+80142b38 btu_hcif_hdl_command_complete
+80142c90 btu_hcif_command_complete_evt
+80142da8 btu_hcif_hdl_command_status
+80142fa8 btu_hcif_command_status_evt
+801430d0 btu_hcif_cmd_timeout
+80143228 btu_hcif_link_key_notification_evt
+80143308 btu_init_core
+80143334 BTE_Init
+80143380 WBT_ExtCreateRecord
+80143460 GAP_Init
+801434c0 gap_conn_init
+80143530 gap_connect_ind
+801436bc gap_connect_cfm
+80143898 gap_config_ind
+801439d4 gap_config_cfm
+80143bc0 gap_disconnect_ind
+80143db8 gap_data_ind
+80143ec8 gap_congestion_ind
+80143ffc btm_cback
+80144124 btm_cback_switch
+80144128 btm_cback_caseD_0
+80144130 btm_cback_caseD_1
+80144138 btm_cback_caseD_2
+80144140 btm_cback_caseD_4
+80144148 btm_cback_caseD_6
+80144150 btm_cback_caseD_7
+80144158 btm_cback_caseD_8
+80144160 btm_cback_caseD_3
+801441d4 gap_btm_cback1
+801441e0 0x801441e0
+801441ec gap_find_addr_name_cb
+801442e4 gap_find_addr_name_cb_switch
+801442e8 gap_find_addr_name_cb_caseD_0
+801442f0 gap_find_addr_name_cb_caseD_1
+801442f8 gap_find_addr_name_cb_caseD_2
+80144300 gap_find_addr_name_cb_caseD_4
+80144308 gap_find_addr_name_cb_caseD_6
+80144310 gap_find_addr_name_cb_caseD_7
+80144318 gap_find_addr_name_cb_caseD_8
+80144320 gap_find_addr_name_cb_caseD_3
+8014437c gap_find_addr_name_cb_switch
+80144380 gap_find_addr_name_cb_caseD_0
+80144388 gap_find_addr_name_cb_caseD_1
+80144390 gap_find_addr_name_cb_caseD_2
+80144398 gap_find_addr_name_cb_caseD_4
+801443a0 gap_find_addr_name_cb_caseD_6
+801443a8 gap_find_addr_name_cb_caseD_7
+801443b0 gap_find_addr_name_cb_caseD_8
+801443b8 gap_find_addr_name_cb_caseD_3
+80144404 gap_find_addr_inq_cb
+801444c0 gap_find_addr_inq_cb_switch
+801444c4 gap_find_addr_inq_cb_caseD_0
+801444cc gap_find_addr_inq_cb_caseD_1
+801444d4 gap_find_addr_inq_cb_caseD_2
+801444dc gap_find_addr_inq_cb_caseD_4
+801444e4 gap_find_addr_inq_cb_caseD_6
+801444ec gap_find_addr_inq_cb_caseD_7
+801444f4 gap_find_addr_inq_cb_caseD_8
+801444fc gap_find_addr_inq_cb_caseD_3
+80144530 gap_find_addr_inq_cb_switch
+80144534 0x80144534
+8014453c gap_find_addr_inq_cb_caseD_1
+80144544 gap_find_addr_inq_cb_caseD_2
+8014454c gap_find_addr_inq_cb_caseD_4
+80144554 gap_find_addr_inq_cb_caseD_6
+8014455c gap_find_addr_inq_cb_caseD_7
+80144564 gap_find_addr_inq_cb_caseD_8
+8014456c gap_find_addr_inq_cb_caseD_3
+801445b8 gap_convert_btm_status
+801445d8 0x801445d8
+801445e0 0x801445e0
+801445e8 0x801445e8
+801445f0 0x801445f0
+801445f8 0x801445f8
+80144600 0x80144600
+80144608 0x80144608
+80144610 0x80144610
+80144618 btsnd_hcic_inquiry
+801446c0 btsnd_hcic_inq_cancel
+80144720 btsnd_hcic_per_inq_mode
+801447e0 btsnd_hcic_create_conn
+801448c0 btsnd_hcic_disconnect
+80144948 btsnd_hcic_add_SCO_conn
+801449d4 btsnd_hcic_accept_conn
+80144a34 btsnd_hcic_reject_conn
+80144a90 btsnd_hcic_link_key_req_reply
+80144c30 btsnd_hcic_link_key_neg_reply
+80144cd0 btsnd_hcic_pin_code_req_reply
+80144eb4 btsnd_hcic_pin_code_neg_reply
+80144f54 btsnd_hcic_change_conn_type
+80144fe4 btsnd_hcic_auth_request
+80145060 btsnd_hcic_set_conn_encrypt
+801450ec btsnd_hcic_rmt_name_req
+801451c4 btsnd_hcic_rmt_name_req_cancel
+80145264 btsnd_hcic_rmt_features_req
+801452e0 btsnd_hcic_rmt_ver_req
+8014535c btsnd_hcic_read_rmt_clk_offset
+801453d8 btsnd_hcic_setup_esco_conn
+801454d4 btsnd_hcic_accept_esco_conn
+801455bc btsnd_hcic_reject_esco_conn
+8014561c btsnd_hcic_hold_mode
+801456d0 btsnd_hcic_sniff_mode
+8014579c btsnd_hcic_exit_sniff_mode
+80145820 btsnd_hcic_park_mode
+801458d4 btsnd_hcic_exit_park_mode
+80145958 btsnd_hcic_switch_role
+80145a08 btsnd_hcic_write_policy_set
+80145a9c btsnd_hcic_reset
+80145af8 btsnd_hcic_set_event_filter
+80145cb4 btsnd_hcic_write_pin_type
+80145d28 btsnd_hcic_read_stored_key
+80145d88 btsnd_hcic_write_stored_key
+80145f48 btsnd_hcic_delete_stored_key
+80145ff8 btsnd_hcic_change_name
+80146138 btsnd_hcic_write_page_tout
+80146170 btsnd_hcic_write_scan_enable
+801461a0 btsnd_hcic_write_pagescan_cfg
+801461e4 btsnd_hcic_write_inqscan_cfg
+80146228 btsnd_hcic_write_auth_enable
+8014629c btsnd_hcic_write_encr_mode
+80146310 btsnd_hcic_write_dev_class
+80146354 btsnd_hcic_write_auto_flush_tout
+80146398 btsnd_hcic_set_host_buf_size
+80146454 btsnd_hcic_write_link_super_tout
+801464e8 btsnd_hcic_write_cur_iac_lap
+80146558 btsnd_hcic_read_local_ver
+801465b8 btsnd_hcic_read_local_features
+80146614 btsnd_hcic_read_buffer_size
+8014663c btsnd_hcic_read_bd_addr
+8014669c btsnd_hcic_get_link_quality
+80146718 btsnd_hcic_read_rssi
+80146790 btsnd_hcic_set_afh_channels
+80146bb0 btsnd_hcic_write_inqscan_type
+80146be0 btsnd_hcic_write_inquiry_mode
+80146c10 btsnd_hcic_write_pagescan_type
+80146c40 btsnd_hcic_vendor_spec_cmd
+80146d34 HID_DevInit
+80146d9c hidd_conn_initiate
+80146e5c hidd_proc_repage_timeout
+80146f24 hidd_pm_set_now
+801470fc hidd_pm_proc_mode_change
+80147254 hidd_pm_inact_timeout
+801472a0 HID_HostGetSDPRecord
+80147368 hidh_search_callback
+801477b8 HID_HostInit
+801477fc HID_HostRegister
+80147878 HID_HostDeregister
+8014795c HID_HostAddDev
+80147aec HID_HostRemoveDev
+80147bb4 HID_HostOpenDev
+80147c18 HID_HostWriteDev
+80147d58 HID_HostCloseDev
+80147df8 HID_HostSetSecurityLevel
+80148020 hidh_conn_reg
+80148178 hidh_conn_disconnect
+8014821c hidh_sec_check_complete_term
+8014834c hidh_l2cif_connect_ind
+801485a4 hidh_proc_repage_timeout
+801486f0 hidh_sec_check_complete_orig
+80148904 hidh_l2cif_connect_cfm
+80148c4c hidh_l2cif_config_ind
+80148ef4 hidh_l2cif_config_cfm
+80149200 hidh_l2cif_disconnect_ind
+801494c4 hidh_l2cif_disconnect_cfm
+8014970c hidh_l2cif_cong_ind
+80149904 hidh_l2cif_data_ind
+80149c9c hidh_conn_snd_data
+80149f38 hidh_conn_initiate
+8014a034 hidh_conn_dereg
+8014a060 L2CA_Register
+8014a1fc L2CA_Deregister
+8014a28c L2CA_ConnectReq
+8014a4c0 L2CA_ConnectRsp
+8014a650 L2CA_ConfigReq
+8014a708 L2CA_ConfigRsp
+8014a7d8 L2CA_DisconnectReq
+8014a87c L2CA_DisconnectRsp
+8014a920 L2CA_DataWrite
+8014aa44 L2CA_SetIdleTimeout
+8014ab0c L2CA_SetIdleTimeoutByBdAddr
+8014ac0c L2CA_SetTraceLevel
+8014ac28 L2CA_RegisterCompression
+8014ac2c l2c_csm_execute
+8014ac4c l2c_csm_execute_switch
+8014ac50 l2c_csm_execute_caseD_0
+8014ac54 l2c_csm_execute_caseD_1
+8014ac58 l2c_csm_execute_caseD_2
+8014ac5c l2c_csm_execute_caseD_3
+8014ac60 l2c_csm_execute_caseD_4
+8014ac64 l2c_csm_execute_caseD_5
+8014ac68 l2c_csm_execute_caseD_6
+8014ac6c l2c_csm_execute_caseD_7
+8014ac70 l2c_csm_execute_caseD_8
+8014ac78 l2c_csm_closed
+8014acf0 l2c_csm_closed_switch
+8014acf4 l2c_csm_closed_caseD_3
+8014ad38 l2c_csm_closed_caseD_0
+8014ad68 l2c_csm_closed_caseD_1
+8014adb0 l2c_csm_closed_caseD_14
+8014adec l2c_csm_closed_caseD_7
+8014ae10 l2c_csm_closed_caseD_8
+8014ae5c l2c_csm_closed_caseD_a
+8014ae8c l2c_csm_closed_caseD_1e
+8014aee0 l2c_csm_closed_caseD_13
+8014aeec l2c_csm_closed_caseD_1a
+8014aef4 l2c_csm_closed_caseD_10
+8014af0c l2c_csm_orig_w4_sec_comp
+8014af88 l2c_csm_orig_w4_sec_comp_switch
+8014af8c l2c_csm_orig_w4_sec_comp_caseD_3
+8014afd0 l2c_csm_orig_w4_sec_comp_caseD_7
+8014affc l2c_csm_orig_w4_sec_comp_caseD_8
+8014b044 l2c_csm_orig_w4_sec_comp_caseD_13
+8014b050 l2c_csm_orig_w4_sec_comp_caseD_1a
+8014b064 l2c_csm_orig_w4_sec_comp_caseD_10
+8014b07c l2c_csm_term_w4_sec_comp
+8014b0e8 l2c_csm_term_w4_sec_comp_switch
+8014b0ec l2c_csm_term_w4_sec_comp_caseD_3
+8014b104 l2c_csm_term_w4_sec_comp_caseD_7
+8014b16c l2c_csm_term_w4_sec_comp_caseD_8
+8014b188 l2c_csm_term_w4_sec_comp_caseD_13
+8014b194 l2c_csm_term_w4_sec_comp_caseD_1a
+8014b1a0 l2c_csm_term_w4_sec_comp_caseD_11
+8014b1c8 l2c_csm_term_w4_sec_comp_caseD_10
+8014b1e4 l2c_csm_w4_l2cap_connect_rsp
+8014b260 l2c_csm_w4_l2cap_connect_rsp_switch
+8014b264 l2c_csm_w4_l2cap_connect_rsp_caseD_3
+8014b2b0 l2c_csm_w4_l2cap_connect_rsp_caseD_b
+8014b310 l2c_csm_w4_l2cap_connect_rsp_caseD_c
+8014b368 l2c_csm_w4_l2cap_connect_rsp_caseD_d
+8014b3b0 l2c_csm_w4_l2cap_connect_rsp_caseD_1e
+8014b3fc l2c_csm_w4_l2cap_connect_rsp_caseD_1a
+8014b408 l2c_csm_w4_l2cap_connect_rsp_caseD_13
+8014b410 l2c_csm_w4_l2cap_connect_rsp_caseD_10
+8014b428 l2c_csm_w4_l2ca_connect_rsp
+8014b49c l2c_csm_w4_l2ca_connect_rsp_switch
+8014b4a0 l2c_csm_w4_l2ca_connect_rsp_caseD_3
+8014b4e8 l2c_csm_w4_l2ca_connect_rsp_caseD_15
+8014b548 l2c_csm_w4_l2ca_connect_rsp_caseD_16
+8014b564 l2c_csm_w4_l2ca_connect_rsp_caseD_1e
+8014b5bc l2c_csm_w4_l2ca_connect_rsp_caseD_13
+8014b5c8 l2c_csm_w4_l2ca_connect_rsp_caseD_1a
+8014b5e8 l2c_csm_w4_l2ca_connect_rsp_caseD_10
+8014b600 l2c_csm_config
+8014b678 l2c_csm_config_switch
+8014b67c l2c_csm_config_caseD_3
+8014b6c0 l2c_csm_config_caseD_e
+8014b724 l2c_csm_config_caseD_f
+8014b7a0 l2c_csm_config_caseD_10
+8014b7ec l2c_csm_config_caseD_11
+8014b844 l2c_csm_config_caseD_17
+8014b870 l2c_csm_config_caseD_18
+8014b8bc l2c_csm_config_caseD_19
+8014b8dc l2c_csm_config_caseD_1a
+8014b900 l2c_csm_config_caseD_13
+8014b940 l2c_csm_config_caseD_1d
+8014b968 l2c_csm_config_caseD_1e
+8014b9b0 l2c_csm_config_caseD_12
+8014b9c8 l2c_csm_open
+8014ba40 l2c_csm_open_switch
+8014ba44 l2c_csm_open_caseD_3
+8014ba88 l2c_csm_open_caseD_6
+8014baac l2c_csm_open_caseD_e
+8014bb24 l2c_csm_open_caseD_11
+8014bb7c l2c_csm_open_caseD_13
+8014bb98 l2c_csm_open_caseD_1a
+8014bbbc l2c_csm_open_caseD_1d
+8014bbd4 l2c_csm_open_caseD_17
+8014bc0c l2c_csm_open_caseD_10
+8014bc24 l2c_csm_w4_l2cap_disconnect_rsp
+8014bca0 l2c_csm_w4_l2cap_disconnect_rsp_switch
+8014bca4 l2c_csm_w4_l2cap_disconnect_rsp_caseD_3
+8014bce8 l2c_csm_w4_l2cap_disconnect_rsp_caseD_12
+8014bd34 l2c_csm_w4_l2cap_disconnect_rsp_caseD_11
+8014bd94 l2c_csm_w4_l2cap_disconnect_rsp_caseD_1e
+8014bde8 l2c_csm_w4_l2cap_disconnect_rsp_caseD_13
+8014bdf0 l2c_csm_w4_l2cap_disconnect_rsp_caseD_10
+8014be08 l2c_csm_w4_l2ca_disconnect_rsp
+8014be7c l2c_csm_w4_l2ca_disconnect_rsp_switch
+8014be80 l2c_csm_w4_l2ca_disconnect_rsp_caseD_3
+8014bec8 l2c_csm_w4_l2ca_disconnect_rsp_caseD_1e
+8014bf24 l2c_csm_w4_l2ca_disconnect_rsp_caseD_1b
+8014bf44 l2c_csm_w4_l2ca_disconnect_rsp_caseD_13
+8014bf4c l2c_csm_w4_l2ca_disconnect_rsp_caseD_10
+8014bf64 forward_peer_data
+8014c108 l2c_link_hci_conn_req
+8014c25c l2c_link_hci_conn_comp
+8014c494 l2c_link_sec_comp
+8014c548 l2c_link_hci_disc_comp
+8014c604 l2c_link_hci_qos_violation
+8014c674 l2c_link_timeout
+8014c7e8 l2c_link_send_to_lower
+8014c8f0 l2c_link_check_send_pkts
+8014cbbc l2c_link_adjust_allocation
+8014cd54 l2c_link_process_num_completed_pkts
+8014ce38 l2c_link_processs_num_bufs
+8014ce4c l2cap_link_chk_pkt_start
+8014d01c l2cap_link_chk_pkt_end
+8014d088 l2c_link_role_changed
+8014d108 l2c_link_role_change_failed
+8014d174 l2c_link_segments_xmitted
+8014d250 l2c_pin_code_request
+8014d294 l2c_init
+8014d3a8 l2c_rcv_acl_data
+8014d6d8 process_l2cap_cmd
+8014d724 process_l2cap_cmd_caseD_b
+8014d7a0 process_l2cap_cmd_switch
+8014d7a4 process_l2cap_cmd_caseD_1
+8014d878 process_l2cap_cmd_caseD_2
+8014d944 process_l2cap_cmd_caseD_3
+8014da3c process_l2cap_cmd_caseD_4
+8014dcec process_l2cap_cmd_caseD_5
+8014df9c process_l2cap_cmd_caseD_6
+8014e010 process_l2cap_cmd_caseD_7
+8014e070 process_l2cap_cmd_caseD_8
+8014e0b0 process_l2cap_cmd_caseD_9
+8014e0d0 process_l2cap_cmd_caseD_a
+8014e0f4 process_l2cap_cmd_caseD_0
+8014e148 l2c_process_timeout
+8014e198 l2c_process_held_packets
+8014e2c4 l2cu_allocate_lcb
+8014e398 l2cu_release_lcb
+8014e498 l2cu_find_lcb_by_bd_addr
+8014e520 l2cu_find_lcb_by_handle
+8014e5b0 l2cu_get_conn_role
+8014e5c0 l2cu_build_header
+8014e684 l2cu_send_peer_cmd_reject
+8014e780 l2cu_send_peer_connect_req
+8014e844 l2cu_send_peer_connect_rsp
+8014e91c l2cu_reject_connection
+8014e9dc l2cu_send_peer_config_req
+8014ecd4 l2cu_send_peer_config_rsp
+8014efcc l2cu_send_peer_config_rej
+8014f180 l2cu_send_peer_disc_req
+8014f254 l2cu_send_peer_disc_rsp
+8014f314 l2cu_send_peer_echo_req
+8014f484 l2cu_send_peer_echo_rsp
+8014f620 l2cu_send_peer_info_rsp
+8014f6c4 l2cu_allocate_ccb
+8014f7d0 l2cu_release_ccb
+8014f974 l2cu_find_ccb_by_cid
+8014f9d0 l2cu_allocate_rcb
+8014fa1c l2cu_release_rcb
+8014fa2c l2cu_find_rcb_by_psm
+8014fae4 l2cu_process_peer_cfg_req
+8014fc2c l2cu_process_peer_cfg_rsp
+8014fc6c l2cu_process_our_cfg_req
+8014fd7c l2cu_process_our_cfg_rsp
+8014fdbc l2cu_device_reset
+8014fe28 l2cu_create_conn
+8014ff40 l2cu_create_conn_after_switch
+80150010 l2cu_find_lcb_by_state
+801500a0 l2cu_lcb_disconnecting
+80150188 RFCOMM_Init
+801501d8 PORT_StartCnf
+80150338 PORT_StartInd
+801503d4 PORT_ParNegInd
+80150584 PORT_ParNegCnf
+80150688 PORT_DlcEstablishInd
+801507c8 PORT_DlcEstablishCnf
+8015090c PORT_PortNegInd
+80150a5c PORT_PortNegCnf
+80150b74 PORT_ControlInd
+80150cec PORT_ControlCnf
+80150db0 PORT_LineStatusInd
+80150e78 PORT_DlcReleaseInd
+80150ee0 PORT_CloseInd
+80150f80 Port_TimeOutCloseMux
+80151018 PORT_DataInd
+80151218 PORT_FlowInd
+80151348 port_rfc_send_tx_data
+80151440 port_rfc_closed
+801515d4 port_select_mtu
+80151750 port_release_port
+8015182c port_find_mcb_dlci_port
+80151880 port_find_dlci_port
+80151908 port_flow_control_user
+80151978 port_get_signal_changes
+801519e0 port_flow_control_peer
+80151bac rfcomm_l2cap_if_init
+80151c28 RFCOMM_ConnectInd
+80151cb4 RFCOMM_ConnectCnf
+80151db8 RFCOMM_ConfigInd
+80151ec0 RFCOMM_ConfigCnf
+80151fc8 RFCOMM_QoSViolationInd
+80151fcc RFCOMM_DisconnectInd
+801520f0 RFCOMM_BufDataInd
+80152390 RFCOMM_CongestionStatusInd
+801524c4 rfc_save_lcid_mcb
+801524e0 rfc_mx_sm_execute
+80152500 rfc_mx_sm_execute_switch
+80152504 rfc_mx_sm_execute_caseD_0
+80152508 rfc_mx_sm_execute_caseD_1
+8015250c rfc_mx_sm_execute_caseD_2
+80152510 rfc_mx_sm_execute_caseD_3
+80152514 rfc_mx_sm_execute_caseD_4
+80152518 rfc_mx_sm_execute_caseD_5
+8015251c rfc_mx_sm_execute_caseD_6
+80152524 rfc_mx_sm_state_idle
+80152598 rfc_mx_sm_state_idle_switch
+8015259c rfc_mx_sm_state_idle_caseD_6
+801525e0 rfc_mx_sm_state_idle_caseD_7
+8015260c rfc_mx_sm_state_idle_caseD_a
+801526c0 rfc_mx_sm_state_idle_caseD_1
+801526c4 rfc_mx_sm_state_idle_caseD_3
+801526d8 rfc_mx_sm_state_idle_caseD_4
+801526ec rfc_mx_sm_state_idle_caseD_0
+80152738 rfc_mx_sm_state_wait_conn_cnf
+801528f4 rfc_mx_sm_state_configure
+8015296c rfc_mx_sm_state_configure_switch
+80152970 rfc_mx_sm_state_configure_caseD_6
+8015299c rfc_mx_sm_state_configure_caseD_c
+801529ac rfc_mx_sm_state_configure_caseD_b
+801529bc rfc_mx_sm_state_configure_caseD_e
+801529d0 rfc_mx_sm_state_configure_caseD_7
+80152a1c rfc_mx_sm_sabme_wait_ua
+80152a90 rfc_mx_sm_sabme_wait_ua_switch
+80152a94 rfc_mx_sm_sabme_wait_ua_caseD_6
+80152ac0 rfc_mx_sm_sabme_wait_ua_caseD_c
+80152ad0 rfc_mx_sm_sabme_wait_ua_caseD_b
+80152ae0 rfc_mx_sm_sabme_wait_ua_caseD_e
+80152af4 rfc_mx_sm_sabme_wait_ua_caseD_1
+80152b1c rfc_mx_sm_sabme_wait_ua_caseD_2
+80152b24 rfc_mx_sm_sabme_wait_ua_caseD_5
+80152b44 rfc_mx_sm_sabme_wait_ua_caseD_0
+80152b90 rfc_mx_sm_state_wait_sabme
+80152cb0 rfc_mx_sm_state_connected
+80152d18 rfc_mx_sm_state_connected_switch
+80152d1c rfc_mx_sm_state_connected_caseD_5
+80152d40 rfc_mx_sm_state_connected_caseD_e
+80152d54 rfc_mx_sm_state_connected_caseD_3
+80152d80 rfc_mx_sm_state_connected_caseD_4
+80152dc8 rfc_mx_sm_state_disc_wait_ua
+80152e34 rfc_mx_sm_state_disc_wait_ua_switch
+80152e38 rfc_mx_sm_state_disc_wait_ua_caseD_1
+80152ea4 rfc_mx_sm_state_disc_wait_ua_caseD_3
+80152eb4 rfc_mx_sm_state_disc_wait_ua_caseD_4
+80152ed0 rfc_mx_sm_state_disc_wait_ua_caseD_6
+80152edc rfc_mx_sm_state_disc_wait_ua_caseD_e
+80152ef0 rfc_mx_sm_state_disc_wait_ua_caseD_8
+80152ef4 rfc_mx_sm_state_disc_wait_ua_caseD_0
+80152f40 rfc_mx_conf_cnf
+80153034 rfc_mx_conf_ind
+80153124 rfc_port_sm_execute
+801531b4 rfc_port_sm_state_closed
+801531ec rfc_port_sm_state_closed_switch
+801531f0 rfc_port_sm_state_closed_caseD_9
+80153228 rfc_port_sm_state_closed_caseD_d
+8015322c rfc_port_sm_state_closed_caseD_e
+80153238 rfc_port_sm_state_closed_caseD_0
+80153270 rfc_port_sm_state_closed_caseD_1
+80153274 rfc_port_sm_state_closed_caseD_2
+8015327c rfc_port_sm_state_closed_caseD_4
+80153298 rfc_port_sm_state_closed_caseD_3
+801532ac rfc_port_sm_state_closed_caseD_5
+801532e4 rfc_port_sm_state_closed_caseD_6
+80153328 rfc_port_sm_sabme_wait_ua
+80153360 rfc_port_sm_sabme_wait_ua_switch
+80153364 rfc_port_sm_sabme_wait_ua_caseD_9
+80153394 rfc_port_sm_sabme_wait_ua_caseD_c
+801533bc rfc_port_sm_sabme_wait_ua_caseD_d
+801533c4 rfc_port_sm_sabme_wait_ua_caseD_e
+801533d0 rfc_port_sm_sabme_wait_ua_caseD_1
+801533f4 rfc_port_sm_sabme_wait_ua_caseD_2
+80153414 rfc_port_sm_sabme_wait_ua_caseD_3
+80153440 rfc_port_sm_sabme_wait_ua_caseD_0
+80153450 rfc_port_sm_sabme_wait_ua_caseD_4
+8015345c rfc_port_sm_sabme_wait_ua_caseD_5
+80153480 rfc_port_sm_sabme_wait_ua_caseD_6
+801534c4 rfc_port_sm_term_wait_sec_check
+80153504 rfc_port_sm_term_wait_sec_check_switch
+80153508 rfc_port_sm_term_wait_sec_check_caseD_f
+80153550 rfc_port_sm_term_wait_sec_check_caseD_9
+8015357c rfc_port_sm_term_wait_sec_check_caseD_d
+80153594 rfc_port_sm_term_wait_sec_check_caseD_e
+801535c0 rfc_port_sm_term_wait_sec_check_caseD_0
+801535c4 rfc_port_sm_term_wait_sec_check_caseD_3
+801535f4 rfc_port_sm_term_wait_sec_check_caseD_4
+80153600 rfc_port_sm_term_wait_sec_check_caseD_b
+80153640 rfc_port_sm_term_wait_sec_check_caseD_1
+80153680 rfc_port_sm_orig_wait_sec_check
+801536c0 rfc_port_sm_orig_wait_sec_check_switch
+801536c4 rfc_port_sm_orig_wait_sec_check_caseD_f
+80153714 rfc_port_sm_orig_wait_sec_check_caseD_0
+80153740 rfc_port_sm_orig_wait_sec_check_caseD_c
+80153758 rfc_port_sm_orig_wait_sec_check_caseD_e
+80153784 rfc_port_sm_orig_wait_sec_check_caseD_4
+80153790 rfc_port_sm_orig_wait_sec_check_caseD_1
+801537d0 rfc_port_sm_opened
+80153808 rfc_port_sm_opened_switch
+8015380c rfc_port_sm_opened_caseD_9
+8015383c rfc_port_sm_opened_caseD_c
+80153864 rfc_port_sm_opened_caseD_d
+8015386c rfc_port_sm_opened_caseD_e
+801538e0 rfc_port_sm_opened_caseD_1
+801538e4 rfc_port_sm_opened_caseD_0
+801538f4 rfc_port_sm_opened_caseD_2
+8015390c rfc_port_sm_opened_caseD_3
+80153930 rfc_port_sm_opened_caseD_4
+80153940 rfc_port_sm_opened_caseD_5
+80153978 rfc_port_sm_opened_caseD_6
+801539bc rfc_port_sm_disc_wait_ua
+801539f0 rfc_port_sm_disc_wait_ua_switch
+801539f4 rfc_port_sm_disc_wait_ua_caseD_9
+80153a20 rfc_port_sm_disc_wait_ua_caseD_d
+80153a28 rfc_port_sm_disc_wait_ua_caseD_e
+80153a34 rfc_port_sm_disc_wait_ua_caseD_1
+80153a40 rfc_port_sm_disc_wait_ua_caseD_2
+80153a4c rfc_port_sm_disc_wait_ua_caseD_0
+80153a60 rfc_port_sm_disc_wait_ua_caseD_3
+80153a74 rfc_port_sm_disc_wait_ua_caseD_4
+80153a90 rfc_port_sm_disc_wait_ua_caseD_5
+80153a98 rfc_port_sm_disc_wait_ua_caseD_6
+80153ad8 rfc_process_pn
+80153bc0 rfc_process_rpn
+80153ecc rfc_process_msc
+80154038 rfc_process_rls
+801540c4 rfc_process_nsc
+801540c8 rfc_process_test_rsp
+801540d0 rfc_process_fcon
+80154134 rfc_process_fcoff
+80154198 rfc_process_l2cap_congestion
+80154220 rfc_set_port_state
+801542c4 RFCOMM_StartRsp
+801542f0 RFCOMM_DlcEstablishReq
+80154358 RFCOMM_DlcEstablishRsp
+801543c8 RFCOMM_ParNegReq
+801544a8 RFCOMM_ParNegRsp
+801544d0 RFCOMM_PortNegReq
+8015458c RFCOMM_PortNegRsp
+801545ac RFCOMM_ControlReq
+80154650 RFCOMM_FlowReq
+801546f4 RFCOMM_LineStatusReq
+8015478c RFCOMM_DlcReleaseReq
+801547b8 RFCOMM_DataReq
+801547f0 rfc_send_sabme
+801548a0 rfc_send_ua
+80154950 rfc_send_dm
+80154a14 rfc_send_disc
+80154ac4 rfc_send_buf_uih
+80154c5c rfc_send_pn
+80154d44 rfc_send_fcon
+80154dc8 rfc_send_fcoff
+80154e4c rfc_send_msc
+80154f6c rfc_send_rls
+8015501c rfc_send_rpn
+80155138 rfc_send_test
+801551e0 rfc_send_credit
+801552a0 rfc_parse_data
+80155814 rfc_process_mx_message
+8015581c 0x8015581c
+80155e38 rfc_calc_fcs
+80155e70 rfc_check_fcs
+80155ebc rfc_alloc_multiplexer_channel
+80156014 rfc_release_multiplexer_channel
+8015609c rfc_timer_start
+80156110 rfc_timer_stop
+80156168 rfc_port_timer_start
+801561e8 rfc_port_timer_stop
+80156240 rfc_check_mcb_active
+80156304 rfcomm_process_timeout
+80156340 rfc_sec_check_complete
+80156394 rfc_port_closed
+801564ec rfc_inc_credit
+80156578 rfc_dec_credit
+801565b4 rfc_check_send_cmd
+80156618 SDP_InitDiscoveryDb
+80156990 SDP_ServiceSearchRequest
+801569ec SDP_ServiceSearchAttributeRequest
+80156a50 SDP_FindAttributeInRec
+80156a78 SDP_FindServiceInDb
+80156b44 SDP_FindServiceUUIDInDb
+80156c4c SDP_SetLocalDiRecord
+80156fac SDP_GetLocalDiRecord
+8015745c SDP_SetTraceLevel
+80157480 sdp_db_service_search
+801575bc find_uuid_in_seq
+80157694 sdp_db_find_record
+801576f0 sdp_db_find_attr_in_rec
+80157730 SDP_CreateRecord
+80157810 SDP_DeleteRecord
+80157924 SDP_AddAttribute
+80157cbc SDP_AddUuidSequence
+80157d94 SDP_AddServiceClassIdList
+80157f10 SDP_DeleteAttribute
+8015814c sdpu_build_uuid_seq
+80158238 sdp_snd_service_search_req
+80158368 sdp_disc_connected
+8015839c sdp_disc_server_rsp
+801584dc process_service_search_rsp
+80158624 process_service_attr_rsp
+801588cc process_service_search_attr_rsp
+80158ba0 save_attr_seq
+80158d8c add_record
+80158e2c add_attr
+80158ef4 add_attr_switch
+80158ef8 add_attr_caseD_1
+80158fa8 add_attr_caseD_2
+80159064 add_attr_caseD_3
+801591f8 add_attr_caseD_6
+801592ac add_attr_caseD_4
+801592dc add_attr_caseD_5
+8015932c add_attr_caseD_0
+801593c4 sdp_init
+80159564 sdp_connect_ind
+80159628 sdp_connect_cfm
+801597b8 sdp_config_ind
+801598f4 sdp_config_cfm
+80159a70 sdp_disconnect_ind
+80159b68 sdp_data_ind
+80159c3c sdp_conn_originate
+80159d50 sdp_disconnect
+80159dec sdp_disconnect_cfm
+80159ea8 sdp_conn_timeout
+80159f30 sdp_server_handle_client_req
+8015a084 process_service_search
+8015a494 process_service_attr_req
+8015a824 process_service_search_attr_req
+8015ac40 sdpu_find_ccb_by_cid
+8015acd0 sdpu_allocate_ccb
+8015ad44 sdpu_release_ccb
+8015ad7c sdpu_build_attrib_seq
+8015af4c sdpu_build_attrib_entry
+8015aff4 sdpu_build_attrib_entry_switch
+8015aff8 sdpu_build_attrib_entry_caseD_1
+8015b008 sdpu_build_attrib_entry_caseD_2
+8015b01c sdpu_build_attrib_entry_caseD_4
+8015b030 sdpu_build_attrib_entry_caseD_8
+8015b044 sdpu_build_attrib_entry_caseD_10
+8015b058 sdpu_build_attrib_entry_caseD_0
+8015b0a0 sdpu_build_n_send_error
+8015b1dc sdpu_extract_uid_seq
+8015b224 sdpu_extract_uid_seq_caseD_1
+8015b22c sdpu_extract_uid_seq_caseD_2
+8015b234 sdpu_extract_uid_seq_caseD_4
+8015b23c sdpu_extract_uid_seq_caseD_5
+8015b248 sdpu_extract_uid_seq_caseD_6
+8015b264 sdpu_extract_uid_seq_caseD_7
+8015b294 sdpu_extract_uid_seq_caseD_0
+8015b2bc 0x8015b2bc
+8015b2f4 0x8015b29c_switch
+8015b2f8 0x8015b29c_caseD_1
+8015b300 0x8015b29c_caseD_2
+8015b308 0x8015b29c_caseD_4
+8015b310 0x8015b29c_caseD_5
+8015b31c 0x8015b29c_caseD_6
+8015b338 0x8015b29c_caseD_7
+8015b368 0x8015b29c_caseD_0
+8015b52c sdpu_extract_attr_seq
+8015b77c sdpu_get_len_from_type
+8015b7a0 sdpu_get_len_from_type_switch
+8015b7a4 sdpu_get_len_from_type_caseD_0
+8015b7b0 sdpu_get_len_from_type_caseD_1
+8015b7bc sdpu_get_len_from_type_caseD_2
+8015b7c8 sdpu_get_len_from_type_caseD_3
+8015b7d4 sdpu_get_len_from_type_caseD_4
+8015b7e0 sdpu_get_len_from_type_caseD_5
+8015b7f0 sdpu_get_len_from_type_caseD_6
+8015b810 sdpu_get_len_from_type_caseD_7
+8015b84c sdpu_is_base_uuid
+8015b92c sdpu_compare_uuid_arrays
+8015bba0 sdpu_compare_uuid_with_attr
+8015bc30 sdpu_sort_attr_list
+8015bc80 contentFastOpenNAND
+8015bcec ARCConvertPathToEntrynum
+8015bcf0 0x8015bcf0
+8015bcf8 contentReadNAND
+8015bd98 0x8015bd98
+8015bda0 0x8015bda0
+8015bef0 CX::InitUncompContextLZ
+8015bf24 CX::ReadUncompLZ
+8015c2e0 CX::GetUncompressedSize
+8015c320 AddItem
+8015c37c 0x8015c37c
+8015c868 DecideOrderInFst
+8015c954 0x8015c954
+8015cb18 CreateDirStructure
+8015ce0c ConstructFSTFromStructure
+8015d0fc DARCH::GetArcSize
+8015d254 DARCH::Create
+8015d314 DBInit
+8015d33c 0x8015d33c
+8015d384 0x8015d384
+8015d394 __DBIsExceptionMarked
+8015d3ac 0x8015d3ac
+8015d3fc DSPCheckMailToDSP
+8015d40c RVL::DSPCheckMailFromDSP
+8015d41c RVL::DSPReadMailFromDSP
+8015d430 DSPSendMailToDSP
+8015d444 DSPInit
+8015d504 DSPCheckInit
+8015d50c DSPAddTask
+8015d57c DSPAssertTask
+8015d638 __DSP_debug_printf
+8015d688 __DSPHandler
+8015dabc __DSP_exec_task
+8015dc60 __DSP_boot_task
+8015ddec __DSP_insert_task
+8015de88 __DSP_remove_task
+8015df1c __DVDFSInit
+8015df4c DVD::ConvertPathToEntrynum
+8015e254 DVD::FastOpen
+8015e2bc DVD::Open
+8015e568 DVD::Close
+8015e58c entryToPath_0
+8015e74c DVD::ReadAsyncPrio
+8015e81c 0x8015e81c
+8015e834 DVDReadPrio
+8015e95c cbForReadSync
+8015e964 StampCommand
+8015ea18 defaultOptionalCommandChecker
+8015ea1c DVD::Init
+8015eb70 stateReadingFST
+8015ece8 cbForStateReadingFST
+8015ee6c 0x8015ee6c
+8015ee70 cbForStateError
+8015ef80 0x8015ef80
+8015ef94 cbForStoreErrorCode2
+8015efd0 CategorizeError
+8015f0c4 cbForStoreErrorCode3
+8015f188 cbForStateGettingError
+8015f68c cbForUnrecoveredError
+8015f86c cbForUnrecoveredErrorRetry
+8015f940 cbForStateGoToRetry
+8015fb80 stateCheckID
+8015feb8 cbForStateReadingTOC
+80160058 cbForStateReadingPartitionInfo
+801604d0 cbForStateOpenPartition
+80160658 cbForStateOpenPartition2
+801607bc cbForStateCheckID1
+80160984 cbForStateCheckID2
+80160b18 stateCoverClosed
+80160b4c stateCoverClosed_switch
+80160b50 stateCoverClosed_caseD_21
+80160b84 stateCoverClosed_caseD_20
+80160b8c stateCoverClosed_caseD_23
+80160ba4 stateCoverClosed_caseD_1
+80160bb0 stateCoverClosed_caseD_0
+80160bdc ResetAlarmHandler
+80160e2c cbForStateReset
+80160f10 stateDownRotation
+80160fd8 cbForStateDownRotation
+80161218 stateCoverClosed_CMD
+80161390 cbForStateCoverClosed
+80161468 cbForPrepareCoverRegister
+801615f0 CoverAlarmHandler
+80161614 stateReady
+8016193c stateBusy
+80161980 stateBusy_switch
+80161984 stateBusy_caseD_10
+80161a08 stateBusy_caseD_0
+80161a28 stateBusy_switch
+80161a2c stateBusy_caseD_5
+80161a50 stateBusy_caseD_1
+80161b78 stateBusy_caseD_2
+80161b94 stateBusy_caseD_3
+80161bac stateBusy_caseD_f
+80161bc4 stateBusy_caseD_d
+80161be4 stateBusy_caseD_e
+80161c08 stateBusy_caseD_10
+80161c28 stateBusy_caseD_20
+80161c40 stateBusy_caseD_21
+80161d68 stateBusy_caseD_22
+80161d94 stateBusy_caseD_23
+80161dac stateBusy_caseD_26
+80161dbc stateBusy_caseD_24
+80161dcc stateBusy_caseD_25
+80161de8 stateBusy_caseD_28
+80161e14 stateBusy_caseD_29
+80161e88 stateBusy_caseD_2a
+80161ebc stateBusy_caseD_0
+80161eec cbForStateBusy
+801628cc DVD::ReadAbsAsyncPrio
+801629b0 DVD::InquiryAsync
+80162a88 DVD::GetCommandBlockStatus
+80162b50 DVD::GetDriveStatus
+80162bec DVD::SetAutoInvalidation
+80162bfc DVD::Pause
+80162c38 DVD::Resume
+80162c88 DVD::CancelAsync
+80162cd4 DVD::CancelAsync_switch
+80162cd8 DVD::CancelAsync_caseD_0
+80162cf8 DVD::CancelAsync_caseD_1
+80162d5c DVD::CancelAsync_caseD_2
+80162da8 DVD::CancelAsync_caseD_3
+80162dc8 DVD::CancelAsync_switch
+80162dcc DVD::CancelAsync_caseD_21
+80162dec DVD::CancelAsync_caseD_1
+80162e4c DVD::CancelAsync_caseD_0
+80162e78 DVD::CancelAsync_caseD_4
+80162f74 DVD::CancelAsync_caseD_c
+80162fc4 DVD::CancelAsync_caseD_8
+80162fec DVD::Cancel
+801630c8 cbForCancelSync
+801630d0 DVD::CancelAll
+8016320c 0x8016320c
+8016321c DVD::GetCurrentDiskID
+80163224 __BS2DVDLowCallback
+8016322c __DVDGetCoverStatus
+801632f4 __DVDResetWithNoSpinup
+80163338 __DVDPrepareResetAsync
+80163454 Callback
+80163460 __DVDPrepareReset
+80163594 __DVDTestAlarm
+801635b4 __DVDStopMotorAsync
+801635bc __DVDRestartMotor
+801635c0 __DVDClearWaitingQueue
+801635f8 __DVDPushWaitingQueue
+80163660 __DVDPopWaitingQueue
+80163700 __DVDCheckWaitingQueue
+80163758 __DVDGetNextWaitingQueue
+801637b8 __DVDDequeueWaitingQueue
+80163818 cbForNandClose
+80163844 cbForNandWrite
+801638a0 cbForNandSeek
+80163968 cbForNandWrite0
+80163a88 cbForNandSeek2
+80163b44 cbForNandRead
+80163c2c cbForNandSeek0
+80163ccc cbForNandSeek1
+80163dcc cbForNandOpen
+80163ee8 cbForNandCreate
+80163f90 cbForNandCreateDir
+80164024 cbForPrepareControlRegister
+801640b4 __DVDStoreErrorCode
+8016411c DVDCompareDiskID
+8016420c DVDGenerateDiskID
+80164294 __DVDShowFatalMessage
+80164364 DVDSetAutoFatalMessaging
+801643c0 __DVDGetAutoFatalMessaging
+801643ec lowCallback
+801643fc __DVDCheckDevice
+80164684 doTransactionCallback
+8016473c doPrepareCoverRegisterCallback
+801647f8 DVD::LowFinalize
+80164848 DVD::LowInit
+80164aac DVD::LowReadDiskID
+80164c34 DVD::LowOpenPartition
+80164e9c DVD::LowOpenPartitionWithTmdAndTicketView
+80165100 DVD::LowGetNoDiscBufferSizes
+8016530c DVD::LowGetNoDiscOpenPartitionParams
+801655a4 DVD::LowClosePartition
+801656a4 0x801656a4
+80165708 DVD::LowUnencryptedRead
+8016589c DVD::LowStopMotor
+80165a30 DVD::LowInquiry
+80165b98 DVD::LowRequestError
+80165d00 DVD::LowSetSpinupFlag
+80165d0c DVD::LowReset
+80165d20 0x80165d20
+80165e88 DVD::LowAudioBufferConfig
+8016601c DVD::LowReportKey
+801661b0 DVD::LowSetMaximumRotation
+80166330 DVD::LowRead
+801664e0 DVD::LowSeek
+8016665c DVD::LowGetCoverRegister
+8016666c DVD::LowGetControlRegister
+80166678 DVD::LowPrepareCoverRegister
+801667e0 DVD::LowPrepareStatusRegister
+80166864 0x80166864
+80166948 DVD::LowGetImmBufferReg
+80166954 DVD::LowUnmaskStatusInterrupts
+8016695c DVD::LowMaskCoverInterrupt
+80166964 DVD::LowClearCoverInterrupt
+80166ad0 ENCInit
+80166bc8 ENCiCheckBreakType
+80166bfc ENCiWriteBreakType
+80166d0c ENCConvertStringTo
+80166d14 0x80166d14
+80166fbc 0x80166fbc
+801671d0 ESP_InitLib
+80167224 ESP_CloseLib
+8016726c ESP_LaunchTitle
+80167300 ESP_ReadContentFile
+801673a0 ESP_SeekContentFile
+8016742c ESP_ListTitleContentsOnCard
+80167544 ESP_GetTicketViews
+8016765c ESP_DiGetTicketView
+80167700 ESP_DiGetTmd
+801677f0 ESP_GetTmdView
+80167904 ESP_GetDataDir
+8016799c ESP_GetTitleId
+80167a34 ESP_GetConsumption
+80167b08 EUARTInit
+80167c04 InitializeUART
+80167c4c WriteUARTN
+80167e78 SetExiInterruptMask
+80167f68 RVL::EXIImm
+801681e4 RVL::EXIImmEx
+80168288 RVL::EXIDma
+80168380 RVL::EXISync
+801685fc RVL::EXISetExiCallback
+80168680 __EXIProbe
+80168800 RVL::EXIAttach
+80168918 RVL::EXIDetach
+801689d0 RVL::EXISelect
+80168b00 RVL::EXIDeselect
+80168c00 RVL::EXIIntrruptHandler
+80168cb8 TCIntrruptHandler
+80168ed0 RVL::EXTIntrruptHandler
+80168fa0 EXIInit
+80169164 RVL::EXILock
+80169260 RVL::EXIUnlock
+80169338 UnlockedHandler
+80169360 RVL::EXIGetID
+8016970c ProbeBarnacle
+80169884 OS::__EnableBarnacle
+80169a40 EXIWriteReg
+80169bcc ISFS::OpenLib
+80169cf4 _isfsFuncCb
+80169e74 ISFS::CreateDir
+80169f68 ISFS::CreateDirAsync
+8016a05c ISFS::ReadDir
+8016a1b0 ISFS::ReadDirAsync
+8016a2f8 ISFS::SetAttr
+8016a3fc ISFS::SetAttrAsync
+8016a500 ISFS::GetAttr
+8016a658 ISFS::GetAttrAsync
+8016a78c ISFS::Delete
+8016a864 ISFS::DeleteAsync
+8016a934 ISFS::Rename
+8016aa38 ISFS::RenameAsync
+8016ab3c ISFS::GetUsage
+8016ac74 ISFS::CreateFile
+8016ad68 ISFS::CreateFileAsync
+8016ae5c ISFS::Open
+8016af24 ISFS::OpenAsync
+8016afdc ISFS::GetFileStats
+8016b0ac ISFS::GetFileStatsAsync
+8016b16c ISFS::Seek
+8016b170 ISFS::SeekAsync
+8016b1fc ISFS::Read
+8016b21c ISFS::ReadAsync
+8016b2c0 ISFS::Write
+8016b2e0 ISFS::WriteAsync
+8016b384 ISFS::Close
+8016b388 ISFS::CloseAsync
+8016b40c ISFS::ShutdownAsync
+8016b49c __GX::DefaultTexRegionCallback
+8016b590 __GX::DefaultTlutRegionCallback
+8016b5b4 __GX::Shutdown
+8016b720 __GX::InitRevisionBits
+8016b850 GX::Init
+8016bd54 __GX::InitGX
+8016c668 GX::CPInterruptHandler
+8016c7c8 GX::InitFifoBase
+8016c854 CPGPLinkCheck
+8016c94c GX::SetCPUFifo
+8016cb2c GX::SetGPFifo
+8016cdbc __GX::SaveFifo
+8016cebc __GX::IsGPFifoReady
+8016cec4 GX::GetGPStatus
+8016cf10 GX::GetCPUFifo
+8016cfa0 GX::GetGPFifo
+8016d030 GX::GetFifoPtrs
+8016d044 GX::GetFifoCount
+8016d04c GX::GetFifoWrap
+8016d054 GX::SetBreakPtCallback
+8016d098 GX::EnableBreakPt
+8016d138 GX::DisableBreakPt
+8016d180 __GX::FifoInit
+8016d1fc __GX::CleanGPFifo
+8016d39c GX::GetCurrentGXThread
+8016d3a4 GX::SetVtxDesc
+8016d3c0 GX::SetVtxDesc_switch
+8016d3c4 GX::SetVtxDesc_caseD_0
+8016d3d8 GX::SetVtxDesc_caseD_1
+8016d3ec GX::SetVtxDesc_caseD_2
+8016d400 GX::SetVtxDesc_caseD_3
+8016d414 GX::SetVtxDesc_caseD_4
+8016d428 GX::SetVtxDesc_caseD_5
+8016d43c GX::SetVtxDesc_caseD_6
+8016d450 GX::SetVtxDesc_caseD_7
+8016d464 GX::SetVtxDesc_caseD_8
+8016d478 GX::SetVtxDesc_caseD_9
+8016d48c GX::SetVtxDesc_caseD_a
+8016d4c0 GX::SetVtxDesc_caseD_19
+8016d4f4 GX::SetVtxDesc_caseD_b
+8016d508 GX::SetVtxDesc_caseD_c
+8016d51c GX::SetVtxDesc_caseD_d
+8016d530 GX::SetVtxDesc_caseD_e
+8016d544 GX::SetVtxDesc_caseD_f
+8016d558 GX::SetVtxDesc_caseD_10
+8016d56c GX::SetVtxDesc_caseD_11
+8016d580 GX::SetVtxDesc_caseD_12
+8016d594 GX::SetVtxDesc_caseD_13
+8016d5a8 GX::SetVtxDesc_caseD_14
+8016d5b8 GX::SetVtxDesc_caseD_15
+8016d608 GX::SetVtxDescv
+8016d61c 0x8016d61c
+8016d640 0x8016d640
+8016d650 0x8016d650
+8016d660 0x8016d660
+8016d670 0x8016d670
+8016d680 0x8016d680
+8016d690 0x8016d690
+8016d6a0 0x8016d6a0
+8016d6b0 0x8016d6b0
+8016d6c0 0x8016d6c0
+8016d6d0 0x8016d6d0
+8016d6e0 0x8016d6e0
+8016d700 0x8016d700
+8016d720 0x8016d720
+8016d730 0x8016d730
+8016d740 0x8016d740
+8016d750 0x8016d750
+8016d760 0x8016d760
+8016d770 0x8016d770
+8016d780 0x8016d780
+8016d790 0x8016d790
+8016d7a0 0x8016d7a0
+8016d7b0 0x8016d7b0
+8016d7bc 0x8016d7bc
+8016d814 __GX::SetVCD
+8016d8c4 __GX::CalculateVLim
+8016d9f0 GX::GetVtxDesc
+8016da0c GX::GetVtxDesc_switch
+8016da10 GX::GetVtxDesc_caseD_0
+8016da20 GX::GetVtxDesc_caseD_1
+8016da30 GX::GetVtxDesc_caseD_2
+8016da40 GX::GetVtxDesc_caseD_3
+8016da50 GX::GetVtxDesc_caseD_4
+8016da60 GX::GetVtxDesc_caseD_5
+8016da70 GX::GetVtxDesc_caseD_6
+8016da80 GX::GetVtxDesc_caseD_7
+8016da90 GX::GetVtxDesc_caseD_8
+8016daa0 GX::GetVtxDesc_caseD_9
+8016dab0 GX::GetVtxDesc_caseD_a
+8016dad4 GX::GetVtxDesc_caseD_19
+8016daf8 GX::GetVtxDesc_caseD_b
+8016db08 GX::GetVtxDesc_caseD_c
+8016db18 GX::GetVtxDesc_caseD_d
+8016db28 GX::GetVtxDesc_caseD_e
+8016db38 GX::GetVtxDesc_caseD_f
+8016db48 GX::GetVtxDesc_caseD_10
+8016db58 GX::GetVtxDesc_caseD_11
+8016db68 GX::GetVtxDesc_caseD_12
+8016db78 GX::GetVtxDesc_caseD_13
+8016db88 GX::GetVtxDesc_caseD_14
+8016db98 GX::GetVtxDesc_caseD_15
+8016dba4 GX::GetVtxDescv
+8016dc34 GX::ClearVtxDesc
+8016dc68 GX::SetVtxAttrFmt
+8016dc94 GX::SetVtxAttrFmt_switch
+8016dc98 GX::SetVtxAttrFmt_caseD_9
+8016dcb0 GX::SetVtxAttrFmt_caseD_19
+8016dcec GX::SetVtxAttrFmt_caseD_b
+8016dd00 GX::SetVtxAttrFmt_caseD_c
+8016dd14 GX::SetVtxAttrFmt_caseD_d
+8016dd2c GX::SetVtxAttrFmt_caseD_e
+8016dd44 GX::SetVtxAttrFmt_caseD_f
+8016dd5c GX::SetVtxAttrFmt_caseD_10
+8016dd74 GX::SetVtxAttrFmt_caseD_11
+8016dd94 GX::SetVtxAttrFmt_caseD_12
+8016ddac GX::SetVtxAttrFmt_caseD_13
+8016ddc4 GX::SetVtxAttrFmt_caseD_14
+8016ddd8 GX::SetVtxAttrFmt_caseD_15
+8016de08 GX::SetVtxAttrFmtv
+8016de1c 0x8016de1c
+8016de48 GX::SetVtxAttrFmtv_switch
+8016de4c GX::SetVtxAttrFmtv_caseD_9
+8016de64 GX::SetVtxAttrFmtv_caseD_19
+8016dea0 GX::SetVtxAttrFmtv_caseD_b
+8016deb4 GX::SetVtxAttrFmtv_caseD_c
+8016dec8 GX::SetVtxAttrFmtv_caseD_d
+8016dee0 GX::SetVtxAttrFmtv_caseD_e
+8016def8 GX::SetVtxAttrFmtv_caseD_f
+8016df10 GX::SetVtxAttrFmtv_caseD_10
+8016df28 GX::SetVtxAttrFmtv_caseD_11
+8016df48 GX::SetVtxAttrFmtv_caseD_12
+8016df60 GX::SetVtxAttrFmtv_caseD_13
+8016df78 GX::SetVtxAttrFmtv_caseD_14
+8016df8c GX::SetVtxAttrFmtv_caseD_15
+8016dfcc __GX::SetVAT
+8016e04c GX::GetVtxAttrFmt
+8016e078 GX::GetVtxAttrFmt_switch
+8016e07c GX::GetVtxAttrFmt_caseD_9
+8016e0a4 GX::GetVtxAttrFmt_caseD_19
+8016e118 GX::GetVtxAttrFmt_caseD_b
+8016e13c GX::GetVtxAttrFmt_caseD_c
+8016e160 GX::GetVtxAttrFmt_caseD_d
+8016e188 GX::GetVtxAttrFmt_caseD_e
+8016e1b0 GX::GetVtxAttrFmt_caseD_f
+8016e1d8 GX::GetVtxAttrFmt_caseD_10
+8016e200 GX::GetVtxAttrFmt_caseD_11
+8016e228 GX::GetVtxAttrFmt_caseD_12
+8016e250 GX::GetVtxAttrFmt_caseD_13
+8016e278 GX::GetVtxAttrFmt_caseD_14
+8016e2a0 GX::GetVtxAttrFmt_caseD_15
+8016e2b8 GX::GetVtxAttrFmtv
+8016e32c GX::SetArray
+8016e36c GX::InvalidateVtxCache
+8016e37c GX::SetTexCoordGen2
+8016e3a4 GX::SetTexCoordGen2_switch
+8016e3a8 GX::SetTexCoordGen2_caseD_0
+8016e3b4 GX::SetTexCoordGen2_caseD_1
+8016e3c0 GX::SetTexCoordGen2_caseD_2
+8016e3cc GX::SetTexCoordGen2_caseD_3
+8016e3d8 GX::SetTexCoordGen2_caseD_13
+8016e3e0 GX::SetTexCoordGen2_caseD_14
+8016e3e8 GX::SetTexCoordGen2_caseD_4
+8016e3f0 GX::SetTexCoordGen2_caseD_5
+8016e3f8 GX::SetTexCoordGen2_caseD_6
+8016e400 GX::SetTexCoordGen2_caseD_7
+8016e408 GX::SetTexCoordGen2_caseD_8
+8016e410 GX::SetTexCoordGen2_caseD_9
+8016e418 GX::SetTexCoordGen2_caseD_a
+8016e420 GX::SetTexCoordGen2_caseD_b
+8016e424 GX::SetTexCoordGen2_caseD_10
+8016e514 GX::SetTexCoordGen2_switch
+8016e518 GX::SetTexCoordGen2_caseD_0
+8016e528 GX::SetTexCoordGen2_caseD_1
+8016e538 GX::SetTexCoordGen2_caseD_2
+8016e548 GX::SetTexCoordGen2_caseD_3
+8016e558 GX::SetTexCoordGen2_caseD_4
+8016e568 GX::SetTexCoordGen2_caseD_5
+8016e578 GX::SetTexCoordGen2_caseD_6
+8016e5a4 GX::SetNumTexGens
+8016e5c8 GX::SetMisc
+8016e654 GX::Flush
+8016e6b0 GX::ResetWriteGatherPipe
+8016e6e4 __GX::Abort
+8016e848 GX::AbortFrame
+8016e9fc GX::SetDrawSync
+8016eab0 GX::DrawDone
+8016eb70 GX::PixModeSync
+8016eb94 GX::PokeAlphaMode
+8016eba4 GX::PokeAlphaUpdate
+8016ebbc GX::PokeAlphaUpdate
+8016ebd0 GX::PokeBlendMode
+8016ec2c GX::PokeColorUpdate
+8016ec40 GX::PokeDstAlpha
+8016ec58 GX::PokeDither
+8016ec6c GX::PokeZMode
+8016ec88 GX::SetDrawSyncCallback
+8016eccc GX::TokenInterruptHandler
+8016ed50 GX::SetDrawDoneCallback
+8016ed94 GX::FinishInterruptHandler
+8016ee14 __GX::PEInit
+8016ee78 __GX::SetDirtyState
+8016f0f0 GX::Begin
+8016f23c __GX::SendFlushPrim
+8016f240 0x8016f240
+8016f314 GX::SetLineWidth
+8016f348 GX::SetPointSize
+8016f37c GX::EnableTexOffsets
+8016f3b8 GX::SetCullMode
+8016f3e0 GX::SetCoPlanar
+8016f414 __GX::SetGenMode
+8016f438 GX::SetDispCopySrc
+8016f478 GX::SetTexCopySrc
+8016f4b8 GX::SetDispCopyDst
+8016f4dc GX::SetTexCopyDst
+8016f5f8 GX::SetDispCopyFrame2Field
+8016f618 GX::SetCopyClamp
+8016f640 GX::GetNumXfbLines
+8016f6cc GX::GetYScaleFactor
+8016f8fc GX::SetDispCopyYScale
+8016f9c8 GX::SetCopyClear
+8016fa40 GX::SetCopyFilter
+8016fc24 GX::SetDispCopyGamma
+8016fc38 GX::CopyDisp
+8016fd74 GX::CopyTex
+8016fecc GX::ClearBoundingBox
+8016ff04 GX::InitLightAttn
+8016ff20 GX::InitLightAttnA
+8016ff30 GX::InitLightAttnK
+8016ff40 GX::InitLightSpot
+8016ffb0 GX::InitLightSpot_switch
+8016ffb4 GX::InitLightSpot_caseD_1
+8016ffc8 GX::InitLightSpot_caseD_2
+8016ffe4 GX::InitLightSpot_caseD_3
+80170000 GX::InitLightSpot_caseD_4
+8017002c GX::InitLightSpot_caseD_5
+8017005c GX::InitLightSpot_caseD_6
+80170098 GX::InitLightSpot_caseD_0
+801700c8 GX::InitLightDistAttn
+80170198 GX::InitLightPos
+801701a8 GX::GetLightPos
+801701c4 GX::InitLightDir
+801701e0 GX::GetLightDir
+80170208 GX::InitSpecularDir
+80170314 GX::InitLightColor
+80170320 GX::LoadLightObjImm
+8017039c GX::SetChanAmbColor
+80170474 GX::SetChanMatColor
+8017054c GX::SetNumChans
+80170570 GX::SetChanCtrl
+80170614 GX::GetTexBufferSize
+80170630 GX::GetTexBufferSize_switch
+80170634 GX::GetTexBufferSize_caseD_0
+80170640 GX::GetTexBufferSize_caseD_1
+8017064c GX::GetTexBufferSize_caseD_13
+80170658 GX::GetTexBufferSize_caseD_10
+80170738 __GetImageTileCount
+80170754 __GetImageTileCount_switch
+80170758 __GetImageTileCount_caseD_0
+80170764 __GetImageTileCount_caseD_1
+80170770 __GetImageTileCount_caseD_13
+8017077c __GetImageTileCount_caseD_10
+801707f8 GX::InitTexObj
+80170938 GX::InitTexObj_switch
+8017093c GX::InitTexObj_caseD_0
+80170950 GX::InitTexObj_caseD_1
+80170964 GX::InitTexObj_caseD_3
+80170978 GX::InitTexObj_caseD_6
+8017098c GX::InitTexObj_caseD_e
+801709a0 GX::InitTexObj_caseD_7
+80170a04 GX::InitTexObjCI
+80170a4c GX::InitTexObjLOD
+80170b50 GX::InitTexObjWrapMode
+80170b64 GX::InitTexObjTlut
+80170b6c GX::InitTexObjFilter
+80170b94 GX::InitTexObjLODBias
+80170be8 GX::InitTexObjUserData
+80170bf0 GX::GetTexObjUserData
+80170bf8 GX::GetTexObjAll
+80170c5c GX::GetTexObjData
+80170c68 GX::GetTexObjWidth
+80170c7c GX::GetTexObjHeight
+80170c90 GX::GetTexObjFmt
+80170c98 GX::GetTexObjWrapS
+80170ca4 GX::GetTexObjWrapT
+80170cb0 GX::GetTexObjMipMap
+80170cbc GX::GetTexObjLODAll
+80170da0 GX::GetTexObjMinFilt
+80170db4 GX::GetTexObjMinFilt
+80170dc0 GX::GetTexObjTlut
+80170dc8 GX::LoadTexObjPreLoaded
+80170f2c GX::LoadTexObj
+80170f80 GX::InitTlutObj
+80170fa8 GX::LoadTlut
+8017103c GX::InitTexCacheRegion
+801710f0 GX::InitTlutRegion
+80171110 GX::InvalidateTexAll
+80171158 GX::SetTexRegionCallback
+8017116c GX::SetTlutRegionCallback
+80171180 GX::SetTexCoordScaleManually
+801711fc GX::SetTexCoordBias
+80171260 __SetSURegs
+801712f0 __GX::SetSUTexRegs
+80171458 __GX::SetTmemConfig
+80171770 0x80171770
+801717ac GX::SetTevIndirect
+80171814 GX::SetIndTexMtx
+80171968 GX::SetIndTexCoordScale
+80171a6c GX::SetIndTexOrder
+80171b38 GX::SetNumIndStages
+80171b58 GX::SetTevDirect
+80171ba0 GX::SetTevIndWarp
+80171bf4 __GX::UpdateBPMask
+80171bf8 __GX::SetIndirectMask
+80171c28 __GX::FlushTextureState
+80171c4c GX::SetTevOp
+80171ce0 GX::SetTevColorIn
+80171d20 GX::SetTevAlphaIn
+80171d60 GX::SetTevColorOp
+80171db8 GX::SetTevAlphaOp
+80171e10 GX::SetTevColor
+80171e70 GX::SetTevColorS10
+80171ed4 GX::SetTevKColor
+80171f30 GX::SetTevKColorSel
+80171f80 GX::SetTevKAlphaSel
+80171fd0 GX::SetTevSwapMode
+8017200c GX::SetTevSwapModeTable
+80172088 GX::SetAlphaCompare
+801720c0 GX::SetZTexture
+8017214c GX::SetTevOrder
+801722a8 GX::SetNumTevStages
+801722cc GX::SetFog
+801724f8 GX::InitFogAdjTable
+80172658 GX::SetFogRangeAdj
+8017277c GX::SetBlendMode
+801727cc GX::SetColorUpdate
+801727f8 GX::SetAlphaUpdate
+80172824 GX::SetZMode
+80172858 GX::SetZCompLoc
+80172888 GX::SetPixelFmt
+80172930 GX::SetDither
+8017295c GX::SetDstAlpha
+8017298c GX::SetFieldMask
+801729c0 GX::SetFieldMode
+80172a30 GX::DrawSphere
+80172e00 GX::BeginDisplayList
+80172eb4 GX::EndDisplayList
+80172f64 GX::CallDisplayList
+80172fd8 __GX::SetProjection
+8017301c GX::SetProjection
+80173080 GX::SetProjectionv
+801730cc GX::GetProjectionv
+8017310c GX::LoadPosMtxImm
+8017315c GX::LoadPosMtxIndx
+80173188 GX::LoadNrmMtxImm
+801731e0 GX::LoadNrmMtxIndx3x3
+80173214 GX::SetCurrentMtx
+80173234 GX::LoadTexMtxImm
+801732e8 __GX::SetViewport
+80173378 GX::SetViewportJitter
+801733b4 GX::SetViewport
+801733e0 GX::GetViewportv
+80173400 GX::SetZScaleOffset
+80173430 GX::SetScissor
+80173498 GX::GetScissor
+801734e0 GX::SetScissorBoxOffset
+8017351c GX::SetClipMode
+80173544 __GX::SetMatrixIndex
+801735cc GX::SetGPMetric
+801736f4 GX::SetGPMetric_switch
+801736f8 GX::SetGPMetric_caseD_0
+80173718 GX::SetGPMetric_caseD_1
+80173738 GX::SetGPMetric_caseD_2
+80173758 GX::SetGPMetric_caseD_3
+80173778 GX::SetGPMetric_caseD_4
+80173798 GX::SetGPMetric_caseD_5
+801737b8 GX::SetGPMetric_caseD_6
+801737d8 GX::SetGPMetric_caseD_7
+801737f8 GX::SetGPMetric_caseD_8
+80173818 GX::SetGPMetric_caseD_9
+80173838 GX::SetGPMetric_caseD_22
+80173858 GX::SetGPMetric_caseD_a
+80173878 GX::SetGPMetric_caseD_b
+80173894 GX::SetGPMetric_caseD_c
+801738b0 GX::SetGPMetric_caseD_d
+801738cc GX::SetGPMetric_caseD_e
+801738e8 GX::SetGPMetric_caseD_f
+80173904 GX::SetGPMetric_caseD_10
+80173920 GX::SetGPMetric_caseD_11
+8017393c GX::SetGPMetric_caseD_12
+80173958 GX::SetGPMetric_caseD_13
+80173974 GX::SetGPMetric_caseD_14
+80173990 GX::SetGPMetric_caseD_15
+801739ac GX::SetGPMetric_caseD_16
+801739c8 GX::SetGPMetric_caseD_17
+801739e4 GX::SetGPMetric_caseD_18
+80173a00 GX::SetGPMetric_caseD_19
+80173a1c GX::SetGPMetric_caseD_1a
+80173a38 GX::SetGPMetric_caseD_1b
+80173a54 GX::SetGPMetric_caseD_1c
+80173a70 GX::SetGPMetric_caseD_1d
+80173a8c GX::SetGPMetric_caseD_1e
+80173aa8 GX::SetGPMetric_caseD_1f
+80173ac4 GX::SetGPMetric_caseD_20
+80173ae0 GX::SetGPMetric_caseD_21
+80173af8 GX::SetGPMetric_caseD_23
+80173b18 GX::SetGPMetric_switch
+80173b1c GX::SetGPMetric_caseD_0
+80173b38 GX::SetGPMetric_caseD_1
+80173b54 GX::SetGPMetric_caseD_2
+80173b70 GX::SetGPMetric_caseD_3
+80173b8c GX::SetGPMetric_caseD_8
+80173ba8 GX::SetGPMetric_caseD_15
+80173bc4 GX::SetGPMetric_caseD_4
+80173be0 GX::SetGPMetric_caseD_5
+80173bfc GX::SetGPMetric_caseD_6
+80173c18 GX::SetGPMetric_caseD_7
+80173c34 GX::SetGPMetric_caseD_9
+80173c64 GX::SetGPMetric_caseD_a
+80173c94 GX::SetGPMetric_caseD_b
+80173cc4 GX::SetGPMetric_caseD_c
+80173cf4 GX::SetGPMetric_caseD_d
+80173d24 GX::SetGPMetric_caseD_e
+80173d54 GX::SetGPMetric_caseD_f
+80173d84 GX::SetGPMetric_caseD_10
+80173db0 GX::SetGPMetric_caseD_11
+80173dc0 GX::SetGPMetric_caseD_12
+80173dd0 GX::SetGPMetric_caseD_13
+80173de0 GX::SetGPMetric_caseD_14
+80173dec GX::SetGPMetric_caseD_16
+80173df8 GX::ClearGPMetric
+80173e08 homebutton::FrameController::Init
+80173e40 homebutton::FrameController::InitFrame
+80173e60 homebutton::FrameController::Calc
+80173fb0 homebutton::GroupAnmController::GroupAnmController
+80173fcc 0x80173fcc
+8017400c homebutton::GroupAnmController::do_calc
+801740bc 0x801740bc
+80174280 0x80174280
+80174488 0x80174488
+80174490 0x80174490
+8017449c 0x8017449c
+801744a0 homebutton::gui::Manager::onEvent
+801744c0 0x801744c0
+801744c4 0x801744c4
+801744cc 0x801744cc
+801744d8 0x801744d8
+801744dc 0x801744dc
+801744e0 0x801744e0
+8017459c homebutton::gui::Manager::init
+80174604 homebutton::gui::Component::init
+80174630 0x80174630
+801746f4 0x801746f4
+801746fc 0x801746fc
+80174728 0x80174728
+801748cc 0x801748cc
+801748d4 homebutton::gui::Component::onTrig
+80174904 homebutton::gui::Manager::calc
+8017496c 0x8017496c
+80174970 homebutton::gui::Manager::draw
+801749d8 0x801749d8
+801749dc 0x801749dc
+80174a54 0x80174a54
+80174a5c homebutton::gui::PaneManager::__dt
+80174bb0 homebutton::gui::PaneComponent::__dt
+80174bf0 homebutton::gui::Component::__dt
+80174c30 homebutton::gui::PaneManager::createLayoutScene
+80174c54 0x80174c54
+80174ee4 0x80174ee4
+80174eec 0x80174eec
+80174ef8 0x80174ef8
+80174f70 0x80174f70
+80175040 0x80175040
+8017516c 0x8017516c
+80175174 0x80175174
+80175314 homebutton::gui::is_visible
+80175414 0x80175414
+80175420 0x80175420
+80175428 0x80175428
+801754fc 0x801754fc
+80175500 0x80175500
+80175504 0x80175504
+8017550c 0x8017550c
+80175514 0x80175514
+80175518 0x80175518
+80175520 0x80175520
+8017554c 0x8017554c
+80175554 0x80175554
+8017555c 0x8017555c
+80175564 0x80175564
+80175678 0x80175678
+80175788 0x80175788
+801757f4 0x801757f4
+801758b0 homebutton::Controller::initCallback
+80175944 homebutton::Controller::clearCallback
+801759b8 homebutton::Controller::setKpad
+80175b3c homebutton::Controller::clrKpadButton
+80175b50 homebutton::Controller::setInValidPos
+80175b64 homebutton::Controller::connect
+80175b74 0x80175b74
+80175b78 0x80175b78
+80175b80 homebutton::Controller::PlaySound
+80175c1c homebutton::Controller::IsPlayingSoundId
+80175c7c homebutton::Controller::InitSound
+80175c8c homebutton::Controller::UpdateSound
+80175ec4 homebutton::Controller::IsPlayReady
+80175ed4 homebutton::Controller::GetController
+80175ed8 homebutton::Controller::StartMotor
+80175f3c homebutton::Controller::StopMotor
+80175f6c homebutton::Controller::GetInfoAsync
+80175ff0 0x80175ff0
+80176014 homebutton::Controller::GetBatteryFlag
+80176038 homebutton::Controller::ClrBatteryFlag
+80176058 homebutton::RemoteSpk::UpdateSpeaker
+801762c0 homebutton::RemoteSpk::ClearPcm
+801762ec homebutton::RemoteSpk::__ct
+801763a8 homebutton::RemoteSpk::__dt
+8017644c homebutton::RemoteSpk::Start
+80176520 homebutton::RemoteSpk::Stop
+80176574 homebutton::RemoteSpk::DelaySpeakerOnCallback
+801765a4 homebutton::RemoteSpk::SpeakerOnCallback
+80176684 homebutton::RemoteSpk::DelaySpeakerPlayCallback
+801766b4 homebutton::RemoteSpk::SpeakerPlayCallback
+80176798 homebutton::RemoteSpk::Connect
+80176824 homebutton::RemoteSpk::Play
+801768bc homebutton::RemoteSpk::IsPlaying
+801768d8 homebutton::RemoteSpk::IsPlayingId
+80176924 0x80176924
+80176ae0 0x80176ae0
+80176b44 0x80176b44
+80176d84 homebutton::PlaySeq
+80176ec8 homebutton::InitAxSound
+801770a8 homebutton::AxSoundMain
+801770ac homebutton::StopAllSeq
+8017728c homebutton::SetVolumeAllSeq
+801773ac HBMFreeMem
+801773b0 0x801773b0
+801773c0 0x801773c0
+801773d0 HBM::Create
+80177520 HBM::Init
+80177554 HBM::Calc
+801775a4 HBM::Draw
+80177700 HBM::GetSelectBtnNum
+80177724 HBM::SetAdjustFlag
+80177734 0x80177734
+80177740 HBM::CreateSound
+80177744 HBM::UpdateSound
+80177798 homebutton::__ct::HomeButton
+8017789c homebutton::__ct::~HomeButton
+80177908 homebutton::__ct::Create
+80178210 homebutton::__ct::Set_config
+80178378 homebutton::__ct::Set_text
+801783fc homebutton::__ct::Init
+80178754 homebutton::__ct::Init_volume
+80178954 homebutton::__ct::Init_sound
+80178a84 homebutton::__ct::Init_battery
+80178cec homebutton::__ct::Calc
+80178ea8 0x80178ea8
+80179070 0x80179070
+801792d8 0x801792d8
+8017938c 0x8017938c
+80179484 0x80179484
+801795a4 0x801795a4
+8017986c 0x8017986c
+80179930 0x80179930
+80179ae8 0x80179ae8
+80179b3c 0x80179b3c
+80179c38 0x80179c38
+80179c7c 0x80179c7c
+80179cb4 0x80179cb4
+80179dac 0x80179dac
+80179f38 0x80179f38
+80179fbc 0x80179fbc
+8017a060 0x8017a060
+8017a2cc 0x8017a2cc
+8017a2d8 0x8017a2d8
+8017aa5c homebutton::__ct::Calc_battery
+8017ac5c homebutton::SpeakerCallback
+8017ad40 homebutton::MotorCallback
+8017ad64 homebutton::RetrySimpleSyncCallback
+8017ae30 0x8017ae30
+8017ae68 homebutton::__ct::Update
+8017b7a0 homebutton::__ct::Update_controller
+8017c038 homebutton::__ct::UpdateTrigPane
+8017c300 homebutton::__ct::StartPointEvent
+8017c450 homebutton::__ct::StartPointEvent_switch
+8017c454 homebutton::__ct::StartPointEvent_caseD_0
+8017c514 homebutton::__ct::StartPointEvent_caseD_1
+8017caac homebutton::__ct::StartPointEvent_caseD_2
+8017cb7c homebutton::__ct::StartPointEvent_caseD_3
+8017cc4c homebutton::__ct::StartPointEvent_caseD_4
+8017cd1c homebutton::__ct::StartPointEvent_caseD_5
+8017cdec homebutton::__ct::StartPointEvent_caseD_6
+8017cebc homebutton::__ct::StartPointEvent_caseD_7
+8017cf40 0x8017cf40
+8017cf8c 0x8017cf40_caseD_8
+8017d130 homebutton::__ct::StartLeftEvent
+8017d280 homebutton::__ct::StartLeftEvent_switch
+8017d284 homebutton::__ct::StartLeftEvent_caseD_0
+8017d2f8 homebutton::__ct::StartLeftEvent_caseD_1
+8017d820 homebutton::__ct::StartLeftEvent_caseD_2
+8017d8a8 homebutton::__ct::StartLeftEvent_caseD_3
+8017d930 homebutton::__ct::StartLeftEvent_caseD_4
+8017d9b8 homebutton::__ct::StartLeftEvent_caseD_5
+8017da40 homebutton::__ct::StartLeftEvent_caseD_6
+8017dac8 homebutton::__ct::StartLeftEvent_caseD_7
+8017db50 homebutton::__ct::StartLeftEvent_caseD_8
+8017dbf0 homebutton::__ct::StartTrigEvent
+8017ded8 0x8017ded8
+8017df6c 0x8017df6c
+8017e0c4 0x8017e0c4
+8017e390 0x8017e390
+8017e65c 0x8017e65c
+8017e88c 0x8017e88c
+8017ea14 0x8017ea14
+8017ebd4 0x8017ebd4
+8017ecec 0x8017ecec
+8017eddc homebutton::__ct::Reset_btn
+8017f03c homebutton::__ct::GetPaneNo
+8017f210 homebutton::HomeButtonEventHandler::OnEvent
+8017f2d0 0x8017f2d0
+8017f4c8 homebutton::Initgx
+8017f680 0x8017f680
+8017f770 0x8017f770
+8017f934 nw4hbm::lyt::AnimTransform::GetFrameSize
+8017f940 nw4hbm::lyt::AnimTransformBasic::__ct
+8017f978 nw4hbm::lyt::AnimTransformBasic::__dt
+8017fa04 0x8017fa04
+8017fb4c 0x8017fb4c
+8017fc4c nw4hbm::lyt::AnimTransformBasic::Bind
+8017fd08 0x8017fd08
+8017fef8 0x8017fef8
+8017ff60 0x8017ff60
+8017ffc4 0x8017ffc4
+80180000 0x80180000
+801801e8 0x801801e8
+8018021c 0x8018021c
+801802f8 0x801802f8
+80180440 0x80180440
+8018049c 0x8018049c
+80180518 0x80180518
+80180538 0x80180538
+801805a8 0x801805a8
+801805e4 0x801805e4
+8018063c nw4hbm::lyt::Bounding::DrawSelf
+801806ac 0x801806ac
+801806ec 0x801806ec
+801806f8 0x801806f8
+8018070c 0x8018070c
+80180738 0x80180738
+80180764 nw4hbm::lyt::detail::TestFileHeader
+8018078c nw4hbm::lyt::detail::TestFileHeader
+801807c0 0x801807c0
+801807d4 0x801807d4
+80180824 0x80180824
+801808ac 0x801808ac
+801809a4 0x801809a4
+80180a38 0x80180a38
+80180aa0 0x80180aa0
+80180af4 0x80180af4
+80180bd8 0x80180bd8
+80181138 0x80181138
+80181230 0x80181230
+801813e0 0x801813e0
+80181520 nw4hbm::lyt::DrawInfo::__ct
+8018159c nw4hbm::lyt::DrawInfo::__dt
+801815dc 0x801815dc
+801816e8 0x801816e8
+80181790 0x80181790
+80181858 nw4hbm::lyt::GroupContainer::AppendGroup
+8018188c nw4hbm::lyt::GroupContainer::FindGroupByName
+80181908 0x80181908
+80181aa8 0x80181aa8
+80181af0 0x80181af0
+80181c18 0x80181c18
+80181f1c 0x80181f1c
+801820a4 0x801820a4
+801820c8 0x801820c8
+801820ec 0x801820ec
+80182100 0x80182100
+80182124 0x80182124
+80182144 0x80182144
+80182164 0x80182164
+80182184 0x80182184
+801821f0 0x801821f0
+80182394 0x80182394
+801825b4 0x801825b4
+801826cc 0x801826cc
+801828d0 0x801828d0
+801828dc 0x801828dc
+80183b28 0x80183b28
+80183bd8 0x80183bd8
+80184350 0x80184350
+80184364 nw4hbm::lyt::Material::GetTexCoordGenAry
+80184384 nw4hbm::lyt::Material::GetIndTexSRTAry
+801843dc 0x801843dc
+8018446c nw4hbm::lyt::Material::SetTexCoordGenNum
+801845c0 0x801845c0
+80184644 0x80184644
+80184698 nw4hbm::lyt::Material::SetColorElement
+80184874 PossibleCorruption
+80185728 0x80185728
+80185744 0x80185744
+801857c4 0x801857c4
+801857d8 nw4hbm::lyt::Material::Animate
+80185850 nw4hbm::lyt::Material::AddAnimationLink
+80185884 0x80185884
+8018588c 0x8018588c
+801858d8 0x801858d8
+801859e8 0x801859e8
+80185b10 0x80185b10
+80185c44 nw4hbm::lyt::Pane::AppendChild
+80185c94 0x80185c94
+80185d64 0x80185d64
+80185d70 0x80185d70
+80185d74 0x80185d74
+80185d9c 0x80185d9c
+80185dc4 0x80185dc4
+80185dcc 0x80185dcc
+80185dd0 nw4hbm::lyt::Pane::FindPaneByName
+80185e7c nw4hbm::lyt::Pane::FindMaterialByName
+80185f34 0x80185f34
+80186234 nw4hbm::lyt::Pane::Draw
+801862b8 nw4hbm::lyt::Pane::DrawSelf
+80186334 nw4hbm::lyt::Pane::Animate
+801863c0 nw4hbm::lyt::Pane::AnimateSelf
+80186474 0x80186474
+80186490 0x80186490
+80186520 0x80186520
+80186538 0x80186538
+801865d8 nw4hbm::lyt::Pane::AddAnimationLink
+8018660c nw4hbm::lyt::Pane::FindAnimationLink
+80186684 0x80186684
+8018673c 0x8018673c
+80186844 0x80186844
+80186944 0x80186944
+8018694c 0x8018694c
+8018695c 0x8018695c
+80186a84 0x80186a84
+80186b54 nw4hbm::lyt::Picture::Append
+80186ba0 0x80186ba0
+80186d10 0x80186d10
+80186d3c 0x80186d3c
+80186d68 0x80186d68
+80186d80 0x80186d80
+80186d98 nw4hbm::lyt::Picture::DrawSelf
+80186e74 0x80186e74
+80186e80 0x80186e80
+80186e94 0x80186e94
+80186ed4 0x80186ed4
+80186ee4 0x80186ee4
+80186eec 0x80186eec
+80186fa0 0x80186fa0
+80187254 0x80187254
+801873e4 0x801873e4
+80187418 0x80187418
+80187460 0x80187460
+8018748c 0x8018748c
+801874a4 0x801874a4
+801874bc 0x801874bc
+80187a24 0x80187a24
+80187e50 0x80187e50
+80187e88 0x80187e88
+80187f04 0x80187f04
+80187f50 0x80187f50
+80187fb8 0x80187fb8
+80188080 0x80188080
+801880c0 0x801880c0
+801883f8 0x801883f8
+80188560 0x80188560
+8018856c 0x8018856c
+80188580 0x80188580
+80188790 0x80188790
+801888d4 0x801888d4
+801889d0 nw4hbm::lyt::Window::FindAnimationLink
+80188a74 0x80188a74
+80188b08 0x80188b08
+80188b34 0x80188b34
+80188b60 0x80188b60
+80188b78 0x80188b78
+80188b90 nw4hbm::lyt::Window::DrawSelf
+80188cd0 nw4hbm::lyt::Window::AnimateSelf
+80188d60 nw4hbm::lyt::Window::UnbindAnimationSelf
+80188df0 0x80188df0
+80188f04 0x80188f04
+801894e0 0x801894e0
+80189ba8 0x80189ba8
+8018a8d8 nw4hbm::lyt::Window::GetFrameSize
+8018a9d8 0x8018a9d8
+8018aa00 0x8018aa00
+8018aa10 0x8018aa10
+8018aa1c 0x8018aa1c
+8018aa30 0x8018aa30
+8018aaa4 0x8018aaa4
+8018ab04 0x8018ab04
+8018acb4 0x8018acb4
+8018ad28 0x8018ad28
+8018ada0 0x8018ada0
+8018adbc 0x8018adbc
+8018add8 0x8018add8
+8018ae38 0x8018ae38
+8018b064 0x8018b064
+8018b0a4 0x8018b0a4
+8018b0ac 0x8018b0ac
+8018b0b4 0x8018b0b4
+8018bb2c 0x8018bb2c
+8018bb70 nw4hbm::ut::CharWriter::SetGradationMode
+8018bcc0 nw4hbm::ut::CharWriter::SetTextColor
+8018be20 nw4hbm::ut::CharWriter::SetTextColor
+8018bfa0 0x8018bfa0
+8018bfa8 0x8018bfa8
+8018bfb0 0x8018bfb0
+8018c080 0x8018c080
+8018c0e4 0x8018c0e4
+8018c148 0x8018c148
+8018c1ac 0x8018c1ac
+8018c1b4 0x8018c1b4
+8018c1bc 0x8018c1bc
+8018c2f8 WorldDarkening_Fade
+8018c304 0x8018c304
+8018c30c 0x8018c30c
+8018c314 0x8018c314
+8018c324 ColourBlendScreenTransition_Update
+8018c334 0x8018c334
+8018c33c 0x8018c33c
+8018c344 0x8018c344
+8018c5c8 0x8018c5c8
+8018c928 0x8018c928
+8018c9d0 0x8018c9d0
+8018ca54 0x8018ca54
+8018ca9c 0x8018ca9c
+8018cac8 0x8018cac8
+8018cae0 0x8018cae0
+8018cb50 0x8018cb50
+8018cbbc 0x8018cbbc
+8018cbdc MEM::GetNthListObject
+8018cc28 0x8018cc28
+8018cc64 0x8018cc64
+8018ccbc nw4hbm::ut::ResFont::SetResource
+8018ce00 0x8018ce00
+8018cf2c 0x8018cf2c
+8018cf70 0x8018cf70
+8018cfb0 0x8018cfb0
+8018cfbc 0x8018cfbc
+8018cfc8 0x8018cfc8
+8018cfd4 0x8018cfd4
+8018cfe0 0x8018cfe0
+8018cff4 0x8018cff4
+8018d008 0x8018d008
+8018d018 0x8018d018
+8018d028 0x8018d028
+8018d038 0x8018d038
+8018d040 0x8018d040
+8018d050 0x8018d050
+8018d060 0x8018d060
+8018d078 0x8018d078
+8018d098 nw4hbm::ut::detail::ResFontBase::SetAlternateChar
+8018d130 AnimatedModelExplodable_SetUnexplodedModelVisibility
+8018d13c 0x8018d13c
+8018d188 nw4hbm::ut::detail::ResFontBase::GetCharWidths
+8018d274 nw4hbm::ut::detail::ResFontBase::GetGlyph
+8018d318 EmissionController_IsLingering
+8018d324 0x8018d324
+8018d3f8 0x8018d3f8
+8018d4fc 0x8018d4fc
+8018d50c 0x8018d50c
+8018d54c 0x8018d54c
+8018d6ac 0x8018d6ac
+8018d8e4 0x8018d8e4
+8018d8f4 0x8018d8f4
+8018d934 0x8018d934
+8018da94 0x8018da94
+8018dccc 0x8018dccc
+8018dd58 0x8018dd58
+8018dd60 0x8018dd60
+8018ddbc 0x8018ddbc
+8018de14 0x8018de14
+8018dea0 0x8018dea0
+8018dea8 0x8018dea8
+8018deb0 0x8018deb0
+8018deb8 0x8018deb8
+8018dec0 0x8018dec0
+8018dec8 0x8018dec8
+8018ded0 nw4hbm::ut::TextWriterBase::Print
+8018e0ec 0x8018e0ec
+8018e324 0x8018e324
+8018e700 0x8018e700
+8018e818 0x8018e818
+8018ef68 0x8018ef68
+8018f6b8 0x8018f6b8
+8018f75c 0x8018f75c
+8018f7fc 0x8018f7fc
+8018f9fc 0x8018f9fc
+8018fa08 0x8018fa08
+80190358 0x80190358
+80190384 0x80190384
+801903bc 0x801903bc
+801903f4 0x801903f4
+80190474 0x80190474
+801904ac 0x801904ac
+80190fa8 0x80190fa8
+80190ffc 0x80190ffc
+80191010 0x80191010
+80191038 0x80191038
+80191064 0x80191064
+801910f0 0x801910f0
+801911c8 0x801911c8
+80191234 0x80191234
+801913bc 0x801913bc
+80191464 HBMSYNMidiInput
+801914b4 HBMSYNSetMasterVolume
+801914c0 0x801914c0
+8019159c 0x8019159c
+801917c8 0x801917c8
+801918f0 __HBMSYNRunInputBufferEvents
+80191958 0x80191958
+80191c24 0x80191c24
+80191d3c 0x80191d3c
+80191d64 __HBMSYNSetupPan
+80191d7c 0x80191d7c
+80191d90 __HBMSYNGetVoiceFader
+80191db4 0x80191db4
+80191e54 0x80191e54
+80191f64 0x80191f64
+80191fcc 0x80191fcc
+80192068 0x80192068
+801920c4 0x801920c4
+801922d8 0x801922d8
+80192348 0x80192348
+801923e8 0x801923e8
+801924f8 0x801924f8
+80192534 0x80192534
+801925d8 0x801925d8
+801925e4 0x801925e4
+801926d4 0x801926d4
+801929b8 __SEQInitTracks
+80192ad4 __HBMSEQReadHeader
+80192b60 0x80192b60
+80192b88 0x80192b88
+80192d0c 0x80192d0c
+80192d9c 0x80192d9c
+80192e34 0x80192e34
+80192f6c HBMSEQGetState
+80192f74 HBMSEQSetVolume
+80192f7c IPCInit
+80192fc8 IPCReInit
+80193010 IPCReadReg
+80193020 IPCWriteReg
+80193030 IPCGetBufferHi
+80193038 IPCGetBufferLo
+80193040 IPCSetBufferLo
+80193048 strnlen
+80193074 IpcReplyHandler
+801932cc IPCInterruptHandler
+80193478 IPCCltInit
+8019352c IPCCltReInit
+801935a0 __ios_Ipc2
+801937e0 IOS::OpenAsync
+801938f8 IOS::Open
+80193a18 IOS::CloseAsync
+80193ad8 IOS::Close
+80193b80 IOS::ReadAsync
+80193c80 IOS::Read
+80193d88 IOS::WriteAsync
+80193e88 IOS::Write
+80193f90 IOS::SeekAsync
+80194070 IOS::Seek
+80194158 IOS::IoctlAsync
+80194290 IOS::Ioctl
+801943c0 __ios_Ioctlv
+801944fc IOS::IoctlvAsync
+801945e0 IOS::Ioctlv
+801946bc IOS::IoctlvReboot
+801949b8 iosCreateHeap
+80194ae8 iosAlloc
+80194cec iosAllocAligned
+80194cf0 iosFree
+80194edc IPCiProfInit
+80194f94 IPCiProfQueueReq
+80195014 IPCiProfAck
+80195024 IPCiProfReply
+801950a0 KPAD::SetFSStickClamp
+801950b4 KPAD::SetPosParam
+801950d0 KPAD::SetHoriParam
+801950ec KPAD::SetDistParam
+80195108 KPAD::SetAccParam?
+80195124 reset_kpad
+801952f8 calc_button_repeat
+8019548c calc_acc
+80195540 calc_acc_horizon
+801956d4 calc_acc_vertical
+801957f8 read_kpad_acc
+80195c60 select_2obj_first
+80195e48 select_2obj_continue
+80196070 getCourseForLiveView
+80196224 select_1obj_continue
+80196398 calc_dpd_variable
+80196964 read_kpad_dpd
+80196dbc clamp_stick_circle
+80196ee4 clamp_stick_cross
+80197108 read_kpad_ext
+80197380 KPAD::Read
+80197aac KPAD::InitEx
+80197da0 KPAD::DisableDPD
+80197dbc KPAD::EnableDPD
+80197dd8 KPADiSamplingCallback
+8019801c 0x8019801c
+801980b0 KPADiControlDpdCallback
+8019812c KPAD::GetUnifiedWpadStatus
+801981ec FindContainHeap_
+8019832c MEM::iInitHeapHead
+801984ec MEM::iFinalizeHeap
+80198658 MEM::FindContainHeap
+80198798 AllocUsedBlockFromFreeBlock_
+8019899c AllocFromHead_
+80198a78 AllocFromTail_
+80198b40 RecycleRegion_
+80198ca8 MEM::CreateExpHeapEx
+80198d58 MEM::DestroyExpHeap
+80198d88 MEM::AllocFromExpHeapEx
+80198e38 MEM::ResizeForMBlockExpHeap
+80199038 MEM::FreeToExpHeap
+80199104 MEM::GetTotalFreeSizeForExpHeap
+80199180 MEM::GetAllocatableSizeForExpHeapEx
+80199258 MEM::SetGroupIDForExpHeap
+801992a8 MEM::VisitAllocatedForExpHeap
+80199344 MEM::GetSizeForMBlockExpHeap
+8019934c MEM::GetGroupIDForMBlockExpHeap
+80199358 MEM::AdjustExpHeap
+80199430 MEM::CreateFrmHeapEx
+801994b4 MEM::DestroyFrmHeap
+801994e4 MEM::AllocFromFrmHeapEx
+80199604 MEM::FreeToFrmHeap
+801996a4 MEM::GetAllocatableSizeForFrmHeapEx
+8019971c MEM::RecordStateForFrmHeap
+801997f0 MEM::FreeByStateToFrmHeap
+801998a4 MEM::CreateUnitHeapEx
+80199a00 MEM::DestroyUnitHeap
+80199a30 MEM::AllocFromUnitHeap
+80199ac4 MEM::FreeToUnitHeap
+80199b34 MEM::CalcHeapSizeForUnitHeap
+80199b58 AllocatorAllocForUnitHeap_
+80199b68 0x80199b68
+80199b70 0x80199b70
+80199b90 AllocatorFreeForUnitHeap_
+80199b98 MEM::AllocFromAllocator
+80199ba8 MEM::FreeToAllocator
+80199bb8 MEM::InitAllocatorForExpHeap
+80199bd4 MEM::InitAllocatorForUnitHeap
+80199bf0 MEM::InitList
+80199c08 MEM::AppendListObject
+80199c78 MEM::RemoveListObject
+80199ce4 MEM::GetNextListObject
+80199d04 MTX::PSMTXIdentity
+80199d30 MTX::PSMTXCopy
+80199d64 MTX::PSMTXConcat
+80199e30 MTX::PSMTXConcatArray
+80199fc8 MTX::PSMTXInverse
+8019a0c0 MTX::PSMTXInvXpose
+8019a188 MTX::PSMTXRotRad
+8019a204 MTX::PSMTXRotTrig
+8019a2b4 MTX::__PSMTXRotAxisRadInternal
+8019a364 MTX::PSMTXRotAxisRad
+8019a3e0 MTX::PSMTXTrans
+8019a414 MTX::PSMTXTransApply
+8019a460 MTX::PSMTXScale
+8019a488 MTX::PSMTXScaleApply
+8019a4e0 MTX::PSMTXQuat
+8019a584 MTX::C_MTXLookAt
+8019a6f8 MTX::C_MTXLightFrustum
+8019a79c MTX::C_MTXLightPerspective
+8019a894 MTX::C_MTXLightOrtho
+8019a91c MTX::PSMTXMultVec
+8019a970 MTX::PSMTXMultVecSR
+8019a9c4 MTX::C_MTXFrustum
+8019aa60 MTX::C_MTXPerspective
+8019ab4c MTX::C_MTXOrtho
+8019abe4 MTX::PSVECAdd
+8019ac08 MTX::PSVECScale
+8019ac24 MTX::PSVECNormalize
+8019ac68 MTX::PSVECMag
+8019acac MTX::PSVECDotProduct
+8019accc MTX::PSVECCrossProduct
+8019ad08 MTX::C_VECHalfAngle
+8019ade0 MTX::PSVECSquareDistance
+8019ae08 MTX::PSQUATMultiply
+8019ae64 MTX::PSQUATScale
+8019ae80 MTX::PSQUATDotProduct
+8019aea0 MTX::PSQUATNormalize
+8019aef4 MTX::PSQUATInverse
+8019af48 MTX::C_QUATMtx
+8019b114 MTX::C_QUATLerp
+8019b178 MTX::C_QUATSlerp
+8019b314 nandCreate
+8019b43c NAND::Create
+8019b4b0 NAND::Private::Create
+8019b524 NAND::Private::CreateAsync
+8019b59c NAND::Delete
+8019b64c NAND::Private::Delete
+8019b6e4 NAND::Private::DeleteAsync
+8019b7a4 NAND::Read
+8019b80c NAND::ReadAsync
+8019b884 NAND::Write
+8019b8ec NAND::WriteAsync
+8019b964 NAND::Seek
+8019ba04 NAND::SeekAsync
+8019bab4 nandCreateDir
+8019bbe0 NAND::CreateDir
+8019bc54 NAND::Private::CreateDir
+8019bcc8 NAND::Private::CreateDirAsync
+8019bd40 nandMove
+8019bee8 NAND::Move
+8019bf4c NAND::GetLength
+8019bfd4 nandGetFileStatusAsyncCallback
+8019c048 NAND::GetLengthAsync
+8019c0d8 nandComposePerm
+8019c12c nandSplitPerm
+8019c1b8 nandGetStatus
+8019c30c nandGetStatusCallback
+8019c380 NAND::GetStatus
+8019c3e4 NAND::Private::GetStatus
+8019c448 NAND::Private::GetStatusAsync
+8019c4cc nandSetStatus
+8019c614 NAND::SetStatus
+8019c678 NAND::Private::SetStatus
+8019c6dc NAND::SetUserData
+8019c6e4 NAND::GetUserData
+8019c6ec nandOpen
+8019c800 NAND::Open
+8019c88c NAND::Private::Open
+8019c918 NAND::OpenAsync
+8019c990 NAND::Private::OpenAsync
+8019ca08 nandOpenCallback
+8019ca80 NAND::Close
+8019caec NAND::CloseAsync
+8019cb74 NAND::SafeOpen
+8019cb80 0x8019cb80
+8019cf28 NAND::SafeClose
+8019cf30 0x8019cf30
+8019d104 NAND::Private::SafeOpenAsync
+8019d130 NAND::SafeOpenAsync
+8019d298 nandSafeOpenCallback
+8019d454 0x8019d454
+8019d688 nandReadOpenCallback
+8019d720 NAND::SafeCloseAsync
+8019d728 0x8019d728
+8019d824 nandSafeCloseCallback
+8019d9e8 nandReadCloseCallback
+8019da44 nandCloseCallback
+8019daa0 nandRemoveTailToken
+8019db74 nandGetHeadToken
+8019dc48 nandGetRelativeName
+8019dce0 nandConvertPath
+8019de1c nandIsPrivatePath
+8019de50 nandIsUnderPrivatePath
+8019dea8 nandIsInitialized
+8019debc nandReportErrorCode
+8019dec0 nandConvertErrorCode
+8019e020 nandGenerateAbsPath
+8019e0e8 nandGetParentDirectory
+8019e18c NAND::Init
+8019e2b8 nandOnShutdown
+8019e384 nandShutdownCallback
+8019e390 NAND::GetCurrentDir
+8019e40c NAND::GetHomeDir
+8019e460 nandCallback
+8019e49c nandGetType
+8019e770 NAND::GetType
+8019e7b4 NAND::Private::GetTypeAsync
+8019e7fc nandGetTypeCallback
+8019e874 nandGetHomeDir
+8019e880 NAND::InitBanner
+8019e95c NAND::SecretGetUsage
+8019ea14 nandCalcUsage
+8019ead0 NAND::Check
+8019ebd8 reserveFileDescriptor
+8019ec2c NAND::LoggingAddMessageAsync
+8019ed24 asyncRoutine
+8019f1a8 OS::__FPRInit
+8019f2d0 OS::__GetIOS::Rev
+8019f33c OS::GetConsoleType
+8019f5c0 ClearArena
+8019f79c ClearMEM2Arena
+8019f980 InquiryCallback
+8019f9bc ReportOS::Info
+8019fae0 ReportOS::Info_switch
+8019fae4 ReportOS::Info_caseD_10000021
+8019faf4 ReportOS::Info_caseD_10000020
+8019fb04 ReportOS::Info_caseD_10000012
+8019fb14 ReportOS::Info_caseD_10000011
+8019fb24 ReportOS::Info_caseD_10000010
+8019fb34 ReportOS::Info_caseD_10000008
+8019fb44 ReportOS::Info_caseD_10000009
+8019fc68 OS::Init
+801a0000 0x801a0000
+801a00e0 OS::ExceptionInit
+801a0138 0x801a0138
+801a0360 OS::__DBIntegrator
+801a0384 OS::__DBJump
+801a0388 OS::__SetExceptionHandler
+801a039c OS::__GetExceptionHandler
+801a03ac OS::ExceptionVector
+801a03e4 OS::DefaultExceptionHandler
+801a0404 0x801a0404
+801a0448 0x801a0448
+801a04a0 OS::__PSInit
+801a04f4 OS::__GetDIConfig
+801a0504 OS::RegisterVersion
+801a0514 OS::GetAppGamename
+801a0598 OS::GetAppType
+801a05b8 OS::__InitAlarm
+801a0610 OS::CreateAlarm
+801a0620 InsertAlarm
+801a0870 OS::SetAlarm
+801a08e0 OS::SetPeriodicAlarm
+801a0964 OS::CancelAlarm
+801a0a7c DecrementerExceptionCallback
+801a0ca8 DecrementerExceptionHandler
+801a0cf8 OS::SetAlarmTag
+801a0d00 OnReset
+801a0d8c OS::SetAlarmUserData
+801a0d94 OS::GetAlarmUserData
+801a0d9c DLInsert
+801a0e48 OS::AllocFromHeap
+801a0f40 OS::FreeToHeap
+801a0fb8 OS::SetCurrentHeap
+801a0fc8 OS::InitAlloc
+801a1038 OS::CreateHeap
+801a10a4 OS::GetMEM1ArenaHi
+801a10ac OS::GetMEM2ArenaHi
+801a10b4 OS::GetArenaHi
+801a10bc OS::GetMEM1ArenaLo
+801a10c4 OS::GetMEM2ArenaLo
+801a10cc OS::GetArenaLo
+801a10d4 OS::SetMEM1ArenaHi
+801a10dc OS::SetMEM2ArenaHi
+801a10e4 OS::SetArenaHi
+801a10ec OS::SetMEM1ArenaLo
+801a10f4 OS::SetMEM2ArenaLo
+801a10fc OS::SetArenaLo
+801a1104 OS::AllocFromMEM1ArenaLo
+801a1138 __AIClockInit
+801a1358 OS::__InitAudioSystem
+801a1520 OS::__StopAudioSystem
+801a15ec DCEnable
+801a1600 DCInvalidateRange
+801a162c DCFlushRange
+801a165c DCStoreRange
+801a168c DCFlushRangeNoSync
+801a16b8 DCStoreRangeNoSync
+801a16e4 DCZeroRange
+801a1710 ICInvalidateRange
+801a1744 ICFlashInvalidate
+801a1754 ICEnable
+801a1768 __LCEnable
+801a1834 LCEnable
+801a186c LCDisable
+801a1894 LCLoadBlocks
+801a18b8 LCStoreBlocks
+801a18dc LCStoreData
+801a197c LCQueueLength
+801a1988 LCQueueWait
+801a199c DMAErrorHandler
+801a1ae4 OS::__CacheInit
+801a1c1c OS::__LoadFPUContext
+801a1d40 OS::__SaveFPUContext
+801a1e68 OS::SaveFPUContext
+801a1e70 OS::SetCurrentContext
+801a1ecc OS::GetCurrentContext
+801a1ed8 OS::SaveContext
+801a1f58 OS::LoadContext
+801a2030 OS::GetStackPointer
+801a2038 OS::SwitchFiber
+801a2068 OS::SwitchFiberEx
+801a2098 OS::ClearContext
+801a20bc OS::InitContext
+801a2178 OS::DumpContext
+801a23d8 OS::SwitchFPUContext
+801a245c OS::__ContextInit
+801a24a4 OS::FillFPUContext
+801a25d0 OS::Report
+801a265c OS::VReport
+801a2660 OS::Panic
+801a278c OS::SetErrorHandler
+801a2a14 OS::__UnhandledException
+801a2c20 OS::__UnhandledException_switch
+801a2c24 OS::__UnhandledException_caseD_2
+801a2c3c OS::__UnhandledException_caseD_3
+801a2c50 OS::__UnhandledException_caseD_5
+801a2c68 OS::__UnhandledException_caseD_6
+801a2c80 OS::__UnhandledException_caseD_f
+801a2ccc OS::__UnhandledException_caseD_0
+801a2d04 PackArgs
+801a2e84 Utf16ToArg
+801a2fdc PackInstallerArgs
+801a31a8 Run
+801a31e4 Callback
+801a31f0 OS::__GetExecParams
+801a3214 callback
+801a321c OS::__LaunchNextFirmware
+801a3888 OS::__LaunchMenu
+801a394c OS::__LaunchDisk
+801a3cec OS::LaunchDiskl
+801a3e00 OS::__BootDolSimple
+801a4648 OS::__BootDol
+801a4828 OS::LaunchInstaller
+801a4aa4 ScreenReport
+801a4dc8 ConfigureVideo
+801a4ec4 OS::Fatal
+801a50dc Halt
+801a56dc GetFontCode
+801a5810 Decode
+801a59b4 OS::SetFontEncode
+801a5a34 ReadFont
+801a5d34 OS::LoadFont
+801a5e5c ParseStringS
+801a5f58 ParseStringW
+801a6114 OS::GetFontTexel
+801a63a4 OS::GetFontTexture
+801a64f4 OS::GetFontWidth
+801a65ac OS::DisableInterrupts
+801a65c0 OS::EnableInterrupts
+801a65d4 OS::RestoreInterrupts
+801a65f8 OS::__SetInterruptHandler
+801a660c OS::__GetInterruptHandler
+801a661c OS::__InterruptInit
+801a66e0 SetInterruptMask
+801a693c OS::__MaskInterrupts
+801a69bc OS::__UnmaskInterrupts
+801a6a3c OS::__DispatchInterrupt
+801a6ce0 ExternalInterruptHandler
+801a6d30 OS::NotifyLink
+801a6d34 OS::NotifyPreLink
+801a6d38 OS::NotifyPostLink
+801a6d3c Relocate
+801a6ffc Link
+801a72dc OS::Link
+801a72e4 OS::__ModuleInit
+801a72fc OS::InitMessageQueue
+801a735c OS::SendMessage
+801a7424 OS::ReceiveMessage
+801a7500 OS::JamMessage
+801a75d0 OS::GetPhysicalMem1Size
+801a75dc OS::GetPhysicalMem2Size
+801a75e8 OS::GetConsoleSimulatedMem1Size
+801a75f4 OS::GetConsoleSimulatedMem2Size
+801a7600 OnShutdown
+801a763c OS::__UnhandledException
+801a7684 OS::ProtectRange
+801a774c ConfigMEM2_unk
+801a77cc 0x801a77cc
+801a784c 0x801a784c
+801a792c 0x801a792c
+801a7a0c 0x801a7a0c
+801a7ab8 0x801a7ab8
+801a7b98 0x801a7b98
+801a7c44 0x801a7c44
+801a7c94 RealMode
+801a7cac BATConfig
+801a7dfc OS::__InitMemoryProtection
+801a7eac OS::InitMutex
+801a7ee4 OS::LockMutex
+801a7fc0 OS::UnlockMutex
+801a8088 OS::__UnlockAllMutex
+801a80f4 OS::TryLockMutex
+801a81b0 OS::InitCond
+801a81b4 OS::SignalCond
+801a81b8 OS::__Reboot
+801a8224 OS::GetSaveRegion
+801a8238 OS::RegisterShutdownFunction
+801a82c0 OS::__CallShutdownFunctions
+801a8370 OS::__ShutdownDevices
+801a8500 OS::__GetDiscState
+801a856c OS::ShutdownSystem
+801a8688 OS::Restart
+801a8758 OS::__ReturnToMenu
+801a8858 OS::ReturnToMenu
+801a8898 OS::ReturnToSetting
+801a88cc OS::ReturnToSetting_switch
+801a88d0 OS::ReturnToSetting_caseD_1
+801a88d8 OS::ReturnToSetting_caseD_2
+801a88e0 OS::ReturnToSetting_caseD_3
+801a88e8 OS::ReturnToSetting_caseD_4
+801a88f0 OS::ReturnToSetting_caseD_5
+801a88f8 OS::ReturnToSetting_caseD_6
+801a8900 OS::ReturnToSetting_caseD_7
+801a8908 OS::ReturnToSetting_caseD_0
+801a8954 OS::__ReturnToMenuForError
+801a89f8 OS::__HotResetForError
+801a8a50 OS::GetResetCode
+801a8a80 OS::ResetSystem
+801a8a9c WriteSramCallback
+801a8bd4 OS::__InitSram
+801a8dd4 UnlockSram
+801a90b4 OS::__SyncSram
+801a90c4 OS::__ReadROM
+801a91e8 OS::GetWirelessID
+801a9260 OS::SetWirelessID
+801a92fc OS::__GetRTCFlags
+801a9418 OS::__ClearRTCFlags
+801a9528 SystemCallVector
+801a9548 OS::__InitSystemCall
+801a95a8 DefaultSwitchThreadCallback
+801a95ac OS::SetSwitchThreadCallback
+801a961c OS::__ThreadInit
+801a98a0 OS::InitThreadQueue
+801a98b0 OS::GetCurrentThread
+801a98bc OS::IsThreadTerminated
+801a98e8 OS::DisableScheduler
+801a9924 OS::EnableScheduler
+801a9960 UnsetRun
+801a99c8 OS::__GetEffectivePriority
+801a9a04 SetEffectivePriority
+801a9bb8 OS::__PromoteThread
+801a9c08 SelectThread
+801a9e30 _OS::Reschedule
+801a9e48 OS::YieldThread
+801a9e84 OS::CreateThread
+801aa0f0 RVL::OS::ExitThread
+801aa1d4 OS::CancelThread
+801aa3ac OS::JoinThread
+801aa4ec OS::DetachThread
+801aa58c OS::ResumeThread
+801aa824 OS::SuspendThread
+801aa9b8 OS::SleepThread
+801aaaa4 OS::WakeupThread
+801aab98 OS::SetThreadPriority
+801aac84 SleepAlarmHandler
+801aaca8 OS::SleepTicks
+801aad5c OS::GetTime
+801aad74 OS::GetTick
+801aad7c OS::__GetSystemTime
+801aade0 OS::__TimeToSystemTime
+801aae38 GetDates
+801aafa8 OS::TicksToCalendarTime
+801ab170 OS::CalendarTimeToTicks
+801ab410 OS::UTF8to32
+801ab520 OS::UTF16to32
+801ab590 OS::UTF32toANSI
+801ab608 OS::UTF32toSJIS
+801ab648 OS::__GetIPCBufferHi
+801ab650 OS::__GetIPCBufferLo
+801ab658 OS::__InitIPCBuffer
+801ab670 OS::SetResetCallback
+801ab75c OS::SetPowerCallback
+801ab848 OS::__InitSTM
+801ab960 OS::__ShutdownToSBY
+801ab9d8 OS::__HotReset
+801aba48 OS::__SetVIAutoDimming
+801abb40 OS::__SetIdleLEDMode
+801abb80 OS::__UnRegisterStateEvent
+801abbf8 OS::__VIDimReplyHandler
+801abc08 OS::__DefaultResetCallback
+801abc0c OS::__DefaultPowerCallback
+801abc10 OS::__StateEventHandler
+801abd64 PlayRecordAlarmCallback
+801abd70 PlayRecordCallback
+801abddc PlayRecordCallback_switch
+801abde0 PlayRecordCallback_caseD_0
+801abdec PlayRecordCallback_caseD_1
+801abe68 PlayRecordCallback_caseD_2
+801abeac PlayRecordCallback_caseD_3
+801abed4 PlayRecordCallback_caseD_4
+801abee0 PlayRecordCallback_caseD_5
+801abf68 PlayRecordCallback_caseD_6
+801ac220 OS::__StartPlayRecord
+801ac274 OS::__StopPlayRecord
+801ac45c OS::__WriteStateFlags
+801ac540 OS::__ReadStateFlags
+801ac668 OS::__InitNet
+801ac71c OS::__CreateNandbootInfo
+801ac7cc OS::__WriteNandbootInfo
+801ac924 OS::GetLaunchCode
+801ac930 OS::GetReturnCode
+801ac93c OS::PlayTimeIsLimited
+801ac954 OS::__PlayTimeRebootCallback
+801ac9dc OS::__PlayTimeFadeLastAIDCallback
+801acb98 OS::__WriteExpiredFlag
+801accac OS::__PlayTimeRebootThread
+801acd98 OS::__PlayTimeAlarmExpired
+801aceb4 OS::__GetPlayTime
+801ad07c OS::__InitPlayTime
+801ad1d4 OS::CheckInstall
+801ad2a8 PackArgs
+801ad428 OS::__CheckCompanyCode
+801ad43c 0x801ad43c
+801ad53c OS::__CheckTmdSysVersion
+801ad610 OS::__GetValidTicketIndex
+801ad800 OS::__RelaunchTitle
+801ada00 OS::__LaunchTitle
+801adb1c LaunchCommon
+801adf60 OS::LaunchTitle
+801ae06c OS::__ReturnToMenul
+801ae174 OS::GetTitleStatus
+801ae4a0 OS::IsTitleInstalled
+801ae524 __init_user
+801ae544 __init_cpp
+801ae58c exit
+801ae5d8 ClampStick
+801ae6f4 PAD::ClampCircle
+801ae7dc PAD::Clamp
+801ae880 UpdateOrigin
+801aea24 PADOriginCallback
+801aeae4 PADOriginUpdateCallback
+801aebac PADProbeCallback
+801aec80 PADTypeAndStatusCallback
+801aefa0 PADReceiveCheckCallback
+801af0dc PAD::Reset
+801af1e4 PAD::Recalibrate
+801af2f0 PAD::Init
+801af44c PAD::Read
+801af908 PAD::ControlMotor
+801af9c0 SPEC0_MakeStatus
+801afad8 SPEC1_MakeStatus
+801afbf0 SPEC2_MakeStatus
+801afffc OnShutdown
+801b00c4 SamplingHandler
+801b0124 __PADDisableRecalibration
+801b0180 SCInit
+801b0220 SCCheckStatus
+801b033c SCReloadConfFileAsync
+801b0450 OpenCallbackFromReload
+801b0520 ReadCallbackFromReload
+801b0608 CloseCallbackFromReload
+801b0694 FinishFromReload
+801b07d0 0x801b07d0
+801b07d4 ParseConfBuf
+801b0a20 UnpackItem
+801b0bb8 DeleteItemByID
+801b0d48 CreateItemByID
+801b0fc0 SCFindByteArrayItem
+801b10a0 0x801b10a0
+801b11c4 SCReplaceByteArrayItem
+801b12dc SCFindU8Item
+801b13b0 SCFindS8Item
+801b1484 SCFindU32Item
+801b1558 SCFindBoolItem
+801b1658 0x801b1658
+801b1684 0x801b1684
+801b1690 SCFlushAsync
+801b18ac MyNandCallback
+801b18e8 MyNandCallback_switch
+801b18ec MyNandCallback_caseD_0
+801b1930 MyNandCallback_caseD_1
+801b1970 MyNandCallback_caseD_2
+801b19a0 MyNandCallback_caseD_3
+801b19e8 MyNandCallback_caseD_4
+801b1a1c MyNandCallback_caseD_5
+801b1a50 MyNandCallback_caseD_6
+801b1a94 MyNandCallback_caseD_7
+801b1ad0 MyNandCallback_caseD_8
+801b1ad8 MyNandCallback_caseD_9
+801b1be4 SCGetAspectRatio
+801b1c38 SCGetDisplayOffsetH
+801b1c60 0x801b1c60
+801b1cac SCGetEuRgb60Mode
+801b1d00 SCGetIdleMode
+801b1d0c SCGetLanguage
+801b1d78 SCGetParentalControl
+801b1d84 SCGetProgressiveMode
+801b1dd8 SCGetScreenSaverMode
+801b1e2c SCGetSoundMode
+801b1e90 SCGetCounterBias
+801b1ed0 0x801b1ed0
+801b1edc 0x801b1edc
+801b1ee8 0x801b1ee8
+801b1ef4 SCSetBtCmpDevInfoArray
+801b1f00 SCGetBtDpdSensibility
+801b1f68 SCGetWpadMotorMode
+801b1fbc SCSetWpadMotorMode
+801b1fc4 SCGetWpadSensorBarPosition
+801b2018 SCGetWpadSpeakerVolume
+801b206c SCSetWpadSpeakerVolume
+801b2074 SCGetSimpleAddressData
+801b2130 SCGetNetContentRestrictions
+801b216c SCGetEULA
+801b21a8 SCGetWCFlags
+801b21e4 SCGetFreeChannelAppCount
+801b21f4 0x801b21f4
+801b2234 __SCF1
+801b23a0 SCGetProductArea
+801b2424 SCGetProductCode
+801b2460 SCGetProductSN
+801b24c8 SCGetProductGameRegion
+801b254c SIBusy
+801b2568 SIIsChanBusy
+801b25a0 CompleteTransfer
+801b2894 SIInterruptHandler
+801b2c80 SIEnablePollingInterrupt
+801b2cf8 SIUnregisterPollingHandler
+801b2de0 SIInit
+801b2ea0 __SITransfer
+801b3050 SIGetStatus
+801b30c8 SISetCommand
+801b30dc SITransferCommands
+801b30ec SISetXY
+801b3148 SIEnablePolling
+801b31d0 SIDisablePolling
+801b323c SIGetResponse
+801b3360 AlarmHandler
+801b33ec SITransfer
+801b3558 GetTypeCallback
+801b3808 SIGetType
+801b39bc SIGetTypeAsync
+801b3acc SISetSamplingRate
+801b3ba4 SIRefreshSamplingRate
+801b3bac THPVideoDecode
+801b3e6c __THPReadFrameHeader
+801b3fa0 __THPReadScaneHeader
+801b40b4 __THPReadQuantizationTable
+801b444c __THPReadHuffmanTableSpecification
+801b4810 __THPPrepBitStream
+801b4a58 __THPDecompressYUV
+801b4b5c __THPDecompressiMCURow512x448
+801b4da8 __THPInverseDCTNoYPos
+801b5234 __THPInverseDCTY8
+801b56c8 __THPDecompressiMCURow640x480
+801b5918 __THPDecompressiMCURowNxN
+801b5b74 __THPHuffDecodeDCTCompY
+801b61d0 __THPHuffDecodeDCTCompU
+801b6858 __THPHuffDecodeDCTCompV
+801b6ee0 THPInit
+801b6f7c 0x801b6f7c
+801b7410 TPLBind
+801b7524 TPLGet
+801b7544 TPLGetGXTexObjFromPalette
+801b7624 USB_LOG
+801b76cc USB_ERR
+801b7778 IUSB_OpenLib
+801b7870 0x801b7870
+801b7878 _intrBlkCtrlIsoCb
+801b7a20 IUSB_OpenDeviceIds
+801b7b64 IUSB_CloseDevice
+801b7c88 __IntrBlkMsgInt
+801b7fc4 usb_
+801b8038 usb_801B8038
+801b80ac 0x801b80ac
+801b8120 __CtrlMsgInt
+801b86c4 IUSB_WriteCtrlMsgAsync
+801b8750 OnShutdown
+801b88e4 __VIRetraceHandler
+801b8c28 __VIRetraceHandler_switch
+801b8c2c __VIRetraceHandler_caseD_0
+801b8c34 __VIRetraceHandler_caseD_1
+801b8c3c __VIRetraceHandler_caseD_2
+801b90f4 VISetPreRetraceCallback
+801b9138 VISetPostRetraceCallback
+801b917c getTiming
+801b9198 getTiming_switch
+801b919c getTiming_caseD_0
+801b91a8 getTiming_caseD_1
+801b91b8 getTiming_caseD_4
+801b91c8 getTiming_caseD_5
+801b91d8 getTiming_caseD_14
+801b91e4 getTiming_caseD_15
+801b91f4 getTiming_caseD_8
+801b9204 getTiming_caseD_9
+801b9214 getTiming_caseD_16
+801b9224 getTiming_caseD_3
+801b9234 getTiming_caseD_10
+801b9244 getTiming_caseD_11
+801b9254 getTiming_caseD_18
+801b9264 getTiming_caseD_1a
+801b9274 getTiming_caseD_6
+801b9284 getTiming_caseD_1c
+801b928c getTiming_caseD_12
+801b9294 __VIInit
+801b94a4 VIInit
+801b9930 VIInit_switch
+801b9934 VIInit_caseD_0
+801b993c VIInit_caseD_1
+801b9944 VIInit_caseD_2
+801b99ec VIWaitForRetrace
+801b9a40 setFbbRegs
+801b9cf8 setHorizontalRegs
+801b9dd8 setVerticalRegs
+801b9f6c VIConfigure
+801ba650 VIConfigurePan
+801ba9a4 VIFlush
+801baab8 VISetNextFrameBuffer
+801bab24 VIGetNextFrameBuffer
+801bab2c VISetBlack
+801baba4 VIGetRetraceCount
+801babac VIGetNextField
+801bac48 VIGetCurrentLine
+801bacd8 VIGetTvFormat
+801bad0c VIGetTvFormat_switch
+801bad10 VIGetTvFormat_caseD_0
+801bad18 VIGetTvFormat_caseD_1
+801bad1c VIGetTvFormat_caseD_2
+801bad38 VIGetDTVStatus
+801bad74 __VIDisplayPositionToXY
+801bafa8 VISetTimeToDimming
+801bafe8 VISetTimeToDimming_switch
+801bafec VISetTimeToDimming_caseD_0
+801baff4 VISetTimeToDimming_caseD_1
+801baff8 VISetTimeToDimming_caseD_2
+801bb0ac VIResetDimmingCount
+801bb0c0 __VIResetRFIdle
+801bb0d0 __VIResetSIIdle
+801bb0e0 WaitMicroTime
+801bb178 sendSlaveAddr
+801bb52c __VISendI2CData
+801bbafc __VISetYUVSEL
+801bbba0 __VISetFilter4EURGB60
+801bbbe0 __VISetCGMS
+801bbc38 __VISetWSS
+801bbc9c __VISetClosedCaption
+801bbd08 __VISetMacrovision
+801bca90 __VISetGammaImm
+801bcc20 0x801bcc20
+801bcc24 __VISetGamma
+801bcc3c __VISetTrapFilter
+801bcc98 VISetTrapFilter
+801bccb8 __VISetRGBOverDrive
+801bcd3c VISetRGBModeImm
+801bcd4c __VISetRGBModeImm
+801bcd94 __VISetRevolutionModeSimple
+801bd1c0 0x801bd1c0
+801bd498 noAlloc
+801bd4c8 noFree
+801bd4f8 OnShutdown
+801bd844 WPADiSendData
+801bda20 WPADiRadioSensitivity
+801bdb24 IsControllerDataChanged
+801be6d0 CheckButtonCombination
+801be7dc WPADiCheckContInputs
+801be960 WPADiManageHandler
+801bf114 WPADiManageHandler0
+801bf134 __ClearControlBlock
+801bf3b4 WPADiInitSub
+801bf5c4 WPAD::Init
+801bf634 WPAD::StartSyncSimple
+801bf638 WPAD::StartFastSyncSimple
+801bf63c WPAD::StopSyncSimple
+801bf640 WPAD::SetSyncSimpleCallback
+801bf644 WPAD::RegisterAllocator
+801bf648 WPAD::GetWorkMemorySize
+801bf64c WPAD::GetStatus
+801bf650 WPAD::GetRadioSensitivity
+801bf694 WPAD::GetAddress
+801bf714 WPAD::GetSensorBarPosition
+801bf748 setupCallback
+801bf81c abortConnCallback
+801bf900 firmwareCheckCallback
+801c01e8 WPADiRetrieveChannel
+801c02e8 WPADiConnCallback
+801c0764 WPADiRecvCallback
+801c07d0 WPAD::GetAccGravityUnit
+801c08a8 CloseCallback
+801c08cc WPAD::Disconnect
+801c0990 WPAD::Probe
+801c0a1c WPAD::SetSamplingCallback
+801c0a84 WPAD::SetConnectCallback
+801c0aec WPAD::SetExtensionCallback
+801c0b54 WPAD::GetDataFormat
+801c0b9c WPAD::SetDataFormat
+801c0c50 __infoCallback
+801c0ca4 WPAD::GetInfoAsync
+801c0ec4 WPAD::ControlMotor
+801c0f90 WPAD::EnableMotor
+801c0fc4 WPAD::IsMotorEnabled
+801c0ff8 WPADControlLed
+801c11e0 WPAD::SaveConfig
+801c128c WPAD::Read
+801c142c WPAD::SetAutoSamplingBuf
+801c15a8 WPADiExcludeButton
+801c166c WPADiCopyOut
+801c17ec WPAD::IsSpeakerEnabled
+801c1830 WPAD::ControlSpeaker
+801c2e4c WPAD::GetSpeakerVolume
+801c2e80 WPAD::SetSpeakerVolume
+801c2ed0 IsBusyStream
+801c3008 WPAD::CanSendStreamData
+801c308c WPAD::SendStreamData
+801c329c WPAD::GetDpdSensitivity
+801c32a4 WPAD::IsDpdEnabled
+801c32e8 __dpdCb
+801c3318 WPAD::ControlDpd
+801c4394 __SendData
+801c45c8 WPADiSendSetReportType
+801c462c WPADiSendSetReportType_switch
+801c4630 WPADiSendSetReportType_caseD_0
+801c463c WPADiSendSetReportType_caseD_1
+801c4648 WPADiSendSetReportType_caseD_2
+801c4654 WPADiSendSetReportType_caseD_3
+801c4660 WPADiSendSetReportType_caseD_4
+801c466c WPADiSendSetReportType_caseD_5
+801c4678 WPADiSendSetReportType_caseD_6
+801c4684 WPADiSendSetReportType_caseD_7
+801c4690 WPADiSendSetReportType_caseD_8
+801c469c WPADiSendSetReportType_caseD_9
+801c47e8 WPADiSendWriteDataCmd
+801c499c WPADiSendWriteData
+801c4b54 WPADiSendReadData
+801c4d00 WPADiClearQueue
+801c4d60 abortInitExtension
+801c4ebc getDevConfig
+801c59a4 getExtConfig
+801c5ec4 getExtType
+801c6224 getGameInfo
+801c63b4 WPADiHIDParser
+801c6464 __a1_20_status_report
+801c6890 __a1_21_user_data
+801c6c98 __a1_22_ack
+801c6edc __parse_dpd_data
+801c7344 __a1_30_data_type
+801c74fc __a1_31_data_type
+801c773c __a1_32_data_type
+801c7f18 __a1_33_data_type
+801c818c __a1_34_data_type
+801c8398 __a1_35_data_type
+801c8c18 __a1_36_data_type
+801c8e50 __a1_37_data_type
+801c96dc __a1_3d_data_type
+801c96e0 __a1_3e_data_type
+801c9cc4 __a1_3f_data_type
+801ca2b8 __a1_unused_report
+801ca2bc WPADiCreateKey
+801ca9ac WPADiCreateKeyFor3rd
+801cb0a4 WPADiDecode
+801cb364 0x801cb364
+801cb4c0 0x801cb4c0
+801cb674 0x801cb674
+801cb7a4 0x801cb7a4
+801cb7d8 0x801cb7d8
+801cb8bc 0x801cb8bc
+801cb988 DEBUGPrint
+801cb9d8 APP_MEMalloc
+801cba28 App_MEMfree
+801cba78 SyncFlushCallback
+801cbaf0 DeleteFlushCallback
+801cbb48 ShutFlushCallback
+801cbb94 InitFlushCallback
+801cbbe0 WUDiIsSyncDisabled
+801cbd40 WUDiSaveDeviceToNand
+801cbe4c WUDiSyncDone
+801cbfbc SyncHandler
+801cc8fc SyncHandler0
+801cc91c WUDiTerminateDevice
+801cc9b4 WUDiDeleteDevice
+801cca68 DeleteAllHandler
+801ccab4 DeleteAllHandler_switch
+801ccab8 DeleteAllHandler_caseD_1
+801ccad0 DeleteAllHandler_caseD_2
+801ccadc DeleteAllHandler_caseD_3
+801ccae8 DeleteAllHandler_caseD_5
+801ccb54 DeleteAllHandler_caseD_8
+801ccba8 DeleteAllHandler_caseD_0
+801ccbc4 DeleteAllHandler0
+801ccbe4 WUDiClearUnregisteredDevice
+801cccf8 EnableStackHandler
+801ccecc EnableStackHandler0
+801cceec WUDiGetRegisteredDevice
+801cd2a8 InitHandler
+801cd38c InitHandler0
+801cd3ac ShutdownHandler
+801cd470 ShutdownHandler0
+801cd490 InitCore
+801cd81c WUDInit
+801cd914 WUDRegisterAllocator
+801cd964 WUDShutdown
+801cdb84 WUDGetStatus
+801cdbc0 WUDGetBufferStatus
+801cdc08 WUDSetSniffMode
+801cdc74 WUDSetSyncSimpleCallback
+801cdcd0 StartSyncDevice
+801cde1c WUDStartFastSyncSimple
+801cde5c WUDStartSyncSimple
+801cde9c WUDCancelSyncDevice
+801cdf3c WUDStopSyncSimple
+801cdfd4 WUDSetDisableChannel
+801ce0c0 WUDSetHidRecvCallback
+801ce11c WUDSetHidConnCallback
+801ce178 WUDSetVisibility
+801ce1d0 reset_again_cb
+801ce1d4 remove_patch_cb
+801ce34c write_patch_cb
+801ce57c install_patch_cb
+801ce650 WUDiInitSub
+801ce7e0 WUDiRegisterDevice
+801ce910 WUDiRemoveDevice
+801cea6c WUDiGetDevInfo
+801ceb44 WUDiGetNewDevInfo
+801cec04 WUDiMoveTopSmpDevInfoPtr
+801ced1c WUDiMoveBottomSmpDevInfoPtr
+801cee34 WUDiMoveTopOfDisconnectedSmpDevice
+801cef8c WUDiMoveTopStdDevInfoPtr
+801cf0a4 WUDiMoveBottomStdDevInfoPtr
+801cf1bc WUDiMoveTopOfDisconnectedStdDevice
+801cf314 WUDIsBusy
+801cf388 CleanupCallback
+801cf3bc WUDSecurityCallback
+801cf414 WUDSecurityCallback_switch
+801cf418 WUDSecurityCallback_caseD_0
+801cf4c4 WUDSecurityCallback_caseD_1
+801cf4e0 WUDSecurityCallback_caseD_2
+801cf580 WUDSecurityCallback_caseD_3
+801cf68c WUDSecurityCallback_caseD_4
+801cf69c WUDSecurityCallback_caseD_5
+801cf788 WUDSecurityCallback_caseD_6
+801cf8dc WUDSecurityCallback_caseD_7
+801cf8ec WUDSecurityCallback_caseD_8
+801cf910 WUDSearchCallback
+801cfb1c WUDVendorSpecificCallback
+801cfe10 WUDDeviceStatusCallback
+801cfe60 WUDStoredLinkKeyCallback
+801d014c WUDPowerManagerCallback
+801d0288 _WUDGetDevAddr
+801d02dc _WUDGetQueuedSize
+801d0338 _WUDGetNotAckedSize
+801d0394 _WUDGetLinkNumber
+801d03d0 WUDHidHostCallback
+801d0418 WUDHidHostCallback_switch
+801d041c WUDHidHostCallback_caseD_0
+801d0438 WUDHidHostCallback_caseD_1
+801d0448 WUDHidHostCallback_caseD_2
+801d0698 WUDHidHostCallback_caseD_3
+801d076c WUDHidHostCallback_caseD_5
+801d077c WUDHidHostCallback_caseD_4
+801d078c WUDHidHostCallback_caseD_7
+801d079c WUDHidHostCallback_caseD_6
+801d07ac WUDHidHostCallback_caseD_9
+801d07bc WUDHidHostCallback_caseD_8
+801d07cc WUDHidHostCallback_caseD_a
+801d07dc WUDHidHostCallback_caseD_b
+801d0870 WUDHidHostCallback_caseD_c
+801d08b0 WUDHidHostCallback_caseD_d
+801d08c0 WUDHidHostCallback_caseD_f
+801d094c WUDHidHostCallback_caseD_e
+801d0968 bta_hh_co_data
+801d09a4 bta_hh_co_open
+801d09b4 bta_hh_co_close
+801d09c4 bta_dm_co_get_compress_memory
+801d09cc DEBUGPrint
+801d0a1c NCDGetCurrentIfConfig
+801d0b14 NCDGetCurrentIpConfig
+801d0c6c NCDGetLinkStatus
+801d0d70 NCDiGetWirelessMacAddress
+801d0e98 NCDiGetEnabledConfigList
+801d0eb0 0x801d0eb0
+801d1014 ExecConfigCommand
+801d11a8 LockRight
+801d1298 NETGetUniversalCalendar
+801d137c NETiGetConnectionTypeFromConfigList
+801d15f4 NETGetStartupErrorCode
+801d1674 GetStartupErrorCode
+801d17ec NETGetRexPPCVersionPrintable
+801d17f4 NETGetWirelessMacAddress
+801d17f8 NETMemCpy
+801d1ba0 NETMemSet
+801d1ca0 OS::CalcCRC32
+801d1dd4 NETMD5Init
+801d1e14 NETMD5Update
+801d1f04 NETMD5GetDigest
+801d202c ProcessBlock
+801d24f4 NETSHA1Init
+801d2544 NETSHA1Update
+801d25f8 NETSHA1GetDigest
+801d2724 0x801d2724
+801d2730 NETSHA1iProcessBlock
+801d2acc NETHMACInit
+801d2d08 NETHMACUpdate
+801d2d18 0x801d2d18
+801d2ebc NHTTPi_InitBgnEndInfo
+801d2eec NHTTPi_alloc
+801d2f48 NHTTPi_free
+801d2f8c NHTTPi_SetError
+801d2f94 NHTTPi_SetSSLError
+801d2f9c NHTTPi_GetSSLError
+801d2fa4 NHTTPi_Startup
+801d3134 NHTTPi_CleanupAsync
+801d3224 addHdrList
+801d3360 NHTTPi_getHdrFromList
+801d33a8 NHTTP_AddHeaderField
+801d33c8 NHTTP_AddPostDataAscii
+801d3554 NHTTPi_InitListInfo
+801d3564 NHTTPi_setReqQueue
+801d3630 NHTTPi_freeReqQueue
+801d374c NHTTPi_allFreeReqQueue
+801d37a0 NHTTPi_getReqFromReqQueue
+801d37a4 NHTTPi_InitMutexInfo
+801d37b0 NHTTPi_initLockReqList
+801d37f0 NHTTPi_exitLockReqList
+801d37f4 NHTTPi_lockReqList
+801d37f8 NHTTPi_unlockReqList
+801d37fc NHTTPi_createCommThread
+801d3890 NHTTPi_destroyCommThread
+801d38d8 NHTTPi_idleCommThread
+801d3900 NHTTPi_kickCommThread
+801d390c NHTTPi_CheckCurrentThread
+801d39a4 NHTTPi_CommThreadProc
+801d39c8 NHTTPi_findNextLineHdrRecvBuf
+801d3bc0 NHTTPi_skipSpaceHdrRecvBuf
+801d3cb8 NHTTPi_compareTokenN_HdrRecvBuf
+801d3ea8 NHTTPi_loadFromHdrRecvBuf
+801d3fec NHTTPi_isRecvBufFull
+801d4008 NHTTPi_RecvBuf
+801d4028 NHTTPi_RecvBufN
+801d4064 NHTTPi_InitRequestInfo
+801d4070 NHTTP_CreateRequest
+801d462c NHTTP_DestroyRequest
+801d4730 NHTTPi_destroyRequestObject
+801d4808 NHTTP_SendRequestAsync
+801d48c8 NHTTP_CancelRequestAsync
+801d498c NHTTPi_cancelAllRequests
+801d4a34 NHTTP_DestroyResponse
+801d4b00 NHTTPi_getHeaderValue
+801d4c34 NHTTPi_checkKeepAlive
+801d4c8c NHTTPi_SocOpen
+801d4d18 NHTTPi_SocClose
+801d4d84 NHTTPi_SocConnect
+801d4e44 NHTTPi_SocSSLConnect
+801d4ff4 NHTTPi_SocRecv_sub
+801d5100 NHTTPi_SocRecv
+801d51dc NHTTPi_SocSend_sub
+801d5374 NHTTPi_SocSend
+801d5420 NHTTPi_SocCancel
+801d5474 NHTTPi_resolveHostname
+801d54e8 NHTTPi_memcpy
+801d54ec NHTTPi_strlen
+801d54f0 NHTTPi_strcmp
+801d54f4 NHTTPi_memclr
+801d5500 NHTTPi_strnicmp
+801d55cc NHTTPi_getUrlEncodedSize
+801d563c NHTTPi_getUrlEncodedSize2
+801d56b0 NHTTPi_encodeUrlChar
+801d5750 NHTTPi_strToHex
+801d5874 NHTTPi_strToInt
+801d5914 NHTTPi_intToStr
+801d5a90 NHTTPi_compareToken
+801d5b44 NHTTPi_strtonum
+801d5bd4 NHTTPi_memfind
+801d5c80 NHTTPi_Base64Encode
+801d5e5c NHTTPi_InitThreadInfo
+801d5e68 NHTTPi_IsCreateCommThreadMessageQueueOn
+801d5e74 NHTTPi_IsCreateCommThreadMessageQueue
+801d5e7c NHTTPi_CheckHeaderEnd
+801d5f44 NHTTPi_SaveBuf
+801d6024 NHTTPi_GetPostContentlength
+801d6128 NHTTPi_SendPostData
+801d62b8 NHTTPi_BufFull
+801d6384 NHTTPi_SendData
+801d6430 NHTTPi_SendProxyConnectMethod
+801d66d8 NHTTPi_RecvProxyConnectHeader
+801d68d0 NHTTPi_SendHeaderList
+801d69c8 NHTTPi_SendProcPostDataRaw
+801d6b50 NHTTPi_SendProcPostDataBinary
+801d6ef4 NHTTPi_SendProcPostDataAscii
+801d71b8 NHTTPi_ThreadReqEnd
+801d7338 NHTTPi_ThreadExecReqQueue
+801d73f0 NHTTPi_ThreadHostAddrProc
+801d7544 NHTTPi_ThreadConnectProc
+801d7700 NHTTPi_ThreadProxyProc
+801d7854 NHTTPi_ThreadSendProc
+801d7cf0 NHTTPi_ThreadRecvHeaderProc
+801d7edc NHTTPi_ThreadParseHeaderProc
+801d820c NHTTPi_ThreadRecvBodyProc
+801d87fc NHTTPi_CommThreadProcMain
+801d8a00 __NHTTPCreateConnection
+801d8b48 NHTTPStartConnection
+801d8bd4 NHTTPGetBodyBuffer
+801d8c70 NHTTPGetUserParam
+801d8ce4 NHTTPGetConnectionError
+801d8d30 NHTTPStartup
+801d8dbc NHTTPCleanupAsync
+801d8df0 NHTTPSSLGetError
+801d8e14 NHTTPi_TemplateConnectionCallback
+801d8ff8 NHTTPCreateRequest
+801d9004 0x801d9004
+801d90d4 NHTTPAddHeaderField
+801d9198 NHTTPAddPostDataAscii
+801d925c NHTTPSendRequestAsync
+801d92b8 NHTTPCancelRequestAsync
+801d92f8 NHTTPDestroyResponse
+801d937c NHTTPGetBodyAll
+801d93e4 NHTTPGetResultCode
+801d9444 NHTTPSetVerifyOption
+801d94a0 NHTTPSetProxy
+801d9610 NHTTPSetProxyDefault
+801d9738 NHTTPSetRootCADefault
+801d9798 NHTTPSetClientCertDefault
+801d9808 NHTTPi_NotifyCompletion
+801d9884 NHTTPi_ControlConnectionList
+801d9994 NHTTPi_CommitConnectionList
+801d99c4 NHTTPi_OmitConnectionList
+801d99f4 NHTTPi_Connection2Request
+801d9a2c NHTTPi_Connection2Response
+801d9a64 NHTTPi_Request2Connection
+801d9a6c NHTTPi_Response2Connection
+801d9a74 NHTTPi_GetConnection
+801d9a7c NHTTPi_GetRequest
+801d9ac0 NHTTPi_GetResponse
+801d9b04 NHTTPi_GetConnectionListLength
+801d9b24 NHTTPi_PostSendCallback
+801d9c0c NHTTPi_BufferFullCallback
+801d9d24 NHTTPi_ReceivedCallback
+801d9e3c NHTTPi_CompleteCallback
+801d9e94 NHTTPi_GetSystemInfoP
+801d9efc NHTTPi_GetBgnEndInfoP
+801d9f00 NHTTPi_GetListInfoP
+801d9f08 NHTTPi_GetReqInfoP
+801d9f10 NHTTPi_GetThreadInfoP
+801d9f18 NHTTPi_GetMutexInfoP
+801d9f20 NHTTPi_SetVirtualContentLength
+801d9f30 NHTTPi_GetVirtualContentLength
+801d9f48 NHTTPi_InitConnectionList
+801d9fa8 Mail_strcpy
+801d9fd8 Mail_strlen
+801d9ffc STD_strnlen
+801da02c NETMemCpy
+801da030 NETMemSet
+801da034 Mail_strncpy
+801da090 Mail_strcat
+801da0e0 Mail_strncat
+801da140 Util_xtoi
+801da19c Mail_tolower
+801da1b4 convNum
+801da71c Mail_sprintf
+801da7a8 0x801da7a8
+801da7e8 0x801da7e8
+801da7ec 0x801da7ec
+801da910 0x801da7a8_switch
+801da914 0x801da7a8_caseD_64
+801da920 0x801da7a8_caseD_6f
+801da92c 0x801da7a8_caseD_75
+801da934 0x801da7a8_caseD_78
+801da944 0x801da7a8_caseD_58
+801da954 0x801da7a8_caseD_63
+801da9a4 0x801da7a8_caseD_73
+801dab8c 0x801da7a8_caseD_59
+801dac68 NWC24FOpen
+801dad5c NWC24iFOpenNand
+801dad98 NWC24iFOpenNand_switch
+801dad9c NWC24iFOpenNand_caseD_1
+801dadcc NWC24iFOpenNand_caseD_2
+801dadd4 NWC24iFOpenNand_caseD_4
+801daddc NWC24iFOpenNand_caseD_0
+801dae94 NWC24iFOpenVF
+801dafbc NWC24FClose
+801db0a4 NWC24iFCloseNand
+801db154 NWC24FSeek
+801db344 NWC24FRead
+801db514 NWC24FWrite
+801db6ec NWC24FGetLength
+801db7a8 NWC24FDeleteVF
+801db828 NWC24MountVF
+801db930 NWC24UnmountVF
+801db9b0 NWC24CheckSizeVF
+801dba44 NWC24CreateVF
+801dbdfc BufferedWrite
+801dbf90 BufferedWriteFlush
+801dc100 BufferedRead
+801dc2ec NWC24::GetMyUserId
+801dc454 NWC24iConfigOpen
+801dc4cc NWC24iConfigReload
+801dc5c0 NWC24iConfigFlush
+801dc740 NWC24GetAccountDomain
+801dc74c NWC24GetMBoxDir
+801dc7bc NWC24GetAppId
+801dc808 NWC24GetGroupId
+801dc8ac NWC24GetIdCreationStage
+801dc8c0 CheckConfig
+801dc9ac 0x801dc9ac
+801dc9bc 0x801dc9bc
+801dc9c8 NWC24Date_Init
+801dc9f8 NWC24iConvIdToStr
+801dcbd4 NWC24iCheckStringLength
+801dcc50 NWC24iStrLCpy
+801dccc4 NWC24iRegister
+801dccfc NWC24::OpenLib
+801dcd1c 0x801dcd1c
+801dcebc 0x801dcd1c_switch
+801dcec0 0x801dcd1c_caseD_ffffffcf
+801dcecc 0x801dcd1c_caseD_ffffffd0
+801dcee8 NWC24::CloseLib
+801dcf54 NWC24IsMsgLibOpened
+801dcf68 NWC24IsMsgLibOpenedByTool
+801dcf7c NWC24IsMsgLibOpenBlocking
+801dcf90 NWC24BlockOpenMsgLib
+801dd030 NWC24iSetNewMsgArrived
+801dd044 0x801dd044
+801dd220 0x801dd220
+801dd228 0x801dd228
+801dd230 0x801dd230
+801dd3d4 AnalyzeErrorCode
+801dd76c ReadSavedErrorCode
+801dd818 NWC24::InitMsgObj
+801dda08 NWC24::SetMsgToId
+801dda6c NWC24::SetMsgToAddr
+801ddb34 NWC24::SetMsgSubject
+801ddba4 NWC24::SetMsgText
+801ddcdc NWC24::SetMsgAttached
+801ddf44 NWC24::SetMsgTag
+801ddf84 NWC24SetMsgFaceData
+801ddfe0 NWC24::SetMsgAltName
+801de064 NWC24::SetMsgMBNoReply
+801de0bc NWC24::SetMsgMBRegDate
+801de190 NWC24::SetMsgMBDelay
+801de24c NWC24SetMsgDWCId
+801de27c NWC24::SetMsgLedPattern
+801de348 NWC24SetMsgExecScript
+801de3a8 NWC24::GetMsgType
+801de420 NWC24::GetMsgNumAttached
+801de43c NWC24::GetMsgAttachedSize
+801de470 NWC24::GetMsgAttachedType
+801de4ec NWC24::GetMsgId
+801de4fc NWC24::GetMsgAppId
+801de50c NWC24::GetMsgTag
+801de51c NWC24::GetMsgFromId
+801de548 NWC24::GetMsgNumTo
+801de574 NWC24GetMsgDWCId
+801de5a0 NWC24::GetMsgDate
+801de5d0 NWC24SetMsgDesignatedTime
+801de66c NWC24GetNumMsgs
+801de6f0 NWC24GetMsgObj
+801de974 NWC24iIsMsgObjReadable
+801dea58 NWC24::DeleteMsg
+801deab8 NWC24CheckMsgBoxSpace
+801deba8 NWC24iOpenMBox
+801ded3c NWC24iMBoxGetCtrlFilePath
+801dee0c 0x801dee0c
+801def4c NWC24iMBoxOpenStoredMsg
+801df024 NWC24iMBoxCloseMsg
+801df0d8 NWC24iMBoxCancelMsg
+801df2dc NWC24iMBoxAddMsgObj
+801df4a8 NWC24iMBoxFlushHeader
+801df5f8 NWC24iMBoxCheck
+801df708 DeleteMsg
+801dfb34 0x801dfb34
+801dfba8 DuplicationCheck
+801dff20 GetCachedMBCHeader
+801e0118 AddMBCEntry
+801e0264 ClearMBCEntry
+801e0350 MountVFMBox
+801e04dc CopyMsgObjToMBCFmt
+801e0688 CopyMsgObjToPrvFmt
+801e08a8 0x801e08a8
+801e09dc 0x801e09dc
+801e09f8 NWC24Base64Decode
+801e0a80 NWC24InitBase64Table
+801e0d60 0x801e0d60
+801e108c QDecode
+801e12d4 0x801e12d4
+801e12dc 0x801e12dc
+801e12e4 NWC24FStreamInit
+801e1384 NWC24FStreamGetc
+801e1470 NWC24FStreamSeek
+801e1490 NWC24FStreamGetPtr
+801e15ac NWC24GetMIMETypeStr
+801e15f4 NWC24iGetMIMETypeSuffix
+801e163c NWC24GetCharsetStr
+801e1684 NWC24ParseCharsetStr
+801e16f0 NWC24GetEncodingStr
+801e1738 NWC24ParseEncodingStr
+801e17a4 NWC24iConvertAddrToUserId
+801e17d4 ExtractWiiAddr
+801e1a6c NWC24iExtractAddrSpec
+801e1be8 NWC24iSearchHeaderF
+801e1d04 StrCmpMultiNCS
+801e1da0 GetFieldLengthF
+801e1e5c NWC24::CommitMsg
+801e1f24 NWC24CommitMsgInternal
+801e2c24 CorrectHeadersForMBDelay
+801e2cf4 CheckMsgObject
+801e2d94 CheckMsgBoxSpace
+801e3110 SynthesizeAddrStr
+801e3220 WriteSMTP_MAILFROM
+801e3308 WriteSMTP_RCPTTO
+801e3420 WriteFromField
+801e3520 WriteToField
+801e3688 WriteDateField
+801e37c0 WriteXWiiAppIdField
+801e38dc WriteXWiiFaceField
+801e39dc WriteXWiiAltNameField
+801e3adc WriteMIMEAttachHeader
+801e3c4c WriteContentTypeField
+801e3d80 WritePlainText
+801e3e40 WriteBase64Data
+801e3fa4 WriteQPData
+801e4094 NWC24ReadMsgField
+801e422c NWC24::ReadMsgAltName
+801e42e4 NWC24::ReadMsgMBNoReply
+801e4374 NWC24::ReadMsgMBRegDate
+801e447c NWC24::ReadMsgMBDelay
+801e4564 NWC24::ReadMsgFromAddr
+801e46d4 NWC24::ReadMsgToAddr
+801e4778 NWC24::ReadMsgToId
+801e4840 ReadMsgToInternal
+801e4980 NWC24::ReadMsgSubject
+801e4ac8 NWC24::ReadMsgText
+801e4b24 ReadMsgTextInternal
+801e4dec NWC24::ReadMsgAttached
+801e4f58 ReadBase64Data
+801e5094 0x801e5094
+801e51c8 NWC24::InitSearchConds
+801e5240 NWC24::SetSearchCondMsgBox
+801e52b0 NWC24::SearchMsgs
+801e5404 NWC24iSearchMain
+801e55a0 NWC24iSearchMatching
+801e5754 NWC24SuspendScheduler
+801e5824 NWC24TrySuspendScheduler
+801e5908 NWC24ResumeScheduler
+801e59f8 NWC24iGetSchedulerStat
+801e5b54 NWC24SetFilterMode
+801e5cf4 NWC24ExecDownloadTask
+801e5e1c NWC24iRequestGenerateUserId
+801e5fd8 NWC24iStartupSocket
+801e5fe8 NWC24iCleanupSocket
+801e5ff8 NWC24iLockSocket
+801e6008 NWC24iUnlockSocket
+801e6018 NWC24iSaveMailNow
+801e6098 NWC24iDownloadNowEx
+801e6238 NWC24iTrySuspendForOpenLib
+801e6318 NWC24iResumeForCloseLib
+801e63e4 ExecSuspendScheduler
+801e63f4 ExecTrySuspendScheduler
+801e6580 ExecResumeScheduler
+801e6590 ExecNoParamCommand
+801e66f0 NWC24iDateToMinutes
+801e6798 NWC24iMinutesToDate
+801e683c NWC24iEpochSecondsToDate
+801e6978 NWC24iEpochSecondsToMinutes
+801e6a0c NWC24iMinutesToOSCalendarTime
+801e6be4 NWC24iDateToOSCalendarTime
+801e6d38 NWC24iIsValidDate
+801e6d68 ConvertDateToDays
+801e6f2c ConvertDaysToDate
+801e70c8 NWC24::ReadFriendInfo
+801e716c NWC24::GetNumFriendInfos
+801e71d8 NWC24GetNumRegFriendInfos
+801e7244 NWC24::IsFriendInfoThere
+801e72d4 NWC24iOpenFriendList
+801e7310 NWC24iReadFriendInfoRaw
+801e7428 GetCachedFLHeader
+801e7508 NWC24AddDWCFriendInfo
+801e7588 NWC24DeleteDWCFriendInfo
+801e75ec NWC24SearchDWCFriendInfo
+801e7708 NWC24AddSecretFriendInfoEx
+801e78bc NWC24SearchFreeSpaceForSecretFriend
+801e796c NWC24SearchOldestSecretFriendInfo
+801e7a2c NWC24iSearchSecretFriendInfoByDWCIdEx
+801e7af8 NWC24iWriteSecretFriendInfo
+801e7d14 NWC24UpdateSecretFriendInfo
+801e7ef4 NWC24DeleteSecretFriendInfo
+801e8060 NWC24iOpenSecretFriendList
+801e809c NWC24iReadSecretFriendInfoRaw
+801e81b0 GetCachedSecretFLHeader
+801e8290 NWC24::CheckUserId
+801e837c NWC24iCheckUserIdCRC
+801e8414 getUnScrambleId
+801e8698 NWC24iGetUniversalTimeMinute
+801e86f0 NWC24iGetUniversalTime
+801e8830 NWC24iGetTimeDifference
+801e89a4 NWC24iSetRtcCounter
+801e8aec NWC24iSynchronizeRtcCounter
+801e8b80 NWC24iOpenResourceManager
+801e8bf8 NWC24iCloseResourceManager
+801e8c2c NWC24iIoctlResourceManager
+801e8c74 NWC24iIoctlResourceManagerAsync
+801e8cd0 NWC24iIsAsyncRequestPending
+801e8cd8 CallbackAsyncIpc
+801e8cf4 NWC24CheckDlTask
+801e8e1c NWC24InitDlTask
+801e8fb8 NWC24SetDlId
+801e902c NWC24GetDlId
+801e90cc NWC24SetDlInterval
+801e9214 NWC24GetDlInterval
+801e9264 NWC24SetDlServerInterval
+801e9300 NWC24GetDlServerInterval
+801e93fc NWC24SetDlRetryMargin
+801e94b0 NWC24GetDlRetryMargin
+801e9558 NWC24SetDlUrl
+801e95f4 NWC24GetDlLastUpdate
+801e9664 NWC24SetDlFlags
+801e96b4 NWC24GetDlTaskMine
+801e9848 NWC24GetDlTaskMineEx
+801e99e0 NWC24IterateDlTask
+801e9b1c NWC24IterateDlTaskEx
+801e9d60 NWC24UpdateDlTask
+801e9f48 NWC24DeleteDlTask
+801ea044 NWC24AddDlTask
+801ea18c NWC24PurgeOldestDlTask
+801ea468 NWC24GetDlVfPath
+801ea4e4 NWC24CreateDlVf
+801ea604 NWC24SetDlPublicKey
+801ea76c NWC24DeleteDlTasksForOptOut
+801eaa0c NWC24OpenDlTaskList
+801eaa68 0x801eaa68
+801eaa70 NWC24iCheckDlHeaderConsistency
+801eae04 NWC24iLoadDlHeader
+801eaf94 NWC24SetDlOptOutFlags
+801eaffc NWC24GetDlOptOutFlags
+801eb078 NWC24::StoreDlTask
+801eb210 NWC24::AddTaskInternal
+801eb644 NWC24::DeleteDlTask
+801eb808 NWC24::SeekAndWriteFile
+801eb900 NWC24::SearchDlTaskId
+801ebb30 0x801ebb30
+801ebb58 0x801ebb58
+801ebb80 0x801ebb80
+801ebba8 NWC24::InitCHJumpObj
+801ebc1c NWC24::SetCHJumpTitleId
+801ebc2c NWC24::SetCHJumpBlockData
+801ebc8c NWC24GetScriptVfPath
+801ebd30 NWC24iPrepareShutdown
+801ebdf0 NWC24Shutdown
+801ebec0 SOInit
+801ec088 SOFinish
+801ec184 SOStartup
+801ec190 0x801ec190
+801ec214 0x801ec214
+801ec448 SOStartup_switch
+801ec44c SOStartup_caseD_0
+801ec454 SOStartup_caseD_ffffffea
+801ec45c SOStartup_caseD_ffffffdf
+801ec464 SOStartup_caseD_ffffffff
+801ec46c SOStartup_caseD_ffffffe3
+801ec470 SOStartup_caseD_ffffffe0
+801ec5b8 SOCleanup
+801ec680 SOCleanup_switch
+801ec684 SOCleanup_caseD_0
+801ec68c SOCleanup_caseD_ffffffea
+801ec694 SOCleanup_caseD_ffffffdf
+801ec69c SOCleanup_caseD_ffffffff
+801ec6a4 SOCleanup_caseD_ffffffe3
+801ec6a8 SOCleanup_caseD_ffffffe0
+801ec768 SOiGetSysWork
+801ec774 SOiIsBufferAddrCheck
+801ec77c SOiIsInitialized
+801ec7cc SOAlloc
+801ec8b4 SOiFree
+801ec8e8 SOiPrepare
+801ec9d0 SOiConclude
+801eca2c SOiPrepareTempRm
+801ecc14 SOiPrepareTempRm_switch
+801ecc18 SOiPrepareTempRm_caseD_ffffffe3
+801ecc20 SOiPrepareTempRm_caseD_fffffffe
+801ecc28 SOiPrepareTempRm_caseD_fffffff1
+801ecc30 SOiPrepareTempRm_caseD_ffffffe4
+801ecd04 SOiConcludeTempRm
+801ecde8 SOiWaitForDHCPEx
+801ecf20 __SOCreateSocket
+801ecff4 SOSocket
+801ed0e4 SOClose
+801ed188 SOBind
+801ed270 SOConnect
+801ed358 SOGetSockName
+801ed454 SORecvFrom
+801ed47c SORecv
+801ed4a0 SOSendTo
+801ed4c8 SOSend
+801ed4ec SOFcntl
+801ed61c SOShutdown
+801ed6d0 SOPoll
+801ed82c SOInetAToN
+801ed938 SOInetNtoA
+801ed98c SONtoHl
+801ed990 SONtoHs
+801ed998 SOHtoNl
+801ed99c SOHtoNs
+801ed9a4 RecvFrom
+801edc5c SendTo
+801ede88 SOGetHostId
+801edf00 SOGetHostByName
+801ee040 SOGetAddrInfo
+801ee324 SOFreeAddrInfo
+801ee388 SOSetSockOpt
+801ee48c SOGetInterfaceOpt
+801ee668 SSLNew
+801ee7c0 SSLConnect
+801ee888 SSLDoHandshake
+801ee934 SSLRead
+801eec04 SSLWrite
+801eeec4 SSLShutdown
+801eef70 SSLSetClientCert
+801ef0dc SSLSetRootCA
+801ef224 SSLSetBuiltInRootCA
+801ef2ec SSLSetBuiltInClientCert
+801ef3b4 OS::InitMutex
+801ef3b8 OS::LockMutex
+801ef3bc OS::UnlockMutex
+801ef3c0 VFipf_toupper
+801ef3d8 VFipf_memcpy
+801ef500 VFipf_memset
+801ef5f8 VFipf_strlen
+801ef618 VFipf_strcpy
+801ef63c VFipf_strcmp
+801ef674 VFipf_strncmp
+801ef6c0 VFiPFCODE_Combine_Width
+801ef6cc VFiPFCODE_Divide_Width
+801ef6dc VFiPF_LE16_TO_U16_STR
+801ef7f4 0x801ef7f4
+801ef7fc 0x801ef7fc
+801ef804 0x801ef804
+801ef81c 0x801ef81c
+801ef8fc VFiPFSTR_InitStr
+801ef9a8 0x801ef9a8
+801ef9bc 0x801ef9bc
+801efa9c 0x801efa9c
+801efb40 0x801efb40
+801efc3c 0x801efc3c
+801efd28 VFipf_w_strlen
+801efd4c VFipf_w_strcpy
+801efd70 0x801efd70
+801efdbc 0x801efdbc
+801efea8 0x801efea8
+801f0064 0x801f0064
+801f0218 0x801f0218
+801f0244 0x801f0244
+801f0270 0x801f0270
+801f029c 0x801f029c
+801f031c 0x801f031c
+801f0334 0x801f0334
+801f056c 0x801f056c
+801f05f4 0x801f05f4
+801f071c 0x801f071c
+801f07a0 0x801f07a0
+801f0824 0x801f0824
+801f08a4 0x801f08a4
+801f09b8 0x801f09b8
+801f0ef0 0x801f0ef0
+801f0f50 VFipdm_bpb_set_fsinfo_information
+801f1014 0x801f1014
+801f115c 0x801f115c
+801f1208 0x801f1208
+801f13ec 0x801f13ec
+801f1530 0x801f1530
+801f15e0 0x801f15e0
+801f1754 0x801f1754
+801f19a4 0x801f19a4
+801f1a8c 0x801f1a8c
+801f1c1c 0x801f1c1c
+801f1d6c 0x801f1d6c
+801f1ebc 0x801f1ebc
+801f1ffc 0x801f1ffc
+801f2134 0x801f2134
+801f2220 0x801f2220
+801f232c 0x801f232c
+801f2430 0x801f2430
+801f2534 0x801f2534
+801f261c 0x801f261c
+801f26f8 0x801f26f8
+801f2858 0x801f2858
+801f29d8 0x801f29d8
+801f2b5c 0x801f2b5c
+801f2c80 0x801f2c80
+801f2e5c 0x801f2e5c
+801f3034 0x801f3034
+801f31b4 0x801f31b4
+801f32f4 0x801f32f4
+801f3508 0x801f3508
+801f371c 0x801f371c
+801f38bc 0x801f38bc
+801f39d0 0x801f39d0
+801f3ad4 0x801f3ad4
+801f3bd8 0x801f3bd8
+801f3cdc 0x801f3cdc
+801f3eac 0x801f3eac
+801f3ec8 0x801f3ec8
+801f3ee4 0x801f3ee4
+801f3ff8 0x801f3ff8
+801f40b4 0x801f40b4
+801f4280 0x801f4280
+801f449c VFipdm_init_diskmanager
+801f45c4 VFipdm_open_disk
+801f460c VFipdm_close_disk
+801f4624 VFipdm_open_partition
+801f4680 VFipdm_close_partition
+801f46c0 0x801f46c0
+801f4940 0x801f4940
+801f4a40 0x801f4a40
+801f4d88 0x801f4d88
+801f4f8c 0x801f4f8c
+801f5220 0x801f5220
+801f5474 0x801f5474
+801f55a8 0x801f55a8
+801f59e4 0x801f59e4
+801f5ae4 0x801f5ae4
+801f5af8 0x801f5af8
+801f5b08 0x801f5b08
+801f5b18 0x801f5b18
+801f5be0 0x801f5be0
+801f5c48 0x801f5c48
+801f5cbc 0x801f5cbc
+801f5d4c 0x801f5d4c
+801f5d8c 0x801f5d8c
+801f5dd4 0x801f5dd4
+801f5e1c 0x801f5e1c
+801f5e7c 0x801f5e7c
+801f5eb8 0x801f5eb8
+801f5ef4 0x801f5ef4
+801f5f54 0x801f5f54
+801f5fd8 0x801f5fd8
+801f600c 0x801f600c
+801f6130 0x801f6130
+801f6188 0x801f6188
+801f62c4 0x801f62c4
+801f62d4 0x801f62d4
+801f6390 0x801f6390
+801f63a0 0x801f63a0
+801f65bc 0x801f65bc
+801f6708 0x801f6708
+801f6764 0x801f6764
+801f6b40 0x801f6b40
+801f6bcc 0x801f6bcc
+801f6d2c 0x801f6d2c
+801f7094 0x801f7094
+801f71ac 0x801f71ac
+801f721c 0x801f721c
+801f7264 0x801f7264
+801f7310 0x801f7310
+801f7530 0x801f7530
+801f769c 0x801f769c
+801f7738 0x801f7738
+801f78c8 0x801f78c8
+801f7934 0x801f7934
+801f79dc 0x801f79dc
+801f7ac4 0x801f7ac4
+801f7b38 0x801f7b38
+801f7c68 0x801f7c68
+801f7e20 0x801f7e20
+801f8070 0x801f8070
+801f814c 0x801f814c
+801f82c4 0x801f82c4
+801f8348 0x801f8348
+801f8580 0x801f8580
+801f8880 0x801f8880
+801f8994 0x801f8994
+801f8c48 0x801f8c48
+801f922c 0x801f922c
+801f9638 0x801f9638
+801f9c4c 0x801f9c4c
+801f9d50 0x801f9d50
+801f9e5c 0x801f9e5c
+801f9f54 0x801f9f54
+801fa280 0x801fa280
+801fa374 0x801fa374
+801fa478 0x801fa478
+801fa520 0x801fa520
+801fa844 0x801fa844
+801fa974 0x801fa974
+801fab78 0x801fab78
+801fad34 0x801fad34
+801faee0 0x801faee0
+801fb0ac 0x801fb0ac
+801fb2d0 0x801fb2d0
+801fb4f8 0x801fb4f8
+801fb7a4 0x801fb7a4
+801fbb0c 0x801fbb0c
+801fbc3c 0x801fbc3c
+801fbd4c 0x801fbd4c
+801fbecc 0x801fbecc
+801fbfe4 0x801fbfe4
+801fc19c 0x801fc19c
+801fc1d8 0x801fc1d8
+801fc29c 0x801fc29c
+801fc34c 0x801fc34c
+801fc3f8 0x801fc3f8
+801fc58c 0x801fc58c
+801fc6bc 0x801fc6bc
+801fc900 0x801fc900
+801fcce0 0x801fcce0
+801fce78 0x801fce78
+801fcfa8 0x801fcfa8
+801fd258 0x801fd258
+801fd340 0x801fd340
+801fd39c 0x801fd39c
+801fd5b4 0x801fd5b4
+801fd630 0x801fd630
+801fd640 0x801fd640
+801fd648 0x801fd648
+801fd6a4 0x801fd6a4
+801fd70c 0x801fd70c
+801fd740 0x801fd740
+801fd75c 0x801fd75c
+801fd940 0x801fd940
+801fdc1c 0x801fdc1c
+801fddc0 0x801fddc0
+801fe294 0x801fe294
+801fe3f8 0x801fe3f8
+801fe5b8 0x801fe5b8
+801fe650 0x801fe650
+801fe820 0x801fe820
+801fe994 0x801fe994
+801feb64 0x801feb64
+801fec84 0x801fec84
+801fee74 VFiPFVOL_InitModule
+801fee78 0x801fee78
+801fef94 0x801fef94
+801ff22c 0x801ff22c
+801ff230 0x801ff230
+801ff400 0x801ff400
+801ff67c 0x801ff67c
+801ff7c0 0x801ff7c0
+801ffa1c 0x801ffa1c
+801ffcf8 0x801ffcf8
+801fff64 0x801fff64
+80200304 0x80200304
+802004cc 0x802004cc
+802006a0 0x802006a0
+802007bc 0x802007bc
+80200c78 0x80200c78
+80200e18 0x80200e18
+8020116c 0x8020116c
+80201290 0x80201290
+80201328 0x80201328
+802013cc 0x802013cc
+80201590 VFiPFFILE_fopen
+802016d8 0x802016d8
+80201a6c 0x80201a6c
+80201ca8 0x80201ca8
+80201f48 0x80201f48
+802022e0 0x802022e0
+8020252c 0x8020252c
+8020270c 0x8020270c
+802029c8 0x802029c8
+80202e7c 0x80202e7c
+802031e4 0x802031e4
+80203210 0x80203210
+80203220 0x80203220
+802035a4 0x802035a4
+802035ac 0x802035ac
+80203644 0x80203644
+802037cc 0x802037cc
+80203a28 0x80203a28
+80203bd8 0x80203bd8
+80203c40 0x80203c40
+80203cdc 0x80203cdc
+80203e08 0x80203e08
+80203ea0 0x80203ea0
+80204618 0x80204618
+802047f4 0x802047f4
+80204908 0x80204908
+80204974 0x80204974
+80204c98 0x80204c98
+80204e3c 0x80204e3c
+80204eb0 0x80204eb0
+80204f68 0x80204f68
+80205058 0x80205058
+80205144 0x80205144
+802053d4 0x802053d4
+8020551c 0x8020551c
+80205758 0x80205758
+8020586c 0x8020586c
+80205970 0x80205970
+80205b6c VFiPFVOL_InitModule
+80205cf8 0x80205cf8
+80205eb4 0x80205eb4
+80206088 0x80206088
+80206244 VFiPFVOL_SetCurrentVolume
+80206390 VFiPFVOL_GetVolumeFromDrvChar
+802064e4 0x802064e4
+80206538 0x80206538
+8020657c VFiPFVOL_errnum
+8020658c 0x8020658c
+8020682c 0x8020682c
+80206e20 0x80206e20
+80206f3c 0x80206f3c
+802070a4 0x802070a4
+80207294 VFiPFCODE_CP932_OEM2Unicode
+80207450 VFiPFCODE_CP932_Unicode2OEM
+802076b8 VFiPFCODE_CP932_OEMCharWidth
+802076ec VFiPFCODE_CP932_isOEMMBchar
+80207768 VFiPFCODE_CP932_UnicodeCharWidth
+80207770 VFiPFCODE_CP932_isUnicodeMBchar
+80207778 VFiPFAPI_ParseOpenModeString
+80207848 VFiPFAPI_convertError
+80207888 VFiPFAPI_convertReturnValue
+80207898 0x80207898
+802078b0 0x802078b0
+802078d4 0x802078d4
+80207968 VFipf2_create
+802079d0 VFipf2_detach
+802079f8 VFipf2_errnum
+80207a1c VFipf2_fclose
+80207a40 VFipf2_finfo
+80207a64 VFipf2_fopen
+80207b18 0x80207b18
+80207b40 VFipf2_fread
+80207b68 VFipf2_fseek
+80207b8c VFipf2_fwrite
+80207bb4 0x80207bb4
+80207bdc VFipf2_init_prfile2
+80207c1c 0x80207c1c
+80207c6c 0x80207c6c
+80207cbc VFipf2_unmount
+80207ce4 VFiPF_InitLockFile
+80207cf0 0x80207cf0
+80207cf8 VFiPFSYS_initializeSYS
+80207cfc VFiPFSYS_GetCurrentContextID
+80207d0c 0x80207d0c
+80207d70 VFIsAvailable
+80207d84 VFInitEx
+80207e4c VFFinalize
+80207eb0 VFSeekFile
+80207f18 0x80207f18
+80207f90 0x80207f90
+80208008 VFiActivateDriveCommon
+802080fc 0x802080fc
+80208288 0x80208288
+80208414 0x80208414
+802084f0 VF_path2handleidx
+802085cc 0x802085cc
+80208694 VFOpenFile
+80208770 VFCloseFile
+802087dc VFSeekFile
+80208868 VFReadFile
+80208904 VFWriteFile
+80208990 0x80208990
+80208a60 0x80208a60
+80208b30 0x80208b30
+80208b70 thunk_0x8020adf8
+80208b74 VFGetLastDeviceError
+80208bfc 0x80208bfc
+80208c80 0x80208c80
+80208cf0 0x80208cf0
+80208d84 VFSysSetLastError
+80208d94 0x80208d94
+80208ed8 0x80208ed8
+80208f04 0x80208f04
+80208f64 0x80208f64
+80208fd8 VFSysPDMDisk2HandleIdx
+8020903c 0x8020903c
+8020907c 0x8020907c
+802090e8 VFSysInit
+8020926c VFSysFinalize
+802093f8 VFSysSetDeviceNANDFlash
+802095e4 VFSysUnsetDevice
+8020973c VFSysCheckExistPrfFile_nandflash_sub
+8020989c VFSysCheckExistPrfFile_nandflash_sub_caseD_0
+802098a8 VFSysCheckExistPrfFile_nandflash_sub_switch_80209a8c::caseD_1
+802098e4 VFSysCheckExistPrfFile_nandflash_sub_caseD_2
+80209a18 VFSysCheckExistPrfFile
+80209a8c VFSysCheckExistPrfFile_switch
+80209aa0 thunk_0x8020c82c
+80209aa4 VFSysCreatePrfFileNANDFlash
+80209b68 VFSysCreatePrfFileNANDFlashEx
+80209c2c VFSysMountDrv
+80209eec VFSysUnmountDrv
+8020a03c VFSysCreateFile_current
+8020a11c VFSysCreateFile
+8020a24c VFSysOpenFile
+8020a338 VFSysOpenFile_current
+8020a474 VFSysCloseFile
+8020a55c VFSysSeekFile
+8020a664 VFSysReadFile
+8020a7dc VFSysWriteFile
+8020a8e8 0x8020a8e8
+8020a9b8 0x8020a9b8
+8020aac8 0x8020aac8
+8020ab98 0x8020ab98
+8020aca8 0x8020aca8
+8020ad10 0x8020ad10
+8020ae00 0x8020ae00
+8020aeac 0x8020aeac
+8020aef4 thunk_0x8020d0cc
+8020aef8 thunk_0x8020d118
+8020aefc 0x8020aefc
+8020b22c 0x8020b22c
+8020b29c VFSysSetTimeStampCallback
+8020b2ac 0x8020b2ac
+8020b2b4 _MakeWStr
+8020b3e0 dHash_InitHashTable
+8020b4e4 dHash_SearchHashW
+8020b674 dHash_GetArg
+8020b6d4 dHash_SetArg
+8020b8bc dHash_DeleteData
+8020b934 dTM_GetNowTime
+8020ba14 dCommon_DevideBuff32
+8020ba7c dCommon_IsPrfFile
+8020bae4 dCommon_CopyPrfFileHeader
+8020bbb8 dCommon_PrintSignature
+8020bbbc dCommon_MakeFsInfoSec
+8020bc08 dCommon_GetPhysicalOffset
+8020bc18 dCommon_GetNiceFatType
+8020bca0 dCommon_GetReservedSecFromFatType
+8020bcb4 dCommon_GetRootEntNumFromFatType
+8020bcd0 dCommon_MakeBootSector
+8020bf14 dCommon_ReadDummyBPB
+8020c08c dCommon_WriteDummyBPB
+8020c194 dCommon_initDriveInfo
+8020c280 dCommon_getFileSizeFromDisk
+8020c2d4 dCommon_setFileSizeToDisk
+8020c32c dCommon_getLastDeviceErrorFromDisk
+8020c380 dCommon_setLastDeviceErrorToDisk
+8020c3d8 dCommon_setLastDeviceErrorToDisk2
+8020c400 thunk_0x80208fd8
+8020c404 dCommon_setFatTypeToDisk
+8020c45c dCommon_getResvSecNumFromDisk
+8020c4b0 dCommon_setResvSecNumToDisk
+8020c508 dCommon_getRootEntNumFromDisk
+8020c55c dCommon_setRootEntNumToDisk
+8020c5b4 dCommon_FlushFromVol
+8020c630 dCommon_FlushFromHandleIdx
+8020c6ac 0x8020c6ac
+8020c76c 0x8020c76c
+8020c82c 0x8020c82c
+8020c8dc 0x8020c8dc
+8020c98c VFi_NandClose
+8020ca3c 0x8020ca3c
+8020cafc 0x8020cafc
+8020cbbc VFi_NandRead
+8020cc7c 0x8020cc7c
+8020cd3c 0x8020cd3c
+8020cdfc VFi_NandGetLength
+8020ceb4 VFi_NandOpenSp
+8020d164 0x8020d164
+8020d514 0x8020d514
+8020d784 0x8020d784
+8020e4e8 RVL::NAND_CreatePrfFile
+8020e4f4 RVL::NAND_CreatePrfFileEx
+8020e500 0x8020e500
+8020e824 0x8020e824
+8020eecc nanddrv_BuildUpFSInfoSector
+8020ef04 0x8020ef04
+8020efa8 0x8020efa8
+8020eff4 0x8020eff4
+8020f060 0x8020f060
+8020f078 0x8020f078
+8020f0bc 0x8020f0bc
+8020f100 0x8020f100
+8020f1fc 0x8020f1fc
+8020f234 0x8020f234
+8020f2dc 0x8020f2dc
+8020f2f4 0x8020f2f4
+8020f494 0x8020f494
+8020f628 0x8020f628
+8020f62c EGG::Allocator::__ct
+8020f688 EGG::Allocator::__dt
+8020f6c8 0x8020f6c8
+8020f6dc free
+8020f6ec EGG::Archive::__dt
+8020f758 0x8020f758
+8020f768 EGG::Archive::Mount
+8020f8d0 EGG::Archive::Mount2(usedCount = 2)
+8020fa38 EGG::Archive::Unmount
+8020fa78 EGG::Archive::ConvertPathToEntry
+8020fa80 EGG::Archive::GetFileFast
+8020fb14 EGG::Archive::GetFileInfo
+8020fb78 EGG::Archive::LoadFromDisc
+8020fcc4 0x8020fcc4
+8020fcd4 EGG::PostRetraceCallback
+8020fcdc EGG::DrawDoneCallback
+8020fd10 EGG::AsyncDisplay::HandleAlarmWrapper
+8020fd18 EGG::AsyncDisplay::__ct
+8020fd8c EGG::AsyncDisplay::startSyncNTSC
+8020fe24 EGG::AsyncDisplay::beginFrame
+8020ff98 EGG::AsyncDisplay::beginRender
+8020ff9c EGG::AsyncDisplay::endRender
+80210024 EGG::AsyncDisplay::postVRetrace
+802100a0 EGG::Display::802100a0
+80210124 0x80210124
+8021013c 0x8021013c
+802104ec EGG::Audio3DActor::__ct
+80210530 EGG::Audio3DActor::__dt
+80210588 EGG::Audio3DActor::__dt
+80210590 EGG::ArcPlayer::__ct
+80210624 EGG::ArcPlayer::__dt
+80210698 EGG::ArcPlayer::SetStreamBlocks
+802106b8 EGG::ArcPlayer::OpenArchive
+80210748 EGG::ArcPlayer::OpenDVDArchive
+802108bc EGG::ArcPlayer::OpenNANDArchive
+80210a30 EGG::ArcPlayer::OpenMemoryArchive
+80210bd8 EGG::ArcPlayer::SetupMemoryArchive
+80210ce4 EGG::ArcPlayer::CloseArchive
+80210d70 EGG::ArcPlayer::LoadGroup
+80210e3c EGG::ArcPlayer::LoadGroup
+80210f08 EGG::ArcPlayer::LoadGroup
+80210fd4 EGG::ArcPlayer::Calc
+80210fec EGG::ArcPlayer::StopAllSound
+80211048 EGG::ArcPlayer::SetupMemoryArchive(s32)
+80211058 EGG::ArcPlayer::StartSound(str)
+802110c8 EGG::ArcPlayer::StartSound(ul)
+802110fc EGG::ArcPlayer::StartSound(u32)
+80211130 EGG::ArcPlayer::PrepareSound(str)
+802111a0 EGG::ArcPlayer::PrepareSound(ul)
+802111d4 EGG::ArcPlayer::PrepareSound(u32)
+80211208 EGG::ArcPlayer::HoldSound(str)
+80211278 EGG::ArcPlayer::HoldSound(ul)
+802112ac EGG::ArcPlayer::HoldSound(u32)
+802112e0 0x802112e0
+80211320 EGG::ExpAudioMgr::__ct
+802113b8 EGG::ExpAudioMgr::__dt
+80211460 EGG::ExpAudioMgr::ExpAudioMgrArg::__ct
+802114f0 EGG::ExpAudioMgr::Initialize
+802115dc EGG::ExpAudioMgr::OpenArchive
+8021167c EGG::ExpAudioMgr::SetupMemoryArchive
+80211718 EGG::ExpAudioMgr::CloseArchive
+8021174c EGG::SoundHeapMgr::GetCurrentLevel
+802117a0 EGG::SoundHeapMgr::SaveState
+80211874 EGG::SoundHeapMgr::LoadState
+80211900 EGG::ExpAudioMgr::LoadState
+8021198c EGG::ExpAudioMgr::SetupMemoryArchive
+8021199c EGG::SimpleAudioMgr::CloseArchive(thunk)
+802119a4 EGG::SimpleAudioMgr::SetupMemoryArchive(thunk)
+802119ac EGG::ExpAudioMgr::LoadState(thunk)
+802119b4 EGG::SimpleAudioMgr::Calc
+802119bc EGG::SimpleAudioMgr::LoadGroup(thunk)
+802119c4 EGG::SimpleAudioMgr::LoadGroup(thunk)
+802119cc EGG::SimpleAudioMgr::LoadGroup(thunk)
+802119d4 EGG::ExpAudioMgr::CloseArchive(thunk)
+802119dc EGG::ExpAudioMgr::SetupMemoryArchive(thunk)
+802119e4 EGG::ExpAudioMgr::SetupMemoryArchive(thunk)
+802119ec EGG::SimpleAudioMgr::OpenMemoryArchive(thunk)
+802119f4 EGG::SimpleAudioMgr::OpenNANDArchive(thunk)
+802119fc EGG::SimpleAudioMgr::OpenDVDArchive(thunk)
+80211a04 EGG::ExpAudioMgr::OpenArchive(thunk)
+80211a0c EGG::ExpAudioMgr::__dt(thunk)
+80211a14 EGG::AudioFx::__ct
+80211a28 EGG::AudioFx::__dt
+80211a94 EGG::AudioFx::CreateFx
+80211ac0 0x80211ac0
+80211ad0 0x80211ad0
+80211ae0 0x80211ae0
+80211af0 0x80211af0
+80211b00 0x80211b00
+80211b10 0x80211b10
+80211b20 0x80211b20
+80211b30 0x80211b30
+80211b40 0x80211b40
+80211b5c 0x80211b5c
+80211c14 EGG::AudioFxMgr::__ct
+80211c74 EGG::AudioFxMgr::__dt
+80211cd8 EGG::AudioFxMgr::InitializeFx
+80211d84 EGG::AudioFxMgr::CreateFxReverb
+80211d94 EGG::AudioFxMgr::ClearFx
+80211e58 0x80211e58
+80212094 0x80212094
+802122d0 0x802122d0
+8021250c 0x8021250c
+80212748 EGG::AudioFx::CreateFxReverb
+80212984 0x80212984
+80212bc0 0x80212bc0
+80212dfc 0x80212dfc
+80213038 0x80213038
+8021318c EGG::SoundHeapMgr::Initialize
+802131e8 EGG::SoundHeapMgr::CreateSoundHeap
+80213258 EGG::SoundHeapMgr::DestroySoundHeap
+80213260 EGG::SimpleAudioMgr::SimpleAudioMgrArg::__ct
+8021329c EGG::SimpleAudioMgr::__ct
+8021337c EGG::SoundArchivePlayerMgr::__dt
+802133d4 EGG::SimpleAudioMgr::__dt
+8021347c EGG::SimpleAudioMgr::Initialize
+802135d0 EGG::SimpleAudioMgr::Calc
+8021361c EGG::SimpleAudioMgr::OpenDVDArchive
+80213624 EGG::SimpleAudioMgr::OpenNANDArchive
+8021362c EGG::SimpleAudioMgr::OpenMemoryArchive
+80213634 EGG::SimpleAudioMgr::SetupMemoryArchive
+8021363c EGG::SimpleAudioMgr::CloseArchive
+80213644 EGG::SimpleAudioMgr::LoadGroup
+8021364c EGG::SimpleAudioMgr::LoadGroup
+80213654 EGG::SimpleAudioMgr::LoadGroup
+8021365c EGG::SoundArchivePlayerMgr::SetupSound
+80213690 EGG::IAudioMgr::Initialize
+80213694 EGG::SoundArchivePlayerMgr::SetupSound(thunk)
+8021369c EGG::SoundArchivePlayerMgr::__dt(thunk)
+802136a4 EGG::SimpleAudioMgr::__dt(ArcPlayer)
+802136ac 0x802136ac
+8021373c 0x8021373c
+802137c8 0x802137c8
+80213920 0x80213920
+802139ec 0x802139ec
+80213a3c 0x80213a3c
+80213ad4 0x80213ad4
+80213b80 0x80213b80
+80213c48 0x80213c48
+80213cc8 EGG::AudioSystem::__ct
+80213ce4 EGG::AudioSystem::__dt
+80213d24 EGG::AudioSystem::Calc
+80213e1c EGG::AudioTrack::__ct
+80213e48 EGG::AudioTrack::Reset
+80213e5c EGG::AudioTrack::ApplyValueChange
+80213edc EGG::AudioTrack::Calc
+80213f54 EGG::AudioTrack::ClampValue
+80213f88 EGG::SimpleAudioTrack::__ct
+80213ffc EGG::SimpleAudioTrack::Reset
+80214058 EGG::SimpleAudioTrack::SetValueSmooth
+8021410c EGG::SimpleAudioTrack::SetValueSmoothAsync
+802141c0 EGG::SimpleAudioTrack::Calc
+80214264 EGG::SimpleAudioTrack::CallBack
+80214340 0x80214340
+80214350 EGG::AudioUtility::HBM::init
+80214360 EGG::AudioUtility::HBM::enter
+80214490 EGG::AudioUtility::HBM::exit
+802145b0 __sinit_\eggAudioUtility_cpp
+802145c0 0x802145c0
+802145f0 BoundBox2f_resetBound
+8021460c EGG::BaseCamera::UpdateMatrix
+8021461c EGG::BaseCamera::Draw
+8021466c EGG::BaseCamera::GetLookVector
+802146c0 EGG::BaseCamera::GetRightVector
+80214714 EGG::BaseCamera::GetUpVector
+80214768 EGG::LookAtCamera::GetViewMatrixOld
+80214770 EGG::LookAtCamera::DoUpdateMatrix
+80214968 0x80214968
+802149b4 EGG::LookAtCamera::DoDraw
+802149b8 EGG::LookAtCamera::LoadMatrix
+80214a04 EGG::LookAtCamera::LoadOldMatrix
+80214a08 EGG::OrthoCamera::__ct
+80214a8c EGG::EGG_ROtationF_CT
+80214b14 EGG::OrthoCamera::DoUpdateMatrix
+80214ba4 EGG::LookAtCamera::GetViewMatrix(const)
+80214bac EGG::LookAtCamera::GetViewMatrix
+80214bb4 EGG::LookAtCamera::GetPosition
+80214bd0 EGG::CapTexture::configure
+80214c74 EGG::CapTexture::copyFromEFB
+80214e10 EGG::CapTexture::destruct
+80214e68 CntFile_construct
+80214eac __dt__Q23EGG7CntFileFv
+80214f14 initThreading__Q23EGG7CntFileFv
+80214f88 spawnFileHandle__Q23EGG7CntFileFPCcPv
+80215030 close__Q23EGG7CntFileFv
+802150a0 readData__Q23EGG7CntFileFPvll
+80215150 0x80215150
+80215158 0x80215158
+80215160 0x80215160
+80215168 EGG::ColorFader::__ct
+8021522c EGG::ColorFader::setColor
+80215248 EGG::ColorFader::getStatus
+80215280 EGG::ColorFader::fadeIn
+802152a8 EGG::ColorFader::fadeOut
+802152d4 EGG::ColorFader::calc
+802153b8 EGG::ColorFader::draw
+8021566c EGG::ColorFader::__dt
+802156ac Comp_encodeSZS
+8021587c egg_8021587C
+802159b8 egg_802159B8
+80215aa8 egg_80215AA8
+80215cbc EGG::CoreStatus::getFSStickButton
+80215d68 EGG::CoreController::CoreController
+80215dc8 EGG::CoreController::sceneReset
+80215e7c EGG::CoreController::getDpdRawPos
+80215e90 0x80215e90
+80215ea4 0x80215ea4
+802161d0 0x802161d0
+802161f8 EGG::CoreController::getAccel
+8021621c EGG::CoreController::beginFrame
+802165c8 0x802165c8
+802165ec 0x802165ec
+80216620 EGG::CoreController::endFrame
+80216688 0x80216688
+802166f4 CoreControllerMgr_createInstance
+80216738 0x80216738
+80216934 0x80216934
+802169ac 0x802169ac
+80216a24 0x80216a24
+80216a28 0x80216a28
+80216a40 0x80216a40
+80216a78 EGG::CoreControllerMgr::connectCallback
+80216ab4 EGG::CoreControllerMgr::__ct
+80216db8 0x80216db8
+80216dbc EGG::CoreControllerMgr::beginFrame
+80216e64 EGG::CoreControllerMgr::endFrame
+80217030 0x80217030
+8021709c GCControllerMgr_createInstance
+802170e0 0x802170e0
+80217274 0x80217274
+802172f0 EGG::EGG_GCCtrlMgr_CTProb
+802173e4 0x802173e4
+802173e8 EGG::GCControllerMgr::calc
+8021748c 0x8021748c
+8021749c 0x8021749c
+80217588 0x80217588
+80217600 0x80217600
+80217714 0x80217714
+80217718 0x80217718
+8021778c 0x8021778c
+802177dc 0x802177dc
+802177e0 0x802177e0
+80217854 0x80217854
+802178a4 0x802178a4
+802178a8 0x802178a8
+80217978 0x80217978
+80217a20 0x80217a20
+80217a28 0x80217a28
+80217a30 0x80217a30
+80217a38 0x80217a38
+80217a40 __sinit_eggCoreController
+80217a9c some_dt
+80217adc EGG::CpuTexture::makeGradient
+80217e1c 0x80217e1c
+80218028 0x80218028
+8021805c EGG::CpuTexture::__ct
+80218098 EGG::CpuTexture::__ct(width, height)
+802180d0 EGG::CpuTexture::__ct(GXTexObj)
+80218178 EGG::CpuTexture::__dt
+802181e8 EGG::CpuTexture::initTexObj
+80218268 EGG::CpuTexture::invalidate
+802182b4 EGG::CpuTexture::flush
+80218300 EGG::CpuTexture::createHeader
+80218384 EGG::CpuTexture::generateSphereBump
+8021856c EGG::CpuTexture::makeGradient
+8021895c EGG::CpuTexture::alloc
+802189d8 EGG::CpuTexture::allocateWithHeader
+80218a64 EGG::CpuTexture::allocate2
+80218ae0 EGG::CpuTexture::plotPixel
+80218b98 EGG::CpuTexture::configure
+80218ba4 EGG::Decomp::decode
+80218c2c EGG::Decomp::decodeSZS
+80218dc0 EGG::Decomp::decodeASH
+80218ff0 EGG::Decomp::decodeASR
+802198f8 EGG::Decomp::checkCompressed
+8021997c EGG::Decomp::getExpandSize
+80219a7c EGG::Decomp::getBitsCode
+80219b84 EGG::Decomp::getBit1c
+80219c10 EGG::Decomp::readTree9
+80219d34 EGG::Decomp::readTree12
+80219e68 EGG::Display::construct
+80219eb0 EGG::Display::getTickPerFrame
+80219eb4 EGG::Display::beginFrame
+80219fa8 EGG::Display::beginRender
+80219fac EGG::Display::endRender
+80219fb0 EGG::Display::endFrame
+80219fb4 EGG::Display::copyEFBtoXFB
+8021a06c EGG::Display::calcFrequency
+8021a0f0 EGG::Disposer::__ct
+8021a144 EGG::Disposer::__dt
+8021a1b8 0x8021a1b8
+8021a4d8 EGG::DrawGX::Initialize
+8021a580 EGG::DrawGX::GetDefaultTexMap
+8021a588 egx_8021A588_ConfigureBASIC
+8021a600 EGG::DrawGX::BeginDrawScreen
+8021a6dc egx_8021A6DC
+8021a884 egx_8021A884
+8021aa88 egx_8021AA88
+8021ad78 EGG::DrawGX::ClearEfb
+8021afe4 EGG::DrawGX::SetMatChannels
+8021b0b8 EGG::DrawGX::SetMatTexGen
+8021b134 EGG::DrawGX::SetMatIndirect
+8021b13c EGG::DrawGX::SetMatTev
+8021b29c EGG::DrawGX::SetMatPE
+8021b300 EGG::DrawGX::SetVtxState
+8021b344 EGG::DrawGX::SetVtxState_switch
+8021b348 EGG::DrawGX::SetVtxState_caseD_0
+8021b3b4 EGG::DrawGX::SetVtxState_caseD_2
+8021b400 EGG::DrawGX::SetVtxState_caseD_6
+8021b470 EGG::DrawGX::SetVtxState_caseD_1
+8021b498 EGG::DrawGX::SetVtxState_caseD_7
+8021b538 EGG::DrawGX::SetVtxState_caseD_9
+8021b5c8 EGG::DrawGX::SetVtxState_caseD_a
+8021b6a4 EGG::DrawGX::InitDL
+8021b790 0x8021b790
+8021b7c0 0x8021b7c0
+8021b908 0x8021b908
+8021b9dc 0x8021b9dc
+8021bac0 0x8021bac0
+8021bad0 0x8021bad0
+8021bae0 0x8021bae0
+8021bb80 0x8021bb80
+8021bcc4 0x8021bcc4
+8021bd08 0x8021bd08
+8021bd38 0x8021bd38
+8021bdc8 0x8021bdc8
+8021be54 0x8021be54
+8021bff0 EGG::DrawGX::DrawDL
+8021c058 EGG::DrawGX::DrawDL(Color)
+8021c0f8 EGG::DrawGX::SetZMode
+8021c118 EGG::DrawGX::SetBlendMode
+8021c13c EGG::DrawGX::SetupTranslucent
+8021c1b8 EGG::DrawGX::SetCull
+8021c210 DrawGX_SetupZWeirdThenCB
+8021c284 DrawGX_SetCUllReverseandBlend
+8021c2dc 0x8021c2dc
+8021c2e0 EGG::DrawPathBase::__ct
+8021c330 EGG::ScreenEffect::__dt
+8021c370 EGG::DrawPathBase::CreateProcs
+8021c4bc EGG::DrawPathBase::Calc
+8021c4dc EGG::DrawPathBase::CalcImpl
+8021c4e0 EGG::DrawPathBase::__dt
+8021c53c EGG::DrawPathBase::Draw
+8021c55c EGG::DrawPathBase::__dt(thunk)
+8021c564 EGG::DrawPathBase::Draw(thunk)
+8021c56c EGG::DrawPathBloom::__ct
+8021c750 EGG::DrawPathBloom::__dt
+8021c8c4 TintTex_destruct
+8021c904 EGG::PostEffect::__dt
+8021c944 EGG::PostEffectBloom::__dt
+8021c984 EGG::PostEffectBlur::__dt
+8021c9c4 EGG::PostEffectSimple::__dt
+8021ca04 egg_threshold_destruct
+8021ca44 EGG::DrawPathBloom::CalcImpl
+8021ccc0 EGG::DrawPathBloom::DrawImpl
+8021d850 EGG::DrawPathBloom::GetBinaryType
+8021d860 EGG::DrawPathBloom::SetBinaryImpl
+8021df0c EGG::DrawPathBloom::GetBinaryImpl
+8021e260 EGG::DrawPathBloom::DoubleMount
+8021e884 EGG::DrawPathBloom::GetBinarySize
+8021e88c EGG::DrawPathBloom::GetScnProcCount
+8021e894 EGG::DrawPathBloom::GetVersion
+8021e89c EGG::DrawPathBloom::__dt(thunk)
+8021e8a4 EGG::DrawPathBloom::SetBinaryImpl(thunk)
+8021e8ac EGG::DrawPathBloom::DoubleMount(thunk)
+8021e8b4 EGG::DrawPathBloom::GetBinaryImpl(thunk)
+8021e8bc EGG::DrawPathBloom::GetBinaryType(thunk)
+8021e8c4 EGG::DrawPathBloom::GetVersion(thunk)
+8021e8cc EGG::DrawPathDOF::__ct
+8021ea64 EGG::DrawPathDOF::__dt
+8021eb88 0x8021eb88
+8021ebc8 0x8021ebc8
+8021ec40 EGG::DrawPathDOF::CalcImpl
+8021eec0 EGG::DrawPathDOF::DrawImpl
+8021ef8c EGG::EGG_DOF_DrawMode1
+8021fb48 0x8021fb48
+8021ff0c 0x8021ff0c
+80220000 0x80220000
+8022014c EGG::Screen::__dt
+8022018c EGG::Frustum::__dt
+802201cc 0x802201cc
+802203ec EGG::DrawPathDOF::GetBinaryType
+802203fc EGG::DrawPathDOF::SetBinaryImpl
+80220508 EGG::DrawPathDOF::GetBinaryImpl
+802205d8 EGG::DrawPathDOF::DoubleMount
+802209fc EGG::DrawPathDOF::GetBinarySize
+80220a04 EGG::DrawPathDOF::GetScnProcCount
+80220a0c EGG::DrawPathDOF::GetVersion
+80220a14 EGG::DrawPathDOF::__dt(thunk)
+80220a1c EGG::DrawPathDOF::SetBinaryImpl(thunk)
+80220a24 EGG::DrawPathDOF::DoubleMount(thunk)
+80220a2c EGG::DrawPathDOF::GetBinaryImpl(thunk)
+80220a34 EGG::DrawPathDOF::GetBinaryType(thunk)
+80220a3c EGG::DrawPathDOF::GetVersion(thunk)
+80220a44 EGG::EggPost3CT
+80220aa8 0x80220aa8
+80220b4c 0x80220b4c
+80220b8c 0x80220b8c
+80220b90 0x80220b90
+80220cd8 0x80220cd8
+80220ce0 0x80220ce0
+80220ce8 EGG::DrawPathShadowVolume::__ct
+80220d7c EGG::DrawPathShadowVolume::DrawImpl
+802217cc EGG::DrawPathShadowVolume::GetScnProcCount
+802217d4 EGG::DrawPathShadowVolume::__dt
+80221834 EGG::DrawPathShadowVolume::__dt(thunk)
+8022183c EGG::DrawPathLightMap::__ct
+802218b0 EGG::DrawPathLightMap::CalcImpl
+802218ec EGG::DrawPathLightMap::DrawImpl
+80222250 EGG::DrawPathLightMap::FreeFirstTwoTexBuffers
+802222ac EGG::DrawPathLightMap::GetScnProcCount
+802222b4 EGG::DrawPathLightMap::__dt
+80222314 EGG::DrawPathLightMap::__dt(thunk)
+8022231c EGG::DvdFile::Initialize
+8022235c EGG::DvdFile::__ct
+802223a0 EGG::DvdFile::__dt
+80222408 EGG::DvdFile::Initiate
+80222470 EGG::DvdFile::Open
+802224e8 EGG::DvdFile::Open
+80222530 EGG::DvdFile::Open
+80222540 EGG::DvdFile::Close
+8022259c EGG::DvdFile::ReadData
+80222660 EGG::DvdFile::WriteData
+80222668 EGG::DvdFile::Sync
+802226bc EGG::DvdFile::GetFileSize
+802226d0 0x802226d0
+802226d8 EGG::DvdRipper::LoadToMainRAM(path)
+8022277c EGG::DvdRipper::LoadToMainRAM(DvdFile)
+8022293c EGG::DvdRipper::LoadToMainRAMLZDecomp(path)
+802229e8 EGG::DvdRipper::LoadToMainRAMLZDecomp(DvdFile)
+80222ccc EGG::Effect::__ct
+80222d50 EGG::Effect::__dt
+80222d90 EGG::Effect::Create
+80222e60 EGG::Effect::Fade
+80222eb0 EGG::Effect::FollowFade
+80222ef4 EGG::Effect::Kill
+80222f50 EGG::Effect::SetDisableCalc
+80222fc0 EGG::Effect::SetDisableDraw
+80223030 EGG::Effect::SetDisableCalcDraw
+802230cc EGG::Effect::SetLife
+8022318c EGG::Effect::SetEmitRatio
+80223220 EGG::Effect::SetEmitInterval
+802232b4 EGG::Effect::SetEmitEmitDiv
+80223348 EGG::Effect::SetPowerRadiationDir
+802233dc EGG::Effect::SetPowerSpecDir
+80223470 EGG::Effect::SetPowerSpecDirAddBase
+80223528 EGG::Effect::SetSpecDir
+80223620 EGG::Effect::SetSpecDirAddBase
+802237d0 EGG::Effect::SetVelocity
+80223834 EGG::Effect::SetColor
+802238d0 nw4r::ef::ParticleManager::Modifier_SetSimpleLightAmbient
+802238f4 nw4r::ef::ParticleManager::Modifier_SetSimpleLightType
+802238fc EGG::Effect::SetParticleSize
+802239bc EGG::Effect::SetParticleScale
+80223a1c nw4r::ef::ParticleManager::Modifier_SetScale
+80223a30 EGG::Effect::SetExpParticleManagerRotate
+80223af0 EGG::Effect::SetParticleRotate
+80223b50 nw4r::ef::ParticleManager::Modifier_SetRotate
+80223b6c EGG::Effect::SetLocalScle
+80223c18 EGG::Effect::SetDynamicsScale
+80223d14 EGG::Effect::SetScale
+80223d30 EGG::Effect::SetScale
+80223d58 EGG::Effect::SetPos
+80223d80 EGG::Effect::SetMtx
+80223d9c EGG::Effect::SetAnimStop
+80223f58 EGG::Effect::Update
+802240b8 EGG::Effect::GetEmitterPtclLife
+80224158 EGG::Effect::GetEmissionRatio
+802241f8 EGG::Effect::LoadEmitter
+802242dc EGG::Effect::Reset
+80224340 __sinit_\eggEffect_cpp
+80224348 EGG::EffectCreator::__ct
+802243b4 EGG::EffectCreator::__dt
+8022443c EGG::EffectCreator::StopAllEffect
+802244b4 EGG::EffectCreator::CalcAll
+8022450c EGG::EffectCreator::CalcGroup
+80224558 EGG::EffectCreator::Draw
+802245ac EGG::EffectCreator::CreateEffect
+8022464c nw4r::ef::EffectSystem::Calc
+802246ec EGG::EffectManager::Create
+80224768 EGG::EffectManager::CreateMemoryManager
+80224bc4 nw4r::ef::MemoryManagerBase::__dt
+80224c04 nw4r::ef::MemoryManagerTmp::__ct
+80224ca8 0x80224ca8
+80224d4c 0x80224d4c
+80224df0 0x80224df0
+80224e94 0x80224e94
+80224e9c 0x80224e9c
+80224ea4 0x80224ea4
+80224ff4 0x80224ff4
+8022500c 0x8022500c
+8022501c EGG::EffectManager::SetCreator
+8022502c EGG::EffectManager::ResetCreator
+80225040 EGG::EffectManager::ResetAllCreator
+80225070 EGG::EffectManager::StopAllEffect
+802250e0 EGG::EffectManager::CalcEffect
+80225108 0x80225108
+802251a8 EGG::EffectManager::GarbageCollection
+802251dc EGG::EffectManager::Draw
+80225208 EGG::EffectManager::CreateEffect
+80225224 EGG::EffectManager::__ct
+802252d4 0x802252d4
+802252e4 0x802252e4
+802252f4 0x802252f4
+80225304 0x80225304
+80225314 nw4r::ef::MemoryManager::__dt
+80225354 nw4r::ef::MemoryManager::GarbageCollection
+802255d4 nw4r::ef::MemoryManager::AllocEffect
+80225668 nw4r::ef::MemoryManager::FreeEffect
+802256b8 0x802256b8
+802256dc 0x802256dc
+802256f8 0x802256f8
+80225714 nw4r::ef::MemoryManager::AllocEmitter
+802257a8 nw4r::ef::MemoryManager::FreeEmitter
+802257f8 0x802257f8
+8022581c 0x8022581c
+80225838 0x80225838
+80225854 nw4r::ef::MemoryManager::AllocParticleManager
+802258e8 nw4r::ef::MemoryManager::FreeParticleManager
+80225938 0x80225938
+8022595c 0x8022595c
+80225978 0x80225978
+80225994 nw4r::ef::MemoryManager::AllocParticle
+80225a28 nw4r::ef::MemoryManager::FreeParticle
+80225a78 0x80225a78
+80225a9c 0x80225a9c
+80225ab8 0x80225ab8
+80225ad4 0x80225ad4
+80225c98 EGG::EffectResource::__ct
+80225d34 EGG::EffectResource::__dt
+80225de8 EGG::EffectResource::SetResource
+80225e74 EGG::EffectResource::ResetResource
+80225f04 EGG::EffectResource::Initialize
+80225f14 0x80225f14
+80225f64 0x80225f64
+80225fa4 0x80225fa4
+8022600c 0x8022600c
+80226060 0x80226060
+8022609c 0x8022609c
+802260f4 0x802260f4
+802261a8 0x802261a8
+802261ec 0x802261ec
+802261f8 EGG:ExpParticleManager::__ct
+80226250 EGG:ExpParticleManager::__dt
+802262a8 EGG:ExpParticleManager::Initialize
+80226308 EGG:ExpParticleManager::Calc
+802263dc EGG:ExpParticleManager::SetLife
+802263f0 EGG:ExpParticleManager::SetSize
+80226410 EGG:ExpParticleManager::SetRotate
+80226438 EGG:ExpParticleManager::Reset
+80226464 EGG::ExceptionCallback
+80226734 EGG::Exception::create
+802267c4 EGG::Exception::setMapFile
+802267f0 EGG::Exception::SetUserCallBack
+80226800 EGG::Exception::__dt
+802268a0 EGG::Exception::__ct
+802269a8 EGG::ExpHeap::__dt
+80226a1c EGG::ExpHeap::Create(parentMBlock)
+80226ac8 EGG::ExpHeap::Create(heap)
+80226b94 EGG::ExpHeap::destroy
+80226c04 EGG::ExpHeap::Alloc
+80226c78 EGG::ExpHeap::free
+80226c80 EGG::ExpHeap::resizeForMBlock
+80226c88 EGG::ExpHeap::getTotalFreeSize
+80226c90 EGG::ExpHeap::getAllocatableSize
+80226c98 EGG::ExpHeap::SetGroupID
+80226ca0 EGG::ExpHeap::AddSizeToGroup
+80226cfc EGG::ExpHeap::CalculateGroupSizes
+80226d4c EGG::ExpHeap::adjust
+80226dc0 EGG::ExpHeap::initAllocator
+80226dd0 EGG::ExpHeap::GroupSizeHolder::__ct
+80226e00 EGG::ExpHeap::GroupSizeHolder::Reset
+80226e98 EGG::ExpHeap::GroupSizeRecord::Add
+80226eac 0x80226eac
+80226ebc EGG::ExpHeap::FreeAll
+80226efc EGG::ExpHeap::getHeapKind
+80226f04 EGG::Fog::__ct
+80226f14 0x80226f14
+80226f60 0x80226f60
+80227018 0x80227018
+802270a4 0x802270a4
+802270b4 0x802270b4
+80227114 0x80227114
+80227168 0x80227168
+8022716c 0x8022716c
+80227174 EGG::Fog::__dt
+802271b4 0x802271b4
+802271bc EGG::FogMgr::__ct
+8022725c EGG::FogMgr::8022725C
+80227274 EGG::FogMgr::setAllClipPlanes
+802272b8 EGG::FogMgr::configureScnRoot
+8022733c 0x8022733c
+8022734c EGG::FogMgr::mount
+802273e8 EGG::FogMgr::save
+80227468 0x80227468
+8022746c 0x8022746c
+8022747c EGG::FogMgr::8022747C
+80227664 EGG::FogMgr::__dt
+802276a4 0x802276a4
+802276b8 0x802276b8
+802276c0 EGG::Frustum::__ct
+80227724 EGG::Frustum::__ct(copy)
+802277a4 EGG::Frustum::SetProjectionPerspectiveGX
+802277d0 EGG::Frustum::SetProjectionOrthographicGX
+802277fc EGG::Frustum::CopyToG3D_Perspective
+80227868 EGG::Frustum::CopyToG3D_Orthographic
+802278d0 EGG::Frustum::CalcMtxPerspective
+80227960 EGG::Frustum::LoadFromAnmScn
+80227b18 EGG::Frustum::GetPerspectiveParams
+80227bd4 EGG::Frustum::GetOrthographicParams(Mtx)
+80227cb4 EGG::Frustum::GetOrthographicParams(floats)
+80227e18 EGG::Frustum::GetViewToScreen
+80227ff4 EGG::Frustum::LoadDirectly
+80228180 EGG::Frustum::CopyToG3D
+80228334 __sinit_\eggFrustum_cpp
+80228358 EGG::G3DUtility::installG3DStateExtensions
+8022845c EGG::G3DUtility::detail::ManualProjectionMapping
+80228490 G3DUtil_LightSestSTuff
+80228668 g3dutil_SolveCameraFrame
+802287e4 EGG::G3DUtility::SearchNodes
+802288e0 EGG::G3DUtility::SearchMaterials
+802289dc EGG::G3DUtility::CountTextureLinkByName
+80228b18 EGG::G3DUtility::SetMaterialTexObj
+80228dcc EGG::GXUtility::getTexCoordGenVal
+80228dd8 EGG::GXUtility::setScaleOffsetPerspective
+80228e18 EGG::GXUtility::getTexObj
+80228f18 VecToRgb
+8022900c EGG::GfxEngine::Create
+80229068 EGG::GfxEngine::Params::__dt
+802290a8 EGG::GfxEngine::Initialize
+80229214 EGG::GfxEngine::BeginDraw
+80229328 EGG::GfxEngine::__ct
+80229344 EGG::GfxEngine::Params::__ct
+80229420 EGG::GfxEngine::__dt
+80229460 EGG::EGG_GxUtil_Smth
+8022947c SetsUpdatesandDitherGX
+8022953c 0x8022953c
+80229540 EGG::GraphicsFIfo::__ct
+802295a8 EGG::GraphicsFIfo::__dt
+80229640 EGG::GraphicsFIfo::Create
+802296a8 EGG::Heap::Initialize
+802296e8 EGG::Heap::__ct
+80229780 EGG::Heap::__dt
+80229814 EGG::Heap::Alloc
+80229ad4 EGG::Heap::FindParentHeap
+80229adc EGG::Heap::FindContainHeap
+80229b84 EGG::Heap::Free
+80229c5c EGG::Heap::Dispose
+80229cb0 EGG::Heap::DumpAll
+80229d74 EGG::Heap::BecomeCurrentHeap
+80229dcc new
+80229dd8 new
+80229de0 new
+80229df0 new_a
+80229dfc new_a
+80229e04 new_a
+80229e14 delete
+80229ee0 delete_a
+80229fac EGG::IScnProc::__dt
+8022a05c EGG::IScnProc::CreateProcs
+8022a164 EGG::IScnProc::Configure
+8022a210 EGG::IScnProc::InsertProcsToScnGroup(nw4r::g3d::ScnGroup*)
+8022a294 EGG::IScnProc::RemoveFromScnGroup
+8022a314 EGG::IScnProc::Run
+8022a38c EGG::LightMgr::__ct
+8022a49c EGG::LightMgr::SetMaxCounts
+8022a4a8 EGG::LightMgr::InitAmbientLights
+8022a5bc EGG::LightMgr::Update
+8022a6b4 EGG::LightMgr::8022a6b4
+8022a780 EGG::LightMgr::8022A780
+8022a7ac EGG::LightMgr::G3dUpdate
+8022a870 EGG::LightMgr::G3dCall
+8022a8e0 EGG::LightMgr::GetBinaryType
+8022a8f0 EGG::LightMgr::SetBinaryImpl
+8022aee4 EGG::LightMgr::GetBinaryImpl
+8022afd8 EGG::LightMgr::DoubleMount
+8022b414 EGG::LightObject::Load
+8022b424 EGG::LightObject::CombineLoad
+8022b434 EGG::LightObject::OnMgrSave
+8022b664 EGG::LightObject::GetBinarySize
+8022b66c EGG::LightMgr::__dt
+8022b6ac EGG::LightMgr::GetBinarySize
+8022b6cc EGG::LightMgr::GetVersion
+8022b6d4 EGG::LightObject::__ct
+8022b7c0 EGG::LightObject::Init
+8022b8d0 EGG::LightObject::RecalcColors
+8022b9dc EGG::LightObject::CalcViewCoords
+8022bc00 EGG::LightObject::GetColorInfo
+8022bd04 EGG::LightObject::8022bd04
+8022bf34 EGG::LightObject::UpdateG3dLightObject
+8022c09c EGG::LightObject::G3dCall
+8022c1bc EGG::LightObject::CalcDir
+8022c260 EGG::LightObject::CalcDestination
+8022c2a4 EGG::LightObject::GetBinaryType
+8022c2b4 EGG::LightObject::SetBinaryImpl
+8022c958 EGG::LightObject::GetBinaryImpl
+8022ca4c EGG::LightObject::DoubleMount
+8022d0f0 EGG::LightObject::GetVersion
+8022d0f8 SetUpKonstClrTevStage
+8022d24c SetUpTripleColorStageWithIndirect
+8022d3f8 SetUpDoubleColorStage
+8022d578 CreateGradientMaps
+8022d730 EGG::LightTexture::__ct
+8022d9ac EGG::LightTexture::__dt
+8022da48 EGG::LightTexture::Configure
+8022da98 0x8022da98
+8022dc9c getViewportDimensions
+8022dce8 EGG::LightTexture::Draw
+8022dd68 EGG::LightTexture::SetupTevInfo
+8022dfa8 EGG::LightTexture::SetupNextTevStage
+8022e2bc EGG::LightTexture::SetupTevFinish
+8022e410 EGG::LightTexture::CopyFromEFB
+8022e4c4 EGG::LightTexture::GetMagic
+8022e4d4 EGG::LightTexture::SetBinaryImpl
+8022e6dc EGG::LightTexture::GetBinaryImpl
+8022e77c EGG::LightTexture::DoubleMount
+8022e780 EGG::LightTexture::GetVersion
+8022e788 EGG::LightTexture::GetBinarySize
+8022e79c EGG::LightTexture::SetBinaryImpl(thunk)
+8022e7a4 EGG::LightTexture::GetBinaryImpl(thunk)
+8022e7ac EGG::LightTexture::GetBinaryType(thunk)
+8022e7b4 EGG::LightTexture::GetBinarySize(thunk)
+8022e7bc EGG::LightMap::__ct
+8022e93c EGG::LightMap::InitTexConfig
+8022eaa4 EGG::LightMap::CreateLightTexturesByPrefix
+8022ebe0 EGG::LightMap::FindTextureByname
+8022ec54 EGG::LightMap::Doupdate
+8022ece0 EGG::LightMap::Update
+8022ed20 EGG::LightMap::SendToGPU
+8022f298 EGG::LightMap::GetBinaryType
+8022f2a8 EGG::LightMap::SetBinaryImpl
+8022f358 EGG::LightMap::GetBinaryImpl
+8022f3dc EGG::LightMap::DoubleMount
+8022f3e0 EGG::LightMap::GetVersion
+8022f3e8 EGG::IBinary::SetBinary
+8022f3f8 EGG::LightTexture::8022f3f8
+8022f708 EGG::LightMap::GetBinarySize
+8022f710 EGG::Link::__ct
+8022f720 EGG::List::__dt
+8022f760 EGG::List::__ct
+8022f77c EGG::List::Add
+8022f7ec EGG::List::__ct(Copy)
+8022f804 EGG::List::GetFirst
+8022f80c EGG::Math::Sqrt
+8022f85c EGG::Math::FrSqrt
+8022f860 EGG::Math::Sin
+8022f86c EGG::Math::Cos
+8022f878 EGG::Math::Tan
+8022f89c EGG::Math::Asin
+8022f8c0 EGG::Math::Acos
+8022f8e4 EGG::Math::Atan2
+8022f90c EGG::Matrix34f::TryInverseTo
+8022fabc EGG::Matrix34f::InverseTo
+8022fac0 EGG::Matrix34f::InverseTransposeTo
+8022fac4 EGG::Matrix34f::MakeIdentity
+8022fb04 EGG::Matrix34f::CalcRPY
+8022fbf0 EGG::Matrix34f::Set
+8022fc34 EGG::Matrix34f::MakeSRT
+8022fe14 EGG::Matrix34f::MakeRT
+8022ff98 EGG::Matrix34f::MakeR
+802300c8 EGG::Matrix34f::MakeST
+80230118 EGG::Matrix34f::MakeQT
+802301d0 EGG::Matrix34f::MakeQ
+80230280 EGG::Matrix34f::MakeS
+802302c4 EGG::Matrix34f::MakeT
+8023030c EGG::Matrix34f::MakeQ2
+802303bc EGG::Matrix34f::SetAxisRotation
+802303f8 EGG::Matrix34f::MultVector
+8023040c EGG::Matrix34f::LoadPosMtx
+80230410 EGG::Matrix34f::MultiplyTo
+80230414 0x80230414
+80230458 EGG::ScnMdlEx::__ct
+80230690 EGG::ScnMdlEx::__dt
+80230718 EGG::ScnMdlEx::GetViewMtxCount
+8023074c eggMdlEx_8023074C
+802307fc eggScnMdlEx_BigThing
+80230ae0 EGG::EggMdlEx_80230AE0
+80230c4c EGG::ScnMdlEx::SearchNodeMatSample
+80230da0 EGG::ScnMdlEx::ReplaceMatsGXTexObj
+80230fd4 EGG::ScnMdlEx::GetResMdl
+8023101c EGG::ScnMdlEx::GetResMat
+802310ac eggMdlEx_802310AC
+802310e0 EGG::EggMdlEx_802310E0
+8023112c EGG::ScnMdlEx::GetResMatMisc
+802311ec eggMdlEx_802311EC
+802313d4 EGG::NWC24Handler::__ct
+80231434 EGG::NWC24Handler::__dt
+802314e0 EGG::NWC24Handler::OpenLib
+8023152c 0x8023152c
+80231554 EGG::NWC24Handler::OpenLib_switch
+80231558 EGG::NWC24Handler::OpenLib_caseD_0
+80231578 EGG::NWC24Handler::OpenLib_caseD_ffffffcf
+80231590 EGG::NWC24Handler::OpenLib_caseD_ffffffe3
+802315d4 EGG::NWC24Handler::OpenLib_caseD_ffffffe5
+802315e8 EGG::NWC24Handler::OpenLib_caseD_ffffffd0
+80231618 EGG::NWC24Handler::CloseLib
+802316d4 EGG::NWC24Handler::GetMyUserId
+80231734 EGG::NWC24Handler::CheckUserId
+802317c0 EGG::NWC24Handler::vf_0x1c
+80231884 EGG::NWC24Handler::InitMsgObj
+80231908 EGG::NWC24Handler::SetMsgToId
+80231994 EGG::NWC24Handler::SetMsgToAddr
+80231a28 EGG::NWC24Handler::SetMsgSubject
+80231ac0 EGG::NWC24Handler::SetMsgText
+80231b64 EGG::NWC24Handler::SetMsgAttached
+80231bfc EGG::NWC24Handler::SetMsgTag
+80231c88 EGG::NWC24Handler::SetMsgLedPattern
+80231d18 EGG::NWC24Handler::GetMsgType
+80231d9c EGG::NWC24Handler::GetMsgFromId
+80231e20 EGG::NWC24Handler::GetMsgNumTo
+80231ea4 EGG::NWC24Handler::GetMsgNumAttached
+80231f28 EGG::NWC24Handler::GetMsgAttachedSize
+80231fb0 EGG::NWC24Handler::GetMsgAttachedType
+80232038 EGG::NWC24Handler::GetMsgDate
+8023209c EGG::NWC24Handler::GetMsgTag
+80232100 EGG::NWC24Handler::GetMsgId
+80232164 EGG::NWC24Handler::GetMsgAppId
+802321c8 EGG::NWC24Handler::ReadMsgFromAddr
+802322a4 EGG::NWC24Handler::ReadMsgToId
+802322e8 EGG::NWC24Handler::ReadMsgToId_switch
+802322ec EGG::NWC24Handler::ReadMsgToId_caseD_0
+80232300 EGG::NWC24Handler::ReadMsgToId_caseD_ffffffd2
+80232314 EGG::NWC24Handler::ReadMsgToId_caseD_ffffffe8
+80232328 EGG::NWC24Handler::ReadMsgToId_caseD_ffffffd3
+80232350 EGG::NWC24Handler::ReadMsgToAddr
+802323a0 EGG::NWC24Handler::ReadMsgToAddr_switch
+802323a4 EGG::NWC24Handler::ReadMsgToAddr_caseD_0
+802323b8 EGG::NWC24Handler::ReadMsgToAddr_caseD_ffffffd2
+802323cc EGG::NWC24Handler::ReadMsgToAddr_caseD_fffffff3
+802323e0 EGG::NWC24Handler::ReadMsgToAddr_caseD_ffffffd3
+8023240c EGG::NWC24Handler::ReadMsgSubject
+802324f8 EGG::NWC24Handler::ReadMsgText
+802325e8 EGG::NWC24Handler::ReadMsgAttached
+80232630 EGG::NWC24Handler::ReadMsgAttached_switch
+80232634 EGG::NWC24Handler::ReadMsgAttached_caseD_0
+80232648 EGG::NWC24Handler::ReadMsgAttached_caseD_ffffffd2
+8023265c EGG::NWC24Handler::ReadMsgAttached_caseD_fffffff2
+80232670 EGG::NWC24Handler::ReadMsgAttached_caseD_ffffffd3
+80232698 eggNwc24_80232698
+802326d4 eggNwc24_80232698_switch
+802326d8 eggNwc24_80232698_caseD_0
+802326ec eggNwc24_80232698_caseD_ffffffd2
+80232700 eggNwc24_80232698_caseD_ffffffe8
+80232714 eggNwc24_80232698_caseD_ffffffd3
+80232740 EGG::NWC24Handler::CommitMsg
+8023277c EGG::NWC24Handler::DeleteMsg
+802327bc EGG::NWC24Handler::DeleteMsg_switch
+802327c0 EGG::NWC24Handler::DeleteMsg_caseD_0
+802327d4 EGG::NWC24Handler::DeleteMsg_caseD_ffffffd2
+802327e8 EGG::NWC24Handler::DeleteMsg_caseD_ffffffe5
+802327fc EGG::NWC24Handler::DeleteMsg_caseD_ffffffd3
+80232824 EGG::NWC24Handler::SetMsgAltName
+802328ac EGG::NWC24Handler::SetMsgMBNoReply
+80232938 EGG::NWC24Handler::SetMsgMBRegDate
+802329e8 EGG::NWC24Handler::SetMsgMBDelay
+80232a74 EGG::NWC24Handler::ReadMsgAltName
+80232b3c EGG::NWC24Handler::ReadMsgMBNoReply
+80232c30 EGG::NWC24Handler::ReadMsgMBRegDate
+80232c80 EGG::NWC24Handler::ReadMsgMBRegDate_switch
+80232c84 EGG::NWC24Handler::ReadMsgMBRegDate_caseD_0
+80232c98 EGG::NWC24Handler::ReadMsgMBRegDate_caseD_ffffffd2
+80232cac EGG::NWC24Handler::ReadMsgMBRegDate_caseD_ffffffe8
+80232cc0 EGG::NWC24Handler::ReadMsgMBRegDate_caseD_ffffffd3
+80232cec EGG::NWC24Handler::ReadMsgMBDelay
+80232d34 EGG::NWC24Handler::ReadMsgMBDelay_switch
+80232d38 EGG::NWC24Handler::ReadMsgMBDelay_caseD_0
+80232d4c EGG::NWC24Handler::ReadMsgMBDelay_caseD_ffffffd2
+80232d60 EGG::NWC24Handler::ReadMsgMBDelay_caseD_ffffffe8
+80232d74 EGG::NWC24Handler::ReadMsgMBDelay_caseD_ffffffd3
+80232da0 EGG::NWC24Handler::ReadFriendInfo
+80232de0 EGG::NWC24Handler::ReadFriendInfo_switch
+80232de4 EGG::NWC24Handler::ReadFriendInfo_caseD_0
+80232df8 EGG::NWC24Handler::ReadFriendInfo_caseD_ffffffd2
+80232e0c EGG::NWC24Handler::ReadFriendInfo_caseD_ffffffe5
+80232e20 EGG::NWC24Handler::ReadFriendInfo_caseD_ffffffd3
+80232e48 EGG::NWC24Handler::IsFriendInfoInThere
+80232e8c EGG::NWC24Handler::IsFriendInfoInThere_switch
+80232e90 EGG::NWC24Handler::IsFriendInfoInThere_caseD_1
+80232eac EGG::NWC24Handler::IsFriendInfoInThere_caseD_0
+80232ec4 EGG::NWC24Handler::IsFriendInfoInThere_caseD_ffffffd2
+80232ed8 0x80232ed8
+80232eec 0x80232eec
+80232f18 EGG::NWC24Handler::GetNumFriendInfos
+80232f54 EGG::NWC24Handler::GetNumFriendInfos_switch
+80232f58 EGG::NWC24Handler::GetNumFriendInfos_caseD_0
+80232f6c EGG::NWC24Handler::GetNumFriendInfos_caseD_ffffffd2
+80232f80 EGG::NWC24Handler::GetNumFriendInfos_caseD_ffffffe5
+80232f94 EGG::NWC24Handler::GetNumFriendInfos_caseD_ffffffd3
+80232fbc EGG::NWC24Handler::InitSearchConds
+80233038 EGG::NWC24Handler::SetSearchCondMsgBox
+802330c0 EGG::NWC24Handler::SearchMsgs
+80233184 0x80233184
+8023318c SchedSuspendTransError
+802331ac SchedSuspendTransError_switch
+802331b0 SchedSuspendTransError_caseD_0
+802331b8 SchedSuspendTransError_caseD_ffffffd6
+802331c0 SchedSuspendTransError_caseD_ffffffd0
+802331c8 SchedSuspendTransError_caseD_ffffffcf
+802331d0 SchedSuspendTransError_caseD_ffffffd2
+802331d8 SchedSuspendTransError_caseD_ffffffda
+802331e0 SchedSuspendTransError_caseD_ffffffdf
+802331e8 SchedSuspendTransError_caseD_ffffffd9
+802331f8 KeepErrorSuspendSched
+8023321c EGG::CompressGBAOdh::CreateImage
+802333b8 EGG::CompressGBAOdh::Initialize
+8023354c EGG::CompressGBAOdh::Process
+802339d4 0x802339d4
+80233a90 0x80233a90
+80233c94 EGG::CompressGBAOdh::WriteImageHeader
+80233d00 EGG::CompressGBAOdh::ColorConversion
+80233e34 0x80233e34
+8023407c 0x8023407c
+8023445c 0x8023445c
+80234950 EGG::AJPGCreator::__ct
+802349b0 EGG::AJPGCreator::CreateImage
+80234a00 0x80234a00
+80234a04 EGG::ProcessMeter::callbackDrawSyncStatic
+80234a54 EGG::PostEffect::__ct
+80234aac EGG::PostEffect::Draw
+80234b40 EGG::PostEffect::PreDraw
+80234b44 0x80234b44
+80234ba4 EGG::PostEffect::SetVtxState
+80234bac EGG::PostEffect::DrawDL
+80234c38 EGG::PostEffect::LoadTexObj
+80234cc0 setChanInfo
+80234d2c setNoIndStages
+80234d34 EGG::EGG__PostEffectBase2_SetAlphaZFogBlend
+80234dc8 EGG::EGG__PostEffectBase2_SetBlendMode
+80234de8 EGG::EGG__PostEffectBase2_SetBlendMode_switch
+80234dec EGG::EGG__PostEffectBase2_SetBlendMode_caseD_0
+80234df4 EGG::EGG__PostEffectBase2_SetBlendMode_caseD_1
+80234dfc EGG::EGG__PostEffectBase2_SetBlendMode_caseD_2
+80234e04 EGG::EGG__PostEffectBase2_SetBlendMode_caseD_3
+80234e0c EGG::EGG__PostEffectBase2_SetBlendMode_caseD_4
+80234e20 EGG::EGG__PostEffectBase2_SetBlendMode_caseD_5
+80234e28 EGG::EGG__PostEffectBase2_SetBlendMode_caseD_6
+80234e3c EGG::EGG__PostEffectBase2_SetBlendMode_caseD_7
+80234e44 EGG::EGG__PostEffectBase2_SetBlendMode_caseD_8
+80234e58 EGG::EGG__PostEffectBase2_SetBlendMode_caseD_9
+80234e6c EGG::EGG__PostEffectBase2_SetBlendMode_caseD_a
+80234e78 Util__GXColorScale
+80234fdc 0x80234fdc
+802350fc 0x802350fc
+802351f0 EGG::PostEffectBlur::__ct
+8023533c EGG::PostEffectBlur::Draw
+802354cc EGG::PostEffectBlur::SetupTevStages
+80235980 EGG::PostEffectBloom::__ct
+80235a40 EGG::PostEffectBloom::PreDraw
+80235dfc EGG::PostEffectSimple::__ct
+80235e80 EGG::PostEffectSimple::__dt
+80236250 EGG::PostEffectOutline::__ct
+80236448 EGG::PostEffectOutline::Draw
+8023671c EGG::PostEffectOutline::PreDraw
+80236bd8 EGG::PostEffectOutline::__dt
+80236c18 0x80236c18
+80236cd8 0x80236cd8
+80236e78 0x80236e78
+80237168 EGG::TexThreshold::construct
+802371e4 EGG::TexThreshold::drawSetup
+80237624 EGG::EGG_DofSub80_CT
+80237784 0x80237784
+80237ab4 0x80237ab4
+80237c28 0x80237c28
+8023826c 0x8023826c
+80238274 0x80238274
+8023827c 0x8023827c
+80238284 EGG::TintTex::construct
+802382f8 EGG::TintTex::drawSetup
+802384fc EGG::ShadowTextureDirector::CreateInstance
+80238540 EGG::ShadowTextureDirector::__dt
+80238580 EGG::ShadowTextureDirector::__ct
+802385b8 EGG::ShadowTextureDirector::Insert
+80238604 EGG::ShadowTextureDirector::Remove
+80238674 EGG::ShadowTextureDirector::DrawAll
+802386dc EGG::CpuMonitor::measureBegin
+80238714 EGG::CpuMonitor::measureEnd
+80238750 EGG::CpuMonitor::show
+80238760 EGG::CpuMonitor::hide
+80238770 EGG::CpuGpMonitor::measureBegin
+802387bc EGG::CpuGpMonitor::measureEnd
+80238804 EGG::CpuGpMonitor::show
+80238820 EGG::CpuGpMonitor::hide
+8023883c EGG::ProcessMeter::__ct
+80238a94 EGG::ProcessMeter::measureBeginFrame
+80238d10 EGG::ProcessMeter::measureEndFrame
+80238d20 EGG::ProcessMeter::measureBeginRender
+80238d30 EGG::ProcessMeter::measureEndRender
+80238d40 EGG::ProcessMeter::callbackDrawSync
+80238d8c EGG::ProcessMeter::Run
+80238e38 EGG::ProcessMeter::setDrawSync
+80238f14 EGG::ProcessMeter::setVisible
+80238f3c EGG::ProcessMeter::isVisible
+80238f48 EGG::ProcessMeter::append
+80238f54 EGG::ProcessMeter::append(gpMonitor)
+80238fa4 EGG::ProcessMeter::draw
+80239338 EGG::ProcessMeter::draw(virtual)
+802393e0 EGG::ProcessMeter::drawSetting
+80239628 EGG::ProcessMeter::__dt
+80239680 EGG::ProcessMeter::isVisible
+80239688 EGG::ProcessMeter::setVisible
+80239690 EGG::ProcessMeter::draw
+80239698 EGG::ProcessMeter::callbackDrawSync
+802396a0 EGG::ProcessMeter::measureEndRender
+802396a8 EGG::ProcessMeter::measureBeginRender
+802396b0 EGG::ProcessMeter::measureEndFrame
+802396b8 EGG::ProcessMeter::measureBeginFrame
+802396c0 ProjectionData_unProject
+80239844 ProjectionData_unProjectToXYPlane
+80239928 ProjectionData_unProjectToXZPlane
+802399f0 0x802399f0
+802399f4 0x802399f4
+80239a74 bokuClass_VF1
+80239b68 0x80239b68
+80239b80 0x80239b80
+80239b94 0x80239b94
+80239bb4 0x80239bb4
+80239bb8 0x80239bb8
+80239cd8 0x80239cd8
+80239cdc 0x80239cdc
+80239d3c 0x80239d3c
+80239dac 0x80239dac
+80239db4 0x80239db4
+80239dec 0x80239dec
+80239df4 0x80239df4
+80239df8 0x80239df8
+80239dfc EGG::Quatf::Set
+80239e10 EGG::Quatf::SetRPY(Vec)
+80239f58 EGG::Quatf::SetRPY(Floats)
+8023a0a0 EGG::Quatf::SetAxisRotation
+8023a138 EGG::Quatf::Norm
+8023a168 EGG::Quatf::Normalise
+8023a210 EGG::Quatf::Inverse
+8023a2d0 EGG::Quatf::RotateVector
+8023a404 EGG::Quatf::RotateVectorConjugate
+8023a540 EGG::Quatf::MultiplyVector
+8023a5c4 EGG::Quatf::SlerpTo
+8023a788 EGG::Quatf::MakeVectorRotation
+8023a884 EGG::SaveBanner::create
+8023a8ec EGG::SaveBanner::InitBanner
+8023aa04 EGG::SaveBanner::ExistBannerFile
+8023aa78 EGG::SaveBanner::CreateBannerFile
+8023ab54 EGG::SaveBanner::SaveBannerFile
+8023ab5c EGG::SaveBanner::IsErrorOccured
+8023ab64 EGG::SaveBanner::__ct
+8023abd8 EGG::SaveBanner::__dt
+8023ac3c EGG::SaveBanner::SaveBannerFile(idx)
+8023ad10 EGG::Scene::__ct
+8023ad84 EGG::Scene::__dt
+8023addc EGG::SceneManager::__ct
+8023ae4c EGG::SceneManager::fadeIn
+8023ae60 EGG::SceneManager::calc
+8023aeac EGG::SceneManager::draw
+8023aef8 EGG::SceneManager::reinitCurrentScene
+8023af18 EGG::SceneManager::reinitCurrentSceneAfterFadeOut
+8023af84 EGG::SceneManager::changeUncleScene
+8023afe0 EGG::SceneManager::changeSiblingScene
+8023afe8 EGG::SceneManager::changeSiblingSceneAfterFadeOut
+8023b064 EGG::SceneManager::changeScene
+8023b0e4 EGG::SceneManager::createScene
+8023b248 EGG::SceneManager::createChildScene
+8023b2ac EGG::SceneManager::destroyCurrentScene
+8023b344 EGG::SceneManager::destroyToSelectSceneID
+8023b3f0 EGG::SceneManager::destroyScene
+8023b568 EGG::SceneManager::incomingCurrentScene
+8023b588 EGG::SceneManager::calcCurrentScene
+8023b5a8 EGG::SceneManager::calcCurrentFader
+8023b800 EGG::SceneManager::drawCurrentScene
+8023b890 EGG::SceneManager::drawCurrentFader
+8023b8b0 EGG::SceneManager::createDefaultFader
+8023b910 EGG::SceneManager::setupNextSceneID
+8023b92c EGG::SceneManager::outgoingParentScene
+8023b940 EGG::SceneManager::FindParentScene
+8023b980 EGG::ScnRenderer::__ct
+8023ba18 EGG::ScnRenderer::__dt
+8023bb10 EGG::ScnRenderer::GetDrawPathCount
+8023bb18 EGG::ScnRenderer::Init
+8023bc00 0x8023bc00
+8023bc4c EGG::ScnRenderer::Init_switch
+8023bc50 EGG::ScnRenderer::Init_caseD_0
+8023bc5c EGG::ScnRenderer::Init_caseD_1
+8023bc68 EGG::ScnRenderer::Init_caseD_2
+8023bc74 EGG::ScnRenderer::Init_caseD_3
+8023bc80 EGG::ScnRenderer::Init_caseD_6
+8023bc90 EGG::ScnRenderer::Init_caseD_4
+8023bca0 EGG::ScnRenderer::Init_caseD_5
+8023bcb0 EGG::ScnRenderer::Init_caseD_7
+8023bcc8 EGG::ScnRenderer::Init_caseD_8
+8023bce0 EGG::ScnRenderer::Init_caseD_9
+8023bd30 EGG::ScnRenderer::GetTimingCount
+8023bd38 EGG::ScnRenderer::CreatePath
+8023c04c EGG::ScnRenderer::Attach
+8023c0d8 EGG::ScnRenderer::Detach
+8023c164 EGG::ScnRenderer::SetScnRoot
+8023c280 EGG::ScnRenderer::Draw
+8023c328 EGG::ScnRenderer::SetPriorityDrawOpa
+8023c394 EGG::ScnRenderer::SetPriorityDrawXlu
+8023c400 EGG::ScnRenderer::ConfigureProc
+8023c484 EGG::ScnRenderer::AfterUpdateFrame
+8023c49c EGG::ScnRenderer::DrawBeforeCalcView
+8023c684 EGG::ScnRenderer::__dt
+8023c68c EGG::ScnRenderer::Draw(thunk)
+8023c694 EGG::ScnRootEx::__ct
+8023c748 EGG::ScnRootEx::__dt
+8023c7e8 EGG::ShadowTextureManager::__dt
+8023c828 EGG::ScnRootEx::Init
+8023c838 EGG::ScnRootEx::RemoveShadowTextureMgr
+8023c88c EGG::ScnRenderer::SetLightMgr
+8023c894 EGG::ScnRenderer::SetFogMgr
+8023c89c EGG::ScnRootEx::UpdateFrame
+8023c8ec EGG::ScnRootEx::vf_0x1c
+8023c8f0 EGG::ScnRootEx::CalcMaterial
+8023c908 EGG::ScnRootEx::CalcVtx
+8023c920 EGG::ScnRootEx::CalcWorld
+8023c98c EGG::ScnRootEx::UpdateCamera
+8023ca18 EGG::ScnRootEx::DrawBeforeCalcViewThenCalc
+8023ca88 EGG::ScnRootEx::GatherDrawScnObj
+8023caa0 EGG::ScnRootEx::ZSort
+8023cab8 EGG::ScnRootEx::DrawOpa
+8023cb10 EGG::ScnRootEx::DrawXlu
+8023cb68 EGG::ScnRootEx::BeforeCalcWorld
+8023cbc0 EGG::ScnRootEx::AfterCalcWorld
+8023cc50 EGG::ScnRootEx::SetCamera
+8023ccd4 EGG::ScnRootEx::DrawBeforeCalcView
+8023ce20 EGG::ScnRootEx::AfterDrawOpa
+8023ce24 EGG::ScnRootEx::AfterDrawXlu
+8023ce28 EGG::ScnRootEx::CalcView
+8023ce64 EGG::ScnRootEx::DoneDraw
+8023cec8 EGG::ScnRootEx::SetScnRoot
+8023ced8 EGG::ScnRootEx::SetGXDrawSettings
+8023cf48 EGG::ScnRootEx::GetLightObjects
+8023d0f8 EGG::Screen::CreateDummy
+8023d2b4 EGG::Screen::__ct
+8023d380 EGG::Screen::__ct(args)
+8023d448 EGG::Screen::__ct(copy)
+8023d4e8 EGG::Screen::LoadDirectly
+8023d67c EGG::Screen::CopyToG3D
+8023d840 EGG::Screen::CopyFromAnother
+8023d934 EGG::Screen::GetPosSizeInEFB
+8023dbd8 EGG::Screen::GetEFBParams
+8023dc34 EGG::Screen::IsChangeEFB
+8023ddc8 EGG::Frustum::IsDirty
+8023ddd4 EGG::Screen::CalcMtxForDrawQuad
+8023de7c EGG::Screen::FillBufferGX
+8023e040 EGG::Screen::GetGlobalPos
+8023e40c EGG::Screen::8023E40C
+8023e438 EGG::Screen::8023E438
+8023e484 EGG::Screen::GetParent
+8023e48c EGG::Screen::SetTVMode
+8023e53c EGG::Screen::SetTVModeDefault
+8023e600 0x8023e600
+8023e700 EGG_Screen_cpp_sinit_
+8023e724 EGG::ScreenEffect::__ct
+8023e73c 0x8023e73c
+8023e748 EGG::OutlineEffect::__ct
+8023e86c EGG::OutlineEffect::__dt
+8023e90c EGG::OutlineEffect::SetupDraw
+8023ef90 EGG::OutlineEffect::Draw
+8023f15c 0x8023f15c
+8023f230 0x8023f230
+8023f4a4 0x8023f4a4
+8023f690 0x8023f690
+8023fa1c 0x8023fa1c
+8023ff10 0x8023ff10
+8023ff24 EGG::ShadowTextureManager::__ct
+8023ff88 EGG::ShadowTextureManager::Calc
+80240000 0x80240000
+80240048 EGG::ShadowTextureManager::Draw
+802402e0 shadTex_802402E0
+80240358 EGG::EGG__GlobalScreenCapture_Take
+80240844 EGG::EGG__GlobalScreenCapture_Release
+802408c0 EGG::EGG__PS_GlobalScreenCapture_Take
+80240988 EGG::ScreenEffect::SetupGX
+80240c78 EGG::EGG__UpdateViewport2
+80240e00 0x80240e00
+80240e0c EGG::EGG__GlobalScreenCapture__AsRGB565
+80240e18 EGG::StateGX::Initialize
+80240eb4 EGG::StateGX::InitFrame
+80240f68 EGG::StateGX::ResetGX
+80240fb0 EGG::StateGX::ResetVtx
+802410ec EGG::StateGX::ResetChannels
+802411c8 EGG::StateGX::ResetIndirect
+80241240 EGG::StateGX::ResetTextures
+802412c8 EGG::StateGX::ResetTexCoordGen
+80241380 EGG::StateGX::ResetTevs
+80241530 EGG::StateGX::ResetPE
+802415e8 EGG::StateGX::ResetCachedState
+80241668 EGG::StateGX::SetPixelFmt
+802416fc EGG::StateGX::SetProjection
+802417fc EGG::StateGX::SetProjectionv
+802418d0 EGG::StateGX::SetViewport
+802419fc EGG::StateGX::SetScissor
+80241acc EGG::StateGX::SetScissorBoxOffset
+80241b60 Stream_destroy
+80241ba0 Stream_read_u32
+80241bfc Stream_readString
+80241c68 Stream__read
+80241ce0 Stream_copyToTextBuffer
+80241eac Stream_getNextToken
+80241f0c Stream_isSpace
+80241f9c Stream_isUpperSJIS
+80241fcc Stream_skipSpace
+802421d4 RamStream_construct
+80242218 0x80242218
+80242328 RamStream_peek_u32
+80242364 0x80242364
+80242474 RamStream_eof
+80242490 0x80242490
+80242494 0x80242494
+80242498 EGG::StreamDecompLZ::init
+802424c8 EGG::StreamDecompLZ::decomp
+802424f4 EGG::StreamDecompLZ::getAlignment
+802424fc EGG::StreamDecompLZ::getUncompressedSize
+80242504 EGG::TSystem::InitMemory
+8024269c EGG::TSystem::Run
+802428e8 EGG::TaskThread::Create
+80242b94 EGG::TaskThread::TJob::__ct
+80242ba8 EGG::TaskThread::DeleteTaskThread
+80242c18 EGG::TaskThread::Request
+80242c98 EGG::TaskThread::IsTaskExist
+80242cd4 EGG::TaskThread::__dt
+80242d2c EGG::TaskThread::OnEnter
+80242d54 EGG::TaskThread::OnExit
+80242d7c EGG::TaskThread::Run
+80242e54 EGG::TaskThread::__ct
+80242eb8 EGG::TaskThread::GetFreeTJob
+80242f1c EGG::TextureBuffer::Configure
+80242f90 EGG::TextureBuffer::Free
+80243080 EGG::TextureBuffer::Initialize
+80243174 EGG::TextureBuffer::Get
+8024319c EGG::TextureBuffer::Alloc
+80243284 EGG::TextureBuffer::__dt
+802432e0 EGG::Thread::__ct(Heap)
+802433ac EGG::Thread::__ct(OS::Thread)
+8024341c EGG::Thread::__dt
+802434d8 EGG::Thread::FindThread
+8024353c EGG::Thread::KandoTestCancelAllThread
+802435a4 EGG::Thread::Initialize
+802435dc EGG::Thread::SwitchThreadCallback
+802436e0 EGG::Thread::SetCommonMesgQueue
+8024373c EGG::Thread::Run
+8024374c 0x8024374c
+80243754 EGG::UnitHeap::__dt
+802437c8 EGG::UnitHeap::__ct
+80243914 EGG::UnitHeap::destroy
+80243984 EGG::UnitHeap::alloc
+802439a4 EGG::UnitHeap::free
+802439ac EGG::UnitHeap::resizeForMBlock
+802439b4 EGG::UnitHeap::getAllocatableSize
+802439bc EGG::UnitHeap::adjust
+802439c4 EGG::UnitHeap::initAllocator
+802439d4 EGG::UnitHeap::calcHeapSize
+802439f8 EGG::UnitHeap::getHeapKind
+80243a00 EGG::Vector2f::NormalizeAndGetNorm
+80243a78 EGG::Vector2f::Normalize
+80243adc EGG::Vector3f::NormalizeAndGetNorm
+80243b6c EGG::Vector3f::Normalize
+80243be8 __sinit__eggVector_cpp
+80243d18 EGG::Video::Initialize
+80243d6c EGG::Video::Configure
+80243e70 EGG::Video::GetTickPerVRetrace(format)
+80243ed0 EGG::Video::GetTickPerVRetrace
+80243f34 EGG::Video::GetStandardRenderModeObj
+80244074 Viewport_construct
+802440b4 set__Q23EGG8ViewportFiiii
+80244134 eggViewport_Calc_TODO
+80244160 EGG::Xfb::__ct
+802441ec EGG::Xfb::CalcBufferSize
+80244200 EGG::XfbManager::Attach
+80244268 EGG::XfbManager::CopyEFB
+802442e8 EGG::XfbManager::SetNextFrameBuffer
+80244350 EGG::XfbManager::PostVRetrace
+802443ac nw4r::g3d::ScnRfl::SetLightSetIdx
+802443c8 nw4r::g3d::ScnRfl::SetFogIdx
+802443e4 nw4r::g3d::ScnRfl::SetExpression
+80244420 nw4r::g3d::ScnRfl::SetupCharModel
+802444b0 nw4r::g3d::ScnRfl::ReplaceCharModel
+80244504 nw4r::g3d::ScnRfl::ReleaseCharModel
+8024451c nw4r::g3d::ScnRfl::Construct
+802445ec nw4r::g3d::ScnRfl::G3dProc
+80244920 nw4r::g3d::ScnRfl::CallDrawProc
+80244a94 nw4r::g3d::ScnRfl::LoadDrawSetting
+80244c0c nw4r::g3d::ScnRfl::__ct
+80244cc8 nw4r::g3d::ScnRfl::__dt
+80244d30 nw4r::g3d::ScnRfl::GetTypeObj
+80244d3c nw4r::g3d::ScnRfl::GetTypeName
+80244d6c nw4r::g3d::ScnRfl::IsDerivedFrom
+80244dd4 switchdataD_80274dd4
+802474a0 switchdataD_802474a0
+80270e30 switchdataD_80270e30
+80271190 switchdataD_80271190
+80271270 switchdataD_80271270
+802713c0 switchdataD_802713c0
+802714a0 switchdataD_802714a0
+802714c0 switchdataD_802714c0
+802714e0 switchdataD_802714e0
+80271630 switchdataD_80271630
+80271710 switchdataD_80271710
+802718d0 switchdataD_802718d0
+80271ab8 switchdataD_80271ab8
+80271ad4 switchdataD_80271ad4
+802726a0 rnd_3DModels(NW4R)_802726a0
+802726c0 rnd_Palettes(NW4R)_802726c0
+802726e0 rnd_Textures(NW4R)_802726e0
+80272700 rnd_AnmChr(NW4R)_80272700
+80272720 rnd_AnmVis(NW4R)_80272720
+80272740 rnd_AnmClr(NW4R)_80272740
+80272760 rnd_AnmTexPat(NW4R)_80272760
+80272780 rnd_AnmTexSrt(NW4R)_80272780
+802727a0 rnd_AnmShp(NW4R)_802727a0
+802727c0 rnd_AnmScn(NW4R)_802727c0
+80272810 switchdataD_80272810
+80273088 switchdataD_80273088
+802730b0 switchdataD_802730b0
+80274520 switchdataD_80274520
+80274578 switchdataD_80274578
+80275018 switchdataD_80275018
+80275700 switchdataD_80275700
+80275a20 switchdataD_80275a20
+80275cfc switchdataD_80275cfc
+80276954 switchdataD_80276954
+802775e8 switchdataD_802775e8
+80277d68 switchdataD_80277d68
+80278cf0 switchdataD_80278cf0
+80279af0 switchdataD_80279af0
+80279b10 switchdataD_80279b10
+80279b30 switchdataD_80279b30
+80279b50 switchdataD_80279b50
+80279b94 switchdataD_80279b94
+8027a200 switchdataD_8027a200
+8027a2d8 switchdataD_8027a2d8
+8027a314 switchdataD_8027a314
+8027a350 switchdataD_8027a350
+8027a624 switchdataD_8027a624
+8027b878 switchdataD_8027b878
+8027ba5c switchdataD_8027ba5c
+8027bb2c switchdataD_8027bb2c
+8027bc28 switchdataD_8027bc28
+8027bc44 switchdataD_8027bc44
+8027d1a8 switchdataD_8027d1a8
+8027ddf8 switchdataD_8027ddf8
+80282cb0 switchdataD_80282cb0
+80282cd8 switchdataD_80282cd8
+80282d5c switchdataD_80282d5c
+80282d84 switchdataD_80282d84
+80282f08 switchdataD_80282f08
+80282f2c switchdataD_80282f2c
+80283220 switchdataD_80283220
+80284d2c switchdataD_80284d2c
+80284e58 switchdataD_80284e58
+80284e7c switchdataD_80284e7c
+80284ee8 switchdataD_80284ee8
+80284f08 switchdataD_80284f08
+80285c30 switchdataD_80285c30
+80285cf0 switchdataD_80285cf0
+80285d94 switchdataD_80285d94
+80285e58 switchdataD_80285e58
+80285fc0 switchdataD_80285fc0
+80286054 switchdataD_80286054
+802861e8 switchdataD_802861e8
+80286274 switchdataD_80286274
+80286338 switchdataD_80286338
+802863d0 switchdataD_802863d0
+8028697c switchdataD_8028697c
+80287078 switchdataD_80287078
+80287110 switchdataD_80287110
+80287190 switchdataD_80287190
+802871d8 switchdataD_802871d8
+8028725c switchdataD_8028725c
+802872b4 switchdataD_802872b4
+80287388 switchdataD_80287388
+802873f0 switchdataD_802873f0
+80287488 switchdataD_80287488
+80287528 switchdataD_80287528
+8028758c switchdataD_8028758c
+802875f4 switchdataD_802875f4
+802879e0 switchdataD_802879e0
+80287da8 switchdataD_80287da8
+80287e40 switchdataD_80287e40
+80287e60 switchdataD_80287e60
+80287e80 switchdataD_80287e80
+80288404 switchdataD_80288404
+802884b0 switchdataD_802884b0
+8028855c switchdataD_8028855c
+80288614 switchdataD_80288614
+802886c0 switchdataD_802886c0
+80289fd0 switchdataD_80289fd0
+8028a0a0 switchdataD_8028a0a0
+8028a108 switchdataD_8028a108
+8028a14c switchdataD_8028a14c
+8028a190 switchdataD_8028a190
+8028a1d4 switchdataD_8028a1d4
+8028a1f0 switchdataD_8028a1f0
+8028a378 switchdataD_8028a378
+8028a398 switchdataD_8028a398
+8028a48c switchdataD_8028a48c
+8028a580 switchdataD_8028a580
+8028a658 switchdataD_8028a658
+8028a6b4 switchdataD_8028a6b4
+8028b988 switchdataD_8028b988
+8028b9b0 switchdataD_8028b9b0
+8028ee58 switchdataD_8028ee58
+8028f7dc switchdataD_8028f7dc
+80290820 switchdataD_80290820
+8029c884 switchdataD_8029c884
+8029ce88 switchdataD_8029ce88
+8029da00 switchdataD_8029da00
+8029da24 switchdataD_8029da24
+8029dab0 switchdataD_8029dab0
+8029dc28 switchdataD_8029dc28
+8029dc4c switchdataD_8029dc4c
+8029e530 switchdataD_8029e530
+802a010c switchdataD_802a010c
+802a0870 switchdataD_802a0870
+802a0f68 switchdataD_802a0f68
+802a1870 switchdataD_802a1870
+802a18f8 switchdataD_802a18f8
+802a19dc switchdataD_802a19dc
+802a2370 switchdataD_802a2370
+802a23f8 switchdataD_802a23f8
+802a2480 switchdataD_802a2480
+802a2658 switchdataD_802a2658
+802a2ba0 switchdataD_802a2ba0
+802a31d8 switchdataD_802a31d8
+802a32a0 switchdataD_802a32a0
+802a335c switchdataD_802a335c
+802a3418 switchdataD_802a3418
+802a34d4 switchdataD_802a34d4
+802a3590 switchdataD_802a3590
+802a364c switchdataD_802a364c
+802a3708 switchdataD_802a3708
+802a37c4 switchdataD_802a37c4
+802a3880 switchdataD_802a3880
+802a3940 switchdataD_802a3940
+802a39fc switchdataD_802a39fc
+802a3b88 switchdataD_802a3b88
+802a3e30 switchdataD_802a3e30
+802a4080 rkSystem
+802a40f4 r13_and_stacks
+80385920 dev/fs_fd
+80385924 r13_and_stacks
+80386000 SystemManager
+80387100 r13_and_stacks
+80510238 RelStart
+805103d0 CINS::Disposer__dt
+80510468 CINS::CreateInstance
+805104dc CINS::DestroyInstance
+80510510 CINS::Init
+805105d4 CINS::__dt
+80510670 CINS::GetReqSizeAndInode
+805106b0 CINS::ReportInstallStatus
+805107d0 CINS::InstallChannel
+8051088c CINS::LaunchTitleOrDisk
+80510a30 0x80510a30
+80510a38 0x80510a38
+80510a40 0x80510a40
+80510a50 0x80510a50
+80510a90 isCompetitionValid
+80510ab8 0x80510ab8
+80510b84 0x80510b84
+80510bf0 0x80510bf0
+80510c74 0x80510c74
+80510d7c KMP::Holder<CKPT>::CalcCompletion
+80510f18 0x80510f18
+80510f58 0x80510f58
+80511034 0x80511034
+80511110 KMP::Manager::CalcNextCPRecursive
+80511500 KMP::Manager::CalcNextCP
+80511e00 KMP::Manager::ResetCKPTScannedState
+80511e7c KMP::Manager::CalcExactFinishTime
+80511ec8 KMP::Holder<CKPT>::CalcExactFinishTime
+8051201c Vec2::Operator-
+80512040 Vec2::Operator+
+80512064 KMP::CKPTSection::CalcDistanceFromCPRecursive
+80512370 KMP::CKPTSection::CalcTotalDistance
+80512694 KMP::Manager::CreateInstance
+8051271c KMP::Manager::DestroyInstance
+8051276c KMP::Manager::__ct
+805127ac KMP::Manager::__dt
+805127ec KMP::Manager::Init
+80512c10 KMP::Manager::GetRawKMP
+80512c2c KMP::RawHolder::__ct
+80512c6c KMP::Holder<CAME>::GetType
+80512c78 KMP::Manager::GetCAMECount
+80512c94 KMP::RawHolder::GetVersion
+80512c9c KMP::Holder<CAME>::GetOpeningCamIdx
+80512cac KMP::Holder<AREA>::SetId
+80512cb4 KMP::Manager::GetAREACount
+80512cd0 KMP::Manager::GetEENPTCount
+80512cec KMP::Manager::GetITPTCount
+80512d08 KMP::Manager::GetJGPTCount
+80512d24 KMP::Manager::GetKTPTCount
+80512d40 KMP::Holder<STGI>::IsNarrowGrid
+80512d4c KMP::Holder<STGI>::GetFilterEffectColor
+80512d58 KMP::Holder<STGI>::HasFilterEffect
+80512d64 KMP::Manager::ParseSTGI
+80512e84 KMP::Manager::ParseMSPT
+80512fa4 KMP::Manager::ParseCNPT
+805130c4 KMP::Manager::ParseJGPT
+805131e4 KMP::Manager::ParseCAME
+80513304 KMP::Manager::ParseAREA
+80513398 KMP::Manager::ParsePOTI
+805134c8 KMP::Manager::ParseGOBJ
+80513600 Vec3::__dt
+80513640 KMP::Manager::ParseCKPT
+8051377c KMP::Manager::ParseCKPH
+80513adc KMP::Manager::ParseITPT
+80513bfc KMP::Manager::ParseITPH
+80513d18 KMP::Manager::ParseENPT
+80513e40 KMP::Manager::ParseENPH
+80513f5c KMP::Manager::ParseKTPT
+805140dc KMP::AREASection::GetHolder
+80514100 KMP::JGPTSection::GetHolder
+80514124 KMP::KTPTSection::GetHolder
+80514148 KMP::Manager::GetHolder<GOBJ>
+80514194 KMP::Holder<GOBJ>::GetRoute
+80514208 KMP::KTPTSection::GetBlock
+80514258 KMP::KTPTSection::__ct
+80514368 KMP::Holder<KTPT>::CalcCoordinates_0Indexed
+80514794 0x80514794
+805147d4 Vec3::Operator-(unary)
+805147fc Vec3::RotateQuaternion
+80514810 Vec3::MultiplyByScalar
+80514838 Vec3::Operator+
+8051486c Vec3::Operator-
+805148a0 KMP::Holder<KTPT>::InitLinks
+80514b24 KMP::Holder<KTPT>::CalcCoordinates
+80514b30 KMP::Manager::GetHolder<KTPT>
+80514b7c KMP::Manager::GetHolder<ENPT>
+80514bc8 KMP::Manager::GetHolder<ENPH>
+80514c30 KMP::Manager::CalcExtremes
+80514d3c KMP::Manager::GetHolder<ITPT>
+80514d88 KMP::Manager::GetHolder<ITPH>
+80514df0 KMP::CKPHSection::Init
+80515014 KMP::CKPHSection::GetHolder
+80515098 KMP::Holder<CKPH>::Init
+805150e0 KMP::Holder<CKPH>::CalcDepthRecursive
+80515244 KMP::CKPTSection::Init
+805154e4 KMP::Holder<CKPT>__ct
+805155e0 KMP::LinkedCKPT::__ct
+805155e4 KMP::LinkedCKPT::__dt
+80515624 KMP::Holder<CKPT>::InitLinks
+80515a6c KMP::Holder<CKPT>::InitType
+80515c24 KMP::Manager::GetHolder<CKPT>
+80515c70 KMP::Manager::GetHolder<CKPH>
+80515cbc KMP::Manager::GetCKPHHolderByCT
+80515d3c KMP::Manager::POTISection::__ct
+80515e04 KMP::Manager::GetHolder<POTI>
+80515e50 KMP::AREASection::__ct
+80515f8c KMP::AREASection::SortByPriority
+80516050 KMP::Holder<AREA>::__ct
+805160b0 KMP::Holder<AREA>::IsPointInAREA
+80516138 KMP::Holder<AREA>::GetRouteId
+80516168 KMP::Holder<AREA>::GetRoute
+80516220 KMP::HolderAREABox::__ct
+805163b4 KMP::Holder<AREA>::__dt
+805163f4 KMP::HolderAREABox::IsPointInAREAShape
+805164fc KMP::HolderAREACylinder::__ct
+80516688 KMP::HolderAREACylinder::IsPointInAREAShape
+80516768 KMP::Manager::GetHolder<AREA>
+805167b4 KMP::Manager::GetAREAHolderByPriority
+80516808 KMP::Manager::FindAREA
+80516a60 KMP::Manager::GetMiniMapAREAParams
+80516bb0 KMP::Manager::GetHolder<CAME>
+80516bfc KMP::Manager::GetCAMEHolderFromAREAId
+80516cd4 KMP::Holder<CAME>::GetNext
+80516d4c KMP::IsNonPrivateBattle
+80516d74 KMP::Holder<ENPT>::InitLinks
+80517590 KMP::Manager::GetNextENPT
+8051760c KMP::Manager::GetNextENPTCount
+80517670 KMP::Manager::GetPrevENPT
+805176ec KMP::Manager::GetPrevENPTCount
+80517750 KMP::Manager::ToggleENPH
+80517858 KMP::Holder<ENPH>::ToggleENPHLink
+80517ce4 KMP::Holder<ENPT>::AddPrevLink
+80517d38 KMP::Holder<ENPT>::AddNextLink
+80517d8c KMP::Holder<ENPT>::AddLink
+80517e88 KMP::Holder<ITPT>::InitLinks
+805181f0 KMP::Manager::GetNextITPT
+80518268 KMP::Manager::GetNextITPTCount
+805182cc KMP::Manager::GetPrevITPT
+80518344 KMP::Manager::GetPrevITPTCount
+805183a8 KMP::Holder<JGPT>::__ct
+805184fc KMP::Holder<JGPT>::InitLinks
+80518920 KMP::Manager::GetHolder<JGPT>
+8051896c KMP::Holder<JGPT>::GetPosition
+80518ab8 Vec3::MultiplyByScalar2
+80518ae0 KMP::Manager::GetHolder<CNPT>
+80518b2c KMP::Manager::GetHolder<MSPT>
+80518b78 KMP::Manager::GetHolder<STGI>
+80518bb0 KMP::Holder<STGI>::GetFilterEffectAlpha
+80518bdc KMP::AREASection::__dt
+80518c40 KMP::Holder<ENPT>::__dt
+80518cc0 ArchiveFile::__ct
+80518cf4 ArchiveFile::__dt
+80518dcc ArchiveFile::Mount
+80518e0c 0x80518e0c
+80518e10 ArchiveFile::Load
+80518fa4 ArchiveFile::LoadUncompressed
+80518fbc ArchiveFile::MountFromRawArchive(void*)
+80519040 ArchiveFile::GetFileNewBuffer
+805190e8 0x805190e8
+805190f0 ArchiveFile::Dump
+805191a4 ArchiveFile::TryDump
+80519240 ArchiveFile::ClearAll
+805192c8 0x805192c8
+805192cc ArchiveFile::Unmount
+80519370 ArchiveFile::ClearArchive
+805193c8 ArchiveFile::ClearDump
+80519420 ArchiveFile::GetFile
+80519508 ArchiveFile::Decompress
+805195a4 ArchiveFile::SetDumpToDecompress
+805195d8 ArchiveFile::MountFromRawArchive(ArchiveFile*)
+80519670 Friend::__dt
+805196b0 Friend::SetFriend
+805196f0 Friend::StoreToDest
+80519704 Friend::AddFriend
+80519780 0x80519780
+8051986c 0x8051986c
+80519980 Friend::SetData
+805199d0 Friend::AddLoss
+805199e8 Friend::AddWin
+80519a00 0x80519a00
+80519a4c 0x80519a4c
+80519b1c 0x80519b1c
+80519d34 0x80519d34
+80519dd8 0x80519dd8
+80519fb8 0x80519fb8
+8051a01c 0x8051a01c
+8051a04c 0x8051a04c
+8051a07c KCLController::CanReuseLastTrianglesList
+8051a0f8 0x8051a0f8
+8051a164 0x8051a164
+8051a174 0x8051a174
+8051a1a4 0x8051a1a4
+8051a1ac 0x8051a1ac
+8051a1b4 0x8051a1b4
+8051a1e0 GameScene::__ct
+8051a368 BaseScene::__dt
+8051a3c0 GameScene::__dt
+8051a41c GameScene::FadeIn
+8051a480 GameScene::FadeOut
+8051a4dc GameScene::FinalizeEnter
+8051aa4c GameScene::GetScreenCount
+8051aa54 GameScene::vf_0x58
+8051aa58 GameScene::AddArchivesHolder
+8051aae8 GameScene::UnmountArchives
+8051ab58 GameScene::enter
+8051af84 GameScene::SetFramerate
+8051afe8 GameScene::ChangeScene
+8051b08c 0x8051b08c
+8051b094 GameScene::FadeOutToReinit
+8051b0e0 GameScene::CreateChildScene
+8051b0f4 GameScene::Reset
+8051b1f8 0x8051b1f8
+8051b250 GameScene::exit
+8051b374 BaseScene::ResetRacedataScenarios
+8051b380 0x8051b380
+8051b39c 0x8051b39c
+8051b3c4 GameScene::vf_0x48
+8051b3c8 GameScene::calc
+8051b790 GameScene::isSpectating
+8051b798 GameScene::vf_0x2c
+8051b7a0 GameScene::vf_0x50
+8051b7a8 0x8051b7a8
+8051b7b0 GameScene::reinit
+8051b8d0 GameScene::OnReinit
+8051b8d4 GameScene::isPaused
+8051b8e4 GameScene::CreateHeap
+8051b988 GameScene::DestroyHeap
+8051b9d0 GameScene::vf_0x5c
+8051b9d4 0x8051b9d4
+8051bc78 GameScene::draw
+8051bd34 0x8051bd34
+8051bed0 GameScene::GetCurrent
+8051bf00 0x8051bf00
+8051c00c BaseScene::outgoing_child_create
+8051c010 BaseScene::incoming_child_destroy
+8051c014 0x8051c014
+8051c018 0x8051c018
+8051c01c BaseScene::reinit
+8051c020 BaseScene::exit
+8051c024 BaseScene::enter
+8051c028 BaseScene::draw
+8051c02c BaseScene::calc
+8051c030 0x8051c030
+8051c088 RKG::ClearBuffer
+8051c094 RKG::CheckHeader
+8051c120 RKGFile::CheckValidity
+8051c23c RKGFile::SetCRC32
+8051c270 GhostData::__ct
+8051c334 Timer::__dt
+8051c374 Timer::__ct
+8051c398 GhostData::__ct(RKG)
+8051c4a0 GhostData::Reset
+8051c52c 0x8051c52c
+8051c530 GhostData::ReadRKG
+8051c790 GhostData::Init
+8051c7f4 GhostData::FillHeader
+8051ca0c GhostData::CreateRKGWithoutInputs
+8051ca80 GhostData::CreateRKG
+8051cb1c GhostData::Fill
+8051ce7c Input::Controller::GetType
+8051ce84 0x8051ce84
+8051ce8c Input::ControllerHolder::GetInputsSize
+8051ce94 GhostGroup::__ct
+8051cf90 GhostData::__dt
+8051cff8 GhostGroup::__dt
+8051d064 GhostGroup::DisableGhostData
+8051d084 GhostGroup::GetGhostData
+8051d0bc GhostGroup::ReadRKG
+8051d0e0 RKG::CompressTo
+8051d1b4 RKG::DecompressTo
+8051d388 RKG::GetLength
+8051d4d4 HomeMenuMgr::CreateInstance
+8051d534 HomeMenuMgr::DestroyInstance
+8051d584 HomeMenuMgr::__dt
+8051d5e8 HomeMenuMgr::LoadHBMArc
+8051d69c 0x8051d69c
+8051d6a0 HomeMenuMgr::__ct
+8051d894 HomeMenuMgr::ResetControllerData
+8051d918 HomeMenuMgr::Open
+8051d9f4 HomeMenuMgr::Close
+8051dac4 0x8051dac4
+8051dd70 HomeMenuMgr::UpdateControllerData
+8051df78 HomeMenuMgr::UpdateLockParams
+8051dfc0 0x8051dfc0
+8051e114 HomeMenuMgr::Calc
+8051e360 0x8051e360
+8051e420 0x8051e420
+8051e574 0x8051e574
+8051e7e8 HomeMenuMgr::Draw
+8051e85c Input::State::Reset
+8051e89c Input::State::operator==
+8051e904 Input::UIState::Reset
+8051e960 Input::State::SetStickXMirrorCheck
+8051e9e8 Input::State::SetStickX
+8051ea28 Input::State::ConvertQuantised
+8051ea60 Input::State::SetStickY
+8051eaa0 Input::UIState::SetStickXMirrorCheck
+8051eb28 Input::UIState::SetStickY
+8051eb68 Input::State::SetControlMotionFlick
+8051eba8 Input::Controller::__ct
+8051ec94 Input::State::__dt
+8051ecd4 Input::UIState::__dt
+8051ed14 Input::Controller::Update
+8051f00c Input::Controller::ResetSelf
+8051f010 Input::Controller::UpdateBatteryField
+8051f074 Input::Controller::GetRemainingBattery
+8051f07c Input::Controller::GetRuntimeTypeInfo
+8051f088 Input::WiiController::__ct
+8051f1ec Input::Controller::__dt
+8051f22c Input::WiiController::Init
+8051f308 Input::Controller::Init
+8051f37c Input::Controller::SetDriftType
+8051f384 Input::WiiController::WPADInfoCallback
+8051f3b4 Input::WiiController::UpdateBattery
+8051f3d0 Input::WiiController::GetRemainingBattery
+8051f410 Input::WiiController::UpdateStatesClassic
+8051fa7c Input::WiiController::UpdateStatesNunchuck
+8051fbe0 Input::WiiController::UpdateStatesCore
+8051fc84 Input::WiiController::UpdateImpl
+8051ffb8 Input::WiiController::TogglePointer
+8051ffd0 Input::GCNController::__ct
+80520118 Input::GCNController::Init
+805201b0 Input::GCNController::UpdateImpl
+805206fc Input::GCNController::HasRumble
+80520730 Input::GhostController::__ct
+80520924 Input::GhostController::__dt
+80520998 Input::GhostController::Init
+80520a4c Input::GhostController::HasRKGInputs
+80520a60 0x80520a60
+80520b18 0x80520b18
+80520b9c Input::GhostController::UpdateImpl
+80520d4c Input::GhostDirectionStream::Read
+80520eb4 Input::GhostDirectionStream::GetInputSize
+80520ebc Input::ControllerHolder::CreateRumbleController
+80520f2c Input::RealControllerHolder::SetDriftType
+80520f64 Input::ControllerHolder::__ct
+80521110 Input::ControllerHolder::Init
+80521198 Input::ControllerHolder::Update
+80521554 Input::RealControllerHolder::SetController
+805215d4 Input::RealControllerHolder::StartGhostReading
+80521688 Input::RealControllerHolder::EndGhostWriting
+80521768 Input::RealControllerHolder::Update
+80521844 Input::RealControllerHolder::SetGhostController
+80521930 Input::RealControllerHolder::PrepareForRace
+805219ac Input::AIControllerHolder::CopyCPUInputs
+80521a34 Input::ControllerHolder::RequestRumble(3args)
+80521acc Input::ControllerHolder::RequestRumble(4args)
+80521d84 Input::Controller::HasRumble
+80521d8c 0x80521d8c
+80521e48 0x80521e48
+80521ed0 Input::ControllerHolder::RequestRumbleByDuration
+80521f8c Input::ControllerHolder::RequestRumbleByDurationNoFaderCheck
+80522014 Input::ControllerHolder::StopAllRumble
+80522078 Input::ControllerHolder::ActivateRumble
+8052208c Input::Controller::ActivateRumble
+80522090 Input::ControllerHolder::StopRumble
+805220a4 Input::ControllerHolder::StopCurrentRumble
+805220a8 Input::ControllerHolder::ResetSelfController
+805220bc Input::RealControllerHolder::__ct
+805222b4 Input::ControllerHolder::__dt
+805222f4 Input::RealControllerHolder::__dt
+80522358 Input::Manager::SetFSStickClamp
+80522364 Input::ControllerParams::Fill
+80522494 Input::Controller::GetChannel
+8052249c 0x8052249c
+8052250c 0x8052250c
+805225a4 0x805225a4
+80522688 0x80522688
+80522690 Input::Manager::ResetKPAD
+805226f4 Input::ControllerHolder::CopyCPUInputs
+805226f8 Input::RealControllerHolder::GetInputsSize
+80522700 Input::RealControllerHolder::GetRKGInputs
+80522708 Input::RealControllerHolder::Init
+8052279c Input::AIControllerHolder::__dt
+805227dc Input::AIController::__dt
+8052281c Input::Controller::IsPointerEnabled
+80522824 Input::Controller::TogglePointer
+80522828 Input::GhostController::SetDriftType
+8052282c Input::GhostController::GetType
+80522834 Input::Controller::Func_0x24
+80522840 Input::GCNController:ResetSelf
+8052284c Input::GCNController:StopRumble
+80522858 Input::GCNController:ActivateRumble
+80522864 Input::GCNController:GetChannel
+8052286c Input::GCNController:GetType
+80522874 Input::GCNController:__dt
+805228b4 Input::WiiController::ResetSelf
+805228c4 Input::WiiController::StopRumble
+805228d0 Input::WiiController::ActivateRumble
+805228dc Input::WiiController::HasRumble
+805228f4 Input::WiiController::IsPointerEnabled
+80522924 Input::WiiController::GetChannel
+8052292c Input::WiiController::GetType
+80522934 Input::WiiController::__dt
+80522974 Input::GhostDirectionStream::Write
+80522ae8 Input::GhostTrickStream::Write
+80522c5c Input::GhostTrickStream::Read
+80522dc4 Input::GhostTrickStream::GetInputSize
+80522dcc Input::GhostActionStream::Write
+80522f40 Input::GhostActionStream::Read
+805230a8 Input::GhostActionStream::GetInputSize
+805230b0 Input_cpp_sinit_
+805230e0 Input::Manager::SyncSimpleCallback
+8052313c Input::Manager::CreateInstance
+8052318c Input::Manager::DestroyInstance
+805231dc Input::Manager::__dt
+805232b0 Input::DummyController::__dt
+805232f0 Input::Manager::__ct
+805234a0 Input::AIControllerHolder::__ct
+80523520 Input::Manager::Init
+80523524 0x80523524
+805235ac Input::Manager::ResetIdleFrameCounter
+805235d4 0x805235d4
+80523690 Input::Manager::Prepare
+80523724 Input::Manager::ResetSelfWiiAndGCNControllers
+805237ac 0x805237ac
+805237e8 Input::Manager::UpdateControllers
+805238f0 Input::Manager::Update
+80523990 0x80523990
+80523a58 Input::Manager::ConvertType
+80523a80 0x80523a80
+80523bc8 0x80523bc8
+80523d10 0x80523d10
+80523eac Input::Manager::ResetDummyController
+80523ebc Input::Manager::TrySetController
+805240ec 0x805240ec
+80524264 Input::Manager::ResetRealController
+8052427c 0x8052427c
+805242d8 Input::Manager::InitControllerHolders
+80524438 0x80524438
+80524500 0x80524500
+8052453c Input::Manager::InitGhostController
+80524558 Input::Manager::PrepareRealControllerHolderForRace
+80524568 Input::Manager::EnableGhostReading
+80524580 Input::Manager::StartGhostReading
+805245cc Input::Manager::EndGhostWriting
+805245dc Input::Manager::EndAllGhostWriting
+80524628 Input::Manager::CopyPADStatus
+805246c0 Input::Manager::InitRumble
+80524718 Input::Manager::ResetRumble
+80524734 0x80524734
+80524788 Input::Manager::SyncWiimotes
+805247e4 0x805247e4
+80524840 Input::Manager::EnableAllPointers
+805248d8 Input::Manager::ToggleAllPointers
+80524944 0x80524944
+80524998 0x80524998
+805249b0 Input::Manager::RequestRumbleByDuration
+805249c8 0x805249c8
+80524a50 0x80524a50
+80524a58 Input::AIController::UpdateImpl
+80524aa8 Input::AIController::GetType
+80524ab0 Input::DummyController::UpdateImpl
+80524ab4 SITransferCommands
+80524ac4 Input::GhostWriter::__ct
+80524c2c Input::GhostWriter::__dt
+80524ca8 Input::GhostWriter::Init
+80524d20 Input::GhostWriter::CopyToRKGInputsBuffer
+80524dd0 Input::GhostWriter::IsInputsSumSmallEnough
+80524e74 Input::GhostWriter::WriteFrame
+80524f78 Input::GhostActionStream::WriteNewValue
+80524f88 Input::GhostActionStream::IncrementDuration
+80524f98 Input::GhostActionStream::IsNewInput
+80524fbc Input::GhostActionStream::ReadValue
+80524fc4 Input::GhostActionStream::IsCurReadInputFinished
+80524fe0 Input::GhostDirectionStream::WriteNewValue
+80524ff0 Input::GhostDirectionStream::IncrementDuration
+80525000 Input::GhostDirectionStream::IsNewInput
+80525024 Input::GhostDirectionStream::ReadValue
+8052502c Input::GhostDirectionStream::IsCurReadInputFinished
+80525048 Input::GhostTrickStream::WriteNewValue
+8052505c Input::GhostTrickStream::IncrementDuration
+80525074 Input::GhostTrickStream::IsNewInput
+8052509c Input::GhostTrickStream::ReadValue
+805250a8 Input::GhostTrickStream::IsCurReadInputFinished
+805250c8 Input::KRMMgr::Init
+80525204 Input::KRMMgr::__ct
+80525278 Input::Rumble::Init
+805252a4 Input::Rumble::Request(KRMEntry)
+805252e8 Input::Rumble::Request(float)
+80525324 0x80525324
+80525334 Input::Rumble::Update
+80525498 Input::RumbleController::__ct
+80525508 Input::RumbleController::Init
+805255bc Input::RumbleController::Stop
+8052564c Input::RumbleController::DeactivateRumble
+8052570c Input::RumbleController::Update
+80525974 Input::RumbleController::Request(KRMEntry)
+80525a74 Input::RumbleController::Request(float)
+80525b8c Input::RumbleController::GetFreeRumble
+80525c38 Input::RumbleController::__dt
+80525c78 Input::Rumble::__dt
+80525cb8 0x80525cb8
+80525d88 0x80525d88
+80525db8 0x80525db8
+80525e00 0x80525e00
+80525e60 0x80525e60
+80525f88 Mii::Init
+80525ff4 0x80525ff4
+80526020 Mii::Load
+805263bc 0x805263bc
+80526400 0x80526400
+80526460 Mii::GetRFLArgs
+8052663c Mii::CreateScnRfl
+805267b4 0x805267b4
+805268f4 0x805268f4
+805269fc 0x805269fc
+80526a10 0x80526a10
+80526a80 0x80526a80
+80526b64 MiiManager::Disposer__dt
+80526bfc MiiManager::CreateInstance
+80526c4c 0x80526c4c
+80526c80 MiiManager::__ct
+80526d3c MiiManagerSub::__ct
+80526d54 MiiManagerSub::__dt
+80526d94 MiiManager::Init
+80527158 MiiManager::__dt
+80527298 MiiManager::CountOfficialMiis
+80527498 0x80527498
+80527514 MiiManager::GetMiddleDB3
+8052751c 0x8052751c
+8052758c Mii::ComputeRFLStoreData
+805275ec Mii::IsMiiId
+80527604 Mii::GetMiiId
+805276e0 MiiManager::GetStatus
+80527700 MiiManager::IsOfficialOrDefaultMii
+80527778 MiiManager::CreatePlayerMiiFromOfficial
+80527b0c MiiManager::CreateStoreMii(RFLCreateID)
+80527d60 MiiManager::CreateOfficialMii(RFLIdx)
+80527e84 MiiManager::CreateOfficialMii(RFLCreateID)
+80527f84 MiiManager::CreateDefaultMii(RFLIdx)
+80528058 0x80528058
+80528068 MiiManager::CreateDefaultMii(RFLCreateID)
+8052816c MiiManager::CreateOfficialMii(IdxArray)
+80528290 MiiManager::AllowMiiDisplay
+805282b0 MiiManager::CreateMiddleDBMii
+80528598 MiiManager::CreateRandomMii
+805287bc MiiManager::CreateMii(CreationParams)
+80528ea8 0x80528ea8
+80529034 Mii::__dt
+80529074 MiiManager::CreateMiddleDB2Mii
+80529330 MiiManager::CreateMii(RFLStoreData)
+80529420 MiiManager::CreateControllerMii
+80529530 0x80529530
+80529590 0x80529590
+80529640 MiiManager::CreatePlayerMiiFromMiddleDB
+80529730 MiiManager::PrepareRFLWiFiPacket
+80529748 MiiManager::RFLWiFiInfo2MiddleDB
+80529798 MiiManager::RFLWiFiInfo2StoreData
+805297e4 MiiCreationParams::InitAndReset
+80529804 MiiCreationParams::Init
+80529824 MiiCreationParams::Reset
+8052985c 0x8052985c
+80529870 0x80529870
+80529898 0x80529898
+805298fc 0x805298fc
+8052991c 0x8052991c
+8052993c MiiCreationParams2::Init
+80529978 MiiCreationParams2::Reset
+805299a4 0x805299a4
+805299b8 0x805299b8
+805299e0 0x805299e0
+80529a44 0x80529a44
+80529a64 0x80529a64
+80529a84 0x80529a84
+80529ac4 MovieManager::__ct
+80529b68 MovieManager::__dt
+80529be4 MovieManager::IsMoviePlaying
+80529c0c MovieManager::DrawDone
+80529c40 MovieManager::Init
+80529c48 MovieManager::Quit
+80529c4c MovieManager::CheckForEnd
+80529ca0 MovieManager::GetCurrentFrameNum
+80529cd0 MovieManager::Prepare
+80529d68 MovieManager::PrepareAsync
+80529e00 MovieManager::RequestPrepare
+80529e5c MovieManager::Play
+80529ea4 MovieManager::PlayAsync
+80529eec MovieManager::RequestPlay
+80529f04 MovieManager::Pause
+80529f44 MovieManager::PauseAsync
+80529f84 MovieManager::RequestPause
+80529f9c MovieManager::Close
+80529fe0 MovieManager::CloseAsync
+8052a024 MovieManager::RequestClose
+8052a03c MovieManager::SetVolume
+8052a048 MovieManager::GetVolume
+8052a04c MovieManager::FillCurTextureInfo
+8052a098 ArchivesHolder::CreateByType
+8052a1c8 CourseArchivesHolder::__ct
+8052a21c CourseArchivesHolder::Reset
+8052a2a8 UIArchivesHolder::__ct
+8052a2fc UIArchivesHolder::Reset
+8052a36c CommonArchivesHolder::__ct
+8052a3c0 CommonArchivesHolder::Reset
+8052a430 CourseArchivesHolder::__dt
+8052a488 UIArchivesHolder::__dt
+8052a4e0 CommonArchivesHolder::__dt
+8052a538 ArchivesHolder::ArchiveHolder
+8052a648 ArchivesHolder::Reset
+8052a6dc ArchivesHolder::__dt
+8052a760 ArchivesHolder::GetFile
+8052a800 ArchivesHolder::HasArchives
+8052a864 ArchivesHolder::FileExists
+8052a954 ArchivesHolder::LoadArchives
+8052aa88 ArchivesHolder::UnmountArchives
+8052aae8 ArchivesHolder::LoadFromOther
+8052ab6c ArchivesHolder::DumpArchive
+8052ac40 ArchivesHolder::ClearArchives
+8052aca0 ArchivesHolder::GetTotalMountedArchivesSize
+8052ad08 ArchivesHolder::GetFirstMountedArchive
+8052ad80 ArchivesHolder::GetFirstMountedArchiveEnd
+8052ae08 ArchivesHolder::GetLoadedArchivesCount
+8052ae5c NandUtils::SafeOpen
+8052aea4 0x8052aea4
+8052aed8 NandUtils::SafeOpen_NandUtils::SafeOpen_switch
+8052aedc NandUtils::SafeOpen_caseD_0
+8052aee4 NandUtils::SafeOpen_caseD_-3
+8052aefc NandUtils::SafeOpen_caseD_-4
+8052af04 NandUtils::SafeOpen_caseD_-15
+8052af0c NandUtils::SafeOpen_caseD_-12
+8052af14 NandUtils::SafeOpen_caseD_-14
+8052af64 NandUtils::Open
+8052b058 NandUtils::SafeClose
+8052b144 NandUtils::Close
+8052b228 NandUtils::Read
+8052b3f8 NandUtils::GetLength
+8052b4d4 NandUtils::Write
+8052b684 NandUtils::Check
+8052b754 NandUtils::CreateDir
+8052b84c NandUtils::GetType
+8052b95c NandUtils::Create
+8052ba54 NandUtils::Delete
+8052bb40 NandUtils::SetStatus
+8052bc3c NandUtils::GetStatus
+8052bd38 NandUtils::FileExists
+8052bd5c NandMgr::Disposer_dt
+8052bdf4 NandMgr::CreateInstance
+8052be98 NandMgr::DestroyInstance
+8052becc NandMgr::__ct
+8052bf44 NandMgr::__dt
+8052bff8 NandMgr::Init
+8052c0b0 NandMgr::ReadRKSYS
+8052c168 NandMgr::ReadFile
+8052c20c NandMgr::CheckRKSYSLength
+8052c2d0 NandMgr::WriteToRKSYS
+8052c428 NandMgr::WriteFile
+8052c4ec 0x8052c4ec
+8052c5d0 0x8052c5d0
+8052c68c NandMgr::CreateRKSYS
+8052c7e4 NandMgr::DeleteRKSYS
+8052cb10 NandMgr::GetBannerType
+8052cb6c 0x8052cb6c
+8052cca4 0x8052cca4
+8052cdc8 0x8052cdc8
+8052ce58 0x8052ce58
+8052cef8 0x8052cef8
+8052d00c 0x8052d00c
+8052d068 0x8052d068
+8052d118 0x8052d118
+8052d1c0 0x8052d1c0
+8052d270 RKSYS::Rating::AddPoints
+8052d298 ElineController::__ct
+8052d310 0x8052d310
+8052d384 0x8052d384
+8052d3d0 0x8052d3d0
+8052d46c ElineMgr::__ct
+8052d828 ElineMgr::GetController
+8052d888 ElineMgr::Update
+8052d96c RacedataPlayer::__ct
+8052da10 RKSYS::Rating::__dt
+8052da50 RacedataPlayer::RegisterPlayerParams
+8052daf0 RacedataPlayer::ComputeGPRank
+8052dbc8 RacedataScenario::__ct
+8052dc68 RacedataPlayer::__dt
+8052dca8 RacedataScenario::BlueTeamHasMorePoints
+8052dd18 RacedataPlayer::GetTeam
+8052dd20 RacedataScenario::GetPlayer(const)
+8052dd30 RacedataPlayer::GetPlayerCount
+8052dd40 Racedata::Init
+8052e42c RacedataPlayer::SetCharacterId
+8052e434 RacedataScenario::GetPlayer
+8052e444 RacedataPlayer::SetKartId
+8052e44c RacedataPlayer::SetPlayerType
+8052e454 Racedata::ResetScenarios
+8052e640 RacedataPlayer::ResetScores
+8052e658 RacedataPlayer::SetPrevFinishPos
+8052e660 0x8052e660
+8052e668 0x8052e668
+8052e764 0x8052e764
+8052e768 0x8052e768
+8052e76c 0x8052e76c
+8052e770 0x8052e770
+8052e870 0x8052e870
+8052e950 RacedataScenario::UpdatePoints
+8052ed18 RacedataScenario::GetGameType
+8052ed20 RacedataPlayer::GetPlayerType
+8052ed28 RacedataScenario::InitControllers
+8052eef0 RacedataScenario::InitGhostPlayer
+8052efd4 0x8052efd4
+8052f064 0x8052f064
+8052f1e0 RacedataScenario::UpdateFromPrevRace
+8052f4e8 RacedataScenario::InitScreens
+8052f788 RacedataScenario::ComputePlayerCounts
+8052f924 RacedataScenario::InitRng
+8052fa0c RacedataScenario::InitCompetitionSettings
+8052fb90 RacedataScenario::Init
+8052fe58 Racedata::CreateInstance
+8052ffe8 Racedata::DestroyInstance
+80530038 Racedata::__dt
+805300f4 RacedataScenario::__dt
+8053015c Racedata::__ct
+805302c4 Racedata::InitRace
+805305ac RacedataScenario::operator=
+80530864 Racedata::InitAwards
+80530f0c RacedataScenario::AreTeamsEnabled
+80530f18 0x80530f18
+80530f20 RacedataPlayer::GetCharacterId
+80530f28 RacedataPlayer::GetKartId
+80530f30 RacedataPlayer::SetMii
+80531068 RacedataPlayer::GetMii
+80531070 Racedata::InitCredits
+80531ce4 Racedata::UpdatePrevFromCur
+80531de4 RacedataScenario::RegisterParameters
+80531f18 Racedata::GetHudSlotId
+80531f2c Racedata::SetGhost
+80531f70 Racedata::GetPlayerIdOfLocalPlayer
+80531f80 Racedata::HandleRaceFinish?
+80531fc8 Racedata::LoadNextGPTrack
+80532030 Racedata::IsTTReplay
+80532070 Racedata::vf_0x18
+80532074 Racedata::vf_0x14
+80532078 Racedata::vf_0x10
+8053207c 0x8053207c
+80532084 Raceinfo::CreateInstance
+805320d4 Raceinfo::DestroyInstance
+80532124 GMDataGP::__ct
+80532188 Raceinfo::CreateGMData
+805321c8 Raceinfo::CreateGMData_Raceinfo::CreateGMData_switch
+805321cc Raceinfo::CreateGMData_case_0
+80532220 Raceinfo::CreateGMData_case_1
+80532248 Raceinfo::CreateGMData_case_4
+80532254 Raceinfo::CreateGMData_case_3
+805322c8 Raceinfo::CreateGMData_case_7
+805323e0 Raceinfo::CreateGMData_case_9
+80532444 Raceinfo::CreateGMData_case_2
+80532488 GMDataOnlineVSPlayer::__ct
+805324ac GMDataOnlineVSPlayer::__dt
+805324ec 0x805324ec
+8053252c 0x8053252c
+8053256c 0x8053256c
+805325ac 0x805325ac
+805325ec 0x805325ec
+8053262c 0x8053262c
+8053266c 0x8053266c
+805326ac 0x805326ac
+805326ec Raceinfo::GetBattleDuration
+805327a0 Raceinfo::__ct
+80532d44 RaceTimerMgrBase::Reset
+80532de0 RaceTimerMgrBase::__dt
+80532e3c Raceinfo::__dt
+80532f48 RaceinfoPlayer::__dt
+80532f88 Raceinfo::Init
+8053308c GMData::Init
+80533090 Raceinfo::GetRemainingCountdownTime
+805330c0 Raceinfo::ComputeDelfinoPierTideState
+805331b4 Raceinfo::Update
+805336a0 RaceTimerMgrBase::Update
+805336a4 Raceinfo::GetLapCount
+805336d8 GMData::HandlePositionTracking
+80533afc 0x80533afc
+80533be8 GMData::vf_0x20
+80533bec 0x80533bec
+80533c34 GMData::vf_0x24
+80533c6c Raceinfo::EndPlayerRace
+80533d84 Raceinfo::SetPlayerDisconnected
+80533dd4 0x80533dd4
+80533ed8 RaceinfoPlayer::__ct
+80534194 0x80534194
+805342e8 RaceinfoPlayer::UpdateRealLocal
+80534684 0x80534684
+805347f4 RaceinfoPlayer::EndRace
+80534934 0x80534934
+805349b8 RaceinfoPlayer::EndLap
+80534c78 RaceinfoPlayer::Vanish
+80534cbc RaceinfoPlayer::Disconnect
+80534ccc 0x80534ccc
+80534d6c 0x80534d6c
+80534df8 RaceinfoPlayer::UpdateCheckPoint
+8053520c 0x8053520c
+80535304 RaceinfoPlayer::Update
+80535698 0x80535698
+8053569c 0x8053569c
+80535718 RaceinfoPlayer::CopyCPUInputs
+8053572c RaceinfoPlayer::FillTimerWithLapSplits
+80535864 RaceTimerMgr::Reset
+80535904 RaceTimerMgr::Update
+80535ca0 Raceinfo::CloneTimer
+80535d14 GMDataTT::CanRaceEnd
+80535de8 GMData::UpdateLocalPlayer
+80535e84 GMData::Update
+80535ef4 GMData::GetJGPTHolder
+80535f28 GMDataGP::CanRaceEnd
+80535fe4 GMDataGP::Update
+80536054 GMDataVS::CanRaceEnd
+80536208 Raceinfo::CanRaceEnd
+8053621c Raceinfo::GetJGPTHolder
+80536230 Raceinfo::IsAtLeastStage
+80536248 0x80536248
+805362dc Raceinfo::GetInitialPhysicsValues
+80536324 Raceinfo::GetInitialPhysicsValues::switch
+80536328 Raceinfo::GetInitialPhysicsValues::case_3
+80536450 Raceinfo::GetInitialPhysicsValues::case_b
+80536484 Raceinfo::GetInitialPhysicsValues::case_c
+80536494 Raceinfo::GetInitialPhysicsValues::case_2
+805364a4 Raceinfo::GetInitialPhysicsValues::case_4
+80536540 Raceinfo::GetInitialPhysicsValues::case_0
+805365c8 Raceinfo::GetKTPTHolder
+80536614 Raceinfo::GetKTPTHolder_switch
+80536618 Raceinfo::GetKTPTHolder_case_3
+80536738 Raceinfo::GetKTPTHolder_case_4
+805367b8 Raceinfo::GetKTPTHolder_case_b
+805367e4 Raceinfo::GetKTPTHolder_case_c
+805367ec Raceinfo::GetKTPTHolder_case_2
+805367f4 Raceinfo::GetKTPTHolder_case_0
+80536828 Raceinfo::GetStartENPT
+805368c4 Raceinfo::GetRawKRT
+805368f8 RaceinfoPlayer::ComputeGPRank
+80536c84 0x80536c84
+80537190 0x80537190
+805371a4 GMData::vf_0x28
+805371a8 0x805371a8
+805371e8 0x805371e8
+8053724c 0x8053724c
+805372b4 0x805372b4
+805372bc 0x805372bc
+80537320 0x80537320
+80537388 0x80537388
+80537390 0x80537390
+805373f4 0x805373f4
+8053745c 0x8053745c
+80537464 0x80537464
+805374c8 0x805374c8
+80537530 0x80537530
+80537538 0x80537538
+8053759c 0x8053759c
+80537604 0x80537604
+8053760c 0x8053760c
+80537670 0x80537670
+805376d8 0x805376d8
+805376e0 RaceTimerMgr::__dt
+80537740 0x80537740
+80537830 Vec3::Cross
+8053787c 0x8053787c
+80537b80 Mtx34::GetColumnByIdx
+80537ba4 0x80537ba4
+80537c54 0x80537c54
+80537c94 0x80537c94
+80537cd4 0x80537cd4
+80537f98 0x80537f98
+80538084 0x80538084
+80538170 0x80538170
+805381a4 0x805381a4
+80538220 0x80538220
+8053831c KMGHolder::SetKMG
+80538344 KMGHolder::ConvertArenaIdToIdx
+80538418 GMDataBattle::HandlePositionTracking
+80538770 GMDataBalloonBattle::OnItemCollision
+80538994 GMDataBalloonBattle::OnKartCollision
+80538bc0 GMDataBalloonBattle::OnOOBCollision
+80538ce0 0x80538ce0
+80538e00 0x80538e00
+80538eb4 0x80538eb4
+80538f50 GMDataOnlineBalloonBattle::GetKMGSeconds2
+80538f58 GMDataOnlineBalloonBattle::GetKMGSeconds3
+80538f60 0x80538f60
+80538fec GMDataBattle::Init
+805391dc GMDataOnlineBalloonBattle::GetKMGSeconds1
+805391e4 GMDataBattle::GetJGPTHolder
+805392e4 0x805392e4
+80539404 0x80539404
+80539574 GMDataBalloonBattle::Update
+80539770 GMDataBalloonBattle::CanRaceEnd
+80539824 GMDataCoinBattle::Update
+80539a84 GMDataCoinBattle::CanRaceEnd
+80539a90 GMDataCoinBattle::OnItemCollision
+80539b30 GMDataCoinBattle::OnKartCollision
+80539be8 GMDataCoinBattle::OnOOBCollision
+80539c3c GMDataOnlineBalloonBattle::Init
+80539f88 GMDataOnlineBalloonBattle::__ct
+8053a180 0x8053a180
+8053a1c0 0x8053a1c0
+8053a200 0x8053a200
+8053a240 0x8053a240
+8053a280 0x8053a280
+8053a2c0 0x8053a2c0
+8053a300 0x8053a300
+8053a340 0x8053a340
+8053a380 0x8053a380
+8053a3c0 0x8053a3c0
+8053a720 0x8053a720
+8053a784 0x8053a784
+8053a78c 0x8053a78c
+8053a7f0 0x8053a7f0
+8053a7f8 0x8053a7f8
+8053a868 0x8053a868
+8053a870 0x8053a870
+8053a8d4 0x8053a8d4
+8053a8dc 0x8053a8dc
+8053a940 0x8053a940
+8053a948 0x8053a948
+8053a9ac 0x8053a9ac
+8053a9b4 0x8053a9b4
+8053aa18 0x8053aa18
+8053aa20 0x8053aa20
+8053abdc 0x8053abdc
+8053abfc 0x8053abfc
+8053ac1c 0x8053ac1c
+8053b0a8 0x8053b0a8
+8053b110 0x8053b110
+8053b178 0x8053b178
+8053b1f8 0x8053b1f8
+8053b260 0x8053b260
+8053b2c8 0x8053b2c8
+8053b330 0x8053b330
+8053b398 0x8053b398
+8053b3cc 0x8053b3cc
+8053b4cc GMDataOnlineBalloonBattle::OnItemCollision
+8053b584 GMDataOnlineBalloonBattle::OnKartCollision
+8053b63c GMDataOnlineBalloonBattle::OnOOBCollision
+8053b6e8 GMDataOnlineBalloonBattle::vf_0x3c
+8053b6f8 0x8053b6f8
+8053b7a4 GMDataOnlineBalloonBattle::OnObjectCollision
+8053b850 0x8053b850
+8053b884 0x8053b884
+8053b910 0x8053b910
+8053b98c 0x8053b98c
+8053baa0 0x8053baa0
+8053bbf4 GMDataOnlineBalloonBattle::Update
+8053bcc8 0x8053bcc8
+8053bcf4 0x8053bcf4
+8053bd5c GMDataOnlineBalloonBattle::Update_switch
+8053bd60 GMDataOnlineBalloonBattle::Update_case_1
+8053bd74 GMDataOnlineBalloonBattle::Update_case_2
+8053bd84 GMDataOnlineBalloonBattle::Update_case_3
+8053bd98 GMDataOnlineBalloonBattle::Update_case_4
+8053be1c GMDataOnlineBalloonBattle::Update_case_5
+8053be2c GMDataOnlineBalloonBattle::Update_case_6
+8053be70 GMDataOnlineBalloonBattle::Update_case_7
+8053be78 GMDataOnlineBalloonBattle::Update_case_0
+8053be7c GMDataOnlineBalloonBattle::Update_case_8
+8053cb2c 0x8053cb2c
+8053cbc8 0x8053cbc8
+8053ce10 0x8053ce10
+8053d060 0x8053d060
+8053d1a0 0x8053d1a0
+8053d260 0x8053d260
+8053d3a0 GMDataOnlineBalloonBattle::vf_0x28
+8053d428 GMDataOnlineCoinBattle::Update
+8053d848 0x8053d848
+8053d8b8 GMDataBattle::vf_0x3c
+8053d8bc GMDataCoinBattle::OnObjectCollision
+8053d8c0 GMDataCoinBattle::GetKMGSeconds3
+8053d8dc GMDataCoinBattle::GetKMGSeconds2
+8053d8f8 GMDataCoinBattle::GetKMGSeconds1
+8053d914 GMDataOnlineBalloonBattle::CanRaceEnd
+8053d91c GMDataBalloonBattle::GetKMGSeconds3
+8053d938 GMDataBalloonBattle::GetKMGSeconds2
+8053d954 GMDataBalloonBattle::GetKMGSeconds1
+8053d970 0x8053d970
+8053d974 0x8053d974
+8053d978 0x8053d978
+8053d97c Raceinfo::RaceinfoGamemodeDataMissionTournament
+8053d9b8 Raceinfo::RaceinfoGamemodeDataMissionTournament_switch
+8053d9bc Raceinfo::RaceinfoGamemodeDataMissionTournament_caseD_0
+8053d9e8 Raceinfo::RaceinfoGamemodeDataMissionTournament_caseD_1
+8053da14 Raceinfo::RaceinfoGamemodeDataMissionTournament_caseD_7
+8053da50 0x8053da50
+8053daa8 0x8053daa8
+8053daac 0x8053daac
+8053daf8 0x8053daf8
+8053dafc 0x8053dafc
+8053db10 0x8053db10
+8053db18 0x8053db18
+8053db34 0x8053db34
+8053dff8 0x8053dff8
+8053e018 0x8053e018
+8053e194 0x8053e194
+8053e27c 0x8053e27c
+8053e298 0x8053e298
+8053e2a0 0x8053e2a0
+8053e2b0 0x8053e2b0
+8053e2f0 0x8053e2f0
+8053e330 0x8053e330
+8053e370 GMDataOnlineVS::Init
+8053e47c 0x8053e47c
+8053e680 0x8053e680
+8053e7ac 0x8053e7ac
+8053ebbc 0x8053ebbc
+8053ec40 0x8053ec40
+8053ed68 0x8053ed68
+8053ee50 0x8053ee50
+8053efd4 0x8053efd4
+8053f184 0x8053f184
+8053f2a4 GMDataOnlineVS::Update
+8053f4a0 GMDataOnlineVS::HandlePositionTracking
+8053fa10 GMDataOnlineVS::CanRaceEnd
+8053fb38 GMDataOnlineVS::vf_0x24
+8053fb98 GMDataOnlineVS::UpdateLocalPlayers
+8053fc4c ArchiveMgr::CreateInstance
+8053fc9c ArchiveMgr::DestroyInstance
+8053fcec ArchiveMgr::__ct
+8053fe68 AllkartArchivesLoader::__ct
+8053fe94 AllkartArchivesLoader::__dt
+8053fed4 0x8053fed4
+8053ff14 0x8053ff14
+8053ff1c ArchiveMgr::__dt
+80540000 0x80540000
+80540038 ArchiveMgr::LoadArchiveAsync
+805400a0 ArchiveMgr::WaitForLoad
+805401ec 0x805401ec
+805401fc 0x805401fc
+8054020c ArchiveMgr::LoadArchive(holder)
+805402c0 ArchiveMgr::LoadArchive(file)
+80540394 ArchiveMgr::LoadArchive(holder, 2heaps)
+80540450 ArchiveMgr::LoadArchive(type)
+80540558 ArchiveMgr::LoadContentArchive
+80540680 ArchiveMgr::LoadUIArchive
+80540760 ArchiveMgr::LoadCourseArchive
+80540918 ArchiveRoot_loadMissionTrack
+80540b14 ArchiveMgr::LoadCompetitionArchives
+80540cfc ArchiveMgr::LoadKartArchive(holder)
+80540e3c ArchiveMgr::LoadKartArchive(playerId)
+80540f90 ArchiveMgr::LoadKartArchiveHolder2(playerId)
+805410e4 0x805410e4
+805411d4 ArchiveMgr::Unmount(source)
+805411e4 ArchiveMgr::Unmount(holder)
+805411ec ArchiveMgr::UnmountContentArchive
+805411fc ArchiveMgr::GetFile
+80541278 ArchiveMgr::GetMenuKartBRRES
+80541320 ArchiveMgr::GetKartBRRES
+805413c8 ArchiveMgr::GetKartArchiveFile
+80541438 ArchiveMgr::GetKartArchiveFileHolder2
+805414a8 ArchiveMgr::GetBSP
+8054155c ArchiveMgr::GetContentFileNewBuffer
+805415b4 ArchiveMgr::HasArchives
+805415c4 ArchiveMgr::HasKartArchive
+805415d4 ArchiveMgr::HasKartArchiveHolder2
+805415e4 ArchiveMgr::HasContentArchive
+80541614 ArchiveMgr::GetArchive
+8054169c ArchiveMgr::SetLayoutResources
+80541738 ArchiveMgr::GetArchiveCount
+80541794 ArchiveMgr::GetUIArchiveCount
+805417a4 ArchiveMgr::AttachUIAccessor
+80541878 ArchiveMgr::AttachLayoutResources
+80541998 ArchiveMgr::LoadCourseArchiveAsync
+805419ac ArchiveMgr::RequestLoadCourseArchiveAsync
+805419c8 ArchiveMgr::GetKartArchivePostfix
+805419ec ArchiveMgr::GetKartArchivePrefix
+80541a10 AsyncCourseArchiveLoader::__ct
+80541a70 AsyncCourseArchiveLoader::Init
+80541ac4 AsyncCourseArchiveLoader::__dt
+80541b58 AsyncCourseArchiveLoader::Load
+80541c18 AsyncCourseArchiveLoader::CopyToHolder
+80541c38 0x80541c38
+80541c48 ArchiveMgr::ExecuteTask
+80541cbc ArchiveMgr::RequestTask
+80541ce0 ArchiveMgr::ProcessRequestsAndShutdown
+80541e44 ArchiveMgr::LoadKartArchiveAsync
+80542030 0x80542030
+80542210 ArchiveMgr::RequestLoadKartArchives
+805422cc ArchiveMgr::InitAllkartArchivesLoaders
+805423bc ArchiveMgr::ResetAllkartArchivesLoaders
+8054247c ArchiveMgr::GetAllKartLoaderHeap
+8054248c ArchiveMgr::LoadEarthBrres(heap)
+80542524 ArchiveMgr::CreateEarthHeap
+80542584 ArchiveMgr::DestroyEarthHeap
+805425d0 ArchiveMgr::LoadEarthBrresAsync
+80542694 ArchiveMgr::LoadEarthBrres
+80542754 ArchiveMgr::RequestLoadEarthBrres
+805427bc ArchiveMgr::LoadStaffGhostAsync
+80542868 0x80542868
+80542878 RootScene::__ct
+805429a8 RootScene::__dt
+80542a10 RootScene::SetHeapsGroupId
+80542a18 RootScene::CreateArchiveMgr
+80542a80 RootScene::CreateGroup1Instances
+80542ae0 RootScene::CreateAudioMgr
+80542b5c RootScene::CreateScnMgrCreator
+80542ba0 RootScene::CreateRacedata
+80542be4 RootScene::CreateEffectsMgr
+80542c2c RootScene::CreateHomeMenuMgr
+80542c74 RootScene::CreateRKNetInstances
+80542cc4 RootScene::CreateUIInstances
+80542d0c 0x80542d0c
+80542d4c RootScene::CreateInstances
+805438b4 RootScene::InitInstances
+80543acc 0x80543acc
+80543b0c 0x80543b0c
+80543b10 RootScene::RequestRootScene
+80543b7c 0x80543b7c
+80543b84 RootScene::enter
+80543c84 RootScene::exit
+80543c88 RootScene::calc
+80543c8c RootScene::draw
+80543c90 0x80543c90
+80543d18 RKSYS::Mgr::Disposer__dt
+80543db0 RKSYS::Mgr::CreateInstance
+80543edc RKSYS::Mgr::DestroyInstance
+80543f10 RKSYS::Mgr::__ct
+8054400c RKSYS::LicenseMgr::__ct
+8054429c RKSYS::LicenseCup::__ct
+805442c0 Timer::__ct(bool)
+80544310 Timer::SetActive
+80544318 RKSYS::LicenseCup::__dt
+80544358 RKSYS::LicenseLdbEntry::__ct
+8054437c RKSYS::LicenseLdbEntry::__dt
+805443bc RKSYS::LicenseUnkTimer::__ct
+805443e0 RKSYS::LicenseUnkTimer::__dt
+80544420 RKSYS::LicenseFriends::__dt
+80544460 RKSYS::LicenseCompletion::__ct
+80544484 RKSYS::LicenseCompletion::__dt
+805444c4 RKSYS::LicenseStaffGhostStatus::__ct
+805444d0 RKSYS::Rating::__ct
+805444e8 RKSYS::LicenseUnkTimer2::__ct
+8054450c RKSYS::LicenseUnkTimer2::__dt
+8054454c RKSYS::LicenseMgr::SetInitialized
+80544558 RKSYS::LicenseMgr::__dt
+8054460c RKSYS::Mgr::__dt
+805446e8 0x805446e8
+80544824 RKSYS::Mgr::RequestTask
+80544840 RKSYS::Mgr::LoadTask
+8054484c RKSYS::Mgr::LoadRKSYS
+80544a38 RKSYS::Mgr::Init
+80544a5c RKSYS::Mgr::SaveCoreTask
+80544adc RKSYS::Mgr::SaveCoreImpl
+80544b48 RKSYS::Mgr::SaveCore
+80544bc4 RKSYS::Mgr::WriteLicenses
+80544c2c RKSYS::Mgr::WriteCoreAndRequestSaveCore
+80544cd8 RKSYS::LicenseMgr::SetCurLicense
+80544d10 RKSYS::Mgr::CheckLicenseMagic
+80544d40 RKSYS::Mgr::ReadLicense
+805455e0 RKSYS::LicenseMgr::ReadMiiName
+80545658 RKSYS::LicenseMgr::GetMiiName
+8054565c RKSYS::LicenseMgr::ReadRFLCreateID
+805456b0 RKSYS::LicenseMgr::SetRFLCreateID
+805456f4 RKSYS::LicenseMgr::ReadDWCAccUserData
+80545798 RKSYS::LicenseMgr::SetDWCUserData
+80545830 RKSYS::LicenseMgr::ReadFriendData
+80545854 RKSYS::LicenseMgr::GetFriends
+8054585c RKSYS::LicenseMgr::ReadCup
+80545934 RKSYS::LicenseMgr::GetCup
+8054594c RKSYS::LicenseMgr::ReadLdbEntry
+80545a00 RKSYS::LicenseMgr::GetLdbEntry(SaveCourseId)
+80545a18 RKSYS::LicenseMgr::ReadUnkTimer
+80545a94 RKSYS::LicenseMgr::GetUnkTimer
+80545aa4 RKSYS::LicenseMgr::ReadCompletion
+80545ad8 RKSYS::LicenseMgr::SetCompletion
+80545b00 RKSYS::LicenseMgr::ReadPBGhostBitfield
+80545b1c RKSYS::LicenseMgr::SetPBGhostBitfield
+80545b28 RKSYS::LicenseMgr::ReadDLGhostBitfield
+80545b44 RKSYS::LicenseMgr::SetDLGhostBitfield
+80545b50 RKSYS::LicenseMgr::SetRKPDEA_2
+80545b5c RKSYS::LicenseMgr::ReadRKPDEA_2
+80545b84 RKSYS::LicenseMgr::ReadStaffGhostStatus
+80545ba8 RKSYS::LicenseMgr::SetStaffGhostStatus
+80545bc0 RKSYS::LicenseMgr::SetRKPD1BC_31
+80545bcc RKSYS::LicenseMgr::ReadRKPD1BC_31
+80545be8 RKSYS::LicenseMgr::GetRKPDVR
+80545c04 RKSYS::LicenseMgr::SetVR
+80545c14 RKSYS::LicenseMgr::GetRKPDBR
+80545c30 RKSYS::LicenseMgr::SetBR
+80545c40 RKSYS::LicenseMgr::SetOfflineVSWins
+80545c60 RKSYS::LicenseMgr::ReadOfflineVSWins
+80545c78 RKSYS::LicenseMgr::SetOfflineVSLosses
+80545c98 RKSYS::LicenseMgr::ReadOfflineVSLosses
+80545cb0 RKSYS::LicenseMgr::SetOfflineBattleWins
+80545cd0 RKSYS::LicenseMgr::ReadOfflineBattleWins
+80545ce8 RKSYS::LicenseMgr::SetOfflineBattleLosses
+80545d08 RKSYS::LicenseMgr::ReadOfflineBattleLosses
+80545d20 RKSYS::LicenseMgr::SetWFCVSWins
+80545d40 RKSYS::LicenseMgr::ReadWFCVSWins
+80545d58 RKSYS::LicenseMgr::SetWFCVSLosses
+80545d78 RKSYS::LicenseMgr::ReadWFCVSLosses
+80545d90 RKSYS::LicenseMgr::SetWFCBattleWins
+80545db0 RKSYS::LicenseMgr::ReadWFCBattleWins
+80545dc8 RKSYS::LicenseMgr::SetWFCBattleLosses
+80545de8 RKSYS::LicenseMgr::ReadWFCBattleLosses
+80545e00 RKSYS::LicenseMgr::SetGhostRacesWins
+80545e20 RKSYS::LicenseMgr::ReadGhostRacesWins
+80545e38 RKSYS::LicenseMgr::SetGhostRacesLosses
+80545e58 RKSYS::LicenseMgr::ReadGhostRacesLosses
+80545e70 RKSYS::LicenseMgr::SetTotalRacePlayed
+80545e90 RKSYS::LicenseMgr::ReadTotalRacePlayed
+80545ea8 RKSYS::LicenseMgr::SetTotalBattlePlayed
+80545ec8 RKSYS::LicenseMgr::ReadTotalBattlePlayed
+80545ee0 RKSYS::LicenseMgr::SetRacesOnWheel
+80545f00 RKSYS::LicenseMgr::ReadRacesOnWheel
+80545f18 RKSYS::LicenseMgr::SetBattlesOnWheel
+80545f38 RKSYS::LicenseMgr::ReadBattlesOnWheel
+80545f50 RKSYS::LicenseMgr::ReadDistanceTravelled
+80545f68 RKSYS::LicenseMgr::SetDistanceTravelled
+80545fa4 RKSYS::LicenseMgr::SetGhostDataChallengesSent
+80545fc4 RKSYS::LicenseMgr::ReadGhostDataChallengesSent
+80545fdc RKSYS::LicenseMgr::SetGhostDataChallengesReceived
+80545ffc RKSYS::LicenseMgr::ReadGhostDataChallengesReceived
+80546014 RKSYS::LicenseMgr::SetItemHitsDelivered
+80546034 RKSYS::LicenseMgr::ReadItemHitsDelivered
+8054604c RKSYS::LicenseMgr::SetItemHitsReceived
+8054606c RKSYS::LicenseMgr::ReadItemHitsReceived
+80546084 RKSYS::LicenseMgr::SetTricksPerformed
+805460a4 RKSYS::LicenseMgr::ReadTricksPerformed
+805460bc RKSYS::LicenseMgr::SetTimes1stPlaceAchieved
+805460dc RKSYS::LicenseMgr::ReadTimes1stPlaceAchieved
+805460f4 RKSYS::LicenseMgr::ReadDistancetravelledwhilein1stplace
+8054610c RKSYS::LicenseMgr::SetDistancetravelledwhilein1stplace
+80546148 RKSYS::LicenseMgr::ReadDistancetravelledonVSRaces
+80546160 RKSYS::LicenseMgr::SetDistancetravelledonVSRaces
+8054619c RKSYS::LicenseMgr::SetCompetitionsEntered
+805461bc RKSYS::LicenseMgr::ReadCompetitionsEntered
+805461d4 RKSYS::LicenseMgr::SetRacesOnCharacter
+805461fc RKSYS::LicenseMgr::ReadRacesOnCharacter
+8054621c RKSYS::LicenseMgr::SetRacesOnKart
+80546244 RKSYS::LicenseMgr::ReadRacesOnKart
+80546264 RKSYS::LicenseMgr::SetRacesOnTrack
+8054628c RKSYS::LicenseMgr::ReadRacesOnTrack
+805462ac RKSYS::LicenseMgr::SetRacesOnBattleArena
+805462d4 RKSYS::LicenseMgr::ReadRacesOnBattleArena
+805462f4 RKSYS::LicenseMgr::SetUnk55f0
+80546310 RKSYS::LicenseMgr::ReadUnk55f0
+8054634c RKSYS::LicenseMgr::SetDefaultDrift
+80546358 RKSYS::LicenseMgr::ReadDefaultDrift
+80546374 RKSYS::LicenseMgr::Set CC
+80546388 RKSYS::LicenseMgr::ReadCC
+805463ac RKSYS::LicenseMgr::SetCPUDifficulty
+805463c0 RKSYS::LicenseMgr::ReadCPUDifficulty
+805463e4 RKSYS::LicenseMgr::SetVehicleType
+805463f8 RKSYS::LicenseMgr::ReadVehicleType
+8054641c RKSYS::LicenseMgr::SetCourseChoice
+80546430 RKSYS::LicenseMgr::ReadCourseChoice
+80546454 RKSYS::LicenseMgr::SetItemsType
+80546468 RKSYS::LicenseMgr::ReadItemsType
+8054648c RKSYS::LicenseMgr::SetTotalRaceCount
+805464a0 RKSYS::LicenseMgr::ReadTotalRaceCount
+805464c4 RKSYS::LicenseMgr::ReadUnkTimer2
+8054652c RKSYS::LicenseMgr::SetUnkTimer2
+8054656c RKSYS::LicenseMgr::ReadRKPD_1BC
+805465cc RKSYS::LicenseMgr::SetRKPD_1BC
+805465f8 RKSYS::LicenseMgr::ReadRKPD_5680
+80546660 RKSYS::LicenseUnk5680::Set
+805466b4 RKSYS::LicenseMgr::SetRKPD_5680
+805466dc RKSYS::LicenseMgr::ReadRKPD_5688
+80546734 RKSYS::LicenseMgr::SetRKPD_5688
+80546744 RKSYS::LicenseMgr::ReadRKPD_568c
+8054677c RKSYS::LicenseMgr::SetRKPD_568c
+805467a8 RKSYS::LicenseMgr::SetRKPD_568c_31
+805467b4 RKSYS::LicenseMgr::ReadRKPD_5688_31
+805467d0 RKSYS::LicenseMgr::WriteToRKPD
+80546fb4 RKSYS::LicenseMgr::IsInitialized
+80546fc0 RKSYS::LicenseMgr::WriteMiiName
+80546fdc RKSYS::LicenseMgr::GetMiiName
+80546fe0 RKSYS::LicenseMgr::WriteRFLCreateID
+80547034 RKSYS::LicenseMgr::GetRFLCreateID
+8054703c RKSYS::LicenseMgr::WriteDWCAccUserData
+805470d0 RKSYS::LicenseMgr::GetDWCAccUserData
+805470dc RKSYS::LicenseMgr::WriteFriendData
+805470fc RKSYS::LicenseMgr::GetFriends
+80547104 RKSYS::LicenseMgr::WriteCup
+80547128 RKSYS::LicenseMgr::GetCup
+80547140 RKSYS::LicenseMgr::WriteLdbEntry
+8054726c RKSYS::LicenseMgr::GetLdbEntry
+80547284 RKSYS::LicenseMgr::WriteUnkTimer
+80547374 RKSYS::LicenseMgr::GetUnkTimer
+80547384 RKSYS::LicenseMgr::WriteCompletion
+805473b8 RKSYS::LicenseMgr::GetCompletion
+805473c4 RKSYS::LicenseMgr::WritePBGhostBitfield
+805473dc RKSYS::LicenseMgr::GetPBGhostBitfield
+805473e8 RKSYS::LicenseMgr::WriteDLGhostBitfield
+80547400 RKSYS::LicenseMgr::GetDLGhostBitfield
+8054740c RKSYS::LicenseMgr::WriteRKPD_EA_2
+8054742c RKSYS::LicenseMgr::GetRKPD_EA_2
+80547438 RKSYS::LicenseMgr::WriteRKPD1BC_31
+80547458 RKSYS::LicenseMgr::GetRKPD1BC_31
+80547464 RKSYS::LicenseMgr::WriteVR
+80547480 RKSYS::LicenseMgr::GetVR
+8054748c RKSYS::LicenseMgr::WriteBR
+805474a8 RKSYS::LicenseMgr::GetBR
+805474b4 RKSYS::LicenseMgr::WriteOfflineVSWins
+805474cc RKSYS::LicenseMgr::GetOfflineVSWins
+805474d8 RKSYS::LicenseMgr::WriteOfflineVSLosses
+805474f0 RKSYS::LicenseMgr::GetOfflineVSLosses
+805474fc RKSYS::LicenseMgr::WriteOfflineBattleWins
+80547514 RKSYS::LicenseMgr::GetOfflineBattleWins
+80547520 RKSYS::LicenseMgr::WriteOfflineBattleLosses
+80547538 RKSYS::LicenseMgr::GetOfflineBattleLosses
+80547544 RKSYS::LicenseMgr::WriteWFCVSWins
+8054755c RKSYS::LicenseMgr::GetWFCVSWins
+80547568 RKSYS::LicenseMgr::WriteWFCVSLosses
+80547580 RKSYS::LicenseMgr::GetWFCVSLosses
+8054758c RKSYS::LicenseMgr::WriteWFCBattleWins
+805475a4 RKSYS::LicenseMgr::GetWFCBattleWins
+805475b0 RKSYS::LicenseMgr::WriteWFCBattleLosses
+805475c8 RKSYS::LicenseMgr::GetWFCBattleLosses
+805475d4 RKSYS::LicenseMgr::WriteGhostRacesWins
+805475ec RKSYS::LicenseMgr::GetGhostRacesWins
+805475f8 RKSYS::LicenseMgr::WriteGhostRacesLosses
+80547610 RKSYS::LicenseMgr::GetGhostRacesLosses
+8054761c RKSYS::LicenseMgr::WriteTotalRacePlayed
+80547634 RKSYS::LicenseMgr::GetTotalRacePlayed
+80547654 RKSYS::LicenseMgr::WriteTotalBattlePlayed
+8054766c RKSYS::LicenseMgr::WriteRacesOnWheel
+8054768c RKSYS::LicenseMgr::GetTotalBattlePlayed
+805476a4 RKSYS::LicenseMgr::GetRacesOnWheel
+805476c4 RKSYS::LicenseMgr::WriteBattlesOnWheel
+805476dc RKSYS::LicenseMgr::GetBattlesOnWheel
+805476fc RKSYS::LicenseMgr::WriteDistanceTravelled
+80547714 RKSYS::LicenseMgr::GetDistanceTravelled
+80547734 RKSYS::LicenseMgr::WriteGhostDataChallengesSent
+8054774c RKSYS::LicenseMgr::GetGhostDataChallengesSent
+8054776c RKSYS::LicenseMgr::WriteGhostDataChallengesReceived
+80547784 RKSYS::LicenseMgr::GetGhostDataChallengesReceived
+805477a4 RKSYS::LicenseMgr::WriteItemHitsDelivered
+805477bc RKSYS::LicenseMgr::GetItemHitsDelivered
+805477dc RKSYS::LicenseMgr::WriteItemHitsReceived
+805477f4 RKSYS::LicenseMgr::GetItemHitsReceived
+80547814 RKSYS::LicenseMgr::WriteTricksPerformed
+8054782c RKSYS::LicenseMgr::GetTricksPerformed
+8054784c RKSYS::LicenseMgr::WriteTimes1stPlaceAchieved
+80547864 RKSYS::LicenseMgr::GetTimes1stPlaceAchieved
+80547884 RKSYS::LicenseMgr::WriteDistancetravelledwhilein1stplace
+8054789c RKSYS::LicenseMgr::GetDistancetravelledwhilein1stplace
+805478bc RKSYS::LicenseMgr::WriteDistancetravelledonVSRaces
+805478d4 RKSYS::LicenseMgr::GetDistancetravelledonVSRaces
+805478f4 RKSYS::LicenseMgr::WriteCompetitionsEntered
+8054790c RKSYS::LicenseMgr::GetCompetitionsEntered
+80547930 RKSYS::LicenseMgr::WriteRacesOnCharacter
+80547950 RKSYS::LicenseMgr::GetRacesOnCharacter
+8054797c RKSYS::LicenseMgr::WriteRacesOnKart
+8054799c RKSYS::LicenseMgr::GetRacesOnKart
+805479c8 RKSYS::LicenseMgr::WriteRacesOnTrack
+805479e8 RKSYS::LicenseMgr::GetRacesOnTrack
+80547a14 RKSYS::LicenseMgr::WriteRacesOnBattleArena
+80547a34 RKSYS::LicenseMgr::WriteUnk55f0
+80547a64 RKSYS::LicenseMgr::GetUnk55f0
+80547a80 RKSYS::LicenseMgr::WriteStaffGhostStatus
+80547aa4 RKSYS::LicenseMgr::GetStaffGhostStatus
+80547ab8 RKSYS::LicenseMgr::WriteDefaultDrift
+80547ad8 RKSYS::LicenseMgr::GetDefaultDrift
+80547ae4 RKSYS::LicenseMgr::WriteCC
+80547b0c RKSYS::LicenseMgr::GetCC
+80547b20 RKSYS::LicenseMgr::WriteCPUDifficulty
+80547b48 RKSYS::LicenseMgr::GetCPUDifficulty
+80547b5c RKSYS::LicenseMgr::WriteVehicleType
+80547b84 RKSYS::LicenseMgr::GetVehicleType
+80547b98 RKSYS::LicenseMgr::WriteCourseChoice
+80547bc0 RKSYS::LicenseMgr::GetCourseChoice
+80547bd4 RKSYS::LicenseMgr::WriteItemsType
+80547bfc RKSYS::LicenseMgr::GetItemsType
+80547c10 RKSYS::LicenseMgr::WriteTotalRaceCount
+80547c38 RKSYS::LicenseMgr::GetTotalRaceCount
+80547c4c RKSYS::LicenseMgr::WriteUnkTimer2
+80547d1c RKSYS::LicenseMgr::GetUnkTimer2
+80547d30 RKSYS::LicenseMgr::GetRKPD_1BC
+80547d74 RKSYS::LicenseMgr::WriteRKPD_1BC
+80547e1c RKSYS::LicenseMgr::GetRKPD_5680
+80547e28 RKSYS::LicenseMgr::WriteRKPD_5680
+80547e84 RKSYS::LicenseUnk5680::Get_0
+80547e8c RKSYS::LicenseUnk5680::Get_7
+80547e94 RKSYS::LicenseUnk5680::Get_11
+80547e9c RKSYS::LicenseMgr::GetRKPD_5688
+80547eac RKSYS::LicenseMgr::WriteRKPD_5688
+80547f08 RKSYS::LicenseMgr::WriteRKPD_568c
+80547f40 RKSYS::LicenseMgr::GetRKPD_568c
+80547f4c RKSYS::LicenseMgr::WriteRKPD_5688_31
+80547f6c RKSYS::LicenseMgr::GetRKPD_5688_31
+80547f78 RKSYS::LicenseMgr::WriteMagic
+80547f98 RKSYS::LicenseUnk5680::__ct(copy)
+80547fbc RKSYS::Mgr::EraseLicense
+80548030 RKSYS::Mgr::CreateLicense
+80548100 0x80548100
+80548104 RKSYS::Reset
+80548224 RKSYS::SetCRC
+80548260 RKSYS::IsCRCCorrect
+805482a8 RKSYS::CheckMagicAndVersion
+805482d8 RKSYS::CheckRegion
+80548300 RKSYS::ResetRKPD
+80548454 RKSYS::CreateRKPD
+805484f4 RKSYS::ReadRKPDCup
+805485b8 RKSYS::ReadRKPDLdbEntry
+80548658 RKSYS::ReadRKPDUnkTimer
+805486c0 RKSYS::ReadRKPDUnkTimer2
+8054884c RKSYS::WriteRKPDLdbEntry
+80548964 RKSYS::WriteRKPDUnkTimer
+80548a40 RKSYS::WriteRKPDUnkTimer2
+80548afc RKSYS::ResetRKGD
+80548b8c RKSYS::GetRKGDUnk8Idx
+80548c58 RKSYS::SetRKGDUnk8
+80548e30 RKSYS::LicenseMgr::GetLdbEntry(CourseId)
+80548e90 RKSYS::LicenseMgr::OverwriteAndStoreLdbEntry
+80548f84 RKSYS::LicenseMgr::StoreLdbEntry
+805490f4 RKSYS::LicenseMgr::GetGhostPosition
+805491e4 RKSYS::LicenseMgr::GetBestRank
+805493b0 RKSYS::LicenseMgr::GetFavouriteCharacter
+80549470 RKSYS::LicenseMgr::GetFavouriteKart
+80549550 RKSYS::LicenseMgr::GetFavouriteTrack
+80549670 RKSYS::LicenseMgr::GetFavouriteBattleArena
+80549720 RKSYS::LicenseMgr::GetWheelRacesPercentage
+80549810 RKSYS::LicenseMgr::GetInFirstPercentage
+80549878 RKSYS::LicenseMgr::Copy5680To5688
+80549898 RKSYS::LicenseMgr::Generate5688Bitfield
+805498d0 RKSYS::LicenseCompletion::Reset
+805498e8 RKSYS::LicenseCompletion::GetOffsetAndRelativeBit
+805498fc RKSYS::LicenseCompletion::SetComplete
+80549924 RKSYS::LicenseCompletion::ResetComplete
+8054994c RKSYS::LicenseCompletion::IsCompleted
+8054997c RKSYS::Mgr::GetGhostOffset
+805499bc RKSYS::Mgr::ReadGhostTask
+80549a14 RKSYS::Mgr::ReadGhost
+80549a68 RKSYS::Mgr::ReadGhostAsync
+80549c44 RKSYS::Mgr::LoadGhostGroupTask
+80549c50 RKSYS::Mgr::LoadGhostGroup
+80549dac RKSYS::Mgr::LoadGhostGroupAsync
+80549ee4 RKSYS::Mgr::WriteGhostTask
+80549f98 RKSYS::Mgr::WriteGhost
+8054a048 RKSYS::Mgr::SaveGhostAsync
+8054a288 RKSYS::Mgr::EraseGhostTask
+8054a328 RKSYS::Mgr::EraseGhost
+8054a3c4 RKSYS::Mgr::EraseGhostAsync
+8054a5c8 RKSYS::Mgr::GetValidLicensesCount
+8054a658 RKSYS::Mgr::GetCombinedLicenseCompletions
+8054a73c RKSYS::Mgr::ReplaceBinaryTask
+8054a748 RKSYS::Mgr::ReplaceBinary
+8054a868 RKSYS::Mgr::EraseBinary
+8054a9b8 RKSYS::Mgr::GetCountry
+8054a9e0 RKSYS::Mgr::GetLongitude
+8054aa08 RKSYS::Mgr::GetLatitude
+8054aa30 GameSceneCreator::CreateInstance
+8054aa64 GameSceneCreator::create
+8054ab28 GameSceneCreator::destroy
+8054ab2c LensFlare::QuadDrawer::__ct
+8054adb0 0x8054adb0
+8054adb4 GameScreenEffectsMgr::GetRootScreenWidth
+8054add0 GameScreenEffectsMgr::GetRootScreenHeight
+8054adf0 LensFlare::QuadDrawer::Draw
+8054afc4 0x8054afc4
+8054b094 LensFlare::Texture::__ct
+8054b164 LensFlare::Texture::SetPosition
+8054b1a8 LensFlare::Texture::CopyFromEFB
+8054b1d4 0x8054b1d4
+8054b310 LensFlare::__ct
+8054b514 0x8054b514
+8054b578 LensFlare::__dt
+8054b62c LensFlare::OnFadeOutPrepareStart
+8054b66c LensFlare::FadeOutPrepareUpdate
+8054b7c4 LensFlare::OnFadeOutStart
+8054b7c8 LensFlare::FadeOutUpdate
+8054b870 LensFlare::OnNoTargetStart
+8054b8c0 LensFlare::NoTargetUpdate
+8054b91c LensFlare::OnNormalStateStart
+8054b9cc LensFlare::OnNormalStateUpdate
+8054bb08 LensFlare::Update
+8054be10 Vec2::MultiplyByScalar
+8054be2c LensFlare::DrawQuads
+8054be94 LensFlare::CopyEFBToTexture
+8054bec0 0x8054bec0
+8054bec8 0x8054bec8
+8054bf50 LensFlareMgr::__ct
+8054c350 LensFlareMgr::__dt
+8054c414 LensFlareMgr::GetBRRESTexCount
+8054c41c LensFlareMgr::GetRawTexture
+8054c498 LensFlareMgr::GetTextureWidth
+8054c500 LensFlareMgr::GetTextureHeight
+8054c568 LensFlareMgr::GetTextureName
+8054c5e4 LensFlareMgr::GetTextureFormat
+8054c5f4 LensFlareMgr::Update
+8054c660 LensFlareMgr::DrawTextures
+8054c7b0 LensFlareMgr::Draw
+8054c834 LensFlareMgr::CopyEFBToTextures
+8054c8f0 LensFlareMgr::AddLensFX
+8054c958 LensFlareMgr::EnableExternalLens
+8054c97c LensFlareMgr::GetTargetPosition
+8054cc44 LensFlareMgr::GetScreenPosition
+8054ce2c 0x8054ce2c
+8054ce58 0x8054ce58
+8054ce90 FilterEffect::__ct
+8054d0b0 0x8054d0b0
+8054d114 FilterEffectMgr::SetColor
+8054d13c FilterEffect::Update
+8054d210 0x8054d210
+8054d220 0x8054d220
+8054d22c 0x8054d22c
+8054d2c8 0x8054d2c8
+8054d2cc 0x8054d2cc
+8054d320 0x8054d320
+8054d324 0x8054d324
+8054d33c 0x8054d33c
+8054d34c 0x8054d34c
+8054d36c 0x8054d36c
+8054d370 0x8054d370
+8054d388 FilterEffect::Draw
+8054d488 FilterEffectMgr::__ct
+8054d6f4 FilterEffectMgr::__dt
+8054d7ac FilterEffect:__dt
+8054d814 FilterEffectMgr::Update
+8054d908 FilterEffectMgr::Draw
+8054da50 0x8054da50
+8054da74 0x8054da74
+8054daa4 0x8054daa4
+8054dc44 CourseFilterEffect::__ct
+8054de24 0x8054de24
+8054de88 CourseFilterEffect::Update
+8054df5c CourseFilterEffect::OnNoFilterStart
+8054df6c CourseFilterEffect::OnWhiteFilterPrepareStart
+8054df90 CourseFilterEffect::WhiteFilterPrepareUpdate
+8054dfe4 CourseFilterEffect::OnWhiteFilterStart
+8054dfe8 CourseFilterEffect::WhiteFilterUpdate
+8054e000 CourseFilterEffect::OnBlackFilterStart
+8054e020 CourseFilterEffect::BlackFilterUpdate
+8054e038 CourseFilterEffect::OnAlphaFadeoutStart
+8054e03c CourseFilterEffect::AlphaFadeoutUpdate
+8054e098 CourseFilterEffect::Draw
+8054e198 CourseFilterEffectMgr::__ct
+8054e3c8 CourseFilterEffectMgr::__dt
+8054e480 CourseFilterEffect::__dt
+8054e4e8 CourseFilterEffectMgr::Update
+8054e5dc CourseFilterEffectMgr:Draw
+8054e714 0x8054e714
+8054e72c 0x8054e72c
+8054e8cc CreditsBars::__ct
+8054e9a8 0x8054e9a8
+8054e9ac CreditsBars::Init
+8054e9d4 CreditsBars::Draw
+8054eb54 GameScreenEffectsMgr::__ct
+8054f120 GameScreenEffectsMgr::__dt
+8054f1b0 GameScreenEffectsMgr::Update
+8054f3c8 0x8054f3c8
+8054f41c GameScreenEffectsMgr::Draw
+8054f7a4 GameScreenEffectsMgr::DrawCourseFilterEffects
+8054f8e0 GameScreenEffectsMgr::CopyEFBToLensFlareTextures
+8054f9a8 GameScreenEffectsMgr::AddLensFX
+8054fa10 GameScreenEffectsMgr::EnableExternalLensFlare
+8054fa38 0x8054fa38
+8054fa60 0x8054fa60
+8054fa94 GameScreenEffectsMgr::RequestWhiteCourseFilter
+8054fab0 CreditsBars::__dt
+8054faf0 GameScreenEffects_cpp_sinit_
+8054fb2c IsVehicleTypeUnlocked
+8054fbd4 0x8054fbd4
+8054fbe4 GetCupType
+8054fc44 IsCupUnlocked
+8054fed8 IsCharacterUnlocked
+8054ff0c IsCharacterUnlocked_switch
+8054ff10 IsCharacterUnlocked_caseD_11
+8054ffa8 IsCharacterUnlocked_caseD_18
+80550000 0x80550000
+80550030 IsCharacterUnlocked_caseD_1a
+805500b4 IsCharacterUnlocked_caseD_10
+805500cc IsKartUnlocked
+805501a4 0x805501a4
+805501c4 0x805501c4
+80550468 isFastStaffGhostUnlocked
+80550548 0x80550548
+805506e8 0x805506e8
+805506ec BitRotator::__ct
+8055070c BitRotator::Update
+80550730 GetTick
+80550734 GetHour
+805507b0 THP::CreateAudioDecodeThread
+80550880 THP::AudioDecodeThreadStart
+805508a0 THP::AudioDecodeThreadCancel
+805508e8 THP::AudioDecoder
+80550910 THP::AudioDecoderForOnMemory
+805509bc THP::AudioDecode
+80550aa8 THP::PopFreeAudioBuffer
+80550adc THP::PushFreeAudioBuffer
+80550af0 THP::PopDecodedAudioBuffer
+80550b34 THP::PushDecodedAudioBuffer
+80550b48 THP::PlayerInit
+80550c68 THP::PlayerQuit
+80550cc0 THP::PlayerOpen
+80550f48 THP::PlayerClose
+80550f9c THP::PlayerCalcNeedMemory
+80551054 THP::PlayerSetBuffer
+80551294 THP::InitAllMessageQueue
+80551364 THP::PrepareReady
+80551378 THP::PlayerPrepare
+805515f8 THP::PlayerPlay
+80551658 THP::PlayerStop
+80551734 THP::PlayerPause
+80551770 THP::PlayerSkip
+80551940 THP::PlayControl
+80551c04 THP::ProperTimingForGettingNextFrame
+80551d30 THP::PlayerDrawCurrentFrame
+80551d38 THP::PlayerGetVideoInfo
+80551d80 THP::PlayerGetAudioInfo
+80551dc8 THP::PlayerGetFrameRate
+80551df0 THP::PlayerGetTotalFrame
+80551e14 THP::PlayerGetState
+80551e24 THP::PlayerDrawDone
+80551e94 0x80551e94
+80551f00 THP::AudioMixCallback
+8055206c THP::MixAudio
+80552438 THP::PlayerSetVolume
+80552564 THP::PlayerGetVolume
+8055259c THP::CreateReadThread
+8055263c THP::ReadThreadStart
+8055265c THP::ReadThreadCancel
+805526a4 THP::Reader
+80552794 THP::PopReadedBuffer
+805527c8 THP::PopReadedBuffer2
+805527dc THP::PopFreeReadBuffer
+80552810 THP::PushFreeReadBuffer
+80552824 THP::PopReadedBuffer2
+80552858 THP::PushReadedBuffer2
+8055286c THP::CreateVideoDecodeThread
+80552940 THP::VideoDecodeThreadStart
+80552960 THP::VideoDecodeThreadCancel
+805529a8 THP::VideoDecoder
+80552a74 THP::VideoDecoderOnMemory
+80552ba4 THP::VideoDecode
+80552cf0 THP::PopFreeTextureSet
+80552d24 THP::PushFreeTextureSet
+80552d38 THP::PopDecodedTextureSet
+80552d7c THP::PushDecodedTextureSet
+80552d90 courseIdToGhostIndex
+80552e74 GetCourseIdBySlot
+80552e98 0x80552e98
+80553038 0x80553038
+80553180 0x80553180
+80553314 0x80553314
+80553564 0x80553564
+8055368c 0x8055368c
+805536d8 0x805536d8
+805536fc 0x8055368c_switch
+80553700 0x8055368c_switch_805536fc::CaseD_0
+80553708 0x8055368c_switch_805536fc::CaseD_fffffffe
+80553720 0x8055368c_switch_805536fc::CaseD_fffffffc
+80553728 0x8055368c_switch_805536fc::CaseD_ffffffff
+80553730 0x8055368c_caseD_fffffff2
+80553788 0x80553788
+805537cc 0x805537cc
+80553824 0x80553824
+80553828 0x80553828
+8055382c 0x8055382c
+80553838 0x80553838
+80553844 0x80553844
+80553850 GlobeScene::__ct
+80553894 GlobeScene::__dt
+805538ec GlobeScene::OnEnter
+805539b8 GlobeScene::CreateAndInitInstances
+80553a88 GlobeScene::OnEnterEnd
+80553ac8 GlobeScene::OnExit
+80553b10 GlobeScene::OnCalc
+80553b88 RaceScene::__ct
+80553bd4 RaceScene::__dt
+80553c50 RaceScene::OnEnter
+80554208 RaceScene::CreateAndInitInstances
+8055472c RaceScene::OnEnterEnd
+805549ac RaceScene::vf_0x58
+805549b0 RaceScene::OnExit
+80554a94 RaceScene::OnReinit
+80554ad4 RaceScene::UpdateRaceInstances
+80554d10 0x80554d10
+80554d90 RaceScene::UpdateSomeInstances
+80554e14 RaceScene::isPaused
+80554e6c RaceScene::OnCalc
+80554f68 RaceScene::GetScreenCount
+80554f78 RaceScene::isSpectating
+80554f88 RaceScene::vf_0x48
+80554f94 RaceScene::vf_0x50
+80554f9c RaceScene::vf_0x58
+80554fa4 MenuScene::__ct
+80554fe8 MenuScene::__dt
+80555040 MenuScene::OnEnter
+80555154 MenuScene::CreateAndInitInstances
+80555264 MenuScene::OnEnterEnd
+80555298 MenuScene::OnExit
+805552c8 MenuScene::OnCalc
+8055531c RelProlog
+80555368 RelEpilog
+805553b0 RelUnresolvedSection
+80555464 Random::__ct
+805554d0 Random::Reset
+80555514 Random::__ct(seed)
+80555538 Random::__dt
+80555578 Random::Next
+805555cc Random::NextLimited
+80555628 Random::NextFloat
+805556a8 Random::NextFloatLimited
+8055572c 0x8055572c
+80555750 ModelTransformator::__ct
+8055585c ModelTransformator::AppendAnmHolder
+80555864 ModelTransformator::AppendAnmBlend
+8055586c ModelTransformator::SetBlendWeightDecrement
+80555890 ModelTransformator::GetBlendWeightDecrement
+805558bc ModelTransformator::DecrementBlendWeight
+805558ec ModelTransformator::DetachAllAnmFromBlend(type)
+8055591c ModelTransformator::DetachAllAnmFromBlend(listIdx)
+8055597c ModelTransformator::LinkAnimationByName
+80556718 ModelTransformator::IsG3dObj
+80556734 AnmChrBlendHolder::__dt
+80556774 0x80556774
+805567b4 ModelTransformator::LinkAnimationByBRRESIdx
+80556f10 ModelTransformator::LinkChrAnmToBone
+805570ec 0x805570ec
+805571a4 ModelTransformator::LinkEmptyAnm
+80557234 ModelTransformator::GetAnmHolderByIdx
+8055723c ModelTransformator::GetAnmObjByIdx
+80557264 ModelTransformator::AddAnmToScnMdlAndSetupBRASD
+805572f0 ModelTransformator::AddAnmToScnMdl
+80557308 ModelTransformator::OverwriteAnm
+80557328 ModelTransformator::RestoreAnm
+80557340 ModelTransformator::GetAnmHolderByType
+80557350 ModelTransformator::GetPrevAnmHolderByType
+80557360 ModelTransformator::IsTypeActive
+8055737c ModelTransformator::IsTypeInPrev
+80557398 ModelTransformator::GetAnmObjByType
+805573ac ModelTransformator::DetachHolderFromParent
+805573cc ModelTransformator::PlayAnmNoBlend
+80557548 0x80557548
+80557650 ModelTransformator::AddAnmBlendToScnMdl
+80557684 ModelTransformator::PlayAnmWithBlend
+80557830 ModelTransformator::StopAnmType
+805578d8 ModelTransformator::UpdateBRASDAndBlend
+80557954 AnmHolder::GetFrame
+80557960 ModelTransformator::UpdateBlend
+80557b20 AnmHolder::IsLooped
+80557b28 AnmHolder::GetFrameCount
+80557b34 0x80557b34
+80557bb8 ModelTransformator::Bind
+80557c10 ModelTransformator::UpdateActiveAnms
+80557cf8 0x80557cf8
+80557d90 0x80557d90
+80557dd0 0x80557dd0
+80557ef4 0x80557ef4
+80557fb0 ModelTransformator::vf_0x8
+80557fb4 AnmHolder::SetUpdateRate
+80557fb8 AnmHolder::GetUpdateRate
+80557fc4 AnmHolder::UpdateRateAndSetFrame
+80557fc8 AnmHolder::SetFrame
+80557fcc 0x80557fcc
+8055800c 0x8055800c
+80558054 0x80558054
+805580a4 0x805580a4
+805582e8 0x805582e8
+805583e8 0x805583e8
+80558538 0x80558538
+80558704 0x80558704
+80558794 AnmTexPatOverrideHolder::__dt
+805587d4 AnmTexPatOverrideHolder::SetWeight
+8055881c AnmTexPatOverrideHolder::GetWeight
+8055886c AnmTexPatOverrideHolder::AttachNew
+80558ab0 AnmTexPatOverrideHolder::Attach
+80558bb0 AnmTexPatOverrideHolder::DecrementWeight
+80558d00 AnmTexPatOverrideHolder::ShouldDetachFromParent
+80558ecc AnmTexPatOverrideHolder::DetachAll
+80558f5c 0x80558f5c
+80558f9c 0x80558f9c
+80558fe4 0x80558fe4
+80559034 0x80559034
+80559278 0x80559278
+80559378 0x80559378
+805594c8 0x805594c8
+80559694 0x80559694
+80559724 0x80559724
+80559764 0x80559764
+805597ac 0x805597ac
+805597fc 0x805597fc
+80559a40 0x80559a40
+80559b40 0x80559b40
+80559c90 0x80559c90
+80559e5c 0x80559e5c
+80559eec AnmChrBlendHolder::__dt
+80559f2c AnmChrBlendHolder::SetWeight
+80559fdc AnmChrBlendHolder::GetWeight
+8055a07c AnmChrBlendHolder::AttachNew
+8055a2c0 AnmChrBlendHolder::Attach
+8055a3c0 AnmChrBlendHolder::DecrementWeight
+8055a510 AnmChrBlendHolder::ShouldDetachFromParent
+8055a6dc AnmChrBlendHolder::DetachAll
+8055a76c 0x8055a76c
+8055a780 0x8055a780
+8055a794 0x8055a794
+8055a800 0x8055a800
+8055a884 0x8055a884
+8055a8e8 0x8055a8e8
+8055a8fc 0x8055a8fc
+8055a910 AnmTexPatHolder::GetFrame
+8055a924 AnmTexPatHolder::SetFrame
+8055a938 AnmTexPatHolder::UpdateRateAndSetFrame
+8055a9a4 AnmTexPatHolder::GetFrameCount
+8055aa28 AnmTexPatHolder::IsLooped
+8055aa8c AnmTexPatHolder::GetUpdateRate
+8055aaa0 AnmTexPatHolder::SetUpdateRate
+8055aab4 0x8055aab4
+8055aac8 0x8055aac8
+8055aadc 0x8055aadc
+8055ab48 0x8055ab48
+8055abcc 0x8055abcc
+8055ac30 0x8055ac30
+8055ac44 0x8055ac44
+8055ac58 0x8055ac58
+8055ac6c 0x8055ac6c
+8055ac80 0x8055ac80
+8055acec 0x8055acec
+8055ad70 0x8055ad70
+8055add4 0x8055add4
+8055ade8 0x8055ade8
+8055adfc AnmChrHolder::GetFrame
+8055ae10 AnmChrHolder::SetFrame
+8055ae24 AnmChrHolder::UpdateRateAndSetFrame
+8055ae90 AnmChrHolder::GetFrameCount
+8055af14 AnmChrHolder::IsLooped
+8055af78 AnmChrHolder::GetUpdateRate
+8055af8c AnmChrHolder::SetUpdateRate
+8055afa0 0x8055afa0
+8055afd0 0x8055afd0
+8055aff0 0x8055aff0
+8055b05c ModelDirector::SetScale
+8055b0b0 0x8055b0b0
+8055b128 0x8055b128
+8055b194 0x8055b194
+8055b1e8 0x8055b1e8
+8055b1f8 0x8055b1f8
+8055b258 0x8055b258
+8055b298 ModelDirector::__ct(ClipInfo)
+8055b50c ModelDirector::__ct
+8055b558 ModelDirector::__ct(ScnMgrIdx)
+8055b5bc ModelDirector::__dt
+8055b5fc ModelDirector::GetBRRES
+8055b618 ModelDirector::BindBRRES
+8055b6a4 ModelDirector::BindBRRESFallback
+8055b754 ModelDirector::RipAndBindBRRES
+8055b7f8 ModelDirector::BindBRRESImpl
+8055ba00 ModelDirector::BRRESExists
+8055ba44 ModelDirector::GetResMdl(string)
+8055ba54 ModelDirector::GetResMdl(idx)
+8055ba64 ModelDirector::MdlExists
+8055ba9c ModelDirector::HasResMdl
+8055baa0 ModelDirector::Init
+8055bd00 ModelDirector::InitG3D
+8055bed4 ModelDirector::AppendToScnMgr
+8055bf10 ModelDirector::CreateScn
+8055c0e8 ModelDirector::LoadWithAnm(name)
+8055c1d0 ModelDirector::LoadWithAnm(idx)
+8055c2b8 ModelDirector::LoadNoAnm(name)
+8055c318 ModelDirector::LoadNoAnm(idx)
+8055c378 ModelDirector::LoadWithOption(name)
+8055c44c ModelDirector::LoadWithOption(idx)
+8055c520 ModelDirector::LoadScnMdl1Mat1Shp
+8055c580 MiiHeadsModel::InitModel
+8055c7f4 0x8055c7f4
+8055c8c4 0x8055c8c4
+8055c93c 0x8055c93c
+8055c9f0 ModelDirector::ToggleVisible
+8055cb08 ModelDirector::EnableDraw
+8055cbd0 0x8055cbd0
+8055cc0c ModelDirector::UpdateVisibility
+8055cce0 ModelDirector::EnableScreen
+8055ccf8 ModelDirector::DisableScreen
+8055cd10 ModelDirector::IsVisibleOnScreen
+8055cd30 ModelDirector::EnableScreen2
+8055cd48 ModelDirector::IsVisibleOnScreen2
+8055cd68 ModelDirector::SetScnMdlOptions
+8055ce84 0x8055ce84
+8055cf08 0x8055cf08
+8055cf90 0x8055cf90
+8055d03c 0x8055d03c
+8055d0f4 0x8055d0f4
+8055d23c ModelDirector::Update
+8055d2f4 0x8055d2f4
+8055d448 ModelDirector::SetAllScnOptionsFromClipInfo
+8055d554 ModelDirector::SetDisableDrawScnOptionsFromClipInfo
+8055d6bc 0x8055d6bc
+8055d82c 0x8055d82c
+8055d920 0x8055d920
+8055d9f0 ModelDirector::CreateTransformator
+8055daf0 0x8055daf0
+8055dc00 0x8055dc00
+8055dce4 ModelDirector::SetAudioActor
+8055ddec ModelDirector::LinkAnimation
+8055df80 0x8055df80
+8055e0f4 0x8055e0f4
+8055e274 ModelDirector::LinkEmptyAnm
+8055e388 0x8055e388
+8055eae0 ModelDirector::LinkAllAnimations
+8055f1e4 ModelDirector::PrepareAllAnms
+8055f27c 0x8055f27c
+8055f28c 0x8055f28c
+8055f2ac 0x8055f2ac
+8055f2b4 ModelDirector::SetLight
+8055f2c4 ModelDirector::GetScnMgr
+8055f2fc ModelDirector::RemoveFromGroup
+8055f34c ModelDirector::ToggleTransparent
+8055f3e8 ModelDirector::ReplaceMatGXTexObj
+8055f41c 0x8055f41c
+8055f4c4 ModelDirector::UpdateDrawPriority
+8055f508 0x8055f508
+8055f5e4 0x8055f5e4
+8055f6a8 0x8055f6a8
+8055f754 0x8055f754
+8055f7d8 ModelDirector::ChangeTransformator
+8055f848 ModelDirector::GetScale
+8055f894 ModelDirector::SetScale(float)
+8055f8d0 ModelCalcBase::__ct
+8055f8dc 0x8055f8dc
+8055f9bc 0x8055f9bc
+8055fa90 ModelCalcCallback::GetBoneWorldMtx
+8055fb64 0x8055fb64
+8055fc44 0x8055fc44
+8055fd18 0x8055fd18
+8055fdec 0x8055fdec
+8055fe34 ModelCalcCallback::__ct
+8055fee8 0x8055fee8
+8055ff28 ModelCalcCallback::ExecCallback_CALC_WORLD
+8055ff4c ModelCalcCBBoneLinked::__ct
+80560010 ModelCalcCallback::__dt
+80560050 ModelCalcCBBoneLinked::ExecWorldCBImpl
+8056022c 0x8056022c
+805602f4 ModelCalcCBBoneLinked::__dt
+80560334 ModelCalcCallback::ExecCallback_CALC_XLU
+80560338 ModelCalcCallback::ExecCallback_CALC_OPA
+8056033c ModelCalcCallback::ExecCallback_CALC_VIEW
+80560340 ModelCalcCallback::ExecCallback_CALC_MAT
+80560344 0x80560344
+80560348 0x80560348
+80560388 ModelCalcCallback::__dt(thunk)
+80560390 ModelCalcCBBoneLinked::__dt(thunk)
+80560398 ModelCalcCallback::ExecCallback_CALC_WORLD(thunk)
+805603a0 0x805603a0
+805603a8 Light::__ct
+8056058c 0x8056058c
+80560648 Light::Init
+805607fc 0x805607fc
+805609a4 0x805609a4
+80560aa0 0x80560aa0
+80560afc Light::InitLightObject
+80560c34 0x80560c34
+80560c90 0x80560c90
+80560d20 Light::Update
+80561000 0x80561000
+80561024 LightMgrHolder::__ct
+805610e8 LightMgrHolder::805610e8
+8056120c LightMgrHolder::8056120c
+805612e8 LightMgrHolder::LoadBLIGHT
+805612ec LightMgrHolder::805612ec
+8056138c 0x8056138c
+80561398 LightMgrHolder::AcquireLight
+80561404 LightMgrHolder::moveFromAtoB
+80561450 LightMgrHolder::vf_0x10
+8056156c LightMgrHolder::Update
+805615f0 LightMgrHolder::LoadBLMAP
+80561688 LightMgrHolderRace::__ct
+80561948 LightMgrHolder::__dt
+80561988 LightMgrHolderRace::LoadBLIGHT
+80561a88 LightMgrHolder::LoadBLMAP
+80561b18 LightMgrHolderMenu_construct
+80561be8 LightMgrHolderMenu_loadBlight
+80561c40 LightMgrHolderMenu_loadLightMap
+80561c9c LightMgrHolderMiiBody_construct
+80561d6c LightMgrHolderMiiBody_loadBlight
+80561dd4 LightMgrHolderMiiBody_loadLightMap
+80561e40 LightMgrHolderMiiBody_destruct
+80561e80 LightMgrHolderMenu_destruct
+80561ec0 LightMgrHolderRace::destruct
+80561f00 Light::__dt
+80561f40 ScnMgr::__ct
+80562064 0x80562064
+805620bc ScnMgr::__dt
+80562144 ScnMgr::ResetRenderModeObj
+80562180 ScnMgr::InitImpl
+80562350 ScnMgr::LoadPostEffects
+80562354 ScnMgr::vf_0x28
+80562358 ScnMgr::CreateAllGroups
+80562444 ScnMgr::CreateScnGroup
+80562470 ScnMgr::LoadLights
+805624cc ScnMgr::DrawLights
+8056251c 0x8056251c
+80562520 ScnMgr::DoneDraw
+805625a8 ScnMgr::DrawModelsImpl
+80562888 ScnMgr::UpdateScnRoot
+80562b34 ScnMgr::UpdateCameras
+80562bf0 GameCamera::GetViewMatrix
+80562bf8 ScnMgr::RemoveShadowTextureMgr
+80562c0c 0x80562c0c
+80562c8c 0x80562c8c
+80562cbc ScnMgr::InsertModelDirectorInScn
+80562e90 ScnMgr::SetModelDrawPriority
+80562f60 ScnMgr::SetModelXluDrawPriority
+80562f80 0x80562f80
+80563068 0x80563068
+805630ec 0x805630ec
+805631ac 0x805631ac
+8056326c ScnMgr::SetAnmScn
+80563410 ScnMgr::SetRootAnmScn
+805635b4 ScnMgr::AppendScnGroupExHolder
+805635c4 ScnMgr::RemoveModelDirector
+805635cc ScnMgr::AppendScreenSpecificModelDirector
+805635d4 ScnMgr::AppendMatModelDirector
+805635dc ScnMgr::RemoveMatModelDirector
+805635e4 ScnMgr::SwitchScnRoot
+80563674 ScnMgr::UpdateVisibility
+805636dc 0x805636dc
+805637f4 0x805637f4
+805638fc ScnMgr::CreateScnGroupEx
+80563a78 ScnMgr::RearrangeDirectorGroups
+80563b9c ScnMgr::80563b9c
+80563be8 ScnMgr::80563be8
+80563c38 ScnMgr::80563c38
+80563c84 ScnGroupExHolder::__ct
+80563ce4 TextureHolder::__ct
+80563db0 TextureHolder::CopyFromEFB
+80563ee8 TextureHolder::80563ee8
+80564074 ScnMgr::UpdateModelDrawPriority
+8056410c ScnMgr::RemoveGroup
+80564140 ScnMgr::InsertGroup
+8056417c ScnMgr::GetScnGroup
+805641d8 TextureHolder::__dt
+80564218 ScnMgr::vf_0x2c
+8056421c ScnMgr::DrawModels
+80564224 ScnMgr::CalcSelf
+80564228 ScnMgr::vf_0xC
+8056422c ScnMgr::Init
+80564238 ScnGroupHolder::__dt
+80564278 ScnGroupExHolder::__dt
+805642b8 Renderer::__ct
+8056430c Renderer::__dt
+80564378 RendererWithModels::__ct
+805643cc RendererWithModels::__dt
+80564444 RendererWithModels::Calc
+80564458 RendererWithModels::Draw
+805644a8 RendererWithModels::DrawWithProjection
+805644ec 0x805644ec
+80564618 RendererMixed::__ct
+8056466c RendererMixed::Draw
+80564688 RendererMii::__ct
+805646e4 RendererMixed::__dt
+80564760 RendererMii::DrawModels
+805647bc RendererMii::__dt
+8056483c ScnMgr::InitScn
+805649a0 0x805649a0
+805649e8 0x805649e8
+80564a14 0x80564a14
+80564adc ScnMgr::CalcAll
+80564b7c ScnMgr::Calc(idx)
+80564c44 0x80564c44
+80564c64 ScnMgr::Draw(idx)
+80564d60 ScnMgr::DrawMain
+80564e38 ScnMgr::DrawSecondary
+80564fa4 0x80564fa4
+80564fbc Renderer::Remove(internal idx)
+80564ff4 ScnMgr::Unregister
+80565030 ScnMgr::Reset
+805650b0 ScnMgr::Finalize
+80565114 Renderer::Register(listIdx)
+80565164 Renderer::RegisterAndAppendScreen
+80565268 Renderer::Register2ndList(NoAppend)
+805652ac Renderer::Remove(listIdx)
+805652c4 Renderer::RemoveFrom1stList
+805652d4 Renderer::RemoveFrom2ndList
+805652e8 Renderer::Register(bool Append)
+8056539c ScnMgr::Register
+805653d0 0x805653d0
+8056543c 0x8056543c
+80565494 0x80565494
+805654ec 0x805654ec
+80565630 ScnMgr::AcquireLight
+80565640 0x80565640
+80565654 0x80565654
+80565664 0x80565664
+80565674 0x80565674
+805656c4 0x805656c4
+805656c8 0x805656c8
+8056572c 0x8056572c
+805657a4 0x805657a4
+8056581c GameScreen::__ct
+805658f0 0x805658f0
+80565ac8 0x80565ac8
+80565b08 0x80565b08
+80565b48 0x80565b48
+80565b50 0x80565b50
+80565b88 0x80565b88
+80565bc8 0x80565bc8
+80565cb8 0x80565cb8
+80565d14 0x80565d14
+80565da0 GameScreen::SetAndLoadOrthoProj
+80565e88 0x80565e88
+80565f70 0x80565f70
+80566020 GameScreen::SetAndLoadProjection
+805660d0 0x805660d0
+80566180 0x80566180
+805661e8 GameScreen::SetProjection
+80566278 0x80566278
+80566330 0x80566330
+805663b8 0x805663b8
+8056645c 0x8056645c
+805664e4 0x805664e4
+80566584 0x80566584
+80566670 0x80566670
+805666b0 0x805666b0
+805666f0 0x805666f0
+80566824 0x80566824
+80566958 0x80566958
+80566bb8 GameScreen::Set16_9AspectRatio
+80566c20 GameScreen::Set4_3AspectRatio
+80566ca0 GameScreen::Init
+80566dbc 0x80566dbc
+80566e38 GameScreen::CalcDimensions
+80566f6c GameScreen::GetAbsoluteToView
+80566fc0 GameScreen::GetViewToScreen
+80566fc4 GameScreen::GetAbsoluteToScreen
+80567044 0x80567044
+805670b4 0x805670b4
+80567130 GameScreen::__dt
+80567170 RendererGlobe::__ct
+805671ac RendererMenu::__dt
+8056720c 0x8056720c
+80567268 RendererGlobe::__dt
+805672cc Kart::Damage::__ct
+8056735c 0x8056735c
+8056739c Kart::Damage::Reset
+805673b0 Kart::Damage::Update
+805674f4 Kart::Damage::SetAffectedByPOW
+805674fc Kart::Damage::SetPOWParams
+80567524 Kart::Damage::SetPOWParams(static)
+8056754c Kart::Damage::ShouldReceivePOWDamage
+80567578 Kart::Damage::ResetPOWParams
+80567594 Kart::Damage::UpdatePOWParams
+805675dc Kart::Damage::SetDamage
+80567a54 Kart::Damage::UpdateCurDamage
+80567a88 Kart::Damage::EndCurDamage
+80567b98 0x80567b98
+80567c68 0x80567c68
+80567ce4 Kart::Damage::UpdateCurDamageSpeed
+80567d3c Kart::Damage::ApplySpinDamage
+80567f68 Kart::Damage::ApplyBananaDamage
+80567fb4 Kart::Damage::ApplyGoombaDamage
+80568000 Kart::Damage::ApplyFireDamage
+8056804c Kart::Damage::ApplyShockDamage
+80568058 Kart::Damage::ApplyZapperDamage
+80568064 Kart::Damage::ApplyPOWDamage
+80568198 0x80568198
+80568204 Kart::Damage::UpdateSpinOutdamage
+8056837c Kart::Damage::OnSpinOutDamageEnd
+805683b8 Kart::Damage::UpdatePOWDamage
+80568558 Kart::Damage::vf_0x10
+80568620 Kart::Damage::OnPOWDamageEnd
+8056865c Kart::Damage::ApplyShellFIBDamage
+805686dc Kart::Damage::OnShellFIBDamageEnd
+80568718 Kart::Damage::ApplyStarDamage
+80568794 Kart::Damage::ApplyKnockback
+80568aa8 Kart::Damage::UpdateKnockbackDamage
+80568c40 0x80568c40
+80568c7c Kart::Damage::OnStarCarDamageEnd
+80568cb8 Kart::Damage::ApplyChompDamage
+80568d34 Kart::Damage::UpdateBigKnockbackDamage
+80568f68 Kart::Damage::OnBigKnockbackDamageEnd
+80568fa4 Kart::Damage::ApplyCarDamage
+80569024 Kart::Damage::ApplyBulletDamage
+805690a0 Kart::Damage::ApplyLaunchDamage
+805692b4 Kart::Damage::UpdateLaunchDamage
+805696c8 Kart::Damage::OnLaunchDamageEnd
+805696cc 0x805696cc
+80569774 Kart::Damage::ApplyThwompDamage
+80569818 Kart::Damage::ApplyMegaDamage
+805698bc Kart::Damage::ApplySquishRespawnDamage
+80569978 Kart::Damage::ApplyCarSquishDamage
+80569a1c Kart::Damage::UpdateSquishDamage
+80569ad0 Kart::Damage::OnSquishDamageEnd
+80569ae8 Kart::Damage::ApplyDrivingDirKnockback
+80569b94 Kart::Damage::ApplySidewaysKnockback
+80569d4c 0x80569d4c
+80569da4 0x80569da4
+80569dfc 0x80569dfc
+80569e9c 0x80569e9c
+80569f2c 0x80569f2c
+80569fb0 0x80569fb0
+8056a04c 0x8056a04c
+8056a164 Kart::Damage::vf_0x14
+8056a168 0x8056a168
+8056a1a8 Kart::Damage::__dt
+8056a1e8 0x8056a1e8
+8056a228 KartDamageCpp_sinit_
+8056a264 Kart::ModelsVisibility::__ct
+8056a2b0 0x8056a2b0
+8056a2f0 Kart::ModelsVisibility::SetInvisible
+8056a300 Kart::ModelsVisibility::SetModelsVisibility
+8056a470 Kart::ModelsVisibility::UpdateModelsVisibility
+8056a580 Kart::ModelsVisibility::SetModelDraw
+8056a59c Kart::ModelsVisibility::__dt
+8056a5dc Kart::MatTEVHandler::SetPartTEVSwapMode
+8056a5ec Kart::MatTEVHandler::__ct
+8056a630 Kart::MatTEVHandler::SetTexSwapModeAndSetTEVSwapModes
+8056a6d8 Kart::MatTEVHandler::SetTEVSwapModes
+8056a780 Kart::MatTEVHandler::SetModelTEVSwapMode(bool)
+8056a89c Kart::MatTEVHandler::SetModelTevColorOp
+8056a998 Kart::MatTEVHandler::SetTEVSwapModesNoTexModeUpdate
+8056aa28 Kart::MatTEVHandler::SetModelTEVSwapMode
+8056ab2c Kart::MatTEVHandler::__dt
+8056ab6c Kart::ScaleAnmController::LoadAnimations
+8056ac9c Kart::ScaleAnmController::GetAnmScale
+8056acf4 Kart::ScaleAnmController::GetPressUpAnmScale
+8056ad44 Kart::ScaleAnmController::__ct
+8056ae90 0x8056ae90
+8056aed0 0x8056aed0
+8056af10 Kart::ScaleAnmController::Reset
+8056afb4 Kart::ScaleAnmController::RequestScaleChange
+8056b060 0x8056b060
+8056b094 0x8056b094
+8056b0cc 0x8056b0cc
+8056b168 Kart::ScaleAnmController::RequestEndScale
+8056b218 Kart::ScaleAnmController::Update
+8056b45c 0x8056b45c
+8056b5a8 Kart::ScaleAnmController::__dt
+8056b5e8 KartScaleAnmController_cpp_sinit_
+8056b630 Kart::ScaleAnmController::__ct
+8056b63c Kart::StarAnmMgr::LoadAnm
+8056b8a8 Kart::StarAnmMgr::__ct
+8056b8ec Kart::StarAnmMgr::Activate
+8056b910 Kart::StarAnmMgr::Update
+8056bbac Kart::StarAnmMgr::StartEnding
+8056bbc0 Kart::StarAnmMgr::End
+8056bbcc Kart::StarAnmMgr::Reset
+8056bd08 0x8056bd08
+8056be20 Kart::StarAnmMgr::SetModelColorsImpl
+8056bf20 0x8056bf20
+8056c030 Kart::StarAnmMgr::SetModelColors
+8056c034 Kart::StarAnmMgr::__dt
+8056c074 0x8056c074
+8056c0cc Kart::Part::__dt
+8056c10c Kart::Arm::LoadModel
+8056c124 Kart::Arm::UpdateMatrix
+8056c394 Kart::Body::__ct
+8056c3fc Kart::Body::LoadModel
+8056c410 Kart::Body::CreateModelDirectors
+8056c458 Kart::Body::Init
+8056c4b4 Kart::Body::Reset
+8056c500 Kart::Body::vf_0x58
+8056c544 0x8056c544
+8056c588 0x8056c588
+8056c604 Kart::Body::GetMatrix
+8056c664 Kart::Body::UpdateMatrix
+8056c700 0x8056c700
+8056c7b8 0x8056c7b8
+8056c874 Kart::Body::vf_0x60
+8056c8f0 0x8056c8f0
+8056c950 0x8056c950
+8056c964 0x8056c964
+8056c9c4 0x8056c9c4
+8056c9e8 Kart::Body::Load2ndModel
+8056ca48 0x8056ca48
+8056cb5c 0x8056cb5c
+8056cc74 0x8056cc74
+8056ccc0 Kart::BodyKart::__ct
+8056cd84 Kart::Body::__dt
+8056cdc4 Kart::BodyKart::SetDispParams
+8056ce04 Kart::BodyKart::Load
+8056ce98 Kart::BodyKart::UpdateMatrix
+8056d118 Kart::BodyKart::vf_0xc
+8056d1ac Kart::BodyKart::vf_0x64
+8056d230 Kart::BodyKart::vf_0x24
+8056d280 Kart::BodyKart::ApplyStarColors
+8056d2f8 Kart::BodyKart::vf_0x2c
+8056d370 Kart::BodyKart::vf_0x30
+8056d3e8 Kart::BodyKart::UpdateModelDrawPriority
+8056d470 0x8056d470
+8056d4b0 Kart::BikeHandle::LoadModel
+8056d4c0 Kart::BikeHandle::UpdateMatrix
+8056d640 0x8056d640
+8056d680 Kart::BikeSwingArm::LoadModel
+8056d690 Kart::BikeSwingArm::UpdateMatrix
+8056d858 Kart::BodyBike::__ct
+8056d8f0 Kart::BikeHandle::__dt
+8056d930 Kart::BikeSwingArm::__dt
+8056d970 Kart::BodyBike::SetDispParams
+8056d984 Kart::BodyBike::LoadModel
+8056d998 Kart::BodyBike::Load
+8056da0c Kart::BodyBike::vf_0x60
+8056da88 Kart::BodyBike::UpdateMatrix
+8056dd54 Kart::Body::GetMatrix
+8056de94 Kart::BodyBike::UpdateWheelMatrix
+8056dfc0 Kart::BodyBike::vf_0xC
+8056e034 Kart::BodyBike::vf_0x64
+8056e094 Kart::BodyBike::vf_0x24
+8056e0b4 Kart::BodyBike::ApplyStarColors
+8056e108 Kart::BodyBike::vf_0x2c
+8056e15c Kart::BodyBike::vf_0x30
+8056e1b0 Kart::BodyBike::UpdateModelDrawPriority
+8056e218 Kart::BodyQuacker::__ct
+8056e2bc Kart::BodyBike::__dt
+8056e2fc Kart::BodyQuacker::GetMatrix
+8056e35c Kart::BodyQuacker::UpdateMatrix
+8056e41c Kart::Body::SetHandleDistance
+8056e424 Kart::Body::SetFloat_0x98
+8056e42c Kart::BodyQuacker::__dt
+8056e46c Kart::Part::vf_0x24
+8056e494 Kart::BodyKart::__dt
+8056e4d4 Kart::Arm::__dt
+8056e514 0x8056e514
+8056e51c 0x8056e51c
+8056e524 0x8056e524
+8056e52c 0x8056e52c
+8056e534 0x8056e534
+8056e53c 0x8056e53c
+8056e544 0x8056e544
+8056e54c 0x8056e54c
+8056e554 0x8056e554
+8056e55c 0x8056e55c
+8056e564 0x8056e564
+8056e56c Kart::Collision::__ct
+8056e5e4 0x8056e5e4
+8056e624 Kart::Collision::Reset
+8056e70c 0x8056e70c
+8056e764 Kart::Collision::ProcessVehicleBodyCollision
+8056e8d4 Kart::Collision::ProcessWheelCollision
+8056e930 Kart::Collision::ProcessMovingRoad
+8056ea04 Kart::Collision::ProcessFloor
+8056ee24 0x8056ee24
+8056eef4 0x8056eef4
+8056f184 0x8056f184
+8056f26c 0x8056f26c
+8056f490 0x8056f490
+8056f510 Kart::Collision::ProcessTriggers
+8056f73c 0x8056f73c
+8056f7f0 Kart::Collision::CheckKartCollision
+80570d20 Kart::Movement::vf_0x30
+80570d24 0x80570d24
+80570da8 0x80570da8
+80571234 0x80571234
+805713b8 0x805713b8
+805713d8 0x805713d8
+805713fc 0x805713fc
+80571484 0x80571484
+80571570 0x80571570
+805715f4 0x805715f4
+80571634 Kart::Collision::CheckTriggersAndOOB
+805718d4 0x805718d4
+80571c5c 0x80571c5c
+80571d04 0x80571d04
+80571d98 0x80571d98
+80571f10 Kart::Collision::CheckObjectCollision
+80572544 0x80572544
+80572574 Object::GetId
+8057257c Kart::Collision::CheckItemCollision
+80572b94 0x80572b94
+80572c20 Kart::Collision::UpdateCollisions
+80572f4c 0x80572f4c
+805730d4 Kart::Collision::InitHitboxes
+80573170 Kart::Collision::HandleNoopCollision
+80573178 Kart::Collision::HandleBananaCollision
+80573190 Kart::Collision::HandleShellCollision
+805731b0 Kart::Collision::HandleBlueShellCollision
+805731c8 Kart::Collision::HandleBombCollision
+805731e0 Kart::Collision::HandleMushroomCollision
+80573224 Kart::Collision::HandleStarCollision
+8057325c Kart::Collision::HandleFibCollision
+805733c4 0x805733c4
+805733cc 0x805733cc
+805733d4 0x805733d4
+805733dc 0x805733dc
+805733e4 0x805733e4
+805733ec 0x805733ec
+805733f4 0x805733f4
+80573464 0x80573464
+80573518 ObjectCollidable::GetCollision
+80573520 0x80573520
+8057353c 0x8057353c
+805735ac 0x805735ac
+805735b4 0x805735b4
+805735bc 0x805735bc
+805735d4 0x805735d4
+805735dc 0x805735dc
+805735e4 0x805735e4
+805735ec 0x805735ec
+8057363c 0x8057363c
+805736c8 0x805736c8
+80573754 0x80573754
+80573790 0x80573790
+805737b8 0x805737b8
+80573824 0x80573824
+80573a2c 0x80573a2c
+80573b00 Kart::Collision::ActivateOOB
+80573ec4 0x80573ec4
+80573ed4 Kart::Collision::UpdateRespawn
+80573ff0 Kart::Collision::__dt
+80574030 0x80574030
+80574068 0x80574068
+80574108 0x80574108
+80574114 Kart::Zipper::__ct
+80574170 Kart::Zipper::__dt
+805741b0 0x805741b0
+805741c8 0x805741c8
+80574210 0x80574210
+805742f4 0x805742f4
+80574340 Kart::Zipper::Update
+80574c7c Vec3::RotateQuaternionConjugate
+80574c90 0x80574c90
+80574e60 0x80574e60
+805750cc 0x805750cc
+805752e8 0x805752e8
+805758a4 Kart::Zipper::End
+805758e4 0x805758e4
+80575a44 Kart::Trick::__ct
+80575aa8 Kart::Trick::__dt
+80575ae8 Kart::Trick::Reset
+80575b38 Kart::Trick::UpdateNext
+80575c6c 0x80575c6c
+80575d50 0x80575d50
+80575d64 0x80575d64
+80575d7c Kart::Trick::TryStart
+80575ee8 Kart::Trick::Start
+80576018 0x80576018
+80576078 0x80576078
+8057613c 0x8057613c
+8057616c Kart::Trick::StartInner
+80576230 0x80576230
+805763e4 Kart::Trick::Update
+80576460 Kart::Trick::SetupProperties
+805764fc Kart::Trick::UpdateRot
+80576618 0x80576618
+80576684 0x80576684
+805766b8 Kart::Trick::End
+80576744 0x80576744
+80576758 Kart::TrickBike::Start
+8057689c Kart::TrickBike::StartInner
+80576994 Kart::TrickBike::UpdateRot
+80576afc Kart::TrickBike::__ct
+80576b3c Kart::BRRESHandle::__ct
+80576c54 Kart::BRRESHandle::__dt
+80576c94 0x80576c94
+80576d10 0x80576d10
+80576d8c Kart::BRRESHandle::LoadKartBRRES
+80576e90 Kart::BRRESHandle::LoadDriverBRRES
+80576f2c 0x80576f2c
+80576fe8 0x80576fe8
+80577064 Kart::BRRESHandle::LoadBodyModel
+80577220 0x80577220
+805772d8 0x805772d8
+805772f0 Kart::BRRESHandle::LoadLeftBackWheelModel
+805773a8 Kart::BRRESHandle::LoadLeftFrontWheelModel
+80577460 Kart::BRRESHandle::LoadRightBackWheelModel
+80577518 Kart::BRRESHandle::LoadRightFrontWheelModel
+805775d0 0x805775d0
+805776d4 Kart::BRRESHandle::LoadArmModel
+805778ac Kart::BRRESHandle::LoadDriverModels
+8057791c Kart::BRRESHandle::LoadBikeHandleModel
+805779e4 Kart::BRRESHandle::LoadBikeSwingArmModel
+80577a9c Kart::BRRESHandle::LoadBikeFrontWheelModel
+80577b54 Kart::BRRESHandle::LoadBikeBackWheelModel
+80577c0c Kart::BRRESHandle::LoadBikeSuspensionsModel
+80577cc4 0x80577cc4
+80577d7c Kart::BRRESHandle::LoadShadowModel
+80577e00 Kart::BRRESHandle::LoadKillerModels
+80577f00 0x80577f00
+80577fa4 0x80577fa4
+80577fc4 Kart::Movement::__ct
+8057811c Kart::Boost::__dt
+8057815c 0x8057815c
+8057819c 0x8057819c
+805781dc 0x805781dc
+8057821c Kart::Movement::CreateTrickZipper
+8057829c Kart::Movement::SetTurnParams
+805784d4 Kart::Movement::Reset
+805788dc Kart::Movement::Update
+80579960 0x80579960
+80579968 Kart::Movement::UpdateHopPhysics
+805799ac Kart::Movement::Respawn
+80579a50 0x80579a50
+80579ce4 0x80579ce4
+80579da8 0x80579da8
+80579f20 0x80579f20
+80579f6c 0x80579f6c
+80579fe4 Kart::Movement::SomethingWheelieBump
+8057a13c 0x8057a13c
+8057a140 Kart::Movement::UpdateDir
+8057a8b4 Kart::Movement::UpdateTurn
+8057ab68 Kart::Movement::UpdateVehicleSpeed
+8057b028 0x8057b028
+8057b108 Kart::Movement::ComputeWallCollisionSpeedFactor
+8057b29c Kart::Movement::vf_0x68
+8057b2a0 0x8057b2a0
+8057b77c 0x8057b77c
+8057b868 Kart::Movement::GetAccelerationFromSpeed
+8057b99c Kart::Movement::ResetBulletSpeed
+8057b9ac Kart::Movement::ResetMaxSpeed
+8057b9bc Kart::Movement::UpdateAcceleration
+8057c3c8 Kart::Movement::GetWheelieSoftSpeedLimitBonus
+8057c3d4 Kart::Movement::UpdateOffroad
+8057c5e8 0x8057c5e8
+8057c69c Kart::Movement::UpdateRotate
+8057cdd4 0x8057cdd4
+8057cf0c Kart::Movement::UpdateVehicleRotationVector
+8057d1d4 Kart::Movement::UpdateSSMTRotation
+8057d398 Kart::Movement::UpdateUps
+8057d888 Kart::Movement::UpdateUpsWhileAirbone
+8057da18 Kart::Movement::CheckIfCanHop
+8057da5c Kart::Movement::Hop
+8057dc40 Kart::Movement::CancelWheelie
+8057dc44 Kart::Movement::UpdateManualDrift
+8057e0dc Kart::Movement::UpdateAutoDrift
+8057e348 0x8057e348
+8057e3f4 Kart::Movement::StartManualDrift
+8057e638 0x8057e638
+8057e6f4 0x8057e6f4
+8057e77c 0x8057e77c
+8057e804 Kart::Movement::UpdateHopAndSlipdrift
+8057e99c 0x8057e99c
+8057ea50 0x8057ea50
+8057ea94 0x8057ea94
+8057eab8 0x8057eab8
+8057ec28 0x8057ec28
+8057ed20 0x8057ed20
+8057ed34 0x8057ed34
+8057ed8c 0x8057ed8c
+8057ee50 Kart::Movement::UpdateMTCharge
+8057efe0 Kart::Movement::GetMTMaxCharge
+8057efec Kart::Movement::GetSMTMaxCharge
+8057eff8 0x8057eff8
+8057f024 0x8057f024
+8057f05c 0x8057f05c
+8057f090 0x8057f090
+8057f1d0 0x8057f1d0
+8057f3d8 Kart::Movement::ActivateMushroom
+8057f630 0x8057f630
+8057f7a8 Kart::Movement::EndTrick
+8057f96c Kart::Movement::ActivateZipperBoost
+8057fb6c 0x8057fb6c
+8057fd18 Kart::Movement::TryStartJumpPad
+805800bc 0x805800bc
+80580268 Kart::Movement::ActivateStar
+805803f0 0x805803f0
+80580438 Kart::Movement::ApplyShock
+8058051c 0x8058051c
+805805ec 0x805805ec
+80580648 0x80580648
+805806a4 0x805806a4
+80580768 0x80580768
+80580778 Kart::Movement::ApplyShockEffect
+80580998 0x80580998
+80580a84 0x80580a84
+80580b14 Kart::Movement::ActivateMega
+80580cdc 0x80580cdc
+80580dc0 0x80580dc0
+80580f28 0x80580f28
+80580f9c 0x80580f9c
+80581034 0x80581034
+805810a8 0x805810a8
+805813a4 0x805813a4
+805813e8 0x805813e8
+8058160c Kart::Movement::UpdateScale
+80581720 Kart::Movement::SetScale
+8058173c 0x8058173c
+80581778 0x80581778
+80581824 Kart::Movement::CalcBlink
+8058196c 0x8058196c
+805819a8 0x805819a8
+80581a24 0x80581a24
+80581a28 Kart::Movement::ActivateTC
+80581a40 Kart::Movement::DeactivateTC
+80581a58 Kart::Movement::ApplyInk
+80581b1c Kart::Movement::UpdateCharacterInk
+80581c70 0x80581c70
+80581c90 Kart::Movement::SomethingRespawnBoost
+8058212c Kart::Movement::ApplyStartBoost
+80582278 0x80582278
+805823a4 0x805823a4
+80582488 0x80582488
+805824c8 0x805824c8
+805824f0 0x805824f0
+80582530 Kart::Movement::TryEndJumpPad
+80582694 Kart::Movement::UpdateBoost
+80582804 0x80582804
+805828cc 0x805828cc
+80582d94 0x80582d94
+80582db4 0x80582db4
+80582dd8 0x80582dd8
+80582e34 0x80582e34
+80582f38 0x80582f38
+80582f58 0x80582f58
+80582f7c 0x80582f7c
+80582f9c Kart::Movement::ReleaseMT
+8058327c 0x8058327c
+805832c4 0x805832c4
+805832e4 Kart::Movement::CancelBoost
+80583424 0x80583424
+8058348c Kart::Movement::vf_0x24
+80583658 Kart::Movement::OnOOB
+805837cc Kart::Movement::vf_0x2c
+80583b84 0x80583b84
+80583b88 Kart::Movement::UpdateStickyRoad
+80583f2c 0x80583f2c
+80584044 Kart::Movement::SetInitialPhysicsValues
+80584334 Kart::Movement::DoRespawn
+80584648 0x80584648
+8058473c 0x8058473c
+80584928 thunk_0x8058473c
+8058492c thunk_0x8058473c
+80584930 0x80584930
+8058498c Kart::Movement::EnterCannon
+80584d58 Kart::Movement::UpdateCannon
+805852c8 0x805852c8
+8058539c Kart::Movement::GetCannonPosAndDir
+805855bc 0x805855bc
+805858ac Kart::Movement::ActivateBullet
+80585a04 0x80585a04
+80585a28 0x80585a28
+80585a60 0x80585a60
+80585aa0 0x80585aa0
+80585ae8 0x80585ae8
+80585af8 0x80585af8
+805860bc 0x805860bc
+8058677c Kart::Movement::UpdateFromPseaVenice
+805869dc Kart::Movement::UpdateDiving
+80586d18 0x80586d18
+80586db4 0x80586db4
+80586e90 0x80586e90
+80586fa8 Kart::Movement::UpdateSlipStream
+805874c0 0x805874c0
+8058758c Kart::Movement::UpdateWheelie
+80587590 Kart::Movement::UpdateSpecialFloor
+80587938 0x80587938
+805879a4 0x805879a4
+80587b30 Kart::MovementBike::__ct
+80587b78 Kart::Movement::__dt
+80587bb8 Kart::MovementBike::CreateTrickZipper
+80587c54 Kart::MovementBike::SetTurnParams
+80587d00 Kart::MovementBike::Reset
+80587d64 Kart::MovementBike::UpdateWheelie
+80587d68 Kart::MovementBike::UpdateVehicleRotationVector
+80588324 Kart::MovementBike::GetWheelieSoftSpeedLimitBonus
+80588350 Kart::MovementBike::StartWheelie
+805883c4 Kart::MovementBike::CancelWheelie2
+805883f4 Kart::MovementBike::UpdateWheelie
+80588798 Kart::MovementBike::TryStartWheelie
+80588860 0x80588860
+80588888 Kart::MovementBike::UpdateMtCharge
+80588950 Kart::MovementBike::vf_0x24
+80588b30 Kart::MovementBike::CancelWheelie
+80588b58 Kart::MovementBike::OnOoB
+80588cac Kart::MovementBike::vf_0x2c
+80588d28 Kart::Boost::__ct
+80588d74 Kart::Boost::Reset
+80588db0 Kart::Boost::Activate
+80588e18 Kart::Boost::CancelAll
+80588e24 Kart::Boost::Update
+80588fc0 Kart::MovementBike::vf_0x30
+80588fd0 Kart::MovementBike::vf_0x68
+80588fe0 Kart::MovementBike::CheckWheelie
+80589024 Kart::Movement::GetStarDuration
+80589030 0x80589030
+8058905c 0x8058905c
+805890b0 0x805890b0
+80589118 0x80589118
+805891c0 0x805891c0
+8058920c 0x8058920c
+80589230 0x80589230
+80589254 0x80589254
+8058926c 0x8058926c
+80589308 0x80589308
+805893fc 0x805893fc
+80589400 Kart::MovementRealLocal::Hop
+80589440 Kart::MovementBikeRealLocal::Hop
+80589480 Kart::MovementBikeRealLocal::StartWheelie
+80589514 Kart::MovementBikeRealLocal::CancelWheelie2
+8058956c Kart::MovementRemote::CanHop
+805895cc Kart::MovementBikeRemote::CanHop
+8058962c Kart::MovementBikeRemote::TryStartWheelie
+805896b8 Kart::Movement::vf_0x58
+805896bc Kart::MovementBike::GetLeanRot
+805896c4 Kart::MovementBikeRemote::__dt
+80589704 Kart::MovementBike::__dt
+80589744 Kart::Movement::CheckWheelie
+8058974c Kart::Movement::GetLeanRot
+80589758 Kart::MovementRemote::__dt
+80589798 Kart::MovementBikeRealLocal::__dt
+805897d8 Kart::MovementRealLocal::__dt
+80589818 0x80589818
+80589830 0x80589830
+80589844 0x80589844
+8058985c RacedataHandler_consstruct
+805898e4 0x805898e4
+80589924 0x80589924
+80589964 0x80589964
+8058998c 0x8058998c
+80589f64 0x80589f64
+8058a774 0x8058a774
+8058a7b4 0x8058a7b4
+8058a7f4 0x8058a7f4
+8058a834 0x8058a834
+8058a874 0x8058a874
+8058a8b4 0x8058a8b4
+8058a8f4 0x8058a8f4
+8058a934 0x8058a934
+8058a974 0x8058a974
+8058a9b4 0x8058a9b4
+8058a9f4 0x8058a9f4
+8058aa34 0x8058aa34
+8058aa74 0x8058aa74
+8058aab4 0x8058aab4
+8058aaf4 0x8058aaf4
+8058ab34 0x8058ab34
+8058ab74 0x8058ab74
+8058abb4 0x8058abb4
+8058ac08 0x8058ac08
+8058ac5c 0x8058ac5c
+8058acb0 0x8058acb0
+8058ad04 0x8058ad04
+8058ad58 0x8058ad58
+8058add8 0x8058add8
+8058ade0 0x8058ade0
+8058ae48 0x8058ae48
+8058ae50 0x8058ae50
+8058aeb8 0x8058aeb8
+8058aec0 0x8058aec0
+8058af28 0x8058af28
+8058af30 0x8058af30
+8058af98 0x8058af98
+8058afa0 0x8058afa0
+8058b008 0x8058b008
+8058b010 0x8058b010
+8058b078 0x8058b078
+8058b080 0x8058b080
+8058b0e8 0x8058b0e8
+8058b0f0 0x8058b0f0
+8058b10c 0x8058b10c
+8058b128 0x8058b128
+8058b144 0x8058b144
+8058b164 0x8058b164
+8058b198 RacedataHandler_processInputs
+8058b494 0x8058b494
+8058b8a8 0x8058b8a8
+8058b9f8 0x8058b9f8
+8058bde0 Audio::KartActor::Reset
+8058be20 0x8058be20
+8058c088 0x8058c088
+8058c08c 0x8058c08c
+8058c0dc 0x8058c0dc
+8058c3d8 0x8058c3d8
+8058c490 0x8058c490
+8058c4c0 0x8058c4c0
+8058c5e4 0x8058c5e4
+8058c614 0x8058c614
+8058c61c 0x8058c61c
+8058c64c 0x8058c64c
+8058c654 0x8058c654
+8058c684 0x8058c684
+8058c68c 0x8058c68c
+8058c6bc 0x8058c6bc
+8058c6c4 0x8058c6c4
+8058c6f4 0x8058c6f4
+8058c6fc 0x8058c6fc
+8058c760 0x8058c760
+8058c7c4 0x8058c7c4
+8058c828 0x8058c828
+8058c88c 0x8058c88c
+8058c8f0 0x8058c8f0
+8058c954 0x8058c954
+8058c9b8 0x8058c9b8
+8058ca28 RacedataFactory_construct
+8058ca74 0x8058ca74
+8058cab4 0x8058cab4
+8058cab8 0x8058cab8
+8058cabc RacedataFactory_sendRacedataRecord
+8058cb30 RacedataFactory_packRacedataRecord
+8058d3cc RacedataFactoryFlags_construct
+8058d414 RacedataFactoryFlags_destroy
+8058d454 0x8058d454
+8058d464 0x8058d464
+8058d47c 0x8058d47c
+8058d4a0 0x8058d4a0
+8058d4dc 0x8058d4dc
+8058d51c 0x8058d51c
+8058d520 0x8058d520
+8058d570 0x8058d570
+8058d644 0x8058d644
+8058d7d8 0x8058d7d8
+8058d8a8 0x8058d8a8
+8058d8d8 0x8058d8d8
+8058d908 0x8058d908
+8058d93c 0x8058d93c
+8058d960 0x8058d960
+8058d984 0x8058d984
+8058d9a8 0x8058d9a8
+8058da2c 0x8058da2c
+8058da50 0x8058da50
+8058daa4 0x8058daa4
+8058dae0 0x8058dae0
+8058db30 0x8058db30
+8058db54 0x8058db54
+8058dbdc 0x8058dbdc
+8058dc0c 0x8058dc0c
+8058dc4c 0x8058dc4c
+8058dc58 0x8058dc58
+8058dc9c 0x8058dc9c
+8058dce0 0x8058dce0
+8058dd24 0x8058dd24
+8058dd60 0x8058dd60
+8058ddbc Kart::Player::__ct
+8058deb0 0x8058deb0
+8058def0 Kart::Player::__dt
+8058df60 0x8058df60
+8058df7c 0x8058df7c
+8058e014 0x8058e014
+8058e188 Kart::Player::InitSub
+8058e22c Kart::Player::Init
+8058e5f8 Kart::Player::CreateBody
+8058e648 0x8058e648
+8058e724 0x8058e724
+8058e7c4 0x8058e7c4
+8058e804 Kart::Player::PrepateTiresAndSUspensions
+8058e990 0x8058e990
+8058ea0c Kart::Player::InitWheels
+8058ec08 Kart::Wheel::__dt
+8058ec48 0x8058ec48
+8058ece0 Kart::Player::CreateSound
+8058ed28 0x8058ed28
+8058ed68 0x8058ed68
+8058ee48 Kart::Player::SetStartPosition
+8058eeb4 Kart::Player::UpdateKartSub
+8058eebc Kart::Player::Update2
+8058f04c 0x8058f04c
+8058f1f4 Kart::Wheel::vf_0x24
+8058f20c 0x8058f20c
+8058f260 Kart::PlayerBike::CreateBody
+8058f2e8 Kart::PlayerBike::InitWheels
+8058f4ac Kart::WheelFront::__dt
+8058f4ec Kart::WheelBikeFront::__dt
+8058f52c Kart::Suspensions::__dt
+8058f56c Kart::PlayerBike::CreateSound
+8058f5b4 Kart::Manager::SetupPlayer
+8058f820 Kart::Player::CreateModel
+8058f8b0 Kart::PlayerBike::__dt
+8058f924 0x8058f924
+8058f990 0x8058f990
+8058f9d0 0x8058f9d0
+8058fa10 Kart::Manager::Disposer__dt
+8058faa8 Kart::Manager::CreateInstance
+8058faf8 Kart::Manager::DestroyInstance
+8058fb2c Kart::Manager::__ct
+8058fdd4 Kart::Manager::__dt
+8058fee0 Kart::Manager::Init
+8058ffe8 Kart::Manager::Update
+80590100 Kart::Manager::GetKartPlayer
+80590110 0x80590110
+80590128 Kart::Link::InitList
+80590138 Kart::Link::LinkKartList
+8059018c Kart::Link::__ct
+805901d0 Kart::Link::SetPointersFromPlayer
+8059020c Kart::Link::GetKartPosition
+80590224 Kart::Player::GetPreviousPosition
+80590238 Kart::Link::SetKartPosition
+80590264 Kart::Link::GetMtx
+80590278 Kart::Link::GetKartBodyMtx
+80590288 Kart::Link::SetKartRotation
+805902dc Kart::Link::GetWheelCount0
+805902ec Kart::Link::GetWheelCount1
+805902fc Kart::Link::GetWheelCountReciprocal
+8059030c Kart::Link::GetWheelCountPlus1Reciprocal
+8059031c Kart::Link::GetWheelPosition
+80590338 Kart::Link::WheelHasFloorCollision
+80590350 Kart::Link::SetBody0x94
+80590368 Kart::Link::SetBodyHandleDistance
+80590380 Kart::Link::SetStartBoost
+80590390 Kart::Link::GetWheelSpeed
+805903ac Kart::Link::GetPhysicsHolder
+805903bc Kart::Link::GetPhysicsHolder(const)
+805903cc Kart::Link::GetPhysics
+805903e0 Kart::Link::GetPhysics(const)
+805903f4 Kart::Link::GetControllerHolder
+8059041c Kart::Link::ActivateRumble(3 args)
+80590478 Kart::Link::ActivateRumble(1 arg)
+80590570 Kart::Link::ActivateRumble(no arg)
+80590650 Kart::Link::IsLocal
+80590664 Kart::Link::IsCPU
+80590678 Kart::Link::IsGhost
+8059068c Kart::Link::IsMii
+8059069c Kart::Link::GetBody
+805906a8 Kart::Link::GetBody(const)
+805906b4 Kart::Link::GetSuspensions
+805906c8 Kart::Link::GetSuspensions(const)
+805906dc Kart::Link::GetWheels
+805906f0 Kart::Link::GetWheels(const)
+80590704 Kart::Link::GetWheelPhysicsHolder
+8059071c Kart::Link::GetWheelPhysicsHolder(const)
+80590734 Kart::Link::GetWheelPhysics
+8059074c Kart::Link::GetWheelPhysics(const)
+80590764 Kart::Link::GetSub
+80590770 Kart::Link::GetSub(const)
+8059077c Kart::Link::GetMovement
+80590788 Kart::Link::GetMovement(const)
+80590794 Kart::Link::GetKartActor
+805907a0 Kart::Link::GetCharacterActor
+805907b0 Kart::Link::PlayCharacterSound
+805907c0 Kart::Link::GetObject
+805907cc Kart::Link::GetShadow
+805907d8 Kart::Link::GetPhysicsHolderHitboxGroup
+805907ec Kart::Link::GetPhysicsHolderHitboxGroup(const)
+80590800 Kart::Link::GetWheelPhysicsHitboxGroup
+8059081c Kart::Link::GetVehicleBodyCollisionData
+80590834 Kart::Link::GetWheelCollisionData
+8059084c Kart::Link::GetCollision
+80590858 Kart::Link::GetCollision(const)
+80590864 Kart::Link::GetStatsAndBsp
+80590874 Kart::Link::GetStats
+80590888 Kart::Link::GetBsp
+8059089c Kart::Link::GetBspHitboxes
+805908b4 Kart::Link::GetBspWheel
+805908d4 Kart::Link::GetValues0x18
+805908e4 Kart::Link::GetKartDriverDispEntry
+805908f4 Kart::Link::GetRotatingItemsParams
+8059090c Kart::Link::GetKartPartsDispEntry
+8059091c Kart::Link::GetBikePartsDispEntry
+8059092c Kart::Link::GetExhaustParticleSet2
+80590958 Kart::Link::GetExhaustParticleSet
+8059098c Kart::Link::GetBalloonsPosition
+805909b8 Kart::Link::GetDriverDispEntry
+805909c8 Kart::Link::GetCameraVerticalDistance
+805909f4 Kart::Link::GetBaseHopStickX
+80590a04 Kart::Link::GetHopStickX
+80590a10 Kart::Link::GetType
+80590a28 Kart::Link::GetStatsWheelCount
+80590a40 Kart::Link::GetDriverController
+80590a4c Kart::Link::GetTriggersCollisionRadius
+80590a5c Kart::Link::GetPlayerIdx
+80590a6c Kart::Link::IsBike
+80590a7c Kart::Link::GetKartId
+80590a8c Kart::Link::ToggleKartVisible
+80590a9c Kart::Link::ToggleVisible
+80590c44 Kart::Link::GetBodyMatCol0(copy)
+80590c6c Kart::Link::GetBodyMatCol1(copy)
+80590c94 Kart::Link::GetBodyMatCol2(copy)
+80590cbc Kart::Link::GetBodyMatCol0
+80590cd0 Kart::Link::GetBodyMatCol1
+80590ce4 Kart::Link::GetBodyMatCol2
+80590cf8 Kart::Link::GetEngineSpeed
+80590d08 Kart::Link::GetSpeed
+80590d20 Kart::Link::GetDamage
+80590d2c Kart::Link::GetDamage(const)
+80590d38 Kart::Link::80590d38
+80590d5c Kart::Link::SetDamageType
+80590d88 Kart::Link::SetAffectedByPOW
+80590d94 Kart::Link::80590d94
+80590da4 Kart::Link::GetCurDamageType
+80590db4 Kart::Link::CancelBoost
+80590dc0 Kart::Link::GetSpeedRatioCapped
+80590dd0 Kart::Link::GetSpeedRatio
+80590de0 Kart::Link::HasCamera
+80590df8 Kart::Link::SetCamera
+80590e04 Kart::Link::GetScreenIdx
+80590e28 Kart::Link::UpdateCameraOnRespawn
+80590e40 Kart::Link::UpdateCameraOnBoost
+80590e58 Kart::Link::ResetCameraFov
+80590e70 Kart::Link::UpdateCameraOnExplosion
+80590e88 Kart::Link::80590e88
+80590e8c Kart::Link::80590e8c
+80590ea4 Kart::Link::80590ea4
+80590ed8 Kart::Link::StopCloseCamera
+80590ef8 Kart::Link::SetCamera
+80590f18 Kart::Link::StopCameraMovAndRotation
+80590f38 Kart::Link::80590f38
+80590f58 Kart::Link::80590f58
+80590f70 Kart::Link::UpdateCameraOnOOBHit
+80590f90 Kart::Link::ActivateStarAnm
+80590f9c Kart::Link::80590f9c
+8059102c Kart::Link::UpdateStarAnm
+80591038 Kart::Link::StopStarAnm
+80591044 Kart::Link::80591044
+80591050 Kart::Link::80591050
+80591070 Kart::Link::GetStarAnm
+8059107c Kart::Link::GetStarColor
+8059108c Kart::Link::GetModelsVisibility
+80591098 Kart::Link::GetModelsVisibility
+805910a4 Kart::Link::GetMatTEVHandler
+805910b0 Kart::Link::GetBaseSpeed
+805910c0 Kart::Link::GetAIController
+805910cc Kart::Link::GetBodyClosestFloorFlags
+805910e4 Kart::Link::GetBodyClosestFloorSettings
+805910fc Kart::Link::IsWheelHittingWall
+80591138 Kart::Link::GetClosestFloorKCLFlags
+80591170 Kart::Link::GetClosestFloorKCLSettingss
+805911a8 Kart::Link::GetBodyKCLIntensity
+805911c0 Kart::Link::805911c0
+805911d8 Kart::Link::GetDriftState
+805911e8 Kart::Link::GetMTCharge
+805911f8 Kart::Link::GetSMTCharge
+80591208 Kart::Link::GetMTMaxCharge
+80591214 Kart::Link::GetSMTMaxCharge
+80591220 Kart::Link::TranslateBody
+80591264 Kart::Link::80591264
+80591314 Kart::Link::IsRespawning
+80591344 Kart::Link::80591344
+80591378 Kart::Link::80591378
+805913a8 Kart::Link::805913a8
+805913fc Kart::Link::IsWaitingForBackwards
+80591418 Kart::Link::GetBackwardsAllowCounter
+80591428 Kart::Link::Get1stLight
+80591434 Kart::Link::Get2ndLight
+80591440 Kart::Link::GetRacedataFactory
+8059144c Kart::Link::GetRacedataHandler
+80591458 Kart::Link::GetRacedataFactoryFlags
+80591468 Kart::Link::80591468
+80591478 Kart::Link::SetScale
+805914bc Kart::Link::GetScale
+805914cc Kart::Link::IsWheelieing
+805914e4 Kart::Link::GetStartBoostCharge
+805914f4 Kart::Link::805914f4
+80591520 Kart::Link::GetEntity
+8059152c Kart::Link::GetClipInfo
+80591538 Kart::Link::CallOnAllPartsFunc
+80591608 Kart::Link::AreKartModelsVisible
+80591618 Kart::Link::GetKiller
+80591624 Kart::Link::GetBillViewMtx
+80591664 Kart::Link::ResetInertia
+8059170c Kart::Link::8059170c
+80591784 Kart::Link::StartOobWipe
+805917a0 Kart::Link::GetOobWipeState
+805917b0 Kart::Link::805917b0
+805917c0 Kart::Link::805917c0
+805917f4 Kart::Link::805917f4
+80591828 Kart::Link::80591828
+8059184c Kart::Link::8059184c
+80591898 Kart::Link::80591898
+805918bc Kart::Link::IncrementItemsHitCount
+805918e0 Kart::Link::IncrementItemsCollisionCount
+80591904 Kart::Link::GetZipper
+80591914 Kart::Link::GetTrick
+80591924 Kart::Link::InitLights
+8059197c Kart::Link::SetLightObjIdx
+80591998 0x80591998
+805919e8 0x805919e8
+805919f4 Kart::InitParamBinsFromCommon
+80591b74 Kart::InitParamBinsFromRace
+80591c9c Kart::ResetParamBins
+80591ce8 Kart::GetParamBinFromCommon
+80591d00 Kart::GetParamBinFromRace
+80591d4c Kart::GetParamBin
+80591dbc Kart::GetBSP
+80591dd0 Kart::LoadKartAndDriverParamBinsFromCommon
+80591e58 Kart::LoadKartParamBinFromCommon
+80591ea8 Kart::LoadDriverParamBinFromCommon
+80591ef8 Kart::LoadStatsParamFileFromCommon
+80591f4c Kart::GetKartParamEntry
+80591f60 Kart::GetDriverParamEntry
+80591fa4 Kart::ComputeStats
+8059240c Kart::LoadKartDriverDisp
+80592498 Kart::GetKartDriverDispEntry
+805924cc Kart::LoadKartPartsDisp
+80592558 Kart::GetKartPartsDispEntry
+80592594 Kart::LoadBikePartsDisp
+80592620 Kart::GetBikePartsDispEntry
+80592660 Kart::SetMiiDispParam
+80592678 Kart::LoadMiiDisp
+805926c8 Kart::LoadMiiDispFromMiiBody
+80592718 Kart::LoadCameraParam
+8059275c Kart::LoadDriverDisp
+805927ac Kart::GetMiiDispEntry
+805927c0 Kart::GetDriverDispEntry
+805927d4 Kart::Link::GetCameraParamBin
+80592848 Kart::Part::__ct
+805928dc 0x805928dc
+80592920 Kart::Part::CreateModelDirectors
+80592a28 Kart::Part::LoadModel
+80592a30 Kart::Part::Create2ndModelDirector
+80592b54 Kart::Part::Load
+80592b64 Kart::Part::UpdateMatrix
+80592bf8 0x80592bf8
+80592cbc Kart::Part::vf_0xC
+80592cdc Kart::Part::SetModelScale
+80592d04 Kart::Part::SetModelMtx
+80592d88 Kart::Part::ToggleModelVisible
+80592db0 Kart::Part::vf_0x20
+80592de4 0x80592de4
+80592df8 Kart::Part::ApplyStarColors
+80592e5c Kart::Part::vf_0x2c
+80592ee0 Kart::Part::vf_0x30
+80592f4c Kart::Part::UpdateModelDrawPriority
+80592fa8 0x80592fa8
+80592fc0 Kart::Values::__ct
+8059308c 0x8059308c
+805930e4 0x805930e4
+80593124 0x80593124
+80593128 0x80593128
+80593138 0x80593138
+80593310 0x80593310
+8059345c 0x8059345c
+8059377c 0x8059377c
+805937d4 0x805937d4
+80593814 0x80593814
+80593c20 0x80593c20
+80593c78 0x80593c78
+80593cb8 0x80593cb8
+80593d0c 0x80593d0c
+80593d1c 0x80593d1c
+80593d54 0x80593d54
+80593dbc 0x80593dbc
+80593e08 0x80593e08
+80593e18 0x80593e18
+80593fa4 0x80593fa4
+80594094 0x80594094
+805940d4 0x805940d4
+80594134 0x80594134
+805941bc 0x805941bc
+805943b4 Kart::Status::__ct
+8059455c Kart::Status::Reset
+80594594 Kart::Status::Init
+80594634 0x80594634
+80594644 0x80594644
+80594704 0x80594704
+8059474c Kart::Status::UpdateCollisionsAndMore
+8059487c Kart::Status::UpdateFromInput
+80594bd4 Kart::Status::UpdateCollisions
+805958ec 0x805958ec
+805958f0 0x805958f0
+80595918 Kart::Status::UpdateStartBoostCharge
+805959d4 Kart::Status::ComputeStartBoost
+80595af8 Kart::Status::ApplyStartBoost
+80595c5c 0x80595c5c
+80595ca4 0x80595ca4
+80595cb4 0x80595cb4
+80595cc4 Kart::Status::__dt
+80595d04 0x80595d04
+80595d48 Kart::Sub::Init
+80595f78 Kart::Sub::InitParts
+805960fc 0x805960fc
+8059617c Kart::Sub::ResetPhysics
+805963e4 0x805963e4
+80596454 Kart::Sub::SetPointers
+80596480 Kart::Sub::Update
+80596cfc Kart::Player::ApplyPhysics
+8059783c Kart::Sub::UpdateTransforms
+80597934 0x80597934
+805979ec 0x805979ec
+80597a40 0x80597a40
+80597a88 Kart::Sub::UpdateMovingRoad
+80597d4c Kart::Player::ApplyCollisionForce
+805980d8 0x805980d8
+8059828c Kart::Sub::InitEntity
+80598338 0x80598338
+805983dc 0x805983dc
+805983f4 0x805983f4
+8059840c 0x8059840c
+80598630 0x80598630
+80598744 0x80598744
+80598890 0x80598890
+80598ac8 Kart::Sub::__dt
+80598b08 Kart::Suspensions::__ct
+80598b50 Kart::Suspensions::LoadModel
+80598b60 Kart::Suspensions::Init
+80598bd4 Kart::Suspensions::InitPhysicsHolder
+80598bdc Kart::Suspensions::Reset
+80598be4 0x80598be4
+80598bec Kart::Suspensions::UpdateMatrix
+80598fe8 Kart::SuspensionsBike::LoadModel
+80598ff8 Kart::SuspensionsBike::UpdateMatrix
+80599124 0x80599124
+80599134 0x80599134
+8059938c 0x8059938c
+805993cc Kart::SuspensionsBike::__dt
+8059940c WheelPhysics::__ct
+80599470 WheelPhysics::InitHitboxGroup
+805994d4 0x805994d4
+80599508 WheelPhysics::Reset
+805995c0 0x805995c0
+80599690 WheelPhysics::UpdateCollision
+80599ad0 WheelPhysics::Realign
+80599d9c 0x80599d9c
+80599dc0 0x80599dc0
+80599eac WheelPhysics::HasFloorCollision
+80599ebc AnimatedModelExplodable_GetWorldMatrix
+80599ec8 WheelPhysics::GetCollisionData
+80599ed4 WheelPhysicsHolder::__ct
+80599f54 WheelPhysicsHolder::Reset
+80599fa0 0x80599fa0
+8059a02c 0x8059a02c
+8059a278 WheelPhysicsHolder::Update
+8059a4f8 Vec3::MultMtxByVec
+8059a574 WheelPhysicsHolder::ApplySuspensions
+8059a9c4 WheelPhysics::__dt
+8059aa04 0x8059aa04
+8059aa44 Kart::Wheel::__ct
+8059aab0 Kart::Wheel::Init
+8059ab14 Kart::Wheel::CreatePhysics
+8059ab68 0x8059ab68
+8059ab70 Kart::Wheel::LoadModel
+8059abf4 Kart::WheelFront::LoadModel
+8059ac1c Kart::WheelFront::CreatePhysics
+8059ac70 Kart::Wheel::UpdateMatrix
+8059ae3c 0x8059ae3c
+8059aecc Kart::WheelFront::UpdateMatrix
+8059b038 Kart::WheelBikeFront::CreatePhysics
+8059b08c Kart::WheelBikeFront::LoadModel
+8059b09c Kart::WheelBikeFront::UpdateMatrix
+8059b1fc Kart::WheelBikeRear::CreatePhysics
+8059b250 Kart::WheelBikeRear::LoadModel
+8059b260 Kart::WheelBikeRear::UpdateMatrix
+8059b3b8 0x8059b3b8
+8059b524 0x8059b524
+8059b564 Kart::WheelBikeRear::__dt
+8059b5a4 0x8059b5a4
+8059b600 Kart::Killer::ModelCalc::ExecWorldCBImpl
+8059b658 Kart::Killer::__ct
+8059b7b8 Kart::Killer::Activate
+8059bc44 Kart::Killer::Update
+8059be8c Kart::Killer::Init
+8059c0b8 Kart::Killer::ToggleVisible
+8059c118 cancelBullet
+8059c29c 0x8059c29c
+8059c44c 0x8059c44c
+8059c798 0x8059c798
+8059c868 0x8059c868
+8059c888 0x8059c888
+8059c954 0x8059c954
+8059cab4 0x8059cab4
+8059cb54 0x8059cb54
+8059cc60 Kart::Killer::UpdateDuration
+8059ce24 0x8059ce24
+8059cf04 0x8059cf04
+8059cfc4 0x8059cfc4
+8059d084 0x8059d084
+8059d0c0 Kart::Killer::UpdateUps
+8059d2b8 0x8059d2b8
+8059d2d4 Kart::Killer::UpdateSettings
+8059d44c Kart::Killer::UpdateGravity
+8059d59c 0x8059d59c
+8059d658 0x8059d658
+8059d8e0 0x8059d8e0
+8059d964 0x8059d964
+8059d97c 0x8059d97c
+8059dae4 0x8059dae4
+8059dcdc 0x8059dcdc
+8059de9c Kart::Killer::__dt
+8059dedc Kart::Killer::ModelCalc::__dt
+8059df1c Kart::Killer::ModelCalc::__dt(thunk)
+8059df24 MenuModelMgr::Disposer__dt
+8059dfbc MenuModelMgr::CreateInstance
+8059e04c MenuModelMgr::DestroyInstance
+8059e080 MenuModelMgr::__ct
+8059e0e4 MenuModelMgr::__dt
+8059e1fc MenuModelMgr::Start
+8059e250 MenuModelMgr::Init
+8059e4a8 MenuModelMgr::Update
+8059e4fc MenuModelMgr::Draw
+8059e550 MenuModelMgr::ResetKartModels
+8059e568 MenuModelMgr::RequestDriverModel
+8059e580 MenuModelMgr::RequestKartModel
+8059e598 MenuModelMgr::RequestBackModel
+8059e5a4 MenuModelMgr::TogglePlayerModel
+8059e5bc 0x8059e5bc
+8059e5d4 MenuModelMgr::ToggleBackModel
+8059e5dc MenuModelMgr::GetTexObj
+8059e5f0 0x8059e5f0
+8059e618 0x8059e618
+8059e634 MenuModelMgr::GetDriverTexture
+8059e644 MenuModelMgr::GetKartTexture
+8059e69c 0x8059e69c
+8059e6ac 0x8059e6ac
+8059e76c ScnMgrMenu::__ct
+8059e7c8 ScnMgrMenu::__dt
+8059e820 ScnMgrMenu::UpdateCameras
+8059e8b4 0x8059e8b4
+8059e8c4 ScnMgrMenu::LoadLights
+8059e920 ScnMgrMenu::CreateScnGroup
+8059e978 ScnMgrMenu::SetAnmScn
+8059e98c ScnMgrMii::__ct
+8059e9e4 ScnMgrMii::__dt
+8059ea3c ScnMgrMii::LoadLights
+8059eaa4 0x8059eaa4
+8059eae0 0x8059eae0
+8059eae4 0x8059eae4
+8059eb94 0x8059eb94
+8059ebf8 0x8059ebf8
+8059ec50 0x8059ec50
+8059eca8 RendererMenu::__ct
+8059ed30 RendererMenu::Calc
+8059ed68 RendererMenu::DrawModels
+8059f4f0 MenuModel::vf_0x18
+8059f508 RendererMenu::Draw
+8059f5bc Kart::PhysicsHolder::Init
+8059f678 Kart::Physics::__dt
+8059f6b8 0x8059f6b8
+8059f6f8 Kart::PhysicsHolder::__dt
+8059f788 0x8059f788
+8059f7c8 Kart::PhysicsHolder::Reset
+8059f968 Kart::PhysicsHolder::Update
+8059fc08 0x8059fc08
+8059fc30 0x8059fc30
+8059fc48 0x8059fc48
+8059fd0c 0x8059fd0c
+8059fdd0 0x8059fdd0
+8059fe94 0x8059fe94
+8059ff58 0x8059ff58
+805a0050 0x805a0050
+805a00d0 0x805a00d0
+805a014c 0x805a014c
+805a01cc 0x805a01cc
+805a02b8 0x805a02b8
+805a0340 Kart::PhysicsHolder::UpdateMat
+805a03c4 0x805a03c4
+805a0410 Kart::PhysicsHolder::ResetQuaternions
+805a0480 0x805a0480
+805a04a0 Kart::PhysicsHolder::__ct
+805a0550 0x805a0550
+805a05a0 AutoCameraMoverRace::__dt
+805a05e0 CamMove::__dt
+805a0620 0x805a0620
+805a0660 AutoCameraMover::__dt
+805a06a0 0x805a06a0
+805a06e0 0x805a06e0
+805a0868 0x805a0868
+805a08ac 0x805a08ac
+805a08ec 0x805a08ec
+805a08f0 0x805a08f0
+805a0a1c 0x805a0a1c
+805a0abc 0x805a0abc
+805a0b70 0x805a0b70
+805a0c14 0x805a0c14
+805a0c88 0x805a0c88
+805a0e00 0x805a0e00
+805a0ecc 0x805a0ecc
+805a0fa0 0x805a0fa0
+805a11b8 0x805a11b8
+805a131c 0x805a131c
+805a13c0 0x805a13c0
+805a1424 0x805a1424
+805a1478 AutoCameraMoverRace::vf_0x14
+805a1480 AutoCameraMoverRace::vf_0x18
+805a1488 0x805a1488
+805a14c8 0x805a14c8
+805a1508 0x805a1508
+805a153c 0x805a153c
+805a1560 0x805a1560
+805a15e0 0x805a15e0
+805a1650 0x805a1650
+805a1750 0x805a1750
+805a17e0 0x805a17e0
+805a1820 0x805a1820
+805a1860 0x805a1860
+805a1864 CameraLink::__ct
+805a18bc GameCamera::__ct
+805a19d8 CameraLink::__dt
+805a1a18 GameCamera::Update
+805a1a34 CameraMgr::__ct
+805a1a44 CameraLink::InitCameraList
+805a1a64 CameraMgr::SetInstance
+805a1a7c CameraLink::Register
+805a1a8c 0x805a1a8c
+805a1af0 CameraLink::UpdateAllCameras
+805a1b78 CameraMgr::Update
+805a1b7c CameraMgr::__dt
+805a1bbc GameCamera::__dt
+805a1bfc GameCamera::vf_0xC
+805a1c00 GameCamera::GetPosition
+805a1c1c GameCamera::GetViewMatrix(const)
+805a1c24 GameCamera::Update(thunk)
+805a1c2c GameCamera::vf_0xC(thunk)
+805a1c34 GameCamera::__dt(thunk)
+805a1c3c GameCamValues::Reset
+805a1cf4 RaceCamera::CopyVec(2vecs)
+805a1d10 RaceCamera::_ct
+805a1fac 0x805a1fac
+805a1fb0 Vec3::__ct(no args)
+805a1fb4 0x805a1fb4
+805a1ff4 0x805a1ff4
+805a2034 RaceCamera::Init
+805a21c8 RaceCamera::GetCamParams
+805a21d0 RaceCamera::Update
+805a2b08 0x805a2b08
+805a2b20 RaceCamera::CopyVec(1vec)
+805a2b3c RaceCamera::CheckBitfield334
+805a2b54 0x805a2b54
+805a2b5c RaceCamera::NegateVec
+805a2b84 0x805a2b84
+805a2c34 0x805a2c34
+805a2c94 RaceCamera::SubtractVecs
+805a2cc8 RaceCamera::AddVecs(3vecs)
+805a2cfc 0x805a2cfc
+805a2fe0 RaceCamera::LinearTransfo(2vecs)
+805a3020 RaceCamera::DotVec
+805a3050 RaceCamera::CheckKartStatusField1
+805a3070 0x805a3070
+805a3314 RaceCamera::CheckKartStatusField0
+805a3334 RaceCamera::IsAutomatic
+805a3348 RaceCamera::ClampFloat
+805a337c RaceCamera::AcosDeg
+805a3468 0x805a3468
+805a34b0 RaceCamera::UpdateCamValues
+805a3e2c RaceCamera::CrossVec
+805a3e78 RaceCamera::NormalizeAndGetNorm
+805a3e7c RaceCamera::CompareFloats
+805a3e9c PSMTXMultVec
+805a3ea0 RaceCamera::ScaleVec(2vecs)
+805a3ec8 0x805a3ec8
+805a3ed0 0x805a3ed0
+805a3ed8 0x805a3ed8
+805a3ee0 0x805a3ee0
+805a3f90 0x805a3f90
+805a3fc4 RaceCamera::SubtractVecsPS
+805a3fe8 RaceCamera::AddVecs(2vecs)
+805a401c RaceCamera::ScaleVec(3vecs)
+805a4044 0x805a4044
+805a404c 0x805a404c
+805a408c 0x805a408c
+805a4094 RaceCamera::GetVecMag
+805a4098 RaceCamera::NormalizeVecPS
+805a40d0 0x805a40d0
+805a463c 0x805a463c
+805a47a4 0x805a47a4
+805a4930 0x805a4930
+805a49bc RaceCamera::OnRespawn
+805a4be4 0x805a4be4
+805a4c08 0x805a4c08
+805a4cdc RaceCamera::FlushPrevValues
+805a4d10 0x805a4d10
+805a4dbc RaceCamera::OnBoost
+805a4ddc RaceCamera::ResetAddedFov
+805a4dec RaceCamera::OnExplosion
+805a4e20 0x805a4e20
+805a4e34 0x805a4e34
+805a5548 0x805a5548
+805a57cc 0x805a57cc
+805a5d30 0x805a5d30
+805a5d70 RaceCamera::vf_0x50
+805a65c4 0x805a65c4
+805a65f8 0x805a65f8
+805a6628 0x805a6628
+805a66d8 0x805a66d8
+805a67bc 0x805a67bc
+805a6880 0x805a6880
+805a68f8 0x805a68f8
+805a6ab8 0x805a6ab8
+805a6b98 0x805a6b98
+805a6c04 0x805a6c04
+805a6c48 0x805a6c48
+805a6c58 RaceCamera::GetViewMtx
+805a6dcc 0x805a6dcc
+805a6de4 0x805a6de4
+805a6e30 0x805a6e30
+805a6e40 BCPInfo::Load
+805a6eb4 0x805a6eb4
+805a6f04 0x805a6f04
+805a6f44 OpeningPan::Load
+805a70a0 OpeningPan::Init
+805a72dc 0x805a72dc
+805a7358 OpeningPan::Calc
+805a7568 0x805a7568
+805a758c cPN_Feather_SetNodeWeight
+805a759c 0x805a759c
+805a75ac FormationSet_GetFormationSpec
+805a75bc 0x805a75bc
+805a75cc 0x805a75cc
+805a76d0 0x805a76d0
+805a772c 0x805a772c
+805a77f0 0x805a77f0
+805a7820 0x805a7820
+805a834c RaceCameraMgr::Disposer__dt
+805a83e4 RaceCameraMgr::CreateInstance
+805a8434 RaceCameraMgr::DestroyInstance
+805a8468 RaceCameraMgr::__ct
+805a8cdc RaceCameraMgr::__dt
+805a8d94 0x805a8d94
+805a8f7c RaceCamera::__dt
+805a8fbc RaceCameraMgr::HasEveryOpeningPanEnded
+805a900c RaceCameraMgr::Update
+805a906c RaceCameraMgr::ApplyShaking
+805a92b4 0x805a92b4
+805a9430 0x805a9430
+805a94d8 0x805a94d8
+805a9530 0x805a9530
+805a96ac 0x805a96ac
+805a9708 0x805a9708
+805a989c 0x805a989c
+805a9904 0x805a9904
+805a9970 0x805a9970
+805a99b0 0x805a99b0
+805a99e4 0x805a99e4
+805a9a14 0x805a9a14
+805a9a40 0x805a9a40
+805a9b04 RaceCameraMgr::ChangeFocusedPlayer
+805a9b64 0x805a9b64
+805a9ba4 OpeningPan::__dt
+805a9be4 RaceCamera::__dt(thunk)
+805a9bec RaceCamera::Update(thunk)
+805a9bf4 RaceCamera::Init(thunk)
+805a9bfc 0x805a9bfc
+805a9c04 AutoCameraMover::__ct
+805a9cb8 0x805a9cb8
+805a9d30 0x805a9d30
+805a9d40 0x805a9d40
+805a9d50 0x805a9d50
+805a9edc 0x805a9edc
+805a9f54 0x805a9f54
+805aa138 0x805aa138
+805aa140 0x805aa140
+805aa22c 0x805aa22c
+805aa710 0x805aa710
+805aa7e8 0x805aa7e8
+805aa898 0x805aa898
+805aa8e4 0x805aa8e4
+805aa940 0x805aa940
+805aa9fc 0x805aa9fc
+805aabe4 0x805aabe4
+805aac64 0x805aac64
+805aad08 0x805aad08
+805aaf64 AutoCameraMoverRace::__ct
+805ab574 AutoCameraMoverRace::ResetActions
+805ab57c AutoCameraMoverRace::vf_0x10
+805abad0 0x805abad0
+805abc90 0x805abc90
+805abd94 0x805abd94
+805abe38 0x805abd94_switch
+805abe3c 0x805abd94_caseD_0
+805abe4c 0x805abd94_caseD_1
+805abe5c 0x805abd94_caseD_2
+805abe6c 0x805abd94_caseD_3
+805abe7c 0x805abd94_caseD_4
+805abe8c 0x805abd94_caseD_6
+805abe9c 0x805abd94_caseD_5
+805abea8 0x805abd94_caseD_7
+805abecc AutoCameraMoverRace::OnAction0Start
+805abed0 AutoCameraMoverRace::OnAction0Update
+805abfb4 AutoCameraMoverRace::OnAction1Start
+805abfe0 AutoCameraMoverRace::OnAction1Update
+805ac118 AutoCameraMoverRace::OnAction2Start
+805ac1f0 AutoCameraMoverRace::OnAction2Update
+805ac328 AutoCameraMoverRace::OnRaceEndStart
+805ac384 AutoCameraMoverRace::OnRaceEndUpdate
+805ac4a4 AutoCameraMoverRace::OnAction4Start
+805ac560 AutoCameraMoverRace::OnAction4Update
+805ac66c AutoCameraMoverRace::OnAction5Start
+805ac744 AutoCameraMoverRace::OnAction5Update
+805ac8bc AutoCameraMoverRace::OnAction6Start
+805aca2c AutoCameraMoverRace::OnAction6Update
+805acb1c 0x805acb1c
+805acc34 0x805acc34
+805ace1c 0x805ace1c
+805ace8c 0x805ace8c
+805acf5c 0x805acf5c
+805ad18c 0x805ad18c
+805ad1b0 0x805ad1b0
+805ad228 DemoCamera_ct
+805ad420 0x805ad420
+805ad460 DemoCamera_init
+805ad5b4 0x805ad5b4
+805ad5c8 0x805ad5c8
+805ad81c 0x805ad81c
+805ad8ac 0x805ad8ac
+805ad924 0x805ad924
+805ada28 0x805ada28
+805adae4 0x805adae4
+805adb40 0x805adb40
+805adcb0 0x805adcb0
+805add98 0x805add98
+805addd8 0x805addd8
+805ade20 0x805ade20
+805ade50 0x805ade50
+805ade98 CamMove::OnStart
+805adee0 CamMove::Update
+805adf10 CamMove::OnEnd
+805adf58 0x805adf58
+805adff0 BFGHolder::__ct
+805ae0f8 BFGHolder::Update
+805ae35c 0x805ae35c
+805ae3bc 0x805ae3bc
+805ae440 FogManager::__ct
+805ae53c FogManager::Update
+805ae5f4 0x805ae5f4
+805ae710 0x805ae710
+805ae734 FogManager::__dt
+805ae774 BFGHolder::__dt
+805ae7b4 0x805ae7b4
+805ae8d0 0x805ae8d0
+805ae9ec VEC3_perpInPlane
+805aead8 0x805aead8
+805aeb88 Vec3_projUnit
+805aebd0 VEC3_rejUnit
+805aec24 VEC3_projAndRej
+805aec8c 0x805aec8c
+805aeca8 0x805aeca8
+805aed14 0x805aed14
+805aee14 0x805aee14
+805aeec4 GetPath
+805aef6c 0x805aef6c
+805af020 0x805af020
+805af048 0x805af048
+805af0f0 0x805af0f0
+805af148 0x805af148
+805af1bc 0x805af1bc
+805af228 0x805af228
+805af330 0x805af330
+805af370 ScnMgrCreator::Disposer__dt
+805af408 ScnMgrCreator::CreateInstance
+805af48c 0x805af48c
+805af4cc ScnMgrCreator::DestroyInstance
+805af500 ScnMgrCreator::__dt
+805af5a8 ScnMgrCreator::CreateScnMgr
+805af774 ScnMgrCreator::CreateRace
+805af948 0x805af948
+805af9e8 ScnMgrCreator::CreateMenu
+805afab0 ScnMgrCreator::CreateGlobe
+805afb78 0x805afb78
+805afc48 0x805afc48
+805afc58 0x805afc58
+805afc98 0x805afc98
+805afd14 0x805afd14
+805afe20 0x805afe20
+805afe88 0x805afe88
+805b0000 0x805b0000
+805b00b4 0x805b00b4
+805b029c 0x805b029c
+805b0494 0x805b0494
+805b052c 0x805b052c
+805b0b28 0x805b0b28
+805b0e40 0x805b0e40
+805b12fc 0x805b12fc
+805b1300 ScnMgrRace::__ct
+805b1354 ScnMgrRace::__ct
+805b13ac 0x805b13ac
+805b144c ScnMgrRace::805b144c
+805b1470 ScnMgrRace::SetModelXluDrawPriority
+805b14e0 ScnMgrRace::LoadPostEffects
+805b1a18 ScnMgrRace::LoadLights
+805b1a74 ScnMgrRace::vf_0xC
+805b1c78 ScnMgrRace::CalcSelf
+805b1cd8 ScnMgrRace::Draw
+805b1d5c 0x805b1d5c
+805b1f2c 0x805b1f2c
+805b2110 ScnMgrRace::UpdateCameras
+805b2168 0x805b2168
+805b21e8 0x805b21e8
+805b2244 0x805b2244
+805b237c 0x805b237c
+805b2550 0x805b2550
+805b2568 0x805b2568
+805b2654 0x805b2654
+805b2740 0x805b2740
+805b328c 0x805b328c
+805b3330 0x805b3330
+805b3470 0x805b3470
+805b354c 0x805b354c
+805b3670 0x805b3670
+805b36e4 0x805b36e4
+805b36e8 0x805b36e8
+805b3a58 0x805b3a58
+805b3a6c ScnProcShadows::Draw
+805b3a78 ScnProcShadows2::Draw
+805b3a84 0x805b3a84
+805b3a90 0x805b3a90
+805b3a9c ScnProcEffects::Draw
+805b3ad4 ScnProcCourseFilterEffect::Draw
+805b3af4 ScnProcEffectsSelfItem::Draw
+805b3b00 ScnMgrRace::Init
+805b3ea8 ScnProcEffectsSelfItem::__dt
+805b3f00 ScnProcCourseFilterEffect::__dt
+805b3f58 ScnProcEffects::__dt
+805b3fb0 0x805b3fb0
+805b4008 0x805b4008
+805b4060 ScnProcShadows2::__dt
+805b40b8 ScnProcShadows::__dt
+805b4110 RendererRaceUIScreen::__ct
+805b4154 RendererRaceUIScreen::__dt
+805b41ac RendererRaceUIScreen::Draw
+805b423c RendererRaceUIOrtho::__ct
+805b4280 RendererRaceUIOrtho::__dt
+805b42d8 RendererRaceUIOrtho::Draw
+805b4314 RendererRaceUIOrtho::Calc
+805b4318 RendererRaceUIScreen::Calc
+805b431c RendererRaceModels::__ct
+805b4368 RendererRaceModels::DrawModels
+805b43bc RendererRaceModels::vf_0x1c
+805b4488 RendererRaceModels::Draw
+805b450c 0x805b450c
+805b4684 RendererRaceModels::__dt
+805b46dc 0x805b46dc
+805b46e8 0x805b46e8
+805b48ac 0x805b48ac
+805b4a30 0x805b4a30
+805b4a8c 0x805b4a8c
+805b4a98 0x805b4a98
+805b4af8 Kart::Physics::__ct
+805b4b54 Kart::Physics::Reset
+805b4d24 Kart::Physics::ResetSpeed
+805b4dc0 Kart::Physics::Init(Reset Thunk)
+805b4dc4 Kart::Physics::Init
+805b4e84 Kart::Physics::InitInertia
+805b4f34 Kart::Physics::CalcInvInertia
+805b4f44 0x805b4f44
+805b50f8 0x805b50f8
+805b5170 Kart::Physics::Update
+805b5b64 0x805b5b64
+805b5b68 Kart::Physics::Stabilize
+805b5ce8 0x805b5ce8
+805b5e40 0x805b5e40
+805b5f44 0x805b5f44
+805b5f78 0x805b5f78
+805b6150 Kart::Physics::ApplyWheelSuspension
+805b629c 0x805b629c
+805b6388 0x805b6388
+805b63bc 0x805b63bc
+805b6438 0x805b6438
+805b6448 Kart::PhysicsBike::Stabilize
+805b66e4 Kart::PhysicsBike::__dt
+805b6724 Kart::Collision::UpdateCollisionsInner
+805b6a9c 0x805b6a9c
+805b6d48 Kart::Collision::ApplyBodyCollision
+805b6f4c Kart::Collision::UpdateWheelCollision
+805b725c 0x805b725c
+805b72b8 0x805b72b8
+805b78d0 0x805b78d0
+805b7928 0x805b7928
+805b7f48 Hitbox::Set
+805b7f84 Hitbox::Reset
+805b7fbc Hitbox::Update
+805b80a8 0x805b80a8
+805b8158 0x805b8158
+805b81d0 0x805b81d0
+805b81e4 0x805b81e4
+805b821c CollisionData::__ct
+805b82bc HitboxGroup::__ct
+805b8330 HitboxGroup::Reset
+805b83d8 0x805b83d8
+805b8420 0x805b8420
+805b8480 0x805b8480
+805b84c0 HitboxGroup::__ct(hitboxes)
+805b86a8 0x805b86a8
+805b875c HitboxGroup::__ct(radius,position)
+805b883c HitboxGroup::UpdateBoundingRadius
+805b8984 ShadowModelDirector::__ct(ClipInfo)
+805b89f4 ShadowModelDirector::__ct
+805b8a48 ShadowModelDirector::__dt
+805b8aa0 ShadowModelDirector::SetScnOptions
+805b8ba4 ShadowModelsMgr::Disposer__dt
+805b8c3c ShadowModelsMgr::CreateInstance
+805b8cfc ShadowModelsMgr::DestroyInstance
+805b8d30 ShadowModelsMgr::__ct
+805b8dc4 ShadowModelsMgr::__dt
+805b8e60 ShadowModelsMgr::InsertModel
+805b8e68 ShadowModelsMgr::InsertModel2
+805b8e70 ShadowModelsMgr::Draw
+805b8f40 ShadowModelsMgr::Draw2
+805b9010 MatModelDirector::__ct
+805b906c MatModelDirector::__ct(scnMgrIdx)
+805b90c8 MatModelDirector::__ct(ClipInfo)
+805b9124 MatModelDirector::__dt
+805b918c MatModelDirector::AppendToScnMgr
+805b91d0 MatModelDirector::SetMaterialNames
+805b91e0 MatModelDirector::CopyMaterialsTevColors
+805b92c8 MatModelDirector::ReplaceDefaultScnMdlTevColorDL
+805b92f8 MatModelDirector::__dt(thunk)
+805b9300 NdevArgsExtractor::__ct
+805b9304 NdevArgsExtractor::__dt
+805b9344 NdevArgsExtractor::ExtractAllArgs
+805ba08c NdevArgsExtractor::ExtractSection
+805ba184 NdevArgsExtractor::ExtractLicense
+805ba274 NdevArgsExtractor::ExtractPad
+805ba3d8 NdevArgsExtractor::ExtractGhostType
+805ba4c8 NdevArgsExtractor::ExtractCourseId
+805ba5b8 NdevArgsExtractor::ExtractGhostLicense
+805ba6e0 NdevArgsExtractor::ExtractFriendIdx
+805ba798 NdevArgsExtractor::ExtractW
+805ba88c NdevArgsExtractor::ExtractD
+805ba98c NdevArgsExtractor::ExtractInt
+805baa60 NdevArgsExtractor::ExtractU64
+805bab40 Pages::ActionLess::__ct
+805bab84 Pages::ActionLess::__dt
+805babec Pages::ActionLess::OnInit
+805bac40 Pages::ActionLess::OnActivate
+805bac4c Pages::ActionLess::AfterControlUpdate
+805bac84 Pages::ActionLess::RequestEnd
+805bac90 Pages::AutoEndingTransparent::__ct
+805bacf8 Pages::AutoEndingTransparent::__dt
+805bad8c Pages::AutoEndingTransparent::OnInit
+805bae80 Pages::AutoEndingTransparent::ResetText
+805bae90 Pages::AutoEndingTransparent::SetMessageWindowText
+805bae98 Pages::AutoEnding::__ct
+805baf10 CtrlMenuPageTitleText::__dt
+805baf68 Pages::AutoEnding::__dt
+805bb024 Pages::AutoEnding::OnInit
+805bb1c0 Pages::AutoEnding::ResetText
+805bb210 Pages::AutoEnding::SetTitleText
+805bb218 Pages::AutoEnding::SetMessageWindowText
+805bb220 Page::vf_0x5c
+805bb224 Page::OnSectionChange
+805bb228 Page::OnResume
+805bb22c Page::OnUpdate
+805bb230 Page::BeforeControlUpdate
+805bb234 Page::AfterExitAnimations
+805bb238 Page::BeforeExitAnimations
+805bb23c Page::AfterEntranceAnimations
+805bb240 Page::BeforeEntranceAnimations
+805bb244 Page::OnDeactivate
+805bb248 Page::OnDispose
+805bb24c Page::IsDVDEnabled
+805bb254 Page::IsHomeMenuWorking
+805bb25c Page::Getpage
+805bb264 0x805bb264
+805bb26c Pages::AutoEnding::GetRuntimeTypeInfo
+805bb278 Page::GetNextPage
+805bb280 Pages::AutoEndingTransparent::GetRuntimeTypeInfo
+805bb28c Pages::ActionLess::GetRuntimeTypeInfo
+805bb298 ActionLessPage_cpp_sinit_
+805bb2b8 Pages::AwardFade::GetPlayersVolumeMgr
+805bb2c4 Pages::AwardFade::__ct
+805bb348 Pages::AwardFade::__dt
+805bb3bc Pages::AwardFade::OnInit
+805bb4dc Pages::AwardFade::OnActivate
+805bb528 Pages::AwardFade::BeforeEntranceAnimations
+805bb52c Pages::AwardFade::BeforeExitAnimations
+805bb530 Pages::AwardFade::AfterControlUpdate
+805bb678 Pages::AwardFade::HandleClick
+805bb724 AwardDemoCongratulations::GetClassName
+805bb734 AwardDemoCongratulations::__ct
+805bb770 AwardDemoCongratulations::__dt
+805bb7c8 AwardDemoCongratulations::Load
+805bb8a0 AwardDemoCongratulations::InitSelf
+805bb8d8 0x805bb8d8
+805bb910 0x805bb910
+805bb948 AwardDemoResultItem::GetClassName
+805bb958 AwardDemoResultItem::__ct
+805bb994 AwardDemoResultItem::__dt
+805bb9ec AwardDemoResultItem::Load
+805bbb98 AwardDemoResultItem::InitSelf
+805bbbd0 AwardDemoResultItem::SetValues
+805bc03c Pages::AwardResults::__ct
+805bc108 Pages::AwardResults::__dt
+805bc1b0 Pages::AwardResults::OnInit
+805bc620 Pages::AwardResults::OnActivate
+805bc640 Pages::AwardResults::BeforeEntranceAnimations
+805bc660 Pages::AwardResults::AfterControlUpdate
+805bc73c Pages::AwardResults::HandleClick
+805bc8dc Pages::AwardResults::InitConfig
+805bc9dc Pages::AwardResults::SetWinOrLose
+805bcba0 0x805bcba0
+805bcc24 Pages::AwardResults::PrepareCongratulations
+805bcdc4 Pages::AwardResults::PrepareResultItems
+805bcf30 Pages::AwardResults::PrepareCup
+805bcfbc Pages::AwardResults::PrepareCup_switch
+805bcfc0 Pages::AwardResults::PrepareCup_caseD_0
+805bcfc8 Pages::AwardResults::PrepareCup_caseD_1
+805bcfd0 Pages::AwardResults::PrepareCup_caseD_2
+805bcfd8 Pages::AwardResults::PrepareCup_caseD_3
+805bcfe0 Pages::AwardResults::PrepareCup_caseD_4
+805bcfe8 Pages::AwardResults::PrepareCup_caseD_5
+805bcff0 Pages::AwardResults::PrepareCup_caseD_6
+805bcff8 Pages::AwardResults::PrepareCup_caseD_7
+805bd050 Pages::AwardResults::InitRank
+805bd2cc Pages::AwardResults::GetRuntimeTypeInfo
+805bd2d8 UIControl::805bd2d8
+805bd2dc UIControl::OnPlayAnimSound
+805bd2e0 UIControl::OnUpdate
+805bd2e4 AwardDemoResultItem::GetRuntimeTypeInfo
+805bd2f0 AwardDemoCongratulations::GetRuntimeTypeInfo
+805bd2fc 0x805bd2fc
+805bd304 Pages::AwardFade::GetRuntimeTypeInfo
+805bd310 TriggerPtmf
+805bd340 TriggerPtmf
+805bd370 AwardPages_cpp_sinit_
+805bd39c PushButton::GetClassName
+805bd3a8 PushButton::__ct
+805bd4b0 PushButton::__dt
+805bd518 PushButton::Load
+805bd704 ManipulatorManager::GetRuntimeTypeInfo
+805bd710 PushButton::OnLoad
+805bd714 0x805bd714
+805bd720 PushButton::LoadWithAnims
+805bdac8 PushButton::SetOnClickHandler
+805bdae0 PushButton::SetOnSelectHandler
+805bdae8 PushButton::SetOnDeSelectHandler
+805bdaf0 PushButton::SelectInitial
+805bdb44 PushButton::Select
+805bdb58 PushButton::SelectFocus
+805bdbd4 PushButton::SetPlayerBitfield
+805bdbe0 PushButton::Init
+805bdd98 PushButton::Update
+805bdf44 PushButton::IsSelected
+805bdf88 PushButton::GetAnimationFrameSize
+805bdffc PushButton::HandleSelect
+805be12c PushButton::OnSelect
+805be130 PushButton::HandleDeselect
+805be354 PushButton::OnDeselect
+805be358 PushButton::HandleClick
+805be42c PushButton::OnClick
+805be430 PushButton::SetSelectionSoundId
+805be438 PushButtonScaleFade::GetClassName
+805be448 PushButtonScaleFade::__ct
+805be55c PushButtonScaleFade::__dt
+805be5c8 PushButtonScaleFade::SetPositionAnim
+805be600 0x805be600
+805be604 PushButtonScaleFade::GetRuntimeTypeInfo
+805be610 PushButton::GetRuntimeTypeInfo
+805be61c PushButton::TriggerPtmf
+805be64c PushButton_cpp_sinit_
+805be66c Pages::AddMKChannel::__ct
+805be7f4 CtrlMenuBackButton::__dt
+805be84c Pages::AddMKChannel::__dt
+805be8f8 Pages::AddMKChannel::OnInit
+805beb28 Pages::AddMKChannel::OnDispose
+805beb2c Pages::AddMKChannel::OnActivate
+805beb30 Pages::AddMKChannel::OnDeactivate
+805beb34 Pages::AddMKChannel::GetNextPage
+805beb4c Pages::AddMKChannel::OnAddButtonClick
+805bed68 Page::GetRuntimeTypeInfo
+805bed74 Pages::AddMKChannel::OnCancelButtonClick
+805bee00 Pages::AddMKChannel::OnBackButtonClick
+805bee3c Pages::AddMKChannel::OnBackPress
+805bee4c Pages::MKChannelExplanation::__ct
+805bef64 Pages::MKChannelExplanation::__dt
+805bf004 Pages::MKChannelExplanation::OnInit
+805bf1a0 Pages::MKChannelExplanation::OnActivate
+805bf1ac Pages::MKChannelExplanation::GetNextPage
+805bf1e4 Pages::MKChannelExplanation::OnButtonClick
+805bf290 Pages::MKChannelExplanation::OnBackPress
+805bf2d8 0x805bf2d8
+805bf2dc Pages::MKChannelExplanation::GetRuntimeTypeInfo
+805bf2e8 Pages::AddMKChannel::GetRuntimeTypeInfo
+805bf2f4 Pages::MKChannelExplanation::TriggerButtonPtmf
+805bf324 Pages::AddMKChannel::TriggerButtonPtmf
+805bf354 Pages::MKChannelExplanation::TriggerBackPtmf
+805bf384 Pages::AddMKChannel::TriggerBackPtmf
+805bf3b4 AddMKChannelPage_cpp_sinit_
+805bf3d0 NotifyButton::GetClassName
+805bf3dc NotifyButton::__ct
+805bf418 NotifyButton::__dt
+805bf470 NotifyButton::Load
+805bf52c NotifyButton::InitSelf
+805bf600 NotifyButton::OnUpdate
+805bf998 NotifyButton::OnClick
+805bf9dc NotifyButton::OnClick_switch
+805bf9e0 NotifyButton::OnClick_caseD_0
+805bf9e8 NotifyButton::OnClick_caseD_1
+805bf9f0 NotifyButton::OnClick_caseD_2
+805bfaf8 NotifyButton::OnClick_caseD_3
+805bfb00 NotifyButton::OnClick_caseD_5
+805bfb08 NotifyButton::OnClick_caseD_7
+805bfb10 NotifyButton::OnClick_caseD_8
+805bfb18 NotifyButton::OnClick_caseD_9
+805bfb20 NotifyButton::OnClick_caseD_a
+805bfb70 NotifyButton::OnClick_switch_805bfb90::CaseD_a
+805bfb94 0x805bfb94
+805bfb9c 0x805bfb9c
+805bfba4 0x805bfba4
+805bfbac 0x805bfbac
+805bfbb4 0x805bfbb4
+805bfbbc 0x805bfbbc
+805bfbc4 0x805bfbc4
+805bfbcc 0x805bfbcc
+805bfbd4 0x805bfbd4
+805bfbdc 0x805bfbdc
+805bfbe4 0x805bfbe4
+805bfbf4 NotifyButton::CheckStatusAvailabilities
+805bfe1c NotifyButton::UpdateText
+805bfe58 NotifyButton::UpdateText_switch
+805bfe5c NotifyButton::UpdateText_caseD_0
+805bfe64 NotifyButton::UpdateText_caseD_1
+805bfe6c NotifyButton::UpdateText_caseD_2
+805bfe74 NotifyButton::UpdateText_caseD_3
+805bfe7c NotifyButton::UpdateText_caseD_4
+805bfe84 NotifyButton::UpdateText_caseD_5
+805bfe8c NotifyButton::UpdateText_caseD_6
+805bfe94 NotifyButton::UpdateText_caseD_7
+805bfe9c NotifyButton::UpdateText_caseD_8
+805bfea4 NotifyButton::UpdateText_caseD_9
+805bfeac NotifyButton::UpdateText_caseD_a
+805bff18 Pages::Channel::__ct
+805c00c0 CtrlMenuInstructionText::__dt
+805c0118 Pages::Channel::__dt
+805c01fc Pages::Channel::OnInit
+805c0884 Pages::Channel::OnDispose
+805c0888 Pages::Channel::OnActivate
+805c08e0 Pages::Channel::OnButtonClick
+805c0b78 Pages::Channel::OnButtonSelect
+805c0c20 Pages::Channel::OnButtonSelect_switch
+805c0c24 Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_0
+805c0c2c Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_1
+805c0c34 Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_2
+805c0c3c Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_3
+805c0c44 Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_4
+805c0c4c Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_5
+805c0c54 Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_6
+805c0c5c Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_7
+805c0c64 Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_8
+805c0c6c Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_9
+805c0c74 Pages::Channel::OnButtonSelect_switch_805c0c20::CaseD_a
+805c0c90 Pages::Channel::OnBackPress
+805c0cc8 Pages::ChannelGhostChoice::__ct
+805c0e38 Pages::ChannelGhostChoice::__dt
+805c0ee8 Pages::ChannelGhostChoice::OnInit
+805c1200 Pages::ChannelGhostChoice::OnActivate
+805c1258 Pages::ChannelGhostChoice::OnButtonClick
+805c1340 Pages::ChannelGhostChoice::OnButtonSelect
+805c1394 Pages::ChannelGhostChoice::OnBackPress
+805c13ac Pages::ChannelRankingChoice::__ct
+805c151c Pages::ChannelRankingChoice::__dt
+805c15cc Pages::ChannelRankingChoice::OnInit
+805c183c Pages::ChannelRankingChoice::OnActivate
+805c188c Pages::ChannelRankingChoice::GetNextPage
+805c18a4 Pages::ChannelRankingChoice::OnButtonClick
+805c1ad0 Pages::ChannelRankingChoice::OnButtonSelect
+805c1b24 Pages::ChannelRankingChoice::OnBackPress
+805c1b34 Pages::ChannelRankingChoice::GetRuntimeTypeInfo
+805c1b40 Pages::ChannelGhostChoice::GetNextPage
+805c1b48 Pages::ChannelGhostChoice::GetRuntimeTypeInfo
+805c1b54 Pages::Channel::GetNextPage
+805c1b5c Pages::Channel::GetRuntimeTypeInfo
+805c1b68 NotifyButton::GetRuntimeTypeInfo
+805c1b74 TriggerPtmf
+805c1ba4 TriggerPtmf
+805c1bd4 TriggerPtmf
+805c1c04 TriggerPtmf
+805c1c34 TriggerPtmf
+805c1c64 TriggerPtmf
+805c1c94 ChannelPage_cpp_sinit_
+805c1cc0 Pages::Approve::__ct
+805c1e18 Pages::Approve::__dt
+805c1eb8 Pages::Approve::OnInit
+805c208c Pages::Approve::OnActivate
+805c2118 Pages::Approve::OnDeactivate
+805c211c Pages::Approve::Reset
+805c21a8 Pages::Approve::SetTitleMessage
+805c21b0 Pages::Approve::SetMessageWindowMessage
+805c21b8 Pages::Approve::SetApproveButtonMessage
+805c21c0 Pages::Approve::OnClick
+805c223c Pages::Approve::OnBackButtonClick
+805c22b8 Pages::Approve::OnBackPress
+805c2324 Pages::Approve::BeforeEntranceAnimations
+805c2340 0x805c2340
+805c235c 0x805c235c
+805c2364 Pages::Approve::GetRuntimeTypeInfo
+805c2370 Pages::Approve::TriggerApprovePtmf
+805c23a0 Pages::Approve::TriggerDisapprovePtmf
+805c23d0 ApprovePage_cpp_sinit_
+805c23e4 ControlGroup::__ct
+805c2400 ControlGroup::__dt
+805c2460 ControlGroup::Init(UIControl)
+805c2620 ControlGroup::Init(Page)
+805c27dc ControlGroup::SetControl
+805c2804 ControlGroup::805c2804
+805c2868 ControlGroup::InitControls
+805c28d8 ControlGroup::Update
+805c2948 ControlGroup::Draw
+805c2a5c ControlGroup::ResetControlsPosition
+805c2ac0 ControlGroup::GetControl
+805c2ad0 ControlGroup::DoAction
+805c2c18 ControlLoader::__ct
+805c2c20 ControlLoader::__dt
+805c2c60 ControlLoader::Load
+805c2e80 ControlLoader::LoadBRCTR
+805c2f34 ControlLoader::LoadAnimations
+805c3218 ControlLoader::IsStringInArray
+805c32b0 ControlLoader::FindStringInArray
+805c3328 ControlLoader::GetVariant
+805c33a8 ControlLoader::LoadVariant
+805c3470 ControlLoader::LoadMessages
+805c3550 ControlLoader::LoadPictures
+805c35f8 Pages::BatteryMgr::__ct
+805c363c Pages::BatteryMgr::__dt
+805c36a4 Pages::BatteryMgr::OnInit
+805c3700 Pages::BatteryMgr::OnActivate
+805c374c Pages::BatteryMgr::BeforeEntranceAnimations
+805c3750 0x805c3750
+805c3754 Pages::BatteryMgr::BeforeExitAnimations
+805c3758 Pages::BatteryMgr::AfterControlUpdate
+805c37e0 Pages::LowBattery::__ct
+805c3874 Pages::LowBattery::__dt
+805c3900 Pages::LowBattery::OnInit
+805c3a28 Pages::LowBattery::OnActivate
+805c3a8c Pages::LowBattery::AfterControlUpdate
+805c3ac4 Pages::LowBattery::OnClick
+805c3ad8 Pages::LowBattery::BeforeEntranceAnimations
+805c3b1c Pages::LowBattery::AfterExitAnimations
+805c3b60 Pages::LowBattery::GetRuntimeTypeInfo
+805c3b6c Pages::BatteryMgr::GetNextPage
+805c3b74 Pages::BatteryMgr::GetRuntimeTypeInfo
+805c3b80 TriggerPtmf
+805c3bb0 LowBatteryPage_cpp_sinit_
+805c3bcc CountDown::__ct
+805c3bec CountDown::__dt
+805c3c2c Countdown::SetInitial
+805c3c44 Countdown::Update
+805c3cc8 CountDownTimerControl::GetClassName
+805c3cd4 CountDownTimerControl::__ct
+805c3d18 CountDownTimerControl::__dt
+805c3d70 CountDownTimerControl::Load
+805c3dfc CountDownTimerControl::InitSelf
+805c407c CountDownTimerControl::OnUpdate
+805c4380 CountDownTimerControl::AnimateCurrentCountDown
+805c4430 CountDownTimerControl::Reset
+805c44e0 0x805c44e0
+805c4748 CountDownTimerControl::GetRuntimeTypeInfo
+805c4754 CountDown_cpp_sinit_
+805c4768 0x805c4768
+805c481c 0x805c481c
+805c4884 0x805c4884
+805c48f0 0x805c48f0
+805c4ce8 Page::EndActivationState
+805c4cec 0x805c4cec
+805c4d0c Page::EndExitState
+805c4d10 0x805c4d10
+805c4e80 0x805c4e80
+805c5388 0x805c5388
+805c558c 0x805c558c
+805c56ac 0x805c56ac
+805c56cc 0x805c56cc
+805c5728 0x805c5728
+805c5730 0x805c5730
+805c573c TriggerPtmf
+805c576c TriggerPtmf
+805c579c 0x805c579c
+805c57b0 0x805c57b0
+805c5834 0x805c5834
+805c589c 0x805c589c
+805c5918 0x805c5918
+805c5ad8 Page::EndExitState
+805c5adc 0x805c5adc
+805c5ae0 0x805c5ae0
+805c6158 0x805c6158
+805c67f0 0x805c67f0
+805c6828 0x805c6828
+805c6a48 0x805c6a48
+805c6b18 0x805c6a48_switch
+805c6b1c 0x805c6a48_caseD_0
+805c6b24 0x805c6a48_caseD_1
+805c6b2c 0x805c6a48_caseD_2
+805c6b34 0x805c6a48_caseD_3
+805c6b3c 0x805c6a48_caseD_4
+805c6b44 0x805c6a48_caseD_5
+805c6b4c 0x805c6a48_caseD_6
+805c6b54 0x805c6a48_caseD_8
+805c6b5c 0x805c6a48_caseD_9
+805c6b64 0x805c6a48_caseD_7
+805c6c08 0x805c6c08
+805c6c78 0x805c6c78
+805c6eb8 0x805c6eb8
+805c6f94 0x805c6f94
+805c7268 0x805c7268
+805c73b8 0x805c73b8
+805c73f8 0x805c73f8
+805c7738 0x805c7738
+805c7824 0x805c7824
+805c7908 0x805c7908
+805c79e8 0x805c79e8
+805c7bb4 0x805c7bb4
+805c7f0c 0x805c7f0c
+805c8008 0x805c8008
+805c80a0 0x805c80a0
+805c8108 0x805c8108
+805c8118 0x805c8118
+805c82e8 0x805c82e8
+805c8398 0x805c8398
+805c8490 0x805c8490
+805c8564 0x805c8564
+805c8608 0x805c8608
+805c87a8 0x805c87a8
+805c87e4 0x805c87e4
+805c87ec 0x805c87ec
+805c8830 0x805c8830
+805c8874 0x805c8874
+805c8880 0x805c8880
+805c8888 0x805c8888
+805c8894 0x805c8894
+805c889c 0x805c889c
+805c88a8 TriggerPtmf
+805c88d8 TriggerPtmf
+805c8908 TriggerPtmf
+805c8938 TriggerPtmf
+805c8968 TriggerPtmf
+805c8998 __sinit_DownloadGhostList_cpp
+805c89b8 DpdPointerControl::GetClassName
+805c89c4 DpdPointerControl::DpadpointerControl
+805c8a08 DpdPointerControl::__dt
+805c8a60 DpdPointerControl::Load
+805c8d6c DpdPointerControl::InitSelf
+805c8ebc DpdPointerControl::OnUpdate
+805c9534 Pages::DpdPointer::__ct
+805c9598 Pages::DpdPointer::__dt
+805c960c Pages::DpdPointer::OnInit
+805c9698 Pages::DpdPointer::OnActivate
+805c96a4 Pages::DpdPointer::BeforeControlUpdate
+805c970c Pages::DpdPointer::CheckForConditions
+805c9714 Pages::System::AddPageLayer
+805c971c Pages::System::Func_0x20
+805c9720 Pages::System::ChangeSection
+805c9724 Pages::System::IsVisible
+805c972c Pages::DpdPointer::GetClassName
+805c9738 Pages::DpdPointer::GetRuntimeTypeInfo
+805c9744 DpdPointerControl::GetRuntimeTypeInfo
+805c9750 __sinit_DpdPointer_cpp
+805c9774 Pages::Empty::__ct
+805c97b8 Pages::Empty::__dt
+805c9820 Pages::Empty::OnInit
+805c9888 Page::OnActivate
+805c988c Pages::Empty::BeforeExitAnimations
+805c9890 Pages::Empty::BeforeEntranceAnimations
+805c9894 NumericEditBox::GetClassName
+805c98a0 NumericEditBox::__ct
+805c99f8 NumericEditBox::__dt
+805c9a7c NumericEditBox::Load
+805c9ebc NumericEditBox::vf_0x3c
+805c9ec0 NumericEditBox::SelectInitial
+805c9f14 NumericEditBox::Select
+805c9f34 NumericEditBox::RemoveAllDigits
+805c9fe8 NumericEditBox::HasFullDigits
+805ca028 NumericEditBox::HasUnusedDigit
+805ca068 NumericEditBox::ComputeSum
+805ca0c8 NumericEditBox::AddDigit
+805ca250 NumericEditBox::RemoveDigit
+805ca438 NumericEditBox::Init
+805ca53c NumericEditBox::Update
+805ca6e8 NumericEditBox::HandleUpPress
+805ca7c0 NumericEditBox::HandleDownPress
+805ca870 NumericEditBox::HandleClick
+805ca94c NumericEditBox::HandleRightPress
+805caa24 NumericEditBox::HandleLeftPress
+805caae0 NumericEditBox::EditLetter::GetClassName
+805caaf0 NumericEditBox::EditLetter::__ct
+805cab2c NumericEditBox::EditLetter::__dt
+805cab84 NumericEditBox::EditLetter::Load
+805cac0c NumericEditBox::EditLetter::Init
+805cac8c NumericEditBox::EditLetter::Update
+805cac90 NumericEditBox::EditLetter::AddDigit
+805cace4 NumericEditBox::EditLetter::RemoveDigit
+805cacf0 NumericEditBox::EditLetter::ToggleCursor
+805cad3c NumericEditBox::EditLetter::AnimateDigit
+805cad74 0x805cad74
+805cad78 NumericEditBox::GetRuntimeTypeInfo
+805cad84 NumericEditBox::EditLetter::GetRuntimeTypeInfo
+805cad90 TriggerPtmf
+805cadc0 NumericEditBox_cpp_sinit_
+805caddc 0x805caddc
+805cade8 0x805cade8
+805cae24 StaffRollControl::__dt
+805cae7c StaffRollControl::Load
+805caf30 StaffRollControl::InitSelf
+805caf68 StaffRollControl::AppearAnimated
+805cafa0 StaffRollControl::DisappearAnimated
+805cafd8 Pages::StaffRoll::__ct
+805cb074 StaffRollText::__ct
+805cb0d0 StaffRollText::__dt
+805cb144 Pages::StaffRoll::__dt
+805cb1c4 Pages::StaffRoll::OnInit
+805cb704 Pages::StaffRoll::OnActivate
+805cb754 Pages::StaffRoll::BeforeEntranceAnimations
+805cb758 Pages::StaffRoll::BeforeExitAnimations
+805cb75c Pages::StaffRoll::AfterControlUpdate
+805cbad8 Pages::StaffRoll::SetHasNotStarted
+805cbaf0 Pages::StaffRoll::OnClick
+805cbafc EndingMovieControl::GetClassName
+805cbb0c EndingMovieControl::__ct
+805cbb48 EndingMovieControl::__dt
+805cbba0 EndingMovieControl::Load
+805cbc98 EndingMovieControl::InitSelf
+805cbcd0 EndingMovieControl::FadeIn
+805cbd08 EndingMovieControl::FadeOut
+805cbd40 EndingMovieControl::IsCurrentAnimation1Or2
+805cbd88 Pages::EndingMovie::__ct
+805cbe24 Pages::EndingMovie::__dt
+805cbea4 Pages::EndingMovie::OnInit
+805cc0a8 Pages::EndingMovie::OnActivate
+805cc1b8 Pages::EndingMovie::AfterEntranceAnimations
+805cc1bc Pages::EndingMovie::AfterControlUpdate
+805cc2ec Pages::EndingMovie::OnMovieActivate
+805cc3b8 Pages::CreditsCongrats::__ct
+805cc44c Pages::CreditsCongrats::__dt
+805cc4fc Pages::CreditsCongrats::OnInit
+805cc6e8 Pages::CreditsCongrats::OnActivate
+805cc864 Pages::CreditsCongrats::AfterControlUpdate
+805ccc04 Pages::CreditsCongrats::OnResumt
+805cd1ac Pages::CreditsCongrats::OnClick
+805cd1b8 Pages::CreditsCongrats::Publish
+805cd2e8 Pages::CreditsCongrats::AfterPublish
+805cd3e8 Pages::CreditsCongrats::AfterPublishMsg
+805cd4e8 Pages::CreditsCongrats::AfterDontPostTooMany
+805cd5e8 Pages::CreditsCongrats::HandlePublishError
+805cd6b8 Pages::CreditsCongrats::HandlePublishError_switch
+805cd6bc Pages::CreditsCongrats::HandlePublishError_caseD_1
+805cd6c4 Pages::CreditsCongrats::HandlePublishError_caseD_2
+805cd6cc Pages::CreditsCongrats::HandlePublishError_caseD_3
+805cd6d4 Pages::CreditsCongrats::HandlePublishError_caseD_4
+805cd6dc Pages::CreditsCongrats::HandlePublishError_caseD_5
+805cd6e4 Pages::CreditsCongrats::HandlePublishError_caseD_6
+805cd6ec Pages::CreditsCongrats::HandlePublishError_caseD_8
+805cd6f4 Pages::CreditsCongrats::HandlePublishError_caseD_9
+805cd6fc Pages::CreditsCongrats::HandlePublishError_caseD_7
+805cd710 Pages::CreditsCongrats::HandlePublishError_caseD_0
+805cd784 0x805cd784
+805cd850 Pages::CreditsCongrats::GetRuntimeTypeInfo
+805cd85c Pages::EndingMovie::GetRuntimeTypeInfo
+805cd868 EndingMovieControl::GetRuntimeTypeInfo
+805cd874 Pages::StaffRoll::GetRuntimeTypeInfo
+805cd880 StaffRollControl::GetRuntimeTypeInfo
+805cd88c TriggerPtmf
+805cd8bc TriggerPtmf
+805cd8ec TriggerPtmf
+805cd91c Ending_cpp_sinit_
+805cd94c Text::Info::__ct
+805cda34 Text::PaneHandler::__ct
+805cda50 Text::PaneHandler::__dt
+805cdac0 Text::Mgr::CreateInstance
+805cdb68 Text::Mgr::DestroyInstance
+805cdbe4 Text::PaneHandler::Init
+805cdd00 Text::PaneHandler::SetMessage
+805cdf28 0x805cdf28
+805ce438 Text::PaneHandler::SetMessage_switch
+805ce43c Text::PaneHandler::SetMessage_case0
+805ce4cc Text::PaneHandler::SetMessage_case10
+805ce534 Text::PaneHandler::SetMessage_case12
+805ce584 Text::PaneHandler::SetMessage_case13
+805ce630 Text::PaneHandler::SetMessage_case14
+805ce79c Text::PaneHandler::SetMessage_case15
+805ce8d8 Text::PaneHandler::SetMessage_case1
+805cedc4 ManipulatorHandler::CheckPlayerPointer
+805cedcc Text::PaneHandler::ResetMessage
+805cee08 Text::PaneHandler::Draw
+805ceed8 0x805ceed8
+805ceef4 0x805ceef4
+805cef10 Text::PaneHandler::GetBMGInfo
+805cefc4 0x805cefc4
+805cf068 Text::GlyphParams::__ct
+805cf06c Text::GlyphParams::__dt
+805cf0ac Text::GlyphParams::SetCharacter
+805cf110 Text::GlyphUnicodeExternal::__ct
+805cf114 Text::GlyphUnicodeExternal::__dt
+805cf154 Text::GlyphUnicodeExternal::SetCharacter
+805cf27c Text::GlyphDrawer::__dt
+805cf2bc Text::GlyphDrawer::Init
+805cf598 Text::GlyphDrawer::Draw
+805cf680 Text::GlyphDrawer::DrawExternalUnicode
+805cf7e4 Text::GlyphDrawer::SetupGXColors
+805cf9ec Text::GlyphDrawer::SetupGXColors_switch
+805cf9f0 Text::GlyphDrawer::SetupGXColors_caseD_1
+805cfa08 Text::GlyphDrawer::SetupGXColors_caseD_10
+805cfa20 Text::GlyphDrawer::SetupGXColors_caseD_11
+805cfa3c Text::GlyphDrawer::SetupGXColors_caseD_12
+805cfa58 Text::GlyphDrawer::SetupGXColors_caseD_13
+805cfa74 Text::GlyphDrawer::SetupGXColors_caseD_14
+805cfa90 Text::GlyphDrawer::SetupGXColors_caseD_15
+805cfaac Text::GlyphDrawer::SetupGXColors_caseD_16
+805cfac8 Text::GlyphDrawer::SetupGXColors_caseD_17
+805cfae0 Text::GlyphDrawer::SetupGXColors_caseD_20
+805cfaf8 Text::GlyphDrawer::SetupGXColors_caseD_21
+805cfb14 Text::GlyphDrawer::SetupGXColors_caseD_30
+805cfb2c Text::GlyphDrawer::SetupGXColors_caseD_31
+805cfb48 Text::GlyphDrawer::SetupGXColors_caseD_32
+805cfb60 Text::GlyphDrawer::SetupGXColors_caseD_33
+805cfb78 Text::GlyphDrawer::SetupGXColors_caseD_40
+805cfb94 Text::GlyphDrawer::SetupGXColors_caseD_18
+805cfbd8 Text::GlobalHandler::__ct
+805cfbe4 Text::GlobalHandler::__dt
+805cfc24 Text::GlobalHandler::SetPaneHandler
+805cff74 0x805cff74
+805d00b0 Text::GlobalHandler::SetCharacter
+805d0324 Text::GlobalHandler::SetExternalUnicodeChar
+805d0584 0x805d0584
+805d061c 0x805d061c
+805d0660 0x805d0660
+805d0674 Text::GlobalHandler::Calc
+805d0c90 0x805d0c90
+805d0cd4 Text::GlobalHandler::CalcMessageParams
+805d0d98 Text::GlobalHandler::GetGlyphParamsAndIncrement
+805d0dd0 Text::GlobalHandler::GetUnicodeGlyphParamsAndIncrement
+805d0e08 Text::GlobalHandler::SetPaneHandlerAndPane
+805d0f34 Text::GameFont::__ct
+805d0f80 Text::GameFont::__dt
+805d0ff0 Text::GameFont::Load
+805d1044 Text::GameFont::GetTextureByCode
+805d1134 Text::GameFont::GetTextureByIdx
+805d1214 Text::GameFont::Init
+805d130c Text::FontMgr::__ct
+805d132c Text::FontMgr::__dt
+805d13c4 Text::FontMgr::CreateInstance
+805d1414 Text::FontMgr::DestroyInstance
+805d14a4 Text::FontMgr::Init
+805d1758 Text::FontMgr::InitFont
+805d1804 Text::FontMgr::GetFont
+805d1888 HandleDisplayControl::GetClassName
+805d1894 HandleDisplayControl::__ct
+805d18d0 HandleDisplayControl::__dt
+805d1928 HandleDisplayControl::Load
+805d19a8 0x805d19a8
+805d1a0c HandleDisplayControl::InitSelf
+805d1ab8 Pages::WheelOnlyComp::__ct
+805d1b24 Pages::WheelOnlyComp::__dt
+805d1ba8 Pages::WheelOnlyComp::OnInit
+805d1cd0 Pages::WheelOnlyComp::OnActivate
+805d1ce4 Pages::WheelOnlyComp::AfterEntranceAnimations
+805d1cf8 Pages::WheelOnlyComp::AfterControlUpdate
+805d1e48 Pages::WheelOnlyComp::GetRuntimeTypeInfo
+805d1e54 HandleDisplayControl::GetRuntimeTypeInfo
+805d1e60 WheelOnlyComp_cpp_sinit_
+805d1e84 FriendList::__ct
+805d1ef8 0x805d21ef8
+805d1f38 FriendListEntry::__ct
+805d1f80 FriendListEntry::__dt
+805d1fc0 0x805d1fc0
+805d2000 0x805d2000
+805d2040 FriendList::__dt
+805d20a4 FriendList::Init
+805d21b4 FriendList::SaveToRKSYS
+805d2264 FriendList::Update
+805d22c8 0x805d22c8
+805d23d8 0x805d23d8
+805d24c0 FriendList::GetFriendCount
+805d255c FriendList::AddFriend
+805d2700 FriendList::RemoveFriend
+805d2778 FriendList::GetFriendIdx
+805d2874 FriendList::GetFriendEntry
+805d2890 FriendList::GetFriend
+805d28c8 FriendList::GetFriendStatus
+805d2900 FriendList::IsFriendStatusLessThan25
+805d294c FriendList::IsUpdated
+805d2968 FriendList::UpdateKeyController
+805d2990 0x805d2990
+805d29dc 0x805d29dc
+805d2a04 0x805d2a04
+805d2a50 FriendList::UpdateStatuses
+805d2aa8 0x805d2aa8
+805d2b44 FriendList::UpdateStatuses_switch
+805d2b48 FriendList::UpdateStatuses_caseD_1
+805d2b50 FriendList::UpdateStatuses_caseD_2
+805d2b58 FriendList::UpdateStatuses_caseD_3
+805d2b60 FriendList::UpdateStatuses_caseD_5
+805d2b68 FriendList::UpdateStatuses_caseD_6
+805d2b70 FriendList::UpdateStatuses_caseD_7
+805d2b78 FriendList::UpdateStatuses_caseD_8
+805d2b80 FriendList::UpdateStatuses_caseD_9
+805d2b88 FriendList::UpdateStatuses_caseD_a
+805d2b90 FriendList::UpdateStatuses_caseD_b
+805d2bf4 FriendList::UpdateStatuses_caseD_4
+805d2c00 FriendList::UpdateStatuses_caseD_c
+805d2c58 FriendList::UpdateStatuses_caseD_d
+805d2cc0 FriendList::UpdateStatuses_caseD_e
+805d2d18 FriendList::UpdateStatuses_caseD_0
+805d2d44 FriendList::UpdateFriendData
+805d3108 0x805d3108
+805d310c 0x805d310c
+805d3134 0x805d3134
+805d3138 0x805d3138
+805d3158 0x805d3158
+805d315c 0x805d315c
+805d31a8 0x805d31a8
+805d31ac 0x805d31ac
+805d31f8 0x805d31f8
+805d31fc FriendCodesController::Update
+805d32b8 FriendCodesController::TrySaveMgrToRKSYS
+805d331c FriendCodesController::SaveMgrToRKSYS
+805d3450 FriendCodesController::ResetMgrKeys
+805d3460 FriendReceiver::TrySaveToRKSYS
+805d34d4 FriendReceiver::TryReceiveData
+805d36bc FriendReceiver::SaveToRKSYS
+805d376c FriendReceiver::vf_0x10
+805d3800 FriendButton::GetClassName
+805d380c FriendButton::__ct
+805d3850 FriendButton::__dt
+805d38a8 FriendButton::Load
+805d3980 FriendButton::SetMii
+805d3b5c 0x805d3b5c
+805d3c54 FriendButton::InitSelf
+805d3c58 FriendButton::OnUpdate
+805d4028 FriendButton::OnSelect
+805d4120 FriendButton::OnDeselect
+805d41c8 Pages::FriendList::__ct
+805d43a8 Pages::FriendList::__dt
+805d446c Pages::FriendList::OnInit
+805d4830 Pages::FriendList::OnDispose
+805d4834 Pages::FriendList::OnActivate
+805d4a54 Pages::FriendList::BeforeEntranceAnimations
+805d4b5c Pages::FriendList::BeforeExitAnimations
+805d4b70 Pages::FriendList::OnDeactivate
+805d4c10 Pages::FriendList::AfterControlUpdate
+805d4c8c Pages::FriendList::AddNewFriend
+805d4d08 Pages::FriendList::OnFriendButtonClick
+805d4e50 Pages::FriendList::OnBackButtonClick
+805d4ee4 Pages::FriendList::OnRightArrowPress
+805d5014 Pages::FriendList::OnLeftArrowPress
+805d510c Pages::FriendList::OnBackPress
+805d518c Pages::FriendList::CompareFriendIndexes
+805d521c Pages::FriendList::FriendStatusToValue
+805d523c Pages::FriendList::FriendStatusToValue_switch
+805d5240 Pages::FriendList::FriendStatusToValue_Case_fffffffe
+805d5248 Pages::FriendList::FriendStatusToValue_Case_ffffffff
+805d5250 Pages::FriendList::FriendStatusToValue_Case_0
+805d5258 Pages::FriendList::FriendStatusToValue_Case_1
+805d5260 Pages::FriendList::FriendStatusToValue_Case_2
+805d5268 Pages::FriendList::FriendStatusToValue_Case_3
+805d5270 Pages::FriendList::FriendStatusToValue_Case_4
+805d5278 Pages::FriendList::FriendStatusToValue_Case_5
+805d5280 Pages::FriendList::FriendStatusToValue_Case_6
+805d5288 Pages::FriendList::FriendStatusToValue_Case_7
+805d5290 Pages::FriendList::FriendStatusToValue_Case_8
+805d5298 Pages::FriendList::FriendStatusToValue_Case_9
+805d52a0 Pages::FriendList::FriendStatusToValue_Case_a
+805d52a8 Pages::FriendList::FriendStatusToValue_Case_b
+805d52b0 Pages::FriendList::FriendStatusToValue_Case_c
+805d52b8 Pages::FriendList::FriendStatusToValue_Case_d
+805d52c0 Pages::FriendList::FriendStatusToValue_Case_e
+805d52c8 Pages::FriendList::FriendStatusToValue_Case_f
+805d52d0 Pages::FriendList::FriendStatusToValue_Case_10
+805d52d8 Pages::FriendList::FriendStatusToValue_Case_11
+805d52e0 Pages::FriendList::FriendStatusToValue_Case_12
+805d52e8 Pages::FriendList::FriendStatusToValue_Case_13
+805d52f0 Pages::FriendList::FriendStatusToValue_Case_14
+805d52f8 Pages::FriendList::FriendStatusToValue_Case_15
+805d5300 Pages::FriendList::FriendStatusToValue_Case_16
+805d5308 Pages::FriendList::FriendStatusToValue_Case_17
+805d5310 Pages::FriendList::FriendStatusToValue_Case_18
+805d5318 Pages::FriendList::FriendStatusToValue_Case_19
+805d5320 Pages::FriendList::FriendStatusToValue_Case_1a
+805d5330 Pages::FriendList::UpdatePageCounter
+805d53f8 Pages::FriendList::UpdateMiiGroup
+805d5500 JoinFriendButton::GetClassName
+805d5510 JoinFriendButton::__ct
+805d554c JoinFriendButton::__dt
+805d55a4 JoinFriendButton::__dt
+805d56ac JoinFriendButton::SetStatus
+805d5818 JoinFriendButton::OnUpdate
+805d585c Pages::FriendInfo::__ct
+805d5a14 Pages::FriendInfo::__dt
+805d5af4 Pages::FriendInfo::OnInit
+805d6000 Pages::FriendInfo::OnActivate
+805d6128 Pages::FriendInfo::AfterControlUpdate
+805d6390 Pages::FriendInfo::PlaySound
+805d6470 Pages::FriendInfo::SetInfoText
+805d6654 0x805d6654
+805d6678 Pages::FriendInfo::OnJoinButtonClick
+805d690c Pages::FriendInfo::OnRemoveButtonClick
+805d6950 Pages::FriendInfo::OnBackButtonClick
+805d6994 Pages::FriendInfo::OnBackPress
+805d69ac Pages::FriendRemove::__ct
+805d6b04 Pages::FriendRemove::__dt
+805d6ba4 Pages::FriendRemove::OnInit
+805d6d40 Pages::FriendRemove::OnActivate
+805d6e10 Pages::FriendRemove::OnDeactivate
+805d6ec8 Pages::FriendRemove::OnResume
+805d6f9c Pages::FriendRemove::OnRemoveButtonClick
+805d7190 Pages::FriendRemove::OnCancelAndBackButtonClick
+805d71ec Pages::FriendRemove::OnBackPress
+805d7204 Pages::FriendRemoving::__ct
+805d7278 Pages::FriendRemoving::__dt
+805d7308 Pages::FriendRemoving::OnInit
+805d7404 Pages::FriendRemoving::OnActivate
+805d74f4 Pages::FriendRemoving::BeforeExitAnimations
+805d7658 Pages::FriendRemoving::AfterControlUpdate
+805d796c Pages::FriendJoinMgr::__ct
+805d79b0 Pages::FriendJoinMgr::__dt
+805d7a18 Pages::FriendJoinMgr::OnInit
+805d7a84 Pages::FriendJoinMgr::OnActivate
+805d7d54 Pages::FriendJoinMgr::BeforeEntranceAnimations
+805d7d58 Pages::FriendJoinMgr::AfterEntranceAnimations
+805d7d68 Pages::FriendJoinMgr::BeforeExitAnimations	
+805d7d6c Pages::FriendJoinMgr::GetNextPage
+805d7d74 Pages::FriendJoinMgr::GetRuntimeTypeInfo
+805d7d80 Pages::FriendRemoving::IsHomeMenuWorking
+805d7d88 Pages::FriendRemoving::GetNextPage
+805d7d90 Pages::FriendRemoving::GetRuntimeTypeInfo
+805d7d9c Pages::FriendRemove::GetNextPage
+805d7da4 Pages::FriendRemove::GetRuntimeTypeInfo
+805d7db0 Pages::FriendInfo::GetNextPage
+805d7db8 Pages::FriendInfo::GetRuntimeTypeInfo
+805d7dc4 JoinFriendButton::GetRuntimeTypeInfo
+805d7dd0 Pages::FriendList::GetNextPage
+805d7dd8 Pages::FriendList::GetRuntimeTypeInfo
+805d7de4 FriendButton::GetRuntimeTypeInfo
+805d7df0 TriggerPtmf
+805d7e20 TriggerPtmf
+805d7e50 TriggerPtmf
+805d7e80 TriggerPtmf
+805d7eb0 TriggerPtmf
+805d7ee0 TriggerPtmf
+805d7f10 TriggerPtmf
+805d7f40 FriendListPage_cpp_sinit_
+805d7f78 Pages::FriendRoom::__ct
+805d8160 Pages::FriendRoom::__dt
+805d820c Pages::FriendRoom::OnInit
+805d8444 Pages::FriendRoom::OnActivate
+805d84fc Pages::FriendRoom::OnDeactivate
+805d8508 Pages::FriendRoom::AfterControlUpdate
+805d8c98 Pages::FriendRoom::OnResume
+805d8f40 Pages::FriendRoom::SetStatus
+805d8f48 0x805d8f48
+805d8f84 Pages::FriendRoom::OnMessagesButtonClick
+805d906c Pages::FriendRoom::OnStartButtonClick
+805d9154 Pages::FriendRoom::OnAddFriendsButtonClick
+805d9160 Pages::FriendRoom::OnBackButtonClick
+805d92a0 Pages::FriendRoom::OnButtonSelect
+805d930c Pages::FriendRoom::OnBackPress
+805d944c FriendMatchingPlayer::GetClassName
+805d945c FriendMatchingPlayer::__ct
+805d94d0 FriendMatchingPlayer::__dt
+805d9528 FriendMatchingPlayer::Load
+805d9614 FriendMatchingPlayer::InitSelf
+805d9700 FriendMatchingPlayer::OnUpdate
+805d987c 0x805d987c
+805d9994 0x805d9994
+805d99f8 0x805d99f8
+805d9aa8 FriendMatchingPlayer::OnMessageSent
+805d9b38 Pages::FriendRoomManager::__ct
+805d9bcc Pages::FriendRoomManager::__dt
+805d9c74 Pages::FriendRoomManager::OnInit
+805d9db0 Pages::FriendRoomManager::OnActivate
+805d9f20 Pages::FriendRoomManager::AfterEntranceAnimations
+805da028 Pages::FriendRoomManager::BeforeExitAnimations
+805da0f4 Pages::FriendRoomManager::OnDeactivate
+805da140 Pages::FriendRoomManager::AfterControlUpdate
+805dac50 AvoidController_UseMinimumAvoidance
+805dac60 0x805dac60
+805dacb0 Pages::FriendRoomManager::GetMessageBmg
+805dada4 Pages::FriendRoomManager::SetToSendPacket
+805dae28 0x805dae28
+805dae30 0x805dae30
+805dae58 0x805dae58
+805dae68 0x805dae68
+805dae7c 0x805dae7c
+805dae80 0x805dae80
+805daec0 0x805daec0
+805daf38 0x805daf38
+805db204 0x805db204
+805db278 0x805db278
+805db320 0x805db320
+805db348 0x805db348
+805db358 0x805db358
+805db634 0x805db634
+805db6b8 MessageSelectControl::GetClassName
+805db6c8 MessageSelectControl::__ct
+805db724 MessageSelectControl::__dt
+805db798 MessageSelectControl::Load
+805db8ec MessageSelectControl::InitSelf
+805db8f0 MessageSelectControl::OnUpdate
+805db9e8 MessageSelectControl::SetPositionAnim
+805dba20 MessageSelectControl::Activate
+805dbab8 MessageSelectControl::Deactivate
+805dbb28 MessageSelectControl::ChangeToPage
+805dbb88 MessageSelectControl::ChangeFromPage
+805dbc20 MessageSelectControl::IsActivated
+805dbc58 MessageSelectControl::IsDeactivated
+805dbc8c MessageSelectControl::SetButtonBmg
+805dbcc4 MessageSelectControl::SetOnClickHandler
+805dbd24 MessageSelectControl::SelectInitialButton
+805dbd34 MessageSelectControl::GetSelectedButtonId
+805dbd94 Pages::FriendRoomMessages::__ct
+805dbfdc SheetSelectControlScaleFade::__dt
+805dc034 Pages::FriendRoomMessages::__dt
+805dc104 Pages::FriendRoomMessages::OnInit
+805dc378 Pages::FriendRoomMessages::OnActivate
+805dc71c Pages::FriendRoomMessages::OnDeactivate
+805dc7b8 Pages::FriendRoomMessages::BeforeControlUpdate
+805dc840 0x805dc840
+805dca9c Pages::FriendRoomMessages::End
+805dcab4 Pages::FriendRoomMessages::UpdateMessage
+805dcc70 Pages::FriendRoomMessages::OnMessageButtonClick
+805dcd78 Pages::FriendRoomMessages::OnModeButtonClick
+805dce80 Pages::FriendRoomMessages::OnAddFriendsButtonClick
+805dd0c8 Pages::FriendRoomMessages::OnRightArrowPress
+805dd1d4 Pages::FriendRoomMessages::OnLeftArrowPress
+805dd2dc Pages::FriendRoomMessages::OnBackButtonClick
+805dd318 Pages::FriendRoomMessages::OnBackPress
+805dd330 Pages::FriendRoomWaiting::__ct
+805dd38c Pages::FriendRoomWaiting::__dt
+805dd418 Pages::FriendRoomWaiting::OnInit
+805dd5ac Pages::FriendRoomWaiting::OnActivate
+805dd724 Pages::FriendRoomWaiting::OnDeactivate
+805dd734 Pages::FriendRoomWaiting::BeforeEntranceAnimations
+805dd7c0 Pages::FriendRoomWaiting::BeforeExitAnimations
+805dd7c4 Pages::FriendRoomWaiting::AfterControlUpdate
+805ddcc8 Pages::FriendRoomWaiting::OnResume
+805de088 0x805de088
+805de090 Pages::FriendRoomWaiting::StartRoom
+805de838 Pages::Menu::GetRuntimeTypeInfo
+805de844 0x805de844
+805de84c Pages::FriendRoomWaiting::IsHomeMenuWorking
+805de854 Pages::FriendRoomWaiting::GetRuntimeTypeInfo
+805de860 Pages::FriendRoomMessages::GetRuntimeTypeInfo
+805de86c MessageSelectControl::GetRuntimeTypeInfo
+805de878 Pages::FriendRoomManager::GetRuntimeTypeInfo
+805de884 FriendMatchingPlayer::GetRuntimeTypeInfo
+805de890 Pages::FriendRoom::GetRuntimeTypeInfo
+805de89c TriggerPtmf
+805de8cc TriggerPtmf
+805de8fc TriggerPtmf
+805de92c TriggerPtmf
+805de95c TriggerPtmf
+805de98c TriggerPtmf
+805de9bc FriendRoomPage_cpp_sinit_
+805de9f0 Pages::GhostRaceExplanation::__ct
+805deb08 Pages::GhostRaceExplanation::__dt
+805deba8 Pages::GhostRaceExplanation::OnInit
+805ded24 Pages::GhostRaceExplanation::OnActivate
+805deeac Pages::GhostRaceExplanation::GetNextPage
+805deefc Pages::GhostRaceExplanation::OnButtonClick
+805def88 Pages::GhostRaceExplanation::OnBackPress
+805defd4 Pages::GhostRaceMgr::__ct
+805df058 Pages::GhostRaceMgr::__dt
+805df0c0 Pages::GhostRaceMgr::OnInit
+805df1d0 Pages::GhostRaceMgr::OnActivate
+805df2f0 Pages::GhostRaceMgr::BeforeEntranceAnimations
+805df2f4 Pages::GhostRaceMgr::BeforeExitAnimations
+805df2f8 Pages::GhostRaceMgr::AfterControlUpdate
+805df540 Pages::GhostRaceMgr::OnResume
+805df978 Pages::GhostRaceMgr::DownloadGhost
+805e00f4 0x805e00f4
+805e0204 0x805e0204
+805e0344 Pages::GhostRaceMgr::PrepareRace
+805e053c Pages::GhostRaceMgr::OnErrorBoxClick
+805e0584 Pages::GhostRaceInfo::__ct
+805e069c Pages::GhostRaceInfo::__dt
+805e073c Pages::GhostRaceInfo::OnInit
+805e08b4 Pages::GhostRaceInfo::OnActivate
+805e08c0 Pages::GhostRaceInfo::UpdateGhostInfo
+805e0918 Pages::GhostRaceInfo::OnButtonClick
+805e0a44 Pages::GhostRaceInfo::OnBackPress
+805e0afc Pages::GhostRaceInfo::GetRuntimeTypeInfo
+805e0b08 Pages::GhostRaceMgr::GetNextPage
+805e0b10 Pages::GhostRaceMgr::GetRuntimeTypeInfo
+805e0b1c Pages::GhostRaceExplanation::GetRuntimeTypeInfo
+805e0b28 TriggerPtmf
+805e0b58 TriggerPtmf
+805e0b88 TriggerPtmf
+805e0bb8 TriggerPtmf
+805e0be8 TriggerPtmf
+805e0c18 GhostRacePage_cpp_sinit_
+805e0c38 Pages::GhostManager::__ct
+805e0cb8 Pages::GhostManager::__dt
+805e0d84 Pages::GhostManager::OnInit
+805e0ffc Pages::GhostManager::OnActivate
+805e10f8 Pages::GhostManager::BeforeEntranceAnimations
+805e10fc Pages::GhostManager::BeforeExitAnimations
+805e1100 Pages::GhostManager::OnDeactivate
+805e1104 Pages::GhostManager::AfterControlUpdate
+805e1108 Pages::GhostManager::OnSectionChange
+805e11b0 Pages::GhostManager::RequestAllGhosts
+805e1214 Pages::GhostManager::UpdateState
+805e124c Pages::GhostManager::UpdateState_switch
+805e1250 Pages::GhostManager::UpdateState_case_1
+805e1360 Pages::GhostManager::UpdateState_case_2
+805e1384 Pages::GhostManager::UpdateState_case_3
+805e13bc Pages::GhostManager::UpdateState_case_4
+805e13f4 Pages::GhostManager::UpdateState_case_5
+805e142c Pages::GhostManager::UpdateState_case_6
+805e145c Pages::GhostManager::UpdateState_case_7
+805e1480 Pages::GhostManager::UpdateState_case_9
+805e14ac Pages::GhostManager::UpdateState_case_a
+805e14d8 Pages::GhostManager::UpdateState_case_b
+805e1504 Pages::GhostManager::UpdateState_case_c
+805e1528 Pages::GhostManager::UpdateState_case_d
+805e1548 Pages::GhostManager::UpdateState_case_0
+805e15c4 Pages::GhostManager::AreStaffGhostsLoading
+805e163c 0x805e163c
+805e1748 Pages::GhostManager::PrepareRaceState
+805e17cc Pages::GhostManager::PrepareReplayState
+805e1800 0x805e1800
+805e1820 0x805e1820
+805e1894 0x805e1894
+805e1998 Pages::GhostManager::RequestGhost
+805e1b04 Pages::GhostManager::SetupGhostRace
+805e1d5c Pages::GhostManager::SetupGhostReplay
+805e1ef8 0x805e1ef8
+805e1fd0 0x805e1fd0
+805e208c GhostList::__ct
+805e209c GhostList::__dt
+805e20dc GhostList::FillWithAllGhosts
+805e2198 GhostList::FillWithAllDLdGhosts
+805e2200 GhostList::Init
+805e22c8 GhostList::Reset
+805e22d4 GhostList::FillFromGroup
+805e241c GhostList::Sort
+805e2430 GhostList::CompareEntries
+805e2500 GhostList::GetHeader
+805e2528 GhostList::CheckIsNew
+805e2554 GhostList::AllAreGhostsNrw
+805e2588 GhostList::SetSectionParamsGhostValues
+805e2610 GhostList::EraseEntry
+805e2720 Pages::GhostManager::GetRuntimeTypeInfo
+805e272c GhostManagerPage_cpp_sinit_
+805e2740 GhostInfoControl::GetClassName
+805e274c GhostInfoControl::__ct
+805e27dc GhostInfoControl::__dt
+805e2844 GhostInfoControl::Load
+805e2964 GhostInfoControl::InitSelf
+805e2968 GhostInfoControl::OnUpdate
+805e296c GhostInfoControl::UpdateInfo
+805e2c80 0x805e2c80
+805e2d40 GhostInfoControl::UpdateInfoAnimate
+805e2da0 0x805e2da0
+805e2df0 0x805e2df0
+805e2e28 0x805e2e28
+805e2e60 0x805e2e60
+805e2e98 0x805e2e98
+805e2ed0 0x805e2ed0
+805e2f08 0x805e2f08
+805e2f40 GhostInfoControl::GetRuntimeTypeInfo
+805e2f4c GhostInfoControl_cpp_sinit_
+805e2f60 SectionParams::__ct
+805e2ff8 SectionParams::__dt
+805e3080 SectionParams::Reset
+805e3224 SectionParams::ResetMiisGhostsAndSubs
+805e32ac SectionParams::ResetBattleParams
+805e32c4 0x805e32c4
+805e32ec SectionParams::RandomizeVSTracks
+805e346c SectionParams::SetVStracks
+805e36a0 SectionParams::IsCourseUnlockedInOneCC
+805e37b0 SectionParams::IsCupUnlockedInOneCC
+805e3858 SectionParams::RandomizeBattleArenas
+805e38fc SectionParams::SetBattleArenas
+805e39d8 SectionParams::CopyMiisToRacedata
+805e3b98 OnlineParams::ResetRaceNumberAndCC
+805e3ba8 OnlineParams::Reset
+805e3d38 OnlineParams::CalcRank
+805e3d48 OnlineParams::SetRankBMG
+805e3d6c 0x805e3d6c
+805e3d80 0x805e3d80
+805e3d98 0x805e3d98
+805e3dbc 0x805e3dbc
+805e3dc8 TitleParams::__ct
+805e3dfc TitleParams::Reset
+805e3efc TitleParams::ForceDemo
+805e3f08 0x805e3f08
+805e3f4c 0x805e3f4c
+805e3f5c 0x805e3f5c
+805e3f68 SectionParams::TrackIdxToCourseId
+805e3fa0 SectionParams::CourseIdToTrackIdx
+805e3ff8 SectionParams::CourseIdToCupIdx
+805e4074 SectionParams::ArenaIdToCupIdx
+805e40a8 SectionParams::ResetLicenseParams
+805e422c Pages::Globe::__ct
+805e42c0 Pages::Globe::MessageWindow::__dt
+805e4318 Pages::Globe::__dt
+805e439c Pages::Globe::OnInit
+805e45bc Pages::Globe::OnActivate
+805e46c0 Pages::Globe::BeforeEntranceAnimations
+805e46c4 Pages::Globe::BeforeExitAnimations
+805e46c8 Pages::Globe::AfterControlUpdate
+805e50b4 0x805e50b4
+805e5254 0x805e5254
+805e5530 0x805e5530
+805e57f0 0x805e57f0
+805e5904 0x805e5904
+805e5a0c Pages::Globe::SetMessage
+805e5de0 0x805e5de0
+805e5ee4 0x805e5ee4
+805e5fe8 0x805e5fe8
+805e60ec 0x805e60ec
+805e6238 0x805e6238
+805e6384 0x805e6384
+805e646c 0x805e646c
+805e64e4 0x805e64e4
+805e65b4 0x805e65b4
+805e6624 0x805e6624
+805e66b8 0x805e66b8
+805e6708 0x805e6708
+805e6744 Pages::Globe::GetFriendActivityBMG
+805e6760 Pages::Globe::GetFriendActivityBMG_switch
+805e6764 Pages::Globe::GetFriendActivityBMG_caseD_1
+805e676c Pages::Globe::GetFriendActivityBMG_caseD_2
+805e6774 Pages::Globe::GetFriendActivityBMG_caseD_3
+805e677c Pages::Globe::GetFriendActivityBMG_caseD_4
+805e6784 Pages::Globe::GetFriendActivityBMG_caseD_5
+805e678c Pages::Globe::GetFriendActivityBMG_caseD_6
+805e6794 Pages::Globe::GetFriendActivityBMG_caseD_7
+805e679c Pages::Globe::GetFriendActivityBMG_caseD_8
+805e67a4 Pages::Globe::GetFriendActivityBMG_caseD_9
+805e67ac Pages::Globe::GetFriendActivityBMG_caseD_a
+805e67b4 Pages::Globe::GetFriendActivityBMG_caseD_b
+805e67bc Pages::Globe::GetFriendActivityBMG_caseD_c
+805e67c4 Pages::Globe::GetFriendActivityBMG_caseD_d
+805e67cc Pages::Globe::GetFriendActivityBMG_caseD_e
+805e67d4 Pages::Globe::GetFriendActivityBMG_caseD_f
+805e67dc Pages::Globe::GetFriendActivityBMG_caseD_10
+805e67e4 Pages::Globe::GetFriendActivityBMG_caseD_11
+805e67ec Pages::Globe::GetFriendActivityBMG_caseD_12
+805e67f4 Pages::Globe::GetFriendActivityBMG_caseD_13
+805e67fc Pages::Globe::GetFriendActivityBMG_caseD_14
+805e6804 Pages::Globe::GetFriendActivityBMG_caseD_15
+805e680c Pages::Globe::GetFriendActivityBMG_caseD_16
+805e6814 Pages::Globe::GetFriendActivityBMG_caseD_17
+805e681c Pages::Globe::GetFriendActivityBMG_caseD_18
+805e6824 Pages::Globe::GetFriendActivityBMG_caseD_19
+805e682c Pages::Globe::GetFriendActivityBMG_caseD_1a
+805e6834 Pages::Globe::GetFriendActivityBMG_caseD_0
+805e683c Pages::Globe::MessageWindow::GetClassName
+805e684c 0x805e684c
+805e6930 Pages::Globe::MessageWindow::InitSelf
+805e6994 0x805e6994
+805e6a30 0x805e6a30
+805e6ae0 0x805e6ae0
+805e6b14 Pages::Globe::GetRuntimeTypeInfo
+805e6b20 Pages::Globe::MessageWindow::GetRuntimeTypeInfo
+805e6b2c GlobePage_cpp_sinit_
+805e6b50 0x805e6b50
+805e6b9c 0x805e6b9c
+805e6c04 0x805e6c04
+805e6c70 0x805e6c70
+805e6d28 Page::EndActivationState
+805e6d2c 0x805e6d2c
+805e6ddc 0x805e6ddc
+805e6e58 0x805e6e58
+805e7220 0x805e7220
+805e7440 0x805e7440
+805e744c 0x805e744c
+805e7460 PaneManager::SearchForPane
+805e74f8 PaneManager::GetParentPane
+805e7500 0x805e7500
+805e7700 PaneManager::IsPaneAndParentsVisible
+805e77f8 PaneManager::IsPaneVisible
+805e7804 PaneManager::SetTextBoxMessage
+805e78f0 PaneManager::DoAction
+805e7a6c PaneManager::CheckForUserInfo
+805e7aac PaneManager::CheckForUserInfo2
+805e7aec PaneManager::GetNextUserInfo
+805e7b40 PaneManager::ConvertColorS10ToUT
+805e7bf4 0x805e7bf4
+805e7c1c PaneManagerHolder::__dt
+805e7ca8 PaneManagerHolder::__ct
+805e7d94 PicturePaneManager::__ct
+805e7db0 TextPaneManager::__ct
+805e7dcc MoviePaneManager::__ct
+805e7de8 0x805e7de8
+805e7dec PaneManagerHolder::InsertPicturePane
+805e7e3c PaneManagerHolder::InsertTextPane
+805e7e8c PaneManagerHolder::InsertMoviePane
+805e7edc PaneManagerHolder::Draw
+805e7f38 PicturePaneManager::Draw
+805e805c TextPaneManager::Draw
+805e8178 MoviePaneManager::Draw
+805e8294 PaneManagerHolder::InsertManager
+805e82c4 Layout::__ct
+805e830c Layout::__dt
+805e8368 Layout::GetPaneByName
+805e8380 Layout::CreateResourceAccessor
+805e8528 Layout::Build
+805e85a8 MainLayout::__ct
+805e8630 MainLayout::__dt
+805e86f4 MainLayout::CreateResourceAccessor
+805e889c MainLayout::Build
+805e9028 MainLayout::GetTextPaneHandlerByName
+805e90a0 MainLayout::GetTextPaneHandlerByPane
+805e90e8 MainLayout::GetMoviePaneHandlerByName
+805e9160 MainLayout::GetMoviePaneHandlerByPane
+805e91a8 MainLayout::Animate
+805e91bc MainLayout::Update
+805e9268 MainLayout::Draw
+805e92d0 Text::PaneHandler::Initializer::Calc
+805e93d4 MoviePaneHander::Initializer::Calc
+805e94d8 PaneTypeCounter::Calc
+805e9708 PaneManager::Initializer::Calc
+805e9b28 PictureLayout::__ct
+805e9bc0 PictureLayout::__dt
+805e9c20 PictureLayout::CreateResourceAccessor
+805e9dd8 PictureLayout::Build
+805e9e78 PictureLayout::SetPrevLayout
+805e9e80 PictureLayout::IsLinkedToLYT
+805e9eec PictureLayoutList::__ct
+805e9ef8 PictureLayoutList::__dt
+805e9f80 PictureLayoutList::Attach
+805ea28c LayoutResourceAccessorList::__ct
+805ea298 LayoutResourceAccessorList::__dt
+805ea358 LayoutFont::__dt
+805ea398 0x805ea398
+805ea3d8 0x805ea3d8
+805ea418 LayoutResources::__dt
+805ea490 LayoutResourceLink::__dt
+805ea4d0 LayoutResourceAccessorList::Attach
+805ea66c LayoutResourceAccessor::Init
+805ea770 LayoutResourceLink::__ct
+805ea780 0x805ea780
+805ea784 0x805ea784
+805ea7c4 0x805ea7c4
+805ea818 LicenseControl::GetClassName
+805ea824 LicenseButton::GetClassName
+805ea834 Pages::LicenseSelect::__ct
+805eaa6c LicenseButton::__ct
+805eaaa8 LicenseButton::__dt
+805eab00 Pages::LicenseSelect::__dt
+805eabb8 Pages::LicenseSelect::OnInit
+805eae94 Pages::LicenseSelect::SetControlMii
+805eb774 Pages::LicenseSelect::OnActivate
+805eb798 Pages::LicenseSelect::OnResume
+805eb79c Pages::LicenseSelect::AfterControlUpdate
+805eb7a0 Pages::LicenseSelect::OnLicenseButtonClick
+805ebb44 Pages::LicenseSelect::OnOptionsButtonClick
+805ebc8c Pages::LicenseSelect::OnBackButtonClick
+805ebcd0 Pages::LicenseSelect::OnBackPress
+805ebce8 Pages::LicenseSelect::OnNewLicenseApprove
+805ebd44 Pages::LicenseSelect::OnNewLicenseDisapprove
+805ebda0 Pages::LicenseSelect::OnNewLicenseBack
+805ebdac Pages::LicenseChangeMii::__ct
+805ebf10 LicenseControl::__dt
+805ebf68 Pages::LicenseChangeMii::__dt
+805ec008 Pages::LicenseChangeMii::OnInit
+805ec274 Pages::LicenseChangeMii::OnActivate
+805ec4e8 Pages::LicenseChangeMii::SetControlMii
+805ecdc8 Pages::LicenseChangeMii::UpdateMiiGroup
+805ecdd8 Pages::LicenseChangeMii::PrepareMessageBox
+805ecf2c 0x805ecf2c
+805ecff0 0x805ecff0
+805ed16c 0x805ed16c
+805ed2d4 Pages::LicenseChangeMii::OnClick
+805ed450 Pages::LicenseChangeMii::OnMiiApprove
+805ed45c Pages::LicenseChangeMii::OnMiiDisapprove
+805ed468 Pages::LicenseChangeMii::OnMessageBoxClick
+805ed4ec Pages::LicenseSettings::__ct
+805ed70c Pages::LicenseSettings::__dt
+805ed7e4 Pages::LicenseSettings::OnInit
+805edbf8 Pages::LicenseSettings::OnActivate
+805edc50 Pages::LicenseSettings::OnRecordsButtonClick
+805edc94 Pages::LicenseSettings::OnChangeMiiButtonClick
+805edcd8 Pages::LicenseSettings::OnEraseLicenseButtonClick
+805edd1c Pages::LicenseSettings::OnBackPress
+805edd68 Pages::LicenseSettings::OnSelectButton
+805eddd4 Pages::LicenseSettings::OnBackPress
+805eddf4 Pages::LicenseErase::__ct
+805edf84 Pages::LicenseErase::__dt
+805ee030 Pages::LicenseErase::OnInit
+805ee238 Pages::LicenseErase::OnActivate
+805ee244 Pages::LicenseErase::OnResume
+805ee41c Pages::LicenseErase::GetNextPage
+805ee434 Pages::LicenseErase::OnYesButtonClick
+805ee578 Pages::LicenseErase::OnNoButtonClick
+805ee5cc Pages::LicenseErase::OnBackPress
+805ee5dc Pages::LicenseErase::OnErasedLicense
+805ee624 Pages::LicenseErase::GetRuntimeTypeInfo
+805ee630 Pages::LicenseSettings::GetNextPage
+805ee638 Pages::LicenseSettings::GetRuntimeTypeInfo
+805ee644 Pages::LicenseChangeMii::GetNextPage
+805ee64c Pages::LicenseChangeMii::GetRuntimeTypeInfo
+805ee658 Pages::LicenseSelect::GetNextPage
+805ee660 Pages::LicenseSelect::GetRuntimeTypeInfo
+805ee66c LicenseButton::GetRuntimeTypeInfo
+805ee678 LicenseControl::GetRuntimeTypeInfo
+805ee684 LicenseUI_cpp_sinit_
+805ee6b4 TriggerPtmf
+805ee6e4 TriggerPtmf
+805ee714 TriggerPtmf
+805ee744 TriggerPtmf
+805ee774 TriggerPtmf
+805ee7a4 TriggerPtmf
+805ee7d4 TriggerPtmf
+805ee804 TriggerPtmf
+805ee834 TriggerPtmf
+805ee864 TriggerPtmf
+805ee894 0x805ee894
+805ee8d0 MiiNameMsgPrinter::__ct
+805ee900 MiiNameMsgPrinter::__dt
+805ee958 MiiNameMsgPrinter::Load
+805eea78 MiiNameMsgPrinter::PrintMessage
+805eeb68 ManipulatorManager::__ct
+805eeb8c ManipulatorManager::__dt
+805eebcc ManipulatorManager::Init
+805eec50 ManipulatorManager::UpdatePlayerBitfield2
+805eec58 ManipulatorManager::CheckActions
+805eec5c ManipulatorManager::Activate
+805eece8 ManipulatorManager::OnLoad
+805eed70 ManipulatorManager::Load
+805eed84 ManipulatorManager::OnReset
+805eed98 ManipulatorManager::Update
+805eee0c ManipulatorManager::GetControllerHolder
+805eee24 ButtonInfo::__ct
+805eeed0 ButtonInfo::__dt
+805eef10 ButtonInfo::Reset
+805eef20 ButtonInfo::Update
+805ef138 ButtonInfo::Init
+805ef1bc 0x805ef1bc
+805ef240 PageManipulatorManager::__ct
+805ef2fc PageManipulatorManager::__dt
+805ef364 PageManipulatorManager::Init
+805ef43c PageManipulatorManager::CheckActions
+805ef5a8 PageManipulatorManager::Activate
+805ef688 PageManipulatorManager::OnReset
+805ef768 PageManipulatorManager::SetGlobalHandler
+805ef780 ControlButtonInfo::__ct
+805ef848 ControlButtonInfo::__dt
+805ef888 ControlButtonInfo::Reset
+805ef898 ControlButtonInfo::Update
+805ef958 ControlButtonInfo::Init
+805ef9ec ControlButtonInfo::LockNonDirectionalActions
+805efa70 ControlButtonInfo::IsADirectionHeldForMultipleOf15
+805efadc ControlButtonInfo::GetFramesOnCurControl
+805efaf8 ControlManipulator::__ct
+805efbd4 ControlManipulator::__dt
+805efc40 0x805efc40
+805efc48 ControlManipulator::Init
+805efcf8 ControlManipulator::SetAction
+805efd10 0x805efd10
+805efd14 ControlManipulator::SetEnabledHudSlots
+805efd1c 0x805efd1c
+805efdc8 ControlManipulator::HasDirectionalHandler
+805efe40 ControlManipulator::TriggerAction
+805efe94 0x805efe94
+805efef4 ControlManipulator::Load
+805f0040 ControlManipulator::Update
+805f03dc ControlManipulator::GetHudColor
+805f0440 ControlManipulator::GetHudSlotIdColor
+805f04d8 ControlManipulator::GetHudSlotIdColorSingle
+805f058c ControlBoundingBox::__ct
+805f05cc ControlBoundingBox::__dt
+805f060c 0x805f060c
+805f0614 0x805f0614
+805f0618 ControlBoundingBox::CalculateBounds
+805f08a0 ControlBoundingBox::TriggerOnSelectHandler
+805f08f0 ControlBoundingBox::TriggerOnDeselectHandler
+805f0940 0x805f0940
+805f09a8 ControlsManipulatorManager::__ct
+805f0a98 ControlManipulatorHolder::__ct
+805f0b94 ControlManipulatorHolder::__dt
+805f0bd4 ControlsManipulatorManager::__dt
+805f0c48 ControlsManipulatorManager::Init
+805f0d38 ControlManipulator::CalcDistanceBothWrapping
+805f0d44 ControlsManipulatorManager::AddControlManipulator
+805f0d84 ControlsManipulatorManager::SetGlobalHandler
+805f0da0 ControlsManipulatorManager::SetControlManipulator
+805f0db4 ControlsManipulatorManager::SetDistanceFunc
+805f0e18 ControlManipulator::CalcDistanceVerticalWrappingOnly
+805f0e24 ControlManipulator::CalcDistanceNoWrapping
+805f0e30 ControlsManipulatorManager::GetHolderList
+805f0e94 ControlsManipulatorManager::CheckActions
+805f1bc0 ControlsManipulatorManager::Activate
+805f1cf4 ControlsManipulatorManager::OnLoad
+805f1e14 ControlsManipulatorManager::OnReset
+805f1f3c ControlsManipulatorManager::OnActivate
+805f1f40 ControlsManipulatorManager::Update
+805f20ec ControlsManipulatorManager::SetChildControlManipulator
+805f2100 ControlsManipulatorManager::InitHolders
+805f2134 ControlsManipulatorManager::IsActionAllowed
+805f216c ControlsManipulatorManager::HasDirectionalGlobalHandler
+805f21e4 ControlsManipulatorManager::Func_805f21e4
+805f226c ControlsManipulatorManager::Func_805f226c
+805f22d4 ControlsManipulatorManager::CheckPlayerPointer
+805f2384 ControlManipulator::CalcDistance
+805f244c ControlManipulator::CalcDistance_Switch
+805f2450 ControlManipulator::CalcDistance_Case_1
+805f26a4 ControlManipulator::CalcDistance_Case_5
+805f292c ControlManipulator::CalcDistance_Case_0
+805f2948 ControlManipulator::CalcDistanceLinear
+805f2ae8 ControlManipulator::CalcDistanceLinear_Switch
+805f2aec ControlManipulator::CalcDistanceLinear_case_1
+805f2b3c ControlManipulator::CalcDistanceLinear_case_4
+805f2b8c ControlManipulator::CalcDistanceLinear_case_5
+805f2bec ControlManipulator::CalcDistanceLinear_case_6
+805f2c4c ControlManipulator::CalcDistanceLinear_case_0
+805f2c64 0x805f2c64
+805f2cd4 ControlsManipulatorManager:IsWiimoteCursorEnabled
+805f2cdc ControlsManipulatorManager::GetRuntimeTypeInfo
+805f2ce8 ManipulatorManager::IsPointerEnabled
+805f2cf0 ManipulatorManager::OnActivate
+805f2cf4 ManipulatorManager::GetHolderList
+805f2cf8 PageManipulatorManager::GetRuntimeTypeInfo
+805f2d04 0x805f2d04
+805f2d24 BackGroundModelControl::GetClassName
+805f2d30 BackGroundModelControl::__ct
+805f2d6c BackGroundModelControl::__dt
+805f2dc4 BackGroundModelControl::Load
+805f2e84 BackGroundModelControl::RequestModel
+805f2ea4 BackGroundModelControl::InitSelf
+805f2ea8 BackGroundModelControl::OnUpdate
+805f3238 DriverModelControl::GetClassName
+805f3248 DriverModelControl::__ct
+805f3284 DriverModelControl::__dt
+805f32dc DriverModelControl::Load
+805f346c DriverModelControl::SetAnimationType
+805f3494 DriverModelControl::RequestModel
+805f3568 DriverModelControl::InitSelf
+805f356c DriverModelControl::OnUpdate
+805f37e4 DriverModelControl::SetPositionAnim
+805f3830 DriverModelControl::SetModelPositionOnAnim
+805f39ac VehicleModelControl::GetClassName
+805f39bc VehicleModelControl::__ct
+805f39f8 VehicleModelControl::__dt
+805f3a50 VehicleModelControl::Load
+805f3b98 VehicleModelControl::SetAnimationType
+805f3bc4 VehicleModelControl::RequestNewModel
+805f3c8c VehicleModelControl::InitSelf
+805f3cf8 VehicleModelControl::OnUpdate
+805f40a4 VehicleModelControl::SetPositionAnim
+805f4110 VehicleModelControl::SetModelPositionOnAnim
+805f42a4 NoteModelControl::GetClassName
+805f42b4 NoteModelControl::__ct
+805f42f0 NoteModelControl::__dt
+805f4348 NoteModelControl::Load
+805f44a0 NoteModelControl::SetAnimationType
+805f44c0 NoteModelControl::InitSelf
+805f45f8 NoteModelControl::OnUpdate
+805f4cfc NoteModelControl::SetPositionAnim
+805f4e4c NoteModelControl::SetModelPositionOnAnim
+805f4f7c NoteModelControl::GetRuntimeTypeInfo
+805f4f88 VehicleModelControl::GetRuntimeTypeInfo
+805f4f94 DriverModelControl::GetRuntimeTypeInfo
+805f4fa0 BackGroundModelControl::GetRuntimeTypeInfo
+805f4fac ModelControl_cpp_sinit_
+805f4fd0 Pages::ModelRenderer::__ct
+805f51c8 Pages::ModelRenderer::__dt
+805f5230 Pages::ModelRenderer::OnInit
+805f5504 Pages::ModelRenderer::OnDispose
+805f5520 Pages::ModelRenderer::OnActivate
+805f56d4 Pages::ModelRenderer::BeforeEntranceAnimations
+805f56d8 Pages::ModelRenderer::BeforeExitAnimations
+805f56dc Pages::ModelRenderer::BeforeControlUpdate
+805f56e0 Pages::ModelRenderer::RequestCharacterModel
+805f570c Pages::ModelRenderer::LoadKartModelsByCharacter
+805f57b8 0x805f57b8
+805f5958 Pages::ModelRenderer::RequestKartModel
+805f5984 Pages::ModelRenderer::RequestBackgroundModel
+805f59ac 0x805f59ac
+805f5a30 Pages::ModelRenderer::SetBackgroundModelVisibility
+805f5a4c Pages::ModelRenderer::GetModelTexObj
+805f5a70 Pages::ModelRenderer::GetBackgroundModelTexObj
+805f5a98 Pages::ModelRenderer::GetVariantType
+805f5c94 Pages::ModelRenderer::PrepareParams
+805f5d58 Pages::ModelRenderer::GetModelCount
+805f5e28 ModelRendererParams::Reset
+805f5e44 0x805f5e44
+805f5fa4 ModelValuesHolder::GetValues
+805f5fdc Pages::ModelRenderer::GetRuntimeTypeInfo
+805f5fe8 ModelRendererPage_cpp_sinit_
+805f5ffc ModelRendererValuesHolder::Init
+805f8b24 ModelRendererValues::SetValues
+805f8b34 BMGHolder::__ct
+805f8b50 BMGHolder::__dt
+805f8b90 BMGHolder::Load
+805f8c00 BMGHolder::Init
+805f8c88 BMGHolder::GetMsgId
+805f8cf0 BMGHolder::GetMessageById
+805f8d2c BMGHolder::GetFontIndex
+805f8d5c Pages::Click::__ct
+805f8de0 Pages::Click::__dt
+805f8e48 Pages::Click::OnInit
+805f8eb8 Pages::Click:::OnLoad
+805f8edc Pages::Click::AfterControlUpdate
+805f8f40 Pages::Click::Reset
+805f8f54 Pages::Click::OnClick
+805f8fac Pages::MessageBoxTransparent::__ct
+805f9054 Pages::MessageBoxTransparent::__dt
+805f90e8 Pages::MessageBoxTransparent::OnInit
+805f9224 Pages::MessageBoxTransparent::Reset
+805f9244 Pages::MessageBoxTransparent::SetMessageWindowText
+805f924c Pages::MessageBoxTransparent::BeforeEntranceAnimations
+805f9290 Pages::MessageBox::AfterExitAnimations
+805f92d4 Pages::MessageBoxTransparent::SetButtonImage
+805f931c Pages::MessageBox::__ct
+805f93dc Pages::MessageBox::__dt
+805f9474 Pages::MessageBox::OnInit
+805f95c0 Pages::MessageBox::Reset
+805f9620 Pages::MessageBox::SetTitleText
+805f9628 Pages::MessageBox::SetMessageWindowText
+805f9630 Pages::MessageBox::SetButtonImage
+805f9678 Pages::MessageBox::GetNextPage
+805f9680 Pages::MessageBox::GetRuntimeTypeInfo
+805f968c Pages::MessageBoxTransparent::GetRuntimeTypeInfo
+805f9698 Pages::Click::GetRuntimeTypeInfo
+805f96a4 Pages::Click::TriggerPtmf
+805f96d4 MessagePagecpp_sinit_
+805f96f4 MessageWindowControl::GetClassName
+805f9700 MessageWindowControl::__ct
+805f973c MessageWindowControl::__dt
+805f9794 MessageWindowControl::Load
+805f9810 MessageWindowControlScaleFade::GetClassName
+805f9820 MessageWindowControlScaleFade::__ct
+805f985c MessageWindowControlScaleFade::__dt
+805f98b8 MessageWindowControlScaleFade::SetPositionAnim
+805f98f0 0x805f98f0
+805f98f4 SimpleMessageWindowControl::GetClassName
+805f9900 SimpleMessageWindowControl::__ct
+805f993c SimpleMessageWindowControl::__dt
+805f9994 SimpleMessageWindowControl::Load
+805f9a48 SimpleMessageWindowControl::InitSelf
+805f9aac BlackBackControlForMessage::GetClassName
+805f9abc BlackBackControlForMessage::__ct
+805f9af8 BlackBackControlForMessage::__dt
+805f9b50 BlackBackControlForMessage::Load
+805f9bc4 BlackBackControlForMessage::SetPositionAnim
+805f9c24 BusySymbol::GetClassName
+805f9c34 BusySymbol::__ct
+805f9c70 BusySymbol::__dt
+805f9cc8 BusySymbol::Load
+805f9d5c BusySymbol::InitSelf
+805f9d94 BusySymbol::SetPositionAnim
+805f9df4 BusySymbol::OnUpdate
+805f9e10 BusySymbol::GetRuntimeTypeInfo
+805f9e1c BlackBackControlForMessage::GetRuntimeTypeInfo
+805f9e28 SimpleMessageWindowControl::GetRuntimeTypeInfo
+805f9e34 MessageWindowControlScaleFade::GetRuntimeTypeInfo
+805f9e40 MessageWindowControl::GetRuntimeTypeInfo
+805f9e4c 0x805f9e4c
+805f9e78 MiiGroup::__ct
+805f9f18 MiiCreationParams2::__dt
+805f9f58 MiiGroup::__dt
+805fa04c MiiGroup::Init
+805fa370 MiiGroup::Reset
+805fa3c4 MiiGroup::ResetCreationParams
+805fa3fc MiiGroup::AddMii
+805fa580 MiiGroup::LoadMiddleDB2Mii
+805fa610 MiiGroup::LoadMii(RFLStoreData)
+805fa678 MiiGroup::LoadOfficialMii
+805fa6e0 MiiGroup::LoadStoreMii
+805fa748 MiiGroup::LoadDefaultMii
+805fa7b0 0x805fa7b0
+805fa8b8 MiiGroup::ReplaceMiiByPlayerMii
+805fa930 MiiGroup::GetMii
+805fa940 0x805fa940
+805fa964 MiiGroup::GetMiiTexObj
+805fa97c MiiGroup::HasAllMiiTexObjs
+805faa84 MiiGroup::DeleteMii
+805faba8 0x805faba8
+805fabf4 MiiGroup::CopyMii
+805faf34 MiiGroup::CopyMiiToOtherGroup
+805fb38c 0x805fb38c
+805fb4cc 0x805fb4cc
+805fb504 0x805fb504
+805fb53c 0x805fb53c
+805fb558 0x805fb558
+805fb5b8 0x805fb5b8
+805fb5bc Pages::BackModel::__ct
+805fb610 Pages::BackModel::__dt
+805fb690 Pages::BackModel::OnInit
+805fb7ac Pages::BackModel::OnInit_switch
+805fb7b0 Pages::BackModel::OnInit_case_60
+805fb7c0 Pages::BackModel::OnInit_case_49
+805fb7d0 Pages::BackModel::OnInit_case_4b
+805fb7e0 Pages::BackModel::OnInit_case_4c
+805fb7ec Pages::BackModel::OnInit_case_4d
+805fb800 Pages::BackModel::GetRuntimeTypeInfo
+805fb80c BackModelPage_cpp_sinit_
+805fb820 MoviePaneHandler::__ct
+805fb850 MoviePaneHandler::__dt
+805fb890 MoviePaneHandler::Init
+805fb99c MoviePaneHandler::Crop(Rect*)
+805fba68 MoviePaneHandler::Crop(4floats)
+805fbb60 MoviePaneHandler::Draw
+805fcd40 MoviePlayer::__ct
+805fcd90 MoviePlayer::__dt
+805fcde8 MoviePlayer::Init
+805fcdec MoviePlayer::Quit
+805fce7c MoviePlayer::Update
+805fd0a8 MoviePlayer::Prepare
+805fd31c 0x805fd31c
+805fd398 MoviePlayer::Close
+805fd3e0 MoviePlayer::GetCurTHPTextureInfo
+805fd3fc MoviePlayer::IsPlaying
+805fd438 MoviePlayer::Pause
+805fd454 MoviePlayer::Play
+805fd470 MoviePlayer::GetCurTextureIdx
+805fd478 MoviePlayer::Reprepare
+805fd4c4 0x805fd4c4
+805fd518 Pages::Options::__ct
+805fd638 Pages::Options::__dt
+805fd6e4 Pages::Options::OnInit
+805fd8e4 Pages::Options::OnDispose
+805fd8e8 Pages::Options::OnActivate
+805fd90c Pages::Options::OnButtonClick
+805fda80 Pages::Options::OnBackPress
+805fdaa8 Pages::WifiOptions::__ct
+805fdbd8 Pages::WifiOptions::__dt
+805fdc9c Pages::WifiOptions::OnInit
+805fdf34 Pages::WifiOptions::OnActivate
+805fdf58 Pages::WifiOptions::OnButtonClick
+805fe110 Pages::WifiOptions::OnBackPress
+805fe128 Pages::OptionExplanation::__ct
+805fe240 Pages::OptionExplanation::__dt
+805fe2e0 Pages::OptionExplanation::OnInit
+805fe460 Pages::OptionExplanation::OnActivate
+805fe48c Pages::OptionExplanation::OnButtonClick
+805fe57c Pages::OptionExplanation::OnBackPress
+805fe5f8 Pages::OptionChoice::__ct
+805fe728 Pages::OptionChoice::__dt
+805fe7d4 Pages::OptionChoice::OnInit
+805fea58 Pages::OptionChoice::OnActivate
+805fea88 Pages::OptionChoice::OnResume
+805feb60 Pages::OptionChoice::SetTitleText
+805feb6c Pages::OptionChoice::SetMessageWindowText
+805feb78 Pages::OptionChoice::SetButtonText
+805febdc Pages::OptionChoice::SetInitialButton
+805febe4 Pages::OptionChoice::OnButtonClick
+805fed8c Pages::OptionChoice::OnBackPress
+805feda4 Pages::RegionOptions::__ct
+805feefc Pages::RegionOptions::__dt
+805fef9c Pages::RegionOptions::OnInit
+805ff128 Pages::RegionOptions::OnActivate
+805ff134 Pages::RegionOptions::GetNextPage
+805ff194 Pages::RegionOptions::OnButtonClick
+805ff1e0 Pages::RegionOptions::OnBackButtonClick
+805ff2a0 Pages::RegionOptions::OnBackPress
+805ff328 Pages::MasterOptions::__ct
+805ff3a4 Pages::MasterOptions::__dt
+805ff40c Pages::MasterOptions::OnInit
+805ff478 Pages::MasterOptions::OnActivate
+805ff4d8 Pages::MasterOptions::BeforeEntranceAnimations
+805ff4dc Pages::MasterOptions::BeforeExitAnimations
+805ff4e0 Pages::MasterOptions::AfterControlUpdate
+805ff6c4 Pages::MasterOptions::OnResume
+805ff700 Pages::MasterOptions::OnResume_switch
+805ff704 Pages::MasterOptions::OnResume_case0
+805ff8a8 Pages::MasterOptions::OnResume_case1
+805ff948 Pages::MasterOptions::OnResume_case2
+80600038 Pages::MasterOptions::OnResume_case4
+80600060 Pages::MasterOptions::OnResume_case5
+80600068 Pages::MasterOptions::OnResume_case7
+80600090 Pages::MasterOptions::OnResume_case8
+80600098 Pages::MasterOptions::OnResume_case9
+806000a8 Pages::MasterOptions::OnResume_case3
+806000c4 Pages::MasterOptions::SetNextPageType
+80600128 Pages::MasterOptions::LoadOptionFirstExplanation
+806002e4 Pages::MasterOptions::LoadOptionNextExplanation
+806003e0 Pages::MasterOptions::LoadOptionChoice
+8060079c Pages::MasterOptions::LoadOptionWaitingNetwork
+806008cc Pages::MasterOptions::LoadOptionWaiting
+806009fc Pages::MasterOptions::LoadOptionChoiceSaved
+80600dc0 Pages::MasterOptions::LoadOptionChoiceSavedNetwork
+80600e90 Pages::MasterOptions::LoadOptionChoiceSavedNetwork_switch
+80600e94 Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case1
+80600e9c Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case2
+80600ea4 Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case3
+80600eac Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case4
+80600eb4 Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case5
+80600ebc Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case6
+80600ec4 Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case8
+80600ecc Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case9
+80600ed4 Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case7
+80600efc Pages::MasterOptions::LoadOptionChoiceSavedNetwork_case0
+80600f88 Pages::MasterOptions::OnClick
+80601014 Pages::MasterOptions::GetNextPage
+8060101c Pages::MasterOptions::GetRuntimeTypeInfo
+80601028 Pages::RegionOptions::GetRuntimeTypeInfo
+80601034 Pages::OptionChoice::GetRuntimeTypeInfo
+80601040 Pages::OptionExplanation::GetRuntimeTypeInfo
+8060104c Pages::WifiOptions::GetNextPage
+80601054 Pages::WifiOptions::GetRuntimeTypeInfo
+80601060 Pages::Options::GetNextPage
+80601068 Pages::Options::GetRuntimeTypeInfo
+80601074 Pages::RegionOptions::TriggerPtmf
+806010a4 Pages::OptionChoice::TriggerPtmf
+806010d4 Pages::OptionExplanation::TriggerPtmf
+80601104 Pages::WifiOptions::TriggerPtmf
+80601134 Pages::Options::TriggerPtmf
+80601164 Pages::MasterOptions::TriggerPtmf
+80601194 Pages::RegionOptions::TriggerBackPtmf
+806011c4 Pages::OptionChoice::TriggerBackPtmf
+806011f4 Pages::OptionExplanation::TriggerBackPtmf
+80601224 Pages::WifiOptions::TriggerBackPtmf
+80601254 Pages::Options::TriggerBackPtmf
+80601284 Optionscpp_sinit_
+806012b0 PadControl::GetClassName
+806012bc PadControl::__ct
+806012f8 PadControl::__dt
+80601350 PadControl::Load
+80601410 PadControl::InitSelf
+8060147c PadControl::OnUpdate
+80601554 PadControl::SetParams
+80601564 PadControl::SetPadID
+8060156c PadControl::RegisterPad
+806015a4 PadControl::UpdateFromParams
+806016fc 0x806016fc
+8060170c 0x8060170c
+80601748 0x80601748
+806017a4 0x806017a4
+806017d4 RecognizePadWindow::GetClassName
+806017e4 RecognizePadWindow::__ct
+80601820 RecognizePadWindow::__dt
+80601878 RecognizePadWindow::Load
+806018f4 RecognizePadWindow::InitSelf
+806018f8 RecognizePadWindow::OnUpdate
+806018fc RecognizePadWindow::SetPositionAnim
+80601934 RecognizePadWindow::GetRuntimeTypeInfo
+80601940 0x80601940
+8060194c PadControl::GetRuntimeTypeInfo
+80601958 PadControl_sinit_
+8060197c Page::__ct
+80601a04 Page::__dt
+80601a60 Page::Init
+80601ad8 Page::OnInit
+80601adc Page::Dispose
+80601aec Page::Activate
+80601c08 Page::Deactivate
+80601c48 Page::IncrementDuration
+80601c64 Page::CheckActions
+80601d24 Page::UpdateState
+80601f44 Page::Exit
+80602144 Page::Enter
+806022cc Page::UpdateControls
+80602338 Page::Update
+8060235c Page::Draw
+80602378 Page::ResetManipulatorManager
+8060238c 0x8060238c
+80602390 Page::Resume
+80602428 Page::HandleSectionChange
+8060244c Page::SetAnimDirection
+8060245c Page::InitControlGroup
+8060246c Page::AddControl
+80602474 Page::SetManipulatorManager
+8060247c Page::EndState
+80602488 Page::EndStateAnimated
+806024a4 Page::EndExitState
+806024b0 Page::ChangeSectionBySceneChange
+80602530 Page::ChangeSectionByReinit
+806025b0 Page::AddPageLayer
+8060265c Page::AnimateControls
+806027ac Page::ControlAnimator::Calc
+806028cc Pages::System::GetAnimDelay
+80602920 Page::MaxAnimDelayGetter::Calc
+80602960 Page::OnStateChangeAnimator::Calc
+80602970 Page::StartEntrance
+806029f4 Page::EndEntrance
+80602b04 Page::StartExit
+80602c60 Page::EndExit
+80602ce8 Page::80602ce8
+80602cf8 Page::PlaySound
+80602d0c 0x80602d0c
+80602d20 Page::SetTransitionSound
+80602d2c Pages::System::__ct
+80602dc0 Pages::System::__dt
+80602e54 Pages::System::Setup
+80602eec Pages::System::CheckForConditions
+80602ef4 SystemPagecpp_sinit_
+80602f04 Pages::RegisteredPads::__ct
+80602f68 Pages::RegisteredPads::__dt
+80602fe8 Pages::RegisteredPads::OnInit
+806030dc Pages::RegisteredPads::OnActivate
+80603250 Pages::RegisteredPads::BeforeEntranceAnimations
+80603254 Pages::RegisteredPads::AfterEntranceAnimations
+80603258 Pages::RegisteredPads::AfterControlUpdate
+80603304 Pages::RegisteredPads::AfterExitAnimations
+80603308 Pages::RegisteredPads::GetNextPage
+80603350 Pages::RegisteredPads::Register
+806033b8 ConnectController::GetClassName
+806033c8 ConnectController::__ct
+80603404 ConnectController::__dt
+8060345c ConnectController::Load
+806035d8 ConnectController::InitSelf
+80603690 ConnectController::OnUpdate
+80603764 Pages::RegisterPad::__ct
+80603890 CtrlMenuDummyBack::__dt
+806038e8 Pages::RegisterPad::__dt
+806039a4 Pages::RegisterPad::OnInit
+80603b90 Pages::RegisterPad::OnActivate
+80603ba4 Pages::RegisterPad::AfterControlUpdate
+80603f10 Pages::RegisterPad::GetNextPage
+80603f28 Pages::RegisterPad::IsDVDEnabled
+80603f70 Pages::RegisterPad::OnBackPress
+80603fbc Pages::RegisterPad::OnStartPress
+80604074 EasyPairingController::GetClassName
+80604084 EasyPairingController::__ct
+806040c0 EasyPairingController::__dt
+80604118 EasyPairingController::Load
+806042a8 EasyPairingController::InitSelf
+806043b8 EasyPairingController::OnUpdate
+80604518 0x80604518
+80604584 Pages::PairWiimotes::__ct
+80604638 Pages::PairWiimotes::__dt
+806046dc Pages::PairWiimotes::OnInit
+80604940 Pages::PairWiimotes::OnActivate
+806049c0 Pages::PairWiimotes::AfterEntranceAnimations
+806049cc Pages::PairWiimotes::BeforeEntranceAnimations
+806049d8 Pages::PairWiimotes::BeforeExitAnimations
+806049e4 Pages::PairWiimotes::OnDeactivate
+80604a88 Pages::PairWiimotes::AfterControlUpdate
+80604b00 Pages::PairWiimotes::SyncWiimotes
+80604c84 Pages::PairWiimotes::OnBackAndStartPress
+80604cd8 Pages::ConfirmPads::__ct
+80604ea0 Pages::ConfirmPads::__dt
+80604f50 Pages::ConfirmPads::OnInit
+80605198 Pages::ConfirmPads::OnActivate
+806051e4 Pages::ConfirmPads::OnDeactivate
+80605204 Pages::ConfirmPads::OnOkButtonClick
+80605260 Pages::ConfirmPads::OnChangeButtonClick
+80605340 Pages::ConfirmPads::OnBackButtonClick
+80605470 Pages::ConfirmPads::OnButtonSelect
+806054c4 Pages::ConfirmPads::OnBackPress
+806055cc Pages::ConfirmPads::GetNextPage
+806055d4 Pages::ConfirmPads::GetRuntimeTypeInfo
+806055e0 Pages::PairWiimotes::GetRuntimeTypeInfo
+806055ec EasyPairingController::GetRuntimeTypeInfo
+806055f8 Pages::RegisterPad::IsHomeMenuWorking
+80605600 Pages::RegisterPad::GetRuntimeTypeInfo
+8060560c ConnectController::GetRuntimeTypeInfo
+80605618 Pages::RegisterPad::GetRuntimeTypeInfo
+80605624 TriggerPtmf
+80605654 TriggerPtmf
+80605684 TriggerPtmf
+806056b4 TriggerPtmf
+806056e4 RegisterPadPage_cpp_sinit_
+80605718 RadioButtonControl::GetClassName
+80605724 RadioButtonControl::__ct
+806058c8 RadioButtonControl::__dt
+8060594c RadioButtonControl::Load
+80605d50 RadioButtonControl::OnLoadingEnd
+80605d54 RadioButtonControl::SetOnClickHandler
+80605d5c RadioButtonControl::SetOnSelectHandler
+80605d64 RadioButtonControl::SetOnDeselectHandler
+80605d6c RadioButtonControl::SetOnChangeHandler
+80605d74 RadioButtonControl::SelectInitialButton
+80605dfc 0x80605dfc
+80605e1c 0x80605e1c
+80605eb4 0x80605eb4
+80605f24 RadioButtonControl::Init
+80606100 RadioButtonControl::Update
+806062d8 RadioButtonControl::HandleSelect
+80606434 RadioButtonControl::HandleDeselect
+80606568 RadioButtonControl::HandleButtonSelect
+80606620 RadioButtonControl::HandleClick
+806066d4 RadioButtonControl::HandleRightPress
+80606790 RadioButtonControl::HandleLeftPress
+80606848 RadioButtonControl::OptionButton::GetClassName
+80606858 RadioButtonControl::OptionButton::__ct
+80606894 RadioButtonControl::OptionButton::__dt
+806068ec RadioButtonControl::OptionButton::Load
+80606994 RadioButtonControl::OptionButton::Init
+80606a14 RadioButtonControl::OptionButton::Update
+80606ad0 RadioButtonControl::OptionButton::GetParentControl
+80606bd0 GetInstanceUnusedControl?
+80606bdc GetInstanceUnusedControl?
+80606be8 0x80606be8
+80606c48 RadioButtonControl::OptionButton::ToggleChose
+80606dc4 0x80606dc4
+80606e24 RadioButtonControl::OptionButton::ToggleSelect
+80606f88 RadioButtonControl::OptionButton::SetBorderColours
+8060703c RadioButtonControl::OptionButton::SetColor_BaseColours
+806070e4 RadioButtonControl::Func_0x40
+806070e8 RadioButtonControl::GetRuntimeTypeInfo
+806070f4 RadioButtonControl::OptionButton::GetRuntimeTypeInfo
+80607100 RadioButtonControl_cpp_sinit_
+80607130 RadioButtonControl_cpp_sinit_
+8060714c RandomMatchingPlayer::GetClassName
+80607158 RandomMatchingPlayer::__ct
+806071cc RandomMatchingPlayer::__dt
+80607224 RandomMatchingPlayer::Load
+80607368 RandomMatchingPlayer::InitSelf
+806074c0 RandomMatchingPlayer::OnUpdate
+80607730 0x80607730
+8060786c 0x8060786c
+80607924 0x80607924
+806079bc 0x806079bc
+80607b40 0x80607b40
+80607b58 RandomMatchingPlayer::SetMii
+80607be4 RandomMatchingPlayer::IsShowing
+80607c1c RandomMatchingPlayer::OnMiiShowing
+80607cdc RandomMatchingPlayer::CalcAngle
+80607d2c 0x80607d2c
+80607d88 MatchingMessageWindow::GetClassName
+80607d98 MatchingMessageWindow::__ct
+80607dd4 MatchingMessageWindow::__dt
+80607e2c MatchingMessageWindow::Load
+80607e90 MatchingMessageWindow::InitSelf
+80607ef4 MatchingMessageWindow::OnUpdate
+80607ef8 MatchingMessageWindow::SetMessage
+80607fb0 MatchingMessageWindow::Hide
+80608060 Pages::GlobeSearch::__ct
+80608194 Pages::GlobeSearch::__dt
+80608268 Pages::GlobeSearch::OnInit
+80608494 Pages::GlobeSearch::OnActivate
+80608d18 Pages::GlobeSearch::BeforeEntranceAnimations
+80608d1c Pages::GlobeSearch::BeforeExitAnimations
+80608d6c Pages::GlobeSearch::BeforeControlUpdate
+806092c0 Pages::GlobeSearch::AfterControlUpdate
+80609a30 Pages::GlobeSearch::OnResume
+80609cb8 0x80609cb8
+80609cf8 0x80609cf8
+80609e84 Pages::GlobeSearch::PrepareLiveView
+8060a40c 0x8060a40c
+8060a658 0x8060a658
+8060a670 Pages::GlobeSearch::GetNextPage
+8060a678 Pages::GlobeSearch::IsHomeMenuWorking
+8060a680 Pages::GlobeSearch::GetRuntimeTypeInfo
+8060a68c MatchingMessageWindow::GetRuntimeTypeInfo
+8060a698 RandomMatchingPlayer::GetRuntimeTypeInfo
+8060a6a4 TriggerPtmf
+8060a6d4 TriggerPtmf
+8060a704 __sinit_RandomMatchingPage_cpp
+8060a72c RankingDetailItem_getTypeName
+8060a738 RankingDetailItem_ct
+8060a774 RankingDetailPage_dt
+8060a7cc 0x8060a7cc
+8060a8f0 0x8060a8f0
+8060a928 0x8060a928
+8060aad4 0x8060aad4
+8060ad38 RankingDetailPage_ct
+8060ae60 0x8060ae60
+8060af14 0x8060af14
+8060b1b8 0x8060b1b8
+8060b1fc 0x8060b1fc
+8060b200 0x8060b200
+8060b308 0x8060b308
+8060b5ec 0x8060b5ec
+8060b610 0x8060b610
+8060b650 0x8060b650
+8060b73c 0x8060b73c
+8060b79c 0x8060b79c
+8060b82c 0x8060b82c
+8060bb58 0x8060bb58
+8060bcdc 0x8060bcdc
+8060bd18 0x8060bd18
+8060bd28 0x8060bd28
+8060bd8c 0x8060bd8c
+8060bdb0 0x8060bdb0
+8060bdf0 0x8060bdf0
+8060be58 0x8060be58
+8060bee0 0x8060bee0
+8060bf90 0x8060bf90
+8060c0dc 0x8060c0dc
+8060c234 0x8060c234
+8060c50c 0x8060c50c
+8060c53c 0x8060c53c
+8060c548 0x8060c548
+8060c7a4 0x8060c7a4
+8060cbbc 0x8060cbbc
+8060cf6c 0x8060cf6c
+8060d084 0x8060d084
+8060d1e8 0x8060d1e8
+8060d1f4 0x8060d1f4
+8060d200 0x8060d200
+8060d20c TriggerPtmf
+8060d23c TriggerPtmf
+8060d26c 0x8060d26c
+8060d294 0x8060d294
+8060d40c 0x8060d40c
+8060d4b4 0x8060d4b4
+8060d694 0x8060d694
+8060d6a8 0x8060d6a8
+8060d6ac 0x8060d6ac
+8060d7ac 0x8060d7ac
+8060d800 0x8060d800
+8060d9f4 0x8060d9f4
+8060da38 0x8060da38
+8060da50 0x8060da50
+8060dc20 0x8060dc20
+8060dca4 0x8060dca4
+8060dd0c 0x8060dd0c
+8060dd78 0x8060dd78
+8060dd88 0x8060dd88
+8060dd94 0x8060dd94
+8060dd9c 0x8060dd9c
+8060e564 0x8060e564
+8060e59c 0x8060e564_switch
+8060e5a0 0x8060e564_caseD_0
+8060e5a8 0x8060e564_caseD_1
+8060e74c 0x8060e564_caseD_2
+8060e820 0x8060e564_caseD_3
+8060e8cc 0x8060e564_caseD_4
+8060e8d4 0x8060e564_caseD_5
+8060e9b8 0x8060e564_caseD_6
+8060eb0c 0x8060e564_caseD_7
+8060ec00 0x8060e564_caseD_8
+8060ee50 0x8060e564_caseD_b
+8060ee58 0x8060e564_caseD_c
+8060ee60 0x8060e564_caseD_d
+8060ef2c 0x8060e564_caseD_10
+8060ef44 0x8060e564_caseD_9
+8060ef5c 0x8060ef5c
+80610480 0x80610480
+8061055c 0x8061055c
+80610668 0x80610668
+80610794 0x80610794
+80610d68 0x80610d68
+806111a0 0x806111a0
+806112a4 0x806112a4
+806113bc 0x806113bc
+8061157c 0x8061157c
+8061164c 0x8061157c_switch
+80611650 0x8061157c_caseD_1
+80611658 0x8061157c_caseD_2
+80611660 0x8061157c_caseD_3
+80611668 0x8061157c_caseD_4
+80611670 0x8061157c_caseD_5
+80611678 0x8061157c_caseD_6
+80611680 0x8061157c_caseD_8
+80611688 0x8061157c_caseD_9
+80611690 0x8061157c_caseD_7
+806116c0 0x8061157c_caseD_0
+80611734 0x80611734
+806117a0 0x806117a0
+806117a8 0x806117a8
+806117b4 0x806117b4
+806117c0 TriggerPtmf
+806117f0 TriggerPtmf
+80611820 TriggerPtmf
+80611850 0x80611850
+8061186c RankingGraphControl::GetClassName
+80611878 RankingGraphControl::__ct
+806118f0 RankingGraphControl::__dt
+80611990 RankingGraphControl::LoadAssets
+80611a18 0x80611a18
+80611a3c RankingGraphControl::UpdateImpl
+8061214c 0x8061214c
+806121e8 0x806121e8
+80612260 0x80612260
+806122d8 0x806122d8
+80612320 0x80612320
+80612370 0x80612370
+806123b8 RankingGraphControlTimeAttack::GetClassName
+806123c8 RankingGraphControlTimeAttack::__ct
+8061250c RankingGraphControlTimeAttack::__dt
+8061267c RankingGraphControlTimeAttack::Load
+80612a68 0x80612a68
+80612a8c 0x80612a8c
+80612a90 RankingGraphControlTimeAttack::GetWindow
+80612afc 0x80612afc
+80612c3c RankingGraphControlTimeAttack::DisplayItems
+80612c9c RankingGraphControlTimeAttack::DisableAllItems
+80612dbc RankingGraphControlTimeAttack:: DisplayItemsOnlineRankings
+80613864 0x80613864
+806138a4 RankingGraphControlTimeAttack:: DisplayItemsFriendsRankings
+80613c90 0x80613c90
+80613ca0 0x80613ca0
+80613dc0 0x80613dc0
+80613efc 0x80613efc
+80614224 0x80614224
+80614248 0x80614248
+8061424c 0x8061424c
+80614298 0x80614298
+806142f8 0x806142f8
+806143dc 0x806143dc
+80614c5c 0x80614c5c
+80614ffc 0x80614ffc
+80615008 RankingGraphControlTimeAttack::GetRuntimeTypeInfo
+80615014 RankingGraphControl::GetRuntimeTypeInfo
+80615020 0x80615020
+80615044 0x80615044
+806150b0 0x806150b0
+80615134 0x80615134
+8061525c 0x8061525c
+8061526c 0x8061526c
+806152a8 0x806152a8
+80615300 0x80615300
+80615378 0x80615378
+806153b0 0x806153b0
+806153b4 Pages::RankingGraph::__ct
+80615650 Pages::RankingGraph::__dt
+80615738 Pages::RankingGraph::OnInit
+80615bd8 Pages::RankingGraph::OnDispose
+80615c8c Pages::RankingGraph::OnActivate
+80615e50 0x80615e50
+80615f4c Pages::RankingGraph::OnTAUpDownChange
+80615f68 Pages::RankingGraph::OnTAUpDownClick
+80615fb4 Pages::RankingGraph::OnTATextChange
+80616038 Pages::RankingGraph::OnCompetitionUpDownChange
+80616054 Pages::RankingGraph::OnCompetitionTextChange
+80616180 Pages::RankingGraph::OnRankingTypeUpDownChange
+806162a4 Pages::RankingGraph::OnRankingTypeTextChange
+806162b4 Pages::RankingGraph::OnBackButtonClick
+80616300 Pages::RankingGraph::OnBackPress
+80616320 Pages::RankingGraph::SetBottomText
+80616328 0x80616328
+80616458 0x80616458
+80616538 0x80616538
+806165bc 0x806165bc
+806165cc 0x806165cc
+806165dc 0x806165dc
+80616700 Pages::RankingGraph::GetNextPage
+80616708 Pages::RankingGraph::GetRuntimeTypeInfo
+80616714 0x80616714
+80616720 0x80616720
+8061672c TriggerPtmf
+8061675c TriggerPtmf
+8061678c TriggerPtmf
+806167bc TriggerPtmf
+806167ec TriggerPtmf
+8061681c 0x8061681c
+80616844 0x80616844
+80616994 RankingItem::GetClassName
+806169a0 0x806169a0
+806169f0 RankingItem::__dt
+80616a48 RankingItem::FinishLoad
+80616c24 RankingItem::OnUpdate
+806170b0 0x806170b0
+806170c4 RankingItem::Disable
+806170d8 RankingItem::Enable
+806170ec RankingItem::Appear
+806171f0 RankingItem::MakeAccessible
+806171f4 RankingItem::Disappear
+80617224 0x80617224
+80617280 0x80617280
+806173a8 RankingItemSelectable::GetClassName
+806173b8 RankingItemSelectable::__ct
+806174cc RankingItemSelectable::__dt
+8061753c RankingItemSelectable::Load
+80617580 RankingItemSelectable::Load_switch
+80617584 RankingItemSelectable::Load_caseD_0
+80617594 RankingItemSelectable::Load_caseD_1
+806175a4 RankingItemSelectable::Load_caseD_2
+806175b4 RankingItemSelectable::Load_caseD_3
+806175c4 RankingItemSelectable::Load_caseD_4
+806175d4 RankingItemSelectable::Load_caseD_5
+806175e4 RankingItemSelectable::Load_caseD_6
+806175f4 RankingItemSelectable::Load_caseD_7
+8061799c RankingItemSelectable::InitSelf
+80617a30 RankingItemSelectable::Disable
+80617a4c RankingItemSelectable::Enable
+80617f64 RankingItemSelectable::MakeAccessible
+80617f80 RankingItemSelectable::Disappear
+80617fb8 RankingItemSelectable::vf_0x50
+80617fd4 RankingItemSelectable::vf_0x54
+80617fec RankingItemSelectable::vf_0x58
+80618004 RankingItemSelectable::vf_0x5c
+80618020 RankingItemSelectable::vf_0x60
+806182ec RankingItemSelectable::vf_0x64
+806182f0 RankedItemSelectable::OnSelect
+80618928 RankedItemSelectable::OnSelect_switch
+8061892c RankedItemSelectable::OnSelect_caseD_0
+80618934 RankedItemSelectable::OnSelect_caseD_1
+8061893c RankedItemSelectable::OnSelect_caseD_3
+80618968 RankedItemSelectable::OnSelect_caseD_5
+80618970 RankedItemSelectable::OnSelect_caseD_6
+806189ac RankedItemSelectable::OnSelect_caseD_7
+80618aec RankedItemSelectable::OnDeselect
+80618c50 RankedItemSelectable::OnClick
+80618e94 0x80618e94
+80618ebc 0x80618e94_switch
+80618ec0 0x80618e94_caseD_0
+80618ec8 0x80618e94_caseD_1
+80618ed0 0x80618e94_caseD_2
+80618ed8 0x80618e94_caseD_3
+80618ee0 0x80618e94_caseD_4
+80618ee8 0x80618e94_caseD_5
+80618ef0 0x80618e94_caseD_6
+80618ef8 0x80618e94_caseD_7
+80618f1c RankingItemStranger::GetClassName
+80618f2c RankingItemStranger::__ct
+80618f88 RankingItemStranger::__dt
+80618fe4 RankingItemStranger::Load
+8061907c RankingItemStranger::Enable
+806190ac RankingItemStranger::vf_0x50
+806190c8 RankingItemStranger::vf_0x54
+806190e0 RankingItemStranger::vf_0x58
+806190f8 RankingItemStranger::vf_0x5c
+806190fc RankingItemStranger::vf_0x60
+80619100 RankingItemStranger::vf_0x64
+80619104 RankingRuler::GetClassName
+80619114 RankingRuler::__ct
+80619150 RankingRuler::__dt
+806191a8 RankingRuler::Load
+8061921c RankingRuler::InitSelf
+80619228 0x80619228
+8061936c 0x8061936c
+80619418 0x80619418
+80619424 RankingWindow::GetClassName
+80619434 RankingWindow::__ct
+80619470 RankingWindow::__dt
+806194c8 0x806194c8
+80619638 RankingWindow::InitSelf
+80619644 RankingWindow::OnUpdate
+806196c4 0x806196c4
+806196d0 0x806196d0
+806198fc RankingWindow::GetRuntimeTypeInfo
+80619908 RankingRuler::GetRuntimeTypeInfo
+80619914 RankingItemStranger::GetRuntimeTypeInfo
+80619920 RankingItemSelectable::GetRuntimeTypeInfo
+8061992c RankingItem::GetRuntimeTypeInfo
+80619938 TriggerPtmf
+80619968 0x80619968
+806199bc 0x806199bc
+806199fc 0x806199fc
+80619a58 0x80619a58
+80619a68 0x80619a68
+80619c50 GLMeshWriterCore_ColourPlat
+80619c70 0x80619c70
+80619cbc 0x80619cbc
+80619f5c 0x80619f5c
+80619f78 0x80619f78
+80619fe8 0x80619fe8
+8061a23c 0x8061a23c
+8061a2bc 0x8061a2bc
+8061a32c 0x8061a32c
+8061a41c 0x8061a41c
+8061a464 0x8061a464
+8061a504 0x8061a504
+8061a5a4 0x8061a5a4
+8061a5f0 0x8061a5f0
+8061a650 0x8061a650
+8061a878 0x8061a878
+8061ab1c 0x8061ab1c
+8061aba0 0x8061aba0
+8061abec 0x8061abec
+8061ac4c 0x8061ac4c
+8061adfc 0x8061adfc
+8061ae6c SectionPad::__ct
+8061ae7c SectionPad::__dt
+8061aebc SectionPad::Init
+8061af20 SectionPad::Update
+8061b338 SectionPad::ResetPadsStatusAndSet0x54
+8061b358 SectionPad::GetCurrentID
+8061b378 SectionPad::GetNewID
+8061b398 SectionPad::GetControllerHolder
+8061b3cc SectionPad::HasAController
+8061b420 SectionPad::SetDriftType
+8061b440 SectionPad::IsDriftAuto
+8061b470 0x8061b470
+8061b490 SectionPad::SetID
+8061b4a8 0x8061b4a8
+8061b5a4 0x8061b5a4
+8061b6ec SectionPad::RequestPad
+8061b7c4 SectionPad::ResetPad
+8061b89c SectionPad::SetPadDisconnected
+8061b8b0 SectionPad::DisconnectPad
+8061b9a0 SectionPad::ResetPadsStatus
+8061b9bc SectionPad::GetFirstDeactivatedPad
+8061ba48 SectionPad::HasControllerChanged
+8061ba80 0x8061ba80
+8061bc54 SectionPad::Has4WiimotePads
+8061bcc8 SectionPad::ResetAllPads
+8061bd14 SectionPad::EnablePointer
+8061bdbc SectionPad::GetControllerHolderByIdx
+8061be40 SectionPad::CalculateID
+8061bfac SectionPad::GetType
+8061bffc Pages::RecognizePad::__ct
+8061c058 Pages::RecognizePad::__dt
+8061c0d8 Pages::RecognizePad::OnInit
+8061c1c0 Pages::RecognizePad::OnActivate
+8061c288 Pages::RecognizePad::OnDeactivate
+8061c2e4 Pages::RecognizePad::AfterControlUpdate
+8061c384 Pages::RecognizePad::BeforeEntranceAnimations
+8061c3c8 Pages::RecognizePad::AfterExitAnimations
+8061c40c Pages::RecognizePad::CheckForConditions
+8061c518 Pages::RecognizePad::IsVisible
+8061c53c Pages::RecognizePadMenu::__ct
+8061c5a4 Pages::RecognizePadMenu::__dt
+8061c628 Pages::RecognizePadMenu::BeforeEntranceAnimations
+8061c720 Pages::RecognizePadMenu::AfterEntranceAnimations
+8061c76c Pages::RecognizePadMenu::BeforeExitAnimations
+8061c780 Pages::RecognizePadMenu::AfterExitAnimations
+8061c7c4 Pages::RecognizePadMenu::BeforeControlUpdate
+8061c86c Pages::RecognizePadMenu::IsDVDEnabled
+8061c880 0x8061c880
+8061c8e8 0x8061c8e8
+8061c96c 0x8061c96c
+8061ca40 0x8061ca40
+8061caa8 0x8061caa8
+8061cb94 0x8061cb94
+8061cbe0 0x8061cbe0
+8061cbf4 0x8061cbf4
+8061cc38 0x8061cc38
+8061cd24 0x8061cd24
+8061cd40 0x8061cd40
+8061cda8 0x8061cda8
+8061ce2c 0x8061ce2c
+8061cf00 0x8061cf00
+8061cfec 0x8061cfec
+8061d038 0x8061d038
+8061d04c 0x8061d04c
+8061d090 0x8061d090
+8061d17c 0x8061d17c
+8061d198 0x8061d198
+8061d1a4 0x8061d1a4
+8061d1b0 0x8061d1b0
+8061d1bc 0x8061d1bc
+8061d1c8 Pages::RecognizePadMenu::GetClassName
+8061d1d4 Pages::RecognizePadMenu::GetRuntimeTypeInfo
+8061d1e0 Pages::RecognizePad::GetRuntimeTypeInfo
+8061d1ec 0x8061d1ec
+8061d214 Pages::RegisteringFriend::__ct
+8061d288 Pages::RegisteringFriend::__dt
+8061d300 Pages::RegisteringFriend::OnInit
+8061d3a8 Pages::RegisteringFriend::OnActivate
+8061d4c8 Pages::RegisteringFriend::BeforeEntranceAnimations
+8061d4cc Pages::RegisteringFriend::BeforeExitAnimations
+8061d4d0 Pages::RegisteringFriend::AfterControlUpdate
+8061d628 Pages::RegisteringFriend::OnResume
+8061dc40 Pages::RegisteringFriend::GetNextPage
+8061dc9c Pages::RegisteringFriend::IsHomeMenuWorking
+8061dcb8 Pages::RegisterFriend::__ct
+8061def0 Pages::RegisterFriend::__dt
+8061dfb4 Pages::RegisterFriend::OnInit
+8061e270 Pages::RegisterFriend::OnActivate
+8061e2e8 0x8061e2e8
+8061e340 0x8061e340
+8061e348 Pages::RegisterFriend::OnDigitClick
+8061e3b4 Pages::RegisterFriend::OnBackSpaceClick
+8061e400 Pages::RegisterFriend::OnOkButtonClick
+8061e6ec Pages::RegisterFriend::OnBackButtonClick
+8061e730 Pages::RegisterFriend::OnOkButtonSelect
+8061e76c Pages::RegisterFriend::OnOkButtonDeselect
+8061e77c Pages::RegisterFriend::OnBackPress
+8061e804 Pages::RegisterFriend::GetRuntimeTypeInfo
+8061e810 Pages::xA5::GetRuntimeTypeInfo
+8061e81c TriggerPtmf
+8061e84c TriggerPtmf
+8061e87c RegisterFriendPage_cpp_sinit_
+8061e898 0x8061e898
+8061e91c 0x8061e91c
+8061e990 0x8061e990
+8061ea10 0x8061ea10
+8061eba8 Page::EndExitState
+8061ebac 0x8061ebac
+8061ebb0 0x8061ebb0
+8061f1cc 0x8061f1cc
+8061f4e4 0x8061f1cc_switch
+8061f4e8 0x8061f1cc_caseD_1
+8061f4f0 0x8061f1cc_caseD_2
+8061f4f8 0x8061f1cc_caseD_3
+8061f500 0x8061f1cc_caseD_4
+8061f508 0x8061f1cc_caseD_5
+8061f510 0x8061f1cc_caseD_6
+8061f518 0x8061f1cc_caseD_8
+8061f520 0x8061f1cc_caseD_9
+8061f528 0x8061f1cc_caseD_7
+8061f550 0x8061f1cc_caseD_0
+8061f5f0 0x8061f5f0
+8061f698 0x8061f698
+8061f6a4 TriggerPtmf
+8061f6d4 0x8061f6d4
+8061f6e8 Pages::CorruptSaveMgr::__ct
+8061f764 Pages::CorruptSaveMgr::__dt
+8061f7cc Pages::CorruptSaveMgr::OnInit
+8061f828 Pages::CorruptSaveMgr::OnActivate
+8061f9b4 Pages::CorruptSaveMgr::AfterControlUpdate
+8061fbec Pages::CorruptSaveMgr::OnResume
+8061fd84 Pages::CorruptSaveMgr::IsHomeMenuWorking
+8061fd9c Pages::CorruptSaveMgr::InitYesNoValues
+8061ff40 0x8061ff40
+8062004c Pages::CorruptSaveMgr::OnReturnToWiiMenuClick
+806200bc Pages::CannotSave::__ct
+80620138 Pages::CannotSave::__dt
+806201a0 Pages::CannotSave::OnInit
+806201fc Pages::CannotSave::OnActivate
+806203a0 Pages::CannotSave::OnYesNoClick
+80620440 Pages::CorruptMemory::__ct
+8062048c Pages::CorruptMemory::__dt
+80620500 Pages::CorruptMemory::OnInit
+806205c4 Pages::CorruptMemory::OnActivate
+80620638 Pages::CorruptMiiData::__ct
+806206c4 Pages::CorruptMiiData::__dt
+80620744 Pages::CorruptMiiData::OnInit
+80620848 Pages::CorruptMiiData::OnActivate
+806208a0 Pages::CorruptMiiData::OnButtonClick
+806208ec Pages::CorruptMiiData::IsHomeMenuWorking
+806208f4 Pages::CorruptMiiData::GetRuntimeTypeInfo
+80620900 Pages::CorruptMemory::IsHomeMenuWorking
+80620908 Pages::CorruptMemory::GetRuntimeTypeInfo
+80620914 Pages::CannotSave::__dt
+8062091c Pages::CannotSave::GetRuntimeTypeInfo
+80620928 Pages::CorruptSaveMgr::GetRuntimeTypeInfo
+80620934 TriggerPtmf
+80620964 TriggerPtmf
+80620994 TriggerPtmf
+806209c4 CorruptPages_cpp_sinit_
+806209e8 RKSYSRequester::__ct
+80620a1c 0x80620a1c
+80620a8c RKSYSRequester::__dt
+80620b04 RKSYSRequester::Reset
+80620b40 RKSYSRequester::Update
+80620c5c RKSYSRequester::Init
+80620da4 RKSYSRequester::Close
+80620dd8 RKSYSRequester::HandleRequest
+806211dc RKSYSRequester::HandleAllRequests
+806212fc RKSYSRequester::CheckRequests
+806213a4 RKSYSRequester::HasError
+806213b8 0x806213b8
+806213cc RKSYSRequester::RequestEraseAllGhosts
+806213e4 RKSYSRequester::RequestSaveLicense
+80621410 RKSYSRequester::NotifyNewLicenseContent
+80621434 RKSYSRequester::RequestSaveLicenseIfNewContent
+80621484 RKSYSRequester::RequestSaveGhost
+8062182c RKSYSRequester::RequestSaveGhost_0x18
+80621bd0 RKSYSRequester::RequestEraseGhost
+80621c08 RKSYSRequester::RequestEraseGhostFromLicense
+80621c3c RKSYSRequester::RequestGetDLdGhost
+80621c78 RKSYSRequester::RequestGetGhostFromLicense
+80621cb0 RKSYSRequester::RequestGetGroupGhosts
+80621ce0 RKSYSRequester::RequestGetGroupGhostsFromLicense
+80621d0c Section::__ct
+80621d84 Section::__dt
+80621e00 Section::Init
+806220b0 Section::Enter
+806221d8 Section::Exit
+806223a0 Section::UpdateSystemPages
+806224f8 Section::Update
+80622764 Section::Draw
+80622ae0 Section::Pause
+80622b4c Section::Resume
+80622c08 Section::OnTransition
+80622c68 Section::CreateMoviePlayer
+80622cb8 Section::CreateFriendList
+80622d08 Section::CreateAndInitPage
+80622d54 Section::CreateSystemPage
+80622da0 Section::AddPageLayer
+80622e00 Section::AddPageLayerAnimatedReturnTopLayer
+80622e6c Section::IsPageTopLayer
+80622ea0 Section::GetTopLayerPage
+80622ec8 Section::IsHomeMenuWorking
+80622f88 Section::IsDVDEnabled
+80623054 Section::ScheduleDisconnection
+80623068 Section::UpdateLayers
+80623228 Section::AddPageLayerAnimated
+80623288 Section::TopLayerPage
+806232e8 Section::RemovePageLayers
+80623390 Section::CreatePageById
+806233b8 Section::CreatePageById_switch
+806233bc Section::CreatePageById_case0
+806233d4 Section::CreatePageById_case1
+806233ec Section::CreatePageById_case2
+80623404 Section::CreatePageById_case3
+8062341c Section::CreatePageById_case4
+80623434 Section::CreatePageById_case5
+8062344c Section::CreatePageById_case6
+80623464 Section::CreatePageById_case7
+8062347c Section::CreatePageById_case8
+80623494 Section::CreatePageById_case9
+806234ac Section::CreatePageById_casea
+806234c4 Section::CreatePageById_caseb
+806234dc Section::CreatePageById_casec
+806234f4 Section::CreatePageById_cased
+8062350c Section::CreatePageById_casee
+80623524 Section::CreatePageById_case10
+8062353c Section::CreatePageById_case12
+80623554 Section::CreatePageById_case13
+8062356c Section::CreatePageById_case16
+80623584 Section::CreatePageById_case17
+8062359c Section::CreatePageById_case18
+806235b4 Section::CreatePageById_case19
+806235cc Section::CreatePageById_case1a
+806235e4 Section::CreatePageById_case1b
+806235fc Section::CreatePageById_case1c
+80623614 Section::CreatePageById_case1d
+8062362c Section::CreatePageById_case1e
+80623644 Section::CreatePageById_case1f
+8062365c Section::CreatePageById_case20
+80623674 Section::CreatePageById_case21
+8062368c Section::CreatePageById_case22
+806236a4 Section::CreatePageById_case23
+806236bc Section::CreatePageById_case24
+806236d4 Section::CreatePageById_case25
+806236ec Section::CreatePageById_case26
+80623704 Section::CreatePageById_case27
+8062371c Section::CreatePageById_case28
+80623734 Section::CreatePageById_case29
+8062374c Section::CreatePageById_case2a
+80623764 Section::CreatePageById_case2b
+8062377c Section::CreatePageById_case2c
+80623794 Section::CreatePageById_case2d
+806237ac Section::CreatePageById_case2e
+806237c4 Section::CreatePageById_case2f
+806237dc Section::CreatePageById_case30
+806237f4 Section::CreatePageById_case31
+8062380c Section::CreatePageById_case32
+80623824 Section::CreatePageById_case33
+8062383c Section::CreatePageById_case34
+80623854 Section::CreatePageById_case35
+8062386c Section::CreatePageById_case36
+80623884 Section::CreatePageById_case37
+8062389c Section::CreatePageById_case38
+806238b4 Section::CreatePageById_case39
+806238cc Section::CreatePageById_case3a
+806238e4 Section::CreatePageById_case3b
+806238fc Section::CreatePageById_case3c
+80623914 Section::CreatePageById_case3d
+8062392c Section::CreatePageById_case3e
+80623944 Section::CreatePageById_case3f
+8062395c Section::CreatePageById_case40
+80623974 Section::CreatePageById_case41
+8062398c Section::CreatePageById_case42
+806239a4 Section::CreatePageById_case43
+806239bc Section::CreatePageById_case44
+806239d4 Section::CreatePageById_case45
+806239ec Section::CreatePageById_case46
+80623a04 Section::CreatePageById_case47
+80623a1c Section::CreatePageById_case48
+80623a34 Section::CreatePageById_case49
+80623a4c Section::CreatePageById_case4a
+80623a64 Section::CreatePageById_case4b
+80623a7c Section::CreatePageById_case4c
+80623a94 Section::CreatePageById_case4d
+80623aac Section::CreatePageById_case4e
+80623ac4 Section::CreatePageById_case4f
+80623adc Section::CreatePageById_case51
+80623af4 Section::CreatePageById_case52
+80623b0c Section::CreatePageById_case53
+80623b24 Section::CreatePageById_case54
+80623b3c Section::CreatePageById_case55
+80623b54 Section::CreatePageById_case56
+80623b6c Section::CreatePageById_case57
+80623b84 Section::CreatePageById_case58
+80623b9c Section::CreatePageById_case59
+80623bb4 Section::CreatePageById_case5a
+80623bcc Section::CreatePageById_case5b
+80623be4 Section::CreatePageById_case5c
+80623bfc Section::CreatePageById_case5d
+80623c14 Section::CreatePageById_case5e
+80623c2c Section::CreatePageById_case5f
+80623c44 Section::CreatePageById_case60
+80623c5c Section::CreatePageById_case61
+80623c74 Section::CreatePageById_case62
+80623c8c Section::CreatePageById_case63
+80623ca4 Section::CreatePageById_case64
+80623cbc Section::CreatePageById_case65
+80623cd4 Section::CreatePageById_case66
+80623cec Section::CreatePageById_case67
+80623d04 Section::CreatePageById_case68
+80623d1c Section::CreatePageById_case69
+80623d34 Section::CreatePageById_case6a
+80623d4c Section::CreatePageById_case6b
+80623d64 Section::CreatePageById_case6c
+80623d7c Section::CreatePageById_case6d
+80623d94 Section::CreatePageById_case6e
+80623dac Section::CreatePageById_case6f
+80623dc4 Section::CreatePageById_case70
+80623ddc Section::CreatePageById_case71
+80623df4 Section::CreatePageById_case72
+80623e0c Section::CreatePageById_case73
+80623e24 Section::CreatePageById_case74
+80623e3c Section::CreatePageById_case75
+80623e54 Section::CreatePageById_case76
+80623e6c Section::CreatePageById_case77
+80623e84 Section::CreatePageById_case78
+80623e9c Section::CreatePageById_case79
+80623eb4 Section::CreatePageById_case7a
+80623ecc Section::CreatePageById_case7b
+80623ee4 Section::CreatePageById_case7c
+80623efc Section::CreatePageById_case7d
+80623f14 Section::CreatePageById_case7e
+80623f2c Section::CreatePageById_case7f
+80623f44 Section::CreatePageById_case80
+80623f5c Section::CreatePageById_case81
+80623f74 Section::CreatePageById_case82
+80623f8c Section::CreatePageById_case83
+80623fa4 Section::CreatePageById_case84
+80623fbc Section::CreatePageById_case85
+80623fd4 Section::CreatePageById_case86
+80623fec Section::CreatePageById_case87
+80624004 Section::CreatePageById_case88
+8062401c Section::CreatePageById_case89
+80624034 Section::CreatePageById_case8a
+8062404c Section::CreatePageById_case8b
+80624064 Section::CreatePageById_case8c
+8062407c Section::CreatePageById_case8d
+80624094 Section::CreatePageById_case8e
+806240ac Section::CreatePageById_case8f
+806240c4 Section::CreatePageById_case90
+806240dc Section::CreatePageById_case91
+806240f4 Section::CreatePageById_case92
+8062410c Section::CreatePageById_case93
+80624124 Section::CreatePageById_case94
+8062413c Section::CreatePageById_case95
+80624154 Section::CreatePageById_case96
+8062416c Section::CreatePageById_case97
+80624184 Section::CreatePageById_case98
+8062419c Section::CreatePageById_case99
+806241b4 Section::CreatePageById_case9a
+806241cc Section::CreatePageById_case9b
+806241e4 Section::CreatePageById_case9c
+806241fc Section::CreatePageById_case9d
+80624214 Section::CreatePageById_case9e
+8062422c Section::CreatePageById_case9f
+80624244 Section::CreatePageById_casea0
+8062425c Section::CreatePageById_casea1
+80624274 Section::CreatePageById_casea2
+8062428c Section::CreatePageById_casea3
+806242a4 Section::CreatePageById_casea4
+806242bc Section::CreatePageById_casea5
+806242d4 Section::CreatePageById_casea6
+806242ec Section::CreatePageById_casea7
+80624304 Section::CreatePageById_casea8
+8062431c Section::CreatePageById_caseaa
+80624334 Section::CreatePageById_caseab
+8062434c Section::CreatePageById_caseac
+80624364 Section::CreatePageById_casead
+8062437c Section::CreatePageById_caseae
+80624394 Section::CreatePageById_caseaf
+806243ac Section::CreatePageById_caseb0
+806243c4 Section::CreatePageById_caseb1
+806243dc Section::CreatePageById_caseb2
+806243f4 Section::CreatePageById_caseb3
+8062440c Section::CreatePageById_caseb4
+80624424 Section::CreatePageById_caseb5
+8062443c Section::CreatePageById_caseb6
+80624454 Section::CreatePageById_caseb7
+8062446c Section::CreatePageById_caseb8
+80624484 Section::CreatePageById_caseb9
+8062449c Section::CreatePageById_caseba
+806244b4 Section::CreatePageById_casebb
+806244cc Section::CreatePageById_casebc
+806244e4 Section::CreatePageById_casebd
+806244fc Section::CreatePageById_casebe
+80624514 Section::CreatePageById_casebf
+8062452c Section::CreatePageById_casec0
+80624544 Section::CreatePageById_casec1
+8062455c Section::CreatePageById_casec2
+80624574 Section::CreatePageById_casec3
+8062458c Section::CreatePageById_casec5
+806245a4 Section::CreatePageById_casec6
+806245bc Section::CreatePageById_casec7
+806245d4 Section::CreatePageById_casec8
+806245ec Section::CreatePageById_casec9
+80624604 Section::CreatePageById_caseca
+8062461c Section::CreatePageById_casecb
+80624634 Section::CreatePageById_casecc
+8062464c Section::CreatePageById_casecd
+80624664 Section::CreatePageById_casece
+80624690 Pages::RaceIntro::__ct
+806246e4 Pages::GPHUD::__ct
+80624764 Pages::RaceHUD::__dt
+806247cc Pages::TTHUD::__ct
+80624874 Pages::VSHUD::__ct
+806248f4 Pages::VSMultiHUD::__ct
+80624974 Pages::BattleHUD::__ct
+806249f4 Pages::BattleMultiHUD::__ct
+80624a74 Pages::TournamentHUD::__ct
+80624af4 Pages::GPPause::__ct
+80624b38 Pages::RaceMenu::__dt
+80624ba0 Pages::VSPause::__ct
+80624be4 Pages::TTPause::__ct
+80624c28 Pages::BattlePause::__ct
+80624c6c 0x80624c6c
+80624cb0 0x80624cb0
+80624cf4 0x80624cf4
+80624d38 0x80624d38
+80624d7c Pages::GhostReplayPause::GhostReplayPausePage
+80624dc0 Pages::GPEnd::__ct
+80624e04 Pages::TTEnd::__ct
+80624e48 Pages::VSRaceEnd::VSRaceEndPage
+80624e8c Pages::BattleEnd::__ct
+80624ed0 Pages::BattleFinalRaceEnd::__ct
+80624f14 0x80624f14
+80624f58 0x80624f58
+80624f9c 0x80624f9c
+80624fe0 0x80624fe0
+80625024 Pages::TTFriendGhostEnd::__ct
+80625068 0x80625068
+806250ac Pages::CheckRankings::__ct
+806250f0 Pages::QuitConfirmation::__ct
+80625134 Pages::TTLeaderboard::__ct
+80625198 Pages::Leaderboard::__dt
+80625200 0x80625200
+8062526c Pages::GPVSLeaderboardUpdate::__ct
+806252a8 Pages::GPVSLeaderboardTotal::__ct
+806252e4 Pages::WWLeaderboardUpdate::__ct
+80625320 Pages::TeamVSLeaderboardTotal::__ct
+80625388 CtrlRaceResultTeam::__ct
+806253ec CtrlRaceResultTeam::__dt
+80625460 Pages::TeamVSLeaderboardBase::__dt
+806254e8 Pages::BattleLeaderboardUpdate::__ct
+80625550 Pages::BattleLeaderboardTotal::__ct
+806255b8 0x806255b8
+806255f4 Pages::GPReplayHUD::__ct
+80625674 Pages::GhostRaceHUD::__ct
+806256f4 Pages::GPReplayPause::__ct
+80625738 Pages::TTReplayPause::__ct
+8062577c Pages::WifiVSHUD::__ct
+806257fc Pages::WifiVSMultiHUD::__ct
+8062587c Pages::WiFiFriendVSHUD::__ct
+806258fc Pages::WiFiFriendTeamVSHUD::__ct
+8062597c Pages::LiveViewHUD::__ct
+806259fc Pages::LiveBattleViewHUD::__ct
+80625a7c Pages::StartRace::__ct
+80625d30 Pages::Menu::__dt
+80625d9c Pages::DriftSelect::OnStartPress
+80625da0 Pages::MainMenu::__ct
+80626078 Pages::MenuBG::__ct
+806261e8 Pages::TopMenuOverlay::__ct
+8062635c Pages::MiiSelect::__ct
+80626640 MiiName::__dt
+80626698 Pages::SinglePlayer::__ct
+80626950 Pages::GPClassSelect::__ct
+80626c10 Pages::CharacterSelect::__ct
+80627008 CtrlMenuCharacterSelect::__dt
+80627060 Pages::KartSelect::__ct
+80627338 CtrlMenuMachineGraph::__ct
+80627374 CtrlMenuMachineGraph::__dt
+806273cc Pages::DriftSelect::__ct
+80627684 Pages::CupSelect::__ct
+80627a40 CtrlMenuMovieHandler::__dt
+80627a80 CtrlMenuMovieLayout::__dt
+80627adc CtrlMenuCupSelectCup::__dt
+80627b64 CtrlMenuCupSelectCourse::__dt
+80627bd8 Pages::CourseSelect::__ct
+80627f6c CtrlMenuCourseSelectCupSub::__ct
+80627fa8 CtrlMenuCourseSelectCupSub::__dt
+80628000 CtrlMenuCourseSelectCup::__dt
+80628068 0x80628068
+80628074 CourseButton::__ct
+806280d4 CtrlMenuMovieButton::__dt
+80628130 CourseButton::__dt
+80628190 0x80628190
+80628210 Pages::VSModeSelect::__ct
+806284c8 Pages::VSSettings::VSSetting
+806287e0 Pages::VSTeamsView::__ct
+80628ab4 CtrlMenuTeamConfirmTeam::__ct
+80628b10 CtrlMenuTeamConfirmTeam::__dt
+80628b84 Pages::BattleModeSelect::__ct
+80628e3c Pages::BattleKartSelect::__ct
+8062912c CharaName::__dt
+80629184 Pages::BattleSettings::__ct
+8062949c Pages::BattleCupSelect::__ct
+80629858 CtrlMenuBattleCupSelectCup::__dt
+806298e0 CtrlMenuBattleCupSelectStage::__dt
+80629954 Pages::BattleStageSelect::__ct
+80629ce8 0x80629ce8
+80629d24 0x80629d24
+80629d7c CtrlMenuBattleStageSelectCup::__dt
+80629df0 StageButton::__ct
+80629e50 StageButton::__dt
+80629eb0 CtrlMenuBattleStageSelectStage::__ct
+80629f30 0x80629f30
+8062a2ec 0x8062a2ec
+8062a374 0x8062a374
+8062a3e8 0x8062a3e8
+8062a77c 0x8062a77c
+8062a7b8 0x8062a7b8
+8062a810 0x8062a810
+8062a884 0x8062a884
+8062a8e4 0x8062a8e4
+8062a944 0x8062a944
+8062a9c4 0x8062a9c4
+8062ac9c 0x8062ac9c
+8062af88 0x8062af88
+8062b240 Pages::MultiPlayer::__ct
+8062b4f4 Pages::MultiKartSelect::__ct
+8062b828 MultiKartBox::__ct
+8062b864 MultiKartBox::__dt
+8062b8bc Pages::MultiDriftSelect::__ct
+8062bb70 Pages::MultiTeamSelect::__ct
+8062be24 Pages::Unlock::__ct
+8062c0f4 Pages::LicenseRecords::__ct
+8062c3a4 Section::CreateSectionPages
+8062c3d8 Section::CreateSectionPages_switch
+8062c3dc Section::CreateSectionPages_case6
+8062c3e8 Section::CreateSectionPages_case7
+8062c3f4 Section::CreateSectionPages_case8
+8062c400 Section::CreateSectionPages_case9
+8062c40c Section::CreateSectionPages_casea
+8062c418 Section::CreateSectionPages_caseb
+8062c424 Section::CreateSectionPages_casec
+8062c430 Section::CreateSectionPages_cased
+8062c43c Section::CreateSectionPages_casee
+8062c448 Section::CreateSectionPages_casef
+8062c454 Section::CreateSectionPages_case10
+8062c478 Section::CreateSectionPages_case11
+8062c4a8 Section::CreateSectionPages_case12
+8062c4d8 Section::CreateSectionPages_case13
+8062c4fc Section::CreateSectionPages_case14
+8062c514 Section::CreateSectionPages_case15
+8062c52c Section::CreateSectionPages_case16
+8062c538 Section::CreateSectionPages_case17
+8062c544 Section::CreateSectionPages_case18
+8062c550 Section::CreateSectionPages_case19
+8062c55c Section::CreateSectionPages_case1a
+8062c568 Section::CreateSectionPages_case1b
+8062c574 Section::CreateSectionPages_case1c
+8062c580 Section::CreateSectionPages_case1d
+8062c58c Section::CreateSectionPages_case1e
+8062c5e0 Section::CreateSectionPages_case1f
+8062c64c Section::CreateSectionPages_case20
+8062c694 Section::CreateSectionPages_case21
+8062c6e8 Section::CreateSectionPages_case22
+8062c73c Section::CreateSectionPages_case23
+8062c790 Section::CreateSectionPages_case24
+8062c7d8 Section::CreateSectionPages_case25
+8062c82c Section::CreateSectionPages_case26
+8062c880 Section::CreateSectionPages_case27
+8062c8d4 Section::CreateSectionPages_case28
+8062c928 Section::CreateSectionPages_case29
+8062c988 Section::CreateSectionPages_case2a
+8062c9e8 Section::CreateSectionPages_case2b
+8062ca48 Section::CreateSectionPages_case2c
+8062ca84 Section::CreateSectionPages_case2d
+8062cacc Section::CreateSectionPages_case2e
+8062cafc Section::CreateSectionPages_case2f
+8062cb44 Section::CreateSectionPages_case30
+8062cbbc Section::CreateSectionPages_case31
+8062cc40 Section::CreateSectionPages_case32
+8062cc7c Section::CreateSectionPages_case33
+8062ccb8 Section::CreateSectionPages_case34
+8062ccf4 Section::CreateSectionPages_case35
+8062cd0c Section::CreateSectionPages_case36
+8062cd24 Section::CreateSectionPages_case37
+8062cd3c Section::CreateSectionPages_case38
+8062cd54 Section::CreateSectionPages_case39
+8062cd60 Section::CreateSectionPages_case3a
+8062cd6c Section::CreateSectionPages_case3b
+8062cd84 Section::CreateSectionPages_case3c
+8062cd9c Section::CreateSectionPages_case3d
+8062cdd8 Section::CreateSectionPages_case3e
+8062ce14 Section::CreateSectionPages_case3f
+8062ce98 Section::CreateSectionPages_case40
+8062cf1c Section::CreateSectionPages_case41
+8062cfa0 Section::CreateSectionPages_case42
+8062d024 Section::CreateSectionPages_case43
+8062d0a8 Section::CreateSectionPages_case44
+8062d0c0 Section::CreateSectionPages_case45
+8062d108 Section::CreateSectionPages_case46
+8062d150 Section::CreateSectionPages_case47
+8062d1f8 Section::CreateSectionPages_case48
+8062d33c Section::CreateSectionPages_case49
+8062d480 Section::CreateSectionPages_case4a
+8062d5c4 Section::CreateSectionPages_case4b
+8062d648 Section::CreateSectionPages_case4c
+8062d6cc Section::CreateSectionPages_case4d
+8062d810 Section::CreateSectionPages_case4e
+8062d87c Section::CreateSectionPages_case4f
+8062d8e8 Section::CreateSectionPages_case50
+8062d954 Section::CreateSectionPages_case51
+8062d99c Section::CreateSectionPages_case52
+8062d9e4 Section::CreateSectionPages_case53
+8062da2c Section::CreateSectionPages_case54
+8062db64 Section::CreateSectionPages_case55
+8062dd08 Section::CreateSectionPages_case56
+8062deac Section::CreateSectionPages_case57
+8062e050 Section::CreateSectionPages_case58
+8062e0e0 Section::CreateSectionPages_case59
+8062e170 Section::CreateSectionPages_case5a
+8062e1d0 Section::CreateSectionPages_case5b
+8062e374 Section::CreateSectionPages_case5c
+8062e518 Section::CreateSectionPages_case5d
+8062e6bc Section::CreateSectionPages_case5e
+8062e74c Section::CreateSectionPages_case5f
+8062e7dc Section::CreateSectionPages_case60
+8062e86c Section::CreateSectionPages_case61
+8062e8fc Section::CreateSectionPages_case62
+8062e98c Section::CreateSectionPages_case63
+8062ea1c Section::CreateSectionPages_case64
+8062eaac Section::CreateSectionPages_case65
+8062eb3c Section::CreateSectionPages_case66
+8062ebcc Section::CreateSectionPages_case67
+8062ec5c Section::CreateSectionPages_case68
+8062ecd4 Section::CreateSectionPages_case69
+8062ed4c Section::CreateSectionPages_case6a
+8062eda0 Section::CreateSectionPages_case6b
+8062edf4 Section::CreateSectionPages_case6c
+8062ee78 Section::CreateSectionPages_case6d
+8062eefc Section::CreateSectionPages_case6e
+8062ef5c Section::CreateSectionPages_case6f
+8062efbc Section::CreateSectionPages_case70
+8062f028 Section::CreateSectionPages_case71
+8062f094 Section::CreateSectionPages_case72
+8062f100 Section::CreateSectionPages_case73
+8062f16c Section::CreateSectionPages_case74
+8062f1d8 Section::CreateSectionPages_case75
+8062f244 Section::CreateSectionPages_case76
+8062f2b0 Section::CreateSectionPages_case77
+8062f31c Section::CreateSectionPages_case78
+8062f334 Section::CreateSectionPages_case79
+8062f34c Section::CreateSectionPages_case7a
+8062f3a0 Section::CreateSectionPages_case7b
+8062f3f4 Section::CreateSectionPages_case7c
+8062f448 Section::CreateSectionPages_case7d
+8062f544 Section::CreateSectionPages_case7e
+8062f610 Section::CreateSectionPages_case7f
+8062f694 Section::CreateSectionPages_case80
+8062f778 Section::CreateSectionPages_case81
+8062f850 Section::CreateSectionPages_case82
+8062f8b0 Section::CreateSectionPages_case83
+8062fa3c Section::CreateSectionPages_case84
+8062fbd4 Section::CreateSectionPages_case85
+8062fc4c Section::CreateSectionPages_case86
+8062fcc4 Section::CreateSectionPages_case87
+8062fd48 Section::CreateSectionPages_case88
+8062fd60 Section::CreateSectionPages_case89
+8062fd78 Section::CreateSectionPages_case8a
+8062fdcc Section::CreateSectionPages_case8b
+8062fe08 Section::CreateSectionPages_case8c
+8062fec8 Section::CreateSectionPages_case8d
+8062fef8 Section::CreateSectionPages_case8e
+8062ff1c Section::CreateSectionPages_case8f
+8062ff88 Section::CreateSectionPages_case90
+8062ffb8 Section::CreateSectionPages_case91
+8062ffe8 Section::CreateSectionPages_case92
+80630018 Section::CreateSectionPages_case93
+80630048 Section::CreateSectionPages_case94
+80630094 Section::AddInitialLayers
+806300c8 Section::AddInitialLayers_switch
+806300cc Section::AddInitialLayers_caseD_6
+806300d8 Section::AddInitialLayers_caseD_7
+806300e4 Section::AddInitialLayers_caseD_8
+806300f0 Section::AddInitialLayers_caseD_9
+806300fc Section::AddInitialLayers_caseD_a
+80630108 Section::AddInitialLayers_caseD_b
+80630114 Section::AddInitialLayers_caseD_c
+80630120 Section::AddInitialLayers_caseD_d
+8063012c Section::AddInitialLayers_caseD_e
+80630138 Section::AddInitialLayers_caseD_f
+80630144 Section::AddInitialLayers_caseD_10
+8063015c Section::AddInitialLayers_caseD_11
+80630174 Section::AddInitialLayers_caseD_12
+8063018c Section::AddInitialLayers_caseD_13
+806301a4 Section::AddInitialLayers_caseD_14
+806301bc Section::AddInitialLayers_caseD_15
+806301d4 Section::AddInitialLayers_caseD_16
+806301e0 Section::AddInitialLayers_caseD_17
+806301ec Section::AddInitialLayers_caseD_18
+806301f8 Section::AddInitialLayers_caseD_19
+80630204 Section::AddInitialLayers_caseD_1a
+80630210 Section::AddInitialLayers_caseD_1b
+8063021c Section::AddInitialLayers_caseD_1c
+80630228 Section::AddInitialLayers_caseD_1d
+80630234 Section::AddInitialLayers_caseD_1e
+8063024c Section::AddInitialLayers_caseD_1f
+80630270 Section::AddInitialLayers_caseD_20
+80630288 Section::AddInitialLayers_caseD_21
+806302a0 Section::AddInitialLayers_caseD_22
+806302b8 Section::AddInitialLayers_caseD_23
+806302d0 Section::AddInitialLayers_caseD_24
+806302e8 Section::AddInitialLayers_caseD_25
+80630300 Section::AddInitialLayers_caseD_26
+80630318 Section::AddInitialLayers_caseD_27
+80630330 Section::AddInitialLayers_caseD_28
+80630348 Section::AddInitialLayers_caseD_29
+80630360 Section::AddInitialLayers_caseD_2a
+80630378 Section::AddInitialLayers_caseD_2b
+80630390 Section::AddInitialLayers_caseD_2c
+806303a8 Section::AddInitialLayers_caseD_2d
+806303c0 Section::AddInitialLayers_caseD_2e
+806303d8 Section::AddInitialLayers_caseD_2f
+806303fc Section::AddInitialLayers_caseD_30
+80630414 Section::AddInitialLayers_caseD_31
+80630438 Section::AddInitialLayers_caseD_32
+8063045c Section::AddInitialLayers_caseD_33
+80630480 Section::AddInitialLayers_caseD_34
+806304a4 Section::AddInitialLayers_caseD_35
+806304b0 Section::AddInitialLayers_caseD_36
+806304bc Section::AddInitialLayers_caseD_37
+806304c8 Section::AddInitialLayers_caseD_38
+806304d4 Section::AddInitialLayers_caseD_39
+806304e0 Section::AddInitialLayers_caseD_3a
+806304ec Section::AddInitialLayers_caseD_3b
+80630504 Section::AddInitialLayers_caseD_3c
+8063051c Section::AddInitialLayers_caseD_3d
+80630534 Section::AddInitialLayers_caseD_3e
+8063054c Section::AddInitialLayers_caseD_3f
+8063057c Section::AddInitialLayers_caseD_40
+806305ac Section::AddInitialLayers_caseD_41
+806305dc Section::AddInitialLayers_caseD_42
+8063060c Section::AddInitialLayers_caseD_43
+8063063c Section::AddInitialLayers_caseD_44
+80630654 Section::AddInitialLayers_caseD_45
+80630678 Section::AddInitialLayers_caseD_46
+8063069c Section::AddInitialLayers_caseD_47
+806306c0 Section::AddInitialLayers_caseD_48
+806306fc Section::AddInitialLayers_caseD_49
+80630738 Section::AddInitialLayers_caseD_4a
+80630774 Section::AddInitialLayers_caseD_4b
+806307b0 Section::AddInitialLayers_caseD_4c
+806307ec Section::AddInitialLayers_caseD_4d
+8063081c Section::AddInitialLayers_caseD_4e
+80630858 Section::AddInitialLayers_caseD_4f
+80630894 Section::AddInitialLayers_caseD_50
+806308d0 Section::AddInitialLayers_caseD_51
+80630900 Section::AddInitialLayers_caseD_52
+80630930 Section::AddInitialLayers_caseD_53
+80630960 Section::AddInitialLayers_caseD_54
+80630990 Section::AddInitialLayers_caseD_55
+806309d8 Section::AddInitialLayers_caseD_56
+80630a20 Section::AddInitialLayers_caseD_57
+80630a68 Section::AddInitialLayers_caseD_58
+80630aa4 Section::AddInitialLayers_caseD_59
+80630ae0 Section::AddInitialLayers_caseD_5a
+80630af8 Section::AddInitialLayers_caseD_5b
+80630b40 Section::AddInitialLayers_caseD_5c
+80630b88 Section::AddInitialLayers_caseD_5d
+80630bd0 Section::AddInitialLayers_caseD_5e
+80630c0c Section::AddInitialLayers_caseD_5f
+80630c48 Section::AddInitialLayers_caseD_60
+80630c84 Section::AddInitialLayers_caseD_61
+80630cc0 Section::AddInitialLayers_caseD_62
+80630cfc Section::AddInitialLayers_caseD_63
+80630d38 Section::AddInitialLayers_caseD_64
+80630d74 Section::AddInitialLayers_caseD_65
+80630db0 Section::AddInitialLayers_caseD_66
+80630dec Section::AddInitialLayers_caseD_67
+80630e28 Section::AddInitialLayers_caseD_68
+80630e58 Section::AddInitialLayers_caseD_69
+80630e88 Section::AddInitialLayers_caseD_6a
+80630eb8 Section::AddInitialLayers_caseD_6b
+80630ee8 Section::AddInitialLayers_caseD_6c
+80630f18 Section::AddInitialLayers_caseD_6d
+80630f48 Section::AddInitialLayers_caseD_6e
+80630f78 Section::AddInitialLayers_caseD_6f
+80630fa8 Section::AddInitialLayers_caseD_70
+80630fd8 Section::AddInitialLayers_caseD_71
+80631008 Section::AddInitialLayers_caseD_72
+80631038 Section::AddInitialLayers_caseD_73
+80631068 Section::AddInitialLayers_caseD_74
+80631098 Section::AddInitialLayers_caseD_75
+806310c8 Section::AddInitialLayers_caseD_76
+806310f8 Section::AddInitialLayers_caseD_77
+80631128 Section::AddInitialLayers_caseD_78
+80631140 Section::AddInitialLayers_caseD_79
+80631158 Section::AddInitialLayers_caseD_7a
+80631170 Section::AddInitialLayers_caseD_7b
+80631188 Section::AddInitialLayers_caseD_7c
+806311a0 Section::AddInitialLayers_caseD_7d
+806311e8 Section::AddInitialLayers_caseD_7e
+80631224 Section::AddInitialLayers_caseD_7f
+80631248 Section::AddInitialLayers_caseD_80
+80631278 Section::AddInitialLayers_caseD_81
+806312a8 Section::AddInitialLayers_caseD_82
+806312cc Section::AddInitialLayers_caseD_83
+80631314 Section::AddInitialLayers_caseD_84
+8063135c Section::AddInitialLayers_caseD_85
+80631380 Section::AddInitialLayers_caseD_86
+806313a4 Section::AddInitialLayers_caseD_87
+806313c8 Section::AddInitialLayers_caseD_88
+806313e0 Section::AddInitialLayers_caseD_89
+806313f8 Section::AddInitialLayers_caseD_8a
+80631410 Section::AddInitialLayers_caseD_8b
+80631428 Section::AddInitialLayers_caseD_8c
+8063144c Section::AddInitialLayers_caseD_8d
+80631470 Section::AddInitialLayers_caseD_8e
+80631494 Section::AddInitialLayers_caseD_8f
+806314b8 Section::AddInitialLayers_caseD_90
+806314e8 Section::AddInitialLayers_caseD_91
+80631518 Section::AddInitialLayers_caseD_92
+80631548 Section::AddInitialLayers_caseD_93
+80631588 Section::GetSceneId
+80631734 Section::GetArchiveName
+80631a58 Section::HasBackModel
+80631af8 Section::HasDriverController
+80631bf0 Section::GetPageName
+80631c00 Section::GetSectionName
+80631c10 0x80631c10
+80631c68 Section::GetSoundId
+80631ef8 Section::GetGroupId
+80632080 0x80632080
+806321b4 Section::GetAudioStreamIdx
+806321d0 Section::GetAudioStreamIdx_switch
+806321d4 Section::GetAudioStreamIdx_caseD_0
+806321dc Section::GetAudioStreamIdx_caseD_1
+806321e4 Section::GetAudioStreamIdx_caseD_2
+806321ec Section::GetAudioStreamIdx_caseD_5
+806321f4 Section::GetAudioStreamIdx_caseD_6
+806321fc Section::GetAudioStreamIdx_caseD_10
+80632204 Section::GetAudioStreamIdx_caseD_4b
+8063220c Section::GetAudioStreamIdx_caseD_4c
+80632214 Section::GetAudioStreamIdx_caseD_4d
+8063221c Section::GetAudioStreamIdx_caseD_4e
+80632224 Section::GetAudioStreamIdx_caseD_57
+8063222c Section::GetAudioStreamIdx_caseD_58
+80632234 Section::GetAudioStreamIdx_caseD_5a
+8063223c Section::GetAudioStreamIdx_caseD_5b
+80632244 Section::GetAudioStreamIdx_caseD_5c
+8063224c Section::GetAudioStreamIdx_caseD_5d
+80632254 Section::GetAudioStreamIdx_caseD_5e
+8063225c Section::GetAudioStreamIdx_caseD_5f
+80632264 Section::GetAudioStreamIdx_caseD_60
+8063226c Section::GetAudioStreamIdx_caseD_65
+80632274 Section::GetAudioStreamIdx_caseD_66
+8063227c Section::GetAudioStreamIdx_caseD_69
+80632284 Section::GetAudioStreamIdx_caseD_6b
+8063228c Section::GetAudioStreamIdx_caseD_6e
+80632294 Section::GetAudioStreamIdx_caseD_70
+8063229c Section::GetAudioStreamIdx_caseD_72
+806322a4 Section::GetAudioStreamIdx_caseD_74
+806322ac Section::GetAudioStreamIdx_caseD_75
+806322b4 Section::GetAudioStreamIdx_caseD_76
+806322bc Section::GetAudioStreamIdx_caseD_77
+806322c4 Section::GetAudioStreamIdx_caseD_78
+806322cc Section::GetAudioStreamIdx_caseD_7a
+806322d4 Section::GetAudioStreamIdx_caseD_7f
+806322dc Section::GetAudioStreamIdx_caseD_80
+806322e4 Section::GetAudioStreamIdx_caseD_81
+806322ec Section::GetAudioStreamIdx_caseD_84
+806322f4 Section::GetAudioStreamIdx_caseD_85
+806322fc Section::GetAudioStreamIdx_caseD_8a
+80632304 Section::GetAudioStreamIdx_caseD_8b
+8063230c Section::GetAudioStreamIdx_caseD_8c
+80632314 Section::GetAudioStreamIdx_caseD_8d
+8063231c Section::GetAudioStreamIdx_caseD_8e
+80632324 Section::GetAudioStreamIdx_caseD_8f
+8063232c Section::GetAudioStreamIdx_caseD_90
+80632334 Section::GetAudioStreamIdx_caseD_93
+8063233c Section::GetAudioStreamIdx_caseD_95
+80632344 Section::GetAudioStreamIdx_caseD_96
+8063234c Section::GetAudioStreamIdx_caseD_98
+80632354 Section::GetAudioStreamIdx_caseD_9a
+8063235c Section::GetAudioStreamIdx_caseD_9b
+80632364 Section::GetAudioStreamIdx_caseD_9c
+8063236c Section::GetAudioStreamIdx_caseD_9d
+80632374 Section::GetAudioStreamIdx_caseD_9f
+8063237c Section::GetAudioStreamIdx_caseD_a0
+80632384 Section::GetAudioStreamIdx_caseD_a1
+8063238c Section::GetAudioStreamIdx_caseD_a2
+80632394 Section::GetAudioStreamIdx_caseD_a5
+8063239c Section::GetAudioStreamIdx_caseD_a8
+806323a4 Section::GetAudioStreamIdx_caseD_b1
+806323ac Section::GetAudioStreamIdx_caseD_b3
+806323b4 Section::GetAudioStreamIdx_caseD_b4
+806323bc Section::GetAudioStreamIdx_caseD_b5
+806323c4 Section::GetAudioStreamIdx_caseD_b6
+806323cc Section::GetAudioStreamIdx_caseD_b8
+806323d4 Section::GetAudioStreamIdx_caseD_b9
+806323dc Section::GetAudioStreamIdx_caseD_bb
+806323e4 Section::GetAudioStreamIdx_caseD_c0
+806323ec Section::GetAudioStreamIdx_caseD_ca
+806323f4 Section::GetAudioStreamIdx_caseD_cc
+806323fc Section::GetAudioStreamIdx_caseD_cd
+8063240c Pages::RaceMenu::SetNextPage
+80632414 Pages::RaceMenu::GetNextPage
+8063241c 0x8063241c
+80632424 0x80632424
+8063242c 0x8063242c
+80632438 0x80632438
+80632444 0x80632444
+8063244c 0x8063244c
+806324b8 0x806324b8
+806324c4 Pages::QuitConfirmation::GetMessageBMG
+806324cc Pages::QuitConfirmation::IsPausePage
+806324d4 Pages::QuitConfirmation::GetButtonsBRCTRName
+806324e0 Pages::QuitConfirmation::GetVariantsIdxArray
+806324ec Pages::QuitConfirmation::GetButtonCount
+806324f4 Pages::QuitConfirmation::__dt
+80632560 Pages::QuitConfirmation::GetRuntimeTypeInfo
+8063256c Pages::CheckRankings::GetMessageBMG
+80632574 Pages::CheckRankings::IsPausePage
+8063257c Pages::CheckRankings::GetButtonsBRCTRName
+80632588 Pages::CheckRankings::GetVariantsIdxArray
+80632594 Pages::CheckRankings::GetButtonCount
+8063259c Pages::CheckRankings::__dt
+80632608 Pages::CheckRankings::GetRuntimeTypeInfo
+80632614 Pages::TTFriendGhostEnd::GetMessageBMG
+8063261c Pages::TTFriendGhostEnd::IsPausePage
+80632624 Pages::TTFriendGhostEnd::GetButtonsBRCTRName
+80632630 Pages::TTFriendGhostEnd::GetVariantsIdxArray
+8063263c Pages::TTFriendGhostEnd::GetButtonCount
+80632644 Pages::TTFriendGhostEnd::__dt
+806326b0 Pages::TTFriendGhostEnd::GetRuntimeTypeInfo
+806326bc 0x806326bc
+806326c4 0x806326c4
+806326cc 0x806326cc
+806326d8 0x806326d8
+806326e4 0x806326e4
+806326ec 0x806326ec
+80632758 0x80632758
+80632764 0x80632764
+8063276c 0x8063276c
+80632774 0x80632774
+80632780 0x80632780
+8063278c 0x8063278c
+80632794 0x80632794
+80632800 0x80632800
+8063280c 0x8063280c
+80632814 0x80632814
+8063281c 0x8063281c
+80632828 0x80632828
+80632834 0x80632834
+8063283c 0x8063283c
+806328a8 0x806328a8
+806328b4 0x806328b4
+806328bc 0x806328bc
+806328c4 0x806328c4
+806328d0 0x806328d0
+806328dc 0x806328dc
+806328e4 0x806328e4
+80632950 0x80632950
+8063295c Pages::BattleFinalRaceEnd::GetMessageBMG
+80632964 Pages::BattleFinalRaceEnd::IsPausePage
+8063296c Pages::BattleFinalRaceEnd::GetButtonsBRCTRName
+80632978 Pages::BattleFinalRaceEnd::GetVariantsIdxArray
+80632984 Pages::BattleFinalRaceEnd::GetButtonCount
+8063298c Pages::BattleFinalRaceEnd::__dt
+806329f8 Pages::BattleFinalRaceEnd::GetRuntimeTypeInfo
+80632a04 Pages::BattleEnd::GetMessageBMG
+80632a0c Pages::BattleEnd::IsPausePage
+80632a14 Pages::BattleEnd::GetButtonsBRCTRName
+80632a20 Pages::BattleEnd::GetVariantsIdxArray
+80632a2c Pages::BattleEnd::GetButtonCount
+80632a34 Pages::BattleEnd::__dt
+80632aa0 Pages::BattleEnd::GetRuntimeTypeInfo
+80632aac Pages::VSRaceEnd::GetMessageBMG
+80632ab4 Pages::VSRaceEnd::IsPausePage
+80632abc Pages::VSRaceEnd::GetButtonsBRCTRName
+80632af4 Pages::VSRaceEnd::GetVariantsIdxArray
+80632b00 Pages::VSRaceEnd::GetButtonCount
+80632b30 Pages::VSRaceEnd::__dt
+80632b9c Pages::VSRaceEnd::GetRuntimeTypeInfo
+80632ba8 Pages::GPEnd::GetMessageBMG
+80632bb0 Pages::GPEnd::IsPausePage
+80632bb8 Pages::GPEnd::GetButtonsBRCTRName
+80632bf0 Pages::GPEnd::GetVariantsIdxArray
+80632bfc Pages::GPEnd::GetButtonCount
+80632c2c Pages::GPEnd::__dt
+80632c98 Pages::GPEnd::GetRuntimeTypeInfo
+80632ca4 Pages::TTEnd::GetMessageBMG
+80632cac Pages::TTEnd::IsPausePage
+80632cb4 Pages::TTEnd::GetButtonsBRCTRName
+80632cc0 Pages::TTEnd::GetVariantsIdxArray
+80632ccc Pages::TTEnd::GetButtonCount
+80632cd4 Pages::TTEnd::__dt
+80632d40 Pages::TTEnd::GetRuntimeTypeInfo
+80632d4c 0x80632d4c
+80632d54 0x80632d54
+80632d5c 0x80632d5c
+80632d68 0x80632d68
+80632d74 0x80632d74
+80632d7c 0x80632d7c
+80632de8 0x80632de8
+80632df4 0x80632df4
+80632dfc 0x80632dfc
+80632e04 0x80632e04
+80632e10 0x80632e10
+80632e1c 0x80632e1c
+80632e24 0x80632e24
+80632e90 0x80632e90
+80632e9c 0x80632e9c
+80632ea4 0x80632ea4
+80632eac 0x80632eac
+80632eb8 0x80632eb8
+80632ec4 0x80632ec4
+80632ecc 0x80632ecc
+80632f38 0x80632f38
+80632f44 Pages::GhostReplayPause::GetMessageBMG
+80632f4c Pages::GhostReplayPause::IsPausePage
+80632f54 Pages::GhostReplayPause::GetButtonsBRCTRName
+80632f60 Pages::GhostReplayPause::GetVariantsIdxArray
+80632f6c Pages::GhostReplayPause::GetButtonCount
+80632f74 Pages::GhostReplayPause::__dt
+80632fe0 Pages::GhostReplayPause::GetRuntimeTypeInfo
+80632fec Pages::GPReplayPause::GetMessageBMG
+80632ff4 Pages::GPReplayPause::IsPausePage
+80632ffc Pages::GPReplayPause::GetButtonsBRCTRName
+80633034 Pages::GPReplayPause::GetVariantsIdxArray
+80633040 Pages::GPReplayPause::GetButtonCount
+80633070 Pages::GPReplayPause::__dt
+806330dc Pages::GPReplayPause::GetRuntimeTypeInfo
+806330e8 Pages::TTReplayPause::GetMessageBMG
+806330f0 Pages::TTReplayPause::IsPausePage
+806330f8 Pages::TTReplayPause::GetButtonsBRCTRName
+80633104 Pages::TTReplayPause::GetVariantsIdxArray
+80633110 Pages::TTReplayPause::GetButtonCount
+80633118 Pages::TTReplayPause::__dt
+80633184 Pages::TTReplayPause::GetRuntimeTypeInfo
+80633190 0x80633190
+80633198 0x80633198
+806331a0 0x806331a0
+806331ac 0x806331ac
+806331b8 0x806331b8
+806331c0 0x806331c0
+8063322c 0x8063322c
+80633238 Pages::BattlePause::GetMessageBMG
+80633240 Pages::BattlePause::IsPausePage
+80633248 Pages::BattlePause::GetButtonsBRCTRName
+80633270 Pages::BattlePause::GetVariantsIdxArray
+8063327c Pages::BattlePause::GetButtonCount
+80633284 Pages::BattlePause::__dt
+806332f0 Pages::BattlePause::GetRuntimeTypeInfo
+806332fc Pages::VSPause::GetMessageBMG
+80633304 Pages::VSPause::IsPausePage
+8063330c Pages::VSPause::GetButtonsBRCTRName
+80633334 Pages::VSPause::GetVariantsIdxArray
+80633340 Pages::VSPause::GetButtonCount
+80633348 Pages::VSPause::__dt
+806333b4 Pages::VSPause::GetRuntimeTypeInfo
+806333c0 Pages::GPPause::GetMessageBMG
+806333c8 Pages::GPPause::IsPausePage
+806333d0 Pages::GPPause::GetButtonsBRCTRName
+806333dc Pages::GPPause::GetVariantsIdxArray
+806333e8 Pages::GPPause::GetButtonCount
+806333f0 Pages::GPPause::__dt
+8063345c Pages::GPPause::GetRuntimeTypeInfo
+80633468 Pages::TTPause::GetMessageBMG
+80633470 Pages::TTPause::IsPausePage
+80633478 Pages::TTPause::GetButtonsBRCTRName
+80633484 Pages::TTPause::GetVariantsIdxArray
+80633490 Pages::TTPause::GetButtonCount
+80633498 Pages::TTPause::__dt
+80633504 Pages::TTPause::GetRuntimeTypeInfo
+80633510 Pages::RaceHUD::GetNextPage
+80633518 Pages::LiveBattleViewHUD::GetCtrlRaceNameBalloonCount
+80633520 Pages::LiveBattleViewHUD::GetEnabledCtrlRaceBases
+80633528 Pages::LiveBattleViewHUD::GetPausePageId
+80633530 Pages::LiveBattleViewHUD::__dt
+8063359c Pages::LiveBattleViewHUD::GetRuntimeTypeInfo
+806335a8 Pages::LiveViewHUD::GetCtrlRaceNameBalloonCount
+806335b0 Pages::LiveViewHUD::GetEnabledCtrlRaceBases
+806335b8 Pages::LiveViewHUD::GetPausePageId
+806335c0 Pages::LiveViewHUD::__dt
+8063362c Pages::LiveViewHUD::GetRuntimeTypeInfo
+80633638 Pages::WiFiFriendTeamVSHUD::GetCtrlRaceNameBalloonCount
+80633640 Pages::WiFiFriendTeamVSHUD::GetEnabledCtrlRaceBases
+80633648 Pages::WiFiFriendTeamVSHUD::GetPausePageId
+80633650 Pages::WiFiFriendTeamVSHUD::__dt
+806336bc Pages::WiFiFriendVSHUD::GetRuntimeTypeInfo
+806336c8 Pages::WiFiFriendVSHUD::GetCtrlRaceNameBalloonCount
+806336d0 Pages::WiFiFriendVSHUD::GetEnabledCtrlRaceBases
+806336d8 Pages::WiFiFriendVSHUD::GetPausePageId
+806336e0 Pages::WiFiFriendVSHUD::__dt
+8063374c Pages::WiFiFriendVSHUD::GetRuntimeTypeInfo
+80633758 Pages::WifiVSMultiHUD::GetCtrlRaceNameBalloonCount
+80633760 Pages::WifiVSMultiHUD::GetEnabledCtrlRaceBases
+80633768 Pages::WifiVSMultiHUD::GetPausePageId
+80633770 Pages::WifiVSMultiHUD::__dt
+806337dc Pages::WifiVSMultiHUD::GetRuntimeTypeInfo
+806337e8 Pages::WifiVSHUD::GetCtrlRaceNameBalloonCount
+806337f0 Pages::WifiVSHUD::GetEnabledCtrlRaceBases
+806337f8 Pages::WifiVSHUD::GetPausePageId
+80633800 Pages::WifiVSHUD::__dt
+8063386c Pages::WifiVSHUD::GetRuntimeTypeInfo
+80633878 Pages::BattleMultiHUD::GetCtrlRaceNameBalloonCount
+80633880 Pages::BattleMultiHUD::GetEnabledCtrlRaceBases
+80633888 Pages::BattleMultiHUD::GetPausePageId
+806338c0 Pages::BattleMultiHUD::__dt
+8063392c Pages::BattleMultiHUD::GetRuntimeTypeInfo
+80633938 Pages::BattleHUD::GetCtrlRaceNameBalloonCount
+80633940 Pages::BattleHUD::GetEnabledCtrlRaceBases
+80633948 Pages::BattleHUD::GetPausePageId
+80633980 Pages::BattleHUD::__dt
+806339ec Pages::BattleHUD::GetRuntimeTypeInfo
+806339f8 Pages::VSMultiHUD::GetCtrlRaceNameBalloonCount
+80633a00 Pages::VSMultiHUD::GetEnabledCtrlRaceBases
+80633a08 Pages::VSMultiHUD::GetPausePageId
+80633a10 Pages::VSMultiHUD::__dt
+80633a7c Pages::VSMultiHUD::GetRuntimeTypeInfo
+80633a88 Pages::VSHUD::GetCtrlRaceNameBalloonCount
+80633a90 Pages::VSHUD::GetEnabledCtrlRaceBases
+80633a98 Pages::VSHUD::GetPausePageId
+80633aa0 Pages::VSHUD::__dt
+80633b0c Pages::VSHUD::GetRuntimeTypeInfo
+80633b18 Pages::GPHUD::GetCtrlRaceNameBalloonCount
+80633b20 Pages::GPHUD::GetEnabledCtrlRaceBases
+80633b28 Pages::GPHUD::GetPausePageId
+80633b30 Pages::GPHUD::__dt
+80633b9c Pages::GPHUD::GetRuntimeTypeInfo
+80633ba8 Pages::TTHUD::GetCtrlRaceNameBalloonCount
+80633bb0 Pages::TTHUD::GetEnabledCtrlRaceBases
+80633bb8 Pages::TTHUD::GetPausePageId
+80633c04 Pages::TTHUD::__dt
+80633c70 Pages::TTHUD::GetRuntimeTypeInfo
+80633c7c Pages::GhostRaceHUD::GetCtrlRaceNameBalloonCount
+80633c84 Pages::GhostRaceHUD::GetEnabledCtrlRaceBases
+80633c8c Pages::GhostRaceHUD::GetPausePageId
+80633ccc Pages::GhostRaceHUD::__dt
+80633d38 Pages::GhostRaceHUD::GetRuntimeTypeInfo
+80633d44 Pages::RaceHUD::GetCtrlRaceNameBalloonCount
+80633d4c Pages::GPReplayHUD::GetEnabledCtrlRaceBases
+80633d54 Pages::GPReplayHUD::GetPausePageId
+80633d5c Pages::GPReplayHUD::__dt
+80633dc8 Pages::GPReplayHUD::GetRuntimeTypeInfo
+80633dd4 TriggerPtmf
+80633e04 TriggerPtmf
+80633e34 TriggerPtmf
+80633e64 TriggerPtmf
+80633e94 TriggerPtmf
+80633ec4 TriggerPtmf
+80633ef4 TriggerPtmf
+80633f24 TriggerPtmf
+80633f54 TriggerPtmf
+80633f84 TriggerPtmf
+80633fb4 TriggerPtmf
+80633fe4 TriggerPtmf
+80634014 TriggerPtmf
+80634044 TriggerPtmf
+80634074 TriggerPtmf
+806340a4 TriggerPtmf
+806340d4 TriggerPtmf
+80634104 TriggerPtmf
+80634134 TriggerPtmf
+80634164 TriggerPtmf
+80634194 TriggerPtmf
+806341c4 TriggerPtmf
+806341f4 TriggerPtmf
+80634224 TriggerPtmf
+80634254 TriggerPtmf
+80634284 TriggerPtmf
+806342b4 TriggerPtmf
+806342e4 TriggerPtmf
+80634314 TriggerPtmf
+80634344 TriggerPtmf
+80634374 TriggerPtmf
+806343a4 TriggerPtmf
+806343d4 TriggerPtmf
+80634404 TriggerPtmf
+80634434 TriggerPtmf
+80634464 TriggerPtmf
+80634494 TriggerPtmf
+806344c4 TriggerPtmf
+806344f4 TriggerPtmf
+80634524 TriggerPtmf
+80634554 TriggerPtmf
+80634584 TriggerPtmf
+806345b4 TriggerPtmf
+806345e4 TriggerPtmf
+80634614 TriggerPtmf
+80634644 TriggerPtmf
+80634674 TriggerPtmf
+806346a4 TriggerPtmf
+806346d4 TriggerPtmf
+80634704 TriggerPtmf
+80634734 TriggerPtmf
+80634764 TriggerPtmf
+80634794 TriggerPtmf
+806347c4 TriggerPtmf
+806347f4 TriggerPtmf
+80634824 TriggerPtmf
+80634854 TriggerPtmf
+80634884 TriggerPtmf
+806348b4 TriggerPtmf
+806348e4 TriggerPtmf
+80634914 TriggerPtmf
+80634944 TriggerPtmf
+80634974 TriggerPtmf
+806349a4 TriggerPtmf
+806349d4 TriggerPtmf
+80634a04 TriggerPtmf
+80634a34 TriggerPtmf
+80634a64 SectionMgr::CreateSystemPages
+80634b80 SectionMgr::GetSectionPriority
+80634c90 SectionMgr::CreateInstance
+80634cc8 SectionMgr::DestroyInstance
+80634d40 SectionMgr::__ct
+80634dc4 SectionMgr::__dt
+80634e44 SectionMgr::Init
+80634fa0 SectionMgr::GetBootSectionSceneId
+80634fbc SectionMgr::LoadSection
+80635080 SectionMgr::EnterSection
+8063519c SectionMgr::ExitSection
+806354b8 0x806354b8
+806354c0 SectionMgr::RaceUpdate
+8063550c SectionMgr::Update
+8063583c SectionMgr::MenuUpdate
+80635890 SectionMgr::UnkUpdate
+80635a2c SectionMgr::Pause
+80635a34 SectionMgr::Resume
+80635a3c SectionMgr::SetNextSection
+80635ac8 SectionMgr::RequestSceneChange
+80635b2c SectionMgr::RequestSceneReinit
+80635b70 SectionMgr::HandleHomeAction
+80635c0c SectionMgr::RequestGoToWiiMenu
+80635c74 SectionMgr::RequestPowerOff
+80635cdc SectionMgr::GetNextSectionArchiveName
+80635ce4 SectionMgr::NextSectionHasBackModel
+80635cec SectionMgr::NextSectionHasDriverController
+80635cf4 SectionMgr::UpdateStatusBitfield
+80635e08 SectionMgr::UpdateDVDStatus
+80635eb8 SheetSelectControl::GetClassName
+80635ec4 SheetSelectControl::__ct
+8063607c SheetSelectControl::__dt
+80636120 SheetSelectControl::Load
+806361e4 SheetSelectControl::Func_0x38
+806361e8 SheetSelectControl::SetRightArrowHandler
+806361f0 SheetSelectControl::SetLeftArrowHandler
+806361f8 SheetSelectControl::SetEnabledHudSlots
+80636264 SheetSelectControl::Toggle
+806362e8 SheetSelectControl::Init
+8063634c SheetSelectControl::Update
+80636350 SheetSelectControl::HandleRightArrowSelect
+806363d4 SheetSelectControl::AfterRightScroll
+806363d8 SheetSelectControl::HandleLeftArrowSelect
+8063645c SheetSelectControl::AfterLeftScroll
+80636460 SheetSelectControl::SheetSelectButton::GetClassName
+80636470 SheetSelectControl::SheetSelectButton::__ct
+80636564 SheetSelectControl::SheetSelectButton::__dt
+806365cc SheetSelectControl::SheetSelectButton::Load
+806367f8 SheetSelectControl::SheetSelectButton::Init
+806369e4 SheetSelectControl::SheetSelectButton::Update
+80636c2c SheetSelectControl::SheetSelectButton::SetEnabledHudSlots
+80636c48 SheetSelectControl::SheetSelectButton::Toggle
+80636c6c SheetSelectControl::SheetSelectButton::GetParentControl
+80636d08 SheetSelectControl::SheetSelectButton::HandleSelect
+80636fc4 SheetSelectControl::SheetSelectButton::HandleDeselect
+806371ac SheetSelectControl::SheetSelectButton::Select
+80637344 SheetSelectControl::SheetSelectButton::SetPositionAnim
+80637474 SheetSelectControl::GetArrowAnimationType
+8063747c SheetSelectControlScaleFade::GetClassName
+8063748c SheetSelectControlScaleFade::GetArrowAnimationType
+80637494 SheetSelectControlScaleFade::GetRuntimeTypeInfo
+806374a0 SheetSelectControl::GetRuntimeTypeInfo
+806374ac SheetSelectControl::SheetSelectButton::GetRuntimeTypeInfo
+806374b8 SheetSelectControl::SheetSelectButton::TriggerPtmf
+806374e8 SheetSelect_cpp_sinit_
+80637514 Pages::ESRBNotice::__ct
+80637560 Pages::ESRBNotice::__dt
+806375d4 Pages::ESRBNotice::OnInit
+80637678 Pages::ESRBNotice::AfterControlUpdate
+806376e8 Pages::Suggest60Hz::__ct
+80637734 Pages::Suggest60Hz::__dt
+806377a8 Pages::Suggest60Hz::OnInit
+80637850 Pages::Suggest60Hz::OnActivate
+8063789c Pages::Suggest60Hz::AfterControl
+80637954 Pages::Suggest60Hz::IsHomeMenuWorking
+8063795c Pages::Suggest60Hz::GetRuntimeTypeInfo
+80637968 Pages::ESRBNotice::IsHomeMenuWorking
+80637970 Pages::ESRBNotice::GetRuntimeTypeInfo
+8063797c NoticePages_cpp_sinit_
+80637998 SystemBMGHolder::__ct
+806379c8 SystemBMGHolder::__dt
+80637a20 SystemBMGHolder::Init
+80637a8c SystemBMGHolder::GetMessage
+80637ac4 TabControl::GetClassName
+80637ad0 TabControl::__ct
+80637b2c TabControl::__dt
+80637ba4 TabControl::Load
+80637d20 TabControl::OnLoadingEnd
+80637d24 TabControl::SetOnClickHandler
+80637d2c TabControl::SetEnabledHudSlots
+80637da8 TabControl::SelectInitial
+80637e48 TabControl::SelectButtonNoPtmf
+80637ec0 TabControl::Init
+80637f94 TabControl::Update
+80637f98 TabControl::SelectButton
+80638038 TabControl::OptionButton::GetClassName
+80638048 TabControl::OptionButton::__ct
+8063813c TabControl::OptionButton::__dt
+806381a4 TabControl::OptionButton::Load
+80638370 TabControl::OptionButton::Init
+8063851c TabControl::OptionButton::Update
+806386c8 TabControl::OptionButton::SetEnabledHudSlots
+806386d0 TabControl::OptionButton::GetParentControl
+806387d0 TabControl::OptionButton::SetInitialState
+80638830 TabControl::OptionButton::ChangeButtonState
+80638988 TabControl::OptionButton::HandleSelect
+80638a7c TabControl::OptionButton::HandleDeselect
+80638c64 TabControl::OptionButton::HandleClick
+80638e20 TabControl::Func_0x40
+80638e24 TabControl::GetRuntimeTypeInfo
+80638e30 TabControl::OptionButton::GetRuntimeTypeInfo
+80638e3c TabControl::OptionButton::TriggerPtmf
+80638e6c TabControl_cpp_sinit_
+80638e88 Pages::GhostSelectSupporting::__ct
+80638ecc Pages::GhostSelectSupporting::__dt
+80638f34 Pages::GhostSelectSupporting::OnInit
+80638fa0 Pages::GhostSelectSupporting::OnActivate
+80639144 Pages::GhostSelectSupporting::BeforeEntranceAnimations
+80639148 Pages::GhostSelectSupporting::BeforeExitAnimations
+8063914c Pages::GhostSelectSupporting::AfterControlUpdate
+80639260 Pages::GhostSelectSupporting::OnResume
+806393c8 Pages::GhostSelectSupporting::InitGhostList
+806395ec Pages::GhostSelect::__ct
+8063982c Pages::GhostSelect::__dt
+80639908 Pages::GhostSelect::OnInit
+80639bd0 Pages::GhostSelect::OnActivate
+80639d34 Pages::GhostSelect::BeforeEntranceAnimations
+80639d6c Pages::GhostSelect::OnResume
+8063a1a4 Pages::GhostSelect::OnRightArrowPress
+8063a2a4 Pages::GhostSelect::OnLeftArrowPress
+8063a3a0 Pages::GhostSelect::OnChallengeGhostPress
+8063a3c0 Pages::GhostSelect::OnWatchReplayPress
+8063a3e0 Pages::GhostSelect::OnSoloTTPress
+8063a400 0x8063a400
+8063a444 Pages::GhostSelect::OnBackPress
+8063a45c 0x8063a45c
+8063a4b8 Pages::GhostSelect::GetNextPage
+8063a4c0 Pages::GhostSelect::GetRuntimeTypeInfo
+8063a4cc Pages::GhostSelectSupporting::GetNextPage
+8063a4d4 Pages::GhostSelectSupporting::GetRuntimeTypeInfo
+8063a4e0 TriggerPtmf
+8063a510 TriggerPtmf
+8063a540 TriggerPtmf
+8063a570 GhostSelectPage_cpp_sinit_
+8063a58c TitleImage::GetClassName
+8063a598 TitleImage::__ct
+8063a5d4 TitleImage::__dt
+8063a62c TitleImage::Load
+8063a6cc TitleImage::InitSelf
+8063a704 0x8063a704
+8063a7b4 0x8063a7b4
+8063a7ec 0x8063a7ec
+8063a89c 0x8063a89c
+8063a8d4 TitleImage::ChangeImage
+8063aa08 Pages::Title::__ct
+8063aa8c CtrlMenuPressStart::__dt
+8063aae4 Pages::Title::__dt
+8063ab6c Pages::Title::OnInit
+8063ad60 Pages::Title::OnDispose
+8063ad64 Pages::Title::OnActivate
+8063ade4 Pages::Title::BeforeEntranceAnimations
+8063ae94 Pages::Title::AfterEntranceAnimations
+8063aee0 Pages::Title::BeforeExitAnimations
+8063af90 Pages::Title::AfterExitAnimations
+8063afc8 Pages::Title::AfterControlUpdate
+8063b124 Pages::Title::OnResume
+8063b130 Pages::Title::PrepareDemo
+8063b514 Pages::BlurryTitle::__ct
+8063b560 Pages::BlurryTitle::__dt
+8063b5d4 Pages::BlurryTitle::OnInit
+8063b698 Pages::BlurryTitle::OnActivate
+8063b7f0 Pages::BlurryTitle::BeforeEntranceAnimations
+8063b7f4 TitleMovieControl::GetClassName
+8063b804 TitleMovieControl::__ct
+8063b840 TitleMovieControl::__dt
+8063b898 TitleMovieControl::Load
+8063b938 TitleMovieControl::InitSelf
+8063b970 TitleMovieControl::OnUpdate
+8063b974 0x8063b974
+8063ba24 0x8063ba24
+8063bad4 0x8063bad4
+8063bb08 Pages::TitleMovie::__ct
+8063bb6c Pages::TitleMovie::__dt
+8063bbe4 Pages::TitleMovie::OnInit
+8063bcf8 Pages::TitleMovie::OnActivate
+8063be44 Pages::TitleMovie::AfterExitAnimations
+8063be88 Pages::TitleMovie::OnDeactivate
+8063be9c Pages::TitleMovie::BeforeControlUpdate
+8063bfcc Pages::TitleMovie::AfterControlUpdate
+8063c0ac Pages::BlinkingPressA::__ct
+8063c110 Pages::BlinkingPressA::__dt
+8063c188 Pages::BlinkingPressA::OnInit
+8063c210 Pages::BlinkingPressA::OnActivate
+8063c268 Pages::BlinkingPressA::OnDeactivate
+8063c27c Pages::BlinkingPressA::AfterControlUpdate
+8063c368 Pages::BlinkingPressA::GetRuntimeTypeInfo
+8063c374 Pages::TitleMovie::GetRuntimeTypeInfo
+8063c380 TitleMovieControl::GetRuntimeTypeInfo
+8063c38c Pages::BlurryTitle::GetRuntimeTypeInfo
+8063c398 Pages::Title::GetNextPage
+8063c3a0 Pages::Title::GetRuntimeTypeInfo
+8063c3ac TitleImage::GetRuntimeTypeInfo
+8063c3b8 Title_cpp_sinit_
+8063c3ec UIAnimator::__ct
+8063c404 UIAnimator::__dt
+8063c464 UIAnimator::SetLayout
+8063c470 UIAnimator::Init
+8063c4d4 UIAnimator::InitAnimationGroup
+8063c53c Animation::__ct
+8063c560 UIAnimator::AppendGroup
+8063c650 UIAnimator::LoadNewAnimation
+8063c714 UIAnimator::LoadAnimation
+8063c7bc UIAnimator::Update
+8063c820 UIAnimator::GetAnimationGroupById
+8063c830 UIAnimator::GetAnimationGroupById
+8063c840 0x8063c840
+8063c844 AnimationGroup::__ct
+8063c8ac AnimationGroup::__dt
+8063c91c AnimationGroup::PlayAnimationAtFrame
+8063ca98 AnimationGroup::PlayAnimationAtPercent
+8063cb20 AnimationGroup::PlayAnimationAtFrameAndDisable
+8063cb54 AnimationGroup::PlayAnimationAtPercentAndDisable
+8063cbe4 AnimationGroup::Update
+8063cddc 0x8063cddc
+8063ce6c UIControl::__ct
+8063cf60 0x8063cf60
+8063cfa0 UIControl::__dt
+8063cffc UIControl::8063cffc
+8063d004 UIControl::Init
+8063d044 UIControl::Update
+8063d084 UIControl::Draw
+8063d0b8 UIControl::SetPosition
+8063d0e0 UIControl::PlayAnimationSound
+8063d194 UIControl::SetPositionAnim
+8063d268 UIControl::InitControlGroup
+8063d278 UIControl::AddControl
+8063d284 UIControl::GetAnimationDelay
+8063d398 UIControl::SetParentControlGroup
+8063d3a4 UIControl::SetSoundIds
+8063d3b0 UIControl::GetClassName
+8063d3c0 0x8063d3c0
+8063d3cc UIControl::PositionFromBasePosition
+8063d550 UIControl::CalculatePosition
+8063d608 UIControl::vf_0x30
+8063d648 UIControl::8063d648
+8063d74c UIControl::PlaySound
+8063d764 UIControl::StopSound
+8063d770 UIControl::HoldSound
+8063d788 LayoutUIControl::GetClassName
+8063d798 LayoutUIControl::__ct
+8063d8c0 LayoutUIControl::__dt
+8063d954 LayoutUIControl::LoadLayout
+8063d9c0 LayoutUIControl::LoadPictureLayout
+8063da00 LayoutUIControl::SetRootPane
+8063dac0 LayoutUIControl::Init
+8063db00 LayoutUIControl::Update
+8063db84 LayoutUIControl::Draw
+8063dcbc LayoutUIControl::SetTextBoxMessage
+8063ddb4 LayoutUIControl::SetMessage
+8063ddf4 LayoutUIControl::MessageRequester::Calc
+8063deec LayoutUIControl::ResetTextBoxMsg
+8063dfc8 LayoutUIControl::ResetMsg
+8063e000 LayoutUIControl::MessageResetter::Calc
+8063e0f0 LayoutUIControl::SetPicturePane
+8063e328 LayoutUIControl::PicturePaneExists
+8063e3dc LayoutUIControl::SetMiiPane
+8063e54c LayoutUIControl::SetPaneVisibility
+8063e58c LayoutUIControl::CropMovie(Rect)
+8063e5c4 LayoutUIControl::CropMovie(4floats)
+8063e61c LayoutUIControl::vf_0x30
+8063e664 LayoutUIControlScaleFade::GetClassName
+8063e674 LayoutUIControlScaleFade::__ct
+8063e7a8 LayoutUIControlScaleFade::__dt
+8063e840 LayoutUIControlScaleFade::SetPositionAnim
+8063e924 LayoutUIControlScaleFade::GetRuntimeTypeInfo
+8063e930 LayoutUIControlcpp_sinit_
+8063e954 UpDownControl::GetClassName
+8063e960 UpDownControl::__ct
+8063eb5c UpDownControl::__dt
+8063ebdc UpDownControl::Load
+8063f01c UpDownControl::OnLoadingEnd
+8063f020 UpDownControl::SetOnChangeHandler
+8063f028 UpDownControl::SetOnClickHandler
+8063f030 UpDownControl::SetOnElementSelectHandler
+8063f038 UpDownControl::SetOnDeselectHandler
+8063f040 0x8063f040
+8063f0ac 0x8063f0ac
+8063f0c0 UpDownControl::SelectInitial(count+initial)
+8063f0e0 UpDownControl::SelectInitial(initial)
+8063f0f8 0x8063f0f8
+8063f160 UpDownControl::SetPlayerBitfield
+8063f16c UpDownControl::Init
+8063f2a8 UpDownControl::Update
+8063f694 UpDownControl::HandleSelect
+8063f7c4 UpDownControl::HandleDeselect
+8063f8c8 UpDownControl::HandleButtonSelect
+8063f8e0 UpDownControl::HandleButtonDeselect
+8063f8f8 UpDownControl::HandleClick
+8063fb64 UpDownControl::HandleRightPress
+8063fc90 UpDownControl::HandleLeftPress
+8063fdb0 UpDownControl::UpDownButton::GetClassName
+8063fdc0 UpDownControl::UpDownButton::__ct
+8063fdfc UpDownControl::UpDownButton::__dt
+8063fe54 UpDownControl::UpDownButton::Load
+8063ff18 UpDownControl::UpDownButton::Init
+8063ffb0 UpDownControl::UpDownButton::Update
+8064009c UpDownControl::UpDownButton::GetParentControl
+8064019c UpDownControl::UpDownButton::ToggleSelect
+80640360 0x80640360
+806403c4 0x806403c4
+80640508 0x80640508
+806405b0 0x806405b0
+806405b8 0x806405b8
+806405c0 TextUpDownValueControl::GetClassName
+806405d0 TextUpDownValueControl::__ct
+8064063c TextUpDownValueControl::__dt
+806406b0 TextUpDownValueControl::Load
+806407d4 TextUpDownValueControl::SetOnTextChangeHandler
+806407dc TextUpDownValueControl::Init
+806408fc TextUpDownValueControl::Update
+806409a0 0x806409a0
+80640aa0 TextUpDownValueControl::InitText
+80640b68 TextUpDownValueControl::OnSelect
+80640cdc TextUpDownValueControl::SetMessage
+80640d0c TextUpDownValueControl::SetMessageAnimated
+80640dfc TextUpDownValueControl::OnClick
+80640e68 TextUpDownValueControl::IsOKStop
+80640f00 TextUpDownValueControl::Get3rdAnimStartFrame
+80640f74 TextUpDownValueControl::SetBorderColours
+80641028 TextUpDownValueControl::SetColor_BaseColours
+806410d0 TextUpDownValueControl::TextControl::GetClassName
+806410e0 TextUpDownValueControl::TextControl::__ct
+8064111c TextUpDownValueControl::TextControl::__dt
+80641174 TextUpDownValueControl::TextControl::Load
+806411e8 TextUpDownValueControl::TextControl::InitSelf
+80641298 0x80641298
+806412f8 TextUpDownValueControl::TextControl::ToggleState
+8064145c UpDownControlOld::1
+8064146c UpDownControlOld::2
+80641624 UpDownControlOld::3
+8064168c UpDownControlOld::4
+806419d4 UpDownControlOld::5
+806419dc UpDownControlOld::6
+80641ac0 UpDownControlOld::7
+80641c8c UpDownControlOld::8
+80641ca0 0x80641ca0
+80641ca8 UpDownControlOld::9
+80641d88 UpDownControlOld::10
+80641d8c UpDownControlOld::11
+80641f8c UpDownControlOld::12
+80641f90 UpDownControlOld::13
+80642070 UpDownControlOld::14
+806422b8 UpDownControlOld::15
+80642370 UpDownControlOld::16
+80642424 UpDownControlOld::17
+80642574 UpDownControlOld::18
+8064262c UpDownControlOld::19
+80642630 UpDownControlOld::20
+806426e4 UpDownControlOld::21
+806426e8 TextUpDownControlOld::1
+806426f8 TextUpDownControlOld::2
+806428bc TextUpDownControlOld::3
+80642928 TextUpDownControlOld::4
+8064295c 0x8064295c
+80642964 0x80642964
+8064296c 0x8064296c
+80642970 0x80642970
+8064297c 0x8064297c
+80642988 TextUpDownValueControl::GetTextControl
+8064298c TextUpDownValueControl::GetRuntimeTypeInfo
+80642998 TextUpDownValueControl::TextControl::GetRuntimeTypeInfo
+806429a4 UpDownControl::Func_0x40
+806429a8 UpDownControl::GetRuntimeTypeInfo
+806429b4 UpDownControl::UpDownButton::GetRuntimeTypeInfo
+806429c0 TriggerPtmf
+806429f0 TriggerPtmf
+80642a20 UpDownControl_cpp_sinit_
+80642a50 TextUpDownValueControl::SetColor_BaseColours(UpDownDisplayedText)
+80642a58 TextUpDownValueControl::SetBorderColours(UpDownDisplayedText)
+80642a60 TextUpDownValueControl::Get3rdAnimStartFrame(UpDownDisplayedText)
+80642a68 TextUpDownValueControl::Animate(UpDownDisplayedText)
+80642a70 TextUpDownValueControl::OnClick(UpDownDisplayedText)
+80642a78 TextUpDownValueControl::SetMessageAnimated(UpDownDisplayedText)
+80642a80 TextUpDownValueControl::SetMessage(UpDownDisplayedText)
+80642a88 TextUpDownValueControl::OnSelect(UpDownDisplayedText)
+80642a90 TextUpDownValueControl::InitText(UpDownDisplayedText)
+80642a98 TextUpDownValueControl::GetTextControl(UpDownDisplayedText)
+80642aa0 VoteControl::GetClassName
+80642aac VoteControl::__ct
+80642ae8 VoteControl::__dt
+80642b40 VoteControl::Load
+80642bec VoteControl::InitSelf
+80642ca0 VoteControl::OnUpdate
+80642ca4 VoteControl::Fill
+80642e14 VoteControl::AnimateSelect
+80642e68 VoteControl::AnimateDeselect
+80642ea0 VoteControl::AnimateChose
+80642efc VoteControl::AnimateFadeOut
+80642f58 VoteControl::IsAnimationShow
+80642f90 Pages::Vote::__ct
+806430bc Pages::Vote::__dt
+80643168 Pages::Vote::OnInit
+80643208 Pages::Vote::OnInit_switch
+8064320c Pages::Vote::OnInit_case58
+80643218 Pages::Vote::OnInit_case59
+80643220 Pages::Vote::OnInit_case5a
+806433c8 Pages::Vote::OnDispose
+806433cc Pages::Vote::BeforeEntranceAnimations
+806437e8 Pages::Vote::BeforeControlUpdate
+80643d24 Pages::Vote::BeforeControlUpdate_switch
+80643d28 Pages::Vote::BeforeControlUpdate_case58
+80643d30 Pages::Vote::BeforeControlUpdate_case59
+80643d38 Pages::Vote::BeforeControlUpdate_case5e
+80643d40 Pages::Vote::BeforeControlUpdate_case5f
+80643d48 Pages::Vote::BeforeControlUpdate_case60
+80643d50 Pages::Vote::BeforeControlUpdate_case61
+80643d58 Pages::Vote::BeforeControlUpdate_case62
+80643d60 Pages::Vote::BeforeControlUpdate_case63
+80643d68 Pages::Vote::BeforeControlUpdate_case64
+80643d70 Pages::Vote::BeforeControlUpdate_case65
+80643d78 Pages::Vote::BeforeControlUpdate_case66
+80643d80 Pages::Vote::BeforeControlUpdate_case67
+80643d84 Pages::Vote::BeforeControlUpdate_caseDefault
+80643e98 Pages::Vote::BeforeExitAnimations
+80643f18 Pages::Vote::GetNextPage
+80643f48 Pages::Vote::SetVotedCourseId
+80643f78 Pages::Vote::SetCourseButtonId_switch
+80643f7c Pages::Vote::SetCourseButtonId_case58
+80643f84 Pages::Vote::SetCourseButtonId_case59
+80643f88 Pages::Vote::SetCourseButtonId_case5a
+80643f8c Pages::Vote::FillVoteControl
+806441e8 Pages::Vote::StartRoulette
+80644430 Pages::Vote::FillVotesCounter
+806445a8 Pages::Vote::OnMessageBoxClick
+8064464c Pages::Vote::GetRuntimeTypeInfo
+80644658 VoteControl::GetRuntimeTypeInfo
+80644664 TriggerPtmf
+80644694 VotePage_cpp_sinit_
+806446b8 0x806446b8
+806446fc 0x806446fc
+80644764 0x80644764
+806447c0 0x806447c0
+806448b8 Page::EndExitState
+806448bc 0x806448bc
+806448c0 0x806448c0
+806449e8 0x806449e8
+806449f8 0x806449f8
+80644b50 0x80644b50
+80644bf0 0x80644bf0
+80644d58 0x80644d58
+80644e40 0x80644e40
+80645078 0x80645078
+80645110 0x80645110
+80645178 0x80645178
+80645348 0x80645348
+80645354 0x80645354
+8064535c 0x8064535c
+80645368 0x80645368
+80645398 0x80645398
+806453c8 0x806453c8
+806453e4 0x806453e4
+806453f0 0x806453f0
+8064542c 0x8064542c
+80645484 0x80645484
+80645524 0x80645524
+8064555c 0x8064555c
+80645594 0x80645594
+806455cc WifiAwardResultItem::GetClassName
+806455dc WifiAwardResultItem::__ct
+80645618 WifiAwardResultItem::__dt
+80645670 WifiAwardResultItem::Load
+806457e8 WifiAwardResultItem::InitSelf
+80645820 0x80645820
+80645bc8 Pages::WiFiVSResults::__ct
+80645c8c Pages::WiFiVSResults::__dt
+80645d28 Pages::WiFiVSResults::OnInit
+8064605c Pages::WiFiVSResults::OnActivate
+80646148 Pages::WiFiVSResults::BeforeEntranceAnimations
+8064615c Pages::WiFiVSResults::AfterEntranceAnimations
+806461b4 Pages::WiFiVSResults::BeforeExitAnimations
+806461c8 Pages::WiFiVSResults::AfterControlUpdate
+80646200 Pages::WiFiVSResults::OnClick
+8064620c 0x8064620c
+80646278 0x80646278
+806463a0 0x806463a0
+806465e0 0x806465e0
+80646750 Pages::WiFiVSResults::GetNextPage
+80646758 Pages::WiFiVSResults::GetRuntimeTypeInfo
+80646764 WifiAwardResultItem::GetRuntimeTypeInfo
+80646770 0x80646770
+8064677c TriggerPtmf
+806467ac WiFiVSResults_cpp_sinit_
+806467d4 Pages::WFCConnect::__ct
+80646850 Pages::WFCConnect::__dt
+806468b8 Pages::WFCConnect::OnInit
+80646924 Pages::WFCConnect::OnActivate
+80646dd4 Pages::WFCConnect::BeforeEntranceAnimations
+80646dd8 Pages::WFCConnect::AfterEntranceAnimations
+80646df8 Pages::WFCConnect::BeforeExitAnimations
+80646dfc Pages::WFCConnect::AfterExitAnimations
+80646e00 Pages::WFCConnect::OnDeactivate
+80646eb0 Pages::WFCConnect::AfterControlUpdate
+806474e8 Pages::WFCConnect::OnResume
+806478c4 Pages::WFCConnect::GetNextPage
+80647998 Pages::WFCConnect::IsHomeMenuWorking
+806479dc Pages::WFCConnect::SetText
+80647cec Pages::WFCConnect::GetTitleBMGId
+80647db8 Pages::WFCConnect::OnDisconnect
+80647ecc Pages::WFCDataStatement::__ct
+80647fe4 Pages::WFCDataStatement::__dt
+80648084 Pages::WFCDataStatement::OnInit
+80648220 Pages::WFCDataStatement::OnActivate
+806483c8 Pages::WFCDataStatement::SetType
+80648404 Pages::WFCDataStatement::OnButtonClick
+80648480 Pages::WFCDataStatement::OnBackPress
+806484a8 Pages::WFCAllowData::__ct
+80648610 Pages::WFCAllowData::__dt
+806486bc Pages::WFCAllowData::OnInit
+806488b4 Pages::WFCAllowData::OnActivate
+80648a24 Pages::WFCAllowData::OnResume
+80648afc Pages::WFCAllowData::OnButtonClick
+80648c9c Pages::WFCAllowData::OnBackButtonClick
+80648cb4 Pages::WFCAllowData::OnBackPress
+80648de8 Pages::WFCDisconnect::__ct
+80648e64 Pages::WFCDisconnect::__dt
+80648ecc Pages::WFCDisconnect::OnInit
+80648f28 Pages::WFCDisconnect::OnActivate
+80649124 Pages::WFCDisconnect::BeforeEntranceAnimations
+80649128 Pages::WFCDisconnect::BeforeExitAnimations
+8064912c Pages::WFCDisconnect::OnDeactivate
+806491dc Pages::WFCDisconnect::OnResume
+806491ec Pages::WFCDisconnect::OnYesNoYesClick
+806492cc Pages::WFCDisconnect::GetRuntimeTypeInfo
+806492d8 Pages::WFCAllowData::GetRuntimeTypeInfo
+806492e4 Pages::WFCDataStatement::GetRuntimeTypeInfo
+806492f0 Pages::WFCConnect::GetRuntimeTypeInfo
+806492fc TriggerPtmf
+8064932c TriggerPtmf
+8064935c TriggerPtmf
+8064938c TriggerPtmf
+806493bc TriggerPtmf
+806493ec TriggerPtmf
+8064941c TriggerPtmf
+8064944c WFCConnectPage_cpp_sinit_
+80649470 Pages::DisconnectMgr::__ct
+806494bc Pages::DisconnectMgr::__dt
+80649524 Pages::DisconnectMgr::OnInit
+80649590 Pages::DisconnectMgr::OnUpdate
+80649988 Pages::DisconnectError::__ct
+80649a14 Pages::DisconnectError::__dt
+80649a94 Pages::DisconnectError::OnInit
+80649b90 Pages::DisconnectError::OnActivate
+80649d18 Pages::DisconnectError::AfterControlUpdate
+80649d60 Pages::DisconnectError::BeforeEntranceAnimations
+80649d6c Pages::DisconnectError::IsHomeMenuWorking
+80649da4 Pages::DisconnectError::GetErrorBMGId
+80649fd8 Pages::DisconnectError::OnClick
+8064a04c Pages::DisconnectError::GetRuntimeTypeInfo
+8064a058 Pages::DisconnectMgr::GetRuntimeTypeInfo
+8064a064 TriggerPtmf
+8064a094 DisconnectPage_cpp_sinit_
+8064a0b0 Pages::LiveViewWaiting::__ct
+8064a10c Pages::LiveViewWaiting::__dt
+8064a198 Pages::LiveViewWaiting::OnInit
+8064a298 Pages::LiveViewWaiting::AfterControlUpdate
+8064a2d8 Pages::LiveViewWaiting::GetNextPage
+8064a324 Pages::LiveViewWaiting::BeforeExitAnimations
+8064a370 Pages::LiveViewWaiting::BeforeEntranceAnimations
+8064a3c8 Pages::LiveViewWaiting::AfterExitAnimations
+8064a3d4 Pages::LiveViewWaiting::GetRuntimeTypeInfo
+8064a3e0 LiveViewWaitingPage_cpp_sinit_
+8064a3f4 Pages::VR::__ct
+8064a4e0 Pages::VR::__dt
+8064a58c Pages::VR::OnInit
+8064a670 Pages::VR::OnInit_switch
+8064a674 Pages::VR::OnInit_case58
+8064a688 Pages::VR::OnInit_case59
+8064a698 Pages::VR::OnInit_case5a
+8064a84c Pages::VR::OnActivate
+8064a908 Pages::VR::OnActivate_switch
+8064a90c Pages::VR::OnActivate_case58
+8064a914 Pages::VR::OnActivate_case59
+8064a918 Pages::VR::OnActivate_case5a
+8064aac4 Pages::VR::AfterControlUpdate
+8064ab08 Pages::VR::FillVRControl
+8064ae6c Pages::VR::OnButtonClick
+8064aea8 Pages::VR::GetRuntimeTypeInfo
+8064aeb4 TriggerPtmf
+8064aee4 VRPage_cpp_sinit_
+8064aef8 Pages::Approve2PWFC::__ct
+8064af74 Pages::Approve2PWFC::__dt
+8064afdc Pages::Approve2PWFC::OnInit
+8064b048 Pages::Approve2PWFC::OnActivate
+8064b15c Pages::Approve2PWFC::BeforeEntranceAnimations
+8064b160 Pages::Approve2PWFC::BeforeExitAnimations
+8064b164 Pages::Approve2PWFC::OnResume
+8064b224 Pages::Approve2PWFC::GetNextPage
+8064b23c Pages::Approve2PWFC::OnApprove
+8064b2b4 FriendsStatusButton::GetClassName
+8064b2c0 FriendsStatusButton::__ct
+8064b2fc FriendsStatusButton::__dt
+8064b354 FriendsStatusButton::Load
+8064b444 FriendsStatusButton::InitSelf
+8064b450 FriendsStatusButton::OnUpdate
+8064b4c0 FriendsStatusButton::OnSelect
+8064b4c4 FriendsStatusButton::OnDeselect
+8064b4c8 FriendsStatusButton::UpdateFriendStatus
+8064b640 Pages::WFCMainMenu::__ct
+8064b850 Pages::WFCMainMenu::__dt
+8064b910 Pages::WFCMainMenu::OnInit
+8064bc90 Pages::WFCMainMenu::OnActivate
+8064bce8 Pages::WFCMainMenu::OnWorldwideButtonClick
+8064bdc4 Pages::WFCMainMenu::OnRegionalButtonClick
+8064bea0 Pages::WFCMainMenu::OnFriendsButtonClick
+8064bee4 Pages::WFCMainMenu::OnBackButtonClick
+8064bf4c Pages::WFCMainMenu::OnButtonSelect
+8064bfb8 Pages::WFCMainMenu::OnBackPress
+8064bfd8 Pages::WFCModeSelect::__ct
+8064c170 Pages::WFCModeSelect::__dt
+8064c220 Pages::WFCModeSelect::OnInit
+8064c4f8 Pages::WFCModeSelect::OnActivate
+8064c610 Pages::WFCModeSelect::OnModeButtonClick
+8064c718 Pages::WFCModeSelect::OnBackButtonClick
+8064c75c Pages::WFCModeSelect::OnModeButtonSelect
+8064c7b0 Pages::WFCModeSelect::OnBackPress
+8064c7c8 Pages::WFCFriendsMenu::__ct
+8064c9d8 Pages::WFCFriendsMenu::__dt
+8064ca98 Pages::WFCFriendsMenu::OnInit
+8064cf18 Pages::WFCFriendsMenu::OnActivate
+8064cff8 Pages::WFCFriendsMenu::OnDeactivate
+8064d0a0 Pages::WFCFriendsMenu::OnRosterButtonClick
+8064d1e8 Pages::WFCFriendsMenu::OnRegisterButtonClick
+8064d330 Pages::WFCFriendsMenu::OnCreateRoomClick
+8064d4f4 Pages::WFCFriendsMenu::OnBackButtonClick
+8064d5a0 Pages::WFCFriendsMenu::OnButtonSelect
+8064d60c Pages::WFCFriendsMenu::OnBackPress
+8064d660 Pages::WFCFriendsMenu::GetNextPage
+8064d668 Pages::WFCFriendsMenu::GetRuntimeTypeInfo
+8064d674 Pages::WFCModeSelect::GetNextPage
+8064d67c Pages::WFCModeSelect::GetRuntimeTypeInfo
+8064d688 Pages::WFCMainMenu::GetNextPage
+8064d690 Pages::WFCMainMenu::GetRuntimeTypeInfo
+8064d69c FriendsStatusButton::GetRuntimeTypeInfo
+8064d6a8 Pages::Approve2PWFC::GetRuntimeTypeInfo
+8064d6b4 TriggerPtmf
+8064d6e4 TriggerPtmf
+8064d714 TriggerPtmf
+8064d744 TriggerPtmf
+8064d774 TriggerPtmf
+8064d7a4 TriggerPtmf
+8064d7d4 TriggerPtmf
+8064d804 WFCMainMenuPage__cpp__sinit
+8064d834 Pages::WWRaceEndCountDown::__ct
+8064d888 Pages::WWRaceEndCountDown::__dt
+8064d908 Pages::WWRaceEndCountDown::OnInit
+8064d994 Pages::WWRaceEndCountDown::OnActivate
+8064db00 Pages::WWRaceEndCountDown::BeforeControlUpdate
+8064db4c FriendStatusButtonRaceAfter::GetClassName
+8064db5c 0x8064db5c
+8064db68 FriendStatusButtonRaceAfter::__ct
+8064dba4 FriendStatusButtonRaceAfter::__dt
+8064dbfc FriendStatusButtonRaceAfter::8064dbfc
+8064dd38 FriendStatusButtonRaceAfter::OnInit
+8064dd3c FriendStatusButtonRaceAfter::OnUpdate
+8064dd9c FriendStatusButtonRaceAfter::UpdateStatus
+8064dee8 Pages::WWRaceEnd::__ct
+8064e014 Pages::WWRaceEnd::__dt
+8064e0b0 Pages::WWRaceEnd::OnInit
+8064e3d8 Pages::WWRaceEnd::OnActivate
+8064e4dc Pages::WWRaceEnd::BeforeEntranceAnimations
+8064e4f0 Pages::WWRaceEnd::AfterControlUpdate
+8064e690 Pages::WWRaceEnd::OnContinueRaceClick
+8064e80c Pages::WWRaceEnd::OnFriendButtonClick
+8064e8ec Pages::WWRaceEnd::OnQuitClick
+8064e9d0 Pages::WWRaceEndQuit::__ct
+8064ea94 Pages::WWRaceEndQuit::__dt
+8064eb20 Pages::WWRaceEndQuit::OnInit
+8064ecb4 Pages::WWRaceEndQuit::OnDispose
+8064ed34 Pages::WWRaceEndQuit::OnActivate
+8064edf8 Pages::WWRaceEndQuit::OnDeactivate
+8064ee04 Pages::WWRaceEndQuit::AfterControlUpdate
+8064efa4 Pages::WWRaceEndQuit::OnYesButtonClick
+8064f124 Pages::WWRaceEndQuit::OnNoButtonClick
+8064f168 Pages::WWRaceEndWait::__ct
+8064f1b4 Pages::WWRaceEndWait::__dt
+8064f228 Pages::WWRaceEndWait::OnInit
+8064f26c Pages::WWRaceEndWait::OnInit_switch
+8064f270 Pages::WWRaceEndWait::OnInit_case_68
+8064f28c Pages::WWRaceEndWait::OnInit_case_69
+8064f320 Pages::WWRaceEndWait::OnActivate
+8064f374 Pages::WWRaceEndWait::AfterControlUpdate
+8064f424 Pages::WWRaceEndWait::AfterControlUpdate_switch
+8064f428 Pages::WWRaceEndWait::AfterControlUpdate_case_68
+8064f430 Pages::WWRaceEndWait::AfterControlUpdate_case_69
+8064f438 Pages::WWRaceEndWait::AfterControlUpdate_case_6c
+8064f440 Pages::WWRaceEndWait::AfterControlUpdate_case_6d
+8064f5b8 Pages::WWRaceEndWait::AfterControlUpdate_switch2D
+8064f5bc Pages::WWRaceEndWait::AfterControlUpdate_case2_70
+8064f5c4 Pages::WWRaceEndWait::AfterControlUpdate_case2_71
+8064f5cc Pages::WWRaceEndWait::AfterControlUpdate_case2_72
+8064f5d4 Pages::WWRaceEndWait::AfterControlUpdate_case2_73
+8064f5dc Pages::WWRaceEndWait::AfterControlUpdate_case2_74
+8064f5e4 Pages::WWRaceEndWait::AfterControlUpdate_case2_75
+8064f5ec Pages::WWRaceEndWait::AfterControlUpdate_case2_76
+8064f5f4 Pages::WWRaceEndWait::AfterControlUpdate_case2_77
+8064f65c 0x8064f65c
+8064f7ec 0x8064f7ec
+8064f8e0 0x8064f65c_switch
+8064f8e4 0x8064f65c_caseD_68
+8064f93c 0x8064f65c_caseD_6c
+8064f988 0x8064f65c_caseD_6a
+8064f9d8 Pages::DisableHomeButton::__ct
+8064fa1c Pages::DisableHomeButton::__dt
+8064fa84 Pages::DisableHomeButton::OnInit
+8064fae0 Pages::DisableHomeButton::IsHomeMenuWorking
+8064fae8 Pages::DisableHomeButton::GetRuntimeTypeInfo
+8064faf4 Pages::RaceEndWait::GetRuntimeTypeInfo
+8064fb00 Pages::WWRaceEndQuit::GetNextPage
+8064fb08 Pages::WWRaceEndQuit::GetRuntimeTypeInfo
+8064fb14 Pages::WWRaceEnd::GetNextPage
+8064fb1c Pages::WWRaceEnd::GetRuntimeTypeInfo
+8064fb28 FriendStatusButtonRaceAfter::GetRuntimeTypeInfo
+8064fb34 Pages::WWRaceEndCountDown::GetNextPage
+8064fb3c Pages::WWRaceEndCountDown::GetRuntimeTypeInfo
+8064fb48 TriggerPtmf
+8064fb78 TriggerPtmf
+8064fba8 WWRaceSupportingPages_cpp_sinit_
+8064fbdc Pages::SELECTStageMgr::__ct
+8064fc70 Pages::SELECTStageMgr::__dt
+8064fcfc Pages::SELECTStageMgr::OnInit
+8064fd54 Pages::SELECTStageMgr::OnInit_switch
+8064fd58 Pages::SELECTStageMgr::OnInit_case58
+8064fd64 Pages::SELECTStageMgr::OnInit_case60
+8064fd70 Pages::SELECTStageMgr::OnInit_case59
+8064fd7c Pages::SELECTStageMgr::OnInit_case62
+8064fd84 Pages::SELECTStageMgr::OnInit_case5a
+8064fe30 Pages::SELECTStageMgr::OnDispose
+8064fe34 Pages::SELECTStageMgr::OnActivate
+8064ff08 Pages::SELECTStageMgr::OnActivate_Pages::SELECTStageMgr::OnActivate_switch
+8064ff0c Pages::SELECTStageMgr::OnActivate_case58
+8064ff2c Pages::SELECTStageMgr::OnActivate_case59
+8064ff48 Pages::SELECTStageMgr::OnActivate_case5a
+80650018 Pages::SELECTStageMgr::OnActivate_switch2
+8065001c Pages::SELECTStageMgr::OnActivate_2case58
+806501d8 Pages::SELECTStageMgr::OnActivate_2case59
+806501f8 Pages::SELECTStageMgr::OnActivate_2case5a
+80650214 Pages::SELECTStageMgr::OnDeactivate
+80650218 Pages::SELECTStageMgr::BeforeControlUpdate
+80650274 Pages::SELECTStageMgr::AfterControlUpdate
+806507a0 Pages::SELECTStageMgr::OnResume
+806509ac Pages::SELECTStageMgr::OnResume_Pages::SELECTStageMgr::OnResume_switch
+806509b0 Pages::SELECTStageMgr::OnResume_case58
+806509b8 Pages::SELECTStageMgr::OnResume_case59
+806509bc Pages::SELECTStageMgr::OnResume_case5a
+80650af4 Pages::SELECTStageMgr::IsPublicBattle
+80650b24 Pages::SELECTStageMgr::IsPublicBattle_switch
+80650b28 Pages::SELECTStageMgr::IsPublicBattle_case58
+80650b30 Pages::SELECTStageMgr::IsPublicBattle_case59
+80650b38 Pages::SELECTStageMgr::IsPublicBattle_case5a
+80650b40 Pages::SELECTStageMgr::GetEngineClass
+80650b90 Pages::SELECTStageMgr::GetBattleType
+80650be0 Pages::SELECTStageMgr::GetInstructionBmgId
+80650c10 Pages::SELECTStageMgr::GetInstructionBmgId_switch
+80650c14 Pages::SELECTStageMgr::GetInstructionBmgId_case58
+80650c84 Pages::SELECTStageMgr::GetInstructionBmgId_case59
+80650ce4 Pages::SELECTStageMgr::GetInstructionBmgId_case60
+80650d54 Pages::SELECTStageMgr::GetInstructionBmgId_case61
+80650dc4 Pages::SELECTStageMgr::GetInstructionBmgId_case62
+80650dcc Pages::SELECTStageMgr::GetInstructionBmgId_case63
+80650dd4 Pages::SELECTStageMgr::GetInstructionBmgId_case5a
+80650ddc Pages::SELECTStageMgr::GetPlayerId
+80650e24 Pages::SELECTStageMgr::PrepareRace
+80650ee4 Pages::SELECTStageMgr::PrepareRace_switch
+80650ee8 Pages::SELECTStageMgr::PrepareRace_case58
+80650f08 Pages::SELECTStageMgr::PrepareRace_case60
+80650f28 Pages::SELECTStageMgr::PrepareRace_case61
+80650f48 Pages::SELECTStageMgr::PrepareRace_case59
+80650f68 Pages::SELECTStageMgr::PrepareRace_case62
+80650f84 Pages::SELECTStageMgr::PrepareRace_case5a
+80650fb4 Pages::SELECTStageMgr::PrepareRace_case5a_switch
+80650fb8 Pages::SELECTStageMgr::PrepareRace_2case58
+8065107c Pages::SELECTStageMgr::PrepareRace_2case59
+806510f4 Pages::SELECTStageMgr::PrepareRace_2case62
+80651120 Pages::SELECTStageMgr::PrepareRace_2case63
+8065114c Pages::SELECTStageMgr::PrepareRace_2case5a
+806515cc Pages::SELECTStageMgr::UpdateOnlineParams
+806517b0 Pages::SELECTStageMgr::OnDisconnect
+80651854 Pages::SELECTStageMgr::SetModeTypes
+80651898 Pages::SELECTStageMgr::SetModeTypes_switch
+8065189c Pages::SELECTStageMgr::SetModeTypes_case58
+806518b0 Pages::SELECTStageMgr::SetModeTypes_case59
+806518c4 Pages::SELECTStageMgr::SetModeTypes_case60
+80651900 Pages::SELECTStageMgr::SetModeTypes_case62
+8065190c Pages::SELECTStageMgr::SetModeTypes_case63
+80651914 Pages::SELECTStageMgr::SetModeTypes_loop
+8065193c 0x8065193c
+80651984 0x80651984
+80651a84 0x80651a84
+80651a90 0x80651a90
+80651ad0 0x80651ad0
+80651b1c 0x80651b1c
+80651ba8 Pages::SELECTStageMgr::IsHomeMenuWorking
+80651bb0 Pages::SELECTStageMgr::GetRuntimeTypeInfo
+80651bbc Pages::SELECTStageMgr::TriggerPtmf
+80651bec CountDownTimerPage_cpp_sinit_
+80651c00 WipeControl::GetClassName
+80651c0c WipeControl::__ct
+80651c48 WipeControl::__dt
+80651ca0 WipeControl::Load
+80651d54 WipeControl::InitSelf
+80651d8c WipeControl::OnUpdate
+80651e80 Pages::Wipe::__ct
+80651eec Pages::Wipe::__dt
+80651f78 Pages::Wipe::OnInit
+806522c4 Pages::Wipe::GetRuntimeTypeInfo
+806522d0 WipeControl::GetRuntimeTypeInfo
+806522dc WipePagecpp_sinit_
+80652300 Pages::YesNo::__ct
+806523a4 Pages::YesNo::__dt
+80652430 Pages::YesNo::OnInit
+806524c4 Pages::YesNo::OnActivate
+80652564 Pages::YesNo::AfterControlUpdate
+806525a0 Pages::YesNo::Reset
+806525fc Pages::YesNo::SetMessageBoxMsg
+80652604 Pages::YesNo::PrepareButton
+80652678 Pages::YesNo::OnButtonClick
+80652700 Pages::YesNo::SelectInitialButton
+80652774 Pages::YesNoPopUp::__ct
+8065284c Pages::YesNoPopUp::__dt
+806528fc Pages::YesNoPopUp::OnInit
+80652b48 Pages::YesNoPopUp::BeforeEntranceAnimations
+80652b8c Pages::YesNoPopUp::AfterExitAnimations
+80652bd0 Pages::YesNoPopUp::Container::GetClassName
+80652be0 Pages::YesNoPopUp::Container::__ct
+80652c1c Pages::YesNoPopUp::Container::__dt
+80652c74 Pages::YesNoPopUp::Container::Load
+80652ce8 Pages::YesNoPopUp::Reset
+80652d44 Pages::YesNoPopUp::Container::SetPositionAnim
+80652d7c Pages::YesNoFull::__ct
+80652e4c Pages::YesNoFull::__dt
+80652ef0 Pages::YesNoFull::OnInit
+806530d0 Pages::YesNoFull::Reset
+8065313c Pages::YesNoFull::SetTitleMsg
+80653144 Pages::YesNoFull::BeforeEntranceAnimations
+80653160 Pages::YesNoFull::AfterExitAnimations
+8065317c Pages::YesNoFull::GetRuntimeTypeInfo
+80653188 Pages::YesNoPopUp::GetRuntimeTypeInfo
+80653194 Pages::YesNoPopUp::Container::GetRuntimeTypeInfo
+806531a0 Pages::YesNo::GetRuntimeTypeInfo
+806531ac Pages::YesNo::TriggerPtmf
+806531dc YesNoPagecpp_sinit_
+80653208 RKNet::PacketMgr::CreateInstance
+80653284 RKNet::PacketMgr::DestroyInstance
+806532d8 RKNet::PacketMgr::Reset
+80653728 RKNet::PacketMgr::Update
+80653960 RKNet::PacketMgr::ExportRacedata
+80653abc RKNet::PacketMgr::GetRacedata
+80653c08 RKNet::PacketMgr::ExportRH2
+80653cb8 RKNet::PacketMgr::GetRH2
+80653d14 RKNet::PacketMgr::ClearSentRacedata
+80653d78 RKNet::PacketMgr::ClearSentRH2
+80653ddc RKNet::PacketMgr::ProcessPlayerDC
+80653df4 RKNet::PacketMgr::__ct
+80653e4c 0x80653e4c
+80653e8c 0x80653e8c
+80653ecc RKNet::PacketMgr::__dt
+80653f24 RKNet::PacketMgr::UpdateAsSpectator
+80654038 RKNet::PacketMgr::EveryoneIsConnected
+80654150 RKNet::PacketMgr::UpdateAsRacer
+806544a8 RKNet::PacketMgr::GetPlayerRH1Timer
+80654568 RKNet::PacketMgr::GetPlayerLagFrames
+806545dc RKNet::PacketMgr::GetMaxRH1Timer
+8065471c RKNet::PacketMgr::SetITEMItem
+80654734 RKNet::PacketMgr::IsITEMItemNew
+80654740 RKNet::PacketMgr::GetITEMStoredItem
+8065474c RKNet::PacketMgr::AddEVENTEntry
+80654758 RKNet::PacketMgr::HasFreeEVENTEntries
+80654810 RKNet::PacketMgr::GetEVENTFreeDataSpace
+80654820 RKNet::PacketMgr::IsPlayerConnected
+806548a8 RKNet::PacketMgr::IsPlayerLocal
+80654918 RKNet::PacketMgr::GetHudSlotId
+80654984 RKNet::PacketMgr::UpdateRaceinfoConnectionStatus
+80654a34 0x80654a34
+80654b00 RKNet::PacketMgr::ProcessLagFrames
+80654d08 RKNet::PacketMgr::CreateRH1AndExportRH1andUSERandRacedata
+80655164 RKNet::PacketMgr::CreateAndExportRH1andUSER
+806554a0 RKNet::PacketMgr::ProcessReceived
+8065574c RKNet::PacketMgr::UpdateAidsBitfield
+80655838 0x80655838
+8065584c 0x8065584c
+80655858 0x80655858
+806559ec 0x806559ec
+806559f0 0x806559f0
+80655b14 0x80655b14
+80655b1c 0x80655b1c
+80655b24 RKNet::Controller::CreateInstance
+80655bac RKNet::Controller::DestroyInstance
+80655c10 RKNet::Controller::Init
+806561a8 RKNet::Controller::ScheduleShutdown
+806561b4 RKNet::Controller::StartSearchWW
+80656270 RKNet::Controller::StartSearchRegion
+8065632c RKNet::Controller::StartSearchBTWW
+806563e8 RKNet::Controller::StartSearchBTRegional
+806564a4 RKNet::Controller::JoinFriend
+806565d4 0x806565d4
+80656704 RKNet::Controller::JoinRoom
+806567d8 RKNet::Controller::StartRoom
+80656898 RKNet::Controller::ResetRH1andROOM
+806568f0 0x806568f0
+80656908 0x80656908
+80656920 0x80656920
+806569b4 RKNet::Controller::GetErrorParams
+80656a30 RKNet::Controller::ResetErrorParams
+80656a8c RKNet::Controller::GetSubTickDiff
+80656aec RKNet::Controller::UpdateServersAsyncAlt
+80656b44 RKNet::Controller::UpdateServersAsync
+80656b6c RKNet::Controller::UpdateFriendsStatus
+80656ca0 RKNet::Controller::SetFriendsAddedBack
+80656d6c RKNet::Controller::SetFriendDeleted
+80656d9c RKNet::Controller::CanExchangeFriendData
+80656e44 RKNet::Controller::IsIdle
+80656e70 0x80656e70
+80656f00 RKNet::Controller::IsConnectedToAnyone
+80656f40 RKNet::Controller::ClearSplitSendRACEPointers
+80656ff8 RKNet::Controller::SetConnectionStateToFailed
+80657004 RKNet::Controller::__ct
+806573dc RKNet::FriendManager::__dt
+8065741c RKNet::Controller::__dt
+80657500 RKNet::Controller::MainNetworkLoop
+80657504 RKNet::Controller::MainLoop
+80657a70 RKNet::Controller::SendPacketsAndUpdateUSER
+80657ab0 RKNet::Controller::CombineSplitSendPackets
+80657e30 RKNet::Controller::TrySendNextRACEPacket
+80657fe4 RKNet::Controller::SendAidNextRACEPacket
+806580c4 RKNet::Controller::GetSplitSendPacketsTotalSize
+80658140 RKNet::Controller::SetConnectionState
+80658148 RKNet::Controller::GetConnectionState
+806581cc RKNet::Controller::HandleError
+8065832c RKNet::Controller::Alloc
+806583b4 RKNet::Controller::Free
+80658418 RKNet::Controller::SOAlloc
+80658498 RKNet::Controller::SOFree
+80658500 RKNet::Controller::DWCAlloc
+8065858c RKNet::Controller::DWCFree
+806585f4 RKNet::Controller::UserRecvCallback
+80658614 RKNet::Controller::LoginCallback
+80658718 RKNet::Controller::MatchedSCCallback
+80658768 RKNet::Controller::ConnectionAttemptCallback
+80658824 RKNet::Controller::ConnectionClosedCallback
+806588d8 RKNet::Controller::UpdateServerCallback
+806588fc RKNet::Controller::UpdateServerCallbackAlt
+80658918 RKNet::Controller::FriendStatusChangeCallback
+8065891c RKNet::Controller::BuddyFriendCallback
+80658928 RKNet::Controller::SetDWCRecvBuffers
+80658990 RKNet::Controller::ProcessPlayerDisconnect
+80658b9c RKNet::Controller::ConnectToWFC
+80658d3c RKNet::Controller::InitSubs
+80658de0 RKNet::Controller::UpdateSubsAndVR
+80658f80 RKNet::Controller::ResetFriendArray
+80659044 RKNet::Controller::StartMatching
+80659170 RKNet::Controller::ConnectToAnybodyAsync
+806595b8 RKNet::Controller::SetupGameServer
+8065961c 0x8065961c
+80659680 RKNet::Controller::ConnectToGameServerFromGroupId
+806598c4 0x806598c4
+80659a3c RKNet::Controller::CalcRACEPacketCRC32
+80659a84 RKNet::Controller::ProcessRACEPacket
+80659bc0 RKNet::Controller::UpdateAidsBelongingToPlayerIds
+80659d20 RKNet::Controller::ResetAidsBelongingToPlayerIds
+80659d58 RKNet::Controller::GetLocalPlayerId
+80659fa4 RKNet::Controller::GetFriendsSearchType
+8065a0b4 RKNet::Controller::UpdateStatusDatas
+8065a24c RKNet::PacketHolder::__ct
+8065a2ac RKNet::PacketHolder::__dt
+8065a30c RKNet::PacketHolder::Clear
+8065a34c RKNet::PacketHolder::Copy
+8065a38c RKNet::PacketHolder::Append
+8065a3dc RKNet::SplitRACEPointers::__ct
+8065a474 RKNet::SplitRACEPointers::__dt
+8065a4f8 RKNet::RatingRangeMaker::Init
+8065a5e0 RKNet::RatingRangeMaker::GetLowerRange
+8065a64c RKNet::RatingRangeMaker::GetUpperRange
+8065a6b4 0x8065a6b4
+8065a768 RKNet::RatingRangeMaker::GetRatingGroup
+8065a8d4 RKNet::GPReverseBuddiesListCallback
+8065a974 RKNet::SetGPError
+8065aa88 RKNet::ROOMHandler::CreateInstance
+8065ab4c RKNet::ROOMHandler::DestroyInstance
+8065ab8c RKNet::ROOMHandler::Init
+8065ac94 RKNet::ROOMHandler::Reset
+8065ad18 RKNet::ROOMHandler::Update
+8065ae70 RKNet::ROOMHandler::SetAllToSendPackets
+8065af64 RKNet::ROOMHandler::GetRecvPacket
+8065af74 RKNet::ROOMHandler::SetToSendPacket
+8065af84 RKNet::ROOMHandler::__ct
+8065b008 RKNet::ROOMHandler::__dt
+8065b048 RKNet::ROOMHandler::ExportROOMandUSER
+8065b194 RKNet::ROOMHandler::ImportNewPackets
+8065b260 RKNet::ROOMHandler::ResetAllPackets
+8065b2e0 RKNet::ROOMHandler::InitPacket
+8065b2ec RKNet::ROOMHandler::ClearToSendPacket
+8065b300 RKNet::ROOMHandler::ClearRecvPacket
+8065b314 RKNet::ROOMHandler::SetToSendPacket2
+8065b324 RKNet::ROOMHandler::SetRecvPacket
+8065b334 RKNet::ROOMHandler::GetToSendPacketPtr
+8065b344 RKNet::ROOMHandler::GetRecvPacketPtr
+8065b354 0x8065b354
+8065b3b8 0x8065b3b8
+8065b40c 0x8065b40c
+8065b450 0x8065b450
+8065b490 0x8065b490
+8065b4e8 RKNet::EVENTHandler::CreateInstance
+8065b600 RKNet::EVENTHandler::DestroyInstance
+8065b640 RKNet::EVENTHandler::__ct
+8065b72c 0x8065b72c
+8065b730 RKNet::EVENTHandler::Update
+8065b780 RKNet::EVENTHandler::AddEntry
+8065b998 RKNet::EVENTHandler::Reset
+8065ba8c RKNet::EVENTHandler::__dt
+8065bacc RKNet::EVENTHandler::FreeExpiredSendEntries
+8065bb94 RKNet::EVENTHandler::ExportSendEntries
+8065bce4 RKNet::EVENTHandler::ImportReceivedEntries
+8065be40 RKNet::EVENTHandler::ProcessReceivedEntries
+8065c04c RKNet::EVENTHandler::ResetEntry
+8065c078 RKNet::EVENTHandler::GetEventType
+8065c0b0 RKNet::EVENTHandler::SetEntryItemAndActionFromType
+8065c0c4 RKNet::EVENTHandler::ProcessEntry
+8065c0ec RKNet::ITEMHandler::CreateInstance
+8065c368 RKNet::ITEMHandler::DestroyInstance
+8065c3a8 RKNet::ITEMHandler::__ct
+8065c5e4 0x8065c5e4
+8065c5e8 RKNet::ITEMHandler::Update
+8065c6c0 RKNet::ITEMHandler::SetItem
+8065c74c RKNet::ITEMHandler::RemoveItem
+8065c7e0 RKNet::ITEMHandler::OnRouletteEnd
+8065c8cc 0x8065c8cc
+8065ca64 0x8065ca64
+8065cc2c 0x8065cc2c
+8065cdf4 RKNet::ITEMHandler::GetModeRelatedInt
+8065cec0 0x8065cec0
+8065cfc4 RKNet::ITEMHandler::SetItemAndMode
+8065d020 0x8065d020
+8065d0e0 RKNet::ITEMHandler::SetDraggedItemAndMode
+8065d13c 0x8065d13c
+8065d21c RKNet::ITEMHandler::GetStoredItem
+8065d2b0 RKNet::ITEMHandler::GetDraggedItem
+8065d364 RKNet::ITEMHandler::GetStoredItemMode
+8065d3f8 RKNet::ITEMHandler::GetDraggedItemMode
+8065d4ac RKNet::ITEMHandler::GetTimer
+8065d55c RKNet::ITEMHandler::IsPlayerConnected
+8065d568 RKNet::ITEMHandler::IsItemNew
+8065d608 RKNet::ITEMHandler::IsDraggingItem
+8065d6e4 RKNet::ITEMHandler::HasStartedDraggingItem
+8065d9f0 0x8065d9f0
+8065dc2c RKNet::ITEMHandler::__dt
+8065dc6c RKNet::ITEMHandler::ExportSendPackets
+8065dd3c RKNet::ITEMHandler::ImportNewPackets
+8065e0a0 RKNet::ITEMHandler::UpdateItemStatusAndSums
+8065e644 RKNet::ITEMHandler::AcknowledgeAid
+8065e8a8 RKNet::ITEMHandler::UpdateLocalPlayersItems
+8065e938 RKNet::ITEMHandler::UpdateStoredItem
+8065ed74 RKNet::ITEMHandler::UpdateDraggedItem
+8065f068 RKNet::ITEMHandler::UpdateLocalPlayers
+8065f6dc RKNet::ItemHandler::GetStoredItemCount
+8065f9cc 0x8065f9cc
+8065fa0c 0x8065fa0c
+8065fa4c 0x8065fa4c
+8065fb6c 0x8065fb6c
+8065fe4c 0x8065fe4c
+8065fe8c RKNet::SELECTHandler::CreateInstance
+8065ff60 RKNet::SELECTHandler::DestroyInstance
+8065ffa4 RKNet::SELECTHandler::InitPackets
+806602f8 0x806602f8
+806602fc RKNet::SELECTHandler::Update
+80660434 RKNet::SELECTHandler::GetWinningVoter
+80660450 RKNet::SELECTHandler::GetWinningCourse
+80660470 RKNet::SELECTHandler::GetOwnSelectId
+8066048c RKNet::SELECTHandler::GetEngineClass
+806604a8 RKNet::SELECTHandler::GetBattleType
+806604cc RKNet::SELECTHandler::GetOwnPlayerIdToAid
+806604d4 RKNet::SELECTHandler::GetCharacterId
+80660524 RKNet::SELECTHandler::GetKartId
+80660574 RKNet::SELECTHandler::GetCourseVote
+806605c4 RKNet::SELECTHandler::GetPlayerData
+8066060c RKNet::SELECTHandler::GetStarRank
+80660654 RKNet::SELECTHandler::GetTeam
+8066068c RKNet::SELECTHandler::HasUnprocessedPackets
+80660710 RKNet::SELECTHandler::IsPrepared
+80660750 RKNet::SELECTHandler::SetPlayerData
+8066076c RKNet::SELECTHandler::__ct
+806607f4 RKNet::SELECTHandler::__dt
+806608b4 RKNet::SELECTHandler::ResetSendPacket
+80660a00 RKNet::SELECTHandler::ResetReceivedPackets
+80660af4 RKNet::SELECTHandler::ResetPacket
+80660bd0 RKNet::SELECTHandler::ResetPlayerData
+80660c3c RKNet::SELECTHandler::HandleReceivedPacketTimes
+80660d2c RKNet::SELECTHandler::IsBattle
+80660d40 RKNet::SELECTHandler::IsTrackDecided
+80660d5c RKNet::SELECTHandler::EveryoneHasAccurateRaceSettings
+80660dcc RKNet::SELECTHandler::EveryoneHasVoted
+80660e3c RKNet::SELECTHandler::EveryoneHasAccurateAidPidMap
+80660eb0 RKNet::SELECTHandler::ClearRH1ReceivedBuffers
+80660f1c RKNet::SELECTHandler::PrepareAndExportSELECTandUSER
+80661078 RKNet::SELECTHandler::ImportNewPackets
+80661288 RKNet::SELECTHandler::PrepareAndExportPacket
+806614b0 RKNet::SELECTHandler::ProcessNewPacketVoting
+80661934 RKNet::SELECTHandler::DecideBattleTypeAndTeams
+80661a14 RKNet::SELECTHandler::GenerateOwnSELECTId
+80661a5c RKNet::SELECTHandler::DecideEngineClass
+80661ce8 RKNet::SELECTHandler::DecideTrack
+80662034 RKNet::SELECTHandler::AllocatePlayerIdsToAids
+806621dc RKNet::SELECTHandler::HasMatchingPlayerIdToAid
+80662290 RKNet::SELECTHandler::DecidePublicTeams
+80662588 RKNet::SELECTHandler::DecidePrivateTeams
+80662778 RKNet::USERHandler::CreateInstance
+806627f8 RKNet::USERHandler::DestroyInstance
+8066284c RKNet::USERHandler::Prepare
+80662944 RKNet::USERHandler::Reset
+806629c0 RKNet::USERHandler::Update
+80662abc RKNet::USERHandler::CopySendToPacketHolder
+80662b00 RKNet::USERHandler::ProcessPlayerDisconnect
+80662bec 0x80662bec
+80662c58 0x80662c58
+80662c68 0x80662c68
+80662c88 0x80662c88
+80662d20 0x80662d20
+80662d80 RKNet::USERHandler::SetSendVR
+80662dc4 RKNet::USERHandler::SetSendBR
+80662e08 RKNet::USERHandler::__ct
+80662e64 RKNet::USERHandler::__dt
+80662ebc RKNet::USERHandler::ImportNewPackets
+80662fb8 0x80662fb8
+8066300c RKNet::USERHandler::CreateSendPacket
+80663194 RKNet::FriendMgr::CreateInstance
+806632bc RKNet::FriendMgr::DestroyInstance
+806632fc RKNet::FriendMgr::ReadDataFromRKSYS
+80663444 RKNet::FriendMgr::Update
+806635a8 RKNet::FriendMgr::CreateAccUserData
+806635b0 RKNet::FriendMgr::CheckAccUserData
+806635e0 RKNet::FriendMgr::IsAccUserDataDirt
+80663610 RKNet::FriendMgr::ClearAccUserDataDirtyFlag
+80663618 RKNet::FriendMgr::CreateFriendCode
+80663644 RKNet::FriendMgr::SetCodesForUnusedIdxs
+8066374c RKNet::FriendMgr::IsAvailable
+8066375c RKNet::FriendMgr::IsBuddyFriend
+80663794 RKNet::FriendMgr::IsValidFriend
+806637c4 RKNet::FriendMgr::CheckFriendCode
+806637fc RKNet::FriendMgr::GetFriendIdx
+80663874 RKNet::FriendMgr::GetFriendCodeLicenseIdx
+80663918 RKNet::FriendMgr::GetLicenseFriendCode
+80663940 RKNet::FriendMgr::GetFirstFreeFriendIdx
+806639a0 RKNet::FriendMgr::__ct
+80663aa4 RKNet::RH1Handler::CreateInstance
+80663c38 RKNet::RH1Handler::DestroyInstance
+80663c7c RKNet::RH1Handler::Activate
+80663c88 RKNet::RH1Handler::Reset
+80663dd4 RKNet::RH1Handler::Update
+8066410c RKNet::RH1Handler::Reset
+806641b0 RKNet::RH1Handler::HasValidCourse
+806643c0 RKNet::RH1Handler::GetKart
+806643d8 RKNet::RH1Handler::GetCharacter
+806643f0 0x806643f0
+8066454c RKNet::RH1Handler::GetStarRank
+80664560 RKNet::RH1Handler::GetValidCourse
+806646c8 0x806646c8
+806647d0 RKNet::RH1Handler::GetPlayerCount
+80664944 RKNet::RH1Handler::GetSELECTId
+80664a3c RKNet::RH1Handler::GetEngineClass
+80664b34 RKNet::RH1Handler::GetAidsBelongingToPlayer
+80664c2c 0x80664c2c
+80664d9c RKNet::RH1Handler::__dt
+80664f00 0x80664f00
+80664ff8 0x80664ff8
+8066506c 0x8066506c
+806651b4 RKNet::RH1Handler::ImportNewPackets
+80665334 0x80665334
+806653c8 RKNet::RH1Handler::ExportDefaultPacket
+80665480 RKNet::RH1Handler::ExportDefaultPacket2
+80665538 0x80665538
+80665660 0x80665660
+80665700 0x80665700
+8066588c 0x8066588c
+8066591c 0x8066591c
+8066596c 0x8066596c
+80665998 0x80665998
+806659b0 0x806659b0
+80665a2c 0x80665a2c
+80665a4c 0x80665a4c
+80665a90 0x80665a90
+80665af8 0x80665af8
+80665b6c 0x80665b6c
+80665bf4 Page::EndExitState
+80665bf8 0x80665bf8
+80665bfc 0x80665bfc
+80665c24 0x80665c24
+80665c3c 0x80665c3c
+80665fec 0x80665fec
+806660e0 0x806660e0
+8066617c 0x8066617c
+80666288 0x80666288
+80666408 0x80666408
+806665cc 0x806665cc
+806665e4 0x806665e4
+8066664c 0x8066664c
+80666694 0x80666694
+806666a0 0x806666a0
+806666ac 0x806666ac
+806666b8 0x806666b8
+806666e8 0x806666e8
+80666718 0x80666718
+80666748 0x80666748
+80666768 0x80666768
+80666880 0x80666880
+80666920 0x80666920
+80666aac 0x80666aac
+80666b00 0x80666b00
+80666b18 0x80666b18
+80666b94 0x80666b94
+80666bb4 0x80666bb4
+80666bc4 0x80666bc4
+80666c20 0x80666c20
+80666c94 0x80666c94
+80666de8 0x80666de8
+80666dec 0x80666dec
+80666ee4 0x80666ee4
+80666f7c 0x80666f7c
+80666fec 0x80666fec
+8066704c 0x8066704c
+806670e4 0x806670e4
+8066711c 0x8066711c
+80667150 0x80667150
+80667234 0x80667234
+80667294 0x80667294
+806672a4 0x806672a4
+806674b4 0x806674b4
+80667598 0x80667598
+80667870 0x80667870
+80667a48 0x80667a48
+80667a4c 0x80667a4c
+80667a50 0x80667a50
+80667bb4 0x80667bb4
+80667cac 0x80667cac
+80667db8 0x80667db8
+80667ec0 0x80667ec0
+80667efc 0x80667efc
+80667f0c 0x80667f0c
+80667f24 0x80667f24
+80667f70 0x80667f70
+80667fe4 0x80667fe4
+80668078 0x80668078
+80668080 0x80668080
+806681b4 Page::EndExitState
+806681b8 0x806681b8
+806681bc 0x806681bc
+806684f4 0x806681bc_switch
+806684f8 0x806681bc_switch_806684f4::CaseD_1
+80668500 0x806681bc_switch_806684f4::CaseD_2
+80668508 0x806681bc_switch_806684f4::CaseD_3
+80668510 0x806681bc_switch_806684f4::CaseD_4
+80668518 0x806681bc_switch_806684f4::CaseD_5
+80668520 0x806681bc_switch_806684f4::CaseD_6
+80668528 0x806681bc_switch_806684f4::CaseD_8
+80668530 0x806681bc_switch_806684f4::CaseD_7
+80668558 0x806681bc_caseD_0
+806685d8 0x806685d8
+806686c0 0x806686c0
+806686c8 0x806686c8
+806686d4 0x806686d4
+806686e0 0x806686e0
+806686ec 0x806686ec
+806686f8 0x806686f8
+80668728 0x80668728
+80668758 0x80668758
+80668788 0x80668788
+806687b8 0x806687b8
+806687e8 0x806687e8
+80668814 ServerMgr::__dt
+8066895c 0x8066895c
+806689b8 ServerMgr::DestroyInstance
+80668ab4 ServerMgr::CreateInstance
+80668b18 ServerMgr::__ct
+80668cb0 0x80668cb0
+80668cd4 0x80668cd4
+80668d14 0x80668d14
+80668d7c 0x80668d7c
+80668e80 0x80668e80
+80668f4c 0x80668f4c
+80668f60 0x80668f60
+80668fa4 ServerMgr::GetServerState
+80668fac ServerMgr::GetState
+80668fb4 0x80668fb4
+80668fd0 0x80668fd0
+80668fdc ServerMgr::GetError
+80668fe4 ServerMgr::CountFriendsToInviteViaMsgBoard
+806690f8 0x806690f8
+80669100 0x80669100
+80669108 0x80669108
+80669264 ServerMgr::Update
+806692a4 ServerMgr::Update_switch
+806692a8 ServerMgr::Update_caseD_1
+806692cc ServerMgr::Update_caseD_8
+806692d4 ServerMgr::Update_caseD_16
+806692dc ServerMgr::Update_caseD_9
+806693f4 ServerMgr::Update_caseD_3
+80669720 ServerMgr::Update_caseD_0
+80669734 0x80669734
+80669858 0x80669858
+80669c74 0x80669c74
+80669cb4 0x80669cb4
+80669cf4 BundleSortProc
+80669d04 0x80669d04
+80669d0c 0x80669d0c
+80669de8 0x80669d0c_switch
+80669dec 0x80669d0c_caseD_0
+80669e5c 0x80669d0c_caseD_1
+8066a050 0x80669d0c_caseD_2
+8066a118 0x80669d0c_caseD_3
+8066a1d8 0x80669d0c_caseD_4
+8066a3a4 0x80669d0c_caseD_5
+8066a440 0x80669d0c_caseD_6
+8066a7bc 0x80669d0c_caseD_7
+8066aa74 0x80669d0c_caseD_8
+8066aad8 0x80669d0c_caseD_9
+8066ad28 0x80669d0c_caseD_a
+8066ad9c 0x8066ad9c
+8066afac 0x8066afac
+8066b2d0 0x8066b2d0
+8066b418 0x8066b418
+8066b4bc ServerMgr::GetRKG
+8066b5f0 0x8066b5f0
+8066b84c 0x8066b84c
+8066b8b8 0x8066b8b8
+8066bcc0 0x8066bcc0
+8066bdb4 0x8066bdb4
+8066bddc 0x8066bddc
+8066c06c 0x8066c06c
+8066c17c ServerMgr::CheckNWC24Available
+8066c188 0x8066c188
+8066c2e8 0x8066c2e8
+8066c390 0x8066c390
+8066c420 0x8066c420
+8066c4bc 0x8066c4bc
+8066c528 ServerMgr::HasCourseNewFriendRecord
+8066c618 0x8066c618
+8066c66c 0x8066c66c
+8066c7f8 0x8066c7f8
+8066c874 0x8066c874
+8066c8d8 ServerMgr::GetCompetitionInfo
+8066ca04 0x8066ca04
+8066ca54 0x8066ca54
+8066ca64 0x8066ca64
+8066cb30 ServerMgr::GetSpecialGhostInfo
+8066cb4c 0x8066cb4c
+8066cbcc 0x8066cbcc
+8066d35c 0x8066d35c
+8066d668 0x8066d668
+8066d734 0x8066d734
+8066d7f4 0x8066d7f4
+8066dad0 0x8066dad0
+8066dbbc 0x8066dbbc
+8066dd48 0x8066dd48
+8066dd94 0x8066dd94
+8066e048 0x8066e048
+8066e160 0x8066e160
+8066e35c 0x8066e35c
+8066e4b0 0x8066e4b0
+8066e654 0x8066e654
+8066e844 0x8066e844
+8066e910 0x8066e910
+8066ea80 0x8066ea80
+8066eb5c 0x8066eb5c
+8066ec2c 0x8066ec2c
+8066eeb4 0x8066eeb4
+8066ef64 0x8066ef64
+8066f0cc 0x8066f0cc
+8066f16c 0x8066f16c
+8066f2c4 0x8066f2c4
+8066f4ac 0x8066f4ac
+8066f590 0x8066f590
+8066f8bc 0x8066f8bc
+8066fa48 0x8066fa48
+8066fbc8 0x8066fbc8
+8066fe0c 0x8066fe0c
+8066ffa4 0x8066ffa4
+80670248 0x80670248
+806706ac 0x806706ac
+80670c08 0x80670c08
+80671000 0x80671000
+8067120c 0x8067120c
+80671314 0x80671314
+80671390 0x80671390
+80671440 0x80671440
+80671588 0x80671588
+8067160c 0x8067160c
+80671770 0x80671770
+80671848 0x80671848
+80671b4c 0x80671b4c
+80671c7c ServerMgr::PublishMsgBoardAsync
+80671df8 ServerMgr::PublishMsgBoard
+806720d0 ServerMgr::InitCHJObj
+80672324 0x80672324
+8067233c 0x8067233c
+80672350 ServerMgr::RequestMsgBoardPublish
+806724a0 0x806724a0
+80672620 0x80672620
+8067268c 0x8067268c
+80672840 0x80672840
+80672a00 0x80672a00
+80672b3c 0x80672b3c
+80672cc8 0x80672cc8
+80672e14 0x80672e14
+806730e4 0x806730e4
+80673170 0x80673170
+80673218 0x80673218
+806732c8 0x806732c8
+80673568 0x80673568
+806738d0 0x806738d0
+80673a40 0x80673a40
+80673a9c 0x80673a9c
+80673bec 0x80673bec
+80673d3c 0x80673d3c
+80673e8c 0x80673e8c
+80674000 0x80674000
+80674154 0x80674154
+806742d4 0x806742d4
+80674518 0x80674518
+80674658 0x80674658
+80674794 0x80674794
+8067482c 0x8067482c
+8067495c 0x8067495c
+80674a38 0x80674a38
+80674ae4 0x80674ae4
+80674b60 0x80674b60
+80674bcc 0x80674bcc
+80674c38 0x80674c38
+80674c88 0x80674c88
+80674dd0 0x80674dd0
+80674f08 0x80674f08
+8067507c 0x8067507c
+806750f0 0x806750f0
+8067512c ServerMgr::CreateRKGFromRKG
+80675230 ServerMgr::CheckGhostDataValidity
+80675304 0x80675304
+80675384 0x80675384
+8067538c 0x8067538c
+80675444 0x80675444
+80675454 0x80675454
+8067552c 0x8067552c
+80675624 0x80675624
+8067568c 0x8067568c
+806756a4 0x806756a4
+806756c8 0x806756c8
+806756d0 0x806756d0
+80675724 0x80675724
+80675848 0x80675848
+80675ad4 0x80675ad4
+80675b80 0x80675b80
+80675e48 0x80675e48
+80675f6c 0x80675f6c
+806760d0 0x806760d0
+806760dc 0x806760dc
+80676130 0x80676130
+80676184 0x80676184
+806761c8 0x806761c8
+806761d0 0x806761d0
+80676220 0x80676220
+80676228 0x80676228
+80676248 0x80676248
+80676288 0x80676288
+806762d4 0x806762d4
+806763e4 0x806763e4
+8067643c 0x8067643c
+80676548 0x80676548
+806766b4 0x806766b4
+80676860 0x80676860
+8067686c 0x8067686c
+80676904 0x80676904
+80676970 0x80676970
+8067697c 0x8067697c
+80676990 0x80676990
+806771cc 0x806771cc
+806771f8 0x806771f8
+8067721c 0x8067721c
+80677228 0x80677228
+80677230 0x80677230
+80677238 0x80677238
+80677240 0x80677240
+80677380 0x80677380
+806773c8 0x806773c8
+80677444 0x80677444
+806775e4 0x806775e4
+806776b0 0x806776b0
+80677758 0x80677758
+80677880 0x80677880
+8067790c 0x8067790c
+80677990 0x80677990
+80677a8c 0x80677a8c
+80677b64 0x80677b64
+80677bf4 0x80677bf4
+80677ce8 0x80677ce8
+80677d80 0x80677d80
+80677e64 0x80677e64
+80677f64 0x80677f64
+80677fb0 0x80677fb0
+8067805c 0x8067805c
+806781dc 0x806781dc
+80678298 0x80678298
+80678318 0x80678318
+80678384 0x80678384
+806783e8 0x806783e8
+806783fc 0x806783fc
+806784a4 0x806784a4
+8067858c 0x8067858c
+80678628 0x80678628
+80678640 0x80678640
+8067866c 0x8067866c
+80678678 0x80678678
+80678680 0x80678680
+80678740 0x80678740
+8067884c 0x8067884c
+80678850 0x80678850
+806789b4 0x806789b4
+80678a28 0x80678a28
+80678aac 0x80678aac
+80678b78 0x80678b78
+80678e94 0x80678e94
+80678f4c 0x80678f4c
+80678fcc 0x80678fcc
+80679024 0x80679024
+8067906c 0x8067906c
+80679078 0x80679078
+80679080 0x80679080
+80679088 0x80679088
+8067909c 0x8067909c
+8067927c 0x8067927c
+8067937c thunk_0x801de348
+80679380 0x80679380
+80679390 0x80679390
+80679568 0x80679568
+80679720 0x80679720
+80679aa8 0x80679aa8
+80679c6c 0x80679c6c
+80679ef4 0x80679ef4
+8067a0b8 0x8067a0b8
+8067a29c 0x8067a29c
+8067a480 0x8067a480
+8067a58c 0x8067a58c
+8067a7b0 0x8067a7b0
+8067a8bc 0x8067a8bc
+8067ac00 0x8067ac00
+8067ac44 0x8067ac44
+8067acac 0x8067acac
+8067ad34 0x8067ad34
+8067ad3c 0x8067ad3c
+8067ae40 Page::EndExitState
+8067ae44 0x8067ae44
+8067ae48 0x8067ae48
+8067b12c 0x8067ae48_switch
+8067b130 0x8067ae48_switch_8067b12c::CaseD_1
+8067b138 0x8067ae48_switch_8067b12c::CaseD_2
+8067b140 0x8067ae48_switch_8067b12c::CaseD_3
+8067b148 0x8067ae48_switch_8067b12c::CaseD_4
+8067b150 0x8067ae48_switch_8067b12c::CaseD_5
+8067b158 0x8067ae48_switch_8067b12c::CaseD_6
+8067b160 0x8067ae48_switch_8067b12c::CaseD_8
+8067b168 0x8067ae48_switch_8067b12c::CaseD_7
+8067b190 0x8067ae48_caseD_0
+8067b210 0x8067b210
+8067b2f8 Effects::Mgr::GetRuntimeTypeInfo
+8067b304 EffectsMgrcpp_sinit_
+8067b318 Effects::MGWhiteFog::__ct
+8067b388 Effects::MGWhiteFog::__dt
+8067b3c8 Effects::MGWhiteFog::Update
+8067b448 Effects::MGWhiteFog::UpdateEffect
+8067b4b4 Effects::MGWhiteFog::Kill
+8067b4c8 Effects::Mgr::CreateInstance
+8067b580 Effects::Mgr::Init
+8067b8f0 Effects::Mgr::Reset
+8067baf4 Effects::Sub9d8::__dt
+8067bb34 Effects::Mgr::LoadRaceEffects
+8067c4f4 Effects::Mgr::CreatePlayerEffects
+8067c580 Effects::Mgr::CreateEffects::Items
+8067c5c0 Effects::Mgr::LoadObjectEffect
+8067c9e4 0x8067c9e4
+8067ca4c Effects::Mgr::InitRace
+8067cb88 Effects::Mgr::Update
+8067cc24 0x8067cc24
+8067cca0 Effects::Mgr::CalcPlayerEffects
+8067ce44 Effects::Mgr::UpdatePlayersVisibility
+8067cf74 Effects::Mgr::Draw
+8067d6f4 0x8067d6f4
+8067d90c 0x8067d90c
+8067da54 Object::GetClipInfo
+8067da5c Effects::Mgr::UpdatePlayerFromWheelCollision
+8067da78 Effects::Mgr::UpdatePlayerFromKartCollision
+8067daa8 Effects::Mgr::GetMenuEffectByIdx
+8067dab0 Effects::Mgr::CalcEffect1
+8067dad0 Effects::Mgr::DrawEffect1
+8067daf4 Effects::Mgr::DrawSelfItem
+8067dca4 0x8067dca4
+8067dcc0 Effects::Mgr::IsEveryoneLookingForwards
+8067dd1c Effects::Mgr::IsMTOrPlayer0xF4
+8067dd58 0x8067dd58
+8067de14 Effects::Sub9d8::Update
+8067e0bc 0x8067e0bc
+8067e230 0x8067e230
+8067e270 dGeomEnable
+8067e280 0x8067e280
+8067e384 ObjectCollidable::__dt
+8067e3c4 Object::__dt
+8067e404 Objects::FlamePoleEff::OnStart
+8067e410 Objects::FlamePoleEff::Update
+8067e5c8 0x8067e5c8
+8067e670 0x8067e670
+8067e6ec 0x8067e6ec
+8067e6f4 Objects::FlamePole::__ct
+8067eaec Vec3::EulerFromMatrix
+8067eafc ObjectExternKCL::__dt
+8067eb3c ObjectKCL::__dt
+8067eb7c 0x8067eb7c
+8067ebe0 Objects::FlamePole::__dt
+8067ec94 Objects::FlamePole::OnStart
+8067ef70 Objects::FlamePole::OnUpdate
+8067f240 Objects::FlamePole::UpdateModelMatrix
+8067f2dc 0x8067f2dc
+8067f2f0 0x8067f2f0
+8067f2f4 Objects::FlamePole::CalcOtherEntityDistance
+8067f484 0x8067f484
+8067f538 0x8067f538
+8067f544 0x8067f544
+8067f5ec 0x8067f5ec
+8067f604 0x8067f604
+8067f650 0x8067f650
+8067f6ac 0x8067f6ac
+8067f6b0 0x8067f6b0
+8067f6b4 0x8067f6b4
+8067f6b8 0x8067f6b8
+8067f7c8 0x8067f7c8
+8067f864 0x8067f864
+8067f868 0x8067f868
+8067f8e4 0x8067f8e4
+8067fa8c 0x8067fa8c
+8067fbb8 Objects::FlamePole::GetTransformationMatrix
+8067fc50 0x8067fc50
+8067fdf4 0x8067fdf4
+8067fe1c Objects::FlamePole::UpdateOtherEntityPosWithRot
+8067fe88 Objects::FlamePole::IsCollidingNoTriangleCheckImpl
+80680218 0x80680218
+806805a8 ObjectEffect::__dt
+80680600 Object::DoCalcShadowMtx
+80680608 Object::vf_0xa8
+80680610 Object::IsLodDisabled
+80680618 Object::GetEntity
+80680620 Object::vf_0x84
+80680628 Object::GetShadowListIdx
+80680630 Object::UpdateShadowScale
+8068065c Object::UpdateModelScale
+806806cc Object::GetShadowResName
+806806d4 Object::GetLowResourceName
+806806dc Object::GetSubFileName
+80680730 Object::GetBRRESName
+80680784 Object::GetName
+806807d8 do_nothing_7d8
+806807dc do_nothing_7dc
+806807e0 ObjectKCL::GetScnObjDrawOptionsIdx
+806807e8 ObjectExternKCL::UpdateKCL
+806807f0 ObjectExternKCL::IsCollidingNoTerrainInfo
+806808ec ObjectExternKCL::HasCurrentCollision
+806808f4 ObjectExternKCL::vf_0x13c
+806808fc ObjectExternKCL::IsCollidingAddEntryNoTerrainInfo
+806809f8 ObjectExternKCL::HasCollision
+80680a00 ObjectExternKCL::IsDriveable
+80680a08 ObjectExternKCL::vf_0xfc
+80680b04 ObjectExternKCL::IsCollidingAddEntry
+80680b14 ObjectExternKCL::IsCollidingNoTerrainInfo(no radius)
+80680bcc ObjectExternKCL::IsCollidingAddEntryNoTerrainInfo(no radius)
+80680c84 ObjectExternKCL::vf_0xec
+80680d3c ObjectExternKCL::IsCollidingAddEntry(no radius)
+80680df4 ObjectExternKCL::IsCollidingNoTerrainInfoNoTriangleCheck
+80680ef0 ObjectExternKCL::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+80680fec ObjectExternKCL::IsColliding
+806810e8 ObjectExternKCL::IsCollidingAddEntryNoTriangleCheck
+806810f8 ObjectExternKCL::vf_0xc0
+806811b0 ObjectExternKCL::vf_0xc4
+80681268 ObjectExternKCL::vf_0xc8
+80681320 ObjectExternKCL::vf_0xcc
+806813d8 ObjectExternKCL::UpdateOtherEntityPos
+8068142c ObjectExternKCL::SetObjInfoCalcBit
+8068143c ObjectExternKCL::GetPeriod
+80681448 ObjectExternKCL::GetPosition
+80681450 ObjectExternKCL::UpdateDiffPosVector
+8068147c ObjectExternKCL::vf_0xb4
+80681490 ObjectExternKCL::UpdateCollision
+806814a4 Objects::FlamePole::vf__0x11c
+806814b0 Objects::FlamePole::vf_0x108
+806814bc Objects::FlamePole::AreItemsAllowed
+806814c4 Objects::FlamePole::GetCollisionDiameter
+80681508 Objects::FlamePole::LoadAnimations
+80681588 0x80681588
+80681590 Objects::FlamePole::GetPropertiesBitfield
+80681598 Object::GetPosition
+806815a0 ObjectCollidable::GetCollisionDiameter
+806816b8 ObjectCollidable::GetSolidityCenter
+806816d8 ObjectCollidable::InitEntity
+80681734 ObjectCollidable::IsSolid
+8068173c ObjectCollidable::GetCollisionTranslation
+80681748 ObjectCollidable::CheckCollision
+8068179c ObjectCollidable::OnCollision
+806817a4 ObjectCollidable::OnItemCollision
+806817ac ObjectCollidable::GetScnObjDrawOptionsIdx
+806817b4 Objects::FlamePoleEff::LoadAnimations
+8068180c Objects::FlamePoleEff::vf_0xec
+80681814 Objects::FlamePoleEff::GetBRRESName
+80681820 Objects::FlamePoleEff::GetPropertiesBitfield
+80681828 Objects::FlamePoleEff::__dt
+80681868 Objects::FlamePole::__dt(thunk)
+80681870 0x80681870
+80681950 0x80681950
+80681e24 0x80681e24
+80681e98 0x80681e98
+80682160 0x80682160
+8068273c 0x8068273c
+806828e8 ObjectKCL::vf_0x111c
+806828f0 ObjectKCL::vf_0x1118
+806828f4 ObjectKCL::UpdateOtherEntityPos
+806828f8 ObjectKCL::SetObjInfoCalcBit
+806828fc ObjectKCL::CalcOtherEntityDistance
+80682900 ObjectKCL::vf_0x108
+8068290c ObjectKCL::AreItemsAllowed
+80682914 ObjectKCL::UpdateKCL
+80682918 ObjectKCL::GetCollisionDiameter
+80682924 ObjectKCL::InitCollision
+80682928 0x80682928
+8068292c 0x8068292c
+80682930 0x80682930
+80682934 0x80682934
+80682938 0x80682938
+80682940 0x80682940
+80682948 0x80682948
+80682950 0x80682950
+80682958 0x80682958
+8068295c 0x8068295c
+80682960 0x80682960
+80682964 0x80682964
+80682968 0x80682968
+80682970 0x80682970
+80682978 0x80682978
+80682980 0x80682980
+80682988 0x80682988
+8068298c 0x8068298c
+80682990 0x80682990
+80682994 0x80682994
+80682998 0x80682998
+806829a0 0x806829a0
+806829e0 0x806829e0
+806837bc 0x806837bc
+80684598 0x80684598
+80685374 0x80685374
+80686150 0x80686150
+80686570 0x80686570
+80686988 0x80686988
+80686c8c 0x80686c8c
+80686f84 0x80686f84
+8068717c 0x8068717c
+806871e0 0x806871e0
+806872a0 0x806872a0
+806873bc 0x806873bc
+80687768 0x80687768
+8068776c 0x8068776c
+80687770 0x80687770
+80687774 0x80687774
+806877c0 0x806877c0
+80687800 0x80687800
+806879a4 0x806879a4
+806879cc 0x806879cc
+80687a2c 0x80687a2c
+80687cc0 0x80687cc0
+80687d58 ObjectExternKCL::UpdateOtherEntityPosWithRot
+80687d5c ObjectExternKCL::vf_0x108
+80687d68 ObjectExternKCL::AreItemsAllowed
+80687d70 ObjectExternKCL::GetCollisionDiameter
+80687db0 ObjectExternKCL::GetYScale
+80687db8 0x80687db8
+80687dc0 0x80687dc0
+80687e0c 0x80687e0c
+80687e14 0x80687e14
+80687e1c 0x80687e1c
+80687e24 obj_gnd_sphere::__ct
+80688004 0x80688004
+806880a8 0x806880a8
+8068829c 0x8068829c
+806882a0 0x806882a0
+806884ac 0x806884ac
+806884ec 0x806884ec
+806887b4 0x806887b4
+80688810 0x80688810
+80688bf8 0x80688bf8
+80688c9c 0x80688c9c
+80688dac 0x80688dac
+80688e48 0x80688e48
+80688e60 0x80688e60
+80688eb0 0x80688eb0
+80688f00 0x80688f00
+80688f50 0x80688f50
+80688fa0 0x80688fa0
+80688ff0 0x80688ff0
+80689040 0x80689040
+80689090 0x80689090
+806890e0 0x806890e0
+80689130 0x80689130
+80689300 0x80689300
+80689a78 0x80689a78
+80689b84 0x80689b84
+80689b88 0x80689b88
+80689b8c 0x80689b8c
+80689b90 0x80689b90
+80689b94 0x80689b94
+80689b9c 0x80689b9c
+80689ba4 0x80689ba4
+80689bac 0x80689bac
+80689bb4 0x80689bb4
+80689bb8 0x80689bb8
+80689bbc 0x80689bbc
+80689bc0 0x80689bc0
+80689bc4 0x80689bc4
+80689bcc 0x80689bcc
+80689bd4 0x80689bd4
+80689bdc 0x80689bdc
+80689be4 0x80689be4
+80689be8 0x80689be8
+80689bec 0x80689bec
+80689bf0 0x80689bf0
+80689bf4 0x80689bf4
+80689bfc 0x80689bfc
+80689d74 0x80689d74
+80689d8c 0x80689d8c
+80689ddc 0x80689ddc
+80689e2c 0x80689e2c
+80689e7c 0x80689e7c
+80689ecc 0x80689ecc
+80689f1c 0x80689f1c
+80689f6c 0x80689f6c
+80689fbc 0x80689fbc
+8068a00c 0x8068a00c
+8068a05c 0x8068a05c
+8068a23c 0x8068a23c
+8068a3b4 0x8068a3b4
+8068a3cc 0x8068a3cc
+8068a41c 0x8068a41c
+8068a46c 0x8068a46c
+8068a4bc 0x8068a4bc
+8068a50c 0x8068a50c
+8068a55c 0x8068a55c
+8068a5ac 0x8068a5ac
+8068a5fc 0x8068a5fc
+8068a64c 0x8068a64c
+8068a69c 0x8068a69c
+8068a888 0x8068a888
+8068a9fc 0x8068a9fc
+8068aa14 0x8068aa14
+8068aa64 0x8068aa64
+8068aab4 0x8068aab4
+8068ab04 0x8068ab04
+8068ab54 0x8068ab54
+8068aba4 0x8068aba4
+8068abf4 0x8068abf4
+8068ac44 0x8068ac44
+8068ac94 0x8068ac94
+8068ace4 0x8068ace4
+8068afe8 0x8068afe8
+8068b15c 0x8068b15c
+8068b174 0x8068b174
+8068b1c4 0x8068b1c4
+8068b214 0x8068b214
+8068b264 0x8068b264
+8068b2b4 0x8068b2b4
+8068b304 0x8068b304
+8068b354 0x8068b354
+8068b3a4 0x8068b3a4
+8068b3f4 0x8068b3f4
+8068b444 0x8068b444
+8068b750 0x8068b750
+8068b7c4 0x8068b7c4
+8068b97c 0x8068b97c
+8068b984 obj_gnd_wave1::__ct
+8068bb68 0x8068bb68
+8068bc0c 0x8068bc0c
+8068bdc8 0x8068bdc8
+8068bdcc obj_gnd_wave2::__ct
+8068bfe4 0x8068bfe4
+8068c088 0x8068c088
+8068c230 0x8068c230
+8068c234 0x8068c234
+8068c464 0x8068c464
+8068c508 0x8068c508
+8068c9d4 0x8068c9d4
+8068c9d8 0x8068c9d8
+8068cbb8 0x8068cbb8
+8068cc5c 0x8068cc5c
+8068ced8 0x8068ced8
+8068cedc Effects::Items::__ct
+8068d234 Effects::Items::__dt
+8068d274 Effects::Items::Init
+8068d280 0x8068d280
+8068d284 Effects::Items::CreateKouraTailGEffect
+8068d2d8 Effects::Items::CreateKouraTailREffect
+8068d32c Effects::Items::CreateKouraTailBEffect
+8068d380 0x8068d380
+8068d3a8 0x8068d3a8
+8068d3d0 0x8068d3d0
+8068d3f0 Effects::Items::FadeKouraTailGEffect
+8068d41c Effects::Items::FadeKouraTailREffect
+8068d448 Effects::Items::FadeKouraTailBEffect
+8068d474 Effects::Items::KillKouraTailGEffect
+8068d4a0 Effects::Items::KillKouraTailREffect
+8068d4cc Effects::Items::KillKouraTailBEffect
+8068d4f8 Effects::Items::CreateKouraBrkGEffect
+8068d570 Effects::Items::CreateKouraBrkREffect
+8068d5e8 Effects::Items::CreateItemVanEffect
+8068d608 Effects::Items::CreateBombHeiEffect
+8068d748 Effects::Items::CreateHaneKouraEffect
+8068d784 Effects::Items::CreateBombHeiSparkEffect
+8068d81c Effects::Items:KillBombHeiEffect
+8068d848 Effects::Items::CreateBananaEffect
+8068d954 0x8068d954
+8068d9e8 Effects::Items::CreateKaminariGumoPreEffect
+8068dad8 Effects::Items::KillKaminariGumoPreEffect
+8068daf4 Effects::Items::CreateKaminariGumoVanEffect
+8068db8c Effects::Items::UpdateKaminariGumoVanEffect
+8068dd08 Effects::Items::CreateKouraTailEffect
+8068df94 0x8068df94
+8068df98 Effects::Player::__ct
+8068e830 Effects::Player::GetRacedata
+8068e83c Effects::Player::GetCourseId
+8068e844 Effects::Player::Color::__ct
+8068e848 Effects::Player::Color::__dt
+8068e888 Effects::Player::__dt
+8068e9a8 Effects::Player::Init
+8068ea58 Effects::Player::Reset
+8068f044 Effects::Player::LoadEffects
+8069077c Effects::Player::LoadEffects_switch
+80690780 Effects::Player::LoadEffects_case0
+8069084c Effects::Player::LoadEffects_case1
+80690918 Effects::Player::LoadEffects_case2
+806909e4 Effects::Player::LoadEffects_case3
+80690ab0 Effects::Player::LoadEffects_case4
+80690b7c Effects::Player::LoadEffects_case5
+80690c48 Effects::Player::LoadEffects_case6
+80690d14 Effects::Player::LoadEffects_case7
+80690de0 Effects::Player::LoadEffects_case8
+80690eac Effects::Player::LoadEffects_case9
+80690f78 Effects::Player::LoadEffects_casea
+80691044 Effects::Player::LoadEffects_caseb
+80693d58 Effects::Player::Toggle
+80693d84 Effects::Player::Update
+80693e94 Effects::Player::UpdateValues
+806946bc 0x806946bc
+80694d0c Effects::Player::UpdateItemEffect
+80695604 0x80695604
+8069566c 0x8069566c
+806958b8 0x806958b8
+806958f4 Effects::Player::KillEffects
+80695ba8 Effects::Player::UpdateNonItemEffects
+80696cf0 0x80696cf0
+80696f1c 0x80696f1c
+80696fbc 0x80696fbc
+8069703c 0x8069703c
+80697138 0x80697138
+80697234 0x80697234
+806972f4 0x806972f4
+806973b4 0x806973b4
+806974c4 0x806974c4
+806975d4 Effects::Player::CreateAndUpdateEffectsByIdx
+80697788 Effects::Player::FollowFadeEffectsByIdx
+8069797c Effects::Player::CreateEffectsByIdx
+806979f0 Effects::Player::UpdateEffectsByIdx
+80697b2c Effects::Player::KillEffectsByIdx
+80697be0 Effects::Player::UpdateCollisionEffects
+80697c30 0x80697c30
+80697d40 Effects::Player::UpdateCollisionEffects_caseD_0
+80697d50 Effects::Player::UpdateCollisionEffects_caseD_1
+80697d60 Effects::Player::UpdateCollisionEffects_caseD_2
+80697d70 Effects::Player::UpdateCollisionEffects_caseD_3
+80697d80 Effects::Player::UpdateCollisionEffects_caseD_4
+80697d90 Effects::Player::UpdateCollisionEffects_caseD_5
+80697da0 Effects::Player::UpdateCollisionEffects_caseD_6
+80697db0 Effects::Player::UpdateCollisionEffects_caseD_7
+80697ed8 Effects::Player::UpdateCollisionEffects_case2D_0
+80697ee8 Effects::Player::UpdateCollisionEffects_case2D_1
+80697ef8 Effects::Player::UpdateCollisionEffects_case2D_2
+80697f08 Effects::Player::UpdateCollisionEffects_case2D_3
+80697f18 Effects::Player::UpdateCollisionEffects_case2D_4
+80697f28 Effects::Player::UpdateCollisionEffects_case2D_5
+80697f38 Effects::Player::UpdateCollisionEffects_case2D_6
+80697f48 Effects::Player::UpdateCollisionEffects_case2D_7
+80697ffc Effects::Player::UpdateVehicleEffects
+80698028 Effects::Player::UpdateKartEffects
+80698f70 Effects::Player::UpdateBikeEffects
+80699cb0 Effects::Player::UpdateJumpSmokeEffects
+8069a738 0x8069a738
+8069a914 0x8069a914
+8069abf4 0x8069abf4
+8069ad40 0x8069ad40
+8069b114 0x8069b114
+8069b394 Effects::Player::UpdateStartUpEffects
+8069b748 Effects::Player::UpdateSlipStreamEffects
+8069baf8 Effects::Player::UpdateGasSmokeEffects
+8069c040 0x8069c040
+8069c1bc 0x8069c1bc
+8069c2ec 0x8069c2ec
+8069c648 0x8069c648
+8069c790 0x8069c790
+8069c7f0 Effects::Player::UpdateWaterEffects
+8069cf18 0x8069cf18
+8069d0bc 0x8069d0bc
+8069d120 Effects::Player::UpdateInBillEffects
+8069db3c 0x8069db3c
+8069dba4 Effects::Player::UpdateThunderEffects
+8069e304 0x8069e304
+8069e514 0x8069e514
+8069e8ac Effects::Player::Create228Effect
+8069eb5c Effects::Player::Create25CEffect
+8069f3e4 0x8069f3e4
+8069f41c 0x8069f41c
+8069f690 0x8069f690
+8069f918 0x8069f918
+8069fcf0 Effects::Player::UpdateInkEffect
+806a02e4 0x806a02e4
+806a0370 0x806a0370
+806a0428 0x806a0428
+806a0b4c 0x806a0b4c
+806a0fdc Effects::Player::UpdateFromWheelCollision
+806a115c Effects::Player::UpdateFromWheelCollision_switch
+806a1160 Effects::Player::UpdateFromWheelCollision_caseD_0
+806a117c Effects::Player::UpdateFromWheelCollision_caseD_1
+806a1198 Effects::Player::UpdateFromWheelCollision_caseD_4
+806a11b4 Effects::Player::UpdateFromWheelCollision_caseD_5
+806a11d0 Effects::Player::UpdateFromWheelCollision_caseD_3
+806a11e8 Effects::Player::UpdateFromWheelCollision_caseD_2
+806a11fc Effects::Player::UpdateFromWheelCollision_caseD_6
+806a1210 Effects::Player::UpdateFromWheelCollision_caseD_7
+806a1660 Effects::Player::UpdateFromKartCollision
+806a1808 0x806a1808
+806a1820 0x806a1820
+806a1938 0x806a1938
+806a19d8 Effects::Player::CreateAndUpdateEffectsByIdxVelocity
+806a1b68 Effects::Player::FollowFadeEffectsByIdxVelocity
+806a1cc8 0x806a1cc8
+806a1d1c 0x806a1d1c
+806a1d70 0x806a1d70
+806a1e4c 0x806a1e4c
+806a1eb0 0x806a1eb0
+806a1fd8 0x806a1fd8
+806a20b4 0x806a20b4
+806a2118 0x806a2118
+806a21f4 0x806a21f4
+806a2258 0x806a2258
+806a2348 0x806a2348
+806a2424 0x806a2424
+806a2460 0x806a2460
+806a2488 0x806a2488
+806a2578 0x806a2578
+806a25ec 0x806a25ec
+806a26a0 0x806a26a0
+806a2780 0x806a2780
+806a27e4 0x806a27e4
+806a290c 0x806a290c
+806a29ec 0x806a29ec
+806a2a50 0x806a2a50
+806a2b78 0x806a2b78
+806a2c14 0x806a2c14
+806a2c30 0x806a2c30
+806a2ce4 0x806a2ce4
+806a2e04 0x806a2e04
+806a2e8c 0x806a2e8c
+806a2f20 0x806a2f20
+806a3138 0x806a3138
+806a3184 0x806a3184
+806a326c 0x806a326c
+806a33b4 0x806a33b4
+806a34a4 0x806a34a4
+806a35cc 0x806a35cc
+806a3618 0x806a3618
+806a36c8 0x806a36c8
+806a37b8 0x806a37b8
+806a381c 0x806a381c
+806a3898 0x806a3898
+806a38e4 0x806a38e4
+806a3948 0x806a3948
+806a3ac4 0x806a3ac4
+806a3d48 0x806a3d48
+806a3f90 0x806a3f90
+806a4020 0x806a4020
+806a40b0 0x806a40b0
+806a414c 0x806a414c
+806a4248 0x806a4248
+806a4318 0x806a4318
+806a43b4 0x806a43b4
+806a44b0 0x806a44b0
+806a4580 0x806a4580
+806a461c 0x806a461c
+806a4718 0x806a4718
+806a47e8 0x806a47e8
+806a4870 0x806a4870
+806a4920 0x806a4920
+806a49c8 0x806a49c8
+806a4a78 0x806a4a78
+806a4b20 0x806a4b20
+806a4b94 0x806a4b94
+806a4c38 0x806a4c38
+806a4ce8 0x806a4ce8
+806a4dac 0x806a4dac
+806a4e5c 0x806a4e5c
+806a4f20 0x806a4f20
+806a4fd0 0x806a4fd0
+806a5094 0x806a5094
+806a5144 0x806a5144
+806a5208 0x806a5208
+806a52d8 0x806a52d8
+806a537c 0x806a537c
+806a54d0 0x806a54d0
+806a5660 0x806a5660
+806a597c 0x806a597c
+806a5a00 0x806a5a00
+806a5d8c 0x806a5d8c
+806a5db0 0x806a5db0
+806a5e34 0x806a5e34
+806a61b0 0x806a61b0
+806a6234 0x806a6234
+806a62a4 Vec3::DivideByScalar
+806a62d8 0x806a62d8
+806a6334 0x806a6334
+806a6428 0x806a6428
+806a65ec Effects::Player::CreateRKHitEffect
+806a66a4 Effects::Player::OnBushCollision
+806a67e4 0x806a67e4
+806a67f8 Effects::Player::CreateSpinEffect
+806a6a2c 0x806a6a2c
+806a6ad8 0x806a6ad8
+806a6c34 0x806a6c34
+806a6ce0 0x806a6ce0
+806a6e3c 0x806a6e3c
+806a6ee8 0x806a6ee8
+806a7044 0x806a7044
+806a70f0 0x806a70f0
+806a724c 0x806a724c
+806a72c0 0x806a72c0
+806a7364 0x806a7364
+806a73d8 0x806a73d8
+806a747c 0x806a747c
+806a7528 0x806a7528
+806a75cc 0x806a75cc
+806a7640 0x806a7640
+806a76e4 0x806a76e4
+806a77b4 0x806a77b4
+806a7858 0x806a7858
+806a79f4 0x806a79f4
+806a7ae4 0x806a7ae4
+806a7b68 0x806a7b68
+806a7c08 0x806a7c08
+806a7c8c 0x806a7c8c
+806a7d30 0x806a7d30
+806a7dd4 0x806a7dd4
+806a7ea4 0x806a7ea4
+806a7f08 0x806a7f08
+806a7f80 0x806a7f80
+806a7fa0 0x806a7fa0
+806a804c 0x806a804c
+806a80f0 0x806a80f0
+806a8154 0x806a8154
+806a81c4 0x806a81c4
+806a8268 Effects::Player::CreateKartBrakeBackwardsEffects
+806a837c Effects::Player::KillKartBrakeBackwardsEffects
+806a849c 0x806a849c
+806a84e4 0x806a84e4
+806a8588 Effects::Player::CreateBikeBrakeBackwardsEffects
+806a867c Effects::Player::KillBikeBrakeBackwardsEffects
+806a877c 0x806a877c
+806a881c 0x806a881c
+806a88f8 0x806a88f8
+806a8998 0x806a8998
+806a8a18 0x806a8a18
+806a8ad4 Effects::Player::CreateStarEffect
+806a8cb0 Effects::Player::UpdateStarEffect
+806a8f2c Effects::Player::CreateRKKiller
+806a9070 Effects::Player::UpdateRKKiller
+806a92a4 0x806a92a4
+806a9328 0x806a9328
+806a93a8 0x806a93a8
+806a942c 0x806a942c
+806a9550 0x806a9550
+806a95f0 0x806a95f0
+806a96cc 0x806a96cc
+806a98cc 0x806a98cc
+806a9b48 0x806a9b48
+806a9d48 0x806a9d48
+806a9fc4 0x806a9fc4
+806aa1c8 0x806aa1c8
+806aa274 0x806aa274
+806aa33c 0x806aa33c
+806aa4cc 0x806aa4cc
+806aa508 0x806aa508
+806aa530 Effects::Player::UpdatePowEffect
+806aa784 Effects::Player::UpdatePow1Effect
+806aa988 0x806aa988
+806aaa2c 0x806aaa2c
+806aaba8 0x806aaba8
+806aabf8 0x806aabf8
+806aace4 0x806aace4
+806aae00 0x806aae00
+806aaf04 Effects::Player::UpdateNiseBoxBiriEffect
+806ab0d4 0x806ab0d4
+806ab1d4 0x806ab1d4
+806ab298 0x806ab298
+806ab33c 0x806ab33c
+806ab468 0x806ab468
+806ab50c 0x806ab50c
+806ab60c 0x806ab60c
+806ab6b0 0x806ab6b0
+806ab8a0 Effects::Player::TriggerPochaEffect
+806abaf4 0x806abaf4
+806abb1c 0x806abb1c
+806abb5c Effects::Player::CreatePochaEffect
+806abd3c 0x806abd3c
+806abf10 0x806abf10
+806abfa8 0x806abfa8
+806ac0c0 0x806ac0c0
+806ac140 0x806ac140
+806ac210 0x806ac210
+806ac2b8 0x806ac2b8
+806ac400 0x806ac400
+806ac618 0x806ac618
+806ac69c 0x806ac69c
+806ac73c 0x806ac73c
+806ac810 0x806ac810
+806ac924 0x806ac924
+806acb04 0x806acb04
+806acb1c 0x806acb1c
+806acfbc 0x806acfbc
+806ad088 0x806ad088
+806ad518 0x806ad518
+806ad5e4 0x806ad5e4
+806ada74 0x806ada74
+806adb40 0x806adb40
+806adccc 0x806adccc
+806adce0 0x806adce0
+806ade58 0x806ade58
+806ade6c 0x806ade6c
+806adee0 0x806adee0
+806adef4 Effects::Player::CreateSandEffect
+806ae36c Effects::Player::Color::__ct(args)
+806ae380 Effects::Player::Color::operator=
+806ae3a4 0x806ae3a4
+806ae58c Effects::Player::CreateGrassEffect
+806ae8ec 0x806ae8ec
+806aeac8 Effects::Player::CreateSnowDirtEffect
+806aedbc 0x806aedbc
+806aef88 0x806aef88
+806af038 Effects::Player::CreateSnowRoadEffect
+806af4d0 0x806af4d0
+806af768 Effects::Player::CreateWaterEffect
+806af9ec 0x806af9ec
+806afaf0 0x806afaf0
+806afc04 Effects::Player::CreateMudEffect
+806aff10 0x806aff10
+806b0098 Effects::Player::CreateFlowerEffect
+806b0334 0x806b0334
+806b04bc Effects::Player::CreateStoneEffect
+806b0754 0x806b0754
+806b08d8 0x806b08d8
+806b0bb4 0x806b0bb4
+806b0e04 0x806b0e04
+806b11b0 0x806b11b0
+806b171c Effects::Player::SetOffroadColors
+806b25ac 0x806b25ac
+806b271c 0x806b271c
+806b2764 0x806b2764
+806b2880 0x806b2880
+806b28c8 0x806b28c8
+806b294c 0x806b294c
+806b2964 0x806b2964
+806b2c60 0x806b2c60
+806b2dac 0x806b2dac
+806b32fc 0x806b32fc
+806b33e0 0x806b33e0
+806b345c 0x806b345c
+806b3698 Effects::Player::SetGessoEffectsVisibility
+806b37cc Effects::Player::UpdateGessoEffectsVisibility
+806b38a8 0x806b38a8
+806b3900 Vector3_rotate
+806b39e0 0x806b39e0
+806b3ac4 0x806b3ac4
+806b3b40 0x806b3b40
+806b3ca4 Vec3::CalcYAxisRotMtx
+806b3e1c 0x806b3e1c
+806b3f70 0x806b3f70
+806b4108 0x806b4108
+806b41e0 0x806b41e0
+806b42c8 0x806b42c8
+806b4474 0x806b4474
+806b45b8 0x806b45b8
+806b46a4 0x806b46a4
+806b46f8 0x806b46f8
+806b475c 0x806b475c
+806b5380 0x806b5380
+806b5530 0x806b5530
+806b55c4 0x806b55c4
+806b59a8 -bx^2+ax
+806b5a0c CreateParabola
+806b5a30 0x806b5a30
+806b5a34 0x806b5a34
+806b5a38 0x806b5a38
+806b5a3c 0x806b5a3c
+806b5a40 0x806b5a40
+806b5ac8 Effects::Mgr::CreateOneTimeEffect(pos)
+806b5b28 Effects::Mgr::CreateOneTimeEffect(mtx)
+806b5b88 Effects::Mgr::CreateOneTimeEffect(pos, scale)
+806b5c04 Effects::Mgr::CreateOneTimeEffect(mtx, scale)
+806b5c80 0x806b5c80
+806b5c84 Objects::Basabasa::__ct
+806b5e1c 0x806b5e1c
+806b5e80 Objects::Basabasa::OnStart
+806b6028 Objects::Basabasa::vf_0x10
+806b602c Objects::Basabasa::Update
+806b6100 0x806b6100
+806b6288 0x806b6288
+806b652c 0x806b652c
+806b6874 Objects::Basabasa::OnCollision
+806b6a18 Objects::Basabasa::OnItemCollision
+806b6eac Objects::Basabasa::UpdateShadow
+806b70d0 Objects::BasabasaMgr::__ct
+806b72f4 Objects::BasabasaMgr::__dt
+806b7334 Objects::BasabasaMgr::OnStart
+806b74c0 Objects::BasabasaMgr::vf_0x10
+806b74c4 Objects::BasabasaMgr::Update
+806b7618 Objects::BasabasaMgr::LoadClipInfo
+806b761c Objects::BasabasaMgr::LoadCollision
+806b7620 Objects::BasabasaMgr::LoadRoute
+806b7624 Objects::BasabasaMgr::LoadModels
+806b7628 Objects::BasabasaMgr::GetPropertiesBitfield
+806b7630 Objects::Basabasa::__dt
+806b769c 0x806b769c
+806b76a4 Objects::Basabasa::LoadAnimations
+806b76e8 Objects::Basabasa::GetName
+806b76f4 Objects::Basabasa::GetSubFileName
+806b7700 Objects::Basabasa::GetPropertiesBitfield
+806b7708 Objects::Basabasa::__dt(thunk)
+806b7710 Objects::CarA::__ct
+806b7868 0x806b7868
+806b78cc Objects::CarA::__dt
+806b7944 Objects::CarA::LoadModels
+806b7b44 Objects::CarA::LoadCollision
+806b7bc4 Objects::CarA::UpdateCollision
+806b7ce0 Objects::CarA::OnStart
+806b7e60 Objects::CarA::OnCollision
+806b802c Objects::CarA::OnItemCollision
+806b82cc Objects::CarA::Update
+806b84fc 0x806b84fc
+806b8588 0x806b8588
+806b85ac 0x806b85ac
+806b86f0 Objects::CarA::UpdateRoute
+806b8838 0x806b8838
+806b8844 0x806b8844
+806b8914 0x806b8914
+806b89a8 0x806b89a8
+806b8ccc 0x806b8ccc
+806b8d3c 0x806b8d3c
+806b8e54 0x806b8e54
+806b8edc 0x806b8edc
+806b8ee4 Objects::CarA::LoadAnimations
+806b8f44 Objects::CarA::GetPropertiesBitfield
+806b8f4c MiiCreationParams::__dt
+806b8f8c Objects::CarA::__dt(thunk)
+806b8f94 0x806b8f94
+806b9074 0x806b9074
+806b90b4 0x806b90b4
+806b90e4 0x806b90e4
+806b9164 0x806b9164
+806b926c 0x806b926c
+806b9274 0x806b9274
+806b93cc 0x806b93cc
+806b9428 0x806b9428
+806b94a0 0x806b94a0
+806b9514 0x806b9514
+806b9594 0x806b9594
+806b9674 0x806b9674
+806b96a0 0x806b96a0
+806b9b28 0x806b9b28
+806b9b8c 0x806b9b8c
+806b9bf8 0x806b9bf8
+806b9e60 0x806b9e60
+806ba144 0x806ba144
+806ba378 0x806ba378
+806ba6d8 0x806ba6d8
+806ba7fc 0x806ba7fc
+806baad4 0x806baad4
+806babec 0x806babec
+806bb144 0x806bb144
+806bb394 0x806bb394
+806bb398 0x806bb398
+806bb39c 0x806bb39c
+806bb5f0 0x806bb5f0
+806bb838 0x806bb838
+806bb83c 0x806bb83c
+806bb840 0x806bb840
+806bba7c 0x806bba7c
+806bbae8 0x806bbae8
+806bbb80 0x806bbb80
+806bbc9c 0x806bbc9c
+806bbddc 0x806bbddc
+806bbde4 0x806bbde4
+806bbe34 0x806bbe34
+806bbe3c 0x806bbe3c
+806bbe40 0x806bbe40
+806bbe44 0x806bbe44
+806bbe4c 0x806bbe4c
+806bbe58 0x806bbe58
+806bbe64 0x806bbe64
+806bbe6c 0x806bbe6c
+806bbeac 0x806bbeac
+806bbeb0 0x806bbeb0
+806bbeb8 0x806bbeb8
+806bbec0 Objects::CowBase::__ct
+806bbf24 Objects::CowBase::__dt
+806bbf64 0x806bbf64
+806bc124 0x806bc124
+806bc2ac Objects::CowBase::OnCollision
+806bc3f0 Objects::CowBase::OnItemCollision
+806bc5c0 0x806bc5c0
+806bc6d8 0x806bc6d8
+806bc87c Objects::CowBase::vf_0xf0
+806bc9d4 0x806bc9d4
+806bcb28 0x806bcb28
+806bcba4 0x806bcba4
+806bccc0 0x806bccc0
+806bcdc4 0x806bcdc4
+806bce88 0x806bce88
+806bcf4c 0x806bcf4c
+806bcfd4 0x806bcfd4
+806bd080 Objects::CowLeader::__ct
+806bd194 0x806bd194
+806bd1f8 Objects::CowLeader::__dt
+806bd264 Objects::CowLeader::OnStart
+806bd388 Objects::CowLeader::Update
+806bd6b0 0x806bd6b0
+806bd738 0x806bd738
+806bd7d8 0x806bd7d8
+806bd84c 0x806bd84c
+806bd88c 0x806bd88c
+806bda1c 0x806bda1c
+806bda70 0x806bda70
+806bdcd8 Objects::CowLeader::vf_0xf0
+806bdd44 0x806bdd44
+806bdd48 Objects::CowVassal::__ct
+806bdf90 0x806bdf90
+806bdff4 Objects::CowVassal::__dt
+806be060 Objects::CowVassal::OnStart
+806be1a8 Objects::CowVassal::Update
+806be4e8 0x806be4e8
+806be580 0x806be580
+806be62c 0x806be62c
+806be794 0x806be794
+806be930 0x806be930
+806be9cc 0x806be9cc
+806beb54 Objects::CowGroup::__ct
+806befec Objects::CowGroup::__dt
+806bf02c Objects::CowGroup::OnStart
+806bf064 Objects::CowGroup::Update
+806bf114 0x806bf114
+806bf208 0x806bf208
+806bf228 0x806bf228
+806bf344 Objects::CowGroup::LoadClipInfo
+806bf348 Objects::CowGroup::LoadCollision
+806bf34c Objects::CowGroup::LoadRoute
+806bf350 Objects::CowGroup::LoadModels
+806bf354 Objects::CowGroup::GetPropertiesBitfield
+806bf35c Objects::CowBase::vf_0xec
+806bf364 Objects::CowBase::LoadAnimations
+806bf420 Objects::CowVassal::LoadRoute
+806bf424 Objects::CowVassal::GetPropertiesBitfield
+806bf42c Objects::CowLeader::GetPropertiesBitfield
+806bf434 Object::GetGetPropertiesBitfield
+806bf448 Object::Update
+806bf4b8 Objects::CowLeader::__dt(thunk)
+806bf4c0 Objects::CowVassal::__dt(thunk)
+806bf4c8 0x806bf4c8
+806bf538 0x806bf538
+806bf578 0x806bf578
+806bf5e4 0x806bf5e4
+806bf604 0x806bf604
+806bf764 0x806bf764
+806bf768 0x806bf768
+806bf770 0x806bf770
+806bf7b0 0x806bf7b0
+806bf7b8 0x806bf7b8
+806bf7fc 0x806bf7fc
+806bf880 0x806bf880
+806bf888 0x806bf888
+806bf918 0x806bf918
+806bf958 0x806bf958
+806bf9f0 0x806bf9f0
+806bf9f4 0x806bf9f4
+806bfad4 0x806bfad4
+806bfb14 Objects::Cannon::__ct
+806bfc48 Objects::Cannon::LoadAnimations
+806bfd90 Objects::Cannon::__dt
+806bfddc Objects::Cannon::OnStart
+806bfed0 Objects::Cannon::Update
+806c040c Objects::Cannon::OnActivation
+806c04f4 Objects::Cannon::vf_0xec
+806c04fc 0x806c04fc
+806c0504 Objects::Cannon::GetScnObjDrawOptionsIdx
+806c050c Objects::EffectSpawner::__ct
+806c0560 Objects::EffectSpawner::OnStart
+806c0570 Objects::EffectSpawner::OnCollision
+806c06f0 Objects::EffectSpawner::Update
+806c07e4 Objects::EffectSpawner::__dt
+806c0824 Objects::EffectSpawner::OnItemCollision
+806c0850 Objects::EffectSpawner::OnWallCollision
+806c0854 Objects::EffectSpawner::GetPropertiesBitfield
+806c085c Objects::LeafEffect::__ct
+806c099c Objects::LeafEffect::OnCollision
+806c0b54 Objects::LeafEffect::Update
+806c0cd8 Objects::LeafEffect::__dt
+806c0d18 Objects::FireSnake_ball::__ct
+806c0d88 Objects::FireSnake_ball::OnStart
+806c0e00 Objects::FireSnake_ball::vf_0xec
+806c0e20 Objects::FireSnake_ball::ToggleVisible
+806c0e24 Objects::FireSnake_ball::Update
+806c0e28 0x806c0e28
+806c0ec8 0x806c0ec8
+806c0f1c 0x806c0f1c
+806c0f30 Objects::FireSnake::__ct
+806c1284 Objects::MapObjProjectile::__dt
+806c12c4 Objects::FireSnake_ball::SetScale
+806c12e0 0x806c12e0
+806c1344 Objects::FireSnake::__dt
+806c13b0 Objects::FireSnake::OnStart
+806c14e4 Objects::FireSnake::Update
+806c1818 Objects::FireSnake::OnCollision
+806c18a8 Objects::FireSnake::OnItemCollision
+806c1930 Objects::FireSnake::OnCycleEnd
+806c19e4 Objects::FireSnake::OnCycleEnd2
+806c19e8 Objects::FireSnake::OnCycleStart
+806c1a88 Objects::FireSnake::OnCycleStart2
+806c1dcc Objects::FireSnake::OnInitialGroundCollision
+806c1e90 Objects::FireSnake::vf_0x114
+806c2000 Objects::FireSnake::vf_0x118
+806c2138 Objects::FireSnake::vf_0x11c
+806c21c8 0x806c21c8
+806c2250 Objects::FireSnake::vf_0x120
+806c2254 Objects::FireSnake::vf_0x124
+806c23b8 Objects::FireSnake::vf_0x128
+806c23c4 Objects::FireSnake::vf_0x12c
+806c23c8 Objects::FireSnake::vf_0xec
+806c2530 0x806c2530
+806c2904 Objects::FireSnake_ball::GetEntity
+806c290c Objects::FireSnake_ball::UpdateDrawInfo
+806c2968 Objects::FireSnake_ball::vf_0x8c
+806c296c Objects::FireSnake_ball::vf_0xf8
+806c29fc Objects::FireSnake::RequestShoot
+806c2a08 Objects::FireSnake::vf_0x130
+806c2a10 Objects::FireSnake::LoadAnimations
+806c2a5c Objects::FireSnake::GetPropertiesBitfield
+806c2a64 Objects::FireSnake_eye::LoadCollision
+806c2a68 Objects::FireSnake_eye::LoadRoute
+806c2a6c Objects::FireSnake_eye::GetName
+806c2a78 Objects::FireSnake_eye::GetSubFileName
+806c2a84 Objects::FireSnake_eye::GetPropertiesBitfield
+806c2a8c Objects::FireSnake_eye::__dt
+806c2acc Objects::FireSnake_ball::__dt
+806c2b0c Objects::FireSnake_ball::vf_0xf0
+806c2b14 Objects::FireSnake_ball::LoadAnimations
+806c2b60 Objects::FireSnake_ball::GetPropertiesBitfield
+806c2b68 Objects::FireSnake::__dt(thunk)
+806c2b70 Objects::FireSnake_v::__ct
+806c2cbc Objects::FireSnake_v::OnStart
+806c2d54 Objects::FireSnake_v::Update
+806c2da4 0x806c2da4
+806c30f0 Objects::FireSnake_v::OnCycleEnd
+806c30f4 Objects::FireSnake_v::OnCycleEnd2
+806c30f8 Objects::FireSnake_v::OnCycleStart
+806c31f0 Objects::FireSnake_v::OnCycleStart2
+806c33b4 Objects::FireSnake_v::OnInitialGroundCollision
+806c33c4 Objects::FireSnake_v::vf_0x114
+806c3548 Objects::FireSnake_v::__dt
+806c35a0 0x806c35a0
+806c35a8 0x806c35a8
+806c369c 0x806c369c
+806c36dc 0x806c36dc
+806c375c 0x806c375c
+806c37f0 0x806c37f0
+806c3864 0x806c3864
+806c3868 0x806c3868
+806c393c 0x806c393c
+806c3944 0x806c3944
+806c3988 0x806c3988
+806c39c8 0x806c39c8
+806c3a3c 0x806c3a3c
+806c3a40 0x806c3a40
+806c3a44 0x806c3a44
+806c3a4c 0x806c3a4c
+806c3a9c 0x806c3a9c
+806c3aa4 obj_FlamePole_v::__ct
+806c3e2c 0x806c3e2c
+806c3e90 0x806c3e90
+806c3fcc obj_FlamePole_v_update
+806c40e4 0x806c40e4
+806c4130 0x806c4130
+806c4178 0x806c4178
+806c41f0 obj_FlamePole_v_raiseUpdate
+806c4280 obj_FlamePole_v_beforeShake
+806c42a0 obj_FlamePole_v_calcShake
+806c43bc obj_FlamePole_v_dropUpdate
+806c43e8 0x806c43e8
+806c4478 0x806c4478
+806c44c8 0x806c44c8
+806c44e4 0x806c44e4
+806c47b4 0x806c47b4
+806c4820 0x806c4820
+806c4878 0x806c4878
+806c4880 0x806c4880
+806c488c 0x806c488c
+806c4898 0x806c4898
+806c48a0 0x806c48a0
+806c48a8 0x806c48a8
+806c4c34 0x806c4c34
+806c4c38 0x806c4c38
+806c4e94 0x806c4e94
+806c4ed4 ManagedObjects::RegisterObject
+806c4ef0 Objects::HwanwanItembox::__ct
+806c4f74 Objects::Itembox::__dt
+806c4fb4 0x806c4fb4
+806c4ff4 Objects::HwanwanItembox::OnStart
+806c5070 Objects::HwanwanItembox::Update
+806c5254 Objects::HwanwanItembox::UpdateShadow
+806c5354 Objects::Hwanwan::__ct
+806c56dc Objects::Hwanwan::__dt
+806c571c 0x806c571c
+806c5ac4 Objects::Hwanwan::Update
+806c5bcc Objects::Hwanwan::vf_0xec
+806c5de0 0x806c5de0
+806c6148 0x806c6148
+806c619c 0x806c619c
+806c6214 0x806c6214
+806c63a8 RouteController::SetPercent
+806c63b0 0x806c63b0
+806c66d8 0x806c66d8
+806c66f4 0x806c66f4
+806c677c 0x806c677c
+806c692c 0x806c692c
+806c69a8 0x806c69a8
+806c69ac Objects::Hwanwan::LoadClipInfo
+806c69b0 Objects::Hwanwan::LoadCollision
+806c69b4 Objects::Hwanwan::LoadModels
+806c69b8 Objects::Hwanwan::GetPropertiesBitfield
+806c69c0 Objects::Itembox::IsActive
+806c69d4 Objects::Itembox::IsSolid
+806c69dc Objects::Itembox::OnNormalCollision
+806c69e0 Objects::Itembox::UpdateModelScale
+806c69e4 Objects::Itembox::UpdateModelMatrix
+806c69e8 Objects::Itembox::LoadShadow
+806c69fc Objects::Itembox::GetPropertiesBitfield
+806c6a04 Objects::HwanwanItembox::GetBRRESName
+806c6a10 Objects::HwanwanItembox::GetSubFileName
+806c6a1c Objects::HwanwanItembox::GetName
+806c6a28 Objects::HwanwanItembox::GetID
+806c6a40 Objects::HwanwanItembox::__dt
+806c6a80 Objects::HwanwanItembox::LoadRoute
+806c6a84 Objects::Itembox::UpdateShadow
+806c6a88 0x806c6a88
+806c6a8c Objects::OnStart
+806c6ad8 Objects::Hwanwan_Chn::ToggleVisible
+806c6adc Objects::Hwanwan_Chn::__dt
+806c6b1c Objects::Hwanwan_Chn::LoadCollision
+806c6b20 Objects::Hwanwan_Chn::LoadRoute
+806c6b24 Objects::Hwanwan_Chn::GetName
+806c6b30 Objects::Hwanwan_Chn::GetSubFileName
+806c6b3c Objects::Hwanwan_Chn::GetPropertiesBitfield
+806c6b44 Objects::HanachanPart::LoadModels
+806c6b7c Objects::HanachanPart::OnStart
+806c6c08 Objects::HanachanPart::vf_0x100
+806c6c10 Objects::HanachanPart::Update
+806c6c94 Objects::HanachanPart::OnCollision
+806c6e40 Objects::HanachanPart::OnItemCollision
+806c7064 0x806c7064
+806c7188 0x806c7188
+806c723c 0x806c723c
+806c72b8 0x806c72b8
+806c7674 0x806c7674
+806c7798 0x806c7798
+806c77b8 0x806c77b8
+806c78cc 0x806c78cc
+806c78f4 0x806c78f4
+806c7a14 0x806c7a14
+806c7b14 0x806c7b14
+806c7c6c nw4r::g3d::ICalcWorldCallback::__dt
+806c7cac Objects::BossHanachanHead::CalcWorldCB::ExecCallbackB
+806c7d68 0x806c7d68
+806c7d74 Objects::BossHanachanHead::__ct
+806c7e68 Objects::HanachanPart::__dt
+806c7ea8 0x806c7ea8
+806c818c Objects::BossHanachanHead::LoadCollision
+806c8204 Objects::BossHanachanHead::OnStart
+806c82ac Objects::BossHanachanHead::Update
+806c8450 Objects::BossHanachanHead::UpdateCollision
+806c85d4 0x806c85d4
+806c8724 0x806c8724
+806c87bc 0x806c87bc
+806c87cc Objects::HanachanBody::LoadAnimations
+806c8878 Objects::HanachanBody::OnStart
+806c8908 0x806c8908
+806c8a5c Objects::Hanachan::__ct
+806c9534 0x806c9534
+806c9598 Objects::Hanachan::__dt
+806c9630 Objects::Hanachan::OnStart
+806c9860 Objects::Hanachan::Update
+806c9bb8 0x806c9bb8
+806c9bc0 0x806c9bc0
+806c9d38 0x806c9d38
+806c9ec8 0x806c9ec8
+806c9f90 0x806c9f90
+806c9f98 0x806c9f98
+806c9fb0 0x806c9fb0
+806ca248 Objects::Hanachan::vf_0xC(parent)
+806ca24c 0x806ca24c
+806ca27c 0x806ca27c
+806ca2f0 0x806ca2f0
+806ca554 0x806ca554
+806ca55c 0x806ca55c
+806ca5e4 0x806ca5e4
+806ca6cc 0x806ca6cc
+806ca72c 0x806ca72c
+806ca8e0 0x806ca8e0
+806ca9ac 0x806ca9ac
+806caa8c 0x806caa8c
+806caad0 0x806caad0
+806cab5c 0x806cab5c
+806cacd0 0x806cacd0
+806caed4 0x806caed4
+806caf9c 0x806caf9c
+806cafb8 0x806cafb8
+806cb0a8 0x806cb0a8
+806cb1e8 0x806cb1e8
+806cb32c 0x806cb32c
+806cb3fc 0x806cb3fc
+806cb588 0x806cb588
+806cb590 0x806cb590
+806cb764 0x806cb764
+806cb950 0x806cb950
+806cb9e0 0x806cb9e0
+806cbbc4 0x806cbbc4
+806cbe2c 0x806cbe2c
+806cbe48 0x806cbe48
+806cbea8 0x806cbea8
+806cbf18 0x806cbf18
+806cbf88 0x806cbf88
+806cbff8 0x806cbff8
+806cc14c 0x806cc14c
+806cc24c 0x806cc24c
+806cc43c 0x806cc43c
+806cc48c 0x806cc48c
+806cc6c0 0x806cc6c0
+806cc8e8 0x806cc8eA
+806cc9e4 nw4r::g3d::ICalcWorldCallback::ExecCallbackC
+806cc9e8 nw4r::g3d::ICalcWorldCallback::ExecCallbackA
+806cc9ec Objects::Hanachan::UpdateModel
+806cc9f0 Objects::Hanachan::LoadClipInfo
+806cc9f4 Objects::Hanachan::LoadCollision
+806cc9f8 Objects::Hanachan::LoadModels
+806cc9fc Objects::Hanachan::GetPropertiesBitfield
+806cca04 Objects::HanachanPart::vf_0x104
+806cca0c Objects::HanachanPart::vf_0x84
+806cca14 Objects::HanachanPart::UpdateModelMatrix
+806ccacc Objects::HanachanPart::LoadRoute
+806ccad0 Objects::HanachanPart::GetPropertiesBitfield
+806ccad8 Objects::HanachanBody::__dt
+806ccb18 Objects::HanachanBody::vf_0xfc
+806ccb20 Objects::HanachanBody::vf_0xf8
+806ccb28 Objects::HanachanBody::vf_0x108
+806ccb30 0x806ccb30
+806ccb4c 0x806ccb4c
+806ccb6c 0x806ccb6c
+806ccb74 Objects::HanachanBody::GetShadowResName
+806ccb80 Objects::HanachanBody::GetSubFileName
+806ccb88 Objects::HanachanPart::GetSubFileName
+806ccb94 Objects::BossHanachanHead::__dt
+806ccbd4 Objects::BossHanachanHead::vf_0xfc
+806ccbf0 Objects::BossHanachanHead::vf_0xf8
+806ccbf8 Objects::BossHanachanHead::vf_0xf4
+806ccc44 Objects::BossHanachanHead::vf_0xf0
+806ccca4 Objects::BossHanachanHead::vf_0xec
+806ccd24 Objects::BossHanachanHead::UpdateShadow
+806ccd98 Objects::BossHanachanHead::vf_0x108
+806ccda0 Objects::BossHanachanHead::LoadAnimations
+806cce28 Objects::BossHanachanHead::GetBRRESName
+806cce34 nw4r::g3d::ICalcWorldCallback::ExecCallbackB
+806cce38 Objects::BossHanachanHead::CalcWorldCB::__dt
+806cce78 Objects::BossHanachanHead::CalcWorldCB::ExecCallbackB(thunk)
+806cce80 Objects::BossHanachanHead::CalcWorldCB::__dt(thunk)
+806cce88 Objects::Hanachan::__dt(thunk)
+806cce90 0x806cce90
+806cd044 0x806cd044
+806cd328 0x806cd328
+806cd458 0x806cd458
+806cd4c0 0x806cd4c0
+806cd6e0 0x806cd6e0
+806cd868 0x806cd868
+806cd994 0x806cd994
+806cdcc0 0x806cdcc0
+806cdcc4 0x806cdcc4
+806cdd20 0x806cdd20
+806cdddc 0x806cdddc
+806cdde0 0x806cdde0
+806cdde4 0x806cdde4
+806cdec8 0x806cdec8
+806ce03c 0x806ce03c
+806ce168 0x806ce168
+806ce354 0x806ce354
+806ce39c 0x806ce39c
+806ce3d0 0x806ce3d0
+806ce430 0x806ce430
+806ce548 0x806ce548
+806ce7b0 0x806ce7b0
+806ce808 0x806ce808
+806ce810 0x806ce810
+806ce818 0x806ce818
+806ce820 0x806ce820
+806ce828 Objects::Heyho::__ct
+806ceac0 0x806ceac0
+806ceb24 Objects::Heyho::__dt
+806ceb90 Objects::Heyho::OnStart
+806cedf4 Objects::Heyho::vf_0x10
+806cedf8 Objects::Heyho::Update
+806cf024 Objects::Heyho::OnCollision
+806cf198 Objects::Heyho::OnItemCollision
+806cf3a4 Objects::Heyho::UpdateShadow
+806cf4cc 0x806cf4cc
+806cf4d0 obj_heyho_move_update
+806cf714 obj_heyho_beforeJump
+806cf72c obj_heyho_jump_update
+806cfac0 0x806cfac0
+806cfb38 0x806cfb38
+806cfd48 0x806cfd48
+806cfdb0 0x806cfdb0
+806cffb0 0x806cffb0
+806d0028 0x806d0028
+806d00b0 0x806d00b0
+806d013c Objects::Heyho::LoadAnimations
+806d01cc Objects::Heyho::vf_0xc
+806d01d4 Objects::Heyho::UpdateCollision
+806d02b4 Objects::Heyho::GetPropertiesBitfield
+806d02bc 0x806d02bc
+806d02c4 Objects::HeyHoBallGBA::__ct
+806d058c 0x806d058c
+806d05f0 Objects::HeyHoBallGBA::OnStart
+806d0780 Objects::HeyHoBallGBA::Update
+806d0880 Objects::HeyHoBallGBA::OnCollision
+806d0978 Objects::HeyHoBallGBA::OnItemCollision
+806d0a00 0x806d0a00
+806d0a14 0x806d0a14
+806d0a3c 0x806d0a3c
+806d0ad8 0x806d0ad8
+806d0c0c 0x806d0c0c
+806d0cd8 0x806d0cd8
+806d0d84 0x806d0d84
+806d0f24 0x806d0f24
+806d10a4 Objects::HeyHoBallGBA::vf_0xec
+806d11c8 0x806d11c8
+806d1308 0x806d1308
+806d1384 0x806d1384
+806d14d8 0x806d14d8
+806d1570 0x806d1570
+806d15a8 0x806d15a8
+806d1820 Objects::HeyHoBallGBA::__dt
+806d188c Objects::HeyHoBallGBA::RequestShoot
+806d1898 0x806d1898
+806d18a0 Objects::HeyHoBallGBA::LoadAnimations
+806d18ec Objects::HeyHoBallGBA::GetPropertiesBitfield
+806d18f4 0x806d18f4
+806d18fc Objects::HeyHoShipGBA::__ct
+806d1998 Objects::MapObjShooter::__dt
+806d19d8 Objects::HeyHoShipGBA::OnStart
+806d1b9c Objects::HeyHoShipGBA::Update
+806d1ca4 Objects::HeyHoShipGBA::GetShootFromRoutePointID
+806d1cc4 0x806d1cc4
+806d1d10 0x806d1d10
+806d1dd4 0x806d1dd4
+806d203c 0x806d203c
+806d20c4 0x806d20c4
+806d2320 Objects::HeyHoShipGBA::__dt
+806d2360 Objects::HeyHoShipGBA::GetPropertiesBitfield
+806d2368 Objects::HeyHoShipManager::__ct
+806d2514 Objects::HeyHoShipManager::__dt
+806d2590 Objects::HeyHoShipManager::OnStart
+806d2868 Objects::HeyHoShipManager::Update
+806d28ec 0x806d28ec
+806d28f0 Objects::MapObjSniper::LoadClipInfo
+806d28f4 Objects::MapObjSniper::LoadCollision
+806d28f8 Objects::MapObjSniper::LoadRoute
+806d28fc Objects::MapObjSniper::LoadModels
+806d2900 Objects::MapObjSniper::GetPropertiesBitfield
+806d2908 Objects::HighwayManager::__ct
+806d2fe8 Objects::HighwayManager::__dt
+806d30bc 0x806d30bc
+806d332c Objects::HighwayManager::OnStart
+806d3448 0x806d3448
+806d345c Objects::HighwayManager::Update
+806d394c 0x806d394c
+806d3c9c 0x806d3c9c
+806d3e5c 0x806d3e5c
+806d401c 0x806d401c
+806d435c 0x806d435c
+806d469c 0x806d469c
+806d4930 0x806d4930
+806d4bc4 0x806d4bc4
+806d4d18 0x806d4d18
+806d4e6c 0x806d4e6c
+806d4eb4 0x806d4eb4
+806d4efc 0x806d4efc
+806d4f44 0x806d4f44
+806d4f8c 0x806d4f8c
+806d4fd4 0x806d4fd4
+806d501c 0x806d501c
+806d5064 0x806d5064
+806d50ac 0x806d50ac
+806d51c8 0x806d51c8
+806d52e0 0x806d52e0
+806d54bc 0x806d54bc
+806d55a0 0x806d55a0
+806d55ec 0x806d55ec
+806d5700 0x806d5700
+806d58c4 0x806d58c4
+806d58cc Objects::K_truck_light::LoadAnimations
+806d595c Objects::K_truck_light::LoadCollision
+806d5960 Objects::K_truck_light::LoadRoute
+806d5964 Objects::K_truck_light::GetSubFileName
+806d5970 Objects::K_truck_light::GetBRRESName
+806d597c Objects::K_truck_light::GetPropertiesBitfield
+806d5984 Objects::K_truck_light::GetID
+806d598c Objects::K_truck_light::__dt
+806d59cc 0x806d59cc
+806d59d4 Objects::K_car_light::LoadAnimations
+806d5a64 Objects::K_car_light::LoadCollision
+806d5a68 Objects::K_car_light::LoadRoute
+806d5a6c Objects::K_car_light::GetSubFileName
+806d5a78 Objects::K_car_light::GetBRRESName
+806d5a84 Objects::K_car_light::GetPropertiesBitfield
+806d5a8c Objects::K_car_light::GetID
+806d5a94 Objects::K_car_light::__dt
+806d5ad4 0x806d5ad4
+806d5adc Objects::K_truck_tire::LoadAnimations
+806d5b28 Objects::K_truck_tire::LoadCollision
+806d5b2c Objects::K_truck_tire::LoadRoute
+806d5b30 Objects::K_truck_tire::GetSubFileName
+806d5b3c Objects::K_truck_tire::GetBRRESName
+806d5b48 Objects::K_truck_tire::GetPropertiesBitfield
+806d5b50 Objects::K_truck_tire::GetID
+806d5b58 Objects::K_truck_tire::__dt
+806d5b98 0x806d5b98
+806d5ba0 Objects::K_car_tire::LoadAnimations
+806d5bec Objects::K_car_tire::LoadCollision
+806d5bf0 Objects::K_car_tire::LoadRoute
+806d5bf4 Objects::K_car_tire::GetSubFileName
+806d5c00 Objects::K_car_tire::GetBRRESName
+806d5c0c Objects::K_car_tire::GetPropertiesBitfield
+806d5c14 Objects::K_car_tire::GetID
+806d5c1c Objects::K_car_tire::__dt
+806d5c5c Objects::HighwayManager::LoadClipInfo
+806d5c60 Objects::HighwayManager::LoadCollision
+806d5c64 Objects::HighwayManager::LoadRoute
+806d5c68 Objects::HighwayManager::LoadModels
+806d5c6c Objects::HighwayManager::GetPropertiesBitfield
+806d5c74 0x806d5c74
+806d5d4c 0x806d5d4c
+806d5e98 0x806d5e98
+806d5ed8 0x806d5ed8
+806d5edc 0x806d5edc
+806d5ee4 Objects::HighwayCar::__ct
+806d68b0 Objects::HighwayCar::GetBRRESName
+806d68b8 0x806d68b8
+806d691c Objects::HighwayCar::__dt
+806d6988 Objects::HighwayCar::LoadModels
+806d69c0 Objects::HighwayCar::GetCollisionDiameter
+806d6b14 Objects::HighwayCar::OnStart
+806d6ecc Objects::HighwayCar::Update
+806d7328 Objects::HighwayCar::OnCollision
+806d7780 Objects::HighwayCar::OnItemCollision
+806d7af8 Objects::HighwayCar::LoadCollision
+806d7bf8 Objects::HighwayCar::UpdateCollision
+806d7cf8 Objects::HighwayCar::GetSolidityCenter
+806d7d64 0x806d7d64
+806d7d68 0x806d7d68
+806d7d6c 0x806d7d6c
+806d7d70 0x806d7d70
+806d7e08 0x806d7e08
+806d7e0c 0x806d7e0c
+806d7ea4 0x806d7ea4
+806d7f58 0x806d7f58
+806d827c 0x806d827c
+806d8b5c 0x806d8b5c
+806d8de8 0x806d8de8
+806d9000 0x806d9000
+806d93a8 0x806d93a8
+806d9430 0x806d9430
+806d9504 0x806d9504
+806d95a0 0x806d95a0
+806d96e0 0x806d96e0
+806d9838 0x806d9838
+806d9914 0x806d9914
+806d998c 0x806d998c
+806d9a04 0x806d9a04
+806d9a3c 0x806d9a3c
+806d9b7c 0x806d9b7c
+806d9c70 0x806d9c70
+806d9d2c 0x806d9d2c
+806d9d9c 0x806d9d9c
+806d9f60 0x806d9f60
+806d9fcc 0x806d9fcc
+806da4b8 0x806da4b8
+806da58c 0x806da58c
+806da660 Objects::HighwayCar::ProcessCollision
+806da728 Objects::HighwayCar::UpdateShadow
+806da79c Objects::HighwayCar::GetShadowResName
+806da7a4 Objects::HighwayCar::GetSubFileName
+806da7ac Objects::HighwayCar::GetPropertiesBitfield
+806da7b4 0x806da7b4
+806da7bc Objects::Kbomneji::LoadAnimations
+806da800 Objects::Kbomneji::LoadCollision
+806da804 Objects::Kbomneji::LoadRoute
+806da808 Objects::Kbomneji::GetSubFileName
+806da814 Objects::Kbomneji::GetPropertiesBitfield
+806da81c Objects::Kbomneji::__dt
+806da85c 0x806da85c
+806da864 Objects::K_bomb_tire00::LoadAnimations
+806da8b0 Objects::K_bomb_tire00::LoadCollision
+806da8b4 Objects::K_bomb_tire00::LoadRoute
+806da8b8 Objects::K_bomb_tire00::GetSubFileName
+806da8c4 Objects::K_bomb_tire00::GetPropertiesBitfield
+806da8cc Objects::K_bomb_tire00::__dt
+806da90c Objects::HighwayCar::__dt(thunk)
+806da914 Objects::KoopaFigure64::__ct
+806daa44 Objects::KoopaFigure64::OnStart
+806dab5c Objects::KoopaFigure64::Update
+806daf10 Objects::KoopaFigure64::UpdateForCPURace
+806dafb8 Objects::KoopaFigure64::UpdateCollision
+806db114 Objects::KoopaFigure64::__dt
+806db154 Objects::KoopaFigure64::LoadCollision
+806db168 Objects::KoopaFigure64::OnCollision
+806db184 Objects::Kuribo::__ct
+806db33c 0x806db33c
+806db3a0 Objects::Kuribo::__dt
+806db40c Objects::Kuribo::OnStart
+806db5ac Objects::Kuribo::vf_0x10
+806db5b0 Objects::Kuribo::Update
+806db764 Objects::Kuribo::OnCollision
+806dba98 Objects::Kuribo::OnItemCollision
+806dc21c Objects::Kuribo::OnRouteEnd
+806dc220 Objects::Kuribo::UpdateRouteEnd
+806dc3f4 Objects::Kuribo::OnCycleBegin
+806dc3f8 Objects::Kuribo::UpdateCycle
+806dc460 0x806dc460
+806dc5e0 0x806dc5e0
+806dc77c 0x806dc77c
+806dc790 0x806dc790
+806dc978 0x806dc978
+806dc9d8 0x806dc9d8
+806dcb58 0x806dcb58
+806dcc9c 0x806dcc9c
+806dcd48 0x806dcd48
+806dcdd0 0x806dcdd0
+806dcddc 0x806dcddc
+806dcfd8 0x806dcfd8
+806dd038 0x806dd038
+806dd128 0x806dd128
+806dd270 Objects::Kuribo::vf_0xC(ObjectCycleManager)
+806dd278 Objects::Kuribo::LoadAnimations
+806dd2c8 0x806dd2c8
+806dd2d0 Objects::Kuribo::__dt(thunk)
+806dd2d8 Objects::Balloon::__ct
+806dd440 Objects::Balloon::__dt
+806dd480 Objects::Balloon::OnStart
+806dd5dc Objects::Balloon::vf_0x10
+806dd5e0 Objects::Balloon::Update
+806dd7d0 0x806dd7d0
+806dd858 Objects::Balloon::UpdateShadow
+806dd924 Objects::Balloon::GetShadowListIdx
+806dd92c Objects::Balloon::GetPropertiesBitfield
+806dd934 0x806dd934
+806dd998 0x806dd998
+806dd9d8 0x806dd9d8
+806dda54 0x806dda54
+806dda80 0x806dda80
+806dda84 Objects::MapObjSniper::__ct
+806ddaf4 Objects::MapObjSniper::__dt
+806ddb34 Objects::MapObjSniper::OnStart
+806ddc44 Objects::MapObjSniper::Update
+806ddcb0 0x806ddcb0
+806ddd20 0x806ddd20
+806ddda0 0x806ddda0
+806dddbc 0x806dddbc
+806dddc0 0x806dddc0
+806dddc8 0x806dddc8
+806dddcc 0x806dddcc
+806dddd0 0x806dddd0
+806dddd4 0x806dddd4
+806dddd8 Objects::SunDS::__ct
+806ddf04 0x806ddf04
+806ddf68 Objects::SunDS::__dt
+806ddfd4 Objects::SunDS::OnStart
+806de03c Objects::SunDS::Update
+806de1c8 0x806de1c8
+806de1e4 0x806de1e4
+806de408 0x806de408
+806de454 0x806de454
+806de458 0x806de458
+806de4e4 0x806de4e4
+806de510 0x806de510
+806de568 0x806de568
+806de598 Objects::SunDS::GetShootFromRoutePointID
+806de5c8 0x806de5c8
+806de5d0 Objects::SunDS::LoadAnimations
+806de614 Objects::SunDS::GetPropertiesBitfield
+806de61c Objects::SunDS::__dt(thunk)
+806de624 Objects::SunDSManager::__ct
+806de780 Objects::SunDSManager::__dt
+806de7fc 0x806de7fc
+806de914 0x806de914
+806de9b0 0x806de9b0
+806dea1c 0x806dea1c
+806deb40 Objects::TruckChimSmk::__ct
+806ded34 Objects::TruckChimSmk::__dt
+806ded74 Objects::TruckChimSmk::OnStart
+806def0c Objects::TruckChimSmk::Update
+806df3f4 Objects::TruckChimSmk::OnCollision
+806df558 Objects::TruckChimSmk::OnItemCollision
+806df584 Objects::TruckChimSmk::UpdateCollision
+806df67c Objects::TruckChimSmk::vf_0x10
+806df680 0x806df680
+806df770 Objects::TruckChimSmk::OnWallCollision
+806df774 Objects::TruckChimSmk::LoadAnimations
+806df7c0 0x806df7c0
+806df7c8 Objects::TruckChimSmk::GetPropertiesBitfield
+806df7d0 Objects::TruckChimSmkW::__ct
+806df94c Objects::TruckChimSmkW::LoadModels
+806df960 Objects::TruckChimSmkW::LoadAnimations
+806df9b8 Objects::TruckChimSmkW::LoadCollision
+806df9cc Objects::TruckChimSmkW::GetSolidityCenter
+806dfa64 Objects::TruckChimSmkW::OnStart
+806dfb18 Objects::TruckChimSmkW::Update
+806dfccc Objects::TruckChimSmkW::__dt
+806dfd0c Objects::TruckChimSmkW::GetScnObjDrawOptionsIdx
+806dfd14 0x806dfd14
+806dfd94 0x806dfd94
+806dfe34 0x806dfe34
+806dfe84 0x806dfe84
+806dfe9c 0x806dfe9c
+806e0050 0x806e0050
+806e0090 0x806e0090
+806e00f4 0x806e00f4
+806e0160 0x806e0160
+806e01c0 0x806e01c0
+806e03e4 0x806e03e4
+806e03e8 0x806e03e8
+806e0650 0x806e0650
+806e0834 0x806e0834
+806e0b30 0x806e0b30
+806e0d48 0x806e0d48
+806e0df0 0x806e0df0
+806e1248 0x806e1248
+806e12d0 0x806e12d0
+806e1370 0x806e1370
+806e17f4 0x806e17f4
+806e1894 0x806e1894
+806e1898 0x806e1898
+806e1940 0x806e1940
+806e1dd0 0x806e1dd0
+806e1e34 0x806e1e34
+806e1f20 0x806e1f20
+806e1f90 0x806e1f90
+806e2060 0x806e2060
+806e206c ObjTruckWagon_construct
+806e21ec 0x806e21ec
+806e222c 0x806e222c
+806e239c 0x806e239c
+806e23a0 0x806e23a0
+806e23a4 0x806e23a4
+806e248c 0x806e248c
+806e24dc 0x806e24dc
+806e24e0 0x806e24e0
+806e24e4 0x806e24e4
+806e24e8 0x806e24e8
+806e24ec 0x806e24ec
+806e24f4 0x806e24f4
+806e24fc 0x806e24fc
+806e256c 0x806e256c
+806e2574 0x806e2574
+806e2604 obj_draw_shadow_init
+806e2608 0x806e2608
+806e260c 0x806e260c
+806e2618 0x806e2618
+806e2624 0x806e2624
+806e2744 0x806e2744
+806e274c 0x806e274c
+806e27a4 0x806e27a4
+806e27fc 0x806e27fc
+806e2804 0x806e2804
+806e2860 0x806e2860
+806e286c 0x806e286c
+806e2878 0x806e2878
+806e287c 0x806e287c
+806e2880 0x806e2880
+806e2888 0x806e2888
+806e28c8 0x806e28c8
+806e28d0 0x806e28d0
+806e28d4 0x806e28d4
+806e28d8 0x806e28d8
+806e28e4 0x806e28e4
+806e28f0 0x806e28f0
+806e28f4 0x806e28f4
+806e28fc 0x806e28fc
+806e2904 0x806e2904
+806e2b7c 0x806e2b7c
+806e2be0 0x806e2be0
+806e2c4c 0x806e2c4c
+806e2cf0 0x806e2cf0
+806e2d80 0x806e2d80
+806e2e08 0x806e2e08
+806e2f24 0x806e2f24
+806e2f34 0x806e2f34
+806e2f38 0x806e2f38
+806e3034 0x806e3034
+806e327c 0x806e327c
+806e3324 0x806e3324
+806e344c 0x806e344c
+806e3458 0x806e3458
+806e384c 0x806e384c
+806e388c 0x806e388c
+806e3920 0x806e3920
+806e3a64 0x806e3a64
+806e3a68 0x806e3a68
+806e3a6c 0x806e3a6c
+806e3a70 0x806e3a70
+806e3a74 0x806e3a74
+806e3a7c 0x806e3a7c
+806e3a84 0x806e3a84
+806e3a8c 0x806e3a8c
+806e3b8c 0x806e3b8c
+806e3bc8 0x806e3bc8
+806e3de0 0x806e3de0
+806e3e20 Objects::Pile::OnStart
+806e3edc Objects::Pile::Update
+806e3ef0 0x806e3ef0
+806e3f20 0x806e3f20
+806e41a4 Objects::Wanwan_Chn::LoadCollision
+806e4208 Objects::Wanwan_Chn::Update
+806e4218 0x806e4218
+806e4220 Objects::Wanwan_Chn::UpdateCollision
+806e4224 Objects::Wanwan::__ct
+806e4a64 Objects::Wanwan_Chn::OnStart
+806e4a88 0x806e4a88
+806e4aec Objects::Wanwan::__dt
+806e4b98 Objects::Wanwan::vf_0x10
+806e4b9c Objects::Wanwan::OnStart
+806e4f2c Objects::Wanwan::Update
+806e526c Objects::Wanwan::OnCollision
+806e546c Objects::Wanwan::OnItemCollision
+806e56c4 0x806e56c4
+806e59bc 0x806e59bc
+806e5a8c 0x806e5a8c
+806e5d70 0x806e5d70
+806e5edc 0x806e5edc
+806e6208 Objects::Wanwan::BeforeWanderB
+806e63a4 Objects::Wanwan::WanderBUpdate
+806e6730 Objects::Wanwan::BeforeWanderA
+806e6838 Objects::Wanwan::WanderAUpdate
+806e6b58 Objects::Wanwan::BeforeLookUp
+806e6b7c Objects::Wanwan::LookUpUpdate
+806e6c54 Objects::Wanwan::BeforeDigDown
+806e6c98 Objects::Wanwan::DigDownUpdate
+806e6dd4 Objects::Wanwan::BeforeLookStraight
+806e6dd8 Objects::Wanwan::LookStraightUpdate
+806e6eb0 Objects::Wanwan::BeforeAttack
+806e6f6c Objects::Wanwan::AttackUpdate
+806e70c4 0x806e70c4
+806e73c4 Objects::Wanwan::BeforeRetreat
+806e7494 Objects::Wanwan::RetreatUpdate
+806e7594 0x806e7594
+806e7638 0x806e7638
+806e78b0 0x806e78b0
+806e794c 0x806e794c
+806e79e4 0x806e79e4
+806e7b7c 0x806e7b7c
+806e7ba4 0x806e7ba4
+806e7e38 0x806e7e38
+806e7edc vector3_lerp
+806e7f64 0x806e7f64
+806e8010 0x806e8010
+806e8014 0x806e8014
+806e8340 0x806e8340
+806e8488 0x806e8488
+806e8520 0x806e8520
+806e87c8 0x806e87c8
+806e896c 0x806e896c
+806e8a60 0x806e8a60
+806e8f4c 0x806e8f4c
+806e9084 0x806e9084
+806e9464 Objects::Wanwan::UpdateModelMatrix
+806e9468 Objects::Wanwan::LoadAnimations
+806e94b4 Objects::Wanwan::vf_0xC
+806e94bc Objects::Wanwan::GetPropertiesBitfield
+806e94c4 Objects::Wanwan_Chn::GetCollisionDiameter
+806e94dc Objects::Wanwan_Chn::GetName
+806e94e8 Objects::Wanwan_Chn::GetSubFileName
+806e94f4 Objects::Wanwan_Chn::GetPropertiesBitfield
+806e94fc Objects::Wanwan_Chn::__dt
+806e953c Objects::Pile::GetName
+806e9548 Objects::Pile::GetSubFileName
+806e9554 Objects::Pile::GetBRRESName
+806e9560 Objects::Pile::GetPropertiesBitfield
+806e9568 Objects::Pile::__dt
+806e95a8 Objects::Wanwan::__dt
+806e95b0 Objects::HwanwanBall::__ct
+806e96c0 0x806e96c0
+806e9724 Objects::HwanwanBall::OnStart
+806e9a78 Objects::HwanwanBall::Update
+806e9cac Objects::HwanwanBall::OnCollision
+806e9d6c Objects::HwanwanBall::OnItemCollision
+806e9e04 0x806e9e04
+806e9e10 0x806e9e10
+806e9fe0 0x806e9fe0
+806e9fe4 0x806e9fe4
+806ea288 0x806ea288
+806ea2fc 0x806ea2fc
+806ea6c4 0x806ea6c4
+806ea784 0x806ea784
+806eaae8 0x806eaae8
+806eac4c 0x806eac4c
+806eacd4 0x806eacd4
+806eb0a8 0x806eb0a8
+806eb184 0x806eb184
+806eb460 0x806eb460
+806eb650 0x806eb650
+806eb86c 0x806eb86c
+806ebd58 0x806ebd58
+806ebe90 Objects::HwanwanBall::UpdateShadow
+806ebf8c 0x806ebf8c
+806ec030 0x806ec030
+806ec0f0 0x806ec0f0
+806ec280 0x806ec280
+806ec2fc 0x806ec2fc
+806ec44c 0x806ec44c
+806ec520 0x806ec520
+806ec5e8 0x806ec5e8
+806ec6e0 Objects::HwanwanBall::__dt
+806ec74c Objects::HwanwanBall::UpdateModelMatrix
+806ec750 Objects::HwanwanBall::LoadAnimations
+806ec7a0 Objects::HwanwanBall::vf_0xc
+806ec7a8 Objects::HwanwanBall::LoadRoute
+806ec7ac Objects::HwanwanBall::GetSubFileName
+806ec7b8 Objects::HwanwanBall::GetPropertiesBitfield
+806ec7c0 Objects::HwanwanBall::__dt(thunk)
+806ec7c8 Effects::Menus::__ct
+806ec914 Effects::Menus::__dt
+806ec994 Effects::Menus::GetEffectByIdx
+806ec9a4 Route::__ct(POTI)
+806ecafc RoutePoint::__ct
+806ecb00 RoutePoint::__dt
+806ecb40 Route::__ct(PointsArray)
+806ecc40 Route::__dt
+806eccc0 Route::FillNormals
+806ece5c Route::FillBLIGHTIndexes
+806ecf88 Route::UpdatePoints
+806ed110 Route::AddPoint
+806ed150 Route::GetPointById
+806ed160 RouteController::__ct
+806ed204 0x806ed204
+806ed24c RouteController::GetNormal
+806ed2b4 RouteController::GetBLIGHTIndex
+806ed30c RouteController::GetTotalDistance
+806ed34c 0x806ed34c
+806ed3e4 0x806ed3e4
+806ed428 0x806ed428
+806ed53c RouteController::__dt
+806ed57c RouteCurved::__ct(POTI)
+806ed6c0 RouteArc::__ct
+806ed6c4 RouteArc::__ct
+806ed704 RouteCurved::__ct(PointsArray)
+806ed828 RouteCurved::__dt
+806ed8bc RouteCurved::Update
+806ed960 RouteCurved::UpdateTotalDistance
+806eda04 RouteCurved::Init
+806ee27c 0x806ee27c
+806ee408 0x806ee408
+806ee4b8 RouteCurved::Calc
+806ee56c 0x806ee56c
+806ee72c 0x806ee72c
+806ee830 RouteCurvedController::__ct
+806ee924 RouteCurvedController::Init
+806eead8 RouteCurvedController::SetParams
+806eeb94 RouteCurvedController::UpdateSpeed
+806eebec RouteCurvedController::Update
+806eeebc RouteCurvedController::vf_0x24
+806eefa0 RouteCurvedController::vf_0x28
+806ef09c RouteCurvedController::GetDistanceToNextPoint
+806ef0d8 RouteCurvedController::GetTotalPercent
+806ef0f8 RouteCurvedController::GetTotalPercentNormalDir
+806ef224 RouteCurvedController::CalculateBezier
+806ef350 RouteCurvedController::CalculateBezierCurve
+806ef454 RouteCurvedController::CalculateBezierDir
+806ef648 RouteController::IsAtRouteEnd
+806ef664 0x806ef664
+806ef804 0x806ef804
+806ef870 0x806ef870
+806ef8f0 0x806ef8f0
+806ef93c RouteCurvedController::GetSpeed
+806ef944 RouteCurvedController::__dt
+806ef984 RouteCurved::GetPercentFromOriginArrays
+806ef98c RouteCurved::GetPercent
+806ef994 RouteCurved::GetPointsPerArc
+806ef99c RouteCurved::GetArcArray
+806ef9a4 RouteCurved::GetSegmentArray
+806ef9ac RouteCurved::GetTotalDistance
+806ef9b4 RouteStraight::__ct(POTI)
+806efbf0 RouteSegment::__ct
+806efbf4 RouteSegment::__dt
+806efc34 RouteStraight::__ct(PointsArray)
+806efd6c RouteStraight::__dt
+806efdc4 RouteStraightController::__ct
+806efe50 RouteStraightController::SetParams
+806efeac RouteStraightController::Init
+806efff4 RouteStraightController::UpdateSpeed
+806f0050 RouteStraightController::Update
+806f02ec RouteStraightController::vf_0x24
+806f041c RouteStraightController::vf_0x28
+806f050c RouteStraightController::GetDistanceToNextPoint
+806f0540 0x806f0540
+806f05f4 0x806f05f4
+806f0610 0x806f0610
+806f0814 0x806f0814
+806f0880 0x806f0880
+806f0900 0x806f0900
+806f0944 RouteStraightController::GetSpeed
+806f094c RouteStraightController::__dt
+806f098c RouteStraight::UpdateTotalDistance
+806f0990 RouteStraight::Update
+806f0994 RouteStraight::GetPercentFromOriginArrays
+806f099c RouteStraight::GetPercent
+806f09a8 RouteStraight::GetPointsPerArc
+806f09b0 RouteStraight::GetArcArray
+806f09b8 RouteStraight::GetSegmentArray
+806f09c0 RouteStraight::GetTotalDistance
+806f09c8 RouteHolder::CreateInstance
+806f0a3c RouteHolder::__ct
+806f0a4c RouteHolder::DestroyInstance
+806f0a98 RouteHolder::__dt
+806f0ad8 RouteHolder::Init
+806f0e58 RouteHolder::CreateRoute
+806f0fc8 RouteHolder::UpdateRoutePoints
+806f1064 RouteHolder::AddRoutePoint
+806f10fc RouteHolder::GetRouteById
+806f110c 0x806f110c
+806f1154 0x806f1154
+806f1158 0x806f1158
+806f1194 0x806f1194
+806f1224 0x806f1224
+806f12b4 0x806f12b4
+806f133c 0x806f133c
+806f13fc 0x806f13fc
+806f14bc 0x806f14bc
+806f1568 0x806f1568
+806f162c 0x806f162c
+806f16ec 0x806f16ec
+806f1878 0x806f1878
+806f1998 0x806f1998
+806f19f8 0x806f19f8
+806f1a54 0x806f1a54
+806f1c58 0x806f1c58
+806f1db8 0x806f1db8
+806f1f14 0x806f1f14
+806f2074 0x806f2074
+806f220c 0x806f220c
+806f22c8 0x806f22c8
+806f2380 0x806f2380
+806f243c 0x806f243c
+806f2450 0x806f2450
+806f2470 0x806f2470
+806f2490 0x806f2490
+806f2730 0x806f2730
+806f2944 0x806f2944
+806f2978 0x806f2978
+806f2a38 0x806f2a38
+806f2dac 0x806f2dac
+806f2e34 0x806f2e34
+806f2fe8 Linked3DPoints::__ct
+806f31f4 Linked3DPoints::__dt
+806f3284 0x806f3284
+806f3370 0x806f3370
+806f3450 0x806f3450
+806f3ab4 0x806f3ab4
+806f3ce8 0x806f3ce8
+806f3d78 0x806f3d78
+806f3f2c 0x806f3f2c
+806f402c 0x806f402c
+806f40f8 0x806f40f8
+806f4160 0x806f4160
+806f4384 0x806f4384
+806f43e8 0x806f43e8
+806f442c 0x806f442c
+806f451c 0x806f451c
+806f4560 0x806f4560
+806f45a4 0x806f45a4
+806f4600 0x806f4600
+806f4630 0x806f4630
+806f46a8 0x806f46a8
+806f46ec 0x806f46ec
+806f471c 0x806f471c
+806f4780 0x806f4780
+806f47b0 0x806f47b0
+806f47d4 0x806f47d4
+806f47f8 0x806f47f8
+806f481c 0x806f481c
+806f4840 0x806f4840
+806f4864 0x806f4864
+806f4888 0x806f4888
+806f48ac aramGetFirstUserAddress
+806f48d0 0x806f48d0
+806f490c 0x806f490c
+806f49b4 0x806f49b4
+806f49b8 0x806f49b8
+806f49bc 0x806f49bc
+806f4de8 0x806f4de8
+806f5290 0x806f5290
+806f531c 0x806f531c
+806f53b8 0x806f53b8
+806f5440 0x806f5440
+806f562c 0x806f562c
+806f56d4 0x806f56d4
+806f5900 0x806f5900
+806f5a8c 0x806f5a8c
+806f5af0 0x806f5af0
+806f5bf0 0x806f5bf0
+806f5c90 0x806f5c90
+806f5cd0 0x806f5cd0
+806f5d50 0x806f5d50
+806f6044 0x806f6044
+806f60c4 0x806f60c4
+806f6130 0x806f6130
+806f6194 0x806f6194
+806f62fc 0x806f62fc
+806f64ac 0x806f64ac
+806f661c 0x806f661c
+806f6838 0x806f6838
+806f696c Audio::Engine3D::Disposer__dt
+806f6a04 Audio::Engine3D::CreateInstance
+806f6a94 Audio::Engine3D::DestroyInstance
+806f6ac8 Audio::Engine3D::SetCurSound
+806f6ad4 0x806f6ad4
+806f6b5c 0x806f6b5c
+806f6bec 0x806f6bec
+806f6c68 Audio::Engine3D::__ct
+806f6ccc 0x806f6ccc
+806f6d0c 0x806f6d0c
+806f6d4c Audio::Engine3D::__dt
+806f6df4 Audio::Engine3D::UpdateAmbientParam
+806f7608 Audio::Engine3D::GetRequiredVoiceOutCount
+806f7610 0x806f7610
+806f7698 Audio::ItemWarning::GetPan
+806f772c Audio::ItemWarning::__ct
+806f7740 0x806f7740
+806f7780 0x806f7780
+806f77d4 Audio::ItemWarning::Init
+806f7828 Audio::ItemWarningMgr::PlayTargetedWarning
+806f7a54 0x806f7a54
+806f7aa8 Audio::ItemWarningMgr::PlayUntargetedWarning
+806f7ce0 Audio::ItemWarningMgr::PlayWarningOnWiimote
+806f7d58 Audio::ItemWarningMgr::Disposer__dt
+806f7ee8 Audio::ItemWarningMgr::CreateInstance
+806f7f70 Audio::ItemWarning::__dt
+806f7fcc Audio::ItemWarningMgr::DestroyInstance
+806f80ac Audio::ItemWarningMgr::__dt
+806f8188 Audio::ItemWarningMgr::Init
+806f8204 Audio::ItemWarningMgr::Shutdown
+806f8210 Audio::ItemWarningMgr::GetItemWarning
+806f8220 Audio::SinglePlayer::CalcWaitTime
+806f84a8 Audio::SinglePlayer::Disposer__dt
+806f8648 Audio::SinglePlayer::CreateInstance
+806f86f0 Audio::SinglePlayer::DestroyInstance
+806f886c Audio::SinglePlayer::__ct
+806f88e8 Audio::Handle::__ct
+806f88f4 Audio::Handle::__dt
+806f8934 Audio::SinglePlayer::__dt
+806f8a64 Audio::SinglePlayer::Calc
+806f8b7c Audio::SinglePlayer::PlaySound
+806f8d98 Audio::Manager::PrepareSound
+806f8dcc Audio::SinglePlayer::PrepareSound
+806f8ed8 0x806f8ed8
+806f9034 Audio::SinglePlayer::PlayPreparedSound
+806f90b8 Audio::SinglePlayer::PreventActiveSoundStop
+806f90c4 Audio::SinglePlayer::StopSound
+806f913c Audio::SinglePlayer::StartSound
+806f933c Audio::SinglePlayer::SetupActiveHandle
+806f9408 Audio::SinglePlayer::SetupActiveHandle_switch
+806f940c Audio::SinglePlayer::SetupActiveHandle_caseD_83
+806f943c Audio::SinglePlayer::SetupActiveHandle_caseD_91
+806f9458 Audio::SinglePlayer::SetupActiveHandle_caseD_85
+806f9498 Audio::SinglePlayer::SetupActiveHandle_caseD_7b
+806f94c4 Audio::SinglePlayer::SetupActiveHandle_caseD_7d
+806f94e0 0x806f94e0
+806f95d8 Audio::SinglePlayer::StartActiveSound
+806f9698 Audio::SinglePlayer::GetFreeHandle
+806f9724 0x806f9724
+806f9728 Audio::SinglePlayer::GetFanfareLength
+806f98ac 0x806f98ac
+806f9900 Audio::SinglePlayer::StopInactiveSounds
+806f9990 Audio::SinglePlayerValuesMgr::Disposer__dt
+806f9abc Audio::SinglePlayerValuesMgr::CreateInstance
+806f9b64 Audio::SinglePlayerValuesMgr::DestroyInstance
+806f9c18 Audio::SinglePlayerValuesMgr::__dt
+806f9cbc Audio::SinglePlayerValuesMgr::SetHandle
+806f9ce0 Audio::SinglePlayerValuesMgr::Calc
+806f9e14 Audio::SinglePlayerValuesMgr::DetachHandle
+806f9e20 Audio::SinglePlayerValuesMgr::UpdateTracks
+806f9e78 Audio::SinglePlayerValuesMgr::SetVolume
+806f9ebc 0x806f9ebc
+806f9f80 Audio::StreamsMgr::Disposer_dt
+806fa0ac Audio::StreamsMgr::CreateInstance
+806fa154 Audio::StreamsMgr::DestroyInstance
+806fa208 Audio::StreamsMgr::__dt
+806fa2ac Audio::StreamsMgr::PrepareStreams
+806fa3fc Audio::StreamsMgr::ChangeStreamVolume
+806fa420 Audio::StreamsMgr::Calc
+806fa5ac Audio::StreamsMgr::ResetVolume
+806fa604 Audio::SinglePlayer::PlayBGSound
+806fa678 Audio::SinglePlayer::UpdateWaitTime
+806fa6e4 0x806fa6e4
+806fa738 Audio::SinglePlayer::CalcTitlePageNext
+806faab4 Audio::StreamsMgr::ChangeMultipleStreamsVolume
+806fab2c Audio::StreamsMgr::ChangeStream
+806fae60 Audio::EngineMgr::Init
+806fafb4 Audio::EngineMgr::Update
+806fb2fc Audio::EngineMgr::CalcSoundId
+806fb394 0x806fb394
+806fb444 Audio::EngineMgr::CalcAccelerating
+806fb558 Audio::EngineMgr::CalcBraking
+806fb640 Audio::EngineMgr::CalcPitch
+806fb720 Audio::RaceAmbienceMgr::Disposer__dt
+806fb8b8 Audio::RaceAmbienceMgr::CreateInstance
+806fb964 Audio::RaceAmbienceMgr::DestroyInstance
+806fbab0 Audio::RaceAmbienceMgr::__ct
+806fbb30 0x806fbb30
+806fbb70 Audio::RaceAmbienceMgr::__dt
+806fbc90 Audio::RaceAmbienceMgr::Init
+806fbcc4 Audio::RaceAmbienceMgr::StopGlobalSound
+806fbcdc Audio::RaceAmbienceMgr::Update
+806fbe14 Audio::RaceAmbienceMgr::StopGlobalSoundFadeOut
+806fbe30 Audio::RaceAmbienceMgr::PlayIntroAmbience
+806fbec0 Audio::RaceAmbienceMgr::PlayIntroAmbience_switch
+806fbec4 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_1
+806fbf68 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_2
+806fbf90 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_3
+806fc064 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_4
+806fc140 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_5
+806fc1fc Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_6
+806fc278 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_7
+806fc2c4 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_3a
+806fc2ec Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_a
+806fc368 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_b
+806fc3dc Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_c
+806fc44c Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_d
+806fc4d0 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_e
+806fc51c Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_f
+806fc5a0 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_10
+806fc628 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_11
+806fc660 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_12
+806fc704 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_13
+806fc7bc Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_14
+806fc860 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_16
+806fc8cc Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_17
+806fc960 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_19
+806fc9b0 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_1a
+806fc9dc Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_1b
+806fca2c Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_1c
+806fca8c Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_1d
+806fcb30 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_1e
+806fcb5c Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_1f
+806fcb84 Audio::RaceAmbienceMgr::PlayIntroAmbience_caseD_0
+806fcba0 Audio::RaceAmbienceMgr::PlayGlobalSound
+806fcd74 Audio::RaceAmbienceMgr::StopGlobalSound(soundId)
+806fcda8 Audio::RaceAmbienceMgr::PlayAmbience
+806fcefc Audio::RaceAmbienceMgr::SetAmbienceVolume
+806fcfa0 Audio::RaceAmbienceMgr::SetAllAmbiencesVolume
+806fd03c Audio::RaceAmbienceMgr::UpdateAmbiences
+806fd0ac Audio::RaceAmbienceMgr::UpdateVeniceAndRingMissionAmbiences
+806fd55c 0x806fd55c
+806fd624 Audio::Ambience::__ct
+806fd6b0 Audio::Ambience::__dt
+806fd73c Audio::Ambience::IsPlayingSoundId
+806fd770 Audio::Ambience::PlayAmbience
+806fd7d4 Audio::Ambience::ResetVolume
+806fd800 Audio::Ambience::SetVolume
+806fd818 Audio::Ambience::Update
+806fd9e0 0x806fd9e0
+806fdae4 Audio::GameHeap::Disposer__dt
+806fdc1c Audio::GameHeap::CreateInstance
+806fdcec Audio::GameHeap::DestroyInstance
+806fde08 Audio::GameHeap::__ct
+806fdeac Audio::GameHeapImpl::__dt
+806fdf18 Audio::GameHeap::__dt
+806fdffc Audio::GameHeap::Initialize
+806fe044 Audio::GameHeap::DestroySoundHeap
+806fe084 Audio::GameHeap::SetType
+806fe0a0 0x806fe0a0
+806fe0e0 EGG::SoundHeapMgr::SaveState(using)
+806fe1b4 EGG::SoundHeapMgr::LoadState(using)
+806fe240 EGG::SoundHeapMgr::GetCurrentLevel(using)
+806fe294 0x806fe294
+806fe2b8 Audio::ReverbMgr::Disposer__dt
+806fe3e4 Audio::ReverbMgr::CreateInstance
+806fe4d0 Audio::ReverbMgr::DestroyInstance
+806fe584 Audio::ReverbMgr::__ct
+806fe654 Audio::ReverbMgr::__dt
+806fe6f8 Audio::ReverbMgr::Disable
+806fe71c Audio::ReverbMgr::Clear
+806fe86c 0x806fe86c
+806fe8ac Audio::ReverbMgr::Prepare
+806fe944 Audio::ReverbMgr::Play
+806fe9bc Audio::ReverbMgr::Disable2
+806fe9e0 Audio::FileManager::__dt
+806fea20 0x806fea20
+806fea60 0x806fea60
+806feaa0 Audio::FileManager::Init
+806febcc 0x806febcc
+806fec98 0x806fec98
+806fee90 Audio::FileManager::LoadBank
+806fefd0 0x806fefd0
+806ff110 0x806ff110
+806ff17c Audio::FileManager::IsBankLoaded
+806ff204 0x806ff204
+806ff28c 0x806ff28c
+806ff4cc 0x806ff4cc
+806ff578 Audio::FileManager::InvalidateWaveData
+806ff5c4 Audio::FileManager::InvalidateData
+806ff610 Audio::FileManager::GetFileWaveDataAddress
+806ff638 Audio::FileManager::GetFileAddress
+806ff660 Audio::FileManager::AudioFileManager
+806ff6b0 Audio::FileManager::__dt(thunk)
+806ff6b8 Audio::FileManager::InvalidateData(thunk)
+806ff6c0 Audio::FileManager::InvalidateWaveData(thunk)
+806ff6c8 Audio::FileManager::SetRequest
+806ff864 0x806ff864
+806ff8a4 Audio::FileManager::LoadGroupAsync
+806ffab4 0x806ffab4
+806ffbac Audio::GroupBankRequester::Disposer__dt
+806ffcd8 Audio::GroupBankRequester::CreateInstance
+806ffe40 Audio::GroupBankRequester::DestroyInstance
+806ffef4 Audio::GroupBankRequester::__ct
+80700030 Audio::GroupBankRequester::__dt
+807000d4 Audio::GroupBankRequester::RequestLoad(id)
+8070010c Audio::GroupBankRequester::RequestLoad(actorId)
+80700184 0x80700184
+807001a4 Audio::Manager::LoadState
+80700230 Audio::GroupBankRequester::ProcessRequests
+807002bc Audio::GroupBankRequester::LoadAsync
+80700440 Audio::GroupBankRequester::GroupBankLoader
+80700460 Audio::GroupBankRequester::ConstructRequests
+80700474 Audio::GroupBankRequester::Request::__ct
+80700578 0x80700578
+807005b8 Audio::Actor<4>::__dt
+8070062c 0x8070062c
+807006b4 0x807006b4
+80700728 Audio::RaceActor::SetupBRASD
+80700754 Audio::RaceActor::UpdateBRASDFrame
+807007cc Audio::RaceActor::Update
+80700814 Audio::Actor<4>::SetPosition
+80700818 Audio::RaceActor::SetupSound
+80700894 ObjectSoundAnimNoHandle::__ct
+807009bc Audio::RaceActor::__dt
+80700a80 ObjectSoundAnimNoHandle::Update
+80700ac8 ObjectSoundAnimNoHandle::Link
+80700b38 ObjectSoundAnimNoHandle::DisableConditional
+80700b80 Audio::RaceActor::DisableConditional
+80700b9c ObjectSoundAnimNoHandle::UpdateUserParam3
+80700bbc Audio::RaceActor::UpdateUserParam3
+80700bdc ObjectSoundAnimNoHandle::StartSoundLimited
+80700d4c Audio::RaceActor::StartSoundLimited
+80700ea8 ObjectSoundAnimNoHandle::HoldSoundLimited
+80701018 Audio::RaceAnimActor::__ct
+80701140 Audio::RaceAnimActor::StartSound
+80701154 Audio::RaceActor::StartSound
+807011c8 0x807011c8
+807011e0 Audio::RaceActor::StartSound(StartInfo)
+80701260 Audio::RaceAnimActor::HoldSound
+80701274 0x80701274
+807012e8 0x807012e8
+80701300 Audio::RaceActor::HoldSound
+80701380 Audio::RaceAnimActor::StopSound
+80701394 Audio::RaceActor::StopSound
+80701398 Audio::RaceActor::HoldSound
+807013a0 Audio::RaceActor::StartSound
+807013a8 Audio::RaceActor::StartNewSoundLimited
+807014e8 Audio::RaceActor::HoldSoundLimited
+807016fc Audio::RaceActor::StopAllSound
+80701760 Audio::RaceActor::GetPosition
+80701768 Audio::RaceActor::UpdateUserParam
+8070177c Audio::RaceActor::UpdateUserParam2
+80701794 Audio::RaceActor::detail_UpdateAmbientArg
+807017f8 Audio::Actor<4>::TryStartSound(u32)
+80701884 Audio::Actor<4>::TryStartSound(ul)
+80701910 Audio::Actor<4>::TryStartSound(str)
+807019d0 Audio::Actor<4>::TryStopAndStartSound(u32)
+80701a64 Audio::Actor<4>::TryStopAndStartSound(ul)
+80701af8 Audio::Actor<4>::TryStopAndStartSound(str)
+80701bb4 Audio::Actor<4>::TryHoldSound(u32)
+80701c9c Audio::Actor<4>::TryHoldSound(ul)
+80701d84 Audio::Actor<4>::TryHoldSound(str)
+80701ea0 Audio::Actor<4>::TryHoldSound(u32, handleId)
+80701f08 Audio::Actor<4>::TryHoldSound(u3l, handleId)
+80701f70 Audio::Actor<4>::TryHoldSound(str, handleId)
+80702014 Audio::Actor<4>::TryPrepareSound(u32)
+807020a0 Audio::Actor<4>::TryPrepareSound(ul)
+8070212c Audio::Actor<4>::TryPrepareSound(str)
+807021ec Audio::Actor<4>::TryStopAndPrepareSound(u32)
+80702280 Audio::Actor<4>::TryStopAndPrepareSound(ul)
+80702314 Audio::Actor<4>::TryStopAndPrepareSound(str)
+807023d0 ObjectSoundAnimNoHandle::__dt
+80702498 Audio::RaceAnimActor::__dt
+80702570 Audio::Actor::detail_UpdateAmbientArg
+80702578 0x80702578
+80702580 0x80702580
+80702588 Audio::RaceActor::__dt
+80702590 ObjectSoundAnimNoHandle::__dt
+80702598 ObjectSoundAnimNoHandle::HoldSoundLimited
+807025a0 ObjectSoundAnimNoHandle::StartSoundLimited
+807025a8 ObjectSoundAnimNoHandle::UpdateUserParam3
+807025b0 ObjectSoundAnimNoHandle::DisableConditional
+807025b8 ObjectSoundAnimNoHandle::Update
+807025c0 ObjectSoundAnimNoHandle::Link
+807025c8 Audio::RaceActor::detail_UpdateAmbientArg
+807025d0 0x807025d0
+807025d8 Audio::RaceActor::UpdateBRASDFrame
+807025e0 Audio::RaceActor::SetupBRASD
+807025e8 Audio::RaceActor::HoldSound
+807025f0 Audio::RaceActor::HoldSound(StartInfo)
+807025f8 Audio::RaceActor::StartSound
+80702600 Audio::RaceActor::StartSound(StartInfo)
+80702608 Audio::RaceAnimActor::StopSound
+80702610 Audio::RaceAnimActor::HoldSound
+80702618 Audio::RaceAnimActor::StartSound
+80702620 Audio::RaceActor::StartNewSoundLimited
+80702628 Audio::RaceActor::StopAllSound
+80702630 Audio::RaceActor::HoldSoundLimited
+80702638 Audio::RaceActor::StartSoundLimited
+80702640 Audio::RaceActor::UpdateUserParam3
+80702648 Audio::RaceActor::DisableCondition
+80702650 Audio::RaceActor::UpdateUserParam2
+80702658 Audio::RaceActor::UpdateUserParam
+80702660 Audio::RaceActor::Reset
+80702668 Audio::RaceActor::GetPosition
+80702670 Audio::RaceActor::Update
+80702678 Audio::LinkedRaceActor::__ct
+807026cc Audio::LinkedRaceActor::__dt
+80702714 Audio::LinkedRaceActor::Link
+807027d0 Audio::LinkedRaceActor::Unlink
+80702828 0x80702828
+80702848 0x80702848
+807028e4 Audio::LinkedRaceActor::CannotPlaySounds
+8070296c 0x8070296c
+80702970 Audio::LinkedRaceActor::Toggle
+807029cc Audio::LinkedRaceActor::GetKartPosition
+807029d4 Audio::LinkedRaceActor::GetObjectPosition
+807029e0 Audio::LinkedRaceActor::SetSoundParams
+807029f0 Audio::ObjectActorAnim::__ct
+80702a44 0x80702a44
+80702a84 Audio::ObjectActorAnim::Link
+80702af4 Audio::ObjectActorAnim::Unlink
+80702afc Audio::ObjectActorAnim::Update
+80702b00 Audio::ObjectActorAnim::StartSoundLimited
+807030a4 Audio::ObjectActorAnim::HoldSoundLimited
+807034c4 Audio::ObjectActorAnim::StartNewSoundLimited
+807036cc Audio::ObjectActorAnim::StartSound
+80703ac8 Audio::ObjectActorAnim::SetupSound
+80703d64 Audio::ObjectActorAnim::DisableConditional
+80703f00 Audio::ObjectActorAnim::UpdateUserParam3
+80703fb0 Audio::ObjectActorAnim::__dt
+8070408c Audio::ObjectActorAnim::__dt(thunk)
+80704094 Audio::ObjectActorAnim::StartSound(thunk)
+8070409c Audio::ObjectActorAnim::StartNewSoundLimited(thunk)
+807040a4 Audio::ObjectActorAnim::HoldSoundLimited(thunk)
+807040ac Audio::ObjectActorAnim::StartSoundLimited(thunk)
+807040b4 Audio::ObjectActorAnim::UpdateUserParam3(thunk)
+807040bc Audio::ObjectActorAnim::DisableConditional(thunk)
+807040c4 Audio::ObjectActorAnim::Update(thunk)
+807040cc Audio::ObjectActorAnim::Unlink(thunk)
+807040d4 Audio::ObjectActorAnim::Link(thunk)
+807040dc Audio::ItemActor::__ct
+80704184 0x80704184
+807041c4 Audio::Actor<2>::__dt
+80704238 0x80704238
+807042c0 Audio::ItemActor::Link
+807042c8 Audio::ItemActor::Unlink
+807042d0 Audio::ItemActor::Update
+807042e8 Audio::Actor<2>::SetPosition
+807042ec Audio::ItemActor::DisableConditional
+80704308 0x80704308
+80704324 Audio::ItemActor::UpdateUserParam3
+80704344 0x80704344
+80704364 Audio::ItemActor::StartSoundLimited
+80704594 0x80704594
+807046a0 Audio::ItemActor::HoldSoundLimited
+8070482c 0x8070482c
+80704998 Audio::ItemActor::StartNewSoundLimited
+80704a94 0x80704a94
+80704b7c 0x80704b7c
+80704bd4 Audio::GessoActor::__ct
+80704c7c 0x80704c7c
+80704cf0 0x80704cf0
+80704d78 Audio::GessoActor::Link
+80704d80 Audio::GessoActor::Update
+80704d84 0x80704d84
+80704d94 0x80704d94
+80704d98 Audio::GessoActor::StartSoundLimited
+80704e90 0x80704e90
+80704f74 Audio::GessoActor::SetupBRASD
+80704f78 Audio::GessoActor::UpdateBRASDFrame
+80704f7c Audio::ItemActor::SetupBRASD
+80704f80 Audio::ItemActor::UpdateBRASD
+80704f84 Audio::GessoActor::StartNewSoundLimited
+80705040 Audio::GessoActor::HoldSoundLimited
+80705158 Audio::GessoActor::StopAllSound
+8070516c Audio::GessoActor::StartSound
+807051e0 Audio::GessoActor::StartSound(StartInfo)
+80705260 Audio::GessoActor::HoldSound
+807052d4 Audio::GessoActor::HoldSound(StartInfo)
+80705354 Audio::GessoActor::Reset
+80705394 Audio::GessoActor::GetPosition
+8070539c Audio::GessoActor::UpdateUserParam
+807053b0 Audio::GessoActor::UpdateUserParam2
+807053c8 Audio::GessoActor::DisableConditional
+807053e4 Audio::GessoActor::UpdateUserPar
+80705404 Audio::GessoActor::detail_UpdateAmbientArg
+80705468 Audio::ItemActor::StopAllSound
+807054cc Audio::ItemActor::StartSound
+80705540 Audio::ItemActor::StartSound(StartInfo)
+807055c0 Audio::ItemActor::HoldSound
+80705634 Audio::ItemActor::HoldSound(StartInfo)
+807056b4 Audio::ItemActor::Reset
+807056f4 Audio::ItemActor::GetPosition
+807056fc Audio::ItemActor::UpdateUserParam
+80705710 Audio::ItemActor::UpdateUserParam2
+80705728 Audio::ItemActor::detail_UpdateAmbientArg
+8070578c 0x8070578c
+80705818 0x80705818
+807058a4 0x807058a4
+80705964 0x80705964
+807059f8 0x807059f8
+80705a8c 0x80705a8c
+80705b48 0x80705b48
+80705c30 0x80705c30
+80705d18 0x80705d18
+80705e34 0x80705e34
+80705e9c 0x80705e9c
+80705f04 0x80705f04
+80705fa8 0x80705fa8
+80706034 0x80706034
+807060c0 0x807060c0
+80706180 0x80706180
+80706214 0x80706214
+807062a8 0x807062a8
+80706364 Audio::Actor<2>::TryStartSound(u32)
+807063f0 Audio::Actor<2>::TryStartSound(ul)
+8070647c Audio::Actor<2>::TryStartSound(str)
+8070653c Audio::Actor<2>::TryStopAndStartSound(u32)
+807065d0 Audio::Actor<2>::TryStopAndStartSound(ul)
+80706664 Audio::Actor<2>::TryStopAndStartSound(str)
+80706720 Audio::Actor<2>::TryHoldSound(u32)
+80706808 Audio::Actor<2>::TryHoldSound(ul)
+807068f0 Audio::Actor<2>::TryHoldSound(str)
+80706a0c Audio::Actor<2>::TryHoldSound(u32, handleId)
+80706a74 Audio::Actor<2>::TryHoldSound(ul, handleId)
+80706adc Audio::Actor<2>::TryHoldSound(str, handleId)
+80706b80 Audio::Actor<2>::TryPrepareSound(u32)
+80706c0c Audio::Actor<2>::TryPrepareSound(ul)
+80706c98 Audio::Actor<2>::TryPrepareSound(str)
+80706d58 Audio::Actor<2>::TryStopAndPrepareSound(u32)
+80706dec Audio::Actor<2>::TryStopAndPrepareSound(ul)
+80706e80 Audio::Actor<2>::TryStopAndPrepareSound(str)
+80706f3c Audio::ItemActor::__dt
+80706fc8 Audio::GessoActor::__dt
+80707054 0x80707054
+8070705c 0x8070705c
+80707064 0x80707064
+8070706c 0x8070706c
+80707074 0x80707074
+8070707c 0x8070707c
+80707084 0x80707084
+8070708c Audio::ItemActor::detail_UpdateAmbientArg(thunk)
+80707094 Audio::ItemActor::__dt(thunk)
+8070709c Audio::ItemActor::UpdateBRASDFrame(thunk)
+807070a4 Audio::ItemActor::SetupBRASD(thunk)
+807070ac Audio::ItemActor::HoldSound(thunk)
+807070b4 Audio::ItemActor::HoldSound(StartInfo)(thunk)
+807070bc Audio::ItemActor::StartSound(thunk)
+807070c4 Audio::ItemActor::StartSound(StartInfo)(thunk)
+807070cc Audio::ItemActor::StartNewSoundLimited(thunk)
+807070d4 Audio::ItemActor::StopAllSound(thunk)
+807070dc Audio::ItemActor::HoldSoundLimited(thunk)
+807070e4 Audio::ItemActor::StartSoundLimited(thunk)
+807070ec Audio::ItemActor::UpdateUserParam3(thunk)
+807070f4 Audio::ItemActor::DisableConditional(thunk)
+807070fc Audio::ItemActor::UpdateUserParam2(thunk)
+80707104 Audio::ItemActor::UpdateUserParam(thunk)
+8070710c Audio::ItemActor::Reset(thunk)
+80707114 Audio::ItemActor::GetPosition(thunk)
+8070711c Audio::ItemActor::Update(thunk)
+80707124 Audio::ItemActor::Unlink(thunk)
+8070712c Audio::ItemActor::Link(thunk)
+80707134 0x80707134
+8070713c 0x8070713c
+80707144 0x80707144
+8070714c Audio::GessoActor::detail_UpdateAmbientArg(thunk)
+80707154 Audio::GessoActor::__dt(thunk)
+8070715c Audio::GessoActor::UpdateBRASDFrame(thunk)
+80707164 Audio::GessoActor::SetupBRASD(thunk)
+8070716c Audio::GessoActor::HoldSound(thunk)
+80707174 Audio::GessoActor::HoldSound(StartInfo)(thunk)
+8070717c Audio::GessoActor::StartSound(thunk)
+80707184 Audio::GessoActor::StartSound(StartInfo)(thunk)
+8070718c Audio::GessoActor::StartNewSoundLimited(thunk)
+80707194 Audio::GessoActor::StopAllSound(thunk)
+8070719c Audio::GessoActor::HoldSoundLimited(thunk)
+807071a4 Audio::GessoActor::StartSoundLimited(thunk)
+807071ac Audio::GessoActor::UpdateUserParam3(thunk)
+807071b4 Audio::GessoActor::DisableConditional(thunk)
+807071bc Audio::GessoActor::UpdateUserParam2(thunk)
+807071c4 Audio::GessoActor::UpdateUserParam(thunk)
+807071cc Audio::GessoActor::Reset(thunk)
+807071d4 Audio::GessoActor::GetPosition(thunk)
+807071dc Audio::GessoActor::Update(thunk)
+807071e4 Audio::GessoActor::Link(thunk)
+807071ec 0x807071ec
+8070722c Audio::KartActor::__ct
+80707360 Audio::SimpleRaceActor::__dt
+807073ec Audio::KartActor::__dt
+807074b0 Audio::KartActor::SetActorType
+807074d0 Audio::KartActor::DisableConditional
+80707514 Audio::KartActor::UpdateUserParam3
+80707534 Audio::KartActor::Link
+80707648 Audio::KartActor::Unlink
+807076d0 Audio::KartActor::Update
+80707e44 0x80707e44
+80707f7c Audio::KartActor::StopAllSound
+8070803c Audio::KartActor::SetupSound
+80708040 Audio::KartActor::HoldSoundLimited
+807082d8 Audio::KartActor::StartSoundLimited
+80708b20 Audio::KartActor::OutputSoundToWiimotes
+80708b44 Audio::KartActor::ApplyKCLSoundTrigger
+80708bac Audio::KartActor::PlayBoostSound
+80708d48 Audio::KartActor::PlayRampSound
+80708ee4 0x80708ee4
+80709150 Audio::KartActor::PlayCannonSound
+807091ac Audio::KartActor::PlayHornSound
+807092b4 Audio::KartActor::StartSound
+80709338 Audio::KartActor::HoldSound
+807093c4 Audio::KartActor::PlayMTSounds
+80709610 Audio::KartActor::PlayRoadSound
+80709824 0x80709824
+807098d8 0x807098d8
+80709980 Audio::KartActor::StartNewSoundLimited
+80709b08 Audio::KartActor::OnObjectNormalCollision
+80709ca4 Audio::KartActor::OnObjectWallCollision
+80709df8 Audio::KartActor::PlayObjectCollisionSounds
+8070afcc Audio::KartActor::PlayWallCollisionSound
+8070b09c Audio::KartActor::PlayBushCollisionSound
+8070b0fc 0x8070b0fc
+8070b1a8 0x8070b1a8
+8070b1d0 0x8070b1d0
+8070b250 Audio::KartActor::UpdateLapSounds
+8070b490 Audio::KartActor::UpdateKCLValues
+8070b818 0x8070b818
+8070b8dc Audio::KartActor::SetRoadState
+8070b8f0 Audio::KartActor::GetDriftAndSSMTRoadSoundId
+8070b954 Audio::KartActor::GetDriftAndSSMTRoadSoundId_switch
+8070b958 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_16
+8070b96c Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_15
+8070b978 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_13
+8070b98c Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_b
+8070b9a0 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_5
+8070b9b4 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_4
+8070b9c8 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_3
+8070b9dc Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_2
+8070b9f0 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_1
+8070ba04 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_0
+8070ba14 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_17
+8070ba28 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_1d
+8070ba38 Audio::KartActor::GetDriftAndSSMTRoadSoundId_caseD_10
+8070ba40 Audio::KartActor::GetLandingSoundId
+8070ba80 Audio::KartActor::GetLandingSoundId_switch
+8070ba84 Audio::KartActor::GetLandingSoundId_caseD_16
+8070ba98 Audio::KartActor::GetLandingSoundId_caseD_15
+8070baa4 Audio::KartActor::GetLandingSoundId_caseD_13
+8070bab8 Audio::KartActor::GetLandingSoundId_caseD_b
+8070bacc Audio::KartActor::GetLandingSoundId_caseD_5
+8070bae0 Audio::KartActor::GetLandingSoundId_caseD_4
+8070baf4 Audio::KartActor::GetLandingSoundId_caseD_3
+8070bb08 Audio::KartActor::GetLandingSoundId_caseD_2
+8070bb1c Audio::KartActor::GetLandingSoundId_caseD_1
+8070bb30 Audio::KartActor::GetLandingSoundId_caseD_0
+8070bb40 Audio::KartActor::GetLandingSoundId_caseD_17
+8070bb54 Audio::KartActor::GetLandingSoundId_caseD_1d
+8070bb64 Audio::KartActor::GetLandingSoundId_caseD_10
+8070bb6c Audio::KartActor::GetRoadSoundId
+8070bbd4 Audio::KartActor::GetRoadSoundId_caseD_16
+8070bbe8 Audio::KartActor::GetRoadSoundId_caseD_15
+8070bbf4 Audio::KartActor::GetRoadSoundId_caseD_13
+8070bc08 Audio::KartActor::GetRoadSoundId_caseD_b
+8070bc1c Audio::KartActor::GetRoadSoundId_caseD_5
+8070bc30 Audio::KartActor::GetRoadSoundId_caseD_4
+8070bc44 Audio::KartActor::GetRoadSoundId_caseD_3
+8070bc58 Audio::KartActor::GetRoadSoundId_caseD_2
+8070bc6c Audio::KartActor::GetRoadSoundId_caseD_1
+8070bc80 Audio::KartActor::GetRoadSoundId_caseD_0
+8070bc90 Audio::KartActor::GetRoadSoundId_caseD_17
+8070bca4 Audio::KartActor::GetRoadSoundId_caseD_1d
+8070bcb4 Audio::KartActor::GetRoadSoundId_caseD_10
+8070bcbc Audio::KartActor::GetBrakingSoundId
+8070bd24 Audio::KartActor::GetBrakingSoundId_caseD_16
+8070bd38 Audio::KartActor::GetBrakingSoundId_caseD_15
+8070bd44 Audio::KartActor::GetBrakingSoundId_caseD_13
+8070bd58 Audio::KartActor::GetBrakingSoundId_caseD_b
+8070bd6c Audio::KartActor::GetBrakingSoundId_caseD_5
+8070bd80 Audio::KartActor::GetBrakingSoundId_caseD_4
+8070bd94 Audio::KartActor::GetBrakingSoundId_caseD_3
+8070bda8 Audio::KartActor::GetBrakingSoundId_caseD_2
+8070bdbc Audio::KartActor::GetBrakingSoundId_caseD_1
+8070bdd0 Audio::KartActor::GetBrakingSoundId_caseD_0
+8070bde0 Audio::KartActor::GetBrakingSoundId_caseD_17
+8070bdf4 Audio::KartActor::GetBrakingSoundId_caseD_1d
+8070be04 Audio::KartActor::GetBrakingSoundId_caseD_10
+8070be0c Audio::KartActor::SetNonLocalVolumeAndPriority
+8070c468 0x8070c468
+8070c564 Audio::KartActor::PlayEngineSound
+8070c758 Audio::KartActor::SetPitch
+8070c868 0x8070c868
+8070c8b0 0x8070c8b0
+8070c8e4 Audio::KartActor::PlayOtherKartCollisionSound
+8070c988 0x8070c988
+8070ca08 Audio::SimpleRaceActor::SetupBRASD
+8070ca0c Audio::SimpleRaceActor::UpdateBRASDFrame
+8070ca10 0x8070ca10
+8070ca14 Audio::SimpleRaceActor::__dt(thunk)
+8070ca1c Audio::KartActor::__dt(thunk)
+8070ca24 Audio::SimpleRaceActor::UpdateBRASDFrame(thunk)
+8070ca2c Audio::SimpleRaceActor::SetupBRASD(thunk)
+8070ca34 Audio::KartActor::HoldSound(thunk)
+8070ca3c Audio::KartActor::StartSound(thunk)
+8070ca44 Audio::KartActor::StartNewSoundLimited(thunk)
+8070ca4c Audio::KartActor::StopAllSound(thunk)
+8070ca54 Audio::KartActor::HoldSoundLimited(thunk)
+8070ca5c Audio::KartActor::StartSoundLimited(thunk)
+8070ca64 Audio::KartActor::UpdateUserParam3(thunk)
+8070ca6c Audio::KartActor::DisableConditional(thunk)
+8070ca74 Audio::KartActor::Update(thunk)
+8070ca7c Audio::KartActor::Unlink(thunk)
+8070ca84 Audio::KartActor::Link(thunk)
+8070ca8c Audio::ObjectActor::__ct
+8070cb38 0x8070cb38
+8070cb78 Audio::ObjectActor::__dt
+8070cc08 Audio::ObjectActor::Update
+8070cd30 Audio::ObjectActor::Unlink
+8070cd38 Audio::ObjectActor::Link
+8070cda8 0x8070cda8
+8070ce00 Audio::ObjectActor::StartNewSoundLimited
+8070d978 Audio::ObjectActor::HoldSoundLimited
+8070dc8c Audio::ObjectActor::StartSoundLimited
+8070de48 0x8070de48
+8070e188 Audio::ObjectActor::DisableConditional
+8070e5f0 Audio::ObjectActor::UpdateUserParam3
+8070e674 Audio::ObjectActor::SetupSound
+8070e72c 0x8070e72c_
+8070e770 Audio::ObjectActor::__dt(thunk)
+8070e778 Audio::ObjectActor::StartNew(thunk)
+8070e780 Audio::ObjectActor::HoldSoundLimited(thunk)
+8070e788 Audio::ObjectActor::StartSoundLimited(thunk)
+8070e790 Audio::ObjectActor::UpdateUserParam3(thunk)
+8070e798 Audio::ObjectActor::DisableConditional(thunk)
+8070e7a0 Audio::ObjectActor::Update(thunk)
+8070e7a8 Audio::ObjectActor::Unlink(thunk)
+8070e7b0 Audio::ObjectActor::Link(thunk)
+8070e7b8 0x8070e7b8
+8070e874 0x8070e874
+8070e8b4 0x8070e8b4
+8070e940 0x8070e940
+8070ea24 0x8070ea24
+8070eb30 0x8070eb30
+8070eb38 0x8070eb38
+8070ec90 0x8070ec90
+8070ecb4 0x8070ec90_caseD_a
+8070eccc 0x8070ec90_switch
+8070ecd0 0x8070ec90_caseD_5
+8070ed0c 0x8070ec90_caseD_6
+8070ed1c 0x8070ec90_caseD_8
+8070ed2c 0x8070ec90_caseD_9
+8070ed5c 0x8070ec90_caseD_a
+8070ed98 0x8070ec90_caseD_b
+8070edb8 0x8070ec90_caseD_c
+8070edc8 0x8070ec90_caseD_e
+8070ede4 0x8070ec90_caseD_7
+8070ede8 0x8070ede8
+8070ee78 0x8070ee78
+8070ee7c 0x8070ee7c
+8070ee80 0x8070ee80
+8070ee88 0x8070ee88
+8070ee90 0x8070ee90
+8070ee98 0x8070ee98
+8070eea0 0x8070eea0
+8070eea8 0x8070eea8
+8070eeb0 0x8070eeb0
+8070eeb8 0x8070eeb8
+8070eec0 0x8070eec0
+8070eec8 Audio::PlayersVolumeMgr::Disposer__dt
+8070eff4 Audio::PlayersVolumeMgr::CreateInstance
+8070f0e8 Audio::PlayersVolumeMgr::DestroyInstance
+8070f19c Audio::PlayersVolumeMgr::__dt
+8070f240 0x8070f240
+8070f308 0x8070f308
+8070f3b8 0x8070f3b8
+8070f3d0 0x8070f3d0
+8070f3e8 Audio::PlayersVolumeMgr::Calc
+8070f470 Audio::PlayersVolumeMgr::StopAllPlayersButTrackUI
+8070f4d0 Audio::PlayersVolumeMgr::MuteAllButTrackUI
+8070f554 Audio::PlayersVolumeMgr::ResetAllButUI
+8070f59c Audio::PlayersVolumeMgr::Reset
+8070f648 Audio::PlayersVolumeMgr::PauseAllButTrackUI
+8070f6b8 Audio::PlayersVolumeMgr::SetVolume
+8070f7a4 0x8070f7a4
+8070f85c 0x8070f85c
+8070f87c 0x8070f87c
+8070f8b8 Audio::ItemAlterationMgr::Disposer__dt
+8070fa08 Audio::ItemAlterationMgr::CreateInstance
+8070fa7c 0x8070fa7c
+8070fabc Audio::ItemAlterationMgr::DestroyInstance
+8070fbc0 Audio::ItemAlterationMgr::__dt
+8070fc98 Audio::ItemAlterationMgr::Init
+8070fcf0 Audio::ItemAlterationMgr::IsDemo
+8070fd10 Audio::ItemAlterationMgr::Update
+8070feb0 Audio::ItemAlterationMgr::ResetItemState
+8070fec8 Audio::ItemAlterationMgr::UpdateStatus
+8071007c Audio::ItemAlterationMgr::SetAudioAlteration
+807101f4 Audio::ItemAlterationMgr::GetCourseSoundId
+80710214 Audio::ItemAlterationMgr::CalcStatus2Values
+807102b0 Audio::ItemAlterationMgr::PlayStarMusic
+80710308 Audio::ItemAlterationMgr::PlayMegaMusic
+80710340 Audio::RaceMgr::Disposer__dt
+807104d0 Audio::RaceMgr::CreateInstance
+80710520 Audio::RaceMgr::DestroyInstance
+80710664 Audio::RaceMgr::ActorHolder::Compare
+80710688 Audio::RaceMgr::__ct
+807108a8 0x807108a8
+807108e8 Audio::RaceMgr::__dt
+80710a00 Audio::RaceMgr::Init
+80710bac Audio::RaceMgr::Shutdown
+80710ca0 Audio::RaceMgr::Calc
+807110a0 0x807110a0
+80711198 Audio::RaceMgr::UpdatePlayerMatrix
+807112fc 0x807112fc
+80711390 0x80711390
+80711418 Audio::RaceMgr::StartRace
+807114a4 Audio::RaceMgr::UpdateActors
+80711514 Audio::RaceMgr::UpdateLocalPlayerParams
+80711668 Audio::RaceMgr::IsAPlayerSquishedOrSmall
+8071172c Audio::RaceMgr::IsAPlayerInStar
+807117a0 Audio::RaceMgr::IsAPlayerInMega
+80711814 0x80711814
+8071185c 0x8071185c
+80711960 Audio::RaceMgr::SetNonTrackVolumes
+80711a0c Audio::RaceMgr::SetEngineVolume
+80711a14 Audio::RaceMgr::SetNonTrackAndEngineVolume
+80711ac4 Audio::RaceMgr::SetRaceState
+807121c0 0x807121c0
+80712234 0x807121c0_switch
+80712238 0x807121c0_caseD_0
+8071224c 0x807121c0_caseD_1
+80712260 0x807121c0_caseD_2
+80712280 0x807121c0_caseD_3
+80712380 0x807121c0_caseD_4
+807123a0 0x807121c0_caseD_5
+807123bc 0x807121c0_caseD_6
+8071244c 0x8071244c
+807124a8 0x807124a8
+80712540 0x80712540
+807125d4 Audio::RaceMgr::CheckRaceState
+80712adc 0x80712adc
+80712b58 Audio::RaceMgr::SortAndToggleActors
+80713754 Audio::RaceMgr::SetKartSound
+807137a8 0x807137a8
+807137ec 0x807137ec
+807137f4 0x807137f4
+80713890 0x80713890
+807138d0 0x807138d0
+807139fc 0x807139fc
+80713a64 0x80713a64
+80713b18 0x80713b18
+80713bbc 0x80713bbc
+80713bc4 0x80713bc4
+80713c80 Audio::RSARPlayer::OutputSoundToWiimotes
+80713d64 0x80713d64
+80713dcc Audio::RSARPlayer::IsDemo
+80713de8 0x80713de8
+80713e10 0x80713e10
+80713e90 Audio::RSARPlayer::CreateInstance
+807140b4 Audio::RSARPlayer::DestroyInstance
+8071412c Audio::RSARPlayer::Close
+80714184 Audio::RSARPlayer::OnLoad
+80714190 Audio::RSARPlayer::Stop
+807141ec Audio::RSARPlayer::HasFinishedLoadingGroups
+807141f8 Audio::RSARPlayer::Calc
+80714370 Audio::RSARPlayer::OnNewPageLayer
+80714374 Audio::MenuRSARPlayer::OnNewPageLayer
+80714598 0x80714598
+80714690 0x80714690
+8071469c 0x8071469c
+807146a8 Audio::RSARPlayer::PlaySoundById
+8071476c Audio::RSARPlayer::HoldSoundById
+807147d0 0x807147d0
+8071493c 0x8071493c
+8071497c Audio::RSARPlayer::PlaySound
+807155e4 Audio::RSARPlayer::StopSoundById
+80715624 Audio::RSARPlayer::HoldSound
+80715648 0x80715648
+807156f4 0x807156f4
+807158e0 0x807158e0
+80715988 0x80715988
+80715a4c 0x80715a4c
+80715a70 Audio::RSARPlayer::PrepareReverb
+80715a74 Audio::RSARPlayer::Reset
+80715a98 Audio::MenuRSARPlayer::__ct
+80715acc Audio::MenuRSARPlayer::Prepare
+80715b7c Audio::MenuRSARPlayer::Close
+80715bd4 Audio::MenuRSARPlayer::OnLoad
+80715c3c Audio::MenuRSARPlayer::Stop
+80715c98 Audio::MenuRSARPlayer::PrepareReverb
+80715da4 Audio::RaceRSARPlayer::__ct
+80715e24 Audio::RaceRSARPlayer::OnLoad
+80715e64 Audio::RaceRSARPlayer::Stop
+80715ecc Audio::RaceRSARPlayer::Pause
+80715f60 Audio::RaceRSARPlayer::Resume
+80715ff0 Audio::RaceRSARPlayer::PlayEndRaceMenuButtonClickSound
+80716008 Audio::RaceRSARPlayer::SetFullVolume
+80716018 Audio::RaceRSARPlayer::HalveVolume
+80716028 Audio::RaceRSARPlayer::Prepare
+80716170 Audio::RaceRSARPlayer::LoadCharacterGroups
+807162b4 Audio::RaceRSARPlayer::PrepareReverb
+80716404 Audio::RaceRSARPlayer::Close
+8071646c Audio::RaceRSARPlayer::Calc
+80716608 Audio::RaceRSARPlayer::PlaySound
+8071677c Audio::RaceRSARPlayer::HoldSound
+807167b8 Audio::TestRSARPlayer::__ct
+807167ec Audio::TestRSARPlayer::Prepare
+8071681c Audio::TestRSARPlayer::Close
+80716874 Audio::TestRSARPlayer::OnDeactivate
+80716880 Audio::GlobeRSARPlayer::__ct
+807168bc Audio::RSARPlayer::__dt
+80716940 Audio::GlobeRSARPlayer::OnDeactivate
+8071698c Audio::GlobeRSARPlayer::Prepare
+80716a20 Audio::GlobeRSARPlayer::Calc
+80716b98 Audio::GlobeRSARPlayer::PrepareReverb
+80716ca4 Audio::GlobeRSARPlayer::Close
+80716cfc 0x80716cfc
+80716d68 Audio::Manager::OpenBRSAR
+80716d94 Audio::Manager::Disposer__dt
+80716e2c Audio::Manager::CreateInstance
+80716f10 Audio::Manager::DestroyInstance
+80716f44 Audio::Manager::__ct
+80717004 Audio::Manager::__dt
+80717104 Audio::Manager::DestroyAudioInstances
+80717150 Audio::Manager::Init
+8071724c Audio::Manager::InitSelf
+80717424 0x80717424
+807174a0 0x807174a0
+807174e0 0x807174e0
+80717520 Audio::Manager::CreateAudioInstances
+807175a0 Audio::Manager::LoadControlsGroup
+8071763c Audio::Manager::Calc
+80717744 Audio::Manager::StartSound
+8071778c Audio::Manager::HoldSound
+807177d4 Audio::Manager::EnterHBM
+8071784c Audio::Manager::ExitHBM
+807178d4 Audio::Manager::AudioUtilityCallback
+807178ec Audio::Manager::Lock
+807178f8 Audio::Manager::Unlock
+80717904 Audio::Manager::PauseOnDVDBusy
+807179b4 Audio::Manager::SetupMemoryArchive
+807179c4 Audio::Manager::HoldSound
+807179f8 Audio::Manager::HoldSound(str)
+80717a68 Audio::Manager::PrepareSound
+80717a9c Audio::Manager::PrepareSound(str)
+80717b0c Audio::Manager::StartSound
+80717b40 Audio::Manager::StartSound(str)
+80717bb0 0x80717bb0
+80717bd0 Audio::Manager::LoadState(thunk)
+80717bd8 Audio::Manager::HoldSound(thunk)
+80717be0 Audio::Manager::StartSound(thunk)
+80717be8 Audio::Manager::Calc(thunk)
+80717bf0 Audio::Manager::LoadGroup(thunk)
+80717bf8 Audio::Manager::LoadGroup(thunk)
+80717c00 Audio::Manager::LoadGroup(thunk)
+80717c08 Audio::Manager::CloseArchive(thunk)
+80717c10 Audio::Manager::SetupMemoryArchive(thunk)
+80717c18 Audio::Manager::SetupMemoryArchive(thunk)
+80717c20 Audio::Manager::OpenMemoryArchive(thunk)
+80717c28 Audio::Manager::OpenNANDArchive(thunk)
+80717c30 Audio::Manager::OpenDVDArchive(thunk)
+80717c38 Audio::Manager::OpenArchive(thunk)
+80717c40 Audio::Manager::__dt(thunk)
+80717c48 Audio::Manager::WriteSeqVariable
+80717cc8 0x80717cc8
+80717d08 Audio::Track::SetValue
+80717d2c Audio::Track::Calc
+80717d70 Audio::PitchModuler::_ct
+80717d84 Audio::PitchModuler::Update
+80717e00 Audio::PitchModuler::GetNextLimit
+80717e34 Audio::EchoMgr::Disposer__dt
+80717f60 Audio::EchoMgr::CreateInstance
+80718014 Audio::EchoMgr::DestroyInstance
+807180c8 Audio::EchoMgr::__ct
+80718150 Audio::EchoMgr::__dt
+807181f4 Audio::EchoMgr::Init
+80718218 Audio::EchoMgr::Shutdown
+8071821c Audio::EchoMgr::Update
+807182b8 Audio::EchoMgr::SetVolume
+807182d0 Audio::EchoMgr::SetEcho
+807182e8 Audio::SoundTriggerMgr::Disposer__dt
+80718414 Audio::SoundTriggerMgr::CreateInstance
+80718498 Audio::SoundTriggerMgr::DestroyInstance
+8071854c Audio::SoundTriggerMgr::__ct
+807185a4 Audio::SoundTriggerMgr::__dt
+80718648 Audio::SoundTriggerMgr::Init
+807186a0 Audio::SoundTriggerMgr::Init_switch
+807186a4 Audio::SoundTriggerMgr::Init_caseD_3a
+80718720 Audio::SoundTriggerMgr::Init_caseD_1
+8071879c Audio::SoundTriggerMgr::Init_caseD_4
+80718818 Audio::SoundTriggerMgr::Init_caseD_0
+80718894 Audio::SoundTriggerMgr::Init_caseD_5
+80718910 Audio::SoundTriggerMgr::Init_caseD_6
+8071898c Audio::SoundTriggerMgr::Init_caseD_3
+80718a08 Audio::SoundTriggerMgr::Init_caseD_c
+80718a84 Audio::SoundTriggerMgr::Init_caseD_18
+80718b00 Audio::SoundTriggerMgr::Init_caseD_1a
+80718b7c Audio::SoundTriggerMgr::Init_caseD_1d
+80718bf8 Audio::SoundTriggerMgr::Init_caseD_10
+80718c74 Audio::SoundTriggerMgr::Init_caseD_13
+80718cf0 Audio::SoundTriggerMgr::Init_caseD_14
+80718d6c Audio::SoundTriggerMgr::Init_caseD_17
+80718de8 Audio::SoundTriggerMgr::Init_caseD_15
+80718e64 Audio::SoundTriggerMgr::Init_caseD_20
+80718edc Audio::SoundTriggerMgr::Init_caseD_2a
+80718ef8 Audio::SoundTriggerMgr::IsAPlayerOnVariant
+80718f3c Audio::SoundTriggerMgr::Shutdown
+80718f48 Audio::SoundTriggerMgr::Update
+80718f84 Audio::SoundTriggerMgr::IsPlayerAheadOfOtherLocal
+80719044 Audio::SoundTriggerMgr::ApplyTrigger
+8071919c Audio::SoundTriggerMgr::ApplyTrigger_switch
+807191a0 Audio::SoundTriggerMgr::ApplyTrigger_caseD_3a
+807192f4 Audio::SoundTriggerMgr::ApplyTrigger_caseD_2
+80719598 Audio::SoundTriggerMgr::ApplyTrigger_caseD_4
+807195b8 Audio::SoundTriggerMgr::ApplyTrigger_switch
+807195bc Audio::SoundTriggerMgr::ApplyTrigger_caseD_0
+80719640 Audio::SoundTriggerMgr::ApplyTrigger_caseD_1
+807196ec Audio::SoundTriggerMgr::ApplyTrigger_caseD_2
+80719770 Audio::SoundTriggerMgr::ApplyTrigger_caseD_3
+80719814 Audio::SoundTriggerMgr::ApplyTrigger_caseD_4
+807198c0 Audio::SoundTriggerMgr::ApplyTrigger_caseD_5
+807199e0 Audio::SoundTriggerMgr::ApplyTrigger_caseD_6
+80719a4c Audio::SoundTriggerMgr::ApplyTrigger_caseD_7
+80719b0c Audio::SoundTriggerMgr::ApplyTrigger_caseD_0
+80719b7c Audio::SoundTriggerMgr::ApplyTrigger_caseD_5
+80719db4 Audio::SoundTriggerMgr::ApplyTrigger_caseD_6
+80719f08 Audio::SoundTriggerMgr::ApplyTrigger_caseD_7
+8071a004 Audio::SoundTriggerMgr::ApplyTrigger_caseD_f
+8071a274 Audio::SoundTriggerMgr::ApplyTrigger_caseD_9
+8071a2e4 Audio::SoundTriggerMgr::ApplyTrigger_caseD_e
+8071a4a8 Audio::SoundTriggerMgr::ApplyTrigger_caseD_3
+8071a53c Audio::SoundTriggerMgr::ApplyTrigger_caseD_a
+8071a748 Audio::SoundTriggerMgr::ApplyTrigger_caseD_b
+8071a80c Audio::SoundTriggerMgr::ApplyTrigger_caseD_c
+8071a82c Audio::SoundTriggerMgr::ApplyTrigger_switch2
+8071a830 Audio::SoundTriggerMgr::ApplyTrigger_case2D_0
+8071a88c Audio::SoundTriggerMgr::ApplyTrigger_case2D_1
+8071a8fc Audio::SoundTriggerMgr::ApplyTrigger_case2D_2
+8071a94c Audio::SoundTriggerMgr::ApplyTrigger_case2D_3
+8071a99c Audio::SoundTriggerMgr::ApplyTrigger_case2D_4
+8071a9ec Audio::SoundTriggerMgr::ApplyTrigger_case2D_5
+8071aa08 Audio::SoundTriggerMgr::ApplyTrigger_case2D_6
+8071aa24 Audio::SoundTriggerMgr::ApplyTrigger_case2D_7
+8071aa5c Audio::SoundTriggerMgr::ApplyTrigger_case2D_d
+8071ac48 Audio::SoundTriggerMgr::ApplyTrigger_case2D_1e
+8071acb4 Audio::SoundTriggerMgr::ApplyTrigger_case2D_1f
+8071ace4 Audio::SoundTriggerMgr::ApplyTrigger_case2D_1b
+8071ae8c Audio::SoundTriggerMgr::ApplyTrigger_case2D_1a
+8071af84 Audio::SoundTriggerMgr::ApplyTrigger_case2D_1c
+8071b16c Audio::SoundTriggerMgr::ApplyTrigger_case2D_1d
+8071b290 Audio::SoundTriggerMgr::ApplyTrigger_case2D_12
+8071b2fc Audio::SoundTriggerMgr::ApplyTrigger_case2D_11
+8071b36c Audio::SoundTriggerMgr::ApplyTrigger_case2D_13
+8071b47c Audio::SoundTriggerMgr::ApplyTrigger_case2D_14
+8071b4ac Audio::SoundTriggerMgr::ApplyTrigger_case2D_16
+8071b4dc Audio::SoundTriggerMgr::ApplyTrigger_case2D_17
+8071b7bc Audio::SoundTriggerMgr::ApplyTrigger_case2D_23
+8071b7ec Audio::SoundTriggerMgr::ApplyTrigger_case2D_1
+8071b808 SetTRKConnected
+8071b814 0x8071b814
+8071b860 0x8071b860
+8071b864 0x8071b864
+8071b868 0x8071b868
+8071b86c MotionControllerSub::__ct
+8071bd1c MotionControllerSub::__dt
+8071be1c 0x8071be1c
+8071c0a4 0x8071c0a4
+8071c144 0x8071c144
+8071c164 0x8071c164
+8071c188 0x8071c188
+8071c1f0 0x8071c1f0
+8071c224 0x8071c224
+8071c2a0 0x8071c2a0
+8071c2ac 0x8071c2ac
+8071c2c8 0x8071c2c8
+8071c2e4 0x8071c2e4
+8071c330 0x8071c330
+8071c370 0x8071c370
+8071c39c 0x8071c39c
+8071c3d0 0x8071c3d0
+8071c3fc 0x8071c3fc
+8071c524 0x8071c524
+8071c61c 0x8071c61c
+8071c6cc 0x8071c6cc
+8071c724 0x8071c724
+8071c784 0x8071c784
+8071c798 0x8071c798
+8071c7f0 0x8071c7f0
+8071c804 0x8071c804
+8071c818 0x8071c818
+8071c8a8 0x8071c8a8
+8071c900 0x8071c900
+8071c928 0x8071c928
+8071c968 0x8071c968
+8071c978 0x8071c978
+8071cbd8 0x8071cbd8
+8071cdac 0x8071cdac
+8071cf20 0x8071cf20
+8071cfd0 0x8071cfd0
+8071d034 0x8071d034
+8071d0a8 0x8071d0a8
+8071d260 0x8071d260
+8071d2a0 0x8071d2a0
+8071d43c 0x8071d43c
+8071d5a0 0x8071d5a0
+8071d62c 0x8071d62c
+8071d6a0 0x8071d6a0
+8071d79c 0x8071d79c
+8071d838 0x8071d838
+8071d860 0x8071d860
+8071d8a0 0x8071d8a0
+8071d95c 0x8071d95c
+8071d968 0x8071d968
+8071d9d4 0x8071d9d4
+8071da40 0x8071da40
+8071dadc 0x8071dadc
+8071db08 0x8071db08
+8071db3c 0x8071db3c
+8071dba0 0x8071dba0
+8071dc60 0x8071dc60
+8071dc94 0x8071dc94
+8071e07c 0x8071e07c
+8071e1bc 0x8071e1bc
+8071e1d8 Lakitu::Manager::Disposer__dt
+8071e270 Lakitu::Manager::CreateInstance
+8071e2fc Lakitu::Manager::DestroyInstance
+8071e330 Lakitu::Manager::__ct
+8071e390 Lakitu::Manager::__dt
+8071e480 Lakitu::Manager::CreatePlayers
+8071e638 Lakitu::Manager::Init
+8071e6c0 Lakitu::Manager::Update
+8071e734 Lakitu::Manager::DoEnableRespawnAction
+8071e7ac Lakitu::Manager::ToggleVisible
+8071e82c 0x8071e82c
+8071e8a4 Lakitu::Manager::StartCountdownAnm
+8071e90c 0x8071e90c
+8071e984 Lakitu::Manager::GetCountdownStartFrame
+8071e9b4 Lakitu::Movement::__ct
+8071ea80 0x8071ea80
+8071eb6c Lakitu::Movement::Reset
+8071ecc4 0x8071ecc4
+8071ee20 0x8071ee20
+8071efa8 0x8071efa8
+8071efd8 Lakitu::Movement::SetBasePosition
+8071eff4 0x8071eff4
+8071f044 AI::CalcLinearTransfo
+8071f0cc 0x8071f0cc
+8071f204 0x8071f204
+8071f31c 0x8071f31c
+8071f404 Lakitu::Movement::Update
+8071fa2c 0x8071fa2c
+8071fc48 0x8071fc48
+8071fc5c 0x8071fc5c
+8071fc80 0x8071fc80
+80720024 Lakitu::Movement::UpdateRotation
+807201b0 0x807201b0
+807202bc Lakitu::Movement::UpdateExtMtx
+807204ec 0x807204ec
+80720500 0x80720500
+807205c8 0x807205c8
+80720664 0x80720664
+8072072c 0x8072072c
+8072074c 0x8072074c
+807208a0 0x807208a0
+80720a20 Lakitu::Movement::UpdateScale
+80720c0c 0x80720c0c
+80720d30 0x80720d30
+80720e8c 0x80720e8c
+80720f44 Lakitu::PlayerBase::__ct
+80720f8c Lakitu::PlayerBase::__dt
+8072101c Lakitu::PlayerBase::Init
+80721024 Lakitu::PlayerBase::Update
+80721090 Lakitu::PlayerBase::ToggleModelsScreenVisibility
+80721128 Lakitu::PlayerBase::SetModelsVisibility
+8072125c 0x8072125c
+80721368 0x80721368
+8072143c 0x8072143c
+807214a8 0x807214a8
+80721514 Lakitu::Player::__ct
+80721c14 AI::Base::__dt
+80721c54 AI::Actions::__dt
+80721c94 0x80721c94
+80721cec Lakitu::Action::__dt
+80721d2c Lakitu::Player::__dt
+80721e64 0x80721e64
+80721ec0 Lakitu::Player::CreateEnableActions
+80721f88 0x80721f88
+80721ffc 0x80721ffc
+80722054 0x80722054
+80722100 Lakitu::Player::Init
+807221c4 Lakitu::Player::Update
+8072239c Lakitu::Player::GetPlayerIdx
+807223a4 Lakitu::Player::StartRespawnAction
+807223bc Lakitu::Player::StartCountdownAction
+8072240c Lakitu::Player::GetCountdownArmSwipeDuration
+80722418 0x80722418
+80722504 Lakitu::Player::LoadGraphics
+80722e54 0x80722e54
+80722ea0 0x80722ea0
+80722ed8 0x80722ed8
+80722f6c 0x80722f6c
+807230d4 Lakitu::Player::MapToWorldSpace
+807232e4 0x807232e4
+807233c0 0x807233c0
+80723458 Lakitu::Player::OnStartIdle
+807234a4 Lakitu::Player::UpdateIdle
+80723598 Lakitu::Player::OnStartCountdown
+8072370c 0x8072370c
+807237ac Lakitu::Player::UpdateCountdown
+80723af8 0x80723af8
+80723b9c 0x80723b9c
+80723c20 Lakitu::Player::OnEndCountdown
+80723c7c Lakitu::Player::OnStartLap
+80723ec0 Lakitu::Player::UpdateLap
+8072429c 0x8072429c
+807242f4 Lakitu::Player::OnStartRespawn
+80724430 Lakitu::Player::UpdateRespawn
+80724778 0x80724778
+80724794 Lakitu::Player::OnStartBackwards
+80724880 Lakitu::Player::UpdateBackwards
+80724f70 Lakitu::Player::OnEndBackwards
+80725060 Lakitu::Player::OnStartEnding
+80725170 Lakitu::Player::UpdateEnding
+80725424 Lakitu::Player::OnEndEnding
+807254a0 Lakitu::Player::OnStartUnknown
+807254c0 Lakitu::Player::UpdateUnknown
+807255a8 AI::Base::OnStartDefaultAction
+807255ac AI::Base::UpdateDefaultAction
+807255b0 Lakitu::Action::OnStart
+807255f8 Lakitu::Action::Update
+80725628 Lakitu::Action::OnEnd
+80725670 0x80725670
+807259e4 Lakitu::Player::__dt(thunk)
+807259ec Lakitu::EnableLakituAction::__ct
+80725a0c Lakitu::EnableLakituAction::__dt
+80725a4c Lakitu::EnableLakituAction::ResetState
+80725a5c Lakitu::EnableLakituAction::HasActionHappened
+80725a78 Lakitu::EnableCountdownAction::__ct
+80725a98 Lakitu::EnableCountdownAction::__dt
+80725ad8 Lakitu::EnableCountdownAction::ResetState
+80725ae8 Lakitu::EnableCountdownAction::EnableAction
+80725b48 Lakitu::EnableDisplayLapAction::__ct
+80725b68 Lakitu::EnableDisplayLapAction::__dt
+80725ba8 Lakitu::EnableDisplayLapAction::ResetState
+80725bd8 Lakitu::EnableDisplayLapAction::EnableAction
+80725c1c Lakitu::EnableBackwardsAction::__ct
+80725c3c Lakitu::EnableBackwardsAction::__dt
+80725c7c Lakitu::EnableBackwardsAction::ResetState
+80725c98 Lakitu::EnableBackwardsAction::EnableAction
+80725dd8 Lakitu::EnableRespawnAction::__ct
+80725df8 Lakitu::EnableRespawnAction::__dt
+80725e38 Lakitu::EnableRespawnAction::ResetState
+80725e48 Lakitu::EnableRespawnAction::EnableAction
+80725e4c Lakitu::EnableEndingAction::__ct
+80725e6c Lakitu::EnableEndingAction::__dt
+80725eac Lakitu::EnableEndingAction::ResetState
+80725ebc Lakitu::EnableEndingAction::EnableAction
+80725f0c 0x80725f0c
+80725f2c 0x80725f2c
+80725f6c cGameSFX_Init
+80725f7c 0x80725f7c
+80725fdc KartAIController::__ct
+80726088 KartAIController::__dt
+80726110 KartAIController::Init
+807261b8 KartAIController::Update
+80726204 KartAIController::GetStick
+8072624c KartAIController::IsCPU
+80726290 KartAIController::IsRealLocal
+807262d0 0x807262d0
+80726338 thunk_0x80590664
+8072633c KartAIController::IsGhost
+80726380 KartAIController::HaveSameTeam
+807263a8 0x807263a8
+807263b0 0x807263b0
+807263c4 0x807263c4
+807263cc 0x807263cc
+807264e8 KartAIController::IsOnTheGround
+807264fc KartAIController::IsInTheAir
+80726510 0x80726510
+80726524 KartAIController::IsManuallyDrifting
+80726538 KartAIController::IsHopping
+8072654c KartAIController::IsAutomaticDrifting
+80726560 KartAIController::IsInABill
+80726574 0x80726574
+80726a18 0x80726a18
+80726a58 0x80726a58
+80726a98 0x80726a98
+80726ad8 0x80726ad8
+80726b94 0x80726b94
+80726be8 0x80726be8
+80726bf0 0x80726bf0
+80726cb0 0x80726cb0
+80726d14 0x80726d14
+80726e04 0x80726e04
+80726e5c 0x80726e5c
+80726e78 0x80726e78
+80726ff8 0x80726ff8
+80727084 0x80727084
+8072709c 0x8072709c
+807272c4 0x807272c4
+80727374 0x80727374
+807273e4 0x807273e4
+807273f0 0x807273f0
+80727400 0x80727400
+807274d0 0x807274d0
+807274dc 0x807274dc
+807274ec 0x807274ec
+80727520 0x80727520
+807275b4 0x807275b4
+807276bc 0x807276bc
+807276c8 0x807276c8
+80727710 0x80727710
+80727740 0x80727740
+80727788 0x80727788
+80727aec 0x80727aec
+80727b2c 0x80727b2c
+80727bd8 0x80727bd8
+80727ca4 0x80727ca4
+80727cf8 0x80727cf8
+80727d40 0x80727d40
+80727d50 0x80727d50
+80727da0 0x80727da0
+80727e84 0x80727e84
+80727ef4 0x80727ef4
+80727f60 0x80727f60
+80728088 0x80728088
+8072820c 0x8072820c
+80728210 0x80728210
+80728214 AI::CPUDriving::GetCalculator
+8072821c 0x8072821c
+80728220 0x80728220
+80728294 0x80728294
+80728298 0x80728298
+8072829c 0x8072829c
+8072835c 0x8072835c
+807284d0 0x807284d0
+807285c8 0x807285c8
+807285cc 0x807285cc
+80728614 0x80728614
+80728644 0x80728644
+8072868c 0x8072868c
+807287b8 0x807287b8
+80728870 0x80728870
+807289a4 0x807289a4
+80728a18 0x80728a18
+80728a58 0x80728a58
+80728a98 0x80728a98
+80728b7c 0x80728b7c
+80728c54 0x80728c54
+80728cc8 0x80728cc8
+80728d94 0x80728d94
+80728e2c 0x80728e2c
+80728e70 0x80728e70
+80728f60 0x80728f60
+8072910c 0x8072910c
+80729188 0x80729188
+80729218 0x80729218
+80729338 0x80729338
+80729340 0x80729340
+80729348 0x80729348
+80729350 0x80729350
+80729614 0x80729614
+80729654 0x80729654
+80729694 0x80729694
+807296b4 0x807296b4
+80729720 0x80729720
+80729728 0x80729728
+80729868 0x80729868
+80729944 0x80729944
+80729a8c 0x80729a8c
+80729a98 0x80729a98
+80729ac0 0x80729ac0
+80729acc 0x80729acc
+80729b88 0x80729b88
+80729b90 0x80729b90
+80729b9c 0x80729b9c
+80729cb4 0x80729cb4
+80729cfc 0x80729cfc
+80729d2c 0x80729d2c
+80729d74 0x80729d74
+80729d9c AI::CPUDriving::__ct
+80729f18 AI::CPUDriving::__dt
+8072a0a8 0x8072a0a8
+8072a0e8 AI::CPUDriving::Init
+8072a21c AI::CPUDriving::InitEnemyRoute
+8072a2a8 0x8072a2a8
+8072a2e8 0x8072a2e8
+8072a2f0 0x8072a2f0
+8072a2f8 0x8072a2f8
+8072a300 0x8072a300
+8072a310 AI::CPUDriving::CalcStartBoost
+8072a370 0x8072a370
+8072a374 ParamActionCalculator::GetStartBoost
+8072a37c 0x8072a37c
+8072a560 0x8072a560
+8072a568 0x8072a568
+8072a570 0x8072a570
+8072a650 0x8072a650
+8072a674 0x8072a674
+8072a6b4 0x8072a6b4
+8072a6c8 0x8072a6c8
+8072a6dc 0x8072a6dc
+8072a740 0x8072a740
+8072a754 0x8072a754
+8072a794 0x8072a794
+8072a7a0 0x8072a7a0
+8072a844 0x8072a844
+8072a88c AI::CPUDriving::IsBattle
+8072a894 0x8072a894
+8072a898 0x8072a898
+8072a8a0 0x8072a8a0
+8072a8a8 0x8072a8a8
+8072a8ac 0x8072a8ac
+8072a8e8 0x8072a8e8
+8072b07c 0x8072b07c
+8072b0bc 0x8072b0bc
+8072b1dc 0x8072b1dc
+8072b3d8 0x8072b3d8
+8072b3dc 0x8072b3dc
+8072b454 0x8072b454
+8072b498 0x8072b498
+8072b500 0x8072b500
+8072b5f8 0x8072b5f8
+8072b618 0x8072b618
+8072b680 0x8072b680
+8072b86c 0x8072b86c
+8072b874 0x8072b874
+8072b95c 0x8072b95c
+8072b964 0x8072b964
+8072b974 0x8072b974
+8072b9b8 0x8072b9b8
+8072bb18 0x8072bb18
+8072bd00 0x8072bd00
+8072bd1c 0x8072bd1c
+8072be68 0x8072be68
+8072bf8c 0x8072bf8c
+8072c160 0x8072c160
+8072c33c 0x8072c33c
+8072c364 0x8072c364
+8072c444 0x8072c444
+8072c448 0x8072c448
+8072c45c 0x8072c45c
+8072c468 0x8072c468
+8072c548 0x8072c548
+8072c568 0x8072c568
+8072c5a8 0x8072c5a8
+8072c5e8 0x8072c5e8
+8072c740 0x8072c740
+8072c80c 0x8072c80c
+8072c814 0x8072c814
+8072c984 0x8072c984
+8072ca04 0x8072ca04
+8072ca18 0x8072ca18
+8072ca58 0x8072ca58
+8072ca68 0x8072ca68
+8072ca7c WorldLoader_GetStadiumTerrain
+8072ca90 0x8072ca90
+8072caa0 0x8072caa0
+8072cab4 0x8072cab4
+8072caf4 0x8072caf4
+8072cc68 0x8072cc68
+8072cc70 0x8072cc70
+8072cc84 0x8072cc84
+8072ccc4 0x8072ccc4
+8072d1dc 0x8072d1dc
+8072d1f0 0x8072d1f0
+8072d230 0x8072d230
+8072d4f4 0x8072d4f4
+8072d528 0x8072d528
+8072d568 0x8072d568
+8072d5bc 0x8072d5bc
+8072d5cc 0x8072d5cc
+8072d7e8 0x8072d7e8
+8072d9d4 0x8072d9d4
+8072db40 0x8072db40
+8072dc28 0x8072dc28
+8072dce4 0x8072dce4
+8072dd18 0x8072dd18
+8072dd58 0x8072dd58
+8072ddb0 0x8072ddb0
+8072dde4 0x8072dde4
+8072de24 0x8072de24
+8072de64 0x8072de64
+8072de6c 0x8072de6c
+8072de74 0x8072de74
+8072de7c 0x8072de7c
+8072de84 0x8072de84
+8072de8c 0x8072de8c
+8072de94 0x8072de94
+8072de9c 0x8072de9c
+8072dea0 0x8072dea0
+8072dee0 0x8072dee0
+8072dee8 0x8072dee8
+8072def0 0x8072def0
+8072def8 0x8072def8
+8072df00 0x8072df00
+8072df08 0x8072df08
+8072df10 0x8072df10
+8072df58 0x8072df58
+8072df88 0x8072df88
+8072dfd0 0x8072dfd0
+8072e2b0 0x8072e2b0
+8072e2f0 0x8072e2f0
+8072e348 0x8072e348
+8072e3e8 0x8072e3e8
+8072e460 0x8072e460
+8072e470 0x8072e470
+8072e494 0x8072e494
+8072e4b0 0x8072e4b0
+8072e4d8 0x8072e4d8
+8072e678 0x8072e678
+8072e680 0x8072e680
+8072e688 0x8072e688
+8072e690 0x8072e690
+8072e6a0 0x8072e6a0
+8072e6a4 0x8072e6a4
+8072e6ac 0x8072e6ac
+8072e6b4 0x8072e6b4
+8072e6bc 0x8072e6bc
+8072e6c4 0x8072e6c4
+8072e6cc 0x8072e6cc
+8072e6d4 0x8072e6d4
+8072e6dc 0x8072e6dc
+8072e6e0 0x8072e6e0
+8072e720 0x8072e720
+8072e768 0x8072e768
+8072e798 0x8072e798
+8072e7e0 0x8072e7e0
+8072e9dc 0x8072e9dc
+8072ea1c 0x8072ea1c
+8072ea74 0x8072ea74
+8072eb84 0x8072eb84
+8072ec00 0x8072ec00
+8072ec28 0x8072ec28
+8072ecc4 0x8072ecc4
+8072edcc 0x8072edcc
+8072ee9c 0x8072ee9c
+8072f00c 0x8072f00c
+8072f318 0x8072f318
+8072f328 0x8072f328
+8072f528 0x8072f528
+8072f554 0x8072f554
+8072f654 0x8072f654
+8072f734 0x8072f734
+8072f800 0x8072f800
+8072f920 0x8072f920
+8072f960 0x8072f960
+8072f9b8 0x8072f9b8
+8072f9f8 0x8072f9f8
+8072fa74 0x8072fa74
+8072fb7c 0x8072fb7c
+8072fc98 0x8072fc98
+8072fca8 0x8072fca8
+8072fd1c 0x8072fd1c
+8072fd38 0x8072fd38
+8072ff60 0x8072ff60
+8072ff68 0x8072ff68
+8072ff70 0x8072ff70
+8072ff78 0x8072ff78
+8072ff80 0x8072ff80
+8072ff88 0x8072ff88
+8072ffd0 0x8072ffd0
+80730000 0x80730000
+80730048 0x80730048
+80730090 0x80730090
+807300c0 0x807300c0
+80730108 0x80730108
+80730198 AI::CPUDrivingRace::__ct
+80730324 AI::CPUDrivingAction::__dt
+80730364 AI::CPUDrivingRace::__dt
+80730420 AI::CPUDrivingRace::Init
+80730510 AI::CPUDrivingRace::InitEnemyRoute
+807306ac 0x807306ac
+80730758 0x80730758
+8073078c AI::CPUDrivingRace::Update
+80730888 0x80730888
+807308dc 0x807308dc
+80730a78 0x80730a78
+80730a7c 0x80730a7c
+80730a80 AI::CPUDrivingAction::OnStart
+80730ac8 AI::CPUDrivingAction::Update
+80730af8 AI::CPUDrivingAction::OnEnd
+80730b40 0x80730b40
+80730b60 0x80730b60
+80730ba0 0x80730ba0
+80730bd8 0x80730bd8
+80730da0 0x80730da0
+80730db4 0x80730db4
+80730e9c 0x80730e9c
+80731004 0x80731004
+80731038 0x80731038
+80731044 0x80731044
+80731148 0x80731148
+80731204 0x80731204
+807312d0 0x807312d0
+807314a0 0x807314a0
+80731738 0x80731738
+8073177c 0x8073177c
+807317a8 0x807317a8
+807317e8 0x807317e8
+80731960 AI::Inputs::__ct
+80731984 AI::Inputs::Reset
+8073199c AI::Inputs::AddInputs
+807319ac AI::Inputs::RemoveInputs
+807319bc 0x807319bc
+807319c4 AI::Player::__ct
+80732360 AI::PlayerActions::__dt
+807323a0 AI::Player::__dt
+80732508 AI::Player::Init
+80732678 AI::Player::Update
+8073269c AI::Player::vf_0x20
+8073272c 0x8073272c
+8073274c 0x8073274c
+807327f0 0x807327f0
+80732890 AI::Player::OnStartPreRace
+807328e0 AI::Player::UpdatePreRace
+80732a6c AI::Player::OnStartAI::CPUDriving
+80732a70 AI::Player::UpdateAI::CPUDriving
+80732c6c AI::Player::OnStartRealPlayerDriving
+80732c70 AI::Player::UpdateRealPlayerDriving
+80732d84 AI::Player::OnStartAction3
+80732d88 AI::Player::UpdateAction3
+80732d8c AI::Player::OnStartPostRaceDriving
+80732ddc 0x80732ddc
+80732de0 AI::Player::UpdatePostRaceDriving
+80732f84 AI::Player::OnStartPostBattleDriving
+80732fd4 AI::Player::UpdatePostBattleDriving
+807330f4 AI::PlayerActions::OnStart
+8073313c AI::PlayerActions::Update
+8073316c AI::PlayerActions::OnEnd
+807331b4 AI::PlayerBike::__ct
+80733238 AI::PlayerBike::__dt
+80733290 AI::PlayerBike::Init
+80733294 AI::PlayerBike::Update
+80733298 AI::PlayerBike::vf_0x20
+8073329c AI::PlayerBike::OnStartAction1
+807332a0 AI::PlayerBike::UpdateAction1
+807332a4 AI::PlayerKart::__ct
+807332fc AI::PlayerKart::__dt
+80733354 AI::PlayerKart::Init
+807333b8 AI::PlayerKart::Update
+807333bc AI::PlayerKart::vf_0x20
+807333c0 AI::PlayerKart::OnStartAction1
+807333c4 AI::PlayerKart::UpdateAction1
+807333c8 0x807333c8
+80733a7c 0x80733a7c
+80733abc 0x80733abc
+80733afc 0x80733afc
+80733b1c 0x80733b1c
+80733b60 0x80733b60
+80733ba4 0x80733ba4
+80733bac 0x80733bac
+80733bb4 0x80733bb4
+80733bbc 0x80733bbc
+80733bc4 0x80733bc4
+80733bcc 0x80733bcc
+80733c60 0x80733c60
+80733ce4 0x80733ce4
+80733d20 0x80733d20
+80733d4c 0x80733d4c
+80733d60 0x80733d60
+80733d7c 0x80733d7c
+80733d94 0x80733d94
+80733db0 0x80733db0
+80733e18 0x80733e18
+80733e24 0x80733e24
+80734058 0x80734058
+80734060 0x80734060
+80734064 0x80734064
+8073414c 0x8073414c
+80734150 0x80734150
+8073421c 0x8073421c
+80734220 0x80734220
+807342e8 0x807342e8
+807342ec 0x807342ec
+807342f8 0x807342f8
+807343f4 0x807343f4
+80734400 0x80734400
+807344fc 0x807344fc
+80734500 0x80734500
+8073458c 0x8073458c
+80734590 0x80734590
+80734594 0x80734594
+807345dc 0x807345dc
+8073461c 0x8073461c
+80734674 0x80734674
+807346b8 0x807346b8
+807346c4 0x807346c4
+807347b8 0x807347b8
+807348c0 0x807348c0
+80734a4c 0x80734a4c
+80734a58 0x80734a58
+80734a70 0x80734a70
+80734b40 0x80734b40
+80734c34 0x80734c34
+80734c74 0x80734c74
+80734e0c 0x80734e0c
+80734ee4 0x80734ee4
+807350d0 0x807350d0
+807350e0 0x807350e0
+807350e4 0x807350e4
+807351dc 0x807351dc
+80735224 0x80735224
+80735254 0x80735254
+8073529c 0x8073529c
+807352b0 0x807352b0
+807352f0 0x807352f0
+807352f4 0x807352f4
+807352f8 0x807352f8
+80735348 0x80735348
+807353f8 0x807353f8
+8073540c 0x8073540c
+8073544c 0x8073544c
+80735450 0x80735450
+80735460 0x80735460
+80735464 0x80735464
+8073555c 0x8073555c
+80735570 0x80735570
+807355b0 0x807355b0
+807355b4 0x807355b4
+807355f4 0x807355f4
+80735600 0x80735600
+80735724 0x80735724
+8073582c 0x8073582c
+80735840 0x80735840
+80735880 0x80735880
+80735948 AI::Character::__ct
+80736218 AI::CharacterActions::__dt
+80736258 AI::Character::__dt
+807362dc AI::Character::Init
+807363c0 AI::Character::Update
+80736400 AI::Character::vf_0x20
+80736480 AI::Character::StartDriving
+807364d8 0x807364d8
+80736588 0x80736588
+807365c4 0x80736588_switch
+807365c8 0x80736588_caseD_1
+807365d0 0x80736588_caseD_0
+807365d4 0x80736588_caseD_13
+807365dc 0x80736588_caseD_18
+807365e4 0x80736588_caseD_1e
+807365e8 0x80736588_caseD_24
+807365f4 0x807365f4
+80736650 0x80736650
+8073668c 0x8073668c
+807366e4 0x807366e4
+80736764 AI::Character::ArePlayersClose
+8073684c 0x8073684c
+807369bc AI::Character::vf_0x8c
+80736ae4 0x80736ae4
+80736bcc 0x80736bcc
+80736ca0 AI::Character::vf_0x94
+80736d24 AI::Character::OnStartAction0
+80736d30 AI::Character::UpdateAction0
+80736d8c AI::Character::OnStartAction1
+80736d90 AI::Character::UpdateAction1
+80736ec4 AI::Character::OnStartAction2
+80736ec8 AI::Character::UpdateAction2
+8073700c AI::Character::OnEndAction2
+80737048 AI::Character::OnStartAction3
+80737054 AI::Character::UpdateAction3
+807371a8 AI::Character::OnStartAction4
+807372e4 AI::Character::UpdateAction4
+807373a8 AI::Character::OnEndAction4
+807373e4 AI::Character::OnStartAction5
+807373f8 AI::Character::UpdateAction5
+80737600 AI::Character::OnEndAction5
+8073763c AI::Character::OnStartAction6
+80737798 AI::Character::UpdateAction6
+80737888 AI::Character::OnEndAction6
+807378c4 AI::Character::OnStartAction7
+807378d4 AI::Character::UpdateAction7
+80737934 AI::Character::OnEndAction7
+80737970 AI::Character::OnStartLookAhead
+807379ac AI::Character::UpdateLookAhead
+807379b0 AI::Character::OnStartLookAtCamera
+807379bc AI::Character::UpdateLookAtCamera
+80737c30 0x80737c30
+80737c50 0x80737c50
+80737c90 0x80737c90
+80737c9c 0x80737c9c
+80737ecc 0x80737ecc
+807381a4 0x807381a4
+80738558 AI::CharacterBattle::__ct
+80738594 AI::CharacterBattle::__dt
+807385ec AI::CharacterBattle::Init
+80738624 AI::CharacterBattle::OnStartAction1
+80738628 AI::CharacterBattle::UpdateAction1
+80738664 AI::CharacterAwards::__ct
+807386a0 AI::CharacterAwards::__dt
+807386f8 AI::CharacterAwards::Init
+80738730 AI::CharacterAwards::OnStartAction1
+80738734 AI::CharacterAwards::UpdateAction1
+80738770 0x80738770
+807387ac 0x807387ac
+80738804 0x80738804
+80738848 0x80738848
+80738960 0x80738960
+80738a48 0x80738a48
+80738a4c 0x80738a4c
+80738ac4 0x80738ac4
+80738ba4 0x80738ba4
+80738cb4 0x80738cb4
+80738cf0 AI::CharacterAwards::vf_0x94
+80738cf8 AI::CharacterActions::OnStart
+80738d40 AI::CharacterActions::Update
+80738d70 AI::CharacterActions::OnEnd
+80738db8 AI::Manager::Disposer__dt
+80738e50 AI::Manager::CreateInstance
+80738ea0 AI::Manager::DestroyInstance
+80738ed4 AI::Manager::__ct
+807390ac AI::Manager::__dt
+8073922c AI::Manager::AddKartAIController
+80739300 AI::Manager::GetKartAIController
+80739310 AI::Manager::GetRealPlayerKartAIController
+80739320 obj_checkIfSomething
+80739328 AI::Manager::Init
+8073942c AI::Manager::Update
+80739530 AI::Manager::GetLocalPlayerCount
+80739540 AI::Manager::GetEngineClass
+80739548 AI::Manager::GetDifficulty
+80739550 0x80739550
+8073958c 0x8073958c
+8073965c AI::Manager::IsGPOrPrivateVS
+80739684 AI::Manager::IsVS
+807396a4 AI::Manager::IsTT
+807396cc AI::Manager::IsMissionTournament
+807396ec AI::Manager::IsOnline
+80739714 AI::Manager::IsBattle
+80739740 AI::Manager::IsOfflineBattle
+80739760 AI::Manager::IsBallonBattle
+80739778 AI::Manager::IsCoinRunners
+80739794 AI::Manager::IsTT2
+807397bc AI::Manager::IsSpecialItemMode
+8073986c AI::Manager::IsTeamMode
+80739880 0x80739880
+80739888 AI::Manager::IsAwardsOrCredits
+807398ac AiHolder_getRealPlayerCountPerTeam
+80739944 AI::Manager::GetRandomValue
+8073996c AI::Manager::GetRandomFloat
+8073999c AI::Manager::SetCCAndDifficulty
+80739a7c 0x80739a7c
+80739b28 0x80739b28
+80739bd0 AiHolder_getBestPreviousScore
+80739c70 0x80739c70
+80739cac 0x80739cac
+80739d38 0x80739d38
+80739d7c 0x80739d7c
+80739ee0 0x80739ee0
+80739f4c 0x80739f4c
+80739ff0 0x80739ff0
+80739ff4 0x80739ff4
+8073a004 0x8073a004
+8073a024 0x8073a024
+8073a064 0x8073a064
+8073a0e8 0x8073a0e8
+8073a384 0x8073a384
+8073a5e4 0x8073a5e4
+8073a674 0x8073a674
+8073a880 0x8073a880
+8073a994 0x8073a994
+8073aaa4 0x8073aaa4
+8073ab30 0x8073ab30
+8073ab68 AI::Params::__ct
+8073abf8 AI::Params::__dt
+8073ac80 AI::Params::GetParamSpeed
+8073ac88 AI::Params::GetParamAction
+8073ac98 AI::Params::LoadParamFile
+8073aca8 AI::Params::Load
+8073af70 0x8073af70
+8073afcc 0x8073afcc
+8073b020 AI::Params::LoadActions
+8073b0f8 AI::EnemyRouteController::__ct
+8073b49c AI::ENPTSettingsHolder::__dt
+8073b4dc AI::EnemyRouteController::__dt
+8073b5dc AI::EnemyRouteController::Init
+8073b690 AI::EnemyRouteController::Update
+8073b7f0 0x8073b7f0
+8073b830 0x8073b830
+8073b874 0x8073b874
+8073b894 0x8073b894
+8073b8b0 0x8073b8b0
+8073b8b8 0x8073b8b8
+8073b8c0 0x8073b8c0
+8073b8e4 0x8073b8e4
+8073b988 0x8073b988
+8073ba70 0x8073ba70
+8073ba78 0x8073ba78
+8073baec 0x8073baec
+8073bb40 0x8073bb40
+8073bb50 0x8073bb50
+8073bc28 0x8073bc28
+8073bd08 0x8073bd08
+8073bd50 AI::EnemyRouteController::IsOutCurENPTBounds
+8073bf24 0x8073bf24
+8073c03c 0x8073c03c
+8073c110 AI::EnemyRouteHolder::AdvanceToNextENPT
+8073c24c 0x8073c24c
+8073c2c0 AI::EnemyRouteHolder::__ct
+8073c308 AI::EnemyRouteHolder::__dt
+8073c348 AI::EnemyRouteHolder::AddKartAIController
+8073c38c 0x8073c38c
+8073c390 0x8073c390
+8073c394 0x8073c394
+8073c540 0x8073c540
+8073c54c AI::ENPTController::__ct
+8073c5b8 AI::ENPTController::__dt
+8073c5f8 AI::ENPTController::SetStartingENPT
+8073c644 AI::ENPTController::Init
+8073c9b8 AI::ENPTController::Update
+8073c9bc AI::ENPTController::GetPrevPrevPrevENPTPosition
+8073ca10 AI::ENPTController::GetPrevPrevENPTPosition
+8073ca64 AI::ENPTController::GetPrevENPTPosition
+8073cab8 AI::ENPTController::GetCurENPTPosition
+8073cb0c AI::ENPTController::GetNextENPTPosition
+8073cb60 AI::ENPTController::GetCurPosition
+8073cb7c 0x8073cb7c
+8073cca8 0x8073cca8
+8073ccec 0x8073ccec
+8073cd3c AI::ENPTController::CalcNext
+8073d060 0x8073d060
+8073d1f0 0x8073d1f0
+8073d228 0x8073d228
+8073d248 0x8073d248
+8073d284 0x8073d284
+8073d2a4 0x8073d2a4
+8073d2c4 0x8073d2c4
+8073d2d0 0x8073d2d0
+8073d37c 0x8073d37c
+8073d3b4 0x8073d3b4
+8073d59c 0x8073d59c
+8073d6ec 0x8073d6ec
+8073d934 0x8073d934
+8073d98c AI::ENPTController::CalcNextPosition
+8073dab8 0x8073dab8
+8073dac4 0x8073dac4
+8073dbcc 0x8073dbcc
+8073dbf4 0x8073dbf4
+8073dc38 0x8073dc38
+8073dc78 0x8073dc78
+8073e01c 0x8073e01c
+8073e05c 0x8073e01c_switch
+8073e060 0x8073e01c_caseD_0
+8073e06c 0x8073e01c_caseD_3
+8073e0a4 0x8073e01c_caseD_4
+8073e0dc 0x8073e01c_caseD_5
+8073e11c 0x8073e01c_caseD_6
+8073e15c 0x8073e01c_caseD_7
+8073e19c 0x8073e01c_caseD_9
+8073e1a8 0x8073e01c_caseD_a
+8073e1b0 0x8073e01c_caseD_1
+8073e1cc 0x8073e1cc
+8073e2fc 0x8073e2fc
+8073e36c 0x8073e36c
+8073e3dc 0x8073e3dc
+8073e44c 0x8073e44c
+8073e4b4 0x8073e4b4
+8073e51c 0x8073e51c
+8073e5d0 0x8073e5d0
+8073e688 0x8073e688
+8073e798 0x8073e798
+8073e8a8 0x8073e8a8
+8073e8ec 0x8073e8ec
+8073e92c 0x8073e92c
+8073e96c 0x8073e92c_switch
+8073e970 0x8073e92c_caseD_0
+8073e97c 0x8073e92c_caseD_3
+8073e9b4 0x8073e92c_caseD_4
+8073e9ec 0x8073e92c_caseD_5
+8073ea2c 0x8073e92c_caseD_6
+8073ea6c 0x8073e92c_caseD_7
+8073eaac 0x8073e92c_caseD_8
+8073eae4 0x8073e92c_caseD_9
+8073eaf0 0x8073e92c_caseD_a
+8073eaf8 0x8073e92c_caseD_1
+8073eb14 0x8073eb14
+8073eb7c 0x8073eb7c
+8073eb8c 0x8073eb8c
+8073ebe4 AI::ENPTSettingsHolder::IsCutPoint
+8073ebf8 AI::ENPTSettingsHolder::IsUseOffroadCutItem
+8073ec0c AI::ENPTSettingsHolder::MustWheelie
+8073ec20 AI::ENPTSettingsHolder::MustEndWheelie
+8073ec34 AI::ENPTSettingsHolder::IsSetting1Equal5
+8073ec48 AI::ENPTSettingsHolder::MustEndDrift
+8073ec5c AI::ENPTSettingsHolder::IsDriftForbidden
+8073ec70 AI::ENPTSettingsHolder::MustDrift
+8073ec84 AI::ENPTSettingsHolder::IsSetting3HighestBitSet
+8073ec90 0x8073ec90
+8073ecac AI::ENPTSettingsHolder::IsDriftAllowed
+8073ece0 0x8073ece0
+8073ecf4 0x8073ecf4
+8073ed08 0x8073ed08
+8073ed1c 0x8073ed1c
+8073ed30 0x8073ed30
+8073ed3c 0x8073ed3c
+8073ed48 0x8073ed48
+8073ed54 0x8073ed54
+8073ed94 0x8073ed94
+8073edd4 0x8073edd4
+8073edf0 AI::ParamActionCalculator::__ct
+8073ee14 AI::ParamActionCalculator::__dt
+8073ee54 AI::ParamActionCalculator::Init
+8073ee8c AI::ParamActionCalculator::CalcStartBoost
+8073efa8 AI::ParamActionCalculator::CalcGotDrift
+8073f064 AI::ParamActionCalculator::CalcGotMT
+8073f108 AI::ParamActionCalculator::CalcGotTrick
+8073f190 AI::ParamActionCalculator::CalcGotWheelie
+8073f218 AI::ParamActionCalculator::CalcGotParamAction6
+8073f2a0 AI::ParamActionCalculator::CalcGotParamAction7
+8073f328 0x8073f328
+8073f37c 0x8073f37c
+8073f3c0 0x8073f3c0
+8073f400 0x8073f400
+8073f43c 0x8073f43c
+8073f4d4 0x8073f4d4
+8073f4f4 0x8073f4f4
+8073f50c 0x8073f50c
+8073f614 0x8073f614
+8073f668 0x8073f668
+8073f6a4 0x8073f6a4
+8073f6e4 0x8073f6e4
+8073f714 0x8073f714
+8073f738 0x8073f738
+8073f76c 0x8073f76c
+8073f7a8 0x8073f7a8
+8073f848 0x8073f848
+8073f8f8 0x8073f8f8
+8073f92c 0x8073f92c
+8073fa0c 0x8073fa0c
+8073fa20 0x8073fa20
+8073fa5c 0x8073fa5c
+8073fa88 0x8073fa88
+8073fab4 0x8073fab4
+8073fb78 0x8073fb78
+8073fbb8 0x8073fbb8
+8073fbf8 0x8073fbf8
+8073fc28 0x8073fc28
+8073fc34 0x8073fc34
+8073fc40 0x8073fc40
+8073fcd0 0x8073fcd0
+8073fd88 0x8073fd88
+807400b0 0x807400b0
+807401b4 0x807401b4
+807404b8 0x807404b8
+807404c8 0x807404c8
+80740604 0x80740604
+80740700 0x80740700
+80740704 0x80740704
+80740738 0x80740738
+80740774 0x80740774
+807407b4 0x807407b4
+807407e4 0x807407e4
+807407f0 0x807407f0
+807407fc 0x807407fc
+8074080c 0x8074080c
+807409b4 0x807409b4
+80740ab0 0x80740ab0
+80740ab4 0x80740ab4
+80740ae8 0x80740ae8
+80740b24 0x80740b24
+80740b64 0x80740b64
+80740b94 0x80740b94
+80740c90 0x80740c90
+80740c94 0x80740c94
+80740cc8 OS::GetCurrentContext
+80740cd4 0x80740cd4
+80740ce0 0x80740ce0
+80740ce4 0x80740ce4
+80740ce8 0x80740ce8
+80740cf0 0x80740cf0
+80740cf8 0x80740cf8
+80740d00 0x80740d00
+80740d08 0x80740d08
+80740d10 0x80740d10
+80740d14 0x80740d14
+80740d18 0x80740d18
+80740d1c 0x80740d1c
+80741388 0x80741388
+807413c8 0x807413c8
+807414b8 0x807414b8
+80741568 0x80741568
+80741654 GameInfoManager_SetUserSelectedCupSidekick
+80741660 0x80741660
+80741804 0x80741804
+80741878 0x80741878
+80741880 0x80741880
+80741888 0x80741888
+80741898 0x80741898
+807418d8 0x807418d8
+807418e0 0x807418e0
+80741980 0x80741980
+80741998 0x80741998
+80741a10 0x80741a10
+80741cec 0x80741cec
+8074204c 0x8074204c
+8074210c 0x8074210c
+807421fc 0x807421fc
+807422cc 0x807422cc
+80742398 0x80742398
+807424e0 0x807424e0
+80742584 0x80742584
+807426e4 0x807426e4
+807427f8 0x807427f8
+80742854 0x80742854
+80742858 0x80742858
+80742898 0x80742898
+80742944 0x80742944
+80742a60 0x80742a60
+80742b04 0x80742b04
+80742b10 0x80742b10
+80742bc0 0x80742bc0
+80742c0c 0x80742c0c
+80742c58 0x80742c58
+80742cc8 0x80742cc8
+80742e80 0x80742e80
+80742fe0 0x80742fe0
+807431bc 0x807431bc
+80743344 0x80743344
+807433e4 0x807433e4
+807433e8 0x807433e8
+80743428 0x80743428
+80743440 0x80743440
+80743458 0x80743458
+80743470 0x80743470
+807434d0 0x807434d0
+8074372c 0x8074372c
+80743774 0x80743774
+807437a4 0x807437a4
+807437ec 0x807437ec
+80743818 0x80743818
+80743858 0x80743858
+80743890 0x80743890
+807438dc 0x807438dc
+8074392c 0x8074392c
+8074398c 0x8074398c
+80743998 0x80743998
+807439b0 cGame_GetGameTime
+807439bc 0x807439bc
+807439f0 0x807439f0
+80743c40 0x80743c40
+80743c94 0x80743c94
+80743cd4 0x80743cd4
+80743df4 0x80743df4
+80743e20 0x80743e20
+80743e80 0x80743e80
+80743f1c 0x80743f1c
+80743fb8 0x80743fb8
+80744194 0x80744194
+807441cc 0x807441cc
+8074420c 0x8074420c
+80744258 0x80744258
+80744364 0x80744364
+80744398 0x80744398
+807443d8 0x807443d8
+80744478 0x80744478
+807445fc 0x807445fc
+80744634 0x80744634
+80744674 0x80744674
+807446c0 0x807446c0
+80744728 0x80744728
+80744730 0x80744730
+80744a2c 0x80744a2c
+80744a6c 0x80744a6c
+80744af4 0x80744af4
+80744ba4 0x80744ba4
+80744c1c 0x80744c1c
+80744c24 0x80744c24
+80744c48 0x80744c48
+80744ce0 0x80744ce0
+80744cec 0x80744cec
+80744dac 0x80744dac
+80744ee4 0x80744ee4
+80744f78 0x80744f78
+80744f8c 0x80744f8c
+80745164 0x80745164
+807451d8 0x807451d8
+80745658 0x80745658
+807456c0 0x807456c0
+807456f8 0x807456f8
+807456fc 0x807456fc
+8074571c 0x8074571c
+8074575c 0x8074575c
+8074576c 0x8074576c
+807457c4 0x807457c4
+8074580c 0x8074580c
+8074583c 0x8074583c
+80745884 MotionController::__ct
+8074591c 0x8074591c
+8074595c MotionController::__dt
+807459e4 MotionController::Init
+80745be4 MotionController::UpdateForNunchuck
+80745de4 MotionController::UpdateForCore
+8074612c 0x8074612c
+807462b8 0x807462b8
+8074644c 0x8074644c
+8074649c 0x8074649c
+80746568 0x80746568
+8074675c 0x8074675c
+807467bc 0x807467bc
+80746970 0x80746970
+80746afc 0x80746afc
+80746c64 0x80746c64
+80747154 0x80747154
+80747198 Objects::PoihanaBase::__ct
+80747208 Objects::PoihanaBase::__dt
+80747248 Objects::PoihanaBase::OnStart
+807472f4 Objects::PoihanaBase::Update
+80747308 Objects::PoihanaBase:GetTranslation
+80747324 0x80747324
+80747380 0x80747380
+8074739c 0x8074739c
+80747404 0x80747404
+80747494 0x80747494
+807474e4 0x807474e4
+80747530 0x80747530
+807475dc 0x807475dc
+807476d8 0x807476d8
+80747788 0x80747788
+8074792c UnkCollidableSub::__ct
+80747974 UnkCollidableSub::__dt
+807479b4 UnkCollidableSub::Reset
+807479d4 UnkCollidableSub::Update
+80747bfc 0x80747bfc
+80747c18 UnkCollidableSub::vf_0x14
+80747c40 Objects::PoihanaBase::SubChild::__ct
+80747c98 Objects::PoihanaBase::SubChild::__dt
+80747cd8 Objects::PoihanaBase::SubChild::Reset
+80747cfc Objects::PoihanaBase::SubChild::Update
+80747f60 0x80747f60
+80748138 Objects::Poihana::SubChild::vf_0x14
+8074815c Objects::PoihanaBase::GetPropertiesBitfield
+80748164 Objects::PoihanaBase::__dt(thunk)
+8074816c Objects::Poihana::__ct
+8074887c Objects::Poihana::Actions::__dt
+807488bc Objects::Poihana::__dt
+80748958 Objects::Poihana::OnStart
+80748b70 Objects::Poihana::Update
+80748bd4 0x80748bd4
+80748cec Objects::Poihana::LoadAnimations
+80748d98 0x80748d98
+80749378 Objects::Poihana::OnCollision
+80749504 Objects::Poihana::OnItemCollision
+80749610 0x80749610
+807496c4 0x807496c4
+80749794 0x80749794
+80749808 0x80749808
+80749824 0x80749824
+807498ac Objects::Poihana::OnStartIdle
+80749924 Objects::Poihana::UpdateIdleAndAction1
+80749ae8 Objects::Poihana::OnStartChase
+80749b00 Objects::Poihana::UpdateChase
+80749f54 0x80749f54
+80749f70 Objects::Poihana::OnStartCatapult
+8074a104 Objects::Poihana::UpdateCatapult
+8074a180 Objects::Poihana::OnEndCatapult
+8074a18c Objects::Poihana::OnStartCatapultNoMove
+8074a1dc Objects::Poihana::UpdateCatapultNoMove
+8074a28c Objects::Poihana::OnEndCatapultNoMove
+8074a298 Objects::Poihana::Topple
+8074a4a4 Objects::Poihana::OnStartToppleNormal
+8074a4bc Objects::Poihana::OnStartToppleInverted
+8074a4d8 Objects::Poihana::UpdateTopple
+8074a720 Objects::Poihana::OnEndTopple
+8074a75c Objects::Poihana::OnStartToppleNoBury
+8074a8ac Objects::Poihana::UpdateToppleNoBury
+8074ad3c 0x8074ad3c
+8074ad58 Objects::Poihana::OnEndToppleNoBury
+8074ad64 Objects::Poihana::Actions::OnStart
+8074adac Objects::Poihana::Actions::Update
+8074addc Objects::Poihana::Actions::OnEnd
+8074ae24 Objects::Poihana::__dt(thunk)
+8074ae2c AI::Base::__ct
+8074af38 AI::Base::UpdateActions
+8074afb4 AI::Base::SetInitialActions
+8074afcc AI::Base::HasSameActions
+8074afe0 AI::Base::SetNextActions
+8074afec AI::Actions::OnActionStart
+8074b034 AI::Actions::Update
+8074b064 AI::Actions::OnActionEnd
+8074b0ac 0x8074b0ac
+8074b0f8 0x8074b0f8
+8074b19c 0x8074b19c
+8074b34c 0x8074b34c
+8074b41c 0x8074b41c
+8074b668 0x8074b668
+8074b7f4 0x8074b7f4
+8074b82c 0x8074b82c
+8074b8a4 0x8074b8a4
+8074b9a8 0x8074b9a8
+8074bb34 0x8074bb34
+8074bbcc 0x8074bbcc
+8074bcd0 0x8074bcd0
+8074bcec 0x8074bcec
+8074bcf0 0x8074bcf0
+8074be40 0x8074be40
+8074bf28 0x8074bf28
+8074bfa0 0x8074bfa0
+8074bfd0 0x8074bfd0
+8074c048 0x8074c048
+8074c0b4 0x8074c0b4
+8074c1e0 0x8074c1e0
+8074c2a4 0x8074c2a4
+8074c2b4 0x8074c2b4
+8074c34c 0x8074c34c
+8074c3f0 0x8074c3f0
+8074c4a8 AwardCupModel::Disposer__dt
+8074c5b0 AwardCupModel::CreateInstance
+8074c680 AwardCupModel::DestroyInstance
+8074c73c AwardCupModel::__ct
+8074c7e0 AwardCupModel::__dt
+8074c8a8 AwardCupModel::Load
+8074c914 AwardCupModel::Load_switch
+8074c918 AwardCupModel::Load_caseD_0
+8074c94c AwardCupModel::Load_caseD_1
+8074c980 AwardCupModel::Load_caseD_2
+8074c9b4 AwardCupModel::Load_caseD_3
+8074c9e8 AwardCupModel::Load_caseD_4
+8074ca1c AwardCupModel::Load_caseD_5
+8074ca50 AwardCupModel::Load_caseD_6
+8074ca84 AwardCupModel::Load_caseD_7
+8074cab8 AwardCupModel::Load_caseD_8
+8074cd20 AwardCupModel::Prepare
+8074ce50 AwardCupModel::Activate
+8074cf00 AwardCupModel::Update
+8074d184 0x8074d184
+8074d2ec 0x8074d2ec
+8074d390 0x8074d390
+8074d43c 0x8074d43c
+8074d580 0x8074d580
+8074d5b8 GlobeMgr::Disposer__dt
+8074d650 GlobeMgr::CreateInstance
+8074d6cc GlobeMgr::DestroyInstance
+8074d700 EarthModel::__ct
+8074dc64 0x8074dc64
+8074dcc8 EarthModel::__dt
+8074dd48 0x8074dd48
+8074df78 0x8074df78
+8074df7c 0x8074df7c
+8074df80 0x8074df80
+8074df84 0x8074df84
+8074e030 0x8074e030
+8074e1f0 0x8074e1f0
+8074e214 0x8074e214
+8074e32c 0x8074e32c
+8074e3ac 0x8074e3ac
+8074e4d4 0x8074e4d4
+8074e600 0x8074e600
+8074e72c 0x8074e72c
+8074e858 0x8074e858
+8074e984 0x8074e984
+8074eab0 0x8074eab0
+8074ebdc 0x8074ebdc
+8074ee8c 0x8074ee8c
+8074f208 GlobeMii::GetTranslation
+8074f210 0x8074f210
+8074f260 0x8074f260
+8074f280 0x8074f280
+8074f2a0 0x8074f2a0
+8074f2c0 0x8074f2c0
+8074f2e4 0x8074f2e4
+8074f304 0x8074f304
+8074f558 0x8074f558
+8074f774 0x8074f774
+8074f9d0 0x8074f9d0
+8074fa40 0x8074fa40
+8074fa80 0x8074fa80
+8074fac0 0x8074fac0
+8074fb00 0x8074fb00
+8074fb44 0x8074fb44
+8074fb84 0x8074fb84
+8074fe38 0x8074fe38
+8074fe3c GlobeMgr::__ct
+8074fe8c GlobeMgr::__dt
+8074ff54 GlobeMgr::Init
+80750018 0x80750018
+80750238 0x80750238
+807502f4 0x807502f4
+80750344 GlobeMgr::Update
+807506c8 0x807506c8
+80750708 0x80750708
+807507ec 0x807507ec
+807507fc GlobeMgr::IsMiiEnabled
+80750808 GlobeMgr::SetPosition
+80750998 0x80750998
+8075099c 0x8075099c
+807509a0 GlobeMgr::SetMii
+807509b4 GlobeMgr::DisplayMii
+807509d0 GlobeMgr::ResetGlobeMii
+807509e4 0x807509e4
+80750aac GlobeMii::__ct
+8075102c GlobeMii::Init
+80751144 GlobeMii::Update
+80751208 GlobeMii::SetMii
+80751528 GlobeMii::IsFemaleMii
+80751540 GlobeMii::DisplayMii
+807518bc GlobeMii::Reset
+8075193c 0x8075193c
+807519c8 0x807519c8
+80751a2c 0x80751a2c
+80751a6c 0x80751a6c
+80751a70 0x80751a70
+80751a74 0x80751a74
+80751b4c 0x80751b4c
+80751c24 0x80751c24
+80751c2c 0x80751c2c
+80751c6c 0x80751c6c
+80751cac 0x80751cac
+80751d60 0x80751d60
+80751ee4 0x80751ee4
+807522b8 0x807522b8
+80752304 0x80752304
+8075246c 0x8075246c
+807525c0 0x807525c0
+80752704 0x80752704
+807527ec 0x807527ec
+807529b8 0x807529b8
+80752a24 0x80752a24
+80752a30 0x80752a30
+80752a44 0x80752a44
+80752aa4 0x80752aa4
+80752aac 0x80752aac
+80752ab4 0x80752ab4
+80752b34 0x80752b34
+80752b74 0x80752b74
+80752c20 0x80752c20
+80752cb8 0x80752cb8
+80752d2c 0x80752d2c
+80752d30 0x80752d30
+80752eec 0x80752eec
+80752fa4 0x80752fa4
+80753048 0x80753048
+807530c0 0x807530c0
+80753268 0x80753268
+807536a0 0x807536a0
+80753714 0x80753714
+80753720 0x80753720
+8075372c 0x8075372c
+807538e8 0x807538e8
+80753960 0x80753960
+80753964 0x80753964
+807539e4 0x807539e4
+807539fc 0x807539fc
+80753a0c 0x80753a0c
+80753b34 0x80753b34
+80753e30 0x80753e30
+80753ea8 0x80753ea8
+80753eac 0x80753eac
+80753f2c 0x80753f2c
+80753f30 0x80753f30
+80753f34 0x80753f34
+80753f38 0x80753f38
+80753f3c 0x80753f3c
+80753f40 0x80753f40
+80753f44 0x80753f44
+80753f4c 0x80753f4c
+80753f50 0x80753f50
+80753f54 0x80753f54
+80753f58 0x80753f58
+80753f5c 0x80753f5c
+80753f64 0x80753f64
+80753f6c 0x80753f6c
+80753fbc 0x80753fbc
+80754034 0x80754034
+80754038 0x80754038
+80754088 0x80754088
+80754100 0x80754100
+80754104 0x80754104
+80754264 0x80754264
+80754960 0x80754960
+807549f0 0x807549f0
+807549fc 0x807549fc
+80754a08 0x80754a08
+80754ad4 0x80754ad4
+80754c14 0x80754c14
+80754c20 0x80754c20
+80754c2c 0x80754c2c
+80754c38 0x80754c38
+80754c44 0x80754c44
+80754c50 0x80754c50
+80754cd8 0x80754cd8
+80754fd4 0x80754fd4
+80755110 0x80755110
+807551c4 0x807551c4
+80755274 0x80755274
+80755330 0x80755330
+807553d4 0x807553d4
+8075547c 0x8075547c
+807558c4 0x807558c4
+80755ad8 0x80755ad8
+80755c58 0x80755c58
+80755c8c 0x80755c8c
+80755fa0 0x80755fa0
+807560c8 0x807560c8
+807561d8 0x807561d8
+80756360 0x80756360
+80756578 0x80756578
+80756838 0x80756838
+80756a0c 0x80756a0c
+80756c10 0x80756c10
+80756d1c 0x80756d1c
+80756dcc 0x80756dcc
+80756df0 0x80756df0
+8075710c 0x8075710c
+807571c0 0x807571c0
+80757514 0x80757514
+8075758c 0x8075758c
+807575fc 0x807575fc
+80757638 0x80757638
+80757670 0x80757670
+80757764 0x80757764
+807578d8 BegomanManager::__ct
+8075794c 0x8075794c
+80757950 0x80757950
+80757db8 0x80757db8
+80757dd4 0x80757dd4
+80757e08 0x80757e08
+80757e90 0x80757e90
+80757ee0 0x80757ee0
+80758188 0x80758188
+807581a0 0x807581a0
+8075826c 0x8075826c
+80758368 0x80758368
+80758444 0x80758444
+807585d0 0x807585d0
+80758674 0x80758674
+80758984 0x80758984
+80758a68 0x80758a68
+80758a70 0x80758a70
+80758a7c 0x80758a7c
+80758a84 0x80758a84
+80758a88 0x80758a88
+80758a8c 0x80758a8c
+80758a90 0x80758a90
+80758a94 0x80758a94
+80758a98 0x80758a98
+80758a9c 0x80758a9c
+80758aa4 0x80758aa4
+80758aa8 0x80758aa8
+80758aac 0x80758aac
+80758ab0 0x80758ab0
+80758ab4 0x80758ab4
+80758ab8 0x80758ab8
+80758abc 0x80758abc
+80758ac4 0x80758ac4
+80758b04 0x80758b04
+80758b44 0x80758b44
+80758b84 0x80758b84
+80758bc4 0x80758bc4
+80758bcc 0x80758bcc
+80758bd4 0x80758bd4
+80758bdc 0x80758bdc
+80758ef0 0x80758ef0
+80758f30 0x80758f30
+80758f68 0x80758f68
+80759364 0x80759364
+80759388 0x80759388
+807596f0 0x807596f0
+807599d0 0x807599d0
+807599d8 0x807599d8
+807599e0 0x807599e0
+807599fc 0x807599fc
+80759db8 0x80759db8
+80759de0 0x80759de0
+80759ee8 0x80759ee8
+8075a398 0x8075a398
+8075a3cc 0x8075a3cc
+8075a4b8 0x8075a4b8
+8075a56c 0x8075a56c
+8075a59c 0x8075a59c
+8075a824 0x8075a824
+8075a864 0x8075a864
+8075a904 0x8075a904
+8075a9a4 0x8075a9a4
+8075aac8 0x8075aac8
+8075ae80 cFielder_IsStriker
+8075ae90 0x8075ae90
+8075afbc 0x8075afbc
+8075b08c 0x8075b08c
+8075b178 0x8075b178
+8075b1f4 0x8075b1f4
+8075b260 0x8075b260
+8075b2e4 0x8075b2e4
+8075b3d0 0x8075b3d0
+8075b524 0x8075b524
+8075b61c 0x8075b61c
+8075b65c 0x8075b65c
+8075b694 0x8075b694
+8075b754 0x8075b754
+8075bc6c 0x8075bc6c
+8075bdb4 0x8075bdb4
+8075bf98 0x8075bf98
+8075c0b0 0x8075c0b0
+8075c2a0 0x8075c2a0
+8075c2bc 0x8075c2bc
+8075c454 0x8075c454
+8075c51c 0x8075c51c
+8075c658 0x8075c658
+8075c888 0x8075c888
+8075c910 0x8075c910
+8075c958 0x8075c958
+8075c9a0 0x8075c9a0
+8075cbe4 0x8075cbe4
+8075cc34 0x8075cc34
+8075cc58 0x8075cc58
+8075cd7c 0x8075cd7c
+8075ce20 0x8075ce20
+8075cf2c 0x8075cf2c
+8075d000 0x8075d000
+8075d010 0x8075d010
+8075d034 0x8075d034
+8075d13c 0x8075d13c
+8075d144 0x8075d144
+8075d26c 0x8075d26c
+8075d378 0x8075d378
+8075d58c 0x8075d58c
+8075d88c 0x8075d88c
+8075d924 0x8075d924
+8075d9d0 0x8075d9d0
+8075d9d8 0x8075d9d8
+8075d9e0 0x8075d9e0
+8075d9ec 0x8075d9ec
+8075d9f4 0x8075d9f4
+8075d9fc 0x8075d9fc
+8075da08 0x8075da08
+8075da14 0x8075da14
+8075da20 0x8075da20
+8075da2c 0x8075da2c
+8075da6c 0x8075da6c
+8075daac 0x8075daac
+8075daec 0x8075daec
+8075db24 0x8075db24
+8075db2c 0x8075db2c
+8075db34 0x8075db34
+8075db3c 0x8075db3c
+8075dba0 0x8075dba0
+8075dc9c 0x8075dc9c
+8075dca0 0x8075dca0
+8075de40 0x8075de40
+8075deac 0x8075deac
+8075e070 0x8075e070
+8075e16c 0x8075e16c
+8075e1f4 0x8075e1f4
+8075e28c 0x8075e28c
+8075e2e0 0x8075e2e0
+8075e6e8 0x8075e6e8
+8075e73c 0x8075e73c
+8075e744 0x8075e744
+8075e74c 0x8075e74c
+8075e78c 0x8075e78c
+8075e804 0x8075e804
+8075e844 0x8075e844
+8075e988 0x8075e988
+8075e98c 0x8075e98c
+8075ea94 0x8075ea94
+8075eaf4 0x8075eaf4
+8075eafc obj_dossunc::__ct
+8075edcc 0x8075edcc
+8075ee68 0x8075ee68
+8075eea8 0x8075eea8
+8075f21c 0x8075f21c
+8075f254 obj_dossun_active_update
+8075f3f4 0x8075f3f4
+8075f430 0x8075f430
+8075f460 0x8075f460
+8075f4d8 0x8075f4d8
+8075f520 0x8075f520
+8075f584 0x8075f584
+8075f76c 0x8075f76c
+8075fa08 0x8075fa08
+8075fb50 0x8075fb50
+8075fc7c 0x8075fc7c
+8075fdcc 0x8075fdcc
+8075fe80 0x8075fe80
+8075fe8c obj_dossun_endFall
+8075fea0 0x8075fea0
+8075ff08 0x8075ff08
+8075ff98 0x8075ff98
+80760118 0x80760118
+80760188 0x80760188
+8076023c 0x8076023c
+807602e0 obj_dossun_update
+80760490 0x80760490
+807604c4 0x807604c4
+807605ec 0x807605ec
+80760634 0x80760634
+80760820 0x80760820
+80760964 obj_dossun_make_active
+80760a44 0x80760a44
+80760ad4 0x80760ad4
+80760b20 0x80760b20
+80760bd4 0x80760bd4
+80760c5c 0x80760c5c
+80760d18 0x80760d18
+80760d8c 0x80760d8c
+8076139c 0x8076139c
+807614d0 0x807614d0
+807616c8 0x807616c8
+80761740 0x80761740
+80761744 0x80761744
+8076198c 0x8076198c
+80762054 0x80762054
+80762190 0x80762190
+807623ac 0x807623ac
+807624f0 0x807624f0
+807625f0 0x807625f0
+80762eec 0x80762eec
+807630d0 0x807630d0
+8076321c 0x8076321c
+807634c0 0x807634c0
+807638f8 0x807638f8
+80763918 0x80763918
+8076393c 0x8076393c
+80763a00 0x80763a00
+80763a04 0x80763a04
+80763a10 0x80763a10
+80763b60 0x80763b60
+80763c14 0x80763c14
+80763e0c 0x80763e0c
+80763eac 0x80763eac
+80763f6c 0x80763f6c
+80764054 0x80764054
+807640f0 0x807640f0
+807642e4 0x807642e4
+807642f8 0x807642f8
+807643a0 0x807643a0
+80764498 0x80764498
+80764510 0x80764510
+807645c4 0x807645c4
+80764604 0x80764604
+80764608 0x80764608
+80764644 0x80764644
+807646a4 0x807646a4
+8076479c 0x8076479c
+807648a4 0x807648a4
+807649a4 0x807649a4
+80764a04 0x80764a04
+80764a0c 0x80764a0c
+80764a14 0x80764a14
+80764a1c 0x80764a1c
+80764a20 0x80764a20
+80764a24 0x80764a24
+80764a28 0x80764a28
+80764a2c 0x80764a2c
+80764a30 0x80764a30
+80764a38 0x80764a38
+80764a3c 0x80764a3c
+80764a8c 0x80764a8c
+80764b04 0x80764b04
+80764b08 0x80764b08
+80764b48 0x80764b48
+80764b88 0x80764b88
+80764bc8 0x80764bc8
+80764c48 0x80764c48
+80764c88 0x80764c88
+80764cc8 obj_Epropeller::__ct
+80764dbc 0x80764dbc
+80764e34 obj_Epropeller::__dt
+80764eb4 obj_Epropeller_0x0c
+80765064 0x80765064
+80765068 obj_Epropeller_update
+80765190 0x80765190
+807652ac 0x807652ac
+807653a8 obj_Epropeller_updateEffect
+80765558 0x80765558
+807655b4 0x807655b4
+80765734 0x80765734
+80765738 0x80765738
+807658e0 0x807658e0
+80765930 0x80765930
+80765a54 0x80765a54
+80765bc0 0x80765bc0
+80765bc8 0x80765bc8
+80765c18 0x80765c18
+80765c90 0x80765c90
+80765c94 0x80765c94
+80765d38 0x80765d38
+80765db0 0x80765db0
+80765e30 0x80765e30
+8076613c 0x8076613c
+80766140 0x80766140
+80766144 0x80766144
+807662f8 0x807662f8
+80766754 0x80766754
+807667dc 0x807667dc
+80766864 0x80766864
+807668d4 0x807668d4
+807669c8 0x807669c8
+80766a08 0x80766a08
+80766a54 0x80766a54
+80766a58 0x80766a58
+80766a98 0x80766a98
+80766ad8 0x80766ad8
+80766b18 0x80766b18
+80766b58 0x80766b58
+80766bac 0x80766bac
+80766bb4 0x80766bb4
+80766bc0 0x80766bc0
+80766bcc 0x80766bcc
+80766ca4 0x80766ca4
+80766cac 0x80766cac
+80766cb0 0x80766cb0
+80766cb8 0x80766cb8
+80766cc4 0x80766cc4
+80766cd0 0x80766cd0
+80766cdc 0x80766cdc
+80766ce8 0x80766ce8
+80766cf4 0x80766cf4
+80766d00 0x80766d00
+80766d50 0x80766d50
+80766dc8 0x80766dc8
+80766dcc 0x80766dcc
+80766e0c 0x80766e0c
+80766e4c 0x80766e4c
+80766e8c 0x80766e8c
+80766f4c Objects::Karehayama::__ct
+80766f88 Objects::Karehayama::__dt
+80766fe0 Objects::Karehayama::OnStart
+80767038 Objects::Karehayama::LoadEffects
+80767114 Objects::Karehayama::CreateCollisionEffectSoft
+807671dc Objects::Karehayama::CreateCollisionEffect
+8076724c Objects::Karehayama::CreateExplosionEffect
+80767250 Objects::Karehayama::Respawn
+807672a4 Objects::Karehayama::DropItem
+8076734c Objects::Karehayama::OnNormalCollision
+80767448 Objects::Karehayama::OnImperviousCollision
+8076757c Objects::Karehayama::OnNormalItemCollision
+80767648 Objects::Karehayama::OnImperviousItemCollision
+80767704 Objects::Karehayama::LoadShadow
+807677e0 Object::ItemDropper::UpdateRespawn
+807677e4 Object::ItemDropper::GetPropertiesBitfield
+807677ec Objects::Karehayama::LoadAnimations
+80767840 Objects::Karehayama::vf_0x114
+80767848 Objects::Karehayama::OnWallCollision
+8076784c Objects::Karehayama::GetBRRESName
+807678a0 Objects::Karehayama::GetSubFileName
+807678f4 0x807678f4
+80767d70 0x80767d70
+80767de8 0x80767de8
+80767dec 0x80767dec
+80767e04 0x80767e04
+80767ff4 0x80767ff4
+807683f0 0x807683f0
+80768408 0x80768408
+80768650 0x80768650
+80768698 0x80768698
+807686b8 0x807686b8
+807686bc 0x807686bc
+80768710 0x80768710
+8076871c 0x8076871c
+80768728 0x80768728
+80768730 0x80768730
+80768734 0x80768734
+80768738 0x80768738
+8076873c 0x8076873c
+80768740 0x80768740
+80768748 0x80768748
+80768790 0x80768790
+807687d8 0x807687d8
+807687e0 0x807687e0
+80768830 0x80768830
+807688a8 0x807688a8
+807688ac 0x807688ac
+8076892c 0x8076892c
+807689ac 0x807689ac
+807689ec Objects::Hanabi::__ct
+80768a50 Objects::Hanabi::__dt
+80768a90 Objects::Hanabi::OnStart
+80768ae4 0x80768ae4
+80768af8 Objects::Hanabi::Update
+80768c18 0x80768c18
+80768d08 Objects::Hanabi::LoadClipInfo
+80768d0c Objects::Hanabi::LoadCollision
+80768d10 Objects::Hanabi::LoadAnimations
+80768d14 Objects::Hanabi::LoadModels
+80768d18 Objects::Hanabi::GetPropertiesBitfield
+80768d20 ObjVeniceGondola_construct
+80768d84 ObjVeniceGondola_destruct
+80768dc4 0x80768dc4
+80768f0c 0x80768f0c
+80768f10 0x80768f10
+807691f8 0x807691f8
+80769280 0x80769280
+80769308 0x80769308
+80769370 0x80769370
+807693ac 0x807693ac
+807693ec 0x807693ec
+8076942c 0x8076942c
+807694e8 0x807694e8
+80769584 0x80769584
+80769590 0x80769590
+8076959c 0x8076959c
+807695a4 0x807695a4
+80769608 0x80769608
+80769610 0x80769610
+8076961c 0x8076961c
+80769628 0x80769628
+80769630 0x80769630
+80769634 0x80769634
+807696cc 0x807696cc
+80769794 0x80769794
+807697d4 0x807697d4
+8076983c 0x8076983c
+80769840 0x80769840
+80769980 0x80769980
+80769998 0x80769998
+80769b30 0x80769b30
+80769b90 0x80769b90
+80769f84 0x80769f84
+8076a024 0x8076a024
+8076a148 0x8076a148
+8076a1fc 0x8076a1fc
+8076a2b8 0x8076a2b8
+8076a338 0x8076a338
+8076a3b0 0x8076a3b0
+8076a508 0x8076a508
+8076a560 0x8076a560
+8076a56c 0x8076a56c
+8076a638 0x8076a638
+8076a824 0x8076a824
+8076a828 0x8076a828
+8076a8a8 0x8076a8a8
+8076a920 0x8076a920
+8076a9d4 0x8076a9d4
+8076a9e0 0x8076a9e0
+8076a9e4 0x8076a9e4
+8076adac 0x8076adac
+8076adb0 0x8076adb0
+8076afa8 0x8076afa8
+8076b080 0x8076b080
+8076b238 0x8076b238
+8076b304 0x8076b304
+8076b4c0 0x8076b4c0
+8076b554 0x8076b554
+8076b990 0x8076b990
+8076b994 0x8076b994
+8076ba0c 0x8076ba0c
+8076ba84 0x8076ba84
+8076ba88 0x8076ba88
+8076bb44 0x8076bb44
+8076bb94 0x8076bb94
+8076bdf4 0x8076bdf4
+8076c038 0x8076c038
+8076c154 0x8076c154
+8076c1f4 0x8076c1f4
+8076c328 0x8076c328
+8076c420 0x8076c420
+8076c424 0x8076c424
+8076c428 0x8076c428
+8076c42c 0x8076c42c
+8076c430 0x8076c430
+8076c438 0x8076c438
+8076c43c 0x8076c43c
+8076c440 0x8076c440
+8076c444 0x8076c444
+8076c448 0x8076c448
+8076c450 0x8076c450
+8076c458 0x8076c458
+8076c4a8 0x8076c4a8
+8076c520 0x8076c520
+8076c524 0x8076c524
+8076c574 0x8076c574
+8076c5ec 0x8076c5ec
+8076c5f0 0x8076c5f0
+8076c640 0x8076c640
+8076c6b8 0x8076c6b8
+8076c6bc 0x8076c6bc
+8076c774 0x8076c774
+8076c858 0x8076c858
+8076c85c Objects::W_Itembox::__ct
+8076c9c8 Objects::SubObjectArray<W_Itembox::Box>::__dt
+8076ca40 Objects::SubObjectArray<W_Itembox::Box>::vf_0x18
+8076ca44 Objects::W_Itembox::__dt
+8076cac4 Objects::W_Itembox::OnStart
+8076cafc 0x8076cafc
+8076cb08 Objects::W_Itembox::Update
+8076cbf8 0x8076cbf8
+8076ccc8 Objects::W_Itembox::Box::__ct
+8076cd04 Objects::W_Itembox::Box::__dt
+8076cd44 Objects::W_Itembox::Box::OnStart
+8076cd54 0x8076cd54
+8076cdb8 Objects::W_Itembox::Box::Update
+8076ceb0 0x8076ceb0
+8076cefc Objects::W_Itembox::Box::OnCollision
+8076cf34 Objects::W_Itembox::Box::OnItemCollision
+8076cf3c Objects::W_Itembox::UpdateModel
+8076cf40 Objects::W_Itembox::LoadClipInfo
+8076cf44 Objects::W_Itembox::LoadCollision
+8076cf48 Objects::W_Itembox::LoadAnimations
+8076cf4c Objects::W_Itembox::LoadModels
+8076cf50 Objects::W_Itembox::GetPropertiesBitfield
+8076cf58 Objects::W_Itembox::Box::GetSubFileName
+8076cf64 Objects::W_Itembox::Box::GetBRRESName
+8076cf70 Objects::W_Itembox::Box::GetPropertiesBitfield
+8076cf78 Objects::SubObjectArray<W_Itembox::Box>::CreateArray
+8076cfc8 Objects::SubObjectArray<W_Itembox::Box>::CreateArray(heap)
+8076d040 Objects::SubObjectArray<W_Itembox::Box>::vf_0x14
+8076d044 Objects::W_Itemboxline::__ct
+8076d460 Objects::SubObjectArray<W_Itemboxline::Box>::__dt
+8076d4d8 Objects::SubObjectArray<W_Itemboxline::Block>::__dt
+8076d550 Objects::SubObjectArray<W_Itemboxline::Block>::vf_0x18
+8076d554 Objects::SubObjectArray<W_Itemboxline::Box>::vf_0x18
+8076d558 Objects::W_Itemboxline::__dt
+8076d604 Objects::W_Itemboxline::OnStart
+8076d640 0x8076d640
+8076d64c Objects::W_Itemboxline::Update
+8076d828 0x8076d828
+8076d9e4 Objects::W_Itemboxline::Box::GetID
+8076da48 Objects::W_Itemboxline::Box::__dt
+8076da88 Objects::W_Itemboxline::Box::OnStart
+8076da98 0x8076da98
+8076daf4 Objects::W_Itemboxline::Box::Update
+8076df44 0x8076df44
+8076e0bc Objects::W_Itemboxline::Box::OnCollision
+8076e0f4 0x8076e0f4
+8076e164 Objects::W_Itemboxline::Block::__dt
+8076e1a4 Objects::W_Itemboxline::Block::OnStart
+8076e210 0x8076e210
+8076e2c0 Objects::W_Itemboxline::Block::Update
+8076e400 0x8076e400
+8076e4e8 Objects::W_Itemboxline::Block::OnCollision
+8076e5d8 Objects::W_Itemboxline::Block::OnItemCollision
+8076e69c 0x8076e69c
+8076e7ac Objects::W_Itemboxline::Press::__ct
+8076e818 Objects::W_Itemboxline::Press::__dt
+8076e870 Objects::W_Itemboxline::Press::TryFall
+8076e8b0 Objects::W_Itemboxline::Press::UpdateEffect
+8076e9a8 Objects::W_Itemboxline::UpdateModel
+8076e9ac Objects::W_Itemboxline::LoadClipInfo
+8076e9b0 Objects::W_Itemboxline::LoadCollision
+8076e9b4 Objects::W_Itemboxline::LoadAnimations
+8076e9b8 Objects::W_Itemboxline::LoadModels
+8076e9bc Objects::W_Itemboxline::GetPropertiesBitfield
+8076e9c4 0x8076e9c4
+8076e9cc 0x8076e9cc
+8076e9d8 0x8076e9d8
+8076e9e4 Objects::W_Itemboxline::Box::GetPropertiesBitfield
+8076e9ec Objects::W_Itemboxline::Block::GetPropertiesBitfield
+8076e9f4 Objects::W_Itemboxline::Block::GetBRRESName
+8076ea00 Objects::W_Itemboxline::Block::GetSubFileName
+8076ea0c Objects::Press::GetCollisionDiameter
+8076ea18 Objects::Press::GetShadowListIdx
+8076ea20 Objects::W_Itemboxline::Press::GetPropertiesBitfield
+8076ea28 Objects::W_Itemboxline::Press::GetID
+8076ea30 Objects::W_Itemboxline::Press::GetBRRESName
+8076ea3c Objects::W_Itemboxline::Press::GetSubFileName
+8076ea48 Objects::SubObjectArray<W_Itemboxline::Block>::CreateArray
+8076ea98 Objects::SubObjectArray<W_Itemboxline::Block>::CreateArray(heap)
+8076eb10 Objects::SubObjectArray<W_Itemboxline::Block>::vf_0x14
+8076eb14 Objects::SubObjectArray<W_Itemboxline::Box>::CreateArray
+8076eb64 Objects::SubObjectArray<W_Itemboxline::Box>::CreateArray(heap)
+8076ebdc Objects::SubObjectArray<W_Itemboxline::Box>::vf_0x14
+8076ebe0 Objects::ItemDropper::__ct
+8076ec28 Objects::ItemDropper::__dt
+8076ec68 Objects::ItemDropper::OnStart
+8076ed18 Objects::ItemDropper::LoadEffects
+8076ed1c Objects::ItemDropper::Update
+8076ed70 Objects::ItemDropper::RespawnImpl
+8076edd4 Objects::ItemDropper::Respawn
+8076ede4 Objects::ItemDropper::DropItem
+8076efdc Objects::ItemDropper::CreateExplosionEffect
+8076f0ac Objects::ItemDropper::OnCollision
+8076f1d4 Objects::ItemDropper::OnNormalCollision
+8076f1d8 Objects::ItemDropper::OnImperviousCollision
+8076f1dc Objects::ItemDropper::OnItemCollision
+8076f2d8 Objects::ItemDropper::OnNormalItemCollision
+8076f2dc Objects::ItemDropper::OnImperviousItemCollision
+8076f2e0 Objects::DKRockGC::__ct
+8076f344 Objects::DKRockGC::__dt
+8076f384 Objects::DKRockGC::OnStart
+8076f58c 0x8076f58c
+8076f590 Objects::DKRockGC::Update
+8076f768 0x8076f768
+8076f868 0x8076f868
+8076f91c 0x8076f91c
+8076fa60 0x8076fa60
+8076fd90 0x8076fd90
+8076ffc0 0x8076ffc0
+80770068 Objects::DKRockGC::OnCollision
+807701f8 Objects::DKRockGC::OnItemCollision
+8077028c Objects::DKRockGC::UpdateShadow
+8077036c Objects::DKRockGC::GetCollisionTranslation
+80770374 Objects::DKRockGC::GetShadowListIdx
+8077037c Objects::DKRockGC::GetPropertiesBitfield
+80770384 Objects::KoopaBall::__ct
+807703d0 Objects::KoopaBall::OnStart
+8077079c 0x8077079c
+807707ac 0x807707ac
+80770924 0x80770924
+80770a64 0x80770a64
+80770adc Objects::KoopaBall::Update
+80770f4c 0x80770f4c
+80771248 0x80771248
+80771324 0x80771324
+8077151c 0x8077151c
+80771624 0x80771624
+80771774 0x80771774
+807718d0 0x807718d0
+807719a0 0x807719a0
+807719e8 0x807719e8
+80771b50 0x80771b50
+80771bcc 0x80771bcc
+80771bf4 Objects::KoopaBall::OnCollision
+80771e24 Objects::KoopaBall::UpdateShadow
+80771f60 Objects::KoopaBall::GetCollisionTranslation
+80771f68 Objects::KoopaBall::GetPropertiesBitfield
+80771f70 Objects::KoopaBall::__dt
+80771fb0 0x80771fb0
+80772054 0x80772054
+807720ec 0x807720ec
+8077213c 0x8077213c
+8077231c 0x8077231c
+80772448 0x80772448
+80772504 0x80772504
+80772530 0x80772530
+80772650 0x80772650
+807726b4 0x807726b4
+807726bc 0x807726bc
+807726c4 0x807726c4
+80772704 0x80772704
+80772744 0x80772744
+8077275c 0x8077275c
+80772b1c 0x80772b1c
+80772c78 0x80772c78
+80772c7c 0x80772c7c
+80772cbc 0x80772cbc
+80772cfc 0x80772cfc
+8077308c 0x8077308c
+80773094 0x80773094
+807730d4 Objects::MiiObj::__ct
+80773114 Objects::MiiObj::__dt
+80773180 Objects::MiiObj::OnStart
+8077318c Objects::MiiObj::LoadModels
+807736c0 Objects::MiiObj::GetPropertiesBitfield
+807736c8 Objects::MiiPoster::__ct
+80773708 Objects::MiiPoster::__dt
+80773714 Objects::MiiPoster::OnStart
+807738e8 Objects::MiiPoster::LoadModels
+807738f0 Objects::MiiPoster::GetPropertiesBitfield
+80773930 Objects::MiiKanban::__ct
+80773970 Objects::MiiKanban::LoadModels
+80773c08 Objects::MiiKanban::OnStart
+80773c14 Objects::MiiKanban::GetPropertiesBitfield
+80773c1c Objects::MiiKanban::__dt
+80773c5c ObjMonteA_construct
+80773d00 0x80773d00
+80773dac 0x80773dac
+80774044 0x80774044
+807740ec 0x807740ec
+80774208 0x80774208
+807742f8 0x807742f8
+8077439c 0x8077439c
+807743a4 0x807743a4
+807743e4 0x807743e4
+80774750 0x80774750
+80774754 0x80774754
+80774a00 0x80774a00
+80774a84 0x80774a84
+80774c1c 0x80774c1c
+80774c80 0x80774c80
+80774cb0 0x80774cb0
+80774eb8 0x80774eb8
+80774f20 0x80774f20
+8077502c 0x8077502c
+80775108 0x80775108
+807753b4 0x807753b4
+80775458 0x80775458
+80775464 0x80775464
+807754ec 0x807754ec
+807754f4 0x807754f4
+807754fc 0x807754fc
+8077553c 0x8077553c
+8077557c 0x8077557c
+80775614 0x80775614
+8077561c 0x8077561c
+80775624 0x80775624
+80775670 Objects::Penguin::__dt
+807756b0 Objects::Penguin::OnStart
+80775758 0x80775758
+80775764 Objects::Penguin::Update
+807757a0 Objects::Penguin::UpdateWithRot
+80775804 Objects::Penguin::UpdateNoRot
+8077588c Objects::Penguin::vf_0x104
+80775950 Objects::Penguin::UpdateMtxNoRot
+80775b1c Objects::Penguin::UpdateMtxWithRot
+80775ba4 0x80775ba4
+80775c2c Objects::Penguin::UpdatePosition
+80775c58 Objects::Penguin::OnCollision
+80775ce0 Objects::Penguin::OnItemCollision
+80775d2c Objects::Penguin::SpinOut
+80775e60 Objects::Penguin_s::__ct
+80775fc4 Objects::PenguinUnkObj::LoadAnimations
+80776070 Objects::Penguin_s::__dt
+807760b0 Objects::Penguin_s::OnStart
+80776188 0x80776188
+80776198 Objects::Penguin_s::Update
+8077637c Objects::Penguin_s::UpdateWithRot
+807763d0 0x807763d0
+80776498 0x80776498
+80776670 0x80776670
+807766e8 Objects::Penguin_s::UpdateNoRot
+807768a0 0x807768a0
+80776af0 Objects::Penguin_s::vf_0x104
+80776b7c 0x80776b7c
+80776b94 0x80776b94
+80776c58 0x80776c58
+80776cdc 0x80776cdc
+80776d90 Objects::Penguin_s::SpinOut
+80776ecc Objects::Penguin_s::UpdateModelMatrix
+8077704c 0x8077704c
+8077708c Objects::Penguin_m::__ct
+80777130 Objects::Penguin_l::__ct
+807771dc Objects::Penguin_l::OnStart
+80777284 Objects::Penguin_l::UpdateModelMatrix
+80777288 0x80777288
+807772c8 Objects::Penguin::LoadAnimations
+8077731c Objects::Penguin::vf_0xec
+80777324 Objects::Penguin::GetPropertiesBitfield
+8077732c Objects::Penguin_l::DoCalcShadowMtx
+80777334 0x80777334
+80777388 0x80777388
+80777390 0x80777390
+80777394 0x80777394
+8077739c Objects::Penguin_s::LoadAnimations
+80777448 Objects::Penguin_s::vf_0xec
+80777450 Objects::PenguinUnkObj::vf_0xec
+80777458 Objects::PenguinUnkObj::Update
+8077745c Objects::PenguinUnkObj::GetScnObjDrawOptionsIdx
+80777464 Objects::PenguinUnkObj::__dt
+807774a4 Objects::Penguin_m::_dt
+807774e4 0x807774e4
+80777524 Objects::Penguin_l::__dt
+80777564 Objects::Press::__ct
+807775fc Objects::Press::OnStart
+8077763c 0x8077763c
+8077786c 0x8077786c
+8077788c Objects::Press::Update
+80777a90 Objects::Press::TryFall
+80777b54 0x80777b54
+80777b90 0x80777b90
+80777bc0 0x80777bc0
+80777cb0 0x80777cb0
+80777d10 Objects::Press::UpdateColliding
+80777ef8 Objects::Press::UpdateEffect
+80777fc8 0x80777fc8
+80778080 0x80778080
+8077808c 0x8077808c
+80778140 0x80778140
+8077814c 0x8077814c
+80778168 0x80778168
+80778218 0x80778218
+807782d4 Objects::Press::OnCollision
+8077840c Objects::Press::LoadCollision
+807786e4 Objects::Press::LoadAnimations
+807787e8 Objects::Press::GetPropertiesBitfield
+807787f0 Objects::Dokan_sfc::__ct
+80778830 Objects::Dokan_sfc::OnStart
+807788c8 Objects::Dokan_sfc::Update
+8077894c 0x8077894c
+807789bc 0x807789bc
+80778ba0 0x80778ba0
+80778c0c Objects::Dokan_sfc::OnCollision
+80778cc4 Objects::Dokan_sfc::OnItemCollision
+80778d50 Objects::Dokan_sfc::UpdateCollision
+80778ea8 Objects::Dokan_sfc::UpdateShadow
+80778f5c Objects::Dokan_sfc::LoadAnimations
+80778fdc Objects::Dokan_sfc::vf_0xec
+80778fe4 Objects::Dokan_sfc::GetPropertiesBitfield
+80778fec Objects::Dokan_sfc::__dt
+8077902c 0x8077902c
+8077906c 0x8077906c
+80779170 0x80779170
+80779174 0x80779174
+8077921c 0x8077921c
+80779390 0x80779390
+80779400 0x80779400
+807795a4 0x807795a4
+8077962c 0x8077962c
+807796b4 0x807796b4
+8077971c 0x8077971c
+80779a68 0x80779a68
+80779d5c 0x80779d5c
+80779e68 0x80779e68
+80779eec 0x80779eec
+80779ef4 0x80779ef4
+80779efc 0x80779efc
+80779f3c 0x80779f3c
+8077a1a8 0x8077a1a8
+8077a1e8 0x8077a1e8
+8077a35c nlListContainer<P8SaveData>__ct
+8077a36c 0x8077a36c
+8077a5f8 0x8077a5f8
+8077a6d4 0x8077a6d4
+8077a8b8 0x8077a8b8
+8077aa78 0x8077aa78
+8077ab98 0x8077ab98
+8077acbc 0x8077acbc
+8077ace0 0x8077ace0
+8077ad60 0x8077ad60
+8077b248 0x8077b248
+8077b358 0x8077b358
+8077b394 0x8077b394
+8077b3d4 0x8077b3d4
+8077b450 0x8077b450
+8077b5bc 0x8077b5bc
+8077ba18 0x8077ba18
+8077ba80 0x8077ba80
+8077bb98 0x8077bb98
+8077bbe0 0x8077bbe0
+8077bc20 0x8077bc20
+8077bc68 0x8077bc68
+8077bca8 0x8077bca8
+8077bd30 0x8077bd30
+8077bd38 0x8077bd38
+8077bd40 0x8077bd40
+8077bd44 0x8077bd44
+8077bd50 0x8077bd50
+8077bd5c 0x8077bd5c
+8077bd68 0x8077bd68
+8077bd74 0x8077bd74
+8077bd80 0x8077bd80
+8077bf44 0x8077bf44
+8077bfbc 0x8077bfbc
+8077bfc0 0x8077bfc0
+8077bfc4 0x8077bfc4
+8077bfc8 0x8077bfc8
+8077c1d0 0x8077c1d0
+8077c220 0x8077c220
+8077c2ec 0x8077c2ec
+8077c2f0 0x8077c2f0
+8077c2f4 0x8077c2f4
+8077c344 0x8077c344
+8077c384 0x8077c384
+8077c500 0x8077c500
+8077c504 0x8077c504
+8077c57c 0x8077c57c
+8077c580 0x8077c580
+8077c5e0 0x8077c5e0
+8077c7ec 0x8077c7ec
+8077c7f0 0x8077c7f0
+8077c8f4 0x8077c8f4
+8077cb54 0x8077cb54
+8077cbb4 0x8077cbb4
+8077cc78 0x8077cc78
+8077cccc 0x8077cccc
+8077ccd4 0x8077ccd4
+8077ccdc 0x8077ccdc
+8077cce0 0x8077cce0
+8077cce4 0x8077cce4
+8077cce8 0x8077cce8
+8077ccec 0x8077ccec
+8077ccf0 0x8077ccf0
+8077ccf4 0x8077ccf4
+8077ccfc 0x8077ccfc
+8077cd4c 0x8077cd4c
+8077cdc4 0x8077cdc4
+8077cdc8 0x8077cdc8
+8077ce48 0x8077ce48
+8077ce88 0x8077ce88
+8077cec8 Objects::Sin_ItemBox::__ct
+8077cf04 Objects::Sin_ItemBox::__dt
+8077cf44 Objects::Sin_ItemBox::OnStart
+8077d024 Objects::Sin_ItemBox::Update
+8077d168 0x8077d168
+8077d274 Objects::Sin_ItemBox::GetPropertiesBitfield
+8077d27c obj_inseki::__ct
+8077d34c 0x8077d34c
+8077d38c 0x8077d38c
+8077d3d4 obj_inseki_update
+8077d4dc 0x8077d4dc
+8077d4e4 0x8077d4e4
+8077d548 0x8077d548
+8077d588 0x8077d588
+8077d644 0x8077d644
+8077d66c 0x8077d66c
+8077d7d0 0x8077d7d0
+8077d834 0x8077d834
+8077d940 0x8077d940
+8077d9b0 0x8077d9b0
+8077d9c4 0x8077d9c4
+8077d9c8 0x8077d9c8
+8077d9cc 0x8077d9cc
+8077d9d0 0x8077d9d0
+8077d9d8 Objects::Fall::__ct
+8077dd10 Objects::Fall::__dt
+8077dd50 Objects::Fall::OnStart
+8077dd54 Objects::Fall::Update
+8077de38 0x8077de38
+8077df1c Objects::Fall::GetPropertiesBitfield
+8077df24 Objects::W_Woodbox::__ct
+8077e0a4 Objects::SubObjectArray<W_Woodbox::Box>::__dt
+8077e11c Objects::SubObjectArray<W_Woodbox::Box>::vf_0x18
+8077e120 Objects::W_Woodbox::__dt
+8077e1a0 Objects::W_Woodbox::OnStart
+8077e1d8 0x8077e1d8
+8077e1e4 Objects::W_Woodbox::Update
+8077e2a8 0x8077e2a8
+8077e34c Objects::W_Woodbox::Box::__ct
+8077e388 Objects::W_Woodbox::Box::__dt
+8077e3e4 Objects::W_Woodbox::Box::OnStart
+8077e444 Objects::W_Woodbox::Box::RespawnImpl
+8077e49c Objects::W_Woodbox::Box::Update
+8077e56c 0x8077e56c
+8077e5e4 Objects::Woodbox::__ct
+8077e620 Objects::Woodbox::__dt
+8077e678 Objects::Woodbox::OnStart
+8077e6b8 Objects::Woodbox::LoadEffects
+8077e704 Objects::Woodbox::DropItem
+8077e750 Objects::Woodbox::Respawn
+8077e7b0 Objects::Woodbox::UpdateRespawn
+8077e7e0 Objects::Woodbox::UpdateRespawnImpl
+8077e928 Objects::Woodbox::OnNormalCollision
+8077e9c0 Objects::Woodbox::OnImperviousCollision
+8077ea6c Objects::Woodbox::OnNormalItemCollision
+8077eb08 Objects::Woodbox::OnImperviousItemCollision
+8077ebb8 Objects::Woodbox::UpdateCollision
+8077ecc8 Objects::W_Woodbox::UpdateModel
+8077eccc Objects::W_Woodbox::LoadClipInfo
+8077ecd0 Objects::W_Woodbox::LoadCollision
+8077ecd4 Objects::W_Woodbox::LoadAnimations
+8077ecd8 Objects::W_Woodbox::LoadModels
+8077ecdc Objects::W_Woodbox::GetPropertiesBitfield
+8077ece4 Objects::Woodbox::InitEntity
+8077ed70 Objects::Woodbox::GetBRRESName
+8077ed7c Objects::Woodbox::GetSubFileName
+8077eda4 Objects::W_Woodbox::Box::GetPropertiesBitfield
+8077edac Objects::Woodbox::GetPropertiesBitfield
+8077edb4 Objects::SubObjectArray<W_Woodbox::Box>::CreateArray
+8077ee04 Objects::SubObjectArray<W_Woodbox::Box>::CreateArray(Heap)
+8077ee7c Objects::SubObjectArray<W_Woodbox::Box>::vf_0x14
+8077ee80 MiiRenderMgr::Disposer__dt
+8077ef84 MiiRenderMgr::CreateInstance
+8077f010 MiiRenderMgr::DestroyInstance
+8077f0c8 MiiRenderMgr::__ct
+8077f128 0x8077f128
+8077f168 MiiRenderMgr::__dt
+8077f22c MiiRenderMgr::Init2
+8077f570 MiiRenderMgr::Init
+8077f6e4 MiiRenderMgr::CreateTextures
+8077f82c 0x8077f82c
+8077f8c8 MiiRenderMgr::SetPercentages
+8077f8d4 MiiRenderMgr::InitMenuModels
+8077fc3c 0x8077fc3c
+80780100 MiiRenderMgr::InitRaceModels
+807803bc 0x807803bc
+8078041c 0x8078041c
+807805d0 0x807805d0
+80780714 0x80780714
+80780aa0 0x80780aa0
+80780ab8 0x80780ab8
+80780be0 0x80780be0
+80780cb0 0x80780cb0
+80780d88 0x80780d88
+80780ed0 0x80780ed0
+80780f0c MiiRenderMgr::InitLights
+80781128 0x80781128
+80781290 MiiRenderMgr::AddMii
+80781474 MiiRenderMgr::CreateMiisAndRender
+80781584 MiiRenderMgr::CreateAndRenderFromMiis
+80781694 MiiRenderMgr::CreateAndDraw
+80781bc8 0x80781bc8
+80781f6c 0x80781f6c
+80782014 MiiRenderMgr::SetMiiForModel
+80782100 MiiRenderMgr::UpdateScreenFromTexture
+807822b8 0x807822b8
+8078235c MiiRenderMgr::RequestAddMii
+807823e4 MiiRenderMgr::ProcessTopAddRequest
+80782498 MiiRenderMgr::DeleteMii
+80782528 MiiRenderMgr::ProcessAllAddRequests
+807825dc 0x807825dc
+80782668 0x80782668
+80782804 MiiRenderMgr::CalcWorldCB::ExecCallbackB
+807828b0 MiiRenderMgr::CalcWorldCB::__dt
+807828f0 0x807828f0
+807829c8 MiiRenderMgr::CalcWorldCB::ExecCallbackB(thunk)
+807829d0 MiiRenderMgr::CalcWorldCB::__dt
+807829d8 0x807829d8
+807829e8 0x807829e8
+80782a28 0x80782a28
+80782a2c 0x80782a2c
+80782b08 0x80782b08
+80782c14 0x80782c14
+80782cd8 0x80782cd8
+80782d74 0x80782d74
+80782e50 0x80782e50
+80782f74 Object::GetRaceinfoRandom
+80782fa8 0x80782fa8
+80783050 0x80783050
+807830f8 0x807830f8
+80783150 0x80783150
+807831c4 0x807831c4
+80783254 0x80783254
+80783374 RaceEndTallies::Disposer__dt
+807834a0 RaceEndTallies::CreateInstance
+80783548 RaceEndTallies::DestroyInstance
+807835fc RaceEndTallies::__dt
+807836a0 RaceEndTallies::__ct
+8078371c RaceEndTallies::Init
+807838a4 RaceEndTallies::Init_switch
+807838a8 RaceEndTallies::Init_caseD_0
+807838b4 RaceEndTallies::Init_caseD_3
+807838bc RaceEndTallies::Init_caseD_4
+80783a08 RaceEndTallies::UpdateLicenseTallies
+80783d14 RaceEndTallies::Reset
+80783d58 RaceEndTallies::SetVSBattleBool
+80783db0 RaceEndTallies::SetTotalDistance
+80783dc8 RaceEndTallies::SetTotalDistanceVS
+80783e24 RaceEndTallies::SetCharacterAndKart
+80783ea8 RaceEndTallies::SetCourseId
+80783ee0 0x80783ee0
+80783eec 0x80783eec
+80783ef4 0x80783ef4
+80783ef8 RaceEndTallies::SetWheelBool
+80783fe0 RaceEndTallies::SetItemsTricksCounts
+80783ffc 0x80783ffc
+80784050 0x80784050
+807840a8 0x807840a8
+80784250 0x80784250
+80784360 0x80784360
+807845c8 0x807845c8
+80784640 0x80784640
+807846b8 0x807846b8
+807846bc 0x807846bc
+807846c0 0x807846c0
+807849bc 0x807849bc
+80784c58 0x80784c58
+80784f94 0x80784f94
+80785124 0x80785124
+807851bc 0x807851bc
+80785254 0x80785254
+807852d8 0x807852d8
+8078534c 0x8078534c
+8078539c 0x8078539c
+80785414 0x80785414
+80785418 0x80785418
+80785468 0x80785468
+807854e0 0x807854e0
+807854e4 EntityManager::__dt
+807855dc EntityManager::CreateInstance
+8078562c EntityManager::DestroyInstance
+807856e0 EntityManager::__ct
+807858d8 0x807858d8
+8078597c 0x8078597c
+807859b0 EntityManager::Update
+80785d8c EntityManager::GetNextKartPlayer
+80785df4 EntityManager::GetNextObj
+80785e5c EntityManager::GetNextObjectCollidable
+80785ec4 EntityManager::GetNextObjectKCL
+80785f2c EntityManager::UpdateIndexes
+80786050 EntityManager::InsertKartPlayer
+80786064 EntityManager::InsertItemEntity
+80786078 EntityManager::InsertObjectCollidable
+80786120 EntityManager::InsertObjectKCL
+80786134 EntityManager::InsertEntity
+80786578 EntityManager::RemoveEntity
+80786774 EntityManager::PrepareFromEntity
+807868c0 EntityManager::FindEntitiesCloseToEntity
+80786b14 EntityManager::PrepareFromSphere
+80786c60 EntityManager::FindEntitiesCloseToSphere
+80786dbc 0x80786dbc
+80786e60 EntityManager::IsPrepared
+80786ed0 Entity::__ct
+80786ef4 Entity::__dt
+80786f34 Entity::Init
+80786f6c Entity::MakeDynamic
+80786f7c Entity::Resize
+80786f98 AreaMasker_
+80786fa8 EntityManager::Prepare
+80786fc0 ClipInfoMgr::GetArea8And9GroupIDs
+8078707c ClipInfoMgr::UpdateScreenInfo
+807872c0 ClipInfoMgr::NormalizeVector
+80787340 ClipInfoMgr::Disposer__dt
+8078746c ClipInfoMgr::CreateInstance
+80787538 ClipInfoMgr::DestroyInstance
+807875ec ClipInfoMgr::__ct
+8078768c ClipScreenInfo::__ct
+80787690 ClipScreenInfo::__dt
+807876d0 ClipInfoMgr::__dt
+80787774 ClipInfoMgr::Update
+80787ab8 ClipInfoMgr::Insert
+80787b88 0x80787b88
+80787ba0 ClipInfoMgr::CalcAreaType8Refs
+80787bd8 ClipInfo::__ct
+80787be4 ClipInfo::__dt
+80787c24 ClipInfo::Init
+80787d04 0x80787d04
+80787d18 0x80787d18
+80787d50 0x80787d50
+80787d84 AwardsMgr::Disposer__dt
+80787eb0 AwardsMgr::CreateInstance
+80787fe0 AwardsMgr::DestroyInstance
+80788094 AwardsMgr::__ct
+80788198 AwardsMgr::__dt
+8078823c AwardsMgr::Init
+80789008 AwardsMgr::LoadStand
+80789340 AwardsMgr::LoadPlayers
+80789b94 0x80789b94
+80789fdc 0x80789fdc
+8078a1d4 0x8078a1d4
+8078a1d8 AwardsMgr::SetParams
+8078a298 0x8078a298
+8078a2bc 0x8078a2bc
+8078a728 0x8078a728
+8078a768 0x8078a768
+8078a904 0x8078a904
+8078aae0 0x8078aae0
+8078acb8 0x8078acb8
+8078ae84 0x8078ae84
+8078b2d4 0x8078b2d4
+8078b540 0x8078b540
+8078b5d0 IKParams::__ct
+8078b7ac IKParams::Load
+8078c3e0 0x8078c3e0
+8078c960 DriverMgr::Disposer__dt
+8078c9e8 DriverMgr::CreateInstance
+8078ca38 DriverMgr::DestroyInstance
+8078ca5c DriverMgr::__ct
+8078ce24 DriverMgr::__dt
+8078cf38 0x8078cf38
+8078cf4c DriverMgr::SetController
+8078cf5c 0x8078cf5c
+8078cfa4 0x8078cfa4
+8078d1a0 0x8078d1a0
+8078d378 0x8078d378
+8078d44c 0x8078d44c
+8078d4c0 0x8078d4c0
+8078d4cc 0x8078d4cc
+8078d614 0x8078d614
+8078d61c 0x8078d61c
+8078d784 0x8078d784
+8078d7e8 DriverMgr::InitAwards
+8078d824 DriverMgr::Update
+8078d980 0x8078d980
+8078d9e8 0x8078d9e8
+8078da90 0x8078da90
+8078db10 0x8078db10
+8078dc6c 0x8078dc6c
+8078ddb4 0x8078ddb4
+8078dde4 DriverMgr::ChangeFocusedPlayer
+8078ddf4 0x8078ddf4
+8078de04 MHModelDirector::__ct
+8078de60 MHModelDirector::SetMatsTEVColors
+8078dfe8 CourseMgr::CreateInstance
+8078e124 CourseMgr::DestroyInstance
+8078e1b0 CourseMgr::LoadModels
+8078e33c 0x8078e33c
+8078e454 0x8078e454
+8078e4e8 CourseMgr::SetSoftWallInfo
+8078e4f0 CourseMgr::UpdateKCL
+8078e588 0x8078e588
+8078e694 0x8078e694
+8078e7c4 0x8078e7c4
+8078e8ec 0x8078e8ec
+8078e8f0 0x8078e8f0
+8078ea98 0x8078ea98
+8078eb00 0x8078eb00
+8078eca8 0x8078eca8
+8078eef4 0x8078eef4
+8078f140 CourseMgr::IsCollidingNoTerrainInfoNoTriangleCheck
+8078f320 CourseMgr::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+8078f500 CourseMgr::IsColliding
+8078f784 CourseMgr::IsCollidingAddEntryNoTriangleCheck
+8078fa08 0x8078fa08
+8078fbb0 0x8078fbb0
+8078fd58 0x8078fd58
+8078ffa4 0x8078ffa4
+807901f0 CourseMgr::IsCollidingNoTerrainInfo
+807903bc CourseMgr::IsCollidingAddEntryNoTerrainInfo
+80790588 0x80790588
+807907f8 CourseMgr::IsCollidingAddEntry
+80790a68 0x80790a68
+80790ac0 _sinit_CourseMgr_cpp
+80790ad0 MHModelDirector::__dt(thunk)
+80790ad8 Item::LoadObjProperties
+80790afc Item::InitAllObjProperties
+80790e1c Item::IsTT
+80790e28 Item::IsAwards
+80790e30 Item::GetDriverMgr
+80790e3c Item::GetKMPObjectsCount
+80790e60 Item::GetGOBJHolder
+80790e6c Item::GetKMPObjectId
+80790e7c Item::ObjProperties::__ct(Copy)
+80790fb8 Item::ObjProperties::ComputeCapacities
+8079126c 0x8079126c
+807912e0 0x807912e0
+80791358 0x80791358
+807913d0 0x807913d0
+80791448 0x80791448
+807914c0 0x807914c0
+80791534 0x80791534
+807915a8 0x807915a8
+80791644 0x80791644
+80791760 Item::PlayerObj::__ct
+80791800 0x80791800
+80791840 Item::PlayerObj::Init
+80791910 Item::PlayerObj::UseItem
+80791c08 0x80791c08
+80791cc8 0x80791cc8
+80791de8 0x80791de8
+80791df8 0x80791df8
+80791e5c Item::PlayerObj::UpdateParams
+80792140 0x80792140
+807921f0 0x807921f0
+8079231c Item::PlayerObj::UpdateTetheredItems
+80792520 0x80792520
+80792618 0x80792618
+80792b08 Item::PlayerObj::TrailPrepare
+80792c68 Item::PlayerObj::TrailUpdate
+80792fc8 0x80792fc8
+80793030 0x80793030
+80793164 0x80793164
+807931dc Item::PlayerObj::TripleTrailPrepare
+8079356c Item::PlayerObj::TripleTrailUpdate
+80793f04 0x80793f04
+80793f74 0x80793f74
+807941f0 Item::PlayerObj::SpinCalc
+8079455c Item::PlayerObj::SpinPrepare
+80794694 Item::PlayerObj::SpinUpdate
+80794a64 0x80794a64
+80794ab0 0x80794ab0
+80794b78 0x80794b78
+80794bac 0x80794bac
+80794c44 0x80794c44
+80794d1c 0x80794d1c
+80794e88 Item::PlayerObj::CalcInitialObjSpeedAndDir
+80795030 0x80795030
+807951ac 0x807951ac
+807952dc 0x807952dc
+80795350 Item::PlayerObj::LoseItem
+807954d8 0x807954d8
+807955c4 Item::PlayerObj::ComputeWheelPosRelativeToKart
+8079565c 0x8079565c
+80795668 Item::PlayerObj::UpdateRemote
+80795848 0x80795848
+80795b60 0x80795b60
+80795c40 0x80795c40
+80795ca0 0x80795ca0
+80795cc8 Item::ObjHolder::__ct
+80795ccc Item::ObjHolder::Init
+80795d94 Item::ObjHolder::HideAll
+80795e04 Item::ObjHolder::Spawn
+80795f28 0x80795f28
+80795f68 Item::ObjHolder::OnObjKillFinish
+807961f0 0x807961f0
+80796348 Item::ObjHolder::SortObjs
+80796470 Item::ObjHolder::Update
+8079698c 0x8079698c
+807969a8 0x807969a8
+80796a48 0x80796a48
+80796b30 Item::ObjHolder::UpdateModelPositions
+80796bbc Item::ObjHolder::OnFinishThrow
+80796c38 0x80796c38
+80796ca0 Item::ObjHolder::ProcessRecvEVENT
+80796f70 Item::ObjHolder::ProcessRecvShootEVENT
+80797140 Item::ObjHolder::ProcessRecvHitFreeEVENT
+807972b8 0x807972b8
+80797424 0x80797424
+807974ac Item::ObjHolder::GetTotalItemCount
+80797524 0x80797524
+8079754c Item::Player::__ct
+8079759c 0x8079759c
+807975dc 0x807975dc
+8079761c 0x8079761c
+8079765c Item::PlayerObj::__dt
+807976e0 Item::Player::Init
+80797890 0x80797890
+80797928 Item::Player::Update
+807981e4 0x807981e4
+8079820c 0x8079820c
+8079824c 0x8079824c
+80798290 0x80798290
+807984dc 0x807984dc
+80798584 0x80798584
+8079864c Item::Player::ActivateMushroom
+80798684 Item::Player::ActivateStar
+807986b4 Item::Player::ActivateMega
+807986e4 Item::Player::ActivateBullet
+8079870c 0x8079870c
+80798710 0x80798710
+80798728 0x80798728
+807987ec 0x807987ec
+80798848 0x80798848
+807988f0 0x807988f0
+80798928 Item::Player::OnObjTetherEnd
+8079898c 0x8079898c
+80798a0c 0x80798a0c
+80798a30 Item::Player::LoseItemFromDmg
+80798b28 Item::Player::LoseTetheredItem
+80798b8c 0x80798b8c
+80798c38 Item::Player::DecideItem
+80798d04 0x80798d04
+80798d0c 0x80798d0c
+80798db4 0x80798db4
+80798dbc Item::Player::HasTripleItem
+80798e40 0x80798e40
+80798f0c Item::Player::GetHeldCount
+80798f84 0x80798f84
+80798f90 0x80798f90
+80798f9c Item::Manager::Disposer__dt
+80799138 Item::Manager::CreateInstance
+80799188 Item::Manager::DestroyInstance
+807992d8 Item::Manager::__ct
+807994dc Item::ObjHolder::__dt
+8079951c Item::Player::__dt
+807995b0 0x807995b0
+807995f0 0x807995f0
+80799630 0x80799630
+80799670 Item::Manager::__dt
+80799794 Item::Manager::Init
+80799850 Item::Manager::Update
+807999a0 Item::Manager::UpdateAllObjModelPos
+807999f8 Item::Manager::UpdateObjHolders
+80799a50 Item::Manager::UpdateTotalItemCountMinus30
+80799acc Item::Manager::UpdatePlayers
+80799b2c 0x80799b2c
+80799be8 Item::Manager::IsThereCapacityForItem
+80799c70 0x80799c70
+80799cac Item::Manager::CheckKartCollision
+80799e50 ItemManager::InitItemDirect
+80799fbc Item::Manager::CreateItemDirect
+8079a12c Item::Manager::GenerateItemDirect
+8079a298 Item::Manager::SpawnCloudForLocal
+8079a3b8 Item::Manager::SpawnCloudForRemote
+8079a498 0x8079a498
+8079a578 0x8079a578
+8079a5f4 Item::Manager::DoSomethingWithFIBObjTevColors
+8079a654 0x8079a654
+8079a65c Item::Manager::GetHeldCount
+8079a6d0 0x8079a6d0
+8079a778 Item::EVENTBuffer::Disposer__dt
+8079a8a4 Item::EVENTBuffer::CreateInstance
+8079ab68 Item::EVENTBuffer::DestroyInstance
+8079ac1c 0x8079ac1c
+8079aca4 0x8079aca4
+8079acc0 0x8079acc0
+8079ad30 Item::EVENTBuffer::GetPlayerIdFromBitfield
+8079ad38 Item::EVENTBuffer::FillOrExtractShootPos
+8079af08 Item::EVENTBuffer::FillOrExtractPosDiff
+8079b078 0x8079b078
+8079b30c 0x8079b30c
+8079b338 Item::EVENTBuffer::FillOrExtractBitfield
+8079b398 Item::EVENTBuffer::FillOrExtractTargetingShoot
+8079b440 Item::EVENTBuffer::FillOrExtractBombShoot
+8079b4ac Item::EVENTBuffer::FillOrExtractShoot
+8079bd94 Item::EVENTBuffer::UpdateSend
+8079bed0 Item::EVENTBuffer::UpdateReceive
+8079bfec Item::EVENTBuffer::QueueSendEntry
+8079c0ac Item::EVENTBuffer::QueueReceivedEntry
+8079c174 0x8079c174
+8079c220 Item::Obj::AddUseEVENTEntry
+8079c2e4 Item::Obj::AddShootEVENTEntry
+8079c3c4 Item::Obj::AddHitFreeEVENTEntry
+8079c498 Item::Obj::AddHitDraggedEVENTEntry
+8079c554 Item::Obj::AddTCLostPassEVENTEntry
+8079c620 Item::Obj::AddAction6EVENTEntry
+8079c6e4 Item::Obj::AddTCLostEndEVENTEntry
+8079c7c4 Item::Obj::AddDropEVENTEntry
+8079c880 Item::Obj::GetHitFreeEntryPlayerIdAndType
+8079c898 0x8079c898
+8079c8a0 0x8079c8a0
+8079c8c8 Item::EVENTBuffer::GetEntryBitfield
+8079c8e4 Item::EVENTBuffer::GetUSEPlayerId
+8079c8ec 0x8079c8ec
+8079c930 0x8079c930
+8079c960 Item::Obj::SendOrExtractHitDraggedEVENT
+8079d2e0 thunk_0x8079dee4
+8079d3dc Item::EVENTBuffer::__ct
+8079d674 Item::EVENTBuffer::__dt
+8079d718 0x8079d718
+8079d720 0x8079d720
+8079d744 0x8079d744
+8079d74c 0x8079d74c
+8079d754 0x8079d754
+8079d75c 0x8079d75c
+8079d764 0x8079d764
+8079d76c GetEVENTEntryDataLength
+8079d804 Item::Obj::InitSelf
+8079d84c Item::Obj::CalcWorld::ExecCallbackB
+8079d8bc Item::Obj::__ct
+8079d920 0x8079d920
+8079d9fc Item::Obj::SpawnModel
+8079da9c Item::Obj::PrepareLight
+8079dc44 0x8079dc44
+8079dc60 0x8079dc60
+8079dcb4 Item::Obj::SetInitialPosition
+8079dcbc Item::Obj::OnKill
+8079dd6c Item::Obj::OnTetherBreak
+8079dd70 Item::Obj::OnFinishKill
+8079de34 Item::Obj::ProcessRecvShootEVENT
+8079dee4 Item::Obj::vf_0x30
+8079e1f0 Item::Obj::vf_0x34
+8079e224 Item::Obj::Init
+8079e300 Item::Obj::RemoveFromScn
+8079e38c 0x8079e38c
+8079e550 Item::Obj::Spawn
+8079e5f4 Item::Obj::Set
+8079e884 Item::Obj::FinishKill
+8079e8f4 0x8079e8f4
+8079e9e8 0x8079e9e8
+8079ea58 0x8079ea58
+8079ebbc 0x8079ebbc
+8079ec44 0x8079ec44
+8079ec98 0x8079ec98
+8079ed1c 0x8079ed1c
+8079ed4c 0x8079ed4c
+8079edb4 0x8079edb4
+8079ee30 Item::Obj::RegisterEntity
+8079eecc Item::Obj::UnregisterEntity
+8079eee0 0x8079eee0
+8079efec Item::Obj::Update
+8079f8b4 0x8079f8b4
+8079f8f4 0x8079f8f4
+8079f934 0x8079f934
+8079fc50 0x8079fc50
+8079fd84 0x8079fd84
+8079fe30 Item::Obj::TryDisappearDueToExcess
+8079feac 0x8079feac
+8079feb4 Item::Obj::CanDisappearFromDuration
+8079ff14 0x8079ff14
+8079ff5c Item::Obj::LoadGraphicsImplicitBRRESNoFunc
+8079ffa4 Item::Obj::LoadGraphicsDefault
+8079ffdc Item::Obj::LoadGraphicsImplicitBRRES
+807a0040 Item::Obj::LoadGraphics
+807a0380 Item::Obj::LoadItemLight
+807a05d0 Item::Obj::UpdateModelPosition
+807a05f4 Item::Obj::UpdateModelPositionNoClip
+807a07b8 Item::Obj::UpdateModelFromVecs
+807a0a68 Item::Obj::UpdateShadow
+807a0cd4 Item::Obj::UpdateModelFromQuat
+807a0e28 Item::Obj::OnObjCollision
+807a1074 0x807a1074
+807a125c 0x807a125c
+807a139c 0x807a139c
+807a14d4 Item::Obj::CheckKartCollision
+807a1680 0x807a1680
+807a1864 0x807a1864
+807a18ec Item::XZVecMag
+807a18fc Item::Obj::ProcessOtherCollision
+807a1c94 Item::Obj::CheckOtherObjsCollision
+807a1ed8 0x807a1ed8
+807a2234 0x807a2234
+807a2250 0x807a2250
+807a2270 0x807a2270
+807a234c 0x807a234c
+807a24f8 0x807a24f8
+807a2570 0x807a2570
+807a25b0 Item::Obj::UpdateWithClipping
+807a2aa8 0x807a2aa8
+807a2de8 0x807a2de8
+807a2e68 0x807a2e68
+807a2edc 0x807a2edc
+807a2f00 0x807a2f00
+807a2f18 0x807a2f18
+807a2f38 0x807a2f38
+807a2f58 0x807a2f58
+807a2f78 0x807a2f78
+807a2f7c 0x807a2f7c
+807a2f88 0x807a2f88
+807a2fbc 0x807a2fbc
+807a30c4 0x807a30c4
+807a3100 0x807a3100
+807a313c 0x807a313c
+807a3178 0x807a3178
+807a31c0 Item::Obj::PrepareShootEventPacket
+807a3370 Item::Obj::SendOrExtractShootEVENT
+807a33e0 0x807a33e0
+807a3474 0x807a3474
+807a34cc 0x807a34cc
+807a3544 0x807a3544
+807a35b0 0x807a35b0
+807a3618 0x807a3618
+807a3648 0x807a3648
+807a377c 0x807a377c
+807a3790 Item::Obj::OnPlayerCollision
+807a3870 0x807a3870
+807a38e0 0x807a38e0
+807a38e4 Item::Obj::KillThunk
+807a38e8 0x807a38e8
+807a38ec 0x807a38ec
+807a38f0 Item::ObjKouraGreen::UpdateThunk
+807a38f4 Item::ObjKouraRed::UpdateThunk
+807a38f8 Item::ObjKouraTogezo::UpdateThunk
+807a38fc Item::ObjBanana::UpdateThunk
+807a3900 Item::ObjBomb::UpdateThunk
+807a3904 Item::ObjFIB::UpdateThunk
+807a3908 Item::ObjKumo::UpdateThunk
+807a390c 0x807a390c
+807a3910 0x807a3910
+807a3914 0x807a3914
+807a3918 0x807a3918
+807a391c 0x807a391c
+807a3920 0x807a3920
+807a3924 0x807a3924
+807a3928 0x807a3928
+807a392c 0x807a392c
+807a3930 0x807a3930
+807a3934 0x807a3934
+807a3938 0x807a3938
+807a393c 0x807a393c
+807a3940 0x807a3940
+807a3944 0x807a3944
+807a3948 0x807a3948
+807a394c 0x807a394c
+807a3950 0x807a3950
+807a3954 0x807a3954
+807a397c 0x807a397c
+807a3984 0x807a3984
+807a3988 0x807a3988
+807a398c 0x807a398c
+807a3994 0x807a3994
+807a39d4 Item::Obj::CalcWorldCB::__dt
+807a3a14 Item::Obj::CalcWorldCB::ExecCallbackB(thunk)
+807a3a1c Item::Obj::CalcWorldCB::__dt(thunk)
+807a3a24 Item::ObjBanana::CreateArray
+807a3aa0 0x807a3aa0
+807a3ae0 0x807a3ae0
+807a3b20 0x807a3b20
+807a3b60 0x807a3b60
+807a3ba0 0x807a3ba0
+807a3be0 Item::ObjBanana::SetInitialPosition
+807a3c80 0x807a3c80
+807a3e78 Item::ObjBanana::Update
+807a400c Item::ObjBanana::vf_0x30
+807a4070 Item::ObjBanana::InitSelf
+807a40f0 Item::ObjBanana::SpawnModel
+807a40f4 Item::ObjBanana::OnKill
+807a41c4 Item::ObjBomb::CreateArray
+807a4384 0x807a4384
+807a43fc 0x807a43fc
+807a4554 0x807a4554
+807a45e0 0x807a45e0
+807a4734 0x807a4734
+807a4850 Item::ObjBomb::__ct
+807a49b4 Item::ObjExplosion::__dt
+807a4a18 Item::ObjBomb::SetInitialPosition
+807a4b48 0x807a4b48
+807a4cdc Item::ObjBomb::Update
+807a4fa0 Item::ObjBomb::SendOrExtractShootEVENT
+807a500c Item::ObjBomb::vf_0x30
+807a5090 Item::ObjBomb::vf_0x34
+807a5144 Item::ObjBomb::InitSelf
+807a5340 Item::ObjBomb::UpdateModelPosition
+807a59e0 Item::ObjBomb::UpdateModelPositionNoClip
+807a5a20 0x807a5a20
+807a5ad0 0x807a5ad0
+807a5b80 Item::ObjBomb::ToggleVisible
+807a5bc4 Item::ObjBomb::SpawnModel
+807a5cfc Item::ObjBomb::PrepareLight
+807a5d48 0x807a5d48
+807a5d88 0x807a5d88
+807a5ea4 0x807a5ea4
+807a5f6c Item::ObjBomb::OnKill
+807a60f8 Item::ObjBomb::OnTetherBreak
+807a619c Item::ObjBomb::OnFinishKill
+807a61f8 0x807a61f8
+807a6248 0x807a6248
+807a626c Item::ObjBomb::__dt
+807a62d8 __sinit_ItemObjBomb_cpp
+807a6320 Item::ObjBomb::__dt(thunk)
+807a6328 Item::Obj::KillObj
+807a64f0 0x807a64f0
+807a6560 Item::Obj::KillFromOtherCollision
+807a6614 Item::Obj::KillFromPlayerCollision
+807a6700 Item::Obj::UpdateKill
+807a6738 0x807a6738
+807a6928 Item::ObjMiddle::__ct
+807a6978 0x807a6978
+807a69f8 0x807a69f8
+807a6c14 Item::Obj::DisappearDueToExcess
+807a6c90 0x807a6c90
+807a6d88 0x807a6d88
+807a6ec8 0x807a6ec8
+807a6f64 0x807a6f64
+807a6f6c 0x807a6f6c
+807a6f74 0x807a6f74
+807a71e4 0x807a71e4
+807a72ac 0x807a72ac
+807a7350 0x807a7350
+807a784c 0x807a784c
+807a78a8 Item::ObjFIB::CreateArray
+807a7940 Item::ObjFIB::SetInitialPosition
+807a79e0 Item::ObjFIB::Update
+807a7a5c Item::ObjFIB::vf_0x30
+807a7ac0 Item::ObjFIB::InitSelf
+807a7d60 0x807a7d60
+807a7d90 0x807a7d90
+807a7f1c Item::ObjFIB::SpawnModel
+807a7fec Item::ObjFIB::UpdateModelPosition
+807a8134 Item::ObjFIB::OnKill
+807a8138 Item::ObjGesso::CreateArray
+807a81b4 Item::Player::UseBlooper
+807a8378 Item::ObjGesso::InitSelf
+807a8394 0x807a8394
+807a8410 0x807a8410
+807a8460 Item::GessoScreen::__ct
+807a85f4 Item::GessoScreen::__dt
+807a8634 0x807a8634
+807a86f8 0x807a86f8
+807a8750 Item::GessoScreen::UpdateModel
+807a8aa0 0x807a8aa0
+807a8bd0 0x807a8bd0
+807a8c0c 0x807a8c0c
+807a8c90 0x807a8c90
+807a8d78 0x807a8d78
+807a8f04 Item::GessoMgr::CreateInstance
+807a8fa0 Item::GessoMgr::DestroyInstance
+807a8fd8 Item::GessoMgr::Init
+807a90a0 Item::GessoMgr::__ct
+807a9128 Item::GessoMgr::DeployBlooper
+807a92b0 Item::GessoMgr::Update
+807a972c Item::GessoMgr::ApplyBlooper
+807a9a58 __sinit_ItemObjGesso_cpp
+807a9a80 Item::ObjKiller::CreateArray
+807a9afc Item::Player::UseBullet
+807a9b40 Item::ObjKiller::InitSelf
+807a9b5c Item::ObjKiller::UpdateModelPosition
+807a9c98 __sinit_ItemObjKiller_cpp
+807a9cc0 Item::ObjKinoko::CreateArray
+807a9d3c Item::Player::UseMushroom
+807a9d90 Item::ObjKinoko::InitSelf
+807a9dac __sinit_ItemObjKinoko_cpp
+807a9dd4 Item::ObjKinokoBig::CreateArray
+807a9e50 Item::Player::UseMegaMushroom
+807a9ea4 Item::ObjKinokoBig::InitSelf
+807a9ec0 __sinit_ItemObjKinokoBig_cpp
+807a9ee8 Item::ObjKinokoPowerful::CreateArray
+807a9f64 Item::Player::UseGoldenMushroom
+807a9fac Item::ObjKinokoPowerful::InitSelf
+807a9fc8 __sinit_ItemObjKinokoPowerful_cpp
+807a9ff0 Item::ObjKouraRed::CreateArray
+807aa1b8 Item::ObjKouraRed::__ct
+807aa358 0x807aa358
+807aa398 0x807aa398
+807aa41c 0x807aa41c
+807aa4b0 0x807aa4b0
+807aa548 0x807aa548
+807aa5ac 0x807aa5ac
+807aa608 0x807aa608
+807aa688 Item::ObjKouraRed::SetInitialPosition
+807aa87c Item::ObjKouraRed::Update
+807aaa5c Item::ObjKouraRed::UpdateModelPosition
+807aaafc Item::ObjKouraRed::UpdateModelPositionNoClip
+807aab88 0x807aab88
+807aabc8 0x807aabc8
+807aac80 0x807aac80
+807aaccc 0x807aaccc
+807aad78 0x807aad78
+807aae58 0x807aae58
+807aae78 0x807aae78
+807ab004 0x807ab004
+807ab024 0x807ab024
+807ab180 0x807ab180
+807ab238 0x807ab238
+807ab37c 0x807ab37c
+807ab388 0x807ab388
+807ab38c Item::ObjKouraRed::InitSelf
+807ab40c Item::ObjKouraRed::SendOrExtractShootEVENT
+807ab508 Item::ObjKouraRed::vf_0x30
+807ab654 0x807ab654
+807ab788 Item::ObjKouraRed::OnKill
+807ab810 Item::ObjKouraRed::OnFinishKill
+807ab854 Item::ObjKouraRed::SpawnModel
+807ab894 Item::ObjKouraRed::GetTargetedPlayerId
+807ab8b0 0x807ab8b0
+807ab96c __sinit_ItemObjKouraRed_cpp
+807ab9d8 0x807ab9d8
+807ab9e0 Item::ObjKouraTogezo::CreateArray
+807abc14 Item::ObjKouraTogezo::__ct
+807abde8 0x807abde8
+807abe80 0x807abe80
+807abee4 0x807abee4
+807abef0 0x807abef0
+807abf2c Item::ObjKouraTogezo::ToggleVisible
+807abf70 Item::ObjKouraTogezo::SpawnModel
+807ac008 Item::ObjKouraTogezo::InitSelf
+807ac1a8 Item::ObjKouraTogezo::CalcTargetedPlayerId
+807ac49c Item::ObjKouraTogezo::Reset
+807ac5b4 0x807ac5b4
+807ac5f4 0x807ac5f4
+807ac634 Item::ObjKouraTogezo::SetInitialPosition
+807ac7d4 Item::ObjKouraTogezo::UpdateModelPosition
+807ac9ec Item::ObjKouraTogezo::UpdateModelPositionNoClip
+807acb24 0x807acb24
+807ace1c 0x807ace1c
+807ad118 Item::ObjKouraTogezo::Update
+807ad5a4 0x807ad5a4
+807ad5ec Item::ObjKouraTogezo::UpdateRouteFlying
+807ad7e4 Item::ObjKouraTogezo::807ad7e4
+807ad824 Item::ObjKouraTogezo::UpdateHomeIn
+807ad914 0x807ad914
+807ad958 Item::ObjKouraTogezo::UpdateDiveIn
+807adb54 0x807adb54
+807adc08 0x807adc08
+807adc5c Item::ObjKouraTogezo::UpdateHover
+807adeac 0x807adeac
+807adf14 0x807adf14
+807adfa4 0x807adfa4
+807ae180 Item::ObjKouraTogezo::807ae180_
+807ae34c Item::ObjKouraTogezo::UpdateExplosion
+807ae414 Item::ObjKouraTogezo::OnKill
+807ae574 Item::ObjKouraTogezo::OnFinishKill
+807ae5d0 Item::ObjKouraTogezo::SendOrExtractShootEVENT
+807ae6ec Item::ObjKouraTogezo::vf_0x30
+807ae8a8 0x807ae8a8
+807ae8b0 Item::ObjKouraTogezo::GetTargetedPlayerId
+807ae8e8 0x807ae8e8
+807ae9bc Item::ObjKouraGreen::__dt
+807aea78 __sinit_ItemObjKouraTogezo_cpp
+807aeae4 Item::ObjKouraGreen::__dt(thunk)
+807aeaec Item::ObjKouraGreen::CreateArray
+807aeb68 get_1
+807aeb74 0x807aeb74
+807aeb80 0x807aeb80
+807aeb8c 0x807aeb8c
+807aeb98 Item::ObjKouraGreen::SetInitialPosition
+807aec64 Item::ObjKouraGreen::Update
+807aed2c Item::ObjKouraGreen::UpdateModelPosition
+807aedcc Item::ObjKouraGreen::UpdateModelPositionNoClip
+807aee58 Item::ObjKouraGreen::SendOrExtractShootEVENT
+807aef38 Item::ObjKouraGreen::vf_0x30
+807aefb4 Item::ObjKouraGreen::InitSelf
+807af034 Item::ObjKouraGreen::OnKill
+807af0bc Item::ObjKouraGreen::OnFinishKill
+807af100 Item::ObjKouraGreen::SpawnModel
+807af140 Item::ObjKumo::CreateArray
+807af1bc Item::Player::UseTC
+807af200 Item::ObjKumo::SpawnModel
+807af234 0x807af234
+807af39c Item::ObjKumo::UpdateModelPosition
+807af534 Item::ObjKumo::InitSelf
+807af5a0 0x807af5a0
+807af76c Item::ObjKumo::Update
+807b07c0 0x807b07c0
+807b08f4 0x807b08f4
+807b0960 Item::ObjKumo::OnFinishKill
+807b09f0 0x807b09f0
+807b0b4c 0x807b0b4c
+807b0f68 0x807b0f68
+807b1108 0x807b1108
+807b120c 0x807b120c
+807b1218 0x807b1218
+807b1220 0x807b1220
+807b123c Item::ObjKumo::OnKill
+807b1304 0x807b1304
+807b1640 0x807b1640
+807b189c 0x807b189c
+807b1950 0x807b1950
+807b1a24 0x807b1a24
+807b1a44 0x807b1a44
+807b1a6c 0x807b1a6c
+807b1a94 0x807b1a94
+807b1ab0 Item::ObjPow::CreateArray
+807b1b2c Item::Player::UsePow
+807b1ba4 Item::ObjPow::InitSelf
+807b1bc0 Item::PowMgr::CreateInstance
+807b1c6c 0x807b1c6c
+807b1c70 Item::PowMgr::DestroyInstance
+807b1ca8 Item::PowMgr::Init
+807b1d18 Item::PowMgr::__ct
+807b1db0 0x807b1db0
+807b1db4 Item::PowMgr::DeployPow
+807b1eec Item::PowMgr::AnimateModel
+807b20bc Item::PowMgr::CreateShockwave
+807b22f8 Item::PowMgr::Update
+807b2474 0x807b2474
+807b24f0 0x807b24f0
+807b2540 Item::PowScreen::__ct
+807b27fc 0x807b27fc
+807b2868 0x807b2868
+807b2884 0x807b2884
+807b2924 0x807b2924
+807b2980 0x807b2980
+807b29dc Item::PowScreen::UpdateModel
+807b2c14 0x807b2c14
+807b2d64 0x807b2d64
+807b2e90 Item::PowMgr::IsPowActive
+807b2eac Item::PowMgr::GetFramesUntilPOWSmash
+807b2ec0 Item::PowMgr::GetPowUserPlayerId
+807b2ed0 __sinit_ItemObjPow_cpp
+807b2ef8 0x807b2ef8
+807b2f14 0x807b2f14
+807b2f54 0x807b2f54
+807b381c 0x807b381c
+807b3bac 0x807b3bac
+807b3c8c 0x807b3c8c
+807b3db0 0x807b3db0
+807b3ec0 0x807b3ec0
+807b3eec Item::ObjKouraTogezoBase::ResetTargeting
+807b3efc Item::ObjKouraTogezoBase::SpawnModel
+807b3f3c 0x807b3f3c
+807b3fdc 0x807b3fdc
+807b43dc 0x807b43dc
+807b4400 0x807b4400
+807b4430 0x807b4430
+807b45b0 Item::ObjKouraTogezo::AcquireTarget
+807b4810 0x807b4810
+807b4878 0x807b4878
+807b4944 0x807b4944
+807b4ae4 0x807b4ae4
+807b4d2c 0x807b4d2c
+807b5068 0x807b5068
+807b50f4 0x807b50f4
+807b5178 0x807b5178
+807b532c 0x807b532c
+807b53f4 0x807b53f4
+807b5484 0x807b5484
+807b54f4 0x807b54f4
+807b60a0 0x807b60a0
+807b6148 0x807b6148
+807b61cc 0x807b61cc
+807b62b8 0x807b62b8
+807b64f8 0x807b64f8
+807b660c 0x807b660c
+807b66f0 0x807b66f0
+807b681c 0x807b681c
+807b6910 Item::ObjThrowable::OnFinishThrow
+807b6b98 0x807b6b98
+807b6bfc KouraGreen_07b6bfc_
+807b6f54 0x807b6f54
+807b6ff0 Item::ObjStar::CreateArray
+807b706c Item::Player::UseStar
+807b70c0 Item::ObjStar::InitSelf
+807b70dc __sinit_ItemObjStar_cpp
+807b7104 Item::ObjThrowable::SetInitialPositionImpl
+807b74d4 0x807b74d4
+807b7570 0x807b7570
+807b7a48 0x807b7a48
+807b7aa4 0x807b7aa4
+807b7b00 Item::ObjThunder::CreateArray
+807b7b7c Item::Player::UseThunder
+807b7c04 Item::ObjThunder::InitSelf
+807b7c20 Item::ObjThunder::ApplyToPlayers
+807b7d74 __sinit_ItemObjThunder_cpp
+807b7d9c 0x807b7d9c
+807b7e58 0x807b7e58
+807b7e6c 0x807b7e6c
+807b7f5c 0x807b7f5c
+807b8010 0x807b8010
+807b80e0 0x807b80e0
+807b854c 0x807b854c
+807b860c ItemPathManager_createInstance
+807b897c 0x807b897c
+807b89e4 0x807b89e4
+807b8a9c Player_UpdateItemPoint
+807b8f30 Item::Point_update2
+807b90f4 0x807b90f4
+807b91e4 0x807b91e4
+807b99d4 0x807b99d4
+807b9a38 0x807b9a38
+807b9b24 0x807b9b24
+807b9c10 0x807b9c10
+807b9c70 0x807b9c70
+807b9dd4 Item::GetQuatFromMat
+807b9e50 0x807b9e50
+807b9ec4 0x807b9ec4
+807b9f48 Item::PlayerRoulette::__ct
+807b9f54 0x807b9f54
+807b9f80 Item::PlayerRoulette::Init
+807b9fb0 Item::PlayerRoulette::DecideItem
+807ba230 0x807ba230
+807ba2d8 Item::PlayerRoulette::OnRouletteEnd
+807ba350 0x807ba350
+807ba37c Item::PlayerRoulette::Update
+807ba56c 0x807ba56c
+807ba5bc 0x807ba5bc
+807ba5d0 0x807ba5d0
+807ba5d8 0x807ba5d8
+807ba650 Item::SlotData::Disposer__dt
+807ba77c Item::SlotData::CreateInstance
+807ba814 Item::SlotData::DestroyInstance
+807ba8c8 Item::SlotData::__ct
+807ba934 Item::SlotData::__dt
+807ba9d8 Item::SlotData::ProcessTable
+807bad08 Item::SlotData::GetNextTable
+807bad20 Item::SlotData::PostProcessVSTable
+807bae80 0x807bae80
+807baed4 Item::SlotData::RandomizeRouletteItem
+807baf48 Item::SlotData::Init
+807bb374 Item::SlotData::RouletteItems::__ct
+807bb380 Item::ItemSlotData::CanItemNotBeObtained
+807bb42c Item::SlotData::DecideItem
+807bb8d0 Item::SlotData::DecideRouletteItem
+807bb9bc Item::SlotData::ResetShockTimer
+807bb9c8 Item::SlotData::ResetBlueShellTimer
+807bb9d4 Item::SlotData::ResetBlooperTimer
+807bb9e0 Item::SlotData::ResetPowTimer
+807bb9ec Item::SlotData::UpdateTimers
+807bba94 Item::SlotData::GetBinary
+807bbb00 Item::SlotData::SetupBattleModeProbabilities
+807bbd60 Item::SlotData::SetupOnlineVSProbabilities
+807bbe98 0x807bbe98
+807bbef8 Item::SlotData::SetupVSProbabilities
+807bc000 Item::SlotData::SetupGPProbabilities
+807bc0f8 Item::PlayerInventory::__ct
+807bc0fc 0x807bc0fc
+807bc130 Item::PlayerInventory::Init
+807bc170 0x807bc170
+807bc2b8 0x807bc2b8
+807bc350 Item::PlayerInventory::EjectItems
+807bc610 Item::PlayerInventory::LoseItemFromDmg
+807bc6e8 Item::PlayerInventory::Update
+807bc830 0x807bc830
+807bc908 0x807bc908
+807bc940 Item::PlayerInventory::SetItem
+807bc97c Item::PlayerInventory::RemoveItems
+807bc9c0 Item::PlayerInventory::ClearAll
+807bc9f4 0x807bc9f4
+807bcab0 0x807bcab0
+807bcad0 0x807bcad0
+807bcae0 Item::InitAllBehavior
+807bd1d0 DriverMgr::SetParams
+807bd210 DriverMgr::SetParams_switch
+807bd214 DriverMgr::SetParams_caseD_2
+807bd230 DriverMgr::SetParams_caseD_3
+807bd24c DriverMgr::SetParams_caseD_7
+807bd268 DriverMgr::SetParams_caseD_9
+807bd284 DriverMgr::SetParams_caseD_0
+807bd29c DriverMgr::SetParams_caseD_1
+807bd340 SomeTimers_update
+807bd374 0x807bd374
+807bd5bc DriverMgr::IsPlayerComputer
+807bd6e4 0x807bd6e4
+807bd718 DriverMgr::GetRaceinfoRandom
+807bd768 0x807bd768
+807bd78c 0x807bd78c
+807bd7b4 CollisionInfo::ObjInfo::Init
+807bd7d8 CollisionInfo::ObjInfo::Set
+807bd810 0x807bd810
+807bd850 CollisionInfo::ObjInfo::AreItemsAllowedOnObj
+807bd864 CollisionInfo::ObjInfo::SetDistanceCalcBit
+807bd88c CollisionInfo::ObjInfo::CalcInitialDistance
+807bd8b8 0x807bd8b8
+807bd8d4 0x807bd8d4
+807bd8e8 CollisionInfo::ObjInfo::Update
+807bd908 CollisionInfo::ObjInfo::UpdateWithRot
+807bd930 CollisionInfo::ObjInfo::Reset
+807bd954 0x807bd954
+807bd96c KCLTypeHolder::FindClosestCollisionEntry
+807bd9e8 0x807bd9e8
+807bda7c KCLTypeHolder::Reset
+807bda9c KCLTypeHolder::ApplyFlagAndRegisterEntry
+807bdae8 0x807bdae8
+807bdb28 KCLTypeHolder::ReplaceBLIGHTIndex
+807bdb5c KCLTypeHolder::ReplaceKCLVariant
+807bdb90 KCLTypeHolder::ReplaceWheelDepth
+807bdbc4 KCLTypeHolder::ReplaceTrickableBit
+807bdbf8 KCLTypeHolder::ReplaceRejectBit
+807bdc2c KCLTypeHolder::ReplaceSoftBit
+807bdc5c KCLController::__ct
+807bdd7c 0x807bdd7c
+807bddbc KCLController::__dt
+807bddfc 0x807bddfc
+807bdf54 0x807bdf54
+807be030 KCLController::FindTrianglesList
+807be12c KCLController::FindTrianglesListAndProcessNewRadius
+807be3c4 0x807be3c4
+807bf4c0 0x807bf4c0
+807c01e4 0x807c01e4
+807c0884 KCLController::IsCollidingImpl
+807c0f00 KCLController::IsCollidingFromCurCopyPosition
+807c1514 KCLController::IsCollidingImplInfY
+807c1b0c 0x807c1b0c
+807c1bb4 KCLController::GetTrianglesList
+807c1c8c 0x807c1c8c
+807c1de8 KCLController::GetTrianglesListReuse
+807c1f80 0x807c1f80
+807c1fac 0x807c1fac
+807c21f4 0x807c21f4
+807c2410 KCLController::IsColliding
+807c243c 0x807c243c
+807c24c0 KCLController::Update
+807c25cc 0x807c25cc
+807c2630 0x807c2630
+807c2660 CollisionInfo::Init
+807c26ac 0x807c26ac
+807c2824 KCLManager::CreateInstance
+807c2884 KCLManager::DestroyInstance
+807c28d8 KCLManager::Load
+807c2928 0x807c2928
+807c293c KCLManager::Update
+807c29e4 0x807c29e4
+807c2a04 0x807c2a04
+807c2a60 0x807c2a60
+807c2bd8 KCLManager::IsCollidingFillInfoNoTerrainInfo
+807c2da0 0x807c2da0
+807c2f18 KCLManager::IsCollidingFillInfoAddEntryNoTerrainInfo
+807c30e0 0x807c30e0
+807c3258 KCLManager::IsCollidingFillInfo
+807c3554 0x807c3554
+807c36cc KCLManager::IsCollidingFillInfoAddEntry
+807c39c8 KCLManager::IsCollidingNoTerrainInfoNoTriangleCheck
+807c3b5c KCLManager::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+807c3cf0 KCLManager::IsColliding
+807c3e84 KCLManager::IsCollidingAddEntryNoTriangleCheck
+807c4018 0x807c4018
+807c41a4 0x807c41a4
+807c4330 0x807c4330
+807c44bc 0x807c44bc
+807c4648 KCLManager::IsCollidingNoTerrainInfo
+807c47f0 KCLManager::IsCollidingAddEntryNoTerrainInfo
+807c4998 0x807c4998
+807c4b40 KCLManager::IsCollidingAddEntry
+807c4ce8 ObjectKCLController::__ct
+807c4d6c ObjectKCLController::__dt
+807c4dc8 ObjectKCLController::Update
+807c4e4c 0x807c4e4c
+807c4e7c 0x807c4e7c
+807c4eac 0x807c4eac
+807c506c 0x807c506c
+807c522c 0x807c522c
+807c53a4 0x807c53a4
+807c551c ObjectKCLController::CalcCollisionNoTerrainInfoNoTriangleCheck
+807c56f8 ObjectKCLController::CalcCollisionAddEntryNoTerrainInfoNoTriangleCheck
+807c58d4 ObjectKCLController::CalcCollision
+807c5a68 ObjectKCLController::CalcCollisionAddEntryNoTriangleCheck
+807c5bfc 0x807c5bfc
+807c5dd4 0x807c5dd4
+807c5fac 0x807c5fac
+807c613c 0x807c613c
+807c62cc ObjectKCLController::CalcCollisionNoTerrainInfo
+807c64c0 ObjectKCLController::CalcCollisionAddEntryNoTerrainInfo
+807c66b4 0x807c66b4
+807c6860 ObjectKCLController::CalcCollisionAddEntry
+807c6a0c 0x807c6a0c
+807c6a14 0x807c6a14
+807c6a20 0x807c6a20
+807c6a38 0x807c6a38
+807c6a44 0x807c6a44
+807c6a98 0x807c6a44_switch
+807c6a9c 0x807c6a44_caseD_0
+807c6ad8 0x807c6a44_caseD_5
+807c6b34 0x807c6a44_caseD_4
+807c6b70 0x807c6a44_caseD_1
+807c6bc8 0x807c6a44_caseD_8
+807c6c04 0x807c6a44_caseD_9
+807c6d1c 0x807c6d1c
+807c6e64 0x807c6e64
+807c6f0c 0x807c6f0c
+807c6f3c 0x807c6f3c
+807c708c DriverControllerBones::__ct
+807c70b4 0x807c70b4
+807c70f4 DriverControllerBones::__dt
+807c7134 DriverControllerBones::SetBoneName
+807c7158 DriverControllerBones::SetNode
+807c71d8 DriverMgr::InitiateDriverControllerBoneNames
+807c7358 0x807c7358
+807c7364 DriverController::__ct
+807c77e4 0x807c77e4
+807c77e8 0x807c77e8
+807c7828 DriverController::LoadModels
+807c7e7c DriverController::LoadBones
+807c8624 0x807c8624
+807c8758 DriverController::Load
+807c962c 0x807c962c
+807c9840 0x807c9840
+807c9844 0x807c9844
+807ca024 0x807ca024
+807ca068 0x807ca068
+807ca0b8 0x807ca0b8
+807ca6e4 0x807ca6e4
+807caaa4 0x807caaa4
+807cab8c 0x807cab8c
+807cad68 0x807cad68
+807cae80 0x807cae80
+807cae8c 0x807cae8c
+807cb0c8 DriverController::Init
+807cb130 DriverControllerBike::Init
+807cb198 0x807cb198
+807cb34c 0x807cb34c
+807cb360 DriverController::Update
+807cb530 0x807cb530
+807cbd18 0x807cbd18
+807cbd20 0x807cbd20
+807cbd24 0x807cbd24
+807cbeb8 0x807cbeb8
+807cc018 PlayerModel_setAnimation
+807cc170 0x807cc170
+807cc174 0x807cc174
+807cce78 0x807cce78
+807cce88 0x807cce88
+807cce98 0x807cce98
+807ccea8 0x807ccea8
+807cceb8 0x807cceb8
+807ccec8 0x807ccec8
+807cced8 0x807cced8
+807ccee8 0x807ccee8
+807ccef8 0x807ccef8
+807ccf08 0x807ccf08
+807ccf18 0x807ccf18
+807ccf28 0x807ccf28
+807cd32c 0x807cd32c
+807cda74 0x807cda74
+807cdbf8 0x807cdbf8
+807cdc20 0x807cdc20
+807cdca4 0x807cdca4
+807cdccc DriverControllerBike::__ct
+807cdd08 DriverController::__dt
+807cddb8 0x807cddb8
+807cdf14 0x807cdf14
+807ce190 0x807ce190
+807ce270 0x807ce270
+807ce31c 0x807ce31c
+807ce38c 0x807ce38c
+807ce5a4 0x807ce5a4
+807ce6d0 0x807ce6d0
+807cec48 0x807cec48
+807cecd4 0x807cecd4
+807cf510 0x807cf510
+807cf920 0x807cf920
+807cf960 0x807cf960
+807cf9f0 0x807cf9f0
+807d0554 0x807d0554
+807d0744 0x807d0744
+807d07f0 0x807d07f0
+807d0898 0x807d0898
+807d0938 0x807d0938
+807d094c 0x807d094c
+807d0b5c MiiDriverModel::UpdateParams
+807d0d68 0x807d0d68
+807d0e70 0x807d0e70
+807d0f78 0x807d0f78
+807d14b4 0x807d14b4
+807d1504 0x807d1504
+807d171c 0x807d171c
+807d18ec 0x807d18ec
+807d19c8 0x807d19c8
+807d1a60 0x807d1a60
+807d1bdc 0x807d1bdc
+807d1bf8 0x807d1bf8
+807d1c14 0x807d1c14
+807d1c40 0x807d1c40
+807d1c5c 0x807d1c5c
+807d1c78 0x807d1c78
+807d1c94 0x807d1c94
+807d1cb0 0x807d1cb0
+807d1ccc 0x807d1ccc
+807d1ce8 0x807d1ce8
+807d1d04 0x807d1d04
+807d1e34 0x807d1e34
+807d1f80 0x807d1f80
+807d201c 0x807d201c
+807d2038 0x807d2038
+807d2064 0x807d2064
+807d20a0 0x807d20a0
+807d20bc 0x807d20bc
+807d20e0 0x807d20e0
+807d2114 0x807d2114
+807d2130 0x807d2130
+807d214c 0x807d214c
+807d2168 0x807d2168
+807d218c 0x807d218c
+807d21a8 0x807d21a8
+807d21c4 0x807d21c4
+807d21f8 DriverController::CreateModelDirectors
+807d2784 0x807d2784
+807d2798 0x807d2798
+807d2940 0x807d2940
+807d2aa8 0x807d2aa8
+807d2b2c 0x807d2b2c
+807d2b68 0x807d2b68
+807d2bb4 0x807d2bb4
+807d2da8 0x807d2da8
+807d2ddc 0x807d2ddc
+807d2de4 0x807d2de4
+807d2dec 0x807d2dec
+807d2e78 0x807d2e78
+807d2f04 0x807d2f04
+807d2fac 0x807d2fac
+807d3054 0x807d3054
+807d30a4 0x807d30a4
+807d30f4 0x807d30f4
+807d3100 0x807d3100
+807d3188 0x807d3188
+807d3300 0x807d3188_switch
+807d3304 0x807d3188_caseD_1a
+807d3314 0x807d3188_caseD_13
+807d3330 0x807d3188_caseD_16
+807d3358 0x807d3188_caseD_14
+807d338c 0x807d338c
+807d3458 0x807d3458
+807d37b4 0x807d37b4
+807d37d0 0x807d37d0
+807d381c 0x807d381c
+807d3868 0x807d3868
+807d396c 0x807d396c
+807d3d58 0x807d3d58
+807d3e68 0x807d3e68
+807d3f10 0x807d3f10
+807d3f24 0x807d3f24
+807d3f58 DriverControllerBike::__dt
+807d400c 0x807d400c
+807d42e8 DriverLimbs::__ct
+807d45e8 DriverCalcWorldCB::__dt
+807d4628 0x807d4628
+807d46a4 0x807d46a4
+807d4700 0x807d4700
+807d4904 0x807d4904
+807d492c 0x807d492c
+807d4a40 0x807d4a40
+807d4a4c 0x807d4a4c
+807d4aa0 0x807d4aa0
+807d4af4 0x807d4af4
+807d4b20 0x807d4b20
+807d4d08 0x807d4d08
+807d5680 0x807d5680
+807d5760 DriverLimbs::ExecCallbackA
+807d5944 0x807d5944
+807d5a98 DriverLimbs::ExecCallbackB
+807d5b38 0x807d5b38
+807d5e90 0x807d5e90
+807d63e0 DriverLimbs::ExecCallbackC
+807d65bc 0x807d65bc
+807d6844 0x807d6844
+807d69e8 DriverLimbs::CalcLeftArm
+807d6b28 DriverLimbs::CalcRightArm
+807d6cac DriverLimbs::CalcLeftLeg
+807d6e60 0x807d6e60
+807d6edc 0x807d6edc
+807d6f58 DriverLimbs::CalcRightLeg
+807d710c 0x807d710c
+807d7458 0x807d7458
+807d7588 0x807d7588
+807d76e8 0x807d76e8
+807d77d4 0x807d77d4
+807d798c 0x807d798c
+807d8004 0x807d8004
+807d82e4 0x807d82e4
+807d8604 0x807d8604
+807d8688 0x807d8688
+807d870c 0x807d870c
+807d8790 0x807d8790
+807d89f4 0x807d89f4
+807d8e30 0x807d8e30
+807d8f88 0x807d8f88
+807d9038 0x807d9038
+807d90e8 0x807d90e8
+807d9134 0x807d9134
+807d91cc 0x807d91cc
+807d9688 0x807d9688
+807d9734 0x807d9734
+807d973c 0x807d973c
+807d974c DriverLimbs::ExecCallbackC(thunk)
+807d9754 DriverLimbs::ExecCallbackB(thunk)
+807d975c DriverLimbs::ExecCallbackA(thunk)
+807d9764 DriverLimbs::__dt(thunk)
+807d976c DriverController::GetBoneMatId
+807d9798 DriverCalcWorldCB::__ct
+807d99ec DriverCalcWorldCB::ExecCallbackB
+807d9b0c DriverCalcWorldCB::ExecCallbackC
+807d9b80 DriverCalcWorldCB::ExecCallbackC(thunk)
+807d9b88 DriverCalcWorldCB::ExecCallbackB(thunk)
+807d9b90 DriverCalcWorldCB::__dt(thunk)
+807d9b98 TicoModel::__ct
+807d9d64 TicoModel::Update
+807da40c 0x807da40c
+807da578 TicoModel::UpdateKartPosition
+807da5c0 ToadetteHair::__ct(ResFile, ModelDirector)
+807da8f4 ToadetteHair::__ct(DriverController)
+807dac50 0x807dac50
+807dad04 0x807dad04
+807db004 0x807db004
+807db008 0x807db008
+807db028 ToadetteHair::ToggleLock
+807db03c ToadetteHair::CalcWorldCB::ExecCallbackC
+807dbc24 ToadetteHair::__dt
+807dbc7c ToadetteHair::CalcWorldCB::__dt
+807dbcbc ToadetteHair::CalcWorldCB::ExecCallbackC(thunk)
+807dbcc4 ToadetteHair::CalcWorldCB::__dt(thunk)
+807dbccc 0x807dbccc
+807dbd80 MiiHeadsModel::__ct(Mii)
+807dbe0c MiiHeadsModel::__ct(miiIdx, r9)
+807dbec8 0x807dbec8
+807dbf7c 0x807dbf7c
+807dbfbc MiiHeadsModel::__ct(Mii, r9)
+807dc048 MiiHeadsModel::Init
+807dc2ac 0x807dc2ac
+807dc2c0 MiiHeadsModel::UpdateParams
+807dc2d8 0x807dc2d8
+807dc2f0 0x807dc2f0
+807dc3e8 MiiHeadsModel::SetExpression
+807dc43c MiiHeadsModel::SetExpression_switch
+807dc440 MiiHeadsModel::SetExpression_caseD_5
+807dc48c MiiHeadsModel::SetExpression_caseD_6
+807dc4d8 MiiHeadsModel::SetExpression_caseD_7
+807dc524 MiiHeadsModel::SetExpression_caseD_4
+807dc570 MiiHeadsModel::SetExpression_caseD_2
+807dc5bc MiiHeadsModel::SetExpression_caseD_1
+807dc608 MiiHeadsModel::SetExpression_caseD_0
+807dc654 MiiHeadsModel::SetExpression_caseD_3
+807dc6c8 0x807dc6c8
+807dc7e4 0x807dc7e4
+807dc860 MiiHeadsModel::__dt
+807dc8b8 0x807dc8b8
+807dc8c8 0x807dc8c8
+807dc950 0x807dc950
+807dca40 0x807dca40
+807dcb30 0x807dcb30
+807dcc20 0x807dcc20
+807dcc60 0x807dcc60
+807dcca0 0x807dcca0
+807dcce0 0x807dcce0
+807dcd20 0x807dcd20
+807dcd60 0x807dcd60
+807dcda0 0x807dcda0
+807dce78 0x807dce78
+807dcf50 0x807dcf50
+807dd028 0x807dd028
+807dd100 0x807dd100
+807dd1d8 0x807dd1d8
+807dd2b0 0x807dd2b0
+807dd5b8 0x807dd5b8
+807dd8c0 0x807dd8c0
+807ddbc8 0x807ddbc8
+807dded0 0x807dded0
+807de1d8 0x807de1d8
+807de4e0 0x807de4e0
+807de640 lim_sprintf
+807de6e8 0x807de6e8
+807de7a8 0x807de7a8
+807de820 0x807de820
+807de858 0x807de858
+807de8b8 0x807de8b8
+807de934 0x807de934
+807deb24 0x807deb24
+807debcc 0x807debcc
+807ded14 PSMTXRotRad
+807dee8c 0x807dee8c
+807df004 0x807df004
+807df17c 0x807df17c
+807df260 0x807df260
+807df3c4 0x807df3c4
+807df430 0x807df430
+807df56c 0x807df56c
+807df690 0x807df690
+807df7b4 0x807df7b4
+807df808 MinimapMgr::Disposer__dt
+807df908 MinimapMgr::CreateInstance
+807dfa04 MinimapMgr::DestroyInstance
+807dfad0 MinimapMgr::__ct
+807dfba0 0x807dfba0
+807dfba4 MinimapMgr::Load
+807dfea4 0x807dfea4
+807dfee4 MinimapMgr::__dt
+807dffa4 MinimapMgr::TryDraw
+807e0028 MinimapMgr::Draw
+807e057c MinimapMgr::ApplyAREAType5
+807e08dc 0x807e08dc
+807e08e0 0x807e08e0
+807e08e4 MinimapMgr::Convert3DPosToPercent
+807e093c CtrlMenuBattleCupSelectCup::GetClassName
+807e0948 CtrlMenuBattleCupSelectStage::GetClassName
+807e0958 CtrlMenuBattleCupSelectCup::Load
+807e0b50 CtrlMenuBattleCupSelectCup::OnInit
+807e0c90 CtrlMenuBattleCupSelectCup::OnCupButtonSelect
+807e0d60 CtrlMenuBattleCupSelectCup::OnCupButtonClick
+807e0dc0 CtrlMenuBattleCupSelectStage::Load
+807e0ee4 CtrlMenuBattleCupSelectStage::UpdateStageList
+807e0fd0 CtrlMenuBattleCupSelectStage::InitSelf
+807e10d4 CtrlMenuBattleCupSelectStage::OnUpdate
+807e1248 CtrlMenuBattleCupSelectStage::GetRuntimeTypeInfo
+807e1254 CtrlMenuBattleCupSelectCup::GetRuntimeTypeInfo
+807e1260 CtrlMenuBattleCup::_sinit_
+807e127c CtrlMenuBattleStageSelectCupSub::GetClassName
+807e1288 CtrlMenuBattleStageSelectCup::GetClassName
+807e1298 CtrlMenuBattleStageSelectStage::GetClassName
+807e12a8 StageButton::GetClassName
+807e12b8 CtrlMenuBattleStageSelectCup::Load
+807e1444 CtrlMenuBattleStageSelectCup::InitSelf
+807e1548 CtrlMenuBattleStageSelectCupSub::SetRelativePosition
+807e15cc CtrlMenuBattleStageSelectCupSub::InitSelf
+807e1668 CtrlMenuBattleStageSelectCupSub::OnUpdate
+807e1d78 Pages::BattleStageSelect::GetManipulatorManager
+807e1d80 CtrlMenuBattleStageSelectStage::Load
+807e1ed0 CtrlMenuBattleStageSelectStage::InitSelf
+807e22b4 CtrlMenuBattleStageSelectStage::OnStageButtonClick
+807e230c CtrlMenuBattleStageSelectStage::OnStageButtonSelect
+807e2508 CtrlMenuBattleStageSelectStage::GetRuntimeTypeInfo
+807e2514 StageButton::GetRuntimeTypeInfo
+807e2520 CtrlMenuMovieButton::GetMovieCount
+807e2528 CtrlMenuBattleStageSelectCup::GetRuntimeTypeInfo
+807e2534 CtrlMenuBattleStageSelectCupSub::GetRuntimeTypeInfo
+807e2540 CtrlMenuBattleStage_cpp_sinit_
+807e256c CtrlMenuMovieButton::OnUpdate(PushButton)
+807e2574 CtrlMenuMovieButton::InitSelf(PushButton)
+807e257c CtrlMenuMovieButton::OnLoad(PushButton)
+807e2584 StageButton::__dt(PushButton)
+807e258c StageButton::GetClassName(PushButton)
+807e2594 StageButton::GetRuntimeTypeInfo(PushButton)
+807e259c CtrlMenuCharacterSelect::GetClassName
+807e25a8 CtrlMenuCharacterSelect::Load
+807e2808 CtrlMenuCharacterSelect::ButtonDriver::__ct
+807e2844 CtrlMenuCharacterSelect::ButtonDriver::__dt
+807e289c CtrlMenuCharacterSelect::GetUnlockedStatus
+807e2928 CtrlMenuCharacterSelect::LoadButton
+807e2d18 CtrlMenuCharacterSelect::InitSelf
+807e30ac CtrlMenuCharacterSelect::OnUpdate
+807e35b0 CtrlMenuCharacterSelect::GetButtonDriver
+807e35fc CtrlMenuCharacterSelect::OnButtonClick
+807e36f4 CtrlMenuCharacterSelect::OnButtonSelect
+807e37d4 CtrlMenuCharacterSelect::OnButtonDeselect
+807e3880 CtrlMenuCharacterSelect::OnMiiButtonClick
+807e39cc CtrlMenuCharacterSelect::OnMiiButtonSelect
+807e3aac CtrlMenuCharacterSelect::OnMiiButtonDeselect
+807e3b58 CtrlMenuCharacterSelect::OnMultiplayerMiiSelected
+807e3bec CtrlMenuCharacterSelect::GetUnlockedCharacterCountByWeight
+807e3cac CtrlMenuCharacterSelect::GetCorrectButtonDriverId
+807e3e00 CtrlMenuCharacterSelect::ButtonDriver::GetClassName
+807e3e10 CtrlMenuCharacterSelect::ButtonDriver::InitSelf
+807e3eac CtrlMenuCharacterSelect::ButtonDriver::SetPositionAnim
+807e3efc CtrlMenuCharacterSelect::ButtonDriver::ResetButtonColours
+807e4130 CtrlMenuCharacterSelect::ButtonDriver::SetButtonColours
+807e43d4 CtrlMenuCharacterSelect::GetRuntimeTypeInfo
+807e43e0 CtrlMenuCharacterSelect::ButtonDriver::GetRuntimeTypeInfo
+807e43ec CtrlMenuCharacterSelect_cpp_sinit_
+807e4410 CtrlMenuCourseSelectCupSub::GetClassName
+807e441c CtrlMenuCourseSelectCup::GetClassName
+807e442c CtrlMenuCourseSelectCourse::GetClassName
+807e443c CourseButton::GetClassName
+807e444c CtrlMenuCourseSelectCup::Load
+807e45c0 CtrlMenuCourseSelectCup::InitSelf
+807e4744 CtrlMenuCourseSelectCupSub::SetRelativePosition
+807e47c8 CtrlMenuCourseSelectCupSub::InitSelf
+807e4864 CtrlMenuCourseSelectCupSub::OnUpdate
+807e4f74 Pages::CourseSelect::GetManipulatorManager
+807e4f7c CtrlMenuCourseSelectCourse::Load
+807e5118 CtrlMenuCourseSelectCourse::InitSelf
+807e5434 CtrlMenuCourseSelectCourse::OnCourseButtonClick
+807e548c CtrlMenuCourseSelectCourse::OnCourseButtonSelect
+807e55f8 CtrlMenuCourseSelectCourse::GetRuntimeTypeInfo
+807e5604 CourseButton::GetRuntimeTypeInfo
+807e5610 CtrlMenuCourseSelectCup::GetRuntimeTypeInfo
+807e561c CtrlMenuCourseSelectCupSub::GetRuntimeTypeInfo
+807e5628 CtrlMenuCoursecpp_sinit_
+807e5654 CourseButton::__dt(PushButton)
+807e565c 0x807e565c
+807e5664 CourseButton::GetRuntimeTypeInfo(PushButton)
+807e566c CtrlMenuCupSelectCup::GetClassName
+807e5678 CtrlMenuCupSelectCourse::GetClassName
+807e5688 CtrlMenuCupSelectCup::Load
+807e5894 CtrlMenuCupSelectCup::InitSelf
+807e5c58 CtrlMenuCupSelectCup::OnCupButtonSelect
+807e5d68 CtrlMenuCupSelectCup::OnCupButtonClick
+807e5dc8 CtrlMenuCupSelectCup::IsCupUnlocked
+807e5ecc CtrlMenuCupSelectCourse::Load
+807e5ff0 CtrlMenuCupSelectCourse::UpdateTrackList
+807e60dc CtrlMenuCupSelectCourse::InitSelf
+807e61e0 CtrlMenuCupSelectCourse::OnUpdate
+807e63d4 CtrlMenuCupSelectCourse::GetRuntimeTypeInfo
+807e63e0 CtrlMenuCupSelectCup::GetRuntimeTypeInfo
+807e63ec CtrlMenuCupcpp_sinit_
+807e6408 0x807e6408
+807e6414 0x807e6414
+807e6424 0x807e6424
+807e666c 0x807e666c
+807e681c 0x807e681c
+807e693c 0x807e693c
+807e699c 0x807e699c
+807e6b24 0x807e6b24
+807e6c10 0x807e6c10
+807e6d30 0x807e6d30
+807e6d34 0x807e6d34
+807e6d40 0x807e6d40
+807e6d4c 0x807e6d4c
+807e6d68 CtrlMenuMRStageSelectLevelSub::GetClassName
+807e6d74 CtrlMenuMRStageSelectLevel::GetClassName
+807e6d84 CtrlMenuMRStageSelectStage::GetClassName
+807e6d94 MRStageButton::GetClassName
+807e6da4 MissionStageSelectLevel::OnInit
+807e6f70 0x807e6f70
+807e7090 0x807e7090
+807e70e8 0x807e70e8
+807e7144 CtrlMenuMRStageSelectLevelSub::OnUpdate
+807e73a0 0x807e73a0
+807e73a8 MissionStageSelectStage::OnInit
+807e75dc 0x807e75dc
+807e77b4 0x807e77b4
+807e780c 0x807e780c
+807e79b8 0x807e79b8
+807e79c4 0x807e79c4
+807e79d0 0x807e79d0
+807e79dc CtrlMenuMRStageSelectLevelSub::GetRuntimeTypeInfo
+807e79e8 0x807e79e8
+807e7a14 0x807e7a14
+807e7a1c 0x807e7a1c
+807e7a24 0x807e7a24
+807e7a2c CtrlMenuMachineGraph::GetClassName
+807e7a38 CtrlMenuMachineGraph::Load
+807e7d88 MachineAbility::__ct
+807e7dc4 MachineAbility::__dt
+807e7e1c CtrlMenuMachineGraph::OnUpdate
+807e7e20 CtrlMenuMachineGraph::OnLoad
+807e7f44 MachineAbility::InitSelf
+807e8118 CtrlMenuMachineGraph::GetRuntimeTypeInfo
+807e8124 CtrlMenuMachineGraph_cpp_sinit
+807e8138 CtrlMenuMovieHandler::Toggle
+807e8188 CtrlMenuMovieHandler::IsMirror
+807e82d0 CtrlMenuMovieButton::GetPaneNames
+807e82dc CtrlMenuMovieLayout::GetPaneNames
+807e82e8 CtrlMenuSingleTopMovieButton::GetPaneNames
+807e82f4 CtrlMenuMovieButton::GetClassName
+807e8300 CtrlMenuMovieButton::OnLoad
+807e84a8 MovieScale::__ct
+807e84ac CtrlMenuMovieButton::InitSelf
+807e8698 CtrlMenuMovieButton::OnUpdate
+807e879c CtrlMenuSingleTopMovieButton::GetClassName
+807e87ac CtrlMenuSingleTopMovieButton::OnLoad
+807e8954 CtrlMenuSingleTopMovieButton::GetMovieCount
+807e895c CtrlMenuSingleTopMovieButton::InitSelf
+807e8b48 CtrlMenuSingleTopMovieButton::OnUpdate
+807e8c4c CtrlMenuMovieLayout::GetClassName
+807e8c5c CtrlMenuMovieLayout::OnLoad
+807e8e04 CtrlMenuMovieLayout::GetMovieCount
+807e8e0c CtrlMenuMovieLayout::InitSelf
+807e8ff8 CtrlMenuMovieLayout::OnUpdate
+807e90fc CtrlMenuMovieLayout::GetRuntimeTypeInfo
+807e9108 CtrlMenuSingleTopMovieButton::GetRuntimeTypeInfo
+807e9114 CtrlMenuSingleTopMovieButton::__dt
+807e9170 CtrlMenuMovieButton::GetRuntimeTypeInfo
+807e917c CtrlMenuMovie_cpp_sinit_
+807e91a4 CtrlMenuMovieButton::__dt(PushButton)
+807e91ac CtrlMenuMovieButton::GetClassName(PushButton)
+807e91b4 CtrlMenuMovieButton::GetRuntimeTypeInfo(PushButton)
+807e91bc CtrlMenuSingleTopMovieButton::OnUpdate(PushButton)
+807e91c4 CtrlMenuSingleTopMovieButton::InitSelf(PushButton)
+807e91cc CtrlMenuSingleTopMovieButton::OnLoad(PushButton)
+807e91d4 CtrlMenuSingleTopMovieButton::__dt(PushButton)
+807e91dc CtrlMenuSingleTopMovieButton::GetClassName(PushButton)
+807e91e4 CtrlMenuSingleTopMovieButton::GetRuntimeTypeInfo(PushButton)
+807e91ec CtrlMenuMovieLayout::OnUpdate(LayoutUIControl)
+807e91f4 CtrlMenuMovieLayout::InitSelf(LayoutUIControl)
+807e91fc CtrlMenuMovieLayout::__dt(LayoutUIControl)
+807e9204 CtrlMenuMovieLayout::GetClassName(LayoutUIControl)
+807e920c CtrlMenuMovieLayout::GetRuntimeTypeInfo(LayoutUIControl)
+807e9214 CtrlMenuBackButton::GetClassName
+807e9220 CtrlMenuDummyBack::GetClassName
+807e9230 CtrlMenuPageTitleText::GetClassName
+807e9240 CtrlMenuInstructionText::GetClassName
+807e9250 CtrlMenuObiTop::GetClassName
+807e9260 CtrlMenuObiBottom::GetClassName
+807e9270 CtrlMenuBackButton::OnUpdate
+807e93b8 CtrlMenuBackButton::OnInit
+807e9410 CtrlMenuBackButton::SetPositionAnim
+807e947c CtrlMenuPageTitleTextText::Load
+807e9610 CtrlMenuBackButton::SetPlayerBitfield
+807e9620 CtrlMenuDummyBack::Load
+807e9724 CtrlMenuDummyBack::OnUpdate
+807e987c CtrlMenuPageTitleText::SetMessage
+807e9898 CtrlMenuPageTitleText::SetPositionAnim
+807e9904 CtrlMenuInstructionText::Load
+807e999c CtrlMenuInstructionText::SetPositionAnim
+807e9a38 CtrlMenuInstructionText::SetMessage
+807e9a68 CtrlMenuObiTop::SetPositionAnim
+807e9ac0 0x807e9ac0
+807e9b18 0x807e9b18
+807e9b70 0x807e9b70
+807e9b7c CtrlMenuObiTop::__dt
+807e9bd4 CtrlMenuObiTop::GetRuntimeTypeInfo
+807e9be0 0x807e9be0
+807e9bec CtrlMenuPageTitleText::GetRuntimeTypeInfo
+807e9bf8 CtrlMenuDummyBack::GetRuntimeTypeInfo
+807e9c04 CtrlMenuBackButton::GetRuntimeTypeInfo
+807e9c10 CtrlMenuText_cpp_sinit_
+807e9c44 CtrlMenuPressStart::GetClassName
+807e9c50 CtrlMenuPressStart::InitSelf
+807e9ccc CtrlMenuPressStart::OnUpdate
+807e9cd0 CtrlMenuPressStart::Load
+807e9d90 CtrlMenuPressStart::GetRuntimeTypeInfo
+807e9d9c CtrlMenuPressStart_cpp_sinit_
+807e9db0 CtrlMenuTeamConfirmTeam::GetClassName
+807e9dc0 CtrlMenuTeamConfirmTeam::Load
+807e9f5c CtrlMenuTeamConfirmTeam::InitSelf
+807ea240 CtrlMenuTeamConfirmTeam::GetRuntimeTypeInfo
+807ea24c CtrlMenuTeamConfirmTeam_cpp_sinit_
+807ea270 CtrlRace2DMap::GetClassName
+807ea27c CtrlRace2DMap::Load
+807ea89c CtrlRace2DMapCharacer::__ct
+807ea8d8 CtrlRaceBase::__dt
+807ea930 CtrlRace2DMapObject::__dt
+807ea98c CtrlRace2DMapCharacter::__dt
+807ea9ec CtrlRace2DMapBossObj::__ct
+807eaa28 CtrlRace2DMapBossObj::__dt
+807eaa88 CtrlRace2DMapObject::SetMapPosition
+807eaaa4 CtrlRace2DMapObject::SetMapRotation
+807eaac0 CtrlRace2DMap::InitSelf
+807eab3c CtrlRace2DMap::OnUpdate
+807eab4c zz_807eab4c
+807eac1c CtrlRace2DMapObject::GetClassName
+807eac2c CtrlRace2DMapObject::InitSelf
+807eac7c CtrlRace2DMapObject::GetPaneName
+807eac88 CtrlRace2DMapObject::OnUpdate
+807eacfc CtrlRace2DMapObject::CalculatePosition
+807eadf0 CtrlRace2DMapCharacter::GetClassName
+807eae00 CtrlRace2DMapCharacer::Load
+807eaecc CtrlRace2DMapCharacter::InitSelf
+807eb250 CtrlRace2DMapCharacer::OnUpdate
+807eb3cc CtrlRace2DMapCharacter::CalculatePosition
+807eb9f8 CtrlRace2DMapBossObj::GetClassName
+807eba08 CtrlRace2DMapBossObj::Load
+807eba60 CtrlRace2DMapBossObj::InitSelf
+807ebd50 CtrlRace2DMapBossObj::OnUpdate
+807ebe40 CtrlRaceBase::GetPane
+807ebe48 CtrlRace2DMapBossObj::GetPaneName
+807ebe54 CtrlRace2DMapBossObj::GetRuntimeTypeInfo
+807ebe60 CtrlRace2DMapCharacter::GetPaneName
+807ebe6c CtrlRace2DMapCharacter::GetRuntimeTypeInfo
+807ebe78 CtrlRace2DMapObject::GetRuntimeTypeInfo
+807ebe84 CtrlRace2DMap::__dt
+807ebee0 CtrlRace2DMap::GetRuntimeTypeInfo
+807ebeec CtrlRace2DMap_cpp_sinit_
+807ebf14 CtrlRaceBase::GetClassName
+807ebf20 CtrlRaceBase::HudSlotColorEnable
+807ec20c CtrlRaceBase::SetPanePosition
+807ec30c CtrlRaceBase::setPausingPhase
+807ec3b0 CtrlRaceBase::IsInactive
+807ec3c4 CtrlRaceBase::HasStarted
+807ec3e0 CtrlRaceBase::UpdatePausePosition
+807ec6e8 CtrlRaceBase::InitSelf
+807ec7f8 CtrlRaceBase::GetPlayerId
+807ec8ec CtrlRaceBase::GetRuntimeTypeInfo
+807ec8f8 0x807ec8f8
+807ec90c CtrlRaceBattleAddPoint::GetClassName
+807ec918 CtrlRaceBattleAddPoint::Load
+807ec9ac CtrlRaceBattleAddPoint::InitSelf
+807eca8c CtrlRaceBattleAddPoint::OnUpdate
+807ecd88 CtrlRaceBattlePoint::GetClassName
+807ecd98 CtrlRaceBattlePoint::SetPanePosition
+807ecf5c 0x807ecf5c
+807ecfac CtrlRaceBattlePoint::SetPositionAnim
+807ed098 CtrlRaceBattlePoint::Init
+807ed134 CtrlRaceBattlePoint::OnUpdate
+807ed1f0 CtrlRaceBattlePoint::Load
+807ed258 CtrlRaceBattleTotalPoint::GetClassName
+807ed268 CtrlRaceBattleTotalPoint::Init
+807ed364 CtrlRaceBattleTotalPoint::OnUpdate
+807ed9e8 CtrlRaceBattleTotalPoint::Load
+807edb84 CtrlRaceBattleTotalPoint::__dt
+807edbe0 CtrlRaceBattleTotalPoint::GetRuntimeTypeInfo
+807edbec CtrlRaceBattlePoint::__dt
+807edc48 CtrlRaceBattlePoint::GetRuntimeTypeInfo
+807edc54 CtrlRaceBattleAddPoint::GetRuntimeTypeInfo
+807edc60 CtrlRaceBattleAddPoint::__dt
+807edcbc CtrlRaceBattlePoint_cpp_sinit_
+807edd98 CtrlRaceBattleSetPoint::GetClassName
+807edda4 CtrlRaceBattleSetPoint::Load
+807edeb8 CtrlRaceBattleSetPoint::InitSelf
+807ee1d8 CtrlRaceBattleSetPoint::__dt
+807ee230 CtrlRaceBattleSetPoint::GetRuntimeTypeInfo
+807ee23c CtrlRaceBattleSetPoint_cpp_sinit_
+807ee250 CtrlRaceCount::GetClassName
+807ee25c CtrlRaceCount::Load
+807ee30c CtrlRaceCount::Init
+807ee358 CtrlRaceCount::OnUpdate
+807ee39c CtrlRaceCount::IsFadingIn
+807ee3d4 CtrlRaceCount::FadeIn
+807ee40c CtrlRaceCount::__dt
+807ee468 CtrlRaceCount::GetRuntimeTypeInfo
+807ee474 CtrlRaceCount_cpp_sinit
+807ee488 CtrlRaceGhostDiffTime::GetClassName
+807ee494 CtrlRaceGhostDiffTime::Init
+807ee548 CtrlRaceGhostDiffTime::OnUpdate
+807ee7c0 CtrlRaceGhostDiffTime::AddTimers
+807ee860 CtrlRaceGhostDiffTime::SubtractTimers
+807ee8e0 CtrlRaceGhostDiffTime::Load
+807ee990 CtrlRaceGhostDiffTime::__dt
+807eea14 CtrlRaceGhostDiffTime::GetRuntimeTypeInfo
+807eea20 CtrlRaceGhostDiffTime_cpp_sinit
+807eea34 CtrlRaceItemWindow::GetClassName
+807eea40 CtrlRaceItemWindow::Init
+807eee0c CtrlRaceItemWindow::IsInactive
+807eeed4 CtrlRaceItemWindow::HasStarted
+807eef64 CtrlRaceItemWindow::OnUpdate
+807ef4c8 CtrlRaceItemWindow::Load
+807ef530 CtrlRaceItemWindow::AnimateItemIcon
+807ef660 CtrlRaceItemWindow::__dt
+807ef6bc CtrlRaceItemWindow::GetRuntimeTypeInfo
+807ef6c8 CtrlRaceItemWindow_cpp_sinit_
+807ef6dc CtrlRaceLap::GetClassName
+807ef6e8 CtrlRaceLap::Init
+807ef810 CtrlRaceLap::OnUpdate
+807ef8d0 CtrlRaceLap::Load
+807ef97c CtrlRaceLap::__dt
+807ef9d8 CtrlRaceLap::GetRuntimeTypeInfo
+807ef9e4 CtrlRaceLap_cpp_sinit_
+807ef9f4 CtrlRaceLive::getClassName
+807efa00 CtrlRaceLive::initLayout
+807efa70 screenElement_setupPauseMovement
+807efa74 0x807efa74
+807efa78 CtrlRaceLiveMessage::getClassName
+807efa88 CtrlRaceLiveMessage::initLayout
+807efadc CtrlRaceLiveMessage::onInit
+807efb90 CtrlRaceLiveMessage::onUpdate
+807efc20 CtrlRaceLiveMessage::__dt
+807efc7c CtrlRaceLiveMessage::getInstance
+807efc88 CtrlRaceLive::__dt
+807efce4 0x807efce4
+807efcf0 __sinit_CtrlRaceLive_cpp
+807efd0c CtrlRaceNameBalloon:GetClassName
+807efd18 CtrlRaceNameBalloon::Load
+807efec8 CtrlRaceNameBalloon::InitSelf
+807f0044 CtrlRaceNameBalloon::UpdateInfo
+807f06e8 CtrlRaceNameBalloon::OnUpdate
+807f0d30 0x807f0d30
+807f0ed4 0x807f0ed4
+807f0f98 0x807f0f98
+807f1094 CtrlRaceNameBalloon::UpdatePosition
+807f132c RaceBalloons::Update
+807f1b8c 0x807f1b8c
+807f1bf0 0x807f1bf0
+807f1c34 RaceBalloons::AddNameBalloon
+807f1c50 RaceBalloons::AddItemBalloon
+807f1c58 RaceBalloons::__ct
+807f1d44 RaceBalloons::Init
+807f1da4 0x807f1da4
+807f1db4 RaceBalloons::OnItemObjTargeting
+807f1f24 0x807f1f24
+807f1f40 CtrlRaceItemBalloon::GetClassName
+807f1f50 CtrlRaceItemBalloon::Load
+807f2118 CtrlRaceItemBalloon::InitSelf
+807f22bc CtrlRaceItemBalloon::OnUpdate
+807f2b74 0x807f2b74
+807f2c84 0x807f2c84
+807f34ec CtrlRaceItemBalloon::UpdateIcon
+807f368c CtrlRaceItemBalloon::UpdatePositionForPlayer
+807f3d68 0x807f3d68
+807f4550 0x807f4550
+807f4680 0x807f4680
+807f46c0 0x807f46c0
+807f47bc CtrlRaceItemBalloon::__dt
+807f4814 CtrlRaceItemBalloon::GetRuntimeTypeInfo
+807f4820 CtrlRaceNameBalloon::__dt
+807f4878 CtrlRaceNameBalloon::GetRuntimeTypeInfo
+807f4884 0x807f4884
+807f48f0 CtrlRaceRankNum::GetClassName
+807f48fc CtrlRaceRankNum::Init
+807f4a08 CtrlRaceRankNum::OnUpdate
+807f4bb4 CtrlRaceRankNum::Load
+807f4d40 CtrlRaceRankNum::IsInactive
+807f4de0 CtrlRaceRankNum::__dt
+807f4e3c CtrlRaceRankNum::GetRuntimeTypeInfo
+807f4e48 CtrlRaceRankNum_cpp_sinit_
+807f4e5c CtrlRaceResult::GetClassName
+807f4e68 CtrlRaceResult::Load
+807f4fcc 0x807f4fcc
+807f51d4 0x807f51d4
+807f52f4 CtrlRaceResult::FillName
+807f5440 0x807f5440
+807f544c 0x807f544c
+807f56d4 CtrlRaceResult::FillScore
+807f579c 0x807f579c
+807f595c CtrlRaceResult::FillFinishTime
+807f5a4c CtrlRaceResult::Init
+807f5a50 CtrlRaceResult::OnUpdate
+807f5d24 CtrlRaceResult::807f5d24
+807f5e2c 0x807f5e2c
+807f5f20 CtrlRaceResult::GetBRCTRName
+807f5f9c CtrlRaceResult::CanEnd
+807f5fec CtrlRaceResult::Fill
+807f6490 CtrlRaceResult::__dt
+807f64e8 CtrlRaceResult::GetRuntimeTypeInfo
+807f64f4 CtrlRaceResult_cpp_sinit_
+807f6510 CtrlRaceResultTeam::GetClassName
+807f651c CtrlRaceResultTeam::Load
+807f69e4 CtrlRaceResultTeam::InitSelf
+807f6fb8 CtrlRaceResultTeam::OnUpdate
+807f7224 CtrlRaceResultTeam::IsResultAnimDone
+807f73c0 CtrlRaceResultTeam::ComparePlayers
+807f7458 CtrlResultAddPoint::GetClassName
+807f7468 CtrlResultAddPoint::Load
+807f7590 CtrlResultAddPoint::InitSelf
+807f75e4 CtrlResultAddPoint::OnUpdate
+807f7600 0x807f7600
+807f7654 CtrlResultAddPoint::GetRuntimeTypeInfo
+807f7660 CtrlRaceResultTeam::GetRuntimeTypeInfo
+807f766c CtrlResultAddPoint::__dt
+807f76c8 CtrlRaceResultTeam_cpp_sinit_
+807f76ec CtrlRaceScore::GetClassName
+807f76f8 CtrlRaceScore::InitSelf
+807f784c CtrlRaceScore::OnUpdate
+807f7914 CtrlRaceScore::Load
+807f7970 CtrlRaceScore::SetMessage
+807f7b48 CtrlRaceScore::__dt
+807f7ba4 CtrlRaceScore::GetRuntimeTypeInfo
+807f7bb0 CtrlRaceScore_cpp_sinit_
+807f7bc4 CtrlRaceTime::GetClassName
+807f7bd0 CtrlRaceTime::__ct
+807f7c6c CtrlRaceTime::InitSelf
+807f7e64 CtrlRaceTime::GetPlayerMaxLap
+807f7e80 CtrlRaceTime::GetPlayerId
+807f7eb4 CtrlRaceTime::GetRacedata
+807f7ec0 CtrlRaceTime::OnUpdate
+807f8084 0x807f8084
+807f826c CtrlRaceTime::GetParentPageId
+807f8274 CtrlRaceTime::GetParentPage
+807f8280 CtrlRaceTime::IsPaused
+807f8288 CtrlRaceTime::GetCurSection
+807f8298 CtrlRaceTime::GetSectionId
+807f82ac CtrlRaceTime::FillTimerGlobal
+807f82bc CtrlRaceTime::HasPlayerFinished
+807f82dc CtrlRaceTime::FillLapSplitTimer
+807f82f4 CtrlRaceTime::IsBattle
+807f8320 CtrlRaceTime::CheckTimer
+807f8360 CtrlRaceTime::IsTimerInvalid
+807f8380 CtrlRaceTime::ResetTimer
+807f83a4 CtrlRaceTime::IsOnlineVS
+807f83c4 CtrlRaceTime::IsModeFlag4
+807f83d0 CtrlRaceTime::IsPlayerLast
+807f83f0 CtrlRaceTime::FillFinishTimeTimer
+807f842c CtrlRaceTime::Load
+807f84c0 CtrlRaceTime::SetTimer
+807f8768 CtrlRaceTime::SetPositionAnim
+807f8840 CtrlRaceTime::DisableFlashingAnimation
+807f8878 CtrlRaceTime::EnableFlashingAnimation
+807f88b0 CtrlRaceTime::Func_0x5c
+807f88b8 CtrlRaceTime::Func_0x58
+807f88c0 CtrlRaceTime::OnDefocus
+807f88e8 CtrlRaceTime::OnFocus
+807f890c CtrlRaceTime::__dt
+807f8968 CtrlRaceTime::GetRuntimeTypeInfo
+807f8974 CtrlRaceTime_cpp_sinit_
+807f8988 CtrlRaceWifiStartMessage::GetClassName
+807f8994 CtrlRaceWifiStartMessage::Load
+807f8ba4 CtrlRaceWifiStartMessage::HasStarted
+807f8bd8 CtrlRaceWifiStartMessage::IsInactive
+807f8be8 CtrlRaceWifiStartMessage::SetPanePosition
+807f8c34 CtrlRaceWifiStartMessage::OnUpdate
+807f8c44 CtrlRaceWifiFinishMessage::GetClassName
+807f8c54 CtrlRaceWifiFinishMessage::Load
+807f8d08 CtrlRaceWifiFinishMessage::HasStarted
+807f8d88 CtrlRaceWifiFinishMessage::IsInactive
+807f8d90 CtrlRaceWifiFinishMessage::SetPanePosition
+807f8f8c CtrlRaceWifiFinishMessage::OnUpdate
+807f8f9c CtrlRaceWaitSymbol::GetClassName
+807f8fac CtrlRaceWaitSymbol::Load
+807f9068 CtrlRaceWaitSymbol::HasStarted
+807f909c CtrlRaceWaitSymbol::IsInactive
+807f90ac CtrlRaceWaitSymbol::SetPanePosition
+807f90f8 CtrlRaceWaitSymbol::OnUpdate
+807f9108 CtrlRaceWaitSymbol::GetPane
+807f9110 CtrlRaceWaitSymbol::__dt
+807f916c CtrlRaceWaitSymbol::GetRuntimeTypeInfo
+807f9178 CtrlRaceWifiFinishMessage::GetPane
+807f9180 CtrlRaceWifiFinishMessage::__dt
+807f91dc CtrlRaceWifiFinishMessage::GetRuntimeTypeInfo
+807f91e8 CtrlRaceWifiStartMessage::GetPane
+807f91f0 CtrlRaceWifiStartMessage::__dt
+807f924c CtrlRaceWifiStartMessage::GetRuntimeTypeInfo
+807f9258 CtrlRaceWifi_cpp_sinit_
+807f9278 GeoHitTableHolder::__ct
+807f9348 GeoHitTableHolder::__dt
+807f9388 Objects::Airblock::__ct
+807f9424 Objects::Airblock::__ct(Vec3s)
+807f94cc Objects::Airblock::OnStart
+807f957c ObjectCollisionPolyhedra::GetRadius
+807f9584 Objects::Airblock::LoadCollision
+807f96a4 Objects::Airblock::UpdateCollision
+807f9770 Objects::Airblock::vf_0xb4
+807f983c Objects::Airblock::GetCollisionDiameter
+807f9864 Objects::Airblock::IsCollidingNoTerrainInfo
+807f9868 Objects::Airblock::IsCollidingAddEntryNoTerrainInfo
+807f986c Objects::Airblock::vf_0xfc
+807f9870 Objects::Airblock::IsCollidingAddEntry
+807f9874 Objects::Airblock::IsCollidingNoTerrainInfoNoTriangleCheck(no radius)
+807f9884 Objects::Airblock::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck(no radius)
+807f9894 Objects::Airblock::IsColliding(no radius)
+807f98a4 Objects::Airblock::IsCollidingNoTriangleCheck(no radius)
+807f98b4 Objects::Airblock::IsCollidingNoTerrainInfoNoTriangleCheck
+807f98b8 Objects::Airblock::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+807f98bc Objects::Airblock::IsColliding
+807f98c0 Objects::Airblock::IsCollidingNoTriangleCheck
+807f98c4 Objects::Airblock::vf_0xc0
+807f98d4 Objects::Airblock::vf_0xc4
+807f98e4 Objects::Airblock::vf_0xc8
+807f98f4 Objects::Airblock::vf_0xcc
+807f9904 Objects::Airblock::Update
+807f9908 Objects::Airblock::GetPropertiesBitfield
+807f9910 Objects::Airblock::__dt
+807f9950 Objects::Airblock::IsCollidingNoTerrainInfoImpl
+807f9c14 Objects::Airblock::IsCollidingAddEntryNoTerrainInfoImplImpl
+807f9ef8 0x807f9ef8
+807fa51c Objects::Airblock::IsCollidingAddEntryImpl
+807fab58 Objects::Aurora::__ct
+807fabc4 Objects::Aurora::OnStart
+807fac84 Objects::Aurora::Update
+807faf10 0x807faf10
+807faffc 0x807faffc
+807fb060 0x807fb060
+807fb33c Objects::Aurora::CalcOtherEntityDistance
+807fb39c Objects::Aurora::UpdateOtherEntityPosWithRot
+807fb520 Objects::Aurora::vf_0x11c
+807fb528 Objects::Aurora::vf_0x108
+807fb534 Objects::Aurora::AreItemsAllowed
+807fb53c Objects::Aurora::IsCollidingNoTerrainInfo
+807fb540 Objects::Aurora::IsCollidingAddEntryNoTerrainInfo
+807fb544 Objects::Aurora::vf_0xfc
+807fb548 Objects::Aurora::IsCollidingAddEntry
+807fb54c Objects::Aurora::IsCollidingNoTerrainInfoNoTriangleCheck(no radius)
+807fb55c Objects::Aurora::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck(no radius)
+807fb56c Objects::Aurora::IsColliding(no radius)
+807fb57c Objects::Aurora::IsCollidingNoTriangleCheck(no radius)
+807fb58c Objects::Aurora::IsCollidingNoTerrainInfoNoTriangleCheck
+807fb590 Objects::Aurora::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+807fb594 Objects::Aurora::IsColliding
+807fb598 Objects::Aurora::IsCollidingNoTriangleCheck
+807fb59c Objects::Aurora::vf_0xc0
+807fb5ac Objects::Aurora::vf_0xc4
+807fb5bc Objects::Aurora::vf_0xc8
+807fb5cc Objects::Aurora::vf_0xc8
+807fb5dc Objects::Aurora::GetCollisionDiameter
+807fb5f0 Objects::Aurora::LoadAnimations
+807fb67c Objects::Aurora::vf_0xb4
+807fb680 Objects::Aurora::UpdateCollision
+807fb684 Objects::Aurora::LoadCollision
+807fb688 Objects::Aurora::GetPropertiesBitfield
+807fb690 Objects::Aurora::__dt
+807fb6d0 Objects::Aurora::IsCollidingNoTerrainInfoImpl
+807fb8b0 Objects::Aurora::IsCollidingAddEntryNoTerrainInfoImpl
+807fbac0 0x807fbac0
+807fbe6c Objects::Aurora::IsCollidingAddEntryImpl
+807fc248 0x807fc248
+807fc294 Objects::Belt::vf_0x120
+807fc578 Objects::BeltEasy::__ct
+807fc5ec Objects::Belt::__dt
+807fc62c Objects::BeltEasy::vf_0x124
+807fc6c8 Objects::BeltEasy::vf_0x128
+807fc764 Objects::BeltCrossing::__ct
+807fc7d8 Objects::BeltCrossing::vf_0x124
+807fc874 Objects::BeltCrossing::vf_0x128
+807fc90c Objects::BeltCurveA::__ct
+807fc9d4 Objects::BeltCurveA::vf_0x124
+807fcca4 Objects::BeltCurveA::vf_0x128
+807fccfc Objects::BeltCurveA::LoadModels
+807fcde8 Objects::BeltCurveA::LoadAnimations
+807fd0e8 Objects::BeltCurveA::UpdateModelMatrix
+807fd1ac Objects::BeltCurveA::OnStart
+807fd1b4 Objects::BeltCurveA::Update
+807fd38c Objects::BeltCurveA::vf_0x12c
+807fd5a0 0x807fd5a0
+807fd66c 0x807fd66c
+807fd6a4 Objects::Belt::vf_0x11c
+807fd6ac Objects::Belt::UpdateOtherEntityPosWithRot
+807fd6b0 Objects::Belt::UpdateOtherEntityPos
+807fd6b4 Objects::Belt::CalcOtherEntityDistance
+807fd6b8 Objects::Belt::vf_0x108
+807fd6c4 Objects::Belt::AreItemsAllowed
+807fd6cc Objects::Belt::IsCollidingNoTerrainInfo
+807fd6d4 Objects::Belt::IsCollidingAddEntryNoTerrainInfo
+807fd6dc Objects::Belt::vf_0xfc
+807fd6e4 Objects::Belt::IsCollidingAddEntry
+807fd6f4 Objects::Belt::IsCollidingNoTerrainInfoNoTriangleCheck(no radius)
+807fd6fc Objects::Belt::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck(no radius)
+807fd704 Objects::Belt::IsColliding(no radius)
+807fd70c Objects::Belt::IsCollidingAddEntryNoTriangleCheck(no radius)
+807fd728 Objects::Belt::IsCollidingNoTerrainInfoNoTriangleCheck
+807fd730 Objects::Belt::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+807fd738 Objects::Belt::IsColliding
+807fd740 Objects::Belt::vf_0xc0
+807fd750 0x807fd750
+807fd758 Objects::Belt::vf_0xc4
+807fd760 Objects::Belt::vf_0xc8
+807fd768 Objects::Belt::vf_0xcc
+807fd784 Objects::Belt::GetCollisionDiameter
+807fd790 Objects::Belt::vf_0xb4
+807fd794 Objects::Belt::UpdateCollision
+807fd798 Objects::Belt::LoadCollision
+807fd79c Objects::Belt::GetPropertiesBitfield
+807fd7a4 Objects::BeltCurveA::SetObjInfoCalcBit
+807fd7b4 Objects::BeltCurveA::GetScnObjDrawOptionsIdx
+807fd7bc Objects::BeltCurveA::__dt
+807fd7fc Objects::Belt::SetObjInfoCalcBit
+807fd80c Objects::Belt::vf_0x12c
+807fd860 Objects::Belt::LoadAnimations
+807fd8a0 Objects::BeltCrossing::GetScnObjDrawOptionsIdx
+807fd8a8 Objects::BeltCrossing::__dt
+807fd8e8 Objects::BeltEasy::GetScnObjDrawOptionsIdx
+807fd8f0 Objects::BeltEasy::__dt
+807fd930 Objects::Belt::GetScnObjDrawOptionsIdx
+807fd938 0x807fd938
+807fda18 0x807fda18
+807fdae4 0x807fdae4
+807fdc50 0x807fdc50
+807fde5c 0x807fde5c
+807fdfb4 0x807fdfb4
+807fdfdc 0x807fdfdc
+807fe03c 0x807fe03c
+807fe2cc 0x807fe2cc
+807fe364 0x807fe364
+807fe4fc 0x807fe4fc
+807fe52c 0x807fe52c
+807fe534 0x807fe534
+807fe5e8 0x807fe5e8
+807fe5f0 0x807fe5f0
+807fe630 0x807fe630
+807fe658 Objects::Crane::__ct
+807fe7ec Objects::Crane::Update
+807fea58 ObjectExternKCL::vf_0x11c
+807fea60 ObjectExternKCL::CalcOtherEntityDistance
+807feac0 ObjectExternKCL::GetTransformationMatrix
+807feaf0 Objects::Crane::GetPeriod
+807feb20 Objects::Crane::GetPropertiesBitfield
+807feb28 Objects::Crane::__dt
+807feb68 0x807feb68
+807fec30 0x807fec30
+807fed5c 0x807fed5c
+807fed80 0x807fed80
+807fefd8 0x807fefd8
+807ff17c 0x807ff17c
+807ff59c 0x807ff59c
+807ff83c 0x807ff83c
+807ff90c 0x807ff90c
+807ff980 0x807ff980
+807ff98c 0x807ff98c
+807ffa24 0x807ffa24
+807ffa2c 0x807ffa2c
+807ffa34 0x807ffa34
+807ffa74 0x807ffa74
+807ffa80 0x807ffa80
+807ffa88 0x807ffa88
+807ffa94 0x807ffa94
+807ffaa0 0x807ffaa0
+807ffae0 0x807ffae0
+807ffb20 0x807ffb20
+807ffdd4 0x807ffdd4
+80800000 0x80800000
+80800100 0x80800100
+808007d8 0x808007d8
+808008fc 0x808008fc
+80800a10 0x80800a10
+80800abc 0x80800abc
+80800fbc 0x80800fbc
+808011cc 0x808011cc
+808014ac 0x808014ac
+8080178c 0x8080178c
+808019f8 0x808019f8
+80801bb4 0x80801bb4
+808027a4 0x808027a4
+808029ac 0x808029ac
+80802c70 0x80802c70
+80802c78 0x80802c78
+80802d00 0x80802d00
+80802d0c 0x80802d0c
+80802d18 0x80802d18
+80802d20 0x80802d20
+80802d60 0x80802d60
+80802d68 0x80802d68
+80802d6c 0x80802d6c
+80802d70 0x80802d70
+80802d80 0x80802d80
+80802d84 0x80802d84
+80802d90 0x80802d90
+80802d98 0x80802d98
+80802da0 0x80802da0
+80802ee0 0x80802ee0
+80803020 0x80803020
+80803160 0x80803160
+80803170 0x80803170
+80803264 0x80803264
+80803358 0x80803358
+8080344c 0x8080344c
+80803540 0x80803540
+80803680 0x80803680
+808037c0 0x808037c0
+80803900 0x80803900
+80803910 0x80803910
+80803a04 0x80803a04
+80803af8 0x80803af8
+80803bec 0x80803bec
+80803ce0 0x80803ce0
+80803cec 0x80803cec
+80803cf0 0x80803cf0
+80803cf8 0x80803cf8
+80803d00 0x80803d00
+80803d40 Objects::bblock::__ct
+80803da8 Objects::VolcanoPiece::__dt
+80803de8 Objects::bblock::LoadModels
+80803f6c Objects::VolcanoPiece::GetSubFileName
+80803f74 Objects::bblock::OnStart
+80803fcc Objects::bblock::UpdateModelMatrix
+80804054 Objects::bblock::LoadAnimations
+80804108 Objects::bblock::LoadCollision
+808043c0 Objects::bblock::GetBRRESName
+808043cc Objects::bblock::SetCollisionType
+80804418 Objects::bblock::Init_eAnm
+808044c0 Objects::VolcanoPiece::UpdateKCL
+808045a8 Objects::VolcanoPiece::SetCollisionType
+808045ac Objects::VolcanoPiece::IsCollidingNoTerrainInfo
+80804730 Objects::VolcanoPiece::IsCollidingAddEntryNoTerrainInfo
+808048b4 Objects::VolcanoPiece::vf_0xfc
+80804a38 Objects::VolcanoPiece::IsCollidingAddEntry
+80804a48 Objects::VolcanoPiece::IsCollidingNoTerrainInfoNoTriangleCheck(no radius)
+80804b90 Objects::VolcanoPiece::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck(no radius)
+80804cd8 Objects::VolcanoPiece::IsColliding(no radius)
+80804e20 Objects::VolcanoPiece::IsCollidingAddEntryNoTriangleCheck(no radius)
+80804f68 Objects::VolcanoPiece::IsCollidingNoTerrainInfoNoTriangleCheck
+808050ec Objects::VolcanoPiece::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+80805270 Objects::VolcanoPiece::IsColliding
+808053f4 Objects::VolcanoPiece::IsCollidingAddEntryNoTriangleCheck
+80805404 Objects::VolcanoPiece::vf_0xc0
+8080554c Objects::VolcanoPiece::vf_0xc4
+80805694 Objects::VolcanoPiece::vf_0xc8
+808057dc Objects::VolcanoPiece::vf_0xcc
+80805924 Objects::VolcanoPiece::UpdateDiffPosVector
+8080595c Objects::VolcanoPiece::GetTransformationMatrix
+80805974 Objects::VolcanoPiece::GetPropertiesBitfield
+8080597c Objects::bblock::UpdateModelScale
+80805a0c Objects::bblock::__dt
+80805a4c Objects::DKturibashiGCc::__ct
+80805ad8 Objects::DKturibashiGCc::OnStart
+80805c24 Objects::DKturibashiGCc::Update
+80805e64 0x80805e64
+80805f44 0x80805f44
+808060d4 Objects::DKturibashiGCc::UpdateOtherEntityPos
+80806268 Objects::DKturibashiGCc::UpdateOtherEntityPosWithRot
+8080642c Objects::DKturibashiGCc::vf_0x11c
+80806434 Objects::DKturibashiGCc::vf_0x108
+80806440 Objects::DKturibashiGCc::AreItemsAllowed
+80806448 Objects::DKturibashiGCc::IsCollidingAddEntryNoTerrainInfo
+8080644c Objects::DKturibashiGCc::IsCollidingAddEntryNoTerrainInfo
+80806450 Objects::DKturibashiGCc::vf_0xfc
+80806454 Objects::DKturibashiGCc::IsCollidingAddEntry
+80806458 Objects::DKturibashiGCc::IsCollidingNoTerrainInfo(no radius)
+80806468 Objects::DKturibashiGCc::IsCollidingAddEntryNoTerrainInfo(no radius)
+80806478 Objects::DKturibashiGCc::vf_0xec(no radius)
+80806488 Objects::DKturibashiGCc::IsCollidingAddEntry(no radius)
+80806498 Objects::DKturibashiGCc::IsCollidingNoTerrainInfoNoTriangleCheck
+8080649c Objects::DKturibashiGCc::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+808064a0 Objects::DKturibashiGCc::IsColliding
+808064a4 Objects::DKturibashiGCc::IsCollidingNoTriangleCheck
+808064a8 Objects::DKturibashiGCc::vf_0xc0
+808064b8 Objects::DKturibashiGCc::vf_0xc4
+808064c8 Objects::DKturibashiGCc::vf_0xc8
+808064d8 Objects::DKturibashiGCc::vf_0xcc
+808064e8 Objects::DKturibashiGCc::GetCollisionDiameter
+808064fc Objects::DKturibashiGCc::LoadAnimations
+80806500 Objects::DKturibashiGCc::vf_0xb4
+80806504 Objects::DKturibashiGCc::UpdateCollision
+80806508 0x80806508
+8080650c Objects::DKturibashiGCc::GetPropertiesBitfield
+80806514 Objects::DKturibashiGCc::__dt
+80806554 0x80806554
+808068a0 0x808068a0
+80806c24 0x80806c24
+80807110 Objects::DKturibashiGCc::IsCollidingImpl
+8080761c Objects::Kinoko::__ct
+808077ec Objects::Kinoko::OnStart
+8080782c Objects::Kinoko::Update
+80807950 Objects::Kinoko_ud::__ct
+80807a14 Objects::Kinoko::__dt
+80807a54 Objects::Kinoko_ud::UpdateSpecific
+80807b7c Objects::Kinoko_bend::__ct
+80807c98 Objects::Kinoko_bend::UpdateSpecific
+80807d84 Objects::Kinoko::vf_0xb4
+80807d88 Objects::Kinoko::SetYScale
+80807d8c Objects::Kinoko::GetSubFileName
+80807dac Objects::Kinoko::GetPropertiesBitfield
+80807db4 Objects::Kinoko_bend::__dt
+80807df4 0x80807df4
+80807df8 Objects::Kinoko_ud::SetYScale
+80807dfc Objects::Kinoko_ud::GetSubFileName
+80807e1c Objects::Kinoko_ud::__dt
+80807e5c Objects::Kinoko_kuki::vf_0xec
+80807e60 Objects::Kinoko_kuki::vf_0xf0
+80807e64 Objects::Kinoko_kuki::GetSubFileName
+80807e84 Objects::Kinoko_kuki::UpdateModelScale
+80807e88 Objects::Kinoko_kuki::GetPropertiesBitfield
+80807e90 Objects::Kinoko_kuki::__dt
+80807ed0 ObjAmi_construct
+80807f40 0x80807f40
+80807ff4 0x80807ff4
+80808080 0x80808080
+80808220 0x80808220
+80808308 0x80808308
+80808578 0x80808578
+808085bc 0x808085bc
+8080861c 0x8080861c
+80808784 0x80808784
+8080878c 0x8080878c
+80808798 0x80808798
+808087a0 0x808087a0
+808087a4 0x808087a4
+808087a8 0x808087a8
+808087ac 0x808087ac
+808087b0 0x808087b0
+808087c0 0x808087c0
+808087d0 0x808087d0
+808087e0 0x808087e0
+808087f0 0x808087f0
+808087f4 0x808087f4
+808087f8 0x808087f8
+808087fc 0x808087fc
+80808800 0x80808800
+80808810 0x80808810
+80808820 0x80808820
+80808830 0x80808830
+80808840 0x80808840
+8080884c 0x8080884c
+80808850 0x80808850
+80808854 0x80808854
+80808858 0x80808858
+80808860 0x80808860
+808088a0 0x808088a0
+80808a8c 0x80808a8c
+80808ca8 0x80808ca8
+80809060 0x80809060
+80809448 Objects::TownBridgeDS::__ct
+808095b8 Objects::TownBridgeDS::LoadCollision
+80809774 Objects::TownBridgeDS::Update
+80809cdc 0x80809cdc
+80809fc4 0x80809fc4
+8080a01c 0x8080a01c
+8080a0f0 Objects::TownBridgeDS::CalcOtherEntityDistance
+8080a4ac Objects::TownBridgeDS::UpdateOtherEntityPosWithRot
+8080a8b4 Objects::TownBridgeDS::vf_0x11c
+8080a8bc Objects::TownBridgeDS::vf_0x108
+8080a8c8 Objects::TownBridgeDS::AreItemsAllowed
+8080a8d0 Objects::TownBridgeDS::GetPeriod
+8080a8dc Objects::TownBridgeDS::LoadAnimations
+8080a964 Objects::TownBridgeDS::GetTransformationMatrix
+8080acd8 Objects::TownBridgeDS::GetPropertiesBitfield
+8080ace0 Objects::TownBridgeDS::__dt
+8080ad20 0x8080ad20
+8080b0d8 obj_obakeblockSFC::__ct
+8080b244 0x8080b244
+8080b318 0x8080b318
+8080b564 0x8080b564
+8080b578 0x8080b578
+8080bb28 0x8080bb28
+8080bc64 0x8080bc64
+8080bdc0 Object::GetCollisionDiameter
+8080bdcc 0x8080bdcc
+8080bdd4 0x8080bdd4
+8080bdd8 0x8080bdd8
+8080bddc 0x8080bddc
+8080bde0 0x8080bde0
+8080bde4 0x8080bde4
+8080bde8 0x8080bde8
+8080bdec 0x8080bdec
+8080bdf0 0x8080bdf0
+8080bdf4 0x8080bdf4
+8080be04 0x8080be04
+8080be14 0x8080be14
+8080be24 0x8080be24
+8080be34 0x8080be34
+8080be38 0x8080be38
+8080be3c 0x8080be3c
+8080be40 0x8080be40
+8080be44 0x8080be44
+8080be54 0x8080be54
+8080be64 0x8080be64
+8080be74 0x8080be74
+8080be84 0x8080be84
+8080be90 0x8080be90
+8080be94 0x8080be94
+8080be98 0x8080be98
+8080be9c 0x8080be9c
+8080bea4 0x8080bea4
+8080bee4 0x8080bee4
+8080c414 ObjectCollisionPolyhedra::SetRadius
+8080c41c 0x8080c41c
+8080c980 0x8080c980
+8080d12c 0x8080d12c
+8080d8fc 0x8080d8fc
+8080d970 0x8080d970
+8080d9a8 0x8080d9a8
+8080d9b4 0x8080d9b4
+8080d9c0 0x8080d9c0
+8080d9cc 0x8080d9cc
+8080da30 0x8080da30
+8080da94 0x8080da94
+8080db08 0x8080db08
+8080dd74 0x8080dd74
+8080ded0 obj_quicksand::__ct
+8080e0e8 0x8080e0e8
+8080e64c 0x8080e64c
+8080edac 0x8080edac
+8080f04c 0x8080f04c
+8080f23c 0x8080f23c
+8080f840 0x8080f840
+8080fe44 0x8080fe44
+80810000 0x80810000
+80810148 0x80810148
+80810170 0x80810170
+80810558 0x80810558
+80810560 0x80810560
+8081056c 0x8081056c
+80810574 0x80810574
+80810578 0x80810578
+8081057c 0x8081057c
+80810580 0x80810580
+80810584 0x80810584
+80810594 0x80810594
+808105a4 0x808105a4
+808105b4 0x808105b4
+808105c4 0x808105c4
+808105c8 0x808105c8
+808105cc 0x808105cc
+808105d0 0x808105d0
+808105d4 0x808105d4
+808105e4 0x808105e4
+808105f4 0x808105f4
+80810604 0x80810604
+80810614 0x80810614
+80810628 0x80810628
+80810690 0x80810690
+8081069c 0x8081069c
+808106a8 0x808106a8
+808106ac 0x808106ac
+808106b0 0x808106b0
+808106b4 0x808106b4
+808106bc 0x808106bc
+808106fc 0x808106fc
+80810708 0x80810708
+80810714 0x80810714
+8081071c 0x8081071c
+80810724 0x80810724
+80810780 0x80810780
+80810bbc 0x80810bbc
+80811024 0x80811024
+80811720 0x80811720
+80811e48 0x80811e48
+80811f88 0x80811f88
+80812180 0x80812180
+80812188 0x80812188
+808122fc 0x808122fc
+80812384 0x80812384
+8081247c 0x8081247c
+80812848 0x80812848
+80812850 0x80812850
+80812b80 0x80812b80
+80812e48 0x80812e48
+808131f8 0x808131f8
+808135f4 0x808135f4
+808136ec 0x808136ec
+80813ae4 0x80813ae4
+80813af0 0x80813af0
+80813b80 0x80813b80
+80813b8c 0x80813b8c
+80813b94 0x80813b94
+80813bd4 Objects::TwistedWay::__ct
+80813c40 Objects::TwistedWay::OnStart
+80813cfc Objects::TwistedWay::Update
+80813f40 0x80813f40
+80814020 0x80814020
+80814130 0x80814130
+80814270 0x80814270
+80814428 Objects::TwistedWay::CalcOtherEntityDistance
+808145d8 Objects::TwistedWay::UpdateOtherEntityPosWithRot
+808147a8 0x808147a8
+8081483c Objects::TwistedWay::vf_0x11c
+80814844 Objects::TwistedWay::vf_0x108
+80814850 Objects::TwistedWay::AreItemsAllowed
+80814858 Objects::TwistedWay::IsCollidingNoTerrainInfo
+8081485c Objects::TwistedWay::IsCollidingAddEntryNoTerrainInfo
+80814860 Objects::TwistedWay::vf_0xfc
+80814864 Objects::TwistedWay::IsCollidingAddEntry
+80814868 Objects::TwistedWay::IsCollidingNoTerrainInfoNoTriangleCheck(no radius)
+80814878 Objects::TwistedWay::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck(no radius)
+80814888 Objects::TwistedWay::IsColliding(no radius)
+80814898 Objects::TwistedWay::IsCollidingAddEntryNoTriangleCheck(no radius)
+808148a4 0x808148a4
+808148a8 Objects::TwistedWay::IsCollidingNoTerrainInfoNoTriangleCheck
+808148ac Objects::TwistedWay::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+808148b0 Objects::TwistedWay::IsColliding
+808148b4 Objects::TwistedWay::IsCollidingAddEntryNoTriangleCheck
+808148b8 Objects::TwistedWay::vf_0xc0
+808148c8 Objects::TwistedWay::vf_0xc4
+808148d8 Objects::TwistedWay::vf_0xc8
+808148e8 Objects::TwistedWay::vf_0xcc
+808148f8 Objects::TwistedWay::GetCollisionDiameter
+80814900 Objects::TwistedWay::LoadAnimations
+80814904 Objects::TwistedWay::vf_0xb4
+80814908 Objects::TwistedWay::UpdateCollision
+8081490c Objects::TwistedWay::LoadCollision
+80814910 Objects::TwistedWay::GetPropertiesBitfield
+80814918 Objects::TwistedWay::__dt
+80814958 0x80814958
+80814ea8 0x80814ea8
+80815444 0x80815444
+80815d64 Objects::TwistedWay::IsCollidingImpl
+808166d0 obj_venice_hasi::__ct
+808168ac 0x808168ac
+808169e0 0x808169e0
+80816ae4 0x80816ae4
+80816f38 0x80816f38
+8081719c 0x8081719c
+80817308 0x80817308
+808173cc 0x808173cc
+80817578 0x80817578
+808176e0 0x808176e0
+80817894 0x80817894
+8081789c 0x8081789c
+808178a0 0x808178a0
+808178a4 0x808178a4
+808178b0 0x808178b0
+808178b8 0x808178b8
+808178c4 0x808178c4
+808178d4 0x808178d4
+808178dc 0x808178dc
+808178e4 0x808178e4
+80817924 ObjSaku_construct
+808179cc 0x808179cc
+80817c60 0x80817c60
+80817da0 0x80817da0
+80817da8 0x80817da8
+80817de8 Objects::VolcanoPiece::__ct
+80817f6c Objects::VolcanoPiece::LoadCollision
+80818334 Objects::VolcanoPiece::UpdateCollisionPosition
+80818674 Objects::VolcanoPiece::SetYScale
+808187b4 Objects::VolcanoPiece::GetTransformationMatrixImpl
+80818fcc 0x80818fcc
+80819028 0x80819028
+80819114 0x80819114
+808193fc Objects::VolcanoPiece::Init_eAnm
+80819400 Objects::VolcanoPiece::Update
+808199a8 Objects::VolcanoPiece::IsCollidingAddEntryNoTriangleCheckImpl
+80819da0 Objects::VolcanoPiece::IsCollidingImpl
+8081a198 Objects::VolcanoRock1::__ct
+8081a370 Objects::VolcanoRock1::Update
+8081a414 Objects::VolcanoRock1::CalcTranslation
+8081a5d0 Objects::VolcanoRock1::GetPeriod
+8081a60c Objects::VolcanoRock1::GetTransformationMatrix
+8081a668 Objects::VolcanoRock1::GetSubFileName
+8081a688 Objects::VolcanoRock1::GetPropertiesBitfield
+8081a690 Objects::VolcanoRock1::__dt
+8081a6d0 ObjectKCL::__ct
+8081a714 ObjectKCL::__ct(Vec3s, objId)
+8081a758 ObjectKCL::__ct(Vec3s, name)
+8081a79c ObjectKCL::Init
+8081a85c ObjectKCL::RegisterEntity
+8081a8d0 ObjectKCL::UpdateModel
+8081a980 ObjectExternKCL::__ct
+8081a9c8 0x8081a9c8
+8081aa10 0x8081aa10
+8081aa58 ObjectExternKCL::LoadCollision
+8081ab4c ObjectExternKCL::InitCollision
+8081ad6c ObjectExternKCL::UpdateCollisionPosition
+8081af28 ObjectExternKCL::SetYScale
+8081afb4 ObjectExternKCL::IsCollidingAddEntryNoTriangleCheckImpl
+8081b16c ObjectExternKCL::IsCollidingImpl
+8081b324 ObjectsKCLMgr::__ct
+8081b380 ObjectsKCLMgr::__dt
+8081b428 ObjectsKCLMgr::CreateInstance
+8081b4b0 ObjectsKCLMgr::DestroyInstance
+8081b500 ObjectsKCLMgr::Init
+8081b5a8 0x8081b5a8
+8081b618 ObjectsKCLMgr::Update
+8081b6c8 ObjectsKCLMgr::AddObject
+8081b7cc ObjectsKCLMgr::UpdateKCL
+8081b870 0x8081b870
+8081b940 0x8081b940
+8081ba10 0x8081ba10
+8081bb54 0x8081bb54
+8081bc98 ObjectsKCLMgr::IsCollidingNoTerrainInfoNoTriangleCheck
+8081bd70 ObjectsKCLMgr::IsCollidingAddEntryNoTerrainInfoNoTriangleCheck
+8081be48 ObjectsKCLMgr::IsColliding
+8081bfa0 ObjectsKCLMgr::IsCollidingAddEntryNoTriangleCheck
+8081c0f8 0x8081c0f8
+8081c1e8 0x8081c1e8
+8081c2d8 0x8081c2d8
+8081c43c 0x8081c43c
+8081c5a0 ObjectsKCLMgr::IsCollidingNoTerrainInfo
+8081c6b4 ObjectsKCLMgr::IsCollidingAddEntryNoTerrainInfo
+8081c7c8 0x8081c7c8
+8081c958 ObjectsKCLMgr::IsCollidingAddEntry
+8081cae8 0x8081cae8
+8081cb70 GetKartWeightClass
+8081cd3c GetCharacterWeightClass
+8081ceb0 0x8081ceb0
+8081cef4 CharacterIdToKartIdByIdx
+8081cf70 0x8081cf70
+8081cfac 0x8081cfac
+8081cfb4 IsKartUnlocked
+8081d020 IsCharacterUnlocked
+8081d028 0x8081d028
+8081d05c 0x8081d05c
+8081d090 KartObjectCollision::Init
+8081d0f8 KartObjectCollision::Init_switch
+8081d0fc KartObjectCollision::Init_case1
+8081d16c KartObjectCollision::Init_case0
+8081d1b8 KartObjectCollision::Init_case2
+8081d22c KartObjectCollision::Init_case3
+8081d29c KartObjectCollision::Init_case6
+8081d2fc KartObjectCollision::Init_case9
+8081d358 KartObjectCollision::Init_casec
+8081d3d4 KartObjectCollision::Init_casef
+8081d430 KartObjectCollision::Init_case4
+8081d4b0 KartObjectCollision::Init_case7
+8081d524 KartObjectCollision::Init_casea
+8081d58c KartObjectCollision::Init_cased
+8081d610 KartObjectCollision::Init_case10
+8081d690 KartObjectCollision::Init_case5
+8081d718 KartObjectCollision::Init_case8
+8081d798 KartObjectCollision::Init_caseb
+8081d818 KartObjectCollision::Init_casee
+8081d89c KartObjectCollision::Init_case11
+8081d93c KartObjectCollision::Init_case12
+8081d998 KartObjectCollision::Init_case13
+8081d9f4 KartObjectCollision::Init_case14
+8081da54 KartObjectCollision::Init_case15
+8081dab4 KartObjectCollision::Init_case18
+8081db14 KartObjectCollision::Init_case1b
+8081db70 KartObjectCollision::Init_case1e
+8081dbcc KartObjectCollision::Init_case21
+8081dc2c KartObjectCollision::Init_case16
+8081dc8c KartObjectCollision::Init_case19
+8081dce8 KartObjectCollision::Init_case1c
+8081dd44 KartObjectCollision::Init_case1f
+8081dda4 KartObjectCollision::Init_case22
+8081de04 KartObjectCollision::Init_case17
+8081de64 KartObjectCollision::Init_case1a
+8081dedc KartObjectCollision::Init_case1d
+8081df3c KartObjectCollision::Init_case20
+8081df9c KartObjectCollision::Init_case23
+8081e0cc KartObjectCollision::__ct
+8081e0e4 KartObjectCollision::__dt
+8081e170 KartObjectCollision::Update
+8081e254 ObjectCollisionPolyhedra::GetDefaultDiameter
+8081e25c 0x8081e25c
+8081e284 MenuModelBRRESHandle::__ct
+8081e29c MenuModelBRRESHandle::__dt
+8081e2dc 0x8081e2dc
+8081e358 MenuModelBRRESHandle::BindDriverBRRES
+8081e548 MenuModelBRRESHandle::BindKartBRRES
+8081e658 MenuModelBRRESHandle::BindBackBRRES
+8081e74c DriverModelAnmCalculator::__dt
+8081e78c MenuModelBRRESHandle::LoadDriverModel
+8081eac4 MenuModelBRRESHandle::LinkDriverAnim
+8081edc0 MenuModelBRRESHandle::LoadKartModel
+8081ef14 MenuModelBRRESHandle::LoadBackModel
+8081efdc MenuModelBRRESHandle::MdlExists
+8081efec ObjectCollidable::__ct(GOBJ)
+8081f028 ObjectCollidable::::__ct(Vec3s, objId)
+8081f064 ObjectCollidable::::__ct(Vec3s, name)
+8081f0a0 ObjectCollidable::Init
+8081f170 ObjectCollidable::RegisterManagedObject
+8081f180 ObjectCollidable::RegisterEntity
+8081f224 ObjectCollidable::LoadCollision
+8081f548 ObjectCollidable::OnNormalCollision
+8081f5d8 ObjectCollidable::OnWallCollision
+8081f66c ObjectCollidable::BeforeKartCollision
+8081f778 ObjectCollidable::BeforeItemCollision
+8081f7c8 ObjectCollidable::UpdateCollision
+8081f828 Object::__ct
+8081f9bc Object::__ct(Vec3s, objId)
+8081fb04 Object::__ct(Vec3s, name)
+8081fc68 Object::OnStart
+8081fcec Object::LoadModels
+8081fd00 Object::LoadModels(r4)
+8081fd10 Object::LoadGraphics
+80820360 Object::LoadSound
+808204b8 Object::LinkSound
+808204fc Object::StartSoundLimited
+8082051c Object::HoldSoundLimited
+8082053c Object::StartNewSoundLimited
+8082055c Object::StartSound
+8082057c Object::HoldSound
+8082059c Object::StopAllSound
+808205bc Object::StopSound
+808205dc Object::LoadShadow
+8082072c Object::LoadAnimations
+80820874 0x80820874
+80820980 Object::LoadRoute
+80820a90 Object::LoadAnimationsByType
+80820eb8 Object::LinkAnimations
+80821070 Object::LoadClipInfo
+80821640 Object::UpdateMatrix
+808216c0 Object::ToggleVisible
+80821738 0x80821738
+808217b0 0x808217b0
+808217b8 Object::UpdateModel
+808218b0 Object::CalcYAxisTransMtx
+80821910 0x80821910
+80821974 Object::UpdateShadow
+80821a9c Object::UpdateModelMatrix
+80821b68 0x80821b68
+80821db8 Object::vf_0x88
+80821dd8 Object::vf_0x8c
+80821dec Object::DisableCollision
+80821e00 Object::EnableCollision
+80821e14 ObjectsMgr::CreateObject
+80826940 0x80826940
+80826e8c ObjectsMgr::CreateAllObjects
+80827a68 Objects::Kinoko_nm::GetPeriod
+80827a74 Objects::Kinoko_nm::GetSubFileName
+80827a94 Objects::Kinoko_nm::GetPropertiesBitfield
+80827a9c Objects::Kinoko_nm::__dt
+80827adc 0x80827adc
+80827aec 0x80827aec
+80827bcc 0x80827bcc
+80827c0c 0x80827c0c
+80827c14 0x80827c14
+80827c78 0x80827c78
+80827cb8 0x80827cb8
+80827cc8 0x80827cc8
+80827d08 0x80827d08
+80827d10 0x80827d10
+80827d50 0x80827d50
+80827d58 0x80827d58
+80827d98 0x80827d98
+80827dd8 0x80827dd8
+80827e18 0x80827e18
+80827e58 0x80827e58
+80827f74 0x80827f74
+808280e4 0x808280e4
+80828158 0x80828158
+8082840c 0x8082840c
+80828428 0x80828428
+80828440 0x80828440
+80828564 0x80828564
+80828568 0x80828568
+80828570 0x80828570
+808285b0 Objects::Itembox::__ct
+8082876c Objects::Itembox::__ct(position)
+80828860 Objects::Itembox::Update
+80828cb8 Objects::Itembox::OnCollision
+80828f44 Objects::F_Itembox::__ct
+80828f98 Objects::F_Itembox::OnStart
+80829074 Objects::F_Itembox::Update
+80829208 Objects::S_Itembox::__ct
+80829280 Objects::S_Itembox::OnStart
+8082945c Objects::S_Itembox::Update
+80829584 Objects::S_Itembox::__dt
+808295c4 Objects::F_Itembox::__dt
+80829604 0x80829604
+8082963c Objects::Heyho2::__ct
+808296f8 Objects::Heyho2::OnStart
+80829764 Objects::Heyho2::Lift::__ct
+808298dc Objects::Heyho2::Lift::OnStart
+80829aa4 Objects::Heyho2::Lift::Update
+80829c98 Objects::Heyho2::Lift::UpdateModelMatrix
+80829d68 Objects::Heyho2::Rider::__ct
+80829ed4 Objects::Heyho2::Rider::OnStart
+8082a00c Objects::Heyho2::Rider::LoadAnimations
+8082a010 Objects::Heyho2::Rider::Update
+8082a134 Objects::Heyho2::LoadRoute
+8082a138 Objects::Heyho2::Update
+8082a13c Objects::Heyho2::LoadModels
+8082a140 Objects::Heyho2::LoadAnimations
+8082a144 Objects::Heyho2::GetPropertiesBitfield
+8082a14c Objects::Heyho2::__dt
+8082a18c Objects::Heyho2::Lift::GetBRRESName
+8082a198 Objects::Heyho2::Lift::GetSubFileName
+8082a1b8 Objects::Heyho2::Lift::GetPropertiesBitfield
+8082a1c0 Objects::Heyho2::Lift::vf_0xa8
+8082a1c8 Objects::Heyho2::Lift::__dt
+8082a208 Objects::Heyho2::Rider::LoadRoute
+8082a20c Objects::Heyho2::Rider::vf_0xa8
+8082a214 Objects::Heyho2::Rider::GetBRRESName
+8082a220 Objects::Heyho2::Rider::GetSubFileName
+8082a26c Objects::Heyho2::Rider::GetPropertiesBitfield
+8082a274 0x8082a274
+8082a2b4 ObjectsMgr::Start
+8082a38c ObjectsMgr::__ct
+8082a654 ObjectCollisionManager::__dt
+8082a694 ObjectsMgr::__dt
+8082a784 ObjectsMgr::CreateInstance
+8082a824 ObjectsMgr::DestroyInstance
+8082a884 0x8082a884
+8082a8f4 ObjectsMgr::Update
+8082aac0 0x8082aac0
+8082ab04 ObjectsMgr::CheckCollision
+8082adbc ObjectsMgr::HandleItemCollision
+8082afec 0x8082afec
+8082b0e8 ObjectsMgr::AddObject
+8082b294 0x8082b294
+8082b3a0 ObjectsMgr::RegisterManagedObject
+8082b3a8 ObjectsMgr::GetManagedObject
+8082b3b8 ObjectsMgr::GetManagedObjectsCount
+8082b3d4 ObjectsMgr::GetPseaVeniceHeightDiff
+8082b3ec ObjectsMgr::GetPseaVeniceHeight
+8082b400 ObjectsMgr::GetPseaVeniceHeightMinus260
+8082b420 0x8082b420
+8082b42c 0x8082b42c
+8082b4e0 ObjectCollisionManager::GetPlayerItemState
+8082b524 ObjectCollisionManager::Get_0x1c
+8082b52c 0x8082b52c
+8082b530 0x8082b530
+8082b534 ObjectCollisionManager::GetPosition
+8082b53c GeoHitTableKartObjHolder::__dt
+8082b57c GeoHitTableKartHolder::__dt
+8082b5bc GeoHitTableObjHolder::__dt
+8082b5fc GeoHitTableItemHolder::__dt
+8082b63c Objects::MiiStatue::__ct
+8082b708 0x8082b708
+8082b748 0x8082b748
+8082b7e8 0x8082b7e8
+8082b888 0x8082b888
+8082b928 0x8082b928
+8082ba18 Objects::MiiStatue::__dt
+8082bae0 Objects::MiiStatue::OnStart
+8082bce8 Objects::MiiStatue::Update
+8082bd68 0x8082bd68
+8082be0c Objects::MiiStatue::GetPropertiesBitfield
+8082be14 0x8082be14
+8082c10c ObjFlowHolder::__ct
+8082c178 ObjFlowHolder::GetObjIDByName
+8082c1f4 ObjFlowHolder::__dt
+8082c234 Objects::Psea::__ct
+8082c634 Objects::Psea::Update
+8082c884 Objects::Psea::LoadModels
+8082c888 Objects::Psea::GetPropertiesBitfield
+8082c890 Objects::Psea::__dt
+8082c8d0 Objects::Psea5spc::GetScnObjDrawOptionsIdx
+8082c8d8 Objects::Psea5spc::GetName
+8082c8e4 Objects::Psea5spc::GetSubFileName
+8082c8f0 Objects::Psea5spc::GetPropertiesBitfield
+8082c8f8 Objects::Psea5spc::__dt
+8082c938 Objects::Psea4tex::GetScnObjDrawOptionsIdx
+8082c940 Objects::Psea4tex::GetName
+8082c94c Objects::Psea4tex::GetSubFileName
+8082c958 Objects::Psea4tex::GetPropertiesBitfield
+8082c960 Objects::Psea4tex::__dt
+8082c9a0 Objects::Psea3nami::GetScnObjDrawOptionsIdx
+8082c9a8 Objects::Psea3nami::GetName
+8082c9b4 Objects::Psea3nami::GetSubFileName
+8082c9c0 Objects::Psea3nami::GetPropertiesBitfield
+8082c9c8 Objects::Psea3nami::__dt
+8082ca08 Objects::Psea2dark::GetScnObjDrawOptionsIdx
+8082ca10 Objects::Psea2dark::GetName
+8082ca1c Objects::Psea2dark::GetSubFileName
+8082ca28 Objects::Psea2dark::GetPropertiesBitfield
+8082ca30 Objects::Psea2dark::__dt
+8082ca70 Objects::Psea1sand::GetScnObjDrawOptionsIdx
+8082ca78 Objects::Psea1sand::GetName
+8082ca84 Objects::Psea1sand::GetSubFileName
+8082ca90 Objects::Psea1sand::GetPropertiesBitfield
+8082ca98 Objects::Psea1sand::__dt
+8082cad8 Objects::Pylon01::_ct
+8082cc64 Objects::Pylon01::GetScnObjDrawOptionsIdx
+8082cc7c Objects::Pylon01::GetBRRESName
+8082ccb4 Objects::Pylon01::LoadAnimations
+8082cd60 Objects::Pylon01::OnStart
+8082d044 Objects::Pylon01::Update
+8082dbec Objects::Pylon01::OnCollision
+8082dfd8 Objects::Pylon01::OnItemCollision
+8082e100 0x8082e100
+8082e3f0 0x8082e3f0
+8082e4f4 Objects::Pylon01::OnWallCollision
+8082e4f8 Objects::Pylon01::GetPropertiesBitfield
+8082e500 Objects::Pylon01::__dt
+8082e540 Objects::WLscreenGC::__ct
+8082e608 Objects::WLscreenGC::__dt
+8082e6a8 Objects::WLscreenGC::LoadModels
+8082e84c Objects::WLscreenGC::OnStart
+8082e850 Objects::WLscreenGC::Update
+8082e854 obj_venice_nami::__ct
+8082e9f4 0x8082e9f4
+8082ebe8 0x8082ebe8
+8082ec9c 0x8082ec9c
+8082ef80 obj_venice_nami_update
+8082f148 0x8082f148
+8082f318 0x8082f318
+8082f3ac 0x8082f3ac
+8082f3b8 0x8082f3b8
+8082f3c0 0x8082f3c0
+8082f3c8 0x8082f3c8
+8082f408 BackModelMgr::__ct
+8082f4d4 BackModelMgr::__dt
+8082f514 BackModelMgr::Start
+8082f5f8 BackModelMgr::Update
+8082f780 BackModelMgr::SetBackModel
+8082f84c BackModelMgr::ToggleVisible
+8082f860 MenuDriverModel::__ct
+8082f8b8 MenuVehicleDisplayModel::__dt
+8082f8f8 MenuDriverModel::Init
+8082fa90 0x8082fa90
+8082fb78 MenuDriverModel::SwitchState
+8082ff0c MenuDriverModel::Update
+80830000 0x80830000
+808300a0 0x808300a0
+80830134 0x80830134
+80830180 MenuDriverModelMgr::__ct
+80830708 MenuDriverModel::__dt
+80830748 0x80830748
+808307b0 MenuDriverModel::Update
+80830a5c MenuModel::ToggleVisible
+80830a80 MenuDriverModel::Draw
+80830c3c MenuDriverModelMgr::TogglePlayerModel
+80830c64 MenuDriverModelMgr::PrepareDriverOnKartAnms
+80830d00 MenuDriverModel::SetPlayerCharacter
+8083104c 0x8083104c
+80831100 0x80831100
+8083144c 0x8083144c
+80831534 0x80831534
+80831724 0x80831724
+80831af4 0x80831af4
+80831bd4 MenuDriverModelMgr::__dt
+80831c14 MenuModel::Update
+80831c18 MenuModel::Init
+80831c1c DriverModelAnmCalculator::Determine
+80831d20 DriverModelAnmCalculator::GetPrefix
+80831e1c 0x80831e1c
+80831e50 0x80831e50
+80831e58 0x80831e58
+80831eb0 0x80831eb0
+80831f08 0x80831f08
+80831f60 MenuKartModel::__ct
+80831f84 MenuKartModel::__dt
+80831fc4 MenuKartModel::Load
+80832240 MenuKartModel::Init
+8083275c MenuKartModel::Update
+80832ae8 MenuKartModelMgr::__ct
+80832cbc 0x80832cbc
+80832cc0 0x80832cc0
+80832d00 MenuKartModelMgr::Load
+80832f98 0x80832f98
+8083300c MenuKartModelMgr::Update
+808331c4 MenuKartModelMgr::Draw
+80833290 MenuKartModelMgr::SetKartModel
+808332e8 MenuKartModelMgr::Reset
+808333ac MenuKartModelMgr::ToggleVisible
+80833444 0x80833444
+80833474 MenuKartModelMgr::GetMenuKartModel
+808334a0 MenuKartModelMgr::__dt
+808334e0 0x808334e0
+80833510 0x80833510
+80833638 GetCupNameMsgId
+80833668 getTrackBmgId
+80833704 0x80833704
+80833734 getArenaBmgId
+80833764 GetPositionBMGId
+8083376c getOrangeOverlayBmgId
+80833774 0x80833774
+808337d4 0x80833774_switch
+808337d8 0x80833774_caseD_18
+808337ec 0x80833774_caseD_1a
+80833800 0x80833774_caseD_1c
+8083381c GetMissionLevelNameMsgId
+80833838 0x80833838
+80833840 ObjectCollisionCuboid::__ct
+80833b00 ObjectCollisionCuboid::SetPositionAndScale
+80833eec ObjectCollisionCuboid::SetPositionAndScale(translation)
+808342e8 0x808342e8
+808342f0 ObjectCollisionCuboid::__dt
+80834348 ObjectCollision::ProcessCollision
+80834fb4 0x80834fb4
+8083504c 0x8083504c
+808350e4 0x808350e4
+80835304 0x80835304
+80835650 0x80835650
+808357e4 0x808357e4
+808358cc 0x808358cc
+808359a4 0x808359a4
+80835a8c 0x80835a8c
+80835f34 0x80835f34
+80836034 0x80836034
+80836068 ObjectCollisionCylinder::__ct
+8083618c ObjectCollisionCylinder::Getposition
+808361f0 ObjectCollisionCylinder::SetPositionAndScale
+80836334 ObjectCollisionCylinder::SetPositionAndScale(translation)
+80836490 0x80836490
+80836498 ObjectCollisionCylinder::GetRadius
+808364a0 ObjectCollisionCylinder::__dt
+808364e0 ObjectCollisionPolyhedra::__ct
+808365a8 ObjectCollisionPolyhedra::__dt
+80836628 ObjectCollisionPolyhedra::GetPosition
+808366d0 ObjectCollisionPolyhedra::SetPositionAndScale
+808367c4 ObjectCollisionPolyhedra::SetPositionAndScale(translation)
+808368d0 ObjectCollisionSphere::__ct
+80836920 ObjectCollisionSphere::GetPosition
+80836998 ObjectCollisionSphere::SetPositionAndScale
+80836a50 ObjectCollisionSphere::SetPositionAndScale(translation)
+80836b54 ObjectCollisionSphere::GetRadius
+80836b5c ObjectCollisionSphere::__dt
+80836b9c Pages::Menu::OnInit
+80837164 Pages::Menu::CreateExternalControl
+8083716c Pages::Menu::SetButtonHandlers
+80837170 Pages::Menu::OnActivate
+808372e0 Pages::Menu::GetTextInfo
+808372e8 Pages::Menu::OnControlsInitialized
+8083752c Pages::Menu::SelectButton
+808375ec Pages::Menu::OnExternalButtonSelect
+808375f0 Pages::Menu::SelectExternObject
+8083761c Pages::Menu::LoadNextPageWithDelayById
+80837720 Pages::Menu::LoadNextPageById
+80837830 Pages::Menu::LoadPrevPageWithDelayById
+80837934 Pages::Menu::LoadPrevPageById
+80837a44 Pages::Menu::LoadPrevPageWithDelay
+80837b4c Pages::Menu::LoadPrevPage
+80837c5c Pages::Menu::ChangeSectionWithDelayById
+80837d1c Pages::Menu::AddPageLayer
+80837d44 Pages::Menu::OnResume
+80837e40 Pages::Menu::ChangeSectionById
+80837f04 Pages::Menu::ForceChangeSectionWithDelayById
+80837f20 Pages::Menu::ForceChangeSectionById
+80837f80 Pages::Menu::LoadMessageBoxPageWithDelay
+8083813c Pages::Menu::LoadMessageBoxPage
+80838300 Pages::Menu::LoadMessageBoxTransparentPageThenChangeSectionWithDelay
+808384cc Pages::Menu::LoadMessageBoxTransparentPageThenChangeSection
+808386a0 Pages::Menu::LoadMessageBoxTransparentPage
+808387ac Pages::Menu::ChangePrevSection
+808387f8 Pages::Menu::OnMoviesActivate
+80838884 Pages::Menu::LoadMovies
+808388a0 Pages::Menu::UnloadMovies
+808388b4 Pages::Menu::IsMultiplayer
+808388f0 Pages::Menu::AreAllPlayersActive
+808389d4 Pages::Menu::BeforeEntranceAnimations
+80838a70 Pages::Menu::GetNextPage
+80838a78 Pages::Menu::BeforeExitAnimations
+80838b14 Pages::Menu::OnStartPress
+80838b18 MenuPage_cpp_sinit_
+80838b2c Pages::MenuBG::GetPageById
+80838c3c Pages::MenuBG::CreateControl
+80838da0 Pages::MenuBG::AfterControlUpdate
+80838da4 Pages::MenuBG::GetPlayerBifield
+80838dac Pages::MenuBG::GetActivePlayerBitfield
+80838db4 Pages::MenuBG::GetManipulatorManager
+80838dbc Pages::MenuBG::BeforeEntranceAnimations
+80838dc0 Pages::MenuBG::__ct
+80838e40 Pages::MenuBG::GetRuntimeTypeInfo
+80838e4c MenuBGPage_cpp_sinit_
+80838e60 Pages::BattleCupSelect::GetPageById
+80838f70 Pages::BattleCupSelect::OnInit
+80838fe8 Pages::BattleCupSelect::CreateExternalControl
+80838ff0 Pages::BattleCupSelect::CreateControl
+80839084 Pages::BattleCupSelect::OnActivate
+808393f4 Pages::BattleCupSelect::AfterControlUpdate
+80839550 Pages::BattleCupSelect::UpdateText
+8083955c Pages::BattleCupSelect::LoadNextPage
+80839694 Pages::BattleCupSelect::OnButtonClick
+80839904 Pages::BattleCupSelect::OnExternalButtonSelect
+80839908 Pages::BattleCupSelect::OnButtonDeselect
+8083990c Pages::BattleCupSelect::OnBackPress
+80839b7c Pages::BattleCupSelect::OnResume
+80839d94 Pages::BattleCupSelect::OnDeactivate
+80839d98 Pages::BattleCupSelect::BeforeEntranceAnimations
+80839df4 Pages::BattleCupSelect::BeforeExitAnimations
+80839e50 Pages::BattleCupSelect::OnTimeout
+80839f4c Pages::BattleCupSelect::GetPlayerBitfield
+80839f54 Pages::BattleCupSelect::GetActivePlayerBitfield
+80839f5c Pages::BattleCupSelect::SetButtonHandlers
+80839fb8 Pages::BattleCupSelect::GetManipulatorManager
+80839fc0 Pages::BattleCupSelect::__dt
+8083a0b4 Pages::BattleCupSelect::GetRuntimeTypeInfo
+8083a0c0 BattleCupSelectPage_sinit_
+8083a0d4 Pages::BattleKartSelect::GetPageById
+8083a1e4 Pages::BattleKartSelect::OnInit
+8083a1f8 Pages::BattleKartSelect::CreateExternalControl
+8083a2e0 Pages::BattleKartSelect::SetButtonHandlers
+8083a33c Pages::BattleKartSelect::CreateControl
+8083a458 Pages::BattleKartSelect::OnActivate
+8083a78c Pages::BattleKartSelect::AfterControlUpdate
+8083a918 Pages::BattleKartSelect::OnButtonClick
+8083aaa4 Pages::BattleKartSelect::OnExternalButtonSelect
+8083ab78 Pages::BattleKartSelect::OnButtonDeselect
+8083ab80 Pages::BattleKartSelect::OnBackPress
+8083ac54 Pages::BattleKartSelect::Func_8083ac54
+8083ad54 Pages::BattleKartSelect::Func_8083ad54
+8083af3c Pages::BattleKartSelect::BeforeEntranceAnimations
+8083af9c Pages::BattleKartSelect::BeforeExitAnimations
+8083affc Pages::BattleKartSelect::GetPlayerBitfield
+8083b004 Pages::BattleKartSelect::GetLocalPlayerCount
+8083b00c Pages::BattleKartSelect::GetManipulatorManager
+8083b014 Pages::BattleKartSelect::__dt
+8083b0c0 Pages::BattleKartSelect::GetRuntimeTypeInfo
+8083b0cc BattleKartSelectPagecpp_sinit_
+8083b0e0 Pages::BattleModeSelect::GetPageById
+8083b1f0 Pages::BattleModeSelect::OnInit
+8083b244 Pages::BattleModeSelect::GetManipulatorManager
+8083b24c Pages::BattleModeSelect::CreateExternalControl
+8083b3f8 Pages::BattleModeSelect::CreateControl
+8083b400 Pages::BattleModeSelect::OnActivate
+8083b7d8 Pages::BattleModeSelect::OnActivate_switch
+8083b7dc Pages::BattleModeSelect::OnActivate_case_0
+8083b7f4 Pages::BattleModeSelect::OnActivate_case_1
+8083b80c Pages::BattleModeSelect::OnActivate_case_2
+8083b824 Pages::BattleModeSelect::OnActivate_case_3
+8083b83c Pages::BattleModeSelect::OnActivate_case_4
+8083b854 Pages::BattleModeSelect::OnActivate_case_5
+8083b86c Pages::BattleModeSelect::OnActivate_case_6
+8083b884 Pages::BattleModeSelect::OnActivate_case_7
+8083b8cc Pages::BattleModeSelect::AfterControlUpdate
+8083b8d0 Pages::BattleModeSelect::OnButtonClick
+8083b9ac Pages::BattleModeSelect::OnExternalButtonSelect
+8083b9e4 Pages::BattleModeSelect::OnButtonDeselect
+8083b9e8 Pages::BattleModeSelect::OnBackPress
+8083b9f4 Pages::BattleModeSelect::OnDeactivate
+8083ba40 Pages::BattleModeSelect::GetPlayerBitfield
+8083ba48 Pages::BattleModeSelect::GetActivePlayerBitfield
+8083ba50 Pages::BattleModeSelect::SetButtonHandlers
+8083baac Pages::BattleModeSelect::__dt
+8083bb2c Pages::BattleModeSelect::GetRuntimeTypeInfo
+8083bb38 BattleModeSelectPage_cpp_sinit_
+8083bb4c Pages::BattleSettings::GetPageById
+8083bc5c Pages::BattleSettings::OnInit
+8083bf50 Pages::BattleSettings::CreateExternalControl
+8083bfe0 Pages::BattleSettings::CreateControl
+8083c3a4 Pages::BattleSettings::OnActivate
+8083c504 Pages::BattleSettings::AfterControlUpdate
+8083c508 Pages::BattleSettings::OnButtonClick
+8083c50c Pages::BattleSettings::OnExternalButtonSelect
+8083c538 Pages::BattleSettings::OnButtonDeselect
+8083c53c Pages::BattleSettings::OnBackPress
+8083c580 Pages::BattleSettings::OnRadioClick
+8083c6ec Pages::BattleSettings::OnRadioChange
+8083c7cc Pages::BattleSettings::OnUpDownClick
+8083c838 Pages::BattleSettings::OnUpDownSelect
+8083c848 Pages::BattleSettings::OnUpDownChange
+8083c8c0 Pages::BattleSettings::OnTextChange
+8083c93c Pages::BattleSettings::GetPlayerBitfield
+8083c944 Pages::BattleSettings::GetActivePlayerBitfield
+8083c94c Pages::BattleSettings::SetButtonHandlers
+8083c9a8 Pages::BattleSettings::GetManipulatorManager
+8083c9b0 Pages::BattleSettings::__dt
+8083ca78 Pages::BattleSettings::GetRuntimeTypeInfo
+8083ca84 Pages::BattleSettings::TriggerUpDown3APtmf
+8083cab4 Pages::BattleSettings::TriggerRadioPtmf
+8083cae4 Pages::BattleSettings::TriggerTextPtmf
+8083cb14 Pages::BattleSettings::TriggerUpDown2APtmf
+8083cb44 BattleSettingsPage_cpp_sinit_
+8083cb58 Pages::BattleStageSelect::GetPageById
+8083cc68 Pages::BattleStageSelect::OnInit
+8083ccb8 Pages::BattleStageSelect::CreateExternalControl
+8083ccc0 Pages::BattleStageSelect::CreateControl
+8083cd54 Pages::BattleStageSelect::OnActivate
+8083cea8 Pages::BattleStageSelect::BeforeEntranceAnimations
+8083cec8 Pages::BattleStageSelect::AfterControlUpdate
+8083cfe4 Pages::BattleStageSelect::UpdateBottomText
+8083cfe8 Pages::BattleStageSelect::LoadNextPage
+8083d11c Pages::BattleStageSelect::OnButtonClick
+8083d154 Pages::BattleStageSelect::OnExternalButtonSelect
+8083d158 Pages::BattleStageSelect::OnButtonDeselect
+8083d15c Pages::BattleStageSelect::OnBackPress
+8083d194 Pages::BattleStageSelect::BeforeExitAnimations
+8083d1f0 Pages::BattleStageSelect::OnDeactivate
+8083d1f4 Pages::BattleStageSelect::OnTimeout
+8083d2c8 Pages::BattleStageSelect::GetPlayerBitfield
+8083d2d0 Pages::BattleStageSelect::GetActivePlayerBitfield
+8083d2d8 Pages::BattleStageSelect::SetButtonHandlers
+8083d334 Pages::BattleStageSelect::__dt
+8083d420 Pages::BattleStageSelect::GetRuntimeTypeInfo
+8083d42c BattleStageSelectPage_cpp_sinit_
+8083d440 CharaName::GetClassName
+8083d44c Pages::CharacterSelect::GetPageById
+8083d55c Pages::CharacterSelect::OnInit
+8083d840 CharaName::__ct
+8083d87c Pages::CharacterSelect::CreateExternalControl
+8083d884 Pages::CharacterSelect::CreateControl
+8083da78 Pages::CharacterSelect::OnActivate
+8083ddb4 Pages::CharacterSelect::GetManipulatorManager
+8083ddbc Pages::CharacterSelect::AfterControlUpdate
+8083dfa8 Pages::CharacterSelect::OnButtonDriverClick
+8083e5f4 Pages::CharacterSelect::OnButtonDriverSelect
+8083e740 Pages::CharacterSelect::OnButtonClick
+8083e8d8 Pages::CharacterSelect::OnExternalButtonSelect
+8083e924 Pages::CharacterSelect::OnButtonDeselect
+8083e928 Pages::CharacterSelect::OnBackPress
+8083ec28 Pages::CharacterSelect::8083ec28
+8083ee1c Pages::CharacterSelect::8083ee1c
+8083eebc Pages::CharacterSelect::OnResume
+8083ef3c Pages::CharacterSelect::OnDispose
+8083ef4c Pages::CharacterSelect::BeforeEntranceAnimations
+8083eff4 Pages::CharacterSelect::BeforeExitAnimations
+8083f09c CharaName::InitSelf
+8083f260 Pages::CharacterSelect::GetPlayerBitfield
+8083f268 Pages::CharacterSelect::GetActivePlayerBitfield
+8083f270 Pages::CharacterSelect::SetButtonHandlers
+8083f2cc Pages::CharacterSelect::__dt
+8083f35c Pages::CharacterSelect::GetRuntimeTypeInfo
+8083f368 CharaName::GetRuntimeTypeInfo
+8083f374 CharaSelectcpp_sinit_
+8083f398 Pages::GPClassSelect::GetPageById
+8083f4a8 Pages::GPClassSelect::OnInit
+8083f578 Pages::GPClassSelect::GetManipulatorManager
+8083f580 Pages::GPClassSelect::CreateExternalControl
+8083f7b0 Pages::GPClassSelect::CreateControl
+8083f838 Pages::GPClassSelect::OnActivate
+8083f914 Pages::GPClassSelect::AfterControlUpdate
+8083f988 Pages::GPClassSelect::OnButtonClick
+8083fb2c Pages::GPClassSelect::OnExternalButtonSelect
+8083fbb4 Pages::GPClassSelect::OnButtonDeselect
+8083fbb8 Pages::GPClassSelect::OnBackPress
+8083fbc4 Pages::GPClassSelect::OnDeactivate
+8083fbc8 Pages::GPClassSelect::OnStartPress
+808400cc Pages::GPClassSelect::GetPlayerBitfield
+808400d4 Pages::GPClassSelect::GetActivePlayerBitfield
+808400dc Pages::GPClassSelect::SetButtonHandlers
+80840138 Pages::GPClassSelect::__dt
+808401c4 Pages::GPClassSelect::GetRuntimeTypeInfo
+808401d0 GPClassSelectPage_cpp_sinit_
+808401e4 Pages::CourseSelect::GetPageById
+808402f4 Pages::CourseSelect::OnInit
+80840390 Pages::CourseSelect::CreateExternalControl
+80840398 Pages::CourseSelect::CreateControl
+808404a0 Pages::CourseSelect::OnActivate
+808405c0 Pages::CourseSelect::BeforeEntranceAnimations
+8084060c Pages::CourseSelect::AfterControlUpdate
+80840728 Pages::CourseSelect::UpdateBottomText
+80840830 Pages::CourseSelect::LoadNextPage
+80840a44 Pages::CourseSelect::OnButtonClick
+80840aac Pages::CourseSelect::OnExternalButtonSelect
+80840ab0 Pages::CourseSelect::OnButtonDeselect
+80840ab4 Pages::CourseSelect::OnBackPress
+80840b1c Pages::CourseSelect::BeforeExitAnimations
+80840b78 Pages::CourseSelect::OnDeactivate
+80840ba0 Pages::CourseSelect::OnTimeout
+80840c74 Pages::CourseSelect::GetPlayerBitfield
+80840c7c Pages::CourseSelect::GetActivePlayerBitfield
+80840c84 Pages::CourseSelect::SetButtonHandlers
+80840ce0 Pages::CourseSelect::__dt
+80840dcc Pages::CourseSelect::GetRuntimeTypeInfo
+80840dd8 Pages::CourseSelect::_sinit_
+80840dec Pages::CupSelect::GetPageById
+80840efc Pages::CupSelect::OnInit
+80841000 Pages::CupSelect::CreateExternalControl
+80841008 Pages::CupSelect::CreateControl
+80841110 Pages::CupSelect::OnActivate
+808414b0 Pages::CupSelect::GetManipulatorManager
+808414b8 Pages::CupSelect::AfterControlUpdate
+80841614 Pages::CupSelect::UpdateText
+80841744 Pages::CupSelect::LoadNextPage
+808418e8 Pages::CupSelect::OnButtonClick
+80841b4c Pages::CupSelect::OnExternalButtonSelect
+80841b50 Pages::CupSelect::OnButtonDeselect
+80841b54 Pages::CupSelect::OnBackPress
+80841de4 Pages::CupSelect::OnResume
+80841ff8 Pages::CupSelect::OnDeactivate
+80842020 Pages::CupSelect::BeforeEntranceAnimations
+8084207c Pages::CupSelect::BeforeExitAnimations
+808420d8 Pages::CupSelect::OnTimeout
+808421d4 Pages::CupSelect::GetPlayerBitfield
+808421dc Pages::CupSelect::GetActivePlayerBitfield
+808421e4 Pages::CupSelect::SetButtonHandlers
+80842240 Pages::CupSelect::__dt
+80842334 Pages::CupSelect::GetRuntimeTypeInfo
+80842340 CupSelectPagecpp_sinit_
+80842354 Pages::StartRace::GetPageById
+80842464 Pages::StartRace::OnInit
+8084247c Pages::StartRace::CreateExternalControl
+808425e0 Pages::StartRace::GetActivePlayerBitfield
+808425e8 Pages::StartRace::SetButtonHandlers
+80842644 Pages::StartRace::CreateControl
+808428a0 Pages::StartRace::OnActivate
+80842914 Pages::StartRace::AfterControlUpdate
+80842948 Pages::StartRace::OnButtonClick
+808429a4 Pages::StartRace::OnExternalButtonSelect
+808429a8 Pages::StartRace::OnButtonDeselect
+808429ac Pages::StartRace::OnBackPress
+808429c8 Pages::StartRace::GetPlayerBitfield
+808429d0 Pages::StartRace::GetManipulatorManager
+808429d8 Pages::StartRace::__dt
+80842a58 Pages::StartRace::GetRuntimeTypeInfo
+80842a64 StartRacePage_cpp_sinit_
+80842a78 0x80842a78
+80842b88 0x80842b88
+80842dac 0x80842dac
+80842e50 0x80842e50
+80842ec0 0x80842ec0
+80842fac 0x80842fac
+80842fb4 0x80842fb4
+80842fb8 0x80842fb8
+80843384 0x80843384
+80843398 0x80843398
+8084339c 0x8084339c
+80843684 0x80843684
+8084368c 0x8084368c
+808436e8 0x808436e8
+808436f0 0x808436f0
+80843794 0x80843794
+808437a0 0x808437a0
+808437b4 0x808437b4
+808438c4 0x808438c4
+808438fc 0x808438fc
+80843904 0x80843904
+80843998 0x80843998
+808439e0 0x808439e0
+808439e4 0x808439e4
+808439f0 0x808439f0
+80843a4c 0x80843a4c
+80843a60 0x80843a60
+80843a64 0x80843a64
+80843a68 0x80843a68
+80843a74 0x80843a74
+80843ac0 0x80843ac0
+80843b14 0x80843b14
+80843b68 0x80843b68
+80843b70 0x80843b70
+80843b78 0x80843b78
+80843bd4 0x80843bd4
+80843bdc 0x80843bdc
+80843cd0 0x80843cd0
+80843cdc 0x80843cdc
+80843cf0 0x80843cf0
+80843e00 0x80843e00
+80843e70 0x80843e70
+80843efc 0x80843efc
+80843f6c 0x80843f6c
+80844050 0x80844050
+80844054 0x80844054
+80844138 0x80844138
+80844170 0x80844170
+80844174 Pages::Menu::UnloadVideoSource
+80844180 0x80844180
+80844184 0x80844184
+8084418c 0x8084418c
+80844194 0x80844194
+808441f0 0x808441f0
+808441f8 0x808441f8
+80844298 0x80844298
+808442a4 0x808442a4
+808442b8 0x808442b8
+808443c8 0x808443c8
+808443dc 0x808443dc
+808443e4 0x808443e4
+80844478 Pages::Menu::OnActivate
+8084447c 0x8084447c
+8084449c 0x8084449c
+808444a0 0x808444a0
+808444a4 0x808444a4
+80844500 0x80844500
+8084455c 0x8084455c
+80844560 0x80844560
+80844564 0x80844564
+808445b4 0x808445b4
+80844608 0x80844608
+80844654 0x80844654
+8084465c 0x8084465c
+80844664 0x80844664
+808446c0 0x808446c0
+808447ac 0x808447ac
+808447b8 0x808447b8
+808447cc Pages::KartSelect::GetPageById
+808448dc ButtonMachine::GetClassName
+808448e8 Pages::KartSelect::GetVehicleID
+80844960 Pages::KartSelect::GetUnlockedVehiclesCountByWeightAndType
+808449dc Pages::KartSelect::GetUnlockedVehiclesCountByWeight
+80844abc Pages::KartSelect::GetMinUnlockedVehiclesCount
+80844d68 Pages::KartSelect::OnInit
+80845148 Pages::KartSelect::CreateExternalControl
+80845150 Pages::KartSelect::CreateControl
+808454b4 Pages::KartSelect::SetButtonHandlers
+80845510 Pages::KartSelect::OnActivate
+80846a1c Pages::KartSelect::GetManipulatorManager
+80846a24 Pages::KartSelect::GetLocalPlayerCount
+80846a2c Pages::KartSelect::AfterControlUpdate
+80846c1c Pages::KartSelect::OnButtonClick
+80846ea4 Pages::KartSelect::OnExternalButtonSelect
+80846fbc Pages::KartSelect::OnButtonSelect
+80846fc0 Pages::KartSelect::OnBackPress
+80847094 Pages::KartSelect::GetExternalControl
+808471c4 Pages::KartSelect::GetButtonMachineById
+80847344 Pages::KartSelect::InitButtonMachine
+8084745c Pages::KartSelect::8084745c
+80847590 Pages::KartSelect::80847590
+80847630 Pages::KartSelect::BeforeEntranceAnimations
+80847690 Pages::KartSelect::BeforeExitAnimations
+808476f0 ButtonMachine::OnUpdate
+80847810 ButtonMachine::InitSelf
+808478f4 zz_8478f4
+80847bec Pages::KartSelect::GetPlayerBitfield
+80847bf4 Pages::KartSelect::__dt
+80847c90 Pages::KartSelect::GetRuntimeTypeInfo
+80847c9c ButtonMachine::GetRuntimeTypeInfo
+80847ca8 ButtonMachine::__dt
+80847d00 KartSelect_cpp_sinit
+80847d24 Pages::MiiSelect::GetPageById
+80847e34 MiiName::GetClassName
+80847e40 Pages::MiiSelect::OnINit
+80848044 Pages::MiiSelect::GetManipulatorManager
+8084804c Pages::MiiSelect::CreateExternalControl
+808481cc Pages::MiiSelect::GetActivePlayerBitfield
+808481d4 Pages::MiiSelect::SetButtonHandlers
+80848230 Pages::MiiSelect::CreateControl
+80848568 Pages::MiiSelect::OnActivate
+808487e8 Pages::MiiSelect::AfterControlUpdate
+808487ec Pages::MiiSelect::OnButtonClick
+80848ae8 Pages::MiiSelect::OnExternalButtonSelect
+80848b58 Pages::MiiSelect::OnButtonDeselect
+80848b60 Pages::MiiSelect::OnBackPress
+80848bd4 Pages::MiiSelect::OnDeactivate
+80848be8 Pages::MiiSelect::OnRightArrowPress
+80848d40 Pages::MiiSelect::OnLeftArrowPress
+80848e44 Pages::MiiSelect::OnTabButtonClick
+80848f94 Pages::MiiSelect::SetMiiIcons
+80849234 Pages::MiiSelect::GetCurTabMiiCount
+80849284 MiiName::InitSelf
+80849448 Pages::MiiSelect::GetPlayerBitfield
+80849450 Pages::MiiSelect::__dt
+808494f8 Pages::MiiSelect::GetRuntimeTypeInfo
+80849504 MiiName::GetRuntimeTypeInfo
+80849510 Pages::MiiSelect::TriggerTabPtmf
+80849540 Pages::MiiSelect::TriggerSheetPtmf
+80849570 MiiSelect_cpp_sinit_
+80849594 Pages::MultiKartSelect::GetPageById
+808496a4 Pages::MultiKartSelect::OnInit
+80849940 Pages::MultiKartSelect::CreateExternalControl
+80849948 Pages::MultiKartSelect::CreateControl
+80849c24 Pages::MultiKartSelect::OnActivate
+80849d80 Pages::MultiKartSelect::AfterControlUpdate
+80849e64 Pages::MultiKartSelect::GetManipulatorManager
+80849e6c Pages::MultiKartSelect::OnButtonClick
+80849f60 Pages::MultiKartSelect::OnExternalButtonSelect
+80849f64 Pages::MultiKartSelect::OnButtonDeselect
+80849f68 Pages::MultiKartSelect::OnBackPress
+8084a100 Pages::MultiKartSelect::OnUpDownClick
+8084a2a4 Pages::MultiKartSelect::OnUpDownChange
+8084a2a8 Pages::MultiKartSelect::OnTextChange
+8084a3f8 Pages::MultiKartSelect::FillPossibleKarts
+8084a5c4 0x8084a5c4
+8084a668 Pages::MultiKartSelect::BeforeEntranceAnimations
+8084a710 Pages::MultiKartSelect::BeforeExitAnimations
+8084a7b8 Pages::MultiKartSelect::GetPlayerBitfield
+8084a7c0 Pages::MultiKartSelect::GetActivePlayerBitfield
+8084a7c8 Pages::MultiKartSelect::SetButtonHandlers
+8084a824 Pages::MultiKartSelect::__dt
+8084a904 Pages::MultiKartSelect::GetRuntimeTypeInfo
+8084a910 TriggerPtmf
+8084a940 TriggerPtmf
+8084a970 TriggerPtmf
+8084a9a0 MultiKartSelectPage_cpp_sinit_
+8084a9b4 Pages::MultiDriftSelect::GetPageById
+8084aac4 Pages::MultiDriftSelect::OnInit
+8084af7c Pages::MultiDriftSelect::GetManipulatorManager
+8084af84 Pages::MultiDriftSelect::GetActivePlayerBitfield
+8084af8c Pages::MultiDriftSelect::GetPlayerBitfield
+8084af94 Pages::MultiDriftSelect::SetButtonHandlers
+8084aff0 Pages::MultiDriftSelect::OnControlsInitialized
+8084aff4 Pages::MultiDriftSelect::CreateExternalControl
+8084b150 Pages::MultiDriftSelect::CreateControl
+8084b280 Pages::MultiDriftSelect::OnActivate
+8084b388 Pages::MultiDriftSelect::AfterControlUpdate
+8084b500 Pages::MultiDriftSelect::OnButtonClick
+8084b7ec Pages::MultiDriftSelect::OnExternalButtonSelect
+8084b7f0 Pages::MultiDriftSelect::OnButtonDeselect
+8084b7f4 Pages::MultiDriftSelect::OnBackPress
+8084b8c4 Pages::MultiDriftSelect::OnResume
+8084b984 Pages::MultiDriftSelect::__dt
+8084ba04 Pages::MultiDriftSelect::GetRuntimeTypeInfo
+8084ba10 MultiDriftSelectPage_cpp_sinit_
+8084ba24 Pages::MultiTeamSelect::GetPageById
+8084bb34 Pages::MultiTeamSelect::OnInit
+8084bffc Pages::MultiTeamSelect::GetManipulatorManager
+8084c004 Pages::MultiTeamSelect::GetActivePlayerBitfield
+8084c00c Pages::MultiTeamSelect::GetPlayerBifield
+8084c014 Pages::MultiTeamSelect::SetButtonHandlers
+8084c070 Pages::MultiTeamSelect::OnControlsInitialized
+8084c074 Pages::MultiTeamSelect::BeforeEntranceAnimations
+8084c11c Pages::MultiTeamSelect::BeforeExitAnimations
+8084c1c4 Pages::MultiTeamSelect::CreateExternalControl
+8084c314 Pages::MultiTeamSelect::CreateControl
+8084c444 Pages::MultiTeamSelect::OnActivate
+8084c714 Pages::MultiTeamSelect::AfterControlUpdate
+8084c718 Pages::MultiTeamSelect::OnButtonClick
+8084cc1c Pages::MultiTeamSelect::OnExternalButtonSelect
+8084cc20 Pages::MultiTeamSelect::OnButtonDeselect
+8084cc24 Pages::MultiTeamSelect::OnBackPress
+8084cd30 Pages::MultiTeamSelect::OnResume
+8084ce1c Pages::MultiTeamSelect::AssignCPUTeams
+8084cff4 Pages::MultiTeamSelect::IsDifferentTeams
+8084d050 Pages::MultiTeamSelect::__dt
+8084d0d0 Pages::MultiTeamSelect::GetRuntimeTypeInfo
+8084d0dc MultiTeamSelectPage_cpp_sinit_
+8084d0f0 Pages::MultiPlayer::GetPageById
+8084d200 Pages::MultiPlayer::OnINit
+8084d260 Pages::MultiPlayer::CreateExternalControl
+8084d3a8 Pages::MultiPlayer::CreateControl
+8084d3b0 Pages::MultiPlayer::OnActivate
+8084d4d8 Pages::MultiPlayer::AfterControlUpdate
+8084d4dc Pages::MultiPlayer::OnButtonClick
+8084d6fc Pages::MultiPlayer::OnExternalButtonSelect
+8084db7c Pages::MultiPlayer::OnButtonDeselect
+8084db80 Pages::MultiPlayer::OnBackPress
+8084dbd4 Pages::MultiPlayer::OnDeactivate
+8084dbd8 Pages::MultiPlayer::GetPlayerBifield
+8084dbe0 Pages::MultiPlayer::GetActivePlayerBitfield
+8084dbe8 Pages::MultiPlayer::SetButtonHandlers
+8084dc44 Pages::MultiPlayer::GetManipulatorManager
+8084dc4c Pages::MultiPlayer::__dt
+8084dccc Pages::MultiPlayer::GetRuntimeTypeInfo
+8084dcd8 MultiPlayerPage_cpp_sinit_
+8084dcec DriftSelectPage:GetPageById
+8084ddfc Pages::DriftSelect::OnInit
+8084dee0 Pages::DriftSelect::GetManipulatorManager
+8084dee8 Pages::DriftSelect::CreateExternalControl
+8084e134 Pages::DriftSelect::CreateControl
+8084e13c Pages::DriftSelect::OnActivate
+8084e25c Pages::DriftSelect::AfterControlUpdate
+8084e388 Pages::DriftSelect::OnButtonClick
+8084e6bc Pages::DriftSelect::OnExternalButtonSelect
+8084e6f4 Pages::DriftSelect::OnButtonDeselect
+8084e6f8 Pages::DriftSelect::OnBackPress
+8084e704 Pages::DriftSelect::OnDeactivate
+8084e750 Pages::DriftSelect::GetPlayerBitfield
+8084e758 Pages::DriftSelect::GetActivePlayerBitfield
+8084e760 Pages::DriftSelect::SetButtonHandlers
+8084e7bc Pages::DriftSelect::__dt
+8084e83c Pages::DriftSelect::GetRuntimeTypeInfo
+8084e848 DriftSelectPage_cpp_sinit_
+8084e85c Pages::TopMenuOverlay::GetPageById
+8084e96c Pages::TopMenuOverlay::CreateControl
+8084ed4c Pages::TopMenuOverlay::vf_0x98
+8084ed54 Pages::TopMenuOverlay::GetPlayerBitfield
+8084ed5c Pages::TopMenuOverlay::GetActivePlayerBitfield
+8084ed64 Pages::TopMenuOverlay::GetManipulatorManager
+8084ed6c Pages::TopMenuOverlay::__dt
+8084edec Pages::TopMenuOverlay::GetRuntimeTypeInfo
+8084edf8 TopMenuOverlayPagecpp_sinit_
+8084ee0c Pages::SinglePlayer::GetPageById
+8084ef1c Pages::SinglePlayer::OnInit
+8084efbc Pages::SinglePlayer::GetManipulatorManager
+8084efc4 Pages::SinglePlayer::CreateExternalControl
+8084f108 Pages::SinglePlayer::CreateControl
+8084f110 Pages::SinglePlayer::OnActivate
+8084f294 Pages::SinglePlayer::AfterControlUpdate
+8084f298 Pages::SinglePlayer::OnButtonClick
+8084f688 Pages::SinglePlayer::OnExternalButtonSelect
+8084fb34 Pages::SinglePlayer::OnButtonDeselect
+8084fb38 Pages::SinglePlayer::OnBackPress
+8084fb8c Pages::SinglePlayer::OnDeactivate
+8084fb90 Pages::SinglePlayer::GetPlayerBitfield
+8084fb98 Pages::SinglePlayer::GetActivePlayerBitfield
+8084fba0 Pages::SinglePlayer::SetButtonHandlers
+8084fbfc Pages::SinglePlayer::__dt
+8084fc7c Pages::SinglePlayer::GetRuntimeTypeInfo
+8084fc88 SinglePlayerPage_cpp_sinit_
+8084fc9c Pages::VSTeamsView::GetPageById
+8084fdac Pages::VSTeamsView::OnInit
+8084fdb0 Pages::VSTeamsView::CreateExternalControl
+8084fe40 Pages::VSTeamsView::CreateControl
+8084fea8 Pages::VSTeamsView::OnActivate
+8084feac Pages::VSTeamsView::AfterControlUpdate
+8084feb0 Pages::VSTeamsView::OnButtonClick
+8084ff80 Pages::VSTeamsView::OnExternalButtonSelect
+8084ffb8 Pages::VSTeamsView::OnButtonDeselect
+8084ffbc Pages::VSTeamsView::OnBackPress
+8084ffc8 Pages::VSTeamsView::AssignTeams
+808501a0 Pages::VSTeamsView::GetPlayerBitfield
+808501a8 Pages::VSTeamsView::GetActivePlayerBitfield
+808501b0 Pages::VSTeamsView::SetButtonHandlers
+8085020c Pages::VSTeamsView::GetManipulatorManager
+80850214 Pages::VSTeamsView::__dt
+808502ac Pages::VSTeamsView::GetRuntimeTypeInfo
+808502b8 VSTeamsViewPage_cpp_sinit_
+808502cc Pages::MainMenu::GetPageById
+808503dc Pages::MainMenu::OnInit
+808504dc Pages::MainMenu::GetManipulatorManager
+808504e4 Pages::MainMenu::CreateExternalControl
+80850580 Pages::MainMenu::CreateControl
+80850d54 Pages::MainMenu::SetButtonHandlers
+80850db0 Pages::MainMenu::OnActivate
+80851108 Pages::MainMenu::AfterControlUpdate
+8085110c Pages::MainMenu::OnButtonClick
+8085151c Pages::MainMenu::OnExternalButtonSelect
+808515a0 Pages::MainMenu::OnButtonDeselect
+808516ac Pages::MainMenu::OnBackPress
+808516bc Pages::MainMenu::ResetSectionParamsAndRacedataScenario1
+80851b88 Pages::MainMenu::OnDeactivate
+80851b8c Pages::MainMenu::ShowMessageBox
+80851c84 Pages::MainMenu::GetPlayerBitfield
+80851c8c Pages::MainMenu::GetActivePlayerBitfield
+80851c94 Pages::MainMenu::__dt
+80851d2c Pages::MainMenu::GetRuntimeTypeInfo
+80851d38 MainMenuPage_cpp_sinit_
+80851d4c 0x80851d4c
+80851e5c 0x80851e5c
+80851e68 0x80851e68
+80851e70 0x80851e70
+80851f70 0x80851f70
+80851fdc 0x80851fdc
+80851fe0 0x80851fe0
+80851ff4 0x80851ff4
+80851ff8 0x80851ff8
+80851ffc Pages::Menu::UnloadVideoSource
+80852008 0x80852008
+8085200c 0x8085200c
+80852014 0x80852014
+8085201c 0x8085201c
+80852078 0x80852078
+80852080 0x80852080
+8085210c 0x8085210c
+80852118 0x80852118
+8085212c Pages::VSModeSelect::GetPageById
+8085223c Pages::VSModeSelect::OnInit
+80852290 Pages::VSModeSelect::GetManipulatorManager
+80852298 Pages::VSModeSelect::CreateExternalControl
+80852448 Pages::VSModeSelect::CreateControl
+80852450 Pages::VSModeSelect::OnActivate
+80852908 Pages::VSModeSelect::OnActivate_switch
+8085290c Pages::VSModeSelect::OnActivate_case_0
+80852924 Pages::VSModeSelect::OnActivate_case_1
+8085293c Pages::VSModeSelect::OnActivate_case_2
+80852954 Pages::VSModeSelect::OnActivate_case_3
+8085296c Pages::VSModeSelect::OnActivate_case_4
+80852984 Pages::VSModeSelect::OnActivate_case_5
+8085299c Pages::VSModeSelect::OnActivate_case_6
+808529b4 Pages::VSModeSelect::OnActivate_case_7
+808529fc Pages::VSModeSelect::AfterControlUpdate
+80852a00 Pages::VSModeSelect::OnButtonClick
+80852ae0 Pages::VSModeSelect::OnExternalButtonSelect
+80852b18 Pages::VSModeSelect::OnButtonDeselect
+80852b1c Pages::VSModeSelect::OnBackPress
+80852b28 Pages::VSModeSelect::OnDeactivate
+80852b74 Pages::VSModeSelect::GetPlayerBitfield
+80852b7c Pages::VSModeSelect::GetActivePlayerBitfield
+80852b84 Pages::VSModeSelect::SetButtonHandlers
+80852be0 Pages::VSModeSelect::__dt
+80852c60 Pages::VSModeSelect::GetRuntimeTypeInfo
+80852c6c VSModeSelectPage_cpp_sinit_
+80852c80 Pages::VSSettings::GetPageById
+80852d90 Pages::VSSettings::OnInit
+80853028 Pages::VSSettings::CreateExternalControl
+808530b8 Pages::VSSettings::CreateControl
+8085354c Pages::VSSettings::OnActivate
+80853650 Pages::VSSettings::AfterControlUpdate
+80853654 Pages::VSSettings::OnButtonClick
+80853684 Pages::VSSettings::OnExternalButtonSelect
+808536b0 Pages::VSSettings::OnButtonDeselect
+808536b4 Pages::VSSettings::OnBackPress
+80853714 Pages::VSSettings::OnRadioClick
+8085389c Pages::VSSettings::OnRadioChange
+8085391c Pages::VSSettings::OnUpDownClick
+80853988 Pages::VSSettings::OnUpDownSelect
+80853998 Pages::VSSettings::OnUpDownChange
+80853a10 Pages::VSSettings::OnTextChange
+80853a8c Pages::VSSettings::OnDispose
+80853a9c Pages::VSSettings::GetPlayerBitfield
+80853aa4 Pages::VSSettings::GetLocalPlayerCount
+80853aac Pages::VSSettings::SetButtonHandlers
+80853b08 Pages::VSSettings::GetManipulatorManager
+80853b10 Pages::VSSettings::__dt
+80853bd8 Pages::VSSettings::GetRuntimeTypeInfo
+80853be4 Pages::VSSettings::TriggerUpDown3APtmf
+80853c14 Pages::VSSettings::TriggerRadioPtmf
+80853c44 Pages::VSSettings::TriggerTextPtmf
+80853c74 Pages::VSSettings::TriggerUpDown2APtmf
+80853ca4 VSSettingsPage_cpp_sinit_
+80853cb8 Pages::Unlock::GetPageById
+80853dc8 0x80853dc8
+80853e18 Pages::Unlock::OnInit
+80853e30 Pages::Unlock::CreateExternalControl
+80853ec0 Pages::Unlock::CreateControl
+80854104 Pages::Unlock::OnActivate
+80854320 Pages::Unlock::AfterControlUpdate
+8085447c Pages::Unlock::OnButtonClick
+80854748 Pages::Unlock::OnExternalButtonSelect
+8085474c Pages::Unlock::OnButtonDeselect
+80854750 Pages::Unlock::OnBackPress
+80854754 Pages::Unlock::SetTitleBMG
+80854810 Pages::Unlock::PrepareControls
+80854a80 0x80854a80
+80854ae0 0x80854ae0
+80854b40 Pages::Unlock::SetModels
+80854c3c Pages::Unlock::SetModels_switch
+80854c40 Pages::Unlock::SetModels_caseD_1b
+80854c4c Pages::Unlock::SetModels_caseD_10
+80854c54 Pages::Unlock::SetModels_caseD_d
+80854c60 Pages::Unlock::SetModels_caseD_b
+80854c6c Pages::Unlock::SetModels_caseD_e
+80854c78 Pages::Unlock::SetModels_caseD_11
+80854c84 Pages::Unlock::SetModels_caseD_12
+80854cd8 0x80854cd8
+80854d28 0x80854d28
+80854d64 0x80854d64
+80854e00 Pages::Unlock::SetMessageWindowMessage
+80854fa4 0x80854fa4
+808550bc Pages::Unlock::GetPlayerBifield
+808550c4 Pages::Unlock::GetActivePlayerBitfield
+808550cc Pages::Unlock::SetButtonHandlers
+80855128 Pages::Unlock::GetManipulatorManager
+80855130 Pages::Unlock::__dt
+808551e0 Pages::Unlock::GetRuntimeTypeInfo
+808551ec UnlockPage_cpp_sinit_
+80855200 Pages::RaceIntro::OnInit
+80855644 Pages::RaceIntro::__dt
+808556c4 Pages::RaceIntro::GetRuntimeTypeInfo
+808556d0 RaceIntroPage_cpp_sinit_
+808556e4 Pages::TTSplits::__ct
+80855854 Pages::TTSplits::Unload
+80855864 Pages::TTSplits::__dt
+80855924 Pages::TTSplits::OnInit
+80855adc Pages::TTSplits::AfterControlUpdate
+80855b30 Pages::TTSplits::BeforeEntranceAnimations
+8085616c Pages::TTSplits::BeforeExitAnimations
+808561dc Pages::TTSplits::GetNextPage
+80856228 Pages::TTSplits::GetRuntimeTypeInfo
+80856234 Pages::TTSplits::TriggerAction
+80856264 Pages::TTSplits::_sinit_
+80856278 Pages::RaceHUD::OnInit
+80856664 Pages::RaceHUD::InitActions
+808569ac Pages::RaceHUD::OnNextPlayerSwitch
+808569b4 Pages::RaceHUD::OnPrevPlayerSwitch
+808569bc Pages::RaceHUD::OnPause
+80856b74 Pages::RaceHUD::ChangeFocusedPlayer
+80856ccc Pages::RaceHUD::GetLocalPlayerCount
+80856cec Pages::RaceHUD::BeforeControlUpdate
+808572d4 Pages::RaceHUD::HasPlayerRaceEnded
+8085732c Pages::RaceHUD::HasRaceEndedReplay
+808573ac Pages::RaceHUD::HasRaceEnded
+808574b8 Pages::RaceHUD::AfterControlUpdate
+80857ac8 0x80857ac8
+80857b08 Pages::RaceHUD::GetCtrlRaceBaseCount
+80857cc0 Pages::RaceHUD::InitCtrlRaceBase
+80858828 CtrlRaceCount::__ct
+80858864 RaceBalloons::__dt
+808588cc CtrlRaceNameBalloon::__ct
+8085891c CtrlRaceItemBalloon::__ct
+8085896c Pages::TournamentHUD::GetEnabledCtrlRaceBases
+80858a18 Pages::RaceHUD::OnDeactivate
+80858a24 Pages::RaceHUD::OnDispose
+80858a34 Pages::RaceHUD::ChangeSectionByReinit
+80858a50 Pages::RaceHUD::OnItemObjTargeting
+80858ae4 Pages::RaceHUD::UpdateRaceBalloons
+80858b88 Pages::TournamentHUD::GetCtrlRaceNameBalloonCount
+80858b90 Pages::TournamentHUD::GetPausePageId
+80858b98 Pages::TournamentHUD::__dt
+80858c04 Pages::TournamentHUD::GetRuntimeTypeInfo
+80858c10 Pages::RaceHUD::GetRuntimeTypeInfo
+80858c1c TriggerPtmf
+80858c4c 0x80858c4c
+80858ca4 Pages::RaceMenu::__ct
+80858d60 Pages::RaceMenu::OnInit
+80859a2c Pages::RaceMenu::OnActivate
+80859e98 Pages::RaceMenu::AfterControlUpdate
+80859f30 Pages::RaceMenu::BeforeEntranceAnimations
+80859f34 Pages::RaceMenu::BeforeExitAnimations
+80859fa0 Pages::RaceMenu::OnDeactivate
+80859fa4 Pages::RaceMenu::OnDispose
+8085a03c 0x8085a03c
+8085a098 Pages::RaceMenu::OnStartPress
+8085a0f4 Pages::RaceMenu::OnButtonClick
+8085a1c0 0x8085a1c0
+8085a208 0x8085a208
+8085a298 0x8085a298
+8085a580 0x8085a580
+8085a5e0 0x8085a5e0
+8085a67c 0x8085a67c
+8085a6dc 0x8085a6dc
+8085a80c 0x8085a80c
+8085a9b0 0x8085a9b0
+8085ac54 0x8085ac54
+8085ade8 0x8085ade8
+8085b024 0x8085b024
+8085b0d8 0x8085b0d8
+8085b18c 0x8085b18c
+8085b3bc 0x8085b3bc
+8085b468 0x8085b468
+8085b4bc 0x8085b4bc
+8085b568 0x8085b568
+8085b5e8 0x8085b5e8
+8085b6d8 0x8085b6d8
+8085b73c 0x8085b73c
+8085b7bc 0x8085b7bc
+8085b81c 0x8085b81c
+8085b8c8 0x8085b8c8
+8085b930 0x8085b930
+8085b9dc 0x8085b9dc
+8085ba44 0x8085ba44
+8085baf0 0x8085baf0
+8085bb9c 0x8085bb9c
+8085bc10 Pages::RaceMenu::IsFinalRace
+8085bd58 Pages::RaceMenu::GetRuntimeTypeInfo
+8085bd64 TriggerPtmf
+8085bd94 TriggerPtmf
+8085bdc4 0x8085bdc4
+8085be44 Pages::Leaderboard::__ct
+8085bf94 Pages::Leaderboard::OnActivate
+8085c070 0x8085c070
+8085c0c4 Pages::Leaderboard::AfterControlUpdate
+8085c16c 0x8085c16c
+8085c390 Pages::Leaderboard::GetRuntimeTypeInfo
+8085c39c TriggerPtmf
+8085c3cc 0x8085c3cc
+8085c3e0 Pages::GPVSLeaderboardUpdate::OnInit
+8085c4f4 Pages::GPVSLeaderboardUpdate::GetRowCount
+8085c504 Pages::GPVSLeaderboardUpdate::CanEnd
+8085c5a0 Pages::GPVSLeaderboardUpdate::Func_0x6c
+8085c858 Pages::GPVSLeaderboardUpdate::FillRows
+8085c974 Pages::GPVSLeaderboardUpdate::GetNextPage
+8085c9b0 Pages::GPVSLeaderboardTotal::OnInit
+8085cae8 Pages::GPVSLeaderboardTotal::FillRows
+8085cc40 Pages::GPVSLeaderboardTotal::GetNextPage
+8085cc84 Pages::GPVSLeaderboardTotal::ComparePlayers
+8085cd18 Pages::WWLeaderboardUpdate::OnInit
+8085ce8c Pages::WWLeaderboardUpdate::FillRows
+8085d55c Pages::WWLeaderboardUpdate::GetNextPage
+8085d564 Pages::TTLeaderboard::OnInit
+8085d784 Pages::TTLeaderboard::GetRowCount
+8085d78c Pages::TTLeaderboard::FillRows
+8085dc44 Pages::TTLeaderboard::GetNextPage
+8085de34 0x8085de34
+8085e3ac 0x8085e3ac
+8085e3b4 0x8085e3b4
+8085e3bc 0x8085e3bc
+8085e42c 0x8085e42c
+8085e438 Pages::TTLeaderboard::__dt
+8085e4b8 Pages::TTLeaderboard::GetRuntimeTypeInfo
+8085e4c4 Pages::WWLeaderboardUpdate::__dt
+8085e534 Pages::WWLeaderboardUpdate::GetRuntimeTypeInfo
+8085e540 Pages::GPVSLeaderboardTotal::__dt
+8085e5b0 Pages::GPVSLeaderboardTotal::GetRuntimeTypeInfo
+8085e5bc Pages::GPVSLeaderboardUpdate::__dt
+8085e62c Pages::GPVSLeaderboardUpdate::GetRuntimeTypeInfo
+8085e638 0x8085e638
+8085e644 LeaderboardsPagescpp_sinit_
+8085e674 Pages::TeamVSLeaderboardBase::OnInit
+8085e7a0 Pages::TeamVSLeaderboardBase::AfterControlUpdate
+8085e7fc Pages::TeamVSLeaderboardBase::CanEnd
+8085e85c Pages::TeamVSLeaderboardBase::CalcTeamScoreDiff
+8085e9e4 Pages::TeamVSLeaderboardTotal::FillRows
+8085ea54 Pages::BattleLeaderboardTotal::FillRows
+8085ea64 Pages::BattleLeaderboardUpdate::FillRows
+8085edb4 Pages::TeamVSLeaderboardTotal::GetNextPage
+8085ede4 Pages::BattleLeaderboardUpdate::GetNextPage
+8085ee14 Pages::BattleLeaderboardTotal::GetNextPage
+8085eeb0 Pages::BattleLeaderboardTotal::__dt
+8085ef3c Pages::BattleLeaderboardTotal::GetRuntimeTypeInfo
+8085ef48 Pages::BattleLeaderboardUpdate::__dt
+8085efd4 Pages::BattleLeaderboardUpdate::GetRuntimeTypeInfo
+8085efe0 Pages::TeamVSLeaderboardTotal::__dt
+8085f06c Pages::TeamVSLeaderboardTotal::GetRuntimeTypeInfo
+8085f078 Pages::TeamVSLeaderboardBase::GetRuntimeTypeInfo
+8085f084 TeamLeaderboard_cpp_sinit_
+8085f0ac Pages::LicenseRecords::GetPageById
+8085f1bc Pages::LicenseRecords::OnInit
+8085f264 Pages::LicenseRecords::CreateExternalControl
+8085f310 Pages::LicenseRecords::CreateControl
+8085f470 Pages::LicenseRecords::OnActivate
+8085f4dc Pages::LicenseRecords::AfterControlUpdate
+8085f4e0 0x8085f4e0
+8085f5bc Pages::LicenseRecords::OnExternalButtonSelect
+8085f5c0 0x8085f5c0
+8085f5c4 0x8085f5c4
+8085f5ec 0x8085f5ec
+8085f934 0x8085f934
+8085fa70 0x8085fa70
+8085fc0c 0x8085fc0c
+8085fd24 0x8085fd24
+8085fec0 Pages::LicenseRecords::GetPlayerBitfield
+8085fec8 Pages::LicenseRecords::GetActivePlayerBitfield
+8085fed0 Pages::LicenseRecords::SetButtonHandlers
+8085ff2c Pages::LicenseRecords::GetManipulatorManager
+8085ff34 Pages::LicenseRecords::__dt
+8085ffb4 Pages::LicenseRecords::GetRuntimeTypeInfo
+8085ffc0 LicenseRecordsPagecpp_sinit_
+8085ffd4 RacePauseMgr::CreateInstance
+80860034 RacePauseMgr::__ct
+8086004c RacePauseMgr::DestroyInstance
+8086009c RacePauseMgr::__dt
+808600dc RacePauseMgr::RequestPause
+80860100 RacePauseMgr::RequestUnpause
+80860124 0x80860124
+80860158 0x80860158
+80860160 0x80860160
+80860204 0x80860204
+80860254 0x80860254
+8086025c 0x8086025c
+80860264 0x80860264
+8086027c 0x8086027c
+808602b0 0x808602b0
+808602b8 0x808602b8
+808602c0 0x808602c0
+808602c8 0x808602c8
+808602d0 0x808602d0
+808602d8 0x808602d8
+808602e0 0x808602e0
+808602e8 0x808602e8
+808602f0 0x808602f0
+808602f8 0x808602f8
+80860300 0x80860300
+80860308 0x80860308
+80860310 0x80860310
+80860318 0x80860318
+80860320 0x80860320
+80860328 0x80860328
+80860330 0x80860330
+80860338 0x80860338
+80860340 0x80860340
+80860348 0x80860348
+80860350 0x80860350
+80860358 0x80860358
+8086038c 0x8086038c
+80860394 0x80860394
+8086039c 0x8086039c
+808603a4 0x808603a4
+808603ac 0x808603ac
+808603b4 0x808603b4
+808603d0 0x808603b4_switch
+808603d4 0x808603b4_caseD_1
+808603dc 0x808603b4_caseD_0
+808603e4 0x808603b4_caseD_3
+808603ec 0x808603b4_caseD_a
+808603f4 0x808603b4_caseD_10
+808603fc 0x808603b4_caseD_12
+80860404 0x808603b4_caseD_11
+8086040c 0x808603b4_caseD_13
+8086041c 0x8086041c
+80860448 0x80860448
+80860450 0x80860450
+80860470 0x80860450_switch
+80860474 0x80860450_caseD_1e
+8086047c 0x80860450_caseD_21
+80860484 IsOnlineSection
+808604c0 IsGhostRaceSection
+808604e0 IsTournamentSection
+80860500 GetActiveRacedataPlayers
+808605fc GetLocalPlayerCount
+80860614 0x80860614
+8086068c 0x8086068c
+808606a4 GetNextVSTrack
+808606d0 0x808606d0
+8086070c 0x8086070c
+8086082c 0x8086082c
+808608e4 TimerToTextInfo
+808609fc IsGameplaySection
+80860a28 0x80860a28
+80860a8c IsBattle
+80860acc GetCharacterIconPaneName
+80860af0 GetItemIconPaneName
+80860b54 GetCupIconPaneName
+80860b88 0x80860b88
+80860bbc GetBattleCupIconPaneName
+80860bf0 0x80860bf0
+80860e08 GetMapIconPaneName
+80860f2c 0x80860f2c
+80860f94 0x80860f2c_switch
+80860f98 0x80860f2c_caseD_0
+80861014 0x80860f2c_caseD_4
+8086107c 0x80860f2c_caseD_8
+808610fc 0x80860f2c_caseD_c
+80861164 0x80860f2c_caseD_10
+8086129c 0x80860f2c_caseD_11
+80861310 0x80860f2c_caseD_12
+80861368 0x80860f2c_caseD_13
+808613b0 0x80860f2c_caseD_14
+80861488 0x80860f2c_caseD_15
+808614e4 0x80860f2c_caseD_23
+80861524 0x80860f2c_caseD_16
+80861598 0x80860f2c_caseD_17
+80861680 0x80860f2c_caseD_18
+808616f4 0x80860f2c_caseD_19
+8086175c 0x80860f2c_caseD_24
+808617a4 0x80860f2c_caseD_1a
+808618b8 0x80860f2c_caseD_1b
+80861938 0x80860f2c_caseD_1c
+80861a1c 0x80860f2c_caseD_1d
+80861a78 0x80860f2c_caseD_1e
+80861ab8 0x80860f2c_caseD_1f
+80861b2c 0x80860f2c_caseD_20
+80861ba4 0x80860f2c_caseD_21
+80861c04 0x80860f2c_caseD_22
+80861c50 0x80860f2c_caseD_25
+80861d28 0x80860f2c_caseD_26
+80861d84 0x80860f2c_caseD_27
+80861dcc 0x80860f2c_caseD_28
+80861e40 0x80860f2c_caseD_29
+80861eb4 0x80860f2c_caseD_2a
+80861f28 0x80860f2c_caseD_2b
+80861f84 0x80860f2c_caseD_3c
+80861fcc 0x80860f2c_caseD_2c
+80862040 0x80860f2c_caseD_2d
+80862128 0x80860f2c_caseD_2e
+8086219c 0x80860f2c_caseD_2f
+80862210 0x80860f2c_caseD_30
+80862278 0x80860f2c_caseD_31
+808622b8 0x80860f2c_caseD_32
+8086232c 0x80860f2c_caseD_33
+808623a0 0x80860f2c_caseD_34
+80862484 0x80860f2c_caseD_35
+808624f8 0x80860f2c_caseD_36
+8086256c 0x80860f2c_caseD_37
+808625c8 0x80860f2c_caseD_38
+80862608 0x80860f2c_caseD_39
+8086267c 0x80860f2c_caseD_3a
+808626d8 0x80860f2c_caseD_3b
+80862754 0x80862754
+808627c0 0x808627c0
+8086284c 0x8086284c
+808628a4 0x808628a4
+80862988 0x80862988
+808629a4 0x80862988_switch
+808629a8 0x80862988_caseD_34
+808629b0 0x80862988_caseD_0
+808629b8 0x80862988_caseD_1
+808629c0 0x80862988_caseD_2
+808629c8 0x80862988_caseD_3
+808629d0 0x80862988_caseD_4
+808629d8 0x80862988_caseD_5
+808629e0 0x80862988_caseD_6
+808629e8 0x80862988_caseD_7
+808629f0 0x80862988_caseD_b
+808629f8 0x80862988_caseD_8
+80862a00 0x80862988_caseD_a
+80862a08 0x80862988_caseD_9
+80862a10 0x80862988_caseD_c
+80862a18 0x80862988_caseD_d
+80862a20 0x80862988_caseD_22
+80862a28 0x80862988_caseD_23
+80862a30 0x80862988_caseD_24
+80862a38 0x80862988_caseD_25
+80862a40 0x80862988_caseD_26
+80862a48 0x80862988_caseD_27
+80862a50 0x80862988_caseD_28
+80862a58 0x80862988_caseD_29
+80862a60 0x80862988_caseD_2a
+80862a68 0x80862988_caseD_2b
+80862a70 0x80862988_caseD_2c
+80862a78 0x80862988_caseD_2d
+80862a80 0x80862988_caseD_2e
+80862a88 0x80862988_caseD_2f
+80862a90 0x80862988_caseD_30
+80862a98 0x80862988_caseD_31
+80862aa0 0x80862988_caseD_32
+80862aa8 0x80862988_caseD_33
+80862ab0 0x80862988_caseD_10
+80862ab8 0x80862ab8
+80862ad4 0x80862ab8_switch
+80862ad8 0x80862ab8_caseD_0
+80862ae0 0x80862ab8_caseD_1
+80862ae8 0x80862ab8_caseD_2
+80862af0 0x80862ab8_caseD_3
+80862af8 0x80862ab8_caseD_4
+80862b00 0x80862ab8_caseD_5
+80862b08 0x80862ab8_caseD_6
+80862b10 0x80862ab8_caseD_7
+80862b18 0x80862ab8_caseD_8
+80862b20 0x80862ab8_caseD_9
+80862b28 0x80862ab8_caseD_a
+80862b30 0x80862ab8_caseD_b
+80862b38 0x80862ab8_caseD_c
+80862b40 0x80862ab8_caseD_d
+80862b48 0x80862ab8_caseD_e
+80862b50 0x80862ab8_caseD_f
+80862b58 0x80862ab8_caseD_10
+80862b60 0x80862ab8_caseD_11
+80862b68 0x80862ab8_caseD_12
+80862b70 0x80862ab8_caseD_14
+80862b78 0x80862ab8_caseD_15
+80862b80 0x80862ab8_caseD_16
+80862b88 0x80862ab8_caseD_17
+80862b90 0x80862ab8_caseD_18
+80862b98 0x80862ab8_caseD_19
+80862ba0 0x80862ab8_caseD_1a
+80862ba8 0x80862ab8_caseD_1c
+80862bb0 0x80862ab8_caseD_1d
+80862bb8 0x80862ab8_caseD_1f
+80862bc0 0x80862ab8_caseD_20
+80862bc8 0x80862ab8_caseD_21
+80862bd0 0x80862ab8_caseD_25
+80862bd8 0x80862ab8_caseD_26
+80862be0 0x80862ab8_caseD_28
+80862be8 0x80862ab8_caseD_29
+80862bf0 0x80862ab8_caseD_2a
+80862bf8 0x80862ab8_caseD_2b
+80862c00 0x80862ab8_caseD_2c
+80862c08 0x80862ab8_caseD_2d
+80862c10 0x80862ab8_caseD_2e
+80862c18 0x80862ab8_caseD_2f
+80862c20 0x80862ab8_caseD_30
+80862c28 0x80862ab8_caseD_32
+80862c30 0x80862ab8_caseD_33
+80862c38 0x80862ab8_caseD_34
+80862c40 0x80862ab8_caseD_35
+80862c48 0x80862ab8_caseD_36
+80862c50 0x80862ab8_caseD_37
+80862c58 0x80862ab8_caseD_39
+80862c60 0x80862ab8_caseD_3a
+80862c68 0x80862ab8_caseD_3b
+80862c78 0x80862c78
+80862c9c 0x80862c9c
+80862cb8 0x80862c9c_switch
+80862cbc 0x80862c9c_caseD_0
+80862cc4 0x80862c9c_caseD_1
+80862ccc 0x80862c9c_caseD_2
+80862cd4 0x80862c9c_caseD_3
+80862cdc 0x80862c9c_caseD_4
+80862ce4 0x80862c9c_caseD_5
+80862cec 0x80862c9c_caseD_6
+80862cf4 0x80862c9c_caseD_7
+80862cfc 0x80862c9c_caseD_b
+80862d04 0x80862c9c_caseD_8
+80862d0c 0x80862c9c_caseD_a
+80862d14 0x80862c9c_caseD_9
+80862d1c 0x80862c9c_caseD_c
+80862d24 0x80862c9c_caseD_d
+80862d34 0x80862d34
+80862d58 0x80862d58
+80862d78 0x80862d58_switch
+80862d7c 0x80862d58_caseD_22
+80862d84 0x80862d58_caseD_23
+80862d8c 0x80862d58_caseD_24
+80862d94 0x80862d58_caseD_25
+80862d9c 0x80862d58_caseD_26
+80862da4 0x80862d58_caseD_27
+80862dac 0x80862d58_caseD_28
+80862db4 0x80862d58_caseD_29
+80862dbc 0x80862d58_caseD_2a
+80862dc4 0x80862d58_caseD_2b
+80862dcc 0x80862d58_caseD_2c
+80862dd4 0x80862d58_caseD_2d
+80862ddc 0x80862d58_caseD_2e
+80862de4 0x80862d58_caseD_2f
+80862dec 0x80862d58_caseD_30
+80862df4 0x80862d58_caseD_31
+80862dfc 0x80862d58_caseD_32
+80862e04 0x80862d58_caseD_33
+80862e0c 0x80862d58_caseD_1e
+80862e14 0x80862d58_caseD_1f
+80862e1c 0x80862d58_caseD_20
+80862e24 0x80862e24
+80863234 0x80863234
+8086329c 0x8086329c
+808632c4 0x808632c4
+808632f0 0x808632c4_switch
+808632f4 0x808632c4_caseD_5
+80863300 0x808632c4_caseD_a
+8086330c 0x808632c4_caseD_7
+80863318 0x808632c4_caseD_f
+80863324 0x808632c4_caseD_12
+80863330 0x808632c4_caseD_14
+8086333c 0x808632c4_caseD_1a
+80863348 0x808632c4_caseD_1b
+80863358 0x808632c4_caseD_10
+8086335c 0x8086335c
+80863384 0x80863384
+808633ac 0x808633ac
+808633cc 0x808633ac_switch
+808633d0 0x808633ac_caseD_1
+808633dc 0x808633ac_caseD_2
+808633e8 0x808633ac_caseD_4
+808633f4 0x808633ac_caseD_5
+80863400 0x808633ac_caseD_7
+8086340c 0x808633ac_caseD_8
+80863418 0x808633ac_caseD_a
+80863424 0x808633ac_caseD_c
+80863430 0x808633ac_caseD_e
+8086343c 0x808633ac_caseD_f
+80863448 0x808633ac_caseD_10
+80863454 0x808633ac_caseD_12
+80863460 0x808633ac_caseD_14
+8086346c 0x808633ac_caseD_1b
+80863478 0x808633ac_caseD_1d
+80863484 0x808633ac_caseD_1e
+80863490 0x808633ac_caseD_1f
+80863498 0x808633ac_caseD_0
+8086349c 0x8086349c
+808634bc 0x8086349c_switch
+808634c0 0x8086349c_caseD_1
+808634cc 0x8086349c_caseD_2
+808634d8 0x8086349c_caseD_5
+808634e4 0x8086349c_caseD_7
+808634f0 0x8086349c_caseD_8
+808634fc 0x8086349c_caseD_a
+80863508 0x8086349c_caseD_c
+80863514 0x8086349c_caseD_e
+80863520 0x8086349c_caseD_f
+8086352c 0x8086349c_caseD_10
+80863538 0x8086349c_caseD_12
+80863544 0x8086349c_caseD_14
+80863550 0x8086349c_caseD_1b
+8086355c 0x8086349c_caseD_1d
+80863568 0x8086349c_caseD_1e
+80863574 0x8086349c_caseD_1f
+8086357c 0x8086349c_caseD_0
+80863580 0x80863580
+808635a0 0x80863580_switch
+808635a4 0x80863580_caseD_a
+808635b0 0x80863580_caseD_e
+808635bc 0x80863580_caseD_d
+808635c8 0x80863580_caseD_4
+808635d4 0x80863580_caseD_7
+808635e0 0x80863580_caseD_f
+808635ec 0x80863580_caseD_12
+808635f8 0x80863580_caseD_14
+80863604 0x80863580_caseD_1b
+80863610 0x80863580_caseD_1
+80863618 0x80863580_caseD_0
+80863638 0x80863638
+80863660 0x80863660
+80863680 0x80863660_switch
+80863684 0x80863660_caseD_2
+80863690 0x80863660_caseD_a
+8086369c 0x80863660_caseD_8
+808636a8 0x80863660_caseD_e
+808636b4 0x80863660_caseD_d
+808636c0 0x80863660_caseD_4
+808636cc 0x80863660_caseD_7
+808636d8 0x80863660_caseD_f
+808636e4 0x80863660_caseD_13
+808636f0 0x80863660_caseD_12
+808636fc 0x80863660_caseD_1b
+80863708 0x80863660_caseD_1
+80863710 0x80863660_caseD_0
+8086375c 0x8086375c
+80863798 0x8086375c_switch
+8086379c 0x8086375c_caseD_a
+808637a8 0x8086375c_caseD_9
+808637b4 0x8086375c_caseD_c
+808637c0 0x8086375c_caseD_e
+808637cc 0x8086375c_caseD_4
+808637d8 0x8086375c_caseD_1b
+808637e4 0x8086375c_caseD_0
+808637f0 0x8086375c_caseD_1
+80863814 0x8086375c_caseD_10
+80863828 0x80863828
+8086382c 0x8086382c
+80863854 0x8086382c_switch
+80863858 0x8086382c_caseD_b
+80863864 0x8086382c_caseD_a
+80863870 0x8086382c_caseD_8
+8086387c 0x8086382c_caseD_e
+80863888 0x8086382c_caseD_d
+80863894 0x8086382c_caseD_7
+808638a0 0x8086382c_caseD_f
+808638ac 0x8086382c_caseD_12
+808638b8 0x8086382c_caseD_14
+808638c4 0x8086382c_caseD_1b
+808638d0 0x8086382c_caseD_0
+808638dc 0x8086382c_caseD_1
+808638e4 0x8086382c_caseD_10
+808638e8 0x808638e8
+80863928 Audio::CharacterActor::__ct
+808639a8 0x808639a8
+808639e8 Audio::RandomCharacterPicker::__dt
+80863a44 Audio::RandomSoundPicker::__dt
+80863a9c Audio::CharacterActor::Link
+80863eb8 0x80863eb8
+80863ff8 Audio::CharacterActor::Unlink
+80864000 Audio::CharacterActor::Update
+808646c4 Audio::CharacterActor::HoldSound
+808646f0 Audio::CharacterActor::PlayCharacterSoundConditional
+80864748 Audio::CharacterActor::PlayCharacterSoundConditional_switch
+8086474c Audio::CharacterActor::PlayCharacterSoundConditional_case1a
+808647c8 Audio::CharacterActor::PlayCharacterSoundConditional_case1b
+80864854 Audio::CharacterActor::PlayCharacterSoundConditional_case16
+80864874 Audio::CharacterActor::PlayCharacterSoundConditional_case17
+808648c4 Audio::CharacterActor::PlayCharacterSoundConditional_caseb
+808648d0 Audio::CharacterActor::PlayCharacterSoundConditional_casec
+808648ec Audio::CharacterActor::PlayCharacterSoundConditional_case10
+80864914 Audio::CharacterActor::PlayCharacterSound
+80864cec 0x80864cec
+80865050 0x80865050
+80865138 0x80865138
+80865390 0x80865390
+80865448 Audio::CharacterActor::PlayCharacterCollisionSound
+80865480 0x80865480
+80865488 0x80865488
+80865490 0x80865490
+80865498 0x80865498
+808654a8 0x808654a8
+80865518 0x80865518
+80865534 0x80865534
+80865580 0x80865580
+808655b4 0x808655b4
+80865618 Audio::CharacterActor::StartSound
+808656c4 0x808656c4
+808656cc 0x808656cc
+808658c0 0x808658c0
+80865918 0x80865918
+80865944 0x80865944
+80865964 0x80865964
+80865984 Audio::CharacterActor::StopSound
+80865a18 0x80865a18
+80865a98 0x80865a98
+80865bd4 0x80865bd4
+80865de8 0x80865de8
+80865f04 0x80865f04
+80865f38 0x80865f38
+80865f50 0x80865f50
+80865f64 0x80865f64
+80865fcc Jumbotron_StopPlaying
+80865fe0 0x80865fe0
+80866110 0x80866110
+80866170 0x80866170
+80866198 0x80866198
+8086622c 0x8086622c
+808662e4 0x808662e4
+8086630c 0x8086630c
+80866388 Audio::CharacterActor::GetCharacterGroupId
+80866404 Audio::CharacterActor::GetCharacterCannonGroupId
+808664c4 0x808664c4
+80866628 0x80866628
+80866b1c 0x80866b1c
+80866b94 0x80866b94
+80866c08 Audio::CharacterActor::__dt
+80866d0c Audio::CharacterActor::__dt(thunk)
+80866d14 Audio::CharacterActor::StopSound(thunk)
+80866d1c Audio::CharacterActor::HoldSound(thunk)
+80866d24 Audio::CharacterActor::StartSound(thunk)
+80866d2c Audio::CharacterActor::Update(thunk)
+80866d34 Audio::CharacterActor::Unlink(thunk)
+80866d3c Audio::CharacterActor::Link(thunk)
+80866d44 AudioRandomMgr::Disposer__dt
+80866ddc AudioRandomMgr::CreateInstance
+80866e64 AudioRandomMgr::DestroyInstance
+80866e98 AudioRandomMgr::__dt
+80866f4c AudioRandomMgr::RandInt
+80866f80 AudioRandomMgr::RandFloat
+80866fc0 0x80866fc0
+80867020 0x80867020
+8086708c Audio::RandomSoundPicker::__ct
+808670d0 0x808670d0
+80867160 0x80867160
+80867194 0x80867194
+808672f4 0x808672f4
+808673a4 0x808673a4
+80867400 0x80867400
+808674cc 0x808674cc
+80867540 0x80867540
+80867550 0x80867550
+80867584 0x80867584
+808675ec 0x808675ec
+808676a4 0x808676a4
+808676d8 0x808676d8
+808676e0 Audio::RandomCharacterPicker::__ct
+80867724 0x80867724
+80867788 0x80867788
+80867790 0x80867790
+80867850 0x80867850
+80867910 0x80867910
+808679d0 0x808679d0
+80867a90 0x80867a90
+80867b3c 0x80867b3c
+80867cb8 0x80867cb8
+80867ddc 0x80867ddc
+80867f0c 0x80867f0c
+80868004 0x80868004
+80868044 0x80868044
+8086817c 0x8086817c
+808683e0 0x808683e0
+80868554 0x80868554
+8086858c 0x8086858c
+80868638 0x80868638
+80868774 cAIPad__ct
+80868780 0x80868780
+80868794 0x80868794
+80868974 0x80868974
+808689dc 0x808689dc
+80868a3c 0x80868a3c
+80868abc 0x80868abc
+80868c20 0x80868c20
+80868d3c 0x80868d3c
+80868d54 0x80868d54
+80868e2c 0x80868e2c
+80868f1c 0x80868f1c
+80868f34 0x80868f34
+80869024 0x80869024
+80869038 0x80869038
+80869054 0x80869054
+8086906c 0x8086906c
+80869084 0x80869084
+80869098 0x80869098
+808690a8 cTeam_GetPlayer
+808690b8 0x808690b8
+808690e0 0x808690e0
+808690fc 0x808690fc
+80869118 0x80869118
+808691fc 0x808691fc
+808692c8 0x808692c8
+80869340 thunk_0x808691fc
+80869344 0x80869344
+80869364 0x80869344_switch
+80869368 0x80869344_caseD_0
+80869374 0x80869344_caseD_1
+80869380 0x80869344_caseD_2
+8086938c 0x80869344_caseD_3
+808693b8 0x808693b8
+80869488 0x80869488
+8086965c 0x8086965c
+808696f8 0x808696f8
+808697a4 0x808697a4
+808697bc 0x808697bc
+80869844 0x80869844
+80869884 0x80869884
+80869998 0x80869998
+808699d8 0x808699d8
+80869b2c 0x80869b2c
+80869c48 0x80869c48
+80869d20 0x80869d20
+80869df4 0x80869df4
+80869fd0 0x80869fd0
+8086a0dc 0x8086a0dc
+8086a254 0x8086a254
+8086a2d4 0x8086a2d4
+8086a318 0x8086a318
+8086a9ec 0x8086a9ec
+8086a9f0 0x8086a9f0
+8086aa30 0x8086aa30
+8086aa34 0x8086aa34
+8086aa74 0x8086aa74
+8086ab68 0x8086ab68
+8086aba8 0x8086aba8
+8086ac20 obj_casino_roulette::__ct
+8086ace8 obj_casino_roulette_generateBigassLongListOfFloatsForRotation
+8086af30 0x8086af30
+8086b1f4 obj_casino_roulette_spinVisually
+8086b274 obj_casino_roulette_update
+8086b33c obj_casino_roulette_spinEverythingElse
+8086b720 obj_casino_roulette_calculateSpin
+8086b878 obj_casino_roulette_spinPlayer
+8086baac obj_casino_roulette_initDushBoardAnimationSpeed?
+8086bb28 0x8086bb28
+8086bb34 0x8086bb34
+8086bbb4 0x8086bbb4
+8086bbbc 0x8086bbbc
+8086bbc4 0x8086bbc4
+8086bbd4 0x8086bbd4
+8086bbdc 0x8086bbdc
+8086bc1c Objects::WLwallGC::__ct
+8086bde4 Objects::WLwallGC::__dt
+8086be34 Objects::WLwallGC::OnStart
+8086bf08 0x8086bf08
+8086bf30 Objects::WLwallGC::GetTransformationMatrix
+8086c098 Objects::WLwallGC::CalcNextPosition
+8086c108 Objects::WLwallGC::Update
+8086c280 Objects::WLwallGC::CalcOtherEntityDistance
+8086c2a8 Objects::WLwallGC::UpdateOtherEntityPos
+8086c328 Objects::WLwallGC::IsCollidingAddEntryNoTriangleCheckImpl
+8086c5a8 Objects::WLwallGC::IsCollidingImpl
+8086c640 Objects::WLwallGC::GetPropertiesBitfield
+8086c648 Objects::WLwallGC::GetPeriod
+8086c684 Objects::WLwallGC::vf_0x11c
+8086c68c 0x8086c68c
+8086c988 0x8086c988
+8086c98c 0x8086c98c
+8086c9cc 0x8086c9cc
+8086ca40 0x8086ca40
+8086cacc 0x8086cacc
+8086cb9c 0x8086cb9c
+8086d890 0x8086d890
+8086de94 0x8086de94
+8086dea8 0x8086dea8
+8086dec8 0x8086dec8
+8086dee8 0x8086dee8
+8086def0 0x8086def0
+8086e034 0x8086e034
+8086e110 0x8086e110
+8086e218 0x8086e218
+8086e21c 0x8086e21c
+8086e224 0x8086e224
+8086e824 0x8086e824
+8086e910 0x8086e910
+8086e9dc 0x8086e9dc
+8086eadc 0x8086eadc
+8086ec3c 0x8086ec3c
+8086ec5c 0x8086ec5c
+8086ee50 0x8086ee50
+8086ef34 0x8086ef34
+8086f01c 0x8086f01c
+8086f19c 0x8086f19c
+8086f23c 0x8086f23c
+8086f410 0x8086f410
+8086f70c 0x8086f70c
+8086f8ec 0x8086f8ec
+80871010 0x80871010
+80871060 0x80871060
+8087147c 0x8087147c
+80871684 0x80871684
+80871698 0x80871698
+808718b0 0x808718b0
+80871900 0x80871900
+80871af4 0x80871af4
+80871b44 0x80871b44
+80871bb0 0x80871bb0
+80872208 0x80872208
+80872858 0x80872858
+80872acc 0x80872acc
+80872bd4 0x80872bd4
+80872be0 0x80872be0
+80872be8 0x80872be8
+80872bf0 0x80872bf0
+80872bf4 0x80872bf4
+80872bf8 0x80872bf8
+80872bfc 0x80872bfc
+80872c00 0x80872c00
+80872c08 0x80872c08
+80872c0c 0x80872c0c
+80872c14 0x80872c14
+80872ca4 0x80872ca4
+80872cb4 0x80872cb4
+80872cc8 0x80872cc8
+80873824 0x80873824
+80873850 0x80873850
+8087385c 0x8087385c
+808739b0 0x808739b0
+808739b8 0x808739b8
+808739c0 0x808739c0
+808739c8 0x808739c8
+808739d0 0x808739d0
+808739f4 0x808739f4
+80873a04 0x80873a04
+80873a08 0x80873a08
+80873a20 0x80873a20
+80873a40 0x80873a40
+80873b48 0x80873b48
+80873cf4 0x80873cf4
+80873dc0 0x80873dc0
+80873e14 0x80873e14
+80873e2c 0x80873e2c
+80873f6c 0x80873f6c
+808741d8 0x808741d8
+80874244 0x80874244
+80874300 0x80874300
+808743a0 0x808743a0
+80874570 0x80874570
+8087477c 0x8087477c
+80874950 0x80874950
+80874a44 0x80874a44
+80874b34 0x80874b34
+80874c18 0x80874c18
+80874d7c 0x80874d7c
+80874d90 0x80874d90
+80874e08 0x80874e08
+80875454 0x80875454
+808755c4 0x808755c4
+8087567c 0x8087567c
+80875688 0x80875688
+80875740 GoalOverlay_SceneCreated
+8087574c 0x8087574c
+80875aac 0x80875aac
+80875d70 0x80875d70
+808766f0 0x808766f0
+80876710 0x80876710
+80876964 0x80876964
+808773f4 0x808773f4
+80877408 0x80877408
+80877574 0x80877574
+80877974 0x80877974
+80877b48 0x80877b48
+80877be0 0x80877be0
+808781d0 0x808781d0
+80878324 0x80878324
+80878494 0x80878494
+8087889c 0x8087889c
+80879654 0x80879654
+80879698 0x80879698
+80879720 0x80879720
+80879c14 0x80879c14
+80879da0 0x80879da0
+8087a138 0x8087a138
+8087a3ac 0x8087a3ac
+8087a4dc 0x8087a4dc
+8087a70c 0x8087a70c
+8087a718 0x8087a718
+8087aff4 0x8087aff4
+8087aff8 0x8087aff8
+8087b198 0x8087b198
+8087b20c 0x8087b20c
+8087b224 0x8087b224
+8087b228 0x8087b228
+8087b2ec 0x8087b2ec
+8087b2f4 0x8087b2f4
+8087b3dc 0x8087b3dc
+8087b46c 0x8087b46c
+8087b4d0 0x8087b4d0
+8087ba20 0x8087ba20
+8087ba24 0x8087ba24
+8087ba64 0x8087ba64
+8087bacc 0x8087bacc
+8087bfe4 0x8087bfe4
+8087cb04 0x8087cb04
+8087cb44 0x8087cb44
+8087cb4c 0x8087cb4c
+8087cb8c 0x8087cb8c
+8087cb94 0x8087cb94
+8087cbd4 0x8087cbd4
+8087cbdc 0x8087cbdc
+8087cc1c 0x8087cc1c
+8087cc5c 0x8087cc5c
+8087cc64 0x8087cc64
+8087cca4 0x8087cca4
+8087ccac 0x8087ccac
+8087ccec 0x8087ccec
+8087ccf4 0x8087ccf4
+8087dbe4 0x8087dbe4
+8087dc48 0x8087dc48
+8087dcac 0x8087dcac
+8087dcec 0x8087dcec
+8087dd58 0x8087dd58
+8087dd60 0x8087dd60
+8087ddc4 0x8087ddc4
+8087de30 0x8087de30
+8087de9c 0x8087de9c
+8087df04 0x8087df04
+8087df44 0x8087df44
+8087dfa8 0x8087dfa8
+8087dfb0 0x8087dfb0
+8087dff0 0x8087dff0
+8087e054 0x8087e054
+8087e05c 0x8087e05c
+8087e09c 0x8087e09c
+8087e100 0x8087e100
+8087e108 0x8087e108
+8087e148 0x8087e148
+8087e178 0x8087e178
+8087e1b8 0x8087e1b8
+8087e1e8 0x8087e1e8
+8087e228 0x8087e228
+8087e258 0x8087e258
+8087e298 0x8087e298
+8087e304 0x8087e304
+8087e30c 0x8087e30c
+8087e34c 0x8087e34c
+8087e3b0 0x8087e3b0
+8087e3b8 0x8087e3b8
+8087e3f8 0x8087e3f8
+8087e438 0x8087e438
+8087e468 0x8087e468
+80881314 0x80881314
+8088137c 0x8088137c
+808813e4 0x808813e4
+8088145c 0x8088145c
+808814c4 0x808814c4
+8088152c 0x8088152c
+808815a4 0x808815a4
+8088160c 0x8088160c
+80881674 0x80881674
+808816dc 0x808816dc
+80881744 0x80881744
+80881798 0x80881798
+808817ec 0x808817ec
+80881840 0x80881840
+808818b8 0x808818b8
+80881920 0x80881920
+80881974 0x80881974
+80881990 0x80881990
+80881994 0x80881994
+80882b58 0x80882b58
+80882be8 0x80882be8
+80882cd4 0x80882cd4
+80882d60 0x80882d60
+808830b4 0x808830b4
+80883250 0x80883250
+80883328 0x80883328
+80883428 0x80883428
+8088342c 0x8088342c
+80883434 0x80883434
+8088343c 0x8088343c
+80883444 0x80883444
+8088344c 0x8088344c
+808837b8 0x808837b8
+80883844 0x80883844
+80883b98 0x80883b98
+808861ac 0x808861ac
+808862d4 0x808862d4
+80886438 0x80886438
+8088644c 0x8088644c
+808864d4 0x808864d4
+808864dc 0x808864dc
+808864e4 0x808864e4
+80886574 obj_cruiserR::__ct
+808867ac 0x808867ac
+80886838 0x80886838
+80886a90 0x80886a90
+80886ab0 0x80886ab0
+80886b58 0x80886b58
+808873d0 0x808873d0
+808879b4 0x808879b4
+808879c8 0x808879c8
+80887a10 0x80887a10
+80887a18 0x80887a18
+80887a20 0x80887a20
+80887a58 0x80887a58
+80887ab4 0x80887ab4
+80887b04 0x80887b04
+80887be4 0x80887be4
+80887d14 0x80887d14
+80887d5c 0x80887d5c
+80887d64 0x80887d64
+80887d84 0x80887d84
+80887d8c 0x80887d8c
+80887e60 0x80887e60
+80887ea0 0x80887ea0
+80887f6c 0x80887f6c
+80887f8c 0x80887f8c
+80888464 0x80888464
+80888594 0x80888594
+808885a0 0x808885a0
+808885ac 0x808885ac
+808885b0 0x808885b0
+80888604 0x80888604
+80888608 0x80888608
+80888610 0x80888610
+80888614 0x80888614
+80888618 0x80888618
+80888620 0x80888620
+808887c4 0x808887c4
+80888804 0x80888804
+80888acc 0x80888acc
+80888b70 0x80888b70
+8088916c 0x8088916c
+808892b0 0x808892b0
+808892f4 0x808892f4
+808894b4 0x808894b4
+808894c0 0x808894c0
+808894c8 GetOneTimerLeadGroundContactAnims
+808894d4 0x808894d4
+808894d8 0x808894d8
+80889594 0x80889594
+8088959c 0x8088959c
+808895a0 0x808895a0
+808895a4 0x808895a4
+808895ac 0x808895ac
+80889744 0x80889744
+808897a0 0x808897a0
+808897f0 0x808897f0
+808899a8 0x808899a8
+8088a294 0x8088a294
+8088a2a8 0x8088a2a8
+8088a2f0 0x8088a2f0
+8088a2f8 0x8088a2f8
+8088a318 0x8088a318
+8088a320 0x8088a320
+8088a3b0 obj_Twanwan::__ct
+8088a46c obj_Twanwan::__dt
+8088a4bc obj_Twanwan_load
+8088a8a4 0x8088a8a4
+8088a978 0x8088a978
+8088ab04 0x8088ab04
+8088b87c obj_Twanwan_update
+8088bb7c 0x8088bb7c
+8088bb94 obj_Twanwan_draw_init
+8088bbcc 0x8088bbcc
+8088bd08 0x8088bd08
+8088bd4c 0x8088bd4c
+8088bdc0 0x8088bdc0
+8088bdc8 0x8088bdc8
+8088be00 0x8088be00
+8088be48 0x8088be48
+8088beb4 0x8088beb4
+8088c4b0 0x8088c4b0
+8088c520 0x8088c520
+8088c52c 0x8088c52c
+8088c584 0x8088c584
+8088c5a0 0x8088c5a0
+8088cb74 0x8088cb74
+8088ccc0 0x8088ccc0
+8088ccc4 0x8088ccc4
+8088cd04 0x8088cd04
+8088ce58 0x8088ce58
+8088ce5c 0x8088ce5c
+8088ce9c 0x8088ce9c
+8088cff0 0x8088cff0
+8088cff4 0x8088cff4
+8088d034 0x8088d034
+8088d100 0x8088d100
+8088d1cc 0x8088d1cc
+8088d298 0x8088d298
+8088d324 0x8088d324
+8088d3b0 0x8088d3b0
+8088d438 0x8088d438
+8088d914 0x8088d914
+8088ddfc 0x8088ddfc
+8088e2d8 0x8088e2d8
+8088e3e8 0x8088e3e8
+8088e4fc 0x8088e4fc
+8088e60c 0x8088e60c
+8088e66c 0x8088e66c
+8088e6cc 0x8088e6cc
+8088e72c 0x8088e72c
+8088e780 0x8088e780
+8088e7d4 0x8088e7d4
+8088e828 0x8088e828
+8088ea18 0x8088ea18
+8088ec08 0x8088ec08
+8088edf8 0x8088edf8
+8088ee38 0x8088ee38
+8088ee78 0x8088ee78
+8088eeb8 0x8088eeb8
+8088f038 0x8088f038
+8088f1bc 0x8088f1bc
+8088f334 RelEndFuncLink::AddEntry
+8088f350 RelEndFuncLink::ExecFuncs
+8088f3a4 0x8088f3a4
diff --git a/projects/mkwii/recomp.yml b/projects/mkwii/recomp.yml
new file mode 100644
index 0000000..bd8f727
--- /dev/null
+++ b/projects/mkwii/recomp.yml
@@ -0,0 +1,68 @@
+schema_version: 1
+workspace_root: ../..
+
+project:
+  id: mkwii-rmcp01
+  display_name: Mario Kart Wii PAL
+  game_id: RMCP01
+  region: P
+  base_manifest_format: mkwii-recomp-base-manifest
+  base_manifest_stem: mkwii_base
+
+memory:
+  base: 0x80000000
+  size: 0x01A00000
+  sda_base: 0x8038CC00
+  sda2_base: 0x8038EFA0
+
+inputs:
+  dol:
+    path: Assets/main.dol
+    sha256: 80d18895b39c63bd80f457398bfcbb91b7d16ac116a41a88967e954080155b05
+
+  rel:
+    path: Assets/StaticR.rel
+    load_address: 0x805102E0
+    sha256: 16d9d146112541fefea701ecb5bc1a496f9d50e4a752fbb5b6778e7c6399f67d
+
+translation:
+  entry_points:
+    - 0x800060A4
+  function_map:
+    path: projects/mkwii/MAP.txt
+
+  #just a precaution, but this should never be needed for MKWii
+  allow_unsupported_instructions: false 
+
+runtime:
+  native_registration_root: runtime/src
+  native_abi_directories:
+    - runtime/src/hle/gx
+
+output:
+  root: generated
+  functions: functions
+  runtime_config: RuntimeConfig.h
+  data_initializer: data_sections_init.cpp
+  base_manifest: ../build/base/mkwii_base_manifest.json
+
+profiles:
+  retro-rewind:
+    enabled: true
+    requires_game_id: RMCP01
+    requires_dol_sha256: 80d18895b39c63bd80f457398bfcbb91b7d16ac116a41a88967e954080155b05
+    code_pul: PulsarPacks/completed/RetroRewind/RetroRewind6/Binaries/Code.pul
+    mod_root: PulsarPacks/completed/RetroRewind/RetroRewind6
+    region: P
+    module_guest_base: 0x81800000
+    module_link_base: 0x803992E0
+    output: build/mods/retro_rewind_full_cpp
+    enable_retro_wfc: true
+    retro_wfc_payload: http://nas.play.rwfc.net/payload?g=RMCPD00
+    retro_wfc_legacy_bootstrap_hook: 0x800ED6E8
+    riivolution:
+      xml: xml/RetroRewind6.xml
+      options:
+        - section: Retro Rewind
+          option: Pack
+          choice: 1
diff --git a/runtime/CMakeLists.txt b/runtime/CMakeLists.txt
new file mode 100644
index 0000000..c2b3a1b
--- /dev/null
+++ b/runtime/CMakeLists.txt
@@ -0,0 +1,229 @@
+cmake_minimum_required(VERSION 3.16)
+project(mkw_recompiled)
+
+if(NOT WIN32 OR NOT MINGW OR NOT CMAKE_CXX_COMPILER_ID STREQUAL "Clang" OR
+   NOT CMAKE_SIZEOF_VOID_P EQUAL 8 OR
+   NOT CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64)$")
+    message(FATAL_ERROR "WiiCompiled requires 64-bit LLVM-MinGW Clang on Windows")
+endif()
+if(NOT CMAKE_BUILD_TYPE STREQUAL "Release")
+    message(FATAL_ERROR "WiiCompiled only supports Release builds")
+endif()
+
+# Preprocessor definitions that belong to this project's own code (the runtime,
+# the translated shards and the product glue) and to nothing else. They are
+# applied directory-scoped, immediately after the aurora add_subdirectory() call,
+# so every target created afterwards (mkw_runtime_common, the translated shard
+# libraries and the products in cmake/PublicProducts.cmake) inherits them while
+# aurora-main and its third-party tree stay unaffected.
+set(MKW_PROJECT_COMPILE_DEFINITIONS NOMINMAX)
+
+set(CMAKE_CXX_STANDARD 17)
+
+# Declared before the vendored libraries so the third-party block below can
+# branch on it and so cmake/NativePrebuilt.cmake is included after the names it
+# must provide are known.
+set(MKW_NATIVE_PREBUILT_DIR "" CACHE PATH
+    "Precompiled aurora/third-party package to link instead of building aurora-main")
+# Maintainer-only counterpart: describe the configured aurora build so the
+# package can be harvested from it.
+set(MKW_NATIVE_PREBUILT_EXPORT_DIR "" CACHE PATH
+    "Maintainer-only: write a description of the configured aurora build here")
+
+# The two Crypto++ configuration macros are load-bearing for ABI: they shape the
+# structs and inline code the headers generate, so a first-party TU including
+# <cryptopp/...> must see exactly what the archive was compiled with. Both the
+# from-source target below and the prebuilt import in cmake/NativePrebuilt.cmake
+# consume this one definition.
+set(MKW_CRYPTOPP_INTERFACE_DEFINITIONS CRYPTOPP_DISABLE_ASM CRYPTOPP_NO_GLOBAL_BYTE)
+
+# Riivolution XML is parsed with pugixml, matching the parser used by Dolphin.
+# The four upstream files from v1.15 (ee86beb30e4973f5feffe3ce63bfa4fbadf72f38)
+# are vendored so builds remain usable with FETCHCONTENT_FULLY_DISCONNECTED.
+add_library(mkw_pugixml STATIC third_party/pugixml/pugixml.cpp)
+add_library(mkw::pugixml ALIAS mkw_pugixml)
+target_include_directories(mkw_pugixml PUBLIC third_party/pugixml)
+target_compile_features(mkw_pugixml PUBLIC cxx_std_17)
+set_target_properties(mkw_pugixml PROPERTIES UNITY_BUILD OFF)
+
+# Runtime configuration is real TOML, parsed by toml11 rather than a project-
+# specific line parser. Keep it header-only and vendored so disconnected release
+# builds have exactly the same parser as developer builds.
+add_library(mkw_toml11 INTERFACE)
+add_library(mkw::toml11 ALIAS mkw_toml11)
+target_include_directories(mkw_toml11 SYSTEM INTERFACE third_party/toml11)
+target_compile_features(mkw_toml11 INTERFACE cxx_std_17)
+
+# Wii ES signatures use the standard binary-field sect233r1 curve. Crypto++
+# supplies that curve, SHA-1, ECDSA and an OS-seeded CSPRNG. The complete 8.9.0
+# source distribution is vendored. Assembly and algorithm-specific SIMD units
+# are disabled to keep the library portable and independent of the runtime's
+# x86-64-v3 policy; the static linker retains only the algorithms we reference.
+#
+# Crypto++ is by far the most expensive vendored library to compile (~150
+# translation units), and under the shipped fixed toolchain it is bit-for-bit
+# identical for every user, so the prebuilt package harvests its archive and
+# this block is skipped entirely in that mode (see cmake/NativePrebuilt.cmake).
+if(NOT MKW_NATIVE_PREBUILT_DIR)
+    file(GLOB MKW_CRYPTOPP_SOURCES CONFIGURE_DEPENDS
+        "${CMAKE_CURRENT_LIST_DIR}/third_party/cryptopp/*.cpp")
+    list(FILTER MKW_CRYPTOPP_SOURCES EXCLUDE REGEX
+        "/(adhoc|bench[123]|datatest|dlltest|fipsalgt|fipstest|pch|regtest[1234]|simple|test|validat[0-9]+)\\.cpp$")
+    list(FILTER MKW_CRYPTOPP_SOURCES EXCLUDE REGEX
+        "(_avx|_ppc|_simd|_sse)\\.cpp$")
+    add_library(mkw_cryptopp STATIC ${MKW_CRYPTOPP_SOURCES})
+    add_library(mkw::cryptopp ALIAS mkw_cryptopp)
+    target_include_directories(mkw_cryptopp SYSTEM PUBLIC third_party)
+    target_compile_features(mkw_cryptopp PUBLIC cxx_std_17)
+    target_compile_definitions(mkw_cryptopp PUBLIC ${MKW_CRYPTOPP_INTERFACE_DEFINITIONS})
+    target_compile_options(mkw_cryptopp PRIVATE -w)
+    set_target_properties(mkw_cryptopp PROPERTIES UNITY_BUILD OFF)
+endif()
+
+set(MKW_TRANSLATED_COMPILE_JOBS 0 CACHE STRING
+    "Cap on concurrently compiling translated shard TUs via a Ninja job pool (0 = uncapped). \
+Scheduling only - never affects output bytes, so it is deliberately outside the canonical flag fingerprint.")
+set(MKW_CPPWINRT_INCLUDE_DIR "" CACHE PATH "Optional self-contained C++/WinRT include directory")
+
+# Precompiled aurora + third-party package (see launcher/Prepare-NativePrebuilt.ps1).
+# Empty - the default - keeps the from-source behaviour every developer build
+# uses. When set, aurora-main, its extern/ tree and the vendored Crypto++ are
+# not compiled at all; imported targets with the same names are wired up from
+# the package instead, so this project's own code compiles and links exactly
+# as before.
+set(MKW_AURORA_DIR "${CMAKE_CURRENT_LIST_DIR}/../aurora-main")
+
+# The translator's explicit float casts are PPC single-precision rounding points.
+# Fast-math may erase them and change guest-visible integer conversions.
+set(MKW_TRANSLATED_PPC_FP_OPTIONS -fno-fast-math -ffp-contract=off)
+
+# ----------------------------------------------------------------------
+# Third-party: aurora-main (provides SDL3 + GPU backends)
+# ----------------------------------------------------------------------
+if(MKW_NATIVE_PREBUILT_DIR)
+    # Precompiled aurora + third-party archives. The source trees are still
+    # present (the runtime includes aurora headers directly), they are simply
+    # not compiled here.
+    include("${CMAKE_CURRENT_LIST_DIR}/cmake/NativePrebuilt.cmake")
+else()
+    if(NOT EXISTS ${MKW_AURORA_DIR}/CMakeLists.txt)
+        message(FATAL_ERROR "Requested aurora-main but ${MKW_AURORA_DIR} is missing")
+    endif()
+    set(DAWN_ENABLE_D3D11 OFF CACHE BOOL "" FORCE)
+    set(DAWN_ENABLE_D3D12 ON CACHE BOOL "" FORCE)
+    set(DAWN_ENABLE_VULKAN ON CACHE BOOL "" FORCE)
+    set(TINT_BUILD_HLSL_WRITER ON CACHE BOOL "" FORCE)
+    set(DAWN_BUILD_SAMPLES OFF CACHE BOOL "" FORCE)
+    set(DAWN_BUILD_TESTS OFF CACHE BOOL "" FORCE)
+    set(DAWN_USE_WINDOWS_UI OFF CACHE BOOL "" FORCE)
+
+    # Provide a tiny stub for DXProgrammableCapture when the SDK/PIX headers are
+    # missing (common on MinGW). Dawn only includes the header; no symbols are
+    # referenced when PIX isn't present.
+    set(MKW_DX_STUB_DIR "${CMAKE_BINARY_DIR}/aurora_dx_stubs")
+    if(NOT EXISTS "${MKW_DX_STUB_DIR}/DXProgrammableCapture.h")
+        file(MAKE_DIRECTORY ${MKW_DX_STUB_DIR})
+        file(WRITE "${MKW_DX_STUB_DIR}/DXProgrammableCapture.h"
+"#pragma once\n// Stubbed PIX capture header for Dawn; no functionality when PIX is absent.\n")
+    endif()
+    # Deliberately NOT injected project-wide. Only a from-source Dawn build ever
+    # includes DXProgrammableCapture.h, and this tree consumes Dawn as a prebuilt
+    # package (AURORA_DAWN_PROVIDER=package), so the old
+    # include_directories()/add_compile_options(-I...) pair only added a dead
+    # -I to every one of the ~500 third-party and runtime compile lines. The
+    # aurora_* targets that do want it get it from the
+    # target_include_directories() call further down; a from-source Dawn build
+    # should add it to the Dawn targets the same way.
+
+    # Keep SDL3 lean when aurora is enabled.
+    set(SDL_SHARED OFF CACHE BOOL "" FORCE)
+    set(SDL_STATIC ON CACHE BOOL "" FORCE)
+    set(SDL_TEST OFF CACHE BOOL "" FORCE)
+
+    # MinGW/WSL can choke on SDL precompiled headers; disable PCH for aurora/SDL.
+    set(CMAKE_DISABLE_PRECOMPILE_HEADERS ON)
+    # Isolate aurora build products to a subdirectory under the main build dir.
+    add_subdirectory(${MKW_AURORA_DIR} ${CMAKE_BINARY_DIR}/aurora-build EXCLUDE_FROM_ALL)
+    set(CMAKE_DISABLE_PRECOMPILE_HEADERS OFF)
+
+    # Keep upstream Aurora split: several sources intentionally use file-local
+    # names that collide under this repo's aggressive unity build settings.
+    set(AURORA_TARGETS aurora_core aurora_gx aurora_pad aurora_si aurora_mtx aurora_vi)
+    foreach(t ${AURORA_TARGETS})
+        if(TARGET ${t})
+            set_target_properties(${t} PROPERTIES UNITY_BUILD OFF)
+            target_compile_options(${t} PRIVATE -O3 -ffast-math -w -pipe)
+            target_include_directories(${t} PRIVATE ${MKW_DX_STUB_DIR})
+            # Aurora's own sources include Windows headers and call std::min/max;
+            # they relied on the old project-wide NOMINMAX that no longer leaks
+            # into this subtree, so the define is applied per target here.
+            target_compile_definitions(${t} PRIVATE NOMINMAX)
+        endif()
+    endforeach()
+
+    # Frame interpolation filters guest NaN/Inf matrices out of a std::sort
+    # comparator, which makes its std::isfinite guards load-bearing for memory
+    # safety, not just match quality. -ffinite-math-only (part of -ffast-math
+    # above) folds those guards to constants and poisons NaN float arguments
+    # via nofpclass, so this one file opts back out of the finite-math
+    # assumption; the file #errors if built without this. Source-scoped
+    # COMPILE_OPTIONS append after the target options, so this overrides the
+    # target's -ffast-math for exactly this TU.
+    if(TARGET aurora_gx)
+        set_source_files_properties("${MKW_AURORA_DIR}/lib/gx/frame_interpolation.cpp"
+            TARGET_DIRECTORY aurora_gx
+            PROPERTIES COMPILE_OPTIONS "-fno-finite-math-only")
+    endif()
+
+    if(MKW_NATIVE_PREBUILT_EXPORT_DIR)
+        include("${CMAKE_CURRENT_LIST_DIR}/cmake/NativePrebuiltExport.cmake")
+    endif()
+endif()
+
+# Everything from here down is this project's own code, so this is where the
+# project definitions enter the directory scope. A directory-scoped definition
+# seeds the COMPILE_DEFINITIONS of targets as they are created, which means:
+#   * aurora-main and its third-party tree were added above -> unaffected;
+#   * mkw_runtime_common, the translated shard libraries and the products in
+#     cmake/PublicProducts.cmake are all created below (that file is include()d,
+#     not add_subdirectory()d, so it shares this directory scope) -> they pick
+#     the definitions up exactly as before.
+if(MKW_PROJECT_COMPILE_DEFINITIONS)
+    add_compile_definitions(${MKW_PROJECT_COMPILE_DEFINITIONS})
+endif()
+
+# Runtime sources. CONFIGURE_DEPENDS costs one glob re-check per build (measured
+# at ~55 ms across the 100+ globs this build already re-verifies for SDL), and it
+# buys correctness: without it, a newly added src/*.cpp that is not referenced by
+# a registration file is silently never compiled and never errors. The stale-glob
+# failure mode is worth far more than the milliseconds.
+file(GLOB_RECURSE SOURCES CONFIGURE_DEPENDS "src/*.cpp")
+set(MKW_BASE_PRODUCT_SOURCE "${CMAKE_CURRENT_LIST_DIR}/src/product/base_product.cpp")
+set(MKW_RETRO_REWIND_PRODUCT_SOURCE "${CMAKE_CURRENT_LIST_DIR}/src/product/retro_rewind_product.cpp")
+# The host ISA guard is the one translation unit that must not receive the
+# x86-64-v3 flags, so it gets its own object library instead of riding along in
+# mkw_runtime_common. See cmake/PublicProducts.cmake and the file's own header.
+set(MKW_CPU_BASELINE_SOURCE "${CMAKE_CURRENT_LIST_DIR}/src/host_cpu_baseline.cpp")
+list(REMOVE_ITEM SOURCES ${MKW_BASE_PRODUCT_SOURCE} ${MKW_RETRO_REWIND_PRODUCT_SOURCE}
+     ${MKW_CPU_BASELINE_SOURCE})
+
+# The translator emits the complete, content-addressed source graph. Consuming
+# this one manifest keeps configure independent of the 28k generated function
+# files and of optional Retro Rewind artifacts such as code.map.
+set(MKW_TRANSLATED_SHARD_MANIFEST
+    "${CMAKE_CURRENT_LIST_DIR}/../generated/build_shards/shards.cmake"
+    CACHE FILEPATH "Translator-owned aggregate shard manifest")
+if(NOT EXISTS "${MKW_TRANSLATED_SHARD_MANIFEST}")
+    message(FATAL_ERROR
+        "Missing translator-owned shard manifest: ${MKW_TRANSLATED_SHARD_MANIFEST}. "
+        "Run Translator.Cli emit-build-shards first; see translator/README.md.")
+endif()
+include("${MKW_TRANSLATED_SHARD_MANIFEST}")
+set(MKW_HAVE_RETRO_REWIND ${MKW_HAVE_RETRO_REWIND_SHARDS})
+message(STATUS
+    "Translator graph: ${MKW_SHARED_BASE_FUNCTION_COUNT}/${MKW_BASE_FUNCTION_COUNT} base functions shared; "
+    "${MKW_PROFILE_SENSITIVE_CALLER_COUNT} profile-sensitive callers; "
+    "${MKW_RETRO_REWIND_FUNCTION_COUNT} Retro Rewind functions")
+
+set(MKW_RUNTIME_SOURCE_DIR "${CMAKE_CURRENT_LIST_DIR}")
+include("${CMAKE_CURRENT_LIST_DIR}/cmake/PublicProducts.cmake")
diff --git a/runtime/assets/dsp/dsp_coef.bin b/runtime/assets/dsp/dsp_coef.bin
new file mode 100644
index 0000000..f919013
Binary files /dev/null and b/runtime/assets/dsp/dsp_coef.bin differ
diff --git a/runtime/assets/pipeline/initial_pipeline_cache.db b/runtime/assets/pipeline/initial_pipeline_cache.db
new file mode 100644
index 0000000..f3856fe
Binary files /dev/null and b/runtime/assets/pipeline/initial_pipeline_cache.db differ
diff --git a/runtime/assets/wii/README.md b/runtime/assets/wii/README.md
new file mode 100644
index 0000000..40672c0
--- /dev/null
+++ b/runtime/assets/wii/README.md
@@ -0,0 +1,9 @@
+# Wii first-run bootstrap payload
+
+This directory contains the small `shared2/wc24` first-run tree needed when Mario
+Kart Wii is launched directly without an imported Wii NAND. The runtime copies
+these files only into a newly managed, per-user NAND and never overwrites an
+existing profile.
+
+The layout and required files follow Dolphin's direct-disc Wii bootstrap:
+`Source/Core/Core/WiiRoot.cpp` and `Data/Sys/Wii/shared2/wc24`.
diff --git a/runtime/assets/wii/shared2/wc24/mbox/Readme.txt b/runtime/assets/wii/shared2/wc24/mbox/Readme.txt
new file mode 100644
index 0000000..6813fc7
--- /dev/null
+++ b/runtime/assets/wii/shared2/wc24/mbox/Readme.txt
@@ -0,0 +1,4 @@
+The Mailbox here has been shrunk, the real file size:
+
+WC24RECV.MBX	0x00700000
+WC24SEND.MBX	0x00200000
diff --git a/runtime/assets/wii/shared2/wc24/mbox/wc24recv.ctl b/runtime/assets/wii/shared2/wc24/mbox/wc24recv.ctl
new file mode 100644
index 0000000..64c26b5
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/mbox/wc24recv.ctl differ
diff --git a/runtime/assets/wii/shared2/wc24/mbox/wc24recv.mbx b/runtime/assets/wii/shared2/wc24/mbox/wc24recv.mbx
new file mode 100644
index 0000000..81cd383
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/mbox/wc24recv.mbx differ
diff --git a/runtime/assets/wii/shared2/wc24/mbox/wc24send.ctl b/runtime/assets/wii/shared2/wc24/mbox/wc24send.ctl
new file mode 100644
index 0000000..165daf7
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/mbox/wc24send.ctl differ
diff --git a/runtime/assets/wii/shared2/wc24/mbox/wc24send.mbx b/runtime/assets/wii/shared2/wc24/mbox/wc24send.mbx
new file mode 100644
index 0000000..d447447
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/mbox/wc24send.mbx differ
diff --git a/runtime/assets/wii/shared2/wc24/misc.bin b/runtime/assets/wii/shared2/wc24/misc.bin
new file mode 100644
index 0000000..b218303
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/misc.bin differ
diff --git a/runtime/assets/wii/shared2/wc24/nwc24dl.bin b/runtime/assets/wii/shared2/wc24/nwc24dl.bin
new file mode 100644
index 0000000..b7f8fa3
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/nwc24dl.bin differ
diff --git a/runtime/assets/wii/shared2/wc24/nwc24fl.bin b/runtime/assets/wii/shared2/wc24/nwc24fl.bin
new file mode 100644
index 0000000..faa12b0
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/nwc24fl.bin differ
diff --git a/runtime/assets/wii/shared2/wc24/nwc24fls.bin b/runtime/assets/wii/shared2/wc24/nwc24fls.bin
new file mode 100644
index 0000000..1ca2191
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/nwc24fls.bin differ
diff --git a/runtime/assets/wii/shared2/wc24/nwc24msg.cbk b/runtime/assets/wii/shared2/wc24/nwc24msg.cbk
new file mode 100644
index 0000000..c87fb77
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/nwc24msg.cbk differ
diff --git a/runtime/assets/wii/shared2/wc24/nwc24msg.cfg b/runtime/assets/wii/shared2/wc24/nwc24msg.cfg
new file mode 100644
index 0000000..c87fb77
Binary files /dev/null and b/runtime/assets/wii/shared2/wc24/nwc24msg.cfg differ
diff --git a/runtime/cmake/NativePrebuilt.cmake b/runtime/cmake/NativePrebuilt.cmake
new file mode 100644
index 0000000..f889ecb
--- /dev/null
+++ b/runtime/cmake/NativePrebuilt.cmake
@@ -0,0 +1,117 @@
+# Consume a precompiled aurora + third-party package instead of compiling
+# aurora-main and its extern/ tree.
+#
+# Produced by launcher/Prepare-NativePrebuilt.ps1 with the same toolchain and the
+# same canonical flag set the consuming build uses, which is what makes a single
+# package valid for every user. Nothing about this project's own code changes:
+# the runtime, the translated shards and the products still compile locally and
+# still link targets named aurora::gx / aurora::pad / aurora::si / aurora::vi /
+# aurora::mtx, so cmake/PublicProducts.cmake needs no prebuilt-specific branch.
+#
+# The aurora and dependency source trees are still present in the workspace - the
+# runtime includes aurora headers directly - so the package records include
+# directories as tokens (@AURORA@, @RUNTIME@, @DEPS@, @PKG@) that resolve here
+# rather than baking a maintainer machine's paths into a redistributable.
+
+get_filename_component(MKW_NP_PACKAGE_DIR "${MKW_NATIVE_PREBUILT_DIR}" ABSOLUTE)
+if(NOT EXISTS "${MKW_NP_PACKAGE_DIR}/native_prebuilt.cmake")
+    message(FATAL_ERROR
+        "MKW_NATIVE_PREBUILT_DIR does not contain native_prebuilt.cmake: ${MKW_NP_PACKAGE_DIR}")
+endif()
+
+# The package ships as <workspace>/Dependencies/native_prebuilt, next to the
+# pinned sources it was built against.
+get_filename_component(MKW_NP_DEPS_DIR "${MKW_NP_PACKAGE_DIR}" DIRECTORY)
+get_filename_component(MKW_NP_AURORA_DIR "${MKW_AURORA_DIR}" ABSOLUTE)
+get_filename_component(MKW_NP_RUNTIME_DIR "${CMAKE_CURRENT_LIST_DIR}" DIRECTORY)
+
+include("${MKW_NP_PACKAGE_DIR}/native_prebuilt.cmake")
+
+function(mkw_np_resolve out_var)
+    set(_resolved "")
+    foreach(_item IN LISTS ARGN)
+        string(REPLACE "@PKG@" "${MKW_NP_PACKAGE_DIR}" _item "${_item}")
+        string(REPLACE "@AURORA@" "${MKW_NP_AURORA_DIR}" _item "${_item}")
+        string(REPLACE "@RUNTIME@" "${MKW_NP_RUNTIME_DIR}" _item "${_item}")
+        string(REPLACE "@DEPS@" "${MKW_NP_DEPS_DIR}" _item "${_item}")
+        list(APPEND _resolved "${_item}")
+    endforeach()
+    set(${out_var} "${_resolved}" PARENT_SCOPE)
+endfunction()
+
+mkw_np_resolve(_mkw_np_includes ${MKW_NP_INCLUDE_DIRECTORIES})
+mkw_np_resolve(_mkw_np_links ${MKW_NP_LINK_LIBRARIES})
+mkw_np_resolve(_mkw_np_dawn_config ${MKW_NP_DAWN_CONFIG_DIR})
+
+foreach(_dir IN LISTS _mkw_np_includes)
+    if(NOT IS_DIRECTORY "${_dir}")
+        message(FATAL_ERROR
+            "The precompiled package expects an include directory that this workspace "
+            "does not have: ${_dir}")
+    endif()
+endforeach()
+
+# Dawn is a prebuilt package on both sides; resolve the same install tree the
+# package was built against so its imported target (and therefore
+# webgpu_dawn.dll / dxcompiler.dll / dxil.dll) is available exactly as a
+# from-source aurora build would provide it.
+if(NOT EXISTS "${_mkw_np_dawn_config}/DawnConfig.cmake")
+    message(FATAL_ERROR "Prebuilt Dawn package is missing DawnConfig.cmake: ${_mkw_np_dawn_config}")
+endif()
+set(_mkw_np_saved_find_global ${CMAKE_FIND_PACKAGE_TARGETS_GLOBAL})
+set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
+find_package(Dawn REQUIRED CONFIG PATHS "${_mkw_np_dawn_config}" NO_DEFAULT_PATH)
+set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ${_mkw_np_saved_find_global})
+if(NOT TARGET dawn::webgpu_dawn)
+    message(FATAL_ERROR "Prebuilt Dawn package did not provide dawn::webgpu_dawn")
+endif()
+
+# One interface target carries the whole compile/link surface. The public aurora
+# names then reduce to aliases of it, which keeps the link line free of the
+# fivefold duplication that giving each of them the full list would produce.
+add_library(mkw_native_prebuilt INTERFACE IMPORTED GLOBAL)
+set_target_properties(mkw_native_prebuilt PROPERTIES
+    INTERFACE_INCLUDE_DIRECTORIES "${_mkw_np_includes}"
+    INTERFACE_COMPILE_DEFINITIONS "${MKW_NP_COMPILE_DEFINITIONS}"
+    INTERFACE_COMPILE_OPTIONS "${MKW_NP_COMPILE_OPTIONS}"
+    INTERFACE_LINK_LIBRARIES "${_mkw_np_links}")
+
+foreach(_target IN LISTS MKW_NP_AURORA_TARGETS)
+    add_library(${_target} INTERFACE IMPORTED GLOBAL)
+    set_target_properties(${_target} PROPERTIES INTERFACE_LINK_LIBRARIES mkw_native_prebuilt)
+endforeach()
+
+# The vendored Crypto++ ships precompiled alongside aurora: under the fixed
+# toolchain its archive is identical for every user, so compiling ~150 of its
+# translation units locally buys nothing. Only the archive is consumed here -
+# the vendored headers still ship in the workspace because first-party TUs
+# include them directly (runtime/include/wii_es_crypto.h).
+if(NOT MKW_CRYPTOPP_INTERFACE_DEFINITIONS)
+    message(FATAL_ERROR
+        "The prebuilt consumer requires MKW_CRYPTOPP_INTERFACE_DEFINITIONS from "
+        "the top-level CMakeLists.txt; without them first-party TUs would compile "
+        "against Crypto++ headers configured differently than the archive.")
+endif()
+file(GLOB _mkw_np_cryptopp_archives "${MKW_NP_PACKAGE_DIR}/lib/libmkw_cryptopp.a")
+list(LENGTH _mkw_np_cryptopp_archives _mkw_np_cryptopp_count)
+if(NOT _mkw_np_cryptopp_count EQUAL 1)
+    message(FATAL_ERROR
+        "The precompiled package must contain exactly one libmkw_cryptopp.a: "
+        "${MKW_NP_PACKAGE_DIR}")
+endif()
+if(NOT TARGET mkw_cryptopp)
+    add_library(mkw_cryptopp STATIC IMPORTED GLOBAL)
+    set_target_properties(mkw_cryptopp PROPERTIES
+        IMPORTED_LOCATION "${_mkw_np_cryptopp_archives}"
+        INTERFACE_INCLUDE_DIRECTORIES "${MKW_NP_RUNTIME_DIR}/third_party"
+        INTERFACE_COMPILE_DEFINITIONS "${MKW_CRYPTOPP_INTERFACE_DEFINITIONS}")
+    add_library(mkw::cryptopp ALIAS mkw_cryptopp)
+endif()
+# The aggregate link list carries the same archive once more (the harvest probe
+# linked it, so the probe-vs-control diff includes it). Repeating a static
+# archive on the link line is harmless; the second pass resolves no members.
+
+list(LENGTH _mkw_np_links _mkw_np_link_count)
+message(STATUS
+    "Aurora and third-party libraries come from the precompiled package "
+    "(${_mkw_np_link_count} link inputs); they are not compiled here")
diff --git a/runtime/cmake/NativePrebuiltExport.cmake b/runtime/cmake/NativePrebuiltExport.cmake
new file mode 100644
index 0000000..89ffa9b
--- /dev/null
+++ b/runtime/cmake/NativePrebuiltExport.cmake
@@ -0,0 +1,149 @@
+# Maintainer-only: describe the configured aurora + third-party build so it can
+# be harvested into a redistributable precompiled package.
+#
+# Enabled with -DMKW_NATIVE_PREBUILT_EXPORT_DIR=<dir>. It never changes what is
+# compiled: it adds two never-built probe targets and writes plain text files
+# describing (a) which library targets aurora produced and where their build
+# outputs land, and (b) the exact compile/link interface a consumer of
+# aurora::gx/pad/si/vi/mtx receives.
+#
+# Everything is taken from the real, fully configured project rather than
+# hand-written, so the package cannot describe a graph the build does not have.
+# The compile/link interface is read back out of build.ninja by
+# launcher/Prepare-NativePrebuilt.ps1: generator expressions cannot be evaluated
+# for a specific language by file(GENERATE), and $<LINK_ONLY:...> collapses to
+# nothing outside a link context, so the generated buildsystem is the only place
+# where the fully resolved, correctly ordered values exist.
+
+if(NOT CMAKE_GENERATOR STREQUAL "Ninja")
+    message(FATAL_ERROR "MKW_NATIVE_PREBUILT_EXPORT_DIR requires the Ninja generator")
+endif()
+
+# Enumerates every target defined anywhere in the configured directory-scope
+# tree rooted at _dir (aurora-main plus whatever its providers FetchContent'ed,
+# whose sources live under the build tree rather than under aurora-main). The
+# walk follows real SUBDIRECTORIES properties instead of parsing files, so it
+# cannot disagree with the configure that just ran. The names are candidates
+# only - each is re-checked below (TARGET existence, library type) and against
+# the link closure mkw_np_probe actually pulled in before anything ships.
+function(mkw_collect_buildsystem_targets _root_dir _out_var)
+    set(_candidates "")
+    set(_visited "")
+    set(_pending "${_root_dir}")
+    while(_pending)
+        list(POP_FRONT _pending _dir)
+        get_filename_component(_dir "${_dir}" ABSOLUTE)
+        if(_dir IN_LIST _visited)
+            continue()
+        endif()
+        list(APPEND _visited "${_dir}")
+        get_property(_scope_targets DIRECTORY "${_dir}" PROPERTY BUILDSYSTEM_TARGETS)
+        if(_scope_targets)
+            list(APPEND _candidates ${_scope_targets})
+        endif()
+        get_property(_children DIRECTORY "${_dir}" PROPERTY SUBDIRECTORIES)
+        foreach(_child IN LISTS _children)
+            if(NOT IS_ABSOLUTE "${_child}")
+                set(_child "${_dir}/${_child}")
+            endif()
+            list(APPEND _pending "${_child}")
+        endforeach()
+    endwhile()
+    set(${_out_var} "${_candidates}" PARENT_SCOPE)
+endfunction()
+
+set(_mkw_np_probe_dir "${CMAKE_BINARY_DIR}/native_prebuilt_probe")
+file(MAKE_DIRECTORY "${_mkw_np_probe_dir}")
+file(WRITE "${_mkw_np_probe_dir}/probe.cpp"
+    "// Records the compile and link interface aurora's public targets hand to a\n"
+    "// consumer. Building mkw_np_probe compiles exactly the aurora + third-party\n"
+    "// closure the game products need, and proves the resulting archives link.\n"
+    "int main() { return 0; }\n")
+
+# Control: identical target with no aurora dependency. Subtracting its command
+# line from the probe's isolates exactly the aurora-derived contribution.
+add_executable(mkw_np_probe_control EXCLUDE_FROM_ALL "${_mkw_np_probe_dir}/probe.cpp")
+set_target_properties(mkw_np_probe_control PROPERTIES UNITY_BUILD OFF)
+target_compile_features(mkw_np_probe_control PRIVATE cxx_std_20)
+
+add_executable(mkw_np_probe EXCLUDE_FROM_ALL "${_mkw_np_probe_dir}/probe.cpp")
+set_target_properties(mkw_np_probe PROPERTIES UNITY_BUILD OFF)
+target_compile_features(mkw_np_probe PRIVATE cxx_std_20)
+# Exactly what mkw_runtime_common and the products link (PublicProducts.cmake)
+# with one deliberate exception: pugixml stays a locally compiled single
+# translation unit, so it must not enter this closure. The runtime's vendored
+# Crypto++ does join the harvest - ~150 translation units that are identical
+# for every user under the pinned toolchain and flag set.
+target_link_libraries(mkw_np_probe PRIVATE
+    aurora::gx aurora::pad aurora::si aurora::vi aurora::mtx
+    mkw::cryptopp)
+
+get_filename_component(_mkw_np_aurora_dir "${MKW_AURORA_DIR}" ABSOLUTE)
+mkw_collect_buildsystem_targets("${_mkw_np_aurora_dir}" _mkw_np_all_targets)
+# mkw_cryptopp is defined by this runtime project, not under aurora-main, so
+# the scan above cannot see it; it is appended explicitly. The type and closure
+# checks below still apply to it.
+list(APPEND _mkw_np_all_targets "mkw_cryptopp")
+if(NOT _mkw_np_all_targets)
+    message(FATAL_ERROR "No buildsystem targets were found under ${_mkw_np_aurora_dir}")
+endif()
+list(REMOVE_DUPLICATES _mkw_np_all_targets)
+list(SORT _mkw_np_all_targets)
+
+set(_mkw_np_lib_targets "")
+foreach(_t IN LISTS _mkw_np_all_targets)
+    if(NOT TARGET ${_t})
+        continue()
+    endif()
+    get_target_property(_imported ${_t} IMPORTED)
+    if(_imported)
+        continue()
+    endif()
+    get_target_property(_type ${_t} TYPE)
+    if(_type STREQUAL "STATIC_LIBRARY" OR _type STREQUAL "SHARED_LIBRARY" OR
+       _type STREQUAL "MODULE_LIBRARY")
+        list(APPEND _mkw_np_lib_targets ${_t})
+    endif()
+endforeach()
+if(NOT _mkw_np_lib_targets)
+    message(FATAL_ERROR "aurora produced no library targets to export")
+endif()
+
+set(_mkw_np_target_lines "")
+foreach(_t IN LISTS _mkw_np_lib_targets)
+    string(APPEND _mkw_np_target_lines
+        "${_t}|$<TARGET_PROPERTY:${_t},TYPE>|$<TARGET_FILE:${_t}>|$<TARGET_LINKER_FILE:${_t}>\n")
+endforeach()
+file(GENERATE OUTPUT "${MKW_NATIVE_PREBUILT_EXPORT_DIR}/targets.txt"
+    CONTENT "${_mkw_np_target_lines}")
+
+# Dawn stays a prebuilt package on the consumer side too; record how this build
+# resolved it so the consumer can reproduce the same imported target.
+set(_mkw_np_dawn_line "")
+if(TARGET dawn::webgpu_dawn)
+    set(_mkw_np_dawn_line
+        "$<TARGET_PROPERTY:dawn::webgpu_dawn,TYPE>|$<TARGET_FILE:dawn::webgpu_dawn>|$<TARGET_LINKER_FILE:dawn::webgpu_dawn>\n")
+endif()
+file(GENERATE OUTPUT "${MKW_NATIVE_PREBUILT_EXPORT_DIR}/dawn.txt"
+    CONTENT "${_mkw_np_dawn_line}")
+
+set(_mkw_np_dawn_config_dir "")
+if(Dawn_DIR AND EXISTS "${Dawn_DIR}/DawnConfig.cmake")
+    set(_mkw_np_dawn_config_dir "${Dawn_DIR}")
+endif()
+
+string(REPLACE ";" "," _mkw_np_lib_targets_csv "${_mkw_np_lib_targets}")
+file(WRITE "${MKW_NATIVE_PREBUILT_EXPORT_DIR}/meta.txt"
+    "aurora_dir=${_mkw_np_aurora_dir}\n"
+    "runtime_dir=${CMAKE_CURRENT_SOURCE_DIR}\n"
+    "binary_dir=${CMAKE_BINARY_DIR}\n"
+    "dawn_config_dir=${_mkw_np_dawn_config_dir}\n"
+    "dawn_prebuilt_source_dir=${dawn_prebuilt_SOURCE_DIR}\n"
+    "aurora_sdl3_target=${AURORA_SDL3_TARGET}\n"
+    "aurora_dawn_version=${AURORA_DAWN_VERSION}\n"
+    "aurora_dawn_linkage=${AURORA_DAWN_LINKAGE}\n"
+    "cxx_compiler=${CMAKE_CXX_COMPILER}\n"
+    "cxx_compiler_version=${CMAKE_CXX_COMPILER_VERSION}\n"
+    "library_targets=${_mkw_np_lib_targets_csv}\n")
+
+message(STATUS "Native prebuilt export: ${MKW_NATIVE_PREBUILT_EXPORT_DIR}")
diff --git a/runtime/cmake/PublicProducts.cmake b/runtime/cmake/PublicProducts.cmake
new file mode 100644
index 0000000..db26440
--- /dev/null
+++ b/runtime/cmake/PublicProducts.cmake
@@ -0,0 +1,292 @@
+# Public WiiCompiled product graph.
+#
+# The translator owns the translated build graph. Mario Kart's profile-neutral
+# functions are compiled once into mkw_base_shared; only callers whose direct
+# ABI differs between profiles receive small base/RR variants.
+
+set(DATA_INIT_FILE "${MKW_RUNTIME_SOURCE_DIR}/../generated/data_sections_init.cpp")
+set(DATA_INIT_BLOB_ASM "${MKW_RUNTIME_SOURCE_DIR}/../generated/data_sections_init_blobs.S")
+if(EXISTS "${DATA_INIT_FILE}")
+    list(APPEND SOURCES "${DATA_INIT_FILE}")
+endif()
+# Crash-report symbolization table emitted by generate-data-init. The stub
+# (deliberately outside the globbed src/ tree so it is never picked up twice)
+# keeps link succeeding when the generated table has not been produced yet.
+set(GUEST_SYMBOL_TABLE_FILE "${MKW_RUNTIME_SOURCE_DIR}/../generated/guest_symbol_table.cpp")
+if(EXISTS "${GUEST_SYMBOL_TABLE_FILE}")
+    list(APPEND SOURCES "${GUEST_SYMBOL_TABLE_FILE}")
+else()
+    list(APPEND SOURCES "${MKW_RUNTIME_SOURCE_DIR}/cmake/guest_symbol_table_stub.cpp")
+endif()
+if(EXISTS "${DATA_INIT_BLOB_ASM}")
+    enable_language(ASM)
+    set_source_files_properties("${DATA_INIT_BLOB_ASM}" PROPERTIES LANGUAGE ASM SKIP_UNITY_BUILD_INCLUSION ON)
+    list(APPEND SOURCES "${DATA_INIT_BLOB_ASM}")
+endif()
+list(REMOVE_DUPLICATES SOURCES)
+
+function(mkw_apply_common_compile_options target)
+    target_compile_options(${target} PRIVATE -O3 -ffast-math -w -pipe)
+endfunction()
+
+function(mkw_apply_translated_compile_options target)
+    target_compile_options(${target} PRIVATE
+        -O2 ${MKW_TRANSLATED_PPC_FP_OPTIONS} -fno-slp-vectorize -w -pipe)
+endfunction()
+
+function(mkw_configure_object_target target)
+    target_include_directories(${target} PRIVATE
+        "${MKW_RUNTIME_SOURCE_DIR}/include"
+        "${MKW_RUNTIME_SOURCE_DIR}/src"
+        # Workspace root, so translator output is spelled "generated/<x>.h"
+        # instead of a ../ chain whose depth depends on the includer.
+        "${MKW_RUNTIME_SOURCE_DIR}/.."
+        "${MKW_RUNTIME_SOURCE_DIR}/../aurora-main/include")
+    target_compile_definitions(${target} PRIVATE
+        TARGET_PC)
+    set_target_properties(${target} PROPERTIES CXX_STANDARD 17 CXX_STANDARD_REQUIRED ON)
+endfunction()
+
+# Translated shard TUs are the memory-hungry compiles; everything else in the build is
+# comparatively small. A dedicated Ninja job pool caps how many of them run at once so the
+# global parallelism can use every core for the cheap TUs without the memory ceiling being a
+# guess. The pool depth is per-machine (derived from installed RAM by LocalBuild.ps1) and is
+# deliberately not part of the canonical flag set: it changes scheduling, never output bytes.
+if(MKW_TRANSLATED_COMPILE_JOBS GREATER 0)
+    set_property(GLOBAL APPEND PROPERTY JOB_POOLS "mkw_translated=${MKW_TRANSLATED_COMPILE_JOBS}")
+endif()
+
+function(mkw_bound_translated_compiles target)
+    if(MKW_TRANSLATED_COMPILE_JOBS GREATER 0)
+        set_property(TARGET ${target} PROPERTY JOB_POOL_COMPILE mkw_translated)
+    endif()
+endfunction()
+
+function(mkw_configure_translated_target target)
+    mkw_configure_object_target(${target})
+    mkw_apply_translated_compile_options(${target})
+    mkw_bound_translated_compiles(${target})
+endfunction()
+
+add_library(mkw_runtime_common OBJECT ${SOURCES})
+mkw_configure_object_target(mkw_runtime_common)
+target_compile_features(mkw_runtime_common PRIVATE cxx_std_20)
+target_compile_definitions(mkw_runtime_common PRIVATE
+    SDL_MAIN_HANDLED
+    _DISABLE_STRING_ANNOTATION _DISABLE_VECTOR_ANNOTATION)
+target_link_libraries(mkw_runtime_common PRIVATE
+    aurora::gx aurora::pad aurora::si aurora::vi aurora::mtx)
+target_link_libraries(mkw_runtime_common PRIVATE mkw::pugixml mkw::toml11 mkw::cryptopp)
+target_link_libraries(mkw_runtime_common PRIVATE shell32 windowsapp)
+if(MKW_CPPWINRT_INCLUDE_DIR)
+    if(NOT EXISTS "${MKW_CPPWINRT_INCLUDE_DIR}/winrt/base.h")
+        message(FATAL_ERROR
+            "MKW_CPPWINRT_INCLUDE_DIR does not contain winrt/base.h: ${MKW_CPPWINRT_INCLUDE_DIR}")
+    endif()
+    target_include_directories(mkw_runtime_common PRIVATE "${MKW_CPPWINRT_INCLUDE_DIR}")
+endif()
+
+# Keep runtime unity units small and semantically related. The old generated-TU
+# batch size put all 57 native runtime sources into one memory-heavy compiler job.
+foreach(source IN LISTS SOURCES)
+    get_filename_component(source_name "${source}" NAME_WE)
+    string(REPLACE "\\" "/" source_normalized "${source}")
+    if(source_normalized MATCHES "/hle/gx/")
+        set(runtime_group "gx_bridge")
+    elseif(source_name MATCHES "network|socket|dns|dwc|ios")
+        set(runtime_group "network_ios")
+    elseif(source_name MATCHES "os_|system|memory|fiber|scheduler")
+        set(runtime_group "guest_system")
+    elseif(source_name MATCHES "debug|trace|prof")
+        set(runtime_group "diagnostics")
+    else()
+        string(SHA256 source_hash "${source_name}")
+        string(SUBSTRING "${source_hash}" 0 4 source_hash_prefix)
+        math(EXPR runtime_bucket "0x${source_hash_prefix} % 8")
+        set(runtime_group "runtime_${runtime_bucket}")
+    endif()
+    set_source_files_properties("${source}" PROPERTIES UNITY_GROUP "${runtime_group}")
+endforeach()
+# These translation units implement guest-visible floating-point bit
+# semantics.  Keep them out of the fast-math runtime unity groups and apply
+# the same contraction/rounding policy as translated PPC shards.
+set(MKW_PPC_SEMANTIC_RUNTIME_SOURCES
+    "${MKW_RUNTIME_SOURCE_DIR}/src/ppc_helpers.cpp"
+    "${MKW_RUNTIME_SOURCE_DIR}/src/fpu_helpers.cpp")
+set_source_files_properties(${MKW_PPC_SEMANTIC_RUNTIME_SOURCES} PROPERTIES
+    SKIP_UNITY_BUILD_INCLUSION ON
+    SKIP_PRECOMPILE_HEADERS ON
+    COMPILE_OPTIONS "${MKW_TRANSLATED_PPC_FP_OPTIONS}")
+set_target_properties(mkw_runtime_common PROPERTIES UNITY_BUILD ON UNITY_BUILD_MODE GROUP)
+target_precompile_headers(mkw_runtime_common PRIVATE "${MKW_RUNTIME_SOURCE_DIR}/include/mkw_pch.h")
+mkw_apply_common_compile_options(mkw_runtime_common)
+
+# Host ISA guard. Everything in MKW_ALL_BUILD_TARGETS below is compiled with
+# -march=x86-64-v3; this object library deliberately is not, which
+# is the whole point of keeping it out of mkw_runtime_common. It runs a CPUID
+# check from a C initializer so an unsupported machine gets a readable error
+# instead of an illegal-instruction crash. Excluded from the unity build and the
+# precompiled header because both are produced with the owning target's flags.
+add_library(mkw_cpu_baseline OBJECT "${MKW_CPU_BASELINE_SOURCE}")
+target_compile_features(mkw_cpu_baseline PRIVATE cxx_std_17)
+set_target_properties(mkw_cpu_baseline PROPERTIES UNITY_BUILD OFF)
+target_compile_options(mkw_cpu_baseline PRIVATE -w)
+
+if(NOT MKW_BASE_COMMON_SHARDS)
+    message(FATAL_ERROR "Translator build graph contains no shared base shards")
+endif()
+
+add_library(mkw_base_shared STATIC ${MKW_BASE_COMMON_SHARDS})
+mkw_configure_translated_target(mkw_base_shared)
+target_precompile_headers(mkw_base_shared PRIVATE "${MKW_RUNTIME_SOURCE_DIR}/include/mkw_pch.h")
+
+if(MKW_BASE_PORTABLE_SENSITIVE_SHARDS)
+    add_library(mkw_base_sensitive OBJECT ${MKW_BASE_PORTABLE_SENSITIVE_SHARDS})
+    mkw_configure_translated_target(mkw_base_sensitive)
+    target_precompile_headers(mkw_base_sensitive REUSE_FROM mkw_base_shared)
+endif()
+
+if(MKW_HAVE_RETRO_REWIND)
+    if(MKW_RETRO_PORTABLE_SENSITIVE_SHARDS)
+        add_library(mkw_retro_sensitive OBJECT ${MKW_RETRO_PORTABLE_SENSITIVE_SHARDS})
+        mkw_configure_translated_target(mkw_retro_sensitive)
+        target_precompile_headers(mkw_retro_sensitive REUSE_FROM mkw_base_shared)
+    endif()
+
+    set(MKW_RETRO_TRANSLATED_SOURCES ${MKW_RETRO_MOD_SHARDS} ${MKW_RETRO_EXTRA_SOURCES})
+    set(MKW_RETRO_BLOB_OBJECTS)
+    foreach(source IN LISTS MKW_RETRO_EXTRA_SOURCES)
+        if(source MATCHES "\\.S$")
+            enable_language(ASM)
+            set_source_files_properties("${source}" PROPERTIES LANGUAGE ASM SKIP_PRECOMPILE_HEADERS ON)
+        endif()
+    endforeach()
+    add_library(mkw_retro_rewind_functions OBJECT ${MKW_RETRO_TRANSLATED_SOURCES})
+    mkw_configure_translated_target(mkw_retro_rewind_functions)
+    target_precompile_headers(mkw_retro_rewind_functions REUSE_FROM mkw_base_shared)
+endif()
+
+function(mkw_configure_product target)
+    target_sources(${target} PRIVATE $<TARGET_OBJECTS:mkw_runtime_common>)
+    # Startup CPU check. Must stay a separate object library so it keeps the
+    # plain baseline ISA while everything around it is built for x86-64-v3.
+    target_sources(${target} PRIVATE $<TARGET_OBJECTS:mkw_cpu_baseline>)
+    target_include_directories(${target} PRIVATE
+        "${MKW_RUNTIME_SOURCE_DIR}/include"
+        "${MKW_RUNTIME_SOURCE_DIR}/src"
+        # Workspace root, so translator output is spelled "generated/<x>.h"
+        # instead of a ../ chain whose depth depends on the includer.
+        "${MKW_RUNTIME_SOURCE_DIR}/.."
+        "${MKW_RUNTIME_SOURCE_DIR}/../aurora-main/include")
+    target_compile_definitions(${target} PRIVATE
+        SDL_MAIN_HANDLED _DISABLE_STRING_ANNOTATION _DISABLE_VECTOR_ANNOTATION TARGET_PC)
+    target_compile_features(${target} PRIVATE cxx_std_20)
+    mkw_apply_common_compile_options(${target})
+    # The dispatch-table and registration shards compile inside the product target itself and
+    # include the same fat translated headers; bound them by the same pool.
+    mkw_bound_translated_compiles(${target})
+    target_link_libraries(${target} PRIVATE
+        mkw_base_shared mkw::pugixml mkw::toml11 mkw::cryptopp)
+
+    target_link_libraries(${target} PRIVATE
+        aurora::gx aurora::pad aurora::si aurora::vi aurora::mtx)
+    if(EXISTS "${MKW_AURORA_DIR}/cmake/AuroraCopyRuntimeDLLs.cmake")
+        include("${MKW_AURORA_DIR}/cmake/AuroraCopyRuntimeDLLs.cmake")
+        aurora_copy_runtime_dlls(${target})
+    endif()
+    if(TARGET sqlite3)
+        get_target_property(MKW_SQLITE_TARGET_TYPE sqlite3 TYPE)
+    endif()
+    if(TARGET sqlite3 AND
+       (MKW_SQLITE_TARGET_TYPE STREQUAL "SHARED_LIBRARY" OR
+        MKW_SQLITE_TARGET_TYPE STREQUAL "MODULE_LIBRARY"))
+        add_custom_command(TARGET ${target} POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy_if_different
+            $<TARGET_FILE:sqlite3> $<TARGET_FILE_DIR:${target}>)
+    endif()
+
+    target_link_libraries(${target} PRIVATE
+        dbghelp user32 winmm ws2_32 iphlpapi secur32 crypt32 windowsapp)
+
+    set_target_properties(${target} PROPERTIES WIN32_EXECUTABLE TRUE)
+    foreach(runtime_dll libc++.dll libunwind.dll)
+        execute_process(
+            COMMAND "${CMAKE_CXX_COMPILER}" "--print-file-name=${runtime_dll}"
+            OUTPUT_VARIABLE runtime_dll_path
+            OUTPUT_STRIP_TRAILING_WHITESPACE)
+        if(NOT EXISTS "${runtime_dll_path}")
+            get_filename_component(mkw_compiler_bin "${CMAKE_CXX_COMPILER}" DIRECTORY)
+            set(runtime_dll_path "${mkw_compiler_bin}/${runtime_dll}")
+        endif()
+        if(NOT EXISTS "${runtime_dll_path}")
+            message(FATAL_ERROR "llvm-mingw runtime DLL not found: ${runtime_dll}")
+        endif()
+        add_custom_command(TARGET ${target} POST_BUILD
+            COMMAND ${CMAKE_COMMAND} -E copy_if_different
+                "${runtime_dll_path}" $<TARGET_FILE_DIR:${target}>)
+    endforeach()
+
+    set(MKW_WII_BOOTSTRAP_SOURCE_DIR "${MKW_RUNTIME_SOURCE_DIR}/assets/wii")
+    if(NOT EXISTS "${MKW_WII_BOOTSTRAP_SOURCE_DIR}/shared2/wc24")
+        message(FATAL_ERROR "Missing Wii first-run bootstrap payload: ${MKW_WII_BOOTSTRAP_SOURCE_DIR}")
+    endif()
+    add_custom_command(TARGET ${target} POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy_directory
+        "${MKW_WII_BOOTSTRAP_SOURCE_DIR}" "$<TARGET_FILE_DIR:${target}>/wii_bootstrap")
+
+    set(MKW_DSP_COEFFICIENT_ROM "${MKW_RUNTIME_SOURCE_DIR}/assets/dsp/dsp_coef.bin")
+    if(NOT EXISTS "${MKW_DSP_COEFFICIENT_ROM}")
+        message(FATAL_ERROR "Missing Wii DSP coefficient ROM: ${MKW_DSP_COEFFICIENT_ROM}")
+    endif()
+    file(SHA256 "${MKW_DSP_COEFFICIENT_ROM}" MKW_DSP_COEFFICIENT_ROM_SHA256)
+    if(NOT MKW_DSP_COEFFICIENT_ROM_SHA256 STREQUAL
+       "d7741279c2e8ec5c5fb318f8fbdd6de6bf583520d288e836a5383233a4238179")
+        message(FATAL_ERROR "Wii DSP coefficient ROM hash mismatch: ${MKW_DSP_COEFFICIENT_ROM_SHA256}")
+    endif()
+    add_custom_command(TARGET ${target} POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy_if_different
+        "${MKW_DSP_COEFFICIENT_ROM}" "$<TARGET_FILE_DIR:${target}>/dsp_coef.bin")
+
+    # Aurora imports this portable recipe database into each user's writable
+    # pipeline cache. Keep the upstream filename so its default resourcesPath
+    # lookup works without application-specific configuration.
+    set(MKW_INITIAL_PIPELINE_CACHE
+        "${MKW_RUNTIME_SOURCE_DIR}/assets/pipeline/initial_pipeline_cache.db")
+    if(NOT EXISTS "${MKW_INITIAL_PIPELINE_CACHE}")
+        message(FATAL_ERROR "Missing transferable Aurora pipeline cache: ${MKW_INITIAL_PIPELINE_CACHE}")
+    endif()
+    add_custom_command(TARGET ${target} POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy_if_different
+        "${MKW_INITIAL_PIPELINE_CACHE}"
+        "$<TARGET_FILE_DIR:${target}>/initial_pipeline_cache.db")
+endfunction()
+
+add_executable(WiiCompiled "${MKW_BASE_PRODUCT_SOURCE}" ${MKW_BASE_REGISTRATION_SOURCES})
+mkw_configure_product(WiiCompiled)
+target_precompile_headers(WiiCompiled PRIVATE
+    "${MKW_RUNTIME_SOURCE_DIR}/include/mkw_pch.h")
+if(TARGET mkw_base_sensitive)
+    target_sources(WiiCompiled PRIVATE $<TARGET_OBJECTS:mkw_base_sensitive>)
+endif()
+
+if(MKW_HAVE_RETRO_REWIND)
+    add_executable(RetroRewind "${MKW_RETRO_REWIND_PRODUCT_SOURCE}" ${MKW_RETRO_REGISTRATION_SOURCES})
+    mkw_configure_product(RetroRewind)
+    target_precompile_headers(RetroRewind REUSE_FROM WiiCompiled)
+    if(TARGET mkw_retro_sensitive)
+        target_sources(RetroRewind PRIVATE $<TARGET_OBJECTS:mkw_retro_sensitive>)
+    endif()
+    target_sources(RetroRewind PRIVATE $<TARGET_OBJECTS:mkw_retro_rewind_functions>)
+    if(MKW_RETRO_BLOB_OBJECTS)
+        target_sources(RetroRewind PRIVATE ${MKW_RETRO_BLOB_OBJECTS})
+    endif()
+    add_custom_target(mkw_release DEPENDS WiiCompiled RetroRewind)
+else()
+    add_custom_target(mkw_release DEPENDS WiiCompiled)
+    message(STATUS "RetroRewind target disabled (run translate-mod and emit-build-shards)")
+endif()
+
+set(MKW_ALL_BUILD_TARGETS
+    mkw_runtime_common mkw_base_shared mkw_base_sensitive mkw_retro_sensitive
+    mkw_retro_rewind_functions WiiCompiled RetroRewind)
+foreach(target IN LISTS MKW_ALL_BUILD_TARGETS)
+    if(TARGET ${target})
+        target_compile_options(${target} PRIVATE -march=x86-64-v3)
+    endif()
+endforeach()
diff --git a/runtime/cmake/guest_symbol_table_stub.cpp b/runtime/cmake/guest_symbol_table_stub.cpp
new file mode 100644
index 0000000..abe0076
--- /dev/null
+++ b/runtime/cmake/guest_symbol_table_stub.cpp
@@ -0,0 +1,18 @@
+// Fallback for builds where generated/guest_symbol_table.cpp has not been
+// produced yet (generate-data-init emits the real table from the project's
+// function map). An empty table simply disables crash-report symbolization.
+#include <cstdint>
+
+extern "C" {
+
+// The extern declarations force external linkage: namespace-scope const
+// objects are internal-linkage by default in C++, even inside extern "C".
+extern const uint32_t kGuestMapSymbolCount;
+extern const uint32_t kGuestMapSymbolAddresses[];
+extern const char* const kGuestMapSymbolNames[];
+
+const uint32_t kGuestMapSymbolCount = 0u;
+const uint32_t kGuestMapSymbolAddresses[] = {0u};
+const char* const kGuestMapSymbolNames[] = {""};
+
+} // extern "C"
diff --git a/runtime/include/abi_bridge.h b/runtime/include/abi_bridge.h
new file mode 100644
index 0000000..e4b87f9
--- /dev/null
+++ b/runtime/include/abi_bridge.h
@@ -0,0 +1,794 @@
+#pragma once
+#include "memory.h"
+#include "ppc_runtime.h"
+#include "system_bridge.h"
+#include "game_graphics_options.h"
+#include "runtime_log.h"
+
+#include <array>
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <iostream>
+#include <optional>
+#include <stdexcept>
+#include <sstream>
+#include <tuple>
+#include <type_traits>
+
+inline void InvokeIndirectCpu(uint32_t target, CpuContext* ctx);
+
+// Some game-facing runtime options alter arguments at well-defined ABI
+// boundaries. Keep this independent of the dispatch mechanism: generated
+// static calls deliberately bypass InvokeDirectCpu for performance.
+// (used for the path mask filtering in ScnRenderer::createPath: depth of
+// field is always removed, bloom when the user disabled it)
+inline void ApplyRuntimeCallOptions(uint32_t target, CpuContext* ctx) {
+    if (target == 0x8023BD38u) {
+        // ScnRenderer::createPath receives the post-processing path mask in r4.
+        ctx->gpr[4] = RuntimeGameGraphicsOptions::FilterScnRendererPathMask(ctx->gpr[4]);
+    }
+}
+
+// Persistent per-thread CPU context used across translated function calls.
+CpuContext& GetPersistentCpuContext();
+void InitializePersistentCpuContext();
+
+enum class FunctionKind : uint8_t {
+    BaseTranslated = 0,
+    ModTranslated = 1,
+    Native = 2,
+};
+
+inline constexpr uint32_t kPpcAllNonvolatileFprMask = 0xffffc000u;
+inline constexpr uint32_t kBaseTranslatedFunctionPriority = 0;
+inline constexpr uint32_t kModTranslatedFunctionPriorityBase = 100;
+inline constexpr uint32_t kNativeFunctionPriority = 10000;
+
+#include "isa/ppc_isa_cr.h"
+
+struct TranslatedFunctionInfo {
+    uint32_t address = 0;
+    const char* name = "";
+    uint64_t moduleId = 0;
+    uint32_t priority = 0;
+    uint32_t nonvolatileFprWriteMask = kPpcAllNonvolatileFprMask;
+    void* entryPoint = nullptr; // Raw typed function pointer for indirect-call resolution
+    void (*rawCpuInvoker)(CpuContext*) = nullptr;
+    bool mustRemainDynamicallyDispatchable = true;
+    FunctionKind kind = FunctionKind::BaseTranslated;
+};
+
+struct RawDispatchRecord {
+    uint32_t address = 0;
+    void (*entry)(CpuContext*) = nullptr;
+    uint32_t nonvolatileFprWriteMask = kPpcAllNonvolatileFprMask;
+    bool preserveNonvolatileGprs = false;
+};
+
+// Translator-owned indirect dispatch is split by the high address byte and
+// then by 4 KiB guest pages. Each populated segment stores only the contiguous
+// page range that contains verified function entry points. The final search is
+// bounded to at most the 1024 aligned instruction addresses in one guest page.
+struct StaticIndirectDispatchPage {
+    uint32_t firstEntry = 0;
+    uint16_t entryCount = 0;
+    // Explicit tail padding to an 8-byte stride. The emitter writes it as a
+    // literal third initializer, so it is part of the generated-data contract.
+    uint16_t reserved = 0;
+};
+
+struct StaticIndirectDispatchSegment {
+    const StaticIndirectDispatchPage* pages = nullptr;
+    uint16_t firstPage = 0;
+    uint16_t pageCount = 0;
+};
+
+struct StaticIndirectDispatchTable {
+    const char* profileName = nullptr;
+    const StaticIndirectDispatchSegment* segments = nullptr; // Exactly 256 high-byte segments.
+    const RawDispatchRecord* entries = nullptr;
+    size_t entryCount = 0;
+};
+
+inline const RawDispatchRecord* FindStaticIndirectDispatchEntry(
+    const StaticIndirectDispatchTable* table,
+    uint32_t address) noexcept {
+    if (!table || !table->segments || !table->entries || table->entryCount == 0) {
+        return nullptr;
+    }
+
+    const auto& segment = table->segments[address >> 24];
+    const uint32_t pageNumber = (address >> 12) & 0x0FFFu;
+    if (!segment.pages || pageNumber < segment.firstPage) {
+        return nullptr;
+    }
+    const uint32_t relativePage = pageNumber - segment.firstPage;
+    if (relativePage >= segment.pageCount) {
+        return nullptr;
+    }
+
+    const auto& page = segment.pages[relativePage];
+    const size_t first = page.firstEntry;
+    const size_t count = page.entryCount;
+    if (first > table->entryCount || count > table->entryCount - first) {
+        return nullptr;
+    }
+
+    size_t lower = first;
+    size_t upper = first + count;
+    while (lower < upper) {
+        const size_t middle = lower + (upper - lower) / 2;
+        const uint32_t candidate = table->entries[middle].address;
+        if (candidate < address) {
+            lower = middle + 1;
+        } else {
+            upper = middle;
+        }
+    }
+    return lower < first + count && table->entries[lower].address == address
+        ? &table->entries[lower]
+        : nullptr;
+}
+
+void RegisterStaticIndirectDispatchTable(const StaticIndirectDispatchTable* table);
+inline std::atomic<const StaticIndirectDispatchTable*> g_publishedStaticIndirectDispatchTable{nullptr};
+
+class StaticIndirectDispatchTableRegistrar {
+public:
+    explicit StaticIndirectDispatchTableRegistrar(const StaticIndirectDispatchTable* table) {
+        RegisterStaticIndirectDispatchTable(table);
+    }
+};
+
+inline unsigned PpcLowestSetBitIndex(uint32_t value) noexcept {
+    return static_cast<unsigned>(__builtin_ctz(value));
+}
+
+class PpcNonvolatileFprGuard {
+public:
+    explicit PpcNonvolatileFprGuard(CpuContext* cpu, uint32_t mask = kPpcAllNonvolatileFprMask) noexcept
+        : cpu_(cpu), mask_(mask & kPpcAllNonvolatileFprMask) {
+        if (!cpu_ || mask_ == 0) {
+            return;
+        }
+        // Real masks are a single contiguous register run - f14..f31 for the
+        // conservative default and f23..f31 or similar for a measured writer -
+        // so resolve the run once and copy it as one straight-line block instead
+        // of testing 18 mask bits. Any other mask keeps the per-bit loop, which
+        // saves and restores exactly the same registers.
+        const uint32_t lowest = mask_ & (0u - mask_);
+        const uint32_t aboveRun = mask_ + lowest;
+        if ((aboveRun & (aboveRun - 1u)) == 0u) {
+            const unsigned first = PpcLowestSetBitIndex(mask_);
+            const unsigned end = aboveRun == 0u ? 32u : PpcLowestSetBitIndex(aboveRun);
+            firstSlot_ = static_cast<uint8_t>(first - 14u);
+            slotCount_ = static_cast<uint8_t>(end - first);
+            const size_t count = slotCount_;
+            for (size_t i = 0; i < count; ++i) {
+                saved_[firstSlot_ + i] = cpu_->fpr[first + i];
+            }
+            return;
+        }
+        for (size_t i = 0; i < saved_.size(); ++i) {
+            if ((mask_ & (1u << (14 + i))) == 0) {
+                continue;
+            }
+            saved_[i] = cpu_->fpr[14 + i];
+        }
+    }
+
+    ~PpcNonvolatileFprGuard() noexcept {
+        if (!cpu_ || mask_ == 0) {
+            return;
+        }
+        if (slotCount_ != 0) {
+            const unsigned first = 14u + firstSlot_;
+            const size_t count = slotCount_;
+            for (size_t i = 0; i < count; ++i) {
+                cpu_->fpr[first + i] = saved_[firstSlot_ + i];
+            }
+            return;
+        }
+        for (size_t i = 0; i < saved_.size(); ++i) {
+            if ((mask_ & (1u << (14 + i))) == 0) {
+                continue;
+            }
+            cpu_->fpr[14 + i] = saved_[i];
+        }
+    }
+
+    PpcNonvolatileFprGuard(const PpcNonvolatileFprGuard&) = delete;
+    PpcNonvolatileFprGuard& operator=(const PpcNonvolatileFprGuard&) = delete;
+
+private:
+    CpuContext* cpu_ = nullptr;
+    uint32_t mask_ = 0;
+    // Contiguous-run description of mask_. slotCount_ == 0 means the mask is not
+    // a single run, so the destructor mirrors the constructor's per-bit loop.
+    uint8_t firstSlot_ = 0;
+    uint8_t slotCount_ = 0;
+    // Every element selected by mask_ is written before it is read. Leaving the
+    // remaining slots uninitialized avoids zero-filling all 18 values around a
+    // call that may preserve only one or two architectural FPRs.
+    std::array<PPC_FPR, 18> saved_;
+};
+
+class PpcNonvolatileGprGuard {
+public:
+    explicit PpcNonvolatileGprGuard(CpuContext* cpu, bool enabled = true) noexcept
+        : cpu_(enabled ? cpu : nullptr) {
+        if (!cpu_) {
+            return;
+        }
+        for (size_t i = 0; i < saved_.size(); ++i) {
+            saved_[i] = cpu_->gpr[14 + i];
+        }
+    }
+
+    ~PpcNonvolatileGprGuard() noexcept {
+        if (!cpu_) {
+            return;
+        }
+        for (size_t i = 0; i < saved_.size(); ++i) {
+            cpu_->gpr[14 + i] = saved_[i];
+        }
+    }
+
+    PpcNonvolatileGprGuard(const PpcNonvolatileGprGuard&) = delete;
+    PpcNonvolatileGprGuard& operator=(const PpcNonvolatileGprGuard&) = delete;
+
+private:
+    CpuContext* cpu_ = nullptr;
+    // Left uninitialized: enabled writes all 18 slots before reading them, disabled reads none,
+    // so skipping the zero-fill saves 72 bytes of stack work on the common disabled hot path.
+    std::array<uint32_t, 18> saved_;
+};
+
+// Guest address of OSLoadContext, which models rfi-style context restoration
+// and intentionally replaces the full guest register file instead of returning
+// like a normal ABI call. It can never be guarded.
+inline constexpr uint32_t kOSLoadContextAddress = 0x801A1F58u;
+
+inline bool ShouldPreserveNonvolatileGprsForRawCpuCall(const TranslatedFunctionInfo* info) noexcept {
+    return info->kind == FunctionKind::Native && info->address != kOSLoadContextAddress;
+}
+
+inline uint32_t NonvolatileFprGuardMaskFor(const TranslatedFunctionInfo* info) noexcept {
+    if (!info || info->nonvolatileFprWriteMask == 0) {
+        return 0;
+    }
+    return info->nonvolatileFprWriteMask & kPpcAllNonvolatileFprMask;
+}
+
+template <uint32_t Target>
+struct KnownTranslatedCpuCall {
+    static constexpr bool kAvailable = false;
+    static constexpr uint32_t kNonvolatileFprWriteMask = kPpcAllNonvolatileFprMask;
+    static constexpr bool kMustRemainDynamicallyDispatchable = true;
+    static constexpr void (*Entry)(CpuContext*) = nullptr;
+};
+
+// Translator-emitted trait specializations, one macro shared by every generated shard.
+// `addr` is the 8-digit hex entry point, `winner` the resolved symbol (mods/Retro Rewind can
+// publish their own name). A specialization only exists for a single statically bound winner,
+// so overridable/dynamically-dispatchable are hardcoded here rather than passed in.
+#define MKW_TRANSLATED_TRAIT(addr, winner, nonvolatile_fpr_write_mask)                    \
+    extern "C" void winner(CpuContext* ctx);                                              \
+    template <>                                                                           \
+    struct KnownTranslatedCpuCall<0x##addr##u> {                                          \
+        static constexpr bool kAvailable = true;                                          \
+        static constexpr uint32_t kNonvolatileFprWriteMask = nonvolatile_fpr_write_mask;  \
+        static constexpr bool kMustRemainDynamicallyDispatchable = false;                 \
+        static constexpr void (*Entry)(CpuContext*) = &winner;                            \
+    }
+
+template <uint32_t Target>
+struct KnownNativeCpuCall {
+    static constexpr bool kAvailable = false;
+    static constexpr uint32_t kNonvolatileFprWriteMask = kPpcAllNonvolatileFprMask;
+    static constexpr void (*Entry)(CpuContext*) = nullptr;
+};
+
+template <uint32_t Target>
+struct KnownTypedNativeCpuCall {
+    static constexpr bool kAvailable = false;
+};
+
+#include "native_cpu_calls.inc"
+
+// Direct-mapped thread-local memo in front of the sorted registry lookup every bctrl performs;
+// a miss just re-runs the sorted lookup. 512 entries (12 KiB) covers the per-frame indirect
+// working set while staying L1/L2 resident, unlike 4096 which would thrash L2. Must stay a
+// power of two, the index masks with (size - 1).
+inline constexpr size_t kIndirectDispatchCacheEntries = 512;
+
+// Namespace-scope `inline thread_local`, not function-local `static thread_local`, to avoid a
+// thread-static init epoch check on every bctrl (same as g_currentCpuContext in ppc_runtime.h).
+struct IndirectResolvedDispatchMemoEntry {
+    bool valid;
+    uint32_t address;
+    const TranslatedFunctionInfo* info;
+};
+inline thread_local IndirectResolvedDispatchMemoEntry
+    g_indirectResolvedDispatchMemo[kIndirectDispatchCacheEntries]{};
+
+struct IndirectRawDispatchMemoEntry {
+    bool valid;
+    uint32_t address;
+    const RawDispatchRecord* record;
+};
+inline thread_local IndirectRawDispatchMemoEntry
+    g_indirectRawDispatchMemo[kIndirectDispatchCacheEntries]{};
+
+class TranslatedFunctionRegistry {
+public:
+    static void Register(TranslatedFunctionInfo info);
+    static void Finalize();
+    static inline bool IsLookupPublished() noexcept {
+        return lookupPublished_.load(std::memory_order_acquire);
+    }
+    static std::optional<TranslatedFunctionInfo> FindNearestByAddress(uint32_t address);
+    static inline const TranslatedFunctionInfo* FindByAddressPtr(uint32_t address) {
+        if (!lookupPublished_.load(std::memory_order_acquire)) {
+            return FindByAddressPtrSlow(address);
+        }
+
+        auto& cached = g_indirectResolvedDispatchMemo[
+            ((address >> 2) * 2654435761u) & (kIndirectDispatchCacheEntries - 1)];
+        if (cached.valid && cached.address == address) {
+            return cached.info;
+        }
+
+        const auto* info = FindByAddressPtrSlow(address);
+        cached = {true, address, info};
+        return info;
+    }
+
+    // Hot wrapper: only the direct-mapped memo probe stays inline. Inlining the
+    // generated-table binary search alongside it pushed the whole function past
+    // the inliner's budget and out-of-lined the probe itself, which is the part
+    // every bctrl executes.
+    static MKW_PPC_FORCE_INLINE const RawDispatchRecord* FindRawByAddressPtr(uint32_t address) {
+        if (!lookupPublished_.load(std::memory_order_acquire)) {
+            return nullptr;
+        }
+
+        auto& cached = g_indirectRawDispatchMemo[
+            ((address >> 2) * 2654435761u) & (kIndirectDispatchCacheEntries - 1)];
+        if (cached.valid && cached.address == address) {
+            return cached.record;
+        }
+
+        return FindRawByAddressPtrMiss(address, cached);
+    }
+    // Look up a registered function by host (native) address.
+    // This enables stack trace symbolication for translated functions.
+    static std::optional<TranslatedFunctionInfo> FindByHostAddress(uintptr_t hostAddr);
+
+private:
+    // Memo miss: resolve against the header-inline generated table first; only dynamically
+    // registered records or a not-yet-published table fall through to the slow path.
+    static MKW_PPC_NO_INLINE MKW_PPC_COLD const RawDispatchRecord* FindRawByAddressPtrMiss(
+        uint32_t address, IndirectRawDispatchMemoEntry& cached) {
+        const RawDispatchRecord* record = nullptr;
+        if (const auto* table =
+                g_publishedStaticIndirectDispatchTable.load(std::memory_order_acquire)) {
+            record = FindStaticIndirectDispatchEntry(table, address);
+        }
+        if (record == nullptr) {
+            record = FindRawByAddressPtrSlow(address);
+        }
+        cached = {true, address, record};
+        return record;
+    }
+
+    static const TranslatedFunctionInfo* FindByAddressPtrSlow(uint32_t address);
+    static const RawDispatchRecord* FindRawByAddressPtrSlow(uint32_t address);
+
+    // Finalize publishes immutable registry, generated-table, and dynamic raw
+    // dispatch storage. Header-inlined cache hits are enabled only after that
+    // release publication, so a pre-finalization miss can never poison them.
+    inline static std::atomic_bool lookupPublished_{false};
+};
+
+// Cold, profile-owned registration data is emitted in compact table shards.
+// Keeping it out of generated function bodies avoids one static constructor
+// per translated function.
+struct BulkTranslatedFunctionRecord {
+    uint32_t address;
+    const char* name;
+    void (*entry)(CpuContext*);
+    FunctionKind kind;
+    bool preservesNonvolatileFprs;
+    uint32_t nonvolatileFprWriteMask;
+    uint32_t priority;
+    uint64_t moduleId;
+    bool mustRemainDynamicallyDispatchable;
+};
+
+void RegisterBulkTranslatedFunctions(const BulkTranslatedFunctionRecord* records, size_t count);
+
+class BulkTranslatedFunctionRegistrar {
+public:
+    BulkTranslatedFunctionRegistrar(const BulkTranslatedFunctionRecord* records, size_t count) {
+        RegisterBulkTranslatedFunctions(records, count);
+    }
+};
+
+MKW_PPC_FORCE_INLINE bool TryDispatchResolvedCpuTarget(const TranslatedFunctionInfo* info, CpuContext* cpu) {
+    if (!info || !info->rawCpuInvoker) {
+        return false;
+    }
+
+    RecompMod::ScopedTranslatedExecutionAddress translatedExecution(info->address);
+    PpcNonvolatileFprGuard fprGuard(cpu, NonvolatileFprGuardMaskFor(info));
+    PpcNonvolatileGprGuard gprGuard(cpu, ShouldPreserveNonvolatileGprsForRawCpuCall(info));
+    if (TryGetCpuContext() != cpu) {
+        CpuContextScope scope(cpu);
+        info->rawCpuInvoker(cpu);
+        return true;
+    }
+    info->rawCpuInvoker(cpu);
+    return true;
+}
+
+inline bool TryDispatchRawCpuTarget(const RawDispatchRecord* record, CpuContext* cpu) {
+    if (!record || !record->entry) {
+        return false;
+    }
+    RecompMod::ScopedTranslatedExecutionAddress translatedExecution(record->address);
+    PpcNonvolatileGprGuard gprGuard(cpu, record->preserveNonvolatileGprs);
+    PpcNonvolatileFprGuard fprGuard(cpu, record->nonvolatileFprWriteMask);
+    if (TryGetCpuContext() != cpu) {
+        CpuContextScope scope(cpu);
+        record->entry(cpu);
+    } else {
+        record->entry(cpu);
+    }
+    return true;
+}
+
+template <uint32_t Target>
+inline void DispatchKnownTranslatedCpuTargetStatic(CpuContext* cpu) {
+    const auto invokeKnownTranslated = [&]() {
+        KnownTranslatedCpuCall<Target>::Entry(cpu);
+    };
+
+    // A statically resolved, non-overridable translated call already running
+    // in this CpuContext needs no registry, context, or diagnostic target
+    // transition. This is the normal generated-to-generated hot path.
+    if (TryGetCpuContext() == cpu) {
+        if constexpr (KnownTranslatedCpuCall<Target>::kNonvolatileFprWriteMask == 0) {
+            invokeKnownTranslated();
+            return;
+        } else {
+            PpcNonvolatileFprGuard fprGuard(
+                cpu, KnownTranslatedCpuCall<Target>::kNonvolatileFprWriteMask);
+            invokeKnownTranslated();
+            return;
+        }
+    }
+
+    CpuContextScope contextScope(cpu);
+    RecompMod::ScopedTranslatedExecutionAddress translatedExecution(Target);
+    if constexpr (KnownTranslatedCpuCall<Target>::kNonvolatileFprWriteMask == 0) {
+        invokeKnownTranslated();
+        return;
+    } else {
+        PpcNonvolatileFprGuard fprGuard(cpu, KnownTranslatedCpuCall<Target>::kNonvolatileFprWriteMask);
+        invokeKnownTranslated();
+    }
+}
+
+[[noreturn]] inline void ReportMissingCpuTarget(uint32_t target, CpuContext* cpu) {
+    // Centralized crash path: stderr diagnostics, heuristics, crash artifacts
+    // in the run's log folder, popup, exit.
+    RuntimeCrash::FatalMissingGuestTarget(target, cpu);
+}
+
+template <uint32_t Target>
+inline const TranslatedFunctionInfo* ResolveDirectCpuTargetInfo() {
+    return TranslatedFunctionRegistry::FindByAddressPtr(Target);
+}
+
+template <uint32_t Target>
+inline const TranslatedFunctionInfo* ResolveDirectCpuTargetInfoCached() {
+    // Only latch a result once the registry is published (immutable for the process lifetime);
+    // a pre-finalization miss or provisional winner must never be cached. 0 = not yet resolved,
+    // 1 = negative-cache sentinel, avoiding a second ready flag on the hot path.
+    static std::atomic<uintptr_t> cachedValue{0};
+    constexpr uintptr_t kNegativeCache = 1;
+    const uintptr_t cached = cachedValue.load(std::memory_order_acquire);
+    if (cached != 0) {
+        return cached == kNegativeCache
+            ? nullptr
+            : reinterpret_cast<const TranslatedFunctionInfo*>(cached);
+    }
+    if (!TranslatedFunctionRegistry::IsLookupPublished()) {
+        return ResolveDirectCpuTargetInfo<Target>();
+    }
+    const auto* info = ResolveDirectCpuTargetInfo<Target>();
+    cachedValue.store(info != nullptr
+                          ? reinterpret_cast<uintptr_t>(info)
+                          : kNegativeCache,
+                      std::memory_order_release);
+    return info;
+}
+
+// Caches the "is the published winner still base translation?" verdict for state-free fast
+// paths guarding tens of thousands of call sites. Same latching rule as above: 0 = unresolved,
+// 1 = negative, 2 = positive, and a verdict computed pre-publication is never stored.
+template <uint32_t Target>
+inline bool IsBaseTranslatedCpuTargetActive() {
+    static std::atomic<uint8_t> cachedVerdict{0};
+    constexpr uint8_t kNegativeVerdict = 1;
+    constexpr uint8_t kPositiveVerdict = 2;
+    const uint8_t cached = cachedVerdict.load(std::memory_order_acquire);
+    if (cached != 0) {
+        return cached == kPositiveVerdict;
+    }
+    const bool publishable = TranslatedFunctionRegistry::IsLookupPublished();
+    const auto* info = ResolveDirectCpuTargetInfo<Target>();
+    const bool active = info != nullptr && info->kind == FunctionKind::BaseTranslated;
+    if (publishable) {
+        cachedVerdict.store(active ? kPositiveVerdict : kNegativeVerdict,
+                            std::memory_order_release);
+    }
+    return active;
+}
+
+template <uint32_t Target>
+inline void InvokeDirectCpu(CpuContext* ctx) {
+    static_assert(Target != 0, "InvokeDirectCpu cannot target address 0");
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    ApplyRuntimeCallOptions(Target, cpu);
+    if constexpr (KnownNativeCpuCall<Target>::kAvailable) {
+        const auto invokeKnownNative = [&]() {
+            PpcNonvolatileGprGuard gprGuard(cpu);
+            if (TryGetCpuContext() != cpu) {
+                CpuContextScope scope(cpu);
+                KnownNativeCpuCall<Target>::Entry(cpu);
+                return;
+            }
+            KnownNativeCpuCall<Target>::Entry(cpu);
+        };
+        if constexpr (KnownNativeCpuCall<Target>::kNonvolatileFprWriteMask == 0) {
+            invokeKnownNative();
+        } else {
+            PpcNonvolatileFprGuard fprGuard(cpu, KnownNativeCpuCall<Target>::kNonvolatileFprWriteMask);
+            invokeKnownNative();
+        }
+        return;
+    }
+
+    if constexpr (KnownTypedNativeCpuCall<Target>::kAvailable) {
+        PpcNonvolatileGprGuard gprGuard(cpu);
+        if (TryGetCpuContext() != cpu) {
+            CpuContextScope scope(cpu);
+            KnownTypedNativeCpuCall<Target>::Invoke(cpu);
+        } else {
+            KnownTypedNativeCpuCall<Target>::Invoke(cpu);
+        }
+        return;
+    }
+
+    if constexpr (KnownTranslatedCpuCall<Target>::kAvailable) {
+        DispatchKnownTranslatedCpuTargetStatic<Target>(cpu);
+        return;
+    }
+
+    const auto* registeredInfo = ResolveDirectCpuTargetInfoCached<Target>();
+    if (TryDispatchResolvedCpuTarget(registeredInfo, cpu)) {
+        return;
+    }
+
+    ReportMissingCpuTarget(Target, cpu);
+}
+
+// Indirect jump (bctr without link) - used for switch tables.
+inline void InvokeIndirectJump(uint32_t target, CpuContext* ctx) {
+    // Use the caller's context, not the persistent global context!
+    // This is essential for tail calls via bctr where the 'this' pointer (r3)
+    // must be passed correctly to the target function.
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    if (TryDispatchRawCpuTarget(TranslatedFunctionRegistry::FindRawByAddressPtr(target), cpu)) {
+        return;
+    }
+
+    // Cold fallback for dynamically registered or signature-only targets.
+    const auto* info = TranslatedFunctionRegistry::FindByAddressPtr(target);
+    if (info) {
+        if (TryDispatchResolvedCpuTarget(info, cpu)) {
+            return;
+        }
+    }
+    
+    // If not registered, this is likely a switch table jump to an intra-function label.
+    // The translator should have recognized this pattern and generated proper switch code.
+    RT_LOG(RT_TAG_RUNTIME) << "InvokeIndirectJump: target 0x"
+              << std::hex << target << std::dec
+              << " is not a registered function.\n"
+              << "This is likely a switch statement jump table that the translator\n"
+              << "failed to recognize. The function containing this bctr needs\n"
+              << "proper switch pattern recognition." << std::endl;
+    RT_LOG(RT_TAG_RUNTIME) << "Indirect jump context: pc=0x" << std::hex << cpu->pc
+              << " lr=0x" << cpu->lr << " ctr=0x" << cpu->ctr
+              << " r1=0x" << cpu->gpr[1] << " r3=0x" << cpu->gpr[3]
+              << " r29=0x" << cpu->gpr[29] << " r30=0x" << cpu->gpr[30]
+              << " r31=0x" << cpu->gpr[31] << std::dec << std::endl;
+    DumpHostStackTraceForRuntimeHelper();
+    std::fflush(stderr);
+    std::ostringstream message;
+    message << "The game stopped because an indirect jump targeted guest address 0x"
+            << std::hex << target
+            << ", but that address is not a registered translated function.\n\n"
+            << "The translator may have missed a switch/jump-table target.";
+    // Same artifact set as RuntimeCrash::FatalMissingGuestTarget, which is this
+    // path's sibling for indirect *calls*: MarkFatalErrorReported below stops the
+    // atexit reporter, so the crash log has to be written here.
+    RuntimeCrash::WriteCrashArtifacts("missing_jump_target", message.str(), &target);
+    SetRuntimeExitCode(EXIT_FAILURE);
+    ShowRuntimeFatalPopup("Missing indirect jump target", message.str());
+    MarkFatalErrorReported();
+    std::exit(EXIT_FAILURE);
+}
+
+inline void InvokeIndirectCpu(uint32_t target, CpuContext* ctx) {
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    if (target == 0) {
+        ReportMissingCpuTarget(target, cpu);
+    }
+    ApplyRuntimeCallOptions(target, cpu);
+    if (TryDispatchRawCpuTarget(TranslatedFunctionRegistry::FindRawByAddressPtr(target), cpu)) {
+        return;
+    }
+    if (TryDispatchResolvedCpuTarget(TranslatedFunctionRegistry::FindByAddressPtr(target), cpu)) {
+        return;
+    }
+    ReportMissingCpuTarget(target, cpu);
+}
+
+template <typename Signature>
+class AbiTrampoline;
+
+template <typename Ret, typename... Args>
+class AbiTrampoline<Ret(Args...)> {
+public:
+    using TargetFn = Ret (*)(Args...);
+
+    AbiTrampoline(uint32_t address,
+                  const char* name,
+                  TargetFn target,
+                  FunctionKind kind = FunctionKind::BaseTranslated,
+                  bool preservesNonvolatileFprs = false,
+                  uint32_t nonvolatileFprWriteMask = kPpcAllNonvolatileFprMask,
+                  uint32_t priority = 0,
+                  uint64_t moduleId = 0,
+                  void (*rawCpuInvoker)(CpuContext*) = nullptr,
+                  bool mustRemainDynamicallyDispatchable = true)
+    {
+        TranslatedFunctionInfo info;
+        info.address = address;
+        info.name = name ? name : "";
+        info.moduleId = moduleId;
+        info.priority = priority;
+        const bool effectivePreservesNonvolatileFprs =
+            preservesNonvolatileFprs || kind == FunctionKind::Native;
+        info.nonvolatileFprWriteMask = effectivePreservesNonvolatileFprs ? 0 : (nonvolatileFprWriteMask & kPpcAllNonvolatileFprMask);
+        info.entryPoint = reinterpret_cast<void*>(target);
+        info.rawCpuInvoker = rawCpuInvoker;
+        info.mustRemainDynamicallyDispatchable = mustRemainDynamicallyDispatchable;
+        info.kind = kind;
+        TranslatedFunctionRegistry::Register(std::move(info));
+    }
+
+    static std::tuple<Args...> BuildArgs(CpuContext* cpu) {
+        size_t gprIndex = 0;
+        size_t fprIndex = 0;
+        return std::tuple<Args...>{LoadArgument<Args>(cpu, gprIndex, fprIndex)...};
+    }
+
+    template <typename T>
+    static std::remove_reference_t<T> LoadArgument(CpuContext* cpu, size_t& gprIndex, size_t& fprIndex) {
+        using CleanT = std::remove_reference_t<T>;
+        if constexpr (std::is_floating_point_v<CleanT>) {
+            if (fprIndex >= 13) {
+                throw std::out_of_range("FPR argument overflow");
+            }
+            return static_cast<CleanT>(cpu->fpr[1 + fprIndex++].d);
+        } else {
+            if (gprIndex >= 8) {
+                size_t stackArgIndex = gprIndex - 8;
+                uint32_t sp = cpu->gpr[1];
+                uint32_t argAddr = sp + 8 + static_cast<uint32_t>(stackArgIndex * 4);
+                gprIndex++;
+                try {
+                    return static_cast<CleanT>(Memory::Read32(argAddr));
+                } catch (const Memory::AccessViolation&) {
+                    RT_LOG(RT_TAG_RUNTIME) << "Stack parameter read failed at 0x" << std::hex << argAddr
+                              << " (SP=0x" << sp << ", argIndex=" << std::dec << (gprIndex - 1) << ")" << std::endl;
+                    throw;
+                }
+            }
+            return static_cast<CleanT>(cpu->gpr[3 + gprIndex++]);
+        }
+    }
+
+    static void InvokeCpu(TargetFn target, CpuContext* cpu) {
+        auto args = BuildArgs(cpu);
+        if constexpr (std::is_void_v<Ret>) {
+            std::apply(target, args);
+        } else {
+            auto result = std::apply(target, args);
+            if constexpr (std::is_floating_point_v<Ret>) {
+                cpu->fpr[1].d = static_cast<double>(result);
+            } else {
+                cpu->gpr[3] = static_cast<uint32_t>(result);
+            }
+        }
+    }
+};
+
+template <auto Target>
+struct AbiRawCpuThunk {
+    static void Invoke(CpuContext* cpu) {
+        if constexpr (std::is_invocable_v<decltype(Target), CpuContext*>) {
+            (void)Target(cpu);
+        } else {
+            AbiTrampoline<std::remove_pointer_t<decltype(Target)>>::InvokeCpu(Target, cpu);
+        }
+    }
+};
+
+template <typename Ret>
+class AbiTrampoline<Ret(CpuContext*)> {
+public:
+    using TargetFn = Ret (*)(CpuContext*);
+
+    AbiTrampoline(uint32_t address,
+                  const char* name,
+                  TargetFn target,
+                  FunctionKind kind = FunctionKind::BaseTranslated,
+                  bool preservesNonvolatileFprs = false,
+                  uint32_t nonvolatileFprWriteMask = kPpcAllNonvolatileFprMask,
+                  uint32_t priority = 0,
+                  uint64_t moduleId = 0,
+                  void (*rawCpuInvoker)(CpuContext*) = nullptr,
+                  bool mustRemainDynamicallyDispatchable = true)
+    {
+        TranslatedFunctionInfo info;
+        info.address = address;
+        info.name = name ? name : "";
+        info.moduleId = moduleId;
+        info.priority = priority;
+        // Deliberately *not* mirroring the typed specialization's
+        // `|| kind == FunctionKind::Native`. A CpuContext* native receives the
+        // whole guest register file and can legitimately write f14-f31 through
+        // it, so it stays conservative until the individual address has been
+        // measured clean and its registration opts out below.
+        info.nonvolatileFprWriteMask = preservesNonvolatileFprs ? 0 : (nonvolatileFprWriteMask & kPpcAllNonvolatileFprMask);
+        info.entryPoint = reinterpret_cast<void*>(target);
+        info.rawCpuInvoker = rawCpuInvoker ? rawCpuInvoker : reinterpret_cast<void (*)(CpuContext*)>(target);
+        info.mustRemainDynamicallyDispatchable = mustRemainDynamicallyDispatchable;
+        info.kind = kind;
+        TranslatedFunctionRegistry::Register(std::move(info));
+    }
+};
+
+#define MKW_DETAIL_CAT(a, b) a##b
+#define MKW_DETAIL_MAKE_UNIQUE(a, b) MKW_DETAIL_CAT(a, b)
+
+// Three hand-written registration macros. Generated code never registers per function; every
+// translated function reaches the registry via the bulk BulkTranslatedFunctionRecord tables
+// in the translator's *_registration TUs.
+#define REGISTER_TRANSLATED_FUNCTION(address, fn) \
+    static AbiTrampoline<decltype(fn)> MKW_DETAIL_MAKE_UNIQUE(_abi_trampoline_, __COUNTER__)(address, #fn, fn, FunctionKind::BaseTranslated, false, kPpcAllNonvolatileFprMask, 0, 0, nullptr, KnownTranslatedCpuCall<address>::kMustRemainDynamicallyDispatchable)
+
+#define REGISTER_NATIVE_FUNCTION(address, fn) \
+    static AbiTrampoline<decltype(fn)> MKW_DETAIL_MAKE_UNIQUE(_abi_native_trampoline_, __COUNTER__)(address, #fn, fn, FunctionKind::Native, false, kPpcAllNonvolatileFprMask, 0, 0, &AbiRawCpuThunk<&fn>::Invoke)
+
+#define REGISTER_NATIVE_FUNCTION_AS(address, fn, pretty_name) \
+    static AbiTrampoline<decltype(fn)> MKW_DETAIL_MAKE_UNIQUE(_abi_native_trampoline_named_, __COUNTER__)(address, pretty_name, fn, FunctionKind::Native, false, kPpcAllNonvolatileFprMask, 0, 0, &AbiRawCpuThunk<&fn>::Invoke)
diff --git a/runtime/include/audio_backend.h b/runtime/include/audio_backend.h
new file mode 100644
index 0000000..ae05827
--- /dev/null
+++ b/runtime/include/audio_backend.h
@@ -0,0 +1,48 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <vector>
+
+#include <SDL3/SDL_audio.h>
+
+class AudioBackend {
+public:
+    static AudioBackend& Instance();
+
+    bool Init(uint32_t sampleRate, uint32_t channels);
+    void Shutdown();
+
+    // Wii AI DMA frames are big-endian and ordered right, left. SDL expects
+    // native-endian interleaved left, right samples.
+    bool PushWiiAiSamplesBE16(const uint8_t* data, size_t bytes);
+    bool PushSamplesLE16(const int16_t* samples, size_t sampleCount);
+
+    // Applied to the final host output, covering both AX and direct AI DMA.
+    void SetMasterVolume(float volume);
+    void SetMuted(bool muted);
+
+private:
+    AudioBackend() = default;
+    ~AudioBackend() = default;
+    AudioBackend(const AudioBackend&) = delete;
+    AudioBackend& operator=(const AudioBackend&) = delete;
+
+    bool EnsureInitializedLocked(uint32_t sampleRate, uint32_t channels);
+    bool QueueHasCapacityLocked(int incomingBytes);
+    uint32_t QueueLimitBytesLocked() const;
+    float EffectiveGainLocked() const;
+    void ApplyGainLocked();
+
+    mutable std::mutex m_mutex;
+    SDL_AudioStream* m_stream = nullptr;
+    SDL_AudioSpec m_spec{};
+    uint32_t m_sampleRate = 0;
+    uint32_t m_channels = 0;
+    bool m_initialized = false;
+    float m_masterVolume = 1.0f;
+    bool m_muted = false;
+    bool m_reportedDroppedBlock = false;
+    std::vector<int16_t> m_convertBuffer;
+};
diff --git a/runtime/include/aurora_events.h b/runtime/include/aurora_events.h
new file mode 100644
index 0000000..ddb2df8
--- /dev/null
+++ b/runtime/include/aurora_events.h
@@ -0,0 +1,142 @@
+#pragma once
+
+#include "settings_overlay.h"
+#include "runtime_config.h"
+
+#include <aurora/aurora.h>
+#include <aurora/event.h>
+#include <dolphin/gx/GXAurora.h>
+
+#include <cstdlib>
+#include <atomic>
+#include <chrono>
+
+#if defined(_WIN32)
+#include <windows.h>
+#endif
+
+extern "C" bool g_dynamicAspectRatioEnabled;
+void ConfigureMkwDynamicAspect(bool widescreen, uint32_t surfaceWidth, uint32_t surfaceHeight);
+void UpdateMkwDynamicAspectSurface(uint32_t surfaceWidth, uint32_t surfaceHeight);
+// Arms the "keep EGG::Frustum's projection scale" flag on every screen that
+// renders to a fixed-size offscreen target. Cheap and idempotent; called from
+// the GX viewport path so it beats bakes that never cross a frame boundary.
+void AssertMkwOffscreenScreenBypass();
+inline std::atomic_bool g_mkwDynamicAspectSurfacePending{false};
+
+namespace WindowPlacementPersistence {
+inline bool sizeDirty = false;
+inline bool positionDirty = false;
+inline uint32_t width = 0;
+inline uint32_t height = 0;
+inline int32_t x = 0;
+inline int32_t y = 0;
+inline std::chrono::steady_clock::time_point changedAt{};
+
+inline void Flush(bool force = false) {
+    if (!sizeDirty && !positionDirty) {
+        return;
+    }
+    constexpr auto kSaveDelay = std::chrono::milliseconds(300);
+    if (!force && std::chrono::steady_clock::now() - changedAt < kSaveDelay) {
+        return;
+    }
+    if (sizeDirty && width != 0 && height != 0) {
+        RuntimeConfigFile::SetWindowSize(width, height);
+    }
+    if (positionDirty) {
+        RuntimeConfigFile::SetWindowPosition(x, y);
+    }
+    sizeDirty = false;
+    positionDirty = false;
+}
+} // namespace WindowPlacementPersistence
+
+// The close event can be consumed while execution is inside a guest fiber
+// (for example, OSSleepThread).  Running normal C++/CRT shutdown from that
+// fiber re-enters runtime teardown and can fault while the fiber machinery is
+// still active.  A window close is an intentional successful exit, so end the
+// process directly and do not run the crash/atexit paths.
+[[noreturn]] inline void ExitForAuroraWindowClose() noexcept {
+    WindowPlacementPersistence::Flush(true);
+#if defined(_WIN32)
+    ::ExitProcess(0);
+#else
+    std::_Exit(EXIT_SUCCESS);
+#endif
+}
+
+// Update cached Aurora window/framebuffer dimensions based on pending events.
+inline void ProcessAuroraEvents(const AuroraEvent* events) {
+    if (!events) {
+        return;
+    }
+
+    bool surfaceChanged = false;
+    for (const AuroraEvent* event = events; event->type != AURORA_NONE; ++event) {
+        switch (event->type) {
+        case AURORA_WINDOW_MOVED:
+            if (aurora_get_display_mode() == AURORA_DISPLAY_MODE_WINDOWED) {
+                WindowPlacementPersistence::x = event->windowPos.x;
+                WindowPlacementPersistence::y = event->windowPos.y;
+                WindowPlacementPersistence::positionDirty = true;
+                WindowPlacementPersistence::changedAt = std::chrono::steady_clock::now();
+            }
+            break;
+        case AURORA_WINDOW_RESIZED:
+            if (aurora_get_display_mode() == AURORA_DISPLAY_MODE_WINDOWED &&
+                event->windowSize.width != 0 && event->windowSize.height != 0) {
+                WindowPlacementPersistence::width = event->windowSize.width;
+                WindowPlacementPersistence::height = event->windowSize.height;
+                WindowPlacementPersistence::sizeDirty = true;
+                WindowPlacementPersistence::changedAt = std::chrono::steady_clock::now();
+            }
+            surfaceChanged = true;
+            break;
+        case AURORA_DISPLAY_SCALE_CHANGED:
+            surfaceChanged = true;
+            break;
+        case AURORA_EXIT:
+            ExitForAuroraWindowClose();
+        default:
+            break;
+        }
+    }
+
+    WindowPlacementPersistence::Flush();
+
+    if (surfaceChanged) {
+        // Applying the viewport policy drains GX. Event dispatch can run
+        // between asynchronous end_frame and the next begin_frame, while the
+        // frame worker is intentionally waiting for begin permission. Joining
+        // it here creates a circular wait. Record the newest native size and
+        // apply it immediately after the next frame has been prepared.
+        g_mkwDynamicAspectSurfacePending.store(true, std::memory_order_release);
+    }
+    settings_overlay::HandleEvents(events);
+}
+
+inline void ApplyPendingMkwDynamicAspectSurface() {
+    // The OS can adjust a window without a resize event reaching the queue
+    // (observed with hidden windows clamped to the work area), so re-read the
+    // surface at every frame boundary instead of only on queued events.
+    // UpdateMkwDynamicAspectSurface is idempotent and cheap for a stable size.
+    (void)g_mkwDynamicAspectSurfacePending.exchange(false, std::memory_order_acq_rel);
+    uint32_t surfaceWidth = 0;
+    uint32_t surfaceHeight = 0;
+    AuroraGetSurfaceSize(&surfaceWidth, &surfaceHeight);
+    UpdateMkwDynamicAspectSurface(surfaceWidth, surfaceHeight);
+}
+
+inline bool BeginAuroraFrame() {
+    if (!aurora_begin_frame()) {
+        return false;
+    }
+    ApplyPendingMkwDynamicAspectSurface();
+    return true;
+}
+
+// Poll Aurora events and update cached window/framebuffer dimensions.
+inline void UpdateAuroraAndProcessEvents() {
+    ProcessAuroraEvents(aurora_update());
+}
diff --git a/runtime/include/console_identity.h b/runtime/include/console_identity.h
new file mode 100644
index 0000000..2d70745
--- /dev/null
+++ b/runtime/include/console_identity.h
@@ -0,0 +1,151 @@
+#pragma once
+
+#include "runtime_config.h"
+
+#include <algorithm>
+#include <array>
+#include <cctype>
+#include <cstddef>
+#include <cstdint>
+#include <filesystem>
+#include <fstream>
+#include <iomanip>
+#include <optional>
+#include <random>
+#include <sstream>
+#include <string>
+#include <string_view>
+#include <utility>
+
+namespace RuntimeConsoleIdentity {
+
+struct Identity {
+    std::string serial;
+    std::array<uint8_t, 6> mac;
+};
+
+inline bool IsValidSerial(const std::string& serial) {
+    return serial.size() == 9 &&
+           serial != "000000000" &&
+           std::all_of(serial.begin(), serial.end(),
+                       [](unsigned char value) { return std::isdigit(value) != 0; });
+}
+
+inline Identity FromSerial(std::string serial) {
+    // Keep Nintendo's Wii OUI. The suffix is derived from the persisted serial
+    // so every API exposes one coherent, stable virtual-console identity.
+    uint32_t hash = 2166136261u;
+    for (const unsigned char value : serial) {
+        hash ^= value;
+        hash *= 16777619u;
+    }
+    uint32_t suffix = hash & 0x00FFFFFFu;
+    if (suffix == 0 || suffix == 0x00FFFFFFu) {
+        suffix ^= 0x005A17C3u;
+    }
+
+    return {
+        std::move(serial),
+        {
+            0x00,
+            0x09,
+            0xBF,
+            static_cast<uint8_t>(suffix >> 16),
+            static_cast<uint8_t>(suffix >> 8),
+            static_cast<uint8_t>(suffix),
+        },
+    };
+}
+
+inline std::optional<std::string> ReadSerial(const std::filesystem::path& path) {
+    std::ifstream input(path);
+    std::string line;
+    if (!input || !std::getline(input, line)) {
+        return std::nullopt;
+    }
+    constexpr std::string_view prefix = "serial=";
+    if (line.rfind(prefix, 0) != 0) {
+        return std::nullopt;
+    }
+    std::string serial = line.substr(prefix.size());
+    if (!IsValidSerial(serial)) {
+        return std::nullopt;
+    }
+    return serial;
+}
+
+inline bool WriteSerial(const std::filesystem::path& path, const std::string& serial) {
+    std::error_code ec;
+    std::filesystem::create_directories(path.parent_path(), ec);
+    if (ec) {
+        return false;
+    }
+
+    const std::filesystem::path temporary = path.string() + ".tmp";
+    {
+        std::ofstream output(temporary, std::ios::trunc);
+        if (!output) {
+            return false;
+        }
+        output << "serial=" << serial << '\n';
+        output.close();
+        if (!output) {
+            return false;
+        }
+    }
+
+    std::filesystem::rename(temporary, path, ec);
+    if (!ec) {
+        return true;
+    }
+    std::filesystem::remove(temporary, ec);
+    return false;
+}
+
+inline std::string GenerateSerial() {
+    std::random_device entropy;
+    std::seed_seq seed{
+        entropy(),
+        entropy(),
+        entropy(),
+        entropy(),
+    };
+    std::mt19937 generator(seed);
+    std::uniform_int_distribution<uint32_t> distribution(100000000u, 999999999u);
+    return std::to_string(distribution(generator));
+}
+
+inline Identity LoadOrCreate(const std::filesystem::path& path) {
+    if (const auto serial = ReadSerial(path)) {
+        return FromSerial(*serial);
+    }
+
+    const std::string generated = GenerateSerial();
+    if (WriteSerial(path, generated)) {
+        return FromSerial(generated);
+    }
+
+    // Remain operational in a read-only environment. This fallback matches
+    // Dolphin's deterministic serial while keeping the same valid identity shape.
+    return FromSerial("123456789");
+}
+
+inline const Identity& Current() {
+    static const Identity identity =
+        LoadOrCreate(RuntimeConfigFile::ApplicationDataDirectory() / "ConsoleIdentity.txt");
+    return identity;
+}
+
+inline std::string FormatMac(const std::array<uint8_t, 6>& mac) {
+    std::ostringstream output;
+    output << std::uppercase << std::hex << std::setfill('0');
+    for (size_t index = 0; index < mac.size(); ++index) {
+        if (index != 0) {
+            output << ':';
+        }
+        output << std::setw(2) << static_cast<unsigned>(mac[index]);
+    }
+    return output.str();
+}
+
+} // namespace RuntimeConsoleIdentity
diff --git a/runtime/include/fiber_manager.h b/runtime/include/fiber_manager.h
new file mode 100644
index 0000000..dbe06d3
--- /dev/null
+++ b/runtime/include/fiber_manager.h
@@ -0,0 +1,126 @@
+#pragma once
+
+#include <atomic>
+#include <cstdint>
+#include <functional>
+#include <mutex>
+#include <thread>
+#include <unordered_map>
+
+#if defined(_WIN32)
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <windows.h>
+#endif
+
+#include "ppc_runtime.h"
+
+// Forward declarations
+struct CpuContext;
+
+// GuestFiberManager: each guest OSThread maps to a Windows Fiber. A scheduler fiber picks
+// which guest fiber runs; a real timer thread queues VI retraces at the VI cadence. Guest
+// threads only switch at explicit yield points (OSSleepThread, OSYieldThread, ...), matching
+// Wii cooperative semantics exactly.
+
+namespace Fiber {
+
+// Thread states matching guest OS
+enum class ThreadState : uint32_t {
+    READY = 1,
+    RUNNING = 2,
+    WAITING = 4,
+    MORIBUND = 8,
+};
+
+// Information about a guest fiber
+struct GuestFiber {
+    void* fiber = nullptr;              // Windows fiber handle
+    uint32_t entryPoint = 0;            // Thread entry function
+    uint32_t entryArg = 0;              // Argument to entry function
+    CpuContext cpuContext{};            // Saved CPU context for this fiber
+    ThreadState state = ThreadState::READY;
+    bool isSchedulerFiber = false;      // True for the main scheduler fiber
+    bool terminated = false;            // Thread has exited
+};
+
+class GuestFiberManager {
+public:
+    // Initialize the fiber system - must be called from main thread
+    static void Initialize();
+    
+    // Shutdown the fiber system
+    static void Shutdown();
+    
+    // Check if fiber system is initialized
+    static bool IsInitialized();
+    
+    // Create a fiber for a guest thread (called from OSCreateThread HLE).
+    // OSCreateThread's stackSize/priority are not passed: the host fiber models
+    // neither, only the guest SP seeded from stackBase. Returns true on success.
+    static bool CreateGuestFiber(uint32_t guestThreadAddr, uint32_t entryPoint,
+                                  uint32_t entryArg, uint32_t stackBase);
+    
+    // Resume a guest thread (called from OSResumeThread HLE)
+    // This marks the fiber as runnable
+    static void ResumeGuestThread(uint32_t guestThreadAddr);
+    
+    // Suspend a guest thread (called from OSSuspendThread HLE)
+    static void SuspendGuestThread(uint32_t guestThreadAddr);
+    
+    // Called when a guest thread exits or is canceled
+    static void ExitGuestThread(uint32_t guestThreadAddr, ThreadState finalState);
+    
+    // Switch to a specific guest thread's fiber (called from OSLoadContext)
+    // This saves the current fiber's state and switches to the target
+    static void SwitchToThread(uint32_t guestThreadAddr, CpuContext* cpu);
+    
+    // Get the currently running guest thread address (0 if in scheduler)
+    static uint32_t GetCurrentGuestThread();
+    
+    // Get fiber info for a guest thread (may be null)
+    static GuestFiber* GetFiber(uint32_t guestThreadAddr);
+    
+    // Check for VI retrace and process it (called from scheduler idle)
+    static void ProcessTimerEvents(CpuContext* cpu);
+    
+    // Register the current host fiber as a guest thread fiber
+    // This is used for the default/main thread that exists before OSCreateThread
+    static bool RegisterMainThreadAsFiber(uint32_t guestThreadAddr, CpuContext* cpu);
+    
+    // Check if a fiber exists for a guest thread
+    static bool HasFiber(uint32_t guestThreadAddr);
+    static bool IsTerminated(uint32_t guestThreadAddr);
+
+private:
+    // The fiber entry point wrapper
+#if defined(_WIN32)
+    static void CALLBACK FiberProc(void* param);
+#else
+    static void FiberProc(void* param);
+#endif
+    
+    // Internal state
+    static std::mutex s_mutex;
+    static std::unordered_map<uint32_t, GuestFiber> s_fibers;
+    static std::vector<void*> s_fibersPendingDelete;
+    static void* s_schedulerFiber;
+    static uint32_t s_currentGuestThread;
+    static bool s_initialized;
+    // Stored CPU context pointer for fiber switches
+    static thread_local CpuContext* s_cpuContext;
+
+    static void PurgePendingFibers();
+};
+
+// Global pending retrace count. GuestFiberManager::ProcessTimerEvents drains
+// this on the guest thread so VI callbacks still run with guest state/locking
+// expectations.
+extern std::atomic<uint32_t> g_viRetracePendingCount;
+
+} // namespace Fiber
+
diff --git a/runtime/include/game_graphics_options.h b/runtime/include/game_graphics_options.h
new file mode 100644
index 0000000..ce700c4
--- /dev/null
+++ b/runtime/include/game_graphics_options.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <atomic>
+#include <cstdint>
+
+namespace RuntimeGameGraphicsOptions {
+
+inline std::atomic<uint32_t>& DisabledPostProcessingPathsState() noexcept {
+    static std::atomic<uint32_t> disabledMask{0};
+    return disabledMask;
+}
+
+inline uint32_t DisabledPostProcessingPaths() noexcept {
+    return DisabledPostProcessingPathsState().load(std::memory_order_relaxed);
+}
+
+inline void SetDisabledPostProcessingPaths(uint32_t disabledMask) noexcept {
+    DisabledPostProcessingPathsState().store(disabledMask, std::memory_order_relaxed);
+}
+
+inline uint32_t FilterScnRendererPathMask(uint32_t pathMask) noexcept {
+    return pathMask & ~(DisabledPostProcessingPaths() | 0x20u);
+}
+
+} // namespace RuntimeGameGraphicsOptions
diff --git a/runtime/include/guest_flat_memory.h b/runtime/include/guest_flat_memory.h
new file mode 100644
index 0000000..caa71c2
--- /dev/null
+++ b/runtime/include/guest_flat_memory.h
@@ -0,0 +1,80 @@
+#pragma once
+
+// Flat 4 GiB guest address space: a guest access is just `*(T*)(kFlatGuestBase + addr)` plus a
+// byte swap, no page-table load/branch. Two views alias the same physical memory: the GUEST
+// view at kFlatGuestBase has page protections as the interception mechanism (unmapped/MMIO/
+// executable/deferred-read pages are uncommitted or protected), while the HOST view is a plain
+// alias native runtime code (image loading, DVD reads, HLE, GX) writes through unchecked.
+#include <cstddef>
+#include <cstdint>
+#include <vector>
+
+namespace GuestFlat {
+
+// Fixed base so the emitted access is `[reg + imm64-in-register]` with no load
+// of a global. 16 TiB: clear of the Windows ASan shadow (32 TiB) and of the
+// usual image/heap placement.
+inline constexpr uint64_t kGuestSpaceSize = 0x1'0000'0000ull;
+inline constexpr uintptr_t kFixedFlatGuestBase = 0x0000'1000'0000'0000ull;
+
+#define MKW_FLAT_GUEST_BASE (reinterpret_cast<uint8_t*>(GuestFlat::kFixedFlatGuestBase))
+
+enum class Backing {
+    Owned,
+    Mem1,
+    Mem2,
+};
+
+struct RegionRequest {
+    uint32_t base = 0;
+    uint64_t size = 0;
+    Backing backing = Backing::Owned;
+};
+
+struct FaultCounters {
+    uint32_t mmio = 0;      // MMIO access that reached the handler
+    uint32_t efb = 0;       // deferred (EFB) read materialized from a trap
+    uint32_t xguard = 0;    // executable-page write trap
+    uint32_t unmapped = 0;  // guest touches that landed outside every mapped region
+    uint32_t unmappedRegions = 0;  // distinct 64 KiB blocks committed on demand
+};
+
+// True once the reservation exists and translated code may use the flat path.
+bool IsActive();
+
+// Reserves the 4 GiB space (once per process) and maps every requested region
+// into both views. Throws std::runtime_error with a precise diagnosis when the
+// reservation, the section objects or a view cannot be created - a silent
+// fallback would let translated code read from an unmapped constant base.
+void Initialize(const std::vector<RegionRequest>& regions);
+
+// Host-view pointer for a mapped guest address, or nullptr when the address is
+// outside every mapped region. This is what the page table and
+// Memory::GetPointer hand out.
+uint8_t* HostPointer(uint32_t guestAddress);
+
+// Deferred (EFB) reads: the covered guest pages are made PAGE_NOACCESS in the
+// guest view so a flat read traps and materializes the copy.
+void ProtectDeferredRange(uint32_t address, size_t length);
+void UnprotectDeferredRange(uint32_t address, size_t length);
+
+// Executable-write guard: pages fully covered by a registered executable range
+// become PAGE_READONLY in the guest view. Registration order does not matter -
+// ranges registered before the mapping exists are re-applied by Initialize.
+void RegisterExecutableRange(uint32_t start, uint32_t end);
+
+FaultCounters Counters();
+
+// End-of-run report for the counters above. An unmapped touch is a wild guest
+// pointer whose block this module silently committed so execution could go on,
+// which makes it invisible unless it is repeated at shutdown; a nonzero count
+// is therefore reported as a warning. Idempotent, so every exit path (normal
+// return, caught exception, abort handler) may call it.
+void LogFaultSummary() noexcept;
+
+// Returns true when the access violation was a guest-space fault this module
+// resolved; the caller must then resume execution. `exceptionPointers` is a
+// Windows EXCEPTION_POINTERS*.
+bool HandleAccessViolation(void* exceptionPointers) noexcept;
+
+} // namespace GuestFlat
diff --git a/runtime/include/guest_interrupt_context.h b/runtime/include/guest_interrupt_context.h
new file mode 100644
index 0000000..51e405d
--- /dev/null
+++ b/runtime/include/guest_interrupt_context.h
@@ -0,0 +1,32 @@
+#pragma once
+
+#include "abi_bridge.h"
+#include "ppc_runtime.h"
+
+// Deferred HLE dispatch (VRetrace/alarm callbacks) runs mid-function on an arbitrary translated
+// caller; using its live CpuContext would let callback exit state clobber resident locals (once
+// wild-read a resident r29 via postVRetrace). This models hardware save/restore: callbacks run on
+// a private copy seeded from the interrupted r1/r2/r13/FP mode, made ambient via CpuContextScope.
+class GuestInterruptCallbackContext {
+public:
+    GuestInterruptCallbackContext()
+        : registers_(InterruptedRegisters()), scope_(&registers_) {}
+
+    GuestInterruptCallbackContext(const GuestInterruptCallbackContext&) = delete;
+    GuestInterruptCallbackContext& operator=(const GuestInterruptCallbackContext&) = delete;
+
+    CpuContext* get() noexcept { return &registers_; }
+
+private:
+    static CpuContext InterruptedRegisters() {
+        // The ambient context is the interrupted guest thread's file. Without
+        // one (host frame loop between fibers) the persistent context is the
+        // only meaningful seed for r1/r2/r13.
+        const CpuContext* interrupted = TryGetCpuContext();
+        return interrupted != nullptr ? *interrupted : GetPersistentCpuContext();
+    }
+
+    CpuContext registers_;
+    CpuContextScope scope_;
+};
+
diff --git a/runtime/include/gx_guest_write.h b/runtime/include/gx_guest_write.h
new file mode 100644
index 0000000..f12c21f
--- /dev/null
+++ b/runtime/include/gx_guest_write.h
@@ -0,0 +1,135 @@
+#pragma once
+
+// Per-granule write-generation counters let GX cache consumers skip re-digesting unchanged
+// ranges. Assumes GPU visibility only happens via DCStoreRange/DCFlushRange/DCInvalidateRange,
+// so hooking those plus DMA writers is a complete notification. Header-only: hot, must not
+// link-depend on the GX HLE.
+
+#include "memory.h"
+
+#include <array>
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+
+// Canonical MEM1/MEM2 physical address for any of the guest's cached, uncached
+// or physical aliases. Lives here rather than in the GX HLE so the tracking
+// table, its notifiers and the GX caches all agree on one address space.
+inline uint32_t CanonicalizeGxMainRamAddress(uint32_t addr) noexcept {
+    if (addr < 0x01800000u) {
+        return addr;
+    }
+    if (addr >= Memory::kMem2PhysicalBase && addr < Memory::kMem2PhysicalEnd) {
+        return addr;
+    }
+    if (addr >= 0x80000000u && addr < 0x81800000u) {
+        return addr - 0x80000000u;
+    }
+    if (addr >= Memory::kMem2CachedBase && addr < Memory::kMem2CachedEnd) {
+        return addr - 0x80000000u;
+    }
+    if (addr >= 0xC0000000u && addr < 0xC1800000u) {
+        return addr - 0xC0000000u;
+    }
+    if (addr >= Memory::kMem2UncachedBase && addr < Memory::kMem2UncachedEnd) {
+        return addr - 0xC0000000u;
+    }
+    return addr;
+}
+
+namespace GxGuestWrite {
+
+// Granularity matches the GX resource caches' occupancy maps: 64 KiB, so a
+// cacheable display list or texture spans only a handful of counters. A false
+// bump only costs one re-digest, which is exactly the untracked behaviour.
+inline constexpr uint32_t kGranuleShift = 16; // 64 KiB per granule
+inline constexpr uint64_t kTrackedSpan = static_cast<uint64_t>(Memory::kMem2PhysicalEnd);
+inline constexpr size_t kGranuleCount = static_cast<size_t>(kTrackedSpan >> kGranuleShift);
+
+// Folded value used for "this range is not covered by the granule map", which
+// forces the consumer to recompute its digest on every call.
+inline constexpr uint64_t kUntracked = ~0ull;
+
+// Shared (not thread_local) because notifications come from the OS HLE and from
+// aurora's readback callbacks while the caches themselves are per guest thread;
+// relaxed ordering is enough, every access is a plain load or a lock-xadd on
+// x86 and a missed-by-a-hair ordering only delays a re-digest by one call.
+inline std::array<std::atomic<uint32_t>, kGranuleCount> g_generations{};
+
+// Monotone fold of every granule counter covering [addr, addr + nbytes).
+// Counters only ever increase, so the sum changes whenever any covered granule
+// is bumped and can never alias back to a previously observed value.
+inline uint64_t GenerationForRange(uint32_t addr, uint32_t nbytes) noexcept {
+    if (nbytes == 0) {
+        return kUntracked;
+    }
+    const uint64_t start = static_cast<uint64_t>(CanonicalizeGxMainRamAddress(addr));
+    const uint64_t end = start + static_cast<uint64_t>(nbytes);
+    if (end <= start || end > kTrackedSpan) {
+        return kUntracked;
+    }
+    const size_t firstGranule = static_cast<size_t>(start >> kGranuleShift);
+    const size_t lastGranule = static_cast<size_t>((end - 1) >> kGranuleShift);
+    uint64_t folded = 0;
+    for (size_t granule = firstGranule; granule <= lastGranule; ++granule) {
+        folded += g_generations[granule].load(std::memory_order_relaxed);
+    }
+    // Never collide with the "untracked" sentinel.
+    return folded == kUntracked ? folded - 1u : folded;
+}
+
+// Bumps every granule covering [addr, addr + size). Deliberately branch-light:
+// this runs on every DC range op, including the ones that only ever touch
+// memory no GX cache has ever looked at.
+inline void NotifyWrite(uint32_t addr, uint32_t size) noexcept {
+    if (size == 0) {
+        return;
+    }
+    const uint64_t start = static_cast<uint64_t>(CanonicalizeGxMainRamAddress(addr));
+    const uint64_t end = start + static_cast<uint64_t>(size);
+    if (end <= start || start >= kTrackedSpan) {
+        return;
+    }
+    const uint64_t clampedEnd = end < kTrackedSpan ? end : kTrackedSpan;
+    const size_t firstGranule = static_cast<size_t>(start >> kGranuleShift);
+    const size_t lastGranule = static_cast<size_t>((clampedEnd - 1) >> kGranuleShift);
+    for (size_t granule = firstGranule; granule <= lastGranule; ++granule) {
+        g_generations[granule].fetch_add(1u, std::memory_order_relaxed);
+    }
+}
+
+// The skip contract shared by every consumer: a stored digest may be trusted
+// only when the range is tracked at all and no notification has landed on it
+// since the digest was taken.
+inline bool CanSkipDigest(uint64_t storedGeneration, uint64_t currentGeneration) noexcept {
+    return currentGeneration != kUntracked && storedGeneration == currentGeneration;
+}
+
+// Host-to-guest inversion for one contiguous guest RAM alias. Aurora holds host
+// pointers only, so the generation and notification hooks it calls have to map
+// them back before they can touch the table.
+inline bool HostRangeToGuest(const void* hostBase, uint64_t hostSize, uint32_t guestBase,
+                             const void* hostPtr, size_t size, uint32_t& outAddr) noexcept {
+    if (hostBase == nullptr || hostPtr == nullptr || size == 0) {
+        return false;
+    }
+    const uintptr_t base = reinterpret_cast<uintptr_t>(hostBase);
+    const uintptr_t ptr = reinterpret_cast<uintptr_t>(hostPtr);
+    if (ptr < base) {
+        return false;
+    }
+    const uint64_t offset = static_cast<uint64_t>(ptr - base);
+    if (offset >= hostSize || static_cast<uint64_t>(size) > hostSize - offset) {
+        return false;
+    }
+    outAddr = guestBase + static_cast<uint32_t>(offset);
+    return true;
+}
+
+// Installs the generation/notification hooks into aurora. Called once after
+// aurora_initialize; until then (and if guest RAM cannot be resolved) aurora
+// digests its source bytes on every validation, which is the old behaviour.
+// Defined in gx_guest_write_hooks.cpp.
+void InstallAuroraHooks();
+
+} // namespace GxGuestWrite
diff --git a/runtime/include/hle/controller_status_contract.h b/runtime/include/hle/controller_status_contract.h
new file mode 100644
index 0000000..e948e10
--- /dev/null
+++ b/runtime/include/hle/controller_status_contract.h
@@ -0,0 +1,82 @@
+#pragma once
+
+#include "isa/big_endian.h"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+
+namespace PadStatusContract {
+
+inline constexpr std::size_t kGuestStatusSize = 0x0C;
+using GuestStatus = std::array<uint8_t, kGuestStatusSize>;
+
+struct Fields {
+    uint16_t buttons = 0;
+    int8_t stickX = 0;
+    int8_t stickY = 0;
+    int8_t substickX = 0;
+    int8_t substickY = 0;
+    uint8_t triggerLeft = 0;
+    uint8_t triggerRight = 0;
+    uint8_t analogA = 0;
+    uint8_t analogB = 0;
+    int8_t error = 0;
+};
+
+inline GuestStatus Encode(const Fields& fields)
+{
+    GuestStatus status{};
+    BigEndian::Write16(status.data(), fields.buttons);
+    status[0x02] = static_cast<uint8_t>(fields.stickX);
+    status[0x03] = static_cast<uint8_t>(fields.stickY);
+    status[0x04] = static_cast<uint8_t>(fields.substickX);
+    status[0x05] = static_cast<uint8_t>(fields.substickY);
+    status[0x06] = fields.triggerLeft;
+    status[0x07] = fields.triggerRight;
+    status[0x08] = fields.analogA;
+    status[0x09] = fields.analogB;
+    status[0x0A] = static_cast<uint8_t>(fields.error);
+    return status;
+}
+
+} // namespace PadStatusContract
+
+namespace WpadContract {
+
+inline constexpr std::size_t kChannelCount = 4;
+inline constexpr int32_t kStatusDisabled = 0;
+inline constexpr int32_t kStatusReady = 3;
+inline constexpr int32_t kErrorNoController = -1;
+inline constexpr int32_t kErrorNotReady = -2;
+inline constexpr int32_t kErrorBadChannel = -6;
+inline constexpr int32_t kExtensionCore = 0;
+
+class State {
+public:
+    void Initialize() { m_initialized = true; }
+    bool IsInitialized() const { return m_initialized; }
+    int32_t GetLibraryStatus() const { return m_initialized ? kStatusReady : kStatusDisabled; }
+
+    int32_t GetDataFormat(uint32_t chan) const
+    {
+        if (chan >= kChannelCount) {
+            return kErrorBadChannel;
+        }
+        return m_initialized ? 0 : kErrorNotReady;
+    }
+
+    int32_t SetDataFormat(uint32_t chan, int32_t format) const
+    {
+        (void)format;
+        if (chan >= kChannelCount) {
+            return kErrorBadChannel;
+        }
+        return m_initialized ? kErrorNoController : kErrorNotReady;
+    }
+
+private:
+    bool m_initialized = false;
+};
+
+} // namespace WpadContract
diff --git a/runtime/include/hle/dvd_contract.h b/runtime/include/hle/dvd_contract.h
new file mode 100644
index 0000000..f9832a8
--- /dev/null
+++ b/runtime/include/hle/dvd_contract.h
@@ -0,0 +1,338 @@
+#pragma once
+
+#include "isa/big_endian.h"
+
+#include <algorithm>
+#include <cctype>
+#include <cstddef>
+#include <cstdint>
+#include <filesystem>
+#include <fstream>
+#include <limits>
+#include <map>
+#include <memory>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace DvdFstContract {
+
+struct RegisteredFile {
+    std::string hostPath;
+    std::string dvdPath;
+    uint32_t size = 0;
+    uint32_t discOffsetWords = 0;
+};
+
+struct IndexedEntry {
+    std::string hostPath;
+    std::string dvdPath;
+    uint32_t size = 0;
+    uint32_t discOffsetWords = 0;
+    uint32_t parentIndex = 0;
+    uint32_t subtreeEnd = 0;
+    bool isDirectory = false;
+};
+
+struct Image {
+    std::vector<IndexedEntry> entries;
+    std::map<std::string, int32_t> pathToEntry;
+    std::vector<uint8_t> bytes;
+};
+
+struct GuestPlacement {
+    uint32_t address = 0;
+    uint32_t reservedArenaHi = 0;
+};
+
+inline std::string CanonicalizePath(const std::string& input) {
+    std::string path = input;
+    std::replace(path.begin(), path.end(), '\\', '/');
+
+    std::vector<std::string> components;
+    size_t cursor = 0;
+    while (cursor < path.size()) {
+        while (cursor < path.size() && path[cursor] == '/') {
+            ++cursor;
+        }
+        const size_t start = cursor;
+        while (cursor < path.size() && path[cursor] != '/') {
+            ++cursor;
+        }
+        if (start == cursor) {
+            continue;
+        }
+
+        std::string component = path.substr(start, cursor - start);
+        if (component == ".") {
+            continue;
+        }
+        if (component == "..") {
+            if (!components.empty()) {
+                components.pop_back();
+            }
+            continue;
+        }
+        components.push_back(std::move(component));
+    }
+
+    std::string canonical = "/";
+    for (size_t i = 0; i < components.size(); ++i) {
+        if (i != 0) {
+            canonical.push_back('/');
+        }
+        canonical += components[i];
+    }
+    return canonical;
+}
+
+inline std::string NormalizeLookupPath(const std::string& input) {
+    std::string path = CanonicalizePath(input);
+    std::transform(path.begin(), path.end(), path.begin(), [](unsigned char ch) {
+        return static_cast<char>(std::tolower(ch));
+    });
+    return path;
+}
+
+namespace Detail {
+
+struct TreeNode {
+    std::string name;
+    std::map<std::string, std::unique_ptr<TreeNode>> children;
+    std::optional<RegisteredFile> file;
+};
+
+inline std::vector<std::string> Components(const std::string& canonicalPath) {
+    std::vector<std::string> result;
+    size_t cursor = canonicalPath == "/" ? canonicalPath.size() : 1;
+    while (cursor < canonicalPath.size()) {
+        const size_t slash = canonicalPath.find('/', cursor);
+        const size_t end = slash == std::string::npos ? canonicalPath.size() : slash;
+        result.push_back(canonicalPath.substr(cursor, end - cursor));
+        cursor = end + 1;
+    }
+    return result;
+}
+
+inline std::string Lowercase(std::string value) {
+    std::transform(value.begin(), value.end(), value.begin(), [](unsigned char ch) {
+        return static_cast<char>(std::tolower(ch));
+    });
+    return value;
+}
+
+inline uint32_t EmitTree(const TreeNode& directory,
+                         uint32_t directoryIndex,
+                         const std::string& directoryPath,
+                         Image& image,
+                         std::vector<std::string>& names) {
+    for (const auto& [lookupName, childPointer] : directory.children) {
+        (void)lookupName;
+        const TreeNode& child = *childPointer;
+        const std::string childPath = directoryPath == "/"
+            ? "/" + child.name
+            : directoryPath + "/" + child.name;
+        const uint32_t index = static_cast<uint32_t>(image.entries.size());
+
+        if (!child.children.empty()) {
+            if (child.file.has_value()) {
+                throw std::runtime_error("DVD FST path is both a file and a directory: " + childPath);
+            }
+            image.entries.push_back({{}, childPath, 0, 0, directoryIndex, 0, true});
+            names.push_back(child.name);
+            image.pathToEntry.emplace(NormalizeLookupPath(childPath), static_cast<int32_t>(index));
+            image.entries[index].subtreeEnd = EmitTree(child, index, childPath, image, names);
+            continue;
+        }
+
+        if (!child.file.has_value()) {
+            throw std::runtime_error("DVD FST contains an empty implicit node: " + childPath);
+        }
+        const RegisteredFile& file = *child.file;
+        image.entries.push_back({file.hostPath, childPath, file.size, file.discOffsetWords,
+                                 directoryIndex, index + 1, false});
+        names.push_back(child.name);
+        image.pathToEntry.emplace(NormalizeLookupPath(childPath), static_cast<int32_t>(index));
+    }
+    return static_cast<uint32_t>(image.entries.size());
+}
+
+} // namespace Detail
+
+inline Image BuildImage(const std::vector<RegisteredFile>& registrations) {
+    // Overlay scanning deliberately registers later mappings last. Collapse those
+    // mappings before assigning FST indices so one guest path has one stable entry.
+    std::map<std::string, RegisteredFile> filesByPath;
+    for (RegisteredFile file : registrations) {
+        file.dvdPath = CanonicalizePath(file.dvdPath);
+        if (file.dvdPath == "/") {
+            throw std::runtime_error("DVD FST cannot register the root as a file");
+        }
+        filesByPath[NormalizeLookupPath(file.dvdPath)] = std::move(file);
+    }
+
+    Detail::TreeNode root;
+    for (const auto& [lookupPath, file] : filesByPath) {
+        (void)lookupPath;
+        Detail::TreeNode* node = &root;
+        const std::vector<std::string> components = Detail::Components(file.dvdPath);
+        for (const std::string& component : components) {
+            const std::string key = Detail::Lowercase(component);
+            auto& child = node->children[key];
+            if (!child) {
+                child = std::make_unique<Detail::TreeNode>();
+                child->name = component;
+            }
+            node = child.get();
+        }
+        node->name = components.back();
+        node->file = file;
+    }
+
+    Image image;
+    image.entries.push_back({{}, "/", 0, 0, 0, 0, true});
+    image.pathToEntry.emplace("/", 0);
+    std::vector<std::string> names(1);
+    image.entries[0].subtreeEnd = Detail::EmitTree(root, 0, "/", image, names);
+
+    if (image.entries.size() > std::numeric_limits<uint32_t>::max() / 12u) {
+        throw std::runtime_error("DVD FST contains too many entries");
+    }
+
+    const size_t entriesSize = image.entries.size() * 12u;
+    std::vector<uint8_t> stringTable(1, 0);
+    std::vector<uint32_t> nameOffsets(image.entries.size(), 0);
+    for (size_t i = 1; i < names.size(); ++i) {
+        if (stringTable.size() > 0x00FFFFFFu) {
+            throw std::runtime_error("DVD FST name table exceeds the Wii 24-bit offset limit");
+        }
+        nameOffsets[i] = static_cast<uint32_t>(stringTable.size());
+        stringTable.insert(stringTable.end(), names[i].begin(), names[i].end());
+        stringTable.push_back(0);
+    }
+
+    image.bytes.assign(entriesSize + stringTable.size(), 0);
+    for (size_t i = 0; i < image.entries.size(); ++i) {
+        const IndexedEntry& entry = image.entries[i];
+        const uint32_t typeAndName = (entry.isDirectory ? 0x01000000u : 0u) | nameOffsets[i];
+        const uint32_t word1 = entry.isDirectory ? entry.parentIndex : entry.discOffsetWords;
+        const uint32_t word2 = entry.isDirectory ? entry.subtreeEnd : entry.size;
+        BigEndian::Write32(image.bytes.data(), i * 12u + 0u, typeAndName);
+        BigEndian::Write32(image.bytes.data(), i * 12u + 4u, word1);
+        BigEndian::Write32(image.bytes.data(), i * 12u + 8u, word2);
+    }
+    std::copy(stringTable.begin(), stringTable.end(), image.bytes.begin() + entriesSize);
+    return image;
+}
+
+inline std::optional<GuestPlacement> ReserveBelowArena(uint32_t arenaLo,
+                                                        uint32_t arenaHi,
+                                                        size_t byteCount) {
+    constexpr uint32_t kAlignment = 32;
+    if (byteCount == 0 || byteCount > std::numeric_limits<uint32_t>::max() || arenaHi <= arenaLo) {
+        return std::nullopt;
+    }
+    const uint32_t size = static_cast<uint32_t>(byteCount);
+    if (size > arenaHi - arenaLo) {
+        return std::nullopt;
+    }
+    const uint32_t unaligned = arenaHi - size;
+    const uint32_t address = unaligned & ~(kAlignment - 1u);
+    if (address < arenaLo || static_cast<uint64_t>(address) + size > arenaHi) {
+        return std::nullopt;
+    }
+    return GuestPlacement{address, address};
+}
+
+} // namespace DvdFstContract
+
+namespace DvdReadContract {
+
+inline constexpr int32_t kInterruptTransferComplete = 1;
+inline constexpr int32_t kInterruptDriveError = 2;
+
+struct LowReadCompletion {
+    int32_t returnValue;
+    int32_t callbackResult;
+};
+
+inline constexpr LowReadCompletion CompletionFor(bool succeeded) noexcept {
+    return succeeded ? LowReadCompletion{1, kInterruptTransferComplete}
+                     : LowReadCompletion{0, kInterruptDriveError};
+}
+
+enum class HostReadFailure : uint8_t {
+    None,
+    MissingFile,
+    BadOffset,
+    ShortRead,
+};
+
+inline constexpr const char* Describe(HostReadFailure failure) noexcept {
+    switch (failure) {
+    case HostReadFailure::None:
+        return "no error";
+    case HostReadFailure::MissingFile:
+        return "host file is missing or cannot be opened";
+    case HostReadFailure::BadOffset:
+        return "read offset is outside the host file";
+    case HostReadFailure::ShortRead:
+        return "host file did not contain the complete requested range";
+    }
+    return "unknown host read error";
+}
+
+// Read into private storage first and publish it only after the complete host
+// range has been obtained. Callers can therefore leave a guest DMA destination
+// untouched for every failure, including a host file truncated after indexing.
+inline bool ReadExact(const std::filesystem::path& hostPath,
+                      uint64_t offset,
+                      uint32_t length,
+                      std::vector<uint8_t>& destination,
+                      HostReadFailure& failure) {
+    failure = HostReadFailure::None;
+
+    std::ifstream file(hostPath, std::ios::binary);
+    if (!file.is_open()) {
+        failure = HostReadFailure::MissingFile;
+        return false;
+    }
+
+    file.seekg(0, std::ios::end);
+    const std::streamoff fileSize = file.tellg();
+    if (fileSize < 0 ||
+        offset > static_cast<uint64_t>(std::numeric_limits<std::streamoff>::max()) ||
+        offset >= static_cast<uint64_t>(fileSize)) {
+        failure = HostReadFailure::BadOffset;
+        return false;
+    }
+
+    const uint64_t remaining = static_cast<uint64_t>(fileSize) - offset;
+    if (static_cast<uint64_t>(length) > remaining) {
+        failure = HostReadFailure::ShortRead;
+        return false;
+    }
+
+    std::vector<uint8_t> staged(length);
+    file.seekg(static_cast<std::streamoff>(offset), std::ios::beg);
+    if (!file) {
+        failure = HostReadFailure::BadOffset;
+        return false;
+    }
+
+    if (length != 0) {
+        file.read(reinterpret_cast<char*>(staged.data()),
+                  static_cast<std::streamsize>(length));
+        if (file.gcount() != static_cast<std::streamsize>(length)) {
+            failure = HostReadFailure::ShortRead;
+            return false;
+        }
+    }
+
+    destination = std::move(staged);
+    return true;
+}
+
+} // namespace DvdReadContract
diff --git a/runtime/include/hle/network_deferred_contract.h b/runtime/include/hle/network_deferred_contract.h
new file mode 100644
index 0000000..13f7609
--- /dev/null
+++ b/runtime/include/hle/network_deferred_contract.h
@@ -0,0 +1,199 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <exception>
+#include <memory>
+#include <optional>
+#include <utility>
+
+namespace NetworkDeferredContract {
+
+enum class PreparationState : uint8_t {
+  NotApplicable,
+  Ready,
+  Error,
+};
+
+// A recognized operation must not be represented by an empty optional: doing
+// so makes malformed input and resource failures indistinguishable from an
+// unrelated ioctl and lets the caller fall through to a blocking fallback.
+template <typename Work> class Preparation {
+public:
+  static Preparation NotApplicable() {
+    return Preparation(PreparationState::NotApplicable, 0, std::nullopt);
+  }
+
+  static Preparation Ready(Work work, int32_t failureResult) {
+    return Preparation(PreparationState::Ready, failureResult,
+                       std::optional<Work>(std::move(work)));
+  }
+
+  static Preparation Error(int32_t result) {
+    return Preparation(PreparationState::Error, result, std::nullopt);
+  }
+
+  PreparationState State() const noexcept { return state_; }
+  int32_t FailureResult() const noexcept { return failureResult_; }
+
+  Work &&TakeWork() && { return std::move(*work_); }
+
+private:
+  Preparation(PreparationState state, int32_t failureResult,
+              std::optional<Work> work)
+      : state_(state), failureResult_(failureResult), work_(std::move(work)) {}
+
+  PreparationState state_ = PreparationState::NotApplicable;
+  int32_t failureResult_ = 0;
+  std::optional<Work> work_;
+};
+
+enum class StartDisposition : uint8_t {
+  NotApplicable,
+  Started,
+  ImmediateResult,
+};
+
+struct StartOutcome {
+  StartDisposition disposition = StartDisposition::NotApplicable;
+  int32_t result = 0;
+  uint64_t token = 0;
+
+  static constexpr StartOutcome NotApplicable() noexcept { return {}; }
+
+  static constexpr StartOutcome Started(uint64_t token) noexcept {
+    return {StartDisposition::Started, 0, token};
+  }
+
+  static constexpr StartOutcome Immediate(int32_t result) noexcept {
+    return {StartDisposition::ImmediateResult, result, 0};
+  }
+};
+
+// Launcher returns a token when the operation is fully installed. Token zero
+// is valid for an asynchronous route because only synchronous callers consume
+// it. A launcher failure or exception becomes the operation-specific immediate
+// error; it can never be reinterpreted as "not applicable".
+template <typename Work, typename Launcher>
+StartOutcome StartPrepared(Preparation<Work> &&preparation,
+                           Launcher &&launcher) {
+  const PreparationState state = preparation.State();
+  const int32_t failureResult = preparation.FailureResult();
+  if (state == PreparationState::NotApplicable) {
+    return StartOutcome::NotApplicable();
+  }
+  if (state == PreparationState::Error) {
+    return StartOutcome::Immediate(failureResult);
+  }
+
+  try {
+    const std::optional<uint64_t> token =
+        std::forward<Launcher>(launcher)(std::move(preparation).TakeWork());
+    return token ? StartOutcome::Started(*token)
+                 : StartOutcome::Immediate(failureResult);
+  } catch (...) {
+    return StartOutcome::Immediate(failureResult);
+  }
+}
+
+// Keep an untouched copy of the host-only work value until resolution and
+// completion publication both succeed. Any worker-side exception is converted
+// into one failure-publication attempt instead of escaping the thread entry and
+// terminating the process.
+template <typename Work, typename Resolver, typename Publish,
+          typename PublishFailure>
+void RunWorker(Work work, Resolver &&resolver, Publish &&publish,
+               PublishFailure &&publishFailure) noexcept {
+  try {
+    auto completion = std::forward<Resolver>(resolver)(work);
+    std::forward<Publish>(publish)(std::move(completion));
+  } catch (...) {
+    const std::exception_ptr error = std::current_exception();
+    try {
+      std::forward<PublishFailure>(publishFailure)(std::move(work), error);
+    } catch (...) {
+      // There is no safe blocking fallback from a detached worker. The
+      // production failure publisher logs if its completion queue cannot
+      // accept the already-normalized failure.
+    }
+  }
+}
+
+template <typename Worker, typename OnDetachFailure>
+Worker *DetachOrRelease(std::unique_ptr<Worker> worker,
+                        OnDetachFailure &&onDetachFailure) noexcept {
+  if (!worker) {
+    return nullptr;
+  }
+
+  try {
+    worker->detach();
+    return nullptr;
+  } catch (...) {
+    const std::exception_ptr error = std::current_exception();
+    Worker *const runningWorker = worker.release();
+    try {
+      std::forward<OnDetachFailure>(onDetachFailure)(error);
+    } catch (...) {
+      // Diagnostics must not turn containment of a running worker into a
+      // second failure path.
+    }
+    return runningWorker;
+  }
+}
+
+// IOS encodes an IPv4 sockaddr as a two-byte length/family header followed by
+// sockaddr::sa_data. Advertising any larger ai_addrlen would expose bytes that
+// were never copied into the guest result.
+inline constexpr size_t kWiiSockAddrHeaderBytes = 2;
+inline constexpr size_t kWiiSockAddrPayloadBytes = 14;
+inline constexpr size_t kWiiIpv4SockAddrBytes =
+    kWiiSockAddrHeaderBytes + kWiiSockAddrPayloadBytes;
+
+inline constexpr bool CanCopyIpv4SockAddr(int nativeFamily, size_t nativeLength,
+                                          int nativeIpv4Family) noexcept {
+  return nativeFamily == nativeIpv4Family &&
+         nativeLength >= kWiiIpv4SockAddrBytes;
+}
+
+inline constexpr bool
+AdvertisedSockAddrFits(uint32_t advertisedLength) noexcept {
+  return advertisedLength <= kWiiIpv4SockAddrBytes;
+}
+
+} // namespace NetworkDeferredContract
+
+namespace NetworkConnectContract {
+
+// IOS presents a blocking socket to the guest while the retained host socket
+// stays nonblocking. A blocking guest connect therefore waits on the guest
+// OSThread, never inside WSAPoll/poll on the emulation scheduler thread.
+inline constexpr int64_t kGuestBlockingTimeoutMilliseconds = 10000;
+
+enum class ProbeDisposition : uint8_t {
+    StaleSocket,
+    PollError,
+    SocketReady,
+    TimedOut,
+    Pending,
+};
+
+// Keep the ordering explicit: fd reuse invalidates the operation before any
+// host syscall, readiness wins at the deadline, and only a zero-result probe
+// may remain pending or time out.
+inline constexpr ProbeDisposition ClassifyProbe(
+    bool socketIdentityIsCurrent, int pollResult, bool deadlineExpired) noexcept {
+    if (!socketIdentityIsCurrent) {
+        return ProbeDisposition::StaleSocket;
+    }
+    if (pollResult < 0) {
+        return ProbeDisposition::PollError;
+    }
+    if (pollResult > 0) {
+        return ProbeDisposition::SocketReady;
+    }
+    return deadlineExpired ? ProbeDisposition::TimedOut
+                           : ProbeDisposition::Pending;
+}
+
+} // namespace NetworkConnectContract
diff --git a/runtime/include/hle/network_poll_contract.h b/runtime/include/hle/network_poll_contract.h
new file mode 100644
index 0000000..143bafb
--- /dev/null
+++ b/runtime/include/hle/network_poll_contract.h
@@ -0,0 +1,161 @@
+#pragma once
+
+#include <array>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <vector>
+
+#ifdef _WIN32
+#include <winsock2.h>
+#else
+#include <poll.h>
+#include <sys/socket.h>
+#endif
+
+namespace NetworkPollContract {
+
+constexpr size_t kMaxDescriptors = 24;
+
+#ifdef _WIN32
+using NativeSocket = SOCKET;
+using NativePollFd = WSAPOLLFD;
+constexpr NativeSocket kInvalidSocket = INVALID_SOCKET;
+#else
+using NativeSocket = int;
+using NativePollFd = pollfd;
+constexpr NativeSocket kInvalidSocket = -1;
+#endif
+
+struct CopiedDescriptor {
+    uint32_t wiiFd = 0;
+    NativeSocket nativeFd = kInvalidSocket;
+    uint64_t socketGeneration = 0;
+    short events = 0;
+    short revents = 0;
+};
+
+// A zero-timeout SO_POLL is a pure readiness probe. Running it directly on
+// the emulation thread is safe because ProbeNow always passes timeout zero to
+// the host API; putting the guest IOS caller to sleep until the next scheduler
+// pump only adds a needless context switch to every GameSpy update tick.
+inline bool RequiresSchedulerWait(int64_t timeoutMilliseconds) {
+    return timeoutMilliseconds != 0;
+}
+
+inline short WiiEventsToNative(uint32_t events) {
+    int native = 0;
+    if (events & 0x0001u) native |= POLLRDNORM;
+    if (events & 0x0002u) native |= POLLRDBAND;
+    if (events & 0x0004u) native |= POLLPRI;
+    if (events & 0x0008u) native |= POLLWRNORM;
+    if (events & 0x0010u) native |= POLLWRBAND;
+
+    // ERR/HUP/NVAL are return-only. Winsock's WSAPoll also rejects the
+    // priority and write-band inputs which Dolphin masks on Windows.
+    native &= ~(POLLERR | POLLHUP | POLLNVAL);
+#ifdef _WIN32
+    native &= ~(POLLPRI | POLLWRBAND);
+#endif
+    return static_cast<short>(native);
+}
+
+inline uint32_t NativeEventsToWii(short events) {
+    uint32_t wii = 0;
+    if (events & POLLRDNORM) wii |= 0x0001u;
+    if (events & POLLRDBAND) wii |= 0x0002u;
+    if (events & POLLPRI) wii |= 0x0004u;
+    if (events & POLLWRNORM) wii |= 0x0008u;
+    if (events & POLLWRBAND) wii |= 0x0010u;
+    if (events & POLLERR) wii |= 0x0020u;
+    if (events & POLLHUP) wii |= 0x0040u;
+    if (events & POLLNVAL) wii |= 0x0080u;
+    return wii;
+}
+
+class Timeout {
+public:
+    using Clock = std::chrono::steady_clock;
+    using TimePoint = Clock::time_point;
+
+    static Timeout FromMilliseconds(int64_t milliseconds, TimePoint now = Clock::now()) {
+        Timeout timeout;
+        if (milliseconds < 0) {
+            timeout.m_infinite = true;
+            timeout.m_deadline = TimePoint::max();
+            return timeout;
+        }
+
+        using Milliseconds = std::chrono::milliseconds;
+        const int64_t maximum = std::chrono::duration_cast<Milliseconds>(TimePoint::max() - now).count();
+        timeout.m_deadline = milliseconds >= maximum
+            ? TimePoint::max()
+            : now + Milliseconds(milliseconds);
+        return timeout;
+    }
+
+    bool IsExpired(TimePoint now = Clock::now()) const {
+        return !m_infinite && now >= m_deadline;
+    }
+
+    bool ShouldRemainPending(int nativeResult, TimePoint now = Clock::now()) const {
+        return nativeResult == 0 && !IsExpired(now);
+    }
+
+    bool IsInfinite() const { return m_infinite; }
+    TimePoint Deadline() const { return m_deadline; }
+
+private:
+    bool m_infinite = false;
+    TimePoint m_deadline{};
+};
+
+// Probes only descriptors whose copied socket identity is still live. A dead identity
+// (SOClose/SOCleanup/slot reuse) reports POLLNVAL and counts toward readiness like IOS/Dolphin;
+// skipping it silently would return 0 forever and strand an infinite-timeout SO_POLL parked
+// during socket teardown mid-WFC-connect.
+template <typename IsStillValid>
+int ProbeNow(std::vector<CopiedDescriptor>& descriptors, IsStillValid&& isStillValid) {
+    if (descriptors.size() > kMaxDescriptors) {
+        return -1;
+    }
+
+    std::array<NativePollFd, kMaxDescriptors> active{};
+    std::array<size_t, kMaxDescriptors> originalIndices{};
+    size_t activeCount = 0;
+    int invalidCount = 0;
+    for (size_t i = 0; i < descriptors.size(); ++i) {
+        CopiedDescriptor& descriptor = descriptors[i];
+        descriptor.revents = 0;
+        if (!isStillValid(descriptor)) {
+            descriptor.revents = POLLNVAL;
+            ++invalidCount;
+            continue;
+        }
+        active[activeCount].fd = descriptor.nativeFd;
+        active[activeCount].events = descriptor.events;
+        active[activeCount].revents = 0;
+        originalIndices[activeCount] = i;
+        ++activeCount;
+    }
+
+    if (activeCount == 0) {
+        return invalidCount;
+    }
+
+#ifdef _WIN32
+    const int result = WSAPoll(active.data(), static_cast<ULONG>(activeCount), 0);
+#else
+    const int result = poll(active.data(), activeCount, 0);
+#endif
+    if (result >= 0) {
+        for (size_t i = 0; i < activeCount; ++i) {
+            descriptors[originalIndices[i]].revents = active[i].revents;
+        }
+        return result + invalidCount;
+    }
+    return invalidCount > 0 ? invalidCount : result;
+}
+
+} // namespace NetworkPollContract
diff --git a/runtime/include/hle/riivolution_contract.h b/runtime/include/hle/riivolution_contract.h
new file mode 100644
index 0000000..3839cbf
--- /dev/null
+++ b/runtime/include/hle/riivolution_contract.h
@@ -0,0 +1,692 @@
+// Riivolution patch-XML parsing and patch selection.
+//
+// Ported from Dolphin Emulator's DiscIO/RiivolutionParser.h/cpp and the
+// external-path resolution rules of DiscIO/RiivolutionPatcher.cpp
+// (https://github.com/dolphin-emu/dolphin).
+// Copyright 2021 Dolphin Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+//
+// Deviations from Dolphin, all deliberate:
+//  - <memory> patches are parsed but never applied here: guest code patching
+//    belongs to the translator's Code.pul/lowmem pipeline, not the runtime.
+//  - Riivolution "macros" are not supported
+
+#pragma once
+
+#include <algorithm>
+#include <cstdint>
+#include <map>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+#include <pugixml.hpp>
+
+namespace RiivolutionContract {
+
+// ============================================================================
+// Minimal XML document model
+// ============================================================================
+
+struct XmlNode {
+    std::string name;
+    std::vector<std::pair<std::string, std::string>> attributes;
+    std::vector<XmlNode> children;
+
+    const std::string* FindAttribute(std::string_view attributeName) const {
+        for (const auto& attribute : attributes) {
+            if (attribute.first == attributeName) {
+                return &attribute.second;
+            }
+        }
+        return nullptr;
+    }
+
+    std::string Attribute(std::string_view attributeName, std::string_view fallback = {}) const {
+        const std::string* value = FindAttribute(attributeName);
+        return value ? *value : std::string(fallback);
+    }
+
+    bool AttributeBool(std::string_view attributeName, bool fallback) const {
+        const std::string* value = FindAttribute(attributeName);
+        if (!value) {
+            return fallback;
+        }
+        if (*value == "true" || *value == "1" || *value == "yes") {
+            return true;
+        }
+        if (*value == "false" || *value == "0" || *value == "no") {
+            return false;
+        }
+        return fallback;
+    }
+
+    // Accepts decimal and 0x-prefixed hex, matching pugixml's number parsing
+    // (Riivolution XMLs write memory offsets as 0x........).
+    uint32_t AttributeUint(std::string_view attributeName, uint32_t fallback) const {
+        const std::string* value = FindAttribute(attributeName);
+        if (!value || value->empty()) {
+            return fallback;
+        }
+        const std::string& text = *value;
+        size_t index = 0;
+        uint32_t base = 10;
+        if (text.size() > 2 && text[0] == '0' && (text[1] == 'x' || text[1] == 'X')) {
+            base = 16;
+            index = 2;
+        }
+        uint64_t result = 0;
+        for (; index < text.size(); ++index) {
+            const char c = text[index];
+            uint32_t digit;
+            if (c >= '0' && c <= '9') {
+                digit = static_cast<uint32_t>(c - '0');
+            } else if (base == 16 && c >= 'a' && c <= 'f') {
+                digit = static_cast<uint32_t>(c - 'a' + 10);
+            } else if (base == 16 && c >= 'A' && c <= 'F') {
+                digit = static_cast<uint32_t>(c - 'A' + 10);
+            } else {
+                return fallback;
+            }
+            result = result * base + digit;
+            if (result > 0xffffffffull) {
+                return fallback;
+            }
+        }
+        return index > (base == 16 ? 2u : 0u) ? static_cast<uint32_t>(result) : fallback;
+    }
+
+    int AttributeInt(std::string_view attributeName, int fallback) const {
+        const std::string* value = FindAttribute(attributeName);
+        if (!value || value->empty()) {
+            return fallback;
+        }
+        const bool negative = (*value)[0] == '-';
+        const uint32_t magnitude =
+            AttributeUintFromText(negative ? value->substr(1) : *value, 0x80000000u);
+        if (magnitude == 0x80000000u && !negative) {
+            return fallback;
+        }
+        return negative ? -static_cast<int>(magnitude) : static_cast<int>(magnitude);
+    }
+
+private:
+    static uint32_t AttributeUintFromText(const std::string& text, uint32_t fallback) {
+        XmlNode probe;
+        probe.attributes.push_back({"v", text});
+        return probe.AttributeUint("v", fallback);
+    }
+};
+
+namespace XmlDetail {
+
+inline bool StartsWith(std::string_view text, std::string_view prefix) {
+    return text.size() >= prefix.size() && text.compare(0, prefix.size(), prefix) == 0;
+}
+
+} // namespace XmlDetail
+
+// Converts only element and attribute data from pugixml. Riivolution carries
+// its data in attributes, so text, declarations, comments, and CDATA do not
+// need to become part of the contract's data model.
+inline XmlNode CopyXmlNode(const pugi::xml_node& source) {
+    XmlNode destination;
+    destination.name = source.name();
+    for (const pugi::xml_attribute& attribute : source.attributes()) {
+        destination.attributes.emplace_back(attribute.name(), attribute.value());
+    }
+    for (const pugi::xml_node& child : source.children()) {
+        if (child.type() == pugi::node_element) {
+            destination.children.push_back(CopyXmlNode(child));
+        }
+    }
+    return destination;
+}
+
+// Parses a document with pugixml and returns its root element, or nullopt when
+// malformed. load_buffer accepts the UTF-8 BOM used by some Riivolution packs.
+inline std::optional<XmlNode> ParseXml(std::string_view text) {
+    pugi::xml_document document;
+    const pugi::xml_parse_result result = document.load_buffer(
+        text.data(), text.size(), pugi::parse_default, pugi::encoding_utf8);
+    if (!result) {
+        return std::nullopt;
+    }
+
+    const pugi::xml_node root = document.document_element();
+    if (!root) {
+        return std::nullopt;
+    }
+    return CopyXmlNode(root);
+}
+
+// ============================================================================
+// Riivolution data model (mirrors Dolphin's DiscIO::Riivolution)
+// ============================================================================
+
+struct GameFilter {
+    std::optional<std::string> game;
+    std::optional<std::string> developer;
+    std::optional<int> disc;
+    std::optional<int> version;
+    std::optional<std::vector<std::string>> regions;
+};
+
+struct PatchReference {
+    std::string id;
+    std::map<std::string, std::string> params;
+};
+
+struct Choice {
+    std::string name;
+    std::vector<PatchReference> patchReferences;
+};
+
+struct Option {
+    std::string name;
+    std::string id;
+    std::vector<Choice> choices;
+
+    // 1-based index into choices; 0 means disabled.
+    uint32_t selectedChoice = 0;
+};
+
+struct Section {
+    std::string name;
+    std::vector<Option> options;
+};
+
+struct File {
+    std::string disc;
+    std::string external;
+    bool resize = true;
+    bool create = false;
+    uint32_t offset = 0;
+    uint32_t fileoffset = 0;
+    uint32_t length = 0;
+};
+
+struct Folder {
+    std::string disc;
+    std::string external;
+    bool resize = true;
+    bool create = false;
+    bool recursive = true;
+    uint32_t length = 0;
+};
+
+struct Savegame {
+    std::string external;
+    bool clone = true;
+};
+
+// Parsed for completeness; the runtime never applies these (guest code and
+// lowmem patching is the translator pipeline's job).
+struct MemoryPatch {
+    uint32_t offset = 0;
+    std::string value;
+    std::string valuefile;
+    std::string original;
+    bool ocarina = false;
+    bool search = false;
+    uint32_t align = 1;
+};
+
+struct Patch {
+    std::string id;
+    std::string root;
+    std::vector<File> filePatches;
+    std::vector<Folder> folderPatches;
+    std::vector<Savegame> savegamePatches;
+    std::vector<MemoryPatch> memoryPatches;
+};
+
+struct Disc {
+    int version = 0;
+    GameFilter gameFilter;
+    std::vector<Section> sections;
+    std::vector<Patch> patches;
+
+    bool IsValidForGame(const std::string& gameId, std::optional<uint16_t> revision,
+                        std::optional<uint8_t> discNumber) const;
+    std::vector<Patch> GeneratePatches(const std::string& gameId) const;
+};
+
+// riivolution/config/<GameID4>.xml - remembered option choices.
+struct ConfigOption {
+    std::string id;
+    uint32_t defaultChoice = 0;
+};
+
+struct Config {
+    int version = 0;
+    std::vector<ConfigOption> options;
+};
+
+// An option choice pinned by the distribution manifest (recomp.yml).
+struct OptionSelection {
+    std::string section; // empty = match any section
+    std::string option;  // matches Option::id first, then Option::name
+    uint32_t choice = 0;
+};
+
+// ============================================================================
+// Parsing
+// ============================================================================
+
+namespace Detail {
+
+inline std::map<std::string, std::string> ReadParams(const XmlNode& node,
+                                                     std::map<std::string, std::string> params = {}) {
+    for (const XmlNode& paramNode : node.children) {
+        if (paramNode.name != "param") {
+            continue;
+        }
+        params[paramNode.Attribute("name")] = paramNode.Attribute("value");
+    }
+    return params;
+}
+
+} // namespace Detail
+
+inline std::optional<Disc> ParseString(std::string_view xml) {
+    const std::optional<XmlNode> root = ParseXml(xml);
+    if (!root || root->name != "wiidisc") {
+        return std::nullopt;
+    }
+
+    Disc disc;
+    disc.version = root->AttributeInt("version", -1);
+    if (disc.version != 1) {
+        return std::nullopt;
+    }
+    const std::string defaultRoot = root->Attribute("root");
+
+    for (const XmlNode& node : root->children) {
+        if (node.name == "id") {
+            for (const auto& attribute : node.attributes) {
+                if (attribute.first == "game") {
+                    disc.gameFilter.game = attribute.second;
+                } else if (attribute.first == "developer") {
+                    disc.gameFilter.developer = attribute.second;
+                } else if (attribute.first == "disc") {
+                    disc.gameFilter.disc = node.AttributeInt("disc", -1);
+                } else if (attribute.first == "version") {
+                    disc.gameFilter.version = node.AttributeInt("version", -1);
+                }
+            }
+            std::vector<std::string> regions;
+            for (const XmlNode& regionNode : node.children) {
+                if (regionNode.name == "region") {
+                    regions.push_back(regionNode.Attribute("type"));
+                }
+            }
+            if (!regions.empty()) {
+                disc.gameFilter.regions = std::move(regions);
+            }
+            continue;
+        }
+
+        if (node.name == "options") {
+            for (const XmlNode& sectionNode : node.children) {
+                if (sectionNode.name != "section") {
+                    continue;
+                }
+                Section section;
+                section.name = sectionNode.Attribute("name");
+                for (const XmlNode& optionNode : sectionNode.children) {
+                    if (optionNode.name != "option") {
+                        continue;
+                    }
+                    Option option;
+                    option.id = optionNode.Attribute("id");
+                    option.name = optionNode.Attribute("name");
+                    option.selectedChoice = optionNode.AttributeUint("default", 0);
+                    auto optionParams = Detail::ReadParams(optionNode);
+                    for (const XmlNode& choiceNode : optionNode.children) {
+                        if (choiceNode.name != "choice") {
+                            continue;
+                        }
+                        Choice choice;
+                        choice.name = choiceNode.Attribute("name");
+                        auto choiceParams = Detail::ReadParams(choiceNode, optionParams);
+                        for (const XmlNode& patchRefNode : choiceNode.children) {
+                            if (patchRefNode.name != "patch") {
+                                continue;
+                            }
+                            PatchReference patchReference;
+                            patchReference.id = patchRefNode.Attribute("id");
+                            patchReference.params = Detail::ReadParams(patchRefNode, choiceParams);
+                            choice.patchReferences.push_back(std::move(patchReference));
+                        }
+                        option.choices.push_back(std::move(choice));
+                    }
+                    section.options.push_back(std::move(option));
+                }
+                disc.sections.push_back(std::move(section));
+            }
+            continue;
+        }
+
+        if (node.name == "patch") {
+            Patch patch;
+            patch.id = node.Attribute("id");
+            patch.root = node.Attribute("root");
+            if (patch.root.empty()) {
+                patch.root = defaultRoot;
+            }
+
+            for (const XmlNode& patchNode : node.children) {
+                if (patchNode.name == "file") {
+                    File file;
+                    file.disc = patchNode.Attribute("disc");
+                    file.external = patchNode.Attribute("external");
+                    file.resize = patchNode.AttributeBool("resize", true);
+                    file.create = patchNode.AttributeBool("create", false);
+                    file.offset = patchNode.AttributeUint("offset", 0);
+                    file.fileoffset = patchNode.AttributeUint("fileoffset", 0);
+                    file.length = patchNode.AttributeUint("length", 0);
+                    patch.filePatches.push_back(std::move(file));
+                } else if (patchNode.name == "folder") {
+                    Folder folder;
+                    folder.disc = patchNode.Attribute("disc");
+                    folder.external = patchNode.Attribute("external");
+                    folder.resize = patchNode.AttributeBool("resize", true);
+                    folder.create = patchNode.AttributeBool("create", false);
+                    folder.recursive = patchNode.AttributeBool("recursive", true);
+                    folder.length = patchNode.AttributeUint("length", 0);
+                    patch.folderPatches.push_back(std::move(folder));
+                } else if (patchNode.name == "savegame") {
+                    Savegame savegame;
+                    savegame.external = patchNode.Attribute("external");
+                    savegame.clone = patchNode.AttributeBool("clone", true);
+                    patch.savegamePatches.push_back(std::move(savegame));
+                } else if (patchNode.name == "memory") {
+                    MemoryPatch memory;
+                    memory.offset = patchNode.AttributeUint("offset", 0);
+                    memory.value = patchNode.Attribute("value");
+                    memory.valuefile = patchNode.Attribute("valuefile");
+                    memory.original = patchNode.Attribute("original");
+                    memory.ocarina = patchNode.AttributeBool("ocarina", false);
+                    memory.search = patchNode.AttributeBool("search", false);
+                    memory.align = patchNode.AttributeUint("align", 1);
+                    patch.memoryPatches.push_back(std::move(memory));
+                }
+            }
+            disc.patches.push_back(std::move(patch));
+        }
+    }
+
+    return disc;
+}
+
+inline std::optional<Config> ParseConfigString(std::string_view xml) {
+    const std::optional<XmlNode> root = ParseXml(xml);
+    if (!root || root->name != "riivolution") {
+        return std::nullopt;
+    }
+
+    Config config;
+    config.version = root->AttributeInt("version", -1);
+    if (config.version != 2) {
+        return std::nullopt;
+    }
+
+    for (const XmlNode& optionNode : root->children) {
+        if (optionNode.name != "option") {
+            continue;
+        }
+        ConfigOption option;
+        option.id = optionNode.Attribute("id");
+        option.defaultChoice = optionNode.AttributeUint("default", 0);
+        config.options.push_back(std::move(option));
+    }
+
+    return config;
+}
+
+// ============================================================================
+// Game matching and patch generation
+// ============================================================================
+
+inline bool Disc::IsValidForGame(const std::string& gameId, std::optional<uint16_t> revision,
+                                 std::optional<uint8_t> discNumber) const {
+    if (gameId.size() != 6) {
+        return false;
+    }
+
+    const std::string_view gameIdFull(gameId);
+    const std::string_view gameRegion = gameIdFull.substr(3, 1);
+    const std::string_view gameDeveloper = gameIdFull.substr(4, 2);
+    const int discNumberInt = discNumber ? static_cast<int>(*discNumber) : -1;
+    const int revisionInt = revision ? static_cast<int>(*revision) : -1;
+
+    if (gameFilter.game && !XmlDetail::StartsWith(gameIdFull, *gameFilter.game)) {
+        return false;
+    }
+    if (gameFilter.developer && gameDeveloper != *gameFilter.developer) {
+        return false;
+    }
+    if (gameFilter.disc && discNumberInt != *gameFilter.disc) {
+        return false;
+    }
+    if (gameFilter.version && revisionInt != *gameFilter.version) {
+        return false;
+    }
+    if (gameFilter.regions) {
+        const auto& regions = *gameFilter.regions;
+        if (!regions.empty() &&
+            std::find(regions.begin(), regions.end(), std::string(gameRegion)) == regions.end()) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+inline std::vector<Patch> Disc::GeneratePatches(const std::string& gameId) const {
+    const std::string_view gameIdFull(gameId);
+    const std::string_view gameIdNoRegion = gameIdFull.substr(0, 3);
+    const std::string_view gameRegion = gameIdFull.substr(3, 1);
+    const std::string_view gameDeveloper = gameIdFull.size() >= 6 ? gameIdFull.substr(4, 2) : std::string_view();
+
+    const auto replaceVariables =
+        [](std::string_view sv, const std::vector<std::pair<std::string, std::string_view>>& replacements) {
+            std::string result;
+            result.reserve(sv.size());
+            while (!sv.empty()) {
+                bool replaced = false;
+                for (const auto& replacement : replacements) {
+                    if (XmlDetail::StartsWith(sv, replacement.first)) {
+                        result.append(replacement.second.data(), replacement.second.size());
+                        sv = sv.substr(replacement.first.size());
+                        replaced = true;
+                        break;
+                    }
+                }
+                if (replaced) {
+                    continue;
+                }
+                result.push_back(sv[0]);
+                sv = sv.substr(1);
+            }
+            return result;
+        };
+
+    // Take only selected patches, replace placeholders in all strings, and
+    // return them.
+    std::vector<Patch> activePatches;
+    for (const Section& section : sections) {
+        for (const Option& option : section.options) {
+            const uint32_t selected = option.selectedChoice;
+            if (selected == 0 || selected > option.choices.size()) {
+                continue;
+            }
+            const Choice& choice = option.choices[selected - 1];
+            for (const PatchReference& patchReference : choice.patchReferences) {
+                const auto patch = std::find_if(patches.begin(), patches.end(), [&](const Patch& candidate) {
+                    return candidate.id == patchReference.id;
+                });
+                if (patch == patches.end()) {
+                    continue;
+                }
+
+                std::vector<std::pair<std::string, std::string_view>> replacements;
+                replacements.emplace_back("{$__gameid}", gameIdNoRegion);
+                replacements.emplace_back("{$__region}", gameRegion);
+                replacements.emplace_back("{$__maker}", gameDeveloper);
+                for (const auto& param : patchReference.params) {
+                    replacements.emplace_back("{$" + param.first + "}", param.second);
+                }
+
+                Patch newPatch = *patch;
+                newPatch.root = replaceVariables(newPatch.root, replacements);
+                for (File& file : newPatch.filePatches) {
+                    file.disc = replaceVariables(file.disc, replacements);
+                    file.external = replaceVariables(file.external, replacements);
+                }
+                for (Folder& folder : newPatch.folderPatches) {
+                    folder.disc = replaceVariables(folder.disc, replacements);
+                    folder.external = replaceVariables(folder.external, replacements);
+                }
+                for (Savegame& savegame : newPatch.savegamePatches) {
+                    savegame.external = replaceVariables(savegame.external, replacements);
+                }
+                for (MemoryPatch& memory : newPatch.memoryPatches) {
+                    memory.valuefile = replaceVariables(memory.valuefile, replacements);
+                }
+                activePatches.push_back(std::move(newPatch));
+            }
+        }
+    }
+
+    return activePatches;
+}
+
+// ============================================================================
+// Option selection
+// ============================================================================
+
+// Dolphin's config identifier: an option is addressed by its id when it has
+// one, otherwise by the concatenation of section name and option name.
+inline void ApplyConfigDefaults(Disc& disc, const Config& config) {
+    for (const ConfigOption& configOption : config.options) {
+        for (Section& section : disc.sections) {
+            for (Option& option : section.options) {
+                const bool matches = option.id.empty()
+                    ? (section.name + option.name) == configOption.id
+                    : option.id == configOption.id;
+                if (matches) {
+                    option.selectedChoice = configOption.defaultChoice;
+                }
+            }
+        }
+    }
+}
+
+// Applies distribution-pinned selections. Runs after ApplyConfigDefaults so a
+// pin always wins over the user's remembered choice.
+inline void ApplySelections(Disc& disc, const std::vector<OptionSelection>& selections) {
+    for (const OptionSelection& selection : selections) {
+        for (Section& section : disc.sections) {
+            if (!selection.section.empty() && section.name != selection.section) {
+                continue;
+            }
+            for (Option& option : section.options) {
+                const bool matches = (!option.id.empty() && option.id == selection.option) ||
+                                     option.name == selection.option;
+                if (matches && selection.choice <= option.choices.size()) {
+                    option.selectedChoice = selection.choice;
+                }
+            }
+        }
+    }
+}
+
+// External path resolution (Dolphin FileDataLoaderHostFS semantics). A leading '/' is absolute
+// (relative to the SD card root); otherwise relative to the patch root (the XML's folder, or
+// its 'root' attribute override). All paths use '/' separators (callers convert host paths via
+// generic_string() first); returns nullopt for ".." traversal or a backslash, which Riivolution
+// treats as a filename character that Windows paths can't replicate.
+
+inline std::optional<std::string> MakeAbsoluteFromRelative(std::string_view sdRoot,
+                                                           std::string_view patchRoot,
+                                                           std::string_view externalRelativePath) {
+    if (externalRelativePath.find('\\') != std::string_view::npos) {
+        return std::nullopt;
+    }
+
+    const bool absolute = !externalRelativePath.empty() && externalRelativePath[0] == '/';
+    std::string result(absolute ? sdRoot : patchRoot);
+    while (!result.empty() && result.back() == '/') {
+        result.pop_back();
+    }
+
+    std::string_view work = externalRelativePath;
+    while (!work.empty() && work.front() == '/') {
+        work.remove_prefix(1);
+    }
+    while (!work.empty() && work.back() == '/') {
+        work.remove_suffix(1);
+    }
+
+    size_t depth = 0;
+    while (!work.empty()) {
+        const size_t separator = work.find('/');
+        const std::string_view element = work.substr(0, separator);
+
+        if (element == ".") {
+            // Harmless, changes nothing.
+        } else if (element == "..") {
+            // Going up a level; never above the root.
+            if (depth == 0) {
+                return std::nullopt;
+            }
+            --depth;
+            const size_t lastSlash = result.rfind('/');
+            if (lastSlash == std::string::npos) {
+                return std::nullopt;
+            }
+            result.resize(lastSlash);
+        } else if (!element.empty()) {
+            ++depth;
+            result.push_back('/');
+            result.append(element.data(), element.size());
+        }
+
+        if (separator == std::string_view::npos) {
+            break;
+        }
+        work.remove_prefix(separator + 1);
+    }
+
+    return result;
+}
+
+// Computes a patch's effective root directory from the XML file's directory
+// and the patch's 'root' attribute.
+inline std::string ResolvePatchRoot(std::string_view sdRoot, std::string_view xmlDirectory,
+                                    std::string_view rootAttribute) {
+    std::string patchRoot(xmlDirectory);
+    if (!rootAttribute.empty()) {
+        if (auto resolved = MakeAbsoluteFromRelative(sdRoot, xmlDirectory, rootAttribute)) {
+            patchRoot = std::move(*resolved);
+        }
+    }
+    return patchRoot;
+}
+
+// First <savegame> across the active patches, in order (Dolphin
+// ExtractSavegameRedirect).
+inline const Savegame* FindSavegamePatch(const std::vector<Patch>& activePatches) {
+    for (const Patch& patch : activePatches) {
+        if (!patch.savegamePatches.empty()) {
+            return &patch.savegamePatches[0];
+        }
+    }
+    return nullptr;
+}
+
+} // namespace RiivolutionContract
diff --git a/runtime/include/hle_stubs.h b/runtime/include/hle_stubs.h
new file mode 100644
index 0000000..92ea526
--- /dev/null
+++ b/runtime/include/hle_stubs.h
@@ -0,0 +1,47 @@
+#pragma once
+
+#include "abi_bridge.h"
+
+// hle/gx/gx_fatal_stubs.cpp includes nothing but this header and reaches
+// std::fprintf / std::snprintf / std::abort through it.
+#include <cstdio>
+#include <cstdlib>
+
+// VI Utils
+void VI_HLE_ForceRetrace(CpuContext* ctx);
+void VI_HLE_PollRetrace(CpuContext* ctx);
+void VI_HLE_ProcessRetracesDeferred(int maxToProcess);
+void VI_HLE_WaitForNextRetracePoll();
+// Single owner of the Aurora frame presentation sequence (seal, optional pace
+// to the VI retrace boundary, pre-warm the next frame). paceToRetrace is true
+// for the GXCopyDisp producer path and false for retrace-context presents.
+void VI_HLE_PresentFrame(bool presentedXfb, bool paceToRetrace);
+bool VI_HLE_IsAdvancingRetrace();
+void VI_HLE_SetXfbReady(uint32_t xfbAddr); // Called by GXCopyDisp to signal EFB→XFB copy
+void Audio_HLE_Tick(CpuContext* ctx, uint32_t deltaMicros);
+void Audio_HLE_Poll(CpuContext* ctx);
+// Deferred twin of Audio_HLE_Poll for the long host waits that already service
+// retraces and alarms (the VI retrace pacing loop, the Aurora frame-worker wait
+// callback). Runs the AI DMA tick on an isolated register file the way
+// OS_HLE_ProcessAlarmsDeferred does, so it is safe to call from the middle of an
+// arbitrary translated function.
+void Audio_HLE_PollDeferred();
+bool OS_HLE_InterruptsEnabled() noexcept;
+extern "C" void OS_HLE_ProcessAlarmsDeferred(int maxToProcess);
+extern "C" void OS_HLE_BeginDeferredGuestCallbacks();
+extern "C" void OS_HLE_EndDeferredGuestCallbacks();
+
+
+// Defines and registers a faithful native reimplementation that REPLACES the translated function
+// at a PPC address (not a stub; genuine not-yet-implemented entries live in hle/gx/gx_fatal_stubs.cpp
+// and abort). The translator regex-parses these macro names to skip that address at build time, so
+// renaming requires updating Translator.Cli/Program.cs, RuntimeNativeGuestEffectAnalyzer.cs,
+// TranslatedBuildShardEmitter.cs and RuntimeNativeFunctionAbiProvider.cs together.
+
+#define PPC_NATIVE_OVERRIDE(addr_hex, name, ret_type, arg_list, call_list) \
+    extern "C" ret_type func_##addr_hex arg_list { return name call_list; } \
+    REGISTER_NATIVE_FUNCTION(0x##addr_hex, name)
+
+#define PPC_NATIVE_OVERRIDE_VOID(addr_hex, name, arg_list, call_list) \
+    extern "C" void func_##addr_hex arg_list { name call_list; } \
+    REGISTER_NATIVE_FUNCTION(0x##addr_hex, name)
diff --git a/runtime/include/isa/big_endian.h b/runtime/include/isa/big_endian.h
new file mode 100644
index 0000000..a8a1cbc
--- /dev/null
+++ b/runtime/include/isa/big_endian.h
@@ -0,0 +1,91 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <type_traits>
+
+namespace BigEndian {
+
+inline uint16_t Read16(const uint8_t* src) {
+    return (static_cast<uint16_t>(src[0]) << 8) |
+           static_cast<uint16_t>(src[1]);
+}
+
+inline uint32_t Read32(const uint8_t* src) {
+    return (static_cast<uint32_t>(src[0]) << 24) |
+           (static_cast<uint32_t>(src[1]) << 16) |
+           (static_cast<uint32_t>(src[2]) << 8) |
+           static_cast<uint32_t>(src[3]);
+}
+
+inline float ReadFloat32(const uint8_t* src) {
+    const uint32_t bits = Read32(src);
+    float value = 0.0f;
+    static_assert(sizeof(bits) == sizeof(value));
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+inline void Write16(uint8_t* dst, uint16_t value) {
+    dst[0] = static_cast<uint8_t>(value >> 8);
+    dst[1] = static_cast<uint8_t>(value);
+}
+
+inline void Write32(uint8_t* dst, uint32_t value) {
+    dst[0] = static_cast<uint8_t>(value >> 24);
+    dst[1] = static_cast<uint8_t>(value >> 16);
+    dst[2] = static_cast<uint8_t>(value >> 8);
+    dst[3] = static_cast<uint8_t>(value);
+}
+
+inline void Write64(uint8_t* dst, uint64_t value) {
+    Write32(dst, static_cast<uint32_t>(value >> 32));
+    Write32(dst + sizeof(uint32_t), static_cast<uint32_t>(value));
+}
+
+inline void WriteFloat32(uint8_t* dst, float value) {
+    uint32_t bits = 0;
+    static_assert(sizeof(bits) == sizeof(value));
+    std::memcpy(&bits, &value, sizeof(bits));
+    Write32(dst, bits);
+}
+
+inline void Write16(uint8_t* dst, std::size_t offset, uint16_t value) {
+    Write16(dst + offset, value);
+}
+
+inline void Write32(uint8_t* dst, std::size_t offset, uint32_t value) {
+    Write32(dst + offset, value);
+}
+
+inline void Write64(uint8_t* dst, std::size_t offset, uint64_t value) {
+    Write64(dst + offset, value);
+}
+
+inline void WriteFloat32(uint8_t* dst, std::size_t offset, float value) {
+    WriteFloat32(dst + offset, value);
+}
+
+template <typename Offset>
+inline void Append16(uint8_t* dst, Offset& offset, uint16_t value) {
+    static_assert(std::is_integral_v<Offset>);
+    Write16(dst + offset, value);
+    offset += static_cast<Offset>(sizeof(value));
+}
+
+template <typename Offset>
+inline void Append32(uint8_t* dst, Offset& offset, uint32_t value) {
+    static_assert(std::is_integral_v<Offset>);
+    Write32(dst + offset, value);
+    offset += static_cast<Offset>(sizeof(value));
+}
+
+template <typename Offset>
+inline void AppendFloat32(uint8_t* dst, Offset& offset, float value) {
+    static_assert(std::is_integral_v<Offset>);
+    WriteFloat32(dst + offset, value);
+    offset += static_cast<Offset>(sizeof(value));
+}
+
+} // namespace BigEndian
diff --git a/runtime/include/isa/ppc_isa_config.h b/runtime/include/isa/ppc_isa_config.h
new file mode 100644
index 0000000..663b576
--- /dev/null
+++ b/runtime/include/isa/ppc_isa_config.h
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <atomic>
+#include <cstdint>
+
+#define MKW_RESTRICT __restrict
+#include <immintrin.h>
+
+inline constexpr bool MkwStateFreeAbiEnabled(uint32_t) noexcept
+{
+    return true;
+}
+
+#define MKW_PPC_FORCE_INLINE __forceinline
+#define MKW_PPC_NO_INLINE __declspec(noinline)
+#define MKW_PPC_ALWAYS_INLINE_BODY __attribute__((always_inline))
+#define MKW_PPC_COLD __attribute__((cold))
+#define MKW_PPC_INTERNAL_CALL __regcall
+
+
+using MkwStateFreeResult2 = uint64_t __attribute__((ext_vector_type(2)));
diff --git a/runtime/include/isa/ppc_isa_context.h b/runtime/include/isa/ppc_isa_context.h
new file mode 100644
index 0000000..0c9381e
--- /dev/null
+++ b/runtime/include/isa/ppc_isa_context.h
@@ -0,0 +1,188 @@
+#pragma once
+#include "ppc_isa_fpenv.h"
+
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <iostream>
+#include <string_view>
+
+void ShowRuntimeFatalPopup(std::string_view category, std::string_view details) noexcept;
+
+union PPC_FPR {
+    uint64_t raw;
+    double d;
+    struct {
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+        float ps1; // Low word (Least Significant)
+        float ps0; // High word (Most Significant)
+#else
+        float ps0; // High word
+        float ps1; // Low word
+#endif
+    } paired;
+};
+
+// PowerPC CPU Context
+struct CpuContext {
+    // Standard GPRs
+    uint32_t gpr[32];
+
+    // Special Purpose Registers defined by standard PPC
+    uint32_t cr;        // Condition Register
+    uint32_t lr;        // Link Register
+    uint32_t ctr;       // Count Register
+    uint32_t xer;       // Integer Exception Register
+    uint32_t fpscr;     // Floating-Point Status and Control Register
+
+    // Program State
+    uint32_t pc;        // Program Counter (not used alot tho)
+
+    // Floating Point Registers (Modified for Paired Single support)
+    PPC_FPR  fpr[32];
+
+    // Broadway Specific Extensions
+    uint32_t gqr[8];    // Graphics Quantization Registers
+    uint32_t hid0;      // HID0
+    uint32_t hid1;      // HID1
+    uint32_t hid2;      // HID2
+
+    uint32_t srr0;      // Save/Restore Register 0
+    uint32_t srr1;      // Save/Restore Register 1
+    uint32_t msr;       // Machine State Register
+};
+
+inline thread_local CpuContext* g_currentCpuContext = nullptr;
+
+class CpuContextScope {
+public:
+    explicit CpuContextScope(CpuContext* ctx)
+        : previous_(g_currentCpuContext)
+    {
+        g_currentCpuContext = ctx;
+
+        savedMxcsr_ = _mm_getcsr();
+        if (ctx != nullptr)
+            MkwApplyHostNiMode(ctx->fpscr);
+    }
+
+    ~CpuContextScope()
+    {
+        g_currentCpuContext = previous_;
+        if (previous_ != nullptr)
+            MkwApplyHostNiMode(previous_->fpscr);
+        else
+            MkwRestoreHostMxcsr(savedMxcsr_);
+    }
+
+    CpuContextScope(const CpuContextScope&) = delete;
+    CpuContextScope& operator=(const CpuContextScope&) = delete;
+
+private:
+    CpuContext* previous_ = nullptr;
+    uint32_t savedMxcsr_ = 0;
+};
+
+inline CpuContext* TryGetCpuContext() noexcept
+{
+    return g_currentCpuContext;
+}
+
+inline CpuContext* CurrentCpuContext()
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu) {
+        std::cerr << "[runtime] CRITICAL: CurrentCpuContext is NULL. "
+                  << "Did you forget to create a CpuContextScope?" << std::endl;
+        ShowRuntimeFatalPopup("Runtime context failure",
+                              "The game stopped because a translated function tried to run without a CPU context.");
+        std::abort();
+    }
+
+    if (cpu->gpr[1] == 0) {
+        std::cerr << "[runtime] CRITICAL: Guest Stack Pointer (r1) is NULL (0x00000000). "
+                  << "The emulated program has crashed." << std::endl;
+        ShowRuntimeFatalPopup("Guest execution failure",
+                              "The game stopped because the guest stack pointer became null while translated code was running.");
+        std::abort(); // Stop immediately so you can debug the cause.
+    }
+    return cpu;
+}
+
+// Condition Register Fields
+#define CR_LT 0
+#define CR_GT 1
+#define CR_EQ 2
+#define CR_SO 3
+
+extern "C" void DumpHostStackTraceForRuntimeHelper();
+void MarkFatalErrorReported();
+
+[[noreturn]] inline void PPC_Undefined(uint32_t pc, uint32_t rawInstruction, const char* details)
+{
+    std::fprintf(stderr,
+                 "[runtime] UNDEFINED guest instruction: pc=0x%08X raw=0x%08X %s\n",
+                 pc,
+                 rawInstruction,
+                 details ? details : "");
+    char message[256]{};
+    std::snprintf(message, sizeof(message),
+                  "The game stopped because it reached an unsupported guest instruction at PC 0x%08X (instruction 0x%08X).\n\n%s",
+                  pc, rawInstruction, details ? details : "No additional details were provided.");
+    ShowRuntimeFatalPopup("Unsupported guest instruction", message);
+    std::abort();
+}
+
+// Used by generated code when the translator encounters privileged/unmodeled PPC instructions
+// (e.g. rfi). This is intentionally loud so missing HLE hooks are easy to find.
+#define UNDEFINED(pc, rawInstruction, details) PPC_Undefined((pc), (rawInstruction), (details))
+
+// Helper to set CR bits (Signed)
+inline void SetCR(CpuContext* cpu, int field, int32_t a, int32_t b) {
+    uint32_t crField = 0;
+    if (a < b) crField |= 0x8; // LT
+    if (a > b) crField |= 0x4; // GT
+    if (a == b) crField |= 0x2; // EQ
+    crField |= (cpu->xer >> 31) & 1u; // SO
+    
+    int shift = (7 - field) * 4;
+    uint32_t mask = 0xF << shift;
+    cpu->cr = (cpu->cr & ~mask) | (crField << shift);
+}
+
+// Helper to set CR bits (Unsigned)
+inline void SetCR(CpuContext* cpu, int field, uint32_t a, uint32_t b) {
+    uint32_t crField = 0;
+    if (a < b) crField |= 0x8; // LT
+    if (a > b) crField |= 0x4; // GT
+    if (a == b) crField |= 0x2; // EQ
+    crField |= (cpu->xer >> 31) & 1u; // SO
+    
+    int shift = (7 - field) * 4;
+    uint32_t mask = 0xF << shift;
+    cpu->cr = (cpu->cr & ~mask) | (crField << shift);
+}
+
+// Helper to set CR bits (Floating-point)
+inline void SetCRFloat(CpuContext* cpu, int field, double a, double b) {
+    uint32_t crField = 0;
+    if (std::isnan(a) || std::isnan(b)) {
+        // Unordered: LT/GT/EQ clear, SO set.
+        crField = 0x1;
+    } else {
+        if (a < b) crField |= 0x8; // LT
+        if (a > b) crField |= 0x4; // GT
+        if (a == b) crField |= 0x2; // EQ
+    }
+
+    int shift = (7 - field) * 4;
+    uint32_t mask = 0xF << shift;
+    cpu->cr = (cpu->cr & ~mask) | (crField << shift);
+}
+
+// Helper to get CR bit
+inline bool GetCRBit(CpuContext* cpu, int field, int bit) {
+    int shift = (7 - field) * 4 + (3 - bit);
+    return (cpu->cr >> shift) & 1;
+}
diff --git a/runtime/include/isa/ppc_isa_cr.h b/runtime/include/isa/ppc_isa_cr.h
new file mode 100644
index 0000000..b82c59a
--- /dev/null
+++ b/runtime/include/isa/ppc_isa_cr.h
@@ -0,0 +1,62 @@
+#pragma once
+
+#include <cmath>
+#include <cstdint>
+
+inline void SetCRResident(uint32_t& cr, uint32_t xer, int field, int32_t a, int32_t b) noexcept {
+    uint32_t value = (a < b ? 0x8u : 0u) | (a > b ? 0x4u : 0u) | (a == b ? 0x2u : 0u) | ((xer >> 31) & 1u);
+    const int shift = (7 - field) * 4;
+    cr = (cr & ~(0xFu << shift)) | (value << shift);
+}
+inline void SetCRResident(uint32_t& cr, uint32_t xer, int field, uint32_t a, uint32_t b) noexcept {
+    uint32_t value = (a < b ? 0x8u : 0u) | (a > b ? 0x4u : 0u) | (a == b ? 0x2u : 0u) | ((xer >> 31) & 1u);
+    const int shift = (7 - field) * 4;
+    cr = (cr & ~(0xFu << shift)) | (value << shift);
+}
+inline void SetCRFloatResident(uint32_t& cr, int field, double a, double b) noexcept {
+    uint32_t value = (std::isnan(a) || std::isnan(b)) ? 0x1u :
+        ((a < b ? 0x8u : 0u) | (a > b ? 0x4u : 0u) | (a == b ? 0x2u : 0u));
+    const int shift = (7 - field) * 4;
+    cr = (cr & ~(0xFu << shift)) | (value << shift);
+}
+
+
+inline bool GetCRBitResident(uint32_t cr, int field, int bit) noexcept {
+    const int shift = (7 - field) * 4 + (3 - bit);
+    return ((cr >> shift) & 1u) != 0u;
+}
+
+inline uint32_t PpcCrSetBitResident(uint32_t cr, uint32_t bitIndex, uint32_t value) noexcept {
+    const uint32_t mask = 1u << (31u - (bitIndex & 31u));
+    return (value & 1u) != 0 ? (cr | mask) : (cr & ~mask);
+}
+
+inline uint32_t PpcCrLogicalResident(
+    uint32_t cr, uint32_t op, uint32_t bt, uint32_t ba, uint32_t bb) noexcept {
+    const auto readBit = [cr](uint32_t index) noexcept {
+        return (cr >> (31u - (index & 31u))) & 1u;
+    };
+    const uint32_t a = readBit(ba);
+    const uint32_t b = readBit(bb);
+    uint32_t result = 0;
+    switch (op & 7u) {
+        case 0: result = ~(a | b) & 1u; break;
+        case 1: result = a & (~b & 1u); break;
+        case 2: result = a ^ b; break;
+        case 3: result = ~(a & b) & 1u; break;
+        case 4: result = a & b; break;
+        case 5: result = ~(a ^ b) & 1u; break;
+        case 6: result = (~a & 1u) | b; break;
+        case 7: result = a | b; break;
+    }
+    return PpcCrSetBitResident(cr, bt, result);
+}
+
+inline uint32_t PpcMcrfResident(uint32_t cr, uint32_t dstField, uint32_t srcField) noexcept {
+    dstField &= 7u;
+    srcField &= 7u;
+    const uint32_t dstShift = (7u - dstField) * 4u;
+    const uint32_t srcShift = (7u - srcField) * 4u;
+    const uint32_t field = (cr >> srcShift) & 0xFu;
+    return (cr & ~(0xFu << dstShift)) | (field << dstShift);
+}
diff --git a/runtime/include/isa/ppc_isa_float.h b/runtime/include/isa/ppc_isa_float.h
new file mode 100644
index 0000000..fcd5795
--- /dev/null
+++ b/runtime/include/isa/ppc_isa_float.h
@@ -0,0 +1,858 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+//
+// Copyright 2018 Dolphin Emulator Project
+//
+// Portions of this file are derived from the Dolphin Emulator
+// (https://github.com/dolphin-emu/dolphin):
+//
+//   * Source/Core/Common/FloatUtils.cpp - the Gekko/Broadway fres and frsqrte
+//     estimate tables (kPpcFresEstimateInline / kPpcFrsqrteEstimateInline,
+//     upstream fres_expected / frsqrte_expected) together with the
+//     PpcApproximateReciprocalInline and PpcApproximateReciprocalSquareRootInline
+//     interpolation routines, which are ports of upstream ApproximateReciprocal
+//     and ApproximateReciprocalSquareRoot.
+//
+// The remainder of this header is original to this project. It is
+// GPL-2.0-or-later as a consequence of the above; see THIRD-PARTY-NOTICES.md.
+
+#pragma once
+// Pure floating-point and paired-single PowerPC semantics: the scalar single
+// and double families, every ps_* arithmetic form, the NI flush rules and the
+// Gekko fres/frsqrte estimates. Nothing in this header touches guest memory -
+// the psq_l/psq_st tier that does lives in ppc_isa_quantized.h.
+
+#include "ppc_isa_config.h"
+#include "ppc_isa_context.h"
+
+#include <array>
+#include <cmath>
+#include <cstdint>
+#include <cstring>
+#include <limits>
+
+inline uint64_t PpcBitCastToU64Inline(double value)
+{
+    uint64_t integral = 0;
+    std::memcpy(&integral, &value, sizeof(integral));
+    return integral;
+}
+
+inline uint32_t PPC_FprLowWordInline(double value)
+{
+    return static_cast<uint32_t>(PpcBitCastToU64Inline(value));
+}
+
+inline double PpcBitCastToDoubleInline(uint64_t value)
+{
+    double result = 0.0;
+    std::memcpy(&result, &value, sizeof(result));
+    return result;
+}
+
+inline uint32_t PpcBitCastToU32Inline(float value)
+{
+    uint32_t integral = 0;
+    std::memcpy(&integral, &value, sizeof(integral));
+    return integral;
+}
+
+inline float PpcBitCastToFloatInline(uint32_t value)
+{
+    float result = 0.0f;
+    std::memcpy(&result, &value, sizeof(result));
+    return result;
+}
+
+// NOTE: PpcGetPs0Inline / PpcGetPs1Inline / PpcPackPairedInline are defined
+// below the paired-single helper block (PpcPsToM128Inline and
+// friends) because their register-domain implementations are written in terms
+// of those helpers. Nothing between here and there uses them.
+
+inline double PpcGetPairedFprInline(const PPC_FPR& fpr)
+{
+    return fpr.d;
+}
+
+inline void PpcSetPairedFprInline(PPC_FPR& fpr, double packed)
+{
+    fpr.d = packed;
+}
+
+// Must stay inside the XMM register domain. Bitcasting through a 64-bit GPR added a movq
+// domain crossing on every paired-single op (630 in the THP IDCT region alone); a double
+// local already lives in an XMM register, so these casts compile to nothing.
+inline __m128 PpcPsToM128Inline(double value)
+{
+    return _mm_castpd_ps(_mm_set_sd(value));
+}
+
+inline double PpcM128ToPsInline(__m128 value)
+{
+    return _mm_cvtsd_f64(_mm_castps_pd(value));
+}
+
+inline __m128 PpcBroadcastPs0Inline(double value)
+{
+    const __m128 lanes = PpcPsToM128Inline(value);
+    return _mm_shuffle_ps(lanes, lanes, _MM_SHUFFLE(1, 1, 1, 1));
+}
+
+inline __m128 PpcBroadcastPs1Inline(double value)
+{
+    const __m128 lanes = PpcPsToM128Inline(value);
+    return _mm_shuffle_ps(lanes, lanes, _MM_SHUFFLE(0, 0, 0, 0));
+}
+
+inline __m128 PpcNegateNonNanLanesInline(__m128 value)
+{
+    const __m128 signMask = _mm_castsi128_ps(_mm_set1_epi32(static_cast<int>(0x80000000u)));
+    const __m128 negated = _mm_xor_ps(value, signMask);
+    const __m128 ordered = _mm_cmpord_ps(value, value);
+    return _mm_or_ps(_mm_and_ps(ordered, negated), _mm_andnot_ps(ordered, value));
+}
+
+// Paired-single lane accessors. The packed double's LOW 32 bits hold ps1 and HIGH 32 bits
+// hold ps0, so in the SSE float-lane view lane 0 == ps1 and lane 1 == ps0. Must stay pure
+// register-domain shuffles (no arithmetic/conversion, so NaN/denormal bits pass through);
+// the former union-based forms store-then-reloaded through memory, a guaranteed
+// store-to-load-forwarding stall on every scalar-lane op.
+inline float PpcGetPs0Inline(double value)
+{
+    // ps0 lives in lane 1; PpcBroadcastPs0Inline already splats it.
+    return _mm_cvtss_f32(PpcBroadcastPs0Inline(value));
+}
+
+inline float PpcGetPs1Inline(double value)
+{
+    // ps1 is already lane 0 of the packed representation.
+    return _mm_cvtss_f32(PpcPsToM128Inline(value));
+}
+
+inline double PpcPackPairedInline(float ps0, float ps1)
+{
+    // _mm_unpacklo_ps(x, y) -> { x[0], y[0], x[1], y[1] }, so lane 0 becomes
+    // ps1 and lane 1 becomes ps0, matching the union layout bit for bit.
+    return PpcM128ToPsInline(_mm_unpacklo_ps(_mm_set_ss(ps1), _mm_set_ss(ps0)));
+}
+
+// FPSCR[NI] is modeled by MXCSR FTZ/DAZ, so arithmetic output flushing compiles to nothing.
+// Two cases still need a software check against the mirrored bit (not STMXCSR, too hot):
+// double->single conversion (CVTSD2SS isn't covered by FTZ) and raw lane pass-through moves.
+inline bool MkwHostNiActiveInline() noexcept
+{
+    return g_mkwHostNiActive;
+}
+
+inline float PpcForceSingleValueInline(double value)
+{
+    // FPSCR[NI] flushes an exact pre-round single-subnormal even when rounding would promote it
+    // to the smallest normal. g_mkwNiFlushThreshold (2^-126 active, 0.0 inactive) turns the
+    // flush into a branchless mask: a set compare lane keeps just the sign bit, a clear lane
+    // passes the value to CVTSD2SS. DAZ (set exactly when NI is) makes the compare itself treat
+    // a subnormal as zero, matching the mask's answer.
+    const __m128d v = _mm_set_sd(value);
+    const __m128d signMask = _mm_set_sd(-0.0);
+    const __m128d magnitude = _mm_andnot_pd(signMask, v);
+    const __m128d flush = _mm_cmplt_sd(magnitude, _mm_set_sd(g_mkwNiFlushThreshold));
+    const __m128d kept = _mm_andnot_pd(_mm_andnot_pd(signMask, flush), v);
+    return static_cast<float>(_mm_cvtsd_f64(kept));
+}
+
+inline float PpcFlushSingleForNiInline(float value)
+{
+    if (!MkwHostNiActiveInline())
+        return value;
+    const uint32_t bits = PpcBitCastToU32Inline(value);
+    if ((bits & 0x7FFFFFFFu) < 0x00800000u) [[unlikely]]
+        return PpcBitCastToFloatInline(bits & 0x80000000u);
+    return value;
+}
+
+inline double PpcFlushPairedForNiInline(double value)
+{
+    // Callers pass results of SSE arithmetic; MXCSR.FTZ already flushed them.
+    return value;
+}
+
+inline double PpcForce25BitInline(double value)
+{
+    constexpr uint64_t kDoubleExpMask = 0x7FF0000000000000ULL;
+    constexpr uint64_t kDoubleFracMask = 0x000FFFFFFFFFFFFFULL;
+    constexpr int kDoubleFracWidth = 52;
+
+    uint64_t integral = PpcBitCastToU64Inline(value);
+
+    const uint64_t exponent = integral & kDoubleExpMask;
+    const uint64_t fraction = integral & kDoubleFracMask;
+
+    if (exponent == 0 && fraction != 0)
+    {
+        int64_t keepMask = 0xFFFFFFFFF8000000LL;
+        uint64_t round = 0x8000000ULL;
+        uint32_t leadingZeros = 0;
+        uint64_t normalizedFraction = fraction;
+        while ((normalizedFraction & (1ULL << 63)) == 0)
+        {
+            normalizedFraction <<= 1;
+            ++leadingZeros;
+        }
+        const uint32_t shift = leadingZeros - (63 - kDoubleFracWidth);
+        keepMask >>= shift;
+        round >>= shift;
+        integral = (integral & static_cast<uint64_t>(keepMask)) + (integral & round);
+    }
+    else
+    {
+        integral = (integral & 0xFFFFFFFFF8000000ULL) + (integral & 0x8000000ULL);
+    }
+
+    return PpcBitCastToDoubleInline(integral);
+}
+
+struct PpcEstimateEntryInline
+{
+    int32_t base;
+    int32_t decrement;
+};
+
+inline constexpr std::array<PpcEstimateEntryInline, 32> kPpcFresEstimateInline = {{
+    {0x7ff800, 0x3e1}, {0x783800, 0x3a7}, {0x70ea00, 0x371}, {0x6a0800, 0x340},
+    {0x638800, 0x313}, {0x5d6200, 0x2ea}, {0x579000, 0x2c4}, {0x520800, 0x2a0},
+    {0x4cc800, 0x27f}, {0x47ca00, 0x261}, {0x430800, 0x245}, {0x3e8000, 0x22a},
+    {0x3a2c00, 0x212}, {0x360800, 0x1fb}, {0x321400, 0x1e5}, {0x2e4a00, 0x1d1},
+    {0x2aa800, 0x1be}, {0x272c00, 0x1ac}, {0x23d600, 0x19b}, {0x209e00, 0x18b},
+    {0x1d8800, 0x17c}, {0x1a9000, 0x16e}, {0x17ae00, 0x15b}, {0x14f800, 0x15b},
+    {0x124400, 0x143}, {0x0fbe00, 0x143}, {0x0d3800, 0x12d}, {0x0ade00, 0x12d},
+    {0x088400, 0x11a}, {0x065000, 0x11a}, {0x041c00, 0x108}, {0x020c00, 0x106},
+}};
+
+inline double PpcApproximateReciprocalInline(double value)
+{
+    constexpr uint64_t kSign = 0x8000000000000000ULL;
+    constexpr uint64_t kExponent = 0x7FF0000000000000ULL;
+    constexpr uint64_t kFraction = 0x000FFFFFFFFFFFFFULL;
+    constexpr uint64_t kQuietBit = 0x0008000000000000ULL;
+    const uint64_t input = PpcBitCastToU64Inline(value);
+    const uint64_t mantissa = input & kFraction;
+    const uint64_t sign = input & kSign;
+    uint64_t exponent = input & kExponent;
+
+    if (mantissa == 0 && exponent == 0)
+        return PpcBitCastToDoubleInline(sign | kExponent);
+    if (exponent == kExponent)
+    {
+        if (mantissa == 0)
+            return PpcBitCastToDoubleInline(sign);
+        return PpcBitCastToDoubleInline(input | kQuietBit);
+    }
+    if (exponent < (uint64_t{895} << 52))
+        return std::copysign(static_cast<double>(std::numeric_limits<float>::max()), value);
+    if (exponent >= (uint64_t{1149} << 52))
+        return std::copysign(0.0, value);
+
+    exponent = (uint64_t{0x7FD} << 52) - exponent;
+    const int index = static_cast<int>(mantissa >> 37);
+    const auto& entry = kPpcFresEstimateInline[static_cast<size_t>(index / 1024)];
+    const int64_t estimate = static_cast<int64_t>(entry.base) -
+        (static_cast<int64_t>(entry.decrement) * (index % 1024) + 1) / 2;
+    return PpcBitCastToDoubleInline(
+        sign | exponent | (static_cast<uint64_t>(estimate) << 29));
+}
+
+// Broadway/Gekko frsqrte lookup table. These constants and the interpolation
+// below match the algorithm used by the checked-in Dolphin reference rather
+// than substituting an exact host reciprocal square root. This lives in the
+// header because frsqrte is emitted at 281 translated sites and an out-of-line
+// call is a full register barrier at each of them.
+inline constexpr std::array<PpcEstimateEntryInline, 32> kPpcFrsqrteEstimateInline = {{
+    {0x1a7e800, -0x568}, {0x17cb800, -0x4f3}, {0x1552800, -0x48d}, {0x130c000, -0x435},
+    {0x10f2000, -0x3e7}, {0x0eff000, -0x3a2}, {0x0d2e000, -0x365}, {0x0b7c000, -0x32e},
+    {0x09e5000, -0x2fc}, {0x0867000, -0x2d0}, {0x06ff000, -0x2a8}, {0x05ab800, -0x283},
+    {0x046a000, -0x261}, {0x0339800, -0x243}, {0x0218800, -0x226}, {0x0105800, -0x20b},
+    {0x3ffa000, -0x7a4}, {0x3c29000, -0x700}, {0x38aa000, -0x670}, {0x3572000, -0x5f2},
+    {0x3279000, -0x584}, {0x2fb7000, -0x524}, {0x2d26000, -0x4cc}, {0x2ac0000, -0x47e},
+    {0x2881000, -0x43a}, {0x2665000, -0x3fa}, {0x2468000, -0x3c2}, {0x2287000, -0x38e},
+    {0x20c1000, -0x35e}, {0x1f12000, -0x332}, {0x1d79000, -0x30a}, {0x1bf4000, -0x2e6},
+}};
+
+inline double PpcApproximateReciprocalSquareRootInline(double value)
+{
+    constexpr uint64_t kSign = 0x8000000000000000ULL;
+    constexpr uint64_t kExponent = 0x7FF0000000000000ULL;
+    constexpr uint64_t kFraction = 0x000FFFFFFFFFFFFFULL;
+    constexpr uint64_t kQuietBit = 0x0008000000000000ULL;
+    constexpr uint64_t kCanonicalQuietNaN = kExponent | kQuietBit;
+
+    const uint64_t input = PpcBitCastToU64Inline(value);
+    uint64_t mantissa = input & kFraction;
+    const uint64_t sign = input & kSign;
+    int64_t exponent = static_cast<int64_t>(input & kExponent);
+
+    if (mantissa == 0 && exponent == 0)
+    {
+        return PpcBitCastToDoubleInline(sign | kExponent);
+    }
+
+    if (static_cast<uint64_t>(exponent) == kExponent)
+    {
+        if (mantissa == 0)
+        {
+            return sign ? PpcBitCastToDoubleInline(kCanonicalQuietNaN) : 0.0;
+        }
+        return PpcBitCastToDoubleInline(input | kQuietBit);
+    }
+
+    if (sign != 0)
+    {
+        return PpcBitCastToDoubleInline(kCanonicalQuietNaN);
+    }
+
+    if (exponent == 0)
+    {
+        // Normalize a subnormal while allowing the signed exponent to extend
+        // below the IEEE-754 encoded range, exactly as the hardware estimate
+        // interpolation expects.
+        do
+        {
+            exponent -= int64_t{1} << 52;
+            mantissa <<= 1;
+        } while ((mantissa & (uint64_t{1} << 52)) == 0);
+        mantissa &= kFraction;
+        exponent += int64_t{1} << 52;
+    }
+
+    const int64_t exponentLsb = exponent & (int64_t{1} << 52);
+    exponent = (((int64_t{0x3FF} << 52) -
+                 ((exponent - (int64_t{0x3FE} << 52)) / 2)) &
+                static_cast<int64_t>(kExponent));
+
+    const int index = static_cast<int>(
+        (static_cast<uint64_t>(exponentLsb) | mantissa) >> 37);
+    const auto& entry = kPpcFrsqrteEstimateInline[static_cast<size_t>(index / 2048)];
+    const int64_t estimate =
+        static_cast<int64_t>(entry.base) +
+        static_cast<int64_t>(entry.decrement) * (index % 2048);
+    const uint64_t result = sign | static_cast<uint64_t>(exponent) |
+                            (static_cast<uint64_t>(estimate) << 26);
+    return PpcBitCastToDoubleInline(result);
+}
+
+// fctiwz: convert to a 32-bit signed integer with round-toward-zero and place
+// the result in the LOW 32 bits of the FPR. The upper 32 bits are
+// architecturally undefined; zero is what the hardware leaves in practice and
+// what stfd/lwz+4 sequences in guest code expect to read back.
+inline int32_t PpcClampIntegerWordInline(double value)
+{
+    if (std::isnan(value)) {
+        return static_cast<int32_t>(0x80000000u);
+    }
+    if (value >= 2147483647.0) {
+        return 2147483647;
+    }
+    if (value <= -2147483648.0) {
+        return static_cast<int32_t>(0x80000000u);
+    }
+    return static_cast<int32_t>(value);
+}
+
+inline double PpcPackIntegerWordInline(int32_t value)
+{
+    return PpcBitCastToDoubleInline(
+        static_cast<uint64_t>(static_cast<uint32_t>(value)));
+}
+
+template <bool Subtract>
+inline float PpcAccuratePsMaddLaneInline(float a, float c, float b)
+{
+    const float signedB = Subtract ? -b : b;
+    // Paired values are stored as exact float32 lanes in this runtime.  An
+    // explicit float FMA therefore matches Gekko's single rounding point;
+    // multiplying and adding separately can differ by an ULP on ordinary
+    // vector and matrix workloads.
+    return PpcFlushSingleForNiInline(std::fma(a, c, signedB));
+}
+
+template <bool Subtract>
+inline float PpcAccuratePsMaddLaneNoNiInline(float a, float c, float b)
+{
+    const float signedB = Subtract ? -b : b;
+    return std::fma(a, c, signedB);
+}
+
+template <bool Subtract>
+inline double PpcAccurateSingleMaddIntermediateInline(double a, double c, double b)
+{
+    // Gekko single-precision fused operations keep the full precision of A
+    // and B, round C to a 25-bit significand, and round only the final result
+    // to float32.  A double FMA is almost sufficient, but an exact result just
+    // beyond a float32 halfway point can be rounded to a double tie first.
+    // Recover the direction of that discarded error for those tie cases.
+    const double roundedC = PpcForce25BitInline(c);
+    const double signedB = Subtract ? -b : b;
+    double result = std::fma(a, roundedC, signedB);
+    const uint64_t resultBits = PpcBitCastToU64Inline(result);
+    constexpr uint64_t kDiscardedMask = 0x000000001FFFFFFFULL;
+    constexpr uint64_t kEvenTie = 0x0000000010000000ULL;
+    if ((resultBits & kDiscardedMask) == kEvenTie)
+    {
+        const double aPrime = signedB - result;
+        const double bPrime = result + aPrime;
+        const double deltaA = std::fma(a, roundedC, aPrime);
+        const double deltaB = signedB - bPrime;
+        const double error = deltaA + deltaB;
+        if (error != 0.0)
+        {
+            result = PpcBitCastToDoubleInline(
+                (error > 0.0) == (result > 0.0) ? resultBits + 1 : resultBits - 1);
+        }
+    }
+    return result;
+}
+
+inline double PpcFmulsInline(double a, double c)
+{
+    return static_cast<double>(
+        PpcForceSingleValueInline(a * PpcForce25BitInline(c)));
+}
+
+inline double PpcFmulsNoNiInline(double a, double c)
+{
+    return static_cast<double>(static_cast<float>(a * PpcForce25BitInline(c)));
+}
+
+inline double PpcFmaddInline(double a, double c, double b)
+{
+    return std::fma(a, c, b);
+}
+
+inline double PpcFmsubInline(double a, double c, double b)
+{
+    return std::fma(a, c, -b);
+}
+
+inline double PpcFnmaddInline(double a, double c, double b)
+{
+    const double result = std::fma(a, c, b);
+    return std::isnan(result) ? result : -result;
+}
+
+inline double PpcFnmsubInline(double a, double c, double b)
+{
+    const double result = std::fma(a, c, -b);
+    return std::isnan(result) ? result : -result;
+}
+
+inline double PpcFmaddsInline(double a, double c, double b)
+{
+    return static_cast<double>(
+        PpcForceSingleValueInline(PpcAccurateSingleMaddIntermediateInline<false>(a, c, b)));
+}
+
+inline double PpcFmsubsInline(double a, double c, double b)
+{
+    return static_cast<double>(
+        PpcForceSingleValueInline(PpcAccurateSingleMaddIntermediateInline<true>(a, c, b)));
+}
+
+inline double PpcFnmaddsInline(double a, double c, double b)
+{
+    const float result = PpcForceSingleValueInline(
+        PpcAccurateSingleMaddIntermediateInline<false>(a, c, b));
+    return static_cast<double>(std::isnan(result) ? result : -result);
+}
+
+inline double PpcFnmsubsInline(double a, double c, double b)
+{
+    const float result = PpcForceSingleValueInline(
+        PpcAccurateSingleMaddIntermediateInline<true>(a, c, b));
+    return static_cast<double>(std::isnan(result) ? result : -result);
+}
+
+inline double PPC_PsMulInline(double lhs, double rhs)
+{
+    return PpcFlushPairedForNiInline(
+        PpcM128ToPsInline(_mm_mul_ps(PpcPsToM128Inline(lhs), PpcPsToM128Inline(rhs))));
+}
+
+inline double PPC_PsMulNoNiInline(double lhs, double rhs)
+{
+    return PpcM128ToPsInline(_mm_mul_ps(PpcPsToM128Inline(lhs), PpcPsToM128Inline(rhs)));
+}
+
+// The paired madd family lowers to one hardware FMA. Semantics match the scalar lanes exactly: a
+// single fused rounding per lane (std::fma(float) == vfmaddps per lane), and
+// the negate-unless-NaN behavior of the nmadd/nmsub forms is expressed with
+// PpcNegateNonNanLanesInline. NI flushing is handled by MXCSR (see
+// MkwApplyHostNiMode), so the NI and NoNi entry points are identical here.
+
+inline double PPC_PsMsubInline(double multiplicand, double multiplier, double subtractor)
+{
+    return PpcM128ToPsInline(_mm_fmsub_ps(
+        PpcPsToM128Inline(multiplicand), PpcPsToM128Inline(multiplier), PpcPsToM128Inline(subtractor)));
+}
+
+inline double PPC_PsMsubNoNiInline(double multiplicand, double multiplier, double subtractor)
+{
+    return PPC_PsMsubInline(multiplicand, multiplier, subtractor);
+}
+
+inline double PPC_PsMaddInline(double multiplicand, double multiplier, double addend)
+{
+    return PpcM128ToPsInline(_mm_fmadd_ps(
+        PpcPsToM128Inline(multiplicand), PpcPsToM128Inline(multiplier), PpcPsToM128Inline(addend)));
+}
+
+inline double PPC_PsMaddNoNiInline(double multiplicand, double multiplier, double addend)
+{
+    return PPC_PsMaddInline(multiplicand, multiplier, addend);
+}
+
+inline double PPC_PsMadds0Inline(double multiplicand, double multiplier, double addend)
+{
+    return PpcM128ToPsInline(_mm_fmadd_ps(
+        PpcPsToM128Inline(multiplicand), PpcBroadcastPs0Inline(multiplier), PpcPsToM128Inline(addend)));
+}
+
+inline double PPC_PsMadds1Inline(double multiplicand, double multiplier, double addend)
+{
+    return PpcM128ToPsInline(_mm_fmadd_ps(
+        PpcPsToM128Inline(multiplicand), PpcBroadcastPs1Inline(multiplier), PpcPsToM128Inline(addend)));
+}
+
+inline double PPC_PsNmsubInline(double multiplicand, double multiplier, double subtractor)
+{
+    return PpcM128ToPsInline(PpcNegateNonNanLanesInline(_mm_fmsub_ps(
+        PpcPsToM128Inline(multiplicand), PpcPsToM128Inline(multiplier), PpcPsToM128Inline(subtractor))));
+}
+
+inline double PPC_PsNmsubNoNiInline(double multiplicand, double multiplier, double subtractor)
+{
+    return PPC_PsNmsubInline(multiplicand, multiplier, subtractor);
+}
+
+inline double PPC_PsNmaddInline(double multiplicand, double multiplier, double addend)
+{
+    return PpcM128ToPsInline(PpcNegateNonNanLanesInline(_mm_fmadd_ps(
+        PpcPsToM128Inline(multiplicand), PpcPsToM128Inline(multiplier), PpcPsToM128Inline(addend))));
+}
+
+inline double PPC_PsMuls0Inline(double aValue, double cValue)
+{
+    return PpcFlushPairedForNiInline(PpcM128ToPsInline(
+        _mm_mul_ps(PpcPsToM128Inline(aValue), PpcBroadcastPs0Inline(cValue))));
+}
+
+inline double PPC_PsMuls1Inline(double aValue, double cValue)
+{
+    return PpcFlushPairedForNiInline(PpcM128ToPsInline(
+        _mm_mul_ps(PpcPsToM128Inline(aValue), PpcBroadcastPs1Inline(cValue))));
+}
+
+inline PPC_FPR PpcMakePairedResultInline(float ps0, float ps1);
+
+inline double PPC_PsFromScalarInline(double value)
+{
+    // Representation conversion, not an architectural operation: Gekko has no
+    // "scalar to paired" instruction, so there is no NI rounding point here.
+    // If the scalar is a single-denormal it stays one; MXCSR.DAZ flushes it as
+    // an input at the next real arithmetic op, exactly like the hardware.
+    const float single = static_cast<float>(value);
+    return PpcPackPairedInline(single, single);
+}
+
+inline double PPC_PsFromScalarNoNiInline(double value)
+{
+    const float single = static_cast<float>(value);
+    return PpcPackPairedInline(single, single);
+}
+
+inline double PPC_PsToScalarInline(double value)
+{
+    return static_cast<double>(PpcGetPs0Inline(value));
+}
+
+// ps_merge* are pure lane selections (result.ps0 from frA, result.ps1 from frB); with lane 0
+// == ps1 and lane 1 == ps0, two shuffles build the result bit-exact instead of round-tripping
+// through the pack helper.
+inline double PPC_PsMerge00Inline(double aValue, double bValue)
+{
+    // lane0 = b.ps0 (b lane 1), lane1 = a.ps0 (a lane 1)
+    const __m128 gathered = _mm_shuffle_ps(
+        PpcPsToM128Inline(bValue), PpcPsToM128Inline(aValue), _MM_SHUFFLE(1, 1, 1, 1));
+    return PpcM128ToPsInline(_mm_shuffle_ps(gathered, gathered, _MM_SHUFFLE(0, 0, 2, 0)));
+}
+
+inline double PPC_PsMerge01Inline(double aValue, double bValue)
+{
+    // lane0 = b.ps1 (b lane 0), lane1 = a.ps0 (a lane 1)
+    const __m128 gathered = _mm_shuffle_ps(
+        PpcPsToM128Inline(bValue), PpcPsToM128Inline(aValue), _MM_SHUFFLE(1, 1, 0, 0));
+    return PpcM128ToPsInline(_mm_shuffle_ps(gathered, gathered, _MM_SHUFFLE(0, 0, 2, 0)));
+}
+
+inline double PPC_PsMerge10Inline(double aValue, double bValue)
+{
+    // lane0 = b.ps0 (b lane 1), lane1 = a.ps1 (a lane 0)
+    const __m128 gathered = _mm_shuffle_ps(
+        PpcPsToM128Inline(bValue), PpcPsToM128Inline(aValue), _MM_SHUFFLE(0, 0, 1, 1));
+    return PpcM128ToPsInline(_mm_shuffle_ps(gathered, gathered, _MM_SHUFFLE(0, 0, 2, 0)));
+}
+
+inline double PPC_PsMerge11Inline(double aValue, double bValue)
+{
+    // lane0 = b.ps1 (b lane 0), lane1 = a.ps1 (a lane 0): plain unpcklps.
+    return PpcM128ToPsInline(
+        _mm_unpacklo_ps(PpcPsToM128Inline(bValue), PpcPsToM128Inline(aValue)));
+}
+
+inline double PPC_PsAddInline(double aValue, double bValue)
+{
+    return PpcFlushPairedForNiInline(
+        PpcM128ToPsInline(_mm_add_ps(PpcPsToM128Inline(aValue), PpcPsToM128Inline(bValue))));
+}
+
+inline double PPC_PsAddNoNiInline(double aValue, double bValue)
+{
+    return PpcM128ToPsInline(
+        _mm_add_ps(PpcPsToM128Inline(aValue), PpcPsToM128Inline(bValue)));
+}
+
+inline double PPC_PsSelInline(double lhsValue, double controlValue, double rhsValue)
+{
+    const float lhs0 = PpcGetPs0Inline(lhsValue);
+    const float lhs1 = PpcGetPs1Inline(lhsValue);
+    const float control0 = PpcGetPs0Inline(controlValue);
+    const float control1 = PpcGetPs1Inline(controlValue);
+    const float rhs0 = PpcGetPs0Inline(rhsValue);
+    const float rhs1 = PpcGetPs1Inline(rhsValue);
+    return PpcPackPairedInline(
+        control0 >= -0.0f ? lhs0 : rhs0,
+        control1 >= -0.0f ? lhs1 : rhs1);
+}
+
+inline double PPC_PsSubInline(double aValue, double bValue)
+{
+    return PpcFlushPairedForNiInline(
+        PpcM128ToPsInline(_mm_sub_ps(PpcPsToM128Inline(aValue), PpcPsToM128Inline(bValue))));
+}
+
+inline double PPC_PsSubNoNiInline(double aValue, double bValue)
+{
+    return PpcM128ToPsInline(
+        _mm_sub_ps(PpcPsToM128Inline(aValue), PpcPsToM128Inline(bValue)));
+}
+
+inline double PPC_PsDivInline(double aValue, double bValue)
+{
+    return PpcFlushPairedForNiInline(
+        PpcM128ToPsInline(_mm_div_ps(PpcPsToM128Inline(aValue), PpcPsToM128Inline(bValue))));
+}
+
+inline double PPC_PsNegInline(double value)
+{
+    return PpcPackPairedInline(-PpcGetPs0Inline(value), -PpcGetPs1Inline(value));
+}
+
+inline double PPC_PsAbsInline(double value)
+{
+    return PpcPackPairedInline(std::abs(PpcGetPs0Inline(value)), std::abs(PpcGetPs1Inline(value)));
+}
+
+inline double PPC_PsSum0Inline(double aValue, double bValue, double cValue)
+{
+    return PpcPackPairedInline(
+        PpcForceSingleValueInline(static_cast<double>(PpcGetPs0Inline(aValue)) + PpcGetPs1Inline(bValue)),
+        PpcFlushSingleForNiInline(PpcGetPs1Inline(cValue)));
+}
+
+inline double PPC_PsSum1Inline(double aValue, double bValue, double cValue)
+{
+    return PpcPackPairedInline(
+        PpcFlushSingleForNiInline(PpcGetPs0Inline(cValue)),
+        PpcForceSingleValueInline(static_cast<double>(PpcGetPs0Inline(aValue)) + PpcGetPs1Inline(bValue)));
+}
+
+inline uint32_t PpcConvertToSingleFTZInline(uint64_t value)
+{
+    const uint32_t exp = static_cast<uint32_t>((value >> 52) & 0x7FFu);
+    if (exp > 896u || (value & 0x7FFFFFFFFFFFFFFFULL) == 0)
+    {
+        return static_cast<uint32_t>(((value >> 32) & 0xC0000000ULL) |
+                                     ((value >> 29) & 0x3FFFFFFFULL));
+    }
+
+    return static_cast<uint32_t>((value >> 32) & 0x80000000ULL);
+}
+
+inline uint64_t PpcConvertToDoubleBitsInline(uint32_t value)
+{
+    uint64_t x = value;
+    uint64_t exp = (x >> 23) & 0xFFu;
+    uint64_t frac = x & 0x007FFFFFu;
+
+    if (exp > 0 && exp < 255)
+    {
+        const uint64_t y = !(exp >> 7);
+        const uint64_t z = (y << 61) | (y << 60) | (y << 59);
+        return ((x & 0xC0000000ULL) << 32) | z | ((x & 0x3FFFFFFFULL) << 29);
+    }
+
+    if (exp == 0 && frac != 0)
+    {
+        exp = 1023 - 126;
+        do
+        {
+            frac <<= 1;
+            --exp;
+        } while ((frac & 0x00800000u) == 0);
+
+        return ((x & 0x80000000ULL) << 32) | (exp << 52) | ((frac & 0x007FFFFFULL) << 29);
+    }
+
+    const uint64_t y = exp >> 7;
+    const uint64_t z = (y << 61) | (y << 60) | (y << 59);
+    return ((x & 0xC0000000ULL) << 32) | z | ((x & 0x3FFFFFFFULL) << 29);
+}
+
+inline double PpcPackPairedBitsInline(uint32_t ps0, uint32_t ps1)
+{
+    return PpcBitCastToDoubleInline((static_cast<uint64_t>(ps0) << 32) | ps1);
+}
+
+inline PPC_FPR PpcMakePairedResultInline(float ps0, float ps1)
+{
+    PPC_FPR result{};
+    result.paired.ps0 = ps0;
+    result.paired.ps1 = ps1;
+    return result;
+}
+
+extern "C" void PPC_Mtfsf(uint32_t fieldMask, double source);
+extern "C" void PPC_Mtfsfi(uint32_t field, uint32_t value);
+extern "C" void PPC_Mtfsb0(uint32_t bit);
+extern "C" void PPC_Mtfsb1(uint32_t bit);
+extern "C" double PPC_Mffs();
+
+extern "C" double PPC_PsAdd(double lhs, double rhs);
+extern "C" double PPC_PsSub(double lhs, double rhs);
+extern "C" double PPC_PsDiv(double lhs, double rhs);
+extern "C" double PPC_PsNeg(double value);
+extern "C" double PPC_PsMul(double lhs, double rhs);
+extern "C" double PPC_PsMsub(double lhs, double mul, double sub);
+extern "C" double PPC_PsMadd(double lhs, double mul, double add);
+extern "C" double PPC_PsNmsub(double lhs, double mul, double sub);
+extern "C" double PPC_PsMadds0(double lhs, double mul, double add);
+extern "C" double PPC_PsMadds1(double lhs, double mul, double add);
+extern "C" double PPC_PsNmadd(double lhs, double mul, double add);
+extern "C" double PPC_PsSel(double lhs, double control, double rhs);
+// ps_res is hot in the THP dequant path (148 static call sites in the IDCT
+// region); the out-of-line definition cost a call + full spill barrier per
+// use, so it is defined inline here. The estimate logic is byte-identical to
+// the old ppc_helpers.cpp body (both used PpcApproximateReciprocalInline).
+extern "C" inline double PPC_PsRes(double value)
+{
+    const float ps0 = static_cast<float>(
+        PpcApproximateReciprocalInline(static_cast<double>(PpcGetPs0Inline(value))));
+    const float ps1 = static_cast<float>(
+        PpcApproximateReciprocalInline(static_cast<double>(PpcGetPs1Inline(value))));
+    return PpcPackPairedInline(ps0, ps1);
+}
+
+extern "C" double PPC_PsRsqrte(double value);
+// Pack a scalar double into a paired-single FPR value (ps0=ps1=float(value)).
+extern "C" double PPC_PsFromScalar(double value);
+// Extract the ps0 lane as a scalar double (used to feed single-precision ops).
+extern "C" double PPC_PsToScalar(double value);
+extern "C" double PPC_PsMerge00(double a, double b);
+extern "C" double PPC_PsMerge01(double a, double b);
+extern "C" double PPC_PsMerge10(double a, double b);
+extern "C" double PPC_PsMerge11(double a, double b);
+extern "C" double PPC_Fsqrt(double value);
+
+// Hot scalar float helpers, defined inline so the compiler can see through them instead of
+// taking a cross-TU caller-saved register barrier at ~2,500 call sites in the hottest float
+// code in the game (bodies moved verbatim from ppc_helpers.cpp/fpu_helpers.cpp). PPC_PsRes
+// above uses the same pattern.
+
+extern "C" inline double PPC_Fres(double value)
+{
+    // The generated paired/scalar boundary presents fres as a packed input and
+    // expects its architecturally replicated single result in the same format.
+    const float result = static_cast<float>(
+        PpcApproximateReciprocalInline(static_cast<double>(PpcGetPs0Inline(value))));
+    return PpcPackPairedInline(result, result);
+}
+
+extern "C" inline double PPC_Frsqrte(double value)
+{
+    // frsqrte (opcode 63) takes the full scalar-double input (generated code normalizes
+    // scalar/paired ownership beforehand) and returns exact Gekko estimate bits only; FPSCR/
+    // Rc/FPRF updates need instruction-level context this value-only helper doesn't have.
+    return PpcApproximateReciprocalSquareRootInline(value);
+}
+
+extern "C" inline double PPC_Fsel(double control, double negative, double positive)
+{
+    // Dolphin models fsel/ps_sel as "fra >= -0.0 ? frC : frB".
+    // That comparison deliberately sends unordered/NaN controls to frB.
+    return (control >= -0.0) ? positive : negative;
+}
+
+// PowerPC fctiwz instruction: Float Convert to Integer Word with Round toward
+// Zero. The result goes in the LOWER 32 bits of the FPR (bits 32-63); the upper
+// 32 bits are undefined. When the value is stored via stfd and reloaded via lwz
+// at offset +4, the integer is correctly retrieved.
+extern "C" inline double PPC_Fctiwz(double value)
+{
+    return PpcPackIntegerWordInline(PpcClampIntegerWordInline(value));
+}
+
+extern "C" double PPC_Fmadd(double multiplicand, double multiplier, double addend);
+extern "C" double PPC_Fmsub(double multiplicand, double multiplier, double subtractor);
+extern "C" double PPC_Fnmadd(double multiplicand, double multiplier, double addend);
+extern "C" double PPC_Fnmsub(double multiplicand, double multiplier, double subtractor);
+// Single-precision scalar helpers (fadds/fsubs/fmuls/fdivs and fused variants).
+extern "C" double PPC_Fadds(double a, double b);
+extern "C" double PPC_Fsubs(double a, double b);
+extern "C" double PPC_Fmuls(double a, double b);
+extern "C" double PPC_Fdivs(double a, double b);
+// The fused single-precision family is a thin wrapper over the Ppc*Inline
+// bodies above; keeping the wrapper out of line meant the wrapper itself was
+// the register barrier. See the block at PPC_Fres for why there is no LTO to
+// fall back on.
+extern "C" inline double PPC_Fmadds(double multiplicand, double multiplier, double addend)
+{
+    return PpcFmaddsInline(multiplicand, multiplier, addend);
+}
+
+extern "C" inline double PPC_Fmsubs(double multiplicand, double multiplier, double subtractor)
+{
+    return PpcFmsubsInline(multiplicand, multiplier, subtractor);
+}
+
+extern "C" inline double PPC_Fnmadds(double multiplicand, double multiplier, double addend)
+{
+    return PpcFnmaddsInline(multiplicand, multiplier, addend);
+}
+
+extern "C" inline double PPC_Fnmsubs(double multiplicand, double multiplier, double subtractor)
+{
+    return PpcFnmsubsInline(multiplicand, multiplier, subtractor);
+}
+
+extern "C" double PPC_Fctiw(double value);   // Convert float to int using FPSCR rounding mode
+extern "C" void PPC_Stfiwx(uint32_t addr, double fprValue);  // Store Float as Integer Word (indexed)
+extern "C" double PPC_PsSum0(double a, double b, double c);
+extern "C" double PPC_PsSum1(double a, double b, double c);
+extern "C" double PPC_PsMuls0(double a, double c);
+extern "C" double PPC_PsMuls1(double a, double c);
+extern "C" double PPC_PsAbs(double value);
+
+// Floating-point comparison helper (fcmpu/fcmpo)
+extern "C" void PPC_Fcmp(uint32_t crField, double a, double b);
+extern "C" void PPC_PsCmpo0(uint32_t crField, double a, double b);
+extern "C" void PPC_PsCmpu0(uint32_t crField, double a, double b);
+extern "C" void PPC_PsCmpo1(uint32_t crField, double a, double b);
+extern "C" void PPC_PsCmpu1(uint32_t crField, double a, double b);
+extern "C" double PPC_PsNabs(double value);
+extern "C" double PPC_PsMr(double value);
diff --git a/runtime/include/isa/ppc_isa_fpenv.h b/runtime/include/isa/ppc_isa_fpenv.h
new file mode 100644
index 0000000..75a29bc
--- /dev/null
+++ b/runtime/include/isa/ppc_isa_fpenv.h
@@ -0,0 +1,53 @@
+#pragma once
+// FPSCR[NI] (non-IEEE flush-to-zero) modeled on the host FP environment, plus
+// the thread-local mirror of that state the hot paths read instead of MXCSR.
+
+#include "ppc_isa_config.h"
+
+#include <cstdint>
+
+// Software-flushing Gekko's single-precision denormals per op roughly doubled the THP IDCT
+// kernel's cycle count, so instead the runtime mirrors guest FPSCR[NI] into host MXCSR FTZ+DAZ
+// wherever FPSCR can change (PPC_Mtfs*, fiber context switches, CpuContextScope), making per-op
+// flushes free. Accepted deviations (same trade Dolphin makes): FTZ also flushes double
+// denormals unlike real NI, and a pre-round-flush edge near FLT_MIN rounds via cvtsd2ss instead.
+inline constexpr uint32_t kMkwMxcsrFlushToZeroBits = (1u << 15) | (1u << 6); // FTZ | DAZ
+
+
+inline thread_local bool g_mkwHostNiActive = false;
+
+// Same state in the form PpcForceSingleValueInline consumes: the pre-round subnormal threshold
+// while NI is active, 0.0 (identity, `|value| < 0.0` is always false) otherwise, so that path
+// needs no branch. Every writer of g_mkwHostNiActive must write this beside it in agreement.
+inline constexpr double kMkwNiFlushThreshold = 0x1p-126;  // 0x3810000000000000
+inline thread_local double g_mkwNiFlushThreshold = 0.0;
+
+inline void MkwApplyHostNiMode(uint32_t fpscr) noexcept
+{
+    const uint32_t csr = _mm_getcsr();
+    const bool wantNi = (fpscr & 0x4u) != 0;
+    const uint32_t want = wantNi
+        ? (csr | kMkwMxcsrFlushToZeroBits)
+        : (csr & ~kMkwMxcsrFlushToZeroBits);
+    if (want != csr)
+        _mm_setcsr(want);
+    // `want` has both bits set or both clear, so this is exactly
+    // `(_mm_getcsr() & kMkwMxcsrFlushToZeroBits) != 0` after the write - the
+    // mirror cannot disagree with the register even if the incoming CSR held
+    // only one of the two bits.
+    g_mkwHostNiActive = wantNi;
+    g_mkwNiFlushThreshold = wantNi ? kMkwNiFlushThreshold : 0.0;
+}
+
+/// <summary>
+/// Restores a previously captured MXCSR value and re-derives the mirror from
+/// it. Every raw restore has to go through here; a bare _mm_setcsr would leave
+/// the mirror describing the FP environment that was just replaced.
+/// </summary>
+inline void MkwRestoreHostMxcsr(uint32_t csr) noexcept
+{
+    _mm_setcsr(csr);
+    const bool niActive = (csr & kMkwMxcsrFlushToZeroBits) != 0;
+    g_mkwHostNiActive = niActive;
+    g_mkwNiFlushThreshold = niActive ? kMkwNiFlushThreshold : 0.0;
+}
diff --git a/runtime/include/isa/ppc_isa_int.h b/runtime/include/isa/ppc_isa_int.h
new file mode 100644
index 0000000..a9e93cc
--- /dev/null
+++ b/runtime/include/isa/ppc_isa_int.h
@@ -0,0 +1,127 @@
+#pragma once
+// Pure integer PowerPC semantics, together with the declarations of the
+// integer, condition/SPR and system helpers the host runtime implements out of
+// line. Nothing here depends on another isa/ header beyond the configuration.
+
+#include "ppc_isa_config.h"
+
+#include <cstdint>
+#include <cstdlib>
+#include <limits>
+
+inline uint32_t PpcRotl32Inline(uint32_t value, uint32_t shift)
+{
+    return __builtin_rotateleft32(value, shift);
+}
+
+extern "C" uint32_t OSSystemCall();
+extern "C" int32_t memset_zero_32(int32_t address);
+extern "C" void OS_HLE_ProcessAlarms(int maxToProcess);
+
+extern "C" uint32_t PPC_Mcrxr(uint32_t crField);
+extern "C" uint32_t PPC_ReadSpr(uint32_t spr);
+extern "C" void PPC_WriteSpr(uint32_t spr, uint32_t value);
+extern "C" uint32_t PPC_CrSetBit(uint32_t bitIndex, uint32_t value);
+extern "C" uint32_t PPC_CrLogical(uint32_t op, uint32_t bt, uint32_t ba, uint32_t bb);
+extern "C" uint32_t PPC_Mcrf(uint32_t dstField, uint32_t srcField);
+
+// Time base helpers (PowerPC 'mftb' / 'mftbu') - declared so generated code can call them.
+extern "C" uint32_t PPC_Mftb();
+extern "C" uint32_t PPC_Mftbu();
+
+// Carry helpers used by translated arithmetic that depends on XER[CA].
+extern "C" uint32_t PPC_UpdateCarryAdd(uint32_t lhs, uint32_t rhs, uint32_t carryIn);
+extern "C" uint32_t PPC_UpdateCarrySub(uint32_t lhs, uint32_t rhs);
+extern "C" uint32_t PPC_UpdateCarryShiftRight(uint32_t value, uint32_t shift);
+extern "C" uint32_t PPC_GetCarry();
+extern "C" uint32_t PPC_Addo(uint32_t lhs, uint32_t rhs);
+extern "C" uint32_t PPC_Addco(uint32_t lhs, uint32_t rhs);
+extern "C" uint32_t PPC_Addeo(uint32_t lhs, uint32_t rhs);
+extern "C" uint32_t PPC_Addmeo(uint32_t value);
+extern "C" uint32_t PPC_Addzeo(uint32_t value);
+extern "C" uint32_t PPC_Subfo(uint32_t subtrahend, uint32_t minuend);
+extern "C" uint32_t PPC_Subfco(uint32_t subtrahend, uint32_t minuend);
+extern "C" uint32_t PPC_Subfeo(uint32_t subtrahend, uint32_t minuend);
+extern "C" uint32_t PPC_Subfmeo(uint32_t value);
+extern "C" uint32_t PPC_Subfzeo(uint32_t value);
+extern "C" uint32_t PPC_Nego(uint32_t value);
+extern "C" uint32_t PPC_Mullwo(uint32_t lhs, uint32_t rhs);
+extern "C" uint32_t PPC_Divwo(uint32_t lhs, uint32_t rhs);
+extern "C" uint32_t PPC_Divwuo(uint32_t lhs, uint32_t rhs);
+extern "C" void PPC_Lswi(uint32_t rD, uint32_t addr, uint32_t byteCount);
+extern "C" void PPC_Lswx(uint32_t rD, uint32_t addr);
+extern "C" void PPC_Stswi(uint32_t rS, uint32_t addr, uint32_t byteCount);
+extern "C" void PPC_Stswx(uint32_t rS, uint32_t addr);
+extern "C" uint32_t PPC_Lwarx(uint32_t addr);
+extern "C" uint32_t PPC_Stwcx(uint32_t addr, uint32_t value);
+extern "C" uint32_t PPC_Mcrfs(uint32_t dstField, uint32_t srcField);
+extern "C" uint32_t PPC_Eciwx(uint32_t addr);
+extern "C" void PPC_Ecowx(uint32_t addr, uint32_t value);
+extern "C" void PPC_TrapWord(uint32_t trapOptions, uint32_t lhs, uint32_t rhs);
+extern "C" uint32_t PPC_Cntlzw(uint32_t value);
+
+MKW_PPC_FORCE_INLINE uint32_t PPC_CntlzwInline(uint32_t value)
+{
+    return value == 0 ? 32u : static_cast<uint32_t>(__builtin_clz(value));
+}
+
+// Byte-reverse helpers (PowerPC 'lwbrx' / 'stwbrx' / 'lhbrx' / 'sthbrx')
+extern "C" uint32_t PPC_LoadWordByteReverse(uint32_t addr);
+extern "C" void PPC_StoreWordByteReverse(uint32_t addr, uint32_t value);
+extern "C" uint32_t PPC_LoadHalfwordByteReverse(uint32_t addr);
+extern "C" void PPC_StoreHalfwordByteReverse(uint32_t addr, uint32_t value);
+
+template <typename T>
+inline int32_t CompareUnsigned(T a, T b) {
+    uint32_t ua = static_cast<uint32_t>(a);
+    uint32_t ub = static_cast<uint32_t>(b);
+    if (ua < ub) return -1;
+    if (ua > ub) return 1;
+    return 0;
+}
+
+template <int Bits>
+inline int32_t SignExtend(uint32_t val) {
+    struct { int32_t x : Bits; } s;
+    s.x = val;
+    return s.x;
+}
+
+inline int32_t ArithmeticShiftRight(int32_t val, int amount) {
+    return val >> amount;
+}
+
+inline uint32_t PPC_Slw(uint32_t value, uint32_t amount)
+{
+    return (amount & 0x20u) != 0 ? 0u : value << (amount & 0x1Fu);
+}
+
+inline uint32_t PPC_Srw(uint32_t value, uint32_t amount)
+{
+    return (amount & 0x20u) != 0 ? 0u : value >> (amount & 0x1Fu);
+}
+
+inline uint32_t PPC_Sraw(uint32_t value, uint32_t amount)
+{
+    if ((amount & 0x20u) != 0)
+    {
+        return (value & 0x80000000u) != 0 ? 0xFFFFFFFFu : 0u;
+    }
+
+    return static_cast<uint32_t>(static_cast<int32_t>(value) >> (amount & 0x1Fu));
+}
+
+inline uint32_t PPC_Divwu(uint32_t dividend, uint32_t divisor)
+{
+    // Gekko does not raise a program exception for non-OE division by zero.
+    // Match the hardware result used by Dolphin's interpreter/JIT.
+    return divisor == 0 ? 0u : dividend / divisor;
+}
+
+inline int32_t PPC_Divw(int32_t dividend, int32_t divisor)
+{
+    if (divisor == 0 || (dividend == std::numeric_limits<int32_t>::min() && divisor == -1))
+        return dividend < 0 ? -1 : 0;
+
+    return dividend / divisor;
+}
diff --git a/runtime/include/isa/ppc_isa_quantized.h b/runtime/include/isa/ppc_isa_quantized.h
new file mode 100644
index 0000000..949197a
--- /dev/null
+++ b/runtime/include/isa/ppc_isa_quantized.h
@@ -0,0 +1,1783 @@
+#pragma once
+
+
+#include "ppc_isa_config.h"
+#include "ppc_isa_context.h"
+#include "ppc_isa_float.h"
+#include "big_endian.h"
+
+#include "ppc_isa_memory.h"
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <cstdlib>
+#include <limits>
+#include <type_traits>
+#include <utility>
+
+
+inline uint32_t PpcLoadPsqFloatBitsInline(uint32_t value)
+{
+    const uint32_t magnitude = value & 0x7FFFFFFFu;
+    if (magnitude > 0x7F800000u)
+        return value | 0x00400000u;
+    return value;
+}
+
+inline uint32_t PpcStorePsqFloatBitsInline(uint32_t value)
+{
+    const uint32_t magnitude = value & 0x7FFFFFFFu;
+    if (magnitude < 0x00800000u)
+        return value & 0x80000000u;
+    if (magnitude > 0x7F800000u)
+        return value | 0x00400000u;
+    return value;
+}
+
+
+inline uint64_t PpcLoadPairPsqFloatBitsPackedInline(uint64_t value)
+{
+    const __m128i lanes = _mm_cvtsi64_si128(static_cast<long long>(value));
+    const __m128i magnitude = _mm_and_si128(lanes, _mm_set1_epi32(0x7FFFFFFF));
+    const __m128i nanMask = _mm_cmpgt_epi32(magnitude, _mm_set1_epi32(0x7F800000));
+    const __m128i result = _mm_or_si128(
+        lanes, _mm_and_si128(nanMask, _mm_set1_epi32(0x00400000)));
+    return static_cast<uint64_t>(_mm_cvtsi128_si64(result));
+}
+
+inline uint64_t PpcStorePairPsqFloatBitsPackedInline(uint64_t value)
+{
+    const __m128i lanes = _mm_cvtsi64_si128(static_cast<long long>(value));
+    const __m128i magnitude = _mm_and_si128(lanes, _mm_set1_epi32(0x7FFFFFFF));
+    const __m128i subnormalMask = _mm_cmplt_epi32(magnitude, _mm_set1_epi32(0x00800000));
+    const __m128i nanMask = _mm_cmpgt_epi32(magnitude, _mm_set1_epi32(0x7F800000));
+    const __m128i quieted = _mm_or_si128(
+        lanes, _mm_and_si128(nanMask, _mm_set1_epi32(0x00400000)));
+    const __m128i signedZero = _mm_and_si128(
+        lanes, _mm_set1_epi32(std::numeric_limits<int32_t>::min()));
+    const __m128i result = _mm_or_si128(
+        _mm_and_si128(subnormalMask, signedZero),
+        _mm_andnot_si128(subnormalMask, quieted));
+    return static_cast<uint64_t>(_mm_cvtsi128_si64(result));
+}
+
+inline __m128i PpcPsqSwapPairBytesInline(__m128i lanes)
+{
+    const __m128i order = _mm_setr_epi8(
+        static_cast<char>(7), static_cast<char>(6), static_cast<char>(5), static_cast<char>(4),
+        static_cast<char>(3), static_cast<char>(2), static_cast<char>(1), static_cast<char>(0),
+        static_cast<char>(0x80), static_cast<char>(0x80), static_cast<char>(0x80), static_cast<char>(0x80),
+        static_cast<char>(0x80), static_cast<char>(0x80), static_cast<char>(0x80), static_cast<char>(0x80));
+    return _mm_shuffle_epi8(lanes, order);
+}
+
+// Lane-local sNaN quieting; identical rule to PpcLoadPairPsqFloatBitsPackedInline.
+inline __m128i PpcLoadPairPsqFloatBitsLanesInline(__m128i lanes)
+{
+    const __m128i magnitude = _mm_and_si128(lanes, _mm_set1_epi32(0x7FFFFFFF));
+    const __m128i nanMask = _mm_cmpgt_epi32(magnitude, _mm_set1_epi32(0x7F800000));
+    return _mm_or_si128(lanes, _mm_and_si128(nanMask, _mm_set1_epi32(0x00400000)));
+}
+
+// Lane-local denormal flush + sNaN quieting; identical rule to
+// PpcStorePairPsqFloatBitsPackedInline.
+inline __m128i PpcStorePairPsqFloatBitsLanesInline(__m128i lanes)
+{
+    const __m128i magnitude = _mm_and_si128(lanes, _mm_set1_epi32(0x7FFFFFFF));
+    const __m128i subnormalMask = _mm_cmplt_epi32(magnitude, _mm_set1_epi32(0x00800000));
+    const __m128i nanMask = _mm_cmpgt_epi32(magnitude, _mm_set1_epi32(0x7F800000));
+    const __m128i quieted = _mm_or_si128(
+        lanes, _mm_and_si128(nanMask, _mm_set1_epi32(0x00400000)));
+    const __m128i signedZero = _mm_and_si128(
+        lanes, _mm_set1_epi32(std::numeric_limits<int32_t>::min()));
+    return _mm_or_si128(
+        _mm_and_si128(subnormalMask, signedZero),
+        _mm_andnot_si128(subnormalMask, quieted));
+}
+
+// host -> packed FPR double, guard already proven by the caller.
+inline double PpcLoadPairPsqFloatFromHostInline(const uint8_t* host)
+{
+    const __m128i raw = _mm_loadl_epi64(reinterpret_cast<const __m128i*>(host));
+    return PpcM128ToPsInline(_mm_castsi128_ps(
+        PpcLoadPairPsqFloatBitsLanesInline(PpcPsqSwapPairBytesInline(raw))));
+}
+
+// packed FPR double -> host, guard already proven by the caller.
+inline void PpcStorePairPsqFloatToHostInline(uint8_t* host, double value)
+{
+    const __m128i lanes = PpcStorePairPsqFloatBitsLanesInline(
+        _mm_castps_si128(PpcPsToM128Inline(value)));
+    _mm_storel_epi64(reinterpret_cast<__m128i*>(host), PpcPsqSwapPairBytesInline(lanes));
+}
+
+template <typename SignedType>
+inline SignedType PpcScaleAndClampPsqInline(float value, uint32_t scale)
+{
+    if (scale == 0u)
+    {
+        constexpr float kMin = static_cast<float>(std::numeric_limits<SignedType>::min());
+        constexpr float kMax = static_cast<float>(std::numeric_limits<SignedType>::max());
+        return static_cast<SignedType>(std::clamp(value, kMin, kMax));
+    }
+
+    const float factor = scale < 32u
+        ? std::ldexp(1.0f, static_cast<int>(scale))
+        : std::ldexp(1.0f, -(64 - static_cast<int>(scale)));
+    const float scaled = value * factor;
+    constexpr float kMin = static_cast<float>(std::numeric_limits<SignedType>::min());
+    constexpr float kMax = static_cast<float>(std::numeric_limits<SignedType>::max());
+    return static_cast<SignedType>(std::clamp(scaled, kMin, kMax));
+}
+
+template <typename SignedType>
+inline float PpcDequantizePsqInline(SignedType value, uint32_t scale)
+{
+    if (scale == 0u)
+    {
+        return static_cast<float>(value);
+    }
+
+    const float factor = scale < 32u
+        ? std::ldexp(1.0f, -static_cast<int>(scale))
+        : std::ldexp(1.0f, static_cast<int>(64u - scale));
+    return static_cast<float>(value) * factor;
+}
+
+template <typename T>
+inline T PpcReadUnpairedPsqInline(uint32_t addr)
+{
+    if constexpr (sizeof(T) == 1)
+    {
+        return static_cast<T>(Memory::Read8(addr));
+    }
+    else if constexpr (sizeof(T) == 2)
+    {
+        return static_cast<T>(Memory::Read16(addr));
+    }
+    else
+    {
+        return static_cast<T>(Memory::Read32(addr));
+    }
+}
+
+template <typename T>
+inline std::pair<T, T> PpcReadPairPsqInline(uint32_t addr)
+{
+    if constexpr (sizeof(T) == 1)
+    {
+        const uint16_t packed = Memory::Read16(addr);
+        return { static_cast<T>(packed >> 8), static_cast<T>(packed) };
+    }
+    else if constexpr (sizeof(T) == 2)
+    {
+        const uint32_t packed = Memory::Read32(addr);
+        return { static_cast<T>(packed >> 16), static_cast<T>(packed) };
+    }
+    else
+    {
+        const uint64_t packed = Memory::Read64(addr);
+        return { static_cast<T>(packed >> 32), static_cast<T>(packed) };
+    }
+}
+
+template <typename T>
+inline void PpcWriteUnpairedPsqInline(uint32_t addr, T value)
+{
+    if constexpr (sizeof(T) == 1)
+    {
+        Memory::Write8(addr, static_cast<uint8_t>(value));
+    }
+    else if constexpr (sizeof(T) == 2)
+    {
+        Memory::Write16(addr, static_cast<uint16_t>(value));
+    }
+    else
+    {
+        Memory::Write32(addr, static_cast<uint32_t>(value));
+    }
+}
+
+template <typename T>
+inline void PpcWritePairPsqInline(uint32_t addr, T first, T second)
+{
+    if constexpr (sizeof(T) == 1)
+    {
+        const uint16_t packed = (static_cast<uint16_t>(first) << 8) | static_cast<uint16_t>(second);
+        Memory::Write16(addr, packed);
+    }
+    else if constexpr (sizeof(T) == 2)
+    {
+        const uint32_t packed = (static_cast<uint32_t>(first) << 16) | static_cast<uint32_t>(second);
+        Memory::Write32(addr, packed);
+    }
+    else
+    {
+        const uint64_t packed = (static_cast<uint64_t>(first) << 32) | static_cast<uint64_t>(second);
+        Memory::Write64(addr, packed);
+    }
+}
+
+// The flat reservation makes every 32-bit guest address a host address; a pending-deferred
+// (EFB) page is PAGE_NOACCESS so the load faults through the vectored handler instead of
+// reading stale bytes, and unmapped pages commit on demand, same as MemoryInline::Flat* loads.
+MKW_PPC_FORCE_INLINE const uint8_t* PpcTryGetPsqReadableHostInline(uint32_t addr)
+{
+    return MKW_FLAT_GUEST_BASE + addr;
+}
+
+// Same reduction for stores. Still refuses a 32-bit address wrap (one host access can't
+// reproduce it) and keeps MMIO write policy inline, since a fault record can't carry the
+// stored value and a null result must preserve the cold GX FIFO dispatch path byte for byte.
+// The old 1 MiB page-cross refusal is gone since the whole 4 GiB is now contiguous; deferred,
+// executable, and unmapped pages still trap.
+MKW_PPC_FORCE_INLINE uint8_t* PpcTryGetPsqWritableHostInline(uint32_t addr)
+{
+    if (addr > UINT32_MAX - 7u) [[unlikely]]
+        return nullptr;
+    if (MemoryInline::FlatWriteNeedsPolicy(addr) ||
+        MemoryInline::FlatWriteNeedsPolicy(addr + 7u)) [[unlikely]]
+        return nullptr;
+    return MKW_FLAT_GUEST_BASE + addr;
+}
+
+inline double PpcLoadPairPsqFloatFastInline(uint32_t addr)
+{
+    const uint8_t* host = PpcTryGetPsqReadableHostInline(addr);
+    if (host != nullptr) [[likely]]
+    {
+        return PpcLoadPairPsqFloatFromHostInline(host);
+    }
+    return PpcBitCastToDoubleInline(
+        PpcLoadPairPsqFloatBitsPackedInline(MemoryInline::Read64Slow(addr)));
+}
+
+inline double PpcLoadSinglePsqFloatFastInline(uint32_t addr)
+{
+    const uint32_t raw = PpcReadUnpairedPsqInline<uint32_t>(addr);
+    return PpcMakePairedResultInline(
+        PpcBitCastToFloatInline(raw),
+        1.0f).d;
+}
+
+template <typename ValueType>
+inline double PpcLoadPairPsqIntegerFastInline(uint32_t addr, uint32_t scale = 0u)
+{
+    if constexpr (sizeof(ValueType) == 1)
+    {
+        const uint16_t packed = Memory::Read16(addr);
+        return PpcMakePairedResultInline(
+            PpcDequantizePsqInline(static_cast<ValueType>(packed >> 8), scale),
+            PpcDequantizePsqInline(static_cast<ValueType>(packed), scale)).d;
+    }
+    else if constexpr (sizeof(ValueType) == 2)
+    {
+        const uint32_t packed = Memory::Read32(addr);
+        return PpcMakePairedResultInline(
+            PpcDequantizePsqInline(static_cast<ValueType>(packed >> 16), scale),
+            PpcDequantizePsqInline(static_cast<ValueType>(packed), scale)).d;
+    }
+    else
+    {
+        const uint64_t packed = Memory::Read64(addr);
+        return PpcMakePairedResultInline(
+            PpcDequantizePsqInline(static_cast<ValueType>(packed >> 32), scale),
+            PpcDequantizePsqInline(static_cast<ValueType>(packed), scale)).d;
+    }
+}
+
+template <typename SignedType>
+inline double PpcLoadSinglePsqQuantizedFastInline(uint32_t addr, uint32_t scale)
+{
+    using UnsignedType = std::make_unsigned_t<SignedType>;
+    const UnsignedType value = PpcReadUnpairedPsqInline<UnsignedType>(addr);
+    return PpcMakePairedResultInline(
+        PpcDequantizePsqInline(static_cast<SignedType>(value), scale),
+        1.0f).d;
+}
+
+inline void PpcStorePairPsqFloatFastInline(uint32_t addr, double value)
+{
+    uint8_t* host = PpcTryGetPsqWritableHostInline(addr);
+    if (host != nullptr) [[likely]]
+    {
+        PpcStorePairPsqFloatToHostInline(host, value);
+        return;
+    }
+    MemoryInline::Write64Slow(
+        addr, PpcStorePairPsqFloatBitsPackedInline(PpcBitCastToU64Inline(value)));
+}
+
+inline uint8_t PpcQuantizePsqU8Scale61Inline(float value)
+{
+    const float scaled = value * 0.125f;
+    if (!(scaled > 0.0f))
+    {
+        return 0;
+    }
+    if (scaled >= 255.0f)
+    {
+        return 255;
+    }
+    return static_cast<uint8_t>(scaled);
+}
+
+// GQR U8 scale 61 is common in paired stores. Quantize both payload lanes as
+// one native vector so the normal finite path does not branch once per lane.
+// MAXPS with zero as the second operand also maps either NaN lane to zero,
+// matching PpcQuantizePsqU8Scale61Inline's !(scaled > 0) rule.
+inline uint16_t PpcQuantizePairPsqU8Scale61PackedInline(double value)
+{
+    const __m128 scaled = _mm_mul_ps(PpcPsToM128Inline(value), _mm_set1_ps(0.125f));
+    const __m128 nonNegative = _mm_max_ps(scaled, _mm_setzero_ps());
+    const __m128 clamped = _mm_min_ps(nonNegative, _mm_set1_ps(255.0f));
+    const __m128i lanes32 = _mm_cvttps_epi32(clamped);
+    const __m128i lanes16 = _mm_packs_epi32(lanes32, lanes32);
+    const __m128i lanes8 = _mm_packus_epi16(lanes16, lanes16);
+    // Native lane 0 is ps1 and lane 1 is ps0. Packing to the low uint16_t
+    // therefore produces the guest-order numeric value (ps0 << 8) | ps1.
+    return static_cast<uint16_t>(_mm_cvtsi128_si32(lanes8));
+}
+
+// Preserve the complete memory/MMIO/executable-write behavior off the leaf
+// path. Keeping this out of line prevents those uncommon checks from being
+// replicated at every compile-time-known PSQ store.
+MKW_PPC_NO_INLINE inline void PpcStorePairPsqU8Scale61Fallback(
+    uint32_t addr, double value)
+{
+    PPC_FPR fpr{};
+    fpr.d = value;
+    const uint16_t packed = static_cast<uint16_t>(
+        (static_cast<uint16_t>(PpcQuantizePsqU8Scale61Inline(fpr.paired.ps0)) << 8) |
+        static_cast<uint16_t>(PpcQuantizePsqU8Scale61Inline(fpr.paired.ps1)));
+    Memory::Write16(addr, packed);
+}
+
+// The full-writable bias is already the runtime proof that this two-byte store
+// is mapped, in range, debug-compatible, and cannot touch executable guest
+// code. Check that proof before doing any conversion work, then perform the
+// endian-aware native store directly. A zero entry takes the exact cold path.
+MKW_PPC_FORCE_INLINE void PpcStorePairPsqU8Scale61FastInline(
+    uint32_t addr, double value)
+{
+    uint8_t* host = nullptr;
+    if (!MemoryInline::TryGetWritablePointerFast(addr, sizeof(uint16_t), host))
+    {
+        PpcStorePairPsqU8Scale61Fallback(addr, value);
+        return;
+    }
+
+    const uint16_t packed = PpcQuantizePairPsqU8Scale61PackedInline(value);
+    BigEndian::Write16(host, packed);
+}
+
+MKW_PPC_FORCE_INLINE void PpcStorePairPsqU8Scale61ResolvedInline(
+    uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value)
+{
+    if (!resolvedHost)
+    {
+        PpcStorePairPsqU8Scale61Fallback(addr, value);
+        return;
+    }
+
+    const uint16_t packed = PpcQuantizePairPsqU8Scale61PackedInline(value);
+    BigEndian::Write16(resolvedHost + offset, packed);
+}
+
+template <typename QuantizedType>
+inline void PpcStorePairPsqQuantizedFastInline(uint32_t addr, double value, uint32_t scale)
+{
+    PPC_FPR fpr{};
+    fpr.d = value;
+    if constexpr (std::is_same_v<QuantizedType, uint8_t>)
+    {
+        if (scale == 61u)
+        {
+            PpcStorePairPsqU8Scale61FastInline(addr, value);
+            return;
+        }
+    }
+
+    if constexpr (std::is_signed_v<QuantizedType>)
+    {
+        const auto first = static_cast<std::make_unsigned_t<QuantizedType>>(
+            static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps0, scale)));
+        const auto second = static_cast<std::make_unsigned_t<QuantizedType>>(
+            static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps1, scale)));
+        PpcWritePairPsqInline(addr, first, second);
+    }
+    else
+    {
+        const auto first = static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps0, scale));
+        const auto second = static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps1, scale));
+        PpcWritePairPsqInline(addr, first, second);
+    }
+}
+
+inline void PpcStoreSinglePsqFloatFastInline(uint32_t addr, double value)
+{
+    const uint32_t first = PpcConvertToSingleFTZInline(
+        PpcBitCastToU64Inline(static_cast<double>(PpcGetPs0Inline(value))));
+    PpcWriteUnpairedPsqInline(addr, first);
+}
+
+template <typename QuantizedType>
+inline void PpcStoreSinglePsqQuantizedFastInline(uint32_t addr, double value, uint32_t scale)
+{
+    PPC_FPR fpr{};
+    fpr.d = value;
+    if constexpr (std::is_signed_v<QuantizedType>)
+    {
+        const auto first = static_cast<std::make_unsigned_t<QuantizedType>>(
+            static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps0, scale)));
+        PpcWriteUnpairedPsqInline(addr, first);
+    }
+    else
+    {
+        const auto first = static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps0, scale));
+        PpcWriteUnpairedPsqInline(addr, first);
+    }
+}
+
+inline double PpcLoadPairPsqFloatResolvedInline(uint8_t* resolvedHost, uint32_t offset, uint32_t addr)
+{
+    // A resolved range is already the proof; MemoryInline::ReadResolved64 only
+    // falls back when the host pointer is null.
+    if (resolvedHost != nullptr) [[likely]]
+        return PpcLoadPairPsqFloatFromHostInline(resolvedHost + offset);
+    return PpcBitCastToDoubleInline(PpcLoadPairPsqFloatBitsPackedInline(
+        MemoryInline::ReadResolvedFallback<uint64_t>(addr)));
+}
+
+inline double PpcLoadSinglePsqFloatResolvedInline(uint8_t* resolvedHost, uint32_t offset, uint32_t addr)
+{
+    const uint32_t raw = MemoryInline::ReadResolved32(resolvedHost, offset, addr);
+    return PpcMakePairedResultInline(PpcBitCastToFloatInline(raw), 1.0f).d;
+}
+
+template <typename ValueType>
+inline double PpcLoadPairPsqIntegerResolvedInline(uint8_t* resolvedHost, uint32_t offset,
+                                                   uint32_t addr, uint32_t scale = 0u)
+{
+    if constexpr (sizeof(ValueType) == 1) {
+        const uint16_t packed = MemoryInline::ReadResolved16(resolvedHost, offset, addr);
+        return PpcMakePairedResultInline(
+            PpcDequantizePsqInline(static_cast<ValueType>(packed >> 8), scale),
+            PpcDequantizePsqInline(static_cast<ValueType>(packed), scale)).d;
+    } else if constexpr (sizeof(ValueType) == 2) {
+        const uint32_t packed = MemoryInline::ReadResolved32(resolvedHost, offset, addr);
+        return PpcMakePairedResultInline(
+            PpcDequantizePsqInline(static_cast<ValueType>(packed >> 16), scale),
+            PpcDequantizePsqInline(static_cast<ValueType>(packed), scale)).d;
+    } else {
+        const uint64_t packed = MemoryInline::ReadResolved64(resolvedHost, offset, addr);
+        return PpcMakePairedResultInline(
+            PpcDequantizePsqInline(static_cast<ValueType>(packed >> 32), scale),
+            PpcDequantizePsqInline(static_cast<ValueType>(packed), scale)).d;
+    }
+}
+
+template <typename SignedType>
+inline double PpcLoadSinglePsqQuantizedResolvedInline(uint8_t* resolvedHost, uint32_t offset, uint32_t addr, uint32_t scale)
+{
+    using UnsignedType = std::make_unsigned_t<SignedType>;
+    UnsignedType value;
+    if constexpr (sizeof(UnsignedType) == 1) value = MemoryInline::ReadResolved8(resolvedHost, offset, addr);
+    else if constexpr (sizeof(UnsignedType) == 2) value = MemoryInline::ReadResolved16(resolvedHost, offset, addr);
+    else value = MemoryInline::ReadResolved32(resolvedHost, offset, addr);
+    return PpcMakePairedResultInline(PpcDequantizePsqInline(static_cast<SignedType>(value), scale), 1.0f).d;
+}
+
+inline void PpcStorePairPsqFloatResolvedInline(uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value)
+{
+    // Mirrors MemoryInline::WriteResolved64: the resolved range is the proof,
+    // and only a null host takes the original-address fallback.
+    if (resolvedHost != nullptr) [[likely]]
+    {
+        PpcStorePairPsqFloatToHostInline(resolvedHost + offset, value);
+        return;
+    }
+    MemoryInline::WriteResolvedFallback<uint64_t>(
+        addr, PpcStorePairPsqFloatBitsPackedInline(PpcBitCastToU64Inline(value)));
+}
+
+template <typename QuantizedType>
+inline void PpcStorePairPsqQuantizedResolvedInline(uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value, uint32_t scale)
+{
+    PPC_FPR fpr{}; fpr.d = value;
+    if constexpr (std::is_same_v<QuantizedType, uint8_t>)
+    {
+        if (scale == 61u)
+        {
+            PpcStorePairPsqU8Scale61ResolvedInline(resolvedHost, offset, addr, value);
+            return;
+        }
+    }
+    using Unsigned = std::make_unsigned_t<QuantizedType>;
+    const auto quantize = [scale](float lane) -> Unsigned {
+        return static_cast<Unsigned>(static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(lane, scale)));
+    };
+    const Unsigned first = quantize(fpr.paired.ps0);
+    const Unsigned second = quantize(fpr.paired.ps1);
+    if constexpr (sizeof(QuantizedType) == 1)
+        MemoryInline::WriteResolved16(resolvedHost, offset, addr, (static_cast<uint16_t>(first) << 8) | second);
+    else if constexpr (sizeof(QuantizedType) == 2)
+        MemoryInline::WriteResolved32(resolvedHost, offset, addr, (static_cast<uint32_t>(first) << 16) | second);
+    else
+        MemoryInline::WriteResolved64(resolvedHost, offset, addr, (static_cast<uint64_t>(first) << 32) | second);
+}
+
+inline void PpcStoreSinglePsqFloatResolvedInline(uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value)
+{
+    const uint32_t first = PpcConvertToSingleFTZInline(PpcBitCastToU64Inline(static_cast<double>(PpcGetPs0Inline(value))));
+    MemoryInline::WriteResolved32(resolvedHost, offset, addr, first);
+}
+
+template <typename QuantizedType>
+inline void PpcStoreSinglePsqQuantizedResolvedInline(uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value, uint32_t scale)
+{
+    PPC_FPR fpr{}; fpr.d = value;
+    using Unsigned = std::make_unsigned_t<QuantizedType>;
+    const Unsigned first = static_cast<Unsigned>(static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps0, scale)));
+    if constexpr (sizeof(QuantizedType) == 1) MemoryInline::WriteResolved8(resolvedHost, offset, addr, first);
+    else if constexpr (sizeof(QuantizedType) == 2) MemoryInline::WriteResolved16(resolvedHost, offset, addr, first);
+    else MemoryInline::WriteResolved32(resolvedHost, offset, addr, first);
+}
+
+template <typename T>
+inline T PpcReadUnpairedPsqStackInline(uint32_t addr)
+{
+    if constexpr (sizeof(T) == 1)
+    {
+        return static_cast<T>(MemoryInline::ReadStack8(addr));
+    }
+    else if constexpr (sizeof(T) == 2)
+    {
+        return static_cast<T>(MemoryInline::ReadStack16(addr));
+    }
+    else
+    {
+        return static_cast<T>(MemoryInline::ReadStack32(addr));
+    }
+}
+
+template <typename T>
+inline void PpcWriteUnpairedPsqStackInline(uint32_t addr, T value)
+{
+    if constexpr (sizeof(T) == 1)
+    {
+        MemoryInline::WriteStack8(addr, static_cast<uint8_t>(value));
+    }
+    else if constexpr (sizeof(T) == 2)
+    {
+        MemoryInline::WriteStack16(addr, static_cast<uint16_t>(value));
+    }
+    else
+    {
+        MemoryInline::WriteStack32(addr, static_cast<uint32_t>(value));
+    }
+}
+
+template <typename T>
+inline void PpcWritePairPsqStackInline(uint32_t addr, T first, T second)
+{
+    if constexpr (sizeof(T) == 1)
+    {
+        const uint16_t packed = (static_cast<uint16_t>(first) << 8) | static_cast<uint16_t>(second);
+        MemoryInline::WriteStack16(addr, packed);
+    }
+    else if constexpr (sizeof(T) == 2)
+    {
+        const uint32_t packed = (static_cast<uint32_t>(first) << 16) | static_cast<uint32_t>(second);
+        MemoryInline::WriteStack32(addr, packed);
+    }
+    else
+    {
+        const uint64_t packed = (static_cast<uint64_t>(first) << 32) | static_cast<uint64_t>(second);
+        MemoryInline::WriteStack64(addr, packed);
+    }
+}
+
+inline double PpcLoadPairPsqFloatStackInline(uint32_t addr)
+{
+    // MemoryInline::ReadStack64's exact proof (TryGetPointerFast), then the
+    // same Memory::Read64 fallback it uses on a miss.
+    uint8_t* host = nullptr;
+    if (MemoryInline::TryGetPointerFast(addr, sizeof(uint64_t), host)) [[likely]]
+        return PpcLoadPairPsqFloatFromHostInline(host);
+    return PpcBitCastToDoubleInline(PpcLoadPairPsqFloatBitsPackedInline(Memory::Read64(addr)));
+}
+
+inline double PpcLoadSinglePsqFloatStackInline(uint32_t addr)
+{
+    const uint32_t raw = PpcReadUnpairedPsqStackInline<uint32_t>(addr);
+    return PpcMakePairedResultInline(PpcBitCastToFloatInline(raw), 1.0f).d;
+}
+
+template <typename ValueType>
+inline double PpcLoadPairPsqIntegerStackInline(uint32_t addr, uint32_t scale = 0u)
+{
+    if constexpr (sizeof(ValueType) == 1)
+    {
+        const uint16_t packed = MemoryInline::ReadStack16(addr);
+        return PpcMakePairedResultInline(
+            PpcDequantizePsqInline(static_cast<ValueType>(packed >> 8), scale),
+            PpcDequantizePsqInline(static_cast<ValueType>(packed), scale)).d;
+    }
+    else if constexpr (sizeof(ValueType) == 2)
+    {
+        const uint32_t packed = MemoryInline::ReadStack32(addr);
+        return PpcMakePairedResultInline(
+            PpcDequantizePsqInline(static_cast<ValueType>(packed >> 16), scale),
+            PpcDequantizePsqInline(static_cast<ValueType>(packed), scale)).d;
+    }
+    else
+    {
+        const uint64_t packed = MemoryInline::ReadStack64(addr);
+        return PpcMakePairedResultInline(
+            PpcDequantizePsqInline(static_cast<ValueType>(packed >> 32), scale),
+            PpcDequantizePsqInline(static_cast<ValueType>(packed), scale)).d;
+    }
+}
+
+template <typename SignedType>
+inline double PpcLoadSinglePsqQuantizedStackInline(uint32_t addr, uint32_t scale)
+{
+    using UnsignedType = std::make_unsigned_t<SignedType>;
+    const UnsignedType value = PpcReadUnpairedPsqStackInline<UnsignedType>(addr);
+    return PpcMakePairedResultInline(
+        PpcDequantizePsqInline(static_cast<SignedType>(value), scale),
+        1.0f).d;
+}
+
+inline void PpcStorePairPsqFloatStackInline(uint32_t addr, double value)
+{
+    // MemoryInline::WriteStack64's exact proof (WriteStackScalarFast ->
+    // TryGetPointerFast), then the same Memory::Write64 fallback on a miss.
+    uint8_t* host = nullptr;
+    if (MemoryInline::TryGetPointerFast(addr, sizeof(uint64_t), host)) [[likely]]
+    {
+        PpcStorePairPsqFloatToHostInline(host, value);
+        return;
+    }
+    Memory::Write64(addr, PpcStorePairPsqFloatBitsPackedInline(PpcBitCastToU64Inline(value)));
+}
+
+template <typename QuantizedType>
+inline void PpcStorePairPsqQuantizedStackInline(uint32_t addr, double value, uint32_t scale)
+{
+    PPC_FPR fpr{};
+    fpr.d = value;
+    if constexpr (std::is_same_v<QuantizedType, uint8_t>)
+    {
+        if (scale == 61u)
+        {
+            const uint16_t packed = PpcQuantizePairPsqU8Scale61PackedInline(value);
+            MemoryInline::WriteStack16(addr, packed);
+            return;
+        }
+    }
+
+    if constexpr (std::is_signed_v<QuantizedType>)
+    {
+        const auto first = static_cast<std::make_unsigned_t<QuantizedType>>(
+            static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps0, scale)));
+        const auto second = static_cast<std::make_unsigned_t<QuantizedType>>(
+            static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps1, scale)));
+        PpcWritePairPsqStackInline(addr, first, second);
+    }
+    else
+    {
+        const auto first = static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps0, scale));
+        const auto second = static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps1, scale));
+        PpcWritePairPsqStackInline(addr, first, second);
+    }
+}
+
+inline void PpcStoreSinglePsqFloatStackInline(uint32_t addr, double value)
+{
+    const uint32_t first = PpcConvertToSingleFTZInline(
+        PpcBitCastToU64Inline(static_cast<double>(PpcGetPs0Inline(value))));
+    PpcWriteUnpairedPsqStackInline(addr, first);
+}
+
+template <typename QuantizedType>
+inline void PpcStoreSinglePsqQuantizedStackInline(uint32_t addr, double value, uint32_t scale)
+{
+    PPC_FPR fpr{};
+    fpr.d = value;
+    if constexpr (std::is_signed_v<QuantizedType>)
+    {
+        const auto first = static_cast<std::make_unsigned_t<QuantizedType>>(
+            static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps0, scale)));
+        PpcWriteUnpairedPsqStackInline(addr, first);
+    }
+    else
+    {
+        const auto first = static_cast<QuantizedType>(PpcScaleAndClampPsqInline<QuantizedType>(fpr.paired.ps0, scale));
+        PpcWriteUnpairedPsqStackInline(addr, first);
+    }
+}
+
+// Paired-Single helpers (psq_l / psq_st). w=0 loads/stores both ps0/ps1 (paired), w=1 only
+// ps0 (scalar); i is the GQR index (0-7) for quantization type and scale.
+extern "C" double PPC_PsqL(uint32_t addr, uint32_t w, uint32_t i);
+extern "C" void PPC_PsqSt(uint32_t addr, double value, uint32_t w, uint32_t i);
+
+// Cold generic body for psq_l. The complete quantization switch lives in one
+// out-of-line copy so PPC_PsqLInline's float fast path can be force-inlined at
+// guest call sites without spilling live registers around a call.
+template <uint32_t W, uint32_t I>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline double PPC_PsqLGeneric(uint32_t gqr, uint32_t addr)
+{
+    static_assert(W <= 1u, "psq load W must be 0 or 1");
+    static_assert(I < 8u, "psq load GQR index must be 0..7");
+    if constexpr (W == 0u)
+    {
+        switch (gqr & 0xFFFF0000u)
+        {
+        case 0x00000000u:
+return PpcLoadPairPsqFloatFastInline(addr);
+        case 0x00040000u:
+return PpcLoadPairPsqIntegerFastInline<uint8_t>(addr);
+        case 0x00050000u:
+return PpcLoadPairPsqIntegerFastInline<uint16_t>(addr);
+        case 0x00060000u:
+return PpcLoadPairPsqIntegerFastInline<int8_t>(addr);
+        case 0x00070000u:
+return PpcLoadPairPsqIntegerFastInline<int16_t>(addr);
+        default:
+            break;
+        }
+    }
+    else
+    {
+        const uint32_t type = (gqr >> 16) & 0x7u;
+        const uint32_t scale = (gqr >> 24) & 0x3Fu;
+        switch (type)
+        {
+        case 0u:
+return PpcLoadSinglePsqFloatFastInline(addr);
+        case 4u:
+return PpcLoadSinglePsqQuantizedFastInline<uint8_t>(addr, scale);
+        case 5u:
+return PpcLoadSinglePsqQuantizedFastInline<uint16_t>(addr, scale);
+        case 6u:
+return PpcLoadSinglePsqQuantizedFastInline<int8_t>(addr, scale);
+        case 7u:
+return PpcLoadSinglePsqQuantizedFastInline<int16_t>(addr, scale);
+        default:
+            break;
+        }
+    }
+
+    return PPC_PsqL(addr, W, I);
+}
+
+// Hot wrapper: the float encoding (quantization type 0) is what the SDK leaves
+// in the GQRs for the overwhelming majority of psq_l sites, so it is tested with
+// one compare and handled inline. Every other encoding, including the reserved
+// ones that must reach PPC_PsqL, tail-calls the cold generic body above.
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE double PPC_PsqLInline(CpuContext* cpu, uint32_t addr)
+{
+    static_assert(W <= 1u, "psq load W must be 0 or 1");
+    static_assert(I < 8u, "psq load GQR index must be 0..7");
+    if (!cpu) [[unlikely]]
+    {
+        std::abort();
+    }
+
+    const uint32_t gqr = cpu->gqr[I];
+    if constexpr (W == 0u)
+    {
+        // Paired float requires type 0 *and* load scale 0 (the pair path in the
+        // generic body dispatches on the whole load halfword for that reason).
+        if ((gqr & 0xFFFF0000u) == 0x00000000u) [[likely]]
+        {
+            return PpcLoadPairPsqFloatFastInline(addr);
+        }
+    }
+    else
+    {
+        // Scalar float ignores the load scale, exactly like the generic switch.
+        if (((gqr >> 16) & 0x7u) == 0u) [[likely]]
+        {
+            return PpcLoadSinglePsqFloatFastInline(addr);
+        }
+    }
+
+    return PPC_PsqLGeneric<W, I>(gqr, addr);
+}
+
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE double PPC_PsqLInline(uint32_t addr)
+{
+    return PPC_PsqLInline<W, I>(TryGetCpuContext(), addr);
+}
+
+// GQR-hoisting entry points (audit T-GQR). Identical bodies to PPC_PsqLInline/PPC_PsqStInline
+// above, but the GQR value arrives as an argument instead of being reloaded from ctx->gqr[I]
+// at every access, since pointer indirection otherwise forces a reload after every intervening
+// store. I is only consulted for reserved encodings that tail-call PPC_PsqL/PPC_PsqSt.
+template <uint32_t W, uint32_t I = 0u>
+MKW_PPC_FORCE_INLINE double PPC_PsqLGqrInline(uint32_t gqrValue, uint32_t addr)
+{
+    static_assert(W <= 1u, "psq load W must be 0 or 1");
+    static_assert(I < 8u, "psq load GQR index must be 0..7");
+    if constexpr (W == 0u)
+    {
+        // Paired float requires type 0 *and* load scale 0 (the pair path in the
+        // generic body dispatches on the whole load halfword for that reason).
+        if ((gqrValue & 0xFFFF0000u) == 0x00000000u) [[likely]]
+        {
+            return PpcLoadPairPsqFloatFastInline(addr);
+        }
+    }
+    else
+    {
+        // Scalar float ignores the load scale, exactly like the generic switch.
+        if (((gqrValue >> 16) & 0x7u) == 0u) [[likely]]
+        {
+            return PpcLoadSinglePsqFloatFastInline(addr);
+        }
+    }
+
+    return PPC_PsqLGeneric<W, I>(gqrValue, addr);
+}
+
+// Context-carrying form, for emission sites that still hand the CpuContext to
+// every helper. The context is not read; the null check is retained so a broken
+// call site fails the same way the ctx->gqr[I] form does.
+template <uint32_t W, uint32_t I = 0u>
+MKW_PPC_FORCE_INLINE double PPC_PsqLGqrInline(CpuContext* cpu, uint32_t gqrValue, uint32_t addr)
+{
+    if (!cpu) [[unlikely]]
+    {
+        std::abort();
+    }
+    return PPC_PsqLGqrInline<W, I>(gqrValue, addr);
+}
+
+template <uint32_t W, uint32_t I, uint32_t GQR>
+MKW_PPC_FORCE_INLINE double PPC_PsqLKnownInline(CpuContext*, uint32_t addr)
+{
+    static_assert(W <= 1u, "psq load W must be 0 or 1");
+    static_assert(I < 8u, "psq load GQR index must be 0..7");
+    constexpr uint32_t type = (GQR >> 16) & 0x7u;
+    constexpr uint32_t scale = (GQR >> 24) & 0x3Fu;
+if constexpr (type == 0u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqFloatFastInline(addr);
+        else return PpcLoadSinglePsqFloatFastInline(addr);
+    }
+    else if constexpr (type == 4u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerFastInline<uint8_t>(addr, scale);
+        else return PpcLoadSinglePsqQuantizedFastInline<uint8_t>(addr, scale);
+    }
+    else if constexpr (type == 5u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerFastInline<uint16_t>(addr, scale);
+        else return PpcLoadSinglePsqQuantizedFastInline<uint16_t>(addr, scale);
+    }
+    else if constexpr (type == 6u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerFastInline<int8_t>(addr, scale);
+        else return PpcLoadSinglePsqQuantizedFastInline<int8_t>(addr, scale);
+    }
+    else if constexpr (type == 7u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerFastInline<int16_t>(addr, scale);
+        else return PpcLoadSinglePsqQuantizedFastInline<int16_t>(addr, scale);
+    }
+    else
+    {
+        return PPC_PsqL(addr, W, I);
+    }
+}
+
+// Cold generic body for the stack-form psq_l, mirroring PPC_PsqLGeneric: the
+// complete quantization switch lives in one out-of-line copy so the hot
+// wrapper's float path can be force-inlined at guest call sites without
+// spilling live registers around a call.
+template <uint32_t W, uint32_t I>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline double PPC_PsqLStackGeneric(uint32_t gqr, uint32_t addr)
+{
+    static_assert(W <= 1u, "psq stack load W must be 0 or 1");
+    static_assert(I < 8u, "psq stack load GQR index must be 0..7");
+    if constexpr (W == 0u)
+    {
+        switch (gqr & 0xFFFF0000u)
+        {
+        case 0x00000000u:
+return PpcLoadPairPsqFloatStackInline(addr);
+        case 0x00040000u:
+return PpcLoadPairPsqIntegerStackInline<uint8_t>(addr);
+        case 0x00050000u:
+return PpcLoadPairPsqIntegerStackInline<uint16_t>(addr);
+        case 0x00060000u:
+return PpcLoadPairPsqIntegerStackInline<int8_t>(addr);
+        case 0x00070000u:
+return PpcLoadPairPsqIntegerStackInline<int16_t>(addr);
+        default:
+            break;
+        }
+    }
+    else
+    {
+        const uint32_t type = (gqr >> 16) & 0x7u;
+        const uint32_t scale = (gqr >> 24) & 0x3Fu;
+        switch (type)
+        {
+        case 0u:
+return PpcLoadSinglePsqFloatStackInline(addr);
+        case 4u:
+return PpcLoadSinglePsqQuantizedStackInline<uint8_t>(addr, scale);
+        case 5u:
+return PpcLoadSinglePsqQuantizedStackInline<uint16_t>(addr, scale);
+        case 6u:
+return PpcLoadSinglePsqQuantizedStackInline<int8_t>(addr, scale);
+        case 7u:
+return PpcLoadSinglePsqQuantizedStackInline<int16_t>(addr, scale);
+        default:
+            break;
+        }
+    }
+
+    return PPC_PsqL(addr, W, I);
+}
+
+// Hot wrapper: the float encoding (quantization type 0) is what the SDK leaves
+// in the GQRs for the overwhelming majority of psq_l sites, so it is tested with
+// one compare and handled inline. Every other encoding, including the reserved
+// ones that must reach PPC_PsqL, tail-calls the cold generic body above.
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE double PPC_PsqLStackInline(CpuContext* cpu, uint32_t addr)
+{
+    static_assert(W <= 1u, "psq stack load W must be 0 or 1");
+    static_assert(I < 8u, "psq stack load GQR index must be 0..7");
+    if (!cpu) [[unlikely]]
+    {
+        std::abort();
+    }
+
+    const uint32_t gqr = cpu->gqr[I];
+    if constexpr (W == 0u)
+    {
+        // Paired float requires type 0 *and* load scale 0 (the pair path in the
+        // generic body dispatches on the whole load halfword for that reason).
+        if ((gqr & 0xFFFF0000u) == 0x00000000u) [[likely]]
+        {
+            return PpcLoadPairPsqFloatStackInline(addr);
+        }
+    }
+    else
+    {
+        // Scalar float ignores the load scale, exactly like the generic switch.
+        if (((gqr >> 16) & 0x7u) == 0u) [[likely]]
+        {
+            return PpcLoadSinglePsqFloatStackInline(addr);
+        }
+    }
+
+    return PPC_PsqLStackGeneric<W, I>(gqr, addr);
+}
+
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE double PPC_PsqLStackInline(uint32_t addr)
+{
+    return PPC_PsqLStackInline<W, I>(TryGetCpuContext(), addr);
+}
+
+template <uint32_t W, uint32_t I, uint32_t GQR>
+MKW_PPC_FORCE_INLINE double PPC_PsqLKnownStackInline(CpuContext*, uint32_t addr)
+{
+    static_assert(W <= 1u, "psq stack load W must be 0 or 1");
+    static_assert(I < 8u, "psq stack load GQR index must be 0..7");
+    constexpr uint32_t type = (GQR >> 16) & 0x7u;
+    constexpr uint32_t scale = (GQR >> 24) & 0x3Fu;
+if constexpr (type == 0u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqFloatStackInline(addr);
+        else return PpcLoadSinglePsqFloatStackInline(addr);
+    }
+    else if constexpr (type == 4u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerStackInline<uint8_t>(addr, scale);
+        else return PpcLoadSinglePsqQuantizedStackInline<uint8_t>(addr, scale);
+    }
+    else if constexpr (type == 5u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerStackInline<uint16_t>(addr, scale);
+        else return PpcLoadSinglePsqQuantizedStackInline<uint16_t>(addr, scale);
+    }
+    else if constexpr (type == 6u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerStackInline<int8_t>(addr, scale);
+        else return PpcLoadSinglePsqQuantizedStackInline<int8_t>(addr, scale);
+    }
+    else if constexpr (type == 7u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerStackInline<int16_t>(addr, scale);
+        else return PpcLoadSinglePsqQuantizedStackInline<int16_t>(addr, scale);
+    }
+    else
+    {
+        return PPC_PsqL(addr, W, I);
+    }
+}
+
+// Cold generic body for psq_st. See PPC_PsqLGeneric: the full switch stays out
+// of line so the float fast path in PPC_PsqStInline can be force-inlined.
+template <uint32_t W, uint32_t I>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline void PPC_PsqStGeneric(uint32_t gqr, uint32_t addr, double value)
+{
+    static_assert(W <= 1u, "psq store W must be 0 or 1");
+    static_assert(I < 8u, "psq store GQR index must be 0..7");
+    if constexpr (W == 0u)
+    {
+        switch (gqr & 0x0000FFFFu)
+        {
+        case 0x0000u:
+PpcStorePairPsqFloatFastInline(addr, value);
+            return;
+        case 0x0004u:
+PpcStorePairPsqQuantizedFastInline<uint8_t>(addr, value, 0u);
+            return;
+        case 0x0005u:
+PpcStorePairPsqQuantizedFastInline<uint16_t>(addr, value, 0u);
+            return;
+        case 0x0006u:
+PpcStorePairPsqQuantizedFastInline<int8_t>(addr, value, 0u);
+            return;
+        case 0x0007u:
+PpcStorePairPsqQuantizedFastInline<int16_t>(addr, value, 0u);
+            return;
+        case 0x3D04u:
+PpcStorePairPsqQuantizedFastInline<uint8_t>(addr, value, 61u);
+            return;
+        default:
+            break;
+        }
+    }
+    else
+    {
+        const uint32_t type = gqr & 0x7u;
+        const uint32_t scale = (gqr >> 8) & 0x3Fu;
+        switch (type)
+        {
+        case 0u:
+PpcStoreSinglePsqFloatFastInline(addr, value);
+            return;
+        case 4u:
+PpcStoreSinglePsqQuantizedFastInline<uint8_t>(addr, value, scale);
+            return;
+        case 5u:
+PpcStoreSinglePsqQuantizedFastInline<uint16_t>(addr, value, scale);
+            return;
+        case 6u:
+PpcStoreSinglePsqQuantizedFastInline<int8_t>(addr, value, scale);
+            return;
+        case 7u:
+PpcStoreSinglePsqQuantizedFastInline<int16_t>(addr, value, scale);
+            return;
+        default:
+            break;
+        }
+    }
+
+    PPC_PsqSt(addr, value, W, I);
+}
+
+// Hot wrapper: store type 0 (float) is the common GQR setup, tested with a
+// single compare and handled inline. Quantized encodings (including the U8
+// scale-61 pair case) and reserved encodings go to the cold generic body.
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE void PPC_PsqStInline(CpuContext* cpu, uint32_t addr, double value)
+{
+    static_assert(W <= 1u, "psq store W must be 0 or 1");
+    static_assert(I < 8u, "psq store GQR index must be 0..7");
+    if (!cpu) [[unlikely]]
+    {
+        std::abort();
+    }
+
+    const uint32_t gqr = cpu->gqr[I];
+    if constexpr (W == 0u)
+    {
+        // Paired float requires store type 0 *and* store scale 0, matching the
+        // generic body's dispatch on the whole store halfword.
+        if ((gqr & 0x0000FFFFu) == 0x0000u) [[likely]]
+        {
+            PpcStorePairPsqFloatFastInline(addr, value);
+            return;
+        }
+    }
+    else
+    {
+        // Scalar float ignores the store scale, exactly like the generic switch.
+        if ((gqr & 0x7u) == 0u) [[likely]]
+        {
+            PpcStoreSinglePsqFloatFastInline(addr, value);
+            return;
+        }
+    }
+
+    PPC_PsqStGeneric<W, I>(gqr, addr, value);
+}
+
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE void PPC_PsqStInline(uint32_t addr, double value)
+{
+    PPC_PsqStInline<W, I>(TryGetCpuContext(), addr, value);
+}
+
+// GQR-hoisting store entry points. See PPC_PsqLGqrInline above for why the GQR
+// value is passed in and what the template parameters still mean.
+template <uint32_t W, uint32_t I = 0u>
+MKW_PPC_FORCE_INLINE void PPC_PsqStGqrInline(uint32_t gqrValue, uint32_t addr, double value)
+{
+    static_assert(W <= 1u, "psq store W must be 0 or 1");
+    static_assert(I < 8u, "psq store GQR index must be 0..7");
+    if constexpr (W == 0u)
+    {
+        // Paired float requires store type 0 *and* store scale 0, matching the
+        // generic body's dispatch on the whole store halfword.
+        if ((gqrValue & 0x0000FFFFu) == 0x0000u) [[likely]]
+        {
+            PpcStorePairPsqFloatFastInline(addr, value);
+            return;
+        }
+    }
+    else
+    {
+        // Scalar float ignores the store scale, exactly like the generic switch.
+        if ((gqrValue & 0x7u) == 0u) [[likely]]
+        {
+            PpcStoreSinglePsqFloatFastInline(addr, value);
+            return;
+        }
+    }
+
+    PPC_PsqStGeneric<W, I>(gqrValue, addr, value);
+}
+
+template <uint32_t W, uint32_t I = 0u>
+MKW_PPC_FORCE_INLINE void PPC_PsqStGqrInline(CpuContext* cpu, uint32_t gqrValue, uint32_t addr, double value)
+{
+    if (!cpu) [[unlikely]]
+    {
+        std::abort();
+    }
+    PPC_PsqStGqrInline<W, I>(gqrValue, addr, value);
+}
+
+template <uint32_t W, uint32_t I, uint32_t GQR>
+MKW_PPC_FORCE_INLINE void PPC_PsqStKnownInline(CpuContext*, uint32_t addr, double value)
+{
+    static_assert(W <= 1u, "psq store W must be 0 or 1");
+    static_assert(I < 8u, "psq store GQR index must be 0..7");
+    constexpr uint32_t type = GQR & 0x7u;
+    constexpr uint32_t scale = (GQR >> 8) & 0x3Fu;
+if constexpr (type == 0u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqFloatFastInline(addr, value);
+        else PpcStoreSinglePsqFloatFastInline(addr, value);
+    }
+    else if constexpr (type == 4u)
+    {
+        if constexpr (W == 0u && scale == 61u)
+        {
+            if constexpr (W == 0u) PpcStorePairPsqQuantizedFastInline<uint8_t>(addr, value, scale);
+            else PpcStoreSinglePsqQuantizedFastInline<uint8_t>(addr, value, scale);
+        }
+        else
+        {
+            if constexpr (W == 0u) PpcStorePairPsqQuantizedFastInline<uint8_t>(addr, value, scale);
+            else PpcStoreSinglePsqQuantizedFastInline<uint8_t>(addr, value, scale);
+        }
+    }
+    else if constexpr (type == 5u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqQuantizedFastInline<uint16_t>(addr, value, scale);
+        else PpcStoreSinglePsqQuantizedFastInline<uint16_t>(addr, value, scale);
+    }
+    else if constexpr (type == 6u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqQuantizedFastInline<int8_t>(addr, value, scale);
+        else PpcStoreSinglePsqQuantizedFastInline<int8_t>(addr, value, scale);
+    }
+    else if constexpr (type == 7u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqQuantizedFastInline<int16_t>(addr, value, scale);
+        else PpcStoreSinglePsqQuantizedFastInline<int16_t>(addr, value, scale);
+    }
+    else
+    {
+        PPC_PsqSt(addr, value, W, I);
+    }
+}
+
+// Cold generic body for the stack-form psq_st. See PPC_PsqStGeneric: the full
+// switch stays out of line so the float fast path in the hot wrapper below can
+// be force-inlined.
+template <uint32_t W, uint32_t I>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline void PPC_PsqStStackGeneric(uint32_t gqr, uint32_t addr, double value)
+{
+    static_assert(W <= 1u, "psq stack store W must be 0 or 1");
+    static_assert(I < 8u, "psq stack store GQR index must be 0..7");
+    if constexpr (W == 0u)
+    {
+        switch (gqr & 0x0000FFFFu)
+        {
+        case 0x0000u:
+PpcStorePairPsqFloatStackInline(addr, value);
+            return;
+        case 0x0004u:
+PpcStorePairPsqQuantizedStackInline<uint8_t>(addr, value, 0u);
+            return;
+        case 0x0005u:
+PpcStorePairPsqQuantizedStackInline<uint16_t>(addr, value, 0u);
+            return;
+        case 0x0006u:
+PpcStorePairPsqQuantizedStackInline<int8_t>(addr, value, 0u);
+            return;
+        case 0x0007u:
+PpcStorePairPsqQuantizedStackInline<int16_t>(addr, value, 0u);
+            return;
+        case 0x3D04u:
+PpcStorePairPsqQuantizedStackInline<uint8_t>(addr, value, 61u);
+            return;
+        default:
+            break;
+        }
+    }
+    else
+    {
+        const uint32_t type = gqr & 0x7u;
+        const uint32_t scale = (gqr >> 8) & 0x3Fu;
+        switch (type)
+        {
+        case 0u:
+PpcStoreSinglePsqFloatStackInline(addr, value);
+            return;
+        case 4u:
+PpcStoreSinglePsqQuantizedStackInline<uint8_t>(addr, value, scale);
+            return;
+        case 5u:
+PpcStoreSinglePsqQuantizedStackInline<uint16_t>(addr, value, scale);
+            return;
+        case 6u:
+PpcStoreSinglePsqQuantizedStackInline<int8_t>(addr, value, scale);
+            return;
+        case 7u:
+PpcStoreSinglePsqQuantizedStackInline<int16_t>(addr, value, scale);
+            return;
+        default:
+            break;
+        }
+    }
+
+    PPC_PsqSt(addr, value, W, I);
+}
+
+// Hot wrapper: store type 0 (float) is the common GQR setup, tested with a
+// single compare and handled inline. Quantized encodings (including the U8
+// scale-61 pair case) and reserved encodings go to the cold generic body.
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE void PPC_PsqStStackInline(CpuContext* cpu, uint32_t addr, double value)
+{
+    static_assert(W <= 1u, "psq stack store W must be 0 or 1");
+    static_assert(I < 8u, "psq stack store GQR index must be 0..7");
+    if (!cpu) [[unlikely]]
+    {
+        std::abort();
+    }
+
+    const uint32_t gqr = cpu->gqr[I];
+    if constexpr (W == 0u)
+    {
+        // Paired float requires store type 0 *and* store scale 0, matching the
+        // generic body's dispatch on the whole store halfword.
+        if ((gqr & 0x0000FFFFu) == 0x0000u) [[likely]]
+        {
+            PpcStorePairPsqFloatStackInline(addr, value);
+            return;
+        }
+    }
+    else
+    {
+        // Scalar float ignores the store scale, exactly like the generic switch.
+        if ((gqr & 0x7u) == 0u) [[likely]]
+        {
+            PpcStoreSinglePsqFloatStackInline(addr, value);
+            return;
+        }
+    }
+
+    PPC_PsqStStackGeneric<W, I>(gqr, addr, value);
+}
+
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE void PPC_PsqStStackInline(uint32_t addr, double value)
+{
+    PPC_PsqStStackInline<W, I>(TryGetCpuContext(), addr, value);
+}
+
+// Context-free PSQ entries for translated regions which own GQR state as an
+// ordinary native value. All architecturally valid quantization encodings are
+// handled directly; reserved encodings retain the generic helper's abort.
+template <uint32_t W, uint32_t I, bool Stack>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline double PPC_PsqLStateFallback(uint32_t gqr, uint32_t addr)
+{
+    static_assert(W <= 1u && I < 8u);
+    const uint32_t type = (gqr >> 16) & 0x7u;
+    const uint32_t scale = (gqr >> 24) & 0x3Fu;
+    if constexpr (W == 0u)
+    {
+        switch (type)
+        {
+        case 0u: return Stack ? PpcLoadPairPsqFloatStackInline(addr) : PpcLoadPairPsqFloatFastInline(addr);
+        case 4u: return Stack ? PpcLoadPairPsqIntegerStackInline<uint8_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<uint8_t>(addr, scale);
+        case 5u: return Stack ? PpcLoadPairPsqIntegerStackInline<uint16_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<uint16_t>(addr, scale);
+        case 6u: return Stack ? PpcLoadPairPsqIntegerStackInline<int8_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<int8_t>(addr, scale);
+        case 7u: return Stack ? PpcLoadPairPsqIntegerStackInline<int16_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<int16_t>(addr, scale);
+        default: std::abort();
+        }
+    }
+    else
+    {
+        switch (type)
+        {
+        case 0u: return Stack ? PpcLoadSinglePsqFloatStackInline(addr) : PpcLoadSinglePsqFloatFastInline(addr);
+        case 4u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<uint8_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<uint8_t>(addr, scale);
+        case 5u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<uint16_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<uint16_t>(addr, scale);
+        case 6u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<int8_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<int8_t>(addr, scale);
+        case 7u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<int16_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<int16_t>(addr, scale);
+        default: std::abort();
+        }
+    }
+}
+
+// Keep the normal explicit-state path small and directly optimizable. Exact
+// unscaled encodings cover the SDK's common GQR setup; scaled and reserved
+// encodings retain the complete implementation in one cold outlined body.
+template <uint32_t W, uint32_t I, bool Stack>
+MKW_PPC_FORCE_INLINE double PPC_PsqLStateInline(uint32_t gqr, uint32_t addr)
+{
+    static_assert(W <= 1u && I < 8u);
+    switch (gqr & 0xFFFF0000u)
+    {
+    case 0x00000000u:
+        if constexpr (W == 0u) return Stack ? PpcLoadPairPsqFloatStackInline(addr) : PpcLoadPairPsqFloatFastInline(addr);
+        else return Stack ? PpcLoadSinglePsqFloatStackInline(addr) : PpcLoadSinglePsqFloatFastInline(addr);
+    case 0x00040000u:
+        if constexpr (W == 0u) return Stack ? PpcLoadPairPsqIntegerStackInline<uint8_t>(addr, 0u) : PpcLoadPairPsqIntegerFastInline<uint8_t>(addr, 0u);
+        else return Stack ? PpcLoadSinglePsqQuantizedStackInline<uint8_t>(addr, 0u) : PpcLoadSinglePsqQuantizedFastInline<uint8_t>(addr, 0u);
+    case 0x00050000u:
+        if constexpr (W == 0u) return Stack ? PpcLoadPairPsqIntegerStackInline<uint16_t>(addr, 0u) : PpcLoadPairPsqIntegerFastInline<uint16_t>(addr, 0u);
+        else return Stack ? PpcLoadSinglePsqQuantizedStackInline<uint16_t>(addr, 0u) : PpcLoadSinglePsqQuantizedFastInline<uint16_t>(addr, 0u);
+    case 0x00060000u:
+        if constexpr (W == 0u) return Stack ? PpcLoadPairPsqIntegerStackInline<int8_t>(addr, 0u) : PpcLoadPairPsqIntegerFastInline<int8_t>(addr, 0u);
+        else return Stack ? PpcLoadSinglePsqQuantizedStackInline<int8_t>(addr, 0u) : PpcLoadSinglePsqQuantizedFastInline<int8_t>(addr, 0u);
+    case 0x00070000u:
+        if constexpr (W == 0u) return Stack ? PpcLoadPairPsqIntegerStackInline<int16_t>(addr, 0u) : PpcLoadPairPsqIntegerFastInline<int16_t>(addr, 0u);
+        else return Stack ? PpcLoadSinglePsqQuantizedStackInline<int16_t>(addr, 0u) : PpcLoadSinglePsqQuantizedFastInline<int16_t>(addr, 0u);
+    default:
+        return PPC_PsqLStateFallback<W, I, Stack>(gqr, addr);
+    }
+}
+
+template <uint32_t W, uint32_t I, bool Stack>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline void PPC_PsqStStateFallback(uint32_t gqr, uint32_t addr, double value)
+{
+    static_assert(W <= 1u && I < 8u);
+    const uint32_t type = gqr & 0x7u;
+    const uint32_t scale = (gqr >> 8) & 0x3Fu;
+    if constexpr (W == 0u)
+    {
+        switch (type)
+        {
+        case 0u: Stack ? PpcStorePairPsqFloatStackInline(addr, value) : PpcStorePairPsqFloatFastInline(addr, value); return;
+        case 4u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<uint8_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<uint8_t>(addr, value, scale); return;
+        case 5u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<uint16_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<uint16_t>(addr, value, scale); return;
+        case 6u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<int8_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<int8_t>(addr, value, scale); return;
+        case 7u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<int16_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<int16_t>(addr, value, scale); return;
+        default: std::abort();
+        }
+    }
+    else
+    {
+        switch (type)
+        {
+        case 0u: if constexpr (Stack) PpcStoreSinglePsqFloatStackInline(addr, value); else PpcStoreSinglePsqFloatFastInline(addr, value); return;
+        case 4u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<uint8_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<uint8_t>(addr, value, scale); return;
+        case 5u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<uint16_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<uint16_t>(addr, value, scale); return;
+        case 6u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<int8_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<int8_t>(addr, value, scale); return;
+        case 7u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<int16_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<int16_t>(addr, value, scale); return;
+        default: std::abort();
+        }
+    }
+}
+
+template <uint32_t W, uint32_t I, bool Stack>
+MKW_PPC_FORCE_INLINE void PPC_PsqStStateInline(uint32_t gqr, uint32_t addr, double value)
+{
+    static_assert(W <= 1u && I < 8u);
+    switch (gqr & 0xFFFFu)
+    {
+    case 0x0000u:
+        if constexpr (W == 0u) Stack ? PpcStorePairPsqFloatStackInline(addr, value) : PpcStorePairPsqFloatFastInline(addr, value);
+        else Stack ? PpcStoreSinglePsqFloatStackInline(addr, value) : PpcStoreSinglePsqFloatFastInline(addr, value);
+        return;
+    case 0x0004u:
+        if constexpr (W == 0u) { if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<uint8_t>(addr, value, 0u); else PpcStorePairPsqQuantizedFastInline<uint8_t>(addr, value, 0u); }
+        else { if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<uint8_t>(addr, value, 0u); else PpcStoreSinglePsqQuantizedFastInline<uint8_t>(addr, value, 0u); }
+        return;
+    case 0x0005u:
+        if constexpr (W == 0u) { if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<uint16_t>(addr, value, 0u); else PpcStorePairPsqQuantizedFastInline<uint16_t>(addr, value, 0u); }
+        else { if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<uint16_t>(addr, value, 0u); else PpcStoreSinglePsqQuantizedFastInline<uint16_t>(addr, value, 0u); }
+        return;
+    case 0x0006u:
+        if constexpr (W == 0u) { if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<int8_t>(addr, value, 0u); else PpcStorePairPsqQuantizedFastInline<int8_t>(addr, value, 0u); }
+        else { if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<int8_t>(addr, value, 0u); else PpcStoreSinglePsqQuantizedFastInline<int8_t>(addr, value, 0u); }
+        return;
+    case 0x0007u:
+        if constexpr (W == 0u) { if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<int16_t>(addr, value, 0u); else PpcStorePairPsqQuantizedFastInline<int16_t>(addr, value, 0u); }
+        else { if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<int16_t>(addr, value, 0u); else PpcStoreSinglePsqQuantizedFastInline<int16_t>(addr, value, 0u); }
+        return;
+    default:
+        PPC_PsqStStateFallback<W, I, Stack>(gqr, addr, value);
+        return;
+    }
+}
+
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE double PPC_PsqLResolvedStateInline(
+    uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr)
+{
+    static_assert(W <= 1u && I < 8u);
+    if (!resolvedHost) [[unlikely]] return PPC_PsqLStateInline<W, I, false>(gqr, addr);
+    const uint32_t type = (gqr >> 16) & 0x7u;
+    const uint32_t scale = (gqr >> 24) & 0x3Fu;
+    if constexpr (W == 0u)
+    {
+        switch (type)
+        {
+        case 0u: return PpcLoadPairPsqFloatResolvedInline(resolvedHost, offset, addr);
+        case 4u: return PpcLoadPairPsqIntegerResolvedInline<uint8_t>(resolvedHost, offset, addr, scale);
+        case 5u: return PpcLoadPairPsqIntegerResolvedInline<uint16_t>(resolvedHost, offset, addr, scale);
+        case 6u: return PpcLoadPairPsqIntegerResolvedInline<int8_t>(resolvedHost, offset, addr, scale);
+        case 7u: return PpcLoadPairPsqIntegerResolvedInline<int16_t>(resolvedHost, offset, addr, scale);
+        default: std::abort();
+        }
+    }
+    else
+    {
+        switch (type)
+        {
+        case 0u: return PpcLoadSinglePsqFloatResolvedInline(resolvedHost, offset, addr);
+        case 4u: return PpcLoadSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, scale);
+        case 5u: return PpcLoadSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, scale);
+        case 6u: return PpcLoadSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, scale);
+        case 7u: return PpcLoadSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, scale);
+        default: std::abort();
+        }
+    }
+}
+
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE void PPC_PsqStResolvedStateInline(
+    uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value)
+{
+    static_assert(W <= 1u && I < 8u);
+    if (!resolvedHost) [[unlikely]]
+    {
+        PPC_PsqStStateInline<W, I, false>(gqr, addr, value);
+        return;
+    }
+    const uint32_t type = gqr & 0x7u;
+    const uint32_t scale = (gqr >> 8) & 0x3Fu;
+    if constexpr (W == 0u)
+    {
+        switch (type)
+        {
+        case 0u: PpcStorePairPsqFloatResolvedInline(resolvedHost, offset, addr, value); return;
+        case 4u: PpcStorePairPsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 5u: PpcStorePairPsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, scale); return;
+        case 6u: PpcStorePairPsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 7u: PpcStorePairPsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, scale); return;
+        default: std::abort();
+        }
+    }
+    else
+    {
+        switch (type)
+        {
+        case 0u: PpcStoreSinglePsqFloatResolvedInline(resolvedHost, offset, addr, value); return;
+        case 4u: PpcStoreSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 5u: PpcStoreSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, scale); return;
+        case 6u: PpcStoreSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 7u: PpcStoreSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, scale); return;
+        default: std::abort();
+        }
+    }
+}
+
+template <uint32_t W, uint32_t I, uint32_t GQR>
+MKW_PPC_FORCE_INLINE void PPC_PsqStKnownStackInline(CpuContext*, uint32_t addr, double value)
+{
+    static_assert(W <= 1u, "psq stack store W must be 0 or 1");
+    static_assert(I < 8u, "psq stack store GQR index must be 0..7");
+    constexpr uint32_t type = GQR & 0x7u;
+    constexpr uint32_t scale = (GQR >> 8) & 0x3Fu;
+if constexpr (type == 0u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqFloatStackInline(addr, value);
+        else PpcStoreSinglePsqFloatStackInline(addr, value);
+    }
+    else if constexpr (type == 4u)
+    {
+        if constexpr (W == 0u && scale == 61u)
+        {
+            if constexpr (W == 0u) PpcStorePairPsqQuantizedStackInline<uint8_t>(addr, value, scale);
+            else PpcStoreSinglePsqQuantizedStackInline<uint8_t>(addr, value, scale);
+        }
+        else
+        {
+            if constexpr (W == 0u) PpcStorePairPsqQuantizedStackInline<uint8_t>(addr, value, scale);
+            else PpcStoreSinglePsqQuantizedStackInline<uint8_t>(addr, value, scale);
+        }
+    }
+    else if constexpr (type == 5u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqQuantizedStackInline<uint16_t>(addr, value, scale);
+        else PpcStoreSinglePsqQuantizedStackInline<uint16_t>(addr, value, scale);
+    }
+    else if constexpr (type == 6u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqQuantizedStackInline<int8_t>(addr, value, scale);
+        else PpcStoreSinglePsqQuantizedStackInline<int8_t>(addr, value, scale);
+    }
+    else if constexpr (type == 7u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqQuantizedStackInline<int16_t>(addr, value, scale);
+        else PpcStoreSinglePsqQuantizedStackInline<int16_t>(addr, value, scale);
+    }
+    else
+    {
+        PPC_PsqSt(addr, value, W, I);
+    }
+}
+
+// Cold generic body for the resolved-host psq_l. Only reached with a non-null
+// resolvedHost; the null case keeps its original PPC_PsqL behaviour in the
+// force-inlined wrapper below.
+template <uint32_t W, uint32_t I>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline double PPC_PsqLResolvedGeneric(
+    uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr)
+{
+    if constexpr (W == 0u) {
+        switch (gqr & 0xFFFF0000u) {
+        case 0x00000000u: return PpcLoadPairPsqFloatResolvedInline(resolvedHost, offset, addr);
+        case 0x00040000u: return PpcLoadPairPsqIntegerResolvedInline<uint8_t>(resolvedHost, offset, addr);
+        case 0x00050000u: return PpcLoadPairPsqIntegerResolvedInline<uint16_t>(resolvedHost, offset, addr);
+        case 0x00060000u: return PpcLoadPairPsqIntegerResolvedInline<int8_t>(resolvedHost, offset, addr);
+        case 0x00070000u: return PpcLoadPairPsqIntegerResolvedInline<int16_t>(resolvedHost, offset, addr);
+        default: return PPC_PsqL(addr, W, I);
+        }
+    } else {
+        const uint32_t type = (gqr >> 16) & 7u;
+        const uint32_t scale = (gqr >> 24) & 0x3Fu;
+        switch (type) {
+        case 0u: return PpcLoadSinglePsqFloatResolvedInline(resolvedHost, offset, addr);
+        case 4u: return PpcLoadSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, scale);
+        case 5u: return PpcLoadSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, scale);
+        case 6u: return PpcLoadSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, scale);
+        case 7u: return PpcLoadSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, scale);
+        default: return PPC_PsqL(addr, W, I);
+        }
+    }
+}
+
+// Hot wrapper: resolved host pointer plus the float GQR encoding is the case
+// that dominates translated code, so it is a compare and a direct byteswapped
+// access. Null host and every non-float encoding stay out of line.
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE double PPC_PsqLResolvedInline(CpuContext* cpu, uint8_t* resolvedHost,
+                                                   uint32_t offset, uint32_t addr)
+{
+    if (!resolvedHost) [[unlikely]] return PPC_PsqL(addr, W, I);
+    const uint32_t gqr = cpu->gqr[I];
+    if constexpr (W == 0u) {
+        // Paired float: load type 0 with load scale 0.
+        if ((gqr & 0xFFFF0000u) == 0x00000000u) [[likely]]
+            return PpcLoadPairPsqFloatResolvedInline(resolvedHost, offset, addr);
+    } else {
+        // Scalar float ignores the load scale.
+        if (((gqr >> 16) & 7u) == 0u) [[likely]]
+            return PpcLoadSinglePsqFloatResolvedInline(resolvedHost, offset, addr);
+    }
+    return PPC_PsqLResolvedGeneric<W, I>(gqr, resolvedHost, offset, addr);
+}
+
+template <uint32_t W, uint32_t I, uint32_t GQR>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline double PPC_PsqLKnownResolvedFallback(
+    uint32_t addr)
+{
+    return PPC_PsqLKnownInline<W, I, GQR>(nullptr, addr);
+}
+
+template <uint32_t W, uint32_t I, uint32_t GQR>
+MKW_PPC_FORCE_INLINE double PPC_PsqLKnownResolvedInline(CpuContext* cpu, uint8_t* resolvedHost,
+                                                        uint32_t offset, uint32_t addr)
+{
+    if (!resolvedHost) [[unlikely]] return PPC_PsqLKnownResolvedFallback<W, I, GQR>(addr);
+    static_assert(W <= 1u, "psq resolved load W must be 0 or 1");
+    static_assert(I < 8u, "psq resolved load GQR index must be 0..7");
+    constexpr uint32_t type = (GQR >> 16) & 0x7u;
+    constexpr uint32_t scale = (GQR >> 24) & 0x3Fu;
+if constexpr (type == 0u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqFloatResolvedInline(resolvedHost, offset, addr);
+        else return PpcLoadSinglePsqFloatResolvedInline(resolvedHost, offset, addr);
+    }
+    else if constexpr (type == 4u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerResolvedInline<uint8_t>(resolvedHost, offset, addr, scale);
+        else return PpcLoadSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, scale);
+    }
+    else if constexpr (type == 5u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerResolvedInline<uint16_t>(resolvedHost, offset, addr, scale);
+        else return PpcLoadSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, scale);
+    }
+    else if constexpr (type == 6u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerResolvedInline<int8_t>(resolvedHost, offset, addr, scale);
+        else return PpcLoadSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, scale);
+    }
+    else if constexpr (type == 7u)
+    {
+if constexpr (W == 0u) return PpcLoadPairPsqIntegerResolvedInline<int16_t>(resolvedHost, offset, addr, scale);
+        else return PpcLoadSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, scale);
+    }
+    else
+    {
+        return PPC_PsqL(addr, W, I);
+    }
+}
+
+// Cold generic body for the resolved-host psq_st. Only reached with a non-null
+// resolvedHost; the null case keeps its original PPC_PsqSt behaviour in the
+// force-inlined wrapper below.
+template <uint32_t W, uint32_t I>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline void PPC_PsqStResolvedGeneric(
+    uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value)
+{
+    if constexpr (W == 0u) {
+        switch (gqr & 0xFFFFu) {
+        case 0x0000u: PpcStorePairPsqFloatResolvedInline(resolvedHost, offset, addr, value); return;
+        case 0x0004u: PpcStorePairPsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 0x0005u: PpcStorePairPsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 0x0006u: PpcStorePairPsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 0x0007u: PpcStorePairPsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 0x3D04u: PpcStorePairPsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, 61u); return;
+        default: PPC_PsqSt(addr, value, W, I); return;
+        }
+    } else {
+        const uint32_t type = gqr & 7u;
+        const uint32_t scale = (gqr >> 8) & 0x3Fu;
+        switch (type) {
+        case 0u: PpcStoreSinglePsqFloatResolvedInline(resolvedHost, offset, addr, value); return;
+        case 4u: PpcStoreSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 5u: PpcStoreSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, scale); return;
+        case 6u: PpcStoreSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 7u: PpcStoreSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, scale); return;
+        default: PPC_PsqSt(addr, value, W, I); return;
+        }
+    }
+}
+
+// Hot wrapper: resolved host pointer plus the float GQR encoding becomes a
+// compare and a direct byteswapped store. Null host and every non-float
+// encoding (including U8 scale 61) stay out of line.
+template <uint32_t W, uint32_t I>
+MKW_PPC_FORCE_INLINE void PPC_PsqStResolvedInline(CpuContext* cpu, uint8_t* resolvedHost,
+                                                  uint32_t offset, uint32_t addr, double value)
+{
+    if (!resolvedHost) [[unlikely]] { PPC_PsqSt(addr, value, W, I); return; }
+    const uint32_t gqr = cpu->gqr[I];
+    if constexpr (W == 0u) {
+        // Paired float: store type 0 with store scale 0.
+        if ((gqr & 0xFFFFu) == 0x0000u) [[likely]] {
+            PpcStorePairPsqFloatResolvedInline(resolvedHost, offset, addr, value);
+            return;
+        }
+    } else {
+        // Scalar float ignores the store scale.
+        if ((gqr & 7u) == 0u) [[likely]] {
+            PpcStoreSinglePsqFloatResolvedInline(resolvedHost, offset, addr, value);
+            return;
+        }
+    }
+    PPC_PsqStResolvedGeneric<W, I>(gqr, resolvedHost, offset, addr, value);
+}
+
+template <uint32_t W, uint32_t I, uint32_t GQR>
+MKW_PPC_NO_INLINE MKW_PPC_COLD inline void PPC_PsqStKnownResolvedFallback(
+    uint32_t addr, double value)
+{
+    PPC_PsqStKnownInline<W, I, GQR>(nullptr, addr, value);
+}
+
+
+template <uint32_t W, uint32_t I, uint32_t GQR>
+MKW_PPC_FORCE_INLINE void PPC_PsqStKnownResolvedInline(CpuContext* cpu, uint8_t* resolvedHost,
+                                                       uint32_t offset, uint32_t addr, double value)
+{
+    if (!resolvedHost) [[unlikely]] { PPC_PsqStKnownResolvedFallback<W, I, GQR>(addr, value); return; }
+    static_assert(W <= 1u, "psq resolved store W must be 0 or 1");
+    static_assert(I < 8u, "psq resolved store GQR index must be 0..7");
+    constexpr uint32_t type = GQR & 0x7u;
+    constexpr uint32_t scale = (GQR >> 8) & 0x3Fu;
+if constexpr (type == 0u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqFloatResolvedInline(resolvedHost, offset, addr, value);
+        else PpcStoreSinglePsqFloatResolvedInline(resolvedHost, offset, addr, value);
+    }
+    else if constexpr (type == 4u)
+    {
+        if constexpr (W == 0u && scale == 61u)
+        {
+            if constexpr (W == 0u) PpcStorePairPsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale);
+            else PpcStoreSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale);
+        }
+        else
+        {
+            if constexpr (W == 0u) PpcStorePairPsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale);
+            else PpcStoreSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale);
+        }
+    }
+    else if constexpr (type == 5u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, scale);
+        else PpcStoreSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, scale);
+    }
+    else if constexpr (type == 6u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, scale);
+        else PpcStoreSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, scale);
+    }
+    else if constexpr (type == 7u)
+    {
+if constexpr (W == 0u) PpcStorePairPsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, scale);
+        else PpcStoreSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, scale);
+    }
+    else
+    {
+        PPC_PsqSt(addr, value, W, I);
+    }
+}
diff --git a/runtime/include/memory.h b/runtime/include/memory.h
new file mode 100644
index 0000000..14fe9ca
--- /dev/null
+++ b/runtime/include/memory.h
@@ -0,0 +1,116 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <filesystem>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <vector>
+
+class Memory {
+public:
+    using DeferredReadCallback = bool (*)(void* user);
+
+    static constexpr size_t kMem1Size = 24u * 1024u * 1024u;
+    static constexpr size_t kMem2Size = 128u * 1024u * 1024u;
+    static constexpr uint32_t kMem1PhysicalBase = 0x00000000u;
+    static constexpr uint32_t kMem1CachedBase = 0x80000000u;
+    static constexpr uint32_t kMem1UncachedBase = 0xC0000000u;
+    static constexpr uint32_t kMem2PhysicalBase = 0x10000000u;
+    static constexpr uint32_t kMem2CachedBase = 0x90000000u;
+    static constexpr uint32_t kMem2UncachedBase = 0xD0000000u;
+    static constexpr uint32_t kMem2PhysicalEnd =
+        kMem2PhysicalBase + static_cast<uint32_t>(kMem2Size);
+    static constexpr uint32_t kMem2CachedEnd =
+        kMem2CachedBase + static_cast<uint32_t>(kMem2Size);
+    static constexpr uint32_t kMem2UncachedEnd =
+        kMem2UncachedBase + static_cast<uint32_t>(kMem2Size);
+
+    struct RegionConfig {
+        std::string name;
+        uint32_t baseAddress = 0;
+        size_t sizeBytes = 0;
+    };
+
+    struct Config {
+        std::vector<RegionConfig> regions;
+        static Config WiiDefaults();
+    };
+
+    class AccessViolation : public std::runtime_error {
+    public:
+        AccessViolation(uint32_t address, size_t length, std::string_view reason);
+
+        uint32_t address() const noexcept { return address_; }
+        size_t length() const noexcept { return length_; }
+        std::string_view reason() const noexcept { return reason_; }
+
+    private:
+        uint32_t address_ = 0;
+        size_t length_ = 0;
+        std::string reason_;
+    };
+
+    static void Init(const Config& config);
+    // Single flat MEM1 region. Not used by the shipped runtime, but the
+    // translator integration-test harnesses emit calls to it.
+    static void Init(size_t mem1Size);
+    static void Reset();
+    // Executable ranges are normally registered during startup. Rebuild the
+    // writable fast-path classification after each registration so a page
+    // previously classified as ordinary data cannot retain a stale direct
+    // write bias.
+    static void RefreshWritableFastPathsForExecutableRanges();
+
+    static uint8_t Read8(uint32_t addr);
+    static uint16_t Read16(uint32_t addr);
+    static uint32_t Read32(uint32_t addr);
+    static uint64_t Read64(uint32_t addr);
+    static float ReadFloat32(uint32_t addr);
+    static double ReadFloat64(uint32_t addr);
+    static void Write8(uint32_t addr, uint8_t val);
+    static void Write16(uint32_t addr, uint16_t val);
+    static void Write32(uint32_t addr, uint32_t val);
+    static void Write64(uint32_t addr, uint64_t val);
+    static void WriteFloat32(uint32_t addr, double val);
+    static void WriteFloat64(uint32_t addr, double val);
+
+    // Exception-safe scalar access for HLE code. These keep Read32/Write32's
+    // full mapping behavior and only convert an unmapped address into a failure
+    // result; they are deliberately not MemoryInline::Try*GuestScalar, which is
+    // the translated-code fast path over the page table.
+    static bool TryRead32(uint32_t addr, uint32_t& value) noexcept {
+        try {
+            value = Read32(addr);
+            return true;
+        } catch (const AccessViolation&) {
+            return false;
+        }
+    }
+
+    static bool TryWrite32(uint32_t addr, uint32_t value) noexcept {
+        try {
+            Write32(addr, value);
+            return true;
+        } catch (const AccessViolation&) {
+            return false;
+        }
+    }
+
+    static uint8_t* GetPointer(uint32_t addr);
+    static uint8_t* GetPointer(uint32_t addr, size_t length);
+    static bool Contains(uint32_t addr, size_t length = 1);
+
+    static uint64_t RegisterDeferredRead(uint32_t addr, size_t length,
+                                         DeferredReadCallback callback, void* user);
+    static void ClearDeferredReads();
+
+    // sizeBytes reports the storage actually allocated, which is not always the
+    // configured size (aliased MEM1/MEM2 windows are clamped to what is behind
+    // them). Used by the crash dump.
+    static std::vector<RegionConfig> DescribeRegions();
+};
+
+// The translated-code access layer is kept separately from the public memory API.
+#include "memory_access.h"
diff --git a/runtime/include/memory_access.h b/runtime/include/memory_access.h
new file mode 100644
index 0000000..c1cca16
--- /dev/null
+++ b/runtime/include/memory_access.h
@@ -0,0 +1,696 @@
+#pragma once
+
+#include "guest_flat_memory.h"
+#include "memory.h"
+#include "recomp_mod_loader.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+// Hooks for GX HLE FIFO handling
+extern "C" {
+    void GX_HLE_FIFO_WriteFloat(float val);
+    void GX_HLE_FIFO_Write32(uint32_t val);
+    void GX_HLE_FIFO_Write16(uint16_t val);
+    void GX_HLE_FIFO_Write8(uint8_t val);
+    void GX_HLE_FIFO_WriteBurst(const uint8_t* data, uint32_t sizeBytes);
+}
+
+namespace MemoryInline {
+#define MKW_MEMORY_FORCE_INLINE __forceinline
+#define MKW_MEMORY_NO_INLINE __declspec(noinline)
+#define MKW_MEMORY_COLD __attribute__((cold))
+inline constexpr uint32_t kPageShift = 20;
+inline constexpr uint32_t kPageSize = 1u << kPageShift;
+inline constexpr uint32_t kPageMask = kPageSize - 1u;
+inline constexpr uint32_t kPageCount = 1u << (32 - kPageShift);
+inline constexpr uint32_t kMaxFastScalarSize = 8;
+inline constexpr uint32_t kWritableSubPageShift = RecompMod::kExecutableWriteGuardPageShift;
+inline constexpr uint32_t kWritableSubPageSize = 1u << kWritableSubPageShift;
+inline constexpr uint32_t kWritableSubPagesPerPage = kPageSize / kWritableSubPageSize;
+
+struct PageEntry {
+    uint8_t* base = nullptr;
+    uint32_t limit = 0;
+};
+
+extern PageEntry g_pageTable[kPageCount];
+// Encoded (host page base - guest page base) + 1 for full pages whose next
+// page is contiguous. This permits any native access up to 8 bytes without a
+// per-access mask/limit check. Zero retains the general PageEntry fallback.
+extern uintptr_t g_fullPageBias[kPageCount];
+// Runtime-active readable biases. Deferred-read pages clear these entries once
+// instead of paying a mode branch on every translated read.
+extern uintptr_t g_fullReadablePageBias[kPageCount];
+// Same encoding, but only for pages proven not to contain executable bytes.
+// Executable-range registration invalidates entries before guest execution.
+extern uintptr_t g_fullWritablePageBias[kPageCount];
+
+// Allocated only for mapped 1 MiB pages that contain both executable and data
+// 4 KiB pages. Entries use the same encoded host bias as the coarse table.
+// Exact executable bits remain authoritative and are checked at lookup time,
+// including both sides of a cross-4-KiB access.
+struct SparseWritablePageTable {
+    uintptr_t encodedBias[kWritableSubPagesPerPage]{};
+};
+extern const SparseWritablePageTable* g_sparseWritablePageTables[kPageCount];
+
+// Nonzero while any registered deferred read overlaps the page. Small
+// mappings (e.g. the 16 KiB locked cache) have no coarse bias entry, so a
+// zero readable bias alone cannot distinguish "deferred content pending"
+// from "small but plain memory"; range resolution needs the explicit flag.
+extern uint8_t g_deferredReadCoveredPages[kPageCount];
+
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD uint8_t Read8Slow(uint32_t addr);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD uint16_t Read16Slow(uint32_t addr);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD uint32_t Read32Slow(uint32_t addr);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD uint64_t Read64Slow(uint32_t addr);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD float ReadFloat32Slow(uint32_t addr);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD double ReadFloat64Slow(uint32_t addr);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD void Write8Slow(uint32_t addr, uint8_t val);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD void Write16Slow(uint32_t addr, uint16_t val);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD void Write32Slow(uint32_t addr, uint32_t val);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD void Write64Slow(uint32_t addr, uint64_t val);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD void WriteFloat32Slow(uint32_t addr, double val);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD void WriteFloat64Slow(uint32_t addr, double val);
+template <typename T>
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD T ReadResolvedFallback(uint32_t addr);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD float ReadResolvedFallbackFloat32(uint32_t addr);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD double ReadResolvedFallbackFloat64(uint32_t addr);
+template <typename T>
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD void WriteResolvedFallback(uint32_t addr, T value);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD void WriteResolvedFallbackFloat32(uint32_t addr, double val);
+MKW_MEMORY_NO_INLINE MKW_MEMORY_COLD void WriteResolvedFallbackFloat64(uint32_t addr, double val);
+bool ResolveDeferredReads(uint32_t addr, size_t length);
+
+constexpr bool IsMmioAddress(uint32_t addr) {
+    return addr >= 0xCC000000u && addr < 0xCE000000u;
+}
+
+constexpr bool IsGpuFifoAddress(uint32_t addr) {
+    return addr >= 0xCC008000u && addr < 0xCC008100u;
+}
+
+// Page protections can't cover this: an MMIO write must reach GX HLE with its value or be
+// reported, and a fault record can't carry the value, so this mask/compare sits in front of
+// every flat store instead.
+MKW_MEMORY_FORCE_INLINE bool FlatWriteNeedsPolicy(uint32_t address) {
+    return (address & 0xFE000000u) == 0xCC000000u;  // 0xCC000000..0xCDFFFFFF
+}
+
+// Gekko stfs conversion is a bit-level narrowing operation.  In particular it
+// does not behave like a host double-to-float cast for values which were left
+// in double precision, and it has hardware-tested handling for tiny values.
+MKW_MEMORY_FORCE_INLINE uint32_t ConvertPpcDoubleToSingleBits(double value) {
+    uint64_t bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    const uint32_t exponent = static_cast<uint32_t>((bits >> 52) & 0x7FFu);
+    // The subnormal-single arm applies to exactly the exponents 874..896; every
+    // other exponent takes the plain sign/exponent/fraction narrowing below.
+    // Inside that window the exponent field is nonzero, so the magnitude cannot
+    // be zero and needs no separate test - the zero case (exponent 0) reaches
+    // the narrowing exactly as it did when the two arms shared that test.
+    if (exponent - 874u <= 22u) [[unlikely]]
+    {
+        uint32_t narrowed = static_cast<uint32_t>(
+            0x80000000ULL | ((bits & 0x000FFFFFFFFFFFFFULL) >> 21));
+        narrowed >>= (905u - exponent);
+        narrowed |= static_cast<uint32_t>((bits >> 32) & 0x80000000ULL);
+        return narrowed;
+    }
+
+    // Results below the documented conversion range are architecturally
+    // undefined; this is the behavior measured on Gekko/Broadway hardware.
+    return static_cast<uint32_t>(
+        ((bits >> 32) & 0xC0000000ULL) | ((bits >> 29) & 0x3FFFFFFFULL));
+}
+
+MKW_MEMORY_FORCE_INLINE float PpcSingleBitsToFloat(uint32_t bits) {
+    float value = 0.0f;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+MKW_MEMORY_FORCE_INLINE bool TryGetPointerFast(uint32_t address, size_t length, uint8_t*& pointer) {
+    const uint32_t page = address >> kPageShift;
+    if (length <= 8) {
+        const uintptr_t encodedBias = g_fullPageBias[page];
+        if (encodedBias != 0) {
+            pointer = reinterpret_cast<uint8_t*>((encodedBias - 1u) + address);
+            return true;
+        }
+    }
+    const uint32_t offset = address & kPageMask;
+    const auto& entry = g_pageTable[page];
+    if (!entry.base || offset + length > entry.limit) {
+        pointer = nullptr;
+        return false;
+    }
+    pointer = entry.base + offset;
+    return true;
+}
+
+inline uint8_t* GetPointerFast(uint32_t address, size_t length) {
+    uint8_t* pointer = nullptr;
+    return TryGetPointerFast(address, length, pointer) ? pointer : nullptr;
+}
+
+MKW_MEMORY_FORCE_INLINE bool TryGetWritablePointerFast(
+    uint32_t address, size_t length, uint8_t*& pointer) {
+    // The sparse-table hit below distinguishes itself from the small-mapping
+    // hit through `pointer`, so the out-parameter must start null regardless
+    // of what the caller passed in. (A caller handing in an uninitialized
+    // pointer used to turn every sparse hit into a write through stack
+    // garbage - random host memory corruption.)
+    pointer = nullptr;
+    if (length == 0 || length > 8 || address > UINT32_MAX - (length - 1))
+        return false;
+    const uint32_t coarsePage = address >> kPageShift;
+    uintptr_t encodedBias = g_fullWritablePageBias[coarsePage];
+    const uint32_t endAddress = address + static_cast<uint32_t>(length - 1);
+    const uint32_t firstExactPage = address >> kWritableSubPageShift;
+    const uint32_t lastExactPage = endAddress >> kWritableSubPageShift;
+    if (encodedBias != 0 && (endAddress >> kPageShift) != coarsePage &&
+        RecompMod::g_executableWriteGuardPages[lastExactPage].load(
+            std::memory_order_relaxed) != 0) {
+        return false;
+    }
+    if (encodedBias == 0) {
+        const auto* subTable = g_sparseWritablePageTables[coarsePage];
+        if (subTable != nullptr) {
+            encodedBias = subTable->encodedBias[
+                (address & kPageMask) >> kWritableSubPageShift];
+            if (encodedBias == 0)
+                return false;
+        } else {
+            // Small mappings such as Broadway's 16 KiB locked cache cannot
+            // populate the full-1-MiB bias table. Keep them native by proving
+            // the exact access against the ordinary page entry, then applying
+            // the same executable-write policy as a sparse-table hit.
+            const uint32_t offset = address & kPageMask;
+            const auto& entry = g_pageTable[coarsePage];
+            if (!entry.base || offset + length > entry.limit)
+                return false;
+            pointer = entry.base + offset;
+        }
+
+        // The exact 4 KiB guard is the final authority. Checking it on every
+        // checked/sparse hit also makes later executable-range registration
+        // safe when a prebuilt table still contains the old mapped bias.
+        if (RecompMod::g_executableWriteGuardPages[firstExactPage].load(
+                std::memory_order_relaxed) != 0 ||
+            (lastExactPage != firstExactPage &&
+             RecompMod::g_executableWriteGuardPages[lastExactPage].load(
+                 std::memory_order_relaxed) != 0)) {
+            return false;
+        }
+
+        if (pointer != nullptr)
+            return true;
+    }
+    if (encodedBias == 0)
+        return false;
+    pointer = reinterpret_cast<uint8_t*>((encodedBias - 1u) + address);
+    return true;
+}
+
+// Flat form: guest_flat_memory.h's page protections already answer mapped/non-deferred/non-executable, so resolving is pure address arithmetic.
+// Two checks stay inline: a wrapped guest address can't survive 64-bit `host + rangeOffset`, and an MMIO write's value isn't recoverable from a
+// fault record, so a write touching that window must resolve null and fall back to Memory::Write*. Checking both range endpoints is a complete
+// proof since length <= kPageSize (1 MiB) can't straddle the 32 MiB MMIO window.
+MKW_MEMORY_FORCE_INLINE uint8_t* ResolveRangeHost(uint32_t base, int32_t minOffset, uint32_t length,
+                                                 bool needsRead, bool needsWrite) {
+    (void)needsRead;
+    const uint32_t guestStart = base + static_cast<uint32_t>(minOffset);
+    if (length == 0 || length > kPageSize || guestStart > UINT32_MAX - (length - 1)) return nullptr;
+    if (needsWrite &&
+        (FlatWriteNeedsPolicy(guestStart) || FlatWriteNeedsPolicy(guestStart + (length - 1))))
+        [[unlikely]] return nullptr;
+    return MKW_FLAT_GUEST_BASE + guestStart;
+}
+
+// Guest-address byte order. Distinct from isa/big_endian.h, which is the
+// host-pointer codec; do not "unify" them.
+inline uint16_t ByteSwap16(uint16_t value) {
+    return __builtin_bswap16(value);
+}
+
+inline uint32_t ByteSwap32(uint32_t value) {
+    return __builtin_bswap32(value);
+}
+
+inline uint64_t ByteSwap64(uint64_t value) {
+    return __builtin_bswap64(value);
+}
+
+template <typename T>
+inline T MaybeByteSwap(T value) {
+    if constexpr (sizeof(T) == 1) {
+        return value;
+    } else if constexpr (sizeof(T) == 2) {
+        return static_cast<T>(ByteSwap16(static_cast<uint16_t>(value)));
+    } else if constexpr (sizeof(T) == 4) {
+        return static_cast<T>(ByteSwap32(static_cast<uint32_t>(value)));
+    } else if constexpr (sizeof(T) == 8) {
+        return static_cast<T>(ByteSwap64(static_cast<uint64_t>(value)));
+    } else {
+        return value;
+    }
+}
+
+template <typename T>
+MKW_MEMORY_FORCE_INLINE bool ReadResolvedScalar(uint8_t* host, uint32_t rangeOffset, T& outValue) {
+    if (!host) return false;
+    if constexpr (sizeof(T) == 1) {
+        outValue = host[rangeOffset];
+    } else {
+        T value = 0;
+        std::memcpy(&value, host + rangeOffset, sizeof(T));
+        outValue = MaybeByteSwap(value);
+    }
+    return true;
+}
+
+struct ResolvedLoadPair {
+    uint32_t first = 0;
+    uint32_t second = 0;
+    bool valid = false;
+};
+
+MKW_MEMORY_FORCE_INLINE ResolvedLoadPair ReadResolvedPair16(
+    uint8_t* host, uint32_t rangeOffset) {
+    uint32_t packed = 0;
+    if (!ReadResolvedScalar(host, rangeOffset, packed)) return {};
+    return {packed >> 16, packed & 0xFFFFu, true};
+}
+
+MKW_MEMORY_FORCE_INLINE ResolvedLoadPair ReadResolvedPair32(uint8_t* host, uint32_t rangeOffset) {
+    uint64_t packed = 0;
+    if (!ReadResolvedScalar(host, rangeOffset, packed)) return {};
+    return {static_cast<uint32_t>(packed >> 32), static_cast<uint32_t>(packed), true};
+}
+
+template <typename Packed>
+MKW_MEMORY_FORCE_INLINE bool WriteResolvedPairFast(
+    uint8_t* host, uint32_t rangeOffset, Packed packed) {
+    if (!host) return false;
+    const Packed swapped = MaybeByteSwap(packed);
+    std::memcpy(host + rangeOffset, &swapped, sizeof(swapped));
+    return true;
+}
+
+MKW_MEMORY_FORCE_INLINE bool WriteResolvedPair16(
+    uint8_t* host, uint32_t rangeOffset, uint32_t packed) {
+    return WriteResolvedPairFast(host, rangeOffset, packed);
+}
+
+MKW_MEMORY_FORCE_INLINE bool WriteResolvedPair32(
+    uint8_t* host, uint32_t rangeOffset, uint64_t packed) {
+    return WriteResolvedPairFast(host, rangeOffset, packed);
+}
+
+template <typename T>
+MKW_MEMORY_FORCE_INLINE bool WriteResolvedScalar(uint8_t* host, uint32_t rangeOffset, T value) {
+    if (!host) return false;
+    if constexpr (sizeof(T) == 1) {
+        host[rangeOffset] = static_cast<uint8_t>(value);
+    } else {
+        const T swapped = MaybeByteSwap(value);
+        std::memcpy(host + rangeOffset, &swapped, sizeof(T));
+    }
+    return true;
+}
+
+template <typename T>
+inline bool TryReadMappedScalar(uint32_t address, T& outValue) {
+    uint8_t* ptr = nullptr;
+    if (TryGetPointerFast(address, sizeof(T), ptr)) {
+        if constexpr (sizeof(T) == 1) {
+            outValue = *ptr;
+        } else {
+            T value = 0;
+            std::memcpy(&value, ptr, sizeof(T));
+            outValue = MaybeByteSwap(value);
+        }
+        return true;
+    }
+    return false;
+}
+
+template <typename T>
+MKW_MEMORY_FORCE_INLINE bool TryReadGuestScalar(uint32_t address, T& outValue) {
+    const uintptr_t encodedBias = g_fullReadablePageBias[address >> kPageShift];
+    if (encodedBias == 0) [[unlikely]]
+        return false;
+    auto* ptr = reinterpret_cast<uint8_t*>((encodedBias - 1u) + address);
+    if constexpr (sizeof(T) == 1) {
+        outValue = *ptr;
+    } else {
+        T value = 0;
+        std::memcpy(&value, ptr, sizeof(T));
+        outValue = MaybeByteSwap(value);
+    }
+    return true;
+}
+
+template <typename T>
+MKW_MEMORY_FORCE_INLINE bool TryWriteGuestScalar(uint32_t address, T value) {
+    static_assert(sizeof(T) >= 1 && sizeof(T) <= kMaxFastScalarSize);
+    // A mixed executable/data 1 MiB page zeroes the coarse writable bias even though most of
+    // its 4 KiB sub-pages are plain data; MKW's THP buffers share such a page with .text, which
+    // used to force ~15% of total CPU through the cold path. The sparse sub-page tier below
+    // keeps those stores native while the exact 4 KiB executable guards stay authoritative.
+    if (address > UINT32_MAX - static_cast<uint32_t>(sizeof(T) - 1u)) [[unlikely]]
+        return false;
+    const uint32_t coarsePage = address >> kPageShift;
+    const uint32_t endAddress = address + static_cast<uint32_t>(sizeof(T) - 1u);
+    if ((endAddress >> kPageShift) != coarsePage) [[unlikely]]
+        return false;
+    const uintptr_t encodedBias = g_fullWritablePageBias[coarsePage];
+    uint8_t* ptr = nullptr;
+    if (encodedBias != 0) {
+        ptr = reinterpret_cast<uint8_t*>((encodedBias - 1u) + address);
+    } else if (!TryGetWritablePointerFast(address, sizeof(T), ptr)) [[unlikely]] {
+        return false;
+    }
+    if constexpr (sizeof(T) == 1) {
+        *ptr = static_cast<uint8_t>(value);
+    } else {
+        const T swapped = MaybeByteSwap(value);
+        std::memcpy(ptr, &swapped, sizeof(T));
+    }
+    return true;
+}
+
+template <typename T>
+inline bool WriteStackScalarFast(uint32_t address, T value) {
+    uint8_t* ptr = nullptr;
+    if (TryGetPointerFast(address, sizeof(T), ptr)) {
+        if constexpr (sizeof(T) == 1) {
+            *ptr = static_cast<uint8_t>(value);
+        } else {
+            const T swapped = MaybeByteSwap(value);
+            std::memcpy(ptr, &swapped, sizeof(T));
+        }
+        return true;
+    }
+    return false;
+}
+
+inline uint8_t ReadStack8(uint32_t address) {
+    uint8_t value = 0;
+    return TryReadMappedScalar(address, value) ? value : Memory::Read8(address);
+}
+
+inline uint16_t ReadStack16(uint32_t address) {
+    uint16_t value = 0;
+    return TryReadMappedScalar(address, value) ? value : Memory::Read16(address);
+}
+
+inline uint32_t ReadStack32(uint32_t address) {
+    uint32_t value = 0;
+    return TryReadMappedScalar(address, value) ? value : Memory::Read32(address);
+}
+
+inline uint64_t ReadStack64(uint32_t address) {
+    uint64_t value = 0;
+    return TryReadMappedScalar(address, value) ? value : Memory::Read64(address);
+}
+
+
+
+inline void WriteStack8(uint32_t address, uint8_t value) {
+    if (!WriteStackScalarFast(address, value)) {
+        Memory::Write8(address, value);
+    }
+}
+
+inline void WriteStack16(uint32_t address, uint16_t value) {
+    if (!WriteStackScalarFast(address, value)) {
+        Memory::Write16(address, value);
+    }
+}
+
+inline void WriteStack32(uint32_t address, uint32_t value) {
+    if (!WriteStackScalarFast(address, value)) {
+        Memory::Write32(address, value);
+    }
+}
+
+inline void WriteStack64(uint32_t address, uint64_t value) {
+    if (!WriteStackScalarFast(address, value)) {
+        Memory::Write64(address, value);
+    }
+}
+
+inline void WriteStackFloat32(uint32_t address, double value) {
+    const uint32_t bits = ConvertPpcDoubleToSingleBits(value);
+    if (!WriteStackScalarFast(address, bits)) {
+        Memory::WriteFloat32(address, value);
+    }
+}
+
+inline void WriteStackFloat64(uint32_t address, double value) {
+    uint64_t bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    if (!WriteStackScalarFast(address, bits)) {
+        Memory::WriteFloat64(address, value);
+    }
+}
+
+template <typename T, typename SlowRead>
+MKW_MEMORY_FORCE_INLINE T ReadResolved(uint8_t* host, uint32_t rangeOffset, uint32_t address,
+                      SlowRead slow) {
+    T value = 0;
+    if (ReadResolvedScalar(host, rangeOffset, value)) {
+        return value;
+    }
+    [[unlikely]] return slow(address);
+}
+
+MKW_MEMORY_FORCE_INLINE uint8_t ReadResolved8(uint8_t* r, uint32_t o, uint32_t a) { return ReadResolved<uint8_t>(r, o, a, ReadResolvedFallback<uint8_t>); }
+MKW_MEMORY_FORCE_INLINE uint16_t ReadResolved16(uint8_t* r, uint32_t o, uint32_t a) { return ReadResolved<uint16_t>(r, o, a, ReadResolvedFallback<uint16_t>); }
+MKW_MEMORY_FORCE_INLINE uint32_t ReadResolved32(uint8_t* r, uint32_t o, uint32_t a) { return ReadResolved<uint32_t>(r, o, a, ReadResolvedFallback<uint32_t>); }
+// Live via isa/ppc_isa_quantized.h (the psq resolved tier packs two lanes into
+// one 64-bit access); generated code never names it directly.
+MKW_MEMORY_FORCE_INLINE uint64_t ReadResolved64(uint8_t* r, uint32_t o, uint32_t a) { return ReadResolved<uint64_t>(r, o, a, ReadResolvedFallback<uint64_t>); }
+MKW_MEMORY_FORCE_INLINE float ReadResolvedFloat32(uint8_t* r, uint32_t o, uint32_t a) {
+    uint32_t bits = 0;
+    if (!ReadResolvedScalar(r, o, bits)) [[unlikely]] return ReadResolvedFallbackFloat32(a);
+    float value; std::memcpy(&value, &bits, sizeof(value)); return value;
+}
+MKW_MEMORY_FORCE_INLINE double ReadResolvedFloat64(uint8_t* r, uint32_t o, uint32_t a) {
+    uint64_t bits = 0;
+    if (!ReadResolvedScalar(r, o, bits)) [[unlikely]] return ReadResolvedFallbackFloat64(a);
+    double value; std::memcpy(&value, &bits, sizeof(value)); return value;
+}
+
+template <typename T, typename SlowWrite>
+MKW_MEMORY_FORCE_INLINE void WriteResolved(uint8_t* host, uint32_t rangeOffset, uint32_t address, T value,
+                          SlowWrite slow) {
+    if (WriteResolvedScalar(host, rangeOffset, value)) {
+        return;
+    }
+    [[unlikely]] slow(address, value);
+}
+
+MKW_MEMORY_FORCE_INLINE void WriteResolved8(uint8_t* r, uint32_t o, uint32_t a, uint8_t v) { WriteResolved(r, o, a, v, WriteResolvedFallback<uint8_t>); }
+MKW_MEMORY_FORCE_INLINE void WriteResolved16(uint8_t* r, uint32_t o, uint32_t a, uint16_t v) { WriteResolved(r, o, a, v, WriteResolvedFallback<uint16_t>); }
+MKW_MEMORY_FORCE_INLINE void WriteResolved32(uint8_t* r, uint32_t o, uint32_t a, uint32_t v) { WriteResolved(r, o, a, v, WriteResolvedFallback<uint32_t>); }
+// Live via isa/ppc_isa_quantized.h, as ReadResolved64 above.
+MKW_MEMORY_FORCE_INLINE void WriteResolved64(uint8_t* r, uint32_t o, uint32_t a, uint64_t v) { WriteResolved(r, o, a, v, WriteResolvedFallback<uint64_t>); }
+MKW_MEMORY_FORCE_INLINE void WriteResolvedFloat32(uint8_t* r, uint32_t o, uint32_t a, double v) {
+    const uint32_t bits = ConvertPpcDoubleToSingleBits(v);
+    if (WriteResolvedScalar(r, o, bits)) return;
+    [[unlikely]] WriteResolvedFallbackFloat32(a, v);
+}
+MKW_MEMORY_FORCE_INLINE void WriteResolvedFloat64(uint8_t* r, uint32_t o, uint32_t a, double v) {
+    uint64_t bits; std::memcpy(&bits, &v, sizeof(bits));
+    if (WriteResolvedScalar(r, o, bits)) return;
+    [[unlikely]] WriteResolvedFallbackFloat64(a, v);
+}
+
+// Flat guest memory (audit item T-MEM): the 4 GiB reservation makes a guest access a byte swap
+// around `*(T*)(base + addr)`, no page-table load or limit check (interception model documented
+// in guest_flat_memory.h). The one exception kept inline is the MMIO write policy, since the
+// written value can't be recovered from a fault record.
+
+template <typename T>
+MKW_MEMORY_FORCE_INLINE T FlatLoad(uint32_t address) {
+    T value{};
+    std::memcpy(&value, MKW_FLAT_GUEST_BASE + address, sizeof(T));
+    return MaybeByteSwap(value);
+}
+
+template <typename T>
+MKW_MEMORY_FORCE_INLINE void FlatStore(uint32_t address, T value) {
+    const T swapped = MaybeByteSwap(value);
+    std::memcpy(MKW_FLAT_GUEST_BASE + address, &swapped, sizeof(T));
+}
+
+MKW_MEMORY_FORCE_INLINE uint8_t FlatRead8(uint32_t address) { return FlatLoad<uint8_t>(address); }
+MKW_MEMORY_FORCE_INLINE uint16_t FlatRead16(uint32_t address) { return FlatLoad<uint16_t>(address); }
+MKW_MEMORY_FORCE_INLINE uint32_t FlatRead32(uint32_t address) { return FlatLoad<uint32_t>(address); }
+
+MKW_MEMORY_FORCE_INLINE float FlatReadFloat32(uint32_t address) {
+    const uint32_t bits = FlatLoad<uint32_t>(address);
+    float value = 0.0f;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+MKW_MEMORY_FORCE_INLINE double FlatReadFloat64(uint32_t address) {
+    const uint64_t bits = FlatLoad<uint64_t>(address);
+    double value = 0.0;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+MKW_MEMORY_FORCE_INLINE void FlatWrite8(uint32_t address, uint8_t value) {
+    if (FlatWriteNeedsPolicy(address)) [[unlikely]] { Write8Slow(address, value); return; }
+    FlatStore<uint8_t>(address, value);
+}
+
+MKW_MEMORY_FORCE_INLINE void FlatWrite16(uint32_t address, uint16_t value) {
+    if (FlatWriteNeedsPolicy(address)) [[unlikely]] { Write16Slow(address, value); return; }
+    FlatStore<uint16_t>(address, value);
+}
+
+MKW_MEMORY_FORCE_INLINE void FlatWrite32(uint32_t address, uint32_t value) {
+    if (FlatWriteNeedsPolicy(address)) [[unlikely]] { Write32Slow(address, value); return; }
+    FlatStore<uint32_t>(address, value);
+}
+
+
+MKW_MEMORY_FORCE_INLINE void FlatWriteFloat32(uint32_t address, double value) {
+    const uint32_t bits = ConvertPpcDoubleToSingleBits(value);
+    if (FlatWriteNeedsPolicy(address)) [[unlikely]] { WriteFloat32Slow(address, value); return; }
+    FlatStore<uint32_t>(address, bits);
+}
+
+MKW_MEMORY_FORCE_INLINE void FlatWriteFloat64(uint32_t address, double value) {
+    uint64_t bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    if (FlatWriteNeedsPolicy(address)) [[unlikely]] { WriteFloat64Slow(address, value); return; }
+    FlatStore<uint64_t>(address, bits);
+}
+
+// Check-free stores: emitted ONLY for addresses the translator proved at translate time are ordinary guest RAM (r1-relative stack slots, ~45%
+// of flat stores), skipping the MMIO mask/compare that's pure overhead there. Still safe if that proof were ever wrong: the flat view maps
+// 0xCC000000..0xCDFFFFFF PAGE_NOACCESS, so a stray MMIO store faults into the same handler and diagnostic as the checked path, just reported
+// instead of dispatched inline. Never use these for an address the translator hasn't proven.
+
+MKW_MEMORY_FORCE_INLINE void FlatWriteRam8(uint32_t address, uint8_t value) {
+    FlatStore<uint8_t>(address, value);
+}
+
+MKW_MEMORY_FORCE_INLINE void FlatWriteRam16(uint32_t address, uint16_t value) {
+    FlatStore<uint16_t>(address, value);
+}
+
+MKW_MEMORY_FORCE_INLINE void FlatWriteRam32(uint32_t address, uint32_t value) {
+    FlatStore<uint32_t>(address, value);
+}
+
+
+MKW_MEMORY_FORCE_INLINE void FlatWriteRamFloat32(uint32_t address, double value) {
+    FlatStore<uint32_t>(address, ConvertPpcDoubleToSingleBits(value));
+}
+
+MKW_MEMORY_FORCE_INLINE void FlatWriteRamFloat64(uint32_t address, double value) {
+    uint64_t bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    FlatStore<uint64_t>(address, bits);
+}
+
+} // namespace MemoryInline
+
+#undef MKW_MEMORY_FORCE_INLINE
+#undef MKW_MEMORY_NO_INLINE
+#undef MKW_MEMORY_COLD
+
+inline uint8_t Memory::Read8(uint32_t addr) {
+    uint8_t value = 0;
+    if (!MemoryInline::TryReadGuestScalar(addr, value)) [[unlikely]]
+        return MemoryInline::Read8Slow(addr);
+    return value;
+}
+
+inline uint16_t Memory::Read16(uint32_t addr) {
+    uint16_t value = 0;
+    if (!MemoryInline::TryReadGuestScalar(addr, value)) [[unlikely]]
+        return MemoryInline::Read16Slow(addr);
+    return value;
+}
+
+inline uint32_t Memory::Read32(uint32_t addr) {
+    uint32_t value = 0;
+    if (!MemoryInline::TryReadGuestScalar(addr, value)) [[unlikely]]
+        return MemoryInline::Read32Slow(addr);
+    return value;
+}
+
+inline uint64_t Memory::Read64(uint32_t addr) {
+    uint64_t value = 0;
+    if (!MemoryInline::TryReadGuestScalar(addr, value)) [[unlikely]]
+        return MemoryInline::Read64Slow(addr);
+    return value;
+}
+
+inline float Memory::ReadFloat32(uint32_t addr) {
+    uint32_t bits = 0;
+    if (!MemoryInline::TryReadGuestScalar(addr, bits)) [[unlikely]]
+        return MemoryInline::ReadFloat32Slow(addr);
+    float value = 0.0f;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+inline double Memory::ReadFloat64(uint32_t addr) {
+    uint64_t bits = 0;
+    if (!MemoryInline::TryReadGuestScalar(addr, bits)) [[unlikely]]
+        return MemoryInline::ReadFloat64Slow(addr);
+    double value = 0.0;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+inline void Memory::Write8(uint32_t addr, uint8_t val) {
+    if (!MemoryInline::TryWriteGuestScalar(addr, val)) [[unlikely]]
+        MemoryInline::Write8Slow(addr, val);
+}
+
+inline void Memory::Write16(uint32_t addr, uint16_t val) {
+    if (!MemoryInline::TryWriteGuestScalar(addr, val)) [[unlikely]]
+        MemoryInline::Write16Slow(addr, val);
+}
+
+inline void Memory::Write32(uint32_t addr, uint32_t val) {
+    if (!MemoryInline::TryWriteGuestScalar(addr, val)) [[unlikely]]
+        MemoryInline::Write32Slow(addr, val);
+}
+
+inline void Memory::Write64(uint32_t addr, uint64_t val) {
+    if (!MemoryInline::TryWriteGuestScalar(addr, val)) [[unlikely]]
+        MemoryInline::Write64Slow(addr, val);
+}
+
+inline void Memory::WriteFloat32(uint32_t addr, double val) {
+    {
+        const uint32_t bits = MemoryInline::ConvertPpcDoubleToSingleBits(val);
+        if (MemoryInline::TryWriteGuestScalar(addr, bits))
+            return;
+    }
+    [[unlikely]] MemoryInline::WriteFloat32Slow(addr, val);
+}
+
+inline void Memory::WriteFloat64(uint32_t addr, double val) {
+    {
+        uint64_t bits = 0;
+        std::memcpy(&bits, &val, sizeof(bits));
+        if (MemoryInline::TryWriteGuestScalar(addr, bits))
+            return;
+    }
+    [[unlikely]] MemoryInline::WriteFloat64Slow(addr, val);
+}
diff --git a/runtime/include/mkw_pch.h b/runtime/include/mkw_pch.h
new file mode 100644
index 0000000..85973a9
--- /dev/null
+++ b/runtime/include/mkw_pch.h
@@ -0,0 +1,19 @@
+// Precompiled header for WiiCompiled
+// This header is precompiled to speed up builds
+// All common headers used by generated functions should be included here
+
+#ifndef MKW_RECOMPILED_PCH_H
+#define MKW_RECOMPILED_PCH_H
+
+// Standard C++ headers
+#include <cstdint>
+#include <cstring>
+#include <cmath>
+#include <iostream>
+
+// Project headers
+#include "ppc_runtime.h"
+#include "abi_bridge.h"
+#include "memory.h"
+
+#endif // MKW_RECOMPILED_PCH_H
diff --git a/runtime/include/music_attenuation.h b/runtime/include/music_attenuation.h
new file mode 100644
index 0000000..f9b397e
--- /dev/null
+++ b/runtime/include/music_attenuation.h
@@ -0,0 +1,28 @@
+#pragma once
+
+#include <cstdint>
+
+namespace MusicAttenuation {
+
+// Enables the optional Windows media-session integration. The monitor is
+// started lazily the first time this is enabled.
+void SetEnabled(bool enabled) noexcept;
+void SetMusicVolume(float volume) noexcept;
+void SetSoundEffectsVolume(float volume) noexcept;
+void SetUiVolume(float volume) noexcept;
+void SetVoicesVolume(float volume) noexcept;
+bool IsExternalMediaPlaying() noexcept;
+bool IsMediaControlAvailable() noexcept;
+bool IsMediaControlInitializationComplete() noexcept;
+
+// Called from the guest scheduler/audio path. This applies state changes to
+// the live SoundPlayer buses, so changing a category or entering/leaving
+// attenuation never requires a scene or race restart.
+void TickGuest() noexcept;
+
+// Accurate native replacement for nw4r::snd::SoundPlayer::SetVolume. Only
+// the category multipliers are applied here; the game's requested bus volume
+// remains the base value.
+void SetSoundPlayerVolume(uint32_t soundPlayer, float requestedVolume);
+
+} // namespace MusicAttenuation
diff --git a/runtime/include/nand_path.h b/runtime/include/nand_path.h
new file mode 100644
index 0000000..34c2858
--- /dev/null
+++ b/runtime/include/nand_path.h
@@ -0,0 +1,194 @@
+#pragma once
+
+#include "runtime_config.h"
+#include "runtime_log.h"
+#include "system_bridge.h"
+
+#include <cstdlib>
+#include <cstdio>
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <optional>
+#include <string>
+#include <string_view>
+
+namespace RuntimeNandPath {
+
+inline std::optional<std::filesystem::path> ExistingDirectory(const std::filesystem::path& path) {
+    std::error_code ec;
+    if (!path.empty() && std::filesystem::is_directory(path, ec) && !ec) {
+        return path;
+    }
+    return std::nullopt;
+}
+
+[[noreturn]] inline void FailNandRoot(const char* message, const std::filesystem::path& path = {}) {
+    if (path.empty()) {
+        RT_LOGF(RT_TAG_NAND, "ERROR: %s\n", message);
+    } else {
+        RT_LOGF(RT_TAG_NAND, "ERROR: %s: %s\n", message, path.string().c_str());
+    }
+    RT_LOGF(RT_TAG_NAND, "Set [paths] nand_root in Config.toml.\n");
+    std::string details = message ? message : "The configured NAND could not be initialized.";
+    if (!path.empty()) {
+        details += "\n\nPath: ";
+        details += path.string();
+    }
+    details += "\n\nSet [paths] nand_root in Config.toml and try again.";
+    // Same fatal idiom as the DVD and OS paths: crash artifacts first so the run
+    // folder always has them, then a non-zero exit code, the popup, and the
+    // "already reported" latch so the atexit handler does not stack a second
+    // generic report on top of this one.
+    RuntimeCrash::WriteCrashArtifacts("nand_root", details);
+    SetRuntimeExitCode(EXIT_FAILURE);
+    ShowRuntimeFatalPopup("NAND initialization failed", details);
+    MarkFatalErrorReported();
+    std::exit(EXIT_FAILURE);
+}
+
+inline std::filesystem::path ResolveConfiguredPath(const std::string& value) {
+    return RuntimeConfigFile::ResolveRelativeToConfig(value);
+}
+
+inline std::string PathStringWithoutTrailingSeparators(std::filesystem::path path) {
+    std::string text = path.string();
+    while (!text.empty()) {
+        const char tail = text.back();
+        if (tail != '\\' && tail != '/') {
+            break;
+        }
+        text.pop_back();
+    }
+    return text;
+}
+
+inline std::filesystem::path ManagedNandRootPath() {
+    return RuntimeConfigFile::ApplicationDataDirectory() / "NAND";
+}
+
+inline std::optional<std::filesystem::path> BootstrapPayloadPath() {
+    if (auto executableDirectory = RuntimeConfigFile::ExecutableDirectory()) {
+        const auto adjacent = *executableDirectory / "wii_bootstrap";
+        if (ExistingDirectory(adjacent / "shared2" / "wc24")) {
+            return adjacent;
+        }
+    }
+
+    // This makes developer-tree launches work without changing their release layout.
+    for (auto base = std::filesystem::current_path(); !base.empty();) {
+        const auto candidate = base / "runtime" / "assets" / "wii";
+        if (ExistingDirectory(candidate / "shared2" / "wc24")) {
+            return candidate;
+        }
+        const auto parent = base.parent_path();
+        if (parent == base) {
+            break;
+        }
+        base = parent;
+    }
+    return std::nullopt;
+}
+
+inline bool CopyBootstrapFile(const std::filesystem::path& sourceRoot,
+                              const std::filesystem::path& destinationRoot,
+                              const std::filesystem::path& relativePath,
+                              std::error_code& ec) {
+    const auto source = sourceRoot / relativePath;
+    const auto destination = destinationRoot / relativePath;
+    if (std::filesystem::exists(destination, ec)) {
+        return !ec;
+    }
+
+    std::filesystem::create_directories(destination.parent_path(), ec);
+    if (ec) {
+        return false;
+    }
+    std::filesystem::copy_file(source, destination, std::filesystem::copy_options::none, ec);
+    return !ec;
+}
+
+// Create these WC24 files only for a new profile; never overwrite user data.
+constexpr std::string_view kBootstrapFiles[] = {
+    "shared2/wc24/misc.bin",
+    "shared2/wc24/nwc24dl.bin",
+    "shared2/wc24/nwc24fl.bin",
+    "shared2/wc24/nwc24fls.bin",
+    "shared2/wc24/nwc24msg.cbk",
+    "shared2/wc24/nwc24msg.cfg",
+    "shared2/wc24/mbox/Readme.txt",
+    "shared2/wc24/mbox/wc24recv.ctl",
+    "shared2/wc24/mbox/wc24recv.mbx",
+    "shared2/wc24/mbox/wc24send.ctl",
+    "shared2/wc24/mbox/wc24send.mbx",
+};
+
+// Add first-run WC24 files only when the NAND has none yet.
+inline bool SeedMissingBootstrapFiles(const std::filesystem::path& root) {
+    const auto payload = BootstrapPayloadPath();
+    if (!payload) {
+        return false;
+    }
+    std::error_code ec;
+    for (const std::string_view file : kBootstrapFiles) {
+        const std::filesystem::path relativePath{std::string(file)};
+        ec.clear();
+        if (!CopyBootstrapFile(*payload, root, relativePath, ec)) {
+            RT_LOG(RT_TAG_NAND) << "could not create " << (root / relativePath).string() << std::endl;
+            return false;
+        }
+    }
+    return true;
+}
+
+inline std::filesystem::path CreateManagedNandRoot() {
+    const std::filesystem::path root = ManagedNandRootPath();
+    std::error_code ec;
+    std::filesystem::create_directories(root, ec);
+    if (ec || !std::filesystem::is_directory(root, ec)) {
+        FailNandRoot("Unable to create managed NAND root", root);
+    }
+
+    if (!SeedMissingBootstrapFiles(root)) {
+        FailNandRoot("Unable to initialize managed NAND", root);
+    }
+
+    const auto marker = root / ".mkw_recompiled_managed_nand";
+    ec.clear();
+    if (!std::filesystem::exists(marker, ec)) {
+        std::ofstream markerFile(marker, std::ios::trunc);
+        if (!markerFile) {
+            FailNandRoot("Managed NAND root is not writable", root);
+        }
+        markerFile << "version=1\n";
+        markerFile.close();
+        if (!markerFile) {
+            FailNandRoot("Unable to finish managed NAND initialization", root);
+        }
+    }
+
+    RT_LOG(RT_TAG_NAND) << "using managed NAND root: " << root.string() << std::endl;
+    return root;
+}
+
+inline std::filesystem::path DiscoverNandRootPath() {
+    const std::string configPath = RuntimeConfigFile::NandRoot();
+    if (!configPath.empty()) {
+        const auto path = ResolveConfiguredPath(configPath);
+        if (auto existing = ExistingDirectory(path)) {
+            // Seed only a new configured NAND so existing frontend data stays unchanged.
+            if (!SeedMissingBootstrapFiles(*existing)) {
+                RT_LOG(RT_TAG_NAND) << "first-run WC24 seeding failed for the configured NAND root" << std::endl;
+            }
+            return *existing;
+        }
+        FailNandRoot("Configured NAND root is not an existing directory", path);
+    }
+    return CreateManagedNandRoot();
+}
+
+inline std::string DiscoverNandRootString() {
+    return PathStringWithoutTrailingSeparators(DiscoverNandRootPath());
+}
+
+} // namespace RuntimeNandPath
diff --git a/runtime/include/native_cpu_calls.inc b/runtime/include/native_cpu_calls.inc
new file mode 100644
index 0000000..e8bc77d
--- /dev/null
+++ b/runtime/include/native_cpu_calls.inc
@@ -0,0 +1,98 @@
+// Native call catalog used by InvokeDirectCpu. Keep project-specific HLE
+// address mappings here; abi_bridge.h contains only the generic ABI machinery.
+//
+// This is a .inc, not a header: it has no includes of its own and references
+// CpuContext, KnownTypedNativeCpuCall<> and KnownNativeCpuCall<>, all of which
+// are declared above its single mid-file include site in abi_bridge.h. It
+// cannot compile standalone and must never be included anywhere else.
+
+extern "C" void nw4r__lyt__detail__DrawQuad_800847c0(CpuContext* ctx);
+extern "C" void nw4r__lyt__detail__DrawQuad_80084d20(CpuContext* ctx);
+
+extern "C" void GX__SetVtxDesc_8016d3a4(uint32_t a, uint32_t t);
+extern "C" void GX__ClearVtxDesc_8016dc34();
+extern "C" void GX__SetVtxAttrFmt_8016dc68(uint32_t vf, uint32_t a, uint32_t c, uint32_t t, uint32_t fr);
+extern "C" void GX__SetTexCoordGen2_8016e37c(uint32_t dc, uint32_t f, uint32_t sp, uint32_t m, uint32_t n, uint32_t pm);
+extern "C" void GX__SetNumTexGens_8016e5a4(uint32_t n);
+extern "C" void GX__DrawDone_8016eab0();
+extern "C" void GX__Begin_8016f0f0(uint32_t t, uint32_t vf, uint32_t nv);
+extern "C" void GX__SetLineWidth_8016f314(uint32_t width, uint32_t texOffsets);
+extern "C" void GX__SetPointSize_8016f348(uint32_t pointSize, uint32_t texOffsets);
+extern "C" void GX__SetCullMode_8016f3b8(uint32_t m);
+extern "C" void GX__SetNumChans_8017054c(uint32_t n);
+extern "C" void GX__SetChanCtrl_80170570(uint32_t ch, uint32_t en, uint32_t as, uint32_t ms, uint32_t lm, uint32_t df, uint32_t af);
+extern "C" void GX__InitTexObj_801707f8(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m);
+extern "C" void GX__InitTexObjLOD_80170a4c(uint32_t oa, uint32_t mif, uint32_t maf, float mil, float mal, float lb, uint32_t bc, uint32_t el, uint32_t ma);
+extern "C" void GX__InvalidateTexAll_80171110();
+extern "C" void GX__LoadTexObj_80170f2c(uint32_t oa, uint32_t tid);
+extern "C" void GX__SetNumIndStages_80171b38(uint32_t n);
+extern "C" void GX__SetTevDirect_80171b58(uint32_t s);
+extern "C" void GX__SetTevColorIn_80171ce0(uint32_t s, uint32_t a, uint32_t b, uint32_t c, uint32_t d);
+extern "C" void GX__SetTevAlphaIn_80171d20(uint32_t s, uint32_t a, uint32_t b, uint32_t c, uint32_t d);
+extern "C" void GX__SetTevColorOp_80171d60(uint32_t s, uint32_t op, uint32_t b, uint32_t sc, uint32_t cl, uint32_t or_);
+extern "C" void GX__SetTevAlphaOp_80171db8(uint32_t s, uint32_t op, uint32_t b, uint32_t sc, uint32_t cl, uint32_t or_);
+extern "C" void GX__SetTevColorS10_80171e70(uint32_t id, uint32_t cp);
+extern "C" void GX__SetTevKColor_80171ed4(uint32_t id, uint32_t cp);
+extern "C" void GX__SetTevKColorSel_80171f30(uint32_t s, uint32_t sel);
+extern "C" void GX__SetTevKAlphaSel_80171f80(uint32_t s, uint32_t sel);
+extern "C" void GX__SetTevSwapMode_80171fd0(uint32_t s, uint32_t rs, uint32_t ts);
+extern "C" void GX__SetTevSwapModeTable_8017200c(uint32_t id, uint32_t r, uint32_t g, uint32_t b, uint32_t a);
+extern "C" void GX__SetTevOrder_8017214c(uint32_t s, uint32_t c, uint32_t m, uint32_t col);
+extern "C" void GX__SetNumTevStages_801722a8(uint32_t n);
+extern "C" void GX__SetBlendMode_8017277c(uint32_t t, uint32_t s, uint32_t d, uint32_t op);
+extern "C" void GX__LoadPosMtxImm_8017310c(uint32_t ma, uint32_t id);
+extern "C" void GX__SetCurrentMtx_80173214(uint32_t id);
+
+#define MKW_KNOWN_TYPED_NATIVE(addr, fn, ...) \
+template <> struct KnownTypedNativeCpuCall<addr> { \
+    static constexpr bool kAvailable = true; \
+    static void Invoke(CpuContext* cpu) { (void)cpu; fn(__VA_ARGS__); } \
+}
+
+MKW_KNOWN_TYPED_NATIVE(0x8016D3A4u, GX__SetVtxDesc_8016d3a4, cpu->gpr[3], cpu->gpr[4]);
+MKW_KNOWN_TYPED_NATIVE(0x8016DC34u, GX__ClearVtxDesc_8016dc34);
+MKW_KNOWN_TYPED_NATIVE(0x8016DC68u, GX__SetVtxAttrFmt_8016dc68, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6], cpu->gpr[7]);
+MKW_KNOWN_TYPED_NATIVE(0x8016E37Cu, GX__SetTexCoordGen2_8016e37c, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6], cpu->gpr[7], cpu->gpr[8]);
+MKW_KNOWN_TYPED_NATIVE(0x8016E5A4u, GX__SetNumTexGens_8016e5a4, cpu->gpr[3]);
+MKW_KNOWN_TYPED_NATIVE(0x8016EAB0u, GX__DrawDone_8016eab0);
+MKW_KNOWN_TYPED_NATIVE(0x8016F0F0u, GX__Begin_8016f0f0, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5]);
+MKW_KNOWN_TYPED_NATIVE(0x8016F314u, GX__SetLineWidth_8016f314, cpu->gpr[3], cpu->gpr[4]);
+MKW_KNOWN_TYPED_NATIVE(0x8016F348u, GX__SetPointSize_8016f348, cpu->gpr[3], cpu->gpr[4]);
+MKW_KNOWN_TYPED_NATIVE(0x8016F3B8u, GX__SetCullMode_8016f3b8, cpu->gpr[3]);
+MKW_KNOWN_TYPED_NATIVE(0x8017054Cu, GX__SetNumChans_8017054c, cpu->gpr[3]);
+MKW_KNOWN_TYPED_NATIVE(0x80170570u, GX__SetChanCtrl_80170570, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6], cpu->gpr[7], cpu->gpr[8], cpu->gpr[9]);
+MKW_KNOWN_TYPED_NATIVE(0x801707F8u, GX__InitTexObj_801707f8, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6], cpu->gpr[7], cpu->gpr[8], cpu->gpr[9], cpu->gpr[10]);
+MKW_KNOWN_TYPED_NATIVE(0x80170A4Cu, GX__InitTexObjLOD_80170a4c, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], static_cast<float>(cpu->fpr[1].d), static_cast<float>(cpu->fpr[2].d), static_cast<float>(cpu->fpr[3].d), cpu->gpr[6], cpu->gpr[7], cpu->gpr[8]);
+MKW_KNOWN_TYPED_NATIVE(0x80171110u, GX__InvalidateTexAll_80171110);
+MKW_KNOWN_TYPED_NATIVE(0x80170F2Cu, GX__LoadTexObj_80170f2c, cpu->gpr[3], cpu->gpr[4]);
+MKW_KNOWN_TYPED_NATIVE(0x80171B38u, GX__SetNumIndStages_80171b38, cpu->gpr[3]);
+MKW_KNOWN_TYPED_NATIVE(0x80171B58u, GX__SetTevDirect_80171b58, cpu->gpr[3]);
+MKW_KNOWN_TYPED_NATIVE(0x80171CE0u, GX__SetTevColorIn_80171ce0, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6], cpu->gpr[7]);
+MKW_KNOWN_TYPED_NATIVE(0x80171D20u, GX__SetTevAlphaIn_80171d20, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6], cpu->gpr[7]);
+MKW_KNOWN_TYPED_NATIVE(0x80171D60u, GX__SetTevColorOp_80171d60, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6], cpu->gpr[7], cpu->gpr[8]);
+MKW_KNOWN_TYPED_NATIVE(0x80171DB8u, GX__SetTevAlphaOp_80171db8, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6], cpu->gpr[7], cpu->gpr[8]);
+MKW_KNOWN_TYPED_NATIVE(0x80171E70u, GX__SetTevColorS10_80171e70, cpu->gpr[3], cpu->gpr[4]);
+MKW_KNOWN_TYPED_NATIVE(0x80171ED4u, GX__SetTevKColor_80171ed4, cpu->gpr[3], cpu->gpr[4]);
+MKW_KNOWN_TYPED_NATIVE(0x80171F30u, GX__SetTevKColorSel_80171f30, cpu->gpr[3], cpu->gpr[4]);
+MKW_KNOWN_TYPED_NATIVE(0x80171F80u, GX__SetTevKAlphaSel_80171f80, cpu->gpr[3], cpu->gpr[4]);
+MKW_KNOWN_TYPED_NATIVE(0x80171FD0u, GX__SetTevSwapMode_80171fd0, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5]);
+MKW_KNOWN_TYPED_NATIVE(0x8017200Cu, GX__SetTevSwapModeTable_8017200c, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6], cpu->gpr[7]);
+MKW_KNOWN_TYPED_NATIVE(0x8017214Cu, GX__SetTevOrder_8017214c, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6]);
+MKW_KNOWN_TYPED_NATIVE(0x801722A8u, GX__SetNumTevStages_801722a8, cpu->gpr[3]);
+MKW_KNOWN_TYPED_NATIVE(0x8017277Cu, GX__SetBlendMode_8017277c, cpu->gpr[3], cpu->gpr[4], cpu->gpr[5], cpu->gpr[6]);
+MKW_KNOWN_TYPED_NATIVE(0x8017310Cu, GX__LoadPosMtxImm_8017310c, cpu->gpr[3], cpu->gpr[4]);
+MKW_KNOWN_TYPED_NATIVE(0x80173214u, GX__SetCurrentMtx_80173214, cpu->gpr[3]);
+
+#undef MKW_KNOWN_TYPED_NATIVE
+
+#define MKW_KNOWN_NATIVE_CPU_CALL(addr, fn) \
+template <> struct KnownNativeCpuCall<addr> { \
+    static constexpr bool kAvailable = true; \
+    static constexpr uint32_t kNonvolatileFprWriteMask = 0; \
+    static constexpr void (*Entry)(CpuContext*) = &fn; \
+}
+
+MKW_KNOWN_NATIVE_CPU_CALL(0x800847C0u, nw4r__lyt__detail__DrawQuad_800847c0);
+MKW_KNOWN_NATIVE_CPU_CALL(0x80084D20u, nw4r__lyt__detail__DrawQuad_80084d20);
+
+#undef MKW_KNOWN_NATIVE_CPU_CALL
diff --git a/runtime/include/ppc_isa_memory.h b/runtime/include/ppc_isa_memory.h
new file mode 100644
index 0000000..aed39dd
--- /dev/null
+++ b/runtime/include/ppc_isa_memory.h
@@ -0,0 +1,10 @@
+#pragma once
+
+// Host memory seam for isa/ppc_isa_quantized.h. That header includes
+// "ppc_isa_memory.h" by plain quoted name and expects whatever it resolves to
+// to supply the Memory / MemoryInline APIs and the flat-guest-base macros its
+// psq fast paths use. This file is this project's implementation of that
+// contract; memory.h chains memory_access.h, which defines MemoryInline.
+
+#include "memory.h" // chains memory_access.h, which supplies MemoryInline and
+                    // includes guest_flat_memory.h for the flat-base macros
diff --git a/runtime/include/ppc_runtime.h b/runtime/include/ppc_runtime.h
new file mode 100644
index 0000000..4816c8c
--- /dev/null
+++ b/runtime/include/ppc_runtime.h
@@ -0,0 +1,14 @@
+// The PowerPC ISA package (runtime/include/isa/), re-exported under the single
+// header name the generated code and the runtime include. The package has two
+// host seams this project satisfies elsewhere: "ppc_isa_memory.h" (pulled by
+// the quantized tier) and the ShowRuntimeFatalPopup implementation.
+
+#pragma once
+
+#include "isa/ppc_isa_config.h"
+#include "isa/big_endian.h"
+#include "isa/ppc_isa_fpenv.h"
+#include "isa/ppc_isa_context.h"
+#include "isa/ppc_isa_int.h"
+#include "isa/ppc_isa_float.h"
+#include "isa/ppc_isa_quantized.h"
diff --git a/runtime/include/recomp_mod_loader.h b/runtime/include/recomp_mod_loader.h
new file mode 100644
index 0000000..5c47cb4
--- /dev/null
+++ b/runtime/include/recomp_mod_loader.h
@@ -0,0 +1,147 @@
+#pragma once
+
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+#include <vector>
+
+struct CpuContext;
+
+namespace RecompMod {
+
+using InitializerFn = void (*)();
+
+struct MemoryReservation {
+    uint32_t start = 0;
+    uint32_t end = 0;
+    std::string name;
+};
+
+// Diagnostic-only, read by fatal reporters (unmapped access, executable-write, CPU dumps).
+// Defined here as `inline thread_local` with a constant initializer, not `extern thread_local`
+// in the .cpp: every indirect dispatch scopes this, so an out-of-line ctor/dtor would cost two
+// un-inlinable calls plus a register spill each for three instructions of work.
+inline thread_local uint32_t g_currentTranslatedExecutionAddress = 0;
+
+class ScopedTranslatedExecutionAddress {
+public:
+    explicit ScopedTranslatedExecutionAddress(uint32_t address) noexcept
+        : previous_(g_currentTranslatedExecutionAddress) {
+        // Address 0 means "nothing new to report" - the enclosing scope's value
+        // stays visible, and the unconditional restore below keeps nesting exact.
+        if (address != 0) {
+            g_currentTranslatedExecutionAddress = address;
+        }
+    }
+
+    ~ScopedTranslatedExecutionAddress() noexcept {
+        g_currentTranslatedExecutionAddress = previous_;
+    }
+
+    ScopedTranslatedExecutionAddress(const ScopedTranslatedExecutionAddress&) = delete;
+    ScopedTranslatedExecutionAddress& operator=(const ScopedTranslatedExecutionAddress&) = delete;
+
+private:
+    uint32_t previous_ = 0;
+};
+
+inline constexpr uint32_t kExecutableWriteGuardPageShift = 12;
+inline constexpr uint32_t kExecutableWriteGuardPageCount = 1u << (32 - kExecutableWriteGuardPageShift);
+inline constexpr uint32_t kExecutableWriteGuardCoarsePageShift = 20;
+inline constexpr uint32_t kExecutableWriteGuardCoarsePageCount = 1u << (32 - kExecutableWriteGuardCoarsePageShift);
+inline constexpr uint32_t kExecutableWriteGuardMidPageShift = 16;
+inline constexpr uint32_t kExecutableWriteGuardMidPageCount = 1u << (32 - kExecutableWriteGuardMidPageShift);
+
+extern std::atomic<bool> g_executableWriteGuardEnabled;
+extern std::atomic<uint8_t> g_executableWriteGuardPages[kExecutableWriteGuardPageCount];
+extern std::atomic<uint8_t> g_executableWriteGuardCoarsePages[kExecutableWriteGuardCoarsePageCount];
+extern std::atomic<uint8_t> g_executableWriteGuardMidPages[kExecutableWriteGuardMidPageCount];
+
+// Two initializer phases, both emitted by the translator's mod data-patch
+// writer. (A third, plain RegisterInitializer/RunInitializers pair existed with
+// no registrant on either side and was removed.)
+void RegisterMemoryInitializer(InitializerFn fn);
+void RunMemoryInitializers();
+void RegisterPostRelInitializer(InitializerFn fn);
+void RunPostRelInitializers();
+
+void RegisterDvdOverlayRoot(std::string root);
+const std::vector<std::string>& DvdOverlayRoots();
+
+// Riivolution settings pinned by the distribution's recomp.yml. The XML path is
+// relative to the pack/overlay root; option selections use Riivolution's 1-based
+// choice index (0 disables the option).
+struct RiivolutionOptionSelection {
+    std::string section;
+    std::string option;
+    uint32_t choice = 0;
+};
+
+void RegisterRiivolutionXml(const char* packRelativePath);
+void RegisterRiivolutionOption(const char* sectionName, const char* optionName, unsigned int choice);
+const std::string& RiivolutionXml();
+const std::vector<RiivolutionOptionSelection>& RiivolutionOptionSelections();
+
+void RegisterMemoryReservation(uint32_t start, uint32_t end, std::string name);
+const std::vector<MemoryReservation>& MemoryReservations();
+
+uint32_t CurrentTranslatedExecutionAddress() noexcept;
+
+void RegisterExecutableRange(uint32_t start, uint32_t end, std::string name);
+bool HandleExecutableWrite(uint32_t address, size_t length, uint64_t value);
+void CheckExecutableWrite(uint32_t address, size_t length, uint64_t value);
+
+inline bool ExecutableWriteGuardMayHit(uint32_t address, size_t length) noexcept {
+    if (length == 0 || !g_executableWriteGuardEnabled.load(std::memory_order_relaxed)) {
+        return false;
+    }
+
+    const uint64_t endExclusive = static_cast<uint64_t>(address) + length;
+    const uint32_t firstCoarsePage = address >> kExecutableWriteGuardCoarsePageShift;
+    const uint64_t lastCoarsePage64 = (endExclusive - 1) >> kExecutableWriteGuardCoarsePageShift;
+    const uint32_t lastCoarsePage = lastCoarsePage64 >= kExecutableWriteGuardCoarsePageCount
+        ? kExecutableWriteGuardCoarsePageCount - 1
+        : static_cast<uint32_t>(lastCoarsePage64);
+    bool coarseHit = false;
+    for (uint32_t page = firstCoarsePage; page <= lastCoarsePage; ++page) {
+        if (g_executableWriteGuardCoarsePages[page].load(std::memory_order_relaxed) != 0) {
+            coarseHit = true;
+            break;
+        }
+    }
+    if (!coarseHit) {
+        return false;
+    }
+
+    const uint32_t firstMidPage = address >> kExecutableWriteGuardMidPageShift;
+    const uint64_t lastMidPage64 = (endExclusive - 1) >> kExecutableWriteGuardMidPageShift;
+    const uint32_t lastMidPage = lastMidPage64 >= kExecutableWriteGuardMidPageCount
+        ? kExecutableWriteGuardMidPageCount - 1
+        : static_cast<uint32_t>(lastMidPage64);
+    bool midHit = false;
+    for (uint32_t page = firstMidPage; page <= lastMidPage; ++page) {
+        if (g_executableWriteGuardMidPages[page].load(std::memory_order_relaxed) != 0) {
+            midHit = true;
+            break;
+        }
+    }
+    if (!midHit) {
+        return false;
+    }
+
+    const uint32_t firstPage = address >> kExecutableWriteGuardPageShift;
+    const uint64_t lastPage64 = (endExclusive - 1) >> kExecutableWriteGuardPageShift;
+    const uint32_t lastPage = lastPage64 >= kExecutableWriteGuardPageCount
+        ? kExecutableWriteGuardPageCount - 1
+        : static_cast<uint32_t>(lastPage64);
+    for (uint32_t page = firstPage; page <= lastPage; ++page) {
+        if (g_executableWriteGuardPages[page].load(std::memory_order_relaxed) != 0) {
+            return true;
+        }
+    }
+    return false;
+}
+
+} // namespace RecompMod
diff --git a/runtime/include/runtime_config.h b/runtime/include/runtime_config.h
new file mode 100644
index 0000000..a350e6c
--- /dev/null
+++ b/runtime/include/runtime_config.h
@@ -0,0 +1,848 @@
+#pragma once
+
+#include <algorithm>
+#include <array>
+#include <cctype>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <limits>
+#include <optional>
+#include <sstream>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+#include <toml.hpp>
+#ifdef _WIN32
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <windows.h>
+#include <shlobj.h>
+#endif
+
+struct RuntimeUserConfig {
+    std::optional<bool> widescreen;
+    std::optional<int32_t> windowPosX;
+    std::optional<int32_t> windowPosY;
+    std::optional<uint32_t> windowWidth;
+    std::optional<uint32_t> windowHeight;
+    std::optional<float> resolutionMultiplier;
+    std::optional<std::string> graphicsApi;
+    std::optional<std::string> displayMode;
+    std::optional<uint32_t> frameInterpolationFps;
+    std::optional<bool> skipUnreadyPipelines;
+    std::optional<bool> disableCopyFilter;
+    std::optional<bool> textureReplacements;
+    std::optional<bool> textureDumps;
+    std::optional<bool> showFps;
+    std::optional<uint32_t> disabledPostProcessingPaths;
+    std::optional<float> audioVolume;
+    std::optional<float> audioMusicVolume;
+    std::optional<float> audioSoundEffectsVolume;
+    std::optional<float> audioUiVolume;
+    std::optional<float> audioVoicesVolume;
+    std::optional<bool> audioMuted;
+    std::optional<bool> audioMixWorker;
+    std::optional<bool> attenuateMusicWhenMediaPlays;
+    std::optional<bool> networkEnabled;
+    std::optional<std::string> nandRoot;
+    std::optional<std::string> dvdRoot;
+    // The one canonical Retro Rewind installation, owned and updated by the frontend. Setup records
+    // it here instead of copying the pack, so an asset-only update is visible on the next launch.
+    std::optional<std::string> retroRewindRoot;
+    std::vector<std::string> overlayRoots;
+    // Controller mappings use Wii/GameCube button names as keys and up to two
+    // comma-separated SDL-style physical button names ("south", or
+    // "dpad_up,left_shoulder") as values; pressing either bound button counts.
+    std::array<std::optional<std::string>, 12> controllerButtons;
+};
+
+namespace RuntimeConfigFile {
+
+inline constexpr const char* kConfigFileName = "Config.toml";
+inline constexpr const char* kApplicationDirectoryName = "WiiCompiled";
+
+// Portable layout. A directory holding kPortableMarkerFileName is a portable root; every piece of
+// runtime user state (Config.toml, NAND, Cache, Logs) lives in <root>/UserData instead of
+// %LOCALAPPDATA%. The marker is searched for from the executable's directory upwards, which is what
+// makes an installation survive being moved or carried on removable media.
+inline constexpr const char* kPortableMarkerFileName = "portable.txt";
+inline constexpr const char* kPortableUserDataDirectoryName = "UserData";
+
+// The installed layout puts products two levels below the root (<root>/Install/Base/game.exe). The
+// bound is deliberately small so an unrelated marker far up a drive can never capture an ordinary
+// installation.
+inline constexpr int kPortableSearchDepth = 4;
+
+inline std::string Trim(std::string_view text) {
+    size_t begin = 0;
+    while (begin < text.size() && std::isspace(static_cast<unsigned char>(text[begin]))) {
+        ++begin;
+    }
+    size_t end = text.size();
+    while (end > begin && std::isspace(static_cast<unsigned char>(text[end - 1]))) {
+        --end;
+    }
+    return std::string(text.substr(begin, end - begin));
+}
+
+inline std::string RemoveComment(std::string_view line) {
+    bool inSingle = false;
+    bool inDouble = false;
+    bool escaped = false;
+    for (size_t i = 0; i < line.size(); ++i) {
+        const char ch = line[i];
+        if (inDouble && ch == '\\' && !escaped) {
+            escaped = true;
+            continue;
+        }
+        if (ch == '\'' && !inDouble) {
+            inSingle = !inSingle;
+        } else if (ch == '"' && !inSingle && !escaped) {
+            inDouble = !inDouble;
+        } else if (ch == '#' && !inSingle && !inDouble) {
+            return std::string(line.substr(0, i));
+        }
+        escaped = false;
+    }
+    return std::string(line);
+}
+
+inline bool IsSupportedResolutionMultiplier(float value) {
+    static constexpr std::array values{0.0f, 1.0f, 1.5f, 2.0f, 3.0f, 4.0f, 6.0f, 8.0f};
+    return std::find(values.begin(), values.end(), value) != values.end();
+}
+
+// Must stay in step with the backend table in main.cpp, which is what actually
+// maps these to AuroraBackend.
+inline bool IsSupportedGraphicsApi(std::string_view value) {
+    static constexpr std::array<std::string_view, 3> values{"auto", "d3d12", "vulkan"};
+    return std::find(values.begin(), values.end(), value) != values.end();
+}
+
+inline bool IsSupportedDisplayMode(std::string_view value) {
+    static constexpr std::array<std::string_view, 3> values{
+        "windowed", "borderless", "exclusive",
+    };
+    return std::find(values.begin(), values.end(), value) != values.end();
+}
+
+// 240 was offered by an early build and is no longer supported; a saved 240 is
+// migrated to 180 at the parse site.
+inline bool IsSupportedFrameInterpolationFps(uint32_t value) {
+    return value == 0 || value == 120 || value == 180;
+}
+
+inline std::optional<std::filesystem::path> ExecutableDirectory() {
+#ifdef _WIN32
+    std::wstring buffer(MAX_PATH, L'\0');
+    for (;;) {
+        const DWORD length = GetModuleFileNameW(nullptr, buffer.data(), static_cast<DWORD>(buffer.size()));
+        if (length == 0) {
+            return std::nullopt;
+        }
+        if (length < buffer.size() - 1) {
+            buffer.resize(length);
+            return std::filesystem::path(buffer).parent_path();
+        }
+        buffer.resize(buffer.size() * 2);
+    }
+#else
+    return std::nullopt;
+#endif
+}
+
+// The portable root this executable lives under, or nullopt for a normal installation. The answer
+// cannot change while the process runs, so it is resolved exactly once: every user-state path
+// derives from it and they must not disagree with each other.
+inline const std::optional<std::filesystem::path>& PortableRootDirectory() {
+    static const std::optional<std::filesystem::path> root = []() -> std::optional<std::filesystem::path> {
+        const auto executableDirectory = ExecutableDirectory();
+        if (!executableDirectory) {
+            return std::nullopt;
+        }
+        std::filesystem::path current = *executableDirectory;
+        for (int level = 0; level <= kPortableSearchDepth; ++level) {
+            std::error_code ec;
+            if (std::filesystem::is_regular_file(current / kPortableMarkerFileName, ec)) {
+                return current;
+            }
+            const auto parent = current.parent_path();
+            if (parent.empty() || parent == current) {
+                break;
+            }
+            current = parent;
+        }
+        return std::nullopt;
+    }();
+    return root;
+}
+
+inline std::filesystem::path ApplicationDataDirectory() {
+    if (const auto& portableRoot = PortableRootDirectory()) {
+        return *portableRoot / kPortableUserDataDirectoryName;
+    }
+#ifdef _WIN32
+    PWSTR rawPath = nullptr;
+    if (SUCCEEDED(SHGetKnownFolderPath(FOLDERID_LocalAppData, KF_FLAG_CREATE, nullptr, &rawPath)) && rawPath) {
+        const std::filesystem::path directory = std::filesystem::path(rawPath) / kApplicationDirectoryName;
+        CoTaskMemFree(rawPath);
+        return directory;
+    }
+#endif
+    return std::filesystem::current_path() / kApplicationDirectoryName;
+}
+
+inline std::filesystem::path ResolveConfigPath() {
+    return ApplicationDataDirectory() / kConfigFileName;
+}
+
+inline void EnsureConfigFile() {
+    const std::filesystem::path path = ResolveConfigPath();
+    std::error_code ec;
+    std::filesystem::create_directories(path.parent_path(), ec);
+    if (ec || std::filesystem::exists(path, ec)) {
+        return;
+    }
+
+    std::ofstream output(path);
+    if (!output) {
+        return;
+    }
+    output << "# WiiCompiled user configuration\n"
+              "# Set paths.dvd_root to an extracted Mario Kart Wii DATA directory.\n\n"
+              "[video]\n"
+              "widescreen = true\n"
+              "resolution_multiplier = 1.0\n"
+              "frame_interpolation_fps = 0\n"
+              "display_mode = \"windowed\"\n"
+              "graphics_api = \"auto\"\n"
+              "skip_unready_pipelines = true\n"
+              "disable_copy_filter = true\n"
+              "show_fps = true\n"
+              "# Dolphin-style custom textures. When enabled, the renderer indexes\n"
+              "# texture_replacements/ next to this file at startup and substitutes\n"
+              "# any tex1_<W>x<H>_<hash>[_<tlut hash>]_<format>.dds or .png it finds\n"
+              "# there for the matching game texture. texture_dumps writes every\n"
+              "# unmatched texture to Cache/texture_dumps under the name a\n"
+              "# replacement would need. Both are read once, at startup.\n"
+              "texture_replacements = false\n"
+              "texture_dumps = false\n\n"
+              "[audio]\n"
+              "volume = 1.0\n"
+              "music_volume = 1.0\n"
+              "sound_effects_volume = 1.0\n"
+              "ui_volume = 1.0\n"
+              "voices_volume = 1.0\n"
+              "muted = false\n"
+              "attenuate_music_when_media_plays = false\n"
+              "# Runs the AX/DSP voice mix on its own thread, joined before the\n"
+              "# guest can observe it. Set to false to mix inline on the guest\n"
+              "# thread exactly as the runtime did before.\n"
+              "mix_worker = true\n\n"
+              "[network]\n"
+              "enabled = true\n\n"
+              "[paths]\n"
+              "# dvd_root = \"D:\\\\MarioKartWii\\\\DATA\"\n"
+              "# nand_root = \"D:\\\\WiiNand\"\n"
+              "# retro_rewind_root = \"D:\\\\RetroRewind\\\\RetroRewind6\"\n"
+              "# overlay_roots = [\"D:\\\\RetroRewind\"]\n";
+}
+
+template <typename T>
+inline std::optional<T> FindConfigValue(
+    const toml::value& document, std::string_view section, std::string_view key) {
+    try {
+        return toml::find<T>(document, std::string(section), std::string(key));
+    } catch (const std::exception&) {
+        return std::nullopt;
+    }
+}
+
+inline std::optional<uint32_t> FindConfigUint(
+    const toml::value& document, std::string_view section, std::string_view key) {
+    const auto value = FindConfigValue<int64_t>(document, section, key);
+    if (!value || *value < 0 || static_cast<uint64_t>(*value) > UINT32_MAX) {
+        return std::nullopt;
+    }
+    return static_cast<uint32_t>(*value);
+}
+
+inline std::optional<int32_t> FindConfigInt(
+    const toml::value& document, std::string_view section, std::string_view key) {
+    const auto value = FindConfigValue<int64_t>(document, section, key);
+    if (!value || *value < INT32_MIN || *value > INT32_MAX) {
+        return std::nullopt;
+    }
+    return static_cast<int32_t>(*value);
+}
+
+inline std::optional<float> FindConfigFloat(
+    const toml::value& document, std::string_view section, std::string_view key) {
+    std::optional<double> value = FindConfigValue<double>(document, section, key);
+    if (!value) {
+        if (const auto integer = FindConfigValue<int64_t>(document, section, key)) {
+            value = static_cast<double>(*integer);
+        }
+    }
+    if (!value || !std::isfinite(*value) ||
+        *value < -static_cast<double>(std::numeric_limits<float>::max()) ||
+        *value > static_cast<double>(std::numeric_limits<float>::max())) {
+        return std::nullopt;
+    }
+    return static_cast<float>(*value);
+}
+
+inline void AppendOverlayRoots(RuntimeUserConfig& config, const std::string& roots) {
+    size_t begin = 0;
+    while (begin < roots.size()) {
+        const size_t end = roots.find(';', begin);
+        std::string root = Trim(std::string_view(roots).substr(begin, end - begin));
+        if (!root.empty()) {
+            config.overlayRoots.push_back(std::move(root));
+        }
+        if (end == std::string::npos) {
+            break;
+        }
+        begin = end + 1;
+    }
+}
+
+inline RuntimeUserConfig ParseConfigDocument(const toml::value& document) {
+    RuntimeUserConfig config;
+
+    static constexpr std::array<std::string_view, 12> buttonKeys = {
+        "a", "b", "x", "y", "start", "z", "l", "r", "up", "down", "left", "right",
+    };
+    for (size_t index = 0; index < buttonKeys.size(); ++index) {
+        config.controllerButtons[index] =
+            FindConfigValue<std::string>(document, "controller", buttonKeys[index]);
+    }
+
+    config.widescreen = FindConfigValue<bool>(document, "video", "widescreen");
+    config.windowPosX = FindConfigInt(document, "video", "window_x");
+    config.windowPosY = FindConfigInt(document, "video", "window_y");
+    if (auto value = FindConfigUint(document, "video", "window_width"); value && *value != 0) {
+        config.windowWidth = *value;
+    }
+    if (auto value = FindConfigUint(document, "video", "window_height"); value && *value != 0) {
+        config.windowHeight = *value;
+    }
+    if (auto value = FindConfigFloat(document, "video", "resolution_multiplier");
+        value && IsSupportedResolutionMultiplier(*value)) {
+        config.resolutionMultiplier = *value;
+    }
+    if (auto value = FindConfigValue<std::string>(document, "video", "graphics_api")) {
+        if (IsSupportedGraphicsApi(*value)) {
+            config.graphicsApi = *value;
+        } else {
+            std::cerr << "[runtime] Unknown video.graphics_api=\"" << *value
+                      << "\", using the automatic backend" << std::endl;
+        }
+    }
+    if (auto value = FindConfigValue<std::string>(document, "video", "display_mode");
+        value && IsSupportedDisplayMode(*value)) {
+        config.displayMode = *value;
+    }
+    if (auto value = FindConfigUint(document, "video", "frame_interpolation_fps")) {
+        const uint32_t migrated = *value == 240u ? 180u : *value;
+        if (IsSupportedFrameInterpolationFps(migrated)) {
+            config.frameInterpolationFps = migrated;
+        }
+    }
+    config.skipUnreadyPipelines = FindConfigValue<bool>(document, "video", "skip_unready_pipelines");
+    config.disableCopyFilter = FindConfigValue<bool>(document, "video", "disable_copy_filter");
+    config.showFps = FindConfigValue<bool>(document, "video", "show_fps");
+    config.textureReplacements = FindConfigValue<bool>(document, "video", "texture_replacements");
+    config.textureDumps = FindConfigValue<bool>(document, "video", "texture_dumps");
+    if (auto value = FindConfigUint(document, "video", "disabled_post_processing_paths");
+        value && (*value & ~0x10u) == 0) {
+        config.disabledPostProcessingPaths = *value & 0x10u;
+    }
+
+    auto readVolume = [&](std::string_view key) -> std::optional<float> {
+        auto value = FindConfigFloat(document, "audio", key);
+        return value && *value >= 0.0f && *value <= 1.0f ? value : std::nullopt;
+    };
+    config.audioVolume = readVolume("volume");
+    config.audioMusicVolume = readVolume("music_volume");
+    config.audioSoundEffectsVolume = readVolume("sound_effects_volume");
+    config.audioUiVolume = readVolume("ui_volume");
+    config.audioVoicesVolume = readVolume("voices_volume");
+    config.audioMuted = FindConfigValue<bool>(document, "audio", "muted");
+    config.audioMixWorker = FindConfigValue<bool>(document, "audio", "mix_worker");
+    config.attenuateMusicWhenMediaPlays =
+        FindConfigValue<bool>(document, "audio", "attenuate_music_when_media_plays");
+    config.networkEnabled = FindConfigValue<bool>(document, "network", "enabled");
+
+    config.nandRoot = FindConfigValue<std::string>(document, "paths", "nand_root");
+    config.dvdRoot = FindConfigValue<std::string>(document, "paths", "dvd_root");
+    config.retroRewindRoot = FindConfigValue<std::string>(document, "paths", "retro_rewind_root");
+    if (auto roots = FindConfigValue<std::vector<std::string>>(document, "paths", "overlay_roots")) {
+        for (auto& root : *roots) {
+            root = Trim(root);
+            if (!root.empty()) {
+                config.overlayRoots.push_back(std::move(root));
+            }
+        }
+    } else if (auto roots = FindConfigValue<std::string>(document, "paths", "overlay_roots")) {
+        AppendOverlayRoots(config, *roots);
+    }
+
+    return config;
+}
+
+inline RuntimeUserConfig ParseConfig(std::istream& input, std::string sourceName = "Config.toml") {
+    try {
+        return ParseConfigDocument(toml::parse(input, std::move(sourceName)));
+    } catch (const std::exception& exception) {
+        std::cerr << "[runtime-config] Invalid TOML; using built-in defaults: "
+                  << exception.what() << std::endl;
+        return {};
+    }
+}
+
+inline RuntimeUserConfig LoadConfigFile() {
+    EnsureConfigFile();
+    std::ifstream file(ResolveConfigPath(), std::ios::binary);
+    return file ? ParseConfig(file, ResolveConfigPath().string()) : RuntimeUserConfig{};
+}
+
+inline const RuntimeUserConfig& Get() {
+    static RuntimeUserConfig config = LoadConfigFile();
+    return config;
+}
+
+inline RuntimeUserConfig& Mutable() {
+    return const_cast<RuntimeUserConfig&>(Get());
+}
+
+inline constexpr std::array<std::string_view, 12> kControllerButtonKeys = {
+    "a", "b", "x", "y", "start", "z", "l", "r", "up", "down", "left", "right",
+};
+
+inline const std::optional<std::string>& ControllerButton(size_t index) {
+    static const std::optional<std::string> empty;
+    return index < Get().controllerButtons.size() ? Get().controllerButtons[index] : empty;
+}
+
+// Update one TOML value without discarding comments, unrelated settings, or
+// user-specific paths. This is used by the in-game F10 settings bar.
+inline bool WriteSetting(std::string_view section, std::string_view key, std::string_view value) {
+    const auto path = ResolveConfigPath();
+    std::ifstream input(path);
+    std::vector<std::string> lines;
+    std::string line;
+    while (std::getline(input, line)) {
+        if (!line.empty() && line.back() == '\r') {
+            line.pop_back();
+        }
+        lines.push_back(std::move(line));
+    }
+
+    const std::string normalizedSection = Trim(section);
+    const std::string normalizedKey = Trim(key);
+    size_t sectionStart = lines.size();
+    size_t sectionEnd = lines.size();
+    for (size_t i = 0; i < lines.size(); ++i) {
+        const std::string trimmed = Trim(RemoveComment(lines[i]));
+        if (trimmed.size() >= 2 && trimmed.front() == '[' && trimmed.back() == ']') {
+            const std::string found = Trim(std::string_view(trimmed).substr(1, trimmed.size() - 2));
+            if (sectionStart != lines.size()) {
+                sectionEnd = i;
+                break;
+            }
+            if (found == normalizedSection) {
+                sectionStart = i;
+            }
+        }
+    }
+
+    const std::string replacement = normalizedKey + " = " + std::string(value);
+    if (sectionStart == lines.size()) {
+        if (!lines.empty() && !lines.back().empty()) {
+            lines.emplace_back();
+        }
+        lines.emplace_back("[" + normalizedSection + "]");
+        lines.push_back(replacement);
+    } else {
+        bool replaced = false;
+        for (size_t i = sectionStart + 1; i < sectionEnd; ++i) {
+            const std::string uncommented = Trim(RemoveComment(lines[i]));
+            const size_t equals = uncommented.find('=');
+            if (equals != std::string::npos && Trim(std::string_view(uncommented).substr(0, equals)) == normalizedKey) {
+                lines[i] = replacement;
+                replaced = true;
+                break;
+            }
+        }
+        if (!replaced) {
+            // Append after the section's last real line rather than after the blank line that
+            // separates it from the next header: this file is edited by hand and by the host
+            // installer as well, and a key parked below the separator reads as if it belonged to
+            // the next section. The host writer (Launcher/WiiCompiled.Setup/RuntimeConfiguration.cs)
+            // applies exactly this rule.
+            size_t insertAt = sectionEnd;
+            while (insertAt > sectionStart + 1 && Trim(lines[insertAt - 1]).empty()) {
+                --insertAt;
+            }
+            lines.insert(lines.begin() + static_cast<std::ptrdiff_t>(insertAt), replacement);
+        }
+    }
+
+    std::error_code ec;
+    if (path.has_parent_path()) {
+        std::filesystem::create_directories(path.parent_path(), ec);
+    }
+    std::ofstream output(path, std::ios::trunc);
+    if (!output) {
+        std::cerr << "[runtime-config] Unable to write " << path.string() << std::endl;
+        return false;
+    }
+    for (const auto& outputLine : lines) {
+        output << outputLine << '\n';
+    }
+    return static_cast<bool>(output);
+}
+
+inline std::string FormatString(std::string_view value) {
+    return toml::format(toml::value(std::string(value)));
+}
+
+inline bool SetResolutionMultiplier(float value) {
+    Mutable().resolutionMultiplier = value;
+    std::ostringstream formatted;
+    formatted << value;
+    return WriteSetting("video", "resolution_multiplier", formatted.str());
+}
+
+inline bool SetWindowSize(uint32_t width, uint32_t height) {
+    if (width == 0 || height == 0) {
+        return false;
+    }
+    Mutable().windowWidth = width;
+    Mutable().windowHeight = height;
+    const bool wroteWidth = WriteSetting("video", "window_width", std::to_string(width));
+    const bool wroteHeight = WriteSetting("video", "window_height", std::to_string(height));
+    return wroteWidth && wroteHeight;
+}
+
+inline bool SetWindowPosition(int32_t x, int32_t y) {
+    Mutable().windowPosX = x;
+    Mutable().windowPosY = y;
+    const bool wroteX = WriteSetting("video", "window_x", std::to_string(x));
+    const bool wroteY = WriteSetting("video", "window_y", std::to_string(y));
+    return wroteX && wroteY;
+}
+
+inline bool SetFrameInterpolationFps(uint32_t value) {
+    if (!IsSupportedFrameInterpolationFps(value)) {
+        return false;
+    }
+    Mutable().frameInterpolationFps = value;
+    return WriteSetting("video", "frame_interpolation_fps", std::to_string(value));
+}
+
+inline bool SetDisplayMode(std::string value) {
+    if (!IsSupportedDisplayMode(value)) {
+        return false;
+    }
+    Mutable().displayMode = value;
+    return WriteSetting("video", "display_mode", FormatString(value));
+}
+
+inline bool SetSkipUnreadyPipelines(bool value) {
+    Mutable().skipUnreadyPipelines = value;
+    return WriteSetting("video", "skip_unready_pipelines", value ? "true" : "false");
+}
+
+inline bool SetDisableCopyFilter(bool value) {
+    Mutable().disableCopyFilter = value;
+    return WriteSetting("video", "disable_copy_filter", value ? "true" : "false");
+}
+
+inline bool SetShowFps(bool value) {
+    Mutable().showFps = value;
+    return WriteSetting("video", "show_fps", value ? "true" : "false");
+}
+
+inline bool SetDisabledPostProcessingPaths(uint32_t value) {
+    Mutable().disabledPostProcessingPaths = value;
+    std::ostringstream formatted;
+    formatted << "0x" << std::hex << std::uppercase << value;
+    return WriteSetting("video", "disabled_post_processing_paths", formatted.str());
+}
+
+inline bool SetControllerButton(size_t index, std::string value) {
+    if (index >= kControllerButtonKeys.size()) {
+        return false;
+    }
+    Mutable().controllerButtons[index] = value;
+    return WriteSetting("controller", kControllerButtonKeys[index], FormatString(value));
+}
+
+inline bool SetAudioVolume(float value) {
+    value = std::clamp(value, 0.0f, 1.0f);
+    Mutable().audioVolume = value;
+    std::ostringstream formatted;
+    formatted << value;
+    return WriteSetting("audio", "volume", formatted.str());
+}
+
+inline bool SetMusicVolume(float value) {
+    value = std::clamp(value, 0.0f, 1.0f);
+    Mutable().audioMusicVolume = value;
+    std::ostringstream formatted;
+    formatted << value;
+    return WriteSetting("audio", "music_volume", formatted.str());
+}
+
+inline bool SetSoundEffectsVolume(float value) {
+    value = std::clamp(value, 0.0f, 1.0f);
+    Mutable().audioSoundEffectsVolume = value;
+    std::ostringstream formatted;
+    formatted << value;
+    return WriteSetting("audio", "sound_effects_volume", formatted.str());
+}
+
+inline bool SetUiVolume(float value) {
+    value = std::clamp(value, 0.0f, 1.0f);
+    Mutable().audioUiVolume = value;
+    std::ostringstream formatted;
+    formatted << value;
+    return WriteSetting("audio", "ui_volume", formatted.str());
+}
+
+inline bool SetVoicesVolume(float value) {
+    value = std::clamp(value, 0.0f, 1.0f);
+    Mutable().audioVoicesVolume = value;
+    std::ostringstream formatted;
+    formatted << value;
+    return WriteSetting("audio", "voices_volume", formatted.str());
+}
+
+inline bool SetAudioMuted(bool value) {
+    Mutable().audioMuted = value;
+    return WriteSetting("audio", "muted", value ? "true" : "false");
+}
+
+inline bool SetAudioMixWorker(bool value) {
+    Mutable().audioMixWorker = value;
+    return WriteSetting("audio", "mix_worker", value ? "true" : "false");
+}
+
+inline bool SetAttenuateMusicWhenMediaPlays(bool value) {
+    Mutable().attenuateMusicWhenMediaPlays = value;
+    return WriteSetting("audio", "attenuate_music_when_media_plays", value ? "true" : "false");
+}
+
+inline bool WidescreenEnabled(bool fallback = false) {
+    return Get().widescreen.value_or(fallback);
+}
+
+inline bool WindowPosition(int32_t& x, int32_t& y) {
+    if (!Get().windowPosX || !Get().windowPosY) {
+        return false;
+    }
+    x = *Get().windowPosX;
+    y = *Get().windowPosY;
+    return true;
+}
+
+inline uint32_t WindowWidth(uint32_t fallback) {
+    return Get().windowWidth.value_or(fallback);
+}
+
+inline uint32_t WindowHeight(uint32_t fallback) {
+    return Get().windowHeight.value_or(fallback);
+}
+
+inline float ResolutionMultiplier(float fallback = 1.0f) {
+    return std::max(0.0f, Get().resolutionMultiplier.value_or(fallback));
+}
+
+inline float AudioVolume(float fallback = 1.0f) {
+    return std::clamp(Get().audioVolume.value_or(fallback), 0.0f, 1.0f);
+}
+
+inline float MusicVolume(float fallback = 1.0f) {
+    return std::clamp(Get().audioMusicVolume.value_or(fallback), 0.0f, 1.0f);
+}
+
+inline float SoundEffectsVolume(float fallback = 1.0f) {
+    return std::clamp(Get().audioSoundEffectsVolume.value_or(fallback), 0.0f, 1.0f);
+}
+
+inline float UiVolume(float fallback = 1.0f) {
+    return std::clamp(Get().audioUiVolume.value_or(fallback), 0.0f, 1.0f);
+}
+
+inline float VoicesVolume(float fallback = 1.0f) {
+    return std::clamp(Get().audioVoicesVolume.value_or(fallback), 0.0f, 1.0f);
+}
+
+inline bool AudioMuted(bool fallback = false) {
+    return Get().audioMuted.value_or(fallback);
+}
+
+// Off-thread AX/DSP mix. Default on; false restores the fully synchronous mix.
+inline bool AudioMixWorkerEnabled(bool fallback = true) {
+    return Get().audioMixWorker.value_or(fallback);
+}
+
+inline bool AttenuateMusicWhenMediaPlays(bool fallback = false) {
+    return Get().attenuateMusicWhenMediaPlays.value_or(fallback);
+}
+
+inline uint32_t FrameInterpolationFps(uint32_t fallback = 0) {
+    return Get().frameInterpolationFps.value_or(fallback);
+}
+
+inline bool SkipUnreadyPipelines(bool fallback = true) {
+    return Get().skipUnreadyPipelines.value_or(fallback);
+}
+
+inline bool DisableCopyFilter(bool fallback = true) {
+    return Get().disableCopyFilter.value_or(fallback);
+}
+
+inline bool ShowFps(bool fallback = true) {
+    return Get().showFps.value_or(fallback);
+}
+
+inline bool TextureReplacements(bool fallback = false) {
+    return Get().textureReplacements.value_or(fallback);
+}
+
+// Dumping only produces the names a replacement would need, so main.cpp
+// gates it on TextureReplacements() as well.
+inline bool TextureDumps(bool fallback = false) {
+    return Get().textureDumps.value_or(fallback);
+}
+
+inline uint32_t DisabledPostProcessingPaths(uint32_t fallback = 0) {
+    return Get().disabledPostProcessingPaths.value_or(fallback) & 0x10u;
+}
+
+inline std::string GraphicsApi(std::string fallback = "auto") {
+    return Get().graphicsApi.value_or(std::move(fallback));
+}
+
+inline std::string DisplayMode(std::string fallback = "windowed") {
+    return Get().displayMode.value_or(std::move(fallback));
+}
+
+inline bool NetworkEnabled(bool fallback = true) {
+    return Get().networkEnabled.value_or(fallback);
+}
+
+inline std::string NandRoot(std::string fallback = "") {
+    return Get().nandRoot.value_or(std::move(fallback));
+}
+
+inline std::string DvdRoot(std::string fallback = "") {
+    return Get().dvdRoot.value_or(std::move(fallback));
+}
+
+// The one resolver for configured paths. A relative value means the same thing
+// everywhere it can be configured: relative to the config file that named it,
+// never to the process working directory (docs/WHEELWIZARD_CONTRACT.md).
+inline std::filesystem::path ResolveRelativeTo(const std::filesystem::path& base,
+                                               const std::string& value) {
+    std::filesystem::path path(value);
+    if (path.is_relative()) {
+        path = base / path;
+    }
+    return path.lexically_normal();
+}
+
+inline std::filesystem::path ResolveRelativeToConfig(const std::string& value) {
+    return ResolveRelativeTo(ResolveConfigPath().parent_path(), value);
+}
+
+// The extracted DATA directory. Empty when nothing is configured.
+inline std::filesystem::path ResolvedDvdRoot() {
+    const std::string configured = DvdRoot();
+    return configured.empty() ? std::filesystem::path{} : ResolveRelativeToConfig(configured);
+}
+
+/// The canonical Retro Rewind installation the frontend owns, or "" when none is recorded.
+inline std::string RetroRewindRoot(std::string fallback = "") {
+    return Get().retroRewindRoot.value_or(std::move(fallback));
+}
+
+inline const std::vector<std::string>& OverlayRoots() {
+    return Get().overlayRoots;
+}
+
+inline void LogLoadedConfig() {
+    static const bool logged = [] {
+        const auto& config = Get();
+        const auto configPath = ResolveConfigPath();
+        std::cout << "[runtime-config] " << configPath.string();
+        if (!std::filesystem::exists(configPath)) {
+            std::cout << " not found; using built-in defaults";
+        } else {
+            std::cout << " loaded";
+            if (config.widescreen) {
+                std::cout << " widescreen=" << (*config.widescreen ? "true" : "false");
+            }
+            if (config.windowWidth || config.windowHeight) {
+                std::cout << " window=" << config.windowWidth.value_or(0) << "x"
+                          << config.windowHeight.value_or(0);
+            }
+            if (config.resolutionMultiplier) {
+                std::cout << " resolution_multiplier=" << *config.resolutionMultiplier;
+            }
+            if (config.dvdRoot) {
+                std::cout << " dvd_root=" << *config.dvdRoot;
+            }
+            if (config.graphicsApi) {
+                std::cout << " graphics_api=" << *config.graphicsApi;
+            }
+            if (config.frameInterpolationFps) {
+                std::cout << " frame_interpolation_fps=" << *config.frameInterpolationFps;
+            }
+            if (config.skipUnreadyPipelines) {
+                std::cout << " skip_unready_pipelines=" << (*config.skipUnreadyPipelines ? "true" : "false");
+            }
+            if (config.disableCopyFilter) {
+                std::cout << " disable_copy_filter=" << (*config.disableCopyFilter ? "true" : "false");
+            }
+            if (config.showFps) {
+                std::cout << " show_fps=" << (*config.showFps ? "true" : "false");
+            }
+            if (config.textureReplacements) {
+                std::cout << " texture_replacements=" << (*config.textureReplacements ? "true" : "false");
+            }
+            if (config.textureDumps) {
+                std::cout << " texture_dumps=" << (*config.textureDumps ? "true" : "false");
+            }
+            if (config.audioVolume) {
+                std::cout << " audio_volume=" << *config.audioVolume;
+            }
+            if (config.audioMuted) {
+                std::cout << " audio_muted=" << (*config.audioMuted ? "true" : "false");
+            }
+            if (config.networkEnabled) {
+                std::cout << " network_enabled=" << (*config.networkEnabled ? "true" : "false");
+            }
+            if (config.nandRoot) {
+                std::cout << " nand_root=" << *config.nandRoot;
+            }
+            if (config.retroRewindRoot) {
+                std::cout << " retro_rewind_root=" << *config.retroRewindRoot;
+            }
+        }
+        std::cout << std::endl;
+        return true;
+    }();
+    (void)logged;
+}
+
+} // namespace RuntimeConfigFile
diff --git a/runtime/include/runtime_log.h b/runtime/include/runtime_log.h
new file mode 100644
index 0000000..60ff361
--- /dev/null
+++ b/runtime/include/runtime_log.h
@@ -0,0 +1,45 @@
+#pragma once
+
+#ifndef MKW_RUNTIME_LOG_H
+#define MKW_RUNTIME_LOG_H
+
+#include <cstdio>
+#include <iostream>
+
+#include "memory.h"
+
+// Canonical module tags. Use one of these; never write a bare "[...]" prefix
+// into a message. (A message whose text spans several output lines repeats the
+// tag inline on the continuation lines - the macros only prefix the first.)
+#define RT_TAG_RUNTIME "runtime"
+#define RT_TAG_CONFIG "runtime-config"
+#define RT_TAG_MEMORY "memory"
+#define RT_TAG_MOD "mod"
+#define RT_TAG_HLE "hle"
+#define RT_TAG_OS "os"
+#define RT_TAG_GX "gx"
+#define RT_TAG_AUDIO "audio"
+#define RT_TAG_NET "net"
+#define RT_TAG_DVD "dvd"
+#define RT_TAG_NAND "nand"
+#define RT_TAG_RIIVOLUTION "riivolution"
+#define RT_TAG_VI "vi"
+
+// Stream form:  RT_LOG(RT_TAG_OS) << "OSCreateThread failed" << std::endl;
+#define RT_LOG(tag) (std::cerr << "[" tag "] ")
+
+// printf form:  RT_LOGF(RT_TAG_GX, "invalid GXTexObj @0x%08X\n", addr);
+// `tag` and the format string must both be literals; they are concatenated.
+#define RT_LOGF(tag, ...) std::fprintf(stderr, "[" tag "] " __VA_ARGS__)
+
+// Shared epilogue for the `catch (const Memory::AccessViolation& e)` handlers
+// spread across the HLE. `who` is the guest function or operation that faulted;
+// the tag is its module.
+inline void LogMemoryError(const char* tag, const char* who,
+                           const ::Memory::AccessViolation& e)
+{
+    std::cerr << "[" << tag << "] " << who << ": memory error at 0x" << std::hex
+              << e.address() << std::dec << " (" << e.reason() << ")" << std::endl;
+}
+
+#endif // MKW_RUNTIME_LOG_H
diff --git a/runtime/include/runtime_product.h b/runtime/include/runtime_product.h
new file mode 100644
index 0000000..6738d3b
--- /dev/null
+++ b/runtime/include/runtime_product.h
@@ -0,0 +1,26 @@
+#pragma once
+
+#include <string_view>
+
+namespace RuntimeProduct {
+
+enum class Kind {
+    BaseGame,
+    RetroRewind,
+};
+
+struct Descriptor {
+    Kind kind;
+    std::string_view displayName;
+};
+
+// Each public executable links exactly one small provider definition. Keeping
+// this selection out of target-wide preprocessor definitions lets the native
+// runtime be compiled once and shared by every product.
+const Descriptor& Active() noexcept;
+
+inline bool IsRetroRewind() noexcept {
+    return Active().kind == Kind::RetroRewind;
+}
+
+} // namespace RuntimeProduct
diff --git a/runtime/include/settings_overlay.h b/runtime/include/settings_overlay.h
new file mode 100644
index 0000000..b706989
--- /dev/null
+++ b/runtime/include/settings_overlay.h
@@ -0,0 +1,15 @@
+#pragma once
+
+#include <aurora/aurora.h>
+#include <aurora/event.h>
+
+namespace settings_overlay {
+// Apply persistent controller settings once Aurora has discovered host devices.
+void InitializeRuntimeSettings() noexcept;
+// Draw the F10 settings bar before each Aurora present.
+void HandleEvents(const AuroraEvent* events) noexcept;
+void Draw() noexcept;
+bool StartupScreenVisible() noexcept;
+void NotifyStrapInputAccepted() noexcept;
+void AdvancePresentedFrame() noexcept;
+} // namespace settings_overlay
diff --git a/runtime/include/system_bridge.h b/runtime/include/system_bridge.h
new file mode 100644
index 0000000..18194e8
--- /dev/null
+++ b/runtime/include/system_bridge.h
@@ -0,0 +1,76 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <ostream>
+#include <string>
+#include <string_view>
+
+#include <csetjmp>
+
+#include "memory.h"
+
+// Global flag to suppress SEH reporting (caught by system_bridge)
+extern bool g_suppressSehReporting;
+// Jump buffer for SEH recovery
+extern thread_local jmp_buf* g_sehJumpTarget;
+// SEH details for the most recent trapped exception (used during ctor execution).
+extern thread_local uint32_t g_sehLastExceptionCode;
+extern thread_local uintptr_t g_sehLastExceptionAddress;
+extern thread_local uintptr_t g_sehLastAccessedAddress;
+extern thread_local uint32_t g_sehLastAccessType;
+
+void WriteFatalLog(std::string_view reason);
+void SetRuntimeExitCode(int code);
+
+// Centralized crash reporting (defined in main.cpp). Every fatal path funnels
+// through these so the per-run log folder always receives the same artifact
+// set: crash_<reason>.txt with registers/backtrace/heuristics, plus MEM1/MEM2
+// snapshots a developer can walk offline.
+namespace RuntimeCrash {
+
+// Writes crash_<reason>.txt (and, once per process, the guest memory
+// snapshots) into the current run's log folder. Safe to call from any fatal
+// path; never throws.
+void WriteCrashArtifacts(std::string_view reason,
+                         std::string_view extraDetails = {},
+                         const uint32_t* missingGuestTarget = nullptr) noexcept;
+
+// Full fatal path for a guest jump to an untranslated/invalid target:
+// stderr diagnostics, crash artifacts, popup, exit.
+[[noreturn]] void FatalMissingGuestTarget(uint32_t target, struct CpuContext* cpu) noexcept;
+
+} // namespace RuntimeCrash
+
+// Shows a user-facing explanation for a fatal runtime error. Declared here with
+// its two siblings; all three are defined in main.cpp so translated dispatch,
+// HLE, memory and Aurora callbacks share one popup and duplicate failures do
+// not stack dialogs. (The ISA package declares this independently at
+// isa/ppc_isa_context.h - that is its standalone host seam, not a duplicate.)
+void ShowRuntimeFatalPopup(std::string_view category, std::string_view details) noexcept;
+
+// Mario Kart Wii's translated entry point. The products always boot here, so
+// this is applied as the default while parsing the command line; there is no
+// flag to override it.
+inline constexpr uint32_t kDefaultEntryAddress = 0x800060A4u;
+
+class SystemBridge {
+public:
+    static void Initialize();
+
+private:
+    static const Memory::RegionConfig* FindRegionConfig(const Memory::Config& config, std::string_view name);
+    static void SeedLowMemDefaults(const Memory::Config& config);
+    
+public:
+    static void DumpCpuState(const struct CpuContext* cpu);
+    static void DumpCpuState(std::ostream& os, const struct CpuContext* cpu);
+
+    // Crash-path helpers shared by the centralized reporter in main.cpp.
+    // DumpCrashHeuristics prints plain-language "likely cause" hints derived
+    // from the register state; WriteGuestMemorySnapshot writes MEM1 to
+    // `mem1Path` and MEM2 to `mem1Path + ".mem2"`, logging outcomes to `os`.
+    static void DumpCrashHeuristics(std::ostream& os, const struct CpuContext* cpu,
+                                    const uint32_t* missingGuestTarget);
+    static void WriteGuestMemorySnapshot(std::ostream& os, const char* mem1Path);
+};
diff --git a/runtime/include/timebase_contract.h b/runtime/include/timebase_contract.h
new file mode 100644
index 0000000..5cf37e5
--- /dev/null
+++ b/runtime/include/timebase_contract.h
@@ -0,0 +1,50 @@
+#pragma once
+
+#include <chrono>
+#include <cstdint>
+
+namespace TimeBaseContract {
+
+// Broadway's time base runs at one quarter of the 243 MHz Wii bus clock.
+// Reduced against one billion nanoseconds per second, that is exactly
+// 243 time-base ticks per 4000 nanoseconds (60.75 MHz).
+inline constexpr uint64_t kBusClockHz = 243'000'000u;
+inline constexpr uint64_t kTimeBaseDivider = 4u;
+inline constexpr uint64_t kTicksPerSecond = kBusClockHz / kTimeBaseDivider;
+inline constexpr uint64_t kNanosecondsPerSecond = 1'000'000'000u;
+inline constexpr uint64_t kTickRatioNumerator = 243u;
+inline constexpr uint64_t kTickRatioDenominator = 4'000u;
+
+static_assert(kTicksPerSecond == 60'750'000u);
+static_assert(kTicksPerSecond * kTickRatioDenominator ==
+              kNanosecondsPerSecond * kTickRatioNumerator);
+
+// Split the rational conversion around the division so the intermediate
+// product cannot overflow. The result is floor(nanoseconds * 243 / 4000).
+constexpr uint64_t NanosecondsToTicks(uint64_t nanoseconds) noexcept
+{
+    return (nanoseconds / kTickRatioDenominator) * kTickRatioNumerator +
+           ((nanoseconds % kTickRatioDenominator) * kTickRatioNumerator) /
+               kTickRatioDenominator;
+}
+
+// Convert guest ticks to a host duration without applying scheduling policy.
+// Oversized durations retain the existing zero-duration failure behavior.
+constexpr std::chrono::nanoseconds TicksToDuration(uint64_t ticks) noexcept
+{
+    constexpr uint64_t kMaxNanoseconds =
+        static_cast<uint64_t>(std::chrono::nanoseconds::max().count());
+    constexpr uint64_t kMaxTicks = NanosecondsToTicks(kMaxNanoseconds);
+
+    if (ticks == 0 || ticks > kMaxTicks) {
+        return std::chrono::nanoseconds::zero();
+    }
+
+    const uint64_t nanoseconds =
+        (ticks / kTickRatioNumerator) * kTickRatioDenominator +
+        ((ticks % kTickRatioNumerator) * kTickRatioDenominator) /
+            kTickRatioNumerator;
+    return std::chrono::nanoseconds(static_cast<int64_t>(nanoseconds));
+}
+
+} // namespace TimeBaseContract
diff --git a/runtime/include/wii_es_crypto.h b/runtime/include/wii_es_crypto.h
new file mode 100644
index 0000000..d1fb78c
--- /dev/null
+++ b/runtime/include/wii_es_crypto.h
@@ -0,0 +1,236 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+//
+// Copyright 2010 Dolphin Emulator Project
+// Copyright 2007,2008 Segher Boessenkool
+//
+// Console identity constants and certificate layout details are derived from
+// the Dolphin Emulator
+// (https://github.com/dolphin-emu/dolphin):
+//
+//   * Source/Core/Core/IOS/IOSC.cpp - the default console identity constants
+//     (device id, CA/MS ids, NG key id, default ECC private key and signature).
+//   * Source/Core/Common/Crypto/ec.cpp - the sect233r1 public-key and signature
+//     encodings used by IOS. Arithmetic, hashing, randomness and ECDSA are now
+//     provided by Crypto++.
+//
+// This file is GPL-2.0-or-later as a consequence; see THIRD-PARTY-NOTICES.md.
+
+#pragma once
+
+#include "isa/big_endian.h"
+#include "nand_path.h"
+
+#include <cryptopp/eccrypto.h>
+#include <cryptopp/ec2n.h>
+#include <cryptopp/oids.h>
+#include <cryptopp/osrng.h>
+#include <cryptopp/sha.h>
+
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <optional>
+#include <stdexcept>
+#include <string>
+
+namespace WiiEsCrypto {
+
+using EcSignature = std::array<uint8_t, 60>;
+using EcPublicKey = std::array<uint8_t, 60>;
+using EccCert = std::array<uint8_t, 0x180>;
+
+constexpr uint32_t kDeviceId = 0x0403AC68;
+constexpr uint32_t kCaId = 1;
+constexpr uint32_t kMsId = 2;
+constexpr uint32_t kNgKeyId = 0x6AAB8C59;
+
+constexpr std::array<uint8_t, 30> kDefaultPrivateKey{{
+    0x00, 0xAB, 0xEE, 0xC1, 0xDD, 0xB4, 0xA6, 0x16, 0x6B, 0x70, 0xFD, 0x7E, 0x56, 0x67, 0x70,
+    0x57, 0x55, 0x27, 0x38, 0xA3, 0x26, 0xC5, 0x46, 0x16, 0xF7, 0x62, 0xC9, 0xED, 0x73, 0xF2,
+}};
+
+constexpr EcSignature kDefaultSignature{{
+    0x00, 0xD8, 0x81, 0x63, 0xB2, 0x00, 0x6B, 0x0B, 0x54, 0x82, 0x88, 0x63, 0x81, 0x1C, 0x00,
+    0x71, 0x12, 0xED, 0xB7, 0xFD, 0x21, 0xAB, 0x0E, 0x50, 0x0E, 0x1F, 0xBF, 0x78, 0xAD, 0x37,
+    0x00, 0x71, 0x8D, 0x82, 0x41, 0xEE, 0x45, 0x11, 0xC7, 0x3B, 0xAC, 0x08, 0xB6, 0x83, 0xDC,
+    0x05, 0xB8, 0xA8, 0x90, 0x1F, 0xA8, 0x2A, 0x0E, 0x4E, 0x76, 0xEF, 0x44, 0x72, 0x99, 0xF8,
+}};
+
+struct Identity {
+    uint32_t deviceId = kDeviceId;
+    uint32_t caId = kCaId;
+    uint32_t msId = kMsId;
+    uint32_t ngKeyId = kNgKeyId;
+    std::array<uint8_t, 30> privateKey = kDefaultPrivateKey;
+    EcSignature signature = kDefaultSignature;
+    bool fromNand = false;
+};
+
+inline std::optional<Identity> LoadIdentityFromKeysBin(const std::filesystem::path& path) {
+    std::ifstream file(path, std::ios::binary | std::ios::ate);
+    if (!file) {
+        return std::nullopt;
+    }
+
+    const std::streamoff fileSize = file.tellg();
+    if (fileSize < 0x400) {
+        return std::nullopt;
+    }
+    file.seekg(0, std::ios::beg);
+    std::array<uint8_t, 0x400> dump{};
+    file.read(reinterpret_cast<char*>(dump.data()), static_cast<std::streamsize>(dump.size()));
+    if (!file) {
+        return std::nullopt;
+    }
+
+    Identity identity{};
+    identity.deviceId = BigEndian::Read32(dump.data() + 0x124);
+    identity.msId = BigEndian::Read32(dump.data() + 0x200);
+    identity.caId = BigEndian::Read32(dump.data() + 0x204);
+    identity.ngKeyId = BigEndian::Read32(dump.data() + 0x208);
+    std::copy_n(dump.data() + 0x128, identity.privateKey.size(), identity.privateKey.begin());
+    std::copy_n(dump.data() + 0x20C, identity.signature.size(), identity.signature.begin());
+    identity.fromNand = true;
+
+    const bool privateKeyEmpty = std::all_of(identity.privateKey.begin(), identity.privateKey.end(),
+                                            [](uint8_t b) { return b == 0; });
+    if (identity.deviceId == 0 || identity.caId == 0 || identity.msId == 0 ||
+        identity.ngKeyId == 0 || privateKeyEmpty) {
+        return std::nullopt;
+    }
+    return identity;
+}
+
+inline std::optional<Identity> LoadIdentityFromNand(const std::filesystem::path& nandBase) {
+    if (nandBase.empty()) {
+        return std::nullopt;
+    }
+    return LoadIdentityFromKeysBin(nandBase / "keys.bin");
+}
+
+inline const Identity& CurrentIdentity() {
+    static const Identity identity = [] {
+        if (auto loaded = LoadIdentityFromNand(RuntimeNandPath::DiscoverNandRootPath())) {
+            return *loaded;
+        }
+        return Identity{};
+    }();
+    return identity;
+}
+
+inline std::array<uint8_t, 20> Sha1(const uint8_t* data, size_t size) {
+    std::array<uint8_t, 20> digest{};
+    CryptoPP::SHA1 hash;
+    hash.CalculateDigest(digest.data(), data, size);
+    return digest;
+}
+
+using CryptoEcdsa = CryptoPP::ECDSA<CryptoPP::EC2N, CryptoPP::SHA1>;
+
+inline CryptoEcdsa::PrivateKey MakePrivateKey(const uint8_t* key) {
+    CryptoPP::DL_GroupParameters_EC<CryptoPP::EC2N> parameters(CryptoPP::ASN1::sect233r1());
+    const CryptoPP::Integer exponent(key, 30);
+    if (exponent <= CryptoPP::Integer::Zero() || exponent >= parameters.GetSubgroupOrder()) {
+        throw std::invalid_argument("Wii ES private key is outside the sect233r1 subgroup");
+    }
+
+    CryptoEcdsa::PrivateKey privateKey;
+    privateKey.Initialize(parameters, exponent);
+    return privateKey;
+}
+
+inline EcSignature SignMessage(const uint8_t* key, const uint8_t* data, size_t size) {
+    const CryptoEcdsa::PrivateKey privateKey = MakePrivateKey(key);
+    const CryptoEcdsa::Signer signer(privateKey);
+    if (signer.SignatureLength() != EcSignature{}.size()) {
+        throw std::runtime_error("Crypto++ returned an unexpected sect233r1 signature size");
+    }
+
+    thread_local CryptoPP::AutoSeededRandomPool random;
+    EcSignature signature{};
+    const size_t written = signer.SignMessage(random, data, size, signature.data());
+    if (written != signature.size()) {
+        throw std::runtime_error("Crypto++ produced a truncated Wii ES signature");
+    }
+    return signature;
+}
+
+inline EcPublicKey PrivToPub(const uint8_t* key) {
+    const CryptoEcdsa::PrivateKey privateKey = MakePrivateKey(key);
+    CryptoEcdsa::PublicKey publicKey;
+    privateKey.MakePublicKey(publicKey);
+    const auto& point = publicKey.GetPublicElement();
+    EcPublicKey out{};
+    point.x.Encode(out.data(), 30);
+    point.y.Encode(out.data() + 30, 30);
+    return out;
+}
+
+inline void WriteString(uint8_t* dst, size_t dstSize, const std::string& text) {
+    std::memset(dst, 0, dstSize);
+    std::memcpy(dst, text.data(), std::min(dstSize, text.size()));
+}
+
+inline std::string Hex8(uint32_t value) {
+    static constexpr char kHex[] = "0123456789abcdef";
+    std::string out(8, '0');
+    for (int i = 7; i >= 0; --i) {
+        out[static_cast<size_t>(i)] = kHex[value & 0xFu];
+        value >>= 4;
+    }
+    return out;
+}
+
+inline std::string Hex16(uint64_t value) {
+    return Hex8(static_cast<uint32_t>(value >> 32)) + Hex8(static_cast<uint32_t>(value));
+}
+
+inline EccCert MakeBlankEccCert(const std::string& issuer, const std::string& name,
+                                const uint8_t* privateKey, uint32_t keyId) {
+    EccCert cert{};
+    BigEndian::Write32(cert.data() + 0x00, 0x00010002u);
+    WriteString(cert.data() + 0x80, 0x40, issuer);
+    BigEndian::Write32(cert.data() + 0xC0, 2);
+    WriteString(cert.data() + 0xC4, 0x40, name);
+    BigEndian::Write32(cert.data() + 0x104, keyId);
+    const EcPublicKey pub = PrivToPub(privateKey);
+    std::copy(pub.begin(), pub.end(), cert.begin() + 0x108);
+    return cert;
+}
+
+inline EccCert GetDeviceCertificate(const Identity& identity = CurrentIdentity()) {
+    const std::string issuer = "Root-CA" + Hex8(identity.caId) + "-MS" + Hex8(identity.msId);
+    const std::string name = "NG" + Hex8(identity.deviceId);
+    EccCert cert = MakeBlankEccCert(issuer, name, identity.privateKey.data(), identity.ngKeyId);
+    std::copy(identity.signature.begin(), identity.signature.end(), cert.begin() + 0x04);
+    return cert;
+}
+
+inline void Sign(uint64_t titleId, const uint8_t* data, size_t dataSize,
+                 const Identity& identity,
+                 EcSignature& sigOut, EccCert& apCertOut) {
+    std::array<uint8_t, 30> apPrivate{};
+    apPrivate[0x1D] = 1;
+
+    const std::string signer = "Root-CA" + Hex8(identity.caId) + "-MS" + Hex8(identity.msId) +
+                               "-NG" + Hex8(identity.deviceId);
+    const std::string name = "AP" + Hex16(titleId);
+    apCertOut = MakeBlankEccCert(signer, name, apPrivate.data(), 0);
+
+    const EcSignature apCertSig = SignMessage(
+        identity.privateKey.data(), apCertOut.data() + 0x80, apCertOut.size() - 0x80);
+    std::copy(apCertSig.begin(), apCertSig.end(), apCertOut.begin() + 0x04);
+
+    sigOut = SignMessage(apPrivate.data(), data, dataSize);
+}
+
+inline void Sign(uint64_t titleId, const uint8_t* data, size_t dataSize,
+                 EcSignature& sigOut, EccCert& apCertOut) {
+    Sign(titleId, data, dataSize, CurrentIdentity(), sigOut, apCertOut);
+}
+
+
+} // namespace WiiEsCrypto
diff --git a/runtime/src/abi_bridge.cpp b/runtime/src/abi_bridge.cpp
new file mode 100644
index 0000000..4ef3b2b
--- /dev/null
+++ b/runtime/src/abi_bridge.cpp
@@ -0,0 +1,486 @@
+#include "abi_bridge.h"
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstddef>
+#include <iomanip>
+#include <iostream>
+#include <mutex>
+#include <sstream>
+#include <unordered_map>
+#include <vector>
+#include "generated/RuntimeConfig.h"
+#include "runtime_log.h"
+
+// Nothing reads CpuContext by offset; these asserts just canary accidental field reordering
+// (the order is a cache-locality choice explained at the struct definition).
+static_assert(offsetof(CpuContext, gpr) == 0);
+static_assert(offsetof(CpuContext, cr) == 128);
+static_assert(offsetof(CpuContext, lr) == 132);
+static_assert(offsetof(CpuContext, ctr) == 136);
+static_assert(offsetof(CpuContext, xer) == 140);
+static_assert(offsetof(CpuContext, fpscr) == 144);
+static_assert(offsetof(CpuContext, pc) == 148);
+static_assert(offsetof(CpuContext, fpr) == 152);
+static_assert(offsetof(CpuContext, gqr) == 408);
+static_assert(offsetof(CpuContext, hid0) == 440);
+static_assert(offsetof(CpuContext, hid1) == 444);
+static_assert(offsetof(CpuContext, hid2) == 448);
+static_assert(offsetof(CpuContext, srr0) == 452);
+static_assert(offsetof(CpuContext, srr1) == 456);
+static_assert(offsetof(CpuContext, msr) == 460);
+static_assert(sizeof(CpuContext) == 464);
+
+namespace {
+std::vector<TranslatedFunctionInfo>& Registry() {
+    static std::vector<TranslatedFunctionInfo> entries;
+    return entries;
+}
+
+size_t& PriorityOverrideCount() {
+    static size_t count = 0;
+    return count;
+}
+
+std::mutex& RegistryMutex() {
+    static std::mutex mutex;
+    return mutex;
+}
+
+std::unordered_map<uint32_t, size_t>& AddressIndex() {
+    static std::unordered_map<uint32_t, size_t> index;
+    return index;
+}
+
+std::vector<RawDispatchRecord>& DynamicRawDispatchEntries() {
+    static std::vector<RawDispatchRecord> entries;
+    return entries;
+}
+
+const StaticIndirectDispatchTable*& GeneratedIndirectDispatchTable() {
+    static const StaticIndirectDispatchTable* table = nullptr;
+    return table;
+}
+
+std::unordered_map<uint32_t, std::vector<size_t>>& AddressEntries() {
+    static std::unordered_map<uint32_t, std::vector<size_t>> entries;
+    return entries;
+}
+
+struct HostEntryRef {
+    uintptr_t addr = 0;
+    size_t index = 0;
+};
+
+std::vector<HostEntryRef>& HostIndex() {
+    static std::vector<HostEntryRef> index;
+    return index;
+}
+
+std::atomic_bool& RegistryFrozen() {
+    static std::atomic_bool frozen{false};
+    return frozen;
+}
+
+const char* KindLabel(FunctionKind kind) {
+    switch (kind) {
+    case FunctionKind::BaseTranslated:
+        return "base translated";
+    case FunctionKind::ModTranslated:
+        return "mod translated";
+    case FunctionKind::Native:
+        return "native";
+    }
+    return "unknown";
+}
+
+uint32_t DefaultPriorityForKind(FunctionKind kind) {
+    switch (kind) {
+    case FunctionKind::BaseTranslated:
+        return kBaseTranslatedFunctionPriority;
+    case FunctionKind::ModTranslated:
+        return kModTranslatedFunctionPriorityBase;
+    case FunctionKind::Native:
+        return kNativeFunctionPriority;
+    }
+    return 0;
+}
+
+uint32_t EffectivePriority(const TranslatedFunctionInfo& info) {
+    return info.priority != 0 ? info.priority : DefaultPriorityForKind(info.kind);
+}
+
+uint32_t KindTieBreaker(FunctionKind kind) {
+    switch (kind) {
+    case FunctionKind::BaseTranslated:
+        return 0;
+    case FunctionKind::ModTranslated:
+        return 1;
+    case FunctionKind::Native:
+        return 2;
+    }
+    return 0;
+}
+
+bool IsBetterCandidate(const TranslatedFunctionInfo& candidate, const TranslatedFunctionInfo& current) {
+    const uint32_t candidatePriority = EffectivePriority(candidate);
+    const uint32_t currentPriority = EffectivePriority(current);
+    if (candidatePriority != currentPriority) {
+        return candidatePriority > currentPriority;
+    }
+
+    const uint32_t candidateKindRank = KindTieBreaker(candidate.kind);
+    const uint32_t currentKindRank = KindTieBreaker(current.kind);
+    if (candidateKindRank != currentKindRank) {
+        return candidateKindRank > currentKindRank;
+    }
+
+    return candidate.moduleId > current.moduleId;
+}
+
+bool IsSameRegistration(const TranslatedFunctionInfo& a, const TranslatedFunctionInfo& b) {
+    return a.address == b.address &&
+           a.kind == b.kind &&
+           EffectivePriority(a) == EffectivePriority(b) &&
+           a.moduleId == b.moduleId;
+}
+
+void RebuildIndicesLocked() {
+    auto& entries = Registry();
+    auto& addrIndex = AddressIndex();
+    auto& addressEntries = AddressEntries();
+    auto& rawDispatchEntries = DynamicRawDispatchEntries();
+    auto& hostIndex = HostIndex();
+
+    addrIndex.clear();
+    addressEntries.clear();
+    rawDispatchEntries.clear();
+    hostIndex.clear();
+    addrIndex.reserve(entries.size());
+    addressEntries.reserve(entries.size());
+
+    for (size_t i = 0; i < entries.size(); ++i) {
+        const auto& entry = entries[i];
+        addressEntries[entry.address].push_back(i);
+        auto addressIt = addrIndex.find(entry.address);
+        if (addressIt == addrIndex.end() || IsBetterCandidate(entry, entries[addressIt->second])) {
+            addrIndex[entry.address] = i;
+        }
+        if (entry.entryPoint) {
+            hostIndex.push_back({reinterpret_cast<uintptr_t>(entry.entryPoint), i});
+        }
+    }
+
+    std::sort(hostIndex.begin(), hostIndex.end(), [](const HostEntryRef& a, const HostEntryRef& b) {
+        return a.addr < b.addr;
+    });
+
+    const bool translatedWinnersAreGenerated = GeneratedIndirectDispatchTable() != nullptr;
+    rawDispatchEntries.reserve(translatedWinnersAreGenerated ? 256u : addrIndex.size());
+    for (const auto& [address, index] : addrIndex) {
+        const auto& entry = entries[index];
+        if (!entry.rawCpuInvoker || !entry.mustRemainDynamicallyDispatchable) {
+            continue;
+        }
+        if (translatedWinnersAreGenerated && entry.kind != FunctionKind::Native) {
+            continue;
+        }
+        rawDispatchEntries.push_back(RawDispatchRecord{
+            .address = address,
+            .entry = entry.rawCpuInvoker,
+            .nonvolatileFprWriteMask = NonvolatileFprGuardMaskFor(&entry),
+            .preserveNonvolatileGprs = ShouldPreserveNonvolatileGprsForRawCpuCall(&entry),
+        });
+    }
+    std::sort(rawDispatchEntries.begin(), rawDispatchEntries.end(),
+              [](const RawDispatchRecord& a, const RawDispatchRecord& b) {
+                  return a.address < b.address;
+              });
+}
+
+std::string ValidateGeneratedIndirectDispatchLocked() {
+    const auto* table = GeneratedIndirectDispatchTable();
+    if (!table) {
+        return {};
+    }
+    if (!table->profileName || !table->segments || !table->entries || table->entryCount == 0) {
+        return "Invalid generated indirect dispatch table";
+    }
+
+    uint32_t previousAddress = 0;
+    for (size_t i = 0; i < table->entryCount; ++i) {
+        const auto& record = table->entries[i];
+        if ((record.address & 3u) != 0 || !record.entry ||
+            (i != 0 && record.address <= previousAddress) ||
+            FindStaticIndirectDispatchEntry(table, record.address) != &record) {
+            std::ostringstream message;
+            message << "Malformed generated indirect dispatch entry " << i
+                    << " for profile '" << table->profileName << "'";
+            return message.str();
+        }
+        previousAddress = record.address;
+
+        const auto winner = AddressIndex().find(record.address);
+        if (winner == AddressIndex().end()) {
+            std::ostringstream message;
+            message << "Generated indirect dispatch target 0x" << std::hex << record.address
+                    << " is not registered for profile '" << table->profileName << "'";
+            return message.str();
+        }
+        const auto& info = Registry()[winner->second];
+        if (info.kind == FunctionKind::Native || info.rawCpuInvoker != record.entry ||
+            NonvolatileFprGuardMaskFor(&info) != record.nonvolatileFprWriteMask ||
+            record.preserveNonvolatileGprs) {
+            std::ostringstream message;
+            message << "Stale generated indirect dispatch winner at 0x" << std::hex
+                    << record.address << " for profile '" << table->profileName << "'";
+            return message.str();
+        }
+    }
+
+    for (const auto& [address, index] : AddressIndex()) {
+        const auto& info = Registry()[index];
+        if ((info.kind == FunctionKind::BaseTranslated || info.kind == FunctionKind::ModTranslated) &&
+            info.rawCpuInvoker && !FindStaticIndirectDispatchEntry(table, address)) {
+            std::ostringstream message;
+            message << "Generated indirect dispatch profile '" << table->profileName
+                    << "' omits translated winner 0x" << std::hex << address;
+            return message.str();
+        }
+    }
+    return {};
+}
+}
+
+void RegisterStaticIndirectDispatchTable(const StaticIndirectDispatchTable* table) {
+    std::lock_guard<std::mutex> lock(RegistryMutex());
+    if (RegistryFrozen().load(std::memory_order_acquire)) {
+        RT_LOG(RT_TAG_RUNTIME) << "ERROR: Generated indirect dispatch table registered after finalization" << std::endl;
+        ShowRuntimeFatalPopup("translated dispatch initialization failed",
+                              "A generated indirect-dispatch table was registered after the function registry was finalized.");
+        std::abort();
+    }
+    auto*& registered = GeneratedIndirectDispatchTable();
+    if (registered && registered != table) {
+        RT_LOG(RT_TAG_RUNTIME) << "ERROR: Multiple generated indirect dispatch profiles were linked" << std::endl;
+        ShowRuntimeFatalPopup("translated dispatch initialization failed",
+                              "Multiple generated indirect-dispatch profiles were linked into the same product.");
+        std::abort();
+    }
+    registered = table;
+    // Mirror into the header-visible atomic under the same lock, so the
+    // inlined miss path and this owning static can never disagree.
+    g_publishedStaticIndirectDispatchTable.store(table, std::memory_order_release);
+}
+
+void RegisterBulkTranslatedFunctions(const BulkTranslatedFunctionRecord* records, size_t count) {
+    for (size_t i = 0; i < count; ++i) {
+        const auto& record = records[i];
+        TranslatedFunctionInfo info;
+        info.address = record.address;
+        info.name = record.name ? record.name : "";
+        info.moduleId = record.moduleId;
+        info.priority = record.priority;
+        info.nonvolatileFprWriteMask = record.preservesNonvolatileFprs
+            ? 0u
+            : (record.nonvolatileFprWriteMask & kPpcAllNonvolatileFprMask);
+        info.entryPoint = reinterpret_cast<void*>(record.entry);
+        info.rawCpuInvoker = record.entry;
+        info.mustRemainDynamicallyDispatchable = record.mustRemainDynamicallyDispatchable;
+        info.kind = record.kind;
+        TranslatedFunctionRegistry::Register(std::move(info));
+    }
+}
+
+void TranslatedFunctionRegistry::Register(TranslatedFunctionInfo info) {
+    std::lock_guard<std::mutex> lock(RegistryMutex());
+    if (RegistryFrozen().load(std::memory_order_acquire)) {
+        RT_LOG(RT_TAG_RUNTIME) << "ERROR: Attempted to register function after registry was finalized: 0x"
+                  << std::hex << info.address << " '" << info.name << "'" << std::dec << std::endl;
+        ShowRuntimeFatalPopup("translated function registration failed",
+                              "A translated function was registered after guest execution had already been finalized.");
+        std::abort();
+    }
+    info.priority = EffectivePriority(info);
+
+    auto& entries = Registry();
+    auto& addrIndex = AddressIndex();
+    auto& addressEntries = AddressEntries();
+
+    auto sameAddressIt = addressEntries.find(info.address);
+    if (sameAddressIt != addressEntries.end()) {
+        for (const size_t existingIndex : sameAddressIt->second) {
+            const auto& existing = entries[existingIndex];
+            if (IsSameRegistration(existing, info)) {
+                RT_LOG(RT_TAG_RUNTIME) << "Duplicate " << KindLabel(info.kind) << " registration for " << info.name << " (0x"
+                          << std::hex << info.address << ") ignored" << std::dec << std::endl;
+                return;
+            }
+        }
+    }
+
+    entries.push_back(std::move(info));
+    const size_t index = entries.size() - 1;
+    addressEntries[entries[index].address].push_back(index);
+    auto bestAddressIt = addrIndex.find(entries[index].address);
+    if (bestAddressIt == addrIndex.end() || IsBetterCandidate(entries[index], entries[bestAddressIt->second])) {
+        if (bestAddressIt != addrIndex.end()) {
+            // Expected on every mod entry - a Retro Rewind boot has thousands.
+            // Counted here and reported once by Finalize instead of per address.
+            ++PriorityOverrideCount();
+        }
+        addrIndex[entries[index].address] = index;
+    }
+    if (entries[index].entryPoint) {
+        HostIndex().push_back({reinterpret_cast<uintptr_t>(entries[index].entryPoint), index});
+    }
+}
+
+void TranslatedFunctionRegistry::Finalize() {
+    if (const size_t overrides = PriorityOverrideCount(); overrides != 0) {
+        RT_LOG(RT_TAG_RUNTIME) << overrides
+                  << " registration(s) took over an address by priority" << std::endl;
+    }
+    std::string validationError;
+    {
+        std::lock_guard<std::mutex> lock(RegistryMutex());
+        // Publication is one-way: cached pointers into the rebuilt vectors
+        // remain valid for the lifetime of the process.
+        if (RegistryFrozen().load(std::memory_order_acquire)) {
+            return;
+        }
+        RebuildIndicesLocked();
+        validationError = ValidateGeneratedIndirectDispatchLocked();
+        if (validationError.empty()) {
+            // Duplicate-registration tracking is initialization-only. AddressIndex
+            // owns every published winner after this point, and Register rejects
+            // later writes, so release the per-address candidate vectors before
+            // the game starts.
+            auto& addressEntries = AddressEntries();
+            addressEntries.clear();
+            addressEntries.rehash(0);
+            RegistryFrozen().store(true, std::memory_order_release);
+            lookupPublished_.store(true, std::memory_order_release);
+        }
+    }
+    if (!validationError.empty()) {
+        throw std::runtime_error("[" RT_TAG_RUNTIME "] " + validationError);
+    }
+}
+
+const TranslatedFunctionInfo* TranslatedFunctionRegistry::FindByAddressPtrSlow(uint32_t address) {
+    if (RegistryFrozen().load(std::memory_order_acquire)) {
+        const auto it = AddressIndex().find(address);
+        return it != AddressIndex().end() ? &Registry()[it->second] : nullptr;
+    }
+
+    std::lock_guard<std::mutex> lock(RegistryMutex());
+    auto it = AddressIndex().find(address);
+    if (it != AddressIndex().end()) {
+        return &Registry()[it->second];
+    }
+    for (auto& entry : Registry()) {
+        if (entry.address == address) {
+            return &entry;
+        }
+    }
+    return nullptr;
+}
+
+const RawDispatchRecord* TranslatedFunctionRegistry::FindRawByAddressPtrSlow(uint32_t address) {
+    if (!RegistryFrozen().load(std::memory_order_acquire)) {
+        return nullptr;
+    }
+    if (const auto* generated = FindStaticIndirectDispatchEntry(GeneratedIndirectDispatchTable(), address)) {
+        return generated;
+    }
+    const auto& entries = DynamicRawDispatchEntries();
+    const auto it = std::lower_bound(entries.begin(), entries.end(), address,
+        [](const RawDispatchRecord& entry, uint32_t target) {
+            return entry.address < target;
+        });
+    return it != entries.end() && it->address == address ? &*it : nullptr;
+}
+
+std::optional<TranslatedFunctionInfo> TranslatedFunctionRegistry::FindByHostAddress(uintptr_t hostAddr) {
+    const bool frozen = RegistryFrozen().load(std::memory_order_acquire);
+    if (!frozen) {
+        std::lock_guard<std::mutex> lock(RegistryMutex());
+        RebuildIndicesLocked();
+    }
+
+    const auto& entries = Registry();
+    const auto& sorted = HostIndex();
+    if (sorted.empty()) {
+        return std::nullopt;
+    }
+
+    auto it = std::upper_bound(sorted.begin(), sorted.end(), hostAddr,
+                               [](uintptr_t addr, const HostEntryRef& ref) { return addr < ref.addr; });
+
+    if (it == sorted.begin()) {
+        return std::nullopt;
+    }
+    --it;
+
+    uintptr_t funcStart = it->addr;
+    uintptr_t funcEnd;
+    auto nextIt = it + 1;
+    if (nextIt != sorted.end()) {
+        funcEnd = nextIt->addr;
+    } else {
+        funcEnd = funcStart + 256 * 1024;
+    }
+
+    if (hostAddr >= funcStart && hostAddr < funcEnd) {
+        return entries[it->index];
+    }
+    return std::nullopt;
+}
+
+std::optional<TranslatedFunctionInfo> TranslatedFunctionRegistry::FindNearestByAddress(uint32_t address) {
+    std::optional<TranslatedFunctionInfo> best;
+    uint32_t bestDelta = UINT32_MAX;
+    const auto scan = [&] {
+        for (const auto& info : Registry()) {
+            if (address < info.address) {
+                continue;
+            }
+            const uint32_t delta = address - info.address;
+            if (delta < bestDelta) {
+                bestDelta = delta;
+                best = info;
+            }
+        }
+    };
+    if (RegistryFrozen().load(std::memory_order_acquire)) {
+        scan();
+    } else {
+        std::lock_guard<std::mutex> lock(RegistryMutex());
+        scan();
+    }
+    return best;
+}
+
+namespace {
+CpuContext g_persistentCpu{};
+}
+
+CpuContext& GetPersistentCpuContext() {
+    return g_persistentCpu;
+}
+
+void InitializePersistentCpuContext() {
+    // Idempotent by contract: generated mod code calls this again before each of
+    // its initializers, after the boot path has already established r1 and live
+    // guest state in the persistent context. Never clear the context here; only
+    // seed the PowerPC ABI environmental registers if no one has yet:
+    // r2 = _SDA2_BASE_ (read-only small data), r13 = _SDA_BASE_.
+    if (g_persistentCpu.gpr[2] == 0) {
+        g_persistentCpu.gpr[2] = RuntimeConfig::SDA2_BASE;
+    }
+    if (g_persistentCpu.gpr[13] == 0) {
+        g_persistentCpu.gpr[13] = RuntimeConfig::SDA1_BASE;
+    }
+}
diff --git a/runtime/src/audio_backend.cpp b/runtime/src/audio_backend.cpp
new file mode 100644
index 0000000..7ceda4c
--- /dev/null
+++ b/runtime/src/audio_backend.cpp
@@ -0,0 +1,203 @@
+#include "audio_backend.h"
+
+#include "runtime_log.h"
+
+#include <algorithm>
+#include <cstdint>
+#include <cstdlib>
+#include <iostream>
+
+#include <SDL3/SDL_init.h>
+
+AudioBackend& AudioBackend::Instance() {
+    static AudioBackend instance;
+    return instance;
+}
+
+float AudioBackend::EffectiveGainLocked() const {
+    return m_muted ? 0.0f : m_masterVolume;
+}
+
+void AudioBackend::ApplyGainLocked() {
+    if (m_stream && !SDL_SetAudioStreamGain(m_stream, EffectiveGainLocked())) {
+        RT_LOG(RT_TAG_AUDIO) << "SDL_SetAudioStreamGain failed: " << SDL_GetError() << std::endl;
+    }
+}
+
+void AudioBackend::SetMasterVolume(float volume) {
+    std::lock_guard<std::mutex> lock(m_mutex);
+    m_masterVolume = std::clamp(volume, 0.0f, 1.0f);
+    ApplyGainLocked();
+}
+
+void AudioBackend::SetMuted(bool muted) {
+    std::lock_guard<std::mutex> lock(m_mutex);
+    m_muted = muted;
+    ApplyGainLocked();
+}
+
+bool AudioBackend::EnsureInitializedLocked(uint32_t sampleRate, uint32_t channels) {
+    if (m_initialized && m_sampleRate == sampleRate && m_channels == channels) {
+        return true;
+    }
+
+    if (m_stream) {
+        SDL_DestroyAudioStream(m_stream);
+        m_stream = nullptr;
+    }
+
+    if (!SDL_InitSubSystem(SDL_INIT_AUDIO)) {
+        RT_LOG(RT_TAG_AUDIO) << "SDL_InitSubSystem(SDL_INIT_AUDIO) failed: " << SDL_GetError() << std::endl;
+        return false;
+    }
+
+    SDL_AudioSpec spec{};
+    spec.format = SDL_AUDIO_S16LE;
+    spec.channels = static_cast<int>(channels);
+    spec.freq = static_cast<int>(sampleRate);
+
+    SDL_AudioStream* stream = SDL_OpenAudioDeviceStream(SDL_AUDIO_DEVICE_DEFAULT_PLAYBACK, &spec, nullptr, nullptr);
+    if (!stream) {
+        RT_LOG(RT_TAG_AUDIO) << "SDL_OpenAudioDeviceStream failed: " << SDL_GetError() << std::endl;
+        return false;
+    }
+
+    if (!SDL_ResumeAudioStreamDevice(stream)) {
+        RT_LOG(RT_TAG_AUDIO) << "SDL_ResumeAudioStreamDevice failed: " << SDL_GetError() << std::endl;
+        SDL_DestroyAudioStream(stream);
+        return false;
+    }
+
+    if (!SDL_SetAudioStreamGain(stream, EffectiveGainLocked())) {
+        RT_LOG(RT_TAG_AUDIO) << "SDL_SetAudioStreamGain failed: " << SDL_GetError() << std::endl;
+        SDL_DestroyAudioStream(stream);
+        return false;
+    }
+
+    m_stream = stream;
+    m_spec = spec;
+    m_sampleRate = sampleRate;
+    m_channels = channels;
+    m_initialized = true;
+    return true;
+}
+
+bool AudioBackend::Init(uint32_t sampleRate, uint32_t channels) {
+    std::lock_guard<std::mutex> lock(m_mutex);
+    return EnsureInitializedLocked(sampleRate, channels);
+}
+
+void AudioBackend::Shutdown() {
+    std::lock_guard<std::mutex> lock(m_mutex);
+    if (m_stream) {
+        SDL_DestroyAudioStream(m_stream);
+        m_stream = nullptr;
+    }
+    if (m_initialized) {
+        SDL_QuitSubSystem(SDL_INIT_AUDIO);
+    }
+    m_initialized = false;
+    m_sampleRate = 0;
+    m_channels = 0;
+    m_reportedDroppedBlock = false;
+    m_convertBuffer.clear();
+}
+
+uint32_t AudioBackend::QueueLimitBytesLocked() const {
+    constexpr uint32_t queueMs = 120;
+
+    const uint64_t bytesPerSecond = static_cast<uint64_t>(m_spec.freq) *
+                                    static_cast<uint64_t>(m_spec.channels) *
+                                    sizeof(int16_t);
+    return static_cast<uint32_t>((bytesPerSecond * queueMs) / 1000u);
+}
+
+bool AudioBackend::QueueHasCapacityLocked(int incomingBytes) {
+    if (!m_stream) {
+        return false;
+    }
+    const int queued = SDL_GetAudioStreamQueued(m_stream);
+    if (queued < 0) {
+        return true;
+    }
+    const uint32_t maxQueued = QueueLimitBytesLocked();
+    if (static_cast<uint64_t>(queued) + static_cast<uint64_t>(std::max(incomingBytes, 0)) > maxQueued) {
+        // Match Dolphin's FIFO overflow behavior: preserve the continuous audio
+        // already queued and discard the new block.  Clearing SDL's entire
+        // stream creates an audible discontinuity (the severe crackle seen when
+        // VI-batched DMA briefly outran playback).
+        // A drop is audible; report the first one so it is not invisible.
+        if (!m_reportedDroppedBlock) {
+            m_reportedDroppedBlock = true;
+            RT_LOG(RT_TAG_AUDIO) << "output queue full (" << queued << "/" << maxQueued
+                      << " bytes); dropping blocks to preserve continuity" << std::endl;
+        }
+        return false;
+    }
+    return true;
+}
+
+bool AudioBackend::PushWiiAiSamplesBE16(const uint8_t* data, size_t bytes) {
+    if (!data || bytes == 0) {
+        return false;
+    }
+
+    std::lock_guard<std::mutex> lock(m_mutex);
+    if (!m_initialized || !m_stream) {
+        return false;
+    }
+
+    const size_t sampleCount = bytes / sizeof(int16_t);
+    if (sampleCount == 0) {
+        return false;
+    }
+
+    if (m_convertBuffer.size() < sampleCount) {
+        m_convertBuffer.resize(sampleCount);
+    }
+
+    const size_t frameCount = sampleCount / 2;
+    for (size_t frame = 0; frame < frameCount; ++frame) {
+        const size_t rightOffset = frame * 4;
+        const size_t leftOffset = rightOffset + 2;
+        const uint16_t right = static_cast<uint16_t>(data[rightOffset]) << 8 |
+                               static_cast<uint16_t>(data[rightOffset + 1]);
+        const uint16_t left = static_cast<uint16_t>(data[leftOffset]) << 8 |
+                              static_cast<uint16_t>(data[leftOffset + 1]);
+        m_convertBuffer[frame * 2] = static_cast<int16_t>(left);
+        m_convertBuffer[frame * 2 + 1] = static_cast<int16_t>(right);
+    }
+
+    const int lenBytes = static_cast<int>(frameCount * 2 * sizeof(int16_t));
+    if (!QueueHasCapacityLocked(lenBytes)) {
+        return true;
+    }
+    if (!SDL_PutAudioStreamData(m_stream, m_convertBuffer.data(), lenBytes)) {
+        RT_LOG(RT_TAG_AUDIO) << "SDL_PutAudioStreamData failed: " << SDL_GetError() << std::endl;
+        return false;
+    }
+
+    return true;
+}
+
+bool AudioBackend::PushSamplesLE16(const int16_t* samples, size_t sampleCount) {
+    if (!samples || sampleCount == 0) {
+        return false;
+    }
+
+    std::lock_guard<std::mutex> lock(m_mutex);
+    if (!m_initialized || !m_stream) {
+        return false;
+    }
+
+    const int lenBytes = static_cast<int>(sampleCount * sizeof(int16_t));
+    if (!QueueHasCapacityLocked(lenBytes)) {
+        return true;
+    }
+    if (!SDL_PutAudioStreamData(m_stream, samples, lenBytes)) {
+        RT_LOG(RT_TAG_AUDIO) << "SDL_PutAudioStreamData failed: " << SDL_GetError() << std::endl;
+        return false;
+    }
+
+    return true;
+}
diff --git a/runtime/src/dynamic_aspect.cpp b/runtime/src/dynamic_aspect.cpp
new file mode 100644
index 0000000..5c1601c
--- /dev/null
+++ b/runtime/src/dynamic_aspect.cpp
@@ -0,0 +1,191 @@
+#include "hle_stubs.h"
+#include "memory.h"
+
+#include <algorithm>
+#include "aurora_events.h"
+#include "hle/gx/gx_dynamic_aspect.h"
+
+#include <dolphin/vi.h>
+
+// Advanced by GXCopyDisp (gx_copy.cpp), defined in gx_utils.cpp. Declared here
+// rather than via gx_internal.h, which is private to the GX HLE sources.
+extern "C" int g_gxFrameCount;
+
+namespace {
+
+bool g_widescreenConfigured = false;
+uint32_t g_lastEggWidth43 = 0;
+uint32_t g_lastEggWidth169 = 0;
+
+// EGG::Screen's static canvas records (PAL). See gx_dynamic_aspect.h for the
+// record layout and the anamorphic presentation model.
+constexpr uint32_t kEggScreenRecord43 = 0x802A3EE8u;
+constexpr uint32_t kEggScreenRecord169 = 0x802A3EF4u;
+constexpr uint32_t kEggActiveScreenPtr = 0x80386F14u;
+
+constexpr uint32_t kEggScreenProjScaleX = 0x80386F20u;
+constexpr uint32_t kEggScreenProjScaleY = 0x80386F24u;
+
+constexpr uint32_t kEggScreenAspectHandler = 0x8023E53Cu;
+
+constexpr uint32_t kMkwUpdateAllScreens = 0x805653D0u;
+constexpr uint32_t kMkwGfxDrawList = 0x809C1830u;
+constexpr uint32_t kSystemManagerInstance = 0x80386000u;
+
+// The draw list is an nw4r::ut::List: +0x00 head, +0x04 tail, +0x08 u16 count,
+// +0x0A u16 link offset, with next = *(node + linkOffset + 4) (List_GetNext,
+// 0x800AF180).
+constexpr uint32_t kMkwGfxDrawListLinkOffset = 0x0Au;
+
+constexpr uint32_t kMkwGfxOffscreenList = 0x809C183Cu;
+constexpr uint32_t kMkwGfxOffscreenNodeScreenSlot = 0x10u;
+constexpr uint32_t kEggScreenVTableOffset = 0x38u;
+constexpr uint32_t kEggScreenVTable = 0x802A3F0Cu;
+constexpr uint32_t kMkwScreenVTable = 0x808B4C20u;
+constexpr uint32_t kEggScreenFlagsOffset = 0x34u;
+constexpr uint16_t kEggScreenFlagFramebufferCanvas = 0x0008u;
+constexpr uint16_t kEggScreenFlagKeepFrustumScale = 0x0040u;
+constexpr uint32_t kMkwGfxNodeScreenSlots[] = {0x10u, 0x28u, 0x2Cu};
+
+bool IsEggScreen(uint32_t address) {
+    if (address == 0 || (address & 3u) != 0 || !Memory::Contains(address, 0x40u)) {
+        return false;
+    }
+    const uint32_t vtable = Memory::Read32(address + kEggScreenVTableOffset);
+    return vtable == kMkwScreenVTable || vtable == kEggScreenVTable;
+}
+
+void KeepFrustumScale(uint32_t screen) {
+    if (!IsEggScreen(screen)) {
+        return;
+    }
+    const uint16_t flags = Memory::Read16(screen + kEggScreenFlagsOffset);
+    if ((flags & kEggScreenFlagKeepFrustumScale) != 0) {
+        return;
+    }
+    Memory::Write16(screen + kEggScreenFlagsOffset,
+                    static_cast<uint16_t>(flags | kEggScreenFlagKeepFrustumScale));
+}
+
+void KeepFrustumScaleOnFramebufferCanvasScreen(uint32_t screen) {
+    if (!IsEggScreen(screen) ||
+        (Memory::Read16(screen + kEggScreenFlagsOffset) &
+         kEggScreenFlagFramebufferCanvas) == 0) {
+        return;
+    }
+    KeepFrustumScale(screen);
+}
+
+// Walk one gfx-node list. On the on-screen list only screens that have already
+// declared themselves framebuffer-canvas (bit 3) may be bypassed. On the
+// offscreen list every screen is offscreen by construction, so no predicate is
+// needed - and none would work anyway, because bit 3 is only set inside the
+// bake itself.
+void SweepGfxNodeList(uint32_t list, bool offscreenList) {
+    if (!Memory::Contains(list, 0x0Cu)) {
+        return;
+    }
+    const uint32_t linkOffset = Memory::Read16(list + kMkwGfxDrawListLinkOffset);
+    // The on-screen walk also reads the menu node's parked-screen slots at
+    // +0x28/+0x2C, which sit past the link words on small nodes.
+    const uint32_t nodeSpan =
+        std::max(linkOffset + 8u, offscreenList ? 0u : kMkwGfxNodeScreenSlots[2] + 4u);
+    uint32_t node = Memory::Read32(list);
+    for (int guard = 0; node != 0 && guard < 64; ++guard) {
+        if (!Memory::Contains(node, nodeSpan)) {
+            break;
+        }
+        if (offscreenList) {
+            KeepFrustumScale(Memory::Read32(node + kMkwGfxOffscreenNodeScreenSlot));
+        } else {
+            for (const uint32_t slot : kMkwGfxNodeScreenSlots) {
+                KeepFrustumScaleOnFramebufferCanvasScreen(Memory::Read32(node + slot));
+            }
+        }
+        node = Memory::Read32(node + linkOffset + 4u);
+    }
+}
+
+// Vertical expansion rides EGG::Screen's global scale, which any screen without bit 6 imports
+// at projection-build time. MKW's offscreen passes only set bit 3 (fixed-size framebuffer canvas,
+// record 2), so without this bypass they'd inherit the expansion and render vertically squashed.
+// Re-arms every scene transition since the offscreen renderer is a per-scene singleton.
+void AssertOffscreenScreenBypass() {
+    SweepGfxNodeList(kMkwGfxDrawList, /*offscreenList=*/false);
+    SweepGfxNodeList(kMkwGfxOffscreenList, /*offscreenList=*/true);
+}
+
+void WriteEggScreenRecord(uint32_t recordAddr, uint32_t width) {
+    Memory::Write16(recordAddr, static_cast<uint16_t>(width));
+    Memory::Write16(recordAddr + 0x02u,
+                    static_cast<uint16_t>(MkwDynamicAspect::kEggScreenHeight));
+    Memory::WriteFloat32(recordAddr + 0x04u, MkwDynamicAspect::EggHorizontalScale(width));
+    Memory::WriteFloat32(recordAddr + 0x08u, 1.0f);
+}
+
+void ApplyEggScreenRecords(uint32_t surfaceWidth, uint32_t surfaceHeight) {
+    using namespace MkwDynamicAspect;
+    const uint32_t width43 =
+        g_widescreenConfigured ? EggRecordWidth(kEggRecordWidth43, surfaceWidth, surfaceHeight)
+                               : kEggRecordWidth43;
+    const uint32_t width169 =
+        g_widescreenConfigured ? EggRecordWidth(kEggRecordWidth169, surfaceWidth, surfaceHeight)
+                               : kEggRecordWidth169;
+    WriteEggScreenRecord(kEggScreenRecord43, width43);
+    WriteEggScreenRecord(kEggScreenRecord169, width169);
+    Memory::WriteFloat32(kEggScreenProjScaleX, 1.0f);
+    Memory::WriteFloat32(kEggScreenProjScaleY,
+                         g_widescreenConfigured
+                             ? VerticalExpansion(surfaceWidth, surfaceHeight)
+                             : 1.0f);
+    AssertOffscreenScreenBypass();
+    if (width43 == g_lastEggWidth43 && width169 == g_lastEggWidth169) {
+        return;
+    }
+    g_lastEggWidth43 = width43;
+    g_lastEggWidth169 = width169;
+    CpuContext callbackCpu = GetPersistentCpuContext();
+    if (Memory::Read32(kSystemManagerInstance) != 0 && Memory::Read32(kMkwGfxDrawList) != 0) {
+        InvokeIndirectCpu(kMkwUpdateAllScreens, &callbackCpu);
+        return;
+    }
+    if (Memory::Read32(kEggActiveScreenPtr) != 0) {
+        InvokeIndirectCpu(kEggScreenAspectHandler, &callbackCpu);
+    }
+}
+
+} // namespace
+
+
+void AssertMkwOffscreenScreenBypass() {
+    static int lastSweptFrame = -1;
+    if (lastSweptFrame == g_gxFrameCount) {
+        return;
+    }
+    lastSweptFrame = g_gxFrameCount;
+    AssertOffscreenScreenBypass();
+}
+
+void UpdateMkwDynamicAspectSurface(uint32_t surfaceWidth, uint32_t surfaceHeight) {
+    if (!g_widescreenConfigured || surfaceWidth == 0 || surfaceHeight == 0) {
+        return;
+    }
+    AuroraSetViewportPolicy(AURORA_VIEWPORT_STRETCH);
+    ApplyEggScreenRecords(surfaceWidth, surfaceHeight);
+}
+
+void ConfigureMkwDynamicAspect(bool widescreen, uint32_t surfaceWidth, uint32_t surfaceHeight) {
+    g_widescreenConfigured = widescreen;
+    g_dynamicAspectRatioEnabled = widescreen;
+    g_lastEggWidth43 = 0;
+    g_lastEggWidth169 = 0;
+    if (widescreen) {
+        VIUnlockAspectRatio();
+        ApplyEggScreenRecords(surfaceWidth, surfaceHeight);
+        return;
+    }
+
+    AuroraSetViewportPolicy(AURORA_VIEWPORT_FIT);
+    VILockAspectRatio(4, 3);
+    ApplyEggScreenRecords(surfaceWidth, surfaceHeight);
+}
diff --git a/runtime/src/fiber_manager.cpp b/runtime/src/fiber_manager.cpp
new file mode 100644
index 0000000..a19731c
--- /dev/null
+++ b/runtime/src/fiber_manager.cpp
@@ -0,0 +1,701 @@
+#include "fiber_manager.h"
+#include "memory.h"
+#include "abi_bridge.h"
+#include "hle_stubs.h"
+#include "runtime_log.h"
+
+// Defined in hle/os/os_sleep.cpp; the sleep-timer table is file-local there.
+
+#include <algorithm>
+#include <chrono>
+#include <cstdlib>
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+namespace Fiber {
+
+std::mutex GuestFiberManager::s_mutex;
+std::unordered_map<uint32_t, GuestFiber> GuestFiberManager::s_fibers;
+std::vector<void*> GuestFiberManager::s_fibersPendingDelete;
+void* GuestFiberManager::s_schedulerFiber = nullptr;
+uint32_t GuestFiberManager::s_currentGuestThread = 0;
+bool GuestFiberManager::s_initialized = false;
+thread_local CpuContext* GuestFiberManager::s_cpuContext = nullptr;
+
+void GuestFiberManager::PurgePendingFibers() {
+#if defined(_WIN32)
+    std::vector<void*> toDelete;
+    {
+        std::lock_guard<std::mutex> lock(s_mutex);
+        toDelete.swap(s_fibersPendingDelete);
+    }
+    const void* current = GetCurrentFiber();
+    for (void* f : toDelete) {
+        if (f && f != current) {
+            DeleteFiber(f);
+        }
+    }
+#endif
+}
+
+// Global VI retrace counter
+std::atomic<uint32_t> g_viRetracePendingCount{0};
+
+// =============================================================================
+// Guest OS memory layout constants
+// =============================================================================
+namespace {
+constexpr uint32_t kOSCurrentContextAddr = 0x800000d4u;
+constexpr uint32_t kOSRunningContextAddr = 0x800000e4u;  // OSGetCurrentThread reads this
+constexpr uint32_t kThreadQueueArrayAddr = 0x803477b0u;
+constexpr uint32_t kSchedulerPendingFlagAddr = 0x80386920u;
+constexpr uint32_t kSchedulerReschedCounterAddr = 0x8038691cu;
+constexpr uint32_t kSchedulerIdleFlagAddr = 0x80386918u;
+
+// OSThread structure offsets
+constexpr uint32_t kThreadStateOffset = 0x2C8u;
+constexpr uint32_t kThreadAttrOffset = 0x2CAu;
+constexpr uint32_t kThreadSuspendOffset = 0x2CCu;
+constexpr uint32_t kThreadPriorityOffset = 0x2D0u;
+constexpr uint32_t kThreadExitValueOffset = 0x2D8u;
+constexpr uint32_t kThreadNextOffset = 0x2E0u;
+constexpr uint32_t kThreadPrevOffset = 0x2E4u;
+constexpr uint32_t kThreadQueueOffset = 0x2DCu;
+constexpr uint32_t kThreadJoinQueueOffset = 0x2E8u;
+
+// OSContext offsets (for saving/loading fiber context)
+constexpr uint32_t kCtxGprOffset = 0x00u;
+constexpr uint32_t kCtxCrOffset = 0x80u;
+constexpr uint32_t kCtxLrOffset = 0x84u;
+constexpr uint32_t kCtxCtrOffset = 0x88u;
+constexpr uint32_t kCtxXerOffset = 0x8Cu;
+constexpr uint32_t kCtxSrr0Offset = 0x198u;
+constexpr uint32_t kCtxSrr1Offset = 0x19Cu;
+constexpr uint32_t kCtxGqrOffset = 0x1A8u;
+
+void ClearPendingMaskForEmptyGuestQueue(uint32_t queueEntry)
+{
+    if (queueEntry < kThreadQueueArrayAddr ||
+        ((queueEntry - kThreadQueueArrayAddr) % 8u) != 0) {
+        return;
+    }
+
+    const uint32_t priority = (queueEntry - kThreadQueueArrayAddr) / 8u;
+    if (priority >= 32 || Memory::Read32(queueEntry) != 0) {
+        return;
+    }
+
+    const uint32_t pending = Memory::Read32(kSchedulerPendingFlagAddr);
+    Memory::Write32(kSchedulerPendingFlagAddr, pending & ~(1u << (31u - priority)));
+}
+
+void RemoveGuestThreadFromQueue(uint32_t threadPtr)
+{
+    const uint32_t queuePtr = Memory::Read32(threadPtr + kThreadQueueOffset);
+    if (queuePtr == 0) {
+        return;
+    }
+
+    const uint32_t next = Memory::Read32(threadPtr + kThreadNextOffset);
+    const uint32_t prev = Memory::Read32(threadPtr + kThreadPrevOffset);
+
+    if (next != 0) {
+        Memory::Write32(next + kThreadPrevOffset, prev);
+    } else {
+        Memory::Write32(queuePtr + 4u, prev);
+    }
+
+    if (prev != 0) {
+        Memory::Write32(prev + kThreadNextOffset, next);
+    } else {
+        Memory::Write32(queuePtr, next);
+    }
+
+    Memory::Write32(threadPtr + kThreadQueueOffset, 0);
+    Memory::Write32(threadPtr + kThreadNextOffset, 0);
+    Memory::Write32(threadPtr + kThreadPrevOffset, 0);
+    ClearPendingMaskForEmptyGuestQueue(queuePtr);
+}
+
+void WakeGuestThreadsOnQueueNoSwitch(uint32_t queueAddr)
+{
+    constexpr int kMaxWake = 256;
+
+    for (int woke = 0; woke < kMaxWake; ++woke) {
+        const uint32_t thread = Memory::Read32(queueAddr);
+        if (thread == 0) {
+            return;
+        }
+
+        const uint32_t next = Memory::Read32(thread + kThreadNextOffset);
+        if (next == 0) {
+            Memory::Write32(queueAddr + 4u, 0);
+        } else {
+            Memory::Write32(next + kThreadPrevOffset, 0);
+        }
+        Memory::Write32(queueAddr, next);
+        Memory::Write32(thread + kThreadNextOffset, 0);
+        Memory::Write32(thread + kThreadPrevOffset, 0);
+
+        const uint16_t state = Memory::Read16(thread + kThreadStateOffset);
+        if (state == 0 || state == 8) {
+            Memory::Write32(thread + kThreadQueueOffset, 0);
+            continue;
+        }
+
+        Memory::Write16(thread + kThreadStateOffset, 1);
+        const int32_t suspend = static_cast<int32_t>(Memory::Read32(thread + kThreadSuspendOffset));
+        if (suspend >= 1) {
+            Memory::Write32(thread + kThreadQueueOffset, 0);
+            continue;
+        }
+
+        int32_t priority = static_cast<int32_t>(Memory::Read32(thread + kThreadPriorityOffset));
+        priority = std::clamp(priority, 0, 31);
+
+        const uint32_t runQueue = kThreadQueueArrayAddr + static_cast<uint32_t>(priority) * 8u;
+        const uint32_t tail = Memory::Read32(runQueue + 4u);
+        if (tail == 0) {
+            Memory::Write32(runQueue, thread);
+        } else {
+            Memory::Write32(tail + kThreadNextOffset, thread);
+        }
+        Memory::Write32(thread + kThreadPrevOffset, tail);
+        Memory::Write32(thread + kThreadNextOffset, 0);
+        Memory::Write32(runQueue + 4u, thread);
+        Memory::Write32(thread + kThreadQueueOffset, runQueue);
+
+        const uint32_t pending = Memory::Read32(kSchedulerPendingFlagAddr);
+        Memory::Write32(kSchedulerPendingFlagAddr, pending | (1u << (31u - static_cast<uint32_t>(priority))));
+        Memory::Write32(kSchedulerReschedCounterAddr, 1);
+
+        GuestFiberManager::ResumeGuestThread(thread);
+    }
+
+    RT_LOG(RT_TAG_OS) << "WakeGuestThreadsOnQueueNoSwitch: hit safety limit at 0x"
+              << std::hex << queueAddr << std::dec << std::endl;
+}
+} // namespace
+
+// =============================================================================
+// GuestFiberManager Implementation
+// =============================================================================
+
+void GuestFiberManager::Initialize() {
+    std::lock_guard<std::mutex> lock(s_mutex);
+    
+    if (s_initialized) {
+        return;
+    }
+    
+#if defined(_WIN32)
+    // Convert the main thread to a fiber (the scheduler fiber)
+    s_schedulerFiber = ConvertThreadToFiber(nullptr);
+    if (!s_schedulerFiber) {
+        // May already be a fiber
+        s_schedulerFiber = GetCurrentFiber();
+        if (!s_schedulerFiber) {
+            RT_LOG(RT_TAG_OS) << "FATAL: Failed to initialize scheduler fiber!" << std::endl;
+            ShowRuntimeFatalPopup("guest scheduler initialization failed",
+                                  "Windows could not create the scheduler fiber required to run guest threads.");
+            std::abort();
+        }
+    }
+    
+#else
+    RT_LOG(RT_TAG_OS) << "WARNING: Fiber support not available on this platform!" << std::endl;
+    s_schedulerFiber = nullptr;
+#endif
+    
+    s_currentGuestThread = 0;
+    s_initialized = true;
+}
+
+void GuestFiberManager::Shutdown() {
+    std::lock_guard<std::mutex> lock(s_mutex);
+
+#if defined(_WIN32)
+    for (auto& [addr, fiber] : s_fibers) {
+        if (fiber.fiber && !fiber.isSchedulerFiber) {
+            DeleteFiber(fiber.fiber);
+            fiber.fiber = nullptr;
+        }
+    }
+    s_fibers.clear();
+    
+    // Convert scheduler fiber back to thread
+    if (s_schedulerFiber) {
+        ConvertFiberToThread();
+        s_schedulerFiber = nullptr;
+    }
+#endif
+    
+    s_initialized = false;
+}
+
+bool GuestFiberManager::IsInitialized() {
+    return s_initialized;
+}
+
+bool GuestFiberManager::CreateGuestFiber(uint32_t guestThreadAddr, uint32_t entryPoint,
+                                          uint32_t entryArg, uint32_t stackBase) {
+    if (!s_initialized) {
+        RT_LOG(RT_TAG_OS) << "CreateGuestFiber called before initialization!" << std::endl;
+        return false;
+    }
+    
+    std::lock_guard<std::mutex> lock(s_mutex);
+    
+    // Check if fiber already exists for this thread - if so, reset it
+    auto existingIt = s_fibers.find(guestThreadAddr);
+    if (existingIt != s_fibers.end()) {
+#if defined(_WIN32)
+        // Delete the old fiber if it exists and is not the scheduler fiber
+        if (existingIt->second.fiber && !existingIt->second.isSchedulerFiber) {
+            DeleteFiber(existingIt->second.fiber);
+        }
+#endif
+        s_fibers.erase(existingIt);
+    }
+    
+    GuestFiber gf;
+    gf.entryPoint = entryPoint;
+    gf.entryArg = entryArg;
+    gf.state = ThreadState::WAITING; // Starts suspended
+    gf.terminated = false;
+    gf.isSchedulerFiber = false;
+    
+    // Initialize CPU context with entry point info
+    std::memset(&gf.cpuContext, 0, sizeof(CpuContext));
+    gf.cpuContext.gpr[1] = stackBase; // Stack pointer
+    gf.cpuContext.gpr[3] = entryArg;  // First argument
+    gf.cpuContext.lr = 0;             // No return address
+    gf.cpuContext.pc = entryPoint;
+    gf.cpuContext.srr0 = entryPoint;
+    
+#if defined(_WIN32)
+    // Create Windows fiber with reasonable stack size
+    // Use host stack size (64KB should be plenty for translated code)
+    constexpr size_t kHostStackSize = 64 * 1024;
+    gf.fiber = CreateFiber(kHostStackSize, FiberProc, reinterpret_cast<void*>(static_cast<uintptr_t>(guestThreadAddr)));
+    
+    if (!gf.fiber) {
+        DWORD err = GetLastError();
+        RT_LOG(RT_TAG_OS) << "CreateFiber failed for thread 0x"
+                  << std::hex << guestThreadAddr 
+                  << " error=" << std::dec << err << std::endl;
+        return false;
+    }
+#else
+    gf.fiber = nullptr;
+#endif
+    
+    s_fibers[guestThreadAddr] = gf;
+    
+    
+    return true;
+}
+
+void GuestFiberManager::ResumeGuestThread(uint32_t guestThreadAddr) {
+    std::lock_guard<std::mutex> lock(s_mutex);
+    auto it = s_fibers.find(guestThreadAddr);
+    if (it == s_fibers.end()) {
+        RT_LOG(RT_TAG_OS) << "ResumeGuestThread: no fiber for 0x"
+                  << std::hex << guestThreadAddr << std::dec << std::endl;
+        return;
+    }
+    
+    if (it->second.terminated) {
+        RT_LOG(RT_TAG_OS) << "ResumeGuestThread: thread 0x"
+                  << std::hex << guestThreadAddr << " already terminated" << std::dec << std::endl;
+        return;
+    }
+    
+    it->second.state = ThreadState::READY;
+
+}
+
+void GuestFiberManager::SuspendGuestThread(uint32_t guestThreadAddr) {
+    std::lock_guard<std::mutex> lock(s_mutex);
+    
+    auto it = s_fibers.find(guestThreadAddr);
+    if (it == s_fibers.end()) {
+        return;
+    }
+    
+    it->second.state = ThreadState::WAITING;
+    
+}
+
+void GuestFiberManager::ExitGuestThread(uint32_t guestThreadAddr, ThreadState finalState) {
+    std::lock_guard<std::mutex> lock(s_mutex);
+    
+    auto it = s_fibers.find(guestThreadAddr);
+    if (it == s_fibers.end()) {
+        return;
+    }
+    
+    it->second.state = finalState;
+    it->second.terminated = true;
+    if (s_currentGuestThread == guestThreadAddr) {
+        s_currentGuestThread = 0;
+    }
+    
+#if defined(_WIN32)
+    if (it->second.fiber && !it->second.isSchedulerFiber) {
+        const void* current = GetCurrentFiber();
+        if (it->second.fiber == current) {
+            s_fibersPendingDelete.push_back(it->second.fiber);
+        } else {
+            DeleteFiber(it->second.fiber);
+        }
+        it->second.fiber = nullptr;
+    }
+#endif
+}
+
+void GuestFiberManager::SwitchToThread(uint32_t guestThreadAddr, CpuContext* cpu) {
+    PurgePendingFibers();
+    if (!s_initialized) {
+        RT_LOG(RT_TAG_OS) << "SwitchToThread called before initialization!" << std::endl;
+        return;
+    }
+    
+    void* fiberHandle = nullptr;
+    uint32_t previousThread = 0;
+    CpuContext callerContext{};
+    const bool haveCallerContext = (cpu != nullptr);
+    CpuContext targetContext{};
+    bool haveTargetContext = false;
+
+    if (cpu) {
+        callerContext = *cpu;
+    }
+    
+    {
+        std::lock_guard<std::mutex> lock(s_mutex);
+        
+        auto it = s_fibers.find(guestThreadAddr);
+        if (it == s_fibers.end()) {
+            RT_LOG(RT_TAG_OS) << "SwitchToThread: no fiber for 0x"
+                      << std::hex << guestThreadAddr << std::dec << std::endl;
+            return;
+        }
+        
+        fiberHandle = it->second.fiber;
+        
+        if (!fiberHandle || it->second.terminated) {
+            RT_LOG(RT_TAG_OS) << "SwitchToThread: invalid fiber for 0x"
+                      << std::hex << guestThreadAddr << std::dec << std::endl;
+            return;
+        }
+        
+        // Remember what thread we're switching from
+        previousThread = s_currentGuestThread;
+        
+        // Save current thread's CPU context if switching from a guest thread
+        if (s_currentGuestThread != 0 && cpu) {
+            auto currentIt = s_fibers.find(s_currentGuestThread);
+            if (currentIt != s_fibers.end()) {
+                currentIt->second.cpuContext = *cpu;
+            }
+        }
+        
+        // Update current thread
+        s_currentGuestThread = guestThreadAddr;
+        it->second.state = ThreadState::RUNNING;
+
+        if (cpu) {
+            targetContext = it->second.cpuContext;
+            haveTargetContext = true;
+        }
+    }
+    
+    // Store CPU context pointer for the target fiber to use
+    s_cpuContext = cpu;
+    
+#if defined(_WIN32)
+    // Check if we're already on the target fiber (e.g., switching to main thread
+    // when we're already on the scheduler fiber)
+    void* currentFiber = GetCurrentFiber();
+    if (currentFiber == fiberHandle) {
+        // Already executing on the target host fiber. This is common for the
+        // default guest thread, which also owns the scheduler fiber. Keep the
+        // live CPU context instead of restoring a possibly stale saved copy
+        // from before the guest thread slept.
+        return;
+    }
+    
+    if (cpu && haveTargetContext) {
+        *cpu = targetContext;
+        // FPSCR travels with the guest-thread context, and its NI bit is
+        // modeled through the per-host-thread MXCSR; every context restore
+        // must re-mirror it.
+        MkwApplyHostNiMode(cpu->fpscr);
+    }
+
+    // Switch to the target fiber (the target fiber will load its own context)
+    SwitchToFiber(fiberHandle);
+    
+    // When we return here, the fiber that issued SwitchToThread has resumed.
+    // That does not automatically mean the previous guest thread became runnable
+    // again; a different thread may simply have yielded back to the scheduler.
+    {
+        std::lock_guard<std::mutex> lock(s_mutex);
+        uint32_t runningContext = 0;
+        uint32_t currentContext = 0;
+        try {
+            runningContext = Memory::Read32(kOSRunningContextAddr);
+            currentContext = Memory::Read32(kOSCurrentContextAddr);
+        } catch (const Memory::AccessViolation&) {
+            runningContext = 0;
+            currentContext = 0;
+        }
+
+        const bool resumedPreviousThread =
+            previousThread != 0 &&
+            runningContext == previousThread &&
+            currentContext == previousThread;
+
+        if (resumedPreviousThread) {
+            auto it = s_fibers.find(previousThread);
+            if (it != s_fibers.end()) {
+                if (cpu) {
+                    *cpu = it->second.cpuContext;
+                    MkwApplyHostNiMode(cpu->fpscr);
+                }
+                it->second.state = ThreadState::RUNNING;
+            }
+            s_currentGuestThread = previousThread;
+        } else {
+            if (cpu && haveCallerContext) {
+                *cpu = callerContext;
+                MkwApplyHostNiMode(cpu->fpscr);
+            }
+            s_currentGuestThread = 0;
+        }
+    }
+#endif
+}
+
+uint32_t GuestFiberManager::GetCurrentGuestThread() {
+    return s_currentGuestThread;
+}
+
+GuestFiber* GuestFiberManager::GetFiber(uint32_t guestThreadAddr) {
+    std::lock_guard<std::mutex> lock(s_mutex);
+    auto it = s_fibers.find(guestThreadAddr);
+    return it != s_fibers.end() ? &it->second : nullptr;
+}
+
+bool GuestFiberManager::HasFiber(uint32_t guestThreadAddr) {
+    std::lock_guard<std::mutex> lock(s_mutex);
+    return s_fibers.count(guestThreadAddr) > 0;
+}
+
+bool GuestFiberManager::IsTerminated(uint32_t guestThreadAddr) {
+    std::lock_guard<std::mutex> lock(s_mutex);
+    auto it = s_fibers.find(guestThreadAddr);
+    return it != s_fibers.end() && it->second.terminated;
+}
+
+bool GuestFiberManager::RegisterMainThreadAsFiber(uint32_t guestThreadAddr, CpuContext* cpu) {
+    if (!s_initialized) {
+        RT_LOG(RT_TAG_OS) << "RegisterMainThreadAsFiber called before initialization!" << std::endl;
+        return false;
+    }
+    
+    std::lock_guard<std::mutex> lock(s_mutex);
+    
+    // Check if already registered
+    if (s_fibers.count(guestThreadAddr)) {
+        return true;
+    }
+    
+    // Register the current host fiber (scheduler fiber) as this guest thread's fiber
+    GuestFiber gf;
+    gf.fiber = s_schedulerFiber;  // The main fiber IS the scheduler fiber
+    gf.entryPoint = 0;
+    gf.entryArg = 0;
+    gf.state = ThreadState::RUNNING;
+    gf.terminated = false;
+    gf.isSchedulerFiber = true;  // This is special - it's both scheduler AND main thread
+    
+    // Copy current CPU context
+    if (cpu) {
+        gf.cpuContext = *cpu;
+    }
+    
+    s_fibers[guestThreadAddr] = gf;
+    s_currentGuestThread = guestThreadAddr;
+    
+    return true;
+}
+
+void GuestFiberManager::ProcessTimerEvents(CpuContext* cpu) {
+    constexpr uint32_t kMaxRetracesPerSlice = 16;
+    const uint32_t pending = g_viRetracePendingCount.exchange(0, std::memory_order_acq_rel);
+    if (pending == 0) {
+        return;
+    }
+
+    const uint32_t retracesToProcess = std::min(pending, kMaxRetracesPerSlice);
+    const uint32_t remaining = pending - retracesToProcess;
+    if (remaining != 0) {
+        g_viRetracePendingCount.fetch_add(remaining, std::memory_order_release);
+    }
+
+    for (uint32_t i = 0; i < retracesToProcess; ++i) {
+        VI_HLE_ForceRetrace(cpu);
+    }
+}
+
+#if defined(_WIN32)
+void CALLBACK GuestFiberManager::FiberProc(void* param)
+#else
+void GuestFiberManager::FiberProc(void* param)
+#endif
+{
+    uint32_t guestThreadAddr = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(param));
+    
+    
+#if defined(_WIN32)
+    // Get our fiber info
+    GuestFiber* fiber = nullptr;
+    uint32_t entryPoint = 0;
+    uint32_t entryArg = 0;
+    
+    {
+        std::lock_guard<std::mutex> lock(s_mutex);
+        auto it = s_fibers.find(guestThreadAddr);
+        if (it == s_fibers.end()) {
+            RT_LOG(RT_TAG_OS) << "FiberProc: fiber not found!" << std::endl;
+            SwitchToFiber(s_schedulerFiber);
+            return;
+        }
+        fiber = &it->second;
+        entryPoint = fiber->entryPoint;
+        entryArg = fiber->entryArg;
+    }
+    
+    // Get the CPU context
+    CpuContext* cpu = s_cpuContext;
+    if (!cpu) {
+        cpu = &GetPersistentCpuContext();
+    }
+    
+    // Guest OSContext: r2 (TOC/SDA2) at 0x08, r13 (SDA) at 0x34. Both must load correctly or
+    // translated code loses access to global/static data.
+    try {
+        // Load r2 (TOC/SDA2 pointer)
+        cpu->gpr[2] = Memory::Read32(guestThreadAddr + 0x08u);
+        // Load r13 (SDA pointer) - this is CRITICAL for global data access
+        cpu->gpr[13] = Memory::Read32(guestThreadAddr + 0x34u);
+        // Load stack pointer from guest context
+        cpu->gpr[1] = Memory::Read32(guestThreadAddr + 0x04u);
+        // Load saved LR
+        cpu->lr = Memory::Read32(guestThreadAddr + 0x84u);
+        
+    } catch (const Memory::AccessViolation& e) {
+        RT_LOG(RT_TAG_OS) << "Failed to load guest context from 0x" << std::hex << guestThreadAddr
+                  << ": " << e.what() << std::dec << std::endl;
+    }
+    
+    // Set up context for thread entry
+    cpu->gpr[3] = entryArg;
+    cpu->pc = entryPoint;
+    cpu->srr0 = entryPoint;
+    
+    // Create a CpuContextScope for this fiber
+    CpuContextScope scope(cpu);
+    
+    int startDeferAttempts = 0;
+    while (entryPoint == 0x8024373c) { // EGG::Thread::start
+        uint32_t vtable = 0;
+        uint32_t startFn = 0;
+        try {
+            vtable = Memory::Read32(entryArg);
+            if (vtable >= 0x80000000u) {
+                startFn = Memory::Read32(vtable + 0x0Cu);
+            }
+        } catch (const Memory::AccessViolation&) {
+            vtable = 0;
+            startFn = 0;
+        }
+
+
+        if (vtable >= 0x80000000u && startFn >= 0x80000000u) {
+            break;
+        }
+
+        if (startDeferAttempts++ > 50) {
+            RT_LOG(RT_TAG_OS) << "EGG::Thread::start target still invalid (vtable=0x" << std::hex << vtable
+                      << ", fn=0x" << startFn << ") after retries; continuing anyway." << std::dec << std::endl;
+            break;
+        }
+        SwitchToFiber(s_schedulerFiber);
+    }
+
+    // The deferral loop above yields to the scheduler and therefore can resume
+    // with registers from a different guest fiber in the shared CpuContext.
+    cpu->gpr[3] = entryArg;
+    cpu->pc = entryPoint;
+    cpu->srr0 = entryPoint;
+
+    
+    // Call the translated thread entry function
+    const auto* info = TranslatedFunctionRegistry::FindByAddressPtr(entryPoint);
+    if (info) {
+        InvokeIndirectCpu(entryPoint, cpu);
+    } else {
+        RT_LOG(RT_TAG_OS) << "Thread entry 0x" << std::hex << entryPoint
+                  << " not found in registry!" << std::dec << std::endl;
+    }
+    
+    // Thread entry functions normally return into OSExitThread on hardware.
+    // Our host fiber call boundary observes the return directly, so complete the
+    // guest OSThread lifecycle here before handing control back to the scheduler.
+
+    try {
+        RemoveGuestThreadFromQueue(guestThreadAddr);
+        const uint16_t attributes = Memory::Read16(guestThreadAddr + kThreadAttrOffset);
+        const bool detached = (attributes & 1u) != 0;
+        const uint16_t finalState = detached ? 0u : static_cast<uint16_t>(ThreadState::MORIBUND);
+        if (!detached) {
+            Memory::Write32(guestThreadAddr + kThreadExitValueOffset, 0);
+        }
+        Memory::Write16(guestThreadAddr + kThreadStateOffset, finalState);
+        WakeGuestThreadsOnQueueNoSwitch(guestThreadAddr + kThreadJoinQueueOffset);
+        if (Memory::Read32(kOSRunningContextAddr) == guestThreadAddr) {
+            Memory::Write32(kOSRunningContextAddr, 0);
+        }
+        if (Memory::Read32(kOSCurrentContextAddr) == guestThreadAddr) {
+            Memory::Write32(kOSCurrentContextAddr, 0);
+        }
+        Memory::Write32(kSchedulerReschedCounterAddr, 1);
+    } catch (const Memory::AccessViolation& e) {
+        RT_LOG(RT_TAG_OS) << "Thread return cleanup failed for 0x" << std::hex
+                  << guestThreadAddr << " at 0x" << e.address() << std::dec
+                  << " (" << e.reason() << ")" << std::endl;
+    }
+    
+    {
+        std::lock_guard<std::mutex> lock(s_mutex);
+        auto it = s_fibers.find(guestThreadAddr);
+        if (it != s_fibers.end()) {
+            it->second.terminated = true;
+            it->second.state = ThreadState::MORIBUND;
+        }
+        s_currentGuestThread = 0;
+    }
+    
+    // Return to scheduler
+    SwitchToFiber(s_schedulerFiber);
+#else
+    (void)guestThreadAddr;
+    RT_LOG(RT_TAG_OS) << "Fibers not supported on this platform!" << std::endl;
+#endif
+}
+
+} // namespace Fiber
diff --git a/runtime/src/fpu_helpers.cpp b/runtime/src/fpu_helpers.cpp
new file mode 100644
index 0000000..8deef19
--- /dev/null
+++ b/runtime/src/fpu_helpers.cpp
@@ -0,0 +1,147 @@
+#include "ppc_runtime.h"
+#include "memory.h"
+
+#include <cmath>
+#include <cstdint>
+
+namespace {
+
+// Broadway Manual 12.2: FEX (bit 1) and VX (bit 2) are status summaries derived
+// from the other bits; mtfsf/mtfsfi cannot set them explicitly.
+constexpr uint32_t kFpscrReadOnlySummaryMask = 0x60000000u;
+
+double RoundNearestEven(double value) {
+    const double floor_value = std::floor(value);
+    const double frac = value - floor_value;
+    if (frac < 0.5) {
+        return floor_value;
+    }
+    if (frac > 0.5) {
+        return floor_value + 1.0;
+    }
+
+    const double half = floor_value / 2.0;
+    return half == std::floor(half) ? floor_value : floor_value + 1.0;
+}
+}
+
+// CurrentCpuContext() aborts on a null context (isa/ppc_isa_context.h), so it
+// never returns nullptr - none of the helpers below guard against one.
+extern "C" void PPC_Mtfsf(uint32_t fieldMask, double source) {
+    CpuContext* cpu = CurrentCpuContext();
+
+    fieldMask &= 0xFFu;
+
+    // A mask of 0 means update nothing. Do not force it to 0xFF.
+    if (fieldMask == 0) {
+        return;
+    }
+
+    // Broadway Manual 12.2: "The low-order 32 bits of frB are placed into the
+    // FPSCR..." - on a little-endian host that is the low word of the FPR.
+    const uint32_t incoming = PPC_FprLowWordInline(source);
+
+    if (fieldMask == 0xFFu) {
+        cpu->fpscr = (cpu->fpscr & kFpscrReadOnlySummaryMask) |
+                     (incoming & ~kFpscrReadOnlySummaryMask);
+        MkwApplyHostNiMode(cpu->fpscr);
+        return;
+    }
+
+    for (int field = 0; field < 8; ++field) {
+        // PowerPC bit numbering is reversed relative to typical host masks.
+        if ((fieldMask & (1u << (7 - field))) == 0) {
+            continue;
+        }
+
+        // Field 0 is bits 0-3 (MSB of FPSCR); field 7 is bits 28-31.
+        const int shift = (7 - field) * 4;
+        uint32_t mask = 0xFu << shift;
+
+        if (field == 0) {
+            mask &= ~kFpscrReadOnlySummaryMask;
+        }
+
+        cpu->fpscr = (cpu->fpscr & ~mask) | (incoming & mask);
+    }
+    MkwApplyHostNiMode(cpu->fpscr);
+}
+
+extern "C" void PPC_Mtfsb1(uint32_t bit) {
+    CpuContext* cpu = CurrentCpuContext();
+
+    bit &= 31u;
+
+    // Broadway Manual p479: bits 1 and 2 (FEX and VX) cannot be explicitly set.
+    if (bit == 1 || bit == 2) {
+        return;
+    }
+
+    const uint32_t shift = 31u - bit;
+    cpu->fpscr |= (1u << shift);
+    MkwApplyHostNiMode(cpu->fpscr);
+}
+
+extern "C" void PPC_Mtfsb0(uint32_t bit) {
+    CpuContext* cpu = CurrentCpuContext();
+
+    bit &= 31u;
+
+    const uint32_t shift = 31u - bit;
+    cpu->fpscr &= ~(1u << shift);
+    MkwApplyHostNiMode(cpu->fpscr);
+}
+
+extern "C" void PPC_Mtfsfi(uint32_t field, uint32_t value) {
+    CpuContext* cpu = CurrentCpuContext();
+
+    field &= 7u;
+    const uint32_t shift = (7u - field) * 4u;
+    uint32_t mask = 0xFu << shift;
+    if (field == 0) {
+        mask &= ~kFpscrReadOnlySummaryMask;
+    }
+
+    cpu->fpscr = (cpu->fpscr & ~mask) | ((value & 0xFu) << shift);
+    MkwApplyHostNiMode(cpu->fpscr);
+}
+
+extern "C" double PPC_Mffs() {
+    // Broadway Manual 12.2: the FPSCR is placed into the low-order bits of frD;
+    // the high-order bits are architecturally undefined and left zero here.
+    return PpcBitCastToDoubleInline(static_cast<uint64_t>(CurrentCpuContext()->fpscr));
+}
+
+// PPC_Fctiwz is defined inline in ppc_runtime.h. It is the single most emitted
+// float helper in the translation (1,051 sites) and this build has no LTO, so
+// an out-of-line definition made every fctiwz a full caller-saved register
+// barrier around two compares and a cvttsd2si. PPC_Fctiw below shares the same
+// isa pack/clamp inlines so the two cannot drift apart.
+
+extern "C" double PPC_Fctiw(double value) {
+    const uint32_t rn = CurrentCpuContext()->fpscr & 0x3u;
+
+    double rounded = value;
+    switch (rn) {
+    case 0:
+        rounded = RoundNearestEven(value);
+        break;
+    case 1:
+        rounded = std::trunc(value);
+        break;
+    case 2:
+        rounded = std::ceil(value);
+        break;
+    case 3:
+        rounded = std::floor(value);
+        break;
+    }
+
+    return PpcPackIntegerWordInline(PpcClampIntegerWordInline(rounded));
+}
+
+// stfiwx stores the low 32 bits of an FPR as raw integer data with no
+// floating-point conversion - the store half of the fctiwz -> stfiwx idiom.
+extern "C" void PPC_Stfiwx(uint32_t addr, double fprValue) {
+    Memory::Write32(addr, PPC_FprLowWordInline(fprValue));
+}
diff --git a/runtime/src/guest_flat_memory.cpp b/runtime/src/guest_flat_memory.cpp
new file mode 100644
index 0000000..2075f42
--- /dev/null
+++ b/runtime/src/guest_flat_memory.cpp
@@ -0,0 +1,693 @@
+#include "guest_flat_memory.h"
+
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iomanip>
+#include <iostream>
+#include <mutex>
+#include <sstream>
+#include <stdexcept>
+#include <unordered_map>
+
+#include "memory.h"
+#include "ppc_runtime.h"
+#include "recomp_mod_loader.h"
+#include "runtime_log.h"
+#include "system_bridge.h"
+
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <windows.h>
+
+namespace GuestFlat {
+namespace {
+
+// Placeholder / view constants. Declared here so the build does not depend on
+// the exact Windows SDK version that first shipped them.
+constexpr DWORD kMemReplacePlaceholder = 0x00004000;
+constexpr DWORD kMemReservePlaceholder = 0x00040000;
+constexpr DWORD kMemPreservePlaceholder = 0x00000002;
+constexpr size_t kAllocationGranularity = 0x10000;  // 64 KiB
+constexpr size_t kHostPageSize = 0x1000;
+
+using VirtualAlloc2Fn = PVOID(WINAPI*)(HANDLE, PVOID, SIZE_T, ULONG, ULONG, void*, ULONG);
+using MapViewOfFile3Fn = PVOID(WINAPI*)(HANDLE, HANDLE, PVOID, ULONG64, SIZE_T, ULONG, ULONG, void*, ULONG);
+
+VirtualAlloc2Fn g_virtualAlloc2 = nullptr;
+MapViewOfFile3Fn g_mapViewOfFile3 = nullptr;
+
+uint8_t* g_base = nullptr;
+bool g_initialized = false;
+std::vector<RegionRequest> g_activeRegions;
+PVOID g_vectoredHandle = nullptr;
+
+std::mutex& StateMutex() {
+    static std::mutex mutex;
+    return mutex;
+}
+
+struct SectionKey {
+    Backing backing = Backing::Owned;
+    uint32_t ownedBase = 0;
+
+    bool operator==(const SectionKey& other) const {
+        return backing == other.backing && ownedBase == other.ownedBase;
+    }
+};
+
+struct SectionKeyHash {
+    size_t operator()(const SectionKey& key) const {
+        return (static_cast<size_t>(key.ownedBase) << 3) ^ static_cast<size_t>(key.backing);
+    }
+};
+
+struct Section {
+    HANDLE handle = nullptr;
+    uint64_t size = 0;
+    uint8_t* hostView = nullptr;
+};
+
+std::unordered_map<SectionKey, Section, SectionKeyHash>& Sections() {
+    static std::unordered_map<SectionKey, Section, SectionKeyHash> sections;
+    return sections;
+}
+
+struct MappedRegion {
+    uint32_t guestBase = 0;
+    uint64_t guestSize = 0;      // requested size (page-table authority)
+    uint64_t mappedSize = 0;     // rounded to allocation granularity
+    uint64_t sectionOffset = 0;
+    uint8_t* hostView = nullptr; // section host view base
+};
+
+std::vector<MappedRegion>& MappedRegions() {
+    static std::vector<MappedRegion> regions;
+    return regions;
+}
+
+struct GuardedRange {
+    uint32_t start = 0;
+    uint32_t end = 0;
+};
+
+std::vector<GuardedRange>& ExecutableRanges() {
+    static std::vector<GuardedRange> ranges;
+    return ranges;
+}
+
+// 4 KiB guest pages currently PAGE_READONLY for the executable-write guard.
+std::vector<uint8_t>& ExecutableProtectedPages() {
+    static std::vector<uint8_t> pages(1u << 20, 0);  // 2^32 / 4 KiB
+    return pages;
+}
+
+std::vector<GuardedRange>& DeferredRanges() {
+    static std::vector<GuardedRange> ranges;
+    return ranges;
+}
+
+std::atomic<uint32_t> g_countMmio{0};
+std::atomic<uint32_t> g_countEfb{0};
+std::atomic<uint32_t> g_countXGuard{0};
+std::atomic<uint32_t> g_countUnmapped{0};
+std::atomic<uint32_t> g_countUnmappedRegions{0};
+
+// Full register dumps for the first few committed regions. The one-line record
+// below is emitted for every region regardless; the dump is what the historical
+// checked path produced for an unmapped access, and it stays useful only while
+// the log is still readable - a pointer that walks a large stride would
+// otherwise bury the run in 65536 dumps.
+constexpr uint32_t kUnmappedCpuDumpLimit = 16;
+
+uint64_t RoundUp(uint64_t value, uint64_t alignment) {
+    return (value + alignment - 1u) & ~(alignment - 1u);
+}
+
+std::string LastErrorText(const char* what) {
+    std::ostringstream oss;
+    oss << what << " failed (GetLastError=" << GetLastError() << ")";
+    return oss.str();
+}
+
+void ResolvePlacementApi() {
+    if (g_virtualAlloc2 != nullptr && g_mapViewOfFile3 != nullptr) return;
+    HMODULE kernelBase = GetModuleHandleW(L"kernelbase.dll");
+    if (kernelBase == nullptr) kernelBase = LoadLibraryW(L"kernelbase.dll");
+    if (kernelBase != nullptr) {
+        g_virtualAlloc2 =
+            reinterpret_cast<VirtualAlloc2Fn>(GetProcAddress(kernelBase, "VirtualAlloc2"));
+        g_mapViewOfFile3 =
+            reinterpret_cast<MapViewOfFile3Fn>(GetProcAddress(kernelBase, "MapViewOfFile3"));
+    }
+    if (g_virtualAlloc2 == nullptr || g_mapViewOfFile3 == nullptr) {
+        throw std::runtime_error(
+            "Flat guest memory requires Windows 10 1803 or newer (VirtualAlloc2/MapViewOfFile3 "
+            "are unavailable on this system).");
+    }
+}
+
+void EnsureReservation() {
+    if (g_base != nullptr) return;
+    ResolvePlacementApi();
+
+    void* requested = reinterpret_cast<void*>(kFixedFlatGuestBase);
+
+    // One extra granule stays an uncommitted placeholder so an access that
+    // straddles 0xFFFFFFFF faults instead of corrupting whatever the allocator
+    // happened to place directly after the reservation.
+    void* reserved = g_virtualAlloc2(GetCurrentProcess(), requested,
+                                     static_cast<SIZE_T>(kGuestSpaceSize + kAllocationGranularity),
+                                     MEM_RESERVE | kMemReservePlaceholder, PAGE_NOACCESS,
+                                     nullptr, 0);
+    if (reserved == nullptr) {
+        std::ostringstream oss;
+        oss << "Unable to reserve the 4 GiB flat guest address space at 0x" << std::hex
+            << reinterpret_cast<uintptr_t>(requested) << std::dec
+            << " (GetLastError=" << GetLastError()
+            << "). The translated code addresses guest memory through this fixed base, so it "
+               "cannot fall back to another one. Something else in this process reserved the "
+               "16 TiB region first - an injected DLL, an overlay or a debugging tool is the "
+               "usual cause.";
+        throw std::runtime_error(oss.str());
+    }
+
+    if (reserved != requested) {
+        throw std::runtime_error(
+            "The flat guest reservation did not land on the fixed base the translated code was "
+            "compiled against.");
+    }
+    g_base = static_cast<uint8_t*>(reserved);
+}
+
+// Carves `size` bytes out of the enclosing placeholder so a view or a private
+// commit can replace it. Splitting an exact-size placeholder is a no-op that
+// reports ERROR_INVALID_PARAMETER; the caller validates the replacement.
+void SplitPlaceholder(uint8_t* address, uint64_t size) {
+    VirtualFree(address, static_cast<SIZE_T>(size), MEM_RELEASE | kMemPreservePlaceholder);
+}
+
+void MapGuestView(const Section& section, uint64_t sectionOffset, uint32_t guestBase,
+                  uint64_t mappedSize) {
+    uint8_t* target = g_base + guestBase;
+    SplitPlaceholder(target, mappedSize);
+    void* view = g_mapViewOfFile3(section.handle, GetCurrentProcess(), target, sectionOffset,
+                                  static_cast<SIZE_T>(mappedSize), kMemReplacePlaceholder,
+                                  PAGE_READWRITE, nullptr, 0);
+    if (view == nullptr) {
+        std::ostringstream oss;
+        oss << "Unable to map guest region 0x" << std::hex << guestBase << " (+0x" << mappedSize
+            << ") into the flat reservation" << std::dec << " (GetLastError=" << GetLastError()
+            << ")";
+        throw std::runtime_error(oss.str());
+    }
+}
+
+// Replaces a placeholder with private committed memory. Used for the MMIO
+// window (read-only zeros) and for on-demand commits of stray guest pages.
+bool CommitPlaceholder(uint8_t* address, uint64_t size, DWORD protection) {
+    SplitPlaceholder(address, size);
+    void* result = g_virtualAlloc2(GetCurrentProcess(), address, static_cast<SIZE_T>(size),
+                                   MEM_RESERVE | MEM_COMMIT | kMemReplacePlaceholder, protection,
+                                   nullptr, 0);
+    return result != nullptr;
+}
+
+// One definition of the two windows lives in memory_access.h; these are the
+// names the fault handler below reads.
+bool IsMmio(uint32_t address) { return MemoryInline::IsMmioAddress(address); }
+bool IsGpuFifo(uint32_t address) { return MemoryInline::IsGpuFifoAddress(address); }
+
+void ApplyExecutableProtectionLocked() {
+    if (g_base == nullptr) return;
+    auto& protectedPages = ExecutableProtectedPages();
+    for (const auto& range : ExecutableRanges()) {
+        // Only pages fully inside the range are protected: edge pages often share a page with data
+        // (MKW's THP buffers do), so guarding them would fault legitimate stores; their writes still go through the checked path.
+        const uint64_t first = RoundUp(range.start, kHostPageSize);
+        const uint64_t last = static_cast<uint64_t>(range.end) & ~(kHostPageSize - 1u);
+        if (last <= first) continue;
+        for (uint64_t page = first; page < last; page += kHostPageSize) {
+            const uint32_t pageIndex = static_cast<uint32_t>(page >> 12);
+            if (protectedPages[pageIndex] != 0) continue;
+            DWORD previous = 0;
+            if (VirtualProtect(g_base + page, kHostPageSize, PAGE_READONLY, &previous) != FALSE) {
+                protectedPages[pageIndex] = 1;
+            }
+        }
+    }
+}
+
+bool SameLayout(const std::vector<RegionRequest>& lhs, const std::vector<RegionRequest>& rhs) {
+    if (lhs.size() != rhs.size()) return false;
+    for (size_t index = 0; index < lhs.size(); ++index) {
+        if (lhs[index].base != rhs[index].base || lhs[index].size != rhs[index].size ||
+            lhs[index].backing != rhs[index].backing) {
+            return false;
+        }
+    }
+    return true;
+}
+
+uint64_t SectionOffsetFor(const RegionRequest& region) {
+    switch (region.backing) {
+    case Backing::Mem1:
+        return region.base & 0x01FFFFFFu;  // 32 MiB MEM1 window
+    case Backing::Mem2:
+        return region.base & 0x0FFFFFFFu;  // 256 MiB MEM2 window
+    case Backing::Owned:
+    default:
+        return 0;
+    }
+}
+
+SectionKey KeyFor(const RegionRequest& region) {
+    SectionKey key;
+    key.backing = region.backing;
+    key.ownedBase = region.backing == Backing::Owned ? region.base : 0;
+    return key;
+}
+
+void ZeroMappedStorage() {
+    for (auto& [key, section] : Sections()) {
+        (void)key;
+        if (section.hostView != nullptr && section.size != 0) {
+            std::memset(section.hostView, 0, static_cast<size_t>(section.size));
+        }
+    }
+}
+
+LONG CALLBACK FlatGuestVectoredHandler(EXCEPTION_POINTERS* info) {
+    if (HandleAccessViolation(info)) {
+        return EXCEPTION_CONTINUE_EXECUTION;
+    }
+    return EXCEPTION_CONTINUE_SEARCH;
+}
+
+void InstallVectoredHandler() {
+    if (g_vectoredHandle != nullptr) return;
+    g_vectoredHandle = AddVectoredExceptionHandler(1, FlatGuestVectoredHandler);
+    if (g_vectoredHandle == nullptr) {
+        throw std::runtime_error(LastErrorText("AddVectoredExceptionHandler"));
+    }
+}
+
+void ReportFatalGuestFault(const char* category, uint32_t guestAddress, bool isWrite,
+                           const char* detail) {
+    RT_LOG(RT_TAG_MEMORY) << "FATAL " << category << std::endl;
+    std::cerr << "  guest address: 0x" << std::hex << std::uppercase << std::setw(8)
+              << std::setfill('0') << guestAddress << std::dec << std::setfill(' ') << std::endl;
+    std::cerr << "  access:        " << (isWrite ? "write" : "read") << std::endl;
+    // The fault record carries the faulting address but not the width of the
+    // access, so the size is genuinely unavailable on this path. The checked
+    // path (runtime/src/memory.cpp) reports the exact length instead.
+    std::cerr << "  access size:   unknown (not recoverable from the fault record)" << std::endl;
+    std::cerr << "  active func:   0x" << std::hex << std::uppercase
+              << RecompMod::CurrentTranslatedExecutionAddress() << std::dec << std::nouppercase
+              << std::endl;
+    std::cerr << "  detail:        " << detail << std::endl;
+    if (auto* cpu = TryGetCpuContext()) {
+        std::cerr << "  guest pc:      0x" << std::hex << cpu->pc << " lr=0x" << cpu->lr << std::dec
+                  << std::endl;
+        SystemBridge::DumpCpuState(cpu);
+    }
+    std::cerr.flush();
+    std::ostringstream message;
+    message << "The game stopped because translated code performed a forbidden guest memory "
+               "access at 0x"
+            << std::hex << std::uppercase << guestAddress << ".\n\n"
+            << detail;
+    ShowRuntimeFatalPopup(category, message.str());
+    std::abort();
+}
+
+// Logged once per newly committed 64 KiB block since a silent commit would hide a wild guest pointer bug.
+// Called with StateMutex() released so the register dump (which reads guest memory) can't deadlock against it.
+void ReportUnmappedCommit(uint32_t guestAddress, uint64_t blockBase, bool isWrite,
+                          uint32_t regionOrdinal) {
+    RT_LOG(RT_TAG_MEMORY) << "WARNING unmapped guest touch: no mapped region for 0x" << std::hex
+              << std::uppercase << std::setw(8) << std::setfill('0') << guestAddress
+              << std::setfill(' ') << " (" << (isWrite ? "write" : "read")
+              << "); committed zero-filled block 0x" << blockBase << "-0x"
+              << (blockBase + kAllocationGranularity) << " active=0x"
+              << RecompMod::CurrentTranslatedExecutionAddress();
+    if (auto* cpu = TryGetCpuContext()) {
+        std::cerr << " pc=0x" << cpu->pc << " lr=0x" << cpu->lr << " r1=0x" << cpu->gpr[1];
+    }
+    std::cerr << std::dec << std::nouppercase << " region#" << regionOrdinal << std::endl;
+
+    if (regionOrdinal <= kUnmappedCpuDumpLimit) {
+        if (auto* cpu = TryGetCpuContext()) {
+            RT_LOG(RT_TAG_MEMORY) << "===== DUMPING CPU STATE (unmapped touch) =====" << std::endl;
+            SystemBridge::DumpCpuState(cpu);
+        }
+        if (regionOrdinal == kUnmappedCpuDumpLimit) {
+            RT_LOG(RT_TAG_MEMORY) << "further unmapped commits log the one-line record only; the "
+                         "shutdown summary reports the totals."
+                      << std::endl;
+        }
+    }
+    std::cerr.flush();
+}
+
+} // namespace
+
+bool IsActive() {
+    return g_initialized;
+}
+
+void Initialize(const std::vector<RegionRequest>& regions) {
+    std::lock_guard<std::mutex> lock(StateMutex());
+
+    if (g_initialized) {
+        if (!SameLayout(g_activeRegions, regions)) {
+            throw std::runtime_error(
+                "The flat guest address space is mapped once per process; a second Memory::Init "
+                "requested a different region layout. Restart the process instead of remapping.");
+        }
+        // Re-init keeps the mapping and restores the pristine interception
+        // state: deferred ranges are gone, executable pages stay protected.
+        for (const auto& range : DeferredRanges()) {
+            const uint64_t first = static_cast<uint64_t>(range.start) & ~(kHostPageSize - 1u);
+            const uint64_t last = RoundUp(range.end, kHostPageSize);
+            DWORD previous = 0;
+            VirtualProtect(g_base + first, static_cast<SIZE_T>(last - first), PAGE_READWRITE,
+                           &previous);
+        }
+        DeferredRanges().clear();
+        ZeroMappedStorage();
+        ApplyExecutableProtectionLocked();
+        return;
+    }
+
+    EnsureReservation();
+
+    // Size every section from the highest byte any of its regions reaches.
+    std::unordered_map<SectionKey, uint64_t, SectionKeyHash> sizes;
+    for (const auto& region : regions) {
+        if (region.size == 0) continue;
+        if ((region.base % kAllocationGranularity) != 0) {
+            std::ostringstream oss;
+            oss << "Guest region base 0x" << std::hex << region.base
+                << " is not 64 KiB aligned; the flat mapping cannot place it.";
+            throw std::runtime_error(oss.str());
+        }
+        const uint64_t end = SectionOffsetFor(region) + region.size;
+        auto& current = sizes[KeyFor(region)];
+        current = std::max(current, end);
+    }
+
+    for (auto& [key, size] : sizes) {
+        const uint64_t rounded = RoundUp(size, kAllocationGranularity);
+        Section section;
+        section.size = rounded;
+        section.handle = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_READWRITE,
+                                            static_cast<DWORD>(rounded >> 32),
+                                            static_cast<DWORD>(rounded & 0xFFFFFFFFu), nullptr);
+        if (section.handle == nullptr) {
+            throw std::runtime_error(LastErrorText("CreateFileMapping for guest RAM"));
+        }
+        section.hostView = static_cast<uint8_t*>(
+            MapViewOfFile(section.handle, FILE_MAP_ALL_ACCESS, 0, 0, static_cast<SIZE_T>(rounded)));
+        if (section.hostView == nullptr) {
+            throw std::runtime_error(LastErrorText("MapViewOfFile for the host guest-RAM alias"));
+        }
+        Sections()[key] = section;
+    }
+
+    for (const auto& region : regions) {
+        if (region.size == 0) continue;
+        const auto& section = Sections()[KeyFor(region)];
+        const uint64_t offset = SectionOffsetFor(region);
+        const uint64_t mappedSize =
+            std::min<uint64_t>(RoundUp(region.size, kAllocationGranularity), section.size - offset);
+        MapGuestView(section, offset, region.base, mappedSize);
+        MappedRegions().push_back(
+            MappedRegion{region.base, region.size, mappedSize, offset, section.hostView});
+    }
+
+    // MMIO stays inaccessible in both directions so the vectored handler can report missing HLE; the old
+    // PAGE_READONLY read window that returned zero turned missing devices into silent hangs instead.
+    if (!CommitPlaceholder(g_base + 0xCC000000u, 0x02000000u, PAGE_NOACCESS)) {
+        throw std::runtime_error(LastErrorText("committing the no-access MMIO window"));
+    }
+
+    ApplyExecutableProtectionLocked();
+    InstallVectoredHandler();
+
+    // Freshly created section objects are demand-zero, so no explicit clear is
+    // needed on the first mapping (that would fault in all 152 MiB at startup).
+    g_activeRegions = regions;
+    g_initialized = true;
+
+    RT_LOG(RT_TAG_MEMORY) << "guest address space reserved at 0x" << std::hex
+              << reinterpret_cast<uintptr_t>(g_base) << std::dec << " (" << MappedRegions().size()
+              << " regions, " << Sections().size() << " backing stores)" << std::endl;
+}
+
+uint8_t* HostPointer(uint32_t guestAddress) {
+    if (!g_initialized) return nullptr;
+    for (const auto& region : MappedRegions()) {
+        if (guestAddress < region.guestBase) continue;
+        const uint64_t offset = static_cast<uint64_t>(guestAddress) - region.guestBase;
+        if (offset >= region.guestSize) continue;
+        return region.hostView + region.sectionOffset + offset;
+    }
+    return nullptr;
+}
+
+void ProtectDeferredRange(uint32_t address, size_t length) {
+    if (!g_initialized || length == 0) return;
+    const uint64_t end = static_cast<uint64_t>(address) + length;
+    if (end > kGuestSpaceSize) return;
+    std::lock_guard<std::mutex> lock(StateMutex());
+    const uint64_t first = static_cast<uint64_t>(address) & ~(kHostPageSize - 1u);
+    const uint64_t last = RoundUp(end, kHostPageSize);
+    DWORD previous = 0;
+    if (VirtualProtect(g_base + first, static_cast<SIZE_T>(last - first), PAGE_NOACCESS,
+                       &previous) == FALSE) {
+        // An unmapped destination cannot be trapped; the checked path still
+        // clears the readable bias, so nothing silently reads stale bytes.
+        return;
+    }
+    DeferredRanges().push_back(GuardedRange{address, static_cast<uint32_t>(end)});
+}
+
+void UnprotectDeferredRange(uint32_t address, size_t length) {
+    if (!g_initialized || length == 0) return;
+    std::lock_guard<std::mutex> lock(StateMutex());
+    auto& ranges = DeferredRanges();
+    const uint64_t end = static_cast<uint64_t>(address) + length;
+    const auto it = std::find_if(ranges.begin(), ranges.end(), [&](const GuardedRange& range) {
+        return range.start == address && range.end == static_cast<uint32_t>(end);
+    });
+    if (it == ranges.end()) return;
+    ranges.erase(it);
+    const uint64_t first = static_cast<uint64_t>(address) & ~(kHostPageSize - 1u);
+    const uint64_t last = RoundUp(end, kHostPageSize);
+    DWORD previous = 0;
+    VirtualProtect(g_base + first, static_cast<SIZE_T>(last - first), PAGE_READWRITE, &previous);
+}
+
+void RegisterExecutableRange(uint32_t start, uint32_t end) {
+    if (end <= start) return;
+    std::lock_guard<std::mutex> lock(StateMutex());
+    auto& ranges = ExecutableRanges();
+    if (std::any_of(ranges.begin(), ranges.end(), [&](const GuardedRange& range) {
+            return range.start == start && range.end == end;
+        })) {
+        return;
+    }
+    ranges.push_back(GuardedRange{start, end});
+    ApplyExecutableProtectionLocked();
+}
+
+FaultCounters Counters() {
+    FaultCounters counters;
+    counters.mmio = g_countMmio.load(std::memory_order_relaxed);
+    counters.efb = g_countEfb.load(std::memory_order_relaxed);
+    counters.xguard = g_countXGuard.load(std::memory_order_relaxed);
+    counters.unmapped = g_countUnmapped.load(std::memory_order_relaxed);
+    counters.unmappedRegions = g_countUnmappedRegions.load(std::memory_order_relaxed);
+    return counters;
+}
+
+void LogFaultSummary() noexcept {
+    static std::atomic<bool> reported{false};
+    if (reported.exchange(true, std::memory_order_relaxed)) return;
+    const FaultCounters counters = Counters();
+    if (counters.unmapped == 0) {
+        RT_LOG(RT_TAG_MEMORY) << "shutdown summary: no unmapped guest touches (efb="
+                  << counters.efb << " xguard=" << counters.xguard << " mmio=" << counters.mmio
+                  << ")" << std::endl;
+        std::cerr.flush();
+        return;
+    }
+    RT_LOG(RT_TAG_MEMORY) << "WARNING shutdown summary: " << counters.unmapped
+              << " unmapped guest touches across " << counters.unmappedRegions
+              << " distinct 64 KiB regions were absorbed by on-demand commits. Each one is a "
+                 "guest pointer that addressed nothing; search the log for "
+                 "'[" RT_TAG_MEMORY "] WARNING unmapped guest touch' for the faulting addresses."
+              << std::endl;
+    RT_LOG(RT_TAG_MEMORY) << "shutdown summary: efb=" << counters.efb
+              << " xguard=" << counters.xguard << " mmio=" << counters.mmio << std::endl;
+    std::cerr.flush();
+}
+
+bool HandleAccessViolation(void* exceptionPointers) noexcept {
+    if (!g_initialized || exceptionPointers == nullptr) return false;
+    auto* info = static_cast<EXCEPTION_POINTERS*>(exceptionPointers);
+    const auto* record = info->ExceptionRecord;
+    if (record == nullptr || record->ExceptionCode != EXCEPTION_ACCESS_VIOLATION ||
+        record->NumberParameters < 2) {
+        return false;
+    }
+
+    const uintptr_t fault = static_cast<uintptr_t>(record->ExceptionInformation[1]);
+    const uintptr_t base = reinterpret_cast<uintptr_t>(g_base);
+    if (fault < base || fault - base >= kGuestSpaceSize) return false;
+
+    const uint32_t guestAddress = static_cast<uint32_t>(fault - base);
+    const bool isWrite = record->ExceptionInformation[0] != 0;
+
+    // 1) Deferred (EFB) read: materialize the pending copy and drop the trap for the whole 4 KiB page span,
+    //    not just the registered range, since protection is page-granular. Leaving a range registered but
+    //    unprotected would serve stale bytes without ever faulting again.
+    {
+        bool covered = false;
+        uint32_t rangeStart = 0;
+        uint32_t rangeEnd = 0;
+        uint64_t spanFirst = 0;
+        uint64_t spanLast = 0;
+        {
+            std::lock_guard<std::mutex> lock(StateMutex());
+            auto& ranges = DeferredRanges();
+            const auto it = std::find_if(ranges.begin(), ranges.end(), [&](const GuardedRange& r) {
+                const uint64_t first = static_cast<uint64_t>(r.start) & ~(kHostPageSize - 1u);
+                const uint64_t last = RoundUp(r.end, kHostPageSize);
+                return guestAddress >= first && guestAddress < last;
+            });
+            if (it != ranges.end()) {
+                covered = true;
+                rangeStart = it->start;
+                rangeEnd = it->end;
+                ranges.erase(it);
+                spanFirst = static_cast<uint64_t>(rangeStart) & ~(kHostPageSize - 1u);
+                spanLast = RoundUp(rangeEnd, kHostPageSize);
+                DWORD previous = 0;
+                VirtualProtect(g_base + spanFirst, static_cast<SIZE_T>(spanLast - spanFirst),
+                               PAGE_READWRITE, &previous);
+            }
+        }
+        if (covered) {
+            g_countEfb.fetch_add(1, std::memory_order_relaxed);
+            try {
+                MemoryInline::ResolveDeferredReads(
+                    static_cast<uint32_t>(spanFirst), static_cast<size_t>(spanLast - spanFirst));
+            } catch (const std::exception& error) {
+                ReportFatalGuestFault("deferred read materialization failed", guestAddress, isWrite,
+                                      error.what());
+            }
+            return true;
+        }
+    }
+
+    // 2) Executable-write guard. Only writes trap (the pages are PAGE_READONLY),
+    //    so a fault here is exactly the event the guard exists to report.
+    {
+        const uint32_t pageIndex = guestAddress >> 12;
+        bool guarded = false;
+        {
+            std::lock_guard<std::mutex> lock(StateMutex());
+            guarded = ExecutableProtectedPages()[pageIndex] != 0;
+        }
+        if (guarded) {
+            g_countXGuard.fetch_add(1, std::memory_order_relaxed);
+            // Aborts inside CheckExecutableWrite for an unsupported patch; the
+            // width and value are not recoverable from the fault record, so the
+            // report carries the exact address instead.
+            if (!RecompMod::HandleExecutableWrite(guestAddress, 1, 0)) {
+                // A permitted write (the REL loader relocating its own text).
+                // Those arrive in bulk, so the page is opened permanently
+                // rather than trapping every relocation.
+                std::lock_guard<std::mutex> lock(StateMutex());
+                DWORD previous = 0;
+                if (VirtualProtect(g_base + (static_cast<uint64_t>(pageIndex) << 12), kHostPageSize,
+                                   PAGE_READWRITE, &previous) != FALSE) {
+                    ExecutableProtectedPages()[pageIndex] = 0;
+                }
+            }
+            return true;
+        }
+    }
+
+    // 3) MMIO. PAGE_NOACCESS makes both directions faults: a write has no backing device (including a GPU
+    //    FIFO store the translator failed to lower), and a read would have to invent a register value;
+    //    answering zero would turn a missing device into a silent hang, so both are reported instead.
+    if (IsMmio(guestAddress)) {
+        g_countMmio.fetch_add(1, std::memory_order_relaxed);
+        if (IsGpuFifo(guestAddress)) {
+            if (isWrite) {
+                ReportFatalGuestFault(
+                    "GPU FIFO write reached the flat memory path", guestAddress, isWrite,
+                    "Gather-pipe stores must be lowered to GX_HLE_FIFO_Write*; the written value "
+                    "cannot be recovered from a fault. Fix the translator lowering for this "
+                    "store.");
+            }
+            ReportFatalGuestFault(
+                "GPU FIFO read blocked", guestAddress, isWrite,
+                "The gather pipe is write-only; nothing can be read back from it. The guest code "
+                "that issued this load needs GX HLE, not a memory access.");
+        }
+        if (isWrite) {
+            ReportFatalGuestFault("MMIO write blocked (non-GPU)", guestAddress, isWrite,
+                                  "Hardware registers have no backing store. Add HLE for this "
+                                  "device instead of letting the write land.");
+        }
+        ReportFatalGuestFault("MMIO read blocked (non-GPU)", guestAddress, isWrite,
+                              "Hardware registers have no backing store. Answering zero would "
+                              "hang the caller in a status poll instead of reporting the gap; "
+                              "add HLE for this device.");
+        return true;
+    }
+
+    // 4) Unmapped address: commit the block on demand (reproducing the old zero-fill sparse-map behavior)
+    //    and report it, since a commit here means a wild guest pointer that would otherwise walk over silently.
+    const uint64_t blockBase = static_cast<uint64_t>(guestAddress) & ~(kAllocationGranularity - 1u);
+    g_countUnmapped.fetch_add(1, std::memory_order_relaxed);
+    bool committed = false;
+    {
+        std::lock_guard<std::mutex> lock(StateMutex());
+        MEMORY_BASIC_INFORMATION mbi{};
+        if (VirtualQuery(g_base + blockBase, &mbi, sizeof(mbi)) == 0) return false;
+        if (mbi.State == MEM_COMMIT) {
+            // Another thread already committed this block: re-running the
+            // access succeeds. Any other committed-but-inaccessible state is
+            // not ours to fix - resuming would fault forever, so hand the
+            // exception to the crash reporter instead.
+            const bool writable = (mbi.Protect & (PAGE_READWRITE | PAGE_WRITECOPY |
+                                                  PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY)) != 0;
+            const bool readable = writable || (mbi.Protect & (PAGE_READONLY | PAGE_EXECUTE_READ |
+                                                              PAGE_EXECUTE)) != 0;
+            return isWrite ? writable : readable;
+        }
+        if (!CommitPlaceholder(g_base + blockBase, kAllocationGranularity, PAGE_READWRITE)) {
+            return false;
+        }
+        committed = true;
+    }
+    if (committed) {
+        const uint32_t ordinal = g_countUnmappedRegions.fetch_add(1, std::memory_order_relaxed) + 1u;
+        ReportUnmappedCommit(guestAddress, blockBase, isWrite, ordinal);
+    }
+    return true;
+}
+
+} // namespace GuestFlat
diff --git a/runtime/src/hle/audio/audio.cpp b/runtime/src/hle/audio/audio.cpp
new file mode 100644
index 0000000..1be5008
--- /dev/null
+++ b/runtime/src/hle/audio/audio.cpp
@@ -0,0 +1,541 @@
+#include "memory.h"
+#include "guest_interrupt_context.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "audio_backend.h"
+#include "ax_dsp.h"
+#include "music_attenuation.h"
+#include "runtime_log.h"
+
+#include <algorithm>
+#include <cstdint>
+#include <chrono>
+#include <cstdio>
+#include <cstring>
+#include <cstdlib>
+#include <string>
+#include <mutex>
+#include <vector>
+
+namespace {
+constexpr uint32_t kDefaultSampleRate = 32000u;
+constexpr uint32_t kAudioChannels = 2u;
+constexpr uint32_t kBytesPerSample = 2u;
+constexpr uint32_t kAIInitializedAddr = 0x80386448u;
+constexpr uint32_t kAICallbackBusyAddr = 0x8038644Cu;
+constexpr uint32_t kAICallbackStackSwitchAddr = 0x8038647Cu;
+constexpr uint32_t kAIDmaCallbackAddr = 0x80386480u;
+
+// Max completed 3 ms DMA blocks delivered per tick. Draining several at once catches up
+// backlog from a long frame without letting a large stall spiral into an unbounded loop.
+constexpr int kMaxBlocksPerTick = 4;
+
+struct AIDmaState {
+    std::mutex mutex;
+    uint32_t startAddr = 0;
+    uint32_t registerStartAddr = 0;
+    uint32_t length = 0;
+    uint32_t callback = 0;
+    bool enabled = false;
+    uint32_t sampleRate = kDefaultSampleRate;
+    uint32_t bytesLeft = 0;
+    double accumulatorSeconds = 0.0;
+    bool tickActive = false;
+    bool loggedBackendFailure = false;
+    bool loggedMissingCallback = false;
+    bool loggedAccessFailure = false;
+};
+
+AIDmaState g_ai{};
+
+// Audio degradation is invisible to the player except as silence, so every
+// notice below reaches stderr unconditionally. The ones that sit on the
+// per-DMA-frame path keep their one-shot latch in g_ai.
+void ReportAudioProblem(const char* who, const char* what) {
+    RT_LOGF(RT_TAG_AUDIO, "%s: %s\n", who, what);
+    std::fflush(stderr);
+}
+
+bool EnsureAudioBackend(uint32_t sampleRate) {
+    return AudioBackend::Instance().Init(sampleRate, kAudioChannels);
+}
+
+uint32_t EncodeAIDmaStartRegister(uint32_t startAddr) {
+    return startAddr & 0x1fffffe0u;
+}
+
+uint32_t EncodeAIDmaLengthRegister(uint32_t length) {
+    return length & 0x000fffe0u;
+}
+
+bool PushAudioBlock(uint32_t startAddr, uint32_t length) {
+    if (startAddr == 0 || length == 0) {
+        return false;
+    }
+    const uint32_t bytes = length;
+    const uint8_t* src = nullptr;
+    try {
+        src = static_cast<const uint8_t*>(Memory::GetPointer(startAddr, bytes));
+    } catch (const Memory::AccessViolation&) {
+        src = nullptr;
+    }
+
+    if (src) {
+        return AudioBackend::Instance().PushWiiAiSamplesBE16(src, bytes);
+    }
+
+    const uint32_t sampleCount = bytes / kBytesPerSample;
+    if (sampleCount == 0) {
+        return false;
+    }
+    std::vector<int16_t> samples(sampleCount);
+    try {
+        for (uint32_t i = 0; i < sampleCount; ++i) {
+            const uint32_t addr = startAddr + i * kBytesPerSample;
+            samples[i] = static_cast<int16_t>(Memory::Read16(addr));
+        }
+    } catch (const Memory::AccessViolation&) {
+        return false;
+    }
+    // Memory::Read16 has converted endianness, but the Wii AI frame order is
+    // still right, left. Convert it to the host's left, right convention.
+    for (uint32_t i = 0; i + 1 < sampleCount; i += 2) {
+        std::swap(samples[i], samples[i + 1]);
+    }
+    return AudioBackend::Instance().PushSamplesLE16(samples.data(), samples.size());
+}
+
+} // namespace
+
+extern "C" void AIClockInit_801A1138(uint32_t clock_mode)
+{
+    // clock_mode is unused: AID/DSP rate is controlled separately by AI state, and
+    // treating it as a sample-rate switch would break Wii AX's normal 32 kHz cadence.
+    (void)clock_mode;
+    uint32_t rate = kDefaultSampleRate;
+    {
+        std::lock_guard<std::mutex> lock(g_ai.mutex);
+        rate = g_ai.sampleRate;
+    }
+    if (!EnsureAudioBackend(rate)) {
+        ReportAudioProblem("__AIClockInit", "audio backend init failed");
+    }
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A1138, AIClockInit_801A1138, (uint32_t clock_mode), (clock_mode));
+
+extern "C" void OSInitAudioSystem_801A1358()
+{
+    AIClockInit_801A1138(1);
+    AxDspHle::InitAram();
+    AxDspHle::Init();
+    if (!EnsureAudioBackend(kDefaultSampleRate)) {
+        ReportAudioProblem("__OSInitAudioSystem", "audio backend init failed");
+    }
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A1358, OSInitAudioSystem_801A1358, (), ());
+
+extern "C" void OSStopAudioSystem_801A1520()
+{
+    {
+        std::lock_guard<std::mutex> lock(g_ai.mutex);
+        g_ai.enabled = false;
+        g_ai.registerStartAddr = 0;
+        g_ai.bytesLeft = 0;
+        g_ai.accumulatorSeconds = 0.0;
+    }
+    AxDspHle::Stop();
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A1520, OSStopAudioSystem_801A1520, (), ());
+
+
+
+// Do NOT stub Audio__Manager__Init_80717150 / Audio__Manager__InitSelf_8071724c: they must
+// run translated to init AudioHandleHolder::sInstance, or createSceneSoundManager NULL-vtable crashes.
+
+
+extern "C" void AIInit_801240b0(uint32_t callback_stack_switch)
+{
+    const uint32_t rate = kDefaultSampleRate;
+    uint32_t initialized = 0;
+    const bool alreadyInitialized = Memory::TryRead32(kAIInitializedAddr, initialized) && initialized == 1u;
+    {
+        std::lock_guard<std::mutex> lock(g_ai.mutex);
+        g_ai.sampleRate = rate;
+        if (!alreadyInitialized) {
+            g_ai.callback = 0;
+            g_ai.loggedMissingCallback = false;
+            g_ai.loggedAccessFailure = false;
+        }
+    }
+    if (!alreadyInitialized) {
+        Memory::TryWrite32(kAIDmaCallbackAddr, 0);
+        Memory::TryWrite32(kAICallbackBusyAddr, 0);
+        Memory::TryWrite32(kAICallbackStackSwitchAddr, callback_stack_switch);
+        Memory::TryWrite32(kAIInitializedAddr, 1);
+    }
+    if (!EnsureAudioBackend(rate)) {
+        ReportAudioProblem("AIInit", "audio backend init failed");
+    } else {
+        RT_LOG(RT_TAG_AUDIO) << "AIInit_801240b0 called: Audio subsystem initialized (HLE)" << std::endl;
+    }
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801240b0, AIInit_801240b0, (uint32_t callback_stack_switch), (callback_stack_switch));
+
+extern "C" uint32_t AICheckInit_80124094()
+{
+    uint32_t initialized = 0;
+    Memory::TryRead32(kAIInitializedAddr, initialized);
+    return initialized;
+}
+REGISTER_NATIVE_FUNCTION(0x80124094, AICheckInit_80124094);
+
+
+
+extern "C" void DSPInit_8015d444()
+{
+    AxDspHle::Init();
+    RT_LOG(RT_TAG_AUDIO) << "DSPInit_8015d444 called: DSP hardware boundary initialized (HLE)" << std::endl;
+}
+
+PPC_NATIVE_OVERRIDE_VOID(8015d444, DSPInit_8015d444, (), ());
+
+extern "C" uint32_t DSPCheckInit_8015d504()
+{
+    return AxDspHle::CheckInit();
+}
+REGISTER_NATIVE_FUNCTION(0x8015D504, DSPCheckInit_8015d504);
+
+extern "C" uint32_t DSPAddTask_8015d50c(uint32_t task_ptr)
+{
+    return AxDspHle::AddTask(task_ptr);
+}
+REGISTER_NATIVE_FUNCTION(0x8015D50C, DSPAddTask_8015d50c);
+
+extern "C" void __DSP_boot_task_8015dc60(uint32_t task_ptr)
+{
+    AxDspHle::AssertTask(task_ptr);
+    RT_LOG(RT_TAG_AUDIO) << "__DSP_boot_task called: booted DSP task at 0x"
+              << std::hex << task_ptr << std::dec << std::endl;
+}
+
+PPC_NATIVE_OVERRIDE_VOID(8015dc60, __DSP_boot_task_8015dc60, (uint32_t task_ptr), (task_ptr));
+
+
+extern "C" void __AXOutInitDSP_801269bc(CpuContext* ctx)
+{
+    AxDspHle::InitForAXOut(ctx);
+    RT_LOG(RT_TAG_AUDIO) << "__AXOutInitDSP called: native AX/DSP HLE initialized." << std::endl;
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801269bc, __AXOutInitDSP_801269bc, (CpuContext* ctx), (ctx));
+
+
+
+extern "C" void AIInitDMA_80123fcc(uint32_t start_addr, uint32_t length)
+{
+    std::lock_guard<std::mutex> lock(g_ai.mutex);
+    g_ai.startAddr = start_addr;
+    g_ai.registerStartAddr = EncodeAIDmaStartRegister(start_addr);
+    g_ai.length = EncodeAIDmaLengthRegister(length);
+    g_ai.bytesLeft = g_ai.length;
+}
+
+PPC_NATIVE_OVERRIDE_VOID(80123fcc, AIInitDMA_80123fcc, (uint32_t start_addr, uint32_t length), (start_addr, length));
+
+
+
+// AIRegisterDMACallback stores the callback in the guest global at 0x80386480.
+// Returns the old callback pointer.
+extern "C" uint32_t AIRegisterDMACallback_80123f88(uint32_t callback)
+{
+    uint32_t old_callback = 0;
+    Memory::TryRead32(kAIDmaCallbackAddr, old_callback);
+    Memory::TryWrite32(kAIDmaCallbackAddr, callback);
+    {
+        std::lock_guard<std::mutex> lock(g_ai.mutex);
+        g_ai.callback = callback;
+        g_ai.loggedMissingCallback = false;
+    }
+    return old_callback;
+}
+PPC_NATIVE_OVERRIDE(80123f88, AIRegisterDMACallback_80123f88, uint32_t, (uint32_t callback), (callback));
+
+// AIStartDMA toggles the AI DMA control register on hardware. Keep the guest-visible
+// DMA state here and let the VI tick advance the hardware boundary.
+extern "C" void AIStartDMA_80124048()
+{
+    const uint32_t rate = kDefaultSampleRate;
+    {
+        std::lock_guard<std::mutex> lock(g_ai.mutex);
+        g_ai.sampleRate = rate;
+        g_ai.enabled = true;
+        g_ai.bytesLeft = g_ai.length;
+    }
+    if (!EnsureAudioBackend(rate)) {
+        ReportAudioProblem("AIStartDMA", "audio backend init failed");
+    }
+}
+
+PPC_NATIVE_OVERRIDE_VOID(80124048, AIStartDMA_80124048, (), ());
+
+extern "C" uint32_t AIGetDMABytesLeft_8012405c()
+{
+    std::lock_guard<std::mutex> lock(g_ai.mutex);
+    return g_ai.bytesLeft;
+}
+PPC_NATIVE_OVERRIDE(8012405C, AIGetDMABytesLeft_8012405c, uint32_t, (), ());
+
+extern "C" uint32_t AIGetDMAStartAddr_8012406c()
+{
+    std::lock_guard<std::mutex> lock(g_ai.mutex);
+    return g_ai.registerStartAddr;
+}
+PPC_NATIVE_OVERRIDE(8012406C, AIGetDMAStartAddr_8012406c, uint32_t, (), ());
+
+extern "C" uint32_t AIGetDMALength_80124084()
+{
+    std::lock_guard<std::mutex> lock(g_ai.mutex);
+    return g_ai.length;
+}
+PPC_NATIVE_OVERRIDE(80124084, AIGetDMALength_80124084, uint32_t, (), ());
+
+extern "C" uint32_t AIGetDSPSampleRate_8012409c()
+{
+    std::lock_guard<std::mutex> lock(g_ai.mutex);
+    // SDK AIGetDSPSampleRate returns AIDFR^1: 0 for 32 kHz, 1 for 48 kHz.
+    return (g_ai.sampleRate == 48000u) ? 1u : 0u;
+}
+PPC_NATIVE_OVERRIDE(8012409C, AIGetDSPSampleRate_8012409c, uint32_t, (), ());
+
+extern "C" void DSPSendMailToDSP_8015d430(uint32_t mail)
+{
+    AxDspHle::SendMailToDSP(mail);
+}
+PPC_NATIVE_OVERRIDE_VOID(8015D430, DSPSendMailToDSP_8015d430, (uint32_t mail), (mail));
+
+extern "C" void SoundPlayerSetVolume_800a35e0(uint32_t soundPlayer, float volume)
+{
+    MusicAttenuation::SetSoundPlayerVolume(soundPlayer, volume);
+}
+
+PPC_NATIVE_OVERRIDE_VOID(800A35E0, SoundPlayerSetVolume_800a35e0,
+              (uint32_t soundPlayer, float volume), (soundPlayer, volume));
+
+extern "C" uint32_t DSPCheckMailToDSP_8015d3fc()
+{
+    return AxDspHle::CheckMailToDSP();
+}
+PPC_NATIVE_OVERRIDE(8015D3FC, DSPCheckMailToDSP_8015d3fc, uint32_t, (), ());
+
+extern "C" uint32_t DSPCheckMailFromDSP_8015d40c()
+{
+    return AxDspHle::CheckMailFromDSP();
+}
+REGISTER_NATIVE_FUNCTION(0x8015D40C, DSPCheckMailFromDSP_8015d40c);
+
+extern "C" uint32_t DSPReadMailFromDSP_8015d41c()
+{
+    return AxDspHle::ReadMailFromDSP();
+}
+REGISTER_NATIVE_FUNCTION(0x8015D41C, DSPReadMailFromDSP_8015d41c);
+
+extern "C" uint32_t DSPAssertTask_8015d57c(uint32_t taskPtr)
+{
+    return AxDspHle::AssertTask(taskPtr);
+}
+PPC_NATIVE_OVERRIDE(8015D57C, DSPAssertTask_8015d57c, uint32_t, (uint32_t taskPtr), (taskPtr));
+
+// Each delivered block runs the AI DMA callback and deferred AX task callbacks before the
+// next block, preserving the SoundThread/DSP interleave order real hardware provides.
+void Audio_HLE_Tick(CpuContext* ctx, uint32_t deltaMicros)
+{
+    uint32_t startAddr = 0;
+    uint32_t length = 0;
+    uint32_t callback = 0;
+    uint32_t sampleRate = kDefaultSampleRate;
+    bool enabled = false;
+
+    {
+        std::lock_guard<std::mutex> lock(g_ai.mutex);
+        enabled = g_ai.enabled;
+        startAddr = g_ai.startAddr;
+        length = g_ai.length;
+        callback = g_ai.callback;
+        sampleRate = g_ai.sampleRate;
+
+        if (enabled && startAddr != 0 && length != 0 && sampleRate != 0) {
+            // SoundThread can hit the idle scheduler before the outer AXOut frame finishes;
+            // retain elapsed time here rather than recursively entering the singleton AI/AX device.
+            g_ai.accumulatorSeconds += static_cast<double>(deltaMicros) / 1'000'000.0;
+            if (g_ai.tickActive) {
+                return;
+            }
+            g_ai.tickActive = true;
+        }
+    }
+
+    if (!enabled || startAddr == 0 || length == 0 || sampleRate == 0) {
+        return;
+    }
+
+    // Resets tickActive on early return; the normal exit path disarms this and clears the
+    // flag itself while already holding the mutex, avoiding a redundant lock acquisition.
+    struct ActiveTickReset {
+        bool armed = true;
+        ~ActiveTickReset()
+        {
+            if (!armed) {
+                return;
+            }
+            std::lock_guard<std::mutex> lock(g_ai.mutex);
+            g_ai.tickActive = false;
+        }
+    } activeTickReset;
+
+    const double bytesPerSecond = static_cast<double>(sampleRate) * kAudioChannels * kBytesPerSample;
+    const double blockDuration = static_cast<double>(length) / bytesPerSecond;
+    if (blockDuration <= 0.0) {
+        return;
+    }
+
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    CpuContextScope scope(cpu);
+
+    int blocksCompleted = 0;
+    while (true) {
+        // Claim the block in one critical section; sample-then-consume separately gains
+        // nothing since the callback below (the only reentrancy point) runs mutex-released.
+        {
+            std::lock_guard<std::mutex> lock(g_ai.mutex);
+            if (g_ai.accumulatorSeconds < blockDuration) {
+                break;
+            }
+            g_ai.accumulatorSeconds -= blockDuration;
+            g_ai.bytesLeft = 0;
+        }
+
+        // Everything below reads what the AX mix wrote (PushAudioBlock) or runs guest code
+        // that reads its PB write-back and aux buffers (__AXOutNewFrame via the AI DMA
+        // callback), so the mix worker must finish first; the join also publishes its
+        // aux-out shadow.
+        AxDspHle::JoinMixWorker();
+
+        if (!EnsureAudioBackend(sampleRate)) {
+            std::lock_guard<std::mutex> lock(g_ai.mutex);
+            if (!g_ai.loggedBackendFailure) {
+                g_ai.loggedBackendFailure = true;
+                ReportAudioProblem("Audio", "audio backend unavailable; dropping samples");
+            }
+        } else {
+            const bool pushed = PushAudioBlock(startAddr, length);
+            if (!pushed) {
+                std::lock_guard<std::mutex> lock(g_ai.mutex);
+                if (!g_ai.loggedAccessFailure) {
+                    g_ai.loggedAccessFailure = true;
+                    ReportAudioProblem("Audio", "failed to read DMA buffer; disabling audio DMA");
+                }
+                g_ai.enabled = false;
+                return;
+            }
+        }
+
+        if (callback != 0) {
+            // Pointer lookup avoids copying the registry record per audio block.
+            const auto* info = TranslatedFunctionRegistry::FindByAddressPtr(callback);
+            if (!info || !info->rawCpuInvoker) {
+                std::lock_guard<std::mutex> lock(g_ai.mutex);
+                if (!g_ai.loggedMissingCallback) {
+                    g_ai.loggedMissingCallback = true;
+                    ReportAudioProblem("Audio", "AI DMA callback not registered; skipping");
+                }
+            } else {
+                Memory::TryWrite32(kAICallbackBusyAddr, 1);
+                InvokeIndirectCpu(callback, cpu);
+                Memory::TryWrite32(kAICallbackBusyAddr, 0);
+                AxDspHle::ServiceDeferredCallbacks();
+            }
+        }
+
+        {
+            std::lock_guard<std::mutex> lock(g_ai.mutex);
+            startAddr = g_ai.startAddr;
+            length = g_ai.length;
+            callback = g_ai.callback;
+            sampleRate = g_ai.sampleRate;
+            g_ai.bytesLeft = g_ai.length;
+        }
+
+        if (++blocksCompleted >= kMaxBlocksPerTick) {
+            break;
+        }
+    }
+
+    {
+        std::lock_guard<std::mutex> lock(g_ai.mutex);
+        if (g_ai.length != 0) {
+            const double bytesRemaining = g_ai.length * (g_ai.accumulatorSeconds / blockDuration);
+            if (bytesRemaining < static_cast<double>(g_ai.length)) {
+                g_ai.bytesLeft = g_ai.length - static_cast<uint32_t>(bytesRemaining);
+            }
+        }
+        g_ai.tickActive = false;
+        activeTickReset.armed = false;
+    }
+}
+
+namespace {
+
+// Wall-clock delta since the previous poll, from whichever pump ran it. All
+// pumps live on the guest thread, so the one thread_local cursor is shared and
+// no interval is ever counted twice or dropped between them.
+int64_t ConsumeAudioPollDeltaMicros()
+{
+    using Clock = std::chrono::steady_clock;
+    static thread_local Clock::time_point lastPoll = Clock::now();
+
+    const Clock::time_point now = Clock::now();
+    auto elapsed = std::chrono::duration_cast<std::chrono::microseconds>(now - lastPoll).count();
+    lastPoll = now;
+
+    if (elapsed < 0) {
+        elapsed = 0;
+    }
+
+    // Cap the catch-up interval after a debugger pause or host stall; backlog drains via
+    // kMaxBlocksPerTick per pass. Never return early on a zero delta: two scheduler passes
+    // can land in the same microsecond and the backlog still needs servicing.
+    constexpr int64_t kMaxPollDeltaMicros = 100'000;
+    return std::min(elapsed, kMaxPollDeltaMicros);
+}
+
+} // namespace
+
+void Audio_HLE_Poll(CpuContext* ctx)
+{
+    MusicAttenuation::TickGuest();
+    Audio_HLE_Tick(ctx, static_cast<uint32_t>(ConsumeAudioPollDeltaMicros()));
+}
+
+void Audio_HLE_PollDeferred()
+{
+    if (!OS_HLE_InterruptsEnabled()) {
+        // Leave the elapsed interval unconsumed so the next poll still sees it.
+        return;
+    }
+
+    GuestInterruptCallbackContext interrupt;
+    CpuContext* cpu = interrupt.get();
+
+    OS_HLE_BeginDeferredGuestCallbacks();
+    try {
+        Audio_HLE_Tick(cpu, static_cast<uint32_t>(ConsumeAudioPollDeltaMicros()));
+    } catch (...) {
+        OS_HLE_EndDeferredGuestCallbacks();
+        throw;
+    }
+    OS_HLE_EndDeferredGuestCallbacks();
+}
diff --git a/runtime/src/hle/audio/ax_dsp.h b/runtime/src/hle/audio/ax_dsp.h
new file mode 100644
index 0000000..8c5f169
--- /dev/null
+++ b/runtime/src/hle/audio/ax_dsp.h
@@ -0,0 +1,36 @@
+#pragma once
+
+#include <cstdint>
+
+struct CpuContext;
+
+namespace AxDspHle {
+
+void Init();
+void InitForAXOut(CpuContext* ctx);
+void Stop();
+
+uint32_t CheckInit();
+uint32_t AddTask(uint32_t taskPtr);
+void SendMailToDSP(uint32_t mail);
+uint32_t CheckMailToDSP();
+uint32_t CheckMailFromDSP();
+uint32_t ReadMailFromDSP();
+uint32_t AssertTask(uint32_t taskPtr);
+void ServiceDeferredCallbacks();
+
+// INVARIANT: no guest code may observe mix output before this returns. Called from
+// Audio_HLE_Tick before the AI DMA block reaches the backend and before the AI callback
+// runs __AXOutNewFrame, the two places guest code reads the mix's PB/output/aux data.
+// Cheap when the mix already finished (the normal case).
+void JoinMixWorker();
+
+// Joins and tears down the mix worker thread. Call before the guest memory map
+// is destroyed or re-created.
+void ShutdownMixWorker();
+
+void SetMixWorkerEnabled(bool enabled);
+
+void InitAram();
+
+}
diff --git a/runtime/src/hle/audio/ax_effects.cpp b/runtime/src/hle/audio/ax_effects.cpp
new file mode 100644
index 0000000..a30a4ac
--- /dev/null
+++ b/runtime/src/hle/audio/ax_effects.cpp
@@ -0,0 +1,375 @@
+#include "abi_bridge.h"
+#include "isa/big_endian.h"
+#include "hle_stubs.h"
+#include "memory.h"
+#include "ppc_runtime.h"
+
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+
+extern "C" void func_8012B830(CpuContext* ctx);
+
+#if defined(__clang__)
+// PowerPC uses discrete fmuls/fadds; a fused multiply-add would change sample rounding.
+#pragma clang fp contract(off)
+#endif
+
+namespace {
+namespace ReverbStd {
+
+constexpr uint32_t kSamplesPerFrame = 96;
+constexpr uint32_t kChannels = 3;
+
+// .sdata2 constants the guest function loads through r2.
+constexpr uint32_t kOneConstantAddr = 0x80388588u;   // 1.0f
+constexpr uint32_t kScaleConstantAddr = 0x8038858Cu; // 0.6f send pre-scale
+
+// AXFX_REVERBSTD_EXP field offsets (byte offsets into the struct in r4).
+constexpr uint32_t kFieldPreDelayCoef = 0x18;
+constexpr uint32_t kFieldEarlyLength = 0x2C;
+constexpr uint32_t kFieldComb1Coef = 0x64;
+constexpr uint32_t kFieldComb2Coef = 0x68;
+constexpr uint32_t kFieldAllpassCoef = 0x9C;
+constexpr uint32_t kFieldLastAllpass = 0xA0; // + channel * 4
+constexpr uint32_t kFieldDamping = 0xAC;
+constexpr uint32_t kFieldFlags = 0xB0;
+constexpr uint32_t kFieldDryPreScale = 0xD0;
+constexpr uint32_t kFieldWetPreScale = 0xD4;
+constexpr uint32_t kFieldAuxInputBuffers = 0xD8;
+constexpr uint32_t kFieldAuxOutputBuffers = 0xDC;
+constexpr uint32_t kFieldMainOutGain = 0xE0;
+constexpr uint32_t kFieldAuxOutGain = 0xE4;
+constexpr uint32_t kStateStructBytes = 0xE8;
+
+enum RingId : uint32_t {
+    kRingPreDelay = 0,
+    kRingEarly,
+    kRingComb1,
+    kRingComb2,
+    kRingAllpass1,
+    kRingAllpass2,
+    kRingCount,
+};
+
+struct RingLayout {
+    uint32_t bufferField;   // Channel 0 buffer pointer.
+    uint32_t channelStride; // Byte stride between channel buffer pointers.
+    uint32_t indexField;
+    uint32_t lengthField;
+};
+
+constexpr RingLayout kRingLayout[kRingCount] = {
+    {0x00, 4, 0x0C, 0x10}, // Pre-delay comb.
+    {0x1C, 4, 0x28, 0x2C}, // Early reflection tap (optional).
+    {0x34, 8, 0x4C, 0x54}, // Comb 1 (per-channel pointers interleave with comb 2).
+    {0x38, 8, 0x50, 0x58}, // Comb 2.
+    {0x6C, 8, 0x84, 0x8C}, // Allpass 1 (interleaves with allpass 2).
+    {0x70, 8, 0x88, 0x90}, // Allpass 2.
+};
+
+struct Frame {
+    uint8_t* ring[kRingCount][kChannels]{};
+    uint32_t ringIndex[kRingCount]{};
+    uint32_t ringLength[kRingCount]{};
+    uint8_t* main[kChannels]{};
+    const uint8_t* auxIn[kChannels]{};
+    uint8_t* auxOut[kChannels]{};
+    float lastAllpass[kChannels]{};
+    float preDelayCoef = 0.0f;
+    float comb1Coef = 0.0f;
+    float comb2Coef = 0.0f;
+    float allpassCoef = 0.0f;
+    float damping = 0.0f;
+    float oneMinusDamping = 0.0f;
+    float dryScale = 0.0f;
+    float wetScale = 0.0f;
+    float mainGain = 0.0f;
+    float auxGain = 0.0f;
+    bool hasEarly = false;
+    bool hasAuxIn = false;
+    bool hasAuxOut = false;
+};
+
+inline float LoadFloat(const uint8_t* host) {
+    return BigEndian::ReadFloat32(host);
+}
+
+inline void StoreFloat(uint8_t* host, float value) {
+    BigEndian::WriteFloat32(host, value);
+}
+
+inline int32_t LoadS32(const uint8_t* host) {
+    return static_cast<int32_t>(BigEndian::Read32(host));
+}
+
+inline void StoreS32(uint8_t* host, int32_t value) {
+    BigEndian::Write32(host, static_cast<uint32_t>(value));
+}
+
+// PowerPC fctiwz: round toward zero, saturating out-of-range and NaN exactly the
+// way runtime/src/fpu_helpers.cpp does for the translated form.
+inline int32_t ConvertToIntegerWord(float value) {
+    const double wide = static_cast<double>(value);
+    if (std::isnan(wide)) {
+        return static_cast<int32_t>(0x80000000u);
+    }
+    if (wide >= 2147483647.0) {
+        return 2147483647;
+    }
+    if (wide <= -2147483648.0) {
+        return static_cast<int32_t>(0x80000000u);
+    }
+    return static_cast<int32_t>(wide);
+}
+
+// Guest-thread-only range resolver. Deliberately NOT the mix's MixResolveRange: this
+// callback must materialize deferred GX reads through the page table, which the
+// worker-safe resolver refuses to do by design.
+uint8_t* ResolveGuestThreadRange(uint32_t addr, size_t bytes) {
+    if (addr == 0 || bytes == 0) {
+        return nullptr;
+    }
+    if (uint8_t* fast = MemoryInline::GetPointerFast(addr, bytes)) {
+        return fast;
+    }
+    // A ring buffer may straddle the inline page granularity; the region lookup
+    // still returns one contiguous host mapping for the whole range.
+    try {
+        return Memory::GetPointer(addr, bytes);
+    } catch (const Memory::AccessViolation&) {
+        return nullptr;
+    }
+}
+
+// Collects everything the render loop needs. Returns false when the layout is
+// not one this port can serve bit-exactly, in which case the caller must run the
+// translated function instead.
+bool BuildFrame(uint32_t buffersAddr, uint32_t stateAddr, Frame& frame) {
+    if (buffersAddr == 0 || stateAddr == 0) {
+        return false;
+    }
+    if (!Memory::Contains(stateAddr, kStateStructBytes)) {
+        return false;
+    }
+
+    const uint32_t auxInputBuffers = Memory::Read32(stateAddr + kFieldAuxInputBuffers);
+    const uint32_t auxOutputBuffers = Memory::Read32(stateAddr + kFieldAuxOutputBuffers);
+    frame.hasAuxIn = auxInputBuffers != 0;
+    frame.hasAuxOut = auxOutputBuffers != 0;
+
+    constexpr size_t kFrameBytes = kSamplesPerFrame * sizeof(int32_t);
+    for (uint32_t channel = 0; channel < kChannels; ++channel) {
+        frame.main[channel] =
+            ResolveGuestThreadRange(Memory::Read32(buffersAddr + channel * 4), kFrameBytes);
+        if (!frame.main[channel]) {
+            return false;
+        }
+        if (frame.hasAuxIn) {
+            frame.auxIn[channel] =
+                ResolveGuestThreadRange(Memory::Read32(auxInputBuffers + channel * 4), kFrameBytes);
+            if (!frame.auxIn[channel]) {
+                return false;
+            }
+        }
+        if (frame.hasAuxOut) {
+            frame.auxOut[channel] =
+                ResolveGuestThreadRange(Memory::Read32(auxOutputBuffers + channel * 4), kFrameBytes);
+            if (!frame.auxOut[channel]) {
+                return false;
+            }
+        }
+    }
+
+    frame.hasEarly = Memory::Read32(stateAddr + kFieldEarlyLength) != 0;
+    for (uint32_t ring = 0; ring < kRingCount; ++ring) {
+        const RingLayout& layout = kRingLayout[ring];
+        frame.ringLength[ring] = Memory::Read32(stateAddr + layout.lengthField);
+        frame.ringIndex[ring] = Memory::Read32(stateAddr + layout.indexField);
+        if (ring == kRingEarly && !frame.hasEarly) {
+            continue;
+        }
+        // The guest maintains index < length; anything else means the struct is
+        // not initialized the way this port assumes.
+        if (frame.ringLength[ring] == 0 || frame.ringIndex[ring] >= frame.ringLength[ring]) {
+            return false;
+        }
+        for (uint32_t channel = 0; channel < kChannels; ++channel) {
+            frame.ring[ring][channel] = ResolveGuestThreadRange(
+                Memory::Read32(stateAddr + layout.bufferField + channel * layout.channelStride),
+                static_cast<size_t>(frame.ringLength[ring]) * sizeof(float));
+            if (!frame.ring[ring][channel]) {
+                return false;
+            }
+        }
+    }
+
+    const float sendScale = Memory::ReadFloat32(kScaleConstantAddr);
+    const float one = Memory::ReadFloat32(kOneConstantAddr);
+    frame.damping = Memory::ReadFloat32(stateAddr + kFieldDamping);
+    frame.oneMinusDamping = one - frame.damping;
+    frame.dryScale = sendScale * Memory::ReadFloat32(stateAddr + kFieldDryPreScale);
+    frame.wetScale = sendScale * Memory::ReadFloat32(stateAddr + kFieldWetPreScale);
+    frame.preDelayCoef = Memory::ReadFloat32(stateAddr + kFieldPreDelayCoef);
+    frame.comb1Coef = Memory::ReadFloat32(stateAddr + kFieldComb1Coef);
+    frame.comb2Coef = Memory::ReadFloat32(stateAddr + kFieldComb2Coef);
+    frame.allpassCoef = Memory::ReadFloat32(stateAddr + kFieldAllpassCoef);
+    frame.mainGain = Memory::ReadFloat32(stateAddr + kFieldMainOutGain);
+    frame.auxGain = Memory::ReadFloat32(stateAddr + kFieldAuxOutGain);
+    for (uint32_t channel = 0; channel < kChannels; ++channel) {
+        frame.lastAllpass[channel] = Memory::ReadFloat32(stateAddr + kFieldLastAllpass + channel * 4);
+    }
+    return true;
+}
+
+void Render(uint32_t stateAddr, Frame& frame) {
+    uint32_t index[kRingCount];
+    for (uint32_t ring = 0; ring < kRingCount; ++ring) {
+        index[ring] = frame.ringIndex[ring];
+    }
+
+    for (uint32_t sample = 0; sample < kSamplesPerFrame; ++sample) {
+        const uint32_t preDelayOffset = index[kRingPreDelay] * 4u;
+        const uint32_t earlyOffset = index[kRingEarly] * 4u;
+        const uint32_t comb1Offset = index[kRingComb1] * 4u;
+        const uint32_t comb2Offset = index[kRingComb2] * 4u;
+        const uint32_t allpass1Offset = index[kRingAllpass1] * 4u;
+        const uint32_t allpass2Offset = index[kRingAllpass2] * 4u;
+        const uint32_t frameOffset = sample * 4u;
+
+        for (uint32_t channel = 0; channel < kChannels; ++channel) {
+            uint8_t* const mainSlot = frame.main[channel] + frameOffset;
+            int32_t rawInput = LoadS32(mainSlot);
+            if (frame.hasAuxIn) {
+                rawInput = static_cast<int32_t>(
+                    static_cast<uint32_t>(rawInput) +
+                    static_cast<uint32_t>(LoadS32(frame.auxIn[channel] + frameOffset)));
+            }
+            const float input = static_cast<float>(rawInput);
+
+            // Pre-delay comb: the tap that leaves the buffer also feeds the dry
+            // (early) send. Every product is its own statement so the host
+            // compiler cannot fuse a multiply into the following add.
+            uint8_t* const preDelaySlot = frame.ring[kRingPreDelay][channel] + preDelayOffset;
+            const float preDelayTap = LoadFloat(preDelaySlot);
+            const float preDelayFeedback = preDelayTap * frame.preDelayCoef;
+            StoreFloat(preDelaySlot, input + preDelayFeedback);
+
+            float excite = input;
+            if (frame.hasEarly) {
+                uint8_t* const earlySlot = frame.ring[kRingEarly][channel] + earlyOffset;
+                excite = LoadFloat(earlySlot);
+                StoreFloat(earlySlot, input);
+            }
+
+            const float dry = preDelayTap * frame.dryScale;
+
+            uint8_t* const comb1Slot = frame.ring[kRingComb1][channel] + comb1Offset;
+            const float comb1Tap = LoadFloat(comb1Slot);
+            const float comb1Feedback = comb1Tap * frame.comb1Coef;
+            StoreFloat(comb1Slot, excite + comb1Feedback);
+
+            uint8_t* const comb2Slot = frame.ring[kRingComb2][channel] + comb2Offset;
+            const float comb2Tap = LoadFloat(comb2Slot);
+            const float comb2Feedback = comb2Tap * frame.comb2Coef;
+            const float combSum = comb1Tap + comb2Tap;
+            StoreFloat(comb2Slot, excite + comb2Feedback);
+
+            uint8_t* const allpass1Slot = frame.ring[kRingAllpass1][channel] + allpass1Offset;
+            const float allpass1Tap = LoadFloat(allpass1Slot);
+            const float allpass1Feedback = allpass1Tap * frame.allpassCoef;
+            const float allpass1Store = combSum + allpass1Feedback;
+            StoreFloat(allpass1Slot, allpass1Store);
+            const float allpass1Feedforward = allpass1Store * frame.allpassCoef;
+            const float allpass1Out = allpass1Tap - allpass1Feedforward;
+
+            const float dampedNew = frame.oneMinusDamping * allpass1Out;
+            const float dampedOld = frame.damping * frame.lastAllpass[channel];
+            const float damped = dampedNew + dampedOld;
+            frame.lastAllpass[channel] = damped;
+
+            uint8_t* const allpass2Slot = frame.ring[kRingAllpass2][channel] + allpass2Offset;
+            const float allpass2Tap = LoadFloat(allpass2Slot);
+            const float allpass2Feedback = allpass2Tap * frame.allpassCoef;
+            const float allpass2Store = damped + allpass2Feedback;
+            StoreFloat(allpass2Slot, allpass2Store);
+            const float allpass2Feedforward = allpass2Store * frame.allpassCoef;
+            const float allpass2Out = allpass2Tap - allpass2Feedforward;
+
+            const float wet = allpass2Out * frame.wetScale;
+            const float mixed = dry + wet;
+            const float mainSample = mixed * frame.mainGain;
+            StoreS32(mainSlot, ConvertToIntegerWord(mainSample));
+            if (frame.hasAuxOut) {
+                const float auxSample = mixed * frame.auxGain;
+                StoreS32(frame.auxOut[channel] + frameOffset, ConvertToIntegerWord(auxSample));
+            }
+        }
+
+        for (uint32_t ring = 0; ring < kRingCount; ++ring) {
+            if (ring == kRingEarly && !frame.hasEarly) {
+                continue;
+            }
+            const uint32_t next = index[ring] + 1u;
+            index[ring] = next < frame.ringLength[ring] ? next : 0u;
+        }
+    }
+
+    // The guest writes these back every sample; nothing can observe the
+    // intermediate values, so one store per field at the end is equivalent.
+    for (uint32_t ring = 0; ring < kRingCount; ++ring) {
+        if (ring == kRingEarly && !frame.hasEarly) {
+            continue;
+        }
+        Memory::Write32(stateAddr + kRingLayout[ring].indexField, index[ring]);
+    }
+    for (uint32_t channel = 0; channel < kChannels; ++channel) {
+        Memory::WriteFloat32(stateAddr + kFieldLastAllpass + channel * 4,
+                             static_cast<double>(frame.lastAllpass[channel]));
+    }
+}
+
+} // namespace ReverbStd
+} // namespace
+
+extern "C" void AXFXReverbStdExpCallback_8012b830(CpuContext* ctx) {
+    if (!ctx) {
+        return;
+    }
+
+    const uint32_t buffersAddr = ctx->gpr[3];
+    const uint32_t stateAddr = ctx->gpr[4];
+
+    uint32_t flags = 0;
+    try {
+        flags = Memory::Read32(stateAddr + ReverbStd::kFieldFlags);
+    } catch (const Memory::AccessViolation&) {
+        func_8012B830(ctx);
+        return;
+    }
+    if (flags != 0) {
+        // Reset request: the guest clears the "in progress" bit and skips the
+        // frame entirely.
+        Memory::Write32(stateAddr + ReverbStd::kFieldFlags, flags & ~2u);
+        return;
+    }
+
+    ReverbStd::Frame frame;
+    bool built = false;
+    try {
+        built = ReverbStd::BuildFrame(buffersAddr, stateAddr, frame);
+    } catch (const Memory::AccessViolation&) {
+        built = false;
+    }
+    if (!built) {
+        func_8012B830(ctx);
+        return;
+    }
+
+    ReverbStd::Render(stateAddr, frame);
+}
+
+REGISTER_NATIVE_FUNCTION_AS(0x8012B830, AXFXReverbStdExpCallback_8012b830,
+                            "AXFXReverbStdExpCallback_8012b830");
diff --git a/runtime/src/hle/audio/ax_internal.h b/runtime/src/hle/audio/ax_internal.h
new file mode 100644
index 0000000..734d9ee
--- /dev/null
+++ b/runtime/src/hle/audio/ax_internal.h
@@ -0,0 +1,651 @@
+#pragma once
+
+// AX/DSP HLE internals shared within this directory; ax_dsp.h is the public surface.
+// Hot accessors stay header-inline because the shipped build links runtime shards without LTO.
+
+#include "isa/big_endian.h"
+#include "memory.h"
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <type_traits>
+
+namespace AxDspHle {
+
+constexpr uint32_t kMailCmdList = 0xBABE0000u;
+constexpr uint32_t kMailCmdListMask = 0xFFFF0000u;
+constexpr uint32_t kTaskMailToCpu = 0xDCD10000u;
+constexpr uint32_t kTaskMailToDsp = 0xCDD10000u;
+constexpr uint32_t kDspInit = kTaskMailToCpu | 0x0000u;
+constexpr uint32_t kDspResume = kTaskMailToCpu | 0x0001u;
+constexpr uint32_t kDspYield = kTaskMailToCpu | 0x0002u;
+constexpr uint32_t kDspDone = kTaskMailToCpu | 0x0003u;
+constexpr uint32_t kDspSync = kTaskMailToCpu | 0x0004u;
+constexpr uint32_t kMailResume = kTaskMailToDsp | 0x0000u;
+constexpr uint32_t kMailNewUCode = kTaskMailToDsp | 0x0001u;
+constexpr uint32_t kMailReset = kTaskMailToDsp | 0x0002u;
+constexpr size_t kResamplingCoefficientCount = 0x800;
+constexpr uint32_t kMailContinue = kTaskMailToDsp | 0x0003u;
+constexpr uint32_t kAxSamplesPerFrame = 96u;
+constexpr uint32_t kAxDspTaskAddr = 0x802F81A0u;
+constexpr uint32_t kDspInitializedAddr = 0x80386608u;
+constexpr uint32_t kDspAssertPendingAddr = 0x80386610u;
+constexpr uint32_t kDspAssertTaskAddr = 0x80386614u;
+constexpr uint32_t kDspCurrentTaskAddr = 0x8038661Cu;
+constexpr uint32_t kDspFirstTaskAddr = 0x80386620u;
+constexpr uint32_t kDspRunningTaskAddr = 0x80386624u;
+constexpr uint32_t kAxIramMmemAddr = 0x8027F820u;
+constexpr uint32_t kAxDramMmemAddr = 0x802F8200u;
+constexpr uint32_t kAxDramLength = 64u;
+constexpr uint32_t kAxDramDspAddr = 3282u;
+constexpr uint32_t kAxInitCallback = 0x80126948u;
+constexpr uint32_t kAxResumeCallback = 0x80126954u;
+constexpr uint32_t kAxDoneCallback = 0x801269A8u;
+constexpr uint32_t kAxRequestCallback = 0x801269B8u;
+
+extern uint32_t g_axTaskPtr;
+
+// The mix worker must resolve guest addresses only via the MEM1/MEM2 region bases below, never
+// via MemoryInline::GetPointerFast or the flat guest view: GX deferred (EFB) reads rewrite the
+// page table and flip protections from the guest thread behind its back, but the MEM1/MEM2 host
+// alias is never reprotected.
+extern std::atomic<uint8_t*> g_mixMem1;
+extern std::atomic<uint8_t*> g_mixMem2;
+
+// True only on the mix worker thread. Guest-thread callers keep the exact
+// fallback behaviour they had before (Memory::Read*/Write*, which materializes
+// deferred reads and reports access violations); the worker instead fails safe.
+extern thread_local bool t_onMixWorker;
+
+void ReportMixAddressOutOfRange(uint32_t addr, size_t bytes);
+
+void RefreshMixMemoryMap();
+
+// Host pointer for a guest range that lies entirely inside MEM1 or MEM2 through
+// any of their physical/cached/uncached aliases; nullptr otherwise.
+inline uint8_t* MixResolveRange(uint32_t addr, size_t bytes) {
+    if (bytes == 0 || bytes > Memory::kMem2Size) {
+        return nullptr;
+    }
+    if (addr > UINT32_MAX - static_cast<uint32_t>(bytes - 1)) {
+        return nullptr;
+    }
+
+    constexpr uint32_t kMem1Size = static_cast<uint32_t>(Memory::kMem1Size);
+    constexpr uint32_t kMem2Size = static_cast<uint32_t>(Memory::kMem2Size);
+
+    uint32_t offset = 0;
+    bool inMem1 = false;
+    if (addr < kMem1Size) {
+        offset = addr;
+        inMem1 = true;
+    } else if (addr - Memory::kMem1CachedBase < kMem1Size) {
+        offset = addr - Memory::kMem1CachedBase;
+        inMem1 = true;
+    } else if (addr - Memory::kMem1UncachedBase < kMem1Size) {
+        offset = addr - Memory::kMem1UncachedBase;
+        inMem1 = true;
+    }
+    if (inMem1) {
+        if (bytes > kMem1Size - offset) {
+            return nullptr;
+        }
+        uint8_t* base = g_mixMem1.load(std::memory_order_relaxed);
+        return base != nullptr ? base + offset : nullptr;
+    }
+
+    bool inMem2 = false;
+    if (addr - Memory::kMem2PhysicalBase < kMem2Size) {
+        offset = addr - Memory::kMem2PhysicalBase;
+        inMem2 = true;
+    } else if (addr - Memory::kMem2CachedBase < kMem2Size) {
+        offset = addr - Memory::kMem2CachedBase;
+        inMem2 = true;
+    } else if (addr - Memory::kMem2UncachedBase < kMem2Size) {
+        offset = addr - Memory::kMem2UncachedBase;
+        inMem2 = true;
+    }
+    if (inMem2) {
+        if (bytes > kMem2Size - offset) {
+            return nullptr;
+        }
+        uint8_t* base = g_mixMem2.load(std::memory_order_relaxed);
+        return base != nullptr ? base + offset : nullptr;
+    }
+    return nullptr;
+}
+
+// One body for the two guest widths the mix reads, so the worker-safety fallback above can
+// only ever be got right or wrong once; stays header-inline since the shipped build has no LTO.
+template <typename T>
+inline T MixReadBE(uint32_t addr) {
+    static_assert(std::is_same<T, uint16_t>::value || std::is_same<T, uint32_t>::value,
+                  "the AX mix only reads 16- and 32-bit guest words");
+    if (const uint8_t* host = MixResolveRange(addr, sizeof(T))) {
+        T value = 0;
+        std::memcpy(&value, host, sizeof(value));
+        if constexpr (std::is_same<T, uint16_t>::value) {
+            return MemoryInline::ByteSwap16(value);
+        } else {
+            return MemoryInline::ByteSwap32(value);
+        }
+    }
+    if (t_onMixWorker) {
+        ReportMixAddressOutOfRange(addr, sizeof(T));
+        return 0;
+    }
+    if constexpr (std::is_same<T, uint16_t>::value) {
+        return Memory::Read16(addr);
+    } else {
+        return Memory::Read32(addr);
+    }
+}
+
+inline uint16_t MixRead16(uint32_t addr) { return MixReadBE<uint16_t>(addr); }
+
+inline uint32_t MixRead32(uint32_t addr) { return MixReadBE<uint32_t>(addr); }
+
+inline void MixWrite16(uint32_t addr, uint16_t value) {
+    if (uint8_t* host = MixResolveRange(addr, sizeof(uint16_t))) {
+        BigEndian::Write16(host, value);
+        return;
+    }
+    if (t_onMixWorker) {
+        ReportMixAddressOutOfRange(addr, sizeof(uint16_t));
+        return;
+    }
+    Memory::Write16(addr, value);
+}
+
+inline bool MixContains(uint32_t addr, size_t bytes) {
+    if (MixResolveRange(addr, bytes) != nullptr) {
+        return true;
+    }
+    return t_onMixWorker ? false : Memory::Contains(addr, bytes);
+}
+
+uint32_t ReadGuestU32OrZero(uint32_t addr);
+
+void MarkDspInitialized();
+
+void ResetDspTaskGlobals();
+
+void LinkSingleDspTask(uint32_t taskPtr);
+
+uint32_t HashEctorGuest(uint32_t addr, uint32_t length);
+
+void InvokeAxTaskCallback(uint32_t callbackOffset, bool passTask);
+
+// Voice sample fetch walks a contiguous guest range one byte at a time, so the
+// enclosing guest page is resolved once per window and reused.
+constexpr uint32_t kAramWindowShift = 12;
+constexpr uint32_t kAramWindowSize = 1u << kAramWindowShift;
+
+struct AramWindow {
+    uint32_t begin = 0;
+    uint32_t end = 0; // Exclusive. begin == end marks an empty window.
+    uint32_t generation = 0;
+    const uint8_t* host = nullptr;
+};
+
+// Bumped whenever the AX HLE (re)initializes so a cached host window can never
+// outlive the guest memory mapping it was resolved against.
+extern std::atomic<uint32_t> g_aramWindowGeneration;
+
+uint8_t ReadAramByteSlow(uint32_t addr);
+
+bool ResolveAramWindow(uint32_t addr, AramWindow& window);
+
+inline uint8_t ReadAramByte(uint32_t addr) {
+    static thread_local AramWindow window{};
+    if (addr >= window.begin && addr < window.end &&
+        window.generation == g_aramWindowGeneration.load(std::memory_order_relaxed)) {
+        return window.host[addr - window.begin];
+    }
+    if (ResolveAramWindow(addr, window)) {
+        return window.host[addr - window.begin];
+    }
+    return ReadAramByteSlow(addr);
+}
+
+enum class MailState {
+    WaitingForCmdListSize,
+    WaitingForCmdListAddress,
+    WaitingForNextTask,
+};
+
+enum class AXCommandLayout {
+    Auto,
+    New,
+    NewNoOutputVolume,
+    Old,
+};
+
+enum AXMixControl : uint32_t {
+    MIX_MAIN_L = 0x000001,
+    MIX_MAIN_L_RAMP = 0x000002,
+    MIX_MAIN_R = 0x000004,
+    MIX_MAIN_R_RAMP = 0x000008,
+    MIX_MAIN_S = 0x000010,
+    MIX_MAIN_S_RAMP = 0x000020,
+    MIX_AUXA_L = 0x000040,
+    MIX_AUXA_L_RAMP = 0x000080,
+    MIX_AUXA_R = 0x000100,
+    MIX_AUXA_R_RAMP = 0x000200,
+    MIX_AUXA_S = 0x000400,
+    MIX_AUXA_S_RAMP = 0x000800,
+    MIX_AUXB_L = 0x001000,
+    MIX_AUXB_L_RAMP = 0x002000,
+    MIX_AUXB_R = 0x004000,
+    MIX_AUXB_R_RAMP = 0x008000,
+    MIX_AUXB_S = 0x010000,
+    MIX_AUXB_S_RAMP = 0x020000,
+    MIX_AUXC_L = 0x040000,
+    MIX_AUXC_L_RAMP = 0x080000,
+    MIX_AUXC_R = 0x100000,
+    MIX_AUXC_R_RAMP = 0x200000,
+    MIX_AUXC_S = 0x400000,
+    MIX_AUXC_S_RAMP = 0x800000,
+};
+
+struct VolumeData {
+    uint16_t volume;
+    uint16_t volume_delta;
+};
+
+struct PBMixerWii {
+    VolumeData main_left, main_right;
+    VolumeData auxA_left, auxA_right;
+    VolumeData auxB_left, auxB_right;
+    VolumeData auxC_left, auxC_right;
+    VolumeData main_surround;
+    VolumeData auxA_surround;
+    VolumeData auxB_surround;
+    VolumeData auxC_surround;
+};
+
+struct PBInitialTimeDelay {
+    uint16_t on;
+    uint16_t addrMemHigh;
+    uint16_t addrMemLow;
+    uint16_t offsetLeft;
+    uint16_t offsetRight;
+    uint16_t targetLeft;
+    uint16_t targetRight;
+};
+
+struct PBDpopWii {
+    int16_t main_left;
+    int16_t auxA_left;
+    int16_t auxB_left;
+    int16_t auxC_left;
+    int16_t main_right;
+    int16_t auxA_right;
+    int16_t auxB_right;
+    int16_t auxC_right;
+    int16_t main_surround;
+    int16_t auxA_surround;
+    int16_t auxB_surround;
+    int16_t auxC_surround;
+};
+
+struct PBUpdatesWii {
+    uint16_t num_updates[3];
+    uint16_t data_hi;
+    uint16_t data_lo;
+};
+
+struct PBUpdate {
+    uint16_t pb_offset;
+    uint16_t new_value;
+};
+
+struct PBVolumeEnvelope {
+    int16_t cur_volume;
+    int16_t cur_volume_delta;
+};
+
+struct PBAudioAddr {
+    uint16_t looping;
+    uint16_t sample_format;
+    uint16_t loop_addr_hi;
+    uint16_t loop_addr_lo;
+    uint16_t end_addr_hi;
+    uint16_t end_addr_lo;
+    uint16_t cur_addr_hi;
+    uint16_t cur_addr_lo;
+};
+
+struct PBADPCMInfo {
+    int16_t coefs[16];
+    uint16_t gain;
+    uint16_t pred_scale;
+    int16_t yn1;
+    int16_t yn2;
+};
+
+struct PBSampleRateConverter {
+    uint16_t ratio_hi;
+    uint16_t ratio_lo;
+    uint16_t cur_addr_frac;
+    int16_t last_samples[4];
+};
+
+struct PBSampleRateConverterWM {
+    uint16_t cur_addr_frac;
+    int16_t last_samples[4];
+};
+
+struct PBADPCMLoopInfo {
+    uint16_t pred_scale;
+    uint16_t yn1;
+    uint16_t yn2;
+};
+
+struct PBLowPassFilter {
+    uint16_t on;
+    int16_t yn1;
+    uint16_t a0;
+    int16_t b0;
+};
+
+struct PBHighPassFilter {
+    uint16_t on;
+    uint16_t unk[3];
+};
+
+struct PBBiquadFilter {
+    uint16_t on;
+    int16_t xn1;
+    int16_t xn2;
+    int16_t yn1;
+    int16_t yn2;
+    int16_t b0;
+    int16_t b1;
+    int16_t b2;
+    int16_t a1;
+    int16_t a2;
+};
+
+struct PBMixerWM {
+    VolumeData main0, aux0;
+    VolumeData main1, aux1;
+    VolumeData main2, aux2;
+    VolumeData main3, aux3;
+};
+
+struct PBDpopWM {
+    int16_t main0;
+    int16_t main1;
+    int16_t main2;
+    int16_t main3;
+    int16_t aux0;
+    int16_t aux1;
+    int16_t aux2;
+    int16_t aux3;
+};
+
+union PBInfImpulseResponseWM {
+    uint16_t on;
+    PBLowPassFilter lpf;
+    PBBiquadFilter biquad;
+};
+
+struct AXPBWii {
+    uint16_t next_pb_hi;
+    uint16_t next_pb_lo;
+    uint16_t this_pb_hi;
+    uint16_t this_pb_lo;
+    uint16_t src_type;
+    uint16_t coef_select;
+    uint16_t mixer_control_hi;
+    uint16_t mixer_control_lo;
+    uint16_t running;
+    uint16_t is_stream;
+    PBMixerWii mixer;
+    PBInitialTimeDelay initial_time_delay;
+    PBDpopWii dpop;
+    PBUpdatesWii updates;
+    PBVolumeEnvelope vol_env;
+    PBAudioAddr audio_addr;
+    PBADPCMInfo adpcm;
+    PBSampleRateConverter src;
+    PBADPCMLoopInfo adpcm_loop_info;
+    PBLowPassFilter lpf;
+    union {
+        PBHighPassFilter hpf;
+        PBBiquadFilter biquad;
+    };
+    uint16_t remote;
+    uint16_t remote_mixer_control;
+    PBMixerWM remote_mixer;
+    PBDpopWM remote_dpop;
+    PBSampleRateConverterWM remote_src;
+    PBInfImpulseResponseWM remote_iir;
+    uint16_t pad[2];
+};
+
+// The AX mix buses in SETUP's block order. Load-bearing in three places (SETUP walks by
+// index, ProcessVoice mixes by name, AdvanceBuffers steps by class), so declared once here.
+enum AxBus : size_t {
+    kBusMainL = 0,
+    kBusMainR,
+    kBusMainS,
+    kBusAuxAL,
+    kBusAuxAR,
+    kBusAuxAS,
+    kBusAuxBL,
+    kBusAuxBR,
+    kBusAuxBS,
+    kBusAuxCL,
+    kBusAuxCR,
+    kBusAuxCS,
+    kBusWm0Main,
+    kBusWm0Aux,
+    kBusWm1Main,
+    kBusWm1Aux,
+    kBusWm2Main,
+    kBusWm2Aux,
+    kBusWm3Main,
+    kBusWm3Aux,
+    kAxBusCount,
+};
+
+// The buses before kBusWm0Main run at 32 samples per millisecond; the wiimote
+// buses that follow run at 6.
+constexpr size_t kAxRegularBusCount = kBusWm0Main;
+constexpr size_t kAxWiimoteBusCount = kAxBusCount - kAxRegularBusCount;
+constexpr uint32_t kAxWiimoteSamplesPerFrame = 18u;
+
+using AXBuffers = std::array<int*, kAxBusCount>;
+
+inline uint32_t Hilo(uint16_t hi, uint16_t lo) {
+    return (static_cast<uint32_t>(hi) << 16) | lo;
+}
+
+inline int16_t ClampS16(int64_t sample) {
+    return static_cast<int16_t>(std::clamp<int64_t>(sample, -0x8000, 0x7fff));
+}
+
+inline int16_t ClampAdpcmS16(int64_t sample) {
+    return static_cast<int16_t>(std::clamp<int64_t>(sample, -0x7fff, 0x7fff));
+}
+
+enum class PBLayout {
+    Unknown,
+    SkipBiquadGapOnly,
+    SkipUpdatesAndBiquadGap,
+    SkipUpdatesOnly,
+};
+
+inline PBLayout PBLayoutForUCode(uint32_t crc) {
+    switch (crc) {
+    case 0x7699af32u:
+    case 0xfa450138u:
+        return PBLayout::SkipBiquadGapOnly;
+    case 0xd9c4bf34u:
+    case 0xadbc06bdu:
+        return PBLayout::SkipUpdatesAndBiquadGap;
+    case 0x347112bau:
+    case 0x4cc52064u:
+        return PBLayout::SkipUpdatesOnly;
+    default:
+        return PBLayout::Unknown;
+    }
+}
+
+inline bool UCodeUsesOldAxWiiCommands(uint32_t crc) {
+    return crc == 0xfa450138u || crc == 0x7699af32u;
+}
+
+inline bool UCodeUsesNewFilter(uint32_t crc) {
+    return crc == 0x347112bau || crc == 0x4cc52064u;
+}
+
+inline AXCommandLayout CommandLayoutForUCode(uint32_t crc) {
+    if (UCodeUsesOldAxWiiCommands(crc)) {
+        return AXCommandLayout::Old;
+    }
+    if (crc == 0xd9c4bf34u) {
+        return AXCommandLayout::NewNoOutputVolume;
+    }
+    return AXCommandLayout::New;
+}
+
+void WriteGuestS32Buffer(uint32_t addr, const int* src, size_t count);
+
+void ReadGuestS32Buffer(uint32_t addr, int* dst, size_t count);
+
+class Accelerator {
+public:
+    void Setup(AXPBWii* pb) {
+        m_pb = pb;
+        m_start = Hilo(pb->audio_addr.loop_addr_hi, pb->audio_addr.loop_addr_lo) & 0x3fffffffu;
+        m_end = Hilo(pb->audio_addr.end_addr_hi, pb->audio_addr.end_addr_lo) & 0x3fffffffu;
+        m_current = Hilo(pb->audio_addr.cur_addr_hi, pb->audio_addr.cur_addr_lo) & 0xbfffffffu;
+        m_format = pb->audio_addr.sample_format;
+        m_gain = static_cast<int16_t>(pb->adpcm.gain);
+        m_pred_scale = pb->adpcm.pred_scale & 0x7f;
+        m_yn1 = pb->adpcm.yn1;
+        m_yn2 = pb->adpcm.yn2;
+        m_reads_stopped = false;
+    }
+
+    int16_t ReadSample() {
+        if (!m_pb || m_reads_stopped) {
+            return 0;
+        }
+
+        uint16_t raw = CurrentRawSample();
+        uint16_t decode = (m_format >> 2) & 3u;
+        int16_t value = 0;
+        uint8_t step = 2;
+
+        if (decode == 0) {
+            raw &= 0xf;
+            int32_t nibble = raw >= 8 ? static_cast<int32_t>(raw) - 16 : static_cast<int32_t>(raw);
+            const int coef_idx = (m_pred_scale >> 4) & 0x7;
+            const int32_t coef1 = m_pb->adpcm.coefs[coef_idx * 2 + 0];
+            const int32_t coef2 = m_pb->adpcm.coefs[coef_idx * 2 + 1];
+            const int32_t scale = 1 << (m_pred_scale & 0xf);
+            const int32_t decoded = scale * nibble + ((0x400 + coef1 * m_yn1 + coef2 * m_yn2) >> 11);
+            value = ClampAdpcmS16(decoded);
+            m_yn2 = m_yn1;
+            m_yn1 = value;
+            ++m_current;
+            if ((m_end & 0xf) == 0 && m_current == m_end) {
+                m_current = m_start + 1;
+            } else if ((m_end & 0xf) == 1 && m_current == m_end - 1) {
+                m_current = m_start;
+            } else if ((m_current & 15) == 0) {
+                m_pred_scale = ReadAram8((m_current & ~15u) >> 1) & 0x7f;
+                m_current += 2;
+                step += 2;
+            }
+        } else {
+            int16_t pcm = static_cast<int16_t>(raw);
+            const uint16_t gain_scale = (m_format >> 4) & 3u;
+            uint8_t gain_shift = gain_scale == 1 ? 0 : (gain_scale == 2 ? 16 : 11);
+            const int coef_idx = (m_pred_scale >> 4) & 0x7;
+            const int32_t coef1 = m_pb->adpcm.coefs[coef_idx * 2 + 0];
+            const int32_t coef2 = m_pb->adpcm.coefs[coef_idx * 2 + 1];
+            value = static_cast<int16_t>(((static_cast<int32_t>(m_gain) * pcm) >> gain_shift) +
+                                         ((coef1 * m_yn1) >> gain_shift) +
+                                         ((coef2 * m_yn2) >> gain_shift));
+            m_yn2 = m_yn1;
+            m_yn1 = value;
+            if (decode != 1) {
+                ++m_current;
+            }
+        }
+
+        if (m_current == m_end + step - 1) {
+            m_current = m_start;
+            m_reads_stopped = true;
+            if (m_pb->audio_addr.looping) {
+                m_pred_scale = m_pb->adpcm_loop_info.pred_scale & 0x7f;
+                if (m_pb->is_stream != 1) {
+                    m_yn1 = static_cast<int16_t>(m_pb->adpcm_loop_info.yn1);
+                    SetYn2(static_cast<int16_t>(m_pb->adpcm_loop_info.yn2));
+                } else {
+                    SetYn2(m_yn2);
+                }
+            } else {
+                m_pb->running = 0;
+            }
+        }
+
+        // Mirrors DSPAccelerator::SetCurrentAddress's CURRENT_ADDRESS_MASK: keep only the
+        // 30-bit ARAM address plus the 0x80000000 write flag.
+        m_current &= 0xbfffffffu;
+
+        m_pb->audio_addr.cur_addr_hi = static_cast<uint16_t>(m_current >> 16);
+        m_pb->audio_addr.cur_addr_lo = static_cast<uint16_t>(m_current);
+        m_pb->adpcm.yn1 = m_yn1;
+        m_pb->adpcm.yn2 = m_yn2;
+        m_pb->adpcm.pred_scale = m_pred_scale;
+        return value;
+    }
+
+    static uint8_t ReadAram8(uint32_t addr) {
+        return ReadAramByte(addr);
+    }
+
+private:
+    void SetYn2(int16_t yn2) {
+        m_yn2 = yn2;
+        m_reads_stopped = false;
+    }
+
+    uint16_t CurrentRawSample() const {
+        const uint16_t size = m_format & 3u;
+        if (size == 0) {
+            uint8_t byte = ReadAram8(m_current >> 1);
+            return (m_current & 1) ? (byte & 0xf) : (byte >> 4);
+        }
+        if (size == 1) {
+            return ReadAram8(m_current);
+        }
+        if (size == 2) {
+            return static_cast<uint16_t>((ReadAram8(m_current * 2) << 8) | ReadAram8(m_current * 2 + 1));
+        }
+        return 0;
+    }
+
+    AXPBWii* m_pb = nullptr;
+    uint32_t m_start = 0;
+    uint32_t m_end = 0;
+    uint32_t m_current = 0;
+    uint16_t m_format = 0;
+    int16_t m_gain = 0;
+    int16_t m_yn1 = 0;
+    int16_t m_yn2 = 0;
+    uint16_t m_pred_scale = 0;
+    bool m_reads_stopped = false;
+};
+
+}
diff --git a/runtime/src/hle/audio/ax_memory.cpp b/runtime/src/hle/audio/ax_memory.cpp
new file mode 100644
index 0000000..588e525
--- /dev/null
+++ b/runtime/src/hle/audio/ax_memory.cpp
@@ -0,0 +1,220 @@
+#include "ax_internal.h"
+
+#include "abi_bridge.h"
+#include "ax_mix_kernels.h"
+#include "memory.h"
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+
+#include <algorithm>
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+
+namespace AxDspHle {
+namespace {
+
+std::atomic<bool> g_loggedMixAddressOutOfRange{false};
+
+} // namespace
+
+uint32_t g_axTaskPtr = kAxDspTaskAddr;
+
+// The state the worker-safe accessors in ax_internal.h resolve against; the
+// invariant they preserve is documented there.
+std::atomic<uint8_t*> g_mixMem1{nullptr};
+std::atomic<uint8_t*> g_mixMem2{nullptr};
+
+thread_local bool t_onMixWorker = false;
+
+// A guest access the worker had to skip is a real, audible degradation, so it
+// reaches stderr unconditionally - but only once, because the site it fires from
+// runs per voice per 3 ms frame.
+void ReportMixAddressOutOfRange(uint32_t addr, size_t bytes) {
+    if (g_loggedMixAddressOutOfRange.exchange(true, std::memory_order_relaxed)) {
+        return;
+    }
+    RT_LOGF(RT_TAG_AUDIO,
+                 "worker skipped a guest access outside MEM1/MEM2 at 0x%08X (%zu bytes)\n",
+                 addr, bytes);
+    std::fflush(stderr);
+}
+
+void RefreshMixMemoryMap() {
+    uint8_t* mem1 = nullptr;
+    uint8_t* mem2 = nullptr;
+    if (Memory::Contains(Memory::kMem1CachedBase, Memory::kMem1Size)) {
+        mem1 = Memory::GetPointer(Memory::kMem1CachedBase, Memory::kMem1Size);
+    }
+    if (Memory::Contains(Memory::kMem2CachedBase, Memory::kMem2Size)) {
+        mem2 = Memory::GetPointer(Memory::kMem2CachedBase, Memory::kMem2Size);
+    }
+    g_mixMem1.store(mem1, std::memory_order_relaxed);
+    g_mixMem2.store(mem2, std::memory_order_relaxed);
+}
+
+uint32_t ReadGuestU32OrZero(uint32_t addr) {
+    uint32_t value = 0;
+    Memory::TryRead32(addr, value);
+    return value;
+}
+
+void MarkDspInitialized() {
+    Memory::TryWrite32(kDspInitializedAddr, 1);
+}
+
+void ResetDspTaskGlobals() {
+    Memory::TryWrite32(kDspAssertPendingAddr, 0);
+    Memory::TryWrite32(kDspAssertTaskAddr, 0);
+    Memory::TryWrite32(0x80386618u, 0);
+    Memory::TryWrite32(kDspCurrentTaskAddr, 0);
+    Memory::TryWrite32(kDspFirstTaskAddr, 0);
+    Memory::TryWrite32(kDspRunningTaskAddr, 0);
+}
+
+void LinkSingleDspTask(uint32_t taskPtr) {
+    if (taskPtr == 0) {
+        return;
+    }
+    g_axTaskPtr = taskPtr;
+    Memory::TryWrite32(kDspCurrentTaskAddr, taskPtr);
+    Memory::TryWrite32(kDspFirstTaskAddr, taskPtr);
+    Memory::TryWrite32(kDspRunningTaskAddr, taskPtr);
+    Memory::TryWrite32(taskPtr + 0x38u, 0);
+    Memory::TryWrite32(taskPtr + 0x3cu, 0);
+}
+
+uint32_t HashEctorGuest(uint32_t addr, uint32_t length) {
+    if (length == 0 || length > 0x10000u || !Memory::Contains(addr, length)) {
+        return 0;
+    }
+
+    uint32_t crc = 0;
+    for (uint32_t i = 0; i < length; ++i) {
+        crc ^= Memory::Read8(addr + i);
+        crc = (crc << 3) | (crc >> 29);
+    }
+    return crc;
+}
+
+void InvokeAxTaskCallback(uint32_t callbackOffset, bool passTask) {
+    if (g_axTaskPtr == 0) {
+        return;
+    }
+    const uint32_t callback = Memory::Read32(g_axTaskPtr + callbackOffset);
+    if (callback == 0) {
+        return;
+    }
+
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu) {
+        cpu = &GetPersistentCpuContext();
+    }
+    CpuContextScope scope(cpu);
+    if (passTask) {
+        cpu->gpr[3] = g_axTaskPtr;
+    }
+    InvokeIndirectCpu(callback, cpu);
+}
+
+std::atomic<uint32_t> g_aramWindowGeneration{1};
+
+namespace {
+
+// The two guest aliases a DSP ARAM address can resolve through. Dolphin's Wii DSP ARAM
+// path treats bit 0x10000000 as the MEM2/EXRAM selector; otherwise reads wrap through
+// MEM1 using the next-power-of-two retail RAM mask (24 MB real, 32 MB masked).
+struct AramAliases {
+    uint32_t physical;
+    uint32_t cached;
+};
+
+AramAliases AramAliasesFor(uint32_t addr) {
+    if (addr & 0x10000000u) {
+        const uint32_t exramOffset = addr & static_cast<uint32_t>(Memory::kMem2Size - 1u);
+        return {0x10000000u | exramOffset, 0x90000000u | exramOffset};
+    }
+    const uint32_t ramOffset = addr & 0x01ffffffu;
+    return {ramOffset, 0x80000000u | ramOffset};
+}
+
+} // namespace
+
+bool ResolveAramWindow(uint32_t addr, AramWindow& window) {
+    // A window is page-aligned and smaller than both the MEM1 wrap mask and the MEM2 size,
+    // so every address inside it maps contiguously and keeps the MEM1/MEM2 selector bit.
+    const uint32_t begin = addr & ~(kAramWindowSize - 1u);
+    const AramAliases aliases = AramAliasesFor(begin);
+    const uint32_t candidates[2] = {aliases.physical, aliases.cached};
+
+    // MixResolveRange, not the page-table walk: this also runs on the mix worker.
+    for (const uint32_t candidate : candidates) {
+        if (const uint8_t* host = MixResolveRange(candidate, kAramWindowSize)) {
+            window.begin = begin;
+            window.end = begin + kAramWindowSize;
+            window.generation = g_aramWindowGeneration.load(std::memory_order_relaxed);
+            window.host = host;
+            return true;
+        }
+    }
+
+    window.begin = 0;
+    window.end = 0;
+    window.host = nullptr;
+    return false;
+}
+
+uint8_t ReadAramByteSlow(uint32_t addr) {
+    // These single-byte probes are not redundant with ResolveAramWindow's:
+    // that one asks for a whole kAramWindowSize page, so it fails for the last
+    // <4 KiB of MEM1/MEM2 where this still succeeds.
+    const AramAliases aliases = AramAliasesFor(addr);
+    if (const uint8_t* host = MixResolveRange(aliases.physical, 1)) {
+        return *host;
+    }
+    if (const uint8_t* host = MixResolveRange(aliases.cached, 1)) {
+        return *host;
+    }
+    // Nothing else backs DSP ARAM: real AX traffic is MEM1/MEM2, and no code
+    // path in the runtime ever writes a separate ARAM store, so an address that
+    // resolves to neither alias reads as silence.
+    return 0;
+}
+
+void WriteGuestS32Buffer(uint32_t addr, const int* src, size_t count) {
+    if (!addr) {
+        return;
+    }
+    // AX mix buffers are contiguous guest ranges; resolve the range once instead
+    // of paying a per-word address translation.
+    if (uint8_t* host = MixResolveRange(addr, count * sizeof(uint32_t))) {
+        AxMixKernels::StoreBigEndian32(host, src, count);
+        return;
+    }
+    if (t_onMixWorker) {
+        ReportMixAddressOutOfRange(addr, count * sizeof(uint32_t));
+        return;
+    }
+    for (size_t i = 0; i < count; ++i) {
+        Memory::Write32(addr + static_cast<uint32_t>(i * 4), static_cast<uint32_t>(src[i]));
+    }
+}
+
+void ReadGuestS32Buffer(uint32_t addr, int* dst, size_t count) {
+    if (const uint8_t* host = MixResolveRange(addr, count * sizeof(uint32_t))) {
+        AxMixKernels::LoadBigEndian32(dst, host, count);
+        return;
+    }
+    if (t_onMixWorker) {
+        ReportMixAddressOutOfRange(addr, count * sizeof(uint32_t));
+        std::fill(dst, dst + count, 0);
+        return;
+    }
+    for (size_t i = 0; i < count; ++i) {
+        dst[i] = static_cast<int32_t>(Memory::Read32(addr + static_cast<uint32_t>(i * 4)));
+    }
+}
+
+} // namespace AxDspHle
diff --git a/runtime/src/hle/audio/ax_mix.cpp b/runtime/src/hle/audio/ax_mix.cpp
new file mode 100644
index 0000000..9b2ceb7
--- /dev/null
+++ b/runtime/src/hle/audio/ax_mix.cpp
@@ -0,0 +1,1569 @@
+#include "ax_dsp.h"
+
+#include "ax_internal.h"
+
+#include "abi_bridge.h"
+#include "audio_backend.h"
+#include "ax_mix_kernels.h"
+#include "isa/big_endian.h"
+#include "memory.h"
+#include "ppc_runtime.h"
+#include "runtime_config.h"
+#include "runtime_log.h"
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <deque>
+#include <filesystem>
+#include <fstream>
+#include <mutex>
+#include <string>
+#include <thread>
+
+namespace AxDspHle {
+namespace {
+
+std::filesystem::path FindDspCoefficientRom() {
+    if (const auto executableDirectory = RuntimeConfigFile::ExecutableDirectory()) {
+        const auto adjacent = *executableDirectory / "dsp_coef.bin";
+        if (std::filesystem::is_regular_file(adjacent)) {
+            return adjacent;
+        }
+    }
+
+    for (auto base = std::filesystem::current_path(); !base.empty();) {
+        const auto sourceTreeAsset = base / "runtime" / "assets" / "dsp" / "dsp_coef.bin";
+        if (std::filesystem::is_regular_file(sourceTreeAsset)) {
+            return sourceTreeAsset;
+        }
+        const auto parent = base.parent_path();
+        if (parent == base) {
+            break;
+        }
+        base = parent;
+    }
+
+    throw std::runtime_error("Missing bundled Wii DSP coefficient ROM (dsp_coef.bin)");
+}
+
+class AXWii {
+public:
+    AXWii() {
+        m_lastMainVolume = 0x8000;
+        m_lastAuxVolumes.fill(0x8000);
+    }
+
+    ~AXWii() { ShutdownMixWorker(); }
+
+    void Initialize() {
+        // Every entry point that resets or reconfigures mix state joins the
+        // worker first: the mix owns those members outright while it runs.
+        JoinMix();
+        RefreshMixMemoryMap();
+        std::lock_guard<std::mutex> lock(m_mutex);
+        m_mixWorkerEnabled = RuntimeConfigFile::AudioMixWorkerEnabled(true);
+        MarkDspInitialized();
+        ResetDspTaskGlobals();
+        m_mailState = MailState::WaitingForCmdListSize;
+        m_cmdListSize = 0;
+        m_toDspBusy = false;
+        m_cpuMails.clear();
+        m_compressorPos = 0;
+        m_deferredResumeCallbacks = 0;
+        // Both layouts are re-derived from the ucode CRC by ConfigureFromTask;
+        // until one arrives, the PB layout is detected per parameter block and
+        // the command layout is probed per command list.
+        m_pbLayout = PBLayout::Unknown;
+        m_commandLayout = AXCommandLayout::Auto;
+        m_ucodeCrc = 0;
+        m_auxOutCount = 0;
+        m_auxInCount = 0;
+        m_deferredAux = false;
+        LoadResamplingCoefficients();
+        PushMail(kDspInit);
+    }
+
+    void Stop() {
+        JoinMix();
+        std::lock_guard<std::mutex> lock(m_mutex);
+        m_mailState = MailState::WaitingForCmdListSize;
+        m_cmdListSize = 0;
+        m_toDspBusy = false;
+        m_cpuMails.clear();
+        m_lastCpuMail = 0;
+        m_compressorPos = 0;
+        m_deferredResumeCallbacks = 0;
+        m_ucodeCrc = 0;
+    }
+
+    void ConfigureFromTask(uint32_t taskPtr) {
+        // ConfigureFromTaskLocked rewrites the ucode CRC and the PB/command
+        // layouts, all of which the mix reads.
+        JoinMix();
+        std::lock_guard<std::mutex> lock(m_mutex);
+        ConfigureFromTaskLocked(taskPtr);
+    }
+
+    void JoinMix() {
+        if (m_mixThread.joinable()) {
+            std::unique_lock<std::mutex> lock(m_mixMutex);
+            m_mixIdle.wait(lock, [this] { return !m_mixPending && !m_mixBusy; });
+        }
+        PublishAuxOutputs();
+    }
+
+    void ShutdownMixWorker() {
+        if (!m_mixThread.joinable()) {
+            return;
+        }
+        {
+            std::lock_guard<std::mutex> lock(m_mixMutex);
+            m_mixStop = true;
+        }
+        m_mixWake.notify_all();
+        m_mixThread.join();
+    }
+
+    void SetMixWorkerEnabled(bool enabled) {
+        std::lock_guard<std::mutex> lock(m_mutex);
+        m_mixWorkerEnabled = enabled;
+    }
+
+    void SendMail(uint32_t mail) {
+        std::lock_guard<std::mutex> lock(m_mutex);
+        HandleMail(mail);
+        m_toDspBusy = false;
+    }
+
+    void QueueResumeCallback() {
+        std::lock_guard<std::mutex> lock(m_mutex);
+        ++m_deferredResumeCallbacks;
+    }
+
+    void ServiceDeferredCallbacks() {
+        while (true) {
+            {
+                std::lock_guard<std::mutex> lock(m_mutex);
+                if (m_deferredResumeCallbacks == 0) {
+                    return;
+                }
+                --m_deferredResumeCallbacks;
+            }
+            InvokeAxTaskCallback(0x2cu, false);
+        }
+    }
+
+    uint32_t CheckMailToDSP() const {
+        std::lock_guard<std::mutex> lock(m_mutex);
+        return m_toDspBusy ? 1u : 0u;
+    }
+
+    uint32_t CheckMailFromDSP() const {
+        std::lock_guard<std::mutex> lock(m_mutex);
+        return m_cpuMails.empty() ? 0u : 1u;
+    }
+
+    uint32_t ReadMailFromDSP() {
+        std::lock_guard<std::mutex> lock(m_mutex);
+        if (m_cpuMails.empty()) {
+            return m_lastCpuMail & 0x7fffffffu;
+        }
+        m_lastCpuMail = m_cpuMails.front();
+        m_cpuMails.pop_front();
+        return m_lastCpuMail;
+    }
+
+private:
+    // What DispatchCommandList has to know about a command list before it is
+    // allowed to leave the guest thread.
+    struct CommandListScan {
+        uint32_t outputCommands = 0;
+        uint32_t auxInputCount = 0;
+        // Three blocks per MIX_AUX* (x3) plus four per UPL_AUX* (x2) = 17.
+        std::array<uint32_t, 24> auxInputAddrs{};
+    };
+
+    struct AuxBlock {
+        uint32_t addr = 0;
+        std::array<int32_t, kAxSamplesPerFrame> data{};
+    };
+
+    enum Cmd : uint16_t {
+        CMD_SETUP = 0x00,
+        CMD_ADD_TO_LR = 0x01,
+        CMD_SUB_TO_LR = 0x02,
+        CMD_ADD_SUB_TO_LR = 0x03,
+        CMD_PROCESS = 0x04,
+        CMD_MIX_AUXA = 0x05,
+        CMD_MIX_AUXB = 0x06,
+        CMD_MIX_AUXC = 0x07,
+        CMD_UPL_AUXA_MIX_LRSC = 0x08,
+        CMD_UPL_AUXB_MIX_LRSC = 0x09,
+        CMD_COMPRESSOR = 0x0a,
+        CMD_OUTPUT = 0x0b,
+        CMD_OUTPUT_DPL2 = 0x0c,
+        CMD_WM_OUTPUT = 0x0d,
+        CMD_END = 0x0e,
+    };
+
+
+    static constexpr uint16_t kCmdSetPbAddressOld = 0x04;
+
+    struct DecodedCommand {
+        Cmd cmd = CMD_SETUP;
+        bool setsPbAddress = false;
+    };
+
+    static DecodedCommand DecodeCommand(uint16_t raw, AXCommandLayout layout) {
+        if (layout != AXCommandLayout::Old) {
+            return {static_cast<Cmd>(raw), false};
+        }
+        if (raw == kCmdSetPbAddressOld) {
+            return {CMD_SETUP, true};
+        }
+        return {static_cast<Cmd>(raw > kCmdSetPbAddressOld ? raw - 1u : raw), false};
+    }
+
+    // The old layout runs the PB chain the previous SET_PB_ADDRESS stashed, and
+    // ProcessPBList applies the old per-millisecond PB update walk for it.
+    static bool UsesStashedPbAddress(AXCommandLayout layout) {
+        return layout == AXCommandLayout::Old;
+    }
+
+    // Only the plain New encoding puts a volume halfword in front of OUTPUT's
+    // two addresses; Old and NewNoOutputVolume both imply 0x8000.
+    static bool OutputCarriesVolume(AXCommandLayout layout) {
+        return layout != AXCommandLayout::Old && layout != AXCommandLayout::NewNoOutputVolume;
+    }
+
+    void PushMail(uint32_t mail) {
+        m_cpuMails.push_back(mail);
+    }
+
+    void HandleMail(uint32_t mail) {
+        switch (m_mailState) {
+        case MailState::WaitingForCmdListSize:
+            if ((mail & kMailCmdListMask) == kMailCmdList) {
+                m_cmdListSize = mail & 0xffffu;
+                m_mailState = MailState::WaitingForCmdListAddress;
+            } else if ((mail & 0xffff0000u) == kTaskMailToDsp) {
+                HandleTaskMail(mail);
+            }
+            break;
+        case MailState::WaitingForCmdListAddress:
+            // The previous mix owns m_cmdList, the mix buses and the PB chain
+            // until it finishes. In practice this join is free
+            JoinMix();
+            CopyCmdList(mail, m_cmdListSize);
+            DispatchCommandList();
+            m_cmdListSize = 0;
+            //  yield mail and the deferred resume callback are still raised synchronously at mail time,
+            PushMail(kDspYield);
+            ++m_deferredResumeCallbacks;
+            m_mailState = MailState::WaitingForNextTask;
+            break;
+        case MailState::WaitingForNextTask:
+            if ((mail & kMailCmdListMask) == kMailCmdList) {
+                m_cmdListSize = mail & 0xffffu;
+                m_mailState = MailState::WaitingForCmdListAddress;
+            } else {
+                HandleTaskMail(mail);
+            }
+            break;
+        }
+    }
+
+    void HandleTaskMail(uint32_t mail) {
+        switch (mail) {
+        case kMailResume:
+            PushMail(kDspResume);
+            m_mailState = MailState::WaitingForCmdListSize;
+            break;
+        case kMailNewUCode:
+        case kMailContinue:
+            m_mailState = MailState::WaitingForCmdListSize;
+            break;
+        case kMailReset:
+            PushMail(kDspDone);
+            m_mailState = MailState::WaitingForCmdListSize;
+            break;
+        default:
+            m_mailState = MailState::WaitingForCmdListSize;
+            break;
+        }
+    }
+
+    void CopyCmdList(uint32_t addr, uint32_t sizeWords) {
+        if (sizeWords > m_cmdList.size()) {
+            // Truncating a command list drops whole commands
+            if (!m_loggedCmdListTruncated.exchange(true, std::memory_order_relaxed)) {
+                RT_LOGF(RT_TAG_AUDIO,
+                             "command list of %u words exceeds the %zu-word buffer; truncating\n",
+                             sizeWords, m_cmdList.size());
+                std::fflush(stderr);
+            }
+            sizeWords = static_cast<uint32_t>(m_cmdList.size());
+        }
+        for (uint32_t i = 0; i < sizeWords; ++i) {
+            m_cmdList[i] = Memory::Read16(addr + i * 2);
+        }
+    }
+
+    // Everything that must be observed at mail time happens here, before the mix leaves the
+    // guest thread: the DSP sync mails OUTPUT commands raise (so the mail sequence doesn't
+    // depend on where the mix runs)
+    void DispatchCommandList() {
+        AXCommandLayout layout = m_commandLayout;
+        if (layout == AXCommandLayout::Auto) {
+            const bool validNew = ScanCommandList(AXCommandLayout::New, nullptr);
+            const bool validNewNoOutputVolume = ScanCommandList(AXCommandLayout::NewNoOutputVolume, nullptr);
+            const bool validOld = ScanCommandList(AXCommandLayout::Old, nullptr);
+            layout = validNew ? AXCommandLayout::New :
+                     (validNewNoOutputVolume ? AXCommandLayout::NewNoOutputVolume :
+                      (validOld ? AXCommandLayout::Old : AXCommandLayout::New));
+        }
+
+        CommandListScan scan{};
+        ScanCommandList(layout, &scan);
+        for (uint32_t i = 0; i < scan.outputCommands; ++i) {
+            PushMail(kDspSync);
+        }
+
+        const bool deferred = m_mixWorkerEnabled && EnsureMixWorker();
+        m_deferredAux = deferred;
+        m_auxInCount = 0;
+        if (deferred) {
+            for (uint32_t i = 0; i < scan.auxInputCount && m_auxInCount < m_auxIn.size(); ++i) {
+                AuxBlock& block = m_auxIn[m_auxInCount++];
+                block.addr = scan.auxInputAddrs[i];
+                ReadGuestS32Buffer(block.addr, block.data.data(), kAxSamplesPerFrame);
+            }
+        }
+
+        m_mixLayout = layout;
+        m_mixCmdListSize = m_cmdListSize;
+        if (deferred) {
+            {
+                std::lock_guard<std::mutex> lock(m_mixMutex);
+                m_mixPending = true;
+            }
+            m_mixWake.notify_one();
+            return;
+        }
+
+        ExecuteCommandList(m_mixLayout, m_mixCmdListSize);
+    }
+
+    bool CanReadWords(uint32_t idx, uint32_t count) const {
+        return idx <= m_cmdListSize && count <= m_cmdListSize - idx;
+    }
+
+    // Walks the command list for a candidate layout
+    bool ScanCommandList(AXCommandLayout layout, CommandListScan* scan) const {
+        uint32_t idx = 0;
+        bool end = false;
+        auto addAuxInput = [&](uint32_t addr, uint32_t blocks) {
+            if (!scan) {
+                return;
+            }
+            for (uint32_t block = 0; block < blocks; ++block) {
+                if (scan->auxInputCount >= scan->auxInputAddrs.size()) {
+                    return;
+                }
+                scan->auxInputAddrs[scan->auxInputCount++] =
+                    addr + block * kAxSamplesPerFrame * static_cast<uint32_t>(sizeof(int32_t));
+            }
+        };
+        auto wordAddress = [&](uint32_t base) {
+            return Hilo(m_cmdList[base], m_cmdList[base + 1]);
+        };
+
+        while (!end) {
+            if (!CanReadWords(idx, 1)) {
+                return false;
+            }
+            const uint16_t cmd = m_cmdList[idx++];
+            const uint32_t operandBase = idx;
+            auto skip = [&](uint32_t words) {
+                if (!CanReadWords(idx, words)) {
+                    return false;
+                }
+                idx += words;
+                return true;
+            };
+
+            const DecodedCommand decoded = DecodeCommand(cmd, layout);
+            if (decoded.setsPbAddress) {
+                if (!skip(2)) return false;
+                continue;
+            }
+
+            switch (decoded.cmd) {
+            case CMD_SETUP:
+            case CMD_ADD_TO_LR:
+            case CMD_SUB_TO_LR:
+            case CMD_ADD_SUB_TO_LR:
+                if (!skip(2)) return false;
+                break;
+            case CMD_PROCESS:
+                if (!UsesStashedPbAddress(layout) && !skip(2)) return false;
+                break;
+            case CMD_MIX_AUXA:
+            case CMD_MIX_AUXB:
+            case CMD_MIX_AUXC:
+                if (!skip(5)) return false;
+                // volume, write address, read address; the mix reads three
+                // consecutive 96-word blocks from the read address.
+                addAuxInput(wordAddress(operandBase + 3), 3);
+                break;
+            case CMD_UPL_AUXA_MIX_LRSC:
+            case CMD_UPL_AUXB_MIX_LRSC:
+                if (!skip(13)) return false;
+                // volume then six addresses; [2..5] are read back.
+                for (uint32_t slot = 2; slot < 6; ++slot) {
+                    addAuxInput(wordAddress(operandBase + 1 + slot * 2), 1);
+                }
+                break;
+            case CMD_COMPRESSOR:
+                if (!skip(4)) return false;
+                break;
+            case CMD_OUTPUT:
+            case CMD_OUTPUT_DPL2:
+                if (!skip(OutputCarriesVolume(layout) ? 5 : 4)) return false;
+                if (scan) ++scan->outputCommands;
+                break;
+            case CMD_WM_OUTPUT:
+                if (!skip(8)) return false;
+                break;
+            case CMD_END:
+                end = true;
+                break;
+            default:
+                return false;
+            }
+        }
+        return idx <= m_cmdListSize;
+    }
+
+    void ExecuteCommandList(AXCommandLayout layout, uint32_t cmdListSize) {
+        uint32_t idx = 0;
+        uint32_t oldPbAddr = 0;
+        const bool newFilter = m_ucodeCrc != 0 ? UCodeUsesNewFilter(m_ucodeCrc) : layout != AXCommandLayout::Old;
+        bool end = false;
+        m_auxOutCount = 0;
+        while (!end && idx < cmdListSize) {
+            const uint16_t cmd = m_cmdList[idx++];
+            uint16_t volume = 0;
+            uint16_t frames = 0;
+            uint32_t addr = 0;
+            uint32_t addr2 = 0;
+            const DecodedCommand decoded = DecodeCommand(cmd, layout);
+            if (decoded.setsPbAddress) {
+                oldPbAddr = ReadAddress(idx);
+                continue;
+            }
+
+            switch (decoded.cmd) {
+            case CMD_SETUP:
+                addr = ReadAddress(idx);
+                SetupProcessing(addr);
+                break;
+            case CMD_ADD_TO_LR:
+            case CMD_SUB_TO_LR:
+                addr = ReadAddress(idx);
+                AddToLR(addr, decoded.cmd == CMD_SUB_TO_LR);
+                break;
+            case CMD_ADD_SUB_TO_LR:
+                addr = ReadAddress(idx);
+                AddSubToLR(addr);
+                break;
+            case CMD_PROCESS:
+                if (UsesStashedPbAddress(layout)) {
+                    ProcessPBList(oldPbAddr, newFilter, true);
+                } else {
+                    addr = ReadAddress(idx);
+                    ProcessPBList(addr, newFilter, false);
+                }
+                break;
+            case CMD_MIX_AUXA:
+            case CMD_MIX_AUXB:
+            case CMD_MIX_AUXC:
+                volume = m_cmdList[idx++];
+                addr = ReadAddress(idx);
+                addr2 = ReadAddress(idx);
+                MixAUXSamples(decoded.cmd - CMD_MIX_AUXA, addr, addr2, volume);
+                break;
+            case CMD_UPL_AUXA_MIX_LRSC:
+            case CMD_UPL_AUXB_MIX_LRSC: {
+                volume = m_cmdList[idx++];
+                std::array<uint32_t, 6> addresses{};
+                for (uint32_t& out : addresses) {
+                    out = ReadAddress(idx);
+                }
+                UploadAUXMixLRSC(decoded.cmd == CMD_UPL_AUXB_MIX_LRSC ? 1 : 0, addresses.data(), volume);
+                break;
+            }
+            case CMD_COMPRESSOR:
+                volume = m_cmdList[idx++];
+                frames = m_cmdList[idx++];
+                addr = ReadAddress(idx);
+                RunCompressor(volume, frames, addr);
+                break;
+            case CMD_OUTPUT:
+            case CMD_OUTPUT_DPL2:
+                volume = OutputCarriesVolume(layout) ? m_cmdList[idx++] : 0x8000u;
+                addr = ReadAddress(idx);
+                addr2 = ReadAddress(idx);
+                OutputSamples(addr2, addr, volume, decoded.cmd == CMD_OUTPUT_DPL2);
+                break;
+            case CMD_WM_OUTPUT: {
+                std::array<uint32_t, 4> addresses{};
+                for (uint32_t& out : addresses) {
+                    out = ReadAddress(idx);
+                }
+                OutputWMSamples(addresses.data());
+                break;
+            }
+            case CMD_END:
+                end = true;
+                break;
+            default:
+                ReportUnknownCommand(cmd, idx - 1);
+                end = true;
+                break;
+            }
+        }
+    }
+
+    void ReportUnknownCommand(uint16_t cmd, uint32_t word) {
+        if (m_loggedUnknownCommand.exchange(true, std::memory_order_relaxed)) {
+            return;
+        }
+        RT_LOGF(RT_TAG_AUDIO,
+                     "unknown AX command 0x%04X at word %u; abandoning the command list\n",
+                     cmd, word);
+        std::fflush(stderr);
+    }
+
+    uint32_t ReadAddress(uint32_t& idx) const {
+        const uint16_t hi = m_cmdList[idx++];
+        const uint16_t lo = m_cmdList[idx++];
+        return Hilo(hi, lo);
+    }
+
+    // Head-of-frame pointer for every bus, in AxBus order. This is the only
+    // place the 20 buses are enumerated.
+    AXBuffers MixBuffers() {
+        AXBuffers buffers{};
+        for (size_t i = 0; i < kAxRegularBusCount; ++i) {
+            buffers[i] = m_bus[i].data();
+        }
+        for (size_t i = 0; i < kAxWiimoteBusCount; ++i) {
+            buffers[kAxRegularBusCount + i] = m_wmBus[i].data();
+        }
+        return buffers;
+    }
+
+    void SetupProcessing(uint32_t initAddr) {
+        const AXBuffers buffers = MixBuffers();
+        for (size_t i = 0; i < buffers.size(); ++i) {
+            const uint32_t value = (MixRead16(initAddr + static_cast<uint32_t>(i * 6)) << 16) |
+                                   MixRead16(initAddr + static_cast<uint32_t>(i * 6 + 2));
+            const int16_t delta = static_cast<int16_t>(MixRead16(initAddr + static_cast<uint32_t>(i * 6 + 4)));
+            const int count = (i < kAxRegularBusCount ? 32 : 6) * 3;
+            if (value == 0) {
+                std::fill(buffers[i], buffers[i] + count, 0);
+            } else {
+                const int32_t start = static_cast<int32_t>(value);
+                for (int j = 0; j < count; ++j) {
+                    buffers[i][j] = start + j * delta;
+                }
+            }
+        }
+    }
+
+    void AddToLR(uint32_t addr, bool neg) {
+        for (uint32_t i = 0; i < kAxSamplesPerFrame; ++i) {
+            int32_t value = static_cast<int32_t>(MixRead32(addr + i * 4));
+            if (neg) {
+                value = -value;
+            }
+            m_bus[kBusMainL][i] += value;
+            m_bus[kBusMainR][i] += value;
+        }
+    }
+
+    void AddSubToLR(uint32_t addr) {
+        for (uint32_t i = 0; i < kAxSamplesPerFrame; ++i) {
+            m_bus[kBusMainL][i] += static_cast<int32_t>(MixRead32(addr + i * 4));
+        }
+        for (uint32_t i = 0; i < kAxSamplesPerFrame; ++i) {
+            m_bus[kBusMainR][i] -= static_cast<int32_t>(MixRead32(addr + (kAxSamplesPerFrame + i) * 4));
+        }
+    }
+
+    static AXMixControl ConvertMixerControl(uint32_t mixerControl) {
+        uint32_t ret = 0;
+        if (mixerControl & 0x00000001) ret |= MIX_MAIN_L;
+        if (mixerControl & 0x00000002) ret |= MIX_MAIN_R;
+        if (mixerControl & 0x00000004) ret |= MIX_MAIN_L | MIX_MAIN_R | MIX_MAIN_L_RAMP | MIX_MAIN_R_RAMP;
+        if (mixerControl & 0x00000008) ret |= MIX_MAIN_S;
+        if (mixerControl & 0x00000010) ret |= MIX_MAIN_S | MIX_MAIN_S_RAMP;
+        if (mixerControl & 0x00010000) ret |= MIX_AUXA_L;
+        if (mixerControl & 0x00020000) ret |= MIX_AUXA_R;
+        if (mixerControl & 0x00040000) ret |= MIX_AUXA_L | MIX_AUXA_R | MIX_AUXA_L_RAMP | MIX_AUXA_R_RAMP;
+        if (mixerControl & 0x00080000) ret |= MIX_AUXA_S;
+        if (mixerControl & 0x00100000) ret |= MIX_AUXA_S | MIX_AUXA_S_RAMP;
+        if (mixerControl & 0x00200000) ret |= MIX_AUXB_L;
+        if (mixerControl & 0x00400000) ret |= MIX_AUXB_R;
+        if (mixerControl & 0x00800000) ret |= MIX_AUXB_L | MIX_AUXB_R | MIX_AUXB_L_RAMP | MIX_AUXB_R_RAMP;
+        if (mixerControl & 0x01000000) ret |= MIX_AUXB_S;
+        if (mixerControl & 0x02000000) ret |= MIX_AUXB_S | MIX_AUXB_S_RAMP;
+        if (mixerControl & 0x04000000) ret |= MIX_AUXC_L;
+        if (mixerControl & 0x08000000) ret |= MIX_AUXC_R;
+        if (mixerControl & 0x10000000) ret |= MIX_AUXC_L | MIX_AUXC_R | MIX_AUXC_L_RAMP | MIX_AUXC_R_RAMP;
+        if (mixerControl & 0x20000000) ret |= MIX_AUXC_S;
+        if (mixerControl & 0x40000000) ret |= MIX_AUXC_S | MIX_AUXC_S_RAMP;
+        return static_cast<AXMixControl>(ret);
+    }
+
+    static void GenerateVolumeRamp(uint16_t* output, uint16_t from, uint16_t to, size_t count) {
+        float current = static_cast<float>(from);
+        const float delta = (static_cast<float>(to) - static_cast<float>(from)) / static_cast<float>(count);
+        for (size_t i = 0; i < count; ++i) {
+            current += delta;
+            output[i] = static_cast<uint16_t>(current);
+        }
+    }
+
+    void ProcessPBList(uint32_t pbAddr, bool newFilter, bool oldAxLayout) {
+        uint32_t guard = 0;
+        while (pbAddr && guard++ < 256) {
+            AXPBWii pb{};
+            ReadPB(pbAddr, pb);
+            AXBuffers buffers = MixBuffers();
+            const AXMixControl control = ConvertMixerControl(Hilo(pb.mixer_control_hi, pb.mixer_control_lo));
+            if (oldAxLayout && (pb.updates.num_updates[0] | pb.updates.num_updates[1] | pb.updates.num_updates[2]) != 0) {
+                const auto updates = LoadPBUpdates(pb);
+                for (uint32_t ms = 0; ms < 3; ++ms) {
+                    ApplyPBUpdatesForMs(pb, updates, ms);
+                    ProcessVoice(pb, buffers, 32, control, BaseCoefficients(), newFilter);
+                    AdvanceBuffers(buffers, 32, 6);
+                }
+            } else {
+                ProcessVoice(pb, buffers, kAxSamplesPerFrame, control, BaseCoefficients(), newFilter);
+            }
+            WritePB(pbAddr, pb);
+            pbAddr = Hilo(pb.next_pb_hi, pb.next_pb_lo);
+        }
+    }
+
+    // Four consecutive 0x200-halfword polyphase banks; only the voice resample selects a
+    // bank (VoiceCoefficients). Wiimote downsample always uses bank 0 at its fixed ratio.
+    const int16_t* BaseCoefficients() const {
+        return m_hasCoeffs ? m_coeffs.data() : nullptr;
+    }
+
+    // Mirrors GetInputSamples' coeffs += pb.coef_select * 0x200, but bounds-checked since
+    // coef_select is a guest halfword; a corrupt PB degrades to linear interpolation instead
+    // of an out-of-bounds read.
+    static const int16_t* VoiceCoefficients(const int16_t* base, uint16_t coefSelect) {
+        if (base == nullptr) {
+            return nullptr;
+        }
+        const uint32_t offset = static_cast<uint32_t>(coefSelect) * 0x200u;
+        if (offset + 0x200u > kResamplingCoefficientCount) {
+            return nullptr;
+        }
+        return base + offset;
+    }
+
+    void LoadResamplingCoefficients() {
+        if (m_triedLoadCoeffs) {
+            return;
+        }
+        m_triedLoadCoeffs = true;
+
+        const auto path = FindDspCoefficientRom();
+        std::ifstream stream(path, std::ios::binary | std::ios::ate);
+        if (!stream || stream.tellg() != static_cast<std::streamoff>(m_coeffs.size() * 2)) {
+            throw std::runtime_error("Bundled Wii DSP coefficient ROM has an invalid size: " + path.string());
+        }
+        stream.seekg(0);
+        std::array<uint8_t, kResamplingCoefficientCount * 2> bytes{};
+        if (!stream.read(reinterpret_cast<char*>(bytes.data()), bytes.size())) {
+            throw std::runtime_error("Failed to read bundled Wii DSP coefficient ROM: " + path.string());
+        }
+        for (size_t i = 0; i < m_coeffs.size(); ++i) {
+            const uint16_t word = static_cast<uint16_t>(bytes[i * 2]) << 8 |
+                                  static_cast<uint16_t>(bytes[i * 2 + 1]);
+            m_coeffs[i] = static_cast<int16_t>(word);
+        }
+        m_hasCoeffs = true;
+    }
+
+    static std::array<PBUpdate, 32> LoadPBUpdates(const AXPBWii& pb) {
+        std::array<PBUpdate, 32> updates{};
+        const uint32_t addr = Hilo(pb.updates.data_hi, pb.updates.data_lo);
+        if (addr == 0) {
+            return updates;
+        }
+        for (size_t i = 0; i < updates.size(); ++i) {
+            updates[i].pb_offset = MixRead16(addr + static_cast<uint32_t>(i * sizeof(PBUpdate)));
+            updates[i].new_value = MixRead16(addr + static_cast<uint32_t>(i * sizeof(PBUpdate) + sizeof(uint16_t)));
+        }
+        return updates;
+    }
+
+    void ApplyPBUpdatesForMs(AXPBWii& pb, const std::array<PBUpdate, 32>& updates, uint32_t ms) {
+        uint32_t start = 0;
+        for (uint32_t i = 0; i < ms; ++i) {
+            start += pb.updates.num_updates[i];
+        }
+        const uint32_t count = pb.updates.num_updates[ms];
+        uint16_t* words = reinterpret_cast<uint16_t*>(&pb);
+        constexpr uint32_t wordCount = sizeof(AXPBWii) / sizeof(uint16_t);
+        for (uint32_t i = start; i < start + count && i < updates.size(); ++i) {
+            if (updates[i].pb_offset >= wordCount) {
+                continue;
+            }
+            words[updates[i].pb_offset] = updates[i].new_value;
+        }
+    }
+
+    static void AdvanceBuffers(AXBuffers& buffers, uint32_t regular, uint32_t wiimote) {
+        for (size_t i = 0; i < kAxRegularBusCount; ++i) {
+            buffers[i] += regular;
+        }
+        for (size_t i = kAxRegularBusCount; i < buffers.size(); ++i) {
+            buffers[i] += wiimote;
+        }
+    }
+
+    // Both directions take their offsets in the same order - guest side first,
+    // then host side - so a mirrored read/write pair reads the same way round.
+    static void CopyGuestToStruct(uint32_t addr, size_t guestOffset, char* dst, size_t structOffset,
+                                  size_t byteCount) {
+        if (const uint8_t* guest =
+                MixResolveRange(addr + static_cast<uint32_t>(guestOffset), byteCount)) {
+            for (size_t i = 0; i < byteCount; i += sizeof(uint16_t)) {
+                uint16_t value = 0;
+                std::memcpy(&value, guest + i, sizeof(value));
+                *reinterpret_cast<uint16_t*>(dst + structOffset + i) = MemoryInline::ByteSwap16(value);
+            }
+            return;
+        }
+        for (size_t i = 0; i < byteCount; i += sizeof(uint16_t)) {
+            *reinterpret_cast<uint16_t*>(dst + structOffset + i) =
+                MixRead16(addr + static_cast<uint32_t>(guestOffset + i));
+        }
+    }
+
+    static void CopyStructToGuest(uint32_t addr, size_t guestOffset, const char* src, size_t structOffset,
+                                  size_t byteCount) {
+        if (uint8_t* guest =
+                MixResolveRange(addr + static_cast<uint32_t>(guestOffset), byteCount)) {
+            for (size_t i = 0; i < byteCount; i += sizeof(uint16_t)) {
+                BigEndian::Write16(
+                    guest + i, *reinterpret_cast<const uint16_t*>(src + structOffset + i));
+            }
+            return;
+        }
+        for (size_t i = 0; i < byteCount; i += sizeof(uint16_t)) {
+            MixWrite16(addr + static_cast<uint32_t>(guestOffset + i),
+                       *reinterpret_cast<const uint16_t*>(src + structOffset + i));
+        }
+    }
+
+    // One run of halfwords that is present in both the guest parameter block and
+    // AXPBWii, possibly at different offsets because the guest layout omits a
+    // field this struct carries.
+    struct PBSegment {
+        size_t guestOffset;
+        size_t structOffset;
+        size_t byteCount;
+    };
+
+    // The segmentation is a property of the ucode's PB layout, not of the
+    // direction of travel, so reads and writes share this one table. Returns the
+    // number of segments written into `out`.
+    static size_t PBSegmentsForLayout(PBLayout layout, std::array<PBSegment, 3>& out) {
+        constexpr size_t pbBytes = sizeof(AXPBWii);
+        constexpr size_t updatesBegin = offsetof(AXPBWii, updates);
+        constexpr size_t updatesEnd = offsetof(AXPBWii, updates) + sizeof(PBUpdatesWii);
+        constexpr size_t gapBegin = offsetof(AXPBWii, hpf) + sizeof(PBHighPassFilter);
+        constexpr size_t gapEnd = offsetof(AXPBWii, biquad) + sizeof(PBBiquadFilter);
+
+        switch (layout) {
+        case PBLayout::SkipBiquadGapOnly:
+            out[0] = {0, 0, gapBegin};
+            out[1] = {gapBegin, gapEnd, pbBytes - gapEnd};
+            return 2;
+        case PBLayout::SkipUpdatesAndBiquadGap:
+            out[0] = {0, 0, updatesBegin};
+            out[1] = {updatesBegin, updatesEnd, gapBegin - updatesEnd};
+            out[2] = {gapBegin, gapEnd, pbBytes - gapEnd};
+            return 3;
+        case PBLayout::SkipUpdatesOnly:
+        case PBLayout::Unknown:
+        default:
+            // Unknown means detection has not settled yet. ReadPB deliberately
+            // falls back to the SkipUpdatesOnly shape so it has something to
+            // score candidates against; WritePBWithLayout refuses instead,
+            // because guessing a segmentation on the way back out would corrupt
+            // the guest's parameter block.
+            out[0] = {0, 0, updatesBegin};
+            out[1] = {updatesBegin, updatesEnd, pbBytes - updatesEnd};
+            return 2;
+        }
+    }
+
+    static void ReadPBWithLayout(uint32_t addr, AXPBWii& pb, PBLayout layout) {
+        std::memset(&pb, 0, sizeof(pb));
+        char* dst = reinterpret_cast<char*>(&pb);
+        std::array<PBSegment, 3> segments{};
+        const size_t count = PBSegmentsForLayout(layout, segments);
+        for (size_t i = 0; i < count; ++i) {
+            CopyGuestToStruct(addr, segments[i].guestOffset, dst, segments[i].structOffset,
+                              segments[i].byteCount);
+        }
+    }
+
+    static void WritePBWithLayout(uint32_t addr, const AXPBWii& pb, PBLayout layout) {
+        if (layout == PBLayout::Unknown) {
+            // See PBSegmentsForLayout: no segmentation is known to be correct,
+            // so nothing is written back. WritePB refuses earlier for the same
+            // reason; this is the guard that makes it safe on its own.
+            return;
+        }
+        const char* src = reinterpret_cast<const char*>(&pb);
+        std::array<PBSegment, 3> segments{};
+        const size_t count = PBSegmentsForLayout(layout, segments);
+        for (size_t i = 0; i < count; ++i) {
+            CopyStructToGuest(addr, segments[i].guestOffset, src, segments[i].structOffset,
+                              segments[i].byteCount);
+        }
+    }
+
+    static bool LooksLikeMainRamPointer(uint32_t addr) {
+        return addr == 0 || MixContains(addr, sizeof(uint16_t) * 8);
+    }
+
+    static bool LooksLikeAxSampleFormat(uint16_t format) {
+        return format == 0 || format == 0x19 || format == 0x0a;
+    }
+
+    static int ScorePBLayout(uint32_t addr, const AXPBWii& pb) {
+        int score = 0;
+        const uint32_t next = Hilo(pb.next_pb_hi, pb.next_pb_lo);
+        const uint32_t self = Hilo(pb.this_pb_hi, pb.this_pb_lo);
+        const uint32_t ratio = Hilo(pb.src.ratio_hi, pb.src.ratio_lo);
+        const uint32_t loop = Hilo(pb.audio_addr.loop_addr_hi, pb.audio_addr.loop_addr_lo);
+        const uint32_t end = Hilo(pb.audio_addr.end_addr_hi, pb.audio_addr.end_addr_lo);
+        const uint32_t current = Hilo(pb.audio_addr.cur_addr_hi, pb.audio_addr.cur_addr_lo);
+
+        score += LooksLikeMainRamPointer(next) ? 8 : -16;
+        score += self == addr ? 12 : (LooksLikeMainRamPointer(self) ? 2 : -8);
+        score += pb.running <= 1 ? 8 : -16;
+        score += pb.running == 1 ? 16 : 0;
+        score += pb.is_stream <= 1 ? 3 : -4;
+        score += pb.src_type <= 2 ? 8 : -10;
+        score += LooksLikeAxSampleFormat(pb.audio_addr.sample_format) ? 14 : -12;
+        score += ratio > 0 && ratio <= 0x00040000u ? 12 : (pb.running == 1 ? -12 : 0);
+        score += (loop & 0xfc000000u) == 0 ? 5 : -5;
+        score += (end & 0xfc000000u) == 0 ? 5 : -5;
+        score += (current & 0xc0000000u) == 0 || (current & 0xc0000000u) == 0x80000000u ? 5 : -5;
+        score += end >= loop ? 4 : -4;
+        return score;
+    }
+
+    PBLayout DetectPBLayout(uint32_t addr) {
+        struct Candidate {
+            PBLayout layout;
+            AXPBWii pb;
+            int score;
+        };
+        std::array<Candidate, 3> candidates{{
+            {PBLayout::SkipUpdatesOnly, {}, 0},
+            {PBLayout::SkipUpdatesAndBiquadGap, {}, 0},
+            {PBLayout::SkipBiquadGapOnly, {}, 0},
+        }};
+        Candidate* best = nullptr;
+        for (Candidate& candidate : candidates) {
+            ReadPBWithLayout(addr, candidate.pb, candidate.layout);
+            candidate.score = ScorePBLayout(addr, candidate.pb);
+            if (candidate.pb.running == 1 && (!best || candidate.score > best->score)) {
+                best = &candidate;
+            }
+        }
+        if (!best || best->score < 40) {
+            return PBLayout::Unknown;
+        }
+        return best->layout;
+    }
+
+    void ReadPB(uint32_t addr, AXPBWii& pb) {
+        PBLayout layout = m_pbLayout;
+        if (layout == PBLayout::Unknown) {
+            layout = DetectPBLayout(addr);
+            if (layout != PBLayout::Unknown) {
+                m_pbLayout = layout;
+            } else {
+                layout = PBLayout::SkipUpdatesOnly;
+            }
+        }
+        ReadPBWithLayout(addr, pb, layout);
+    }
+
+    void ConfigureFromTaskLocked(uint32_t taskPtr) {
+        if (taskPtr == 0) {
+            return;
+        }
+
+        const uint32_t iramAddr = ReadGuestU32OrZero(taskPtr + 0x0cu);
+        const uint32_t iramLength = ReadGuestU32OrZero(taskPtr + 0x10u);
+        const uint32_t crc = HashEctorGuest(iramAddr, iramLength);
+        if (crc == 0) {
+            return;
+        }
+
+        m_ucodeCrc = crc;
+        const PBLayout derivedPBLayout = PBLayoutForUCode(crc);
+        if (derivedPBLayout != PBLayout::Unknown) {
+            m_pbLayout = derivedPBLayout;
+        }
+        m_commandLayout = CommandLayoutForUCode(crc);
+    }
+
+    // PB write-back goes straight into guest memory even from the worker, deliberately:
+    // the CPU's only PB chain access is __AXServiceVPB, reached from __AXSyncPBs before
+    // the mail that starts a mix (and after the previous mix was joined), so guest and mix
+    // never touch a PB concurrently. Shadowing it would only risk a stale-snapshot clobber.
+    void WritePB(uint32_t addr, const AXPBWii& pb) const {
+        if (m_pbLayout == PBLayout::Unknown) {
+            return;
+        }
+        WritePBWithLayout(addr, pb, m_pbLayout);
+    }
+
+    void RunCompressor(uint16_t threshold, uint16_t releaseFrames, uint32_t tableAddr) {
+        bool triggered = false;
+        for (uint32_t i = 0; i < kAxSamplesPerFrame; ++i) {
+            const int64_t left = m_bus[kBusMainL][i];
+            const int64_t right = m_bus[kBusMainR][i];
+            if ((left < 0 ? -left : left) > threshold || (right < 0 ? -right : right) > threshold) {
+                triggered = true;
+                break;
+            }
+        }
+
+        constexpr uint32_t kAttackEntryCount = 11;
+        const uint32_t frameByteSize = kAxSamplesPerFrame * sizeof(uint16_t);
+        uint32_t tableOffset = 0;
+        if (triggered) {
+            tableOffset = m_compressorPos * frameByteSize;
+            m_compressorPos = releaseFrames;
+        } else if (m_compressorPos != 0) {
+            --m_compressorPos;
+            tableOffset = (kAttackEntryCount + m_compressorPos) * frameByteSize;
+        } else {
+            return;
+        }
+
+        for (uint32_t i = 0; i < kAxSamplesPerFrame; ++i) {
+            const uint16_t coef = MixRead16(tableAddr + tableOffset + i * sizeof(uint16_t));
+            m_bus[kBusMainL][i] =
+                static_cast<int>((static_cast<int64_t>(m_bus[kBusMainL][i]) * coef) >> 15);
+            m_bus[kBusMainR][i] =
+                static_cast<int>((static_cast<int64_t>(m_bus[kBusMainR][i]) * coef) >> 15);
+        }
+    }
+
+    void ProcessVoice(AXPBWii& pb, const AXBuffers& buffers, uint32_t count, AXMixControl control,
+                      const int16_t* coeffs, bool newFilter) {
+        if (pb.running != 1) {
+            return;
+        }
+        Accelerator accel;
+        accel.Setup(&pb);
+        std::array<int16_t, kAxSamplesPerFrame> samples{};
+        Resample(accel, pb, samples.data(), count, coeffs);
+        // Same wrapping 16-bit ramp as MixAdd, minus the accumulate. The two's
+        // complement wrap of the int16 envelope is bit-identical to the uint16
+        // wrap the kernel performs, so the value stored back is unchanged.
+        pb.vol_env.cur_volume = static_cast<int16_t>(AxMixKernels::ScaleRamp(
+            samples.data(), count, static_cast<uint16_t>(pb.vol_env.cur_volume),
+            static_cast<uint16_t>(pb.vol_env.cur_volume_delta)));
+        if (pb.lpf.on) {
+            LowPassFilter(samples.data(), count, pb.lpf);
+        }
+        if (newFilter && pb.biquad.on) {
+            BiquadFilter(samples.data(), count, pb.biquad);
+        }
+
+        auto mix = [&](uint32_t bit, uint32_t rampBit, int* out, VolumeData& vd, int16_t& dpop) {
+            if ((control & bit) == 0) {
+                return;
+            }
+            MixAdd(out, samples.data(), count, vd, dpop, (control & rampBit) != 0);
+        };
+        mix(MIX_MAIN_L, MIX_MAIN_L_RAMP, buffers[kBusMainL], pb.mixer.main_left, pb.dpop.main_left);
+        mix(MIX_MAIN_R, MIX_MAIN_R_RAMP, buffers[kBusMainR], pb.mixer.main_right, pb.dpop.main_right);
+        mix(MIX_MAIN_S, MIX_MAIN_S_RAMP, buffers[kBusMainS], pb.mixer.main_surround, pb.dpop.main_surround);
+        mix(MIX_AUXA_L, MIX_AUXA_L_RAMP, buffers[kBusAuxAL], pb.mixer.auxA_left, pb.dpop.auxA_left);
+        mix(MIX_AUXA_R, MIX_AUXA_R_RAMP, buffers[kBusAuxAR], pb.mixer.auxA_right, pb.dpop.auxA_right);
+        mix(MIX_AUXA_S, MIX_AUXA_S_RAMP, buffers[kBusAuxAS], pb.mixer.auxA_surround, pb.dpop.auxA_surround);
+        mix(MIX_AUXB_L, MIX_AUXB_L_RAMP, buffers[kBusAuxBL], pb.mixer.auxB_left, pb.dpop.auxB_left);
+        mix(MIX_AUXB_R, MIX_AUXB_R_RAMP, buffers[kBusAuxBR], pb.mixer.auxB_right, pb.dpop.auxB_right);
+        mix(MIX_AUXB_S, MIX_AUXB_S_RAMP, buffers[kBusAuxBS], pb.mixer.auxB_surround, pb.dpop.auxB_surround);
+        mix(MIX_AUXC_L, MIX_AUXC_L_RAMP, buffers[kBusAuxCL], pb.mixer.auxC_left, pb.dpop.auxC_left);
+        mix(MIX_AUXC_R, MIX_AUXC_R_RAMP, buffers[kBusAuxCR], pb.mixer.auxC_right, pb.dpop.auxC_right);
+        mix(MIX_AUXC_S, MIX_AUXC_S_RAMP, buffers[kBusAuxCS], pb.mixer.auxC_surround, pb.dpop.auxC_surround);
+
+        if (pb.remote) {
+            if (newFilter && pb.remote_iir.on) {
+                if (pb.remote_iir.on == 2) {
+                    BiquadFilter(samples.data(), count, pb.remote_iir.biquad);
+                } else {
+                    LowPassFilter(samples.data(), count, pb.remote_iir.lpf);
+                }
+            }
+
+            const uint32_t wmCount = count == kAxSamplesPerFrame ? 18u : 6u;
+            std::array<int16_t, 18> wmSamples{};
+            pb.remote_src.cur_addr_frac = static_cast<uint16_t>(ResampleAudio(
+                [&samples, count](uint32_t index) {
+                    return samples[std::min<uint32_t>(index, count - 1)];
+                },
+                wmSamples.data(), wmCount, pb.remote_src.last_samples, pb.remote_src.cur_addr_frac,
+                0x00055555u, 0, coeffs));
+
+            auto mixRemote = [&](uint32_t channel, int* out, VolumeData& vd, int16_t& dpop) {
+                const uint16_t mode = static_cast<uint16_t>((pb.remote_mixer_control >> (channel * 2)) & 3u);
+                if (mode == 0) {
+                    return;
+                }
+                MixAdd(out, wmSamples.data(), wmCount, vd, dpop, (mode & 2u) != 0);
+            };
+            mixRemote(0, buffers[kBusWm0Main], pb.remote_mixer.main0, pb.remote_dpop.main0);
+            mixRemote(1, buffers[kBusWm0Aux], pb.remote_mixer.aux0, pb.remote_dpop.aux0);
+            mixRemote(2, buffers[kBusWm1Main], pb.remote_mixer.main1, pb.remote_dpop.main1);
+            mixRemote(3, buffers[kBusWm1Aux], pb.remote_mixer.aux1, pb.remote_dpop.aux1);
+            mixRemote(4, buffers[kBusWm2Main], pb.remote_mixer.main2, pb.remote_dpop.main2);
+            mixRemote(5, buffers[kBusWm2Aux], pb.remote_mixer.aux2, pb.remote_dpop.aux2);
+            mixRemote(6, buffers[kBusWm3Main], pb.remote_mixer.main3, pb.remote_dpop.main3);
+            mixRemote(7, buffers[kBusWm3Aux], pb.remote_mixer.aux3, pb.remote_dpop.aux3);
+        }
+    }
+
+    template <typename Reader>
+    static uint32_t ResampleAudio(Reader&& readSample, int16_t* out, uint32_t count, int16_t* lastSamples,
+                                  uint32_t pos, uint32_t ratio, uint16_t srcType,
+                                  const int16_t* coeffs = nullptr) {
+        if (coeffs && srcType == 0) {
+            std::array<int16_t, 4> temp{};
+            std::memcpy(temp.data(), lastSamples, sizeof(int16_t) * 4);
+            uint32_t idx = 4;
+            uint32_t readSamples = 0;
+            for (uint32_t i = 0; i < count; ++i) {
+                pos += ratio;
+                while (pos >= 0x10000u) {
+                    temp[idx++ & 3] = readSample(readSamples++);
+                    pos -= 0x10000u;
+                }
+
+                const uint16_t fracIndex = static_cast<uint16_t>(((pos & 0xffffu) >> 9) << 2);
+                const int16_t* c = coeffs + fracIndex;
+                const int64_t t0 = temp[idx++ & 3];
+                const int64_t t1 = temp[idx++ & 3];
+                const int64_t t2 = temp[idx++ & 3];
+                const int64_t t3 = temp[idx++ & 3];
+                out[i] = ClampS16((t0 * c[0] + t1 * c[1] + t2 * c[2] + t3 * c[3]) >> 15);
+            }
+            lastSamples[3] = temp[--idx & 3];
+            lastSamples[2] = temp[--idx & 3];
+            lastSamples[1] = temp[--idx & 3];
+            lastSamples[0] = temp[--idx & 3];
+            return pos & 0xffffu;
+        }
+
+        // SRCTYPE_POLYPHASE (0) without a table and SRCTYPE_LINEAR (1) both degrade to
+        // LINEAR; anything else (SRCTYPE_NEAREST or undefined) reads the accelerator 1:1
+        // and ignores the ratio, matching DSPHLE's ResampleAudio branch order.
+        if (srcType != 0 && srcType != 1) {
+            for (uint32_t i = 0; i < count; ++i) {
+                out[i] = readSample(i);
+            }
+            if (count >= 4) {
+                std::memcpy(lastSamples, out + count - 4, sizeof(int16_t) * 4);
+            }
+            return pos;
+        }
+
+        std::array<int16_t, 4> temp{};
+        std::memcpy(temp.data(), lastSamples, sizeof(int16_t) * 4);
+        uint32_t idx = 4;
+        uint32_t readSamples = 0;
+        for (uint32_t i = 0; i < count; ++i) {
+            pos += ratio;
+            while (pos >= 0x10000u) {
+                temp[idx++ & 3] = readSample(readSamples++);
+                pos -= 0x10000u;
+            }
+            const uint16_t frac = pos & 0xffffu;
+            if (frac == 0) {
+                out[i] = temp[idx++ & 3];
+                idx += 3;
+            } else {
+                const int32_t s0 = temp[idx++ & 3];
+                const int32_t s1 = temp[idx++ & 3];
+                idx += 2;
+                out[i] = static_cast<int16_t>((s0 * static_cast<uint16_t>(-frac) + s1 * frac) >> 16);
+            }
+        }
+        lastSamples[3] = temp[--idx & 3];
+        lastSamples[2] = temp[--idx & 3];
+        lastSamples[1] = temp[--idx & 3];
+        lastSamples[0] = temp[--idx & 3];
+        return pos & 0xffffu;
+    }
+
+    // `coeffs` is the DROM base; the bank is selected here, per voice, exactly
+    // where GetInputSamples selects it.
+    static void Resample(Accelerator& accel, AXPBWii& pb, int16_t* out, uint32_t count,
+                         const int16_t* coeffs) {
+        pb.src.cur_addr_frac = static_cast<uint16_t>(ResampleAudio(
+            [&accel](uint32_t) {
+                return accel.ReadSample();
+            },
+            out, count, pb.src.last_samples, pb.src.cur_addr_frac,
+            Hilo(pb.src.ratio_hi, pb.src.ratio_lo), pb.src_type,
+            VoiceCoefficients(coeffs, pb.coef_select)));
+    }
+
+    static void MixAdd(int* out, const int16_t* input, uint32_t count, VolumeData& vd, int16_t& dpop, bool ramp) {
+        // int16 x uint16 always fits in int32, so the 64-bit clamp the generic
+        // helper performs is unnecessary here.
+        const uint16_t delta = ramp ? vd.volume_delta : 0;
+        vd.volume = AxMixKernels::MixAddRamp(out, input, count, vd.volume, delta, dpop);
+    }
+
+    static void LowPassFilter(int16_t* samples, uint32_t count, PBLowPassFilter& filter) {
+        for (uint32_t i = 0; i < count; ++i) {
+            filter.yn1 = samples[i] = ClampS16((filter.a0 * static_cast<int32_t>(samples[i]) +
+                                                filter.b0 * static_cast<int32_t>(filter.yn1)) >> 15);
+        }
+    }
+
+    static void BiquadFilter(int16_t* samples, uint32_t count, PBBiquadFilter& filter) {
+        for (uint32_t i = 0; i < count; ++i) {
+            const int16_t xn0 = samples[i];
+            int64_t value = 0;
+            value += filter.b0 * static_cast<int32_t>(xn0);
+            value += filter.b1 * static_cast<int32_t>(filter.xn1);
+            value += filter.b2 * static_cast<int32_t>(filter.xn2);
+            value += filter.a1 * static_cast<int32_t>(filter.yn1);
+            value += filter.a2 * static_cast<int32_t>(filter.yn2);
+            value <<= 2;
+            value += (value & 0x10000) ? 0x8000 : 0x7fff;
+            const int16_t yn0 = ClampS16(value >> 16);
+            filter.xn2 = filter.xn1;
+            filter.yn2 = filter.yn1;
+            filter.xn1 = xn0;
+            filter.yn1 = yn0;
+            samples[i] = yn0;
+        }
+    }
+
+    void MixAUXSamples(uint32_t auxId, uint32_t writeAddr, uint32_t readAddr, uint16_t volume) {
+        std::array<uint16_t, kAxSamplesPerFrame> ramp{};
+        GenerateVolumeRamp(ramp.data(), m_lastAuxVolumes[auxId], volume, ramp.size());
+        m_lastAuxVolumes[auxId] = volume;
+        std::array<int*, 3> src{};
+        if (auxId == 0) src = {m_bus[kBusAuxAL].data(), m_bus[kBusAuxAR].data(), m_bus[kBusAuxAS].data()};
+        if (auxId == 1) src = {m_bus[kBusAuxBL].data(), m_bus[kBusAuxBR].data(), m_bus[kBusAuxBS].data()};
+        if (auxId == 2) src = {m_bus[kBusAuxCL].data(), m_bus[kBusAuxCR].data(), m_bus[kBusAuxCS].data()};
+        if (writeAddr) {
+            for (int* buffer : src) {
+                WriteAuxOutBuffer(writeAddr, buffer, kAxSamplesPerFrame);
+                writeAddr += kAxSamplesPerFrame * sizeof(int32_t);
+            }
+        }
+        std::array<int*, 3> dst = {m_bus[kBusMainL].data(), m_bus[kBusMainR].data(), m_bus[kBusMainS].data()};
+        std::array<int, kAxSamplesPerFrame> aux{};
+        for (int* buffer : dst) {
+            ReadAuxInBuffer(readAddr, aux.data(), kAxSamplesPerFrame);
+            readAddr += kAxSamplesPerFrame * sizeof(int32_t);
+            AxMixKernels::MixAccumRamp32(buffer, aux.data(), ramp.data(), kAxSamplesPerFrame);
+        }
+    }
+
+    void UploadAUXMixLRSC(int auxId, uint32_t* addresses, uint16_t volume) {
+        int* auxLeft = auxId ? m_bus[kBusAuxBL].data() : m_bus[kBusAuxAL].data();
+        int* auxRight = auxId ? m_bus[kBusAuxBR].data() : m_bus[kBusAuxAR].data();
+        int* auxSurround = auxId ? m_bus[kBusAuxBS].data() : m_bus[kBusAuxAS].data();
+        int* auxCBuffer = auxId ? m_bus[kBusAuxCS].data() : m_bus[kBusAuxCR].data();
+        WriteAuxOutBuffer(addresses[0], auxLeft, kAxSamplesPerFrame);
+        WriteAuxOutBuffer(addresses[0] + kAxSamplesPerFrame * sizeof(int32_t), auxRight, kAxSamplesPerFrame);
+        WriteAuxOutBuffer(addresses[0] + 2 * kAxSamplesPerFrame * sizeof(int32_t), auxSurround, kAxSamplesPerFrame);
+        WriteAuxOutBuffer(addresses[1], auxCBuffer, kAxSamplesPerFrame);
+        std::array<uint16_t, kAxSamplesPerFrame> ramp{};
+        GenerateVolumeRamp(ramp.data(), m_lastAuxVolumes[auxId], volume, ramp.size());
+        m_lastAuxVolumes[auxId] = volume;
+        std::array<int*, 4> mixDest = {m_bus[kBusMainL].data(), m_bus[kBusMainR].data(),
+                                       m_bus[kBusMainS].data(), m_bus[kBusAuxCL].data()};
+        std::array<int, kAxSamplesPerFrame> temp{};
+        for (uint32_t i = 0; i < mixDest.size(); ++i) {
+            ReadAuxInBuffer(addresses[2 + i], temp.data(), kAxSamplesPerFrame);
+            AxMixKernels::MixAccumRamp32(mixDest[i], temp.data(), ramp.data(),
+                                         kAxSamplesPerFrame);
+        }
+    }
+
+    void OutputSamples(uint32_t lrAddr, uint32_t surroundAddr, uint16_t volume, bool uploadAuxC) {
+        std::array<uint16_t, kAxSamplesPerFrame> ramp{};
+        GenerateVolumeRamp(ramp.data(), m_lastMainVolume, volume, ramp.size());
+        m_lastMainVolume = volume;
+        WriteGuestS32Buffer(surroundAddr, m_bus[kBusMainS].data(), kAxSamplesPerFrame);
+        if (uploadAuxC) {
+            WriteGuestS32Buffer(surroundAddr + kAxSamplesPerFrame * sizeof(int32_t),
+                                m_bus[kBusAuxCL].data(), kAxSamplesPerFrame);
+        }
+        std::array<int16_t, kAxSamplesPerFrame * 2> pcm{};
+        for (uint32_t i = 0; i < kAxSamplesPerFrame; ++i) {
+            const int16_t left = ClampS16((static_cast<int64_t>(m_bus[kBusMainL][i]) * ramp[i]) >> 15);
+            const int16_t right = ClampS16((static_cast<int64_t>(m_bus[kBusMainR][i]) * ramp[i]) >> 15);
+            // OUTPUT is destructive on the DSP: the main buses are left holding the ramped,
+            // clamped result (not the wide accumulator) so any mixing after it sees that value.
+            m_bus[kBusMainL][i] = left;
+            m_bus[kBusMainR][i] = right;
+            pcm[i * 2] = right;
+            pcm[i * 2 + 1] = left;
+        }
+        // The AI frame (contiguous right/left interleaved) lands in guest memory directly
+        // even from the worker: its only reader, PushAudioBlock, runs after Audio_HLE_Tick
+        // has joined the worker, so the guest never observes a half-written frame.
+        if (uint8_t* host = MixResolveRange(lrAddr, pcm.size() * sizeof(int16_t))) {
+            for (size_t i = 0; i < pcm.size(); ++i) {
+                BigEndian::Write16(host + i * sizeof(uint16_t), static_cast<uint16_t>(pcm[i]));
+            }
+        } else {
+            for (uint32_t i = 0; i < kAxSamplesPerFrame; ++i) {
+                MixWrite16(lrAddr + i * 4, static_cast<uint16_t>(pcm[i * 2]));
+                MixWrite16(lrAddr + i * 4 + 2, static_cast<uint16_t>(pcm[i * 2 + 1]));
+            }
+        }
+    }
+
+    void OutputWMSamples(uint32_t* addresses) {
+        const AXBuffers all = MixBuffers();
+        const std::array<int*, 4> buffers = {all[kBusWm0Main], all[kBusWm1Main], all[kBusWm2Main],
+                                             all[kBusWm3Main]};
+        for (uint32_t i = 0; i < buffers.size(); ++i) {
+            for (uint32_t j = 0; j < kAxWiimoteSamplesPerFrame; ++j) {
+                MixWrite16(addresses[i] + j * 2, static_cast<uint16_t>(ClampS16(buffers[i][j])));
+            }
+        }
+    }
+
+    // Aux OUT/IN stay off guest memory during a deferred mix, since __AXProcessAux reads a mix
+    // result inside the same __AXOutNewFrame that produced it: OUT shadows to a host buffer
+    // JoinMix publishes one AX frame later (a 3 ms older reverb tap, not a dry-signal change),
+    // and IN snapshots at mail time to match a synchronous mix. Reads check this frame's shadow
+    // first, so a same-buffer write/read still behaves like a synchronous read-back.
+    void WriteAuxOutBuffer(uint32_t addr, const int* src, uint32_t count) {
+        if (!m_deferredAux) {
+            WriteGuestS32Buffer(addr, src, count);
+            return;
+        }
+        if (addr == 0) {
+            return;
+        }
+        if (m_auxOutCount >= m_auxOut.size()) {
+            ReportAuxShadowOverflow();
+            return;
+        }
+        AuxBlock& block = m_auxOut[m_auxOutCount++];
+        block.addr = addr;
+        std::memcpy(block.data.data(), src, count * sizeof(int32_t));
+    }
+
+    void ReadAuxInBuffer(uint32_t addr, int* dst, uint32_t count) {
+        if (m_deferredAux) {
+            for (uint32_t i = m_auxOutCount; i-- > 0;) {
+                if (m_auxOut[i].addr == addr) {
+                    std::memcpy(dst, m_auxOut[i].data.data(), count * sizeof(int32_t));
+                    return;
+                }
+            }
+            for (uint32_t i = 0; i < m_auxInCount; ++i) {
+                if (m_auxIn[i].addr == addr) {
+                    std::memcpy(dst, m_auxIn[i].data.data(), count * sizeof(int32_t));
+                    return;
+                }
+            }
+        }
+        ReadGuestS32Buffer(addr, dst, count);
+    }
+
+    // Guest thread only, with the worker joined.
+    void PublishAuxOutputs() {
+        for (uint32_t i = 0; i < m_auxOutCount; ++i) {
+            WriteGuestS32Buffer(m_auxOut[i].addr, m_auxOut[i].data.data(), kAxSamplesPerFrame);
+        }
+        // Publish exactly once: __AXProcessAux may process the aux buffer in
+        // place, so replaying the shadow at the next join would overwrite the
+        // reverb result the guest just computed.
+        m_auxOutCount = 0;
+    }
+
+    void ReportAuxShadowOverflow() {
+        if (m_loggedAuxShadowOverflow.exchange(true, std::memory_order_relaxed)) {
+            return;
+        }
+        RT_LOGF(RT_TAG_AUDIO, "aux-out shadow overflow; dropped an aux upload\n");
+        std::fflush(stderr);
+    }
+
+    bool EnsureMixWorker() {
+        if (m_mixThread.joinable()) {
+            return true;
+        }
+        if (g_mixMem1.load(std::memory_order_relaxed) == nullptr) {
+            return false;
+        }
+        RT_LOGF(RT_TAG_AUDIO, "starting the AX/DSP mix worker thread\n");
+        std::fflush(stderr);
+        m_mixStop = false;
+        m_mixPending = false;
+        m_mixBusy = false;
+        try {
+            m_mixThread = std::thread([this] { MixWorkerMain(); });
+        } catch (const std::system_error&) {
+            RT_LOGF(RT_TAG_AUDIO, "failed to start the mix worker; mixing inline\n");
+            std::fflush(stderr);
+            return false;
+        }
+        return true;
+    }
+
+    void MixWorkerMain() {
+        t_onMixWorker = true;
+        for (;;) {
+            {
+                std::unique_lock<std::mutex> lock(m_mixMutex);
+                m_mixWake.wait(lock, [this] { return m_mixStop || m_mixPending; });
+                if (!m_mixPending) {
+                    return;
+                }
+                m_mixPending = false;
+                m_mixBusy = true;
+            }
+
+            try {
+                ExecuteCommandList(m_mixLayout, m_mixCmdListSize);
+            } catch (const std::exception& error) {
+                ReportMixWorkerFailure(error.what());
+            } catch (...) {
+                ReportMixWorkerFailure("unknown exception");
+            }
+
+            {
+                std::lock_guard<std::mutex> lock(m_mixMutex);
+                m_mixBusy = false;
+            }
+            m_mixIdle.notify_all();
+        }
+    }
+
+    void ReportMixWorkerFailure(const char* what) {
+        if (m_loggedMixWorkerFailure.exchange(true, std::memory_order_relaxed)) {
+            return;
+        }
+        RT_LOGF(RT_TAG_AUDIO, "worker aborted a command list: %s\n", what);
+        std::fflush(stderr);
+    }
+
+    mutable std::mutex m_mutex;
+    MailState m_mailState = MailState::WaitingForCmdListSize;
+    bool m_toDspBusy = false;
+    uint32_t m_cmdListSize = 0;
+    std::array<uint16_t, 512> m_cmdList{};
+    std::deque<uint32_t> m_cpuMails;
+    uint32_t m_lastCpuMail = 0;
+    uint32_t m_compressorPos = 0;
+    uint32_t m_deferredResumeCallbacks = 0;
+    uint32_t m_ucodeCrc = 0;
+    PBLayout m_pbLayout = PBLayout::Unknown;
+    AXCommandLayout m_commandLayout = AXCommandLayout::Auto;
+    bool m_triedLoadCoeffs = false;
+    bool m_hasCoeffs = false;
+    std::array<int16_t, 0x800> m_coeffs{};
+    // Indexed by AxBus. The wiimote buses live in their own array because they
+    // are 18 samples per frame rather than 96.
+    std::array<std::array<int, kAxSamplesPerFrame>, kAxRegularBusCount> m_bus{};
+    std::array<std::array<int, kAxWiimoteSamplesPerFrame>, kAxWiimoteBusCount> m_wmBus{};
+    uint16_t m_lastMainVolume = 0x8000;
+    std::array<uint16_t, 3> m_lastAuxVolumes{};
+
+    // Mix worker handshake.
+    std::thread m_mixThread;
+    mutable std::mutex m_mixMutex;
+    std::condition_variable m_mixWake;  // guest -> worker
+    std::condition_variable m_mixIdle;  // worker -> guest
+    bool m_mixStop = false;
+    bool m_mixPending = false;
+    bool m_mixBusy = false;
+    bool m_mixWorkerEnabled = false;
+    AXCommandLayout m_mixLayout = AXCommandLayout::New;
+    uint32_t m_mixCmdListSize = 0;
+    std::atomic<bool> m_loggedMixWorkerFailure{false};
+    std::atomic<bool> m_loggedAuxShadowOverflow{false};
+    std::atomic<bool> m_loggedUnknownCommand{false};
+    std::atomic<bool> m_loggedCmdListTruncated{false};
+
+    // Aux marshalling. m_deferredAux is written by the guest thread before the
+    // worker is signalled and read by whichever thread runs the mix.
+    bool m_deferredAux = false;
+    uint32_t m_auxOutCount = 0;
+    uint32_t m_auxInCount = 0;
+    std::array<AuxBlock, 24> m_auxOut{};
+    std::array<AuxBlock, 24> m_auxIn{};
+};
+
+AXWii& Instance() {
+    static AXWii ax;
+    return ax;
+}
+
+} // namespace
+
+void Init() {
+    InitAram();
+    Instance().Initialize();
+}
+
+void InitForAXOut(CpuContext* ctx) {
+    Init();
+    g_axTaskPtr = kAxDspTaskAddr;
+    Memory::Write32(g_axTaskPtr + 0x00u, 1);
+    Memory::Write32(g_axTaskPtr + 0x04u, 0);
+    Memory::Write32(g_axTaskPtr + 0x0cu, kAxIramMmemAddr);
+    Memory::Write32(g_axTaskPtr + 0x14u, 0);
+    Memory::Write32(g_axTaskPtr + 0x18u, kAxDramMmemAddr);
+    Memory::Write32(g_axTaskPtr + 0x1cu, kAxDramLength);
+    Memory::Write32(g_axTaskPtr + 0x20u, kAxDramDspAddr);
+    Memory::Write32(g_axTaskPtr + 0x28u, kAxInitCallback);
+    Memory::Write32(g_axTaskPtr + 0x2cu, kAxResumeCallback);
+    Memory::Write32(g_axTaskPtr + 0x30u, kAxDoneCallback);
+    Memory::Write32(g_axTaskPtr + 0x34u, kAxRequestCallback);
+    if (ctx) {
+        const uint32_t r13 = ctx->gpr[13];
+        Memory::Write32(g_axTaskPtr + 0x10u, Memory::Read16(r13 - 0x73fcu));
+        Memory::Write16(g_axTaskPtr + 0x24u, Memory::Read16(r13 - 0x7400u));
+        Memory::Write16(g_axTaskPtr + 0x26u, Memory::Read16(r13 - 0x73feu));
+    }
+    Instance().ConfigureFromTask(g_axTaskPtr);
+    LinkSingleDspTask(g_axTaskPtr);
+    if (ctx) {
+        const uint32_t r13 = ctx->gpr[13];
+        Memory::Write32(r13 - 0x66d8u, 1);
+        Memory::Write32(r13 - 0x66dcu, 0);
+    }
+}
+
+void Stop() {
+    Instance().Stop();
+}
+
+uint32_t CheckInit() {
+    return ReadGuestU32OrZero(kDspInitializedAddr);
+}
+
+uint32_t AddTask(uint32_t taskPtr) {
+    if (taskPtr == 0) {
+        return 0;
+    }
+
+    MarkDspInitialized();
+    Instance().ConfigureFromTask(taskPtr);
+    const uint32_t firstTask = ReadGuestU32OrZero(kDspFirstTaskAddr);
+    if (firstTask == 0) {
+        LinkSingleDspTask(taskPtr);
+    } else {
+        const uint32_t oldCurrent = ReadGuestU32OrZero(kDspCurrentTaskAddr);
+        Memory::TryWrite32(oldCurrent + 0x38u, taskPtr);
+        Memory::TryWrite32(taskPtr + 0x38u, 0);
+        Memory::TryWrite32(taskPtr + 0x3cu, oldCurrent);
+        Memory::TryWrite32(kDspCurrentTaskAddr, taskPtr);
+    }
+    Memory::TryWrite32(taskPtr + 0x00u, 0);
+    Memory::TryWrite32(taskPtr + 0x08u, 1);
+    if (taskPtr == ReadGuestU32OrZero(kDspFirstTaskAddr)) {
+        AssertTask(taskPtr);
+    }
+    return taskPtr;
+}
+
+void SendMailToDSP(uint32_t mail) {
+    Instance().SendMail(mail);
+}
+
+uint32_t CheckMailToDSP() {
+    return Instance().CheckMailToDSP();
+}
+
+uint32_t CheckMailFromDSP() {
+    return Instance().CheckMailFromDSP();
+}
+
+uint32_t ReadMailFromDSP() {
+    return Instance().ReadMailFromDSP();
+}
+
+uint32_t AssertTask(uint32_t taskPtr) {
+    if (taskPtr != 0) {
+        g_axTaskPtr = taskPtr;
+        Memory::TryWrite32(kDspAssertPendingAddr, 1);
+        Memory::TryWrite32(kDspAssertTaskAddr, taskPtr);
+        Memory::TryWrite32(kDspRunningTaskAddr, taskPtr);
+        Memory::Write32(taskPtr, 1);
+        Instance().QueueResumeCallback();
+    }
+    return taskPtr;
+}
+
+void ServiceDeferredCallbacks() {
+    Instance().ServiceDeferredCallbacks();
+}
+
+void InitAram() {
+    // Retire cached host sample windows: the guest memory map may have been rebuilt since
+    // the last AX session, so the worker (which caches a window thread_local) must be idle
+    // across the generation bump and region-base refresh.
+    Instance().JoinMix();
+    RefreshMixMemoryMap();
+    g_aramWindowGeneration.fetch_add(1, std::memory_order_relaxed);
+}
+
+void JoinMixWorker() {
+    Instance().JoinMix();
+}
+
+void ShutdownMixWorker() {
+    Instance().ShutdownMixWorker();
+}
+
+void SetMixWorkerEnabled(bool enabled) {
+    Instance().SetMixWorkerEnabled(enabled);
+}
+
+} // namespace AxDspHle
diff --git a/runtime/src/hle/audio/ax_mix_kernels.h b/runtime/src/hle/audio/ax_mix_kernels.h
new file mode 100644
index 0000000..687d6ba
--- /dev/null
+++ b/runtime/src/hle/audio/ax_mix_kernels.h
@@ -0,0 +1,289 @@
+#pragma once
+
+#include "isa/big_endian.h"
+
+// AX/DSP fixed-point mix kernels: the inner loops of the AXWii command-list mix in ax_mix.cpp.
+// Each exists as a scalar reference (a literal transcription of the loop it replaced) and an AVX2 form.
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+#if defined(__AVX2__)
+#include <immintrin.h>
+#define MKW_AX_MIX_AVX2 1
+#else
+#define MKW_AX_MIX_AVX2 0
+#endif
+
+namespace AxMixKernels {
+
+inline int16_t ClampToS16(int32_t value) {
+    if (value < -0x8000) {
+        return static_cast<int16_t>(-0x8000);
+    }
+    if (value > 0x7fff) {
+        return static_cast<int16_t>(0x7fff);
+    }
+    return static_cast<int16_t>(value);
+}
+
+// MixAdd: accumulates a voice into a 32-bit mix bus through a 16-bit volume ramp, remembering the
+// last emitted sample as the de-pop value. Returns the ramp after `count` steps; `dpop` is left
+// untouched when count == 0, matching the scalar loop.
+
+inline uint16_t MixAddRampScalar(int32_t* out, const int16_t* input, uint32_t count,
+                                 uint16_t volume, uint16_t delta, int16_t& dpop) {
+    int16_t last = dpop;
+    for (uint32_t i = 0; i < count; ++i) {
+        const int32_t scaled =
+            (static_cast<int32_t>(input[i]) * static_cast<int32_t>(volume)) >> 15;
+        const int16_t sample = ClampToS16(scaled);
+        out[i] += sample;
+        volume = static_cast<uint16_t>(volume + delta);
+        last = sample;
+    }
+    dpop = last;
+    return volume;
+}
+
+#if MKW_AX_MIX_AVX2
+inline uint16_t MixAddRampAvx2(int32_t* out, const int16_t* input, uint32_t count,
+                               uint16_t volume, uint16_t delta, int16_t& dpop) {
+    uint32_t i = 0;
+    int16_t last = dpop;
+    if (count >= 8) {
+        const __m256i lanes = _mm256_setr_epi32(0, 1, 2, 3, 4, 5, 6, 7);
+        const __m256i deltaVec = _mm256_set1_epi32(static_cast<int32_t>(delta));
+        const __m256i wrapMask = _mm256_set1_epi32(0xFFFF);
+        const __m256i clampLow = _mm256_set1_epi32(-0x8000);
+        const __m256i clampHigh = _mm256_set1_epi32(0x7FFF);
+        const __m256i blockStep = _mm256_set1_epi32(static_cast<int32_t>(delta) * 8);
+        // volume + k*delta stays well inside int32 for every count the AX mix
+        // uses (<= 96), so the wrap is applied only by the 16-bit mask below -
+        // exactly where the scalar loop applies it.
+        __m256i ramp = _mm256_add_epi32(_mm256_set1_epi32(static_cast<int32_t>(volume)),
+                                        _mm256_mullo_epi32(lanes, deltaVec));
+        __m256i lastBlock = _mm256_setzero_si256();
+        for (; i + 8 <= count; i += 8) {
+            const __m256i samples = _mm256_cvtepi16_epi32(
+                _mm_loadu_si128(reinterpret_cast<const __m128i*>(input + i)));
+            const __m256i vol = _mm256_and_si256(ramp, wrapMask);
+            // int16 x uint16 always fits in int32, so the low half of the
+            // 32x32 multiply is the exact product.
+            __m256i scaled = _mm256_srai_epi32(_mm256_mullo_epi32(samples, vol), 15);
+            scaled = _mm256_min_epi32(_mm256_max_epi32(scaled, clampLow), clampHigh);
+            const __m256i acc =
+                _mm256_loadu_si256(reinterpret_cast<const __m256i*>(out + i));
+            _mm256_storeu_si256(reinterpret_cast<__m256i*>(out + i),
+                                _mm256_add_epi32(acc, scaled));
+            lastBlock = scaled;
+            ramp = _mm256_add_epi32(ramp, blockStep);
+        }
+        if (i != 0) {
+            last = static_cast<int16_t>(_mm256_extract_epi32(lastBlock, 7));
+            volume = static_cast<uint16_t>(
+                static_cast<uint32_t>(_mm256_extract_epi32(ramp, 0)));
+        }
+    }
+    for (; i < count; ++i) {
+        const int32_t scaled =
+            (static_cast<int32_t>(input[i]) * static_cast<int32_t>(volume)) >> 15;
+        const int16_t sample = ClampToS16(scaled);
+        out[i] += sample;
+        volume = static_cast<uint16_t>(volume + delta);
+        last = sample;
+    }
+    dpop = last;
+    return volume;
+}
+#endif
+
+inline uint16_t MixAddRamp(int32_t* out, const int16_t* input, uint32_t count,
+                           uint16_t volume, uint16_t delta, int16_t& dpop) {
+#if MKW_AX_MIX_AVX2
+    return MixAddRampAvx2(out, input, count, volume, delta, dpop);
+#else
+    return MixAddRampScalar(out, input, count, volume, delta, dpop);
+#endif
+}
+
+// ---------------------------------------------------------------------------
+// Voice volume envelope: scale a 16-bit sample block in place through the same
+// wrapping 16-bit ramp. Returns the ramp value after `count` steps.
+// ---------------------------------------------------------------------------
+
+inline uint16_t ScaleRampScalar(int16_t* samples, uint32_t count, uint16_t volume,
+                                uint16_t delta) {
+    for (uint32_t i = 0; i < count; ++i) {
+        const int32_t scaled =
+            (static_cast<int32_t>(samples[i]) * static_cast<int32_t>(volume)) >> 15;
+        samples[i] = ClampToS16(scaled);
+        volume = static_cast<uint16_t>(volume + delta);
+    }
+    return volume;
+}
+
+#if MKW_AX_MIX_AVX2
+inline uint16_t ScaleRampAvx2(int16_t* samples, uint32_t count, uint16_t volume,
+                              uint16_t delta) {
+    uint32_t i = 0;
+    if (count >= 8) {
+        const __m256i lanes = _mm256_setr_epi32(0, 1, 2, 3, 4, 5, 6, 7);
+        const __m256i deltaVec = _mm256_set1_epi32(static_cast<int32_t>(delta));
+        const __m256i wrapMask = _mm256_set1_epi32(0xFFFF);
+        const __m256i blockStep = _mm256_set1_epi32(static_cast<int32_t>(delta) * 8);
+        __m256i ramp = _mm256_add_epi32(_mm256_set1_epi32(static_cast<int32_t>(volume)),
+                                        _mm256_mullo_epi32(lanes, deltaVec));
+        for (; i + 8 <= count; i += 8) {
+            const __m256i block = _mm256_cvtepi16_epi32(
+                _mm_loadu_si128(reinterpret_cast<const __m128i*>(samples + i)));
+            const __m256i vol = _mm256_and_si256(ramp, wrapMask);
+            const __m256i scaled =
+                _mm256_srai_epi32(_mm256_mullo_epi32(block, vol), 15);
+            // Signed 32 -> 16 saturation is exactly clamp(-0x8000, 0x7fff).
+            const __m128i packed = _mm_packs_epi32(_mm256_castsi256_si128(scaled),
+                                                   _mm256_extracti128_si256(scaled, 1));
+            _mm_storeu_si128(reinterpret_cast<__m128i*>(samples + i), packed);
+            ramp = _mm256_add_epi32(ramp, blockStep);
+        }
+        if (i != 0) {
+            volume = static_cast<uint16_t>(
+                static_cast<uint32_t>(_mm256_extract_epi32(ramp, 0)));
+        }
+    }
+    for (; i < count; ++i) {
+        const int32_t scaled =
+            (static_cast<int32_t>(samples[i]) * static_cast<int32_t>(volume)) >> 15;
+        samples[i] = ClampToS16(scaled);
+        volume = static_cast<uint16_t>(volume + delta);
+    }
+    return volume;
+}
+#endif
+
+inline uint16_t ScaleRamp(int16_t* samples, uint32_t count, uint16_t volume,
+                          uint16_t delta) {
+#if MKW_AX_MIX_AVX2
+    return ScaleRampAvx2(samples, count, volume, delta);
+#else
+    return ScaleRampScalar(samples, count, volume, delta);
+#endif
+}
+
+// ---------------------------------------------------------------------------
+// AUX return: accumulate a 32-bit aux bus into a 32-bit main bus through a
+// per-sample 16-bit ramp table.
+// ---------------------------------------------------------------------------
+
+inline void MixAccumRamp32Scalar(int32_t* dst, const int32_t* src, const uint16_t* ramp,
+                                 uint32_t count) {
+    for (uint32_t i = 0; i < count; ++i) {
+        dst[i] += static_cast<int32_t>(
+            (static_cast<int64_t>(src[i]) * static_cast<int64_t>(ramp[i])) >> 15);
+    }
+}
+
+#if MKW_AX_MIX_AVX2
+inline void MixAccumRamp32Avx2(int32_t* dst, const int32_t* src, const uint16_t* ramp,
+                               uint32_t count) {
+    uint32_t i = 0;
+    for (; i + 8 <= count; i += 8) {
+        const __m256i source =
+            _mm256_loadu_si256(reinterpret_cast<const __m256i*>(src + i));
+        const __m256i gain = _mm256_cvtepu16_epi32(
+            _mm_loadu_si128(reinterpret_cast<const __m128i*>(ramp + i)));
+        // Even dwords (indices 0,2,4,6) and odd dwords (1,3,5,7) as two sets of
+        // four signed 32x32 -> 64 products. |product| < 2^47, so shifting the
+        // 64-bit lane logically by 15 leaves bits 15..46 of the product in the
+        // low dword - the same bits the scalar (int32)(p >> 15) keeps.
+        const __m256i even = _mm256_srli_epi64(_mm256_mul_epi32(source, gain), 15);
+        const __m256i odd = _mm256_srli_epi64(
+            _mm256_mul_epi32(_mm256_srli_epi64(source, 32), _mm256_srli_epi64(gain, 32)),
+            15);
+        const __m256i result =
+            _mm256_blend_epi32(even, _mm256_slli_epi64(odd, 32), 0xAA);
+        const __m256i acc = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(dst + i));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(dst + i),
+                            _mm256_add_epi32(acc, result));
+    }
+    for (; i < count; ++i) {
+        dst[i] += static_cast<int32_t>(
+            (static_cast<int64_t>(src[i]) * static_cast<int64_t>(ramp[i])) >> 15);
+    }
+}
+#endif
+
+inline void MixAccumRamp32(int32_t* dst, const int32_t* src, const uint16_t* ramp,
+                           uint32_t count) {
+#if MKW_AX_MIX_AVX2
+    MixAccumRamp32Avx2(dst, src, ramp, count);
+#else
+    MixAccumRamp32Scalar(dst, src, ramp, count);
+#endif
+}
+
+// ---------------------------------------------------------------------------
+// Guest mix-buffer marshalling: host int32 <-> big-endian guest words.
+// ---------------------------------------------------------------------------
+
+inline void StoreBigEndian32Scalar(uint8_t* dst, const int32_t* src, size_t count) {
+    for (size_t i = 0; i < count; ++i) {
+        BigEndian::Write32(dst + i * sizeof(uint32_t), static_cast<uint32_t>(src[i]));
+    }
+}
+
+inline void LoadBigEndian32Scalar(int32_t* dst, const uint8_t* src, size_t count) {
+    for (size_t i = 0; i < count; ++i) {
+        dst[i] = static_cast<int32_t>(BigEndian::Read32(src + i * sizeof(uint32_t)));
+    }
+}
+
+#if MKW_AX_MIX_AVX2
+inline __m256i ByteSwapMask32() {
+    return _mm256_setr_epi8(3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12,
+                            3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12);
+}
+
+inline void StoreBigEndian32Avx2(uint8_t* dst, const int32_t* src, size_t count) {
+    const __m256i mask = ByteSwapMask32();
+    size_t i = 0;
+    for (; i + 8 <= count; i += 8) {
+        const __m256i value =
+            _mm256_loadu_si256(reinterpret_cast<const __m256i*>(src + i));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(dst + i * sizeof(uint32_t)),
+                            _mm256_shuffle_epi8(value, mask));
+    }
+    StoreBigEndian32Scalar(dst + i * sizeof(uint32_t), src + i, count - i);
+}
+
+inline void LoadBigEndian32Avx2(int32_t* dst, const uint8_t* src, size_t count) {
+    const __m256i mask = ByteSwapMask32();
+    size_t i = 0;
+    for (; i + 8 <= count; i += 8) {
+        const __m256i value = _mm256_loadu_si256(
+            reinterpret_cast<const __m256i*>(src + i * sizeof(uint32_t)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(dst + i),
+                            _mm256_shuffle_epi8(value, mask));
+    }
+    LoadBigEndian32Scalar(dst + i, src + i * sizeof(uint32_t), count - i);
+}
+#endif
+
+inline void StoreBigEndian32(uint8_t* dst, const int32_t* src, size_t count) {
+#if MKW_AX_MIX_AVX2
+    StoreBigEndian32Avx2(dst, src, count);
+#else
+    StoreBigEndian32Scalar(dst, src, count);
+#endif
+}
+
+inline void LoadBigEndian32(int32_t* dst, const uint8_t* src, size_t count) {
+#if MKW_AX_MIX_AVX2
+    LoadBigEndian32Avx2(dst, src, count);
+#else
+    LoadBigEndian32Scalar(dst, src, count);
+#endif
+}
+
+} // namespace AxMixKernels
diff --git a/runtime/src/hle/c_stdio.cpp b/runtime/src/hle/c_stdio.cpp
new file mode 100644
index 0000000..cd109d3
--- /dev/null
+++ b/runtime/src/hle/c_stdio.cpp
@@ -0,0 +1,271 @@
+#include "hle_stubs.h"
+#include "hle/guest_printf.h"
+#include "memory.h"
+
+#include <cctype>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <sstream>
+#include <string>
+
+// Hardware boundary used by the translated MetroWerks stdio implementation.
+// The original routine forwards completed FILE-buffer writes to UART/EXI or TRK.
+// Keep __FileWrite (0x80011620), __fwrite, and fwide translated so their buffering,
+// orientation, short-write, and return-value semantics remain guest-owned.
+extern "C" uint32_t ConsoleWrite_HLE_80015500(
+    uint32_t handle, uint32_t bufferAddr, uint32_t lengthPtr, uint32_t refCon)
+{
+    (void)handle;
+    (void)refCon;
+
+    if (!lengthPtr) {
+        return 1;
+    }
+
+    try {
+        const uint32_t length = Memory::Read32(lengthPtr);
+        if (length == 0) {
+            return 0;
+        }
+
+        const uint8_t* data = Memory::GetPointer(bufferAddr, length);
+        if (!data) {
+            Memory::Write32(lengthPtr, 0);
+            return 1;
+        }
+
+        return 0;
+    } catch (const Memory::AccessViolation&) {
+        try {
+            Memory::Write32(lengthPtr, 0);
+        } catch (const Memory::AccessViolation&) {
+        }
+        return 1;
+    }
+}
+
+PPC_NATIVE_OVERRIDE(80015500, ConsoleWrite_HLE_80015500, uint32_t,
+         (uint32_t handle, uint32_t bufferAddr, uint32_t lengthPtr, uint32_t refCon),
+         (handle, bufferAddr, lengthPtr, refCon));
+
+
+
+// --------------------------------------------------------------------------
+// Shared guest printf formatter used by CPU-context stdio and OSReport paths.
+// --------------------------------------------------------------------------
+std::string RuntimeHle::FormatGuestPrintf(const std::string& fmt,
+                                          size_t& outChars,
+                                          const PrintfNext32& next32,
+                                          const PrintfNext64& next64,
+                                          const PrintfNextDouble& nextDouble,
+                                          const PrintfReadString& readString)
+{
+    std::ostringstream out;
+    outChars = 0;
+
+    auto appendText = [&](const std::string& text) {
+        out << text;
+        outChars += text.size();
+    };
+
+    auto appendChar = [&](char ch) {
+        out.put(ch);
+        ++outChars;
+    };
+
+    size_t i = 0;
+    while (i < fmt.size()) {
+        if (fmt[i] != '%') {
+            appendChar(fmt[i]);
+            ++i;
+            continue;
+        }
+
+        // Handle escaped %%
+        if (i + 1 < fmt.size() && fmt[i + 1] == '%') {
+            appendChar('%');
+            i += 2;
+            continue;
+        }
+
+        size_t cur = i + 1;
+        std::string flags;
+        while (cur < fmt.size() && std::strchr("-+ #0", fmt[cur])) {
+            flags.push_back(fmt[cur]);
+            ++cur;
+        }
+
+        bool widthFromArg = false;
+        int width = -1;
+        if (cur < fmt.size() && fmt[cur] == '*') {
+            widthFromArg = true;
+            ++cur;
+        } else {
+            int parsed = 0;
+            bool seen = false;
+            while (cur < fmt.size() && std::isdigit(static_cast<unsigned char>(fmt[cur]))) {
+                seen = true;
+                parsed = (parsed * 10) + (fmt[cur] - '0');
+                ++cur;
+            }
+            if (seen) {
+                width = parsed;
+            }
+        }
+
+        bool precisionFromArg = false;
+        int precision = -1;
+        if (cur < fmt.size() && fmt[cur] == '.') {
+            ++cur;
+            if (cur < fmt.size() && fmt[cur] == '*') {
+                precisionFromArg = true;
+                ++cur;
+            } else {
+                int parsed = 0;
+                bool seen = false;
+                while (cur < fmt.size() && std::isdigit(static_cast<unsigned char>(fmt[cur]))) {
+                    seen = true;
+                    parsed = (parsed * 10) + (fmt[cur] - '0');
+                    ++cur;
+                }
+                precision = seen ? parsed : 0; // "%.s" -> precision 0
+            }
+        }
+
+        std::string length;
+        if (cur < fmt.size()) {
+            if (fmt[cur] == 'h') {
+                length.push_back('h');
+                ++cur;
+                if (cur < fmt.size() && fmt[cur] == 'h') {
+                    length.push_back('h');
+                    ++cur;
+                }
+            } else if (fmt[cur] == 'l') {
+                length.push_back('l');
+                ++cur;
+                if (cur < fmt.size() && fmt[cur] == 'l') {
+                    length.push_back('l');
+                    ++cur;
+                }
+            } else if (fmt[cur] == 'z' || fmt[cur] == 't') {
+                length.push_back(fmt[cur]);
+                ++cur;
+            }
+        }
+
+        if (widthFromArg) {
+            width = static_cast<int32_t>(next32());
+            if (width < 0) {
+                flags.push_back('-');
+                width = -width;
+            }
+        }
+        if (precisionFromArg) {
+            precision = static_cast<int32_t>(next32());
+            if (precision < 0) {
+                precision = -1; // Negative precision is treated as if it's omitted.
+            }
+        }
+
+        if (cur >= fmt.size()) {
+            appendText(fmt.substr(i));
+            break;
+        }
+
+        char spec = fmt[cur];
+        ++cur;
+
+        std::ostringstream pieceBuilder;
+        pieceBuilder << "%";
+        if (!flags.empty()) pieceBuilder << flags;
+        if (width >= 0) pieceBuilder << width;
+        if (precision >= 0) pieceBuilder << "." << precision;
+        pieceBuilder << length << spec;
+        const std::string piece = pieceBuilder.str();
+
+        auto appendWithSnprintf = [&](auto value) {
+            int needed = std::snprintf(nullptr, 0, piece.c_str(), value);
+            if (needed <= 0) {
+                return;
+            }
+            std::string buf(static_cast<size_t>(needed) + 1, '\0');
+            std::snprintf(buf.data(), buf.size(), piece.c_str(), value);
+            buf.resize(static_cast<size_t>(needed));
+            appendText(buf);
+        };
+
+        switch (spec) {
+            case 's': {
+                uint32_t ptr = next32();
+                std::string guest = readString(ptr);
+                appendWithSnprintf(guest.c_str());
+                break;
+            }
+            case 'c': {
+                char ch = static_cast<char>(next32() & 0xFF);
+                appendWithSnprintf(ch);
+                break;
+            }
+            case 'p': {
+                uint32_t ptr = next32();
+                appendWithSnprintf(reinterpret_cast<void*>(static_cast<uintptr_t>(ptr)));
+                break;
+            }
+            case 'd':
+            case 'i': {
+                if (length == "ll") {
+                    int64_t v = static_cast<int64_t>(next64());
+                    appendWithSnprintf(v);
+                } else {
+                    int32_t v = static_cast<int32_t>(next32());
+                    appendWithSnprintf(v);
+                }
+                break;
+            }
+            case 'u':
+            case 'x':
+            case 'X':
+            case 'o': {
+                if (length == "ll") {
+                    uint64_t v = next64();
+                    appendWithSnprintf(v);
+                } else {
+                    uint32_t v = next32();
+                    appendWithSnprintf(v);
+                }
+                break;
+            }
+            case 'f': case 'F':
+            case 'e': case 'E':
+            case 'g': case 'G':
+            case 'a': case 'A': {
+                double v = nextDouble();
+                appendWithSnprintf(v);
+                break;
+            }
+            case 'n': {
+                uint32_t ptr = next32();
+                if (ptr != 0) {
+                    Memory::Write32(ptr, static_cast<uint32_t>(outChars));
+                }
+                break;
+            }
+            default: {
+                // Unknown specifier, copy literally so we don't drop information.
+                appendText(fmt.substr(i, cur - i));
+                break;
+            }
+        }
+
+        i = cur;
+    }
+
+    return out.str();
+}
+
+// 0x801D09CC is WUD_DEBUGPrint in the PAL executable. Its retail body only
+// performs the compiler-generated variadic prologue and returns; it does not
+// format or emit text. Keep it on the ordinary translated path so its guest
+// memory effects remain exact without inventing expensive host-side logging.
diff --git a/runtime/src/hle/esp.cpp b/runtime/src/hle/esp.cpp
new file mode 100644
index 0000000..1211ea6
--- /dev/null
+++ b/runtime/src/hle/esp.cpp
@@ -0,0 +1,118 @@
+// ESP HLE Stubs
+// ESP functions communicate with /dev/es to get title information.
+// We stub these to return Mario Kart Wii's title ID directly.
+
+#include "hle_stubs.h"
+#include "memory.h"
+#include "runtime_log.h"
+#include <cstring>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cctype>
+
+static constexpr uint32_t MKW_TITLE_ID_HI = 0x00010004;
+static constexpr uint32_t MKW_TITLE_ID_LO = 0x524D4350; // "RMCP" fallback
+
+static bool IsValidEspTitleCode(uint32_t code) {
+    for (int shift = 24; shift >= 0; shift -= 8) {
+        const char ch = static_cast<char>((code >> shift) & 0xffu);
+        if (!std::isalnum(static_cast<unsigned char>(ch))) {
+            return false;
+        }
+    }
+    return true;
+}
+
+static uint32_t CurrentTitleIdLo() {
+    if (Memory::Contains(0x80000000u, 4u)) {
+        const uint32_t code = Memory::Read32(0x80000000u);
+        if (IsValidEspTitleCode(code)) {
+            return code;
+        }
+    }
+
+    return MKW_TITLE_ID_LO;
+}
+
+// The guest asked for its title ID or data directory through a pointer we cannot
+// honour. Nothing downstream explains why the save-data path then fails, so say
+// so - once per site, because the caller may retry every frame.
+static void ReportEspArgError(bool& logged, const char* who, const char* what)
+{
+    if (logged) {
+        return;
+    }
+    logged = true;
+    RT_LOGF(RT_TAG_HLE, "%s: %s\n", who, what);
+    std::fflush(stderr);
+}
+
+// 0x801671d0 -> ESP_InitLib
+// Opens /dev/es. We just pretend it succeeded.
+extern "C" int32_t ESP_InitLib_stub(void)
+{
+    return 0;
+}
+PPC_NATIVE_OVERRIDE(801671d0, ESP_InitLib_stub, int32_t, (void), ());
+
+// 0x80167224 -> ESP_CloseLib  
+// Closes /dev/es. No-op for us.
+extern "C" int32_t ESP_CloseLib_stub(void)
+{
+    return 0;
+}
+PPC_NATIVE_OVERRIDE(80167224, ESP_CloseLib_stub, int32_t, (void), ());
+
+// 0x8016799c -> ESP_GetTitleId
+// Gets the 64-bit title ID. param_1 is pointer to 8 bytes.
+// Decompiled signature: int ESP_GetTitleId(undefined4 *param_1)
+extern "C" int32_t ESP_GetTitleId_stub(uint32_t outPtr)
+{
+    if (outPtr == 0) {
+        static bool logged = false;
+        ReportEspArgError(logged, "ESP_GetTitleId", "null output pointer, returning error");
+        return -0x3f9; // Same error as original for null
+    }
+
+    // Write title ID (big-endian)
+    Memory::Write32(outPtr, MKW_TITLE_ID_HI);
+    Memory::Write32(outPtr + 4, CurrentTitleIdLo());
+    return 0;
+}
+PPC_NATIVE_OVERRIDE(8016799c, ESP_GetTitleId_stub, int32_t, (uint32_t outPtr), (outPtr));
+
+// 0x80167904 -> ESP_GetDataDir(titleHi, titleLo, outPathPtr)
+// Gets the NAND data directory path for a title.
+extern "C" int32_t ESP_GetDataDir_stub(uint32_t titleHi, uint32_t titleLo, uint32_t outPathPtr)
+{
+    if (outPathPtr == 0) {
+        static bool loggedNull = false;
+        ReportEspArgError(loggedNull, "ESP_GetDataDir", "null output pointer, returning error");
+        return -0x3f9;
+    }
+
+    // Check alignment (original requires 32-byte alignment)
+    if ((outPathPtr & 0x1f) != 0) {
+        static bool loggedUnaligned = false;
+        ReportEspArgError(loggedUnaligned, "ESP_GetDataDir",
+                          "output pointer is not 32-byte aligned, returning error");
+        return -0x3f9;
+    }
+
+
+    // Build the path: /title/XXXXXXXX/YYYYYYYY/data
+    // This is what the game expects for its save data location
+    char path[64];
+    std::sprintf(path, "/title/%08x/%08x/data", titleHi, titleLo);
+    
+    // Copy path to game memory
+    const char* src = path;
+    uint32_t dst = outPathPtr;
+    while (*src) {
+        Memory::Write8(dst++, static_cast<uint8_t>(*src++));
+    }
+    Memory::Write8(dst, 0); // null terminator
+    return 0;
+}
+PPC_NATIVE_OVERRIDE(80167904, ESP_GetDataDir_stub, int32_t, (uint32_t titleHi, uint32_t titleLo, uint32_t outPathPtr), (titleHi, titleLo, outPathPtr));
diff --git a/runtime/src/hle/guest_printf.h b/runtime/src/hle/guest_printf.h
new file mode 100644
index 0000000..02060e0
--- /dev/null
+++ b/runtime/src/hle/guest_printf.h
@@ -0,0 +1,22 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <string>
+
+namespace RuntimeHle {
+
+using PrintfNext32 = std::function<uint32_t()>;
+using PrintfNext64 = std::function<uint64_t()>;
+using PrintfNextDouble = std::function<double()>;
+using PrintfReadString = std::function<std::string(uint32_t)>;
+
+std::string FormatGuestPrintf(const std::string& format,
+                              size_t& outChars,
+                              const PrintfNext32& next32,
+                              const PrintfNext64& next64,
+                              const PrintfNextDouble& nextDouble,
+                              const PrintfReadString& readString);
+
+} // namespace RuntimeHle
diff --git a/runtime/src/hle/gx/gx_copy.cpp b/runtime/src/hle/gx/gx_copy.cpp
new file mode 100644
index 0000000..5631a01
--- /dev/null
+++ b/runtime/src/hle/gx/gx_copy.cpp
@@ -0,0 +1,160 @@
+// gx_copy.cpp - Framebuffer Copy Operations
+#include "gx_internal.h"
+
+#include "settings_overlay.h"
+
+#include <dolphin/gx/GXAurora.h>
+
+#include <algorithm>
+#include <map>
+#include <mutex>
+#include <vector>
+
+namespace {
+// Copy destinations stay GPU-only until an explicit/lazy readback. Track the
+// guest ranges that own those results so a later data-cache flush over a reused
+// allocation can retire the stale GPU texture before it is considered by a
+// subsequent GXLoadTexObj. There is at most one live range per destination;
+// rewriting the destination replaces its previous extent.
+std::mutex g_efbCopyDestinationsMutex;
+std::map<uint32_t, uint32_t> g_efbCopyDestinations;
+uint32_t g_largestEfbCopyDestination = 0;
+
+void RememberEfbCopyDestination(uint32_t addr, uint32_t size) {
+    if (size == 0) {
+        return;
+    }
+    std::lock_guard<std::mutex> guard(g_efbCopyDestinationsMutex);
+    g_efbCopyDestinations[CanonicalizeGxMainRamAddress(addr)] = size;
+    // A conservative monotonic maximum lets invalidation jump directly to
+    // the only map interval that could overlap instead of walking every copy
+    // destination on every DCStoreRange.
+    g_largestEfbCopyDestination = std::max(g_largestEfbCopyDestination, size);
+}
+
+} // namespace
+
+void InvalidateEfbCopyDestinationsForRange(uint32_t addr, uint32_t size) {
+    if (size == 0) {
+        return;
+    }
+
+    const uint64_t dirtyStart = CanonicalizeGxMainRamAddress(addr);
+    const uint64_t dirtyEnd = dirtyStart + size;
+    std::vector<uint32_t> retired;
+    {
+        std::lock_guard<std::mutex> guard(g_efbCopyDestinationsMutex);
+        const uint64_t earliestCandidate =
+            dirtyStart > g_largestEfbCopyDestination ? dirtyStart - g_largestEfbCopyDestination : 0;
+        for (auto it = g_efbCopyDestinations.lower_bound(static_cast<uint32_t>(earliestCandidate));
+             it != g_efbCopyDestinations.end() && static_cast<uint64_t>(it->first) < dirtyEnd;) {
+            const uint64_t copyStart = it->first;
+            const uint64_t copyEnd = copyStart + it->second;
+            if (dirtyEnd <= copyStart || dirtyStart >= copyEnd) {
+                ++it;
+                continue;
+            }
+            retired.push_back(it->first);
+            it = g_efbCopyDestinations.erase(it);
+        }
+    }
+
+    // Preserve FIFO ordering: the destroy command is emitted before any later
+    // texture load that can consume the freshly flushed RAM bytes.
+    for (const uint32_t copyAddr : retired) {
+        GXDestroyCopyTex(GuestToHostPtr(copyAddr));
+    }
+}
+
+// ============================================================================
+// Display Copy Source/Destination
+// ============================================================================
+
+extern "C" void GX__SetDispCopySrc_8016f438(uint32_t l, uint32_t t, uint32_t w, uint32_t h) {
+    GXSetDispCopySrc((u16)l, (u16)t, (u16)w, (u16)h);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f438, GX__SetDispCopySrc_8016f438, (uint32_t l, uint32_t t, uint32_t w, uint32_t h), (l, t, w, h));
+
+extern "C" void GX__SetDispCopyDst_8016f4b8(uint32_t w, uint32_t h) { GXSetDispCopyDst((u16)w, (u16)h); }
+PPC_NATIVE_OVERRIDE_VOID(8016f4b8, GX__SetDispCopyDst_8016f4b8, (uint32_t w, uint32_t h), (w, h));
+
+// ============================================================================
+// Texture Copy Source/Destination
+// ============================================================================
+
+extern "C" void GX__SetTexCopySrc_8016f478(uint32_t l, uint32_t t, uint32_t w, uint32_t h) {
+    GXSetTexCopySrc((u16)l, (u16)t, (u16)w, (u16)h);
+    g_texCopyState.srcLeft=(u16)l; g_texCopyState.srcTop=(u16)t;
+    g_texCopyState.srcWidth=(u16)w; g_texCopyState.srcHeight=(u16)h;
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f478, GX__SetTexCopySrc_8016f478, (uint32_t l, uint32_t t, uint32_t w, uint32_t h), (l, t, w, h));
+
+extern "C" void GX__SetTexCopyDst_8016f4dc(uint32_t w, uint32_t h, uint32_t f, uint32_t m) {
+    GXSetTexCopyDst((u16)w, (u16)h, (GXTexFmt)f, (GXBool)m);
+    g_texCopyState.dstWidth=(u16)w; g_texCopyState.dstHeight=(u16)h;
+    g_texCopyState.dstFormat=f; g_texCopyState.dstMipmap=m;
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f4dc, GX__SetTexCopyDst_8016f4dc, (uint32_t w, uint32_t h, uint32_t f, uint32_t m), (w, h, f, m));
+
+extern "C" void GX__SetCopyFilter_8016fa40(uint32_t aa, uint32_t spa, uint32_t vf, uint32_t vfa) {
+    uint8_t sp[12][2]={}, vfb[7]={};
+    if(spa) std::memcpy(sp, GuestToHostPtr(spa, 24), 24);
+    if(vfa) std::memcpy(vfb, GuestToHostPtr(vfa, 7), 7);
+    GXSetCopyFilter((GXBool)aa, sp, (GXBool)vf, vfb);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016fa40, GX__SetCopyFilter_8016fa40, (uint32_t aa, uint32_t spa, uint32_t vf, uint32_t vfa), (aa, spa, vf, vfa));
+
+extern "C" void GX__SetDispCopyGamma_8016fc24(uint32_t g) { GXSetDispCopyGamma((GXGamma)g); }
+PPC_NATIVE_OVERRIDE_VOID(8016fc24, GX__SetDispCopyGamma_8016fc24, (uint32_t g), (g));
+
+// ============================================================================
+// Copy Execution
+// ============================================================================
+
+extern "C" void GX__CopyDisp_8016fc38(uint32_t da, uint32_t c) {
+    EnsureAuroraFrameActive();
+    // GX copies are FIFO-ordered on hardware. Drain submitted draws before
+    // resolving the EFB so high-level copies see the same contents.
+    GXDrawDone();
+    GXCopyDisp(GuestToHostPtr(da), (GXBool)c);
+    // No second GXDrawDone here: the frame-worker wait below is for the DONE
+    // phase, which strictly subsumes the drain this call would perform.
+    ++g_gxFrameCount;
+    VI_HLE_SetXfbReady(da);
+    // Present immediately so post-copy draws don't leak into this frame. Join at the DONE phase
+    // (not the cheaper SEALED phase GXDrawDone waits for) because ImGui's draw lists, owned by
+    // Aurora's render worker, replay during encode; aurora_end_frame would join here anyway.
+    aurora_wait_for_frame_worker();
+    settings_overlay::Draw();
+    // Seal, pace to the VI retrace boundary (Aurora renders the sealed frame
+    // during the wait), and pre-warm the next frame.
+    VI_HLE_PresentFrame(/*presentedXfb=*/true, /*paceToRetrace=*/true);
+}
+
+PPC_NATIVE_OVERRIDE_VOID(8016fc38, GX__CopyDisp_8016fc38, (uint32_t da, uint32_t c), (da, c));
+
+
+extern "C" void GX__CopyTex_8016fd74(uint32_t da, uint32_t c) {
+    EnsureAuroraFrameActive();
+    // Match GX FIFO ordering: texture copies observe all prior draws.
+    GXDrawDone();
+    const uint16_t rawSrcLeft = g_texCopyState.srcLeft;
+    const uint16_t rawSrcTop = g_texCopyState.srcTop;
+    const uint16_t rawSrcWidth = g_texCopyState.srcWidth;
+    const uint16_t rawSrcHeight = g_texCopyState.srcHeight;
+
+    // Keep the source in guest EFB coordinates. Aurora maps it to the scaled
+    // EFB exactly once, matching Dolphin's ConvertEFBRectangle path.
+    GXSetTexCopySrc(rawSrcLeft, rawSrcTop, rawSrcWidth, rawSrcHeight);
+    // EFB copies stay GPU-only except probe-sized ones (e.g. the 4x4 lens-flare depth probe),
+    // which Aurora reads back asynchronously via efb_ram::schedule and land in guest RAM a frame
+    // later. RISK: copies above the probe threshold, or on the offscreen list, are not
+    // auto-downloaded, so guest reads see stale RAM; call aurora_flush_efb_copies_to_ram if a
+    // copy needs reading back.
+    GXCopyTex(GuestToHostPtr(da), (GXBool)c);
+    RememberEfbCopyDestination(
+        da, GXGetTexBufferSize(g_texCopyState.dstWidth, g_texCopyState.dstHeight,
+                               g_texCopyState.dstFormat, GX_FALSE, 0));
+    GXSetTexCopySrc(rawSrcLeft, rawSrcTop, rawSrcWidth, rawSrcHeight);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016fd74, GX__CopyTex_8016fd74, (uint32_t da, uint32_t c), (da, c));
diff --git a/runtime/src/hle/gx/gx_cp_decode.h b/runtime/src/hle/gx/gx_cp_decode.h
new file mode 100644
index 0000000..49fed99
--- /dev/null
+++ b/runtime/src/hle/gx/gx_cp_decode.h
@@ -0,0 +1,168 @@
+#pragma once
+
+#include "gx_stream_common.h"
+
+namespace GxCpDecode {
+
+inline GXAttrType AttrType2(uint32_t bits) {
+    return static_cast<GXAttrType>(bits & 0x3u);
+}
+
+inline bool SameVtxAttrFmt(const VtxAttrFmt& lhs, const VtxAttrFmt& rhs) {
+    return lhs.cnt == rhs.cnt && lhs.type == rhs.type && lhs.frac == rhs.frac;
+}
+
+inline void VcdLo(uint32_t value) {
+    bool changed = false;
+    const auto assign = [&changed](GXAttrType& dst, GXAttrType next) {
+        changed |= dst != next;
+        dst = next;
+    };
+    for (int i = GX_VA_PNMTXIDX; i <= GX_VA_TEX7MTXIDX; ++i) {
+        assign(g_hleGxState.vtxDesc[i], (value & (1u << i)) ? GX_DIRECT : GX_NONE);
+    }
+    assign(g_hleGxState.vtxDesc[GX_VA_POS], AttrType2(value >> 9));
+    assign(g_hleGxState.vtxDesc[GX_VA_NRM], AttrType2(value >> 11));
+    assign(g_hleGxState.vtxDesc[GX_VA_CLR0], AttrType2(value >> 13));
+    assign(g_hleGxState.vtxDesc[GX_VA_CLR1], AttrType2(value >> 15));
+    assign(g_hleGxState.vtxDesc[GX_VA_NBT], GX_NONE);
+    if (changed) {
+        g_hleGxState.InvalidateVtxLayoutHash();
+    }
+}
+
+inline void VcdHi(uint32_t value) {
+    bool changed = false;
+    for (int tex = 0; tex < 8; ++tex) {
+        auto& dst = g_hleGxState.vtxDesc[GX_VA_TEX0 + tex];
+        const auto next = AttrType2(value >> (tex * 2));
+        changed |= dst != next;
+        dst = next;
+    }
+    if (changed) {
+        g_hleGxState.InvalidateVtxLayoutHash();
+    }
+}
+
+inline void VatA(uint8_t fmt, uint32_t value) {
+    auto& attrs = g_hleGxState.vtxAttrFmt[fmt];
+    const VtxAttrFmt oldPos = attrs[GX_VA_POS];
+    const VtxAttrFmt oldNrm = attrs[GX_VA_NRM];
+    const VtxAttrFmt oldClr0 = attrs[GX_VA_CLR0];
+    const VtxAttrFmt oldClr1 = attrs[GX_VA_CLR1];
+    const VtxAttrFmt oldTex0 = attrs[GX_VA_TEX0];
+    auto& pos = attrs[GX_VA_POS];
+    pos.cnt = ((value >> 0) & 1u) ? GX_POS_XYZ : GX_POS_XY;
+    pos.type = static_cast<GXCompType>((value >> 1) & 7u);
+    pos.frac = static_cast<u8>((value >> 4) & 0x1fu);
+
+    auto& nrm = attrs[GX_VA_NRM];
+    nrm.type = static_cast<GXCompType>((value >> 10) & 7u);
+    nrm.cnt = (value & 0x80000000u)
+        ? GX_NRM_NBT3
+        : (((value >> 9) & 1u) ? GX_NRM_NBT : GX_NRM_XYZ);
+    nrm.frac = GxStream::NormalFracBits(nrm.type);
+
+    auto& clr0 = attrs[GX_VA_CLR0];
+    clr0.cnt = ((value >> 13) & 1u) ? GX_CLR_RGBA : GX_CLR_RGB;
+    clr0.type = static_cast<GXCompType>((value >> 14) & 7u);
+    clr0.frac = 0;
+
+    auto& clr1 = attrs[GX_VA_CLR1];
+    clr1.cnt = ((value >> 17) & 1u) ? GX_CLR_RGBA : GX_CLR_RGB;
+    clr1.type = static_cast<GXCompType>((value >> 18) & 7u);
+    clr1.frac = 0;
+
+    auto& tex0 = attrs[GX_VA_TEX0];
+    tex0.cnt = ((value >> 21) & 1u) ? GX_TEX_ST : GX_TEX_S;
+    tex0.type = static_cast<GXCompType>((value >> 22) & 7u);
+    tex0.frac = static_cast<u8>((value >> 25) & 0x1fu);
+    if (!SameVtxAttrFmt(oldPos, pos) || !SameVtxAttrFmt(oldNrm, nrm) ||
+        !SameVtxAttrFmt(oldClr0, clr0) || !SameVtxAttrFmt(oldClr1, clr1) ||
+        !SameVtxAttrFmt(oldTex0, tex0)) {
+        g_hleGxState.InvalidateVtxLayoutHash();
+    }
+}
+
+inline void VatB(uint8_t fmt, uint32_t value) {
+    auto& attrs = g_hleGxState.vtxAttrFmt[fmt];
+    VtxAttrFmt before[4];
+    for (int tex = 1; tex <= 4; ++tex) before[tex - 1] = attrs[GX_VA_TEX0 + tex];
+    for (int tex = 1; tex <= 4; ++tex) {
+        const int shift = (tex - 1) * 9;
+        auto& attr = attrs[GX_VA_TEX0 + tex];
+        attr.cnt = ((value >> shift) & 1u) ? GX_TEX_ST : GX_TEX_S;
+        attr.type = static_cast<GXCompType>((value >> (shift + 1)) & 7u);
+        if (tex != 4) {
+            attr.frac = static_cast<u8>((value >> (shift + 4)) & 0x1fu);
+        }
+    }
+    bool changed = false;
+    for (int tex = 1; tex <= 4; ++tex) changed |= !SameVtxAttrFmt(before[tex - 1], attrs[GX_VA_TEX0 + tex]);
+    if (changed) {
+        g_hleGxState.InvalidateVtxLayoutHash();
+    }
+}
+
+inline void VatC(uint8_t fmt, uint32_t value) {
+    auto& attrs = g_hleGxState.vtxAttrFmt[fmt];
+    VtxAttrFmt before[4];
+    for (int tex = 4; tex <= 7; ++tex) before[tex - 4] = attrs[GX_VA_TEX0 + tex];
+    attrs[GX_VA_TEX4].frac = static_cast<u8>(value & 0x1fu);
+    for (int tex = 5; tex <= 7; ++tex) {
+        const int shift = 5 + (tex - 5) * 9;
+        auto& attr = attrs[GX_VA_TEX0 + tex];
+        attr.cnt = ((value >> shift) & 1u) ? GX_TEX_ST : GX_TEX_S;
+        attr.type = static_cast<GXCompType>((value >> (shift + 1)) & 7u);
+        attr.frac = static_cast<u8>((value >> (shift + 4)) & 0x1fu);
+    }
+    bool changed = false;
+    for (int tex = 4; tex <= 7; ++tex) changed |= !SameVtxAttrFmt(before[tex - 4], attrs[GX_VA_TEX0 + tex]);
+    if (changed) {
+        g_hleGxState.InvalidateVtxLayoutHash();
+    }
+}
+
+// Applies one CP register write, wherever it came from: a GX_LOAD_CP_REG packet
+// in the raw FIFO stream, the same packet inside a display list, or a replay of
+// a display list's recorded CP writes on a scan-cache hit. Registers this does
+// not decode (0x30 draw-sync/matrix-index config and 0x40 among them) are
+// dropped, identically for every caller.
+inline void ApplyCpRegWrite(uint8_t reg, uint32_t value) {
+    if (reg == 0x50) {
+        VcdLo(value);
+        return;
+    }
+    if (reg == 0x60) {
+        VcdHi(value);
+        return;
+    }
+    if (reg >= 0x70 && reg <= 0x77) {
+        VatA(static_cast<uint8_t>(reg - 0x70), value);
+        return;
+    }
+    if (reg >= 0x80 && reg <= 0x87) {
+        VatB(static_cast<uint8_t>(reg - 0x80), value);
+        return;
+    }
+    if (reg >= 0x90 && reg <= 0x97) {
+        VatC(static_cast<uint8_t>(reg - 0x90), value);
+        return;
+    }
+    if (reg >= 0xA0 && reg <= 0xAF) {
+        const int attr = (reg - 0xA0) + GX_VA_POS;
+        if (attr >= 0 && attr < 26) {
+            g_hleGxState.vtxArray[attr].base = DecodeCpArrayBaseGuestAddress(value);
+        }
+        return;
+    }
+    if (reg >= 0xB0 && reg <= 0xBF) {
+        const int attr = (reg - 0xB0) + GX_VA_POS;
+        if (attr >= 0 && attr < 26) {
+            g_hleGxState.vtxArray[attr].stride = value;
+        }
+        return;
+    }
+}
+
+} // namespace GxCpDecode
diff --git a/runtime/src/hle/gx/gx_dl.cpp b/runtime/src/hle/gx/gx_dl.cpp
new file mode 100644
index 0000000..4a984a7
--- /dev/null
+++ b/runtime/src/hle/gx/gx_dl.cpp
@@ -0,0 +1,1521 @@
+#include "gx_internal.h"
+#include "gx_stream_common.h"
+#include "gx_cp_decode.h"
+#include "isa/big_endian.h"
+
+#include <cstdlib>
+#include <unordered_map>
+
+// The display-list scan cache validates a cached scan against the live guest
+// bytes with a 64-bit XXH3 digest (see GxDisplayListScanCache::CanReuse).
+#include <xxhash.h>
+
+namespace aurora::gx::fifo {
+bool in_display_list();
+bool submit_raw_draw(GXPrimitive prim, GXVtxFmt fmt, const uint8_t* vertices, uint16_t vtxCount,
+                     uint32_t vertexBytes);
+}
+
+namespace {
+
+// Opcode constants and the stream helpers this file shares with gx_fifo.cpp /
+// gx_vertex.cpp; see gx_stream_common.h.
+using namespace GxCmd;
+using namespace GxStream;
+using GxCpDecode::ApplyCpRegWrite;
+using GxCpDecode::SameVtxAttrFmt;
+
+// Small display lists dominate the in-race call count. Cache them as well, but
+// cap both individual entries and aggregate copied command bytes so malformed
+// guest input cannot turn this optimization into unbounded host allocation.
+constexpr uint32_t kDlScanCacheMaxEntryBytes = 64u * 1024u;
+constexpr size_t kDlScanCacheMaxEntries = 8192;
+constexpr size_t kDlScanCacheMaxStoredBytes = 8u * 1024u * 1024u;
+
+// Display-list write tracking (audit F6a): re-digesting every list every call is the
+// costliest step of GX__CallDisplayList, and wasted on BRRES shape lists that are written
+// once at load and never touched again.
+constexpr uint64_t kDlWriteGenerationUntracked = GxGuestWrite::kUntracked;
+
+// Byte footprint of one vertex of the currently configured layout. Indexed attributes are
+// sized before the matrix-attribute check here (unlike BuildScanVertexLayout), but a
+// GX_INDEX16 matrix attribute is impossible on real hardware so both are unreachable.
+static uint32_t CalcDLVertexSize(GXVtxFmt vtxfmt) {
+    uint32_t size = 0;
+    for (int attr = 0; attr < 26; ++attr) {
+        const auto type = g_hleGxState.vtxDesc[attr];
+        if (type == GX_NONE) continue;
+        const auto& fmt = g_hleGxState.vtxAttrFmt[vtxfmt][attr];
+        if (type == GX_INDEX8) size += (attr == GX_VA_NRM) ? NormalIndexCount(fmt) : 1u;
+        else if (type == GX_INDEX16) size += ((attr == GX_VA_NRM) ? NormalIndexCount(fmt) : 1u) * 2u;
+        else if (type == GX_DIRECT) {
+            size += DirectAttrByteSize(static_cast<GXAttr>(attr), fmt, /*matrixAttrIsOneByte=*/true,
+                                       /*fallbackComps=*/0u);
+        }
+    }
+    return size;
+}
+
+static void ApplyAuroraVtxDesc();
+static void ApplyAuroraVtxAttrFmtForDisplayList(GXVtxFmt fmt, bool mixed);
+static void SyncAppliedVtxStateFromHleReal();
+static void SubmitLytDrawPacket(const uint8_t* packet, uint32_t packetBytes);
+
+static inline uint8_t ScaleLytAlpha(uint8_t alpha, uint32_t modulate) {
+    const int32_t product = static_cast<int32_t>(alpha) * static_cast<int32_t>(modulate & 0xFFu);
+    const int32_t magic = static_cast<int32_t>(0x80808081u);
+    int32_t quotient = static_cast<int32_t>((static_cast<int64_t>(magic) * product) >> 32);
+    quotient = static_cast<int32_t>(quotient + product) >> 7;
+    quotient += (static_cast<uint32_t>(quotient) >> 31);
+    return static_cast<uint8_t>(quotient);
+}
+
+static inline uint32_t ReadLytColor(uint32_t colorAddr, int index) {
+    return Memory::Read32(colorAddr + static_cast<uint32_t>(index * 4));
+}
+
+static inline uint32_t ReadModulatedLytColor(uint32_t colorAddr, int index, uint32_t alpha) {
+    const uint32_t addr = colorAddr + static_cast<uint32_t>(index * 4);
+    const uint8_t r = Memory::Read8(addr);
+    const uint8_t g = Memory::Read8(addr + 1);
+    const uint8_t b = Memory::Read8(addr + 2);
+    uint8_t a = Memory::Read8(addr + 3);
+    if ((alpha & 0xFFu) != 0xFFu) {
+        a = ScaleLytAlpha(a, alpha);
+    }
+    return (static_cast<uint32_t>(r) << 24) |
+           (static_cast<uint32_t>(g) << 16) |
+           (static_cast<uint32_t>(b) << 8) |
+           static_cast<uint32_t>(a);
+}
+
+static inline void AppendLytTexCoords(uint8_t* packet, uint32_t& pos, uint32_t texCoordAddr,
+                                      int texCoordCount, uint32_t cornerOffset) {
+    if (texCoordCount <= 0) {
+        return;
+    }
+    for (int i = 0; i < texCoordCount; ++i) {
+        const uint32_t coordAddr = texCoordAddr + static_cast<uint32_t>(i * 32) + cornerOffset;
+        BigEndian::AppendFloat32(packet, pos, Memory::ReadFloat32(coordAddr));
+        BigEndian::AppendFloat32(packet, pos, Memory::ReadFloat32(coordAddr + 4));
+    }
+}
+
+static inline void AppendLytQuadVertex(uint8_t* packet, uint32_t& pos, float x, float y,
+                                       uint32_t texCoordAddr, int texCoordCount,
+                                       uint32_t cornerOffset, const uint32_t* colors, int colorIndex) {
+    BigEndian::AppendFloat32(packet, pos, x);
+    BigEndian::AppendFloat32(packet, pos, y);
+    if (colors) {
+        BigEndian::Append32(packet, pos, colors[colorIndex]);
+    }
+    AppendLytTexCoords(packet, pos, texCoordAddr, texCoordCount, cornerOffset);
+}
+
+// The four corners of an nw4r::lyt quad, in the order GX_QUADS expects, with
+// each corner's texcoord byte offset and colour index. The winding order is
+// load-bearing and both emit paths below share this one copy of it.
+static inline void AppendLytQuadVertices(uint8_t* packet, uint32_t& pos, float x0, float y0,
+                                         float x1, float y1, uint32_t texCoordAddr,
+                                         int texCoordCount, const uint32_t* colors) {
+    AppendLytQuadVertex(packet, pos, x0, y0, texCoordAddr, texCoordCount, 0, colors, 0);
+    AppendLytQuadVertex(packet, pos, x1, y0, texCoordAddr, texCoordCount, 8, colors, 1);
+    AppendLytQuadVertex(packet, pos, x1, y1, texCoordAddr, texCoordCount, 24, colors, 3);
+    AppendLytQuadVertex(packet, pos, x0, y1, texCoordAddr, texCoordCount, 16, colors, 2);
+}
+
+static bool CanSubmitLytDrawDirect(int texCoordCount, const uint32_t* colors) {
+    if (texCoordCount < 0 || texCoordCount > 8) {
+        return false;
+    }
+    const auto& posFmt = g_hleGxState.vtxAttrFmt[GX_VTXFMT0][GX_VA_POS];
+    if (g_hleGxState.vtxDesc[GX_VA_POS] != GX_DIRECT ||
+        posFmt.cnt != GX_POS_XY ||
+        posFmt.type != GX_F32) {
+        return false;
+    }
+
+    const bool hasColors = colors != nullptr;
+    const auto& clrFmt = g_hleGxState.vtxAttrFmt[GX_VTXFMT0][GX_VA_CLR0];
+    if (hasColors) {
+        if (g_hleGxState.vtxDesc[GX_VA_CLR0] != GX_DIRECT ||
+            clrFmt.cnt != GX_CLR_RGBA ||
+            clrFmt.type != GX_RGBA8) {
+            return false;
+        }
+    } else if (g_hleGxState.vtxDesc[GX_VA_CLR0] != GX_NONE) {
+        return false;
+    }
+
+    if (g_hleGxState.vtxDesc[GX_VA_NRM] != GX_NONE ||
+        g_hleGxState.vtxDesc[GX_VA_CLR1] != GX_NONE) {
+        return false;
+    }
+
+    for (int attr = GX_VA_PNMTXIDX; attr <= GX_VA_TEX7MTXIDX; ++attr) {
+        if (g_hleGxState.vtxDesc[attr] != GX_NONE) {
+            return false;
+        }
+    }
+
+    for (int i = 0; i < 8; ++i) {
+        const GXAttr attr = static_cast<GXAttr>(GX_VA_TEX0 + i);
+        const auto& fmt = g_hleGxState.vtxAttrFmt[GX_VTXFMT0][attr];
+        if (i < texCoordCount) {
+            if (g_hleGxState.vtxDesc[attr] != GX_DIRECT ||
+                fmt.cnt != GX_TEX_ST ||
+                fmt.type != GX_F32) {
+                return false;
+            }
+        } else if (g_hleGxState.vtxDesc[attr] != GX_NONE) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+static bool SubmitLytDrawDirect(float x0, float y0, float x1, float y1, int texCoordCount,
+                                uint32_t texCoordAddr, const uint32_t* colors) {
+    if (!CanSubmitLytDrawDirect(texCoordCount, colors)) {
+        return false;
+    }
+
+
+    EnsureAuroraFrameActive();
+
+    ApplyAuroraVtxDesc();
+
+    ApplyAuroraVtxAttrFmtForDisplayList(GX_VTXFMT0, false);
+
+    EnsureDefaultGxAlphaCompare();
+
+
+    std::array<uint8_t, 4u * (8u + 4u + 8u * 8u)> vertices{};
+    uint32_t pos = 0;
+    AppendLytQuadVertices(vertices.data(), pos, x0, y0, x1, y1, texCoordAddr, texCoordCount, colors);
+
+    if (!aurora::gx::fifo::submit_raw_draw(GX_QUADS, GX_VTXFMT0, vertices.data(), 4, pos)) {
+        return false;
+    }
+    GXMarkFrameWork();
+
+    SyncAppliedVtxStateFromHleReal();
+    return true;
+}
+
+static inline void EmitLytDrawQuad(uint32_t posAddr, uint32_t sizeAddr, int texCoordCount,
+                                   uint32_t texCoordAddr, const uint32_t* colors) {
+    const float x0 = Memory::ReadFloat32(posAddr);
+    const float y0 = Memory::ReadFloat32(posAddr + 4);
+    // The casts pin the arithmetic to PPC single precision regardless of the
+    // host's FLT_EVAL_METHOD.
+    const float x1 = static_cast<float>(x0 + Memory::ReadFloat32(sizeAddr));
+    const float y1 = static_cast<float>(y0 - Memory::ReadFloat32(sizeAddr + 4));
+
+    if (SubmitLytDrawDirect(x0, y0, x1, y1, texCoordCount, texCoordAddr, colors)) {
+        return;
+    }
+
+    // GX has exactly 8 texture coordinates, so nw4r::lyt cannot ask for more.
+    // The fixed packet buffer below is sized for that maximum; bail rather than
+    // overrun it if the guest ever hands us something else.
+    if (texCoordCount > 8) {
+        return;
+    }
+
+    std::array<uint8_t, 3u + 4u * (8u + 4u + 8u * 8u)> packet{};
+    uint32_t pos = 0;
+    packet[pos++] = GX_DRAW_QUADS_CMD | GX_VTXFMT0;
+    BigEndian::Append16(packet.data(), pos, 4);
+    AppendLytQuadVertices(packet.data(), pos, x0, y0, x1, y1, texCoordAddr, texCoordCount, colors);
+    SubmitLytDrawPacket(packet.data(), pos);
+}
+
+static uint32_t SubmitDLVertex(const uint8_t* ptr, GXVtxFmt vtxfmt, const GXAttrType* sourceVtxDesc) {
+    uint32_t offset = 0;
+    for (int attr = 0; attr < 26; ++attr) {
+        const auto type = sourceVtxDesc[attr]; if (type == GX_NONE) continue;
+        const auto& fmt = g_hleGxState.vtxAttrFmt[vtxfmt][attr];
+        const GXAttr gxAttr = static_cast<GXAttr>(attr);
+        if (type == GX_INDEX8) {
+            const uint32_t indexCount = (gxAttr == GX_VA_NRM) ? NormalIndexCount(fmt) : 1u;
+            if (gxAttr == GX_VA_NRM && indexCount == 3u) {
+                const uint32_t indices[3] = {ptr[offset], ptr[offset + 1], ptr[offset + 2]};
+                SubmitIndexedNormalNBT3(indices, fmt);
+            } else {
+                SubmitIndexedAttribute(gxAttr, ptr[offset]);
+            }
+            offset += indexCount;
+        }
+        else if (type == GX_INDEX16) {
+            const uint32_t indexCount = (gxAttr == GX_VA_NRM) ? NormalIndexCount(fmt) : 1u;
+            if (gxAttr == GX_VA_NRM && indexCount == 3u) {
+                const uint32_t indices[3] = {
+                    ReadBE16(ptr + offset),
+                    ReadBE16(ptr + offset + 2),
+                    ReadBE16(ptr + offset + 4),
+                };
+                SubmitIndexedNormalNBT3(indices, fmt);
+            } else {
+                SubmitIndexedAttribute(gxAttr, ReadBE16(ptr + offset));
+            }
+            offset += indexCount * 2u;
+        }
+        else if (type == GX_DIRECT) {
+            float comps[9]{};
+            switch (attr) {
+            case GX_VA_PNMTXIDX: {
+                const u8 idx = ptr[offset];
+                offset += 1;
+                GXMatrixIndex1u8(gxAttr, idx);
+                break;
+            }
+            case GX_VA_TEX0MTXIDX: case GX_VA_TEX1MTXIDX: case GX_VA_TEX2MTXIDX:
+            case GX_VA_TEX3MTXIDX: case GX_VA_TEX4MTXIDX: case GX_VA_TEX5MTXIDX:
+            case GX_VA_TEX6MTXIDX: case GX_VA_TEX7MTXIDX:
+                GXMatrixIndex1u8(gxAttr, ptr[offset]);
+                offset += 1;
+                break;
+            case GX_VA_POS: {
+                int count = static_cast<int>(AttrCompCount(GX_VA_POS, fmt, 0u)), compSize = GetCompSizeBytes(fmt.type);
+                for (int i = 0; i < count; ++i) {
+                    comps[i] = ReadStreamComp(ptr + offset, fmt.type, fmt.frac);
+                    offset += compSize;
+                }
+                SubmitAttribute(gxAttr, comps, fmt);
+                break;
+            }
+            case GX_VA_NRM: {
+                int count = static_cast<int>(AttrCompCount(GX_VA_NRM, fmt, 0u)), compSize = GetCompSizeBytes(fmt.type);
+                for (int i = 0; i < count; ++i) {
+                    comps[i] = ReadStreamComp(ptr + offset, fmt.type, fmt.frac);
+                    offset += compSize;
+                }
+                SubmitAttribute(gxAttr, comps, fmt);
+                break;
+            }
+            case GX_VA_CLR0: case GX_VA_CLR1: {
+                GXColor color{};
+                DecodeColorBytes(ptr + offset, fmt.type, fmt.cnt, color);
+                offset += ColorByteSize(fmt.type, fmt.cnt);
+                if (fmt.cnt == GX_CLR_RGB) GXColor3u8(color.r, color.g, color.b); else GXColor4u8(color.r, color.g, color.b, color.a);
+                break;
+            }
+            case GX_VA_TEX0: case GX_VA_TEX1: case GX_VA_TEX2: case GX_VA_TEX3: case GX_VA_TEX4: case GX_VA_TEX5: case GX_VA_TEX6: case GX_VA_TEX7: {
+                // All eight GX_VA_TEXn share one component layout.
+                int count = static_cast<int>(AttrCompCount(GX_VA_TEX0, fmt, 0u)), compSize = GetCompSizeBytes(fmt.type);
+                for (int i = 0; i < count; ++i) {
+                    comps[i] = ReadStreamComp(ptr + offset, fmt.type, fmt.frac);
+                    offset += compSize;
+                }
+                SubmitAttribute(gxAttr, comps, fmt);
+                break;
+            }
+            default: break;
+            }
+        }
+    }
+    return offset;
+}
+
+static void ApplyAuroraVtxStateForDlBegin(GXVtxFmt fmt) {
+    // Only this publish site latches the format into the HLE state; the FIFO and
+    // immediate-mode sites have already done it by the time they publish.
+    g_hleGxState.currentVtxFmt = fmt;
+
+    PublishAuroraVtxState(fmt, AuroraVtxPublishOptions{/*includeNbt=*/false,
+                                                       /*fmtLoopFirst=*/0,
+                                                       /*fmtLoopLast=*/25});
+}
+
+
+struct HleGxVertexStateSnapshot {
+    GXAttrType vtxDesc[26];
+    VtxAttrFmt vtxAttrFmt[8][26];
+    HleGxState::VtxArray vtxArray[26];
+    GXVtxFmt currentVtxFmt;
+    uint64_t vtxLayoutHash;
+    bool vtxLayoutHashDirty;
+    // Bit per vtxAttrFmt row carried in this snapshot.
+    uint32_t vtxAttrFmtRows;
+    bool hasVtxDesc;
+    bool hasVtxArray;
+    bool hasCurrentVtxFmt;
+};
+
+constexpr uint32_t kAllVtxAttrFmtRows = 0xFFu;
+
+static HleGxVertexStateSnapshot CaptureGxVertexState() {
+    HleGxVertexStateSnapshot snapshot;
+    std::memcpy(snapshot.vtxDesc, g_hleGxState.vtxDesc, sizeof(snapshot.vtxDesc));
+    std::memcpy(snapshot.vtxAttrFmt, g_hleGxState.vtxAttrFmt, sizeof(snapshot.vtxAttrFmt));
+    std::memcpy(snapshot.vtxArray, g_hleGxState.vtxArray, sizeof(snapshot.vtxArray));
+    snapshot.currentVtxFmt = g_hleGxState.currentVtxFmt;
+    snapshot.vtxLayoutHash = g_hleGxState.vtxLayoutHash;
+    snapshot.vtxLayoutHashDirty = g_hleGxState.vtxLayoutHashDirty;
+    snapshot.vtxAttrFmtRows = kAllVtxAttrFmtRows;
+    snapshot.hasVtxDesc = true;
+    snapshot.hasVtxArray = true;
+    snapshot.hasCurrentVtxFmt = true;
+    return snapshot;
+}
+
+static void RestoreGxVertexState(const HleGxVertexStateSnapshot& snapshot) {
+    if (snapshot.hasVtxDesc) {
+        std::memcpy(g_hleGxState.vtxDesc, snapshot.vtxDesc, sizeof(snapshot.vtxDesc));
+    }
+    if (snapshot.vtxAttrFmtRows == kAllVtxAttrFmtRows) {
+        std::memcpy(g_hleGxState.vtxAttrFmt, snapshot.vtxAttrFmt, sizeof(snapshot.vtxAttrFmt));
+    } else {
+        for (uint32_t fmt = 0; fmt < 8; ++fmt) {
+            if ((snapshot.vtxAttrFmtRows & (1u << fmt)) == 0) {
+                continue;
+            }
+            std::memcpy(g_hleGxState.vtxAttrFmt[fmt], snapshot.vtxAttrFmt[fmt],
+                        sizeof(snapshot.vtxAttrFmt[fmt]));
+        }
+    }
+    if (snapshot.hasVtxArray) {
+        std::memcpy(g_hleGxState.vtxArray, snapshot.vtxArray, sizeof(snapshot.vtxArray));
+    }
+    if (snapshot.hasCurrentVtxFmt) {
+        g_hleGxState.currentVtxFmt = snapshot.currentVtxFmt;
+    }
+    g_hleGxState.vtxLayoutHash = snapshot.vtxLayoutHash;
+    g_hleGxState.vtxLayoutHashDirty = snapshot.vtxLayoutHashDirty;
+    // The wholesale desc/attr-fmt overwrite above bypasses the per-field change
+    // checks that normally bump this, so mirrors must be told to resync.
+    ++g_hleGxState.vtxStateGeneration;
+}
+
+struct ScanAttrStep {
+    GXAttr attr = GX_VA_NULL;
+    uint32_t offset = 0;
+    uint32_t size = 0;
+    bool indexed = false;
+    bool index16 = false;
+};
+
+struct ScanLayoutCacheEntry {
+    // Only the indexed steps are consumed (ScanDLVerticesMaxIndices); the scan
+    // has no use for the direct ones beyond their contribution to vertexSize.
+    std::array<ScanAttrStep, 26> indexedSteps{};
+    uint32_t indexedStepCount = 0;
+    uint32_t vertexSize = 0;
+    uint32_t version = 0;
+    uint32_t generation = 0;
+    bool valid = false;
+};
+
+
+struct DlCpWrite {
+    uint8_t reg = 0;
+    uint32_t value = 0;
+};
+
+
+static HleGxVertexStateSnapshot CaptureGxVertexStateForCpWrites(const std::vector<DlCpWrite>& writes) {
+    HleGxVertexStateSnapshot snapshot;
+    snapshot.vtxAttrFmtRows = 0;
+    snapshot.hasVtxDesc = false;
+    snapshot.hasVtxArray = false;
+    snapshot.hasCurrentVtxFmt = false;
+    for (const auto& write : writes) {
+        const uint8_t reg = write.reg;
+        if (reg == 0x50 || reg == 0x60) {
+            snapshot.hasVtxDesc = true;
+        } else if (reg >= 0x70 && reg <= 0x77) {
+            snapshot.vtxAttrFmtRows |= 1u << (reg - 0x70);
+        } else if (reg >= 0x80 && reg <= 0x87) {
+            snapshot.vtxAttrFmtRows |= 1u << (reg - 0x80);
+        } else if (reg >= 0x90 && reg <= 0x97) {
+            snapshot.vtxAttrFmtRows |= 1u << (reg - 0x90);
+        } else if (reg >= 0xA0 && reg <= 0xBF) {
+            snapshot.hasVtxArray = true;
+        }
+    }
+    if (snapshot.hasVtxDesc) {
+        std::memcpy(snapshot.vtxDesc, g_hleGxState.vtxDesc, sizeof(snapshot.vtxDesc));
+    }
+    for (uint32_t fmt = 0; fmt < 8; ++fmt) {
+        if ((snapshot.vtxAttrFmtRows & (1u << fmt)) == 0) {
+            continue;
+        }
+        std::memcpy(snapshot.vtxAttrFmt[fmt], g_hleGxState.vtxAttrFmt[fmt],
+                    sizeof(snapshot.vtxAttrFmt[fmt]));
+    }
+    if (snapshot.hasVtxArray) {
+        std::memcpy(snapshot.vtxArray, g_hleGxState.vtxArray, sizeof(snapshot.vtxArray));
+    }
+    snapshot.vtxLayoutHash = g_hleGxState.vtxLayoutHash;
+    snapshot.vtxLayoutHashDirty = g_hleGxState.vtxLayoutHashDirty;
+    return snapshot;
+}
+
+struct DlScanCacheEntry {
+    uint32_t listAddr = 0;
+    uint32_t nbytes = 0;
+    uint64_t layoutHash = 0;
+    std::array<uint32_t, GX_VA_MAX_ATTR> maxIdx{};
+    std::array<bool, GX_VA_MAX_ATTR> sawIdx{};
+    std::array<uint32_t, GX_VA_MAX_ATTR> maxXfIdx{};
+    std::array<uint32_t, GX_VA_MAX_ATTR> maxXfBytes{};
+    std::array<bool, GX_VA_MAX_ATTR> sawXfIdx{};
+    GXVtxFmt dlVtxFmt = GX_MAX_VTXFMT;
+    bool dlVtxFmtMixed = false;
+    bool dlHasNestedDl = false;
+    bool dlHasArrayStateWrites = false;
+    bool dlHasCpWrites = false;
+    bool scanOk = false;
+    // Flatten results for lists that need one. `flattenVerbatim` means the
+    // flattened stream is byte-identical to the source list, so aurora can be
+    // handed the guest bytes directly and no copy has to be stored.
+    bool needsFlatten = false;
+    bool flattenOk = false;
+    bool flattenVerbatim = false;
+};
+
+struct DlScanCacheRecord {
+    DlScanCacheEntry result{};
+    // Answer of DisplayListMayContainDraw for these bytes
+    bool mayContainDraw = false;
+    uint64_t contentDigest = 0;
+    uint64_t writeGeneration = kDlWriteGenerationUntracked;
+    std::vector<DlCpWrite> cpWrites{};
+    std::vector<uint8_t> flattened{};
+};
+
+struct DlScanCacheState {
+    std::unordered_map<uint64_t, DlScanCacheRecord> entries{};
+    size_t storedCommandBytes = 0;
+};
+
+static uint64_t HashScanLayoutState() {
+    if (!g_hleGxState.vtxLayoutHashDirty) {
+        return g_hleGxState.vtxLayoutHash;
+    }
+    uint64_t hash = 1469598103934665603ull;
+    auto mix = [&hash](uint32_t value) {
+        hash ^= static_cast<uint64_t>(value);
+        hash *= 1099511628211ull;
+    };
+    for (int attr = 0; attr < 26; ++attr) {
+        mix(static_cast<uint32_t>(g_hleGxState.vtxDesc[attr]));
+    }
+    for (int fmt = 0; fmt < 8; ++fmt) {
+        for (int attr = 0; attr < 26; ++attr) {
+            const auto& f = g_hleGxState.vtxAttrFmt[fmt][attr];
+            mix(static_cast<uint32_t>(f.cnt));
+            mix(static_cast<uint32_t>(f.type));
+            mix(static_cast<uint32_t>(f.frac));
+        }
+    }
+    g_hleGxState.vtxLayoutHash = hash;
+    g_hleGxState.vtxLayoutHashDirty = false;
+    return g_hleGxState.vtxLayoutHash;
+}
+
+static uint64_t DlScanCacheKey(uint32_t listAddr, uint32_t nbytes, uint64_t layoutHash) {
+    return GxDisplayListScanCache::MakeIdentityKey(listAddr, nbytes, layoutHash);
+}
+
+static DlScanCacheState& DlScanCache() {
+    static thread_local DlScanCacheState s_cache;
+    return s_cache;
+}
+
+static uint64_t DlContentDigest(const uint8_t* list, uint32_t nbytes) {
+    return static_cast<uint64_t>(XXH3_64bits(list, static_cast<size_t>(nbytes)));
+}
+
+
+struct DlScanCacheProbe {
+    const DlScanCacheRecord* record = nullptr;
+    uint64_t contentDigest = 0;
+    bool digestValid = false;
+    uint64_t writeGeneration = kDlWriteGenerationUntracked;
+};
+
+static DlScanCacheProbe ProbeDlScanCache(const uint8_t* list, uint32_t listAddr, uint32_t nbytes,
+                                         uint64_t layoutHash) {
+    DlScanCacheProbe probe{};
+    probe.writeGeneration = GxGuestWrite::GenerationForRange(listAddr, nbytes);
+
+    auto& s_cache = DlScanCache();
+    const uint64_t key = DlScanCacheKey(listAddr, nbytes, layoutHash);
+    const auto it = s_cache.entries.find(key);
+    if (it != s_cache.entries.end()) {
+        auto& record = it->second;
+        const auto& entry = record.result;
+        const bool identityMatches = entry.listAddr == CanonicalizeGxMainRamAddress(listAddr) &&
+                                     entry.nbytes == nbytes && entry.layoutHash == layoutHash;
+        if (identityMatches && probe.writeGeneration != kDlWriteGenerationUntracked &&
+            record.writeGeneration == probe.writeGeneration) {
+            // Nothing has flushed a write over these bytes since the digest was
+            // taken, so the stored digest still describes them. Skip XXH3.
+            probe.record = &record;
+            probe.contentDigest = record.contentDigest;
+            probe.digestValid = true;
+        } else {
+            probe.contentDigest = DlContentDigest(list, nbytes);
+            probe.digestValid = true;
+            if (identityMatches &&
+                GxDisplayListScanCache::CanReuse(entry.listAddr, entry.nbytes, entry.layoutHash,
+                                                 record.contentDigest, listAddr, nbytes, layoutHash,
+                                                 probe.contentDigest)) {
+                // False alarm: the bump did not actually change this list
+                record.writeGeneration = probe.writeGeneration;
+                probe.record = &record;
+            }
+        }
+    }
+    return probe;
+}
+
+static size_t DlScanCacheRecordBytes(const DlScanCacheRecord& record) {
+    return record.flattened.size() + record.cpWrites.size() * sizeof(DlCpWrite);
+}
+
+static void StoreDlScanCache(uint32_t listAddr, uint32_t nbytes, uint64_t layoutHash,
+                             uint64_t contentDigest, uint64_t writeGeneration,
+                             bool mayContainDraw, const DlScanCacheEntry& entry,
+                             std::vector<DlCpWrite>&& cpWrites, const uint8_t* flattened,
+                             uint32_t flattenedBytes) {
+    auto& s_cache = DlScanCache();
+    const uint64_t key = DlScanCacheKey(listAddr, nbytes, layoutHash);
+    auto old = s_cache.entries.find(key);
+    bool replacing = old != s_cache.entries.end();
+    size_t replacedBytes = replacing ? DlScanCacheRecordBytes(old->second) : 0;
+    const size_t incomingBytes = static_cast<size_t>(flattenedBytes) +
+                                 cpWrites.size() * sizeof(DlCpWrite);
+    if ((!replacing && s_cache.entries.size() >= kDlScanCacheMaxEntries) ||
+        s_cache.storedCommandBytes - replacedBytes + incomingBytes > kDlScanCacheMaxStoredBytes) {
+        s_cache.entries.clear();
+        s_cache.storedCommandBytes = 0;
+        replacing = false;
+        replacedBytes = 0;
+    }
+    DlScanCacheRecord record{};
+    record.result = entry;
+    record.mayContainDraw = mayContainDraw;
+    record.result.listAddr = CanonicalizeGxMainRamAddress(listAddr);
+    record.result.nbytes = nbytes;
+    record.result.layoutHash = layoutHash;
+    record.contentDigest = contentDigest;
+    // Sampled before the digest was taken, so a write racing the digest can only
+    // make the next call re-digest, never make it trust a stale entry.
+    record.writeGeneration = writeGeneration;
+    record.cpWrites = std::move(cpWrites);
+    if (flattened != nullptr && flattenedBytes != 0) {
+        record.flattened.assign(flattened, flattened + flattenedBytes);
+    }
+    auto [it, inserted] = s_cache.entries.insert_or_assign(key, std::move(record));
+    (void)inserted;
+    s_cache.storedCommandBytes += DlScanCacheRecordBytes(it->second);
+    if (replacing) {
+        s_cache.storedCommandBytes -= replacedBytes;
+    }
+}
+
+static void BuildScanVertexLayout(GXVtxFmt vtxfmt, std::array<ScanAttrStep, 26>& indexedSteps,
+                                  uint32_t& indexedStepCount, uint32_t& vertexSize) {
+    indexedStepCount = 0;
+    vertexSize = 0;
+    for (int attr = 0; attr < 26; ++attr) {
+        const auto type = g_hleGxState.vtxDesc[attr];
+        if (type == GX_NONE) {
+            continue;
+        }
+        const GXAttr gxAttr = static_cast<GXAttr>(attr);
+        ScanAttrStep step{};
+        step.attr = gxAttr;
+        step.offset = vertexSize;
+        if (IsMatrixIndexAttr(gxAttr)) {
+            step.size = 1;
+        } else if (type == GX_INDEX8) {
+            step.size = (gxAttr == GX_VA_NRM) ? NormalIndexCount(g_hleGxState.vtxAttrFmt[vtxfmt][attr]) : 1u;
+            step.indexed = true;
+        } else if (type == GX_INDEX16) {
+            step.size = ((gxAttr == GX_VA_NRM) ? NormalIndexCount(g_hleGxState.vtxAttrFmt[vtxfmt][attr]) : 1u) * 2u;
+            step.indexed = true;
+            step.index16 = true;
+        } else if (type == GX_DIRECT) {
+            // Matrix attributes are handled above, so this reports 0 for them.
+            step.size = DirectAttrByteSize(gxAttr, g_hleGxState.vtxAttrFmt[vtxfmt][attr],
+                                           /*matrixAttrIsOneByte=*/false, /*fallbackComps=*/0u);
+        }
+        if (step.size == 0) {
+            continue;
+        }
+        if (step.indexed) {
+            indexedSteps[indexedStepCount++] = step;
+        }
+        // Every step contributes to the vertex stride, indexed or not: the
+        // offsets the indexed steps carry are relative to the whole vertex.
+        vertexSize += step.size;
+    }
+}
+
+static const ScanLayoutCacheEntry& GetScanVertexLayout(GXVtxFmt vtxfmt,
+                                                       std::array<ScanLayoutCacheEntry, 8>& cache,
+                                                       uint32_t version,
+                                                       uint32_t generation) {
+    auto& entry = cache[static_cast<uint32_t>(vtxfmt)];
+    if (entry.valid && entry.version == version && entry.generation == generation) {
+        return entry;
+    }
+    BuildScanVertexLayout(vtxfmt, entry.indexedSteps, entry.indexedStepCount, entry.vertexSize);
+    entry.version = version;
+    entry.generation = generation;
+    entry.valid = true;
+    return entry;
+}
+
+static void ScanDLVerticesMaxIndices(const uint8_t* ptr, uint16_t vtxCount,
+                                     const std::array<ScanAttrStep, 26>& steps, uint32_t stepCount,
+                                     uint32_t vertexSize,
+                                     std::array<uint32_t, GX_VA_MAX_ATTR>& maxIdx,
+                                     std::array<bool, GX_VA_MAX_ATTR>& sawIdx) {
+    if (stepCount == 0) {
+        return;
+    }
+    const uint8_t* vertex = ptr;
+    for (uint16_t v = 0; v < vtxCount; ++v, vertex += vertexSize) {
+        for (uint32_t i = 0; i < stepCount; ++i) {
+            const auto& step = steps[i];
+            const int attr = static_cast<int>(step.attr);
+            const uint32_t indexSize = step.index16 ? 2u : 1u;
+            const uint32_t indexCount = std::max(1u, step.size / indexSize);
+            for (uint32_t indexIdx = 0; indexIdx < indexCount; ++indexIdx) {
+                const uint8_t* indexPtr = vertex + step.offset + indexIdx * indexSize;
+                const uint32_t index = step.index16 ? ReadBE16(indexPtr) : *indexPtr;
+                if (!sawIdx[attr] || index > maxIdx[attr]) {
+                    maxIdx[attr] = index;
+                    sawIdx[attr] = true;
+                }
+            }
+        }
+    }
+}
+
+
+static void AppendBytes(std::vector<uint8_t>& out, const uint8_t* data, uint32_t count) {
+    out.insert(out.end(), data, data + count);
+}
+
+template <class Visitor>
+static bool WalkDisplayList(const uint8_t* data, uint32_t nbytes, Visitor& visitor, int depth) {
+    if (depth > Visitor::kMaxDepth) {
+        return false;
+    }
+    uint32_t pos = 0;
+    while (pos < nbytes) {
+        const uint8_t* const cmdPtr = data + pos;
+        const uint8_t cmd = data[pos++];
+        if (cmd == GX_NOP_CMD) {
+            if (!visitor.OnNop(cmd)) return false;
+            continue;
+        }
+        if (cmd == GX_LOAD_BP_REG_CMD) {
+            if (pos + 4u > nbytes) return false;
+            if (!visitor.OnBpReg(cmdPtr, ReadBE32(data + pos))) return false;
+            pos += 4u;
+            continue;
+        }
+        const uint8_t opcode = cmd & GX_OPCODE_MASK_CMD;
+        if (opcode == GX_LOAD_CP_REG_CMD) {
+            if (pos + 5u > nbytes) return false;
+            if (!visitor.OnCpReg(cmdPtr, data[pos], ReadBE32(data + pos + 1))) return false;
+            pos += 5u;
+            continue;
+        }
+        if (opcode == GX_LOAD_XF_REG_CMD) {
+            // Overflow-safe spelling of "pos + 4 <= nbytes && pos + payload <= nbytes".
+            if (pos > nbytes || nbytes - pos < 4u) return false;
+            const uint16_t count = ReadBE16(data + pos);
+            const uint32_t payloadBytes = 4u + (static_cast<uint32_t>(count) + 1u) * 4u;
+            if (payloadBytes > nbytes - pos) return false;
+            if (!visitor.OnXfReg(cmdPtr, payloadBytes)) return false;
+            pos += payloadBytes;
+            continue;
+        }
+        if (opcode >= GX_LOAD_INDX_A_CMD && opcode <= GX_LOAD_INDX_D_CMD) {
+            if (pos + 4u > nbytes) return false;
+            if (!visitor.OnIndexedXf(cmdPtr, cmd, ReadBE32(data + pos))) return false;
+            pos += 4u;
+            continue;
+        }
+        if (opcode == GX_CMD_CALL_DL_CMD) {
+            if (pos + 8u > nbytes) return false;
+            const uint32_t addr = ReadBE32(data + pos);
+            const uint32_t size = ReadBE32(data + pos + 4);
+            pos += 8u;
+            if (!visitor.OnCallDisplayList(addr, size, depth)) return false;
+            continue;
+        }
+        if (opcode == GX_CMD_INVL_VC_CMD) {
+            if (!visitor.OnInvalidateVertexCache(cmd)) return false;
+            continue;
+        }
+        if constexpr (Visitor::kHandlesDraw) {
+            if (IsDrawOpcode(opcode)) {
+                const GXVtxFmt vtxfmt = static_cast<GXVtxFmt>(cmd & GX_VAT_MASK_CMD);
+                // Resolved before the count bounds check: the index scan latches
+                // the list's vertex format here, and for the other two this is a
+                // pure function of the current layout.
+                const uint32_t vertexSize = visitor.DrawVertexSize(vtxfmt);
+                if (pos + 2u > nbytes) return false;
+                const uint16_t vtxCount = ReadBE16(data + pos);
+                pos += 2u;
+                uint32_t payloadBytes = static_cast<uint32_t>(vtxCount) * vertexSize;
+                if (pos + payloadBytes > nbytes) return false;
+                if (!visitor.OnDraw(cmdPtr, opcode, vtxfmt, vtxCount, data + pos, payloadBytes)) {
+                    return false;
+                }
+                pos += payloadBytes;
+                continue;
+            }
+        }
+        if (!visitor.OnUnknownCommand(cmd)) return false;
+    }
+    return true;
+}
+
+// Does this list carry anything that can produce geometry? Anything the walker
+// cannot model counts as "yes", which is why every hook that would have to look
+// at a payload just fails the walk instead.
+struct DlMayContainDrawVisitor {
+    static constexpr int kMaxDepth = 8;
+    static constexpr bool kHandlesDraw = false;
+
+    bool OnNop(uint8_t) { return true; }
+    bool OnBpReg(const uint8_t*, uint32_t) { return true; }
+    // An array base/stride write means the list is setting up indexed geometry.
+    bool OnCpReg(const uint8_t*, uint8_t reg, uint32_t) { return !(reg >= 0xA0 && reg <= 0xBF); }
+    bool OnXfReg(const uint8_t*, uint32_t) { return true; }
+    bool OnIndexedXf(const uint8_t*, uint8_t, uint32_t) { return true; }
+    bool OnInvalidateVertexCache(uint8_t) { return true; }
+    // Draw opcodes reach this too (kHandlesDraw is false): a draw opcode, or a
+    // command byte this walker does not model, both mean "assume it draws".
+    bool OnUnknownCommand(uint8_t) { return false; }
+    bool OnCallDisplayList(uint32_t addr, uint32_t size, int depth) {
+        if (addr == 0 || size == 0) return true;
+        const uint8_t* nested = static_cast<const uint8_t*>(GuestToHostPtr(addr, size));
+        if (!nested) return false;
+        DlMayContainDrawVisitor child;
+        return WalkDisplayList(nested, size, child, depth + 1);
+    }
+};
+
+static bool DisplayListMayContainDraw(const uint8_t* data, uint32_t nbytes) {
+    DlMayContainDrawVisitor visitor;
+    return !WalkDisplayList(data, nbytes, visitor, 0);
+}
+
+// Interpreter fallback
+struct DlInterpretVisitor {
+    static constexpr int kMaxDepth = 8;
+    static constexpr bool kHandlesDraw = true;
+
+    bool OnNop(uint8_t) { return true; }
+    bool OnInvalidateVertexCache(uint8_t) { return true; }
+    bool OnUnknownCommand(uint8_t) { return true; }
+    bool OnCpReg(const uint8_t*, uint8_t reg, uint32_t value) { ApplyCpRegWrite(reg, value); return true; }
+    bool OnBpReg(const uint8_t*, uint32_t bpWord) {
+        GXApplyBPReg(static_cast<uint8_t>(bpWord >> 24), bpWord & 0x00FFFFFFu);
+        return true;
+    }
+    bool OnXfReg(const uint8_t* cmdPtr, uint32_t payloadBytes) {
+        GXCallDisplayList(cmdPtr, 1u + payloadBytes);
+        GXMarkFrameWork();
+        return true;
+    }
+    bool OnIndexedXf(const uint8_t* cmdPtr, uint8_t cmd, uint32_t value) {
+        ApplyIndexedXfArrayForPacket(cmd, value);
+        GXCallDisplayList(cmdPtr, 5);
+        GXMarkFrameWork();
+        return true;
+    }
+    bool OnCallDisplayList(uint32_t addr, uint32_t size, int depth) {
+        if (addr == 0 || size == 0) return true;
+        const uint8_t* nested = static_cast<const uint8_t*>(GuestToHostPtr(addr, size));
+        if (!nested) return true;
+        DlInterpretVisitor child;
+        WalkDisplayList(nested, size, child, depth + 1);
+        return true;
+    }
+    uint32_t DrawVertexSize(GXVtxFmt vtxfmt) { return CalcDLVertexSize(vtxfmt); }
+    bool OnDraw(const uint8_t*, uint8_t opcode, GXVtxFmt vtxfmt, uint16_t vtxCount,
+                const uint8_t* vertices, uint32_t& payloadBytes) {
+        EnsureAuroraFrameActive();
+        const HleGxVertexStateSnapshot drawGuestState = CaptureGxVertexState();
+        ApplyAuroraVtxStateForDlBegin(vtxfmt);
+        GXBegin(OpcodeToGXPrimitive(opcode), vtxfmt, vtxCount);
+        GXMarkFrameWork();
+        // The per-vertex decode is what advances the cursor here, exactly as
+        // before the walk was shared: report what it actually consumed rather
+        // than the vtxCount * stride product the walker precomputed.
+        uint32_t consumed = 0;
+        for (uint16_t v = 0; v < vtxCount; ++v) {
+            consumed += SubmitDLVertex(vertices + consumed, vtxfmt, drawGuestState.vtxDesc);
+        }
+        GXEnd();
+        RestoreGxVertexState(drawGuestState);
+        payloadBytes = consumed;
+        return true;
+    }
+};
+
+static void ParseDisplayList(const uint8_t* data, uint32_t nbytes) {
+    DlInterpretVisitor visitor;
+    WalkDisplayList(data, nbytes, visitor, 0);
+}
+
+struct DlIndexScanVisitor {
+    static constexpr int kMaxDepth = 4;
+    static constexpr bool kHandlesDraw = true;
+
+    static std::array<ScanLayoutCacheEntry, 8>& LayoutCache() {
+        static thread_local std::array<ScanLayoutCacheEntry, 8> cache;
+        return cache;
+    }
+    static uint32_t NextLayoutGeneration() {
+        static thread_local uint32_t counter = 0;
+        return ++counter;
+    }
+
+    std::array<uint32_t, GX_VA_MAX_ATTR>& maxIdx;
+    std::array<bool, GX_VA_MAX_ATTR>& sawIdx;
+    std::array<uint32_t, GX_VA_MAX_ATTR>& maxXfIdx;
+    std::array<uint32_t, GX_VA_MAX_ATTR>& maxXfBytes;
+    std::array<bool, GX_VA_MAX_ATTR>& sawXfIdx;
+    GXVtxFmt* outFmt;
+    bool* outFmtMixed;
+    bool* outHasNestedDl;
+    bool* outHasArrayStateWrites;
+    bool* outHasCpWrites;
+    std::vector<DlCpWrite>* outCpWrites;
+    // Every walk - including each nested one - gets its own layout generation, so
+    // a cached layout can only be reused inside the walk that built it.
+    uint32_t layoutVersion = 1;
+    uint32_t layoutGeneration = NextLayoutGeneration();
+    const ScanLayoutCacheEntry* pendingLayout = nullptr;
+
+    bool OnNop(uint8_t) { return true; }
+    bool OnBpReg(const uint8_t*, uint32_t) { return true; }
+    bool OnXfReg(const uint8_t*, uint32_t) { return true; }
+    bool OnInvalidateVertexCache(uint8_t) { return true; }
+    bool OnUnknownCommand(uint8_t) { return false; }
+    bool OnCpReg(const uint8_t*, uint8_t reg, uint32_t value) {
+        if (outHasCpWrites) *outHasCpWrites = true;
+        if (reg >= 0xA0 && reg <= 0xBF && outHasArrayStateWrites) *outHasArrayStateWrites = true;
+        if (outCpWrites != nullptr) outCpWrites->push_back(DlCpWrite{reg, value});
+        ApplyCpRegWrite(reg, value);
+        if (reg == 0x50 || reg == 0x60 || (reg >= 0x70 && reg <= 0x97)) ++layoutVersion;
+        return true;
+    }
+    bool OnIndexedXf(const uint8_t*, uint8_t cmd, uint32_t value) {
+        const int attr =
+            GX_POS_MTX_ARRAY + (((cmd & GX_OPCODE_MASK_CMD) - GX_LOAD_INDX_A_CMD) / 0x08);
+        const uint32_t index = value >> 16;
+        const uint32_t bytes = (((value >> 12) & 0x0fu) + 1u) * 4u;
+        if (attr >= 0 && attr < GX_VA_MAX_ATTR) {
+            if (!sawXfIdx[attr] || index > maxXfIdx[attr]) maxXfIdx[attr] = index;
+            if (bytes > maxXfBytes[attr]) maxXfBytes[attr] = bytes;
+            sawXfIdx[attr] = true;
+        }
+        return true;
+    }
+    bool OnCallDisplayList(uint32_t addr, uint32_t size, int depth) {
+        if (addr == 0 || size == 0) return true;
+        if (outHasNestedDl) *outHasNestedDl = true;
+        try {
+            const uint8_t* nested = static_cast<const uint8_t*>(GuestToHostPtr(addr, size));
+            if (nested) {
+                DlIndexScanVisitor child{maxIdx,         sawIdx,         maxXfIdx,
+                                         maxXfBytes,     sawXfIdx,       outFmt,
+                                         outFmtMixed,    outHasNestedDl, outHasArrayStateWrites,
+                                         outHasCpWrites, outCpWrites};
+                if (!WalkDisplayList(nested, size, child, depth + 1)) return false;
+            }
+            ++layoutVersion;
+        } catch (...) {
+            return false;
+        }
+        return true;
+    }
+    uint32_t DrawVertexSize(GXVtxFmt vtxfmt) {
+        if (outFmt) {
+            if (*outFmt == GX_MAX_VTXFMT) *outFmt = vtxfmt;
+            else if (*outFmt != vtxfmt && outFmtMixed) *outFmtMixed = true;
+        }
+        pendingLayout = &GetScanVertexLayout(vtxfmt, LayoutCache(), layoutVersion, layoutGeneration);
+        return pendingLayout->vertexSize;
+    }
+    bool OnDraw(const uint8_t*, uint8_t, GXVtxFmt, uint16_t vtxCount, const uint8_t* vertices,
+                uint32_t&) {
+        ScanDLVerticesMaxIndices(vertices, vtxCount, pendingLayout->indexedSteps,
+                                 pendingLayout->indexedStepCount, pendingLayout->vertexSize, maxIdx,
+                                 sawIdx);
+        return true;
+    }
+};
+
+static bool ScanDisplayListMaxIndices(const uint8_t* data, uint32_t nbytes,
+                                      std::array<uint32_t, GX_VA_MAX_ATTR>& maxIdx,
+                                      std::array<bool, GX_VA_MAX_ATTR>& sawIdx,
+                                      std::array<uint32_t, GX_VA_MAX_ATTR>& maxXfIdx,
+                                      std::array<uint32_t, GX_VA_MAX_ATTR>& maxXfBytes,
+                                      std::array<bool, GX_VA_MAX_ATTR>& sawXfIdx,
+                                      GXVtxFmt* outFmt, bool* outFmtMixed, bool* outHasNestedDl,
+                                      bool* outHasArrayStateWrites, bool* outHasCpWrites,
+                                      std::vector<DlCpWrite>* outCpWrites) {
+    DlIndexScanVisitor visitor{maxIdx,         sawIdx,         maxXfIdx,
+                               maxXfBytes,     sawXfIdx,       outFmt,
+                               outFmtMixed,    outHasNestedDl, outHasArrayStateWrites,
+                               outHasCpWrites, outCpWrites};
+    return WalkDisplayList(data, nbytes, visitor, 0);
+}
+
+// Inlines nested lists into one flat command stream aurora can consume directly.
+// `outVerbatim` stays true only while every consumed command is appended
+// unchanged, i.e. the flattened stream is a byte-for-byte copy of the source
+// list. Callers use that to hand aurora the guest bytes directly.
+struct DlFlattenVisitor {
+    static constexpr int kMaxDepth = 8;
+    static constexpr bool kHandlesDraw = true;
+
+    std::vector<uint8_t>& out;
+    bool skipArrayState;
+    bool* outVerbatim;
+
+    bool OnNop(uint8_t cmd) { out.push_back(cmd); return true; }
+    bool OnInvalidateVertexCache(uint8_t cmd) { out.push_back(cmd); return true; }
+    bool OnUnknownCommand(uint8_t) { return false; }
+    bool OnBpReg(const uint8_t* cmdPtr, uint32_t) { AppendBytes(out, cmdPtr, 5); return true; }
+    bool OnIndexedXf(const uint8_t* cmdPtr, uint8_t, uint32_t) { AppendBytes(out, cmdPtr, 5); return true; }
+    bool OnXfReg(const uint8_t* cmdPtr, uint32_t payloadBytes) {
+        AppendBytes(out, cmdPtr, 1u + payloadBytes);
+        return true;
+    }
+    // Command byte + the 2-byte vertex count + the vertex payload.
+    bool OnDraw(const uint8_t* cmdPtr, uint8_t, GXVtxFmt, uint16_t, const uint8_t*,
+                uint32_t& payloadBytes) {
+        AppendBytes(out, cmdPtr, 3u + payloadBytes);
+        return true;
+    }
+    uint32_t DrawVertexSize(GXVtxFmt vtxfmt) { return CalcDLVertexSize(vtxfmt); }
+    bool OnCpReg(const uint8_t* cmdPtr, uint8_t reg, uint32_t value) {
+        const bool arrayBaseOrStride = (reg >= 0xA0 && reg <= 0xBF);
+        if (!skipArrayState || !arrayBaseOrStride) {
+            AppendBytes(out, cmdPtr, 6);
+        } else if (outVerbatim != nullptr) {
+            *outVerbatim = false;
+        }
+        ApplyCpRegWrite(reg, value);
+        return true;
+    }
+    bool OnCallDisplayList(uint32_t addr, uint32_t size, int depth) {
+        if (outVerbatim != nullptr) *outVerbatim = false;
+        if (addr == 0 || size == 0) return true;
+        const uint8_t* nested = static_cast<const uint8_t*>(GuestToHostPtr(addr, size));
+        if (!nested) return true;
+        DlFlattenVisitor child{out, skipArrayState, outVerbatim};
+        return WalkDisplayList(nested, size, child, depth + 1);
+    }
+};
+
+static bool FlattenDisplayListForAurora(const uint8_t* data, uint32_t nbytes,
+                                        std::vector<uint8_t>& out, bool skipArrayState,
+                                        bool* outVerbatim = nullptr) {
+    DlFlattenVisitor visitor{out, skipArrayState, outVerbatim};
+    return WalkDisplayList(data, nbytes, visitor, 0);
+}
+
+static std::vector<uint8_t>& FlattenDisplayListScratch() {
+    static thread_local std::vector<uint8_t> s_scratch;
+    return s_scratch;
+}
+
+static bool s_appliedVtxDescValid = false;
+static std::array<GXAttrType, 26> s_appliedVtxDesc{};
+static std::array<GXAttrType, 26> s_appliedSourceVtxDesc{};
+static bool s_appliedVtxAttrFmtValid = false;
+static VtxAttrFmt s_appliedVtxAttrFmt[8][26]{};
+
+struct AppliedArrayState {
+    const void* data = nullptr;
+    uint32_t size = 0;
+    uint8_t stride = 0;
+    bool valid = false;
+};
+
+static std::array<AppliedArrayState, GX_VA_MAX_ATTR> s_appliedArrays{};
+
+// True only while the applied-state mirror is a verbatim copy of HLE vertex state at
+// generation s_appliedVtxStateGeneration; any HLE-side mutation bumps that generation, so the
+// memoized republish below can never observe a stale match.
+static bool s_appliedVtxStateMatchesHle = false;
+static uint32_t s_appliedVtxStateGeneration = 0;
+
+static void InvalidateAppliedAuroraState() {
+    s_appliedVtxDescValid = false;
+    s_appliedVtxAttrFmtValid = false;
+    s_appliedVtxStateMatchesHle = false;
+    for (auto& array : s_appliedArrays) {
+        array.valid = false;
+    }
+}
+
+static void SyncAppliedVtxStateFromHleReal() {
+    // skip the republish only when the mirror is already an exact copy of
+    // HLE state
+    if (s_appliedVtxStateMatchesHle && s_appliedVtxDescValid && s_appliedVtxAttrFmtValid &&
+        s_appliedVtxStateGeneration == g_hleGxState.vtxStateGeneration) {
+        return;
+    }
+    // Both mirrors are dense arrays of the same trivially copyable element types
+    // as their HLE counterparts, so publish them with three memcpys instead of
+    // 234 individual element assignments.
+    static_assert(sizeof(s_appliedVtxDesc) == sizeof(g_hleGxState.vtxDesc));
+    static_assert(sizeof(s_appliedSourceVtxDesc) == sizeof(g_hleGxState.vtxDesc));
+    static_assert(sizeof(s_appliedVtxAttrFmt) == sizeof(g_hleGxState.vtxAttrFmt));
+    std::memcpy(s_appliedVtxDesc.data(), g_hleGxState.vtxDesc, sizeof(g_hleGxState.vtxDesc));
+    std::memcpy(s_appliedSourceVtxDesc.data(), g_hleGxState.vtxDesc, sizeof(g_hleGxState.vtxDesc));
+    s_appliedVtxDescValid = true;
+
+    std::memcpy(s_appliedVtxAttrFmt, g_hleGxState.vtxAttrFmt, sizeof(g_hleGxState.vtxAttrFmt));
+    s_appliedVtxAttrFmtValid = true;
+
+    s_appliedVtxStateMatchesHle = true;
+    s_appliedVtxStateGeneration = g_hleGxState.vtxStateGeneration;
+}
+
+static void ApplyAuroraArrayIfChanged(GXAttr attr, const void* data, uint32_t size, uint8_t stride) {
+    auto& applied = s_appliedArrays[attr];
+    if (applied.valid && applied.data == data && applied.size == size && applied.stride == stride) {
+        return;
+    }
+    GXSetArray(attr, data, size, stride);
+    applied.data = data;
+    applied.size = size;
+    applied.stride = stride;
+    applied.valid = true;
+}
+
+// Aurora's live vertex descriptor for one attribute, read straight back out of
+// its CP shadow registers (GXGetVtxDesc is the exact inverse of GXSetVtxDesc,
+// GX_VA_NRM included). This is the ground truth the applied-state mirror is
+// checked against below; it is a switch plus a shift/mask, no state change and
+// no FIFO traffic.
+static bool AuroraVtxDescMatchesLive(GXAttr attr, GXAttrType expected) {
+    GXAttrType live = GX_NONE;
+    GXGetVtxDesc(attr, &live);
+    return live == expected;
+}
+
+
+static void ApplyAuroraVtxDesc() {
+    const bool hadValidState = s_appliedVtxDescValid;
+    if (!hadValidState) {
+        s_appliedVtxStateMatchesHle = false;
+    }
+    for (int attr = 0; attr < 26; ++attr) {
+        if (attr == GX_VA_NBT) continue;
+        const GXAttr gxAttr = static_cast<GXAttr>(attr);
+        const GXAttrType type = g_hleGxState.vtxDesc[attr];
+        bool needsPublish = !hadValidState || s_appliedVtxDesc[attr] != type;
+        // GXGetVtxDesc only decodes GX_VA_PNMTXIDX..GX_VA_TEX7; the XF array
+        // pseudo-attributes above GX_VA_TEX7 have no CP descriptor bits, so
+        // probing them would always report GX_NONE and republish a no-op.
+        if (!needsPublish && !IsMatrixIndexAttr(gxAttr) && gxAttr <= GX_VA_TEX7 &&
+            (type == GX_INDEX8 || type == GX_INDEX16)) {
+            needsPublish = !AuroraVtxDescMatchesLive(gxAttr, type);
+        }
+        if (needsPublish) {
+            GXSetVtxDesc(gxAttr, type);
+            s_appliedVtxDesc[attr] = type;
+        }
+        if (!hadValidState || s_appliedSourceVtxDesc[attr] != type) {
+            GXSetSourceVtxDesc(gxAttr, type);
+            s_appliedSourceVtxDesc[attr] = type;
+        }
+    }
+    s_appliedVtxDescValid = true;
+}
+
+// Size of one element of the guest array an indexed attribute reads from. An
+// NBT3 normal is indexed per 3-component group, not per 9-component triple.
+static uint32_t GetIndexedAttrElementSizeBytes(GXAttr attr, const VtxAttrFmt& fmt) {
+    if (attr == GX_VA_NRM && fmt.cnt == GX_NRM_NBT3) {
+        return 3u * static_cast<uint32_t>(GetCompSizeBytes(fmt.type));
+    }
+    return DirectAttrByteSize(attr, fmt, /*matrixAttrIsOneByte=*/false, /*fallbackComps=*/0u);
+}
+
+static void ApplyAuroraVtxAttrFmt(GXVtxFmt fmt) {
+    const bool hadValidState = s_appliedVtxAttrFmtValid;
+    // Rows other than `fmt` keep their contents and every write below copies
+    // g_hleGxState, so an already-matching mirror still matches. Only the rebuild
+    // from an invalidated mirror leaves the untouched rows divergent.
+    if (!hadValidState) {
+        s_appliedVtxStateMatchesHle = false;
+    }
+    for (int attr = 0; attr < 26; ++attr) {
+        if (attr == GX_VA_NBT) continue;
+        if (IsMatrixIndexAttr(static_cast<GXAttr>(attr))) continue;
+        const auto& f = g_hleGxState.vtxAttrFmt[fmt][attr];
+        if (hadValidState && SameVtxAttrFmt(s_appliedVtxAttrFmt[fmt][attr], f)) {
+            continue;
+        }
+        GXSetVtxAttrFmt(fmt, static_cast<GXAttr>(attr), f.cnt, f.type, f.frac);
+        s_appliedVtxAttrFmt[fmt][attr] = f;
+    }
+    s_appliedVtxAttrFmtValid = true;
+}
+
+static void ApplyAuroraVtxAttrFmtAll() {
+    for (int fmt = 0; fmt < 8; ++fmt) {
+        ApplyAuroraVtxAttrFmt(static_cast<GXVtxFmt>(fmt));
+    }
+}
+
+static void ApplyAuroraVtxAttrFmtForDisplayList(GXVtxFmt fmt, bool mixed) {
+    if (!mixed && fmt < GX_MAX_VTXFMT) {
+        ApplyAuroraVtxAttrFmt(fmt);
+        return;
+    }
+    ApplyAuroraVtxAttrFmtAll();
+}
+
+static void SubmitLytDrawPacket(const uint8_t* packet, uint32_t packetBytes) {
+    if (packet == nullptr || packetBytes == 0) {
+        return;
+    }
+    EnsureAuroraFrameActive();
+    ApplyAuroraVtxDesc();
+    ApplyAuroraVtxAttrFmtForDisplayList(GX_VTXFMT0, false);
+    EnsureDefaultGxAlphaCompare();
+
+    GXCallDisplayList(packet, packetBytes);
+    GXMarkFrameWork();
+    SyncAppliedVtxStateFromHleReal();
+}
+
+static bool ApplyAuroraArraysForDisplayList(const std::array<uint32_t, GX_VA_MAX_ATTR>& maxIdx,
+                                            const std::array<bool, GX_VA_MAX_ATTR>& sawIdx,
+                                            GXVtxFmt vtxfmt,
+                                            bool vtxfmtMixed) {
+    static std::array<std::array<std::vector<uint8_t>, 2>, GX_VA_MAX_ATTR> s_packedArrays;
+    static std::array<uint32_t, GX_VA_MAX_ATTR> s_packedArrayCursor{};
+    bool ok = true;
+    if (vtxfmt >= GX_MAX_VTXFMT) {
+        vtxfmt = g_hleGxState.currentVtxFmt;
+    }
+    for (int attr = 0; attr < 26; ++attr) {
+        const GXAttrType type = g_hleGxState.vtxDesc[attr]; if (type != GX_INDEX8 && type != GX_INDEX16) continue;
+        if (!sawIdx[attr]) continue;
+        const auto& arr = g_hleGxState.vtxArray[attr];
+        if (arr.base == 0 || arr.stride == 0) { ok = false; continue; }
+        const uint32_t count = maxIdx[attr] + 1u;
+        const GXAttr gxAttr = static_cast<GXAttr>(attr);
+        const auto& fmt = g_hleGxState.vtxAttrFmt[vtxfmt][attr];
+        const uint32_t elemSize = GetIndexedAttrElementSizeBytes(gxAttr, fmt);
+        if (elemSize == 0) {
+            ok = false;
+            continue;
+        }
+        const uint32_t span = (count > 0) ? (static_cast<uint32_t>((count - 1u) * arr.stride) + elemSize) : 0u;
+        const bool needsPack = arr.stride > 0xffu;
+        if (!Memory::Contains(arr.base, span)) {
+            ok = false;
+            continue;
+        }
+        const uint8_t* hostPtr = static_cast<const uint8_t*>(GuestToHostPtr(arr.base, span));
+        if (!hostPtr) {
+            ok = false;
+            continue;
+        }
+        // Aurora's storage-fetch shaders consume guest big-endian bytes directly
+        // and honor the array stride. Keep the backing pointer stable so per-frame
+        // storage uploads can be cached instead of repacking every display-list call.
+        if (!needsPack) {
+            ApplyAuroraArrayIfChanged(gxAttr, hostPtr, span, static_cast<uint8_t>(arr.stride));
+            continue;
+        }
+        auto& packed = s_packedArrays[attr][++s_packedArrayCursor[attr] & 1u];
+        if (!PackIndexedAttrData(hostPtr, arr.stride, count, elemSize, packed)) {
+            ok = false;
+            continue;
+        }
+        ApplyAuroraArrayIfChanged(gxAttr, packed.data(), static_cast<uint32_t>(packed.size()), static_cast<uint8_t>(elemSize));
+    }
+    return ok;
+}
+
+static bool ApplyAuroraIndexedXFArraysForDisplayList(const std::array<uint32_t, GX_VA_MAX_ATTR>& maxXfIdx,
+                                                     const std::array<uint32_t, GX_VA_MAX_ATTR>& maxXfBytes,
+                                                     const std::array<bool, GX_VA_MAX_ATTR>& sawXfIdx) {
+    bool ok = true;
+    for (int attr = GX_POS_MTX_ARRAY; attr <= GX_LIGHT_ARRAY; ++attr) {
+        if (!sawXfIdx[attr]) {
+            continue;
+        }
+        const auto& arr = g_hleGxState.vtxArray[attr];
+        const uint32_t bytes = maxXfBytes[attr];
+        if (arr.base == 0 || arr.stride == 0 || bytes == 0) {
+            ok = false;
+            continue;
+        }
+        const uint32_t span = maxXfIdx[attr] * arr.stride + bytes;
+        if (!Memory::Contains(arr.base, span)) {
+            ok = false;
+            continue;
+        }
+        const uint8_t* hostPtr = static_cast<const uint8_t*>(GuestToHostPtr(arr.base, span));
+        if (!hostPtr) {
+            ok = false;
+            continue;
+        }
+        ApplyAuroraArrayIfChanged(static_cast<GXAttr>(attr), hostPtr, span, static_cast<uint8_t>(arr.stride));
+    }
+    return ok;
+}
+
+} // namespace
+
+extern "C" void GxNotifyDisplayListMemoryWrite(uint32_t addr, uint32_t size) {
+    GxGuestWrite::NotifyWrite(addr, size);
+}
+
+extern "C" void GX__CallDisplayList_80172f64(uint32_t listAddr, uint32_t nbytes) {
+    if (nbytes == 0 || listAddr == 0) return;
+    try {
+        const uint8_t* list = static_cast<const uint8_t*>(GuestToHostPtr(listAddr, nbytes));
+        if (!list) return;
+
+        const bool allowScanCache = nbytes <= kDlScanCacheMaxEntryBytes;
+        const uint64_t scanLayoutHash = allowScanCache ? HashScanLayoutState() : 0;
+        // The digest is computed lazily inside the probe: an entry whose covering
+        // write-tracking granules have not moved since it was stored keeps its
+        // recorded digest and skips the XXH3 pass over the whole list entirely.
+        const DlScanCacheProbe probe =
+            allowScanCache ? ProbeDlScanCache(list, listAddr, nbytes, scanLayoutHash)
+                           : DlScanCacheProbe{};
+        const DlScanCacheRecord* cached = probe.record;
+
+        // The scan a cached record came from already walked the list for this,
+        // so only a miss pays for DisplayListMayContainDraw.
+        const bool mayContainDraw =
+            (cached != nullptr) ? cached->mayContainDraw : DisplayListMayContainDraw(list, nbytes);
+        if (!mayContainDraw) {
+            EnsureAuroraFrameActive();
+            GXMarkFrameWork();
+            GXCallDisplayList(list, nbytes);
+            // The republish is required even for register-only lists (verified by
+            // experiment: dropping it corrupts in-race geometry decode). It is
+            // instead memoized inside SyncAppliedVtxStateFromHleReal, so a run of
+            // register-only lists between draws pays for at most one mirror copy.
+            SyncAppliedVtxStateFromHleReal();
+            return;
+        }
+        std::array<uint32_t, GX_VA_MAX_ATTR> maxIdx{}; std::array<bool, GX_VA_MAX_ATTR> sawIdx{};
+        std::array<uint32_t, GX_VA_MAX_ATTR> maxXfIdx{}; std::array<uint32_t, GX_VA_MAX_ATTR> maxXfBytes{};
+        std::array<bool, GX_VA_MAX_ATTR> sawXfIdx{};
+        GXVtxFmt dlVtxFmt = GX_MAX_VTXFMT; bool dlVtxFmtMixed = false;
+        bool dlHasNestedDl = false;
+        bool dlHasArrayStateWrites = false;
+        bool dlHasCpWrites = false;
+
+        HleGxVertexStateSnapshot stateBeforeScan;
+        bool haveStateBeforeScan = false;
+
+        bool scanOk = false;
+        bool needsFlatten = false;
+        bool flattenOk = false;
+        const uint8_t* auroraStream = nullptr;
+        uint32_t auroraStreamBytes = 0;
+        if (cached != nullptr) {
+            const auto& entry = cached->result;
+            scanOk = entry.scanOk;
+            maxIdx = entry.maxIdx;
+            sawIdx = entry.sawIdx;
+            maxXfIdx = entry.maxXfIdx;
+            maxXfBytes = entry.maxXfBytes;
+            sawXfIdx = entry.sawXfIdx;
+            dlVtxFmt = entry.dlVtxFmt;
+            dlVtxFmtMixed = entry.dlVtxFmtMixed;
+            dlHasNestedDl = entry.dlHasNestedDl;
+            dlHasArrayStateWrites = entry.dlHasArrayStateWrites;
+            dlHasCpWrites = entry.dlHasCpWrites;
+            needsFlatten = entry.needsFlatten;
+            flattenOk = entry.flattenOk;
+            // A scan/flatten only mutates HLE vertex state through the CP writes
+            // embedded in the list. Replaying the recorded writes in stream order
+            // lands g_hleGxState exactly where the uncached path would have left it.
+            if (dlHasCpWrites) {
+                stateBeforeScan = CaptureGxVertexStateForCpWrites(cached->cpWrites);
+                haveStateBeforeScan = true;
+            }
+            for (const auto& write : cached->cpWrites) {
+                ApplyCpRegWrite(write.reg, write.value);
+            }
+            if (needsFlatten && flattenOk) {
+                if (entry.flattenVerbatim) {
+                    auroraStream = list;
+                    auroraStreamBytes = nbytes;
+                } else {
+                    auroraStream = cached->flattened.data();
+                    auroraStreamBytes = static_cast<uint32_t>(cached->flattened.size());
+                }
+            }
+        } else {
+            std::vector<DlCpWrite> cpWrites{};
+            // The scan discovers the list's CP writes as it walks, so this path
+            // cannot narrow the snapshot the way the cached one does.
+            stateBeforeScan = CaptureGxVertexState();
+            haveStateBeforeScan = true;
+            scanOk = ScanDisplayListMaxIndices(list, nbytes, maxIdx, sawIdx, maxXfIdx, maxXfBytes, sawXfIdx,
+                                               &dlVtxFmt, &dlVtxFmtMixed, &dlHasNestedDl,
+                                               &dlHasArrayStateWrites, &dlHasCpWrites, &cpWrites);
+            needsFlatten = dlHasNestedDl || dlHasArrayStateWrites || dlHasCpWrites;
+            bool flattenVerbatim = true;
+            auto& flattened = FlattenDisplayListScratch();
+            if (needsFlatten) {
+                RestoreGxVertexState(stateBeforeScan);
+                flattened.clear();
+                flattenOk = FlattenDisplayListForAurora(list, nbytes, flattened, dlHasArrayStateWrites,
+                                                        &flattenVerbatim);
+                if (flattenOk) {
+                    if (flattenVerbatim) {
+                        auroraStream = list;
+                        auroraStreamBytes = nbytes;
+                    } else {
+                        auroraStream = flattened.data();
+                        auroraStreamBytes = static_cast<uint32_t>(flattened.size());
+                    }
+                }
+            }
+            // Nested lists stay uncached: the digest only covers the outer list, so a
+            // rewritten callee would go undetected. Everything else is cacheable since the
+            // scan/flatten are pure functions of the list bytes and the layout-hash cache key.
+            if (allowScanCache && scanOk && !dlHasNestedDl && (!needsFlatten || flattenOk)) {
+                DlScanCacheEntry entry{};
+                entry.listAddr = CanonicalizeGxMainRamAddress(listAddr);
+                entry.nbytes = nbytes;
+                entry.layoutHash = scanLayoutHash;
+                entry.maxIdx = maxIdx;
+                entry.sawIdx = sawIdx;
+                entry.maxXfIdx = maxXfIdx;
+                entry.maxXfBytes = maxXfBytes;
+                entry.sawXfIdx = sawXfIdx;
+                entry.dlVtxFmt = dlVtxFmt;
+                entry.dlVtxFmtMixed = dlVtxFmtMixed;
+                entry.dlHasNestedDl = dlHasNestedDl;
+                entry.dlHasArrayStateWrites = dlHasArrayStateWrites;
+                entry.dlHasCpWrites = dlHasCpWrites;
+                entry.scanOk = scanOk;
+                entry.needsFlatten = needsFlatten;
+                entry.flattenOk = flattenOk;
+                entry.flattenVerbatim = flattenVerbatim;
+                const bool storeFlattened = needsFlatten && flattenOk && !flattenVerbatim;
+
+                const uint64_t contentDigest =
+                    probe.digestValid ? probe.contentDigest : DlContentDigest(list, nbytes);
+                StoreDlScanCache(listAddr, nbytes, scanLayoutHash, contentDigest,
+                                 probe.writeGeneration, mayContainDraw, entry, std::move(cpWrites),
+                                 storeFlattened ? flattened.data() : nullptr,
+                                 storeFlattened ? static_cast<uint32_t>(flattened.size()) : 0u);
+            }
+        }
+
+        if (needsFlatten) {
+            bool flattenApplyOk = flattenOk && scanOk && auroraStream != nullptr && auroraStreamBytes != 0;
+            if (flattenApplyOk) {
+                ApplyAuroraVtxDesc();
+                ApplyAuroraVtxAttrFmtForDisplayList(dlVtxFmt, dlVtxFmtMixed);
+                const bool flattenArraysOk =
+                    ApplyAuroraArraysForDisplayList(maxIdx, sawIdx, dlVtxFmt, dlVtxFmtMixed);
+                const bool flattenXfOk =
+                    ApplyAuroraIndexedXFArraysForDisplayList(maxXfIdx, maxXfBytes, sawXfIdx);
+                flattenApplyOk = flattenArraysOk && flattenXfOk;
+            }
+            if (flattenApplyOk) {
+                EnsureAuroraFrameActive();
+                GXMarkFrameWork();
+                GXCallDisplayList(auroraStream, auroraStreamBytes);
+                // No flip back to GX_DIRECT here
+                SyncAppliedVtxStateFromHleReal();
+                return;
+            }
+
+        } else {
+            bool applyOk = scanOk;
+            bool arraysOk = false;
+            bool xfOk = false;
+            if (scanOk) {
+                ApplyAuroraVtxDesc();
+                ApplyAuroraVtxAttrFmtForDisplayList(dlVtxFmt, dlVtxFmtMixed);
+                arraysOk = ApplyAuroraArraysForDisplayList(maxIdx, sawIdx, dlVtxFmt, dlVtxFmtMixed);
+                xfOk = ApplyAuroraIndexedXFArraysForDisplayList(maxXfIdx, maxXfBytes, sawXfIdx);
+                applyOk = arraysOk && xfOk;
+            }
+            if (applyOk) {
+                EnsureAuroraFrameActive();
+                GXMarkFrameWork();
+                GXCallDisplayList(list, nbytes);
+
+                SyncAppliedVtxStateFromHleReal();
+                return;
+            }
+
+        }
+
+        if (haveStateBeforeScan) {
+            RestoreGxVertexState(stateBeforeScan);
+        }
+        EnsureAuroraFrameActive();
+        GXMarkFrameWork();
+        InvalidateAppliedAuroraState();
+        ParseDisplayList(list, nbytes);
+        InvalidateAppliedAuroraState();
+    } catch (...) {}
+}
+
+PPC_NATIVE_OVERRIDE_VOID(80172F64, GX__CallDisplayList_80172f64, (uint32_t listAddr, uint32_t nbytes), (listAddr, nbytes));
+
+extern "C" void nw4r__lyt__detail__DrawQuad_800847c0(CpuContext* ctx) {
+    uint32_t colors[4];
+    const uint32_t colorAddr = ctx->gpr[7];
+    const uint32_t* colorPtr = nullptr;
+    if (colorAddr != 0) {
+        colors[0] = ReadLytColor(colorAddr, 0);
+        colors[1] = ReadLytColor(colorAddr, 1);
+        colors[2] = ReadLytColor(colorAddr, 2);
+        colors[3] = ReadLytColor(colorAddr, 3);
+        colorPtr = colors;
+    }
+
+    EmitLytDrawQuad(ctx->gpr[3], ctx->gpr[4], static_cast<int32_t>(ctx->gpr[5]), ctx->gpr[6], colorPtr);
+}
+
+REGISTER_NATIVE_FUNCTION(0x800847C0, nw4r__lyt__detail__DrawQuad_800847c0);
+
+extern "C" void nw4r__lyt__detail__DrawQuad_80084d20(CpuContext* ctx) {
+    uint32_t colors[4];
+    const uint32_t colorAddr = ctx->gpr[7];
+    const uint32_t* colorPtr = nullptr;
+    if (colorAddr != 0) {
+        const uint32_t alpha = ctx->gpr[8];
+        colors[0] = ReadModulatedLytColor(colorAddr, 0, alpha);
+        colors[1] = ReadModulatedLytColor(colorAddr, 1, alpha);
+        colors[2] = ReadModulatedLytColor(colorAddr, 2, alpha);
+        colors[3] = ReadModulatedLytColor(colorAddr, 3, alpha);
+        colorPtr = colors;
+    }
+
+    EmitLytDrawQuad(ctx->gpr[3], ctx->gpr[4], static_cast<int32_t>(ctx->gpr[5]), ctx->gpr[6], colorPtr);
+}
+
+REGISTER_NATIVE_FUNCTION(0x80084D20, nw4r__lyt__detail__DrawQuad_80084d20);
diff --git a/runtime/src/hle/gx/gx_dynamic_aspect.h b/runtime/src/hle/gx/gx_dynamic_aspect.h
new file mode 100644
index 0000000..7d64eea
--- /dev/null
+++ b/runtime/src/hle/gx/gx_dynamic_aspect.h
@@ -0,0 +1,68 @@
+#pragma once
+
+#include <algorithm>
+#include <aurora/render_size_limits.hpp>
+#include <cmath>
+#include <cstdint>
+
+// EGG::Screen picks a canvas record at 0x802A3EE8 via SCGetAspectRatio, squeezed into the fixed
+// 608x456 framebuffer by xScale=fbWidth/width; only gScreenScaleX/Y (0x80386F20/24) feed vertical
+// FOV, so records can only widen horizontal FOV. Solving for k = surfaceAspect/(16:9): record
+// width = base*max(k,1), gScreenScaleY = max(1/k,1), giving Hor+ above 16:9 and Vert+ below it
+// without cropping either axis. Verified bit-exact against the reference Gecko patch at 2560x1080.
+namespace MkwDynamicAspect {
+
+inline constexpr float kPresentationAspect169 = 16.0f / 9.0f;
+inline constexpr float kEggFramebufferWidth = 608.0f;
+inline constexpr uint32_t kEggScreenHeight = 456u;
+inline constexpr uint32_t kEggRecordWidth43 = 608u;
+inline constexpr uint32_t kEggRecordWidth169 = 832u;
+// Guard against a degenerate window turning the world inside out: 6.0 is a
+// ~145 degree vertical FOV at MKW's stock 45 degree base, past which the
+// 10.0 near plane and the game's own culling stop behaving.
+inline constexpr float kMaxVerticalExpansion =
+    aurora::render_size_limits::kMaxDynamicPortraitExpansion;
+
+inline float SurfaceAspect(uint32_t width, uint32_t height) noexcept {
+    if (width == 0 || height == 0) {
+        return kPresentationAspect169;
+    }
+    return aurora::render_size_limits::clamp_dynamic_aspect(
+        static_cast<float>(width) / static_cast<float>(height));
+}
+
+// surfaceAspect / (16:9). Above 1 the surface is wider than 16:9, below 1 it
+// is tighter (4:3, portrait).
+inline float AspectRatioFactor(uint32_t width, uint32_t height) noexcept {
+    return SurfaceAspect(width, height) / kPresentationAspect169;
+}
+
+// Hor+ factor, clamped at 1 so a tighter-than-16:9 surface never narrows the
+// canvas (that would crop away scene the 16:9 view showed).
+inline float HorizontalExpansion(uint32_t width, uint32_t height) noexcept {
+    return std::max(1.0f, AspectRatioFactor(width, height));
+}
+
+// Vert+ factor, clamped at 1 so a wider-than-16:9 surface never shortens the
+// frustum. Exactly one of the two expansions is ever greater than 1.
+inline float VerticalExpansion(uint32_t width, uint32_t height) noexcept {
+    const float factor = AspectRatioFactor(width, height);
+    if (!(factor > 0.0f)) {
+        return 1.0f;
+    }
+    return std::clamp(1.0f / factor, 1.0f, kMaxVerticalExpansion);
+}
+
+inline uint32_t EggRecordWidth(uint32_t baseWidth, uint32_t surfaceWidth,
+                               uint32_t surfaceHeight) noexcept {
+    const float scaledWidth =
+        static_cast<float>(baseWidth) * HorizontalExpansion(surfaceWidth, surfaceHeight);
+    return std::clamp<uint32_t>(
+        static_cast<uint32_t>(std::lround(scaledWidth / 4.0f)) * 4u, 4u, 0xFFFCu);
+}
+
+inline float EggHorizontalScale(uint32_t recordWidth) noexcept {
+    return kEggFramebufferWidth / static_cast<float>(std::max(recordWidth, 1u));
+}
+
+} // namespace MkwDynamicAspect
diff --git a/runtime/src/hle/gx/gx_egg.cpp b/runtime/src/hle/gx/gx_egg.cpp
new file mode 100644
index 0000000..8a9fd75
--- /dev/null
+++ b/runtime/src/hle/gx/gx_egg.cpp
@@ -0,0 +1,122 @@
+// gx_egg.cpp - EGG Library Helper Stubs
+#include "gx_internal.h"
+
+// Vertex helper declarations not used by the direct-call catalog.
+extern "C" void GX__SetArray_8016e32c(uint32_t a, uint32_t ba, uint32_t str);
+extern "C" void GX_HLE_FIFO_WriteFloat(float val);
+extern "C" void GX_HLE_FIFO_Write8(uint8_t val);
+
+// ============================================================================
+// EGG::DrawGX Functions
+// ============================================================================
+
+// Use translated implementations for the main DrawGX setup routines.
+// Keep HLE fallbacks only for known missing alias entry points.
+static void EGG__DrawGX__SetVtxState_HLE(uint32_t state) {
+    GX__ClearVtxDesc_8016dc34();
+    auto setDesc = [](uint32_t attr, uint32_t type) { GX__SetVtxDesc_8016d3a4(attr, type); };
+    auto setFmt = [](uint32_t attr, uint32_t cnt, uint32_t type, uint32_t frac) { GX__SetVtxAttrFmt_8016dc68(0, attr, cnt, type, frac); };
+    auto setArray = [](uint32_t attr, uint32_t addr, uint32_t stride) { if (addr && stride) GX__SetArray_8016e32c(attr, addr, stride); };
+
+    switch (state) {
+    case 0:
+        setFmt(GX_VA_POS, GX_POS_XYZ, GX_S16, 0xE);
+        setFmt(GX_VA_NRM, GX_NRM_XYZ, GX_S16, 0xE);
+        setArray(GX_VA_POS, 0x802574a0u, 6);
+        setArray(GX_VA_NRM, 0x802574e0u, 6);
+        setDesc(GX_VA_POS, GX_INDEX8);
+        setDesc(GX_VA_NRM, GX_INDEX8);
+        break;
+    case 1:
+        setDesc(GX_VA_POS, GX_DIRECT);
+        setFmt(GX_VA_POS, GX_POS_XYZ, GX_F32, 0);
+        break;
+    case 2: case 3: case 4: case 5:
+        setDesc(GX_VA_POS, GX_DIRECT); setDesc(GX_VA_NRM, GX_DIRECT);
+        setFmt(GX_VA_POS, GX_POS_XYZ, GX_F32, 0); setFmt(GX_VA_NRM, GX_NRM_XYZ, GX_F32, 0);
+        break;
+    case 6:
+        setDesc(GX_VA_POS, GX_DIRECT); setDesc(GX_VA_NRM, GX_DIRECT); setDesc(GX_VA_CLR0, GX_DIRECT);
+        setFmt(GX_VA_POS, GX_POS_XYZ, GX_F32, 0); setFmt(GX_VA_NRM, GX_NRM_XYZ, GX_F32, 0);
+        setFmt(GX_VA_CLR0, GX_CLR_RGBA, GX_RGBA8, 0);
+        break;
+    case 7: case 8:
+        setDesc(GX_VA_POS, GX_INDEX8); setDesc(GX_VA_NRM, GX_INDEX8);
+        if (state == 7) setDesc(GX_VA_TEX0, GX_DIRECT);
+        setFmt(GX_VA_POS, GX_POS_XY, GX_S16, 0xE); setFmt(GX_VA_NRM, GX_NRM_XYZ, GX_S16, 0xE);
+        if (state == 7) setFmt(GX_VA_TEX0, GX_TEX_ST, GX_F32, 0);
+        setArray(GX_VA_POS, 0x80257520u, 4); setArray(GX_VA_NRM, 0x80388b80u, 6);
+        break;
+    case 9:
+        setDesc(GX_VA_POS, GX_INDEX8); setDesc(GX_VA_NRM, GX_INDEX8); setDesc(GX_VA_TEX0, GX_DIRECT);
+        setFmt(GX_VA_POS, GX_POS_XYZ, GX_S16, 0xE); setFmt(GX_VA_NRM, GX_NRM_XYZ, GX_S16, 0xE);
+        setFmt(GX_VA_TEX0, GX_TEX_ST, GX_F32, 0);
+        setArray(GX_VA_POS, 0x80257540u, 6); setArray(GX_VA_NRM, 0x80388ba0u, 6);
+        break;
+    case 10: case 11: case 12: case 13: {
+        const bool useAltPos = (state == 11 || state == 13);
+        const bool useTex = (state == 10 || state == 11);
+        setDesc(GX_VA_POS, GX_INDEX8);
+        if (useTex) setDesc(GX_VA_TEX0, GX_INDEX8);
+        const uint32_t posBase = useAltPos ? 0x80388be0u : 0x80388bc0u;
+        setArray(GX_VA_POS, posBase, 2);
+        if (useTex) setArray(GX_VA_TEX0, 0x80388be0u, 2);
+        setFmt(GX_VA_POS, GX_POS_XY, GX_U8, 0);
+        if (useTex) setFmt(GX_VA_TEX0, GX_TEX_ST, GX_U8, 0);
+        break;
+    }
+    default: break;
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(8021b344, EGG__DrawGX__SetVtxState_HLE, (uint32_t state), (state));
+PPC_NATIVE_OVERRIDE_VOID(8021b688, EGG__DrawGX__SetVtxState_HLE, (uint32_t state), (state));
+
+extern "C" void EGG__LightTexture__SetupTevFinish_HLE_8022e2bc(CpuContext* ctx) {
+    const uint32_t self = ctx->gpr[3];
+    const uint32_t stageCount = Memory::Read8(self + 0x75);
+    const uint32_t tevCount = Memory::Read16(self + 0x78);
+
+    if (stageCount != 0) {
+        uint32_t remainder = tevCount % stageCount;
+        if (remainder > 0) {
+            const GXColor black{0, 0, 0, 255};
+            while (remainder < stageCount) {
+                GXSetTevColor(static_cast<GXTevRegID>(remainder + 1), black);
+                GXSetTevKColor(static_cast<GXTevKColorID>(remainder), black);
+                ++remainder;
+            }
+
+            const uint32_t mode = Memory::Read32(self + 0x44);
+            const float origin = Memory::ReadFloat32(ctx->gpr[2] + ((mode == 2) ? -25004 : -25040));
+            const float span = Memory::ReadFloat32(ctx->gpr[2] + -25024);
+            const float end = static_cast<float>(origin + span);
+            const float lower = static_cast<float>(origin - span);
+
+            auto writeVertex = [](uint8_t posIdx, float s, float t) {
+                GX_HLE_FIFO_Write8(posIdx);
+                GX_HLE_FIFO_WriteFloat(s);
+                GX_HLE_FIFO_WriteFloat(t);
+            };
+
+            GX__Begin_8016f0f0(GX_QUADS, GX_VTXFMT0, 4);
+            writeVertex(0, origin, origin);
+            writeVertex(1, origin, lower);
+            writeVertex(2, end, lower);
+            writeVertex(3, end, origin);
+        }
+    }
+
+    Memory::Write8(self + 0x74, 2);
+}
+PPC_NATIVE_OVERRIDE_VOID(8022e2bc, EGG__LightTexture__SetupTevFinish_HLE_8022e2bc, (CpuContext* ctx), (ctx));
+
+// ============================================================================
+// EGG::AsyncDisplay
+// ============================================================================
+
+extern "C" void EGG__AsyncDisplay__endRender_HLE_8020ff9c(CpuContext* ctx) {
+    uint32_t p = ctx->gpr[3]; ctx->gpr[3] = p; ctx->lr = 0x8020FF9C;
+    InvokeIndirectCpu(0x80219FB4u, ctx);
+    InvokeIndirectCpu(0x8016ED50u, ctx);
+}
+PPC_NATIVE_OVERRIDE_VOID(8020FF9C, EGG__AsyncDisplay__endRender_HLE_8020ff9c, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/gx/gx_fatal_stubs.cpp b/runtime/src/hle/gx/gx_fatal_stubs.cpp
new file mode 100644
index 0000000..42ca4e5
--- /dev/null
+++ b/runtime/src/hle/gx/gx_fatal_stubs.cpp
@@ -0,0 +1,241 @@
+// Auto-generated GX fatal stubs
+#include "hle_stubs.h"
+#include "runtime_log.h"
+
+namespace {
+[[noreturn]] void HaltGX(uint32_t addr, const char* name) {
+    const char* symbol = name ? name : "<unknown GX symbol>";
+    RT_LOGF(RT_TAG_GX,
+            "unimplemented GX entry point: %s at guest address 0x%08X.\n"
+            "[gx] This graphics call has no Aurora implementation bound to it yet, so the\n"
+            "[gx] runtime cannot continue without silently dropping GPU state. Bind it in\n"
+            "[gx] runtime/src/hle/gx/ and remove the stub from gx_fatal_stubs.cpp.\n",
+            symbol, addr);
+    std::fflush(stderr);
+    char message[512]{};
+    std::snprintf(message, sizeof(message),
+                  "%s at guest address 0x%08X has no Aurora implementation bound to it, so the "
+                  "runtime stopped rather than keep rendering with missing GPU state.",
+                  symbol, addr);
+    ShowRuntimeFatalPopup("the game called an unimplemented graphics function", message);
+    std::abort();
+}
+} // namespace
+
+// Every fatal stub is the same two statements with the address and the symbol
+// name substituted, so the body comes from this macro. The registration is
+// deliberately still spelled out per entry so the translator's runtime-native
+// index sees the literal PPC_NATIVE_OVERRIDE_VOID invocation. Hiding it inside
+// this macro would leave the index unable to associate an address with the stub.
+#define GX_FATAL_STUB(addr, sym) \
+    extern "C" void gx_stub_##addr(CpuContext* ctx) { (void)ctx; HaltGX(0x##addr, sym); }
+
+GX_FATAL_STUB(8016b49c, "__GX__DefaultTexRegionCallback_8016b49c") PPC_NATIVE_OVERRIDE_VOID(8016b49c, gx_stub_8016b49c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016b590, "__GX__DefaultTlutRegionCallback_8016b590") PPC_NATIVE_OVERRIDE_VOID(8016b590, gx_stub_8016b590, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016b5b4, "__GX__Shutdown_8016b5b4") PPC_NATIVE_OVERRIDE_VOID(8016b5b4, gx_stub_8016b5b4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016c668, "GX__CPInterruptHandler_8016c668") PPC_NATIVE_OVERRIDE_VOID(8016c668, gx_stub_8016c668, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d054, "GX__SetBreakPtCallback_8016d054") PPC_NATIVE_OVERRIDE_VOID(8016d054, gx_stub_8016d054, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d098, "GX__EnableBreakPt_8016d098") PPC_NATIVE_OVERRIDE_VOID(8016d098, gx_stub_8016d098, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d138, "GX__DisableBreakPt_8016d138") PPC_NATIVE_OVERRIDE_VOID(8016d138, gx_stub_8016d138, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d1fc, "__GX__CleanGPFifo_8016d1fc") PPC_NATIVE_OVERRIDE_VOID(8016d1fc, gx_stub_8016d1fc, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d3c0, "GX__SetVtxDesc_switch_8016d3c0") PPC_NATIVE_OVERRIDE_VOID(8016d3c0, gx_stub_8016d3c0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d3c4, "GX__SetVtxDesc_caseD_0_8016d3c4") PPC_NATIVE_OVERRIDE_VOID(8016d3c4, gx_stub_8016d3c4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d3d8, "GX__SetVtxDesc_caseD_1_8016d3d8") PPC_NATIVE_OVERRIDE_VOID(8016d3d8, gx_stub_8016d3d8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d3ec, "GX__SetVtxDesc_caseD_2_8016d3ec") PPC_NATIVE_OVERRIDE_VOID(8016d3ec, gx_stub_8016d3ec, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d400, "GX__SetVtxDesc_caseD_3_8016d400") PPC_NATIVE_OVERRIDE_VOID(8016d400, gx_stub_8016d400, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d414, "GX__SetVtxDesc_caseD_4_8016d414") PPC_NATIVE_OVERRIDE_VOID(8016d414, gx_stub_8016d414, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d428, "GX__SetVtxDesc_caseD_5_8016d428") PPC_NATIVE_OVERRIDE_VOID(8016d428, gx_stub_8016d428, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d43c, "GX__SetVtxDesc_caseD_6_8016d43c") PPC_NATIVE_OVERRIDE_VOID(8016d43c, gx_stub_8016d43c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d450, "GX__SetVtxDesc_caseD_7_8016d450") PPC_NATIVE_OVERRIDE_VOID(8016d450, gx_stub_8016d450, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d464, "GX__SetVtxDesc_caseD_8_8016d464") PPC_NATIVE_OVERRIDE_VOID(8016d464, gx_stub_8016d464, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d478, "GX__SetVtxDesc_caseD_9_8016d478") PPC_NATIVE_OVERRIDE_VOID(8016d478, gx_stub_8016d478, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d48c, "GX__SetVtxDesc_caseD_a_8016d48c") PPC_NATIVE_OVERRIDE_VOID(8016d48c, gx_stub_8016d48c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d4c0, "GX__SetVtxDesc_caseD_19_8016d4c0") PPC_NATIVE_OVERRIDE_VOID(8016d4c0, gx_stub_8016d4c0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d4f4, "GX__SetVtxDesc_caseD_b_8016d4f4") PPC_NATIVE_OVERRIDE_VOID(8016d4f4, gx_stub_8016d4f4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d508, "GX__SetVtxDesc_caseD_c_8016d508") PPC_NATIVE_OVERRIDE_VOID(8016d508, gx_stub_8016d508, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d51c, "GX__SetVtxDesc_caseD_d_8016d51c") PPC_NATIVE_OVERRIDE_VOID(8016d51c, gx_stub_8016d51c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d530, "GX__SetVtxDesc_caseD_e_8016d530") PPC_NATIVE_OVERRIDE_VOID(8016d530, gx_stub_8016d530, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d544, "GX__SetVtxDesc_caseD_f_8016d544") PPC_NATIVE_OVERRIDE_VOID(8016d544, gx_stub_8016d544, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d558, "GX__SetVtxDesc_caseD_10_8016d558") PPC_NATIVE_OVERRIDE_VOID(8016d558, gx_stub_8016d558, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d56c, "GX__SetVtxDesc_caseD_11_8016d56c") PPC_NATIVE_OVERRIDE_VOID(8016d56c, gx_stub_8016d56c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d580, "GX__SetVtxDesc_caseD_12_8016d580") PPC_NATIVE_OVERRIDE_VOID(8016d580, gx_stub_8016d580, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d594, "GX__SetVtxDesc_caseD_13_8016d594") PPC_NATIVE_OVERRIDE_VOID(8016d594, gx_stub_8016d594, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d5a8, "GX__SetVtxDesc_caseD_14_8016d5a8") PPC_NATIVE_OVERRIDE_VOID(8016d5a8, gx_stub_8016d5a8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d5b8, "GX__SetVtxDesc_caseD_15_8016d5b8") PPC_NATIVE_OVERRIDE_VOID(8016d5b8, gx_stub_8016d5b8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d814, "__GX__SetVCD_8016d814") PPC_NATIVE_OVERRIDE_VOID(8016d814, gx_stub_8016d814, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016d8c4, "__GX__CalculateVLim_8016d8c4") PPC_NATIVE_OVERRIDE_VOID(8016d8c4, gx_stub_8016d8c4, (CpuContext* ctx), (ctx));
+// moved to gx_vertex.cpp: GX__GetVtxDesc_8016d9f0
+GX_FATAL_STUB(8016da0c, "GX__GetVtxDesc_switch_8016da0c") PPC_NATIVE_OVERRIDE_VOID(8016da0c, gx_stub_8016da0c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016da10, "GX__GetVtxDesc_caseD_0_8016da10") PPC_NATIVE_OVERRIDE_VOID(8016da10, gx_stub_8016da10, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016da20, "GX__GetVtxDesc_caseD_1_8016da20") PPC_NATIVE_OVERRIDE_VOID(8016da20, gx_stub_8016da20, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016da30, "GX__GetVtxDesc_caseD_2_8016da30") PPC_NATIVE_OVERRIDE_VOID(8016da30, gx_stub_8016da30, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016da40, "GX__GetVtxDesc_caseD_3_8016da40") PPC_NATIVE_OVERRIDE_VOID(8016da40, gx_stub_8016da40, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016da50, "GX__GetVtxDesc_caseD_4_8016da50") PPC_NATIVE_OVERRIDE_VOID(8016da50, gx_stub_8016da50, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016da60, "GX__GetVtxDesc_caseD_5_8016da60") PPC_NATIVE_OVERRIDE_VOID(8016da60, gx_stub_8016da60, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016da70, "GX__GetVtxDesc_caseD_6_8016da70") PPC_NATIVE_OVERRIDE_VOID(8016da70, gx_stub_8016da70, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016da80, "GX__GetVtxDesc_caseD_7_8016da80") PPC_NATIVE_OVERRIDE_VOID(8016da80, gx_stub_8016da80, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016da90, "GX__GetVtxDesc_caseD_8_8016da90") PPC_NATIVE_OVERRIDE_VOID(8016da90, gx_stub_8016da90, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016daa0, "GX__GetVtxDesc_caseD_9_8016daa0") PPC_NATIVE_OVERRIDE_VOID(8016daa0, gx_stub_8016daa0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dab0, "GX__GetVtxDesc_caseD_a_8016dab0") PPC_NATIVE_OVERRIDE_VOID(8016dab0, gx_stub_8016dab0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dad4, "GX__GetVtxDesc_caseD_19_8016dad4") PPC_NATIVE_OVERRIDE_VOID(8016dad4, gx_stub_8016dad4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016daf8, "GX__GetVtxDesc_caseD_b_8016daf8") PPC_NATIVE_OVERRIDE_VOID(8016daf8, gx_stub_8016daf8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db08, "GX__GetVtxDesc_caseD_c_8016db08") PPC_NATIVE_OVERRIDE_VOID(8016db08, gx_stub_8016db08, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db18, "GX__GetVtxDesc_caseD_d_8016db18") PPC_NATIVE_OVERRIDE_VOID(8016db18, gx_stub_8016db18, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db28, "GX__GetVtxDesc_caseD_e_8016db28") PPC_NATIVE_OVERRIDE_VOID(8016db28, gx_stub_8016db28, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db38, "GX__GetVtxDesc_caseD_f_8016db38") PPC_NATIVE_OVERRIDE_VOID(8016db38, gx_stub_8016db38, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db48, "GX__GetVtxDesc_caseD_10_8016db48") PPC_NATIVE_OVERRIDE_VOID(8016db48, gx_stub_8016db48, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db58, "GX__GetVtxDesc_caseD_11_8016db58") PPC_NATIVE_OVERRIDE_VOID(8016db58, gx_stub_8016db58, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db68, "GX__GetVtxDesc_caseD_12_8016db68") PPC_NATIVE_OVERRIDE_VOID(8016db68, gx_stub_8016db68, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db78, "GX__GetVtxDesc_caseD_13_8016db78") PPC_NATIVE_OVERRIDE_VOID(8016db78, gx_stub_8016db78, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db88, "GX__GetVtxDesc_caseD_14_8016db88") PPC_NATIVE_OVERRIDE_VOID(8016db88, gx_stub_8016db88, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016db98, "GX__GetVtxDesc_caseD_15_8016db98") PPC_NATIVE_OVERRIDE_VOID(8016db98, gx_stub_8016db98, (CpuContext* ctx), (ctx));
+// moved to gx_vertex.cpp: GX__GetVtxDescv_8016dba4
+GX_FATAL_STUB(8016dc94, "GX__SetVtxAttrFmt_switch_8016dc94") PPC_NATIVE_OVERRIDE_VOID(8016dc94, gx_stub_8016dc94, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dc98, "GX__SetVtxAttrFmt_caseD_9_8016dc98") PPC_NATIVE_OVERRIDE_VOID(8016dc98, gx_stub_8016dc98, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dcb0, "GX__SetVtxAttrFmt_caseD_19_8016dcb0") PPC_NATIVE_OVERRIDE_VOID(8016dcb0, gx_stub_8016dcb0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dcec, "GX__SetVtxAttrFmt_caseD_b_8016dcec") PPC_NATIVE_OVERRIDE_VOID(8016dcec, gx_stub_8016dcec, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dd00, "GX__SetVtxAttrFmt_caseD_c_8016dd00") PPC_NATIVE_OVERRIDE_VOID(8016dd00, gx_stub_8016dd00, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dd14, "GX__SetVtxAttrFmt_caseD_d_8016dd14") PPC_NATIVE_OVERRIDE_VOID(8016dd14, gx_stub_8016dd14, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dd2c, "GX__SetVtxAttrFmt_caseD_e_8016dd2c") PPC_NATIVE_OVERRIDE_VOID(8016dd2c, gx_stub_8016dd2c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dd44, "GX__SetVtxAttrFmt_caseD_f_8016dd44") PPC_NATIVE_OVERRIDE_VOID(8016dd44, gx_stub_8016dd44, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dd5c, "GX__SetVtxAttrFmt_caseD_10_8016dd5c") PPC_NATIVE_OVERRIDE_VOID(8016dd5c, gx_stub_8016dd5c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dd74, "GX__SetVtxAttrFmt_caseD_11_8016dd74") PPC_NATIVE_OVERRIDE_VOID(8016dd74, gx_stub_8016dd74, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dd94, "GX__SetVtxAttrFmt_caseD_12_8016dd94") PPC_NATIVE_OVERRIDE_VOID(8016dd94, gx_stub_8016dd94, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016ddac, "GX__SetVtxAttrFmt_caseD_13_8016ddac") PPC_NATIVE_OVERRIDE_VOID(8016ddac, gx_stub_8016ddac, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016ddc4, "GX__SetVtxAttrFmt_caseD_14_8016ddc4") PPC_NATIVE_OVERRIDE_VOID(8016ddc4, gx_stub_8016ddc4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016ddd8, "GX__SetVtxAttrFmt_caseD_15_8016ddd8") PPC_NATIVE_OVERRIDE_VOID(8016ddd8, gx_stub_8016ddd8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016de48, "GX__SetVtxAttrFmtv_switch_8016de48") PPC_NATIVE_OVERRIDE_VOID(8016de48, gx_stub_8016de48, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016de4c, "GX__SetVtxAttrFmtv_caseD_9_8016de4c") PPC_NATIVE_OVERRIDE_VOID(8016de4c, gx_stub_8016de4c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016de64, "GX__SetVtxAttrFmtv_caseD_19_8016de64") PPC_NATIVE_OVERRIDE_VOID(8016de64, gx_stub_8016de64, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dea0, "GX__SetVtxAttrFmtv_caseD_b_8016dea0") PPC_NATIVE_OVERRIDE_VOID(8016dea0, gx_stub_8016dea0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016deb4, "GX__SetVtxAttrFmtv_caseD_c_8016deb4") PPC_NATIVE_OVERRIDE_VOID(8016deb4, gx_stub_8016deb4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dec8, "GX__SetVtxAttrFmtv_caseD_d_8016dec8") PPC_NATIVE_OVERRIDE_VOID(8016dec8, gx_stub_8016dec8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dee0, "GX__SetVtxAttrFmtv_caseD_e_8016dee0") PPC_NATIVE_OVERRIDE_VOID(8016dee0, gx_stub_8016dee0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016def8, "GX__SetVtxAttrFmtv_caseD_f_8016def8") PPC_NATIVE_OVERRIDE_VOID(8016def8, gx_stub_8016def8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016df10, "GX__SetVtxAttrFmtv_caseD_10_8016df10") PPC_NATIVE_OVERRIDE_VOID(8016df10, gx_stub_8016df10, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016df28, "GX__SetVtxAttrFmtv_caseD_11_8016df28") PPC_NATIVE_OVERRIDE_VOID(8016df28, gx_stub_8016df28, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016df48, "GX__SetVtxAttrFmtv_caseD_12_8016df48") PPC_NATIVE_OVERRIDE_VOID(8016df48, gx_stub_8016df48, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016df60, "GX__SetVtxAttrFmtv_caseD_13_8016df60") PPC_NATIVE_OVERRIDE_VOID(8016df60, gx_stub_8016df60, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016df78, "GX__SetVtxAttrFmtv_caseD_14_8016df78") PPC_NATIVE_OVERRIDE_VOID(8016df78, gx_stub_8016df78, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016df8c, "GX__SetVtxAttrFmtv_caseD_15_8016df8c") PPC_NATIVE_OVERRIDE_VOID(8016df8c, gx_stub_8016df8c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016dfcc, "__GX__SetVAT_8016dfcc") PPC_NATIVE_OVERRIDE_VOID(8016dfcc, gx_stub_8016dfcc, (CpuContext* ctx), (ctx));
+// moved to gx_vertex.cpp: GX__GetVtxAttrFmt_8016e04c
+GX_FATAL_STUB(8016e078, "GX__GetVtxAttrFmt_switch_8016e078") PPC_NATIVE_OVERRIDE_VOID(8016e078, gx_stub_8016e078, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e07c, "GX__GetVtxAttrFmt_caseD_9_8016e07c") PPC_NATIVE_OVERRIDE_VOID(8016e07c, gx_stub_8016e07c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e0a4, "GX__GetVtxAttrFmt_caseD_19_8016e0a4") PPC_NATIVE_OVERRIDE_VOID(8016e0a4, gx_stub_8016e0a4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e118, "GX__GetVtxAttrFmt_caseD_b_8016e118") PPC_NATIVE_OVERRIDE_VOID(8016e118, gx_stub_8016e118, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e13c, "GX__GetVtxAttrFmt_caseD_c_8016e13c") PPC_NATIVE_OVERRIDE_VOID(8016e13c, gx_stub_8016e13c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e160, "GX__GetVtxAttrFmt_caseD_d_8016e160") PPC_NATIVE_OVERRIDE_VOID(8016e160, gx_stub_8016e160, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e188, "GX__GetVtxAttrFmt_caseD_e_8016e188") PPC_NATIVE_OVERRIDE_VOID(8016e188, gx_stub_8016e188, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e1b0, "GX__GetVtxAttrFmt_caseD_f_8016e1b0") PPC_NATIVE_OVERRIDE_VOID(8016e1b0, gx_stub_8016e1b0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e1d8, "GX__GetVtxAttrFmt_caseD_10_8016e1d8") PPC_NATIVE_OVERRIDE_VOID(8016e1d8, gx_stub_8016e1d8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e200, "GX__GetVtxAttrFmt_caseD_11_8016e200") PPC_NATIVE_OVERRIDE_VOID(8016e200, gx_stub_8016e200, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e228, "GX__GetVtxAttrFmt_caseD_12_8016e228") PPC_NATIVE_OVERRIDE_VOID(8016e228, gx_stub_8016e228, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e250, "GX__GetVtxAttrFmt_caseD_13_8016e250") PPC_NATIVE_OVERRIDE_VOID(8016e250, gx_stub_8016e250, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e278, "GX__GetVtxAttrFmt_caseD_14_8016e278") PPC_NATIVE_OVERRIDE_VOID(8016e278, gx_stub_8016e278, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e2a0, "GX__GetVtxAttrFmt_caseD_15_8016e2a0") PPC_NATIVE_OVERRIDE_VOID(8016e2a0, gx_stub_8016e2a0, (CpuContext* ctx), (ctx));
+// moved to gx_vertex.cpp: GX__GetVtxAttrFmtv_8016e2b8
+GX_FATAL_STUB(8016e3a4, "GX__SetTexCoordGen2_switch_8016e3a4") PPC_NATIVE_OVERRIDE_VOID(8016e3a4, gx_stub_8016e3a4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e3a8, "GX__SetTexCoordGen2_caseD_0_8016e3a8") PPC_NATIVE_OVERRIDE_VOID(8016e3a8, gx_stub_8016e3a8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e3b4, "GX__SetTexCoordGen2_caseD_1_8016e3b4") PPC_NATIVE_OVERRIDE_VOID(8016e3b4, gx_stub_8016e3b4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e3c0, "GX__SetTexCoordGen2_caseD_2_8016e3c0") PPC_NATIVE_OVERRIDE_VOID(8016e3c0, gx_stub_8016e3c0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e3cc, "GX__SetTexCoordGen2_caseD_3_8016e3cc") PPC_NATIVE_OVERRIDE_VOID(8016e3cc, gx_stub_8016e3cc, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e3d8, "GX__SetTexCoordGen2_caseD_13_8016e3d8") PPC_NATIVE_OVERRIDE_VOID(8016e3d8, gx_stub_8016e3d8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e3e0, "GX__SetTexCoordGen2_caseD_14_8016e3e0") PPC_NATIVE_OVERRIDE_VOID(8016e3e0, gx_stub_8016e3e0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e3e8, "GX__SetTexCoordGen2_caseD_4_8016e3e8") PPC_NATIVE_OVERRIDE_VOID(8016e3e8, gx_stub_8016e3e8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e3f0, "GX__SetTexCoordGen2_caseD_5_8016e3f0") PPC_NATIVE_OVERRIDE_VOID(8016e3f0, gx_stub_8016e3f0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e3f8, "GX__SetTexCoordGen2_caseD_6_8016e3f8") PPC_NATIVE_OVERRIDE_VOID(8016e3f8, gx_stub_8016e3f8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e400, "GX__SetTexCoordGen2_caseD_7_8016e400") PPC_NATIVE_OVERRIDE_VOID(8016e400, gx_stub_8016e400, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e408, "GX__SetTexCoordGen2_caseD_8_8016e408") PPC_NATIVE_OVERRIDE_VOID(8016e408, gx_stub_8016e408, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e410, "GX__SetTexCoordGen2_caseD_9_8016e410") PPC_NATIVE_OVERRIDE_VOID(8016e410, gx_stub_8016e410, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e418, "GX__SetTexCoordGen2_caseD_a_8016e418") PPC_NATIVE_OVERRIDE_VOID(8016e418, gx_stub_8016e418, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e420, "GX__SetTexCoordGen2_caseD_b_8016e420") PPC_NATIVE_OVERRIDE_VOID(8016e420, gx_stub_8016e420, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e424, "GX__SetTexCoordGen2_caseD_10_8016e424") PPC_NATIVE_OVERRIDE_VOID(8016e424, gx_stub_8016e424, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e514, "GX__SetTexCoordGen2_switch_8016e514") PPC_NATIVE_OVERRIDE_VOID(8016e514, gx_stub_8016e514, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e518, "GX__SetTexCoordGen2_caseD_0_8016e518") PPC_NATIVE_OVERRIDE_VOID(8016e518, gx_stub_8016e518, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e528, "GX__SetTexCoordGen2_caseD_1_8016e528") PPC_NATIVE_OVERRIDE_VOID(8016e528, gx_stub_8016e528, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e538, "GX__SetTexCoordGen2_caseD_2_8016e538") PPC_NATIVE_OVERRIDE_VOID(8016e538, gx_stub_8016e538, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e548, "GX__SetTexCoordGen2_caseD_3_8016e548") PPC_NATIVE_OVERRIDE_VOID(8016e548, gx_stub_8016e548, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e558, "GX__SetTexCoordGen2_caseD_4_8016e558") PPC_NATIVE_OVERRIDE_VOID(8016e558, gx_stub_8016e558, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e568, "GX__SetTexCoordGen2_caseD_5_8016e568") PPC_NATIVE_OVERRIDE_VOID(8016e568, gx_stub_8016e568, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e578, "GX__SetTexCoordGen2_caseD_6_8016e578") PPC_NATIVE_OVERRIDE_VOID(8016e578, gx_stub_8016e578, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e588, "GX__SetTexCoordGen2_caseD_7_8016e588") PPC_NATIVE_OVERRIDE_VOID(8016e588, gx_stub_8016e588, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e6e4, "__GX__Abort_8016e6e4") PPC_NATIVE_OVERRIDE_VOID(8016e6e4, gx_stub_8016e6e4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016e848, "GX__AbortFrame_8016e848") PPC_NATIVE_OVERRIDE_VOID(8016e848, gx_stub_8016e848, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016eb94, "GX__PokeAlphaMode_8016eb94") PPC_NATIVE_OVERRIDE_VOID(8016eb94, gx_stub_8016eb94, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016eba4, "GX__PokeAlphaUpdate_8016eba4") PPC_NATIVE_OVERRIDE_VOID(8016eba4, gx_stub_8016eba4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016ebbc, "GX__PokeAlphaUpdate_8016ebbc") PPC_NATIVE_OVERRIDE_VOID(8016ebbc, gx_stub_8016ebbc, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016ebd0, "GX__PokeBlendMode_8016ebd0") PPC_NATIVE_OVERRIDE_VOID(8016ebd0, gx_stub_8016ebd0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016ec2c, "GX__PokeColorUpdate_8016ec2c") PPC_NATIVE_OVERRIDE_VOID(8016ec2c, gx_stub_8016ec2c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016ec40, "GX__PokeDstAlpha_8016ec40") PPC_NATIVE_OVERRIDE_VOID(8016ec40, gx_stub_8016ec40, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016ec58, "GX__PokeDither_8016ec58") PPC_NATIVE_OVERRIDE_VOID(8016ec58, gx_stub_8016ec58, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016ec6c, "GX__PokeZMode_8016ec6c") PPC_NATIVE_OVERRIDE_VOID(8016ec6c, gx_stub_8016ec6c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016f23c, "__GX__SendFlushPrim_8016f23c") PPC_NATIVE_OVERRIDE_VOID(8016f23c, gx_stub_8016f23c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8016f414, "__GX__SetGenMode_8016f414") PPC_NATIVE_OVERRIDE_VOID(8016f414, gx_stub_8016f414, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801724f8, "GX__InitFogAdjTable_801724f8") PPC_NATIVE_OVERRIDE_VOID(801724f8, gx_stub_801724f8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80172fd8, "__GX__SetProjection_80172fd8") PPC_NATIVE_OVERRIDE_VOID(80172fd8, gx_stub_80172fd8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801732e8, "__GX__SetViewport_801732e8") PPC_NATIVE_OVERRIDE_VOID(801732e8, gx_stub_801732e8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173544, "__GX__SetMatrixIndex_80173544") PPC_NATIVE_OVERRIDE_VOID(80173544, gx_stub_80173544, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801735cc, "GX__SetGPMetric_801735cc") PPC_NATIVE_OVERRIDE_VOID(801735cc, gx_stub_801735cc, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801736f4, "GX__SetGPMetric_switch_801736f4") PPC_NATIVE_OVERRIDE_VOID(801736f4, gx_stub_801736f4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801736f8, "GX__SetGPMetric_caseD_0_801736f8") PPC_NATIVE_OVERRIDE_VOID(801736f8, gx_stub_801736f8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173718, "GX__SetGPMetric_caseD_1_80173718") PPC_NATIVE_OVERRIDE_VOID(80173718, gx_stub_80173718, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173738, "GX__SetGPMetric_caseD_2_80173738") PPC_NATIVE_OVERRIDE_VOID(80173738, gx_stub_80173738, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173758, "GX__SetGPMetric_caseD_3_80173758") PPC_NATIVE_OVERRIDE_VOID(80173758, gx_stub_80173758, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173778, "GX__SetGPMetric_caseD_4_80173778") PPC_NATIVE_OVERRIDE_VOID(80173778, gx_stub_80173778, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173798, "GX__SetGPMetric_caseD_5_80173798") PPC_NATIVE_OVERRIDE_VOID(80173798, gx_stub_80173798, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801737b8, "GX__SetGPMetric_caseD_6_801737b8") PPC_NATIVE_OVERRIDE_VOID(801737b8, gx_stub_801737b8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801737d8, "GX__SetGPMetric_caseD_7_801737d8") PPC_NATIVE_OVERRIDE_VOID(801737d8, gx_stub_801737d8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801737f8, "GX__SetGPMetric_caseD_8_801737f8") PPC_NATIVE_OVERRIDE_VOID(801737f8, gx_stub_801737f8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173818, "GX__SetGPMetric_caseD_9_80173818") PPC_NATIVE_OVERRIDE_VOID(80173818, gx_stub_80173818, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173838, "GX__SetGPMetric_caseD_22_80173838") PPC_NATIVE_OVERRIDE_VOID(80173838, gx_stub_80173838, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173858, "GX__SetGPMetric_caseD_a_80173858") PPC_NATIVE_OVERRIDE_VOID(80173858, gx_stub_80173858, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173878, "GX__SetGPMetric_caseD_b_80173878") PPC_NATIVE_OVERRIDE_VOID(80173878, gx_stub_80173878, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173894, "GX__SetGPMetric_caseD_c_80173894") PPC_NATIVE_OVERRIDE_VOID(80173894, gx_stub_80173894, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801738b0, "GX__SetGPMetric_caseD_d_801738b0") PPC_NATIVE_OVERRIDE_VOID(801738b0, gx_stub_801738b0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801738cc, "GX__SetGPMetric_caseD_e_801738cc") PPC_NATIVE_OVERRIDE_VOID(801738cc, gx_stub_801738cc, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801738e8, "GX__SetGPMetric_caseD_f_801738e8") PPC_NATIVE_OVERRIDE_VOID(801738e8, gx_stub_801738e8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173904, "GX__SetGPMetric_caseD_10_80173904") PPC_NATIVE_OVERRIDE_VOID(80173904, gx_stub_80173904, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173920, "GX__SetGPMetric_caseD_11_80173920") PPC_NATIVE_OVERRIDE_VOID(80173920, gx_stub_80173920, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(8017393c, "GX__SetGPMetric_caseD_12_8017393c") PPC_NATIVE_OVERRIDE_VOID(8017393c, gx_stub_8017393c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173958, "GX__SetGPMetric_caseD_13_80173958") PPC_NATIVE_OVERRIDE_VOID(80173958, gx_stub_80173958, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173974, "GX__SetGPMetric_caseD_14_80173974") PPC_NATIVE_OVERRIDE_VOID(80173974, gx_stub_80173974, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173990, "GX__SetGPMetric_caseD_15_80173990") PPC_NATIVE_OVERRIDE_VOID(80173990, gx_stub_80173990, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801739ac, "GX__SetGPMetric_caseD_16_801739ac") PPC_NATIVE_OVERRIDE_VOID(801739ac, gx_stub_801739ac, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801739c8, "GX__SetGPMetric_caseD_17_801739c8") PPC_NATIVE_OVERRIDE_VOID(801739c8, gx_stub_801739c8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(801739e4, "GX__SetGPMetric_caseD_18_801739e4") PPC_NATIVE_OVERRIDE_VOID(801739e4, gx_stub_801739e4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173a00, "GX__SetGPMetric_caseD_19_80173a00") PPC_NATIVE_OVERRIDE_VOID(80173a00, gx_stub_80173a00, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173a1c, "GX__SetGPMetric_caseD_1a_80173a1c") PPC_NATIVE_OVERRIDE_VOID(80173a1c, gx_stub_80173a1c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173a38, "GX__SetGPMetric_caseD_1b_80173a38") PPC_NATIVE_OVERRIDE_VOID(80173a38, gx_stub_80173a38, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173a54, "GX__SetGPMetric_caseD_1c_80173a54") PPC_NATIVE_OVERRIDE_VOID(80173a54, gx_stub_80173a54, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173a70, "GX__SetGPMetric_caseD_1d_80173a70") PPC_NATIVE_OVERRIDE_VOID(80173a70, gx_stub_80173a70, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173a8c, "GX__SetGPMetric_caseD_1e_80173a8c") PPC_NATIVE_OVERRIDE_VOID(80173a8c, gx_stub_80173a8c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173aa8, "GX__SetGPMetric_caseD_1f_80173aa8") PPC_NATIVE_OVERRIDE_VOID(80173aa8, gx_stub_80173aa8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173ac4, "GX__SetGPMetric_caseD_20_80173ac4") PPC_NATIVE_OVERRIDE_VOID(80173ac4, gx_stub_80173ac4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173ae0, "GX__SetGPMetric_caseD_21_80173ae0") PPC_NATIVE_OVERRIDE_VOID(80173ae0, gx_stub_80173ae0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173af8, "GX__SetGPMetric_caseD_23_80173af8") PPC_NATIVE_OVERRIDE_VOID(80173af8, gx_stub_80173af8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173b18, "GX__SetGPMetric_switch_80173b18") PPC_NATIVE_OVERRIDE_VOID(80173b18, gx_stub_80173b18, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173b1c, "GX__SetGPMetric_caseD_0_80173b1c") PPC_NATIVE_OVERRIDE_VOID(80173b1c, gx_stub_80173b1c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173b38, "GX__SetGPMetric_caseD_1_80173b38") PPC_NATIVE_OVERRIDE_VOID(80173b38, gx_stub_80173b38, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173b54, "GX__SetGPMetric_caseD_2_80173b54") PPC_NATIVE_OVERRIDE_VOID(80173b54, gx_stub_80173b54, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173b70, "GX__SetGPMetric_caseD_3_80173b70") PPC_NATIVE_OVERRIDE_VOID(80173b70, gx_stub_80173b70, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173b8c, "GX__SetGPMetric_caseD_8_80173b8c") PPC_NATIVE_OVERRIDE_VOID(80173b8c, gx_stub_80173b8c, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173ba8, "GX__SetGPMetric_caseD_15_80173ba8") PPC_NATIVE_OVERRIDE_VOID(80173ba8, gx_stub_80173ba8, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173bc4, "GX__SetGPMetric_caseD_4_80173bc4") PPC_NATIVE_OVERRIDE_VOID(80173bc4, gx_stub_80173bc4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173be0, "GX__SetGPMetric_caseD_5_80173be0") PPC_NATIVE_OVERRIDE_VOID(80173be0, gx_stub_80173be0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173bfc, "GX__SetGPMetric_caseD_6_80173bfc") PPC_NATIVE_OVERRIDE_VOID(80173bfc, gx_stub_80173bfc, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173c18, "GX__SetGPMetric_caseD_7_80173c18") PPC_NATIVE_OVERRIDE_VOID(80173c18, gx_stub_80173c18, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173c34, "GX__SetGPMetric_caseD_9_80173c34") PPC_NATIVE_OVERRIDE_VOID(80173c34, gx_stub_80173c34, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173c64, "GX__SetGPMetric_caseD_a_80173c64") PPC_NATIVE_OVERRIDE_VOID(80173c64, gx_stub_80173c64, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173c94, "GX__SetGPMetric_caseD_b_80173c94") PPC_NATIVE_OVERRIDE_VOID(80173c94, gx_stub_80173c94, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173cc4, "GX__SetGPMetric_caseD_c_80173cc4") PPC_NATIVE_OVERRIDE_VOID(80173cc4, gx_stub_80173cc4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173cf4, "GX__SetGPMetric_caseD_d_80173cf4") PPC_NATIVE_OVERRIDE_VOID(80173cf4, gx_stub_80173cf4, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173d24, "GX__SetGPMetric_caseD_e_80173d24") PPC_NATIVE_OVERRIDE_VOID(80173d24, gx_stub_80173d24, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173d54, "GX__SetGPMetric_caseD_f_80173d54") PPC_NATIVE_OVERRIDE_VOID(80173d54, gx_stub_80173d54, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173d84, "GX__SetGPMetric_caseD_10_80173d84") PPC_NATIVE_OVERRIDE_VOID(80173d84, gx_stub_80173d84, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173db0, "GX__SetGPMetric_caseD_11_80173db0") PPC_NATIVE_OVERRIDE_VOID(80173db0, gx_stub_80173db0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173dc0, "GX__SetGPMetric_caseD_12_80173dc0") PPC_NATIVE_OVERRIDE_VOID(80173dc0, gx_stub_80173dc0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173dd0, "GX__SetGPMetric_caseD_13_80173dd0") PPC_NATIVE_OVERRIDE_VOID(80173dd0, gx_stub_80173dd0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173de0, "GX__SetGPMetric_caseD_14_80173de0") PPC_NATIVE_OVERRIDE_VOID(80173de0, gx_stub_80173de0, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173dec, "GX__SetGPMetric_caseD_16_80173dec") PPC_NATIVE_OVERRIDE_VOID(80173dec, gx_stub_80173dec, (CpuContext* ctx), (ctx));
+GX_FATAL_STUB(80173df8, "GX__ClearGPMetric_80173df8") PPC_NATIVE_OVERRIDE_VOID(80173df8, gx_stub_80173df8, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/gx/gx_fifo.cpp b/runtime/src/hle/gx/gx_fifo.cpp
new file mode 100644
index 0000000..a77e96e
--- /dev/null
+++ b/runtime/src/hle/gx/gx_fifo.cpp
@@ -0,0 +1,791 @@
+#include "gx_internal.h"
+#include "gx_stream_common.h"
+#include "gx_cp_decode.h"
+#include "isa/big_endian.h"
+
+// Opcode constants and the stream helpers this file shares with gx_dl.cpp /
+// gx_vertex.cpp; see gx_stream_common.h.
+using namespace GxCmd;
+using namespace GxStream;
+
+HleGxState g_hleGxState;
+
+namespace aurora::gx::fifo {
+bool submit_raw_draw(GXPrimitive prim, GXVtxFmt fmt, const uint8_t* vertices, uint16_t vtxCount,
+                     uint32_t vertexBytes);
+}
+
+void HleGxState::ResetVertex() {
+    currentAttr = NextEnabledAttr(GX_VA_PNMTXIDX - 1);
+    currentComp = 0;
+}
+
+GXAttr HleGxState::NextEnabledAttr(int startAttr) {
+    for (int i = startAttr + 1; i < 26; ++i) {
+        if (vtxDesc[i] != GX_NONE) {
+            return static_cast<GXAttr>(i);
+        }
+    }
+    return GX_VA_NULL;
+}
+
+int HleGxState::GetExpectedCompCount(GXAttr attr, const VtxAttrFmt& fmt) {
+    // Attributes with no component layout (matrix indices, XF arrays, GX_VA_NBT)
+    // count as one component here: the incremental parser advances one element
+    // per raw stream item for them.
+    return static_cast<int>(AttrCompCount(attr, fmt, 1u));
+}
+
+static void ApplyAuroraVtxStateForRawBegin(GXVtxFmt fmt) {
+    // KNOWN DIVERGENCE: this is the only publish site with includeNbt=true, so it also
+    // publishes GX_VA_NBT after GX_VA_NRM, which makes aurora's SETVAT fall-through clobber the
+    // NRM VAT with the default. Raw-FIFO geometry renders correctly with it; do not "fix" without
+    // an in-race A/B run.
+    PublishAuroraVtxState(fmt, AuroraVtxPublishOptions{/*includeNbt=*/true,
+                                                       /*fmtLoopFirst=*/0,
+                                                       /*fmtLoopLast=*/25});
+}
+
+// There is deliberately no indexed-aurora path here. Immediate-mode indexed
+// draws are parsed incrementally, and aurora's indexed-array upload has to
+// precede the draw carrying the max-index bounds, which cannot be known without
+// buffering the whole primitive. Indexed attributes are therefore expanded into
+// the packed direct stream above (GX_INDEX8/16 -> GX_DIRECT).
+
+static uint32_t GetDirectAttrByteSizeForFifo(GXAttr attr, const VtxAttrFmt& fmt) {
+    return DirectAttrByteSize(attr, fmt, /*matrixAttrIsOneByte=*/true, /*fallbackComps=*/1u);
+}
+
+static bool TryGetRawDirectFifoVertexSize(GXVtxFmt fmt, uint32_t& vertexSize) {
+    vertexSize = 0;
+    if (fmt >= GX_MAX_VTXFMT) {
+        return false;
+    }
+
+    for (int attr = 0; attr < 26; ++attr) {
+        const GXAttrType type = g_hleGxState.vtxDesc[attr];
+        if (type == GX_NONE) {
+            continue;
+        }
+        if (type != GX_DIRECT) {
+            return false;
+        }
+
+        const GXAttr gxAttr = static_cast<GXAttr>(attr);
+        const uint32_t attrBytes =
+            GetDirectAttrByteSizeForFifo(gxAttr, g_hleGxState.vtxAttrFmt[fmt][attr]);
+        if (attrBytes == 0) {
+            return false;
+        }
+        vertexSize += attrBytes;
+    }
+
+    return vertexSize != 0;
+}
+
+static bool TrySubmitRawDirectFifoDraw(const uint8_t* packet, uint32_t packetBytes, GXPrimitive prim,
+                                       GXVtxFmt vtxFmt, uint16_t vtxCount) {
+    if (packet == nullptr || packetBytes == 0 || vtxCount == 0) {
+        return false;
+    }
+
+    EnsureAuroraFrameActive();
+
+    g_hleGxState.currentVtxFmt = vtxFmt;
+    g_hleGxState.currentPrim = prim;
+    g_hleGxState.vertsRemaining = vtxCount;
+    g_hleGxState.inBegin = false;
+    g_hleGxState.auroraBeginCalled = false;
+    g_hleGxState.ResetVertex();
+
+    ApplyAuroraVtxStateForRawBegin(vtxFmt);
+    EnsureDefaultGxAlphaCompare();
+
+    if (!aurora::gx::fifo::submit_raw_draw(prim, vtxFmt, packet + 3, vtxCount, packetBytes - 3u)) {
+        return false;
+    }
+    GXMarkFrameWork();
+    return true;
+}
+
+static void DecodeColorFromArray(uint32_t addr, GXCompType type, GXCompCnt cnt, GXColor& out) {
+    // Gather exactly the bytes the shared decoder consumes. GX_RGBX8 is the one
+    // format whose stream footprint (4 bytes) exceeds what is decoded (3), and
+    // the pre-dedup code read only those 3 from the guest array - keep it that
+    // way so a 3-byte tail at the end of an array cannot start faulting.
+    const uint32_t byteCount =
+        (type == GX_RGBX8) ? 3u : ColorByteSize(type, cnt);
+    uint8_t bytes[4] = {0, 0, 0, 0};
+    for (uint32_t i = 0; i < byteCount && i < 4u; ++i) {
+        bytes[i] = Memory::Read8(addr + i);
+    }
+    DecodeColorBytes(bytes, type, cnt, out);
+}
+
+void SubmitIndexedAttribute(GXAttr attr, uint32_t index) {
+    const auto& fmt = g_hleGxState.vtxAttrFmt[g_hleGxState.currentVtxFmt][attr];
+    const auto& arr = g_hleGxState.vtxArray[attr];
+    if (arr.base == 0 || arr.stride == 0) {
+        float comps[9]{};
+        switch (attr) {
+        case GX_VA_CLR0:
+        case GX_VA_CLR1:
+            if (fmt.cnt == GX_CLR_RGB) {
+                GXColor3u8(0, 0, 0);
+            } else {
+                GXColor4u8(0, 0, 0, 0xFF);
+            }
+            break;
+        case GX_VA_POS:
+        case GX_VA_NRM:
+        case GX_VA_TEX0:
+        case GX_VA_TEX1:
+        case GX_VA_TEX2:
+        case GX_VA_TEX3:
+        case GX_VA_TEX4:
+        case GX_VA_TEX5:
+        case GX_VA_TEX6:
+        case GX_VA_TEX7:
+            SubmitAttribute(attr, comps, fmt);
+            break;
+        default:
+            break;
+        }
+        return;
+    }
+    const uint32_t baseAddr = arr.base + index * arr.stride;
+    float comps[9]{};
+    u32 rawComps[9]{};
+    switch (attr) {
+    case GX_VA_POS: {
+        const int count = static_cast<int>(AttrCompCount(GX_VA_POS, fmt, 0u));
+        const int step = GetCompSizeBytes(fmt.type);
+        uint32_t addr = baseAddr;
+        for (int i = 0; i < count; ++i, addr += step) {
+            comps[i] = ReadArrayComp(addr, fmt.type, fmt.frac);
+            rawComps[i] = ReadArrayRawComp(addr, fmt.type);
+        }
+        SubmitAttribute(attr, comps, fmt, rawComps);
+        break;
+    }
+    case GX_VA_NRM: {
+        const int count = static_cast<int>(AttrCompCount(GX_VA_NRM, fmt, 0u));
+        const int step = GetCompSizeBytes(fmt.type);
+        uint32_t addr = baseAddr;
+        for (int i = 0; i < count; ++i, addr += step) {
+            comps[i] = ReadArrayComp(addr, fmt.type, fmt.frac);
+            rawComps[i] = ReadArrayRawComp(addr, fmt.type);
+        }
+        SubmitAttribute(attr, comps, fmt, rawComps);
+        break;
+    }
+    case GX_VA_CLR0:
+    case GX_VA_CLR1: {
+        GXColor color{};
+        DecodeColorFromArray(baseAddr, fmt.type, fmt.cnt, color);
+        if (fmt.cnt == GX_CLR_RGB) {
+            GXColor3u8(color.r, color.g, color.b);
+        } else {
+            GXColor4u8(color.r, color.g, color.b, color.a);
+        }
+        break;
+    }
+    case GX_VA_TEX0: case GX_VA_TEX1: case GX_VA_TEX2: case GX_VA_TEX3:
+    case GX_VA_TEX4: case GX_VA_TEX5: case GX_VA_TEX6: case GX_VA_TEX7: {
+        // Every GX_VA_TEXn shares one component layout, so the constant here is
+        // exact for whichever of them `attr` is.
+        const int count = static_cast<int>(AttrCompCount(GX_VA_TEX0, fmt, 0u));
+        const int step = GetCompSizeBytes(fmt.type);
+        uint32_t addr = baseAddr;
+        for (int i = 0; i < count; ++i, addr += step) {
+            comps[i] = ReadArrayComp(addr, fmt.type, fmt.frac);
+            rawComps[i] = ReadArrayRawComp(addr, fmt.type);
+        }
+        SubmitAttribute(attr, comps, fmt, rawComps);
+        break;
+    }
+    default:
+        break;
+    }
+}
+
+// Mirrors the raw-integer fast paths in SubmitAttribute below: for those
+// (attr, type) pairs the float component buffer is never read, so the direct
+// FIFO path can skip building it.
+static bool SubmitAttributeReadsFloatComps(GXAttr attr, const VtxAttrFmt& fmt) {
+    switch (attr) {
+    case GX_VA_POS:
+    case GX_VA_NRM:
+    case GX_VA_TEX0: case GX_VA_TEX1: case GX_VA_TEX2: case GX_VA_TEX3:
+    case GX_VA_TEX4: case GX_VA_TEX5: case GX_VA_TEX6: case GX_VA_TEX7:
+        break;
+    default:
+        return true;
+    }
+    switch (fmt.type) {
+    case GX_U8:
+    case GX_S8:
+    case GX_U16:
+    case GX_S16:
+        return false;
+    default:
+        return true;
+    }
+}
+
+void SubmitAttribute(GXAttr attr, float* comps, const VtxAttrFmt& fmt, const u32* rawComps) {
+    auto r8 = [rawComps](int idx) { return static_cast<u8>(rawComps[idx]); };
+    auto rs8 = [rawComps](int idx) { return static_cast<s8>(rawComps[idx]); };
+    auto r16 = [rawComps](int idx) { return static_cast<u16>(rawComps[idx]); };
+    auto rs16 = [rawComps](int idx) { return static_cast<s16>(rawComps[idx]); };
+
+    switch (attr) {
+    case GX_VA_POS:
+        if (rawComps) {
+            if (fmt.cnt == GX_POS_XY) {
+                switch (fmt.type) {
+                case GX_U8: GXPosition2u8(r8(0), r8(1)); return;
+                case GX_S8: GXPosition2s8(rs8(0), rs8(1)); return;
+                case GX_U16: GXPosition2u16(r16(0), r16(1)); return;
+                case GX_S16: GXPosition2s16(rs16(0), rs16(1)); return;
+                default: break;
+                }
+            } else {
+                switch (fmt.type) {
+                case GX_U8: GXPosition3u8(r8(0), r8(1), r8(2)); return;
+                case GX_S8: GXPosition3s8(rs8(0), rs8(1), rs8(2)); return;
+                case GX_U16: GXPosition3u16(r16(0), r16(1), r16(2)); return;
+                case GX_S16: GXPosition3s16(rs16(0), rs16(1), rs16(2)); return;
+                default: break;
+                }
+            }
+        }
+        if (fmt.cnt == GX_POS_XY) {
+            GXPosition2f32(comps[0], comps[1]);
+        } else {
+            GXPosition3f32(comps[0], comps[1], comps[2]);
+        }
+        break;
+    case GX_VA_NRM:
+        if (rawComps) {
+            const bool nbt = fmt.cnt == GX_NRM_NBT || fmt.cnt == GX_NRM_NBT3;
+            const int groups = nbt ? 3 : 1;
+            switch (fmt.type) {
+            case GX_U8:
+                for (int i = 0; i < groups; ++i) {
+                    GXNormal3u8(r8(i * 3), r8(i * 3 + 1), r8(i * 3 + 2));
+                }
+                return;
+            case GX_S8:
+                for (int i = 0; i < groups; ++i) {
+                    GXNormal3s8(rs8(i * 3), rs8(i * 3 + 1), rs8(i * 3 + 2));
+                }
+                return;
+            case GX_U16:
+                for (int i = 0; i < groups; ++i) {
+                    GXNormal3u16(r16(i * 3), r16(i * 3 + 1), r16(i * 3 + 2));
+                }
+                return;
+            case GX_S16:
+                for (int i = 0; i < groups; ++i) {
+                    GXNormal3s16(rs16(i * 3), rs16(i * 3 + 1), rs16(i * 3 + 2));
+                }
+                return;
+            default: break;
+            }
+        }
+        if (fmt.cnt == GX_NRM_NBT || fmt.cnt == GX_NRM_NBT3) {
+            for (int i = 0; i < 3; ++i) {
+                GXNormal3f32(comps[i * 3], comps[i * 3 + 1], comps[i * 3 + 2]);
+            }
+        } else {
+            GXNormal3f32(comps[0], comps[1], comps[2]);
+        }
+        break;
+    case GX_VA_CLR0:
+    case GX_VA_CLR1:
+        if (fmt.cnt == GX_CLR_RGB) {
+            GXColor3u8(static_cast<u8>(comps[0]), static_cast<u8>(comps[1]),
+                       static_cast<u8>(comps[2]));
+        } else {
+            GXColor4u8(static_cast<u8>(comps[0]), static_cast<u8>(comps[1]),
+                       static_cast<u8>(comps[2]), static_cast<u8>(comps[3]));
+        }
+        break;
+    case GX_VA_TEX0: case GX_VA_TEX1: case GX_VA_TEX2: case GX_VA_TEX3:
+    case GX_VA_TEX4: case GX_VA_TEX5: case GX_VA_TEX6: case GX_VA_TEX7:
+        if (rawComps) {
+            if (fmt.cnt == GX_TEX_S) {
+                switch (fmt.type) {
+                case GX_U8: GXTexCoord1u8(r8(0)); return;
+                case GX_S8: GXTexCoord1s8(rs8(0)); return;
+                case GX_U16: GXTexCoord1u16(r16(0)); return;
+                case GX_S16: GXTexCoord1s16(rs16(0)); return;
+                default: break;
+                }
+            } else {
+                switch (fmt.type) {
+                case GX_U8: GXTexCoord2u8(r8(0), r8(1)); return;
+                case GX_S8: GXTexCoord2s8(rs8(0), rs8(1)); return;
+                case GX_U16: GXTexCoord2u16(r16(0), r16(1)); return;
+                case GX_S16: GXTexCoord2s16(rs16(0), rs16(1)); return;
+                default: break;
+                }
+            }
+        }
+        if (fmt.cnt == GX_TEX_S) {
+            GXTexCoord1f32(comps[0]);
+        } else {
+            GXTexCoord2f32(comps[0], comps[1]);
+        }
+        break;
+    default: break;
+    }
+}
+
+// `val` is a raw big-endian bit pattern: the FIFO stream is type-agnostic, and
+// the float entry point converts before it gets here.
+void HleFifoWrite(u32 val, uint32_t sizeBytes) {
+    const bool recordOnly = IsDisplayListActive();
+    if (recordOnly) {
+        WriteDisplayListData(val, sizeBytes);
+        return;
+    }
+
+    auto resetFifoBuffer = [&]() {
+        g_hleGxState.fifoReadOffset = 0;
+        g_hleGxState.fifoByteCount = 0;
+    };
+
+    auto compactFifoBuffer = [&]() {
+        if (g_hleGxState.fifoByteCount == 0) {
+            g_hleGxState.fifoReadOffset = 0;
+            return;
+        }
+        if (g_hleGxState.fifoReadOffset == 0) {
+            return;
+        }
+        std::memmove(g_hleGxState.fifoBytes.data(),
+                     g_hleGxState.fifoBytes.data() + g_hleGxState.fifoReadOffset,
+                     g_hleGxState.fifoByteCount);
+        g_hleGxState.fifoReadOffset = 0;
+    };
+
+    auto fifoData = [&]() -> uint8_t* {
+        return g_hleGxState.fifoBytes.data() + g_hleGxState.fifoReadOffset;
+    };
+
+    auto pushBytes = [&](u32 value, uint32_t count) {
+        if (count == 0) return;
+        if (count > 4) count = 4;
+        if (g_hleGxState.fifoReadOffset + g_hleGxState.fifoByteCount + count > g_hleGxState.fifoBytes.size()) {
+            compactFifoBuffer();
+            if (g_hleGxState.fifoReadOffset + g_hleGxState.fifoByteCount + count > g_hleGxState.fifoBytes.size()) {
+                resetFifoBuffer();
+            }
+        }
+        const size_t writeOffset = g_hleGxState.fifoReadOffset + g_hleGxState.fifoByteCount;
+        switch (count) {
+        case 4:
+            BigEndian::Write32(g_hleGxState.fifoBytes.data() + writeOffset, value);
+            break;
+        case 2:
+            BigEndian::Write16(g_hleGxState.fifoBytes.data() + writeOffset,
+                               static_cast<uint16_t>(value));
+            break;
+        default:
+            g_hleGxState.fifoBytes[writeOffset] = static_cast<uint8_t>(value & 0xFF);
+            break;
+        }
+        g_hleGxState.fifoByteCount += count;
+    };
+
+    auto consumeBytes = [&](uint32_t count, u32& out) -> bool {
+        if (count == 0 || g_hleGxState.fifoByteCount < count) return false;
+        u32 value = 0;
+        const uint32_t foldCount = (count > 4) ? 4 : count;
+        uint8_t* data = fifoData();
+        for (uint32_t i = 0; i < foldCount; ++i) {
+            value = (value << 8) | data[i];
+        }
+        g_hleGxState.fifoReadOffset += count;
+        g_hleGxState.fifoByteCount -= count;
+        if (g_hleGxState.fifoByteCount == 0) {
+            g_hleGxState.fifoReadOffset = 0;
+        }
+        out = value;
+        return true;
+    };
+
+    pushBytes(val, sizeBytes == 0 ? 4 : sizeBytes);
+
+    // Parse raw FIFO command packets written directly to the gather pipe
+    // (e.g. NW4R/G3D paths that do not call the GXBegin wrapper function).
+    while (!g_hleGxState.inBegin) {
+        if (g_hleGxState.fifoByteCount < 1) {
+            break;
+        }
+
+        uint8_t* data = fifoData();
+        const uint8_t cmd = data[0];
+        const uint8_t opcode = cmd & GX_OPCODE_MASK_CMD;
+        u32 sink = 0;
+
+        if (cmd == GX_NOP_CMD || opcode == GX_CMD_INVL_VC_CMD) {
+            if (!consumeBytes(1, sink)) break;
+            continue;
+        }
+
+        if (cmd == GX_LOAD_BP_REG_CMD) {
+            if (g_hleGxState.fifoByteCount < 5) break;
+            const uint32_t bpWord = ReadBE32(data + 1);
+            GXApplyBPReg(static_cast<uint8_t>(bpWord >> 24), bpWord & 0x00FFFFFFu);
+            if (!consumeBytes(5, sink)) break;
+            continue;
+        }
+
+        if (opcode == GX_LOAD_CP_REG_CMD) {
+            if (g_hleGxState.fifoByteCount < 6) break;
+            const uint8_t reg = data[1];
+            const uint32_t cpValue = ReadBE32(data + 2);
+            GxCpDecode::ApplyCpRegWrite(reg, cpValue);
+            if (!consumeBytes(6, sink)) break;
+            continue;
+        }
+
+        if (opcode == GX_LOAD_XF_REG_CMD) {
+            if (g_hleGxState.fifoByteCount < 5) break;
+            const uint16_t countWords = ReadBE16(data + 1);
+            const uint32_t packetBytes = 1u + 4u + (static_cast<uint32_t>(countWords) + 1u) * 4u;
+            if (g_hleGxState.fifoByteCount < packetBytes) break;
+            GXCallDisplayList(data, packetBytes);
+            GXMarkFrameWork();
+            if (!consumeBytes(packetBytes, sink)) break;
+            continue;
+        }
+
+        if (opcode >= GX_LOAD_INDX_A_CMD && opcode <= GX_LOAD_INDX_D_CMD) {
+            if (g_hleGxState.fifoByteCount < 5) break;
+            const uint32_t xfValue = ReadBE32(data + 1);
+            ApplyIndexedXfArrayForPacket(cmd, xfValue);
+            GXCallDisplayList(data, 5);
+            GXMarkFrameWork();
+            if (!consumeBytes(5, sink)) break;
+            continue;
+        }
+
+        if (opcode == GX_CMD_CALL_DL_CMD) {
+            if (g_hleGxState.fifoByteCount < 9) break;
+            const uint32_t listAddr = ReadBE32(data + 1);
+            const uint32_t listSize = ReadBE32(data + 5);
+            if (!consumeBytes(9, sink)) break;
+            if (listAddr != 0 && listSize > 0) {
+                GX__CallDisplayList_80172f64(listAddr, listSize);
+            }
+            continue;
+        }
+
+        if (IsDrawOpcode(opcode)) {
+            if (g_hleGxState.fifoByteCount < 3) break;
+            const uint16_t vtxCount = ReadBE16(data + 1);
+            const GXVtxFmt vtxFmt = static_cast<GXVtxFmt>(cmd & GX_VAT_MASK_CMD);
+            const GXPrimitive prim = OpcodeToGXPrimitive(cmd);
+            uint32_t rawVertexSize = 0;
+            if (TryGetRawDirectFifoVertexSize(vtxFmt, rawVertexSize)) {
+                const uint32_t packetBytes = 3u + static_cast<uint32_t>(vtxCount) * rawVertexSize;
+                if (g_hleGxState.fifoByteCount < packetBytes) {
+                    break;
+                }
+                if (TrySubmitRawDirectFifoDraw(data, packetBytes, prim, vtxFmt, vtxCount)) {
+                    if (!consumeBytes(packetBytes, sink)) break;
+                    continue;
+                }
+            }
+            if (!consumeBytes(3, sink)) break;
+
+            g_hleGxState.currentVtxFmt = vtxFmt;
+            g_hleGxState.currentPrim = prim;
+            g_hleGxState.vertsRemaining = vtxCount;
+            g_hleGxState.inBegin = true;
+            g_hleGxState.auroraBeginCalled = false;
+            g_hleGxState.ResetVertex();
+
+            break;
+        }
+
+        // Unknown FIFO command byte outside a begin packet; discard it so stream parsing can recover.
+        if (!consumeBytes(1, sink)) break;
+    }
+
+    if (!g_hleGxState.inBegin) {
+        return;
+    }
+
+    if (!recordOnly && !g_hleGxState.auroraBeginCalled) {
+        EnsureAuroraFrameActive();
+        ApplyAuroraVtxStateForRawBegin(g_hleGxState.currentVtxFmt);
+        EnsureDefaultGxAlphaCompare();
+        GXBegin(g_hleGxState.currentPrim, g_hleGxState.currentVtxFmt, static_cast<u16>(g_hleGxState.vertsRemaining));
+        g_hleGxState.auroraBeginCalled = true;
+        GXMarkFrameWork();
+    }
+
+    auto finishVertexIfNeeded = [&](GXAttr prevAttr) {
+        g_hleGxState.currentAttr = g_hleGxState.NextEnabledAttr(prevAttr);
+        g_hleGxState.currentComp = 0;
+        if (g_hleGxState.currentAttr == GX_VA_NULL) {
+            g_hleGxState.ResetVertex();
+            if (g_hleGxState.vertsRemaining > 0) {
+                g_hleGxState.vertsRemaining--;
+                if (g_hleGxState.vertsRemaining == 0) {
+                    g_hleGxState.inBegin = false;
+                    g_hleGxState.auroraBeginCalled = false;
+                    if (!recordOnly) {
+                        GXEnd();
+                    }
+                }
+            }
+        }
+    };
+
+    while (true) {
+        if (!g_hleGxState.inBegin) {
+            break;
+        }
+        GXAttr attr = g_hleGxState.currentAttr;
+        if (attr == GX_VA_NULL) {
+            resetFifoBuffer();
+            return;
+        }
+
+        GXAttrType inputType = g_hleGxState.vtxDesc[attr];
+        const VtxAttrFmt& fmt = g_hleGxState.vtxAttrFmt[g_hleGxState.currentVtxFmt][attr];
+
+        if (IsMatrixIndexAttr(attr)) {
+            if (g_hleGxState.fifoByteCount < 1) break;
+            u32 raw = 0;
+            if (!consumeBytes(1, raw)) break;
+            if (!recordOnly) {
+                GXMatrixIndex1u8(attr, static_cast<u8>(raw));
+            }
+            finishVertexIfNeeded(attr);
+            continue;
+        }
+
+        if (inputType == GX_DIRECT) {
+            if (attr == GX_VA_CLR0 || attr == GX_VA_CLR1) {
+                const uint32_t colorSize = ColorByteSize(fmt.type, fmt.cnt);
+
+                if (g_hleGxState.fifoByteCount < colorSize) break;
+
+                uint8_t colorBytes[4] = {0, 0, 0, 0};
+                uint8_t* data = fifoData();
+                for (uint32_t i = 0; i < colorSize && i < 4; ++i) {
+                    colorBytes[i] = data[i];
+                }
+                g_hleGxState.fifoReadOffset += colorSize;
+                g_hleGxState.fifoByteCount -= colorSize;
+                if (g_hleGxState.fifoByteCount == 0) {
+                    g_hleGxState.fifoReadOffset = 0;
+                }
+
+                GXColor color{};
+                DecodeColorBytes(colorBytes, fmt.type, fmt.cnt, color);
+
+                if (!recordOnly) {
+                    if (fmt.cnt == GX_CLR_RGB) {
+                        GXColor3u8(color.r, color.g, color.b);
+                    } else {
+                        GXColor4u8(color.r, color.g, color.b, color.a);
+                    }
+                }
+                finishVertexIfNeeded(attr);
+                continue;
+            }
+            
+            const int compSize = GetCompSizeBytes(fmt.type);
+            if (compSize <= 0 || g_hleGxState.fifoByteCount < static_cast<size_t>(compSize)) break;
+            u32 raw = 0;
+            if (!consumeBytes(static_cast<uint32_t>(compSize), raw)) break;
+            constexpr int kMaxComps = 9;
+            if (g_hleGxState.currentComp < kMaxComps) {
+                if (SubmitAttributeReadsFloatComps(attr, fmt)) {
+                    g_hleGxState.compBuffer[g_hleGxState.currentComp] =
+                        ConvertCompToFloat(raw, fmt.type, fmt.frac);
+                }
+                g_hleGxState.rawCompBuffer[g_hleGxState.currentComp] = raw;
+            }
+            g_hleGxState.currentComp++;
+            const int expected = g_hleGxState.GetExpectedCompCount(attr, fmt);
+            if (g_hleGxState.currentComp >= expected) {
+                if (!recordOnly) {
+                    SubmitAttribute(attr, g_hleGxState.compBuffer, fmt, g_hleGxState.rawCompBuffer);
+                }
+                finishVertexIfNeeded(attr);
+            }
+            continue;
+        }
+
+        if (inputType == GX_INDEX8 || inputType == GX_INDEX16) {
+            const uint32_t idxSize = (inputType == GX_INDEX8) ? 1u : 2u;
+            const uint32_t indexCount = (attr == GX_VA_NRM) ? NormalIndexCount(fmt) : 1u;
+            if (g_hleGxState.fifoByteCount < idxSize * indexCount) break;
+            u32 raw[3]{};
+            for (uint32_t i = 0; i < indexCount; ++i) {
+                if (!consumeBytes(idxSize, raw[i])) break;
+            }
+            if (!recordOnly) {
+                if (attr == GX_VA_NRM && indexCount == 3u) {
+                    SubmitIndexedNormalNBT3(raw, fmt);
+                } else {
+                    SubmitIndexedAttribute(attr, raw[0]);
+                }
+            }
+            finishVertexIfNeeded(attr);
+            continue;
+        }
+
+        g_hleGxState.currentAttr = g_hleGxState.NextEnabledAttr(attr);
+        g_hleGxState.currentComp = 0;
+        if (g_hleGxState.currentAttr == GX_VA_NULL) {
+            g_hleGxState.ResetVertex();
+        }
+        break;
+    }
+}
+
+// Must behave exactly like GX_HLE_FIFO_Write32/16/8 run byte by byte. The ring is not
+// bulk-appended ahead of a single parse because the parser can re-enter GX HLE (nested display
+// lists, XF/draw calls), which would misorder that work relative to the stream.
+static void HleFifoWriteBurstChunked(const uint8_t* data, uint32_t sizeBytes) {
+    uint32_t offset = 0;
+    for (; offset + 4u <= sizeBytes; offset += 4u) {
+        HleFifoWrite(ReadBE32(data + offset), 4);
+    }
+    if (offset + 2u <= sizeBytes) {
+        HleFifoWrite(static_cast<u32>(ReadBE16(data + offset)), 2);
+        offset += 2u;
+    }
+    if (offset < sizeBytes) {
+        HleFifoWrite(static_cast<u32>(data[offset]), 1);
+    }
+}
+
+// Applies complete register-load packets straight to the parser's own entry points, skipping the
+// serialize/ring/re-parse round trip; returns bytes consumed, caller hands the rest to
+// HleFifoWriteBurstChunked. Safe (per gd_fifo_hle.cpp's GdCanApplyDirect) only on a packet
+// boundary with nothing buffered, outside a GXBegin packet and outside display-list recording;
+// any other opcode or a truncated packet just stops the walk.
+static uint32_t ApplyFifoPacketsDirect(const uint8_t* data, uint32_t sizeBytes) {
+    uint32_t offset = 0;
+
+    while (offset < sizeBytes) {
+        // Re-tested per packet, not once per burst: nothing currently re-enters GX HLE mid-walk,
+        // but if it ever does, breaking here just hands the remainder to the ring.
+        if (IsDisplayListActive() || g_hleGxState.inBegin || g_hleGxState.fifoByteCount != 0) {
+            break;
+        }
+
+        const uint8_t* packet = data + offset;
+        const uint32_t avail = sizeBytes - offset;
+        const uint8_t cmd = packet[0];
+        const uint8_t opcode = cmd & GX_OPCODE_MASK_CMD;
+
+        if (cmd == GX_NOP_CMD) {
+            offset += 1u;
+            continue;
+        }
+
+        if (cmd == GX_LOAD_BP_REG_CMD) {
+            if (avail < 5u) break;
+            const uint32_t bpWord = ReadBE32(packet + 1);
+            GXApplyBPReg(static_cast<uint8_t>(bpWord >> 24), bpWord & 0x00FFFFFFu);
+            offset += 5u;
+            continue;
+        }
+
+        if (opcode == GX_LOAD_CP_REG_CMD) {
+            if (avail < 6u) break;
+            const uint8_t reg = packet[1];
+            const uint32_t cpValue = ReadBE32(packet + 2);
+            // Same function the parser calls, so the CP registers it does not
+            // decode (0x30/0x40 among them) are dropped here identically.
+            GxCpDecode::ApplyCpRegWrite(reg, cpValue);
+            offset += 6u;
+            continue;
+        }
+
+        if (opcode == GX_LOAD_XF_REG_CMD) {
+            if (avail < 5u) break;
+            const uint16_t countWords = ReadBE16(packet + 1);
+            const uint32_t packetBytes = 1u + 4u + (static_cast<uint32_t>(countWords) + 1u) * 4u;
+            if (avail < packetBytes) break;
+            GXCallDisplayList(packet, packetBytes);
+            GXMarkFrameWork();
+            offset += packetBytes;
+            continue;
+        }
+
+        break;
+    }
+
+    return offset;
+}
+
+// Display-list recording just copies bytes into the guest list buffer and advances the shadow
+// cursor, so a burst is one logical append as long as it doesn't cross the list end; a burst that
+// would wrap falls back to the per-write path instead. Returns false to signal that fallback.
+static bool WriteDisplayListBurst(const uint8_t* data, uint32_t sizeBytes) {
+    GxDisplayListState& dl = g_dlRecordState;
+    if (!dl.active || dl.base == 0 || dl.size == 0 || dl.writePtr == 0) {
+        // Same guard WriteDisplayListData applies; let the per-write path
+        // reproduce its (silent) drop.
+        return false;
+    }
+
+    const uint32_t end = dl.base + dl.size;
+    if (dl.writePtr > end || (end - dl.writePtr) < sizeBytes) {
+        return false;
+    }
+
+    // Guest-visible bytes are written through the ordinary store path, so
+    // unaligned cursors, MMIO policy and executable-write guards all behave as
+    // they do for a single store. The cursor and count advance per element so a
+    // failed write in the middle leaves exactly the completed prefix recorded.
+    try {
+        uint32_t offset = 0;
+        for (; offset + 4u <= sizeBytes; offset += 4u) {
+            Memory::Write32(dl.writePtr, ReadBE32(data + offset));
+            dl.writePtr += 4u;
+            dl.count += 4u;
+        }
+        if (offset + 2u <= sizeBytes) {
+            Memory::Write16(dl.writePtr, ReadBE16(data + offset));
+            dl.writePtr += 2u;
+            dl.count += 2u;
+            offset += 2u;
+        }
+        if (offset < sizeBytes) {
+            Memory::Write8(dl.writePtr, data[offset]);
+            dl.writePtr += 1u;
+            dl.count += 1u;
+        }
+    } catch (const Memory::AccessViolation&) {
+    }
+    return true;
+}
+
+extern "C" void GX_HLE_FIFO_WriteBurst(const uint8_t* data, uint32_t sizeBytes) {
+    if (data == nullptr || sizeBytes == 0) {
+        return;
+    }
+
+    if (IsDisplayListActive() && WriteDisplayListBurst(data, sizeBytes)) {
+        return;
+    }
+
+    const uint32_t applied = ApplyFifoPacketsDirect(data, sizeBytes);
+    if (applied < sizeBytes) {
+        HleFifoWriteBurstChunked(data + applied, sizeBytes - applied);
+    }
+}
diff --git a/runtime/src/hle/gx/gx_frame.cpp b/runtime/src/hle/gx/gx_frame.cpp
new file mode 100644
index 0000000..6df3885
--- /dev/null
+++ b/runtime/src/hle/gx/gx_frame.cpp
@@ -0,0 +1,94 @@
+#include "gx_internal.h"
+#include "runtime_log.h"
+
+#include <cstdio>
+
+GxDisplayListState g_dlRecordState{};
+
+void BeginDisplayListRecording(uint32_t listAddr, uint32_t sizeBytes) {
+    g_dlRecordState.base = listAddr;
+    g_dlRecordState.size = sizeBytes;
+    g_dlRecordState.writePtr = listAddr;
+    g_dlRecordState.count = 0;
+    g_dlRecordState.active = listAddr != 0 && sizeBytes != 0;
+}
+
+void EndDisplayListRecording() {
+    if (!g_dlRecordState.active) {
+        return;
+    }
+    g_dlRecordState.active = false;
+    // Publish the shadow cursor/count so the guest-visible fifo object at
+    // kDlFifoAddr matches exactly what the per-write guest updates produced
+    // before the state was cached runtime-side.
+    try {
+        Memory::Write32(kDlWritePtrAddr, g_dlRecordState.writePtr);
+        Memory::Write32(kDlCountAddr, g_dlRecordState.count);
+    } catch (const Memory::AccessViolation&) {
+    }
+}
+
+void WriteDisplayListData(uint32_t val, uint32_t sizeBytes) {
+    GxDisplayListState& dl = g_dlRecordState;
+    if (!dl.active || dl.base == 0 || dl.size == 0 || dl.writePtr == 0) {
+        return;
+    }
+    try {
+        const uint32_t writePtr = dl.writePtr;
+        switch (sizeBytes) {
+        case 1:
+            Memory::Write8(writePtr, static_cast<uint8_t>(val));
+            break;
+        case 2:
+            Memory::Write16(writePtr, static_cast<uint16_t>(val));
+            break;
+        default:
+            Memory::Write32(writePtr, val);
+            sizeBytes = 4;
+            break;
+        }
+
+        uint32_t nextPtr = writePtr + sizeBytes;
+        const uint32_t end = dl.base + dl.size;
+        if (nextPtr > end) {
+            // The wrap flag is read straight out of guest memory by
+            // GX__EndDisplayList_80172eb4, so keep writing it through. Wrapping
+            // is a once-per-overflow event, not a per-write cost.
+            Memory::Write8(kDlFifoAddr + kDlWrapFlagOffset, 1);
+            nextPtr = dl.base + (nextPtr - end);
+        }
+
+        dl.writePtr = nextPtr;
+        dl.count += sizeBytes;
+    } catch (const Memory::AccessViolation&) {
+    }
+}
+
+void BeginNextAuroraFrameWithRetry(std::chrono::milliseconds timeout) {
+    const auto deadline = std::chrono::steady_clock::now() + timeout;
+    uint32_t attempts = 0;
+    while (std::chrono::steady_clock::now() < deadline) {
+        UpdateAuroraAndProcessEvents();
+        ++attempts;
+        if (BeginAuroraFrame()) {
+            g_auroraFrameActive.store(true, std::memory_order_release);
+            return;
+        }
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+    // Retry window expired: the aurora frame stays INACTIVE and every GX
+    // command until the next EnsureAuroraFrameActive is silently dropped
+    // (draws, one-shot bakes, copies). This is a frame-loss event.
+    static uint32_t s_beginExpiredLogCount = 0;
+    if (s_beginExpiredLogCount < 256 || (s_beginExpiredLogCount & 255) == 0) {
+        RT_LOGF(RT_TAG_GX, "BeginAuroraFrame retry EXPIRED after %u attempts; frame remains inactive (n=%u)\n",
+                attempts, s_beginExpiredLogCount + 1);
+    }
+    ++s_beginExpiredLogCount;
+}
+
+void EnsureAuroraFrameActive() {
+    if (!g_auroraFrameActive.load(std::memory_order_acquire)) {
+        BeginNextAuroraFrameWithRetry();
+    }
+}
diff --git a/runtime/src/hle/gx/gx_guest_write_hooks.cpp b/runtime/src/hle/gx/gx_guest_write_hooks.cpp
new file mode 100644
index 0000000..315526c
--- /dev/null
+++ b/runtime/src/hle/gx/gx_guest_write_hooks.cpp
@@ -0,0 +1,83 @@
+#include "gx_guest_write.h"
+
+#include "memory.h"
+#include "runtime_log.h"
+
+#include <aurora/gfx.h>
+
+#include <array>
+#include <cstdio>
+
+namespace GxGuestWrite {
+namespace {
+
+// Aurora holds host pointers into guest RAM (GXTexObj::data, GXTlutObj::data,
+// EFB copy destinations) and has no guest-address concept. Both MEM1 and MEM2
+// are one contiguous host mapping each - every guest alias of a physical byte
+// resolves to the same host address - so a single base per bank inverts the
+// translation exactly.
+struct GuestRamAlias {
+    const void* hostBase = nullptr;
+    uint64_t size = 0;
+    uint32_t guestBase = 0;
+};
+
+std::array<GuestRamAlias, 2> g_aliases{};
+
+bool HostToGuest(const void* hostPtr, size_t size, uint32_t& outAddr) noexcept {
+    for (const auto& alias : g_aliases) {
+        if (HostRangeToGuest(alias.hostBase, alias.size, alias.guestBase, hostPtr, size, outAddr)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+bool TooLargeForGuestRange(size_t size) noexcept {
+    return static_cast<uint64_t>(size) > static_cast<uint64_t>(UINT32_MAX);
+}
+
+uint64_t GuestWriteGenerationHook(const void* hostPtr, size_t size) noexcept {
+    uint32_t addr = 0;
+    if (TooLargeForGuestRange(size) || !HostToGuest(hostPtr, size, addr)) {
+        return kUntracked;
+    }
+    return GenerationForRange(addr, static_cast<uint32_t>(size));
+}
+
+void GuestWriteNotifyHook(const void* hostPtr, size_t size) noexcept {
+    uint32_t addr = 0;
+    if (TooLargeForGuestRange(size) || !HostToGuest(hostPtr, size, addr)) {
+        return;
+    }
+    NotifyWrite(addr, static_cast<uint32_t>(size));
+}
+
+GuestRamAlias ResolveAlias(uint32_t guestBase, size_t size) noexcept {
+    try {
+        if (const void* host = Memory::GetPointer(guestBase, 1)) {
+            return {host, static_cast<uint64_t>(size), guestBase};
+        }
+    } catch (...) {
+    }
+    return {};
+}
+
+} // namespace
+
+void InstallAuroraHooks() {
+    g_aliases[0] = ResolveAlias(Memory::kMem1CachedBase, Memory::kMem1Size);
+    g_aliases[1] = ResolveAlias(Memory::kMem2CachedBase, Memory::kMem2Size);
+    if (g_aliases[0].hostBase == nullptr || g_aliases[1].hostBase == nullptr) {
+        // Without both banks a host pointer cannot be classified, so leaving the
+        // hooks uninstalled is the only safe answer: aurora then digests every
+        // source on every validation, exactly as it did before.
+        RT_LOGF(RT_TAG_GX,
+                "guest RAM host aliases unavailable; texture source write tracking "
+                "disabled\n");
+        return;
+    }
+    aurora_set_guest_write_hooks(&GuestWriteGenerationHook, &GuestWriteNotifyHook);
+}
+
+} // namespace GxGuestWrite
diff --git a/runtime/src/hle/gx/gx_indirect.cpp b/runtime/src/hle/gx/gx_indirect.cpp
new file mode 100644
index 0000000..7855f30
--- /dev/null
+++ b/runtime/src/hle/gx/gx_indirect.cpp
@@ -0,0 +1,45 @@
+// gx_indirect.cpp - Indirect Texture / Bump Mapping
+#include "gx_internal.h"
+
+// ============================================================================
+// Indirect Texture Stages
+// ============================================================================
+
+extern "C" void GX__SetNumIndStages_80171b38(uint32_t n) { GXSetNumIndStages((u8)n); }
+PPC_NATIVE_OVERRIDE_VOID(80171b38, GX__SetNumIndStages_80171b38, (uint32_t n), (n));
+
+extern "C" void GX__SetIndTexOrder_80171a6c(uint32_t s, uint32_t c, uint32_t m) {
+    GXSetIndTexOrder((GXIndTexStageID)s, (GXTexCoordID)(c==0xFFu?0:c), (GXTexMapID)(m==0xFFu?0:m));
+}
+PPC_NATIVE_OVERRIDE_VOID(80171a6c, GX__SetIndTexOrder_80171a6c, (uint32_t s, uint32_t c, uint32_t m), (s, c, m));
+
+extern "C" void GX__SetIndTexCoordScale_80171968(uint32_t s, uint32_t ss, uint32_t ts) {
+    GXSetIndTexCoordScale((GXIndTexStageID)s, (GXIndTexScale)ss, (GXIndTexScale)ts);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171968, GX__SetIndTexCoordScale_80171968, (uint32_t s, uint32_t ss, uint32_t ts), (s, ss, ts));
+
+extern "C" void GX__SetIndTexMtx_80171814(uint32_t id, uint32_t ma, uint32_t se) {
+    float m[6]; for(int i=0; i<6; ++i) m[i]=Memory::ReadFloat32(ma+i*4);
+    GXSetIndTexMtx((GXIndTexMtxID)id, m, (s8)se);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171814, GX__SetIndTexMtx_80171814, (uint32_t id, uint32_t ma, uint32_t se), (id, ma, se));
+
+// ============================================================================
+// TEV Indirect Texture Control
+// ============================================================================
+
+extern "C" void GX__SetTevDirect_80171b58(uint32_t s) { GXSetTevDirect((GXTevStageID)s); }
+PPC_NATIVE_OVERRIDE_VOID(80171b58, GX__SetTevDirect_80171b58, (uint32_t s), (s));
+
+extern "C" void GX__SetTevIndWarp_80171ba0(uint32_t ts, uint32_t is, uint32_t so, uint32_t rm, uint32_t ms) {
+    GXSetTevIndWarp((GXTevStageID)std::min(ts, 15u), (GXIndTexStageID)std::min(is, 3u),
+        (GXBool)so, (GXBool)rm, (GXIndTexMtxID)ms);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171ba0, GX__SetTevIndWarp_80171ba0, (uint32_t ts, uint32_t is, uint32_t so, uint32_t rm, uint32_t ms), (ts, is, so, rm, ms));
+
+extern "C" void GX__SetTevIndirect_801717ac(uint32_t ts, uint32_t is, uint32_t f, uint32_t bs, uint32_t ms, uint32_t ws, uint32_t wt, uint32_t ap, uint32_t il, uint32_t as) {
+    GXSetTevIndirect((GXTevStageID)std::min(ts,15u), (GXIndTexStageID)std::min(is,3u), (GXIndTexFormat)f,
+        (GXIndTexBiasSel)bs, (GXIndTexMtxID)ms, (GXIndTexWrap)ws, (GXIndTexWrap)wt,
+        (GXBool)ap, (GXBool)il, (GXIndTexAlphaSel)as);
+}
+PPC_NATIVE_OVERRIDE_VOID(801717ac, GX__SetTevIndirect_801717ac, (uint32_t ts, uint32_t is, uint32_t f, uint32_t bs, uint32_t ms, uint32_t ws, uint32_t wt, uint32_t ap, uint32_t il, uint32_t as), (ts, is, f, bs, ms, ws, wt, ap, il, as));
diff --git a/runtime/src/hle/gx/gx_init.cpp b/runtime/src/hle/gx/gx_init.cpp
new file mode 100644
index 0000000..d1cbaf4
--- /dev/null
+++ b/runtime/src/hle/gx/gx_init.cpp
@@ -0,0 +1,233 @@
+// gx_init.cpp - GX Initialization and FIFO Management
+#include "gx_internal.h"
+#include "runtime_log.h"
+
+#include <cstdio>
+
+// Forward declarations for HLE functions used by GXInit
+extern "C" void __GX__FifoInit_8016d180();
+extern "C" void __GX__PEInit_8016ee14();
+extern "C" void __GX__SetTmemConfig_80171458(uint32_t mode);
+extern "C" void GX__InitFifoBase_8016c7c8(uint32_t fa, uint32_t ba, uint32_t s);
+// GX__SetCPUFifo_8016c94c is already declared in gx_internal.h.
+extern "C" void GX__SetGPFifo_8016cb2c(uint32_t fa);
+extern "C" GXFifoObj* GXInit(void* base, u32 size);
+
+// ============================================================================
+// GXInit
+// ============================================================================
+
+
+/**
+ * GXInit HLE - Initialize the Graphics subsystem
+ * This replaces the translated function that writes to MMIO addresses.
+ */
+extern "C" uint32_t GX__Init_8016b850(uint32_t fifoBase, uint32_t fifoSize)
+{
+    constexpr uint32_t kFifoObjAddr = 0x80343740u;
+    constexpr uint32_t kGXDataAddr = 0x803437C0u;
+    constexpr uint32_t kGXDataSize = 0x600u;
+
+    GXInit(GuestToHostPtr(fifoBase, fifoSize), fifoSize);
+
+    // Initialize GXData structure in guest memory
+    try {
+        for (uint32_t offset = 0; offset < kGXDataSize; offset += 4) {
+            Memory::Write32(kGXDataAddr + offset, 0);
+        }
+        Memory::Write8(kGXDataAddr + 0x5f8, 0);
+        Memory::Write8(kGXDataAddr + 0x5f9, 1);
+        Memory::Write8(kGXDataAddr + 0x5fa, 1);
+        Memory::Write32(kGXDataAddr + 0x5e4, 0);
+        Memory::Write32(kGXDataAddr + 0x5e8, 0);
+        Memory::Write32(kGXDataAddr + 0x5fc, 0);
+        Memory::Write32(kGXDataPtrAddr, kGXDataAddr);
+        // GXData+0x5F8 was just cleared; drop any stale recording shadow with it.
+        BeginDisplayListRecording(0, 0);
+    } catch (const ::Memory::AccessViolation& e) {
+        RT_LOGF(RT_TAG_GX, "Memory access violation during GXData init: %s\n", e.what());
+    }
+
+    __GX__FifoInit_8016d180();
+    GX__InitFifoBase_8016c7c8(kFifoObjAddr, fifoBase, fifoSize);
+    GX__SetCPUFifo_8016c94c(kFifoObjAddr);
+    GX__SetGPFifo_8016cb2c(kFifoObjAddr);
+    __GX__PEInit_8016ee14();
+
+    try {
+        uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (gd) {
+            Memory::Write32(gd + 0x254, 0);
+            Memory::Write32(gd + 0x174, 0x0f0000ff);
+            Memory::Write32(gd + 0x7c, 0x22000000);
+            Memory::Write32(gd + 0x170, 0x27000000);
+            const uint32_t baseRegs[] = {0x30, 0x38};
+            for (int i = 0; i < 2; ++i) {
+                uint32_t r = baseRegs[i];
+                Memory::Write32(gd + 0x108 + i * 0x10, r << 24);
+                Memory::Write32(gd + 0x128 + i * 0x10, (r + 1) << 24);
+                Memory::Write32(gd + 0x10c + i * 0x10, (r + 2) << 24);
+                Memory::Write32(gd + 0x12c + i * 0x10, (r + 3) << 24);
+                Memory::Write32(gd + 0x110 + i * 0x10, (r + 4) << 24);
+                Memory::Write32(gd + 0x130 + i * 0x10, (r + 5) << 24);
+                Memory::Write32(gd + 0x114 + i * 0x10, (r + 6) << 24);
+                Memory::Write32(gd + 0x134 + i * 0x10, (r + 7) << 24);
+            }
+        }
+    } catch (...) {}
+
+    __GX__SetTmemConfig_80171458(2);
+
+    RT_LOGF(RT_TAG_GX, "GX initialized, FIFO at 0x%08X (base=0x%08X size=0x%08X)\n",
+            kFifoObjAddr, fifoBase, fifoSize);
+
+    return kFifoObjAddr;
+}
+PPC_NATIVE_OVERRIDE(8016b850, GX__Init_8016b850, uint32_t, (uint32_t fifoBase, uint32_t fifoSize), (fifoBase, fifoSize));
+
+// ============================================================================
+// FIFO Management
+// ============================================================================
+
+extern "C" void GX__InitFifoBase_8016c7c8(uint32_t fa, uint32_t ba, uint32_t s) { GXInitFifoBase((GXFifoObj*)GuestToHostPtr(fa, sizeof(GXFifoObj)), GuestToHostPtr(ba, s), s); }
+
+extern "C" void GX__SetCPUFifo_8016c94c(uint32_t fa) { GXSetCPUFifo((GXFifoObj*)GuestToHostPtr(fa, sizeof(GXFifoObj))); }
+PPC_NATIVE_OVERRIDE_VOID(8016c94c, GX__SetCPUFifo_8016c94c, (uint32_t fa), (fa));
+
+extern "C" void GX__SetGPFifo_8016cb2c(uint32_t fa) { GXSetGPFifo((GXFifoObj*)GuestToHostPtr(fa, sizeof(GXFifoObj))); }
+PPC_NATIVE_OVERRIDE_VOID(8016cb2c, GX__SetGPFifo_8016cb2c, (uint32_t fa), (fa));
+
+extern "C" void __GX__SaveFifo_8016cdbc(uint32_t fa) { GXSaveCPUFifo((GXFifoObj*)GuestToHostPtr(fa, sizeof(GXFifoObj))); }
+PPC_NATIVE_OVERRIDE_VOID(8016cdbc, __GX__SaveFifo_8016cdbc, (uint32_t fa), (fa));
+
+extern "C" void GX__GetCPUFifo_8016cf10(uint32_t fa) { auto* d=(GXFifoObj*)GuestToHostPtr(fa, sizeof(GXFifoObj)); auto* s=GXGetCPUFifo(); if(d&&s) std::memcpy(d,s,sizeof(GXFifoObj)); }
+PPC_NATIVE_OVERRIDE_VOID(8016cf10, GX__GetCPUFifo_8016cf10, (uint32_t fa), (fa));
+
+extern "C" void __GX__FifoInit_8016d180()
+{
+    constexpr uint32_t kCpInterruptId = 0x11u;
+    constexpr uint32_t kCpInterruptMask = 0x4000u;
+    constexpr uint32_t kCpInterruptHandlerAddr = 0x8016c668u;
+    constexpr uint32_t kGxCurrentThreadPtrAddr = 0x803867c4u;
+    constexpr uint32_t kGxThreadQueueAddr = 0x803867c0u;
+    constexpr uint32_t kCpuFifoObjAddr = 0x80343de4u;
+    constexpr uint32_t kGpFifoObjAddr = 0x80343dc0u;
+    constexpr size_t kFifoObjSize = 0x24u;
+    constexpr uint32_t kFifoWrapFlagAddr = 0x803867b0u;
+    constexpr uint32_t kFifoWrapFlag2Addr = 0x803867b1u;
+
+    __OSSetInterruptHandler_801a65f8_hle(kCpInterruptId, kCpInterruptHandlerAddr);
+    __OSUnmaskInterrupts_801a69bc_hle(kCpInterruptMask);
+
+    try { Memory::Write32(kGxCurrentThreadPtrAddr, OS__GetCurrentThread_801a98b0_hle()); } catch (const ::Memory::AccessViolation&) {}
+    try { Memory::Write32(kGxThreadQueueAddr, 0); } catch (const ::Memory::AccessViolation&) {}
+
+    auto zeroBlock = [](uint32_t addr, size_t sizeBytes) {
+        for (size_t offset = 0; offset < sizeBytes; offset += 4) {
+            Memory::Write32(addr + static_cast<uint32_t>(offset), 0);
+        }
+    };
+
+    try { zeroBlock(kCpuFifoObjAddr, kFifoObjSize); } catch (const ::Memory::AccessViolation&) {}
+    try { zeroBlock(kGpFifoObjAddr, kFifoObjSize); } catch (const ::Memory::AccessViolation&) {}
+
+    try { Memory::Write8(kFifoWrapFlagAddr, 0); } catch (const ::Memory::AccessViolation&) {}
+    try { Memory::Write8(kFifoWrapFlag2Addr, 0); } catch (const ::Memory::AccessViolation&) {}
+}
+
+extern "C" void __GX__PEInit_8016ee14()
+{
+    constexpr uint32_t kPeTokenInterruptId = 0x12u;
+    constexpr uint32_t kPeFinishInterruptId = 0x13u;
+    constexpr uint32_t kPeTokenInterruptMask = 0x1000u;
+    constexpr uint32_t kPeFinishInterruptMask = 0x2000u;
+    constexpr uint32_t kPeTokenHandlerAddr = 0x8016eccc;
+    constexpr uint32_t kPeFinishHandlerAddr = 0x8016ed94;
+    constexpr uint32_t kPeThreadQueueAddr = 0x803867d0u;
+
+    __OSSetInterruptHandler_801a65f8_hle(kPeTokenInterruptId, kPeTokenHandlerAddr);
+    __OSSetInterruptHandler_801a65f8_hle(kPeFinishInterruptId, kPeFinishHandlerAddr);
+    __OSUnmaskInterrupts_801a69bc_hle(kPeTokenInterruptMask);
+    __OSUnmaskInterrupts_801a69bc_hle(kPeFinishInterruptMask);
+
+    try { Memory::Write32(kPeThreadQueueAddr, 0); } catch (const ::Memory::AccessViolation&) {}
+    try {
+        const uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (gd) {
+            const uint16_t cur = Memory::Read16(gd + 0x0Au);
+            Memory::Write16(gd + 0x0Au, static_cast<uint16_t>(cur | 0x000Fu));
+        }
+    } catch (const ::Memory::AccessViolation&) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(8016ee14, __GX__PEInit_8016ee14, (), ());
+
+// ============================================================================
+// Display List Recording
+// ============================================================================
+
+extern "C" void GX__BeginDisplayList_80172e00(uint32_t la, uint32_t s) {
+    try {
+        uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (!gd) return;
+        if (Memory::Read32(gd + 0x5FCu)) GX__SetDirtyState_8016ee78();
+        if (Memory::Read8(gd + 0x5F9u)) std::memcpy(Memory::GetPointer(0x80344110, 0x600), Memory::GetPointer(gd, 0x600), 0x600);
+        Memory::Write32(0x80344094, la + s - 4u);
+        Memory::Write32(0x803440AC, 0);
+        Memory::Write32(0x80344090, la);
+        Memory::Write32(0x80344098, s);
+        Memory::Write32(0x803440A4, la);
+        Memory::Write32(0x803440A8, la);
+        Memory::Write8(gd + 0x5F8u, 1u);
+        // Mirror the guest fifo-object fields the FIFO write path consumes so
+        // HleFifoWrite never has to read them back out of guest memory.
+        BeginDisplayListRecording(la, s);
+        GXFlush();
+        GX__GetCPUFifo_8016cf10(0x80344710);
+        GX__SetCPUFifo_8016c94c(0x80344090);
+    } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(80172e00, GX__BeginDisplayList_80172e00, (uint32_t la, uint32_t s), (la, s));
+
+extern "C" uint32_t GX__EndDisplayList_80172eb4() {
+    try {
+        GXFlush();
+        GX__GetCPUFifo_8016cf10(0x80344090);
+        const uint8_t wrapped = Memory::Read8(kDlFifoAddr + kDlWrapFlagOffset);
+        GX__SetCPUFifo_8016c94c(0x80344710);
+
+        const uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (gd) {
+            if (Memory::Read8(gd + 0x5F9u) != 0) {
+                const int32_t interruptLevel = OS__DisableInterrupts_801a65ac();
+                const uint32_t savedWord8 = Memory::Read32(gd + 0x08u);
+                std::memcpy(Memory::GetPointer(gd, 0x600),
+                            Memory::GetPointer(0x80344110, 0x600),
+                            0x600);
+                Memory::Write32(gd + 0x08u, savedWord8);
+                OS__RestoreInterrupts_801a65d4(interruptLevel);
+            }
+            Memory::Write8(gd + 0x5F8u, 0);
+        }
+
+        // Publish the cached cursor/count before the count is read back below.
+        // Done unconditionally: the original read of GXData+0x5F8 returned
+        // "inactive" whenever the GXData pointer was null, so recording must
+        // stop here even on the gd == 0 path.
+        EndDisplayListRecording();
+
+        return wrapped == 0 ? Memory::Read32(kDlCountAddr) : 0;
+    } catch (...) {
+        // Leaving the shadow active would silently swallow every subsequent
+        // FIFO write into a dead list.
+        EndDisplayListRecording();
+        return 0;
+    }
+}
+PPC_NATIVE_OVERRIDE(80172EB4, GX__EndDisplayList_80172eb4, uint32_t, (), ());
+
+// ============================================================================
+// Flush
+// ============================================================================
+
+extern "C" void GX__Flush_8016e654() { GXFlush(); }
+PPC_NATIVE_OVERRIDE_VOID(8016e654, GX__Flush_8016e654, (), ());
diff --git a/runtime/src/hle/gx/gx_internal.h b/runtime/src/hle/gx/gx_internal.h
new file mode 100644
index 0000000..25e9e6d
--- /dev/null
+++ b/runtime/src/hle/gx/gx_internal.h
@@ -0,0 +1,396 @@
+#pragma once
+
+#include "hle_stubs.h"
+#include "memory.h"
+#include "gx_guest_write.h"
+#include "ppc_runtime.h"
+#include "aurora_events.h"
+#include "gx_texture_binding_contract.h"
+
+#include <algorithm>
+
+#include <dolphin/gx/GXLighting.h>
+#include <dolphin/gx/GXFifo.h>
+#include <dolphin/gx/GXManage.h>
+#include <dolphin/gx/GXFrameBuffer.h>
+#include <dolphin/gx/GXTexture.h>
+#include <dolphin/gx/GXDispList.h>
+#include <dolphin/gx/GXGet.h>
+#include <dolphin/gx/GXTransform.h>
+#include <dolphin/gx/GXCull.h>
+#include <dolphin/gx/GXPixel.h>
+#include <dolphin/gx/GXTev.h>
+#include <dolphin/gx/GXBump.h>
+#include <dolphin/gx/GXGeometry.h>
+#include <dolphin/gx/GXVert.h>
+#include <dolphin/gx/GXExtra.h>
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <set>
+#include <map>
+#include <unordered_map>
+#include <vector>
+#include <type_traits>
+#include <memory>
+#include <thread>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <new>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+#include <mutex>
+#include <cmath>
+#include <stdexcept>
+
+#include <aurora/aurora.h>
+
+namespace aurora::gfx {
+bool is_offscreen() noexcept;
+}
+
+// --- Constants ---
+constexpr uint32_t kGXDataPtrAddr = 0x803886C8;
+constexpr uint32_t kDlFifoAddr = 0x80344090;
+constexpr uint32_t kDlWritePtrAddr = 0x803440A4;
+constexpr uint32_t kDlCountAddr = 0x803440AC;
+constexpr uint32_t kDlWrapFlagOffset = 0x20;
+constexpr uint32_t kMaxTluts = 20;
+constexpr uint32_t kGxDrawDoneFlagAddr = 0x803867d8;
+
+// --- External Declarations ---
+extern "C" void GXInitTexObjTlut(GXTexObj* obj, u32 tlut);
+extern "C" int32_t OS__DisableInterrupts_801a65ac();
+extern "C" int32_t OS__RestoreInterrupts_801a65d4(int32_t level);
+extern "C" uint32_t __OSSetInterruptHandler_801a65f8_hle(uint32_t interrupt, uint32_t handler);
+extern "C" uint32_t __OSUnmaskInterrupts_801a69bc_hle(uint32_t mask);
+extern "C" uint32_t OS__GetCurrentThread_801a98b0_hle();
+extern "C" void GX__SetCPUFifo_8016c94c(uint32_t fifoAddr);
+extern "C" void GX__SetDirtyState_8016ee78();
+extern "C" void GX__CallDisplayList_80172f64(uint32_t listAddr, uint32_t nbytes);
+
+extern std::atomic_bool g_auroraFrameActive;
+extern std::atomic_bool g_auroraFrameHadWork;
+
+inline void GXMarkFrameWork() {
+    g_auroraFrameHadWork.store(true, std::memory_order_release);
+}
+
+// --- Global State ---
+extern "C" {
+extern int g_gxFrameCount;
+
+extern int32_t g_scissorLeft;
+extern int32_t g_scissorTop;
+extern int32_t g_scissorWidth;
+extern int32_t g_scissorHeight;
+
+extern float g_viewportState[6];
+extern float g_projectionVector[7];
+}
+
+// Decoded guest GXTexObj metadata. The sampler half is
+// GxTextureBindingContract::SamplerState, shared with the binding record so the
+// two field lists cannot drift; only the bookkeeping fields are added here.
+struct TexObjMeta : GxTextureBindingContract::SamplerState {
+    uint32_t userData = 0;
+    bool needsUpload = true;
+};
+
+// --- Host-side texture object storage (audit F9) ---
+// One hash-map slot per guest GXTexObj (see TexObjSlot) instead of two parallel maps, so
+// GXLoadTexObj no longer pays redundant tree descents to reach state for the same object.
+struct HleTexObj {
+    alignas(GXTexObj) std::byte storage[sizeof(GXTexObj)]{};
+    bool storageLive = false;
+    bool constructed = false;
+
+    HleTexObj() = default;
+    ~HleTexObj() { Destroy(); }
+
+    GXTexObj* PublicPtr() { return reinterpret_cast<GXTexObj*>(storage); }
+
+    void EnsureStorageLive() {
+        if (!storageLive) {
+            std::memset(storage, 0, sizeof(storage));
+            storageLive = true;
+        }
+    }
+
+    void Destroy() {
+        if (storageLive) {
+            GXDestroyTexObj(PublicPtr());
+            std::memset(storage, 0, sizeof(storage));
+            storageLive = false;
+            constructed = false;
+        }
+    }
+};
+
+// One entry of the texobj table, keyed by the guest GXTexObj address.
+//
+// Derives from TexObjMeta on purpose: `GetTexObjMeta()` hands out a reference to
+// the base subobject, so the HLE's `GetTexObjMeta(oa) = meta;` writebacks assign
+// only the decoded fields and leave the bookkeeping below intact.
+struct TexObjSlot : TexObjMeta {
+    // Guest address of the GXTexObj this slot describes (the map key), so the
+    // index vectors can carry slot pointers instead of re-looking-up keys.
+    uint32_t objAddr = 0;
+
+    // Aurora-side object. Created lazily by CreateHostTexObj.
+    std::unique_ptr<HleTexObj> host;
+
+    // Byte-exact shadow of the last-decoded guest GXTexObj; served without a
+    // diff only while guest bytes still match it. Games mutate these structs
+    // with plain, unflushed CPU stores, so a generation-counter scheme can
+    // miss writes; an earlier "freeze after two loads" version caused stale
+    // texture binds on track reload. Re-comparing bytes per load is correct.
+    uint64_t guestShadow[4] = {0, 0, 0, 0};
+    bool hasGuestShadow = false;
+
+    // DCStoreRange interval-index bookkeeping: what this slot currently
+    // contributes to g_texObjIntervals, so a pending update that turns out to
+    // be a no-op costs a compare instead of an erase + insert.
+    uint32_t indexedDataAddr = 0;
+    uint32_t indexedSize = 0;
+    bool inIntervalIndex = false;
+    bool pendingIntervalUpdate = false;
+};
+
+struct TlutObjMeta {
+    uint32_t dataAddr = 0;
+    uint16_t entries = 0;
+    uint32_t format = 0;
+    bool dirty = true;
+};
+
+using BoundTexInfo = GxTextureBindingContract::State;
+
+// CanonicalizeGxMainRamAddress and the guest-write generation table live in
+// gx_guest_write.h so the GX caches and the runtime-wide write notifiers share
+// one address space and one table.
+
+namespace GxDisplayListScanCache {
+
+inline bool XfPayloadFits(uint32_t pos, uint32_t nbytes, uint16_t count) noexcept {
+    const uint32_t payloadBytes = 4u + (static_cast<uint32_t>(count) + 1u) * 4u;
+    return pos <= nbytes && payloadBytes <= nbytes - pos;
+}
+
+inline uint64_t MakeIdentityKey(uint32_t listAddr, uint32_t nbytes, uint64_t layoutHash) noexcept {
+    const uint32_t canonicalAddr = CanonicalizeGxMainRamAddress(listAddr);
+    uint64_t key = layoutHash;
+    key ^= (static_cast<uint64_t>(canonicalAddr) << 32) | static_cast<uint64_t>(nbytes);
+    key *= 1099511628211ull;
+    key ^= static_cast<uint64_t>(canonicalAddr) * 0x9e3779b97f4a7c15ull;
+    return key;
+}
+
+// Display-list identity uses a 64-bit content digest (XXH3, computed by the caller in
+// gx_dl.cpp) instead of a shadow-copy memcmp, avoiding the multi-megabyte shadow and its extra read pass.
+inline bool ContentDigestMatches(uint64_t storedDigest,
+                                 uint32_t storedNbytes,
+                                 uint64_t currentDigest,
+                                 uint32_t currentNbytes) noexcept {
+    return storedNbytes == currentNbytes && storedDigest == currentDigest;
+}
+
+inline bool CanReuse(uint32_t storedAddr,
+                     uint32_t storedNbytes,
+                     uint64_t storedLayoutHash,
+                     uint64_t storedContentDigest,
+                     uint32_t currentAddr,
+                     uint32_t currentNbytes,
+                     uint64_t currentLayoutHash,
+                     uint64_t currentContentDigest) noexcept {
+    return storedAddr == CanonicalizeGxMainRamAddress(currentAddr) &&
+           storedLayoutHash == currentLayoutHash &&
+           ContentDigestMatches(storedContentDigest, storedNbytes, currentContentDigest,
+                                currentNbytes);
+}
+
+} // namespace GxDisplayListScanCache
+
+struct VtxAttrFmt {
+    GXCompCnt cnt = GX_POS_XYZ;
+    GXCompType type = GX_F32;
+    u8 frac = 0;
+};
+
+struct HleGxState {
+    GXAttrType vtxDesc[26]{};
+    VtxAttrFmt vtxAttrFmt[8][26]{};
+    // Display-list scans key their decoded index bounds by the active vertex
+    // layout. Most display lists reuse that layout, so recompute its content
+    // hash only after a real VCD/VAT mutation.
+    uint64_t vtxLayoutHash = 0;
+    bool vtxLayoutHashDirty = true;
+    // Bumped on every real vtxDesc/vtxAttrFmt mutation. Consumers that mirror
+    // this state (gx_dl.cpp's applied-state mirror) use it to detect that a
+    // republish would be a no-op.
+    uint32_t vtxStateGeneration = 0;
+    struct VtxArray {
+        uint32_t base = 0;
+        uint32_t stride = 0;
+    };
+    VtxArray vtxArray[26]{};
+
+    GXVtxFmt currentVtxFmt = GX_VTXFMT0;
+    GXPrimitive currentPrim = GX_TRIANGLES;
+    u32 vertsRemaining = 0;
+    bool inBegin = false;
+    bool auroraBeginCalled = false;
+    bool dirty = false;
+
+    GXAttr currentAttr = GX_VA_NULL;
+    int currentComp = 0;
+    float compBuffer[9]{}; 
+    u32 rawCompBuffer[9]{};
+    // Shared byte queue for MMIO FIFO command packets and in-begin vertex payload.
+    std::array<uint8_t, 4096> fifoBytes{};
+    size_t fifoReadOffset = 0;
+    size_t fifoByteCount = 0;
+
+    void ResetVertex();
+    void InvalidateVtxLayoutHash() noexcept {
+        vtxLayoutHashDirty = true;
+        ++vtxStateGeneration;
+    }
+    GXAttr NextEnabledAttr(int startAttr);
+    int GetExpectedCompCount(GXAttr attr, const VtxAttrFmt& fmt);
+};
+
+struct TexCopyState {
+    uint16_t srcLeft = 0;
+    uint16_t srcTop = 0;
+    uint16_t srcWidth = 0;
+    uint16_t srcHeight = 0;
+    uint16_t dstWidth = 0;
+    uint16_t dstHeight = 0;
+    uint32_t dstFormat = 0;
+    uint32_t dstMipmap = 0;
+};
+
+// --- Display list recording state (audit F2) ---
+// HleFifoWrite owns a shadow cursor instead of re-reading guest memory per FIFO write (was
+// 2 reads/write, up to 9 with a list open). Safe only because nothing outside the GX HLE
+// touches the guest words it shadows (GXData+0x5F8, kDl*Addr); flushed back to guest memory
+// when the list ends so guest-visible state stays correct.
+struct GxDisplayListState {
+    uint32_t base = 0;
+    uint32_t size = 0;
+    uint32_t writePtr = 0;
+    uint32_t count = 0;
+    bool active = false;
+};
+extern GxDisplayListState g_dlRecordState;
+
+inline bool IsDisplayListActive() noexcept { return g_dlRecordState.active; }
+
+// Mirrors GX__BeginDisplayList_80172e00's guest-side initialization.
+void BeginDisplayListRecording(uint32_t listAddr, uint32_t sizeBytes);
+// Flushes the shadow cursor/count back into guest memory and stops recording.
+void EndDisplayListRecording();
+
+// --- Helper Functions ---
+void WriteDisplayListData(uint32_t val, uint32_t sizeBytes);
+void BeginNextAuroraFrameWithRetry(std::chrono::milliseconds timeout = std::chrono::milliseconds(100));
+void EnsureAuroraFrameActive();
+
+GXColor DecodeGxColor(uint32_t colorWord);
+void WriteGuestFloat(uint32_t addr, float value, const char* label = nullptr);
+void* GuestToHostPtr(uint32_t addr, size_t len = 0);
+void WriteGuest32(uint32_t addr, uint32_t value, const char* label = nullptr);
+
+static inline bool IsMatrixIndexAttr(GXAttr attr) noexcept {
+    return attr == GX_VA_PNMTXIDX ||
+           (attr >= GX_VA_TEX0MTXIDX && attr <= GX_VA_TEX7MTXIDX);
+}
+
+static inline uint32_t DecodeCpArrayBaseGuestAddress(uint32_t value) noexcept {
+    constexpr uint32_t kWiiCpPhysicalAddressMask = 0x1fffffffu;
+    const uint32_t physical = value & kWiiCpPhysicalAddressMask;
+    if (physical == 0) {
+        return 0;
+    }
+    if (Memory::Contains(physical, 1)) {
+        return physical;
+    }
+
+    const uint32_t cached = physical | 0x80000000u;
+    if (Memory::Contains(cached, 1)) {
+        return cached;
+    }
+
+    const uint32_t uncached = physical | 0xC0000000u;
+    if (Memory::Contains(uncached, 1)) {
+        return uncached;
+    }
+
+    return cached;
+}
+
+bool IsKnownTexFormat(uint32_t fmt);
+bool IsPaletteTexFormat(uint32_t fmt);
+bool IsKnownTlutFormat(uint32_t fmt);
+bool ValidateTlutData(uint32_t objAddr, const TlutObjMeta& meta);
+
+TexObjMeta& GetTexObjMeta(uint32_t addr);
+TexObjMeta ExtractTexObjMetaFromGuest(uint32_t addr);
+bool TryGetOrExtractTexObjMeta(uint32_t addr, TexObjMeta& outMeta);
+TlutObjMeta& GetTlutObjMeta(uint32_t addr);
+GXTexObj* GetHostTexObj(uint32_t addr);
+GXTexObj* TryGetHostTexObj(uint32_t addr);
+GXTexObj* CreateHostTexObj(uint32_t addr);
+void MarkHostTexObjConstructed(uint32_t addr);
+void MarkTexObjsDirtyForRange(uint32_t addr, uint32_t size);
+// Invalidates GPU-only GXCopyTex results when guest CPU writes are made visible
+// over their destination. This is the allocation-reuse generation boundary
+// for copy textures; it must be called for every data-cache store/flush range.
+void InvalidateEfbCopyDestinationsForRange(uint32_t addr, uint32_t size);
+GXTlutObj* CreateHostTlutObj(uint32_t addr);
+void MarkHostTlutObjConstructed(uint32_t addr);
+GXTlutObj* GetHostTlutObj(uint32_t addr);
+void MarkTlutObjsDirtyForRange(uint32_t addr, uint32_t size);
+// One-stop invalidation for DMA-class host-side writes into guest RAM (DVD
+// reads, DCZeroRange, LC stores): texobjs + TLUTs + EFB copies + display
+// lists. extern "C" so HLE modules outside the GX layer can declare it without
+// pulling in this header.
+extern "C" void GxNotifyGuestRamDmaWrite(uint32_t addr, uint32_t size);
+
+void HleFifoWrite(u32 val, uint32_t sizeBytes);
+void SubmitAttribute(GXAttr attr, float* comps, const VtxAttrFmt& fmt, const u32* rawComps = nullptr);
+void SubmitIndexedAttribute(GXAttr attr, uint32_t index);
+
+static inline int GetCompSizeBytes(GXCompType type) {
+    switch (type) {
+    case GX_U8: case GX_S8: return 1;
+    case GX_U16: case GX_S16: return 2;
+    case GX_F32: return 4;
+    default: return 1;
+    }
+}
+
+// ReadArrayComp (guest vertex array -> float) now lives in gx_stream_common.h
+// as GxStream::ReadArrayComp, next to the single fixed-point conversion table
+// its display-list and FIFO counterparts share.
+
+extern HleGxState g_hleGxState;
+// Set once the guest (or a default-injection site) has published an alpha
+// compare to aurora; the only consumer is GxStream::EnsureDefaultGxAlphaCompare.
+extern bool g_alphaCompareValid;
+extern std::array<BoundTexInfo, 8> g_boundTexMaps;
+extern TexCopyState g_texCopyState;
+
+extern std::mutex g_texObjMutex;
+extern std::mutex g_tlutObjMutex;
+// Guest GXTexObj address -> decoded metadata + host object. std::unordered_map
+// rather than absl::flat_hash_map because the runtime target does not link
+// absl, and because callers (gx_texture.cpp) hold an iterator across an insert
+// that happens on another key: unordered_map keeps references valid across a
+// rehash, an open-addressed table would not.
+extern std::unordered_map<uint32_t, TexObjSlot> g_TexObjMeta;
diff --git a/runtime/src/hle/gx/gx_lighting.cpp b/runtime/src/hle/gx/gx_lighting.cpp
new file mode 100644
index 0000000..1b1d392
--- /dev/null
+++ b/runtime/src/hle/gx/gx_lighting.cpp
@@ -0,0 +1,97 @@
+// gx_lighting.cpp - Lighting and Channel Control
+#include "gx_internal.h"
+#include "runtime_log.h"
+
+#include <cstdio>
+
+namespace {
+
+// GXLightObj is an opaque 64-byte guest object. The Revolution SDK leaves
+// three words at the front unused, then stores the exact 13 XF light words
+// loaded by GXLoadLightObjImm. Aurora's host-side GXLightObj implementation is
+// compact (it starts at color), so a guest pointer must never be passed to the
+// host implementation directly.
+constexpr uint32_t kLightObjSize = 0x40;
+constexpr uint32_t kColorOffset = 0x0c;
+constexpr uint32_t kAttnAOffset = 0x10;
+constexpr uint32_t kAttnKOffset = 0x1c;
+constexpr uint32_t kPositionOffset = 0x28;
+constexpr uint32_t kDirectionOffset = 0x34;
+
+bool ValidateGuestLightObj(uint32_t addr, const char* operation) {
+    if (addr != 0 && Memory::Contains(addr, kLightObjSize)) {
+        return true;
+    }
+    RT_LOGF(RT_TAG_GX, "%s: invalid GXLightObj @0x%08X\n", operation, addr);
+    std::fflush(stderr);
+    return false;
+}
+
+float ReadGuestLightFloat(uint32_t addr, uint32_t offset) {
+    return Memory::ReadFloat32(addr + offset);
+}
+
+void InitializeHostLightFromGuest(GXLightObj& host, uint32_t guestAddr) {
+    GXInitLightColor(&host, DecodeGxColor(Memory::Read32(guestAddr + kColorOffset)));
+    GXInitLightAttn(
+        &host,
+        ReadGuestLightFloat(guestAddr, kAttnAOffset + 0),
+        ReadGuestLightFloat(guestAddr, kAttnAOffset + 4),
+        ReadGuestLightFloat(guestAddr, kAttnAOffset + 8),
+        ReadGuestLightFloat(guestAddr, kAttnKOffset + 0),
+        ReadGuestLightFloat(guestAddr, kAttnKOffset + 4),
+        ReadGuestLightFloat(guestAddr, kAttnKOffset + 8));
+    GXInitLightPos(
+        &host,
+        ReadGuestLightFloat(guestAddr, kPositionOffset + 0),
+        ReadGuestLightFloat(guestAddr, kPositionOffset + 4),
+        ReadGuestLightFloat(guestAddr, kPositionOffset + 8));
+
+    // GXInitLightDir negates its arguments before storing them. The guest
+    // object already contains those stored XF direction components.
+    GXInitLightDir(
+        &host,
+        -ReadGuestLightFloat(guestAddr, kDirectionOffset + 0),
+        -ReadGuestLightFloat(guestAddr, kDirectionOffset + 4),
+        -ReadGuestLightFloat(guestAddr, kDirectionOffset + 8));
+}
+
+} // namespace
+
+// ============================================================================
+// Light Object Load
+// ============================================================================
+
+extern "C" void GX__LoadLightObjImm_80170320(uint32_t la, uint32_t lid) {
+    if (!ValidateGuestLightObj(la, "GXLoadLightObjImm")) return;
+    GXLightObj host{};
+    InitializeHostLightFromGuest(host, la);
+    GXLoadLightObjImm(&host, static_cast<GXLightID>(lid));
+}
+PPC_NATIVE_OVERRIDE_VOID(80170320, GX__LoadLightObjImm_80170320, (uint32_t la, uint32_t lid), (la, lid));
+
+// ============================================================================
+// Channel Control
+// ============================================================================
+
+extern "C" void GX__SetChanAmbColor_8017039c(uint32_t c, uint32_t cp) {
+    EnsureAuroraFrameActive();
+    GXColor color = DecodeGxColor(Memory::Read32(cp));
+    GXSetChanAmbColor((GXChannelID)c, color);
+}
+PPC_NATIVE_OVERRIDE_VOID(8017039c, GX__SetChanAmbColor_8017039c, (uint32_t c, uint32_t cp), (c, cp));
+
+extern "C" void GX__SetChanMatColor_80170474(uint32_t c, uint32_t cp) {
+    EnsureAuroraFrameActive();
+    GXColor color = DecodeGxColor(Memory::Read32(cp));
+    GXSetChanMatColor((GXChannelID)c, color);
+}
+PPC_NATIVE_OVERRIDE_VOID(80170474, GX__SetChanMatColor_80170474, (uint32_t c, uint32_t cp), (c, cp));
+
+extern "C" void GX__SetNumChans_8017054c(uint32_t n) { GXSetNumChans((u8)n); }
+PPC_NATIVE_OVERRIDE_VOID(8017054c, GX__SetNumChans_8017054c, (uint32_t n), (n));
+
+extern "C" void GX__SetChanCtrl_80170570(uint32_t ch, uint32_t en, uint32_t as, uint32_t ms, uint32_t lm, uint32_t df, uint32_t af) {
+    GXSetChanCtrl((GXChannelID)ch, en!=0, (GXColorSrc)as, (GXColorSrc)ms, lm, (GXDiffuseFn)df, (GXAttnFn)af);
+}
+PPC_NATIVE_OVERRIDE_VOID(80170570, GX__SetChanCtrl_80170570, (uint32_t ch, uint32_t en, uint32_t as, uint32_t ms, uint32_t lm, uint32_t df, uint32_t af), (ch, en, as, ms, lm, df, af));
diff --git a/runtime/src/hle/gx/gx_objects.cpp b/runtime/src/hle/gx/gx_objects.cpp
new file mode 100644
index 0000000..ce4f368
--- /dev/null
+++ b/runtime/src/hle/gx/gx_objects.cpp
@@ -0,0 +1,712 @@
+#include "gx_internal.h"
+#include "runtime_log.h"
+
+#include <cstddef>
+#include <limits>
+
+// --- Texture and TLUT Objects ---
+
+namespace aurora::gfx {
+struct TextureRef;
+using TextureHandle = std::shared_ptr<TextureRef>;
+} 
+
+// HleTexObj now lives in gx_internal.h: it is embedded in TexObjSlot so the
+// metadata and the Aurora object share one hash-map entry.
+
+struct HostGXTlutObj {
+    alignas(GXTlutObj) std::byte publicStorage[sizeof(GXTlutObj)]{};
+    aurora::gfx::TextureHandle ref;
+};
+
+struct HleTlutObj {
+    static constexpr size_t kTlutObjStorageSize =
+        (sizeof(GXTlutObj) >= sizeof(HostGXTlutObj)) ? sizeof(GXTlutObj) : sizeof(HostGXTlutObj);
+    static constexpr size_t kTlutObjStorageAlign =
+        (alignof(GXTlutObj) >= alignof(HostGXTlutObj)) ? alignof(GXTlutObj) : alignof(HostGXTlutObj);
+    using Storage = std::aligned_storage_t<kTlutObjStorageSize, kTlutObjStorageAlign>;
+
+    Storage storage{};
+    bool storageLive = false;
+    bool constructed = false;
+
+    HleTlutObj() = default;
+    ~HleTlutObj() { Destroy(); }
+
+    HostGXTlutObj* HostObj() { return reinterpret_cast<HostGXTlutObj*>(&storage); }
+    GXTlutObj* PublicPtr() { return reinterpret_cast<GXTlutObj*>(HostObj()->publicStorage); }
+
+    void EnsureStorageLive() {
+        if (!storageLive) {
+            new (&storage) HostGXTlutObj();
+            storageLive = true;
+        }
+    }
+
+    void Destroy() {
+        if (storageLive) {
+            GXDestroyTlutObj(PublicPtr());
+            std::destroy_at(HostObj());
+            std::memset(&storage, 0, sizeof(storage));
+            storageLive = false;
+            constructed = false;
+        }
+    }
+};
+
+std::mutex g_texObjMutex;
+std::map<uint32_t, std::unique_ptr<HleTlutObj>> g_HostTlutObjMap;
+std::mutex g_tlutObjMutex;
+
+// The texobj table. One slot per guest GXTexObj address holds both the decoded
+// metadata and the Aurora object, so GXLoadTexObj resolves everything it needs
+// with a single hash lookup instead of six tree descents across two maps.
+std::unordered_map<uint32_t, TexObjSlot> g_TexObjMeta;
+std::map<uint32_t, TlutObjMeta> g_TlutObjMeta;
+std::array<BoundTexInfo, 8> g_boundTexMaps{};
+
+namespace {
+
+// A whole GXLoadTexObj call resolves the same guest address several times, so memoising the last
+// slot turns all but the first lookup into a pointer compare. Safe because g_TexObjMeta is
+// node-based and never erased from, so element references stay valid across rehashes.
+uint32_t g_texObjSlotMemoAddr = 0;
+TexObjSlot* g_texObjSlotMemo = nullptr;
+
+constexpr size_t kTexObjTableReserve = 1024;
+
+} // namespace
+
+struct TexObjIntervalEntry {
+    uint32_t dataAddr = 0;
+    uint32_t size = 0;
+    uint32_t objAddr = 0;
+    TexObjSlot* slot = nullptr;
+};
+
+// DCStoreRange invalidation index, sorted by (dataAddr, objAddr). Rebuilding is O(N log N) plus a
+// GXGetTexBufferSize per texobj, so it must not happen once per DCStoreRange: mutations instead
+// queue their slot for a targeted patch. The queue used to be a capacity-limited vector that
+// overflowed under real per-frame GXLoadTexObj volume and silently degraded into a full rebuild
+// every call; the dedupe flag now lives on the slot so queuing is O(1) and uncapped.
+std::vector<TexObjIntervalEntry> g_texObjIntervals;
+std::vector<TexObjSlot*> g_texObjIntervalsPending;
+bool g_texObjIntervalsRebuildAll = true;
+
+// Upper bound on any entry's byte size. The dirty scan walks left from lower_bound(dirtyStart)
+// and needs this to know when no earlier-starting interval can still reach dirtyStart (intervals
+// are sorted by start only, so a larger one could start further back). An overestimate just
+// lengthens the walk, so the patch path only ever raises it and rebuild recomputes it exactly.
+uint32_t g_texObjIntervalMaxSize = 0;
+
+// Address bounds of every registered TLUT payload, so a DCStoreRange over an
+// unrelated buffer can skip the g_TlutObjMeta scan entirely. Recomputed lazily
+// because TLUT registration is far rarer than cache flushes.
+uint64_t g_tlutObjBoundsStart = 0;
+uint64_t g_tlutObjBoundsEnd = 0;
+bool g_tlutObjBoundsDirty = true;
+
+// Guest GXTexObj is 32 bytes: word0 wrap/filter bits, word1 LOD bits, word2 width/height/format,
+// word3 data address (<<5), word4 user data, word5 texFmt, word6 tlut, byte 0x1F flags. Exact
+// bit positions are decoded inline below.
+
+TexObjMeta ExtractTexObjMetaFromGuest(uint32_t addr) {
+    TexObjMeta meta{};
+    try {
+        uint32_t word0 = Memory::Read32(addr + 0x00);
+        uint32_t word1 = Memory::Read32(addr + 0x04);
+        uint32_t word2 = Memory::Read32(addr + 0x08);
+        uint32_t word3 = Memory::Read32(addr + 0x0C);
+        uint32_t word4 = Memory::Read32(addr + 0x10);
+        uint32_t word5 = Memory::Read32(addr + 0x14);
+        uint32_t word6 = Memory::Read32(addr + 0x18);
+        uint8_t flags = Memory::Read8(addr + 0x1F);
+        
+        meta.wrapS = word0 & 0x3;
+        meta.wrapT = (word0 >> 2) & 0x3;
+        meta.width = (word2 & 0x3FF) + 1;
+        meta.height = ((word2 >> 10) & 0x3FF) + 1;
+        meta.dataAddr = CanonicalizeGxMainRamAddress((word3 & 0xFFFFFF) << 5);
+        meta.userData = word4;
+        meta.mipmap = (flags & 1) != 0;
+
+        const uint32_t formatFromWord2 = (word2 >> 20) & 0xF;
+        uint32_t resolvedFormat = word5;
+        if (!IsKnownTexFormat(resolvedFormat) && IsKnownTexFormat(formatFromWord2)) {
+            resolvedFormat = formatFromWord2;
+        }
+        meta.format = resolvedFormat;
+        meta.tlut = word6;
+        
+        // LOD parameters from GXGetTexObjLODAll
+        // minLod = ((word1 & 0xff) / 16.0f)
+        // maxLod = (((word1 >> 8) & 0xff) / 16.0f)
+        meta.minLod = (float)(word1 & 0xFF) / 16.0f;
+        meta.maxLod = (float)((word1 >> 8) & 0xFF) / 16.0f;
+        
+        // lodBias from bits [17:9] as signed 8-bit, scaled by 1/32
+        int8_t biasRaw = (int8_t)((word0 >> 9) & 0xFF);
+        meta.lodBias = (float)biasRaw / 32.0f;
+        
+        // biasClamp from bit 21
+        meta.biasClamp = ((word0 >> 21) & 1) != 0;
+        
+        // edgeLod from countLeadingZeros((word0 >> 8) & 1) >> 5
+        // If bit 8 is set, edgeLod=0, else edgeLod=1
+        meta.edgeLod = ((word0 >> 8) & 1) == 0;
+        
+        // maxAniso from bits [20:19]
+        meta.maxAniso = (word0 >> 19) & 0x3;
+        
+        // Filter modes - bits [7:5] store the encoded HW value written by
+        // GX2HWFiltConv. This is the inverse of kGxToHwMinFilter in gx_texture.cpp.
+        static const uint8_t filterLut[] = {0, 2, 4, 0, 1, 3, 5, 0};
+        meta.minFilter = filterLut[(word0 >> 5) & 7];
+        meta.magFilter = (word0 >> 4) & 1;
+
+        // GXInitTexObj sets flags bit 1 for non-CI formats, but GXInitTexObjCI clears it.
+        // Accept CI textures even when bit 1 is cleared, as long as the payload is sane.
+        bool isValid = (flags & 0x02) != 0;
+        if (!isValid) {
+            if (IsKnownTexFormat(meta.format) && meta.dataAddr != 0) {
+                isValid = true;
+            }
+        }
+        if (!isValid) {
+            return TexObjMeta{};
+        }
+        
+    } catch (...) {
+        // If we can't read the guest memory, return empty meta
+    }
+    return meta;
+}
+
+namespace {
+
+bool IsUsableTexObjMeta(const TexObjMeta& meta) {
+    return meta.dataAddr != 0 &&
+           meta.width != 0 &&
+           meta.height != 0 &&
+           IsKnownTexFormat(meta.format);
+}
+
+bool TexObjIntervalLess(const TexObjIntervalEntry& lhs, const TexObjIntervalEntry& rhs) {
+    if (lhs.dataAddr != rhs.dataAddr) {
+        return lhs.dataAddr < rhs.dataAddr;
+    }
+    return lhs.objAddr < rhs.objAddr;
+}
+
+bool TryBuildTexObjIntervalEntry(TexObjSlot& slot, TexObjIntervalEntry& outEntry) {
+    if (!IsUsableTexObjMeta(slot)) {
+        return false;
+    }
+
+    const uint8_t maxLod = slot.maxLod > 0.0f ? static_cast<uint8_t>(std::min(slot.maxLod, 255.0f)) : 0u;
+    const uint32_t texSize =
+        GXGetTexBufferSize(slot.width, slot.height, slot.format, static_cast<GXBool>(slot.mipmap), maxLod);
+    if (texSize == 0) {
+        return false;
+    }
+
+    outEntry = TexObjIntervalEntry{
+        .dataAddr = CanonicalizeGxMainRamAddress(slot.dataAddr),
+        .size = texSize,
+        .objAddr = slot.objAddr,
+        .slot = &slot,
+    };
+    return true;
+}
+
+// --- Slot lookup -------------------------------------------------------------
+
+TexObjSlot* FindTexObjSlot(uint32_t addr) {
+    if (g_texObjSlotMemo != nullptr && g_texObjSlotMemoAddr == addr) {
+        return g_texObjSlotMemo;
+    }
+    const auto it = g_TexObjMeta.find(addr);
+    if (it == g_TexObjMeta.end()) {
+        return nullptr;
+    }
+    g_texObjSlotMemoAddr = addr;
+    g_texObjSlotMemo = &it->second;
+    return g_texObjSlotMemo;
+}
+
+TexObjSlot& FindOrCreateTexObjSlot(uint32_t addr) {
+    if (TexObjSlot* existing = FindTexObjSlot(addr)) {
+        return *existing;
+    }
+    if (g_TexObjMeta.empty()) {
+        g_TexObjMeta.reserve(kTexObjTableReserve);
+    }
+    TexObjSlot& slot = g_TexObjMeta[addr];
+    slot.objAddr = addr;
+    g_texObjSlotMemoAddr = addr;
+    g_texObjSlotMemo = &slot;
+    return slot;
+}
+
+// --- DCStoreRange interval index --------------------------------------------
+
+void RebuildTexObjIntervalsLocked() {
+    g_texObjIntervals.clear();
+    g_texObjIntervals.reserve(g_TexObjMeta.size());
+    g_texObjIntervalMaxSize = 0;
+    for (auto& entry : g_TexObjMeta) {
+        TexObjSlot& slot = entry.second;
+        slot.pendingIntervalUpdate = false;
+        TexObjIntervalEntry interval{};
+        if (TryBuildTexObjIntervalEntry(slot, interval)) {
+            g_texObjIntervalMaxSize = std::max(g_texObjIntervalMaxSize, interval.size);
+            g_texObjIntervals.push_back(interval);
+            slot.indexedDataAddr = interval.dataAddr;
+            slot.indexedSize = interval.size;
+            slot.inIntervalIndex = true;
+        } else {
+            slot.indexedDataAddr = 0;
+            slot.indexedSize = 0;
+            slot.inIntervalIndex = false;
+        }
+    }
+
+    std::sort(g_texObjIntervals.begin(), g_texObjIntervals.end(), TexObjIntervalLess);
+    g_texObjIntervalsRebuildAll = false;
+    g_texObjIntervalsPending.clear();
+}
+
+// Records that the caller is about to mutate the metadata of `slot`. The slot
+// remembers what it currently contributes to the index, so this only has to be
+// an O(1) enqueue with an O(1) dedupe - no linear scan and, critically, no
+// capacity limit that silently degrades into a full rebuild.
+void QueueTexObjIntervalUpdate(TexObjSlot& slot) {
+    if (g_texObjIntervalsRebuildAll || slot.pendingIntervalUpdate) {
+        return;
+    }
+    slot.pendingIntervalUpdate = true;
+    g_texObjIntervalsPending.push_back(&slot);
+}
+
+// Returns true when the sorted index actually had to shift elements, which is
+// the only expensive outcome. Metadata writebacks that leave the interval
+// untouched - the overwhelming majority, since GXLoadTexObj stores its metadata
+// back twice per call - cost one GXGetTexBufferSize and two compares.
+bool PatchTexObjIntervalEntryLocked(TexObjSlot& slot) {
+    TexObjIntervalEntry fresh{};
+    const bool hasFresh = TryBuildTexObjIntervalEntry(slot, fresh);
+
+    if (slot.inIntervalIndex && hasFresh && slot.indexedDataAddr == fresh.dataAddr) {
+        if (slot.indexedSize == fresh.size) {
+            return false;
+        }
+        // Same sort position, different payload: fix it up in place.
+        const auto it =
+            std::lower_bound(g_texObjIntervals.begin(), g_texObjIntervals.end(), fresh, TexObjIntervalLess);
+        if (it != g_texObjIntervals.end() && it->dataAddr == fresh.dataAddr && it->objAddr == fresh.objAddr) {
+            it->size = fresh.size;
+            it->slot = &slot;
+            slot.indexedSize = fresh.size;
+            g_texObjIntervalMaxSize = std::max(g_texObjIntervalMaxSize, fresh.size);
+            return false;
+        }
+        // Index and slot disagree; fall through and rebuild this entry.
+        slot.inIntervalIndex = false;
+    }
+
+    bool moved = false;
+    if (slot.inIntervalIndex) {
+        const TexObjIntervalEntry stale{
+            .dataAddr = slot.indexedDataAddr,
+            .size = 0,
+            .objAddr = slot.objAddr,
+            .slot = &slot,
+        };
+        const auto staleIt =
+            std::lower_bound(g_texObjIntervals.begin(), g_texObjIntervals.end(), stale, TexObjIntervalLess);
+        if (staleIt != g_texObjIntervals.end() && staleIt->dataAddr == stale.dataAddr &&
+            staleIt->objAddr == stale.objAddr) {
+            g_texObjIntervals.erase(staleIt);
+            moved = true;
+        }
+        slot.inIntervalIndex = false;
+    }
+
+    slot.indexedDataAddr = 0;
+    slot.indexedSize = 0;
+    if (!hasFresh) {
+        return moved;
+    }
+
+    const auto insertAt =
+        std::lower_bound(g_texObjIntervals.begin(), g_texObjIntervals.end(), fresh, TexObjIntervalLess);
+    g_texObjIntervals.insert(insertAt, fresh);
+    slot.indexedDataAddr = fresh.dataAddr;
+    slot.indexedSize = fresh.size;
+    slot.inIntervalIndex = true;
+    g_texObjIntervalMaxSize = std::max(g_texObjIntervalMaxSize, fresh.size);
+    return true;
+}
+
+// Each real move memmoves half the index on average, so a burst of genuine
+// relocations (a course load re-initialising thousands of texobjs) is still
+// cheaper to absorb with one rebuild.
+constexpr size_t kMaxTexObjIntervalPatchMoves = 64;
+
+void EnsureTexObjIntervalsLocked() {
+    if (g_texObjIntervalsRebuildAll) {
+        RebuildTexObjIntervalsLocked();
+        return;
+    }
+    if (g_texObjIntervalsPending.empty()) {
+        return;
+    }
+
+    size_t moves = 0;
+    for (size_t i = 0; i < g_texObjIntervalsPending.size(); ++i) {
+        TexObjSlot& slot = *g_texObjIntervalsPending[i];
+        slot.pendingIntervalUpdate = false;
+        if (PatchTexObjIntervalEntryLocked(slot)) {
+            ++moves;
+        }
+        if (moves >= kMaxTexObjIntervalPatchMoves &&
+            g_texObjIntervalsPending.size() - (i + 1) > kMaxTexObjIntervalPatchMoves) {
+            // RebuildTexObjIntervalsLocked clears every slot's pending flag and
+            // the queue itself, including the entries not visited here.
+            RebuildTexObjIntervalsLocked();
+            return;
+        }
+    }
+    g_texObjIntervalsPending.clear();
+}
+
+void EnsureTlutObjBoundsLocked() {
+    if (!g_tlutObjBoundsDirty) {
+        return;
+    }
+
+    uint64_t boundsStart = std::numeric_limits<uint64_t>::max();
+    uint64_t boundsEnd = 0;
+    for (const auto& [objAddr, meta] : g_TlutObjMeta) {
+        (void)objAddr;
+        if (meta.dataAddr == 0 || meta.entries == 0 || !IsKnownTlutFormat(meta.format)) {
+            continue;
+        }
+        const uint64_t tlutStart = CanonicalizeGxMainRamAddress(meta.dataAddr);
+        const uint64_t tlutEnd = tlutStart + static_cast<uint64_t>(meta.entries) * 2u;
+        boundsStart = std::min(boundsStart, tlutStart);
+        boundsEnd = std::max(boundsEnd, tlutEnd);
+    }
+    if (boundsStart >= boundsEnd) {
+        boundsStart = 0;
+        boundsEnd = 0;
+    }
+
+    g_tlutObjBoundsStart = boundsStart;
+    g_tlutObjBoundsEnd = boundsEnd;
+    g_tlutObjBoundsDirty = false;
+}
+
+bool TexObjBackingDiffers(const TexObjMeta& lhs, const TexObjMeta& rhs) {
+    return CanonicalizeGxMainRamAddress(lhs.dataAddr) != CanonicalizeGxMainRamAddress(rhs.dataAddr) ||
+           lhs.width != rhs.width ||
+           lhs.height != rhs.height ||
+           lhs.format != rhs.format ||
+           lhs.mipmap != rhs.mipmap ||
+           lhs.maxLod != rhs.maxLod;
+}
+
+bool TexObjMetaDiffers(const TexObjMeta& lhs, const TexObjMeta& rhs) {
+    return CanonicalizeGxMainRamAddress(lhs.dataAddr) != CanonicalizeGxMainRamAddress(rhs.dataAddr) ||
+           lhs.width != rhs.width ||
+           lhs.height != rhs.height ||
+           lhs.format != rhs.format ||
+           lhs.wrapS != rhs.wrapS ||
+           lhs.wrapT != rhs.wrapT ||
+           lhs.mipmap != rhs.mipmap ||
+           lhs.minFilter != rhs.minFilter ||
+           lhs.magFilter != rhs.magFilter ||
+           lhs.minLod != rhs.minLod ||
+           lhs.maxLod != rhs.maxLod ||
+           lhs.lodBias != rhs.lodBias ||
+           lhs.biasClamp != rhs.biasClamp ||
+           lhs.edgeLod != rhs.edgeLod ||
+           lhs.maxAniso != rhs.maxAniso ||
+           lhs.tlut != rhs.tlut ||
+           lhs.userData != rhs.userData;
+}
+
+TexObjMeta MergeGuestTexObjMeta(const TexObjMeta& cached, const TexObjMeta& guest) {
+    TexObjMeta merged = guest;
+    merged.needsUpload = cached.needsUpload;
+    if (TexObjBackingDiffers(cached, guest)) {
+        merged.needsUpload = true;
+    }
+    return merged;
+}
+
+// Reads the raw 32 guest bytes of a GXTexObj struct. Returns false (and the
+// caller must treat the shadow as absent) when the address is unreadable.
+bool ReadTexObjShadow(uint32_t addr, uint64_t (&out)[4]) noexcept {
+    try {
+        out[0] = Memory::Read64(addr + 0x00);
+        out[1] = Memory::Read64(addr + 0x08);
+        out[2] = Memory::Read64(addr + 0x10);
+        out[3] = Memory::Read64(addr + 0x18);
+    } catch (...) {
+        return false;
+    }
+    return true;
+}
+
+bool ShadowEquals(const uint64_t (&a)[4], const uint64_t (&b)[4]) noexcept {
+    return a[0] == b[0] && a[1] == b[1] && a[2] == b[2] && a[3] == b[3];
+}
+
+// Captures the current guest bytes as the slot's shadow so the cache is marked in sync. HLE
+// GXInitTexObj* callers fetch the meta reference before rewriting guest memory, so their capture
+// is intentionally stale; the next lookup just re-decodes once, which is the safe direction.
+void MarkTexObjSyncedLocked(TexObjSlot& slot) noexcept {
+    slot.hasGuestShadow = ReadTexObjShadow(slot.objAddr, slot.guestShadow);
+}
+
+} // namespace
+
+bool TryGetOrExtractTexObjMeta(uint32_t addr, TexObjMeta& outMeta) {
+    TexObjSlot* slot = FindTexObjSlot(addr);
+    if (slot != nullptr) {
+        const bool cachedUsable = IsUsableTexObjMeta(*slot);
+        if (cachedUsable) {
+            // Fast path: guest bytes are byte-identical to what the cache was decoded from. The
+            // full 32-byte compare (not a generation stamp) is what catches plain guest stores
+            // over the struct that never issue a cache op; see TexObjSlot::guestShadow.
+            uint64_t shadow[4];
+            if (ReadTexObjShadow(addr, shadow) && slot->hasGuestShadow &&
+                ShadowEquals(slot->guestShadow, shadow)) {
+                outMeta = *slot;
+                return true;
+            }
+
+            const TexObjMeta extracted = ExtractTexObjMetaFromGuest(addr);
+            if (IsUsableTexObjMeta(extracted) && TexObjMetaDiffers(*slot, extracted)) {
+                // The caller writes the merged result back through
+                // GetTexObjMeta, which is what re-establishes the sync.
+                outMeta = MergeGuestTexObjMeta(*slot, extracted);
+                return true;
+            }
+            MarkTexObjSyncedLocked(*slot);
+            outMeta = *slot;
+            return true;
+        }
+        // Cached metadata can be created early (e.g., by LOD/filter calls) before
+        // full InitTexObj has populated dimensions/address. Re-extract from guest
+        // memory in that case instead of propagating the stale zeroed entry.
+        TexObjMeta extracted = ExtractTexObjMetaFromGuest(addr);
+        const bool extractedUsable = IsUsableTexObjMeta(extracted);
+        if (extractedUsable) {
+            QueueTexObjIntervalUpdate(*slot);
+            static_cast<TexObjMeta&>(*slot) = extracted;
+            MarkTexObjSyncedLocked(*slot);
+            outMeta = extracted;
+            return true;
+        }
+        // Keep legacy behavior for callers that still want to inspect invalid meta.
+        outMeta = *slot;
+        return true;
+    }
+    // No slot yet: decode the guest struct without creating one, exactly as
+    // before. The first GXLoadTexObj writeback is what materialises the slot.
+    outMeta = ExtractTexObjMetaFromGuest(addr);
+    if (outMeta.width > 0 && outMeta.height > 0) {
+        return true;
+    }
+    return false;
+}
+
+// Single choke point for texobj metadata writes: callers mutate the returned reference, so this
+// queues the interval-index patch and re-captures the guest shadow before that happens.
+TexObjMeta& GetTexObjMeta(uint32_t addr) {
+    TexObjSlot& slot = FindOrCreateTexObjSlot(addr);
+    QueueTexObjIntervalUpdate(slot);
+    MarkTexObjSyncedLocked(slot);
+    return slot;
+}
+
+// Same contract as GetTexObjMeta: the caller mutates the returned reference, so
+// the cached TLUT address bounds have to be recomputed before the next flush.
+TlutObjMeta& GetTlutObjMeta(uint32_t addr) {
+    g_tlutObjBoundsDirty = true;
+    return g_TlutObjMeta[addr];
+}
+
+GXTexObj* GetHostTexObj(uint32_t addr) {
+    TexObjSlot* slot = FindTexObjSlot(addr);
+    if (slot == nullptr || !slot->host || !slot->host->constructed) {
+        const CpuContext* cpu = TryGetCpuContext();
+        RT_LOGF(RT_TAG_GX,
+                "GXTex: invalid GXTexObj @0x%08X (PC=0x%08X, LR=0x%08X, CTR=0x%08X)\n",
+                addr, cpu ? cpu->pc : 0u, cpu ? cpu->lr : 0u, cpu ? cpu->ctr : 0u);
+        std::fflush(stderr);
+        GXTexObj* obj = CreateHostTexObj(addr);
+        MarkHostTexObjConstructed(addr);
+        return obj;
+    }
+    return slot->host->PublicPtr();
+}
+
+GXTexObj* CreateHostTexObj(uint32_t addr) {
+    TexObjSlot& slot = FindOrCreateTexObjSlot(addr);
+    // GXInitTexObj/GXInitTexObjCI land here and rewrite the entire guest struct,
+    // resetting the LOD/filter words the HLE does not mirror into this cache.
+    // The shadow captured before that rewrite mismatches afterwards, so the
+    // next lookup takes exactly one guest re-decode and picks those defaults
+    // (and the computed mipmap maxLod) up.
+    if (!slot.host) {
+        slot.host = std::make_unique<HleTexObj>();
+    } else {
+        slot.host->Destroy();
+    }
+    slot.host->EnsureStorageLive();
+    return slot.host->PublicPtr();
+}
+
+void MarkHostTexObjConstructed(uint32_t addr) {
+    TexObjSlot* slot = FindTexObjSlot(addr);
+    if (slot != nullptr && slot->host) {
+        slot->host->constructed = true;
+    }
+}
+
+GXTexObj* TryGetHostTexObj(uint32_t addr) {
+    TexObjSlot* slot = FindTexObjSlot(addr);
+    if (slot != nullptr && slot->host && slot->host->constructed) {
+        return slot->host->PublicPtr();
+    }
+    return nullptr;
+}
+
+void MarkTexObjsDirtyForRange(uint32_t addr, uint32_t size) {
+    if (size == 0) {
+        return;
+    }
+
+    // Do this even when no GXTexObj currently describes the range. Games
+    // commonly fill and flush a newly recycled heap block before constructing
+    // its texture object; the flush is the only authoritative indication that
+    // an older GPU-only EFB copy at that address is no longer the source.
+    InvalidateEfbCopyDestinationsForRange(addr, size);
+
+    const uint64_t dirtyStart = CanonicalizeGxMainRamAddress(addr);
+    const uint64_t dirtyEnd = dirtyStart + size;
+    std::lock_guard<std::mutex> guard(g_texObjMutex);
+
+    EnsureTexObjIntervalsLocked();
+    const auto lower = std::lower_bound(
+        g_texObjIntervals.begin(), g_texObjIntervals.end(), static_cast<uint32_t>(dirtyStart),
+        [](const TexObjIntervalEntry& entry, uint32_t key) { return entry.dataAddr < key; });
+
+    for (auto it = lower; it != g_texObjIntervals.begin();) {
+        --it;
+        const uint64_t texStart = it->dataAddr;
+        if (texStart + g_texObjIntervalMaxSize <= dirtyStart) {
+            // No entry at or left of this start can reach dirtyStart anymore.
+            break;
+        }
+        const uint64_t texEnd = texStart + it->size;
+        if (texEnd <= dirtyStart) {
+            // This entry falls short, but an earlier-starting, larger one may
+            // still overlap: keep walking until the max-size bound proves
+            // otherwise.
+            continue;
+        }
+        it->slot->needsUpload = true;
+    }
+
+    for (auto it = lower; it != g_texObjIntervals.end(); ++it) {
+        const uint64_t texStart = it->dataAddr;
+        if (texStart >= dirtyEnd) {
+            break;
+        }
+        it->slot->needsUpload = true;
+    }
+}
+
+// Defined in gx_dl.cpp.
+extern "C" void GxNotifyDisplayListMemoryWrite(uint32_t addr, uint32_t size);
+
+// Single entry point for DMA-class host writes into guest RAM (DVD reads, DCZeroRange, locked
+// cache stores) that the SDK brackets with DCInvalidateRange rather than a flush, so the normal
+// DC flush/store interceptors never see them. Without this call, GX caches keyed on guest bytes
+// keep serving stale contents and a reloaded track reuses old texture pixels at the same address.
+extern "C" void GxNotifyGuestRamDmaWrite(uint32_t addr, uint32_t size) {
+    if (size == 0) {
+        return;
+    }
+    MarkTexObjsDirtyForRange(addr, size);
+    MarkTlutObjsDirtyForRange(addr, size);
+    GxNotifyDisplayListMemoryWrite(addr, size);
+}
+
+GXTlutObj* CreateHostTlutObj(uint32_t addr) {
+    auto& slot = g_HostTlutObjMap[addr];
+    if (!slot) {
+        slot = std::make_unique<HleTlutObj>();
+    } else {
+        slot->Destroy();
+    }
+    slot->EnsureStorageLive();
+    return slot->PublicPtr();
+}
+
+void MarkHostTlutObjConstructed(uint32_t addr) {
+    auto it = g_HostTlutObjMap.find(addr);
+    if (it != g_HostTlutObjMap.end() && it->second) {
+        it->second->constructed = true;
+    }
+}
+
+GXTlutObj* GetHostTlutObj(uint32_t addr) {
+    auto it = g_HostTlutObjMap.find(addr);
+    if (it == g_HostTlutObjMap.end() || !it->second || !it->second->constructed) {
+        const CpuContext* cpu = TryGetCpuContext();
+        RT_LOGF(RT_TAG_GX,
+                "GXTex: invalid GXTlutObj @0x%08X (PC=0x%08X, LR=0x%08X, CTR=0x%08X)\n",
+                addr, cpu ? cpu->pc : 0u, cpu ? cpu->lr : 0u, cpu ? cpu->ctr : 0u);
+        std::fflush(stderr);
+        GXTlutObj* obj = CreateHostTlutObj(addr);
+        MarkHostTlutObjConstructed(addr);
+        return obj;
+    }
+    return it->second->PublicPtr();
+}
+
+void MarkTlutObjsDirtyForRange(uint32_t addr, uint32_t size) {
+    if (size == 0) {
+        return;
+    }
+
+    const uint64_t dirtyStart = CanonicalizeGxMainRamAddress(addr);
+    const uint64_t dirtyEnd = dirtyStart + size;
+    std::lock_guard<std::mutex> guard(g_tlutObjMutex);
+    EnsureTlutObjBoundsLocked();
+    // Most DCStoreRange calls flush small material/vertex buffers that live
+    // nowhere near a palette, so reject them without walking the map.
+    if (g_tlutObjBoundsStart >= g_tlutObjBoundsEnd ||
+        dirtyEnd <= g_tlutObjBoundsStart ||
+        dirtyStart >= g_tlutObjBoundsEnd) {
+        return;
+    }
+    for (auto& [objAddr, meta] : g_TlutObjMeta) {
+        if (meta.dataAddr == 0 || meta.entries == 0 || !IsKnownTlutFormat(meta.format)) {
+            continue;
+        }
+
+        const uint64_t tlutStart = CanonicalizeGxMainRamAddress(meta.dataAddr);
+        const uint64_t tlutEnd = tlutStart + static_cast<uint64_t>(meta.entries) * 2u;
+        if (dirtyEnd <= tlutStart || dirtyStart >= tlutEnd) {
+            continue;
+        }
+
+        meta.dirty = true;
+    }
+}
diff --git a/runtime/src/hle/gx/gx_pixel.cpp b/runtime/src/hle/gx/gx_pixel.cpp
new file mode 100644
index 0000000..8866ab1
--- /dev/null
+++ b/runtime/src/hle/gx/gx_pixel.cpp
@@ -0,0 +1,88 @@
+// gx_pixel.cpp - Pixel Processing, Blending, and Fog
+#include "gx_internal.h"
+
+// ============================================================================
+// Blend Mode
+// ============================================================================
+
+extern "C" void GX__SetBlendMode_8017277c(uint32_t t, uint32_t s, uint32_t d, uint32_t op) {
+    GXSetBlendMode(static_cast<GXBlendMode>(t), static_cast<GXBlendFactor>(s),
+                   static_cast<GXBlendFactor>(d), static_cast<GXLogicOp>(op));
+}
+PPC_NATIVE_OVERRIDE_VOID(8017277c, GX__SetBlendMode_8017277c, (uint32_t t, uint32_t s, uint32_t d, uint32_t op), (t, s, d, op));
+
+extern "C" void GX__SetColorUpdate_801727cc(uint32_t en) {
+    GXSetColorUpdate(static_cast<GXBool>(en));
+}
+PPC_NATIVE_OVERRIDE_VOID(801727cc, GX__SetColorUpdate_801727cc, (uint32_t en), (en));
+
+extern "C" void GX__SetAlphaUpdate_801727f8(uint32_t en) {
+    GXSetAlphaUpdate(static_cast<GXBool>(en));
+}
+PPC_NATIVE_OVERRIDE_VOID(801727f8, GX__SetAlphaUpdate_801727f8, (uint32_t en), (en));
+
+// ============================================================================
+// Z Buffer
+// ============================================================================
+
+extern "C" void GX__SetZMode_80172824(uint32_t ce, uint32_t f, uint32_t ue) {
+    GXSetZMode(static_cast<GXBool>(ce), static_cast<GXCompare>(f), static_cast<GXBool>(ue));
+}
+PPC_NATIVE_OVERRIDE_VOID(80172824, GX__SetZMode_80172824, (uint32_t ce, uint32_t f, uint32_t ue), (ce, f, ue));
+
+extern "C" void GX__SetZCompLoc_80172858(uint32_t bt) {
+    GXSetZCompLoc(static_cast<GXBool>(bt));
+}
+PPC_NATIVE_OVERRIDE_VOID(80172858, GX__SetZCompLoc_80172858, (uint32_t bt), (bt));
+
+// ============================================================================
+// Pixel Format and Dither
+// ============================================================================
+
+extern "C" void GX__SetPixelFmt_80172888(uint32_t pf, uint32_t zf) {
+    GXSetPixelFmt(static_cast<GXPixelFmt>(pf), static_cast<GXZFmt16>(zf));
+}
+PPC_NATIVE_OVERRIDE_VOID(80172888, GX__SetPixelFmt_80172888, (uint32_t pf, uint32_t zf), (pf, zf));
+
+extern "C" void GX__SetDither_80172930(uint32_t d) {
+    GXSetDither(static_cast<GXBool>(d));
+}
+PPC_NATIVE_OVERRIDE_VOID(80172930, GX__SetDither_80172930, (uint32_t d), (d));
+
+extern "C" void GX__SetDstAlpha_8017295c(uint32_t en, uint32_t a) {
+    GXSetDstAlpha(static_cast<GXBool>(en), static_cast<u8>(a));
+}
+PPC_NATIVE_OVERRIDE_VOID(8017295c, GX__SetDstAlpha_8017295c, (uint32_t en, uint32_t a), (en, a));
+
+// ============================================================================
+// Fog and Alpha Compare
+// ============================================================================
+
+extern "C" void GX__SetFog_801722cc(uint32_t t, float sz, float ez, float nz, float fz, uint32_t cp) {
+    GXSetFog((GXFogType)t, sz, ez, nz, fz, DecodeGxColor(Memory::Read32(cp)));
+}
+PPC_NATIVE_OVERRIDE_VOID(801722cc, GX__SetFog_801722cc, (uint32_t t, float sz, float ez, float nz, float fz, uint32_t cp), (t, sz, ez, nz, fz, cp));
+
+extern "C" void GX__SetAlphaCompare_80172088(uint32_t c0, uint32_t r0, uint32_t op, uint32_t c1, uint32_t r1) {
+    g_alphaCompareValid = true;
+    GXSetAlphaCompare((GXCompare)c0, (u8)r0, (GXAlphaOp)op, (GXCompare)c1, (u8)r1);
+}
+PPC_NATIVE_OVERRIDE_VOID(80172088, GX__SetAlphaCompare_80172088, (uint32_t c0, uint32_t r0, uint32_t op, uint32_t c1, uint32_t r1), (c0, r0, op, c1, r1));
+
+extern "C" void GX__SetZTexture_801720c0(uint32_t op, uint32_t f, uint32_t b) { GXSetZTexture((GXZTexOp)op, (GXTexFmt)f, b); }
+PPC_NATIVE_OVERRIDE_VOID(801720c0, GX__SetZTexture_801720c0, (uint32_t op, uint32_t f, uint32_t b), (op, f, b));
+
+// ============================================================================
+// Culling and Clipping
+// ============================================================================
+
+extern "C" void GX__SetCullMode_8016f3b8(uint32_t m) {
+    GXSetCullMode(static_cast<GXCullMode>(m));
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f3b8, GX__SetCullMode_8016f3b8, (uint32_t m), (m));
+
+extern "C" void GX__SetCoPlanar_8016f3e0(uint32_t en) { GXSetCoPlanar((GXBool)en); }
+PPC_NATIVE_OVERRIDE_VOID(8016f3e0, GX__SetCoPlanar_8016f3e0, (uint32_t en), (en));
+
+extern "C" void GX__SetClipMode_8017351c(uint32_t m) { GXSetClipMode((GXClipMode)m); }
+PPC_NATIVE_OVERRIDE_VOID(8017351c, GX__SetClipMode_8017351c, (uint32_t m), (m));
diff --git a/runtime/src/hle/gx/gx_stream_common.h b/runtime/src/hle/gx/gx_stream_common.h
new file mode 100644
index 0000000..006ab47
--- /dev/null
+++ b/runtime/src/hle/gx/gx_stream_common.h
@@ -0,0 +1,390 @@
+#pragma once
+
+#include "isa/big_endian.h"
+#include "gx_internal.h"
+
+// Shared GX command-stream helpers used verbatim by gx_fifo.cpp, gx_dl.cpp and gx_vertex.cpp
+// instead of forked per-file copies; genuine per-caller differences are explicit parameters here.
+// Header-inline throughout: the shipped clang/llvm-mingw build has no LTO across runtime shards,
+// so a non-inline hot helper becomes a real call on the per-vertex path.
+
+namespace GxCmd {
+
+constexpr uint8_t GX_NOP_CMD         = 0x00;
+constexpr uint8_t GX_LOAD_CP_REG_CMD = 0x08;
+constexpr uint8_t GX_LOAD_XF_REG_CMD = 0x10;
+constexpr uint8_t GX_LOAD_INDX_A_CMD = 0x20;
+constexpr uint8_t GX_LOAD_INDX_D_CMD = 0x38;
+constexpr uint8_t GX_CMD_CALL_DL_CMD = 0x40;
+constexpr uint8_t GX_CMD_INVL_VC_CMD = 0x48;
+constexpr uint8_t GX_LOAD_BP_REG_CMD = 0x61;
+constexpr uint8_t GX_OPCODE_MASK_CMD = 0xF8;
+constexpr uint8_t GX_VAT_MASK_CMD    = 0x07;
+
+constexpr uint8_t GX_DRAW_QUADS_CMD          = 0x80;
+// 0x88 is the second quad opcode (GX_DRAW_QUADS_2). Real hardware treats it as
+// GX_QUADS as well, and MKW's nw4r shape lists do emit it.
+constexpr uint8_t GX_DRAW_QUADS_2_CMD        = 0x88;
+constexpr uint8_t GX_DRAW_TRIANGLES_CMD      = 0x90;
+constexpr uint8_t GX_DRAW_TRIANGLE_STRIP_CMD = 0x98;
+constexpr uint8_t GX_DRAW_TRIANGLE_FAN_CMD   = 0xA0;
+constexpr uint8_t GX_DRAW_LINES_CMD          = 0xA8;
+constexpr uint8_t GX_DRAW_LINE_STRIP_CMD     = 0xB0;
+constexpr uint8_t GX_DRAW_POINTS_CMD         = 0xB8;
+
+} // namespace GxCmd
+
+namespace GxStream {
+
+// --- Big-endian scalar reads out of a command stream ---------------------
+
+inline uint16_t ReadBE16(const uint8_t* ptr) { return BigEndian::Read16(ptr); }
+inline uint32_t ReadBE32(const uint8_t* ptr) { return BigEndian::Read32(ptr); }
+inline float ReadBEF32(const uint8_t* ptr) { return BigEndian::ReadFloat32(ptr); }
+
+// --- Draw opcodes ---------------------------------------------------------
+
+inline GXPrimitive OpcodeToGXPrimitive(uint8_t opcode) {
+    switch (opcode & GxCmd::GX_OPCODE_MASK_CMD) {
+    case GxCmd::GX_DRAW_QUADS_CMD: return GX_QUADS;
+    case GxCmd::GX_DRAW_QUADS_2_CMD: return GX_QUADS;
+    case GxCmd::GX_DRAW_TRIANGLES_CMD: return GX_TRIANGLES;
+    case GxCmd::GX_DRAW_TRIANGLE_STRIP_CMD: return GX_TRIANGLESTRIP;
+    case GxCmd::GX_DRAW_TRIANGLE_FAN_CMD: return GX_TRIANGLEFAN;
+    case GxCmd::GX_DRAW_LINES_CMD: return GX_LINES;
+    case GxCmd::GX_DRAW_LINE_STRIP_CMD: return GX_LINESTRIP;
+    case GxCmd::GX_DRAW_POINTS_CMD: return GX_POINTS;
+    default: return GX_TRIANGLES;
+    }
+}
+
+inline bool IsDrawOpcode(uint8_t opcode) {
+    switch (opcode & GxCmd::GX_OPCODE_MASK_CMD) {
+    case GxCmd::GX_DRAW_QUADS_CMD:
+    case GxCmd::GX_DRAW_QUADS_2_CMD:
+    case GxCmd::GX_DRAW_TRIANGLES_CMD:
+    case GxCmd::GX_DRAW_TRIANGLE_STRIP_CMD:
+    case GxCmd::GX_DRAW_TRIANGLE_FAN_CMD:
+    case GxCmd::GX_DRAW_LINES_CMD:
+    case GxCmd::GX_DRAW_LINE_STRIP_CMD:
+    case GxCmd::GX_DRAW_POINTS_CMD:
+        return true;
+    default:
+        return false;
+    }
+}
+
+// --- Vertex layout --------------------------------------------------------
+
+// GX_NRM_NBT3 is the one normal format whose indexed form carries three
+// separate indices (normal, binormal, tangent) instead of one.
+inline uint32_t NormalIndexCount(const VtxAttrFmt& fmt) {
+    return fmt.cnt == GX_NRM_NBT3 ? 3u : 1u;
+}
+
+// Fixed-point fraction the CP applies to normals; it is implied by the
+// component type instead of being carried in the VAT.
+inline uint8_t NormalFracBits(GXCompType type) {
+    switch (type) {
+    case GX_U8:
+        return 7;
+    case GX_S8:
+        return 6;
+    case GX_U16:
+        return 15;
+    case GX_S16:
+        return 14;
+    default:
+        return 0;
+    }
+}
+
+// Components per attribute. `fallback` is what the attributes with no
+// component layout (matrix indices, the XF array pseudo-attributes, GX_VA_NBT)
+// report: the FIFO direct-size path treats them as one component, everything
+// else treats them as "not a component attribute" and passes 0.
+inline uint32_t AttrCompCount(GXAttr attr, const VtxAttrFmt& fmt, uint32_t fallback) {
+    switch (attr) {
+    case GX_VA_POS:
+        return (fmt.cnt == GX_POS_XY) ? 2u : 3u;
+    case GX_VA_NRM:
+        return (fmt.cnt == GX_NRM_NBT || fmt.cnt == GX_NRM_NBT3) ? 9u : 3u;
+    case GX_VA_CLR0:
+    case GX_VA_CLR1:
+        return (fmt.cnt == GX_CLR_RGB) ? 3u : 4u;
+    case GX_VA_TEX0: case GX_VA_TEX1: case GX_VA_TEX2: case GX_VA_TEX3:
+    case GX_VA_TEX4: case GX_VA_TEX5: case GX_VA_TEX6: case GX_VA_TEX7:
+        return (fmt.cnt == GX_TEX_S) ? 1u : 2u;
+    default:
+        return fallback;
+    }
+}
+
+// Stream footprint of one direct color component. Note GX_RGBX8 occupies four
+// bytes but only three of them are decoded.
+inline uint32_t ColorByteSize(GXCompType type, GXCompCnt cnt) {
+    switch (type) {
+    case GX_RGB565: return 2u;
+    case GX_RGB8:   return 3u;
+    case GX_RGBX8:  return 4u;
+    case GX_RGBA4:  return 2u;
+    case GX_RGBA6:  return 3u;
+    case GX_RGBA8:  return 4u;
+    default:        return (cnt == GX_CLR_RGB) ? 3u : 4u;
+    }
+}
+
+// Stream footprint of one GX_DIRECT attribute. `matrixAttrIsOneByte` distinguishes callers that
+// walk a vertex end to end (CalcDLVertexSize, the FIFO direct-size probe) and must count the
+// matrix index byte, from callers that only size component attributes and handle matrix attributes
+// themselves, so must see 0. `fallbackComps` does the same for attributes with no component layout.
+inline uint32_t DirectAttrByteSize(GXAttr attr, const VtxAttrFmt& fmt, bool matrixAttrIsOneByte,
+                                   uint32_t fallbackComps) {
+    if (IsMatrixIndexAttr(attr)) {
+        return matrixAttrIsOneByte ? 1u : 0u;
+    }
+    if (attr == GX_VA_CLR0 || attr == GX_VA_CLR1) {
+        return ColorByteSize(fmt.type, fmt.cnt);
+    }
+    return AttrCompCount(attr, fmt, fallbackComps) * static_cast<uint32_t>(GetCompSizeBytes(fmt.type));
+}
+
+// --- Colors ---------------------------------------------------------------
+
+// Decodes one direct/indexed color out of guest big-endian bytes. `src` must hold the bytes the
+// format actually reads (see ColorByteSize; GX_RGBX8 reads three of its four). `out.a` is written
+// even for GX_CLR_RGB formats, where every caller drops it (GXColor3u8) so the value is unobservable.
+inline void DecodeColorBytes(const uint8_t* src, GXCompType type, GXCompCnt cnt, GXColor& out) {
+    switch (type) {
+    case GX_RGB565: {
+        const uint16_t packed = ReadBE16(src);
+        out.r = static_cast<uint8_t>(((packed >> 11) & 0x1F) * 255 / 31);
+        out.g = static_cast<uint8_t>(((packed >> 5) & 0x3F) * 255 / 63);
+        out.b = static_cast<uint8_t>((packed & 0x1F) * 255 / 31);
+        out.a = 0xFF;
+        break;
+    }
+    case GX_RGB8:
+    case GX_RGBX8:
+        out.r = src[0];
+        out.g = src[1];
+        out.b = src[2];
+        out.a = 0xFF;
+        break;
+    case GX_RGBA4: {
+        const uint16_t packed = ReadBE16(src);
+        out.r = static_cast<uint8_t>(((packed >> 12) & 0xF) * 17);
+        out.g = static_cast<uint8_t>(((packed >> 8) & 0xF) * 17);
+        out.b = static_cast<uint8_t>(((packed >> 4) & 0xF) * 17);
+        out.a = static_cast<uint8_t>((packed & 0xF) * 17);
+        break;
+    }
+    case GX_RGBA6: {
+        const uint32_t packed = (static_cast<uint32_t>(src[0]) << 16) |
+                                (static_cast<uint32_t>(src[1]) << 8) |
+                                static_cast<uint32_t>(src[2]);
+        out.r = static_cast<uint8_t>(((packed >> 18) & 0x3F) * 255 / 63);
+        out.g = static_cast<uint8_t>(((packed >> 12) & 0x3F) * 255 / 63);
+        out.b = static_cast<uint8_t>(((packed >> 6) & 0x3F) * 255 / 63);
+        out.a = static_cast<uint8_t>((packed & 0x3F) * 255 / 63);
+        break;
+    }
+    case GX_RGBA8:
+        out.r = src[0];
+        out.g = src[1];
+        out.b = src[2];
+        out.a = src[3];
+        break;
+    default:
+        out.r = src[0];
+        out.g = src[1];
+        out.b = src[2];
+        out.a = (cnt == GX_CLR_RGBA) ? src[3] : 0xFF;
+        break;
+    }
+}
+
+// --- Components -----------------------------------------------------------
+
+// The one fixed-point conversion table. GX_F32 is a bit pattern, never scaled;
+// every other type is an integer scaled by the VAT's fractional bit count.
+inline float ConvertCompToFloat(u32 raw, GXCompType type, uint8_t frac) {
+    if (type == GX_F32) {
+        float value;
+        std::memcpy(&value, &raw, sizeof(value));
+        return value;
+    }
+    float value = 0.0f;
+    switch (type) {
+    case GX_U8:  value = static_cast<float>(static_cast<u8>(raw)); break;
+    case GX_S8:  value = static_cast<float>(static_cast<s8>(raw)); break;
+    case GX_U16: value = static_cast<float>(static_cast<u16>(raw)); break;
+    case GX_S16: value = static_cast<float>(static_cast<s16>(raw)); break;
+    default:     value = static_cast<float>(raw); break;
+    }
+    if (frac > 0) {
+        value /= static_cast<float>(1u << frac);
+    }
+    return value;
+}
+
+// Raw (unconverted, host-endian) component out of a command stream.
+inline u32 ReadBECompRaw(const uint8_t* ptr, GXCompType type) {
+    switch (type) {
+    case GX_U8:
+    case GX_S8:
+        return ptr[0];
+    case GX_U16:
+    case GX_S16:
+        return ReadBE16(ptr);
+    case GX_F32:
+        return ReadBE32(ptr);
+    default:
+        return ptr[0];
+    }
+}
+
+// Raw component out of a guest vertex array.
+inline u32 ReadArrayRawComp(uint32_t addr, GXCompType type) {
+    switch (type) {
+    case GX_U8:
+    case GX_S8:
+        return Memory::Read8(addr);
+    case GX_U16:
+    case GX_S16:
+        return Memory::Read16(addr);
+    case GX_F32:
+        return Memory::Read32(addr);
+    default:
+        return Memory::Read8(addr);
+    }
+}
+
+inline float ReadArrayComp(uint32_t addr, GXCompType type, uint8_t frac) {
+    return ConvertCompToFloat(ReadArrayRawComp(addr, type), type, frac);
+}
+
+inline float ReadStreamComp(const uint8_t* ptr, GXCompType type, uint8_t frac) {
+    return ConvertCompToFloat(ReadBECompRaw(ptr, type), type, frac);
+}
+
+// --- Indexed attributes ---------------------------------------------------
+
+// GX_NRM_NBT3 indexed normals: three indices, each selecting one 3-component
+// group, submitted as a single 9-component normal attribute.
+inline void SubmitIndexedNormalNBT3(const uint32_t indices[3], const VtxAttrFmt& fmt) {
+    const auto& arr = g_hleGxState.vtxArray[GX_VA_NRM];
+    if (arr.base == 0 || arr.stride == 0) {
+        SubmitIndexedAttribute(GX_VA_NRM, indices[0]);
+        return;
+    }
+
+    const uint32_t step = static_cast<uint32_t>(GetCompSizeBytes(fmt.type));
+    float comps[9]{};
+    u32 rawComps[9]{};
+    for (uint32_t group = 0; group < 3; ++group) {
+        uint32_t addr = arr.base + indices[group] * arr.stride;
+        for (uint32_t component = 0; component < 3; ++component, addr += step) {
+            const uint32_t out = group * 3u + component;
+            comps[out] = ReadArrayComp(addr, fmt.type, fmt.frac);
+            rawComps[out] = ReadArrayRawComp(addr, fmt.type);
+        }
+    }
+    SubmitAttribute(GX_VA_NRM, comps, fmt, rawComps);
+}
+
+// Repacks a strided guest array into a tightly packed host copy. Only needed
+// for strides aurora's GXSetArray cannot express (> 255 bytes).
+inline bool PackIndexedAttrData(const uint8_t* srcBase, uint32_t stride, uint32_t count,
+                                uint32_t elemSize, std::vector<uint8_t>& out) {
+    if (elemSize == 0 || count == 0) return false;
+    out.resize(static_cast<size_t>(count) * elemSize);
+    for (uint32_t i = 0; i < count; ++i) {
+        const uint8_t* src = srcBase + static_cast<size_t>(i) * stride;
+        uint8_t* dst = out.data() + static_cast<size_t>(i) * elemSize;
+        std::memcpy(dst, src, elemSize);
+    }
+    return true;
+}
+
+// Binds the guest XF array (position/normal matrices, lights) a GX_LOAD_INDX_*
+// packet indexes into, so aurora can resolve the index itself.
+inline bool ApplyIndexedXfArrayForPacket(uint8_t cmd, uint32_t value) {
+    const int attr = GX_POS_MTX_ARRAY +
+                     (((cmd & GxCmd::GX_OPCODE_MASK_CMD) - GxCmd::GX_LOAD_INDX_A_CMD) / 0x08);
+    if (attr < GX_POS_MTX_ARRAY || attr > GX_LIGHT_ARRAY) {
+        return false;
+    }
+
+    const uint32_t index = value >> 16;
+    const uint32_t bytes = (((value >> 12) & 0x0fu) + 1u) * 4u;
+    const auto& arr = g_hleGxState.vtxArray[attr];
+    if (arr.base == 0 || arr.stride == 0 || arr.stride > 0xffu || bytes == 0) {
+        return false;
+    }
+
+    const uint32_t span = index * arr.stride + bytes;
+    if (!Memory::Contains(arr.base, span)) {
+        return false;
+    }
+
+    const auto* hostPtr = static_cast<const uint8_t*>(GuestToHostPtr(arr.base, span));
+    if (!hostPtr) {
+        return false;
+    }
+
+    GXSetArray(static_cast<GXAttr>(attr), hostPtr, span, static_cast<uint8_t>(arr.stride));
+    return true;
+}
+
+// --- Render state ---------------------------------------------------------
+
+// Draw paths that bypass the guest's own GXSetAlphaCompare (raw FIFO packets,
+// synthesized lyt quads) must not inherit whatever aurora happened to hold.
+inline void EnsureDefaultGxAlphaCompare() {
+    if (g_alphaCompareValid) {
+        return;
+    }
+    g_alphaCompareValid = true;
+    GXSetAlphaCompare(GX_ALWAYS, 0, GX_AOP_AND, GX_ALWAYS, 0);
+}
+
+// --- Vertex descriptor publication ---------------------------------------
+
+// The three publish sites are NOT semantically identical and are deliberately not merged: only
+// raw-FIFO publishes GX_VA_NBT (includeNbt), and immediate-mode only republishes VAT rows
+// GX_VA_POS..GX_VA_TEX7 (fmtLoopFirst/Last). Indexed attributes always report GX_DIRECT here since
+// all three sites expand them into the direct stream themselves before aurora sees them.
+struct AuroraVtxPublishOptions {
+    bool includeNbt;
+    int fmtLoopFirst;
+    int fmtLoopLast;
+};
+
+inline void PublishAuroraVtxState(GXVtxFmt fmt, const AuroraVtxPublishOptions& options) {
+    for (int attr = 0; attr < 26; ++attr) {
+        if (!options.includeNbt && attr == GX_VA_NBT) {
+            continue;
+        }
+        const GXAttr gxAttr = static_cast<GXAttr>(attr);
+        GXAttrType type = g_hleGxState.vtxDesc[attr];
+        if (type == GX_INDEX8 || type == GX_INDEX16) {
+            type = GX_DIRECT;
+        }
+        GXSetVtxDesc(gxAttr, type);
+    }
+
+    for (int attr = options.fmtLoopFirst; attr <= options.fmtLoopLast; ++attr) {
+        if (!options.includeNbt && attr == GX_VA_NBT) {
+            continue;
+        }
+        const GXAttr gxAttr = static_cast<GXAttr>(attr);
+        if (IsMatrixIndexAttr(gxAttr)) {
+            continue;
+        }
+        const auto& f = g_hleGxState.vtxAttrFmt[fmt][attr];
+        GXSetVtxAttrFmt(fmt, gxAttr, f.cnt, f.type, f.frac);
+    }
+}
+
+} // namespace GxStream
diff --git a/runtime/src/hle/gx/gx_stubs.cpp b/runtime/src/hle/gx/gx_stubs.cpp
new file mode 100644
index 0000000..bba6585
--- /dev/null
+++ b/runtime/src/hle/gx/gx_stubs.cpp
@@ -0,0 +1,130 @@
+#include "gx_internal.h"
+#include "runtime_log.h"
+
+extern "C" void __GXSetSUTexRegs();
+
+// ============================================================================
+// FIFO Write Helpers
+// ============================================================================
+
+extern "C" void GX_HLE_FIFO_WriteFloat(float val) {
+    u32 raw; std::memcpy(&raw, &val, 4);
+    try { HleFifoWrite(raw, 4); } catch (...) { RT_LOGF(RT_TAG_GX, "FIFO write float failed\n"); }
+}
+
+extern "C" void GX_HLE_FIFO_Write32(uint32_t val) { HleFifoWrite(val, 4); }
+extern "C" void GX_HLE_FIFO_Write16(uint16_t val) { HleFifoWrite(static_cast<u32>(val), 2); }
+extern "C" void GX_HLE_FIFO_Write8(uint8_t val) { HleFifoWrite(static_cast<u32>(val), 1); }
+
+extern "C" void GX__SetDrawSync_8016ed08(uint32_t token) {
+    (void)token;
+    try { uint32_t gd = Memory::Read32(kGXDataPtrAddr); if (gd) {
+        if (Memory::Read32(gd + 0x5FCu)) GX__SetDirtyState_8016ee78();
+        Memory::Write16(gd + 2, 0);
+    } } catch (...) {}
+}
+
+extern "C" void GX__SetDrawSync_8016e9fc(uint32_t token) { GX__SetDrawSync_8016ed08(token); }
+PPC_NATIVE_OVERRIDE_VOID(8016e9fc, GX__SetDrawSync_8016e9fc, (uint32_t token), (token));
+
+extern "C" void GX__FinishInterruptHandler_8016ed94() {
+    try {
+        uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (gd) Memory::Write16(gd + 0x0Au, static_cast<uint16_t>(Memory::Read16(gd + 0x0Au) | 0x0008u));
+        Memory::Write8(kGxDrawDoneFlagAddr, 1);
+    } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(8016ed94, GX__FinishInterruptHandler_8016ed94, (), ());
+
+extern "C" void GX__DrawDone_8016eab0() {
+    try { Memory::Write8(kGxDrawDoneFlagAddr, 0); } catch (...) {}
+    GXDrawDone(); GX__FinishInterruptHandler_8016ed94();
+}
+PPC_NATIVE_OVERRIDE_VOID(8016eab0, GX__DrawDone_8016eab0, (), ());
+
+extern "C" void GX__PixModeSync_8016eb70() {
+    try { uint32_t gd = Memory::Read32(kGXDataPtrAddr); if (gd) Memory::Write16(gd + 2, 0); } catch (...) {}
+    GXPixModeSync();
+}
+PPC_NATIVE_OVERRIDE_VOID(8016eb70, GX__PixModeSync_8016eb70, (), ());
+
+// ============================================================================
+// Hardware Revision / Thread Query - No-ops
+// ============================================================================
+
+extern "C" void __GX__InitRevisionBits_8016b720() {}
+PPC_NATIVE_OVERRIDE_VOID(8016b720, __GX__InitRevisionBits_8016b720, (), ());
+
+// ============================================================================
+// Texture State Management - Aurora handles internally
+// ============================================================================
+
+extern "C" void __GX__SetSUTexRegs_801712f0() {
+    __GXSetSUTexRegs();
+    try { uint32_t gd = Memory::Read32(kGXDataPtrAddr); if (gd) Memory::Write16(gd + 2, 0); } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(801712f0, __GX__SetSUTexRegs_801712f0, (), ());
+
+extern "C" void __GX__SetTmemConfig_80171458(uint32_t mode) {
+    // TMEM layout configuration - Aurora manages internally
+    (void)mode;
+}
+PPC_NATIVE_OVERRIDE_VOID(80171458, __GX__SetTmemConfig_80171458, (uint32_t mode), (mode));
+
+extern "C" void __GX__FlushTextureState_80171c28() {
+    // BP texture state flush - Aurora handles via API
+    try { uint32_t gd = Memory::Read32(kGXDataPtrAddr); if (gd) Memory::Write16(gd + 2, 0); } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(80171c28, __GX__FlushTextureState_80171c28, (), ());
+
+// ============================================================================
+// Copy Configuration - No-ops for features Aurora doesn't use
+// ============================================================================
+
+extern "C" void GX__SetDispCopyFrame2Field_8016f5f8(uint32_t f) {
+    GXSetDispCopyFrame2Field(f);
+    try {
+        const uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (gd) {
+            Memory::Write32(gd + 0x23Cu, (Memory::Read32(gd + 0x23Cu) & 0xFFFFCFFFu) | ((f & 3u) << 12));
+            Memory::Write32(gd + 0x24Cu, Memory::Read32(gd + 0x24Cu) & 0xFFFFCFFFu);
+        }
+    } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f5f8, GX__SetDispCopyFrame2Field_8016f5f8, (uint32_t f), (f));
+
+extern "C" void GX__SetCopyClamp_8016f618(uint32_t c) {
+    GXSetCopyClamp(static_cast<GXFBClamp>(c));
+    try {
+        const uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (gd) {
+            const uint32_t clamp = c & 3u;
+            Memory::Write32(gd + 0x23Cu, (Memory::Read32(gd + 0x23Cu) & 0xFFFFFFFCu) | clamp);
+            Memory::Write32(gd + 0x24Cu, (Memory::Read32(gd + 0x24Cu) & 0xFFFFFFFCu) | clamp);
+        }
+    } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f618, GX__SetCopyClamp_8016f618, (uint32_t c), (c));
+
+extern "C" void GX__ClearBoundingBox_8016fecc() {
+    GXClearBoundingBox();
+    try {
+        const uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (gd) Memory::Write16(gd + 2, 0);
+    } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(8016fecc, GX__ClearBoundingBox_8016fecc, (), ());
+
+// ============================================================================
+// FIFO/State Management - No-ops
+// ============================================================================
+
+extern "C" void GX__SetDirtyState_8016ee78() {
+    try { uint32_t gd = Memory::Read32(kGXDataPtrAddr); if (gd) Memory::Write32(gd + 0x5FCu, 0); } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(8016ee78, GX__SetDirtyState_8016ee78, (), ());
+
+extern "C" void GX__ResetWriteGatherPipe_8016e6b0() {
+    // WPAR reset - not needed on host
+}
+PPC_NATIVE_OVERRIDE_VOID(8016e6b0, GX__ResetWriteGatherPipe_8016e6b0, (), ());
diff --git a/runtime/src/hle/gx/gx_tev.cpp b/runtime/src/hle/gx/gx_tev.cpp
new file mode 100644
index 0000000..54c01a9
--- /dev/null
+++ b/runtime/src/hle/gx/gx_tev.cpp
@@ -0,0 +1,128 @@
+// gx_tev.cpp - TEV Stage Configuration
+#include "gx_internal.h"
+#include "runtime_log.h"
+
+// Aurora's CHECK() on these tev array indices compiles to nothing under NDEBUG, so this
+// guest->native boundary must reject out-of-range IDs itself; a bad ID here is a malformed
+// display list, never legitimate traffic.
+namespace {
+
+bool GxTevIdOk(uint32_t value, uint32_t limit, const char* what) {
+    if (value < limit) return true;
+    RT_LOGF(RT_TAG_GX, "%s out of range: %u (max %u), ignoring\n", what, value, limit - 1u);
+    return false;
+}
+
+inline bool TevStageOk(uint32_t s) { return GxTevIdOk(s, GX_MAX_TEVSTAGE, "TEV stage"); }
+inline bool TevRegOk(uint32_t id) { return GxTevIdOk(id, GX_MAX_TEVREG, "TEV register"); }
+inline bool TevKColorOk(uint32_t id) { return GxTevIdOk(id, GX_MAX_KCOLOR, "TEV konstant color"); }
+inline bool TevSwapOk(uint32_t id) { return GxTevIdOk(id, GX_MAX_TEVSWAP, "TEV swap selector"); }
+
+} // namespace
+
+// ============================================================================
+// TEV Stage Count and Order
+// ============================================================================
+
+extern "C" void GX__SetNumTevStages_801722a8(uint32_t n) {
+    // GXSetNumTevStages takes a count, not an index, so the inclusive bound is
+    // GX_MAX_TEVSTAGE itself.
+    if (n > GX_MAX_TEVSTAGE) {
+        RT_LOGF(RT_TAG_GX, "GXSetNumTevStages: invalid count %u, ignoring\n", n);
+        return;
+    }
+    GXSetNumTevStages((u8)n);
+}
+PPC_NATIVE_OVERRIDE_VOID(801722a8, GX__SetNumTevStages_801722a8, (uint32_t n), (n));
+
+extern "C" void GX__SetTevOp_80171c4c(uint32_t s, uint32_t m) {
+    if (!TevStageOk(s)) return;
+    GXSetTevOp((GXTevStageID)s, (GXTevMode)m);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171c4c, GX__SetTevOp_80171c4c, (uint32_t s, uint32_t m), (s, m));
+
+extern "C" void GX__SetTevOrder_8017214c(uint32_t s, uint32_t c, uint32_t m, uint32_t col) {
+    if (!TevStageOk(s)) return;
+    GXSetTevOrder((GXTevStageID)s, (GXTexCoordID)c, (GXTexMapID)m, (GXChannelID)col);
+}
+PPC_NATIVE_OVERRIDE_VOID(8017214c, GX__SetTevOrder_8017214c, (uint32_t s, uint32_t c, uint32_t m, uint32_t col), (s, c, m, col));
+
+// ============================================================================
+// TEV Color/Alpha Inputs
+// ============================================================================
+
+extern "C" void GX__SetTevColorIn_80171ce0(uint32_t s, uint32_t a, uint32_t b, uint32_t c, uint32_t d) {
+    if (!TevStageOk(s)) return;
+    GXSetTevColorIn((GXTevStageID)s, (GXTevColorArg)a, (GXTevColorArg)b, (GXTevColorArg)c, (GXTevColorArg)d);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171ce0, GX__SetTevColorIn_80171ce0, (uint32_t s, uint32_t a, uint32_t b, uint32_t c, uint32_t d), (s, a, b, c, d));
+
+extern "C" void GX__SetTevAlphaIn_80171d20(uint32_t s, uint32_t a, uint32_t b, uint32_t c, uint32_t d) {
+    if (!TevStageOk(s)) return;
+    GXSetTevAlphaIn((GXTevStageID)s, (GXTevAlphaArg)a, (GXTevAlphaArg)b, (GXTevAlphaArg)c, (GXTevAlphaArg)d);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171d20, GX__SetTevAlphaIn_80171d20, (uint32_t s, uint32_t a, uint32_t b, uint32_t c, uint32_t d), (s, a, b, c, d));
+
+// ============================================================================
+// TEV Color/Alpha Operations
+// ============================================================================
+
+extern "C" void GX__SetTevColorOp_80171d60(uint32_t s, uint32_t op, uint32_t b, uint32_t sc, uint32_t cl, uint32_t or_) {
+    if (!TevStageOk(s) || !TevRegOk(or_)) return;
+    GXSetTevColorOp((GXTevStageID)s, (GXTevOp)op, (GXTevBias)b, (GXTevScale)sc, (GXBool)cl, (GXTevRegID)or_);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171d60, GX__SetTevColorOp_80171d60, (uint32_t s, uint32_t op, uint32_t b, uint32_t sc, uint32_t cl, uint32_t or_), (s, op, b, sc, cl, or_));
+
+extern "C" void GX__SetTevAlphaOp_80171db8(uint32_t s, uint32_t op, uint32_t b, uint32_t sc, uint32_t cl, uint32_t or_) {
+    if (!TevStageOk(s) || !TevRegOk(or_)) return;
+    GXSetTevAlphaOp((GXTevStageID)s, (GXTevOp)op, (GXTevBias)b, (GXTevScale)sc, (GXBool)cl, (GXTevRegID)or_);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171db8, GX__SetTevAlphaOp_80171db8, (uint32_t s, uint32_t op, uint32_t b, uint32_t sc, uint32_t cl, uint32_t or_), (s, op, b, sc, cl, or_));
+
+// ============================================================================
+// TEV Color Registers
+// ============================================================================
+
+extern "C" void GX__SetTevColor_80171e10(uint32_t id, uint32_t cp) {
+    if (!TevRegOk(id)) return;
+    const uint8_t* p=Memory::GetPointer(cp, 4); GXColor c; c.r=p[0]; c.g=p[1]; c.b=p[2]; c.a=p[3];
+    GXSetTevColor((GXTevRegID)id, c);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171e10, GX__SetTevColor_80171e10, (uint32_t id, uint32_t cp), (id, cp));
+
+extern "C" void GX__SetTevColorS10_80171e70(uint32_t id, uint32_t cp) {
+    if (!TevRegOk(id)) return;
+    const uint8_t* p=Memory::GetPointer(cp, 8); GXColorS10 c;
+    c.r=(p[0]<<8)|p[1]; c.g=(p[2]<<8)|p[3]; c.b=(p[4]<<8)|p[5]; c.a=(p[6]<<8)|p[7];
+    GXSetTevColorS10((GXTevRegID)id, c);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171e70, GX__SetTevColorS10_80171e70, (uint32_t id, uint32_t cp), (id, cp));
+
+extern "C" void GX__SetTevKColor_80171ed4(uint32_t id, uint32_t cp) {
+    if (!TevKColorOk(id)) return;
+    const uint8_t* p=Memory::GetPointer(cp, 4); GXColor c; c.r=p[0]; c.g=p[1]; c.b=p[2]; c.a=p[3];
+    GXSetTevKColor((GXTevKColorID)id, c);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171ed4, GX__SetTevKColor_80171ed4, (uint32_t id, uint32_t cp), (id, cp));
+
+extern "C" void GX__SetTevKColorSel_80171f30(uint32_t s, uint32_t sel) { if (!TevStageOk(s)) return; GXSetTevKColorSel((GXTevStageID)s, (GXTevKColorSel)sel); }
+PPC_NATIVE_OVERRIDE_VOID(80171f30, GX__SetTevKColorSel_80171f30, (uint32_t s, uint32_t sel), (s, sel));
+
+extern "C" void GX__SetTevKAlphaSel_80171f80(uint32_t s, uint32_t sel) { if (!TevStageOk(s)) return; GXSetTevKAlphaSel((GXTevStageID)s, (GXTevKAlphaSel)sel); }
+PPC_NATIVE_OVERRIDE_VOID(80171f80, GX__SetTevKAlphaSel_80171f80, (uint32_t s, uint32_t sel), (s, sel));
+
+// ============================================================================
+// TEV Swap Tables
+// ============================================================================
+
+extern "C" void GX__SetTevSwapModeTable_8017200c(uint32_t id, uint32_t r, uint32_t g, uint32_t b, uint32_t a) {
+    if (!TevSwapOk(id)) return;
+    GXSetTevSwapModeTable((GXTevSwapSel)id, (GXTevColorChan)r, (GXTevColorChan)g, (GXTevColorChan)b, (GXTevColorChan)a);
+}
+PPC_NATIVE_OVERRIDE_VOID(8017200c, GX__SetTevSwapModeTable_8017200c, (uint32_t id, uint32_t r, uint32_t g, uint32_t b, uint32_t a), (id, r, g, b, a));
+
+extern "C" void GX__SetTevSwapMode_80171fd0(uint32_t s, uint32_t rs, uint32_t ts) {
+    if (!TevStageOk(s) || !TevSwapOk(rs) || !TevSwapOk(ts)) return;
+    GXSetTevSwapMode((GXTevStageID)s, (GXTevSwapSel)rs, (GXTevSwapSel)ts);
+}
+PPC_NATIVE_OVERRIDE_VOID(80171fd0, GX__SetTevSwapMode_80171fd0, (uint32_t s, uint32_t rs, uint32_t ts), (s, rs, ts));
diff --git a/runtime/src/hle/gx/gx_texture.cpp b/runtime/src/hle/gx/gx_texture.cpp
new file mode 100644
index 0000000..b5ebedd
--- /dev/null
+++ b/runtime/src/hle/gx/gx_texture.cpp
@@ -0,0 +1,708 @@
+// gx_texture.cpp - Texture Object and TLUT Functions
+#include "gx_internal.h"
+#include "runtime_log.h"
+
+#include <algorithm>
+#include <cstdlib>
+
+// Helper to write GXTexObj structure to guest memory in SDK format
+// This is needed because other code may read the structure directly
+static void WriteGuestTexObj(uint32_t addr, uint32_t dataAddr, uint16_t width, uint16_t height, 
+                             uint32_t format, uint32_t wrapS, uint32_t wrapT, bool mipmap,
+                             bool writeTlut, uint32_t tlut) {
+    dataAddr = CanonicalizeGxMainRamAddress(dataAddr);
+    for (int i = 0; i < 8; i++) {
+        Memory::Write32(addr + i * 4, 0);
+    }
+
+    uint32_t word0 = (wrapS & 0x3u) | ((wrapT & 0x3u) << 2) | 0x10u;
+    uint32_t word1 = 0;
+    if (!mipmap) {
+        word0 = (word0 & 0xFFFFFF10u) | (wrapS & 0x3u) | ((wrapT & 0x3u) << 2) | 0x90u;
+    } else {
+        word0 = (word0 & 0xFFFFFF10u) | (wrapS & 0x3u) | ((wrapT & 0x3u) << 2) |
+                (((format - 8u) < 3u) ? 0xB0u : 0xD0u);
+        const uint32_t maxDim = std::max<uint32_t>(width, height);
+        const uint32_t maxLod = maxDim > 0 ? (31u - static_cast<uint32_t>(__builtin_clz(maxDim))) : 0u;
+        word1 |= (std::min<uint32_t>(maxLod * 16u, 0xFFu) << 8);
+    }
+
+    uint32_t blockShiftX = 2;
+    uint32_t blockShiftY = 2;
+    uint8_t blockType = 2;
+    switch (format & 0xFu) {
+    case 0:
+    case 8:
+        blockShiftX = 3;
+        blockShiftY = 3;
+        blockType = 1;
+        break;
+    case 1:
+    case 2:
+    case 9:
+        blockShiftX = 3;
+        blockShiftY = 2;
+        blockType = 2;
+        break;
+    case 3:
+    case 4:
+    case 5:
+    case 10:
+        blockShiftX = 2;
+        blockShiftY = 2;
+        blockType = 2;
+        break;
+    case 6:
+        blockShiftX = 2;
+        blockShiftY = 2;
+        blockType = 3;
+        break;
+    case 14:
+        blockShiftX = 3;
+        blockShiftY = 3;
+        blockType = 0;
+        break;
+    default:
+        blockShiftX = 2;
+        blockShiftY = 2;
+        blockType = 2;
+        break;
+    }
+
+    const uint32_t word2 =
+        ((width - 1u) & 0x3FFu) |
+        (((height - 1u) & 0x3FFu) << 10) |
+        ((format & 0xFu) << 20);
+    const uint32_t word3 = (dataAddr >> 5) & 0x00FFFFFFu;
+    const uint32_t blocksX = (static_cast<uint32_t>(width) + ((1u << blockShiftX) - 1u)) >> blockShiftX;
+    const uint32_t blocksY = (static_cast<uint32_t>(height) + ((1u << blockShiftY) - 1u)) >> blockShiftY;
+    const uint16_t blockCount = static_cast<uint16_t>((blocksX * blocksY) & 0x7FFFu);
+    uint8_t flags = mipmap ? 0x03u : 0x02u;
+
+    Memory::Write32(addr + 0x00, word0);
+    Memory::Write32(addr + 0x04, word1);
+    Memory::Write32(addr + 0x08, word2);
+    Memory::Write32(addr + 0x0C, word3);
+    Memory::Write32(addr + 0x14, format);
+    if (writeTlut) {
+        Memory::Write32(addr + 0x18, tlut);
+    }
+    Memory::Write16(addr + 0x1C, blockCount);
+    Memory::Write8(addr + 0x1E, blockType);
+    Memory::Write8(addr + 0x1F, flags);
+}
+
+// SDK min-filter enum -> the hardware encoding stored in GXTexObj word0[7:5]
+// (GX2HWFiltConv). Entries 6 and 7 have no SDK filter and read back as 0; the
+// inverse table (HW -> SDK) lives in gx_objects.cpp.
+static const uint8_t kGxToHwMinFilter[8] = {0, 4, 1, 5, 2, 6, 0, 0};
+
+// Helper to update LOD info in guest GXTexObj structure
+static void WriteGuestTexObjLOD(uint32_t addr, uint32_t minFilt, uint32_t magFilt,
+                                 float minLod, float maxLod, float lodBias,
+                                 bool biasClamp, bool edgeLod, uint32_t maxAniso) {
+    // Read existing word0 and update relevant bits
+    uint32_t word0 = Memory::Read32(addr + 0x00);
+
+    // bits [4] = magFilter, bits [7:5] = hardware minFilter encoding
+    uint32_t minFiltBits = (minFilt < 6u) ? kGxToHwMinFilter[minFilt] : 4;
+    word0 = (word0 & ~0xF0) | ((magFilt & 1) << 4) | ((minFiltBits & 7) << 5);
+    
+    // bits [8] = edgeLod (inverted), bits [17:9] = lodBias (signed, scaled by 32)
+    int8_t biasScaled = (int8_t)(lodBias * 32.0f);
+    word0 = (word0 & ~0x3FF00) | ((edgeLod ? 0 : 1) << 8) | ((uint32_t)(uint8_t)biasScaled << 9);
+    
+    // bits [20:19] = maxAniso, bit [21] = biasClamp
+    word0 = (word0 & ~0x380000) | ((maxAniso & 0x3) << 19) | ((biasClamp ? 1 : 0) << 21);
+    
+    Memory::Write32(addr + 0x00, word0);
+    
+    // word1: bits [7:0] = minLod * 16, bits [15:8] = maxLod * 16
+    uint8_t minLodScaled = (uint8_t)(minLod * 16.0f);
+    uint8_t maxLodScaled = (uint8_t)(maxLod * 16.0f);
+    uint32_t word1 = Memory::Read32(addr + 0x04);
+    word1 = (word1 & 0xFFFF0000) | minLodScaled | ((uint32_t)maxLodScaled << 8);
+    Memory::Write32(addr + 0x04, word1);
+}
+
+// ============================================================================
+// Texture Object Initialization
+// ============================================================================
+
+static uint32_t g_unsupportedFormatLogCount = 0;
+
+// Must cover every format aurora's convert_texture() decodes; anything missing here is refused
+// and never reaches aurora (GX_TF_C14X2 was once missing despite aurora decoding it, silently
+// dropping C14X2 binds). GX_CTF_YUVA8 stays listed for THP EFB-copy frames, which never go through convert_texture.
+static bool IsAuroraLoadableTexFormat(uint32_t fmt) noexcept {
+    switch (fmt) {
+    case GX_TF_I4:
+    case GX_TF_I8:
+    case GX_TF_IA4:
+    case GX_TF_IA8:
+    case GX_TF_C4:
+    case GX_TF_C8:
+    case GX_TF_C14X2:
+    case GX_TF_RGB565:
+    case GX_TF_RGB5A3:
+    case GX_TF_Z8:
+    case GX_TF_Z16:
+    case GX_TF_Z24X8:
+    case GX_TF_RGBA8:
+    case GX_CTF_YUVA8:
+    case GX_TF_CMPR:
+        return true;
+    default:
+        return false;
+    }
+}
+
+static GXTexWrapMode SanitizeWrapMode(uint32_t rawWrap) noexcept {
+    switch (rawWrap) {
+    case GX_CLAMP:
+    case GX_REPEAT:
+    case GX_MIRROR:
+        return static_cast<GXTexWrapMode>(rawWrap);
+    default:
+        return GX_CLAMP;
+    }
+}
+
+static GXTexFilter SanitizeMinFilter(uint32_t rawFilter) noexcept {
+    switch (rawFilter) {
+    case GX_NEAR:
+    case GX_LINEAR:
+    case GX_NEAR_MIP_NEAR:
+    case GX_LIN_MIP_NEAR:
+    case GX_NEAR_MIP_LIN:
+    case GX_LIN_MIP_LIN:
+        return static_cast<GXTexFilter>(rawFilter);
+    // Some decoded hardware encodings surface as 6/7; map to the strongest valid mip filter.
+    case 6:
+    case 7:
+        return GX_LIN_MIP_LIN;
+    default:
+        return GX_LINEAR;
+    }
+}
+
+static GXTexFilter SanitizeMagFilter(uint32_t rawFilter) noexcept {
+    return (rawFilter == GX_NEAR) ? GX_NEAR : GX_LINEAR;
+}
+
+static GXAnisotropy SanitizeAniso(uint32_t rawAniso) noexcept {
+    switch (rawAniso) {
+    case GX_ANISO_1:
+    case GX_ANISO_2:
+    case GX_ANISO_4:
+        return static_cast<GXAnisotropy>(rawAniso);
+    default:
+        return GX_ANISO_4;
+    }
+}
+
+static bool IsReasonableTextureDimensions(uint16_t width, uint16_t height) noexcept {
+    // Hardware textures are small; reject absurd dimensions that can destabilize host texture creation.
+    constexpr uint16_t kMaxDimension = 4096;
+    return width > 0 && height > 0 && width <= kMaxDimension && height <= kMaxDimension;
+}
+
+static float SanitizeLodValue(float lod, float fallback) noexcept {
+    if (!std::isfinite(lod)) {
+        return fallback;
+    }
+    return std::max(0.0f, lod);
+}
+
+static float SanitizeLodBias(float lodBias) noexcept {
+    if (!std::isfinite(lodBias)) {
+        return 0.0f;
+    }
+    return std::clamp(lodBias, -4.0f, 3.99f);
+}
+
+// Republish the host texobj's LOD/filter block from `meta`, with the three
+// fields each caller may be overriding passed in explicitly.
+static void ApplyHostTexObjLod(GXTexObj* obj, const TexObjMeta& meta, GXTexFilter minFilter,
+                               GXTexFilter magFilter, float lodBias, GXAnisotropy maxAniso) {
+    GXInitTexObjLOD(obj, minFilter, magFilter, meta.minLod, meta.maxLod, lodBias,
+                    meta.biasClamp ? GX_TRUE : GX_FALSE, meta.edgeLod ? GX_TRUE : GX_FALSE,
+                    maxAniso);
+}
+
+static uint32_t ComputeMaxMipLevel(uint16_t width, uint16_t height) noexcept {
+    uint32_t w = std::max<uint32_t>(1u, width);
+    uint32_t h = std::max<uint32_t>(1u, height);
+    uint32_t levels = 0;
+    while (w > 1u || h > 1u) {
+        w = std::max<uint32_t>(1u, w >> 1u);
+        h = std::max<uint32_t>(1u, h >> 1u);
+        ++levels;
+    }
+    return levels;
+}
+
+extern "C" void GX__InitTexObj_801707f8(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m) {
+    if (w == 0 || h == 0) {
+        auto* cpu = TryGetCpuContext();
+        RT_LOGF(RT_TAG_GX,
+                "GXInitTexObj zero size oa=0x%08X da=0x%08X w=%u h=%u f=%u ws=%u wt=%u m=%u pc=0x%08X lr=0x%08X\n",
+                oa, da, w, h, f, ws, wt, m, cpu ? cpu->pc : 0u, cpu ? cpu->lr : 0u);
+    }
+    const uint32_t canonicalDataAddr = CanonicalizeGxMainRamAddress(da);
+    std::lock_guard<std::mutex> guard(g_texObjMutex); GXTexObj* obj = CreateHostTexObj(oa); TexObjMeta& meta = GetTexObjMeta(oa);
+    meta.dataAddr=canonicalDataAddr; meta.width=(u16)w; meta.height=(u16)h; meta.format=f; meta.wrapS=ws; meta.wrapT=wt; meta.mipmap=(m!=0); meta.userData=0; meta.needsUpload=true;
+    GXInitTexObj(obj, GuestToHostPtr(da), (u16)w, (u16)h, (GXTexFmt)f, (GXTexWrapMode)ws, (GXTexWrapMode)wt, (GXBool)m); MarkHostTexObjConstructed(oa);
+    // Also write to guest memory so reads work
+    WriteGuestTexObj(oa, canonicalDataAddr, (u16)w, (u16)h, f, ws, wt, m != 0, false, 0);
+}
+PPC_NATIVE_OVERRIDE_VOID(801707f8, GX__InitTexObj_801707f8, (uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m), (oa, da, w, h, f, ws, wt, m));
+
+extern "C" void GX__InitTexObj_switch_80170938(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m) { GX__InitTexObj_801707f8(oa, da, w, h, f, ws, wt, m); }
+PPC_NATIVE_OVERRIDE_VOID(80170938, GX__InitTexObj_switch_80170938, (uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m), (oa, da, w, h, f, ws, wt, m));
+
+extern "C" void GX__InitTexObj_caseD_0_8017093c(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m) { GX__InitTexObj_801707f8(oa, da, w, h, f, ws, wt, m); }
+PPC_NATIVE_OVERRIDE_VOID(8017093c, GX__InitTexObj_caseD_0_8017093c, (uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m), (oa, da, w, h, f, ws, wt, m));
+
+extern "C" void GX__InitTexObj_caseD_1_80170950(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m) { GX__InitTexObj_801707f8(oa, da, w, h, f, ws, wt, m); }
+PPC_NATIVE_OVERRIDE_VOID(80170950, GX__InitTexObj_caseD_1_80170950, (uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m), (oa, da, w, h, f, ws, wt, m));
+
+extern "C" void GX__InitTexObj_caseD_3_80170964(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m) { GX__InitTexObj_801707f8(oa, da, w, h, f, ws, wt, m); }
+PPC_NATIVE_OVERRIDE_VOID(80170964, GX__InitTexObj_caseD_3_80170964, (uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m), (oa, da, w, h, f, ws, wt, m));
+
+extern "C" void GX__InitTexObj_caseD_6_80170978(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m) { GX__InitTexObj_801707f8(oa, da, w, h, f, ws, wt, m); }
+PPC_NATIVE_OVERRIDE_VOID(80170978, GX__InitTexObj_caseD_6_80170978, (uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m), (oa, da, w, h, f, ws, wt, m));
+
+extern "C" void GX__InitTexObj_caseD_e_8017098c(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m) { GX__InitTexObj_801707f8(oa, da, w, h, f, ws, wt, m); }
+PPC_NATIVE_OVERRIDE_VOID(8017098c, GX__InitTexObj_caseD_e_8017098c, (uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m), (oa, da, w, h, f, ws, wt, m));
+
+extern "C" void GX__InitTexObj_caseD_7_801709a0(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m) { GX__InitTexObj_801707f8(oa, da, w, h, f, ws, wt, m); }
+PPC_NATIVE_OVERRIDE_VOID(801709a0, GX__InitTexObj_caseD_7_801709a0, (uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m), (oa, da, w, h, f, ws, wt, m));
+
+// ============================================================================
+// Texture Object Configuration
+// ============================================================================
+
+extern "C" void GX__InitTexObjCI_80170a04(uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m, uint32_t tl) {
+    if (w == 0 || h == 0) {
+        auto* cpu = TryGetCpuContext();
+        RT_LOGF(RT_TAG_GX,
+                "GXInitTexObjCI zero size oa=0x%08X da=0x%08X w=%u h=%u f=%u ws=%u wt=%u m=%u tl=%u pc=0x%08X lr=0x%08X\n",
+                oa, da, w, h, f, ws, wt, m, tl, cpu ? cpu->pc : 0u, cpu ? cpu->lr : 0u);
+    }
+    const uint32_t canonicalDataAddr = CanonicalizeGxMainRamAddress(da);
+    std::lock_guard<std::mutex> guard(g_texObjMutex); GXTexObj* obj = CreateHostTexObj(oa); TexObjMeta& meta = GetTexObjMeta(oa);
+    meta.dataAddr=canonicalDataAddr; meta.width=(u16)w; meta.height=(u16)h; meta.format=f; meta.wrapS=ws; meta.wrapT=wt; meta.mipmap=(m!=0); meta.tlut=tl; meta.userData=0; meta.needsUpload=true;
+    GXInitTexObjCI(obj, GuestToHostPtr(da), (u16)w, (u16)h, (GXCITexFmt)f, (GXTexWrapMode)ws, (GXTexWrapMode)wt, (GXBool)m, tl); MarkHostTexObjConstructed(oa);
+    // Also write to guest memory so reads work
+    WriteGuestTexObj(oa, canonicalDataAddr, (u16)w, (u16)h, f, ws, wt, m != 0, true, tl);
+    // GXInitTexObjCI clears bit1 in the flags byte; keep guest memory consistent.
+    try {
+        uint8_t flags = Memory::Read8(oa + 0x1F);
+        Memory::Write8(oa + 0x1F, static_cast<uint8_t>(flags & 0xFD));
+    } catch (...) {
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(80170a04, GX__InitTexObjCI_80170a04, (uint32_t oa, uint32_t da, uint32_t w, uint32_t h, uint32_t f, uint32_t ws, uint32_t wt, uint32_t m, uint32_t tl), (oa, da, w, h, f, ws, wt, m, tl));
+
+extern "C" void GX__InitTexObjLOD_80170a4c(uint32_t oa, uint32_t mif, uint32_t maf, float mil, float mal, float lb, uint32_t bc, uint32_t el, uint32_t ma) {
+    std::lock_guard<std::mutex> guard(g_texObjMutex); GXTexObj* obj = GetHostTexObj(oa); TexObjMeta& meta = GetTexObjMeta(oa);
+    float fmal = std::isfinite(mal) && mal >= 0.f ? mal : 0.f, fmil = std::isfinite(mil) && mil >= 0.f ? std::min(mil, fmal) : 0.f;
+    meta.minFilter=mif; meta.magFilter=maf; meta.minLod=fmil; meta.maxLod=fmal; meta.lodBias=lb; meta.biasClamp=(bc!=0); meta.edgeLod=(el!=0); meta.maxAniso=ma;
+    GXInitTexObjLOD(obj, (GXTexFilter)mif, (GXTexFilter)maf, fmil, fmal, lb, (GXBool)bc, (GXBool)el, (GXAnisotropy)ma);
+    // Also write LOD info to guest memory
+    WriteGuestTexObjLOD(oa, mif, maf, fmil, fmal, lb, bc != 0, el != 0, ma);
+}
+PPC_NATIVE_OVERRIDE_VOID(80170a4c, GX__InitTexObjLOD_80170a4c, (uint32_t oa, uint32_t mif, uint32_t maf, float mil, float mal, float lb, uint32_t bc, uint32_t el, uint32_t ma), (oa, mif, maf, mil, mal, lb, bc, el, ma));
+
+extern "C" void GX__InitTexObjWrapMode_80170b50(uint32_t oa, uint32_t ws, uint32_t wt) {
+    std::lock_guard<std::mutex> guard(g_texObjMutex);
+    GXTexObj* obj = GetHostTexObj(oa);
+    TexObjMeta& meta = GetTexObjMeta(oa);
+    meta.wrapS = ws;
+    meta.wrapT = wt;
+    try {
+        uint32_t word0 = Memory::Read32(oa + 0x00);
+        word0 = (word0 & ~0xFu) | (ws & 0x3u) | ((wt & 0x3u) << 2);
+        Memory::Write32(oa + 0x00, word0);
+    } catch (...) {
+    }
+    GXInitTexObjWrapMode(obj, (GXTexWrapMode)ws, (GXTexWrapMode)wt);
+}
+PPC_NATIVE_OVERRIDE_VOID(80170b50, GX__InitTexObjWrapMode_80170b50, (uint32_t oa, uint32_t ws, uint32_t wt), (oa, ws, wt));
+
+extern "C" void GX__InitTexObjTlut_80170b64(uint32_t oa, uint32_t tl) {
+    std::lock_guard<std::mutex> guard(g_texObjMutex);
+    GXTexObj* obj = GetHostTexObj(oa);
+    TexObjMeta& meta = GetTexObjMeta(oa);
+    meta.tlut = tl;
+    GXInitTexObjTlut(obj, tl);
+    // Keep guest GXTexObj coherent for later GXLoadTexObj from memory.
+    try {
+        Memory::Write32(oa + 0x18, tl);
+    } catch (...) {
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(80170b64, GX__InitTexObjTlut_80170b64, (uint32_t oa, uint32_t tl), (oa, tl));
+
+// GXInitTexObjFilter - sets mag/min filter modes
+extern "C" void GX__InitTexObjFilter_80170b6c(uint32_t oa, uint32_t minFilter, uint32_t magFilter) {
+    std::lock_guard<std::mutex> guard(g_texObjMutex);
+    TexObjMeta& meta = GetTexObjMeta(oa);
+    meta.minFilter = minFilter;
+    meta.magFilter = magFilter;
+    
+    try {
+        uint32_t word0 = Memory::Read32(oa + 0x00);
+        // bit 4: magFilter - set if magFilter == GX_LINEAR (1), clear otherwise
+        // Original code used cntlzw to check: cntlzw(magFilter-1) >> 1 & 0x10
+        // This sets bit 4 when magFilter-1 is 0 (i.e., magFilter == 1)
+        uint32_t magBit = (magFilter == 1) ? 0x10 : 0;
+        word0 = (word0 & 0xFFFFFFEF) | magBit;
+        // bits [7:5]: minFilter from LUT
+        uint32_t minBits = (kGxToHwMinFilter[minFilter & 7] & 7) << 5;
+        word0 = (word0 & 0xFFFFFF0F) | magBit | minBits;
+        Memory::Write32(oa + 0x00, word0);
+    } catch (...) {}
+
+    // Update host texture object if it exists
+    if (GXTexObj* obj = TryGetHostTexObj(oa)) {
+        ApplyHostTexObjLod(obj, meta, (GXTexFilter)minFilter, (GXTexFilter)magFilter, meta.lodBias,
+                           (GXAnisotropy)meta.maxAniso);
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(80170b6c, GX__InitTexObjFilter_80170b6c, (uint32_t oa, uint32_t minFilter, uint32_t magFilter), (oa, minFilter, magFilter));
+
+// GXInitTexObjLODBias - sets LOD bias value
+extern "C" void GX__InitTexObjLODBias_80170b94(uint32_t oa, float bias) {
+    std::lock_guard<std::mutex> guard(g_texObjMutex);
+    TexObjMeta& meta = GetTexObjMeta(oa);
+    
+    // Clamp bias to [-4.0, 3.99...] range as per SDK
+    constexpr float kMinBias = -4.0f;
+    constexpr float kMaxBias = 3.99f; // Actually ~3.990000009536743
+    float clampedBias = bias;
+    if (clampedBias < kMinBias) clampedBias = kMinBias;
+    if (clampedBias >= 4.0f) clampedBias = kMaxBias;
+    
+    meta.lodBias = clampedBias;
+    
+    // Update guest GXTexObj word0 with bias (scale by 32, store in bits [16:9])
+    try {
+        uint32_t word0 = Memory::Read32(oa + 0x00);
+        int8_t biasScaled = static_cast<int8_t>(clampedBias * 32.0f);
+        word0 = (word0 & 0xFFFE01FF) | ((static_cast<uint32_t>(static_cast<uint8_t>(biasScaled)) & 0xFF) << 9);
+        Memory::Write32(oa + 0x00, word0);
+    } catch (...) {}
+    
+    // Update host texture object if it exists
+    if (GXTexObj* obj = TryGetHostTexObj(oa)) {
+        ApplyHostTexObjLod(obj, meta, (GXTexFilter)meta.minFilter, (GXTexFilter)meta.magFilter,
+                           clampedBias, (GXAnisotropy)meta.maxAniso);
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(80170b94, GX__InitTexObjLODBias_80170b94, (uint32_t oa, float bias), (oa, bias));
+
+extern "C" void GX__InitTexObjUserData_80170be8(uint32_t oa, uint32_t userData) {
+    std::lock_guard<std::mutex> guard(g_texObjMutex);
+    TexObjMeta& meta = GetTexObjMeta(oa);
+    meta.userData = userData;
+
+    // The RVL SDK stores this opaque guest pointer verbatim at GXTexObj + 0x10.
+    WriteGuest32(oa + 0x10, userData, "GXInitTexObjUserData");
+
+    // Aurora keeps an expanded host-side object, so mirror the pointer when
+    // that representation has already been constructed.
+    if (GXTexObj* obj = TryGetHostTexObj(oa)) {
+        GXInitTexObjUserData(obj, GuestToHostPtr(userData));
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(80170be8, GX__InitTexObjUserData_80170be8,
+              (uint32_t oa, uint32_t userData), (oa, userData));
+
+// ============================================================================
+// Texture Loading
+// ============================================================================
+
+// A refused GXLoadTexObj must not leave the previous material's texture bound in that TEV
+// slot (rejection paths used to just return, so draws sampled stale, unrelated art). Bind
+// aurora's empty texture instead: null image data resolves to a 1x1 transparent placeholder,
+// which is also the correct result for the common case of an intentionally-transparent hide texture.
+static void BindUnloadableTexturePlaceholder(uint32_t tid) {
+    if (tid >= g_boundTexMaps.size()) {
+        return;
+    }
+    // Callers hold g_texObjMutex, so this initialization is serialized.
+    static GXTexObj s_placeholder{};
+    static bool s_placeholderReady = false;
+    if (!s_placeholderReady) {
+        GXInitTexObj(&s_placeholder, nullptr, 1, 1, GX_TF_RGBA8, GX_CLAMP, GX_CLAMP, GX_FALSE);
+        s_placeholderReady = true;
+    }
+    // A zeroed binding record can never compare equal to a real load (those
+    // always carry a non-zero objAddr), so the CanSkipHostLoad fast path cannot
+    // mistake a later genuine bind for a no-op.
+    g_boundTexMaps[tid] = BoundTexInfo{};
+    GXLoadTexObj(&s_placeholder, (GXTexMapID)tid);
+}
+
+extern "C" void GX__LoadTexObj_80170f2c(uint32_t oa, uint32_t tid) {
+    static uint32_t s_invalidMetaLogCount = 0;
+    static uint32_t s_invalidTidLogCount = 0;
+    static uint32_t s_invalidDimLogCount = 0;
+    static uint32_t s_hostExceptionLogCount = 0;
+    static uint32_t s_metaLookupLogCount = 0;
+    static uint32_t s_unknownFormatLogCount = 0;
+    static uint32_t s_invalidDataLogCount = 0;
+    std::lock_guard<std::mutex> guard(g_texObjMutex);
+
+    if (tid >= g_boundTexMaps.size()) {
+        if (s_invalidTidLogCount < 128) {
+            RT_LOGF(RT_TAG_GX, "GXLoadTexObj: invalid tex map id %u (oa=0x%08X)\n", tid, oa);
+            ++s_invalidTidLogCount;
+        }
+        return;
+    }
+    
+    // Check if we have metadata for this texture, or try to extract it from guest memory
+    TexObjMeta meta;
+    if (!TryGetOrExtractTexObjMeta(oa, meta)) {
+        if (s_metaLookupLogCount++ < 64) {
+            RT_LOGF(RT_TAG_GX,
+                    "GXLoadTexObj rejected reason=no-metadata oa=0x%08X tid=%u\n", oa, tid);
+        }
+        BindUnloadableTexturePlaceholder(tid);
+        return;
+    }
+
+    if (meta.dataAddr == 0 || meta.width == 0 || meta.height == 0) {
+        if (s_invalidMetaLogCount++ < 64) {
+            RT_LOGF(RT_TAG_GX,
+                    "GXLoadTexObj rejected reason=invalid-meta oa=0x%08X tid=%u data=0x%08X %ux%u\n",
+                    oa, tid, meta.dataAddr, meta.width, meta.height);
+        }
+        BindUnloadableTexturePlaceholder(tid);
+        return;
+    }
+    if (!IsReasonableTextureDimensions(meta.width, meta.height)) {
+        if (s_invalidDimLogCount++ < 128) {
+            RT_LOGF(RT_TAG_GX,
+                    "GXLoadTexObj rejected reason=bad-dimensions oa=0x%08X tid=%u %ux%u fmt=0x%X\n",
+                    oa, tid, meta.width, meta.height, meta.format);
+        }
+        BindUnloadableTexturePlaceholder(tid);
+        return;
+    }
+    // One gate, two reasons: every aurora-loadable format is also a known one,
+    // so a separate IsKnownTexFormat rejection could never fire on anything this
+    // check would let through. The reason string still distinguishes "GX has no
+    // such format" from "aurora cannot decode it", which is what triage needs.
+    if (!IsAuroraLoadableTexFormat(meta.format)) {
+        const bool known = IsKnownTexFormat(meta.format);
+        uint32_t& logCount = known ? g_unsupportedFormatLogCount : s_unknownFormatLogCount;
+        if (logCount++ < 128) {
+            RT_LOGF(RT_TAG_GX,
+                    "GXLoadTexObj rejected reason=%s oa=0x%08X tid=%u fmt=0x%X %ux%u\n",
+                    known ? "unsupported-format" : "unknown-format", oa, tid, meta.format,
+                    meta.width, meta.height);
+        }
+        BindUnloadableTexturePlaceholder(tid);
+        return;
+    }
+    const float maxMipLevel = static_cast<float>(ComputeMaxMipLevel(meta.width, meta.height));
+    const float minLodSafe = SanitizeLodValue(meta.minLod, 0.0f);
+    float maxLodSafe = SanitizeLodValue(meta.maxLod, minLodSafe);
+    maxLodSafe = std::min(maxLodSafe, maxMipLevel);
+    const float clampedMinLodSafe = std::min(minLodSafe, maxLodSafe);
+    const float lodBiasSafe = SanitizeLodBias(meta.lodBias);
+    const uint8_t maxLod = (maxLodSafe > 0.0f) ? ((maxLodSafe > 255.0f) ? 255u : static_cast<uint8_t>(maxLodSafe)) : 0u;
+    const uint32_t size = GXGetTexBufferSize(meta.width, meta.height, meta.format, (GXBool)meta.mipmap, maxLod);
+    if (size == 0 || !Memory::Contains(meta.dataAddr, size)) {
+        if (s_invalidDataLogCount++ < 64) {
+            auto* cpu = TryGetCpuContext();
+            RT_LOGF(RT_TAG_GX,
+                    "GXLoadTexObj rejected reason=data-out-of-range "
+                    "oa=0x%08X tid=%u data=0x%08X size=0x%X %ux%u fmt=0x%X mip=%u maxLod=%u pc=0x%08X lr=0x%08X\n",
+                    oa, tid, meta.dataAddr, size, meta.width, meta.height, meta.format,
+                    meta.mipmap ? 1u : 0u, static_cast<uint32_t>(maxLod),
+                    cpu ? cpu->pc : 0u, cpu ? cpu->lr : 0u);
+        }
+        BindUnloadableTexturePlaceholder(tid);
+        return;
+    }
+    const GXTexWrapMode wrapS = SanitizeWrapMode(meta.wrapS);
+    const GXTexWrapMode wrapT = SanitizeWrapMode(meta.wrapT);
+    const GXTexFilter minFilter = SanitizeMinFilter(meta.minFilter);
+    const GXTexFilter magFilter = SanitizeMagFilter(meta.magFilter);
+    const GXAnisotropy maxAnisoSafe = SanitizeAniso(meta.maxAniso);
+    meta.wrapS = static_cast<uint32_t>(wrapS);
+    meta.wrapT = static_cast<uint32_t>(wrapT);
+    meta.minFilter = static_cast<uint32_t>(minFilter);
+    meta.magFilter = static_cast<uint32_t>(magFilter);
+    meta.maxAniso = static_cast<uint32_t>(maxAnisoSafe);
+    meta.minLod = clampedMinLodSafe;
+    meta.maxLod = maxLodSafe;
+    meta.lodBias = lodBiasSafe;
+    
+    // Check if host texture object exists, create if needed
+    GXTexObj* obj = TryGetHostTexObj(oa);
+    const bool isPalette = IsPaletteTexFormat(meta.format);
+    bool needsInit = (obj == nullptr);
+    const auto metaIt = g_TexObjMeta.find(oa);
+    if (!needsInit && metaIt != g_TexObjMeta.end()) {
+        const TexObjMeta& cached = metaIt->second;
+        if (cached.width != meta.width || cached.height != meta.height || cached.format != meta.format ||
+            cached.wrapS != meta.wrapS || cached.wrapT != meta.wrapT || cached.mipmap != meta.mipmap ||
+            cached.minFilter != meta.minFilter || cached.magFilter != meta.magFilter ||
+            cached.minLod != meta.minLod || cached.maxLod != meta.maxLod ||
+            cached.lodBias != meta.lodBias || cached.biasClamp != meta.biasClamp ||
+            cached.edgeLod != meta.edgeLod || cached.maxAniso != meta.maxAniso ||
+            cached.tlut != meta.tlut || cached.userData != meta.userData) {
+            needsInit = true;
+        }
+    }
+    bool tlutChanged = false;
+    bool textureDataUploaded = false;
+    try {
+        if (needsInit) {
+            if (!obj) {
+                obj = CreateHostTexObj(oa);
+            }
+            void* dp = GuestToHostPtr(meta.dataAddr, size);
+            if (dp) {
+                if (isPalette) {
+                    GXInitTexObjCI(obj, dp, meta.width, meta.height, (GXCITexFmt)meta.format,
+                                   wrapS, wrapT,
+                                   meta.mipmap ? GX_TRUE : GX_FALSE, meta.tlut);
+                } else {
+                    GXInitTexObj(obj, dp, meta.width, meta.height, (GXTexFmt)meta.format,
+                                 wrapS, wrapT,
+                                 meta.mipmap ? GX_TRUE : GX_FALSE);
+                }
+                ApplyHostTexObjLod(obj, meta, minFilter, magFilter, meta.lodBias, maxAnisoSafe);
+                GXInitTexObjUserData(obj, GuestToHostPtr(meta.userData));
+            }
+            MarkHostTexObjConstructed(oa);
+            // Write through GetTexObjMeta so the DCStoreRange interval index is
+            // told this entry's backing may have moved.
+            GetTexObjMeta(oa) = meta;
+        } else if (isPalette && metaIt != g_TexObjMeta.end() && metaIt->second.tlut != meta.tlut) {
+            GXInitTexObjTlut(obj, meta.tlut);
+            GetTexObjMeta(oa).tlut = meta.tlut;
+            tlutChanged = true;
+        }
+
+        const void* dp = GuestToHostPtr(meta.dataAddr, size);
+        if (dp && meta.needsUpload) {
+            GXInitTexObjData(obj, dp);
+            meta.needsUpload = false;
+            textureDataUploaded = true;
+        }
+        // Everything the binding contract compares apart from objAddr is the
+        // shared sampler state, so copy that base wholesale; only dataAddr needs
+        // to be canonicalized on the way in.
+        BoundTexInfo newBound{};
+        static_cast<GxTextureBindingContract::SamplerState&>(newBound) = meta;
+        newBound.objAddr = oa;
+        newBound.dataAddr = CanonicalizeGxMainRamAddress(meta.dataAddr);
+        const BoundTexInfo& oldBound = g_boundTexMaps[tid];
+        const bool canSkipHostLoad = GxTextureBindingContract::CanSkipHostLoad(
+            oldBound, newBound, needsInit, tlutChanged, textureDataUploaded);
+
+        g_boundTexMaps[tid] = newBound;
+        GetTexObjMeta(oa) = meta;
+        if (!canSkipHostLoad) {
+            GXLoadTexObj(obj, (GXTexMapID)tid);
+        }
+    } catch (const std::exception& ex) {
+        if (s_hostExceptionLogCount++ < 64) {
+            RT_LOGF(RT_TAG_GX,
+                    "GXLoadTexObj rejected reason=host-exception (%s) oa=0x%08X tid=%u fmt=0x%X %ux%u data=0x%08X\n",
+                    ex.what(), oa, tid, meta.format, meta.width, meta.height, meta.dataAddr);
+        }
+        BindUnloadableTexturePlaceholder(tid);
+        return;
+    } catch (...) {
+        if (s_hostExceptionLogCount++ < 64) {
+            RT_LOGF(RT_TAG_GX,
+                    "GXLoadTexObj rejected reason=host-exception-unknown oa=0x%08X tid=%u fmt=0x%X %ux%u data=0x%08X\n",
+                    oa, tid, meta.format, meta.width, meta.height, meta.dataAddr);
+        }
+        BindUnloadableTexturePlaceholder(tid);
+        return;
+    }
+    try { uint32_t gd = Memory::Read32(kGXDataPtrAddr); if (gd) { Memory::Write32(gd + 0x5FCu, Memory::Read32(gd + 0x5FCu) | 1u); Memory::Write16(gd + 2, 0); } } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(80170f2c, GX__LoadTexObj_80170f2c, (uint32_t oa, uint32_t tid), (oa, tid));
+
+extern "C" void GX__LoadTexObjPreLoaded_80170dc8(uint32_t oa, uint32_t tid) { GX__LoadTexObj_80170f2c(oa, tid); }
+PPC_NATIVE_OVERRIDE_VOID(80170dc8, GX__LoadTexObjPreLoaded_80170dc8, (uint32_t oa, uint32_t tid), (oa, tid));
+
+// ============================================================================
+// Texture Object Getters
+// ============================================================================
+
+extern "C" void GX__GetTexObjAll_80170bf8(uint32_t oa, uint32_t dp, uint32_t wp, uint32_t hp, uint32_t fp, uint32_t wsp, uint32_t wtp, uint32_t mp) {
+    std::lock_guard<std::mutex> guard(g_texObjMutex);
+    TexObjMeta meta;
+    if (!TryGetOrExtractTexObjMeta(oa, meta)) {
+        RT_LOGF(RT_TAG_GX, "GXGetTexObjAll: failed to get metadata for GXTexObj @0x%08X\n", oa);
+        // Return zeros on failure
+        if (dp) Memory::Write32(dp, 0); if (wp) Memory::Write16(wp, 0); if (hp) Memory::Write16(hp, 0); 
+        if (fp) Memory::Write32(fp, 0); if (wsp) Memory::Write32(wsp, 0); if (wtp) Memory::Write32(wtp, 0); if (mp) Memory::Write8(mp, 0);
+        return;
+    }
+    if (dp) Memory::Write32(dp, meta.dataAddr); if (wp) Memory::Write16(wp, meta.width); if (hp) Memory::Write16(hp, meta.height); if (fp) Memory::Write32(fp, meta.format); if (wsp) Memory::Write32(wsp, meta.wrapS); if (wtp) Memory::Write32(wtp, meta.wrapT); if (mp) Memory::Write8(mp, meta.mipmap ? 1 : 0);
+}
+PPC_NATIVE_OVERRIDE_VOID(80170bf8, GX__GetTexObjAll_80170bf8, (uint32_t oa, uint32_t dp, uint32_t wp, uint32_t hp, uint32_t fp, uint32_t wsp, uint32_t wtp, uint32_t mp), (oa, dp, wp, hp, fp, wsp, wtp, mp));
+
+extern "C" void GX__GetTexObjLODAll_80170cbc(uint32_t oa, uint32_t mifp, uint32_t mafp, uint32_t milp, uint32_t malp, uint32_t lbp, uint32_t bcp, uint32_t elp, uint32_t map) {
+    std::lock_guard<std::mutex> guard(g_texObjMutex);
+    TexObjMeta meta;
+    if (!TryGetOrExtractTexObjMeta(oa, meta)) {
+        RT_LOGF(RT_TAG_GX, "GXGetTexObjLODAll: failed to get metadata for GXTexObj @0x%08X\n", oa);
+        // Return zeros on failure
+        if (mifp) Memory::Write32(mifp, 0); if (mafp) Memory::Write32(mafp, 0); if (milp) Memory::WriteFloat32(milp, 0.0f);
+        if (malp) Memory::WriteFloat32(malp, 0.0f); if (lbp) Memory::WriteFloat32(lbp, 0.0f); if (bcp) Memory::Write8(bcp, 0);
+        if (elp) Memory::Write8(elp, 0); if (map) Memory::Write32(map, 0);
+        return;
+    }
+    if (mifp) Memory::Write32(mifp, meta.minFilter); if (mafp) Memory::Write32(mafp, meta.magFilter); if (milp) Memory::WriteFloat32(milp, meta.minLod); if (malp) Memory::WriteFloat32(malp, meta.maxLod); if (lbp) Memory::WriteFloat32(lbp, meta.lodBias); if (bcp) Memory::Write8(bcp, meta.biasClamp ? 1 : 0); if (elp) Memory::Write8(elp, meta.edgeLod ? 1 : 0); if (map) Memory::Write32(map, meta.maxAniso);
+}
+PPC_NATIVE_OVERRIDE_VOID(80170cbc, GX__GetTexObjLODAll_80170cbc, (uint32_t oa, uint32_t mifp, uint32_t mafp, uint32_t milp, uint32_t malp, uint32_t lbp, uint32_t bcp, uint32_t elp, uint32_t map), (oa, mifp, mafp, milp, malp, lbp, bcp, elp, map));
+
+// ============================================================================
+// TLUT (Texture Lookup Table)
+// ============================================================================
+
+extern "C" void GX__InitTlutObj_80170f80(uint32_t oa, uint32_t da, uint32_t f, uint32_t e) {
+    std::lock_guard<std::mutex> guard(g_tlutObjMutex); GXTlutObj* obj = CreateHostTlutObj(oa); TlutObjMeta& meta = GetTlutObjMeta(oa);
+    meta.dataAddr=CanonicalizeGxMainRamAddress(da); meta.format=f; meta.entries=(u16)e; meta.dirty=false;
+    // Leave the object unconstructed on a bad descriptor. A later GXLoadTlut
+    // then takes GetHostTlutObj's soft-fail path and gets a fresh empty object
+    // instead of aurora reading entries*2 bytes off an unvalidated pointer.
+    if (!ValidateTlutData(oa, meta)) return;
+    GXInitTlutObj(obj, GuestToHostPtr(da), (GXTlutFmt)f, (u16)e); MarkHostTlutObjConstructed(oa);
+}
+PPC_NATIVE_OVERRIDE_VOID(80170f80, GX__InitTlutObj_80170f80, (uint32_t oa, uint32_t da, uint32_t f, uint32_t e), (oa, da, f, e));
+
+extern "C" void GX__LoadTlut_80170fa8(uint32_t oa, uint32_t tl) { std::lock_guard<std::mutex> guard(g_tlutObjMutex); if (tl >= kMaxTluts) { RT_LOGF(RT_TAG_GX, "GXLoadTlut: invalid TLUT index %u (oa=0x%08X)\n", tl, oa); return; } auto metaIt = g_TlutObjMeta.find(oa); if (metaIt != g_TlutObjMeta.end() && metaIt->second.dirty) { if (ValidateTlutData(oa, metaIt->second)) { GXTlutObj* rebuild = CreateHostTlutObj(oa); GXInitTlutObj(rebuild, GuestToHostPtr(metaIt->second.dataAddr), (GXTlutFmt)metaIt->second.format, metaIt->second.entries); MarkHostTlutObjConstructed(oa); } metaIt->second.dirty = false; } GXTlutObj* obj = GetHostTlutObj(oa); GXLoadTlut(obj, (GXTlut)tl); try { uint32_t gd = Memory::Read32(kGXDataPtrAddr); if (gd) Memory::Write16(gd + 2, 0); } catch (...) {} }
+PPC_NATIVE_OVERRIDE_VOID(80170fa8, GX__LoadTlut_80170fa8, (uint32_t oa, uint32_t tl), (oa, tl));
+
+// ============================================================================
+// Texture Invalidation and Coordinate Control
+// ============================================================================
+
+extern "C" void GX__InvalidateTexAll_80171110() {
+    // Real GX invalidates its internal texture cache here. Aurora forwards the
+    // invalidate to the renderer, which keeps unchanged source uploads hot but
+    // revalidates reused guest buffers before serving cached texture handles.
+    GXInvalidateTexAll();
+}
+PPC_NATIVE_OVERRIDE_VOID(80171110, GX__InvalidateTexAll_80171110, (), ());
+
+extern "C" void GX__SetTexCoordScaleManually_80171180(uint32_t c, uint32_t en, uint32_t ss, uint32_t ts) { GXSetTexCoordScaleManually((GXTexCoordID)c, (GXBool)en, (u16)ss, (u16)ts); try{ uint32_t gd=Memory::Read32(kGXDataPtrAddr); if(gd){ Memory::Write32(gd+0x5E4u, (Memory::Read32(gd+0x5E4u)&~(1u<<c))|((en&1u)<<c)); if(en){ uint32_t sa=gd+0x108u+c*4u, ta=gd+0x128u+c*4u; Memory::Write32(sa, (Memory::Read32(sa)&0xFFFF0000u)|((ss-1)&0xFFFFu)); Memory::Write32(ta, (Memory::Read32(ta)&0xFFFF0000u)|((ts-1)&0xFFFFu)); Memory::Write16(gd+2, 0); } } }catch(...){} }
+PPC_NATIVE_OVERRIDE_VOID(80171180, GX__SetTexCoordScaleManually_80171180, (uint32_t c, uint32_t en, uint32_t ss, uint32_t ts), (c, en, ss, ts));
+
+extern "C" void GX__SetTexCoordBias_801711fc(uint32_t c, uint32_t se, uint32_t te) { GXSetTexCoordBias((GXTexCoordID)c, (GXBool)se, (GXBool)te); try{ uint32_t gd=Memory::Read32(kGXDataPtrAddr); if(gd){ uint32_t sa=gd+0x108u+c*4u, ta=gd+0x128u+c*4u; Memory::Write32(sa, (Memory::Read32(sa)&0xFFFEFFFFu)|((se&1u)<<16)); Memory::Write32(ta, (Memory::Read32(ta)&0xFFFEFFFFu)|((te&1u)<<16)); if(Memory::Read32(gd+0x5E4u)&(1u<<c)) Memory::Write16(gd+2, 0); } }catch(...){} }
+PPC_NATIVE_OVERRIDE_VOID(801711fc, GX__SetTexCoordBias_801711fc, (uint32_t c, uint32_t se, uint32_t te), (c, se, te));
diff --git a/runtime/src/hle/gx/gx_texture_binding_contract.h b/runtime/src/hle/gx/gx_texture_binding_contract.h
new file mode 100644
index 0000000..f8ca7b2
--- /dev/null
+++ b/runtime/src/hle/gx/gx_texture_binding_contract.h
@@ -0,0 +1,66 @@
+#pragma once
+
+#include <cstdint>
+
+namespace GxTextureBindingContract {
+
+// Every piece of GX texture state that can change the bound view/sampler. Shared by `State`
+// (this plus the guest GXTexObj address) and HLE's TexObjMeta (this plus the `userData`/
+// `needsUpload` bookkeeping fields), so a new sampler field here reaches both.
+struct SamplerState {
+    uint32_t dataAddr = 0;
+    uint16_t width = 0;
+    uint16_t height = 0;
+    uint32_t format = 0;
+    uint32_t wrapS = 0;
+    uint32_t wrapT = 0;
+    uint32_t tlut = 0;
+    uint32_t minFilter = 0;
+    uint32_t magFilter = 0;
+    float minLod = 0.0f;
+    float maxLod = 0.0f;
+    float lodBias = 0.0f;
+    uint32_t maxAniso = 0;
+    bool biasClamp = false;
+    bool edgeLod = false;
+    bool mipmap = false;
+};
+
+// Guest code routinely reuses a GXTexObj at the same stack address, so that
+// address is not an object identity by itself - the sampler state above has to
+// be part of the snapshot.
+struct State : SamplerState {
+    uint32_t objAddr = 0;
+};
+
+inline bool SameSamplerState(const SamplerState& lhs, const SamplerState& rhs) noexcept {
+    return lhs.dataAddr == rhs.dataAddr &&
+           lhs.width == rhs.width &&
+           lhs.height == rhs.height &&
+           lhs.format == rhs.format &&
+           lhs.wrapS == rhs.wrapS &&
+           lhs.wrapT == rhs.wrapT &&
+           lhs.tlut == rhs.tlut &&
+           lhs.minFilter == rhs.minFilter &&
+           lhs.magFilter == rhs.magFilter &&
+           lhs.minLod == rhs.minLod &&
+           lhs.maxLod == rhs.maxLod &&
+           lhs.lodBias == rhs.lodBias &&
+           lhs.maxAniso == rhs.maxAniso &&
+           lhs.biasClamp == rhs.biasClamp &&
+           lhs.edgeLod == rhs.edgeLod &&
+           lhs.mipmap == rhs.mipmap;
+}
+
+inline bool SameBinding(const State& lhs, const State& rhs) noexcept {
+    return lhs.objAddr == rhs.objAddr && SameSamplerState(lhs, rhs);
+}
+
+inline bool CanSkipHostLoad(const State& oldBinding, const State& newBinding,
+                            bool needsInit, bool tlutChanged,
+                            bool textureDataUploaded) noexcept {
+    return SameBinding(oldBinding, newBinding) &&
+           !needsInit && !tlutChanged && !textureDataUploaded;
+}
+
+} // namespace GxTextureBindingContract
diff --git a/runtime/src/hle/gx/gx_transform.cpp b/runtime/src/hle/gx/gx_transform.cpp
new file mode 100644
index 0000000..f2a82a5
--- /dev/null
+++ b/runtime/src/hle/gx/gx_transform.cpp
@@ -0,0 +1,193 @@
+// gx_transform.cpp - Viewport, Projection, and Matrix Functions
+#include "isa/big_endian.h"
+#include "gx_internal.h"
+
+namespace {
+    static inline void SwapBeF32ArrayToHost(const uint32_t* srcBe, float* dst, size_t count) {
+        const auto* bytes = reinterpret_cast<const uint8_t*>(srcBe);
+        for (size_t i = 0; i < count; ++i) {
+            dst[i] = BigEndian::ReadFloat32(bytes + i * sizeof(uint32_t));
+        }
+    }
+
+    static void UpdateProjectionVectorFromMatrix(const float* mtxRowMajor, GXProjectionType projType) {
+        g_projectionVector[0] = (projType == GX_PERSPECTIVE) ? 0.0f : 1.0f;
+        g_projectionVector[1] = mtxRowMajor[0];
+        g_projectionVector[3] = mtxRowMajor[5];
+        g_projectionVector[5] = mtxRowMajor[10];
+        g_projectionVector[6] = mtxRowMajor[11];
+        if (projType == GX_PERSPECTIVE) {
+            g_projectionVector[2] = mtxRowMajor[2];
+            g_projectionVector[4] = mtxRowMajor[6];
+        } else {
+            g_projectionVector[2] = mtxRowMajor[3];
+            g_projectionVector[4] = mtxRowMajor[7];
+        }
+    }
+
+    static void UpdateProjectionVectorFromProjV(const float* projV) {
+        std::memcpy(g_projectionVector, projV, sizeof(g_projectionVector));
+    }
+
+}
+
+// ============================================================================
+// Viewport
+// ============================================================================
+
+// Viewport and scissor go to aurora in guest EFB coordinates, mapped to the active render target
+// exactly once inside gx::map_logical_viewport/map_logical_scissor. A prior VI origin/scale
+// transform double-transformed menu viewports and broke 640x480 overscan, so it was removed.
+extern "C" void GX__SetViewportJitter_80173378(float l, float t, float w, float h, float nz, float fz, uint32_t f) {
+    g_viewportState[0]=l; g_viewportState[1]=t; g_viewportState[2]=w; g_viewportState[3]=h; g_viewportState[4]=nz; g_viewportState[5]=fz;
+    GXSetViewportJitter(l, t, w, h, nz, fz, f);
+}
+PPC_NATIVE_OVERRIDE_VOID(80173378, GX__SetViewportJitter_80173378, (float l, float t, float w, float h, float nz, float fz, uint32_t f), (l, t, w, h, nz, fz, f));
+
+extern "C" void GX__SetViewport_801733b4(float l, float t, float w, float h, float nz, float fz) {
+    g_viewportState[0]=l; g_viewportState[1]=t; g_viewportState[2]=w; g_viewportState[3]=h; g_viewportState[4]=nz; g_viewportState[5]=fz;
+    GXSetViewport(l, t, w, h, nz, fz);
+}
+PPC_NATIVE_OVERRIDE_VOID(801733b4, GX__SetViewport_801733b4, (float l, float t, float w, float h, float nz, float fz), (l, t, w, h, nz, fz));
+
+extern "C" void GX__GetViewportv_801733e0(uint32_t oa) {
+    // EGG::StateGX::GXSetViewport (0x802418D0) reads the current viewport unconditionally, and
+    // every offscreen bake reaches it via its clear pass (0x8023DE7C) before building its own
+    // projection, so arming the frustum-scale bypass here always beats the bake, including
+    // RaceScene::createSubsystems's frame-boundary-less ones. Gated to one walk per GX frame to
+    // skip the cross-TU call on repeats, while the first viewport read of each frame stays unthrottled.
+    static int lastBypassFrame = -1;
+    if (lastBypassFrame != g_gxFrameCount) {
+        lastBypassFrame = g_gxFrameCount;
+        AssertMkwOffscreenScreenBypass();
+    }
+    if (!oa) return; for(int i=0; i<6; ++i) WriteGuestFloat(oa + i*4, g_viewportState[i]);
+}
+PPC_NATIVE_OVERRIDE_VOID(801733e0, GX__GetViewportv_801733e0, (uint32_t oa), (oa));
+
+extern "C" void GX__SetZScaleOffset_80173400(float s, float o) {
+    GXSetZScaleOffset(s, o);
+    try {
+        const uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (gd) {
+            constexpr float kZ24Scale = 16777215.0f;
+            Memory::WriteFloat32(gd + 0x55Cu, kZ24Scale * o);
+            Memory::WriteFloat32(gd + 0x560u, 1.0f + kZ24Scale * s);
+            Memory::Write32(gd + 0x5FCu, Memory::Read32(gd + 0x5FCu) | 0x10000000u);
+        }
+    } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(80173400, GX__SetZScaleOffset_80173400, (float s, float o), (s, o));
+
+extern "C" void GX__SetScissorBoxOffset_801734e0(int32_t xo, int32_t yo) {
+    GXSetScissorBoxOffset(xo, yo);
+    try {
+        const uint32_t gd = Memory::Read32(kGXDataPtrAddr);
+        if (gd) Memory::Write16(gd + 2, 0);
+    } catch (...) {}
+}
+PPC_NATIVE_OVERRIDE_VOID(801734e0, GX__SetScissorBoxOffset_801734e0, (int32_t xo, int32_t yo), (xo, yo));
+
+// ============================================================================
+// Scissor
+// ============================================================================
+
+extern "C" void GX__SetScissor_80173430(uint32_t l, uint32_t t, uint32_t w, uint32_t h) {
+    g_scissorLeft=(int32_t)l; g_scissorTop=(int32_t)t; g_scissorWidth=(int32_t)w; g_scissorHeight=(int32_t)h;
+    try { uint32_t gd=Memory::Read32(kGXDataPtrAddr); if(gd){
+        uint32_t r148=Memory::Read32(gd+0x148), r14c=Memory::Read32(gd+0x14c);
+        uint32_t sx=g_scissorLeft+0x156, sy=g_scissorTop+0x156, ex=sx+g_scissorWidth-1, ey=sy+g_scissorHeight-1;
+        Memory::Write32(gd+0x148, ((sx<<12)&0x7ff000u)|(sy&0x7ffu)|(r148&0xff800800u));
+        Memory::Write32(gd+0x14c, ((ex<<12)&0x7ff000u)|(ey&0x7ffu)|(r14c&0xff800800u));
+        Memory::Write16(gd+2, 0);
+    } } catch(...) {}
+    // No viewport replay here: aurora recomputes viewport and scissor together
+    // on every scissor change (set_logical_scissor -> apply_logical_render_state),
+    // so re-issuing the current viewport would be duplicate work.
+    GXSetScissor(l, t, w, h);
+}
+PPC_NATIVE_OVERRIDE_VOID(80173430, GX__SetScissor_80173430, (uint32_t l, uint32_t t, uint32_t w, uint32_t h), (l, t, w, h));
+
+// ============================================================================
+// Projection
+// ============================================================================
+
+extern "C" void GX__SetProjection_8017301c(uint32_t ma, uint32_t pt) {
+    const uint32_t* raw=(const uint32_t*)GuestToHostPtr(ma, 64); float m[16];
+    SwapBeF32ArrayToHost(raw, m, 16);
+    GXSetProjection(m, (GXProjectionType)pt);
+    UpdateProjectionVectorFromMatrix(m, (GXProjectionType)pt);
+}
+PPC_NATIVE_OVERRIDE_VOID(8017301c, GX__SetProjection_8017301c, (uint32_t ma, uint32_t pt), (ma, pt));
+
+extern "C" void GX__SetProjectionv_80173080(uint32_t pa) {
+    const uint32_t* raw=(const uint32_t*)GuestToHostPtr(pa, 28); float v[7];
+    SwapBeF32ArrayToHost(raw, v, 7);
+    GXProjectionType pt=(v[0]!=0.f)?GX_ORTHOGRAPHIC:GX_PERSPECTIVE;
+    float m[16]={0.f}; m[0]=v[1]; m[5]=v[3]; m[10]=v[5]; m[11]=v[6];
+    if(pt==GX_PERSPECTIVE){ m[2]=v[2]; m[6]=v[4]; m[14]=-1.f; } else { m[3]=v[2]; m[7]=v[4]; m[15]=1.f; }
+    GXSetProjection(m, pt);
+    UpdateProjectionVectorFromProjV(v);
+}
+PPC_NATIVE_OVERRIDE_VOID(80173080, GX__SetProjectionv_80173080, (uint32_t pa), (pa));
+
+extern "C" void GX__GetProjectionv_801730cc(uint32_t pa) {
+    uint8_t* out = static_cast<uint8_t*>(GuestToHostPtr(pa, 28));
+    for (int i = 0; i < 7; ++i) {
+        BigEndian::WriteFloat32(out + i * sizeof(float), g_projectionVector[i]);
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(801730cc, GX__GetProjectionv_801730cc, (uint32_t pa), (pa));
+
+// ============================================================================
+// Matrix Loading
+// ============================================================================
+
+extern "C" void GX__LoadPosMtxImm_8017310c(uint32_t ma, uint32_t id) {
+    const uint32_t* raw=(const uint32_t*)GuestToHostPtr(ma); float m[12];
+    SwapBeF32ArrayToHost(raw, m, 12);
+    GXLoadPosMtxImm((float(*)[4])m, id);
+}
+PPC_NATIVE_OVERRIDE_VOID(8017310c, GX__LoadPosMtxImm_8017310c, (uint32_t ma, uint32_t id), (ma, id));
+
+extern "C" void GX__LoadPosMtxIndx_8017315c(uint32_t mi, uint32_t id) {
+    const auto& arr=g_hleGxState.vtxArray[GX_POS_MTX_ARRAY];
+    if(arr.base==0||arr.stride==0) return;
+    const uint32_t* raw=(const uint32_t*)GuestToHostPtr(arr.base+mi*arr.stride, 48);
+    if(raw){ float m[12]; SwapBeF32ArrayToHost(raw,m,12); GXLoadPosMtxImm((float(*)[4])m,id); }
+}
+PPC_NATIVE_OVERRIDE_VOID(8017315c, GX__LoadPosMtxIndx_8017315c, (uint32_t mi, uint32_t id), (mi, id));
+
+extern "C" void GX__LoadNrmMtxImm_80173188(uint32_t ma, uint32_t id) {
+    const uint32_t* raw=(const uint32_t*)GuestToHostPtr(ma, 48); float m[12];
+    SwapBeF32ArrayToHost(raw, m, 12); GXLoadNrmMtxImm((float(*)[4])m, id);
+}
+PPC_NATIVE_OVERRIDE_VOID(80173188, GX__LoadNrmMtxImm_80173188, (uint32_t ma, uint32_t id), (ma, id));
+
+extern "C" void GX__LoadNrmMtxIndx3x3_801731e0(uint32_t mi, uint32_t id) {
+    const auto& arr=g_hleGxState.vtxArray[GX_NRM_MTX_ARRAY];
+    if(arr.base==0||arr.stride==0) return;
+    const uint32_t* raw=(const uint32_t*)GuestToHostPtr(arr.base+mi*arr.stride, 36);
+    if(raw){
+        float src[9]{};
+        float m[12]{};
+        SwapBeF32ArrayToHost(raw, src, 9);
+        for (uint32_t row = 0; row < 3; ++row) {
+            for (uint32_t col = 0; col < 3; ++col) {
+                m[row * 4 + col] = src[row * 3 + col];
+            }
+        }
+        GXLoadNrmMtxImm((float(*)[4])m, id);
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(801731e0, GX__LoadNrmMtxIndx3x3_801731e0, (uint32_t mi, uint32_t id), (mi, id));
+
+extern "C" void GX__LoadTexMtxImm_80173234(uint32_t ma, uint32_t id, uint32_t t) {
+    size_t c=(t==(uint32_t)GX_MTX3x4)?12:8;
+    const uint32_t* raw=(const uint32_t*)GuestToHostPtr(ma,c*4); float l[12]={};
+    SwapBeF32ArrayToHost(raw,l,c); GXLoadTexMtxImm(l, id, (GXTexMtxType)t);
+}
+PPC_NATIVE_OVERRIDE_VOID(80173234, GX__LoadTexMtxImm_80173234, (uint32_t ma, uint32_t id, uint32_t t), (ma, id, t));
+
+extern "C" void GX__SetCurrentMtx_80173214(uint32_t id) { GXSetCurrentMtx(id); }
+PPC_NATIVE_OVERRIDE_VOID(80173214, GX__SetCurrentMtx_80173214, (uint32_t id), (id));
diff --git a/runtime/src/hle/gx/gx_utils.cpp b/runtime/src/hle/gx/gx_utils.cpp
new file mode 100644
index 0000000..aed1e5d
--- /dev/null
+++ b/runtime/src/hle/gx/gx_utils.cpp
@@ -0,0 +1,67 @@
+#include "gx_internal.h"
+#include "runtime_log.h"
+
+extern "C" {
+int g_gxFrameCount = 0;
+
+int32_t g_scissorLeft = 0;
+int32_t g_scissorTop = 0;
+int32_t g_scissorWidth = 0;
+int32_t g_scissorHeight = 0;
+
+float g_viewportState[6] = {0.f, 0.f, 1.f, 1.f, 0.f, 1.f};
+float g_projectionVector[7] = {1.f, 1.f, 0.f, 1.f, 0.f, -1.f, 0.f};
+}
+
+bool g_alphaCompareValid = false;
+
+TexCopyState g_texCopyState;
+
+GXColor DecodeGxColor(uint32_t colorWord) {
+    GXColor color{};
+    color.r = static_cast<uint8_t>((colorWord >> 24) & 0xFF);
+    color.g = static_cast<uint8_t>((colorWord >> 16) & 0xFF);
+    color.b = static_cast<uint8_t>((colorWord >> 8) & 0xFF);
+    color.a = static_cast<uint8_t>(colorWord & 0xFF);
+    return color;
+}
+
+void WriteGuestFloat(uint32_t addr, float value, const char* label) {
+    if (addr == 0) return;
+    try { Memory::WriteFloat32(addr, value); } catch (const Memory::AccessViolation& e) { LogMemoryError(RT_TAG_GX, label ? label : "GX write", e); }
+}
+
+void* GuestToHostPtr(uint32_t addr, size_t len) {
+    if (addr == 0) return nullptr;
+    try { return Memory::GetPointer(addr, len); } catch (const Memory::AccessViolation& e) { LogMemoryError(RT_TAG_GX, "GX guest pointer", e); return nullptr; }
+}
+
+void WriteGuest32(uint32_t addr, uint32_t value, const char* label) {
+    if (addr == 0) return;
+    try { Memory::Write32(addr, value); } catch (const Memory::AccessViolation& e) { LogMemoryError(RT_TAG_GX, label ? label : "GX write32", e); }
+}
+
+bool IsKnownTexFormat(uint32_t fmt) {
+    switch (fmt) {
+    case GX_TF_I4: case GX_TF_I8: case GX_TF_IA4: case GX_TF_IA8: case GX_TF_RGB565: case GX_TF_RGB5A3: case GX_TF_RGBA8: case GX_TF_CMPR: case GX_TF_C4: case GX_TF_C8: case GX_TF_C14X2: case GX_TF_Z8: case GX_TF_Z16: case GX_TF_Z24X8: case GX_CTF_R4: case GX_CTF_RA4: case GX_CTF_RA8: case GX_CTF_YUVA8: case GX_CTF_A8: case GX_CTF_R8: case GX_CTF_G8: case GX_CTF_B8: case GX_CTF_RG8: case GX_CTF_GB8: case GX_CTF_Z4: case GX_CTF_Z8M: case GX_CTF_Z8L: case GX_CTF_Z16L: return true;
+    default: return false;
+    }
+}
+
+bool IsPaletteTexFormat(uint32_t fmt) { return fmt == GX_TF_C4 || fmt == GX_TF_C8 || fmt == GX_TF_C14X2; }
+bool IsKnownTlutFormat(uint32_t fmt) { switch (fmt) { case GX_TL_IA8: case GX_TL_RGB565: case GX_TL_RGB5A3: return true; default: return false; } }
+
+// Returns false when the guest's TLUT descriptor is unusable. Callers must not
+// hand the descriptor to aurora in that case: aurora reads entries*2 bytes from
+// the pointer at load time, so a bad address or entry count is an out-of-range
+// native read. This used to only log and let the call through, which is why the
+// return value now exists.
+bool ValidateTlutData(uint32_t objAddr, const TlutObjMeta& meta) {
+    if (meta.dataAddr == 0 || meta.entries == 0) { RT_LOGF(RT_TAG_GX, "invalid TLUT data (oa=0x%08X)\n", objAddr); return false; }
+    if (!IsKnownTlutFormat(meta.format)) { RT_LOGF(RT_TAG_GX, "invalid TLUT format 0x%X (oa=0x%08X)\n", meta.format, objAddr); return false; }
+    if (!Memory::Contains(meta.dataAddr, static_cast<uint32_t>(meta.entries) * 2u)) {
+        RT_LOGF(RT_TAG_GX, "invalid TLUT range (oa=0x%08X data=0x%08X entries=%u)\n", objAddr, meta.dataAddr, meta.entries);
+        return false;
+    }
+    return true;
+}
diff --git a/runtime/src/hle/gx/gx_vertex.cpp b/runtime/src/hle/gx/gx_vertex.cpp
new file mode 100644
index 0000000..68cbf92
--- /dev/null
+++ b/runtime/src/hle/gx/gx_vertex.cpp
@@ -0,0 +1,401 @@
+// gx_vertex.cpp - Vertex Descriptor and Attribute Functions
+#include "gx_internal.h"
+#include "gx_stream_common.h"
+#include "fiber_manager.h"
+#include "guest_interrupt_context.h"
+#include "runtime_log.h"
+
+#include <cstdio>
+#include <cstdlib>
+
+namespace {
+uint32_t CanonicalVtxAttr(uint32_t attr) {
+    return attr == GX_VA_NBT ? GX_VA_NRM : attr;
+}
+
+// There is deliberately no indexed-aurora path here. The immediate begin path
+// streams vertex data incrementally, and aurora's indexed-array upload must
+// precede the draw carrying the max-index bounds, which cannot be known without
+// buffering the whole primitive. Indexed attributes are therefore expanded into
+// the packed direct stream below (GX_INDEX8/16 -> GX_DIRECT).
+void ApplyAuroraVtxStateForBegin(GXVtxFmt fmt) {
+    GxStream::PublishAuroraVtxState(fmt,
+                                    GxStream::AuroraVtxPublishOptions{
+                                        /*includeNbt=*/false,
+                                        /*fmtLoopFirst=*/static_cast<int>(GX_VA_POS),
+                                        /*fmtLoopLast=*/static_cast<int>(GX_VA_TEX7)});
+}
+}
+
+// ============================================================================
+// Vertex Descriptor
+// ============================================================================
+
+extern "C" void GX__ClearVtxDesc_8016dc34() {
+    bool changed = false;
+    for(int i=0; i<26; ++i){
+        changed |= g_hleGxState.vtxDesc[i] != GX_NONE;
+        g_hleGxState.vtxDesc[i]=GX_NONE;
+    }
+    if (changed) g_hleGxState.InvalidateVtxLayoutHash();
+    // GXClearVtxDesc resets descriptors only; array base/stride state persists.
+    GXClearVtxDesc();
+}
+PPC_NATIVE_OVERRIDE_VOID(8016dc34, GX__ClearVtxDesc_8016dc34, (), ());
+
+extern "C" void GX__SetVtxDesc_8016d3a4(uint32_t a, uint32_t t) {
+    const uint32_t attr = CanonicalVtxAttr(a);
+    if(attr>=26||attr==GX_VA_NULL) return;
+    const GXAttrType oldType = g_hleGxState.vtxDesc[attr];
+    g_hleGxState.vtxDesc[attr]=(GXAttrType)t;
+    if (a == GX_VA_NBT) {
+        g_hleGxState.vtxDesc[GX_VA_NBT] = GX_NONE;
+    }
+    if (g_hleGxState.vtxDesc[attr] != oldType) g_hleGxState.InvalidateVtxLayoutHash();
+    if(IsMatrixIndexAttr((GXAttr)attr)) return;
+    GXSetVtxDesc((GXAttr)a, (t==GX_INDEX8||t==GX_INDEX16)?GX_DIRECT:(GXAttrType)t);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016d3a4, GX__SetVtxDesc_8016d3a4, (uint32_t a, uint32_t t), (a, t));
+
+extern "C" void GX__SetVtxDescv_8016d608(uint32_t la) {
+    if(!la) return; uint32_t p=la;
+    while(true){
+        uint32_t a=Memory::Read32(p);
+        if(a==0xFFu) break;
+        GX__SetVtxDesc_8016d3a4(a, Memory::Read32(p+4));
+        p+=8;
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(8016d608, GX__SetVtxDescv_8016d608, (uint32_t la), (la));
+
+extern "C" void GX__GetVtxDesc_8016d9f0(uint32_t a, uint32_t tp) {
+    GXAttrType type = GX_NONE;
+    const uint32_t attr = CanonicalVtxAttr(a);
+    if (attr < GX_VA_MAX_ATTR && attr != GX_VA_NULL) {
+        type = g_hleGxState.vtxDesc[attr];
+    }
+    if (tp) {
+        Memory::Write32(tp, static_cast<uint32_t>(type));
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(8016d9f0, GX__GetVtxDesc_8016d9f0, (uint32_t a, uint32_t tp), (a, tp));
+
+extern "C" void GX__GetVtxDescv_8016dba4(uint32_t la) {
+    if (!la) {
+        return;
+    }
+
+    uint32_t p = la;
+    for (uint32_t a = GX_VA_PNMTXIDX; a <= GX_VA_TEX7; ++a) {
+        Memory::Write32(p, a);
+        Memory::Write32(p + 4, static_cast<uint32_t>(g_hleGxState.vtxDesc[a]));
+        p += 8;
+    }
+    Memory::Write32(p, GX_VA_NBT);
+    Memory::Write32(p + 4, static_cast<uint32_t>(g_hleGxState.vtxDesc[GX_VA_NRM]));
+    p += 8;
+    Memory::Write32(p, GX_VA_NULL);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016dba4, GX__GetVtxDescv_8016dba4, (uint32_t la), (la));
+
+// ============================================================================
+// Vertex Attribute Format
+// ============================================================================
+
+extern "C" void GX__SetVtxAttrFmt_8016dc68(uint32_t vf, uint32_t a, uint32_t c, uint32_t t, uint32_t fr) {
+    const uint32_t attr = CanonicalVtxAttr(a);
+    if(vf<8&&attr<26){
+        const VtxAttrFmt oldFmt = g_hleGxState.vtxAttrFmt[vf][attr];
+        g_hleGxState.vtxAttrFmt[vf][attr].cnt=(GXCompCnt)c;
+        g_hleGxState.vtxAttrFmt[vf][attr].type=(GXCompType)t;
+        g_hleGxState.vtxAttrFmt[vf][attr].frac=(u8)fr;
+        if (a == GX_VA_NBT) {
+            g_hleGxState.vtxAttrFmt[vf][GX_VA_NBT] = {};
+        }
+        const auto& newFmt = g_hleGxState.vtxAttrFmt[vf][attr];
+        if (oldFmt.cnt != newFmt.cnt || oldFmt.type != newFmt.type || oldFmt.frac != newFmt.frac) {
+            g_hleGxState.InvalidateVtxLayoutHash();
+        }
+    }
+    if (vf >= GX_MAX_VTXFMT || a < GX_VA_POS || a >= GX_VA_MAX_ATTR) {
+        return;
+    }
+    GXSetVtxAttrFmt((GXVtxFmt)vf, (GXAttr)a, (GXCompCnt)c, (GXCompType)t, (u8)fr);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016dc68, GX__SetVtxAttrFmt_8016dc68, (uint32_t vf, uint32_t a, uint32_t c, uint32_t t, uint32_t fr), (vf, a, c, t, fr));
+
+extern "C" void GX__SetVtxAttrFmtv_8016de08(uint32_t vf, uint32_t la) {
+    if(!la) return; uint32_t p=la;
+    while(true){
+        uint32_t a=Memory::Read32(p);
+        if(a==0xFFu) break;
+        GX__SetVtxAttrFmt_8016dc68(vf, a, Memory::Read32(p+4), Memory::Read32(p+8), Memory::Read32(p+12)&0xFFu);
+        p+=16;
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(8016de08, GX__SetVtxAttrFmtv_8016de08, (uint32_t vf, uint32_t la), (vf, la));
+
+extern "C" void GX__GetVtxAttrFmt_8016e04c(uint32_t vf, uint32_t a, uint32_t cp, uint32_t tp, uint32_t fp) {
+    VtxAttrFmt fmt{};
+    const uint32_t attr = CanonicalVtxAttr(a);
+    if (vf < 8 && attr < GX_VA_MAX_ATTR && attr != GX_VA_NULL) {
+        fmt = g_hleGxState.vtxAttrFmt[vf][attr];
+    }
+    if (cp) {
+        Memory::Write32(cp, static_cast<uint32_t>(fmt.cnt));
+    }
+    if (tp) {
+        Memory::Write32(tp, static_cast<uint32_t>(fmt.type));
+    }
+    if (fp) {
+        Memory::Write8(fp, fmt.frac);
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(8016e04c, GX__GetVtxAttrFmt_8016e04c, (uint32_t vf, uint32_t a, uint32_t cp, uint32_t tp, uint32_t fp), (vf, a, cp, tp, fp));
+
+extern "C" void GX__GetVtxAttrFmtv_8016e2b8(uint32_t vf, uint32_t la) {
+    if (!la) {
+        return;
+    }
+
+    uint32_t p = la;
+    for (uint32_t a = GX_VA_POS; a <= GX_VA_TEX7; ++a) {
+        VtxAttrFmt fmt{};
+        if (vf < 8) {
+            fmt = g_hleGxState.vtxAttrFmt[vf][a];
+        }
+        Memory::Write32(p, a);
+        Memory::Write32(p + 4, static_cast<uint32_t>(fmt.cnt));
+        Memory::Write32(p + 8, static_cast<uint32_t>(fmt.type));
+        Memory::Write8(p + 12, fmt.frac);
+        p += 16;
+    }
+    Memory::Write32(p, GX_VA_NULL);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016e2b8, GX__GetVtxAttrFmtv_8016e2b8, (uint32_t vf, uint32_t la), (vf, la));
+
+// ============================================================================
+// Vertex Arrays
+// ============================================================================
+
+extern "C" void GX__SetArray_8016e32c(uint32_t a, uint32_t ba, uint32_t str) {
+    const uint32_t attr = CanonicalVtxAttr(a);
+    if(attr<26){ g_hleGxState.vtxArray[attr].base=ba; g_hleGxState.vtxArray[attr].stride=str; }
+}
+PPC_NATIVE_OVERRIDE_VOID(8016e32c, GX__SetArray_8016e32c, (uint32_t a, uint32_t ba, uint32_t str), (a, ba, str));
+
+// Switch-artifact entry point for the same SDK function; forwards rather than
+// repeating the body.
+extern "C" void GX__SetArray_8016e1c4(uint32_t a, uint32_t b, uint32_t s) { GX__SetArray_8016e32c(a, b, s); }
+PPC_NATIVE_OVERRIDE_VOID(8016e1c4, GX__SetArray_8016e1c4, (uint32_t a, uint32_t b, uint32_t s), (a, b, s));
+
+// ============================================================================
+// Texture Coordinate Generation
+// ============================================================================
+
+extern "C" void GX__SetNumTexGens_8016e5a4(uint32_t n) {
+    GXSetNumTexGens((u8)n);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016e5a4, GX__SetNumTexGens_8016e5a4, (uint32_t n), (n));
+
+extern "C" void GX__SetTexCoordGen2_8016e37c(uint32_t dc, uint32_t f, uint32_t sp, uint32_t m, uint32_t n, uint32_t pm) {
+    if (sp >= static_cast<uint32_t>(GX_MAX_TEXGENSRC)) {
+        uint32_t pc = 0;
+        uint32_t lr = 0;
+        if (auto* cpu = TryGetCpuContext()) {
+            pc = cpu->pc;
+            lr = cpu->lr;
+        }
+        RT_LOGF(RT_TAG_GX,
+                "GXSetTexCoordGen2 invalid src=%u dst=%u type=%u mtx=%u norm=%u post=%u PC=0x%08X LR=0x%08X\n",
+                sp, dc, f, m, n, pm, pc, lr);
+    }
+    GXSetTexCoordGen2((GXTexCoordID)dc, (GXTexGenType)f, (GXTexGenSrc)sp, m, (GXBool)n, pm);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016e37c, GX__SetTexCoordGen2_8016e37c, (uint32_t dc, uint32_t f, uint32_t sp, uint32_t m, uint32_t n, uint32_t pm), (dc, f, sp, m, n, pm));
+
+extern "C" void GX__EnableTexOffsets_8016f37c(uint32_t coord, uint32_t lineEnable, uint32_t pointEnable) {
+    GXEnableTexOffsets(static_cast<GXTexCoordID>(coord),
+                       lineEnable ? GX_TRUE : GX_FALSE,
+                       pointEnable ? GX_TRUE : GX_FALSE);
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f37c, GX__EnableTexOffsets_8016f37c, (uint32_t coord, uint32_t lineEnable, uint32_t pointEnable), (coord, lineEnable, pointEnable));
+
+extern "C" void GX__SetLineWidth_8016f314(uint32_t width, uint32_t texOffsets) {
+    GXSetLineWidth(static_cast<u8>(width), static_cast<GXTexOffset>(texOffsets));
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f314, GX__SetLineWidth_8016f314, (uint32_t width, uint32_t texOffsets), (width, texOffsets));
+
+extern "C" void GX__SetPointSize_8016f348(uint32_t pointSize, uint32_t texOffsets) {
+    GXSetPointSize(static_cast<u8>(pointSize), static_cast<GXTexOffset>(texOffsets));
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f348, GX__SetPointSize_8016f348, (uint32_t pointSize, uint32_t texOffsets), (pointSize, texOffsets));
+
+// ============================================================================
+// Begin/End Drawing
+// ============================================================================
+
+namespace {
+thread_local bool g_inGxBeginOrFifo = false;
+thread_local std::chrono::steady_clock::time_point g_nextDeferredTimingPoll{};
+
+void ServiceDeferredTimingDuringGxWork() {
+    if (g_inGxBeginOrFifo) {
+        return;
+    }
+
+    const auto now = std::chrono::steady_clock::now();
+    if (now < g_nextDeferredTimingPoll) {
+        return;
+    }
+    g_nextDeferredTimingPoll = now + std::chrono::milliseconds(1);
+
+    g_inGxBeginOrFifo = true;
+    try {
+        if (Fiber::GuestFiberManager::IsInitialized()) {
+            // VI callbacks are what advance EGG::AsyncDisplay on NTSC/PAL60;
+            // PAL50 uses an OS alarm. Keep both clocks moving while a slow
+            // host frame is still being submitted, but defer fiber switches
+            // and Aurora work until the native GX call has unwound.
+            VI_HLE_ProcessRetracesDeferred(8);
+            OS_HLE_ProcessAlarmsDeferred(8);
+        } else if (TryGetCpuContext() != nullptr) {
+            // Same interrupt isolation as the deferred paths above: this GX call
+            // is mid-execution of a translated function, so the retrace
+            // callbacks must not publish their registers into its context.
+            GuestInterruptCallbackContext interrupt;
+            VI_HLE_PollRetrace(interrupt.get());
+        }
+    } catch (...) {
+        g_inGxBeginOrFifo = false;
+        throw;
+    }
+    g_inGxBeginOrFifo = false;
+}
+}
+
+extern "C" void GX__Begin_8016f0f0(uint32_t t, uint32_t vf, uint32_t nv) {
+    if(IsDisplayListActive()){
+        WriteDisplayListData((u8)(t|vf), 1);
+        WriteDisplayListData((u16)nv, 2);
+        return;
+    }
+    ServiceDeferredTimingDuringGxWork();
+    ApplyAuroraVtxStateForBegin(static_cast<GXVtxFmt>(vf));
+    g_hleGxState.currentVtxFmt=(GXVtxFmt)vf; g_hleGxState.currentPrim=(GXPrimitive)t;
+    g_hleGxState.vertsRemaining=nv; g_hleGxState.inBegin=true; g_hleGxState.auroraBeginCalled=false;
+    g_hleGxState.fifoReadOffset = 0;
+    g_hleGxState.fifoByteCount=0; g_hleGxState.ResetVertex();
+}
+PPC_NATIVE_OVERRIDE_VOID(8016f0f0, GX__Begin_8016f0f0, (uint32_t t, uint32_t vf, uint32_t nv), (t, vf, nv));
+
+extern "C" void GX__End_80044b30() { g_hleGxState.inBegin=false; GXEnd(); }
+PPC_NATIVE_OVERRIDE_VOID(80044b30, GX__End_80044b30, (), ());
+
+extern "C" void GX__End_80048c30() { GX__End_80044b30(); }
+PPC_NATIVE_OVERRIDE_VOID(80048c30, GX__End_80048c30, (), ());
+
+extern "C" void GX__DrawSphere_80172a30(uint32_t numMajor, uint32_t numMinor) {
+    constexpr uint32_t kAttrCount = 26;
+    constexpr float kSphereRadius = 1.0f;
+    constexpr float kPi = 3.14159265358979323846f;
+    constexpr float kTwoPi = kPi * 2.0f;
+
+    std::array<GXAttrType, kAttrCount> savedVtxDesc{};
+    std::array<VtxAttrFmt, kAttrCount> savedFmt3{};
+    for (uint32_t i = 0; i < kAttrCount; ++i) {
+        savedVtxDesc[i] = g_hleGxState.vtxDesc[i];
+        savedFmt3[i] = g_hleGxState.vtxAttrFmt[GX_VTXFMT3][i];
+    }
+
+    const bool hadTex0 = savedVtxDesc[GX_VA_TEX0] != GX_NONE;
+
+    bool drawOpen = false;
+    try {
+        EnsureAuroraFrameActive();
+
+        for (uint32_t i = 0; i < kAttrCount; ++i) {
+            g_hleGxState.vtxDesc[i] = GX_NONE;
+        }
+        g_hleGxState.InvalidateVtxLayoutHash();
+        GXClearVtxDesc();
+
+        GX__SetVtxDesc_8016d3a4(GX_VA_POS, GX_DIRECT);
+        GX__SetVtxDesc_8016d3a4(GX_VA_NRM, GX_DIRECT);
+        GX__SetVtxAttrFmt_8016dc68(GX_VTXFMT3, GX_VA_POS, GX_POS_XYZ, GX_F32, 0);
+        GX__SetVtxAttrFmt_8016dc68(GX_VTXFMT3, GX_VA_NRM, GX_NRM_XYZ, GX_F32, 0);
+        if (hadTex0) {
+            GX__SetVtxDesc_8016d3a4(GX_VA_TEX0, GX_DIRECT);
+            GX__SetVtxAttrFmt_8016dc68(GX_VTXFMT3, GX_VA_TEX0, GX_TEX_ST, GX_F32, 0);
+        }
+
+        const float majorStep = kPi / static_cast<float>(numMajor);
+        const float minorStep = kTwoPi / static_cast<float>(numMinor);
+        const float invRadius = 1.0f / kSphereRadius;
+
+        for (uint32_t major = 0; major < numMajor; ++major) {
+            const float major0 = static_cast<float>(major) * majorStep;
+            const float major1 = major0 + majorStep;
+
+            const float ring0 = kSphereRadius * std::sin(major0);
+            const float ring1 = kSphereRadius * std::sin(major1);
+            const float z0 = kSphereRadius * std::cos(major0);
+            const float z1 = kSphereRadius * std::cos(major1);
+
+            const uint16_t vertexCount = static_cast<uint16_t>(((numMinor + 1u) * 2u) & 0xFFFEu);
+            GXBegin(GX_TRIANGLESTRIP, GX_VTXFMT3, vertexCount);
+            drawOpen = true;
+
+            const float nz0 = z0 * invRadius;
+            const float nz1 = z1 * invRadius;
+
+            for (uint32_t minor = 0; minor <= numMinor; ++minor) {
+                const float minorAngle = static_cast<float>(minor) * minorStep;
+                const float c = std::cos(minorAngle);
+                const float s = std::sin(minorAngle);
+
+                const float x1 = c * ring1;
+                const float y1 = s * ring1;
+                GXPosition3f32(x1, y1, z1);
+                GXNormal3f32(x1 * invRadius, y1 * invRadius, nz1);
+                if (hadTex0) {
+                    GXTexCoord2f32(static_cast<float>(minor) / static_cast<float>(numMinor),
+                                   static_cast<float>(major + 1u) / static_cast<float>(numMajor));
+                }
+
+                const float x0 = c * ring0;
+                const float y0 = s * ring0;
+                GXPosition3f32(x0, y0, z0);
+                GXNormal3f32(x0 * invRadius, y0 * invRadius, nz0);
+                if (hadTex0) {
+                    GXTexCoord2f32(static_cast<float>(minor) / static_cast<float>(numMinor),
+                                   static_cast<float>(major) / static_cast<float>(numMajor));
+                }
+            }
+            GXEnd();
+            drawOpen = false;
+        }
+    } catch (...) {
+        if (drawOpen) {
+            GXEnd();
+            drawOpen = false;
+        }
+    }
+
+    for (uint32_t i = 0; i < kAttrCount; ++i) {
+        g_hleGxState.vtxDesc[i] = GX_NONE;
+    }
+    g_hleGxState.InvalidateVtxLayoutHash();
+    GXClearVtxDesc();
+    for (uint32_t attr = 0; attr < kAttrCount; ++attr) {
+        const GXAttrType type = savedVtxDesc[attr];
+        if (type != GX_NONE) {
+            GX__SetVtxDesc_8016d3a4(attr, static_cast<uint32_t>(type));
+        }
+    }
+    for (uint32_t attr = GX_VA_POS; attr <= GX_VA_TEX7; ++attr) {
+        const VtxAttrFmt& fmt = savedFmt3[attr];
+        GX__SetVtxAttrFmt_8016dc68(GX_VTXFMT3, attr, static_cast<uint32_t>(fmt.cnt), static_cast<uint32_t>(fmt.type), fmt.frac);
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(80172a30, GX__DrawSphere_80172a30, (uint32_t numMajor, uint32_t numMinor), (numMajor, numMinor));
diff --git a/runtime/src/hle/input/kpad.cpp b/runtime/src/hle/input/kpad.cpp
new file mode 100644
index 0000000..5e87c4a
--- /dev/null
+++ b/runtime/src/hle/input/kpad.cpp
@@ -0,0 +1,23 @@
+#include "hle_stubs.h"
+
+#include <cstdint>
+
+extern "C" int32_t KPAD__Read_HLE(uint32_t chan, uint32_t statusPtr, uint32_t count)
+{
+    (void)chan;
+    (void)statusPtr;
+    (void)count;
+    return 0;
+}
+PPC_NATIVE_OVERRIDE(80197380, KPAD__Read_HLE, int32_t, (uint32_t chan, uint32_t statusPtr, uint32_t count),
+         (chan, statusPtr, count));
+
+extern "C" int32_t KPAD__GetUnifiedWpadStatus_HLE(uint32_t chan, uint32_t statusPtr, uint32_t count)
+{
+    (void)chan;
+    (void)statusPtr;
+    (void)count;
+    return 0;
+}
+PPC_NATIVE_OVERRIDE(8019812C, KPAD__GetUnifiedWpadStatus_HLE, int32_t,
+         (uint32_t chan, uint32_t statusPtr, uint32_t count), (chan, statusPtr, count));
diff --git a/runtime/src/hle/input/pad.cpp b/runtime/src/hle/input/pad.cpp
new file mode 100644
index 0000000..e3a0539
--- /dev/null
+++ b/runtime/src/hle/input/pad.cpp
@@ -0,0 +1,78 @@
+#include "hle_stubs.h"
+#include "memory.h"
+#include "hle/controller_status_contract.h"
+
+#include <algorithm>
+#include <cstdio>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+#include <dolphin/pad.h>
+
+namespace {
+
+void WritePadStatus(uint32_t base, const PADStatus& status) {
+    const auto guestStatus = PadStatusContract::Encode({
+        status.button,
+        status.stickX,
+        status.stickY,
+        status.substickX,
+        status.substickY,
+        status.triggerL,
+        status.triggerR,
+        status.analogA,
+        status.analogB,
+        status.err,
+    });
+    uint8_t* dst = Memory::GetPointer(base, guestStatus.size());
+    std::memcpy(dst, guestStatus.data(), guestStatus.size());
+}
+
+} // namespace
+
+extern "C" uint32_t PAD__Init_HLE()
+{
+    return PADInit() ? 1u : 0u;
+}
+PPC_NATIVE_OVERRIDE(801AF2F0, PAD__Init_HLE, uint32_t, (), ());
+
+extern "C" uint32_t PAD__Read_HLE(uint32_t statusPtr)
+{
+    if (statusPtr == 0) {
+        return 0;
+    }
+
+    PADStatus statuses[PAD_CHANMAX]{};
+    const uint32_t rumbleMask = PADRead(statuses);
+
+    try {
+        for (uint32_t i = 0; i < PAD_CHANMAX; ++i) {
+            WritePadStatus(statusPtr + static_cast<uint32_t>(i * PadStatusContract::kGuestStatusSize),
+                           statuses[i]);
+        }
+    } catch (const Memory::AccessViolation&) {
+        return 0;
+    }
+
+    return rumbleMask;
+}
+PPC_NATIVE_OVERRIDE(801AF44C, PAD__Read_HLE, uint32_t, (uint32_t statusPtr), (statusPtr));
+
+extern "C" uint32_t PAD__Reset_HLE(uint32_t mask)
+{
+    return PADReset(mask) ? 1u : 0u;
+}
+PPC_NATIVE_OVERRIDE(801AF0DC, PAD__Reset_HLE, uint32_t, (uint32_t mask), (mask));
+
+extern "C" uint32_t PAD__Recalibrate_HLE(uint32_t mask)
+{
+    return PADRecalibrate(mask) ? 1u : 0u;
+}
+PPC_NATIVE_OVERRIDE(801AF1E4, PAD__Recalibrate_HLE, uint32_t, (uint32_t mask), (mask));
+
+extern "C" void PAD__ControlMotor_HLE(int32_t chan, uint32_t command)
+{
+    PADControlMotor(chan, command);
+}
+PPC_NATIVE_OVERRIDE_VOID(801AF908, PAD__ControlMotor_HLE, (int32_t chan, uint32_t command), (chan, command));
diff --git a/runtime/src/hle/input/wpad.cpp b/runtime/src/hle/input/wpad.cpp
new file mode 100644
index 0000000..c6a59c7
--- /dev/null
+++ b/runtime/src/hle/input/wpad.cpp
@@ -0,0 +1,182 @@
+#include "hle_stubs.h"
+#include "memory.h"
+#include "hle/controller_status_contract.h"
+
+#include <cstdint>
+
+void NandQueueIosCallback(uint32_t callbackPtr, int32_t result, uint32_t callbackArg);
+
+namespace {
+
+constexpr uint32_t kDefaultWorkMemSize = 0x20000;
+constexpr uint8_t kDefaultDpdSensitivity = 3;
+constexpr int32_t kStatusOk = 0;
+
+struct WpadStubState {
+    bool initSubRan = false;
+    bool simpleSyncActive = false;
+    uint32_t syncDeviceCallback = 0;
+    uint32_t workMemSize = kDefaultWorkMemSize;
+    uint8_t dpdSensitivity = kDefaultDpdSensitivity;
+    WpadContract::State contract{};
+};
+
+WpadStubState g_state{};
+
+void InvokeWpadCallback(uint32_t callback, uint32_t chan, int32_t result)
+{
+    if (callback == 0) {
+        return;
+    }
+    if (!TranslatedFunctionRegistry::FindByAddressPtr(callback)) {
+        return;
+    }
+    auto& cpu = GetPersistentCpuContext();
+    cpu.gpr[3] = chan;
+    cpu.gpr[4] = static_cast<uint32_t>(result);
+    InvokeIndirectCpu(callback, &cpu);
+}
+
+int32_t InitializeWpadLibrary()
+{
+    g_state.contract.Initialize();
+    return kStatusOk;
+}
+
+// The async WPAD entry points all report their outcome to the guest callback and
+// then return the same value.
+int32_t CompleteWpadRequest(uint32_t chan, uint32_t callback, int32_t result)
+{
+    InvokeWpadCallback(callback, chan, result);
+    return result;
+}
+
+} // namespace
+
+extern "C" int32_t WPADGetStatus_HLE()
+{
+    // RVL::WPADGetStatus takes no channel arg; it reports global WUD library state.
+    // Reading r3 here would leak a caller's stale register value into the result.
+    return g_state.contract.GetLibraryStatus();
+}
+PPC_NATIVE_OVERRIDE(801BF64C, WPADGetStatus_HLE, int32_t, (), ());
+
+extern "C" uint32_t WPADGetDpdSensitivity_HLE()
+{
+    return static_cast<uint32_t>(g_state.dpdSensitivity);
+}
+PPC_NATIVE_OVERRIDE(801C329C, WPADGetDpdSensitivity_HLE, uint32_t, (), ());
+
+extern "C" int32_t WPADInitSub_HLE()
+{
+    if (!g_state.initSubRan) {
+        g_state.initSubRan = true;
+        return InitializeWpadLibrary();
+    }
+    return kStatusOk;
+}
+PPC_NATIVE_OVERRIDE(801BF3B4, WPADInitSub_HLE, int32_t, (), ());
+
+extern "C" int32_t WPADInit_HLE()
+{
+    return InitializeWpadLibrary();
+}
+PPC_NATIVE_OVERRIDE(801BF5C4, WPADInit_HLE, int32_t, (), ());
+
+extern "C" int32_t WUDGetStatus_HLE()
+{
+    return WpadContract::kStatusReady;
+}
+PPC_NATIVE_OVERRIDE(801CDB84, WUDGetStatus_HLE, int32_t, (), ());
+
+// WPADGetDataFormat reads the per-channel format set by WPADSetDataFormat. Can't reuse the
+// translated SDK implementation: it dereferences Bluetooth control blocks that HLE'd WPADInit
+// never constructs.
+extern "C" int32_t WPADGetDataFormat_HLE(uint32_t chan)
+{
+    return g_state.contract.GetDataFormat(chan);
+}
+PPC_NATIVE_OVERRIDE(801C0B54, WPADGetDataFormat_HLE, int32_t, (uint32_t chan), (chan));
+
+extern "C" int32_t WPADSetDataFormat_HLE(uint32_t chan, int32_t format)
+{
+    return g_state.contract.SetDataFormat(chan, format);
+}
+PPC_NATIVE_OVERRIDE(801C0B9C, WPADSetDataFormat_HLE, int32_t, (uint32_t chan, int32_t format), (chan, format));
+
+extern "C" int32_t WPADProbe_HLE(uint32_t chan, uint32_t typePtr)
+{
+    if (chan >= WpadContract::kChannelCount) {
+        return WpadContract::kErrorBadChannel;
+    }
+
+    if (typePtr != 0) {
+        Memory::Write32(typePtr, WpadContract::kExtensionCore);
+    }
+    return WpadContract::kErrorNoController;
+}
+PPC_NATIVE_OVERRIDE(801C0990, WPADProbe_HLE, int32_t, (uint32_t chan, uint32_t typePtr), (chan, typePtr));
+
+extern "C" void WPADControlMotor_HLE(uint32_t chan, uint32_t command)
+{
+    (void)chan;
+    (void)command;
+}
+PPC_NATIVE_OVERRIDE(801C0EC4, WPADControlMotor_HLE, void, (uint32_t chan, uint32_t command), (chan, command));
+
+extern "C" int32_t WPADGetInfoAsync_HLE(uint32_t chan, uint32_t infoPtr, uint32_t callback)
+{
+    if (chan >= WpadContract::kChannelCount) {
+        return CompleteWpadRequest(chan, callback, WpadContract::kErrorBadChannel);
+    }
+
+    (void)infoPtr;
+    return CompleteWpadRequest(chan, callback, WpadContract::kErrorNoController);
+}
+PPC_NATIVE_OVERRIDE(801C0CA4, WPADGetInfoAsync_HLE, int32_t,
+         (uint32_t chan, uint32_t infoPtr, uint32_t callback), (chan, infoPtr, callback));
+
+extern "C" int32_t WPADControlLed_HLE(uint32_t chan, uint32_t ledMask, uint32_t callback)
+{
+    if (chan >= WpadContract::kChannelCount) {
+        return CompleteWpadRequest(chan, callback, WpadContract::kErrorBadChannel);
+    }
+    (void)ledMask;
+    return CompleteWpadRequest(chan, callback, WpadContract::kErrorNoController);
+}
+PPC_NATIVE_OVERRIDE(801C0FF8, WPADControlLed_HLE, int32_t,
+         (uint32_t chan, uint32_t ledMask, uint32_t callback), (chan, ledMask, callback));
+
+extern "C" int32_t WPADStartSimpleSync_HLE()
+{
+    if (g_state.simpleSyncActive) {
+        return 0;
+    }
+    g_state.simpleSyncActive = true;
+    return 1;
+}
+PPC_NATIVE_OVERRIDE(801BF634, WPADStartSimpleSync_HLE, int32_t, (), ()); // WUDStartSyncSimple
+PPC_NATIVE_OVERRIDE(801BF638, WPADStartSimpleSync_HLE, int32_t, (), ()); // WPADStartSimpleSync (HBM)
+
+// due to multiplayer controller screen hle this to avoid startsyncdevice to return fail every frame
+// causing you to get softlocked in the game
+extern "C" int32_t WPADStopSimpleSync_HLE()
+{
+    if (g_state.simpleSyncActive) {
+        g_state.simpleSyncActive = false;
+        const uint32_t callback = g_state.syncDeviceCallback;
+        if (callback != 0 && TranslatedFunctionRegistry::FindByAddressPtr(callback)) {
+            NandQueueIosCallback(callback, 1, 0); // callback(WUD_SYNC_DONE, devicesSynced=0)
+        }
+    }
+    return 1;
+}
+PPC_NATIVE_OVERRIDE(801BF63C, WPADStopSimpleSync_HLE, int32_t, (), ());
+
+extern "C" uint32_t WPADSetSyncDeviceCallback_HLE(uint32_t callback)
+{
+    const uint32_t previous = g_state.syncDeviceCallback;
+    g_state.syncDeviceCallback = callback;
+    return previous;
+}
+PPC_NATIVE_OVERRIDE(801BF640, WPADSetSyncDeviceCallback_HLE, uint32_t, (uint32_t callback), (callback));
diff --git a/runtime/src/hle/ios.cpp b/runtime/src/hle/ios.cpp
new file mode 100644
index 0000000..bdeab3b
--- /dev/null
+++ b/runtime/src/hle/ios.cpp
@@ -0,0 +1,195 @@
+// IOS Async Stubs
+// Synchronous IOS functions are now in hle/storage/ which provides proper
+// NAND filesystem redirection to Dolphin's Wii directory.
+
+#include "hle_stubs.h"
+#include "memory.h"
+#include "hle/net/network.h"
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <iostream>
+
+void NandQueueIosCallback(uint32_t callbackPtr, int32_t result, uint32_t callbackArg);
+bool NandProcessPendingCallbacks(CpuContext* cpu, int maxToProcess);
+extern "C" int32_t NAND_IOS_Open_HLE(uint32_t pathPtr, uint32_t mode);
+extern "C" int32_t NAND_IOS_Close_HLE(uint32_t fd);
+extern "C" int32_t NAND_IOS_Read_HLE(uint32_t fd, uint32_t bufferPtr, uint32_t length);
+extern "C" int32_t NAND_IOS_Write_HLE(uint32_t fd, uint32_t bufferPtr, uint32_t length);
+extern "C" int32_t NAND_IOS_Seek_HLE(uint32_t fd, int32_t offset, int32_t whence);
+extern "C" int32_t NAND_IOS_Ioctl_HLE(uint32_t fd, uint32_t cmd, uint32_t inBufPtr, uint32_t inLen,
+                                      uint32_t outBufPtr, uint32_t outLen);
+extern "C" int32_t NAND_IOS_Ioctlv_HLE(uint32_t fd, uint32_t cmd, uint32_t numIn, uint32_t numOut,
+                                       uint32_t vectorPtr);
+
+namespace {
+
+void SetIosReturn(CpuContext* ctx, int32_t result)
+{
+    if (ctx) {
+        ctx->gpr[3] = static_cast<uint32_t>(result);
+    }
+}
+
+// Every async entry point completes the same way: hand the result to the guest
+// callback, then report "queued successfully" (0) to the caller.
+void CompleteAsync(CpuContext* ctx, uint32_t callback, int32_t result, uint32_t callbackArg)
+{
+    NandQueueIosCallback(callback, result, callbackArg);
+    SetIosReturn(ctx, 0);
+}
+
+// Shared network-fd body of IOS_IoctlAsync / IOS_IoctlvAsync. Returns false when
+// the fd is not ours, leaving the caller to take the NAND path. `start` performs
+// the matching Network_HLE_Start*Async call and `blockingFallback` the matching
+// synchronous ioctl; neither call signature is changed here.
+template <typename Start, typename BlockingFallback>
+bool TryDeferredNetworkAsync(CpuContext* ctx, uint32_t fd, uint32_t callback,
+                             uint32_t callbackArg, Start&& start,
+                             BlockingFallback&& blockingFallback)
+{
+    if (!Network_HLE_IsFd(fd)) {
+        return false;
+    }
+
+    const NetworkDeferredContract::StartOutcome deferred = start();
+    if (deferred.disposition == NetworkDeferredContract::StartDisposition::Started) {
+        SetIosReturn(ctx, 0);
+        return true;
+    }
+    if (deferred.disposition == NetworkDeferredContract::StartDisposition::ImmediateResult) {
+        CompleteAsync(ctx, callback, deferred.result, callbackArg);
+        return true;
+    }
+
+    const int32_t result = blockingFallback();
+    CompleteAsync(ctx, callback, result, callbackArg);
+    return true;
+}
+
+// IOS_ReadAsync and IOS_WriteAsync differ only in the NAND entry point they call.
+void IosBufferAsync(CpuContext* ctx, int32_t (*op)(uint32_t fd, uint32_t bufferPtr, uint32_t length))
+{
+    const uint32_t fd = ctx->gpr[3];
+    const uint32_t bufferPtr = ctx->gpr[4];
+    const uint32_t length = ctx->gpr[5];
+    const uint32_t callback = ctx->gpr[6];
+    const uint32_t callbackArg = ctx->gpr[7];
+    const int32_t result = op(fd, bufferPtr, length);
+    CompleteAsync(ctx, callback, result, callbackArg);
+}
+
+} // namespace
+
+// ============================================================================
+// Async IOS functions - these still need separate handling
+// ============================================================================
+
+// 0x80194158 -> IOS_IoctlAsync
+extern "C" void IOS_IoctlAsync_80194158(CpuContext* ctx)
+{
+    const uint32_t fd = ctx->gpr[3];
+    const uint32_t cmd = ctx->gpr[4];
+    const uint32_t inBuf = ctx->gpr[5];
+    const uint32_t inLen = ctx->gpr[6];
+    const uint32_t outBuf = ctx->gpr[7];
+    const uint32_t outLen = ctx->gpr[8];
+    const uint32_t callback = ctx->gpr[9];
+    const uint32_t callbackArg = ctx->gpr[10];
+    if (TryDeferredNetworkAsync(
+            ctx, fd, callback, callbackArg,
+            [&] {
+                return Network_HLE_StartIoctlAsync(fd, cmd, inBuf, inLen, outBuf, outLen,
+                                                   callback, callbackArg);
+            },
+            [&] { return Network_HLE_Ioctl(fd, cmd, inBuf, inLen, outBuf, outLen); })) {
+        return;
+    }
+
+    const int32_t result = NAND_IOS_Ioctl_HLE(fd, cmd, inBuf, inLen, outBuf, outLen);
+    CompleteAsync(ctx, callback, result, callbackArg); // Success
+}
+PPC_NATIVE_OVERRIDE_VOID(80194158, IOS_IoctlAsync_80194158, (CpuContext* ctx), (ctx));
+
+// 0x801937E0 -> IOS_OpenAsync
+extern "C" void IOS_OpenAsync_HLE(CpuContext* ctx) {
+    const uint32_t pathPtr = ctx->gpr[3];
+    const uint32_t mode = ctx->gpr[4];
+    const uint32_t callback = ctx->gpr[5];
+    const uint32_t callbackArg = ctx->gpr[6];
+    const char* path = pathPtr ? (const char*)Memory::GetPointer(pathPtr) : "(null)";
+    if (pathPtr) {
+        if (const int32_t netFd = Network_HLE_OpenDevice(path, mode)) {
+            CompleteAsync(ctx, callback, netFd, callbackArg);
+            return;
+        }
+    }
+    const int32_t result = NAND_IOS_Open_HLE(pathPtr, mode);
+    CompleteAsync(ctx, callback, result, callbackArg); // Queued successfully
+}
+PPC_NATIVE_OVERRIDE_VOID(801937E0, IOS_OpenAsync_HLE, (CpuContext* ctx), (ctx));
+
+// 0x80193A18 -> IOS_CloseAsync
+extern "C" void IOS_CloseAsync_HLE(CpuContext* ctx) {
+    const uint32_t fd = ctx->gpr[3];
+    const uint32_t callback = ctx->gpr[4];
+    const uint32_t callbackArg = ctx->gpr[5];
+    if (Network_HLE_IsFd(fd)) {
+        const int32_t result = Network_HLE_Close(fd);
+        CompleteAsync(ctx, callback, result, callbackArg);
+        return;
+    }
+    const int32_t result = NAND_IOS_Close_HLE(fd);
+    CompleteAsync(ctx, callback, result, callbackArg);
+}
+PPC_NATIVE_OVERRIDE_VOID(80193A18, IOS_CloseAsync_HLE, (CpuContext* ctx), (ctx));
+
+// 0x80193B80 -> IOS_ReadAsync
+extern "C" void IOS_ReadAsync_HLE(CpuContext* ctx) {
+    IosBufferAsync(ctx, NAND_IOS_Read_HLE);
+}
+PPC_NATIVE_OVERRIDE_VOID(80193B80, IOS_ReadAsync_HLE, (CpuContext* ctx), (ctx));
+
+// 0x80193D88 -> IOS_WriteAsync
+extern "C" void IOS_WriteAsync_HLE(CpuContext* ctx) {
+    IosBufferAsync(ctx, NAND_IOS_Write_HLE);
+}
+PPC_NATIVE_OVERRIDE_VOID(80193D88, IOS_WriteAsync_HLE, (CpuContext* ctx), (ctx));
+
+// 0x80193F90 -> IOS_SeekAsync
+extern "C" void IOS_SeekAsync_HLE(CpuContext* ctx) {
+    const uint32_t fd = ctx->gpr[3];
+    const int32_t offset = static_cast<int32_t>(ctx->gpr[4]);
+    const int32_t whence = static_cast<int32_t>(ctx->gpr[5]);
+    const uint32_t callback = ctx->gpr[6];
+    const uint32_t callbackArg = ctx->gpr[7];
+    const int32_t result = NAND_IOS_Seek_HLE(fd, offset, whence);
+    CompleteAsync(ctx, callback, result, callbackArg);
+}
+PPC_NATIVE_OVERRIDE_VOID(80193F90, IOS_SeekAsync_HLE, (CpuContext* ctx), (ctx));
+
+// 0x801944FC -> IOS_IoctlvAsync
+extern "C" void IOS_IoctlvAsync_HLE(CpuContext* ctx)
+{
+    const uint32_t fd = ctx->gpr[3];
+    const uint32_t cmd = ctx->gpr[4];
+    const uint32_t numIn = ctx->gpr[5];
+    const uint32_t numOut = ctx->gpr[6];
+    const uint32_t vectorPtr = ctx->gpr[7];
+    const uint32_t callback = ctx->gpr[8];
+    const uint32_t callbackArg = ctx->gpr[9];
+    if (TryDeferredNetworkAsync(
+            ctx, fd, callback, callbackArg,
+            [&] {
+                return Network_HLE_StartIoctlvAsync(fd, cmd, numIn, numOut, vectorPtr,
+                                                    callback, callbackArg);
+            },
+            [&] { return Network_HLE_Ioctlv(fd, cmd, numIn, numOut, vectorPtr); })) {
+        return;
+    }
+
+    const int32_t result = NAND_IOS_Ioctlv_HLE(fd, cmd, numIn, numOut, vectorPtr);
+    CompleteAsync(ctx, callback, result, callbackArg);
+}
+PPC_NATIVE_OVERRIDE_VOID(801944FC, IOS_IoctlvAsync_HLE, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/net/network.h b/runtime/src/hle/net/network.h
new file mode 100644
index 0000000..aa21c08
--- /dev/null
+++ b/runtime/src/hle/net/network.h
@@ -0,0 +1,33 @@
+#pragma once
+
+#include "hle/network_deferred_contract.h"
+
+#include <cstdint>
+
+struct CpuContext;
+
+extern "C" int32_t Network_HLE_OpenDevice(const char* path, uint32_t mode);
+extern "C" bool Network_HLE_IsFd(uint32_t fd);
+extern "C" int32_t Network_HLE_Close(uint32_t fd);
+extern "C" int32_t Network_HLE_Ioctl(uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen,
+                                      uint32_t outBuf, uint32_t outLen);
+extern "C" int32_t Network_HLE_Ioctlv(uint32_t fd, uint32_t cmd, uint32_t numIn, uint32_t numOut,
+                                       uint32_t vectorPtr);
+
+// DNS can block for seconds, so these copy guest input and resolve on a worker.
+// Network_HLE_ProcessCompletions must be pumped from the guest scheduler thread,
+// since that is where guest output is committed and the waiter is woken.
+NetworkDeferredContract::StartOutcome Network_HLE_StartIoctlSync(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen,
+    uint32_t outBuf, uint32_t outLen, uint32_t waitQueue);
+NetworkDeferredContract::StartOutcome Network_HLE_StartIoctlvSync(
+    uint32_t fd, uint32_t cmd, uint32_t numIn, uint32_t numOut,
+    uint32_t vectorPtr, uint32_t waitQueue);
+NetworkDeferredContract::StartOutcome Network_HLE_StartIoctlAsync(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen,
+    uint32_t outBuf, uint32_t outLen, uint32_t callback, uint32_t callbackArg);
+NetworkDeferredContract::StartOutcome Network_HLE_StartIoctlvAsync(
+    uint32_t fd, uint32_t cmd, uint32_t numIn, uint32_t numOut,
+    uint32_t vectorPtr, uint32_t callback, uint32_t callbackArg);
+bool Network_HLE_TakeSyncResult(uint64_t token, int32_t* result);
+bool Network_HLE_ProcessCompletions(CpuContext* cpu);
diff --git a/runtime/src/hle/net/network_config.cpp b/runtime/src/hle/net/network_config.cpp
new file mode 100644
index 0000000..78802c0
--- /dev/null
+++ b/runtime/src/hle/net/network_config.cpp
@@ -0,0 +1,302 @@
+#include "network_internal.h"
+
+#include "abi_bridge.h"
+#include "ppc_runtime.h"
+
+namespace NetworkHle {
+
+extern "C" void func_801D8D30(CpuContext* ctx);
+extern "C" void func_801D9E94(CpuContext* ctx);
+
+static uint32_t GetNHttpSystemInfo(CpuContext* ctx, uint32_t& savedR3, uint32_t& savedR4, uint32_t& savedR5) {
+    savedR3 = ctx->gpr[3];
+    savedR4 = ctx->gpr[4];
+    savedR5 = ctx->gpr[5];
+    func_801D9E94(ctx);
+    const uint32_t systemInfo = ctx->gpr[3];
+    ctx->gpr[3] = savedR3;
+    ctx->gpr[4] = savedR4;
+    ctx->gpr[5] = savedR5;
+    return systemInfo;
+}
+
+extern "C" void NHTTPStartup_Reentrant_HLE_801d8d30(CpuContext* ctx) {
+    if (!ctx) {
+        return;
+    }
+
+    uint32_t savedR3 = 0;
+    uint32_t savedR4 = 0;
+    uint32_t savedR5 = 0;
+    const uint32_t systemInfo = GetNHttpSystemInfo(ctx, savedR3, savedR4, savedR5);
+    if (Memory::Contains(systemInfo + 1996u, 4) && Memory::Read32(systemInfo + 1996u) != 0) {
+        // ponytail: NHTTP stays active across DWC auth/GHTTP handoffs, but the
+        // allocator callbacks are caller-owned and can outlive the auth object.
+        if (Memory::Contains(systemInfo + 1988u, 8)) {
+            const uint32_t oldAlloc = Memory::Read32(systemInfo + 1988u);
+            const uint32_t oldFree = Memory::Read32(systemInfo + 1992u);
+            if (oldAlloc != savedR3 || oldFree != savedR4) {
+                Memory::Write32(systemInfo + 1988u, savedR3);
+                Memory::Write32(systemInfo + 1992u, savedR4);
+            }
+        }
+        ctx->gpr[3] = 0;
+        return;
+    }
+
+    ctx->gpr[3] = savedR3;
+    ctx->gpr[4] = savedR4;
+    ctx->gpr[5] = savedR5;
+    func_801D8D30(ctx);
+
+    const int32_t result = static_cast<int32_t>(ctx->gpr[3]);
+    if (result < 0) {
+        uint32_t retryR3 = 0;
+        uint32_t retryR4 = 0;
+        uint32_t retryR5 = 0;
+        const uint32_t retrySystemInfo = GetNHttpSystemInfo(ctx, retryR3, retryR4, retryR5);
+        const bool becameActive =
+            Memory::Contains(retrySystemInfo + 1996u, 4) && Memory::Read32(retrySystemInfo + 1996u) != 0;
+        if (becameActive) {
+            ctx->gpr[3] = 0;
+        }
+    }
+}
+
+REGISTER_NATIVE_FUNCTION_AS(0x801D8D30, NHTTPStartup_Reentrant_HLE_801d8d30, "NHTTPStartup_Reentrant_HLE_801d8d30");
+
+static void WriteNcdConfig(uint32_t addr, uint32_t len) {
+    if (!addr || len == 0) {
+        return;
+    }
+    ZeroMemoryRange(addr, len);
+    if (len >= 0x04) {
+        Memory::Write32(addr, 1);
+    }
+    if (len >= 0x08) {
+        Memory::Write8(addr + 4, 2);  // wired
+        Memory::Write8(addr + 5, 30);
+        Memory::Write8(addr + 6, 7);  // NWC24 permission: all
+    }
+    if (len >= 0x18) {
+        const uint32_t connection = addr + 8;
+        Memory::Write8(connection, 0xA7);  // selected, tested, DHCP IP/DNS, wired
+        Memory::Write8(connection + 1, 3); // wired link
+        const char* name = "MKW Recompiled";
+        for (uint32_t i = 0; i < 14 && i + 2 < len - 8 && name[i]; ++i) {
+            Memory::Write8(connection + 2 + i, static_cast<uint8_t>(name[i]));
+        }
+    }
+}
+
+enum class KdTrySuspendPhase {
+    Boot,
+    PostResumeProbe,
+    Ready,
+};
+
+static KdTrySuspendPhase g_kdTrySuspendPhase = KdTrySuspendPhase::Boot;
+static bool g_kdBootProbeSeen = false;
+
+// /dev/net/kd/time state, mirroring Dolphin's NetKDTimeDevice. Any negative
+// result here turns into NWC24's generic -42 ("Failed to synchronize time"),
+// and DWC's auth stack also reads universal time through this device.
+static int64_t g_kdTimeUtcDiff = 0;
+static uint64_t g_kdTimeRtc = 0;
+
+static uint64_t KdAdjustedUtcSeconds() {
+    const int64_t now = static_cast<int64_t>(std::time(nullptr));
+    return static_cast<uint64_t>(now + g_kdTimeUtcDiff);
+}
+
+int32_t HandleKdTimeIoctl(uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf,
+                                 uint32_t outLen) {
+    // Dolphin: NetKDTimeDevice::IOCtl. Every reply writes the WC24 result word
+    // at out+0; the u64 payloads live at out+4.
+    enum : uint32_t {
+        IOCTL_NW24_GET_UNIVERSAL_TIME = 0x14,
+        IOCTL_NW24_SET_UNIVERSAL_TIME = 0x15,
+        IOCTL_NW24_UNIMPLEMENTED = 0x16,
+        IOCTL_NW24_SET_RTC_COUNTER = 0x17,
+        IOCTL_NW24_GET_TIME_DIFF = 0x18,
+    };
+
+    int32_t ipcResult = 0;
+    switch (cmd) {
+    case IOCTL_NW24_GET_UNIVERSAL_TIME:
+        if (outBuf && outLen >= 0x0C) {
+            Memory::Write64(outBuf + 4u, KdAdjustedUtcSeconds());
+        }
+        break;
+    case IOCTL_NW24_SET_UNIVERSAL_TIME:
+        if (inBuf && inLen >= 8) {
+            const uint64_t requestedUtc = Memory::Read64(inBuf);
+            const int64_t now = static_cast<int64_t>(std::time(nullptr));
+            g_kdTimeUtcDiff = static_cast<int64_t>(requestedUtc) - now;
+        }
+        break;
+    case IOCTL_NW24_SET_RTC_COUNTER:
+        if (inBuf && inLen >= 4) {
+            g_kdTimeRtc = Memory::Read32(inBuf);
+        }
+        break;
+    case IOCTL_NW24_GET_TIME_DIFF:
+        if (outBuf && outLen >= 0x0C) {
+            Memory::Write64(outBuf + 4u, KdAdjustedUtcSeconds() - g_kdTimeRtc);
+        }
+        break;
+    case IOCTL_NW24_UNIMPLEMENTED:
+        ipcResult = -9;
+        break;
+    default:
+        break;
+    }
+
+    WriteReturn(outBuf, outLen, 0);
+    return ipcResult;
+}
+
+int32_t HandleKdIoctl(uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf,
+                             uint32_t outLen) {
+    switch (cmd) {
+    case 0x01: // NWC24 suspend scheduler
+        WriteReturn(outBuf, outLen, 0);
+        return 0;
+    case 0x03: // resume scheduler
+        // MKW performs a suspend/user-ID/resume initialization cycle after its
+        // first boot-time try-suspend probe. The next probe still observes the
+        // scheduler transition as pending; later requests are operational.
+        if (g_kdBootProbeSeen && g_kdTrySuspendPhase == KdTrySuspendPhase::Boot) {
+            g_kdTrySuspendPhase = KdTrySuspendPhase::PostResumeProbe;
+        }
+        WriteReturn(outBuf, outLen, 0);
+        return 0;
+    case 0x04: // time triggers
+        // Dolphin writes the scheduler spans (minutes) after the result word;
+        // leaving them unwritten hands the guest stale reply-buffer bytes.
+        WriteReturn(outBuf, outLen, 0);
+        if (outBuf && outLen >= 0x0C) {
+            Memory::Write32(outBuf + 4u, 1); // mail span
+            Memory::Write32(outBuf + 8u, 2); // download span
+        }
+        return 0;
+    case 0x05: // schedule span
+    case 0x08: // lock socket
+    case 0x09: // unlock socket
+    case 0x1E: // scheduler stat
+        WriteReturn(outBuf, outLen, 0);
+        return 0;
+    case 0x02: // try suspend scheduler
+        // Our synchronous IOS bridge reuses the reply buffer, so acknowledging
+        // this like Dolphin does (unchanged output) leaks cmd 3's zero result
+        // into MKW's post-resume probe and makes the SDK panic. Preserve the
+        // two pending startup probes, then report success once ready.
+        if (g_kdTrySuspendPhase == KdTrySuspendPhase::Boot) {
+            g_kdBootProbeSeen = true;
+            WriteReturn(outBuf, outLen, -42);
+        } else if (g_kdTrySuspendPhase == KdTrySuspendPhase::PostResumeProbe) {
+            WriteReturn(outBuf, outLen, -42);
+            g_kdTrySuspendPhase = KdTrySuspendPhase::Ready;
+        } else {
+            WriteReturn(outBuf, outLen, 0);
+        }
+        return 0;
+    case 0x06: // startup socket
+        if (outBuf && outLen) {
+            ZeroMemoryRange(outBuf, outLen);
+        }
+        WriteReturn(outBuf, outLen, 0);
+        if (outBuf && outLen >= 8) {
+            Memory::Write32(outBuf + 4, 0);
+        }
+        EnsureSocketRuntime();
+        return 0;
+    case 0x07: // cleanup socket
+        // Dolphin's IOCTL_NWC24_CLEANUP_SOCKET calls WiiSockMan::Clean().
+        CleanupAllWiiSockets();
+        WriteReturn(outBuf, outLen, 0);
+        return 0;
+    case 0x0F: // request generated user id
+        // Mirrors Dolphin's reply shape: result word, u64 user id at +4,
+        // NWC24CreationStage at +0xC (Initial=0/Generated=1/Registered=2). The
+        // id is a stable constant so regenerating it can't rebind the DWC
+        // account to a different console identity.
+        if (outBuf && outLen >= 0x10) {
+            ZeroMemoryRange(outBuf, outLen);
+            WriteReturn(outBuf, outLen, 0);
+            Memory::Write64(outBuf + 4, RuntimeGeneratedUserId());
+            Memory::Write32(outBuf + 0x0C, 1); // NWC24CreationStage::Generated
+        } else {
+            WriteReturn(outBuf, outLen, 0);
+        }
+        return 0;
+    default:
+        WriteReturn(outBuf, outLen, 0);
+        return 0;
+    }
+}
+
+int32_t HandleKdIoctlv(uint32_t cmd, const std::vector<IoVector>& in, const std::vector<IoVector>& out) {
+    const uint32_t inBuf = in.empty() ? 0 : in[0].address;
+    const uint32_t inLen = in.empty() ? 0 : in[0].size;
+    const uint32_t outBuf = out.empty() ? 0 : out[0].address;
+    const uint32_t outLen = out.empty() ? 0 : out[0].size;
+    return HandleKdIoctl(cmd, inBuf, inLen, outBuf, outLen);
+}
+
+int32_t HandleNcdIoctlv(uint32_t cmd, const std::vector<IoVector>& in,
+                               const std::vector<IoVector>& out) {
+    (void)in;
+    switch (cmd) {
+    case 1: // LOCKWIRELESSDRIVER
+        WriteVectorReturn(out, 0, 0);
+        if (!out.empty() && out[0].address && out[0].size >= 8) {
+            Memory::Write32(out[0].address + 4, 1);
+        }
+        return 0;
+    case 2: // UNLOCKWIRELESSDRIVER
+        WriteVectorReturn(out, 0, 0);
+        return 0;
+    case 3: // GETCONFIG
+        if (!out.empty()) {
+            WriteNcdConfig(out[0].address, out[0].size);
+        }
+        WriteVectorReturn(out, out.size() > 1 ? 1 : 0, 0);
+        if (out.size() > 1 && out[1].size >= 8) {
+            Memory::Write32(out[1].address + 4, 0);
+        }
+        return 0;
+    case 7: // GETLINKSTATUS
+        if (!out.empty() && out[0].address && out[0].size >= 8) {
+            Memory::Write32(out[0].address, 0);
+            Memory::Write32(out[0].address + 4, 3); // LINK_WIRED
+        }
+        return 0;
+    case 8: { // GETWIRELESSMACADDRESS
+        const std::array<uint8_t, 6>& mac = RuntimeMacAddress();
+        if (out.size() > 1 && out[1].address && out[1].size >= mac.size()) {
+            CopyToGuest(out[1].address, mac.data(), static_cast<uint32_t>(mac.size()));
+        }
+        WriteVectorReturn(out, 0, 0);
+        return 0;
+    }
+    case 4: // SETCONFIG
+    case 6: // WRITECONFIG
+        WriteVectorReturn(out, out.size() > 1 ? 1 : 0, 0);
+        return 0;
+    case 5: // READCONFIG
+        if (!out.empty()) {
+            WriteNcdConfig(out[0].address, out[0].size);
+        }
+        WriteVectorReturn(out, out.size() > 1 ? 1 : 0, 0);
+        if (out.size() > 1 && out[1].size >= 8) {
+            Memory::Write32(out[1].address + 4, 0);
+        }
+        return 0;
+    default:
+        WriteVectorReturn(out, out.size() > 1 ? 1 : 0, 0);
+        return 0;
+    }
+}
+
+}  // namespace NetworkHle
diff --git a/runtime/src/hle/net/network_core.cpp b/runtime/src/hle/net/network_core.cpp
new file mode 100644
index 0000000..dacbbe3
--- /dev/null
+++ b/runtime/src/hle/net/network_core.cpp
@@ -0,0 +1,751 @@
+#include "network_internal.h"
+
+#include "console_identity.h"
+#include "hle/net/network.h"
+#include "runtime_config.h"
+#include "runtime_log.h"
+#include "runtime_product.h"
+
+namespace NetworkHle {
+
+bool RetroRewindProfileActive();
+
+static std::mutex g_mutex;
+static std::map<int32_t, DeviceKind> g_devices;
+static int32_t g_nextDeviceFd = 2000;
+
+const std::array<uint8_t, 6>& RuntimeMacAddress() {
+    return RuntimeConsoleIdentity::Current().mac;
+}
+
+uint64_t RuntimeGeneratedUserId() {
+    return 0x000000014D4B5752ull;
+}
+
+void ZeroMemoryRange(uint32_t addr, uint32_t size) {
+    if (!addr || !size) {
+        return;
+    }
+    for (uint32_t i = 0; i < size; ++i) {
+        Memory::Write8(addr + i, 0);
+    }
+}
+
+void CopyToGuest(uint32_t addr, const void* data, uint32_t size) {
+    if (!addr || !data || !size) {
+        return;
+    }
+    uint8_t* out = Memory::GetPointer(addr, size);
+    if (out) {
+        std::memcpy(out, data, size);
+    }
+}
+
+std::string ReadGuestString(uint32_t addr, uint32_t maxLen) {
+    std::string result;
+    if (!addr) {
+        return result;
+    }
+    for (uint32_t i = 0; i < maxLen; ++i) {
+        const char ch = static_cast<char>(Memory::Read8(addr + i));
+        if (ch == '\0') {
+            break;
+        }
+        result.push_back(ch);
+    }
+    return result;
+}
+
+std::string Lower(std::string_view text) {
+    return RuntimeHle::Lower(text);
+}
+
+bool RetroRewindProfileActive() {
+    return RuntimeProduct::IsRetroRewind();
+}
+
+bool StartsWith(std::string_view text, std::string_view prefix) {
+    return text.size() >= prefix.size() && text.compare(0, prefix.size(), prefix) == 0;
+}
+
+// No host rewriting here: the Retro-WFC payload already redirects Nintendo
+// hostnames at its own resolver hooks before the name reaches this HLE.
+
+std::vector<IoVector> ReadVectors(uint32_t vectorPtr, uint32_t count) {
+    std::vector<IoVector> vectors;
+    vectors.reserve(count);
+    for (uint32_t i = 0; i < count; ++i) {
+        vectors.push_back(RuntimeHle::ReadIoVector(vectorPtr, i));
+    }
+    return vectors;
+}
+
+bool WriteReturn(uint32_t outBuf, uint32_t outLen, int32_t value) {
+    if (!outBuf || outLen < 4) {
+        return false;
+    }
+    Memory::Write32(outBuf, static_cast<uint32_t>(value));
+    return true;
+}
+
+bool WriteVectorReturn(const std::vector<IoVector>& out, size_t index, int32_t value) {
+    if (index >= out.size() || out[index].size < 4 || !out[index].address) {
+        return false;
+    }
+    Memory::Write32(out[index].address, static_cast<uint32_t>(value));
+    return true;
+}
+
+static int32_t AllocateDevice(DeviceKind kind) {
+    std::lock_guard<std::mutex> lock(g_mutex);
+    const int32_t fd = g_nextDeviceFd++;
+    g_devices.emplace(fd, kind);
+    return fd;
+}
+
+std::optional<DeviceKind> GetDeviceKind(uint32_t fd) {
+    std::lock_guard<std::mutex> lock(g_mutex);
+    auto it = g_devices.find(static_cast<int32_t>(fd));
+    if (it == g_devices.end()) {
+        return std::nullopt;
+    }
+    return it->second;
+}
+
+static bool RemoveDevice(uint32_t fd) {
+    std::lock_guard<std::mutex> lock(g_mutex);
+    return g_devices.erase(static_cast<int32_t>(fd)) != 0;
+}
+
+void NetFail(const char* format, ...) {
+    char line[512];
+    std::va_list args;
+    va_start(args, format);
+    const int written = std::vsnprintf(line, sizeof(line), format, args);
+    va_end(args);
+    if (written < 0) {
+        return;
+    }
+    RT_LOGF(RT_TAG_NET, "%s\n", line);
+    std::fflush(stderr);
+}
+
+std::array<WiiSocket, kWiiSocketMax> g_sockets;
+int32_t g_lastSocketError = 0;
+static uint64_t g_nextSocketGeneration = 1;
+
+static uint64_t NextSocketGeneration() {
+    const uint64_t generation = g_nextSocketGeneration++;
+    if (g_nextSocketGeneration == 0) {
+        g_nextSocketGeneration = 1;
+    }
+    return generation;
+}
+
+bool EnsureSocketRuntime() {
+#ifdef _WIN32
+    static bool initialized = [] {
+        WSADATA data{};
+        const int result = WSAStartup(MAKEWORD(2, 2), &data);
+        if (result != 0) {
+            RT_LOGF(RT_TAG_NET, "WSAStartup failed: %d\n", result);
+            return false;
+        }
+        return true;
+    }();
+    return initialized;
+#else
+    return true;
+#endif
+}
+
+int NativeLastError() {
+#ifdef _WIN32
+    return WSAGetLastError();
+#else
+    return errno;
+#endif
+}
+
+// Dolphin: WiiSockMan::TranslateErrorCode (IOS/Network/Socket.cpp:42-86).
+// isReadWrite mirrors Dolphin's is_rw: a nonblocking connect/bind must still
+// report SO_EINPROGRESS on would-block while send/recv/accept report SO_EAGAIN.
+// Unmapped codes collapse to -1 rather than -SO_EINVAL, which would make
+// unrelated failures look like malformed requests to the SDK.
+int32_t TranslateSocketError(int err, bool isReadWrite) {
+#ifdef _WIN32
+    switch (err) {
+    case WSAEMSGSIZE:
+        return -1;
+    case WSAENOTSOCK:
+        return -SO_EBADF;
+    case WSAEADDRINUSE:
+        return -SO_EADDRINUSE;
+    case WSAECONNRESET:
+        return -SO_ECONNRESET;
+    case WSAEISCONN:
+        return -SO_EISCONN;
+    case WSAENOTCONN:
+        return -SO_ENOTCONN;
+    case WSAEINPROGRESS:
+        return -SO_EINPROGRESS;
+    case WSAEALREADY:
+        return -SO_EALREADY;
+    case WSAEACCES:
+        return -SO_EACCES;
+    case WSAECONNREFUSED:
+        return -SO_ECONNREFUSED;
+    case WSAENETUNREACH:
+        return -SO_ENETUNREACH;
+    case WSAEHOSTUNREACH:
+        return -SO_EHOSTUNREACH;
+    case WSAENOBUFS:
+        return -SO_ENOMEM;
+    case WSAENETRESET:
+        return -SO_ENETRESET;
+    case WSAEWOULDBLOCK:
+        return isReadWrite ? -SO_EAGAIN : -SO_EINPROGRESS;
+    default:
+        return -1;
+    }
+#else
+    switch (err) {
+    case EMSGSIZE:
+        return -1;
+    case EBADF:
+        return -SO_EBADF;
+    case EADDRINUSE:
+        return -SO_EADDRINUSE;
+    case ECONNRESET:
+        return -SO_ECONNRESET;
+    case EISCONN:
+        return -SO_EISCONN;
+    case ENOTCONN:
+        return -SO_ENOTCONN;
+    case EINPROGRESS:
+        return -SO_EINPROGRESS;
+    case EALREADY:
+        return -SO_EALREADY;
+    case EACCES:
+        return -SO_EACCES;
+    case ECONNREFUSED:
+        return -SO_ECONNREFUSED;
+    case ENETUNREACH:
+        return -SO_ENETUNREACH;
+    case EHOSTUNREACH:
+        return -SO_EHOSTUNREACH;
+    case ENOMEM:
+    case ENOBUFS:
+        return -SO_ENOMEM;
+    case ENETRESET:
+        return -SO_ENETRESET;
+#if defined(EWOULDBLOCK) && EWOULDBLOCK != EAGAIN
+    case EWOULDBLOCK:
+#endif
+    case EAGAIN:
+        return isReadWrite ? -SO_EAGAIN : -SO_EINPROGRESS;
+    default:
+        return -1;
+    }
+#endif
+}
+
+#ifdef _WIN32
+// Dolphin: WiiSockMan::GetNetErrorCode (IOS/Network/Socket.cpp:100-109). Winsock
+// reports WSAEINVAL rather than WSAEALREADY when a connect is already pending on
+// the socket (a Winsock 1.1 compatibility behaviour, also seen when a layered
+// provider hijacks ws2_32). Only the connect paths may apply this.
+int NormalizeConnectError(int err) {
+    return err == WSAEINVAL ? WSAEALREADY : err;
+}
+#else
+int NormalizeConnectError(int err) {
+    return err;
+}
+#endif
+
+int32_t SocketResult(int ret, bool isReadWrite) {
+    if (ret >= 0) {
+        g_lastSocketError = 0;
+        return ret;
+    }
+    g_lastSocketError = TranslateSocketError(NativeLastError(), isReadWrite);
+    return g_lastSocketError;
+}
+
+int32_t SocketErrorResult(int nativeErr, bool isReadWrite) {
+    g_lastSocketError = TranslateSocketError(nativeErr, isReadWrite);
+    return g_lastSocketError;
+}
+
+bool IsWouldBlockError(int err) {
+#ifdef _WIN32
+    return err == WSAEWOULDBLOCK || err == WSAEINPROGRESS || err == WSAEALREADY;
+#else
+    return err == EWOULDBLOCK || err == EAGAIN || err == EINPROGRESS || err == EALREADY;
+#endif
+}
+
+// Mirrors Dolphin's WiiSocket::GetConnectingState (IOS/Network/Socket.cpp:751-826):
+// select() on write+except, never WSAPoll, since WSAPoll does not report a failed
+// connect and a refused/unreachable peer would stay "pending" forever. Returns >0
+// once settled, 0 while in flight, <0 if the probe itself failed.
+int ProbeConnectSettled(NativeSocket socket, int timeoutMs) {
+#ifdef _WIN32
+    fd_set writeFds;
+    fd_set exceptFds;
+    FD_ZERO(&writeFds);
+    FD_ZERO(&exceptFds);
+    FD_SET(socket, &writeFds);
+    FD_SET(socket, &exceptFds);
+    timeval limit{};
+    limit.tv_sec = timeoutMs / 1000;
+    limit.tv_usec = (timeoutMs % 1000) * 1000;
+    const int ret = select(0, nullptr, &writeFds, &exceptFds, timeoutMs < 0 ? nullptr : &limit);
+    if (ret <= 0) {
+        return ret;
+    }
+    return (FD_ISSET(socket, &writeFds) || FD_ISSET(socket, &exceptFds)) ? 1 : 0;
+#else
+    pollfd descriptor{};
+    descriptor.fd = socket;
+    descriptor.events = POLLOUT;
+    const int ret = poll(&descriptor, 1, timeoutMs);
+    if (ret <= 0) {
+        return ret;
+    }
+    return (descriptor.revents & (POLLOUT | POLLERR | POLLHUP | POLLNVAL)) ? 1 : 0;
+#endif
+}
+
+// Dolphin confirms a settled connect with getsockopt(SO_ERROR) followed by
+// getpeername(); the second call is what rejects a socket that reported
+// writability without ever reaching ESTABLISHED.
+int32_t ClassifySettledConnect(NativeSocket socket) {
+    int socketError = 0;
+    socklen_t socketErrorLen = sizeof(socketError);
+    if (getsockopt(socket, SOL_SOCKET, SO_ERROR, reinterpret_cast<char*>(&socketError),
+                   &socketErrorLen) != 0) {
+        return TranslateSocketError(NativeLastError(), false);
+    }
+    if (socketError != 0) {
+        return TranslateSocketError(socketError, false);
+    }
+
+    sockaddr_in peer{};
+    socklen_t peerLen = sizeof(peer);
+    if (getpeername(socket, reinterpret_cast<sockaddr*>(&peer), &peerLen) != 0) {
+        return TranslateSocketError(NativeLastError(), false);
+    }
+    return 0;
+}
+
+static int32_t FinishNonBlockingConnect(NativeSocket socket, int timeoutMs) {
+    const int pollRet = ProbeConnectSettled(socket, timeoutMs);
+    if (pollRet <= 0) {
+        // Dolphin reports a connect that never settled as -SO_ENETUNREACH
+        // (IOS/Network/Socket.cpp:352-356), not -SO_ETIMEDOUT: ETIMEDOUT is not
+        // even reachable through its error table, so the SDK never handles it.
+        const int hostError = pollRet < 0 ? NativeLastError() : 0;
+        return pollRet == 0 ? -SO_ENETUNREACH : TranslateSocketError(hostError, false);
+    }
+    return ClassifySettledConnect(socket);
+}
+
+bool WaitForReadable(NativeSocket socket, int timeoutMs) {
+    if (timeoutMs <= 0) {
+        return false;
+    }
+
+    pollfd pfd{};
+    pfd.fd = socket;
+    pfd.events = POLLRDNORM;
+#ifdef _WIN32
+    const int ret = WSAPoll(&pfd, 1, timeoutMs);
+#else
+    const int ret = poll(&pfd, 1, timeoutMs);
+#endif
+    return ret > 0 && (pfd.revents & (POLLRDNORM | POLLIN | POLLERR | POLLHUP)) != 0;
+}
+
+void CloseNativeSocket(NativeSocket socket) {
+    if (socket == kInvalidSocket) {
+        return;
+    }
+#ifdef _WIN32
+    closesocket(socket);
+#else
+    close(socket);
+#endif
+}
+
+void SetNonBlocking(NativeSocket socket, bool enabled) {
+#ifdef _WIN32
+    u_long mode = enabled ? 1 : 0;
+    ioctlsocket(socket, FIONBIO, &mode);
+#else
+    int flags = fcntl(socket, F_GETFL, 0);
+    if (flags >= 0) {
+        if (enabled) {
+            flags |= O_NONBLOCK;
+        } else {
+            flags &= ~O_NONBLOCK;
+        }
+        fcntl(socket, F_SETFL, flags);
+    }
+#endif
+}
+
+
+
+static void ConfigureUdpSocket(NativeSocket socket, int type) {
+#ifdef _WIN32
+    if (type != SOCK_DGRAM) {
+        return;
+    }
+
+    BOOL disabled = FALSE;
+    DWORD bytesReturned = 0;
+    WSAIoctl(socket, SIO_UDP_CONNRESET, &disabled, sizeof(disabled),
+             nullptr, 0, &bytesReturned, nullptr, nullptr);
+#else
+    (void)socket;
+    (void)type;
+#endif
+}
+
+int32_t ReconnectWiiSocket(WiiSocket& socket, uint16_t port) {
+    if (!socket.hasPeerAddr || socket.type != SOCK_STREAM) {
+        return -SO_EINVAL;
+    }
+
+    NativeSocket native = ::socket(socket.af, socket.type, socket.protocol);
+    if (native == kInvalidSocket) {
+        return SocketResult(-1, false);
+    }
+    ConfigureUdpSocket(native, socket.type);
+
+    SetNonBlocking(native, true);
+    sockaddr_in addr = socket.peerAddr;
+    addr.sin_port = htons(port);
+    const int ret = connect(native, reinterpret_cast<sockaddr*>(&addr), sizeof(addr));
+    const int nativeErr = ret < 0 ? NormalizeConnectError(NativeLastError()) : 0;
+    int32_t result = 0;
+    if (ret < 0 && IsWouldBlockError(nativeErr)) {
+        result = FinishNonBlockingConnect(native, 10000);
+    } else if (ret < 0) {
+        result = SocketErrorResult(nativeErr, false);
+    } else {
+        result = SocketResult(ret, false);
+    }
+    g_lastSocketError = result;
+    if (result != 0) {
+        CloseNativeSocket(native);
+        return result;
+    }
+
+    CloseNativeSocket(socket.native);
+    socket.native = native;
+    socket.generation = NextSocketGeneration();
+    socket.peerAddr = addr;
+    socket.peerPort = port;
+    socket.nonblocking = false;
+    SetNonBlocking(socket.native, false);
+    return 0;
+}
+
+int MapWiiAf(uint32_t af) {
+    if (af == kWiiAfInet) {
+        return AF_INET;
+    }
+#ifdef AF_INET6
+    if (af == kWiiAfInet6) {
+        return AF_INET6;
+    }
+#endif
+    return -1;
+}
+
+int MapNativeAfToWii(int af) {
+    if (af == AF_INET) {
+        return kWiiAfInet;
+    }
+#ifdef AF_INET6
+    if (af == AF_INET6) {
+        return kWiiAfInet6;
+    }
+#endif
+    return -1;
+}
+
+int MapWiiSocketType(uint32_t type) {
+    if (type == 0) {
+        return 0;
+    }
+    if (type == kWiiSockStream) {
+        return SOCK_STREAM;
+    }
+    if (type == kWiiSockDgram) {
+        return SOCK_DGRAM;
+    }
+#ifdef SOCK_RAW
+    if (type == kWiiSockRaw) {
+        return SOCK_RAW;
+    }
+#endif
+#ifdef SOCK_RDM
+    if (type == kWiiSockRdm) {
+        return SOCK_RDM;
+    }
+#endif
+#ifdef SOCK_SEQPACKET
+    if (type == kWiiSockSeqPacket) {
+        return SOCK_SEQPACKET;
+    }
+#endif
+    return -1;
+}
+
+int MapWiiAddrInfoFamily(uint32_t family) {
+    const int mapped = MapWiiAf(family);
+    // Dolphin passes unfamiliar addrinfo hint values through to the host
+    // resolver, which then returns the platform's EAI_FAMILY equivalent. Do
+    // not turn an invalid family into AF_INET and accidentally resolve it.
+    return mapped >= 0 ? mapped : static_cast<int>(family);
+}
+
+int MapWiiAddrInfoSocketType(uint32_t type) {
+    const int mapped = MapWiiSocketType(type);
+    // Wii and host socket type values match for the common types, but retain
+    // Dolphin's pass-through behavior for an unfamiliar hint so getaddrinfo
+    // can reject it instead of silently broadening the query.
+    return mapped >= 0 ? mapped : static_cast<int>(type);
+}
+
+uint32_t MapNativeSocketTypeToWii(int type) {
+    if (type == 0) {
+        return 0;
+    }
+    if (type == SOCK_STREAM) {
+        return kWiiSockStream;
+    }
+    if (type == SOCK_DGRAM) {
+        return kWiiSockDgram;
+    }
+#ifdef SOCK_RAW
+    if (type == SOCK_RAW) {
+        return kWiiSockRaw;
+    }
+#endif
+#ifdef SOCK_RDM
+    if (type == SOCK_RDM) {
+        return kWiiSockRdm;
+    }
+#endif
+#ifdef SOCK_SEQPACKET
+    if (type == SOCK_SEQPACKET) {
+        return kWiiSockSeqPacket;
+    }
+#endif
+    // Dolphin writes ai_socktype without coercion. Preserve an unfamiliar host
+    // value rather than silently changing it to SOCK_STREAM.
+    return static_cast<uint32_t>(type);
+}
+
+int32_t AddWiiSocket(NativeSocket native, int af, int type, int protocol) {
+    if (native == kInvalidSocket) {
+        return SocketResult(-1, false);
+    }
+    for (int i = 0; i < kWiiSocketMax; ++i) {
+        if (g_sockets[i].native == kInvalidSocket) {
+            ConfigureUdpSocket(native, type);
+            if (type == SOCK_DGRAM) {
+                // Dolphin: WiiSockMan::AddSocket - "Wii UDP sockets can use
+                // broadcast address by default" (IOS/Network/Socket.cpp:905-916).
+                // Without this a sendto() to a broadcast address fails with
+                // EACCES/WSAEACCES on the host but succeeds on hardware.
+                const int enableBroadcast = 1;
+                setsockopt(native, SOL_SOCKET, SO_BROADCAST,
+                           reinterpret_cast<const char*>(&enableBroadcast),
+                           sizeof(enableBroadcast));
+            }
+            SetNonBlocking(native, true);
+            // IOS keeps the host descriptor nonblocking while the guest flag starts cleared.
+            g_sockets[i] = {native, af, type, protocol, false};
+            g_sockets[i].generation = NextSocketGeneration();
+            return i;
+        }
+    }
+    CloseNativeSocket(native);
+    return -SO_EMFILE;
+}
+
+WiiSocket* GetWiiSocket(uint32_t fd) {
+    if (fd >= kWiiSocketMax || g_sockets[fd].native == kInvalidSocket) {
+        g_lastSocketError = -SO_EBADF;
+        return nullptr;
+    }
+    return &g_sockets[fd];
+}
+
+bool SocketIdentityIsCurrent(uint32_t wiiFd, NativeSocket nativeFd, uint64_t generation) {
+    if (wiiFd >= g_sockets.size()) {
+        return false;
+    }
+    const WiiSocket& socket = g_sockets[wiiFd];
+    return socket.native != kInvalidSocket && socket.native == nativeFd &&
+           socket.generation == generation;
+}
+
+bool CopiedPollSocketIsStillValid(const NetworkPollContract::CopiedDescriptor& descriptor) {
+    return SocketIdentityIsCurrent(descriptor.wiiFd, descriptor.nativeFd,
+                                   descriptor.socketGeneration);
+}
+
+bool ValidatePollRequest(uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen,
+                         uint32_t& descriptorCount) {
+    descriptorCount = outLen / 12u;
+    return inBuf && outBuf && inLen >= 8u && descriptorCount != 0 &&
+           descriptorCount <= NetworkPollContract::kMaxDescriptors &&
+           Memory::Contains(inBuf, 8u) &&
+           Memory::Contains(outBuf, static_cast<size_t>(descriptorCount) * 12u);
+}
+
+std::vector<NetworkPollContract::CopiedDescriptor> CopyPollDescriptors(uint32_t outBuf,
+                                                                      uint32_t descriptorCount) {
+    std::vector<NetworkPollContract::CopiedDescriptor> descriptors;
+    descriptors.reserve(descriptorCount);
+    for (uint32_t i = 0; i < descriptorCount; ++i) {
+        const uint32_t entry = outBuf + i * 12u;
+        NetworkPollContract::CopiedDescriptor descriptor{};
+        descriptor.wiiFd = Memory::Read32(entry);
+        descriptor.events = NetworkPollContract::WiiEventsToNative(Memory::Read32(entry + 4u));
+        if (descriptor.wiiFd < g_sockets.size()) {
+            const WiiSocket& socket = g_sockets[descriptor.wiiFd];
+            if (socket.native != kInvalidSocket) {
+                descriptor.nativeFd = socket.native;
+                descriptor.socketGeneration = socket.generation;
+            }
+        }
+        descriptors.push_back(descriptor);
+    }
+    return descriptors;
+}
+
+void WritePollResults(uint32_t outAddress,
+                      const std::vector<NetworkPollContract::CopiedDescriptor>& descriptors) {
+    for (size_t i = 0; i < descriptors.size(); ++i) {
+        Memory::Write32(outAddress + static_cast<uint32_t>(i * 12u + 8u),
+                        NetworkPollContract::NativeEventsToWii(descriptors[i].revents));
+    }
+}
+
+}  // namespace NetworkHle
+
+using namespace NetworkHle;
+
+extern "C" int32_t Network_HLE_OpenDevice(const char* path, uint32_t mode) {
+    if (!path) {
+        return -101;
+    }
+    if (!RuntimeConfigFile::NetworkEnabled(true)) {
+        // The guest opens several /dev/net nodes at boot and retries; report the
+        // reason online will not work exactly once.
+        static bool reported = false;
+        if (!reported) {
+            reported = true;
+            NetFail("networking is disabled in Config.toml; online play is unavailable");
+        }
+        return 0;
+    }
+    DeviceKind kind;
+    if (std::strcmp(path, "/dev/net/kd/request") == 0) {
+        kind = DeviceKind::KdRequest;
+    } else if (std::strcmp(path, "/dev/net/kd/time") == 0) {
+        kind = DeviceKind::KdTime;
+    } else if (std::strcmp(path, "/dev/net/ncd/manage") == 0) {
+        kind = DeviceKind::NcdManage;
+    } else if (std::strcmp(path, "/dev/net/ip/top") == 0) {
+        kind = DeviceKind::IpTop;
+        EnsureSocketRuntime();
+    } else if (std::strcmp(path, "/dev/net/ssl") == 0) {
+        kind = DeviceKind::Ssl;
+        EnsureSocketRuntime();
+    } else {
+        return 0;
+    }
+
+    return AllocateDevice(kind);
+}
+
+extern "C" bool Network_HLE_IsFd(uint32_t fd) {
+    return GetDeviceKind(fd).has_value();
+}
+
+extern "C" int32_t Network_HLE_Close(uint32_t fd) {
+    if (!GetDeviceKind(fd)) {
+        return -101;
+    }
+    RemoveDevice(fd);
+    return 0;
+}
+
+extern "C" int32_t Network_HLE_Ioctl(uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen,
+                                      uint32_t outBuf, uint32_t outLen) {
+    const auto device = GetDeviceKind(fd);
+    if (!device) {
+        return -101;
+    }
+    switch (*device) {
+    case DeviceKind::KdRequest:
+        return HandleKdIoctl(cmd, inBuf, inLen, outBuf, outLen);
+    case DeviceKind::KdTime:
+        return HandleKdTimeIoctl(cmd, inBuf, inLen, outBuf, outLen);
+    case DeviceKind::IpTop:
+        return HandleIpTopIoctl(cmd, inBuf, inLen, outBuf, outLen);
+    case DeviceKind::NcdManage:
+        return 0;
+    case DeviceKind::Ssl:
+        return 0;
+    }
+    return -101;
+}
+
+extern "C" int32_t Network_HLE_Ioctlv(uint32_t fd, uint32_t cmd, uint32_t numIn, uint32_t numOut,
+                                       uint32_t vectorPtr) {
+    const auto device = GetDeviceKind(fd);
+    if (!device) {
+        return -101;
+    }
+    // numIn/numOut are guest-controlled; sum in 64-bit so a wrap can't make
+    // `vectors` shorter than numIn and run the iterator arithmetic below off
+    // the end. Matches PrepareDeferredGetAddrInfo in network_deferred.cpp.
+    const uint64_t vectorCount = static_cast<uint64_t>(numIn) + numOut;
+    if (vectorCount > kMaxIoVectors || (vectorCount != 0 &&
+        (!vectorPtr || !Memory::Contains(vectorPtr, static_cast<size_t>(vectorCount) * 8u)))) {
+        return -SO_EINVAL;
+    }
+
+    const std::vector<IoVector> vectors = ReadVectors(vectorPtr, static_cast<uint32_t>(vectorCount));
+    const std::vector<IoVector> in(vectors.begin(), vectors.begin() + numIn);
+    const std::vector<IoVector> out(vectors.begin() + numIn, vectors.end());
+
+    switch (*device) {
+    case DeviceKind::NcdManage:
+        return HandleNcdIoctlv(cmd, in, out);
+    case DeviceKind::IpTop:
+        return HandleIpTopIoctlv(cmd, in, out);
+    case DeviceKind::KdRequest:
+        return HandleKdIoctlv(cmd, in, out);
+    case DeviceKind::KdTime: {
+        const uint32_t inBuf = in.empty() ? 0 : in[0].address;
+        const uint32_t inLen = in.empty() ? 0 : in[0].size;
+        const uint32_t outBuf = out.empty() ? 0 : out[0].address;
+        const uint32_t outLen = out.empty() ? 0 : out[0].size;
+        return HandleKdTimeIoctl(cmd, inBuf, inLen, outBuf, outLen);
+    }
+    case DeviceKind::Ssl:
+        return HandleSslIoctlv(cmd, in, out);
+    }
+    return -101;
+}
diff --git a/runtime/src/hle/net/network_deferred.cpp b/runtime/src/hle/net/network_deferred.cpp
new file mode 100644
index 0000000..8ed5e0e
--- /dev/null
+++ b/runtime/src/hle/net/network_deferred.cpp
@@ -0,0 +1,1070 @@
+#include "network_internal.h"
+
+#include "fiber_manager.h"
+#include "hle/net/network.h"
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+
+void OS_HLE_WakeupThreadNoReschedule(CpuContext* ctx, uint32_t waitQueue);
+void NandQueueIosCallback(uint32_t callbackPtr, int32_t result, uint32_t callbackArg);
+
+namespace NetworkHle {
+
+enum class DeferredDnsKind {
+    GetHostByName,
+    GetAddrInfo,
+    InetAton,
+};
+
+static const char* DeferredDnsKindName(DeferredDnsKind kind) {
+    switch (kind) {
+    case DeferredDnsKind::GetHostByName:
+        return "gethostbyname";
+    case DeferredDnsKind::GetAddrInfo:
+        return "getaddrinfo";
+    case DeferredDnsKind::InetAton:
+        return "inet_aton";
+    }
+    return "?";
+}
+
+enum class DeferredNetworkCompletionKind {
+    SyncWaitQueue,
+    AsyncCallback,
+};
+
+struct DeferredNetworkRoute {
+    DeferredNetworkCompletionKind kind = DeferredNetworkCompletionKind::SyncWaitQueue;
+    uint64_t token = 0;
+    uint32_t waitQueue = 0;
+    uint32_t expectedThread = 0;
+    uint32_t callback = 0;
+    uint32_t callbackArg = 0;
+};
+
+// This is deliberately a host-only value object. Guest strings, vectors and
+// hints are copied by the emulation thread before the worker is launched. The
+// worker may carry guest output addresses as opaque integers, but it has no
+// CpuContext or guest-memory pointer with which to dereference them.
+struct DeferredDnsWork {
+    DeferredDnsKind kind = DeferredDnsKind::GetHostByName;
+    DeferredNetworkRoute route{};
+    std::string node;
+    std::string service;
+    bool hasHints = false;
+    int hintFlags = 0;
+    int hintFamily = AF_UNSPEC;
+    int hintSockType = 0;
+    int hintProtocol = 0;
+    uint32_t outAddress = 0;
+    uint32_t outSize = 0;
+};
+
+struct DeferredDnsAddress {
+    int flags = 0;
+    uint32_t family = 0;
+    int sockType = 0;
+    int protocol = 0;
+    uint32_t addressLength = 0;
+    uint32_t ipv4Address = 0;
+    std::array<uint8_t, NetworkDeferredContract::kWiiSockAddrPayloadBytes> socketData{};
+};
+
+static std::optional<DeferredDnsAddress> NormalizeDeferredDnsAddress(const addrinfo& native) {
+    // This IOS result layout currently owns one complete IPv4 sockaddr. Do not
+    // advertise an IPv6 ai_addrlen while retaining only sockaddr::sa_data.
+    if (!native.ai_addr ||
+        !NetworkDeferredContract::CanCopyIpv4SockAddr(
+            native.ai_family, native.ai_addrlen, AF_INET)) {
+        return std::nullopt;
+    }
+    const int wiiFamily = MapNativeAfToWii(native.ai_family);
+    if (wiiFamily != kWiiAfInet) {
+        return std::nullopt;
+    }
+
+    DeferredDnsAddress normalized{};
+    normalized.flags = native.ai_flags;
+    normalized.family = static_cast<uint32_t>(wiiFamily);
+    normalized.sockType = native.ai_socktype;
+    normalized.protocol = native.ai_protocol;
+    normalized.addressLength =
+        static_cast<uint32_t>(NetworkDeferredContract::kWiiIpv4SockAddrBytes);
+    const auto* socketAddress = reinterpret_cast<const sockaddr*>(native.ai_addr);
+    std::memcpy(normalized.socketData.data(), socketAddress->sa_data,
+                normalized.socketData.size());
+    const auto* ipv4 = reinterpret_cast<const sockaddr_in*>(native.ai_addr);
+    normalized.ipv4Address = ntohl(ipv4->sin_addr.s_addr);
+    return normalized;
+}
+
+struct DeferredDnsCompletion {
+    DeferredDnsWork work{};
+    int32_t result = 0;
+    std::vector<DeferredDnsAddress> addresses;
+};
+
+struct DeferredPollWork {
+    DeferredNetworkRoute route{};
+    NetworkPollContract::Timeout timeout{};
+    uint32_t outAddress = 0;
+    uint32_t outSize = 0;
+    std::vector<NetworkPollContract::CopiedDescriptor> descriptors;
+};
+
+struct DeferredConnectWork {
+    DeferredNetworkRoute route{};
+    NetworkPollContract::Timeout timeout{};
+    uint32_t wiiFd = 0;
+    NativeSocket nativeFd = kInvalidSocket;
+    uint64_t socketGeneration = 0;
+    sockaddr_in peerAddress{};
+    std::optional<int32_t> initialResult;
+};
+
+using DeferredDnsPreparation =
+    NetworkDeferredContract::Preparation<DeferredDnsWork>;
+using DeferredPollPreparation =
+    NetworkDeferredContract::Preparation<DeferredPollWork>;
+using DeferredConnectPreparation =
+    NetworkDeferredContract::Preparation<DeferredConnectWork>;
+
+struct DeferredNetworkStore {
+    std::mutex completedMutex;
+    std::deque<DeferredDnsCompletion> completed;
+    // Pending polls are submitted and probed only by the emulation scheduler
+    // thread, so unlike DNS worker completions they need no cross-thread lock.
+    std::vector<DeferredPollWork> pendingPolls;
+    std::vector<DeferredConnectWork> pendingConnects;
+    std::mutex resultMutex;
+    std::unordered_map<uint64_t, int32_t> syncResults;
+    std::mutex schedulerThreadMutex;
+    std::optional<std::thread::id> schedulerThread;
+    std::atomic<uint64_t> nextToken{1};
+};
+
+static DeferredNetworkStore& GetDeferredNetworkStore() {
+    // DNS workers are detached so the resolver can never block runtime
+    // shutdown. Keep their destination alive for the lifetime of the process;
+    // there is intentionally no static destructor for this state.
+    static auto* store = new DeferredNetworkStore();
+    return *store;
+}
+
+// pendingConnects is only ever touched from the emulation/scheduler thread, so
+// this needs no lock. Marking the operation resolved makes the next completion
+// pump wake the parked OSThread with the requested result; the connect itself is
+// never re-probed afterwards.
+void AbortPendingDeferredConnects(uint32_t wiiFd, int32_t result) {
+    DeferredNetworkStore& store = GetDeferredNetworkStore();
+    for (DeferredConnectWork& work : store.pendingConnects) {
+        if (work.wiiFd == wiiFd && !work.initialResult) {
+            work.initialResult = result;
+        }
+    }
+}
+
+static void NoteDeferredNetworkSchedulerThread(const char* operation) {
+    DeferredNetworkStore& store = GetDeferredNetworkStore();
+    const std::thread::id current = std::this_thread::get_id();
+    std::lock_guard<std::mutex> lock(store.schedulerThreadMutex);
+    if (!store.schedulerThread) {
+        store.schedulerThread = current;
+        return;
+    }
+    if (*store.schedulerThread != current) {
+        RT_LOGF(RT_TAG_NET,
+                     "deferred network %s ran off the emulation thread\n",
+                     operation);
+#ifndef NDEBUG
+        assert(*store.schedulerThread == current);
+#endif
+    }
+}
+
+static int32_t DeferredDnsFailureResult(DeferredDnsKind kind) {
+    switch (kind) {
+    case DeferredDnsKind::GetHostByName:
+        return -1;
+    case DeferredDnsKind::GetAddrInfo:
+        return SO_ERROR_HOST_NOT_FOUND;
+    case DeferredDnsKind::InetAton:
+        return 0;
+    }
+    return -1;
+}
+
+static void QueueDeferredDnsCompletion(DeferredDnsCompletion completion) {
+    DeferredNetworkStore& store = GetDeferredNetworkStore();
+    std::lock_guard<std::mutex> lock(store.completedMutex);
+    store.completed.push_back(std::move(completion));
+}
+
+static DeferredDnsCompletion ResolveDeferredDns(DeferredDnsWork work) {
+    DeferredDnsCompletion completion{};
+    completion.work = std::move(work);
+
+    addrinfo hints{};
+    addrinfo* hintPtr = nullptr;
+    if (completion.work.kind != DeferredDnsKind::GetAddrInfo) {
+        hints.ai_family = AF_INET;
+        hintPtr = &hints;
+    } else {
+        if (completion.work.hasHints) {
+#ifdef AF_INET6
+            if (completion.work.hintFamily == AF_INET6) {
+                // The guest result encoder deliberately owns IPv4 sockaddr
+                // payloads only. An IPv6-only query therefore has no valid
+                // result rather than a truncated sockaddr_in6.
+                completion.result = DeferredDnsFailureResult(completion.work.kind);
+                return completion;
+            }
+#endif
+            hints.ai_flags = completion.work.hintFlags;
+            hints.ai_family = completion.work.hintFamily == AF_UNSPEC
+                ? AF_INET
+                : completion.work.hintFamily;
+            hints.ai_socktype = completion.work.hintSockType;
+            hints.ai_protocol = completion.work.hintProtocol;
+        } else {
+            hints.ai_family = AF_INET;
+        }
+        hintPtr = &hints;
+    }
+
+    addrinfo* nativeResults = nullptr;
+    const char* node = completion.work.node.empty() ? nullptr : completion.work.node.c_str();
+    const char* service = completion.work.service.empty() ? nullptr : completion.work.service.c_str();
+    const int gai = getaddrinfo(node, service, hintPtr, &nativeResults);
+    if (gai != 0 || !nativeResults) {
+        completion.result = DeferredDnsFailureResult(completion.work.kind);
+        if (nativeResults) {
+            freeaddrinfo(nativeResults);
+        }
+        // The name the guest asked for is what proves whether the Retro-WFC
+        // payload's own resolver hooks rewrote the Nintendo hostname or not.
+        NetFail("dns %s '%s'%s%s FAILED gai=%d result=%d",
+                DeferredDnsKindName(completion.work.kind), completion.work.node.c_str(),
+                completion.work.service.empty() ? "" : " service=",
+                completion.work.service.c_str(), gai, completion.result);
+        return completion;
+    }
+
+    // The host resolver's linked list and sockaddr pointers are owned by its
+    // allocator. Normalize everything to POD before leaving the worker.
+    const size_t maxAddresses = completion.work.kind == DeferredDnsKind::GetHostByName
+        ? 71u
+        : (completion.work.kind == DeferredDnsKind::InetAton ? 1u : 256u);
+    completion.addresses.reserve(std::min<size_t>(maxAddresses, 16u));
+    for (addrinfo* it = nativeResults; it && completion.addresses.size() < maxAddresses; it = it->ai_next) {
+        if (auto normalized = NormalizeDeferredDnsAddress(*it)) {
+            completion.addresses.push_back(std::move(*normalized));
+        }
+    }
+    freeaddrinfo(nativeResults);
+    completion.result = completion.addresses.empty()
+        ? DeferredDnsFailureResult(completion.work.kind)
+        : 0;
+    return completion;
+}
+
+static bool LaunchDeferredDns(DeferredDnsWork work) {
+    std::unique_ptr<std::thread> worker;
+    try {
+        worker = std::make_unique<std::thread>([work = std::move(work)]() mutable {
+            NetworkDeferredContract::RunWorker(
+                std::move(work),
+                [](const DeferredDnsWork& copiedWork) {
+                    return ResolveDeferredDns(copiedWork);
+                },
+                [](DeferredDnsCompletion completion) {
+                    QueueDeferredDnsCompletion(std::move(completion));
+                },
+                [](DeferredDnsWork failedWork, std::exception_ptr error) {
+                    (void)error;
+                    DeferredDnsCompletion failure{};
+                    failure.work = std::move(failedWork);
+                    failure.result = DeferredDnsFailureResult(failure.work.kind);
+                    try {
+                        QueueDeferredDnsCompletion(std::move(failure));
+                    } catch (const std::exception& queueError) {
+                        RT_LOGF(RT_TAG_NET,
+                                     "failed to queue deferred DNS failure: %s\n",
+                                     queueError.what());
+                    } catch (...) {
+                        RT_LOGF(RT_TAG_NET,
+                                     "failed to queue deferred DNS failure\n");
+                    }
+                });
+        });
+    } catch (const std::exception&) {
+        return false;
+    }
+
+    (void)NetworkDeferredContract::DetachOrRelease(
+        std::move(worker), [](std::exception_ptr error) noexcept {
+            try {
+                if (error) {
+                    std::rethrow_exception(error);
+                }
+            } catch (const std::exception& detachError) {
+                RT_LOGF(RT_TAG_NET,
+                             "failed to detach deferred DNS worker; "
+                             "retaining running worker: %s\n",
+                             detachError.what());
+                return;
+            } catch (...) {
+            }
+            RT_LOGF(RT_TAG_NET,
+                         "failed to detach deferred DNS worker; "
+                         "retaining running worker\n");
+        });
+    return true;
+}
+
+// Every deferred operation is an /dev/net/ip/top command; anything else must
+// fall straight through to the direct path.
+static bool IsIpTopDevice(uint32_t fd) {
+    const std::optional<DeviceKind> kind = GetDeviceKind(fd);
+    return kind && *kind == DeviceKind::IpTop;
+}
+
+static bool IsIpTopCommand(uint32_t fd, uint32_t cmd, uint32_t expectedCmd) {
+    return cmd == expectedCmd && IsIpTopDevice(fd);
+}
+
+template <typename Work>
+static bool IsApplicable(const NetworkDeferredContract::Preparation<Work>& prepared) {
+    return prepared.State() != NetworkDeferredContract::PreparationState::NotApplicable;
+}
+
+static DeferredDnsPreparation PrepareDeferredGetHostByName(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen) {
+    if (!IsIpTopCommand(fd, cmd, IOCTL_SO_GETHOSTBYNAME)) {
+        return DeferredDnsPreparation::NotApplicable();
+    }
+    if (!inBuf || !outBuf || outLen < 0x460 || !Memory::Contains(outBuf, outLen)) {
+        return DeferredDnsPreparation::Error(-1);
+    }
+
+    const uint32_t maxInput = inLen ? inLen : 256u;
+    if (!Memory::Contains(inBuf, maxInput)) {
+        return DeferredDnsPreparation::Error(-1);
+    }
+
+    DeferredDnsWork work{};
+    work.kind = DeferredDnsKind::GetHostByName;
+    work.node = ReadGuestString(inBuf, maxInput);
+    if (work.node.empty()) {
+        return DeferredDnsPreparation::Error(-1);
+    }
+    work.outAddress = outBuf;
+    work.outSize = outLen;
+    return DeferredDnsPreparation::Ready(std::move(work), -1);
+}
+
+static DeferredDnsPreparation PrepareDeferredInetAton(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen) {
+    if (!IsIpTopCommand(fd, cmd, IOCTL_SO_INETATON)) {
+        return DeferredDnsPreparation::NotApplicable();
+    }
+
+    const uint32_t maxInput = inLen ? inLen : 256u;
+    if (!inBuf || !outBuf || outLen < 4u ||
+        !Memory::Contains(inBuf, maxInput) || !Memory::Contains(outBuf, 4u)) {
+        return DeferredDnsPreparation::Error(0);
+    }
+
+    DeferredDnsWork work{};
+    work.kind = DeferredDnsKind::InetAton;
+    work.node = ReadGuestString(inBuf, maxInput);
+    if (work.node.empty()) {
+        return DeferredDnsPreparation::Error(0);
+    }
+    in_addr numericAddress{};
+    if (inet_pton(AF_INET, work.node.c_str(), &numericAddress) == 1) {
+        // Numeric conversion cannot block; retain the existing immediate path.
+        return DeferredDnsPreparation::NotApplicable();
+    }
+    work.outAddress = outBuf;
+    work.outSize = 4u;
+    return DeferredDnsPreparation::Ready(std::move(work), 0);
+}
+
+static DeferredDnsPreparation PrepareDeferredScalarDns(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen) {
+    auto getHostByName =
+        PrepareDeferredGetHostByName(fd, cmd, inBuf, inLen, outBuf, outLen);
+    if (IsApplicable(getHostByName)) {
+        return getHostByName;
+    }
+    return PrepareDeferredInetAton(fd, cmd, inBuf, inLen, outBuf, outLen);
+}
+
+static DeferredPollPreparation PrepareDeferredPoll(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen) {
+    if (!IsIpTopCommand(fd, cmd, IOCTL_SO_POLL)) {
+        return DeferredPollPreparation::NotApplicable();
+    }
+
+    uint32_t descriptorCount = 0;
+    if (!ValidatePollRequest(inBuf, inLen, outBuf, outLen, descriptorCount)) {
+        return DeferredPollPreparation::Error(-SO_EINVAL);
+    }
+
+    const int64_t timeoutMilliseconds = static_cast<int64_t>(Memory::Read64(inBuf));
+    if (!NetworkPollContract::RequiresSchedulerWait(timeoutMilliseconds)) {
+        // A timeout-zero poll is guaranteed not to block and is cheaper to
+        // execute directly than to copy, sleep, wake, and copy back.
+        return DeferredPollPreparation::NotApplicable();
+    }
+
+    DeferredPollWork work{};
+    work.outAddress = outBuf;
+    work.outSize = outLen;
+    work.timeout = NetworkPollContract::Timeout::FromMilliseconds(timeoutMilliseconds);
+    work.descriptors = CopyPollDescriptors(outBuf, descriptorCount);
+    return DeferredPollPreparation::Ready(std::move(work), -SO_EINVAL);
+}
+
+static DeferredConnectPreparation PrepareDeferredConnect(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen) {
+    if (!IsIpTopCommand(fd, cmd, IOCTL_SO_CONNECT)) {
+        return DeferredConnectPreparation::NotApplicable();
+    }
+    if (!inBuf || inLen < 16u || !Memory::Contains(inBuf, 16u)) {
+        return DeferredConnectPreparation::Error(-SO_EINVAL);
+    }
+
+    const uint32_t wiiFd = Memory::Read32(inBuf);
+    WiiSocket* socket = GetWiiSocket(wiiFd);
+    if (!socket) {
+        return DeferredConnectPreparation::Error(-SO_EBADF);
+    }
+    if (socket->nonblocking) {
+        // The direct path is already a zero-wait host connect and returns
+        // SO_EINPROGRESS to the guest as required.
+        return DeferredConnectPreparation::NotApplicable();
+    }
+
+    DeferredConnectWork work{};
+    work.wiiFd = wiiFd;
+    work.nativeFd = socket->native;
+    work.socketGeneration = socket->generation;
+    work.peerAddress = ReadWiiSockAddr(inBuf + 8u);
+    work.timeout = NetworkPollContract::Timeout::FromMilliseconds(
+        NetworkConnectContract::kGuestBlockingTimeoutMilliseconds);
+    return DeferredConnectPreparation::Ready(std::move(work), -SO_EINVAL);
+}
+
+static DeferredDnsPreparation PrepareDeferredGetAddrInfo(
+    uint32_t fd, uint32_t cmd, uint32_t numIn, uint32_t numOut, uint32_t vectorPtr) {
+    if (!IsIpTopCommand(fd, cmd, IOCTLV_SO_GETADDRINFO)) {
+        return DeferredDnsPreparation::NotApplicable();
+    }
+    const uint64_t vectorCount = static_cast<uint64_t>(numIn) + numOut;
+    if (vectorCount == 0 || vectorCount > UINT32_MAX || !vectorPtr ||
+        !Memory::Contains(vectorPtr, static_cast<size_t>(vectorCount) * 8u)) {
+        return DeferredDnsPreparation::Error(-SO_EINVAL);
+    }
+
+    const std::vector<IoVector> vectors = ReadVectors(vectorPtr, static_cast<uint32_t>(vectorCount));
+    const std::vector<IoVector> in(vectors.begin(), vectors.begin() + numIn);
+    const std::vector<IoVector> out(vectors.begin() + numIn, vectors.end());
+    if (out.empty() || !out[0].address || !out[0].size ||
+        !Memory::Contains(out[0].address, out[0].size)) {
+        return DeferredDnsPreparation::Error(-SO_EINVAL);
+    }
+    for (const IoVector& vector : vectors) {
+        if ((vector.address == 0) != (vector.size == 0) ||
+            (vector.address && !Memory::Contains(vector.address, vector.size))) {
+            return DeferredDnsPreparation::Error(-SO_EINVAL);
+        }
+    }
+
+    DeferredDnsWork work{};
+    work.kind = DeferredDnsKind::GetAddrInfo;
+    work.outAddress = out[0].address;
+    work.outSize = out[0].size;
+    if (!in.empty() && in[0].address && in[0].size) {
+        if (!Memory::Contains(in[0].address, in[0].size)) {
+            return DeferredDnsPreparation::Error(-SO_EINVAL);
+        }
+        work.node = ReadGuestString(in[0].address, in[0].size);
+    }
+    if (in.size() > 1 && in[1].address && in[1].size) {
+        if (!Memory::Contains(in[1].address, in[1].size)) {
+            return DeferredDnsPreparation::Error(-SO_EINVAL);
+        }
+        work.service = ReadGuestString(in[1].address, in[1].size);
+    }
+    if (in.size() > 2 && in[2].address) {
+        if (in[2].size < 0x10 || !Memory::Contains(in[2].address, 0x10)) {
+            return DeferredDnsPreparation::Error(-SO_EINVAL);
+        }
+        work.hasHints = true;
+        work.hintFlags = static_cast<int>(Memory::Read32(in[2].address));
+        work.hintFamily = MapWiiAddrInfoFamily(Memory::Read32(in[2].address + 4));
+        work.hintSockType = MapWiiAddrInfoSocketType(Memory::Read32(in[2].address + 8));
+        work.hintProtocol = static_cast<int>(Memory::Read32(in[2].address + 0x0C));
+    }
+    if (work.node.empty() && work.service.empty()) {
+        return DeferredDnsPreparation::Error(SO_ERROR_HOST_NOT_FOUND);
+    }
+    return DeferredDnsPreparation::Ready(
+        std::move(work), SO_ERROR_HOST_NOT_FOUND);
+}
+
+static int32_t ApplyDeferredDnsCompletion(const DeferredDnsCompletion& completion) {
+    if (completion.result != 0) {
+        return completion.result;
+    }
+
+    const uint32_t outAddress = completion.work.outAddress;
+    const uint32_t outSize = completion.work.outSize;
+    if (!outAddress || !outSize || !Memory::Contains(outAddress, outSize)) {
+        return -SO_EINVAL;
+    }
+
+    if (completion.work.kind == DeferredDnsKind::InetAton) {
+        if (completion.addresses.empty()) {
+            return 0;
+        }
+        Memory::Write32(outAddress, completion.addresses.front().ipv4Address);
+        return 1;
+    }
+
+    ZeroMemoryRange(outAddress, outSize);
+    if (completion.work.kind == DeferredDnsKind::GetHostByName) {
+        constexpr uint32_t kStructSize = 0x10;
+        constexpr uint32_t kIpListOffset = 0x110;
+        constexpr uint32_t kIpPtrListOffset = 0x340;
+        const std::string canonical = completion.work.node.size() < 240
+            ? completion.work.node
+            : completion.work.node.substr(0, 239);
+        for (uint32_t i = 0; i <= canonical.size(); ++i) {
+            Memory::Write8(outAddress + kStructSize + i,
+                           i < canonical.size() ? static_cast<uint8_t>(canonical[i]) : 0);
+        }
+        Memory::Write32(outAddress, outAddress + kStructSize);
+        Memory::Write16(outAddress + 8, kWiiAfInet);
+        Memory::Write16(outAddress + 10, 4);
+        Memory::Write32(outAddress + 12, outAddress + kIpPtrListOffset);
+
+        const uint32_t count = static_cast<uint32_t>(std::min<size_t>(completion.addresses.size(), 71u));
+        for (uint32_t i = 0; i < count; ++i) {
+            Memory::Write32(outAddress + kIpListOffset + i * 4,
+                            completion.addresses[i].ipv4Address);
+            Memory::Write32(outAddress + kIpPtrListOffset + i * 4,
+                            outAddress + kIpListOffset + i * 4);
+        }
+        Memory::Write32(outAddress + kIpPtrListOffset + count * 4, 0);
+        // Hardware returns an empty aliases list. Point h_aliases at the same
+        // terminator that ends h_addr_list, matching IOS/Dolphin exactly.
+        Memory::Write32(outAddress + 4, outAddress + kIpPtrListOffset + count * 4);
+        return 0;
+    }
+
+    constexpr uint32_t kInfoSize = 0x20;
+    constexpr uint32_t kSockAddrOffset = 0x460;
+    constexpr uint32_t kSockAddrStride = 0x1C;
+    const uint64_t end = static_cast<uint64_t>(outAddress) + outSize;
+    const uint64_t infoEnd = std::min<uint64_t>(end, static_cast<uint64_t>(outAddress) + kSockAddrOffset);
+    uint32_t infoAddress = outAddress;
+    uint32_t socketAddress = outAddress + kSockAddrOffset;
+    size_t writeCount = 0;
+    while (writeCount < completion.addresses.size() &&
+           static_cast<uint64_t>(infoAddress) + kInfoSize <= infoEnd &&
+           static_cast<uint64_t>(socketAddress) + kSockAddrStride <= end) {
+        ++writeCount;
+        infoAddress += kInfoSize;
+        socketAddress += kSockAddrStride;
+    }
+
+    infoAddress = outAddress;
+    socketAddress = outAddress + kSockAddrOffset;
+    for (size_t i = 0; i < writeCount; ++i) {
+        const DeferredDnsAddress& address = completion.addresses[i];
+        if (address.family != kWiiAfInet ||
+            address.addressLength != NetworkDeferredContract::kWiiIpv4SockAddrBytes ||
+            !NetworkDeferredContract::AdvertisedSockAddrFits(address.addressLength)) {
+            return -SO_EINVAL;
+        }
+        Memory::Write32(infoAddress, static_cast<uint32_t>(address.flags));
+        Memory::Write32(infoAddress + 0x04, address.family);
+        Memory::Write32(infoAddress + 0x08, MapNativeSocketTypeToWii(address.sockType));
+        Memory::Write32(infoAddress + 0x0C, static_cast<uint32_t>(address.protocol));
+        Memory::Write32(infoAddress + 0x10, address.addressLength);
+        Memory::Write32(infoAddress + 0x14, 0);
+        Memory::Write32(infoAddress + 0x18, socketAddress);
+        Memory::Write8(socketAddress, static_cast<uint8_t>(address.addressLength & 0xFFu));
+        Memory::Write8(socketAddress + 1, static_cast<uint8_t>(address.family & 0xFFu));
+        CopyToGuest(socketAddress + 2, address.socketData.data(),
+                    static_cast<uint32_t>(address.socketData.size()));
+        Memory::Write32(infoAddress + 0x1C,
+                        i + 1 < writeCount ? infoAddress + kInfoSize : 0);
+        infoAddress += kInfoSize;
+        socketAddress += kSockAddrStride;
+    }
+    return 0;
+}
+
+}  // namespace NetworkHle
+
+using namespace NetworkHle;
+
+static bool InitializeDeferredSyncRoute(DeferredNetworkRoute& route, uint32_t waitQueue) {
+    if (!waitQueue) {
+        return false;
+    }
+    NoteDeferredNetworkSchedulerThread("submission");
+    DeferredNetworkStore& store = GetDeferredNetworkStore();
+    uint64_t nextToken = store.nextToken.fetch_add(1, std::memory_order_relaxed);
+    if (nextToken == 0) {
+        nextToken = store.nextToken.fetch_add(1, std::memory_order_relaxed);
+    }
+    // OSSleepThread uses the running OSThread, or the SDK default thread during
+    // early scheduler setup. Capture its identity before yielding so a late
+    // resolver result cannot wake a stale/reused stack queue after cancellation.
+    constexpr uint32_t kOSRunningContextAddr = 0x800000E4u;
+    constexpr uint32_t kDefaultThreadContextAddr = 0x80347498u;
+    uint32_t expectedThread = Memory::Read32(kOSRunningContextAddr);
+    if (expectedThread == 0) {
+        expectedThread = kDefaultThreadContextAddr;
+    }
+    if (!Memory::Contains(expectedThread + 0x2C8u, 0x20u) ||
+        !Memory::Contains(waitQueue, 16u)) {
+        return false;
+    }
+    route.kind = DeferredNetworkCompletionKind::SyncWaitQueue;
+    route.token = nextToken;
+    route.waitQueue = waitQueue;
+    route.expectedThread = expectedThread;
+    // ABA cookie: thread/stack addresses are reused after cancellation.
+    Memory::Write64(waitQueue + 8u, nextToken);
+    return true;
+}
+
+static void InitializeDeferredAsyncRoute(DeferredNetworkRoute& route, uint32_t callback,
+                                         uint32_t callbackArg) {
+    NoteDeferredNetworkSchedulerThread("submission");
+    route.kind = DeferredNetworkCompletionKind::AsyncCallback;
+    route.callback = callback;
+    route.callbackArg = callbackArg;
+}
+
+using DeferredStartOutcome = NetworkDeferredContract::StartOutcome;
+
+// Install a prepared operation on either completion route. The sync/async delta
+// is entirely in `initializeRoute`: the sync form allocates the token that
+// Network_HLE_TakeSyncResult later redeems, the async form leaves route.token at
+// zero, which StartPrepared documents as valid for a callback route.
+template <typename Work, typename InitializeRoute, typename Install>
+static DeferredStartOutcome StartDeferred(NetworkDeferredContract::Preparation<Work> prepared,
+                                          InitializeRoute&& initializeRoute, Install&& install) {
+    return NetworkDeferredContract::StartPrepared(
+        std::move(prepared),
+        [&initializeRoute, &install](Work work) -> std::optional<uint64_t> {
+            if (!EnsureSocketRuntime() || !initializeRoute(work.route)) {
+                return std::nullopt;
+            }
+            const uint64_t token = work.route.token;
+            if (!install(std::move(work))) {
+                return std::nullopt;
+            }
+            return token;
+        });
+}
+
+static bool DeferredConnectSocketIsStillValid(const DeferredConnectWork& work) {
+    return SocketIdentityIsCurrent(work.wiiFd, work.nativeFd, work.socketGeneration);
+}
+
+static bool InstallDeferredDns(DeferredDnsWork work) {
+    return LaunchDeferredDns(std::move(work));
+}
+
+static bool InstallDeferredPoll(DeferredPollWork work) {
+    GetDeferredNetworkStore().pendingPolls.push_back(std::move(work));
+    return true;
+}
+
+// A blocking connect issues the host connect() at submission time, because the
+// SDK's own retry loop depends on seeing the immediate outcome; only a genuinely
+// in-flight connect is parked for the completion pump to probe.
+static bool InstallDeferredConnect(DeferredConnectWork work) {
+    if (!DeferredConnectSocketIsStillValid(work)) {
+        work.initialResult = -SO_EBADF;
+    } else {
+        const int ret = connect(work.nativeFd, reinterpret_cast<sockaddr*>(&work.peerAddress),
+                                sizeof(work.peerAddress));
+        if (ret == 0) {
+            work.initialResult = 0;
+        } else {
+            const int nativeError = NormalizeConnectError(NativeLastError());
+            if (!IsWouldBlockError(nativeError)) {
+                const int32_t translated = TranslateSocketError(nativeError, false);
+                // Dolphin rewrites -SO_EISCONN to SO_SUCCESS here (IOS/Network/
+                // Socket.cpp:356-359): the SDK detects a completed blocking
+                // connect by re-issuing connect() on it, so reporting EISCONN
+                // as an error aborted session setup.
+                work.initialResult = translated == -SO_EISCONN ? 0 : translated;
+            }
+        }
+    }
+    GetDeferredNetworkStore().pendingConnects.push_back(std::move(work));
+    return true;
+}
+
+static auto SyncRoute(uint32_t waitQueue) {
+    return [waitQueue](DeferredNetworkRoute& route) {
+        return InitializeDeferredSyncRoute(route, waitQueue);
+    };
+}
+
+static auto AsyncRoute(uint32_t callback, uint32_t callbackArg) {
+    return [callback, callbackArg](DeferredNetworkRoute& route) {
+        InitializeDeferredAsyncRoute(route, callback, callbackArg);
+        return true;
+    };
+}
+
+static std::optional<int32_t> ScalarDeferredFailureResult(uint32_t fd, uint32_t cmd) {
+    if (!IsIpTopDevice(fd)) {
+        return std::nullopt;
+    }
+    switch (cmd) {
+    case IOCTL_SO_CONNECT:
+        return -SO_EINVAL;
+    case IOCTL_SO_POLL:
+        return -SO_EINVAL;
+    case IOCTL_SO_GETHOSTBYNAME:
+        return -1;
+    case IOCTL_SO_INETATON:
+        return 0;
+    default:
+        return std::nullopt;
+    }
+}
+
+// Guest-input marshalling faults must never escape into the IOS bridge. Note
+// that the two failure results are NOT the same for the ioctlv entry points: a
+// faulted descriptor array is a malformed request (-SO_EINVAL) while any other
+// failure is reported to the resolver's caller as a lookup miss.
+template <typename Body>
+static DeferredStartOutcome RunDeferredEntry(int32_t accessViolationResult,
+                                             int32_t exceptionResult, Body&& body) {
+    try {
+        return body();
+    } catch (const Memory::AccessViolation&) {
+        return DeferredStartOutcome::Immediate(accessViolationResult);
+    } catch (const std::bad_alloc&) {
+        return DeferredStartOutcome::Immediate(-SO_ENOMEM);
+    } catch (const std::exception&) {
+        return DeferredStartOutcome::Immediate(exceptionResult);
+    }
+}
+
+// SO_CONNECT, SO_POLL and the scalar DNS commands all arrive through ioctl and
+// are distinguished by which Prepare* claims them.
+template <typename InitializeRoute>
+static DeferredStartOutcome StartScalarDeferredIoctl(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen,
+    InitializeRoute initializeRoute) {
+    auto connect = PrepareDeferredConnect(fd, cmd, inBuf, inLen);
+    if (IsApplicable(connect)) {
+        return StartDeferred(std::move(connect), initializeRoute, InstallDeferredConnect);
+    }
+    auto poll = PrepareDeferredPoll(fd, cmd, inBuf, inLen, outBuf, outLen);
+    if (IsApplicable(poll)) {
+        return StartDeferred(std::move(poll), initializeRoute, InstallDeferredPoll);
+    }
+    return StartDeferred(PrepareDeferredScalarDns(fd, cmd, inBuf, inLen, outBuf, outLen),
+                         initializeRoute, InstallDeferredDns);
+}
+
+NetworkDeferredContract::StartOutcome Network_HLE_StartIoctlSync(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen,
+    uint32_t outBuf, uint32_t outLen, uint32_t waitQueue) {
+    const std::optional<int32_t> failureResult = ScalarDeferredFailureResult(fd, cmd);
+    if (!failureResult) {
+        return DeferredStartOutcome::NotApplicable();
+    }
+    return RunDeferredEntry(*failureResult, *failureResult, [&] {
+        return StartScalarDeferredIoctl(fd, cmd, inBuf, inLen, outBuf, outLen,
+                                        SyncRoute(waitQueue));
+    });
+}
+
+NetworkDeferredContract::StartOutcome Network_HLE_StartIoctlvSync(
+    uint32_t fd, uint32_t cmd, uint32_t numIn, uint32_t numOut,
+    uint32_t vectorPtr, uint32_t waitQueue) {
+    if (!IsIpTopCommand(fd, cmd, IOCTLV_SO_GETADDRINFO)) {
+        return DeferredStartOutcome::NotApplicable();
+    }
+    return RunDeferredEntry(-SO_EINVAL, SO_ERROR_HOST_NOT_FOUND, [&] {
+        return StartDeferred(PrepareDeferredGetAddrInfo(fd, cmd, numIn, numOut, vectorPtr),
+                             SyncRoute(waitQueue), InstallDeferredDns);
+    });
+}
+
+NetworkDeferredContract::StartOutcome Network_HLE_StartIoctlAsync(
+    uint32_t fd, uint32_t cmd, uint32_t inBuf, uint32_t inLen,
+    uint32_t outBuf, uint32_t outLen, uint32_t callback, uint32_t callbackArg) {
+    const std::optional<int32_t> failureResult = ScalarDeferredFailureResult(fd, cmd);
+    if (!failureResult) {
+        return DeferredStartOutcome::NotApplicable();
+    }
+    return RunDeferredEntry(*failureResult, *failureResult, [&] {
+        return StartScalarDeferredIoctl(fd, cmd, inBuf, inLen, outBuf, outLen,
+                                        AsyncRoute(callback, callbackArg));
+    });
+}
+
+NetworkDeferredContract::StartOutcome Network_HLE_StartIoctlvAsync(
+    uint32_t fd, uint32_t cmd, uint32_t numIn, uint32_t numOut,
+    uint32_t vectorPtr, uint32_t callback, uint32_t callbackArg) {
+    if (!IsIpTopCommand(fd, cmd, IOCTLV_SO_GETADDRINFO)) {
+        return DeferredStartOutcome::NotApplicable();
+    }
+    return RunDeferredEntry(-SO_EINVAL, SO_ERROR_HOST_NOT_FOUND, [&] {
+        return StartDeferred(PrepareDeferredGetAddrInfo(fd, cmd, numIn, numOut, vectorPtr),
+                             AsyncRoute(callback, callbackArg), InstallDeferredDns);
+    });
+}
+
+bool Network_HLE_TakeSyncResult(uint64_t token, int32_t* result) {
+    if (!token || !result) {
+        return false;
+    }
+    NoteDeferredNetworkSchedulerThread("result retrieval");
+    DeferredNetworkStore& store = GetDeferredNetworkStore();
+    std::lock_guard<std::mutex> lock(store.resultMutex);
+    const auto it = store.syncResults.find(token);
+    if (it == store.syncResults.end()) {
+        return false;
+    }
+    *result = it->second;
+    store.syncResults.erase(it);
+    return true;
+}
+
+static bool DeferredNetworkWaiterIsValid(const DeferredNetworkRoute& route) {
+    if (!route.waitQueue || !route.expectedThread ||
+        !Memory::Contains(route.waitQueue, 16u) ||
+        !Memory::Contains(route.expectedThread + 0x2C8u, 0x20u) ||
+        Fiber::GuestFiberManager::IsTerminated(route.expectedThread)) {
+        return false;
+    }
+
+    constexpr uint16_t kThreadStateWaiting = 4;
+    constexpr uint32_t kThreadStateOffset = 0x2C8u;
+    constexpr uint32_t kThreadQueueOffset = 0x2DCu;
+    constexpr uint32_t kThreadNextOffset = 0x2E0u;
+    constexpr uint32_t kThreadPrevOffset = 0x2E4u;
+    try {
+        return Memory::Read16(route.expectedThread + kThreadStateOffset) == kThreadStateWaiting &&
+               Memory::Read32(route.expectedThread + kThreadQueueOffset) == route.waitQueue &&
+               Memory::Read32(route.waitQueue) == route.expectedThread &&
+               Memory::Read32(route.waitQueue + 4u) == route.expectedThread &&
+               Memory::Read64(route.waitQueue + 8u) == route.token &&
+               Memory::Read32(route.expectedThread + kThreadNextOffset) == 0 &&
+               Memory::Read32(route.expectedThread + kThreadPrevOffset) == 0;
+    } catch (const Memory::AccessViolation&) {
+        return false;
+    }
+}
+
+static void DeliverDeferredNetworkResult(CpuContext* cpu, DeferredNetworkStore& store,
+                                         const DeferredNetworkRoute& route, int32_t result) {
+    if (route.kind == DeferredNetworkCompletionKind::SyncWaitQueue) {
+        {
+            std::lock_guard<std::mutex> lock(store.resultMutex);
+            const auto [it, inserted] = store.syncResults.emplace(route.token, result);
+            if (!inserted) {
+                RT_LOGF(RT_TAG_NET,
+                             "duplicate deferred network token %" PRIu64 "\n",
+                             route.token);
+                it->second = result;
+            }
+        }
+        // Output and result are committed before the waiter becomes READY.
+        OS_HLE_WakeupThreadNoReschedule(cpu, route.waitQueue);
+    } else {
+        // NandProcessPendingCallbacks runs immediately after this pump, on
+        // this same emulation/scheduler host thread.
+        NandQueueIosCallback(route.callback, result, route.callbackArg);
+    }
+}
+
+static std::optional<int32_t> ProbeDeferredPoll(
+    DeferredPollWork& work, NetworkPollContract::Timeout::TimePoint now) {
+    const int nativeResult = NetworkPollContract::ProbeNow(
+        work.descriptors, NetworkHle::CopiedPollSocketIsStillValid);
+    const int32_t result = nativeResult < 0 ? SocketResult(nativeResult, false) : nativeResult;
+    if (work.timeout.ShouldRemainPending(nativeResult, now)) {
+        return std::nullopt;
+    }
+    return result;
+}
+
+static int32_t ApplyDeferredPollCompletion(const DeferredPollWork& work, int32_t result) {
+    const size_t outputBytes = work.descriptors.size() * 12u;
+    if (!work.outAddress || outputBytes == 0 || outputBytes > work.outSize ||
+        !Memory::Contains(work.outAddress, outputBytes)) {
+        return -SO_EINVAL;
+    }
+    WritePollResults(work.outAddress, work.descriptors);
+    return result;
+}
+
+static std::optional<int32_t> ProbeDeferredConnect(
+    DeferredConnectWork& work, NetworkPollContract::Timeout::TimePoint now) {
+    if (work.initialResult) {
+        return *work.initialResult;
+    }
+
+    const bool identityIsCurrent = DeferredConnectSocketIsStillValid(work);
+    int pollResult = 0;
+    if (identityIsCurrent) {
+        pollResult = ProbeConnectSettled(work.nativeFd, 0);
+    }
+
+    using NetworkConnectContract::ProbeDisposition;
+    switch (NetworkConnectContract::ClassifyProbe(
+        identityIsCurrent, pollResult, work.timeout.IsExpired(now))) {
+    case ProbeDisposition::StaleSocket:
+        return -SO_EBADF;
+    case ProbeDisposition::PollError:
+        return TranslateSocketError(NativeLastError(), false);
+    case ProbeDisposition::TimedOut:
+        // Dolphin's blocking-connect timeout reports -SO_ENETUNREACH
+        // (IOS/Network/Socket.cpp:352-356). -SO_ETIMEDOUT is not reachable
+        // through its error table at all, so the SDK has no handler for it.
+        return -SO_ENETUNREACH;
+    case ProbeDisposition::Pending:
+        return std::nullopt;
+    case ProbeDisposition::SocketReady:
+        break;
+    }
+
+    return ClassifySettledConnect(work.nativeFd);
+}
+
+bool Network_HLE_ProcessCompletions(CpuContext* cpu) {
+    if (!cpu) {
+        return false;
+    }
+    NoteDeferredNetworkSchedulerThread("completion pump");
+
+    std::deque<DeferredDnsCompletion> ready;
+    DeferredNetworkStore& store = GetDeferredNetworkStore();
+    {
+        std::lock_guard<std::mutex> lock(store.completedMutex);
+        ready.swap(store.completed);
+    }
+    bool handledAny = false;
+
+    while (!ready.empty()) {
+        DeferredDnsCompletion completion = std::move(ready.front());
+        ready.pop_front();
+
+        const DeferredNetworkRoute& route = completion.work.route;
+        if (route.kind == DeferredNetworkCompletionKind::SyncWaitQueue &&
+            !DeferredNetworkWaiterIsValid(route)) {
+            continue;
+        }
+
+        int32_t result = completion.result;
+        if (result == 0) {
+            try {
+                result = ApplyDeferredDnsCompletion(completion);
+            } catch (const Memory::AccessViolation& error) {
+                const std::string_view reason = error.reason();
+                NetFail("dns %s '%s' result write faulted: %.*s -> wii=%d",
+                        DeferredDnsKindName(completion.work.kind), completion.work.node.c_str(),
+                        static_cast<int>(reason.size()), reason.data(), -SO_EINVAL);
+                result = -SO_EINVAL;
+            }
+        }
+        DeliverDeferredNetworkResult(cpu, store, route, result);
+        handledAny = true;
+    }
+
+    const auto now = NetworkPollContract::Timeout::Clock::now();
+    for (auto it = store.pendingPolls.begin(); it != store.pendingPolls.end();) {
+        DeferredPollWork& work = *it;
+        const DeferredNetworkRoute route = work.route;
+        if (route.kind == DeferredNetworkCompletionKind::SyncWaitQueue &&
+            !DeferredNetworkWaiterIsValid(route)) {
+            it = store.pendingPolls.erase(it);
+            continue;
+        }
+
+        const std::optional<int32_t> probedResult = ProbeDeferredPoll(work, now);
+        if (!probedResult) {
+            ++it;
+            continue;
+        }
+
+        int32_t result = *probedResult;
+        const size_t descriptorCount = work.descriptors.size();
+        try {
+            result = ApplyDeferredPollCompletion(work, result);
+        } catch (const Memory::AccessViolation& error) {
+            const std::string_view reason = error.reason();
+            NetFail("SO_POLL(wait) result write faulted for %llu descriptor(s): %.*s -> wii=%d",
+                    static_cast<unsigned long long>(descriptorCount),
+                    static_cast<int>(reason.size()), reason.data(), -SO_EINVAL);
+            result = -SO_EINVAL;
+        }
+        it = store.pendingPolls.erase(it);
+        DeliverDeferredNetworkResult(cpu, store, route, result);
+        handledAny = true;
+    }
+
+    for (auto it = store.pendingConnects.begin();
+         it != store.pendingConnects.end();) {
+        DeferredConnectWork& work = *it;
+        const DeferredNetworkRoute route = work.route;
+        if (route.kind == DeferredNetworkCompletionKind::SyncWaitQueue &&
+            !DeferredNetworkWaiterIsValid(route)) {
+            it = store.pendingConnects.erase(it);
+            continue;
+        }
+
+        const std::optional<int32_t> probedResult =
+            ProbeDeferredConnect(work, now);
+        if (!probedResult) {
+            ++it;
+            continue;
+        }
+
+        int32_t result = *probedResult;
+        if (result == 0) {
+            if (DeferredConnectSocketIsStillValid(work)) {
+                WiiSocket& socket = g_sockets[work.wiiFd];
+                socket.peerPort = ntohs(work.peerAddress.sin_port);
+                socket.peerAddr = work.peerAddress;
+                socket.hasPeerAddr = true;
+            } else {
+                result = -SO_EBADF;
+            }
+        }
+        g_lastSocketError = result;
+        // Every blocking connect settles here exactly once, whether it was
+        // resolved at submission, probed, timed out or aborted by a close - so
+        // this is the single place a failed WFC connect becomes visible.
+        if (result != 0) {
+            char peer[INET_ADDRSTRLEN]{};
+            inet_ntop(AF_INET, &work.peerAddress.sin_addr, peer, sizeof(peer));
+            NetFail("SO_CONNECT fd=%u -> %s:%u FAILED wii=%d", work.wiiFd,
+                    peer[0] ? peer : "0.0.0.0",
+                    static_cast<unsigned>(ntohs(work.peerAddress.sin_port)), result);
+        }
+        it = store.pendingConnects.erase(it);
+        DeliverDeferredNetworkResult(cpu, store, route, result);
+        handledAny = true;
+    }
+    return handledAny;
+}
diff --git a/runtime/src/hle/net/network_internal.h b/runtime/src/hle/net/network_internal.h
new file mode 100644
index 0000000..97c0608
--- /dev/null
+++ b/runtime/src/hle/net/network_internal.h
@@ -0,0 +1,269 @@
+#pragma once
+
+// Shared internals of the /dev/net HLE. Only entities used by more than one
+// network_*.cpp live here; everything else stays file-local.
+
+#include "hle/network_poll_contract.h"
+#include "hle/runtime_parse_helpers.h"
+#include "memory.h"
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <charconv>
+#include <cassert>
+#include <cctype>
+#include <ctime>
+#include <chrono>
+#include <cinttypes>
+#include <cstdarg>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <deque>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <new>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <thread>
+#include <unordered_map>
+#include <utility>
+#include <vector>
+
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#include <mstcpip.h>
+#include <iphlpapi.h>
+#define SECURITY_WIN32
+#include <security.h>
+#include <schannel.h>
+#ifndef SIO_UDP_CONNRESET
+#define SIO_UDP_CONNRESET _WSAIOW(IOC_VENDOR, 12)
+#endif
+#else
+#include <arpa/inet.h>
+#include <cerrno>
+#include <fcntl.h>
+#include <netdb.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <unistd.h>
+#endif
+
+namespace NetworkHle {
+
+enum class DeviceKind {
+    KdRequest,
+    KdTime,
+    NcdManage,
+    IpTop,
+    Ssl,
+};
+
+using IoVector = RuntimeHle::IoVector;
+
+// Upper bound on the descriptor count an Ioctlv may declare. Real IOS commands
+// use a handful of vectors; this only exists so a guest-supplied count cannot
+// drive an unbounded allocation or overflow the in/out split.
+inline constexpr uint64_t kMaxIoVectors = 32;
+
+// Ordinal positions of Dolphin's SO_E* table (IOS/Network/Socket.h). Load-bearing:
+// the guest SDK compares the negated value against its own copy, so an off-by-one
+// here silently turns "connection refused" into the wrong error on the guest.
+enum WiiSocketError {
+    SO_SUCCESS = 0,
+    SO_EACCES = 2,
+    SO_EADDRINUSE = 3,
+    SO_EAGAIN = 6,
+    SO_EALREADY = 7,
+    SO_EBADF = 8,
+    SO_ECONNABORTED = 13,
+    SO_ECONNREFUSED = 14,
+    SO_ECONNRESET = 15,
+    SO_EHOSTUNREACH = 23,
+    SO_EINPROGRESS = 26,
+    SO_EINVAL = 28,
+    SO_EISCONN = 30,
+    SO_EMFILE = 33,
+    SO_ENETRESET = 39,
+    SO_ENETUNREACH = 40,
+    SO_ENOBUFS = 42,
+    SO_ENOMEM = 49,
+    SO_ENOPROTOOPT = 51,
+    SO_ENOTCONN = 56,
+    SO_ENOTSOCK = 59,
+    SO_EPROTONOSUPPORT = 68,
+    SO_ETIMEDOUT = 76,
+    SO_ERROR_HOST_NOT_FOUND = -305,
+};
+
+constexpr int kWiiAfInet = 2;
+constexpr int kWiiAfInet6 = 23;
+constexpr int kWiiSockStream = 1;
+constexpr int kWiiSockDgram = 2;
+constexpr int kWiiSockRaw = 3;
+constexpr int kWiiSockRdm = 4;
+constexpr int kWiiSockSeqPacket = 5;
+constexpr int kWiiSocketMax = 24;
+
+#ifdef _WIN32
+using NativeSocket = SOCKET;
+constexpr NativeSocket kInvalidSocket = INVALID_SOCKET;
+#else
+using NativeSocket = int;
+constexpr NativeSocket kInvalidSocket = -1;
+#endif
+
+struct WiiSocket {
+    NativeSocket native = kInvalidSocket;
+    int af = AF_INET;
+    int type = SOCK_STREAM;
+    int protocol = 0;
+    bool nonblocking = false;
+    uint16_t peerPort = 0;
+    bool hasPeerAddr = false;
+    sockaddr_in peerAddr{};
+    std::vector<uint8_t> nasWriteBuffer;
+    uint64_t generation = 0;
+    // Failure-report one-shots: a failing send/recv repeats every retry, so only
+    // a change of error is reported. Reset with the rest of the struct when the
+    // fd is recycled, so a new socket reports its own failures again.
+    int32_t lastLoggedSendError = 0;
+    int32_t lastLoggedRecvError = 0;
+};
+
+extern std::array<WiiSocket, kWiiSocketMax> g_sockets;
+extern int32_t g_lastSocketError;
+
+// Dolphin's WiiSocket::CloseFd and WiiSocket::Shutdown resolve every operation
+// still queued on the socket at the moment it goes away instead of letting them
+// linger (IOS/Network/Socket.cpp:214-235 and 164-212). Defined below, next to
+// the deferred store it walks.
+void AbortPendingDeferredConnects(uint32_t wiiFd, int32_t result);
+
+enum class NasSslWriteAction {
+    PassThrough,
+    Buffered,
+    Ready,
+};
+
+enum NetIoctl {
+    IOCTL_SO_ACCEPT = 1,
+    IOCTL_SO_BIND = 2,
+    IOCTL_SO_CLOSE = 3,
+    IOCTL_SO_CONNECT = 4,
+    IOCTL_SO_FCNTL = 5,
+    IOCTL_SO_GETPEERNAME = 6,
+    IOCTL_SO_GETSOCKNAME = 7,
+    IOCTL_SO_GETSOCKOPT = 8,
+    IOCTL_SO_SETSOCKOPT = 9,
+    IOCTL_SO_LISTEN = 10,
+    IOCTL_SO_POLL = 11,
+    IOCTLV_SO_RECVFROM = 12,
+    IOCTLV_SO_SENDTO = 13,
+    IOCTL_SO_SHUTDOWN = 14,
+    IOCTL_SO_SOCKET = 15,
+    IOCTL_SO_GETHOSTID = 16,
+    IOCTL_SO_GETHOSTBYNAME = 17,
+    IOCTL_SO_GETLASTERROR = 20,
+    IOCTL_SO_INETATON = 21,
+    IOCTL_SO_INETPTON = 22,
+    IOCTL_SO_INETNTOP = 23,
+    IOCTLV_SO_GETADDRINFO = 24,
+    IOCTLV_SO_STARTUP = 26,
+    IOCTLV_SO_CLEANUP = 27,
+    IOCTLV_SO_GETINTERFACEOPT = 28,
+    IOCTLV_SO_SETINTERFACEOPT = 29,
+    IOCTL_SO_SETINTERFACE = 30,
+    IOCTL_SO_INITINTERFACE = 31,
+};
+
+// network_core.cpp
+bool RetroRewindProfileActive();
+const std::array<uint8_t, 6>& RuntimeMacAddress();
+uint64_t RuntimeGeneratedUserId();
+void ZeroMemoryRange(uint32_t addr, uint32_t size);
+void CopyToGuest(uint32_t addr, const void* data, uint32_t size);
+std::string ReadGuestString(uint32_t addr, uint32_t maxLen = 1024);
+std::string Lower(std::string_view text);
+bool StartsWith(std::string_view text, std::string_view prefix);
+std::vector<IoVector> ReadVectors(uint32_t vectorPtr, uint32_t count);
+bool WriteReturn(uint32_t outBuf, uint32_t outLen, int32_t value);
+bool WriteVectorReturn(const std::vector<IoVector>& out, size_t index, int32_t value);
+std::optional<DeviceKind> GetDeviceKind(uint32_t fd);
+// Always-on product logging, reserved for failures a player can act on: a
+// connect/auth/DNS/SSL failure or a socket error that aborts a connection.
+// Routine per-packet traffic must not be reported here. Host error codes are
+// captured before the call, because std::fprintf may clobber errno.
+void NetFail(const char* format, ...);
+bool EnsureSocketRuntime();
+int NativeLastError();
+int32_t TranslateSocketError(int err, bool isReadWrite = true);
+int NormalizeConnectError(int err);
+int32_t SocketResult(int ret, bool isReadWrite = true);
+int32_t SocketErrorResult(int nativeErr, bool isReadWrite = true);
+bool IsWouldBlockError(int err);
+int ProbeConnectSettled(NativeSocket socket, int timeoutMs);
+int32_t ClassifySettledConnect(NativeSocket socket);
+bool WaitForReadable(NativeSocket socket, int timeoutMs);
+void CloseNativeSocket(NativeSocket socket);
+void SetNonBlocking(NativeSocket socket, bool enabled);
+int32_t ReconnectWiiSocket(WiiSocket& socket, uint16_t port);
+int MapWiiAf(uint32_t af);
+int MapNativeAfToWii(int af);
+int MapWiiSocketType(uint32_t type);
+int MapWiiAddrInfoFamily(uint32_t family);
+int MapWiiAddrInfoSocketType(uint32_t type);
+uint32_t MapNativeSocketTypeToWii(int type);
+int32_t AddWiiSocket(NativeSocket native, int af, int type, int protocol);
+WiiSocket* GetWiiSocket(uint32_t fd);
+
+// A Wii fd alone does not identify a socket: the slot is recycled by SOSocket
+// after SOClose, so a copied descriptor must also match the host descriptor and
+// the generation counter it was captured with.
+bool SocketIdentityIsCurrent(uint32_t wiiFd, NativeSocket nativeFd, uint64_t generation);
+bool CopiedPollSocketIsStillValid(const NetworkPollContract::CopiedDescriptor& descriptor);
+
+// SO_POLL request marshalling, shared by the direct (timeout-zero) path in
+// network_socket.cpp and the scheduler-queued path in network_deferred.cpp.
+bool ValidatePollRequest(uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen,
+                         uint32_t& descriptorCount);
+std::vector<NetworkPollContract::CopiedDescriptor> CopyPollDescriptors(uint32_t outBuf,
+                                                                      uint32_t descriptorCount);
+void WritePollResults(uint32_t outAddress,
+                      const std::vector<NetworkPollContract::CopiedDescriptor>& descriptors);
+
+// network_socket.cpp
+void CleanupAllWiiSockets();
+sockaddr_in ReadWiiSockAddr(uint32_t addr);
+int32_t HandleIpTopIoctl(uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf,
+                         uint32_t outLen);
+int32_t HandleIpTopIoctlv(uint32_t cmd, const std::vector<IoVector>& in,
+                          const std::vector<IoVector>& out);
+
+// network_ssl.cpp
+void ClearSslSessionsForSocket(uint32_t fd);
+NasSslWriteAction PreparePlainNasTcpWrite(WiiSocket& socket, const uint8_t* data,
+                                         uint32_t size, std::vector<uint8_t>& patched);
+int32_t HandleSslIoctlv(uint32_t cmd, const std::vector<IoVector>& in,
+                        const std::vector<IoVector>& out);
+
+// network_config.cpp
+int32_t HandleKdTimeIoctl(uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf,
+                          uint32_t outLen);
+int32_t HandleKdIoctl(uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf,
+                      uint32_t outLen);
+int32_t HandleKdIoctlv(uint32_t cmd, const std::vector<IoVector>& in,
+                       const std::vector<IoVector>& out);
+int32_t HandleNcdIoctlv(uint32_t cmd, const std::vector<IoVector>& in,
+                        const std::vector<IoVector>& out);
+
+}  // namespace NetworkHle
diff --git a/runtime/src/hle/net/network_socket.cpp b/runtime/src/hle/net/network_socket.cpp
new file mode 100644
index 0000000..898942f
--- /dev/null
+++ b/runtime/src/hle/net/network_socket.cpp
@@ -0,0 +1,530 @@
+#include "network_internal.h"
+
+namespace NetworkHle {
+
+static int32_t NewWiiSocket(uint32_t af, uint32_t type, uint32_t protocol) {
+    if (!EnsureSocketRuntime()) {
+        return -SO_EINVAL;
+    }
+    const int nativeAf = MapWiiAf(af);
+    const int nativeType = MapWiiSocketType(type);
+    if (nativeAf < 0 || nativeType < 0) {
+        return -SO_EINVAL;
+    }
+    NativeSocket s = ::socket(nativeAf, nativeType, protocol);
+    const int hostError = s == kInvalidSocket ? NativeLastError() : 0;
+    const int32_t wiiFd = AddWiiSocket(s, nativeAf, nativeType, static_cast<int>(protocol));
+    if (wiiFd < 0) {
+        NetFail("SO_SOCKET af=%u type=%u proto=%u failed host=%d wii=%d", af, type, protocol,
+                hostError, wiiFd);
+    }
+    return wiiFd;
+}
+
+static int32_t DeleteWiiSocket(uint32_t fd) {
+    WiiSocket* s = GetWiiSocket(fd);
+    if (!s) {
+        return -SO_EBADF;
+    }
+    ClearSslSessionsForSocket(fd);
+    CloseNativeSocket(s->native);
+    *s = {};
+    s->native = kInvalidSocket;
+    // Dolphin fails everything still parked on the socket with -SO_ENOTCONN the
+    // moment the descriptor closes. Leaving a blocking connect to notice on its
+    // own kept the guest OSThread asleep until the next scheduler pump and then
+    // reported -SO_EBADF instead.
+    AbortPendingDeferredConnects(fd, -SO_ENOTCONN);
+    return 0;
+}
+
+// Dolphin: WiiSockMan::Clean (IOS/Network/Socket.h:278) destroys every WiiSocket,
+// which closes its host descriptor and fails its pending operations. Going
+// through DeleteWiiSocket keeps SSL sessions, buffered NAS writes and parked
+// connects from surviving the sockets they were bound to.
+void CleanupAllWiiSockets() {
+    for (uint32_t fd = 0; fd < static_cast<uint32_t>(kWiiSocketMax); ++fd) {
+        if (g_sockets[fd].native != kInvalidSocket) {
+            DeleteWiiSocket(fd);
+        }
+    }
+}
+
+struct WiiSockAddrIn {
+    uint8_t len = 8;
+    uint8_t family = kWiiAfInet;
+    uint16_t port = 0;
+    uint32_t addr = 0;
+};
+
+sockaddr_in ReadWiiSockAddr(uint32_t addr) {
+    sockaddr_in native{};
+    native.sin_family = AF_INET;
+    native.sin_port = htons(Memory::Read16(addr + 2));
+    native.sin_addr.s_addr = htonl(Memory::Read32(addr + 4));
+    return native;
+}
+
+static void WriteWiiSockAddr(uint32_t addr, const sockaddr_in& native, uint32_t len) {
+    if (!addr) {
+        return;
+    }
+    Memory::Write8(addr, static_cast<uint8_t>(std::min<uint32_t>(len, 8)));
+    Memory::Write8(addr + 1, kWiiAfInet);
+    Memory::Write16(addr + 2, ntohs(native.sin_port));
+    Memory::Write32(addr + 4, ntohl(native.sin_addr.s_addr));
+}
+
+static int MapSockOptLevel(uint32_t level) {
+    return level == 0xFFFF ? SOL_SOCKET : static_cast<int>(level);
+}
+
+static int MapSockOptName(uint32_t optname) {
+    switch (optname) {
+    case 0x4:
+        return SO_REUSEADDR;
+    case 0x80:
+        return SO_LINGER;
+    case 0x100:
+        return SO_OOBINLINE;
+    case 0x1001:
+        return SO_SNDBUF;
+    case 0x1002:
+        return SO_RCVBUF;
+    case 0x1008:
+        return SO_TYPE;
+    case 0x1009:
+        return SO_ERROR;
+    default:
+        return static_cast<int>(optname);
+    }
+}
+
+static in_addr ResolveDefaultInterfaceIp() {
+    in_addr fallback{};
+    fallback.s_addr = inet_addr("10.0.1.30");
+    if (!EnsureSocketRuntime()) {
+        return fallback;
+    }
+
+    NativeSocket s = ::socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
+    if (s == kInvalidSocket) {
+        return fallback;
+    }
+
+    sockaddr_in remote{};
+    remote.sin_family = AF_INET;
+    remote.sin_addr.s_addr = inet_addr("8.8.8.8");
+    remote.sin_port = htons(53);
+    connect(s, reinterpret_cast<const sockaddr*>(&remote), sizeof(remote));
+
+    sockaddr_in local{};
+    socklen_t len = sizeof(local);
+    if (getsockname(s, reinterpret_cast<sockaddr*>(&local), &len) != 0) {
+        CloseNativeSocket(s);
+        return fallback;
+    }
+    CloseNativeSocket(s);
+    return local.sin_addr;
+}
+
+static int32_t HandleInetAton(uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen) {
+    if (!inBuf || !outBuf || outLen < 4) {
+        return 0;
+    }
+    const std::string host = ReadGuestString(inBuf, inLen ? inLen : 256);
+    in_addr addr{};
+    if (inet_pton(AF_INET, host.c_str(), &addr) != 1) {
+        // Hostnames are resolved only through the deferred boundary. Numeric
+        // conversion is the sole direct path because inet_pton cannot block.
+        return 0;
+    }
+    Memory::Write32(outBuf, ntohl(addr.s_addr));
+    return 1;
+}
+
+static int32_t HandleInetPton(uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen) {
+    if (!inBuf || !outBuf || outLen < 8) {
+        return 0;
+    }
+    const std::string address = ReadGuestString(inBuf, inLen ? inLen : 256);
+    in_addr parsed{};
+    if (inet_pton(AF_INET, address.c_str(), &parsed) != 1) {
+        return 0;
+    }
+    Memory::Write32(outBuf + 4u, ntohl(parsed.s_addr));
+    return 1;
+}
+
+int32_t HandleIpTopIoctl(uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf, uint32_t outLen) {
+    switch (cmd) {
+    case IOCTL_SO_INITINTERFACE:
+    case IOCTL_SO_SETINTERFACE:
+        return 0;
+    case IOCTL_SO_SOCKET:
+        if (!inBuf || inLen < 12) return -SO_EINVAL;
+        return NewWiiSocket(Memory::Read32(inBuf), Memory::Read32(inBuf + 4), Memory::Read32(inBuf + 8));
+    case IOCTL_SO_CLOSE:
+        if (!inBuf || inLen < 4) return -SO_EINVAL;
+        return DeleteWiiSocket(Memory::Read32(inBuf));
+    case IOCTL_SO_BIND:
+    case IOCTL_SO_CONNECT: {
+        if (!inBuf || inLen < 16) return -SO_EINVAL;
+        const uint32_t requestFd = Memory::Read32(inBuf);
+        WiiSocket* s = GetWiiSocket(requestFd);
+        if (!s) {
+            return -SO_EBADF;
+        }
+        sockaddr_in addr = ReadWiiSockAddr(inBuf + 8);
+        const int ret = (cmd == IOCTL_SO_BIND)
+            ? bind(s->native, reinterpret_cast<sockaddr*>(&addr), sizeof(addr))
+            : connect(s->native, reinterpret_cast<sockaddr*>(&addr), sizeof(addr));
+        int32_t result = 0;
+        if (cmd == IOCTL_SO_CONNECT && ret < 0) {
+            // Nonblocking connects only (blocking ones go through
+            // Network_HLE_StartIoctl*). Dolphin passes the raw error through here
+            // (IOS/Network/Socket.cpp:344-346); the guest's connect loop needs to
+            // see SO_EINPROGRESS/SO_EALREADY/SO_EISCONN as distinct states.
+            result = SocketErrorResult(NormalizeConnectError(NativeLastError()), false);
+        } else {
+            result = SocketResult(ret, false);
+        }
+        if (cmd == IOCTL_SO_CONNECT && result == 0) {
+            s->peerPort = ntohs(addr.sin_port);
+            s->peerAddr = addr;
+            s->hasPeerAddr = true;
+        }
+        return result;
+    }
+    case IOCTL_SO_FCNTL: {
+        if (!inBuf || inLen < 12) return -SO_EINVAL;
+        WiiSocket* s = GetWiiSocket(Memory::Read32(inBuf));
+        if (!s) return -SO_EBADF;
+        const uint32_t op = Memory::Read32(inBuf + 4);
+        const uint32_t arg = Memory::Read32(inBuf + 8);
+        if (op == 3) {
+            return s->nonblocking ? 4 : 0;
+        }
+        if (op == 4) {
+            s->nonblocking = (arg & 4) != 0;
+            return 0;
+        }
+        return 0;
+    }
+    case IOCTL_SO_GETSOCKNAME:
+    case IOCTL_SO_GETPEERNAME: {
+        if (!inBuf || !outBuf || inLen < 4 || outLen < 8) return -SO_EINVAL;
+        WiiSocket* s = GetWiiSocket(Memory::Read32(inBuf));
+        if (!s) return -SO_EBADF;
+        sockaddr_in addr{};
+        socklen_t len = sizeof(addr);
+        const int ret = (cmd == IOCTL_SO_GETSOCKNAME)
+            ? getsockname(s->native, reinterpret_cast<sockaddr*>(&addr), &len)
+            : getpeername(s->native, reinterpret_cast<sockaddr*>(&addr), &len);
+        if (ret == 0) {
+            WriteWiiSockAddr(outBuf, addr, static_cast<uint32_t>(len));
+        }
+        return SocketResult(ret, false);
+    }
+    case IOCTL_SO_GETSOCKOPT: {
+        if (!outBuf || outLen < 0x14) return -SO_EINVAL;
+        WiiSocket* s = GetWiiSocket(Memory::Read32(outBuf));
+        if (!s) return -SO_EBADF;
+        const int level = MapSockOptLevel(Memory::Read32(outBuf + 4));
+        const int optname = MapSockOptName(Memory::Read32(outBuf + 8));
+        int value = 0;
+        socklen_t valueLen = sizeof(value);
+        const int ret = getsockopt(s->native, level, optname, reinterpret_cast<char*>(&value), &valueLen);
+        Memory::Write32(outBuf + 0x0C, static_cast<uint32_t>(valueLen));
+        Memory::Write32(outBuf + 0x10, static_cast<uint32_t>(value));
+        return SocketResult(ret, false);
+    }
+    case IOCTL_SO_SETSOCKOPT: {
+        if (!inBuf || inLen < 0x10) return -SO_EINVAL;
+        WiiSocket* s = GetWiiSocket(Memory::Read32(inBuf));
+        if (!s) return -SO_EBADF;
+        const int level = MapSockOptLevel(Memory::Read32(inBuf + 4));
+        const int optname = MapSockOptName(Memory::Read32(inBuf + 8));
+        const uint32_t optLen = std::min<uint32_t>(Memory::Read32(inBuf + 0x0C), inLen - 0x10);
+        const char* optVal = reinterpret_cast<const char*>(Memory::GetPointer(inBuf + 0x10, optLen));
+        return SocketResult(setsockopt(s->native, level, optname, optVal, static_cast<int>(optLen)), false);
+    }
+    case IOCTL_SO_LISTEN: {
+        if (!inBuf || inLen < 8) return -SO_EINVAL;
+        WiiSocket* s = GetWiiSocket(Memory::Read32(inBuf));
+        if (!s) {
+            return -SO_EBADF;
+        }
+        return SocketResult(listen(s->native, static_cast<int>(Memory::Read32(inBuf + 4))), false);
+    }
+    case IOCTL_SO_SHUTDOWN: {
+        // Dolphin: WiiSocket::Shutdown (IOS/Network/Socket.cpp:164-212).
+        if (!inBuf || inLen < 8) return -SO_EINVAL;
+        const uint32_t wiiFd = Memory::Read32(inBuf);
+        WiiSocket* s = GetWiiSocket(wiiFd);
+        if (!s) return -SO_EBADF;
+        const uint32_t how = Memory::Read32(inBuf + 4);
+        if (how > 2) {
+            return -SO_EINVAL;
+        }
+
+        int socketType = 0;
+        socklen_t socketTypeLen = sizeof(socketType);
+        if (getsockopt(s->native, SOL_SOCKET, SO_TYPE, reinterpret_cast<char*>(&socketType),
+                       &socketTypeLen) != 0 ||
+            (socketType != SOCK_STREAM && socketType != SOCK_DGRAM)) {
+            return -SO_EBADF;
+        }
+        if (socketType == SOCK_DGRAM) {
+            // The Wii does nothing and reports success for UDP. Passing this
+            // through to the host returned ENOTCONN for an unconnected datagram
+            // socket, which made the guest's teardown path bail out early and
+            // leak the descriptor.
+            return SO_SUCCESS;
+        }
+
+        const int32_t result = SocketResult(shutdown(s->native, static_cast<int>(how)), false);
+        if (how == 1 || how == 2) {
+            // Dolphin aborts a pending blocking connect with -SO_ENETUNREACH
+            // when the write half is shut down.
+            AbortPendingDeferredConnects(wiiFd, -SO_ENETUNREACH);
+        }
+        return result;
+    }
+    case IOCTL_SO_POLL: {
+        uint32_t descriptorCount = 0;
+        if (!ValidatePollRequest(inBuf, inLen, outBuf, outLen, descriptorCount)) {
+            return -SO_EINVAL;
+        }
+
+        // Zero-timeout readiness probes intentionally take this direct path.
+        // ProbeNow always passes timeout zero to the host API, so this cannot
+        // stall the emulation thread. Finite and infinite waits are copied and
+        // serviced by the scheduler queue instead.
+        std::vector<NetworkPollContract::CopiedDescriptor> descriptors =
+            CopyPollDescriptors(outBuf, descriptorCount);
+        const int nativeResult =
+            NetworkPollContract::ProbeNow(descriptors, CopiedPollSocketIsStillValid);
+        const int32_t result = nativeResult < 0 ? SocketResult(nativeResult, false) : nativeResult;
+        WritePollResults(outBuf, descriptors);
+        return result;
+    }
+    case IOCTL_SO_GETHOSTID:
+        return static_cast<int32_t>(ntohl(ResolveDefaultInterfaceIp().s_addr));
+    case IOCTL_SO_GETHOSTBYNAME:
+        // Valid hostname lookups are installed through the deferred boundary.
+        // This defensive path handles only a malformed/unroutable entry call and
+        // must never invoke the host resolver on the guest scheduler thread.
+        NetFail("SO_GETHOSTBYNAME took the direct path (deferred boundary bypassed); "
+                "name resolution failed");
+        return -1;
+    case IOCTL_SO_GETLASTERROR:
+        return g_lastSocketError;
+    case IOCTL_SO_INETATON:
+        return HandleInetAton(inBuf, inLen, outBuf, outLen);
+    case IOCTL_SO_INETPTON:
+        return HandleInetPton(inBuf, inLen, outBuf, outLen);
+    case IOCTL_SO_INETNTOP: {
+        if (!inBuf || !outBuf || inLen < 12) return -SO_EINVAL;
+        char text[32]{};
+        std::snprintf(text, sizeof(text), "%u.%u.%u.%u", Memory::Read8(inBuf + 8), Memory::Read8(inBuf + 9),
+                      Memory::Read8(inBuf + 10), Memory::Read8(inBuf + 11));
+        const uint32_t size = std::min<uint32_t>(outLen ? outLen - 1 : 0, static_cast<uint32_t>(std::strlen(text)));
+        CopyToGuest(outBuf, text, size);
+        Memory::Write8(outBuf + size, 0);
+        return 0;
+    }
+    default:
+        // SO_ACCEPT (cmd 1) has no handler and lands here too.
+        return -SO_EINVAL;
+    }
+}
+
+static int32_t HandleGetInterfaceOpt(const std::vector<IoVector>& in, const std::vector<IoVector>& out) {
+    if (in.empty() || out.empty() || in[0].size < 8) {
+        return -SO_EINVAL;
+    }
+    const uint32_t param = Memory::Read32(in[0].address);
+    const uint32_t opt = Memory::Read32(in[0].address + 4);
+    uint32_t offset = 0;
+    if (!out.empty() && out[0].size >= 8) {
+        offset = Memory::Read32(out[0].address + 4);
+    }
+
+    switch (opt) {
+    case 0xb003:
+        Memory::Write32(out[0].address, 0x08080808);
+        if (out[0].size >= 8) {
+            Memory::Write32(out[0].address + 4, 0x08080404);
+        }
+        return 0;
+    case 0x1003:
+        Memory::Write32(out[0].address, 0);
+        return 0;
+    case 0x1004: {
+        const std::array<uint8_t, 6>& mac = RuntimeMacAddress();
+        CopyToGuest(out[0].address, mac.data(), std::min<uint32_t>(out[0].size, mac.size()));
+        return 0;
+    }
+    case 0x1005:
+        Memory::Write32(out[0].address, 1);
+        return 0;
+    case 0x3001:
+        Memory::Write32(out[0].address, 0x10);
+        return 0;
+    case 0x4002:
+        Memory::Write32(out[0].address, 1);
+        return 0;
+    case 0x4003: {
+        if (out.size() > 1 && out[1].address) {
+            Memory::Write32(out[1].address, 0x0C);
+        }
+        const uint32_t hostOrderIp = ntohl(ResolveDefaultInterfaceIp().s_addr);
+        Memory::Write32(out[0].address, hostOrderIp);
+        if (out[0].size >= 12) {
+            Memory::Write32(out[0].address + 4, 0xFFFFFF00);
+            Memory::Write32(out[0].address + 8, (hostOrderIp & 0xFFFFFF00) | 0xFF);
+        }
+        return 0;
+    }
+    case 0x4005:
+        Memory::Write32(out[0].address, 0x20);
+        return 0;
+    case 0x4006:
+        if (out[0].size >= offset + 24) {
+            Memory::Write32(out[0].address + offset, 0);
+            Memory::Write32(out[0].address + offset + 4, 0);
+            Memory::Write32(out[0].address + offset + 8, 0);
+            Memory::Write32(out[0].address + offset + 12, 1);
+            Memory::Write64(out[0].address + offset + 16, 0);
+            offset += 24;
+        }
+        if (out.size() > 1 && out[1].address) {
+            Memory::Write32(out[1].address, offset);
+        }
+        return 0;
+    case 0x6003:
+    case 0x600a:
+    case 0x600c:
+        Memory::Write32(out[0].address, 0x80);
+        return 0;
+    case 0xb002:
+        Memory::Write32(out[0].address, 2);
+        return 0;
+    default:
+        Memory::Write32(out[0].address, 0);
+        return 0;
+    }
+}
+
+int32_t HandleIpTopIoctlv(uint32_t cmd, const std::vector<IoVector>& in, const std::vector<IoVector>& out) {
+    switch (cmd) {
+    case IOCTLV_SO_STARTUP:
+        EnsureSocketRuntime();
+        return 0;
+    case IOCTLV_SO_CLEANUP:
+        CleanupAllWiiSockets();
+        return 0;
+    case IOCTLV_SO_GETINTERFACEOPT:
+        return HandleGetInterfaceOpt(in, out);
+    case IOCTLV_SO_SETINTERFACEOPT:
+        return 0;
+    case IOCTLV_SO_GETADDRINFO:
+        // As with SO_GETHOSTBYNAME: resolution belongs to the deferred boundary.
+        NetFail("SO_GETADDRINFO took the direct path (deferred boundary bypassed); "
+                "name resolution failed");
+        return SO_ERROR_HOST_NOT_FOUND;
+    case IOCTLV_SO_SENDTO: {
+        if (in.size() < 2) return -SO_EINVAL;
+        const uint32_t fd = Memory::Read32(in[1].address);
+        WiiSocket* s = GetWiiSocket(fd);
+        if (!s) return -SO_EBADF;
+        // Dolphin: "send/sendto only handles MSG_OOB" - flags &= SO_MSG_OOB
+        // (IOS/Network/Socket.cpp:606-607). SO_MSG_PEEK (0x02) is a receive-only
+        // flag; forwarding it to sendto() makes Winsock reject the whole call.
+        uint32_t flags = Memory::Read32(in[1].address + 4) & 0x01;
+        const uint32_t hasDest = Memory::Read32(in[1].address + 8);
+        sockaddr_in dest{};
+        sockaddr* destPtr = nullptr;
+        socklen_t destLen = 0;
+        if (hasDest) {
+            dest = ReadWiiSockAddr(in[1].address + 0x0C);
+            destPtr = reinterpret_cast<sockaddr*>(&dest);
+            destLen = sizeof(dest);
+        }
+        const auto* data = Memory::GetPointer(in[0].address, in[0].size);
+        std::vector<uint8_t> patched;
+        const NasSslWriteAction nasAction = !destPtr
+            ? PreparePlainNasTcpWrite(*s, data, in[0].size, patched)
+            : NasSslWriteAction::PassThrough;
+        if (nasAction == NasSslWriteAction::Buffered) {
+            return static_cast<int32_t>(in[0].size);
+        }
+
+        const bool patchedWrite = nasAction == NasSslWriteAction::Ready;
+        const uint8_t* sendData = patchedWrite ? patched.data() : data;
+        const uint32_t sendSize = patchedWrite ? static_cast<uint32_t>(patched.size()) : in[0].size;
+        const int ret = sendto(s->native, reinterpret_cast<const char*>(sendData), static_cast<int>(sendSize),
+                               static_cast<int>(flags), destPtr, destLen);
+        const int hostError = ret < 0 ? NativeLastError() : 0;
+        int32_t result = SocketResult(ret);
+        if (patchedWrite && ret == static_cast<int>(sendSize)) {
+            result = static_cast<int32_t>(in[0].size);
+        }
+        // A blocked send is routine; anything else aborts the connection, and
+        // the SDK retries it, so only a change of error is reported.
+        if (ret < 0 && result != -SO_EAGAIN && result != s->lastLoggedSendError) {
+            s->lastLoggedSendError = result;
+            NetFail("send failed fd=%u size=%u host=%d wii=%d", fd, sendSize, hostError, result);
+        }
+        return result;
+    }
+    case IOCTLV_SO_RECVFROM: {
+        if (in.empty() || out.empty()) return -SO_EINVAL;
+        const uint32_t fd = Memory::Read32(in[0].address);
+        WiiSocket* s = GetWiiSocket(fd);
+        if (!s) return -SO_EBADF;
+        const uint32_t rawFlags = Memory::Read32(in[0].address + 4);
+        uint32_t flags = rawFlags & 0x03;
+        const bool forceNonBlock = (rawFlags & 0x04u) != 0;
+        char* data = reinterpret_cast<char*>(Memory::GetPointer(out[0].address, out[0].size));
+        sockaddr_in from{};
+        socklen_t fromLen = sizeof(from);
+        sockaddr* fromPtr = out.size() > 1 && out[1].address && out[1].size >= 8 ? reinterpret_cast<sockaddr*>(&from) : nullptr;
+        int ret = 0;
+
+        ret = recvfrom(s->native, data, static_cast<int>(out[0].size), static_cast<int>(flags), fromPtr,
+                       fromPtr ? &fromLen : nullptr);
+        int nativeErr = ret < 0 ? NativeLastError() : 0;
+        // Nonblocking sockets get -SO_EAGAIN immediately (Dolphin's retry predicate
+        // short-circuits on nonBlock/forceNonBlock, IOS/Network/Socket.cpp:715-718);
+        // waiting here anyway stalled the whole emulation thread on every empty read.
+        constexpr int kStreamRecvWaitMs = 250;
+        const int streamWaitMs = (forceNonBlock || s->nonblocking) ? 0 : kStreamRecvWaitMs;
+        const bool waited = ret < 0 && !fromPtr && s->type == SOCK_STREAM &&
+            IsWouldBlockError(nativeErr) && WaitForReadable(s->native, streamWaitMs);
+        if (waited) {
+            ret = recvfrom(s->native, data, static_cast<int>(out[0].size), static_cast<int>(flags), nullptr,
+                           nullptr);
+            // WaitForReadable also returns true for POLLERR/POLLHUP, so the retry
+            // is where a reset connection surfaces; the first call's would-block
+            // error must not be reused or the guest retries that socket forever.
+            nativeErr = ret < 0 ? NativeLastError() : 0;
+        }
+
+        if (ret >= 0 && fromPtr) {
+            WriteWiiSockAddr(out[1].address, from, static_cast<uint32_t>(fromLen));
+        }
+        const int32_t result = ret >= 0 ? SocketResult(ret) : SocketErrorResult(nativeErr);
+        if (ret < 0 && result != -SO_EAGAIN && result != s->lastLoggedRecvError) {
+            s->lastLoggedRecvError = result;
+            NetFail("recv failed fd=%u host=%d wii=%d", fd, nativeErr, result);
+        }
+        return result;
+    }
+    default:
+        return -SO_EINVAL;
+    }
+}
+
+}  // namespace NetworkHle
diff --git a/runtime/src/hle/net/network_ssl.cpp b/runtime/src/hle/net/network_ssl.cpp
new file mode 100644
index 0000000..d0bb9ac
--- /dev/null
+++ b/runtime/src/hle/net/network_ssl.cpp
@@ -0,0 +1,733 @@
+#include "network_internal.h"
+
+namespace NetworkHle {
+
+enum SslError {
+    SSL_OK = 0,
+    SSL_ERR_FAILED = -1,
+    SSL_ERR_RAGAIN = -2,
+    SSL_ERR_WAGAIN = -3,
+    SSL_ERR_SYSCALL = -5,
+    SSL_ERR_ZERO = -6,
+    SSL_ERR_ID = -8,
+    SSL_ERR_VCOMMONNAME = -9,
+};
+
+enum SslIoctlv {
+    IOCTLV_NET_SSL_NEW = 0x01,
+    IOCTLV_NET_SSL_CONNECT = 0x02,
+    IOCTLV_NET_SSL_DOHANDSHAKE = 0x03,
+    IOCTLV_NET_SSL_READ = 0x04,
+    IOCTLV_NET_SSL_WRITE = 0x05,
+    IOCTLV_NET_SSL_SHUTDOWN = 0x06,
+    IOCTLV_NET_SSL_SETCLIENTCERT = 0x07,
+    IOCTLV_NET_SSL_SETCLIENTCERTDEFAULT = 0x08,
+    IOCTLV_NET_SSL_REMOVECLIENTCERT = 0x09,
+    IOCTLV_NET_SSL_SETROOTCA = 0x0A,
+    IOCTLV_NET_SSL_SETROOTCADEFAULT = 0x0B,
+    IOCTLV_NET_SSL_DOHANDSHAKEEX = 0x0C,
+    IOCTLV_NET_SSL_SETBUILTINROOTCA = 0x0D,
+    IOCTLV_NET_SSL_SETBUILTINCLIENTCERT = 0x0E,
+    IOCTLV_NET_SSL_DISABLEVERIFYOPTIONFORDEBUG = 0x0F,
+    IOCTLV_NET_SSL_DEBUGGETVERSION = 0x14,
+    IOCTLV_NET_SSL_DEBUGGETTIME = 0x15,
+};
+
+constexpr int kMaxSslSessions = 4;
+
+struct SslSession {
+    bool active = false;
+    bool handshaked = false;
+    bool plaintextWfc = false;
+    uint32_t socketFd = UINT32_MAX;
+    NativeSocket native = kInvalidSocket;
+    std::string hostname;
+    std::vector<uint8_t> nasWriteBuffer;
+    std::vector<uint8_t> decrypted;
+    std::vector<uint8_t> encryptedExtra;
+    // Failure-report one-shots; cleared with the session by ClearSslSession. The
+    // handshake re-runs on every read/write, so a failing one repeats forever.
+    bool loggedHandshakeFail = false;
+    int32_t lastLoggedReadError = 0;
+    int32_t lastLoggedWriteError = 0;
+#ifdef _WIN32
+    bool haveCred = false;
+    bool haveContext = false;
+    CredHandle cred{};
+    CtxtHandle context{};
+    SecPkgContext_StreamSizes sizes{};
+#endif
+};
+
+static std::array<SslSession, kMaxSslSessions> g_sslSessions;
+
+// Logging wrapper around the platform handshake implementation; see below.
+static int32_t SslHandshake(SslSession& ssl);
+
+static bool IsRetroNasSslHost(std::string_view hostname) {
+    if (!RetroRewindProfileActive()) {
+        return false;
+    }
+    const std::string lowered = Lower(hostname);
+    return StartsWith(lowered, "nas.") || StartsWith(lowered, "naswii.");
+}
+
+static bool IsRetroPlaintextSslHost(std::string_view hostname) {
+    if (IsRetroNasSslHost(hostname)) {
+        return true;
+    }
+    if (!RetroRewindProfileActive()) {
+        return false;
+    }
+
+    const std::string lowered = Lower(hostname);
+    return StartsWith(lowered, "sake.gs.") ||
+           lowered.find(".sake.gs.") != std::string::npos ||
+           StartsWith(lowered, "gamestats.gs.") ||
+           lowered.find(".gamestats.gs.") != std::string::npos ||
+           StartsWith(lowered, "gamestats2.gs.") ||
+           lowered.find(".gamestats2.gs.") != std::string::npos ||
+           StartsWith(lowered, "race.gs.") ||
+           lowered.find(".race.gs.") != std::string::npos;
+}
+
+static std::optional<size_t> ParseHttpContentLength(std::string_view headers) {
+    std::optional<size_t> parsedLength;
+    size_t lineStart = 0;
+    while (lineStart <= headers.size()) {
+        const size_t lineEnd = headers.find("\r\n", lineStart);
+        const std::string_view line = headers.substr(
+            lineStart, lineEnd == std::string_view::npos ? headers.size() - lineStart : lineEnd - lineStart);
+        const size_t colon = line.find(':');
+        if (colon != std::string_view::npos && Lower(line.substr(0, colon)) == "content-length") {
+            size_t valueStart = colon + 1;
+            while (valueStart < line.size() && (line[valueStart] == ' ' || line[valueStart] == '\t')) {
+                ++valueStart;
+            }
+            size_t valueEnd = line.size();
+            while (valueEnd > valueStart && (line[valueEnd - 1] == ' ' || line[valueEnd - 1] == '\t')) {
+                --valueEnd;
+            }
+            size_t value = 0;
+            const auto [end, error] = std::from_chars(
+                line.data() + valueStart, line.data() + valueEnd, value, 10);
+            if (error != std::errc{} || end != line.data() + valueEnd ||
+                (parsedLength && *parsedLength != value)) {
+                return std::nullopt;
+            }
+            parsedLength = value;
+        }
+        if (lineEnd == std::string_view::npos) {
+            break;
+        }
+        lineStart = lineEnd + 2;
+    }
+    return parsedLength;
+}
+
+// The Retro-WFC server rejects a NAS "POST /ac" auth body split across TCP
+// segments, so buffer guest chunks until Content-Length is satisfied, then
+// flush as one write. Flush at 16 KiB if it never terminates, and immediately
+// if Content-Length can't be parsed.
+static NasSslWriteAction AccumulateNasRequest(std::vector<uint8_t>& buffer, const uint8_t* data,
+                                              uint32_t size, std::vector<uint8_t>& patched) {
+    buffer.insert(buffer.end(), data, data + size);
+    if (buffer.size() > 16 * 1024) {
+        patched.swap(buffer);
+        buffer.clear();
+        return NasSslWriteAction::Ready;
+    }
+
+    const std::string accumulated(reinterpret_cast<const char*>(buffer.data()), buffer.size());
+    const size_t headerEnd = accumulated.find("\r\n\r\n");
+    if (headerEnd == std::string::npos) {
+        return NasSslWriteAction::Buffered;
+    }
+
+    const std::optional<size_t> contentLength =
+        ParseHttpContentLength(std::string_view(accumulated).substr(0, headerEnd));
+    if (!contentLength) {
+        patched.swap(buffer);
+        buffer.clear();
+        return NasSslWriteAction::Ready;
+    }
+
+    const size_t requestSize = headerEnd + 4 + *contentLength;
+    if (accumulated.size() < requestSize) {
+        return NasSslWriteAction::Buffered;
+    }
+
+    patched.assign(buffer.begin(), buffer.begin() + requestSize);
+    if (accumulated.size() > requestSize) {
+        patched.insert(patched.end(), buffer.begin() + requestSize, buffer.end());
+    }
+    buffer.clear();
+    return NasSslWriteAction::Ready;
+}
+
+static bool StartsNasAuthRequest(const uint8_t* data, uint32_t size) {
+    return size >= 9 && std::memcmp(data, "POST /ac ", 9) == 0;
+}
+
+// SSL route: the session carries the hostname the guest asked for, so the NAS
+// host is identified by name. Deliberately not IsRetroNasSslHost - the SSL write
+// path re-assembles NAS auth regardless of which profile is active.
+static NasSslWriteAction PrepareNasSslWrite(SslSession& ssl, const uint8_t* data, uint32_t size,
+                                            std::vector<uint8_t>& patched) {
+    if (!data || size == 0) {
+        return NasSslWriteAction::PassThrough;
+    }
+    const std::string loweredHost = Lower(ssl.hostname);
+    const bool isNasHost = StartsWith(loweredHost, "nas.") || StartsWith(loweredHost, "naswii.");
+    if (!isNasHost || (!StartsNasAuthRequest(data, size) && ssl.nasWriteBuffer.empty())) {
+        return NasSslWriteAction::PassThrough;
+    }
+    return AccumulateNasRequest(ssl.nasWriteBuffer, data, size, patched);
+}
+
+// Plain-TCP route: a rerouted 443->80 NAS connection has no hostname on the
+// socket, so the peer port and the stream type are what identify it.
+NasSslWriteAction PreparePlainNasTcpWrite(WiiSocket& socket, const uint8_t* data, uint32_t size,
+                                                 std::vector<uint8_t>& patched) {
+    if (!data || size == 0 || socket.type != SOCK_STREAM || socket.peerPort != 80) {
+        return NasSslWriteAction::PassThrough;
+    }
+    if (!StartsNasAuthRequest(data, size) && socket.nasWriteBuffer.empty()) {
+        return NasSslWriteAction::PassThrough;
+    }
+    return AccumulateNasRequest(socket.nasWriteBuffer, data, size, patched);
+}
+
+static bool WriteSslReturn(const std::vector<IoVector>& in, int32_t value) {
+    if (in.empty() || !in[0].address || in[0].size < 4) {
+        return false;
+    }
+    Memory::Write32(in[0].address, static_cast<uint32_t>(value));
+    return true;
+}
+
+static int ReadSslId(const std::vector<IoVector>& out) {
+    if (out.empty() || !out[0].address || out[0].size < 4) {
+        return -1;
+    }
+    return static_cast<int>(Memory::Read32(out[0].address)) - 1;
+}
+
+static bool IsSslIdValid(int id) {
+    return id >= 0 && id < kMaxSslSessions && g_sslSessions[id].active;
+}
+
+#ifdef _WIN32
+static bool IsSecuritySuccess(SECURITY_STATUS status) {
+    return status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED || status == SEC_I_INCOMPLETE_CREDENTIALS;
+}
+
+static bool SendAll(NativeSocket socket, const uint8_t* data, size_t size) {
+    size_t offset = 0;
+    while (offset < size) {
+        const int chunk = static_cast<int>(std::min<size_t>(size - offset, 64 * 1024));
+        const int ret = send(socket, reinterpret_cast<const char*>(data + offset), chunk, 0);
+        if (ret <= 0) {
+            // Reported by the SSL_WRITE / handshake caller as SSL_ERR_SYSCALL.
+            return false;
+        }
+        offset += static_cast<size_t>(ret);
+    }
+    return true;
+}
+
+static int RecvBlocking(NativeSocket socket, std::vector<uint8_t>& buffer) {
+    std::array<uint8_t, 16 * 1024> temp{};
+    const int ret = recv(socket, reinterpret_cast<char*>(temp.data()), static_cast<int>(temp.size()), 0);
+    if (ret > 0) {
+        buffer.insert(buffer.end(), temp.begin(), temp.begin() + ret);
+    }
+    return ret;
+}
+
+static void KeepExtraBuffer(std::vector<uint8_t>& dest, const SecBuffer& buffer) {
+    dest.clear();
+    if (buffer.BufferType == SECBUFFER_EXTRA && buffer.pvBuffer && buffer.cbBuffer) {
+        const auto* begin = static_cast<const uint8_t*>(buffer.pvBuffer);
+        dest.assign(begin, begin + buffer.cbBuffer);
+    }
+}
+
+static void ClearSslSession(SslSession& ssl) {
+    if (ssl.haveContext) {
+        DeleteSecurityContext(&ssl.context);
+    }
+    if (ssl.haveCred) {
+        FreeCredentialsHandle(&ssl.cred);
+    }
+    ssl = {};
+}
+
+static int32_t EnsureSslCredentials(SslSession& ssl) {
+    if (ssl.haveCred) {
+        return SSL_OK;
+    }
+
+    SCHANNEL_CRED cred{};
+    cred.dwVersion = SCHANNEL_CRED_VERSION;
+    cred.dwFlags = SCH_USE_STRONG_CRYPTO | SCH_CRED_NO_DEFAULT_CREDS | SCH_CRED_MANUAL_CRED_VALIDATION;
+
+    TimeStamp expiry{};
+    const SECURITY_STATUS status = AcquireCredentialsHandleA(
+        nullptr, const_cast<LPSTR>(UNISP_NAME_A), SECPKG_CRED_OUTBOUND, nullptr, &cred, nullptr, nullptr,
+        &ssl.cred, &expiry);
+    if (status != SEC_E_OK) {
+        return SSL_ERR_FAILED;
+    }
+    ssl.haveCred = true;
+    return SSL_OK;
+}
+
+static int32_t SslHandshakeImpl(SslSession& ssl) {
+    if (ssl.plaintextWfc) {
+        ssl.handshaked = true;
+        return SSL_OK;
+    }
+
+    const int32_t credRet = EnsureSslCredentials(ssl);
+    if (credRet != SSL_OK) {
+        return credRet;
+    }
+    if (ssl.native == kInvalidSocket) {
+        return SSL_ERR_SYSCALL;
+    }
+    if (ssl.handshaked) {
+        return SSL_OK;
+    }
+
+    DWORD attrs = 0;
+    TimeStamp expiry{};
+    std::vector<uint8_t> incoming = std::move(ssl.encryptedExtra);
+    ssl.encryptedExtra.clear();
+    constexpr DWORD flags = ISC_REQ_SEQUENCE_DETECT | ISC_REQ_REPLAY_DETECT | ISC_REQ_CONFIDENTIALITY |
+                            ISC_REQ_ALLOCATE_MEMORY | ISC_REQ_STREAM | ISC_REQ_EXTENDED_ERROR;
+
+    for (int step = 0; step < 128; ++step) {
+        SecBuffer outBuffer{};
+        outBuffer.BufferType = SECBUFFER_TOKEN;
+        SecBufferDesc outDesc{};
+        outDesc.ulVersion = SECBUFFER_VERSION;
+        outDesc.cBuffers = 1;
+        outDesc.pBuffers = &outBuffer;
+
+        SecBuffer inBuffers[2]{};
+        SecBufferDesc inDesc{};
+        SecBufferDesc* inDescPtr = nullptr;
+        if (!incoming.empty()) {
+            inBuffers[0].BufferType = SECBUFFER_TOKEN;
+            inBuffers[0].pvBuffer = incoming.data();
+            inBuffers[0].cbBuffer = static_cast<unsigned long>(incoming.size());
+            inBuffers[1].BufferType = SECBUFFER_EMPTY;
+            inDesc.ulVersion = SECBUFFER_VERSION;
+            inDesc.cBuffers = 2;
+            inDesc.pBuffers = inBuffers;
+            inDescPtr = &inDesc;
+        }
+
+        const SECURITY_STATUS status = InitializeSecurityContextA(
+            &ssl.cred, ssl.haveContext ? &ssl.context : nullptr,
+            ssl.hostname.empty() ? nullptr : const_cast<char*>(ssl.hostname.c_str()), flags, 0, SECURITY_NATIVE_DREP,
+            inDescPtr, 0, &ssl.context, &outDesc, &attrs, &expiry);
+        if (status != SEC_E_INVALID_HANDLE) {
+            ssl.haveContext = true;
+        }
+
+        if (outBuffer.pvBuffer && outBuffer.cbBuffer) {
+            const bool sent = SendAll(ssl.native, static_cast<const uint8_t*>(outBuffer.pvBuffer), outBuffer.cbBuffer);
+            FreeContextBuffer(outBuffer.pvBuffer);
+            if (!sent) {
+                return SSL_ERR_SYSCALL;
+            }
+        }
+
+        if (status == SEC_E_OK) {
+            if (inDescPtr) {
+                KeepExtraBuffer(ssl.encryptedExtra, inBuffers[1]);
+            }
+            const SECURITY_STATUS sizeStatus =
+                QueryContextAttributesA(&ssl.context, SECPKG_ATTR_STREAM_SIZES, &ssl.sizes);
+            if (sizeStatus != SEC_E_OK) {
+                return SSL_ERR_FAILED;
+            }
+            ssl.handshaked = true;
+            return SSL_OK;
+        }
+
+        if (status == SEC_E_INCOMPLETE_MESSAGE) {
+            const int ret = RecvBlocking(ssl.native, incoming);
+            if (ret == 0) {
+                return SSL_ERR_ZERO;
+            }
+            if (ret < 0) {
+                return SSL_ERR_RAGAIN;
+            }
+            continue;
+        }
+
+        if (status == SEC_I_CONTINUE_NEEDED || status == SEC_I_INCOMPLETE_CREDENTIALS) {
+            std::vector<uint8_t> extra;
+            if (inDescPtr) {
+                KeepExtraBuffer(extra, inBuffers[1]);
+            }
+            incoming = std::move(extra);
+            const int ret = RecvBlocking(ssl.native, incoming);
+            if (ret == 0) {
+                return SSL_ERR_ZERO;
+            }
+            if (ret < 0) {
+                return SSL_ERR_RAGAIN;
+            }
+            continue;
+        }
+
+        return status == SEC_E_WRONG_PRINCIPAL ? SSL_ERR_VCOMMONNAME : SSL_ERR_FAILED;
+    }
+
+    return SSL_ERR_FAILED;
+}
+
+static int32_t SslWrite(SslSession& ssl, const uint8_t* data, uint32_t size) {
+    if (!data || size == 0) {
+        return SSL_ERR_ZERO;
+    }
+    const int32_t handshakeRet = SslHandshake(ssl);
+    if (handshakeRet != SSL_OK) {
+        return handshakeRet;
+    }
+
+    if (ssl.plaintextWfc) {
+        return SendAll(ssl.native, data, size) ? static_cast<int32_t>(size) : SSL_ERR_SYSCALL;
+    }
+
+    uint32_t total = 0;
+    while (total < size) {
+        const uint32_t chunk = std::min<uint32_t>(size - total, ssl.sizes.cbMaximumMessage);
+        std::vector<uint8_t> packet(ssl.sizes.cbHeader + chunk + ssl.sizes.cbTrailer);
+        std::memcpy(packet.data() + ssl.sizes.cbHeader, data + total, chunk);
+
+        SecBuffer buffers[4]{};
+        buffers[0].BufferType = SECBUFFER_STREAM_HEADER;
+        buffers[0].pvBuffer = packet.data();
+        buffers[0].cbBuffer = ssl.sizes.cbHeader;
+        buffers[1].BufferType = SECBUFFER_DATA;
+        buffers[1].pvBuffer = packet.data() + ssl.sizes.cbHeader;
+        buffers[1].cbBuffer = chunk;
+        buffers[2].BufferType = SECBUFFER_STREAM_TRAILER;
+        buffers[2].pvBuffer = packet.data() + ssl.sizes.cbHeader + chunk;
+        buffers[2].cbBuffer = ssl.sizes.cbTrailer;
+        buffers[3].BufferType = SECBUFFER_EMPTY;
+
+        SecBufferDesc desc{};
+        desc.ulVersion = SECBUFFER_VERSION;
+        desc.cBuffers = 4;
+        desc.pBuffers = buffers;
+
+        const SECURITY_STATUS status = EncryptMessage(&ssl.context, 0, &desc, 0);
+        if (status != SEC_E_OK) {
+            return SSL_ERR_FAILED;
+        }
+
+        const size_t encryptedSize =
+            static_cast<size_t>(buffers[0].cbBuffer) + buffers[1].cbBuffer + buffers[2].cbBuffer;
+        if (!SendAll(ssl.native, packet.data(), encryptedSize)) {
+            return SSL_ERR_SYSCALL;
+        }
+        total += chunk;
+    }
+    return static_cast<int32_t>(total);
+}
+
+static int32_t SslRead(SslSession& ssl, uint8_t* out, uint32_t size) {
+    if (!out || size == 0) {
+        return SSL_ERR_ZERO;
+    }
+    const int32_t handshakeRet = SslHandshake(ssl);
+    if (handshakeRet != SSL_OK) {
+        return handshakeRet;
+    }
+
+    if (ssl.plaintextWfc) {
+        const int ret = recv(ssl.native, reinterpret_cast<char*>(out), static_cast<int>(size), 0);
+        if (ret == 0) {
+            return SSL_ERR_ZERO;
+        }
+        if (ret < 0) {
+            return SSL_ERR_RAGAIN;
+        }
+        return ret;
+    }
+
+    while (ssl.decrypted.empty()) {
+        std::vector<uint8_t> encrypted = std::move(ssl.encryptedExtra);
+        ssl.encryptedExtra.clear();
+        if (encrypted.empty()) {
+            const int ret = RecvBlocking(ssl.native, encrypted);
+            if (ret == 0) {
+                return SSL_ERR_ZERO;
+            }
+            if (ret < 0) {
+                return SSL_ERR_RAGAIN;
+            }
+        }
+
+        for (;;) {
+            SecBuffer buffers[4]{};
+            buffers[0].BufferType = SECBUFFER_DATA;
+            buffers[0].pvBuffer = encrypted.data();
+            buffers[0].cbBuffer = static_cast<unsigned long>(encrypted.size());
+            buffers[1].BufferType = SECBUFFER_EMPTY;
+            buffers[2].BufferType = SECBUFFER_EMPTY;
+            buffers[3].BufferType = SECBUFFER_EMPTY;
+
+            SecBufferDesc desc{};
+            desc.ulVersion = SECBUFFER_VERSION;
+            desc.cBuffers = 4;
+            desc.pBuffers = buffers;
+
+            const SECURITY_STATUS status = DecryptMessage(&ssl.context, &desc, 0, nullptr);
+            if (status == SEC_E_INCOMPLETE_MESSAGE) {
+                const int ret = RecvBlocking(ssl.native, encrypted);
+                if (ret == 0) {
+                    return SSL_ERR_ZERO;
+                }
+                if (ret < 0) {
+                    return SSL_ERR_RAGAIN;
+                }
+                continue;
+            }
+            if (status == SEC_I_CONTEXT_EXPIRED) {
+                return SSL_ERR_ZERO;
+            }
+            if (!IsSecuritySuccess(status) && status != SEC_I_RENEGOTIATE) {
+                return SSL_ERR_FAILED;
+            }
+
+            for (const SecBuffer& buffer : buffers) {
+                if (buffer.BufferType == SECBUFFER_DATA && buffer.pvBuffer && buffer.cbBuffer) {
+                    const auto* begin = static_cast<const uint8_t*>(buffer.pvBuffer);
+                    ssl.decrypted.insert(ssl.decrypted.end(), begin, begin + buffer.cbBuffer);
+                } else if (buffer.BufferType == SECBUFFER_EXTRA && buffer.pvBuffer && buffer.cbBuffer) {
+                    const auto* begin = static_cast<const uint8_t*>(buffer.pvBuffer);
+                    ssl.encryptedExtra.assign(begin, begin + buffer.cbBuffer);
+                }
+            }
+            break;
+        }
+    }
+
+    const uint32_t copied = std::min<uint32_t>(size, static_cast<uint32_t>(ssl.decrypted.size()));
+    std::memcpy(out, ssl.decrypted.data(), copied);
+    ssl.decrypted.erase(ssl.decrypted.begin(), ssl.decrypted.begin() + copied);
+    return copied == 0 ? SSL_ERR_ZERO : static_cast<int32_t>(copied);
+}
+#else
+static void ClearSslSession(SslSession& ssl) {
+    ssl = {};
+}
+
+static int32_t SslHandshakeImpl(SslSession&) {
+    return SSL_ERR_FAILED;
+}
+
+static int32_t SslWrite(SslSession&, const uint8_t*, uint32_t) {
+    return SSL_ERR_FAILED;
+}
+
+static int32_t SslRead(SslSession&, uint8_t*, uint32_t) {
+    return SSL_ERR_FAILED;
+}
+#endif
+
+// The handshake runs on every SSL read/write, so a failure repeats for as long
+// as the session lives; report only the first one.
+static int32_t SslHandshake(SslSession& ssl) {
+    const int32_t result = SslHandshakeImpl(ssl);
+    if (result != SSL_OK && !ssl.loggedHandshakeFail) {
+        ssl.loggedHandshakeFail = true;
+        NetFail("ssl handshake FAILED host=%s ssl_err=%d",
+                ssl.hostname.empty() ? "?" : ssl.hostname.c_str(), result);
+    }
+    return result;
+}
+
+void ClearSslSessionsForSocket(uint32_t fd) {
+    for (SslSession& ssl : g_sslSessions) {
+        if (ssl.active && ssl.socketFd == fd) {
+            ClearSslSession(ssl);
+        }
+    }
+}
+
+int32_t HandleSslIoctlv(uint32_t cmd, const std::vector<IoVector>& in, const std::vector<IoVector>& out) {
+
+    switch (cmd) {
+    case IOCTLV_NET_SSL_NEW: {
+        // out[0] carries the verify option. Its value is not consulted - every
+        // certificate check is delegated to Schannel with
+        // SCH_CRED_MANUAL_CRED_VALIDATION - but it is still read so that a
+        // request pointing outside guest memory faults here as it always has.
+        if (!out.empty() && out[0].address && out[0].size >= 4) {
+            (void)Memory::Read32(out[0].address);
+        }
+        std::string hostname = out.size() > 1 ? ReadGuestString(out[1].address, out[1].size) : "";
+
+        for (int i = 0; i < kMaxSslSessions; ++i) {
+            if (!g_sslSessions[i].active) {
+                ClearSslSession(g_sslSessions[i]);
+                g_sslSessions[i].active = true;
+                g_sslSessions[i].hostname = hostname;
+                WriteSslReturn(in, i + 1);
+                return 0;
+            }
+        }
+        WriteSslReturn(in, SSL_ERR_FAILED);
+        NetFail("SSL_NEW host=%s FAILED: all %d session slots in use",
+                hostname.empty() ? "?" : hostname.c_str(), kMaxSslSessions);
+        return 0;
+    }
+    case IOCTLV_NET_SSL_CONNECT: {
+        const int sslId = ReadSslId(out);
+        if (!IsSslIdValid(sslId)) {
+            WriteSslReturn(in, SSL_ERR_ID);
+            return 0;
+        }
+        if (out.size() < 2 || !out[1].address || out[1].size < 4) {
+            WriteSslReturn(in, SSL_ERR_FAILED);
+            return 0;
+        }
+        const uint32_t socketFd = Memory::Read32(out[1].address);
+        WiiSocket* socket = GetWiiSocket(socketFd);
+        if (!socket) {
+            WriteSslReturn(in, SSL_ERR_SYSCALL);
+            return 0;
+        }
+
+        SslSession& ssl = g_sslSessions[sslId];
+        ssl.socketFd = socketFd;
+        ssl.native = socket->native;
+        ssl.plaintextWfc = false;
+        socket->nonblocking = false;
+        SetNonBlocking(socket->native, false);
+        if (IsRetroPlaintextSslHost(ssl.hostname) && socket->peerPort == 443) {
+            const int32_t reroute = ReconnectWiiSocket(*socket, 80);
+            if (reroute != 0) {
+                WriteSslReturn(in, SSL_ERR_SYSCALL);
+                NetFail("SSL_CONNECT host=%s 443->80 plaintext reroute FAILED wii=%d",
+                        ssl.hostname.c_str(), reroute);
+                return 0;
+            }
+            ssl.native = socket->native;
+            ssl.plaintextWfc = true;
+        }
+#ifdef _WIN32
+        const int timeoutMs = 15000;
+        setsockopt(socket->native, SOL_SOCKET, SO_RCVTIMEO, reinterpret_cast<const char*>(&timeoutMs), sizeof(timeoutMs));
+        setsockopt(socket->native, SOL_SOCKET, SO_SNDTIMEO, reinterpret_cast<const char*>(&timeoutMs), sizeof(timeoutMs));
+#endif
+        WriteSslReturn(in, SSL_OK);
+        return 0;
+    }
+    case IOCTLV_NET_SSL_DOHANDSHAKE:
+    case IOCTLV_NET_SSL_DOHANDSHAKEEX: {
+        const int sslId = ReadSslId(out);
+        WriteSslReturn(in, IsSslIdValid(sslId) ? SslHandshake(g_sslSessions[sslId]) : SSL_ERR_ID);
+        return 0;
+    }
+    case IOCTLV_NET_SSL_WRITE: {
+        const int sslId = ReadSslId(out);
+        if (!IsSslIdValid(sslId)) {
+            WriteSslReturn(in, SSL_ERR_ID);
+            return 0;
+        }
+        if (out.size() < 2 || !out[1].address) {
+            WriteSslReturn(in, SSL_ERR_FAILED);
+            return 0;
+        }
+        const auto* data = Memory::GetPointer(out[1].address, out[1].size);
+        std::vector<uint8_t> patched;
+        const NasSslWriteAction nasAction = PrepareNasSslWrite(g_sslSessions[sslId], data, out[1].size, patched);
+        if (nasAction == NasSslWriteAction::Buffered) {
+            WriteSslReturn(in, static_cast<int32_t>(out[1].size));
+            return 0;
+        }
+
+        const bool patchedSslWrite = nasAction == NasSslWriteAction::Ready;
+
+        const uint8_t* writeData = patchedSslWrite ? patched.data() : data;
+        const uint32_t writeSize = patchedSslWrite ? static_cast<uint32_t>(patched.size()) : out[1].size;
+        SslSession& writeSession = g_sslSessions[sslId];
+        int32_t result = SslWrite(writeSession, writeData, writeSize);
+        if (patchedSslWrite && result == static_cast<int32_t>(writeSize)) {
+            result = static_cast<int32_t>(out[1].size);
+        }
+        // SSL_ERR_WAGAIN is a retry, not a failure; the SDK re-issues the write,
+        // so only a change of error is reported.
+        if (result < 0 && result != SSL_ERR_WAGAIN && result != writeSession.lastLoggedWriteError) {
+            writeSession.lastLoggedWriteError = result;
+            NetFail("SSL_WRITE host=%s size=%u FAILED ssl_err=%d",
+                    writeSession.hostname.empty() ? "?" : writeSession.hostname.c_str(), writeSize,
+                    result);
+        }
+        WriteSslReturn(in, result);
+        return 0;
+    }
+    case IOCTLV_NET_SSL_READ: {
+        const int sslId = ReadSslId(out);
+        if (!IsSslIdValid(sslId)) {
+            WriteSslReturn(in, SSL_ERR_ID);
+            return 0;
+        }
+        if (in.size() < 2 || !in[1].address) {
+            WriteSslReturn(in, SSL_ERR_FAILED);
+            return 0;
+        }
+        auto* data = Memory::GetPointer(in[1].address, in[1].size);
+        SslSession& readSession = g_sslSessions[sslId];
+        const int32_t result = SslRead(readSession, data, in[1].size);
+        if (result < 0 && result != SSL_ERR_RAGAIN && result != readSession.lastLoggedReadError) {
+            readSession.lastLoggedReadError = result;
+            NetFail("SSL_READ host=%s FAILED ssl_err=%d%s",
+                    readSession.hostname.empty() ? "?" : readSession.hostname.c_str(), result,
+                    result == SSL_ERR_ZERO ? " (peer closed)" : "");
+        }
+        WriteSslReturn(in, result);
+        return 0;
+    }
+    case IOCTLV_NET_SSL_SHUTDOWN: {
+        const int sslId = ReadSslId(out);
+        if (!IsSslIdValid(sslId)) {
+            WriteSslReturn(in, SSL_ERR_ID);
+            return 0;
+        }
+        ClearSslSession(g_sslSessions[sslId]);
+        WriteSslReturn(in, SSL_OK);
+        return 0;
+    }
+    case IOCTLV_NET_SSL_SETCLIENTCERT:
+    case IOCTLV_NET_SSL_SETCLIENTCERTDEFAULT:
+    case IOCTLV_NET_SSL_REMOVECLIENTCERT:
+    case IOCTLV_NET_SSL_SETROOTCA:
+    case IOCTLV_NET_SSL_SETROOTCADEFAULT:
+    case IOCTLV_NET_SSL_SETBUILTINROOTCA:
+    case IOCTLV_NET_SSL_SETBUILTINCLIENTCERT:
+    case IOCTLV_NET_SSL_DISABLEVERIFYOPTIONFORDEBUG: {
+        const int sslId = ReadSslId(out);
+        WriteSslReturn(in, IsSslIdValid(sslId) ? SSL_OK : SSL_ERR_ID);
+        return 0;
+    }
+    case IOCTLV_NET_SSL_DEBUGGETVERSION:
+    case IOCTLV_NET_SSL_DEBUGGETTIME:
+        WriteSslReturn(in, SSL_OK);
+        return 0;
+    default:
+        WriteSslReturn(in, SSL_ERR_FAILED);
+        return 0;
+    }
+}
+
+}  // namespace NetworkHle
diff --git a/runtime/src/hle/os/os_alarm.cpp b/runtime/src/hle/os/os_alarm.cpp
new file mode 100644
index 0000000..a60e076
--- /dev/null
+++ b/runtime/src/hle/os/os_alarm.cpp
@@ -0,0 +1,474 @@
+// OSAlarm queue HLE.
+
+#include <cstdint>
+#include <iostream>
+#include <mutex>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "guest_interrupt_context.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+#include "hle/net/network.h"
+#include "generated/RuntimeConfig.h"
+#include "os_internal.h"
+
+extern "C" void func_801AADE0(CpuContext* ctx);
+extern "C" void func_801A0620(CpuContext* ctx);
+
+// ============================================================================
+// Alarm queue helpers
+// ============================================================================
+extern bool NandProcessPendingCallbacks(CpuContext* cpu, int maxToProcess);
+
+namespace {
+// OSAlarm link layout matches InsertAlarm in the original RVL OS:
+//   0x10 = prev
+//   0x14 = next
+constexpr uint32_t kAlarmPrevOffset = 0x10u;
+constexpr uint32_t kAlarmNextOffset = 0x14u;
+thread_local int g_alarmProcessDepth = 0;
+
+struct AlarmProcessScope {
+    AlarmProcessScope() { ++g_alarmProcessDepth; }
+    ~AlarmProcessScope() { --g_alarmProcessDepth; }
+};
+
+// Translated code can leave r13 pointing somewhere else, and the alarm queue is
+// addressed relative to the SDA1 base, so restore it before touching the queue.
+// `logOnce` fires the one-shot notice OS_HLE_ProcessAlarms has always emitted;
+// the other call sites have never logged.
+void EnsureSda1Base(CpuContext* cpu, bool logOnce = false)
+{
+    if (cpu->gpr[13] == RuntimeConfig::SDA1_BASE) {
+        return;
+    }
+
+    if (logOnce) {
+        static std::once_flag r13_fix_once;
+        std::call_once(r13_fix_once, []() {
+            RT_LOG(RT_TAG_OS) << "OS_HLE_ProcessAlarms: fixing r13 to SDA1 base" << std::endl;
+        });
+    }
+    cpu->gpr[13] = RuntimeConfig::SDA1_BASE;
+}
+
+void IncrementSchedulerDisableCount()
+{
+    const uint32_t count = ::Memory::Read32(kSchedulerIdleFlagAddr);
+    ::Memory::Write32(kSchedulerIdleFlagAddr, count + 1u);
+}
+
+void DecrementSchedulerDisableCount()
+{
+    const uint32_t count = ::Memory::Read32(kSchedulerIdleFlagAddr);
+    if (count == 0) {
+        RT_LOG(RT_TAG_OS) << "scheduler disable count underflow during alarm callback" << std::endl;
+        return;
+    }
+    ::Memory::Write32(kSchedulerIdleFlagAddr, count - 1u);
+}
+
+void RunDeferredReschedule(CpuContext* cpu)
+{
+    if (!cpu) {
+        return;
+    }
+
+    // AdvanceRetrace owns renderer/VI host state across guest callbacks. A
+    // completion may make a thread READY here, but switching fibers before the
+    // retrace frame unwinds would let unrelated guest work run under the live
+    // retrace guard. Leave the pending bit for the next safe scheduler point,
+    // matching OSWakeupThread's established behavior below.
+    if (VI_HLE_IsAdvancingRetrace()) {
+        return;
+    }
+
+    if (::Memory::Read32(kSchedulerReschedCounterAddr) == 0) {
+        return;
+    }
+
+    cpu->gpr[3] = 0;
+    SelectThread_801a9c08(cpu);
+}
+
+void SanitizeAlarmQueue(CpuContext* cpu)
+{
+    if (!cpu) {
+        return;
+    }
+
+    const uint32_t queueBase = cpu->gpr[13] - kAlarmQueueOffsetFromR13;
+    try {
+        const uint32_t head = ::Memory::Read32(queueBase);
+        const uint32_t tail = ::Memory::Read32(queueBase + 4u);
+        if (head == 0) {
+            return;
+        }
+
+        const uint32_t prev = ::Memory::Read32(head + kAlarmPrevOffset);
+        const uint32_t next = ::Memory::Read32(head + kAlarmNextOffset);
+
+        // Some builds initialize the alarm list as a self-referential node.
+        // Treat that as an empty list so InsertAlarm doesn't spin forever.
+        if (next == head && prev == head && head == tail) {
+            RT_LOG(RT_TAG_OS) << "Alarm queue sentinel detected; resetting to empty before InsertAlarm" << std::endl;
+            ::Memory::Write32(queueBase, 0);
+            ::Memory::Write32(queueBase + 4u, 0);
+            ::Memory::Write32(head + kAlarmPrevOffset, 0);
+            ::Memory::Write32(head + kAlarmNextOffset, 0);
+        }
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "SanitizeAlarmQueue", e);
+    }
+}
+
+constexpr uint32_t kAlarmHandlerOffset = 0x00u;
+constexpr uint32_t kAlarmFireTimeHiOffset = 0x08u;
+constexpr uint32_t kAlarmFireTimeLoOffset = 0x0Cu;
+constexpr uint32_t kAlarmPeriodHiOffset = 0x18u;
+constexpr uint32_t kAlarmPeriodLoOffset = 0x1Cu;
+
+bool IsLikelyCodeAddress(uint32_t addr)
+{
+    if (addr == 0) {
+        return false;
+    }
+    if (TranslatedFunctionRegistry::FindByAddressPtr(addr)) {
+        return true;
+    }
+    return Memory::Contains(addr, 4);
+}
+} // namespace
+
+namespace OsHleInternal {
+bool ProcessAlarmQueue(CpuContext* cpu, int maxToProcess)
+{
+    if (!cpu || maxToProcess <= 0) {
+        return false;
+    }
+
+    if (g_alarmProcessDepth != 0) {
+        return false;
+    }
+
+    EnsureSda1Base(cpu);
+
+    if (cpu->gpr[13] == 0) {
+        return false;
+    }
+
+    bool handledAny = false;
+
+    // Keep the alarm recursion guard scoped to alarm dispatch itself. IOS
+    // completion may wake and immediately switch into a guest fiber; carrying
+    // g_alarmProcessDepth across that switch would make the resumed fiber skip
+    // all alarm/network/callback pumping until this host frame ran again.
+    {
+        AlarmProcessScope alarmProcessScope;
+        SanitizeAlarmQueue(cpu);
+        const uint32_t queueBase = cpu->gpr[13] - kAlarmQueueOffsetFromR13;
+
+        try {
+            for (int i = 0; i < maxToProcess; ++i) {
+                const uint32_t alarm = ::Memory::Read32(queueBase);
+                if (alarm == 0) {
+                    break;
+                }
+
+                const uint64_t now = ReadSystemTime();
+                const uint32_t fireHi = ::Memory::Read32(alarm + kAlarmFireTimeHiOffset);
+                const uint32_t fireLo = ::Memory::Read32(alarm + kAlarmFireTimeLoOffset);
+                const uint64_t fireTime = (static_cast<uint64_t>(fireHi) << 32) | fireLo;
+                const uint32_t handler = ::Memory::Read32(alarm + kAlarmHandlerOffset);
+                if (now < fireTime) {
+                    break;
+                }
+
+                handledAny = true;
+
+                const uint32_t next = ::Memory::Read32(alarm + kAlarmNextOffset);
+
+                ::Memory::Write32(queueBase, next);
+                if (next == 0) {
+                    ::Memory::Write32(queueBase + 4u, 0);
+                } else {
+                    ::Memory::Write32(next + kAlarmPrevOffset, 0);
+                }
+
+                ::Memory::Write32(alarm + kAlarmNextOffset, 0);
+                ::Memory::Write32(alarm + kAlarmPrevOffset, 0);
+                ::Memory::Write32(alarm + kAlarmHandlerOffset, 0);
+
+                const uint32_t periodHi = ::Memory::Read32(alarm + kAlarmPeriodHiOffset);
+                const uint32_t periodLo = ::Memory::Read32(alarm + kAlarmPeriodLoOffset);
+                if ((periodHi | periodLo) != 0) {
+                    cpu->gpr[3] = alarm;
+                    cpu->gpr[5] = 0;
+                    cpu->gpr[6] = 0;
+                    cpu->gpr[7] = handler;
+                    func_801A0620(cpu);
+                }
+
+                if (handler != 0) {
+                    IncrementSchedulerDisableCount();
+                    try {
+                        cpu->gpr[3] = alarm;
+                        cpu->gpr[4] = ::Memory::Read32(kOSCurrentContextAddr);
+                        InvokeIndirectCpu(handler, cpu);
+                    } catch (...) {
+                        DecrementSchedulerDisableCount();
+                        throw;
+                    }
+                    DecrementSchedulerDisableCount();
+                    RunDeferredReschedule(cpu);
+                }
+            }
+        } catch (const ::Memory::AccessViolation& e) {
+            LogMemoryError(RT_TAG_OS, "ProcessAlarmQueue", e);
+        }
+    }
+
+    // Host DNS workers never touch guest memory. Commit their output here on
+    // the scheduler thread, waking synchronous IOS waiters or queuing async IOS
+    // callbacks before the callback drain below.
+    bool completionNeedsReschedule = false;
+    if (Network_HLE_ProcessCompletions(cpu)) {
+        handledAny = true;
+        completionNeedsReschedule = true;
+    }
+
+    if (NandProcessPendingCallbacks(cpu, maxToProcess)) {
+        handledAny = true;
+        completionNeedsReschedule = true;
+    }
+    if (completionNeedsReschedule) {
+        RunDeferredReschedule(cpu);
+    }
+
+    return handledAny;
+}
+} // namespace OsHleInternal
+
+extern "C" void OSSetAlarm_HLE_801a0870(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    if (!cpu) {
+        return;
+    }
+
+    const uint32_t alarm = cpu->gpr[3];
+    uint32_t tickHi = cpu->gpr[5];
+    uint32_t tickLo = cpu->gpr[6];
+    uint32_t handler = cpu->gpr[7];
+
+    const uint32_t altTickHi = cpu->gpr[4];
+    const uint32_t altTickLo = cpu->gpr[5];
+    const uint32_t altHandler = cpu->gpr[6];
+
+    // Log all OSSetAlarm calls for debugging RFL alarm issues
+
+    if (!IsLikelyCodeAddress(handler) && IsLikelyCodeAddress(altHandler)) {
+        handler = altHandler;
+        tickHi = altTickHi;
+        tickLo = altTickLo;
+    }
+
+    if (alarm == 0) {
+        return;
+    }
+
+    const int32_t level = OS__DisableInterrupts_801a65ac();
+    SanitizeAlarmQueue(cpu);
+
+    uint64_t now = 0;
+    try {
+        now = ReadSystemTime();
+    } catch (const ::Memory::AccessViolation&) {
+        now = (static_cast<uint64_t>(PPC_Mftbu()) << 32) | PPC_Mftb();
+    }
+
+    const uint64_t offset = (static_cast<uint64_t>(tickHi) << 32) | tickLo;
+    const uint64_t fireTime = now + offset;
+
+    try {
+        ::Memory::Write32(alarm + kAlarmPeriodLoOffset, 0);
+        ::Memory::Write32(alarm + kAlarmPeriodHiOffset, 0);
+        ::Memory::Write32(alarm + kAlarmHandlerOffset, handler);
+        ::Memory::Write32(alarm + kAlarmFireTimeHiOffset, static_cast<uint32_t>(fireTime >> 32));
+        ::Memory::Write32(alarm + kAlarmFireTimeLoOffset, static_cast<uint32_t>(fireTime & 0xFFFFFFFFu));
+        ::Memory::Write32(alarm + kAlarmNextOffset, 0);
+        ::Memory::Write32(alarm + kAlarmPrevOffset, 0);
+    } catch (const ::Memory::AccessViolation&) {
+        OS__RestoreInterrupts_801a65d4(level);
+        return;
+    }
+
+    const uint32_t queueBase = cpu->gpr[13] - kAlarmQueueOffsetFromR13;
+    try {
+        const uint32_t head = ::Memory::Read32(queueBase);
+        if (head == 0) {
+            ::Memory::Write32(queueBase, alarm);
+            ::Memory::Write32(queueBase + 4u, alarm);
+        } else {
+            uint32_t cur = head;
+            uint32_t prev = 0;
+              while (cur != 0) {
+                  const uint32_t curHi = ::Memory::Read32(cur + kAlarmFireTimeHiOffset);
+                  const uint32_t curLo = ::Memory::Read32(cur + kAlarmFireTimeLoOffset);
+                  const uint64_t curFire = (static_cast<uint64_t>(curHi) << 32) | curLo;
+                  if (static_cast<int64_t>(fireTime) < static_cast<int64_t>(curFire)) {
+                      break;
+                  }
+                  prev = cur;
+                  cur = ::Memory::Read32(cur + kAlarmNextOffset);
+              }
+
+
+            if (prev == 0) {
+                ::Memory::Write32(alarm + kAlarmNextOffset, head);
+                ::Memory::Write32(head + kAlarmPrevOffset, alarm);
+                ::Memory::Write32(queueBase, alarm);
+            } else {
+                ::Memory::Write32(alarm + kAlarmPrevOffset, prev);
+                ::Memory::Write32(alarm + kAlarmNextOffset, cur);
+                ::Memory::Write32(prev + kAlarmNextOffset, alarm);
+                if (cur != 0) {
+                    ::Memory::Write32(cur + kAlarmPrevOffset, alarm);
+                } else {
+                    ::Memory::Write32(queueBase + 4u, alarm);
+                }
+            }
+        }
+    } catch (const ::Memory::AccessViolation&) {
+    }
+
+    OS__RestoreInterrupts_801a65d4(level);
+}
+PPC_NATIVE_OVERRIDE_VOID(801A0870, OSSetAlarm_HLE_801a0870, (CpuContext* ctx), (ctx));
+
+extern "C" void OS_HLE_ProcessAlarms(int maxToProcess)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu) {
+        cpu = &GetPersistentCpuContext();
+    }
+    // R13 should always point at the SDA base; force it if translated code clobbered it.
+    EnsureSda1Base(cpu, true);
+    ProcessAlarmQueue(cpu, maxToProcess);
+}
+
+extern "C" void OS_HLE_ProcessAlarmsDeferred(int maxToProcess)
+{
+    if (maxToProcess <= 0 || !OS_HLE_InterruptsEnabled()) {
+        return;
+    }
+
+    // Alarm handlers reached from here interrupt an arbitrary translated
+    // function (GX__Begin's timing service, the host frame loop), so they run
+    // on a private copy of that function's register file the way a decrementer
+    // interrupt would. Guest memory and the alarm queue stay shared.
+    GuestInterruptCallbackContext interrupt;
+    CpuContext* cpu = interrupt.get();
+    EnsureSda1Base(cpu);
+
+    // Host renderer waits are not guest critical sections: on hardware, alarm
+    // interrupts continue to run while the GPU is slow. Dispatch callbacks at
+    // the timed wait boundary, but keep any resulting guest thread switch
+    // deferred until the native GX call has unwound and renderer ownership is
+    // safe again.
+    IncrementSchedulerDisableCount();
+    try {
+        ProcessAlarmQueue(cpu, maxToProcess);
+    } catch (...) {
+        DecrementSchedulerDisableCount();
+        throw;
+    }
+    DecrementSchedulerDisableCount();
+}
+
+extern "C" void OS_HLE_BeginDeferredGuestCallbacks()
+{
+    IncrementSchedulerDisableCount();
+}
+
+extern "C" void OS_HLE_EndDeferredGuestCallbacks()
+{
+    DecrementSchedulerDisableCount();
+}
+
+// HLE implementation replacing the translated version. Keeps the original
+// field writes and InsertAlarm call but avoids the bad self-linked queue state.
+extern "C" void OS__SetPeriodicAlarm_801a08e0(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    if (!cpu) {
+        return;
+    }
+
+    SanitizeAlarmQueue(cpu);
+
+    const uint32_t alarm = cpu->gpr[3];
+    const uint32_t startHi = cpu->gpr[5];
+    const uint32_t startLo = cpu->gpr[6];
+    const uint32_t periodHi = cpu->gpr[7];
+    const uint32_t periodLo = cpu->gpr[8];
+    const uint32_t handler = cpu->gpr[9];
+
+    const int32_t level = OS__DisableInterrupts_801a65ac();
+
+    Memory::Write32(alarm + kAlarmPeriodLoOffset, periodLo);
+    Memory::Write32(alarm + kAlarmPeriodHiOffset, periodHi);
+
+    cpu->gpr[3] = startHi;
+    cpu->gpr[4] = startLo;
+    func_801AADE0(cpu);
+    Memory::Write32(alarm + 0x20u, cpu->gpr[3]);
+    Memory::Write32(alarm + 0x24u, cpu->gpr[4]);
+
+    cpu->gpr[3] = alarm;
+    cpu->gpr[5] = 0;
+    cpu->gpr[6] = 0;
+    cpu->gpr[7] = handler;
+    func_801A0620(cpu);
+
+    cpu->gpr[3] = static_cast<uint32_t>(OS__RestoreInterrupts_801a65d4(level));
+}
+
+// Register the function
+PPC_NATIVE_OVERRIDE_VOID(801A08E0, OS__SetPeriodicAlarm_801a08e0, (CpuContext* ctx), (ctx));
+
+// RFLiIsWorking (RFL, the Mii library) lives here because its whole job is to
+// pump this file's alarm queue: RFLInitRes spins on it waiting for async RFL
+// work that only completes when the interrupt-driven alarmCheckCb_ fires.
+// Original at 0x800BD860 reads the "working" flag at RFL manager + 0x1B34,
+// returning 0 when the manager pointer (0x80386298) is null.
+extern "C" uint32_t RFLiIsWorking_HLE_800bd860()
+{
+    // Pump alarms/callbacks on the current guest thread when available. Using a
+    // detached persistent context here can leave the busy loop waiting on work
+    // that completed on the wrong scheduling context.
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu) {
+        cpu = &GetPersistentCpuContext();
+    }
+    EnsureSda1Base(cpu);
+    ProcessAlarmQueue(cpu, 32);
+
+    // Now return the actual "working" status
+    constexpr uint32_t kRflManagerPtrAddr = 0x80386298u;
+    constexpr uint32_t kWorkingFlagOffset = 0x1b34u;
+
+    try {
+        const uint32_t managerBase = ::Memory::Read32(kRflManagerPtrAddr);
+        if (managerBase == 0) {
+            return 0;
+        }
+        return ::Memory::Read32(managerBase + kWorkingFlagOffset);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "RFLiIsWorking", e);
+        return 0;
+    }
+}
+PPC_NATIVE_OVERRIDE(800BD860, RFLiIsWorking_HLE_800bd860, uint32_t, (), ());
diff --git a/runtime/src/hle/os/os_cache.cpp b/runtime/src/hle/os/os_cache.cpp
new file mode 100644
index 0000000..bee9022
--- /dev/null
+++ b/runtime/src/hle/os/os_cache.cpp
@@ -0,0 +1,236 @@
+// Data/instruction/locked cache maintenance HLE.
+
+#include <cstdint>
+#include <cstring>
+#include <iostream>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+#include "hle/gx/gx_internal.h"
+
+// ============================================================================
+// Data cache maintenance (DCInvalidate/Flush/Store)
+// These touch hardware on console; on host we fast-path them to avoid huge
+// translated loops while still validating the guest range.
+// ============================================================================
+namespace {
+struct CacheRange {
+    uint32_t start = 0;
+    uint32_t size = 0;
+};
+
+constexpr uint32_t kCacheLineSize = 32;
+
+bool NormalizeCacheRange(uint32_t addr, uint32_t length, CacheRange& out)
+{
+    if (length == 0) {
+        return false;
+    }
+
+    const uint32_t alignedStart = addr & ~(kCacheLineSize - 1u);
+    const uint64_t end = static_cast<uint64_t>(addr) + static_cast<uint64_t>(length) + (kCacheLineSize - 1u);
+    const uint64_t alignedEnd = end & ~(static_cast<uint64_t>(kCacheLineSize) - 1u);
+    if (alignedEnd <= alignedStart || alignedEnd >= 0x100000000ull) {
+        return false;
+    }
+
+    out.start = alignedStart;
+    out.size = static_cast<uint32_t>(alignedEnd - alignedStart);
+    return out.size != 0;
+}
+
+bool ValidateCacheRange(const char* label, const CacheRange& range)
+{
+    if (range.size == 0) {
+        return false;
+    }
+
+    if (!::Memory::Contains(range.start, range.size)) {
+        RT_LOG(RT_TAG_OS) << label << ": range 0x" << std::hex << range.start
+                  << " len=0x" << range.size << std::dec
+                  << " outside guest memory; skipping" << std::endl;
+        return false;
+    }
+    return true;
+}
+
+void DcRangeOp(const char* label, uint32_t addr, uint32_t length)
+{
+    CacheRange range{};
+    if (!NormalizeCacheRange(addr, length, range) || !ValidateCacheRange(label, range)) {
+        return;
+    }
+
+    GxNotifyGuestRamDmaWrite(range.start, range.size);
+}
+} // namespace
+
+extern "C" void DCInvalidateRange_801a1600(uint32_t addr, uint32_t length)
+{
+    DcRangeOp("DCInvalidateRange_801a1600", addr, length);
+}
+
+extern "C" void DCFlushRange_801a162c(uint32_t addr, uint32_t length)
+{
+    DcRangeOp("DCFlushRange_801a162c", addr, length);
+}
+
+extern "C" void DCStoreRange_801a165c(uint32_t addr, uint32_t length)
+{
+    DcRangeOp("DCStoreRange_801a165c", addr, length);
+}
+
+extern "C" void DCFlushRangeNoSync_801a168c(uint32_t addr, uint32_t length)
+{
+    DcRangeOp("DCFlushRangeNoSync_801a168c", addr, length);
+}
+
+extern "C" void DCStoreRangeNoSync_801a16b8(uint32_t addr, uint32_t length)
+{
+    DcRangeOp("DCStoreRangeNoSync_801a16b8", addr, length);
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A1600, DCInvalidateRange_801a1600, (uint32_t addr, uint32_t length), (addr, length));
+PPC_NATIVE_OVERRIDE_VOID(801A162C, DCFlushRange_801a162c, (uint32_t addr, uint32_t length), (addr, length));
+PPC_NATIVE_OVERRIDE_VOID(801A165C, DCStoreRange_801a165c, (uint32_t addr, uint32_t length), (addr, length));
+PPC_NATIVE_OVERRIDE_VOID(801A168C, DCFlushRangeNoSync_801a168c, (uint32_t addr, uint32_t length), (addr, length));
+PPC_NATIVE_OVERRIDE_VOID(801A16B8, DCStoreRangeNoSync_801a16b8, (uint32_t addr, uint32_t length), (addr, length));
+
+// ----------------------------------------------------------------------------
+// CPU Cache Maintenance Stubs (DC/IC/LC)
+// These are safe to no-op because the host CPU handles caching.
+// ----------------------------------------------------------------------------
+extern "C" void Cache_Maintenance_Stub()
+{
+}
+
+namespace {
+
+constexpr uint32_t kCacheOpLineSize = 32u;
+constexpr uint32_t kLcOpPageSize = 4096u;
+constexpr uint32_t kLcOpMaxBlocksPerTransfer = 128u;
+
+uint32_t AlignDown32(uint32_t value)
+{
+    return value & ~(kCacheOpLineSize - 1u);
+}
+
+uint32_t AlignUp32(uint32_t value)
+{
+    return (value + (kCacheOpLineSize - 1u)) & ~(kCacheOpLineSize - 1u);
+}
+
+uint32_t DecodeLcBlockCount(uint32_t encodedBlockCount)
+{
+    const uint32_t blocks = encodedBlockCount & 0x7Fu;
+    return blocks == 0 ? kLcOpMaxBlocksPerTransfer : blocks;
+}
+
+bool CopyGuestRange(uint32_t dstAddr, uint32_t srcAddr, uint32_t len, const char* opName)
+{
+    if (len == 0) {
+        return true;
+    }
+
+    try {
+        auto* dst = ::Memory::GetPointer(dstAddr, len);
+        auto* src = ::Memory::GetPointer(srcAddr, len);
+        std::memmove(dst, src, len);
+        return true;
+    } catch (const ::Memory::AccessViolation& e) {
+        RT_LOG(RT_TAG_OS) << opName << ": memory access failed @0x" << std::hex << e.address()
+                  << " len=0x" << len << std::dec << " (" << e.reason() << ")" << std::endl;
+        return false;
+    }
+}
+
+} // namespace
+
+extern "C" void DCZeroRange_HLE_801a16e4(CpuContext* ctx)
+{
+    const uint32_t addr = static_cast<uint32_t>(ctx->gpr[3]);
+    const uint32_t len = static_cast<uint32_t>(ctx->gpr[4]);
+    if (len == 0) {
+        return;
+    }
+
+    const uint32_t alignedAddr = AlignDown32(addr);
+    const uint32_t alignedLen = AlignUp32((addr - alignedAddr) + len);
+    try {
+        auto* dst = ::Memory::GetPointer(alignedAddr, alignedLen);
+        std::memset(dst, 0, alignedLen);
+        GxNotifyGuestRamDmaWrite(alignedAddr, alignedLen);
+    } catch (const ::Memory::AccessViolation& e) {
+        RT_LOG(RT_TAG_OS) << "DCZeroRange: memory access failed @0x" << std::hex << e.address()
+                  << " len=0x" << alignedLen << std::dec << " (" << e.reason() << ")" << std::endl;
+    }
+}
+
+extern "C" void LCLoadBlocks_HLE_801a1894(CpuContext* ctx)
+{
+    const uint32_t dstAddr = static_cast<uint32_t>(ctx->gpr[3]);
+    const uint32_t srcAddr = static_cast<uint32_t>(ctx->gpr[4]);
+    const uint32_t blocks = DecodeLcBlockCount(static_cast<uint32_t>(ctx->gpr[5]));
+    const uint32_t len = blocks * kCacheOpLineSize;
+    if (CopyGuestRange(dstAddr, srcAddr, len, "LCLoadBlocks")) {
+        // RAM->LC loads are DMA reads on console, but the destination range is
+        // still a guest RAM alias as far as the runtime is concerned; notify it
+        // the same way LCStoreBlocks below does.
+        GxNotifyGuestRamDmaWrite(dstAddr, len);
+    }
+}
+
+extern "C" void LCStoreBlocks_HLE_801a18b8(CpuContext* ctx)
+{
+    const uint32_t dstAddr = static_cast<uint32_t>(ctx->gpr[3]);
+    const uint32_t srcAddr = static_cast<uint32_t>(ctx->gpr[4]);
+    const uint32_t blocks = DecodeLcBlockCount(static_cast<uint32_t>(ctx->gpr[5]));
+    const uint32_t len = blocks * kCacheOpLineSize;
+    if (CopyGuestRange(dstAddr, srcAddr, len, "LCStoreBlocks")) {
+        // LC->RAM stores are DMA writes on console; no flush follows them.
+        GxNotifyGuestRamDmaWrite(dstAddr, len);
+    }
+}
+
+extern "C" uint32_t LCStoreData_HLE_801a18dc(CpuContext* ctx)
+{
+    const uint32_t dstAddr = static_cast<uint32_t>(ctx->gpr[3]);
+    const uint32_t srcAddr = static_cast<uint32_t>(ctx->gpr[4]);
+    const uint32_t len = static_cast<uint32_t>(ctx->gpr[5]);
+    if (CopyGuestRange(dstAddr, srcAddr, len, "LCStoreData") && len != 0) {
+        GxNotifyGuestRamDmaWrite(dstAddr, len);
+    }
+
+    const uint32_t pagesQueued = len == 0 ? 0u : ((len + kLcOpPageSize - 1u) / kLcOpPageSize);
+    ctx->gpr[3] = pagesQueued;
+    return pagesQueued;
+}
+
+extern "C" uint32_t LCQueueLength_HLE_801a197c(CpuContext*)
+{
+    // We execute LC transfers synchronously, so the DMA queue is always drained.
+    return 0;
+}
+
+extern "C" void LCQueueWait_HLE_801a1988(CpuContext*)
+{
+    // Synchronous HLE copy completes immediately.
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801a15ec, Cache_Maintenance_Stub, (), ()); // DCEnable
+PPC_NATIVE_OVERRIDE_VOID(801a16e4, DCZeroRange_HLE_801a16e4, (CpuContext* ctx), (ctx)); // DCZeroRange
+PPC_NATIVE_OVERRIDE_VOID(801a1710, Cache_Maintenance_Stub, (), ()); // ICInvalidateRange
+PPC_NATIVE_OVERRIDE_VOID(801a1744, Cache_Maintenance_Stub, (), ()); // ICFlashInvalidate
+PPC_NATIVE_OVERRIDE_VOID(801a1754, Cache_Maintenance_Stub, (), ()); // ICEnable
+PPC_NATIVE_OVERRIDE_VOID(801a1768, Cache_Maintenance_Stub, (), ()); // __LCEnable
+PPC_NATIVE_OVERRIDE_VOID(801a1834, Cache_Maintenance_Stub, (), ()); // LCEnable
+PPC_NATIVE_OVERRIDE_VOID(801a186c, Cache_Maintenance_Stub, (), ()); // LCDisable
+PPC_NATIVE_OVERRIDE_VOID(801a1894, LCLoadBlocks_HLE_801a1894, (CpuContext* ctx), (ctx)); // LCLoadBlocks
+PPC_NATIVE_OVERRIDE_VOID(801a18b8, LCStoreBlocks_HLE_801a18b8, (CpuContext* ctx), (ctx)); // LCStoreBlocks
+PPC_NATIVE_OVERRIDE(801a18dc, LCStoreData_HLE_801a18dc, uint32_t, (CpuContext* ctx), (ctx)); // LCStoreData
+PPC_NATIVE_OVERRIDE(801a197c, LCQueueLength_HLE_801a197c, uint32_t, (CpuContext* ctx), (ctx)); // LCQueueLength
+PPC_NATIVE_OVERRIDE_VOID(801a1988, LCQueueWait_HLE_801a1988, (CpuContext* ctx), (ctx)); // LCQueueWait
+PPC_NATIVE_OVERRIDE_VOID(801a1ae4, Cache_Maintenance_Stub, (), ()); // OS____CacheInit
diff --git a/runtime/src/hle/os/os_context.cpp b/runtime/src/hle/os/os_context.cpp
new file mode 100644
index 0000000..4b17875
--- /dev/null
+++ b/runtime/src/hle/os/os_context.cpp
@@ -0,0 +1,167 @@
+// Guest OSContext bookkeeping and the OSLoadContext context switch.
+
+#include <atomic>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <iostream>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+#include "os_internal.h"
+
+extern "C" uint32_t OS__GetCurrentThread_801a98b0_hle()
+{
+    try {
+        return ::Memory::Read32(kOSRunningContextAddr);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OS__GetCurrentThread_801a98b0", e);
+        return 0;
+    }
+}
+
+extern "C" void OS__ClearContext_801a2098(uint32_t contextAddr)
+{
+    if (contextAddr == 0) {
+        return;
+    }
+
+    try {
+        ::Memory::Write16(contextAddr + 0x1a0u, 0);
+        ::Memory::Write16(contextAddr + 0x1a2u, 0);
+
+        const uint32_t exceptionCtx = ::Memory::Read32(kOSExceptionContextAddr);
+        if (exceptionCtx == contextAddr) {
+            ::Memory::Write32(kOSExceptionContextAddr, 0);
+        }
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OS__ClearContext_801a2098", e);
+    }
+}
+
+extern "C" void OS__SetCurrentContext_801a1e70(uint32_t contextAddr)
+{
+    try {
+        if (contextAddr == 0) {
+            ::Memory::Write32(kOSPhysicalContextAddr, 0);
+            ::Memory::Write32(kOSCurrentContextAddr, 0);
+            return;
+        }
+
+        const uint32_t physicalMask = contextAddr & 0x3fffffffu;
+        ::Memory::Write32(kOSPhysicalContextAddr, physicalMask);
+        ::Memory::Write32(kOSCurrentContextAddr, contextAddr);
+
+        const uint32_t exceptionCtx = ::Memory::Read32(kOSExceptionContextAddr);
+        uint32_t flags = ::Memory::Read32(contextAddr + 0x19cu);
+        if (exceptionCtx == contextAddr) {
+            flags |= 0x2000u;
+        } else {
+            flags &= ~0x2000u;
+            std::atomic_thread_fence(std::memory_order_seq_cst);
+        }
+        ::Memory::Write32(contextAddr + 0x19cu, flags);
+
+        uint16_t modeFlags = ::Memory::Read16(contextAddr + 0x1a2u);
+        if (g_interrupts_enabled.load()) {
+            modeFlags |= 0x0002u;
+        } else {
+            modeFlags &= static_cast<uint16_t>(~0x0002u);
+        }
+        ::Memory::Write16(contextAddr + 0x1a2u, modeFlags);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OS__SetCurrentContext_801a1e70", e);
+    }
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A2098, OS__ClearContext_801a2098, (uint32_t contextAddr), (contextAddr));
+PPC_NATIVE_OVERRIDE_VOID(801A1E70, OS__SetCurrentContext_801a1e70, (uint32_t contextAddr), (contextAddr));
+REGISTER_NATIVE_FUNCTION(0x801A98B0, OS__GetCurrentThread_801a98b0_hle);
+
+// OSLoadContext (0x801A1F58): restores CPU state from a guest OSContext and jumps to SRR0 by hand,
+// since the real function's privileged mtspr/rfi can't be translated.
+
+extern "C" [[noreturn]] void OS__LoadContext_801a1f58(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t guestContextAddr = cpu->gpr[3];
+
+    RT_LOG(RT_TAG_OS) << "OS__LoadContext_801a1f58 called: ctx=0x" << std::hex << guestContextAddr << std::dec << std::endl;
+
+    if (guestContextAddr == 0) {
+        RT_LOG(RT_TAG_OS) << "OS__LoadContext: FATAL - null context address!" << std::endl;
+        std::fflush(stderr);
+        std::abort();
+    }
+
+    try {
+        // Validate SRR0 (the jump target, at 0x198) before mutating any other state.
+        uint32_t srr0 = ::Memory::Read32(guestContextAddr + 0x198u);
+        
+        // Validate the jump target exists in our translated function registry
+        if (srr0 == 0) {
+            RT_LOG(RT_TAG_OS) << "OS__LoadContext: FATAL - SRR0 (jump target) is NULL!" << std::endl;
+            std::fflush(stderr);
+            std::abort();
+        }
+
+        // ---- Load GPRs ----
+        for (int i = 0; i < 32; ++i) {
+            cpu->gpr[i] = ::Memory::Read32(guestContextAddr + static_cast<uint32_t>(i * 4));
+        }
+
+        // ---- Load Special Registers ----
+        cpu->cr  = ::Memory::Read32(guestContextAddr + 0x80u);
+        cpu->lr  = ::Memory::Read32(guestContextAddr + 0x84u);
+        cpu->ctr = ::Memory::Read32(guestContextAddr + 0x88u);
+        cpu->xer = ::Memory::Read32(guestContextAddr + 0x8Cu);
+
+        // ---- Load GQRs (Graphics Quantization Registers) ----
+        // GQR0 is always 0 (not saved/restored)
+        cpu->gqr[0] = 0;
+        cpu->gqr[1] = ::Memory::Read32(guestContextAddr + 0x1A8u);
+        cpu->gqr[2] = ::Memory::Read32(guestContextAddr + 0x1ACu);
+        cpu->gqr[3] = ::Memory::Read32(guestContextAddr + 0x1B0u);
+        cpu->gqr[4] = ::Memory::Read32(guestContextAddr + 0x1B4u);
+        cpu->gqr[5] = ::Memory::Read32(guestContextAddr + 0x1B8u);
+        cpu->gqr[6] = ::Memory::Read32(guestContextAddr + 0x1BCu);
+        cpu->gqr[7] = ::Memory::Read32(guestContextAddr + 0x1C0u);
+
+        // ---- Clear exception context flag if set ----
+        uint16_t modeFlags = ::Memory::Read16(guestContextAddr + 0x1A2u);
+        if ((modeFlags & 0x0002u) != 0) {
+            modeFlags &= ~0x0002u;
+            ::Memory::Write16(guestContextAddr + 0x1A2u, modeFlags);
+        }
+
+        // ---- Update PC and SRR registers ----
+        cpu->srr0 = srr0;
+        cpu->srr1 = ::Memory::Read32(guestContextAddr + 0x19Cu);
+        cpu->pc = srr0;
+
+        RT_LOG(RT_TAG_OS) << "OS__LoadContext: jumping to target=0x" << std::hex << srr0 
+                  << " SP=0x" << cpu->gpr[1] << std::dec << std::endl;
+
+        // Equivalent to 'rfi': jump to SRR0 with MSR from SRR1.
+        InvokeIndirectJump(srr0, cpu);
+
+        // If we get here, the function returned normally (shouldn't happen for context switches)
+        // But for safety, just return (the caller's state is now the loaded context)
+        RT_LOG(RT_TAG_OS) << "OS__LoadContext: WARNING - target returned, this is unexpected!" << std::endl;
+
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OS__LoadContext", e);
+        std::fflush(stderr);
+        std::abort();
+    }
+
+    // This function should never return (rfi is a non-returning jump)
+    // If InvokeIndirectJump returns, we have a problem
+    std::fflush(stderr);
+    std::abort();
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A1F58, OS__LoadContext_801a1f58, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/os/os_init.cpp b/runtime/src/hle/os/os_init.cpp
new file mode 100644
index 0000000..08472a8
--- /dev/null
+++ b/runtime/src/hle/os/os_init.cpp
@@ -0,0 +1,340 @@
+// Boot/init hooks, OSFatal, and assorted hardware-init stubs.
+
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <string>
+#include <thread>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "recomp_mod_loader.h"
+#include "runtime_log.h"
+#include "system_bridge.h"
+
+extern "C" void func_801A961C(CpuContext* ctx);
+extern "C" void func_8055531C(CpuContext* ctx);
+
+extern "C" void OSInitAlarm_RecompModLateInit_801a961c(CpuContext* ctx) {
+    func_801A961C(ctx);
+}
+
+REGISTER_NATIVE_FUNCTION_AS(0x801A961C, OSInitAlarm_RecompModLateInit_801a961c, "OSInitAlarm_RecompModLateInit_801a961c");
+
+extern "C" void StaticRProlog_RecompModInit_8055531c(CpuContext* ctx) {
+    RecompMod::RunMemoryInitializers();
+    func_8055531C(ctx);
+    RecompMod::RunPostRelInitializers();
+}
+
+REGISTER_NATIVE_FUNCTION_AS(0x8055531C, StaticRProlog_RecompModInit_8055531c, "StaticRProlog_RecompModInit_8055531c");
+
+namespace {
+std::string ReadGuestCStringLimited(uint32_t address, size_t limit = 4096) {
+    if (address == 0) {
+        return "<null>";
+    }
+
+    std::string text;
+    text.reserve(128);
+    for (size_t i = 0; i < limit; ++i) {
+        const uint8_t ch = Memory::Read8(address + static_cast<uint32_t>(i));
+        if (ch == 0) {
+            return text;
+        }
+        text.push_back(static_cast<char>(ch));
+    }
+    text += "<unterminated>";
+    return text;
+}
+}
+
+extern "C" void OSFatal_HLE_801a4ec4(CpuContext* ctx) {
+    const uint32_t fg = ctx ? ctx->gpr[3] : 0;
+    const uint32_t bg = ctx ? ctx->gpr[4] : 0;
+    const uint32_t messagePtr = ctx ? ctx->gpr[5] : 0;
+    RT_LOG(RT_TAG_OS) << "OS::Fatal called fg=0x" << std::hex << fg
+              << " bg=0x" << bg
+              << " message=0x" << messagePtr
+              << std::dec << " '" << ReadGuestCStringLimited(messagePtr) << "'" << std::endl;
+    if (ctx) {
+        SystemBridge::DumpCpuState(ctx);
+    }
+    const std::string guestMessage = ReadGuestCStringLimited(messagePtr);
+    const std::string details =
+        guestMessage.empty() ? std::string("OS::Fatal was called without a message.") : guestMessage;
+    // MarkFatalErrorReported below suppresses the atexit reporter, so this path
+    // has to write its own artifacts or the run folder gets nothing.
+    RuntimeCrash::WriteCrashArtifacts("osfatal", details);
+    SetRuntimeExitCode(EXIT_FAILURE);
+    ShowRuntimeFatalPopup("the guest operating system reported a fatal error", details);
+    MarkFatalErrorReported();
+    std::exit(EXIT_FAILURE);
+}
+
+REGISTER_NATIVE_FUNCTION_AS(0x801A4EC4, OSFatal_HLE_801a4ec4, "OSFatal_HLE_801a4ec4");
+
+extern "C" void GKI_delay_HLE_801301b4(CpuContext* ctx)
+{
+    const uint32_t delayMs = ctx ? static_cast<uint32_t>(ctx->gpr[3]) : 0;
+    const uint32_t sleepMs = delayMs == 0 ? 1u : std::min(delayMs, 10u);
+    std::this_thread::sleep_for(std::chrono::milliseconds(sleepMs));
+}
+
+extern "C" uint32_t BTM_IsDeviceUp_HLE_8013a300(CpuContext* ctx)
+{
+    // Force Bluetooth stack to "up" to avoid endless polling loops while we lack
+    // real hardware bring-up.
+    constexpr uint32_t kBtmCbBase = 0x80336278u;
+    constexpr uint32_t kDevStateOffset = 0x64Eu;
+    try {
+        ::Memory::Write8(kBtmCbBase + kDevStateOffset, 5u);
+    } catch (const ::Memory::AccessViolation&) {
+        // Ignore; best-effort write
+    }
+
+    if (ctx) {
+        ctx->gpr[3] = 1;
+    }
+    return 1;
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801301B4, GKI_delay_HLE_801301b4, (CpuContext* ctx), (ctx));
+PPC_NATIVE_OVERRIDE(8013A300, BTM_IsDeviceUp_HLE_8013a300, uint32_t, (CpuContext* ctx), (ctx));
+
+// Serial Interface (SI) - GameCube controller ports; stubbed since we don't emulate the MMIO.
+
+// SIInit (0x801b2de0): skips MMIO setup at 0xCD006434 and controller detection.
+extern "C" void SIInit_801b2de0()
+{
+    RT_LOG(RT_TAG_OS) << "SIInit_801b2de0 called: skipping MMIO register setup and controller detection" << std::endl;
+}
+
+// SISetSamplingRate (0x801b3acc): ignored, we don't emulate SI polling timing.
+extern "C" void HLE_SISetSamplingRate_801b3acc(uint32_t msec)
+{
+    RT_LOG(RT_TAG_OS) << "HLE_SISetSamplingRate_801b3acc called: msec=" << msec << ": Stubbed success." << std::endl;
+}
+
+// Video Interface (VI) - TV output.
+
+// VIGetTvFormat (0x801bacd8): CRITICAL, must return 1 (VI_PAL) not 0, or PAL builds
+// misbehave/panic.
+extern "C" uint32_t HLE_VIGetTvFormat_801bacd8()
+{
+    // VI_NTSC = 0, VI_PAL = 1, VI_MPAL = 2
+    RT_LOG(RT_TAG_OS) << "HLE_VIGetTvFormat_801bacd8 called: returning VI_PAL (1)" << std::endl;
+    return 1;
+}
+
+REGISTER_NATIVE_FUNCTION(0x801B2DE0, SIInit_801b2de0);
+PPC_NATIVE_OVERRIDE_VOID(801B3ACC, HLE_SISetSamplingRate_801b3acc, (uint32_t msec), (msec));
+
+// OS____InitMemoryProtection (0x801A7DFC): real version touches MMU/MMIO we don't emulate;
+// no-op and return success so boot doesn't stall.
+extern "C" uint32_t OS____InitMemoryProtection_801a7dfc(uint32_t r3, uint32_t r4, uint32_t r5, uint32_t r6, uint32_t r7, uint32_t r8)
+{
+    RT_LOG(RT_TAG_OS) << "OS____InitMemoryProtection_801a7dfc called (stubbed): r3=0x" << std::hex << r3 << std::dec << std::endl;
+
+    return 0;
+}
+
+PPC_NATIVE_OVERRIDE(801A7DFC, OS____InitMemoryProtection_801a7dfc, uint32_t, (uint32_t r3, uint32_t r4, uint32_t r5, uint32_t r6, uint32_t r7, uint32_t r8), (r3, r4, r5, r6, r7, r8));
+
+// OSGetConsoleType (0x8019f33c): standard Wii = 0x12, NDEV (expanded MEM2) = 0x10000012;
+// MKWii uses the NDEV result to enable its extra-memory heap path.
+extern "C" uint32_t OS__GetConsoleType_8019f33c(uint32_t /*r4*/, uint32_t /*r5*/, uint32_t /*r6*/,
+                                                uint32_t /*r7*/, uint32_t /*r8*/, uint32_t /*r31*/)
+{
+    constexpr uint32_t kRetailMem2Size = 64u * 1024u * 1024u;
+    const uint32_t physicalMem2Size = Memory::Read32(0x80003118u);
+    const uint32_t consoleType =
+        physicalMem2Size == kRetailMem2Size ? 0x00000012u : 0x10000012u;
+    static std::atomic<bool> logged{false};
+    if (!logged.exchange(true)) {
+        RT_LOG(RT_TAG_OS) << "OSGetConsoleType: MEM2="
+                  << (physicalMem2Size / (1024u * 1024u))
+                  << " MB, returning 0x" << std::hex << consoleType << std::dec << std::endl;
+    }
+    return consoleType;
+}
+
+// Register the function
+PPC_NATIVE_OVERRIDE(8019F33C, OS__GetConsoleType_8019f33c, uint32_t, (uint32_t r4, uint32_t r5, uint32_t r6, uint32_t r7, uint32_t r8, uint32_t r31), (r4, r5, r6, r7, r8, r31));
+
+// OSGetResetCode (0x801a8a50): real version reads MMIO 0xCC003024; we always report
+// Cold Boot (0).
+extern "C" uint32_t OSGetResetCode_801a8a50()
+{
+    // Log occasionally just to track boot flow
+    static bool logged = false;
+    if (!logged) {
+        RT_LOG(RT_TAG_OS) << "OSGetResetCode_801a8a50 called: returning 0 (Cold Boot)" << std::endl;
+        logged = true;
+    }
+    return 0; 
+}
+
+// Register the function
+PPC_NATIVE_OVERRIDE(801A8A50, OSGetResetCode_801a8a50, uint32_t, (), ());
+
+// __OSInitSTM (0x801AB848): real version opens /dev/stm/* handles. We stub it by writing
+// fake handles and the success flag into the SDA (r13) block so OSResetSystem's checks pass.
+extern "C" uint32_t __OSInitSTM_HLE_801ab848(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    if (!cpu) return 0;
+
+    RT_LOG(RT_TAG_OS) << "__OSInitSTM_HLE_801ab848 called: initializing STM state" << std::endl;
+
+    // R13 (SDA2) holds the base for small data variables
+    const uint32_t r13 = cpu->gpr[13];
+    if (r13 == 0) {
+         RT_LOG(RT_TAG_OS) << "__OSInitSTM: Warning - R13 is 0, cannot write state." << std::endl;
+         return 0;
+    }
+
+    // Offsets from disassembly: r13-0x62cc=STM_Initialized, r13-0x62c8=/dev/stm/immediate,
+    // r13-0x62c4=/dev/stm/eventhook.
+    try {
+        // Mark STM as initialized
+        ::Memory::Write32(r13 - 0x62ccu, 1);
+
+        // Fake non-zero handles so callers' zero-checks pass.
+        ::Memory::Write32(r13 - 0x62c8u, 0x00535401); // "ST\x01"
+        ::Memory::Write32(r13 - 0x62c4u, 0x00535402); // "ST\x02"
+
+        // Default Power/Reset callback pointers are left unset; safe since we never fire
+        // the STM hardware interrupt that would invoke them.
+    } catch (const ::Memory::AccessViolation& e) {
+        RT_LOG(RT_TAG_OS) << "__OSInitSTM: Failed to write STM state to SDA @ 0x"
+                  << std::hex << e.address() << std::dec << " (" << e.reason() << ")" << std::endl;
+        return 0; // Return failure
+    }
+
+    // Return 1 (success)
+    return 1;
+}
+
+// Register the function
+PPC_NATIVE_OVERRIDE(801AB848, __OSInitSTM_HLE_801ab848, uint32_t, (CpuContext* ctx), (ctx));
+
+
+extern "C" void OS____PSInit_801a04a0()
+{
+    RT_LOG(RT_TAG_OS) << "OS____PSInit_801a04a0 called (stubbed)" << std::endl;
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A04A0, OS____PSInit_801a04a0, (), ());
+
+
+
+extern "C" void __init_hardware_80006348()
+{
+    RT_LOG(RT_TAG_OS) << "__init_hardware_80006348 called (stubbed)" << std::endl;
+}
+
+PPC_NATIVE_OVERRIDE_VOID(80006348,__init_hardware_80006348, (), ());
+
+
+// PPC SPR (Special Purpose Register) access stubs; these registers don't exist on x86 so
+// each one just logs and no-ops.
+
+// Each PPC_NATIVE_OVERRIDE_VOID line stays written out per stub (not looped) because the
+// translator text-scans them to decide which addresses to skip translating.
+#define PPC_SPR_STUB_BODY(name, message) \
+    extern "C" void name() { RT_LOG(RT_TAG_OS) << message << std::endl; }
+
+PPC_SPR_STUB_BODY(PPCMfhid0_8012e574, "PPCMfhid0 called (stubbed) - Move From HID0")
+PPC_NATIVE_OVERRIDE_VOID(8012e574, PPCMfhid0_8012e574, (), ());
+
+PPC_SPR_STUB_BODY(PPCMthid0_8012e57c, "PPCMthid0 called (stubbed) - Move To HID0")
+PPC_NATIVE_OVERRIDE_VOID(8012e57c, PPCMthid0_8012e57c, (), ());
+
+extern "C" void PPCMtdec_8012e594()
+{
+    static std::atomic<int> logCount{0};
+    if (logCount.fetch_add(1) < 4) {
+        RT_LOG(RT_TAG_OS) << "PPCMtdec called (stubbed) - Move To Decrementer" << std::endl;
+    }
+    // We don't simulate decrementer exceptions, so pump due alarms here instead. Capped at
+    // 32, not 1: a single alarm let unrelated periodic alarms backlog and delay
+    // AsyncDisplay's pacing alarm by multiple retraces.
+    OS_HLE_ProcessAlarms(32);
+}
+PPC_NATIVE_OVERRIDE_VOID(8012E594, PPCMtdec_8012e594, (), ());
+
+extern "C" void PPCSync_8012e59c()
+{
+    // PowerPC `sync`. Translated guest code runs on one host thread at a time
+    // and the runtime's own cross-thread state uses C++ atomics, so there is no
+    // guest-visible reordering for this barrier to prevent.
+}
+PPC_NATIVE_OVERRIDE_VOID(8012e59c, PPCSync_8012e59c, (), ());
+
+PPC_SPR_STUB_BODY(PPCMtmmcr0_8012e5b8, "PPCMtmmcr0 called (stubbed) - Move To MMCR0")
+PPC_NATIVE_OVERRIDE_VOID(8012e5b8, PPCMtmmcr0_8012e5b8, (), ());
+
+PPC_SPR_STUB_BODY(PPCMtmmcr1_8012e5c0, "PPCMtmmcr1 called (stubbed) - Move To MMCR1")
+PPC_NATIVE_OVERRIDE_VOID(8012e5c0, PPCMtmmcr1_8012e5c0, (), ());
+
+PPC_SPR_STUB_BODY(PPCMtpmc1_8012e5c8, "PPCMtpmc1 called (stubbed) - Move To PMC1")
+PPC_NATIVE_OVERRIDE_VOID(8012e5c8, PPCMtpmc1_8012e5c8, (), ());
+
+PPC_SPR_STUB_BODY(PPCMtpmc2_8012e5d0, "PPCMtpmc2 called (stubbed) - Move To PMC2")
+PPC_NATIVE_OVERRIDE_VOID(8012e5d0, PPCMtpmc2_8012e5d0, (), ());
+
+PPC_SPR_STUB_BODY(PPCMtpmc3_8012e5d8, "PPCMtpmc3 called (stubbed) - Move To PMC3")
+PPC_NATIVE_OVERRIDE_VOID(8012e5d8, PPCMtpmc3_8012e5d8, (), ());
+
+PPC_SPR_STUB_BODY(PPCMtpmc4_8012e5e0, "PPCMtpmc4 called (stubbed) - Move To PMC4")
+PPC_NATIVE_OVERRIDE_VOID(8012e5e0, PPCMtpmc4_8012e5e0, (), ());
+
+extern "C" uint32_t PPCMfhid2_8012e630_impl()
+{
+    if (CpuContext* cpu = TryGetCpuContext()) {
+        if (cpu->hid2 == 0) {
+            cpu->hid2 = 0x10000000u;
+        }
+        return cpu->hid2;
+    }
+    return 0x10000000u;
+}
+// Register the function using a return-value stub
+extern "C" void PPCMfhid2_HLE_8012e630(CpuContext* ctx)
+{
+    ctx->gpr[3] = PPCMfhid2_8012e630_impl();
+}
+REGISTER_TRANSLATED_FUNCTION(0x8012e630, PPCMfhid2_HLE_8012e630);
+
+extern "C" void PPCMthid2_8012e638(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    cpu->hid2 = cpu->gpr[3];
+
+    static std::atomic<int> logCount{0};
+    if (logCount.fetch_add(1) < 4) {
+        RT_LOG(RT_TAG_OS) << "PPCMthid2 set HID2=0x" << std::hex << cpu->hid2 << std::dec << std::endl;
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(8012e638, PPCMthid2_8012e638, (CpuContext* ctx), (ctx));
+
+PPC_SPR_STUB_BODY(PPCMfwpar_8012e640,
+                  "PPCMfwpar called (stubbed) - Move From Write Pipe Address Register")
+PPC_NATIVE_OVERRIDE_VOID(8012e640, PPCMfwpar_8012e640, (), ());
+
+PPC_SPR_STUB_BODY(PPCMtwpar_8012e64c,
+                  "PPCMtwpar called (stubbed) - Move To Write Pipe Address Register")
+PPC_NATIVE_OVERRIDE_VOID(8012e64c, PPCMtwpar_8012e64c, (), ());
+
+PPC_SPR_STUB_BODY(PPCDisableSpeculation_8012e654, "PPCDisableSpeculation called (stubbed)")
+PPC_NATIVE_OVERRIDE_VOID(8012e654, PPCDisableSpeculation_8012e654, (), ());
+
+PPC_SPR_STUB_BODY(PPCMthid4_8012e684, "PPCMthid4 called (stubbed) - Move To HID4")
+PPC_NATIVE_OVERRIDE_VOID(8012e684, PPCMthid4_8012e684, (), ());
diff --git a/runtime/src/hle/os/os_internal.h b/runtime/src/hle/os/os_internal.h
new file mode 100644
index 0000000..9b2b700
--- /dev/null
+++ b/runtime/src/hle/os/os_internal.h
@@ -0,0 +1,158 @@
+#pragma once
+
+// Shared internals for the OS HLE files in this directory. Everything here was
+// file-local state in the single OS HLE translation unit; it lives in a named
+// namespace so the split files can share one definition instead of duplicating
+// it, and the using-directive below keeps every call site unchanged.
+
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <iostream>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "runtime_log.h"
+
+namespace OsHleInternal {
+
+extern std::atomic<bool> g_interrupts_enabled;
+// Tracks the current interrupt mask bits; stored as a 32-bit value for MMIO
+// tracking on the guest side. Default to 0 (no bits masked on startup).
+// OS____MaskInterrupts returns the pre-call value to the guest, so this is
+// observable state, not just bookkeeping.
+extern std::atomic<uint32_t> g_interrupt_mask;
+
+constexpr uint32_t kInterruptHandlerTablePtrAddr = 0x803868f8u;
+constexpr uint32_t kInterruptHandlerTableAddr = 0x80003040u;
+constexpr size_t kInterruptHandlerTableBytes = 0x80u;
+constexpr uint32_t kInterruptMaskLoAddr = 0x800000c4u;
+constexpr uint32_t kInterruptMaskHiAddr = 0x800000c8u;
+constexpr uint32_t kOSPhysicalContextAddr = 0x800000c0u;
+constexpr uint32_t kOSCurrentContextAddr = 0x800000d4u;
+constexpr uint32_t kOSExceptionContextAddr = 0x800000d8u;
+constexpr uint32_t kThreadListHeadAddr = 0x800000dcu;    // First thread in thread list (for iteration)
+constexpr uint32_t kThreadListTailAddr = 0x800000e0u;    // Last added thread (tail of thread list)
+constexpr uint32_t kOSRunningContextAddr = 0x800000e4u;  // Currently running thread context
+
+constexpr uint32_t kDefaultThreadContextAddr = 0x80347498u;
+constexpr uint32_t kIdleThreadContextAddr = 0x803478b0u;
+constexpr uint32_t kThreadQueueArrayAddr = 0x803477b0u;
+constexpr size_t kThreadQueueArrayBytes = 0x100u;
+constexpr uint32_t kSwitchThreadCallbackPtrAddr = 0x80385ae0u;
+constexpr uint32_t kSchedulerReschedCounterAddr = 0x8038691cu;
+constexpr uint32_t kSchedulerPendingFlagAddr = 0x80386920u;
+// RVL OS uses this as the OSDisableScheduler/OSEnableScheduler nesting count.
+// SelectThread exits early while the count is non-zero.
+constexpr uint32_t kSchedulerIdleFlagAddr = 0x80386918u;
+constexpr uint32_t kAlarmQueueOffsetFromR13 = 0x6360u;
+
+constexpr uint32_t kThreadStateOffset = 0x2C8u;
+constexpr uint32_t kThreadAttrOffset = 0x2CAu;
+constexpr uint32_t kThreadSuspendOffset = 0x2CCu;
+constexpr uint32_t kThreadPriorityOffset = 0x2D0u;
+constexpr uint32_t kThreadBasePriorityOffset = 0x2D4u;
+constexpr uint32_t kThreadExitValueOffset = 0x2D8u;
+constexpr uint32_t kThreadQueueOffset = 0x2DCu;
+constexpr uint32_t kThreadNextOffset = 0x2E0u;
+constexpr uint32_t kThreadPrevOffset = 0x2E4u;
+constexpr uint32_t kThreadJoinQueueOffset = 0x2E8u;
+constexpr uint32_t kThreadMutexOffset = 0x2F0u;
+constexpr uint32_t kThreadMutexQueueOffset = 0x2F4u;
+constexpr uint32_t kThreadMutexTailOffset = 0x2F8u;
+constexpr uint32_t kThreadListNextOffset = 0x2FCu;
+constexpr uint32_t kThreadListPrevOffset = 0x300u;
+
+constexpr uint16_t kThreadStateReady = 1u;
+constexpr uint16_t kThreadStateRunning = 2u;
+constexpr uint16_t kThreadStateWaiting = 4u;
+constexpr uint16_t kThreadStateMoribund = 8u;
+constexpr int32_t kSuspendedWaitPriority = 32;
+
+// OSMessageQueue layout (Wii SDK): sendQueue@0x00, recvQueue@0x08 (OSThreadQueue head/tail),
+// msgArray@0x10, msgCount@0x14, firstIndex@0x18, usedCount@0x1C.
+constexpr uint32_t kMsgQueueSendOffset = 0x00u;
+constexpr uint32_t kMsgQueueRecvOffset = 0x08u;
+constexpr uint32_t kMsgQueueArrayOffset = 0x10u;
+constexpr uint32_t kMsgQueueCountOffset = 0x14u;
+constexpr uint32_t kMsgQueueFirstOffset = 0x18u;
+constexpr uint32_t kMsgQueueUsedOffset = 0x1Cu;
+
+constexpr uint32_t kMutexWaitQueueHeadOffset = 0x00u;
+constexpr uint32_t kMutexOwnerOffset = 0x08u;
+constexpr uint32_t kMutexCountOffset = 0x0Cu;
+constexpr uint32_t kMutexThreadNextOffset = 0x10u;
+constexpr uint32_t kMutexThreadPrevOffset = 0x14u;
+
+struct SleepTimerEntry {
+    uint32_t threadPtr;
+    std::chrono::steady_clock::time_point deadline;
+};
+
+inline bool ThreadStateIsTerminated(uint16_t state)
+{
+    return state == 0 || state == kThreadStateMoribund;
+}
+
+// Unlink `node` from a doubly linked guest list. `nextOff`/`prevOff` are the
+// node's link field offsets; `headAddr`/`tailAddr` are the list's head and tail
+// slots (a fixed OS global for the thread list, `queue`/`queue + 4` for an
+// OSThreadQueue, a thread field pair for the owned-mutex list).
+inline void UnlinkGuestListNode(uint32_t node, uint32_t nextOff, uint32_t prevOff,
+                                uint32_t headAddr, uint32_t tailAddr)
+{
+    const uint32_t next = ::Memory::Read32(node + nextOff);
+    const uint32_t prev = ::Memory::Read32(node + prevOff);
+
+    if (next != 0) {
+        ::Memory::Write32(next + prevOff, prev);
+    } else {
+        ::Memory::Write32(tailAddr, prev);
+    }
+
+    if (prev != 0) {
+        ::Memory::Write32(prev + nextOff, next);
+    } else {
+        ::Memory::Write32(headAddr, next);
+    }
+
+    ::Memory::Write32(node + nextOff, 0);
+    ::Memory::Write32(node + prevOff, 0);
+}
+
+// Defined in os_thread.cpp.
+void RemoveThreadFromQueue(uint32_t threadPtr);
+int32_t ComputeThreadEffectivePriority(uint32_t threadPtr);
+void InsertThreadIntoQueueByPriority(uint32_t queuePtr, uint32_t threadPtr, int32_t priority);
+uint32_t SetThreadEffectivePriority(uint32_t threadPtr, int32_t priority);
+
+// Defined in os_sleep.cpp.
+void CancelSleepTimer(uint32_t threadPtr);
+void ClearOutstandingPark(uint32_t threadPtr);
+bool ProcessSleepTimers(CpuContext* cpu);
+
+// Defined in os_alarm.cpp.
+bool ProcessAlarmQueue(CpuContext* cpu, int maxToProcess);
+
+// Defined in os_time.cpp.
+uint64_t ReadSystemTime();
+
+} // namespace OsHleInternal
+
+using namespace OsHleInternal;
+
+// Cross-file HLE entry points, declared here for the same reason they were
+// declared at the top of the old single OS translation unit: the OS subsystems
+// call into each other.
+extern "C" int32_t OS__DisableInterrupts_801a65ac();
+extern "C" int32_t OS__EnableInterrupts_801a65c0();
+extern "C" int32_t OS__RestoreInterrupts_801a65d4(int32_t level);
+extern "C" void OS__ClearContext_801a2098(uint32_t contextAddr);
+extern "C" void OS__SetCurrentContext_801a1e70(uint32_t contextAddr);
+extern "C" [[noreturn]] void OS__LoadContext_801a1f58(CpuContext* ctx);
+extern "C" void OSSuspendThread_HLE_801aa6a8(CpuContext* ctx);
+extern "C" void OSResumeThread_HLE_801aa58c(CpuContext* ctx);
+extern "C" void OSWakeupThread_HLE_801aaaa4(CpuContext* ctx);
+extern "C" void OSSleepThread_HLE_801aa9b8(CpuContext* ctx);
+extern "C" void SelectThread_801a9c08(CpuContext* ctx);
diff --git a/runtime/src/hle/os/os_interrupt.cpp b/runtime/src/hle/os/os_interrupt.cpp
new file mode 100644
index 0000000..29bc4c1
--- /dev/null
+++ b/runtime/src/hle/os/os_interrupt.cpp
@@ -0,0 +1,506 @@
+// Interrupt masking/dispatch plus the EXI/IPC hardware stubs that hang off it.
+
+#include <atomic>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <mutex>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+#include "os_internal.h"
+
+extern "C" uint32_t SetInterruptMask_801a66e0(uint32_t mask, uint32_t enable);
+
+namespace OsHleInternal {
+std::atomic<bool> g_interrupts_enabled{true};
+std::atomic<uint32_t> g_interrupt_mask{0};
+} // namespace OsHleInternal
+
+namespace {
+std::once_flag interrupt_init_log_once;
+std::once_flag exception_init_log_once;
+
+inline void UpdateCurrentContextInterruptFlag(bool enabled)
+{
+    // Both OSDisableInterrupts and OSRestoreInterrupts land here. A failed lookup means no
+    // context exists yet (normal during early boot), so we just skip the write in that case.
+    uint32_t currentContext = 0;
+    if (!MemoryInline::TryReadGuestScalar(kOSCurrentContextAddr, currentContext) ||
+        currentContext == 0) {
+        return;
+    }
+    const uint32_t modeFlagsAddr = currentContext + 0x1A2u;
+    uint16_t modeFlags = 0;
+    if (!MemoryInline::TryReadGuestScalar(modeFlagsAddr, modeFlags)) {
+        return;
+    }
+    const uint16_t updated = enabled ? static_cast<uint16_t>(modeFlags | 0x0002u)
+                                     : static_cast<uint16_t>(modeFlags & static_cast<uint16_t>(~0x0002u));
+    if (updated == modeFlags) {
+        return;
+    }
+    MemoryInline::TryWriteGuestScalar(modeFlagsAddr, updated);
+}
+} // namespace
+
+// Minimal, host-side replacements for early OS interrupt/exception helpers.
+extern "C" int32_t OS__DisableInterrupts_801a65ac()
+{
+    const bool previous = g_interrupts_enabled.exchange(false);
+    UpdateCurrentContextInterruptFlag(false);
+    return previous ? 1 : 0;
+}
+
+extern "C" int32_t OS__RestoreInterrupts_801a65d4(int32_t level)
+{
+    const bool prev = g_interrupts_enabled.exchange(level != 0);
+    UpdateCurrentContextInterruptFlag(level != 0);
+    return prev ? 1 : 0;
+}
+
+extern "C" int32_t OS__EnableInterrupts_801a65c0()
+{
+    const bool prev = g_interrupts_enabled.exchange(true);
+    UpdateCurrentContextInterruptFlag(true);
+    return prev ? 1 : 0;
+}
+
+bool OS_HLE_InterruptsEnabled() noexcept
+{
+    return g_interrupts_enabled.load(std::memory_order_acquire);
+}
+
+extern "C" uint32_t OS____InterruptInit_801a661c(uint32_t r3, uint32_t r4, uint32_t r5, uint32_t r6, uint32_t r7, uint32_t r8)
+{
+    (void)r3;
+    (void)r4;
+    (void)r5;
+    (void)r6;
+    (void)r7;
+    (void)r8;
+
+    std::call_once(interrupt_init_log_once, [&]() {
+        RT_LOG(RT_TAG_OS) << "OS____InterruptInit_801a661c called: r3=" << r3 << " r4=" << r4 << " r5=" << r5
+                  << " r6=" << r6 << " r7=" << r7 << " r8=" << r8 << std::endl;
+        RT_LOG(RT_TAG_OS) << "OSInterruptInit: skipped hardware MMIO setup; marking interrupts initialized" << std::endl;
+    });
+
+    // Keep interrupts disabled until RestoreInterrupts decides otherwise.
+    g_interrupts_enabled.store(false);
+
+    try {
+        // Initialize interrupt vector table pointer and clear the table (0x20 entries).
+        ::Memory::Write32(kInterruptHandlerTablePtrAddr, kInterruptHandlerTableAddr);
+        if (auto* table = ::Memory::GetPointer(kInterruptHandlerTableAddr, kInterruptHandlerTableBytes)) {
+            std::memset(table, 0, kInterruptHandlerTableBytes);
+        } else {
+            for (size_t offset = 0; offset < kInterruptHandlerTableBytes; offset += 4) {
+                ::Memory::Write32(kInterruptHandlerTableAddr + static_cast<uint32_t>(offset), 0);
+            }
+        }
+
+        // Reset interrupt mask state tracked in guest memory and our host mirror.
+        ::Memory::Write32(kInterruptMaskLoAddr, 0);
+        ::Memory::Write32(kInterruptMaskHiAddr, 0);
+        g_interrupt_mask.store(0);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OS____InterruptInit_801a661c", e);
+    }
+
+    return 0;
+}
+
+extern "C" uint32_t OS__ExceptionInit_801a00e0(uint32_t r3, uint32_t r4, uint32_t r5, uint32_t r6, uint32_t r7, uint32_t r8, uint32_t r20)
+{
+    (void)r3;
+    (void)r4;
+    (void)r5;
+    (void)r6;
+    (void)r7;
+    (void)r8;
+    (void)r20;
+
+    std::call_once(exception_init_log_once, [&]() {
+        RT_LOG(RT_TAG_OS) << "OS__ExceptionInit_801a00e0 called: r3=" << r3 << " r4=" << r4 << " r5=" << r5
+                  << " r6=" << r6 << " r7=" << r7 << " r8=" << r8 << " r20=" << r20 << std::endl;
+        RT_LOG(RT_TAG_OS) << "OSExceptionInit: skipped exception vector setup" << std::endl;
+    });
+    return 0;
+}
+
+extern "C" uint32_t __OSSetInterruptHandler_801a65f8_hle(uint32_t interrupt, uint32_t handler)
+{
+    constexpr uint32_t kMaxInterrupts = 32;
+
+    uint32_t tableBase = 0;
+    try {
+        tableBase = ::Memory::Read32(kInterruptHandlerTablePtrAddr);
+    } catch (const ::Memory::AccessViolation&) {
+        tableBase = 0;
+    }
+
+    if (tableBase == 0) {
+        tableBase = kInterruptHandlerTableAddr;
+        try {
+            ::Memory::Write32(kInterruptHandlerTablePtrAddr, tableBase);
+        } catch (const ::Memory::AccessViolation&) {
+            // If we cannot write the pointer, fail gracefully.
+        }
+    }
+
+    if (interrupt >= kMaxInterrupts) {
+        return 0;
+    }
+
+    const uint32_t entryAddr = tableBase + interrupt * 4u;
+    uint32_t previous = 0;
+    try {
+        previous = ::Memory::Read32(entryAddr);
+        ::Memory::Write32(entryAddr, handler);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "__OSSetInterruptHandler_801a65f8", e);
+    }
+
+    return previous;
+}
+
+extern "C" uint32_t __OSUnmaskInterrupts_801a69bc_hle(uint32_t mask)
+{
+    const int32_t level = OS__DisableInterrupts_801a65ac();
+
+    uint32_t previous = 0;
+    try {
+        const uint32_t loMask = ::Memory::Read32(kInterruptMaskLoAddr);
+        const uint32_t hiMask = ::Memory::Read32(kInterruptMaskHiAddr);
+        previous = loMask;
+
+        const uint32_t newLo = loMask & ~mask;
+        ::Memory::Write32(kInterruptMaskLoAddr, newLo);
+        g_interrupt_mask.store(newLo);
+
+        const uint32_t combinedBefore = loMask | hiMask;
+        const uint32_t combinedAfter = newLo | hiMask;
+        for (uint32_t pending = mask & combinedBefore; pending != 0; pending = SetInterruptMask_801a66e0(pending, combinedAfter)) {
+        }
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "__OSUnmaskInterrupts_801a69bc", e);
+    }
+
+    OS__RestoreInterrupts_801a65d4(level);
+    return previous;
+}
+
+// EXI: early hardware init touches Hollywood registers (0xCD00xxxx). Provide a no-op stub.
+extern "C" uint32_t EXIInit_80168fa0()
+{
+    RT_LOG(RT_TAG_OS) << "EXIInit_80168fa0 called: skipping MMIO register setup" << std::endl;
+    return 0;
+}
+
+// ----------------------------------------------------------------------------
+// Interrupt Controller - Mask/Unmask Hardware Interrupts
+// ----------------------------------------------------------------------------
+
+// SetInterruptMask (0x801a66e0): stub for Hollywood interrupt controller MMIO we don't emulate.
+// Callers loop on this until it returns 0, so always return 0 to break the loop.
+extern "C" uint32_t SetInterruptMask_801a66e0(uint32_t mask, uint32_t enable)
+{
+    // Keep the state tracking (useful for debugging)
+    static std::atomic<int> call_count{0};
+    const int prev_count = call_count.fetch_add(1);
+
+    uint32_t old_mask = g_interrupt_mask.load();
+    uint32_t new_mask = old_mask;
+    if (enable) {
+        new_mask = old_mask | mask;
+    } else {
+        new_mask = old_mask & ~mask;
+    }
+    g_interrupt_mask.store(new_mask);
+
+    // Log occasionally
+    if (prev_count < 8 || (prev_count & 0x3FF) == 0) {
+        RT_LOG(RT_TAG_OS) << "SetInterruptMask_801a66e0 called: mask=0x" << std::hex << mask << std::dec
+                  << " enable=" << enable
+                  << " (forcing return 0 to break loop)" << std::endl;
+    }
+    return 0;
+}
+
+PPC_NATIVE_OVERRIDE(801A65AC, OS__DisableInterrupts_801a65ac, int32_t, (), ());
+PPC_NATIVE_OVERRIDE(801A65C0, OS__EnableInterrupts_801a65c0, int32_t, (), ());
+PPC_NATIVE_OVERRIDE(801A65D4, OS__RestoreInterrupts_801a65d4, int32_t, (int32_t level), (level));
+PPC_NATIVE_OVERRIDE(801A661C, OS____InterruptInit_801a661c, uint32_t, (uint32_t r3, uint32_t r4, uint32_t r5, uint32_t r6, uint32_t r7, uint32_t r8), (r3, r4, r5, r6, r7, r8));
+PPC_NATIVE_OVERRIDE(801A66E0, SetInterruptMask_801a66e0, uint32_t, (uint32_t mask, uint32_t enable), (mask, enable));
+PPC_NATIVE_OVERRIDE(801A00E0, OS__ExceptionInit_801a00e0, uint32_t, (uint32_t r3, uint32_t r4, uint32_t r5, uint32_t r6, uint32_t r7, uint32_t r8, uint32_t r20), (r3, r4, r5, r6, r7, r8, r20));
+PPC_NATIVE_OVERRIDE(80168FA0, EXIInit_80168fa0, uint32_t, (), ());
+REGISTER_NATIVE_FUNCTION(0x801A65F8, __OSSetInterruptHandler_801a65f8_hle);
+REGISTER_NATIVE_FUNCTION(0x801A69BC, __OSUnmaskInterrupts_801a69bc_hle);
+
+// OS____MaskInterrupts (0x801a693c): stubbed out because its verification loop reads MMIO
+// registers we don't emulate, which would spin forever.
+extern "C" uint32_t OS____MaskInterrupts_801a693c(uint32_t mask, uint32_t unmask)
+{
+    static std::atomic<int> call_count{0};
+    const int count = call_count.fetch_add(1);
+    
+    if (count < 5) {
+        RT_LOG(RT_TAG_OS) << "OS____MaskInterrupts_801a693c called: mask=0x" << std::hex << mask
+                  << " unmask=0x" << unmask << std::dec 
+                  << " (stubbed to prevent MMIO verification loop)" << std::endl;
+    }
+    
+    // Update our internal mask state
+    uint32_t old_mask = g_interrupt_mask.load();
+    uint32_t new_mask = old_mask;
+    
+    if (unmask) {
+        new_mask = old_mask & ~mask;  // Clear bits
+    } else {
+        new_mask = old_mask | mask;   // Set bits
+    }
+    
+    g_interrupt_mask.store(new_mask);
+    
+    // Return the previous mask state
+    return old_mask;
+}
+
+PPC_NATIVE_OVERRIDE(801A693C, OS____MaskInterrupts_801a693c, uint32_t, (uint32_t mask, uint32_t unmask), (mask, unmask));
+
+// ----------------------------------------------------------------------------
+// EXISelect / EXIDeselect - HLE Stubs (0x801689d0 / 0x80168b00)
+// Real implementation touches MMIO at 0xCD0068xx; stub returns 1 (success).
+// ----------------------------------------------------------------------------
+
+extern "C" uint32_t EXISelect_801689d0(uint32_t channel, uint32_t device, uint32_t frequency)
+{
+    // Log occasionally to avoid spam if polled frequently
+    static int log_counter = 0;
+    if (log_counter++ < 10) {
+        RT_LOG(RT_TAG_OS) << "EXISelect_801689d0 called: channel=" << channel
+                  << " device=" << device << " freq=" << frequency 
+                  << " (stubbed success)" << std::endl;
+    }
+    return 1; // Return 1 (true) to indicate successful selection
+}
+
+// Body for the EXI stubs that take only a channel and report success: the real
+// ops drive Hollywood MMIO we do not emulate, and the callers loop until they
+// see success. Each keeps its own log budget and wording; the registrations
+// stay spelled out below because the translator scans them by text.
+#define EXI_CHANNEL_STUB(name, logLimit, channelLabel)                    \
+    extern "C" uint32_t name(uint32_t channel)                            \
+    {                                                                     \
+        static int log_count = 0;                                         \
+        if (log_count++ < (logLimit)) {                                   \
+            RT_LOG(RT_TAG_OS) << #name " called: " channelLabel           \
+                      << channel << " (stubbed success)" << std::endl;    \
+        }                                                                 \
+        return 1;                                                         \
+    }
+
+EXI_CHANNEL_STUB(EXIDeselect_80168b00, 10, "channel=")
+
+// Register the functions
+PPC_NATIVE_OVERRIDE(801689D0, EXISelect_801689d0, uint32_t, (uint32_t channel, uint32_t device, uint32_t frequency), (channel, device, frequency));
+PPC_NATIVE_OVERRIDE(80168B00, EXIDeselect_80168b00, uint32_t, (uint32_t channel), (channel));
+
+// ----------------------------------------------------------------------------
+// SetExiInterruptMask (0x80167e78): stubbed no-op, our fake EXI devices need no interrupt masking.
+// ----------------------------------------------------------------------------
+extern "C" void SetExiInterruptMask_80167e78(uint32_t channel, uint32_t exi_struct_ptr)
+{
+    // channel: r3 (0, 1, 2)
+    // exi_struct_ptr: r4
+    // This function is void and typically just modifies internal OS masks.
+    // We treat it as a successful no-op.
+}
+
+// Register the function
+PPC_NATIVE_OVERRIDE_VOID(80167E78, SetExiInterruptMask_80167e78, (uint32_t channel, uint32_t exi_struct_ptr), (channel, exi_struct_ptr));
+
+// ----------------------------------------------------------------------------
+// EXI Transaction Stubs (Imm, Dma, Sync, Unlock)
+// ----------------------------------------------------------------------------
+
+// RVL__EXIImm / EXIImm
+// Address: 0x80167f68
+// Behavior: Performs an Immediate transfer (1-4 bytes) over EXI.
+//           Stub: Return 1 (success). If it's a read, we clear the buffer.
+extern "C" uint32_t EXIImm_80167f68(uint32_t channel, uint32_t buffer, uint32_t length, uint32_t type, uint32_t callback)
+{
+    // type: 0=Read, 1=Write, 2=RW
+    // If reading, clear the destination buffer to 0 to be safe.
+    if (type == 0 || type == 2) {
+        try {
+            for (uint32_t i = 0; i < length; ++i) {
+                ::Memory::Write8(buffer + i, 0);
+            }
+        } catch (...) {
+            RT_LOG(RT_TAG_OS) << "EXIImm: Failed to write to guest buffer 0x" << std::hex << buffer << std::dec << std::endl;
+        }
+    }
+    
+    // Log only occasionally
+    static int log_count = 0;
+    if (log_count++ < 5) {
+        RT_LOG(RT_TAG_OS) << "EXIImm_80167f68 called: chan=" << channel << " len=" << length << " type=" << type << " (stubbed success)" << std::endl;
+    }
+    return 1; // Success
+}
+
+// RVL__EXIDma / EXIDma
+// Address: 0x80168288
+// Behavior: Performs a DMA transfer over EXI.
+//           Stub: Return 1 (success).
+extern "C" uint32_t EXIDma_80168288(uint32_t channel, uint32_t buffer, uint32_t length, uint32_t type, uint32_t callback)
+{
+    static int log_count = 0;
+    if (log_count++ < 5) {
+        RT_LOG(RT_TAG_OS) << "EXIDma_80168288 called: chan=" << channel << " len=" << length << " (stubbed success)" << std::endl;
+    }
+    return 1; // Success
+}
+
+// RVL__EXISync / EXISync
+// Address: 0x80168380
+// Behavior: Waits for the current EXI transfer to complete.
+//           Stub: Return 1 (success) immediately.
+EXI_CHANNEL_STUB(EXISync_80168380, 5, "chan=")
+
+// RVL__EXIUnlock / EXIUnlock
+// Address: 0x80169260
+// Behavior: Unlocks the EXI channel and triggers any pending callbacks.
+//           Stub: Return 1 (success) to bypass internal callback logic that causes the 0x0 crash.
+EXI_CHANNEL_STUB(EXIUnlock_80169260, 5, "chan=")
+
+// ----------------------------------------------------------------------------
+// OSSetPowerCallback (0x801AB75C): sets the power-button callback pointer in the SDA (r13);
+// the real STM/IOS registration is stubbed.
+// ----------------------------------------------------------------------------
+extern "C" uint32_t OSSetPowerCallback_801ab75c(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    if (!cpu) return 0;
+
+    const uint32_t newCallback = cpu->gpr[3];
+    const uint32_t r13 = cpu->gpr[13];
+
+    // Assembly defines the default callback address as (0x801b0000 - 0x43f4)
+    constexpr uint32_t kDefaultCallbackAddr = 0x801b0000u - 0x43f4u; // 0x801abc0c
+
+    // Offsets from R13 (SDA2)
+    const uint32_t kCallbackPtrAddr = r13 - 0x62b8u;
+    const uint32_t kHandlerActiveAddr = r13 - 0x62c0u;
+
+    RT_LOG(RT_TAG_OS) << "OSSetPowerCallback_801ab75c called: newCB=0x"
+              << std::hex << newCallback << std::dec << std::endl;
+
+    // 1. Disable Interrupts (Preserve atomicity as per SDK)
+    int32_t oldLevel = OS__DisableInterrupts_801a65ac();
+
+    uint32_t oldCallback = kDefaultCallbackAddr;
+
+    try {
+        // 2. Read the current callback
+        if (::Memory::Contains(kCallbackPtrAddr, 4)) {
+            oldCallback = ::Memory::Read32(kCallbackPtrAddr);
+        }
+
+        // 3. Update to the new callback (or reset to default if nullptr passed)
+        uint32_t callbackToWrite = (newCallback != 0) ? newCallback : kDefaultCallbackAddr;
+        ::Memory::Write32(kCallbackPtrAddr, callbackToWrite);
+
+        // 4. Simulate STM Event Handler Registration
+        // Real code calls IOS_IoctlAsync here. We just set the flag to 1 
+        // to pretend the event handler was successfully registered.
+        uint32_t isActive = ::Memory::Read32(kHandlerActiveAddr);
+        if (isActive == 0) {
+            ::Memory::Write32(kHandlerActiveAddr, 1);
+        }
+
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSSetPowerCallback", e);
+    }
+
+    // 5. Restore Interrupts
+    OS__RestoreInterrupts_801a65d4(oldLevel);
+
+    // 6. Return logic: If old callback was default, return NULL. Otherwise return old address.
+    if (oldCallback == kDefaultCallbackAddr) {
+        return 0;
+    }
+    return oldCallback;
+}
+
+// Register the function
+PPC_NATIVE_OVERRIDE(801AB75C, OSSetPowerCallback_801ab75c, uint32_t, (CpuContext* ctx), (ctx));
+
+PPC_NATIVE_OVERRIDE(80167F68, EXIImm_80167f68, uint32_t, (uint32_t channel, uint32_t buffer, uint32_t length, uint32_t type, uint32_t callback), (channel, buffer, length, type, callback));
+PPC_NATIVE_OVERRIDE(80168288, EXIDma_80168288, uint32_t, (uint32_t channel, uint32_t buffer, uint32_t length, uint32_t type, uint32_t callback), (channel, buffer, length, type, callback));
+PPC_NATIVE_OVERRIDE(80168380, EXISync_80168380, uint32_t, (uint32_t channel), (channel));
+PPC_NATIVE_OVERRIDE(80169260, EXIUnlock_80169260, uint32_t, (uint32_t channel), (channel));
+
+// ----------------------------------------------------------------------------
+// IPC Register Access Stubs (0x80193020 write / 0x80193010 read): Broadway-IOS MMIO,
+// unmapped here, so abort loudly instead of crashing silently.
+// ----------------------------------------------------------------------------
+
+extern "C" void IPCWriteReg_80193020(uint32_t index, uint32_t value)
+{
+    // index: Register index (0=Command, 1=Result, 2=Control, etc.)
+    // value: 32-bit value to write
+    // CRASH: We need to identify callers and stub them at a higher level
+    RT_LOG(RT_TAG_OS) << "IPCWriteReg_80193020 called: idx=" << index
+              << " val=0x" << std::hex << value << std::dec << std::endl;
+    RT_LOG(RT_TAG_OS) << "IPC hardware access detected - stub the caller instead!" << std::endl;
+    std::fflush(stderr);
+    std::abort();
+}
+
+extern "C" uint32_t IPCReadReg_80193010(uint32_t index)
+{
+    // index: Register index
+    // CRASH: We need to identify callers and stub them at a higher level
+    RT_LOG(RT_TAG_OS) << "IPCReadReg_80193010 called: idx=" << index << std::endl;
+    RT_LOG(RT_TAG_OS) << "IPC hardware access detected - stub the caller instead!" << std::endl;
+    std::fflush(stderr);
+    std::abort();
+}
+
+// Register the functions
+PPC_NATIVE_OVERRIDE_VOID(80193020, IPCWriteReg_80193020, (uint32_t index, uint32_t value), (index, value));
+PPC_NATIVE_OVERRIDE(80193010, IPCReadReg_80193010, uint32_t, (uint32_t index), (index));
+
+// ----------------------------------------------------------------------------
+// IPCCltInit (0x80193478): hardware parts (interrupt handler, MMIO) are stubbed, but we still
+// call translated IPCInit (0x80192F7C) to init the IPC buffer globals; skip it and
+// IPCGetBufferLo/Hi return 0, so ISFS_OpenLib fails with "APP ERROR: Not enough IPC arena".
+// ----------------------------------------------------------------------------
+extern "C" int32_t IPCCltInit_80193478(CpuContext* ctx)
+{
+    RT_LOG(RT_TAG_OS) << "IPCCltInit_80193478 called: calling IPCInit for buffer setup" << std::endl;
+    
+    // Sets 0x803867EC/F0/E8 (IPC buffer lo/hi + init flag) from __OSGetIPCBufferLo/Hi.
+    InvokeIndirectCpu(0x80192F7Cu, ctx);
+
+    // Advance the buffer lo pointer by 0x1000 (iosHeap size), matching real IPCCltInit.
+    uint32_t bufferLo = Memory::Read32(ctx->gpr[13] + -25620); // 0x803867EC at r13-0x6414
+    uint32_t newBufLo = bufferLo + 0x1000; // Advance by 4KB for iosHeap
+    Memory::Write32(ctx->gpr[13] + -25620, newBufLo);
+    
+    RT_LOG(RT_TAG_OS) << "IPCCltInit: IPC buffer lo advanced from 0x" << std::hex << bufferLo
+              << " to 0x" << newBufLo << std::dec << std::endl;
+    
+    // Skip the rest (interrupt handler, IPC MMIO access) - those are hardware-specific
+    return 0; // Success
+}
+
+PPC_NATIVE_OVERRIDE(80193478, IPCCltInit_80193478, int32_t, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/os/os_message.cpp b/runtime/src/hle/os/os_message.cpp
new file mode 100644
index 0000000..94b0fe0
--- /dev/null
+++ b/runtime/src/hle/os/os_message.cpp
@@ -0,0 +1,218 @@
+// OSMessageQueue HLE.
+
+#include <cstdint>
+#include <iostream>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+#include "os_internal.h"
+
+// ============================================================================
+// OSMessageQueue HLE
+// ============================================================================
+extern "C" void OS__InitMessageQueue_HLE_801a72fc(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t queuePtr = cpu->gpr[3];
+    const uint32_t msgArrayPtr = cpu->gpr[4];
+    const uint32_t msgCount = cpu->gpr[5];
+
+    if (queuePtr == 0) {
+        return;
+    }
+
+    try {
+        // Clear send/recv thread queues
+        ::Memory::Write32(queuePtr + kMsgQueueSendOffset + 0u, 0);
+        ::Memory::Write32(queuePtr + kMsgQueueSendOffset + 4u, 0);
+        ::Memory::Write32(queuePtr + kMsgQueueRecvOffset + 0u, 0);
+        ::Memory::Write32(queuePtr + kMsgQueueRecvOffset + 4u, 0);
+
+        ::Memory::Write32(queuePtr + kMsgQueueArrayOffset, msgArrayPtr);
+        ::Memory::Write32(queuePtr + kMsgQueueCountOffset, msgCount);
+        ::Memory::Write32(queuePtr + kMsgQueueFirstOffset, 0);
+        ::Memory::Write32(queuePtr + kMsgQueueUsedOffset, 0);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OS__InitMessageQueue", e);
+    }
+}
+REGISTER_NATIVE_FUNCTION(0x801A72FC, OS__InitMessageQueue_HLE_801a72fc);
+
+static bool MsgQueueIsFull(uint32_t queuePtr)
+{
+    const uint32_t used = ::Memory::Read32(queuePtr + kMsgQueueUsedOffset);
+    const uint32_t count = ::Memory::Read32(queuePtr + kMsgQueueCountOffset);
+    return count != 0 && used >= count;
+}
+
+static bool MsgQueueIsEmpty(uint32_t queuePtr)
+{
+    const uint32_t used = ::Memory::Read32(queuePtr + kMsgQueueUsedOffset);
+    return used == 0;
+}
+
+static void MsgQueueEnqueue(uint32_t queuePtr, uint32_t msg)
+{
+    const uint32_t arrayPtr = ::Memory::Read32(queuePtr + kMsgQueueArrayOffset);
+    const uint32_t count = ::Memory::Read32(queuePtr + kMsgQueueCountOffset);
+    uint32_t first = ::Memory::Read32(queuePtr + kMsgQueueFirstOffset);
+    uint32_t used = ::Memory::Read32(queuePtr + kMsgQueueUsedOffset);
+
+    if (count == 0) {
+        return;
+    }
+
+    const uint32_t index = (first + used) % count;
+    ::Memory::Write32(arrayPtr + index * 4u, msg);
+    ::Memory::Write32(queuePtr + kMsgQueueUsedOffset, used + 1u);
+}
+
+static void MsgQueueJam(uint32_t queuePtr, uint32_t msg)
+{
+    const uint32_t arrayPtr = ::Memory::Read32(queuePtr + kMsgQueueArrayOffset);
+    const uint32_t count = ::Memory::Read32(queuePtr + kMsgQueueCountOffset);
+    uint32_t first = ::Memory::Read32(queuePtr + kMsgQueueFirstOffset);
+    uint32_t used = ::Memory::Read32(queuePtr + kMsgQueueUsedOffset);
+
+    if (count == 0) {
+        return;
+    }
+
+    first = (first == 0) ? (count - 1u) : (first - 1u);
+    ::Memory::Write32(arrayPtr + first * 4u, msg);
+    ::Memory::Write32(queuePtr + kMsgQueueFirstOffset, first);
+    ::Memory::Write32(queuePtr + kMsgQueueUsedOffset, used + 1u);
+}
+
+static uint32_t MsgQueueDequeue(uint32_t queuePtr)
+{
+    const uint32_t arrayPtr = ::Memory::Read32(queuePtr + kMsgQueueArrayOffset);
+    const uint32_t count = ::Memory::Read32(queuePtr + kMsgQueueCountOffset);
+    uint32_t first = ::Memory::Read32(queuePtr + kMsgQueueFirstOffset);
+    uint32_t used = ::Memory::Read32(queuePtr + kMsgQueueUsedOffset);
+
+    if (count == 0 || used == 0) {
+        return 0;
+    }
+
+    const uint32_t msg = ::Memory::Read32(arrayPtr + first * 4u);
+    first = (first + 1u) % count;
+    ::Memory::Write32(queuePtr + kMsgQueueFirstOffset, first);
+    ::Memory::Write32(queuePtr + kMsgQueueUsedOffset, used - 1u);
+    return msg;
+}
+
+namespace {
+// Shared blocking-loop body for OSSendMessage/OSJamMessage/OSReceiveMessage: with interrupts
+// off, wait for the queue shape the op needs, apply it, wake the opposite queue, and return 1,
+// or return 0 immediately if non-blocking. Only the predicate/action/offsets differ per caller.
+template <typename Ready, typename Apply>
+int32_t MsgQueueOp(CpuContext* cpu, const char* who, uint32_t queuePtr, bool block,
+                   Ready ready, Apply apply, uint32_t wakeOffset, uint32_t blockOffset)
+{
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+
+    while (true) {
+        try {
+            if (ready(queuePtr)) {
+                apply(queuePtr);
+                cpu->gpr[3] = queuePtr + wakeOffset;
+                OSWakeupThread_HLE_801aaaa4(cpu);
+                cpu->gpr[3] = 1;
+                OS__RestoreInterrupts_801a65d4(irqState);
+                return 1;
+            }
+        } catch (const ::Memory::AccessViolation& e) {
+            LogMemoryError(RT_TAG_OS, who, e);
+            cpu->gpr[3] = 0;
+            OS__RestoreInterrupts_801a65d4(irqState);
+            return 0;
+        }
+
+        if (!block) {
+            cpu->gpr[3] = 0;
+            OS__RestoreInterrupts_801a65d4(irqState);
+            return 0;
+        }
+
+        cpu->gpr[3] = queuePtr + blockOffset;
+        OSSleepThread_HLE_801aa9b8(cpu);
+    }
+}
+} // namespace
+
+extern "C" int32_t OS__SendMessage_HLE_801a735c(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t queuePtr = cpu->gpr[3];
+    const uint32_t msg = cpu->gpr[4];
+    const uint32_t flags = cpu->gpr[5];
+    const bool block = (flags & 1u) != 0;
+
+    if (queuePtr == 0) {
+        cpu->gpr[3] = 0;
+        return 0;
+    }
+
+    // Append, then wake receivers blocked on the receive queue (offset 0x08);
+    // a full queue parks this thread on the send queue.
+    return MsgQueueOp(
+        cpu, "OS__SendMessage", queuePtr, block,
+        [](uint32_t queue) { return !MsgQueueIsFull(queue); },
+        [msg](uint32_t queue) { MsgQueueEnqueue(queue, msg); },
+        kMsgQueueRecvOffset, kMsgQueueSendOffset);
+}
+REGISTER_NATIVE_FUNCTION(0x801A735C, OS__SendMessage_HLE_801a735c);
+
+extern "C" int32_t OS__ReceiveMessage_HLE_801a7424(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t queuePtr = cpu->gpr[3];
+    const uint32_t outMsgPtr = cpu->gpr[4];
+    const uint32_t flags = cpu->gpr[5];
+    const bool block = (flags & 1u) != 0;
+
+    if (queuePtr == 0) {
+        cpu->gpr[3] = 0;
+        return 0;
+    }
+
+    // Pop, then wake senders now that there is space; an empty queue parks this
+    // thread on the receive queue.
+    return MsgQueueOp(
+        cpu, "OS__ReceiveMessage", queuePtr, block,
+        [](uint32_t queue) { return !MsgQueueIsEmpty(queue); },
+        [outMsgPtr](uint32_t queue) {
+            const uint32_t msg = MsgQueueDequeue(queue);
+            if (outMsgPtr != 0) {
+                ::Memory::Write32(outMsgPtr, msg);
+            }
+        },
+        kMsgQueueSendOffset, kMsgQueueRecvOffset);
+}
+REGISTER_NATIVE_FUNCTION(0x801A7424, OS__ReceiveMessage_HLE_801a7424);
+
+extern "C" int32_t OS__JamMessage_HLE_801a7500(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t queuePtr = cpu->gpr[3];
+    const uint32_t msg = cpu->gpr[4];
+    const uint32_t flags = cpu->gpr[5];
+    const bool block = (flags & 1u) != 0;
+
+    if (queuePtr == 0) {
+        cpu->gpr[3] = 0;
+        return 0;
+    }
+
+    // Prepend instead of append; otherwise identical to OSSendMessage.
+    return MsgQueueOp(
+        cpu, "OS__JamMessage", queuePtr, block,
+        [](uint32_t queue) { return !MsgQueueIsFull(queue); },
+        [msg](uint32_t queue) { MsgQueueJam(queue, msg); },
+        kMsgQueueRecvOffset, kMsgQueueSendOffset);
+}
+REGISTER_NATIVE_FUNCTION(0x801A7500, OS__JamMessage_HLE_801a7500);
diff --git a/runtime/src/hle/os/os_report.cpp b/runtime/src/hle/os/os_report.cpp
new file mode 100644
index 0000000..78facb4
--- /dev/null
+++ b/runtime/src/hle/os/os_report.cpp
@@ -0,0 +1,181 @@
+// OSReport formatting/logging.
+
+#include <cstdint>
+#include <iostream>
+#include <string>
+#include <vector>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "hle_stubs.h"
+#include "hle/guest_printf.h"
+#include "ppc_runtime.h"
+#include "system_bridge.h"
+
+// Thread-local cache used to store host-side copies of guest strings so we can
+// safely return const char* pointers that remain valid for the duration of a
+// single OSReport call. OS__Report will clear this each time it's invoked.
+static thread_local std::vector<std::string> g_guest_string_cache;
+
+// Forward declaration for the helper used by the formatter.
+static const char* GetGuestString(uint32_t guestAddr);
+
+// ============================================================================
+// OSReport Implementation
+// ============================================================================
+
+// ----------------------------------------------------------------------------
+// OSReport formatting helpers
+// ----------------------------------------------------------------------------
+
+struct OsReportVarArgState {
+    CpuContext* cpu = nullptr;
+    size_t gprIndex = 0; // r4 maps to index 0
+    size_t fprIndex = 0; // f1 maps to index 0
+    bool missingArgWarned = false;
+};
+
+static uint32_t NextOsReportU32(OsReportVarArgState& state)
+{
+    if (state.cpu && state.gprIndex < 7) {
+        return state.cpu->gpr[4 + state.gprIndex++];
+    }
+    if (state.cpu) {
+        const uint32_t stackArg = state.cpu->gpr[1] + 8u +
+                                  static_cast<uint32_t>((state.gprIndex++ - 7u) * 4u);
+        try {
+            return Memory::Read32(stackArg);
+        } catch (const Memory::AccessViolation&) {
+        }
+    }
+    if (!state.missingArgWarned) {
+        std::cout << "[OSReport] warning: missing GPR vararg; defaulting to 0" << std::endl;
+        state.missingArgWarned = true;
+    }
+    ++state.gprIndex;
+    return 0;
+}
+
+static uint64_t NextOsReportU64(OsReportVarArgState& state)
+{
+    // Align to 8-byte boundary relative to the full argument list.
+    // The OSReport fixed arg (fmt) is in r3, so r4 corresponds to an offset of 4 bytes.
+    // PPC varargs align 64-bit values to 8 bytes, which means we must skip r4 when needed.
+    if (((state.gprIndex + 1u) & 1u) != 0) {
+        ++state.gprIndex;
+    }
+    uint64_t hi = NextOsReportU32(state);
+    uint64_t lo = NextOsReportU32(state);
+    return (hi << 32) | lo;
+}
+
+static double NextOsReportDouble(OsReportVarArgState& state)
+{
+    if (state.cpu && state.fprIndex < 8) {
+        return state.cpu->fpr[1 + state.fprIndex++].d;
+    }
+    return 0.0;
+}
+
+static std::string ReadGuestStringForReport(uint32_t guestAddr)
+{
+    const char* s = GetGuestString(guestAddr);
+    if (!s) {
+        return "(null)";
+    }
+    return std::string(s);
+}
+
+static void HLE_LogOSReport(CpuContext* cpu, const char* fmt)
+{
+    if (!fmt) {
+        std::cout << "[OSReport] (null fmt)" << std::endl;
+        return;
+    }
+
+    OsReportVarArgState state{cpu};
+    size_t renderedLen = 0;
+    std::string buffer = RuntimeHle::FormatGuestPrintf(
+        fmt,
+        renderedLen,
+        [&state]() { return NextOsReportU32(state); },
+        [&state]() { return NextOsReportU64(state); },
+        [&state]() { return NextOsReportDouble(state); },
+        [](uint32_t address) { return ReadGuestStringForReport(address); });
+
+    static thread_local std::string lastBuffer;
+    static thread_local size_t repeated = 0;
+    if (buffer == lastBuffer) {
+        ++repeated;
+        return;
+    }
+    if (repeated != 0) {
+        std::cout << "[OSReport] previous message repeated " << repeated << " time(s)" << std::endl;
+        repeated = 0;
+    }
+    lastBuffer = buffer;
+
+    std::cout << "[OSReport] " << buffer;
+
+    // OSReport strings don't always end in \n, so flush explicitly
+    if (buffer.empty() || buffer.back() != '\n') {
+        std::cout << std::endl;
+    } else {
+        std::cout << std::flush;
+    }
+
+    // Translator correctness diagnostic: NW4R assertion reports normally lose
+    // the guest caller because OS__Report is an HLE boundary. The context is
+    // synchronized at this boundary, so capture the guest backchain at the
+    // first warning/panic instead of attributing the later PPCHalt unwind.
+    if (buffer.find(" Warning:") != std::string::npos ||
+        buffer.find(" Panic:") != std::string::npos) {
+        SystemBridge::DumpCpuState(cpu);
+    }
+}
+
+// Read a NULL-terminated string from guest memory and return a host-owned
+// const char* pointer that remains valid for the duration of the calling
+// thread's OS__Report invocation. This uses a thread-local cache to store
+// copies so that earlier pointers don't get invalidated by later calls.
+static const char* GetGuestString(uint32_t guestAddr)
+{
+    if (guestAddr == 0) {
+        return nullptr;
+    }
+
+    constexpr size_t kMaxGuestStringLength = 4096; // safety cap
+    std::string s;
+    s.reserve(128);
+    try {
+        for (size_t i = 0; i < kMaxGuestStringLength; ++i) {
+            const uint8_t b = ::Memory::Read8(guestAddr + static_cast<uint32_t>(i));
+            if (b == 0) {
+                break;
+            }
+            s.push_back(static_cast<char>(b));
+        }
+    } catch (const ::Memory::AccessViolation&) {
+        // Fallthrough; we will present a replacement that indicates invalid memory
+        s = "<invalid_guest_memory>";
+    }
+
+    // Push into the thread-local cache and return a stable pointer
+    g_guest_string_cache.push_back(std::move(s));
+    return g_guest_string_cache.back().c_str();
+}
+
+// Keep the full CPU context: variadic integer arguments use r4-r10/stack while
+// variadic floating-point arguments use f1-f8.
+extern "C" void OS__Report_801a25d0(CpuContext* ctx)
+{
+    // Clear the thread-local cache of host-side string copies so that each
+    // call of OS__Report has fresh buffers and returned const char* values
+    // remain valid for the duration of this function.
+    g_guest_string_cache.clear();
+
+    const char* fmt_str = GetGuestString(ctx ? ctx->gpr[3] : 0);
+    HLE_LogOSReport(ctx, fmt_str);
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A25D0, OS__Report_801a25d0, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/os/os_reset.cpp b/runtime/src/hle/os/os_reset.cpp
new file mode 100644
index 0000000..e36af5e
--- /dev/null
+++ b/runtime/src/hle/os/os_reset.cpp
@@ -0,0 +1,153 @@
+#include "memory.h"
+#include "hle/audio/ax_dsp.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+#include "system_bridge.h"
+
+#include <cstdlib>
+#include <cstdio>
+#include <cstdint>
+#include <string>
+#include <chrono>
+#include <thread>
+
+namespace {
+
+static std::string ReadGuestStringSafe(uint32_t addr)
+{
+    if (addr == 0) {
+        return "";
+    }
+    std::string out;
+    out.reserve(64);
+    try {
+        for (size_t i = 0; i < 512; ++i) {
+            uint8_t b = Memory::Read8(addr + static_cast<uint32_t>(i));
+            if (b == 0) break;
+            out.push_back(static_cast<char>(b));
+        }
+    } catch (const Memory::AccessViolation&) {
+        out = "<invalid_guest_ptr>";
+    }
+    return out;
+}
+
+} // namespace
+
+// 0x8012E5A4 -> PPCHalt
+extern "C" void PPCHalt_8012E5A4()
+{
+    // A halt is never a clean shutdown: the guest reaches it after OSPanic or an
+    // unrecoverable OS error. Report it like every other fatal path so the run
+    // folder gets the same artifact set, and exit non-zero.
+    RT_LOGF(RT_TAG_OS, "PPCHalt called, exiting process\n");
+    std::fflush(stderr);
+    RuntimeCrash::WriteCrashArtifacts("halt", "The guest executed PPCHalt.");
+    SetRuntimeExitCode(EXIT_FAILURE);
+    ShowRuntimeFatalPopup("the guest operating system halted the console",
+                          "Mario Kart Wii executed PPCHalt, which the console only reaches after an "
+                          "unrecoverable error.");
+    MarkFatalErrorReported();
+    std::exit(EXIT_FAILURE);
+}
+
+PPC_NATIVE_OVERRIDE_VOID(8012E5A4, PPCHalt_8012E5A4, (), ());
+
+// 0x801A2660 -> OS::Panic
+extern "C" void OS__Panic_801A2660_Cpu(CpuContext* ctx)
+{
+    const uint32_t file_ptr = ctx ? ctx->gpr[3] : 0;
+    const int line = ctx ? static_cast<int>(ctx->gpr[4]) : 0;
+    const uint32_t fmt_ptr = ctx ? ctx->gpr[5] : 0;
+
+    const std::string file = ReadGuestStringSafe(file_ptr);
+    const std::string fmt = ReadGuestStringSafe(fmt_ptr);
+
+    std::fprintf(stderr, "\n\n");
+    std::fprintf(stderr, "========================================\n");
+    RT_LOGF(RT_TAG_OS, "OS::Panic called!\n");
+    std::fprintf(stderr, "========================================\n");
+    RT_LOGF(RT_TAG_OS, "Location: %s:%d\n", file.empty() ? "<null>" : file.c_str(), line);
+    if (!fmt.empty()) {
+        RT_LOGF(RT_TAG_OS, "Message: %s\n", fmt.c_str());
+    }
+    std::fprintf(stderr, "========================================\n");
+    std::fflush(stderr);
+    
+    RT_LOGF(RT_TAG_OS, "Dumping CPU state...\n");
+    std::fflush(stderr);
+    
+    
+    RT_LOGF(RT_TAG_OS, "CPU registers:\n");
+    if (ctx) {
+        std::fprintf(stderr, "  PC: 0x%08X  LR: 0x%08X  CTR: 0x%08X\n", ctx->pc, ctx->lr, ctx->ctr);
+        std::fprintf(stderr, "  r1: 0x%08X  r2: 0x%08X  r13: 0x%08X\n", ctx->gpr[1], ctx->gpr[2], ctx->gpr[13]);
+        std::fprintf(stderr, "  r3: 0x%08X  r4: 0x%08X  r5: 0x%08X\n", ctx->gpr[3], ctx->gpr[4], ctx->gpr[5]);
+    } else {
+        std::fprintf(stderr, "  (CPU context is NULL)\n");
+    }
+    
+    std::fprintf(stderr, "========================================\n");
+    RT_LOGF(RT_TAG_OS, "Flushing output and exiting...\n");
+    std::fflush(stderr);
+    std::fflush(stdout);
+
+    std::string details = "Mario Kart Wii reported an OS panic";
+    if (!file.empty()) {
+        details += " at ";
+        details += file;
+        details += ":";
+        details += std::to_string(line);
+    }
+    if (!fmt.empty()) {
+        details += "\n\n";
+        details += fmt;
+    }
+    RuntimeCrash::WriteCrashArtifacts("panic", details);
+    SetRuntimeExitCode(EXIT_FAILURE);
+    ShowRuntimeFatalPopup("the guest operating system reported a panic", details);
+    MarkFatalErrorReported();
+
+    // Give extra time for output to flush with PowerShell redirection
+    std::this_thread::sleep_for(std::chrono::milliseconds(200));
+    
+    std::exit(EXIT_FAILURE);
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A2660, OS__Panic_801A2660_Cpu, (CpuContext* ctx), (ctx));
+
+// 0x801A8A80 -> OSResetSystem
+extern "C" uint32_t OSResetSystem()
+{
+    RT_LOGF(RT_TAG_OS, "OSResetSystem: simulating console reset\n");
+    std::fflush(stderr);
+    // The AX mix worker holds resolved host pointers into the guest regions;
+    // it must be stopped before those mappings are torn down.
+    AxDspHle::ShutdownMixWorker();
+    Memory::Reset();
+    SetRuntimeExitCode(0);
+    std::exit(EXIT_SUCCESS);
+    return 0; // unreachable, but keeps the signature consistent with callers
+}
+
+PPC_NATIVE_OVERRIDE(801A8A80, OSResetSystem, uint32_t, (), ());
+
+// 0x801AE58C -> exit(int status)
+extern "C" uint32_t Exit_801AE58C(int status)
+{
+    RT_LOGF(RT_TAG_OS, "exit(status=%d) called via 0x801AE58C\n", status);
+    std::fflush(stderr);
+    if (status != 0) {
+        const std::string details =
+            "Mario Kart Wii called exit(" + std::to_string(status) + ").";
+        RuntimeCrash::WriteCrashArtifacts("exit", details);
+        ShowRuntimeFatalPopup("the game exited with an error status", details);
+        MarkFatalErrorReported();
+    }
+    SetRuntimeExitCode(status);
+    std::exit(status);
+    return static_cast<uint32_t>(status);
+}
+
+PPC_NATIVE_OVERRIDE(801AE58C, Exit_801AE58C, uint32_t, (int status), (status));
diff --git a/runtime/src/hle/os/os_scheduler.cpp b/runtime/src/hle/os/os_scheduler.cpp
new file mode 100644
index 0000000..c6bbd00
--- /dev/null
+++ b/runtime/src/hle/os/os_scheduler.cpp
@@ -0,0 +1,563 @@
+// SelectThread scheduler, OSWakeupThread and the OSMutex primitives.
+
+#include <cstdint>
+#include <iostream>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "fiber_manager.h"
+#include "runtime_log.h"
+#include "os_internal.h"
+
+namespace {
+void LinkMutexToThread(uint32_t threadPtr, uint32_t mutexPtr)
+{
+    const uint32_t tail = ::Memory::Read32(threadPtr + kThreadMutexTailOffset);
+    if (tail == 0) {
+        ::Memory::Write32(threadPtr + kThreadMutexQueueOffset, mutexPtr);
+    } else {
+        ::Memory::Write32(tail + kMutexThreadNextOffset, mutexPtr);
+    }
+
+    ::Memory::Write32(mutexPtr + kMutexThreadPrevOffset, tail);
+    ::Memory::Write32(mutexPtr + kMutexThreadNextOffset, 0);
+    ::Memory::Write32(threadPtr + kThreadMutexTailOffset, mutexPtr);
+}
+
+void UnlinkMutexFromThread(uint32_t threadPtr, uint32_t mutexPtr)
+{
+    UnlinkGuestListNode(mutexPtr, kMutexThreadNextOffset, kMutexThreadPrevOffset,
+                        threadPtr + kThreadMutexQueueOffset, threadPtr + kThreadMutexTailOffset);
+}
+
+// Tail-enqueue `thread` on the run queue for `priority` and record which queue
+// it is linked into. Marking the priority pending is a separate step because
+// OSWakeupThread runs its fiber bookkeeping between the two.
+void LinkThreadOnRunQueue(uint32_t thread, int32_t priority)
+{
+    const uint32_t queueEntry = kThreadQueueArrayAddr + static_cast<uint32_t>(priority) * 8u;
+    const uint32_t tail = ::Memory::Read32(queueEntry + 4u);
+    if (tail == 0) {
+        ::Memory::Write32(queueEntry, thread);
+    } else {
+        ::Memory::Write32(tail + kThreadNextOffset, thread);
+    }
+    ::Memory::Write32(thread + kThreadPrevOffset, tail);
+    ::Memory::Write32(thread + kThreadNextOffset, 0);
+    ::Memory::Write32(queueEntry + 4u, thread);
+    ::Memory::Write32(thread + kThreadQueueOffset, queueEntry);
+}
+
+// Publish `priority` in the scheduler pending mask and request a reschedule.
+void MarkRunQueuePending(int32_t priority)
+{
+    const uint32_t pending = ::Memory::Read32(kSchedulerPendingFlagAddr);
+    ::Memory::Write32(kSchedulerPendingFlagAddr, pending | (1u << (31 - priority)));
+    ::Memory::Write32(kSchedulerReschedCounterAddr, 1);
+}
+
+// Pop `head` off the front of the thread queue whose head/tail slots are
+// `queueAddr`/`queueAddr + 4`, returning the new head.
+uint32_t PopThreadQueueHead(uint32_t queueAddr, uint32_t head)
+{
+    const uint32_t next = ::Memory::Read32(head + kThreadNextOffset);
+    if (next == 0) {
+        ::Memory::Write32(queueAddr + 4u, 0);
+    } else {
+        ::Memory::Write32(next + kThreadPrevOffset, 0);
+    }
+    ::Memory::Write32(queueAddr, next);
+    return next;
+}
+
+void PromoteThreadPriority(uint32_t threadPtr, int32_t priority)
+{
+    while (threadPtr != 0) {
+        if (static_cast<int32_t>(::Memory::Read32(threadPtr + kThreadSuspendOffset)) > 0) {
+            return;
+        }
+
+        const int32_t currentPriority =
+            static_cast<int32_t>(::Memory::Read32(threadPtr + kThreadPriorityOffset));
+        if (currentPriority <= priority) {
+            return;
+        }
+
+        threadPtr = SetThreadEffectivePriority(threadPtr, priority);
+    }
+}
+} // namespace
+
+extern "C" void OSWakeupThread_HLE_801aaaa4(CpuContext* ctx);
+extern "C" void OSSleepThread_HLE_801aa9b8(CpuContext* ctx);
+
+static void TryInvokeSwitchCallback(uint32_t oldCtx, uint32_t newCtx, CpuContext* cpu)
+{
+    try {
+        const uint32_t callbackAddr = ::Memory::Read32(kSwitchThreadCallbackPtrAddr);
+        if (callbackAddr == 0) {
+            return;
+        }
+
+        if (TranslatedFunctionRegistry::FindByAddressPtr(callbackAddr)) {
+            CpuContext* ctx = cpu ? cpu : &GetPersistentCpuContext();
+            ctx->gpr[3] = oldCtx;
+            ctx->gpr[4] = newCtx;
+            InvokeIndirectCpu(callbackAddr, ctx);
+            return;
+        }
+
+        RT_LOG(RT_TAG_OS) << "__OSThreadInit: switchThreadCallback 0x" << std::hex << callbackAddr
+                  << std::dec << " not registered; skipping" << std::endl;
+    } catch (const ::Memory::AccessViolation& e) {
+        RT_LOG(RT_TAG_OS) << "__OSThreadInit: failed to read callback pointer (0x" << std::hex
+                  << e.address() << std::dec << ")" << std::endl;
+    }
+}
+
+// Forward declare for SelectThread to use
+extern "C" void OS__SetCurrentContext_801a1e70(uint32_t contextAddr);
+extern "C" void func_801A1ED8(CpuContext* ctx);
+
+// ============================================================================
+// SelectThread HLE - Thread Scheduler (Fiber-Aware)
+// Address: 0x801A9C08. Picks the next runnable thread; switches via Windows
+// Fibers instead of blocking InvokeIndirectJump.
+// ============================================================================
+
+extern "C" void SelectThread_801a9c08(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t forceSwitch = cpu->gpr[3];
+
+    ProcessSleepTimers(cpu);
+
+    // Read scheduler state
+    const uint32_t idleFlag = ::Memory::Read32(kSchedulerIdleFlagAddr);
+    if (idleFlag >= 1) {
+        // Scheduler is idle/disabled, return 0
+        cpu->gpr[3] = 0;
+        return;
+    }
+
+    // Get current context
+    const uint32_t currentContext = ::Memory::Read32(kOSCurrentContextAddr);
+    const uint32_t runningContext = ::Memory::Read32(kOSRunningContextAddr);
+    
+    // Early exit if no thread system is initialized yet
+        // (both current and running contexts are 0)
+        if (currentContext == 0 && runningContext == 0) {
+            cpu->gpr[3] = 0;
+            return;
+        }
+
+    if (currentContext != runningContext) {
+        // Not in the running thread's context, return 0
+        cpu->gpr[3] = 0;
+        return;
+    }
+
+    // Check if we have a running thread
+    if (runningContext != 0) {
+        // Read thread state at offset 0x2C8 (state field)
+        const uint16_t threadState = ::Memory::Read16(runningContext + 0x2C8u);
+        
+        if (threadState == 2) { // RUNNING state
+            // Check if we need to reschedule
+            const uint32_t reschedPending = ::Memory::Read32(kSchedulerPendingFlagAddr);
+            
+            if (forceSwitch == 0) {
+                // Get thread priority from offset 0x2D0
+                const int32_t threadPriority = static_cast<int32_t>(::Memory::Read32(runningContext + 0x2D0u));
+                
+                // countLeadingZeros equivalent - find highest priority pending
+                uint32_t pendingClz = 32;
+                if (reschedPending != 0) {
+                    pendingClz = PPC_Cntlzw(reschedPending);
+                }
+                
+                if (threadPriority <= static_cast<int32_t>(pendingClz)) {
+                    // Current thread has higher or equal priority, don't switch
+                    cpu->gpr[3] = 0;
+                    return;
+                }
+            }
+            
+            // Mark thread as READY (state = 1)
+            ::Memory::Write16(runningContext + 0x2C8u, 1);
+            
+            // Add running thread back to its priority queue
+            const int32_t prio = static_cast<int32_t>(::Memory::Read32(runningContext + 0x2D0u));
+            LinkThreadOnRunQueue(runningContext, prio);
+            MarkRunQueuePending(prio);
+        }
+
+        // If the context is not preemptible, save it and return when it resumes.
+        // This matches OSSaveContext semantics used by the original scheduler.
+        try {
+            const uint16_t modeFlags = ::Memory::Read16(runningContext + 0x1A2u);
+            if ((modeFlags & 0x0002u) == 0) {
+                cpu->gpr[3] = runningContext;
+                func_801A1ED8(cpu);
+                if (cpu->gpr[3] != 0) {
+                    cpu->gpr[3] = 0;
+                    return;
+                }
+            }
+        } catch (const ::Memory::AccessViolation& e) {
+            RT_LOG(RT_TAG_OS) << "SelectThread: failed to read mode flags @0x"
+                      << std::hex << e.address() << std::dec << std::endl;
+        }
+    }
+
+    // Check if there are any runnable threads
+    uint32_t reschedPending = ::Memory::Read32(kSchedulerPendingFlagAddr);
+    if (reschedPending == 0) {
+        // No threads to run - enter idle loop
+        TryInvokeSwitchCallback(runningContext, 0, cpu);
+        ::Memory::Write32(kOSRunningContextAddr, 0);
+        
+        // Set current context to idle thread context
+        OS__SetCurrentContext_801a1e70(kIdleThreadContextAddr);
+        
+        while (true) {
+            // Enable interrupts and idle until something becomes runnable.
+            OS__EnableInterrupts_801a65c0();
+
+            while (::Memory::Read32(kSchedulerPendingFlagAddr) == 0) {
+                ProcessSleepTimers(cpu);
+                // Dolphin models DSP audio DMA as an independent 4 kHz timing
+                // event.  Poll it from the guest scheduler instead of batching
+                // completed 3 ms DMA blocks at VI retrace cadence.  A completed
+                // block wakes SoundThread and sets the scheduler pending mask.
+                Audio_HLE_Poll(cpu);
+                if (::Memory::Read32(kSchedulerPendingFlagAddr) != 0) {
+                    break;
+                }
+                VI_HLE_PollRetrace(cpu);
+                if (Fiber::GuestFiberManager::IsInitialized()) {
+                    Fiber::GuestFiberManager::ProcessTimerEvents(cpu);
+                }
+                ProcessAlarmQueue(cpu, 8);
+                if (::Memory::Read32(kSchedulerPendingFlagAddr) != 0) {
+                    break;
+                }
+                VI_HLE_WaitForNextRetracePoll();
+            }
+
+            OS__DisableInterrupts_801a65ac();
+            reschedPending = ::Memory::Read32(kSchedulerPendingFlagAddr);
+            if (reschedPending != 0) {
+                break;
+            }
+        }
+
+        OS__ClearContext_801a2098(kIdleThreadContextAddr);
+    }
+
+    // Clear reschedule counter
+    ::Memory::Write32(kSchedulerReschedCounterAddr, 0);
+
+    // Note: When the current thread is already in WAITING state (not RUNNING),
+    // we skip the preemptibility check entirely, matching the original OS behavior.
+    // The preemptibility check only applies when the thread is RUNNING and we're
+    // deciding whether to preempt it.
+
+    // Find highest priority thread
+    uint32_t pendingMask = ::Memory::Read32(kSchedulerPendingFlagAddr);
+    
+    if (pendingMask == 0) {
+        // No runnable threads in the run queue at this point
+        cpu->gpr[3] = 0;
+        return;
+    }
+    
+    uint32_t priorityLevel = 0;
+    uint32_t queueEntry = 0;
+    uint32_t nextThread = 0;
+    while (true) {
+        priorityLevel = PPC_Cntlzw(pendingMask);
+        queueEntry = kThreadQueueArrayAddr + (priorityLevel * 8);
+        nextThread = ::Memory::Read32(queueEntry);
+
+        if (nextThread == 0) {
+            RT_LOG(RT_TAG_OS) << "SelectThread: ERROR - pending bit set but no thread in queue!" << std::endl;
+            const uint32_t mask = ~(1u << (31 - priorityLevel));
+            ::Memory::Write32(kSchedulerPendingFlagAddr, pendingMask & mask);
+            pendingMask = ::Memory::Read32(kSchedulerPendingFlagAddr);
+            if (pendingMask == 0) {
+                cpu->gpr[3] = 0;
+                return;
+            }
+            continue;
+        }
+
+        const uint16_t state = ::Memory::Read16(nextThread + kThreadStateOffset);
+        if (ThreadStateIsTerminated(state) || Fiber::GuestFiberManager::IsTerminated(nextThread)) {
+            RemoveThreadFromQueue(nextThread);
+            pendingMask = ::Memory::Read32(kSchedulerPendingFlagAddr);
+            if (pendingMask == 0) {
+                cpu->gpr[3] = 0;
+                return;
+            }
+            continue;
+        }
+
+        break;
+    }
+
+    // Remove thread from queue head
+    const uint32_t threadNext = PopThreadQueueHead(queueEntry, nextThread);
+
+    // If queue is now empty, clear the pending bit
+    if (threadNext == 0) {
+        const uint32_t mask = ~(1u << (31 - priorityLevel));
+        ::Memory::Write32(kSchedulerPendingFlagAddr, pendingMask & mask);
+    }
+
+    // Clear thread's queue pointer
+    ::Memory::Write32(nextThread + 0x2DCu, 0);
+    
+    // Set thread to RUNNING state
+    ::Memory::Write16(nextThread + 0x2C8u, 2);
+
+    // Invoke switch callback
+    TryInvokeSwitchCallback(runningContext, nextThread, cpu);
+
+    // Update running context
+    ::Memory::Write32(kOSRunningContextAddr, nextThread);
+    
+    // Set as current context
+    OS__SetCurrentContext_801a1e70(nextThread);
+
+    // Use fiber-based context switch if available
+    if (Fiber::GuestFiberManager::IsInitialized()) {
+        uint32_t currentGuestThread = Fiber::GuestFiberManager::GetCurrentGuestThread();
+        
+        // If we don't have a current guest fiber but we DO have a running context,
+        // register the running context as the "main thread" fiber.
+        // This allows the main thread to participate in fiber switching.
+        if (currentGuestThread == 0 && runningContext != 0) {
+            if (!Fiber::GuestFiberManager::HasFiber(runningContext)) {
+                Fiber::GuestFiberManager::RegisterMainThreadAsFiber(runningContext, cpu);
+            }
+            // Whether we registered it or it already existed, use it as the current thread
+            currentGuestThread = runningContext;
+        }
+        
+        // Check if target thread has a fiber
+        if (!Fiber::GuestFiberManager::HasFiber(nextThread)) {
+            // No fiber for target thread - this can happen if the thread was created
+            // by translated code that didn't go through our HLE. Just continue.
+            cpu->gpr[3] = nextThread;
+            OS__LoadContext_801a1f58(cpu);
+            return;
+        }
+        
+        // If we still don't have a current guest thread (no running context),
+        // we can't do a proper fiber switch. Just return and let the caller handle it.
+        if (currentGuestThread == 0) {
+            Fiber::GuestFiberManager::SwitchToThread(nextThread, cpu);
+            return;
+        }
+        
+        // Perform the fiber switch!
+        Fiber::GuestFiberManager::SwitchToThread(nextThread, cpu);
+        // When we return here, we've been switched back
+        return;
+    }
+    
+    // Fallback to blocking InvokeIndirectJump (original behavior)
+    cpu->gpr[3] = nextThread;
+    OS__LoadContext_801a1f58(cpu);
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801A9C08, SelectThread_801a9c08, (CpuContext* ctx), (ctx));
+
+// ============================================================================
+// OSWakeupThread HLE - drain a thread queue and mark threads runnable
+// Address: 0x801AAAA4
+// ============================================================================
+static void WakeupThreadQueue(CpuContext* ctx, bool allowImmediateReschedule)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t queueAddr = cpu->gpr[3];
+    if (queueAddr == 0) {
+        return;
+    }
+
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+    bool resched = false;
+    constexpr int kMaxWake = 256;
+    int woke = 0;
+
+    while (woke < kMaxWake) {
+        const uint32_t thread = ::Memory::Read32(queueAddr);
+        if (thread == 0) {
+            break;
+        }
+
+        PopThreadQueueHead(queueAddr, thread);
+
+        const uint16_t state = ::Memory::Read16(thread + kThreadStateOffset);
+        if (ThreadStateIsTerminated(state) || Fiber::GuestFiberManager::IsTerminated(thread)) {
+            ::Memory::Write32(thread + kThreadQueueOffset, 0);
+            ::Memory::Write32(thread + kThreadNextOffset, 0);
+            ::Memory::Write32(thread + kThreadPrevOffset, 0);
+            woke++;
+            continue;
+        }
+
+        // Mark READY
+        ::Memory::Write16(thread + 0x2C8u, 1);
+
+        const int32_t suspend = static_cast<int32_t>(::Memory::Read32(thread + 0x2CCu));
+        if (suspend < 1) {
+            int32_t prio = static_cast<int32_t>(::Memory::Read32(thread + 0x2D0u));
+            if (prio < 0) prio = 0;
+            if (prio > 31) prio = 31;
+            LinkThreadOnRunQueue(thread, prio);
+
+            if (Fiber::GuestFiberManager::IsInitialized()) {
+                if (thread == kDefaultThreadContextAddr && !Fiber::GuestFiberManager::HasFiber(thread)) {
+                    Fiber::GuestFiberManager::RegisterMainThreadAsFiber(thread, cpu);
+                }
+                Fiber::GuestFiberManager::ResumeGuestThread(thread);
+            }
+
+            MarkRunQueuePending(prio);
+            resched = true;
+        }
+
+        woke++;
+    }
+
+    if (woke >= kMaxWake) {
+        RT_LOG(RT_TAG_OS) << "OSWakeupThread: hit safety limit, possible queue cycle at 0x"
+                  << std::hex << queueAddr << std::dec << std::endl;
+    }
+
+    if (allowImmediateReschedule && resched && !VI_HLE_IsAdvancingRetrace()) {
+        cpu->gpr[3] = 0;
+        SelectThread_801a9c08(cpu);
+    }
+
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+
+extern "C" void OSWakeupThread_HLE_801aaaa4(CpuContext* ctx)
+{
+    WakeupThreadQueue(ctx, true);
+}
+
+void OS_HLE_WakeupThreadNoReschedule(CpuContext* ctx, uint32_t waitQueue)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t savedR3 = cpu->gpr[3];
+    cpu->gpr[3] = waitQueue;
+    WakeupThreadQueue(cpu, false);
+    cpu->gpr[3] = savedR3;
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801AAAA4, OSWakeupThread_HLE_801aaaa4, (CpuContext* ctx), (ctx));
+
+extern "C" void OSSleepThread_HLE_801aa9b8(CpuContext* ctx);
+
+extern "C" void OSLockMutex_HLE_801a7ee4(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t mutexPtr = cpu->gpr[3];
+    if (mutexPtr == 0) {
+        return;
+    }
+
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+
+    try {
+        const uint32_t currentThread = ::Memory::Read32(kOSRunningContextAddr);
+        if (currentThread == 0) {
+            OS__RestoreInterrupts_801a65d4(irqState);
+            return;
+        }
+
+        while (true) {
+            const uint32_t ownerThread = ::Memory::Read32(mutexPtr + kMutexOwnerOffset);
+            if (ownerThread == 0) {
+                ::Memory::Write32(mutexPtr + kMutexOwnerOffset, currentThread);
+                const uint32_t count = ::Memory::Read32(mutexPtr + kMutexCountOffset);
+                ::Memory::Write32(mutexPtr + kMutexCountOffset, count + 1u);
+                LinkMutexToThread(currentThread, mutexPtr);
+                break;
+            }
+
+            if (ownerThread == currentThread) {
+                const uint32_t count = ::Memory::Read32(mutexPtr + kMutexCountOffset);
+                ::Memory::Write32(mutexPtr + kMutexCountOffset, count + 1u);
+                break;
+            }
+
+            ::Memory::Write32(currentThread + kThreadMutexOffset, mutexPtr);
+            const int32_t priority =
+                static_cast<int32_t>(::Memory::Read32(currentThread + kThreadPriorityOffset));
+            PromoteThreadPriority(ownerThread, priority);
+
+            cpu->gpr[3] = mutexPtr;
+            OSSleepThread_HLE_801aa9b8(cpu);
+            ::Memory::Write32(currentThread + kThreadMutexOffset, 0);
+        }
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSLockMutex", e);
+    }
+
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+PPC_NATIVE_OVERRIDE_VOID(801A7EE4, OSLockMutex_HLE_801a7ee4, (CpuContext* ctx), (ctx));
+
+extern "C" void OSUnlockMutex_HLE_801a7fc0(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t mutexPtr = cpu->gpr[3];
+    if (mutexPtr == 0) {
+        return;
+    }
+
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+
+    try {
+        const uint32_t currentThread = ::Memory::Read32(kOSRunningContextAddr);
+        if (currentThread == 0) {
+            OS__RestoreInterrupts_801a65d4(irqState);
+            return;
+        }
+
+        if (::Memory::Read32(mutexPtr + kMutexOwnerOffset) == currentThread) {
+            const uint32_t count = ::Memory::Read32(mutexPtr + kMutexCountOffset) - 1u;
+            ::Memory::Write32(mutexPtr + kMutexCountOffset, count);
+            if (count == 0) {
+                UnlinkMutexFromThread(currentThread, mutexPtr);
+                ::Memory::Write32(mutexPtr + kMutexOwnerOffset, 0);
+
+                const int32_t effectivePriority =
+                    static_cast<int32_t>(::Memory::Read32(currentThread + kThreadPriorityOffset));
+                const int32_t basePriority =
+                    static_cast<int32_t>(::Memory::Read32(currentThread + kThreadBasePriorityOffset));
+                if (effectivePriority < basePriority) {
+                    const int32_t recomputedPriority = ComputeThreadEffectivePriority(currentThread);
+                    ::Memory::Write32(currentThread + kThreadPriorityOffset,
+                                      static_cast<uint32_t>(recomputedPriority));
+                }
+
+                cpu->gpr[3] = mutexPtr;
+                OSWakeupThread_HLE_801aaaa4(cpu);
+            }
+        }
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSUnlockMutex", e);
+    }
+
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+PPC_NATIVE_OVERRIDE_VOID(801A7FC0, OSUnlockMutex_HLE_801a7fc0, (CpuContext* ctx), (ctx));
+
diff --git a/runtime/src/hle/os/os_sleep.cpp b/runtime/src/hle/os/os_sleep.cpp
new file mode 100644
index 0000000..5938dda
--- /dev/null
+++ b/runtime/src/hle/os/os_sleep.cpp
@@ -0,0 +1,474 @@
+// OSSleepTicks / OSSleepThread parking plus the host-side sleep-timer table.
+
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <iostream>
+#include <mutex>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "fiber_manager.h"
+#include "timebase_contract.h"
+#include "runtime_log.h"
+#include "os_internal.h"
+
+namespace OsHleInternal {
+std::mutex gSleepTimerMutex;
+std::vector<SleepTimerEntry> gSleepTimers;
+
+void CancelSleepTimer(uint32_t threadPtr)
+{
+    std::lock_guard<std::mutex> lock(gSleepTimerMutex);
+    std::erase_if(gSleepTimers, [threadPtr](const SleepTimerEntry& entry) {
+        return entry.threadPtr == threadPtr;
+    });
+}
+
+bool SleepTimerIsPending(uint32_t threadPtr)
+{
+    std::lock_guard<std::mutex> lock(gSleepTimerMutex);
+    for (const SleepTimerEntry& entry : gSleepTimers) {
+        if (entry.threadPtr == threadPtr) {
+            return true;
+        }
+    }
+    return false;
+}
+
+// Threads with an outstanding OSSleepTicks park (timer armed, wake not yet delivered). If one ends
+// up park-shaped with no pending timer, the reconciler in ProcessSleepTimers heals it; nothing
+// outside this set is ever force-started.
+std::mutex gOutstandingParkMutex;
+std::unordered_set<uint32_t> gOutstandingParks;
+
+void MarkParkOutstanding(uint32_t threadPtr)
+{
+    std::lock_guard<std::mutex> lock(gOutstandingParkMutex);
+    gOutstandingParks.insert(threadPtr);
+}
+
+void ClearOutstandingPark(uint32_t threadPtr)
+{
+    std::lock_guard<std::mutex> lock(gOutstandingParkMutex);
+    gOutstandingParks.erase(threadPtr);
+}
+
+void ScheduleSleepTimer(uint32_t threadPtr, uint64_t ticks)
+{
+    using Clock = std::chrono::steady_clock;
+
+    const auto duration = TimeBaseContract::TicksToDuration(ticks);
+    const auto deadline = Clock::now() + duration;
+
+    std::lock_guard<std::mutex> lock(gSleepTimerMutex);
+    std::erase_if(gSleepTimers, [threadPtr](const SleepTimerEntry& entry) {
+        return entry.threadPtr == threadPtr;
+    });
+    gSleepTimers.push_back({threadPtr, deadline});
+}
+
+bool ProcessSleepTimers(CpuContext* cpu)
+{
+    using Clock = std::chrono::steady_clock;
+
+    std::vector<SleepTimerEntry> dueTimers;
+    const auto now = Clock::now();
+    {
+        std::lock_guard<std::mutex> lock(gSleepTimerMutex);
+        auto it = gSleepTimers.begin();
+        while (it != gSleepTimers.end()) {
+            if (it->deadline > now) {
+                ++it;
+                continue;
+            }
+            dueTimers.push_back(*it);
+            it = gSleepTimers.erase(it);
+        }
+    }
+
+    for (const SleepTimerEntry& timer : dueTimers) {
+        const uint32_t threadPtr = timer.threadPtr;
+        if (threadPtr == 0 ||
+            !Memory::Contains(threadPtr + kThreadSuspendOffset, sizeof(uint32_t))) {
+            continue;
+        }
+
+        // A sleep park always leaves the thread Ready with a suspension. A Running thread with a due
+        // timer is mid-park (fire raced the self-suspend), so defer instead of consuming it there or
+        // the sleeper strands. Any other shape means the sleeper already woke; drop the stale timer
+        // without touching the thread.
+        const uint16_t stateAtFire = Memory::Read16(threadPtr + kThreadStateOffset);
+        const int32_t countAtFire =
+            static_cast<int32_t>(Memory::Read32(threadPtr + kThreadSuspendOffset));
+        if (stateAtFire == kThreadStateRunning) {
+            std::lock_guard<std::mutex> lock(gSleepTimerMutex);
+            bool present = false;
+            for (const SleepTimerEntry& entry : gSleepTimers) {
+                if (entry.threadPtr == threadPtr) {
+                    present = true;
+                    break;
+                }
+            }
+            if (!present) {
+                gSleepTimers.push_back({threadPtr, now + std::chrono::milliseconds(2)});
+            }
+            continue;
+        }
+        if (stateAtFire != kThreadStateReady || countAtFire < 1) {
+            RT_LOG(RT_TAG_OS) << "sleep-timer stale for thread 0x" << std::hex << threadPtr
+                      << std::dec << " (state=" << stateAtFire << " suspends=" << countAtFire
+                      << "); dropped without consuming a suspension" << std::endl;
+            ClearOutstandingPark(threadPtr);
+            continue;
+        }
+
+        ClearOutstandingPark(threadPtr);
+        cpu->gpr[3] = threadPtr;
+        OSResumeThread_HLE_801aa58c(cpu);
+
+        // OSResumeThread only peels one suspension level, so if the sleeper's count is inflated
+        // (failed park, overlapping suspend) dropping the timer here would strand it. Keep it armed
+        // instead of consuming it; remaining suspensions after the park's own are foreign ones woken
+        // by their own OSResumeThread. Rearming here used to steal those foreign suspensions, which
+        // is how the DWC re-init thread got stranded.
+    }
+
+    // Stranded-sleeper reconciler: heals a thread whose park has no pending wake timer (lost to a
+    // race) by resuming it once that shape persists for 100ms, sampled every 50ms so no strand is
+    // missed. The atomic CAS below lets exactly one caller run the scan when ProcessSleepTimers
+    // executes on more than one host thread; the rest skip it.
+    static std::atomic<Clock::rep> strandScanDueAt{0};
+    auto strandScanClaim = strandScanDueAt.load(std::memory_order_relaxed);
+    const bool runStrandReconciler =
+        now.time_since_epoch().count() >= strandScanClaim &&
+        strandScanDueAt.compare_exchange_strong(
+            strandScanClaim,
+            static_cast<Clock::rep>(
+                (now + std::chrono::milliseconds(50)).time_since_epoch().count()),
+            std::memory_order_relaxed);
+    if (runStrandReconciler) {
+        static std::mutex strandMutex;
+        static std::unordered_map<uint32_t, Clock::time_point> strandFirstSeen;
+
+        std::vector<uint32_t> outstanding;
+        {
+            std::lock_guard<std::mutex> lock(gOutstandingParkMutex);
+            outstanding.assign(gOutstandingParks.begin(), gOutstandingParks.end());
+        }
+        // Decide who to heal under the lock, but resume OUTSIDE it: the resume
+        // re-enters the scheduler and thus this function, and holding the lock
+        // across it is a guaranteed self-deadlock.
+        std::vector<uint32_t> toHeal;
+        {
+            std::lock_guard<std::mutex> strandLock(strandMutex);
+            // Drop debounce records for threads whose park was satisfied elsewhere.
+            for (auto it = strandFirstSeen.begin(); it != strandFirstSeen.end();) {
+                if (std::find(outstanding.begin(), outstanding.end(), it->first) ==
+                    outstanding.end()) {
+                    it = strandFirstSeen.erase(it);
+                } else {
+                    ++it;
+                }
+            }
+            const auto reconcileNow = Clock::now();
+            for (const uint32_t threadPtr : outstanding) {
+                if (SleepTimerIsPending(threadPtr)) {
+                    strandFirstSeen.erase(threadPtr);
+                    continue;
+                }
+                if (!Memory::Contains(threadPtr + kThreadSuspendOffset, sizeof(uint32_t)) ||
+                    Fiber::GuestFiberManager::IsTerminated(threadPtr)) {
+                    ClearOutstandingPark(threadPtr);
+                    strandFirstSeen.erase(threadPtr);
+                    continue;
+                }
+                const uint16_t state = Memory::Read16(threadPtr + kThreadStateOffset);
+                const int32_t count =
+                    static_cast<int32_t>(Memory::Read32(threadPtr + kThreadSuspendOffset));
+                if (state != kThreadStateReady || count < 1) {
+                    ClearOutstandingPark(threadPtr);
+                    strandFirstSeen.erase(threadPtr);
+                    continue;
+                }
+                const auto seen = strandFirstSeen.find(threadPtr);
+                if (seen == strandFirstSeen.end()) {
+                    strandFirstSeen.emplace(threadPtr, reconcileNow);
+                    continue;
+                }
+                if (reconcileNow - seen->second < std::chrono::milliseconds(100)) {
+                    continue;
+                }
+                strandFirstSeen.erase(seen);
+                ClearOutstandingPark(threadPtr);
+                toHeal.push_back(threadPtr);
+            }
+        }
+        for (const uint32_t threadPtr : toHeal) {
+            RT_LOG(RT_TAG_OS) << "reconciler: thread 0x" << std::hex << threadPtr
+                      << std::dec << " park-shaped with no pending wake timer for 100ms; "
+                      << "resuming lost sleeper" << std::endl;
+            cpu->gpr[3] = threadPtr;
+            OSResumeThread_HLE_801aa58c(cpu);
+        }
+    }
+
+    return !dueTimers.empty();
+}
+} // namespace OsHleInternal
+
+// ---------------------------------------------------------------------------
+// OSSleepTicks HLE - mirror the SDK behavior by suspending the current guest
+// thread and resuming it from a host-side timer. A host sleep here starves
+// lower-priority guest workers because the scheduler never gets control.
+// ---------------------------------------------------------------------------
+extern "C" void OS__SleepTicks_HLE_801aaca8(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    if (!cpu) {
+        return;
+    }
+
+    const uint64_t ticks = (static_cast<uint64_t>(cpu->gpr[3]) << 32) | cpu->gpr[4];
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+
+    try {
+        uint32_t currentThread = ::Memory::Read32(kOSRunningContextAddr);
+        if (Fiber::GuestFiberManager::IsInitialized()) {
+            const uint32_t fiberThread = Fiber::GuestFiberManager::GetCurrentGuestThread();
+            if (fiberThread != 0) {
+                currentThread = fiberThread;
+            }
+        }
+        if (currentThread == 0) {
+            OS__RestoreInterrupts_801a65d4(irqState);
+            return;
+        }
+
+        // Parking here is OSSuspendThread plus a one-shot timer that can only peel one suspension.
+        // If the scheduler cannot switch away (OSDisableScheduler nesting raised around a deferred
+        // guest-callback batch), suspending would inflate the count with nothing left to zero it,
+        // parking forever (the silent DWC SOStartupEx hang). Mirror OSSleepThread: refuse to park
+        // and let the caller retry.
+        const uint32_t sleepIdleFlag = ::Memory::Read32(kSchedulerIdleFlagAddr);
+        const uint32_t sleepCurrentContext = ::Memory::Read32(kOSCurrentContextAddr);
+        if (sleepIdleFlag != 0 ||
+            (sleepCurrentContext != 0 && sleepCurrentContext != currentThread)) {
+            thread_local std::unordered_set<uint32_t> reportedUnparkableTickSleeps;
+            if (reportedUnparkableTickSleeps.insert(currentThread).second) {
+                RT_LOG(RT_TAG_OS) << "OSSleepTicks: thread 0x" << std::hex << currentThread
+                          << std::dec << " cannot park (scheduler nesting "
+                          << sleepIdleFlag << "); busy-returning so the caller retries."
+                          << std::endl;
+            }
+            OS__RestoreInterrupts_801a65d4(irqState);
+            return;
+        }
+
+        ScheduleSleepTimer(currentThread, ticks);
+        MarkParkOutstanding(currentThread);
+        cpu->gpr[3] = currentThread;
+        OSSuspendThread_HLE_801aa6a8(cpu);
+
+        // Defence in depth: SelectThread has other refusal paths (context mismatch, drained run
+        // queues), and there's a fire-before-park race where the timer fires and its resume is
+        // consumed before we suspend. Either way we're still executing with a positive suspension
+        // count, so revert it fully instead of leaving an inflated counter or a stale timer that
+        // could half-wake a future sleep.
+        const bool timerStillPending = SleepTimerIsPending(currentThread);
+        const int32_t suspendCount =
+            static_cast<int32_t>(::Memory::Read32(currentThread + kThreadSuspendOffset));
+        if (suspendCount > 0) {
+            CancelSleepTimer(currentThread);
+            ClearOutstandingPark(currentThread);
+            ::Memory::Write32(currentThread + kThreadSuspendOffset,
+                              static_cast<uint32_t>(suspendCount - 1));
+            if (suspendCount == 1) {
+                if (::Memory::Read16(currentThread + kThreadStateOffset) == kThreadStateReady &&
+                    ::Memory::Read32(currentThread + kThreadQueueOffset) == 0) {
+                    ::Memory::Write16(currentThread + kThreadStateOffset, kThreadStateRunning);
+                }
+                if (Fiber::GuestFiberManager::IsInitialized() &&
+                    Fiber::GuestFiberManager::HasFiber(currentThread)) {
+                    Fiber::GuestFiberManager::ResumeGuestThread(currentThread);
+                }
+            }
+            thread_local std::unordered_set<uint32_t> reportedFailedTickParks;
+            if (reportedFailedTickParks.insert(currentThread).second) {
+                RT_LOG(RT_TAG_OS) << "OSSleepTicks: thread 0x" << std::hex << currentThread
+                          << std::dec << " failed to switch away while parking; "
+                          << "reverted the suspension and busy-returned." << std::endl;
+            }
+        }
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSSleepTicks", e);
+    }
+
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+REGISTER_NATIVE_FUNCTION(0x801AACA8, OS__SleepTicks_HLE_801aaca8);
+
+namespace {
+// OSSleepThread must reach SelectThread with the scheduler-disable count at zero, or the thread
+// relinks into the wait queue a second time and OSWakeupThread livelocks. The SDK guarantees this;
+// deferred guest-callback batches (VI retrace, alarms) can raise the count and violate it.
+bool SchedulerCanSwitchAway()
+{
+    return ::Memory::Read32(kSchedulerIdleFlagAddr) == 0;
+}
+
+// A blocking call from a non-switchable region can't park, so the caller's retry loop spins; that's
+// survivable if host-side work (alarm, IOS completion) eventually satisfies the wait, terminal if
+// not. Report once per wait queue and escalate if a site stays wedged long enough to read as a freeze.
+void ReportUnparkableSleep(uint32_t queuePtr, uint32_t thread)
+{
+    using Clock = std::chrono::steady_clock;
+
+    // thread_local rather than static: guest scheduling normally runs on one
+    // host thread, but this is reachable from the host frame loop too and a
+    // diagnostic must not be the thing that introduces a data race.
+    thread_local std::unordered_set<uint32_t> reportedQueues;
+    thread_local uint32_t wedgedQueue = 0;
+    thread_local Clock::time_point wedgedSince{};
+    thread_local bool escalated = false;
+
+    const uint32_t disableCount = ::Memory::Read32(kSchedulerIdleFlagAddr);
+
+    if (reportedQueues.insert(queuePtr).second) {
+        RT_LOG(RT_TAG_OS) << "OSSleepThread: thread 0x" << std::hex << thread
+                  << " tried to block on wait queue 0x" << queuePtr
+                  << std::dec << " but the scheduler could not switch away";
+        if (disableCount != 0) {
+            std::cerr << " (OSDisableScheduler nesting count " << disableCount << ")";
+        }
+        std::cerr << ". Not parking - the caller retries instead of corrupting"
+                     " the wait queue." << std::endl;
+    }
+
+    const auto now = Clock::now();
+    if (queuePtr != wedgedQueue) {
+        wedgedQueue = queuePtr;
+        wedgedSince = now;
+        escalated = false;
+        return;
+    }
+
+    constexpr auto kWedgeThreshold = std::chrono::seconds(5);
+    if (!escalated && now - wedgedSince >= kWedgeThreshold) {
+        escalated = true;
+        RT_LOG(RT_TAG_OS) << "OSSleepThread: wait queue 0x" << std::hex << queuePtr
+                  << " has been unsatisfiable for " << std::dec
+                  << std::chrono::duration_cast<std::chrono::seconds>(now - wedgedSince).count()
+                  << "s from a non-switchable region. The guest callback that is"
+                     " blocking here must not block, or the deferred-callback"
+                     " scope around it is wrong." << std::endl;
+    }
+}
+} // namespace
+
+// OSSleepThread (0x801aa9b8)
+// Puts the current thread to sleep on a specified wait queue.
+extern "C" void OSSleepThread_HLE_801aa9b8(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t queuePtr = cpu->gpr[3];
+    
+    if (queuePtr == 0) {
+        RT_LOG(RT_TAG_OS) << "OSSleepThread: null queue pointer!" << std::endl;
+        return;
+    }
+
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+    
+    try {
+        uint32_t currentThread = ::Memory::Read32(kOSRunningContextAddr);
+        
+        // If no current thread is set but we have a default thread, use that
+        // This can happen during early boot before the scheduler has switched threads
+        if (currentThread == 0) {
+            currentThread = kDefaultThreadContextAddr;
+            if (!Memory::Contains(currentThread, 4)) {
+                RT_LOG(RT_TAG_OS) << "OSSleepThread: no current thread and default thread not valid!" << std::endl;
+                OS__RestoreInterrupts_801a65d4(irqState);
+                return;
+            }
+            // Set the default thread as current (both running and context)
+            ::Memory::Write32(kOSRunningContextAddr, currentThread);
+            OS__SetCurrentContext_801a1e70(currentThread);
+            
+            // Also register as a fiber if not already
+            if (Fiber::GuestFiberManager::IsInitialized() && 
+                !Fiber::GuestFiberManager::HasFiber(currentThread)) {
+                RT_LOG(RT_TAG_OS) << "OSSleepThread: registering default thread 0x"
+                          << std::hex << currentThread << " as fiber" << std::dec << std::endl;
+                Fiber::GuestFiberManager::RegisterMainThreadAsFiber(currentThread, cpu);
+            }
+        }
+        
+        // See SchedulerCanSwitchAway: parking is only safe when SelectThread is
+        // permitted to switch. Otherwise leave the thread RUNNING and the wait
+        // queue untouched and let the caller's retry loop re-test its condition.
+        if (!SchedulerCanSwitchAway()) {
+            ReportUnparkableSleep(queuePtr, currentThread);
+            OS__RestoreInterrupts_801a65d4(irqState);
+            return;
+        }
+
+        // Mark thread as WAITING
+        ::Memory::Write16(currentThread + 0x2C8u, 4);
+
+        // Store the queue we're waiting on
+        ::Memory::Write32(currentThread + 0x2DCu, queuePtr);
+
+        // Insert into wait queue (sorted by priority). The shared helper also
+        // re-writes the queue pointer stored above and, for a run-queue
+        // address, publishes the pending bit - neither applies to a wait queue.
+        const int32_t ourPrio = static_cast<int32_t>(::Memory::Read32(currentThread + 0x2D0u));
+        InsertThreadIntoQueueByPriority(queuePtr, currentThread, ourPrio);
+
+        // Mark fiber as waiting
+        if (Fiber::GuestFiberManager::IsInitialized()) {
+            Fiber::GuestFiberManager::SuspendGuestThread(currentThread);
+        }
+
+        // Set reschedule flag and switch threads
+        ::Memory::Write32(kSchedulerReschedCounterAddr, 1);
+        
+        // Match the original SDK behavior: sleep yields via SelectThread(0).
+        cpu->gpr[3] = 0;
+        SelectThread_801a9c08(cpu);
+
+        // Defence in depth: SelectThread has other paths that return without switching (context
+        // mismatch, uninitialised thread system, a run queue that drained mid-enqueue). None of
+        // them may leave this thread WAITING and linked, or the caller's retry loop inserts the same
+        // node twice; a real switch resumes here already RUNNING with the queue pointer cleared, so
+        // this block never fires there.
+        if (::Memory::Read16(currentThread + kThreadStateOffset) == kThreadStateWaiting &&
+            ::Memory::Read32(currentThread + kThreadQueueOffset) == queuePtr) {
+            // Reverse of the priority-sorted insert above, so a thread is never
+            // left WAITING and linked while its caller keeps running on the
+            // same stack.
+            UnlinkGuestListNode(currentThread, kThreadNextOffset, kThreadPrevOffset, queuePtr,
+                                queuePtr + 4u);
+            ::Memory::Write32(currentThread + kThreadQueueOffset, 0);
+            ::Memory::Write16(currentThread + kThreadStateOffset, kThreadStateRunning);
+            if (Fiber::GuestFiberManager::IsInitialized() &&
+                Fiber::GuestFiberManager::HasFiber(currentThread)) {
+                Fiber::GuestFiberManager::ResumeGuestThread(currentThread);
+            }
+            ReportUnparkableSleep(queuePtr, currentThread);
+        }
+
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSSleepThread", e);
+    }
+    
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+PPC_NATIVE_OVERRIDE_VOID(801AA9B8, OSSleepThread_HLE_801aa9b8, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/os/os_thread.cpp b/runtime/src/hle/os/os_thread.cpp
new file mode 100644
index 0000000..5de684a
--- /dev/null
+++ b/runtime/src/hle/os/os_thread.cpp
@@ -0,0 +1,717 @@
+// Guest thread lifecycle HLE (fiber-backed) plus the thread-list/priority-queue
+// helpers shared with the scheduler.
+
+#include <cstdint>
+#include <iostream>
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "fiber_manager.h"
+#include "runtime_log.h"
+#include "os_internal.h"
+
+namespace OsHleInternal {
+void RemoveThreadFromList(uint32_t threadPtr)
+{
+    UnlinkGuestListNode(threadPtr, kThreadListNextOffset, kThreadListPrevOffset,
+                        kThreadListHeadAddr, kThreadListTailAddr);
+}
+
+void UpdatePendingMaskForQueue(uint32_t queueEntry)
+{
+    if (queueEntry < kThreadQueueArrayAddr ||
+        queueEntry >= (kThreadQueueArrayAddr + kThreadQueueArrayBytes) ||
+        ((queueEntry - kThreadQueueArrayAddr) % 8u) != 0) {
+        return;
+    }
+
+    if (::Memory::Read32(queueEntry) != 0) {
+        return;
+    }
+
+    const uint32_t priority = (queueEntry - kThreadQueueArrayAddr) / 8u;
+    const uint32_t pending = ::Memory::Read32(kSchedulerPendingFlagAddr);
+    ::Memory::Write32(kSchedulerPendingFlagAddr, pending & ~(1u << (31u - priority)));
+}
+
+void RemoveThreadFromQueue(uint32_t threadPtr)
+{
+    const uint32_t queuePtr = ::Memory::Read32(threadPtr + kThreadQueueOffset);
+    if (queuePtr == 0) {
+        return;
+    }
+
+    UnlinkGuestListNode(threadPtr, kThreadNextOffset, kThreadPrevOffset, queuePtr, queuePtr + 4u);
+    ::Memory::Write32(threadPtr + kThreadQueueOffset, 0);
+
+    UpdatePendingMaskForQueue(queuePtr);
+}
+
+int32_t ComputeThreadEffectivePriority(uint32_t threadPtr)
+{
+    int32_t priority = static_cast<int32_t>(::Memory::Read32(threadPtr + kThreadBasePriorityOffset));
+
+    for (uint32_t mutexPtr = ::Memory::Read32(threadPtr + kThreadMutexQueueOffset);
+         mutexPtr != 0;
+         mutexPtr = ::Memory::Read32(mutexPtr + kMutexThreadNextOffset)) {
+        const uint32_t waiterThread = ::Memory::Read32(mutexPtr + kMutexWaitQueueHeadOffset);
+        if (waiterThread == 0) {
+            continue;
+        }
+
+        const int32_t waiterPriority =
+            static_cast<int32_t>(::Memory::Read32(waiterThread + kThreadPriorityOffset));
+        if (waiterPriority < priority) {
+            priority = waiterPriority;
+        }
+    }
+
+    return priority;
+}
+
+bool IsThpVideoDecoderEntry(uint32_t entryFunc)
+{
+    switch (entryFunc) {
+    case 0x805529A8u:
+    case 0x80552A74u:
+        return true;
+    default:
+        return false;
+    }
+}
+
+void InsertThreadIntoQueueByPriority(uint32_t queuePtr, uint32_t threadPtr, int32_t priority)
+{
+    ::Memory::Write32(threadPtr + kThreadQueueOffset, queuePtr);
+
+    uint32_t insertBefore = ::Memory::Read32(queuePtr);
+    while (insertBefore != 0) {
+        const int32_t queuedPriority =
+            static_cast<int32_t>(::Memory::Read32(insertBefore + kThreadPriorityOffset));
+        if (queuedPriority > priority) {
+            break;
+        }
+        insertBefore = ::Memory::Read32(insertBefore + kThreadNextOffset);
+    }
+
+    if (insertBefore == 0) {
+        const uint32_t tail = ::Memory::Read32(queuePtr + 4u);
+        if (tail == 0) {
+            ::Memory::Write32(queuePtr, threadPtr);
+        } else {
+            ::Memory::Write32(tail + kThreadNextOffset, threadPtr);
+        }
+        ::Memory::Write32(threadPtr + kThreadPrevOffset, tail);
+        ::Memory::Write32(threadPtr + kThreadNextOffset, 0);
+        ::Memory::Write32(queuePtr + 4u, threadPtr);
+    } else {
+        ::Memory::Write32(threadPtr + kThreadNextOffset, insertBefore);
+        const uint32_t prev = ::Memory::Read32(insertBefore + kThreadPrevOffset);
+        ::Memory::Write32(insertBefore + kThreadPrevOffset, threadPtr);
+        ::Memory::Write32(threadPtr + kThreadPrevOffset, prev);
+        if (prev == 0) {
+            ::Memory::Write32(queuePtr, threadPtr);
+        } else {
+            ::Memory::Write32(prev + kThreadNextOffset, threadPtr);
+        }
+    }
+
+    if (queuePtr >= kThreadQueueArrayAddr &&
+        queuePtr < (kThreadQueueArrayAddr + kThreadQueueArrayBytes) &&
+        ((queuePtr - kThreadQueueArrayAddr) % 8u) == 0) {
+        const uint32_t queueIndex = (queuePtr - kThreadQueueArrayAddr) / 8u;
+        const uint32_t pending = ::Memory::Read32(kSchedulerPendingFlagAddr);
+        ::Memory::Write32(kSchedulerPendingFlagAddr, pending | (1u << (31u - queueIndex)));
+    }
+}
+
+uint32_t SetThreadEffectivePriority(uint32_t threadPtr, int32_t priority)
+{
+    const uint16_t state = ::Memory::Read16(threadPtr + kThreadStateOffset);
+    if (state == 3u) {
+        return 0;
+    }
+
+    if (state < 3u) {
+        if (state == kThreadStateReady) {
+            RemoveThreadFromQueue(threadPtr);
+            ::Memory::Write32(threadPtr + kThreadPriorityOffset, static_cast<uint32_t>(priority));
+
+            const uint32_t queueEntry =
+                kThreadQueueArrayAddr + static_cast<uint32_t>(priority) * 8u;
+            InsertThreadIntoQueueByPriority(queueEntry, threadPtr, priority);
+            ::Memory::Write32(kSchedulerReschedCounterAddr, 1);
+        } else if (state != 0u) {
+            ::Memory::Write32(kSchedulerReschedCounterAddr, 1);
+            ::Memory::Write32(threadPtr + kThreadPriorityOffset, static_cast<uint32_t>(priority));
+        }
+        return 0;
+    }
+
+    if (state < 5u) {
+        const uint32_t queuePtr = ::Memory::Read32(threadPtr + kThreadQueueOffset);
+        RemoveThreadFromQueue(threadPtr);
+        ::Memory::Write32(threadPtr + kThreadPriorityOffset, static_cast<uint32_t>(priority));
+        if (queuePtr != 0) {
+            InsertThreadIntoQueueByPriority(queuePtr, threadPtr, priority);
+        }
+
+        const uint32_t mutexPtr = ::Memory::Read32(threadPtr + kThreadMutexOffset);
+        if (mutexPtr != 0) {
+            return ::Memory::Read32(mutexPtr + kMutexOwnerOffset);
+        }
+    }
+
+    return 0;
+}
+} // namespace OsHleInternal
+
+namespace {
+void PropagateMutexOwnerPriority(uint32_t mutexPtr)
+{
+    if (mutexPtr == 0) {
+        return;
+    }
+
+    uint32_t ownerThread = ::Memory::Read32(mutexPtr + kMutexOwnerOffset);
+    while (ownerThread != 0 &&
+           static_cast<int32_t>(::Memory::Read32(ownerThread + kThreadSuspendOffset)) < 1) {
+        const int32_t ownerPriority = ComputeThreadEffectivePriority(ownerThread);
+        if (::Memory::Read32(ownerThread + kThreadPriorityOffset) ==
+            static_cast<uint32_t>(ownerPriority)) {
+            break;
+        }
+        ownerThread = SetThreadEffectivePriority(ownerThread, ownerPriority);
+    }
+}
+
+void MarkFiberThreadTerminated(uint32_t threadPtr, uint16_t finalState)
+{
+    if (!Fiber::GuestFiberManager::IsInitialized()) {
+        return;
+    }
+
+    Fiber::ThreadState fiberState = Fiber::ThreadState::MORIBUND;
+    if (finalState == 0) {
+        fiberState = Fiber::ThreadState::WAITING;
+    }
+    Fiber::GuestFiberManager::ExitGuestThread(threadPtr, fiberState);
+}
+
+void WakeThreadJoiners(CpuContext* cpu, uint32_t threadPtr)
+{
+    if (!cpu) {
+        return;
+    }
+    cpu->gpr[3] = threadPtr + kThreadJoinQueueOffset;
+    OSWakeupThread_HLE_801aaaa4(cpu);
+}
+
+void UnlockAllThreadMutexes(CpuContext* cpu, uint32_t threadPtr)
+{
+    if (!cpu) {
+        return;
+    }
+    CpuContextScope scope(cpu);
+    cpu->gpr[3] = threadPtr;
+    InvokeIndirectCpu(0x801A8088u, cpu); // __OSUnlockAllMutex
+}
+
+// Shared tail of OSExitThread/OSCancelThread: clears context, delists if detached, marks
+// final state, and wakes joiners/mutex waiters. Only OSExitThread publishes an exit value.
+void TerminateThreadCommon(CpuContext* cpu, uint32_t threadPtr, bool publishExitValue,
+                           uint32_t exitValue)
+{
+    OS__ClearContext_801a2098(threadPtr);
+
+    const uint16_t attributes = ::Memory::Read16(threadPtr + kThreadAttrOffset);
+    const bool detached = (attributes & 1u) != 0;
+    const uint16_t finalState = detached ? 0u : kThreadStateMoribund;
+
+    if (detached) {
+        RemoveThreadFromList(threadPtr);
+    } else if (publishExitValue) {
+        ::Memory::Write32(threadPtr + kThreadExitValueOffset, exitValue);
+    }
+
+    ::Memory::Write16(threadPtr + kThreadStateOffset, finalState);
+    MarkFiberThreadTerminated(threadPtr, finalState);
+
+    UnlockAllThreadMutexes(cpu, threadPtr);
+    WakeThreadJoiners(cpu, threadPtr);
+}
+} // namespace
+
+// Fiber-based threading HLE: each guest OSThread gets a host fiber for cooperative
+// context switching without blocking the main thread.
+
+// OSCreateThread (0x801a9e84)
+// Creates a new guest thread and associates a host fiber with it.
+extern "C" void OSCreateThread_HLE_801a9e84(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    
+    // r3..r9 = thread struct, entry func, entry arg, stack top, stack size, priority, attributes.
+
+    const uint32_t threadPtr  = cpu->gpr[3];
+    const uint32_t entryFunc  = cpu->gpr[4];
+    const uint32_t entryArg   = cpu->gpr[5];
+    const uint32_t stackTop   = cpu->gpr[6];
+    const uint32_t stackSize  = cpu->gpr[7];
+    const int32_t  priority   = static_cast<int32_t>(cpu->gpr[8]);
+    const uint16_t attributes = static_cast<uint16_t>(cpu->gpr[9]);
+    
+    // Validate priority range
+    if (priority < 0 || priority > 31) {
+        RT_LOG(RT_TAG_OS) << "OSCreateThread: invalid priority " << priority << std::endl;
+        cpu->gpr[3] = 0; // Return failure
+        return;
+    }
+    
+    // Create the guest fiber
+    if (Fiber::GuestFiberManager::IsInitialized()) {
+        Fiber::GuestFiberManager::CreateGuestFiber(threadPtr, entryFunc, entryArg, stackTop);
+
+        if (Fiber::GuestFiberManager::GetFiber(threadPtr) != nullptr) {
+            const uint32_t hid2 = cpu->hid2 != 0 ? cpu->hid2 : 0x10000000u;
+            Fiber::GuestFiberManager::GetFiber(threadPtr)->cpuContext.hid2 = hid2;
+        }
+    }
+    
+    // Initialize guest thread structure (matching original SDK behavior)
+    try {
+        const uint32_t alignedStack = stackTop & 0xFFFFFFF8u;
+        
+        // Thread state and attributes
+        ::Memory::Write16(threadPtr + 0x2C8u, 1);              // state = READY
+        ::Memory::Write16(threadPtr + 0x2CAu, attributes & 1); // attributes (detached)
+        ::Memory::Write32(threadPtr + 0x2D4u, priority);       // base priority
+        ::Memory::Write32(threadPtr + 0x2D0u, priority);       // effective priority
+        ::Memory::Write32(threadPtr + 0x2CCu, 1);              // suspend count = 1 (created suspended)
+        ::Memory::Write32(threadPtr + 0x2D8u, 0xFFFFFFFFu);    // exit value
+        
+        // Queue pointers
+        ::Memory::Write32(threadPtr + 0x2F0u, 0);
+        ::Memory::Write32(threadPtr + 0x2ECu, 0);
+        ::Memory::Write32(threadPtr + 0x2E8u, 0);
+        ::Memory::Write32(threadPtr + 0x2F8u, 0);
+        ::Memory::Write32(threadPtr + 0x2F4u, 0);
+        
+        // Stack setup - write frame markers
+        ::Memory::Write32(alignedStack - 8, 0);
+        ::Memory::Write32(alignedStack - 4, 0);
+
+        // Let the translated SDK path initialize the guest OSContext exactly
+        // like OSInitContext, then apply the OSCreateThread-specific overrides
+        // that follow in the original PPC.
+        {
+            CpuContextScope scope(cpu);
+            cpu->gpr[3] = threadPtr;
+            cpu->gpr[4] = entryFunc;
+            cpu->gpr[5] = alignedStack - 8;
+            InvokeIndirectCpu(0x801A20BCu, cpu); // OSInitContext
+        }
+
+        if (IsThpVideoDecoderEntry(entryFunc)) {
+            // Decoder threads restore their own context via OSLoadContext, so the saved
+            // context needs these GQR2-GQR5 values or paired-single THP decode breaks
+            // under the all-zero OSInitContext defaults.
+            ::Memory::Write32(threadPtr + 0x1ACu, 0x00040004u);
+            ::Memory::Write32(threadPtr + 0x1B0u, 0x00050005u);
+            ::Memory::Write32(threadPtr + 0x1B4u, 0x00060006u);
+            ::Memory::Write32(threadPtr + 0x1B8u, 0x00070007u);
+
+        }
+
+        ::Memory::Write32(threadPtr + 0x84u, 0x801AA0F0u); // LR = OSExitThread
+        ::Memory::Write32(threadPtr + 0x0Cu, entryArg);    // r3 = argument
+
+        // Stack info
+        ::Memory::Write32(threadPtr + 0x304u, stackTop);
+        ::Memory::Write32(threadPtr + 0x308u, stackTop - stackSize);
+        ::Memory::Write32(stackTop - stackSize, 0xDEADBABEu);  // Stack guard
+        
+        // Thread list linkage
+        ::Memory::Write32(threadPtr + 0x30Cu, 0);
+        ::Memory::Write32(threadPtr + 0x310u, 0);
+        ::Memory::Write32(threadPtr + 0x314u, 0);
+
+        // Match the original OSCreateThread slow-path initialization that runs
+        // once scheduler globals are live. THP worker threads depend on these
+        // queue/list blocks being fully zeroed.
+        constexpr uint32_t kSchedulerInitFlagAddr = 0x80347130u;
+        constexpr uint32_t kThreadAttrSourceAddr = 0x80385AA8u;
+        if (Memory::Contains(kSchedulerInitFlagAddr, 4) &&
+            ::Memory::Read32(kSchedulerInitFlagAddr) != 0) {
+            uint32_t srr1 = ::Memory::Read32(threadPtr + 0x19Cu);
+            srr1 |= 0x900u;
+            ::Memory::Write32(threadPtr + 0x19Cu, srr1);
+
+            uint16_t modeFlags = ::Memory::Read16(threadPtr + 0x1A2u);
+            modeFlags = static_cast<uint16_t>(modeFlags | 0x1u);
+            ::Memory::Write16(threadPtr + 0x1A2u, modeFlags);
+
+            if (Memory::Contains(kThreadAttrSourceAddr, 4)) {
+                const uint32_t attr = (::Memory::Read32(kThreadAttrSourceAddr) & 0xF8u) | 0x4u;
+                ::Memory::Write32(threadPtr + 0x194u, attr);
+            }
+
+            for (uint32_t offset = 0; offset < 0x80u; offset += 4u) {
+                ::Memory::Write32(threadPtr + 0x90u + offset, 0);
+                ::Memory::Write32(threadPtr + 0x1C8u + offset, 0);
+            }
+        }
+
+        // Add to global thread list (matching original SDK logic exactly)
+        const int32_t irqState = OS__DisableInterrupts_801a65ac();
+        
+        // Read thread list tail (last added thread)
+        const uint32_t tailThread = ::Memory::Read32(kThreadListTailAddr);
+        
+        // The new thread becomes the head if the queue is empty.
+        uint32_t newHead = threadPtr;
+        
+        if (tailThread != 0) {
+            // There's an existing tail - link it to the new thread
+            ::Memory::Write32(tailThread + 0x2FCu, threadPtr);  // tail->next = new
+            // Keep existing head
+            newHead = ::Memory::Read32(kThreadListHeadAddr);
+        }
+        
+        // Update thread list head
+        ::Memory::Write32(kThreadListHeadAddr, newHead);
+        
+        // Link new thread into list
+        ::Memory::Write32(threadPtr + 0x300u, tailThread);  // new->prev = old tail
+        ::Memory::Write32(threadPtr + 0x2FCu, 0);           // new->next = 0
+        
+        // New thread becomes the tail
+        ::Memory::Write32(kThreadListTailAddr, threadPtr);
+        
+        OS__RestoreInterrupts_801a65d4(irqState);
+        
+        cpu->gpr[3] = 1; // Return success
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSCreateThread", e);
+        cpu->gpr[3] = 0; // Return failure
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(801A9E84, OSCreateThread_HLE_801a9e84, (CpuContext* ctx), (ctx));
+
+extern "C" void OSExitThread_HLE_801aa0f0(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t exitValue = cpu->gpr[3];
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+
+    try {
+        const uint32_t threadPtr = ::Memory::Read32(kOSRunningContextAddr);
+        if (threadPtr == 0) {
+            OS__RestoreInterrupts_801a65d4(irqState);
+            return;
+        }
+
+        TerminateThreadCommon(cpu, threadPtr, true, exitValue);
+
+        ::Memory::Write32(kSchedulerReschedCounterAddr, 1);
+        cpu->gpr[3] = 0;
+        SelectThread_801a9c08(cpu);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSExitThread", e);
+    }
+
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+PPC_NATIVE_OVERRIDE_VOID(801AA0F0, OSExitThread_HLE_801aa0f0, (CpuContext* ctx), (ctx));
+
+extern "C" void OSCancelThread_HLE_801aa1d4(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t threadPtr = cpu->gpr[3];
+    if (threadPtr == 0) {
+        return;
+    }
+
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+
+    try {
+        const uint16_t state = ::Memory::Read16(threadPtr + kThreadStateOffset);
+        if (state == 3 || state == 0 || state > 4) {
+            OS__RestoreInterrupts_801a65d4(irqState);
+            return;
+        }
+
+        if (state == kThreadStateReady) {
+            const int32_t suspend = static_cast<int32_t>(::Memory::Read32(threadPtr + kThreadSuspendOffset));
+            if (suspend < 1) {
+                RemoveThreadFromQueue(threadPtr);
+            }
+        } else if (state == kThreadStateRunning) {
+            ::Memory::Write32(kSchedulerReschedCounterAddr, 1);
+        } else if (state == kThreadStateWaiting) {
+            RemoveThreadFromQueue(threadPtr);
+        }
+
+        TerminateThreadCommon(cpu, threadPtr, false, 0);
+
+        if (::Memory::Read32(kSchedulerReschedCounterAddr) != 0) {
+            cpu->gpr[3] = 0;
+            SelectThread_801a9c08(cpu);
+        }
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSCancelThread", e);
+    }
+
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+PPC_NATIVE_OVERRIDE_VOID(801AA1D4, OSCancelThread_HLE_801aa1d4, (CpuContext* ctx), (ctx));
+
+extern "C" void OSJoinThread_HLE_801aa3ac(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t threadPtr = cpu->gpr[3];
+    const uint32_t outExitValue = cpu->gpr[4];
+    if (threadPtr == 0) {
+        cpu->gpr[3] = 0;
+        return;
+    }
+
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+    uint32_t result = 0;
+
+    try {
+        const uint16_t attributes = ::Memory::Read16(threadPtr + kThreadAttrOffset);
+        uint16_t state = ::Memory::Read16(threadPtr + kThreadStateOffset);
+        const uint32_t joinHead = ::Memory::Read32(threadPtr + kThreadJoinQueueOffset);
+
+        if ((attributes & 1u) == 0 && state != kThreadStateMoribund && joinHead == 0) {
+            cpu->gpr[3] = threadPtr + kThreadJoinQueueOffset;
+            OSSleepThread_HLE_801aa9b8(cpu);
+            state = ::Memory::Read16(threadPtr + kThreadStateOffset);
+
+            bool foundInList = false;
+            if (state != 0) {
+                for (uint32_t it = ::Memory::Read32(kThreadListHeadAddr); it != 0;
+                     it = ::Memory::Read32(it + kThreadListNextOffset)) {
+                    if (it == threadPtr) {
+                        foundInList = true;
+                        break;
+                    }
+                }
+            }
+
+            if (!foundInList && state != kThreadStateMoribund) {
+                OS__RestoreInterrupts_801a65d4(irqState);
+                cpu->gpr[3] = 0;
+                return;
+            }
+        }
+
+        if (state == kThreadStateMoribund) {
+            if (outExitValue != 0) {
+                ::Memory::Write32(outExitValue, ::Memory::Read32(threadPtr + kThreadExitValueOffset));
+            }
+            RemoveThreadFromList(threadPtr);
+            ::Memory::Write16(threadPtr + kThreadStateOffset, 0);
+            result = 1;
+        }
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSJoinThread", e);
+        result = 0;
+    }
+
+    OS__RestoreInterrupts_801a65d4(irqState);
+    cpu->gpr[3] = result;
+}
+PPC_NATIVE_OVERRIDE_VOID(801AA3AC, OSJoinThread_HLE_801aa3ac, (CpuContext* ctx), (ctx));
+
+extern "C" void OSDetachThread_HLE_801aa4ec(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t threadPtr = cpu->gpr[3];
+    if (threadPtr == 0) {
+        return;
+    }
+
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+
+    try {
+        const uint16_t attributes = ::Memory::Read16(threadPtr + kThreadAttrOffset);
+        ::Memory::Write16(threadPtr + kThreadAttrOffset, attributes | 1u);
+
+        const uint16_t state = ::Memory::Read16(threadPtr + kThreadStateOffset);
+        if (state == kThreadStateMoribund) {
+            RemoveThreadFromList(threadPtr);
+            ::Memory::Write16(threadPtr + kThreadStateOffset, 0);
+            MarkFiberThreadTerminated(threadPtr, 0);
+        }
+
+        WakeThreadJoiners(cpu, threadPtr);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSDetachThread", e);
+    }
+
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+PPC_NATIVE_OVERRIDE_VOID(801AA4EC, OSDetachThread_HLE_801aa4ec, (CpuContext* ctx), (ctx));
+
+extern "C" void OSSuspendThread_HLE_801aa6a8(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t threadPtr = cpu->gpr[3];
+    if (threadPtr == 0) {
+        cpu->gpr[3] = 0;
+        return;
+    }
+
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+
+    try {
+        const int32_t suspendCount =
+            static_cast<int32_t>(::Memory::Read32(threadPtr + kThreadSuspendOffset));
+        ::Memory::Write32(threadPtr + kThreadSuspendOffset,
+                          static_cast<uint32_t>(suspendCount + 1));
+
+        if (suspendCount == 0) {
+            const uint16_t state = ::Memory::Read16(threadPtr + kThreadStateOffset);
+            if (state < 3u) {
+                if (state == kThreadStateReady) {
+                    RemoveThreadFromQueue(threadPtr);
+                } else if (state != 0u) {
+                    ::Memory::Write32(kSchedulerReschedCounterAddr, 1);
+                    ::Memory::Write16(threadPtr + kThreadStateOffset, kThreadStateReady);
+                }
+            } else if (state < 5u) {
+                const uint32_t queuePtr = ::Memory::Read32(threadPtr + kThreadQueueOffset);
+                RemoveThreadFromQueue(threadPtr);
+                ::Memory::Write32(threadPtr + kThreadPriorityOffset, kSuspendedWaitPriority);
+                if (queuePtr != 0) {
+                    InsertThreadIntoQueueByPriority(queuePtr, threadPtr, kSuspendedWaitPriority);
+                }
+                PropagateMutexOwnerPriority(::Memory::Read32(threadPtr + kThreadMutexOffset));
+            }
+
+            if (Fiber::GuestFiberManager::IsInitialized()) {
+                Fiber::GuestFiberManager::SuspendGuestThread(threadPtr);
+            }
+
+            if (::Memory::Read32(kSchedulerReschedCounterAddr) != 0) {
+                cpu->gpr[3] = 0;
+                SelectThread_801a9c08(cpu);
+            }
+        }
+
+        cpu->gpr[3] = static_cast<uint32_t>(suspendCount);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSSuspendThread", e);
+        cpu->gpr[3] = 0;
+    }
+
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+PPC_NATIVE_OVERRIDE_VOID(801AA6A8, OSSuspendThread_HLE_801aa6a8, (CpuContext* ctx), (ctx));
+
+// OSResumeThread (0x801aa58c)
+// Resumes a suspended thread, making it eligible for scheduling.
+extern "C" void OSResumeThread_HLE_801aa58c(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t threadPtr = cpu->gpr[3];
+    
+    if (threadPtr == 0) {
+        cpu->gpr[3] = 0;
+        return;
+    }
+    
+    const int32_t irqState = OS__DisableInterrupts_801a65ac();
+    
+    try {
+        // Read current suspend count
+        const int32_t suspendCount = static_cast<int32_t>(::Memory::Read32(threadPtr + 0x2CCu));
+        const int32_t newSuspend = suspendCount - 1;
+        
+        if (newSuspend < 0) {
+            ::Memory::Write32(threadPtr + 0x2CCu, 0);
+        } else {
+            ::Memory::Write32(threadPtr + 0x2CCu, static_cast<uint32_t>(newSuspend));
+            
+            if (newSuspend == 0) {
+                CancelSleepTimer(threadPtr);
+                ClearOutstandingPark(threadPtr);
+                const uint16_t state = ::Memory::Read16(threadPtr + 0x2C8u);
+
+                if (state == kThreadStateWaiting) {
+                    const uint32_t queuePtr = ::Memory::Read32(threadPtr + kThreadQueueOffset);
+                    RemoveThreadFromQueue(threadPtr);
+
+                    const int32_t priority = ComputeThreadEffectivePriority(threadPtr);
+                    ::Memory::Write32(threadPtr + kThreadPriorityOffset, static_cast<uint32_t>(priority));
+
+                    if (queuePtr != 0) {
+                        InsertThreadIntoQueueByPriority(queuePtr, threadPtr, priority);
+                    }
+
+                    if (Fiber::GuestFiberManager::IsInitialized()) {
+                        Fiber::GuestFiberManager::SuspendGuestThread(threadPtr);
+                    }
+
+                    PropagateMutexOwnerPriority(::Memory::Read32(threadPtr + kThreadMutexOffset));
+                } else if (state == kThreadStateReady) {
+                    const int32_t priority = ComputeThreadEffectivePriority(threadPtr);
+                    ::Memory::Write32(threadPtr + kThreadPriorityOffset, static_cast<uint32_t>(priority));
+
+                    const uint32_t queueEntry =
+                        kThreadQueueArrayAddr + static_cast<uint32_t>(priority) * 8u;
+                    InsertThreadIntoQueueByPriority(queueEntry, threadPtr, priority);
+                    ::Memory::Write32(kSchedulerReschedCounterAddr, 1);
+
+                    if (Fiber::GuestFiberManager::IsInitialized()) {
+                        if (threadPtr == kDefaultThreadContextAddr && !Fiber::GuestFiberManager::HasFiber(threadPtr)) {
+                            Fiber::GuestFiberManager::RegisterMainThreadAsFiber(threadPtr, cpu);
+                        }
+                        Fiber::GuestFiberManager::ResumeGuestThread(threadPtr);
+                    }
+                } else {
+                    // Neither Waiting nor Ready: no path reschedules the fiber, so the thread
+                    // would be lost. A thread stuck Running (its park raced the timer pump) is
+                    // recovered as Ready; terminated threads stay dead.
+                    RT_LOG(RT_TAG_OS) << "OSResumeThread: thread 0x" << std::hex << threadPtr
+                              << std::dec << " reached suspend count 0 in state=" << state
+                              << (state == kThreadStateRunning ? "; recovering as Ready"
+                                                               : "; no wake path - thread lost")
+                              << std::endl;
+                    if (state == kThreadStateRunning &&
+                        !Fiber::GuestFiberManager::IsTerminated(threadPtr)) {
+                        ::Memory::Write16(threadPtr + kThreadStateOffset, kThreadStateReady);
+                        const int32_t priority = ComputeThreadEffectivePriority(threadPtr);
+                        ::Memory::Write32(threadPtr + kThreadPriorityOffset,
+                                          static_cast<uint32_t>(priority));
+                        const uint32_t queueEntry =
+                            kThreadQueueArrayAddr + static_cast<uint32_t>(priority) * 8u;
+                        InsertThreadIntoQueueByPriority(queueEntry, threadPtr, priority);
+                        ::Memory::Write32(kSchedulerReschedCounterAddr, 1);
+                        if (Fiber::GuestFiberManager::IsInitialized()) {
+                            Fiber::GuestFiberManager::ResumeGuestThread(threadPtr);
+                        }
+                    }
+                }
+
+                if (::Memory::Read32(kSchedulerReschedCounterAddr) != 0) {
+                    cpu->gpr[3] = 0;
+                    SelectThread_801a9c08(cpu);
+                }
+            }
+        }
+        
+        cpu->gpr[3] = static_cast<uint32_t>(suspendCount);
+        
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OSResumeThread", e);
+        cpu->gpr[3] = 0;
+    }
+    
+    OS__RestoreInterrupts_801a65d4(irqState);
+}
+PPC_NATIVE_OVERRIDE_VOID(801AA58C, OSResumeThread_HLE_801aa58c, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/os/os_time.cpp b/runtime/src/hle/os/os_time.cpp
new file mode 100644
index 0000000..a89e4a4
--- /dev/null
+++ b/runtime/src/hle/os/os_time.cpp
@@ -0,0 +1,85 @@
+#include "memory.h"
+#include "hle_stubs.h"
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+#include "os_internal.h"
+
+#include <cstdint>
+#include <iostream>
+
+namespace {
+// Read the 64-bit time base the way the SDK does: retry until the upper word is
+// unchanged across the lower-word read, so a rollover in between is never
+// observed as a jump.
+void ReadTimeBaseRegisters(uint32_t& outHi, uint32_t& outLo)
+{
+    while (true) {
+        const uint32_t hi1 = PPC_Mftbu();
+        const uint32_t lo = PPC_Mftb();
+        const uint32_t hi2 = PPC_Mftbu();
+        if (hi1 == hi2) {
+            outHi = hi1;
+            outLo = lo;
+            return;
+        }
+    }
+}
+} // namespace
+
+namespace OsHleInternal {
+uint64_t ReadSystemTime()
+{
+    uint32_t hi1 = 0;
+    uint32_t lo = 0;
+    ReadTimeBaseRegisters(hi1, lo);
+
+    const uint64_t timeBase = (static_cast<uint64_t>(hi1) << 32) | lo;
+    const uint32_t baseHi = ::Memory::Read32(0x800030D8u);
+    const uint32_t baseLo = ::Memory::Read32(0x800030DCu);
+    const uint64_t base = (static_cast<uint64_t>(baseHi) << 32) | baseLo;
+    return base + timeBase;
+}
+} // namespace OsHleInternal
+
+// OSGetTime -> returns 64-bit time base (hi in r3, lo in r4).
+extern "C" void OS__GetTime_HLE(CpuContext* ctx)
+{
+    if (!ctx) {
+        return;
+    }
+
+    uint32_t hi = 0;
+    uint32_t lo = 0;
+    ReadTimeBaseRegisters(hi, lo);
+    ctx->gpr[3] = hi;
+    ctx->gpr[4] = lo;
+}
+
+PPC_NATIVE_OVERRIDE_VOID(801AAD5C, OS__GetTime_HLE, (CpuContext* ctx), (ctx));
+
+
+// ----------------------------------------------------------------------------
+// OSGetSystemTime HLE - map system time structure to a 64-bit return
+extern "C" uint32_t OS____GetSystemTime_801aad7c(uint32_t /*r3_hi*/, uint32_t /*r4_lo*/, uint32_t /*r5*/, int32_t /*r6*/, uint32_t /*r7*/, uint32_t /*r8*/) {
+    // Save/disable interrupts (mirrors the original implementation).
+    int saved_level = OS__DisableInterrupts_801a65ac();
+
+    uint64_t now = 0;
+    try {
+        now = ReadSystemTime();
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_OS, "OS____GetSystemTime_801aad7c", e);
+        now = (static_cast<uint64_t>(PPC_Mftbu()) << 32) | PPC_Mftb();
+    }
+    const uint32_t hi = static_cast<uint32_t>(now >> 32);
+    const uint32_t lo = static_cast<uint32_t>(now & 0xFFFFFFFFu);
+    OS__RestoreInterrupts_801a65d4(saved_level);
+
+    if (CpuContext* ctx = CurrentCpuContext()) {
+        ctx->gpr[3] = hi;
+        ctx->gpr[4] = lo;
+    }
+    return hi;
+}
+
+PPC_NATIVE_OVERRIDE(801AAD7C, OS____GetSystemTime_801aad7c, uint32_t, (uint32_t r3_low, uint32_t r4_high, uint32_t r5_unused, int32_t r6_unused, uint32_t r7_unused, uint32_t r8_unused), (r3_low, r4_high, r5_unused, r6_unused, r7_unused, r8_unused));
diff --git a/runtime/src/hle/runtime_parse_helpers.h b/runtime/src/hle/runtime_parse_helpers.h
new file mode 100644
index 0000000..b44bb41
--- /dev/null
+++ b/runtime/src/hle/runtime_parse_helpers.h
@@ -0,0 +1,64 @@
+#pragma once
+
+// Small guest-memory / string helpers shared by more than one HLE subsystem.
+// Anything used by a single .cpp stays file-local.
+
+#include "memory.h"
+
+#include <algorithm>
+#include <cctype>
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+namespace RuntimeHle {
+
+// An IOS ioctlv descriptor as it is laid out in guest memory: two big-endian
+// words (address, size) per entry, 8 bytes apart. Shared by the /dev/net and
+// /dev/isfs device layers, which previously each declared their own copy.
+struct IoVector {
+    uint32_t address = 0;
+    uint32_t size = 0;
+};
+
+inline IoVector ReadIoVector(uint32_t vectorPtr, uint32_t index) {
+    const uint32_t entry = vectorPtr + index * 8u;
+    return {Memory::Read32(entry), Memory::Read32(entry + 4u)};
+}
+
+// ASCII-lowercase in place. Host path and disc-filename comparisons are
+// case-insensitive; the guest side is not, so this only ever runs on host
+// strings.
+inline void LowerInPlace(std::string& text) {
+    std::transform(text.begin(), text.end(), text.begin(),
+                   [](unsigned char ch) { return static_cast<char>(std::tolower(ch)); });
+}
+
+inline std::string Lower(std::string_view text) {
+    std::string lowered(text);
+    LowerInPlace(lowered);
+    return lowered;
+}
+
+inline bool IsValidGameCode(uint32_t code) {
+    for (int shift = 24; shift >= 0; shift -= 8) {
+        const char ch = static_cast<char>((code >> shift) & 0xffu);
+        if (!std::isalnum(static_cast<unsigned char>(ch))) {
+            return false;
+        }
+    }
+    return true;
+}
+
+inline uint32_t CurrentGameCode(uint32_t fallback) {
+    if (Memory::Contains(0x80000000u, 4u)) {
+        const uint32_t code = Memory::Read32(0x80000000u);
+        if (IsValidGameCode(code)) {
+            return code;
+        }
+    }
+
+    return fallback;
+}
+
+} // namespace RuntimeHle
diff --git a/runtime/src/hle/sc.cpp b/runtime/src/hle/sc.cpp
new file mode 100644
index 0000000..62c4411
--- /dev/null
+++ b/runtime/src/hle/sc.cpp
@@ -0,0 +1,131 @@
+#include "hle_stubs.h"
+
+#include "console_identity.h"
+#include <cstdlib>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include "memory.h"
+#include "runtime_config.h"
+#include "runtime_log.h"
+
+namespace {
+
+constexpr uint32_t kPalProductRegion = 2;
+
+} // namespace
+
+// SCCheckStatus is polled in OSInit's busy loop (while(SCCheckStatus()==1) waits on async SYSCONF
+// load via NAND IPC); we have no async IPC callbacks, so return 0 (SUCCESS) immediately.
+
+// 0x801B0220 -> SCCheckStatus()
+// Returns: 0 = success, 1 = busy, 2 = error
+extern "C" uint32_t SCCheckStatus_HLE()
+{
+    // Return 0 (success) immediately to avoid infinite busy-wait in OSInit
+    return 0;
+}
+
+PPC_NATIVE_OVERRIDE(801B0220, SCCheckStatus_HLE, uint32_t, (), ());
+
+// 0x801B1BE4 -> SCGetAspectRatio()
+// Returns: 0 = 4:3, 1 = 16:9
+extern "C" uint32_t SCGetAspectRatio_HLE()
+{
+    return RuntimeConfigFile::WidescreenEnabled(true) ? 1u : 0u;
+}
+
+PPC_NATIVE_OVERRIDE(801B1BE4, SCGetAspectRatio_HLE, uint32_t, (), ());
+
+// 0x801B1CAC -> SCGetEuRgb60Mode()
+// Returns: 0 = PAL50, 1 = PAL60/RGB60
+extern "C" uint32_t SCGetEuRgb60Mode_HLE()
+{
+    // Default to PAL60 so PAL builds do not fall back to the half-rate PAL50
+    // sync path on modern displays. Actual texture/cache correctness is handled
+    // elsewhere; this only exposes the intended SYSCONF setting.
+    return 1;
+}
+
+PPC_NATIVE_OVERRIDE(801B1CAC, SCGetEuRgb60Mode_HLE, uint32_t, (), ());
+
+// The managed NAND intentionally starts without a console-owned setting.txt.
+// DWC nevertheless requires the Wii product code and serial number so it can
+// include csnum in NAS authentication. Expose one stable virtual-console
+// identity without requiring or mutating a user's real NAND.
+
+extern "C" uint32_t SCGetProductArea_HLE()
+{
+    // The PAL setting.txt AREA value is "EUR". The SDK's lookup table at
+    // 0x8029CEB0 maps JPN=0, USA=1, EUR=2.
+    return kPalProductRegion;
+}
+
+PPC_NATIVE_OVERRIDE(801B23A0, SCGetProductArea_HLE, uint32_t, (), ());
+
+extern "C" uint32_t SCGetProductCode_HLE()
+{
+    // Original PAL SC storage for the six-byte CODE value.
+    constexpr uint32_t kProductCodeAddress = 0x803869E0u;
+    static constexpr char kProductCode[] = "LEH";
+    if (!Memory::Contains(kProductCodeAddress, sizeof(kProductCode))) {
+        return 0;
+    }
+    std::memcpy(Memory::GetPointer(kProductCodeAddress, sizeof(kProductCode)),
+                kProductCode, sizeof(kProductCode));
+    return kProductCodeAddress;
+}
+
+PPC_NATIVE_OVERRIDE(801B2424, SCGetProductCode_HLE, uint32_t, (), ());
+
+extern "C" uint32_t SCGetProductSN_HLE(uint32_t serialAddress)
+{
+    const std::string& serial = RuntimeConsoleIdentity::Current().serial;
+    if (!serialAddress || !Memory::Contains(serialAddress, serial.size() + 1)) {
+        return 0;
+    }
+    std::memcpy(Memory::GetPointer(serialAddress, serial.size() + 1),
+                serial.c_str(), serial.size() + 1);
+    return 1;
+}
+
+PPC_NATIVE_OVERRIDE(801B2460, SCGetProductSN_HLE, uint32_t, (uint32_t serialAddress), (serialAddress));
+
+extern "C" uint32_t SCGetProductGameRegion_HLE()
+{
+    // The PAL setting.txt GAME value is "EU". The SDK's own lookup table at
+    // 0x8029CEF8 maps JP=0, US=1, EU=2.
+    return kPalProductRegion;
+}
+
+PPC_NATIVE_OVERRIDE(801B24C8, SCGetProductGameRegion_HLE, uint32_t, (), ());
+
+// These stubs make the game think all titles are installed; otherwise it checks title ID
+// 0x00010004524d4350 ("RMCP", Mario Kart Wii PAL) and reports error code 5.
+
+// 0x801AE4A0 -> OS__IsTitleInstalled(titleIdHi, titleIdLo)
+// Returns: 1 = installed, 0 = not installed
+extern "C" uint32_t OS__IsTitleInstalled(uint32_t titleIdHi, uint32_t titleIdLo)
+{
+    RT_LOGF(RT_TAG_HLE, "CINS: OSIsTitleInstalled(0x%08X%08X) -> 1 (stubbed as installed)\n",
+            titleIdHi, titleIdLo);
+    return 1; // Always report installed
+}
+
+PPC_NATIVE_OVERRIDE(801AE4A0, OS__IsTitleInstalled, uint32_t, (uint32_t titleIdHi, uint32_t titleIdLo), (titleIdHi, titleIdLo));
+
+// 0x801AD1D4 -> OS__CheckInstall(requiredBlocks, titleIdHi, titleIdLo, outFlagsPtr): returns 0 with
+// outFlagsPtr = 0x3 (bit0 has data, bit1 has update; bit2 would be needs-blocks) i.e. fully installed.
+extern "C" uint32_t OS__CheckInstall(uint32_t requiredBlocks, uint32_t titleIdHi, 
+                                      uint32_t titleIdLo, uint32_t outFlagsPtr)
+{
+    RT_LOGF(RT_TAG_HLE, "OS__CheckInstall(blocks=%u, 0x%08X%08X) -> success (stubbed)\n",
+            requiredBlocks, titleIdHi, titleIdLo);
+    if (outFlagsPtr != 0) {
+        Memory::Write32(outFlagsPtr, 0x3); // has data + has update = fully installed
+    }
+    return 0; // Success
+}
+
+PPC_NATIVE_OVERRIDE(801AD1D4, OS__CheckInstall, uint32_t, (uint32_t requiredBlocks, uint32_t titleIdHi, uint32_t titleIdLo, uint32_t outFlagsPtr), (requiredBlocks, titleIdHi, titleIdLo, outFlagsPtr));
diff --git a/runtime/src/hle/storage/dvd.cpp b/runtime/src/hle/storage/dvd.cpp
new file mode 100644
index 0000000..a8af178
--- /dev/null
+++ b/runtime/src/hle/storage/dvd.cpp
@@ -0,0 +1,1121 @@
+#include "hle_stubs.h"
+#include "isa/big_endian.h"
+#include "hle/dvd_contract.h"
+#include "hle/runtime_parse_helpers.h"
+#include "memory.h"
+
+// Defined in hle/gx/gx_objects.cpp. DVD reads are DMA-class writes to guest
+// RAM: the game brackets them with DCInvalidateRange (not a flush), so the GX
+// layer's caches must be notified explicitly that these bytes changed.
+extern "C" void GxNotifyGuestRamDmaWrite(uint32_t addr, uint32_t size);
+#include "hle/storage/riivolution.h"
+#include "ppc_runtime.h"
+#include "recomp_mod_loader.h"
+#include "runtime_config.h"
+#include "runtime_log.h"
+#include "runtime_product.h"
+
+#include <cstdint>
+#include <cstdlib>
+#include <cstdio>
+#include <cstring>
+#include <algorithm>
+#include <vector>
+#include <string>
+#include <map>
+#include <unordered_set>
+#include <filesystem>
+#include <iostream>
+#include <fstream>
+#include <mutex>
+#include <sstream>
+#include <utility>
+
+namespace fs = std::filesystem;
+
+// ============================================================================
+// Configuration
+// ============================================================================
+
+// The extracted ISO "DATA" folder. We map its "files" subfolder to the DVD
+// root "/" and its "sys" subfolder to "/sys/". The root is user-owned input:
+// it is never embedded into or copied by the public runtime.
+static std::string g_dvdRoot;
+static std::once_flag g_dvdRootOnce;
+
+static uint32_t CurrentDiscGameCode() {
+    return RuntimeHle::CurrentGameCode(0x524D4350u); // RMCP
+}
+
+// ============================================================================
+// DVD Constants & Structures
+// ============================================================================
+
+#define DVD_STATE_FATAL_ERROR  -1
+#define DVD_STATE_END           0
+#define DVD_STATE_BUSY          1
+#define DVD_STATE_WAITING       2
+#define DVD_STATE_COVER_CLOSED  3
+#define DVD_STATE_NO_DISK       4
+#define DVD_STATE_COVER_OPEN    5
+
+// Offsets in DVD Command Block (OS standard)
+#define DVD_CB_OFFSET_STATE       0x0C
+#define DVD_CB_OFFSET_TRANSFERRED 0x20
+#define DVD_FILEINFO_OFFSET_ADDR  0x30
+#define DVD_FILEINFO_OFFSET_LEN   0x34
+
+struct DVDFileEntry {
+    std::string hostPath; // Full Windows path
+    std::string dvdPath;  // Virtual Wii path (e.g., "/Race/Course.szs")
+    uint32_t size;
+    uint32_t discOffsetWords = 0;
+    bool isDirectory = false;
+};
+
+struct FstFileEntry {
+    uint32_t start;
+    uint32_t end;
+    uint32_t size;
+    std::string dvdPath;
+    std::string hostPath;
+};
+
+// Global State
+static std::vector<DVDFileEntry> g_fileEntries;
+static std::map<std::string, int32_t> g_pathToEntry;
+// Maps each published file's disc range back to its runtime entry.
+struct PublishedExtent {
+    uint64_t startBytes = 0;
+    uint64_t endBytes = 0;
+    int32_t entryIndex = -1;
+};
+static std::vector<PublishedExtent> g_publishedExtents;
+static bool g_dvdInitialized = false;
+static std::vector<FstFileEntry> g_fstFiles;
+static bool g_fstLoaded = false;
+static std::unordered_set<std::string> g_loggedReadErrors;
+static constexpr int32_t kDvdFatalError = -3;
+
+extern "C" void DVDInit_8015EA1C();
+
+// This MEM2 region is reserved at startup for the published FST.
+extern "C" uint32_t g_dvdFstReservedBase;
+extern "C" uint32_t g_dvdFstReservedSize;
+
+// Byte-wise copy into guest RAM plus the DMA notification the GX caches need.
+static void CopyToGuestAsDma(uint32_t dest, const uint8_t* data, size_t size) {
+    for (size_t i = 0; i < size; ++i) {
+        Memory::Write8(dest + static_cast<uint32_t>(i), data[i]);
+    }
+    GxNotifyGuestRamDmaWrite(dest, static_cast<uint32_t>(size));
+}
+
+static std::string NormalizeDvdHostPath(std::string path) {
+    while (!path.empty() && (path.back() == '\\' || path.back() == '/')) {
+        path.pop_back();
+    }
+    return path;
+}
+
+static bool IsDvdDataRoot(const fs::path& path) {
+    std::error_code ec;
+    return fs::is_directory(path, ec) && !ec &&
+           fs::is_directory(path / "files", ec) && !ec &&
+           fs::is_regular_file(path / "sys" / "fst.bin", ec) && !ec;
+}
+
+// Single fatal idiom for this module: crash artifacts under `reason`, the same
+// text in the popup, a non-zero exit code, and no second generic report from
+// the atexit handler.
+[[noreturn]] static void FailDvd(const char* reason, const char* category,
+                                 const std::string& details) {
+    RuntimeCrash::WriteCrashArtifacts(reason, details);
+    SetRuntimeExitCode(EXIT_FAILURE);
+    ShowRuntimeFatalPopup(category, details);
+    MarkFatalErrorReported();
+    std::exit(EXIT_FAILURE);
+}
+
+[[noreturn]] static void FailDvdRoot(const char* source, const fs::path& path = {}) {
+    RT_LOGF(RT_TAG_DVD, "ERROR: %s", source);
+    if (!path.empty()) {
+        std::fprintf(stderr, ": %s", path.string().c_str());
+    }
+    std::fprintf(stderr,
+                 "\n[dvd] Set [paths] dvd_root in Config.toml "
+                 "to your extracted Mario Kart Wii DATA directory.\n");
+    std::string details = source ? source : "The configured DVD root could not be opened.";
+    if (!path.empty()) {
+        details += "\n\nPath: ";
+        details += path.string();
+    }
+    details += "\n\nSet [paths] dvd_root in Config.toml to the extracted "
+               "Mario Kart Wii DATA directory.";
+    FailDvd("dvd_root", "DVD data is unavailable", details);
+}
+
+static const std::string& GetDvdRoot() {
+    std::call_once(g_dvdRootOnce, []() {
+        const fs::path path = RuntimeConfigFile::ResolvedDvdRoot();
+        if (path.empty()) {
+            FailDvdRoot("No DVD root is configured");
+        }
+        if (!IsDvdDataRoot(path)) {
+            FailDvdRoot("Configured DVD root is not an extracted DATA directory", path);
+        }
+        g_dvdRoot = NormalizeDvdHostPath(path.string());
+    });
+
+    return g_dvdRoot;
+}
+
+static std::string NormalizePath(const std::string& path);
+static std::string ResolveDvdMappedHostPath(const std::string& dvdPath, const std::string& fallbackHostPath);
+
+static void InvokeDvdCallback(uint32_t callbackPtr, int32_t result, uint32_t fileInfoPtr) {
+    if (callbackPtr == 0) {
+        return;
+    }
+    if (!TranslatedFunctionRegistry::FindByAddressPtr(callbackPtr)) {
+        return;
+    }
+    auto& cpu = GetPersistentCpuContext();
+    cpu.gpr[3] = static_cast<uint32_t>(result);
+    cpu.gpr[4] = fileInfoPtr;
+    InvokeIndirectCpu(callbackPtr, &cpu);
+}
+
+// Same shape as InvokeDvdCallback minus the command block: the DVDLow callbacks
+// take only a result, so r4 is deliberately left untouched here.
+static void InvokeDvdLowCallback(uint32_t callbackPtr, int32_t result) {
+    if (callbackPtr == 0) {
+        return;
+    }
+    if (!TranslatedFunctionRegistry::FindByAddressPtr(callbackPtr)) {
+        return;
+    }
+    auto& cpu = GetPersistentCpuContext();
+    cpu.gpr[3] = static_cast<uint32_t>(result);
+    InvokeIndirectCpu(callbackPtr, &cpu);
+}
+
+static void ReportDvdReadError(const std::string& hostPath,
+                               int64_t offset,
+                               uint32_t length,
+                               const char* reason) {
+    const std::string key = hostPath + "\n" + std::to_string(offset);
+    if (!g_loggedReadErrors.insert(key).second) {
+        return;
+    }
+
+    RT_LOGF(RT_TAG_DVD,
+                 "ERROR: DVD read failed: host=\"%s\" offset=%lld (0x%llx) "
+                 "length=%u: %s\n",
+                 hostPath.c_str(),
+                 static_cast<long long>(offset),
+                 static_cast<unsigned long long>(offset),
+                 length,
+                 reason ? reason : "unknown read error");
+}
+
+static int32_t DvdReadFatal(uint32_t fileInfoPtr,
+                            const std::string& hostPath,
+                            int64_t offset,
+                            uint32_t length,
+                            const char* reason) {
+    ReportDvdReadError(hostPath, offset, length, reason);
+    try {
+        Memory::Write32(fileInfoPtr + DVD_CB_OFFSET_STATE,
+                        static_cast<uint32_t>(DVD_STATE_FATAL_ERROR));
+        Memory::Write32(fileInfoPtr + DVD_CB_OFFSET_TRANSFERRED, 0);
+    } catch (const Memory::AccessViolation&) {
+    }
+    return kDvdFatalError;
+}
+
+static void LoadFstIndex() {
+    if (g_fstLoaded) {
+        return;
+    }
+    g_fstLoaded = true;
+
+    fs::path fstPath = fs::path(GetDvdRoot()) / "sys" / "fst.bin";
+    std::ifstream fstFile(fstPath, std::ios::binary);
+    if (!fstFile.is_open()) {
+        return;
+    }
+
+    fstFile.seekg(0, std::ios::end);
+    const std::streamsize size = fstFile.tellg();
+    fstFile.seekg(0, std::ios::beg);
+    if (size < 12) {
+        return;
+    }
+
+    std::vector<uint8_t> data(static_cast<size_t>(size));
+    fstFile.read(reinterpret_cast<char*>(data.data()), size);
+    if (!fstFile) {
+        return;
+    }
+
+    const uint32_t entryCount = BigEndian::Read32(&data[8]);
+    if (entryCount == 0 || entryCount > 0x10000) {
+        return;
+    }
+
+    const size_t entriesSize = static_cast<size_t>(entryCount) * 12;
+    if (entriesSize >= data.size()) {
+        return;
+    }
+
+    const size_t stringBase = entriesSize;
+
+    struct DirFrame {
+        uint32_t endIndex;
+        std::string path;
+    };
+
+    std::vector<DirFrame> stack;
+    stack.push_back({entryCount, std::string()});
+
+    g_fstFiles.clear();
+    g_fstFiles.reserve(entryCount / 2);
+
+    for (uint32_t i = 1; i < entryCount; ++i) {
+        while (!stack.empty() && i >= stack.back().endIndex) {
+            stack.pop_back();
+        }
+        if (stack.empty()) {
+            break;
+        }
+
+        const size_t entryOff = static_cast<size_t>(i) * 12;
+        const uint32_t nameWord = BigEndian::Read32(&data[entryOff]);
+        const uint8_t type = static_cast<uint8_t>(nameWord >> 24);
+        const uint32_t nameOffset = nameWord & 0x00FFFFFFu;
+        if (stringBase + nameOffset >= data.size()) {
+            break;
+        }
+
+        const char* namePtr = reinterpret_cast<const char*>(&data[stringBase + nameOffset]);
+        std::string name(namePtr);
+
+        if (type != 0) {
+            const uint32_t nextIndex = BigEndian::Read32(&data[entryOff + 8]);
+            std::string dirPath = stack.back().path;
+            if (!dirPath.empty()) {
+                dirPath += "/";
+            }
+            dirPath += name;
+            stack.push_back({nextIndex, dirPath});
+            continue;
+        }
+
+        const uint32_t fileOffset = BigEndian::Read32(&data[entryOff + 4]);
+        const uint32_t fileSize = BigEndian::Read32(&data[entryOff + 8]);
+
+        std::string relPath = stack.back().path;
+        if (!relPath.empty()) {
+            relPath += "/";
+        }
+        relPath += name;
+
+        const uint64_t startBytes64 = static_cast<uint64_t>(fileOffset) * 4ull;
+        if (startBytes64 > 0xFFFFFFFFu) {
+            continue;
+        }
+        const uint32_t startBytes = static_cast<uint32_t>(startBytes64);
+        const uint32_t endBytes = startBytes + fileSize;
+
+        FstFileEntry entry;
+        entry.start = startBytes;
+        entry.end = endBytes;
+        entry.size = fileSize;
+        entry.dvdPath = "/" + relPath;
+        const std::string baseHostPath = (fs::path(GetDvdRoot()) / "files" / fs::path(relPath)).string();
+        entry.hostPath = ResolveDvdMappedHostPath(entry.dvdPath, baseHostPath);
+        g_fstFiles.push_back(std::move(entry));
+    }
+
+    std::sort(g_fstFiles.begin(), g_fstFiles.end(),
+              [](const FstFileEntry& a, const FstFileEntry& b) { return a.start < b.start; });
+
+}
+
+static const PublishedExtent* FindPublishedExtentForByteOffset(uint64_t offset) {
+    if (g_publishedExtents.empty()) {
+        return nullptr;
+    }
+
+    auto it = std::upper_bound(
+        g_publishedExtents.begin(), g_publishedExtents.end(), offset,
+        [](uint64_t value, const PublishedExtent& extent) { return value < extent.startBytes; });
+    if (it == g_publishedExtents.begin()) {
+        return nullptr;
+    }
+    --it;
+    if (offset >= it->startBytes && offset < it->endBytes) {
+        return &(*it);
+    }
+    return nullptr;
+}
+
+struct AbsReadResult {
+    const DVDFileEntry* entry = nullptr;
+    uint32_t fileOffset = 0;
+    uint32_t readLength = 0;
+};
+
+static bool ResolveAbsRead(uint32_t offset, uint32_t length, AbsReadResult& out) {
+    // The extent table is available after DVDInit publishes the FST.
+    DVDInit_8015EA1C();
+    const PublishedExtent* extent = FindPublishedExtentForByteOffset(offset);
+    uint64_t effectiveOffset = offset;
+
+    if (!extent) {
+        // Accept both byte offsets and the FST's four-byte word offsets.
+        const uint64_t scaledOffset = static_cast<uint64_t>(offset) * 4ull;
+        extent = FindPublishedExtentForByteOffset(scaledOffset);
+        if (extent) {
+            effectiveOffset = scaledOffset;
+        }
+    }
+
+    if (!extent) {
+        return false;
+    }
+
+    const DVDFileEntry& entry = g_fileEntries[extent->entryIndex];
+    const uint32_t fileOffset = static_cast<uint32_t>(effectiveOffset - extent->startBytes);
+    uint32_t readLength = length;
+    if (readLength == 0 || fileOffset + readLength > entry.size) {
+        readLength = entry.size - fileOffset;
+    }
+
+    out.entry = &entry;
+    out.fileOffset = fileOffset;
+    out.readLength = readLength;
+    return true;
+}
+
+// Helper: Normalize paths (Windows backslash -> forward slash, lowercase for lookup)
+static std::string NormalizePath(const std::string& path) {
+    return DvdFstContract::NormalizeLookupPath(path);
+}
+
+static void RegisterFileEntry(std::string dvdPath, const fs::path& hostPath, uint32_t size) {
+    dvdPath = DvdFstContract::CanonicalizePath(dvdPath);
+
+    DVDFileEntry fileEntry;
+    fileEntry.hostPath = hostPath.string();
+    fileEntry.dvdPath = dvdPath;
+    fileEntry.size = size;
+
+    const int32_t entryNum = static_cast<int32_t>(g_fileEntries.size());
+    g_fileEntries.push_back(std::move(fileEntry));
+    g_pathToEntry[NormalizePath(dvdPath)] = entryNum;
+}
+
+// True when a disc path already has an entry (vanilla disc or an earlier
+// overlay registration). Uses the same canonicalization as RegisterFileEntry.
+static bool DvdEntryExists(const std::string& dvdPath) {
+    return g_pathToEntry.find(NormalizePath(DvdFstContract::CanonicalizePath(dvdPath))) !=
+           g_pathToEntry.end();
+}
+
+// Walk `root` and hand every entry to `visit`. Uses the error_code iterator forms so an
+// unreadable entry doesn't abort the rest of the overlay. `announceErrors` keeps the
+// disc-index scan noisy and the by-name mapping quiet, matching each caller's old behavior.
+template <typename Visit>
+static void WalkDirectory(const fs::path& root, bool recursive, bool announceErrors, Visit&& visit) {
+    std::error_code ec;
+
+    if (!recursive) {
+        for (const auto& entry : fs::directory_iterator(
+                 root, fs::directory_options::skip_permission_denied, ec)) {
+            if (ec) {
+                break;
+            }
+            visit(entry);
+        }
+        return;
+    }
+
+    fs::recursive_directory_iterator it(root, fs::directory_options::skip_permission_denied, ec);
+    if (ec) {
+        if (announceErrors) {
+            RT_LOG(RT_TAG_DVD) << "WARNING: cannot enumerate " << root.string() << ": "
+                      << ec.message() << std::endl;
+        }
+        return;
+    }
+
+    const fs::recursive_directory_iterator end;
+    while (it != end) {
+        const fs::directory_entry entry = *it;
+
+        it.increment(ec);
+        if (ec) {
+            if (announceErrors) {
+                RT_LOG(RT_TAG_DVD) << "WARNING: stopped enumerating " << root.string() << ": "
+                          << ec.message() << std::endl;
+                return;
+            }
+            visit(entry);
+            return;
+        }
+
+        visit(entry);
+    }
+}
+
+// Helper: Scan directory and build file index.
+// addNewFiles=false is Riivolution's create="false": only files already on
+// the disc may be replaced, nothing new is added.
+static void ScanDirectory(const fs::path& root, const std::string& virtualPrefix,
+                          bool recursive = true, bool addNewFiles = true) {
+    std::error_code ec;
+    if (!fs::exists(root, ec)) {
+        return;
+    }
+
+    const auto registerEntry = [&](const fs::directory_entry& entry) {
+        std::error_code entryEc;
+        if (!entry.is_regular_file(entryEc) || entryEc) {
+            return;
+        }
+
+        const std::uintmax_t size = fs::file_size(entry.path(), entryEc);
+        if (entryEc) {
+            RT_LOG(RT_TAG_DVD) << "WARNING: skipping " << entry.path().string() << ": "
+                      << entryEc.message() << std::endl;
+            return;
+        }
+
+        const fs::path relative = fs::relative(entry.path(), root, entryEc);
+        if (entryEc) {
+            return;
+        }
+
+        std::string prefix = virtualPrefix.empty() ? "/" : virtualPrefix;
+        if (prefix.back() != '/' && prefix.back() != '\\') {
+            prefix += "/";
+        }
+        std::string dvdPath = prefix + relative.string();
+        if (!addNewFiles && !DvdEntryExists(dvdPath)) {
+            return;
+        }
+        RegisterFileEntry(std::move(dvdPath), entry.path(), static_cast<uint32_t>(size));
+    };
+
+    WalkDirectory(root, recursive, /*announceErrors=*/true, registerEntry);
+}
+
+// Riivolution <folder> without a disc path: replace disc files that share a
+// filename with a file in the external folder (Dolphin's
+// FindFilenameNodeInFST behavior, applied across the whole index).
+static void ApplyFolderByNameMapping(const RuntimeRiivolution::Mapping& mapping) {
+    // Snapshot the current index: matches by filename may only target entries
+    // that exist before this mapping, and RegisterFileEntry appends.
+    std::map<std::string, std::vector<std::string>> discPathsByName;
+    const size_t entryCount = g_fileEntries.size();
+    for (size_t i = 0; i < entryCount; ++i) {
+        const std::string& dvdPath = g_fileEntries[i].dvdPath;
+        const size_t lastSlash = dvdPath.rfind('/');
+        std::string name = lastSlash == std::string::npos ? dvdPath : dvdPath.substr(lastSlash + 1);
+        RuntimeHle::LowerInPlace(name);
+        if (!name.empty()) {
+            discPathsByName[name].push_back(dvdPath);
+        }
+    }
+
+    uint32_t replaced = 0;
+    const auto applyEntry = [&](const fs::directory_entry& entry) {
+        std::error_code entryEc;
+        if (!entry.is_regular_file(entryEc) || entryEc) {
+            return;
+        }
+        std::string name = entry.path().filename().string();
+        RuntimeHle::LowerInPlace(name);
+        const auto matches = discPathsByName.find(name);
+        if (matches == discPathsByName.end()) {
+            return;
+        }
+        const std::uintmax_t size = fs::file_size(entry.path(), entryEc);
+        if (entryEc) {
+            return;
+        }
+        for (const std::string& dvdPath : matches->second) {
+            RegisterFileEntry(dvdPath, entry.path(), static_cast<uint32_t>(size));
+            ++replaced;
+        }
+    };
+
+    WalkDirectory(mapping.hostPath, mapping.recursive, /*announceErrors=*/false, applyEntry);
+
+    RT_LOG(RT_TAG_DVD) << mapping.hostPath.string() << ": replaced " << replaced
+              << " disc file(s) by filename" << std::endl;
+}
+
+static void ScanOverlayRoot(const RuntimeRiivolution::Overlay& overlay) {
+    if (!overlay.patches) {
+        // Fallback for mod roots that mirror the disc filesystem directly (not a
+        // Riivolution pack, which wouldn't map anything useful this way).
+        RT_LOG(RT_TAG_DVD) << overlay.root.string()
+                  << ": no Riivolution XML found, treating the root as a disc-shaped overlay"
+                  << std::endl;
+        ScanDirectory(overlay.root, "/");
+        return;
+    }
+
+    for (const auto& mapping : overlay.patches->mappings) {
+        switch (mapping.kind) {
+        case RuntimeRiivolution::Mapping::Kind::File: {
+            if (!mapping.create && !DvdEntryExists(mapping.discPath)) {
+                break;
+            }
+            std::error_code ec;
+            const std::uintmax_t size = fs::file_size(mapping.hostPath, ec);
+            if (!ec) {
+                RegisterFileEntry(mapping.discPath, mapping.hostPath, static_cast<uint32_t>(size));
+            }
+            break;
+        }
+        case RuntimeRiivolution::Mapping::Kind::Folder:
+            ScanDirectory(mapping.hostPath, mapping.discPath, mapping.recursive, mapping.create);
+            break;
+        case RuntimeRiivolution::Mapping::Kind::FolderByName:
+            ApplyFolderByNameMapping(mapping);
+            break;
+        }
+    }
+}
+
+static std::string ResolveDvdMappedHostPath(const std::string& dvdPath, const std::string& fallbackHostPath) {
+    const std::string normalized = NormalizePath(dvdPath);
+    const auto it = g_pathToEntry.find(normalized);
+    if (it != g_pathToEntry.end() && it->second >= 0 &&
+        it->second < static_cast<int32_t>(g_fileEntries.size())) {
+        return g_fileEntries[it->second].hostPath;
+    }
+
+    for (const auto& overlay : RuntimeRiivolution::Overlays()) {
+        const fs::path candidate = overlay.root / fs::path(normalized.substr(1));
+        std::error_code ec;
+        if (fs::is_regular_file(candidate, ec)) {
+            return candidate.string();
+        }
+    }
+
+    return fallbackHostPath;
+}
+
+[[noreturn]] static void FailRuntimeFst(const std::string& reason) {
+    RT_LOGF(RT_TAG_DVD, "ERROR: cannot publish the runtime FST: %s\n", reason.c_str());
+    FailDvd("dvd_fst", "DVD file table is unavailable", reason);
+}
+
+static void BuildAndPublishRuntimeFst() {
+    // Preserve real disc offsets where a runtime entry replaces a file from the
+    // extracted image. Created Riivolution paths have no physical disc extent;
+    // they are opened by their shared FST/SDK entry number instead.
+    for (const FstFileEntry& fstFile : g_fstFiles) {
+        const auto mapped = g_pathToEntry.find(NormalizePath(fstFile.dvdPath));
+        if (mapped == g_pathToEntry.end() || mapped->second < 0 ||
+            mapped->second >= static_cast<int32_t>(g_fileEntries.size())) {
+            continue;
+        }
+        g_fileEntries[mapped->second].discOffsetWords = fstFile.start / 4u;
+    }
+
+    // Give runtime-added files unique synthetic disc ranges so reads can find them.
+    uint64_t nextFreeBytes = 0;
+    for (const FstFileEntry& fstFile : g_fstFiles) {
+        nextFreeBytes = std::max(nextFreeBytes, static_cast<uint64_t>(fstFile.end));
+    }
+    for (const DVDFileEntry& entry : g_fileEntries) {
+        if (entry.discOffsetWords != 0) {
+            nextFreeBytes = std::max(
+                nextFreeBytes, static_cast<uint64_t>(entry.discOffsetWords) * 4ull + entry.size);
+        }
+    }
+    for (DVDFileEntry& entry : g_fileEntries) {
+        if (entry.isDirectory || entry.discOffsetWords != 0) {
+            continue;
+        }
+        nextFreeBytes = (nextFreeBytes + 31ull) & ~31ull;
+        if (nextFreeBytes / 4ull > 0xFFFFFFFFull) {
+            FailRuntimeFst("synthetic disc extents exceed the 32-bit FST word offset range");
+        }
+        entry.discOffsetWords = static_cast<uint32_t>(nextFreeBytes / 4ull);
+        nextFreeBytes += std::max<uint32_t>(entry.size, 4u);
+    }
+
+    std::vector<DvdFstContract::RegisteredFile> registrations;
+    registrations.reserve(g_fileEntries.size());
+    for (const DVDFileEntry& entry : g_fileEntries) {
+        registrations.push_back({entry.hostPath, entry.dvdPath, entry.size, entry.discOffsetWords});
+    }
+
+    DvdFstContract::Image image;
+    try {
+        image = DvdFstContract::BuildImage(registrations);
+    } catch (const std::exception& error) {
+        FailRuntimeFst(error.what());
+    }
+
+    std::vector<DVDFileEntry> indexedEntries;
+    indexedEntries.reserve(image.entries.size());
+    for (const DvdFstContract::IndexedEntry& entry : image.entries) {
+        indexedEntries.push_back({entry.hostPath, entry.dvdPath, entry.size,
+                                  entry.discOffsetWords, entry.isDirectory});
+    }
+    g_fileEntries = std::move(indexedEntries);
+    g_pathToEntry = std::move(image.pathToEntry);
+
+    g_publishedExtents.clear();
+    g_publishedExtents.reserve(g_fileEntries.size());
+    for (size_t i = 0; i < g_fileEntries.size(); ++i) {
+        const DVDFileEntry& entry = g_fileEntries[i];
+        if (entry.isDirectory || entry.discOffsetWords == 0) {
+            continue;
+        }
+        const uint64_t startBytes = static_cast<uint64_t>(entry.discOffsetWords) * 4ull;
+        // Give empty files a one-byte range so their handles still resolve.
+        const uint64_t endBytes = startBytes + std::max<uint32_t>(entry.size, 1u);
+        g_publishedExtents.push_back({startBytes, endBytes, static_cast<int32_t>(i)});
+    }
+    std::sort(g_publishedExtents.begin(), g_publishedExtents.end(),
+              [](const PublishedExtent& a, const PublishedExtent& b) {
+                  return a.startBytes < b.startBytes;
+              });
+
+    // Use the FST memory reserved before guest code can allocate over it.
+    if (g_dvdFstReservedBase == 0 || image.bytes.size() > g_dvdFstReservedSize ||
+        !Memory::Contains(g_dvdFstReservedBase, g_dvdFstReservedSize)) {
+        std::ostringstream reason;
+        reason << "The " << image.bytes.size() << "-byte runtime FST does not fit the "
+               << g_dvdFstReservedSize << "-byte guest reservation at 0x" << std::hex
+               << g_dvdFstReservedBase << ".";
+        FailRuntimeFst(reason.str());
+    }
+
+    const uint32_t fstAddress = g_dvdFstReservedBase;
+    for (size_t i = 0; i < image.bytes.size(); ++i) {
+        Memory::Write8(fstAddress + static_cast<uint32_t>(i), image.bytes[i]);
+    }
+
+    Memory::Write32(0x80000038u, fstAddress);
+    Memory::Write32(0x8000003Cu, static_cast<uint32_t>(image.bytes.size()));
+
+    RT_LOG(RT_TAG_DVD) << "published " << image.entries.size() << " FST entries ("
+              << image.bytes.size() << " bytes) at 0x" << std::hex << fstAddress
+              << " inside the boot-time MEM2 reservation" << std::dec << std::endl;
+
+    if (const char* dumpPath = std::getenv("MKW_DUMP_FST")) {
+        std::ofstream dump(dumpPath, std::ios::binary);
+        dump.write(reinterpret_cast<const char*>(image.bytes.data()),
+                   static_cast<std::streamsize>(image.bytes.size()));
+        RT_LOG(RT_TAG_DVD) << "dumped published FST to " << dumpPath << std::endl;
+    }
+}
+
+extern "C" const char* DVDResolveHostPathForTest(const char* dvdPath)
+{
+    static std::string resolved;
+    resolved.clear();
+
+    if (!dvdPath || dvdPath[0] == '\0') {
+        return nullptr;
+    }
+
+    DVDInit_8015EA1C();
+    const std::string normalized = NormalizePath(dvdPath);
+    const auto it = g_pathToEntry.find(normalized);
+    if (it == g_pathToEntry.end() ||
+        it->second < 0 ||
+        it->second >= static_cast<int32_t>(g_fileEntries.size()) ||
+        g_fileEntries[it->second].isDirectory) {
+        return nullptr;
+    }
+
+    resolved = g_fileEntries[it->second].hostPath;
+    return resolved.c_str();
+}
+
+// ============================================================================
+// High-Level DVD API
+// ============================================================================
+
+static void InitDvdWaitingQueues()
+{
+    constexpr uint32_t kQueueBase = 0x80343230;
+    for (uint32_t i = 0; i < 4; ++i) {
+        const uint32_t queue = kQueueBase + (i * 8);
+        Memory::Write32(queue + 0, queue);
+        Memory::Write32(queue + 4, queue);
+    }
+}
+
+static void CompleteDvdCancelState()
+{
+    InitDvdWaitingQueues();
+
+    // These are the SDK DVD globals used by DVDCancelAll/__DVDPrepareReset.
+    // The actual drive work is HLE'd, so complete pending cancel/reset waits.
+    Memory::Write32(0x80386664, 0); // Canceling
+    Memory::Write32(0x80386668, 0); // ResumeFromHere
+    Memory::Write32(0x80386670, 0); // PausingFlag
+    Memory::Write32(0x8038667C, 1); // CancelAllSync complete
+    Memory::Write32(0x803866A8, 1); // PrepareReset complete
+    Memory::Write32(0x803866F0, 0); // executing command block
+}
+
+// 0x8015EA1C -> DVDInit
+extern "C" void DVDInit_8015EA1C()
+{
+    if (g_dvdInitialized) return;
+    // The scan below builds g_fileEntries incrementally, so a re-entrant call
+    // must not start a second scan on top of a half-built index and duplicate
+    // every entry.
+    static bool initializing = false;
+    if (initializing) return;
+    initializing = true;
+
+
+    // 1. Initialize Global Flags (Emulate OS state)
+    // These addresses are standard OS globals for DVD context
+    Memory::Write8(0x80386724, 1);   // Contexts initialized
+    Memory::Write8(0x80386725, 1);   // LowInit called
+    Memory::Write32(0x80386720, 0);  // Current context index
+    Memory::Write8(0x803866a0, 1);   // DVDInit called flag
+    CompleteDvdCancelState();
+
+    // 2. Initialize DVD Context structures (prevent crashes in callbacks)
+    constexpr uint32_t kContextBase = 0x803434e0;
+    constexpr uint32_t kMagicValue = 0xFEEBDAED;
+    for (int i = 0; i < 4; i++) {
+        uint32_t ctx = kContextBase + i * 0x20;
+        Memory::Write32(ctx + 0x0C, kMagicValue);
+        Memory::Write32(ctx + 0x10, i);
+    }
+
+    // 3. Set Low Memory Globals (The "Magic" Identification)
+    // This tells the game "Yes, I am Mario Kart Wii"
+    uint32_t diskHeader = 0x80000000;
+    Memory::Write32(diskHeader + 0x00, CurrentDiscGameCode());
+    Memory::Write16(diskHeader + 0x04, 0x3031);     // '01' (Maker)
+    Memory::Write8(diskHeader + 0x06, 0x01);        // Disk #1
+    // 4. Scan Files
+    fs::path rootPath(GetDvdRoot());
+    
+    // Map "<dvd_root>/files" -> "/"
+    ScanDirectory(rootPath / "files", "/");
+
+    // Map "<dvd_root>/sys" -> "/sys/" (e.g. main.dol, bi2.bin)
+    ScanDirectory(rootPath / "sys", "/sys/");
+
+    const auto& overlays = RuntimeRiivolution::Overlays();
+    if (overlays.empty() && RuntimeProduct::IsRetroRewind()) {
+        RT_LOG(RT_TAG_DVD) << "WARNING: no Retro Rewind overlay root was found. "
+                     "File replacements (menu archives, karts, drivers, courses) will not apply "
+                     "and the game will look and play like the unmodded disc. Set "
+                     "[paths] retro_rewind_root in Config.toml "
+                     "with the RetroRewind6 folder."
+                  << std::endl;
+    }
+    // RegisterFileEntry lets the last registration win, so apply the roots in
+    // reverse discovery order: the explicitly configured root outranks the mod
+    // manifest.
+    const size_t vanillaEntryCount = g_fileEntries.size();
+    for (auto overlay = overlays.rbegin(); overlay != overlays.rend(); ++overlay) {
+        ScanOverlayRoot(*overlay);
+    }
+    RT_LOG(RT_TAG_DVD) << "disc index: " << vanillaEntryCount << " disc file(s), "
+              << (g_fileEntries.size() - vanillaEntryCount) << " overlay registration(s) from "
+              << overlays.size() << " root(s)" << std::endl;
+
+    // Load FST mapping so real files keep their physical disc extents.
+    LoadFstIndex();
+    BuildAndPublishRuntimeFst();
+
+    // Initialize the translated DVD filesystem so it can use the published FST.
+    constexpr uint32_t kDvdFsInitAddress = 0x8015DF1C;
+    if (TranslatedFunctionRegistry::FindByAddressPtr(kDvdFsInitAddress)) {
+        InvokeIndirectCpu(kDvdFsInitAddress, &GetPersistentCpuContext());
+    }
+
+    g_dvdInitialized = true;
+    initializing = false;
+}
+PPC_NATIVE_OVERRIDE_VOID(8015EA1C, DVDInit_8015EA1C, (), ());
+
+// FST-only DVD functions run translated so mods can override them safely.
+
+// 0x8015E834 -> DVDReadPrio
+extern "C" int32_t DVDReadPrio_8015E834(uint32_t fileInfoPtr, uint32_t bufferPtr, int32_t length, int32_t offset, int32_t prio)
+{
+    (void)prio;
+
+    uint32_t startWords = 0;
+    try {
+        startWords = Memory::Read32(fileInfoPtr + DVD_FILEINFO_OFFSET_ADDR);
+    } catch (const Memory::AccessViolation&) {
+        return DvdReadFatal(fileInfoPtr, "<invalid DVD file info>", offset,
+                            length > 0 ? static_cast<uint32_t>(length) : 0,
+                            "DVD file info is outside guest memory");
+    }
+
+    // Treat startAddr as an FST offset, including offsets inside a file.
+    const uint64_t startBytes = static_cast<uint64_t>(startWords) * 4ull;
+    const PublishedExtent* extent = FindPublishedExtentForByteOffset(startBytes);
+    if (!extent) {
+        return DvdReadFatal(fileInfoPtr, "<unresolved DVD file handle>", offset,
+                            length > 0 ? static_cast<uint32_t>(length) : 0,
+                            "DVD file info does not reference a published FST extent");
+    }
+
+    const DVDFileEntry& entry = g_fileEntries[extent->entryIndex];
+
+    if (offset < 0 || length < 0) {
+        return DvdReadFatal(fileInfoPtr, entry.hostPath, offset,
+                            length > 0 ? static_cast<uint32_t>(length) : 0,
+                            "negative DVD read offset or length");
+    }
+
+    const uint64_t extentBias = startBytes - extent->startBytes;
+    const uint64_t requestedOffset = extentBias + static_cast<uint32_t>(offset);
+    uint32_t uLength = (uint32_t)length;
+
+    if (requestedOffset >= entry.size) {
+        return DvdReadFatal(fileInfoPtr, entry.hostPath, offset, uLength,
+                            "read offset is outside the indexed DVD file");
+    }
+    const uint32_t uOffset = static_cast<uint32_t>(requestedOffset);
+
+    if (uLength > entry.size - uOffset) {
+        uLength = entry.size - uOffset;
+    }
+
+    if (uLength != 0 && !Memory::Contains(bufferPtr, uLength)) {
+        return DvdReadFatal(fileInfoPtr, entry.hostPath, offset, uLength,
+                            "DVD read destination is outside guest memory");
+    }
+
+    std::vector<uint8_t> tempBuf;
+    DvdReadContract::HostReadFailure failure;
+    if (!DvdReadContract::ReadExact(entry.hostPath, uOffset, uLength, tempBuf, failure)) {
+        return DvdReadFatal(fileInfoPtr, entry.hostPath, offset, uLength,
+                            DvdReadContract::Describe(failure));
+    }
+
+    CopyToGuestAsDma(bufferPtr, tempBuf.data(), uLength);
+
+    Memory::Write32(fileInfoPtr + DVD_CB_OFFSET_TRANSFERRED, uLength);
+    Memory::Write32(fileInfoPtr + DVD_CB_OFFSET_STATE, DVD_STATE_END);
+    CompleteDvdCancelState();
+
+    return static_cast<int32_t>(uLength);
+}
+PPC_NATIVE_OVERRIDE(8015E834, DVDReadPrio_8015E834, int32_t, (uint32_t f, uint32_t b, int32_t l, int32_t o, int32_t p), (f, b, l, o, p));
+
+// 0x8015E74C -> DVDReadAsyncPrio (internal)
+// HLE: perform synchronous read and invoke callback immediately.
+extern "C" int32_t DVD__ReadAsyncPrio_HLE_8015e74c(uint32_t fileInfoPtr,
+                                                   uint32_t bufferPtr,
+                                                   int32_t length,
+                                                   int32_t offset,
+                                                   uint32_t callbackPtr,
+                                                   int32_t prio)
+{
+    const int32_t bytesRead = DVDReadPrio_8015E834(fileInfoPtr, bufferPtr, length, offset, prio);
+
+    InvokeDvdCallback(callbackPtr, bytesRead, fileInfoPtr);
+    CompleteDvdCancelState();
+    return bytesRead >= 0 ? 1 : 0;
+}
+PPC_NATIVE_OVERRIDE(8015E74C, DVD__ReadAsyncPrio_HLE_8015e74c, int32_t,
+         (uint32_t f, uint32_t b, int32_t l, int32_t o, uint32_t cb, int32_t p),
+         (f, b, l, o, cb, p));
+
+// 0x801628CC -> DVDReadAbsAsyncPrio (internal)
+// HLE: resolve the absolute disc offset to a host file and read it.
+extern "C" int32_t DVD__ReadAbsAsyncPrio_HLE_801628cc(uint32_t cmdBlockPtr,
+                                                      uint32_t bufferPtr,
+                                                      int32_t length,
+                                                      int32_t offset,
+                                                      uint32_t callbackPtr,
+                                                      int32_t prio)
+{
+    (void)prio;
+    int32_t bytesRead = -1;
+    {
+        AbsReadResult readInfo;
+        const uint32_t requestedLength = length > 0 ? static_cast<uint32_t>(length) : 0;
+        const uint32_t absoluteOffset = static_cast<uint32_t>(offset);
+        if (length < 0) {
+            bytesRead = DvdReadFatal(cmdBlockPtr, "<unmapped DVD offset>", absoluteOffset, 0,
+                                     "negative absolute DVD read length");
+        } else if (!ResolveAbsRead(absoluteOffset, requestedLength, readInfo)) {
+            bytesRead = DvdReadFatal(cmdBlockPtr, "<unmapped DVD offset>", absoluteOffset,
+                                     requestedLength,
+                                     "absolute DVD read offset is not mapped to a host file");
+        } else if (requestedLength != 0 && readInfo.readLength != requestedLength) {
+            bytesRead = DvdReadFatal(cmdBlockPtr, readInfo.entry->hostPath,
+                                     readInfo.fileOffset, requestedLength,
+                                     "requested range extends beyond the indexed DVD file");
+        } else if (requestedLength != 0 && !Memory::Contains(bufferPtr, requestedLength)) {
+            bytesRead = DvdReadFatal(cmdBlockPtr, readInfo.entry->hostPath,
+                                     readInfo.fileOffset, requestedLength,
+                                     "DVD read destination is outside guest memory");
+        } else {
+            std::vector<uint8_t> tempBuf;
+            DvdReadContract::HostReadFailure failure;
+            if (!DvdReadContract::ReadExact(readInfo.entry->hostPath,
+                                            readInfo.fileOffset,
+                                            readInfo.readLength,
+                                            tempBuf,
+                                            failure)) {
+                bytesRead = DvdReadFatal(cmdBlockPtr, readInfo.entry->hostPath,
+                                         readInfo.fileOffset, readInfo.readLength,
+                                         DvdReadContract::Describe(failure));
+            } else {
+                CopyToGuestAsDma(bufferPtr, tempBuf.data(), tempBuf.size());
+                bytesRead = static_cast<int32_t>(tempBuf.size());
+            }
+        }
+
+        if (bytesRead >= 0) {
+            try {
+                Memory::Write32(cmdBlockPtr + DVD_CB_OFFSET_STATE, DVD_STATE_END);
+                Memory::Write32(cmdBlockPtr + DVD_CB_OFFSET_TRANSFERRED,
+                                static_cast<uint32_t>(bytesRead));
+            } catch (const Memory::AccessViolation&) {
+            }
+        }
+    }
+
+    InvokeDvdCallback(callbackPtr, bytesRead, cmdBlockPtr);
+    CompleteDvdCancelState();
+    return bytesRead >= 0 ? 1 : 0;
+}
+PPC_NATIVE_OVERRIDE(801628CC, DVD__ReadAbsAsyncPrio_HLE_801628cc, int32_t,
+         (uint32_t cb, uint32_t b, int32_t l, int32_t o, uint32_t cbfn, int32_t p),
+         (cb, b, l, o, cbfn, p));
+
+
+// ============================================================================
+// Low-Level / Core DVD (The "Magic" Handlers)
+// ============================================================================
+
+// 0x80164848 -> DVDLowInit
+extern "C" int32_t DVDLowInit_80164848() {
+    // Just ensure init is done
+    DVDInit_8015EA1C(); 
+    return 1;
+}
+PPC_NATIVE_OVERRIDE(80164848, DVDLowInit_80164848, int32_t, (), ());
+
+extern "C" int32_t DVDLowInquiry_80165A30(uint32_t cmdBlockPtr, uint32_t callback)
+{
+    // HLE: acknowledge the drive is present. Must mark the command block complete
+    // (State = 0) or callers polling this address hang waiting for "Busy" to clear.
+    if (cmdBlockPtr) {
+        Memory::Write32(cmdBlockPtr + DVD_CB_OFFSET_STATE, DVD_STATE_END);
+    }
+    CompleteDvdCancelState();
+
+    return 1; // Return 1 to indicate the command was successfully issued.
+}
+PPC_NATIVE_OVERRIDE(80165A30, DVDLowInquiry_80165A30, int32_t, (uint32_t b, uint32_t c), (b, c));
+
+// 0x80164AAC -> DVDLowReadDiskID
+extern "C" int32_t DVDLowReadDiskID_80164AAC(uint32_t diskIdPtr, uint32_t callback) {
+    if (diskIdPtr) {
+        Memory::Write32(diskIdPtr + 0x00, CurrentDiscGameCode());
+        Memory::Write16(diskIdPtr + 0x04, 0x3031);
+        Memory::Write8 (diskIdPtr + 0x06, 0x01);
+    }
+    CompleteDvdCancelState();
+    return 1; // Success
+}
+PPC_NATIVE_OVERRIDE(80164AAC, DVDLowReadDiskID_80164AAC, int32_t, (uint32_t p, uint32_t c), (p, c));
+
+// 0x80166330 -> DVDLowRead (And 0x80165708 UnencryptedRead)
+// The game calls this to read the Disk Header (offset 0) or raw data.
+extern "C" int32_t DVDLowRead_80166330(uint32_t buffer, uint32_t length, uint32_t offset, uint32_t callback)
+{
+    const auto finish = [callback](bool succeeded) {
+        const auto completion = DvdReadContract::CompletionFor(succeeded);
+        InvokeDvdLowCallback(callback, completion.callbackResult);
+        CompleteDvdCancelState();
+        return completion.returnValue;
+    };
+
+    if (length == 0) {
+        return finish(true);
+    }
+
+    if (offset == 0 && length >= 0x20) {
+        if (!Memory::Contains(buffer, length)) {
+            ReportDvdReadError("<synthetic disc header>", offset, length,
+                               "DVD read destination is outside guest memory");
+            return finish(false);
+        }
+        Memory::Write32(buffer + 0x00, CurrentDiscGameCode());
+        Memory::Write16(buffer + 0x04, 0x3031);     // 01
+        GxNotifyGuestRamDmaWrite(buffer, length);
+        return finish(true);
+    }
+
+    AbsReadResult readInfo;
+    if (!ResolveAbsRead(offset, length, readInfo)) {
+        ReportDvdReadError("<unmapped DVD offset>", offset, length,
+                           "absolute DVD read offset is not mapped to a host file");
+        return finish(false);
+    }
+    if (readInfo.readLength != length) {
+        ReportDvdReadError(readInfo.entry->hostPath, readInfo.fileOffset, length,
+                           "requested range extends beyond the indexed DVD file");
+        return finish(false);
+    }
+    if (!Memory::Contains(buffer, length)) {
+        ReportDvdReadError(readInfo.entry->hostPath, readInfo.fileOffset, length,
+                           "DVD read destination is outside guest memory");
+        return finish(false);
+    }
+
+    std::vector<uint8_t> tempBuf;
+    DvdReadContract::HostReadFailure failure;
+    if (!DvdReadContract::ReadExact(readInfo.entry->hostPath,
+                                    readInfo.fileOffset,
+                                    readInfo.readLength,
+                                    tempBuf,
+                                    failure)) {
+        ReportDvdReadError(readInfo.entry->hostPath, readInfo.fileOffset,
+                           readInfo.readLength, DvdReadContract::Describe(failure));
+        return finish(false);
+    }
+
+    CopyToGuestAsDma(buffer, tempBuf.data(), tempBuf.size());
+    return finish(true);
+}
+PPC_NATIVE_OVERRIDE(80166330, DVDLowRead_80166330, int32_t, (uint32_t b, uint32_t l, uint32_t o, uint32_t c), (b, l, o, c));
+
+// UnencryptedRead has the same completion and failure contract as DVDLowRead.
+extern "C" int32_t DVDLowUnencryptedRead_80165708(uint32_t b, uint32_t l, uint32_t o, uint32_t c) {
+    return DVDLowRead_80166330(b, l, o, c);
+}
+PPC_NATIVE_OVERRIDE(80165708, DVDLowUnencryptedRead_80165708, int32_t, (uint32_t b, uint32_t l, uint32_t o, uint32_t c), (b, l, o, c));
+
+// ============================================================================
+// Other Necessary Stubs
+// ============================================================================
+
+extern "C" int32_t DVDCheckDevice_801643FC() { return 1; } // Ready
+PPC_NATIVE_OVERRIDE(801643FC, DVDCheckDevice_801643FC, int32_t, (), ());
+
+extern "C" int32_t DVDLowClearCoverInterrupt_80166964(uint32_t cb) { return 1; }
+PPC_NATIVE_OVERRIDE(80166964, DVDLowClearCoverInterrupt_80166964, int32_t, (uint32_t cb), (cb));
+
diff --git a/runtime/src/hle/storage/nand_api.cpp b/runtime/src/hle/storage/nand_api.cpp
new file mode 100644
index 0000000..abd3605
--- /dev/null
+++ b/runtime/src/hle/storage/nand_api.cpp
@@ -0,0 +1,446 @@
+// NAND/ISFS HLE: the synchronous RVL NAND* library.
+//
+// Shared state and helpers live in nand_internal.h.
+
+#include "nand_internal.h"
+
+// ============================================================================
+// Local helpers
+// ============================================================================
+
+// Unchecked NUL-terminated write into guest memory. The RVL NAND library hands
+// out fixed-size caller buffers and never tells us how big they are, so this
+// deliberately matches the library's own unbounded copy.
+static void WriteGuestNandPath(uint32_t address, const std::string& value) {
+    for (size_t i = 0; i < value.size(); ++i) {
+        Memory::Write8(address + static_cast<uint32_t>(i), static_cast<uint8_t>(value[i]));
+    }
+    Memory::Write8(address + static_cast<uint32_t>(value.size()), 0);
+}
+
+// NANDGetHomeDir and NANDGetCurrentDir both answer with the title's data
+// directory; the SDK keeps no separate working directory for us to track.
+static int32_t WriteNandDataDir(uint32_t outPathPtr) {
+    if (!outPathPtr) {
+        return NAND_RESULT_INVALID;
+    }
+    WriteGuestNandPath(outPathPtr, CurrentNandDataDir());
+    return NAND_RESULT_OK;
+}
+
+// fileInfoPtr -> fd -> live handle. Logs and returns null when the guest hands
+// us a descriptor that was never opened (or was already closed).
+static FileHandle* ResolveNandFileHandle(const char* who, uint32_t fileInfoPtr) {
+    const int32_t fd = static_cast<int32_t>(Memory::Read32(fileInfoPtr));
+    FileHandle* handle = GetHandle(fd);
+    if (!handle || !handle->file) {
+        LogNandError(who, "invalid fd=%d", fd);
+        return nullptr;
+    }
+    return handle;
+}
+
+// ============================================================================
+// The synchronous RVL NAND* library
+// ============================================================================
+
+extern "C" int32_t NANDInit_HLE(void) {
+    // Initialize ISFS
+    ISFS_OpenLib_Initialize(&GetPersistentCpuContext());
+
+    // NANDHomeDir is at 0x80346D20 (from ESP_GetDataDir output)
+    WriteGuestNandPath(0x80346D20, CurrentNandDataDir());
+
+    // Mark NAND as initialized (0x80386848 = 2)
+    Memory::Write32(0x80386848, 2);
+
+    return NAND_RESULT_OK;
+}
+PPC_NATIVE_OVERRIDE(8019E18C, NANDInit_HLE, int32_t, (void), ());
+
+extern "C" int32_t NANDGetCurrentDir_HLE(uint32_t outPathPtr) {
+    return WriteNandDataDir(outPathPtr);
+}
+PPC_NATIVE_OVERRIDE(8019E390, NANDGetCurrentDir_HLE, int32_t, (uint32_t outPathPtr), (outPathPtr));
+
+extern "C" int32_t NANDCheck_HLE(uint32_t blockSize, uint32_t blockCount, uint32_t outResults) {
+    const int32_t result = NandCheckContract::WriteHealthyResult(
+        outResults,
+        [](uint32_t address, size_t length) { return Memory::Contains(address, length); },
+        [](uint32_t address, uint32_t value) {
+            try {
+                Memory::Write32(address, value);
+                return true;
+            } catch (const Memory::AccessViolation&) {
+                return false;
+            }
+        });
+    if (result != NAND_RESULT_OK) {
+        LogNandError("NANDCheck",
+                     "FAILED: invalid four-byte result buffer 0x%08X (blockSize=%u blockCount=%u)",
+                     outResults, blockSize, blockCount);
+    }
+    return result;
+}
+PPC_NATIVE_OVERRIDE(8019EAD0, NANDCheck_HLE, int32_t, (uint32_t blockSize, uint32_t blockCount, uint32_t outResults), (blockSize, blockCount, outResults));
+
+extern "C" int32_t NANDOpen_HLE(uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode) {
+    const char* path = pathPtr ? (const char*)Memory::GetPointer(pathPtr) : nullptr;
+    if (!path || !fileInfoPtr) {
+        LogNandError("NANDOpen", "invalid params: path=%p fileInfo=0x%08X", path, fileInfoPtr);
+        return NAND_RESULT_INVALID;
+    }
+
+    std::string hostPath = TranslateNandPath(path);
+
+    // Existing-file write opens go through a shadow copy seeded from the original, so a
+    // crash between NANDWrite and NANDClose cannot leave a torn file (the game patches
+    // sub-ranges, e.g. ghost saves at a non-zero offset). New files still create in place.
+    if ((mode == 2 || mode == 3) && PathExists(hostPath) && !IsDirectory(hostPath)) {
+        if (IsHostPathOpen(hostPath)) {
+            // Another live handle already refers to this file. A shadow would hide the
+            // writes from that handle, so stay in place for this open.
+            LogNandWarning("NANDOpen", "WARNING: '%s' already has a live handle, writing in place",
+                           hostPath.c_str());
+        } else {
+            const std::string tempPath = SafeTempPathFor(hostPath);
+            if (DiscardStaleSafeTemp(tempPath)) {
+                std::error_code ec;
+                std::filesystem::copy_file(hostPath, tempPath,
+                                           std::filesystem::copy_options::overwrite_existing, ec);
+                if (ec) {
+                    LogNandWarning("NANDOpen", "WARNING: could not seed shadow '%s' (%s), writing in place",
+                                   tempPath.c_str(), ec.message().c_str());
+                    std::remove(tempPath.c_str());
+                } else {
+                    FILE* shadow = std::fopen(tempPath.c_str(), "r+b");
+                    if (!shadow) {
+                        LogNandWarning("NANDOpen", "WARNING: could not open shadow '%s', writing in place",
+                                       tempPath.c_str());
+                        std::remove(tempPath.c_str());
+                    } else {
+                        const int32_t shadowFd = AllocateFd(tempPath, shadow, static_cast<int32_t>(mode));
+                        {
+                            std::lock_guard<std::mutex> lock(g_fdMutex);
+                            auto it = g_fileHandles.find(shadowFd);
+                            if (it != g_fileHandles.end()) {
+                                it->second.safeCommitPath = hostPath;
+                            }
+                        }
+                        Memory::Write32(fileInfoPtr, static_cast<uint32_t>(shadowFd));
+                        Memory::Write8(fileInfoPtr + 0x8a, NAND_OPEN_FLAG_OPEN);
+                        return NAND_RESULT_OK;
+                    }
+                }
+            }
+        }
+    }
+
+    const char* fopenMode = "rb";
+    if (mode == 1) fopenMode = "rb";
+    else if (mode == 2) fopenMode = "r+b";
+    else if (mode == 3) fopenMode = "r+b";
+    
+    FILE* file = std::fopen(hostPath.c_str(), fopenMode);
+    if (!file && mode >= 2) {
+        // Try creating for write modes
+        file = std::fopen(hostPath.c_str(), "w+b");
+    }
+    
+    // Create parent directories and retry
+    if (!file && CreateParentDirectories(hostPath)) {
+        file = std::fopen(hostPath.c_str(), mode >= 2 ? "w+b" : "rb");
+    }
+
+    if (!file) {
+        if (IsFaceLibResourcePath(path) && SeedFaceLibResource(hostPath)) {
+            file = std::fopen(hostPath.c_str(), fopenMode);
+        }
+        if (!file) {
+            LogNandError("NANDOpen", "FAILED to open");
+            return NAND_RESULT_NOEXISTS;
+        }
+    }
+
+    int32_t fd = AllocateFd(hostPath, file, mode);
+    Memory::Write32(fileInfoPtr, static_cast<uint32_t>(fd));
+    Memory::Write8(fileInfoPtr + 0x8a, NAND_OPEN_FLAG_OPEN);
+    return NAND_RESULT_OK;
+}
+PPC_NATIVE_OVERRIDE(8019C800, NANDOpen_HLE, int32_t, (uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode), (pathPtr, fileInfoPtr, mode));
+
+extern "C" int32_t NANDClose_HLE(uint32_t fileInfoPtr) {
+    if (!fileInfoPtr) {
+        return NAND_RESULT_INVALID;
+    }
+    
+    uint8_t openFlag = Memory::Read8(fileInfoPtr + 0x8a);
+    if (openFlag == NAND_OPEN_FLAG_SAFE_OPEN || openFlag == NAND_OPEN_FLAG_SAFE_OPEN_ASYNC) {
+        // Console behaviour (nandClose @ 0x8019CA80): only openFlag==1 is accepted, a safe
+        // handle falls through to -8. It is neither closed nor committed here.
+        LogNandWarning("NANDClose", "WARNING: refusing safe-open handle (flag=%u), NANDSafeClose is required", openFlag);
+        return NAND_RESULT_INVALID;
+    }
+    if (openFlag != NAND_OPEN_FLAG_OPEN) {
+        LogNandWarning("NANDClose", "file not open (flag=%u)", openFlag);
+        return NAND_RESULT_INVALID;
+    }
+
+    int32_t fd = static_cast<int32_t>(Memory::Read32(fileInfoPtr));
+
+    // Flush, fsync and (for shadowed write handles) atomically publish. A failure here is
+    // reported to the guest instead of being swallowed, so NandUtil_close surfaces it as a
+    // save error rather than a silent success on top of a half-written file.
+    const int32_t result = CommitAndCloseFd("NANDClose", fd, /*missingFdIsError=*/false);
+    if (result != NAND_RESULT_OK) {
+        return result;
+    }
+
+    Memory::Write8(fileInfoPtr + 0x8a, NAND_OPEN_FLAG_CLOSED); // Mark as closed
+    return NAND_RESULT_OK;
+}
+PPC_NATIVE_OVERRIDE(8019CA80, NANDClose_HLE, int32_t, (uint32_t fileInfoPtr), (fileInfoPtr));
+
+extern "C" int32_t NANDRead_HLE(uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length) {
+    if (!fileInfoPtr) {
+        return NAND_RESULT_INVALID;
+    }
+
+    FileHandle* handle = ResolveNandFileHandle("NANDRead", fileInfoPtr);
+    if (!handle) {
+        return NAND_RESULT_INVALID;
+    }
+
+    uint8_t* buffer = (uint8_t*)Memory::GetPointer(bufferPtr);
+    if (!buffer) {
+        return NAND_RESULT_INVALID;
+    }
+
+    size_t bytesRead = std::fread(buffer, 1, length, handle->file);
+    return static_cast<int32_t>(bytesRead);
+}
+PPC_NATIVE_OVERRIDE(8019B7A4, NANDRead_HLE, int32_t, (uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length), (fileInfoPtr, bufferPtr, length));
+
+extern "C" int32_t NANDWrite_HLE(uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length) {
+    if (!fileInfoPtr) {
+        return NAND_RESULT_INVALID;
+    }
+
+    FileHandle* handle = ResolveNandFileHandle("NANDWrite", fileInfoPtr);
+    if (!handle) {
+        return NAND_RESULT_INVALID;
+    }
+
+    const uint8_t* buffer = (const uint8_t*)Memory::GetPointer(bufferPtr);
+    if (!buffer) {
+        return NAND_RESULT_INVALID;
+    }
+
+    size_t bytesWritten = std::fwrite(buffer, 1, length, handle->file);
+    std::fflush(handle->file);
+    return static_cast<int32_t>(bytesWritten);
+}
+PPC_NATIVE_OVERRIDE(8019B884, NANDWrite_HLE, int32_t, (uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length), (fileInfoPtr, bufferPtr, length));
+
+extern "C" int32_t NANDSeek_HLE(uint32_t fileInfoPtr, int32_t offset, int32_t whence) {
+    if (!fileInfoPtr) {
+        return NAND_RESULT_INVALID;
+    }
+
+    FileHandle* handle = ResolveNandFileHandle("NANDSeek", fileInfoPtr);
+    if (!handle) {
+        return NAND_RESULT_INVALID;
+    }
+
+    if (std::fseek(handle->file, offset, NandSeekOrigin(whence)) != 0) {
+        return NAND_RESULT_UNKNOWN;
+    }
+
+    return static_cast<int32_t>(std::ftell(handle->file));
+}
+PPC_NATIVE_OVERRIDE(8019B964, NANDSeek_HLE, int32_t, (uint32_t fileInfoPtr, int32_t offset, int32_t whence), (fileInfoPtr, offset, whence));
+
+extern "C" int32_t NANDGetLength_HLE(uint32_t fileInfoPtr, uint32_t outLengthPtr) {
+    if (!fileInfoPtr || !outLengthPtr) {
+        return NAND_RESULT_INVALID;
+    }
+
+    FileHandle* handle = ResolveNandFileHandle("NANDGetLength", fileInfoPtr);
+    if (!handle) {
+        return NAND_RESULT_INVALID;
+    }
+
+    const NandFileExtent extent = NandProbeFileExtent(handle->file);
+    Memory::Write32(outLengthPtr, static_cast<uint32_t>(extent.size));
+    return NAND_RESULT_OK;
+}
+PPC_NATIVE_OVERRIDE(8019BF4C, NANDGetLength_HLE, int32_t, (uint32_t fileInfoPtr, uint32_t outLengthPtr), (fileInfoPtr, outLengthPtr));
+
+extern "C" int32_t NANDCreate_HLE(uint32_t pathPtr, uint32_t perm, uint32_t attr) {
+    const char* path = pathPtr ? (const char*)Memory::GetPointer(pathPtr) : nullptr;
+    if (!path) {
+        return NAND_RESULT_INVALID;
+    }
+    
+    std::string hostPath = TranslateNandPath(path);
+    CreateParentDirectories(hostPath);
+
+    // Check if file already exists
+    if (PathExists(hostPath)) {
+        return NAND_RESULT_EXISTS;
+    }
+    
+    // Create empty file
+    FILE* f = std::fopen(hostPath.c_str(), "wb");
+    if (!f) {
+        return NAND_RESULT_UNKNOWN;
+    }
+    std::fclose(f);
+    
+    return NAND_RESULT_OK;
+}
+PPC_NATIVE_OVERRIDE(8019B43C, NANDCreate_HLE, int32_t, (uint32_t pathPtr, uint32_t perm, uint32_t attr), (pathPtr, perm, attr));
+
+extern "C" int32_t NANDDelete_HLE(uint32_t pathPtr) {
+    const char* path = pathPtr ? (const char*)Memory::GetPointer(pathPtr) : nullptr;
+    if (!path) {
+        return NAND_RESULT_INVALID;
+    }
+
+    std::string hostPath = TranslateNandPath(path);
+
+    if (!PathExists(hostPath)) {
+        return NAND_RESULT_NOEXISTS;
+    }
+    
+    if (std::remove(hostPath.c_str()) == 0) {
+        return NAND_RESULT_OK;
+    }
+    
+    return NAND_RESULT_UNKNOWN;
+}
+PPC_NATIVE_OVERRIDE(8019B59C, NANDDelete_HLE, int32_t, (uint32_t pathPtr), (pathPtr));
+
+extern "C" int32_t NANDCreateDir_HLE(uint32_t pathPtr, uint32_t perm, uint32_t attr) {
+    const char* path = pathPtr ? (const char*)Memory::GetPointer(pathPtr) : nullptr;
+    if (!path) {
+        return NAND_RESULT_INVALID;
+    }
+
+    std::string hostPath = TranslateNandPath(path);
+
+    if (PathExists(hostPath)) {
+        if (IsDirectory(hostPath)) {
+            return NAND_RESULT_OK; // Already exists
+        }
+        return NAND_RESULT_EXISTS;
+    }
+    
+    if (CreateDirectoryPath(hostPath)) {
+#ifdef _WIN32
+        _mkdir(hostPath.c_str());
+#else
+        mkdir(hostPath.c_str(), 0755);
+#endif
+        return NAND_RESULT_OK;
+    }
+    
+    return NAND_RESULT_UNKNOWN;
+}
+PPC_NATIVE_OVERRIDE(8019BBE0, NANDCreateDir_HLE, int32_t, (uint32_t pathPtr, uint32_t perm, uint32_t attr), (pathPtr, perm, attr));
+
+extern "C" int32_t NANDMove_HLE(uint32_t srcPathPtr, uint32_t dstPathPtr) {
+    const char* srcPath = srcPathPtr ? (const char*)Memory::GetPointer(srcPathPtr) : nullptr;
+    const char* dstPath = dstPathPtr ? (const char*)Memory::GetPointer(dstPathPtr) : nullptr;
+    
+    if (!srcPath || !dstPath) {
+        return NAND_RESULT_INVALID;
+    }
+    
+    const std::filesystem::path srcHost = TranslateNandPath(srcPath);
+    const std::filesystem::path dstDirectoryHost = TranslateNandPath(dstPath);
+    const std::filesystem::path srcName = srcHost.filename();
+    if (srcName.empty()) {
+        return NAND_RESULT_INVALID;
+    }
+
+    // RVL SDK nandMove always appends the source entry's relative name to the
+    // second argument. The latter is a directory, not a complete destination
+    // filename (for example /tmp/banner.bin -> <title home>/banner.bin).
+    const std::filesystem::path dstHost = dstDirectoryHost / srcName;
+
+    if (!PathExists(srcHost.string())) {
+        return NAND_RESULT_NOEXISTS;
+    }
+    if (!IsDirectory(dstDirectoryHost.string())) {
+        return NAND_RESULT_NOEXISTS;
+    }
+    if (PathExists(dstHost.string())) {
+        return NAND_RESULT_EXISTS;
+    }
+
+    std::error_code ec;
+    std::filesystem::rename(srcHost, dstHost, ec);
+    if (!ec) {
+        return NAND_RESULT_OK;
+    }
+
+    LogNandError("NANDMove", "FAILED error=%d message='%s'", ec.value(), ec.message().c_str());
+    return NAND_RESULT_UNKNOWN;
+}
+PPC_NATIVE_OVERRIDE(8019BEE8, NANDMove_HLE, int32_t, (uint32_t srcPathPtr, uint32_t dstPathPtr), (srcPathPtr, dstPathPtr));
+
+extern "C" int32_t NANDGetStatus_HLE(uint32_t pathPtr, uint32_t outStatusPtr) {
+    const char* path = pathPtr ? (const char*)Memory::GetPointer(pathPtr) : nullptr;
+    if (!path || !outStatusPtr) {
+        return NAND_RESULT_INVALID;
+    }
+
+    std::string hostPath = TranslateNandPath(path);
+
+    if (!PathExists(hostPath)) {
+        return NAND_RESULT_NOEXISTS;
+    }
+    
+    // NANDStatus structure - fill with fake values
+    // This is typically used to check permissions and file type
+    Memory::Write32(outStatusPtr, 0);      // Magic/type
+    Memory::Write32(outStatusPtr + 4, 0);  // Permissions  
+    
+    return NAND_RESULT_OK;
+}
+PPC_NATIVE_OVERRIDE(8019C380, NANDGetStatus_HLE, int32_t, (uint32_t pathPtr, uint32_t outStatusPtr), (pathPtr, outStatusPtr));
+
+extern "C" int32_t NANDGetType_HLE(uint32_t pathPtr, uint32_t outTypePtr) {
+    const char* path = pathPtr ? (const char*)Memory::GetPointer(pathPtr) : nullptr;
+    if (!path || !outTypePtr) {
+        return NAND_RESULT_INVALID;
+    }
+    
+    std::string hostPath = TranslateNandPath(path);
+    
+    if (!PathExists(hostPath)) {
+        return NAND_RESULT_NOEXISTS;
+    }
+    
+    // 1 = file, 2 = directory
+    uint8_t type = IsDirectory(hostPath) ? 2 : 1;
+    Memory::Write8(outTypePtr, type);
+    return NAND_RESULT_OK;
+}
+PPC_NATIVE_OVERRIDE(8019E770, NANDGetType_HLE, int32_t, (uint32_t pathPtr, uint32_t outTypePtr), (pathPtr, outTypePtr));
+
+// ============================================================================
+// contentFastOpenNAND/contentReadNAND/contentCloseNAND: NAND-installed content (WADs) never
+// exists here, everything comes from the DVD image, so refusing is the correct SDK answer.
+// ============================================================================
+
+extern "C" int32_t contentFastOpenNAND_HLE(uint32_t contentId, uint32_t outHandlePtr) {
+    return ISFS_ENOENT;
+}
+PPC_NATIVE_OVERRIDE(8015BC80, contentFastOpenNAND_HLE, int32_t, (uint32_t contentId, uint32_t outHandlePtr), (contentId, outHandlePtr));
+
+extern "C" int32_t contentReadNAND_HLE(uint32_t handlePtr, uint32_t buffer, uint32_t length, uint32_t outReadPtr) {
+    return ISFS_EINVAL;
+}
+PPC_NATIVE_OVERRIDE(8015BCF8, contentReadNAND_HLE, int32_t, (uint32_t handlePtr, uint32_t buffer, uint32_t length, uint32_t outReadPtr), (handlePtr, buffer, length, outReadPtr));
diff --git a/runtime/src/hle/storage/nand_async.cpp b/runtime/src/hle/storage/nand_async.cpp
new file mode 100644
index 0000000..8ad225d
--- /dev/null
+++ b/runtime/src/hle/storage/nand_async.cpp
@@ -0,0 +1,513 @@
+// NAND/ISFS HLE: asynchronous entry points, guest callback dispatch and the
+// crash-safe NANDSafeOpen/NANDSafeClose shadow-write machinery.
+//
+// Shared state and helpers live in nand_internal.h.
+
+#include "nand_internal.h"
+
+// Guest callback dispatch: host NAND work completes synchronously, so an "async" call just
+// queues its guest completion callback here and an HLE pump dispatches it later.
+
+struct PendingNandCallback {
+    uint32_t callbackPtr = 0;
+    int32_t result = 0;
+    uint32_t commandBlock = 0;
+};
+
+static std::mutex g_pendingNandCallbackMutex;
+static std::deque<PendingNandCallback> g_pendingNandCallbacks;
+
+static void DispatchNandCallback(CpuContext* cpu, uint32_t callbackPtr, int32_t result, uint32_t commandBlock) {
+    if (callbackPtr == 0) {
+        return;
+    }
+
+    // The callback signature is: void callback(int result, void* commandBlock)
+    // We need to invoke it through the translated function system
+    if (!TranslatedFunctionRegistry::FindByAddressPtr(callbackPtr)) {
+        LogNandError("InvokeNandCallback", "callback 0x%08X not found in registry", callbackPtr);
+        return;
+    }
+
+    if (cpu) {
+        // IOS/NAND completions are asynchronous side calls. Run them on a
+        // scratch guest CPU context so callback argument setup and any
+        // transient LR/CTR/nonvolatile register changes do not corrupt the
+        // interrupted thread that happened to pump the completion queue.
+        CpuContext callbackCpu = *cpu;
+        callbackCpu.gpr[3] = static_cast<uint32_t>(result);
+        callbackCpu.gpr[4] = commandBlock;
+        CpuContextScope callbackScope(&callbackCpu);
+        InvokeIndirectCpu(callbackPtr, &callbackCpu);
+    } else {
+        auto& callbackCpu = GetPersistentCpuContext();
+        callbackCpu.gpr[3] = static_cast<uint32_t>(result);
+        callbackCpu.gpr[4] = commandBlock;
+        InvokeIndirectCpu(callbackPtr, &callbackCpu);
+    }
+}
+
+static void InvokeNandCallback(uint32_t callbackPtr, int32_t result, uint32_t commandBlock) {
+    if (callbackPtr == 0) {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(g_pendingNandCallbackMutex);
+    g_pendingNandCallbacks.push_back({callbackPtr, result, commandBlock});
+}
+
+void NandQueueIosCallback(uint32_t callbackPtr, int32_t result, uint32_t callbackArg) {
+    InvokeNandCallback(callbackPtr, result, callbackArg);
+}
+
+// Guest NAND callbacks can re-enter this drain: RFL's hidden-Mii loader chains one async
+// load per Mii as its own completion callback, and a database fattened by online play
+// nested hundreds of frames deep and crashed at boot. Hardware is iterative via the IPC
+// interrupt, so a nested drain refuses here and the outermost loop dispatches the queue flat.
+static thread_local int g_nandCallbackDrainDepth = 0;
+
+bool NandProcessPendingCallbacks(CpuContext* cpu, int maxToProcess) {
+    if (maxToProcess <= 0) {
+        return false;
+    }
+    if (g_nandCallbackDrainDepth != 0) {
+        return false;
+    }
+    struct DrainScope {
+        DrainScope() { ++g_nandCallbackDrainDepth; }
+        ~DrainScope() { --g_nandCallbackDrainDepth; }
+    } drainScope;
+
+    // Host-side NAND work finishes immediately. Drain a generous chunk of the guest
+    // callback queue in one pump so multi-step chains (open -> read -> close -> user cb)
+    // do not get stranded across many retrace ticks and trip the RFL/Mii error path.
+    const size_t maxCallbacksThisPump = std::max<size_t>(static_cast<size_t>(maxToProcess), 64);
+    size_t processed = 0;
+    while (processed < maxCallbacksThisPump) {
+        PendingNandCallback cb{};
+        {
+            std::lock_guard<std::mutex> lock(g_pendingNandCallbackMutex);
+            if (g_pendingNandCallbacks.empty()) {
+                break;
+            }
+            cb = g_pendingNandCallbacks.front();
+            g_pendingNandCallbacks.pop_front();
+        }
+        DispatchNandCallback(cpu, cb.callbackPtr, cb.result, cb.commandBlock);
+        ++processed;
+    }
+    return processed != 0;
+}
+
+// Async NAND entry points run the sync call, queue the guest completion callback, and return.
+// `params`'s last two args must stay named callbackPtr/commandBlockPtr since the macro bodies
+// reference them directly. PPC_NATIVE_OVERRIDE calls stay written out verbatim, not macro-generated,
+// because the C# translator regex-scans this file as raw text to decide which addresses to leave untranslated.
+
+// Returns the synchronous result verbatim.
+#define NAND_ASYNC_FWD_BODY(Name, Sync, params, sync_args)        \
+    extern "C" int32_t Name params {                              \
+        int32_t result = Sync sync_args;                          \
+        InvokeNandCallback(callbackPtr, result, commandBlockPtr); \
+        return result;                                            \
+    }
+
+// Reports only success or failure: the transferred count travels to the guest
+// through the callback, so a non-negative result collapses to NAND_RESULT_OK.
+#define NAND_ASYNC_FWD_BODY_OKZERO(Name, Sync, params, sync_args) \
+    extern "C" int32_t Name params {                              \
+        int32_t result = Sync sync_args;                          \
+        InvokeNandCallback(callbackPtr, result, commandBlockPtr); \
+        return (result < 0) ? result : NAND_RESULT_OK;            \
+    }
+
+NAND_ASYNC_FWD_BODY(NANDOpenAsync_HLE, NANDOpen_HLE,
+    (uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, fileInfoPtr, mode))
+PPC_NATIVE_OVERRIDE(8019C918, NANDOpenAsync_HLE, int32_t,
+    (uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, fileInfoPtr, mode, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY(NANDCloseAsync_HLE, NANDClose_HLE,
+    (uint32_t fileInfoPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr))
+PPC_NATIVE_OVERRIDE(8019CAEC, NANDCloseAsync_HLE, int32_t,
+    (uint32_t fileInfoPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY_OKZERO(NANDReadAsync_HLE, NANDRead_HLE,
+    (uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, bufferPtr, length))
+PPC_NATIVE_OVERRIDE(8019B80C, NANDReadAsync_HLE, int32_t,
+    (uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, bufferPtr, length, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY_OKZERO(NANDWriteAsync_HLE, NANDWrite_HLE,
+    (uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, bufferPtr, length))
+PPC_NATIVE_OVERRIDE(8019B8EC, NANDWriteAsync_HLE, int32_t,
+    (uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, bufferPtr, length, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY_OKZERO(NANDSeekAsync_HLE, NANDSeek_HLE,
+    (uint32_t fileInfoPtr, int32_t offset, int32_t whence, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, offset, whence))
+PPC_NATIVE_OVERRIDE(8019BA04, NANDSeekAsync_HLE, int32_t,
+    (uint32_t fileInfoPtr, int32_t offset, int32_t whence, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, offset, whence, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY(NANDGetLengthAsync_HLE, NANDGetLength_HLE,
+    (uint32_t fileInfoPtr, uint32_t outLengthPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, outLengthPtr))
+PPC_NATIVE_OVERRIDE(8019C048, NANDGetLengthAsync_HLE, int32_t,
+    (uint32_t fileInfoPtr, uint32_t outLengthPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, outLengthPtr, callbackPtr, commandBlockPtr));
+
+// The private/safe variants forward to the same synchronous library; only
+// NANDPrivateSafeOpen has its own implementation.
+extern "C" int32_t NANDSafeOpen_HLE(uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode,
+                                     uint32_t tempBufferPtr, uint32_t tempBufferSize);
+extern "C" int32_t NANDSafeClose_HLE(uint32_t fileInfoPtr);
+extern "C" int32_t NANDGetType_HLE(uint32_t pathPtr, uint32_t outTypePtr);
+
+NAND_ASYNC_FWD_BODY(NANDPrivateOpenAsync_HLE, NANDOpen_HLE,
+    (uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, fileInfoPtr, mode))
+PPC_NATIVE_OVERRIDE(8019C990, NANDPrivateOpenAsync_HLE, int32_t,
+    (uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, fileInfoPtr, mode, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY(NANDPrivateSafeOpenAsync_HLE, NANDSafeOpen_HLE,
+    (uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode, uint32_t tempBufferPtr, uint32_t tempBufferSize,
+     uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, fileInfoPtr, mode, tempBufferPtr, tempBufferSize))
+PPC_NATIVE_OVERRIDE(8019D104, NANDPrivateSafeOpenAsync_HLE, int32_t,
+    (uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode, uint32_t tempBufferPtr, uint32_t tempBufferSize,
+     uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, fileInfoPtr, mode, tempBufferPtr, tempBufferSize, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY(NANDSafeCloseAsync_HLE, NANDSafeClose_HLE,
+    (uint32_t fileInfoPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr))
+PPC_NATIVE_OVERRIDE(8019D720, NANDSafeCloseAsync_HLE, int32_t,
+    (uint32_t fileInfoPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (fileInfoPtr, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY(NANDPrivateCreateAsync_HLE, NANDCreate_HLE,
+    (uint32_t pathPtr, uint32_t perm, uint32_t attr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, perm, attr))
+PPC_NATIVE_OVERRIDE(8019B524, NANDPrivateCreateAsync_HLE, int32_t,
+    (uint32_t pathPtr, uint32_t perm, uint32_t attr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, perm, attr, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY(NANDPrivateCreateDirAsync_HLE, NANDCreateDir_HLE,
+    (uint32_t pathPtr, uint32_t perm, uint32_t attr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, perm, attr))
+PPC_NATIVE_OVERRIDE(8019BCC8, NANDPrivateCreateDirAsync_HLE, int32_t,
+    (uint32_t pathPtr, uint32_t perm, uint32_t attr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, perm, attr, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY(NANDPrivateDeleteAsync_HLE, NANDDelete_HLE,
+    (uint32_t pathPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr))
+PPC_NATIVE_OVERRIDE(8019B6E4, NANDPrivateDeleteAsync_HLE, int32_t,
+    (uint32_t pathPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY(NANDPrivateGetStatusAsync_HLE, NANDGetStatus_HLE,
+    (uint32_t pathPtr, uint32_t statusPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, statusPtr))
+PPC_NATIVE_OVERRIDE(8019C448, NANDPrivateGetStatusAsync_HLE, int32_t,
+    (uint32_t pathPtr, uint32_t statusPtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, statusPtr, callbackPtr, commandBlockPtr));
+
+NAND_ASYNC_FWD_BODY(NANDPrivateGetTypeAsync_HLE, NANDGetType_HLE,
+    (uint32_t pathPtr, uint32_t outTypePtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, outTypePtr))
+PPC_NATIVE_OVERRIDE(8019E7B4, NANDPrivateGetTypeAsync_HLE, int32_t,
+    (uint32_t pathPtr, uint32_t outTypePtr, uint32_t callbackPtr, uint32_t commandBlockPtr),
+    (pathPtr, outTypePtr, callbackPtr, commandBlockPtr));
+
+// NANDSafeOpen/NANDSafeClose crash-safe file replacement, mirroring console semantics (nandSafeOpen
+// @ 0x8019CB80, nandSafeClose @ 0x8019CF30): write modes copy the original to a same-volume scratch
+// file, and safeClose commits it via fflush -> _commit/fsync -> MoveFileEx(REPLACE_EXISTING | WRITE_THROUGH).
+
+static const char kNandSafeTempSuffix[] = ".nandsafe.tmp";
+
+std::string SafeTempPathFor(const std::string& hostPath) {
+    return hostPath + kNandSafeTempSuffix;
+}
+
+// Push the CRT buffer out and then force the OS to put it on the platter, so the data is
+// durable before the rename that publishes it.
+static bool FlushFileToDisk(FILE* file) {
+    if (!file) {
+        return false;
+    }
+    if (std::fflush(file) != 0) {
+        return false;
+    }
+#ifdef _WIN32
+    const int osFd = _fileno(file);
+    if (osFd < 0) {
+        return false;
+    }
+    return _commit(osFd) == 0;
+#else
+    const int osFd = fileno(file);
+    if (osFd < 0) {
+        return false;
+    }
+    return fsync(osFd) == 0;
+#endif
+}
+
+// Replace `targetPath` with `tempPath` in one step. Either the old or the new contents
+// survive a crash; there is no window where the target is truncated or partial.
+static bool AtomicReplaceHostFile(const char* who, const std::string& tempPath,
+                                  const std::string& targetPath) {
+#ifdef _WIN32
+    if (MoveFileExA(tempPath.c_str(), targetPath.c_str(),
+                    MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH)) {
+        return true;
+    }
+    LogNandError(who, "ERROR: MoveFileEx('%s' -> '%s') failed (err=%lu)",
+            tempPath.c_str(), targetPath.c_str(), static_cast<unsigned long>(GetLastError()));
+    return false;
+#else
+    if (std::rename(tempPath.c_str(), targetPath.c_str()) != 0) {
+        LogNandError(who, "ERROR: rename('%s' -> '%s') failed",
+                tempPath.c_str(), targetPath.c_str());
+        return false;
+    }
+    // Durably record the directory entry so the rename itself survives a crash.
+    const std::string directory = std::filesystem::path(targetPath).parent_path().string();
+    const int dirFd = open(directory.c_str(), O_RDONLY);
+    if (dirFd >= 0) {
+        fsync(dirFd);
+        close(dirFd);
+    }
+    return true;
+#endif
+}
+
+// Remove a scratch file left behind by a previous run that died between safe open and
+// safe close. Its contents are worthless: the original was never replaced.
+bool DiscardStaleSafeTemp(const std::string& tempPath) {
+    if (!PathExists(tempPath)) {
+        return true;
+    }
+    LogNandWarning("nand-shadow", "WARNING: discarding stale scratch file '%s' from a previous run",
+            tempPath.c_str());
+    if (std::remove(tempPath.c_str()) == 0) {
+        return true;
+    }
+    LogNandError("nand-shadow", "FAILED to remove stale scratch file '%s'", tempPath.c_str());
+    return false;
+}
+
+// True when any live handle already refers to `hostPath`, either directly or as the
+// commit target of a shadow. Used to keep shadow writes from hiding data behind a second
+// handle on the same file.
+bool IsHostPathOpen(const std::string& hostPath) {
+    std::lock_guard<std::mutex> lock(g_fdMutex);
+    for (const auto& entry : g_fileHandles) {
+        if (entry.second.path == hostPath || entry.second.safeCommitPath == hostPath) {
+            return true;
+        }
+    }
+    return false;
+}
+
+// Retire a handle: flush writable handles all the way to disk and, when the handle is a
+// shadow, atomically publish it over its commit target. On any failure the shadow is
+// dropped and the original is left exactly as it was, and the error is returned so the
+// guest's close call fails instead of silently reporting success.
+int32_t CommitAndCloseFd(const char* who, int32_t fd, bool missingFdIsError) {
+    std::string tempPath;
+    std::string commitPath;
+    FILE* file = nullptr;
+    int32_t mode = 0;
+
+    {
+        std::lock_guard<std::mutex> lock(g_fdMutex);
+        auto it = g_fileHandles.find(fd);
+        if (it == g_fileHandles.end()) {
+            if (missingFdIsError) {
+                LogNandError(who, "FAILED: unknown fd=%d", fd);
+                return NAND_RESULT_INVALID;
+            }
+            return NAND_RESULT_OK;
+        }
+        tempPath = it->second.path;
+        commitPath = it->second.safeCommitPath;
+        file = it->second.file;
+        mode = it->second.mode;
+        g_fileHandles.erase(it);
+    }
+
+    const bool needsCommit = !commitPath.empty();
+    const bool writable = needsCommit || mode >= 2;
+
+    // Only writable handles get the fsync: _commit/FlushFileBuffers fails on a handle that
+    // was opened read-only.
+    const bool flushed = writable ? FlushFileToDisk(file) : true;
+    if (file) {
+        std::fclose(file);
+    }
+
+    if (!needsCommit) {
+        if (!flushed) {
+            LogNandError(who, "ERROR: flush of '%s' failed", tempPath.c_str());
+            return NAND_RESULT_UNKNOWN;
+        }
+        return NAND_RESULT_OK;
+    }
+
+    if (!flushed) {
+        LogNandError(who, "ERROR: flush of '%s' failed, discarding it and leaving '%s' untouched",
+                tempPath.c_str(), commitPath.c_str());
+        std::remove(tempPath.c_str());
+        return NAND_RESULT_UNKNOWN;
+    }
+
+    if (!AtomicReplaceHostFile(who, tempPath, commitPath)) {
+        std::remove(tempPath.c_str());
+        return NAND_RESULT_UNKNOWN;
+    }
+
+    return NAND_RESULT_OK;
+}
+
+extern "C" int32_t NANDSafeOpen_HLE(uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode,
+                                     uint32_t tempBufferPtr, uint32_t tempBufferSize) {
+    (void)tempBufferPtr;
+    (void)tempBufferSize;
+
+    const char* path = pathPtr ? (const char*)Memory::GetPointer(pathPtr) : nullptr;
+    if (!path || !fileInfoPtr) {
+        LogNandError("NANDSafeOpen", "invalid params: path=%p fileInfo=0x%08X", path, fileInfoPtr);
+        return NAND_RESULT_INVALID;
+    }
+    if (mode < 1 || mode > 3) {
+        LogNandError("NANDSafeOpen", "FAILED: invalid access type %u", mode);
+        return NAND_RESULT_INVALID;
+    }
+
+    const std::string hostPath = TranslateNandPath(path);
+    if (hostPath.empty()) {
+        LogNandError("NANDSafeOpen", "FAILED to translate path '%s'", path);
+        return NAND_RESULT_INVALID;
+    }
+
+    // accType is recorded in the guest struct before anything else, exactly as the
+    // library does, so a caller inspecting NANDFileInfo sees the same layout.
+    Memory::Write8(fileInfoPtr + 0x88, static_cast<uint8_t>(mode));
+
+    if (mode == 1) {
+        // Read-only safe open reads the original in place; the library builds no scratch
+        // copy for this case.
+        FILE* file = std::fopen(hostPath.c_str(), "rb");
+        if (!file && IsFaceLibResourcePath(path) && SeedFaceLibResource(hostPath)) {
+            file = std::fopen(hostPath.c_str(), "rb");
+        }
+        if (!file) {
+            LogNandError("NANDSafeOpen", "FAILED to open '%s' for reading", hostPath.c_str());
+            return NAND_RESULT_NOEXISTS;
+        }
+
+        const int32_t fd = AllocateFd(hostPath, file, static_cast<int32_t>(mode));
+        Memory::Write32(fileInfoPtr, static_cast<uint32_t>(fd));
+        Memory::Write8(fileInfoPtr + 0x8a, NAND_OPEN_FLAG_SAFE_OPEN);
+        return NAND_RESULT_OK;
+    }
+
+    // Write modes. The library queries the attributes of the original first, so a safe
+    // open of a file that does not exist fails instead of creating one.
+    if (!PathExists(hostPath)) {
+        LogNandError("NANDSafeOpen", "FAILED: '%s' does not exist, safe open never creates it", hostPath.c_str());
+        return NAND_RESULT_NOEXISTS;
+    }
+    if (IsDirectory(hostPath)) {
+        LogNandError("NANDSafeOpen", "FAILED: '%s' is a directory", hostPath.c_str());
+        return NAND_RESULT_INVALID;
+    }
+
+    const std::string tempPath = SafeTempPathFor(hostPath);
+    if (!DiscardStaleSafeTemp(tempPath)) {
+        return NAND_RESULT_ACCESS;
+    }
+
+    // The scratch file starts as a byte-for-byte copy of the original and the guest is
+    // positioned at offset 0, so partial writes keep the bytes they never touch.
+    std::error_code ec;
+    std::filesystem::copy_file(hostPath, tempPath,
+                               std::filesystem::copy_options::overwrite_existing, ec);
+    if (ec) {
+        LogNandError("NANDSafeOpen", "FAILED to seed scratch file '%s' from '%s': %s",
+                tempPath.c_str(), hostPath.c_str(), ec.message().c_str());
+        std::remove(tempPath.c_str());
+        return NAND_RESULT_UNKNOWN;
+    }
+
+    FILE* file = std::fopen(tempPath.c_str(), "r+b");
+    if (!file) {
+        LogNandError("NANDSafeOpen", "FAILED to open scratch file '%s'", tempPath.c_str());
+        std::remove(tempPath.c_str());
+        return NAND_RESULT_UNKNOWN;
+    }
+
+    const int32_t fd = AllocateFd(tempPath, file, static_cast<int32_t>(mode));
+    {
+        std::lock_guard<std::mutex> lock(g_fdMutex);
+        auto it = g_fileHandles.find(fd);
+        if (it != g_fileHandles.end()) {
+            it->second.safeCommitPath = hostPath;
+        }
+    }
+
+    Memory::Write32(fileInfoPtr, static_cast<uint32_t>(fd));
+    Memory::Write8(fileInfoPtr + 0x8a, NAND_OPEN_FLAG_SAFE_OPEN);
+    return NAND_RESULT_OK;
+}
+PPC_NATIVE_OVERRIDE(8019CB74, NANDSafeOpen_HLE, int32_t,
+    (uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode, uint32_t tempBufferPtr, uint32_t tempBufferSize),
+    (pathPtr, fileInfoPtr, mode, tempBufferPtr, tempBufferSize));
+
+extern "C" int32_t NANDSafeClose_HLE(uint32_t fileInfoPtr) {
+    if (!fileInfoPtr) {
+        return NAND_RESULT_INVALID;
+    }
+
+    uint8_t openFlag = 0;
+    try {
+        openFlag = Memory::Read8(fileInfoPtr + 0x8a);
+    } catch (const Memory::AccessViolation&) {
+        LogNandError("NANDSafeClose", "memory access violation while reading open flag");
+        return NAND_RESULT_INVALID;
+    }
+
+    if (openFlag == NAND_OPEN_FLAG_OPEN) {
+        // Handle came from a plain NANDOpen; there is no pending commit to publish.
+        LogNandWarning("NANDSafeClose", "WARNING: handle was opened with NANDOpen (flag=%u) -> plain close", openFlag);
+        return NANDClose_HLE(fileInfoPtr);
+    }
+
+    if (openFlag != NAND_OPEN_FLAG_SAFE_OPEN && openFlag != NAND_OPEN_FLAG_SAFE_OPEN_ASYNC) {
+        // Safe close is allowed to be called after async sequences that already closed the file.
+        return NAND_RESULT_OK;
+    }
+
+    const int32_t fd = static_cast<int32_t>(Memory::Read32(fileInfoPtr));
+    const int32_t result = CommitAndCloseFd("NANDSafeClose", fd, /*missingFdIsError=*/true);
+    if (result != NAND_RESULT_OK) {
+        // Leave openFlag alone: NandUtil_safeClose retries transient failures.
+        return result;
+    }
+
+    Memory::Write8(fileInfoPtr + 0x8a,
+                   (openFlag == NAND_OPEN_FLAG_SAFE_OPEN) ? NAND_OPEN_FLAG_SAFE_CLOSED
+                                                          : NAND_OPEN_FLAG_SAFE_CLOSED_ASYNC);
+    return NAND_RESULT_OK;
+}
+PPC_NATIVE_OVERRIDE(8019CF28, NANDSafeClose_HLE, int32_t, (uint32_t fileInfoPtr), (fileInfoPtr));
diff --git a/runtime/src/hle/storage/nand_check_contract.h b/runtime/src/hle/storage/nand_check_contract.h
new file mode 100644
index 0000000..9f8a3d8
--- /dev/null
+++ b/runtime/src/hle/storage/nand_check_contract.h
@@ -0,0 +1,31 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <utility>
+
+namespace NandCheckContract {
+
+inline constexpr int32_t kResultOk = 0;
+inline constexpr int32_t kResultInvalid = -8;
+inline constexpr uint32_t kHealthyResultBits = 0;
+inline constexpr size_t kResultSize = sizeof(uint32_t);
+
+
+template <typename RangeValidator, typename WordWriter>
+int32_t WriteHealthyResult(uint32_t outResults,
+                           RangeValidator&& contains,
+                           WordWriter&& write32)
+{
+    if (outResults == 0 ||
+        !std::forward<RangeValidator>(contains)(outResults, kResultSize)) {
+        return kResultInvalid;
+    }
+
+    if (!std::forward<WordWriter>(write32)(outResults, kHealthyResultBits)) {
+        return kResultInvalid;
+    }
+    return kResultOk;
+}
+
+} // namespace NandCheckContract
diff --git a/runtime/src/hle/storage/nand_fs.cpp b/runtime/src/hle/storage/nand_fs.cpp
new file mode 100644
index 0000000..6b31c03
--- /dev/null
+++ b/runtime/src/hle/storage/nand_fs.cpp
@@ -0,0 +1,450 @@
+// NAND/ISFS HLE: redirects Wii NAND paths (e.g. /title/00010004/524d4350/data/rksys.dat) to
+// <nand_root>\title\00010004\524d4350\data\rksys.dat on the host.
+
+#include "nand_internal.h"
+
+#include "isa/big_endian.h"
+#include "hle/storage/riivolution.h"
+#include "runtime_log.h"
+
+// ============================================================================
+// Configuration
+// ============================================================================
+
+// Base path for the host Wii NAND directory (resolved at runtime).
+static std::string g_dolphinWiiBase;
+static std::once_flag g_dolphinWiiBaseOnce;
+
+// ============================================================================
+// Logging
+// ============================================================================
+
+static void EmitNandLog(const char* func, const char* fmt, va_list args) {
+    char buf[512];
+    vsnprintf(buf, sizeof(buf), fmt, args);
+    RT_LOGF(RT_TAG_NAND, "%s: %s\n", func, buf);
+}
+
+void LogNandError(const char* func, const char* fmt, ...) {
+    va_list args;
+    va_start(args, fmt);
+    EmitNandLog(func, fmt, args);
+    va_end(args);
+}
+
+void LogNandWarning(const char* func, const char* fmt, ...) {
+    va_list args;
+    va_start(args, fmt);
+    EmitNandLog(func, fmt, args);
+    va_end(args);
+}
+
+// ============================================================================
+// File Descriptor Management
+// ============================================================================
+
+std::map<int32_t, FileHandle> g_fileHandles;
+static int32_t g_nextFd = 100; // Start at 100 to avoid confusion with stdio fds
+std::mutex g_fdMutex;
+
+int32_t AllocateFd(const std::string& path, FILE* file, int32_t mode) {
+    std::lock_guard<std::mutex> lock(g_fdMutex);
+    int32_t fd = g_nextFd++;
+    g_fileHandles[fd] = {file, path, mode, 0};
+    return fd;
+}
+
+FileHandle* GetHandle(int32_t fd) {
+    auto it = g_fileHandles.find(fd);
+    if (it == g_fileHandles.end()) {
+        return nullptr;
+    }
+    return &it->second;
+}
+
+void CloseFd(int32_t fd) {
+    std::lock_guard<std::mutex> lock(g_fdMutex);
+    auto it = g_fileHandles.find(fd);
+    if (it != g_fileHandles.end()) {
+        if (it->second.file) {
+            std::fclose(it->second.file);
+        }
+        g_fileHandles.erase(it);
+    }
+}
+
+// ============================================================================
+// Path Translation
+// ============================================================================
+
+uint32_t CurrentMkwTitleIdLo() {
+    return RuntimeHle::CurrentGameCode(kNandTitleIdLo);
+}
+
+std::string CurrentNandDataDir() {
+    char path[64];
+    std::snprintf(path, sizeof(path), "/title/%08x/%08x/data",
+                  kNandTitleIdHi, CurrentMkwTitleIdLo());
+    return path;
+}
+
+const std::string& GetNandBasePath() {
+    std::call_once(g_dolphinWiiBaseOnce, []() {
+        g_dolphinWiiBase = RuntimeNandPath::DiscoverNandRootString();
+    });
+
+    return g_dolphinWiiBase;
+}
+
+static std::string BuildHostNandPath(std::string wiiPathStr) {
+    std::string hostPath = GetNandBasePath();
+    for (char& c : wiiPathStr) {
+        if (c == '/') {
+#ifdef _WIN32
+            c = '\\';
+#endif
+        }
+    }
+
+    if (!wiiPathStr.empty() && (wiiPathStr[0] == '\\' || wiiPathStr[0] == '/')) {
+        hostPath += wiiPathStr;
+    } else {
+        hostPath += "\\";
+        hostPath += wiiPathStr;
+    }
+    return hostPath;
+}
+
+// Collapses "." and ".." components against the NAND root. Without this, guest paths like
+// "/title/../../../../Users/..." escape the NAND root into the real filesystem under the
+// current user's permissions. ".." at the root clamps to the root, matching IOS.
+static std::string LexicallyResolveWiiPath(const std::string& path) {
+    std::vector<std::string> components;
+    std::string component;
+    // path is always absolute here, so a leading empty component is implied.
+    for (size_t i = 1; i <= path.size(); ++i) {
+        if (i < path.size() && path[i] != '/') {
+            component.push_back(path[i]);
+            continue;
+        }
+        if (component == "..") {
+            if (!components.empty()) {
+                components.pop_back();
+            }
+        } else if (!component.empty() && component != ".") {
+            components.push_back(component);
+        }
+        component.clear();
+    }
+
+    std::string resolved;
+    for (const std::string& part : components) {
+        resolved.push_back('/');
+        resolved += part;
+    }
+    return resolved.empty() ? "/" : resolved;
+}
+
+static std::string NormalizeAbsoluteWiiPath(const char* wiiPath) {
+    if (!wiiPath || wiiPath[0] == '\0') {
+        return {};
+    }
+
+    std::string path = wiiPath;
+    std::replace(path.begin(), path.end(), '\\', '/');
+    if (path[0] != '/') {
+        std::string cwd = CurrentNandDataDir();
+        if (!cwd.empty() && cwd.back() != '/') {
+            cwd.push_back('/');
+        }
+        path = cwd + path;
+    }
+    path = LexicallyResolveWiiPath(path);
+    while (path.size() > 1 && path.back() == '/') {
+        path.pop_back();
+    }
+    return path;
+}
+
+struct RiivolutionSaveRedirect {
+    bool enabled = false;
+    bool clone = false;
+    std::string hostDirectory;
+};
+
+static std::once_flag g_riivolutionSaveRedirectOnce;
+static RiivolutionSaveRedirect g_riivolutionSaveRedirect;
+
+static const RiivolutionSaveRedirect& GetRiivolutionSaveRedirect() {
+    // The active pack's <savegame> patch, resolved against the virtual SD root
+    // exactly like Dolphin resolves it for Riivolution launches. This keeps
+    // the recomp's save in the same folder a Dolphin/WheelWizard launch of the
+    // pack uses (e.g. .../Riivolution/WheelWizard/riivolution/save/RetroWFC/RMCP).
+    std::call_once(g_riivolutionSaveRedirectOnce, []() {
+        const auto& redirect = RuntimeRiivolution::GetSaveRedirect();
+        if (!redirect) {
+            return;
+        }
+        g_riivolutionSaveRedirect.enabled = true;
+        g_riivolutionSaveRedirect.clone = redirect->clone;
+        g_riivolutionSaveRedirect.hostDirectory = redirect->hostDirectory.string();
+        // Riivolution creates the redirect folder if it does not exist.
+        CreateDirectoryPath(g_riivolutionSaveRedirect.hostDirectory);
+    });
+
+    return g_riivolutionSaveRedirect;
+}
+
+static void CloneRiivolutionSaveIfNeeded(const std::string& sourceHostPath,
+                                         const std::string& redirectedHostPath,
+                                         const RiivolutionSaveRedirect& redirect) {
+    if (!redirect.clone || PathExists(redirectedHostPath) || !PathExists(sourceHostPath)) {
+        return;
+    }
+
+    CreateParentDirectories(redirectedHostPath);
+
+    std::error_code ec;
+    std::filesystem::copy_file(sourceHostPath, redirectedHostPath,
+                               std::filesystem::copy_options::skip_existing, ec);
+    if (ec) {
+        LogNandWarning("RiivolutionSave", "WARNING: failed to clone '%s' -> '%s': %s",
+                       sourceHostPath.c_str(), redirectedHostPath.c_str(), ec.message().c_str());
+    }
+}
+
+static bool ResolveRiivolutionSaveHostPath(const std::string& absoluteWiiPath, std::string& outHostPath) {
+    const RiivolutionSaveRedirect& redirect = GetRiivolutionSaveRedirect();
+    if (!redirect.enabled) {
+        return false;
+    }
+
+    const std::string dataDir = CurrentNandDataDir();
+    if (absoluteWiiPath != dataDir &&
+        (absoluteWiiPath.size() <= dataDir.size() ||
+         absoluteWiiPath.compare(0, dataDir.size(), dataDir) != 0 ||
+         absoluteWiiPath[dataDir.size()] != '/')) {
+        return false;
+    }
+
+    std::string relative;
+    if (absoluteWiiPath.size() > dataDir.size()) {
+        relative = absoluteWiiPath.substr(dataDir.size() + 1);
+    }
+
+    std::filesystem::path redirected(redirect.hostDirectory);
+    if (!relative.empty()) {
+        redirected /= std::filesystem::path(relative);
+    }
+
+    outHostPath = redirected.string();
+    CloneRiivolutionSaveIfNeeded(BuildHostNandPath(absoluteWiiPath), outHostPath, redirect);
+    return true;
+}
+
+std::string TranslateNandPath(const char* wiiPath) {
+    std::string wiiPathStr = NormalizeAbsoluteWiiPath(wiiPath);
+    if (wiiPathStr.empty()) {
+        return "";
+    }
+
+    std::string redirectedHostPath;
+    if (ResolveRiivolutionSaveHostPath(wiiPathStr, redirectedHostPath)) {
+        return redirectedHostPath;
+    }
+
+    return BuildHostNandPath(wiiPathStr);
+}
+
+// ============================================================================
+// U8 archive helper (used to seed FaceLib resources from the ISO)
+// ============================================================================
+
+struct U8Node {
+    uint32_t typeAndNameOffset;
+    uint32_t dataOffset;
+    uint32_t size;
+};
+
+static bool ExtractFromU8(const std::string& archivePath, const char* targetName, std::vector<uint8_t>& outData) {
+    std::ifstream file(archivePath, std::ios::binary);
+    if (!file) {
+        return false;
+    }
+
+    file.seekg(0, std::ios::end);
+    const std::streamsize size = file.tellg();
+    if (size < 0x20) {
+        return false;
+    }
+    file.seekg(0, std::ios::beg);
+
+    std::vector<uint8_t> data(static_cast<size_t>(size));
+    if (!file.read(reinterpret_cast<char*>(data.data()), size)) {
+        return false;
+    }
+
+    const uint32_t magic = BigEndian::Read32(data.data());
+    if (magic != 0x55AA382Du) { // "U\xAA8-"
+        return false;
+    }
+
+    const uint32_t rootOffset = BigEndian::Read32(data.data() + 0x04);
+    if (rootOffset + 0x0C > data.size()) {
+        return false;
+    }
+
+    const U8Node* root = reinterpret_cast<const U8Node*>(data.data() + rootOffset);
+    const uint32_t nodeCount = BigEndian::Read32(reinterpret_cast<const uint8_t*>(&root->size));
+    const uint32_t nodeTableSize = nodeCount * sizeof(U8Node);
+    const uint32_t stringTableOffset = rootOffset + nodeTableSize;
+    if (stringTableOffset >= data.size()) {
+        return false;
+    }
+
+    struct DirFrame {
+        std::string path;
+        uint32_t endIndex;
+    };
+    std::vector<DirFrame> stack;
+    stack.push_back({"", nodeCount});
+
+    for (uint32_t index = 1; index < nodeCount; ++index) {
+        while (!stack.empty() && index >= stack.back().endIndex) {
+            stack.pop_back();
+        }
+        if (stack.empty()) {
+            break;
+        }
+
+        const U8Node* node = reinterpret_cast<const U8Node*>(data.data() + rootOffset + index * sizeof(U8Node));
+        const uint32_t typeAndName = BigEndian::Read32(reinterpret_cast<const uint8_t*>(&node->typeAndNameOffset));
+        const uint32_t nameOffset = typeAndName & 0x00FFFFFFu;
+        const bool isDir = (typeAndName >> 24) != 0;
+        if (stringTableOffset + nameOffset >= data.size()) {
+            return false;
+        }
+
+        const char* name = reinterpret_cast<const char*>(data.data() + stringTableOffset + nameOffset);
+        const std::string fullPath = stack.back().path + name;
+
+        if (isDir) {
+            const uint32_t endIndex = BigEndian::Read32(reinterpret_cast<const uint8_t*>(&node->size));
+            stack.push_back({fullPath + "/", endIndex});
+            continue;
+        }
+
+        if (fullPath == targetName || std::strcmp(name, targetName) == 0) {
+            const uint32_t fileOffset = BigEndian::Read32(reinterpret_cast<const uint8_t*>(&node->dataOffset));
+            const uint32_t fileSize = BigEndian::Read32(reinterpret_cast<const uint8_t*>(&node->size));
+            if (fileOffset + fileSize > data.size()) {
+                return false;
+            }
+            outData.assign(data.begin() + fileOffset, data.begin() + fileOffset + fileSize);
+            return true;
+        }
+    }
+
+    return false;
+}
+
+// The only FaceLib resource the game ever seeds; every call site used to pass it
+// as an argument and the path predicate below hard-codes the same name.
+static constexpr char kFaceLibResourceName[] = "RFL_Res.dat";
+
+bool SeedFaceLibResource(const std::string& hostPath) {
+    std::vector<uint8_t> payload;
+    if (const auto dvdRoot = RuntimeConfigFile::ResolvedDvdRoot(); !dvdRoot.empty()) {
+        const auto arcPath = dvdRoot / "files" / "contents" / "RFLRes01.arc";
+        std::error_code ec;
+        if (std::filesystem::exists(arcPath, ec)) {
+            ExtractFromU8(arcPath.string(), kFaceLibResourceName, payload);
+        }
+    }
+
+    if (payload.empty()) {
+        LogNandError("FaceLibSeed", "Failed to locate %s in RFLRes01.arc", kFaceLibResourceName);
+        return false;
+    }
+
+    CreateParentDirectories(hostPath);
+
+    std::ofstream out(hostPath, std::ios::binary);
+    if (!out) {
+        LogNandError("FaceLibSeed", "Failed to create %s", hostPath.c_str());
+        return false;
+    }
+    out.write(reinterpret_cast<const char*>(payload.data()), static_cast<std::streamsize>(payload.size()));
+    if (!out) {
+        LogNandError("FaceLibSeed", "Failed to write %s", hostPath.c_str());
+        return false;
+    }
+
+    return true;
+}
+
+bool IsFaceLibResourcePath(const char* path) {
+    return std::strcmp(path, "/shared2/menu/FaceLib/RFL_Res.dat") == 0;
+}
+
+// Create directories recursively
+bool CreateDirectoryPath(const std::string& path) {
+    if (path.empty()) {
+        return true;
+    }
+
+    std::error_code ec;
+    std::filesystem::create_directories(path, ec);
+    return !ec || std::filesystem::is_directory(path);
+}
+
+// Check if a path exists
+bool PathExists(const std::string& path) {
+#ifdef _WIN32
+    return GetFileAttributesA(path.c_str()) != INVALID_FILE_ATTRIBUTES;
+#else
+    return access(path.c_str(), F_OK) == 0;
+#endif
+}
+
+// Check if path is a directory
+bool IsDirectory(const std::string& path) {
+#ifdef _WIN32
+    DWORD attrs = GetFileAttributesA(path.c_str());
+    return attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_DIRECTORY);
+#else
+    struct stat st;
+    return stat(path.c_str(), &st) == 0 && S_ISDIR(st.st_mode);
+#endif
+}
+
+bool CreateParentDirectories(const std::string& path) {
+    size_t lastSlash = path.rfind('\\');
+    if (lastSlash == std::string::npos) {
+        lastSlash = path.rfind('/');
+    }
+    if (lastSlash == std::string::npos) {
+        return false;
+    }
+    CreateDirectoryPath(path.substr(0, lastSlash));
+    return true;
+}
+
+// ============================================================================
+// stdio helpers shared by the NAND* library and the IOS_* device layer
+// ============================================================================
+
+int NandSeekOrigin(int32_t whence) {
+    if (whence == 1) return SEEK_CUR;
+    if (whence == 2) return SEEK_END;
+    return SEEK_SET;
+}
+
+NandFileExtent NandProbeFileExtent(FILE* file) {
+    NandFileExtent extent;
+    extent.position = std::ftell(file);
+    std::fseek(file, 0, SEEK_END);
+    extent.size = std::ftell(file);
+    std::fseek(file, extent.position, SEEK_SET);
+    return extent;
+}
diff --git a/runtime/src/hle/storage/nand_internal.h b/runtime/src/hle/storage/nand_internal.h
new file mode 100644
index 0000000..37e4e8d
--- /dev/null
+++ b/runtime/src/hle/storage/nand_internal.h
@@ -0,0 +1,197 @@
+// Shared NAND/ISFS HLE internals, split across nand_fs.cpp (config, logging, fds, paths, FaceLib),
+// nand_isfs.cpp (IOS_*/ISFS layer), nand_api.cpp (sync NAND* library), and nand_async.cpp (async
+// wrappers, NANDSafeOpen/Close). Anything more than one of those needs is declared here, defined once.
+
+#pragma once
+
+#include "hle_stubs.h"
+#include "nand_check_contract.h"
+#include "hle/runtime_parse_helpers.h"
+#include "memory.h"
+#include "nand_path.h"
+#include "hle/net/network.h"
+#include "recomp_mod_loader.h"
+#include "runtime_config.h"
+#include "runtime_product.h"
+#include "wii_es_crypto.h"
+
+#include <algorithm>
+#include <cstdarg>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <chrono>
+#include <fstream>
+#include <deque>
+#include <map>
+#include <mutex>
+#include <vector>
+#include <filesystem>
+#include <string>
+#include <sys/stat.h>
+
+#ifdef _WIN32
+#include <direct.h>
+#include <io.h>
+#include <windows.h>
+#define mkdir(path, mode) _mkdir(path)
+#define access _access
+#define F_OK 0
+#else
+#include <fcntl.h>
+#include <sys/types.h>
+#include <unistd.h>
+#endif
+
+// Mario Kart Wii Title ID
+namespace {
+constexpr uint32_t kNandTitleIdHi = 0x00010004;
+constexpr uint32_t kNandTitleIdLo = 0x524D4350; // "RMCP" fallback
+} // anonymous namespace
+
+// ============================================================================
+// Logging
+// ============================================================================
+
+// Always-on product logging: NAND failures are how save corruption and a
+// misconfigured NAND root reach the player. Severity is chosen by the call site
+// - never by inspecting the format string - and both levels print the same way;
+// the split records intent and is the single place to add filtering later.
+void LogNandError(const char* func, const char* fmt, ...);
+void LogNandWarning(const char* func, const char* fmt, ...);
+
+// ============================================================================
+// File Descriptor Management
+// ============================================================================
+
+struct FileHandle {
+    FILE* file = nullptr;
+    std::string path;
+    int32_t mode = 0; // 1=read, 2=write, 3=read/write
+    uint32_t position = 0;
+    // Non-empty only for write-mode NANDSafeOpen handles. `path` then points at the
+    // sibling scratch file the guest is writing into, and this is the original file it
+    // atomically replaces on NANDSafeClose.
+    std::string safeCommitPath;
+};
+
+extern std::map<int32_t, FileHandle> g_fileHandles;
+extern std::mutex g_fdMutex;
+
+int32_t AllocateFd(const std::string& path, FILE* file, int32_t mode);
+FileHandle* GetHandle(int32_t fd);
+void CloseFd(int32_t fd);
+
+// ============================================================================
+// Path Translation
+// ============================================================================
+
+uint32_t CurrentMkwTitleIdLo();
+std::string CurrentNandDataDir();
+const std::string& GetNandBasePath();
+std::string TranslateNandPath(const char* wiiPath);
+
+bool CreateDirectoryPath(const std::string& path);
+bool PathExists(const std::string& path);
+bool IsDirectory(const std::string& path);
+
+// Create the directory that contains `path`. False when `path` has no directory
+// component, i.e. there was nothing to create.
+bool CreateParentDirectories(const std::string& path);
+
+bool SeedFaceLibResource(const std::string& hostPath);
+bool IsFaceLibResourcePath(const char* path);
+
+// ============================================================================
+// stdio helpers shared by the NAND* library and the IOS_* device layer
+// ============================================================================
+
+// Guest seek whence (0/1/2) -> stdio origin. Anything else keeps SEEK_SET.
+int NandSeekOrigin(int32_t whence);
+
+struct NandFileExtent {
+    long position = 0; // stream position on entry; restored before returning
+    long size = 0;
+};
+
+NandFileExtent NandProbeFileExtent(FILE* file);
+
+// ============================================================================
+// NAND Error Codes
+// ============================================================================
+
+enum NANDResult {
+    NAND_RESULT_OK = 0,
+    NAND_RESULT_ACCESS = -1,
+    NAND_RESULT_ALLOC_FAILED = -2,
+    NAND_RESULT_BUSY = -3,
+    NAND_RESULT_CORRUPT = -4,
+    NAND_RESULT_ECC_CRIT = -5,
+    NAND_RESULT_EXISTS = -6,
+    NAND_RESULT_INVALID = -8,
+    NAND_RESULT_MAXBLOCKS = -9,
+    NAND_RESULT_MAXFD = -10,
+    NAND_RESULT_MAXFILES = -11,
+    NAND_RESULT_NOEXISTS = -12,
+    NAND_RESULT_NOTEMPTY = -13,
+    NAND_RESULT_OPENFD = -14,
+    NAND_RESULT_AUTHENTICATION = -15,
+    NAND_RESULT_UNKNOWN = -64,
+    NAND_RESULT_FATAL_ERROR = -128,
+};
+
+// NANDFileInfo::openFlag (offset 0x8a). The RVL NAND library uses distinct values for
+// plain and safe handles so NANDClose/NANDSafeClose can reject the wrong pairing
+// (see nandOpen/nandClose/nandSafeOpen/nandSafeClose at 0x8019C800..0x8019CF30).
+enum NANDOpenFlag {
+    NAND_OPEN_FLAG_NONE = 0,
+    NAND_OPEN_FLAG_OPEN = 1,               // NANDOpen
+    NAND_OPEN_FLAG_CLOSED = 2,             // NANDClose
+    NAND_OPEN_FLAG_SAFE_OPEN = 3,          // NANDSafeOpen (sync)
+    NAND_OPEN_FLAG_SAFE_CLOSED = 4,        // NANDSafeClose (sync)
+    NAND_OPEN_FLAG_SAFE_OPEN_ASYNC = 5,    // NANDSafeOpenAsync
+    NAND_OPEN_FLAG_SAFE_CLOSED_ASYNC = 6,  // NANDSafeCloseAsync
+};
+
+// ISFS error codes (IOS filesystem)
+enum ISFSResult {
+    ISFS_OK = 0,
+    ISFS_EINVAL = -101,      // Invalid argument
+    ISFS_EACCESS = -102,     // Permission denied
+    ISFS_ECORRUPT = -103,    // Data corrupted
+    ISFS_EEXIST = -105,      // File exists
+    ISFS_ENOENT = -106,      // No such file/directory
+    ISFS_ENOMEM = -107,      // Out of memory
+    ISFS_EFULL = -108,       // Filesystem full
+    ISFS_ENOTEMPTY = -109,   // Directory not empty
+    ISFS_EBUSY = -110,       // Resource busy
+    ISFS_ENOENT2 = -4,       // Alternative no such file
+    ISFS_EIO = -114,         // I/O error
+    ISFS_MAXFD = -22,        // Max file descriptors
+};
+
+// ============================================================================
+// ISFS library initialization (defined in nand_isfs.cpp)
+// ============================================================================
+
+int32_t ISFS_OpenLib_Initialize(CpuContext* ctx);
+
+// Shadow-write machinery, defined with the NANDSafeOpen/NANDSafeClose section below.
+std::string SafeTempPathFor(const std::string& hostPath);
+bool DiscardStaleSafeTemp(const std::string& tempPath);
+bool IsHostPathOpen(const std::string& hostPath);
+int32_t CommitAndCloseFd(const char* who, int32_t fd, bool missingFdIsError);
+
+// Synchronous NAND library entry points (defined in nand_api.cpp); the async
+// wrappers in nand_async.cpp forward to them.
+extern "C" int32_t NANDOpen_HLE(uint32_t pathPtr, uint32_t fileInfoPtr, uint32_t mode);
+extern "C" int32_t NANDClose_HLE(uint32_t fileInfoPtr);
+extern "C" int32_t NANDRead_HLE(uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length);
+extern "C" int32_t NANDWrite_HLE(uint32_t fileInfoPtr, uint32_t bufferPtr, uint32_t length);
+extern "C" int32_t NANDSeek_HLE(uint32_t fileInfoPtr, int32_t offset, int32_t whence);
+extern "C" int32_t NANDGetLength_HLE(uint32_t fileInfoPtr, uint32_t outLengthPtr);
+extern "C" int32_t NANDCreate_HLE(uint32_t pathPtr, uint32_t perm, uint32_t attr);
+extern "C" int32_t NANDDelete_HLE(uint32_t pathPtr);
+extern "C" int32_t NANDCreateDir_HLE(uint32_t pathPtr, uint32_t perm, uint32_t attr);
+extern "C" int32_t NANDGetStatus_HLE(uint32_t pathPtr, uint32_t outStatusPtr);
diff --git a/runtime/src/hle/storage/nand_isfs.cpp b/runtime/src/hle/storage/nand_isfs.cpp
new file mode 100644
index 0000000..b92103d
--- /dev/null
+++ b/runtime/src/hle/storage/nand_isfs.cpp
@@ -0,0 +1,1017 @@
+// NAND/ISFS HLE: the IOS_* device layer.
+//
+// Shared state and helpers live in nand_internal.h.
+
+#include "nand_internal.h"
+
+#include "runtime_log.h"
+
+extern "C" void OSSleepThread_HLE_801aa9b8(CpuContext* ctx);
+
+// ============================================================================
+// SHA device handles
+// ============================================================================
+
+struct ShaHandle {
+    CryptoPP::SHA1 hash;
+    uint64_t byteCount = 0;
+
+    void Restart() {
+        hash.Restart();
+        byteCount = 0;
+    }
+};
+
+static std::map<int32_t, ShaHandle> g_shaHandles;
+static int32_t g_nextShaFd = 0x10001;
+static std::mutex g_shaMutex;
+
+static int32_t AllocateShaFd() {
+    std::lock_guard<std::mutex> lock(g_shaMutex);
+    const int32_t fd = g_nextShaFd++;
+    g_shaHandles.try_emplace(fd);
+    return fd;
+}
+
+static ShaHandle* GetShaHandle(int32_t fd) {
+    auto it = g_shaHandles.find(fd);
+    if (it == g_shaHandles.end()) {
+        return nullptr;
+    }
+    return &it->second;
+}
+
+static void CloseShaFd(int32_t fd) {
+    std::lock_guard<std::mutex> lock(g_shaMutex);
+    g_shaHandles.erase(fd);
+}
+
+struct ISFSFileStats {
+    uint32_t length;    // File size in bytes
+    uint32_t position;  // Current file position
+};
+
+// ============================================================================
+// Device identifiers and ioctl commands
+// ============================================================================
+
+// Special FD for /dev/fs (the ISFS device)
+static constexpr int32_t ISFS_DEV_FD = 1;
+static constexpr int32_t ES_DEV_FD = 3;
+static constexpr int32_t DOLPHIN_DEV_FD = 4;
+static constexpr uint32_t ES_IOCTL_GETDEVICEID = 0x07;
+static constexpr uint32_t ES_IOCTL_GETDEVICECERT = 0x1E;
+static constexpr uint32_t ES_IOCTL_GETTITLEID = 0x20;
+static constexpr uint32_t ES_IOCTL_SIGN = 0x30;
+static constexpr uint32_t DOLPHIN_IOCTL_GET_ELAPSED_TIME = 0x01;
+static constexpr uint32_t DOLPHIN_IOCTL_GET_VERSION = 0x02;
+static constexpr uint32_t DOLPHIN_IOCTL_GET_SPEED_LIMIT = 0x03;
+static constexpr uint32_t DOLPHIN_IOCTL_SET_SPEED_LIMIT = 0x04;
+static constexpr uint32_t DOLPHIN_IOCTL_GET_CPU_SPEED = 0x05;
+static constexpr uint32_t DOLPHIN_IOCTL_GET_REAL_PRODUCT_CODE = 0x06;
+static constexpr uint32_t DOLPHIN_IOCTL_DISCORD_SET_CLIENT = 0x07;
+static constexpr uint32_t DOLPHIN_IOCTL_DISCORD_SET_PRESENCE = 0x08;
+static constexpr uint32_t DOLPHIN_IOCTL_DISCORD_RESET = 0x09;
+static constexpr uint32_t DOLPHIN_IOCTL_GET_SYSTEM_TIME = 0x0A;
+static constexpr uint32_t SHA_IOCTL_INIT = 0;
+static constexpr uint32_t SHA_IOCTL_UPDATE = 1;
+static constexpr uint32_t SHA_IOCTL_FINAL = 2;
+
+static std::string ReadGuestCString(uint32_t address, size_t maxLength = 1024) {
+    std::string text;
+    if (address == 0) {
+        return text;
+    }
+
+    for (size_t i = 0; i < maxLength; ++i) {
+        const uint32_t current = address + static_cast<uint32_t>(i);
+        if (!Memory::Contains(current, 1)) {
+            break;
+        }
+        const char ch = static_cast<char>(Memory::Read8(current));
+        if (ch == '\0') {
+            break;
+        }
+        text.push_back(ch);
+    }
+    return text;
+}
+static constexpr uint32_t SHA_CONTEXT_SIZE = 0x1c;
+static constexpr uint32_t SHA_DIGEST_SIZE = 0x14;
+
+// Same guest layout as the /dev/net ioctlv descriptors; see runtime_parse_helpers.h.
+using IosVector = RuntimeHle::IoVector;
+using RuntimeHle::ReadIoVector;
+
+static IosVector ReadIosVector(uint32_t vectorPtr, uint32_t index) {
+    return ReadIoVector(vectorPtr, index);
+}
+
+static uint64_t CurrentMkwTitleId() {
+    uint32_t low = CurrentMkwTitleIdLo();
+    return (static_cast<uint64_t>(kNandTitleIdHi) << 32) | low;
+}
+
+static bool WriteGuestBytes(uint32_t address, uint32_t size, const uint8_t* data, size_t dataSize) {
+    if (address == 0 || size < dataSize || !Memory::Contains(address, dataSize)) {
+        return false;
+    }
+    uint8_t* out = Memory::GetPointer(address, dataSize);
+    std::memcpy(out, data, dataSize);
+    return true;
+}
+
+static bool IsValidGuestRange(uint32_t address, uint32_t size) {
+    return size == 0 || (address != 0 && Memory::Contains(address, size));
+}
+
+using DolphinClock = std::chrono::steady_clock;
+// Dolphin starts this clock when the emulation device is constructed, not on its first ioctl.
+static const DolphinClock::time_point g_dolphinElapsedStart = DolphinClock::now();
+
+static uint32_t DolphinElapsedMilliseconds() {
+    return static_cast<uint32_t>(
+        std::chrono::duration_cast<std::chrono::milliseconds>(DolphinClock::now() - g_dolphinElapsedStart).count());
+}
+
+static int32_t HandleDolphinIoctlv(uint32_t cmd, uint32_t numIn, uint32_t numOut, uint32_t vectorPtr) {
+    if (vectorPtr != 0 && !Memory::Contains(vectorPtr, static_cast<size_t>(numIn + numOut) * 8u)) {
+        return ISFS_EINVAL;
+    }
+
+    // Every /dev/dolphin command answers through exactly one output vector.
+    // `minimumSize` 0 means the case validates the buffer itself (WriteGuestBytes).
+    const auto singleOut = [&](uint32_t minimumSize, IosVector& out) -> bool {
+        if (numOut != 1 || vectorPtr == 0) {
+            return false;
+        }
+        out = ReadIosVector(vectorPtr, numIn);
+        return minimumSize == 0 ||
+               (out.size >= minimumSize && Memory::Contains(out.address, minimumSize));
+    };
+
+    IosVector out;
+    switch (cmd) {
+        case DOLPHIN_IOCTL_GET_ELAPSED_TIME: {
+            if (!singleOut(4u, out)) {
+                return ISFS_EINVAL;
+            }
+            Memory::Write32(out.address, DolphinElapsedMilliseconds());
+            return ISFS_OK;
+        }
+
+        case DOLPHIN_IOCTL_GET_VERSION: {
+            if (!singleOut(0u, out)) {
+                return ISFS_EINVAL;
+            }
+            static constexpr char kVersion[] = "WiiCompiled-DolphinDevice";
+            if (!WriteGuestBytes(out.address, out.size,
+                                 reinterpret_cast<const uint8_t*>(kVersion), sizeof(kVersion))) {
+                return ISFS_EINVAL;
+            }
+            return ISFS_OK;
+        }
+
+        case DOLPHIN_IOCTL_GET_SPEED_LIMIT:
+        case DOLPHIN_IOCTL_GET_CPU_SPEED: {
+            if (!singleOut(4u, out)) {
+                return ISFS_EINVAL;
+            }
+            Memory::Write32(out.address, cmd == DOLPHIN_IOCTL_GET_SPEED_LIMIT ? 100u : 729000000u);
+            return ISFS_OK;
+        }
+
+        case DOLPHIN_IOCTL_GET_REAL_PRODUCT_CODE: {
+            if (!singleOut(0u, out)) {
+                return ISFS_EINVAL;
+            }
+            char productCode[8] = {};
+            uint32_t discId = Memory::Contains(0x80000000u, 4u) ? Memory::Read32(0x80000000u) : kNandTitleIdLo;
+            productCode[0] = static_cast<char>((discId >> 24) & 0xffu);
+            productCode[1] = static_cast<char>((discId >> 16) & 0xffu);
+            productCode[2] = static_cast<char>((discId >> 8) & 0xffu);
+            productCode[3] = static_cast<char>(discId & 0xffu);
+            productCode[4] = '0';
+            productCode[5] = '1';
+            if (!WriteGuestBytes(out.address, out.size,
+                                 reinterpret_cast<const uint8_t*>(productCode), sizeof(productCode))) {
+                return ISFS_EINVAL;
+            }
+            return ISFS_OK;
+        }
+
+        case DOLPHIN_IOCTL_SET_SPEED_LIMIT:
+        case DOLPHIN_IOCTL_DISCORD_SET_CLIENT:
+        case DOLPHIN_IOCTL_DISCORD_SET_PRESENCE:
+        case DOLPHIN_IOCTL_DISCORD_RESET:
+            return ISFS_OK;
+
+        case DOLPHIN_IOCTL_GET_SYSTEM_TIME: {
+            if (!singleOut(8u, out)) {
+                return ISFS_EINVAL;
+            }
+            const auto nowMs = std::chrono::duration_cast<std::chrono::milliseconds>(
+                std::chrono::system_clock::now().time_since_epoch()).count();
+            const uint64_t value = static_cast<uint64_t>(nowMs);
+            Memory::Write32(out.address, static_cast<uint32_t>(value >> 32));
+            Memory::Write32(out.address + 4u, static_cast<uint32_t>(value));
+            return ISFS_OK;
+        }
+
+        default:
+            LogNandWarning("IOS_Ioctlv", "/dev/dolphin unsupported cmd=%u", cmd);
+            return ISFS_EINVAL;
+    }
+}
+
+static bool WriteShaOutputs(const ShaHandle& handle, const IosVector& context, const IosVector& hash) {
+    CryptoPP::SHA1 snapshot = handle.hash;
+    std::array<uint8_t, CryptoPP::SHA1::DIGESTSIZE> digest{};
+    snapshot.Final(digest.data());
+    if (!WriteGuestBytes(hash.address, hash.size, digest.data(), digest.size())) {
+        return false;
+    }
+
+    if (context.address != 0 && context.size >= SHA_CONTEXT_SIZE && Memory::Contains(context.address, SHA_CONTEXT_SIZE)) {
+        Memory::Write32(context.address + 0x00, 0x67452301u);
+        Memory::Write32(context.address + 0x04, 0xEFCDAB89u);
+        Memory::Write32(context.address + 0x08, 0x98BADCFEu);
+        Memory::Write32(context.address + 0x0c, 0x10325476u);
+        Memory::Write32(context.address + 0x10, 0xC3D2E1F0u);
+        const uint64_t bitCount = handle.byteCount * 8u;
+        Memory::Write32(context.address + 0x14, static_cast<uint32_t>(bitCount >> 32));
+        Memory::Write32(context.address + 0x18, static_cast<uint32_t>(bitCount));
+    }
+
+    return true;
+}
+
+static int32_t HandleShaIoctlv(int32_t fd, uint32_t cmd, uint32_t numIn, uint32_t numOut, uint32_t vectorPtr) {
+    if (!vectorPtr || !Memory::Contains(vectorPtr, static_cast<size_t>(numIn + numOut) * 8u)) {
+        return ISFS_EINVAL;
+    }
+    if (numIn != 1 || numOut != 2) {
+        LogNandWarning("IOS_Ioctlv", "/dev/sha unsupported vector shape cmd=%u numIn=%u numOut=%u",
+                cmd, numIn, numOut);
+        return ISFS_EINVAL;
+    }
+
+    ShaHandle* handle = GetShaHandle(fd);
+    if (!handle) {
+        return ISFS_EINVAL;
+    }
+
+    const IosVector input = ReadIosVector(vectorPtr, 0);
+    const IosVector context = ReadIosVector(vectorPtr, 1);
+    const IosVector hash = ReadIosVector(vectorPtr, 2);
+    if (!IsValidGuestRange(input.address, input.size) ||
+        context.size < SHA_CONTEXT_SIZE || hash.size < SHA_DIGEST_SIZE ||
+        !IsValidGuestRange(context.address, SHA_CONTEXT_SIZE) ||
+        !IsValidGuestRange(hash.address, SHA_DIGEST_SIZE)) {
+        LogNandWarning("IOS_Ioctlv",
+                "/dev/sha invalid buffers cmd=%u in=0x%08X/%u ctx=0x%08X/%u hash=0x%08X/%u",
+                cmd, input.address, input.size, context.address, context.size, hash.address, hash.size);
+        return ISFS_EINVAL;
+    }
+
+    if (cmd == SHA_IOCTL_INIT) {
+        handle->Restart();
+    } else if (cmd != SHA_IOCTL_UPDATE && cmd != SHA_IOCTL_FINAL) {
+        LogNandWarning("IOS_Ioctlv", "/dev/sha unsupported cmd=%u", cmd);
+        return ISFS_EINVAL;
+    }
+
+    if (input.size != 0) {
+        const uint8_t* bytes = Memory::GetPointer(input.address, input.size);
+        handle->hash.Update(bytes, input.size);
+        handle->byteCount += input.size;
+    }
+
+    if (!WriteShaOutputs(*handle, context, hash)) {
+        return ISFS_EINVAL;
+    }
+
+    if (cmd == SHA_IOCTL_FINAL) {
+        handle->Restart();
+    }
+    return ISFS_OK;
+}
+
+extern "C" int32_t NAND_IOS_Open_HLE(uint32_t pathPtr, uint32_t mode) {
+    const std::string pathStorage = ReadGuestCString(pathPtr);
+    const char* path = pathPtr == 0 ? nullptr : pathStorage.c_str();
+    
+    if (!path) {
+        LogNandError("IOS_Open", "null path");
+        return ISFS_EINVAL;
+    }
+    
+    // Handle special device paths
+    if (std::strncmp(path, "/dev/", 5) == 0) {
+        if (std::strcmp(path, "/dev/fs") == 0) {
+            return ISFS_DEV_FD;
+        }
+        if (std::strcmp(path, "/dev/es") == 0) {
+            return ES_DEV_FD;
+        }
+        if (std::strcmp(path, "/dev/sha") == 0) {
+            const int32_t fd = AllocateShaFd();
+            return fd;
+        }
+        if (const int32_t netFd = Network_HLE_OpenDevice(path, mode)) {
+            return netFd;
+        }
+        if (std::strcmp(path, "/dev/dolphin") == 0) {
+            return DOLPHIN_DEV_FD;
+        }
+        LogNandWarning("IOS_Open", "unknown device '%s' mode=%u", path, mode);
+        return ISFS_ENOENT;
+    }
+    
+    // It's a NAND file path
+    std::string hostPath = TranslateNandPath(path);
+    
+    // Seed FaceLib resources before the existence check so every open mode can
+    // still find them on a fresh managed NAND.
+    if (!PathExists(hostPath) && IsFaceLibResourcePath(path)) {
+        SeedFaceLibResource(hostPath);
+    }
+
+    // Determine file mode. IOS never creates files on open - creation happens
+    // exclusively through ISFS CreateFile (which we implement). The previous
+    // create-on-open fallback ("w+b") silently materialized 0-byte files (for
+    // example /shared2/sys/net/02/config.dat) that later reads treated as
+    // valid, poisoning persistent state across sessions.
+    const char* fopenMode = "rb";
+    if (mode == 2 || mode == 3) {
+        if (!PathExists(hostPath)) {
+            LogNandWarning("IOS_Open", "'%s' does not exist; open mode %u never creates it",
+                    hostPath.c_str(), mode);
+            return ISFS_ENOENT;
+        }
+        fopenMode = "r+b";      // Write-only opens still need read for seeks
+    }
+
+    FILE* file = std::fopen(hostPath.c_str(), fopenMode);
+
+    if (!file) {
+        LogNandError("IOS_Open", "FAILED to open '%s'", hostPath.c_str());
+        return ISFS_ENOENT;
+    }
+    
+    int32_t fd = AllocateFd(hostPath, file, mode);
+    return fd;
+}
+PPC_NATIVE_OVERRIDE(801938F8, NAND_IOS_Open_HLE, int32_t, (uint32_t pathPtr, uint32_t mode), (pathPtr, mode));
+
+extern "C" void NAND_IOS_OpenBody_HLE_801938FC(CpuContext* ctx) {
+    const int32_t result = NAND_IOS_Open_HLE(ctx->gpr[3], ctx->gpr[4]);
+    ctx->gpr[3] = static_cast<uint32_t>(result);
+    ctx->gpr[1] = ctx->gpr[1] + 32u;
+}
+REGISTER_NATIVE_FUNCTION_AS(0x801938FC, NAND_IOS_OpenBody_HLE_801938FC, "NAND_IOS_OpenBody_HLE_801938FC");
+
+extern "C" int32_t NAND_IOS_Close_HLE(uint32_t fd) {
+    if (fd == ISFS_DEV_FD) {
+        return ISFS_OK;
+    }
+    if (fd == ES_DEV_FD) {
+        return ISFS_OK;
+    }
+    if (fd == DOLPHIN_DEV_FD) {
+        return ISFS_OK;
+    }
+    if (GetShaHandle(static_cast<int32_t>(fd))) {
+        CloseShaFd(static_cast<int32_t>(fd));
+        return ISFS_OK;
+    }
+    if (Network_HLE_IsFd(fd)) {
+        return Network_HLE_Close(fd);
+    }
+    
+    auto* handle = GetHandle(fd);
+    if (!handle) {
+        LogNandError("IOS_Close", "invalid fd=%d", fd);
+        return ISFS_EINVAL;
+    }
+    
+    CloseFd(fd);
+    return ISFS_OK;
+}
+PPC_NATIVE_OVERRIDE(80193AD8, NAND_IOS_Close_HLE, int32_t, (uint32_t fd), (fd));
+
+extern "C" int32_t NAND_IOS_Read_HLE(uint32_t fd, uint32_t bufferPtr, uint32_t length) {
+    auto* handle = GetHandle(fd);
+    if (!handle || !handle->file) {
+        LogNandError("IOS_Read", "invalid fd=%d", fd);
+        return ISFS_EINVAL;
+    }
+    
+    if (!bufferPtr || length == 0) {
+        return 0;
+    }
+    
+    uint8_t* buffer = (uint8_t*)Memory::GetPointer(bufferPtr);
+    if (!buffer) {
+        LogNandError("IOS_Read", "invalid buffer ptr 0x%08X", bufferPtr);
+        return ISFS_EINVAL;
+    }
+    
+    size_t bytesRead = std::fread(buffer, 1, length, handle->file);
+    handle->position += static_cast<uint32_t>(bytesRead);
+    
+    return static_cast<int32_t>(bytesRead);
+}
+PPC_NATIVE_OVERRIDE(80193C80, NAND_IOS_Read_HLE, int32_t, (uint32_t fd, uint32_t bufferPtr, uint32_t length), (fd, bufferPtr, length));
+
+extern "C" int32_t NAND_IOS_Write_HLE(uint32_t fd, uint32_t bufferPtr, uint32_t length) {
+    auto* handle = GetHandle(fd);
+    if (!handle || !handle->file) {
+        LogNandError("IOS_Write", "invalid fd=%d", fd);
+        return ISFS_EINVAL;
+    }
+    
+    if (!bufferPtr || length == 0) {
+        return 0;
+    }
+    
+    const uint8_t* buffer = (const uint8_t*)Memory::GetPointer(bufferPtr);
+    if (!buffer) {
+        LogNandError("IOS_Write", "invalid buffer ptr 0x%08X", bufferPtr);
+        return ISFS_EINVAL;
+    }
+    
+    size_t bytesWritten = std::fwrite(buffer, 1, length, handle->file);
+    std::fflush(handle->file);
+    handle->position += static_cast<uint32_t>(bytesWritten);
+    
+    return static_cast<int32_t>(bytesWritten);
+}
+PPC_NATIVE_OVERRIDE(80193E88, NAND_IOS_Write_HLE, int32_t, (uint32_t fd, uint32_t bufferPtr, uint32_t length), (fd, bufferPtr, length));
+
+extern "C" int32_t NAND_IOS_Seek_HLE(uint32_t fd, int32_t offset, int32_t whence) {
+    auto* handle = GetHandle(fd);
+    if (!handle || !handle->file) {
+        LogNandError("IOS_Seek", "invalid fd=%d", fd);
+        return ISFS_EINVAL;
+    }
+    
+    if (std::fseek(handle->file, offset, NandSeekOrigin(whence)) != 0) {
+        LogNandError("IOS_Seek", "fd=%d offset=%d whence=%d FAILED", fd, offset, whence);
+        return ISFS_EIO;
+    }
+    
+    handle->position = static_cast<uint32_t>(std::ftell(handle->file));
+    return static_cast<int32_t>(handle->position);
+}
+PPC_NATIVE_OVERRIDE(80194070, NAND_IOS_Seek_HLE, int32_t, (uint32_t fd, int32_t offset, int32_t whence), (fd, offset, whence));
+
+// ============================================================================
+// IOS_Ioctl HLE - Handles filesystem commands
+// ============================================================================
+
+// ISFS Ioctl commands
+enum ISFSCommand {
+    ISFS_IOCTL_FORMAT = 1,
+    ISFS_IOCTL_GETSTATS = 2,
+    ISFS_IOCTL_CREATEDIR = 3,
+    ISFS_IOCTL_READDIR = 4,
+    ISFS_IOCTL_SETATTR = 5,
+    ISFS_IOCTL_GETATTR = 6,
+    ISFS_IOCTL_DELETE = 7,
+    ISFS_IOCTL_RENAME = 8,
+    ISFS_IOCTL_CREATEFILE = 9,
+    ISFS_IOCTL_SETFILEVERCTRL = 10,
+    ISFS_IOCTL_GETFILESTATS = 11,
+    ISFS_IOCTL_GETUSAGE = 12,
+    ISFS_IOCTL_SHUTDOWN = 13,
+};
+
+extern "C" int32_t NAND_IOS_Ioctl_HLE(
+    uint32_t fd,
+    uint32_t cmd,
+    uint32_t inBufPtr, uint32_t inLen,
+    uint32_t outBufPtr, uint32_t outLen)
+{
+
+    if (Network_HLE_IsFd(fd)) {
+        return Network_HLE_Ioctl(fd, cmd, inBufPtr, inLen, outBufPtr, outLen);
+    }
+
+    if (GetShaHandle(static_cast<int32_t>(fd))) {
+        LogNandWarning("IOS_Ioctl", "/dev/sha does not support scalar ioctl cmd=%u", cmd);
+        return ISFS_EINVAL;
+    }
+    if (fd == DOLPHIN_DEV_FD) {
+        LogNandWarning("IOS_Ioctl", "/dev/dolphin does not support scalar ioctl cmd=%u", cmd);
+        return ISFS_EINVAL;
+    }
+    
+    // Handle /dev/fs ISFS commands
+    if (fd == ISFS_DEV_FD) {
+        switch (cmd) {
+            case ISFS_IOCTL_CREATEDIR: {
+                // Input buffer: path + attributes
+                if (!inBufPtr || inLen < 0x4c) {
+                    return ISFS_EINVAL;
+                }
+                const char* path = (const char*)Memory::GetPointer(inBufPtr + 6);
+                std::string hostPath = TranslateNandPath(path);
+                
+                if (CreateDirectoryPath(hostPath)) {
+#ifdef _WIN32
+                    _mkdir(hostPath.c_str());
+#else
+                    mkdir(hostPath.c_str(), 0755);
+#endif
+                    return ISFS_OK;
+                }
+                return ISFS_EIO;
+            }
+            
+            case ISFS_IOCTL_DELETE: {
+                if (!inBufPtr || inLen < 0x40) {
+                    return ISFS_EINVAL;
+                }
+                const char* path = (const char*)Memory::GetPointer(inBufPtr);
+                std::string hostPath = TranslateNandPath(path);
+                
+                if (IsDirectory(hostPath)) {
+#ifdef _WIN32
+                    if (RemoveDirectoryA(hostPath.c_str())) return ISFS_OK;
+#else
+                    if (rmdir(hostPath.c_str()) == 0) return ISFS_OK;
+#endif
+                } else {
+                    if (std::remove(hostPath.c_str()) == 0) return ISFS_OK;
+                }
+                return ISFS_ENOENT;
+            }
+            
+            case ISFS_IOCTL_GETATTR: {
+                if (!inBufPtr || !outBufPtr) {
+                    return ISFS_EINVAL;
+                }
+                const char* path = (const char*)Memory::GetPointer(inBufPtr);
+                std::string hostPath = TranslateNandPath(path);
+                
+                if (!PathExists(hostPath)) {
+                    return ISFS_ENOENT;
+                }
+                
+                // Return fake attributes (owner UID, group ID, permissions)
+                // Format: u32 ownerID, u16 groupID, u8 ownerPerm, u8 groupPerm, u8 otherPerm, u8 attrs
+                uint8_t* outBuf = (uint8_t*)Memory::GetPointer(outBufPtr);
+                if (outBuf && outLen >= 0x4c) {
+                    std::memset(outBuf, 0, outLen);
+                    // Owner UID = 0
+                    Memory::Write32(outBufPtr, 0);
+                    // Group ID = 0
+                    Memory::Write16(outBufPtr + 4, 0);
+                    // Permissions: 3 = read/write for all
+                    Memory::Write8(outBufPtr + 0x49, 3); // owner perm
+                    Memory::Write8(outBufPtr + 0x46, 3); // group perm
+                    Memory::Write8(outBufPtr + 0x47, 3); // other perm
+                    Memory::Write8(outBufPtr + 0x48, IsDirectory(hostPath) ? 2 : 1); // attrs (2=dir, 1=file)
+                }
+                return ISFS_OK;
+            }
+            
+            case ISFS_IOCTL_CREATEFILE: {
+                if (!inBufPtr || inLen < 0x4c) {
+                    return ISFS_EINVAL;
+                }
+                const char* path = (const char*)Memory::GetPointer(inBufPtr + 6);
+                std::string hostPath = TranslateNandPath(path);
+                CreateParentDirectories(hostPath);
+
+                // Create empty file
+                FILE* f = std::fopen(hostPath.c_str(), "wb");
+                if (f) {
+                    std::fclose(f);
+                    return ISFS_OK;
+                }
+                return ISFS_EIO;
+            }
+            
+            case ISFS_IOCTL_GETFILESTATS: {
+                // GETFILESTATS is addressed to a file fd, never to /dev/fs.
+                LogNandWarning("IOS_Ioctl", "GETFILESTATS on ISFS device - unexpected");
+                return ISFS_EINVAL;
+            }
+            
+            case ISFS_IOCTL_RENAME: {
+                if (!inBufPtr || inLen < 0x80) {
+                    return ISFS_EINVAL;
+                }
+                const char* srcPath = (const char*)Memory::GetPointer(inBufPtr);
+                const char* dstPath = (const char*)Memory::GetPointer(inBufPtr + 0x40);
+                std::string srcHost = TranslateNandPath(srcPath);
+                std::string dstHost = TranslateNandPath(dstPath);
+                
+                if (std::rename(srcHost.c_str(), dstHost.c_str()) == 0) {
+                    return ISFS_OK;
+                }
+                return ISFS_EIO;
+            }
+            
+            case ISFS_IOCTL_GETSTATS: {
+                // Return filesystem stats (fake values)
+                if (outBufPtr && outLen >= 0x1c) {
+                    Memory::Write32(outBufPtr + 0x00, 0x200000);  // Total blocks
+                    Memory::Write32(outBufPtr + 0x04, 0x100000);  // Free blocks
+                    Memory::Write32(outBufPtr + 0x08, 0);         // Used blocks
+                    Memory::Write32(outBufPtr + 0x0C, 0);         // Bad blocks
+                    Memory::Write32(outBufPtr + 0x10, 0);         // Reserved blocks
+                    Memory::Write32(outBufPtr + 0x14, 0x20);      // Block size
+                    Memory::Write32(outBufPtr + 0x18, 0);         // Free inodes
+                }
+                return ISFS_OK;
+            }
+            
+            case ISFS_IOCTL_SETATTR: {
+                // Ignore attribute changes - we don't implement file permissions
+                return ISFS_OK;
+            }
+            
+            case ISFS_IOCTL_GETUSAGE: {
+                // Return usage info (fake values)
+                if (outBufPtr && outLen >= 8) {
+                    Memory::Write32(outBufPtr + 0, 100);   // Files
+                    Memory::Write32(outBufPtr + 4, 10000); // Blocks used
+                }
+                return ISFS_OK;
+            }
+            
+            case ISFS_IOCTL_READDIR: {
+                // Read directory listing
+                // This is complex - return empty for now
+                if (outBufPtr && outLen >= 4) {
+                    Memory::Write32(outBufPtr, 0); // 0 entries
+                }
+                return ISFS_OK;
+            }
+            
+            default:
+                LogNandWarning("IOS_Ioctl", "unknown ISFS cmd=%u", cmd);
+                return ISFS_OK;
+        }
+    }
+    
+    // Handle file-specific commands
+    auto* handle = GetHandle(fd);
+    if (handle && handle->file) {
+        if (cmd == ISFS_IOCTL_GETFILESTATS) {
+            // Get file stats
+            if (!outBufPtr || outLen < 8) {
+                return ISFS_EINVAL;
+            }
+            
+            const NandFileExtent extent = NandProbeFileExtent(handle->file);
+            Memory::Write32(outBufPtr, static_cast<uint32_t>(extent.size));
+            Memory::Write32(outBufPtr + 4, static_cast<uint32_t>(extent.position));
+            
+            return ISFS_OK;
+        }
+    }
+    
+    // Unknown command - return success to not block game
+    return ISFS_OK;
+}
+
+// The stack frame a guest thread parks on while a deferred network ioctl runs.
+// `newStack` is always oldStack - kFrameSize, even when the frame could not be
+// built, because the sleep path installs it unconditionally.
+struct IosWaitFrame {
+    bool valid = false;
+    uint32_t oldStack = 0;
+    uint32_t newStack = 0;
+    uint32_t waitQueue = 0;
+};
+
+static IosWaitFrame InitializeIosWaitQueueFrame(CpuContext* ctx) {
+    constexpr uint32_t kFrameSize = 0x40u;
+    constexpr uint32_t kWaitQueueOffset = 0x30u;
+
+    IosWaitFrame frame;
+    frame.oldStack = ctx->gpr[1];
+    frame.newStack = frame.oldStack - kFrameSize;
+    if (frame.oldStack < kFrameSize || !Memory::Contains(frame.newStack, kFrameSize)) {
+        return frame;
+    }
+    // Preserve the PPC linkage area and the required r3-r10 outgoing-argument
+    // save area. The queue lives in local storage beyond sp+0x28 so a guest
+    // switch callback cannot legally spill over it while this thread sleeps.
+    Memory::Write32(frame.newStack, frame.oldStack);
+    Memory::Write32(frame.newStack + 4u, 0);
+    Memory::Write32(frame.newStack + kWaitQueueOffset, 0);
+    Memory::Write32(frame.newStack + kWaitQueueOffset + 4u, 0);
+    frame.waitQueue = frame.newStack + kWaitQueueOffset;
+    frame.valid = true;
+    return frame;
+}
+
+static void FinishDeferredIosWait(CpuContext* ctx, uint32_t oldStack, uint64_t token) {
+    int32_t result = -101;
+    if (!Network_HLE_TakeSyncResult(token, &result)) {
+        RT_LOGF(RT_TAG_NAND,
+                     "deferred network waiter resumed without result token=%llu\n",
+                     static_cast<unsigned long long>(token));
+    }
+    ctx->gpr[1] = oldStack;
+    ctx->gpr[3] = static_cast<uint32_t>(result);
+}
+
+// IOS_Ioctl and IOS_Ioctlv park a network request the same way: build the wait
+// frame, hand its queue to the network layer, and either sleep on it or take the
+// immediate answer. True when the request was handled here.
+template <typename StartSync>
+static bool TryDeferredNetworkIosSync(CpuContext* ctx, StartSync&& startSync) {
+    const IosWaitFrame frame = InitializeIosWaitQueueFrame(ctx);
+    const auto deferred = startSync(frame.valid ? frame.waitQueue : 0u);
+    if (deferred.disposition == NetworkDeferredContract::StartDisposition::Started) {
+        ctx->gpr[1] = frame.newStack;
+        ctx->gpr[3] = frame.waitQueue;
+        OSSleepThread_HLE_801aa9b8(ctx);
+        FinishDeferredIosWait(ctx, frame.oldStack, deferred.token);
+        return true;
+    }
+    if (deferred.disposition == NetworkDeferredContract::StartDisposition::ImmediateResult) {
+        ctx->gpr[3] = static_cast<uint32_t>(deferred.result);
+        return true;
+    }
+    return false;
+}
+
+extern "C" void NAND_IOS_Ioctl_Entry_HLE(CpuContext* ctx) {
+    const uint32_t fd = ctx->gpr[3];
+    const uint32_t cmd = ctx->gpr[4];
+    const uint32_t inBufPtr = ctx->gpr[5];
+    const uint32_t inLen = ctx->gpr[6];
+    const uint32_t outBufPtr = ctx->gpr[7];
+    const uint32_t outLen = ctx->gpr[8];
+
+    if (Network_HLE_IsFd(fd)) {
+        const bool handled = TryDeferredNetworkIosSync(ctx, [&](uint32_t waitQueue) {
+            return Network_HLE_StartIoctlSync(fd, cmd, inBufPtr, inLen, outBufPtr, outLen, waitQueue);
+        });
+        if (handled) {
+            return;
+        }
+    }
+
+    ctx->gpr[3] = static_cast<uint32_t>(
+        NAND_IOS_Ioctl_HLE(fd, cmd, inBufPtr, inLen, outBufPtr, outLen));
+}
+PPC_NATIVE_OVERRIDE_VOID(80194290, NAND_IOS_Ioctl_Entry_HLE, (CpuContext* ctx), (ctx));
+
+// ============================================================================
+// ISFS_OpenLib - Initialize ISFS
+// ============================================================================
+
+// Global state for ISFS initialization
+static bool g_isfsInitialized = false;
+
+// The ISFS/IPC globals ISFS_OpenLib touches, as negative r13 (SDA1) offsets.
+// These are address-exact: they name the SDK's own variables, so the numbers are
+// load-bearing and must not be "tidied". Names come from the RVL IPC/ISFS
+// sources; only the naming changed here, never a value.
+namespace {
+constexpr uint32_t kIsfsFdSda1Offset = 29408u;              // __ISFS_fd
+constexpr uint32_t kIsfsPathSda1Offset = 29400u;            // __ISFS_path ("/dev/fs")
+constexpr uint32_t kIpcBufferLoSda1Offset = 25620u;         // IPC buffer window, low
+constexpr uint32_t kIpcBufferHiSda1Offset = 25616u;         // IPC buffer window, high
+constexpr uint32_t kIpcArenaLoSda1Offset = 25732u;          // __IPCArenaLo
+constexpr uint32_t kIpcArenaHiSda1Offset = 25728u;          // __IPCArenaHi
+constexpr uint32_t kIsfsHeapHandleSda1Offset = 25724u;      // ISFS heap handle
+constexpr uint32_t kIsfsHeapBaseSda1Offset = 25740u;        // ISFS heap base address
+constexpr uint32_t kIsfsHeapInitializedSda1Offset = 25744u; // ISFS heap created flag
+} // namespace
+
+static void WriteGuestString(uint32_t address, const char* value) {
+    if (!value) {
+        return;
+    }
+    const size_t length = std::strlen(value) + 1;
+    if (!Memory::Contains(address, length)) {
+        return;
+    }
+    for (size_t i = 0; i < length; ++i) {
+        Memory::Write8(address + static_cast<uint32_t>(i), static_cast<uint8_t>(value[i]));
+    }
+}
+
+int32_t ISFS_OpenLib_Initialize(CpuContext* ctx) {
+    g_isfsInitialized = true;
+    
+    // Create the title data directory if it doesn't exist
+    char titlePath[256];
+    const std::string& base = GetNandBasePath();
+    std::snprintf(titlePath, sizeof(titlePath), "%s\\title\\%08x\\%08x\\data",
+                  base.c_str(), kNandTitleIdHi, CurrentMkwTitleIdLo());
+    CreateDirectoryPath(titlePath);
+
+    if (!ctx) {
+        return ISFS_OK;
+    }
+
+    const uint32_t r13 = ctx->gpr[13];
+    if (r13 == 0) {
+        return ISFS_OK;
+    }
+
+    const uint32_t isfsFdGlobal = r13 - kIsfsFdSda1Offset;
+    const uint32_t isfsPathGlobal = r13 - kIsfsPathSda1Offset;
+    const uint32_t ipcBufferLoGlobal = r13 - kIpcBufferLoSda1Offset;
+    const uint32_t ipcBufferHiGlobal = r13 - kIpcBufferHiSda1Offset;
+    const uint32_t ipcArenaLoGlobal = r13 - kIpcArenaLoSda1Offset;
+    const uint32_t ipcArenaHiGlobal = r13 - kIpcArenaHiSda1Offset;
+    const uint32_t isfsHeapGlobal = r13 - kIsfsHeapHandleSda1Offset;
+    const uint32_t isfsHeapBaseGlobal = r13 - kIsfsHeapBaseSda1Offset;
+    const uint32_t isfsHeapInitializedGlobal = r13 - kIsfsHeapInitializedSda1Offset;
+
+    WriteGuestString(isfsPathGlobal, "/dev/fs");
+
+    if (Memory::Contains(isfsFdGlobal, 4)) {
+        Memory::Write32(isfsFdGlobal, static_cast<uint32_t>(ISFS_DEV_FD));
+    }
+
+    // The heap bring-up below reads and writes all seven IPC globals, so it only
+    // runs when every one of them is inside guest memory.
+    for (const uint32_t global : {ipcBufferLoGlobal, ipcBufferHiGlobal, ipcArenaLoGlobal,
+                                  ipcArenaHiGlobal, isfsHeapGlobal, isfsHeapBaseGlobal,
+                                  isfsHeapInitializedGlobal}) {
+        if (!Memory::Contains(global, 4)) {
+            return ISFS_OK;
+        }
+    }
+
+    uint32_t ipcLo = Memory::Read32(ipcBufferLoGlobal);
+    uint32_t ipcHi = Memory::Read32(ipcBufferHiGlobal);
+    if (ipcLo == 0 || ipcHi == 0 || ipcLo >= ipcHi) {
+        return ISFS_OK;
+    }
+
+    if (Memory::Read32(isfsHeapInitializedGlobal) == 0) {
+        Memory::Write32(ipcArenaLoGlobal, ipcLo);
+        Memory::Write32(ipcArenaHiGlobal, ipcHi);
+
+        const uint32_t heapBase = (ipcLo + 31u) & ~31u;
+        const uint32_t heapSize = 5440u;
+        if (heapBase + heapSize <= ipcHi) {
+            Memory::Write32(isfsHeapBaseGlobal, heapBase);
+
+            const uint32_t savedR3 = ctx->gpr[3];
+            const uint32_t savedR4 = ctx->gpr[4];
+            const uint32_t savedR5 = ctx->gpr[5];
+            const uint32_t savedLr = ctx->lr;
+
+            ctx->gpr[3] = heapBase;
+            ctx->gpr[4] = heapSize;
+            ctx->lr = 0x80169BCCu;
+            InvokeDirectCpu<0x801949B8u>(ctx);
+            const uint32_t heapHandle = ctx->gpr[3];
+
+            ctx->gpr[3] = heapBase + heapSize;
+            ctx->lr = 0x80169BCCu;
+            InvokeDirectCpu<0x80193040u>(ctx);
+
+            ctx->gpr[3] = savedR3;
+            ctx->gpr[4] = savedR4;
+            ctx->gpr[5] = savedR5;
+            ctx->lr = savedLr;
+
+            Memory::Write32(isfsHeapGlobal, heapHandle);
+            Memory::Write32(isfsHeapInitializedGlobal, 1u);
+        }
+    }
+
+    return ISFS_OK;
+}
+
+extern "C" void ISFS_OpenLib_HLE_80169BCC(CpuContext* ctx) {
+    ctx->gpr[3] = static_cast<uint32_t>(ISFS_OpenLib_Initialize(ctx));
+}
+
+REGISTER_NATIVE_FUNCTION_AS(0x80169BCC, ISFS_OpenLib_HLE_80169BCC, "ISFS_OpenLib_HLE_80169BCC");
+
+// ============================================================================
+// IOS_Ioctlv HLE - Vector Ioctl for complex ISFS operations
+// ============================================================================
+
+extern "C" int32_t NAND_IOS_Ioctlv_HLE(
+    uint32_t fd,
+    uint32_t cmd,
+    uint32_t numIn,
+    uint32_t numOut,
+    uint32_t vectorPtr)
+{
+
+    if (Network_HLE_IsFd(fd)) {
+        return Network_HLE_Ioctlv(fd, cmd, numIn, numOut, vectorPtr);
+    }
+
+    if (GetShaHandle(static_cast<int32_t>(fd))) {
+        return HandleShaIoctlv(static_cast<int32_t>(fd), cmd, numIn, numOut, vectorPtr);
+    }
+
+    if (fd == DOLPHIN_DEV_FD) {
+        return HandleDolphinIoctlv(cmd, numIn, numOut, vectorPtr);
+    }
+
+    if (fd == ES_DEV_FD) {
+        if (!vectorPtr || !Memory::Contains(vectorPtr, static_cast<size_t>(numIn + numOut) * 8u)) {
+            return ISFS_EINVAL;
+        }
+
+        switch (cmd) {
+            case ES_IOCTL_GETDEVICEID: {
+                if (numIn != 0 || numOut != 1) {
+                    return ISFS_EINVAL;
+                }
+                const IosVector out = ReadIosVector(vectorPtr, 0);
+                if (out.size < 4 || out.address == 0 || !Memory::Contains(out.address, 4)) {
+                    return ISFS_EINVAL;
+                }
+                const WiiEsCrypto::Identity& identity = WiiEsCrypto::CurrentIdentity();
+                Memory::Write32(out.address, identity.deviceId);
+                return ISFS_OK;
+            }
+
+            case ES_IOCTL_GETDEVICECERT: {
+                if (numIn != 0 || numOut != 1) {
+                    return ISFS_EINVAL;
+                }
+                const IosVector out = ReadIosVector(vectorPtr, 0);
+                const auto cert = WiiEsCrypto::GetDeviceCertificate();
+                if (!WriteGuestBytes(out.address, out.size, cert.data(), cert.size())) {
+                    return ISFS_EINVAL;
+                }
+                return ISFS_OK;
+            }
+
+            case ES_IOCTL_GETTITLEID: {
+                if (numIn != 0 || numOut != 1) {
+                    return ISFS_EINVAL;
+                }
+                const IosVector out = ReadIosVector(vectorPtr, 0);
+                if (out.size < 8 || out.address == 0 || !Memory::Contains(out.address, 8)) {
+                    return ISFS_EINVAL;
+                }
+                const uint64_t titleId = CurrentMkwTitleId();
+                Memory::Write32(out.address, static_cast<uint32_t>(titleId >> 32));
+                Memory::Write32(out.address + 4u, static_cast<uint32_t>(titleId));
+                return ISFS_OK;
+            }
+
+            case ES_IOCTL_SIGN: {
+                if (numIn != 1 || numOut != 2) {
+                    return ISFS_EINVAL;
+                }
+                const IosVector in = ReadIosVector(vectorPtr, 0);
+                const IosVector sigOut = ReadIosVector(vectorPtr, 1);
+                const IosVector certOut = ReadIosVector(vectorPtr, 2);
+                if (in.address == 0 || !Memory::Contains(in.address, in.size)) {
+                    return ISFS_EINVAL;
+                }
+                const uint8_t* input = Memory::GetPointer(in.address, in.size);
+                WiiEsCrypto::EcSignature signature{};
+                WiiEsCrypto::EccCert cert{};
+                WiiEsCrypto::Sign(CurrentMkwTitleId(), input, in.size, signature, cert);
+                if (!WriteGuestBytes(sigOut.address, sigOut.size, signature.data(), signature.size()) ||
+                    !WriteGuestBytes(certOut.address, certOut.size, cert.data(), cert.size())) {
+                    return ISFS_EINVAL;
+                }
+                return ISFS_OK;
+            }
+
+            default:
+                LogNandWarning("IOS_Ioctlv", "unsupported /dev/es cmd=%u", cmd);
+                return ISFS_EINVAL;
+        }
+    }
+    
+    // Non-device ioctlv has no ISFS command we need to service.
+    return ISFS_OK;
+}
+
+extern "C" void NAND_IOS_Ioctlv_Entry_HLE(CpuContext* ctx) {
+    const uint32_t fd = ctx->gpr[3];
+    const uint32_t cmd = ctx->gpr[4];
+    const uint32_t numIn = ctx->gpr[5];
+    const uint32_t numOut = ctx->gpr[6];
+    const uint32_t vectorPtr = ctx->gpr[7];
+
+    if (Network_HLE_IsFd(fd)) {
+        const bool handled = TryDeferredNetworkIosSync(ctx, [&](uint32_t waitQueue) {
+            return Network_HLE_StartIoctlvSync(fd, cmd, numIn, numOut, vectorPtr, waitQueue);
+        });
+        if (handled) {
+            return;
+        }
+    }
+
+    ctx->gpr[3] = static_cast<uint32_t>(
+        NAND_IOS_Ioctlv_HLE(fd, cmd, numIn, numOut, vectorPtr));
+}
+PPC_NATIVE_OVERRIDE_VOID(801945E0, NAND_IOS_Ioctlv_Entry_HLE, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/storage/riivolution.cpp b/runtime/src/hle/storage/riivolution.cpp
new file mode 100644
index 0000000..8eb2348
--- /dev/null
+++ b/runtime/src/hle/storage/riivolution.cpp
@@ -0,0 +1,353 @@
+// Riivolution overlay loading (host-IO shim). See riivolution.h.
+//
+// Ported behavior from Dolphin Emulator's DiscIO/RiivolutionParser and
+// RiivolutionPatcher (https://github.com/dolphin-emu/dolphin).
+// Copyright 2021 Dolphin Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "hle/storage/riivolution.h"
+
+#include "hle/riivolution_contract.h"
+#include "hle/runtime_parse_helpers.h"
+#include "memory.h"
+#include "nand_path.h"
+#include "recomp_mod_loader.h"
+#include "runtime_config.h"
+#include "runtime_log.h"
+#include "runtime_product.h"
+
+#include <algorithm>
+#include <cctype>
+#include <fstream>
+#include <iostream>
+#include <mutex>
+#include <sstream>
+#include <system_error>
+
+namespace fs = std::filesystem;
+
+namespace {
+
+struct RiivoState {
+    std::vector<RuntimeRiivolution::Overlay> overlays;
+    std::optional<RuntimeRiivolution::SaveRedirect> saveRedirect;
+};
+
+std::once_flag g_riivoOnce;
+RiivoState g_riivoState;
+
+std::optional<std::string> RiivoReadFile(const fs::path& path) {
+    std::ifstream stream(path, std::ios::binary);
+    if (!stream.is_open()) {
+        return std::nullopt;
+    }
+    std::ostringstream buffer;
+    buffer << stream.rdbuf();
+    return buffer.str();
+}
+
+// Six-character game ID ("RMCP01") from guest low memory, with the same RMCP
+// fallback the rest of the storage HLE uses for boots that have not written
+// the disc header yet.
+std::string RiivoGameId() {
+    const uint32_t code = RuntimeHle::CurrentGameCode(0x524D4350u); // "RMCP"
+    std::string id(6, '\0');
+    id[0] = static_cast<char>((code >> 24) & 0xffu);
+    id[1] = static_cast<char>((code >> 16) & 0xffu);
+    id[2] = static_cast<char>((code >> 8) & 0xffu);
+    id[3] = static_cast<char>(code & 0xffu);
+
+    uint16_t maker = 0;
+    if (Memory::Contains(0x80000004u, 2u)) {
+        maker = Memory::Read16(0x80000004u);
+    }
+    const char makerHi = static_cast<char>((maker >> 8) & 0xffu);
+    const char makerLo = static_cast<char>(maker & 0xffu);
+    if (std::isalnum(static_cast<unsigned char>(makerHi)) &&
+        std::isalnum(static_cast<unsigned char>(makerLo))) {
+        id[4] = makerHi;
+        id[5] = makerLo;
+    } else {
+        id[4] = '0';
+        id[5] = '1';
+    }
+    return id;
+}
+
+std::string RiivoComparablePath(const fs::path& path) {
+    std::string text = path.lexically_normal().generic_string();
+#ifdef _WIN32
+    RuntimeHle::LowerInPlace(text);
+#endif
+    return text;
+}
+
+void RiivoAddRoot(std::vector<RuntimeRiivolution::Overlay>& overlays, fs::path root,
+                  const char* source) {
+    std::error_code ec;
+    if (!fs::is_directory(root, ec)) {
+        return;
+    }
+
+    fs::path normalized = fs::weakly_canonical(root, ec);
+    if (ec) {
+        normalized = root.lexically_normal();
+    }
+
+    const std::string comparable = RiivoComparablePath(normalized);
+    const auto duplicate =
+        std::find_if(overlays.begin(), overlays.end(), [&](const RuntimeRiivolution::Overlay& overlay) {
+            return RiivoComparablePath(overlay.root) == comparable;
+        });
+    if (duplicate != overlays.end()) {
+        return;
+    }
+
+    RT_LOG(RT_TAG_RIIVOLUTION) << "overlay root (" << (source ? source : "unknown")
+              << "): " << normalized.string() << std::endl;
+    overlays.push_back({std::move(normalized), std::nullopt});
+}
+
+std::vector<RuntimeRiivolution::Overlay> RiivoDiscoverRoots() {
+    std::vector<RuntimeRiivolution::Overlay> overlays;
+
+    // Discovery order is precedence order: DVDInit applies the roots in
+    // reverse, so an explicitly configured root (command line first, then
+    // Config.toml) always outranks the mod manifest.
+    for (const auto& root : RuntimeConfigFile::OverlayRoots()) {
+        // A relative overlay root resolves against the config file that named
+        // it, never against whatever working directory the process happened
+        // to be started in.
+        RiivoAddRoot(overlays, RuntimeNandPath::ResolveConfiguredPath(root),
+                     "command line or Config.toml");
+    }
+
+    // The one canonical Retro Rewind installation setup recorded. Only the
+    // Retro Rewind product applies it: overlaying the base product with the
+    // pack's menu archives made "base game" boot as a half-Retro-Rewind build.
+    if (const auto retroRewindRoot =
+            RuntimeProduct::IsRetroRewind() ? RuntimeConfigFile::RetroRewindRoot() : std::string{};
+        !retroRewindRoot.empty()) {
+        RiivoAddRoot(overlays, RuntimeNandPath::ResolveConfiguredPath(retroRewindRoot),
+                     "canonical Retro Rewind installation");
+    }
+
+    for (const auto& root : RecompMod::DvdOverlayRoots()) {
+        RiivoAddRoot(overlays, fs::path(root), "recomp mod manifest");
+    }
+
+    return overlays;
+}
+
+// The Riivolution XMLs describing an overlay root, plus the SD-root directory
+// that absolute external paths resolve against.
+struct RiivoXmlSet {
+    fs::path sdRoot;
+    std::vector<fs::path> xmlFiles;
+};
+
+std::optional<RiivoXmlSet> RiivoFindXmls(const fs::path& overlayRoot) {
+    std::error_code ec;
+
+    // Distribution-pinned XML from recomp.yml: a path relative to the pack
+    // folder. The pack folder sits inside the virtual SD root (e.g.
+    // <sd>/RetroRewind6), so externals resolve against the root's parent.
+    const std::string& configured = RecompMod::RiivolutionXml();
+    if (!configured.empty()) {
+        const fs::path configuredXml = overlayRoot / fs::path(configured);
+        if (fs::is_regular_file(configuredXml, ec)) {
+            return RiivoXmlSet{overlayRoot.parent_path(), {configuredXml}};
+        }
+    }
+
+    // Dolphin-style discovery: the overlay root is itself a virtual SD root
+    // carrying <root>/riivolution/*.xml.
+    const fs::path xmlDirectory = overlayRoot / "riivolution";
+    if (fs::is_directory(xmlDirectory, ec)) {
+        std::vector<fs::path> xmlFiles;
+        for (const auto& entry : fs::directory_iterator(xmlDirectory, ec)) {
+            if (ec) {
+                break;
+            }
+            if (entry.is_regular_file(ec) && entry.path().extension() == ".xml") {
+                xmlFiles.push_back(entry.path());
+            }
+        }
+        if (!xmlFiles.empty()) {
+            // Sort so the same folder always produces the same disc.
+            std::sort(xmlFiles.begin(), xmlFiles.end());
+            return RiivoXmlSet{overlayRoot, std::move(xmlFiles)};
+        }
+    }
+
+    return std::nullopt;
+}
+
+std::vector<RiivolutionContract::OptionSelection> RiivoManifestSelections() {
+    std::vector<RiivolutionContract::OptionSelection> selections;
+    for (const auto& selection : RecompMod::RiivolutionOptionSelections()) {
+        selections.push_back({selection.section, selection.option, selection.choice});
+    }
+    return selections;
+}
+
+void RiivoCollectMappings(const RiivolutionContract::Patch& patch, const std::string& sdRootGeneric,
+                          const std::string& xmlDirGeneric, RuntimeRiivolution::PatchSet& set) {
+    const std::string patchRoot =
+        RiivolutionContract::ResolvePatchRoot(sdRootGeneric, xmlDirGeneric, patch.root);
+    std::error_code ec;
+
+    // Dolphin applies each patch's file patches first, then its folder
+    // patches; with last-registration-wins that means folders shadow files
+    // within one patch, and later patches shadow earlier ones.
+    for (const auto& file : patch.filePatches) {
+        if (file.disc.empty()) {
+            ++set.skippedExternals;
+            continue;
+        }
+        const auto resolved =
+            RiivolutionContract::MakeAbsoluteFromRelative(sdRootGeneric, patchRoot, file.external);
+        if (!resolved) {
+            ++set.skippedExternals;
+            continue;
+        }
+        const fs::path hostFile(*resolved);
+        if (!fs::is_regular_file(hostFile, ec)) {
+            ++set.skippedExternals;
+            continue;
+        }
+        set.mappings.push_back(
+            {RuntimeRiivolution::Mapping::Kind::File, file.disc, hostFile, true, file.create});
+    }
+
+    for (const auto& folder : patch.folderPatches) {
+        const auto resolved =
+            RiivolutionContract::MakeAbsoluteFromRelative(sdRootGeneric, patchRoot, folder.external);
+        if (!resolved) {
+            ++set.skippedExternals;
+            continue;
+        }
+        const fs::path hostFolder(*resolved);
+        if (!fs::is_directory(hostFolder, ec)) {
+            ++set.skippedExternals;
+            continue;
+        }
+        const auto kind = folder.disc.empty() ? RuntimeRiivolution::Mapping::Kind::FolderByName
+                                              : RuntimeRiivolution::Mapping::Kind::Folder;
+        set.mappings.push_back({kind, folder.disc, hostFolder, folder.recursive, folder.create});
+    }
+}
+
+std::optional<RuntimeRiivolution::PatchSet> RiivoLoadPatchSet(const fs::path& overlayRoot,
+                                                              RiivoState& state) {
+    const auto xmlSet = RiivoFindXmls(overlayRoot);
+    if (!xmlSet) {
+        return std::nullopt;
+    }
+
+    const std::string gameId = RiivoGameId();
+    const std::string sdRootGeneric = xmlSet->sdRoot.generic_string();
+    const auto manifestSelections = RiivoManifestSelections();
+
+    // Dolphin-compatible remembered choices; a recomp.yml pin overrides them.
+    std::optional<RiivolutionContract::Config> config;
+    const fs::path configXml =
+        xmlSet->sdRoot / "riivolution" / "config" / (gameId.substr(0, 4) + ".xml");
+    if (const auto configText = RiivoReadFile(configXml)) {
+        config = RiivolutionContract::ParseConfigString(*configText);
+    }
+
+    RuntimeRiivolution::PatchSet set;
+    for (const fs::path& xmlFile : xmlSet->xmlFiles) {
+        const auto text = RiivoReadFile(xmlFile);
+        if (!text) {
+            RT_LOG(RT_TAG_RIIVOLUTION) << "WARNING: cannot read " << xmlFile.string() << std::endl;
+            continue;
+        }
+
+        auto disc = RiivolutionContract::ParseString(*text);
+        if (!disc) {
+            RT_LOG(RT_TAG_RIIVOLUTION) << "WARNING: " << xmlFile.string()
+                      << " is not a valid Riivolution XML (version 1 wiidisc); ignoring it"
+                      << std::endl;
+            continue;
+        }
+        if (!disc->IsValidForGame(gameId, std::nullopt, std::nullopt)) {
+            RT_LOG(RT_TAG_RIIVOLUTION) << xmlFile.string() << ": not valid for " << gameId
+                      << ", skipped" << std::endl;
+            continue;
+        }
+
+        if (config) {
+            RiivolutionContract::ApplyConfigDefaults(*disc, *config);
+        }
+        RiivolutionContract::ApplySelections(*disc, manifestSelections);
+
+        const auto activePatches = disc->GeneratePatches(gameId);
+        const std::string xmlDirGeneric = xmlFile.parent_path().generic_string();
+
+        const size_t before = set.mappings.size();
+        for (const auto& patch : activePatches) {
+            RiivoCollectMappings(patch, sdRootGeneric, xmlDirGeneric, set);
+        }
+
+        // Highest-priority overlay with a <savegame> wins.
+        if (!state.saveRedirect) {
+            if (const auto* savegame = RiivolutionContract::FindSavegamePatch(activePatches)) {
+                if (const auto resolvedSave = RiivolutionContract::MakeAbsoluteFromRelative(
+                        sdRootGeneric, xmlDirGeneric, savegame->external)) {
+                    state.saveRedirect =
+                        RuntimeRiivolution::SaveRedirect{fs::path(*resolvedSave), savegame->clone};
+                    RT_LOG(RT_TAG_RIIVOLUTION) << "savegame redirect: "
+                              << state.saveRedirect->hostDirectory.string()
+                              << (savegame->clone ? " (clone)" : "") << std::endl;
+                }
+            }
+        }
+
+        // A pack whose XML parses but activates nothing is the most confusing
+        // failure this layer has: the game boots, plays, and quietly shows
+        // vanilla content. Always say what happened.
+        RT_LOG(RT_TAG_RIIVOLUTION) << xmlFile.string() << ": " << activePatches.size()
+                  << " active patch(es), " << (set.mappings.size() - before) << " mapping(s)"
+                  << std::endl;
+        if (activePatches.empty()) {
+            RT_LOG(RT_TAG_RIIVOLUTION) << "WARNING: " << xmlFile.string()
+                      << " has no enabled options for " << gameId
+                      << "; check the riivolution option selections (recomp.yml) or "
+                      << sdRootGeneric << "/riivolution/config/" << gameId.substr(0, 4) << ".xml"
+                      << std::endl;
+        }
+    }
+
+    if (set.skippedExternals != 0) {
+        RT_LOG(RT_TAG_RIIVOLUTION) << overlayRoot.string() << ": skipped "
+                  << set.skippedExternals << " mapping(s) whose external path does not exist"
+                  << std::endl;
+    }
+
+    return set;
+}
+
+void RiivoInitialize() {
+    g_riivoState.overlays = RiivoDiscoverRoots();
+    for (auto& overlay : g_riivoState.overlays) {
+        overlay.patches = RiivoLoadPatchSet(overlay.root, g_riivoState);
+    }
+}
+
+} // namespace
+
+namespace RuntimeRiivolution {
+
+const std::vector<Overlay>& Overlays() {
+    std::call_once(g_riivoOnce, RiivoInitialize);
+    return g_riivoState.overlays;
+}
+
+const std::optional<SaveRedirect>& GetSaveRedirect() {
+    std::call_once(g_riivoOnce, RiivoInitialize);
+    return g_riivoState.saveRedirect;
+}
+
+} // namespace RuntimeRiivolution
diff --git a/runtime/src/hle/storage/riivolution.h b/runtime/src/hle/storage/riivolution.h
new file mode 100644
index 0000000..ff7c71c
--- /dev/null
+++ b/runtime/src/hle/storage/riivolution.h
@@ -0,0 +1,60 @@
+// Riivolution overlay loading: host-IO shim around hle/riivolution_contract.h. Discovers DVD
+// overlay roots (Config.toml/CLI/recomp mod manifest), parses each root's XML, applies option
+// selections, and exposes the resulting disc mappings (dvd.cpp) and savegame redirect (nand_fs.cpp).
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#pragma once
+
+#include <filesystem>
+#include <optional>
+#include <string>
+#include <vector>
+
+namespace RuntimeRiivolution {
+
+struct Mapping {
+    enum class Kind {
+        File,         // discPath is a file path
+        Folder,       // discPath is a directory prefix
+        FolderByName, // no disc path: replace disc files matching by filename
+    };
+
+    Kind kind = Kind::File;
+    std::string discPath;
+    std::filesystem::path hostPath;
+    bool recursive = true;
+    // Riivolution 'create': when false, only files already present on the disc
+    // may be replaced; nothing new is added.
+    bool create = false;
+};
+
+struct PatchSet {
+    // In Dolphin's application order (per active patch: files, then folders);
+    // a later mapping for the same disc path wins.
+    std::vector<Mapping> mappings;
+    uint32_t skippedExternals = 0; // externals that do not exist on the host
+};
+
+struct Overlay {
+    std::filesystem::path root;
+    // nullopt: the root carries no Riivolution XML and is a plain disc-shaped
+    // overlay directory.
+    std::optional<PatchSet> patches;
+};
+
+struct SaveRedirect {
+    std::filesystem::path hostDirectory;
+    bool clone = false;
+};
+
+// Discovered overlay roots in precedence order (highest priority first), each
+// with its active Riivolution mappings. Loaded once, thread-safe.
+const std::vector<Overlay>& Overlays();
+
+// The active <savegame> redirect from the highest-priority overlay that has
+// one, resolved to a host directory (Dolphin semantics: the whole NAND
+// /title/<id>/data directory is redirected there).
+const std::optional<SaveRedirect>& GetSaveRedirect();
+
+} // namespace RuntimeRiivolution
diff --git a/runtime/src/hle/strap_scene.cpp b/runtime/src/hle/strap_scene.cpp
new file mode 100644
index 0000000..cf4e7ad
--- /dev/null
+++ b/runtime/src/hle/strap_scene.cpp
@@ -0,0 +1,17 @@
+#include "hle_stubs.h"
+#include "settings_overlay.h"
+
+#include <cstdint>
+
+// StrapScene::calc calls CheckInput only after the scene's loading and timing
+// gates have completed. Accepting that check advances on the first eligible
+// frame without depending on a Code.pul function address or guest controller
+// hardware. The PAL base DOL hash pins this entry point, and Retro Rewind
+// overlays the same base-game function.
+extern "C" uint32_t StrapScene__CheckInput_Skip(uint32_t scenePtr)
+{
+    (void)scenePtr;
+    settings_overlay::NotifyStrapInputAccepted();
+    return 1;
+}
+PPC_NATIVE_OVERRIDE(800077C8, StrapScene__CheckInput_Skip, uint32_t, (uint32_t scenePtr), (scenePtr));
diff --git a/runtime/src/hle/task_thread.cpp b/runtime/src/hle/task_thread.cpp
new file mode 100644
index 0000000..dc4810d
--- /dev/null
+++ b/runtime/src/hle/task_thread.cpp
@@ -0,0 +1,209 @@
+#include "hle_stubs.h"
+#include "abi_bridge.h"
+#include "ppc_runtime.h"
+#include "memory.h"
+#include "runtime_log.h"
+
+namespace {
+
+constexpr uint32_t kTaskMessageQueueOffset = 0x0Cu;
+constexpr uint32_t kTaskCurrentJobOffset = 0x48u;
+constexpr uint32_t kTaskDoneQueueOffset = 0x54u;
+
+constexpr uint32_t kJobCallbackOffset = 0x00u;
+constexpr uint32_t kJobArgOffset = 0x04u;
+constexpr uint32_t kJobTokenOffset = 0x08u;
+constexpr uint32_t kJobUnknown3Offset = 0x0Cu;
+constexpr uint32_t kJobUnknown4Offset = 0x10u;
+constexpr uint32_t kJobOnDoneOffset = 0x14u;
+constexpr uint32_t kJobSize = 0x18u;
+
+bool ShouldRetryThpPrepareAfterClose(uint32_t callback, uint32_t arg, uint32_t result)
+{
+    if (callback != 0x80529D68u || result != 0) {
+        return false;
+    }
+    if (arg == 0 || !Memory::Contains(arg + 0xACu, 4)) {
+        return false;
+    }
+    const uint32_t state = Memory::Read32(arg + 0xACu);
+    if (state != 0) {
+        return false;
+    }
+    if (!Memory::Contains(0x809BECF0u, 4) || !Memory::Contains(0x809BEBA0u, 4)) {
+        return false;
+    }
+    const uint32_t thpInit = Memory::Read32(0x809BECF0u);
+    const uint32_t thpOpen = Memory::Read32(0x809BEBA0u);
+    return thpInit != 0 && thpOpen != 0;
+}
+
+uint32_t RunMovieManagerPrepareAsync(uint32_t manager, CpuContext* cpu)
+{
+    if (!cpu || manager == 0 || !Memory::Contains(manager + 0xACu, 4)) {
+        return 0;
+    }
+
+    if (Memory::Read32(manager + 0xACu) != 0) {
+        return cpu->gpr[3];
+    }
+
+    auto callThpPlayerOpen = [&]() -> uint32_t {
+        CpuContextScope scope(cpu);
+        cpu->gpr[3] = manager + 0x28u;
+        cpu->gpr[4] = 0;
+        InvokeIndirectCpu(0x80550CC0u, cpu);
+        return cpu->gpr[3];
+    };
+
+    uint32_t openResult = callThpPlayerOpen();
+    if (openResult == 0 && ShouldRetryThpPrepareAfterClose(0x80529D68u, manager, 0)) {
+        {
+            CpuContextScope scope(cpu);
+            InvokeIndirectCpu(0x80551658u, cpu); // THP__PlayerStop
+            InvokeIndirectCpu(0x80550F48u, cpu); // THP__PlayerClose
+        }
+        if (Memory::Contains(0x809BEBA0u, 8) && Memory::Read32(0x809BEBA0u) != 0) {
+            Memory::Write32(0x809BEBA0u, 0);
+            Memory::Write8(0x809BEBA4u, 0);
+            Memory::Write8(0x809BEBA5u, 0);
+            Memory::Write8(0x809BEBA6u, 0);
+            Memory::Write8(0x809BEBA7u, 0);
+        }
+        openResult = callThpPlayerOpen();
+    }
+
+    if (openResult == 0) {
+        cpu->gpr[3] = 0;
+        return 0;
+    }
+
+    {
+        CpuContextScope scope(cpu);
+        cpu->gpr[3] = manager + 0x10u;
+        InvokeIndirectCpu(0x80551D38u, cpu); // THP__PlayerGetVideoInfo
+        InvokeIndirectCpu(0x80550F9Cu, cpu); // THP__PlayerCalcNeedMemory
+    }
+    const uint32_t needMemory = cpu->gpr[3];
+    Memory::Write32(manager + 0x20u, needMemory);
+    Memory::Write32(manager + 0x24u, 0);
+
+    const uint32_t setBufferArg = Memory::Read32(manager + 0x1Cu);
+    {
+        CpuContextScope scope(cpu);
+        cpu->gpr[3] = setBufferArg;
+        InvokeIndirectCpu(0x80551054u, cpu); // THP__PlayerSetBuffer
+    }
+
+    const uint32_t mode = Memory::Read32(manager + 0xA8u);
+    const uint32_t audioSystem = Memory::Read32(0x8088FDB8u + (mode << 2));
+    uint32_t prepareResult = 0;
+    {
+        CpuContextScope scope(cpu);
+        cpu->gpr[3] = Memory::Read32(manager + 0x24u);
+        cpu->gpr[4] = audioSystem;
+        cpu->gpr[5] = 0;
+        InvokeIndirectCpu(0x80551378u, cpu); // THP__PlayerPrepare
+        prepareResult = cpu->gpr[3];
+    }
+    if (prepareResult != 0) {
+        Memory::Write32(manager + 0xACu, 1);
+    }
+    cpu->gpr[3] = prepareResult;
+    return prepareResult;
+}
+
+void ClearTaskJob(uint32_t taskThread, uint32_t job)
+{
+    if (job == 0 || !Memory::Contains(job, kJobSize)) {
+        Memory::Write32(taskThread + kTaskCurrentJobOffset, 0);
+        return;
+    }
+
+    Memory::Write32(job + kJobCallbackOffset, 0);
+    Memory::Write32(taskThread + kTaskCurrentJobOffset, 0);
+    Memory::Write32(job + kJobCallbackOffset, 0);
+    Memory::Write32(job + kJobUnknown3Offset, 0);
+    Memory::Write32(job + kJobUnknown4Offset, 0);
+    Memory::Write32(job + kJobOnDoneOffset, 0);
+}
+
+} // namespace
+
+// HLE override for TaskThread_run (0x80242D7C).
+// This mirrors the worker loop from the original implementation so job slots
+// are retired exactly when the callback has finished.
+extern "C" void TaskThread_run_HLE_80242d7c(CpuContext* ctx) {
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    const uint32_t taskThread = cpu->gpr[3];
+    if (!Memory::Contains(taskThread + kTaskMessageQueueOffset, 0x4Cu)) {
+        return;
+    }
+
+    // Match the original PPC prologue: TaskThread::Run seeds GQR2-GQR5 before
+    // servicing callbacks. Some worker callbacks rely on these quantization
+    // registers being initialized on the task thread.
+    cpu->gqr[2] = 0x00040004u;
+    cpu->gqr[3] = 0x00050005u;
+    cpu->gqr[4] = 0x00060006u;
+    cpu->gqr[5] = 0x00070007u;
+
+    while (true) {
+        const uint32_t stackPointer = cpu->gpr[1];
+        const uint32_t outMsgPtr = stackPointer >= 0x20u ? (stackPointer - 0x20u) : 0;
+        if (outMsgPtr == 0 || !Memory::Contains(outMsgPtr, 4)) {
+            RT_LOG(RT_TAG_HLE) << "TaskThread_run: invalid guest stack scratch for task thread 0x"
+                      << std::hex << taskThread << std::dec << std::endl;
+            return;
+        }
+
+        {
+            CpuContextScope scope(cpu);
+            cpu->gpr[3] = taskThread + kTaskMessageQueueOffset;
+            cpu->gpr[4] = outMsgPtr;
+            cpu->gpr[5] = 1; // OS_MESSAGE_BLOCK
+            InvokeIndirectCpu(0x801A7424u, cpu); // OSReceiveMessage
+        }
+
+        const uint32_t job = Memory::Read32(outMsgPtr);
+        Memory::Write32(taskThread + kTaskCurrentJobOffset, job);
+
+        if (job != 0 && Memory::Contains(job, kJobSize)) {
+            const uint32_t callback = Memory::Read32(job + kJobCallbackOffset);
+            const uint32_t arg = Memory::Read32(job + kJobArgOffset);
+            const uint32_t token = Memory::Read32(job + kJobTokenOffset);
+            const uint32_t onDone = Memory::Read32(job + kJobOnDoneOffset);
+
+            if (callback != 0) {
+                CpuContextScope scope(cpu);
+                if (callback == 0x80529D68u) {
+                    RunMovieManagerPrepareAsync(arg, cpu);
+                } else {
+                    cpu->gpr[3] = arg;
+                    InvokeIndirectCpu(callback, cpu);
+                }
+            }
+
+            const uint32_t currentJob = Memory::Read32(taskThread + kTaskCurrentJobOffset);
+            if (currentJob != 0 && onDone != 0) {
+                CpuContextScope scope(cpu);
+                cpu->gpr[3] = Memory::Read32(currentJob + kJobArgOffset);
+                InvokeIndirectCpu(onDone, cpu);
+            }
+
+            if (Memory::Contains(taskThread + kTaskDoneQueueOffset, 4)) {
+                const uint32_t doneQueue = Memory::Read32(taskThread + kTaskDoneQueueOffset);
+                if (doneQueue != 0) {
+                    CpuContextScope scope(cpu);
+                    cpu->gpr[3] = doneQueue;
+                    cpu->gpr[4] = token;
+                    cpu->gpr[5] = 0; // OS_MESSAGE_NOBLOCK
+                    InvokeIndirectCpu(0x801A735Cu, cpu); // OSSendMessage
+                }
+            }
+        }
+
+        ClearTaskJob(taskThread, job);
+    }
+}
+PPC_NATIVE_OVERRIDE_VOID(80242D7C, TaskThread_run_HLE_80242d7c, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/hle/trk.cpp b/runtime/src/hle/trk.cpp
new file mode 100644
index 0000000..50c2867
--- /dev/null
+++ b/runtime/src/hle/trk.cpp
@@ -0,0 +1,14 @@
+#include "hle_stubs.h"
+#include "runtime_log.h"
+#include <cstdint>
+#include <cstdio>
+
+extern "C" uint32_t Stub_8002001C(uint32_t ctx, int code)
+{
+    RT_LOGF(RT_TAG_HLE, "Stub_8002001C(0x%08x, %d)\n", ctx, code);
+    (void)ctx;
+    (void)code;
+    return 0;
+}
+
+PPC_NATIVE_OVERRIDE(8002001C, Stub_8002001C, uint32_t, (uint32_t ctx, int code), (ctx, code));
diff --git a/runtime/src/hle/vi.cpp b/runtime/src/hle/vi.cpp
new file mode 100644
index 0000000..59369d2
--- /dev/null
+++ b/runtime/src/hle/vi.cpp
@@ -0,0 +1,923 @@
+#include "hle_stubs.h"
+#include "memory.h"
+#include "abi_bridge.h"
+#include "guest_interrupt_context.h"
+#include "ppc_runtime.h"
+#include "aurora_events.h"
+#include "settings_overlay.h"
+#include "fiber_manager.h"
+#include "runtime_log.h"
+
+#include <dolphin/vi.h>
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <mutex>
+#include <thread>
+
+#include <aurora/aurora.h>
+
+#if defined(_WIN32)
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <windows.h>
+#endif
+
+// Forward declaration for OSWakeupThread - used to wake threads on VI retrace queue
+extern "C" void OSWakeupThread_HLE_801aaaa4(CpuContext* ctx);
+
+// Forward declaration for OSSleepThread - used by VIWaitForRetrace HLE
+extern "C" void OSSleepThread_HLE_801aa9b8(CpuContext* cpu);
+extern "C" int g_gxFrameCount;
+extern "C" int32_t OS__DisableInterrupts_801a65ac();
+extern "C" int32_t OS__RestoreInterrupts_801a65d4(int32_t level);
+
+// Aurora frame cycle tracking - needs external linkage for the GX HLE
+// (declared in gx_internal.h, consumed by gx_frame.cpp). We need to call
+// aurora_begin_frame() before GX commands and aurora_end_frame() after.
+std::atomic_bool g_auroraFrameActive{false};
+std::atomic_bool g_auroraFrameHadWork{false};
+
+namespace {
+
+using namespace std::chrono_literals;
+using Clock = std::chrono::steady_clock;
+
+constexpr uint32_t kGuestGxRenderModeCopyBytes = 0x39;
+
+bool ReadGuestRenderModeObj(uint32_t guestPtr, GXRenderModeObj& out) {
+    if (guestPtr == 0 || !Memory::Contains(guestPtr, kGuestGxRenderModeCopyBytes)) {
+        return false;
+    }
+
+    try {
+        out.viTVmode = static_cast<VITVMode>(Memory::Read32(guestPtr + 0x00));
+        out.fbWidth = Memory::Read16(guestPtr + 0x04);
+        out.efbHeight = Memory::Read16(guestPtr + 0x06);
+        out.xfbHeight = Memory::Read16(guestPtr + 0x08);
+        out.viXOrigin = Memory::Read16(guestPtr + 0x0a);
+        out.viYOrigin = Memory::Read16(guestPtr + 0x0c);
+        out.viWidth = Memory::Read16(guestPtr + 0x0e);
+        out.viHeight = Memory::Read16(guestPtr + 0x10);
+        out.xFBmode = static_cast<VIXFBMode>(Memory::Read32(guestPtr + 0x14));
+        out.field_rendering = Memory::Read8(guestPtr + 0x18);
+        out.aa = Memory::Read8(guestPtr + 0x19);
+
+        for (size_t i = 0; i < 12; ++i) {
+            out.sample_pattern[i][0] = Memory::Read8(guestPtr + 0x1a + static_cast<uint32_t>(i * 2));
+            out.sample_pattern[i][1] = Memory::Read8(guestPtr + 0x1a + static_cast<uint32_t>(i * 2) + 1);
+        }
+        for (size_t i = 0; i < 7; ++i) {
+            out.vfilter[i] = Memory::Read8(guestPtr + 0x32 + static_cast<uint32_t>(i));
+        }
+    } catch (const Memory::AccessViolation&) {
+        return false;
+    }
+
+    return true;
+}
+
+struct ViState {
+    bool initialized = false;
+    uint32_t tvFormat = 0; // VIGetTvFormat returns VI_NTSC before VIInit
+    uint32_t nextFrameBuffer = 0;
+    uint32_t currentFrameBuffer = 0;
+    uint32_t retraceCount = 0;
+    bool black = false;
+    uint32_t preRetraceCallback = 0;
+    uint32_t postRetraceCallback = 0;
+    uint32_t renderWidth = 640;
+    uint32_t renderHeight = 480;
+    uint32_t viXOrigin = 0;
+    uint32_t viYOrigin = 0;
+    uint32_t xfbWidth = 640;
+    uint32_t xfbHeight = 480;
+    bool fieldOdd = false;
+    Clock::time_point lastRetrace = Clock::now();
+    std::chrono::microseconds retraceInterval{16666us}; // ~60 Hz
+    bool hasValidXfb = false; // True once we've received at least one GXCopyDisp
+    uint32_t readyXfb = 0;    // XFB address from the most recent GXCopyDisp
+
+    // VIConfigure/VISetNextFrameBuffer/VISetBlack only write pending values below; VIFlush arms them but
+    // the commit happens at the next retrace, matching real VI hardware. A VIFlush called from a
+    // pre-retrace callback therefore misses the imminent field and lands one field late.
+
+    // Pending values (written by VISetNextFrameBuffer, VISetBlack, VIConfigure)
+    uint32_t pendingNextFrameBuffer = 0;
+    bool pendingBlack = false;
+    // Matches the active-state default (NTSC before VIInit) and the pending
+    // 16666us interval below; a flush before any VIConfigure must not commit
+    // PAL timing onto an NTSC-interval state.
+    uint32_t pendingTvFormat = 0;
+    uint32_t pendingRenderWidth = 640;
+    uint32_t pendingRenderHeight = 480;
+    uint32_t pendingViXOrigin = 0;
+    uint32_t pendingViYOrigin = 0;
+    uint32_t pendingXfbWidth = 640;
+    uint32_t pendingXfbHeight = 480;
+    std::chrono::microseconds pendingRetraceInterval{16666us};
+    
+    // Set by VIFlush(); cleared after commit in AdvanceRetrace
+    bool flushArmed = false;
+};
+
+std::mutex g_viMutex;
+ViState g_vi;
+
+
+// Guest-side state addresses used by the SDK's VI globals.
+constexpr uint32_t kViInitializedFlagAddr   = 0x80386b38;
+constexpr uint32_t kViTvFormatAddr          = 0x80386ba8;
+constexpr uint32_t kViRenderWidthAddr       = 0x80350864;
+constexpr uint32_t kViRenderHeightAddr      = 0x80350866;
+constexpr uint32_t kViXfbWidthAddr          = 0x80350872;
+constexpr uint32_t kViXfbHeightAddr         = 0x8035087c;
+constexpr uint32_t kViRetraceCountAddr      = 0x80386be4; // matches VIWaitForRetrace/handler
+constexpr uint32_t kViTimingGuardAddr       = 0x80386b44;
+constexpr uint32_t kViPreRetraceCallback    = 0x80386bb8;
+constexpr uint32_t kViPostRetraceCallback   = 0x80386bb4;
+constexpr uint32_t kViNextFrameBufferAddr   = 0x80386ba0;
+constexpr uint32_t kViNextFrameBufferHwAddr = 0x80350890;
+constexpr uint32_t kViRetraceQueueAddr      = 0x80386bc0; // Thread queue for VIWaitForRetrace
+
+// EGG::BaseSystem::sSystem pointer - must be non-null before post-retrace callback is valid
+constexpr uint32_t kEggSSystemAddr = 0x80386F60;
+
+std::chrono::microseconds IntervalForFormat(uint32_t tvFormat) {
+    // NTSC-ish defaults to 60 Hz; PAL uses 50 Hz.
+    return tvFormat == 1 ? 20000us : 16666us;
+}
+
+// Shared busy-wait budget for deadline-precise sleeps (matches Aurora's
+// presenter spin window). Larger windows burn a core for no visible gain.
+constexpr std::chrono::microseconds kFinalSpinWindow{500};
+
+void SleepPreciselyUntil(Clock::time_point deadline, bool finishWithSpin = false,
+                         std::chrono::microseconds spinWindow = 750us) {
+    const auto now = Clock::now();
+    if (now >= deadline) {
+        return;
+    }
+    const auto timerDeadline =
+        finishWithSpin && deadline - now > spinWindow ? deadline - spinWindow : deadline;
+#if defined(_WIN32)
+#ifndef CREATE_WAITABLE_TIMER_HIGH_RESOLUTION
+#define CREATE_WAITABLE_TIMER_HIGH_RESOLUTION 0x00000002
+#endif
+    struct HighResolutionTimer {
+        HANDLE handle = CreateWaitableTimerExW(nullptr, nullptr, CREATE_WAITABLE_TIMER_HIGH_RESOLUTION,
+                                               TIMER_MODIFY_STATE | SYNCHRONIZE);
+        ~HighResolutionTimer() {
+            if (handle != nullptr) {
+                CloseHandle(handle);
+            }
+        }
+    };
+    static thread_local HighResolutionTimer timer;
+    if (timer.handle != nullptr) {
+        const auto remaining100ns =
+            std::chrono::duration_cast<std::chrono::duration<int64_t, std::ratio<1, 10000000>>>(timerDeadline - now);
+        LARGE_INTEGER due{};
+        due.QuadPart = -std::max<int64_t>(remaining100ns.count(), 1);
+        if (SetWaitableTimerEx(timer.handle, &due, 0, nullptr, nullptr, nullptr, 0) != FALSE) {
+            WaitForSingleObject(timer.handle, INFINITE);
+            if (!finishWithSpin) {
+                return;
+            }
+        }
+    }
+#endif
+    if (!finishWithSpin) {
+        std::this_thread::sleep_until(deadline);
+        return;
+    }
+    if (Clock::now() < timerDeadline) {
+        std::this_thread::sleep_until(timerDeadline);
+    }
+    // This runs only for the final fraction of a VI interval. Do not yield the
+    // host thread here: a scheduler quantum is larger than the remaining
+    // budget and would recreate the 17-18 ms sawtooth this path removes.
+    while (Clock::now() < deadline) {
+#if defined(_WIN32)
+        YieldProcessor();
+#endif
+    }
+}
+
+void ViSetR3(CpuContext* ctx, uint32_t value)
+{
+    if (ctx) {
+        ctx->gpr[3] = value;
+    }
+}
+
+void WriteGuestStateLocked() {
+    try {
+        Memory::Write8(kViInitializedFlagAddr, 1);
+        Memory::Write8(kViTimingGuardAddr, 1);
+        Memory::Write32(kViTvFormatAddr, g_vi.tvFormat);
+        Memory::Write16(kViRenderWidthAddr, static_cast<uint16_t>(g_vi.renderWidth));
+        Memory::Write16(kViRenderHeightAddr, static_cast<uint16_t>(g_vi.renderHeight));
+        Memory::Write16(kViXfbWidthAddr, static_cast<uint16_t>(g_vi.xfbWidth));
+        Memory::Write16(kViXfbHeightAddr, static_cast<uint16_t>(g_vi.xfbHeight));
+        Memory::Write32(kViRetraceCountAddr, g_vi.retraceCount);
+        Memory::Write32(kViPreRetraceCallback, g_vi.preRetraceCallback);
+        Memory::Write32(kViPostRetraceCallback, g_vi.postRetraceCallback);
+        // Write PENDING frame buffer to guest memory so SDK code sees the queued value
+        Memory::Write32(kViNextFrameBufferAddr, g_vi.pendingNextFrameBuffer);
+        Memory::Write32(kViNextFrameBufferHwAddr, g_vi.pendingNextFrameBuffer);
+    } catch (const ::Memory::AccessViolation& e) {
+        LogMemoryError(RT_TAG_VI, "WriteGuestStateLocked", e);
+    }
+}
+
+void EnsureInitializedLocked() {
+    if (g_vi.initialized) {
+        return;
+    }
+    g_vi.initialized = true;
+    g_vi.retraceInterval = IntervalForFormat(g_vi.tvFormat);
+    g_vi.lastRetrace = Clock::now();
+    WriteGuestStateLocked();
+}
+
+// GXRenderModeObj::viTVmode encodes the output family (0 NTSC, 1 PAL, 2 MPAL,
+// 5 EURGB60) in bits [4:2].
+uint32_t ExtractTvFormat(uint32_t tvMode) {
+    return (tvMode >> 2) & 0x7;
+}
+
+// Re-entry guard to prevent AdvanceRetrace calling itself via OSWakeupThread -> SelectThread
+static std::atomic<bool> s_inAdvanceRetrace{false};
+
+void AdvanceRetrace(CpuContext* ctx, Clock::time_point retraceStamp, bool serviceAurora) {
+    // Prevent re-entry - this can happen if OSWakeupThread triggers SelectThread
+    // which goes idle and calls ProcessTimerEvents again
+    if (s_inAdvanceRetrace.exchange(true)) {
+        return;
+    }
+    
+    uint32_t preCb = 0;
+    uint32_t postCb = 0;
+    uint32_t retraceValue = 0;
+    bool hasXfbReady = false;
+    uint32_t readyXfb = 0;
+    uint32_t currentFb = 0;
+    bool isBlack = false;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        
+        // Commit pending state if VIFlush armed it (see ViState).
+        if (g_vi.flushArmed) {
+            // Commit pending -> active
+            g_vi.nextFrameBuffer = g_vi.pendingNextFrameBuffer;
+            g_vi.black = g_vi.pendingBlack;
+            g_vi.tvFormat = g_vi.pendingTvFormat;
+            g_vi.renderWidth = g_vi.pendingRenderWidth;
+            g_vi.renderHeight = g_vi.pendingRenderHeight;
+            g_vi.viXOrigin = g_vi.pendingViXOrigin;
+            g_vi.viYOrigin = g_vi.pendingViYOrigin;
+            g_vi.xfbWidth = g_vi.pendingXfbWidth;
+            g_vi.xfbHeight = g_vi.pendingXfbHeight;
+            g_vi.retraceInterval = g_vi.pendingRetraceInterval;
+            
+            // Clear flush armed flag
+            g_vi.flushArmed = false;
+            
+        }
+        
+        g_vi.retraceCount++;
+        g_vi.fieldOdd = !g_vi.fieldOdd;
+        g_vi.currentFrameBuffer = g_vi.nextFrameBuffer;
+        currentFb = g_vi.currentFrameBuffer;
+        g_vi.lastRetrace = retraceStamp;
+        retraceValue = g_vi.retraceCount;
+        preCb = g_vi.preRetraceCallback;
+        postCb = g_vi.postRetraceCallback;
+        hasXfbReady = g_vi.hasValidXfb;
+        readyXfb = g_vi.readyXfb;
+        isBlack = g_vi.black;
+        WriteGuestStateLocked();
+    }
+
+    // Wake up threads sleeping on the VI retrace queue (VIWaitForRetrace).
+    // The retrace count has been incremented and written to guest memory.
+    if (ctx) {
+        ctx->gpr[3] = kViRetraceQueueAddr;
+        OSWakeupThread_HLE_801aaaa4(ctx);
+    }
+
+    if (serviceAurora) {
+        // Process window events (but don't present - that happens in GXCopyDisp)
+        UpdateAuroraAndProcessEvents();
+
+        // Start a new Aurora frame if one isn't already active
+        if (!g_auroraFrameActive.load(std::memory_order_acquire)) {
+            if (BeginAuroraFrame()) {
+                g_auroraFrameActive.store(true, std::memory_order_release);
+            }
+        }
+    }
+
+    if (ctx) {
+        ctx->gpr[3] = retraceValue;
+        if (preCb) {
+            InvokeIndirectCpu(preCb, ctx);
+        }
+        if (postCb) {
+            // Guard: only invoke callback if sSystem is initialized
+            // The callback dereferences sSystem which must be non-null
+            uint32_t sSystemPtr = Memory::Read32(kEggSSystemAddr);
+            if (sSystemPtr != 0) {
+                InvokeIndirectCpu(postCb, ctx);
+            }
+        }
+    }
+
+    // VISetBlack(TRUE) keeps frame submission running but shows only the clear color: GX render work is
+    // skipped and Aurora's end_frame() clears to black, matching the hardware manual's "signal continues,
+    // pixels go black" behavior. When not black, submission waits for hasXfbReady (GXCopyDisp done).
+    if (serviceAurora) {
+        const bool frameActive = g_auroraFrameActive.load(std::memory_order_acquire);
+        const bool xfbMatches = (readyXfb != 0 && readyXfb == currentFb);
+        const bool shouldPresentXfb = hasXfbReady && !isBlack && xfbMatches;
+        const bool shouldPresentBlack = isBlack && frameActive;
+        const bool shouldSubmit = frameActive && (shouldPresentXfb || shouldPresentBlack);
+
+        if (shouldSubmit) {
+            if (!isBlack || settings_overlay::StartupScreenVisible()) {
+                // Normal presentation: draw overlay on top of GX content
+                settings_overlay::Draw();
+            }
+            // Outside startup, VI black remains a pure black presentation.
+            // Unpaced: this present already runs in retrace context.
+            VI_HLE_PresentFrame(shouldPresentXfb, false);
+        } else if (g_auroraFrameHadWork.load(std::memory_order_acquire) && !shouldPresentXfb && !isBlack) {
+            // GX work is in progress but frame not complete - just poll window events
+            // Don't call aurora_end_frame() as that would present incomplete work
+            UpdateAuroraAndProcessEvents();
+        }
+    }
+
+    // Clear re-entry guard
+    s_inAdvanceRetrace.store(false);
+}
+
+bool AdvanceDueRetraces(CpuContext* ctx, int maxToProcess, bool serviceAurora)
+{
+    bool advancedAny = false;
+
+    for (int catchUpCount = 0; catchUpCount < maxToProcess; ++catchUpCount) {
+        Clock::time_point target;
+        auto now = Clock::now();
+        {
+            std::lock_guard<std::mutex> lock(g_viMutex);
+            if (!g_vi.initialized) {
+                return advancedAny;
+            }
+            target = g_vi.lastRetrace + g_vi.retraceInterval;
+            if (now < target) {
+                return advancedAny;
+            }
+        }
+
+
+        AdvanceRetrace(ctx, target, serviceAurora);
+        advancedAny = true;
+    }
+
+    return advancedAny;
+}
+
+} // namespace
+
+// Force one retrace boundary to pass, whether or not its wall-clock deadline
+// has arrived, so the guest's retrace callbacks (AsyncDisplay's counters and
+// friends) run. VI_HLE_PollRetrace below is the time-driven counterpart.
+void VI_HLE_ForceRetrace(CpuContext* ctx) {
+    Clock::time_point target;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        target = g_vi.lastRetrace + g_vi.retraceInterval;
+    }
+    AdvanceRetrace(ctx, target, true);
+}
+
+bool VI_HLE_IsAdvancingRetrace() {
+    return s_inAdvanceRetrace.load(std::memory_order_acquire);
+}
+
+// Advance every retrace whose interval has already elapsed. Safe to call from
+// busy loops (GX drawing, the scheduler's idle spin) to keep VBlank ticking.
+void VI_HLE_PollRetrace(CpuContext* ctx) {
+    AdvanceDueRetraces(ctx, 8, true);
+}
+
+void VI_HLE_ProcessRetracesDeferred(int maxToProcess) {
+    if (maxToProcess <= 0 || !OS_HLE_InterruptsEnabled()) {
+        return;
+    }
+
+    // This entry point runs from the middle of an arbitrary translated function
+    // (GX__Begin's timing service, the host frame loop). Retrace callbacks are
+    // an interrupt from that function's point of view, so they get a private
+    // copy of its register file exactly as the hardware interrupt would.
+    GuestInterruptCallbackContext interrupt;
+    CpuContext* cpu = interrupt.get();
+
+    // Host renderer ownership is not a guest critical section. Deliver due VI
+    // callbacks at wall-clock cadence while suppressing thread switches and
+    // all recursive Aurora/event work until the native GX call has unwound.
+    OS_HLE_BeginDeferredGuestCallbacks();
+    try {
+        AdvanceDueRetraces(cpu, maxToProcess, false);
+    } catch (...) {
+        OS_HLE_EndDeferredGuestCallbacks();
+        throw;
+    }
+    OS_HLE_EndDeferredGuestCallbacks();
+}
+
+void VI_HLE_WaitForNextRetracePoll() {
+    Clock::time_point retraceDeadline;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        retraceDeadline = g_vi.lastRetrace + g_vi.retraceInterval;
+    }
+
+    const auto now = Clock::now();
+    if (now >= retraceDeadline) {
+        return;
+    }
+    // Audio DMA and alarm queues still need regular service even when the VI
+    // deadline is farther away. The high-resolution wait removes the 1 ms
+    // scheduler overshoot when retrace is the next event.
+    const bool retraceIsNext = retraceDeadline <= now + 1ms;
+    SleepPreciselyUntil(retraceIsNext ? retraceDeadline : now + 1ms, retraceIsNext,
+                        kFinalSpinWindow);
+}
+
+namespace {
+
+// Retrace count consumed by the most recent paced present. This is a slot memo
+// against the VI timeline, not a second clock: it only answers "did a retrace
+// already elapse while this frame was being produced?". Producer-thread only.
+uint32_t s_lastPacedRetraceCount = ~0u;
+
+// Last presentation anchor handed to Aurora, in nanoseconds on the VI retrace
+// grid. Guarantees consecutive sealed frames never share an anchor (see the
+// comment at the stamping site). Producer-thread only, like the memo above.
+uint64_t s_lastPresentAnchorNanos = 0;
+
+// Sleeps to the same VI retrace boundary VIWaitForRetrace targets, servicing alarms every 1 ms so audio
+// DMA and timers keep running, then delivers that retrace so guest logic starts exactly on the grid.
+void PaceToRetraceBoundary(Clock::time_point deadline) {
+    constexpr auto kServiceSlice = 1ms;
+    for (;;) {
+        const auto now = Clock::now();
+        if (now >= deadline) {
+            break;
+        }
+        if (deadline - now > kServiceSlice + kFinalSpinWindow) {
+            SleepPreciselyUntil(now + kServiceSlice);
+            OS_HLE_ProcessAlarmsDeferred(8);
+            // Audio DMA is a 3 ms cadence and this wait is up to a full display
+            // period long. Without a pump here the blocks that came due during
+            // the wait are all delivered at once when the guest next reaches
+            // idle, which the guest observes as AI slack jitter.
+            Audio_HLE_PollDeferred();
+            continue;
+        }
+        SleepPreciselyUntil(deadline, true, kFinalSpinWindow);
+        break;
+    }
+    VI_HLE_ProcessRetracesDeferred(1);
+}
+
+} // namespace
+
+// Single owner of the Aurora frame presentation sequence: seals the active frame, optionally paces the
+// producer to the VI retrace boundary, and pre-warms the next frame. Paced from GXCopyDisp; unpaced for
+// the retrace-context black/boot present path in AdvanceRetrace.
+void VI_HLE_PresentFrame(bool presentedXfb, bool paceToRetrace) {
+    Clock::time_point paceDeadline{};
+    bool paceThisFrame = false;
+    if (paceToRetrace) {
+        uint64_t baseNanos = 0;
+        uint64_t intervalNanos = 0;
+        uint32_t retraceCount = 0;
+        {
+            std::lock_guard<std::mutex> lock(g_viMutex);
+            EnsureInitializedLocked();
+            paceDeadline = g_vi.lastRetrace + g_vi.retraceInterval;
+            retraceCount = g_vi.retraceCount;
+            baseNanos = static_cast<uint64_t>(
+                std::chrono::duration_cast<std::chrono::nanoseconds>(
+                    g_vi.lastRetrace.time_since_epoch())
+                    .count());
+            intervalNanos = static_cast<uint64_t>(
+                std::chrono::duration_cast<std::chrono::nanoseconds>(g_vi.retraceInterval)
+                    .count());
+        }
+        // Hold the frame to its boundary only when no retrace elapsed during
+        // its production. A frame that missed its boundary presents
+        // immediately: hardware would quantize down to the next vblank here,
+        // but free-running late frames matches the previous pacer and keeps a
+        // heavy scene at e.g. 50 fps instead of hard 30.
+        const uint32_t retracesElapsed = retraceCount - s_lastPacedRetraceCount;
+        paceThisFrame = retracesElapsed == 0;
+        s_lastPacedRetraceCount = retraceCount;
+        // aurora_report_producer_paced needs a different signal than the pace-wait above: the guest
+        // self-paces via VIWaitForRetrace, so one retrace per produced frame is the healthy locked-60
+        // cadence, and zero only happens when production outruns VI. "Kept up" means <=1 retrace
+        // elapsed; 2+ means a boundary was missed, so Aurora seals that frame without its interpolated
+        // slots (a windowed backstop lowers the slot target only under sustained overload).
+        aurora_report_producer_paced(retracesElapsed <= 1);
+        // Stamp the sealed frame's presentation schedule so Aurora paces interpolated slots against
+        // this same VI timeline. Anchor to the NEXT retrace boundary, not the period just produced,
+        // since slots anchored to the current period would already be expired by seal time. Encoding
+        // overruns are corrected by sliding the whole slot group forward onto a later boundary of this
+        // same grid, so this stays the single cadence authority. Anchors must also be strictly
+        // monotonic: two frames sealed before lastRetrace advances would collide on one boundary and
+        // burst-present, so a colliding anchor steps onto the next grid point instead of repeating it.
+        uint64_t anchorNanos = baseNanos + intervalNanos;
+        if (s_lastPresentAnchorNanos != 0 && anchorNanos <= s_lastPresentAnchorNanos) {
+            anchorNanos = s_lastPresentAnchorNanos + intervalNanos;
+        }
+        s_lastPresentAnchorNanos = anchorNanos;
+        aurora_set_present_schedule(anchorNanos, intervalNanos);
+    } else {
+        // Retrace-context presents (VI black, boot) have no display period of
+        // their own to subdivide; present as soon as the frame is ready. The
+        // schedule grid is gone, so the anchor cursor must not constrain the
+        // next paced frame.
+        s_lastPresentAnchorNanos = 0;
+        aurora_set_present_schedule(0, 0);
+    }
+
+    aurora_end_frame();
+    if (paceThisFrame) {
+        PaceToRetraceBoundary(paceDeadline);
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        s_lastPacedRetraceCount = g_vi.retraceCount;
+    }
+    settings_overlay::AdvancePresentedFrame();
+    g_auroraFrameActive.store(false, std::memory_order_release);
+    g_auroraFrameHadWork.store(false, std::memory_order_release);
+    if (presentedXfb) {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        g_vi.hasValidXfb = false;
+        g_vi.readyXfb = 0;
+    }
+    // Pre-warm the next frame so subsequent GX work has a valid frame context.
+    {
+        UpdateAuroraAndProcessEvents();
+        if (BeginAuroraFrame()) {
+            g_auroraFrameActive.store(true, std::memory_order_release);
+        }
+    }
+}
+
+// -----------------------------------------------------------------------------
+// VI_HLE_SetXfbReady - Called by GXCopyDisp to signal EFB->XFB copy completed.
+// This marks that we now have valid framebuffer data to present.
+// -----------------------------------------------------------------------------
+void VI_HLE_SetXfbReady(uint32_t xfbAddr) {
+    std::lock_guard<std::mutex> lock(g_viMutex);
+    g_vi.hasValidXfb = true;
+    g_vi.readyXfb = xfbAddr;
+    if (g_vi.currentFrameBuffer == 0 && g_vi.nextFrameBuffer == 0) {
+        g_vi.currentFrameBuffer = xfbAddr;
+        g_vi.nextFrameBuffer = xfbAddr;
+        g_vi.pendingNextFrameBuffer = xfbAddr;
+        WriteGuestStateLocked();
+    } else if (g_vi.nextFrameBuffer != xfbAddr) {
+        g_vi.nextFrameBuffer = xfbAddr;
+        g_vi.pendingNextFrameBuffer = xfbAddr;
+    }
+}
+
+// VIInit (0x801B94A4) and its lower-level helper __VIInit (0x801B9294) both
+// program MMIO at 0xCC0020xx on hardware. We skip all hardware access and seed
+// the same defaults instead, so the two entry points share one body.
+static void SeedViStateForInit(CpuContext* ctx, const char* who)
+{
+    RT_LOG(RT_TAG_VI) << who << " called: seeding VI state (HLE)" << std::endl;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+    }
+    ViSetR3(ctx, 0);
+}
+
+extern "C" void VIInit_HLE_801b94a4(CpuContext* ctx)
+{
+    SeedViStateForInit(ctx, "VIInit_801b94a4");
+}
+PPC_NATIVE_OVERRIDE_VOID(801B94A4, VIInit_HLE_801b94a4, (CpuContext* ctx), (ctx));
+
+extern "C" void __VIInit_HLE_801b9294(CpuContext* ctx)
+{
+    SeedViStateForInit(ctx, "__VIInit_801b9294");
+}
+PPC_NATIVE_OVERRIDE_VOID(801B9294, __VIInit_HLE_801b9294, (CpuContext* ctx), (ctx));
+
+// -----------------------------------------------------------------------------
+// Helper stubs referenced by VIInit switch cases (case D variants).
+// These are hardware-specific; treat as no-ops to keep control flow intact.
+// -----------------------------------------------------------------------------
+extern "C" void VIInit_caseD_0_HLE_801b9934(CpuContext* ctx)
+{
+    (void)ctx;
+    RT_LOG(RT_TAG_VI) << "VIInit_caseD_0_801b9934 stubbed" << std::endl;
+}
+PPC_NATIVE_OVERRIDE_VOID(801B9934, VIInit_caseD_0_HLE_801b9934, (CpuContext* ctx), (ctx));
+
+extern "C" void VIInit_caseD_1_HLE_801b993c(CpuContext* ctx)
+{
+    (void)ctx;
+    RT_LOG(RT_TAG_VI) << "VIInit_caseD_1_801b993c stubbed" << std::endl;
+}
+PPC_NATIVE_OVERRIDE_VOID(801B993C, VIInit_caseD_1_HLE_801b993c, (CpuContext* ctx), (ctx));
+
+extern "C" void VIInit_caseD_2_HLE_801b9944(CpuContext* ctx)
+{
+    (void)ctx;
+    RT_LOG(RT_TAG_VI) << "VIInit_caseD_2_801b9944 stubbed" << std::endl;
+}
+PPC_NATIVE_OVERRIDE_VOID(801B9944, VIInit_caseD_2_HLE_801b9944, (CpuContext* ctx), (ctx));
+
+// -----------------------------------------------------------------------------
+// VISetPreRetraceCallback (0x801B90F4)
+// -----------------------------------------------------------------------------
+extern "C" void VISetPreRetraceCallback_HLE_801b90f4(CpuContext* ctx)
+{
+    const uint32_t newCb = ctx ? ctx->gpr[3] : 0;
+    uint32_t prev = 0;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        prev = g_vi.preRetraceCallback;
+        g_vi.preRetraceCallback = newCb;
+        WriteGuestStateLocked();
+    }
+    ViSetR3(ctx, prev);
+}
+PPC_NATIVE_OVERRIDE_VOID(801B90F4, VISetPreRetraceCallback_HLE_801b90f4, (CpuContext* ctx), (ctx));
+
+// -----------------------------------------------------------------------------
+// VISetPostRetraceCallback (0x801B9138)
+// -----------------------------------------------------------------------------
+extern "C" void VISetPostRetraceCallback_HLE_801b9138(CpuContext* ctx)
+{
+    const uint32_t newCb = ctx ? ctx->gpr[3] : 0;
+    uint32_t prev = 0;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        prev = g_vi.postRetraceCallback;
+        g_vi.postRetraceCallback = newCb;
+        WriteGuestStateLocked();
+    }
+    ViSetR3(ctx, prev);
+}
+PPC_NATIVE_OVERRIDE_VOID(801B9138, VISetPostRetraceCallback_HLE_801b9138, (CpuContext* ctx), (ctx));
+
+// -----------------------------------------------------------------------------
+// VIGetDTVStatus (0x801BAD38)
+// Reads DTV status from VI hardware (MMIO 0xCC00206E). Stub to "not ready".
+// -----------------------------------------------------------------------------
+extern "C" void VIGetDTVStatus_HLE_801bad38(CpuContext* ctx)
+{
+    ViSetR3(ctx, 0); // return 0 -> not ready / disabled
+}
+PPC_NATIVE_OVERRIDE_VOID(801BAD38, VIGetDTVStatus_HLE_801bad38, (CpuContext* ctx), (ctx));
+
+// -----------------------------------------------------------------------------
+// VIConfigure & related helpers: translate GXRenderModeObj into guest globals.
+// -----------------------------------------------------------------------------
+extern "C" void VIConfigure_HLE_801b9f6c(CpuContext* ctx)
+{
+    // One read of the guest GXRenderModeObj serves both the VI pending state and
+    // aurora, rather than unpacking the same 0x39 bytes twice.
+    const uint32_t renderModePtr = ctx ? ctx->gpr[3] : 0;
+    GXRenderModeObj renderMode{};
+    if (!ReadGuestRenderModeObj(renderModePtr, renderMode)) {
+        RT_LOG(RT_TAG_VI) << "VIConfigure: invalid GXRenderModeObj pointer 0x"
+                  << std::hex << renderModePtr << std::dec << std::endl;
+        ViSetR3(ctx, 0);
+        return;
+    }
+
+    const uint32_t decodedTvFormat =
+        ExtractTvFormat(static_cast<uint32_t>(renderMode.viTVmode));
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+
+        // Write to PENDING state - will be committed on next retrace after VIFlush
+        g_vi.pendingTvFormat = decodedTvFormat;
+        g_vi.pendingRetraceInterval = IntervalForFormat(g_vi.pendingTvFormat);
+        g_vi.pendingRenderWidth =
+            renderMode.viWidth != 0 ? renderMode.viWidth : renderMode.fbWidth;
+        g_vi.pendingRenderHeight =
+            renderMode.viHeight != 0 ? renderMode.viHeight : renderMode.xfbHeight;
+        g_vi.pendingViXOrigin = renderMode.viXOrigin;
+        g_vi.pendingViYOrigin = renderMode.viYOrigin;
+        g_vi.pendingXfbWidth = renderMode.fbWidth;
+        g_vi.pendingXfbHeight =
+            renderMode.xfbHeight != 0 ? renderMode.xfbHeight : renderMode.efbHeight;
+    }
+
+    ::VIConfigure(&renderMode);
+
+    ViSetR3(ctx, 0);
+}
+PPC_NATIVE_OVERRIDE_VOID(801B9F6C, VIConfigure_HLE_801b9f6c, (CpuContext* ctx), (ctx));
+
+extern "C" void VIFlush_HLE_801ba9a4(CpuContext* ctx)
+{
+    uint32_t guestNextFb = 0;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+
+        if (g_vi.pendingNextFrameBuffer == 0) {
+            try {
+                guestNextFb = Memory::Read32(kViNextFrameBufferAddr);
+            } catch (const Memory::AccessViolation&) {
+                guestNextFb = 0;
+            }
+            if (guestNextFb == 0) {
+                try {
+                    guestNextFb = Memory::Read32(kViNextFrameBufferHwAddr);
+                } catch (const Memory::AccessViolation&) {
+                    guestNextFb = 0;
+                }
+            }
+            if (guestNextFb != 0) {
+                g_vi.pendingNextFrameBuffer = guestNextFb;
+            }
+        }
+        
+        // Arm only; the commit happens at the next retrace (see ViState).
+        g_vi.flushArmed = true;
+    }
+
+    // NOTE: We do NOT set hasValidXfb here. Frame readiness is signaled ONLY by
+    // GXCopyDisp (which sets hasValidXfb = true), as that's when the EFB->XFB
+    // copy is complete and we have a valid frame to present.
+
+    ViSetR3(ctx, 0);
+}
+PPC_NATIVE_OVERRIDE_VOID(801BA9A4, VIFlush_HLE_801ba9a4, (CpuContext* ctx), (ctx));
+
+extern "C" void VISetNextFrameBuffer_HLE_801baab8(CpuContext* ctx)
+{
+    const uint32_t fbPtr = ctx ? ctx->gpr[3] : 0;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        // Write to PENDING state - will be committed on next retrace after VIFlush
+        g_vi.pendingNextFrameBuffer = fbPtr;
+        // Also update guest memory for SDK code that reads this directly
+        WriteGuestStateLocked();
+    }
+    ViSetR3(ctx, 0);
+}
+PPC_NATIVE_OVERRIDE_VOID(801BAAB8, VISetNextFrameBuffer_HLE_801baab8, (CpuContext* ctx), (ctx));
+
+extern "C" void VIGetNextFrameBuffer_HLE_801bab24(CpuContext* ctx)
+{
+    uint32_t fb = 0;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        // Return PENDING value - what was set by VISetNextFrameBuffer
+        fb = g_vi.pendingNextFrameBuffer;
+    }
+    ViSetR3(ctx, fb);
+    VI_HLE_PollRetrace(ctx);
+}
+PPC_NATIVE_OVERRIDE_VOID(801BAB24, VIGetNextFrameBuffer_HLE_801bab24, (CpuContext* ctx), (ctx));
+
+extern "C" void VISetBlack_HLE_801bab2c(CpuContext* ctx)
+{
+    const bool makeBlack = ctx ? (ctx->gpr[3] != 0) : false;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        // Write to PENDING state - will be committed on next retrace after VIFlush
+        g_vi.pendingBlack = makeBlack;
+    }
+    ViSetR3(ctx, 0);
+}
+PPC_NATIVE_OVERRIDE_VOID(801BAB2C, VISetBlack_HLE_801bab2c, (CpuContext* ctx), (ctx));
+
+extern "C" void VIGetRetraceCount_HLE_801baba4(CpuContext* ctx)
+{
+    uint32_t count = 0;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        count = g_vi.retraceCount;
+    }
+    ViSetR3(ctx, count);
+    VI_HLE_PollRetrace(ctx);
+}
+PPC_NATIVE_OVERRIDE_VOID(801BABA4, VIGetRetraceCount_HLE_801baba4, (CpuContext* ctx), (ctx));
+
+extern "C" void VIGetNextField_HLE_801babac(CpuContext* ctx)
+{
+    bool fieldOdd = false;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        fieldOdd = g_vi.fieldOdd;
+    }
+    ViSetR3(ctx, fieldOdd ? 1 : 0);
+    VI_HLE_PollRetrace(ctx);
+}
+PPC_NATIVE_OVERRIDE_VOID(801BABAC, VIGetNextField_HLE_801babac, (CpuContext* ctx), (ctx));
+
+extern "C" void VIGetCurrentLine_HLE_801bac48(CpuContext* ctx)
+{
+    uint32_t height = 480;
+    std::chrono::microseconds interval{16666us};
+    Clock::time_point last;
+    {
+        std::lock_guard<std::mutex> lock(g_viMutex);
+        EnsureInitializedLocked();
+        height = g_vi.xfbHeight;
+        interval = g_vi.retraceInterval;
+        last = g_vi.lastRetrace;
+    }
+    const auto now = Clock::now();
+    const auto elapsed = std::chrono::duration_cast<std::chrono::microseconds>(now - last);
+    uint32_t line = 0;
+    if (interval.count() > 0 && height > 0) {
+        const uint64_t scaled = static_cast<uint64_t>(elapsed.count()) * height;
+        line = static_cast<uint32_t>(std::min<uint64_t>(height - 1, scaled / interval.count()));
+    }
+    ViSetR3(ctx, line);
+}
+PPC_NATIVE_OVERRIDE_VOID(801BAC48, VIGetCurrentLine_HLE_801bac48, (CpuContext* ctx), (ctx));
+
+extern "C" void VIWaitForRetrace_HLE_801b99ec(CpuContext* ctx)
+{
+    CpuContext* cpu = ctx ? ctx : &GetPersistentCpuContext();
+    
+    if (Fiber::GuestFiberManager::IsInitialized()) {
+        const int32_t irqState = OS__DisableInterrupts_801a65ac();
+        uint32_t retraceCount = 0;
+        {
+            std::lock_guard<std::mutex> lock(g_viMutex);
+            EnsureInitializedLocked();
+            retraceCount = g_vi.retraceCount;
+        }
+
+        do {
+            cpu->gpr[3] = kViRetraceQueueAddr;
+            OSSleepThread_HLE_801aa9b8(cpu);
+
+            {
+                std::lock_guard<std::mutex> lock(g_viMutex);
+                EnsureInitializedLocked();
+                if (g_vi.retraceCount != retraceCount) {
+                    break;
+                }
+            }
+        } while (true);
+
+        OS__RestoreInterrupts_801a65d4(irqState);
+    } else {
+        std::chrono::microseconds interval{16666us};
+        Clock::time_point target;
+        {
+            std::lock_guard<std::mutex> lock(g_viMutex);
+            EnsureInitializedLocked();
+            interval = g_vi.retraceInterval;
+            target = g_vi.lastRetrace + interval;
+        }
+
+        const auto now = Clock::now();
+        if (now < target) {
+            SleepPreciselyUntil(target, true);
+        }
+        AdvanceRetrace(cpu, target, true);
+    }
+    ViSetR3(cpu, 0);
+}
+PPC_NATIVE_OVERRIDE_VOID(801B99EC, VIWaitForRetrace_HLE_801b99ec, (CpuContext* ctx), (ctx));
diff --git a/runtime/src/host_cpu_baseline.cpp b/runtime/src/host_cpu_baseline.cpp
new file mode 100644
index 0000000..7271f7e
--- /dev/null
+++ b/runtime/src/host_cpu_baseline.cpp
@@ -0,0 +1,194 @@
+// Host ISA guard. Every other product target builds with -march=x86-64-v3, so a pre-Haswell
+// Intel or pre-Excavator AMD machine would otherwise die on an illegal-instruction fault with no
+// explanation. This TU alone skips that flag (own CMake object library, excluded from unity
+// build/PCH) and runs from a priority-101 C initializer, ahead of every C++ dynamic initializer
+// and thus the first AVX2 code that could execute. Keep it free of anything that could pull in
+// vectorized code: no iostreams, no std::string, no runtime-wide headers.
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+
+#include <cpuid.h>
+#include <windows.h>
+
+namespace {
+
+void HostCpuId(unsigned leaf, unsigned subleaf, unsigned regs[4]) {
+    unsigned eax = 0, ebx = 0, ecx = 0, edx = 0;
+    __cpuid_count(leaf, subleaf, eax, ebx, ecx, edx);
+    regs[0] = eax;
+    regs[1] = ebx;
+    regs[2] = ecx;
+    regs[3] = edx;
+}
+
+unsigned HostCpuIdMaxLeaf(unsigned base) {
+    unsigned regs[4] = {0, 0, 0, 0};
+    HostCpuId(base, 0, regs);
+    return regs[0];
+}
+
+// XGETBV through inline assembly rather than the _xgetbv intrinsic: the GNU
+// driver gates that intrinsic behind -mxsave, which this file is specifically
+// compiled without. Only reachable once CPUID has reported OSXSAVE.
+uint64_t ReadXcr0() {
+    unsigned eax = 0, edx = 0;
+    __asm__ __volatile__("xgetbv" : "=a"(eax), "=d"(edx) : "c"(0));
+    return (static_cast<uint64_t>(edx) << 32) | eax;
+}
+
+struct CpuFeature {
+    const char* name;
+    unsigned leaf;
+    unsigned subleaf;
+    unsigned reg;  // index into the eax/ebx/ecx/edx array filled by HostCpuId
+    unsigned bit;
+    bool isOsXsave;
+};
+
+// Everything x86-64-v3 implies, which includes all of x86-64-v2. Spelled out so
+// the error message can name the exact instruction sets the machine lacks
+// rather than only "AVX2", which is merely the best known member of the set.
+constexpr CpuFeature kRequiredFeatures[] = {
+    {"SSE3", 1, 0, 2, 0, false},
+    {"SSSE3", 1, 0, 2, 9, false},
+    {"FMA", 1, 0, 2, 12, false},
+    {"CMPXCHG16B", 1, 0, 2, 13, false},
+    {"SSE4.1", 1, 0, 2, 19, false},
+    {"SSE4.2", 1, 0, 2, 20, false},
+    {"MOVBE", 1, 0, 2, 22, false},
+    {"POPCNT", 1, 0, 2, 23, false},
+    {"OSXSAVE", 1, 0, 2, 27, true},
+    {"AVX", 1, 0, 2, 28, false},
+    {"F16C", 1, 0, 2, 29, false},
+    {"BMI1", 7, 0, 1, 3, false},
+    {"AVX2", 7, 0, 1, 5, false},
+    {"BMI2", 7, 0, 1, 8, false},
+    {"LAHF-SAHF", 0x80000001u, 0, 2, 0, false},
+    {"LZCNT", 0x80000001u, 0, 2, 5, false},
+};
+
+// Fixed-capacity text accumulation: no allocation, no exceptions, nothing that
+// could route through code this file is trying to stay ahead of.
+struct TextBuffer {
+    char data[1024] = {};
+    size_t used = 0;
+
+    void Append(const char* text) {
+        if (text == nullptr) {
+            return;
+        }
+        while (*text != '\0' && used + 1 < sizeof(data)) {
+            data[used++] = *text++;
+        }
+        data[used] = '\0';
+    }
+};
+
+// True when the host can run this build. Otherwise `missing` holds the absent
+// feature names, comma separated.
+bool CollectMissingBaselineFeatures(TextBuffer& missing) {
+    const unsigned maxBasic = HostCpuIdMaxLeaf(0);
+    const unsigned maxExtended = HostCpuIdMaxLeaf(0x80000000u);
+
+    bool ok = true;
+    bool haveOsXsave = false;
+
+    for (const CpuFeature& feature : kRequiredFeatures) {
+        const bool leafAvailable = (feature.leaf & 0x80000000u) != 0
+                                       ? feature.leaf <= maxExtended
+                                       : feature.leaf <= maxBasic;
+
+        bool present = false;
+        if (leafAvailable) {
+            unsigned regs[4] = {0, 0, 0, 0};
+            HostCpuId(feature.leaf, feature.subleaf, regs);
+            present = (regs[feature.reg] & (1u << feature.bit)) != 0;
+        }
+
+        if (present) {
+            haveOsXsave = haveOsXsave || feature.isOsXsave;
+            continue;
+        }
+
+        if (!ok) {
+            missing.Append(", ");
+        }
+        missing.Append(feature.name);
+        ok = false;
+    }
+
+    // CPUID reporting AVX is not sufficient: the OS also has to have enabled
+    // XMM and YMM state saving or every VEX-encoded instruction faults. This is
+    // the same guard a compiler's own runtime feature dispatch applies.
+    if (ok && haveOsXsave) {
+        constexpr uint64_t kXmmAndYmmState = 0x6u;
+        if ((ReadXcr0() & kXmmAndYmmState) != kXmmAndYmmState) {
+            missing.Append("operating system support for AVX register state (XCR0 YMM bits)");
+            ok = false;
+        }
+    }
+
+    return ok;
+}
+
+// stdio is NOT usable from a .CRT$XIC initializer - the UCRT has not stood it
+// up yet, and fprintf(stderr, ...) faults there. Verified on this toolchain:
+// WriteFile on the raw standard-error handle and MessageBoxA both work, printf
+// does not. Anything added to this reporting path has to respect that.
+void WriteStdErrEarly(const char* text) {
+    const HANDLE handle = ::GetStdHandle(STD_ERROR_HANDLE);
+    if (handle == nullptr || handle == INVALID_HANDLE_VALUE) {
+        return;
+    }
+    size_t length = 0;
+    while (text[length] != '\0') {
+        ++length;
+    }
+    DWORD written = 0;
+    ::WriteFile(handle, text, static_cast<DWORD>(length), &written, nullptr);
+}
+
+[[noreturn]] void ReportUnsupportedCpu(const char* missing) {
+    TextBuffer message;
+    message.Append(
+        "This build needs a processor that supports AVX2 and the rest of the "
+        "x86-64-v3 instruction set.\n\nMissing on this machine: ");
+    message.Append(missing);
+    message.Append(
+        "\n\nx86-64-v3 covers Intel Core processors from Haswell (4th "
+        "generation, 2013) onward and AMD processors from Excavator (2015) onward.");
+
+    // The tag matches RT_TAG_RUNTIME in runtime_log.h. It is spelled out here
+    // because this translation unit must not include runtime-wide headers (see
+    // the file comment): runtime_log.h pulls in <iostream> and memory.h, and
+    // this code runs before any C++ dynamic initializer.
+    WriteStdErrEarly("[runtime] ");
+    WriteStdErrEarly(message.data);
+    WriteStdErrEarly("\n");
+
+    ::MessageBoxA(nullptr, message.data, "WiiCompiled - Unsupported Processor",
+                  MB_OK | MB_ICONERROR | MB_SETFOREGROUND | MB_TASKMODAL);
+    // Leave through the OS rather than exit(): the C++ dynamic initializers
+    // have not run yet, so there is no constructed program state to unwind and
+    // the teardown path itself lives in AVX2 translation units.
+    ::ExitProcess(1u);
+}
+
+}  // namespace
+
+extern "C" int MkwHostCpuBaselineInit() {
+    TextBuffer missing;
+    if (!CollectMissingBaselineFeatures(missing)) {
+        ReportUnsupportedCpu(missing.data);
+    }
+    return 0;
+}
+
+// Priorities 0-100 are reserved for the implementation; 101 is the earliest a
+// user constructor can request, which puts this ahead of every default-priority
+// constructor in the image.
+__attribute__((constructor(101))) static void MkwHostCpuBaselineCtor() {
+    MkwHostCpuBaselineInit();
+}
diff --git a/runtime/src/main.cpp b/runtime/src/main.cpp
new file mode 100644
index 0000000..7050948
--- /dev/null
+++ b/runtime/src/main.cpp
@@ -0,0 +1,1333 @@
+#include <algorithm>
+#include <atomic>
+#include <cctype>
+#include <chrono>
+#include <csignal>
+#include <cstdio>
+#include <cstdlib>
+#include <cmath>
+#include <cstring>
+#include <exception>
+#include <filesystem>
+#include <fstream>
+#include <iomanip>
+#include <iostream>
+#include <array>
+#include <limits>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <thread>
+#include <mutex>
+#include <unordered_map>
+#include <vector>
+
+#if defined(_WIN32)
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <fcntl.h>
+#include <io.h>
+#include <crtdbg.h>
+#include <windows.h>
+#include <mmsystem.h>
+#include <dbghelp.h>
+#else
+#include <unistd.h>
+#endif
+
+#include "abi_bridge.h"
+#include "guest_flat_memory.h"
+#include "gx_guest_write.h"
+#include "memory.h"
+#include "system_bridge.h"
+#include "ppc_runtime.h"
+#include "aurora_events.h"
+#include "fiber_manager.h"
+#include "hle_stubs.h"
+#include "runtime_config.h"
+#include "runtime_log.h"
+#include "runtime_product.h"
+#include "recomp_mod_loader.h"
+#include <aurora/aurora.h>
+#include <aurora/gfx.h>
+#include <dolphin/gx/GXAurora.h>
+#include <dolphin/vi.h>
+
+// Defined in `runtime/src/hle/vi.cpp` (used by GX/VI HLE).
+extern std::atomic_bool g_auroraFrameActive;
+extern "C" int g_gxFrameCount;
+extern "C" const char* DVDResolveHostPathForTest(const char* dvdPath);
+bool OS_HLE_InterruptsEnabled() noexcept;
+
+namespace {
+
+// Defined below, beside the fatal-log machinery.
+std::string FormatHostStackTrace(unsigned framesToSkip = 0);
+
+void ServiceGuestTimingDuringAuroraFrameWait() {
+    // Aurora can block inside FIFO drains before control returns to GX HLE, for as long as a
+    // whole display period. Keep VI retraces, alarms and audio moving at wall-clock cadence here
+    // while still suppressing guest rescheduling and recursive Aurora work.
+    VI_HLE_ProcessRetracesDeferred(8);
+    OS_HLE_ProcessAlarmsDeferred(8);
+    Audio_HLE_PollDeferred();
+}
+
+#if defined(_WIN32)
+int __cdecl WindowsCrtReportHook(int reportType, char* message, int* returnValue) {
+    if (returnValue) {
+        *returnValue = 0;
+    }
+
+    RT_LOG(RT_TAG_RUNTIME) << "CRT report type=" << reportType;
+    if (message) {
+        std::cerr << ": " << message;
+    } else {
+        std::cerr << '\n';
+    }
+
+    RT_LOG(RT_TAG_RUNTIME) << "CRT report stack:\n" << FormatHostStackTrace(1);
+    std::cerr.flush();
+    return TRUE;
+}
+
+void ConfigureWindowsFatalDialogBehavior() {
+    ::SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX | SEM_NOOPENFILEERRORBOX);
+    _set_abort_behavior(0, _WRITE_ABORT_MSG | _CALL_REPORTFAULT);
+    _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_FILE);
+    _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
+    _CrtSetReportMode(_CRT_ERROR, _CRTDBG_MODE_FILE);
+    _CrtSetReportFile(_CRT_ERROR, _CRTDBG_FILE_STDERR);
+    _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_FILE);
+    _CrtSetReportFile(_CRT_ASSERT, _CRTDBG_FILE_STDERR);
+    _CrtSetReportHook(WindowsCrtReportHook);
+}
+
+class WindowsTimerResolutionGuard {
+public:
+    WindowsTimerResolutionGuard() {
+        const MMRESULT result = ::timeBeginPeriod(1);
+        if (result == TIMERR_NOERROR) {
+            armed_ = true;
+        } else {
+            RT_LOG(RT_TAG_RUNTIME) << "timeBeginPeriod(1) failed: " << result << std::endl;
+        }
+    }
+
+    ~WindowsTimerResolutionGuard() {
+        if (armed_) {
+            ::timeEndPeriod(1);
+        }
+    }
+
+    WindowsTimerResolutionGuard(const WindowsTimerResolutionGuard&) = delete;
+    WindowsTimerResolutionGuard& operator=(const WindowsTimerResolutionGuard&) = delete;
+
+private:
+    bool armed_ = false;
+};
+#endif
+} // namespace
+
+namespace {
+
+std::string g_lastEntryLabel;
+std::atomic_bool g_auroraInitialized{false};
+std::atomic_flag g_abortSignalHandled = ATOMIC_FLAG_INIT;
+std::atomic_bool g_fatalErrorReported{false};
+std::atomic_bool g_fatalPopupShown{false};
+std::atomic<int> g_lastExitCode{0};
+std::atomic_bool g_exitCodeSet{false};
+
+struct ProcessTranscriptState {
+    bool enabled = false;
+    std::filesystem::path path;
+    std::ofstream file;
+    std::mutex fileMutex;
+    std::atomic_bool initialized{false};
+    int savedStdoutFd = -1;
+    int savedStderrFd = -1;
+    int stdoutPipeReadFd = -1;
+    int stdoutPipeWriteFd = -1;
+    int stderrPipeReadFd = -1;
+    int stderrPipeWriteFd = -1;
+    std::thread stdoutThread;
+    std::thread stderrThread;
+};
+
+std::filesystem::path GetDefaultRuntimeLogDirectory() {
+    return RuntimeConfigFile::ApplicationDataDirectory() / "Logs";
+}
+
+// Every entry in the Logs root - both the per-run folders written by this
+// scheme and any flat .log files left over from the previous one - is removed
+// once it is older than the retention window.
+void PruneOldRunLogs(const std::filesystem::path& logRoot) {
+    constexpr auto kRetention = std::chrono::hours(24 * 4);
+
+    std::error_code ec;
+    const auto now = std::filesystem::file_time_type::clock::now();
+    for (const auto& entry : std::filesystem::directory_iterator(logRoot, ec)) {
+        std::error_code entryEc;
+        const auto writeTime = std::filesystem::last_write_time(entry.path(), entryEc);
+        if (entryEc) {
+            continue;
+        }
+        if (now - writeTime > kRetention) {
+            std::filesystem::remove_all(entry.path(), entryEc);
+        }
+    }
+}
+
+// Logs/<product>_<epochSeconds>_pid<pid>/ - one folder per run. The console
+// transcript and every crash artifact for the run land in here, so "zip this
+// folder" is a complete diagnostic. Created lazily so even a crash before
+// transcript setup still has somewhere to write.
+const std::filesystem::path& GetRunLogDirectory() {
+    static const std::filesystem::path runDirectory = [] {
+        const std::filesystem::path logRoot = GetDefaultRuntimeLogDirectory();
+
+        std::error_code ec;
+        std::filesystem::create_directories(logRoot, ec);
+        PruneOldRunLogs(logRoot);
+
+#if defined(_WIN32)
+        const unsigned long pid = ::GetCurrentProcessId();
+#else
+        const auto pid = static_cast<unsigned long>(::getpid());
+#endif
+        const auto now = std::chrono::system_clock::now();
+        const auto secs = std::chrono::duration_cast<std::chrono::seconds>(now.time_since_epoch()).count();
+
+        std::ostringstream name;
+        name << (RuntimeProduct::IsRetroRewind() ? "retro_rewind" : "base")
+             << "_" << secs << "_pid" << pid;
+        const std::filesystem::path directory = logRoot / name.str();
+        std::filesystem::create_directories(directory, ec);
+        return directory;
+    }();
+    return runDirectory;
+}
+
+ProcessTranscriptState& GetProcessTranscriptState() {
+    static ProcessTranscriptState state;
+    return state;
+}
+
+void WriteProcessTranscriptChunk(ProcessTranscriptState& state, const char* data, size_t size) {
+    if (!state.enabled || !state.file || size == 0) {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(state.fileMutex);
+    state.file.write(data, static_cast<std::streamsize>(size));
+    state.file.flush();
+}
+
+void PumpTranscriptPipe(ProcessTranscriptState& state, int readFd, int mirrorFd) {
+    std::array<char, 4096> buffer{};
+    for (;;) {
+#if defined(_WIN32)
+        const int bytesRead = _read(readFd, buffer.data(), static_cast<unsigned int>(buffer.size()));
+#else
+        const ssize_t bytesRead = ::read(readFd, buffer.data(), buffer.size());
+#endif
+        if (bytesRead <= 0) {
+            break;
+        }
+
+        if (mirrorFd >= 0) {
+            size_t offset = 0;
+            while (offset < static_cast<size_t>(bytesRead)) {
+#if defined(_WIN32)
+                const int written = _write(mirrorFd,
+                                           buffer.data() + offset,
+                                           static_cast<unsigned int>(static_cast<size_t>(bytesRead) - offset));
+#else
+                const ssize_t written = ::write(mirrorFd,
+                                                buffer.data() + offset,
+                                                static_cast<size_t>(bytesRead) - offset);
+#endif
+                if (written <= 0) {
+                    break;
+                }
+                offset += static_cast<size_t>(written);
+            }
+        }
+
+        WriteProcessTranscriptChunk(state, buffer.data(), static_cast<size_t>(bytesRead));
+    }
+}
+
+#if defined(_WIN32)
+int GetFileDescriptor(FILE* file) {
+    return _fileno(file);
+}
+
+int DuplicateFileDescriptor(int fd) {
+    return _dup(fd);
+}
+
+int DuplicateFileDescriptorTo(int sourceFd, int targetFd) {
+    return _dup2(sourceFd, targetFd);
+}
+
+void CloseFileDescriptor(int fd) {
+    _close(fd);
+}
+#else
+int GetFileDescriptor(FILE* file) {
+    return fileno(file);
+}
+
+int DuplicateFileDescriptor(int fd) {
+    return ::dup(fd);
+}
+
+int DuplicateFileDescriptorTo(int sourceFd, int targetFd) {
+    return ::dup2(sourceFd, targetFd);
+}
+
+void CloseFileDescriptor(int fd) {
+    ::close(fd);
+}
+#endif
+
+bool InstallTranscriptPipe(int& outReadFd, int& outWriteFd, int targetFd) {
+#if defined(_WIN32)
+    int pipeFds[2]{-1, -1};
+    if (_pipe(pipeFds, 8192, _O_BINARY) != 0) {
+        return false;
+    }
+#else
+    int pipeFds[2]{-1, -1};
+    if (::pipe(pipeFds) != 0) {
+        return false;
+    }
+#endif
+
+    outReadFd = pipeFds[0];
+    outWriteFd = pipeFds[1];
+    if (targetFd == GetFileDescriptor(stdout)) {
+        std::fflush(stdout);
+    } else if (targetFd == GetFileDescriptor(stderr)) {
+        std::fflush(stderr);
+    }
+
+    if (DuplicateFileDescriptorTo(outWriteFd, targetFd) < 0) {
+        CloseFileDescriptor(outReadFd);
+        CloseFileDescriptor(outWriteFd);
+        outReadFd = -1;
+        outWriteFd = -1;
+        return false;
+    }
+    return true;
+}
+
+#if defined(_WIN32)
+void AttachParentConsoleForDiagnostics() {
+    // GUI-subsystem products get no console and no bound stdout/stderr unless a parent already
+    // redirected them (pipe/file: leave alone) or has a console to attach to (bind only the
+    // streams still unbound). With no parent console, fall back to NUL rather than leaving
+    // _fileno(stdout) == -2, which would stop InitializeProcessTranscript from redirecting into
+    // the log file at all.
+    const HANDLE outHandle = ::GetStdHandle(STD_OUTPUT_HANDLE);
+    const HANDLE errHandle = ::GetStdHandle(STD_ERROR_HANDLE);
+    const bool haveOut = outHandle != nullptr && outHandle != INVALID_HANDLE_VALUE;
+    const bool haveErr = errHandle != nullptr && errHandle != INVALID_HANDLE_VALUE;
+    if (haveOut && haveErr) {
+        return;
+    }
+
+    const bool attached =
+        ::GetConsoleWindow() != nullptr || ::AttachConsole(ATTACH_PARENT_PROCESS) != 0;
+    const char* const sink = attached ? "CONOUT$" : "NUL";
+    if (!haveOut) {
+        (void)std::freopen(sink, "w", stdout);
+    }
+    if (!haveErr) {
+        (void)std::freopen(sink, "w", stderr);
+    }
+    std::cout.clear();
+    std::cerr.clear();
+}
+#else
+void AttachParentConsoleForDiagnostics() {}
+#endif
+
+// The setup writes build-fingerprint.json beside every product executable; its SetupVersion is
+// the only version identity the runtime has (products are compiled locally, so nothing is baked
+// into the binary). Surface it at the top of the transcript so every attached log self-identifies.
+std::string ReadInstalledSetupVersion() {
+    const auto directory = RuntimeConfigFile::ExecutableDirectory();
+    if (!directory) {
+        return {};
+    }
+    std::ifstream file(*directory / "build-fingerprint.json", std::ios::binary);
+    if (!file) {
+        return {};
+    }
+    const std::string text((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
+    constexpr std::string_view kKey = "\"SetupVersion\"";
+    const auto keyPos = text.find(kKey);
+    if (keyPos == std::string::npos) {
+        return {};
+    }
+    const auto colon = text.find(':', keyPos + kKey.size());
+    const auto open = colon == std::string::npos ? std::string::npos : text.find('"', colon + 1);
+    const auto close = open == std::string::npos ? std::string::npos : text.find('"', open + 1);
+    if (close == std::string::npos) {
+        return {};
+    }
+    return text.substr(open + 1, close - open - 1);
+}
+
+void InitializeProcessTranscript(int argc, char** argv) {
+    auto& state = GetProcessTranscriptState();
+    if (state.initialized.exchange(true, std::memory_order_acq_rel)) {
+        return;
+    }
+
+    const std::filesystem::path path = GetRunLogDirectory() / "console.log";
+    state.file.open(path.string(), std::ios::out | std::ios::trunc | std::ios::binary);
+    if (!state.file) {
+        return;
+    }
+
+    state.enabled = true;
+    state.path = path;
+
+#if defined(_WIN32)
+    const unsigned long pid = ::GetCurrentProcessId();
+#else
+    const auto pid = static_cast<unsigned long>(::getpid());
+#endif
+
+    const std::string setupVersion = ReadInstalledSetupVersion();
+
+    {
+        std::lock_guard<std::mutex> lock(state.fileMutex);
+        state.file << "[runtime] WiiCompiled "
+                   << (setupVersion.empty() ? "version unknown" : setupVersion) << "\n";
+        state.file << "[runtime] process transcript started\n";
+        state.file << "[runtime] pid=" << pid << "\n";
+        state.file << "[runtime] argv=";
+        for (int i = 0; i < argc; ++i) {
+            if (i != 0) {
+                state.file << ' ';
+            }
+            state.file << argv[i];
+        }
+        state.file << "\n";
+        state.file.flush();
+    }
+
+    state.savedStdoutFd = DuplicateFileDescriptor(GetFileDescriptor(stdout));
+    state.savedStderrFd = DuplicateFileDescriptor(GetFileDescriptor(stderr));
+
+    std::setvbuf(stdout, nullptr, _IONBF, 0);
+    std::setvbuf(stderr, nullptr, _IONBF, 0);
+
+    auto restoreFailedSetup = [&state]() {
+        if (state.savedStdoutFd >= 0) {
+            DuplicateFileDescriptorTo(state.savedStdoutFd, GetFileDescriptor(stdout));
+        }
+        if (state.savedStderrFd >= 0) {
+            DuplicateFileDescriptorTo(state.savedStderrFd, GetFileDescriptor(stderr));
+        }
+        if (state.stdoutPipeReadFd >= 0) {
+            CloseFileDescriptor(state.stdoutPipeReadFd);
+            state.stdoutPipeReadFd = -1;
+        }
+        if (state.stdoutPipeWriteFd >= 0) {
+            CloseFileDescriptor(state.stdoutPipeWriteFd);
+            state.stdoutPipeWriteFd = -1;
+        }
+        if (state.stderrPipeReadFd >= 0) {
+            CloseFileDescriptor(state.stderrPipeReadFd);
+            state.stderrPipeReadFd = -1;
+        }
+        if (state.stderrPipeWriteFd >= 0) {
+            CloseFileDescriptor(state.stderrPipeWriteFd);
+            state.stderrPipeWriteFd = -1;
+        }
+        if (state.savedStdoutFd >= 0) {
+            CloseFileDescriptor(state.savedStdoutFd);
+            state.savedStdoutFd = -1;
+        }
+        if (state.savedStderrFd >= 0) {
+            CloseFileDescriptor(state.savedStderrFd);
+            state.savedStderrFd = -1;
+        }
+        state.enabled = false;
+        state.file.close();
+    };
+
+    if (!InstallTranscriptPipe(state.stdoutPipeReadFd, state.stdoutPipeWriteFd, GetFileDescriptor(stdout)) ||
+        !InstallTranscriptPipe(state.stderrPipeReadFd, state.stderrPipeWriteFd, GetFileDescriptor(stderr))) {
+        restoreFailedSetup();
+        return;
+    }
+
+    state.stdoutThread = std::thread([&state]() {
+        PumpTranscriptPipe(state, state.stdoutPipeReadFd, state.savedStdoutFd);
+    });
+    state.stderrThread = std::thread([&state]() {
+        PumpTranscriptPipe(state, state.stderrPipeReadFd, state.savedStderrFd);
+    });
+}
+
+void ShutdownProcessTranscript() {
+    auto& state = GetProcessTranscriptState();
+    if (!state.enabled) {
+        return;
+    }
+
+    std::fflush(stdout);
+    std::fflush(stderr);
+    std::cout.flush();
+    std::cerr.flush();
+
+    if (state.savedStdoutFd >= 0) {
+        DuplicateFileDescriptorTo(state.savedStdoutFd, GetFileDescriptor(stdout));
+    }
+    if (state.savedStderrFd >= 0) {
+        DuplicateFileDescriptorTo(state.savedStderrFd, GetFileDescriptor(stderr));
+    }
+
+    if (state.stdoutPipeWriteFd >= 0) {
+        CloseFileDescriptor(state.stdoutPipeWriteFd);
+        state.stdoutPipeWriteFd = -1;
+    }
+    if (state.stderrPipeWriteFd >= 0) {
+        CloseFileDescriptor(state.stderrPipeWriteFd);
+        state.stderrPipeWriteFd = -1;
+    }
+
+    if (state.stdoutThread.joinable()) {
+        state.stdoutThread.join();
+    }
+    if (state.stderrThread.joinable()) {
+        state.stderrThread.join();
+    }
+
+    if (state.stdoutPipeReadFd >= 0) {
+        CloseFileDescriptor(state.stdoutPipeReadFd);
+        state.stdoutPipeReadFd = -1;
+    }
+    if (state.stderrPipeReadFd >= 0) {
+        CloseFileDescriptor(state.stderrPipeReadFd);
+        state.stderrPipeReadFd = -1;
+    }
+    if (state.savedStdoutFd >= 0) {
+        CloseFileDescriptor(state.savedStdoutFd);
+        state.savedStdoutFd = -1;
+    }
+    if (state.savedStderrFd >= 0) {
+        CloseFileDescriptor(state.savedStderrFd);
+        state.savedStderrFd = -1;
+    }
+
+    {
+        std::lock_guard<std::mutex> lock(state.fileMutex);
+        state.file << "\n[runtime] process transcript ended\n";
+        state.file.flush();
+    }
+    state.file.close();
+    state.enabled = false;
+}
+
+// The one host stack walker. Every caller - the CRT report hook, the fatal log
+// and the stderr crash dump - goes through this, so the log and the console see
+// exactly the same frames, including the TranslatedFunctionRegistry fallback for
+// addresses DbgHelp cannot name.
+std::string FormatHostStackTrace(unsigned framesToSkip) {
+#if defined(_WIN32)
+    static std::atomic_bool s_symbolsReady{false};
+    HANDLE process = GetCurrentProcess();
+    if (!s_symbolsReady.load(std::memory_order_acquire)) {
+        SymSetOptions(SYMOPT_UNDNAME | SYMOPT_DEFERRED_LOADS | SYMOPT_LOAD_LINES);
+        if (SymInitialize(process, nullptr, TRUE)) {
+            s_symbolsReady.store(true, std::memory_order_release);
+        }
+    }
+    const bool symbolsReady = s_symbolsReady.load(std::memory_order_acquire);
+
+    void* frames[64]{};
+    const USHORT captured = CaptureStackBackTrace(static_cast<DWORD>(framesToSkip),
+                                                  static_cast<DWORD>(std::size(frames)), frames, nullptr);
+    std::ostringstream out;
+    if (captured == 0) {
+        out << "[runtime] host stack trace unavailable (CaptureStackBackTrace returned 0)\n";
+        return out.str();
+    }
+    out << "[runtime] host stack trace (most recent call first):\n";
+    for (USHORT i = 0; i < captured; ++i) {
+        const DWORD64 addr = reinterpret_cast<DWORD64>(frames[i]);
+        HMODULE module = nullptr;
+        char modulePath[MAX_PATH] = "?";
+        DWORD64 moduleBase = 0;
+        if (GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
+                               reinterpret_cast<LPCSTR>(frames[i]),
+                               &module) != 0 &&
+            module != nullptr) {
+            moduleBase = reinterpret_cast<DWORD64>(module);
+            (void)GetModuleFileNameA(module, modulePath, MAX_PATH);
+        }
+
+        const char* symbolName = "?";
+        std::string translatedFuncName;
+        uint32_t ppcAddress = 0;
+        DWORD64 symbolDisp = 0;
+        std::array<char, sizeof(SYMBOL_INFO) + MAX_SYM_NAME> symbolBuffer{};
+        auto* symbol = reinterpret_cast<SYMBOL_INFO*>(symbolBuffer.data());
+        symbol->SizeOfStruct = sizeof(SYMBOL_INFO);
+        symbol->MaxNameLen = MAX_SYM_NAME;
+        if (symbolsReady && SymFromAddr(process, addr, &symbolDisp, symbol)) {
+            symbolName = symbol->Name;
+        } else if (auto info = TranslatedFunctionRegistry::FindByHostAddress(static_cast<uintptr_t>(addr))) {
+            // DbgHelp could not name it; the translated-function registry can.
+            translatedFuncName = info->name;
+            ppcAddress = info->address;
+            if (!translatedFuncName.empty()) {
+                symbolName = translatedFuncName.c_str();
+                symbolDisp = addr - reinterpret_cast<DWORD64>(info->entryPoint);
+            }
+        }
+
+        IMAGEHLP_LINE64 line{};
+        line.SizeOfStruct = sizeof(line);
+        DWORD lineDisp = 0;
+        const char* fileName = nullptr;
+        DWORD lineNumber = 0;
+        if (symbolsReady && SymGetLineFromAddr64(process, addr, &lineDisp, &line)) {
+            fileName = line.FileName;
+            lineNumber = line.LineNumber;
+        }
+
+        out << "  ["
+            << std::setw(2) << std::setfill('0') << static_cast<unsigned>(i)
+            << std::setfill(' ') << "] "
+            << modulePath << "!" << symbolName
+            << " + 0x" << std::hex << std::uppercase << symbolDisp
+            << " (0x" << addr;
+        if (moduleBase != 0) {
+            out << ", module+0x" << (addr - moduleBase);
+        }
+        if (ppcAddress != 0) {
+            out << ", PPC:0x" << std::setw(8) << std::setfill('0') << ppcAddress << std::setfill(' ');
+        }
+        out << std::dec << std::nouppercase;
+        if (fileName) {
+            out << ", " << fileName << ":" << lineNumber;
+        }
+        out << ")\n";
+    }
+    return out.str();
+#else
+    (void)framesToSkip;
+    return {};
+#endif
+}
+
+void WriteFatalLogImpl(std::string_view reason, std::string_view extraDetails = {},
+                       const uint32_t* missingGuestTarget = nullptr) {
+    const std::filesystem::path runDirectory = GetRunLogDirectory();
+    std::string fileName = "crash_";
+    fileName.append(reason);
+    fileName.append(".txt");
+    std::ofstream out((runDirectory / fileName).string(), std::ios::out | std::ios::trunc);
+    if (!out) {
+        return;
+    }
+
+    const auto now = std::chrono::system_clock::now();
+    const auto nowSecs = std::chrono::duration_cast<std::chrono::seconds>(now.time_since_epoch()).count();
+
+    out << "[runtime] fatal log" << std::endl;
+    out << "[runtime] reason: " << reason << std::endl;
+    out << "[runtime] timestamp(seconds): " << nowSecs << std::endl;
+    out << "[runtime] entry: " << (g_lastEntryLabel.empty() ? "<unknown>" : g_lastEntryLabel) << std::endl;
+    if (!extraDetails.empty()) {
+        out << "[runtime] details: " << extraDetails << std::endl;
+    }
+    if (missingGuestTarget) {
+        out << "[runtime] guest jump target: 0x" << std::hex << std::uppercase
+            << *missingGuestTarget << std::dec << std::endl;
+    }
+
+    const CpuContext* cpu = TryGetCpuContext();
+    if (!cpu) {
+        // Exceptions can unwind CpuContextScope before we get here.
+        // Fall back to the persistent CPU context snapshot so fatal logs still include registers.
+        cpu = &GetPersistentCpuContext();
+    }
+    if (cpu) {
+        SystemBridge::DumpCrashHeuristics(out, cpu, missingGuestTarget);
+        SystemBridge::DumpCpuState(out, cpu);
+    } else {
+        out << "[runtime] CPU context unavailable." << std::endl;
+    }
+
+    // Guest memory snapshots so the heap/object state can be walked offline.
+    // Written once per process: several fatal paths can fire in sequence
+    // (e.g. an exception followed by the exit-code report) and the snapshots
+    // are large.
+    static std::atomic_bool s_memorySnapshotWritten{false};
+    if (!s_memorySnapshotWritten.exchange(true, std::memory_order_acq_rel)) {
+        SystemBridge::WriteGuestMemorySnapshot(out, (runDirectory / "mem1.bin").string().c_str());
+    }
+
+    out.flush();
+    RT_LOG(RT_TAG_RUNTIME) << "crash artifacts written to " << runDirectory.string() << std::endl;
+}
+
+void SetRuntimeExitCodeImpl(int code) {
+    g_lastExitCode.store(code, std::memory_order_relaxed);
+    g_exitCodeSet.store(true, std::memory_order_relaxed);
+}
+
+} // namespace
+
+namespace {
+
+void DumpHostStackTrace() {
+#if defined(_WIN32)
+    static std::atomic_flag s_inProgress = ATOMIC_FLAG_INIT;
+    if (s_inProgress.test_and_set()) {
+        return;
+    }
+    const std::string trace = FormatHostStackTrace(1);
+    std::fputs(trace.c_str(), stderr);
+    std::fflush(stderr);
+    s_inProgress.clear();
+#else
+    RT_LOGF(RT_TAG_RUNTIME, "Host stack trace unavailable on this platform\n");
+    std::fflush(stderr);
+#endif
+}
+
+} // namespace
+
+extern "C" void DumpHostStackTraceForRuntimeHelper() {
+    DumpHostStackTrace();
+}
+
+void MarkFatalErrorReported() {
+    g_fatalErrorReported.store(true, std::memory_order_release);
+}
+
+void ShowRuntimeFatalPopup(std::string_view category, std::string_view details) noexcept {
+    if (g_fatalPopupShown.exchange(true, std::memory_order_acq_rel)) {
+        return;
+    }
+
+    try {
+        std::string message;
+        message.reserve(category.size() + details.size() + 220);
+        message.append("The game stopped because ");
+        message.append(category.empty() ? "a fatal error occurred." : category);
+        message.append(".\n\n");
+        if (details.empty()) {
+            message.append("No additional details were available.");
+        } else {
+            constexpr size_t kMaxPopupDetails = 4096;
+            message.append(details.data(), std::min(details.size(), kMaxPopupDetails));
+            if (details.size() > kMaxPopupDetails) {
+                message.append("\n\n[Additional details were written to the crash log.]");
+            }
+        }
+        message.append("\n\nSee the WiiCompiled Logs folder for the full diagnostic.");
+#if defined(_WIN32)
+        ::MessageBoxA(nullptr, message.c_str(), "WiiCompiled - Fatal Error",
+                      MB_OK | MB_ICONERROR | MB_SETFOREGROUND | MB_TASKMODAL);
+#else
+        // The shipped product is Windows-first. Keep non-Windows builds safe
+        // and retain the console diagnostic when no native dialog is available.
+        RT_LOGF(RT_TAG_RUNTIME, "fatal dialog: %s\n", message.c_str());
+#endif
+    } catch (...) {
+        // Reporting a crash must never throw or mask the original failure.
+    }
+}
+
+namespace RuntimeCrash {
+
+void WriteCrashArtifacts(std::string_view reason, std::string_view extraDetails,
+                         const uint32_t* missingGuestTarget) noexcept {
+    try {
+        WriteFatalLogImpl(reason, extraDetails, missingGuestTarget);
+    } catch (...) {
+        // Crash reporting must never mask the original failure.
+    }
+}
+
+[[noreturn]] void FatalMissingGuestTarget(uint32_t target, CpuContext* cpu) noexcept {
+    RT_LOG(RT_TAG_RUNTIME) << "InvokeIndirectCpu: target 0x" << std::hex << target
+              << " not translated (missing function)" << std::dec << std::endl;
+    RT_LOG(RT_TAG_RUNTIME) << "Caller LR = 0x" << std::hex << (cpu ? cpu->lr : 0u)
+              << std::dec << std::endl;
+    try {
+        SystemBridge::DumpCrashHeuristics(std::cerr, cpu, &target);
+        SystemBridge::DumpCpuState(cpu);
+    } catch (...) {
+    }
+    std::fflush(stderr);
+
+    std::ostringstream message;
+    message << "The game stopped because it tried to execute guest address 0x"
+            << std::hex << target
+            << ", but that function was not translated or registered.\n\n"
+            << "Caller LR: 0x" << (cpu ? cpu->lr : 0u);
+    if (target == 0) {
+        message << "\n\nA jump to address 0 usually means a virtual call through a bad "
+                   "object pointer; the crash log heuristics have details.";
+    }
+    WriteCrashArtifacts("missing_target", message.str(), &target);
+    ShowRuntimeFatalPopup("Missing translated function", message.str());
+    MarkFatalErrorReported();
+    std::exit(EXIT_FAILURE);
+}
+
+} // namespace RuntimeCrash
+
+
+namespace {
+
+void RuntimeAuroraLogCallback(AuroraLogLevel level, const char* module,
+                              const char* message, unsigned int len) {
+    const std::string_view moduleView = module != nullptr ? std::string_view(module) : std::string_view{};
+    const std::string_view messageView = message != nullptr ? std::string_view(message, len) : std::string_view{};
+    std::cerr << "[aurora] [" << static_cast<int>(level) << "] [" << moduleView << "] "
+              << messageView << std::endl;
+    if (level == LOG_FATAL) {
+        ShowRuntimeFatalPopup("Aurora reported a fatal renderer error", messageView);
+    }
+}
+
+const TranslatedFunctionInfo* ResolveEntry() {
+    const auto* entry = TranslatedFunctionRegistry::FindByAddressPtr(kDefaultEntryAddress);
+    if (!entry) {
+        std::ostringstream oss;
+        oss << "No translated function registered at address 0x" << std::hex << kDefaultEntryAddress;
+        throw std::runtime_error(oss.str());
+    }
+    return entry;
+}
+
+void SeedCpuContext(CpuContext& cpu) {
+    cpu.gpr[1] = 0x81700000u;
+}
+
+void DumpAccessViolationReport(const Memory::AccessViolation& ex,
+                               std::string_view entryLabel) {
+    const uint32_t address = ex.address();
+    const size_t length = ex.length();
+    const CpuContext* cpu = TryGetCpuContext();
+
+    RT_LOG(RT_TAG_RUNTIME) << "===== Memory Access Violation =====" << std::endl;
+    RT_LOG(RT_TAG_RUNTIME) << "Reason : " << ex.reason() << std::endl;
+    std::cerr << std::hex << std::uppercase;
+    RT_LOG(RT_TAG_RUNTIME) << "Address: 0x" << std::setw(8) << std::setfill('0') << address
+              << " (+0x" << length << ")" << std::dec << std::setfill(' ') << std::endl;
+    RT_LOG(RT_TAG_RUNTIME) << "Entry  : " << (entryLabel.empty() ? "(unknown)" : std::string(entryLabel)) << std::endl;
+    RT_LOG(RT_TAG_RUNTIME) << "Mode   : strict (trap on unmapped)" << std::endl;
+    RT_LOG(RT_TAG_RUNTIME) << "r1 seed: 0x81700000" << std::endl;
+    if (cpu) {
+        RT_LOG(RT_TAG_RUNTIME) << "CurrentCpuContext: " << cpu << "  r1=0x"
+                  << std::hex << std::uppercase << cpu->gpr[1] << std::dec << std::nouppercase << std::endl;
+        RT_LOG(RT_TAG_RUNTIME) << "Last recorded PC : 0x" << std::hex << std::uppercase << cpu->pc
+                  << std::dec << std::nouppercase << std::endl;
+    } else {
+        RT_LOG(RT_TAG_RUNTIME) << "CurrentCpuContext: (null)" << std::endl;
+    }
+
+    SystemBridge::DumpCpuState(cpu);
+
+    const auto regions = Memory::DescribeRegions();
+    if (regions.empty()) {
+        RT_LOG(RT_TAG_RUNTIME) << "Memory not initialized; no regions mapped." << std::endl;
+        return;
+    }
+
+    RT_LOG(RT_TAG_RUNTIME) << "Mapped regions:" << std::endl;
+    uint64_t bestDistance = std::numeric_limits<uint64_t>::max();
+    std::string bestRegion;
+    bool insideRegion = false;
+
+    for (const auto& region : regions) {
+        const uint64_t base = region.baseAddress;
+        const uint64_t end = base + region.sizeBytes;
+        const bool contains = address >= base && address < end;
+        if (contains) {
+            insideRegion = true;
+            bestDistance = 0;
+            bestRegion = region.name;
+        } else {
+            const uint64_t distance = address < base ? base - address : address - end + 1;
+            if (distance < bestDistance) {
+                bestDistance = distance;
+                bestRegion = region.name;
+            }
+        }
+
+        std::cerr << "  - " << region.name
+                  << " 0x" << std::hex << std::setw(8) << std::setfill('0') << region.baseAddress
+                  << " .. 0x" << std::setw(8) << (end - 1)
+                  << std::dec << std::setfill(' ')
+                  << " (" << region.sizeBytes / 1024 << " KiB";
+        if (contains) {
+            std::cerr << ", <-- access landed here";
+        }
+        std::cerr << ")" << std::endl;
+    }
+
+    if (!bestRegion.empty() && !insideRegion) {
+        RT_LOG(RT_TAG_RUNTIME) << "Nearest region: " << bestRegion << " (" << bestDistance << " bytes away)" << std::endl;
+    }
+
+    RT_LOG(RT_TAG_RUNTIME) << "Verify that the installed game data and runtime build match." << std::endl;
+}
+
+#if defined(_WIN32)
+PVOID g_vectoredSehHandle = nullptr;
+constexpr DWORD kCppExceptionCodeGcc = 0x20474343; // "GCC" exception code
+constexpr DWORD kCppExceptionCodeMsvc = 0xE06D7363;
+// AddressSanitizer uses STATUS_FATAL_APP_EXIT when it detects an error and wants to report it.
+// We must let ASan's handler run so it can print file/line information.
+constexpr DWORD kAsanFatalAppExit = 0x40000015; // STATUS_FATAL_APP_EXIT
+
+void ReportStructuredException(EXCEPTION_POINTERS* info) {
+    if (!info || !info->ExceptionRecord) {
+        RT_LOG(RT_TAG_RUNTIME) << "Structured exception occurred, but no diagnostic info was captured." << std::endl;
+        return;
+    }
+
+    const auto* record = info->ExceptionRecord;
+    const auto code = record->ExceptionCode;
+    std::cerr << std::hex << std::uppercase;
+    RT_LOG(RT_TAG_RUNTIME) << "Structured exception 0x" << code;
+    if (!g_lastEntryLabel.empty()) {
+        std::cerr << " while executing " << g_lastEntryLabel;
+    }
+    std::cerr << std::dec << std::nouppercase << std::endl;
+
+    const auto faultAddress = reinterpret_cast<uintptr_t>(record->ExceptionAddress);
+    std::cerr << std::hex << std::uppercase;
+    RT_LOG(RT_TAG_RUNTIME) << "Fault address: 0x" << faultAddress << std::dec << std::nouppercase << std::endl;
+
+    if (code == EXCEPTION_ACCESS_VIOLATION && record->NumberParameters >= 2) {
+        const auto accessType = record->ExceptionInformation[0];
+        const auto accessed = record->ExceptionInformation[1];
+        RT_LOG(RT_TAG_RUNTIME) << "Access type: " << (accessType ? "write" : "read")
+                  << " at 0x" << std::hex << std::uppercase << accessed << std::dec << std::nouppercase << std::endl;
+
+        // Guardrail: flag raw GX gather pipe touches (0xCC00_8xxx) which must be routed through HLE.
+        // Direct stores to this MMIO region (e.g., translated stfs/stb -0x8000(r4) with r4=0xCC010000)
+        // will fault on the host. Emit an explicit hint so we know to fix the translation/HLE path instead
+        // of chasing generic access violations.
+        constexpr uintptr_t kGxGatherLo = 0xCC008000;
+        constexpr uintptr_t kGxGatherHi = 0xCC009000; // one page past the 0x100-byte gather range for clarity
+        if (accessed >= kGxGatherLo && accessed < kGxGatherHi) {
+            RT_LOG(RT_TAG_RUNTIME) << "HINT: guest attempted a direct GX gather pipe write (0xCC00_8xxx)." << std::endl;
+            RT_LOG(RT_TAG_RUNTIME) << "      These must go through GX_HLE_FIFO_Write*; check the translated function for" << std::endl;
+            RT_LOG(RT_TAG_RUNTIME) << "      literal stores to -0x8000(r4) after lis r4,0xCC01 and route them via HLE." << std::endl;
+        }
+    }
+
+#if defined(_M_X64) || defined(__x86_64__)
+    const auto rip = info->ContextRecord ? info->ContextRecord->Rip : 0;
+    const auto rsp = info->ContextRecord ? info->ContextRecord->Rsp : 0;
+    std::cerr << std::hex << std::uppercase;
+    RT_LOG(RT_TAG_RUNTIME) << "RIP=0x" << rip << " RSP=0x" << rsp << std::dec << std::nouppercase << std::endl;
+#elif defined(_M_IX86)
+    const auto eip = info->ContextRecord ? info->ContextRecord->Eip : 0;
+    const auto esp = info->ContextRecord ? info->ContextRecord->Esp : 0;
+    std::cerr << std::hex << std::uppercase;
+    RT_LOG(RT_TAG_RUNTIME) << "EIP=0x" << eip << " ESP=0x" << esp << std::dec << std::nouppercase << std::endl;
+#endif
+
+    // Always dump CPU state on crash.
+    RT_LOG(RT_TAG_RUNTIME) << "===== DUMPING CPU STATE =====" << std::endl;
+    SystemBridge::DumpCpuState(TryGetCpuContext());
+    std::cerr.flush();
+
+    RT_LOG(RT_TAG_RUNTIME) << "Enable /DEBUG builds or capture a dump for full stack details." << std::endl;
+    std::cerr.flush();
+}
+
+
+
+LONG CALLBACK SehLogger(EXCEPTION_POINTERS* info) {
+    // Guest-space faults are the flat memory interception mechanism (MMIO,
+    // deferred EFB reads, the executable-write guard, unmapped pages). The
+    // flat module registers its own handler first, but registration order is
+    // not guaranteed once another VEH is installed later, so consult it here
+    // too - resolving a fault twice is a no-op.
+    if (GuestFlat::HandleAccessViolation(info)) {
+        return EXCEPTION_CONTINUE_EXECUTION;
+    }
+    if (g_suppressSehReporting && g_sehJumpTarget) {
+        g_sehLastExceptionCode = info->ExceptionRecord->ExceptionCode;
+        g_sehLastExceptionAddress = reinterpret_cast<uintptr_t>(info->ExceptionRecord->ExceptionAddress);
+        g_sehLastAccessType = 0;
+        g_sehLastAccessedAddress = 0;
+        if (g_sehLastExceptionCode == EXCEPTION_ACCESS_VIOLATION && info->ExceptionRecord->NumberParameters >= 2) {
+            g_sehLastAccessType = static_cast<uint32_t>(info->ExceptionRecord->ExceptionInformation[0]);
+            g_sehLastAccessedAddress = static_cast<uintptr_t>(info->ExceptionRecord->ExceptionInformation[1]);
+        }
+        longjmp(*g_sehJumpTarget, 1);
+    }
+    if (g_suppressSehReporting) {
+        return EXCEPTION_CONTINUE_SEARCH;
+    }
+    // Let C++ exceptions propagate to std::terminate so we can log their what().
+    if (info->ExceptionRecord->ExceptionCode == kCppExceptionCodeGcc ||
+        info->ExceptionRecord->ExceptionCode == kCppExceptionCodeMsvc) {
+        return EXCEPTION_CONTINUE_SEARCH;
+    }
+    if (info->ExceptionRecord->ExceptionCode == 0x40010006 || // DBG_PRINTEXCEPTION_C
+        info->ExceptionRecord->ExceptionCode == 0x4001000A || // DBG_PRINTEXCEPTION_WIDE_C (OutputDebugStringW)
+        info->ExceptionRecord->ExceptionCode == 0x406D1388 || // SetThreadName
+        info->ExceptionRecord->ExceptionCode == kAsanFatalAppExit) { // ASan reporting - let it print first
+        return EXCEPTION_CONTINUE_SEARCH;
+    }
+    
+    // Guard against re-entrancy: if we crash while reporting, don't recurse
+    static std::atomic_flag s_inCrashHandler = ATOMIC_FLAG_INIT;
+    if (s_inCrashHandler.test_and_set()) {
+        std::_Exit(EXIT_FAILURE);
+    }
+    
+    // Report the structured exception with detailed information
+    ReportStructuredException(info);
+    const auto* record = info->ExceptionRecord;
+    const DWORD code = record != nullptr ? record->ExceptionCode : 0;
+    std::ostringstream popupDetails;
+    popupDetails << "A native Windows exception (0x" << std::hex << std::uppercase << code << ") occurred";
+    if (!g_lastEntryLabel.empty()) {
+        popupDetails << " while executing " << g_lastEntryLabel;
+    }
+    if (code == EXCEPTION_ACCESS_VIOLATION && record->NumberParameters >= 2) {
+        popupDetails << ".\n\nThe game attempted a "
+                     << (record->ExceptionInformation[0] ? "write" : "read")
+                     << " at host address 0x" << record->ExceptionInformation[1];
+    }
+    popupDetails << ".\n\nThe process transcript and crash log contain the full CPU and stack diagnostics.";
+    ShowRuntimeFatalPopup("a native crash occurred", popupDetails.str());
+    DumpHostStackTrace();
+
+    WriteFatalLogImpl("seh");
+    
+    // CRITICAL: Explicitly flush all output to ensure visibility with PowerShell redirection
+    std::cerr << '\n';
+    RT_LOG(RT_TAG_RUNTIME) << "===== FLUSHING OUTPUT BEFORE EXIT =====" << std::endl;
+    std::cerr.flush();
+    std::cout.flush();
+    std::fflush(stdout);
+    std::fflush(stderr);
+    
+    std::_Exit(EXIT_FAILURE);
+}
+
+void InstallSehLogger() {
+    if (!g_vectoredSehHandle) {
+        g_vectoredSehHandle = AddVectoredExceptionHandler(1, SehLogger);
+    }
+}
+#endif
+
+void AbortSignalHandler(int signum) {
+    // Guard against re-entrancy if multiple aborts are raised in quick succession
+    if (g_abortSignalHandled.test_and_set()) {
+        std::_Exit(EXIT_FAILURE);
+    }
+
+    // abort() bypasses atexit, so the guest-memory fault summary has to be
+    // emitted here too. It is idempotent, so a later AtExitHandler is a no-op.
+    GuestFlat::LogFaultSummary();
+
+    ShowRuntimeFatalPopup("a fatal internal error occurred",
+                          "The process called abort while running the game or Aurora renderer.\n\n"
+                          "This usually means an unimplemented function, failed renderer assertion, "
+                          "or another unrecoverable runtime condition was reached.");
+
+    // Skip detailed dump if already reported by another handler
+    if (g_fatalErrorReported.load(std::memory_order_acquire)) {
+        std::fflush(stderr);
+        std::fflush(stdout);
+        std::_Exit(EXIT_FAILURE);
+    }
+
+    WriteFatalLogImpl("sigabrt");
+
+    std::fflush(stderr);
+    std::fflush(stdout);
+    std::_Exit(EXIT_FAILURE);
+}
+
+} // namespace
+
+// Retained as the thin public wrapper over WriteFatalLogImpl (declared in
+// system_bridge.h); it has no in-tree callers because every fatal path now goes
+// through RuntimeCrash::WriteCrashArtifacts.
+void WriteFatalLog(std::string_view reason) {
+    WriteFatalLogImpl(reason);
+}
+
+void SetRuntimeExitCode(int code) {
+    SetRuntimeExitCodeImpl(code);
+}
+
+// Global handler called via atexit() to flush buffers before any exit
+static void AtExitHandler() {
+    // End-of-run guest memory report. This runs before the fatal-report check
+    // below because the counters describe the whole session and are just as
+    // interesting after a crash as after a clean exit.
+    GuestFlat::LogFaultSummary();
+
+    // Skip if already reported by another handler
+    if (g_fatalErrorReported.load(std::memory_order_acquire)) {
+        return;
+    }
+    if (g_exitCodeSet.load(std::memory_order_relaxed) &&
+        g_lastExitCode.load(std::memory_order_relaxed) != 0) {
+        ShowRuntimeFatalPopup("the runtime exited with an error",
+                              "The game stopped after reporting a fatal error. Check the process transcript and crash log for details.");
+        WriteFatalLogImpl("exitcode");
+    }
+
+    std::cerr.flush();
+    std::cout.flush();
+    std::fflush(stdout);
+    std::fflush(stderr);
+}
+
+// Global terminate handler for uncaught exceptions
+static void TerminateHandler() {
+    // Skip detailed dump if already reported
+    if (g_fatalErrorReported.load(std::memory_order_acquire)) {
+        std::fflush(stderr);
+        std::_Exit(EXIT_FAILURE);
+    }
+    std::string terminateDetails;
+    if (auto ex = std::current_exception()) {
+        try {
+            std::rethrow_exception(ex);
+        } catch (const std::exception& e) {
+            terminateDetails = std::string("Unhandled C++ exception: ") + e.what();
+            RT_LOG(RT_TAG_RUNTIME) << "Unhandled C++ exception: " << e.what() << std::endl;
+        } catch (...) {
+            terminateDetails = "Unhandled non-std C++ exception.";
+            RT_LOG(RT_TAG_RUNTIME) << "Unhandled non-std C++ exception." << std::endl;
+        }
+    } else {
+        terminateDetails = "std::terminate() without current exception.";
+    }
+    ShowRuntimeFatalPopup("an unhandled C++ exception occurred", terminateDetails);
+    const std::string hostStackSummary = FormatHostStackTrace(1);
+    if (!hostStackSummary.empty()) {
+        terminateDetails.append("\n");
+        terminateDetails.append(hostStackSummary);
+    }
+    WriteFatalLogImpl("terminate", terminateDetails);
+    RT_LOG(RT_TAG_RUNTIME) << "std::terminate() called - program exiting" << std::endl;
+    std::cerr.flush();
+    DumpHostStackTrace();
+    if (const CpuContext* cpu = TryGetCpuContext()) {
+        RT_LOG(RT_TAG_RUNTIME) << "CPU state at terminate:" << std::endl;
+        SystemBridge::DumpCpuState(cpu);
+    }
+    std::fflush(stderr);
+    std::_Exit(EXIT_FAILURE);
+}
+
+int RuntimeMain(int argc, char** argv) {
+    // Must run before the transcript duplicates stdout/stderr: it decides what
+    // those descriptors are mirrored to now that the products are GUI-subsystem.
+    AttachParentConsoleForDiagnostics();
+#if defined(_WIN32)
+    ConfigureWindowsFatalDialogBehavior();
+    InstallSehLogger();
+    WindowsTimerResolutionGuard timerResolutionGuard;
+#endif
+    InitializeProcessTranscript(argc, argv);
+    std::signal(SIGABRT, AbortSignalHandler);
+    // Install exit/terminate handlers to ensure we get crash info
+    std::atexit(AtExitHandler);
+    std::set_terminate(TerminateHandler);
+    
+    std::string currentEntryLabel;
+
+    try {
+        if (argc != 1) {
+            throw std::invalid_argument("The game runtime does not accept command-line options; use Config.toml through the installed host.");
+        }
+        RuntimeConfigFile::LogLoadedConfig();
+        SystemBridge::Initialize();
+        TranslatedFunctionRegistry::Finalize();
+
+        // Initialize Aurora (graphics backend)
+        // We use auto backend (or specific if needed) and set a default window size.
+        // This is required for GX commands (like texture loading) to work.
+        AuroraConfig auroraConfig = {};
+        auroraConfig.appName = RuntimeProduct::Active().displayName.data();
+        const auto applicationDataDirectory = RuntimeConfigFile::ApplicationDataDirectory();
+        const auto rendererCacheDirectory = applicationDataDirectory / "Cache";
+        std::error_code rendererPathError;
+        std::filesystem::create_directories(rendererCacheDirectory, rendererPathError);
+        if (rendererPathError) {
+            RT_LOG(RT_TAG_RUNTIME) << "Unable to create renderer cache directory "
+                      << rendererCacheDirectory << ": " << rendererPathError.message() << std::endl;
+        }
+        const std::string auroraUserPath = applicationDataDirectory.string();
+        const std::string auroraCachePath = rendererCacheDirectory.string();
+        auroraConfig.userPath = auroraUserPath.c_str();
+        auroraConfig.cachePath = auroraCachePath.c_str();
+        auroraConfig.logCallback = &RuntimeAuroraLogCallback;
+        auroraConfig.logLevel = LOG_DEBUG;
+        const bool configWidescreen = RuntimeConfigFile::WidescreenEnabled(true);
+        auroraConfig.windowWidth = configWidescreen ? 854 : 640;
+        auroraConfig.windowHeight = 480;
+        auroraConfig.windowWidth = RuntimeConfigFile::WindowWidth(auroraConfig.windowWidth);
+        auroraConfig.windowHeight = RuntimeConfigFile::WindowHeight(auroraConfig.windowHeight);
+        auroraConfig.hasWindowPosition = RuntimeConfigFile::WindowPosition(
+            auroraConfig.windowPosX, auroraConfig.windowPosY);
+        auroraConfig.allowJoystickBackgroundEvents = true;
+        auroraConfig.disableCopyFilter = RuntimeConfigFile::DisableCopyFilter(true);
+        // Dolphin-style custom textures. Aurora indexes <userPath>/texture_replacements
+        // once during aurora_initialize, so both knobs only take effect on the next launch.
+        // Dumps name each unmatched texture the way its replacement would have to be named,
+        // which is only useful while the index is live - hence the conjunction.
+        auroraConfig.allowTextureReplacements = RuntimeConfigFile::TextureReplacements(false);
+        auroraConfig.allowTextureDumps = auroraConfig.allowTextureReplacements &&
+                                         RuntimeConfigFile::TextureDumps(false);
+        // No vsync knob: aurora always configures a non-blocking present mode.
+        auroraConfig.desiredBackend = BACKEND_AUTO;
+        const float resolutionMultiplier = RuntimeConfigFile::ResolutionMultiplier(1.0f);
+        ConfigureMkwDynamicAspect(configWidescreen, auroraConfig.windowWidth, auroraConfig.windowHeight);
+        VISetFrameBufferScale(resolutionMultiplier);
+        // One table for both directions. RuntimeConfigFile::IsSupportedGraphicsApi
+        // whitelists exactly these config names, so an unrecognised value has
+        // already been rejected (and reported) at parse time.
+        struct GraphicsBackendEntry {
+            const char* configName;
+            AuroraBackend backend;
+        };
+        static constexpr std::array<GraphicsBackendEntry, 3> kGraphicsBackends{{
+            {"auto", BACKEND_AUTO}, {"d3d12", BACKEND_D3D12}, {"vulkan", BACKEND_VULKAN},
+        }};
+        const auto backendDisplayName = [](AuroraBackend value) -> const char* {
+            for (const auto& entry : kGraphicsBackends) {
+                if (entry.backend == value) {
+                    return entry.configName;
+                }
+            }
+            return "unknown";
+        };
+
+        const std::string backend = RuntimeConfigFile::GraphicsApi("auto");
+        for (const auto& entry : kGraphicsBackends) {
+            if (backend == entry.configName) {
+                auroraConfig.desiredBackend = entry.backend;
+                break;
+            }
+        }
+        const AuroraBackend requestedBackend = auroraConfig.desiredBackend;
+
+        const AuroraInfo auroraInfo = aurora_initialize(0, nullptr, &auroraConfig);
+        if (requestedBackend != BACKEND_AUTO && auroraInfo.backend != requestedBackend) {
+            RT_LOG(RT_TAG_RUNTIME) << "graphics_api=\"" << backend
+                      << "\" is not available on this system; aurora fell back to \""
+                      << backendDisplayName(auroraInfo.backend)
+                      << "\". See the [aurora::gpu] lines above for the reason." << std::endl;
+        } else {
+            RT_LOG(RT_TAG_RUNTIME) << "graphics backend: " << backendDisplayName(auroraInfo.backend)
+                      << std::endl;
+        }
+        aurora_set_frame_worker_wait_callback(ServiceGuestTimingDuringAuroraFrameWait);
+        GxGuestWrite::InstallAuroraHooks();
+        UpdateMkwDynamicAspectSurface(auroraInfo.windowSize.native_fb_width,
+                                      auroraInfo.windowSize.native_fb_height);
+        settings_overlay::InitializeRuntimeSettings();
+        RT_LOG(RT_TAG_CONFIG) << "video.widescreen=" << (configWidescreen ? "true" : "false")
+                  << " SCGetAspectRatio=" << (configWidescreen ? 1 : 0)
+                  << " resolutionMultiplier=" << resolutionMultiplier
+                  << " window=" << auroraInfo.windowSize.width << "x" << auroraInfo.windowSize.height
+                  << " native=" << auroraInfo.windowSize.native_fb_width << "x"
+                  << auroraInfo.windowSize.native_fb_height
+                  << " viewportPolicy=" << (g_dynamicAspectRatioEnabled ? "stretch" : "fit")
+                  << " presentAspect="
+                  << (g_dynamicAspectRatioEnabled ? "surface (dynamic EGG canvas)" : "4:3")
+                  << std::endl;
+        g_auroraInitialized.store(true, std::memory_order_release);
+
+        auto entry = ResolveEntry();
+        InitializePersistentCpuContext();
+        auto& cpu = GetPersistentCpuContext();
+        SeedCpuContext(cpu);
+        
+        // Initialize the fiber-based threading system
+        Fiber::GuestFiberManager::Initialize();
+        
+        CpuContextScope cpuScope(&cpu);
+
+        std::string label = entry->name;
+        if (label.empty()) {
+            std::ostringstream oss;
+            oss << "0x" << std::hex << entry->address;
+            label = oss.str();
+        }
+        currentEntryLabel = label;
+        g_lastEntryLabel = currentEntryLabel;
+
+        InvokeIndirectCpu(entry->address, &cpu);
+        const uint32_t result = cpu.gpr[3];
+        RT_LOG(RT_TAG_RUNTIME) << label << " => 0x" << std::hex << result << std::dec << " (" << result << ")" << std::endl;
+        
+        // Shutdown fiber system
+        Fiber::GuestFiberManager::Shutdown();
+        WindowPlacementPersistence::Flush(true);
+        aurora_shutdown();
+        SetRuntimeExitCodeImpl(0);
+        ShutdownProcessTranscript();
+        return 0;
+    } catch (const Memory::AccessViolation& ex) {
+        std::cerr << "Runtime error: " << ex.what() << std::endl;
+        DumpAccessViolationReport(ex, currentEntryLabel);
+        std::ostringstream details;
+        details << "addr=0x" << std::hex << std::uppercase << ex.address()
+                << " len=0x" << ex.length()
+                << std::dec << std::nouppercase
+                << " reason=" << ex.reason();
+        ShowRuntimeFatalPopup("a guest memory access was out of bounds", details.str());
+        WriteFatalLogImpl("access_violation", details.str());
+        SetRuntimeExitCodeImpl(1);
+        Fiber::GuestFiberManager::Shutdown();
+        WindowPlacementPersistence::Flush(true);
+        aurora_shutdown();
+        ShutdownProcessTranscript();
+        return 1;
+    } catch (const std::exception& ex) {
+        std::cerr << "Runtime error: " << ex.what() << std::endl;
+        SystemBridge::DumpCpuState(TryGetCpuContext());
+        ShowRuntimeFatalPopup("a runtime exception occurred", ex.what());
+        WriteFatalLogImpl("exception");
+        SetRuntimeExitCodeImpl(1);
+        Fiber::GuestFiberManager::Shutdown();
+        WindowPlacementPersistence::Flush(true);
+        aurora_shutdown();
+        ShutdownProcessTranscript();
+        return 1;
+    }
+}
+
+int main(int argc, char** argv) {
+    return RuntimeMain(argc, argv);
+}
+extern "C" bool g_dynamicAspectRatioEnabled = false;
diff --git a/runtime/src/memory.cpp b/runtime/src/memory.cpp
new file mode 100644
index 0000000..63f5825
--- /dev/null
+++ b/runtime/src/memory.cpp
@@ -0,0 +1,793 @@
+#include "memory.h"
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cctype>
+#include <chrono>
+#include <cstdlib>
+#include <cstring>
+#include <cstdio>
+#include <iomanip>
+#include <iostream>
+#include <memory>
+#include <string>
+#include <optional>
+#include "ppc_runtime.h"
+#include "runtime_log.h"
+#include "system_bridge.h"
+#include <mutex>
+#include <sstream>
+#include <unordered_map>
+
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#include <dbghelp.h>
+
+MemoryInline::PageEntry MemoryInline::g_pageTable[MemoryInline::kPageCount]{};
+uintptr_t MemoryInline::g_fullPageBias[MemoryInline::kPageCount]{};
+uintptr_t MemoryInline::g_fullReadablePageBias[MemoryInline::kPageCount]{};
+uintptr_t MemoryInline::g_fullWritablePageBias[MemoryInline::kPageCount]{};
+const MemoryInline::SparseWritablePageTable*
+    MemoryInline::g_sparseWritablePageTables[MemoryInline::kPageCount]{};
+uint8_t MemoryInline::g_deferredReadCoveredPages[MemoryInline::kPageCount]{};
+template <typename T>
+T MemoryInline::ReadResolvedFallback(uint32_t addr) {
+    if constexpr (sizeof(T) == 1) return Memory::Read8(addr);
+    if constexpr (sizeof(T) == 2) return Memory::Read16(addr);
+    if constexpr (sizeof(T) == 4) return Memory::Read32(addr);
+    return Memory::Read64(addr);
+}
+template uint8_t MemoryInline::ReadResolvedFallback<uint8_t>(uint32_t);
+template uint16_t MemoryInline::ReadResolvedFallback<uint16_t>(uint32_t);
+template uint32_t MemoryInline::ReadResolvedFallback<uint32_t>(uint32_t);
+template uint64_t MemoryInline::ReadResolvedFallback<uint64_t>(uint32_t);
+float MemoryInline::ReadResolvedFallbackFloat32(uint32_t addr) { return Memory::ReadFloat32(addr); }
+double MemoryInline::ReadResolvedFallbackFloat64(uint32_t addr) { return Memory::ReadFloat64(addr); }
+template <typename T>
+void MemoryInline::WriteResolvedFallback(uint32_t addr, T value) {
+    if constexpr (sizeof(T) == 1) Memory::Write8(addr, value);
+    else if constexpr (sizeof(T) == 2) Memory::Write16(addr, value);
+    else if constexpr (sizeof(T) == 4) Memory::Write32(addr, value);
+    else Memory::Write64(addr, value);
+}
+template void MemoryInline::WriteResolvedFallback<uint8_t>(uint32_t, uint8_t);
+template void MemoryInline::WriteResolvedFallback<uint16_t>(uint32_t, uint16_t);
+template void MemoryInline::WriteResolvedFallback<uint32_t>(uint32_t, uint32_t);
+template void MemoryInline::WriteResolvedFallback<uint64_t>(uint32_t, uint64_t);
+void MemoryInline::WriteResolvedFallbackFloat32(uint32_t addr, double val) { Memory::WriteFloat32(addr, val); }
+void MemoryInline::WriteResolvedFallbackFloat64(uint32_t addr, double val) { Memory::WriteFloat64(addr, val); }
+namespace {
+struct DeferredRead {
+    uint64_t token = 0;
+    uint32_t start = 0;
+    size_t length = 0;
+    Memory::DeferredReadCallback callback = nullptr;
+    void* user = nullptr;
+};
+
+std::mutex& DeferredReadMutex() {
+    static std::mutex mutex;
+    return mutex;
+}
+
+std::vector<DeferredRead>& DeferredReads() {
+    static std::vector<DeferredRead> reads;
+    return reads;
+}
+
+uint64_t& NextDeferredReadToken() {
+    static uint64_t token = 1;
+    return token;
+}
+
+bool RangesOverlap(uint32_t firstStart, size_t firstLength,
+                   uint32_t secondStart, size_t secondLength) {
+    const uint64_t firstEnd = static_cast<uint64_t>(firstStart) + firstLength;
+    const uint64_t secondEnd = static_cast<uint64_t>(secondStart) + secondLength;
+    return static_cast<uint64_t>(firstStart) < secondEnd &&
+           static_cast<uint64_t>(secondStart) < firstEnd;
+}
+
+void RefreshDeferredReadPage(uint32_t page) {
+    const uint32_t pageStart = page << MemoryInline::kPageShift;
+    const auto& reads = DeferredReads();
+    const bool covered = std::any_of(reads.begin(), reads.end(), [pageStart](const DeferredRead& read) {
+        return RangesOverlap(pageStart, MemoryInline::kPageSize, read.start, read.length);
+    });
+    MemoryInline::g_fullReadablePageBias[page] =
+        !covered ? MemoryInline::g_fullPageBias[page] : 0;
+    MemoryInline::g_deferredReadCoveredPages[page] = covered ? 1 : 0;
+}
+
+struct Region {
+    Memory::RegionConfig config;
+    uint8_t* storagePtr = nullptr;
+    size_t storageSize = 0;
+};
+
+std::vector<Region>& Regions() {
+    static std::vector<Region> regions;
+    return regions;
+}
+
+std::mutex& RegionMutex() {
+    static std::mutex mutex;
+    return mutex;
+}
+
+std::array<std::unique_ptr<MemoryInline::SparseWritablePageTable>,
+           MemoryInline::kPageCount>& SparseWritablePageTableStorage() {
+    static std::array<std::unique_ptr<MemoryInline::SparseWritablePageTable>,
+                      MemoryInline::kPageCount> storage;
+    return storage;
+}
+
+void ClearPageTable() {
+    auto* table = MemoryInline::g_pageTable;
+    for (uint32_t i = 0; i < MemoryInline::kPageCount; ++i) {
+        auto& entry = table[i];
+        entry.base = nullptr;
+        entry.limit = 0;
+        MemoryInline::g_fullPageBias[i] = 0;
+        MemoryInline::g_fullReadablePageBias[i] = 0;
+        MemoryInline::g_fullWritablePageBias[i] = 0;
+        MemoryInline::g_deferredReadCoveredPages[i] = 0;
+        MemoryInline::g_sparseWritablePageTables[i] = nullptr;
+        SparseWritablePageTableStorage()[i].reset();
+    }
+}
+
+} // namespace
+
+uint64_t Memory::RegisterDeferredRead(uint32_t addr, size_t length,
+                                      DeferredReadCallback callback, void* user) {
+    if (length == 0 || callback == nullptr ||
+        static_cast<uint64_t>(addr) + length > (uint64_t{1} << 32)) {
+        return 0;
+    }
+
+    std::lock_guard lock{DeferredReadMutex()};
+    uint64_t token = NextDeferredReadToken()++;
+    if (token == 0) token = NextDeferredReadToken()++;
+    DeferredReads().push_back({token, addr, length, callback, user});
+    const uint32_t firstPage = addr >> MemoryInline::kPageShift;
+    const uint32_t lastPage = static_cast<uint32_t>(
+        (static_cast<uint64_t>(addr) + length - 1) >> MemoryInline::kPageShift);
+    for (uint32_t page = firstPage; page <= lastPage; ++page) {
+        MemoryInline::g_fullReadablePageBias[page] = 0;
+        MemoryInline::g_deferredReadCoveredPages[page] = 1;
+    }
+    // Clearing the readable bias only intercepts the checked path. A flat read
+    // needs the host pages themselves to trap, which is what PAGE_NOACCESS on
+    // the guest view does; the vectored handler materializes the copy, restores
+    // the protection and re-runs the access.
+    GuestFlat::ProtectDeferredRange(addr, length);
+    return token;
+}
+
+void Memory::ClearDeferredReads() {
+    std::lock_guard lock{DeferredReadMutex()};
+    auto& reads = DeferredReads();
+    std::vector<uint32_t> pages;
+    for (const auto& read : reads) {
+        const uint32_t firstPage = read.start >> MemoryInline::kPageShift;
+        const uint32_t lastPage = static_cast<uint32_t>(
+            (static_cast<uint64_t>(read.start) + read.length - 1) >> MemoryInline::kPageShift);
+        for (uint32_t page = firstPage; page <= lastPage; ++page) pages.push_back(page);
+        GuestFlat::UnprotectDeferredRange(read.start, read.length);
+    }
+    reads.clear();
+    std::sort(pages.begin(), pages.end());
+    pages.erase(std::unique(pages.begin(), pages.end()), pages.end());
+    for (uint32_t page : pages) RefreshDeferredReadPage(page);
+}
+
+bool MemoryInline::ResolveDeferredReads(uint32_t addr, size_t length) {
+    std::vector<DeferredRead> matches;
+    std::vector<uint32_t> affectedPages;
+    {
+        std::lock_guard lock{DeferredReadMutex()};
+        auto& reads = DeferredReads();
+        for (auto it = reads.begin(); it != reads.end();) {
+            if (!RangesOverlap(addr, length, it->start, it->length)) {
+                ++it;
+                continue;
+            }
+            const uint32_t firstPage = it->start >> kPageShift;
+            const uint32_t lastPage = static_cast<uint32_t>(
+                (static_cast<uint64_t>(it->start) + it->length - 1) >> kPageShift);
+            for (uint32_t page = firstPage; page <= lastPage; ++page) affectedPages.push_back(page);
+            matches.push_back(*it);
+            // Idempotent: the vectored handler already dropped the protection
+            // for the range whose trap brought us here.
+            GuestFlat::UnprotectDeferredRange(it->start, it->length);
+            it = reads.erase(it);
+        }
+        std::sort(affectedPages.begin(), affectedPages.end());
+        affectedPages.erase(std::unique(affectedPages.begin(), affectedPages.end()), affectedPages.end());
+        for (uint32_t page : affectedPages) RefreshDeferredReadPage(page);
+    }
+
+    // The range is removed before entering renderer code so any memory reads
+    // made while submitting the copy cannot recursively trigger it.
+    for (const auto& match : matches) {
+        if (!match.callback(match.user)) {
+            throw Memory::AccessViolation(addr, length, "deferred read materialization failed");
+        }
+    }
+    return true;
+}
+
+namespace {
+
+void BuildPageTable() {
+    auto* table = MemoryInline::g_pageTable;
+    for (const auto& region : Regions()) {
+        const uint64_t base = region.config.baseAddress;
+        const uint64_t size = region.storageSize;
+        const uint64_t end = base + size;
+        if (size == 0) {
+            continue;
+        }
+
+        const uint32_t startPage = static_cast<uint32_t>(base >> MemoryInline::kPageShift);
+        const uint32_t endPage = static_cast<uint32_t>((end - 1) >> MemoryInline::kPageShift);
+        for (uint32_t page = startPage; page <= endPage; ++page) {
+            const uint64_t pageBase = static_cast<uint64_t>(page) << MemoryInline::kPageShift;
+            const uint64_t offset = pageBase - base;
+            if (offset >= size) {
+                continue;
+            }
+            const uint32_t limit = static_cast<uint32_t>(std::min<uint64_t>(MemoryInline::kPageSize, size - offset));
+            table[page].base = region.storagePtr + static_cast<size_t>(offset);
+            table[page].limit = limit;
+        }
+    }
+
+    // The last page of each contiguous mapping remains on the checked path so
+    // an access straddling its end cannot escape the mapped region. Every
+    // preceding full page can safely service native accesses up to 8 bytes,
+    // including a cross-page access into its contiguous successor.
+    for (uint32_t page = 0; page + 1 < MemoryInline::kPageCount; ++page) {
+        const auto& current = table[page];
+        const auto& next = table[page + 1];
+        if (!current.base || current.limit != MemoryInline::kPageSize ||
+            !next.base || next.limit < MemoryInline::kMaxFastScalarSize - 1u ||
+            next.base != current.base + MemoryInline::kPageSize)
+            continue;
+        const uintptr_t guestPageBase = static_cast<uintptr_t>(page) << MemoryInline::kPageShift;
+        const uintptr_t bias = reinterpret_cast<uintptr_t>(current.base) - guestPageBase;
+        MemoryInline::g_fullPageBias[page] = bias + 1u;
+    }
+}
+
+void RefreshFastPathTables() {
+    auto& sparseStorage = SparseWritablePageTableStorage();
+    for (uint32_t page = 0; page < MemoryInline::kPageCount; ++page) {
+        const uintptr_t bias = MemoryInline::g_fullPageBias[page];
+        MemoryInline::g_fullReadablePageBias[page] = bias;
+        MemoryInline::g_deferredReadCoveredPages[page] = 0;
+        MemoryInline::g_sparseWritablePageTables[page] = nullptr;
+        sparseStorage[page].reset();
+
+        const bool coarseExecutable =
+            RecompMod::g_executableWriteGuardCoarsePages[page].load(
+                std::memory_order_relaxed) != 0;
+        MemoryInline::g_fullWritablePageBias[page] = coarseExecutable ? 0 : bias;
+        if (!coarseExecutable || bias == 0)
+            continue;
+
+        auto sparse = std::make_unique<MemoryInline::SparseWritablePageTable>();
+        bool hasExecutableSubPage = false;
+        bool hasWritableSubPage = false;
+        const uint32_t firstExactPage =
+            page * MemoryInline::kWritableSubPagesPerPage;
+        for (uint32_t subPage = 0;
+             subPage < MemoryInline::kWritableSubPagesPerPage; ++subPage) {
+            const bool executable =
+                RecompMod::g_executableWriteGuardPages[firstExactPage + subPage].load(
+                    std::memory_order_relaxed) != 0;
+            hasExecutableSubPage |= executable;
+            hasWritableSubPage |= !executable;
+            sparse->encodedBias[subPage] = executable ? 0 : bias;
+        }
+
+        // A homogeneous executable page has no writable fast path; a
+        // homogeneous data page already uses g_fullWritablePageBias. Retain an
+        // allocation only for the intended mixed case.
+        if (hasExecutableSubPage && hasWritableSubPage) {
+            MemoryInline::g_sparseWritablePageTables[page] = sparse.get();
+            sparseStorage[page] = std::move(sparse);
+        }
+    }
+    std::lock_guard lock{DeferredReadMutex()};
+    for (const auto& read : DeferredReads()) {
+        const uint32_t firstPage = read.start >> MemoryInline::kPageShift;
+        const uint32_t lastPage = static_cast<uint32_t>(
+            (static_cast<uint64_t>(read.start) + read.length - 1) >> MemoryInline::kPageShift);
+        for (uint32_t page = firstPage; page <= lastPage; ++page) {
+            MemoryInline::g_fullReadablePageBias[page] = 0;
+            MemoryInline::g_deferredReadCoveredPages[page] = 1;
+        }
+    }
+}
+
+Region* TryResolveRegion(uint32_t address, size_t length) {
+    auto& regions = Regions();
+    for (auto& region : regions) {
+        const uint64_t base = region.config.baseAddress;
+        const uint64_t limit = base + region.storageSize;
+        const uint64_t addr = address;
+        const uint64_t end = addr + length;
+        if (addr >= base && end <= limit) {
+            return &region;
+        }
+    }
+    return nullptr;
+}
+
+Region& ResolveRegion(uint32_t address, size_t length) {
+    if (Region* region = TryResolveRegion(address, length)) {
+        return *region;
+    }
+    // Emit extra context to help diagnose early-boot accesses that miss the map.
+    if (auto* cpu = TryGetCpuContext()) {
+        const uint32_t active = RecompMod::CurrentTranslatedExecutionAddress();
+        RT_LOG(RT_TAG_MEMORY) << "AccessViolation ctx=" << cpu
+                  << " pc=0x" << std::hex << cpu->pc
+                  << " active=0x" << active
+                  << " lr=0x" << cpu->lr
+                  << " r1=0x" << cpu->gpr[1]
+                  << " r8=0x" << cpu->gpr[8]
+                  << " r9=0x" << cpu->gpr[9]
+                  << " r12=0x" << cpu->gpr[12]
+                  << " r30=0x" << cpu->gpr[30]
+                  << " r31=0x" << cpu->gpr[31]
+                  << std::dec
+                  << " addr=0x" << std::hex << address
+                  << " len=" << length << std::dec
+                  << " reason=no mapped region" << std::endl;
+    } else {
+        RT_LOG(RT_TAG_MEMORY) << "AccessViolation ctx=(null) addr=0x" << std::hex << address
+                  << " len=" << length << std::dec << " reason=no mapped region" << std::endl;
+    }
+    RT_LOG(RT_TAG_MEMORY) << "===== DUMPING CPU STATE =====" << std::endl;
+    SystemBridge::DumpCpuState(TryGetCpuContext());
+    // Hexdump guest memory around pointer-carrying registers so a corrupted
+    // structure's surroundings (e.g. ASCII sprayed over a link pointer) are
+    // visible in the report without a debugger attached.
+    if (auto* cpu = TryGetCpuContext()) {
+        for (const int reg : {4, 5, 6, 7, 8, 26, 27, 28, 29, 30, 31}) {
+            const uint32_t base = cpu->gpr[reg];
+            if (base < 0x80000000u || base >= 0x94000000u)
+                continue;
+            const uint32_t start = (base - 0x40u) & ~0xFu;
+            RT_LOG(RT_TAG_MEMORY) << "hexdump around r" << reg << "=0x" << std::hex << base << ":" << std::endl;
+            for (uint32_t row = 0; row < 16; ++row) {
+                const uint32_t rowAddr = start + row * 16u;
+                RT_LOG(RT_TAG_MEMORY) << "  0x" << std::hex << rowAddr << ":";
+                char ascii[17] = {};
+                for (uint32_t i = 0; i < 16; ++i) {
+                    uint8_t byte = 0;
+                    if (!MemoryInline::TryReadGuestScalar(rowAddr + i, byte)) {
+                        std::cerr << " ??";
+                        ascii[i] = '?';
+                        continue;
+                    }
+                    std::cerr << " " << std::setw(2) << std::setfill('0') << static_cast<uint32_t>(byte);
+                    ascii[i] = (byte >= 0x20 && byte < 0x7F) ? static_cast<char>(byte) : '.';
+                }
+                std::cerr << "  |" << ascii << "|" << std::dec << std::setfill(' ') << std::endl;
+            }
+        }
+    }
+#if defined(_WIN32)
+    void* frames[32]{};
+    const USHORT captured = CaptureStackBackTrace(0, static_cast<DWORD>(std::size(frames)), frames, nullptr);
+    const auto imageBase = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
+    HANDLE process = GetCurrentProcess();
+    static const bool symbolsReady = [] {
+        SymSetOptions(SYMOPT_UNDNAME | SYMOPT_DEFERRED_LOADS | SYMOPT_LOAD_LINES);
+        if (SymInitialize(GetCurrentProcess(), nullptr, TRUE) != FALSE)
+            return true;
+        // The runtime crash reporter may already own the process-wide DbgHelp
+        // session. Reuse it rather than treating ERROR_INVALID_PARAMETER as
+        // symbol unavailability.
+        return GetLastError() == ERROR_INVALID_PARAMETER;
+    }();
+    RT_LOG(RT_TAG_MEMORY) << "host stack at first invalid guest access:" << std::endl;
+    for (USHORT index = 0; index < captured; ++index) {
+        const auto addressValue = reinterpret_cast<uintptr_t>(frames[index]);
+        RT_LOG(RT_TAG_MEMORY) << "  #" << index << " absolute=0x" << std::hex << addressValue;
+        if (imageBase != 0 && addressValue >= imageBase)
+            std::cerr << " image+0x" << (addressValue - imageBase);
+        std::array<char, sizeof(SYMBOL_INFO) + MAX_SYM_NAME> symbolBuffer{};
+        auto* symbol = reinterpret_cast<SYMBOL_INFO*>(symbolBuffer.data());
+        symbol->SizeOfStruct = sizeof(SYMBOL_INFO);
+        symbol->MaxNameLen = MAX_SYM_NAME;
+        DWORD64 displacement = 0;
+        if (symbolsReady && SymFromAddr(process, addressValue, &displacement, symbol))
+            std::cerr << " " << symbol->Name << "+0x" << displacement;
+        std::cerr << std::dec << std::endl;
+    }
+#endif
+    std::cerr.flush();
+    throw Memory::AccessViolation(address, length, "no mapped region");
+}
+
+GuestFlat::Backing ClassifyBacking(uint32_t baseAddress) {
+    // MEM1: physical (0x00000000), cached (0x80000000), uncached (0xC0000000)
+    if ((baseAddress >= Memory::kMem1PhysicalBase &&
+         baseAddress < Memory::kMem1PhysicalBase + Memory::kMem1Size) ||
+        (baseAddress >= Memory::kMem1CachedBase &&
+         baseAddress < Memory::kMem1CachedBase + Memory::kMem1Size) ||
+        (baseAddress >= Memory::kMem1UncachedBase &&
+         baseAddress < Memory::kMem1UncachedBase + Memory::kMem1Size)) {
+        return GuestFlat::Backing::Mem1;
+    }
+
+    // NDEV-sized MEM2: physical (0x10000000), cached (0x90000000),
+    // uncached (0xD0000000). Mario Kart Wii detects this configuration and
+    // creates its original EGGRootDebug expansion heap.
+    if ((baseAddress >= Memory::kMem2PhysicalBase &&
+         baseAddress < Memory::kMem2PhysicalEnd) ||
+        (baseAddress >= Memory::kMem2CachedBase &&
+         baseAddress < Memory::kMem2CachedEnd) ||
+        (baseAddress >= Memory::kMem2UncachedBase &&
+         baseAddress < Memory::kMem2UncachedEnd)) {
+        return GuestFlat::Backing::Mem2;
+    }
+
+    return GuestFlat::Backing::Owned;
+}
+
+
+template <typename T>
+T ReadScalar(uint32_t address) {
+    // This is the cold *Slow path; Memory::GetPointer already tries the fast
+    // probe first, so repeating it here only guaranteed a second miss.
+    auto* ptr = Memory::GetPointer(address, sizeof(T));
+    if constexpr (sizeof(T) == 1) {
+        return *ptr;
+    } else {
+        T value = 0;
+        std::memcpy(&value, ptr, sizeof(T));
+        return MemoryInline::MaybeByteSwap(value);
+    }
+}
+
+template <typename T>
+void WriteScalar(uint32_t address, T value) {
+    if (RecompMod::HandleExecutableWrite(address, sizeof(T), static_cast<uint64_t>(value))) {
+        return;
+    }
+
+    auto* ptr = Memory::GetPointer(address, sizeof(T));
+    if constexpr (sizeof(T) == 1) {
+        *ptr = static_cast<uint8_t>(value);
+    } else {
+        const T swapped = MemoryInline::MaybeByteSwap(value);
+        std::memcpy(ptr, &swapped, sizeof(T));
+    }
+}
+
+} // namespace
+
+Memory::AccessViolation::AccessViolation(uint32_t address, size_t length, std::string_view reason)
+    : std::runtime_error([&]() {
+          std::ostringstream oss;
+          oss << "Memory access violation at 0x" << std::hex << std::uppercase << address
+              << " (+0x" << length << ") :: " << reason;
+          return oss.str();
+      }()),
+      address_(address),
+      length_(length),
+      reason_(reason) {}
+
+void Memory::RefreshWritableFastPathsForExecutableRanges() {
+    std::lock_guard<std::mutex> lock(RegionMutex());
+    RefreshFastPathTables();
+}
+
+Memory::Config Memory::Config::WiiDefaults() {
+    // Physical / cached / uncached views of MEM1 and MEM2, then the locked cache.
+    Config config;
+
+    config.regions.push_back(RegionConfig{
+        .name = "MEM1_PHYS",
+        .baseAddress = Memory::kMem1PhysicalBase,
+        .sizeBytes = Memory::kMem1Size,
+    });
+
+    config.regions.push_back(RegionConfig{
+        .name = "MEM1",
+        .baseAddress = Memory::kMem1CachedBase,
+        .sizeBytes = Memory::kMem1Size,
+    });
+
+    config.regions.push_back(RegionConfig{
+        .name = "MEM1_UNCACHED",
+        .baseAddress = Memory::kMem1UncachedBase,
+        .sizeBytes = Memory::kMem1Size,
+    });
+
+    config.regions.push_back(RegionConfig{
+        .name = "MEM2_PHYS",
+        .baseAddress = Memory::kMem2PhysicalBase,
+        .sizeBytes = Memory::kMem2Size,
+    });
+
+    config.regions.push_back(RegionConfig{
+        .name = "MEM2",
+        .baseAddress = Memory::kMem2CachedBase,
+        .sizeBytes = Memory::kMem2Size,
+    });
+
+    config.regions.push_back(RegionConfig{
+        .name = "MEM2_UNCACHED",
+        .baseAddress = Memory::kMem2UncachedBase,
+        .sizeBytes = Memory::kMem2Size,
+    });
+
+    // Kamek module overlay: 2 MiB above MEM1, which the game believes ends at 0x81800000, so this
+    // costs no arena space (unlike the old in-arena reservation that shrank the race scene heaps).
+    // Base must stay within +/-32 MiB of every DOL/StaticR hook site for Kamek Rel24 branches to encode.
+    config.regions.push_back(RegionConfig{
+        .name = "MEM1_KAMEK_OVERLAY",
+        .baseAddress = 0x81800000,
+        .sizeBytes = 0x200000,
+    });
+
+    // Locked cache (THP decoder fast RAM) is really 16KB at 0xE0000000, but a sub-page mapping can
+    // never enter the coarse 1MiB bias tables, forcing every THP load/store through the checked
+    // fallback (the dominant cost of THP-heavy screens). Back a full 1MiB page plus the successor
+    // page the bias builder needs, so locked-cache access stays on the two-instruction native path.
+    constexpr size_t lcSize = MemoryInline::kPageSize + 4096u;
+    config.regions.push_back(RegionConfig{
+        .name = "LOCKED_CACHE",
+        .baseAddress = 0xE0000000,
+        .sizeBytes = lcSize,
+    });
+
+    return config;
+}
+
+void Memory::Init(size_t mem1Size) {
+    Config config;
+    config.regions.push_back(RegionConfig{.name = "MEM1", .baseAddress = 0x80000000, .sizeBytes = mem1Size});
+    Init(config);
+}
+
+void Memory::Init(const Config& config) {
+    std::lock_guard<std::mutex> lock(RegionMutex());
+    auto& regions = Regions();
+    regions.clear();
+    ClearPageTable();
+    regions.reserve(config.regions.size());
+
+    // The flat reservation backs every guest view from one shared section object, so cached/uncached/
+    // physical mirrors alias as before. GetPointer still hands out the unprotected host alias, so
+    // native code (image loading, DVD reads, HLE) is unaffected by the guest view's protections.
+    {
+        std::vector<GuestFlat::RegionRequest> flatRegions;
+        flatRegions.reserve(config.regions.size());
+        for (const auto& regionConfig : config.regions) {
+            flatRegions.push_back(GuestFlat::RegionRequest{
+                regionConfig.baseAddress, regionConfig.sizeBytes,
+                ClassifyBacking(regionConfig.baseAddress)});
+        }
+        GuestFlat::Initialize(flatRegions);
+    }
+
+    // Map virtual regions onto that backing store, with mirroring.
+    for (const auto& regionConfig : config.regions) {
+        Region instance;
+        instance.config = regionConfig;
+
+        instance.storagePtr = GuestFlat::HostPointer(regionConfig.baseAddress);
+        if (instance.storagePtr == nullptr && regionConfig.sizeBytes != 0) {
+            throw std::runtime_error("Flat guest mapping is missing region '" + regionConfig.name + "'");
+        }
+        instance.storageSize = regionConfig.sizeBytes;
+
+        regions.emplace_back(std::move(instance));
+    }
+
+    BuildPageTable();
+    RefreshFastPathTables();
+}
+
+void Memory::Reset() {
+    ClearDeferredReads();
+    std::lock_guard<std::mutex> lock(RegionMutex());
+    Regions().clear();
+    ClearPageTable();
+}
+
+namespace {
+// MMIO reads have no backing store or generic HLE. Answering zero (the old sparse fallback) turned
+// unimplemented devices into silent hangs, so unmapped reads throw like MMIO writes; every device
+// we do implement is hooked at the function level, so a hit here means a missing HLE hook.
+[[noreturn]] void ThrowMmioReadBlocked(uint32_t addr, size_t length) {
+    std::ostringstream reason;
+    reason << (MemoryInline::IsGpuFifoAddress(addr)
+                   ? "GPU FIFO read blocked (the gather pipe is write-only)"
+                   : "MMIO read blocked (non-GPU)")
+           << "; add HLE for this device instead of answering zero"
+           << " (active=0x" << std::hex << std::uppercase
+           << RecompMod::CurrentTranslatedExecutionAddress() << std::dec << std::nouppercase << ")";
+    throw Memory::AccessViolation(addr, length, reason.str());
+}
+} // namespace
+
+uint8_t MemoryInline::Read8Slow(uint32_t addr) {
+    if (IsMmioAddress(addr)) {
+        ThrowMmioReadBlocked(addr, sizeof(uint8_t));
+    }
+    ResolveDeferredReads(addr, sizeof(uint8_t));
+    return ReadScalar<uint8_t>(addr);
+}
+
+uint16_t MemoryInline::Read16Slow(uint32_t addr) {
+    if (IsMmioAddress(addr)) {
+        ThrowMmioReadBlocked(addr, sizeof(uint16_t));
+    }
+    ResolveDeferredReads(addr, sizeof(uint16_t));
+    return ReadScalar<uint16_t>(addr);
+}
+
+uint32_t MemoryInline::Read32Slow(uint32_t addr) {
+    if (IsMmioAddress(addr)) {
+        ThrowMmioReadBlocked(addr, sizeof(uint32_t));
+    }
+    ResolveDeferredReads(addr, sizeof(uint32_t));
+    const uint32_t value = ReadScalar<uint32_t>(addr);
+    return value;
+}
+
+uint64_t MemoryInline::Read64Slow(uint32_t addr) {
+    if (IsMmioAddress(addr)) {
+        ThrowMmioReadBlocked(addr, sizeof(uint64_t));
+    }
+    ResolveDeferredReads(addr, sizeof(uint64_t));
+    return ReadScalar<uint64_t>(addr);
+}
+
+float MemoryInline::ReadFloat32Slow(uint32_t addr) {
+    if (IsMmioAddress(addr)) {
+        ThrowMmioReadBlocked(addr, sizeof(float));
+    }
+    ResolveDeferredReads(addr, sizeof(uint32_t));
+    const auto bits = ReadScalar<uint32_t>(addr);
+    float value;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+double MemoryInline::ReadFloat64Slow(uint32_t addr) {
+    if (IsMmioAddress(addr)) {
+        ThrowMmioReadBlocked(addr, sizeof(double));
+    }
+    ResolveDeferredReads(addr, sizeof(uint64_t));
+    const auto bits = ReadScalar<uint64_t>(addr);
+    double value;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+void MemoryInline::Write8Slow(uint32_t addr, uint8_t val) {
+    if (IsGpuFifoAddress(addr)) {
+        GX_HLE_FIFO_Write8(val);
+        return;
+    }
+    if (IsMmioAddress(addr)) {
+        throw Memory::AccessViolation(addr, sizeof(val), "MMIO write blocked (non-GPU)");
+    }
+    WriteScalar(addr, val);
+}
+
+void MemoryInline::Write16Slow(uint32_t addr, uint16_t val) {
+    if (IsGpuFifoAddress(addr)) {
+        GX_HLE_FIFO_Write16(val);
+        return;
+    }
+    if (IsMmioAddress(addr)) {
+        throw Memory::AccessViolation(addr, sizeof(val), "MMIO write blocked (non-GPU)");
+    }
+    WriteScalar(addr, val);
+}
+
+void MemoryInline::Write32Slow(uint32_t addr, uint32_t val) {
+    if (IsGpuFifoAddress(addr)) {
+        GX_HLE_FIFO_Write32(val);
+        return;
+    }
+    if (IsMmioAddress(addr)) {
+        throw Memory::AccessViolation(addr, sizeof(val), "MMIO write blocked (non-GPU)");
+    }
+    WriteScalar(addr, val);
+}
+
+void MemoryInline::Write64Slow(uint32_t addr, uint64_t val) {
+    if (IsGpuFifoAddress(addr)) {
+        // The gather pipe is a byte-stream FIFO; a 64-bit store is two big-endian
+        // 32-bit pushes, high word first. Without this arm the write fell through
+        // to WriteScalar, which found no mapped region behind 0xCC008000 and threw
+        // "no mapped region" instead of reaching GX.
+        GX_HLE_FIFO_Write32(static_cast<uint32_t>(val >> 32));
+        GX_HLE_FIFO_Write32(static_cast<uint32_t>(val));
+        return;
+    }
+    if (IsMmioAddress(addr)) {
+        throw Memory::AccessViolation(addr, sizeof(val), "MMIO write blocked (non-GPU)");
+    }
+    WriteScalar(addr, val);
+}
+
+void MemoryInline::WriteFloat32Slow(uint32_t addr, double val) {
+    // stfs stores the IEEE-754 bit pattern of the single-precision value, never a
+    // truncated integer.
+    const uint32_t bits = ConvertPpcDoubleToSingleBits(val);
+    if (IsGpuFifoAddress(addr)) {
+        GX_HLE_FIFO_WriteFloat(PpcSingleBitsToFloat(bits));
+        return;
+    }
+    if (IsMmioAddress(addr)) {
+        throw Memory::AccessViolation(addr, sizeof(float), "MMIO write blocked (non-GPU)");
+    }
+
+    WriteScalar(addr, bits);
+}
+
+void MemoryInline::WriteFloat64Slow(uint32_t addr, double val) {
+    // stfd stores the full 64-bit FPR bit pattern - load-bearing for the
+    // fctiwz->stfd->lwz idiom, where the integer result lives in the low word.
+    uint64_t bits;
+    std::memcpy(&bits, &val, sizeof(bits));
+
+    if (IsGpuFifoAddress(addr)) {
+        GX_HLE_FIFO_WriteFloat(static_cast<float>(val));
+        return;
+    }
+    if (IsMmioAddress(addr)) {
+        throw Memory::AccessViolation(addr, sizeof(double), "MMIO write blocked (non-GPU)");
+    }
+
+    WriteScalar(addr, bits);
+}
+
+uint8_t* Memory::GetPointer(uint32_t addr) {
+    return GetPointer(addr, 1);
+}
+
+uint8_t* Memory::GetPointer(uint32_t addr, size_t length) {
+    if (auto* ptr = MemoryInline::GetPointerFast(addr, length)) {
+        return ptr;
+    }
+    auto& region = ResolveRegion(addr, length);
+    auto offset = static_cast<size_t>(addr - region.config.baseAddress);
+    return region.storagePtr + offset;
+}
+
+bool Memory::Contains(uint32_t addr, size_t length) {
+    if (MemoryInline::GetPointerFast(addr, length)) {
+        return true;
+    }
+    // Contains is a membership predicate: callers probe arbitrary guest values
+    // (e.g. gfx-node slots that may hold floats), so a miss must stay silent
+    // rather than take ResolveRegion's crash-dump path.
+    return TryResolveRegion(addr, length) != nullptr;
+}
+
+std::vector<Memory::RegionConfig> Memory::DescribeRegions() {
+    std::lock_guard<std::mutex> lock(RegionMutex());
+    std::vector<RegionConfig> info;
+    info.reserve(Regions().size());
+    for (const auto& region : Regions()) {
+        info.push_back(RegionConfig{region.config.name, region.config.baseAddress, region.storageSize});
+    }
+    return info;
+}
diff --git a/runtime/src/music_attenuation.cpp b/runtime/src/music_attenuation.cpp
new file mode 100644
index 0000000..3b99941
--- /dev/null
+++ b/runtime/src/music_attenuation.cpp
@@ -0,0 +1,306 @@
+#include "music_attenuation.h"
+
+#include "memory.h"
+
+#include <array>
+#include <atomic>
+#include <bit>
+#include <chrono>
+#include <cstdint>
+#include <iostream>
+#include <mutex>
+#include <thread>
+
+#if defined(_WIN32)
+#include <winrt/base.h>
+#include <winrt/Windows.Foundation.h>
+#include <winrt/Windows.Foundation.Collections.h>
+#include <winrt/Windows.Media.Control.h>
+#endif
+
+namespace MusicAttenuation {
+namespace {
+
+constexpr uint32_t kSoundManagerPointer = 0x809C2898u;
+constexpr uint32_t kArchivePlayerOffset = 0x5BCu;
+constexpr uint32_t kSoundPlayersOffset = 0x34u;
+constexpr uint32_t kSoundPlayerVolumeOffset = 0x2Cu;
+constexpr uint32_t kSoundPlayerStride = 0x5Cu;
+// The PAL revo_kart.brsar allocates 12 SoundPlayers, with player 11 being
+// PL_MAX rather than a playable bus. The game's PlayersVolumeMgr likewise
+// owns 11 volume tracks, so the usable buses are players 0 through 10.
+constexpr size_t kSoundPlayerCount = 11;
+
+std::atomic<bool> g_enabled{false};
+std::atomic<bool> g_externalMediaPlaying{false};
+std::atomic<bool> g_mediaControlAvailable{false};
+std::atomic<bool> g_mediaControlInitializationComplete{false};
+std::atomic<float> g_musicVolume{1.0f};
+std::atomic<float> g_soundEffectsVolume{1.0f};
+std::atomic<float> g_uiVolume{1.0f};
+std::atomic<float> g_voicesVolume{1.0f};
+std::once_flag g_monitorStart;
+
+// These fields are touched only from the guest scheduler thread.
+uint32_t g_soundPlayerArray = 0;
+std::array<float, kSoundPlayerCount> g_requestedSoundPlayerVolumes{};
+std::array<float, kSoundPlayerCount> g_lastAppliedSoundPlayerVolumes{};
+std::array<bool, kSoundPlayerCount> g_haveSoundPlayerVolumes{};
+
+float ClampSoundPlayerVolume(float volume) noexcept {
+    // Match nw4r::snd::SoundPlayer::SetVolume at 0x800A35E0 exactly,
+    // including its NaN behavior (unordered compares select the upper bound).
+    if (volume <= 1.0f) {
+        return volume < 0.0f ? 0.0f : volume;
+    }
+    return 1.0f;
+}
+
+bool WriteGuestFloat(uint32_t address, float value) noexcept {
+    try {
+        Memory::Write32(address, std::bit_cast<uint32_t>(value));
+        return true;
+    } catch (const Memory::AccessViolation&) {
+        return false;
+    }
+}
+
+bool ReadGuestFloat(uint32_t address, float& value) noexcept {
+    uint32_t bits = 0;
+    if (!Memory::TryRead32(address, bits)) {
+        return false;
+    }
+    value = std::bit_cast<float>(bits);
+    return true;
+}
+
+uint32_t ResolveSoundPlayerArray() noexcept {
+    uint32_t soundManager = 0;
+    uint32_t archivePlayer = 0;
+    uint32_t soundPlayers = 0;
+    if (!Memory::TryRead32(kSoundManagerPointer, soundManager) || soundManager == 0 ||
+        !Memory::TryRead32(soundManager + kArchivePlayerOffset, archivePlayer) || archivePlayer == 0 ||
+        !Memory::TryRead32(archivePlayer + kSoundPlayersOffset, soundPlayers)) {
+        return 0;
+    }
+
+    // revo_kart.brsar names player 0 YPPL_BGM. Players 1-10 are the
+    // independent UI, object, engine, race, vehicle, and voice players.
+    return soundPlayers;
+}
+
+enum class SoundCategory {
+    Music,
+    SoundEffects,
+    Ui,
+    Voices,
+};
+
+SoundCategory CategoryForPlayer(size_t playerIndex) noexcept {
+    switch (playerIndex) {
+    case 0:
+        return SoundCategory::Music;
+    case 1:
+    case 7:
+        return SoundCategory::Ui;
+    case 8:
+    case 9:
+    case 10:
+        return SoundCategory::Voices;
+    default:
+        return SoundCategory::SoundEffects;
+    }
+}
+
+float CategoryVolume(size_t playerIndex) noexcept {
+    switch (CategoryForPlayer(playerIndex)) {
+    case SoundCategory::Music:
+        return g_musicVolume.load(std::memory_order_acquire);
+    case SoundCategory::SoundEffects:
+        return g_soundEffectsVolume.load(std::memory_order_acquire);
+    case SoundCategory::Ui:
+        return g_uiVolume.load(std::memory_order_acquire);
+    case SoundCategory::Voices:
+        return g_voicesVolume.load(std::memory_order_acquire);
+    }
+    return 1.0f;
+}
+
+bool FindSoundPlayerIndex(uint32_t soundPlayer, uint32_t soundPlayerArray, size_t& playerIndex) noexcept {
+    if (soundPlayer == 0 || soundPlayerArray == 0 || soundPlayer < soundPlayerArray) {
+        return false;
+    }
+    const uint32_t offset = soundPlayer - soundPlayerArray;
+    if (offset % kSoundPlayerStride != 0) {
+        return false;
+    }
+    const size_t index = static_cast<size_t>(offset / kSoundPlayerStride);
+    if (index >= kSoundPlayerCount) {
+        return false;
+    }
+    playerIndex = index;
+    return true;
+}
+
+float AppliedSoundPlayerVolume(size_t playerIndex, float requestedVolume, bool attenuated) noexcept {
+    if (playerIndex == 0 && attenuated) {
+        return 0.0f;
+    }
+    return requestedVolume * CategoryVolume(playerIndex);
+}
+
+bool ShouldAttenuate() noexcept {
+    return g_enabled.load(std::memory_order_acquire) &&
+           g_externalMediaPlaying.load(std::memory_order_acquire);
+}
+
+#if defined(_WIN32)
+void MonitorWindowsMediaSessions() noexcept {
+    using namespace winrt::Windows::Media::Control;
+    using namespace std::chrono_literals;
+
+    try {
+        winrt::init_apartment(winrt::apartment_type::multi_threaded);
+        const auto manager = GlobalSystemMediaTransportControlsSessionManager::RequestAsync().get();
+        g_mediaControlAvailable.store(true, std::memory_order_release);
+        g_mediaControlInitializationComplete.store(true, std::memory_order_release);
+
+        for (;;) {
+            bool playing = false;
+            try {
+                for (const auto& session : manager.GetSessions()) {
+                    const auto info = session.GetPlaybackInfo();
+                    if (info.PlaybackStatus() ==
+                        GlobalSystemMediaTransportControlsSessionPlaybackStatus::Playing) {
+                        playing = true;
+                        break;
+                    }
+                }
+            } catch (const winrt::hresult_error&) {
+                // Sessions can disappear between enumeration and the playback
+                // query. Treat that sample as inactive and retry shortly.
+            }
+            g_externalMediaPlaying.store(playing, std::memory_order_release);
+            std::this_thread::sleep_for(250ms);
+        }
+    } catch (const winrt::hresult_error& error) {
+        g_mediaControlAvailable.store(false, std::memory_order_release);
+        g_externalMediaPlaying.store(false, std::memory_order_release);
+        g_mediaControlInitializationComplete.store(true, std::memory_order_release);
+        std::wcerr << L"[audio] Windows media-session monitoring unavailable: "
+                   << error.message().c_str() << std::endl;
+    }
+}
+#endif
+
+void StartMonitor() noexcept {
+#if defined(_WIN32)
+    // The process owns this monitor for its remaining lifetime. Keeping it
+    // detached avoids shutdown ordering between WinRT and static audio state.
+    std::thread(MonitorWindowsMediaSessions).detach();
+#else
+    g_mediaControlAvailable.store(false, std::memory_order_release);
+    g_mediaControlInitializationComplete.store(true, std::memory_order_release);
+#endif
+}
+
+} // namespace
+
+void SetEnabled(bool enabled) noexcept {
+    if (enabled) {
+        std::call_once(g_monitorStart, StartMonitor);
+    }
+    g_enabled.store(enabled, std::memory_order_release);
+}
+
+bool IsExternalMediaPlaying() noexcept {
+    return g_externalMediaPlaying.load(std::memory_order_acquire);
+}
+
+bool IsMediaControlAvailable() noexcept {
+    return g_mediaControlAvailable.load(std::memory_order_acquire);
+}
+
+bool IsMediaControlInitializationComplete() noexcept {
+    return g_mediaControlInitializationComplete.load(std::memory_order_acquire);
+}
+
+void SetMusicVolume(float volume) noexcept {
+    g_musicVolume.store(ClampSoundPlayerVolume(volume), std::memory_order_release);
+}
+
+void SetSoundEffectsVolume(float volume) noexcept {
+    g_soundEffectsVolume.store(ClampSoundPlayerVolume(volume), std::memory_order_release);
+}
+
+void SetUiVolume(float volume) noexcept {
+    g_uiVolume.store(ClampSoundPlayerVolume(volume), std::memory_order_release);
+}
+
+void SetVoicesVolume(float volume) noexcept {
+    g_voicesVolume.store(ClampSoundPlayerVolume(volume), std::memory_order_release);
+}
+
+void TickGuest() noexcept {
+    const bool attenuated = ShouldAttenuate();
+    const uint32_t soundPlayerArray = ResolveSoundPlayerArray();
+    if (soundPlayerArray == 0) {
+        g_soundPlayerArray = 0;
+        g_haveSoundPlayerVolumes.fill(false);
+        return;
+    }
+
+    if (soundPlayerArray != g_soundPlayerArray) {
+        g_soundPlayerArray = soundPlayerArray;
+        g_haveSoundPlayerVolumes.fill(false);
+    }
+
+    for (size_t playerIndex = 0; playerIndex < kSoundPlayerCount; ++playerIndex) {
+        const uint32_t soundPlayer = soundPlayerArray + static_cast<uint32_t>(playerIndex) * kSoundPlayerStride;
+        float currentVolume = 0.0f;
+        if (!ReadGuestFloat(soundPlayer + kSoundPlayerVolumeOffset, currentVolume)) {
+            continue;
+        }
+
+        // Direct/generated stores can bypass the SetVolume override. When the
+        // observed value is not the value last written by this layer, treat it
+        // as the game's new base volume and multiply it on the way out. This
+        // also preserves the requested BGM volume while it is muted at zero.
+        if (!g_haveSoundPlayerVolumes[playerIndex] ||
+            currentVolume != g_lastAppliedSoundPlayerVolumes[playerIndex]) {
+            g_requestedSoundPlayerVolumes[playerIndex] = ClampSoundPlayerVolume(currentVolume);
+            g_haveSoundPlayerVolumes[playerIndex] = true;
+        }
+
+        const float applied = AppliedSoundPlayerVolume(
+            playerIndex, g_requestedSoundPlayerVolumes[playerIndex], attenuated);
+        if (currentVolume != applied &&
+            WriteGuestFloat(soundPlayer + kSoundPlayerVolumeOffset, applied)) {
+            g_lastAppliedSoundPlayerVolumes[playerIndex] = applied;
+        } else if (currentVolume == applied) {
+            g_lastAppliedSoundPlayerVolumes[playerIndex] = applied;
+        }
+    }
+}
+
+void SetSoundPlayerVolume(uint32_t soundPlayer, float requestedVolume) {
+    const float clamped = ClampSoundPlayerVolume(requestedVolume);
+    float applied = clamped;
+    const uint32_t soundPlayerArray = ResolveSoundPlayerArray();
+    size_t playerIndex = 0;
+    if (FindSoundPlayerIndex(soundPlayer, soundPlayerArray, playerIndex)) {
+        if (soundPlayerArray != g_soundPlayerArray) {
+            g_soundPlayerArray = soundPlayerArray;
+            g_haveSoundPlayerVolumes.fill(false);
+        }
+        g_requestedSoundPlayerVolumes[playerIndex] = clamped;
+        g_haveSoundPlayerVolumes[playerIndex] = true;
+        applied = AppliedSoundPlayerVolume(playerIndex, clamped, ShouldAttenuate());
+        g_lastAppliedSoundPlayerVolumes[playerIndex] = applied;
+    }
+    // Preserve the original function's access semantics. An invalid player is
+    // a guest bug and must not be converted into a silent successful call.
+    Memory::Write32(soundPlayer + kSoundPlayerVolumeOffset, std::bit_cast<uint32_t>(applied));
+}
+
+} // namespace MusicAttenuation
diff --git a/runtime/src/ppc_helpers.cpp b/runtime/src/ppc_helpers.cpp
new file mode 100644
index 0000000..06e8488
--- /dev/null
+++ b/runtime/src/ppc_helpers.cpp
@@ -0,0 +1,932 @@
+#include "ppc_runtime.h"
+// ppc_runtime.h re-exports the rest of the ISA package; the CR tier is pulled in
+// by abi_bridge.h for generated code, so this TU asks for it directly.
+#include "isa/ppc_isa_cr.h"
+#include "memory.h"
+#include "runtime_log.h"
+#include "timebase_contract.h"
+
+#include <array>
+#include <bitset>
+#include <chrono>
+#include <cmath>
+#include <cstdint>
+#include <cstdlib>
+#include <stdexcept>
+#include <limits>
+
+
+extern "C" void PPC_TrapWord(uint32_t trapOptions, uint32_t lhs, uint32_t rhs)
+{
+    const bool trap =
+        ((trapOptions & 0x10u) != 0u && static_cast<int32_t>(lhs) < static_cast<int32_t>(rhs)) ||
+        ((trapOptions & 0x08u) != 0u && static_cast<int32_t>(lhs) > static_cast<int32_t>(rhs)) ||
+        ((trapOptions & 0x04u) != 0u && lhs == rhs) ||
+        ((trapOptions & 0x02u) != 0u && lhs < rhs) ||
+        ((trapOptions & 0x01u) != 0u && lhs > rhs);
+    if (trap)
+    {
+        throw std::runtime_error("PowerPC trap condition fired");
+    }
+}
+
+namespace {
+
+constexpr uint32_t kBroadwayPvr = 0x00087200u; // Known PVR value for Wii's Broadway CPU.
+
+// One warning per (SPR, direction). A bitset rather than bool arrays: an
+// unhandled SPR is a real translation gap worth reporting once per SPR, but the
+// dedup state has no business costing 4 KiB of .bss.
+std::bitset<2048> g_warnedSprRead{};
+std::bitset<2048> g_warnedSprWrite{};
+std::array<uint32_t, 2048> g_sprShadow{};
+uint32_t g_reservationAddr = 0;
+bool g_hasReservation = false;
+const auto g_timeBaseStart = std::chrono::steady_clock::now();
+
+uint64_t GetTimeBase() {
+    const auto elapsed = std::chrono::steady_clock::now() - g_timeBaseStart;
+    const auto nanoseconds =
+        std::chrono::duration_cast<std::chrono::nanoseconds>(elapsed).count();
+    return TimeBaseContract::NanosecondsToTicks(static_cast<uint64_t>(nanoseconds));
+}
+
+constexpr uint32_t kFpscrFx = 1u << 31;
+constexpr uint32_t kFpscrFex = 1u << 30;
+constexpr uint32_t kFpscrVx = 1u << 29;
+constexpr uint32_t kFpscrOx = 1u << 28;
+constexpr uint32_t kFpscrUx = 1u << 27;
+constexpr uint32_t kFpscrZx = 1u << 26;
+constexpr uint32_t kFpscrXx = 1u << 25;
+constexpr uint32_t kFpscrVxSnan = 1u << 24;
+constexpr uint32_t kFpscrVxIsi = 1u << 23;
+constexpr uint32_t kFpscrVxIdi = 1u << 22;
+constexpr uint32_t kFpscrVxZdz = 1u << 21;
+constexpr uint32_t kFpscrVxImz = 1u << 20;
+constexpr uint32_t kFpscrVxVc = 1u << 19;
+constexpr uint32_t kFpscrVxSoft = 1u << 10;
+constexpr uint32_t kFpscrVxSqrt = 1u << 9;
+constexpr uint32_t kFpscrVxCvi = 1u << 8;
+constexpr uint32_t kFpscrVe = 1u << 7;
+constexpr uint32_t kFpscrOe = 1u << 6;
+constexpr uint32_t kFpscrUe = 1u << 5;
+constexpr uint32_t kFpscrZe = 1u << 4;
+constexpr uint32_t kFpscrXe = 1u << 3;
+constexpr uint32_t kFpscrVxAny =
+    kFpscrVxSnan | kFpscrVxIsi | kFpscrVxIdi | kFpscrVxZdz | kFpscrVxImz |
+    kFpscrVxVc | kFpscrVxSoft | kFpscrVxSqrt | kFpscrVxCvi;
+constexpr uint32_t kFpscrAnyX = kFpscrOx | kFpscrUx | kFpscrZx | kFpscrXx | kFpscrVxAny;
+constexpr uint32_t kFpscrAnyE = kFpscrVe | kFpscrOe | kFpscrUe | kFpscrZe | kFpscrXe;
+
+template <size_t N>
+inline void WarnOnce(std::bitset<N>& warned, uint32_t spr, const char* op)
+{
+    if (spr < N)
+    {
+        if (warned.test(spr))
+        {
+            return;
+        }
+        warned.set(spr);
+    }
+    RT_LOG(RT_TAG_RUNTIME) << "PPC_" << op << " unhandled SPR " << spr << " (defaulting to 0)" << std::endl;
+}
+
+
+
+inline void UpdateFpscrSummary(CpuContext* cpu)
+{
+    if (!cpu)
+    {
+        return;
+    }
+
+    if ((cpu->fpscr & kFpscrVxAny) != 0)
+    {
+        cpu->fpscr |= kFpscrVx;
+    }
+    else
+    {
+        cpu->fpscr &= ~kFpscrVx;
+    }
+
+    if (((cpu->fpscr >> 22) & (cpu->fpscr & kFpscrAnyE)) != 0)
+    {
+        cpu->fpscr |= kFpscrFex;
+    }
+    else
+    {
+        cpu->fpscr &= ~kFpscrFex;
+    }
+}
+
+} // namespace
+
+extern "C" uint32_t PPC_UpdateCarryAdd(uint32_t lhs, uint32_t rhs, uint32_t carryIn)
+{
+    const uint64_t sum = static_cast<uint64_t>(lhs) + static_cast<uint64_t>(rhs) + static_cast<uint64_t>(carryIn & 1u);
+    const uint32_t carryOut = static_cast<uint32_t>((sum >> 32) & 1u);
+    CpuContext* cpu = TryGetCpuContext();
+    if (cpu)
+    {
+        cpu->xer = (cpu->xer & ~0x20000000u) | (carryOut << 29);
+        return cpu->xer;
+    }
+
+    return carryOut << 29;
+}
+
+extern "C" uint32_t PPC_UpdateCarrySub(uint32_t lhs, uint32_t rhs)
+{
+    // Carry flag is set when no borrow occurs (i.e., lhs >= rhs).
+    const uint32_t carryOut = lhs >= rhs ? 1u : 0u;
+    CpuContext* cpu = TryGetCpuContext();
+    if (cpu)
+    {
+        cpu->xer = (cpu->xer & ~0x20000000u) | (carryOut << 29);
+        return cpu->xer;
+    }
+
+    return carryOut << 29;
+}
+
+extern "C" uint32_t PPC_UpdateCarryShiftRight(uint32_t value, uint32_t shift)
+{
+    uint32_t carryOut = 0;
+
+    // Per Broadway docs: CA is set if value is NEGATIVE and any 1 bits shifted out
+    const bool isNegative = (value & 0x80000000u) != 0;
+
+    if ((shift & 0x20u) != 0)
+    {
+        carryOut = isNegative ? 1u : 0u;
+    }
+    else
+    {
+        const uint32_t sh = shift & 31u;
+        if (sh != 0 && isNegative)
+        {
+            const uint32_t mask = (1u << sh) - 1u;
+            carryOut = (value & mask) ? 1u : 0u;
+        }
+    }
+
+    CpuContext* cpu = TryGetCpuContext();
+    if (cpu)
+    {
+        cpu->xer = (cpu->xer & ~0x20000000u) | (carryOut << 29);
+        return cpu->xer;
+    }
+
+    return carryOut << 29;
+}
+
+extern "C" uint32_t PPC_GetCarry()
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        return 0;
+    }
+    return (cpu->xer >> 29) & 1u;
+}
+
+static void UpdateOverflow(uint32_t result, bool overflow)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        return;
+    }
+
+    if (overflow)
+    {
+        cpu->xer |= 0xC0000000u; // SO and OV.
+    }
+    else
+    {
+        cpu->xer &= ~0x40000000u; // Clear OV, preserve SO.
+    }
+    (void)result;
+}
+
+static uint32_t AddWithXer(uint32_t lhs, uint32_t rhs, uint32_t carryIn, bool updateCarry)
+{
+    const uint64_t wide = static_cast<uint64_t>(lhs) + static_cast<uint64_t>(rhs) + static_cast<uint64_t>(carryIn & 1u);
+    const uint32_t result = static_cast<uint32_t>(wide);
+    const bool overflow = ((~(lhs ^ rhs) & (lhs ^ result)) & 0x80000000u) != 0;
+    if (updateCarry)
+    {
+        PPC_UpdateCarryAdd(lhs, rhs, carryIn);
+    }
+    UpdateOverflow(result, overflow);
+    return result;
+}
+
+static uint32_t SubfWithXer(uint32_t subtrahend, uint32_t minuend, uint32_t carryIn, bool extended, bool updateCarry)
+{
+    const uint32_t rhs = ~subtrahend;
+    const uint64_t wide = static_cast<uint64_t>(rhs) + static_cast<uint64_t>(minuend) + static_cast<uint64_t>(extended ? (carryIn & 1u) : 1u);
+    const uint32_t result = static_cast<uint32_t>(wide);
+    const bool overflow = (((minuend ^ subtrahend) & (minuend ^ result)) & 0x80000000u) != 0;
+    if (updateCarry)
+    {
+        CpuContext* cpu = TryGetCpuContext();
+        const uint32_t carryOut = static_cast<uint32_t>((wide >> 32) & 1u);
+        if (cpu)
+        {
+            cpu->xer = (cpu->xer & ~0x20000000u) | (carryOut << 29);
+        }
+    }
+    UpdateOverflow(result, overflow);
+    return result;
+}
+
+extern "C" uint32_t PPC_Addo(uint32_t lhs, uint32_t rhs) { return AddWithXer(lhs, rhs, 0, false); }
+extern "C" uint32_t PPC_Addco(uint32_t lhs, uint32_t rhs) { return AddWithXer(lhs, rhs, 0, true); }
+extern "C" uint32_t PPC_Addeo(uint32_t lhs, uint32_t rhs) { return AddWithXer(lhs, rhs, PPC_GetCarry(), true); }
+extern "C" uint32_t PPC_Addmeo(uint32_t value) { return AddWithXer(value, 0xFFFFFFFFu, PPC_GetCarry(), true); }
+extern "C" uint32_t PPC_Addzeo(uint32_t value) { return AddWithXer(value, 0, PPC_GetCarry(), true); }
+extern "C" uint32_t PPC_Subfo(uint32_t subtrahend, uint32_t minuend) { return SubfWithXer(subtrahend, minuend, 0, false, false); }
+extern "C" uint32_t PPC_Subfco(uint32_t subtrahend, uint32_t minuend) { return SubfWithXer(subtrahend, minuend, 0, false, true); }
+extern "C" uint32_t PPC_Subfeo(uint32_t subtrahend, uint32_t minuend) { return SubfWithXer(subtrahend, minuend, PPC_GetCarry(), true, true); }
+extern "C" uint32_t PPC_Subfmeo(uint32_t value) { return SubfWithXer(value, 0xFFFFFFFFu, PPC_GetCarry(), true, true); }
+extern "C" uint32_t PPC_Subfzeo(uint32_t value) { return SubfWithXer(value, 0, PPC_GetCarry(), true, true); }
+extern "C" uint32_t PPC_Nego(uint32_t value) { return SubfWithXer(value, 0, 0, false, false); }
+
+extern "C" uint32_t PPC_Mullwo(uint32_t lhs, uint32_t rhs)
+{
+    const int64_t product = static_cast<int64_t>(static_cast<int32_t>(lhs)) * static_cast<int64_t>(static_cast<int32_t>(rhs));
+    const uint32_t result = static_cast<uint32_t>(product);
+    UpdateOverflow(result, product < std::numeric_limits<int32_t>::min() || product > std::numeric_limits<int32_t>::max());
+    return result;
+}
+
+extern "C" uint32_t PPC_Divwo(uint32_t lhs, uint32_t rhs)
+{
+    const int32_t dividend = static_cast<int32_t>(lhs);
+    const int32_t divisor = static_cast<int32_t>(rhs);
+    if (divisor == 0 || (dividend == std::numeric_limits<int32_t>::min() && divisor == -1))
+    {
+        const uint32_t result = dividend < 0 ? 0xFFFFFFFFu : 0u;
+        UpdateOverflow(result, true);
+        return result;
+    }
+    const uint32_t result = static_cast<uint32_t>(dividend / divisor);
+    UpdateOverflow(result, false);
+    return result;
+}
+
+extern "C" uint32_t PPC_Divwuo(uint32_t lhs, uint32_t rhs)
+{
+    if (rhs == 0)
+    {
+        UpdateOverflow(0, true);
+        return 0;
+    }
+    const uint32_t result = lhs / rhs;
+    UpdateOverflow(result, false);
+    return result;
+}
+
+static void LoadString(uint32_t rD, uint32_t addr, uint32_t byteCount)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        return;
+    }
+
+    uint32_t reg = rD & 31u;
+    uint32_t current = 0;
+    for (uint32_t i = 0; i < byteCount; ++i)
+    {
+        current = (current << 8) | Memory::Read8(addr + i);
+        if ((i & 3u) == 3u)
+        {
+            cpu->gpr[reg] = current;
+            reg = (reg + 1u) & 31u;
+            current = 0;
+        }
+    }
+
+    const uint32_t partial = byteCount & 3u;
+    if (partial != 0)
+    {
+        cpu->gpr[reg] = current << ((4u - partial) * 8u);
+    }
+}
+
+static void StoreString(uint32_t rS, uint32_t addr, uint32_t byteCount)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        return;
+    }
+
+    uint32_t reg = rS & 31u;
+    for (uint32_t i = 0; i < byteCount; ++i)
+    {
+        const uint32_t shift = 24u - ((i & 3u) * 8u);
+        Memory::Write8(addr + i, static_cast<uint8_t>(cpu->gpr[reg] >> shift));
+        if ((i & 3u) == 3u)
+        {
+            reg = (reg + 1u) & 31u;
+        }
+    }
+}
+
+extern "C" void PPC_Lswi(uint32_t rD, uint32_t addr, uint32_t byteCount) { LoadString(rD, addr, byteCount == 0 ? 32u : byteCount); }
+extern "C" void PPC_Lswx(uint32_t rD, uint32_t addr)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    LoadString(rD, addr, cpu ? (cpu->xer & 0x7Fu) : 0u);
+}
+extern "C" void PPC_Stswi(uint32_t rS, uint32_t addr, uint32_t byteCount) { StoreString(rS, addr, byteCount == 0 ? 32u : byteCount); }
+extern "C" void PPC_Stswx(uint32_t rS, uint32_t addr)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    StoreString(rS, addr, cpu ? (cpu->xer & 0x7Fu) : 0u);
+}
+
+extern "C" uint32_t PPC_Lwarx(uint32_t addr)
+{
+    g_reservationAddr = addr;
+    g_hasReservation = true;
+    return Memory::Read32(addr);
+}
+
+extern "C" uint32_t PPC_Stwcx(uint32_t addr, uint32_t value)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    const bool success = g_hasReservation && g_reservationAddr == addr;
+    g_hasReservation = false;
+    if (success)
+    {
+        Memory::Write32(addr, value);
+    }
+    if (cpu)
+    {
+        const uint32_t so = (cpu->xer >> 31) & 1u;
+        const uint32_t cr0 = (success ? 0x2u : 0u) | so;
+        cpu->cr = (cpu->cr & 0x0FFFFFFFu) | (cr0 << 28);
+    }
+    return success ? 1u : 0u;
+}
+
+extern "C" uint32_t PPC_Mcrfs(uint32_t dstField, uint32_t srcField)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        return 0;
+    }
+
+    const uint32_t dst = dstField & 7u;
+    const uint32_t src = srcField & 7u;
+    const uint32_t value = (cpu->fpscr >> ((7u - src) * 4u)) & 0xFu;
+    cpu->cr = (cpu->cr & ~(0xFu << ((7u - dst) * 4u))) | (value << ((7u - dst) * 4u));
+    cpu->fpscr &= ~((0xFu << ((7u - src) * 4u)) & (kFpscrFx | kFpscrAnyX));
+    UpdateFpscrSummary(cpu);
+    return cpu->cr;
+}
+
+extern "C" uint32_t PPC_Eciwx(uint32_t addr)
+{
+    (void)addr;
+    throw std::runtime_error("eciwx attempted external control/MMIO read");
+}
+
+extern "C" uint32_t PPC_Mftb()
+{
+    return static_cast<uint32_t>(GetTimeBase());
+}
+
+extern "C" uint32_t PPC_Mftbu()
+{
+    return static_cast<uint32_t>(GetTimeBase() >> 32);
+}
+
+extern "C" uint32_t OSSystemCall()
+{
+    return 0;
+}
+
+extern "C" void PPC_Ecowx(uint32_t addr, uint32_t value)
+{
+    (void)addr;
+    (void)value;
+    throw std::runtime_error("ecowx attempted external control/MMIO write");
+}
+
+extern "C" uint32_t PPC_Mcrxr(uint32_t crField)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        return 0;
+    }
+
+    const uint32_t field = crField & 7u;
+    const uint32_t value = (cpu->xer >> 28) & 0xFu;
+    const uint32_t shift = (7u - field) * 4u;
+    cpu->cr = (cpu->cr & ~(0xFu << shift)) | (value << shift);
+    cpu->xer &= ~0xF0000000u;
+    return cpu->cr;
+}
+
+extern "C" uint32_t PPC_ReadSpr(uint32_t spr)
+{
+    CpuContext* cpu = TryGetCpuContext();
+
+    // Preserve previously written values for unknown SPRs so that callers see what they set.
+    auto shadowValue = [&]() -> uint32_t
+    {
+        if (spr < g_sprShadow.size())
+        {
+            return g_sprShadow[spr];
+        }
+        return 0u;
+    };
+
+    if (spr >= 912u && spr <= 919u)
+    {
+        return cpu ? cpu->gqr[spr - 912u] : 0u;
+    }
+
+    switch (spr)
+    {
+        case 8: return cpu ? cpu->lr : 0u;
+        case 9: return cpu ? cpu->ctr : 0u;
+        case 1: return cpu ? cpu->xer : 0u;
+        case 22: return shadowValue(); // DEC - emulate as latched value
+        case 26: return cpu ? cpu->srr0 : 0u;
+        case 27: return cpu ? cpu->srr1 : 0u;
+        case 268: return PPC_Mftb();
+        case 269: return PPC_Mftbu();
+        case 287: return kBroadwayPvr; // PVR
+        case 920: return cpu ? cpu->hid2 : 0u;
+        case 1008: return cpu ? cpu->hid0 : 0u;
+        case 1009: return cpu ? cpu->hid1 : 0u;
+        case 1011: return shadowValue(); // spr3f3 in TRK save block
+        case 1017: return shadowValue(); // DMA/L2 ancillary SPRs (preserve writes)
+        case 952:  // PM registers - preserve writes
+        case 953:
+        case 954:
+        case 956:
+        case 957:
+        case 958:
+            return shadowValue();
+        default:
+            WarnOnce(g_warnedSprRead, spr, "ReadSpr");
+            return shadowValue();
+    }
+}
+
+extern "C" void PPC_WriteSpr(uint32_t spr, uint32_t value)
+{
+    CpuContext* cpu = TryGetCpuContext();
+
+    if (spr >= 912u && spr <= 919u)
+    {
+        if (cpu)
+        {
+            cpu->gqr[spr - 912u] = value;
+        }
+        return;
+    }
+
+    switch (spr)
+    {
+        case 8: if (cpu) cpu->lr = value; return;
+        case 9: if (cpu) cpu->ctr = value; return;
+        case 1: if (cpu) cpu->xer = value; return;
+        case 22: break; // DEC - fallthrough to shadow
+        case 26: if (cpu) cpu->srr0 = value; return;
+        case 27: if (cpu) cpu->srr1 = value; return;
+        case 920: if (cpu) cpu->hid2 = value; return;
+        case 1008: if (cpu) cpu->hid0 = value; return;
+        case 1009: if (cpu) cpu->hid1 = value; return;
+        case 1011: break;
+        case 1017: break;
+        case 952:  // PM registers - preserve values
+        case 953:
+        case 954:
+        case 956:
+        case 957:
+        case 958:
+            break;
+        default:
+            WarnOnce(g_warnedSprWrite, spr, "WriteSpr");
+            break;
+    }
+
+    if (spr < g_sprShadow.size())
+    {
+        g_sprShadow[spr] = value;
+    }
+}
+
+extern "C" uint32_t PPC_Cntlzw(uint32_t value)
+{
+    // cntlzw returns 32 when the input is zero; __builtin_clz is undefined in that case.
+    if (value == 0)
+    {
+        return 32u;
+    }
+    return static_cast<uint32_t>(__builtin_clz(value));
+}
+
+// The CR semantics themselves live in isa/ppc_isa_cr.h, which is what generated
+// code calls (Ppc*Resident on a register-resident CR). These out-of-line forms
+// exist only for the !hasDest lifter path and must not re-implement them.
+extern "C" uint32_t PPC_CrSetBit(uint32_t bitIndex, uint32_t value)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        return 0;
+    }
+
+    cpu->cr = PpcCrSetBitResident(cpu->cr, bitIndex, value);
+    return cpu->cr;
+}
+
+extern "C" uint32_t PPC_CrLogical(uint32_t op, uint32_t bt, uint32_t ba, uint32_t bb)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        return 0;
+    }
+
+    cpu->cr = PpcCrLogicalResident(cpu->cr, op, bt, ba, bb);
+    return cpu->cr;
+}
+
+extern "C" uint32_t PPC_Mcrf(uint32_t dstField, uint32_t srcField)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        return 0;
+    }
+
+    cpu->cr = PpcMcrfResident(cpu->cr, dstField, srcField);
+    return cpu->cr;
+}
+
+extern "C" double PPC_PsAdd(double lhs, double rhs)
+{
+    return PPC_PsAddInline(lhs, rhs);
+}
+
+extern "C" double PPC_PsSub(double lhs, double rhs)
+{
+    return PPC_PsSubInline(lhs, rhs);
+}
+
+extern "C" double PPC_PsDiv(double lhs, double rhs)
+{
+    return PPC_PsDivInline(lhs, rhs);
+}
+
+extern "C" double PPC_PsNeg(double value)
+{
+    return PPC_PsNegInline(value);
+}
+
+extern "C" double PPC_PsMul(double lhs, double rhs)
+{
+    return PPC_PsMulInline(lhs, rhs);
+}
+
+extern "C" double PPC_PsMsub(double multiplicand, double multiplier, double subtractor)
+{
+    return PPC_PsMsubInline(multiplicand, multiplier, subtractor);
+}
+
+extern "C" double PPC_PsMadd(double multiplicand, double multiplier, double addend)
+{
+    return PPC_PsMaddInline(multiplicand, multiplier, addend);
+}
+
+// ps_madds0: frD[ps0] = frA[ps0] * frC[ps0] + frB[ps0], frD[ps1] = frA[ps1] * frC[ps0] + frB[ps1]
+// Uses frC[ps0] as a scalar multiplier for both lanes
+extern "C" double PPC_PsMadds0(double multiplicand, double multiplier, double addend)
+{
+    return PPC_PsMadds0Inline(multiplicand, multiplier, addend);
+}
+
+// ps_madds1: frD[ps0] = frA[ps0] * frC[ps1] + frB[ps0], frD[ps1] = frA[ps1] * frC[ps1] + frB[ps1]
+// Uses frC[ps1] as a scalar multiplier for both lanes
+extern "C" double PPC_PsMadds1(double multiplicand, double multiplier, double addend)
+{
+    return PPC_PsMadds1Inline(multiplicand, multiplier, addend);
+}
+
+extern "C" double PPC_PsNmsub(double multiplicand, double multiplier, double subtractor)
+{
+    return PPC_PsNmsubInline(multiplicand, multiplier, subtractor);
+}
+
+extern "C" double PPC_PsNmadd(double multiplicand, double multiplier, double addend)
+{
+    return PPC_PsNmaddInline(multiplicand, multiplier, addend);
+}
+
+extern "C" double PPC_PsSel(double lhs, double control, double rhs)
+{
+    // Dolphin models fsel/ps_sel as "fra >= -0.0 ? frC : frB".
+    // That comparison deliberately sends unordered/NaN controls to frB.
+    return PPC_PsSelInline(lhs, control, rhs);
+}
+
+// PPC_PsRes is defined extern "C" inline in ppc_runtime.h (hot in THP dequant).
+
+extern "C" double PPC_PsRsqrte(double value)
+{
+    return PpcPackPairedInline(
+        static_cast<float>(PpcApproximateReciprocalSquareRootInline(
+            static_cast<double>(PpcGetPs0Inline(value)))),
+        static_cast<float>(PpcApproximateReciprocalSquareRootInline(
+            static_cast<double>(PpcGetPs1Inline(value)))));
+}
+
+extern "C" double PPC_PsFromScalar(double value)
+{
+    return PPC_PsFromScalarInline(value);
+}
+
+extern "C" double PPC_PsToScalar(double value)
+{
+    return PPC_PsToScalarInline(value);
+}
+
+extern "C" double PPC_PsMerge00(double a, double b)
+{
+    return PPC_PsMerge00Inline(a, b);
+}
+
+extern "C" double PPC_PsMerge01(double a, double b)
+{
+    return PPC_PsMerge01Inline(a, b);
+}
+
+extern "C" double PPC_PsMerge10(double a, double b)
+{
+    return PPC_PsMerge10Inline(a, b);
+}
+
+extern "C" double PPC_PsMerge11(double a, double b)
+{
+    return PPC_PsMerge11Inline(a, b);
+}
+
+extern "C" double PPC_PsSum0(double a, double b, double c)
+{
+    return PPC_PsSum0Inline(a, b, c);
+}
+
+extern "C" double PPC_PsSum1(double a, double b, double c)
+{
+    return PPC_PsSum1Inline(a, b, c);
+}
+
+extern "C" double PPC_PsMuls0(double a, double c)
+{
+    return PPC_PsMuls0Inline(a, c);
+}
+
+extern "C" double PPC_PsMuls1(double a, double c)
+{
+    return PPC_PsMuls1Inline(a, c);
+}
+
+extern "C" double PPC_PsAbs(double value)
+{
+    return PPC_PsAbsInline(value);
+}
+
+extern "C" double PPC_Fsqrt(double value)
+{
+    return std::sqrt(value);
+}
+
+// PPC_Fres, PPC_Frsqrte and PPC_Fsel are now defined inline in ppc_runtime.h:
+// they are emitted at ~1,100 translated sites between them and an out-of-line
+// definition made each one a full caller-saved register barrier (there is no
+// LTO in this build). The bodies moved verbatim; ApproximateReciprocalSquareRoot
+// below is retained because PPC_PsRsqrte still uses it.
+
+extern "C" double PPC_Fmadd(double multiplicand, double multiplier, double addend)
+{
+    return PpcFmaddInline(multiplicand, multiplier, addend);
+}
+
+extern "C" double PPC_Fmsub(double multiplicand, double multiplier, double subtractor)
+{
+    return PpcFmsubInline(multiplicand, multiplier, subtractor);
+}
+
+extern "C" double PPC_Fnmadd(double multiplicand, double multiplier, double addend)
+{
+    return PpcFnmaddInline(multiplicand, multiplier, addend);
+}
+
+extern "C" double PPC_Fnmsub(double multiplicand, double multiplier, double subtractor)
+{
+    return PpcFnmsubInline(multiplicand, multiplier, subtractor);
+}
+
+// Single-precision scalar helpers.
+// PowerPC "single" ops perform the arithmetic in full precision and then round
+// the result to single-precision. Converting operands to float first can lose
+// critical low bits (e.g., integer->float via 0x4330 trick), yielding zeros.
+extern "C" double PPC_Fadds(double a, double b)
+{
+    const float res = PpcForceSingleValueInline(a + b);
+    return static_cast<double>(res);
+}
+
+extern "C" double PPC_Fsubs(double a, double b)
+{
+    const float res = PpcForceSingleValueInline(a - b);
+    return static_cast<double>(res);
+}
+
+extern "C" double PPC_Fmuls(double a, double b)
+{
+    return PpcFmulsInline(a, b);
+}
+
+extern "C" double PPC_Fdivs(double a, double b)
+{
+    const float res = PpcForceSingleValueInline(a / b);
+    return static_cast<double>(res);
+}
+
+// PPC_Fmadds / PPC_Fmsubs / PPC_Fnmadds / PPC_Fnmsubs are defined inline in
+// ppc_runtime.h for the same reason as PPC_Fsel above: the out-of-line wrapper
+// around the already-inline body was itself the register barrier.
+
+extern "C" uint32_t PPC_LoadWordByteReverse(uint32_t addr)
+{
+    // lwbrx: Load Word Byte-Reverse Indexed
+    // Loads a 32-bit word from memory and byte-swaps it
+    uint32_t value = Memory::Read32(addr);
+    
+    // Byte-swap: ABCD -> DCBA
+    return ((value >> 24) & 0x000000FF) |
+           ((value >> 8)  & 0x0000FF00) |
+           ((value << 8)  & 0x00FF0000) |
+           ((value << 24) & 0xFF000000);
+}
+
+extern "C" void PPC_StoreWordByteReverse(uint32_t addr, uint32_t value)
+{
+    // stwbrx: Store Word Byte-Reverse Indexed
+    // Byte-swaps a 32-bit value and stores it to memory
+    // Byte-swap: ABCD -> DCBA
+    uint32_t swapped = ((value >> 24) & 0x000000FF) |
+                       ((value >> 8)  & 0x0000FF00) |
+                       ((value << 8)  & 0x00FF0000) |
+                       ((value << 24) & 0xFF000000);
+    
+    Memory::Write32(addr, swapped);
+}
+
+extern "C" uint32_t PPC_LoadHalfwordByteReverse(uint32_t addr)
+{
+    // lhbrx: Load Halfword Byte-Reverse Indexed
+    // Loads a 16-bit halfword from memory and byte-swaps it, zero-extending to 32 bits
+    uint16_t value = Memory::Read16(addr);
+    
+    // Byte-swap: AB -> BA
+    uint16_t swapped = ((value >> 8) & 0x00FF) |
+                       ((value << 8) & 0xFF00);
+    return static_cast<uint32_t>(swapped);
+}
+
+extern "C" void PPC_StoreHalfwordByteReverse(uint32_t addr, uint32_t value)
+{
+    // sthbrx: Store Halfword Byte-Reverse Indexed
+    // Byte-swaps the lower 16 bits of the value and stores it to memory
+    uint16_t halfword = static_cast<uint16_t>(value & 0xFFFF);
+    
+    // Byte-swap: AB -> BA
+    uint16_t swapped = ((halfword >> 8) & 0x00FF) |
+                       ((halfword << 8) & 0xFF00);
+    Memory::Write16(addr, swapped);
+}
+
+// psq_l / psq_st with a runtime GQR index. The lifter only reaches these when
+// w/i are non-constant, which never happens in this DOL - every emitted site is
+// rewritten to the isa templates in ppc_isa_quantized.h. The bodies below defer
+// to the same isa runtime-GQR dispatch so the two can never drift.
+extern "C" double PPC_PsqL(uint32_t addr, uint32_t w, uint32_t i)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu) {
+        std::abort();  // CpuContext must never be null in PPC_PsqL
+    }
+
+    const uint32_t gqr = cpu->gqr[i & 7];
+    return w == 0 ? PPC_PsqLStateFallback<0u, 0u, false>(gqr, addr)
+                  : PPC_PsqLStateFallback<1u, 0u, false>(gqr, addr);
+}
+
+extern "C" void PPC_PsqSt(uint32_t addr, double value, uint32_t w, uint32_t i)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu)
+    {
+        std::abort();
+    }
+
+    const uint32_t gqr = cpu->gqr[i & 7];
+    if (w == 0)
+    {
+        PPC_PsqStStateFallback<0u, 0u, false>(gqr, addr, value);
+    }
+    else
+    {
+        PPC_PsqStStateFallback<1u, 0u, false>(gqr, addr, value);
+    }
+}
+
+extern "C" int32_t memset_zero_32(int32_t address)
+{
+    // dcbz zeros a 32-byte block.
+    // The translator aligns the address to 32 bytes before calling this.
+    try {
+        // Try fast path: get direct pointer to memory
+        uint8_t* ptr = Memory::GetPointer(static_cast<uint32_t>(address), 32);
+        std::memset(ptr, 0, 32);
+    } catch (...) {
+        // Fallback or MMIO (rare for dcbz): write using scalar helpers
+        uint32_t addr = static_cast<uint32_t>(address);
+        for (int i = 0; i < 8; ++i) {
+             Memory::Write32(addr + i * 4, 0);
+        }
+    }
+    return 0;
+}
+
+// Floating-point comparison (fcmpu/fcmpo)
+// Sets the specified CR field based on comparing two double values.
+extern "C" void PPC_Fcmp(uint32_t crField, double a, double b)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu) {
+        return;
+    }
+    SetCRFloat(cpu, crField & 7, a, b);
+}
+
+// ps_cmpo and ps_cmpu differ only in which FPSCR invalid-operation bit a NaN
+// operand raises (VXVC vs VXSNAN). This runtime never models FPSCR exception
+// bits from a compare - SetCRFloat writes the CR field and nothing else - so the
+// ordered and unordered forms are deliberately the same body. If FPSCR exception
+// state ever becomes observable, these four need to diverge.
+extern "C" void PPC_PsCmpo0(uint32_t crField, double a, double b)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu) {
+        return;
+    }
+    SetCRFloat(cpu, crField & 7, PpcGetPs0Inline(a), PpcGetPs0Inline(b));
+}
+
+extern "C" void PPC_PsCmpu0(uint32_t crField, double a, double b)
+{
+    PPC_PsCmpo0(crField, a, b);
+}
+
+extern "C" void PPC_PsCmpo1(uint32_t crField, double a, double b)
+{
+    CpuContext* cpu = TryGetCpuContext();
+    if (!cpu) {
+        return;
+    }
+    SetCRFloat(cpu, crField & 7, PpcGetPs1Inline(a), PpcGetPs1Inline(b));
+}
+
+extern "C" void PPC_PsCmpu1(uint32_t crField, double a, double b)
+{
+    PPC_PsCmpo1(crField, a, b);
+}
+
+extern "C" double PPC_PsNabs(double value)
+{
+    // No isa twin: ps_nabs is never emitted by this DOL, so it stays out-of-line
+    // here, but built from the same lane accessors as its neighbours.
+    return PpcPackPairedInline(-std::abs(PpcGetPs0Inline(value)),
+                               -std::abs(PpcGetPs1Inline(value)));
+}
+
+extern "C" double PPC_PsMr(double value)
+{
+    return value;
+}
diff --git a/runtime/src/product/base_product.cpp b/runtime/src/product/base_product.cpp
new file mode 100644
index 0000000..926372f
--- /dev/null
+++ b/runtime/src/product/base_product.cpp
@@ -0,0 +1,13 @@
+#include "runtime_product.h"
+
+namespace RuntimeProduct {
+
+const Descriptor& Active() noexcept {
+    static constexpr Descriptor descriptor{
+        Kind::BaseGame,
+        "WiiCompiled",
+    };
+    return descriptor;
+}
+
+} // namespace RuntimeProduct
diff --git a/runtime/src/product/retro_rewind_product.cpp b/runtime/src/product/retro_rewind_product.cpp
new file mode 100644
index 0000000..898568f
--- /dev/null
+++ b/runtime/src/product/retro_rewind_product.cpp
@@ -0,0 +1,13 @@
+#include "runtime_product.h"
+
+namespace RuntimeProduct {
+
+const Descriptor& Active() noexcept {
+    static constexpr Descriptor descriptor{
+        Kind::RetroRewind,
+        "Retro Rewind",
+    };
+    return descriptor;
+}
+
+} // namespace RuntimeProduct
diff --git a/runtime/src/recomp_mod_loader.cpp b/runtime/src/recomp_mod_loader.cpp
new file mode 100644
index 0000000..bb7e037
--- /dev/null
+++ b/runtime/src/recomp_mod_loader.cpp
@@ -0,0 +1,442 @@
+#include "recomp_mod_loader.h"
+
+#include <algorithm>
+#include <cstdlib>
+#include <iomanip>
+#include <iostream>
+#include <mutex>
+#include <optional>
+#include <sstream>
+#include <filesystem>
+
+#include "memory.h"
+#include "ppc_runtime.h"
+#include "runtime_config.h"
+#include "runtime_log.h"
+#include "system_bridge.h"
+
+namespace {
+
+struct ExecutableRange {
+    uint32_t start = 0;
+    uint32_t end = 0;
+    std::string name;
+};
+
+std::vector<RecompMod::InitializerFn>& MemoryInitializers() {
+    static std::vector<RecompMod::InitializerFn> initializers;
+    return initializers;
+}
+
+std::vector<RecompMod::InitializerFn>& PostRelInitializers() {
+    static std::vector<RecompMod::InitializerFn> initializers;
+    return initializers;
+}
+
+std::vector<std::string>& OverlayRoots() {
+    static std::vector<std::string> roots;
+    return roots;
+}
+
+std::string& RiivolutionXmlPath() {
+    static std::string path;
+    return path;
+}
+
+std::vector<RecompMod::RiivolutionOptionSelection>& RiivolutionSelections() {
+    static std::vector<RecompMod::RiivolutionOptionSelection> selections;
+    return selections;
+}
+
+std::vector<RecompMod::MemoryReservation>& Reservations() {
+    static std::vector<RecompMod::MemoryReservation> reservations;
+    return reservations;
+}
+
+std::mutex& ModMutex() {
+    static std::mutex mutex;
+    return mutex;
+}
+
+bool& MemoryInitializersRan() {
+    static bool ran = false;
+    return ran;
+}
+
+bool& PostRelInitializersRan() {
+    static bool ran = false;
+    return ran;
+}
+
+std::vector<ExecutableRange>& ExecutableRanges() {
+    static std::vector<ExecutableRange> ranges;
+    return ranges;
+}
+
+void MarkExecutableGuardPages(uint32_t start, uint32_t end) {
+    if (end <= start) {
+        return;
+    }
+
+    const uint32_t firstPage = start >> RecompMod::kExecutableWriteGuardPageShift;
+    const uint32_t lastPage = (end - 1) >> RecompMod::kExecutableWriteGuardPageShift;
+    for (uint32_t page = firstPage; page <= lastPage; ++page) {
+        RecompMod::g_executableWriteGuardPages[page].store(1, std::memory_order_relaxed);
+    }
+    const uint32_t firstCoarsePage = start >> RecompMod::kExecutableWriteGuardCoarsePageShift;
+    const uint32_t lastCoarsePage = (end - 1) >> RecompMod::kExecutableWriteGuardCoarsePageShift;
+    for (uint32_t page = firstCoarsePage; page <= lastCoarsePage; ++page) {
+        RecompMod::g_executableWriteGuardCoarsePages[page].store(1, std::memory_order_relaxed);
+        // Keep ordinary data stores on a single biased-page lookup. A page
+        // containing any executable bytes retains the exact guard hierarchy.
+        MemoryInline::g_fullWritablePageBias[page] = 0;
+    }
+    const uint32_t firstMidPage = start >> RecompMod::kExecutableWriteGuardMidPageShift;
+    const uint32_t lastMidPage = (end - 1) >> RecompMod::kExecutableWriteGuardMidPageShift;
+    for (uint32_t page = firstMidPage; page <= lastMidPage; ++page) {
+        RecompMod::g_executableWriteGuardMidPages[page].store(1, std::memory_order_relaxed);
+    }
+}
+
+void AddExecutableRangeLocked(uint32_t start, uint32_t end, std::string name) {
+    if (end <= start) {
+        return;
+    }
+
+    auto& ranges = ExecutableRanges();
+    const auto duplicate = std::find_if(ranges.begin(), ranges.end(), [&](const ExecutableRange& range) {
+        return range.start == start && range.end == end && range.name == name;
+    });
+    if (duplicate != ranges.end()) {
+        return;
+    }
+
+    ranges.push_back({start, end, std::move(name)});
+    MarkExecutableGuardPages(start, end);
+    // Flat guest accesses never consult the guard tables, so the host pages
+    // fully covered by the range become read-only in the guest view. Native
+    // runtime writers use the unprotected host alias and are unaffected.
+    GuestFlat::RegisterExecutableRange(start, end);
+    RecompMod::g_executableWriteGuardEnabled.store(true, std::memory_order_release);
+}
+
+void AddMem1AliasesLocked(uint32_t start, uint32_t end, const std::string& name) {
+    if (end <= start) {
+        return;
+    }
+
+    const uint64_t length = static_cast<uint64_t>(end) - start;
+    auto addFromOffset = [&](uint32_t offset) {
+        if (offset + length > 24ull * 1024ull * 1024ull) {
+            return;
+        }
+        AddExecutableRangeLocked(0x80000000u + offset, static_cast<uint32_t>(0x80000000ull + offset + length), name + " [cached]");
+        AddExecutableRangeLocked(0xC0000000u + offset, static_cast<uint32_t>(0xC0000000ull + offset + length), name + " [uncached]");
+    };
+
+    if (start < 0x01800000u && end <= 0x01800000u) {
+        addFromOffset(start);
+    } else if (start >= 0x80000000u && end <= 0x81800000u) {
+        addFromOffset(start - 0x80000000u);
+    } else if (start >= 0xC0000000u && end <= 0xC1800000u) {
+        addFromOffset(start - 0xC0000000u);
+    }
+}
+
+void AddMem2AliasesLocked(uint32_t start, uint32_t end, const std::string& name) {
+    if (end <= start) {
+        return;
+    }
+
+    const uint64_t length = static_cast<uint64_t>(end) - start;
+    auto addFromOffset = [&](uint32_t offset) {
+        if (offset + length > Memory::kMem2Size) {
+            return;
+        }
+        AddExecutableRangeLocked(Memory::kMem2CachedBase + offset,
+                                 static_cast<uint32_t>(Memory::kMem2CachedBase + offset + length),
+                                 name + " [cached]");
+        AddExecutableRangeLocked(Memory::kMem2UncachedBase + offset,
+                                 static_cast<uint32_t>(Memory::kMem2UncachedBase + offset + length),
+                                 name + " [uncached]");
+    };
+
+    if (start >= Memory::kMem2PhysicalBase && end <= Memory::kMem2PhysicalEnd) {
+        addFromOffset(start - Memory::kMem2PhysicalBase);
+    } else if (start >= Memory::kMem2CachedBase && end <= Memory::kMem2CachedEnd) {
+        addFromOffset(start - Memory::kMem2CachedBase);
+    } else if (start >= Memory::kMem2UncachedBase && end <= Memory::kMem2UncachedEnd) {
+        addFromOffset(start - Memory::kMem2UncachedBase);
+    }
+}
+
+bool Intersects(uint32_t address, size_t length, const ExecutableRange& range) {
+    const uint64_t writeStart = address;
+    const uint64_t writeEnd = writeStart + length;
+    return writeStart < range.end && writeEnd > range.start;
+}
+
+std::optional<ExecutableRange> FindExecutableRange(uint32_t address, size_t length) {
+    std::lock_guard<std::mutex> lock(ModMutex());
+    for (const auto& range : ExecutableRanges()) {
+        if (Intersects(address, length, range)) {
+            return range;
+        }
+    }
+    return std::nullopt;
+}
+
+bool IsKnownBaseRelLoaderWrite(const ExecutableRange& range) {
+    if (range.name.find("StaticR.rel") == std::string::npos) {
+        return false;
+    }
+
+    const auto* cpu = TryGetCpuContext();
+    if (!cpu) {
+        return false;
+    }
+
+    // The game copies and relocates REL sections before executing them. Those
+    // writes are normal loading/linking, not runtime code patches.
+    return (cpu->lr >= 0x8000A000u && cpu->lr < 0x8000A400u) ||
+           (cpu->lr >= 0x801A6000u && cpu->lr < 0x801A7000u);
+}
+
+} // namespace
+
+namespace RecompMod {
+
+std::atomic<bool> g_executableWriteGuardEnabled{false};
+std::atomic<uint8_t> g_executableWriteGuardPages[kExecutableWriteGuardPageCount]{};
+std::atomic<uint8_t> g_executableWriteGuardCoarsePages[kExecutableWriteGuardCoarsePageCount]{};
+std::atomic<uint8_t> g_executableWriteGuardMidPages[kExecutableWriteGuardMidPageCount]{};
+
+void RegisterMemoryInitializer(InitializerFn fn) {
+    if (!fn) {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(ModMutex());
+    MemoryInitializers().push_back(fn);
+}
+
+void RunMemoryInitializers() {
+    std::vector<InitializerFn> pending;
+    {
+        std::lock_guard<std::mutex> lock(ModMutex());
+        if (MemoryInitializersRan()) {
+            return;
+        }
+        MemoryInitializersRan() = true;
+        pending = MemoryInitializers();
+    }
+
+    for (auto* fn : pending) {
+        fn();
+    }
+
+    if (!pending.empty()) {
+        RT_LOG(RT_TAG_MOD) << "Ran " << pending.size() << " recomp mod memory initializer(s)" << std::endl;
+    }
+}
+
+void RegisterPostRelInitializer(InitializerFn fn) {
+    if (!fn) {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(ModMutex());
+    PostRelInitializers().push_back(fn);
+}
+
+void RunPostRelInitializers() {
+    std::vector<InitializerFn> pending;
+    {
+        std::lock_guard<std::mutex> lock(ModMutex());
+        if (PostRelInitializersRan()) {
+            return;
+        }
+        PostRelInitializersRan() = true;
+        pending = PostRelInitializers();
+    }
+
+    for (auto* fn : pending) {
+        fn();
+    }
+
+    if (!pending.empty()) {
+        RT_LOG(RT_TAG_MOD) << "Ran " << pending.size() << " recomp mod post-REL initializer(s)" << std::endl;
+    }
+}
+
+void RegisterDvdOverlayRoot(std::string root) {
+    if (root.empty()) {
+        return;
+    }
+
+    // Documented exception to the "relative to Config.toml" rule: overlay roots
+    // are registered by mod code shipped beside the executable, so they resolve
+    // against the executable directory instead.
+    const std::filesystem::path base =
+        RuntimeConfigFile::ExecutableDirectory().value_or(std::filesystem::current_path());
+    root = RuntimeConfigFile::ResolveRelativeTo(base, root).string();
+
+    std::lock_guard<std::mutex> lock(ModMutex());
+    auto& roots = OverlayRoots();
+    const auto it = std::find(roots.begin(), roots.end(), root);
+    if (it == roots.end()) {
+        roots.push_back(std::move(root));
+    }
+}
+
+const std::vector<std::string>& DvdOverlayRoots() {
+    return OverlayRoots();
+}
+
+void RegisterRiivolutionXml(const char* packRelativePath) {
+    if (!packRelativePath || packRelativePath[0] == '\0') {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(ModMutex());
+    RiivolutionXmlPath() = packRelativePath;
+}
+
+void RegisterRiivolutionOption(const char* sectionName, const char* optionName, unsigned int choice) {
+    if (!optionName || optionName[0] == '\0') {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(ModMutex());
+    auto& selections = RiivolutionSelections();
+    const auto existing = std::find_if(selections.begin(), selections.end(), [&](const RiivolutionOptionSelection& selection) {
+        return selection.section == (sectionName ? sectionName : "") && selection.option == optionName;
+    });
+    if (existing != selections.end()) {
+        existing->choice = choice;
+        return;
+    }
+    selections.push_back({sectionName ? sectionName : "", optionName, choice});
+}
+
+const std::string& RiivolutionXml() {
+    return RiivolutionXmlPath();
+}
+
+const std::vector<RiivolutionOptionSelection>& RiivolutionOptionSelections() {
+    return RiivolutionSelections();
+}
+
+void RegisterMemoryReservation(uint32_t start, uint32_t end, std::string name) {
+    if (end <= start) {
+        return;
+    }
+
+    std::lock_guard<std::mutex> lock(ModMutex());
+    auto& reservations = Reservations();
+    const auto duplicate = std::find_if(reservations.begin(), reservations.end(), [&](const MemoryReservation& reservation) {
+        return reservation.start == start && reservation.end == end && reservation.name == name;
+    });
+    if (duplicate != reservations.end()) {
+        return;
+    }
+
+    reservations.push_back({start, end, std::move(name)});
+}
+
+const std::vector<MemoryReservation>& MemoryReservations() {
+    return Reservations();
+}
+
+// ScopedTranslatedExecutionAddress and its thread-local backing variable live
+// in the header: the indirect-dispatch path constructs one per call and cannot
+// afford a cross-TU call pair (no LTO in this build).
+
+uint32_t CurrentTranslatedExecutionAddress() noexcept {
+    return g_currentTranslatedExecutionAddress;
+}
+
+void RegisterExecutableRange(uint32_t start, uint32_t end, std::string name) {
+    if (end <= start) {
+        return;
+    }
+
+    {
+        std::lock_guard<std::mutex> lock(ModMutex());
+        if (name.empty()) {
+            std::ostringstream fallback;
+            fallback << "0x" << std::hex << std::uppercase << start << "-0x" << end;
+            name = fallback.str();
+        }
+
+        AddExecutableRangeLocked(start, end, name);
+        AddMem1AliasesLocked(start, end, name);
+        AddMem2AliasesLocked(start, end, name);
+    }
+
+    // Memory mappings can already exist when a mod publishes its executable
+    // sections. Reclassify the startup-only writable fast path now; otherwise
+    // a formerly homogeneous data page could retain a stale direct-write bias.
+    Memory::RefreshWritableFastPathsForExecutableRanges();
+}
+
+[[noreturn]] void ReportForbiddenExecutableWrite(uint32_t address, size_t length, uint64_t value,
+                                                 const ExecutableRange& range);
+
+bool HandleExecutableWrite(uint32_t address, size_t length, uint64_t value) {
+    if (!ExecutableWriteGuardMayHit(address, length)) {
+        return false;
+    }
+
+    const auto hit = FindExecutableRange(address, length);
+    if (!hit.has_value()) {
+        return false;
+    }
+
+    if (IsKnownBaseRelLoaderWrite(*hit)) {
+        return false;
+    }
+
+    ReportForbiddenExecutableWrite(address, length, value, *hit);
+}
+
+void CheckExecutableWrite(uint32_t address, size_t length, uint64_t value) {
+    if (!ExecutableWriteGuardMayHit(address, length)) {
+        return;
+    }
+
+    const auto hit = FindExecutableRange(address, length);
+    if (!hit.has_value()) {
+        return;
+    }
+
+    ReportForbiddenExecutableWrite(address, length, value, *hit);
+}
+
+[[noreturn]] void ReportForbiddenExecutableWrite(uint32_t address, size_t length, uint64_t value,
+                                                 const ExecutableRange& range) {
+    RT_LOG(RT_TAG_MOD) << "FATAL unsupported executable write" << std::endl;
+    std::cerr << "  address: 0x" << std::hex << std::uppercase << std::setw(8) << std::setfill('0') << address << std::endl;
+    std::cerr << "  value:   0x" << std::setw(16) << value << std::endl;
+    std::cerr << "  width:   " << std::dec << length << std::endl;
+    std::cerr << "  range:   0x" << std::hex << std::uppercase << std::setw(8) << std::setfill('0') << range.start
+              << "-0x" << std::setw(8) << range.end << " " << range.name << std::dec << std::endl;
+
+    if (auto* cpu = TryGetCpuContext()) {
+        std::cerr << "  caller pc: 0x" << std::hex << std::uppercase << std::setw(8) << std::setfill('0') << cpu->pc << std::endl;
+        std::cerr << "  caller lr: 0x" << std::setw(8) << cpu->lr << std::dec << std::endl;
+        SystemBridge::DumpCpuState(cpu);
+    } else {
+        std::cerr << "  caller pc: unavailable" << std::endl;
+    }
+
+    std::cerr << "  reason: executable runtime writes are forbidden" << std::endl;
+    std::ostringstream message;
+    message << "The game stopped because translated code attempted to write to executable memory at 0x"
+            << std::hex << std::uppercase << address
+            << ". Runtime executable patches are not supported in this build.";
+    ShowRuntimeFatalPopup("forbidden executable memory write", message.str());
+    std::abort();
+}
+
+} // namespace RecompMod
diff --git a/runtime/src/settings_overlay.cpp b/runtime/src/settings_overlay.cpp
new file mode 100644
index 0000000..b269604
--- /dev/null
+++ b/runtime/src/settings_overlay.cpp
@@ -0,0 +1,913 @@
+#include "settings_overlay.h"
+#include "audio_backend.h"
+#include "game_graphics_options.h"
+#include "music_attenuation.h"
+#include "runtime_config.h"
+#include "runtime_log.h"
+
+#include <imgui.h>
+#include <SDL3/SDL_events.h>
+#include <SDL3/SDL_gamepad.h>
+#include <SDL3/SDL_keyboard.h>
+#include <SDL3/SDL_mouse.h>
+#include <SDL3/SDL_scancode.h>
+
+#include <array>
+#include <algorithm>
+#include <atomic>
+#include <cctype>
+#include <chrono>
+#include <cmath>
+#include <cstdint>
+#include <limits>
+#include <iostream>
+#include <string>
+#include <string_view>
+#include <utility>
+
+#if defined(_WIN32)
+#define WIN32_LEAN_AND_MEAN
+#include <Windows.h>
+#include <shellapi.h>
+#endif
+
+#include <dolphin/pad.h>
+#include <dolphin/vi.h>
+#include <aurora/aurora.h>
+#include <aurora/gfx.h>
+
+extern "C" int g_gxFrameCount;
+
+// Defined in runtime/src/hle/audio/ax_mix.cpp. That header is private to the HLE
+// directory and is not on this target's include path.
+namespace AxDspHle {
+void SetMixWorkerEnabled(bool enabled);
+}
+
+namespace settings_overlay {
+namespace {
+
+const char* GraphicsApiDisplayName() {
+    switch (aurora_get_backend()) {
+    case BACKEND_D3D11: return "Direct3D 11";
+    case BACKEND_D3D12: return "Direct3D 12";
+    case BACKEND_METAL: return "Metal";
+    case BACKEND_VULKAN: return "Vulkan";
+    case BACKEND_OPENGL: return "OpenGL";
+    case BACKEND_OPENGLES: return "OpenGL ES";
+    case BACKEND_WEBGPU: return "WebGPU";
+    case BACKEND_NULL: return "Null";
+    case BACKEND_AUTO: return "Automatic";
+    }
+    return "Unknown";
+}
+
+bool g_topBarVisible = false;
+int g_controllerPort = 0;
+float g_resolutionScale = RuntimeConfigFile::ResolutionMultiplier(1.0f);
+int g_audioVolumePercent = static_cast<int>(std::lround(RuntimeConfigFile::AudioVolume(1.0f) * 100.0f));
+int g_musicVolumePercent = static_cast<int>(std::lround(RuntimeConfigFile::MusicVolume(1.0f) * 100.0f));
+int g_soundEffectsVolumePercent =
+    static_cast<int>(std::lround(RuntimeConfigFile::SoundEffectsVolume(1.0f) * 100.0f));
+int g_uiVolumePercent = static_cast<int>(std::lround(RuntimeConfigFile::UiVolume(1.0f) * 100.0f));
+int g_voicesVolumePercent = static_cast<int>(std::lround(RuntimeConfigFile::VoicesVolume(1.0f) * 100.0f));
+bool g_audioMuted = RuntimeConfigFile::AudioMuted(false);
+bool g_audioMixWorker = RuntimeConfigFile::AudioMixWorkerEnabled(true);
+bool g_attenuateMusicWhenMediaPlays = RuntimeConfigFile::AttenuateMusicWhenMediaPlays(false);
+int g_frameInterpolationMode = [] {
+    switch (RuntimeConfigFile::FrameInterpolationFps(0)) {
+    case 120:
+        return 1;
+    case 180:
+        return 2;
+    default:
+        return 0;
+    }
+}();
+int g_displayMode = [] {
+    const std::string mode = RuntimeConfigFile::DisplayMode("windowed");
+    if (mode == "borderless") {
+        return static_cast<int>(AURORA_DISPLAY_MODE_BORDERLESS);
+    }
+    if (mode == "exclusive") {
+        return static_cast<int>(AURORA_DISPLAY_MODE_EXCLUSIVE);
+    }
+    return static_cast<int>(AURORA_DISPLAY_MODE_WINDOWED);
+}();
+bool g_skipUnreadyPipelines = RuntimeConfigFile::SkipUnreadyPipelines(true);
+bool g_disableCopyFilter = RuntimeConfigFile::DisableCopyFilter(true);
+bool g_showFps = RuntimeConfigFile::ShowFps(true);
+uint32_t g_disabledPostProcessingPaths = RuntimeConfigFile::DisabledPostProcessingPaths(0);
+std::array<int32_t, PAD_MAX_CONTROLLERS> g_configuredControllerIndices = [] {
+    std::array<int32_t, PAD_MAX_CONTROLLERS> indices{};
+    indices.fill(std::numeric_limits<int32_t>::min());
+    return indices;
+}();
+
+struct ControllerButtonItem {
+    const char* configKey;
+    const char* label;
+    PADButton padButton;
+};
+
+constexpr std::array<ControllerButtonItem, PAD_BUTTON_COUNT> kControllerButtons = {{
+    {"a", "A", PAD_BUTTON_A},
+    {"b", "B", PAD_BUTTON_B},
+    {"x", "X", PAD_BUTTON_X},
+    {"y", "Y", PAD_BUTTON_Y},
+    {"start", "Start", PAD_BUTTON_START},
+    {"z", "Z", PAD_TRIGGER_Z},
+    {"l", "L", PAD_TRIGGER_L},
+    {"r", "R", PAD_TRIGGER_R},
+    {"up", "D-pad Up", PAD_BUTTON_UP},
+    {"down", "D-pad Down", PAD_BUTTON_DOWN},
+    {"left", "D-pad Left", PAD_BUTTON_LEFT},
+    {"right", "D-pad Right", PAD_BUTTON_RIGHT},
+}};
+
+struct NativeButtonItem {
+    const char* configName;
+    const char* label;
+    uint32_t nativeButton;
+};
+
+constexpr std::array<NativeButtonItem, SDL_GAMEPAD_BUTTON_COUNT + 1> kNativeButtons = {{
+    {"unmapped", "Unmapped / analog trigger", PAD_NATIVE_BUTTON_INVALID},
+    {"south", "South (A / Cross)", SDL_GAMEPAD_BUTTON_SOUTH},
+    {"east", "East (B / Circle)", SDL_GAMEPAD_BUTTON_EAST},
+    {"west", "West (X / Square)", SDL_GAMEPAD_BUTTON_WEST},
+    {"north", "North (Y / Triangle)", SDL_GAMEPAD_BUTTON_NORTH},
+    {"back", "Back / Select", SDL_GAMEPAD_BUTTON_BACK},
+    {"guide", "Guide / Home", SDL_GAMEPAD_BUTTON_GUIDE},
+    {"start", "Start / Options", SDL_GAMEPAD_BUTTON_START},
+    {"left_stick", "Left stick click", SDL_GAMEPAD_BUTTON_LEFT_STICK},
+    {"right_stick", "Right stick click", SDL_GAMEPAD_BUTTON_RIGHT_STICK},
+    {"left_shoulder", "Left shoulder", SDL_GAMEPAD_BUTTON_LEFT_SHOULDER},
+    {"right_shoulder", "Right shoulder", SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER},
+    {"dpad_up", "D-pad Up", SDL_GAMEPAD_BUTTON_DPAD_UP},
+    {"dpad_down", "D-pad Down", SDL_GAMEPAD_BUTTON_DPAD_DOWN},
+    {"dpad_left", "D-pad Left", SDL_GAMEPAD_BUTTON_DPAD_LEFT},
+    {"dpad_right", "D-pad Right", SDL_GAMEPAD_BUTTON_DPAD_RIGHT},
+    {"misc1", "Misc 1 / Share", SDL_GAMEPAD_BUTTON_MISC1},
+    {"right_paddle1", "Right paddle 1", SDL_GAMEPAD_BUTTON_RIGHT_PADDLE1},
+    {"left_paddle1", "Left paddle 1", SDL_GAMEPAD_BUTTON_LEFT_PADDLE1},
+    {"right_paddle2", "Right paddle 2", SDL_GAMEPAD_BUTTON_RIGHT_PADDLE2},
+    {"left_paddle2", "Left paddle 2", SDL_GAMEPAD_BUTTON_LEFT_PADDLE2},
+    {"touchpad", "Touchpad", SDL_GAMEPAD_BUTTON_TOUCHPAD},
+    {"misc2", "Misc 2", SDL_GAMEPAD_BUTTON_MISC2},
+    {"misc3", "Misc 3 / GC L click", SDL_GAMEPAD_BUTTON_MISC3},
+    {"misc4", "Misc 4 / GC R click", SDL_GAMEPAD_BUTTON_MISC4},
+    {"misc5", "Misc 5", SDL_GAMEPAD_BUTTON_MISC5},
+    {"misc6", "Misc 6", SDL_GAMEPAD_BUTTON_MISC6},
+}};
+
+// Classic Controller Pro layout, indexed like kControllerButtons: the SNES-style
+// diamond (A right, B bottom, X top, Y left) with digital bumpers driving the GC
+// triggers and Z on Back/Select (the same home the NSO GC default gives it).
+constexpr std::array<const char*, PAD_BUTTON_COUNT> kClassicProPreset = {
+    "east",           // A
+    "south",          // B
+    "north",          // X
+    "west",           // Y
+    "start",          // Start
+    "back",           // Z
+    "left_shoulder",  // L
+    "right_shoulder", // R
+    "dpad_up", "dpad_down", "dpad_left", "dpad_right",
+};
+
+struct ResolutionItem {
+    const char* label;
+    float scale;
+};
+
+using Clock = std::chrono::steady_clock;
+
+constexpr auto kCursorAutoHideDelay = std::chrono::seconds(5);
+Clock::time_point g_lastMouseActivity{Clock::now()};
+bool g_cursorHidden = false;
+
+constexpr std::array<std::string_view, 3> kDisplayModeConfigNames = {
+    "windowed", "borderless", "exclusive",
+};
+
+uint64_t g_presentedFrame = 0;
+std::atomic_bool g_strapInputAccepted = false;
+std::atomic_uint64_t g_startupDismissFrame = UINT64_MAX;
+constexpr uint64_t kStrapTransitionCoverFrames = 60;
+
+constexpr std::array<ResolutionItem, 8> kResolutions = {{
+    {"Auto (window size)", 0.0f}, {"Native (1x)", 1.0f}, {"1.5x", 1.5f}, {"2x", 2.0f},
+    {"3x", 3.0f}, {"4x", 4.0f}, {"6x", 6.0f}, {"8x", 8.0f},
+}};
+
+constexpr std::array<uint32_t, 3> kFrameInterpolationTargetFps{0, 120, 180};
+
+bool IsHighResolutionScale(float scale) {
+    return std::fabs(scale - 6.0f) < 0.001f || std::fabs(scale - 8.0f) < 0.001f;
+}
+
+bool IsHighFrameRateMode() {
+    return kFrameInterpolationTargetFps[static_cast<size_t>(g_frameInterpolationMode)] > 60;
+}
+
+void SetResolutionScale(float scale) {
+    g_resolutionScale = scale;
+    VISetFrameBufferScale(scale);
+    RuntimeConfigFile::SetResolutionMultiplier(scale);
+}
+
+void LimitResolutionForFrameRate() {
+    if (IsHighFrameRateMode() && IsHighResolutionScale(g_resolutionScale)) {
+        SetResolutionScale(4.0f);
+    }
+}
+
+const NativeButtonItem* FindNativeButton(std::string value) {
+    const auto it = std::find_if(kNativeButtons.begin(), kNativeButtons.end(), [&](const NativeButtonItem& item) {
+        return value == item.configName;
+    });
+    return it == kNativeButtons.end() ? nullptr : &*it;
+}
+
+struct ControllerBindingPair {
+    std::string primary;
+    std::string secondary;
+};
+
+std::string TrimBindingToken(const std::string& token) {
+    const size_t begin = token.find_first_not_of(" \t");
+    if (begin == std::string::npos) {
+        return {};
+    }
+    const size_t end = token.find_last_not_of(" \t");
+    return token.substr(begin, end - begin + 1);
+}
+
+// Config values hold up to two comma-separated button names ("dpad_up" or
+// "dpad_up,left_shoulder"); pressing either one counts as the GC button.
+ControllerBindingPair SplitControllerBinding(const std::string& value) {
+    const size_t comma = value.find(',');
+    if (comma == std::string::npos) {
+        return {TrimBindingToken(value), {}};
+    }
+    return {TrimBindingToken(value.substr(0, comma)), TrimBindingToken(value.substr(comma + 1))};
+}
+
+const NativeButtonItem& NativeButtonForValue(uint32_t nativeButton) {
+    const auto it = std::find_if(kNativeButtons.begin(), kNativeButtons.end(), [&](const NativeButtonItem& item) {
+        return nativeButton == item.nativeButton;
+    });
+    return it == kNativeButtons.end() ? kNativeButtons.front() : *it;
+}
+
+void SetTopBarVisible(bool visible) {
+    if (g_topBarVisible == visible) {
+        return;
+    }
+    g_topBarVisible = visible;
+    PADBlockInput(visible);
+}
+
+void ApplyConfiguredMappings() {
+    for (uint32_t port = 0; port < PAD_MAX_CONTROLLERS; ++port) {
+        const int32_t controllerIndex = PADGetIndexForPort(port);
+        if (controllerIndex == g_configuredControllerIndices[port]) {
+            continue;
+        }
+        g_configuredControllerIndices[port] = controllerIndex;
+        if (controllerIndex < 0) {
+            continue;
+        }
+
+        uint32_t count = 0;
+        if (PADGetButtonMappings(port, &count) == nullptr || count != PAD_BUTTON_COUNT) {
+            continue;
+        }
+        for (size_t i = 0; i < kControllerButtons.size(); ++i) {
+            const auto& configured = RuntimeConfigFile::ControllerButton(i);
+            if (!configured) {
+                continue;
+            }
+            const ControllerBindingPair binding = SplitControllerBinding(*configured);
+            if (const NativeButtonItem* native = FindNativeButton(binding.primary)) {
+                PADSetButtonMapping(port, PADButtonMapping{native->nativeButton, kControllerButtons[i].padButton});
+            } else {
+                RT_LOG(RT_TAG_CONFIG) << "Unknown controller." << kControllerButtons[i].configKey
+                          << " button '" << binding.primary << "'" << std::endl;
+            }
+            uint32_t altNative = PAD_NATIVE_BUTTON_INVALID;
+            if (!binding.secondary.empty()) {
+                if (const NativeButtonItem* native = FindNativeButton(binding.secondary)) {
+                    altNative = native->nativeButton;
+                } else {
+                    RT_LOG(RT_TAG_CONFIG) << "Unknown controller." << kControllerButtons[i].configKey
+                              << " secondary button '" << binding.secondary << "'" << std::endl;
+                }
+            }
+            PADSetAltButtonMapping(port, PADButtonMapping{altNative, kControllerButtons[i].padButton});
+        }
+    }
+}
+
+void DrawControllerSettings() {
+    for (int port = 0; port < PAD_MAX_CONTROLLERS; ++port) {
+        const std::string label = "Port " + std::to_string(port + 1);
+        ImGui::RadioButton(label.c_str(), &g_controllerPort, port);
+        if (port + 1 < PAD_MAX_CONTROLLERS) {
+            ImGui::SameLine();
+        }
+    }
+
+    ImGui::Separator();
+    const uint32_t controllerCount = PADCount();
+    if (controllerCount == 0) {
+        ImGui::TextDisabled("No controller connected");
+        return;
+    }
+
+    const char* currentName = PADGetName(static_cast<uint32_t>(g_controllerPort));
+    ImGui::Text("Assigned: %s", currentName != nullptr ? currentName : "None");
+    if (ImGui::BeginMenu("Assign connected controller")) {
+        for (uint32_t index = 0; index < controllerCount; ++index) {
+            const char* name = PADGetNameForControllerIndex(index);
+            ImGui::PushID(static_cast<int>(index));
+            if (ImGui::MenuItem(name != nullptr ? name : "Unknown controller")) {
+                PADSetPortForIndex(index, static_cast<uint32_t>(g_controllerPort));
+                g_configuredControllerIndices.fill(std::numeric_limits<int32_t>::min());
+                ApplyConfiguredMappings();
+            }
+            ImGui::PopID();
+        }
+        ImGui::EndMenu();
+    }
+
+    uint32_t mappingCount = 0;
+    PADButtonMapping* mappings = PADGetButtonMappings(static_cast<uint32_t>(g_controllerPort), &mappingCount);
+    if (mappings == nullptr || mappingCount != PAD_BUTTON_COUNT) {
+        ImGui::TextDisabled("Assign a controller to edit its buttons");
+        return;
+    }
+
+    uint32_t altMappingCount = 0;
+    PADButtonMapping* altMappings =
+        PADGetAltButtonMappings(static_cast<uint32_t>(g_controllerPort), &altMappingCount);
+
+    const auto writeBinding = [](size_t index, uint32_t primaryNative, uint32_t altNative) {
+        std::string value = NativeButtonForValue(primaryNative).configName;
+        if (altNative != PAD_NATIVE_BUTTON_INVALID) {
+            value += ',';
+            value += NativeButtonForValue(altNative).configName;
+        }
+        RuntimeConfigFile::SetControllerButton(index, value);
+    };
+
+    // Which rows show the second-binding combo without one being bound yet;
+    // reset when the user switches ports so a stale "+" click doesn't linger.
+    static std::array<bool, PAD_BUTTON_COUNT> altRowExpanded{};
+    static int altRowExpandedPort = -1;
+    if (altRowExpandedPort != g_controllerPort) {
+        altRowExpandedPort = g_controllerPort;
+        altRowExpanded.fill(false);
+    }
+
+    ImGui::SeparatorText("Presets");
+    if (ImGui::Button("GameCube")) {
+        const uint32_t port = static_cast<uint32_t>(g_controllerPort);
+        PADRestoreDefaultMapping(port);
+        uint32_t restoredCount = 0;
+        if (PADButtonMapping* restored = PADGetButtonMappings(port, &restoredCount)) {
+            for (size_t i = 0; i < kControllerButtons.size(); ++i) {
+                const auto it = std::find_if(restored, restored + restoredCount, [&](const PADButtonMapping& mapping) {
+                    return mapping.padButton == kControllerButtons[i].padButton;
+                });
+                if (it != restored + restoredCount) {
+                    RuntimeConfigFile::SetControllerButton(i, NativeButtonForValue(it->nativeButton).configName);
+                }
+            }
+        }
+        altRowExpanded.fill(false);
+        PADSerializeMappings();
+        mappings = PADGetButtonMappings(port, &mappingCount);
+    }
+    ImGui::SameLine();
+    if (ImGui::Button("Classic Controller Pro")) {
+        const uint32_t port = static_cast<uint32_t>(g_controllerPort);
+        for (size_t i = 0; i < kControllerButtons.size(); ++i) {
+            if (const NativeButtonItem* native = FindNativeButton(kClassicProPreset[i])) {
+                PADSetButtonMapping(port, PADButtonMapping{native->nativeButton, kControllerButtons[i].padButton});
+                PADSetAltButtonMapping(port,
+                                       PADButtonMapping{PAD_NATIVE_BUTTON_INVALID, kControllerButtons[i].padButton});
+                RuntimeConfigFile::SetControllerButton(i, kClassicProPreset[i]);
+            }
+        }
+        altRowExpanded.fill(false);
+        PADSerializeMappings();
+        mappings = PADGetButtonMappings(port, &mappingCount);
+    }
+
+    ImGui::SeparatorText("Button mapping");
+    for (size_t i = 0; i < kControllerButtons.size(); ++i) {
+        auto mappingIt = std::find_if(mappings, mappings + mappingCount, [&](const PADButtonMapping& mapping) {
+            return mapping.padButton == kControllerButtons[i].padButton;
+        });
+        if (mappingIt == mappings + mappingCount) {
+            continue;
+        }
+        PADButtonMapping* altIt = nullptr;
+        if (altMappings != nullptr && altMappingCount == PAD_BUTTON_COUNT) {
+            const auto it = std::find_if(altMappings, altMappings + altMappingCount, [&](const PADButtonMapping& mapping) {
+                return mapping.padButton == kControllerButtons[i].padButton;
+            });
+            if (it != altMappings + altMappingCount) {
+                altIt = it;
+            }
+        }
+
+        const NativeButtonItem& current = NativeButtonForValue(mappingIt->nativeButton);
+        ImGui::PushID(static_cast<int>(i));
+        ImGui::SetNextItemWidth(190.0f);
+        if (ImGui::BeginCombo("##primary", current.label)) {
+            for (const auto& candidate : kNativeButtons) {
+                const bool selected = candidate.nativeButton == mappingIt->nativeButton;
+                if (ImGui::Selectable(candidate.label, selected)) {
+                    const uint32_t port = static_cast<uint32_t>(g_controllerPort);
+                    PADSetButtonMapping(port, PADButtonMapping{candidate.nativeButton, kControllerButtons[i].padButton});
+                    writeBinding(i, candidate.nativeButton,
+                                 altIt != nullptr ? altIt->nativeButton : PAD_NATIVE_BUTTON_INVALID);
+                    PADSerializeMappings();
+                    mappings = PADGetButtonMappings(port, &mappingCount);
+                }
+                if (selected) {
+                    ImGui::SetItemDefaultFocus();
+                }
+            }
+            ImGui::EndCombo();
+        }
+        if (altIt != nullptr) {
+            const bool altBound = altIt->nativeButton != PAD_NATIVE_BUTTON_INVALID;
+            if (!altBound && !altRowExpanded[i]) {
+                ImGui::SameLine();
+                if (ImGui::SmallButton("+")) {
+                    altRowExpanded[i] = true;
+                }
+                if (ImGui::IsItemHovered()) {
+                    ImGui::SetTooltip("Add a second binding; pressing either one works");
+                }
+            } else {
+                ImGui::SameLine();
+                ImGui::TextUnformatted("or");
+                ImGui::SameLine();
+                const char* altLabel = altBound ? NativeButtonForValue(altIt->nativeButton).label : "None";
+                ImGui::SetNextItemWidth(190.0f);
+                if (ImGui::BeginCombo("##alt", altLabel)) {
+                    for (const auto& candidate : kNativeButtons) {
+                        const bool isNone = candidate.nativeButton == PAD_NATIVE_BUTTON_INVALID;
+                        const bool selected = candidate.nativeButton == altIt->nativeButton;
+                        if (ImGui::Selectable(isNone ? "None" : candidate.label, selected)) {
+                            const uint32_t port = static_cast<uint32_t>(g_controllerPort);
+                            PADSetAltButtonMapping(
+                                port, PADButtonMapping{candidate.nativeButton, kControllerButtons[i].padButton});
+                            writeBinding(i, mappingIt->nativeButton, candidate.nativeButton);
+                            if (isNone) {
+                                altRowExpanded[i] = false;
+                            }
+                        }
+                        if (selected) {
+                            ImGui::SetItemDefaultFocus();
+                        }
+                    }
+                    ImGui::EndCombo();
+                }
+            }
+        }
+        ImGui::SameLine();
+        ImGui::TextUnformatted(kControllerButtons[i].label);
+        ImGui::PopID();
+    }
+
+}
+
+void DrawAudioSettings() {
+    ImGui::SetNextItemWidth(220.0f);
+    if (ImGui::SliderInt("Master", &g_audioVolumePercent, 0, 100, "%d%%")) {
+        const float volume = static_cast<float>(g_audioVolumePercent) / 100.0f;
+        AudioBackend::Instance().SetMasterVolume(volume);
+        RuntimeConfigFile::SetAudioVolume(volume);
+    }
+    if (ImGui::SliderInt("Music", &g_musicVolumePercent, 0, 100, "%d%%")) {
+        const float volume = static_cast<float>(g_musicVolumePercent) / 100.0f;
+        MusicAttenuation::SetMusicVolume(volume);
+        RuntimeConfigFile::SetMusicVolume(volume);
+    }
+    if (ImGui::SliderInt("Sound Effects", &g_soundEffectsVolumePercent, 0, 100, "%d%%")) {
+        const float volume = static_cast<float>(g_soundEffectsVolumePercent) / 100.0f;
+        MusicAttenuation::SetSoundEffectsVolume(volume);
+        RuntimeConfigFile::SetSoundEffectsVolume(volume);
+    }
+    if (ImGui::SliderInt("UI", &g_uiVolumePercent, 0, 100, "%d%%")) {
+        const float volume = static_cast<float>(g_uiVolumePercent) / 100.0f;
+        MusicAttenuation::SetUiVolume(volume);
+        RuntimeConfigFile::SetUiVolume(volume);
+    }
+    if (ImGui::SliderInt("Voices", &g_voicesVolumePercent, 0, 100, "%d%%")) {
+        const float volume = static_cast<float>(g_voicesVolumePercent) / 100.0f;
+        MusicAttenuation::SetVoicesVolume(volume);
+        RuntimeConfigFile::SetVoicesVolume(volume);
+    }
+    if (ImGui::Checkbox("Mute", &g_audioMuted)) {
+        AudioBackend::Instance().SetMuted(g_audioMuted);
+        RuntimeConfigFile::SetAudioMuted(g_audioMuted);
+    }
+    ImGui::Separator();
+    if (ImGui::Checkbox("Mix audio on a worker thread", &g_audioMixWorker)) {
+        // Applies immediately: SetMixWorkerEnabled joins any in-flight mix
+        // before switching, so the change never lands mid-frame.
+        AxDspHle::SetMixWorkerEnabled(g_audioMixWorker);
+        RuntimeConfigFile::SetAudioMixWorker(g_audioMixWorker);
+    }
+    if (ImGui::IsItemHovered()) {
+        ImGui::SetTooltip(
+            "Runs the AX/DSP voice mix off the game thread. Turn this off if you "
+            "suspect an audio problem; the mix then runs inline as it used to.");
+    }
+    ImGui::Separator();
+    if (ImGui::Checkbox("Mute game music while external media is playing",
+                        &g_attenuateMusicWhenMediaPlays)) {
+        MusicAttenuation::SetEnabled(g_attenuateMusicWhenMediaPlays);
+        RuntimeConfigFile::SetAttenuateMusicWhenMediaPlays(g_attenuateMusicWhenMediaPlays);
+    }
+    if (g_attenuateMusicWhenMediaPlays) {
+        if (MusicAttenuation::IsExternalMediaPlaying()) {
+            ImGui::TextDisabled("External media is playing; game music is muted.");
+        } else if (!MusicAttenuation::IsMediaControlInitializationComplete()) {
+            ImGui::TextDisabled("Waiting for Windows Media Control...");
+        } else if (!MusicAttenuation::IsMediaControlAvailable()) {
+            ImGui::TextDisabled("Windows Media Control is unavailable.");
+        } else {
+            ImGui::TextDisabled("No external media is currently playing.");
+        }
+    }
+}
+
+void DrawGraphicsSettings() {
+    g_displayMode = static_cast<int>(aurora_get_display_mode());
+    struct EffectFlag {
+        const char* label;
+        uint32_t flag;
+    };
+    static constexpr std::array<EffectFlag, 1> kEffectFlags = {{
+        {"Disable bloom", 0x10u},
+    }};
+
+    for (const auto& effect : kEffectFlags) {
+        bool disabled = (g_disabledPostProcessingPaths & effect.flag) != 0;
+        if (ImGui::Checkbox(effect.label, &disabled)) {
+            if (disabled) {
+                g_disabledPostProcessingPaths |= effect.flag;
+            } else {
+                g_disabledPostProcessingPaths &= ~effect.flag;
+            }
+            RuntimeGameGraphicsOptions::SetDisabledPostProcessingPaths(g_disabledPostProcessingPaths);
+            RuntimeConfigFile::SetDisabledPostProcessingPaths(g_disabledPostProcessingPaths);
+        }
+    }
+    ImGui::TextDisabled("Applied when the next scene renderer is created.");
+    ImGui::Separator();
+    static constexpr const char* kDisplayModes[] = {
+        "Windowed",
+        "Borderless fullscreen",
+        "Exclusive fullscreen",
+    };
+    if (ImGui::Combo("Display mode", &g_displayMode, kDisplayModes, static_cast<int>(std::size(kDisplayModes)))) {
+        const auto mode = static_cast<AuroraDisplayMode>(g_displayMode);
+        aurora_set_display_mode(mode);
+        const AuroraDisplayMode activeMode = aurora_get_display_mode();
+        if (activeMode == mode) {
+            RuntimeConfigFile::SetDisplayMode(std::string(kDisplayModeConfigNames[static_cast<size_t>(g_displayMode)]));
+        } else {
+            g_displayMode = static_cast<int>(activeMode);
+        }
+    }
+    if (g_displayMode == AURORA_DISPLAY_MODE_EXCLUSIVE) {
+        ImGui::TextDisabled(
+            "Requests the closest native-resolution display mode to the output frame "
+            "rate (60 Hz, or the frame interpolation target).");
+    }
+    constexpr std::array<const char*, 3> kFrameInterpolationModes{
+        "Off", "120 FPS", "180 FPS",
+    };
+    const char* currentFrameInterpolationMode =
+        kFrameInterpolationModes[static_cast<size_t>(g_frameInterpolationMode)];
+    bool frameInterpolationModeChanged = false;
+    if (ImGui::BeginCombo("Race frame interpolation (experimental)", currentFrameInterpolationMode)) {
+        for (int mode = 0; mode < static_cast<int>(kFrameInterpolationModes.size()); ++mode) {
+            const bool selected = g_frameInterpolationMode == mode;
+            if (ImGui::Selectable(kFrameInterpolationModes[static_cast<size_t>(mode)], selected)) {
+                g_frameInterpolationMode = mode;
+                frameInterpolationModeChanged = true;
+            }
+            if (selected) {
+                ImGui::SetItemDefaultFocus();
+            }
+        }
+        ImGui::EndCombo();
+    }
+    if (frameInterpolationModeChanged) {
+        const uint32_t targetFps = kFrameInterpolationTargetFps[static_cast<size_t>(g_frameInterpolationMode)];
+        aurora_set_frame_interpolation_fps(targetFps);
+        RuntimeConfigFile::SetFrameInterpolationFps(targetFps);
+        LimitResolutionForFrameRate();
+        if (aurora_get_display_mode() == AURORA_DISPLAY_MODE_EXCLUSIVE) {
+            // Re-apply exclusive mode so the display refresh tracks the new target.
+            aurora_set_display_mode(AURORA_DISPLAY_MODE_EXCLUSIVE);
+        }
+    }
+    ImGui::PushTextWrapPos(ImGui::GetCursorPosX() + 380.0f);
+    ImGui::TextDisabled("Frame interpolation is experimental, you might find visual artifacts");
+    ImGui::PopTextWrapPos();
+    if (ImGui::Checkbox("Disable copy filter", &g_disableCopyFilter)) {
+        aurora_set_disable_copy_filter(g_disableCopyFilter);
+        RuntimeConfigFile::SetDisableCopyFilter(g_disableCopyFilter);
+    }
+    if (ImGui::Checkbox("Skip draws while shaders compile", &g_skipUnreadyPipelines)) {
+        aurora_set_skip_unready_pipelines(g_skipUnreadyPipelines);
+        RuntimeConfigFile::SetSkipUnreadyPipelines(g_skipUnreadyPipelines);
+    }
+    if (ImGui::Checkbox("Show FPS", &g_showFps)) {
+        RuntimeConfigFile::SetShowFps(g_showFps);
+    }
+    ImGui::Separator();
+    ImGui::Text("Graphics API: %s", GraphicsApiDisplayName());
+}
+
+void DrawFpsOverlay() {
+    AuroraPresentTiming presentTiming{};
+    aurora_get_present_timing(&presentTiming);
+    if (!g_showFps) {
+        return;
+    }
+
+    const ImGuiIO& io = ImGui::GetIO();
+    constexpr float kMargin = 10.0f;
+    const float top = g_topBarVisible ? ImGui::GetFrameHeight() + kMargin : kMargin;
+    ImGui::SetNextWindowPos(ImVec2(io.DisplaySize.x - kMargin, top), ImGuiCond_Always, ImVec2(1.0f, 0.0f));
+    ImGui::SetNextWindowBgAlpha(0.55f);
+    constexpr ImGuiWindowFlags kFlags = ImGuiWindowFlags_AlwaysAutoResize |
+                                         ImGuiWindowFlags_NoDecoration |
+                                         ImGuiWindowFlags_NoFocusOnAppearing |
+                                         ImGuiWindowFlags_NoInputs |
+                                         ImGuiWindowFlags_NoMove |
+                                         ImGuiWindowFlags_NoNav |
+                                         ImGuiWindowFlags_NoSavedSettings;
+    if (ImGui::Begin("FPS Overlay", nullptr, kFlags)) {
+        if (presentTiming.sampleCount == 0) {
+            ImGui::TextUnformatted("FPS: --");
+        } else {
+            // Present timing includes the additional frames produced by
+            // interpolation, so this remains the actual displayed FPS.
+            ImGui::Text("FPS: %.1f", presentTiming.framesPerSecond);
+            // Replay-unsafe frames hold the presented cadence with duplicated
+            // slots, so the counter alone reads 180 while the motion on screen
+            // is 60 Hz. Surface the divergence instead of hiding it.
+            if (presentTiming.effectiveFramesPerSecond <
+                presentTiming.framesPerSecond * 0.95) {
+                ImGui::TextColored(ImVec4(1.0f, 0.75f, 0.25f, 1.0f), "Motion: %.1f",
+                                   presentTiming.effectiveFramesPerSecond);
+            }
+        }
+    }
+    ImGui::End();
+}
+
+void DrawShaderCompilationStatus() {
+    const uint32_t queuedPipelines = aurora_get_queued_pipeline_count();
+    if (queuedPipelines == 0) {
+        return;
+    }
+
+    constexpr float kMargin = 10.0f;
+    const float top = g_topBarVisible ? ImGui::GetFrameHeight() + kMargin : kMargin;
+    ImGui::SetNextWindowPos(ImVec2(kMargin, top), ImGuiCond_Always);
+    ImGui::SetNextWindowBgAlpha(0.55f);
+    ImGui::PushStyleVar(ImGuiStyleVar_WindowPadding, ImVec2(7.0f, 4.0f));
+    constexpr ImGuiWindowFlags kFlags = ImGuiWindowFlags_AlwaysAutoResize |
+                                        ImGuiWindowFlags_NoDecoration |
+                                        ImGuiWindowFlags_NoFocusOnAppearing |
+                                        ImGuiWindowFlags_NoInputs |
+                                        ImGuiWindowFlags_NoMove |
+                                        ImGuiWindowFlags_NoNav |
+                                        ImGuiWindowFlags_NoSavedSettings;
+    if (ImGui::Begin("Shader Compilation Status", nullptr, kFlags)) {
+        ImGui::SetWindowFontScale(0.85f);
+        ImGui::Text("%u shader%s compiling", queuedPipelines, queuedPipelines == 1 ? "" : "s");
+    }
+    ImGui::End();
+    ImGui::PopStyleVar();
+}
+
+void DrawStartupScreen() {
+    if (!StartupScreenVisible()) {
+        return;
+    }
+
+    const ImGuiViewport* viewport = ImGui::GetMainViewport();
+    ImGui::SetNextWindowPos(viewport->Pos, ImGuiCond_Always);
+    ImGui::SetNextWindowSize(viewport->Size, ImGuiCond_Always);
+    ImGui::SetNextWindowBgAlpha(1.0f);
+    ImGui::PushStyleColor(ImGuiCol_WindowBg, IM_COL32(0, 0, 0, 255));
+    ImGui::PushStyleVar(ImGuiStyleVar_WindowPadding, ImVec2(0.0f, 0.0f));
+    constexpr ImGuiWindowFlags kFlags = ImGuiWindowFlags_NoDecoration |
+                                        ImGuiWindowFlags_NoFocusOnAppearing |
+                                        ImGuiWindowFlags_NoInputs |
+                                        ImGuiWindowFlags_NoMove |
+                                        ImGuiWindowFlags_NoNav |
+                                        ImGuiWindowFlags_NoSavedSettings |
+                                        ImGuiWindowFlags_NoBringToFrontOnFocus;
+    if (ImGui::Begin("Wiicompiled Startup", nullptr, kFlags)) {
+        ImGui::SetWindowFontScale(1.25f);
+        constexpr const char* kTitle = "WiiCompiled";
+        const ImVec2 titleSize = ImGui::CalcTextSize(kTitle);
+        const float titleX = std::max(0.0f, (viewport->Size.x - titleSize.x) * 0.5f);
+        const float startY = std::max(0.0f, (viewport->Size.y - titleSize.y) * 0.5f);
+        ImGui::SetCursorPos(ImVec2(titleX, startY));
+        ImGui::TextUnformatted(kTitle);
+    }
+    ImGui::End();
+    ImGui::PopStyleVar();
+    ImGui::PopStyleColor();
+}
+
+void DrawTopBar() {
+    if (!g_topBarVisible || !ImGui::BeginMainMenuBar()) {
+        return;
+    }
+
+    ImGui::TextUnformatted("WiiCompiled");
+    ImGui::Separator();
+    const auto resolutionIt = std::find_if(kResolutions.begin(), kResolutions.end(), [](const ResolutionItem& item) {
+        return std::fabs(item.scale - g_resolutionScale) < 0.001f;
+    });
+    const char* resolutionLabel = resolutionIt != kResolutions.end() ? resolutionIt->label : "Custom";
+    const std::string resolutionMenuLabel = std::string("Resolution: ") + resolutionLabel;
+    if (ImGui::BeginMenu(resolutionMenuLabel.c_str())) {
+        for (const auto& resolution : kResolutions) {
+            const bool selected = std::fabs(resolution.scale - g_resolutionScale) < 0.001f;
+            const bool disabled = IsHighFrameRateMode() && IsHighResolutionScale(resolution.scale);
+            ImGui::BeginDisabled(disabled);
+            const bool clicked = ImGui::MenuItem(resolution.label, nullptr, selected);
+            ImGui::EndDisabled();
+            if (clicked) {
+                SetResolutionScale(resolution.scale);
+            }
+        }
+        ImGui::EndMenu();
+    }
+
+    if (ImGui::BeginMenu("Graphics")) {
+        DrawGraphicsSettings();
+        ImGui::EndMenu();
+    }
+
+    if (ImGui::BeginMenu("Controller settings")) {
+        DrawControllerSettings();
+        ImGui::EndMenu();
+    }
+
+    const std::string audioLabel = g_audioMuted
+        ? "Audio: Muted"
+        : "Audio: " + std::to_string(g_audioVolumePercent) + "%";
+    // Keep the popup ID stable while the Master slider changes the visible
+    // label. Without the ### suffix, ImGui treats every new percentage as a
+    // different menu and closes the popup on the first drag update.
+    const std::string audioMenuLabel = audioLabel + "###AudioSettingsMenu";
+    if (ImGui::BeginMenu(audioMenuLabel.c_str())) {
+        DrawAudioSettings();
+        ImGui::EndMenu();
+    }
+
+    const float hideWidth = ImGui::CalcTextSize("Hide (F10)").x + ImGui::GetStyle().FramePadding.x * 2.0f;
+    ImGui::SetCursorPosX(std::max(ImGui::GetCursorPosX(), ImGui::GetWindowWidth() - hideWidth - 8.0f));
+    if (ImGui::MenuItem("Hide (F10)")) {
+        SetTopBarVisible(false);
+    }
+    ImGui::EndMainMenuBar();
+}
+
+bool IsToggleKey(const SDL_Event& event, SDL_Scancode code) {
+    return event.type == SDL_EVENT_KEY_DOWN && !event.key.repeat && event.key.scancode == code;
+}
+
+bool IsMouseActivity(const SDL_Event& event) {
+    switch (event.type) {
+    case SDL_EVENT_MOUSE_MOTION:
+    case SDL_EVENT_MOUSE_BUTTON_DOWN:
+    case SDL_EVENT_MOUSE_BUTTON_UP:
+    case SDL_EVENT_MOUSE_WHEEL:
+        return true;
+    default:
+        return false;
+    }
+}
+
+// Runs on the thread that pumps SDL events (the same one that calls Draw), so
+// the SDL cursor calls are safe here.
+void UpdateCursorAutoHide() {
+    const bool shouldHide =
+        !g_topBarVisible && Clock::now() - g_lastMouseActivity >= kCursorAutoHideDelay;
+    if (shouldHide == g_cursorHidden) {
+        return;
+    }
+    g_cursorHidden = shouldHide;
+    if (shouldHide) {
+        SDL_HideCursor();
+    } else {
+        SDL_ShowCursor();
+    }
+}
+
+// Alt+Enter toggles the display mode inside aurora without going through the
+// F10 combo, so the active mode is compared against the last persisted one
+// every frame and written back on change.
+void PersistDisplayModeIfChanged() {
+    const int active = static_cast<int>(aurora_get_display_mode());
+    if (active == g_displayMode) {
+        return;
+    }
+    g_displayMode = active;
+    RuntimeConfigFile::SetDisplayMode(std::string(kDisplayModeConfigNames[static_cast<size_t>(active)]));
+}
+} // namespace
+
+void InitializeRuntimeSettings() noexcept {
+    ApplyConfiguredMappings();
+    AudioBackend::Instance().SetMasterVolume(static_cast<float>(g_audioVolumePercent) / 100.0f);
+    AudioBackend::Instance().SetMuted(g_audioMuted);
+    MusicAttenuation::SetMusicVolume(static_cast<float>(g_musicVolumePercent) / 100.0f);
+    MusicAttenuation::SetSoundEffectsVolume(static_cast<float>(g_soundEffectsVolumePercent) / 100.0f);
+    MusicAttenuation::SetUiVolume(static_cast<float>(g_uiVolumePercent) / 100.0f);
+    MusicAttenuation::SetVoicesVolume(static_cast<float>(g_voicesVolumePercent) / 100.0f);
+    MusicAttenuation::SetEnabled(g_attenuateMusicWhenMediaPlays);
+    RuntimeGameGraphicsOptions::SetDisabledPostProcessingPaths(g_disabledPostProcessingPaths);
+    const uint32_t targetFps = kFrameInterpolationTargetFps[static_cast<size_t>(g_frameInterpolationMode)];
+    LimitResolutionForFrameRate();
+    aurora_set_frame_interpolation_fps(targetFps);
+    aurora_set_display_mode(static_cast<AuroraDisplayMode>(g_displayMode));
+    g_displayMode = static_cast<int>(aurora_get_display_mode());
+    aurora_set_disable_copy_filter(g_disableCopyFilter);
+    aurora_set_skip_unready_pipelines(g_skipUnreadyPipelines);
+    g_strapInputAccepted.store(false, std::memory_order_relaxed);
+    g_startupDismissFrame.store(UINT64_MAX, std::memory_order_relaxed);
+    PADBlockInput(g_topBarVisible);
+}
+
+void HandleEvents(const AuroraEvent* events) noexcept {
+    if (!events) {
+        return;
+    }
+    for (const AuroraEvent* ev = events; ev->type != AURORA_NONE; ++ev) {
+        if (ev->type == AURORA_CONTROLLER_ADDED || ev->type == AURORA_CONTROLLER_REMOVED) {
+            g_configuredControllerIndices.fill(std::numeric_limits<int32_t>::min());
+        }
+        if (ev->type != AURORA_SDL_EVENT) {
+            continue;
+        }
+        if (IsToggleKey(ev->sdl, SDL_SCANCODE_F10)) {
+            SetTopBarVisible(!g_topBarVisible);
+        }
+        if (IsMouseActivity(ev->sdl)) {
+            g_lastMouseActivity = Clock::now();
+        }
+    }
+}
+
+void Draw() noexcept {
+    // Wait for the frame worker's DONE phase: it has replayed the previous frame's ImGui draw lists
+    // and started the next ImGui frame, so all overlay callers can now safely issue ImGui commands.
+    aurora_wait_for_frame_worker();
+    ApplyConfiguredMappings();
+    PersistDisplayModeIfChanged();
+    UpdateCursorAutoHide();
+    if (!StartupScreenVisible()) {
+        DrawShaderCompilationStatus();
+    }
+    DrawFpsOverlay();
+    DrawTopBar();
+    DrawStartupScreen();
+}
+
+bool StartupScreenVisible() noexcept {
+    return !g_strapInputAccepted.load(std::memory_order_acquire) ||
+           g_presentedFrame < g_startupDismissFrame.load(std::memory_order_relaxed);
+}
+
+void NotifyStrapInputAccepted() noexcept {
+    bool expected = false;
+    if (g_strapInputAccepted.compare_exchange_strong(expected, true, std::memory_order_acq_rel)) {
+        g_startupDismissFrame.store(g_presentedFrame + kStrapTransitionCoverFrames,
+                                    std::memory_order_release);
+    }
+}
+
+void AdvancePresentedFrame() noexcept { ++g_presentedFrame; }
+} // namespace settings_overlay
diff --git a/runtime/src/system_bridge.cpp b/runtime/src/system_bridge.cpp
new file mode 100644
index 0000000..644156c
--- /dev/null
+++ b/runtime/src/system_bridge.cpp
@@ -0,0 +1,643 @@
+#include "system_bridge.h"
+
+#include <cctype>
+#include <fstream>
+#include <iomanip>
+#include <iostream>
+#include <optional>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+
+
+#include "abi_bridge.h"
+#include "memory.h"
+#include "ppc_runtime.h"
+#include "recomp_mod_loader.h"
+#include "runtime_log.h"
+#include "runtime_product.h"
+#include "timebase_contract.h"
+
+// Global flag to suppress SEH reporting during static constructor execution
+bool g_suppressSehReporting = false;
+thread_local jmp_buf* g_sehJumpTarget = nullptr;
+thread_local uint32_t g_sehLastExceptionCode = 0;
+thread_local uintptr_t g_sehLastExceptionAddress = 0;
+thread_local uintptr_t g_sehLastAccessedAddress = 0;
+thread_local uint32_t g_sehLastAccessType = 0;
+
+// Forward declaration for data section initialization generated by the translator.
+extern "C" void InitializeDataSections();
+
+namespace {
+std::string Hex32(uint32_t value) {
+    std::ostringstream oss;
+    oss << std::hex << std::uppercase << std::setw(8) << std::setfill('0') << value;
+    return oss.str();
+}
+
+std::optional<std::string> PrintableU32(uint32_t value) {
+    std::string out;
+    out.reserve(4);
+    for (int shift = 24; shift >= 0; shift -= 8) {
+        const auto ch = static_cast<unsigned char>((value >> shift) & 0xFFu);
+        if (!std::isprint(ch)) {
+            return std::nullopt;
+        }
+        out.push_back(static_cast<char>(ch));
+    }
+    return out;
+}
+
+std::optional<TranslatedFunctionInfo> FindNearestTranslatedFunction(uint32_t address) {
+    auto best = TranslatedFunctionRegistry::FindNearestByAddress(address);
+
+    // Crash-only heuristic: large gaps are usually data/FourCC values, not code offsets.
+    if (best && address - best->address < 0x10000u) {
+        return best;
+    }
+    return std::nullopt;
+}
+
+// generated/guest_symbol_table.cpp (or the stub when it is absent): the
+// project's function-map names, sorted by address, for crash symbolization.
+extern "C" {
+extern const uint32_t kGuestMapSymbolCount;
+extern const uint32_t kGuestMapSymbolAddresses[];
+extern const char* const kGuestMapSymbolNames[];
+}
+
+// Floor lookup into the function-map name table with the same gap cap as the
+// registry heuristic above. Returns nullptr when no named symbol is close.
+const char* GuestMapSymbolFloor(uint32_t address, uint32_t* symbolStart) {
+    if (kGuestMapSymbolCount == 0) {
+        return nullptr;
+    }
+    uint32_t lo = 0;
+    uint32_t hi = kGuestMapSymbolCount;
+    while (lo < hi) {
+        const uint32_t mid = lo + (hi - lo) / 2;
+        if (kGuestMapSymbolAddresses[mid] <= address) {
+            lo = mid + 1;
+        } else {
+            hi = mid;
+        }
+    }
+    if (lo == 0) {
+        return nullptr;
+    }
+    const uint32_t index = lo - 1;
+    if (address - kGuestMapSymbolAddresses[index] >= 0x10000u) {
+        return nullptr;
+    }
+    if (symbolStart) {
+        *symbolStart = kGuestMapSymbolAddresses[index];
+    }
+    return kGuestMapSymbolNames[index];
+}
+
+std::optional<uint32_t> ReadGuest32NoThrow(uint32_t address) {
+    uint32_t value = 0;
+    if (MemoryInline::TryReadMappedScalar(address, value)) {
+        return value;
+    }
+    return std::nullopt;
+}
+
+std::optional<uint8_t> ReadGuest8NoThrow(uint32_t address) {
+    uint8_t value = 0;
+    if (MemoryInline::TryReadMappedScalar(address, value)) {
+        return value;
+    }
+    return std::nullopt;
+}
+
+std::optional<std::string> GuestCStringPreview(uint32_t address) {
+    std::string out;
+    out.reserve(48);
+    for (uint32_t i = 0; i < 48; ++i) {
+        const auto byte = ReadGuest8NoThrow(address + i);
+        if (!byte) {
+            return std::nullopt;
+        }
+        if (*byte == 0) {
+            return out.size() >= 3 ? std::optional<std::string>(out) : std::nullopt;
+        }
+        if (!std::isprint(*byte)) {
+            return std::nullopt;
+        }
+        out.push_back(static_cast<char>(*byte));
+    }
+    out += "...";
+    return out;
+}
+
+void PrintGuestValue(std::ostream& os, std::string_view label, uint32_t value) {
+    os << " ";
+    if (!label.empty()) {
+        os << label << "=";
+    }
+    os << "0x" << Hex32(value);
+    // Prefer the function-map name (human symbol) over the registry's
+    // func_XXXXXXXX label; when both resolve, the closer floor wins so a map
+    // symbol from a preceding function cannot shadow an exact registry hit.
+    uint32_t mapStart = 0;
+    const char* mapName = GuestMapSymbolFloor(value, &mapStart);
+    if (const auto* exact = TranslatedFunctionRegistry::FindByAddressPtr(value)) {
+        if (mapName && mapStart >= exact->address) {
+            os << "<" << mapName;
+            if (value != mapStart) {
+                os << "+0x" << std::hex << std::uppercase << (value - mapStart) << std::dec;
+            }
+            os << ">";
+        } else {
+            os << "<" << exact->name << ">";
+        }
+    } else if (auto nearest = FindNearestTranslatedFunction(value)) {
+        if (mapName && mapStart >= nearest->address) {
+            os << "<" << mapName;
+            if (value != mapStart) {
+                os << "+0x" << std::hex << std::uppercase << (value - mapStart) << std::dec;
+            }
+            os << ">";
+        } else {
+            os << "<" << nearest->name << "+0x" << std::hex << std::uppercase
+               << (value - nearest->address) << std::dec << ">";
+        }
+    } else if (mapName) {
+        os << "<" << mapName << "+0x" << std::hex << std::uppercase
+           << (value - mapStart) << std::dec << ">";
+    }
+    if (auto text = PrintableU32(value)) {
+        os << "('" << *text << "')";
+    } else if (auto guestString = GuestCStringPreview(value)) {
+        os << "(\"" << *guestString << "\")";
+    }
+}
+
+void PrintFrameTailWords(std::ostream& os, uint32_t previousSp) {
+    os << " tail:";
+    for (int32_t offset = -0x40; offset <= 0x04; offset += 4) {
+        const uint32_t address = previousSp + static_cast<uint32_t>(offset);
+        const auto value = ReadGuest32NoThrow(address);
+        if (!value) {
+            continue;
+        }
+        os << " " << (offset < 0 ? "-" : "+")
+           << std::hex << std::uppercase << std::setw(2) << std::setfill('0')
+           << static_cast<uint32_t>(std::abs(offset)) << "=0x" << Hex32(*value);
+    }
+    os << std::dec << std::setfill(' ');
+}
+
+void DumpGuestBackchain(std::ostream& os, const CpuContext* cpu) {
+    uint32_t sp = cpu->gpr[1];
+    if (sp == 0) {
+        return;
+    }
+
+    os << "[runtime] Stack backchain:" << std::endl;
+    for (int frame = 0; frame < 12; ++frame) {
+        const auto previousSp = ReadGuest32NoThrow(sp);
+        if (!previousSp || *previousSp == 0) {
+            os << "[runtime]   #" << frame << " sp=0x" << Hex32(sp) << " prev=(unmapped)" << std::endl;
+            break;
+        }
+
+        const uint32_t frameSize = *previousSp - sp;
+        os << "[runtime]   #" << frame << " sp=0x" << Hex32(sp)
+           << " prev=0x" << Hex32(*previousSp)
+           << " size=0x" << std::hex << std::uppercase << frameSize << std::dec;
+
+        if (frameSize <= 0x20000u) {
+            if (const auto savedLr = ReadGuest32NoThrow(*previousSp + 4u)) {
+                PrintGuestValue(os, "savedLR", *savedLr);
+            }
+            PrintFrameTailWords(os, *previousSp);
+        }
+        os << std::endl;
+
+        if (*previousSp <= sp || frameSize > 0x20000u) {
+            break;
+        }
+        sp = *previousSp;
+    }
+}
+
+void DumpGuestStackHints(std::ostream& os, const CpuContext* cpu) {
+    const uint32_t sp = cpu->gpr[1];
+    if (sp == 0) {
+        return;
+    }
+
+    os << "[runtime] Stack words:";
+    for (uint32_t offset = 0; offset < 0x40; offset += 4) {
+        const auto value = ReadGuest32NoThrow(sp + offset);
+        if (!value) {
+            break;
+        }
+        os << " +" << std::hex << std::uppercase << std::setw(2) << std::setfill('0')
+           << offset << "=0x" << Hex32(*value);
+    }
+    os << std::dec << std::setfill(' ') << std::endl;
+
+    int printed = 0;
+    for (uint32_t offset = 0; offset < 0x800 && printed < 32; offset += 4) {
+        const auto value = ReadGuest32NoThrow(sp + offset);
+        if (!value) {
+            continue;
+        }
+        if (!TranslatedFunctionRegistry::FindByAddressPtr(*value) && !FindNearestTranslatedFunction(*value)) {
+            continue;
+        }
+        if (printed == 0) {
+            os << "[runtime] Stack code refs:";
+        }
+        os << " +" << std::hex << std::uppercase << offset << std::dec << ":";
+        PrintGuestValue(os, "", *value);
+        ++printed;
+    }
+    if (printed != 0) {
+        os << std::endl;
+    }
+}
+
+void DumpGuestCrashHints(std::ostream& os, const CpuContext* cpu) {
+    if (!cpu) {
+        return;
+    }
+
+    const uint32_t active = RecompMod::CurrentTranslatedExecutionAddress();
+    if (active != 0) {
+        os << "[runtime] Active translated target: ";
+        PrintGuestValue(os, "guest", active);
+        os << std::endl;
+    }
+
+    os << "[runtime] Guest refs:";
+    PrintGuestValue(os, "pc", cpu->pc);
+    PrintGuestValue(os, "lr", cpu->lr);
+    PrintGuestValue(os, "ctr", cpu->ctr);
+    PrintGuestValue(os, "r12", cpu->gpr[12]);
+    PrintGuestValue(os, "r3", cpu->gpr[3]);
+    PrintGuestValue(os, "r4", cpu->gpr[4]);
+    PrintGuestValue(os, "r5", cpu->gpr[5]);
+    PrintGuestValue(os, "r15", cpu->gpr[15]);
+    PrintGuestValue(os, "r16", cpu->gpr[16]);
+    PrintGuestValue(os, "r18", cpu->gpr[18]);
+    PrintGuestValue(os, "r26", cpu->gpr[26]);
+    PrintGuestValue(os, "r27", cpu->gpr[27]);
+    os << std::endl;
+
+    if (active != 0 && active != cpu->pc) {
+        os << "[runtime] Note: active translated target differs from ctx->pc; ctx->pc may be stale "
+              "without PC tracing."
+           << std::endl;
+    }
+
+    DumpGuestStackHints(os, cpu);
+    DumpGuestBackchain(os, cpu);
+}
+
+} // namespace
+
+void SystemBridge::Initialize() {
+    const auto memoryConfig = Memory::Config::WiiDefaults();
+    Memory::Init(memoryConfig);
+
+    SeedLowMemDefaults(memoryConfig);
+
+    // Initialize from the embedded DOL/REL data sections. This provides the
+    // initial memory state for .data, .rodata, .sdata, etc.
+    RT_LOG(RT_TAG_RUNTIME) << "Initializing data sections from embedded DOL/REL data" << std::endl;
+    InitializeDataSections();
+
+    // Constructors run before the main entry point, but they still require the
+    // PowerPC ABI environment. Keep using the persistent context here: the old
+    // AbiCallContext path implicitly selected and seeded it for every ctor.
+    InitializePersistentCpuContext();
+    CpuContext& cpu = GetPersistentCpuContext();
+    cpu.gpr[1] = 0x81700000u;
+    CpuContextScope scope(&cpu);
+
+    g_suppressSehReporting = true;
+
+    // Run main DOL static constructors first
+    // These set up vtables and other critical infrastructure
+    RT_LOG(RT_TAG_RUNTIME) << "Running static constructors for main DOL..." << std::endl;
+
+    const uint32_t dolCtorStart = 0x80244DE0;
+    const uint32_t dolCtorEnd = 0x80244EA0;
+
+    int dolCount = 0;
+    for (uint32_t addr = dolCtorStart; addr < dolCtorEnd; addr += 4) {
+        uint32_t funcAddr = 0;
+        try {
+            funcAddr = Memory::Read32(addr);
+        } catch (...) {
+            continue;
+        }
+
+        if (funcAddr == 0 || funcAddr == 0xFFFFFFFF) continue;
+
+        if (TranslatedFunctionRegistry::FindByAddressPtr(funcAddr)) {
+            jmp_buf jumpBuf;
+            g_sehJumpTarget = &jumpBuf;
+            if (setjmp(jumpBuf) == 0) {
+                cpu.gpr[1] = 0x81700000u;
+                InvokeIndirectCpu(funcAddr, &cpu);
+                dolCount++;
+            } else {
+                RT_LOG(RT_TAG_RUNTIME) << "SEH Exception caught invoking DOL ctor 0x" << std::hex << funcAddr
+                          << " code=0x" << g_sehLastExceptionCode
+                          << " at=0x" << g_sehLastExceptionAddress;
+                if (g_sehLastExceptionCode == 0xC0000005u && g_sehLastAccessedAddress != 0) {
+                    std::cerr << " " << (g_sehLastAccessType ? "write" : "read")
+                              << "=0x" << g_sehLastAccessedAddress;
+                }
+                std::cerr << std::dec << " - skipping." << std::endl;
+            }
+            g_sehJumpTarget = nullptr;
+        }
+    }
+    RT_LOG(RT_TAG_RUNTIME) << "Executed " << dolCount << " main DOL static constructors." << std::endl;
+
+    // StaticR.rel ctors must be run manually since we aren't using OSLink
+    RT_LOG(RT_TAG_RUNTIME) << "Running static constructors for StaticR.rel..." << std::endl;
+
+    // Define range for StaticR.rel .ctors
+    const uint32_t ctorStart = 0x8088f400;
+    const uint32_t ctorEnd = 0x8088f704;
+
+    int count = 0;
+    for (uint32_t addr = ctorStart; addr < ctorEnd; addr += 4) {
+        uint32_t funcAddr = 0;
+        try {
+            funcAddr = Memory::Read32(addr);
+        } catch (...) {
+            continue;
+        }
+
+        if (funcAddr == 0 || funcAddr == 0xFFFFFFFF) continue;
+
+        if (TranslatedFunctionRegistry::FindByAddressPtr(funcAddr)) {
+            jmp_buf jumpBuf;
+            g_sehJumpTarget = &jumpBuf;
+            if (setjmp(jumpBuf) == 0) {
+                cpu.gpr[1] = 0x81700000u;
+                InvokeIndirectCpu(funcAddr, &cpu);
+                count++;
+            } else {
+                RT_LOG(RT_TAG_RUNTIME) << "SEH Exception caught invoking ctor 0x" << std::hex << funcAddr
+                          << " code=0x" << g_sehLastExceptionCode
+                          << " at=0x" << g_sehLastExceptionAddress;
+                if (g_sehLastExceptionCode == 0xC0000005u && g_sehLastAccessedAddress != 0) {
+                    std::cerr << " " << (g_sehLastAccessType ? "write" : "read")
+                              << "=0x" << g_sehLastAccessedAddress;
+                }
+                std::cerr << std::dec << " - skipping." << std::endl;
+            }
+            g_sehJumpTarget = nullptr;
+        }
+    }
+    g_suppressSehReporting = false;
+    RT_LOG(RT_TAG_RUNTIME) << "Executed " << count << " static constructors." << std::endl;
+}
+
+void SystemBridge::WriteGuestMemorySnapshot(std::ostream& os, const char* mem1Path) {
+    constexpr uint32_t kMem1Base = 0x80000000u;
+    constexpr uint32_t kMem1Size = 0x01800000u;
+    if (Memory::Contains(kMem1Base, kMem1Size)) {
+        std::ofstream dump(mem1Path, std::ios::binary | std::ios::trunc);
+        dump.write(reinterpret_cast<const char*>(Memory::GetPointer(kMem1Base, kMem1Size)),
+                   kMem1Size);
+        os << "[runtime] MEM1 snapshot written to " << mem1Path
+           << (dump.good() ? "" : " (write failed)") << std::endl;
+    }
+    constexpr uint32_t kMem2Base = 0x90000000u;
+    for (uint32_t mem2Size : {0x08000000u, 0x04000000u}) {
+        if (!Memory::Contains(kMem2Base, mem2Size)) {
+            continue;
+        }
+        const std::string mem2Path = std::string(mem1Path) + ".mem2";
+        std::ofstream dump(mem2Path, std::ios::binary | std::ios::trunc);
+        dump.write(reinterpret_cast<const char*>(Memory::GetPointer(kMem2Base, mem2Size)),
+                   mem2Size);
+        os << "[runtime] MEM2 snapshot written to " << mem2Path
+           << (dump.good() ? "" : " (write failed)") << std::endl;
+        break;
+    }
+}
+
+void SystemBridge::DumpCrashHeuristics(std::ostream& os, const CpuContext* cpu,
+                                       const uint32_t* missingGuestTarget) {
+    if (!cpu) {
+        return;
+    }
+
+    if (missingGuestTarget && *missingGuestTarget == 0) {
+        os << "[runtime] The guest jumped to address 0 - almost always a virtual call "
+              "through a bad object, or a callback pointer that was never set."
+           << std::endl;
+        if (cpu->gpr[3] == 0) {
+            os << "[runtime] r3 (the C++ 'this' pointer) is NULL at the call. A very common "
+                  "cause is an unchecked guest heap allocation failure: every "
+                  "\"heap (...)->alloc(size(...))\" OSReport line above is a FAILED "
+                  "allocation (the number after 'free' is the bytes actually left in "
+                  "that heap). If those lines are present, the heap was exhausted "
+                  "before this crash." << std::endl;
+        }
+    } else if (missingGuestTarget) {
+        os << "[runtime] The guest jumped to 0x" << std::hex << std::uppercase
+           << *missingGuestTarget << std::dec
+           << ", which is not a translated function entry. If the value looks like "
+              "readable text or a data pointer, a function pointer or vtable was "
+              "overwritten (guest memory stomp)." << std::endl;
+    }
+}
+
+// MEM2 space reserved at startup for the runtime FST.
+extern "C" uint32_t g_dvdFstReservedBase = 0;
+extern "C" uint32_t g_dvdFstReservedSize = 0;
+
+void SystemBridge::SeedLowMemDefaults(const Memory::Config& config) {
+
+    const auto* mem1Region = FindRegionConfig(config, "MEM1");
+    const auto* mem2Region = FindRegionConfig(config, "MEM2");
+    const uint32_t mem1Size = mem1Region ? static_cast<uint32_t>(mem1Region->sizeBytes) : 0;
+    const uint32_t mem2Size = mem2Region ? static_cast<uint32_t>(mem2Region->sizeBytes) : 0;
+
+    struct SeedEntry {
+        uint32_t address;
+        uint32_t value;
+        const char* label;
+        bool force = false;
+    };
+
+    std::vector<SeedEntry> entries;
+    constexpr uint32_t kMem1ArenaLoDefault = 0x80399180u;
+    uint32_t mem1ArenaHiDefault = 0x817f0520u;
+    constexpr uint32_t kBusClockHz =
+        static_cast<uint32_t>(TimeBaseContract::kBusClockHz);
+    constexpr uint32_t kCpuClockHz = kBusClockHz * 3u;
+    // Mario Kart Wii boots under IOS36. These are the IOS kernel values that
+    // Dolphin exposes in low memory for IOS36 (VersionInfo.cpp). SDK helpers
+    // read them through the 0xC0000000 MEM1 alias.
+    constexpr uint32_t kIos36Version = 0x00240E18u;
+    constexpr uint32_t kIos36Date = 0x00030110u;
+
+    constexpr uint32_t kMem2LoFloor = 0x90000800u;
+    // Reserve enough guest memory for the runtime-built DVD FST.
+    constexpr uint32_t kDvdFstReserveSize = 0x200000u;
+    // IOS36 reserves 128 KiB for IPC immediately below a 128 KiB IOS-owned
+    // block. Dolphin's RAM override preserves both sizes and moves them to the
+    // top of the expanded MEM2 mapping.
+    constexpr uint32_t kIPCArenaSize = 0x20000u;
+    constexpr uint32_t kIosReservedSize = 0x20000u;
+
+    // The boot code exposes the current disc ID in low memory before DVDInit.
+    // Retro Rewind reads the region byte directly from here while building its
+    // Retro-WFC payload URL, and OSGetAppGamename reads the app code mirrors
+    // at 0x80003180/0x80003194 while building NAS auth fields.
+    entries.push_back({0x80000000u, 0x524D4350u, "Disc game code"}); // RMCP
+    entries.push_back({0x80000004u, 0x30310100u, "Disc maker/id"});  // 01 + disc 1
+    entries.push_back({0x80003180u, 0x524D4350u, "OS app game code"}); // RMCP
+    entries.push_back({0x80003194u, 0x524D4350u, "OS app gamename"});  // RMCP
+    if (RuntimeProduct::IsRetroRewind()) {
+        entries.push_back({0x800017D8u, 0x00000001u, "Retro Rewind recomp runtime marker", true});
+    }
+
+    for (const auto& reservation : RecompMod::MemoryReservations()) {
+        if (reservation.start >= kMem1ArenaLoDefault &&
+            reservation.start < mem1ArenaHiDefault &&
+            reservation.end <= 0x81800000u) {
+            mem1ArenaHiDefault = reservation.start;
+            RT_LOG(RT_TAG_MOD) << "Reserved MEM1 range 0x" << std::hex << std::uppercase
+                      << reservation.start << "-0x" << reservation.end
+                      << " for " << reservation.name
+                      << "; MEM1 arena hi now 0x" << mem1ArenaHiDefault
+                      << std::dec << std::nouppercase << std::endl;
+        }
+    }
+
+    // Seed OS clock values used by SDK timing helpers (OSBusClock/OSClock).
+    entries.push_back({0x800000F8u, kBusClockHz, "__OSBusClock"});
+    entries.push_back({0x800000FCu, kCpuClockHz, "__OSClock"});
+    entries.push_back({0x80003140u, kIos36Version, "IOS36 version"});
+    entries.push_back({0x80003144u, kIos36Date, "IOS36 date"});
+
+    if (mem1Size != 0) {
+        const uint32_t mem1End = Memory::kMem1CachedBase + mem1Size;
+        entries.push_back({0x80000028u, mem1Size, "Legacy MEM1 size", true});
+        entries.push_back({0x80000030u, kMem1ArenaLoDefault, "Legacy MEM1 arena lo", true});
+        entries.push_back({0x80000034u, mem1ArenaHiDefault, "Legacy MEM1 arena hi", true});
+        entries.push_back({0x800000F0u, mem1Size, "Legacy simulated MEM1 size", true});
+        entries.push_back({0x80003100u, mem1Size, "Physical MEM1 size", true});
+        entries.push_back({0x80003104u, mem1Size, "Simulated MEM1 size", true});
+        entries.push_back({0x80003108u, mem1End, "MEM1 end", true});
+        entries.push_back({0x8000310Cu, kMem1ArenaLoDefault, "MEM1 arena lo", true});
+        entries.push_back({0x80003110u, mem1ArenaHiDefault, "MEM1 arena hi", true});
+    }
+
+    if (mem2Size != 0) {
+        const uint32_t physicalMem2End = Memory::kMem2CachedBase + mem2Size;
+        const uint32_t iosReservedLo = physicalMem2End - kIosReservedSize;
+        const uint32_t mem2End = iosReservedLo;
+        const uint32_t ipcBufHi = mem2End;
+        const uint32_t ipcBufLo = ipcBufHi - kIPCArenaSize;
+        // Reserve FST memory before guest code can use this part of the arena.
+        g_dvdFstReservedSize = kDvdFstReserveSize;
+        g_dvdFstReservedBase = ipcBufLo - kDvdFstReserveSize;
+        const uint32_t mem2ArenaHi = g_dvdFstReservedBase;
+
+        entries.push_back({0x80003118u, mem2Size, "Physical MEM2 size", true});
+        entries.push_back({0x8000311Cu, mem2Size, "Simulated MEM2 size", true});
+        entries.push_back({0x80003120u, mem2End, "MEM2 end", true});
+        entries.push_back({0x80003124u, kMem2LoFloor, "MEM2 arena lo", true});
+        entries.push_back({0x80003128u, mem2ArenaHi, "MEM2 arena hi", true});
+        entries.push_back({0x80003130u, ipcBufLo, "IPC Buffer lo", true});
+        entries.push_back({0x80003134u, ipcBufHi, "IPC Buffer hi", true});
+        entries.push_back({0x80003138u, 0x00000002u, "Hollywood revision", true});
+        entries.push_back({0x80003148u, iosReservedLo, "IOS reserved lo", true});
+        entries.push_back({0x8000314Cu, physicalMem2End, "IOS reserved hi", true});
+    }
+
+    bool patchedAny = false;
+    size_t seededCount = 0;
+    for (const auto& entry : entries) {
+        if (entry.value == 0) continue;
+        
+        // Only patch if the address is mapped
+        if (!Memory::Contains(entry.address, sizeof(uint32_t))) continue;
+
+        // Only patch if currently zero (don't overwrite if OS already initialized)
+        if (!entry.force && Memory::Read32(entry.address) != 0) continue;
+        
+        Memory::Write32(entry.address, entry.value);
+        patchedAny = true;
+        ++seededCount;
+    }
+
+    if (seededCount != 0) {
+        RT_LOG(RT_TAG_RUNTIME) << "Seeded " << seededCount << " low-memory default(s)" << std::endl;
+    }
+
+    if (patchedAny && mem2Size != 0) {
+        const uint32_t patchedLo = Memory::Read32(0x80003124u);
+        const uint32_t patchedHi = Memory::Read32(0x80003128u);
+        const uint32_t patchedSize = Memory::Read32(0x8000311Cu);
+        RT_LOG(RT_TAG_RUNTIME) << "MEM2 defaults active -> size=" << (patchedSize / (1024 * 1024))
+                  << " MB, arena 0x" << std::hex << std::uppercase << patchedLo
+                  << " - 0x" << patchedHi << std::dec << std::nouppercase << std::endl;
+    }
+}
+
+const Memory::RegionConfig* SystemBridge::FindRegionConfig(const Memory::Config& config, std::string_view name) {
+    for (const auto& region : config.regions) {
+        if (region.name == name) {
+            return &region;
+        }
+    }
+    return nullptr;
+}
+
+void SystemBridge::DumpCpuState(const CpuContext* cpu) {
+    DumpCpuState(std::cerr, cpu);
+}
+
+void SystemBridge::DumpCpuState(std::ostream& os, const CpuContext* cpu) {
+    if (!cpu) {
+        os << "[runtime] CPU context unavailable; registers could not be dumped." << std::endl;
+        return;
+    }
+
+    DumpGuestCrashHints(os, cpu);
+
+    os << "[runtime] PC=0x" << Hex32(cpu->pc)
+       << " LR=0x" << Hex32(cpu->lr)
+       << " CTR=0x" << Hex32(cpu->ctr)
+       << " CR=0x" << Hex32(cpu->cr)
+       << " XER=0x" << Hex32(cpu->xer) << std::endl;
+    os << "[runtime] SRR0=0x" << Hex32(cpu->srr0)
+       << " SRR1=0x" << Hex32(cpu->srr1) << std::endl;
+    os << "[runtime] SP(r1)=0x" << Hex32(cpu->gpr[1])
+       << " R2=0x" << Hex32(cpu->gpr[2])
+       << " R13=0x" << Hex32(cpu->gpr[13]) << std::endl;
+
+    for (int base = 0; base < 32; base += 8) {
+        os << "[runtime] GPR" << std::setw(2) << std::setfill('0') << base
+           << "-" << std::setw(2) << std::setfill('0') << (base + 7) << ": ";
+        for (int i = 0; i < 8; ++i) {
+            const int reg = base + i;
+            os << "r" << std::setw(2) << std::setfill('0') << reg << "=0x"
+               << Hex32(cpu->gpr[reg]) << (i == 7 ? "" : " ");
+        }
+        os << std::setfill(' ') << std::endl;
+    }
+    os << std::setfill(' ');
+}
diff --git a/runtime/third_party/cryptopp/3way.cpp b/runtime/third_party/cryptopp/3way.cpp
new file mode 100644
index 0000000..4228e5e
--- /dev/null
+++ b/runtime/third_party/cryptopp/3way.cpp
@@ -0,0 +1,143 @@
+// 3way.cpp - modified by Wei Dai from Joan Daemen's 3way.c
+// The original code and all modifications are in the public domain.
+
+#include "pch.h"
+#include "3way.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void ThreeWay_TestInstantiations()
+{
+	ThreeWay::Encryption x1;
+	ThreeWay::Decryption x2;
+}
+#endif
+
+namespace
+{
+	const word32 START_E = 0x0b0b; // round constant of first encryption round
+	const word32 START_D = 0xb1b1; // round constant of first decryption round
+}
+
+static inline word32 reverseBits(word32 a)
+{
+	a = ((a & 0xAAAAAAAA) >> 1) | ((a & 0x55555555) << 1);
+	a = ((a & 0xCCCCCCCC) >> 2) | ((a & 0x33333333) << 2);
+	return ((a & 0xF0F0F0F0) >> 4) | ((a & 0x0F0F0F0F) << 4);
+}
+
+#define mu(a0, a1, a2)				\
+{									\
+	a1 = reverseBits(a1);			\
+	word32 t = reverseBits(a0);		\
+	a0 = reverseBits(a2);			\
+	a2 = t;							\
+}
+
+#define pi_gamma_pi(a0, a1, a2)   \
+{                                 \
+	word32 b0, b2;                          \
+	b2 = rotlConstant<1>(a2);               \
+	b0 = rotlConstant<22>(a0);				\
+	a0 = rotlConstant<1>(b0 ^ (a1|(~b2)));	\
+	a2 = rotlConstant<22>(b2 ^ (b0|(~a1))); \
+	a1 ^= (b2|(~b0));                       \
+}
+
+// thanks to Paulo Barreto for this optimized theta()
+#define theta(a0, a1, a2)									\
+{ 															\
+	word32 b0, b1, c; 										\
+	c = a0 ^ a1 ^ a2; 										\
+	c = rotlConstant<16>(c) ^ rotlConstant<8>(c);			\
+	b0 = (a0 << 24) ^ (a2 >> 8) ^ (a1 << 8) ^ (a0 >> 24); 	\
+	b1 = (a1 << 24) ^ (a0 >> 8) ^ (a2 << 8) ^ (a1 >> 24); 	\
+	a0 ^= c ^ b0; 											\
+	a1 ^= c ^ b1; 											\
+	a2 ^= c ^ (b0 >> 16) ^ (b1 << 16); 						\
+}
+
+#define rho(a0, a1, a2)			\
+{								\
+	theta(a0, a1, a2);			\
+	pi_gamma_pi(a0, a1, a2);	\
+}
+
+void ThreeWay::Base::UncheckedSetKey(const byte *uk, unsigned int length, const NameValuePairs &params)
+{
+	AssertValidKeyLength(length);
+
+	m_rounds = GetRoundsAndThrowIfInvalid(params, this);
+
+	for (unsigned int i=0; i<3; i++)
+		m_k[i] = (word32)uk[4*i+3] | ((word32)uk[4*i+2]<<8) | ((word32)uk[4*i+1]<<16) | ((word32)uk[4*i]<<24);
+
+	if (!IsForwardTransformation())
+	{
+		theta(m_k[0], m_k[1], m_k[2]);
+		mu(m_k[0], m_k[1], m_k[2]);
+		m_k[0] = ByteReverse(m_k[0]);
+		m_k[1] = ByteReverse(m_k[1]);
+		m_k[2] = ByteReverse(m_k[2]);
+	}
+}
+
+void ThreeWay::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	typedef BlockGetAndPut<word32, BigEndian> Block;
+
+	word32 a0, a1, a2;
+	Block::Get(inBlock)(a0)(a1)(a2);
+
+	word32 rc = START_E;
+
+	for(unsigned i=0; i<m_rounds; i++)
+	{
+		a0 ^= m_k[0] ^ (rc<<16);
+		a1 ^= m_k[1];
+		a2 ^= m_k[2] ^ rc;
+		rho(a0, a1, a2);
+
+		rc <<= 1;
+		if (rc&0x10000) rc ^= 0x11011;
+	}
+	a0 ^= m_k[0] ^ (rc<<16);
+	a1 ^= m_k[1];
+	a2 ^= m_k[2] ^ rc;
+	theta(a0, a1, a2);
+
+	Block::Put(xorBlock, outBlock)(a0)(a1)(a2);
+}
+
+void ThreeWay::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	typedef BlockGetAndPut<word32, LittleEndian> Block;
+
+	word32 a0, a1, a2;
+	Block::Get(inBlock)(a0)(a1)(a2);
+
+	word32 rc = START_D;
+
+	mu(a0, a1, a2);
+	for(unsigned i=0; i<m_rounds; i++)
+	{
+		a0 ^= m_k[0] ^ (rc<<16);
+		a1 ^= m_k[1];
+		a2 ^= m_k[2] ^ rc;
+		rho(a0, a1, a2);
+
+		rc <<= 1;
+		if (rc&0x10000) rc ^= 0x11011;
+	}
+	a0 ^= m_k[0] ^ (rc<<16);
+	a1 ^= m_k[1];
+	a2 ^= m_k[2] ^ rc;
+	theta(a0, a1, a2);
+	mu(a0, a1, a2);
+
+	Block::Put(xorBlock, outBlock)(a0)(a1)(a2);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/3way.h b/runtime/third_party/cryptopp/3way.h
new file mode 100644
index 0000000..868fa8c
--- /dev/null
+++ b/runtime/third_party/cryptopp/3way.h
@@ -0,0 +1,63 @@
+// 3way.h - originally written and placed in the public domain by Wei Dai
+
+/// \file 3way.h
+/// \brief Classes for the 3-Way block cipher
+
+#ifndef CRYPTOPP_THREEWAY_H
+#define CRYPTOPP_THREEWAY_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief ThreeWay block cipher information
+struct ThreeWay_Info : public FixedBlockSize<12>, public FixedKeyLength<12>, public VariableRounds<11>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "3-Way";}
+};
+
+/// \brief ThreeWay block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/3-Way">3-Way</a>
+class ThreeWay : public ThreeWay_Info, public BlockCipherDocumentation
+{
+	/// \brief Class specific implementation and overrides used to operate the cipher.
+	/// \details Implementations and overrides in \p Base apply to both \p ENCRYPTION and \p DECRYPTION directions
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<ThreeWay_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		unsigned int m_rounds;
+		FixedSizeSecBlock<word32, 3> m_k;
+	};
+
+	/// \brief Class specific methods used to operate the cipher in the forward direction.
+	/// \details Implementations and overrides in \p Enc apply to \p ENCRYPTION.
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief Class specific methods used to operate the cipher in the reverse direction.
+	/// \details Implementations and overrides in \p Dec apply to \p DECRYPTION.
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef ThreeWay::Encryption ThreeWayEncryption;
+typedef ThreeWay::Decryption ThreeWayDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/Filelist.txt b/runtime/third_party/cryptopp/Filelist.txt
new file mode 100644
index 0000000..9e2fd10
--- /dev/null
+++ b/runtime/third_party/cryptopp/Filelist.txt
@@ -0,0 +1,652 @@
+3way.cpp
+3way.h
+adhoc.cpp.proto
+adv_simd.h
+adler32.cpp
+adler32.h
+aes.h
+aes_armv4.h
+aes_armv4.S
+algebra.cpp
+algebra.h
+algparam.cpp
+algparam.h
+allocate.cpp
+allocate.h
+arc4.cpp
+arc4.h
+ariatab.cpp
+aria.cpp
+aria.h
+argnames.h
+arm_simd.h
+asn.cpp
+asn.h
+authenc.cpp
+authenc.h
+base32.cpp
+base32.h
+base64.cpp
+base64.h
+basecode.cpp
+basecode.h
+bench.h
+bds10.zip
+bench1.cpp
+bench2.cpp
+bench3.cpp
+bfinit.cpp
+blake2.cpp
+blake2s_simd.cpp
+blake2b_simd.cpp
+blake2.h
+blowfish.cpp
+blowfish.h
+blumshub.cpp
+blumshub.h
+camellia.cpp
+camellia.h
+cast.cpp
+cast.h
+casts.cpp
+cbcmac.cpp
+cbcmac.h
+ccm.cpp
+ccm.h
+chacha.cpp
+chacha_avx.cpp
+chacha_simd.cpp
+chacha.h
+chachapoly.cpp
+chachapoly.h
+cham.cpp
+cham_simd.cpp
+cham.h
+channels.cpp
+channels.h
+cmac.cpp
+cmac.h
+config.h
+config_align.h
+config_asm.h
+config_cpu.h
+config_cxx.h
+config_dll.h
+config_int.h
+config_misc.h
+config_ns.h
+config_os.h
+config_ver.h
+cpu.cpp
+cpu.h
+crc.cpp
+crc_simd.cpp
+crc.h
+cryptdll.vcxproj
+cryptdll.vcxproj.filters
+cryptest.sln
+cryptest.vcxproj
+cryptest.vcxproj.user
+cryptest.vcxproj.filters
+cryptest.mapfile
+cryptest.nmake
+cryptlib.cpp
+cryptlib.h
+cryptlib.vcxproj
+cryptlib.vcxproj.filters
+cryptopp.rc
+darn.cpp
+darn.h
+datatest.cpp
+default.cpp
+default.h
+des.cpp
+des.h
+dessp.cpp
+dh.cpp
+dh.h
+dh2.cpp
+dh2.h
+dll.cpp
+dll.h
+dlltest.cpp
+dlltest.vcxproj
+dlltest.vcxproj.filters
+dmac.h
+drbg.h
+donna.h
+donna_32.h
+donna_64.h
+donna_sse.h
+donna_32.cpp
+donna_64.cpp
+donna_sse.cpp
+dsa.cpp
+dsa.h
+eax.cpp
+eax.h
+ec2n.cpp
+ec2n.h
+eccrypto.cpp
+eccrypto.h
+ecp.cpp
+ecp.h
+ecpoint.h
+elgamal.cpp
+elgamal.h
+emsa2.cpp
+emsa2.h
+eprecomp.cpp
+eprecomp.h
+esign.cpp
+esign.h
+factory.h
+fhmqv.cpp
+fhmqv.h
+files.cpp
+files.h
+filters.cpp
+filters.h
+fips140.cpp
+fips140.h
+fipsalgt.cpp
+fipstest.cpp
+fltrimpl.h
+gcm_simd.cpp
+gcm.cpp
+gcm.h
+gf256.cpp
+gf256.h
+gf2_32.cpp
+gf2_32.h
+gf2n_simd.cpp
+gf2n.cpp
+gf2n.h
+gfpcrypt.cpp
+gfpcrypt.h
+gost.cpp
+gost.h
+gzip.cpp
+gzip.h
+hashfwd.h
+hc128.cpp
+hc128.h
+hc256.cpp
+hc256.h
+hex.cpp
+hex.h
+hight.h
+hight.cpp
+hkdf.h
+hmac.cpp
+hmac.h
+hmqv.cpp
+hmqv.h
+hrtimer.cpp
+hrtimer.h
+ida.cpp
+ida.h
+idea.cpp
+idea.h
+integer.cpp
+integer.h
+iterhash.cpp
+iterhash.h
+kalynatab.cpp
+kalyna.cpp
+kalyna.h
+keccak.cpp
+keccak_core.cpp
+keccak_simd.cpp
+keccak.h
+lubyrack.h
+lea.cpp
+lea_simd.cpp
+lea.h
+lsh256.cpp
+lsh256_sse.cpp
+lsh256_avx.cpp
+lsh512.cpp
+lsh512_sse.cpp
+lsh512_avx.cpp
+lsh.h
+luc.cpp
+luc.h
+mars.cpp
+mars.h
+marss.cpp
+md2.cpp
+md2.h
+md4.cpp
+md4.h
+md5.cpp
+md5.h
+mdc.h
+mersenne.h
+misc.cpp
+misc.h
+modarith.h
+modes.cpp
+modes.h
+modexppc.h
+mqueue.cpp
+mqueue.h
+mqv.cpp
+mqv.h
+naclite.h
+nbtheory.cpp
+nbtheory.h
+neon_simd.cpp
+nr.h
+oaep.cpp
+oaep.h
+oids.h
+osrng.cpp
+osrng.h
+ossig.h
+padlkrng.cpp
+padlkrng.h
+panama.cpp
+panama.h
+pch.cpp
+pch.h
+pkcspad.cpp
+pkcspad.h
+poly1305.cpp
+poly1305.h
+polynomi.cpp
+polynomi.h
+power7_ppc.cpp
+power8_ppc.cpp
+power9_ppc.cpp
+ppc_simd.cpp
+ppc_simd.h
+primetab.cpp
+pssr.cpp
+pssr.h
+pubkey.cpp
+pubkey.h
+pwdbased.h
+queue.cpp
+queue.h
+rabin.cpp
+rabin.h
+randpool.cpp
+randpool.h
+rabbit.cpp
+rabbit.h
+rc2.cpp
+rc2.h
+rc5.cpp
+rc5.h
+rc6.cpp
+rc6.h
+rdrand.asm
+rdrand.cpp
+rdrand.h
+rdseed.asm
+rdtables.cpp
+regtest1.cpp
+regtest2.cpp
+regtest3.cpp
+regtest4.cpp
+resource.h
+rijndael.cpp
+rijndael_simd.cpp
+rijndael.h
+ripemd.cpp
+ripemd.h
+rng.cpp
+rng.h
+rsa.cpp
+rsa.h
+rw.cpp
+rw.h
+safer.cpp
+safer.h
+salsa.cpp
+salsa.h
+scrypt.cpp
+scrypt.h
+seal.cpp
+seal.h
+secblock.h
+secblockfwd.h
+seckey.h
+seed.cpp
+seed.h
+serpent.cpp
+serpent.h
+serpentp.h
+sha.cpp
+sha_simd.cpp
+sha.h
+sha1_armv4.h
+sha1_armv4.S
+sha256_armv4.h
+sha256_armv4.S
+sha512_armv4.h
+sha512_armv4.S
+sha3.cpp
+sha3.h
+shacal2.cpp
+shacal2_simd.cpp
+shacal2.h
+shake.cpp
+shake.h
+shark.cpp
+shark.h
+sharkbox.cpp
+simple.cpp
+simple.h
+siphash.h
+simeck.cpp
+simeck.h
+simon.cpp
+simon128_simd.cpp
+simon.h
+skipjack.cpp
+skipjack.h
+sm3.cpp
+sm3.h
+sm4.cpp
+sm4_simd.cpp
+sm4.h
+smartptr.h
+sosemanuk.cpp
+sosemanuk.h
+speck.cpp
+speck128_simd.cpp
+speck.h
+square.cpp
+square.h
+squaretb.cpp
+sse_simd.cpp
+stdcpp.h
+strciphr.cpp
+strciphr.h
+tea.cpp
+tea.h
+test.cpp
+trap.h
+tftables.cpp
+threefish.cpp
+threefish.h
+tiger.cpp
+tiger.h
+tigertab.cpp
+trunhash.h
+ttmac.cpp
+ttmac.h
+tweetnacl.cpp
+tweetnacl.h
+twofish.cpp
+twofish.h
+validat0.cpp
+validat1.cpp
+validat2.cpp
+validat3.cpp
+validat4.cpp
+validat5.cpp
+validat6.cpp
+validat7.cpp
+validat8.cpp
+validat9.cpp
+validat10.cpp
+validate.h
+vmac.cpp
+vmac.h
+vs2005.zip
+wake.cpp
+wake.h
+whrlpool.cpp
+whrlpool.h
+words.h
+x64dll.asm
+x64masm.asm
+xed25519.h
+xed25519.cpp
+xtr.cpp
+xtr.h
+xtrcrypt.cpp
+xtrcrypt.h
+xts.cpp
+xts.h
+zdeflate.cpp
+zdeflate.h
+zinflate.cpp
+zinflate.h
+zlib.cpp
+zlib.h
+Doxyfile
+GNUmakefile
+GNUmakefile-cross
+License.txt
+Readme.txt
+History.txt
+Install.txt
+Filelist.txt
+cryptopp.supp
+TestData/3desval.dat
+TestData/3wayval.dat
+TestData/aria.dat
+TestData/camellia.dat
+TestData/cast128v.dat
+TestData/cast256v.dat
+TestData/defdmac1.bin
+TestData/defdmac2.bin
+TestData/descert.dat
+TestData/dh1024.dat
+TestData/dh2048.dat
+TestData/dlie1024.dat
+TestData/dlie2048.dat
+TestData/dsa1024.dat
+TestData/dsa1024b.dat
+TestData/dsa512.dat
+TestData/ecies_p160.dat
+TestData/ecies_t163.dat
+TestData/ed25519.dat
+TestData/ed25519_ver.dat
+TestData/ed25519v0.dat
+TestData/ed25519v1.dat
+TestData/elgc1024.dat
+TestData/esig1023.dat
+TestData/esig1536.dat
+TestData/esig2046.dat
+TestData/fhmqv160.dat
+TestData/fhmqv256.dat
+TestData/fhmqv384.dat
+TestData/fhmqv512.dat
+TestData/gostval.dat
+TestData/hmqv160.dat
+TestData/hmqv256.dat
+TestData/hmqv384.dat
+TestData/hmqv512.dat
+TestData/ideaval.dat
+TestData/luc1024.dat
+TestData/luc2048.dat
+TestData/lucc1024.dat
+TestData/lucc512.dat
+TestData/lucd1024.dat
+TestData/lucd512.dat
+TestData/lucs1024.dat
+TestData/lucs512.dat
+TestData/marsval.dat
+TestData/mqv1024.dat
+TestData/mqv2048.dat
+TestData/nr1024.dat
+TestData/nr2048.dat
+TestData/rabi1024.dat
+TestData/rabi2048.dat
+TestData/rc2val.dat
+TestData/rc5val.dat
+TestData/rc6val.dat
+TestData/rijndael.dat
+TestData/rsa1024.dat
+TestData/rsa2048.dat
+TestData/rsa2048a.dat
+TestData/rsa400pb.dat
+TestData/rsa400pv.dat
+TestData/rsa512a.dat
+TestData/rw1024.dat
+TestData/rw2048.dat
+TestData/saferval.dat
+TestData/serpentv.dat
+TestData/shacal2v.dat
+TestData/sharkval.dat
+TestData/skipjack.dat
+TestData/squareva.dat
+TestData/twofishv.dat
+TestData/usage.dat
+TestData/x25519.dat
+TestData/x25519v0.dat
+TestData/x25519v1.dat
+TestData/xtrdh171.dat
+TestData/xtrdh342.dat
+TestVectors/aead.txt
+TestVectors/aes.txt
+TestVectors/all.txt
+TestVectors/aria.txt
+TestVectors/blake2.txt
+TestVectors/blake2b.txt
+TestVectors/blake2s.txt
+TestVectors/camellia.txt
+TestVectors/ccm.txt
+TestVectors/chacha.txt
+TestVectors/chacha_tls.txt
+TestVectors/chacha20poly1305.txt
+TestVectors/cham.txt
+TestVectors/cmac.txt
+TestVectors/dlies.txt
+TestVectors/dsa.txt
+TestVectors/dsa_1363.txt
+TestVectors/dsa_rfc6979.txt
+TestVectors/eax.txt
+TestVectors/esign.txt
+TestVectors/gcm.txt
+TestVectors/hc128.txt
+TestVectors/hc256.txt
+TestVectors/hight.txt
+TestVectors/hkdf.txt
+TestVectors/hmac.txt
+TestVectors/kalyna.txt
+TestVectors/keccak.txt
+TestVectors/lea.txt
+TestVectors/lsh.txt
+TestVectors/lsh256.txt
+TestVectors/lsh512.txt
+TestVectors/lsh512_256.txt
+TestVectors/mars.txt
+TestVectors/nr.txt
+TestVectors/panama.txt
+TestVectors/poly1305aes.txt
+TestVectors/poly1305_tls.txt
+TestVectors/rabbit.txt
+TestVectors/Readme.txt
+TestVectors/rsa_oaep.txt
+TestVectors/rsa_pkcs1_1_5.txt
+TestVectors/rsa_pss.txt
+TestVectors/rw.txt
+TestVectors/salsa.txt
+TestVectors/seal.txt
+TestVectors/seed.txt
+TestVectors/sha.txt
+TestVectors/sha1_160_fips_180.txt
+TestVectors/sha1_fips_180.txt
+TestVectors/sha2.txt
+TestVectors/sha2_224_fips_180.txt
+TestVectors/sha2_256_fips_180.txt
+TestVectors/sha2_384_fips_180.txt
+TestVectors/sha2_512_fips_180.txt
+TestVectors/sha2_fips_180.txt
+TestVectors/sha3.txt
+TestVectors/sha3_224_fips_202.txt
+TestVectors/sha3_256_fips_202.txt
+TestVectors/sha3_384_fips_202.txt
+TestVectors/sha3_512_fips_202.txt
+TestVectors/sha3_fips_202.txt
+TestVectors/shake.txt
+TestVectors/shacal2.txt
+TestVectors/simeck.txt
+TestVectors/simon.txt
+TestVectors/siphash.txt
+TestVectors/skipjack.txt
+TestVectors/sm3.txt
+TestVectors/sm4.txt
+TestVectors/sosemanuk.txt
+TestVectors/speck.txt
+TestVectors/tea.txt
+TestVectors/threefish.txt
+TestVectors/ttmac.txt
+TestVectors/vmac.txt
+TestVectors/wake.txt
+TestVectors/whrlpool.txt
+TestVectors/xchacha.txt
+TestVectors/xts.txt
+TestPrograms/test_32bit.cpp
+TestPrograms/test_64bit.cpp
+TestPrograms/test_arm_acle_header.cpp
+TestPrograms/test_arm_aes.cpp
+TestPrograms/test_arm_armv7.cpp
+TestPrograms/test_arm_asimd.cpp
+TestPrograms/test_arm_crc.cpp
+TestPrograms/test_arm_neon.cpp
+TestPrograms/test_arm_neon_header.cpp
+TestPrograms/test_arm_pmull.cpp
+TestPrograms/test_arm_sha1.cpp
+TestPrograms/test_arm_sha256.cpp
+TestPrograms/test_arm_sha3.cpp
+TestPrograms/test_arm_sha512.cpp
+TestPrograms/test_arm_sm3.cpp
+TestPrograms/test_arm_sm4.cpp
+TestPrograms/test_asm_mixed.cpp
+TestPrograms/test_cxx11_alignas.cpp
+TestPrograms/test_cxx11_alignof.cpp
+TestPrograms/test_cxx11_assert.cpp
+TestPrograms/test_cxx11_atomic.cpp
+TestPrograms/test_cxx11_auto.cpp
+TestPrograms/test_cxx11_constexpr.cpp
+TestPrograms/test_cxx11.cpp
+TestPrograms/test_cxx11_deletefn.cpp
+TestPrograms/test_cxx11_enumtype.cpp
+TestPrograms/test_cxx11_initializer.cpp
+TestPrograms/test_cxx11_lambda.cpp
+TestPrograms/test_cxx11_noexcept.cpp
+TestPrograms/test_cxx11_nullptr.cpp
+TestPrograms/test_cxx11_staticinit.cpp
+TestPrograms/test_cxx11_sync.cpp
+TestPrograms/test_cxx11_vartemplates.cpp
+TestPrograms/test_cxx14.cpp
+TestPrograms/test_cxx17_assert.cpp
+TestPrograms/test_cxx17.cpp
+TestPrograms/test_cxx17_exceptions.cpp
+TestPrograms/test_cxx98_exception.cpp
+TestPrograms/test_cxx.cpp
+TestPrograms/test_glibc.cpp
+TestPrograms/test_newlib.cpp
+TestPrograms/test_nodevirtualize.cpp
+TestPrograms/test_ppc_aes.cpp
+TestPrograms/test_ppc_altivec.cpp
+TestPrograms/test_ppc_power7.cpp
+TestPrograms/test_ppc_power8.cpp
+TestPrograms/test_ppc_power9.cpp
+TestPrograms/test_ppc_sha.cpp
+TestPrograms/test_ppc_vmull.cpp
+TestPrograms/test_pthreads.cpp
+TestPrograms/test_x86_aes.cpp
+TestPrograms/test_x86_avx2.cpp
+TestPrograms/test_x86_avx512.cpp
+TestPrograms/test_x86_avx.cpp
+TestPrograms/test_x86_clmul.cpp
+TestPrograms/test_x86_cpuid.cpp
+TestPrograms/test_x86_rdrand.cpp
+TestPrograms/test_x86_rdseed.cpp
+TestPrograms/test_x86_sha.cpp
+TestPrograms/test_x86_sse2.cpp
+TestPrograms/test_x86_sse3.cpp
+TestPrograms/test_x86_sse41.cpp
+TestPrograms/test_x86_sse42.cpp
+TestPrograms/test_x86_ssse3.cpp
+TestPrograms/test_x86_via_aes.cpp
+TestPrograms/test_x86_via_rng.cpp
+TestPrograms/test_x86_via_sha.cpp
diff --git a/runtime/third_party/cryptopp/History.txt b/runtime/third_party/cryptopp/History.txt
new file mode 100644
index 0000000..370ae34
--- /dev/null
+++ b/runtime/third_party/cryptopp/History.txt
@@ -0,0 +1,610 @@
+*** History ***
+
+The History file contains the items that comprise the release notes. The
+items in the list below used to be in Readme.txt. Readme.txt now contans the
+last several releases.
+
+1.0 - First public release
+    - Withdrawn at the request of RSA DSI over patent claims
+    - included Blowfish, BBS, DES, DH, Diamond, DSA, ElGamal, IDEA,
+      MD5, RC4, RC5, RSA, SHA, WAKE, secret sharing, DEFLATE compression
+    - had a serious bug in the RSA key generation code.
+
+1.1 - Removed RSA, RC4, RC5
+    - Disabled calls to RSAREF's non-public functions
+    - Minor bugs fixed
+
+2.0 - a completely new, faster multiprecision integer class
+    - added MD5-MAC, HAVAL, 3-WAY, TEA, SAFER, LUC, Rabin, BlumGoldwasser,
+      elliptic curve algorithms
+    - added the Lucas strong probable primality test
+    - ElGamal encryption and signature schemes modified to avoid weaknesses
+    - Diamond changed to Diamond2 because of key schedule weakness
+    - fixed bug in WAKE key setup
+    - SHS class renamed to SHA
+    - lots of miscellaneous optimizations
+
+2.1 - added Tiger, HMAC, GOST, RIPE-MD160, LUCELG, LUCDIF, XOR-MAC,
+      OAEP, PSSR, SHARK
+    - added precomputation to DH, ElGamal, DSA, and elliptic curve algorithms
+    - added back RC5 and a new RSA
+    - optimizations in elliptic curves over GF(p)
+    - changed Rabin to use OAEP and PSSR
+    - changed many classes to allow copy constructors to work correctly
+    - improved exception generation and handling
+
+2.2 - added SEAL, CAST-128, Square
+    - fixed bug in HAVAL (padding problem)
+    - fixed bug in triple-DES (decryption order was reversed)
+    - fixed bug in RC5 (couldn't handle key length not a multiple of 4)
+    - changed HMAC to conform to RFC-2104 (which is not compatible
+      with the original HMAC)
+    - changed secret sharing and information dispersal to use GF(2^32)
+      instead of GF(65521)
+    - removed zero knowledge prover/verifier for graph isomorphism
+    - removed several utility classes in favor of the C++ standard library
+
+2.3 - ported to EGCS
+    - fixed incomplete workaround of min/max conflict in MSVC
+
+3.0 - placed all names into the "CryptoPP" namespace
+    - added MD2, RC2, RC6, MARS, RW, DH2, MQV, ECDHC, CBC-CTS
+    - added abstract base classes PK_SimpleKeyAgreementDomain and
+      PK_AuthenticatedKeyAgreementDomain
+    - changed DH and LUCDIF to implement the PK_SimpleKeyAgreementDomain
+      interface and to perform domain parameter and key validation
+    - changed interfaces of PK_Signer and PK_Verifier to sign and verify
+      messages instead of message digests
+    - changed OAEP to conform to PKCS#1 v2.0
+    - changed benchmark code to produce HTML tables as output
+    - changed PSSR to track IEEE P1363a
+    - renamed ElGamalSignature to NR and changed it to track IEEE P1363
+    - renamed ECKEP to ECMQVC and changed it to track IEEE P1363
+    - renamed several other classes for clarity
+    - removed support for calling RSAREF
+    - removed option to compile old SHA (SHA-0)
+    - removed option not to throw exceptions
+
+3.1 - added ARC4, Rijndael, Twofish, Serpent, CBC-MAC, DMAC
+    - added interface for querying supported key lengths of symmetric ciphers
+      and MACs
+    - added sample code for RSA signature and verification
+    - changed CBC-CTS to be compatible with RFC 2040
+    - updated SEAL to version 3.0 of the cipher specification
+    - optimized multiprecision squaring and elliptic curves over GF(p)
+    - fixed bug in MARS key setup
+    - fixed bug with attaching objects to Deflator
+
+3.2 - added DES-XEX3, ECDSA, DefaultEncryptorWithMAC
+    - renamed DES-EDE to DES-EDE2 and TripleDES to DES-EDE3
+    - optimized ARC4
+    - generalized DSA to allow keys longer than 1024 bits
+    - fixed bugs in GF2N and ModularArithmetic that can cause calculation errors
+    - fixed crashing bug in Inflator when given invalid inputs
+    - fixed endian bug in Serpent
+    - fixed padding bug in Tiger
+
+4.0 - added Skipjack, CAST-256, Panama, SHA-2 (SHA-256, SHA-384, and SHA-512),
+      and XTR-DH
+    - added a faster variant of Rabin's Information Dispersal Algorithm (IDA)
+    - added class wrappers for these operating system features:
+       * high resolution timers on Windows, Unix, and MacOS
+       * Berkeley and Windows style sockets
+       * Windows named pipes
+       * /dev/random and /dev/urandom on Linux and FreeBSD
+       * Microsoft's CryptGenRandom on Windows
+    - added support for SEC 1 elliptic curve key format and compressed points
+    - added support for X.509 public key format (subjectPublicKeyInfo) for
+      RSA, DSA, and elliptic curve schemes
+    - added support for DER and OpenPGP signature format for DSA
+    - added support for ZLIB compressed data format (RFC 1950)
+    - changed elliptic curve encryption to use ECIES (as defined in SEC 1)
+    - changed MARS key schedule to reflect the latest specification
+    - changed BufferedTransformation interface to support multiple channels
+      and messages
+    - changed CAST and SHA-1 implementations to use public domain source code
+    - fixed bug in StringSource
+    - optmized multi-precision integer code for better performance
+
+4.1 - added more support for the recommended elliptic curve parameters in SEC 2
+    - added Panama MAC, MARC4
+    - added IV stealing feature to CTS mode
+    - added support for PKCS #8 private key format for RSA, DSA, and elliptic
+      curve schemes
+    - changed Deflate, MD5, Rijndael, and Twofish to use public domain code
+    - fixed a bug with flushing compressed streams
+    - fixed a bug with decompressing stored blocks
+    - fixed a bug with EC point decompression using non-trinomial basis
+    - fixed a bug in NetworkSource::GeneralPump()
+    - fixed a performance issue with EC over GF(p) decryption
+    - fixed syntax to allow GCC to compile without -fpermissive
+    - relaxed some restrictions in the license
+
+4.2 - added support for longer HMAC keys
+    - added MD4 (which is not secure so use for compatibility purposes only)
+    - added compatibility fixes/workarounds for STLport 4.5, GCC 3.0.2,
+      and MSVC 7.0
+    - changed MD2 to use public domain code
+    - fixed a bug with decompressing multiple messages with the same object
+    - fixed a bug in CBC-MAC with MACing multiple messages with the same object
+    - fixed a bug in RC5 and RC6 with zero-length keys
+    - fixed a bug in Adler32 where incorrect checksum may be generated
+
+5.0 - added ESIGN, DLIES, WAKE-OFB, PBKDF1 and PBKDF2 from PKCS #5
+    - added key validation for encryption and signature public/private keys
+    - renamed StreamCipher interface to SymmetricCipher, which is now implemented
+      by both stream ciphers and block cipher modes including ECB and CBC
+    - added keying interfaces to support resetting of keys and IVs without
+      having to destroy and recreate objects
+    - changed filter interface to support non-blocking input/output
+    - changed SocketSource and SocketSink to use overlapped I/O on Microsoft Windows
+    - grouped related classes inside structs to help templates, for example
+      AESEncryption and AESDecryption are now AES::Encryption and AES::Decryption
+    - where possible, typedefs have been added to improve backwards
+      compatibility when the CRYPTOPP_MAINTAIN_BACKWARDS_COMPATIBILITY macro is defined
+    - changed Serpent, HAVAL and IDEA to use public domain code
+    - implemented SSE2 optimizations for Integer operations
+    - fixed a bug in HMAC::TruncatedFinal()
+    - fixed SKIPJACK byte ordering following NIST clarification dated 5/9/02
+
+5.01 - added known answer test for X9.17 RNG in FIPS 140 power-up self test
+     - submitted to NIST/CSE, but not publicly released
+
+5.02 - changed EDC test to MAC integrity check using HMAC/SHA1
+     - improved performance of integrity check
+     - added blinding to defend against RSA timing attack
+
+5.03 - created DLL version of Crypto++ for FIPS 140-2 validation
+     - fixed vulnerabilities in GetNextIV for CTR and OFB modes
+
+5.0.4 - Removed DES, SHA-256, SHA-384, SHA-512 from DLL
+
+5.1 - added PSS padding and changed PSSR to track IEEE P1363a draft standard
+    - added blinding for RSA and Rabin to defend against timing attacks
+      on decryption operations
+    - changed signing and decryption APIs to support the above
+    - changed WaitObjectContainer to allow waiting for more than 64
+      objects at a time on Win32 platforms
+    - fixed a bug in CBC and ECB modes with processing non-aligned data
+    - fixed standard conformance bugs in DLIES (DHAES mode) and RW/EMSA2
+      signature scheme (these fixes are not backwards compatible)
+    - fixed a number of compiler warnings, minor bugs, and portability problems
+    - removed Sapphire
+
+5.2 - merged in changes for 5.01 - 5.0.4
+    - added support for using encoding parameters and key derivation parameters
+      with public key encryption (implemented by OAEP and DL/ECIES)
+    - added Camellia, SHACAL-2, Two-Track-MAC, Whirlpool, RIPEMD-320,
+      RIPEMD-128, RIPEMD-256, Base-32 coding, FIPS variant of CFB mode
+    - added ThreadUserTimer for timing thread CPU usage
+    - added option for password-based key derivation functions
+      to iterate until a mimimum elapsed thread CPU time is reached
+    - added option (on by default) for DEFLATE compression to detect
+      uncompressible files and process them more quickly
+    - improved compatibility and performance on 64-bit platforms,
+      including Alpha, IA-64, x86-64, PPC64, Sparc64, and MIPS64
+    - fixed ONE_AND_ZEROS_PADDING to use 0x80 instead 0x01 as padding.
+    - fixed encoding/decoding of PKCS #8 privateKeyInfo to properly
+      handle optional attributes
+
+5.2.1 - fixed bug in the "dlltest" DLL testing program
+      - fixed compiling with STLport using VC .NET
+      - fixed compiling with -fPIC using GCC
+      - fixed compiling with -msse2 on systems without memalign()
+      - fixed inability to instantiate PanamaMAC
+      - fixed problems with inline documentation
+
+5.2.2 - added SHA-224
+      - put SHA-256, SHA-384, SHA-512, RSASSA-PSS into DLL
+
+5.2.3 - fixed issues with FIPS algorithm test vectors
+      - put RSASSA-ISO into DLL
+
+5.3 - ported to MSVC 2005 with support for x86-64
+    - added defense against AES timing attacks, and more AES test vectors
+    - changed StaticAlgorithmName() of Rijndael to "AES", CTR to "CTR"
+
+5.4 - added Salsa20
+    - updated Whirlpool to version 3.0
+    - ported to GCC 4.1, Sun C++ 5.8, and Borland C++Builder 2006
+
+5.5 - added VMAC and Sosemanuk (with x86-64 and SSE2 assembly)
+    - improved speed of integer arithmetic, AES, SHA-512, Tiger, Salsa20,
+      Whirlpool, and PANAMA cipher using assembly (x86-64, MMX, SSE2)
+    - optimized Camellia and added defense against timing attacks
+    - updated benchmarks code to show cycles per byte and to time key/IV setup
+    - started using OpenMP for increased multi-core speed
+    - enabled GCC optimization flags by default in GNUmakefile
+    - added blinding and computational error checking for RW signing
+    - changed RandomPool, X917RNG, GetNextIV, DSA/NR/ECDSA/ECNR to reduce
+      the risk of reusing random numbers and IVs after virtual machine state
+      rollback
+    - changed default FIPS mode RNG from AutoSeededX917RNG<DES_EDE3> to
+      AutoSeededX917RNG<AES>
+    - fixed PANAMA cipher interface to accept 256-bit key and 256-bit IV
+    - moved MD2, MD4, MD5, PanamaHash, ARC4, WAKE_CFB into the namespace "Weak"
+    - removed HAVAL, MD5-MAC, XMAC
+
+5.5.1 - fixed VMAC validation failure on 32-bit big-endian machines
+
+5.5.2 - ported x64 assembly language code for AES, Salsa20, Sosemanuk, and Panama
+        to MSVC 2005 (using MASM since MSVC doesn't support inline assembly on x64)
+      - fixed Salsa20 initialization crash on non-SSE2 machines
+      - fixed Whirlpool crash on Pentium 2 machines
+      - fixed possible branch prediction analysis (BPA) vulnerability in
+        MontgomeryReduce(), which may affect security of RSA, RW, LUC
+      - fixed link error with MSVC 2003 when using "debug DLL" form of runtime library
+      - fixed crash in SSE2_Add on P4 machines when compiled with
+        MSVC 6.0 SP5 with Processor Pack
+      - ported to MSVC 2008, GCC 4.2, Sun CC 5.9, Intel C++ Compiler 10.0,
+        and Borland C++Builder 2007
+
+5.6.0 - added AuthenticatedSymmetricCipher interface class and Filter wrappers
+      - added CCM, GCM (with SSE2 assembly), EAX, CMAC, XSalsa20, and SEED
+      - added support for variable length IVs
+      - added OIDs for Brainpool elliptic curve parameters
+      - improved AES and SHA-256 speed on x86 and x64
+      - changed BlockTransformation interface to no longer assume data alignment
+      - fixed incorrect VMAC computation on message lengths
+        that are >64 mod 128 (x86 assembly version is not affected)
+      - fixed compiler error in vmac.cpp on x86 with GCC -fPIC
+      - fixed run-time validation error on x86-64 with GCC 4.3.2 -O2
+      - fixed HashFilter bug when putMessage=true
+      - fixed AES-CTR data alignment bug that causes incorrect encryption on ARM
+      - removed WORD64_AVAILABLE; compiler support for 64-bit int is now required
+      - ported to GCC 4.3, C++Builder 2009, Sun CC 5.10, Intel C++ Compiler 11
+
+5.6.1 - added support for AES-NI and CLMUL instruction sets in AES and GMAC/GCM
+      - removed WAKE-CFB
+      - fixed several bugs in the SHA-256 x86/x64 assembly code:
+         * incorrect hash on non-SSE2 x86 machines on non-aligned input
+         * incorrect hash on x86 machines when input crosses 0x80000000
+         * incorrect hash on x64 when compiled with GCC with optimizations enabled
+      - fixed bugs in AES x86 and x64 assembly causing crashes in some MSVC build configurations
+      - switched to a public domain implementation of MARS
+      - ported to MSVC 2010, GCC 4.5.1, Sun Studio 12u1, C++Builder 2010, Intel C++ Compiler 11.1
+      - renamed the MSVC DLL project to "cryptopp" for compatibility with MSVC 2010
+
+5.6.2 - changed license to Boost Software License 1.0
+      - added SHA-3 (Keccak)
+      - updated DSA to FIPS 186-3 (see DSA2 class)
+      - fixed Blowfish minimum keylength to be 4 bytes (32 bits)
+      - fixed Salsa validation failure when compiling with GCC 4.6
+      - fixed infinite recursion when on x64, assembly disabled, and no AESNI
+      - ported to MSVC 2012, GCC 4.7, Clang 3.2, Solaris Studio 12.3, Intel C++ Compiler 13.0
+
+5.6.3 - maintenance release, honored API/ABI/Versioning requirements
+      - expanded processes to include community and its input
+         * 12 unique contributors for this release
+      - fixed CVE-2015-2141
+      - cleared most Undefined Behavior Sanitizer (UBsan) findings
+      - cleared all Address Sanitizer (Asan) findings
+      - cleared all Valgrind findings
+      - cleared all Coverity findings
+      - cleared all Enterprise Analysis (/analyze) findings
+      - cleared most GCC warnings with -Wall
+      - cleared most Clang warnings with -Wall
+      - cleared most MSVC warnings with /W4
+      - added -fPIC 64-bit builds. Off by default for i386
+      - added HKDF class from RFC 5868
+      - switched to member_ptr due to C++ 11 warnings for auto_ptr
+      - initialization of C++ static objects, off by default
+         * GCC and init_priotirty/constructor attributes
+         * MSVC and init_seg(lib)
+         * CRYPTOPP_INIT_PRIORITY disabled by default, but available
+      - improved OS X support
+      - improved GNUmakefile support for Testing and QA
+      - added self tests for additional Testing and QA
+      - added cryptest.sh for systematic Testing and QA
+      - added GNU Gold linker support
+      - added Visual Studio 2010 solution and project files in vs2010.zip
+      - added Clang integrated assembler support
+      - unconditionally define CRYPTOPP_NO_UNALIGNED_DATA_ACCESS for Makefile
+        target 'ubsan' and at -O3 due to GCC vectorization on x86 and x86_64
+      - workaround ARMEL/GCC 5.2 bug and failed self test
+      - fixed crash in MQV due to GCC 4.9+ and inlining
+      - fixed hang in SHA due to GCC 4.9+ and inlining
+      - fixed missing rdtables::Te under VS with ALIGNED_DATA_ACCESS
+      - fixed S/390 and big endian feature detection
+      - fixed S/390 and int128_t/uint128_t detection
+      - fixed X32 (ILP32) feature detection
+      - removed  _CRT_SECURE_NO_DEPRECATE for Microsoft platforms
+      - utilized bound checking interfaces from ISO/IEC TR 24772 when available
+      - improved ARM, ARM64, MIPS, MIPS64, S/390 and X32 (ILP32) support
+      - introduced CRYPTOPP_MAINTAIN_BACKWARDS_COMPATIBILITY_562
+      - added additional Doxygen-based documentation
+      - ported to MSVC 2015, Xcode 7.2, GCC 5.2, Clang 3.7, Intel C++ 16.00
+
+5.6.4 - September 11, 2016
+      - maintenance release, honored API/ABI/Versioning requirements
+      - expanded community input and support
+         * 22 unique contributors for this release
+      - fixed CVE-2016-3995
+      - changed SHA3 to FIPS 202 (F1600, XOF d=0x06)
+      - added Keccak (F1600, XOF d=0x01)
+      - added ChaCha (ChaCha8/12/20)
+      - added HMQV and FHMQV
+         * Hashed and Fully Hashed MQV
+      - added BLAKE2 (BLAKE2s and BLAKE2b)
+         * C++, SSE2, SSE4, ARM NEON and ARMv8 ASIMD
+      - added CRC32-C
+         * C/C++, Amd64 CRC, and ARMv8 CRC
+      - improved Rabin-William signatures
+         * Tweaked roots <em>e</em> and <em>f</em>
+      - improved C++11 support
+         * atomics, threads and fences
+         * alginof, alignas
+         * constexpr
+         * noexcept
+      - improved GCM mode
+         * ARM NEON and ARMv8 ASIMD
+         * ARMv8 carry-less multiply
+      - improved Windows 8 and 10 support
+         * Windows Phone, Universal Windows Platform, Windows Store
+      - improved MIPS, ARMv7 and ARMv8 support
+         * added scripts setenv-{android|embedded|ios}.sh for GNUmakefile-cross
+         * aggressive use of -march=<arch> and -mfpu=<fpu> in cryptest.sh
+      - improved build systems
+         * Visual Studio 2010 default
+         * added CMake support (lacks FindCryptopp.cmake)
+         * archived VC++ 5/0/6.0 project files (vc60.zip)
+         * archived VS2005 project files (vs2005.zip)
+         * archived Borland project files (bds10.zip)
+      - improved Testing and QA
+         * expanded platforms and compilers
+         * added code generation tests based on CPU features
+         * added C++03, C++11, C++14, C++17 testing
+         * added -O3, -O5, -Ofast and -Os testing
+      - ported to MSVC 2015 SP3, Xcode 9.0, Sun Studio 12.5, GCC 7.0,
+        MacPorts GCC 7.0, Clang 3.8, Intel C++ 17.00
+
+5.6.5 - October 11, 2016
+      - maintenance release, recompile of programs recommended
+      - expanded community input and support
+         * 25 unique contributors as of this release
+      - fixed CVE-2016-7420 (Issue 277, document NDEBUG for production/release)
+      - fixed CVE-2016-7544 (Issue 302, avoid _malloca and _freea)
+      - shipped library in recommended state
+         * backwards compatibility achieved with <config.compat>
+      - Visual Studio project file cleanup
+         * improved X86 and X64 MSBuild support
+         * added ARM-based MSBuild awareness
+      - improved Testing and QA
+         * expanded platforms and compilers
+         * expanded Coverity into OS X and Windows platforms
+         * added Windows test scripts using Strawberry Perl
+      - ported to MSVC 2015 SP3, Xcode 7.3, Sun Studio 12.5, GCC 7.0,
+        MacPorts GCC 7.0, Clang 3.8, Intel C++ 17.00
+
+6.0.0 - January 22, 2018
+      - Major release, recompile of programs required
+      - expanded community input and support
+         * 43 unique contributors as of this release
+      - fixed CVE-2016-9939 (Issue 346, transient DoS)
+      - fixed CVE-2017-9434 (Issue 414, misidentified memory error)
+      - converted to BASE+SIMD implementation
+         * BASE provides an architecture neutral C++ implementation
+         * SIMD provides architecture specific hardware acceleration
+      - improved PowerPC Power4, Power7 and Power8 support
+      - added ARIA, EC German DSA, Deterministic signatures (RFC 6979),
+        Kalyna, NIST Hash and HMAC DRBG, Padlock RNG, Poly1305, SipHash,
+        Simon, Speck, SM3, SM4, Threefish algorithms
+      - added NaCl interface from the compact library
+         * x25519 key exhange and ed25519 signing provided through NaCl interface
+      - improved Testing and QA
+      - ported to MSVC 2017, Xcode 8.1, Sun Studio 12.5, GCC 7.0,
+        MacPorts GCC 7.0, Clang 4.0, Intel C++ 17.00, IBM XL C/C++ 13.1
+
+6.1.0 - February 22, 2018
+      - minor release, maintenance items
+      - expanded community input and support
+         * 46 unique contributors as of this release
+      - use 2048-bit modulus default for DSA
+      - fix build under Linuxbrew
+      - use /bin/sh in GNUmakefile
+      - fix missing flags for SIMON and SPECK in GNUMakefile-cross
+      - fix ARM and MinGW misdetection
+      - port setenv-android.sh to latest NDK
+      - fix Clang check for C++11 lambdas
+      - Simon and Speck to little-endian implementation
+      - use LIB_MAJOR for ABI compatibility
+      - fix ODR violation in AdvancedProcessBlocks_{ARCH} templates
+      - handle C++17 std::uncaught_exceptions
+      - ported to MSVC 2017, Xcode 8.1, Sun Studio 12.5, GCC 8.0.1,
+        MacPorts GCC 7.0, Clang 4.0, Intel C++ 17.00, IBM XL C/C++ 13.1
+
+7.0.0 - April 8, 2018
+      - major release, recompile of programs required
+      - expanded community input and support
+         * 48 unique contributors as of this release
+      - fix incorrect result when using Integer::ModInverse
+         * may be CVE worthy, but request was not submitted
+      - fix ARIA/CTR bus error on Sparc64
+      - fix incorrect result when using a_exp_b_mod_c
+      - fix undeclared identifier uint32_t on early Visual Studio
+      - fix iPhoneSimulator build on i386
+      - fix incorrect adler32 in ZlibDecompressor
+      - fix Power7 test using PPC_FEATURE_ARCH_2_06
+      - workaround incorrect Glibc sysconf return value on ppc64-le
+      - add KeyDerivationFunction interface
+      - add scrypt key derivation function
+      - add Salsa20_Core transform callable from outside class
+      - add sbyte, sword16, sword32 and sword64
+      - remove s_nullNameValuePairs from unnamed namespace
+      - ported to MSVC 2017, Xcode 9.3, Sun Studio 12.5, GCC 8.0.1,
+        MacPorts GCC 7.0, Clang 4.0, Intel C++ 17.00, IBM XL C/C++ 13.1
+
+8.0.0 - December 28, 2018
+      - major release, recompile of programs required
+      - expanded community input and support
+         * 54 unique contributors as of this release
+      - add x25519 key exchange and ed25519 signature scheme
+      - add limited Asymmetric Key Package support from RFC 5958
+      - add Power9 DARN random number generator support
+      - add CHAM, HC-128, HC-256, Hight, LEA, Rabbit, Simeck
+      - fix FixedSizeAllocatorWithCleanup may be unaligned on some platforms
+      - cutover to GNU Make-based cpu feature tests
+      - rename files with dashes to underscores
+      - fix LegacyDecryptor and LegacyDecryptorWithMAC use wrong MAC
+      - fix incorrect AES/CBC decryption on Windows
+      - avoid Singleton<T> when possible, avoid std::call_once completely
+      - fix SPARC alignment problems due to GetAlignmentOf<T>() on word64
+      - add ARM AES asm implementation from Cryptogams
+      - remove CRYPTOPP_ALLOW_UNALIGNED_DATA_ACCESS support
+
+8.1.0 - February 22, 2019
+      - minor release, no recompile of programs required
+      - expanded community input and support
+        * 56 unique contributors as of this release
+      - fix OS X PowerPC builds with Clang
+      - add Microsoft ARM64 support
+      - fix iPhone Simulator build due to missing symbols
+      - add CRYPTOPP_BUGGY_SIMD_LOAD_AND_STORE
+      - add carryless multiplies for NIST b233 and k233 curves
+      - fix OpenMP build due to use of OpenMP 4 with down-level compilers
+      - add SignStream and VerifyStream for ed25519 and large files
+      - fix missing AlgorithmProvider in PanamaHash
+      - add SHAKE-128 and SHAKE-256
+      - fix AVX2 build due to _mm256_broadcastsi128_si256
+      - add IETF ChaCha, XChaCha, ChaChaPoly1305 and XChaChaPoly1305
+
+8.2.0 - April 28, 2019
+      - minor release, no recompile of programs required
+      - expanded community input and support
+        * 56 unique contributors as of this release
+      - use PowerPC unaligned loads and stores with Power8
+      - add SKIPJACK test vectors
+      - fix SHAKE-128 and SHAKE-256 compile
+      - removed IS_NEON from Makefile
+      - fix Aarch64 build on Fedora 29
+      - fix missing GF2NT_233_Multiply_Reduce_CLMUL in FIPS DLL
+      - add missing BLAKE2 constructors
+      - fix missing BlockSize() in BLAKE2 classes
+
+8.3.0 - December 20, 2020
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 66 unique contributors as of this release
+      - fix use of macro CRYPTOPP_ALIGN_DATA
+      - fix potential out-of-bounds read in ECDSA
+      - fix std::bad_alloc when using ByteQueue in pipeline
+      - fix missing CRYPTOPP_CXX17_EXCEPTIONS with Clang
+      - fix potential out-of-bounds read in GCM mode
+      - add configure.sh when preprocessor macros fail
+      - fix potential out-of-bounds read in SipHash
+      - fix compile error on POWER9 due to vec_xl_be
+      - fix K233 curve on POWER8
+      - add Cirrus CI testing
+      - fix broken encryption for some 64-bit ciphers
+      - fix Android cpu-features.c using C++ compiler
+      - disable RDRAND and RDSEED for some AMD processors
+      - fix BLAKE2 hash calculation using Salt and Personalization
+      - refresh Android and iOS build scripts
+      - add XTS mode
+      - fix circular dependency between misc.h and secblock.h
+      - add Certificate interface
+      - fix recursion in AES::Encryption without AESNI
+      - add missing OID for ElGamal encryption
+      - fix missing override in KeyDerivationFunction-derived classes
+      - fix RDSEED assemble under MSVC
+      - fix elliptic curve timing leaks (CVE-2019-14318)
+      - add link-library variable to Makefiles
+      - fix SIZE_MAX definition in misc.h
+      - add GetWord64 and PutWord64 to BufferedTransformation
+      - use HKDF in AutoSeededX917RNG::Reseed
+      - fix Asan finding in VMAC on i686 in inline asm
+      - fix undeclared identifier _mm_roti_epi64 on Gentoo
+      - fix ECIES and GetSymmetricKeyLength
+      - fix possible divide by zero in PKCS5_PBKDF2_HMAC
+      - refine ASN.1 encoders and decoders
+      - disable BMI2 code paths in Integer class
+      - fix use of CRYPTOPP_CLANG_VERSION
+      - add NEON SHA1, SHA256 and SHA512 from Cryptogams
+      - add ARM SHA1, SHA256 and SHA512 from Cryptogams
+      - make config.h more autoconf friendly
+      - handle Clang triplet armv8l-unknown-linux-gnueabihf
+      - fix reference binding to misaligned address in xed25519
+      - clear asserts in TestDataNameValuePairs
+
+8.4.0 - January 2, 2021
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 67 unique contributors as of this release
+      - fix SIGILL on POWER8 when compiling with GCC 10
+      - fix potential out-of-bounds write in FixedSizeAllocatorWithCleanup
+      - fix compile on AIX POWER7 with IBM XLC 12.01
+      - fix compile on Solaris with SunCC 12.6
+      - revert changes for constant-time elliptic curve algorithms
+      - fix makefile clean and distclean recipes
+
+8.5.0 - March 7, 2021
+      - minor release, no recompile of programs required
+      - expanded community input and support
+        * 70 unique contributors as of this release
+      - port to Apple M1 hardware
+
+8.6.0 - September 21, 2021
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 74 unique contributors as of this release
+      - fix ElGamal encryption
+      - fix ChaCha20 AVX2 implementation
+      - add octal and decimal literal prefix parsing to Integer
+      - add missing overload in ed25519Signer and ed25519Verifier
+      - make SHA-NI independent of AVX and AVX2
+      - fix OldRandomPool GenerateWord32
+      - use CPPFLAGS during feature testing
+      - fix compile on CentOS 5
+      - fix compile on FreeBSD
+      - fix feature testing on ARM A-32 and Aarch64
+      - enable inline ASM for CRC and PMULL on Apple M1
+      - fix Intel oneAPI compile
+      - rename test files with *.cpp extension
+      - fix GCC compile error due to missing _mm256_set_m128i
+      - add LSH-256 and LSH-512 hash functions
+      - add ECIES_P1363 for backwards compatibility
+      - fix AdditiveCipherTemplate<T> ProcessData
+      - remove CRYPTOPP_NO_CXX11 define
+      - add -fno-common for Darwin builds
+      - update documentation
+
+8.7.0 - August 7, 2022
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 81 unique contributors as of this release
+      - fix RSA key generation for small moduli
+      - fix AES-GCM with AESNI but without CLMUL
+      - fix Clang warning with C++17
+      - fix MinGW builds due to use of O_NOFOLLOW
+      - rework CFB_CipherTemplate::ProcessData and AdditiveCipherTemplate::ProcessData
+        * restored performance and avoided performance penalty of a temp buffer
+      - fix undersized SecBlock buffer in Integer bit operations
+      - work around several GCC 11 & 12 problems
+
+8.8.0 - June 25, 2023
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 88 unique contributors as of this release
+      - fix crash in cryptest.exe when invoked with no options
+      - fix crash in library due to GCC removing live code
+      - fix RSA with key size 16 may provide an invalid key
+      - fix failure to build on 32-bit x86
+      - fix failure to build on iPhone Simulator for arm64
+      - fix failure to build on Windows arm64
+      - test for SSSE3 before using the ISA
+      - fix include of <x86intrin.h> when using MSVC
+      - improve performance of CRC32C_Update_SSE42 for x86-64
+      - update documentation
+
+8.9.0 - October 1, 2023
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 88 unique contributors as of this release
+      - fix SIMON128 Asan finding on POWER8
+      - fix AES/CFB and AES/CTR modes self test failures when using Cryptogams AES on ARMv7
+      - fix ARIA/CTR mode self test failures when inString==outString
+      - fix HIGHT/CTR mode self test failures when inString==outString
+      - fix Rabbit/CTR mode self test failures when inString==outString
+      - fix Prime Table and dangling reference to a temporary>
+      - fix Singleton::Ref when using C++11 memory fences
+      - remove unneeded call to Crop() in Randomize()
diff --git a/runtime/third_party/cryptopp/Install.txt b/runtime/third_party/cryptopp/Install.txt
new file mode 100644
index 0000000..d8c01ad
--- /dev/null
+++ b/runtime/third_party/cryptopp/Install.txt
@@ -0,0 +1,241 @@
+CONTENTS OF THIS FILE
+---------------------
+
+* Introduction
+* Prerequisites
+* Building the Library
+* Alternate Build Systems
+* Installing the Library
+* Makefile Targets
+* Dynamic Analysis
+* Acceptance Testing
+* Reporting problems
+
+
+INTRODUCTION
+------------
+
+Crypto++ Library is a free C++ class library of cryptographic algorithms and schemes. The library was originally written and placed in public domain by Wei Dai, but it is now maintained by the community. The library homepage is at http://www.cryptopp.com/. The latest library source code can be found at http://github.com/weidai11/cryptopp. For licensing and copyright information, please see License.txt.
+
+These are general instructions for AIX, BSDs, Linux, OS X, Solaris and Unix. The library uses GNU Make and a GNUmakefile to avoid anemic make. On AIX, BSD and Solaris you will likely have to use `gmake` to build the library. On Linux and OS X, the system's make should be OK. On Windows, Crypto++ provides Visual Studio solutions.
+
+You should look through the GNUmakefile and config.h to ensure settings look reasonable before building. There are two wiki pages that help explain them at http://www.cryptopp.com/wiki/GNUmakefile and http://www.cryptopp.com/wiki/Config.h.
+
+Wiki pages are available for some platforms with specific build instructions. The pages include Android, ARM, iOS, MSBuild and Solaris. Solaris users should visit the wiki for important information on compiling the library with different versions of SunCC and options, and information on improving library performance and features.
+
+Crypto++ does not depend upon other tools or libraries. The library only needs GNU Make 3.80 on Unix & Linux; or Visual Studio 2010 and above build tools on Windows. The library does not use Autotools, does not use CMake, and does not use Boost.
+
+Autotools and CMake projects are not officially supported. The build systems take too much time and effort. Unofficial projects are available at https://github.com/noloader/cryptopp-autotools and https://github.com/abdes/cryptopp-cmake. The projects provide a central location to support Autotools and CMake. Collaborators for Autotools and CMake are welcomed.
+
+
+PREREQUISITES
+-------------
+
+The library requires a semi-modern C++ compiler and GNU Make 3.81 or above. The compiler must support 64-bit words, C++03, namespaces, RTTI and exceptions.
+
+The library does not depend on other build systems, like Autotools or CMake. The library does not depend on other libraries, like Boost.
+
+BUILDING THE LIBRARY
+--------------------
+
+In general, all you should have to do is open a terminal, cd to the cryptopp directory, and then:
+
+    make
+    make test
+    sudo make install
+
+The command above builds the static library and cryptest.exe program. It also uses a sane default flags, which are usually "-DNDEBUG -g2 -O3 -fPIC".
+
+If you want to build the shared object, then issue:
+
+    make static dynamic cryptest.exe
+
+Or:
+
+    make libcryptopp.a libcryptopp.so cryptest.exe
+
+
+If you would like to use a different compiler, the set CXX:
+
+    export CXX=/opt/intel/bin/icpc
+    make
+
+Or:
+
+    CXX=/opt/solarisstudio12.4/bin/CC make
+
+If you want to build using C++11, then:
+
+    export CXXFLAGS="-DNDEBUG -g2 -O3 -std=c++11"
+    make
+
+Or:
+
+    CXXFLAGS="-DNDEBUG -g2 -O3 -std=c++11" make
+
+LLVM's libc++ is also supported, so you can:
+
+    export CXXFLAGS="-std=c++11 -stdlib=libc++"
+    make
+
+If you are using the library on OS X with XCode then you should add LLVM's libc++. You can do so by modifying CXXFLAGS, or you can modify the GNUmakefile. To modify the GNUmakefile, open it and find the line for OS X builds around line 150:
+
+    ifneq ($(IS_DARWIN),0)
+      CXX ?= c++
+      CRYPTOPP_CXXFLAGS += -stdlib=libc++
+      AR = libtool
+      ARFLAGS = -static -o
+    endif
+
+If you target 32-bit IA-32 machines (i386, i586 or i686), then the makefile forgoes -fPIC due to register pressures. You should add -fPIC yourself, if needed:
+
+    CXXFLAGS="-DNDEBUG -g2 -O3 -fPIC" make
+
+You can also override a variable so that only your flags are present. That is, the makefile will not add additional flags. For example, the following builds with only -std=c++11:
+
+    make CXXFLAGS="-std=c++11"
+
+Crypto++ does not engage Specter remediations at this time. You can build with Specter resistance with the following flags:
+
+    CXXFLAGS="-DNDEBUG -g2 -O3 -mfunction-return=thunk -mindirect-branch=thunk" make
+
+The library does not support out-of-tree builds. You must cd to the Crypto++ directory before building. `make distclean` will return the Crypto++ directory to a pristine state.
+
+
+BUILDING WITH VCPKG
+-------------------
+
+You can download and install cryptopp using the [vcpkg](https://github.com/Microsoft/vcpkg/) dependency manager:
+
+    git clone https://github.com/Microsoft/vcpkg.git
+    cd vcpkg
+    ./bootstrap-vcpkg.sh
+    ./vcpkg integrate install
+    ./vcpkg install cryptopp
+
+The cryptopp port in vcpkg is kept up to date by Microsoft team members and community contributors.
+If the version is out of date, please [create an issue or pull request](https://github.com/Microsoft/vcpkg) on the vcpkg repository.
+
+
+ALTERNATE BUILD SYSTEMS
+-----------------------
+
+The Crypto++ library is Make based and uses GNU Make by default. The makefile uses '-DNDEBUG -g2 -O2' CXXFLAGS by default. If you use an alternate build system, like Autotools or CMake, then ensure the build system includes '-DNDEBUG' for production or release builds. The Crypto++ library uses asserts for debugging and diagnostics during development; it does not rely on them to crash a program at runtime.
+
+If an assert triggers in production software, then unprotected sensitive information could be written to the filesystem and could be egressed to the platform's error reporting program, like Apport on Ubuntu, CrashReporter on Apple and Windows Error Reporting on Microsoft OSes.
+
+The makefile orders object files to help remediate problems associated with C++ static initialization order. The library does not use custom linker scripts. If you use an alternate build system, like Autotools or CMake, and collect source files into a list, then ensure these three are at the head of the list: 'cryptlib.cpp cpu.cpp integer.cpp <other sources>'. They should be linked in the same order: 'cryptlib.o cpu.o integer.o <other objects>'.
+
+If your linker supports initialization attributes, like init_priority, then you can define CRYPTOPP_INIT_PRIORITY to control object initialization order. Set it to a value like 250. User programs can use CRYPTOPP_USER_PRIORITY to avoid conflicts with library values. Initialization attributes are more reliable than object file ordering, but its not ubiquitously supported by linkers.
+
+The makefile links to the static version of the Crypto++ library to avoid missing dynamic libraries, incorrect dynamic libraries, binary planting and other LD_PRELOAD tricks. You should use the static version of the library in your programs to help avoid unwanted redirections.
+
+
+INSTALLING THE LIBRARY
+----------------------
+
+To install the library into a user selected directory, perform:
+
+    make install PREFIX=/usr/local
+
+If you are going to run `make install PREFIX=/usr/local`, then you should build with '-DCRYPTOPP_DATA_DIR='\"$PREFIX/share/cryptopp/\"' to ensure cryptest.exe can locate the test data files and test vectors after installation. The trailing slash in the path is needed because simple preprocessor concatenation is used.
+
+During install, the makefile copies cryptest.exe into $PREFIX/bin, copies headers into $PREFIX/include/cryptopp, and copies libraries into $PREFIX/lib. If you only built a static or dynamic version of the library, then only one library is copied. The install recipe does not fail if the static library or shared object is not built.
+
+PREFIX is non-standard, but its retained for historical purposes. The makefile also responds to `prefix=<path>`.
+
+
+MAKEFILE TARGETS
+----------------
+
+The following are some of the targets provided by the GNU makefile.
+
+`make` invokes the default rule, which builds the Crypto++ static library and test harness. They are called `libcryptopp.a` and `cryptest.exe`, respectively. `cryptest.exe` links against `libcryptopp.a`, so the static library is a prerequisite for the target.
+
+`make libcryptopp.a` and `make static` build the static version of the library.
+
+`make libcryptopp.so` and `make dynamic` build the dynamic version of the library. On Mac OS X, the recipe builds `libcryptopp.dylib` instead.
+
+`make cryptest.exe` builds the library test harness.
+
+`make test` and `make check` are the same recipe and invoke the test harness with the validation option. That is, it executes `cryptest.exe v`.
+
+`make install` installs the library. By default, the makefile copies into `/usr/local` by default.
+
+`make clean` cleans most transient and temporary objects.
+
+`make disclean` cleans most objects that are not part of the original distribution.
+
+`make dist` and `make zip` builds ZIP file that is suitable for distribution.
+
+`make iso` builds an ISO on Linux or OS X that is suitable for alternate distribution.
+
+`make ubsan` and `make asan` builds the library with the respective sanitizer.
+
+
+DYNAMIC ANALYSIS
+----------------
+
+The Crypto++ embraces tools like Undefined Behavior sanitizer (UBsan), Address sanitizer (Asan), Bounds sanitizer (Bsan), Coverity Scan and Valgrind. Both Clang 3.2 and above and GCC 4.8 and above provide sanitizers. Please check with your distribution on how to install the compiler with its sanitizer libraries (they are sometimes a separate install item).
+
+UBsan and Asan are mutually exclusive options, so you can perform only one of these at a time:
+
+    make ubsan
+    ./cryptest.exe v 2>&1 | grep -E "(error:|FAILED)"
+    ./cryptest.exe tv all 2>&1 | grep -E "(error:|FAILED)"
+
+Or:
+
+    make asan
+    ./cryptest.exe v 2>&1 | grep -E "(error:|FAILED)"
+    ./cryptest.exe tv all 2>&1 | grep -E "(error:|FAILED)"
+
+If you experience failures under Asan, then gather more information with asan_symbolize. You may not need asan_symbolize nowadays:
+
+    ./cryptest.exe v 2>&1 | asan_symbolize
+
+If you moved Crypto++ such that the paths have changed, then perform:
+
+    ./cryptest.exe v 2>&1 | sed "s/<old path>/<new path>/g" | asan_symbolize
+
+
+ACCEPTANCE TESTING
+------------------
+
+Crypto++ uses five security gates in its engineering process. The library must maintain the quality provided by the review system and integrity of the test suites. You can use the information to decide if the Crypto++ library suits your needs and provides a compatible security posture.
+
+The first gate is code review and discussion of proposed changes. Git commits often cross reference a User Group discussions.
+
+Second is the compiler warning system. The code must clean compile under the equivalent of GCC's -Wall -Wextra (modulo -Wno-type-limits -Wno-unknown-pragmas). This is a moving target as compiler analysis improves.
+
+Third, the code must pass cleanly though GCC and Clang's Undefined Behavior sanitizer (UBsan), Address sanitizer (Asan) and Bounds sanitizer (Bsan). See DYNAMIC ANALYSIS above on how to execute them.
+
+Fourth, the code must pass cleanly though Coverity Scan and Valgrind. Valgrind testing is performed at -O1 in accordance with Valgrind recommendations.
+
+Fifth, the test harness provides a "validation" option which performs basic system checks (like endianness and word sizes) and exercises algorithms (like AES and SHA). You run the validation suite as shown below. The tail of the output should indicate 0 failed tests.
+
+    ./cryptest.exe v
+    ...
+
+    Seed used was 1612313449
+    Test started at Tue Feb 2 19:50:49 2021
+    Test ended at Tue Feb 2 19:50:52 2021
+
+Sixth, the test harness provides a "test vector" option which uses many known test vectors, even those published by other people (like Brian Gladman for AES). You run the test vectors as shown below. The tail of the output should indicate 0 failed tests.
+
+    ./cryptest.exe tv all
+    ...
+
+    Testing SymmetricCipher algorithm AES/XTS.
+    .....................
+    Tests complete. Total tests = 11260. Failed tests = 0.
+
+The library also offers its test script for those who want to use it. The test script is names cryptest.sh, and it repeatedly builds the library and exectues the tests under various configurations. It takes about 4 hours to run on a semi-modern desktop or server; and several days to run on an IoT gadget. Also see http://github.com/weidai11/cryptopp/blob/master/cryptest.sh and http://cryptopp.com/wiki/Cryptest.sh.
+
+
+REPORTING PROBLEMS
+------------------
+
+Build failures, dirty compiles and failures in the validation suite or test vectors should be reported at the Crypto++ User Group. The User Group is located at http://groups.google.com/forum/#!forum/cryptopp-users.
+
+The library uses Wei Dai's GitHub to track issues. The tracker is located at http://github.com/weidai11/cryptopp/issues. Please do not ask questions in the bug tracker; ask questions on the mailing list instead. Also see http://www.cryptopp.com/wiki/Bug_Report.
diff --git a/runtime/third_party/cryptopp/License.txt b/runtime/third_party/cryptopp/License.txt
new file mode 100644
index 0000000..800ac7e
--- /dev/null
+++ b/runtime/third_party/cryptopp/License.txt
@@ -0,0 +1,84 @@
+Compilation Copyright (c) 1995-2019 by Wei Dai.  All rights reserved.
+This copyright applies only to this software distribution package
+as a compilation, and does not imply a copyright on any particular
+file in the package.
+
+All individual files in this compilation are placed in the public domain by
+Wei Dai and other contributors.
+
+I would like to thank the following authors for placing their works into
+the public domain:
+
+Joan Daemen - 3way.cpp
+Leonard Janke - cast.cpp, seal.cpp
+Steve Reid - cast.cpp
+Phil Karn - des.cpp
+Andrew M. Kuchling - md2.cpp, md4.cpp
+Colin Plumb - md5.cpp
+Seal Woods - rc6.cpp
+Chris Morgan - rijndael.cpp
+Paulo Baretto - rijndael.cpp, skipjack.cpp, square.cpp
+Richard De Moliner - safer.cpp
+Matthew Skala - twofish.cpp
+Kevin Springle - camellia.cpp, shacal2.cpp, ttmac.cpp, whrlpool.cpp, ripemd.cpp
+Ronny Van Keer - sha3.cpp
+Aumasson, Neves, Wilcox-O'Hearn and Winnerlein - blake2.cpp, blake2b_simd.cpp, blake2s_simd.cpp
+Aaram Yun - aria.cpp, aria_simd.cpp
+Han Lulu, Markku-Juhani O. Saarinen - sm4.cpp sm4_simd.cpp
+Daniel J. Bernstein, Jack Lloyd - chacha.cpp, chacha_simd.cpp, chacha_avx.cpp
+Andrew Moon - ed25519, x25519, donna_32.cpp, donna_64.cpp, donna_sse.cpp
+
+The Crypto++ Library uses portions of Andy Polyakov's CRYPTOGAMS on Linux
+for 32-bit ARM with files aes_armv4.S, sha1_armv4.S and sha256_armv4.S.
+CRYPTOGAMS is dual licensed with a permissive BSD-style license. The
+CRYPTOGAMS license is reproduced below. You can disable Cryptogams code by
+undefining the relevant macros in config_asm.h.
+
+The Crypto++ Library uses portions of Jack Lloyd's Botan for ChaCha SSE2 and
+AVX. Botan placed the code in public domain for Crypto++ to use.
+
+The Crypto++ Library (as a compilation) is currently licensed under the Boost
+Software License 1.0 (http://www.boost.org/users/license.html).
+
+Boost Software License - Version 1.0 - August 17th, 2003
+
+Permission is hereby granted, free of charge, to any person or organization
+obtaining a copy of the software and accompanying documentation covered by
+this license (the "Software") to use, reproduce, display, distribute,
+execute, and transmit the Software, and to prepare derivative works of the
+Software, and to permit third-parties to whom the Software is furnished to
+do so, all subject to the following:
+
+The copyright notices in the Software and this entire statement, including
+the above license grant, this restriction and the following disclaimer,
+must be included in all copies of the Software, in whole or in part, and
+all derivative works of the Software, unless such copies or derivative
+works are solely in the form of machine-executable object code generated by
+a source language processor.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
+SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
+FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+CRYPTOGAMS License
+
+Copyright (c) 2006-2017, CRYPTOGAMS by <appro@openssl.org>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+* Redistributions of source code must retain copyright notices,
+  this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above
+  copyright notice, this list of conditions and the following
+  disclaimer in the documentation and/or other materials
+  provided with the distribution.
+* Neither the name of the CRYPTOGAMS nor the names of its copyright
+  holder and contributors may be used to endorse or promote products
+  derived from this software without specific prior written permission.
diff --git a/runtime/third_party/cryptopp/Readme.txt b/runtime/third_party/cryptopp/Readme.txt
new file mode 100644
index 0000000..631bc4e
--- /dev/null
+++ b/runtime/third_party/cryptopp/Readme.txt
@@ -0,0 +1,477 @@
+Crypto++: free C++ Class Library of Cryptographic Schemes
+Version 8.9 - October 1, 2023
+
+Crypto++ Library is a free C++ class library of cryptographic schemes.
+Currently the library contains the following algorithms:
+
+                   algorithm type  name
+
+ authenticated encryption schemes  GCM, CCM, EAX, ChaCha20Poly1305 and
+                                   XChaCha20Poly1305
+
+        high speed stream ciphers  ChaCha (8/12/20), ChaCha (IETF), Panama, Salsa20,
+                                   Sosemanuk, XSalsa20, XChaCha20
+
+           AES and AES candidates  AES (Rijndael), RC6, MARS, Twofish, Serpent,
+                                   CAST-256
+
+                                   ARIA, Blowfish, Camellia, CHAM, HIGHT, IDEA,
+                                   Kalyna (128/256/512), LEA, SEED, RC5, SHACAL-2,
+              other block ciphers  SIMON (64/128), Skipjack, SPECK (64/128),
+                                   Simeck, SM4, Threefish (256/512/1024),
+                                   Triple-DES (DES-EDE2 and DES-EDE3), TEA, XTEA
+
+  block cipher modes of operation  ECB, CBC, CBC ciphertext stealing (CTS),
+                                   CFB, OFB, counter mode (CTR), XTS
+
+     message authentication codes  BLAKE2s, BLAKE2b, CMAC, CBC-MAC, DMAC, GMAC, HMAC,
+                                   Poly1305, Poly1305 (IETF), SipHash, Two-Track-MAC,
+                                   VMAC
+
+                                   BLAKE2s, BLAKE2b, Keccack (F1600), LSH (256/512),
+                   hash functions  SHA-1, SHA-2 (224/256/384/512), SHA-3 (224/256),
+                                   SHA-3 (384/512), SHAKE (128/256), SipHash, SM3, Tiger,
+                                   RIPEMD (128/160/256/320), WHIRLPOOL
+
+                                   RSA, DSA, Deterministic DSA, ElGamal,
+          public-key cryptography  Nyberg-Rueppel (NR), Rabin-Williams (RW), LUC,
+                                   LUCELG, EC-based German Digital Signature (ECGDSA),
+                                   DLIES (variants of DHAES), ESIGN
+
+   padding schemes for public-key  PKCS#1 v2.0, OAEP, PSS, PSSR, IEEE P1363
+                          systems  EMSA2 and EMSA5
+
+                                   Diffie-Hellman (DH), Unified Diffie-Hellman (DH2),
+            key agreement schemes  Menezes-Qu-Vanstone (MQV), Hashed MQV (HMQV),
+                                   Fully Hashed MQV (FHMQV), LUCDIF, XTR-DH
+
+      elliptic curve cryptography  ECDSA, Deterministic ECDSA, ed25519, ECNR, ECIES,
+                                   ECDH, ECMQV, x25519
+
+          insecure or obsolescent  MD2, MD4, MD5, Panama Hash, DES, ARC4, SEAL
+algorithms retained for backwards  3.0, WAKE-OFB, DESX (DES-XEX3), RC2,
+     compatibility and historical  SAFER, 3-WAY, GOST, SHARK, CAST-128, Square
+                            value
+
+Other features include:
+
+  * pseudo random number generators (PRNG): ANSI X9.17 appendix C, RandomPool,
+    DARN, VIA Padlock, RDRAND, RDSEED, NIST Hash and HMAC DRBGs
+  * password based key derivation functions: PBKDF1 and PBKDF2 from PKCS #5,
+    PBKDF from PKCS #12 appendix B, HKDF from RFC 5869, Scrypt from RFC 7914
+  * Shamir's secret sharing scheme and Rabin's information dispersal algorithm
+    (IDA)
+  * fast multi-precision integer (bignum) and polynomial operations
+  * finite field arithmetics, including GF(p) and GF(2^n)
+  * prime number generation and verification
+  * useful non-cryptographic algorithms
+      + DEFLATE (RFC 1951) compression/decompression with gzip (RFC 1952) and
+        zlib (RFC 1950) format support
+      + Hex, base-32, base-64, URL safe base-64 encoding and decoding
+      + 32-bit CRC, CRC-C and Adler32 checksum
+  * class wrappers for these platform and operating system features (optional):
+      + high resolution timers on Windows, Unix, and Mac OS
+      + /dev/random, /dev/urandom, /dev/srandom
+      + Microsoft's CryptGenRandom or BCryptGenRandom on Windows
+  * A high level interface for most of the above, using a filter/pipeline
+    metaphor
+  * benchmarks and validation testing
+  * x86, x64 (x86-64), x32 (ILP32), ARM-32, Aarch32, Aarch64 and Power8
+    in-core code for the commonly used algorithms
+      + run-time CPU feature detection and code selection
+      + supports GCC-style and MSVC-style inline assembly, and MASM for x64
+      + x86, x64 (x86-64), x32 provides MMX, SSE2, and SSE4 implementations
+      + ARM-32, Aarch32 and Aarch64 provides NEON, ASIMD and ARMv8 implementations
+      + Power8 provides in-core AES using NX Crypto Acceleration
+
+The Crypto++ library was originally written by Wei Dai. The library is now
+maintained by several team members and the community. You are welcome to use it
+for any purpose without paying anyone, but see License.txt for the fine print.
+
+The following compilers are supported for this release. Please visit
+http://www.cryptopp.com the most up to date build instructions and porting notes.
+
+  * Visual Studio 2003 - 2022
+  * GCC 3.3 - 13.1
+  * Apple Clang 4.3 - 12.0
+  * LLVM Clang 2.9 - 14.0
+  * C++ Builder 2015
+  * Intel C++ Compiler 9 - 16.0
+  * Sun Studio 12u1 - 12.7
+  * IBM XL C/C++ 10.0 - 14.0
+
+*** Important Usage Notes ***
+
+1. If a constructor for A takes a pointer to an object B (except primitive
+types such as int and char), then A owns B and will delete B at A's
+destruction.  If a constructor for A takes a reference to an object B,
+then the caller retains ownership of B and should not destroy it until
+A no longer needs it.
+
+2. Crypto++ is thread safe at the class level. This means you can use
+Crypto++ safely in a multithreaded application, but you must provide
+synchronization when multiple threads access a common Crypto++ object.
+
+*** MSVC-Specific Information ***
+
+To compile Crypto++ with MSVC, open "cryptest.sln" (for MSVC 2003 - 2015)
+and build one or more of the following projects:
+
+cryptest Non-DLL-Import Configuration - This builds the full static library
+  along with a full test driver.
+cryptest DLL-Import Configuration - This builds a static library containing
+  only algorithms not in the DLL, along with a full test driver that uses
+  both the DLL and the static library.
+cryptdll - This builds the DLL. Please note that if you wish to use Crypto++
+  as a FIPS validated module, you must use a pre-built DLL that has undergone
+  the FIPS validation process instead of building your own.
+dlltest - This builds a sample application that only uses the DLL.
+
+The DLL used to provide FIPS validated cryptography. The library was moved
+to the CMVP's [Historical Validation List](http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-historical.htm).
+The library and the DLL are no longer considered
+validated. You should no longer use the DLL.
+
+To use the Crypto++ DLL in your application, #include "dll.h" before including
+any other Crypto++ header files, and place the DLL in the same directory as
+your .exe file. dll.h includes the line #pragma comment(lib, "cryptopp")
+so you don't have to explicitly list the import library in your project
+settings. To use a static library form of Crypto++, make the "cryptlib"
+project a dependency of your application project, or specify it as
+an additional library to link with in your project settings.
+In either case you should check the compiler options to
+make sure that the library and your application are using the same C++
+run-time libraries and calling conventions.
+
+*** DLL Memory Management ***
+
+Because it's possible for the Crypto++ DLL to delete objects allocated
+by the calling application, they must use the same C++ memory heap. Three
+methods are provided to achieve this.
+1.  The calling application can tell Crypto++ what heap to use. This method
+    is required when the calling application uses a non-standard heap.
+2.  Crypto++ can tell the calling application what heap to use. This method
+    is required when the calling application uses a statically linked C++ Run
+    Time Library. (Method 1 does not work in this case because the Crypto++ DLL
+    is initialized before the calling application's heap is initialized.)
+3.  Crypto++ can automatically use the heap provided by the calling application's
+    dynamically linked C++ Run Time Library. The calling application must
+    make sure that the dynamically linked C++ Run Time Library is initialized
+    before Crypto++ is loaded. (At this time it is not clear if it is possible
+    to control the order in which DLLs are initialized on Windows 9x machines,
+    so it might be best to avoid using this method.)
+
+When Crypto++ attaches to a new process, it searches all modules loaded
+into the process space for exported functions "GetNewAndDeleteForCryptoPP"
+and "SetNewAndDeleteFromCryptoPP". If one of these functions is found,
+Crypto++ uses methods 1 or 2, respectively, by calling the function.
+Otherwise, method 3 is used.
+
+*** Linux and Unix-like Specific Information ***
+
+A makefile is included for you to compile Crypto++ with GCC and compatibles.
+Make sure you are using GNU Make and GNU ld. The make process will produce
+two files, libcryptopp.a and cryptest.exe. Run "cryptest.exe v" for the
+validation suite and "cryptest.exe tv all" for additional test vectors.
+
+The makefile uses '-DNDEBUG -g2 -O2' CXXFLAGS by default. If you use an
+alternate build system, like Autotools or CMake, then ensure the build system
+includes '-DNDEBUG' for production or release builds. The Crypto++ library uses
+asserts for debugging and diagnostics during development; it does not
+rely on them to crash a program at runtime.
+
+If an assert triggers in production software, then unprotected sensitive
+information could be egressed from the program to the filesystem or the
+platform's error reporting program, like Apport on Ubuntu or CrashReporter
+on Apple.
+
+The makefile orders object files to help remediate problems associated with
+C++ static initialization order. The library does not use custom linker scripts.
+If you use an alternate build system, like Autotools or CMake, and collect source
+files into a list, then ensure these three are at the head of the list: 'cryptlib.cpp
+cpu.cpp integer.cpp <other sources>'. They should be linked in the same order:
+'cryptlib.o cpu.o integer.o <other objects>'.
+
+If your linker supports initialization attributes, like init_priority, then you can
+define CRYPTOPP_INIT_PRIORITY to control object initialization order. Set it to a
+value like 250. User programs can use CRYPTOPP_USER_PRIORITY to avoid conflicts with
+library values. Initialization attributes are more reliable than object file ordering,
+but its not ubiquitously supported by linkers.
+
+The makefile links to the static version of the Crypto++ library to avoid binary
+planting and other LD_PRELOAD tricks. You should use the static version of the
+library in your programs to help avoid unwanted redirections.
+
+*** Side Channel Attacks ***
+
+Crypto++ attempts to resist side channel attacks using various remediations.
+The remediations are applied as a best effort but are probably incomplete. They
+are incomplete due to cpu speculation bugs like Spectre, Meltdown, Foreshadow.
+The attacks target both cpu caches and internal buffers. Intel generally refers
+to internal buffer attacks as "Microarchitectural Data Sampling" (MDS).
+
+The library uses hardware instructions when possible for block ciphers, hashes
+and other operations. The hardware acceleration remediates some timing
+attacks. The library also uses cache-aware algorithms and access patterns
+to minimize leakage cache evictions.
+
+Elliptic curves over binary fields are believed to leak information. The task is a
+work in progress. We don't believe binary fields are used in production, so we feel it
+is a low risk at the moment.
+
+Crypto++ does not engage Specter remediations at this time. The GCC options
+for Specter are -mfunction-return=thunk and -mindirect-branch=thunk, and the
+library uses them during testing. If you want the Specter workarounds then add
+the GCC options to your CXXFLAGS when building the library.
+
+To help resist attacks you should disable hyperthreading on cpus. If you
+suspect or find an information leak then please report it.
+
+*** Documentation and Support ***
+
+Crypto++ is documented through inline comments in header files, which are
+processed through Doxygen to produce an HTML reference manual. You can find
+a link to the manual from http://www.cryptopp.com. Also at that site is
+the Crypto++ FAQ, which you should browse through before attempting to
+use this library, because it will likely answer many of questions that
+may come up. Finally, the site provides the wiki which has many topics
+and code examples.
+
+If you run into any problems, please try the Crypto++ mailing list.
+The subscription information and the list archive are available on
+http://www.cryptopp.com.
+
+*** Source Code and Contributing ***
+
+The source code and its planned changes are available at the following locations.
+
+  * The Crypto++ GitHub repository allows you to view the latest (unreleased)
+    Crypto++ source code via the Linux kernel's git beginning around June 2015.
+    Its also serves as an incubator to nurture and grow the library.
+  * The former Crypto++ SourceForge repository allows you to view the Crypto++
+    source code via Apache's subversion until about July 2015. At that time,
+    SourceForge had infrastructure problems and a cutover to GutHub was performed.
+  * The Roadmap on the wiki provides the general direction the library is heading.
+    It includes planned features and releases, and even some wishlist items.
+
+Contributions of all types are welcomed. Contributions include the following.
+
+  * Bug finding and fixes
+  * Features and enhancements
+  * Test scripts and test cases
+  * Branch and release testing
+  * Documentation and updates
+
+If you think you have found a bug in the library, then you should discuss it on the
+Users mailing list. Discussing it will help bring the issue to the attention of folks
+who can help resolve the issue. If you want to contribute a bug fix to the library,
+then make a Pull Request or make a Diff available somewhere. Also see Bug Reports on
+the wiki.
+
+Features and enhancements are welcomed additions to the library. This category tends
+to be time consuming because algorithms and their test cases need to be reviewed and
+merged. Please be mindful of the test cases, and attempt to procure them from an
+independent source.
+
+The library cherishes test scripts and test cases. They ensure the library is fit and
+they help uncover issues with the library before users experience them. If you have
+some time, then write some test cases, especially the ones that are intended to break
+things.
+
+Branch and release testing is your chance to ensure Master (and planned merges) meets
+your expectations and perform as expected. If you have a few spare cycles, then please
+test Master on your favorite platform. We need more testing on MinGW, Windows Phone,
+Windows Store, Solaris 10 (and below), and modern iOS and OS X (including TV and
+Watch builds).
+
+Documentation and updates includes both the inline source code annotations using
+Doxygen, and the online information provided in the wiki. The wiki is more verbose and
+usually provides more contextual information than the API reference. Besides testing,
+documentation is one of the highest returns on investment.
+
+*** History ***
+
+The items in this section comprise the most recent history. Please see History.txt
+for the record back to Crypto++ 1.0.
+
+8.9.0 - October 1, 2023
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 88 unique contributors as of this release
+      - fix SIMON128 Asan finding on POWER8
+      - fix AES/CFB and AES/CTR modes self test failures when using Cryptogams AES on ARMv7
+      - fix ARIA/CTR mode self test failures when inString==outString
+      - fix HIGHT/CTR mode self test failures when inString==outString
+      - fix Rabbit/CTR mode self test failures when inString==outString
+      - fix Prime Table and dangling reference to a temporary>
+      - fix Singleton::Ref when using C++11 memory fences
+      - remove unneeded call to Crop() in Randomize()
+
+8.8.0 - June 25, 2023
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 88 unique contributors as of this release
+      - fix crash in cryptest.exe when invoked with no options
+      - fix crash in library due to GCC removing live code
+      - fix RSA with key size 16 may provide an invalid key
+      - fix failure to build on 32-bit x86
+      - fix failure to build on iPhone Simulator for arm64
+      - fix failure to build on Windows arm64
+      - test for SSSE3 before using the ISA
+      - fix include of <x86intrin.h> when using MSVC
+      - improve performance of CRC32C_Update_SSE42 for x86-64
+      - update documentation
+
+8.7.0 - August 7, 2022
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 81 unique contributors as of this release
+      - fix RSA key generation for small moduli
+      - fix AES-GCM with AESNI but without CLMUL
+      - fix Clang warning with C++17
+      - fix MinGW builds due to use of O_NOFOLLOW
+      - rework CFB_CipherTemplate::ProcessData and AdditiveCipherTemplate::ProcessData
+        * restored performance and avoided performance penalty of a temp buffer
+      - fix undersized SecBlock buffer in Integer bit operations
+      - work around several GCC 11 & 12 problems
+
+8.6.0 - September 21, 2021
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 74 unique contributors as of this release
+      - fix ElGamal encryption
+      - fix ChaCha20 AVX2 implementation
+      - add octal and decimal literal prefix parsing to Integer
+      - add missing overload in ed25519Signer and ed25519Verifier
+      - make SHA-NI independent of AVX and AVX2
+      - fix OldRandomPool GenerateWord32
+      - use CPPFLAGS during feature testing
+      - fix compile on CentOS 5
+      - fix compile on FreeBSD
+      - fix feature testing on ARM A-32 and Aarch64
+      - enable inline ASM for CRC and PMULL on Apple M1
+      - fix Intel oneAPI compile
+      - rename test files with *.cpp extension
+      - fix GCC compile error due to missing _mm256_set_m128i
+      - add LSH-256 and LSH-512 hash functions
+      - add ECIES_P1363 for backwards compatibility
+      - fix AdditiveCipherTemplate<T> ProcessData
+      - remove CRYPTOPP_NO_CXX11 define
+      - add -fno-common for Darwin builds
+      - update documentation
+
+8.5.0 - March 7, 2021
+      - minor release, no recompile of programs required
+      - expanded community input and support
+        * 70 unique contributors as of this release
+      - port to Apple M1 hardware
+
+8.4.0 - January 2, 2021
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 67 unique contributors as of this release
+      - fix SIGILL on POWER8 when compiling with GCC 10
+      - fix potential out-of-bounds write in FixedSizeAllocatorWithCleanup
+      - fix compile on AIX POWER7 with IBM XLC 12.01
+      - fix compile on Solaris with SunCC 12.6
+      - revert changes for constant-time elliptic curve algorithms
+      - fix makefile clean and distclean recipes
+
+8.3.0 - December 20, 2020
+      - minor release, recompile of programs required
+      - expanded community input and support
+        * 66 unique contributors as of this release
+      - fix use of macro CRYPTOPP_ALIGN_DATA
+      - fix potential out-of-bounds read in ECDSA
+      - fix std::bad_alloc when using ByteQueue in pipeline
+      - fix missing CRYPTOPP_CXX17_EXCEPTIONS with Clang
+      - fix potential out-of-bounds read in GCM mode
+      - add configure.sh when preprocessor macros fail
+      - fix potential out-of-bounds read in SipHash
+      - fix compile error on POWER9 due to vec_xl_be
+      - fix K233 curve on POWER8
+      - add Cirrus CI testing
+      - fix broken encryption for some 64-bit ciphers
+      - fix Android cpu-features.c using C++ compiler
+      - disable RDRAND and RDSEED for some AMD processors
+      - fix BLAKE2 hash calculation using Salt and Personalization
+      - refresh Android and iOS build scripts
+      - add XTS mode
+      - fix circular dependency between misc.h and secblock.h
+      - add Certificate interface
+      - fix recursion in AES::Encryption without AESNI
+      - add missing OID for ElGamal encryption
+      - fix missing override in KeyDerivationFunction-derived classes
+      - fix RDSEED assemble under MSVC
+      - fix elliptic curve timing leaks (CVE-2019-14318)
+      - add link-library variable to Makefiles
+      - fix SIZE_MAX definition in misc.h
+      - add GetWord64 and PutWord64 to BufferedTransformation
+      - use HKDF in AutoSeededX917RNG::Reseed
+      - fix Asan finding in VMAC on i686 in inline asm
+      - fix undeclared identifier _mm_roti_epi64 on Gentoo
+      - fix ECIES and GetSymmetricKeyLength
+      - fix possible divide by zero in PKCS5_PBKDF2_HMAC
+      - refine ASN.1 encoders and decoders
+      - disable BMI2 code paths in Integer class
+      - fix use of CRYPTOPP_CLANG_VERSION
+      - add NEON SHA1, SHA256 and SHA512 from Cryptogams
+      - add ARM SHA1, SHA256 and SHA512 from Cryptogams
+      - make config.h more autoconf friendly
+      - handle Clang triplet armv8l-unknown-linux-gnueabihf
+      - fix reference binding to misaligned address in xed25519
+      - clear asserts in TestDataNameValuePairs
+
+8.2.0 - April 28, 2019
+      - minor release, no recompile of programs required
+      - expanded community input and support
+        * 56 unique contributors as of this release
+      - use PowerPC unaligned loads and stores with Power8
+      - add SKIPJACK test vectors
+      - fix SHAKE-128 and SHAKE-256 compile
+      - removed IS_NEON from Makefile
+      - fix Aarch64 build on Fedora 29
+      - fix missing GF2NT_233_Multiply_Reduce_CLMUL in FIPS DLL
+      - add missing BLAKE2 constructors
+      - fix missing BlockSize() in BLAKE2 classes
+
+8.1.0 - February 22, 2019
+      - minor release, no recompile of programs required
+      - expanded community input and support
+        * 56 unique contributors as of this release
+      - fix OS X PowerPC builds with Clang
+      - add Microsoft ARM64 support
+      - fix iPhone Simulator build due to missing symbols
+      - add CRYPTOPP_BUGGY_SIMD_LOAD_AND_STORE
+      - add carryless multiplies for NIST b233 and k233 curves
+      - fix OpenMP build due to use of OpenMP 4 with down-level compilers
+      - add SignStream and VerifyStream for ed25519 and large files
+      - fix missing AlgorithmProvider in PanamaHash
+      - add SHAKE-128 and SHAKE-256
+      - fix AVX2 build due to _mm256_broadcastsi128_si256
+      - add IETF ChaCha, XChaCha, ChaChaPoly1305 and XChaChaPoly1305
+
+8.0.0 - December 28, 2018
+      - major release, recompile of programs required
+      - expanded community input and support
+         * 54 unique contributors as of this release
+      - add x25519 key exchange and ed25519 signature scheme
+      - add limited Asymmetric Key Package support from RFC 5958
+      - add Power9 DARN random number generator support
+      - add CHAM, HC-128, HC-256, Hight, LEA, Rabbit, Simeck
+      - fix FixedSizeAllocatorWithCleanup may be unaligned on some platforms
+      - cutover to GNU Make-based cpu feature tests
+      - rename files with dashes to underscores
+      - fix LegacyDecryptor and LegacyDecryptorWithMAC use wrong MAC
+      - fix incorrect AES/CBC decryption on Windows
+      - avoid Singleton<T> when possible, avoid std::call_once completely
+      - fix SPARC alignment problems due to GetAlignmentOf<T>() on word64
+      - add ARM AES asm implementation from Cryptogams
+      - remove CRYPTOPP_ALLOW_UNALIGNED_DATA_ACCESS support
+
+June 2015 - Changing of the guard. Wei Dai turned the library over to the
+        community. The first community release was Crypto++ 5.6.3. Wei is
+        no longer involved with the daily operations of the project. Wei
+        still provides guidance when we have questions.
+
+Originally written by Wei Dai, maintained by the Crypto++ Project
diff --git a/runtime/third_party/cryptopp/WIICOMPILED.md b/runtime/third_party/cryptopp/WIICOMPILED.md
new file mode 100644
index 0000000..75b5af5
--- /dev/null
+++ b/runtime/third_party/cryptopp/WIICOMPILED.md
@@ -0,0 +1,23 @@
+# Crypto++ vendoring notes
+
+- Upstream version: Crypto++ 8.9.0
+- Upstream tag: `CRYPTOPP_8_9_0`
+- Upstream commit: `843d74c7c97f9e19a615b8ff3c0ca06599ca501b`
+- Source: <https://github.com/weidai11/cryptopp>
+
+The top-level source distribution is vendored for disconnected builds. CMake
+excludes upstream test programs, assembly, and algorithm-specific SIMD units.
+
+WiiCompiled carries three small portability adaptations for its supported
+Clang/MSVC-ABI build:
+
+1. `config_os.h` has a project-scoped opt-in around Crypto++ 8.9.0's Clang/MSVC
+   hard stop.
+2. `config_int.h` can avoid Clang's 128-bit division helpers, which are absent
+   from this ABI's runtime library.
+3. `cpu.cpp` returns inert feature-probe results when `CRYPTOPP_DISABLE_ASM` is
+   set, avoiding references to the deliberately omitted x64 assembly helpers.
+
+This configuration supplies SHA-1, sect233r1 public key derivation, ECDSA
+signing, signature verification, and key validation for the runtime's Wii ES
+crypto implementation.
diff --git a/runtime/third_party/cryptopp/adler32.cpp b/runtime/third_party/cryptopp/adler32.cpp
new file mode 100644
index 0000000..f4a3ada
--- /dev/null
+++ b/runtime/third_party/cryptopp/adler32.cpp
@@ -0,0 +1,82 @@
+// adler32.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "adler32.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void Adler32::Update(const byte *input, size_t length)
+{
+	const unsigned long BASE = 65521;
+
+	unsigned long s1 = m_s1;
+	unsigned long s2 = m_s2;
+
+	if (length % 8 != 0)
+	{
+		do
+		{
+			s1 += *input++;
+			s2 += s1;
+			length--;
+		} while (length % 8 != 0);
+
+		if (s1 >= BASE)
+			s1 -= BASE;
+		s2 %= BASE;
+	}
+
+	while (length > 0)
+	{
+		s1 += input[0]; s2 += s1;
+		s1 += input[1]; s2 += s1;
+		s1 += input[2]; s2 += s1;
+		s1 += input[3]; s2 += s1;
+		s1 += input[4]; s2 += s1;
+		s1 += input[5]; s2 += s1;
+		s1 += input[6]; s2 += s1;
+		s1 += input[7]; s2 += s1;
+
+		length -= 8;
+		input += 8;
+
+		if (s1 >= BASE)
+			s1 -= BASE;
+		if (length % 0x8000 == 0)
+			s2 %= BASE;
+	}
+
+	CRYPTOPP_ASSERT(s1 < BASE);
+	CRYPTOPP_ASSERT(s2 < BASE);
+
+	m_s1 = (word16)s1;
+	m_s2 = (word16)s2;
+}
+
+void Adler32::TruncatedFinal(byte *hash, size_t size)
+{
+	ThrowIfInvalidTruncatedSize(size);
+
+	switch (size)
+	{
+	default:
+		hash[3] = byte(m_s1);
+		// fall through
+	case 3:
+		hash[2] = byte(m_s1 >> 8);
+		// fall through
+	case 2:
+		hash[1] = byte(m_s2);
+		// fall through
+	case 1:
+		hash[0] = byte(m_s2 >> 8);
+		// fall through
+	case 0:
+		;
+		// fall through
+	}
+
+	Reset();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/adler32.h b/runtime/third_party/cryptopp/adler32.h
new file mode 100644
index 0000000..39f8deb
--- /dev/null
+++ b/runtime/third_party/cryptopp/adler32.h
@@ -0,0 +1,33 @@
+// adler32.h - originally written and placed in the public domain by Wei Dai
+
+/// \file adler32.h
+/// \brief Class file for ADLER-32 checksum calculations
+
+#ifndef CRYPTOPP_ADLER32_H
+#define CRYPTOPP_ADLER32_H
+
+#include "cryptlib.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// ADLER-32 checksum calculations
+class Adler32 : public HashTransformation
+{
+public:
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 4);
+	Adler32() {Reset();}
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *hash, size_t size);
+	unsigned int DigestSize() const {return DIGESTSIZE;}
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "Adler32";}
+    std::string AlgorithmName() const {return StaticAlgorithmName();}
+
+private:
+	void Reset() {m_s1 = 1; m_s2 = 0;}
+
+	word16 m_s1, m_s2;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/adv_simd.h b/runtime/third_party/cryptopp/adv_simd.h
new file mode 100644
index 0000000..963d58e
--- /dev/null
+++ b/runtime/third_party/cryptopp/adv_simd.h
@@ -0,0 +1,1281 @@
+// adv_simd.h - written and placed in the public domain by Jeffrey Walton
+
+/// \file adv_simd.h
+/// \brief Template for AdvancedProcessBlocks and SIMD processing
+
+//    The SIMD based implementations for ciphers that use SSE, NEON and Power7
+//    have a common pattern. Namely, they have a specialized implementation of
+//    AdvancedProcessBlocks which processes multiple block using hardware
+//    acceleration. After several implementations we noticed a lot of copy and
+//    paste occurring. adv_simd.h provides a template to avoid the copy and paste.
+//
+//    There are 6 templates provided in this file. The number following the
+//    function name, 128, is the block size in bits. The name following the
+//    block size is the arrangement and acceleration. For example 4x1_SSE means
+//    Intel SSE using two encrypt (or decrypt) functions: one that operates on
+//    4 SIMD words, and one that operates on 1 SIMD words.
+//
+//      * AdvancedProcessBlocks128_4x1_SSE
+//      * AdvancedProcessBlocks128_6x2_SSE
+//      * AdvancedProcessBlocks128_4x1_NEON
+//      * AdvancedProcessBlocks128_6x1_NEON
+//      * AdvancedProcessBlocks128_4x1_ALTIVEC
+//      * AdvancedProcessBlocks128_6x1_ALTIVEC
+//
+//    If an arrangement ends in 2, like 6x2, then the template will handle the
+//    single block case by padding with 0's and using the two SIMD word
+//    function. This happens at most one time when processing multiple blocks.
+//    The extra processing of a zero block is trivial and worth the tradeoff.
+//
+//    The MAYBE_CONST macro present on x86 is a SunCC workaround. Some versions
+//    of SunCC lose/drop the const-ness in the F1 and F4 functions. It eventually
+//    results in a failed link due to the const/non-const mismatch.
+//
+//    In July 2020 the library stopped using 64-bit block version of
+//    AdvancedProcessBlocks. Testing showed unreliable results and failed
+//    self tests on occasion. Also see Issue 945 and
+//    https://github.com/weidai11/cryptopp/commit/dd7598e638bb.
+
+#ifndef CRYPTOPP_ADVANCED_SIMD_TEMPLATES
+#define CRYPTOPP_ADVANCED_SIMD_TEMPLATES
+
+#include "config.h"
+#include "misc.h"
+#include "stdcpp.h"
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include <arm_neon.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+# include <emmintrin.h>
+# include <xmmintrin.h>
+#endif
+
+// SunCC needs CRYPTOPP_SSSE3_AVAILABLE, too
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+# include <emmintrin.h>
+# include <pmmintrin.h>
+# include <xmmintrin.h>
+#endif
+
+#if defined(__ALTIVEC__)
+# include "ppc_simd.h"
+#endif
+
+// ************************ All block ciphers *********************** //
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::BlockTransformation;
+
+CRYPTOPP_CONSTANT(BT_XorInput = BlockTransformation::BT_XorInput);
+CRYPTOPP_CONSTANT(BT_AllowParallel = BlockTransformation::BT_AllowParallel);
+CRYPTOPP_CONSTANT(BT_InBlockIsCounter = BlockTransformation::BT_InBlockIsCounter);
+CRYPTOPP_CONSTANT(BT_ReverseDirection = BlockTransformation::BT_ReverseDirection);
+CRYPTOPP_CONSTANT(BT_DontIncrementInOutPointers = BlockTransformation::BT_DontIncrementInOutPointers);
+
+ANONYMOUS_NAMESPACE_END
+
+// *************************** ARM NEON ************************** //
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE) || (CRYPTOPP_ARM_ASIMD_AVAILABLE) || \
+    defined(CRYPTOPP_DOXYGEN_PROCESSING)
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief AdvancedProcessBlocks for 1 and 6 blocks
+/// \tparam F1 function to process 1 128-bit block
+/// \tparam F6 function to process 6 128-bit blocks
+/// \tparam W word type of the subkey table
+/// \details AdvancedProcessBlocks128_6x1_NEON processes 6 and 2 NEON SIMD words
+///  at a time.
+/// \details The subkey type is usually word32 or word64. F1 and F6 must use the
+///  same word type.
+template <typename F1, typename F6, typename W>
+inline size_t AdvancedProcessBlocks128_6x1_NEON(F1 func1, F6 func6,
+            const W *subKeys, size_t rounds, const byte *inBlocks,
+            const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    CRYPTOPP_ASSERT(subKeys);
+    CRYPTOPP_ASSERT(inBlocks);
+    CRYPTOPP_ASSERT(outBlocks);
+    CRYPTOPP_ASSERT(length >= 16);
+
+    const unsigned int w_one[] = {0, 0<<24, 0, 1<<24};
+    const uint32x4_t s_one = vld1q_u32(w_one);
+
+    const size_t blockSize = 16;
+    // const size_t neonBlockSize = 16;
+
+    size_t inIncrement = (flags & (EnumToInt(BT_InBlockIsCounter)|EnumToInt(BT_DontIncrementInOutPointers))) ? 0 : blockSize;
+    size_t xorIncrement = (xorBlocks != NULLPTR) ? blockSize : 0;
+    size_t outIncrement = (flags & EnumToInt(BT_DontIncrementInOutPointers)) ? 0 : blockSize;
+
+    // Clang and Coverity are generating findings using xorBlocks as a flag.
+    const bool xorInput = (xorBlocks != NULLPTR) && (flags & EnumToInt(BT_XorInput));
+    const bool xorOutput = (xorBlocks != NULLPTR) && !(flags & EnumToInt(BT_XorInput));
+
+    if (flags & BT_ReverseDirection)
+    {
+        inBlocks = PtrAdd(inBlocks, length - blockSize);
+        xorBlocks = PtrAdd(xorBlocks, length - blockSize);
+        outBlocks = PtrAdd(outBlocks, length - blockSize);
+        inIncrement = 0-inIncrement;
+        xorIncrement = 0-xorIncrement;
+        outIncrement = 0-outIncrement;
+    }
+
+    if (flags & BT_AllowParallel)
+    {
+        while (length >= 6*blockSize)
+        {
+            uint64x2_t block0, block1, block2, block3, block4, block5;
+            if (flags & BT_InBlockIsCounter)
+            {
+                const uint64x2_t one = vreinterpretq_u64_u32(s_one);
+                block0 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                block1 = vaddq_u64(block0, one);
+                block2 = vaddq_u64(block1, one);
+                block3 = vaddq_u64(block2, one);
+                block4 = vaddq_u64(block3, one);
+                block5 = vaddq_u64(block4, one);
+                vst1q_u8(const_cast<byte*>(inBlocks),
+                    vreinterpretq_u8_u64(vaddq_u64(block5, one)));
+            }
+            else
+            {
+                block0 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block1 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block2 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block3 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block4 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block5 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+            }
+
+            if (xorInput)
+            {
+                block0 = veorq_u64(block0, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = veorq_u64(block1, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = veorq_u64(block2, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = veorq_u64(block3, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block4 = veorq_u64(block4, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block5 = veorq_u64(block5, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            func6(block0, block1, block2, block3, block4, block5, subKeys, static_cast<unsigned int>(rounds));
+
+            if (xorOutput)
+            {
+                block0 = veorq_u64(block0, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = veorq_u64(block1, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = veorq_u64(block2, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = veorq_u64(block3, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block4 = veorq_u64(block4, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block5 = veorq_u64(block5, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block0));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block1));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block2));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block3));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block4));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block5));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+
+            length -= 6*blockSize;
+        }
+    }
+
+    while (length >= blockSize)
+    {
+        uint64x2_t block;
+        block = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+
+        if (xorInput)
+            block = veorq_u64(block, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+
+        if (flags & BT_InBlockIsCounter)
+            const_cast<byte *>(inBlocks)[15]++;
+
+        func1(block, subKeys, static_cast<unsigned int>(rounds));
+
+        if (xorOutput)
+            block = veorq_u64(block, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+
+        vst1q_u8(outBlocks, vreinterpretq_u8_u64(block));
+
+        inBlocks = PtrAdd(inBlocks, inIncrement);
+        outBlocks = PtrAdd(outBlocks, outIncrement);
+        xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+        length -= blockSize;
+    }
+
+    return length;
+}
+
+/// \brief AdvancedProcessBlocks for 1 and 4 blocks
+/// \tparam F1 function to process 1 128-bit block
+/// \tparam F4 function to process 4 128-bit blocks
+/// \tparam W word type of the subkey table
+/// \details AdvancedProcessBlocks128_4x1_NEON processes 4 and 1 NEON SIMD words
+///  at a time.
+/// \details The subkey type is usually word32 or word64. V is the vector type and it is
+///  usually uint32x4_t or uint32x4_t. F1, F4, and W must use the same word and
+///  vector type.
+template <typename F1, typename F4, typename W>
+inline size_t AdvancedProcessBlocks128_4x1_NEON(F1 func1, F4 func4,
+            const W *subKeys, size_t rounds, const byte *inBlocks,
+            const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    CRYPTOPP_ASSERT(subKeys);
+    CRYPTOPP_ASSERT(inBlocks);
+    CRYPTOPP_ASSERT(outBlocks);
+    CRYPTOPP_ASSERT(length >= 16);
+
+    const unsigned int w_one[] = {0, 0<<24, 0, 1<<24};
+    const uint32x4_t s_one = vld1q_u32(w_one);
+
+    const size_t blockSize = 16;
+    // const size_t neonBlockSize = 16;
+
+    size_t inIncrement = (flags & (EnumToInt(BT_InBlockIsCounter)|EnumToInt(BT_DontIncrementInOutPointers))) ? 0 : blockSize;
+    size_t xorIncrement = (xorBlocks != NULLPTR) ? blockSize : 0;
+    size_t outIncrement = (flags & EnumToInt(BT_DontIncrementInOutPointers)) ? 0 : blockSize;
+
+    // Clang and Coverity are generating findings using xorBlocks as a flag.
+    const bool xorInput = (xorBlocks != NULLPTR) && (flags & EnumToInt(BT_XorInput));
+    const bool xorOutput = (xorBlocks != NULLPTR) && !(flags & EnumToInt(BT_XorInput));
+
+    if (flags & BT_ReverseDirection)
+    {
+        inBlocks = PtrAdd(inBlocks, length - blockSize);
+        xorBlocks = PtrAdd(xorBlocks, length - blockSize);
+        outBlocks = PtrAdd(outBlocks, length - blockSize);
+        inIncrement = 0-inIncrement;
+        xorIncrement = 0-xorIncrement;
+        outIncrement = 0-outIncrement;
+    }
+
+    if (flags & BT_AllowParallel)
+    {
+        while (length >= 4*blockSize)
+        {
+            uint32x4_t block0, block1, block2, block3;
+            if (flags & BT_InBlockIsCounter)
+            {
+                const uint32x4_t one = s_one;
+                block0 = vreinterpretq_u32_u8(vld1q_u8(inBlocks));
+                block1 = vreinterpretq_u32_u64(vaddq_u64(vreinterpretq_u64_u32(block0), vreinterpretq_u64_u32(one)));
+                block2 = vreinterpretq_u32_u64(vaddq_u64(vreinterpretq_u64_u32(block1), vreinterpretq_u64_u32(one)));
+                block3 = vreinterpretq_u32_u64(vaddq_u64(vreinterpretq_u64_u32(block2), vreinterpretq_u64_u32(one)));
+                vst1q_u8(const_cast<byte*>(inBlocks), vreinterpretq_u8_u64(vaddq_u64(
+                    vreinterpretq_u64_u32(block3), vreinterpretq_u64_u32(one))));
+            }
+            else
+            {
+                block0 = vreinterpretq_u32_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block1 = vreinterpretq_u32_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block2 = vreinterpretq_u32_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block3 = vreinterpretq_u32_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+            }
+
+            if (xorInput)
+            {
+                block0 = veorq_u32(block0, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = veorq_u32(block1, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = veorq_u32(block2, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = veorq_u32(block3, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            func4(block0, block1, block2, block3, subKeys, static_cast<unsigned int>(rounds));
+
+            if (xorOutput)
+            {
+                block0 = veorq_u32(block0, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = veorq_u32(block1, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = veorq_u32(block2, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = veorq_u32(block3, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            vst1q_u8(outBlocks, vreinterpretq_u8_u32(block0));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u32(block1));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u32(block2));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u32(block3));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+
+            length -= 4*blockSize;
+        }
+    }
+
+    while (length >= blockSize)
+    {
+        uint32x4_t block = vreinterpretq_u32_u8(vld1q_u8(inBlocks));
+
+        if (xorInput)
+            block = veorq_u32(block, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+
+        if (flags & BT_InBlockIsCounter)
+            const_cast<byte *>(inBlocks)[15]++;
+
+        func1(block, subKeys, static_cast<unsigned int>(rounds));
+
+        if (xorOutput)
+            block = veorq_u32(block, vreinterpretq_u32_u8(vld1q_u8(xorBlocks)));
+
+        vst1q_u8(outBlocks, vreinterpretq_u8_u32(block));
+
+        inBlocks = PtrAdd(inBlocks, inIncrement);
+        outBlocks = PtrAdd(outBlocks, outIncrement);
+        xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+        length -= blockSize;
+    }
+
+    return length;
+}
+
+/// \brief AdvancedProcessBlocks for 2 and 6 blocks
+/// \tparam F2 function to process 2 128-bit blocks
+/// \tparam F6 function to process 6 128-bit blocks
+/// \tparam W word type of the subkey table
+/// \details AdvancedProcessBlocks128_6x2_NEON processes 6 and 2 NEON SIMD words
+///  at a time. For a single block the template uses F2 with a zero block.
+/// \details The subkey type is usually word32 or word64. F2 and F6 must use the
+///  same word type.
+template <typename F2, typename F6, typename W>
+inline size_t AdvancedProcessBlocks128_6x2_NEON(F2 func2, F6 func6,
+            const W *subKeys, size_t rounds, const byte *inBlocks,
+            const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    CRYPTOPP_ASSERT(subKeys);
+    CRYPTOPP_ASSERT(inBlocks);
+    CRYPTOPP_ASSERT(outBlocks);
+    CRYPTOPP_ASSERT(length >= 16);
+
+    const unsigned int w_one[] = {0, 0<<24, 0, 1<<24};
+    const uint32x4_t s_one = vld1q_u32(w_one);
+
+    const size_t blockSize = 16;
+    // const size_t neonBlockSize = 16;
+
+    size_t inIncrement = (flags & (EnumToInt(BT_InBlockIsCounter)|EnumToInt(BT_DontIncrementInOutPointers))) ? 0 : blockSize;
+    size_t xorIncrement = (xorBlocks != NULLPTR) ? blockSize : 0;
+    size_t outIncrement = (flags & EnumToInt(BT_DontIncrementInOutPointers)) ? 0 : blockSize;
+
+    // Clang and Coverity are generating findings using xorBlocks as a flag.
+    const bool xorInput = (xorBlocks != NULLPTR) && (flags & EnumToInt(BT_XorInput));
+    const bool xorOutput = (xorBlocks != NULLPTR) && !(flags & EnumToInt(BT_XorInput));
+
+    if (flags & BT_ReverseDirection)
+    {
+        inBlocks = PtrAdd(inBlocks, length - blockSize);
+        xorBlocks = PtrAdd(xorBlocks, length - blockSize);
+        outBlocks = PtrAdd(outBlocks, length - blockSize);
+        inIncrement = 0-inIncrement;
+        xorIncrement = 0-xorIncrement;
+        outIncrement = 0-outIncrement;
+    }
+
+    if (flags & BT_AllowParallel)
+    {
+        while (length >= 6*blockSize)
+        {
+            uint64x2_t block0, block1, block2, block3, block4, block5;
+            if (flags & BT_InBlockIsCounter)
+            {
+                const uint64x2_t one = vreinterpretq_u64_u32(s_one);
+                block0 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                block1 = vaddq_u64(block0, one);
+                block2 = vaddq_u64(block1, one);
+                block3 = vaddq_u64(block2, one);
+                block4 = vaddq_u64(block3, one);
+                block5 = vaddq_u64(block4, one);
+                vst1q_u8(const_cast<byte*>(inBlocks),
+                    vreinterpretq_u8_u64(vaddq_u64(block5, one)));
+            }
+            else
+            {
+                block0 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block1 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block2 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block3 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block4 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block5 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+            }
+
+            if (xorInput)
+            {
+                block0 = veorq_u64(block0, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = veorq_u64(block1, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = veorq_u64(block2, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = veorq_u64(block3, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block4 = veorq_u64(block4, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block5 = veorq_u64(block5, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            func6(block0, block1, block2, block3, block4, block5, subKeys, static_cast<unsigned int>(rounds));
+
+            if (xorOutput)
+            {
+                block0 = veorq_u64(block0, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = veorq_u64(block1, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = veorq_u64(block2, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = veorq_u64(block3, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block4 = veorq_u64(block4, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block5 = veorq_u64(block5, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block0));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block1));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block2));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block3));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block4));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block5));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+
+            length -= 6*blockSize;
+        }
+
+        while (length >= 2*blockSize)
+        {
+            uint64x2_t block0, block1;
+            if (flags & BT_InBlockIsCounter)
+            {
+                const uint64x2_t one = vreinterpretq_u64_u32(s_one);
+                block0 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                block1 = vaddq_u64(block0, one);
+                vst1q_u8(const_cast<byte*>(inBlocks),
+                    vreinterpretq_u8_u64(vaddq_u64(block1, one)));
+            }
+            else
+            {
+                block0 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block1 = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+            }
+
+            if (xorInput)
+            {
+                block0 = veorq_u64(block0, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = veorq_u64(block1, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            func2(block0, block1, subKeys, static_cast<unsigned int>(rounds));
+
+            if (xorOutput)
+            {
+                block0 = veorq_u64(block0, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = veorq_u64(block1, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block0));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            vst1q_u8(outBlocks, vreinterpretq_u8_u64(block1));
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+
+            length -= 2*blockSize;
+        }
+    }
+
+    while (length >= blockSize)
+    {
+        uint64x2_t block, zero = {0,0};
+        block = vreinterpretq_u64_u8(vld1q_u8(inBlocks));
+
+        if (xorInput)
+            block = veorq_u64(block, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+
+        if (flags & BT_InBlockIsCounter)
+            const_cast<byte *>(inBlocks)[15]++;
+
+        func2(block, zero, subKeys, static_cast<unsigned int>(rounds));
+
+        if (xorOutput)
+            block = veorq_u64(block, vreinterpretq_u64_u8(vld1q_u8(xorBlocks)));
+
+        vst1q_u8(outBlocks, vreinterpretq_u8_u64(block));
+
+        inBlocks = PtrAdd(inBlocks, inIncrement);
+        outBlocks = PtrAdd(outBlocks, outIncrement);
+        xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+        length -= blockSize;
+    }
+
+    return length;
+}
+
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+// *************************** Intel SSE ************************** //
+
+#if defined(CRYPTOPP_SSSE3_AVAILABLE) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief SunCC workaround
+/// \details SunCC loses the const on AES_Enc_Block and AES_Dec_Block
+/// \sa <A HREF="http://github.com/weidai11/cryptopp/issues/224">Issue
+///  224, SunCC and failed compile for rijndael.cpp</A>
+# define MAYBE_CONST const
+/// \brief SunCC workaround
+/// \details SunCC loses the const on AES_Enc_Block and AES_Dec_Block
+/// \sa <A HREF="http://github.com/weidai11/cryptopp/issues/224">Issue
+///  224, SunCC and failed compile for rijndael.cpp</A>
+# define MAYBE_UNCONST_CAST(T, x) (x)
+#elif (__SUNPRO_CC >= 0x5130)
+# define MAYBE_CONST
+# define MAYBE_UNCONST_CAST(T, x) const_cast<MAYBE_CONST T>(x)
+#else
+# define MAYBE_CONST const
+# define MAYBE_UNCONST_CAST(T, x) (x)
+#endif
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Clang workaround
+/// \details Clang issues spurious alignment warnings
+/// \sa <A HREF="http://bugs.llvm.org/show_bug.cgi?id=20670">Issue
+///  20670, _mm_loadu_si128 parameter has wrong type</A>
+# define M128_CAST(x) ((__m128i *)(void *)(x))
+/// \brief Clang workaround
+/// \details Clang issues spurious alignment warnings
+/// \sa <A HREF="http://bugs.llvm.org/show_bug.cgi?id=20670">Issue
+///  20670, _mm_loadu_si128 parameter has wrong type</A>
+# define CONST_M128_CAST(x) ((const __m128i *)(const void *)(x))
+#else
+# ifndef M128_CAST
+#  define M128_CAST(x) ((__m128i *)(void *)(x))
+# endif
+# ifndef CONST_M128_CAST
+#  define CONST_M128_CAST(x) ((const __m128i *)(const void *)(x))
+# endif
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief AdvancedProcessBlocks for 2 and 6 blocks
+/// \tparam F2 function to process 2 128-bit blocks
+/// \tparam F6 function to process 6 128-bit blocks
+/// \tparam W word type of the subkey table
+/// \details AdvancedProcessBlocks128_6x2_SSE processes 6 and 2 SSE SIMD words
+///  at a time. For a single block the template uses F2 with a zero block.
+/// \details The subkey type is usually word32 or word64. F2 and F6 must use the
+///  same word type.
+template <typename F2, typename F6, typename W>
+inline size_t AdvancedProcessBlocks128_6x2_SSE(F2 func2, F6 func6,
+        MAYBE_CONST W *subKeys, size_t rounds, const byte *inBlocks,
+        const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    CRYPTOPP_ASSERT(subKeys);
+    CRYPTOPP_ASSERT(inBlocks);
+    CRYPTOPP_ASSERT(outBlocks);
+    CRYPTOPP_ASSERT(length >= 16);
+
+    const size_t blockSize = 16;
+    // const size_t xmmBlockSize = 16;
+
+    size_t inIncrement = (flags & (EnumToInt(BT_InBlockIsCounter)|EnumToInt(BT_DontIncrementInOutPointers))) ? 0 : blockSize;
+    size_t xorIncrement = (xorBlocks != NULLPTR) ? blockSize : 0;
+    size_t outIncrement = (flags & EnumToInt(BT_DontIncrementInOutPointers)) ? 0 : blockSize;
+
+    // Clang and Coverity are generating findings using xorBlocks as a flag.
+    const bool xorInput = (xorBlocks != NULLPTR) && (flags & EnumToInt(BT_XorInput));
+    const bool xorOutput = (xorBlocks != NULLPTR) && !(flags & EnumToInt(BT_XorInput));
+
+    if (flags & BT_ReverseDirection)
+    {
+        inBlocks = PtrAdd(inBlocks, length - blockSize);
+        xorBlocks = PtrAdd(xorBlocks, length - blockSize);
+        outBlocks = PtrAdd(outBlocks, length - blockSize);
+        inIncrement = 0-inIncrement;
+        xorIncrement = 0-xorIncrement;
+        outIncrement = 0-outIncrement;
+    }
+
+    if (flags & BT_AllowParallel)
+    {
+        while (length >= 6*blockSize)
+        {
+            __m128i block0, block1, block2, block3, block4, block5;
+            if (flags & BT_InBlockIsCounter)
+            {
+                // Increment of 1 in big-endian compatible with the ctr byte array.
+                const __m128i s_one = _mm_set_epi32(1<<24, 0, 0, 0);
+                block0 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                block1 = _mm_add_epi32(block0, s_one);
+                block2 = _mm_add_epi32(block1, s_one);
+                block3 = _mm_add_epi32(block2, s_one);
+                block4 = _mm_add_epi32(block3, s_one);
+                block5 = _mm_add_epi32(block4, s_one);
+                _mm_storeu_si128(M128_CAST(inBlocks), _mm_add_epi32(block5, s_one));
+            }
+            else
+            {
+                block0 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block1 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block2 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block3 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block4 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block5 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+            }
+
+            if (xorInput)
+            {
+                block0 = _mm_xor_si128(block0, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = _mm_xor_si128(block1, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = _mm_xor_si128(block2, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = _mm_xor_si128(block3, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block4 = _mm_xor_si128(block4, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block5 = _mm_xor_si128(block5, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            func6(block0, block1, block2, block3, block4, block5, subKeys, static_cast<unsigned int>(rounds));
+
+            if (xorOutput)
+            {
+                block0 = _mm_xor_si128(block0, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = _mm_xor_si128(block1, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = _mm_xor_si128(block2, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = _mm_xor_si128(block3, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block4 = _mm_xor_si128(block4, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block5 = _mm_xor_si128(block5, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            _mm_storeu_si128(M128_CAST(outBlocks), block0);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            _mm_storeu_si128(M128_CAST(outBlocks), block1);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            _mm_storeu_si128(M128_CAST(outBlocks), block2);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            _mm_storeu_si128(M128_CAST(outBlocks), block3);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            _mm_storeu_si128(M128_CAST(outBlocks), block4);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            _mm_storeu_si128(M128_CAST(outBlocks), block5);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+
+            length -= 6*blockSize;
+        }
+
+        while (length >= 2*blockSize)
+        {
+            __m128i block0, block1;
+            if (flags & BT_InBlockIsCounter)
+            {
+                // Increment of 1 in big-endian compatible with the ctr byte array.
+                const __m128i s_one = _mm_set_epi32(1<<24, 0, 0, 0);
+                block0 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                block1 = _mm_add_epi32(block0, s_one);
+                _mm_storeu_si128(M128_CAST(inBlocks), _mm_add_epi32(block1, s_one));
+            }
+            else
+            {
+                block0 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block1 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+            }
+
+            if (xorInput)
+            {
+                block0 = _mm_xor_si128(block0, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = _mm_xor_si128(block1, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            func2(block0, block1, subKeys, static_cast<unsigned int>(rounds));
+
+            if (xorOutput)
+            {
+                block0 = _mm_xor_si128(block0, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = _mm_xor_si128(block1, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            _mm_storeu_si128(M128_CAST(outBlocks), block0);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            _mm_storeu_si128(M128_CAST(outBlocks), block1);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+
+            length -= 2*blockSize;
+        }
+    }
+
+    while (length >= blockSize)
+    {
+        __m128i block, zero = _mm_setzero_si128();
+        block = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+
+        if (xorInput)
+            block = _mm_xor_si128(block, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+
+        if (flags & BT_InBlockIsCounter)
+            const_cast<byte *>(inBlocks)[15]++;
+
+        func2(block, zero, subKeys, static_cast<unsigned int>(rounds));
+
+        if (xorOutput)
+            block = _mm_xor_si128(block, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+
+        _mm_storeu_si128(M128_CAST(outBlocks), block);
+
+        inBlocks = PtrAdd(inBlocks, inIncrement);
+        outBlocks = PtrAdd(outBlocks, outIncrement);
+        xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+        length -= blockSize;
+    }
+
+    return length;
+}
+
+/// \brief AdvancedProcessBlocks for 1 and 4 blocks
+/// \tparam F1 function to process 1 128-bit block
+/// \tparam F4 function to process 4 128-bit blocks
+/// \tparam W word type of the subkey table
+/// \details AdvancedProcessBlocks128_4x1_SSE processes 4 and 1 SSE SIMD words
+///  at a time.
+/// \details The subkey type is usually word32 or word64. F1 and F4 must use the
+///  same word type.
+template <typename F1, typename F4, typename W>
+inline size_t AdvancedProcessBlocks128_4x1_SSE(F1 func1, F4 func4,
+        MAYBE_CONST W *subKeys, size_t rounds, const byte *inBlocks,
+        const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    CRYPTOPP_ASSERT(subKeys);
+    CRYPTOPP_ASSERT(inBlocks);
+    CRYPTOPP_ASSERT(outBlocks);
+    CRYPTOPP_ASSERT(length >= 16);
+
+    const size_t blockSize = 16;
+    // const size_t xmmBlockSize = 16;
+
+    size_t inIncrement = (flags & (EnumToInt(BT_InBlockIsCounter)|EnumToInt(BT_DontIncrementInOutPointers))) ? 0 : blockSize;
+    size_t xorIncrement = (xorBlocks != NULLPTR) ? blockSize : 0;
+    size_t outIncrement = (flags & EnumToInt(BT_DontIncrementInOutPointers)) ? 0 : blockSize;
+
+    // Clang and Coverity are generating findings using xorBlocks as a flag.
+    const bool xorInput = (xorBlocks != NULLPTR) && (flags & EnumToInt(BT_XorInput));
+    const bool xorOutput = (xorBlocks != NULLPTR) && !(flags & EnumToInt(BT_XorInput));
+
+    if (flags & BT_ReverseDirection)
+    {
+        inBlocks = PtrAdd(inBlocks, length - blockSize);
+        xorBlocks = PtrAdd(xorBlocks, length - blockSize);
+        outBlocks = PtrAdd(outBlocks, length - blockSize);
+        inIncrement = 0-inIncrement;
+        xorIncrement = 0-xorIncrement;
+        outIncrement = 0-outIncrement;
+    }
+
+    if (flags & BT_AllowParallel)
+    {
+        while (length >= 4*blockSize)
+        {
+            __m128i block0, block1, block2, block3;
+            if (flags & BT_InBlockIsCounter)
+            {
+                // Increment of 1 in big-endian compatible with the ctr byte array.
+                const __m128i s_one = _mm_set_epi32(1<<24, 0, 0, 0);
+                block0 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                block1 = _mm_add_epi32(block0, s_one);
+                block2 = _mm_add_epi32(block1, s_one);
+                block3 = _mm_add_epi32(block2, s_one);
+                _mm_storeu_si128(M128_CAST(inBlocks), _mm_add_epi32(block3, s_one));
+            }
+            else
+            {
+                block0 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block1 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block2 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block3 = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+            }
+
+            if (xorInput)
+            {
+                block0 = _mm_xor_si128(block0, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = _mm_xor_si128(block1, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = _mm_xor_si128(block2, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = _mm_xor_si128(block3, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            func4(block0, block1, block2, block3, subKeys, static_cast<unsigned int>(rounds));
+
+            if (xorOutput)
+            {
+                block0 = _mm_xor_si128(block0, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = _mm_xor_si128(block1, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = _mm_xor_si128(block2, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = _mm_xor_si128(block3, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            _mm_storeu_si128(M128_CAST(outBlocks), block0);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            _mm_storeu_si128(M128_CAST(outBlocks), block1);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            _mm_storeu_si128(M128_CAST(outBlocks), block2);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            _mm_storeu_si128(M128_CAST(outBlocks), block3);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+
+            length -= 4*blockSize;
+        }
+    }
+
+    while (length >= blockSize)
+    {
+        __m128i block = _mm_loadu_si128(CONST_M128_CAST(inBlocks));
+
+        if (xorInput)
+            block = _mm_xor_si128(block, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+
+        if (flags & BT_InBlockIsCounter)
+            const_cast<byte *>(inBlocks)[15]++;
+
+        func1(block, subKeys, static_cast<unsigned int>(rounds));
+
+        if (xorOutput)
+            block = _mm_xor_si128(block, _mm_loadu_si128(CONST_M128_CAST(xorBlocks)));
+
+        _mm_storeu_si128(M128_CAST(outBlocks), block);
+
+        inBlocks = PtrAdd(inBlocks, inIncrement);
+        outBlocks = PtrAdd(outBlocks, outIncrement);
+        xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+        length -= blockSize;
+    }
+
+    return length;
+}
+
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
+
+// ************************** Altivec/Power 4 ************************** //
+
+#if defined(__ALTIVEC__) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief AdvancedProcessBlocks for 1 and 4 blocks
+/// \tparam F1 function to process 1 128-bit block
+/// \tparam F4 function to process 4 128-bit blocks
+/// \tparam W word type of the subkey table
+/// \details AdvancedProcessBlocks128_4x1_ALTIVEC processes 4 and 1 Altivec SIMD words
+///  at a time.
+/// \details The subkey type is usually word32 or word64. F1 and F4 must use the
+///  same word type.
+template <typename F1, typename F4, typename W>
+inline size_t AdvancedProcessBlocks128_4x1_ALTIVEC(F1 func1, F4 func4,
+        const W *subKeys, size_t rounds, const byte *inBlocks,
+        const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    CRYPTOPP_ASSERT(subKeys);
+    CRYPTOPP_ASSERT(inBlocks);
+    CRYPTOPP_ASSERT(outBlocks);
+    CRYPTOPP_ASSERT(length >= 16);
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+    const uint32x4_p s_one  = {1,0,0,0};
+#else
+    const uint32x4_p s_one = {0,0,0,1};
+#endif
+
+    const size_t blockSize = 16;
+    // const size_t simdBlockSize = 16;
+
+    size_t inIncrement = (flags & (EnumToInt(BT_InBlockIsCounter)|EnumToInt(BT_DontIncrementInOutPointers))) ? 0 : blockSize;
+    size_t xorIncrement = (xorBlocks != NULLPTR) ? blockSize : 0;
+    size_t outIncrement = (flags & EnumToInt(BT_DontIncrementInOutPointers)) ? 0 : blockSize;
+
+    // Clang and Coverity are generating findings using xorBlocks as a flag.
+    const bool xorInput = (xorBlocks != NULLPTR) && (flags & EnumToInt(BT_XorInput));
+    const bool xorOutput = (xorBlocks != NULLPTR) && !(flags & EnumToInt(BT_XorInput));
+
+    if (flags & BT_ReverseDirection)
+    {
+        inBlocks = PtrAdd(inBlocks, length - blockSize);
+        xorBlocks = PtrAdd(xorBlocks, length - blockSize);
+        outBlocks = PtrAdd(outBlocks, length - blockSize);
+        inIncrement = 0-inIncrement;
+        xorIncrement = 0-xorIncrement;
+        outIncrement = 0-outIncrement;
+    }
+
+    if (flags & BT_AllowParallel)
+    {
+        while (length >= 4*blockSize)
+        {
+            uint32x4_p block0, block1, block2, block3;
+
+            if (flags & BT_InBlockIsCounter)
+            {
+                block0 = VecLoadBE(inBlocks);
+                block1 = VecAdd(block0, s_one);
+                block2 = VecAdd(block1, s_one);
+                block3 = VecAdd(block2, s_one);
+
+                // Hack due to big-endian loads used by POWER8 (and maybe ARM-BE).
+                // CTR_ModePolicy::OperateKeystream is wired such that after
+                // returning from this function CTR_ModePolicy will detect wrap on
+                // on the last counter byte and increment the next to last byte.
+                // The problem is, with a big-endian load, inBlocks[15] is really
+                // located at index 15. The vector addition using a 32-bit element
+                // generates a carry into inBlocks[14] and then CTR_ModePolicy
+                // increments inBlocks[14] too.
+                const_cast<byte*>(inBlocks)[15] += 6;
+            }
+            else
+            {
+                block0 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block1 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block2 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block3 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+            }
+
+            if (xorInput)
+            {
+                block0 = VecXor(block0, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = VecXor(block1, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = VecXor(block2, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = VecXor(block3, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            func4(block0, block1, block2, block3, subKeys, rounds);
+
+            if (xorOutput)
+            {
+                block0 = VecXor(block0, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = VecXor(block1, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = VecXor(block2, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = VecXor(block3, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            VecStoreBE(block0, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            VecStoreBE(block1, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            VecStoreBE(block2, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            VecStoreBE(block3, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+
+            length -= 4*blockSize;
+        }
+    }
+
+    while (length >= blockSize)
+    {
+        uint32x4_p block = VecLoadBE(inBlocks);
+
+        if (xorInput)
+            block = VecXor(block, VecLoadBE(xorBlocks));
+
+        if (flags & BT_InBlockIsCounter)
+            const_cast<byte *>(inBlocks)[15]++;
+
+        func1(block, subKeys, rounds);
+
+        if (xorOutput)
+            block = VecXor(block, VecLoadBE(xorBlocks));
+
+        VecStoreBE(block, outBlocks);
+
+        inBlocks = PtrAdd(inBlocks, inIncrement);
+        outBlocks = PtrAdd(outBlocks, outIncrement);
+        xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+        length -= blockSize;
+    }
+
+    return length;
+}
+
+/// \brief AdvancedProcessBlocks for 1 and 6 blocks
+/// \tparam F1 function to process 1 128-bit block
+/// \tparam F6 function to process 6 128-bit blocks
+/// \tparam W word type of the subkey table
+/// \details AdvancedProcessBlocks128_6x1_ALTIVEC processes 6 and 1 Altivec SIMD words
+///  at a time.
+/// \details The subkey type is usually word32 or word64. F1 and F6 must use the
+///  same word type.
+template <typename F1, typename F6, typename W>
+inline size_t AdvancedProcessBlocks128_6x1_ALTIVEC(F1 func1, F6 func6,
+        const W *subKeys, size_t rounds, const byte *inBlocks,
+        const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    CRYPTOPP_ASSERT(subKeys);
+    CRYPTOPP_ASSERT(inBlocks);
+    CRYPTOPP_ASSERT(outBlocks);
+    CRYPTOPP_ASSERT(length >= 16);
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+    const uint32x4_p s_one  = {1,0,0,0};
+#else
+    const uint32x4_p s_one = {0,0,0,1};
+#endif
+
+    const size_t blockSize = 16;
+    // const size_t simdBlockSize = 16;
+
+    size_t inIncrement = (flags & (EnumToInt(BT_InBlockIsCounter)|EnumToInt(BT_DontIncrementInOutPointers))) ? 0 : blockSize;
+    size_t xorIncrement = (xorBlocks != NULLPTR) ? blockSize : 0;
+    size_t outIncrement = (flags & EnumToInt(BT_DontIncrementInOutPointers)) ? 0 : blockSize;
+
+    // Clang and Coverity are generating findings using xorBlocks as a flag.
+    const bool xorInput = (xorBlocks != NULLPTR) && (flags & EnumToInt(BT_XorInput));
+    const bool xorOutput = (xorBlocks != NULLPTR) && !(flags & EnumToInt(BT_XorInput));
+
+    if (flags & BT_ReverseDirection)
+    {
+        inBlocks = PtrAdd(inBlocks, length - blockSize);
+        xorBlocks = PtrAdd(xorBlocks, length - blockSize);
+        outBlocks = PtrAdd(outBlocks, length - blockSize);
+        inIncrement = 0-inIncrement;
+        xorIncrement = 0-xorIncrement;
+        outIncrement = 0-outIncrement;
+    }
+
+    if (flags & BT_AllowParallel)
+    {
+        while (length >= 6*blockSize)
+        {
+            uint32x4_p block0, block1, block2, block3, block4, block5;
+
+            if (flags & BT_InBlockIsCounter)
+            {
+                block0 = VecLoadBE(inBlocks);
+                block1 = VecAdd(block0, s_one);
+                block2 = VecAdd(block1, s_one);
+                block3 = VecAdd(block2, s_one);
+                block4 = VecAdd(block3, s_one);
+                block5 = VecAdd(block4, s_one);
+
+                // Hack due to big-endian loads used by POWER8 (and maybe ARM-BE).
+                // CTR_ModePolicy::OperateKeystream is wired such that after
+                // returning from this function CTR_ModePolicy will detect wrap on
+                // on the last counter byte and increment the next to last byte.
+                // The problem is, with a big-endian load, inBlocks[15] is really
+                // located at index 15. The vector addition using a 32-bit element
+                // generates a carry into inBlocks[14] and then CTR_ModePolicy
+                // increments inBlocks[14] too.
+                //
+                // To find this bug we needed a test case with a ctr of 0xNN...FA.
+                // The last octet is 0xFA and adding 6 creates the wrap to trigger
+                // the issue. If the last octet was 0xFC then 4 would trigger it.
+                // We dumb-lucked into the test with SPECK-128. The test case of
+                // interest is the one with IV 348ECA9766C09F04 826520DE47A212FA.
+                uint8x16_p temp = VecAdd((uint8x16_p)block5, (uint8x16_p)s_one);
+                VecStoreBE(temp, const_cast<byte*>(inBlocks));
+            }
+            else
+            {
+                block0 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block1 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block2 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block3 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block4 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+                block5 = VecLoadBE(inBlocks);
+                inBlocks = PtrAdd(inBlocks, inIncrement);
+            }
+
+            if (xorInput)
+            {
+                block0 = VecXor(block0, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = VecXor(block1, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = VecXor(block2, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = VecXor(block3, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block4 = VecXor(block4, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block5 = VecXor(block5, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            func6(block0, block1, block2, block3, block4, block5, subKeys, rounds);
+
+            if (xorOutput)
+            {
+                block0 = VecXor(block0, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block1 = VecXor(block1, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block2 = VecXor(block2, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block3 = VecXor(block3, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block4 = VecXor(block4, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+                block5 = VecXor(block5, VecLoadBE(xorBlocks));
+                xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+            }
+
+            VecStoreBE(block0, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            VecStoreBE(block1, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            VecStoreBE(block2, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            VecStoreBE(block3, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            VecStoreBE(block4, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+            VecStoreBE(block5, outBlocks);
+            outBlocks = PtrAdd(outBlocks, outIncrement);
+
+            length -= 6*blockSize;
+        }
+    }
+
+    while (length >= blockSize)
+    {
+        uint32x4_p block = VecLoadBE(inBlocks);
+
+        if (xorInput)
+            block = VecXor(block, VecLoadBE(xorBlocks));
+
+        if (flags & BT_InBlockIsCounter)
+            const_cast<byte *>(inBlocks)[15]++;
+
+        func1(block, subKeys, rounds);
+
+        if (xorOutput)
+            block = VecXor(block, VecLoadBE(xorBlocks));
+
+        VecStoreBE(block, outBlocks);
+
+        inBlocks = PtrAdd(inBlocks, inIncrement);
+        outBlocks = PtrAdd(outBlocks, outIncrement);
+        xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+        length -= blockSize;
+    }
+
+    return length;
+}
+
+NAMESPACE_END  // CryptoPP
+
+#endif  // __ALTIVEC__
+
+#endif  // CRYPTOPP_ADVANCED_SIMD_TEMPLATES
diff --git a/runtime/third_party/cryptopp/aes.h b/runtime/third_party/cryptopp/aes.h
new file mode 100644
index 0000000..bcc5cf7
--- /dev/null
+++ b/runtime/third_party/cryptopp/aes.h
@@ -0,0 +1,30 @@
+// aes.h - originally written and placed in the public domain by Wei Dai
+
+/// \file
+/// \brief Class file for the AES cipher (Rijndael)
+/// \details AES is a typdef for Rijndael classes. All key sizes are supported.
+///   The library only provides Rijndael with 128-bit blocks, and not 192-bit or 256-bit blocks
+/// \since Rijndael since Crypto++ 3.1, Intel AES-NI since Crypto++ 5.6.1, ARMv8 AES since Crypto++ 6.0,
+///   Power8 AES since Crypto++ 6.0
+
+#ifndef CRYPTOPP_AES_H
+#define CRYPTOPP_AES_H
+
+#include "rijndael.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief AES block cipher (Rijndael)
+/// \details AES is a typdef for Rijndael classes. All key sizes are supported.
+///   The library only provides Rijndael with 128-bit blocks, and not 192-bit or 256-bit blocks
+/// \sa <a href="http://www.cryptolounge.org/wiki/AES">AES</a> winner, announced on 10/2/2000
+/// \since Rijndael since Crypto++ 3.1, Intel AES-NI since Crypto++ 5.6.1, ARMv8 AES since Crypto++ 6.0,
+///   Power8 AES since Crypto++ 6.0
+DOCUMENTED_TYPEDEF(Rijndael, AES);
+
+typedef RijndaelEncryption AESEncryption;
+typedef RijndaelDecryption AESDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/aes_armv4.S b/runtime/third_party/cryptopp/aes_armv4.S
new file mode 100644
index 0000000..6651a70
--- /dev/null
+++ b/runtime/third_party/cryptopp/aes_armv4.S
@@ -0,0 +1,1215 @@
+@ Copyright 2007-2018 The OpenSSL Project Authors. All Rights Reserved.
+@
+@ ====================================================================
+@ Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
+@ project. The module is, however, dual licensed under OpenSSL and
+@ CRYPTOGAMS licenses depending on where you obtain it. For further
+@ details see http://www.openssl.org/~appro/cryptogams/.
+@ ====================================================================
+
+@ JW, JUL 2018: Begin defines from taken from arm_arch.h
+@               The defines were included through the header.
+
+# if !defined(__ARM_ARCH__)
+#  if defined(__CC_ARM)
+#   define __ARM_ARCH__ __TARGET_ARCH_ARM
+#   if defined(__BIG_ENDIAN)
+#    define __ARMEB__
+#   else
+#    define __ARMEL__
+#   endif
+#  elif defined(__GNUC__)
+#   if   defined(__aarch64__)
+#    define __ARM_ARCH__ 8
+#    if __BYTE_ORDER__==__ORDER_BIG_ENDIAN__
+#     define __ARMEB__
+#    else
+#     define __ARMEL__
+#    endif
+
+#   elif defined(__ARM_ARCH)
+#    define __ARM_ARCH__ __ARM_ARCH
+#   elif defined(__ARM_ARCH_8A__)
+#    define __ARM_ARCH__ 8
+#   elif defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__)     || \
+        defined(__ARM_ARCH_7R__)|| defined(__ARM_ARCH_7M__)     || \
+        defined(__ARM_ARCH_7EM__)
+#    define __ARM_ARCH__ 7
+#   elif defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__)     || \
+        defined(__ARM_ARCH_6K__)|| defined(__ARM_ARCH_6M__)     || \
+        defined(__ARM_ARCH_6Z__)|| defined(__ARM_ARCH_6ZK__)    || \
+        defined(__ARM_ARCH_6T2__)
+#    define __ARM_ARCH__ 6
+#   elif defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__)     || \
+        defined(__ARM_ARCH_5E__)|| defined(__ARM_ARCH_5TE__)    || \
+        defined(__ARM_ARCH_5TEJ__)
+#    define __ARM_ARCH__ 5
+#   elif defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__)
+#    define __ARM_ARCH__ 4
+#   else
+#    error "unsupported ARM architecture"
+#   endif
+#  endif
+# endif
+
+# if !defined(__ARM_MAX_ARCH__)
+#  define __ARM_MAX_ARCH__ __ARM_ARCH__
+# endif
+
+# if __ARM_MAX_ARCH__<__ARM_ARCH__
+#  error "__ARM_MAX_ARCH__ can't be less than __ARM_ARCH__"
+# elif __ARM_MAX_ARCH__!=__ARM_ARCH__
+#  if __ARM_ARCH__<7 && __ARM_MAX_ARCH__>=7 && defined(__ARMEB__)
+#   error "can't build universal big-endian binary"
+#  endif
+# endif
+
+@ JW, JUL 2018: End defines from taken from arm_arch.h
+@               Back to original Cryptogams code
+
+#if defined(__thumb2__) && !defined(__APPLE__)
+.syntax	unified
+.thumb
+#else
+.code	32
+#undef __thumb2__
+#endif
+
+.text
+
+.type	AES_Te,%object
+.align	5
+AES_Te:
+.word	0xc66363a5, 0xf87c7c84, 0xee777799, 0xf67b7b8d
+.word	0xfff2f20d, 0xd66b6bbd, 0xde6f6fb1, 0x91c5c554
+.word	0x60303050, 0x02010103, 0xce6767a9, 0x562b2b7d
+.word	0xe7fefe19, 0xb5d7d762, 0x4dababe6, 0xec76769a
+.word	0x8fcaca45, 0x1f82829d, 0x89c9c940, 0xfa7d7d87
+.word	0xeffafa15, 0xb25959eb, 0x8e4747c9, 0xfbf0f00b
+.word	0x41adadec, 0xb3d4d467, 0x5fa2a2fd, 0x45afafea
+.word	0x239c9cbf, 0x53a4a4f7, 0xe4727296, 0x9bc0c05b
+.word	0x75b7b7c2, 0xe1fdfd1c, 0x3d9393ae, 0x4c26266a
+.word	0x6c36365a, 0x7e3f3f41, 0xf5f7f702, 0x83cccc4f
+.word	0x6834345c, 0x51a5a5f4, 0xd1e5e534, 0xf9f1f108
+.word	0xe2717193, 0xabd8d873, 0x62313153, 0x2a15153f
+.word	0x0804040c, 0x95c7c752, 0x46232365, 0x9dc3c35e
+.word	0x30181828, 0x379696a1, 0x0a05050f, 0x2f9a9ab5
+.word	0x0e070709, 0x24121236, 0x1b80809b, 0xdfe2e23d
+.word	0xcdebeb26, 0x4e272769, 0x7fb2b2cd, 0xea75759f
+.word	0x1209091b, 0x1d83839e, 0x582c2c74, 0x341a1a2e
+.word	0x361b1b2d, 0xdc6e6eb2, 0xb45a5aee, 0x5ba0a0fb
+.word	0xa45252f6, 0x763b3b4d, 0xb7d6d661, 0x7db3b3ce
+.word	0x5229297b, 0xdde3e33e, 0x5e2f2f71, 0x13848497
+.word	0xa65353f5, 0xb9d1d168, 0x00000000, 0xc1eded2c
+.word	0x40202060, 0xe3fcfc1f, 0x79b1b1c8, 0xb65b5bed
+.word	0xd46a6abe, 0x8dcbcb46, 0x67bebed9, 0x7239394b
+.word	0x944a4ade, 0x984c4cd4, 0xb05858e8, 0x85cfcf4a
+.word	0xbbd0d06b, 0xc5efef2a, 0x4faaaae5, 0xedfbfb16
+.word	0x864343c5, 0x9a4d4dd7, 0x66333355, 0x11858594
+.word	0x8a4545cf, 0xe9f9f910, 0x04020206, 0xfe7f7f81
+.word	0xa05050f0, 0x783c3c44, 0x259f9fba, 0x4ba8a8e3
+.word	0xa25151f3, 0x5da3a3fe, 0x804040c0, 0x058f8f8a
+.word	0x3f9292ad, 0x219d9dbc, 0x70383848, 0xf1f5f504
+.word	0x63bcbcdf, 0x77b6b6c1, 0xafdada75, 0x42212163
+.word	0x20101030, 0xe5ffff1a, 0xfdf3f30e, 0xbfd2d26d
+.word	0x81cdcd4c, 0x180c0c14, 0x26131335, 0xc3ecec2f
+.word	0xbe5f5fe1, 0x359797a2, 0x884444cc, 0x2e171739
+.word	0x93c4c457, 0x55a7a7f2, 0xfc7e7e82, 0x7a3d3d47
+.word	0xc86464ac, 0xba5d5de7, 0x3219192b, 0xe6737395
+.word	0xc06060a0, 0x19818198, 0x9e4f4fd1, 0xa3dcdc7f
+.word	0x44222266, 0x542a2a7e, 0x3b9090ab, 0x0b888883
+.word	0x8c4646ca, 0xc7eeee29, 0x6bb8b8d3, 0x2814143c
+.word	0xa7dede79, 0xbc5e5ee2, 0x160b0b1d, 0xaddbdb76
+.word	0xdbe0e03b, 0x64323256, 0x743a3a4e, 0x140a0a1e
+.word	0x924949db, 0x0c06060a, 0x4824246c, 0xb85c5ce4
+.word	0x9fc2c25d, 0xbdd3d36e, 0x43acacef, 0xc46262a6
+.word	0x399191a8, 0x319595a4, 0xd3e4e437, 0xf279798b
+.word	0xd5e7e732, 0x8bc8c843, 0x6e373759, 0xda6d6db7
+.word	0x018d8d8c, 0xb1d5d564, 0x9c4e4ed2, 0x49a9a9e0
+.word	0xd86c6cb4, 0xac5656fa, 0xf3f4f407, 0xcfeaea25
+.word	0xca6565af, 0xf47a7a8e, 0x47aeaee9, 0x10080818
+.word	0x6fbabad5, 0xf0787888, 0x4a25256f, 0x5c2e2e72
+.word	0x381c1c24, 0x57a6a6f1, 0x73b4b4c7, 0x97c6c651
+.word	0xcbe8e823, 0xa1dddd7c, 0xe874749c, 0x3e1f1f21
+.word	0x964b4bdd, 0x61bdbddc, 0x0d8b8b86, 0x0f8a8a85
+.word	0xe0707090, 0x7c3e3e42, 0x71b5b5c4, 0xcc6666aa
+.word	0x904848d8, 0x06030305, 0xf7f6f601, 0x1c0e0e12
+.word	0xc26161a3, 0x6a35355f, 0xae5757f9, 0x69b9b9d0
+.word	0x17868691, 0x99c1c158, 0x3a1d1d27, 0x279e9eb9
+.word	0xd9e1e138, 0xebf8f813, 0x2b9898b3, 0x22111133
+.word	0xd26969bb, 0xa9d9d970, 0x078e8e89, 0x339494a7
+.word	0x2d9b9bb6, 0x3c1e1e22, 0x15878792, 0xc9e9e920
+.word	0x87cece49, 0xaa5555ff, 0x50282878, 0xa5dfdf7a
+.word	0x038c8c8f, 0x59a1a1f8, 0x09898980, 0x1a0d0d17
+.word	0x65bfbfda, 0xd7e6e631, 0x844242c6, 0xd06868b8
+.word	0x824141c3, 0x299999b0, 0x5a2d2d77, 0x1e0f0f11
+.word	0x7bb0b0cb, 0xa85454fc, 0x6dbbbbd6, 0x2c16163a
+@ Te4[256]
+.byte	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5
+.byte	0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76
+.byte	0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0
+.byte	0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0
+.byte	0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc
+.byte	0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15
+.byte	0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a
+.byte	0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75
+.byte	0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0
+.byte	0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84
+.byte	0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b
+.byte	0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf
+.byte	0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85
+.byte	0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8
+.byte	0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5
+.byte	0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2
+.byte	0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17
+.byte	0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73
+.byte	0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88
+.byte	0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb
+.byte	0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c
+.byte	0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79
+.byte	0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9
+.byte	0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08
+.byte	0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6
+.byte	0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a
+.byte	0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e
+.byte	0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e
+.byte	0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94
+.byte	0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf
+.byte	0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68
+.byte	0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
+@ rcon[]
+.word	0x01000000, 0x02000000, 0x04000000, 0x08000000
+.word	0x10000000, 0x20000000, 0x40000000, 0x80000000
+.word	0x1B000000, 0x36000000, 0, 0, 0, 0, 0, 0
+.size	AES_Te,.-AES_Te
+
+@ void cryptogams_AES_encrypt_block(const unsigned char *in, unsigned char *out,
+@ 		 const AES_KEY *key) {
+.globl	cryptogams_AES_encrypt_block
+.type	cryptogams_AES_encrypt_block,%function
+.align	5
+cryptogams_AES_encrypt_block:
+#ifndef	__thumb2__
+	sub	r3,pc,#8		@ cryptogams_AES_encrypt_block
+#else
+	adr	r3,.
+#endif
+	stmdb	sp!,{r1,r4-r12,lr}
+#if defined(__thumb2__) || defined(__APPLE__)
+	adr	r10,AES_Te
+#else
+	sub	r10,r3,#cryptogams_AES_encrypt_block-AES_Te	@ Te
+#endif
+	mov	r12,r0		@ inp
+	mov	r11,r2
+#if __ARM_ARCH__<7
+	ldrb	r0,[r12,#3]	@ load input data in endian-neutral
+	ldrb	r4,[r12,#2]	@ manner...
+	ldrb	r5,[r12,#1]
+	ldrb	r6,[r12,#0]
+	orr	r0,r0,r4,lsl#8
+	ldrb	r1,[r12,#7]
+	orr	r0,r0,r5,lsl#16
+	ldrb	r4,[r12,#6]
+	orr	r0,r0,r6,lsl#24
+	ldrb	r5,[r12,#5]
+	ldrb	r6,[r12,#4]
+	orr	r1,r1,r4,lsl#8
+	ldrb	r2,[r12,#11]
+	orr	r1,r1,r5,lsl#16
+	ldrb	r4,[r12,#10]
+	orr	r1,r1,r6,lsl#24
+	ldrb	r5,[r12,#9]
+	ldrb	r6,[r12,#8]
+	orr	r2,r2,r4,lsl#8
+	ldrb	r3,[r12,#15]
+	orr	r2,r2,r5,lsl#16
+	ldrb	r4,[r12,#14]
+	orr	r2,r2,r6,lsl#24
+	ldrb	r5,[r12,#13]
+	ldrb	r6,[r12,#12]
+	orr	r3,r3,r4,lsl#8
+	orr	r3,r3,r5,lsl#16
+	orr	r3,r3,r6,lsl#24
+#else
+	ldr	r0,[r12,#0]
+	ldr	r1,[r12,#4]
+	ldr	r2,[r12,#8]
+	ldr	r3,[r12,#12]
+#ifdef __ARMEL__
+	rev	r0,r0
+	rev	r1,r1
+	rev	r2,r2
+	rev	r3,r3
+#endif
+#endif
+	bl	_cryptogams_armv4_AES_encrypt_block
+
+	ldr	r12,[sp],#4		@ pop out
+#if __ARM_ARCH__>=7
+#ifdef __ARMEL__
+	rev	r0,r0
+	rev	r1,r1
+	rev	r2,r2
+	rev	r3,r3
+#endif
+	str	r0,[r12,#0]
+	str	r1,[r12,#4]
+	str	r2,[r12,#8]
+	str	r3,[r12,#12]
+#else
+	mov	r4,r0,lsr#24		@ write output in endian-neutral
+	mov	r5,r0,lsr#16		@ manner...
+	mov	r6,r0,lsr#8
+	strb	r4,[r12,#0]
+	strb	r5,[r12,#1]
+	mov	r4,r1,lsr#24
+	strb	r6,[r12,#2]
+	mov	r5,r1,lsr#16
+	strb	r0,[r12,#3]
+	mov	r6,r1,lsr#8
+	strb	r4,[r12,#4]
+	strb	r5,[r12,#5]
+	mov	r4,r2,lsr#24
+	strb	r6,[r12,#6]
+	mov	r5,r2,lsr#16
+	strb	r1,[r12,#7]
+	mov	r6,r2,lsr#8
+	strb	r4,[r12,#8]
+	strb	r5,[r12,#9]
+	mov	r4,r3,lsr#24
+	strb	r6,[r12,#10]
+	mov	r5,r3,lsr#16
+	strb	r2,[r12,#11]
+	mov	r6,r3,lsr#8
+	strb	r4,[r12,#12]
+	strb	r5,[r12,#13]
+	strb	r6,[r12,#14]
+	strb	r3,[r12,#15]
+#endif
+#if __ARM_ARCH__>=5
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,pc}
+#else
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+	tst	lr,#1
+	moveq	pc,lr			@ be binary compatible with V4, yet
+.word	0xe12fff1e			@ interoperable with Thumb ISA:-)
+#endif
+.size	cryptogams_AES_encrypt_block,.-cryptogams_AES_encrypt_block
+
+.type	_cryptogams_armv4_AES_encrypt_block,%function
+.align	2
+_cryptogams_armv4_AES_encrypt_block:
+	str	lr,[sp,#-4]!		@ push lr
+	ldmia	r11!,{r4,r5,r6,r7}
+	eor	r0,r0,r4
+	ldr	r12,[r11,#240-16]
+	eor	r1,r1,r5
+	eor	r2,r2,r6
+	eor	r3,r3,r7
+	sub	r12,r12,#1
+	mov	lr,#255
+
+	and	r7,lr,r0
+	and	r8,lr,r0,lsr#8
+	and	r9,lr,r0,lsr#16
+	mov	r0,r0,lsr#24
+.Lenc_loop:
+	ldr	r4,[r10,r7,lsl#2]	@ Te3[s0>>0]
+	and	r7,lr,r1,lsr#16	@ i0
+	ldr	r5,[r10,r8,lsl#2]	@ Te2[s0>>8]
+	and	r8,lr,r1
+	ldr	r6,[r10,r9,lsl#2]	@ Te1[s0>>16]
+	and	r9,lr,r1,lsr#8
+	ldr	r0,[r10,r0,lsl#2]	@ Te0[s0>>24]
+	mov	r1,r1,lsr#24
+
+	ldr	r7,[r10,r7,lsl#2]	@ Te1[s1>>16]
+	ldr	r8,[r10,r8,lsl#2]	@ Te3[s1>>0]
+	ldr	r9,[r10,r9,lsl#2]	@ Te2[s1>>8]
+	eor	r0,r0,r7,ror#8
+	ldr	r1,[r10,r1,lsl#2]	@ Te0[s1>>24]
+	and	r7,lr,r2,lsr#8	@ i0
+	eor	r5,r5,r8,ror#8
+	and	r8,lr,r2,lsr#16	@ i1
+	eor	r6,r6,r9,ror#8
+	and	r9,lr,r2
+	ldr	r7,[r10,r7,lsl#2]	@ Te2[s2>>8]
+	eor	r1,r1,r4,ror#24
+	ldr	r8,[r10,r8,lsl#2]	@ Te1[s2>>16]
+	mov	r2,r2,lsr#24
+
+	ldr	r9,[r10,r9,lsl#2]	@ Te3[s2>>0]
+	eor	r0,r0,r7,ror#16
+	ldr	r2,[r10,r2,lsl#2]	@ Te0[s2>>24]
+	and	r7,lr,r3		@ i0
+	eor	r1,r1,r8,ror#8
+	and	r8,lr,r3,lsr#8	@ i1
+	eor	r6,r6,r9,ror#16
+	and	r9,lr,r3,lsr#16	@ i2
+	ldr	r7,[r10,r7,lsl#2]	@ Te3[s3>>0]
+	eor	r2,r2,r5,ror#16
+	ldr	r8,[r10,r8,lsl#2]	@ Te2[s3>>8]
+	mov	r3,r3,lsr#24
+
+	ldr	r9,[r10,r9,lsl#2]	@ Te1[s3>>16]
+	eor	r0,r0,r7,ror#24
+	ldr	r7,[r11],#16
+	eor	r1,r1,r8,ror#16
+	ldr	r3,[r10,r3,lsl#2]	@ Te0[s3>>24]
+	eor	r2,r2,r9,ror#8
+	ldr	r4,[r11,#-12]
+	eor	r3,r3,r6,ror#8
+
+	ldr	r5,[r11,#-8]
+	eor	r0,r0,r7
+	ldr	r6,[r11,#-4]
+	and	r7,lr,r0
+	eor	r1,r1,r4
+	and	r8,lr,r0,lsr#8
+	eor	r2,r2,r5
+	and	r9,lr,r0,lsr#16
+	eor	r3,r3,r6
+	mov	r0,r0,lsr#24
+
+	subs	r12,r12,#1
+	bne	.Lenc_loop
+
+	add	r10,r10,#2
+
+	ldrb	r4,[r10,r7,lsl#2]	@ Te4[s0>>0]
+	and	r7,lr,r1,lsr#16	@ i0
+	ldrb	r5,[r10,r8,lsl#2]	@ Te4[s0>>8]
+	and	r8,lr,r1
+	ldrb	r6,[r10,r9,lsl#2]	@ Te4[s0>>16]
+	and	r9,lr,r1,lsr#8
+	ldrb	r0,[r10,r0,lsl#2]	@ Te4[s0>>24]
+	mov	r1,r1,lsr#24
+
+	ldrb	r7,[r10,r7,lsl#2]	@ Te4[s1>>16]
+	ldrb	r8,[r10,r8,lsl#2]	@ Te4[s1>>0]
+	ldrb	r9,[r10,r9,lsl#2]	@ Te4[s1>>8]
+	eor	r0,r7,r0,lsl#8
+	ldrb	r1,[r10,r1,lsl#2]	@ Te4[s1>>24]
+	and	r7,lr,r2,lsr#8	@ i0
+	eor	r5,r8,r5,lsl#8
+	and	r8,lr,r2,lsr#16	@ i1
+	eor	r6,r9,r6,lsl#8
+	and	r9,lr,r2
+	ldrb	r7,[r10,r7,lsl#2]	@ Te4[s2>>8]
+	eor	r1,r4,r1,lsl#24
+	ldrb	r8,[r10,r8,lsl#2]	@ Te4[s2>>16]
+	mov	r2,r2,lsr#24
+
+	ldrb	r9,[r10,r9,lsl#2]	@ Te4[s2>>0]
+	eor	r0,r7,r0,lsl#8
+	ldrb	r2,[r10,r2,lsl#2]	@ Te4[s2>>24]
+	and	r7,lr,r3		@ i0
+	eor	r1,r1,r8,lsl#16
+	and	r8,lr,r3,lsr#8	@ i1
+	eor	r6,r9,r6,lsl#8
+	and	r9,lr,r3,lsr#16	@ i2
+	ldrb	r7,[r10,r7,lsl#2]	@ Te4[s3>>0]
+	eor	r2,r5,r2,lsl#24
+	ldrb	r8,[r10,r8,lsl#2]	@ Te4[s3>>8]
+	mov	r3,r3,lsr#24
+
+	ldrb	r9,[r10,r9,lsl#2]	@ Te4[s3>>16]
+	eor	r0,r7,r0,lsl#8
+	ldr	r7,[r11,#0]
+	ldrb	r3,[r10,r3,lsl#2]	@ Te4[s3>>24]
+	eor	r1,r1,r8,lsl#8
+	ldr	r4,[r11,#4]
+	eor	r2,r2,r9,lsl#16
+	ldr	r5,[r11,#8]
+	eor	r3,r6,r3,lsl#24
+	ldr	r6,[r11,#12]
+
+	eor	r0,r0,r7
+	eor	r1,r1,r4
+	eor	r2,r2,r5
+	eor	r3,r3,r6
+
+	sub	r10,r10,#2
+	ldr	pc,[sp],#4		@ pop and return
+.size	_cryptogams_armv4_AES_encrypt_block,.-_cryptogams_armv4_AES_encrypt_block
+
+.globl	cryptogams_AES_set_encrypt_key
+.type	cryptogams_AES_set_encrypt_key,%function
+.align	5
+cryptogams_AES_set_encrypt_key:
+_armv4_AES_set_encrypt_key:
+#ifndef	__thumb2__
+	sub	r3,pc,#8		@ AES_set_encrypt_key
+#else
+	adr	r3,.
+#endif
+	teq	r0,#0
+#ifdef	__thumb2__
+	itt	eq			@ Thumb2 thing, sanity check in ARM
+#endif
+	moveq	r0,#-1
+	beq	.Labrt
+	teq	r2,#0
+#ifdef	__thumb2__
+	itt	eq			@ Thumb2 thing, sanity check in ARM
+#endif
+	moveq	r0,#-1
+	beq	.Labrt
+
+	teq	r1,#128
+	beq	.Lok
+	teq	r1,#192
+	beq	.Lok
+	teq	r1,#256
+#ifdef	__thumb2__
+	itt	ne			@ Thumb2 thing, sanity check in ARM
+#endif
+	movne	r0,#-1
+	bne	.Labrt
+
+.Lok:	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+	mov	r12,r0		@ inp
+	mov	lr,r1			@ bits
+	mov	r11,r2			@ key
+
+#if defined(__thumb2__) || defined(__APPLE__)
+	adr	r10,AES_Te+1024				@ Te4
+#else
+	sub	r10,r3,#_armv4_AES_set_encrypt_key-AES_Te-1024	@ Te4
+#endif
+
+#if __ARM_ARCH__<7
+	ldrb	r0,[r12,#3]	@ load input data in endian-neutral
+	ldrb	r4,[r12,#2]	@ manner...
+	ldrb	r5,[r12,#1]
+	ldrb	r6,[r12,#0]
+	orr	r0,r0,r4,lsl#8
+	ldrb	r1,[r12,#7]
+	orr	r0,r0,r5,lsl#16
+	ldrb	r4,[r12,#6]
+	orr	r0,r0,r6,lsl#24
+	ldrb	r5,[r12,#5]
+	ldrb	r6,[r12,#4]
+	orr	r1,r1,r4,lsl#8
+	ldrb	r2,[r12,#11]
+	orr	r1,r1,r5,lsl#16
+	ldrb	r4,[r12,#10]
+	orr	r1,r1,r6,lsl#24
+	ldrb	r5,[r12,#9]
+	ldrb	r6,[r12,#8]
+	orr	r2,r2,r4,lsl#8
+	ldrb	r3,[r12,#15]
+	orr	r2,r2,r5,lsl#16
+	ldrb	r4,[r12,#14]
+	orr	r2,r2,r6,lsl#24
+	ldrb	r5,[r12,#13]
+	ldrb	r6,[r12,#12]
+	orr	r3,r3,r4,lsl#8
+	str	r0,[r11],#16
+	orr	r3,r3,r5,lsl#16
+	str	r1,[r11,#-12]
+	orr	r3,r3,r6,lsl#24
+	str	r2,[r11,#-8]
+	str	r3,[r11,#-4]
+#else
+	ldr	r0,[r12,#0]
+	ldr	r1,[r12,#4]
+	ldr	r2,[r12,#8]
+	ldr	r3,[r12,#12]
+#ifdef __ARMEL__
+	rev	r0,r0
+	rev	r1,r1
+	rev	r2,r2
+	rev	r3,r3
+#endif
+	str	r0,[r11],#16
+	str	r1,[r11,#-12]
+	str	r2,[r11,#-8]
+	str	r3,[r11,#-4]
+#endif
+
+	teq	lr,#128
+	bne	.Lnot128
+	mov	r12,#10
+	str	r12,[r11,#240-16]
+	add	r6,r10,#256			@ rcon
+	mov	lr,#255
+
+.L128_loop:
+	and	r5,lr,r3,lsr#24
+	and	r7,lr,r3,lsr#16
+	ldrb	r5,[r10,r5]
+	and	r8,lr,r3,lsr#8
+	ldrb	r7,[r10,r7]
+	and	r9,lr,r3
+	ldrb	r8,[r10,r8]
+	orr	r5,r5,r7,lsl#24
+	ldrb	r9,[r10,r9]
+	orr	r5,r5,r8,lsl#16
+	ldr	r4,[r6],#4			@ rcon[i++]
+	orr	r5,r5,r9,lsl#8
+	eor	r5,r5,r4
+	eor	r0,r0,r5			@ rk[4]=rk[0]^...
+	eor	r1,r1,r0			@ rk[5]=rk[1]^rk[4]
+	str	r0,[r11],#16
+	eor	r2,r2,r1			@ rk[6]=rk[2]^rk[5]
+	str	r1,[r11,#-12]
+	eor	r3,r3,r2			@ rk[7]=rk[3]^rk[6]
+	str	r2,[r11,#-8]
+	subs	r12,r12,#1
+	str	r3,[r11,#-4]
+	bne	.L128_loop
+	sub	r2,r11,#176
+	b	.Ldone
+
+.Lnot128:
+#if __ARM_ARCH__<7
+	ldrb	r8,[r12,#19]
+	ldrb	r4,[r12,#18]
+	ldrb	r5,[r12,#17]
+	ldrb	r6,[r12,#16]
+	orr	r8,r8,r4,lsl#8
+	ldrb	r9,[r12,#23]
+	orr	r8,r8,r5,lsl#16
+	ldrb	r4,[r12,#22]
+	orr	r8,r8,r6,lsl#24
+	ldrb	r5,[r12,#21]
+	ldrb	r6,[r12,#20]
+	orr	r9,r9,r4,lsl#8
+	orr	r9,r9,r5,lsl#16
+	str	r8,[r11],#8
+	orr	r9,r9,r6,lsl#24
+	str	r9,[r11,#-4]
+#else
+	ldr	r8,[r12,#16]
+	ldr	r9,[r12,#20]
+#ifdef __ARMEL__
+	rev	r8,r8
+	rev	r9,r9
+#endif
+	str	r8,[r11],#8
+	str	r9,[r11,#-4]
+#endif
+
+	teq	lr,#192
+	bne	.Lnot192
+	mov	r12,#12
+	str	r12,[r11,#240-24]
+	add	r6,r10,#256			@ rcon
+	mov	lr,#255
+	mov	r12,#8
+
+.L192_loop:
+	and	r5,lr,r9,lsr#24
+	and	r7,lr,r9,lsr#16
+	ldrb	r5,[r10,r5]
+	and	r8,lr,r9,lsr#8
+	ldrb	r7,[r10,r7]
+	and	r9,lr,r9
+	ldrb	r8,[r10,r8]
+	orr	r5,r5,r7,lsl#24
+	ldrb	r9,[r10,r9]
+	orr	r5,r5,r8,lsl#16
+	ldr	r4,[r6],#4			@ rcon[i++]
+	orr	r5,r5,r9,lsl#8
+	eor	r9,r5,r4
+	eor	r0,r0,r9			@ rk[6]=rk[0]^...
+	eor	r1,r1,r0			@ rk[7]=rk[1]^rk[6]
+	str	r0,[r11],#24
+	eor	r2,r2,r1			@ rk[8]=rk[2]^rk[7]
+	str	r1,[r11,#-20]
+	eor	r3,r3,r2			@ rk[9]=rk[3]^rk[8]
+	str	r2,[r11,#-16]
+	subs	r12,r12,#1
+	str	r3,[r11,#-12]
+#ifdef	__thumb2__
+	itt	eq				@ Thumb2 thing, sanity check in ARM
+#endif
+	subeq	r2,r11,#216
+	beq	.Ldone
+
+	ldr	r7,[r11,#-32]
+	ldr	r8,[r11,#-28]
+	eor	r7,r7,r3			@ rk[10]=rk[4]^rk[9]
+	eor	r9,r8,r7			@ rk[11]=rk[5]^rk[10]
+	str	r7,[r11,#-8]
+	str	r9,[r11,#-4]
+	b	.L192_loop
+
+.Lnot192:
+#if __ARM_ARCH__<7
+	ldrb	r8,[r12,#27]
+	ldrb	r4,[r12,#26]
+	ldrb	r5,[r12,#25]
+	ldrb	r6,[r12,#24]
+	orr	r8,r8,r4,lsl#8
+	ldrb	r9,[r12,#31]
+	orr	r8,r8,r5,lsl#16
+	ldrb	r4,[r12,#30]
+	orr	r8,r8,r6,lsl#24
+	ldrb	r5,[r12,#29]
+	ldrb	r6,[r12,#28]
+	orr	r9,r9,r4,lsl#8
+	orr	r9,r9,r5,lsl#16
+	str	r8,[r11],#8
+	orr	r9,r9,r6,lsl#24
+	str	r9,[r11,#-4]
+#else
+	ldr	r8,[r12,#24]
+	ldr	r9,[r12,#28]
+#ifdef __ARMEL__
+	rev	r8,r8
+	rev	r9,r9
+#endif
+	str	r8,[r11],#8
+	str	r9,[r11,#-4]
+#endif
+
+	mov	r12,#14
+	str	r12,[r11,#240-32]
+	add	r6,r10,#256			@ rcon
+	mov	lr,#255
+	mov	r12,#7
+
+.L256_loop:
+	and	r5,lr,r9,lsr#24
+	and	r7,lr,r9,lsr#16
+	ldrb	r5,[r10,r5]
+	and	r8,lr,r9,lsr#8
+	ldrb	r7,[r10,r7]
+	and	r9,lr,r9
+	ldrb	r8,[r10,r8]
+	orr	r5,r5,r7,lsl#24
+	ldrb	r9,[r10,r9]
+	orr	r5,r5,r8,lsl#16
+	ldr	r4,[r6],#4			@ rcon[i++]
+	orr	r5,r5,r9,lsl#8
+	eor	r9,r5,r4
+	eor	r0,r0,r9			@ rk[8]=rk[0]^...
+	eor	r1,r1,r0			@ rk[9]=rk[1]^rk[8]
+	str	r0,[r11],#32
+	eor	r2,r2,r1			@ rk[10]=rk[2]^rk[9]
+	str	r1,[r11,#-28]
+	eor	r3,r3,r2			@ rk[11]=rk[3]^rk[10]
+	str	r2,[r11,#-24]
+	subs	r12,r12,#1
+	str	r3,[r11,#-20]
+#ifdef	__thumb2__
+	itt	eq				@ Thumb2 thing, sanity check in ARM
+#endif
+	subeq	r2,r11,#256
+	beq	.Ldone
+
+	and	r5,lr,r3
+	and	r7,lr,r3,lsr#8
+	ldrb	r5,[r10,r5]
+	and	r8,lr,r3,lsr#16
+	ldrb	r7,[r10,r7]
+	and	r9,lr,r3,lsr#24
+	ldrb	r8,[r10,r8]
+	orr	r5,r5,r7,lsl#8
+	ldrb	r9,[r10,r9]
+	orr	r5,r5,r8,lsl#16
+	ldr	r4,[r11,#-48]
+	orr	r5,r5,r9,lsl#24
+
+	ldr	r7,[r11,#-44]
+	ldr	r8,[r11,#-40]
+	eor	r4,r4,r5			@ rk[12]=rk[4]^...
+	ldr	r9,[r11,#-36]
+	eor	r7,r7,r4			@ rk[13]=rk[5]^rk[12]
+	str	r4,[r11,#-16]
+	eor	r8,r8,r7			@ rk[14]=rk[6]^rk[13]
+	str	r7,[r11,#-12]
+	eor	r9,r9,r8			@ rk[15]=rk[7]^rk[14]
+	str	r8,[r11,#-8]
+	str	r9,[r11,#-4]
+	b	.L256_loop
+
+.align	2
+.Ldone:	mov	r0,#0
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+.Labrt:
+#if __ARM_ARCH__>=5
+	bx	lr				@ .word	0xe12fff1e
+#else
+	tst	lr,#1
+	moveq	pc,lr			@ be binary compatible with V4, yet
+.word	0xe12fff1e			@ interoperable with Thumb ISA:-)
+#endif
+.size	cryptogams_AES_set_encrypt_key,.-cryptogams_AES_set_encrypt_key
+
+.globl	cryptogams_AES_set_decrypt_key
+.type	cryptogams_AES_set_decrypt_key,%function
+.align	5
+cryptogams_AES_set_decrypt_key:
+	str	lr,[sp,#-4]!            @ push lr
+	bl	_armv4_AES_set_encrypt_key
+	teq	r0,#0
+	ldr	lr,[sp],#4              @ pop lr
+	bne	.Labrt
+
+	mov	r0,r2			@ AES_set_encrypt_key preserves r2,
+	mov	r1,r2			@ which is AES_KEY *key
+	b	_armv4_AES_set_enc2dec_key
+.size	cryptogams_AES_set_decrypt_key,.-cryptogams_AES_set_decrypt_key
+
+@ void cryptogams_AES_set_enc2dec_key(const AES_KEY *inp,AES_KEY *out)
+.globl	cryptogams_AES_set_enc2dec_key
+.type	cryptogams_AES_set_enc2dec_key,%function
+.align	5
+cryptogams_AES_set_enc2dec_key:
+_armv4_AES_set_enc2dec_key:
+	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+
+	ldr	r12,[r0,#240]
+	mov	r7,r0			@ input
+	add	r8,r0,r12,lsl#4
+	mov	r11,r1			@ output
+	add	r10,r1,r12,lsl#4
+	str	r12,[r1,#240]
+
+.Linv:	ldr	r0,[r7],#16
+	ldr	r1,[r7,#-12]
+	ldr	r2,[r7,#-8]
+	ldr	r3,[r7,#-4]
+	ldr	r4,[r8],#-16
+	ldr	r5,[r8,#16+4]
+	ldr	r6,[r8,#16+8]
+	ldr	r9,[r8,#16+12]
+	str	r0,[r10],#-16
+	str	r1,[r10,#16+4]
+	str	r2,[r10,#16+8]
+	str	r3,[r10,#16+12]
+	str	r4,[r11],#16
+	str	r5,[r11,#-12]
+	str	r6,[r11,#-8]
+	str	r9,[r11,#-4]
+	teq	r7,r8
+	bne	.Linv
+
+	ldr	r0,[r7]
+	ldr	r1,[r7,#4]
+	ldr	r2,[r7,#8]
+	ldr	r3,[r7,#12]
+	str	r0,[r11]
+	str	r1,[r11,#4]
+	str	r2,[r11,#8]
+	str	r3,[r11,#12]
+	sub	r11,r11,r12,lsl#3
+	ldr	r0,[r11,#16]!		@ prefetch tp1
+	mov	r7,#0x80
+	mov	r8,#0x1b
+	orr	r7,r7,#0x8000
+	orr	r8,r8,#0x1b00
+	orr	r7,r7,r7,lsl#16
+	orr	r8,r8,r8,lsl#16
+	sub	r12,r12,#1
+	mvn	r9,r7
+	mov	r12,r12,lsl#2	@ (rounds-1)*4
+
+.Lmix:	and	r4,r0,r7
+	and	r1,r0,r9
+	sub	r4,r4,r4,lsr#7
+	and	r4,r4,r8
+	eor	r1,r4,r1,lsl#1	@ tp2
+
+	and	r4,r1,r7
+	and	r2,r1,r9
+	sub	r4,r4,r4,lsr#7
+	and	r4,r4,r8
+	eor	r2,r4,r2,lsl#1	@ tp4
+
+	and	r4,r2,r7
+	and	r3,r2,r9
+	sub	r4,r4,r4,lsr#7
+	and	r4,r4,r8
+	eor	r3,r4,r3,lsl#1	@ tp8
+
+	eor	r4,r1,r2
+	eor	r5,r0,r3		@ tp9
+	eor	r4,r4,r3		@ tpe
+	eor	r4,r4,r1,ror#24
+	eor	r4,r4,r5,ror#24	@ ^= ROTATE(tpb=tp9^tp2,8)
+	eor	r4,r4,r2,ror#16
+	eor	r4,r4,r5,ror#16	@ ^= ROTATE(tpd=tp9^tp4,16)
+	eor	r4,r4,r5,ror#8	@ ^= ROTATE(tp9,24)
+
+	ldr	r0,[r11,#4]		@ prefetch tp1
+	str	r4,[r11],#4
+	subs	r12,r12,#1
+	bne	.Lmix
+
+	mov	r0,#0
+#if __ARM_ARCH__>=5
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,pc}
+#else
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+	tst	lr,#1
+	moveq	pc,lr			@ be binary compatible with V4, yet
+.word	0xe12fff1e			@ interoperable with Thumb ISA:-)
+#endif
+.size	cryptogams_AES_set_enc2dec_key,.-cryptogams_AES_set_enc2dec_key
+
+.type	AES_Td,%object
+.align	5
+AES_Td:
+.word	0x51f4a750, 0x7e416553, 0x1a17a4c3, 0x3a275e96
+.word	0x3bab6bcb, 0x1f9d45f1, 0xacfa58ab, 0x4be30393
+.word	0x2030fa55, 0xad766df6, 0x88cc7691, 0xf5024c25
+.word	0x4fe5d7fc, 0xc52acbd7, 0x26354480, 0xb562a38f
+.word	0xdeb15a49, 0x25ba1b67, 0x45ea0e98, 0x5dfec0e1
+.word	0xc32f7502, 0x814cf012, 0x8d4697a3, 0x6bd3f9c6
+.word	0x038f5fe7, 0x15929c95, 0xbf6d7aeb, 0x955259da
+.word	0xd4be832d, 0x587421d3, 0x49e06929, 0x8ec9c844
+.word	0x75c2896a, 0xf48e7978, 0x99583e6b, 0x27b971dd
+.word	0xbee14fb6, 0xf088ad17, 0xc920ac66, 0x7dce3ab4
+.word	0x63df4a18, 0xe51a3182, 0x97513360, 0x62537f45
+.word	0xb16477e0, 0xbb6bae84, 0xfe81a01c, 0xf9082b94
+.word	0x70486858, 0x8f45fd19, 0x94de6c87, 0x527bf8b7
+.word	0xab73d323, 0x724b02e2, 0xe31f8f57, 0x6655ab2a
+.word	0xb2eb2807, 0x2fb5c203, 0x86c57b9a, 0xd33708a5
+.word	0x302887f2, 0x23bfa5b2, 0x02036aba, 0xed16825c
+.word	0x8acf1c2b, 0xa779b492, 0xf307f2f0, 0x4e69e2a1
+.word	0x65daf4cd, 0x0605bed5, 0xd134621f, 0xc4a6fe8a
+.word	0x342e539d, 0xa2f355a0, 0x058ae132, 0xa4f6eb75
+.word	0x0b83ec39, 0x4060efaa, 0x5e719f06, 0xbd6e1051
+.word	0x3e218af9, 0x96dd063d, 0xdd3e05ae, 0x4de6bd46
+.word	0x91548db5, 0x71c45d05, 0x0406d46f, 0x605015ff
+.word	0x1998fb24, 0xd6bde997, 0x894043cc, 0x67d99e77
+.word	0xb0e842bd, 0x07898b88, 0xe7195b38, 0x79c8eedb
+.word	0xa17c0a47, 0x7c420fe9, 0xf8841ec9, 0x00000000
+.word	0x09808683, 0x322bed48, 0x1e1170ac, 0x6c5a724e
+.word	0xfd0efffb, 0x0f853856, 0x3daed51e, 0x362d3927
+.word	0x0a0fd964, 0x685ca621, 0x9b5b54d1, 0x24362e3a
+.word	0x0c0a67b1, 0x9357e70f, 0xb4ee96d2, 0x1b9b919e
+.word	0x80c0c54f, 0x61dc20a2, 0x5a774b69, 0x1c121a16
+.word	0xe293ba0a, 0xc0a02ae5, 0x3c22e043, 0x121b171d
+.word	0x0e090d0b, 0xf28bc7ad, 0x2db6a8b9, 0x141ea9c8
+.word	0x57f11985, 0xaf75074c, 0xee99ddbb, 0xa37f60fd
+.word	0xf701269f, 0x5c72f5bc, 0x44663bc5, 0x5bfb7e34
+.word	0x8b432976, 0xcb23c6dc, 0xb6edfc68, 0xb8e4f163
+.word	0xd731dcca, 0x42638510, 0x13972240, 0x84c61120
+.word	0x854a247d, 0xd2bb3df8, 0xaef93211, 0xc729a16d
+.word	0x1d9e2f4b, 0xdcb230f3, 0x0d8652ec, 0x77c1e3d0
+.word	0x2bb3166c, 0xa970b999, 0x119448fa, 0x47e96422
+.word	0xa8fc8cc4, 0xa0f03f1a, 0x567d2cd8, 0x223390ef
+.word	0x87494ec7, 0xd938d1c1, 0x8ccaa2fe, 0x98d40b36
+.word	0xa6f581cf, 0xa57ade28, 0xdab78e26, 0x3fadbfa4
+.word	0x2c3a9de4, 0x5078920d, 0x6a5fcc9b, 0x547e4662
+.word	0xf68d13c2, 0x90d8b8e8, 0x2e39f75e, 0x82c3aff5
+.word	0x9f5d80be, 0x69d0937c, 0x6fd52da9, 0xcf2512b3
+.word	0xc8ac993b, 0x10187da7, 0xe89c636e, 0xdb3bbb7b
+.word	0xcd267809, 0x6e5918f4, 0xec9ab701, 0x834f9aa8
+.word	0xe6956e65, 0xaaffe67e, 0x21bccf08, 0xef15e8e6
+.word	0xbae79bd9, 0x4a6f36ce, 0xea9f09d4, 0x29b07cd6
+.word	0x31a4b2af, 0x2a3f2331, 0xc6a59430, 0x35a266c0
+.word	0x744ebc37, 0xfc82caa6, 0xe090d0b0, 0x33a7d815
+.word	0xf104984a, 0x41ecdaf7, 0x7fcd500e, 0x1791f62f
+.word	0x764dd68d, 0x43efb04d, 0xccaa4d54, 0xe49604df
+.word	0x9ed1b5e3, 0x4c6a881b, 0xc12c1fb8, 0x4665517f
+.word	0x9d5eea04, 0x018c355d, 0xfa877473, 0xfb0b412e
+.word	0xb3671d5a, 0x92dbd252, 0xe9105633, 0x6dd64713
+.word	0x9ad7618c, 0x37a10c7a, 0x59f8148e, 0xeb133c89
+.word	0xcea927ee, 0xb761c935, 0xe11ce5ed, 0x7a47b13c
+.word	0x9cd2df59, 0x55f2733f, 0x1814ce79, 0x73c737bf
+.word	0x53f7cdea, 0x5ffdaa5b, 0xdf3d6f14, 0x7844db86
+.word	0xcaaff381, 0xb968c43e, 0x3824342c, 0xc2a3405f
+.word	0x161dc372, 0xbce2250c, 0x283c498b, 0xff0d9541
+.word	0x39a80171, 0x080cb3de, 0xd8b4e49c, 0x6456c190
+.word	0x7bcb8461, 0xd532b670, 0x486c5c74, 0xd0b85742
+@ Td4[256]
+.byte	0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38
+.byte	0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb
+.byte	0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87
+.byte	0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb
+.byte	0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d
+.byte	0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e
+.byte	0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2
+.byte	0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25
+.byte	0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16
+.byte	0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92
+.byte	0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda
+.byte	0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84
+.byte	0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a
+.byte	0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06
+.byte	0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02
+.byte	0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b
+.byte	0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea
+.byte	0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73
+.byte	0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85
+.byte	0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e
+.byte	0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89
+.byte	0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b
+.byte	0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20
+.byte	0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4
+.byte	0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31
+.byte	0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f
+.byte	0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d
+.byte	0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef
+.byte	0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0
+.byte	0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61
+.byte	0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26
+.byte	0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
+.size	AES_Td,.-AES_Td
+
+@ void cryptogams_AES_decrypt_block(const unsigned char *in, unsigned char *out,
+@ 		 const AES_KEY *key) {
+.globl	cryptogams_AES_decrypt_block
+.type	cryptogams_AES_decrypt_block,%function
+.align	5
+cryptogams_AES_decrypt_block:
+#ifndef	__thumb2__
+	sub	r3,pc,#8		@ cryptogams_AES_decrypt_block
+#else
+	adr	r3,.
+#endif
+	stmdb	sp!,{r1,r4-r12,lr}
+#if defined(__thumb2__) || defined(__APPLE__)
+	adr	r10,AES_Td
+#else
+	sub	r10,r3,#cryptogams_AES_decrypt_block-AES_Td	@ Td
+#endif
+	mov	r12,r0		@ inp
+	mov	r11,r2
+#if __ARM_ARCH__<7
+	ldrb	r0,[r12,#3]	@ load input data in endian-neutral
+	ldrb	r4,[r12,#2]	@ manner...
+	ldrb	r5,[r12,#1]
+	ldrb	r6,[r12,#0]
+	orr	r0,r0,r4,lsl#8
+	ldrb	r1,[r12,#7]
+	orr	r0,r0,r5,lsl#16
+	ldrb	r4,[r12,#6]
+	orr	r0,r0,r6,lsl#24
+	ldrb	r5,[r12,#5]
+	ldrb	r6,[r12,#4]
+	orr	r1,r1,r4,lsl#8
+	ldrb	r2,[r12,#11]
+	orr	r1,r1,r5,lsl#16
+	ldrb	r4,[r12,#10]
+	orr	r1,r1,r6,lsl#24
+	ldrb	r5,[r12,#9]
+	ldrb	r6,[r12,#8]
+	orr	r2,r2,r4,lsl#8
+	ldrb	r3,[r12,#15]
+	orr	r2,r2,r5,lsl#16
+	ldrb	r4,[r12,#14]
+	orr	r2,r2,r6,lsl#24
+	ldrb	r5,[r12,#13]
+	ldrb	r6,[r12,#12]
+	orr	r3,r3,r4,lsl#8
+	orr	r3,r3,r5,lsl#16
+	orr	r3,r3,r6,lsl#24
+#else
+	ldr	r0,[r12,#0]
+	ldr	r1,[r12,#4]
+	ldr	r2,[r12,#8]
+	ldr	r3,[r12,#12]
+#ifdef __ARMEL__
+	rev	r0,r0
+	rev	r1,r1
+	rev	r2,r2
+	rev	r3,r3
+#endif
+#endif
+	bl	_cryptogams_armv4_AES_decrypt_block
+
+	ldr	r12,[sp],#4		@ pop out
+#if __ARM_ARCH__>=7
+#ifdef __ARMEL__
+	rev	r0,r0
+	rev	r1,r1
+	rev	r2,r2
+	rev	r3,r3
+#endif
+	str	r0,[r12,#0]
+	str	r1,[r12,#4]
+	str	r2,[r12,#8]
+	str	r3,[r12,#12]
+#else
+	mov	r4,r0,lsr#24		@ write output in endian-neutral
+	mov	r5,r0,lsr#16		@ manner...
+	mov	r6,r0,lsr#8
+	strb	r4,[r12,#0]
+	strb	r5,[r12,#1]
+	mov	r4,r1,lsr#24
+	strb	r6,[r12,#2]
+	mov	r5,r1,lsr#16
+	strb	r0,[r12,#3]
+	mov	r6,r1,lsr#8
+	strb	r4,[r12,#4]
+	strb	r5,[r12,#5]
+	mov	r4,r2,lsr#24
+	strb	r6,[r12,#6]
+	mov	r5,r2,lsr#16
+	strb	r1,[r12,#7]
+	mov	r6,r2,lsr#8
+	strb	r4,[r12,#8]
+	strb	r5,[r12,#9]
+	mov	r4,r3,lsr#24
+	strb	r6,[r12,#10]
+	mov	r5,r3,lsr#16
+	strb	r2,[r12,#11]
+	mov	r6,r3,lsr#8
+	strb	r4,[r12,#12]
+	strb	r5,[r12,#13]
+	strb	r6,[r12,#14]
+	strb	r3,[r12,#15]
+#endif
+#if __ARM_ARCH__>=5
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,pc}
+#else
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+	tst	lr,#1
+	moveq	pc,lr			@ be binary compatible with V4, yet
+.word	0xe12fff1e			@ interoperable with Thumb ISA:-)
+#endif
+.size	cryptogams_AES_decrypt_block,.-cryptogams_AES_decrypt_block
+
+.type	_cryptogams_armv4_AES_decrypt_block,%function
+.align	2
+_cryptogams_armv4_AES_decrypt_block:
+	str	lr,[sp,#-4]!		@ push lr
+	ldmia	r11!,{r4,r5,r6,r7}
+	eor	r0,r0,r4
+	ldr	r12,[r11,#240-16]
+	eor	r1,r1,r5
+	eor	r2,r2,r6
+	eor	r3,r3,r7
+	sub	r12,r12,#1
+	mov	lr,#255
+
+	and	r7,lr,r0,lsr#16
+	and	r8,lr,r0,lsr#8
+	and	r9,lr,r0
+	mov	r0,r0,lsr#24
+.Ldec_loop:
+	ldr	r4,[r10,r7,lsl#2]	@ Td1[s0>>16]
+	and	r7,lr,r1		@ i0
+	ldr	r5,[r10,r8,lsl#2]	@ Td2[s0>>8]
+	and	r8,lr,r1,lsr#16
+	ldr	r6,[r10,r9,lsl#2]	@ Td3[s0>>0]
+	and	r9,lr,r1,lsr#8
+	ldr	r0,[r10,r0,lsl#2]	@ Td0[s0>>24]
+	mov	r1,r1,lsr#24
+
+	ldr	r7,[r10,r7,lsl#2]	@ Td3[s1>>0]
+	ldr	r8,[r10,r8,lsl#2]	@ Td1[s1>>16]
+	ldr	r9,[r10,r9,lsl#2]	@ Td2[s1>>8]
+	eor	r0,r0,r7,ror#24
+	ldr	r1,[r10,r1,lsl#2]	@ Td0[s1>>24]
+	and	r7,lr,r2,lsr#8	@ i0
+	eor	r5,r8,r5,ror#8
+	and	r8,lr,r2		@ i1
+	eor	r6,r9,r6,ror#8
+	and	r9,lr,r2,lsr#16
+	ldr	r7,[r10,r7,lsl#2]	@ Td2[s2>>8]
+	eor	r1,r1,r4,ror#8
+	ldr	r8,[r10,r8,lsl#2]	@ Td3[s2>>0]
+	mov	r2,r2,lsr#24
+
+	ldr	r9,[r10,r9,lsl#2]	@ Td1[s2>>16]
+	eor	r0,r0,r7,ror#16
+	ldr	r2,[r10,r2,lsl#2]	@ Td0[s2>>24]
+	and	r7,lr,r3,lsr#16	@ i0
+	eor	r1,r1,r8,ror#24
+	and	r8,lr,r3,lsr#8	@ i1
+	eor	r6,r9,r6,ror#8
+	and	r9,lr,r3		@ i2
+	ldr	r7,[r10,r7,lsl#2]	@ Td1[s3>>16]
+	eor	r2,r2,r5,ror#8
+	ldr	r8,[r10,r8,lsl#2]	@ Td2[s3>>8]
+	mov	r3,r3,lsr#24
+
+	ldr	r9,[r10,r9,lsl#2]	@ Td3[s3>>0]
+	eor	r0,r0,r7,ror#8
+	ldr	r7,[r11],#16
+	eor	r1,r1,r8,ror#16
+	ldr	r3,[r10,r3,lsl#2]	@ Td0[s3>>24]
+	eor	r2,r2,r9,ror#24
+
+	ldr	r4,[r11,#-12]
+	eor	r0,r0,r7
+	ldr	r5,[r11,#-8]
+	eor	r3,r3,r6,ror#8
+	ldr	r6,[r11,#-4]
+	and	r7,lr,r0,lsr#16
+	eor	r1,r1,r4
+	and	r8,lr,r0,lsr#8
+	eor	r2,r2,r5
+	and	r9,lr,r0
+	eor	r3,r3,r6
+	mov	r0,r0,lsr#24
+
+	subs	r12,r12,#1
+	bne	.Ldec_loop
+
+	add	r10,r10,#1024
+
+	ldr	r5,[r10,#0]		@ prefetch Td4
+	ldr	r6,[r10,#32]
+	ldr	r4,[r10,#64]
+	ldr	r5,[r10,#96]
+	ldr	r6,[r10,#128]
+	ldr	r4,[r10,#160]
+	ldr	r5,[r10,#192]
+	ldr	r6,[r10,#224]
+
+	ldrb	r0,[r10,r0]		@ Td4[s0>>24]
+	ldrb	r4,[r10,r7]		@ Td4[s0>>16]
+	and	r7,lr,r1		@ i0
+	ldrb	r5,[r10,r8]		@ Td4[s0>>8]
+	and	r8,lr,r1,lsr#16
+	ldrb	r6,[r10,r9]		@ Td4[s0>>0]
+	and	r9,lr,r1,lsr#8
+
+	add	r1,r10,r1,lsr#24
+	ldrb	r7,[r10,r7]		@ Td4[s1>>0]
+	ldrb	r1,[r1]		@ Td4[s1>>24]
+	ldrb	r8,[r10,r8]		@ Td4[s1>>16]
+	eor	r0,r7,r0,lsl#24
+	ldrb	r9,[r10,r9]		@ Td4[s1>>8]
+	eor	r1,r4,r1,lsl#8
+	and	r7,lr,r2,lsr#8	@ i0
+	eor	r5,r5,r8,lsl#8
+	and	r8,lr,r2		@ i1
+	ldrb	r7,[r10,r7]		@ Td4[s2>>8]
+	eor	r6,r6,r9,lsl#8
+	ldrb	r8,[r10,r8]		@ Td4[s2>>0]
+	and	r9,lr,r2,lsr#16
+
+	add	r2,r10,r2,lsr#24
+	ldrb	r2,[r2]		@ Td4[s2>>24]
+	eor	r0,r0,r7,lsl#8
+	ldrb	r9,[r10,r9]		@ Td4[s2>>16]
+	eor	r1,r8,r1,lsl#16
+	and	r7,lr,r3,lsr#16	@ i0
+	eor	r2,r5,r2,lsl#16
+	and	r8,lr,r3,lsr#8	@ i1
+	ldrb	r7,[r10,r7]		@ Td4[s3>>16]
+	eor	r6,r6,r9,lsl#16
+	ldrb	r8,[r10,r8]		@ Td4[s3>>8]
+	and	r9,lr,r3		@ i2
+
+	add	r3,r10,r3,lsr#24
+	ldrb	r9,[r10,r9]		@ Td4[s3>>0]
+	ldrb	r3,[r3]		@ Td4[s3>>24]
+	eor	r0,r0,r7,lsl#16
+	ldr	r7,[r11,#0]
+	eor	r1,r1,r8,lsl#8
+	ldr	r4,[r11,#4]
+	eor	r2,r9,r2,lsl#8
+	ldr	r5,[r11,#8]
+	eor	r3,r6,r3,lsl#24
+	ldr	r6,[r11,#12]
+
+	eor	r0,r0,r7
+	eor	r1,r1,r4
+	eor	r2,r2,r5
+	eor	r3,r3,r6
+
+	sub	r10,r10,#1024
+	ldr	pc,[sp],#4		@ pop and return
+.size	_cryptogams_armv4_AES_decrypt_block,.-_cryptogams_armv4_AES_decrypt_block
diff --git a/runtime/third_party/cryptopp/aes_armv4.h b/runtime/third_party/cryptopp/aes_armv4.h
new file mode 100644
index 0000000..000dfec
--- /dev/null
+++ b/runtime/third_party/cryptopp/aes_armv4.h
@@ -0,0 +1,30 @@
+/* Header file for use with Cryptogam's ARMv4 AES.         */
+/* Also see http://www.openssl.org/~appro/cryptogams/ and  */
+/* https://wiki.openssl.org/index.php?title=Cryptogams_AES */
+
+#ifndef CRYPTOGAMS_AES_ARMV4_H
+#define CRYPTOGAMS_AES_ARMV4_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+//#define AES_MAXNR 14
+//typedef struct AES_KEY_st {
+//    unsigned int rd_key[4 * (AES_MAXNR + 1)];
+//    int rounds;
+//} AES_KEY;
+
+// Instead of AES_KEY we use a 'word32 rkey[4*15+4]'. It has space for
+// both the AES_MAXNR round keys and the number of rounds in the tail.
+
+int cryptogams_AES_set_encrypt_key(const unsigned char *userKey, const int bits, unsigned int *rkey);
+int cryptogams_AES_set_decrypt_key(const unsigned char *userKey, const int bits, unsigned int *rkey);
+void cryptogams_AES_encrypt_block(const unsigned char *in, unsigned char *out, const unsigned int *rkey);
+void cryptogams_AES_decrypt_block(const unsigned char *in, unsigned char *out, const unsigned int *rkey);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* CRYPTOGAMS_AES_ARMV4_H */
diff --git a/runtime/third_party/cryptopp/algebra.cpp b/runtime/third_party/cryptopp/algebra.cpp
new file mode 100644
index 0000000..cf5c2a4
--- /dev/null
+++ b/runtime/third_party/cryptopp/algebra.cpp
@@ -0,0 +1,341 @@
+// algebra.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_ALGEBRA_CPP	// SunCC workaround: compiler could cause this file to be included twice
+#define CRYPTOPP_ALGEBRA_CPP
+
+#include "algebra.h"
+#include "integer.h"
+
+#include <vector>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+template <class T> const T& AbstractGroup<T>::Double(const Element &a) const
+{
+	return this->Add(a, a);
+}
+
+template <class T> const T& AbstractGroup<T>::Subtract(const Element &a, const Element &b) const
+{
+	// make copy of a in case Inverse() overwrites it
+	Element a1(a);
+	return this->Add(a1, Inverse(b));
+}
+
+template <class T> T& AbstractGroup<T>::Accumulate(Element &a, const Element &b) const
+{
+	return a = this->Add(a, b);
+}
+
+template <class T> T& AbstractGroup<T>::Reduce(Element &a, const Element &b) const
+{
+	return a = this->Subtract(a, b);
+}
+
+template <class T> const T& AbstractRing<T>::Square(const Element &a) const
+{
+	return this->Multiply(a, a);
+}
+
+template <class T> const T& AbstractRing<T>::Divide(const Element &a, const Element &b) const
+{
+	// make copy of a in case MultiplicativeInverse() overwrites it
+	Element a1(a);
+	return this->Multiply(a1, this->MultiplicativeInverse(b));
+}
+
+template <class T> const T& AbstractEuclideanDomain<T>::Mod(const Element &a, const Element &b) const
+{
+	Element q;
+	this->DivisionAlgorithm(result, q, a, b);
+	return result;
+}
+
+template <class T> const T& AbstractEuclideanDomain<T>::Gcd(const Element &a, const Element &b) const
+{
+	Element g[3]={b, a};
+	unsigned int i0=0, i1=1, i2=2;
+
+	while (!this->Equal(g[i1], this->Identity()))
+	{
+		g[i2] = this->Mod(g[i0], g[i1]);
+		unsigned int t = i0; i0 = i1; i1 = i2; i2 = t;
+	}
+
+	return result = g[i0];
+}
+
+template <class T> const typename QuotientRing<T>::Element& QuotientRing<T>::MultiplicativeInverse(const Element &a) const
+{
+	Element g[3]={m_modulus, a};
+	Element v[3]={m_domain.Identity(), m_domain.MultiplicativeIdentity()};
+	Element y;
+	unsigned int i0=0, i1=1, i2=2;
+
+	while (!this->Equal(g[i1], this->Identity()))
+	{
+		// y = g[i0] / g[i1];
+		// g[i2] = g[i0] % g[i1];
+		m_domain.DivisionAlgorithm(g[i2], y, g[i0], g[i1]);
+		// v[i2] = v[i0] - (v[i1] * y);
+		v[i2] = m_domain.Subtract(v[i0], m_domain.Multiply(v[i1], y));
+		unsigned int t = i0; i0 = i1; i1 = i2; i2 = t;
+	}
+
+	return m_domain.IsUnit(g[i0]) ? m_domain.Divide(v[i0], g[i0]) : m_domain.Identity();
+}
+
+template <class T> T AbstractGroup<T>::ScalarMultiply(const Element &base, const Integer &exponent) const
+{
+	Element result;
+	this->SimultaneousMultiply(&result, base, &exponent, 1);
+	return result;
+}
+
+template <class T> T AbstractGroup<T>::CascadeScalarMultiply(const Element &x, const Integer &e1, const Element &y, const Integer &e2) const
+{
+	const unsigned expLen = STDMAX(e1.BitCount(), e2.BitCount());
+	if (expLen==0)
+		return this->Identity();
+
+	const unsigned w = (expLen <= 46 ? 1 : (expLen <= 260 ? 2 : 3));
+	const unsigned tableSize = 1<<w;
+	std::vector<Element> powerTable(tableSize << w);
+
+	powerTable[1] = x;
+	powerTable[tableSize] = y;
+	if (w==1)
+		powerTable[3] = this->Add(x,y);
+	else
+	{
+		powerTable[2] = this->Double(x);
+		powerTable[2*tableSize] = this->Double(y);
+
+		unsigned i, j;
+
+		for (i=3; i<tableSize; i+=2)
+			powerTable[i] = Add(powerTable[i-2], powerTable[2]);
+		for (i=1; i<tableSize; i+=2)
+			for (j=i+tableSize; j<(tableSize<<w); j+=tableSize)
+				powerTable[j] = Add(powerTable[j-tableSize], y);
+
+		for (i=3*tableSize; i<(tableSize<<w); i+=2*tableSize)
+			powerTable[i] = Add(powerTable[i-2*tableSize], powerTable[2*tableSize]);
+		for (i=tableSize; i<(tableSize<<w); i+=2*tableSize)
+			for (j=i+2; j<i+tableSize; j+=2)
+				powerTable[j] = Add(powerTable[j-1], x);
+	}
+
+	Element result;
+	unsigned power1 = 0, power2 = 0, prevPosition = expLen-1;
+	bool firstTime = true;
+
+	for (int i = expLen-1; i>=0; i--)
+	{
+		power1 = 2*power1 + e1.GetBit(i);
+		power2 = 2*power2 + e2.GetBit(i);
+
+		if (i==0 || 2*power1 >= tableSize || 2*power2 >= tableSize)
+		{
+			unsigned squaresBefore = prevPosition-i;
+			unsigned squaresAfter = 0;
+			prevPosition = i;
+			while ((power1 || power2) && power1%2 == 0 && power2%2==0)
+			{
+				power1 /= 2;
+				power2 /= 2;
+				squaresBefore--;
+				squaresAfter++;
+			}
+			if (firstTime)
+			{
+				result = powerTable[(power2<<w) + power1];
+				firstTime = false;
+			}
+			else
+			{
+				while (squaresBefore--)
+					result = this->Double(result);
+				if (power1 || power2)
+					Accumulate(result, powerTable[(power2<<w) + power1]);
+			}
+			while (squaresAfter--)
+				result = this->Double(result);
+			power1 = power2 = 0;
+		}
+	}
+	return result;
+}
+
+template <class Element, class Iterator> Element GeneralCascadeMultiplication(const AbstractGroup<Element> &group, Iterator begin, Iterator end)
+{
+	if (end-begin == 1)
+		return group.ScalarMultiply(begin->base, begin->exponent);
+	else if (end-begin == 2)
+		return group.CascadeScalarMultiply(begin->base, begin->exponent, (begin+1)->base, (begin+1)->exponent);
+	else
+	{
+		Integer q, t;
+		Iterator last = end;
+		--last;
+
+		std::make_heap(begin, end);
+		std::pop_heap(begin, end);
+
+		while (!!begin->exponent)
+		{
+			// last->exponent is largest exponent, begin->exponent is next largest
+			t = last->exponent;
+			Integer::Divide(last->exponent, q, t, begin->exponent);
+
+			if (q == Integer::One())
+				group.Accumulate(begin->base, last->base);	// avoid overhead of ScalarMultiply()
+			else
+				group.Accumulate(begin->base, group.ScalarMultiply(last->base, q));
+
+			std::push_heap(begin, end);
+			std::pop_heap(begin, end);
+		}
+
+		return group.ScalarMultiply(last->base, last->exponent);
+	}
+}
+
+struct WindowSlider
+{
+	WindowSlider(const Integer &expIn, bool fastNegate, unsigned int windowSizeIn=0)
+		: exp(expIn), windowModulus(Integer::One()), windowSize(windowSizeIn), windowBegin(0), expWindow(0)
+		, fastNegate(fastNegate), negateNext(false), firstTime(true), finished(false)
+	{
+		if (windowSize == 0)
+		{
+			unsigned int expLen = exp.BitCount();
+			windowSize = expLen <= 17 ? 1 : (expLen <= 24 ? 2 : (expLen <= 70 ? 3 : (expLen <= 197 ? 4 : (expLen <= 539 ? 5 : (expLen <= 1434 ? 6 : 7)))));
+		}
+		windowModulus <<= windowSize;
+	}
+
+	void FindNextWindow()
+	{
+		unsigned int expLen = exp.WordCount() * WORD_BITS;
+		unsigned int skipCount = firstTime ? 0 : windowSize;
+		firstTime = false;
+		while (!exp.GetBit(skipCount))
+		{
+			if (skipCount >= expLen)
+			{
+				finished = true;
+				return;
+			}
+			skipCount++;
+		}
+
+		exp >>= skipCount;
+		windowBegin += skipCount;
+		expWindow = word32(exp % (word(1) << windowSize));
+
+		if (fastNegate && exp.GetBit(windowSize))
+		{
+			negateNext = true;
+			expWindow = (word32(1) << windowSize) - expWindow;
+			exp += windowModulus;
+		}
+		else
+			negateNext = false;
+	}
+
+	Integer exp, windowModulus;
+	unsigned int windowSize, windowBegin;
+	word32 expWindow;
+	bool fastNegate, negateNext, firstTime, finished;
+};
+
+template <class T>
+void AbstractGroup<T>::SimultaneousMultiply(T *results, const T &base, const Integer *expBegin, unsigned int expCount) const
+{
+	std::vector<std::vector<Element> > buckets(expCount);
+	std::vector<WindowSlider> exponents;
+	exponents.reserve(expCount);
+	unsigned int i;
+
+	for (i=0; expBegin && i<expCount; i++)
+	{
+		CRYPTOPP_ASSERT(expBegin->NotNegative());
+		exponents.push_back(WindowSlider(*expBegin++, InversionIsFast(), 0));
+		exponents[i].FindNextWindow();
+		buckets[i].resize(((size_t) 1) << (exponents[i].windowSize-1), Identity());
+	}
+
+	unsigned int expBitPosition = 0;
+	Element g = base;
+	bool notDone = true;
+
+	while (notDone)
+	{
+		notDone = false;
+		for (i=0; i<expCount; i++)
+		{
+			if (!exponents[i].finished && expBitPosition == exponents[i].windowBegin)
+			{
+				Element &bucket = buckets[i][exponents[i].expWindow/2];
+				if (exponents[i].negateNext)
+					Accumulate(bucket, Inverse(g));
+				else
+					Accumulate(bucket, g);
+				exponents[i].FindNextWindow();
+			}
+			notDone = notDone || !exponents[i].finished;
+		}
+
+		if (notDone)
+		{
+			g = Double(g);
+			expBitPosition++;
+		}
+	}
+
+	for (i=0; i<expCount; i++)
+	{
+		Element &r = *results++;
+		r = buckets[i][buckets[i].size()-1];
+		if (buckets[i].size() > 1)
+		{
+			for (int j = (int)buckets[i].size()-2; j >= 1; j--)
+			{
+				Accumulate(buckets[i][j], buckets[i][j+1]);
+				Accumulate(r, buckets[i][j]);
+			}
+			Accumulate(buckets[i][0], buckets[i][1]);
+			r = Add(Double(r), buckets[i][0]);
+		}
+	}
+}
+
+template <class T> T AbstractRing<T>::Exponentiate(const Element &base, const Integer &exponent) const
+{
+	Element result;
+	SimultaneousExponentiate(&result, base, &exponent, 1);
+	return result;
+}
+
+template <class T> T AbstractRing<T>::CascadeExponentiate(const Element &x, const Integer &e1, const Element &y, const Integer &e2) const
+{
+	return MultiplicativeGroup().AbstractGroup<T>::CascadeScalarMultiply(x, e1, y, e2);
+}
+
+template <class Element, class Iterator> Element GeneralCascadeExponentiation(const AbstractRing<Element> &ring, Iterator begin, Iterator end)
+{
+	return GeneralCascadeMultiplication<Element>(ring.MultiplicativeGroup(), begin, end);
+}
+
+template <class T>
+void AbstractRing<T>::SimultaneousExponentiate(T *results, const T &base, const Integer *exponents, unsigned int expCount) const
+{
+	MultiplicativeGroup().AbstractGroup<T>::SimultaneousMultiply(results, base, exponents, expCount);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/algebra.h b/runtime/third_party/cryptopp/algebra.h
new file mode 100644
index 0000000..1e04dff
--- /dev/null
+++ b/runtime/third_party/cryptopp/algebra.h
@@ -0,0 +1,453 @@
+// algebra.h - originally written and placed in the public domain by Wei Dai
+
+/// \file algebra.h
+/// \brief Classes for performing mathematics over different fields
+
+#ifndef CRYPTOPP_ALGEBRA_H
+#define CRYPTOPP_ALGEBRA_H
+
+#include "config.h"
+#include "integer.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+class Integer;
+
+/// \brief Abstract group
+/// \tparam T element class or type
+/// \details <tt>const Element&</tt> returned by member functions are references
+///   to internal data members. Since each object may have only
+///   one such data member for holding results, the following code
+///   will produce incorrect results:
+///   <pre>    abcd = group.Add(group.Add(a,b), group.Add(c,d));</pre>
+///   But this should be fine:
+///   <pre>    abcd = group.Add(a, group.Add(b, group.Add(c,d));</pre>
+template <class T> class CRYPTOPP_NO_VTABLE AbstractGroup
+{
+public:
+	typedef T Element;
+
+	virtual ~AbstractGroup() {}
+
+	/// \brief Compare two elements for equality
+	/// \param a first element
+	/// \param b second element
+	/// \return true if the elements are equal, false otherwise
+	/// \details Equal() tests the elements for equality using <tt>a==b</tt>
+	virtual bool Equal(const Element &a, const Element &b) const =0;
+
+	/// \brief Provides the Identity element
+	/// \return the Identity element
+	virtual const Element& Identity() const =0;
+
+	/// \brief Adds elements in the group
+	/// \param a first element
+	/// \param b second element
+	/// \return the sum of <tt>a</tt> and <tt>b</tt>
+	virtual const Element& Add(const Element &a, const Element &b) const =0;
+
+	/// \brief Inverts the element in the group
+	/// \param a first element
+	/// \return the inverse of the element
+	virtual const Element& Inverse(const Element &a) const =0;
+
+	/// \brief Determine if inversion is fast
+	/// \return true if inversion is fast, false otherwise
+	virtual bool InversionIsFast() const {return false;}
+
+	/// \brief Doubles an element in the group
+	/// \param a the element
+	/// \return the element doubled
+	virtual const Element& Double(const Element &a) const;
+
+	/// \brief Subtracts elements in the group
+	/// \param a first element
+	/// \param b second element
+	/// \return the difference of <tt>a</tt> and <tt>b</tt>. The element <tt>a</tt> must provide a Subtract member function.
+	virtual const Element& Subtract(const Element &a, const Element &b) const;
+
+	/// \brief TODO
+	/// \param a first element
+	/// \param b second element
+	/// \return TODO
+	virtual Element& Accumulate(Element &a, const Element &b) const;
+
+	/// \brief Reduces an element in the congruence class
+	/// \param a element to reduce
+	/// \param b the congruence class
+	/// \return the reduced element
+	virtual Element& Reduce(Element &a, const Element &b) const;
+
+	/// \brief Performs a scalar multiplication
+	/// \param a multiplicand
+	/// \param e multiplier
+	/// \return the product
+	virtual Element ScalarMultiply(const Element &a, const Integer &e) const;
+
+	/// \brief TODO
+	/// \param x first multiplicand
+	/// \param e1 the first multiplier
+	/// \param y second multiplicand
+	/// \param e2 the second multiplier
+	/// \return TODO
+	virtual Element CascadeScalarMultiply(const Element &x, const Integer &e1, const Element &y, const Integer &e2) const;
+
+	/// \brief Multiplies a base to multiple exponents in a group
+	/// \param results an array of Elements
+	/// \param base the base to raise to the exponents
+	/// \param exponents an array of exponents
+	/// \param exponentsCount the number of exponents in the array
+	/// \details SimultaneousMultiply() multiplies the base to each exponent in the exponents array and stores the
+	///   result at the respective position in the results array.
+	/// \details SimultaneousMultiply() must be implemented in a derived class.
+	/// \pre <tt>COUNTOF(results) == exponentsCount</tt>
+	/// \pre <tt>COUNTOF(exponents) == exponentsCount</tt>
+	virtual void SimultaneousMultiply(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const;
+};
+
+/// \brief Abstract ring
+/// \tparam T element class or type
+/// \details <tt>const Element&</tt> returned by member functions are references
+///   to internal data members. Since each object may have only
+///   one such data member for holding results, the following code
+///   will produce incorrect results:
+///   <pre>    abcd = group.Add(group.Add(a,b), group.Add(c,d));</pre>
+///   But this should be fine:
+///   <pre>    abcd = group.Add(a, group.Add(b, group.Add(c,d));</pre>
+template <class T> class CRYPTOPP_NO_VTABLE AbstractRing : public AbstractGroup<T>
+{
+public:
+	typedef T Element;
+
+	/// \brief Construct an AbstractRing
+	AbstractRing() {m_mg.m_pRing = this;}
+
+	/// \brief Copy construct an AbstractRing
+	/// \param source other AbstractRing
+	AbstractRing(const AbstractRing &source)
+		{CRYPTOPP_UNUSED(source); m_mg.m_pRing = this;}
+
+	/// \brief Assign an AbstractRing
+	/// \param source other AbstractRing
+	AbstractRing& operator=(const AbstractRing &source)
+		{CRYPTOPP_UNUSED(source); return *this;}
+
+	/// \brief Determines whether an element is a unit in the group
+	/// \param a the element
+	/// \return true if the element is a unit after reduction, false otherwise.
+	virtual bool IsUnit(const Element &a) const =0;
+
+	/// \brief Retrieves the multiplicative identity
+	/// \return the multiplicative identity
+	virtual const Element& MultiplicativeIdentity() const =0;
+
+	/// \brief Multiplies elements in the group
+	/// \param a the multiplicand
+	/// \param b the multiplier
+	/// \return the product of a and b
+	virtual const Element& Multiply(const Element &a, const Element &b) const =0;
+
+	/// \brief Calculate the multiplicative inverse of an element in the group
+	/// \param a the element
+	virtual const Element& MultiplicativeInverse(const Element &a) const =0;
+
+	/// \brief Square an element in the group
+	/// \param a the element
+	/// \return the element squared
+	virtual const Element& Square(const Element &a) const;
+
+	/// \brief Divides elements in the group
+	/// \param a the dividend
+	/// \param b the divisor
+	/// \return the quotient
+	virtual const Element& Divide(const Element &a, const Element &b) const;
+
+	/// \brief Raises a base to an exponent in the group
+	/// \param a the base
+	/// \param e the exponent
+	/// \return the exponentiation
+	virtual Element Exponentiate(const Element &a, const Integer &e) const;
+
+	/// \brief TODO
+	/// \param x first element
+	/// \param e1 first exponent
+	/// \param y second element
+	/// \param e2 second exponent
+	/// \return TODO
+	virtual Element CascadeExponentiate(const Element &x, const Integer &e1, const Element &y, const Integer &e2) const;
+
+	/// \brief Exponentiates a base to multiple exponents in the Ring
+	/// \param results an array of Elements
+	/// \param base the base to raise to the exponents
+	/// \param exponents an array of exponents
+	/// \param exponentsCount the number of exponents in the array
+	/// \details SimultaneousExponentiate() raises the base to each exponent in the exponents array and stores the
+	///   result at the respective position in the results array.
+	/// \details SimultaneousExponentiate() must be implemented in a derived class.
+	/// \pre <tt>COUNTOF(results) == exponentsCount</tt>
+	/// \pre <tt>COUNTOF(exponents) == exponentsCount</tt>
+	virtual void SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const;
+
+	/// \brief Retrieves the multiplicative group
+	/// \return the multiplicative group
+	virtual const AbstractGroup<T>& MultiplicativeGroup() const
+		{return m_mg;}
+
+private:
+	class MultiplicativeGroupT : public AbstractGroup<T>
+	{
+	public:
+		const AbstractRing<T>& GetRing() const
+			{return *m_pRing;}
+
+		bool Equal(const Element &a, const Element &b) const
+			{return GetRing().Equal(a, b);}
+
+		const Element& Identity() const
+			{return GetRing().MultiplicativeIdentity();}
+
+		const Element& Add(const Element &a, const Element &b) const
+			{return GetRing().Multiply(a, b);}
+
+		Element& Accumulate(Element &a, const Element &b) const
+			{return a = GetRing().Multiply(a, b);}
+
+		const Element& Inverse(const Element &a) const
+			{return GetRing().MultiplicativeInverse(a);}
+
+		const Element& Subtract(const Element &a, const Element &b) const
+			{return GetRing().Divide(a, b);}
+
+		Element& Reduce(Element &a, const Element &b) const
+			{return a = GetRing().Divide(a, b);}
+
+		const Element& Double(const Element &a) const
+			{return GetRing().Square(a);}
+
+		Element ScalarMultiply(const Element &a, const Integer &e) const
+			{return GetRing().Exponentiate(a, e);}
+
+		Element CascadeScalarMultiply(const Element &x, const Integer &e1, const Element &y, const Integer &e2) const
+			{return GetRing().CascadeExponentiate(x, e1, y, e2);}
+
+		void SimultaneousMultiply(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const
+			{GetRing().SimultaneousExponentiate(results, base, exponents, exponentsCount);}
+
+		const AbstractRing<T> *m_pRing;
+	};
+
+	MultiplicativeGroupT m_mg;
+};
+
+// ********************************************************
+
+/// \brief Base and exponent
+/// \tparam T base class or type
+/// \tparam E exponent class or type
+template <class T, class E = Integer>
+struct BaseAndExponent
+{
+public:
+	BaseAndExponent() {}
+	BaseAndExponent(const T &base, const E &exponent) : base(base), exponent(exponent) {}
+	bool operator<(const BaseAndExponent<T, E> &rhs) const {return exponent < rhs.exponent;}
+	T base;
+	E exponent;
+};
+
+// VC60 workaround: incomplete member template support
+template <class Element, class Iterator>
+	Element GeneralCascadeMultiplication(const AbstractGroup<Element> &group, Iterator begin, Iterator end);
+template <class Element, class Iterator>
+	Element GeneralCascadeExponentiation(const AbstractRing<Element> &ring, Iterator begin, Iterator end);
+
+// ********************************************************
+
+/// \brief Abstract Euclidean domain
+/// \tparam T element class or type
+/// \details <tt>const Element&</tt> returned by member functions are references
+///   to internal data members. Since each object may have only
+///   one such data member for holding results, the following code
+///   will produce incorrect results:
+///   <pre>    abcd = group.Add(group.Add(a,b), group.Add(c,d));</pre>
+///   But this should be fine:
+///   <pre>    abcd = group.Add(a, group.Add(b, group.Add(c,d));</pre>
+template <class T> class CRYPTOPP_NO_VTABLE AbstractEuclideanDomain : public AbstractRing<T>
+{
+public:
+	typedef T Element;
+
+	/// \brief Performs the division algorithm on two elements in the ring
+	/// \param r the remainder
+	/// \param q the quotient
+	/// \param a the dividend
+	/// \param d the divisor
+	virtual void DivisionAlgorithm(Element &r, Element &q, const Element &a, const Element &d) const =0;
+
+	/// \brief Performs a modular reduction in the ring
+	/// \param a the element
+	/// \param b the modulus
+	/// \return the result of <tt>a%b</tt>.
+	virtual const Element& Mod(const Element &a, const Element &b) const =0;
+
+	/// \brief Calculates the greatest common denominator in the ring
+	/// \param a the first element
+	/// \param b the second element
+	/// \return the greatest common denominator of a and b.
+	virtual const Element& Gcd(const Element &a, const Element &b) const;
+
+protected:
+	mutable Element result;
+};
+
+// ********************************************************
+
+/// \brief Euclidean domain
+/// \tparam T element class or type
+/// \details <tt>const Element&</tt> returned by member functions are references
+///   to internal data members. Since each object may have only
+///   one such data member for holding results, the following code
+///   will produce incorrect results:
+///   <pre>    abcd = group.Add(group.Add(a,b), group.Add(c,d));</pre>
+///   But this should be fine:
+///   <pre>    abcd = group.Add(a, group.Add(b, group.Add(c,d));</pre>
+template <class T> class EuclideanDomainOf : public AbstractEuclideanDomain<T>
+{
+public:
+	typedef T Element;
+
+	EuclideanDomainOf() {}
+
+	bool Equal(const Element &a, const Element &b) const
+		{return a==b;}
+
+	const Element& Identity() const
+		{return Element::Zero();}
+
+	const Element& Add(const Element &a, const Element &b) const
+		{return result = a+b;}
+
+	Element& Accumulate(Element &a, const Element &b) const
+		{return a+=b;}
+
+	const Element& Inverse(const Element &a) const
+		{return result = -a;}
+
+	const Element& Subtract(const Element &a, const Element &b) const
+		{return result = a-b;}
+
+	Element& Reduce(Element &a, const Element &b) const
+		{return a-=b;}
+
+	const Element& Double(const Element &a) const
+		{return result = a.Doubled();}
+
+	const Element& MultiplicativeIdentity() const
+		{return Element::One();}
+
+	const Element& Multiply(const Element &a, const Element &b) const
+		{return result = a*b;}
+
+	const Element& Square(const Element &a) const
+		{return result = a.Squared();}
+
+	bool IsUnit(const Element &a) const
+		{return a.IsUnit();}
+
+	const Element& MultiplicativeInverse(const Element &a) const
+		{return result = a.MultiplicativeInverse();}
+
+	const Element& Divide(const Element &a, const Element &b) const
+		{return result = a/b;}
+
+	const Element& Mod(const Element &a, const Element &b) const
+		{return result = a%b;}
+
+	void DivisionAlgorithm(Element &r, Element &q, const Element &a, const Element &d) const
+		{Element::Divide(r, q, a, d);}
+
+	bool operator==(const EuclideanDomainOf<T> &rhs) const
+		{CRYPTOPP_UNUSED(rhs); return true;}
+
+private:
+	mutable Element result;
+};
+
+/// \brief Quotient ring
+/// \tparam T element class or type
+/// \details <tt>const Element&</tt> returned by member functions are references
+///   to internal data members. Since each object may have only
+///   one such data member for holding results, the following code
+///   will produce incorrect results:
+///   <pre>    abcd = group.Add(group.Add(a,b), group.Add(c,d));</pre>
+///   But this should be fine:
+///   <pre>    abcd = group.Add(a, group.Add(b, group.Add(c,d));</pre>
+template <class T> class QuotientRing : public AbstractRing<typename T::Element>
+{
+public:
+	typedef T EuclideanDomain;
+	typedef typename T::Element Element;
+
+	QuotientRing(const EuclideanDomain &domain, const Element &modulus)
+		: m_domain(domain), m_modulus(modulus) {}
+
+	const EuclideanDomain & GetDomain() const
+		{return m_domain;}
+
+	const Element& GetModulus() const
+		{return m_modulus;}
+
+	bool Equal(const Element &a, const Element &b) const
+		{return m_domain.Equal(m_domain.Mod(m_domain.Subtract(a, b), m_modulus), m_domain.Identity());}
+
+	const Element& Identity() const
+		{return m_domain.Identity();}
+
+	const Element& Add(const Element &a, const Element &b) const
+		{return m_domain.Add(a, b);}
+
+	Element& Accumulate(Element &a, const Element &b) const
+		{return m_domain.Accumulate(a, b);}
+
+	const Element& Inverse(const Element &a) const
+		{return m_domain.Inverse(a);}
+
+	const Element& Subtract(const Element &a, const Element &b) const
+		{return m_domain.Subtract(a, b);}
+
+	Element& Reduce(Element &a, const Element &b) const
+		{return m_domain.Reduce(a, b);}
+
+	const Element& Double(const Element &a) const
+		{return m_domain.Double(a);}
+
+	bool IsUnit(const Element &a) const
+		{return m_domain.IsUnit(m_domain.Gcd(a, m_modulus));}
+
+	const Element& MultiplicativeIdentity() const
+		{return m_domain.MultiplicativeIdentity();}
+
+	const Element& Multiply(const Element &a, const Element &b) const
+		{return m_domain.Mod(m_domain.Multiply(a, b), m_modulus);}
+
+	const Element& Square(const Element &a) const
+		{return m_domain.Mod(m_domain.Square(a), m_modulus);}
+
+	const Element& MultiplicativeInverse(const Element &a) const;
+
+	bool operator==(const QuotientRing<T> &rhs) const
+		{return m_domain == rhs.m_domain && m_modulus == rhs.m_modulus;}
+
+protected:
+	EuclideanDomain m_domain;
+	Element m_modulus;
+};
+
+NAMESPACE_END
+
+#ifdef CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES
+#include "algebra.cpp"
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/algparam.cpp b/runtime/third_party/cryptopp/algparam.cpp
new file mode 100644
index 0000000..268096f
--- /dev/null
+++ b/runtime/third_party/cryptopp/algparam.cpp
@@ -0,0 +1,75 @@
+// algparam.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "algparam.h"
+#include "integer.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+bool CombinedNameValuePairs::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	if (strcmp(name, "ValueNames") == 0)
+		return m_pairs1.GetVoidValue(name, valueType, pValue) && m_pairs2.GetVoidValue(name, valueType, pValue);
+	else
+		return m_pairs1.GetVoidValue(name, valueType, pValue) || m_pairs2.GetVoidValue(name, valueType, pValue);
+}
+
+void AlgorithmParametersBase::operator=(const AlgorithmParametersBase &rhs)
+{
+	CRYPTOPP_UNUSED(rhs);
+	CRYPTOPP_ASSERT(false);
+}
+
+bool AlgorithmParametersBase::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	if (strcmp(name, "ValueNames") == 0)
+	{
+		NameValuePairs::ThrowIfTypeMismatch(name, typeid(std::string), valueType);
+		if (m_next.get())
+		    m_next->GetVoidValue(name, valueType, pValue);
+		(*reinterpret_cast<std::string *>(pValue) += m_name) += ";";
+		return true;
+	}
+	else if (strcmp(name, m_name) == 0)
+	{
+		AssignValue(name, valueType, pValue);
+		m_used = true;
+		return true;
+	}
+	else if (m_next.get())
+		return m_next->GetVoidValue(name, valueType, pValue);
+	else
+	    return false;
+}
+
+AlgorithmParameters::AlgorithmParameters()
+	: m_defaultThrowIfNotUsed(true)
+{
+}
+
+AlgorithmParameters::AlgorithmParameters(const AlgorithmParameters &x)
+	: m_defaultThrowIfNotUsed(x.m_defaultThrowIfNotUsed)
+{
+	m_next.reset(const_cast<AlgorithmParameters &>(x).m_next.release());
+}
+
+AlgorithmParameters & AlgorithmParameters::operator=(const AlgorithmParameters &x)
+{
+	m_next.reset(const_cast<AlgorithmParameters &>(x).m_next.release());
+	return *this;
+}
+
+bool AlgorithmParameters::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	if (m_next.get())
+		return m_next->GetVoidValue(name, valueType, pValue);
+	else
+		return false;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/algparam.h b/runtime/third_party/cryptopp/algparam.h
new file mode 100644
index 0000000..72dae19
--- /dev/null
+++ b/runtime/third_party/cryptopp/algparam.h
@@ -0,0 +1,520 @@
+// algparam.h - originally written and placed in the public domain by Wei Dai
+
+/// \file algparam.h
+/// \brief Classes for working with NameValuePairs
+
+#ifndef CRYPTOPP_ALGPARAM_H
+#define CRYPTOPP_ALGPARAM_H
+
+#include "config.h"
+#include "cryptlib.h"
+
+#include "smartptr.h"
+#include "secblock.h"
+#include "integer.h"
+#include "misc.h"
+
+#include <string>
+#include <typeinfo>
+#include <exception>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Used to pass byte array input as part of a NameValuePairs object
+class ConstByteArrayParameter
+{
+public:
+	/// \brief Construct a ConstByteArrayParameter
+	/// \param data a C-String
+	/// \param deepCopy flag indicating whether the data should be copied
+	/// \details The deepCopy option is used when the NameValuePairs object can't
+	///   keep a copy of the data available
+	ConstByteArrayParameter(const char *data = NULLPTR, bool deepCopy = false)
+		: m_deepCopy(false), m_data(NULLPTR), m_size(0)
+	{
+		Assign(reinterpret_cast<const byte *>(data), data ? strlen(data) : 0, deepCopy);
+	}
+
+	/// \brief Construct a ConstByteArrayParameter
+	/// \param data a memory buffer
+	/// \param size the length of the memory buffer
+	/// \param deepCopy flag indicating whether the data should be copied
+	/// \details The deepCopy option is used when the NameValuePairs object can't
+	///   keep a copy of the data available
+	ConstByteArrayParameter(const byte *data, size_t size, bool deepCopy = false)
+		: m_deepCopy(false), m_data(NULLPTR), m_size(0)
+	{
+		Assign(data, size, deepCopy);
+	}
+
+	/// \brief Construct a ConstByteArrayParameter
+	/// \tparam T a std::basic_string<char> or std::vector<byte> class
+	/// \param string a std::basic_string<char> or std::vector<byte> object
+	/// \param deepCopy flag indicating whether the data should be copied
+	/// \details The deepCopy option is used when the NameValuePairs object can't
+	///   keep a copy of the data available
+	template <class T> ConstByteArrayParameter(const T &string, bool deepCopy = false)
+		: m_deepCopy(false), m_data(NULLPTR), m_size(0)
+	{
+		CRYPTOPP_COMPILE_ASSERT(sizeof(typename T::value_type) == 1);
+		Assign(reinterpret_cast<const byte *>(&string[0]), string.size(), deepCopy);
+	}
+
+	/// \brief Assign contents from a memory buffer
+	/// \param data a memory buffer
+	/// \param size the length of the memory buffer
+	/// \param deepCopy flag indicating whether the data should be copied
+	/// \details The deepCopy option is used when the NameValuePairs object can't
+	///   keep a copy of the data available
+	void Assign(const byte *data, size_t size, bool deepCopy)
+	{
+		// This fires, which means: no data with a size, or data with no size.
+		// CRYPTOPP_ASSERT((data && size) || !(data || size));
+		if (deepCopy)
+			m_block.Assign(data, size);
+		else
+		{
+			m_data = data;
+			m_size = size;
+		}
+		m_deepCopy = deepCopy;
+	}
+
+	/// \brief Pointer to the first byte in the memory block
+	const byte *begin() const {return m_deepCopy ? m_block.begin() : m_data;}
+	/// \brief Pointer beyond the last byte in the memory block
+	const byte *end() const {return m_deepCopy ? m_block.end() : m_data + m_size;}
+	/// \brief Length of the memory block
+	size_t size() const {return m_deepCopy ? m_block.size() : m_size;}
+
+private:
+	bool m_deepCopy;
+	const byte *m_data;
+	size_t m_size;
+	SecByteBlock m_block;
+};
+
+/// \brief Used to pass byte array input as part of a NameValuePairs object
+class ByteArrayParameter
+{
+public:
+	/// \brief Construct a ByteArrayParameter
+	/// \param data a memory buffer
+	/// \param size the length of the memory buffer
+	ByteArrayParameter(byte *data = NULLPTR, unsigned int size = 0)
+		: m_data(data), m_size(size) {}
+
+	/// \brief Construct a ByteArrayParameter
+	/// \param block a SecByteBlock
+	ByteArrayParameter(SecByteBlock &block)
+		: m_data(block.begin()), m_size(block.size()) {}
+
+	/// \brief Pointer to the first byte in the memory block
+	byte *begin() const {return m_data;}
+	/// \brief Pointer beyond the last byte in the memory block
+	byte *end() const {return m_data + m_size;}
+	/// \brief Length of the memory block
+	size_t size() const {return m_size;}
+
+private:
+	byte *m_data;
+	size_t m_size;
+};
+
+/// \brief Combines two sets of NameValuePairs
+/// \details CombinedNameValuePairs allows you to provide two sets of of NameValuePairs.
+///   If a name is not found in the first set, then the second set is searched for the
+///   name and value pair. The second set of NameValuePairs often provides default values.
+class CRYPTOPP_DLL CombinedNameValuePairs : public NameValuePairs
+{
+public:
+	/// \brief Construct a CombinedNameValuePairs
+	/// \param pairs1 reference to the first set of NameValuePairs
+	/// \param pairs2 reference to the second set of NameValuePairs
+	CombinedNameValuePairs(const NameValuePairs &pairs1, const NameValuePairs &pairs2)
+		: m_pairs1(pairs1), m_pairs2(pairs2) {}
+
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+
+private:
+	const NameValuePairs &m_pairs1, &m_pairs2;
+};
+
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+template <class T, class BASE>
+class GetValueHelperClass
+{
+public:
+	GetValueHelperClass(const T *pObject, const char *name, const std::type_info &valueType, void *pValue, const NameValuePairs *searchFirst)
+		: m_pObject(pObject), m_name(name), m_valueType(&valueType), m_pValue(pValue), m_found(false), m_getValueNames(false)
+	{
+		if (strcmp(m_name, "ValueNames") == 0)
+		{
+			m_found = m_getValueNames = true;
+			NameValuePairs::ThrowIfTypeMismatch(m_name, typeid(std::string), *m_valueType);
+			if (searchFirst)
+				searchFirst->GetVoidValue(m_name, valueType, pValue);
+			if (typeid(T) != typeid(BASE))
+				pObject->BASE::GetVoidValue(m_name, valueType, pValue);
+			((*reinterpret_cast<std::string *>(m_pValue) += "ThisPointer:") += typeid(T).name()) += ';';
+		}
+
+		if (!m_found && strncmp(m_name, "ThisPointer:", 12) == 0 && strcmp(m_name+12, typeid(T).name()) == 0)
+		{
+			NameValuePairs::ThrowIfTypeMismatch(m_name, typeid(T *), *m_valueType);
+			*reinterpret_cast<const T **>(pValue) = pObject;
+			m_found = true;
+			return;
+		}
+
+		if (!m_found && searchFirst)
+			m_found = searchFirst->GetVoidValue(m_name, valueType, pValue);
+
+		if (!m_found && typeid(T) != typeid(BASE))
+			m_found = pObject->BASE::GetVoidValue(m_name, valueType, pValue);
+	}
+
+	operator bool() const {return m_found;}
+
+	template <class R>
+	GetValueHelperClass<T,BASE> & operator()(const char *name, const R & (T::*pm)() const)
+	{
+		if (m_getValueNames)
+			(*reinterpret_cast<std::string *>(m_pValue) += name) += ";";
+		if (!m_found && strcmp(name, m_name) == 0)
+		{
+			NameValuePairs::ThrowIfTypeMismatch(name, typeid(R), *m_valueType);
+			*reinterpret_cast<R *>(m_pValue) = (m_pObject->*pm)();
+			m_found = true;
+		}
+		return *this;
+	}
+
+	GetValueHelperClass<T,BASE> &Assignable()
+	{
+#ifndef __INTEL_COMPILER	// ICL 9.1 workaround: Intel compiler copies the vTable pointer for some reason
+		if (m_getValueNames)
+			((*reinterpret_cast<std::string *>(m_pValue) += "ThisObject:") += typeid(T).name()) += ';';
+		if (!m_found && strncmp(m_name, "ThisObject:", 11) == 0 && strcmp(m_name+11, typeid(T).name()) == 0)
+		{
+			NameValuePairs::ThrowIfTypeMismatch(m_name, typeid(T), *m_valueType);
+			*reinterpret_cast<T *>(m_pValue) = *m_pObject;
+			m_found = true;
+		}
+#endif
+		return *this;
+	}
+
+private:
+	const T *m_pObject;
+	const char *m_name;
+	const std::type_info *m_valueType;
+	void *m_pValue;
+	bool m_found, m_getValueNames;
+};
+
+template <class BASE, class T>
+GetValueHelperClass<T, BASE> GetValueHelper(const T *pObject, const char *name, const std::type_info &valueType, void *pValue, const NameValuePairs *searchFirst=NULLPTR)
+{
+	return GetValueHelperClass<T, BASE>(pObject, name, valueType, pValue, searchFirst);
+}
+
+template <class T>
+GetValueHelperClass<T, T> GetValueHelper(const T *pObject, const char *name, const std::type_info &valueType, void *pValue, const NameValuePairs *searchFirst=NULLPTR)
+{
+	return GetValueHelperClass<T, T>(pObject, name, valueType, pValue, searchFirst);
+}
+
+// ********************************************************
+
+template <class T, class BASE>
+class AssignFromHelperClass
+{
+public:
+	AssignFromHelperClass(T *pObject, const NameValuePairs &source)
+		: m_pObject(pObject), m_source(source), m_done(false)
+	{
+		if (source.GetThisObject(*pObject))
+			m_done = true;
+		else if (typeid(BASE) != typeid(T))
+			pObject->BASE::AssignFrom(source);
+	}
+
+	template <class R>
+	AssignFromHelperClass & operator()(const char *name, void (T::*pm)(const R&))
+	{
+		if (!m_done)
+		{
+			R value;
+			if (!m_source.GetValue(name, value))
+				throw InvalidArgument(std::string(typeid(T).name()) + ": Missing required parameter '" + name + "'");
+			(m_pObject->*pm)(value);
+		}
+		return *this;
+	}
+
+	template <class R, class S>
+	AssignFromHelperClass & operator()(const char *name1, const char *name2, void (T::*pm)(const R&, const S&))
+	{
+		if (!m_done)
+		{
+			R value1;
+			if (!m_source.GetValue(name1, value1))
+				throw InvalidArgument(std::string(typeid(T).name()) + ": Missing required parameter '" + name1 + "'");
+			S value2;
+			if (!m_source.GetValue(name2, value2))
+				throw InvalidArgument(std::string(typeid(T).name()) + ": Missing required parameter '" + name2 + "'");
+			(m_pObject->*pm)(value1, value2);
+		}
+		return *this;
+	}
+
+private:
+	T *m_pObject;
+	const NameValuePairs &m_source;
+	bool m_done;
+};
+
+template <class BASE, class T>
+AssignFromHelperClass<T, BASE> AssignFromHelper(T *pObject, const NameValuePairs &source)
+{
+	return AssignFromHelperClass<T, BASE>(pObject, source);
+}
+
+template <class T>
+AssignFromHelperClass<T, T> AssignFromHelper(T *pObject, const NameValuePairs &source)
+{
+	return AssignFromHelperClass<T, T>(pObject, source);
+}
+
+#endif // CRYPTOPP_DOXYGEN_PROCESSING
+
+// ********************************************************
+
+#ifndef CRYPTOPP_NO_ASSIGN_TO_INTEGER
+// Allow the linker to discard Integer code if not needed.
+// Also see http://github.com/weidai11/cryptopp/issues/389.
+CRYPTOPP_DLL bool AssignIntToInteger(const std::type_info &valueType, void *pInteger, const void *pInt);
+#endif
+
+CRYPTOPP_DLL const std::type_info & CRYPTOPP_API IntegerTypeId();
+
+/// \brief Base class for AlgorithmParameters
+class CRYPTOPP_DLL AlgorithmParametersBase
+{
+public:
+	/// \brief Exception thrown when an AlgorithmParameter is unused
+	class ParameterNotUsed : public Exception
+	{
+	public:
+		ParameterNotUsed(const char *name) : Exception(OTHER_ERROR, std::string("AlgorithmParametersBase: parameter \"") + name + "\" not used") {}
+	};
+
+	virtual ~AlgorithmParametersBase() CRYPTOPP_THROW
+	{
+
+#if defined(CRYPTOPP_CXX17_UNCAUGHT_EXCEPTIONS)
+		if (std::uncaught_exceptions() == 0)
+#elif defined(CRYPTOPP_CXX98_UNCAUGHT_EXCEPTION)
+		if (std::uncaught_exception() == false)
+#else
+		try
+#endif
+		{
+			if (m_throwIfNotUsed && !m_used)
+				throw ParameterNotUsed(m_name);
+		}
+#if !defined(CRYPTOPP_CXX98_UNCAUGHT_EXCEPTION)
+# if !defined(CRYPTOPP_CXX17_UNCAUGHT_EXCEPTIONS)
+		catch(const Exception&)
+		{
+		}
+# endif
+#endif
+	}
+
+	// this is actually a move, not a copy
+	AlgorithmParametersBase(const AlgorithmParametersBase &x)
+		: m_name(x.m_name), m_throwIfNotUsed(x.m_throwIfNotUsed), m_used(x.m_used)
+	{
+		m_next.reset(const_cast<AlgorithmParametersBase &>(x).m_next.release());
+		x.m_used = true;
+	}
+
+	/// \brief Construct a AlgorithmParametersBase
+	/// \param name the parameter name
+	/// \param throwIfNotUsed flags indicating whether an exception should be thrown
+	/// \details If throwIfNotUsed is true, then a ParameterNotUsed exception
+	///   will be thrown in the destructor if the parameter is not not retrieved.
+	AlgorithmParametersBase(const char *name, bool throwIfNotUsed)
+		: m_name(name), m_throwIfNotUsed(throwIfNotUsed), m_used(false) {}
+
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+
+protected:
+	friend class AlgorithmParameters;
+	void operator=(const AlgorithmParametersBase& rhs);  // assignment not allowed, declare this for VC60
+
+	virtual void AssignValue(const char *name, const std::type_info &valueType, void *pValue) const =0;
+	virtual void MoveInto(void *p) const =0;	// not really const
+
+	const char *m_name;
+	bool m_throwIfNotUsed;
+	mutable bool m_used;
+	member_ptr<AlgorithmParametersBase> m_next;
+};
+
+/// \brief Template base class for AlgorithmParameters
+/// \tparam T the class or type
+template <class T>
+class AlgorithmParametersTemplate : public AlgorithmParametersBase
+{
+public:
+	/// \brief Construct an AlgorithmParametersTemplate
+	/// \param name the name of the value
+	/// \param value a reference to the value
+	/// \param throwIfNotUsed flags indicating whether an exception should be thrown
+	/// \details If throwIfNotUsed is true, then a ParameterNotUsed exception
+	///   will be thrown in the destructor if the parameter is not not retrieved.
+	AlgorithmParametersTemplate(const char *name, const T &value, bool throwIfNotUsed)
+		: AlgorithmParametersBase(name, throwIfNotUsed), m_value(value)
+	{
+	}
+
+	void AssignValue(const char *name, const std::type_info &valueType, void *pValue) const
+	{
+#ifndef CRYPTOPP_NO_ASSIGN_TO_INTEGER
+		// Special case for retrieving an Integer parameter when an int was passed in
+		if (!(typeid(T) == typeid(int) && AssignIntToInteger(valueType, pValue, &m_value)))
+#endif
+		{
+			NameValuePairs::ThrowIfTypeMismatch(name, typeid(T), valueType);
+			*reinterpret_cast<T *>(pValue) = m_value;
+		}
+	}
+
+#if defined(DEBUG_NEW) && (CRYPTOPP_MSC_VERSION >= 1300)
+# pragma push_macro("new")
+# undef new
+#endif
+
+	void MoveInto(void *buffer) const
+	{
+		AlgorithmParametersTemplate<T>* p = new(buffer) AlgorithmParametersTemplate<T>(*this);
+		CRYPTOPP_UNUSED(p);	// silence warning
+	}
+
+#if defined(DEBUG_NEW) && (CRYPTOPP_MSC_VERSION >= 1300)
+# pragma pop_macro("new")
+#endif
+
+protected:
+	T m_value;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS AlgorithmParametersTemplate<bool>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AlgorithmParametersTemplate<int>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AlgorithmParametersTemplate<ConstByteArrayParameter>;
+
+/// \brief An object that implements NameValuePairs
+/// \note A NameValuePairs object containing an arbitrary number of name value pairs may be constructed by
+///   repeatedly using operator() on the object returned by MakeParameters, for example:
+///   <pre>
+///     AlgorithmParameters parameters = MakeParameters(name1, value1)(name2, value2)(name3, value3);
+///   </pre>
+class CRYPTOPP_DLL AlgorithmParameters : public NameValuePairs
+{
+public:
+	/// \brief Construct a AlgorithmParameters
+	/// \note A NameValuePairs object containing an arbitrary number of name value pairs may be constructed by
+	///   repeatedly using operator() on the object returned by MakeParameters, for example:
+	///   <pre>
+	///     AlgorithmParameters parameters = MakeParameters(name1, value1)(name2, value2)(name3, value3);
+	///   </pre>
+	AlgorithmParameters();
+
+#ifdef __BORLANDC__
+	/// \brief Construct a AlgorithmParameters
+	/// \tparam T the class or type
+	/// \param name the name of the object or value to retrieve
+	/// \param value reference to a variable that receives the value
+	/// \param throwIfNotUsed if true, the object will throw an exception if the value is not accessed
+	/// \note throwIfNotUsed is ignored if using a compiler that does not support std::uncaught_exception(),
+	///   such as MSVC 7.0 and earlier.
+	/// \note A NameValuePairs object containing an arbitrary number of name value pairs may be constructed by
+	///   repeatedly using operator() on the object returned by MakeParameters, for example:
+	///   <pre>
+	///     AlgorithmParameters parameters = MakeParameters(name1, value1)(name2, value2)(name3, value3);
+	///   </pre>
+	template <class T>
+	AlgorithmParameters(const char *name, const T &value, bool throwIfNotUsed=true)
+		: m_next(new AlgorithmParametersTemplate<T>(name, value, throwIfNotUsed))
+		, m_defaultThrowIfNotUsed(throwIfNotUsed)
+	{
+	}
+#endif
+
+	AlgorithmParameters(const AlgorithmParameters &x);
+
+	AlgorithmParameters & operator=(const AlgorithmParameters &x);
+
+	/// \tparam T the class or type
+	/// \param name the name of the object or value to retrieve
+	/// \param value reference to a variable that receives the value
+	/// \param throwIfNotUsed if true, the object will throw an exception if the value is not accessed
+	template <class T>
+	AlgorithmParameters & operator()(const char *name, const T &value, bool throwIfNotUsed)
+	{
+		member_ptr<AlgorithmParametersBase> p(new AlgorithmParametersTemplate<T>(name, value, throwIfNotUsed));
+		p->m_next.reset(m_next.release());
+		m_next.reset(p.release());
+		m_defaultThrowIfNotUsed = throwIfNotUsed;
+		return *this;
+	}
+
+	/// \brief Appends a NameValuePair to a collection of NameValuePairs
+	/// \tparam T the class or type
+	/// \param name the name of the object or value to retrieve
+	/// \param value reference to a variable that receives the value
+	template <class T>
+	AlgorithmParameters & operator()(const char *name, const T &value)
+	{
+		return operator()(name, value, m_defaultThrowIfNotUsed);
+	}
+
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+
+protected:
+	member_ptr<AlgorithmParametersBase> m_next;
+	bool m_defaultThrowIfNotUsed;
+};
+
+/// \brief Create an object that implements NameValuePairs
+/// \tparam T the class or type
+/// \param name the name of the object or value to retrieve
+/// \param value reference to a variable that receives the value
+/// \param throwIfNotUsed if true, the object will throw an exception if the value is not accessed
+/// \note throwIfNotUsed is ignored if using a compiler that does not support std::uncaught_exception(),
+///   such as MSVC 7.0 and earlier.
+/// \note A NameValuePairs object containing an arbitrary number of name value pairs may be constructed by
+///   repeatedly using \p operator() on the object returned by \p MakeParameters, for example:
+///   <pre>
+///     AlgorithmParameters parameters = MakeParameters(name1, value1)(name2, value2)(name3, value3);
+///   </pre>
+#ifdef __BORLANDC__
+typedef AlgorithmParameters MakeParameters;
+#else
+template <class T>
+AlgorithmParameters MakeParameters(const char *name, const T &value, bool throwIfNotUsed = true)
+{
+	return AlgorithmParameters()(name, value, throwIfNotUsed);
+}
+#endif
+
+#define CRYPTOPP_GET_FUNCTION_ENTRY(name)		(Name::name(), &ThisClass::Get##name)
+#define CRYPTOPP_SET_FUNCTION_ENTRY(name)		(Name::name(), &ThisClass::Set##name)
+#define CRYPTOPP_SET_FUNCTION_ENTRY2(name1, name2)	(Name::name1(), Name::name2(), &ThisClass::Set##name1##And##name2)
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/allocate.cpp b/runtime/third_party/cryptopp/allocate.cpp
new file mode 100644
index 0000000..b85fc9d
--- /dev/null
+++ b/runtime/third_party/cryptopp/allocate.cpp
@@ -0,0 +1,104 @@
+// allocate.cpp - written and placed in the public domain by Jeffrey Walton
+
+// The functions in allocate.h and allocate.cpp were originally in misc.h
+// and misc.cpp. They were extracted in September 2019 to sidestep a circular
+// dependency with misc.h and secblock.h.
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "allocate.h"
+#include "stdcpp.h"
+#include "misc.h"
+#include "trap.h"
+
+// for memalign
+#if defined(CRYPTOPP_MEMALIGN_AVAILABLE) || defined(CRYPTOPP_MM_MALLOC_AVAILABLE) || defined(QNX)
+# include <malloc.h>
+#endif
+// for posix_memalign
+#if defined(CRYPTOPP_POSIX_MEMALIGN_AVAILABLE)
+# include <stdlib.h>
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void CallNewHandler()
+{
+	std::new_handler newHandler = std::set_new_handler(NULLPTR);
+	if (newHandler)
+		std::set_new_handler(newHandler);
+
+	if (newHandler)
+		newHandler();
+	else
+		throw std::bad_alloc();
+}
+
+void * AlignedAllocate(size_t size)
+{
+	byte *p;
+#if defined(CRYPTOPP_MM_MALLOC_AVAILABLE)
+	while ((p = (byte *)_mm_malloc(size, 16)) == NULLPTR)
+#elif defined(CRYPTOPP_MEMALIGN_AVAILABLE)
+	while ((p = (byte *)memalign(16, size)) == NULLPTR)
+#elif defined(CRYPTOPP_MALLOC_ALIGNMENT_IS_16)
+	while ((p = (byte *)malloc(size)) == NULLPTR)
+#elif defined(CRYPTOPP_POSIX_MEMALIGN_AVAILABLE)
+	while (posix_memalign(reinterpret_cast<void**>(&p), 16, size) != 0)
+#else
+	while ((p = (byte *)malloc(size + 16)) == NULLPTR)
+#endif
+		CallNewHandler();
+
+#ifdef CRYPTOPP_NO_ALIGNED_ALLOC
+	size_t adjustment = 16-((size_t)p%16);
+	CRYPTOPP_ASSERT(adjustment > 0);
+	p += adjustment;
+	p[-1] = (byte)adjustment;
+#endif
+
+	// If this assert fires then there are problems that need
+	// to be fixed. Please open a bug report.
+	CRYPTOPP_ASSERT(IsAlignedOn(p, 16));
+	return p;
+}
+
+void AlignedDeallocate(void *p)
+{
+	// Guard pointer due to crash on AIX when CRYPTOPP_NO_ALIGNED_ALLOC
+	// is in effect. The guard was previously in place in SecBlock,
+	// but it was removed at f4d68353ca7c as part of GH #875.
+	CRYPTOPP_ASSERT(p);
+
+	if (p != NULLPTR)
+	{
+#ifdef CRYPTOPP_MM_MALLOC_AVAILABLE
+		_mm_free(p);
+#elif defined(CRYPTOPP_NO_ALIGNED_ALLOC)
+		p = (byte *)p - ((byte *)p)[-1];
+		free(p);
+#else
+		free(p);
+#endif
+	}
+}
+
+void * UnalignedAllocate(size_t size)
+{
+	void *p;
+	while ((p = malloc(size)) == NULLPTR)
+		CallNewHandler();
+	return p;
+}
+
+void UnalignedDeallocate(void *p)
+{
+	free(p);
+}
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_IMPORTS
diff --git a/runtime/third_party/cryptopp/allocate.h b/runtime/third_party/cryptopp/allocate.h
new file mode 100644
index 0000000..b106b07
--- /dev/null
+++ b/runtime/third_party/cryptopp/allocate.h
@@ -0,0 +1,74 @@
+// allocate.h - written and placed in the public domain by Jeffrey Walton
+
+// The functions in allocate.h and allocate.cpp were originally in misc.h
+// and misc.cpp. They were extracted in September 2019 to sidestep a circular
+// dependency with misc.h and secblock.h.
+
+/// \file allocate.h
+/// \brief Functions for allocating aligned buffers
+
+#ifndef CRYPTOPP_ALLOCATE_H
+#define CRYPTOPP_ALLOCATE_H
+
+#include "config.h"
+#include "cryptlib.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Attempts to reclaim unused memory
+/// \throw bad_alloc
+/// \details In the normal course of running a program, a request for memory
+///  normally succeeds. If a call to AlignedAllocate or UnalignedAllocate fails,
+///  then CallNewHandler is called in n effort to recover. Internally,
+///  CallNewHandler calls set_new_handler(nullptr) in an effort to free memory.
+///  There is no guarantee CallNewHandler will be able to obtain more memory so
+///  an allocation succeeds. If the call to set_new_handler fails, then CallNewHandler
+///  throws a bad_alloc exception.
+/// \throw bad_alloc on failure
+/// \since Crypto++ 5.0
+/// \sa AlignedAllocate, AlignedDeallocate, UnalignedAllocate, UnalignedDeallocate
+CRYPTOPP_DLL void CRYPTOPP_API CallNewHandler();
+
+/// \brief Allocates a buffer on 16-byte boundary
+/// \param size the size of the buffer
+/// \details AlignedAllocate is primarily used when the data will be
+///  processed by SSE, NEON, ARMv8 or PowerPC instructions. The assembly
+///  language routines rely on the alignment. If the alignment is not
+///  respected, then a SIGBUS could be generated on Unix and Linux, and an
+///  EXCEPTION_DATATYPE_MISALIGNMENT could be generated on Windows.
+/// \details Formerly, AlignedAllocate and AlignedDeallocate were only
+///  available on certain platforms when CRYTPOPP_DISABLE_ASM was not in
+///  effect. However, Android and iOS debug simulator builds got into a
+///  state where the aligned allocator was not available and caused link
+///  failures.
+/// \since AlignedAllocate for SIMD since Crypto++ 1.0, AlignedAllocate
+///  for all builds since Crypto++ 8.1
+/// \sa AlignedDeallocate, UnalignedAllocate, UnalignedDeallocate, CallNewHandler,
+///  <A HREF="http://github.com/weidai11/cryptopp/issues/779">Issue 779</A>
+CRYPTOPP_DLL void* CRYPTOPP_API AlignedAllocate(size_t size);
+
+/// \brief Frees a buffer allocated with AlignedAllocate
+/// \param ptr the buffer to free
+/// \since AlignedDeallocate for SIMD since Crypto++ 1.0, AlignedAllocate
+///  for all builds since Crypto++ 8.1
+/// \sa AlignedAllocate, UnalignedAllocate, UnalignedDeallocate, CallNewHandler,
+///  <A HREF="http://github.com/weidai11/cryptopp/issues/779">Issue 779</A>
+CRYPTOPP_DLL void CRYPTOPP_API AlignedDeallocate(void *ptr);
+
+/// \brief Allocates a buffer
+/// \param size the size of the buffer
+/// \since Crypto++ 1.0
+/// \sa AlignedAllocate, AlignedDeallocate, UnalignedDeallocate, CallNewHandler,
+///  <A HREF="http://github.com/weidai11/cryptopp/issues/779">Issue 779</A>
+CRYPTOPP_DLL void * CRYPTOPP_API UnalignedAllocate(size_t size);
+
+/// \brief Frees a buffer allocated with UnalignedAllocate
+/// \param ptr the buffer to free
+/// \since Crypto++ 1.0
+/// \sa AlignedAllocate, AlignedDeallocate, UnalignedAllocate, CallNewHandler,
+///  <A HREF="http://github.com/weidai11/cryptopp/issues/779">Issue 779</A>
+CRYPTOPP_DLL void CRYPTOPP_API UnalignedDeallocate(void *ptr);
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_ALLOCATE_H
diff --git a/runtime/third_party/cryptopp/arc4.cpp b/runtime/third_party/cryptopp/arc4.cpp
new file mode 100644
index 0000000..1865f6e
--- /dev/null
+++ b/runtime/third_party/cryptopp/arc4.cpp
@@ -0,0 +1,122 @@
+// arc4.cpp - originally written and placed in the public domain by Wei Dai
+
+// The ARC4 algorithm was first revealed in an anonymous email to the
+// cypherpunks mailing list. This file originally contained some
+// code copied from this email. The code has since been rewritten in order
+// to clarify the copyright status of this file. It should now be
+// completely in the public domain.
+
+#include "pch.h"
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+#include "arc4.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+namespace Weak1 {
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void ARC4_TestInstantiations()
+{
+	ARC4 x;
+}
+#endif
+
+ARC4_Base::~ARC4_Base()
+{
+	m_x = m_y = 0;
+}
+
+void ARC4_Base::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	AssertValidKeyLength(length);
+
+	m_x = 1;
+	m_y = 0;
+
+	unsigned int i;
+	for (i=0; i<256; i++)
+		m_state[i] = byte(i);
+
+	unsigned int keyIndex = 0, stateIndex = 0;
+	for (i=0; i<256; i++)
+	{
+		unsigned int a = m_state[i];
+		stateIndex += key[keyIndex] + a;
+		stateIndex &= 0xff;
+		m_state[i] = m_state[stateIndex];
+		m_state[stateIndex] = byte(a);
+		if (++keyIndex >= length)
+			keyIndex = 0;
+	}
+
+	int discardBytes = params.GetIntValueWithDefault("DiscardBytes", GetDefaultDiscardBytes());
+	DiscardBytes(discardBytes);
+}
+
+template <class T>
+static inline unsigned int MakeByte(T &x, T &y, byte *s)
+{
+	unsigned int a = s[x];
+	y = byte((y+a) & 0xff);
+	unsigned int b = s[y];
+	s[x] = byte(b);
+	s[y] = byte(a);
+	x = byte((x+1) & 0xff);
+	return s[(a+b) & 0xff];
+}
+
+void ARC4_Base::GenerateBlock(byte *output, size_t size)
+{
+	while (size--)
+		*output++ = static_cast<byte>(MakeByte(m_x, m_y, m_state));
+}
+
+void ARC4_Base::ProcessData(byte *outString, const byte *inString, size_t length)
+{
+	if (length == 0)
+		return;
+
+	byte *const s = m_state;
+	unsigned int x = m_x;
+	unsigned int y = m_y;
+
+	if (inString == outString)
+	{
+		do
+		{
+			*outString++ ^= MakeByte(x, y, s);
+		} while (--length);
+	}
+	else
+	{
+		do
+		{
+			*outString++ = *inString++ ^ byte(MakeByte(x, y, s));
+		}
+		while(--length);
+	}
+
+	m_x = byte(x);
+	m_y = byte(y);
+}
+
+void ARC4_Base::DiscardBytes(size_t n)
+{
+	if (n == 0)
+		return;
+
+	byte *const s = m_state;
+	unsigned int x = m_x;
+	unsigned int y = m_y;
+
+	do
+	{
+		MakeByte(x, y, s);
+	}
+	while(--n);
+
+	m_x = byte(x);
+	m_y = byte(y);
+}
+
+}
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/arc4.h b/runtime/third_party/cryptopp/arc4.h
new file mode 100644
index 0000000..ca444ce
--- /dev/null
+++ b/runtime/third_party/cryptopp/arc4.h
@@ -0,0 +1,89 @@
+// arc4.h - originally written and placed in the public domain by Wei Dai
+
+/// \file arc4.h
+/// \brief Classes for ARC4 cipher
+/// \since Crypto++ 3.1
+
+#ifndef CRYPTOPP_ARC4_H
+#define CRYPTOPP_ARC4_H
+
+#include "cryptlib.h"
+#include "strciphr.h"
+#include "secblock.h"
+#include "smartptr.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+namespace Weak1 {
+
+/// \brief ARC4 base class
+/// \details Implementations and overrides in \p Base apply to both \p ENCRYPTION and \p DECRYPTION directions
+/// \since Crypto++ 3.1
+class CRYPTOPP_NO_VTABLE ARC4_Base : public VariableKeyLength<16, 1, 256>, public RandomNumberGenerator, public SymmetricCipher, public SymmetricCipherDocumentation
+{
+public:
+	~ARC4_Base();
+
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "ARC4";}
+
+	void GenerateBlock(byte *output, size_t size);
+	void DiscardBytes(size_t n);
+
+    void ProcessData(byte *outString, const byte *inString, size_t length);
+
+	bool IsRandomAccess() const {return false;}
+	bool IsSelfInverting() const {return true;}
+	bool IsForwardTransformation() const {return true;}
+
+	typedef SymmetricCipherFinal<ARC4_Base> Encryption;
+	typedef SymmetricCipherFinal<ARC4_Base> Decryption;
+
+protected:
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+	virtual unsigned int GetDefaultDiscardBytes() const {return 0;}
+
+    FixedSizeSecBlock<byte, 256> m_state;
+    byte m_x, m_y;
+};
+
+/// \brief Alleged RC4
+/// \sa <a href="http://www.cryptopp.com/wiki/RC4">Alleged RC4</a>
+/// \since Crypto++ 3.1
+DOCUMENTED_TYPEDEF(SymmetricCipherFinal<ARC4_Base>, ARC4);
+
+/// \brief MARC4 base class
+/// \details Implementations and overrides in \p Base apply to both \p ENCRYPTION and \p DECRYPTION directions
+/// \details MARC4 discards the first 256 bytes of keystream, which may be weaker than the rest
+/// \since Crypto++ 3.1
+class CRYPTOPP_NO_VTABLE MARC4_Base : public ARC4_Base
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "MARC4";}
+
+	typedef SymmetricCipherFinal<MARC4_Base> Encryption;
+	typedef SymmetricCipherFinal<MARC4_Base> Decryption;
+
+protected:
+	unsigned int GetDefaultDiscardBytes() const {return 256;}
+};
+
+/// \brief Modified Alleged RC4
+/// \sa <a href="http://www.cryptopp.com/wiki/RC4">Alleged RC4</a>
+/// \since Crypto++ 3.1
+DOCUMENTED_TYPEDEF(SymmetricCipherFinal<MARC4_Base>, MARC4);
+
+}
+#if CRYPTOPP_ENABLE_NAMESPACE_WEAK >= 1
+namespace Weak {using namespace Weak1;}		// import Weak1 into CryptoPP::Weak
+#else
+using namespace Weak1;	// import Weak1 into CryptoPP with warning
+#ifdef __GNUC__
+#warning "You may be using a weak algorithm that has been retained for backwards compatibility. Please '#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1' before including this .h file and prepend the class name with 'Weak::' to remove this warning."
+#else
+#pragma message("You may be using a weak algorithm that has been retained for backwards compatibility. Please '#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1' before including this .h file and prepend the class name with 'Weak::' to remove this warning.")
+#endif
+#endif
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/argnames.h b/runtime/third_party/cryptopp/argnames.h
new file mode 100644
index 0000000..4f929d5
--- /dev/null
+++ b/runtime/third_party/cryptopp/argnames.h
@@ -0,0 +1,99 @@
+// argnames.h - originally written and placed in the public domain by Wei Dai
+
+/// \file argnames.h
+/// \brief Standard names for retrieving values by name when working with \p NameValuePairs
+
+#ifndef CRYPTOPP_ARGNAMES_H
+#define CRYPTOPP_ARGNAMES_H
+
+#include "cryptlib.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+DOCUMENTED_NAMESPACE_BEGIN(Name)
+
+#define CRYPTOPP_DEFINE_NAME_STRING(name)	inline const char *name() {return #name;}
+
+CRYPTOPP_DEFINE_NAME_STRING(ValueNames)			///< string, a list of value names with a semicolon (';') after each name
+CRYPTOPP_DEFINE_NAME_STRING(Version)			///< int
+CRYPTOPP_DEFINE_NAME_STRING(Seed)				///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(Key)				///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(IV)					///< ConstByteArrayParameter, also accepts const byte * for backwards compatibility
+CRYPTOPP_DEFINE_NAME_STRING(StolenIV)			///< byte *
+CRYPTOPP_DEFINE_NAME_STRING(Nonce)				///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(Rounds)				///< int
+CRYPTOPP_DEFINE_NAME_STRING(FeedbackSize)		///< int
+CRYPTOPP_DEFINE_NAME_STRING(WordSize)			///< int, in bytes
+CRYPTOPP_DEFINE_NAME_STRING(BlockSize)			///< int, in bytes
+CRYPTOPP_DEFINE_NAME_STRING(EffectiveKeyLength)	///< int, in bits
+CRYPTOPP_DEFINE_NAME_STRING(KeySize)			///< int, in bits
+CRYPTOPP_DEFINE_NAME_STRING(ModulusSize)		///< int, in bits
+CRYPTOPP_DEFINE_NAME_STRING(SubgroupOrderSize)	///< int, in bits
+CRYPTOPP_DEFINE_NAME_STRING(PrivateExponentSize)///< int, in bits
+CRYPTOPP_DEFINE_NAME_STRING(Modulus)			///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(PublicExponent)		///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(PrivateExponent)	///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(PublicElement)		///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(SubgroupOrder)		///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(Cofactor)			///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(SubgroupGenerator)	///< Integer, ECP::Point, or EC2N::Point
+CRYPTOPP_DEFINE_NAME_STRING(Curve)				///< ECP or EC2N
+CRYPTOPP_DEFINE_NAME_STRING(GroupOID)			///< OID
+CRYPTOPP_DEFINE_NAME_STRING(PointerToPrimeSelector)		///< const PrimeSelector *
+CRYPTOPP_DEFINE_NAME_STRING(Prime1)				///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(Prime2)				///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(ModPrime1PrivateExponent)	///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(ModPrime2PrivateExponent)	///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(MultiplicativeInverseOfPrime2ModPrime1)	///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(QuadraticResidueModPrime1)	///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(QuadraticResidueModPrime2)	///< Integer
+CRYPTOPP_DEFINE_NAME_STRING(PutMessage)			///< bool
+CRYPTOPP_DEFINE_NAME_STRING(TruncatedDigestSize)	///< int
+CRYPTOPP_DEFINE_NAME_STRING(BlockPaddingScheme)	///< StreamTransformationFilter::BlockPaddingScheme
+CRYPTOPP_DEFINE_NAME_STRING(HashVerificationFilterFlags)		///< word32
+CRYPTOPP_DEFINE_NAME_STRING(AuthenticatedDecryptionFilterFlags)	///< word32
+CRYPTOPP_DEFINE_NAME_STRING(SignatureVerificationFilterFlags)	///< word32
+CRYPTOPP_DEFINE_NAME_STRING(InputBuffer)		///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(OutputBuffer)		///< ByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(InputFileName)		///< const char *
+CRYPTOPP_DEFINE_NAME_STRING(InputFileNameWide)	///< const wchar_t *
+CRYPTOPP_DEFINE_NAME_STRING(InputStreamPointer)	///< std::istream *
+CRYPTOPP_DEFINE_NAME_STRING(InputBinaryMode)	///< bool
+CRYPTOPP_DEFINE_NAME_STRING(OutputFileName)		///< const char *
+CRYPTOPP_DEFINE_NAME_STRING(OutputFileNameWide)	///< const wchar_t *
+CRYPTOPP_DEFINE_NAME_STRING(OutputStreamPointer)	///< std::ostream *
+CRYPTOPP_DEFINE_NAME_STRING(OutputBinaryMode)	///< bool
+CRYPTOPP_DEFINE_NAME_STRING(EncodingParameters)	///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(KeyDerivationParameters)	///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(Separator)			///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(Terminator)			///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(Uppercase)			///< bool
+CRYPTOPP_DEFINE_NAME_STRING(GroupSize)			///< int
+CRYPTOPP_DEFINE_NAME_STRING(Pad)				///< bool
+CRYPTOPP_DEFINE_NAME_STRING(PaddingByte)		///< byte
+CRYPTOPP_DEFINE_NAME_STRING(Log2Base)			///< int
+CRYPTOPP_DEFINE_NAME_STRING(EncodingLookupArray)	///< const byte *
+CRYPTOPP_DEFINE_NAME_STRING(DecodingLookupArray)	///< const byte *
+CRYPTOPP_DEFINE_NAME_STRING(InsertLineBreaks)	///< bool
+CRYPTOPP_DEFINE_NAME_STRING(MaxLineLength)		///< int
+CRYPTOPP_DEFINE_NAME_STRING(DigestSize)			///< int, in bytes
+CRYPTOPP_DEFINE_NAME_STRING(L1KeyLength)		///< int, in bytes
+CRYPTOPP_DEFINE_NAME_STRING(TableSize)			///< int, in bytes
+CRYPTOPP_DEFINE_NAME_STRING(Blinding)			///< bool, timing attack mitigations, ON by default
+CRYPTOPP_DEFINE_NAME_STRING(DerivedKey)			///< ByteArrayParameter, key derivation, derived key
+CRYPTOPP_DEFINE_NAME_STRING(DerivedKeyLength)	///< int, key derivation, derived key length in bytes
+CRYPTOPP_DEFINE_NAME_STRING(Personalization)	///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(PersonalizationSize)	///< int, in bytes
+CRYPTOPP_DEFINE_NAME_STRING(Salt)				///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(Tweak)				///< ConstByteArrayParameter
+CRYPTOPP_DEFINE_NAME_STRING(SaltSize)			///< int, in bytes
+CRYPTOPP_DEFINE_NAME_STRING(TreeMode)			///< byte
+CRYPTOPP_DEFINE_NAME_STRING(FileName)			///< const char *
+CRYPTOPP_DEFINE_NAME_STRING(FileTime)			///< int
+CRYPTOPP_DEFINE_NAME_STRING(Comment)			///< const char *
+CRYPTOPP_DEFINE_NAME_STRING(Identity)			///< ConstByteArrayParameter
+DOCUMENTED_NAMESPACE_END
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/aria.cpp b/runtime/third_party/cryptopp/aria.cpp
new file mode 100644
index 0000000..fd00dae
--- /dev/null
+++ b/runtime/third_party/cryptopp/aria.cpp
@@ -0,0 +1,348 @@
+// aria.cpp - written and placed in the public domain by Jeffrey Walton
+
+#include "pch.h"
+#include "config.h"
+
+#include "aria.h"
+#include "misc.h"
+#include "cpu.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(ARIATab)
+
+extern const word32 S1[256];
+extern const word32 S2[256];
+extern const word32 X1[256];
+extern const word32 X2[256];
+extern const word32 KRK[3][4];
+
+NAMESPACE_END
+NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+using CryptoPP::ARIATab::S1;
+using CryptoPP::ARIATab::S2;
+using CryptoPP::ARIATab::X1;
+using CryptoPP::ARIATab::X2;
+using CryptoPP::ARIATab::KRK;
+
+inline byte ARIA_BRF(const word32 x, const int y) {
+	return static_cast<byte>(GETBYTE(x, y));
+}
+
+// Key XOR Layer. Bumps the round key pointer.
+inline const byte* ARIA_KXL(const byte rk[16], word32 t[4]) {
+	typedef BlockGetAndPut<word32, NativeByteOrder, true, true>  NativeBlock;
+	NativeBlock::Put(rk, t)(t[0])(t[1])(t[2])(t[3]);
+	return rk+16;
+}
+
+// S-Box Layer 1 + M
+inline void SBL1_M(word32& T0, word32& T1, word32& T2, word32& T3) {
+	T0=S1[ARIA_BRF(T0,3)]^S2[ARIA_BRF(T0,2)]^X1[ARIA_BRF(T0,1)]^X2[ARIA_BRF(T0,0)];
+	T1=S1[ARIA_BRF(T1,3)]^S2[ARIA_BRF(T1,2)]^X1[ARIA_BRF(T1,1)]^X2[ARIA_BRF(T1,0)];
+	T2=S1[ARIA_BRF(T2,3)]^S2[ARIA_BRF(T2,2)]^X1[ARIA_BRF(T2,1)]^X2[ARIA_BRF(T2,0)];
+	T3=S1[ARIA_BRF(T3,3)]^S2[ARIA_BRF(T3,2)]^X1[ARIA_BRF(T3,1)]^X2[ARIA_BRF(T3,0)];
+}
+
+// S-Box Layer 2 + M
+inline void SBL2_M(word32& T0, word32& T1, word32& T2, word32& T3) {
+	T0=X1[ARIA_BRF(T0,3)]^X2[ARIA_BRF(T0,2)]^S1[ARIA_BRF(T0,1)]^S2[ARIA_BRF(T0,0)];
+	T1=X1[ARIA_BRF(T1,3)]^X2[ARIA_BRF(T1,2)]^S1[ARIA_BRF(T1,1)]^S2[ARIA_BRF(T1,0)];
+	T2=X1[ARIA_BRF(T2,3)]^X2[ARIA_BRF(T2,2)]^S1[ARIA_BRF(T2,1)]^S2[ARIA_BRF(T2,0)];
+	T3=X1[ARIA_BRF(T3,3)]^X2[ARIA_BRF(T3,2)]^S1[ARIA_BRF(T3,1)]^S2[ARIA_BRF(T3,0)];
+  }
+
+inline void ARIA_P(word32& T0, word32& T1, word32& T2, word32& T3) {
+	CRYPTOPP_UNUSED(T0);
+	T1 = ((T1<< 8)&0xff00ff00) ^ ((T1>> 8)&0x00ff00ff);
+	T2 = rotrConstant<16>(T2);
+	T3 = ByteReverse((T3));
+}
+
+inline void ARIA_M(word32& X, word32& Y) {
+	Y=X<<8 ^ X>>8 ^ X<<16 ^ X>>16 ^ X<<24 ^ X>>24;
+}
+
+
+inline void ARIA_MM(word32& T0, word32& T1, word32& T2, word32& T3) {
+	T1^=T2; T2^=T3; T0^=T1;
+	T3^=T1; T2^=T0; T1^=T2;
+}
+
+inline void ARIA_FO(word32 t[4]) {
+	SBL1_M(t[0],t[1],t[2],t[3]);
+	ARIA_MM(t[0],t[1],t[2],t[3]);
+	ARIA_P(t[0],t[1],t[2],t[3]);
+	ARIA_MM(t[0],t[1],t[2],t[3]);
+}
+
+inline void ARIA_FE(word32 t[4]) {
+	SBL2_M(t[0],t[1],t[2],t[3]);
+	ARIA_MM(t[0],t[1],t[2],t[3]);
+	ARIA_P(t[2],t[3],t[0],t[1]);
+	ARIA_MM(t[0],t[1],t[2],t[3]);
+}
+
+// n-bit right shift of Y XORed to X
+template <unsigned int N>
+inline void ARIA_GSRK(const word32 X[4], const word32 Y[4], word32 RK[4])
+{
+	// MSVC is not generating a "rotate immediate". Constify to help it along.
+	static const unsigned int Q = 4-(N/32);
+	static const unsigned int R = N % 32;
+
+	RK[0] = (X[0]) ^ ((Y[(Q  )%4])>>R) ^ ((Y[(Q+3)%4])<<(32-R));
+	RK[1] = (X[1]) ^ ((Y[(Q+1)%4])>>R) ^ ((Y[(Q  )%4])<<(32-R));
+	RK[2] = (X[2]) ^ ((Y[(Q+2)%4])>>R) ^ ((Y[(Q+1)%4])<<(32-R));
+	RK[3] = (X[3]) ^ ((Y[(Q+3)%4])>>R) ^ ((Y[(Q+2)%4])<<(32-R));
+}
+
+void ARIA::Base::UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &params)
+{
+	CRYPTOPP_UNUSED(params);
+
+	m_rk.New(4*17);  // round keys
+	m_w.New(4*24);	 // w0, w1, w2, w3, t and u
+
+	int Q, q, R, r;
+
+	switch (keylen)
+	{
+	case 16:
+		R = r = m_rounds = 12;
+		Q = q = 0;
+		break;
+	case 32:
+		R = r = m_rounds = 16;
+		Q = q = 2;
+		break;
+	case 24:
+		R = r = m_rounds = 14;
+		Q = q = 1;
+		break;
+	default:
+		Q = q = R = r = m_rounds = 0;
+		CRYPTOPP_ASSERT(0);
+	}
+
+	// w0-w3 each has room for 4 words (16 bytes). t and u are each 4 words (16 bytes) temp areas.
+	// The storage requrements for w0-w3, t and u are 96 bytes or 24 words.
+	word32 *w0 = m_w.data(), *w1 = m_w.data()+4, *w2 = m_w.data()+8, *w3 = m_w.data()+12, *t = m_w.data()+16;
+
+	GetBlock<word32, BigEndian, false>block(key);
+	block(w0[0])(w0[1])(w0[2])(w0[3]);
+
+	t[0]=w0[0]^KRK[q][0]; t[1]=w0[1]^KRK[q][1];
+	t[2]=w0[2]^KRK[q][2]; t[3]=w0[3]^KRK[q][3];
+
+	ARIA_FO(t);
+
+	if (keylen == 32)
+	{
+		block(w1[0])(w1[1])(w1[2])(w1[3]);
+	}
+	else if (keylen == 24)
+	{
+		block(w1[0])(w1[1]); w1[2] = w1[3] = 0;
+	}
+	else
+	{
+		w1[0]=w1[1]=w1[2]=w1[3]=0;
+	}
+
+	w1[0]^=t[0]; w1[1]^=t[1]; w1[2]^=t[2]; w1[3]^=t[3];
+	std::memcpy(t, w1, 16);
+
+	q = (q==2) ? 0 : (q+1);
+	t[0]^=KRK[q][0]; t[1]^=KRK[q][1]; t[2]^=KRK[q][2]; t[3]^=KRK[q][3];
+
+	ARIA_FE(t);
+
+	t[0]^=w0[0]; t[1]^=w0[1]; t[2]^=w0[2]; t[3]^=w0[3];
+	std::memcpy(w2, t, 16);
+
+	q = (q==2) ? 0 : (q+1);
+	t[0]^=KRK[q][0]; t[1]^=KRK[q][1]; t[2]^=KRK[q][2]; t[3]^=KRK[q][3];
+
+	ARIA_FO(t);
+
+	w3[0]=t[0]^w1[0]; w3[1]=t[1]^w1[1]; w3[2]=t[2]^w1[2]; w3[3]=t[3]^w1[3];
+
+	ARIA_GSRK<19>(w0, w1, m_rk +  0);
+	ARIA_GSRK<19>(w1, w2, m_rk +  4);
+	ARIA_GSRK<19>(w2, w3, m_rk +  8);
+	ARIA_GSRK<19>(w3, w0, m_rk + 12);
+	ARIA_GSRK<31>(w0, w1, m_rk + 16);
+	ARIA_GSRK<31>(w1, w2, m_rk + 20);
+	ARIA_GSRK<31>(w2, w3, m_rk + 24);
+	ARIA_GSRK<31>(w3, w0, m_rk + 28);
+	ARIA_GSRK<67>(w0, w1, m_rk + 32);
+	ARIA_GSRK<67>(w1, w2, m_rk + 36);
+	ARIA_GSRK<67>(w2, w3, m_rk + 40);
+	ARIA_GSRK<67>(w3, w0, m_rk + 44);
+	ARIA_GSRK<97>(w0, w1, m_rk + 48);
+
+	if (keylen > 16)
+	{
+		ARIA_GSRK<97>(w1, w2, m_rk + 52);
+		ARIA_GSRK<97>(w2, w3, m_rk + 56);
+
+		if (keylen > 24)
+		{
+			ARIA_GSRK< 97>(w3, w0, m_rk + 60);
+			ARIA_GSRK<109>(w0, w1, m_rk + 64);
+		}
+	}
+
+	// Decryption operation
+	if (!IsForwardTransformation())
+	{
+		word32 *a, *z, *s;
+		r = R; q = Q;
+
+		// s reuses w0 temp area
+		a=m_rk.data(); s=m_w.data()+0; z=a+r*4;
+		std::memcpy(t, a, 16); std::memcpy(a, z, 16); std::memcpy(z, t, 16);
+
+		a+=4; z-=4;
+		for (; a<z; a+=4, z-=4)
+		{
+			ARIA_M(a[0],t[0]); ARIA_M(a[1],t[1]); ARIA_M(a[2],t[2]); ARIA_M(a[3],t[3]);
+			ARIA_MM(t[0],t[1],t[2],t[3]); ARIA_P(t[0],t[1],t[2],t[3]); ARIA_MM(t[0],t[1],t[2],t[3]);
+			std::memcpy(s, t, 16);
+
+			ARIA_M(z[0],t[0]); ARIA_M(z[1],t[1]); ARIA_M(z[2],t[2]); ARIA_M(z[3],t[3]);
+			ARIA_MM(t[0],t[1],t[2],t[3]); ARIA_P(t[0],t[1],t[2],t[3]); ARIA_MM(t[0],t[1],t[2],t[3]);
+			std::memcpy(a, t, 16); std::memcpy(z, s, 16);
+		}
+
+		ARIA_M(a[0],t[0]); ARIA_M(a[1],t[1]); ARIA_M(a[2],t[2]); ARIA_M(a[3],t[3]);
+		ARIA_MM(t[0],t[1],t[2],t[3]); ARIA_P(t[0],t[1],t[2],t[3]); ARIA_MM(t[0],t[1],t[2],t[3]);
+		std::memcpy(z, t, 16);
+	}
+
+	// Silence warnings
+	CRYPTOPP_UNUSED(Q); CRYPTOPP_UNUSED(R);
+	CRYPTOPP_UNUSED(q); CRYPTOPP_UNUSED(r);
+}
+
+void ARIA::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	const byte *rk = reinterpret_cast<const byte*>(m_rk.data());
+	word32 *t = const_cast<word32*>(m_w.data()+16);
+
+	// Timing attack countermeasure. See comments in Rijndael for more details.
+	// We used Yun's 32-bit implementation, so we use words rather than bytes.
+	const int cacheLineSize = GetCacheLineSize();
+	unsigned int i;
+	volatile word32 _u = 0;
+	word32 u = _u;
+
+	for (i=0; i<COUNTOF(S1); i+=cacheLineSize/(sizeof(S1[0])))
+		u |= *(S1+i);
+	t[0] |= u;
+
+	GetBlock<word32, BigEndian>block(inBlock);
+	block(t[0])(t[1])(t[2])(t[3]);
+
+	if (m_rounds > 12) {
+		rk = ARIA_KXL(rk, t); ARIA_FO(t);
+		rk = ARIA_KXL(rk, t); ARIA_FE(t);
+	}
+
+	if (m_rounds > 14) {
+		rk = ARIA_KXL(rk, t); ARIA_FO(t);
+		rk = ARIA_KXL(rk, t); ARIA_FE(t);
+	}
+
+	rk = ARIA_KXL(rk, t); ARIA_FO(t); rk = ARIA_KXL(rk, t); ARIA_FE(t);
+	rk = ARIA_KXL(rk, t); ARIA_FO(t); rk = ARIA_KXL(rk, t); ARIA_FE(t);
+	rk = ARIA_KXL(rk, t); ARIA_FO(t); rk = ARIA_KXL(rk, t); ARIA_FE(t);
+	rk = ARIA_KXL(rk, t); ARIA_FO(t); rk = ARIA_KXL(rk, t); ARIA_FE(t);
+	rk = ARIA_KXL(rk, t); ARIA_FO(t); rk = ARIA_KXL(rk, t); ARIA_FE(t);
+	rk = ARIA_KXL(rk, t); ARIA_FO(t); rk = ARIA_KXL(rk, t);
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+	if (xorBlock)
+	{
+		outBlock[ 0] = static_cast<byte>(X1[ARIA_BRF(t[0],3)]   ) ^ rk[ 3] ^ xorBlock[ 0];
+		outBlock[ 1] = static_cast<byte>(X2[ARIA_BRF(t[0],2)]>>8) ^ rk[ 2] ^ xorBlock[ 1];
+		outBlock[ 2] = static_cast<byte>(S1[ARIA_BRF(t[0],1)]   ) ^ rk[ 1] ^ xorBlock[ 2];
+		outBlock[ 3] = static_cast<byte>(S2[ARIA_BRF(t[0],0)]   ) ^ rk[ 0] ^ xorBlock[ 3];
+		outBlock[ 4] = static_cast<byte>(X1[ARIA_BRF(t[1],3)]   ) ^ rk[ 7] ^ xorBlock[ 4];
+		outBlock[ 5] = static_cast<byte>(X2[ARIA_BRF(t[1],2)]>>8) ^ rk[ 6] ^ xorBlock[ 5];
+		outBlock[ 6] = static_cast<byte>(S1[ARIA_BRF(t[1],1)]   ) ^ rk[ 5] ^ xorBlock[ 6];
+		outBlock[ 7] = static_cast<byte>(S2[ARIA_BRF(t[1],0)]   ) ^ rk[ 4] ^ xorBlock[ 7];
+		outBlock[ 8] = static_cast<byte>(X1[ARIA_BRF(t[2],3)]   ) ^ rk[11] ^ xorBlock[ 8];
+		outBlock[ 9] = static_cast<byte>(X2[ARIA_BRF(t[2],2)]>>8) ^ rk[10] ^ xorBlock[ 9];
+		outBlock[10] = static_cast<byte>(S1[ARIA_BRF(t[2],1)]   ) ^ rk[ 9] ^ xorBlock[10];
+		outBlock[11] = static_cast<byte>(S2[ARIA_BRF(t[2],0)]   ) ^ rk[ 8] ^ xorBlock[11];
+		outBlock[12] = static_cast<byte>(X1[ARIA_BRF(t[3],3)]   ) ^ rk[15] ^ xorBlock[12];
+		outBlock[13] = static_cast<byte>(X2[ARIA_BRF(t[3],2)]>>8) ^ rk[14] ^ xorBlock[13];
+		outBlock[14] = static_cast<byte>(S1[ARIA_BRF(t[3],1)]   ) ^ rk[13] ^ xorBlock[14];
+		outBlock[15] = static_cast<byte>(S2[ARIA_BRF(t[3],0)]   ) ^ rk[12] ^ xorBlock[15];
+	}
+	else
+	{
+		outBlock[ 0] = static_cast<byte>(X1[ARIA_BRF(t[0],3)]   ) ^ rk[ 3];
+		outBlock[ 1] = static_cast<byte>(X2[ARIA_BRF(t[0],2)]>>8) ^ rk[ 2];
+		outBlock[ 2] = static_cast<byte>(S1[ARIA_BRF(t[0],1)]   ) ^ rk[ 1];
+		outBlock[ 3] = static_cast<byte>(S2[ARIA_BRF(t[0],0)]   ) ^ rk[ 0];
+		outBlock[ 4] = static_cast<byte>(X1[ARIA_BRF(t[1],3)]   ) ^ rk[ 7];
+		outBlock[ 5] = static_cast<byte>(X2[ARIA_BRF(t[1],2)]>>8) ^ rk[ 6];
+		outBlock[ 6] = static_cast<byte>(S1[ARIA_BRF(t[1],1)]   ) ^ rk[ 5];
+		outBlock[ 7] = static_cast<byte>(S2[ARIA_BRF(t[1],0)]   ) ^ rk[ 4];
+		outBlock[ 8] = static_cast<byte>(X1[ARIA_BRF(t[2],3)]   ) ^ rk[11];
+		outBlock[ 9] = static_cast<byte>(X2[ARIA_BRF(t[2],2)]>>8) ^ rk[10];
+		outBlock[10] = static_cast<byte>(S1[ARIA_BRF(t[2],1)]   ) ^ rk[ 9];
+		outBlock[11] = static_cast<byte>(S2[ARIA_BRF(t[2],0)]   ) ^ rk[ 8];
+		outBlock[12] = static_cast<byte>(X1[ARIA_BRF(t[3],3)]   ) ^ rk[15];
+		outBlock[13] = static_cast<byte>(X2[ARIA_BRF(t[3],2)]>>8) ^ rk[14];
+		outBlock[14] = static_cast<byte>(S1[ARIA_BRF(t[3],1)]   ) ^ rk[13];
+		outBlock[15] = static_cast<byte>(S2[ARIA_BRF(t[3],0)]   ) ^ rk[12];
+	}
+#else
+	if (xorBlock)
+	{
+		outBlock[ 0] = static_cast<byte>(X1[ARIA_BRF(t[0],3)]   ) ^ rk[ 0] ^ xorBlock[ 0];
+		outBlock[ 1] = static_cast<byte>(X2[ARIA_BRF(t[0],2)]>>8) ^ rk[ 1] ^ xorBlock[ 1];
+		outBlock[ 2] = static_cast<byte>(S1[ARIA_BRF(t[0],1)]   ) ^ rk[ 2] ^ xorBlock[ 2];
+		outBlock[ 3] = static_cast<byte>(S2[ARIA_BRF(t[0],0)]   ) ^ rk[ 3] ^ xorBlock[ 3];
+		outBlock[ 4] = static_cast<byte>(X1[ARIA_BRF(t[1],3)]   ) ^ rk[ 4] ^ xorBlock[ 4];
+		outBlock[ 5] = static_cast<byte>(X2[ARIA_BRF(t[1],2)]>>8) ^ rk[ 5] ^ xorBlock[ 5];
+		outBlock[ 6] = static_cast<byte>(S1[ARIA_BRF(t[1],1)]   ) ^ rk[ 6] ^ xorBlock[ 6];
+		outBlock[ 7] = static_cast<byte>(S2[ARIA_BRF(t[1],0)]   ) ^ rk[ 7] ^ xorBlock[ 7];
+		outBlock[ 8] = static_cast<byte>(X1[ARIA_BRF(t[2],3)]   ) ^ rk[ 8] ^ xorBlock[ 8];
+		outBlock[ 9] = static_cast<byte>(X2[ARIA_BRF(t[2],2)]>>8) ^ rk[ 9] ^ xorBlock[ 9];
+		outBlock[10] = static_cast<byte>(S1[ARIA_BRF(t[2],1)]   ) ^ rk[10] ^ xorBlock[10];
+		outBlock[11] = static_cast<byte>(S2[ARIA_BRF(t[2],0)]   ) ^ rk[11] ^ xorBlock[11];
+		outBlock[12] = static_cast<byte>(X1[ARIA_BRF(t[3],3)]   ) ^ rk[12] ^ xorBlock[12];
+		outBlock[13] = static_cast<byte>(X2[ARIA_BRF(t[3],2)]>>8) ^ rk[13] ^ xorBlock[13];
+		outBlock[14] = static_cast<byte>(S1[ARIA_BRF(t[3],1)]   ) ^ rk[14] ^ xorBlock[14];
+		outBlock[15] = static_cast<byte>(S2[ARIA_BRF(t[3],0)]   ) ^ rk[15] ^ xorBlock[15];
+	}
+	else
+	{
+		outBlock[ 0] = static_cast<byte>(X1[ARIA_BRF(t[0],3)]   ) ^ rk[ 0];
+		outBlock[ 1] = static_cast<byte>(X2[ARIA_BRF(t[0],2)]>>8) ^ rk[ 1];
+		outBlock[ 2] = static_cast<byte>(S1[ARIA_BRF(t[0],1)]   ) ^ rk[ 2];
+		outBlock[ 3] = static_cast<byte>(S2[ARIA_BRF(t[0],0)]   ) ^ rk[ 3];
+		outBlock[ 4] = static_cast<byte>(X1[ARIA_BRF(t[1],3)]   ) ^ rk[ 4];
+		outBlock[ 5] = static_cast<byte>(X2[ARIA_BRF(t[1],2)]>>8) ^ rk[ 5];
+		outBlock[ 6] = static_cast<byte>(S1[ARIA_BRF(t[1],1)]   ) ^ rk[ 6];
+		outBlock[ 7] = static_cast<byte>(S2[ARIA_BRF(t[1],0)]   ) ^ rk[ 7];
+		outBlock[ 8] = static_cast<byte>(X1[ARIA_BRF(t[2],3)]   ) ^ rk[ 8];
+		outBlock[ 9] = static_cast<byte>(X2[ARIA_BRF(t[2],2)]>>8) ^ rk[ 9];
+		outBlock[10] = static_cast<byte>(S1[ARIA_BRF(t[2],1)]   ) ^ rk[10];
+		outBlock[11] = static_cast<byte>(S2[ARIA_BRF(t[2],0)]   ) ^ rk[11];
+		outBlock[12] = static_cast<byte>(X1[ARIA_BRF(t[3],3)]   ) ^ rk[12];
+		outBlock[13] = static_cast<byte>(X2[ARIA_BRF(t[3],2)]>>8) ^ rk[13];
+		outBlock[14] = static_cast<byte>(S1[ARIA_BRF(t[3],1)]   ) ^ rk[14];
+		outBlock[15] = static_cast<byte>(S2[ARIA_BRF(t[3],0)]   ) ^ rk[15];
+	}
+#endif  // CRYPTOPP_LITTLE_ENDIAN
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/aria.h b/runtime/third_party/cryptopp/aria.h
new file mode 100644
index 0000000..da623a1
--- /dev/null
+++ b/runtime/third_party/cryptopp/aria.h
@@ -0,0 +1,71 @@
+// aria.h - written and placed in the public domain by Jeffrey Walton
+
+/// \file aria.h
+/// \brief Classes for the ARIA block cipher
+/// \details The Crypto++ ARIA implementation is based on the 32-bit implementation by Aaram Yun
+///   from the National Security Research Institute, KOREA. Aaram Yun's implementation is based on
+///   the 8-bit implementation by Jin Hong. The source files are available in ARIA.zip from the Korea
+///   Internet & Security Agency website.
+/// \sa <A HREF="http://tools.ietf.org/html/rfc5794">RFC 5794, A Description of the ARIA Encryption Algorithm</A>,
+///   <A HREF="http://seed.kisa.or.kr/iwt/ko/bbs/EgovReferenceList.do?bbsId=BBSMSTR_000000000002">Korea
+///   Internet & Security Agency homepage</A>
+
+#ifndef CRYPTOPP_ARIA_H
+#define CRYPTOPP_ARIA_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief ARIA block cipher information
+/// \since Crypto++ 6.0
+struct ARIA_Info : public FixedBlockSize<16>, public VariableKeyLength<16, 16, 32, 8>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "ARIA";}
+};
+
+/// \brief ARIA block cipher
+/// \details The Crypto++ ARIA implementation is based on the 32-bit implementation by Aaram Yun
+///   from the National Security Research Institute, KOREA. Aaram Yun's implementation is based on
+///   the 8-bit implementation by Jin Hong. The source files are available in ARIA.zip from the Korea
+///   Internet & Security Agency website.
+/// \sa <A HREF="http://tools.ietf.org/html/rfc5794">RFC 5794, A Description of the ARIA Encryption Algorithm</A>,
+///   <A HREF="http://seed.kisa.or.kr/iwt/ko/bbs/EgovReferenceList.do?bbsId=BBSMSTR_000000000002">Korea
+///   Internet & Security Agency homepage</A>
+/// \sa <a href="http://www.cryptopp.com/wiki/ARIA">ARIA</a>
+/// \since Crypto++ 6.0
+class ARIA : public ARIA_Info, public BlockCipherDocumentation
+{
+public:
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<ARIA_Info>
+	{
+	public:
+		Base() : m_rounds(0) {}
+
+	protected:
+		void UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &params);
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+	private:
+		// Reference implementation allocates a table of 17 round keys.
+		typedef SecBlock<byte, AllocatorWithCleanup<byte, true> >     AlignedByteBlock;
+		typedef SecBlock<word32, AllocatorWithCleanup<word32, true> > AlignedWordBlock;
+
+		AlignedWordBlock  m_rk;  // round keys
+		AlignedWordBlock  m_w;   // w0, w1, w2, w3, t and u
+		unsigned int m_rounds;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+typedef ARIA::Encryption ARIAEncryption;
+typedef ARIA::Decryption ARIADecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/ariatab.cpp b/runtime/third_party/cryptopp/ariatab.cpp
new file mode 100644
index 0000000..7db92df
--- /dev/null
+++ b/runtime/third_party/cryptopp/ariatab.cpp
@@ -0,0 +1,166 @@
+// ariatab.cpp - written and placed in the public domain by Jeffrey Walton
+
+#include "pch.h"
+#include "config.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(ARIATab)
+
+CRYPTOPP_ALIGN_DATA(16)
+CRYPTOPP_TABLE
+const word32 S1[256]={
+	0x00636363,0x007c7c7c,0x00777777,0x007b7b7b,0x00f2f2f2,0x006b6b6b,0x006f6f6f,0x00c5c5c5,
+	0x00303030,0x00010101,0x00676767,0x002b2b2b,0x00fefefe,0x00d7d7d7,0x00ababab,0x00767676,
+	0x00cacaca,0x00828282,0x00c9c9c9,0x007d7d7d,0x00fafafa,0x00595959,0x00474747,0x00f0f0f0,
+	0x00adadad,0x00d4d4d4,0x00a2a2a2,0x00afafaf,0x009c9c9c,0x00a4a4a4,0x00727272,0x00c0c0c0,
+	0x00b7b7b7,0x00fdfdfd,0x00939393,0x00262626,0x00363636,0x003f3f3f,0x00f7f7f7,0x00cccccc,
+	0x00343434,0x00a5a5a5,0x00e5e5e5,0x00f1f1f1,0x00717171,0x00d8d8d8,0x00313131,0x00151515,
+	0x00040404,0x00c7c7c7,0x00232323,0x00c3c3c3,0x00181818,0x00969696,0x00050505,0x009a9a9a,
+	0x00070707,0x00121212,0x00808080,0x00e2e2e2,0x00ebebeb,0x00272727,0x00b2b2b2,0x00757575,
+	0x00090909,0x00838383,0x002c2c2c,0x001a1a1a,0x001b1b1b,0x006e6e6e,0x005a5a5a,0x00a0a0a0,
+	0x00525252,0x003b3b3b,0x00d6d6d6,0x00b3b3b3,0x00292929,0x00e3e3e3,0x002f2f2f,0x00848484,
+	0x00535353,0x00d1d1d1,0x00000000,0x00ededed,0x00202020,0x00fcfcfc,0x00b1b1b1,0x005b5b5b,
+	0x006a6a6a,0x00cbcbcb,0x00bebebe,0x00393939,0x004a4a4a,0x004c4c4c,0x00585858,0x00cfcfcf,
+	0x00d0d0d0,0x00efefef,0x00aaaaaa,0x00fbfbfb,0x00434343,0x004d4d4d,0x00333333,0x00858585,
+	0x00454545,0x00f9f9f9,0x00020202,0x007f7f7f,0x00505050,0x003c3c3c,0x009f9f9f,0x00a8a8a8,
+	0x00515151,0x00a3a3a3,0x00404040,0x008f8f8f,0x00929292,0x009d9d9d,0x00383838,0x00f5f5f5,
+	0x00bcbcbc,0x00b6b6b6,0x00dadada,0x00212121,0x00101010,0x00ffffff,0x00f3f3f3,0x00d2d2d2,
+	0x00cdcdcd,0x000c0c0c,0x00131313,0x00ececec,0x005f5f5f,0x00979797,0x00444444,0x00171717,
+	0x00c4c4c4,0x00a7a7a7,0x007e7e7e,0x003d3d3d,0x00646464,0x005d5d5d,0x00191919,0x00737373,
+	0x00606060,0x00818181,0x004f4f4f,0x00dcdcdc,0x00222222,0x002a2a2a,0x00909090,0x00888888,
+	0x00464646,0x00eeeeee,0x00b8b8b8,0x00141414,0x00dedede,0x005e5e5e,0x000b0b0b,0x00dbdbdb,
+	0x00e0e0e0,0x00323232,0x003a3a3a,0x000a0a0a,0x00494949,0x00060606,0x00242424,0x005c5c5c,
+	0x00c2c2c2,0x00d3d3d3,0x00acacac,0x00626262,0x00919191,0x00959595,0x00e4e4e4,0x00797979,
+	0x00e7e7e7,0x00c8c8c8,0x00373737,0x006d6d6d,0x008d8d8d,0x00d5d5d5,0x004e4e4e,0x00a9a9a9,
+	0x006c6c6c,0x00565656,0x00f4f4f4,0x00eaeaea,0x00656565,0x007a7a7a,0x00aeaeae,0x00080808,
+	0x00bababa,0x00787878,0x00252525,0x002e2e2e,0x001c1c1c,0x00a6a6a6,0x00b4b4b4,0x00c6c6c6,
+	0x00e8e8e8,0x00dddddd,0x00747474,0x001f1f1f,0x004b4b4b,0x00bdbdbd,0x008b8b8b,0x008a8a8a,
+	0x00707070,0x003e3e3e,0x00b5b5b5,0x00666666,0x00484848,0x00030303,0x00f6f6f6,0x000e0e0e,
+	0x00616161,0x00353535,0x00575757,0x00b9b9b9,0x00868686,0x00c1c1c1,0x001d1d1d,0x009e9e9e,
+	0x00e1e1e1,0x00f8f8f8,0x00989898,0x00111111,0x00696969,0x00d9d9d9,0x008e8e8e,0x00949494,
+	0x009b9b9b,0x001e1e1e,0x00878787,0x00e9e9e9,0x00cecece,0x00555555,0x00282828,0x00dfdfdf,
+	0x008c8c8c,0x00a1a1a1,0x00898989,0x000d0d0d,0x00bfbfbf,0x00e6e6e6,0x00424242,0x00686868,
+	0x00414141,0x00999999,0x002d2d2d,0x000f0f0f,0x00b0b0b0,0x00545454,0x00bbbbbb,0x00161616
+};
+
+CRYPTOPP_ALIGN_DATA(16)
+CRYPTOPP_TABLE
+const word32 S2[256]={
+	0xe200e2e2,0x4e004e4e,0x54005454,0xfc00fcfc,0x94009494,0xc200c2c2,0x4a004a4a,0xcc00cccc,
+	0x62006262,0x0d000d0d,0x6a006a6a,0x46004646,0x3c003c3c,0x4d004d4d,0x8b008b8b,0xd100d1d1,
+	0x5e005e5e,0xfa00fafa,0x64006464,0xcb00cbcb,0xb400b4b4,0x97009797,0xbe00bebe,0x2b002b2b,
+	0xbc00bcbc,0x77007777,0x2e002e2e,0x03000303,0xd300d3d3,0x19001919,0x59005959,0xc100c1c1,
+	0x1d001d1d,0x06000606,0x41004141,0x6b006b6b,0x55005555,0xf000f0f0,0x99009999,0x69006969,
+	0xea00eaea,0x9c009c9c,0x18001818,0xae00aeae,0x63006363,0xdf00dfdf,0xe700e7e7,0xbb00bbbb,
+	0x00000000,0x73007373,0x66006666,0xfb00fbfb,0x96009696,0x4c004c4c,0x85008585,0xe400e4e4,
+	0x3a003a3a,0x09000909,0x45004545,0xaa00aaaa,0x0f000f0f,0xee00eeee,0x10001010,0xeb00ebeb,
+	0x2d002d2d,0x7f007f7f,0xf400f4f4,0x29002929,0xac00acac,0xcf00cfcf,0xad00adad,0x91009191,
+	0x8d008d8d,0x78007878,0xc800c8c8,0x95009595,0xf900f9f9,0x2f002f2f,0xce00cece,0xcd00cdcd,
+	0x08000808,0x7a007a7a,0x88008888,0x38003838,0x5c005c5c,0x83008383,0x2a002a2a,0x28002828,
+	0x47004747,0xdb00dbdb,0xb800b8b8,0xc700c7c7,0x93009393,0xa400a4a4,0x12001212,0x53005353,
+	0xff00ffff,0x87008787,0x0e000e0e,0x31003131,0x36003636,0x21002121,0x58005858,0x48004848,
+	0x01000101,0x8e008e8e,0x37003737,0x74007474,0x32003232,0xca00caca,0xe900e9e9,0xb100b1b1,
+	0xb700b7b7,0xab00abab,0x0c000c0c,0xd700d7d7,0xc400c4c4,0x56005656,0x42004242,0x26002626,
+	0x07000707,0x98009898,0x60006060,0xd900d9d9,0xb600b6b6,0xb900b9b9,0x11001111,0x40004040,
+	0xec00ecec,0x20002020,0x8c008c8c,0xbd00bdbd,0xa000a0a0,0xc900c9c9,0x84008484,0x04000404,
+	0x49004949,0x23002323,0xf100f1f1,0x4f004f4f,0x50005050,0x1f001f1f,0x13001313,0xdc00dcdc,
+	0xd800d8d8,0xc000c0c0,0x9e009e9e,0x57005757,0xe300e3e3,0xc300c3c3,0x7b007b7b,0x65006565,
+	0x3b003b3b,0x02000202,0x8f008f8f,0x3e003e3e,0xe800e8e8,0x25002525,0x92009292,0xe500e5e5,
+	0x15001515,0xdd00dddd,0xfd00fdfd,0x17001717,0xa900a9a9,0xbf00bfbf,0xd400d4d4,0x9a009a9a,
+	0x7e007e7e,0xc500c5c5,0x39003939,0x67006767,0xfe00fefe,0x76007676,0x9d009d9d,0x43004343,
+	0xa700a7a7,0xe100e1e1,0xd000d0d0,0xf500f5f5,0x68006868,0xf200f2f2,0x1b001b1b,0x34003434,
+	0x70007070,0x05000505,0xa300a3a3,0x8a008a8a,0xd500d5d5,0x79007979,0x86008686,0xa800a8a8,
+	0x30003030,0xc600c6c6,0x51005151,0x4b004b4b,0x1e001e1e,0xa600a6a6,0x27002727,0xf600f6f6,
+	0x35003535,0xd200d2d2,0x6e006e6e,0x24002424,0x16001616,0x82008282,0x5f005f5f,0xda00dada,
+	0xe600e6e6,0x75007575,0xa200a2a2,0xef00efef,0x2c002c2c,0xb200b2b2,0x1c001c1c,0x9f009f9f,
+	0x5d005d5d,0x6f006f6f,0x80008080,0x0a000a0a,0x72007272,0x44004444,0x9b009b9b,0x6c006c6c,
+	0x90009090,0x0b000b0b,0x5b005b5b,0x33003333,0x7d007d7d,0x5a005a5a,0x52005252,0xf300f3f3,
+	0x61006161,0xa100a1a1,0xf700f7f7,0xb000b0b0,0xd600d6d6,0x3f003f3f,0x7c007c7c,0x6d006d6d,
+	0xed00eded,0x14001414,0xe000e0e0,0xa500a5a5,0x3d003d3d,0x22002222,0xb300b3b3,0xf800f8f8,
+	0x89008989,0xde00dede,0x71007171,0x1a001a1a,0xaf00afaf,0xba00baba,0xb500b5b5,0x81008181
+};
+
+CRYPTOPP_ALIGN_DATA(16)
+CRYPTOPP_TABLE
+const word32 X1[256]={
+	0x52520052,0x09090009,0x6a6a006a,0xd5d500d5,0x30300030,0x36360036,0xa5a500a5,0x38380038,
+	0xbfbf00bf,0x40400040,0xa3a300a3,0x9e9e009e,0x81810081,0xf3f300f3,0xd7d700d7,0xfbfb00fb,
+	0x7c7c007c,0xe3e300e3,0x39390039,0x82820082,0x9b9b009b,0x2f2f002f,0xffff00ff,0x87870087,
+	0x34340034,0x8e8e008e,0x43430043,0x44440044,0xc4c400c4,0xdede00de,0xe9e900e9,0xcbcb00cb,
+	0x54540054,0x7b7b007b,0x94940094,0x32320032,0xa6a600a6,0xc2c200c2,0x23230023,0x3d3d003d,
+	0xeeee00ee,0x4c4c004c,0x95950095,0x0b0b000b,0x42420042,0xfafa00fa,0xc3c300c3,0x4e4e004e,
+	0x08080008,0x2e2e002e,0xa1a100a1,0x66660066,0x28280028,0xd9d900d9,0x24240024,0xb2b200b2,
+	0x76760076,0x5b5b005b,0xa2a200a2,0x49490049,0x6d6d006d,0x8b8b008b,0xd1d100d1,0x25250025,
+	0x72720072,0xf8f800f8,0xf6f600f6,0x64640064,0x86860086,0x68680068,0x98980098,0x16160016,
+	0xd4d400d4,0xa4a400a4,0x5c5c005c,0xcccc00cc,0x5d5d005d,0x65650065,0xb6b600b6,0x92920092,
+	0x6c6c006c,0x70700070,0x48480048,0x50500050,0xfdfd00fd,0xeded00ed,0xb9b900b9,0xdada00da,
+	0x5e5e005e,0x15150015,0x46460046,0x57570057,0xa7a700a7,0x8d8d008d,0x9d9d009d,0x84840084,
+	0x90900090,0xd8d800d8,0xabab00ab,0x00000000,0x8c8c008c,0xbcbc00bc,0xd3d300d3,0x0a0a000a,
+	0xf7f700f7,0xe4e400e4,0x58580058,0x05050005,0xb8b800b8,0xb3b300b3,0x45450045,0x06060006,
+	0xd0d000d0,0x2c2c002c,0x1e1e001e,0x8f8f008f,0xcaca00ca,0x3f3f003f,0x0f0f000f,0x02020002,
+	0xc1c100c1,0xafaf00af,0xbdbd00bd,0x03030003,0x01010001,0x13130013,0x8a8a008a,0x6b6b006b,
+	0x3a3a003a,0x91910091,0x11110011,0x41410041,0x4f4f004f,0x67670067,0xdcdc00dc,0xeaea00ea,
+	0x97970097,0xf2f200f2,0xcfcf00cf,0xcece00ce,0xf0f000f0,0xb4b400b4,0xe6e600e6,0x73730073,
+	0x96960096,0xacac00ac,0x74740074,0x22220022,0xe7e700e7,0xadad00ad,0x35350035,0x85850085,
+	0xe2e200e2,0xf9f900f9,0x37370037,0xe8e800e8,0x1c1c001c,0x75750075,0xdfdf00df,0x6e6e006e,
+	0x47470047,0xf1f100f1,0x1a1a001a,0x71710071,0x1d1d001d,0x29290029,0xc5c500c5,0x89890089,
+	0x6f6f006f,0xb7b700b7,0x62620062,0x0e0e000e,0xaaaa00aa,0x18180018,0xbebe00be,0x1b1b001b,
+	0xfcfc00fc,0x56560056,0x3e3e003e,0x4b4b004b,0xc6c600c6,0xd2d200d2,0x79790079,0x20200020,
+	0x9a9a009a,0xdbdb00db,0xc0c000c0,0xfefe00fe,0x78780078,0xcdcd00cd,0x5a5a005a,0xf4f400f4,
+	0x1f1f001f,0xdddd00dd,0xa8a800a8,0x33330033,0x88880088,0x07070007,0xc7c700c7,0x31310031,
+	0xb1b100b1,0x12120012,0x10100010,0x59590059,0x27270027,0x80800080,0xecec00ec,0x5f5f005f,
+	0x60600060,0x51510051,0x7f7f007f,0xa9a900a9,0x19190019,0xb5b500b5,0x4a4a004a,0x0d0d000d,
+	0x2d2d002d,0xe5e500e5,0x7a7a007a,0x9f9f009f,0x93930093,0xc9c900c9,0x9c9c009c,0xefef00ef,
+	0xa0a000a0,0xe0e000e0,0x3b3b003b,0x4d4d004d,0xaeae00ae,0x2a2a002a,0xf5f500f5,0xb0b000b0,
+	0xc8c800c8,0xebeb00eb,0xbbbb00bb,0x3c3c003c,0x83830083,0x53530053,0x99990099,0x61610061,
+	0x17170017,0x2b2b002b,0x04040004,0x7e7e007e,0xbaba00ba,0x77770077,0xd6d600d6,0x26260026,
+	0xe1e100e1,0x69690069,0x14140014,0x63630063,0x55550055,0x21210021,0x0c0c000c,0x7d7d007d
+};
+
+CRYPTOPP_ALIGN_DATA(16)
+CRYPTOPP_TABLE
+const word32 X2[256]={
+	0x30303000,0x68686800,0x99999900,0x1b1b1b00,0x87878700,0xb9b9b900,0x21212100,0x78787800,
+	0x50505000,0x39393900,0xdbdbdb00,0xe1e1e100,0x72727200,0x09090900,0x62626200,0x3c3c3c00,
+	0x3e3e3e00,0x7e7e7e00,0x5e5e5e00,0x8e8e8e00,0xf1f1f100,0xa0a0a000,0xcccccc00,0xa3a3a300,
+	0x2a2a2a00,0x1d1d1d00,0xfbfbfb00,0xb6b6b600,0xd6d6d600,0x20202000,0xc4c4c400,0x8d8d8d00,
+	0x81818100,0x65656500,0xf5f5f500,0x89898900,0xcbcbcb00,0x9d9d9d00,0x77777700,0xc6c6c600,
+	0x57575700,0x43434300,0x56565600,0x17171700,0xd4d4d400,0x40404000,0x1a1a1a00,0x4d4d4d00,
+	0xc0c0c000,0x63636300,0x6c6c6c00,0xe3e3e300,0xb7b7b700,0xc8c8c800,0x64646400,0x6a6a6a00,
+	0x53535300,0xaaaaaa00,0x38383800,0x98989800,0x0c0c0c00,0xf4f4f400,0x9b9b9b00,0xededed00,
+	0x7f7f7f00,0x22222200,0x76767600,0xafafaf00,0xdddddd00,0x3a3a3a00,0x0b0b0b00,0x58585800,
+	0x67676700,0x88888800,0x06060600,0xc3c3c300,0x35353500,0x0d0d0d00,0x01010100,0x8b8b8b00,
+	0x8c8c8c00,0xc2c2c200,0xe6e6e600,0x5f5f5f00,0x02020200,0x24242400,0x75757500,0x93939300,
+	0x66666600,0x1e1e1e00,0xe5e5e500,0xe2e2e200,0x54545400,0xd8d8d800,0x10101000,0xcecece00,
+	0x7a7a7a00,0xe8e8e800,0x08080800,0x2c2c2c00,0x12121200,0x97979700,0x32323200,0xababab00,
+	0xb4b4b400,0x27272700,0x0a0a0a00,0x23232300,0xdfdfdf00,0xefefef00,0xcacaca00,0xd9d9d900,
+	0xb8b8b800,0xfafafa00,0xdcdcdc00,0x31313100,0x6b6b6b00,0xd1d1d100,0xadadad00,0x19191900,
+	0x49494900,0xbdbdbd00,0x51515100,0x96969600,0xeeeeee00,0xe4e4e400,0xa8a8a800,0x41414100,
+	0xdadada00,0xffffff00,0xcdcdcd00,0x55555500,0x86868600,0x36363600,0xbebebe00,0x61616100,
+	0x52525200,0xf8f8f800,0xbbbbbb00,0x0e0e0e00,0x82828200,0x48484800,0x69696900,0x9a9a9a00,
+	0xe0e0e000,0x47474700,0x9e9e9e00,0x5c5c5c00,0x04040400,0x4b4b4b00,0x34343400,0x15151500,
+	0x79797900,0x26262600,0xa7a7a700,0xdedede00,0x29292900,0xaeaeae00,0x92929200,0xd7d7d700,
+	0x84848400,0xe9e9e900,0xd2d2d200,0xbababa00,0x5d5d5d00,0xf3f3f300,0xc5c5c500,0xb0b0b000,
+	0xbfbfbf00,0xa4a4a400,0x3b3b3b00,0x71717100,0x44444400,0x46464600,0x2b2b2b00,0xfcfcfc00,
+	0xebebeb00,0x6f6f6f00,0xd5d5d500,0xf6f6f600,0x14141400,0xfefefe00,0x7c7c7c00,0x70707000,
+	0x5a5a5a00,0x7d7d7d00,0xfdfdfd00,0x2f2f2f00,0x18181800,0x83838300,0x16161600,0xa5a5a500,
+	0x91919100,0x1f1f1f00,0x05050500,0x95959500,0x74747400,0xa9a9a900,0xc1c1c100,0x5b5b5b00,
+	0x4a4a4a00,0x85858500,0x6d6d6d00,0x13131300,0x07070700,0x4f4f4f00,0x4e4e4e00,0x45454500,
+	0xb2b2b200,0x0f0f0f00,0xc9c9c900,0x1c1c1c00,0xa6a6a600,0xbcbcbc00,0xececec00,0x73737300,
+	0x90909000,0x7b7b7b00,0xcfcfcf00,0x59595900,0x8f8f8f00,0xa1a1a100,0xf9f9f900,0x2d2d2d00,
+	0xf2f2f200,0xb1b1b100,0x00000000,0x94949400,0x37373700,0x9f9f9f00,0xd0d0d000,0x2e2e2e00,
+	0x9c9c9c00,0x6e6e6e00,0x28282800,0x3f3f3f00,0x80808000,0xf0f0f000,0x3d3d3d00,0xd3d3d300,
+	0x25252500,0x8a8a8a00,0xb5b5b500,0xe7e7e700,0x42424200,0xb3b3b300,0xc7c7c700,0xeaeaea00,
+	0xf7f7f700,0x4c4c4c00,0x11111100,0x33333300,0x03030300,0xa2a2a200,0xacacac00,0x60606000
+};
+
+CRYPTOPP_ALIGN_DATA(16)
+CRYPTOPP_TABLE
+const word32 KRK[3][4] = {
+	{0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0},
+	{0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0},
+	{0xdb92371d, 0x2126e970, 0x03249775, 0x04e8c90e}
+};
+
+NAMESPACE_END
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/arm_simd.h b/runtime/third_party/cryptopp/arm_simd.h
new file mode 100644
index 0000000..b8eabe1
--- /dev/null
+++ b/runtime/third_party/cryptopp/arm_simd.h
@@ -0,0 +1,427 @@
+// arm_simd.h - written and placed in public domain by Jeffrey Walton
+
+/// \file arm_simd.h
+/// \brief Support functions for ARM and vector operations
+
+#ifndef CRYPTOPP_ARM_SIMD_H
+#define CRYPTOPP_ARM_SIMD_H
+
+#include "config.h"
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include <stdint.h>
+# include <arm_neon.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#if (CRYPTOPP_ARM_CRC32_AVAILABLE) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+///	\name CRC32 checksum
+//@{
+
+/// \brief CRC32 checksum
+/// \param crc the starting crc value
+/// \param val the value to checksum
+/// \return CRC32 value
+/// \since Crypto++ 8.6
+inline uint32_t CRC32B (uint32_t crc, uint8_t val)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+	return __crc32b(crc, val);
+#else
+    __asm__ ("crc32b   %w0, %w0, %w1   \n\t"
+            :"+r" (crc) : "r" (val) );
+    return crc;
+#endif
+}
+
+/// \brief CRC32 checksum
+/// \param crc the starting crc value
+/// \param val the value to checksum
+/// \return CRC32 value
+/// \since Crypto++ 8.6
+inline uint32_t CRC32W (uint32_t crc, uint32_t val)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+	return __crc32w(crc, val);
+#else
+    __asm__ ("crc32w   %w0, %w0, %w1   \n\t"
+            :"+r" (crc) : "r" (val) );
+    return crc;
+#endif
+}
+
+/// \brief CRC32 checksum
+/// \param crc the starting crc value
+/// \param vals the values to checksum
+/// \return CRC32 value
+/// \since Crypto++ 8.6
+inline uint32_t CRC32Wx4 (uint32_t crc, const uint32_t vals[4])
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+	return __crc32w(__crc32w(__crc32w(__crc32w(
+             crc, vals[0]), vals[1]), vals[2]), vals[3]);
+#else
+    __asm__ ("crc32w   %w0, %w0, %w1   \n\t"
+             "crc32w   %w0, %w0, %w2   \n\t"
+             "crc32w   %w0, %w0, %w3   \n\t"
+             "crc32w   %w0, %w0, %w4   \n\t"
+            :"+r" (crc) : "r" (vals[0]), "r" (vals[1]),
+                          "r" (vals[2]), "r" (vals[3]));
+    return crc;
+#endif
+}
+
+//@}
+///	\name CRC32-C checksum
+
+/// \brief CRC32-C checksum
+/// \param crc the starting crc value
+/// \param val the value to checksum
+/// \return CRC32-C value
+/// \since Crypto++ 8.6
+inline uint32_t CRC32CB (uint32_t crc, uint8_t val)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+	return __crc32cb(crc, val);
+#else
+    __asm__ ("crc32cb   %w0, %w0, %w1   \n\t"
+            :"+r" (crc) : "r" (val) );
+    return crc;
+#endif
+}
+
+/// \brief CRC32-C checksum
+/// \param crc the starting crc value
+/// \param val the value to checksum
+/// \return CRC32-C value
+/// \since Crypto++ 8.6
+inline uint32_t CRC32CW (uint32_t crc, uint32_t val)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+	return __crc32cw(crc, val);
+#else
+    __asm__ ("crc32cw   %w0, %w0, %w1   \n\t"
+            :"+r" (crc) : "r" (val) );
+    return crc;
+#endif
+}
+
+/// \brief CRC32-C checksum
+/// \param crc the starting crc value
+/// \param vals the values to checksum
+/// \return CRC32-C value
+/// \since Crypto++ 8.6
+inline uint32_t CRC32CWx4 (uint32_t crc, const uint32_t vals[4])
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+	return __crc32cw(__crc32cw(__crc32cw(__crc32cw(
+             crc, vals[0]), vals[1]), vals[2]), vals[3]);
+#else
+    __asm__ ("crc32cw   %w0, %w0, %w1   \n\t"
+             "crc32cw   %w0, %w0, %w2   \n\t"
+             "crc32cw   %w0, %w0, %w3   \n\t"
+             "crc32cw   %w0, %w0, %w4   \n\t"
+            :"+r" (crc) : "r" (vals[0]), "r" (vals[1]),
+                          "r" (vals[2]), "r" (vals[3]));
+    return crc;
+#endif
+}
+//@}
+#endif  // CRYPTOPP_ARM_CRC32_AVAILABLE
+
+#if (CRYPTOPP_ARM_PMULL_AVAILABLE) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+///	\name Polynomial multiplication
+//@{
+
+/// \brief Polynomial multiplication
+/// \param a the first value
+/// \param b the second value
+/// \return vector product
+/// \details PMULL_00() performs polynomial multiplication and presents
+///  the result like Intel's <tt>c = _mm_clmulepi64_si128(a, b, 0x00)</tt>.
+///  The <tt>0x00</tt> indicates the low 64-bits of <tt>a</tt> and <tt>b</tt>
+///  are multiplied.
+/// \note An Intel XMM register is composed of 128-bits. The leftmost bit
+///  is MSB and numbered 127, while the rightmost bit is LSB and
+///  numbered 0.
+/// \since Crypto++ 8.0
+inline uint64x2_t PMULL_00(const uint64x2_t a, const uint64x2_t b)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    const __n64 x = { vgetq_lane_u64(a, 0) };
+    const __n64 y = { vgetq_lane_u64(b, 0) };
+    return vmull_p64(x, y);
+#elif defined(__GNUC__)
+    uint64x2_t r;
+    __asm__ ("pmull    %0.1q, %1.1d, %2.1d   \n\t"
+            :"=w" (r) : "w" (a), "w" (b) );
+    return r;
+#else
+    return (uint64x2_t)(vmull_p64(
+        vgetq_lane_u64(vreinterpretq_u64_u8(a),0),
+        vgetq_lane_u64(vreinterpretq_u64_u8(b),0)));
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first value
+/// \param b the second value
+/// \return vector product
+/// \details PMULL_01 performs() polynomial multiplication and presents
+///  the result like Intel's <tt>c = _mm_clmulepi64_si128(a, b, 0x01)</tt>.
+///  The <tt>0x01</tt> indicates the low 64-bits of <tt>a</tt> and high
+///  64-bits of <tt>b</tt> are multiplied.
+/// \note An Intel XMM register is composed of 128-bits. The leftmost bit
+///  is MSB and numbered 127, while the rightmost bit is LSB and
+///  numbered 0.
+/// \since Crypto++ 8.0
+inline uint64x2_t PMULL_01(const uint64x2_t a, const uint64x2_t b)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    const __n64 x = { vgetq_lane_u64(a, 0) };
+    const __n64 y = { vgetq_lane_u64(b, 1) };
+    return vmull_p64(x, y);
+#elif defined(__GNUC__)
+    uint64x2_t r;
+    __asm__ ("pmull    %0.1q, %1.1d, %2.1d   \n\t"
+            :"=w" (r) : "w" (a), "w" (vget_high_u64(b)) );
+    return r;
+#else
+    return (uint64x2_t)(vmull_p64(
+        vgetq_lane_u64(vreinterpretq_u64_u8(a),0),
+        vgetq_lane_u64(vreinterpretq_u64_u8(b),1)));
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first value
+/// \param b the second value
+/// \return vector product
+/// \details PMULL_10() performs polynomial multiplication and presents
+///  the result like Intel's <tt>c = _mm_clmulepi64_si128(a, b, 0x10)</tt>.
+///  The <tt>0x10</tt> indicates the high 64-bits of <tt>a</tt> and low
+///  64-bits of <tt>b</tt> are multiplied.
+/// \note An Intel XMM register is composed of 128-bits. The leftmost bit
+///  is MSB and numbered 127, while the rightmost bit is LSB and
+///  numbered 0.
+/// \since Crypto++ 8.0
+inline uint64x2_t PMULL_10(const uint64x2_t a, const uint64x2_t b)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    const __n64 x = { vgetq_lane_u64(a, 1) };
+    const __n64 y = { vgetq_lane_u64(b, 0) };
+    return vmull_p64(x, y);
+#elif defined(__GNUC__)
+    uint64x2_t r;
+    __asm__ ("pmull    %0.1q, %1.1d, %2.1d   \n\t"
+            :"=w" (r) : "w" (vget_high_u64(a)), "w" (b) );
+    return r;
+#else
+    return (uint64x2_t)(vmull_p64(
+        vgetq_lane_u64(vreinterpretq_u64_u8(a),1),
+        vgetq_lane_u64(vreinterpretq_u64_u8(b),0)));
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first value
+/// \param b the second value
+/// \return vector product
+/// \details PMULL_11() performs polynomial multiplication and presents
+///  the result like Intel's <tt>c = _mm_clmulepi64_si128(a, b, 0x11)</tt>.
+///  The <tt>0x11</tt> indicates the high 64-bits of <tt>a</tt> and <tt>b</tt>
+///  are multiplied.
+/// \note An Intel XMM register is composed of 128-bits. The leftmost bit
+///  is MSB and numbered 127, while the rightmost bit is LSB and
+///  numbered 0.
+/// \since Crypto++ 8.0
+inline uint64x2_t PMULL_11(const uint64x2_t a, const uint64x2_t b)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    const __n64 x = { vgetq_lane_u64(a, 1) };
+    const __n64 y = { vgetq_lane_u64(b, 1) };
+    return vmull_p64(x, y);
+#elif defined(__GNUC__)
+    uint64x2_t r;
+    __asm__ ("pmull2   %0.1q, %1.2d, %2.2d   \n\t"
+            :"=w" (r) : "w" (a), "w" (b) );
+    return r;
+#else
+    return (uint64x2_t)(vmull_p64(
+        vgetq_lane_u64(vreinterpretq_u64_u8(a),1),
+        vgetq_lane_u64(vreinterpretq_u64_u8(b),1)));
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first value
+/// \param b the second value
+/// \return vector product
+/// \details PMULL() performs vmull_p64(). PMULL is provided as
+///  GCC inline assembly due to Clang and lack of support for the intrinsic.
+/// \since Crypto++ 8.0
+inline uint64x2_t PMULL(const uint64x2_t a, const uint64x2_t b)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    const __n64 x = { vgetq_lane_u64(a, 0) };
+    const __n64 y = { vgetq_lane_u64(b, 0) };
+    return vmull_p64(x, y);
+#elif defined(__GNUC__)
+    uint64x2_t r;
+    __asm__ ("pmull    %0.1q, %1.1d, %2.1d   \n\t"
+            :"=w" (r) : "w" (a), "w" (b) );
+    return r;
+#else
+    return (uint64x2_t)(vmull_p64(
+        vgetq_lane_u64(vreinterpretq_u64_u8(a),0),
+        vgetq_lane_u64(vreinterpretq_u64_u8(b),0)));
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first value
+/// \param b the second value
+/// \return vector product
+/// \details PMULL_HIGH() performs vmull_high_p64(). PMULL_HIGH is provided as
+///  GCC inline assembly due to Clang and lack of support for the intrinsic.
+/// \since Crypto++ 8.0
+inline uint64x2_t PMULL_HIGH(const uint64x2_t a, const uint64x2_t b)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    const __n64 x = { vgetq_lane_u64(a, 1) };
+    const __n64 y = { vgetq_lane_u64(b, 1) };
+    return vmull_p64(x, y);
+#elif defined(__GNUC__)
+    uint64x2_t r;
+    __asm__ ("pmull2   %0.1q, %1.2d, %2.2d   \n\t"
+            :"=w" (r) : "w" (a), "w" (b) );
+    return r;
+#else
+    return (uint64x2_t)(vmull_p64(
+        vgetq_lane_u64(vreinterpretq_u64_u8(a),1),
+        vgetq_lane_u64(vreinterpretq_u64_u8(b),1))));
+#endif
+}
+
+/// \brief Vector extraction
+/// \tparam C the byte count
+/// \param a the first value
+/// \param b the second value
+/// \return vector
+/// \details VEXT_U8() extracts the first <tt>C</tt> bytes of vector
+///  <tt>a</tt> and the remaining bytes in <tt>b</tt>. VEXT_U8 is provided
+///  as GCC inline assembly due to Clang and lack of support for the intrinsic.
+/// \since Crypto++ 8.0
+template <unsigned int C>
+inline uint64x2_t VEXT_U8(uint64x2_t a, uint64x2_t b)
+{
+    // https://github.com/weidai11/cryptopp/issues/366
+#if defined(CRYPTOPP_MSC_VERSION)
+    return vreinterpretq_u64_u8(vextq_u8(
+        vreinterpretq_u8_u64(a), vreinterpretq_u8_u64(b), C));
+#else
+    uint64x2_t r;
+    __asm__ ("ext   %0.16b, %1.16b, %2.16b, %3   \n\t"
+            :"=w" (r) : "w" (a), "w" (b), "I" (C) );
+    return r;
+#endif
+}
+
+//@}
+#endif // CRYPTOPP_ARM_PMULL_AVAILABLE
+
+#if CRYPTOPP_ARM_SHA3_AVAILABLE  || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+///	\name ARMv8.2 operations
+//@{
+
+/// \brief Three-way XOR
+/// \param a the first value
+/// \param b the second value
+/// \param c the third value
+/// \return three-way exclusive OR of the values
+/// \details VEOR3() performs veor3q_u64(). VEOR3 is provided as GCC inline assembly due
+///  to Clang and lack of support for the intrinsic.
+/// \details VEOR3 requires ARMv8.2.
+/// \since Crypto++ 8.6
+inline uint64x2_t VEOR3(uint64x2_t a, uint64x2_t b, uint64x2_t c)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    return veor3q_u64(a, b, c);
+#else
+    uint64x2_t r;
+    __asm__ ("eor3   %0.16b, %1.16b, %2.16b, %3.16b   \n\t"
+            :"=w" (r) : "w" (a), "w" (b), "w" (c));
+    return r;
+#endif
+}
+
+/// \brief XOR and rotate
+/// \param a the first value
+/// \param b the second value
+/// \param c the third value
+/// \return two-way exclusive OR of the values, then rotated by c
+/// \details VXARQ() performs vxarq_u64(). VXARQ is provided as GCC inline assembly due
+///  to Clang and lack of support for the intrinsic.
+/// \details VXARQ requires ARMv8.2.
+/// \since Crypto++ 8.6
+inline uint64x2_t VXAR(uint64x2_t a, uint64x2_t b, const int c)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    return vxarq_u64(a, b, c);
+#else
+    uint64x2_t r;
+    __asm__ ("xar   %0.2d, %1.2d, %2.2d, %3   \n\t"
+            :"=w" (r) : "w" (a), "w" (b), "I" (c));
+    return r;
+#endif
+}
+
+/// \brief XOR and rotate
+/// \tparam C the rotate amount
+/// \param a the first value
+/// \param b the second value
+/// \return two-way exclusive OR of the values, then rotated by C
+/// \details VXARQ() performs vxarq_u64(). VXARQ is provided as GCC inline assembly due
+///  to Clang and lack of support for the intrinsic.
+/// \details VXARQ requires ARMv8.2.
+/// \since Crypto++ 8.6
+template <unsigned int C>
+inline uint64x2_t VXAR(uint64x2_t a, uint64x2_t b)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    return vxarq_u64(a, b, C);
+#else
+    uint64x2_t r;
+    __asm__ ("xar   %0.2d, %1.2d, %2.2d, %3   \n\t"
+            :"=w" (r) : "w" (a), "w" (b), "I" (C));
+    return r;
+#endif
+}
+
+/// \brief XOR and rotate
+/// \param a the first value
+/// \param b the second value
+/// \return two-way exclusive OR of the values, then rotated 1-bit
+/// \details VRAX1() performs vrax1q_u64(). VRAX1 is provided as GCC inline assembly due
+///  to Clang and lack of support for the intrinsic.
+/// \details VRAX1 requires ARMv8.2.
+/// \since Crypto++ 8.6
+inline uint64x2_t VRAX1(uint64x2_t a, uint64x2_t b)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    return vrax1q_u64(a, b);
+#else
+    uint64x2_t r;
+    __asm__ ("rax1   %0.2d, %1.2d, %2.2d   \n\t"
+            :"=w" (r) : "w" (a), "w" (b));
+    return r;
+#endif
+}
+//@}
+#endif  // CRYPTOPP_ARM_SHA3_AVAILABLE
+
+#endif // CRYPTOPP_ARM_SIMD_H
diff --git a/runtime/third_party/cryptopp/asn.cpp b/runtime/third_party/cryptopp/asn.cpp
new file mode 100644
index 0000000..a68d164
--- /dev/null
+++ b/runtime/third_party/cryptopp/asn.cpp
@@ -0,0 +1,717 @@
+// asn.cpp - originally written and placed in the public domain by Wei Dai
+//           CryptoPP::Test namespace added by JW in February 2017
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "cryptlib.h"
+#include "asn.h"
+#include "misc.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+#include <time.h>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+size_t DERLengthEncode(BufferedTransformation &bt, lword length)
+{
+	size_t i=0;
+	if (length <= 0x7f)
+	{
+		bt.Put(byte(length));
+		i++;
+	}
+	else
+	{
+		bt.Put(byte(BytePrecision(length) | 0x80));
+		i++;
+		for (int j=BytePrecision(length); j; --j)
+		{
+			bt.Put(byte(length >> (j-1)*8));
+			i++;
+		}
+	}
+	return i;
+}
+
+bool BERLengthDecode(BufferedTransformation &bt, lword &length, bool &definiteLength)
+{
+	byte b;
+
+	if (!bt.Get(b))
+		return false;
+
+	if (!(b & 0x80))
+	{
+		definiteLength = true;
+		length = b;
+	}
+	else
+	{
+		unsigned int lengthBytes = b & 0x7f;
+
+		if (lengthBytes == 0)
+		{
+			definiteLength = false;
+			return true;
+		}
+
+		definiteLength = true;
+		length = 0;
+		while (lengthBytes--)
+		{
+			if (length >> (8*(sizeof(length)-1)))
+				BERDecodeError();	// length about to overflow
+
+			if (!bt.Get(b))
+				return false;
+
+			length = (length << 8) | b;
+		}
+	}
+	return true;
+}
+
+bool BERLengthDecode(BufferedTransformation &bt, size_t &length)
+{
+	lword lw = 0;
+	bool definiteLength = false;
+	if (!BERLengthDecode(bt, lw, definiteLength))
+		BERDecodeError();
+	if (!SafeConvert(lw, length))
+		BERDecodeError();
+	return definiteLength;
+}
+
+void DEREncodeNull(BufferedTransformation &out)
+{
+	out.Put(TAG_NULL);
+	out.Put(0);
+}
+
+void BERDecodeNull(BufferedTransformation &in)
+{
+	byte b;
+	if (!in.Get(b) || b != TAG_NULL)
+		BERDecodeError();
+	size_t length;
+	if (!BERLengthDecode(in, length) || length != 0)
+		BERDecodeError();
+}
+
+/// ASN Strings
+size_t DEREncodeOctetString(BufferedTransformation &bt, const byte *str, size_t strLen)
+{
+	bt.Put(OCTET_STRING);
+	size_t lengthBytes = DERLengthEncode(bt, strLen);
+	bt.Put(str, strLen);
+	return 1+lengthBytes+strLen;
+}
+
+size_t DEREncodeOctetString(BufferedTransformation &bt, const SecByteBlock &str)
+{
+	return DEREncodeOctetString(bt, ConstBytePtr(str), BytePtrSize(str));
+}
+
+size_t BERDecodeOctetString(BufferedTransformation &bt, SecByteBlock &str)
+{
+	byte b;
+	if (!bt.Get(b) || b != OCTET_STRING)
+		BERDecodeError();
+
+	size_t bc;
+	if (!BERLengthDecode(bt, bc))
+		BERDecodeError();
+	if (bc > bt.MaxRetrievable()) // Issue 346
+		BERDecodeError();
+
+	str.New(bc);
+	if (bc != bt.Get(BytePtr(str), bc))
+		BERDecodeError();
+	return bc;
+}
+
+size_t BERDecodeOctetString(BufferedTransformation &bt, BufferedTransformation &str)
+{
+	byte b;
+	if (!bt.Get(b) || b != OCTET_STRING)
+		BERDecodeError();
+
+	size_t bc;
+	if (!BERLengthDecode(bt, bc))
+		BERDecodeError();
+	if (bc > bt.MaxRetrievable()) // Issue 346
+		BERDecodeError();
+
+	bt.TransferTo(str, bc);
+	return bc;
+}
+
+size_t DEREncodeTextString(BufferedTransformation &bt, const byte* str, size_t strLen, byte asnTag)
+{
+	bt.Put(asnTag);
+	size_t lengthBytes = DERLengthEncode(bt, strLen);
+	bt.Put(str, strLen);
+	return 1+lengthBytes+strLen;
+}
+
+size_t DEREncodeTextString(BufferedTransformation &bt, const SecByteBlock &str, byte asnTag)
+{
+	return DEREncodeTextString(bt, ConstBytePtr(str), BytePtrSize(str), asnTag);
+}
+
+size_t DEREncodeTextString(BufferedTransformation &bt, const std::string &str, byte asnTag)
+{
+	return DEREncodeTextString(bt, ConstBytePtr(str), BytePtrSize(str), asnTag);
+}
+
+size_t BERDecodeTextString(BufferedTransformation &bt, SecByteBlock &str, byte asnTag)
+{
+	byte b;
+	if (!bt.Get(b) || b != asnTag)
+		BERDecodeError();
+
+	size_t bc;
+	if (!BERLengthDecode(bt, bc))
+		BERDecodeError();
+	if (bc > bt.MaxRetrievable()) // Issue 346
+		BERDecodeError();
+
+	str.resize(bc);
+	if (bc != bt.Get(BytePtr(str), BytePtrSize(str)))
+		BERDecodeError();
+
+	return bc;
+}
+
+size_t BERDecodeTextString(BufferedTransformation &bt, std::string &str, byte asnTag)
+{
+	byte b;
+	if (!bt.Get(b) || b != asnTag)
+		BERDecodeError();
+
+	size_t bc;
+	if (!BERLengthDecode(bt, bc))
+		BERDecodeError();
+	if (bc > bt.MaxRetrievable()) // Issue 346
+		BERDecodeError();
+
+	str.resize(bc);
+	if (bc != bt.Get(BytePtr(str), BytePtrSize(str)))
+		BERDecodeError();
+
+	return bc;
+}
+
+size_t DEREncodeDate(BufferedTransformation &bt, const SecByteBlock &str, byte asnTag)
+{
+	bt.Put(asnTag);
+	size_t lengthBytes = DERLengthEncode(bt, str.size());
+	bt.Put(ConstBytePtr(str), BytePtrSize(str));
+	return 1+lengthBytes+str.size();
+}
+
+size_t BERDecodeDate(BufferedTransformation &bt, SecByteBlock &str, byte asnTag)
+{
+	byte b;
+	if (!bt.Get(b) || b != asnTag)
+		BERDecodeError();
+
+	size_t bc;
+	if (!BERLengthDecode(bt, bc))
+		BERDecodeError();
+	if (bc > bt.MaxRetrievable()) // Issue 346
+		BERDecodeError();
+
+	str.resize(bc);
+	if (bc != bt.Get(BytePtr(str), BytePtrSize(str)))
+		BERDecodeError();
+
+	return bc;
+}
+
+size_t DEREncodeBitString(BufferedTransformation &bt, const byte *str, size_t strLen, unsigned int unusedBits)
+{
+	bt.Put(BIT_STRING);
+	size_t lengthBytes = DERLengthEncode(bt, strLen+1);
+	bt.Put((byte)unusedBits);
+	bt.Put(str, strLen);
+	return 2+lengthBytes+strLen;
+}
+
+size_t BERDecodeBitString(BufferedTransformation &bt, SecByteBlock &str, unsigned int &unusedBits)
+{
+	byte b;
+	if (!bt.Get(b) || b != BIT_STRING)
+		BERDecodeError();
+
+	size_t bc;
+	if (!BERLengthDecode(bt, bc))
+		BERDecodeError();
+	if (bc == 0)
+		BERDecodeError();
+	if (bc > bt.MaxRetrievable()) // Issue 346
+		BERDecodeError();
+
+	// X.690, 8.6.2.2: "The number [of unused bits] shall be in the range zero to seven"
+	byte unused;
+	if (!bt.Get(unused) || unused > 7)
+		BERDecodeError();
+	unusedBits = unused;
+	str.resize(bc-1);
+	if ((bc-1) != bt.Get(BytePtr(str), bc-1))
+		BERDecodeError();
+	return bc-1;
+}
+
+void DERReencode(BufferedTransformation &source, BufferedTransformation &dest)
+{
+	byte tag;
+	source.Peek(tag);
+	BERGeneralDecoder decoder(source, tag);
+	DERGeneralEncoder encoder(dest, tag);
+	if (decoder.IsDefiniteLength())
+		decoder.TransferTo(encoder, decoder.RemainingLength());
+	else
+	{
+		while (!decoder.EndReached())
+			DERReencode(decoder, encoder);
+	}
+	decoder.MessageEnd();
+	encoder.MessageEnd();
+}
+
+size_t BERDecodePeekLength(const BufferedTransformation &bt)
+{
+	lword count = (std::min)(bt.MaxRetrievable(), static_cast<lword>(16));
+	if (count == 0) return 0;
+
+	ByteQueue tagAndLength;
+	bt.CopyTo(tagAndLength, count);
+
+	// Skip tag
+	tagAndLength.Skip(1);
+
+	// BERLengthDecode fails for indefinite length.
+	size_t length;
+	if (!BERLengthDecode(tagAndLength, length))
+		return 0;
+
+	return length;
+}
+
+void OID::EncodeValue(BufferedTransformation &bt, word32 v)
+{
+	for (unsigned int i=RoundUpToMultipleOf(STDMAX(7U,BitPrecision(v)), 7U)-7; i != 0; i-=7)
+		bt.Put((byte)(0x80 | ((v >> i) & 0x7f)));
+	bt.Put((byte)(v & 0x7f));
+}
+
+size_t OID::DecodeValue(BufferedTransformation &bt, word32 &v)
+{
+	byte b;
+	size_t i=0;
+	v = 0;
+	while (true)
+	{
+		if (!bt.Get(b))
+			BERDecodeError();
+		i++;
+		if (v >> (8*sizeof(v)-7))	// v about to overflow
+			BERDecodeError();
+		v <<= 7;
+		v += b & 0x7f;
+		if (!(b & 0x80))
+			return i;
+	}
+}
+
+void OID::DEREncode(BufferedTransformation &bt) const
+{
+	CRYPTOPP_ASSERT(m_values.size() >= 2);
+	ByteQueue temp;
+	temp.Put(byte(m_values[0] * 40 + m_values[1]));
+	for (size_t i=2; i<m_values.size(); i++)
+		EncodeValue(temp, m_values[i]);
+	bt.Put(OBJECT_IDENTIFIER);
+	DERLengthEncode(bt, temp.CurrentSize());
+	temp.TransferTo(bt);
+}
+
+void OID::BERDecode(BufferedTransformation &bt)
+{
+	byte b;
+	if (!bt.Get(b) || b != OBJECT_IDENTIFIER)
+		BERDecodeError();
+
+	size_t length;
+	if (!BERLengthDecode(bt, length) || length < 1)
+		BERDecodeError();
+
+	if (!bt.Get(b))
+		BERDecodeError();
+
+	length--;
+	m_values.resize(2);
+	m_values[0] = b / 40;
+	m_values[1] = b % 40;
+
+	while (length > 0)
+	{
+		word32 v;
+		size_t valueLen = DecodeValue(bt, v);
+		if (valueLen > length)
+			BERDecodeError();
+		m_values.push_back(v);
+		length -= valueLen;
+	}
+}
+
+void OID::BERDecodeAndCheck(BufferedTransformation &bt) const
+{
+	OID oid(bt);
+	if (*this != oid)
+		BERDecodeError();
+}
+
+std::ostream& OID::Print(std::ostream& out) const
+{
+	std::ostringstream oss;
+	for (size_t i = 0; i < m_values.size(); ++i)
+	{
+		oss << m_values[i];
+		if (i+1 < m_values.size())
+			oss << ".";
+	}
+	return out << oss.str();
+}
+
+inline BufferedTransformation & EncodedObjectFilter::CurrentTarget()
+{
+	if (m_flags & PUT_OBJECTS)
+		return *AttachedTransformation();
+	else
+		return TheBitBucket();
+}
+
+void EncodedObjectFilter::Put(const byte *inString, size_t length)
+{
+	if (m_nCurrentObject == m_nObjects)
+	{
+		AttachedTransformation()->Put(inString, length);
+		return;
+	}
+
+	LazyPutter lazyPutter(m_queue, inString, length);
+
+	while (m_queue.AnyRetrievable())
+	{
+		switch (m_state)
+		{
+		case IDENTIFIER:
+			if (!m_queue.Get(m_id))
+				return;
+			m_queue.TransferTo(CurrentTarget(), 1);
+			m_state = LENGTH;
+		// fall through
+		case LENGTH:
+		{
+			byte b;
+			if (m_level > 0 && m_id == 0 && m_queue.Peek(b) && b == 0)
+			{
+				m_queue.TransferTo(CurrentTarget(), 1);
+				m_level--;
+				m_state = IDENTIFIER;
+				break;
+			}
+			ByteQueue::Walker walker(m_queue);
+			bool definiteLength = false;
+			if (!BERLengthDecode(walker, m_lengthRemaining, definiteLength))
+				return;
+			m_queue.TransferTo(CurrentTarget(), walker.GetCurrentPosition());
+			if (!((m_id & CONSTRUCTED) || definiteLength))
+				BERDecodeError();
+			if (!definiteLength)
+			{
+				if (!(m_id & CONSTRUCTED))
+					BERDecodeError();
+				m_level++;
+				m_state = IDENTIFIER;
+				break;
+			}
+			m_state = BODY;
+		}
+		// fall through
+		case BODY:
+			m_lengthRemaining -= m_queue.TransferTo(CurrentTarget(), m_lengthRemaining);
+
+			if (m_lengthRemaining == 0)
+				m_state = IDENTIFIER;
+		// fall through
+		case TAIL:
+		case ALL_DONE:
+		default: ;
+		}
+
+		if (m_state == IDENTIFIER && m_level == 0)
+		{
+			// just finished processing a level 0 object
+			++m_nCurrentObject;
+
+			if (m_flags & PUT_MESSANGE_END_AFTER_EACH_OBJECT)
+				AttachedTransformation()->MessageEnd();
+
+			if (m_nCurrentObject == m_nObjects)
+			{
+				if (m_flags & PUT_MESSANGE_END_AFTER_ALL_OBJECTS)
+					AttachedTransformation()->MessageEnd();
+
+				if (m_flags & PUT_MESSANGE_SERIES_END_AFTER_ALL_OBJECTS)
+					AttachedTransformation()->MessageSeriesEnd();
+
+				m_queue.TransferAllTo(*AttachedTransformation());
+				return;
+			}
+		}
+	}
+}
+
+BERGeneralDecoder::BERGeneralDecoder(BufferedTransformation &inQueue)
+	: m_inQueue(inQueue), m_length(0), m_finished(false)
+{
+	Init(DefaultTag);
+}
+
+BERGeneralDecoder::BERGeneralDecoder(BufferedTransformation &inQueue, byte asnTag)
+	: m_inQueue(inQueue), m_length(0), m_finished(false)
+{
+	Init(asnTag);
+}
+
+BERGeneralDecoder::BERGeneralDecoder(BERGeneralDecoder &inQueue, byte asnTag)
+	: m_inQueue(inQueue), m_length(0), m_finished(false)
+{
+	Init(asnTag);
+}
+
+void BERGeneralDecoder::Init(byte asnTag)
+{
+	byte b;
+	if (!m_inQueue.Get(b) || b != asnTag)
+		BERDecodeError();
+
+	if (!BERLengthDecode(m_inQueue, m_length, m_definiteLength))
+		BERDecodeError();
+
+	if (!m_definiteLength && !(asnTag & CONSTRUCTED))
+		BERDecodeError();	// cannot be primitive and have indefinite length
+}
+
+BERGeneralDecoder::~BERGeneralDecoder()
+{
+	try	// avoid throwing in destructor
+	{
+		if (!m_finished)
+			MessageEnd();
+	}
+	catch (const Exception&)
+	{
+		// CRYPTOPP_ASSERT(0);
+	}
+}
+
+bool BERGeneralDecoder::EndReached() const
+{
+	if (m_definiteLength)
+		return m_length == 0;
+	else
+	{	// check end-of-content octets
+		word16 i;
+		return (m_inQueue.PeekWord16(i)==2 && i==0);
+	}
+}
+
+byte BERGeneralDecoder::PeekByte() const
+{
+	byte b;
+	if (!Peek(b))
+		BERDecodeError();
+	return b;
+}
+
+void BERGeneralDecoder::CheckByte(byte check)
+{
+	byte b;
+	if (!Get(b) || b != check)
+		BERDecodeError();
+}
+
+void BERGeneralDecoder::MessageEnd()
+{
+	m_finished = true;
+	if (m_definiteLength)
+	{
+		if (m_length != 0)
+			BERDecodeError();
+	}
+	else
+	{	// remove end-of-content octets
+		word16 i;
+		if (m_inQueue.GetWord16(i) != 2 || i != 0)
+			BERDecodeError();
+	}
+}
+
+size_t BERGeneralDecoder::TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel, bool blocking)
+{
+	if (m_definiteLength && transferBytes > m_length)
+		transferBytes = m_length;
+	size_t blockedBytes = m_inQueue.TransferTo2(target, transferBytes, channel, blocking);
+	ReduceLength(transferBytes);
+	return blockedBytes;
+}
+
+size_t BERGeneralDecoder::CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end, const std::string &channel, bool blocking) const
+{
+	if (m_definiteLength)
+		end = STDMIN(m_length, end);
+	return m_inQueue.CopyRangeTo2(target, begin, end, channel, blocking);
+}
+
+lword BERGeneralDecoder::ReduceLength(lword delta)
+{
+	if (m_definiteLength)
+	{
+		if (m_length < delta)
+			BERDecodeError();
+		m_length -= delta;
+	}
+	return delta;
+}
+
+DERGeneralEncoder::DERGeneralEncoder(BufferedTransformation &outQueue)
+	: m_outQueue(outQueue), m_asnTag(DefaultTag), m_finished(false)
+{
+}
+
+DERGeneralEncoder::DERGeneralEncoder(BufferedTransformation &outQueue, byte asnTag)
+	: m_outQueue(outQueue), m_asnTag(asnTag), m_finished(false)
+{
+}
+
+DERGeneralEncoder::DERGeneralEncoder(DERGeneralEncoder &outQueue, byte asnTag)
+	: m_outQueue(outQueue), m_asnTag(asnTag), m_finished(false)
+{
+}
+
+DERGeneralEncoder::~DERGeneralEncoder()
+{
+	try	// avoid throwing in constructor
+	{
+		if (!m_finished)
+			MessageEnd();
+	}
+	catch (const Exception&)
+	{
+		CRYPTOPP_ASSERT(0);
+	}
+}
+
+void DERGeneralEncoder::MessageEnd()
+{
+	m_finished = true;
+	lword length = CurrentSize();
+	m_outQueue.Put(m_asnTag);
+	DERLengthEncode(m_outQueue, length);
+	TransferTo(m_outQueue);
+}
+
+// *************************************************************
+
+void X509PublicKey::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder subjectPublicKeyInfo(bt);
+		BERSequenceDecoder algorithm(subjectPublicKeyInfo);
+			GetAlgorithmID().BERDecodeAndCheck(algorithm);
+			bool parametersPresent = algorithm.EndReached() ? false : BERDecodeAlgorithmParameters(algorithm);
+		algorithm.MessageEnd();
+
+		BERGeneralDecoder subjectPublicKey(subjectPublicKeyInfo, BIT_STRING);
+			subjectPublicKey.CheckByte(0);	// unused bits
+			BERDecodePublicKey(subjectPublicKey, parametersPresent, (size_t)subjectPublicKey.RemainingLength());
+		subjectPublicKey.MessageEnd();
+	subjectPublicKeyInfo.MessageEnd();
+}
+
+void X509PublicKey::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder subjectPublicKeyInfo(bt);
+
+		DERSequenceEncoder algorithm(subjectPublicKeyInfo);
+			GetAlgorithmID().DEREncode(algorithm);
+			DEREncodeAlgorithmParameters(algorithm);
+		algorithm.MessageEnd();
+
+		DERGeneralEncoder subjectPublicKey(subjectPublicKeyInfo, BIT_STRING);
+			subjectPublicKey.Put(0);	// unused bits
+			DEREncodePublicKey(subjectPublicKey);
+		subjectPublicKey.MessageEnd();
+
+	subjectPublicKeyInfo.MessageEnd();
+}
+
+void PKCS8PrivateKey::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder privateKeyInfo(bt);
+		word32 version;
+		BERDecodeUnsigned<word32>(privateKeyInfo, version, INTEGER, 0, 0);	// check version
+
+		BERSequenceDecoder algorithm(privateKeyInfo);
+			GetAlgorithmID().BERDecodeAndCheck(algorithm);
+			bool parametersPresent = algorithm.EndReached() ? false : BERDecodeAlgorithmParameters(algorithm);
+		algorithm.MessageEnd();
+
+		BERGeneralDecoder octetString(privateKeyInfo, OCTET_STRING);
+			BERDecodePrivateKey(octetString, parametersPresent, (size_t)privateKeyInfo.RemainingLength());
+		octetString.MessageEnd();
+
+		if (!privateKeyInfo.EndReached())
+			BERDecodeOptionalAttributes(privateKeyInfo);
+	privateKeyInfo.MessageEnd();
+}
+
+void PKCS8PrivateKey::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder privateKeyInfo(bt);
+		DEREncodeUnsigned<word32>(privateKeyInfo, 0);	// version
+
+		DERSequenceEncoder algorithm(privateKeyInfo);
+			GetAlgorithmID().DEREncode(algorithm);
+			DEREncodeAlgorithmParameters(algorithm);
+		algorithm.MessageEnd();
+
+		DERGeneralEncoder octetString(privateKeyInfo, OCTET_STRING);
+			DEREncodePrivateKey(octetString);
+		octetString.MessageEnd();
+
+		DEREncodeOptionalAttributes(privateKeyInfo);
+	privateKeyInfo.MessageEnd();
+}
+
+void PKCS8PrivateKey::BERDecodeOptionalAttributes(BufferedTransformation &bt)
+{
+	DERReencode(bt, m_optionalAttributes);
+}
+
+void PKCS8PrivateKey::DEREncodeOptionalAttributes(BufferedTransformation &bt) const
+{
+	m_optionalAttributes.CopyTo(bt);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/asn.h b/runtime/third_party/cryptopp/asn.h
new file mode 100644
index 0000000..cf44fc7
--- /dev/null
+++ b/runtime/third_party/cryptopp/asn.h
@@ -0,0 +1,965 @@
+// asn.h - originally written and placed in the public domain by Wei Dai
+
+/// \file asn.h
+/// \brief Classes and functions for working with ANS.1 objects
+
+#ifndef CRYPTOPP_ASN_H
+#define CRYPTOPP_ASN_H
+
+#include "cryptlib.h"
+#include "filters.h"
+#include "smartptr.h"
+#include "stdcpp.h"
+#include "queue.h"
+#include "misc.h"
+
+#include <iosfwd>
+
+// Issue 340
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wconversion"
+# pragma GCC diagnostic ignored "-Wsign-conversion"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief ASN.1 types
+/// \note These tags are not complete
+enum ASNTag
+{
+	/// \brief ASN.1 Boolean
+	BOOLEAN 			= 0x01,
+	/// \brief ASN.1 Integer
+	INTEGER 			= 0x02,
+	/// \brief ASN.1 Bit string
+	BIT_STRING			= 0x03,
+	/// \brief ASN.1 Octet string
+	OCTET_STRING		= 0x04,
+	/// \brief ASN.1 Null
+	TAG_NULL			= 0x05,
+	/// \brief ASN.1 Object identifier
+	OBJECT_IDENTIFIER	= 0x06,
+	/// \brief ASN.1 Object descriptor
+	OBJECT_DESCRIPTOR	= 0x07,
+	/// \brief ASN.1 External reference
+	EXTERNAL			= 0x08,
+	/// \brief ASN.1 Real integer
+	REAL				= 0x09,
+	/// \brief ASN.1 Enumerated value
+	ENUMERATED			= 0x0a,
+	/// \brief ASN.1 UTF-8 string
+	UTF8_STRING			= 0x0c,
+	/// \brief ASN.1 Sequence
+	SEQUENCE			= 0x10,
+	/// \brief ASN.1 Set
+	SET 				= 0x11,
+	/// \brief ASN.1 Numeric string
+	NUMERIC_STRING		= 0x12,
+	/// \brief ASN.1 Printable string
+	PRINTABLE_STRING 	= 0x13,
+	/// \brief ASN.1 T61 string
+	T61_STRING			= 0x14,
+	/// \brief ASN.1 Videotext string
+	VIDEOTEXT_STRING 	= 0x15,
+	/// \brief ASN.1 IA5 string
+	IA5_STRING			= 0x16,
+	/// \brief ASN.1 UTC time
+	UTC_TIME 			= 0x17,
+	/// \brief ASN.1 Generalized time
+	GENERALIZED_TIME 	= 0x18,
+	/// \brief ASN.1 Graphic string
+	GRAPHIC_STRING		= 0x19,
+	/// \brief ASN.1 Visible string
+	VISIBLE_STRING		= 0x1a,
+	/// \brief ASN.1 General string
+	GENERAL_STRING		= 0x1b,
+	/// \brief ASN.1 Universal string
+	UNIVERSAL_STRING	= 0x1c,
+	/// \brief ASN.1 BMP string
+	BMP_STRING  		= 0x1e
+};
+
+/// \brief ASN.1 flags
+/// \note These flags are not complete
+enum ASNIdFlag
+{
+	/// \brief ASN.1 Universal class
+	UNIVERSAL           = 0x00,
+	// DATA           = 0x01,
+	// HEADER           = 0x02,
+	/// \brief ASN.1 Primitive flag
+	PRIMITIVE           = 0x00,
+	/// \brief ASN.1 Constructed flag
+	CONSTRUCTED         = 0x20,
+	/// \brief ASN.1 Application class
+	APPLICATION         = 0x40,
+	/// \brief ASN.1 Context specific class
+	CONTEXT_SPECIFIC    = 0x80,
+	/// \brief ASN.1 Private class
+	PRIVATE             = 0xc0
+};
+
+/// \brief Raises a BERDecodeErr
+inline void BERDecodeError() {throw BERDecodeErr();}
+
+/// \brief Exception thrown when an unknown object identifier is encountered
+class CRYPTOPP_DLL UnknownOID : public BERDecodeErr
+{
+public:
+	/// \brief Construct an UnknownOID
+	UnknownOID() : BERDecodeErr("BER decode error: unknown object identifier") {}
+	/// \brief Construct an UnknownOID
+	/// \param err error message to use for the exception
+	UnknownOID(const char *err) : BERDecodeErr(err) {}
+};
+
+/// \brief DER encode a length
+/// \param bt BufferedTransformation object for writing
+/// \param length the size to encode
+/// \return the number of octets used for the encoding
+CRYPTOPP_DLL size_t CRYPTOPP_API DERLengthEncode(BufferedTransformation &bt, lword length);
+
+/// \brief BER decode a length
+/// \param bt BufferedTransformation object for reading
+/// \param length the decoded size
+/// \return true if the value was decoded
+/// \throw BERDecodeError if the value fails to decode or is too large for size_t
+/// \details BERLengthDecode() returns false if the encoding is indefinite length.
+CRYPTOPP_DLL bool CRYPTOPP_API BERLengthDecode(BufferedTransformation &bt, size_t &length);
+
+/// \brief DER encode NULL
+/// \param bt BufferedTransformation object for writing
+CRYPTOPP_DLL void CRYPTOPP_API DEREncodeNull(BufferedTransformation &bt);
+
+/// \brief BER decode NULL
+/// \param bt BufferedTransformation object for reading
+CRYPTOPP_DLL void CRYPTOPP_API BERDecodeNull(BufferedTransformation &bt);
+
+/// \brief DER encode octet string
+/// \param bt BufferedTransformation object for writing
+/// \param str the string to encode
+/// \param strLen the length of the string
+/// \return the number of octets used for the encoding
+CRYPTOPP_DLL size_t CRYPTOPP_API DEREncodeOctetString(BufferedTransformation &bt, const byte *str, size_t strLen);
+
+/// \brief DER encode octet string
+/// \param bt BufferedTransformation object for reading
+/// \param str the string to encode
+/// \return the number of octets used for the encoding
+CRYPTOPP_DLL size_t CRYPTOPP_API DEREncodeOctetString(BufferedTransformation &bt, const SecByteBlock &str);
+
+/// \brief BER decode octet string
+/// \param bt BufferedTransformation object for reading
+/// \param str the decoded string
+/// \return the number of octets used for the encoding
+CRYPTOPP_DLL size_t CRYPTOPP_API BERDecodeOctetString(BufferedTransformation &bt, SecByteBlock &str);
+
+/// \brief BER decode octet string
+/// \param bt BufferedTransformation object for reading
+/// \param str the decoded string
+/// \return the number of octets used for the encoding
+CRYPTOPP_DLL size_t CRYPTOPP_API BERDecodeOctetString(BufferedTransformation &bt, BufferedTransformation &str);
+
+/// \brief DER encode text string
+/// \param bt BufferedTransformation object for writing
+/// \param str the string to encode
+/// \param strLen the length of the string, in bytes
+/// \param asnTag the ASN.1 identifier
+/// \return the number of octets used for the encoding
+/// \details DEREncodeTextString() can be used for UTF8_STRING, PRINTABLE_STRING, and IA5_STRING
+/// \since Crypto++ 8.3
+CRYPTOPP_DLL size_t CRYPTOPP_API DEREncodeTextString(BufferedTransformation &bt, const byte* str, size_t strLen, byte asnTag);
+
+/// \brief DER encode text string
+/// \param bt BufferedTransformation object for writing
+/// \param str the string to encode
+/// \param asnTag the ASN.1 identifier
+/// \return the number of octets used for the encoding
+/// \details DEREncodeTextString() can be used for UTF8_STRING, PRINTABLE_STRING, and IA5_STRING
+/// \since Crypto++ 8.3
+CRYPTOPP_DLL size_t CRYPTOPP_API DEREncodeTextString(BufferedTransformation &bt, const SecByteBlock &str, byte asnTag);
+
+/// \brief DER encode text string
+/// \param bt BufferedTransformation object for writing
+/// \param str the string to encode
+/// \param asnTag the ASN.1 identifier
+/// \return the number of octets used for the encoding
+/// \details DEREncodeTextString() can be used for UTF8_STRING, PRINTABLE_STRING, and IA5_STRING
+/// \since Crypto++ 6.0
+CRYPTOPP_DLL size_t CRYPTOPP_API DEREncodeTextString(BufferedTransformation &bt, const std::string &str, byte asnTag);
+
+/// \brief BER decode text string
+/// \param bt BufferedTransformation object for reading
+/// \param str the string to decode
+/// \param asnTag the ASN.1 identifier
+/// \details BERDecodeTextString() can be used for UTF8_STRING, PRINTABLE_STRING, and IA5_STRING
+/// \since Crypto++ 8.3
+CRYPTOPP_DLL size_t CRYPTOPP_API BERDecodeTextString(BufferedTransformation &bt, SecByteBlock &str, byte asnTag);
+
+/// \brief BER decode text string
+/// \param bt BufferedTransformation object for reading
+/// \param str the string to decode
+/// \param asnTag the ASN.1 identifier
+/// \details BERDecodeTextString() can be used for UTF8_STRING, PRINTABLE_STRING, and IA5_STRING
+/// \since Crypto++ 6.0
+CRYPTOPP_DLL size_t CRYPTOPP_API BERDecodeTextString(BufferedTransformation &bt, std::string &str, byte asnTag);
+
+/// \brief DER encode date
+/// \param bt BufferedTransformation object for writing
+/// \param str the date to encode
+/// \param asnTag the ASN.1 identifier
+/// \return the number of octets used for the encoding
+/// \details BERDecodeDate() can be used for UTC_TIME and GENERALIZED_TIME
+/// \since Crypto++ 8.3
+CRYPTOPP_DLL size_t CRYPTOPP_API DEREncodeDate(BufferedTransformation &bt, const SecByteBlock &str, byte asnTag);
+
+/// \brief BER decode date
+/// \param bt BufferedTransformation object for reading
+/// \param str the date to decode
+/// \param asnTag the ASN.1 identifier
+/// \details BERDecodeDate() can be used for UTC_TIME and GENERALIZED_TIME
+/// \since Crypto++ 8.3
+CRYPTOPP_DLL size_t CRYPTOPP_API BERDecodeDate(BufferedTransformation &bt, SecByteBlock &str, byte asnTag);
+
+/// \brief DER encode bit string
+/// \param bt BufferedTransformation object for writing
+/// \param str the string to encode
+/// \param strLen the length of the string
+/// \param unusedBits the number of unused bits
+/// \return the number of octets used for the encoding
+/// \details The caller is responsible for shifting octets if unusedBits is
+///  not 0. For example, to DER encode a web server X.509 key usage, the 101b
+///  bit mask is often used (digitalSignature and keyEncipherment). In this
+///  case <tt>str</tt> is one octet with a value=0xa0 and unusedBits=5. The
+///  value 0xa0 is <tt>101b << 5</tt>.
+CRYPTOPP_DLL size_t CRYPTOPP_API DEREncodeBitString(BufferedTransformation &bt, const byte *str, size_t strLen, unsigned int unusedBits=0);
+
+/// \brief DER decode bit string
+/// \param bt BufferedTransformation object for reading
+/// \param str the decoded string
+/// \param unusedBits the number of unused bits
+/// \details The caller is responsible for shifting octets if unusedBits is
+///  not 0. For example, to DER encode a web server X.509 key usage, the 101b
+///  bit mask is often used (digitalSignature and keyEncipherment). In this
+///  case <tt>str</tt> is one octet with a value=0xa0 and unusedBits=5. The
+///  value 0xa0 is <tt>101b << 5</tt>.
+CRYPTOPP_DLL size_t CRYPTOPP_API BERDecodeBitString(BufferedTransformation &bt, SecByteBlock &str, unsigned int &unusedBits);
+
+/// \brief BER decode and DER re-encode
+/// \param bt BufferedTransformation object for writing
+/// \param dest BufferedTransformation object
+CRYPTOPP_DLL void CRYPTOPP_API DERReencode(BufferedTransformation &bt, BufferedTransformation &dest);
+
+/// \brief BER decode size
+/// \param bt BufferedTransformation object for reading
+/// \return the length of the ASN.1 value, in bytes
+/// \details BERDecodePeekLength() determines the length of a value without
+///  consuming octets in the stream. The stream must use definite length encoding.
+///  If indefinite length encoding is used or an error occurs, then 0 is returned.
+/// \since Crypto++ 8.3
+CRYPTOPP_DLL size_t CRYPTOPP_API BERDecodePeekLength(const BufferedTransformation &bt);
+
+/// \brief Object Identifier
+class CRYPTOPP_DLL OID
+{
+public:
+	virtual ~OID() {}
+
+	/// \brief Construct an OID
+	OID() {}
+
+	/// \brief Construct an OID
+	/// \param v value to initialize the OID
+	OID(word32 v) : m_values(1, v) {}
+
+	/// \brief Construct an OID
+	/// \param bt BufferedTransformation object
+	OID(BufferedTransformation &bt) {
+		BERDecode(bt);
+	}
+
+	/// \brief Append a value to an OID
+	/// \param rhs the value to append
+	inline OID & operator+=(word32 rhs) {
+		m_values.push_back(rhs); return *this;
+	}
+
+	/// \brief DER encode this OID
+	/// \param bt BufferedTransformation object
+	void DEREncode(BufferedTransformation &bt) const;
+
+	/// \brief BER decode an OID
+	/// \param bt BufferedTransformation object
+	void BERDecode(BufferedTransformation &bt);
+
+	/// \brief BER decode an OID
+	/// \param bt BufferedTransformation object
+	/// \throw BERDecodeErr() if decoded value doesn't match an expected OID
+	/// \details BERDecodeAndCheck() can be used to parse an OID and verify it matches an expected.
+	/// <pre>
+	///   BERSequenceDecoder key(bt);
+	///   ...
+	///   BERSequenceDecoder algorithm(key);
+	///   GetAlgorithmID().BERDecodeAndCheck(algorithm);
+	/// </pre>
+	void BERDecodeAndCheck(BufferedTransformation &bt) const;
+
+	/// \brief Determine if OID is empty
+	/// \return true if OID has 0 elements, false otherwise
+	/// \since Crypto++ 8.0
+	bool Empty() const {
+		return m_values.empty();
+	}
+
+	/// \brief Retrieve OID value array
+	/// \return OID value vector
+	/// \since Crypto++ 8.0
+	const std::vector<word32>& GetValues() const {
+		return m_values;
+	}
+
+	/// \brief Print an OID
+	/// \param out ostream object
+	/// \return ostream reference
+	/// \details Print() writes the OID in a customary format, like
+	///  1.2.840.113549.1.1.11. The caller is reposnsible to convert the
+	///  OID to a friendly name, like sha256WithRSAEncryption.
+	/// \since Crypto++ 8.3
+	std::ostream& Print(std::ostream& out) const;
+
+protected:
+	friend bool operator==(const OID &lhs, const OID &rhs);
+	friend bool operator!=(const OID &lhs, const OID &rhs);
+	friend bool operator<(const OID &lhs, const OID &rhs);
+	friend bool operator<=(const OID &lhs, const OID &rhs);
+	friend bool operator>=(const OID &lhs, const OID &rhs);
+
+	std::vector<word32> m_values;
+
+private:
+	static void EncodeValue(BufferedTransformation &bt, word32 v);
+	static size_t DecodeValue(BufferedTransformation &bt, word32 &v);
+};
+
+/// \brief ASN.1 encoded object filter
+class EncodedObjectFilter : public Filter
+{
+public:
+	enum Flag {PUT_OBJECTS=1, PUT_MESSANGE_END_AFTER_EACH_OBJECT=2, PUT_MESSANGE_END_AFTER_ALL_OBJECTS=4, PUT_MESSANGE_SERIES_END_AFTER_ALL_OBJECTS=8};
+	enum State {IDENTIFIER, LENGTH, BODY, TAIL, ALL_DONE} m_state;
+
+	virtual ~EncodedObjectFilter() {}
+
+	/// \brief Construct an EncodedObjectFilter
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \param nObjects the number of objects
+	/// \param flags bitwise OR of EncodedObjectFilter::Flag
+	EncodedObjectFilter(BufferedTransformation *attachment = NULLPTR, unsigned int nObjects = 1, word32 flags = 0);
+
+	/// \brief Input a byte buffer for processing
+	/// \param inString the byte buffer to process
+	/// \param length the size of the string, in bytes
+	void Put(const byte *inString, size_t length);
+
+	unsigned int GetNumberOfCompletedObjects() const {return m_nCurrentObject;}
+	unsigned long GetPositionOfObject(unsigned int i) const {return m_positions[i];}
+
+private:
+	BufferedTransformation & CurrentTarget();
+
+	ByteQueue m_queue;
+	std::vector<unsigned int> m_positions;
+	lword m_lengthRemaining;
+	word32 m_nObjects, m_nCurrentObject, m_level, m_flags;
+	byte m_id;
+};
+
+/// \brief BER General Decoder
+class CRYPTOPP_DLL BERGeneralDecoder : public Store
+{
+public:
+	/// \brief Default ASN.1 tag
+	enum {DefaultTag = SEQUENCE | EnumToInt(CONSTRUCTED)};
+
+	virtual ~BERGeneralDecoder();
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \details BERGeneralDecoder uses DefaultTag
+	explicit BERGeneralDecoder(BufferedTransformation &inQueue);
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \param asnTag ASN.1 tag
+	explicit BERGeneralDecoder(BufferedTransformation &inQueue, byte asnTag);
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \param asnTag ASN.1 tag
+	explicit BERGeneralDecoder(BERGeneralDecoder &inQueue, byte asnTag);
+
+	/// \brief Determine length encoding
+	/// \return true if the ASN.1 object is definite length encoded, false otherwise
+	bool IsDefiniteLength() const {
+		return m_definiteLength;
+	}
+
+	/// \brief Determine remaining length
+	/// \return number of octets that remain to be consumed
+	/// \details RemainingLength() is only valid if IsDefiniteLength()
+	///  returns true.
+	lword RemainingLength() const {
+		CRYPTOPP_ASSERT(m_definiteLength);
+		return IsDefiniteLength() ? m_length : 0;
+	}
+
+	/// \brief Determine end of stream
+	/// \return true if all octets have been consumed, false otherwise
+	bool EndReached() const;
+
+	/// \brief Determine next octet
+	/// \return next octet in the stream
+	/// \details PeekByte does not consume the octet.
+	/// \throw BERDecodeError if there are no octets remaining
+	byte PeekByte() const;
+
+	/// \brief Determine next octet
+	/// \details CheckByte reads the next byte in the stream and verifies
+	///  the octet matches b.
+	/// \throw BERDecodeError if the next octet is not b
+	void CheckByte(byte b);
+
+	/// \brief Transfer bytes to another BufferedTransformation
+	/// \param target the destination BufferedTransformation
+	/// \param transferBytes the number of bytes to transfer
+	/// \param channel the channel on which the transfer should occur
+	/// \param blocking specifies whether the object should block when
+	///  processing input
+	/// \return the number of bytes that remain in the transfer block
+	///  (i.e., bytes not transferred)
+	/// \details TransferTo2() removes bytes and moves
+	///  them to the destination. Transfer begins at the index position
+	///  in the current stream, and not from an absolute position in the
+	///  stream.
+	/// \details transferBytes is an \a IN and \a OUT parameter. When
+	///  the call is made, transferBytes is the requested size of the
+	///  transfer. When the call returns, transferBytes is the number
+	///  of bytes that were transferred.
+	size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+
+	/// \brief Copy bytes to another BufferedTransformation
+	/// \param target the destination BufferedTransformation
+	/// \param begin the 0-based index of the first byte to copy in
+	///  the stream
+	/// \param end the 0-based index of the last byte to copy in
+	///  the stream
+	/// \param channel the channel on which the transfer should occur
+	/// \param blocking specifies whether the object should block when
+	///  processing input
+	/// \return the number of bytes that remain in the copy block
+	///  (i.e., bytes not copied)
+	/// \details CopyRangeTo2 copies bytes to the
+	///  destination. The bytes are not removed from this object. Copying
+	///  begins at the index position in the current stream, and not from
+	///  an absolute position in the stream.
+	/// \details begin is an \a IN and \a OUT parameter. When the call is
+	///  made, begin is the starting position of the copy. When the call
+	///  returns, begin is the position of the first byte that was \a not
+	///  copied (which may be different than end). begin can be used for
+	///  subsequent calls to CopyRangeTo2().
+	size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const;
+
+	/// \brief Signals the end of messages to the object
+	/// \details Call this to denote end of sequence
+	void MessageEnd();
+
+protected:
+	BufferedTransformation &m_inQueue;
+	lword m_length;
+	bool m_finished, m_definiteLength;
+
+private:
+	void Init(byte asnTag);
+	void StoreInitialize(const NameValuePairs &parameters)
+		{CRYPTOPP_UNUSED(parameters); CRYPTOPP_ASSERT(false);}
+	lword ReduceLength(lword delta);
+};
+
+/// \brief DER General Encoder
+class CRYPTOPP_DLL DERGeneralEncoder : public ByteQueue
+{
+public:
+	/// \brief Default ASN.1 tag
+	enum {DefaultTag = SEQUENCE | EnumToInt(CONSTRUCTED)};
+
+	virtual ~DERGeneralEncoder();
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \details DERGeneralEncoder uses DefaultTag
+	explicit DERGeneralEncoder(BufferedTransformation &outQueue);
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \param asnTag ASN.1 tag
+	explicit DERGeneralEncoder(BufferedTransformation &outQueue, byte asnTag);
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \param asnTag ASN.1 tag
+	explicit DERGeneralEncoder(DERGeneralEncoder &outQueue, byte asnTag);
+
+	/// \brief Signals the end of messages to the object
+	/// \details Call this to denote end of sequence
+	void MessageEnd();
+
+private:
+	BufferedTransformation &m_outQueue;
+	byte m_asnTag;
+	bool m_finished;
+};
+
+/// \brief BER Sequence Decoder
+class CRYPTOPP_DLL BERSequenceDecoder : public BERGeneralDecoder
+{
+public:
+	/// \brief Default ASN.1 tag
+	enum {DefaultTag = SEQUENCE | EnumToInt(CONSTRUCTED)};
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \details BERSequenceDecoder uses DefaultTag
+	explicit BERSequenceDecoder(BufferedTransformation &inQueue)
+		: BERGeneralDecoder(inQueue, DefaultTag) {}
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \param asnTag ASN.1 tag
+	explicit BERSequenceDecoder(BufferedTransformation &inQueue, byte asnTag)
+		: BERGeneralDecoder(inQueue, asnTag) {}
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \details BERSequenceDecoder uses DefaultTag
+	explicit BERSequenceDecoder(BERSequenceDecoder &inQueue)
+		: BERGeneralDecoder(inQueue, DefaultTag) {}
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \param asnTag ASN.1 tag
+	explicit BERSequenceDecoder(BERSequenceDecoder &inQueue, byte asnTag)
+		: BERGeneralDecoder(inQueue, asnTag) {}
+};
+
+/// \brief DER Sequence Encoder
+class CRYPTOPP_DLL DERSequenceEncoder : public DERGeneralEncoder
+{
+public:
+	/// \brief Default ASN.1 tag
+	enum {DefaultTag = SEQUENCE | EnumToInt(CONSTRUCTED)};
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \details DERSequenceEncoder uses DefaultTag
+	explicit DERSequenceEncoder(BufferedTransformation &outQueue)
+		: DERGeneralEncoder(outQueue, DefaultTag) {}
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \param asnTag ASN.1 tag
+	explicit DERSequenceEncoder(BufferedTransformation &outQueue, byte asnTag)
+		: DERGeneralEncoder(outQueue, asnTag) {}
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \details DERSequenceEncoder uses DefaultTag
+	explicit DERSequenceEncoder(DERSequenceEncoder &outQueue)
+		: DERGeneralEncoder(outQueue, DefaultTag) {}
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \param asnTag ASN.1 tag
+	explicit DERSequenceEncoder(DERSequenceEncoder &outQueue, byte asnTag)
+		: DERGeneralEncoder(outQueue, asnTag) {}
+};
+
+/// \brief BER Set Decoder
+class CRYPTOPP_DLL BERSetDecoder : public BERGeneralDecoder
+{
+public:
+	/// \brief Default ASN.1 tag
+	enum {DefaultTag = SET | EnumToInt(CONSTRUCTED)};
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \details BERSetDecoder uses DefaultTag
+	explicit BERSetDecoder(BufferedTransformation &inQueue)
+		: BERGeneralDecoder(inQueue, DefaultTag) {}
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \param asnTag ASN.1 tag
+	explicit BERSetDecoder(BufferedTransformation &inQueue, byte asnTag)
+		: BERGeneralDecoder(inQueue, asnTag) {}
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \details BERSetDecoder uses DefaultTag
+	explicit BERSetDecoder(BERSetDecoder &inQueue)
+		: BERGeneralDecoder(inQueue, DefaultTag) {}
+
+	/// \brief Construct an ASN.1 decoder
+	/// \param inQueue input byte queue
+	/// \param asnTag ASN.1 tag
+	explicit BERSetDecoder(BERSetDecoder &inQueue, byte asnTag)
+		: BERGeneralDecoder(inQueue, asnTag) {}
+};
+
+/// \brief DER Set Encoder
+class CRYPTOPP_DLL DERSetEncoder : public DERGeneralEncoder
+{
+public:
+	/// \brief Default ASN.1 tag
+	enum {DefaultTag = SET | EnumToInt(CONSTRUCTED)};
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \details DERSetEncoder uses DefaultTag
+	explicit DERSetEncoder(BufferedTransformation &outQueue)
+		: DERGeneralEncoder(outQueue, DefaultTag) {}
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \param asnTag ASN.1 tag
+	explicit DERSetEncoder(BufferedTransformation &outQueue, byte asnTag)
+		: DERGeneralEncoder(outQueue, asnTag) {}
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \details DERSetEncoder uses DefaultTag
+	explicit DERSetEncoder(DERSetEncoder &outQueue)
+		: DERGeneralEncoder(outQueue, DefaultTag) {}
+
+	/// \brief Construct an ASN.1 encoder
+	/// \param outQueue output byte queue
+	/// \param asnTag ASN.1 tag
+	explicit DERSetEncoder(DERSetEncoder &outQueue, byte asnTag)
+		: DERGeneralEncoder(outQueue, asnTag) {}
+};
+
+/// \brief Optional data encoder and decoder
+/// \tparam T class or type
+template <class T>
+class ASNOptional : public member_ptr<T>
+{
+public:
+	/// \brief BER decode optional data
+	/// \param seqDecoder sequence with the optional ASN.1 data
+	/// \param tag ASN.1 tag to match as optional data
+	/// \param mask the mask to apply when matching the tag
+	/// \sa ASNTag and ASNIdFlag
+	void BERDecode(BERSequenceDecoder &seqDecoder, byte tag, byte mask = ~CONSTRUCTED)
+	{
+		byte b;
+		if (seqDecoder.Peek(b) && (b & mask) == tag)
+			reset(new T(seqDecoder));
+	}
+
+	/// \brief DER encode optional data
+	/// \param out BufferedTransformation object
+	void DEREncode(BufferedTransformation &out)
+	{
+		if (this->get() != NULLPTR)
+			this->get()->DEREncode(out);
+	}
+};
+
+/// \brief Encode and decode ASN.1 objects with additional information
+/// \tparam BASE base class or type
+/// \details Encodes and decodes public keys, private keys and group
+///   parameters with OID identifying the algorithm or scheme.
+template <class BASE>
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE ASN1CryptoMaterial : public ASN1Object, public BASE
+{
+public:
+	/// \brief DER encode ASN.1 object
+	/// \param bt BufferedTransformation object
+	/// \details Save() will write the OID associated with algorithm or scheme.
+	///   In the case of public and private keys, this function writes the
+	///   subjectPublicKeyInfo and privateKeyInfo parts.
+	void Save(BufferedTransformation &bt) const
+		{BEREncode(bt);}
+
+	/// \brief BER decode ASN.1 object
+	/// \param bt BufferedTransformation object
+	void Load(BufferedTransformation &bt)
+		{BERDecode(bt);}
+};
+
+/// \brief Encodes and decodes subjectPublicKeyInfo
+class CRYPTOPP_DLL X509PublicKey : public ASN1CryptoMaterial<PublicKey>
+{
+public:
+	virtual ~X509PublicKey() {}
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	/// \brief Retrieves the OID of the algorithm
+	/// \return OID of the algorithm
+	virtual OID GetAlgorithmID() const =0;
+
+	/// \brief Decode algorithm parameters
+	/// \param bt BufferedTransformation object
+	/// \sa BERDecodePublicKey, <A HREF="http://www.ietf.org/rfc/rfc2459.txt">RFC
+	///  2459, section 7.3.1</A>
+	virtual bool BERDecodeAlgorithmParameters(BufferedTransformation &bt)
+		{BERDecodeNull(bt); return false;}
+
+	/// \brief Encode algorithm parameters
+	/// \param bt BufferedTransformation object
+	/// \sa DEREncodePublicKey, <A HREF="http://www.ietf.org/rfc/rfc2459.txt">RFC
+	///  2459, section 7.3.1</A>
+	virtual bool DEREncodeAlgorithmParameters(BufferedTransformation &bt) const
+		{DEREncodeNull(bt); return false;}
+
+	/// \brief Decode subjectPublicKey part of subjectPublicKeyInfo
+	/// \param bt BufferedTransformation object
+	/// \param parametersPresent flag indicating if algorithm parameters are present
+	/// \param size number of octets to read for the parameters, in bytes
+	/// \details BERDecodePublicKey() the decodes subjectPublicKey part of
+	///  subjectPublicKeyInfo, without the BIT STRING header.
+	/// \details When <tt>parametersPresent = true</tt> then BERDecodePublicKey() calls
+	///  BERDecodeAlgorithmParameters() to parse algorithm parameters.
+	/// \sa BERDecodeAlgorithmParameters
+	virtual void BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size) =0;
+
+	/// \brief Encode subjectPublicKey part of subjectPublicKeyInfo
+	/// \param bt BufferedTransformation object
+	/// \details DEREncodePublicKey() encodes the subjectPublicKey part of
+	///  subjectPublicKeyInfo, without the BIT STRING header.
+	/// \sa DEREncodeAlgorithmParameters
+	virtual void DEREncodePublicKey(BufferedTransformation &bt) const =0;
+};
+
+/// \brief Encodes and Decodes privateKeyInfo
+class CRYPTOPP_DLL PKCS8PrivateKey : public ASN1CryptoMaterial<PrivateKey>
+{
+public:
+	virtual ~PKCS8PrivateKey() {}
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	/// \brief Retrieves the OID of the algorithm
+	/// \return OID of the algorithm
+	virtual OID GetAlgorithmID() const =0;
+
+	/// \brief Decode optional parameters
+	/// \param bt BufferedTransformation object
+	/// \sa BERDecodePrivateKey, <A HREF="http://www.ietf.org/rfc/rfc2459.txt">RFC
+	///  2459, section 7.3.1</A>
+	virtual bool BERDecodeAlgorithmParameters(BufferedTransformation &bt)
+		{BERDecodeNull(bt); return false;}
+
+	/// \brief Encode optional parameters
+	/// \param bt BufferedTransformation object
+	/// \sa DEREncodePrivateKey, <A HREF="http://www.ietf.org/rfc/rfc2459.txt">RFC
+	///  2459, section 7.3.1</A>
+	virtual bool DEREncodeAlgorithmParameters(BufferedTransformation &bt) const
+		{DEREncodeNull(bt); return false;}
+
+	/// \brief Decode privateKey part of privateKeyInfo
+	/// \param bt BufferedTransformation object
+	/// \param parametersPresent flag indicating if algorithm parameters are present
+	/// \param size number of octets to read for the parameters, in bytes
+	/// \details BERDecodePrivateKey() the decodes privateKey part of privateKeyInfo,
+	///  without the OCTET STRING header.
+	/// \details When <tt>parametersPresent = true</tt> then BERDecodePrivateKey() calls
+	///  BERDecodeAlgorithmParameters() to parse algorithm parameters.
+	/// \sa BERDecodeAlgorithmParameters
+	virtual void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size) =0;
+
+	/// \brief Encode privateKey part of privateKeyInfo
+	/// \param bt BufferedTransformation object
+	/// \details DEREncodePrivateKey() encodes the privateKey part of privateKeyInfo,
+	///  without the OCTET STRING header.
+	/// \sa DEREncodeAlgorithmParameters
+	virtual void DEREncodePrivateKey(BufferedTransformation &bt) const =0;
+
+	/// \brief Decode optional attributes
+	/// \param bt BufferedTransformation object
+	/// \details BERDecodeOptionalAttributes() decodes optional attributes including
+	///  context-specific tag.
+	/// \sa BERDecodeAlgorithmParameters, DEREncodeOptionalAttributes
+	/// \note default implementation stores attributes to be output using
+	///  DEREncodeOptionalAttributes
+	virtual void BERDecodeOptionalAttributes(BufferedTransformation &bt);
+
+	/// \brief Encode optional attributes
+	/// \param bt BufferedTransformation object
+	/// \details DEREncodeOptionalAttributes() encodes optional attributes including
+	///  context-specific tag.
+	/// \sa BERDecodeAlgorithmParameters
+	virtual void DEREncodeOptionalAttributes(BufferedTransformation &bt) const;
+
+protected:
+	ByteQueue m_optionalAttributes;
+};
+
+// ********************************************************
+
+/// \brief DER Encode unsigned value
+/// \tparam T class or type
+/// \param out BufferedTransformation object
+/// \param w unsigned value to encode
+/// \param asnTag the ASN.1 identifier
+/// \details DEREncodeUnsigned() can be used with INTEGER, BOOLEAN, and ENUM
+template <class T>
+size_t DEREncodeUnsigned(BufferedTransformation &out, T w, byte asnTag = INTEGER)
+{
+	byte buf[sizeof(w)+1];
+	unsigned int bc;
+	if (asnTag == BOOLEAN)
+	{
+		buf[sizeof(w)] = w ? 0xff : 0;
+		bc = 1;
+	}
+	else
+	{
+		buf[0] = 0;
+		for (unsigned int i=0; i<sizeof(w); i++)
+			buf[i+1] = byte(w >> (sizeof(w)-1-i)*8);
+		bc = sizeof(w);
+		while (bc > 1 && buf[sizeof(w)+1-bc] == 0)
+			--bc;
+		if (buf[sizeof(w)+1-bc] & 0x80)
+			++bc;
+	}
+	out.Put(asnTag);
+	size_t lengthBytes = DERLengthEncode(out, bc);
+	out.Put(buf+sizeof(w)+1-bc, bc);
+	return 1+lengthBytes+bc;
+}
+
+/// \brief BER Decode unsigned value
+/// \tparam T fundamental C++ type
+/// \param in BufferedTransformation object
+/// \param w the decoded value
+/// \param asnTag the ASN.1 identifier
+/// \param minValue the minimum expected value
+/// \param maxValue the maximum expected value
+/// \throw BERDecodeErr() if the value cannot be parsed or the decoded value is not within range.
+/// \details DEREncodeUnsigned() can be used with INTEGER, BOOLEAN, and ENUM
+template <class T>
+void BERDecodeUnsigned(BufferedTransformation &in, T &w, byte asnTag = INTEGER,
+					   T minValue = 0, T maxValue = T(0xffffffff))
+{
+	byte b;
+	if (!in.Get(b) || b != asnTag)
+		BERDecodeError();
+
+	size_t bc;
+	bool definite = BERLengthDecode(in, bc);
+	if (!definite)
+		BERDecodeError();
+	if (bc > in.MaxRetrievable())  // Issue 346
+		BERDecodeError();
+	if (asnTag == BOOLEAN && bc != 1) // X.690, 8.2.1
+		BERDecodeError();
+	if ((asnTag == INTEGER || asnTag == ENUMERATED) && bc == 0) // X.690, 8.3.1 and 8.4
+		BERDecodeError();
+
+	SecByteBlock buf(bc);
+
+	if (bc != in.Get(buf, bc))
+		BERDecodeError();
+
+	// This consumes leading 0 octets. According to X.690, 8.3.2, it could be non-conforming behavior.
+	//  X.690, 8.3.2 says "the bits of the first octet and bit 8 of the second octet ... (a) shall
+	//  not all be ones and (b) shall not all be zeros ... These rules ensure that an integer value
+	//  is always encoded in the smallest possible number of octet".
+	// We invented AER (Alternate Encoding Rules), which is more relaxed than BER, CER, and DER.
+	const byte *ptr = buf;
+	while (bc > sizeof(w) && *ptr == 0)
+	{
+		bc--;
+		ptr++;
+	}
+	if (bc > sizeof(w))
+		BERDecodeError();
+
+	w = 0;
+	for (unsigned int i=0; i<bc; i++)
+		w = (w << 8) | ptr[i];
+
+	if (w < minValue || w > maxValue)
+		BERDecodeError();
+}
+
+#ifdef CRYPTOPP_DOXYGEN_PROCESSING
+/// \brief Compare two OIDs for equality
+/// \param lhs the first OID
+/// \param rhs the second OID
+/// \return true if the OIDs are equal, false otherwise
+inline bool operator==(const OID &lhs, const OID &rhs);
+/// \brief Compare two OIDs for inequality
+/// \param lhs the first OID
+/// \param rhs the second OID
+/// \return true if the OIDs are not equal, false otherwise
+inline bool operator!=(const OID &lhs, const OID &rhs);
+/// \brief Compare two OIDs for ordering
+/// \param lhs the first OID
+/// \param rhs the second OID
+/// \return true if the first OID is less than the second OID, false otherwise
+/// \details operator<() calls std::lexicographical_compare() on each element in the array of values.
+inline bool operator<(const OID &lhs, const OID &rhs);
+/// \brief Compare two OIDs for ordering
+/// \param lhs the first OID
+/// \param rhs the second OID
+/// \return true if the first OID is less than or equal to the second OID, false otherwise
+/// \details operator<=() is implemented in terms of operator==() and operator<().
+/// \since Crypto++ 8.3
+inline bool operator<=(const OID &lhs, const OID &rhs);
+/// \brief Compare two OIDs for ordering
+/// \param lhs the first OID
+/// \param rhs the second OID
+/// \return true if the first OID is greater than or equal to the second OID, false otherwise
+/// \details operator>=() is implemented in terms of operator<().
+/// \since Crypto++ 8.3
+inline bool operator>=(const OID &lhs, const OID &rhs);
+/// \brief Append a value to an OID
+/// \param lhs the OID
+/// \param rhs the value to append
+inline OID operator+(const OID &lhs, unsigned long rhs);
+/// \brief Print a OID value
+/// \param out the output stream
+/// \param oid the OID
+inline std::ostream& operator<<(std::ostream& out, const OID &oid)
+	{ return oid.Print(out); }
+#else
+inline bool operator==(const ::CryptoPP::OID &lhs, const ::CryptoPP::OID &rhs)
+	{return lhs.m_values == rhs.m_values;}
+inline bool operator!=(const ::CryptoPP::OID &lhs, const ::CryptoPP::OID &rhs)
+	{return lhs.m_values != rhs.m_values;}
+inline bool operator<(const ::CryptoPP::OID &lhs, const ::CryptoPP::OID &rhs)
+	{return std::lexicographical_compare(lhs.m_values.begin(), lhs.m_values.end(), rhs.m_values.begin(), rhs.m_values.end());}
+inline bool operator<=(const ::CryptoPP::OID &lhs, const ::CryptoPP::OID &rhs)
+	{return lhs<rhs || lhs==rhs;}
+inline bool operator>=(const ::CryptoPP::OID &lhs, const ::CryptoPP::OID &rhs)
+	{return ! (lhs<rhs);}
+inline ::CryptoPP::OID operator+(const ::CryptoPP::OID &lhs, unsigned long rhs)
+	{return ::CryptoPP::OID(lhs)+=rhs;}
+inline std::ostream& operator<<(std::ostream& out, const OID &oid)
+	{ return oid.Print(out); }
+#endif
+
+NAMESPACE_END
+
+// Issue 340
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic pop
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/authenc.cpp b/runtime/third_party/cryptopp/authenc.cpp
new file mode 100644
index 0000000..e37e601
--- /dev/null
+++ b/runtime/third_party/cryptopp/authenc.cpp
@@ -0,0 +1,188 @@
+// authenc.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "authenc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void AuthenticatedSymmetricCipherBase::AuthenticateData(const byte *input, size_t len)
+{
+	// UBsan finding with -std=c++03 using memcpy
+	CRYPTOPP_ASSERT(input && len);
+	if(!input || !len) return;
+
+	unsigned int blockSize = AuthenticationBlockSize();
+	unsigned int &num = m_bufferedDataLength;
+	byte* data = m_buffer.begin();
+
+	if (data && num)	// process left over data
+	{
+		if (num+len >= blockSize)
+		{
+			std::memcpy(data+num, input, blockSize-num);
+			AuthenticateBlocks(data, blockSize);
+			input += (blockSize-num);
+			len -= (blockSize-num);
+			num = 0;
+			// drop through and do the rest
+		}
+		else
+		{
+			std::memcpy(data+num, input, len);
+			num += (unsigned int)len;
+			return;
+		}
+	}
+
+	// now process the input data in blocks of blockSize bytes and save the leftovers to m_data
+	if (len >= blockSize)
+	{
+		size_t leftOver = AuthenticateBlocks(input, len);
+		input += (len - leftOver);
+		len = leftOver;
+	}
+
+	if (data && len)
+		std::memcpy(data, input, len);
+	num = (unsigned int)len;
+}
+
+void AuthenticatedSymmetricCipherBase::SetKey(const byte *userKey, size_t keylength, const NameValuePairs &params)
+{
+	m_bufferedDataLength = 0;
+	m_state = State_Start;
+
+	this->SetKeyWithoutResync(userKey, keylength, params);
+	m_state = State_KeySet;
+
+	size_t length;
+	const byte *iv = GetIVAndThrowIfInvalid(params, length);
+	if (iv)
+		Resynchronize(iv, (int)length);
+}
+
+void AuthenticatedSymmetricCipherBase::Resynchronize(const byte *iv, int length)
+{
+	if (m_state < State_KeySet)
+		throw BadState(AlgorithmName(), "Resynchronize", "key is set");
+
+	m_bufferedDataLength = 0;
+	m_totalHeaderLength = m_totalMessageLength = m_totalFooterLength = 0;
+	m_state = State_KeySet;
+
+	Resync(iv, this->ThrowIfInvalidIVLength(length));
+	m_state = State_IVSet;
+}
+
+void AuthenticatedSymmetricCipherBase::Update(const byte *input, size_t length)
+{
+	// Part of original authenc.cpp code. Don't remove it.
+	if (length == 0) {return;}
+
+	switch (m_state)
+	{
+	case State_Start:
+	case State_KeySet:
+		throw BadState(AlgorithmName(), "Update", "setting key and IV");
+	case State_IVSet:
+		AuthenticateData(input, length);
+		m_totalHeaderLength += length;
+		break;
+	case State_AuthUntransformed:
+	case State_AuthTransformed:
+		AuthenticateLastConfidentialBlock();
+		m_bufferedDataLength = 0;
+		m_state = State_AuthFooter;
+		// fall through
+	case State_AuthFooter:
+		AuthenticateData(input, length);
+		m_totalFooterLength += length;
+		break;
+	default:
+		CRYPTOPP_ASSERT(false);
+	}
+}
+
+void AuthenticatedSymmetricCipherBase::ProcessData(byte *outString, const byte *inString, size_t length)
+{
+	if (m_state >= State_IVSet && length > MaxMessageLength()-m_totalMessageLength)
+		throw InvalidArgument(AlgorithmName() + ": message length exceeds maximum");
+	m_totalMessageLength += length;
+
+reswitch:
+	switch (m_state)
+	{
+	case State_Start:
+	case State_KeySet:
+		throw BadState(AlgorithmName(), "ProcessData", "setting key and IV");
+	case State_AuthFooter:
+		throw BadState(AlgorithmName(), "ProcessData was called after footer input has started");
+	case State_IVSet:
+		AuthenticateLastHeaderBlock();
+		m_bufferedDataLength = 0;
+		m_state = AuthenticationIsOnPlaintext()==IsForwardTransformation() ? State_AuthUntransformed : State_AuthTransformed;
+		goto reswitch;
+	case State_AuthUntransformed:
+		AuthenticateData(inString, length);
+		AccessSymmetricCipher().ProcessData(outString, inString, length);
+		break;
+	case State_AuthTransformed:
+		AccessSymmetricCipher().ProcessData(outString, inString, length);
+		AuthenticateData(outString, length);
+		break;
+	default:
+		CRYPTOPP_ASSERT(false);
+	}
+}
+
+void AuthenticatedSymmetricCipherBase::TruncatedFinal(byte *mac, size_t macSize)
+{
+	// https://github.com/weidai11/cryptopp/issues/954
+	this->ThrowIfInvalidTruncatedSize(macSize);
+
+	if (m_totalHeaderLength > MaxHeaderLength())
+		throw InvalidArgument(AlgorithmName() + ": header length of " + IntToString(m_totalHeaderLength) + " exceeds the maximum of " + IntToString(MaxHeaderLength()));
+
+	if (m_totalFooterLength > MaxFooterLength())
+	{
+		if (MaxFooterLength() == 0)
+			throw InvalidArgument(AlgorithmName() + ": additional authenticated data (AAD) cannot be input after data to be encrypted or decrypted");
+		else
+			throw InvalidArgument(AlgorithmName() + ": footer length of " + IntToString(m_totalFooterLength) + " exceeds the maximum of " + IntToString(MaxFooterLength()));
+	}
+
+	switch (m_state)
+	{
+	case State_Start:
+	case State_KeySet:
+		throw BadState(AlgorithmName(), "TruncatedFinal", "setting key and IV");
+
+	case State_IVSet:
+		AuthenticateLastHeaderBlock();
+		m_bufferedDataLength = 0;
+		// fall through
+
+	case State_AuthUntransformed:
+	case State_AuthTransformed:
+		AuthenticateLastConfidentialBlock();
+		m_bufferedDataLength = 0;
+		// fall through
+
+	case State_AuthFooter:
+		AuthenticateLastFooterBlock(mac, macSize);
+		m_bufferedDataLength = 0;
+		break;
+
+	default:
+		CRYPTOPP_ASSERT(false);
+	}
+
+	m_state = State_KeySet;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/authenc.h b/runtime/third_party/cryptopp/authenc.h
new file mode 100644
index 0000000..5fc3e38
--- /dev/null
+++ b/runtime/third_party/cryptopp/authenc.h
@@ -0,0 +1,87 @@
+// authenc.h - originally written and placed in the public domain by Wei Dai
+
+/// \file
+/// \brief Classes for authenticated encryption modes of operation
+/// \details Authenticated encryption (AE) schemes combine confidentiality and authenticity
+///   into a single mode of operation They gained traction in the early 2000's because manually
+///   combining them was error prone for the typical developer. Around that time, the desire to
+///   authenticate but not ecrypt additional data (AAD) was also identified. When both features
+///   are available from a scheme, the system is referred to as an AEAD scheme.
+/// \details Crypto++ provides four authenticated encryption modes of operation - CCM, EAX, GCM
+///   and OCB mode. All modes derive from AuthenticatedSymmetricCipherBase() and the
+///   motivation for the API, like calling AAD a &quot;header&quot;, can be found in Bellare,
+///   Rogaway and Wagner's <A HREF="http://web.cs.ucdavis.edu/~rogaway/papers/eax.pdf">The EAX
+///   Mode of Operation</A>. The EAX paper suggested a basic API to help standardize AEAD
+///   schemes in software and promote adoption of the modes.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Authenticated_Encryption">Authenticated
+///   Encryption</A> on the Crypto++ wiki.
+/// \since Crypto++ 5.6.0
+
+#ifndef CRYPTOPP_AUTHENC_H
+#define CRYPTOPP_AUTHENC_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Base class for authenticated encryption modes of operation
+/// \details AuthenticatedSymmetricCipherBase() serves as a base implementation for one direction
+///   (encryption or decryption) of a stream cipher or block cipher mode with authentication.
+/// \details Crypto++ provides four authenticated encryption modes of operation - CCM, EAX, GCM
+///   and OCB mode. All modes derive from AuthenticatedSymmetricCipherBase() and the
+///   motivation for the API, like calling AAD a &quot;header&quot;, can be found in Bellare,
+///   Rogaway and Wagner's <A HREF="http://web.cs.ucdavis.edu/~rogaway/papers/eax.pdf">The EAX
+///   Mode of Operation</A>. The EAX paper suggested a basic API to help standardize AEAD
+///   schemes in software and promote adoption of the modes.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Authenticated_Encryption">Authenticated
+///   Encryption</A> on the Crypto++ wiki.
+/// \since Crypto++ 5.6.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE AuthenticatedSymmetricCipherBase : public AuthenticatedSymmetricCipher
+{
+public:
+	AuthenticatedSymmetricCipherBase() : m_totalHeaderLength(0), m_totalMessageLength(0),
+		m_totalFooterLength(0), m_bufferedDataLength(0), m_state(State_Start) {}
+
+	// StreamTransformation interface
+	bool IsRandomAccess() const {return false;}
+	bool IsSelfInverting() const {return true;}
+
+	void SetKey(const byte *userKey, size_t keylength, const NameValuePairs &params);
+	void Restart() {if (m_state > State_KeySet) m_state = State_KeySet;}
+	void Resynchronize(const byte *iv, int length=-1);
+	void Update(const byte *input, size_t length);
+	void ProcessData(byte *outString, const byte *inString, size_t length);
+	void TruncatedFinal(byte *mac, size_t macSize);
+
+protected:
+	void UncheckedSetKey(const byte * key, unsigned int length,const CryptoPP::NameValuePairs &params)
+		{CRYPTOPP_UNUSED(key), CRYPTOPP_UNUSED(length), CRYPTOPP_UNUSED(params); CRYPTOPP_ASSERT(false);}
+
+	void AuthenticateData(const byte *data, size_t len);
+	const SymmetricCipher & GetSymmetricCipher() const
+		{return const_cast<AuthenticatedSymmetricCipherBase *>(this)->AccessSymmetricCipher();}
+
+	virtual SymmetricCipher & AccessSymmetricCipher() =0;
+	virtual bool AuthenticationIsOnPlaintext() const =0;
+	virtual unsigned int AuthenticationBlockSize() const =0;
+	virtual void SetKeyWithoutResync(const byte *userKey, size_t keylength, const NameValuePairs &params) =0;
+	virtual void Resync(const byte *iv, size_t len) =0;
+	virtual size_t AuthenticateBlocks(const byte *data, size_t len) =0;
+	virtual void AuthenticateLastHeaderBlock() =0;
+	virtual void AuthenticateLastConfidentialBlock() {}
+	virtual void AuthenticateLastFooterBlock(byte *mac, size_t macSize) =0;
+
+	// State_AuthUntransformed: authentication is applied to plain text (Authenticate-then-Encrypt)
+	// State_AuthTransformed: authentication is applied to cipher text (Encrypt-then-Authenticate)
+	enum State {State_Start, State_KeySet, State_IVSet, State_AuthUntransformed, State_AuthTransformed, State_AuthFooter};
+
+	AlignedSecByteBlock m_buffer;
+	lword m_totalHeaderLength, m_totalMessageLength, m_totalFooterLength;
+	unsigned int m_bufferedDataLength;
+	State m_state;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/base32.cpp b/runtime/third_party/cryptopp/base32.cpp
new file mode 100644
index 0000000..d39ed45
--- /dev/null
+++ b/runtime/third_party/cryptopp/base32.cpp
@@ -0,0 +1,97 @@
+// base32.cpp - written and placed in the public domain by Frank Palazzolo, based on hex.cpp by Wei Dai
+//              extended hex alphabet added by JW in November, 2017.
+
+#include "pch.h"
+#include "base32.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+ANONYMOUS_NAMESPACE_BEGIN
+
+const byte s_stdUpper[] = "ABCDEFGHIJKMNPQRSTUVWXYZ23456789";
+const byte s_stdLower[] = "abcdefghijkmnpqrstuvwxyz23456789";
+const byte s_hexUpper[] = "0123456789ABCDEFGHIJKLMNOPQRSTUV";
+const byte s_hexLower[] = "0123456789abcdefghijklmnopqrstuv";
+
+const int s_array[256] = {
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, 24, 25, 26, 27, 28, 29, 30, 31, -1, -1, -1, -1, -1, -1,
+	-1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, -1, 11, 12, -1,
+	13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, -1, -1, -1, -1, -1,
+	-1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, -1, 11, 12, -1,
+	13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+};
+
+const int s_hexArray[256] = {
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, -1, -1, -1, -1, -1, -1,
+	-1, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
+	25, 26, 27, 28, 29, 30, 31, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
+	25, 26, 27, 28, 29, 30, 31, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+};
+
+ANONYMOUS_NAMESPACE_END
+
+void Base32Encoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	bool uppercase = parameters.GetValueWithDefault(Name::Uppercase(), true);
+	m_filter->Initialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::EncodingLookupArray(), uppercase ? &s_stdUpper[0] : &s_stdLower[0], false)(Name::Log2Base(), 5, true)));
+}
+
+void Base32Decoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	BaseN_Decoder::IsolatedInitialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::DecodingLookupArray(), GetDefaultDecodingLookupArray(), false)(Name::Log2Base(), 5, true)));
+}
+
+// Unrolled initialization, http://github.com/weidai11/cryptopp/issues/376
+const int *Base32Decoder::GetDefaultDecodingLookupArray()
+{
+	return s_array;
+}
+
+void Base32HexEncoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	bool uppercase = parameters.GetValueWithDefault(Name::Uppercase(), true);
+	m_filter->Initialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::EncodingLookupArray(), uppercase ? &s_hexUpper[0] : &s_hexLower[0], false)(Name::Log2Base(), 5, true)));
+}
+
+void Base32HexDecoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	BaseN_Decoder::IsolatedInitialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::DecodingLookupArray(), GetDefaultDecodingLookupArray(), false)(Name::Log2Base(), 5, true)));
+}
+
+// Unrolled initialization, http://github.com/weidai11/cryptopp/issues/376
+const int *Base32HexDecoder::GetDefaultDecodingLookupArray()
+{
+	return s_hexArray;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/base32.h b/runtime/third_party/cryptopp/base32.h
new file mode 100644
index 0000000..80a64ed
--- /dev/null
+++ b/runtime/third_party/cryptopp/base32.h
@@ -0,0 +1,158 @@
+// base32.h - written and placed in the public domain by Frank Palazzolo, based on hex.cpp by Wei Dai
+//              extended hex alphabet added by JW in November, 2017.
+
+/// \file base32.h
+/// \brief Classes for Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder
+
+#ifndef CRYPTOPP_BASE32_H
+#define CRYPTOPP_BASE32_H
+
+#include "cryptlib.h"
+#include "basecode.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Base32 encodes data using DUDE encoding
+/// \details Converts data to base32 using DUDE encoding. The default code is based on <A HREF="http://www.ietf.org/proceedings/51/I-D/draft-ietf-idn-dude-02.txt">Differential Unicode Domain Encoding (DUDE) (draft-ietf-idn-dude-02.txt)</A>.
+/// \sa Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder
+class Base32Encoder : public SimpleProxyFilter
+{
+public:
+	/// \brief Construct a Base32Encoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \param uppercase a flag indicating uppercase output
+	/// \param groupSize the size of the grouping
+	/// \param separator the separator to use between groups
+	/// \param terminator the terminator appeand after processing
+	/// \details Base32Encoder() constructs a default encoder. The constructor lacks fields for padding and
+	///   line breaks. You must use IsolatedInitialize() to change the default padding character or suppress it.
+	/// \sa Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder
+	Base32Encoder(BufferedTransformation *attachment = NULLPTR, bool uppercase = true, int groupSize = 0, const std::string &separator = ":", const std::string &terminator = "")
+		: SimpleProxyFilter(new BaseN_Encoder(new Grouper), attachment)
+	{
+		IsolatedInitialize(MakeParameters(Name::Uppercase(), uppercase)(Name::GroupSize(), groupSize)(Name::Separator(), ConstByteArrayParameter(separator))(Name::Terminator(), ConstByteArrayParameter(terminator)));
+	}
+
+	/// \brief Initialize or reinitialize this object, without signal propagation
+	/// \param parameters a set of NameValuePairs used to initialize this object
+	/// \details IsolatedInitialize() is used to initialize or reinitialize an object using a variable
+	///   number of arbitrarily typed arguments. IsolatedInitialize() does not call Initialize() on attached
+	///   transformations. If initialization should be propagated, then use the Initialize() function.
+	/// \details The following code modifies the padding and line break parameters for an encoder:
+	///   <pre>
+	///     Base32Encoder encoder;
+	///     AlgorithmParameters params = MakeParameters(Pad(), false)(InsertLineBreaks(), false);
+	///     encoder.IsolatedInitialize(params);</pre>
+	/// \details You can change the encoding to <A HREF="http://tools.ietf.org/html/rfc4648#page-10">RFC 4648, Base
+	///   32 Encoding with Extended Hex Alphabet</A> by performing the following:
+	///   <pre>
+	///     Base32Encoder encoder;
+	///     const byte ALPHABET[] = "0123456789ABCDEFGHIJKLMNOPQRSTUV";
+	///     AlgorithmParameters params = MakeParameters(Name::EncodingLookupArray(),(const byte *)ALPHABET);
+	///     encoder.IsolatedInitialize(params);</pre>
+	/// \details If you change the encoding alphabet, then you will need to change the decoding alphabet \a and
+	///   the decoder's lookup table.
+	/// \sa Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder
+	void IsolatedInitialize(const NameValuePairs &parameters);
+};
+
+/// \brief Base32 decodes data using DUDE encoding
+/// \details Converts data from base32 using DUDE encoding. The default code is based on <A HREF="http://www.ietf.org/proceedings/51/I-D/draft-ietf-idn-dude-02.txt">Differential Unicode Domain Encoding (DUDE) (draft-ietf-idn-dude-02.txt)</A>.
+/// \sa Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder
+class Base32Decoder : public BaseN_Decoder
+{
+public:
+	/// \brief Construct a Base32Decoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \sa IsolatedInitialize() for an example of modifying a Base32Decoder after construction.
+	Base32Decoder(BufferedTransformation *attachment = NULLPTR)
+		: BaseN_Decoder(GetDefaultDecodingLookupArray(), 5, attachment) {}
+
+	/// \brief Initialize or reinitialize this object, without signal propagation
+	/// \param parameters a set of NameValuePairs used to initialize this object
+	/// \details IsolatedInitialize() is used to initialize or reinitialize an object using a variable
+	///   number of arbitrarily typed arguments. IsolatedInitialize() does not call Initialize() on attached
+	///   transformations. If initialization should be propagated, then use the Initialize() function.
+	/// \details You can change the encoding to <A HREF="http://tools.ietf.org/html/rfc4648#page-10">RFC 4648, Base
+	///   32 Encoding with Extended Hex Alphabet</A> by performing the following:
+	///   <pre>
+	///     int lookup[256];
+	///     const byte ALPHABET[] = "0123456789ABCDEFGHIJKLMNOPQRSTUV";
+	///     Base32Decoder::InitializeDecodingLookupArray(lookup, ALPHABET, 32, true /*insensitive*/);
+	///
+	///     Base32Decoder decoder;
+	///     AlgorithmParameters params = MakeParameters(Name::DecodingLookupArray(),(const int *)lookup);
+	///     decoder.IsolatedInitialize(params);</pre>
+	/// \sa Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder
+	void IsolatedInitialize(const NameValuePairs &parameters);
+
+private:
+	/// \brief Provides the default decoding lookup table
+	/// \return default decoding lookup table
+	static const int * CRYPTOPP_API GetDefaultDecodingLookupArray();
+};
+
+/// \brief Base32 encodes data using extended hex
+/// \details Converts data to base32 using extended hex alphabet. The alphabet is different than Base32Encoder.
+/// \sa Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder, <A HREF="http://tools.ietf.org/html/rfc4648#page-10">RFC 4648, Base 32 Encoding with Extended Hex Alphabet</A>.
+/// \since Crypto++ 6.0
+class Base32HexEncoder : public SimpleProxyFilter
+{
+public:
+	/// \brief Construct a Base32HexEncoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \param uppercase a flag indicating uppercase output
+	/// \param groupSize the size of the grouping
+	/// \param separator the separator to use between groups
+	/// \param terminator the terminator appeand after processing
+	/// \details Base32HexEncoder() constructs a default encoder. The constructor lacks fields for padding and
+	///   line breaks. You must use IsolatedInitialize() to change the default padding character or suppress it.
+	/// \sa Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder
+	Base32HexEncoder(BufferedTransformation *attachment = NULLPTR, bool uppercase = true, int groupSize = 0, const std::string &separator = ":", const std::string &terminator = "")
+		: SimpleProxyFilter(new BaseN_Encoder(new Grouper), attachment)
+	{
+		IsolatedInitialize(MakeParameters(Name::Uppercase(), uppercase)(Name::GroupSize(), groupSize)(Name::Separator(), ConstByteArrayParameter(separator))(Name::Terminator(), ConstByteArrayParameter(terminator)));
+	}
+
+	/// \brief Initialize or reinitialize this object, without signal propagation
+	/// \param parameters a set of NameValuePairs used to initialize this object
+	/// \details IsolatedInitialize() is used to initialize or reinitialize an object using a variable
+	///   number of arbitrarily typed arguments. IsolatedInitialize() does not call Initialize() on attached
+	///   transformations. If initialization should be propagated, then use the Initialize() function.
+	/// \details The following code modifies the padding and line break parameters for an encoder:
+	///   <pre>
+	///     Base32HexEncoder encoder;
+	///     AlgorithmParameters params = MakeParameters(Pad(), false)(InsertLineBreaks(), false);
+	///     encoder.IsolatedInitialize(params);</pre>
+	void IsolatedInitialize(const NameValuePairs &parameters);
+};
+
+/// \brief Base32 decodes data using extended hex
+/// \details Converts data from base32 using extended hex alphabet. The alphabet is different than Base32Decoder.
+/// \sa Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder, <A HREF="http://tools.ietf.org/html/rfc4648#page-10">RFC 4648, Base 32 Encoding with Extended Hex Alphabet</A>.
+/// \since Crypto++ 6.0
+class Base32HexDecoder : public BaseN_Decoder
+{
+public:
+	/// \brief Construct a Base32HexDecoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \sa Base32Encoder, Base32Decoder, Base32HexEncoder and Base32HexDecoder
+	Base32HexDecoder(BufferedTransformation *attachment = NULLPTR)
+		: BaseN_Decoder(GetDefaultDecodingLookupArray(), 5, attachment) {}
+
+	/// \brief Initialize or reinitialize this object, without signal propagation
+	/// \param parameters a set of NameValuePairs used to initialize this object
+	/// \details IsolatedInitialize() is used to initialize or reinitialize an object using a variable
+	///   number of arbitrarily typed arguments. IsolatedInitialize() does not call Initialize() on attached
+	///   transformations. If initialization should be propagated, then use the Initialize() function.
+	void IsolatedInitialize(const NameValuePairs &parameters);
+
+private:
+	/// \brief Provides the default decoding lookup table
+	/// \return default decoding lookup table
+	static const int * CRYPTOPP_API GetDefaultDecodingLookupArray();
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/base64.cpp b/runtime/third_party/cryptopp/base64.cpp
new file mode 100644
index 0000000..9a23ec9
--- /dev/null
+++ b/runtime/third_party/cryptopp/base64.cpp
@@ -0,0 +1,111 @@
+// base64.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+#include "base64.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+ANONYMOUS_NAMESPACE_BEGIN
+
+const byte s_stdVec[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const byte s_urlVec[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const byte s_padding = '=';
+const int s_stdArray[256] = {
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
+	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
+	-1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
+	15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1,
+	-1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
+	41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+};
+const int s_urlArray[256] = {
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1,
+	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
+	-1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
+	15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, 63,
+	-1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
+	41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+};
+
+ANONYMOUS_NAMESPACE_END
+
+void Base64Encoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	bool insertLineBreaks = parameters.GetValueWithDefault(Name::InsertLineBreaks(), true);
+	int maxLineLength = parameters.GetIntValueWithDefault(Name::MaxLineLength(), 72);
+
+	const char *lineBreak = insertLineBreaks ? "\n" : "";
+
+	m_filter->Initialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::EncodingLookupArray(), &s_stdVec[0], false)
+			(Name::PaddingByte(), s_padding)
+			(Name::GroupSize(), insertLineBreaks ? maxLineLength : 0)
+			(Name::Separator(), ConstByteArrayParameter(lineBreak))
+			(Name::Terminator(), ConstByteArrayParameter(lineBreak))
+			(Name::Log2Base(), 6, true)));
+}
+
+void Base64URLEncoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	bool insertLineBreaks = parameters.GetValueWithDefault(Name::InsertLineBreaks(), true);
+	int maxLineLength = parameters.GetIntValueWithDefault(Name::MaxLineLength(), 72);
+
+	const char *lineBreak = insertLineBreaks ? "\n" : "";
+
+	m_filter->Initialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::EncodingLookupArray(), &s_urlVec[0], false)
+			(Name::PaddingByte(), s_padding)
+			(Name::GroupSize(), insertLineBreaks ? maxLineLength : 0)
+			(Name::Separator(), ConstByteArrayParameter(lineBreak))
+			(Name::Terminator(), ConstByteArrayParameter(lineBreak))
+			(Name::Log2Base(), 6, true)));
+}
+
+void Base64Decoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	BaseN_Decoder::IsolatedInitialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::DecodingLookupArray(), GetDecodingLookupArray(), false)(Name::Log2Base(), 6, true)));
+}
+
+const int *Base64Decoder::GetDecodingLookupArray()
+{
+	return s_stdArray;
+}
+
+void Base64URLDecoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	BaseN_Decoder::IsolatedInitialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::DecodingLookupArray(), GetDecodingLookupArray(), false)(Name::Log2Base(), 6, true)));
+}
+
+// Unrolled initialization, http://github.com/weidai11/cryptopp/issues/376
+const int *Base64URLDecoder::GetDecodingLookupArray()
+{
+	return s_urlArray;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/base64.h b/runtime/third_party/cryptopp/base64.h
new file mode 100644
index 0000000..be5c6b7
--- /dev/null
+++ b/runtime/third_party/cryptopp/base64.h
@@ -0,0 +1,158 @@
+// base64.h - originally written and placed in the public domain by Wei Dai
+
+/// \file base64.h
+/// \brief Classes for the Base64Encoder, Base64Decoder, Base64URLEncoder and Base64URLDecoder
+
+#ifndef CRYPTOPP_BASE64_H
+#define CRYPTOPP_BASE64_H
+
+#include "cryptlib.h"
+#include "basecode.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Base64 encodes data using DUDE
+/// \details Base64 encodes data per <A HREF="http://tools.ietf.org/html/rfc4648#section-4">RFC 4648, Base 64 Encoding</A>.
+class Base64Encoder : public SimpleProxyFilter
+{
+public:
+	/// \brief Construct a Base64Encoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \param insertLineBreaks a BufferedTrasformation to attach to this object
+	/// \param maxLineLength the length of a line if line breaks are used
+	/// \details Base64Encoder constructs a default encoder. The constructor lacks a parameter for padding, and you must
+	///   use IsolatedInitialize() to modify the Base64Encoder after construction.
+	/// \sa IsolatedInitialize() for an example of modifying an encoder after construction.
+	Base64Encoder(BufferedTransformation *attachment = NULLPTR, bool insertLineBreaks = true, int maxLineLength = 72)
+		: SimpleProxyFilter(new BaseN_Encoder(new Grouper), attachment)
+	{
+		IsolatedInitialize(MakeParameters(Name::InsertLineBreaks(), insertLineBreaks)(Name::MaxLineLength(), maxLineLength));
+	}
+
+	/// \brief Initialize or reinitialize this object, without signal propagation
+	/// \param parameters a set of NameValuePairs used to initialize this object
+	/// \details IsolatedInitialize() is used to initialize or reinitialize an object using a variable
+	///   number of arbitrarily typed arguments. IsolatedInitialize() does not call Initialize() on attached
+	///   transformations. If initialization should be propagated, then use the Initialize() function.
+	/// \details The following code modifies the padding and line break parameters for an encoder:
+	///   <pre>
+	///     Base64Encoder encoder;
+	///     AlgorithmParameters params = MakeParameters(Pad(), false)(InsertLineBreaks(), false);
+	///     encoder.IsolatedInitialize(params);</pre>
+	/// \details You can change the encoding to RFC 4648 web safe alphabet by performing the following:
+	///   <pre>
+	///     Base64Encoder encoder;
+	///     const byte ALPHABET[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+	///     AlgorithmParameters params = MakeParameters(Name::EncodingLookupArray(),(const byte *)ALPHABET);
+	///     encoder.IsolatedInitialize(params);</pre>
+	/// \details If you change the encoding alphabet, then you will need to change the decoding alphabet \a and
+	///   the decoder's lookup table.
+	/// \sa Base64URLEncoder for an encoder that provides the web safe alphabet, and Base64Decoder::IsolatedInitialize()
+	///   for an example of modifying a decoder's lookup table after construction.
+	void IsolatedInitialize(const NameValuePairs &parameters);
+};
+
+/// \brief Base64 decodes data using DUDE
+/// \details Base64 encodes data per <A HREF="http://tools.ietf.org/html/rfc4648#section-4">RFC 4648, Base 64 Encoding</A>.
+class Base64Decoder : public BaseN_Decoder
+{
+public:
+	/// \brief Construct a Base64Decoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \sa IsolatedInitialize() for an example of modifying an encoder after construction.
+	Base64Decoder(BufferedTransformation *attachment = NULLPTR)
+		: BaseN_Decoder(GetDecodingLookupArray(), 6, attachment) {}
+
+	/// \brief Initialize or reinitialize this object, without signal propagation
+	/// \param parameters a set of NameValuePairs used to initialize this object
+	/// \details IsolatedInitialize() is used to initialize or reinitialize an object using a variable
+	///   number of arbitrarily typed arguments. IsolatedInitialize() does not call Initialize() on attached
+	///   transformations. If initialization should be propagated, then use the Initialize() function.
+	/// \details The default decoding alpahbet is RFC 4868. You can change the to RFC 4868 web safe alphabet
+	///   by performing the following:
+	///   <pre>
+	///     int lookup[256];
+	///     const byte ALPHABET[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+	///     Base64Decoder::InitializeDecodingLookupArray(lookup, ALPHABET, 64, false);
+	///
+	///     Base64Decoder decoder;
+	///     AlgorithmParameters params = MakeParameters(Name::DecodingLookupArray(),(const int *)lookup);
+	///     decoder.IsolatedInitialize(params);</pre>
+	/// \sa Base64URLDecoder for a decoder that provides the web safe alphabet, and Base64Encoder::IsolatedInitialize()
+	///   for an example of modifying an encoder's alphabet after construction.
+	void IsolatedInitialize(const NameValuePairs &parameters);
+
+private:
+	/// \brief Provides the default decoding lookup table
+	/// \return default decoding lookup table
+	static const int * CRYPTOPP_API GetDecodingLookupArray();
+};
+
+/// \brief Base64 encodes data using a web safe alphabet
+/// \details Base64 encodes data per <A HREF="http://tools.ietf.org/html/rfc4648#section-5">RFC 4648, Base 64 Encoding
+///   with URL and Filename Safe Alphabet</A>.
+class Base64URLEncoder : public SimpleProxyFilter
+{
+public:
+	/// \brief Construct a Base64URLEncoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \param insertLineBreaks a BufferedTrasformation to attach to this object
+	/// \param maxLineLength the length of a line if line breaks are used
+	/// \details Base64URLEncoder() constructs a default encoder using a web safe alphabet. The constructor ignores
+	///   insertLineBreaks and maxLineLength because the web and URL safe specifications don't use them. They are
+	///   present in the constructor for API compatibility with Base64Encoder so it is a drop-in replacement. The
+	///   constructor also disables padding on the encoder for the same reason.
+	/// \details If you need line breaks or padding, then you must use IsolatedInitialize() to set them
+	///   after constructing a Base64URLEncoder.
+	/// \sa Base64Encoder for an encoder that provides a classic alphabet, and Base64URLEncoder::IsolatedInitialize
+	///   for an example of modifying an encoder after construction.
+	Base64URLEncoder(BufferedTransformation *attachment = NULLPTR, bool insertLineBreaks = false, int maxLineLength = -1)
+		: SimpleProxyFilter(new BaseN_Encoder(new Grouper), attachment)
+	{
+		CRYPTOPP_UNUSED(insertLineBreaks), CRYPTOPP_UNUSED(maxLineLength);
+		IsolatedInitialize(MakeParameters(Name::InsertLineBreaks(), false)(Name::MaxLineLength(), -1)(Name::Pad(),false));
+	}
+
+	/// \details IsolatedInitialize() is used to initialize or reinitialize an object using a variable
+	///   number of arbitrarily typed arguments. IsolatedInitialize() does not call Initialize() on attached
+	///   transformations. If initialization should be propagated, then use the Initialize() function.
+	/// \details The following code modifies the padding and line break parameters for an encoder:
+	///   <pre>
+	///     Base64URLEncoder encoder;
+	///     AlgorithmParameters params = MakeParameters(Name::Pad(), true)(Name::InsertLineBreaks(), true);
+	///     encoder.IsolatedInitialize(params);</pre>
+	/// \sa Base64Encoder for an encoder that provides a classic alphabet.
+	void IsolatedInitialize(const NameValuePairs &parameters);
+};
+
+/// \brief Base64 decodes data using a web safe alphabet
+/// \details Base64 encodes data per <A HREF="http://tools.ietf.org/html/rfc4648#section-5">RFC 4648, Base 64 Encoding
+///   with URL and Filename Safe Alphabet</A>.
+class Base64URLDecoder : public BaseN_Decoder
+{
+public:
+	/// \brief Construct a Base64URLDecoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \details Base64URLDecoder() constructs a default decoder using a web safe alphabet.
+	/// \sa Base64Decoder for a decoder that provides a classic alphabet.
+	Base64URLDecoder(BufferedTransformation *attachment = NULLPTR)
+		: BaseN_Decoder(GetDecodingLookupArray(), 6, attachment) {}
+
+	/// \brief Initialize or reinitialize this object, without signal propagation
+	/// \param parameters a set of NameValuePairs used to initialize this object
+	/// \details IsolatedInitialize() is used to initialize or reinitialize an object using a variable
+	///   number of arbitrarily typed arguments. IsolatedInitialize() does not call Initialize() on
+	///  attached transformations. If initialization should be propagated, then use the Initialize() function.
+	/// \sa Base64Decoder for a decoder that provides a classic alphabet, and Base64URLEncoder::IsolatedInitialize
+	///   for an example of modifying an encoder after construction.
+	void IsolatedInitialize(const NameValuePairs &parameters);
+
+private:
+	/// \brief Provides the default decoding lookup table
+	/// \return default decoding lookup table
+	static const int * CRYPTOPP_API GetDecodingLookupArray();
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/basecode.cpp b/runtime/third_party/cryptopp/basecode.cpp
new file mode 100644
index 0000000..e5aeb2a
--- /dev/null
+++ b/runtime/third_party/cryptopp/basecode.cpp
@@ -0,0 +1,239 @@
+// basecode.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "basecode.h"
+#include "fltrimpl.h"
+#include <ctype.h>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void BaseN_Encoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	parameters.GetRequiredParameter("BaseN_Encoder", Name::EncodingLookupArray(), m_alphabet);
+
+	parameters.GetRequiredIntParameter("BaseN_Encoder", Name::Log2Base(), m_bitsPerChar);
+	if (m_bitsPerChar <= 0 || m_bitsPerChar >= 8)
+		throw InvalidArgument("BaseN_Encoder: Log2Base must be between 1 and 7 inclusive");
+
+	byte padding;
+	bool pad;
+	if (parameters.GetValue(Name::PaddingByte(), padding))
+		pad = parameters.GetValueWithDefault(Name::Pad(), true);
+	else
+		pad = false;
+	m_padding = pad ? padding : -1;
+
+	m_bytePos = m_bitPos = 0;
+
+	int i = 8;
+	while (i%m_bitsPerChar != 0)
+		i += 8;
+	m_outputBlockSize = i/m_bitsPerChar;
+
+	m_outBuf.New(m_outputBlockSize);
+}
+
+size_t BaseN_Encoder::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	FILTER_BEGIN;
+	while (m_inputPosition < length)
+	{
+		if (m_bytePos == 0)
+			std::memset(m_outBuf, 0, m_outputBlockSize);
+
+		{
+		unsigned int b = begin[m_inputPosition++], bitsLeftInSource = 8;
+		while (true)
+		{
+			CRYPTOPP_ASSERT(m_bitsPerChar-m_bitPos >= 0);
+			unsigned int bitsLeftInTarget = (unsigned int)(m_bitsPerChar-m_bitPos);
+			m_outBuf[m_bytePos] |= b >> (8-bitsLeftInTarget);
+			if (bitsLeftInSource >= bitsLeftInTarget)
+			{
+				m_bitPos = 0;
+				++m_bytePos;
+				bitsLeftInSource -= bitsLeftInTarget;
+				if (bitsLeftInSource == 0)
+					break;
+				b <<= bitsLeftInTarget;
+				b &= 0xff;
+			}
+			else
+			{
+				m_bitPos += bitsLeftInSource;
+				break;
+			}
+		}
+		}
+
+		CRYPTOPP_ASSERT(m_bytePos <= m_outputBlockSize);
+		if (m_bytePos == m_outputBlockSize)
+		{
+			int i;
+			for (i=0; i<m_bytePos; i++)
+			{
+				CRYPTOPP_ASSERT(m_outBuf[i] < (1 << m_bitsPerChar));
+				m_outBuf[i] = m_alphabet[m_outBuf[i]];
+			}
+			FILTER_OUTPUT(1, m_outBuf, m_outputBlockSize, 0);
+
+			m_bytePos = m_bitPos = 0;
+		}
+	}
+	if (messageEnd)
+	{
+		if (m_bitPos > 0)
+			++m_bytePos;
+
+		int i;
+		for (i=0; i<m_bytePos; i++)
+			m_outBuf[i] = m_alphabet[m_outBuf[i]];
+
+		if (m_padding != -1 && m_bytePos > 0)
+		{
+			std::memset(m_outBuf+m_bytePos, m_padding, m_outputBlockSize-m_bytePos);
+			m_bytePos = m_outputBlockSize;
+		}
+		FILTER_OUTPUT(2, m_outBuf, m_bytePos, messageEnd);
+		m_bytePos = m_bitPos = 0;
+	}
+	FILTER_END_NO_MESSAGE_END;
+}
+
+void BaseN_Decoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	parameters.GetRequiredParameter("BaseN_Decoder", Name::DecodingLookupArray(), m_lookup);
+
+	parameters.GetRequiredIntParameter("BaseN_Decoder", Name::Log2Base(), m_bitsPerChar);
+	if (m_bitsPerChar <= 0 || m_bitsPerChar >= 8)
+		throw InvalidArgument("BaseN_Decoder: Log2Base must be between 1 and 7 inclusive");
+
+	m_bytePos = m_bitPos = 0;
+
+	int i = m_bitsPerChar;
+	while (i%8 != 0)
+		i += m_bitsPerChar;
+	m_outputBlockSize = i/8;
+
+	m_outBuf.New(m_outputBlockSize);
+}
+
+size_t BaseN_Decoder::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	FILTER_BEGIN;
+	while (m_inputPosition < length)
+	{
+		unsigned int value;
+		value = m_lookup[begin[m_inputPosition++]];
+		if (value >= 256)
+			continue;
+
+		if (m_bytePos == 0 && m_bitPos == 0)
+			std::memset(m_outBuf, 0, m_outputBlockSize);
+
+		{
+			int newBitPos = m_bitPos + m_bitsPerChar;
+			if (newBitPos <= 8)
+				m_outBuf[m_bytePos] |= value << (8-newBitPos);
+			else
+			{
+				m_outBuf[m_bytePos] |= value >> (newBitPos-8);
+				m_outBuf[m_bytePos+1] |= value << (16-newBitPos);
+			}
+
+			m_bitPos = newBitPos;
+			while (m_bitPos >= 8)
+			{
+				m_bitPos -= 8;
+				++m_bytePos;
+			}
+		}
+
+		if (m_bytePos == m_outputBlockSize)
+		{
+			FILTER_OUTPUT(1, m_outBuf, m_outputBlockSize, 0);
+			m_bytePos = m_bitPos = 0;
+		}
+	}
+	if (messageEnd)
+	{
+		FILTER_OUTPUT(2, m_outBuf, m_bytePos, messageEnd);
+		m_bytePos = m_bitPos = 0;
+	}
+	FILTER_END_NO_MESSAGE_END;
+}
+
+void BaseN_Decoder::InitializeDecodingLookupArray(int *lookup, const byte *alphabet, unsigned int base, bool caseInsensitive)
+{
+	std::fill(lookup, lookup+256, -1);
+
+	for (unsigned int i=0; i<base; i++)
+	{
+		// Debug asserts for 'lookup[alphabet[i]] == -1' removed because the self tests
+		// have unusual tests that try to break the encoders and decoders. Tests include
+		// a string of the same characters. I.,e., a string of stars like '********...'.
+		if (caseInsensitive && isalpha(alphabet[i]))
+		{
+			lookup[toupper(alphabet[i])] = i;
+			lookup[tolower(alphabet[i])] = i;
+		}
+		else
+		{
+			lookup[alphabet[i]] = i;
+		}
+	}
+}
+
+void Grouper::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_groupSize = parameters.GetIntValueWithDefault(Name::GroupSize(), 0);
+	ConstByteArrayParameter separator, terminator;
+	if (m_groupSize)
+		parameters.GetRequiredParameter("Grouper", Name::Separator(), separator);
+	else
+		parameters.GetValue(Name::Separator(), separator);
+	parameters.GetValue(Name::Terminator(), terminator);
+
+	m_separator.Assign(separator.begin(), separator.size());
+	m_terminator.Assign(terminator.begin(), terminator.size());
+	m_counter = 0;
+}
+
+size_t Grouper::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	FILTER_BEGIN;
+	if (m_groupSize)
+	{
+		while (m_inputPosition < length)
+		{
+			if (m_counter == m_groupSize)
+			{
+				FILTER_OUTPUT(1, m_separator, m_separator.size(), 0);
+				m_counter = 0;
+			}
+
+			size_t len;
+			FILTER_OUTPUT2(2, (len = STDMIN(length-m_inputPosition, m_groupSize-m_counter)),
+				begin+m_inputPosition, len, 0);
+			m_inputPosition += len;
+			m_counter += len;
+		}
+	}
+	else
+		FILTER_OUTPUT(3, begin, length, 0);
+
+	if (messageEnd)
+	{
+		FILTER_OUTPUT(4, m_terminator, m_terminator.size(), messageEnd);
+		m_counter = 0;
+	}
+	FILTER_END_NO_MESSAGE_END
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/basecode.h b/runtime/third_party/cryptopp/basecode.h
new file mode 100644
index 0000000..7158de6
--- /dev/null
+++ b/runtime/third_party/cryptopp/basecode.h
@@ -0,0 +1,146 @@
+// basecode.h - originally written and placed in the public domain by Wei Dai
+
+/// \file
+/// \brief Base classes for working with encoders and decoders.
+
+#ifndef CRYPTOPP_BASECODE_H
+#define CRYPTOPP_BASECODE_H
+
+#include "cryptlib.h"
+#include "filters.h"
+#include "algparam.h"
+#include "argnames.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Encoder for bases that are a power of 2
+class CRYPTOPP_DLL BaseN_Encoder : public Unflushable<Filter>
+{
+public:
+	/// \brief Construct a BaseN_Encoder
+	/// \param attachment a BufferedTransformation to attach to this object
+	BaseN_Encoder(BufferedTransformation *attachment=NULLPTR)
+		: m_alphabet(NULLPTR), m_padding(0), m_bitsPerChar(0)
+		, m_outputBlockSize(0), m_bytePos(0), m_bitPos(0)
+			{Detach(attachment);}
+
+	/// \brief Construct a BaseN_Encoder
+	/// \param alphabet table of ASCII characters to use as the alphabet
+	/// \param log2base the log<sub>2</sub>base
+	/// \param attachment a BufferedTransformation to attach to this object
+	/// \param padding the character to use as padding
+	/// \pre log2base must be between 1 and 7 inclusive
+	/// \throw InvalidArgument if log2base is not between 1 and 7
+	BaseN_Encoder(const byte *alphabet, int log2base, BufferedTransformation *attachment=NULLPTR, int padding=-1)
+		: m_alphabet(NULLPTR), m_padding(0), m_bitsPerChar(0)
+		, m_outputBlockSize(0), m_bytePos(0), m_bitPos(0)
+	{
+		Detach(attachment);
+		BaseN_Encoder::IsolatedInitialize(
+			MakeParameters
+				(Name::EncodingLookupArray(), alphabet)
+				(Name::Log2Base(), log2base)
+				(Name::Pad(), padding != -1)
+				(Name::PaddingByte(), byte(padding)));
+	}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *begin, size_t length, int messageEnd, bool blocking);
+
+private:
+	const byte *m_alphabet;
+	int m_padding, m_bitsPerChar, m_outputBlockSize;
+	int m_bytePos, m_bitPos;
+	SecByteBlock m_outBuf;
+};
+
+/// \brief Decoder for bases that are a power of 2
+class CRYPTOPP_DLL BaseN_Decoder : public Unflushable<Filter>
+{
+public:
+	/// \brief Construct a BaseN_Decoder
+	/// \param attachment a BufferedTransformation to attach to this object
+	/// \details padding is set to -1, which means use default padding. If not
+	///   required, then the value must be set via IsolatedInitialize().
+	BaseN_Decoder(BufferedTransformation *attachment=NULLPTR)
+		: m_lookup(NULLPTR), m_bitsPerChar(0)
+		, m_outputBlockSize(0), m_bytePos(0), m_bitPos(0)
+			{Detach(attachment);}
+
+	/// \brief Construct a BaseN_Decoder
+	/// \param lookup table of values
+	/// \param log2base the log<sub>2</sub>base
+	/// \param attachment a BufferedTransformation to attach to this object
+	/// \details log2base is the exponent (like 5 in 2<sup>5</sup>), and not
+	///   the number of elements (like 32).
+	/// \details padding is set to -1, which means use default padding. If not
+	///   required, then the value must be set via IsolatedInitialize().
+	BaseN_Decoder(const int *lookup, int log2base, BufferedTransformation *attachment=NULLPTR)
+		: m_lookup(NULLPTR), m_bitsPerChar(0)
+		, m_outputBlockSize(0), m_bytePos(0), m_bitPos(0)
+	{
+		Detach(attachment);
+		BaseN_Decoder::IsolatedInitialize(
+			MakeParameters
+				(Name::DecodingLookupArray(), lookup)
+				(Name::Log2Base(), log2base));
+	}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *begin, size_t length, int messageEnd, bool blocking);
+
+	/// \brief Initializes BaseN lookup array
+	/// \param lookup table of values
+	/// \param alphabet table of ASCII characters
+	/// \param base the base for the encoder
+	/// \param caseInsensitive flag indicating whether the alphabet is case sensitivie
+	/// \pre COUNTOF(lookup) == 256
+	/// \pre COUNTOF(alphabet) == base
+	/// \details Internally, the function sets the first 256 elements in the lookup table to
+	///  their value from the alphabet array or -1. base is the number of element (like 32),
+	///  and not an exponent (like 5 in 2<sup>5</sup>)
+	static void CRYPTOPP_API InitializeDecodingLookupArray(int *lookup, const byte *alphabet, unsigned int base, bool caseInsensitive);
+
+private:
+	const int *m_lookup;
+	int m_bitsPerChar, m_outputBlockSize;
+	int m_bytePos, m_bitPos;
+	SecByteBlock m_outBuf;
+};
+
+/// \brief Filter that breaks input stream into groups of fixed size
+class CRYPTOPP_DLL Grouper : public Bufferless<Filter>
+{
+public:
+	/// \brief Construct a Grouper
+	/// \param attachment a BufferedTransformation to attach to this object
+	Grouper(BufferedTransformation *attachment=NULLPTR)
+		: m_groupSize(0), m_counter(0) {Detach(attachment);}
+
+	/// \brief Construct a Grouper
+	/// \param groupSize the size of the grouping
+	/// \param separator the separator to use between groups
+	/// \param terminator the terminator appeand after processing
+	/// \param attachment a BufferedTransformation to attach to this object
+	Grouper(int groupSize, const std::string &separator, const std::string &terminator, BufferedTransformation *attachment=NULLPTR)
+		: m_groupSize(0), m_counter(0)
+	{
+		Detach(attachment);
+		Grouper::IsolatedInitialize(
+			MakeParameters
+				(Name::GroupSize(), groupSize)
+				(Name::Separator(), ConstByteArrayParameter(separator))
+				(Name::Terminator(), ConstByteArrayParameter(terminator)));
+	}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *begin, size_t length, int messageEnd, bool blocking);
+
+private:
+	SecByteBlock m_separator, m_terminator;
+	size_t m_groupSize, m_counter;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/bench.h b/runtime/third_party/cryptopp/bench.h
new file mode 100644
index 0000000..561b657
--- /dev/null
+++ b/runtime/third_party/cryptopp/bench.h
@@ -0,0 +1,105 @@
+// bench.h - originally written and placed in the public domain by Wei Dai
+//           CryptoPP::Test namespace added by JW in February 2017
+
+#ifndef CRYPTOPP_BENCH_H
+#define CRYPTOPP_BENCH_H
+
+#include "cryptlib.h"
+
+#include <iostream>
+#include <iomanip>
+#include <cmath>
+#include <ctime>
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+// More granular control over benchmarks
+enum TestClass {
+	/// \brief Random number generators
+	UnkeyedRNG=(1<<0),
+	/// \brief Message digests
+	UnkeyedHash=(1<<1),
+	/// \brief Other unkeyed algorithms
+	UnkeyedOther=(1<<2),
+
+	/// \brief Message authentication codes
+	SharedKeyMAC=(1<<3),
+	/// \brief Stream ciphers
+	SharedKeyStream=(1<<4),
+	/// \brief Block ciphers ciphers
+	SharedKeyBlock=(1<<5),
+	/// \brief Other shared key algorithms
+	SharedKeyOther=(1<<6),
+
+	/// \brief Key agreement algorithms over integers
+	PublicKeyAgreement=(1<<7),
+	/// \brief Encryption algorithms over integers
+	PublicKeyEncryption=(1<<8),
+	/// \brief Signature algorithms over integers
+	PublicKeySignature=(1<<9),
+	/// \brief Other public key algorithms over integers
+	PublicKeyOther=(1<<10),
+
+	/// \brief Key agreement algorithms over EC
+	PublicKeyAgreementEC=(1<<11),
+	/// \brief Encryption algorithms over EC
+	PublicKeyEncryptionEC=(1<<12),
+	/// \brief Signature algorithms over EC
+	PublicKeySignatureEC=(1<<13),
+	/// \brief Other public key algorithms over EC
+	PublicKeyOtherEC=(1<<14),
+
+	Unkeyed=UnkeyedRNG|UnkeyedHash|UnkeyedOther,
+	SharedKey=SharedKeyMAC|SharedKeyStream|SharedKeyBlock|SharedKeyOther,
+	PublicKey=PublicKeyAgreement|PublicKeyEncryption|PublicKeySignature|PublicKeyOther,
+	PublicKeyEC=PublicKeyAgreementEC|PublicKeyEncryptionEC|PublicKeySignatureEC|PublicKeyOtherEC,
+
+	All=Unkeyed|SharedKey|PublicKey|PublicKeyEC,
+
+	TestFirst=(0), TestLast=(1<<15)
+};
+
+extern const double CLOCK_TICKS_PER_SECOND;
+extern double g_allocatedTime;
+extern double g_hertz;
+extern double g_logTotal;
+extern unsigned int g_logCount;
+extern const byte defaultKey[];
+
+// Test book keeping
+extern time_t g_testBegin;
+extern time_t g_testEnd;
+
+// Benchmark command handler
+void BenchmarkWithCommand(int argc, const char* const argv[]);
+// Top level, prints preamble and postamble
+void Benchmark(Test::TestClass suites, double t, double hertz);
+// Unkeyed systems
+void BenchmarkUnkeyedAlgorithms(double t, double hertz);
+// Shared key systems
+void BenchmarkSharedKeyedAlgorithms(double t, double hertz);
+// Public key systems over integers
+void BenchmarkPublicKeyAlgorithms(double t, double hertz);
+// Public key systems over elliptic curves
+void BenchmarkEllipticCurveAlgorithms(double t, double hertz);
+
+// These are defined in bench1.cpp
+extern void OutputResultKeying(double iterations, double timeTaken);
+extern void OutputResultBytes(const char *name, const char *provider, double length, double timeTaken);
+extern void OutputResultOperations(const char *name, const char *provider, const char *operation, bool pc, unsigned long iterations, double timeTaken);
+
+// These are defined in bench1.cpp
+extern void BenchMark(const char *name, BufferedTransformation &bt, double timeTotal);
+extern void BenchMark(const char *name, StreamTransformation &cipher, double timeTotal);
+extern void BenchMark(const char *name, HashTransformation &ht, double timeTotal);
+extern void BenchMark(const char *name, RandomNumberGenerator &rng, double timeTotal);
+
+// These are defined in bench2.cpp
+extern void BenchMarkKeying(SimpleKeyingInterface &c, size_t keyLength, const NameValuePairs &params);
+extern void BenchMark(const char *name, AuthenticatedSymmetricCipher &cipher, double timeTotal);
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
+
+#endif
diff --git a/runtime/third_party/cryptopp/bench1.cpp b/runtime/third_party/cryptopp/bench1.cpp
new file mode 100644
index 0000000..24c9a3b
--- /dev/null
+++ b/runtime/third_party/cryptopp/bench1.cpp
@@ -0,0 +1,520 @@
+// bench1.cpp - originally written and placed in the public domain by Wei Dai
+//              CryptoPP::Test namespace added by JW in February 2017
+
+#include "cryptlib.h"
+#include "bench.h"
+#include "validate.h"
+
+#include "cpu.h"
+#include "factory.h"
+#include "algparam.h"
+#include "argnames.h"
+#include "smartptr.h"
+#include "stdcpp.h"
+
+#include "osrng.h"
+#include "drbg.h"
+#include "darn.h"
+#include "mersenne.h"
+#include "rdrand.h"
+#include "padlkrng.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4355)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+#ifdef CLOCKS_PER_SEC
+const double CLOCK_TICKS_PER_SECOND = (double)CLOCKS_PER_SEC;
+#elif defined(CLK_TCK)
+const double CLOCK_TICKS_PER_SECOND = (double)CLK_TCK;
+#else
+const double CLOCK_TICKS_PER_SECOND = 1000000.0;
+#endif
+
+extern const byte defaultKey[] = "0123456789" // 168 + NULL
+	"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
+	"00000000000000000000000000000000000000000000000000000"
+	"00000000000000000000000000000000000000000000000000000";
+
+double g_allocatedTime = 0.0, g_hertz = 0.0, g_logTotal = 0.0;
+unsigned int g_logCount = 0;
+time_t g_testBegin, g_testEnd;
+
+inline std::string HertzToString(double hertz)
+{
+	std::ostringstream oss;
+	oss.precision(3);
+
+	if (hertz >= 0.999e+9)
+		oss << hertz / 1e+9 << " GHz";
+	else if (hertz >= 0.999e+6)
+		oss << hertz / 1e+6 << " MHz";
+	else if (hertz >= 0.999e+3)
+		oss << hertz / 1e+3 << " KHz";
+	else
+		oss << hertz << " Hz";
+
+	return oss.str();
+}
+
+void OutputResultBytes(const char *name, const char *provider, double length, double timeTaken)
+{
+	std::ostringstream oss;
+
+	// Coverity finding
+	if (length < 0.000001f) length = 0.000001f;
+	if (timeTaken < 0.000001f) timeTaken = 0.000001f;
+
+	double mbs = length / timeTaken / (1024*1024);
+	oss << "\n<TR><TD>" << name << "<TD>" << provider;
+	oss << std::setiosflags(std::ios::fixed);
+	oss << "<TD>" << std::setprecision(0) << std::setiosflags(std::ios::fixed) << mbs;
+	if (g_hertz > 1.0f)
+	{
+		const double cpb = timeTaken * g_hertz / length;
+		if (cpb < 24.0f)
+			oss << "<TD>" << std::setprecision(2) << std::setiosflags(std::ios::fixed) << cpb;
+		else
+			oss << "<TD>" << std::setprecision(1) << std::setiosflags(std::ios::fixed) << cpb;
+	}
+	g_logTotal += log(mbs);
+	g_logCount++;
+
+	std::cout << oss.str();
+}
+
+void OutputResultKeying(double iterations, double timeTaken)
+{
+	std::ostringstream oss;
+
+	// Coverity finding
+	if (iterations < 0.000001f) iterations = 0.000001f;
+	if (timeTaken < 0.000001f) timeTaken = 0.000001f;
+
+	oss << "<TD>" << std::setprecision(3) << std::setiosflags(std::ios::fixed) << (1000*1000*timeTaken/iterations);
+
+	// Coverity finding
+	if (g_hertz > 1.0f)
+		oss << "<TD>" << std::setprecision(0) << std::setiosflags(std::ios::fixed) << timeTaken * g_hertz / iterations;
+
+	std::cout << oss.str();
+}
+
+void OutputResultOperations(const char *name, const char *provider, const char *operation, bool pc, unsigned long iterations, double timeTaken)
+{
+	CRYPTOPP_UNUSED(provider);
+	std::ostringstream oss;
+
+	// Coverity finding
+	if (!iterations) iterations++;
+	if (timeTaken < 0.000001f) timeTaken = 0.000001f;
+
+	oss << "\n<TR><TD>" << name << " " << operation << (pc ? " with precomputation" : "");
+	//oss << "<TD>" << provider;
+	oss << "<TD>" << std::setprecision(3) << std::setiosflags(std::ios::fixed) << (1000*timeTaken/iterations);
+
+	// Coverity finding
+	if (g_hertz > 1.0f)
+	{
+		const double t = timeTaken * g_hertz / iterations / 1000000;
+		oss << "<TD>" << std::setprecision(3) << std::setiosflags(std::ios::fixed) << t;
+	}
+
+	g_logTotal += log(iterations/timeTaken);
+	g_logCount++;
+
+	std::cout << oss.str();
+}
+
+/*
+void BenchMark(const char *name, BlockTransformation &cipher, double timeTotal)
+{
+	const int BUF_SIZE = RoundUpToMultipleOf(2048U, cipher.OptimalNumberOfParallelBlocks() * cipher.BlockSize());
+	AlignedSecByteBlock buf(BUF_SIZE);
+	buf.SetMark(16);
+
+	const int nBlocks = BUF_SIZE / cipher.BlockSize();
+	unsigned long i=0, blocks=1;
+	double timeTaken;
+
+	clock_t start = ::clock();
+	do
+	{
+		blocks *= 2;
+		for (; i<blocks; i++)
+			cipher.ProcessAndXorMultipleBlocks(buf, NULLPTR, buf, nBlocks);
+		timeTaken = double(::clock() - start) / CLOCK_TICKS_PER_SECOND;
+	}
+	while (timeTaken < 2.0/3*timeTotal);
+
+	OutputResultBytes(name, double(blocks) * BUF_SIZE, timeTaken);
+}
+*/
+
+void BenchMark(const char *name, StreamTransformation &cipher, double timeTotal)
+{
+	const int BUF_SIZE=RoundUpToMultipleOf(2048U, cipher.OptimalBlockSize());
+	AlignedSecByteBlock buf(BUF_SIZE);
+	Test::GlobalRNG().GenerateBlock(buf, BUF_SIZE);
+	buf.SetMark(16);
+
+	unsigned long i=0, blocks=1;
+	double timeTaken;
+
+	clock_t start = ::clock();
+	do
+	{
+		blocks *= 2;
+		for (; i<blocks; i++)
+			cipher.ProcessString(buf, BUF_SIZE);
+		timeTaken = double(::clock() - start) / CLOCK_TICKS_PER_SECOND;
+	}
+	while (timeTaken < 2.0/3*timeTotal);
+
+	std::string provider = cipher.AlgorithmProvider();
+	OutputResultBytes(name, provider.c_str(), double(blocks) * BUF_SIZE, timeTaken);
+}
+
+void BenchMark(const char *name, HashTransformation &ht, double timeTotal)
+{
+	const int BUF_SIZE=2048U;
+	AlignedSecByteBlock buf(BUF_SIZE);
+	Test::GlobalRNG().GenerateBlock(buf, BUF_SIZE);
+	buf.SetMark(16);
+
+	unsigned long i=0, blocks=1;
+	double timeTaken;
+
+	clock_t start = ::clock();
+	do
+	{
+		blocks *= 2;
+		for (; i<blocks; i++)
+			ht.Update(buf, BUF_SIZE);
+		timeTaken = double(::clock() - start) / CLOCK_TICKS_PER_SECOND;
+	}
+	while (timeTaken < 2.0/3*timeTotal);
+
+	std::string provider = ht.AlgorithmProvider();
+	OutputResultBytes(name, provider.c_str(), double(blocks) * BUF_SIZE, timeTaken);
+}
+
+void BenchMark(const char *name, BufferedTransformation &bt, double timeTotal)
+{
+	const int BUF_SIZE=2048U;
+	AlignedSecByteBlock buf(BUF_SIZE);
+	Test::GlobalRNG().GenerateBlock(buf, BUF_SIZE);
+	buf.SetMark(16);
+
+	unsigned long i=0, blocks=1;
+	double timeTaken;
+
+	clock_t start = ::clock();
+	do
+	{
+		blocks *= 2;
+		for (; i<blocks; i++)
+			bt.Put(buf, BUF_SIZE);
+		timeTaken = double(::clock() - start) / CLOCK_TICKS_PER_SECOND;
+	}
+	while (timeTaken < 2.0/3*timeTotal);
+
+	std::string provider = bt.AlgorithmProvider();
+	OutputResultBytes(name, provider.c_str(), double(blocks) * BUF_SIZE, timeTaken);
+}
+
+void BenchMark(const char *name, RandomNumberGenerator &rng, double timeTotal)
+{
+	const int BUF_SIZE = 2048U;
+	AlignedSecByteBlock buf(BUF_SIZE);
+	Test::GlobalRNG().GenerateBlock(buf, BUF_SIZE);
+	buf.SetMark(16);
+
+	SymmetricCipher * cipher = dynamic_cast<SymmetricCipher*>(&rng);
+	if (cipher != NULLPTR)
+	{
+		const size_t size = cipher->DefaultKeyLength();
+		if (cipher->IsResynchronizable())
+			cipher->SetKeyWithIV(buf, size, buf+size);
+		else
+			cipher->SetKey(buf, size);
+	}
+
+	unsigned long long blocks = 1;
+	double timeTaken;
+
+	clock_t start = ::clock();
+	do
+	{
+		rng.GenerateBlock(buf, buf.size());
+		blocks++;
+		timeTaken = double(::clock() - start) / CLOCK_TICKS_PER_SECOND;
+	} while (timeTaken < timeTotal);
+
+	std::string provider = rng.AlgorithmProvider();
+	OutputResultBytes(name, provider.c_str(), double(blocks) * BUF_SIZE, timeTaken);
+}
+
+// Hack, but we probably need a KeyedRandomNumberGenerator interface
+//  and a few methods to generalize keying a RNG. X917RNG, Hash_DRBG,
+//  HMAC_DRBG, AES/CFB RNG and a few others could use it. "A few others"
+//  includes BLAKE2, ChaCha and Poly1305 when used as a RNG.
+void BenchMark(const char *name, NIST_DRBG &rng, double timeTotal)
+{
+	const int BUF_SIZE = 2048U;
+	AlignedSecByteBlock buf(BUF_SIZE);
+	Test::GlobalRNG().GenerateBlock(buf, BUF_SIZE);
+	buf.SetMark(16);
+
+	rng.IncorporateEntropy(buf, rng.MinEntropyLength());
+	unsigned long long blocks = 1;
+	double timeTaken;
+
+	clock_t start = ::clock();
+	do
+	{
+		rng.GenerateBlock(buf, buf.size());
+		blocks++;
+		timeTaken = double(::clock() - start) / CLOCK_TICKS_PER_SECOND;
+	} while (timeTaken < timeTotal);
+
+	std::string provider = rng.AlgorithmProvider();
+	OutputResultBytes(name, provider.c_str(), double(blocks) * BUF_SIZE, timeTaken);
+}
+
+template <class T>
+void BenchMarkByNameKeyLess(const char *factoryName, const char *displayName = NULLPTR, const NameValuePairs &params = g_nullNameValuePairs)
+{
+	CRYPTOPP_UNUSED(params);
+	std::string name = factoryName;
+	if (displayName)
+		name = displayName;
+
+	member_ptr<T> obj(ObjectFactoryRegistry<T>::Registry().CreateObject(factoryName));
+	BenchMark(name.c_str(), *obj, g_allocatedTime);
+}
+
+void AddHtmlHeader()
+{
+	std::ostringstream oss;
+
+	// HTML5
+	oss << "<!DOCTYPE HTML>";
+	oss << "\n<HTML lang=\"en\">";
+
+	oss << "\n<HEAD>";
+	oss << "\n<META charset=\"UTF-8\">";
+	oss << "\n<TITLE>Speed Comparison of Popular Crypto Algorithms</TITLE>";
+	oss << "\n<STYLE>\n  table {border-collapse: collapse;}";
+	oss << "\n  table, th, td, tr {border: 1px solid black;}\n</STYLE>";
+	oss << "\n</HEAD>";
+
+	oss << "\n<BODY>";
+
+	oss << "\n<H1><A href=\"http://www.cryptopp.com\">Crypto++ " << CRYPTOPP_VERSION / 100;
+	oss << '.' << (CRYPTOPP_VERSION % 100) / 10 << '.' << CRYPTOPP_VERSION % 10 << "</A> Benchmarks</H1>";
+
+	oss << "\n<P>Here are speed benchmarks for some commonly used cryptographic algorithms.</P>";
+
+	if (g_hertz > 1.0f)
+		oss << "\n<P>CPU frequency of the test platform is " << HertzToString(g_hertz) << ".</P>";
+	else
+		oss << "\n<P>CPU frequency of the test platform was not provided.</P>" << std::endl;
+
+	std::cout << oss.str();
+}
+
+void AddHtmlFooter()
+{
+	std::ostringstream oss;
+	oss << "\n</BODY>\n</HTML>\n";
+	std::cout << oss.str();
+}
+
+void BenchmarkWithCommand(int argc, const char* const argv[])
+{
+	std::string command(argv[1]);
+	float runningTime(argc >= 3 ? Test::StringToValue<float, true>(argv[2]) : 1.0f);
+	float cpuFreq(argc >= 4 ? Test::StringToValue<float, true>(argv[3])*float(1e9) : 0.0f);
+	std::string algoName(argc >= 5 ? argv[4] : "");
+
+	// https://github.com/weidai11/cryptopp/issues/983
+	if (runningTime > 10.0f)
+		runningTime = 10.0f;
+
+	if (command == "b")  // All benchmarks
+		Benchmark(Test::All, runningTime, cpuFreq);
+	else if (command == "b4")  // Public key algorithms over EC
+		Test::Benchmark(Test::PublicKeyEC, runningTime, cpuFreq);
+	else if (command == "b3")  // Public key algorithms
+		Test::Benchmark(Test::PublicKey, runningTime, cpuFreq);
+	else if (command == "b2")  // Shared key algorithms
+		Test::Benchmark(Test::SharedKey, runningTime, cpuFreq);
+	else if (command == "b1")  // Unkeyed algorithms
+		Test::Benchmark(Test::Unkeyed, runningTime, cpuFreq);
+}
+
+void Benchmark(Test::TestClass suites, double t, double hertz)
+{
+	g_allocatedTime = t;
+	g_hertz = hertz;
+
+	// Add <br> in between tables
+	size_t count_breaks = 0;
+
+	AddHtmlHeader();
+
+	g_testBegin = ::time(NULLPTR);
+
+	if (static_cast<int>(suites) == 0 || static_cast<int>(suites) > TestLast)
+		suites = Test::All;
+
+	// Unkeyed algorithms
+	if (suites & Test::Unkeyed)
+	{
+		if (count_breaks)
+			std::cout << "\n<BR>";
+		count_breaks++;
+
+		BenchmarkUnkeyedAlgorithms(t, hertz);
+	}
+
+	// Shared key algorithms
+	if (suites & Test::SharedKey)
+	{
+		if (count_breaks)
+			std::cout << "\n<BR>";
+		count_breaks++;
+
+		BenchmarkSharedKeyedAlgorithms(t, hertz);
+	}
+
+	// Public key algorithms
+	if (suites & Test::PublicKey)
+	{
+		if (count_breaks)
+			std::cout << "\n<BR>";
+		count_breaks++;
+
+		BenchmarkPublicKeyAlgorithms(t, hertz);
+	}
+
+	// Public key algorithms over EC
+	if (suites & Test::PublicKeyEC)
+	{
+		if (count_breaks)
+			std::cout << "\n<BR>";
+		count_breaks++;
+
+		BenchmarkEllipticCurveAlgorithms(t, hertz);
+	}
+
+	g_testEnd = ::time(NULLPTR);
+
+	std::ostringstream oss;
+	oss << "\n<P>Throughput Geometric Average: " << std::setiosflags(std::ios::fixed);
+	oss << std::exp(g_logTotal/(g_logCount > 0.0f ? g_logCount : 1.0f)) << std::endl;
+
+	oss << "\n<P>Test started at " << TimeToString(g_testBegin);
+	oss << "\n<BR>Test ended at " << TimeToString(g_testEnd);
+	oss << "\n";
+	std::cout << oss.str();
+
+	AddHtmlFooter();
+}
+
+void BenchmarkUnkeyedAlgorithms(double t, double hertz)
+{
+	g_allocatedTime = t;
+	g_hertz = hertz;
+
+	const char *cpb;
+	if (g_hertz > 1.0f)
+		cpb = "<TH>Cycles/Byte";
+	else
+		cpb = "";
+
+	std::cout << "\n<TABLE>";
+
+	std::cout << "\n<COLGROUP><COL style=\"text-align: left;\"><COL style=\"text-align: right;\">";
+	std::cout << "<COL style=\"text-align: right;\">";
+	std::cout << "\n<THEAD style=\"background: #F0F0F0\">";
+	std::cout << "\n<TR><TH>Algorithm<TH>Provider<TH>MiB/Second" << cpb;
+
+	std::cout << "\n<TBODY style=\"background: white;\">";
+	{
+#ifdef NONBLOCKING_RNG_AVAILABLE
+		BenchMarkByNameKeyLess<RandomNumberGenerator>("NonblockingRng");
+#endif
+#ifdef OS_RNG_AVAILABLE
+		BenchMarkByNameKeyLess<RandomNumberGenerator>("AutoSeededRandomPool");
+		BenchMarkByNameKeyLess<RandomNumberGenerator>("AutoSeededX917RNG(AES)");
+#endif
+		BenchMarkByNameKeyLess<RandomNumberGenerator>("MT19937");
+#if (CRYPTOPP_BOOL_X86) && !defined(CRYPTOPP_DISABLE_ASM)
+		if (HasPadlockRNG())
+			BenchMarkByNameKeyLess<RandomNumberGenerator>("PadlockRNG");
+#endif
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64) && !defined(CRYPTOPP_DISABLE_ASM)
+		if (HasRDRAND())
+			BenchMarkByNameKeyLess<RandomNumberGenerator>("RDRAND");
+		if (HasRDSEED())
+			BenchMarkByNameKeyLess<RandomNumberGenerator>("RDSEED");
+#endif
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64) && !defined(CRYPTOPP_DISABLE_ASM)
+		if (HasDARN())
+			BenchMarkByNameKeyLess<RandomNumberGenerator>("DARN");
+#endif
+		BenchMarkByNameKeyLess<RandomNumberGenerator>("AES/OFB RNG");
+		BenchMarkByNameKeyLess<NIST_DRBG>("Hash_DRBG(SHA1)");
+		BenchMarkByNameKeyLess<NIST_DRBG>("Hash_DRBG(SHA256)");
+		BenchMarkByNameKeyLess<NIST_DRBG>("HMAC_DRBG(SHA1)");
+		BenchMarkByNameKeyLess<NIST_DRBG>("HMAC_DRBG(SHA256)");
+	}
+
+	std::cout << "\n<TBODY style=\"background: yellow;\">";
+	{
+		BenchMarkByNameKeyLess<HashTransformation>("CRC32");
+		BenchMarkByNameKeyLess<HashTransformation>("CRC32C");
+		BenchMarkByNameKeyLess<HashTransformation>("Adler32");
+		BenchMarkByNameKeyLess<HashTransformation>("MD5");
+		BenchMarkByNameKeyLess<HashTransformation>("SHA-1");
+		BenchMarkByNameKeyLess<HashTransformation>("SHA-256");
+		BenchMarkByNameKeyLess<HashTransformation>("SHA-512");
+		BenchMarkByNameKeyLess<HashTransformation>("SHA3-224");
+		BenchMarkByNameKeyLess<HashTransformation>("SHA3-256");
+		BenchMarkByNameKeyLess<HashTransformation>("SHA3-384");
+		BenchMarkByNameKeyLess<HashTransformation>("SHA3-512");
+		BenchMarkByNameKeyLess<HashTransformation>("Keccak-224");
+		BenchMarkByNameKeyLess<HashTransformation>("Keccak-256");
+		BenchMarkByNameKeyLess<HashTransformation>("Keccak-384");
+		BenchMarkByNameKeyLess<HashTransformation>("Keccak-512");
+		BenchMarkByNameKeyLess<HashTransformation>("Tiger");
+		BenchMarkByNameKeyLess<HashTransformation>("Whirlpool");
+		BenchMarkByNameKeyLess<HashTransformation>("RIPEMD-160");
+		BenchMarkByNameKeyLess<HashTransformation>("RIPEMD-320");
+		BenchMarkByNameKeyLess<HashTransformation>("RIPEMD-128");
+		BenchMarkByNameKeyLess<HashTransformation>("RIPEMD-256");
+		BenchMarkByNameKeyLess<HashTransformation>("SM3");
+		BenchMarkByNameKeyLess<HashTransformation>("BLAKE2s");
+		BenchMarkByNameKeyLess<HashTransformation>("BLAKE2b");
+		BenchMarkByNameKeyLess<HashTransformation>("LSH-256");
+		BenchMarkByNameKeyLess<HashTransformation>("LSH-512");
+	}
+
+	std::cout << "\n</TABLE>" << std::endl;
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/bench2.cpp b/runtime/third_party/cryptopp/bench2.cpp
new file mode 100644
index 0000000..0bd2d0a
--- /dev/null
+++ b/runtime/third_party/cryptopp/bench2.cpp
@@ -0,0 +1,267 @@
+// bench2.cpp - originally written and placed in the public domain by Wei Dai
+//              CryptoPP::Test namespace added by JW in February 2017
+
+#include "cryptlib.h"
+#include "bench.h"
+#include "validate.h"
+
+#include "cpu.h"
+#include "factory.h"
+#include "algparam.h"
+#include "argnames.h"
+#include "smartptr.h"
+#include "stdcpp.h"
+
+#include "vmac.h"
+#include "hmac.h"
+#include "ttmac.h"
+#include "cmac.h"
+#include "dmac.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4355)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+void BenchMarkKeying(SimpleKeyingInterface &c, size_t keyLength, const NameValuePairs &params)
+{
+	unsigned long iterations = 0;
+	double timeTaken;
+
+	clock_t start = ::clock();
+	do
+	{
+		for (unsigned int i=0; i<1024; i++)
+			c.SetKey(defaultKey, keyLength, params);
+		timeTaken = double(::clock() - start) / CLOCK_TICKS_PER_SECOND;
+		iterations += 1024;
+	}
+	while (timeTaken < g_allocatedTime);
+
+	OutputResultKeying(iterations, timeTaken);
+}
+
+void BenchMark(const char *name, AuthenticatedSymmetricCipher &cipher, double timeTotal)
+{
+	if (cipher.NeedsPrespecifiedDataLengths())
+		cipher.SpecifyDataLengths(0, cipher.MaxMessageLength(), 0);
+
+	BenchMark(name, static_cast<StreamTransformation &>(cipher), timeTotal);
+}
+
+template <class T_FactoryOutput, class T_Interface>
+void BenchMarkByName2(const char *factoryName, size_t keyLength=0, const char *displayName=NULLPTR, const NameValuePairs &params = g_nullNameValuePairs)
+{
+	std::string name(factoryName ? factoryName : "");
+	member_ptr<T_FactoryOutput> obj(ObjectFactoryRegistry<T_FactoryOutput>::Registry().CreateObject(name.c_str()));
+
+	if (keyLength == 0)
+		keyLength = obj->DefaultKeyLength();
+
+	if (displayName != NULLPTR)
+		name = displayName;
+	else if (keyLength != 0)
+		name += " (" + IntToString(keyLength * 8) + "-bit key)";
+
+	obj->SetKey(defaultKey, keyLength, CombinedNameValuePairs(params, MakeParameters(Name::IV(), ConstByteArrayParameter(defaultKey, obj->IVSize()), false)));
+	BenchMark(name.c_str(), *static_cast<T_Interface *>(obj.get()), g_allocatedTime);
+	BenchMarkKeying(*obj, keyLength, CombinedNameValuePairs(params, MakeParameters(Name::IV(), ConstByteArrayParameter(defaultKey, obj->IVSize()), false)));
+}
+
+template <class T_FactoryOutput>
+void BenchMarkByName(const char *factoryName, size_t keyLength=0, const char *displayName=NULLPTR, const NameValuePairs &params = g_nullNameValuePairs)
+{
+	BenchMarkByName2<T_FactoryOutput,T_FactoryOutput>(factoryName, keyLength, displayName, params);
+}
+
+void BenchmarkSharedKeyedAlgorithms(double t, double hertz)
+{
+	g_allocatedTime = t;
+	g_hertz = hertz;
+
+	const char *cpb, *cpk;
+	if (g_hertz > 1.0f)
+	{
+		cpb = "<TH>Cycles/Byte";
+		cpk = "<TH>Cycles to<BR>Setup Key and IV";
+	}
+	else
+	{
+		cpb = cpk = "";
+	}
+
+	std::cout << "\n<TABLE>";
+	std::cout << "\n<COLGROUP><COL style=\"text-align: left;\"><COL style=\"text-align: right;\"><COL style=";
+	std::cout << "\"text-align: right;\"><COL style=\"text-align: right;\"><COL style=\"text-align: right;\">";
+	std::cout << "\n<THEAD style=\"background: #F0F0F0\">";
+	std::cout << "\n<TR><TH>Algorithm<TH>Provider<TH>MiB/Second" << cpb;
+	std::cout << "<TH>Microseconds to<BR>Setup Key and IV" << cpk;
+
+	std::cout << "\n<TBODY style=\"background: white;\">";
+	{
+#if CRYPTOPP_AESNI_AVAILABLE
+		if (HasCLMUL())
+			BenchMarkByName2<AuthenticatedSymmetricCipher, MessageAuthenticationCode>("AES/GCM", 0, "GMAC(AES)");
+		else
+#elif CRYPTOPP_ARM_PMULL_AVAILABLE
+		if (HasPMULL())
+			BenchMarkByName2<AuthenticatedSymmetricCipher, MessageAuthenticationCode>("AES/GCM", 0, "GMAC(AES)");
+		else
+#elif CRYPTOPP_POWER8_VMULL_AVAILABLE
+		if (HasPMULL())
+			BenchMarkByName2<AuthenticatedSymmetricCipher, MessageAuthenticationCode>("AES/GCM", 0, "GMAC(AES)");
+		else
+#endif
+		{
+			BenchMarkByName2<AuthenticatedSymmetricCipher, MessageAuthenticationCode>("AES/GCM", 0, "GMAC(AES) (2K tables)", MakeParameters(Name::TableSize(), 2048));
+			BenchMarkByName2<AuthenticatedSymmetricCipher, MessageAuthenticationCode>("AES/GCM", 0, "GMAC(AES) (64K tables)", MakeParameters(Name::TableSize(), 64 * 1024));
+		}
+
+		BenchMarkByName<MessageAuthenticationCode>("VMAC(AES)-64");
+		BenchMarkByName<MessageAuthenticationCode>("VMAC(AES)-128");
+		BenchMarkByName<MessageAuthenticationCode>("HMAC(SHA-1)");
+		BenchMarkByName<MessageAuthenticationCode>("HMAC(SHA-256)");
+		BenchMarkByName<MessageAuthenticationCode>("Two-Track-MAC");
+		BenchMarkByName<MessageAuthenticationCode>("CMAC(AES)");
+		BenchMarkByName<MessageAuthenticationCode>("DMAC(AES)");
+		BenchMarkByName<MessageAuthenticationCode>("Poly1305(AES)");
+		BenchMarkByName<MessageAuthenticationCode>("Poly1305TLS");
+		BenchMarkByName<MessageAuthenticationCode>("BLAKE2s");
+		BenchMarkByName<MessageAuthenticationCode>("BLAKE2b");
+		BenchMarkByName<MessageAuthenticationCode>("SipHash-2-4");
+		BenchMarkByName<MessageAuthenticationCode>("SipHash-4-8");
+	}
+
+	std::cout << "\n<TBODY style=\"background: yellow;\">";
+	{
+		BenchMarkByName<SymmetricCipher>("Panama-LE");
+		BenchMarkByName<SymmetricCipher>("Panama-BE");
+		BenchMarkByName<SymmetricCipher>("Salsa20", 0, "Salsa20");
+		BenchMarkByName<SymmetricCipher>("Salsa20", 0, "Salsa20/12", MakeParameters(Name::Rounds(), 12));
+		BenchMarkByName<SymmetricCipher>("Salsa20", 0, "Salsa20/8", MakeParameters(Name::Rounds(), 8));
+		BenchMarkByName<SymmetricCipher>("ChaCha", 0, "ChaCha20");
+		BenchMarkByName<SymmetricCipher>("ChaCha", 0, "ChaCha12", MakeParameters(Name::Rounds(), 12));
+		BenchMarkByName<SymmetricCipher>("ChaCha", 0, "ChaCha8", MakeParameters(Name::Rounds(), 8));
+		BenchMarkByName<SymmetricCipher>("ChaChaTLS");
+		BenchMarkByName<SymmetricCipher>("Sosemanuk");
+		BenchMarkByName<SymmetricCipher>("Rabbit");
+		BenchMarkByName<SymmetricCipher>("RabbitWithIV");
+		BenchMarkByName<SymmetricCipher>("HC-128");
+		BenchMarkByName<SymmetricCipher>("HC-256");
+		BenchMarkByName<SymmetricCipher>("MARC4");
+		BenchMarkByName<SymmetricCipher>("SEAL-3.0-LE");
+		BenchMarkByName<SymmetricCipher>("WAKE-OFB-LE");
+	}
+
+	std::cout << "\n<TBODY style=\"background: white;\">";
+	{
+		BenchMarkByName<SymmetricCipher>("AES/CTR", 16);
+		BenchMarkByName<SymmetricCipher>("AES/CTR", 24);
+		BenchMarkByName<SymmetricCipher>("AES/CTR", 32);
+		BenchMarkByName<SymmetricCipher>("AES/CBC", 16);
+		BenchMarkByName<SymmetricCipher>("AES/CBC", 24);
+		BenchMarkByName<SymmetricCipher>("AES/CBC", 32);
+		BenchMarkByName<SymmetricCipher>("AES/XTS", 32);
+		BenchMarkByName<SymmetricCipher>("AES/XTS", 48);
+		BenchMarkByName<SymmetricCipher>("AES/XTS", 64);
+		BenchMarkByName<SymmetricCipher>("AES/OFB", 16);
+		BenchMarkByName<SymmetricCipher>("AES/CFB", 16);
+		BenchMarkByName<SymmetricCipher>("AES/ECB", 16);
+		BenchMarkByName<SymmetricCipher>("ARIA/CTR", 16);
+		BenchMarkByName<SymmetricCipher>("ARIA/CTR", 32);
+		BenchMarkByName<SymmetricCipher>("HIGHT/CTR");
+		BenchMarkByName<SymmetricCipher>("Camellia/CTR", 16);
+		BenchMarkByName<SymmetricCipher>("Camellia/CTR", 32);
+		BenchMarkByName<SymmetricCipher>("Twofish/CTR");
+		BenchMarkByName<SymmetricCipher>("Threefish-256(256)/CTR", 32);
+		BenchMarkByName<SymmetricCipher>("Threefish-512(512)/CTR", 64);
+		BenchMarkByName<SymmetricCipher>("Threefish-1024(1024)/CTR", 128);
+		BenchMarkByName<SymmetricCipher>("Serpent/CTR");
+		BenchMarkByName<SymmetricCipher>("CAST-128/CTR");
+		BenchMarkByName<SymmetricCipher>("CAST-256/CTR", 32);
+		BenchMarkByName<SymmetricCipher>("RC6/CTR");
+		BenchMarkByName<SymmetricCipher>("MARS/CTR");
+		BenchMarkByName<SymmetricCipher>("SHACAL-2/CTR", 16);
+		BenchMarkByName<SymmetricCipher>("SHACAL-2/CTR", 64);
+		BenchMarkByName<SymmetricCipher>("DES/CTR");
+		BenchMarkByName<SymmetricCipher>("DES-XEX3/CTR");
+		BenchMarkByName<SymmetricCipher>("DES-EDE3/CTR");
+		BenchMarkByName<SymmetricCipher>("IDEA/CTR");
+		BenchMarkByName<SymmetricCipher>("RC5/CTR", 0, "RC5 (r=16)");
+		BenchMarkByName<SymmetricCipher>("Blowfish/CTR");
+		BenchMarkByName<SymmetricCipher>("SKIPJACK/CTR");
+		BenchMarkByName<SymmetricCipher>("SEED/CTR", 0, "SEED/CTR (1/2 K table)");
+		BenchMarkByName<SymmetricCipher>("SM4/CTR");
+
+		BenchMarkByName<SymmetricCipher>("Kalyna-128/CTR", 16, "Kalyna-128(128)/CTR (128-bit key)");
+		BenchMarkByName<SymmetricCipher>("Kalyna-128/CTR", 32, "Kalyna-128(256)/CTR (256-bit key)");
+		BenchMarkByName<SymmetricCipher>("Kalyna-256/CTR", 32, "Kalyna-256(256)/CTR (256-bit key)");
+		BenchMarkByName<SymmetricCipher>("Kalyna-256/CTR", 64, "Kalyna-256(512)/CTR (512-bit key)");
+		BenchMarkByName<SymmetricCipher>("Kalyna-512/CTR", 64, "Kalyna-512(512)/CTR (512-bit key)");
+	}
+
+	std::cout << "\n<TBODY style=\"background: yellow;\">";
+	{
+		BenchMarkByName<SymmetricCipher>("CHAM-64/CTR", 16, "CHAM-64(128)/CTR (128-bit key)");
+		BenchMarkByName<SymmetricCipher>("CHAM-128/CTR", 16, "CHAM-128(128)/CTR (128-bit key)");
+		BenchMarkByName<SymmetricCipher>("CHAM-128/CTR", 32, "CHAM-128(256)/CTR (256-bit key)");
+
+		BenchMarkByName<SymmetricCipher>("LEA-128/CTR", 16, "LEA-128(128)/CTR (128-bit key)");
+		BenchMarkByName<SymmetricCipher>("LEA-128/CTR", 24, "LEA-128(192)/CTR (192-bit key)");
+		BenchMarkByName<SymmetricCipher>("LEA-128/CTR", 32, "LEA-128(256)/CTR (256-bit key)");
+
+		BenchMarkByName<SymmetricCipher>("SIMECK-32/CTR", 8, "SIMECK-32(64)/CTR (64-bit key)");
+		BenchMarkByName<SymmetricCipher>("SIMECK-64/CTR", 16, "SIMECK-64(128)/CTR (128-bit key)");
+
+		BenchMarkByName<SymmetricCipher>("SIMON-64/CTR", 12, "SIMON-64(96)/CTR (96-bit key)");
+		BenchMarkByName<SymmetricCipher>("SIMON-64/CTR", 16, "SIMON-64(128)/CTR (128-bit key)");
+		BenchMarkByName<SymmetricCipher>("SIMON-128/CTR", 16, "SIMON-128(128)/CTR (128-bit key)");
+		BenchMarkByName<SymmetricCipher>("SIMON-128/CTR", 24, "SIMON-128(192)/CTR (192-bit key)");
+		BenchMarkByName<SymmetricCipher>("SIMON-128/CTR", 32, "SIMON-128(256)/CTR (256-bit key)");
+
+		BenchMarkByName<SymmetricCipher>("SPECK-64/CTR", 12, "SPECK-64(96)/CTR (96-bit key)");
+		BenchMarkByName<SymmetricCipher>("SPECK-64/CTR", 16, "SPECK-64(128)/CTR (128-bit key)");
+		BenchMarkByName<SymmetricCipher>("SPECK-128/CTR", 16, "SPECK-128(128)/CTR (128-bit key)");
+		BenchMarkByName<SymmetricCipher>("SPECK-128/CTR", 24, "SPECK-128(192)/CTR (192-bit key)");
+		BenchMarkByName<SymmetricCipher>("SPECK-128/CTR", 32, "SPECK-128(256)/CTR (256-bit key)");
+
+		BenchMarkByName<SymmetricCipher>("TEA/CTR");
+		BenchMarkByName<SymmetricCipher>("XTEA/CTR");
+	}
+
+	std::cout << "\n<TBODY style=\"background: white;\">";
+	{
+#if CRYPTOPP_AESNI_AVAILABLE
+		if (HasCLMUL())
+			BenchMarkByName2<AuthenticatedSymmetricCipher, AuthenticatedSymmetricCipher>("AES/GCM", 0, "AES/GCM");
+		else
+#elif CRYPTOPP_ARM_PMULL_AVAILABLE
+		if (HasPMULL())
+			BenchMarkByName2<AuthenticatedSymmetricCipher, AuthenticatedSymmetricCipher>("AES/GCM", 0, "AES/GCM");
+		else
+#elif CRYPTOPP_POWER8_VMULL_AVAILABLE
+		if (HasPMULL())
+			BenchMarkByName2<AuthenticatedSymmetricCipher, AuthenticatedSymmetricCipher>("AES/GCM", 0, "AES/GCM");
+		else
+#endif
+		{
+			BenchMarkByName2<AuthenticatedSymmetricCipher, AuthenticatedSymmetricCipher>("AES/GCM", 0, "AES/GCM (2K tables)", MakeParameters(Name::TableSize(), 2048));
+			BenchMarkByName2<AuthenticatedSymmetricCipher, AuthenticatedSymmetricCipher>("AES/GCM", 0, "AES/GCM (64K tables)", MakeParameters(Name::TableSize(), 64 * 1024));
+		}
+		BenchMarkByName2<AuthenticatedSymmetricCipher, AuthenticatedSymmetricCipher>("AES/CCM");
+		BenchMarkByName2<AuthenticatedSymmetricCipher, AuthenticatedSymmetricCipher>("AES/EAX");
+		BenchMarkByName2<AuthenticatedSymmetricCipher, AuthenticatedSymmetricCipher>("ChaCha20/Poly1305");
+		BenchMarkByName2<AuthenticatedSymmetricCipher, AuthenticatedSymmetricCipher>("XChaCha20/Poly1305");
+	}
+
+	std::cout << "\n</TABLE>" << std::endl;
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/bench3.cpp b/runtime/third_party/cryptopp/bench3.cpp
new file mode 100644
index 0000000..e280a62
--- /dev/null
+++ b/runtime/third_party/cryptopp/bench3.cpp
@@ -0,0 +1,480 @@
+// bench3.cpp - originally written and placed in the public domain by Wei Dai
+//              CryptoPP::Test namespace added by JW in February 2017
+
+#include "cryptlib.h"
+#include "bench.h"
+#include "validate.h"
+
+#include "cpu.h"
+#include "factory.h"
+#include "algparam.h"
+#include "argnames.h"
+#include "smartptr.h"
+#include "stdcpp.h"
+
+#include "pubkey.h"
+#include "gfpcrypt.h"
+#include "eccrypto.h"
+#include "pkcspad.h"
+
+#include "files.h"
+#include "filters.h"
+#include "hex.h"
+#include "rsa.h"
+#include "nr.h"
+#include "dsa.h"
+#include "luc.h"
+#include "rw.h"
+#include "ecp.h"
+#include "ec2n.h"
+#include "asn.h"
+#include "dh.h"
+#include "mqv.h"
+#include "hmqv.h"
+#include "fhmqv.h"
+#include "xed25519.h"
+#include "xtrcrypt.h"
+#include "esign.h"
+#include "pssr.h"
+#include "oids.h"
+#include "randpool.h"
+#include "stdcpp.h"
+#include "hrtimer.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+void BenchMarkEncryption(const char *name, PK_Encryptor &key, double timeTotal, bool pc = false)
+{
+	unsigned int len = 16;
+	SecByteBlock plaintext(len), ciphertext(key.CiphertextLength(len));
+	Test::GlobalRNG().GenerateBlock(plaintext, len);
+
+	unsigned int i = 0;
+	double timeTaken;
+
+	ThreadUserTimer timer;
+	timer.StartTimer();
+
+	do
+	{
+		key.Encrypt(Test::GlobalRNG(), plaintext, len, ciphertext);
+		++i; timeTaken = timer.ElapsedTimeAsDouble();
+	}
+	while (timeTaken < timeTotal);
+
+	std::string provider = key.AlgorithmProvider();
+	OutputResultOperations(name, provider.c_str(), "Encryption", pc, i, timeTaken);
+
+	if (!pc && key.GetMaterial().SupportsPrecomputation())
+	{
+		key.AccessMaterial().Precompute(16);
+		BenchMarkEncryption(name, key, timeTotal, true);
+	}
+}
+
+void BenchMarkDecryption(const char *name, PK_Decryptor &priv, PK_Encryptor &pub, double timeTotal)
+{
+	unsigned int len = 16;
+	SecByteBlock ciphertext(pub.CiphertextLength(len));
+	SecByteBlock plaintext(pub.MaxPlaintextLength(ciphertext.size()));
+	Test::GlobalRNG().GenerateBlock(plaintext, len);
+	pub.Encrypt(Test::GlobalRNG(), plaintext, len, ciphertext);
+
+	unsigned int i = 0;
+	double timeTaken;
+
+	ThreadUserTimer timer;
+	timer.StartTimer();
+
+	do
+	{
+		priv.Decrypt(Test::GlobalRNG(), ciphertext, ciphertext.size(), plaintext);
+		++i; timeTaken = timer.ElapsedTimeAsDouble();
+	}
+	while (timeTaken < timeTotal);
+
+	std::string provider = priv.AlgorithmProvider();
+	OutputResultOperations(name, provider.c_str(), "Decryption", false, i, timeTaken);
+}
+
+void BenchMarkSigning(const char *name, PK_Signer &key, double timeTotal, bool pc=false)
+{
+	unsigned int len = 16;
+	AlignedSecByteBlock message(len), signature(key.SignatureLength());
+	Test::GlobalRNG().GenerateBlock(message, len);
+
+	unsigned int i = 0;
+	double timeTaken;
+
+	ThreadUserTimer timer;
+	timer.StartTimer();
+
+	do
+	{
+		(void)key.SignMessage(Test::GlobalRNG(), message, len, signature);
+		++i; timeTaken = timer.ElapsedTimeAsDouble();
+	}
+	while (timeTaken < timeTotal);
+
+	std::string provider = key.AlgorithmProvider();
+	OutputResultOperations(name, provider.c_str(), "Signature", pc, i, timeTaken);
+
+	if (!pc && key.GetMaterial().SupportsPrecomputation())
+	{
+		key.AccessMaterial().Precompute(16);
+		BenchMarkSigning(name, key, timeTotal, true);
+	}
+}
+
+void BenchMarkVerification(const char *name, const PK_Signer &priv, PK_Verifier &pub, double timeTotal, bool pc=false)
+{
+	unsigned int len = 16;
+	AlignedSecByteBlock message(len), signature(pub.SignatureLength());
+	Test::GlobalRNG().GenerateBlock(message, len);
+	priv.SignMessage(Test::GlobalRNG(), message, len, signature);
+
+	unsigned int i = 0;
+	double timeTaken;
+
+	ThreadUserTimer timer;
+	timer.StartTimer();
+
+	do
+	{
+		(void)pub.VerifyMessage(message, len, signature, signature.size());
+		++i; timeTaken = timer.ElapsedTimeAsDouble();
+	}
+	while (timeTaken < timeTotal);
+
+	std::string provider = pub.AlgorithmProvider();
+	OutputResultOperations(name, provider.c_str(), "Verification", pc, i, timeTaken);
+
+	if (!pc && pub.GetMaterial().SupportsPrecomputation())
+	{
+		pub.AccessMaterial().Precompute(16);
+		BenchMarkVerification(name, priv, pub, timeTotal, true);
+	}
+}
+
+void BenchMarkKeyGen(const char *name, SimpleKeyAgreementDomain &d, double timeTotal, bool pc=false)
+{
+	SecByteBlock priv(d.PrivateKeyLength()), pub(d.PublicKeyLength());
+
+	unsigned int i = 0;
+	double timeTaken;
+
+	ThreadUserTimer timer;
+	timer.StartTimer();
+
+	do
+	{
+		d.GenerateKeyPair(Test::GlobalRNG(), priv, pub);
+		++i; timeTaken = timer.ElapsedTimeAsDouble();
+	}
+	while (timeTaken < timeTotal);
+
+	std::string provider = d.AlgorithmProvider();
+	OutputResultOperations(name, provider.c_str(), "Key-Pair Generation", pc, i, timeTaken);
+
+	if (!pc && d.GetMaterial().SupportsPrecomputation())
+	{
+		d.AccessMaterial().Precompute(16);
+		BenchMarkKeyGen(name, d, timeTotal, true);
+	}
+}
+
+void BenchMarkKeyGen(const char *name, AuthenticatedKeyAgreementDomain &d, double timeTotal, bool pc=false)
+{
+	SecByteBlock priv(d.EphemeralPrivateKeyLength()), pub(d.EphemeralPublicKeyLength());
+
+	unsigned int i = 0;
+	double timeTaken;
+
+	ThreadUserTimer timer;
+	timer.StartTimer();
+
+	do
+	{
+		d.GenerateEphemeralKeyPair(Test::GlobalRNG(), priv, pub);
+		++i; timeTaken = timer.ElapsedTimeAsDouble();
+	}
+	while (timeTaken < timeTotal);
+
+	std::string provider = d.AlgorithmProvider();
+	OutputResultOperations(name, provider.c_str(), "Key-Pair Generation", pc, i, timeTaken);
+
+	if (!pc && d.GetMaterial().SupportsPrecomputation())
+	{
+		d.AccessMaterial().Precompute(16);
+		BenchMarkKeyGen(name, d, timeTotal, true);
+	}
+}
+
+void BenchMarkAgreement(const char *name, SimpleKeyAgreementDomain &d, double timeTotal, bool pc=false)
+{
+	SecByteBlock priv1(d.PrivateKeyLength()), priv2(d.PrivateKeyLength());
+	SecByteBlock pub1(d.PublicKeyLength()), pub2(d.PublicKeyLength());
+	d.GenerateKeyPair(Test::GlobalRNG(), priv1, pub1);
+	d.GenerateKeyPair(Test::GlobalRNG(), priv2, pub2);
+	SecByteBlock val(d.AgreedValueLength());
+
+	unsigned int i = 0;
+	double timeTaken;
+
+	ThreadUserTimer timer;
+	timer.StartTimer();
+
+	do
+	{
+		d.Agree(val, priv1, pub2);
+		d.Agree(val, priv2, pub1);
+		i+=2; timeTaken = timer.ElapsedTimeAsDouble();
+	}
+	while (timeTaken < timeTotal);
+
+	std::string provider = d.AlgorithmProvider();
+	OutputResultOperations(name, provider.c_str(), "Key Agreement", pc, i, timeTaken);
+}
+
+void BenchMarkAgreement(const char *name, AuthenticatedKeyAgreementDomain &d, double timeTotal, bool pc=false)
+{
+	SecByteBlock spriv1(d.StaticPrivateKeyLength()), spriv2(d.StaticPrivateKeyLength());
+	SecByteBlock epriv1(d.EphemeralPrivateKeyLength()), epriv2(d.EphemeralPrivateKeyLength());
+	SecByteBlock spub1(d.StaticPublicKeyLength()), spub2(d.StaticPublicKeyLength());
+	SecByteBlock epub1(d.EphemeralPublicKeyLength()), epub2(d.EphemeralPublicKeyLength());
+	d.GenerateStaticKeyPair(Test::GlobalRNG(), spriv1, spub1);
+	d.GenerateStaticKeyPair(Test::GlobalRNG(), spriv2, spub2);
+	d.GenerateEphemeralKeyPair(Test::GlobalRNG(), epriv1, epub1);
+	d.GenerateEphemeralKeyPair(Test::GlobalRNG(), epriv2, epub2);
+	SecByteBlock val(d.AgreedValueLength());
+
+	unsigned int i = 0;
+	double timeTaken;
+
+	ThreadUserTimer timer;
+	timer.StartTimer();
+
+	do
+	{
+		d.Agree(val, spriv1, epriv1, spub2, epub2);
+		d.Agree(val, spriv2, epriv2, spub1, epub1);
+		i+=2; timeTaken = timer.ElapsedTimeAsDouble();
+	}
+	while (timeTaken < timeTotal);
+
+	std::string provider = d.AlgorithmProvider();
+	OutputResultOperations(name, provider.c_str(), "Key Agreement", pc, i, timeTaken);
+}
+
+template <class SCHEME>
+void BenchMarkCrypto(const char *filename, const char *name, double timeTotal)
+{
+	FileSource f(DataDir(filename).c_str(), true, new HexDecoder);
+	typename SCHEME::Decryptor priv(f);
+	typename SCHEME::Encryptor pub(priv);
+	BenchMarkEncryption(name, pub, timeTotal);
+	BenchMarkDecryption(name, priv, pub, timeTotal);
+}
+
+template <class SCHEME>
+void BenchMarkSignature(const char *filename, const char *name, double timeTotal)
+{
+	FileSource f(DataDir(filename).c_str(), true, new HexDecoder);
+	typename SCHEME::Signer priv(f);
+	typename SCHEME::Verifier pub(priv);
+	BenchMarkSigning(name, priv, timeTotal);
+	BenchMarkVerification(name, priv, pub, timeTotal);
+}
+
+template <class D>
+void BenchMarkKeyAgreement(const char *filename, const char *name, double timeTotal)
+{
+	FileSource f(DataDir(filename).c_str(), true, new HexDecoder);
+	D d(f);
+	BenchMarkKeyGen(name, d, timeTotal);
+	BenchMarkAgreement(name, d, timeTotal);
+}
+
+void BenchmarkPublicKeyAlgorithms(double t, double hertz)
+{
+	g_allocatedTime = t;
+	g_hertz = hertz;
+
+	const char *mco;
+	if (g_hertz > 1.0f)
+		mco = "<TH>Megacycles/Operation";
+	else
+		mco = "";
+
+	std::cout << "\n<TABLE>";
+	std::cout << "\n<COLGROUP><COL style=\"text-align: left;\"><COL style=";
+	std::cout << "\"text-align: right;\"><COL style=\"text-align: right;\">";
+	std::cout << "\n<THEAD style=\"background: #F0F0F0\">";
+	std::cout << "\n<TR><TH>Operation<TH>Milliseconds/Operation" << mco;
+
+	std::cout << "\n<TBODY style=\"background: white;\">";
+	{
+		BenchMarkCrypto<RSAES<OAEP<SHA1> > >("TestData/rsa1024.dat", "RSA 1024", t);
+		BenchMarkCrypto<LUCES<OAEP<SHA1> > >("TestData/luc1024.dat", "LUC 1024", t);
+		BenchMarkCrypto<DLIES<> >("TestData/dlie1024.dat", "DLIES 1024", t);
+		BenchMarkCrypto<LUC_IES<> >("TestData/lucc512.dat", "LUCELG 512", t);
+	}
+
+	std::cout << "\n<TBODY style=\"background: yellow;\">";
+	{
+		BenchMarkCrypto<RSAES<OAEP<SHA1> > >("TestData/rsa2048.dat", "RSA 2048", t);
+		BenchMarkCrypto<LUCES<OAEP<SHA1> > >("TestData/luc2048.dat", "LUC 2048", t);
+		BenchMarkCrypto<DLIES<> >("TestData/dlie2048.dat", "DLIES 2048", t);
+		BenchMarkCrypto<LUC_IES<> >("TestData/lucc1024.dat", "LUCELG 1024", t);
+	}
+
+	std::cout << "\n<TBODY style=\"background: white;\">";
+	{
+		BenchMarkSignature<RSASS<PSSR, SHA1> >("TestData/rsa1024.dat", "RSA 1024", t);
+		BenchMarkSignature<RWSS<PSSR, SHA1> >("TestData/rw1024.dat", "RW 1024", t);
+		BenchMarkSignature<LUCSS<PSSR, SHA1> >("TestData/luc1024.dat", "LUC 1024", t);
+		BenchMarkSignature<NR<SHA1> >("TestData/nr1024.dat", "NR 1024", t);
+		BenchMarkSignature<DSA>("TestData/dsa1024.dat", "DSA 1024", t);
+		BenchMarkSignature<LUC_HMP<SHA1> >("TestData/lucs512.dat", "LUC-HMP 512", t);
+		BenchMarkSignature<ESIGN<SHA1> >("TestData/esig1023.dat", "ESIGN 1023", t);
+		BenchMarkSignature<ESIGN<SHA1> >("TestData/esig1536.dat", "ESIGN 1536", t);
+	}
+
+	std::cout << "\n<TBODY style=\"background: yellow;\">";
+	{
+		BenchMarkSignature<RSASS<PSSR, SHA1> >("TestData/rsa2048.dat", "RSA 2048", t);
+		BenchMarkSignature<RWSS<PSSR, SHA1> >("TestData/rw2048.dat", "RW 2048", t);
+		BenchMarkSignature<LUCSS<PSSR, SHA1> >("TestData/luc2048.dat", "LUC 2048", t);
+		BenchMarkSignature<NR<SHA1> >("TestData/nr2048.dat", "NR 2048", t);
+		BenchMarkSignature<LUC_HMP<SHA1> >("TestData/lucs1024.dat", "LUC-HMP 1024", t);
+		BenchMarkSignature<ESIGN<SHA1> >("TestData/esig2046.dat", "ESIGN 2046", t);
+	}
+
+	std::cout << "\n<TBODY style=\"background: white;\">";
+	{
+		BenchMarkKeyAgreement<XTR_DH>("TestData/xtrdh171.dat", "XTR-DH 171", t);
+		BenchMarkKeyAgreement<XTR_DH>("TestData/xtrdh342.dat", "XTR-DH 342", t);
+		BenchMarkKeyAgreement<DH>("TestData/dh1024.dat", "DH 1024", t);
+		BenchMarkKeyAgreement<DH>("TestData/dh2048.dat", "DH 2048", t);
+		BenchMarkKeyAgreement<LUC_DH>("TestData/lucd512.dat", "LUCDIF 512", t);
+		BenchMarkKeyAgreement<LUC_DH>("TestData/lucd1024.dat", "LUCDIF 1024", t);
+		BenchMarkKeyAgreement<MQV>("TestData/mqv1024.dat", "MQV 1024", t);
+		BenchMarkKeyAgreement<MQV>("TestData/mqv2048.dat", "MQV 2048", t);
+	}
+
+	std::cout << "\n</TABLE>" << std::endl;
+}
+
+void BenchmarkEllipticCurveAlgorithms(double t, double hertz)
+{
+	g_allocatedTime = t;
+	g_hertz = hertz;
+
+	const char *mco;
+	if (g_hertz > 1.0f)
+		mco = "<TH>Megacycles/Operation";
+	else
+		mco = "";
+
+	std::cout << "\n<TABLE>";
+	std::cout << "\n<COLGROUP><COL style=\"text-align: left;\"><COL style=";
+	std::cout << "\"text-align: right;\"><COL style=\"text-align: right;\">";
+	std::cout << "\n<THEAD style=\"background: #F0F0F0\">";
+	std::cout << "\n<TR><TH>Operation<TH>Milliseconds/Operation" << mco;
+
+	std::cout << "\n<TBODY style=\"background: white;\">";
+	{
+		ed25519::Signer sign(Test::GlobalRNG());
+		ed25519::Verifier verify(sign);
+		x25519 agree(Test::GlobalRNG());
+
+		BenchMarkSigning("ed25519", sign, t);
+		BenchMarkVerification("ed25519", sign, verify, t);
+		BenchMarkKeyGen("x25519", agree, t);
+		BenchMarkAgreement("x25519", agree, t);
+	}
+
+#if 0
+	std::cout << "\n<TBODY style=\"background: yellow;\">";
+	{
+		BenchMarkKeyAgreement<ECMQV160>("TestData/mqv160.dat", "MQV P-160", t);
+		BenchMarkKeyAgreement<ECMQV256>("TestData/mqv256.dat", "MQV P-256", t);
+		BenchMarkKeyAgreement<ECMQV384>("TestData/mqv384.dat", "MQV P-384", t);
+		BenchMarkKeyAgreement<ECMQV512>("TestData/mqv512.dat", "MQV P-521", t);
+
+		BenchMarkKeyAgreement<ECHMQV160>("TestData/hmqv160.dat", "HMQV P-160", t);
+		BenchMarkKeyAgreement<ECHMQV256>("TestData/hmqv256.dat", "HMQV P-256", t);
+		BenchMarkKeyAgreement<ECHMQV384>("TestData/hmqv384.dat", "HMQV P-384", t);
+		BenchMarkKeyAgreement<ECHMQV512>("TestData/hmqv512.dat", "HMQV P-521", t);
+
+		BenchMarkKeyAgreement<ECFHMQV160>("TestData/fhmqv160.dat", "FHMQV P-160", t);
+		BenchMarkKeyAgreement<ECFHMQV256>("TestData/fhmqv256.dat", "FHMQV P-256", t);
+		BenchMarkKeyAgreement<ECFHMQV384>("TestData/fhmqv384.dat", "FHMQV P-384", t);
+		BenchMarkKeyAgreement<ECFHMQV512>("TestData/fhmqv512.dat", "FHMQV P-521", t);
+	}
+#endif
+
+	std::cout << "\n<TBODY style=\"background: yellow;\">";
+	{
+		ECIES<ECP>::Decryptor cpriv(Test::GlobalRNG(), ASN1::secp256k1());
+		ECIES<ECP>::Encryptor cpub(cpriv);
+		ECDSA<ECP, SHA1>::Signer spriv(cpriv);
+		ECDSA<ECP, SHA1>::Verifier spub(spriv);
+		ECDSA_RFC6979<ECP, SHA1>::Signer spriv2(cpriv);
+		ECDSA_RFC6979<ECP, SHA1>::Verifier spub2(spriv2);
+		ECGDSA<ECP, SHA1>::Signer spriv3(Test::GlobalRNG(), ASN1::secp256k1());
+		ECGDSA<ECP, SHA1>::Verifier spub3(spriv3);
+		ECDH<ECP>::Domain ecdhc(ASN1::secp256k1());
+		ECMQV<ECP>::Domain ecmqvc(ASN1::secp256k1());
+
+		BenchMarkEncryption("ECIES over GF(p) 256", cpub, t);
+		BenchMarkDecryption("ECIES over GF(p) 256", cpriv, cpub, t);
+		BenchMarkSigning("ECDSA over GF(p) 256", spriv, t);
+		BenchMarkVerification("ECDSA over GF(p) 256", spriv, spub, t);
+		BenchMarkSigning("ECDSA-RFC6979 over GF(p) 256", spriv2, t);
+		BenchMarkVerification("ECDSA-RFC6979 over GF(p) 256", spriv2, spub2, t);
+		BenchMarkSigning("ECGDSA over GF(p) 256", spriv3, t);
+		BenchMarkVerification("ECGDSA over GF(p) 256", spriv3, spub3, t);
+		BenchMarkKeyGen("ECDHC over GF(p) 256", ecdhc, t);
+		BenchMarkAgreement("ECDHC over GF(p) 256", ecdhc, t);
+		BenchMarkKeyGen("ECMQVC over GF(p) 256", ecmqvc, t);
+		BenchMarkAgreement("ECMQVC over GF(p) 256", ecmqvc, t);
+	}
+
+	std::cout << "\n<TBODY style=\"background: white;\">";
+	{
+		ECIES<EC2N>::Decryptor cpriv(Test::GlobalRNG(), ASN1::sect233r1());
+		ECIES<EC2N>::Encryptor cpub(cpriv);
+		ECDSA<EC2N, SHA1>::Signer spriv(cpriv);
+		ECDSA<EC2N, SHA1>::Verifier spub(spriv);
+		ECDSA_RFC6979<EC2N, SHA1>::Signer spriv2(cpriv);
+		ECDSA_RFC6979<EC2N, SHA1>::Verifier spub2(spriv2);
+		ECGDSA<EC2N, SHA1>::Signer spriv3(Test::GlobalRNG(), ASN1::sect233r1());
+		ECGDSA<EC2N, SHA1>::Verifier spub3(spriv3);
+		ECDH<EC2N>::Domain ecdhc(ASN1::sect233r1());
+		ECMQV<EC2N>::Domain ecmqvc(ASN1::sect233r1());
+
+		BenchMarkEncryption("ECIES over GF(2^n) 233", cpub, t);
+		BenchMarkDecryption("ECIES over GF(2^n) 233", cpriv, cpub, t);
+		BenchMarkSigning("ECDSA over GF(2^n) 233", spriv, t);
+		BenchMarkVerification("ECDSA over GF(2^n) 233", spriv, spub, t);
+		BenchMarkSigning("ECDSA-RFC6979 over GF(2^n) 233", spriv2, t);
+		BenchMarkVerification("ECDSA-RFC6979 over GF(2^n) 233", spriv2, spub2, t);
+		BenchMarkSigning("ECGDSA over GF(2^n) 233", spriv3, t);
+		BenchMarkVerification("ECGDSA over GF(2^n) 233", spriv3, spub3, t);
+		BenchMarkKeyGen("ECDHC over GF(2^n) 233", ecdhc, t);
+		BenchMarkAgreement("ECDHC over GF(2^n) 233", ecdhc, t);
+		BenchMarkKeyGen("ECMQVC over GF(2^n) 233", ecmqvc, t);
+		BenchMarkAgreement("ECMQVC over GF(2^n) 233", ecmqvc, t);
+	}
+
+	std::cout << "\n</TABLE>" << std::endl;
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/bfinit.cpp b/runtime/third_party/cryptopp/bfinit.cpp
new file mode 100644
index 0000000..714570a
--- /dev/null
+++ b/runtime/third_party/cryptopp/bfinit.cpp
@@ -0,0 +1,277 @@
+#include "pch.h"
+#include "blowfish.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const word32 Blowfish::Base::p_init[Blowfish::ROUNDS+2] =
+{
+  608135816U, 2242054355U,  320440878U,   57701188U,
+ 2752067618U,  698298832U,  137296536U, 3964562569U,
+ 1160258022U,  953160567U, 3193202383U,  887688300U,
+ 3232508343U, 3380367581U, 1065670069U, 3041331479U,
+ 2450970073U, 2306472731U
+} ;
+
+const word32 Blowfish::Base::s_init[4*256] = {
+ 3509652390U, 2564797868U,  805139163U, 3491422135U,
+ 3101798381U, 1780907670U, 3128725573U, 4046225305U,
+  614570311U, 3012652279U,  134345442U, 2240740374U,
+ 1667834072U, 1901547113U, 2757295779U, 4103290238U,
+  227898511U, 1921955416U, 1904987480U, 2182433518U,
+ 2069144605U, 3260701109U, 2620446009U,  720527379U,
+ 3318853667U,  677414384U, 3393288472U, 3101374703U,
+ 2390351024U, 1614419982U, 1822297739U, 2954791486U,
+ 3608508353U, 3174124327U, 2024746970U, 1432378464U,
+ 3864339955U, 2857741204U, 1464375394U, 1676153920U,
+ 1439316330U,  715854006U, 3033291828U,  289532110U,
+ 2706671279U, 2087905683U, 3018724369U, 1668267050U,
+  732546397U, 1947742710U, 3462151702U, 2609353502U,
+ 2950085171U, 1814351708U, 2050118529U,  680887927U,
+  999245976U, 1800124847U, 3300911131U, 1713906067U,
+ 1641548236U, 4213287313U, 1216130144U, 1575780402U,
+ 4018429277U, 3917837745U, 3693486850U, 3949271944U,
+  596196993U, 3549867205U,  258830323U, 2213823033U,
+  772490370U, 2760122372U, 1774776394U, 2652871518U,
+  566650946U, 4142492826U, 1728879713U, 2882767088U,
+ 1783734482U, 3629395816U, 2517608232U, 2874225571U,
+ 1861159788U,  326777828U, 3124490320U, 2130389656U,
+ 2716951837U,  967770486U, 1724537150U, 2185432712U,
+ 2364442137U, 1164943284U, 2105845187U,  998989502U,
+ 3765401048U, 2244026483U, 1075463327U, 1455516326U,
+ 1322494562U,  910128902U,  469688178U, 1117454909U,
+  936433444U, 3490320968U, 3675253459U, 1240580251U,
+  122909385U, 2157517691U,  634681816U, 4142456567U,
+ 3825094682U, 3061402683U, 2540495037U,   79693498U,
+ 3249098678U, 1084186820U, 1583128258U,  426386531U,
+ 1761308591U, 1047286709U,  322548459U,  995290223U,
+ 1845252383U, 2603652396U, 3431023940U, 2942221577U,
+ 3202600964U, 3727903485U, 1712269319U,  422464435U,
+ 3234572375U, 1170764815U, 3523960633U, 3117677531U,
+ 1434042557U,  442511882U, 3600875718U, 1076654713U,
+ 1738483198U, 4213154764U, 2393238008U, 3677496056U,
+ 1014306527U, 4251020053U,  793779912U, 2902807211U,
+  842905082U, 4246964064U, 1395751752U, 1040244610U,
+ 2656851899U, 3396308128U,  445077038U, 3742853595U,
+ 3577915638U,  679411651U, 2892444358U, 2354009459U,
+ 1767581616U, 3150600392U, 3791627101U, 3102740896U,
+  284835224U, 4246832056U, 1258075500U,  768725851U,
+ 2589189241U, 3069724005U, 3532540348U, 1274779536U,
+ 3789419226U, 2764799539U, 1660621633U, 3471099624U,
+ 4011903706U,  913787905U, 3497959166U,  737222580U,
+ 2514213453U, 2928710040U, 3937242737U, 1804850592U,
+ 3499020752U, 2949064160U, 2386320175U, 2390070455U,
+ 2415321851U, 4061277028U, 2290661394U, 2416832540U,
+ 1336762016U, 1754252060U, 3520065937U, 3014181293U,
+  791618072U, 3188594551U, 3933548030U, 2332172193U,
+ 3852520463U, 3043980520U,  413987798U, 3465142937U,
+ 3030929376U, 4245938359U, 2093235073U, 3534596313U,
+  375366246U, 2157278981U, 2479649556U,  555357303U,
+ 3870105701U, 2008414854U, 3344188149U, 4221384143U,
+ 3956125452U, 2067696032U, 3594591187U, 2921233993U,
+	2428461U,  544322398U,  577241275U, 1471733935U,
+  610547355U, 4027169054U, 1432588573U, 1507829418U,
+ 2025931657U, 3646575487U,  545086370U,   48609733U,
+ 2200306550U, 1653985193U,  298326376U, 1316178497U,
+ 3007786442U, 2064951626U,  458293330U, 2589141269U,
+ 3591329599U, 3164325604U,  727753846U, 2179363840U,
+  146436021U, 1461446943U, 4069977195U,  705550613U,
+ 3059967265U, 3887724982U, 4281599278U, 3313849956U,
+ 1404054877U, 2845806497U,  146425753U, 1854211946U,
+
+ 1266315497U, 3048417604U, 3681880366U, 3289982499U,
+ 2909710000U, 1235738493U, 2632868024U, 2414719590U,
+ 3970600049U, 1771706367U, 1449415276U, 3266420449U,
+  422970021U, 1963543593U, 2690192192U, 3826793022U,
+ 1062508698U, 1531092325U, 1804592342U, 2583117782U,
+ 2714934279U, 4024971509U, 1294809318U, 4028980673U,
+ 1289560198U, 2221992742U, 1669523910U,   35572830U,
+  157838143U, 1052438473U, 1016535060U, 1802137761U,
+ 1753167236U, 1386275462U, 3080475397U, 2857371447U,
+ 1040679964U, 2145300060U, 2390574316U, 1461121720U,
+ 2956646967U, 4031777805U, 4028374788U,   33600511U,
+ 2920084762U, 1018524850U,  629373528U, 3691585981U,
+ 3515945977U, 2091462646U, 2486323059U,  586499841U,
+  988145025U,  935516892U, 3367335476U, 2599673255U,
+ 2839830854U,  265290510U, 3972581182U, 2759138881U,
+ 3795373465U, 1005194799U,  847297441U,  406762289U,
+ 1314163512U, 1332590856U, 1866599683U, 4127851711U,
+  750260880U,  613907577U, 1450815602U, 3165620655U,
+ 3734664991U, 3650291728U, 3012275730U, 3704569646U,
+ 1427272223U,  778793252U, 1343938022U, 2676280711U,
+ 2052605720U, 1946737175U, 3164576444U, 3914038668U,
+ 3967478842U, 3682934266U, 1661551462U, 3294938066U,
+ 4011595847U,  840292616U, 3712170807U,  616741398U,
+  312560963U,  711312465U, 1351876610U,  322626781U,
+ 1910503582U,  271666773U, 2175563734U, 1594956187U,
+   70604529U, 3617834859U, 1007753275U, 1495573769U,
+ 4069517037U, 2549218298U, 2663038764U,  504708206U,
+ 2263041392U, 3941167025U, 2249088522U, 1514023603U,
+ 1998579484U, 1312622330U,  694541497U, 2582060303U,
+ 2151582166U, 1382467621U,  776784248U, 2618340202U,
+ 3323268794U, 2497899128U, 2784771155U,  503983604U,
+ 4076293799U,  907881277U,  423175695U,  432175456U,
+ 1378068232U, 4145222326U, 3954048622U, 3938656102U,
+ 3820766613U, 2793130115U, 2977904593U,   26017576U,
+ 3274890735U, 3194772133U, 1700274565U, 1756076034U,
+ 4006520079U, 3677328699U,  720338349U, 1533947780U,
+  354530856U,  688349552U, 3973924725U, 1637815568U,
+  332179504U, 3949051286U,   53804574U, 2852348879U,
+ 3044236432U, 1282449977U, 3583942155U, 3416972820U,
+ 4006381244U, 1617046695U, 2628476075U, 3002303598U,
+ 1686838959U,  431878346U, 2686675385U, 1700445008U,
+ 1080580658U, 1009431731U,  832498133U, 3223435511U,
+ 2605976345U, 2271191193U, 2516031870U, 1648197032U,
+ 4164389018U, 2548247927U,  300782431U,  375919233U,
+  238389289U, 3353747414U, 2531188641U, 2019080857U,
+ 1475708069U,  455242339U, 2609103871U,  448939670U,
+ 3451063019U, 1395535956U, 2413381860U, 1841049896U,
+ 1491858159U,  885456874U, 4264095073U, 4001119347U,
+ 1565136089U, 3898914787U, 1108368660U,  540939232U,
+ 1173283510U, 2745871338U, 3681308437U, 4207628240U,
+ 3343053890U, 4016749493U, 1699691293U, 1103962373U,
+ 3625875870U, 2256883143U, 3830138730U, 1031889488U,
+ 3479347698U, 1535977030U, 4236805024U, 3251091107U,
+ 2132092099U, 1774941330U, 1199868427U, 1452454533U,
+  157007616U, 2904115357U,  342012276U,  595725824U,
+ 1480756522U,  206960106U,  497939518U,  591360097U,
+  863170706U, 2375253569U, 3596610801U, 1814182875U,
+ 2094937945U, 3421402208U, 1082520231U, 3463918190U,
+ 2785509508U,  435703966U, 3908032597U, 1641649973U,
+ 2842273706U, 3305899714U, 1510255612U, 2148256476U,
+ 2655287854U, 3276092548U, 4258621189U,  236887753U,
+ 3681803219U,  274041037U, 1734335097U, 3815195456U,
+ 3317970021U, 1899903192U, 1026095262U, 4050517792U,
+  356393447U, 2410691914U, 3873677099U, 3682840055U,
+
+ 3913112168U, 2491498743U, 4132185628U, 2489919796U,
+ 1091903735U, 1979897079U, 3170134830U, 3567386728U,
+ 3557303409U,  857797738U, 1136121015U, 1342202287U,
+  507115054U, 2535736646U,  337727348U, 3213592640U,
+ 1301675037U, 2528481711U, 1895095763U, 1721773893U,
+ 3216771564U,   62756741U, 2142006736U,  835421444U,
+ 2531993523U, 1442658625U, 3659876326U, 2882144922U,
+  676362277U, 1392781812U,  170690266U, 3921047035U,
+ 1759253602U, 3611846912U, 1745797284U,  664899054U,
+ 1329594018U, 3901205900U, 3045908486U, 2062866102U,
+ 2865634940U, 3543621612U, 3464012697U, 1080764994U,
+  553557557U, 3656615353U, 3996768171U,  991055499U,
+  499776247U, 1265440854U,  648242737U, 3940784050U,
+  980351604U, 3713745714U, 1749149687U, 3396870395U,
+ 4211799374U, 3640570775U, 1161844396U, 3125318951U,
+ 1431517754U,  545492359U, 4268468663U, 3499529547U,
+ 1437099964U, 2702547544U, 3433638243U, 2581715763U,
+ 2787789398U, 1060185593U, 1593081372U, 2418618748U,
+ 4260947970U,   69676912U, 2159744348U,   86519011U,
+ 2512459080U, 3838209314U, 1220612927U, 3339683548U,
+  133810670U, 1090789135U, 1078426020U, 1569222167U,
+  845107691U, 3583754449U, 4072456591U, 1091646820U,
+  628848692U, 1613405280U, 3757631651U,  526609435U,
+  236106946U,   48312990U, 2942717905U, 3402727701U,
+ 1797494240U,  859738849U,  992217954U, 4005476642U,
+ 2243076622U, 3870952857U, 3732016268U,  765654824U,
+ 3490871365U, 2511836413U, 1685915746U, 3888969200U,
+ 1414112111U, 2273134842U, 3281911079U, 4080962846U,
+  172450625U, 2569994100U,  980381355U, 4109958455U,
+ 2819808352U, 2716589560U, 2568741196U, 3681446669U,
+ 3329971472U, 1835478071U,  660984891U, 3704678404U,
+ 4045999559U, 3422617507U, 3040415634U, 1762651403U,
+ 1719377915U, 3470491036U, 2693910283U, 3642056355U,
+ 3138596744U, 1364962596U, 2073328063U, 1983633131U,
+  926494387U, 3423689081U, 2150032023U, 4096667949U,
+ 1749200295U, 3328846651U,  309677260U, 2016342300U,
+ 1779581495U, 3079819751U,  111262694U, 1274766160U,
+  443224088U,  298511866U, 1025883608U, 3806446537U,
+ 1145181785U,  168956806U, 3641502830U, 3584813610U,
+ 1689216846U, 3666258015U, 3200248200U, 1692713982U,
+ 2646376535U, 4042768518U, 1618508792U, 1610833997U,
+ 3523052358U, 4130873264U, 2001055236U, 3610705100U,
+ 2202168115U, 4028541809U, 2961195399U, 1006657119U,
+ 2006996926U, 3186142756U, 1430667929U, 3210227297U,
+ 1314452623U, 4074634658U, 4101304120U, 2273951170U,
+ 1399257539U, 3367210612U, 3027628629U, 1190975929U,
+ 2062231137U, 2333990788U, 2221543033U, 2438960610U,
+ 1181637006U,  548689776U, 2362791313U, 3372408396U,
+ 3104550113U, 3145860560U,  296247880U, 1970579870U,
+ 3078560182U, 3769228297U, 1714227617U, 3291629107U,
+ 3898220290U,  166772364U, 1251581989U,  493813264U,
+  448347421U,  195405023U, 2709975567U,  677966185U,
+ 3703036547U, 1463355134U, 2715995803U, 1338867538U,
+ 1343315457U, 2802222074U, 2684532164U,  233230375U,
+ 2599980071U, 2000651841U, 3277868038U, 1638401717U,
+ 4028070440U, 3237316320U,    6314154U,  819756386U,
+  300326615U,  590932579U, 1405279636U, 3267499572U,
+ 3150704214U, 2428286686U, 3959192993U, 3461946742U,
+ 1862657033U, 1266418056U,  963775037U, 2089974820U,
+ 2263052895U, 1917689273U,  448879540U, 3550394620U,
+ 3981727096U,  150775221U, 3627908307U, 1303187396U,
+  508620638U, 2975983352U, 2726630617U, 1817252668U,
+ 1876281319U, 1457606340U,  908771278U, 3720792119U,
+ 3617206836U, 2455994898U, 1729034894U, 1080033504U,
+
+  976866871U, 3556439503U, 2881648439U, 1522871579U,
+ 1555064734U, 1336096578U, 3548522304U, 2579274686U,
+ 3574697629U, 3205460757U, 3593280638U, 3338716283U,
+ 3079412587U,  564236357U, 2993598910U, 1781952180U,
+ 1464380207U, 3163844217U, 3332601554U, 1699332808U,
+ 1393555694U, 1183702653U, 3581086237U, 1288719814U,
+  691649499U, 2847557200U, 2895455976U, 3193889540U,
+ 2717570544U, 1781354906U, 1676643554U, 2592534050U,
+ 3230253752U, 1126444790U, 2770207658U, 2633158820U,
+ 2210423226U, 2615765581U, 2414155088U, 3127139286U,
+  673620729U, 2805611233U, 1269405062U, 4015350505U,
+ 3341807571U, 4149409754U, 1057255273U, 2012875353U,
+ 2162469141U, 2276492801U, 2601117357U,  993977747U,
+ 3918593370U, 2654263191U,  753973209U,   36408145U,
+ 2530585658U,   25011837U, 3520020182U, 2088578344U,
+  530523599U, 2918365339U, 1524020338U, 1518925132U,
+ 3760827505U, 3759777254U, 1202760957U, 3985898139U,
+ 3906192525U,  674977740U, 4174734889U, 2031300136U,
+ 2019492241U, 3983892565U, 4153806404U, 3822280332U,
+  352677332U, 2297720250U,   60907813U,   90501309U,
+ 3286998549U, 1016092578U, 2535922412U, 2839152426U,
+  457141659U,  509813237U, 4120667899U,  652014361U,
+ 1966332200U, 2975202805U,   55981186U, 2327461051U,
+  676427537U, 3255491064U, 2882294119U, 3433927263U,
+ 1307055953U,  942726286U,  933058658U, 2468411793U,
+ 3933900994U, 4215176142U, 1361170020U, 2001714738U,
+ 2830558078U, 3274259782U, 1222529897U, 1679025792U,
+ 2729314320U, 3714953764U, 1770335741U,  151462246U,
+ 3013232138U, 1682292957U, 1483529935U,  471910574U,
+ 1539241949U,  458788160U, 3436315007U, 1807016891U,
+ 3718408830U,  978976581U, 1043663428U, 3165965781U,
+ 1927990952U, 4200891579U, 2372276910U, 3208408903U,
+ 3533431907U, 1412390302U, 2931980059U, 4132332400U,
+ 1947078029U, 3881505623U, 4168226417U, 2941484381U,
+ 1077988104U, 1320477388U,  886195818U,   18198404U,
+ 3786409000U, 2509781533U,  112762804U, 3463356488U,
+ 1866414978U,  891333506U,   18488651U,  661792760U,
+ 1628790961U, 3885187036U, 3141171499U,  876946877U,
+ 2693282273U, 1372485963U,  791857591U, 2686433993U,
+ 3759982718U, 3167212022U, 3472953795U, 2716379847U,
+  445679433U, 3561995674U, 3504004811U, 3574258232U,
+   54117162U, 3331405415U, 2381918588U, 3769707343U,
+ 4154350007U, 1140177722U, 4074052095U,  668550556U,
+ 3214352940U,  367459370U,  261225585U, 2610173221U,
+ 4209349473U, 3468074219U, 3265815641U,  314222801U,
+ 3066103646U, 3808782860U,  282218597U, 3406013506U,
+ 3773591054U,  379116347U, 1285071038U,  846784868U,
+ 2669647154U, 3771962079U, 3550491691U, 2305946142U,
+  453669953U, 1268987020U, 3317592352U, 3279303384U,
+ 3744833421U, 2610507566U, 3859509063U,  266596637U,
+ 3847019092U,  517658769U, 3462560207U, 3443424879U,
+  370717030U, 4247526661U, 2224018117U, 4143653529U,
+ 4112773975U, 2788324899U, 2477274417U, 1456262402U,
+ 2901442914U, 1517677493U, 1846949527U, 2295493580U,
+ 3734397586U, 2176403920U, 1280348187U, 1908823572U,
+ 3871786941U,  846861322U, 1172426758U, 3287448474U,
+ 3383383037U, 1655181056U, 3139813346U,  901632758U,
+ 1897031941U, 2986607138U, 3066810236U, 3447102507U,
+ 1393639104U,  373351379U,  950779232U,  625454576U,
+ 3124240540U, 4148612726U, 2007998917U,  544563296U,
+ 2244738638U, 2330496472U, 2058025392U, 1291430526U,
+  424198748U,   50039436U,   29584100U, 3605783033U,
+ 2429876329U, 2791104160U, 1057563949U, 3255363231U,
+ 3075367218U, 3463963227U, 1469046755U,  985887462U
+};
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/blake2.cpp b/runtime/third_party/cryptopp/blake2.cpp
new file mode 100644
index 0000000..680d56d
--- /dev/null
+++ b/runtime/third_party/cryptopp/blake2.cpp
@@ -0,0 +1,797 @@
+// blake2.cpp - written and placed in the public domain by Jeffrey Walton
+//              and Zooko Wilcox-O'Hearn. Based on Aumasson, Neves,
+//              Wilcox-O'Hearn and Winnerlein's reference BLAKE2
+//              implementation at http://github.com/BLAKE2/BLAKE2.
+//
+// The BLAKE2b and BLAKE2s numbers are consistent with the BLAKE2 team's
+// numbers. However, we have an Altivec implementation of BLAKE2s,
+// and a POWER8 implementation of BLAKE2b (BLAKE2 team is missing them).
+// Altivec code is about 2x faster than C++ when using GCC 5.0 or
+// above. The POWER8 code is about 2.5x faster than C++ when using GCC 5.0
+// or above. If you use GCC 4.0 (PowerMac) or GCC 4.8 (GCC Compile Farm)
+// then the PowerPC code will be slower than C++. Be sure to use GCC 5.0
+// or above for PowerPC builds or disable Altivec for BLAKE2b and BLAKE2s
+// if using the old compilers.
+
+#include "pch.h"
+#include "config.h"
+#include "cryptlib.h"
+#include "argnames.h"
+#include "algparam.h"
+#include "blake2.h"
+#include "cpu.h"
+
+// Uncomment for benchmarking C++ against SSE2 or NEON.
+// Do so in both blake2.cpp and blake2_simd.cpp.
+// #undef CRYPTOPP_SSE41_AVAILABLE
+// #undef CRYPTOPP_ARM_NEON_AVAILABLE
+// #undef CRYPTOPP_ALTIVEC_AVAILABLE
+// #undef CRYPTOPP_POWER8_AVAILABLE
+
+// Disable NEON/ASIMD for Cortex-A53 and A57. The shifts are too slow and C/C++ is about
+// 3 cpb faster than NEON/ASIMD. Also see http://github.com/weidai11/cryptopp/issues/367.
+#if (defined(__aarch32__) || defined(__aarch64__)) && defined(CRYPTOPP_SLOW_ARMV8_SHIFT)
+# undef CRYPTOPP_ARM_NEON_AVAILABLE
+#endif
+
+// BLAKE2s bug on AIX 7.1 (POWER7) with XLC 12.01
+// https://github.com/weidai11/cryptopp/issues/743
+#if defined(__xlC__) && (__xlC__ < 0x0d01)
+# define CRYPTOPP_DISABLE_ALTIVEC 1
+# undef CRYPTOPP_POWER7_AVAILABLE
+# undef CRYPTOPP_POWER8_AVAILABLE
+# undef CRYPTOPP_ALTIVEC_AVAILABLE
+#endif
+
+// Can't use GetAlignmentOf<word64>() because of C++11 and constexpr
+// Can use 'const unsigned int' because of MSVC 2013
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+# define ALIGN_SPEC32 16
+# define ALIGN_SPEC64 16
+#else
+# define ALIGN_SPEC32 4
+# define ALIGN_SPEC64 8
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Export the tables to the SIMD files
+extern const word32 BLAKE2S_IV[8];
+extern const word64 BLAKE2B_IV[8];
+
+CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
+const word32 BLAKE2S_IV[8] = {
+    0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
+    0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
+};
+
+CRYPTOPP_ALIGN_DATA(ALIGN_SPEC64)
+const word64 BLAKE2B_IV[8] = {
+    W64LIT(0x6a09e667f3bcc908), W64LIT(0xbb67ae8584caa73b),
+    W64LIT(0x3c6ef372fe94f82b), W64LIT(0xa54ff53a5f1d36f1),
+    W64LIT(0x510e527fade682d1), W64LIT(0x9b05688c2b3e6c1f),
+    W64LIT(0x1f83d9abfb41bd6b), W64LIT(0x5be0cd19137e2179)
+};
+
+NAMESPACE_END
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::rotrConstant;
+
+CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
+const byte BLAKE2S_SIGMA[10][16] = {
+    {  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15 },
+    { 14, 10,  4,  8,  9, 15, 13,  6,  1, 12,  0,  2, 11,  7,  5,  3 },
+    { 11,  8, 12,  0,  5,  2, 15, 13, 10, 14,  3,  6,  7,  1,  9,  4 },
+    {  7,  9,  3,  1, 13, 12, 11, 14,  2,  6,  5, 10,  4,  0, 15,  8 },
+    {  9,  0,  5,  7,  2,  4, 10, 15, 14,  1, 11, 12,  6,  8,  3, 13 },
+    {  2, 12,  6, 10,  0, 11,  8,  3,  4, 13,  7,  5, 15, 14,  1,  9 },
+    { 12,  5,  1, 15, 14, 13,  4, 10,  0,  7,  6,  3,  9,  2,  8, 11 },
+    { 13, 11,  7, 14, 12,  1,  3,  9,  5,  0, 15,  4,  8,  6,  2, 10 },
+    {  6, 15, 14,  9, 11,  3,  0,  8, 12,  2, 13,  7,  1,  4, 10,  5 },
+    { 10,  2,  8,  4,  7,  6,  1,  5, 15, 11,  9, 14,  3, 12, 13 , 0 },
+};
+
+CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
+const byte BLAKE2B_SIGMA[12][16] = {
+    {  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15 },
+    { 14, 10,  4,  8,  9, 15, 13,  6,  1, 12,  0,  2, 11,  7,  5,  3 },
+    { 11,  8, 12,  0,  5,  2, 15, 13, 10, 14,  3,  6,  7,  1,  9,  4 },
+    {  7,  9,  3,  1, 13, 12, 11, 14,  2,  6,  5, 10,  4,  0, 15,  8 },
+    {  9,  0,  5,  7,  2,  4, 10, 15, 14,  1, 11, 12,  6,  8,  3, 13 },
+    {  2, 12,  6, 10,  0, 11,  8,  3,  4, 13,  7,  5, 15, 14,  1,  9 },
+    { 12,  5,  1, 15, 14, 13,  4, 10,  0,  7,  6,  3,  9,  2,  8, 11 },
+    { 13, 11,  7, 14, 12,  1,  3,  9,  5,  0, 15,  4,  8,  6,  2, 10 },
+    {  6, 15, 14,  9, 11,  3,  0,  8, 12,  2, 13,  7,  1,  4, 10,  5 },
+    { 10,  2,  8,  4,  7,  6,  1,  5, 15, 11,  9, 14,  3, 12, 13 , 0 },
+    {  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15 },
+    { 14, 10,  4,  8,  9, 15, 13,  6,  1, 12,  0,  2, 11,  7,  5,  3 }
+};
+
+template <unsigned int R, unsigned int N>
+inline void BLAKE2B_G(const word64 m[16], word64& a, word64& b, word64& c, word64& d)
+{
+    a = a + b + m[BLAKE2B_SIGMA[R][2*N+0]];
+    d = rotrConstant<32>(d ^ a);
+    c = c + d;
+    b = rotrConstant<24>(b ^ c);
+    a = a + b + m[BLAKE2B_SIGMA[R][2*N+1]];
+    d = rotrConstant<16>(d ^ a);
+    c = c + d;
+    b = rotrConstant<63>(b ^ c);
+}
+
+template <unsigned int R>
+inline void BLAKE2B_ROUND(const word64 m[16], word64 v[16])
+{
+    BLAKE2B_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
+    BLAKE2B_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
+    BLAKE2B_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
+    BLAKE2B_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
+    BLAKE2B_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
+    BLAKE2B_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
+    BLAKE2B_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
+    BLAKE2B_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
+}
+
+template <unsigned int R, unsigned int N>
+inline void BLAKE2S_G(const word32 m[16], word32& a, word32& b, word32& c, word32& d)
+{
+    a = a + b + m[BLAKE2S_SIGMA[R][2*N+0]];
+    d = rotrConstant<16>(d ^ a);
+    c = c + d;
+    b = rotrConstant<12>(b ^ c);
+    a = a + b + m[BLAKE2S_SIGMA[R][2*N+1]];
+    d = rotrConstant<8>(d ^ a);
+    c = c + d;
+    b = rotrConstant<7>(b ^ c);
+}
+
+template <unsigned int R>
+inline void BLAKE2S_ROUND(const word32 m[16], word32 v[])
+{
+    BLAKE2S_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
+    BLAKE2S_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
+    BLAKE2S_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
+    BLAKE2S_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
+    BLAKE2S_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
+    BLAKE2S_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
+    BLAKE2S_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
+    BLAKE2S_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state);
+void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state);
+
+#if CRYPTOPP_SSE41_AVAILABLE
+extern void BLAKE2_Compress32_SSE4(const byte* input, BLAKE2s_State& state);
+extern void BLAKE2_Compress64_SSE4(const byte* input, BLAKE2b_State& state);
+#endif
+
+#if CRYPTOPP_ARM_NEON_AVAILABLE
+extern void BLAKE2_Compress32_NEON(const byte* input, BLAKE2s_State& state);
+extern void BLAKE2_Compress64_NEON(const byte* input, BLAKE2b_State& state);
+#endif
+
+#if CRYPTOPP_ALTIVEC_AVAILABLE
+extern void BLAKE2_Compress32_ALTIVEC(const byte* input, BLAKE2s_State& state);
+#endif
+
+#if CRYPTOPP_POWER8_AVAILABLE
+extern void BLAKE2_Compress64_POWER8(const byte* input, BLAKE2b_State& state);
+#endif
+
+unsigned int BLAKE2b::OptimalDataAlignment() const
+{
+#if defined(CRYPTOPP_SSE41_AVAILABLE)
+    if (HasSSE41())
+        return 16;  // load __m128i
+    else
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return 8;  // load uint64x2_t
+    else
+#endif
+#if (CRYPTOPP_POWER8_AVAILABLE)
+    if (HasPower8())
+        return 16;  // load vector long long
+    else
+#endif
+    return GetAlignmentOf<word64>();
+}
+
+std::string BLAKE2b::AlgorithmProvider() const
+{
+#if defined(CRYPTOPP_SSE41_AVAILABLE)
+    if (HasSSE41())
+        return "SSE4.1";
+    else
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return "NEON";
+    else
+#endif
+#if (CRYPTOPP_POWER8_AVAILABLE)
+    if (HasPower8())
+        return "Power8";
+    else
+#endif
+    return "C++";
+}
+
+unsigned int BLAKE2s::OptimalDataAlignment() const
+{
+#if defined(CRYPTOPP_SSE41_AVAILABLE)
+    if (HasSSE41())
+        return 16;  // load __m128i
+    else
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return 4;  // load uint32x4_t
+    else
+#endif
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return 16;  // load vector unsigned int
+    else
+#endif
+    return GetAlignmentOf<word32>();
+}
+
+std::string BLAKE2s::AlgorithmProvider() const
+{
+#if defined(CRYPTOPP_SSE41_AVAILABLE)
+    if (HasSSE41())
+        return "SSE4.1";
+    else
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return "NEON";
+    else
+#endif
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return "Altivec";
+    else
+#endif
+    return "C++";
+}
+
+void BLAKE2s_State::Reset()
+{
+    std::memset(m_hft, 0x00, m_hft.SizeInBytes());
+    m_len = 0;
+}
+
+void BLAKE2b_State::Reset()
+{
+    std::memset(m_hft, 0x00, m_hft.SizeInBytes());
+    m_len = 0;
+}
+
+BLAKE2s_ParameterBlock::BLAKE2s_ParameterBlock(size_t digestLen, size_t keyLen,
+        const byte* saltStr, size_t saltLen,
+        const byte* personalizationStr, size_t personalizationLen)
+{
+    Reset(digestLen, keyLen);
+
+    if (saltStr && saltLen)
+        memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
+
+    if (personalizationStr && personalizationLen)
+        memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
+}
+
+BLAKE2b_ParameterBlock::BLAKE2b_ParameterBlock(size_t digestLen, size_t keyLen,
+        const byte* saltStr, size_t saltLen,
+        const byte* personalizationStr, size_t personalizationLen)
+{
+    Reset(digestLen, keyLen);
+
+    if (saltStr && saltLen)
+        memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
+
+    if (personalizationStr && personalizationLen)
+        memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
+}
+
+void BLAKE2s_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
+{
+    std::memset(m_data, 0x00, m_data.size());
+    m_data[DigestOff] = static_cast<byte>(digestLen);
+    m_data[KeyOff] = static_cast<byte>(keyLen);
+    m_data[FanoutOff] = m_data[DepthOff] = 1;
+}
+
+void BLAKE2b_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
+{
+    std::memset(m_data, 0x00, m_data.size());
+    m_data[DigestOff] = static_cast<byte>(digestLen);
+    m_data[KeyOff] = static_cast<byte>(keyLen);
+    m_data[FanoutOff] = m_data[DepthOff] = 1;
+}
+
+BLAKE2s::BLAKE2s(bool treeMode, unsigned int digestSize)
+    : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
+{
+    CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
+
+    UncheckedSetKey(NULLPTR, 0, MakeParameters
+        (Name::DigestSize(), (int)digestSize)
+        (Name::TreeMode(), treeMode));
+}
+
+BLAKE2b::BLAKE2b(bool treeMode, unsigned int digestSize)
+    : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
+{
+    CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
+
+    UncheckedSetKey(NULLPTR, 0, MakeParameters
+        (Name::DigestSize(), (int)digestSize)
+        (Name::TreeMode(), treeMode));
+}
+
+BLAKE2s::BLAKE2s(unsigned int digestSize)
+    : m_digestSize(digestSize), m_keyLength(0), m_treeMode(false)
+{
+    CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
+
+    UncheckedSetKey(NULLPTR, 0, MakeParameters
+        (Name::DigestSize(), (int)digestSize)
+        (Name::TreeMode(), false));
+}
+
+BLAKE2b::BLAKE2b(unsigned int digestSize)
+    : m_digestSize(digestSize), m_keyLength(0), m_treeMode(false)
+{
+    CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
+
+    UncheckedSetKey(NULLPTR, 0, MakeParameters
+        (Name::DigestSize(), (int)digestSize)
+        (Name::TreeMode(), false));
+}
+
+BLAKE2s::BLAKE2s(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
+    const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
+    : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
+{
+    CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
+    CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
+    CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
+    CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
+
+    UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
+        (Name::DigestSize(),(int)digestSize)
+        (Name::TreeMode(),treeMode)
+        (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
+        (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
+}
+
+BLAKE2b::BLAKE2b(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
+    const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
+    : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
+{
+    CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
+    CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
+    CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
+    CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
+
+    UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
+        (Name::DigestSize(),(int)digestSize)
+        (Name::TreeMode(),treeMode)
+        (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
+        (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
+}
+
+void BLAKE2s::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
+{
+    if (key && length)
+    {
+        m_key.New(BLOCKSIZE);
+        std::memcpy(m_key, key, length);
+        std::memset(m_key + length, 0x00, BLOCKSIZE - length);
+        m_keyLength = length;
+    }
+    else
+    {
+        m_key.resize(0);
+        m_keyLength = 0;
+    }
+
+    m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
+                       Name::DigestSize(), static_cast<int>(m_digestSize)));
+
+    m_state.Reset();
+    m_block.Reset(m_digestSize, m_keyLength);
+    (void)params.GetValue(Name::TreeMode(), m_treeMode);
+
+    ConstByteArrayParameter t;
+    if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
+        memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
+
+    if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
+        memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
+
+    Restart();
+}
+
+void BLAKE2b::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
+{
+    if (key && length)
+    {
+        m_key.New(BLOCKSIZE);
+        std::memcpy(m_key, key, length);
+        std::memset(m_key + length, 0x00, BLOCKSIZE - length);
+        m_keyLength = length;
+    }
+    else
+    {
+        m_key.resize(0);
+        m_keyLength = 0;
+    }
+
+    m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
+                       Name::DigestSize(), static_cast<int>(m_digestSize)));
+
+    m_state.Reset();
+    m_block.Reset(m_digestSize, m_keyLength);
+    (void)params.GetValue(Name::TreeMode(), m_treeMode);
+
+    ConstByteArrayParameter t;
+    if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
+        memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
+
+    if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
+        memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
+
+    Restart();
+}
+
+void BLAKE2s::Restart()
+{
+    static const word32 zero[2] = {0,0};
+    Restart(m_block, zero);
+}
+
+void BLAKE2b::Restart()
+{
+    static const word64 zero[2] = {0,0};
+    Restart(m_block, zero);
+}
+
+void BLAKE2s::Restart(const BLAKE2s_ParameterBlock& block, const word32 counter[2])
+{
+    // We take a counter as a parameter to allow customized state.
+    m_state.Reset();
+    if (counter != NULLPTR)
+    {
+        word32* t = m_state.t();
+        t[0] = counter[0];
+        t[1] = counter[1];
+    }
+
+    // We take a parameter block as a parameter to allow customized state.
+    // Avoid the copy of the parameter block when we are passing our own block.
+    if (block.data() != m_block.data()) {
+        std::memcpy(m_block.data(), block.data(), m_block.size());
+    }
+
+    m_block.m_data[BLAKE2s_ParameterBlock::DigestOff] = (byte)m_digestSize;
+    m_block.m_data[BLAKE2s_ParameterBlock::KeyOff] = (byte)m_keyLength;
+
+    const word32* iv = BLAKE2S_IV;
+    PutBlock<word32, LittleEndian, true> put(m_block.data(), m_state.h());
+    put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
+
+    // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
+    // The key is padded to a full Blocksize with 0. Key it during Restart to
+    // avoid FirstPut and friends. Key size == 0 means no key.
+    if (m_keyLength)
+        Update(m_key, BLOCKSIZE);
+}
+
+void BLAKE2b::Restart(const BLAKE2b_ParameterBlock& block, const word64 counter[2])
+{
+    // We take a counter as a parameter to allow customized state.
+    m_state.Reset();
+    if (counter != NULLPTR)
+    {
+        word64* t = m_state.t();
+        t[0] = counter[0];
+        t[1] = counter[1];
+    }
+
+    // We take a parameter block as a parameter to allow customized state.
+    // Avoid the copy of the parameter block when we are passing our own block.
+    if (block.data() != m_block.data()) {
+        std::memcpy(m_block.data(), block.data(), m_block.size());
+    }
+
+    m_block.m_data[BLAKE2b_ParameterBlock::DigestOff] = (byte)m_digestSize;
+    m_block.m_data[BLAKE2b_ParameterBlock::KeyOff] = (byte)m_keyLength;
+
+    const word64* iv = BLAKE2B_IV;
+    PutBlock<word64, LittleEndian, true> put(m_block.data(), m_state.h());
+    put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
+
+    // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
+    // The key is padded to a full Blocksize with 0. Key it during Restart to
+    // avoid FirstPut and friends. Key size == 0 means no key.
+    if (m_keyLength)
+        Update(m_key, BLOCKSIZE);
+}
+
+void BLAKE2s::Update(const byte *input, size_t length)
+{
+    CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
+
+    if (length > BLOCKSIZE - m_state.m_len)
+    {
+        if (m_state.m_len != 0)
+        {
+            // Complete current block
+            const size_t fill = BLOCKSIZE - m_state.m_len;
+            std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
+
+            IncrementCounter(BLOCKSIZE);
+            Compress(m_state.m_buf);
+            m_state.m_len = 0;
+
+            length -= fill, input += fill;
+        }
+
+        // Compress in-place to avoid copies
+        while (length > BLOCKSIZE)
+        {
+            IncrementCounter(BLOCKSIZE);
+            Compress(input);
+            length -= BLOCKSIZE, input += BLOCKSIZE;
+        }
+    }
+
+    // Copy tail bytes
+    if (length)
+    {
+        CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
+        std::memcpy(m_state.m_buf+m_state.m_len, input, length);
+        m_state.m_len += static_cast<unsigned int>(length);
+    }
+}
+
+void BLAKE2b::Update(const byte *input, size_t length)
+{
+    CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
+
+    if (length > BLOCKSIZE - m_state.m_len)
+    {
+        if (m_state.m_len != 0)
+        {
+            // Complete current block
+            const size_t fill = BLOCKSIZE - m_state.m_len;
+            std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
+
+            IncrementCounter(BLOCKSIZE);
+            Compress(m_state.m_buf);
+            m_state.m_len = 0;
+
+            length -= fill, input += fill;
+        }
+
+        // Compress in-place to avoid copies
+        while (length > BLOCKSIZE)
+        {
+            CRYPTOPP_ASSERT(m_state.m_len == 0);
+            IncrementCounter(BLOCKSIZE);
+            Compress(input);
+            length -= BLOCKSIZE, input += BLOCKSIZE;
+        }
+    }
+
+    // Copy tail bytes
+    if (length)
+    {
+        CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
+        std::memcpy(m_state.m_buf + m_state.m_len, input, length);
+        m_state.m_len += static_cast<unsigned int>(length);
+    }
+}
+
+void BLAKE2s::TruncatedFinal(byte *hash, size_t size)
+{
+    CRYPTOPP_ASSERT(hash != NULLPTR);
+    this->ThrowIfInvalidTruncatedSize(size);
+    word32* f = m_state.f();
+
+    // Set last block unconditionally
+    f[0] = ~static_cast<word32>(0);
+
+    // Set last node if tree mode
+    if (m_treeMode)
+        f[1] = ~static_cast<word32>(0);
+
+    // Increment counter for tail bytes only
+    IncrementCounter(m_state.m_len);
+
+    std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
+    Compress(m_state.m_buf);
+
+    // Copy to caller buffer
+    std::memcpy(hash, m_state.h(), size);
+
+    Restart();
+}
+
+void BLAKE2b::TruncatedFinal(byte *hash, size_t size)
+{
+    CRYPTOPP_ASSERT(hash != NULLPTR);
+    this->ThrowIfInvalidTruncatedSize(size);
+    word64* f = m_state.f();
+
+    // Set last block unconditionally
+    f[0] = ~static_cast<word64>(0);
+
+    // Set last node if tree mode
+    if (m_treeMode)
+        f[1] = ~static_cast<word64>(0);
+
+    // Increment counter for tail bytes only
+    IncrementCounter(m_state.m_len);
+
+    std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
+    Compress(m_state.m_buf);
+
+    // Copy to caller buffer
+    std::memcpy(hash, m_state.h(), size);
+
+    Restart();
+}
+
+void BLAKE2s::IncrementCounter(size_t count)
+{
+    word32* t = m_state.t();
+    t[0] += static_cast<word32>(count);
+    t[1] += !!(t[0] < count);
+}
+
+void BLAKE2b::IncrementCounter(size_t count)
+{
+    word64* t = m_state.t();
+    t[0] += static_cast<word64>(count);
+    t[1] += !!(t[0] < count);
+}
+
+void BLAKE2s::Compress(const byte *input)
+{
+#if CRYPTOPP_SSE41_AVAILABLE
+    if(HasSSE41())
+    {
+        return BLAKE2_Compress32_SSE4(input, m_state);
+    }
+#endif
+#if CRYPTOPP_ARM_NEON_AVAILABLE
+    if(HasNEON())
+    {
+        return BLAKE2_Compress32_NEON(input, m_state);
+    }
+#endif
+#if CRYPTOPP_ALTIVEC_AVAILABLE
+    if(HasAltivec())
+    {
+        return BLAKE2_Compress32_ALTIVEC(input, m_state);
+    }
+#endif
+    return BLAKE2_Compress32_CXX(input, m_state);
+}
+
+void BLAKE2b::Compress(const byte *input)
+{
+#if CRYPTOPP_SSE41_AVAILABLE
+    if(HasSSE41())
+    {
+        return BLAKE2_Compress64_SSE4(input, m_state);
+    }
+#endif
+#if CRYPTOPP_ARM_NEON_AVAILABLE
+    if(HasNEON())
+    {
+        return BLAKE2_Compress64_NEON(input, m_state);
+    }
+#endif
+#if CRYPTOPP_POWER8_AVAILABLE
+    if(HasPower8())
+    {
+        return BLAKE2_Compress64_POWER8(input, m_state);
+    }
+#endif
+    return BLAKE2_Compress64_CXX(input, m_state);
+}
+
+void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state)
+{
+    word64 m[16], v[16];
+
+    GetBlock<word64, LittleEndian, true> get1(input);
+    get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
+
+    GetBlock<word64, LittleEndian, true> get2(state.h());
+    get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
+
+    const word64* iv = BLAKE2B_IV;
+    const word64* tf = state.t();
+    v[ 8] = iv[0];
+    v[ 9] = iv[1];
+    v[10] = iv[2];
+    v[11] = iv[3];
+    v[12] = tf[0] ^ iv[4];
+    v[13] = tf[1] ^ iv[5];
+    v[14] = tf[2] ^ iv[6];
+    v[15] = tf[3] ^ iv[7];
+
+    BLAKE2B_ROUND<0>(m, v);
+    BLAKE2B_ROUND<1>(m, v);
+    BLAKE2B_ROUND<2>(m, v);
+    BLAKE2B_ROUND<3>(m, v);
+    BLAKE2B_ROUND<4>(m, v);
+    BLAKE2B_ROUND<5>(m, v);
+    BLAKE2B_ROUND<6>(m, v);
+    BLAKE2B_ROUND<7>(m, v);
+    BLAKE2B_ROUND<8>(m, v);
+    BLAKE2B_ROUND<9>(m, v);
+    BLAKE2B_ROUND<10>(m, v);
+    BLAKE2B_ROUND<11>(m, v);
+
+    word64* h = state.h();
+    for (unsigned int i = 0; i < 8; ++i)
+        h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
+}
+
+void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state)
+{
+    word32 m[16], v[16];
+
+    GetBlock<word32, LittleEndian, true> get1(input);
+    get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
+
+    GetBlock<word32, LittleEndian, true> get2(state.h());
+    get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
+
+    const word32* iv = BLAKE2S_IV;
+    const word32* tf = state.t();
+    v[ 8] = iv[0];
+    v[ 9] = iv[1];
+    v[10] = iv[2];
+    v[11] = iv[3];
+    v[12] = tf[0] ^ iv[4];
+    v[13] = tf[1] ^ iv[5];
+    v[14] = tf[2] ^ iv[6];
+    v[15] = tf[3] ^ iv[7];
+
+    BLAKE2S_ROUND<0>(m, v);
+    BLAKE2S_ROUND<1>(m, v);
+    BLAKE2S_ROUND<2>(m, v);
+    BLAKE2S_ROUND<3>(m, v);
+    BLAKE2S_ROUND<4>(m, v);
+    BLAKE2S_ROUND<5>(m, v);
+    BLAKE2S_ROUND<6>(m, v);
+    BLAKE2S_ROUND<7>(m, v);
+    BLAKE2S_ROUND<8>(m, v);
+    BLAKE2S_ROUND<9>(m, v);
+
+    word32* h = state.h();
+    for (unsigned int i = 0; i < 8; ++i)
+        h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/blake2.h b/runtime/third_party/cryptopp/blake2.h
new file mode 100644
index 0000000..bbbe134
--- /dev/null
+++ b/runtime/third_party/cryptopp/blake2.h
@@ -0,0 +1,444 @@
+// blake2.h - written and placed in the public domain by Jeffrey Walton
+//            and Zooko Wilcox-O'Hearn. Based on Aumasson, Neves,
+//            Wilcox-O'Hearn and Winnerlein's reference BLAKE2
+//            implementation at http://github.com/BLAKE2/BLAKE2.
+
+/// \file blake2.h
+/// \brief Classes for BLAKE2b and BLAKE2s message digests and keyed message digests
+/// \details This implementation follows Aumasson, Neves, Wilcox-O'Hearn and Winnerlein's
+///   <A HREF="http://blake2.net/blake2.pdf">BLAKE2: simpler, smaller, fast as MD5</A> (2013.01.29).
+///   Static algorithm name return either "BLAKE2b" or "BLAKE2s". An object algorithm name follows
+///   the naming described in <A HREF="http://tools.ietf.org/html/rfc7693#section-4">RFC 7693, The
+///   BLAKE2 Cryptographic Hash and Message Authentication Code (MAC)</A>.
+/// \since C++ since Crypto++ 5.6.4, SSE since Crypto++ 5.6.4, NEON since Crypto++ 6.0,
+///   Power8 since Crypto++ 8.0
+
+#ifndef CRYPTOPP_BLAKE2_H
+#define CRYPTOPP_BLAKE2_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "seckey.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief BLAKE2s hash information
+/// \since Crypto++ 5.6.4
+struct BLAKE2s_Info : public VariableKeyLength<32,0,32,1,SimpleKeyingInterface::NOT_RESYNCHRONIZABLE>
+{
+    typedef VariableKeyLength<32,0,32,1,SimpleKeyingInterface::NOT_RESYNCHRONIZABLE> KeyBase;
+    CRYPTOPP_CONSTANT(MIN_KEYLENGTH = KeyBase::MIN_KEYLENGTH);
+    CRYPTOPP_CONSTANT(MAX_KEYLENGTH = KeyBase::MAX_KEYLENGTH);
+    CRYPTOPP_CONSTANT(DEFAULT_KEYLENGTH = KeyBase::DEFAULT_KEYLENGTH);
+
+    CRYPTOPP_CONSTANT(BLOCKSIZE = 64);
+    CRYPTOPP_CONSTANT(DIGESTSIZE = 32);
+    CRYPTOPP_CONSTANT(SALTSIZE = 8);
+    CRYPTOPP_CONSTANT(PERSONALIZATIONSIZE = 8);
+
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "BLAKE2s";}
+};
+
+/// \brief BLAKE2b hash information
+/// \since Crypto++ 5.6.4
+struct BLAKE2b_Info : public VariableKeyLength<64,0,64,1,SimpleKeyingInterface::NOT_RESYNCHRONIZABLE>
+{
+    typedef VariableKeyLength<64,0,64,1,SimpleKeyingInterface::NOT_RESYNCHRONIZABLE> KeyBase;
+    CRYPTOPP_CONSTANT(MIN_KEYLENGTH = KeyBase::MIN_KEYLENGTH);
+    CRYPTOPP_CONSTANT(MAX_KEYLENGTH = KeyBase::MAX_KEYLENGTH);
+    CRYPTOPP_CONSTANT(DEFAULT_KEYLENGTH = KeyBase::DEFAULT_KEYLENGTH);
+
+    CRYPTOPP_CONSTANT(BLOCKSIZE = 128);
+    CRYPTOPP_CONSTANT(DIGESTSIZE = 64);
+    CRYPTOPP_CONSTANT(SALTSIZE = 16);
+    CRYPTOPP_CONSTANT(PERSONALIZATIONSIZE = 16);
+
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "BLAKE2b";}
+};
+
+/// \brief BLAKE2s parameter block
+struct CRYPTOPP_NO_VTABLE BLAKE2s_ParameterBlock
+{
+    CRYPTOPP_CONSTANT(SALTSIZE = BLAKE2s_Info::SALTSIZE);
+    CRYPTOPP_CONSTANT(DIGESTSIZE = BLAKE2s_Info::DIGESTSIZE);
+    CRYPTOPP_CONSTANT(PERSONALIZATIONSIZE = BLAKE2s_Info::PERSONALIZATIONSIZE);
+
+    BLAKE2s_ParameterBlock()
+    {
+        Reset();
+    }
+
+    BLAKE2s_ParameterBlock(size_t digestSize)
+    {
+        Reset(digestSize);
+    }
+
+    BLAKE2s_ParameterBlock(size_t digestSize, size_t keyLength, const byte* salt, size_t saltLength,
+        const byte* personalization, size_t personalizationLength);
+
+    void Reset(size_t digestLength=DIGESTSIZE, size_t keyLength=0);
+
+    byte* data() {
+        return m_data.data();
+    }
+
+    const byte* data() const {
+        return m_data.data();
+    }
+
+    size_t size() const {
+        return m_data.size();
+    }
+
+    byte* salt() {
+        return m_data + SaltOff;
+    }
+
+    byte* personalization() {
+        return m_data + PersonalizationOff;
+    }
+
+    // Offsets into the byte array
+    enum {
+        DigestOff = 0, KeyOff = 1, FanoutOff = 2, DepthOff = 3, LeafOff = 4, NodeOff = 8,
+        NodeDepthOff = 14, InnerOff = 15, SaltOff = 16, PersonalizationOff = 24
+    };
+
+    FixedSizeAlignedSecBlock<byte, 32, true> m_data;
+};
+
+/// \brief BLAKE2b parameter block
+struct CRYPTOPP_NO_VTABLE BLAKE2b_ParameterBlock
+{
+    CRYPTOPP_CONSTANT(SALTSIZE = BLAKE2b_Info::SALTSIZE);
+    CRYPTOPP_CONSTANT(DIGESTSIZE = BLAKE2b_Info::DIGESTSIZE);
+    CRYPTOPP_CONSTANT(PERSONALIZATIONSIZE = BLAKE2b_Info::PERSONALIZATIONSIZE);
+
+    BLAKE2b_ParameterBlock()
+    {
+        Reset();
+    }
+
+    BLAKE2b_ParameterBlock(size_t digestSize)
+    {
+        Reset(digestSize);
+    }
+
+    BLAKE2b_ParameterBlock(size_t digestSize, size_t keyLength, const byte* salt, size_t saltLength,
+        const byte* personalization, size_t personalizationLength);
+
+    void Reset(size_t digestLength=DIGESTSIZE, size_t keyLength=0);
+
+    byte* data() {
+        return m_data.data();
+    }
+
+    const byte* data() const {
+        return m_data.data();
+    }
+
+    size_t size() const {
+        return m_data.size();
+    }
+
+    byte* salt() {
+        return m_data + SaltOff;
+    }
+
+    byte* personalization() {
+        return m_data + PersonalizationOff;
+    }
+
+    // Offsets into the byte array
+    enum {
+        DigestOff = 0, KeyOff = 1, FanoutOff = 2, DepthOff = 3, LeafOff = 4, NodeOff = 8,
+        NodeDepthOff = 16, InnerOff = 17, RfuOff = 18, SaltOff = 32, PersonalizationOff = 48
+    };
+
+    FixedSizeAlignedSecBlock<byte, 64, true> m_data;
+};
+
+/// \brief BLAKE2s state information
+/// \since Crypto++ 5.6.4
+struct CRYPTOPP_NO_VTABLE BLAKE2s_State
+{
+    BLAKE2s_State() {
+        Reset();
+    }
+
+    void Reset();
+
+    inline word32* h() {
+        return m_hft.data();
+    }
+
+    inline word32* t() {
+        return m_hft.data() + 8;
+    }
+
+    inline word32* f() {
+        return m_hft.data() + 10;
+    }
+
+    inline byte* data() {
+        return m_buf.data();
+    }
+
+    // SSE4, Power7 and NEON depend upon t[] and f[] being side-by-side
+    CRYPTOPP_CONSTANT(BLOCKSIZE = BLAKE2s_Info::BLOCKSIZE);
+    FixedSizeAlignedSecBlock<word32, 8+2+2, true> m_hft;
+    FixedSizeAlignedSecBlock<byte, BLOCKSIZE, true> m_buf;
+    size_t m_len;
+};
+
+/// \brief BLAKE2b state information
+/// \since Crypto++ 5.6.4
+struct CRYPTOPP_NO_VTABLE BLAKE2b_State
+{
+    BLAKE2b_State() {
+        Reset();
+    }
+
+    void Reset();
+
+    inline word64* h() {
+        return m_hft.data();
+    }
+
+    inline word64* t() {
+        return m_hft.data() + 8;
+    }
+
+    inline word64* f() {
+        return m_hft.data() + 10;
+    }
+
+    inline byte* data() {
+        return m_buf.data();
+    }
+
+    // SSE4, Power8 and NEON depend upon t[] and f[] being side-by-side
+    CRYPTOPP_CONSTANT(BLOCKSIZE = BLAKE2b_Info::BLOCKSIZE);
+    FixedSizeAlignedSecBlock<word64, 8+2+2, true> m_hft;
+    FixedSizeAlignedSecBlock<byte, BLOCKSIZE, true> m_buf;
+    size_t m_len;
+};
+
+/// \brief The BLAKE2s cryptographic hash function
+/// \details BLAKE2s can function as both a hash and keyed hash. If you want only the hash,
+///   then use the BLAKE2s constructor that accepts no parameters or digest size. If you
+///   want a keyed hash, then use the constructor that accpts the key as a parameter.
+///   Once a key and digest size are selected, its effectively immutable. The Restart()
+///   method that accepts a ParameterBlock does not allow you to change it.
+/// \sa Aumasson, Neves, Wilcox-O'Hearn and Winnerlein's
+///   <A HREF="http://blake2.net/blake2.pdf">BLAKE2: simpler, smaller, fast as MD5</A> (2013.01.29).
+/// \since C++ since Crypto++ 5.6.4, SSE since Crypto++ 5.6.4, NEON since Crypto++ 6.0,
+///   Power8 since Crypto++ 8.0
+class BLAKE2s : public SimpleKeyingInterfaceImpl<MessageAuthenticationCode, BLAKE2s_Info>
+{
+public:
+    CRYPTOPP_CONSTANT(DEFAULT_KEYLENGTH = BLAKE2s_Info::DEFAULT_KEYLENGTH);
+    CRYPTOPP_CONSTANT(MIN_KEYLENGTH = BLAKE2s_Info::MIN_KEYLENGTH);
+    CRYPTOPP_CONSTANT(MAX_KEYLENGTH = BLAKE2s_Info::MAX_KEYLENGTH);
+
+    CRYPTOPP_CONSTANT(DIGESTSIZE = BLAKE2s_Info::DIGESTSIZE);
+    CRYPTOPP_CONSTANT(BLOCKSIZE = BLAKE2s_Info::BLOCKSIZE);
+    CRYPTOPP_CONSTANT(SALTSIZE = BLAKE2s_Info::SALTSIZE);
+    CRYPTOPP_CONSTANT(PERSONALIZATIONSIZE = BLAKE2s_Info::PERSONALIZATIONSIZE);
+
+    typedef BLAKE2s_State State;
+    typedef BLAKE2s_ParameterBlock ParameterBlock;
+
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "BLAKE2s";}
+
+    virtual ~BLAKE2s() {}
+
+    /// \brief Construct a BLAKE2s hash
+    /// \param digestSize the digest size, in bytes
+    /// \param treeMode flag indicating tree mode
+    /// \since Crypto++ 5.6.4
+    BLAKE2s(bool treeMode=false, unsigned int digestSize = DIGESTSIZE);
+
+    /// \brief Construct a BLAKE2s hash
+    /// \param digestSize the digest size, in bytes
+    /// \details treeMode flag is set to false
+    /// \since Crypto++ 8.2
+    BLAKE2s(unsigned int digestSize);
+
+    /// \brief Construct a BLAKE2s hash
+    /// \param key a byte array used to key the cipher
+    /// \param keyLength the size of the byte array
+    /// \param salt a byte array used as salt
+    /// \param saltLength the size of the byte array
+    /// \param personalization a byte array used as personalization string
+    /// \param personalizationLength the size of the byte array
+    /// \param treeMode flag indicating tree mode
+    /// \param digestSize the digest size, in bytes
+    /// \since Crypto++ 5.6.4
+    BLAKE2s(const byte *key, size_t keyLength, const byte* salt = NULLPTR, size_t saltLength = 0,
+        const byte* personalization = NULLPTR, size_t personalizationLength = 0,
+        bool treeMode=false, unsigned int digestSize = DIGESTSIZE);
+
+    /// \brief Retrieve the object's name
+    /// \return the object's algorithm name following RFC 7693
+    /// \details Object algorithm name follows the naming described in
+    ///   <A HREF="http://tools.ietf.org/html/rfc7693#section-4">RFC 7693, The BLAKE2 Cryptographic Hash and
+    /// Message Authentication Code (MAC)</A>. For example, "BLAKE2b-512" and "BLAKE2s-256".
+    std::string AlgorithmName() const {return std::string(BLAKE2s_Info::StaticAlgorithmName()) + "-" + IntToString(DigestSize()*8);}
+
+    unsigned int BlockSize() const {return BLOCKSIZE;}
+    unsigned int DigestSize() const {return m_digestSize;}
+    unsigned int OptimalDataAlignment() const;
+
+    void Update(const byte *input, size_t length);
+    void Restart();
+
+    /// \brief Restart a hash with parameter block and counter
+    /// \param block parameter block
+    /// \param counter counter array
+    /// \details Parameter block is persisted across calls to Restart().
+    void Restart(const BLAKE2s_ParameterBlock& block, const word32 counter[2]);
+
+    /// \brief Set tree mode
+    /// \param mode the new tree mode
+    /// \details BLAKE2 has two finalization flags, called State::f[0] and State::f[1].
+    ///   If <tt>treeMode=false</tt> (default), then State::f[1] is never set. If
+    ///   <tt>treeMode=true</tt>, then State::f[1] is set when State::f[0] is set.
+    ///   Tree mode is persisted across calls to Restart().
+    void SetTreeMode(bool mode) {m_treeMode=mode;}
+
+    /// \brief Get tree mode
+    /// \return the current tree mode
+    /// \details Tree mode is persisted across calls to Restart().
+    bool GetTreeMode() const {return m_treeMode;}
+
+    void TruncatedFinal(byte *hash, size_t size);
+
+    std::string AlgorithmProvider() const;
+
+protected:
+    // Operates on state buffer and/or input. Must be BLOCKSIZE, final block will pad with 0's.
+    void Compress(const byte *input);
+    inline void IncrementCounter(size_t count=BLOCKSIZE);
+
+    void UncheckedSetKey(const byte* key, unsigned int length, const CryptoPP::NameValuePairs& params);
+
+private:
+    State m_state;
+    ParameterBlock m_block;
+    AlignedSecByteBlock m_key;
+    word32 m_digestSize, m_keyLength;
+    bool m_treeMode;
+};
+
+/// \brief The BLAKE2b cryptographic hash function
+/// \details BLAKE2b can function as both a hash and keyed hash. If you want only the hash,
+///   then use the BLAKE2b constructor that accepts no parameters or digest size. If you
+///   want a keyed hash, then use the constructor that accpts the key as a parameter.
+///   Once a key and digest size are selected, its effectively immutable. The Restart()
+///   method that accepts a ParameterBlock does not allow you to change it.
+/// \sa Aumasson, Neves, Wilcox-O'Hearn and Winnerlein's
+///   <A HREF="http://blake2.net/blake2.pdf">BLAKE2: simpler, smaller, fast as MD5</A> (2013.01.29).
+/// \since C++ since Crypto++ 5.6.4, SSE since Crypto++ 5.6.4, NEON since Crypto++ 6.0,
+///   Power8 since Crypto++ 8.0
+class BLAKE2b : public SimpleKeyingInterfaceImpl<MessageAuthenticationCode, BLAKE2b_Info>
+{
+public:
+    CRYPTOPP_CONSTANT(DEFAULT_KEYLENGTH = BLAKE2b_Info::DEFAULT_KEYLENGTH);
+    CRYPTOPP_CONSTANT(MIN_KEYLENGTH = BLAKE2b_Info::MIN_KEYLENGTH);
+    CRYPTOPP_CONSTANT(MAX_KEYLENGTH = BLAKE2b_Info::MAX_KEYLENGTH);
+
+    CRYPTOPP_CONSTANT(DIGESTSIZE = BLAKE2b_Info::DIGESTSIZE);
+    CRYPTOPP_CONSTANT(BLOCKSIZE = BLAKE2b_Info::BLOCKSIZE);
+    CRYPTOPP_CONSTANT(SALTSIZE = BLAKE2b_Info::SALTSIZE);
+    CRYPTOPP_CONSTANT(PERSONALIZATIONSIZE = BLAKE2b_Info::PERSONALIZATIONSIZE);
+
+    typedef BLAKE2b_State State;
+    typedef BLAKE2b_ParameterBlock ParameterBlock;
+
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "BLAKE2b";}
+
+    virtual ~BLAKE2b() {}
+
+    /// \brief Construct a BLAKE2b hash
+    /// \param digestSize the digest size, in bytes
+    /// \param treeMode flag indicating tree mode
+    /// \since Crypto++ 5.6.4
+    BLAKE2b(bool treeMode=false, unsigned int digestSize = DIGESTSIZE);
+
+    /// \brief Construct a BLAKE2s hash
+    /// \param digestSize the digest size, in bytes
+    /// \details treeMode flag is set to false
+    /// \since Crypto++ 8.2
+    BLAKE2b(unsigned int digestSize);
+
+    /// \brief Construct a BLAKE2b hash
+    /// \param key a byte array used to key the cipher
+    /// \param keyLength the size of the byte array
+    /// \param salt a byte array used as salt
+    /// \param saltLength the size of the byte array
+    /// \param personalization a byte array used as personalization string
+    /// \param personalizationLength the size of the byte array
+    /// \param treeMode flag indicating tree mode
+    /// \param digestSize the digest size, in bytes
+    /// \since Crypto++ 5.6.4
+    BLAKE2b(const byte *key, size_t keyLength, const byte* salt = NULLPTR, size_t saltLength = 0,
+        const byte* personalization = NULLPTR, size_t personalizationLength = 0,
+        bool treeMode=false, unsigned int digestSize = DIGESTSIZE);
+
+    /// \brief Retrieve the object's name
+    /// \return the object's algorithm name following RFC 7693
+    /// \details Object algorithm name follows the naming described in
+    ///   <A HREF="http://tools.ietf.org/html/rfc7693#section-4">RFC 7693, The BLAKE2 Cryptographic Hash and
+    /// Message Authentication Code (MAC)</A>. For example, "BLAKE2b-512" and "BLAKE2s-256".
+    std::string AlgorithmName() const {return std::string(BLAKE2b_Info::StaticAlgorithmName()) + "-" + IntToString(DigestSize()*8);}
+
+    unsigned int BlockSize() const {return BLOCKSIZE;}
+    unsigned int DigestSize() const {return m_digestSize;}
+    unsigned int OptimalDataAlignment() const;
+
+    void Update(const byte *input, size_t length);
+    void Restart();
+
+    /// \brief Restart a hash with parameter block and counter
+    /// \param block parameter block
+    /// \param counter counter array
+    /// \details Parameter block is persisted across calls to Restart().
+    void Restart(const BLAKE2b_ParameterBlock& block, const word64 counter[2]);
+
+    /// \brief Set tree mode
+    /// \param mode the new tree mode
+    /// \details BLAKE2 has two finalization flags, called State::f[0] and State::f[1].
+    ///   If <tt>treeMode=false</tt> (default), then State::f[1] is never set. If
+    ///   <tt>treeMode=true</tt>, then State::f[1] is set when State::f[0] is set.
+    ///   Tree mode is persisted across calls to Restart().
+    void SetTreeMode(bool mode) {m_treeMode=mode;}
+
+    /// \brief Get tree mode
+    /// \return the current tree mode
+    /// \details Tree mode is persisted across calls to Restart().
+    bool GetTreeMode() const {return m_treeMode;}
+
+    void TruncatedFinal(byte *hash, size_t size);
+
+    std::string AlgorithmProvider() const;
+
+protected:
+
+    // Operates on state buffer and/or input. Must be BLOCKSIZE, final block will pad with 0's.
+    void Compress(const byte *input);
+    inline void IncrementCounter(size_t count=BLOCKSIZE);
+
+    void UncheckedSetKey(const byte* key, unsigned int length, const CryptoPP::NameValuePairs& params);
+
+private:
+    State m_state;
+    ParameterBlock m_block;
+    AlignedSecByteBlock m_key;
+    word32 m_digestSize, m_keyLength;
+    bool m_treeMode;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/blake2b_simd.cpp b/runtime/third_party/cryptopp/blake2b_simd.cpp
new file mode 100644
index 0000000..77928b8
--- /dev/null
+++ b/runtime/third_party/cryptopp/blake2b_simd.cpp
@@ -0,0 +1,1276 @@
+// blake2_simd.cpp - written and placed in the public domain by
+//                   Samuel Neves, Jeffrey Walton, Uri Blumenthal
+//                   and Marcel Raad.
+//
+//    This source file uses intrinsics to gain access to ARMv7a/ARMv8a
+//    NEON, Power8 and SSE4.1 instructions. A separate source file is
+//    needed because additional CXXFLAGS are required to enable the
+//    appropriate instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+#include "misc.h"
+#include "blake2.h"
+
+// Uncomment for benchmarking C++ against SSE2 or NEON.
+// Do so in both blake2.cpp and blake2_simd.cpp.
+// #undef CRYPTOPP_SSE41_AVAILABLE
+// #undef CRYPTOPP_ARM_NEON_AVAILABLE
+// #undef CRYPTOPP_ALTIVEC_AVAILABLE
+
+// Disable NEON/ASIMD for Cortex-A53 and A57. The shifts are too slow and C/C++ is about
+// 3 cpb faster than NEON/ASIMD. Also see http://github.com/weidai11/cryptopp/issues/367.
+#if (defined(__aarch32__) || defined(__aarch64__)) && defined(CRYPTOPP_SLOW_ARMV8_SHIFT)
+# undef CRYPTOPP_ARM_NEON_AVAILABLE
+#endif
+
+// BLAKE2s bug on AIX 7.1 (POWER7) with XLC 12.01
+// https://github.com/weidai11/cryptopp/issues/743
+#if defined(__xlC__) && (__xlC__ < 0x0d01)
+# define CRYPTOPP_DISABLE_ALTIVEC 1
+# undef CRYPTOPP_POWER8_AVAILABLE
+# undef CRYPTOPP_ALTIVEC_AVAILABLE
+#endif
+
+#if defined(__XOP__)
+# if defined(CRYPTOPP_GCC_COMPATIBLE)
+#  include <x86intrin.h>
+# endif
+# include <ammintrin.h>
+#endif  // XOP
+
+#if (CRYPTOPP_SSE41_AVAILABLE)
+# include <emmintrin.h>
+# include <tmmintrin.h>
+# include <smmintrin.h>
+#endif
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include <arm_neon.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#if (CRYPTOPP_POWER8_AVAILABLE)
+# include "ppc_simd.h"
+#endif
+
+#if defined(CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE)
+/* Ignore "warning: vec_lvsl is deprecated..." */
+# pragma GCC diagnostic ignored "-Wdeprecated"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char BLAKE2B_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Exported by blake2.cpp
+extern const word32 BLAKE2S_IV[8];
+extern const word64 BLAKE2B_IV[8];
+
+#if CRYPTOPP_SSE41_AVAILABLE
+
+#define LOADU(p)  _mm_loadu_si128((const __m128i *)(const void*)(p))
+#define STOREU(p,r) _mm_storeu_si128((__m128i *)(void*)(p), r)
+#define TOF(reg) _mm_castsi128_ps((reg))
+#define TOI(reg) _mm_castps_si128((reg))
+
+void BLAKE2_Compress64_SSE4(const byte* input, BLAKE2b_State& state)
+{
+    #define BLAKE2B_LOAD_MSG_0_1(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m0, m1); \
+    b1 = _mm_unpacklo_epi64(m2, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_0_2(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m0, m1); \
+    b1 = _mm_unpackhi_epi64(m2, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_0_3(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m4, m5); \
+    b1 = _mm_unpacklo_epi64(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_0_4(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m4, m5); \
+    b1 = _mm_unpackhi_epi64(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_1(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m7, m2); \
+    b1 = _mm_unpackhi_epi64(m4, m6); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_2(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m5, m4); \
+    b1 = _mm_alignr_epi8(m3, m7, 8); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_3(b0, b1) \
+    do { \
+    b0 = _mm_shuffle_epi32(m0, _MM_SHUFFLE(1,0,3,2)); \
+    b1 = _mm_unpackhi_epi64(m5, m2); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_4(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m6, m1); \
+    b1 = _mm_unpackhi_epi64(m3, m1); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_1(b0, b1) \
+    do { \
+    b0 = _mm_alignr_epi8(m6, m5, 8); \
+    b1 = _mm_unpackhi_epi64(m2, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_2(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m4, m0); \
+    b1 = _mm_blend_epi16(m1, m6, 0xF0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_3(b0, b1) \
+    do { \
+    b0 = _mm_blend_epi16(m5, m1, 0xF0); \
+    b1 = _mm_unpackhi_epi64(m3, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_4(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m7, m3); \
+    b1 = _mm_alignr_epi8(m2, m0, 8); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_1(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m3, m1); \
+    b1 = _mm_unpackhi_epi64(m6, m5); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_2(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m4, m0); \
+    b1 = _mm_unpacklo_epi64(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_3(b0, b1) \
+    do { \
+    b0 = _mm_blend_epi16(m1, m2, 0xF0); \
+    b1 = _mm_blend_epi16(m2, m7, 0xF0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_4(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m3, m5); \
+    b1 = _mm_unpacklo_epi64(m0, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_1(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m4, m2); \
+    b1 = _mm_unpacklo_epi64(m1, m5); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_2(b0, b1) \
+    do { \
+    b0 = _mm_blend_epi16(m0, m3, 0xF0); \
+    b1 = _mm_blend_epi16(m2, m7, 0xF0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_3(b0, b1) \
+    do { \
+    b0 = _mm_blend_epi16(m7, m5, 0xF0); \
+    b1 = _mm_blend_epi16(m3, m1, 0xF0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_4(b0, b1) \
+    do { \
+    b0 = _mm_alignr_epi8(m6, m0, 8); \
+    b1 = _mm_blend_epi16(m4, m6, 0xF0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_1(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m1, m3); \
+    b1 = _mm_unpacklo_epi64(m0, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_2(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m6, m5); \
+    b1 = _mm_unpackhi_epi64(m5, m1); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_3(b0, b1) \
+    do { \
+    b0 = _mm_blend_epi16(m2, m3, 0xF0); \
+    b1 = _mm_unpackhi_epi64(m7, m0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_4(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m6, m2); \
+    b1 = _mm_blend_epi16(m7, m4, 0xF0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_1(b0, b1) \
+    do { \
+    b0 = _mm_blend_epi16(m6, m0, 0xF0); \
+    b1 = _mm_unpacklo_epi64(m7, m2); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_2(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m2, m7); \
+    b1 = _mm_alignr_epi8(m5, m6, 8); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_3(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m0, m3); \
+    b1 = _mm_shuffle_epi32(m4, _MM_SHUFFLE(1,0,3,2)); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_4(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m3, m1); \
+    b1 = _mm_blend_epi16(m1, m5, 0xF0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_1(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m6, m3); \
+    b1 = _mm_blend_epi16(m6, m1, 0xF0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_2(b0, b1) \
+    do { \
+    b0 = _mm_alignr_epi8(m7, m5, 8); \
+    b1 = _mm_unpackhi_epi64(m0, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_3(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m2, m7); \
+    b1 = _mm_unpacklo_epi64(m4, m1); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_4(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m0, m2); \
+    b1 = _mm_unpacklo_epi64(m3, m5); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_1(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m3, m7); \
+    b1 = _mm_alignr_epi8(m0, m5, 8); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_2(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m7, m4); \
+    b1 = _mm_alignr_epi8(m4, m1, 8); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_3(b0, b1) \
+    do { \
+    b0 = m6; \
+    b1 = _mm_alignr_epi8(m5, m0, 8); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_4(b0, b1) \
+    do { \
+    b0 = _mm_blend_epi16(m1, m3, 0xF0); \
+    b1 = m2; \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_1(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m5, m4); \
+    b1 = _mm_unpackhi_epi64(m3, m0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_2(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m1, m2); \
+    b1 = _mm_blend_epi16(m3, m2, 0xF0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_3(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m7, m4); \
+    b1 = _mm_unpackhi_epi64(m1, m6); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_4(b0, b1) \
+    do { \
+    b0 = _mm_alignr_epi8(m7, m5, 8); \
+    b1 = _mm_unpacklo_epi64(m6, m0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_1(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m0, m1); \
+    b1 = _mm_unpacklo_epi64(m2, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_2(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m0, m1); \
+    b1 = _mm_unpackhi_epi64(m2, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_3(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m4, m5); \
+    b1 = _mm_unpacklo_epi64(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_4(b0, b1) \
+    do { \
+    b0 = _mm_unpackhi_epi64(m4, m5); \
+    b1 = _mm_unpackhi_epi64(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_1(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m7, m2); \
+    b1 = _mm_unpackhi_epi64(m4, m6); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_2(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m5, m4); \
+    b1 = _mm_alignr_epi8(m3, m7, 8); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_3(b0, b1) \
+    do { \
+    b0 = _mm_shuffle_epi32(m0, _MM_SHUFFLE(1,0,3,2)); \
+    b1 = _mm_unpackhi_epi64(m5, m2); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_4(b0, b1) \
+    do { \
+    b0 = _mm_unpacklo_epi64(m6, m1); \
+    b1 = _mm_unpackhi_epi64(m3, m1); \
+    } while(0)
+
+#ifdef __XOP__
+# define MM_ROTI_EPI64(r, c) \
+    _mm_roti_epi64(r, c)
+#else
+# define MM_ROTI_EPI64(x, c) \
+      (-(c) == 32) ? _mm_shuffle_epi32((x), _MM_SHUFFLE(2,3,0,1))  \
+    : (-(c) == 24) ? _mm_shuffle_epi8((x), r24) \
+    : (-(c) == 16) ? _mm_shuffle_epi8((x), r16) \
+    : (-(c) == 63) ? _mm_xor_si128(_mm_srli_epi64((x), -(c)), _mm_add_epi64((x), (x)))  \
+    : _mm_xor_si128(_mm_srli_epi64((x), -(c)), _mm_slli_epi64((x), 64-(-(c))))
+#endif
+
+#define BLAKE2B_G1(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1) \
+    row1l = _mm_add_epi64(_mm_add_epi64(row1l, b0), row2l); \
+    row1h = _mm_add_epi64(_mm_add_epi64(row1h, b1), row2h); \
+    \
+    row4l = _mm_xor_si128(row4l, row1l); \
+    row4h = _mm_xor_si128(row4h, row1h); \
+    \
+    row4l = MM_ROTI_EPI64(row4l, -32); \
+    row4h = MM_ROTI_EPI64(row4h, -32); \
+    \
+    row3l = _mm_add_epi64(row3l, row4l); \
+    row3h = _mm_add_epi64(row3h, row4h); \
+    \
+    row2l = _mm_xor_si128(row2l, row3l); \
+    row2h = _mm_xor_si128(row2h, row3h); \
+    \
+    row2l = MM_ROTI_EPI64(row2l, -24); \
+    row2h = MM_ROTI_EPI64(row2h, -24);
+
+#define BLAKE2B_G2(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1) \
+    row1l = _mm_add_epi64(_mm_add_epi64(row1l, b0), row2l); \
+    row1h = _mm_add_epi64(_mm_add_epi64(row1h, b1), row2h); \
+    \
+    row4l = _mm_xor_si128(row4l, row1l); \
+    row4h = _mm_xor_si128(row4h, row1h); \
+    \
+    row4l = MM_ROTI_EPI64(row4l, -16); \
+    row4h = MM_ROTI_EPI64(row4h, -16); \
+    \
+    row3l = _mm_add_epi64(row3l, row4l); \
+    row3h = _mm_add_epi64(row3h, row4h); \
+    \
+    row2l = _mm_xor_si128(row2l, row3l); \
+    row2h = _mm_xor_si128(row2h, row3h); \
+    \
+    row2l = MM_ROTI_EPI64(row2l, -63); \
+    row2h = MM_ROTI_EPI64(row2h, -63); \
+
+#define BLAKE2B_DIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h) \
+    t0 = row4l;\
+    t1 = row2l;\
+    row4l = row3l;\
+    row3l = row3h;\
+    row3h = row4l;\
+    row4l = _mm_unpackhi_epi64(row4h, _mm_unpacklo_epi64(t0, t0)); \
+    row4h = _mm_unpackhi_epi64(t0, _mm_unpacklo_epi64(row4h, row4h)); \
+    row2l = _mm_unpackhi_epi64(row2l, _mm_unpacklo_epi64(row2h, row2h)); \
+    row2h = _mm_unpackhi_epi64(row2h, _mm_unpacklo_epi64(t1, t1))
+
+#define BLAKE2B_UNDIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h) \
+    t0 = row3l;\
+    row3l = row3h;\
+    row3h = t0;\
+    t0 = row2l;\
+    t1 = row4l;\
+    row2l = _mm_unpackhi_epi64(row2h, _mm_unpacklo_epi64(row2l, row2l)); \
+    row2h = _mm_unpackhi_epi64(t0, _mm_unpacklo_epi64(row2h, row2h)); \
+    row4l = _mm_unpackhi_epi64(row4l, _mm_unpacklo_epi64(row4h, row4h)); \
+    row4h = _mm_unpackhi_epi64(row4h, _mm_unpacklo_epi64(t1, t1))
+
+#define BLAKE2B_ROUND(r) \
+    BLAKE2B_LOAD_MSG_ ##r ##_1(b0, b1); \
+    BLAKE2B_G1(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+    BLAKE2B_LOAD_MSG_ ##r ##_2(b0, b1); \
+    BLAKE2B_G2(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+    BLAKE2B_DIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h); \
+    BLAKE2B_LOAD_MSG_ ##r ##_3(b0, b1); \
+    BLAKE2B_G1(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+    BLAKE2B_LOAD_MSG_ ##r ##_4(b0, b1); \
+    BLAKE2B_G2(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+    BLAKE2B_UNDIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h);
+
+    __m128i row1l, row1h;
+    __m128i row2l, row2h;
+    __m128i row3l, row3h;
+    __m128i row4l, row4h;
+    __m128i b0, b1;
+    __m128i t0, t1;
+
+    const __m128i r16 = _mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9);
+    const __m128i r24 = _mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10);
+
+    const __m128i m0 = LOADU(input + 00);
+    const __m128i m1 = LOADU(input + 16);
+    const __m128i m2 = LOADU(input + 32);
+    const __m128i m3 = LOADU(input + 48);
+    const __m128i m4 = LOADU(input + 64);
+    const __m128i m5 = LOADU(input + 80);
+    const __m128i m6 = LOADU(input + 96);
+    const __m128i m7 = LOADU(input + 112);
+
+    row1l = LOADU(state.h()+0);
+    row1h = LOADU(state.h()+2);
+    row2l = LOADU(state.h()+4);
+    row2h = LOADU(state.h()+6);
+    row3l = LOADU(BLAKE2B_IV+0);
+    row3h = LOADU(BLAKE2B_IV+2);
+    row4l = _mm_xor_si128(LOADU(BLAKE2B_IV+4), LOADU(state.t()+0));
+    row4h = _mm_xor_si128(LOADU(BLAKE2B_IV+6), LOADU(state.f()+0));
+
+    BLAKE2B_ROUND(0);
+    BLAKE2B_ROUND(1);
+    BLAKE2B_ROUND(2);
+    BLAKE2B_ROUND(3);
+    BLAKE2B_ROUND(4);
+    BLAKE2B_ROUND(5);
+    BLAKE2B_ROUND(6);
+    BLAKE2B_ROUND(7);
+    BLAKE2B_ROUND(8);
+    BLAKE2B_ROUND(9);
+    BLAKE2B_ROUND(10);
+    BLAKE2B_ROUND(11);
+
+    row1l = _mm_xor_si128(row3l, row1l);
+    row1h = _mm_xor_si128(row3h, row1h);
+    STOREU(state.h()+0, _mm_xor_si128(LOADU(state.h()+0), row1l));
+    STOREU(state.h()+2, _mm_xor_si128(LOADU(state.h()+2), row1h));
+    row2l = _mm_xor_si128(row4l, row2l);
+    row2h = _mm_xor_si128(row4h, row2h);
+    STOREU(state.h()+4, _mm_xor_si128(LOADU(state.h()+4), row2l));
+    STOREU(state.h()+6, _mm_xor_si128(LOADU(state.h()+6), row2h));
+}
+#endif  // CRYPTOPP_SSE41_AVAILABLE
+
+#if CRYPTOPP_ARM_NEON_AVAILABLE
+void BLAKE2_Compress64_NEON(const byte* input, BLAKE2b_State& state)
+{
+    #define BLAKE2B_LOAD_MSG_0_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m0), vget_low_u64(m1)); b1 = vcombine_u64(vget_low_u64(m2), vget_low_u64(m3)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_0_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m0), vget_high_u64(m1)); b1 = vcombine_u64(vget_high_u64(m2), vget_high_u64(m3)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_0_3(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m4), vget_low_u64(m5)); b1 = vcombine_u64(vget_low_u64(m6), vget_low_u64(m7)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_0_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m4), vget_high_u64(m5)); b1 = vcombine_u64(vget_high_u64(m6), vget_high_u64(m7)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m7), vget_low_u64(m2)); b1 = vcombine_u64(vget_high_u64(m4), vget_high_u64(m6)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m5), vget_low_u64(m4)); b1 = vextq_u64(m7, m3, 1); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_3(b0, b1) \
+    do { b0 = vextq_u64(m0, m0, 1); b1 = vcombine_u64(vget_high_u64(m5), vget_high_u64(m2)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m6), vget_low_u64(m1)); b1 = vcombine_u64(vget_high_u64(m3), vget_high_u64(m1)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_1(b0, b1) \
+    do { b0 = vextq_u64(m5, m6, 1); b1 = vcombine_u64(vget_high_u64(m2), vget_high_u64(m7)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m4), vget_low_u64(m0)); b1 = vcombine_u64(vget_low_u64(m1), vget_high_u64(m6)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_3(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m5), vget_high_u64(m1)); b1 = vcombine_u64(vget_high_u64(m3), vget_high_u64(m4)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m7), vget_low_u64(m3)); b1 = vextq_u64(m0, m2, 1); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m3), vget_high_u64(m1)); b1 = vcombine_u64(vget_high_u64(m6), vget_high_u64(m5)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m4), vget_high_u64(m0)); b1 = vcombine_u64(vget_low_u64(m6), vget_low_u64(m7)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_3(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m1), vget_high_u64(m2)); b1 = vcombine_u64(vget_low_u64(m2), vget_high_u64(m7)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m3), vget_low_u64(m5)); b1 = vcombine_u64(vget_low_u64(m0), vget_low_u64(m4)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m4), vget_high_u64(m2)); b1 = vcombine_u64(vget_low_u64(m1), vget_low_u64(m5)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m0), vget_high_u64(m3)); b1 = vcombine_u64(vget_low_u64(m2), vget_high_u64(m7)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_3(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m7), vget_high_u64(m5)); b1 = vcombine_u64(vget_low_u64(m3), vget_high_u64(m1)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_4(b0, b1) \
+    do { b0 = vextq_u64(m0, m6, 1); b1 = vcombine_u64(vget_low_u64(m4), vget_high_u64(m6)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m1), vget_low_u64(m3)); b1 = vcombine_u64(vget_low_u64(m0), vget_low_u64(m4)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m6), vget_low_u64(m5)); b1 = vcombine_u64(vget_high_u64(m5), vget_high_u64(m1)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_3(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m2), vget_high_u64(m3)); b1 = vcombine_u64(vget_high_u64(m7), vget_high_u64(m0)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m6), vget_high_u64(m2)); b1 = vcombine_u64(vget_low_u64(m7), vget_high_u64(m4)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m6), vget_high_u64(m0)); b1 = vcombine_u64(vget_low_u64(m7), vget_low_u64(m2)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m2), vget_high_u64(m7)); b1 = vextq_u64(m6, m5, 1); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_3(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m0), vget_low_u64(m3)); b1 = vextq_u64(m4, m4, 1); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m3), vget_high_u64(m1)); b1 = vcombine_u64(vget_low_u64(m1), vget_high_u64(m5)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m6), vget_high_u64(m3)); b1 = vcombine_u64(vget_low_u64(m6), vget_high_u64(m1)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_2(b0, b1) \
+    do { b0 = vextq_u64(m5, m7, 1); b1 = vcombine_u64(vget_high_u64(m0), vget_high_u64(m4)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_3(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m2), vget_high_u64(m7)); b1 = vcombine_u64(vget_low_u64(m4), vget_low_u64(m1)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m0), vget_low_u64(m2)); b1 = vcombine_u64(vget_low_u64(m3), vget_low_u64(m5)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m3), vget_low_u64(m7)); b1 = vextq_u64(m5, m0, 1); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m7), vget_high_u64(m4)); b1 = vextq_u64(m1, m4, 1); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_3(b0, b1) \
+    do { b0 = m6; b1 = vextq_u64(m0, m5, 1); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m1), vget_high_u64(m3)); b1 = m2; } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m5), vget_low_u64(m4)); b1 = vcombine_u64(vget_high_u64(m3), vget_high_u64(m0)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m1), vget_low_u64(m2)); b1 = vcombine_u64(vget_low_u64(m3), vget_high_u64(m2)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_3(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m7), vget_high_u64(m4)); b1 = vcombine_u64(vget_high_u64(m1), vget_high_u64(m6)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_4(b0, b1) \
+    do { b0 = vextq_u64(m5, m7, 1); b1 = vcombine_u64(vget_low_u64(m6), vget_low_u64(m0)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m0), vget_low_u64(m1)); b1 = vcombine_u64(vget_low_u64(m2), vget_low_u64(m3)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m0), vget_high_u64(m1)); b1 = vcombine_u64(vget_high_u64(m2), vget_high_u64(m3)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_3(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m4), vget_low_u64(m5)); b1 = vcombine_u64(vget_low_u64(m6), vget_low_u64(m7)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_high_u64(m4), vget_high_u64(m5)); b1 = vcombine_u64(vget_high_u64(m6), vget_high_u64(m7)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_1(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m7), vget_low_u64(m2)); b1 = vcombine_u64(vget_high_u64(m4), vget_high_u64(m6)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_2(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m5), vget_low_u64(m4)); b1 = vextq_u64(m7, m3, 1); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_3(b0, b1) \
+    do { b0 = vextq_u64(m0, m0, 1); b1 = vcombine_u64(vget_high_u64(m5), vget_high_u64(m2)); } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_4(b0, b1) \
+    do { b0 = vcombine_u64(vget_low_u64(m6), vget_low_u64(m1)); b1 = vcombine_u64(vget_high_u64(m3), vget_high_u64(m1)); } while(0)
+
+    #define vrorq_n_u64_32(x) vreinterpretq_u64_u32(vrev64q_u32(vreinterpretq_u32_u64((x))))
+
+    #define vrorq_n_u64_24(x) vcombine_u64( \
+        vreinterpret_u64_u8(vext_u8(vreinterpret_u8_u64(vget_low_u64(x)), vreinterpret_u8_u64(vget_low_u64(x)), 3)), \
+        vreinterpret_u64_u8(vext_u8(vreinterpret_u8_u64(vget_high_u64(x)), vreinterpret_u8_u64(vget_high_u64(x)), 3)))
+
+    #define vrorq_n_u64_16(x) vcombine_u64( \
+        vreinterpret_u64_u8(vext_u8(vreinterpret_u8_u64(vget_low_u64(x)), vreinterpret_u8_u64(vget_low_u64(x)), 2)), \
+        vreinterpret_u64_u8(vext_u8(vreinterpret_u8_u64(vget_high_u64(x)), vreinterpret_u8_u64(vget_high_u64(x)), 2)))
+
+    #define vrorq_n_u64_63(x) veorq_u64(vaddq_u64(x, x), vshrq_n_u64(x, 63))
+
+    #define BLAKE2B_G1(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1) \
+    do { \
+      row1l = vaddq_u64(vaddq_u64(row1l, b0), row2l); \
+      row1h = vaddq_u64(vaddq_u64(row1h, b1), row2h); \
+      row4l = veorq_u64(row4l, row1l); row4h = veorq_u64(row4h, row1h); \
+      row4l = vrorq_n_u64_32(row4l); row4h = vrorq_n_u64_32(row4h); \
+      row3l = vaddq_u64(row3l, row4l); row3h = vaddq_u64(row3h, row4h); \
+      row2l = veorq_u64(row2l, row3l); row2h = veorq_u64(row2h, row3h); \
+      row2l = vrorq_n_u64_24(row2l); row2h = vrorq_n_u64_24(row2h); \
+    } while(0)
+
+    #define BLAKE2B_G2(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1) \
+    do { \
+      row1l = vaddq_u64(vaddq_u64(row1l, b0), row2l); \
+      row1h = vaddq_u64(vaddq_u64(row1h, b1), row2h); \
+      row4l = veorq_u64(row4l, row1l); row4h = veorq_u64(row4h, row1h); \
+      row4l = vrorq_n_u64_16(row4l); row4h = vrorq_n_u64_16(row4h); \
+      row3l = vaddq_u64(row3l, row4l); row3h = vaddq_u64(row3h, row4h); \
+      row2l = veorq_u64(row2l, row3l); row2h = veorq_u64(row2h, row3h); \
+      row2l = vrorq_n_u64_63(row2l); row2h = vrorq_n_u64_63(row2h); \
+    } while(0)
+
+    #define BLAKE2B_DIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h) \
+    do { \
+      uint64x2_t t0 = vextq_u64(row2l, row2h, 1); \
+      uint64x2_t t1 = vextq_u64(row2h, row2l, 1); \
+      row2l = t0; row2h = t1; t0 = row3l;  row3l = row3h; row3h = t0; \
+      t0 = vextq_u64(row4h, row4l, 1); t1 = vextq_u64(row4l, row4h, 1); \
+      row4l = t0; row4h = t1; \
+    } while(0)
+
+    #define BLAKE2B_UNDIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h) \
+    do { \
+      uint64x2_t t0 = vextq_u64(row2h, row2l, 1); \
+      uint64x2_t t1 = vextq_u64(row2l, row2h, 1); \
+      row2l = t0; row2h = t1; t0 = row3l; row3l = row3h; row3h = t0; \
+      t0 = vextq_u64(row4l, row4h, 1); t1 = vextq_u64(row4h, row4l, 1); \
+      row4l = t0; row4h = t1; \
+    } while(0)
+
+    #define BLAKE2B_ROUND(r) \
+    do { \
+      uint64x2_t b0, b1; \
+      BLAKE2B_LOAD_MSG_ ##r ##_1(b0, b1); \
+      BLAKE2B_G1(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+      BLAKE2B_LOAD_MSG_ ##r ##_2(b0, b1); \
+      BLAKE2B_G2(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+      BLAKE2B_DIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h); \
+      BLAKE2B_LOAD_MSG_ ##r ##_3(b0, b1); \
+      BLAKE2B_G1(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+      BLAKE2B_LOAD_MSG_ ##r ##_4(b0, b1); \
+      BLAKE2B_G2(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+      BLAKE2B_UNDIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h); \
+    } while(0)
+
+    const uint64x2_t m0 = vreinterpretq_u64_u8(vld1q_u8(input +  00));
+    const uint64x2_t m1 = vreinterpretq_u64_u8(vld1q_u8(input +  16));
+    const uint64x2_t m2 = vreinterpretq_u64_u8(vld1q_u8(input +  32));
+    const uint64x2_t m3 = vreinterpretq_u64_u8(vld1q_u8(input +  48));
+    const uint64x2_t m4 = vreinterpretq_u64_u8(vld1q_u8(input +  64));
+    const uint64x2_t m5 = vreinterpretq_u64_u8(vld1q_u8(input +  80));
+    const uint64x2_t m6 = vreinterpretq_u64_u8(vld1q_u8(input +  96));
+    const uint64x2_t m7 = vreinterpretq_u64_u8(vld1q_u8(input + 112));
+
+    uint64x2_t row1l, row1h, row2l, row2h;
+    uint64x2_t row3l, row3h, row4l, row4h;
+
+    const uint64x2_t h0 = row1l = vld1q_u64(state.h()+0);
+    const uint64x2_t h1 = row1h = vld1q_u64(state.h()+2);
+    const uint64x2_t h2 = row2l = vld1q_u64(state.h()+4);
+    const uint64x2_t h3 = row2h = vld1q_u64(state.h()+6);
+
+    row3l = vld1q_u64(BLAKE2B_IV+0);
+    row3h = vld1q_u64(BLAKE2B_IV+2);
+    row4l = veorq_u64(vld1q_u64(BLAKE2B_IV+4), vld1q_u64(state.t()+0));
+    row4h = veorq_u64(vld1q_u64(BLAKE2B_IV+6), vld1q_u64(state.f()+0));
+
+    BLAKE2B_ROUND(0);
+    BLAKE2B_ROUND(1);
+    BLAKE2B_ROUND(2);
+    BLAKE2B_ROUND(3);
+    BLAKE2B_ROUND(4);
+    BLAKE2B_ROUND(5);
+    BLAKE2B_ROUND(6);
+    BLAKE2B_ROUND(7);
+    BLAKE2B_ROUND(8);
+    BLAKE2B_ROUND(9);
+    BLAKE2B_ROUND(10);
+    BLAKE2B_ROUND(11);
+
+    vst1q_u64(state.h()+0, veorq_u64(h0, veorq_u64(row1l, row3l)));
+    vst1q_u64(state.h()+2, veorq_u64(h1, veorq_u64(row1h, row3h)));
+    vst1q_u64(state.h()+4, veorq_u64(h2, veorq_u64(row2l, row4l)));
+    vst1q_u64(state.h()+6, veorq_u64(h3, veorq_u64(row2h, row4h)));
+}
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+#if (CRYPTOPP_POWER8_AVAILABLE)
+
+inline uint64x2_p VecLoad64(const void* p)
+{
+    return (uint64x2_p)vec_xl(0, CONST_V32_CAST(p));
+}
+
+inline uint64x2_p VecLoad64LE(const void* p, const uint8x16_p le_mask)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    const uint32x4_p v = vec_xl(0, CONST_V32_CAST(p));
+    return (uint64x2_p)VecPermute(v, v, le_mask);
+#else
+    CRYPTOPP_UNUSED(le_mask);
+    return (uint64x2_p)vec_xl(0, CONST_V32_CAST(p));
+#endif
+}
+
+inline void VecStore64(void* p, const uint64x2_p x)
+{
+    vec_xst((uint32x4_p)x, 0, NCONST_V32_CAST(p));
+}
+
+inline void VecStore64LE(void* p, const uint64x2_p x, const uint8x16_p le_mask)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    const uint64x2_p v = VecPermute(x, x, le_mask);
+    vec_xst((uint32x4_p)v, 0, NCONST_V32_CAST(p));
+#else
+    CRYPTOPP_UNUSED(le_mask);
+    vec_xst((uint32x4_p)x, 0, NCONST_V32_CAST(p));
+#endif
+}
+
+#if defined(CRYPTOPP_BIG_ENDIAN)
+#define vec_shl_8(a,b) (uint64x2_p)vec_sld((uint8x16_p)a,(uint8x16_p)b,8)
+#else
+#define vec_shl_8(a,b) (uint64x2_p)vec_sld((uint8x16_p)b,(uint8x16_p)a,8)
+#endif
+
+#define vec_merge_hi(a, b) vec_mergeh(a,b)
+#define vec_merge_hi_lo(a, b) vec_mergeh(a,(uint64x2_p)vec_sld((uint8x16_p)b,(uint8x16_p)b,8))
+#define vec_merge_lo(a, b) vec_mergel(a,b)
+
+void BLAKE2_Compress64_POWER8(const byte* input, BLAKE2b_State& state)
+{
+    #define BLAKE2B_LOAD_MSG_0_1(b0, b1) \
+    do { \
+         b0 = vec_merge_hi(m0, m1); \
+         b1 = vec_merge_hi(m2, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_0_2(b0, b1) \
+    do { \
+         b0 = vec_merge_lo(m0, m1); \
+         b1 = vec_merge_lo(m2, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_0_3(b0, b1) \
+    do { \
+         b0 = vec_merge_hi(m4, m5); \
+         b1 = vec_merge_hi(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_0_4(b0, b1) \
+    do { \
+         b0 = vec_merge_lo(m4, m5); \
+         b1 = vec_merge_lo(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_1(b0, b1) \
+    do { \
+         b0 = vec_merge_hi(m7, m2); \
+         b1 = vec_merge_lo(m4, m6); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_2(b0, b1) \
+    do { \
+         b0 = vec_merge_hi(m5, m4); \
+         b1 = vec_shl_8(m7, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_3(b0, b1) \
+    do { \
+         b0 = vec_shl_8(m0, m0); \
+         b1 = vec_merge_lo(m5, m2); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_1_4(b0, b1) \
+    do { \
+         b0 = vec_merge_hi(m6, m1); \
+         b1 = vec_merge_lo(m3, m1); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_1(b0, b1) \
+    do { \
+         b0 = vec_shl_8(m5, m6); \
+         b1 = vec_merge_lo(m2, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_2(b0, b1) \
+    do { \
+         b0 = vec_merge_hi(m4, m0); \
+         b1 = vec_merge_hi_lo(m1, m6); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_3(b0, b1) \
+       do { \
+         b0 = vec_merge_hi_lo(m5, m1); \
+         b1 = vec_merge_lo(m3, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_2_4(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m7, m3); \
+         b1 = vec_shl_8(m0, m2); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_1(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m3, m1); \
+         b1 = vec_merge_lo(m6, m5); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_2(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m4, m0); \
+         b1 = vec_merge_hi(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_3(b0, b1) \
+       do { \
+         b0 = vec_merge_hi_lo(m1, m2); \
+         b1 = vec_merge_hi_lo(m2, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_3_4(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m3, m5); \
+         b1 = vec_merge_hi(m0, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_1(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m4, m2); \
+         b1 = vec_merge_hi(m1, m5); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_2(b0, b1) \
+       do { \
+         b0 = vec_merge_hi_lo(m0, m3); \
+         b1 = vec_merge_hi_lo(m2, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_3(b0, b1) \
+       do { \
+         b0 = vec_merge_hi_lo(m7, m5); \
+         b1 = vec_merge_hi_lo(m3, m1); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_4_4(b0, b1) \
+       do { \
+         b0 = vec_shl_8(m0, m6); \
+         b1 = vec_merge_hi_lo(m4, m6); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_1(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m1, m3); \
+         b1 = vec_merge_hi(m0, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_2(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m6, m5); \
+         b1 = vec_merge_lo(m5, m1); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_3(b0, b1) \
+       do { \
+         b0 = vec_merge_hi_lo(m2, m3); \
+         b1 = vec_merge_lo(m7, m0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_5_4(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m6, m2); \
+         b1 = vec_merge_hi_lo(m7, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_1(b0, b1) \
+       do { \
+         b0 = vec_merge_hi_lo(m6, m0); \
+         b1 = vec_merge_hi(m7, m2); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_2(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m2, m7); \
+         b1 = vec_shl_8(m6, m5); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_3(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m0, m3); \
+         b1 = vec_shl_8(m4, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_6_4(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m3, m1); \
+         b1 = vec_merge_hi_lo(m1, m5); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_1(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m6, m3); \
+         b1 = vec_merge_hi_lo(m6, m1); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_2(b0, b1) \
+       do { \
+         b0 = vec_shl_8(m5, m7); \
+         b1 = vec_merge_lo(m0, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_3(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m2, m7); \
+         b1 = vec_merge_hi(m4, m1); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_7_4(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m0, m2); \
+         b1 = vec_merge_hi(m3, m5); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_1(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m3, m7); \
+         b1 = vec_shl_8(m5, m0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_2(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m7, m4); \
+         b1 = vec_shl_8(m1, m4); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_3(b0, b1) \
+       do { \
+         b0 = m6; \
+         b1 = vec_shl_8(m0, m5); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_8_4(b0, b1) \
+       do { \
+         b0 = vec_merge_hi_lo(m1, m3); \
+         b1 = m2; \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_1(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m5, m4); \
+         b1 = vec_merge_lo(m3, m0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_2(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m1, m2); \
+         b1 = vec_merge_hi_lo(m3, m2); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_3(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m7, m4); \
+         b1 = vec_merge_lo(m1, m6); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_9_4(b0, b1) \
+       do { \
+         b0 = vec_shl_8(m5, m7); \
+         b1 = vec_merge_hi(m6, m0); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_1(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m0, m1); \
+         b1 = vec_merge_hi(m2, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_2(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m0, m1); \
+         b1 = vec_merge_lo(m2, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_3(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m4, m5); \
+         b1 = vec_merge_hi(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_10_4(b0, b1) \
+       do { \
+         b0 = vec_merge_lo(m4, m5); \
+         b1 = vec_merge_lo(m6, m7); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_1(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m7, m2); \
+         b1 = vec_merge_lo(m4, m6); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_2(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m5, m4); \
+         b1 = vec_shl_8(m7, m3); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_3(b0, b1) \
+       do { \
+         b0 = vec_shl_8(m0, m0); \
+         b1 = vec_merge_lo(m5, m2); \
+    } while(0)
+
+    #define BLAKE2B_LOAD_MSG_11_4(b0, b1) \
+       do { \
+         b0 = vec_merge_hi(m6, m1); \
+         b1 = vec_merge_lo(m3, m1); \
+    } while(0)
+
+    // Power8 has packed 64-bit rotate, but in terms of left rotate
+    const uint64x2_p ROR16_MASK = { 64-16, 64-16 };
+    const uint64x2_p ROR24_MASK = { 64-24, 64-24 };
+    const uint64x2_p ROR32_MASK = { 64-32, 64-32 };
+    const uint64x2_p ROR63_MASK = { 64-63, 64-63 };
+
+    #define vec_ror_32(x) vec_rl(x, ROR32_MASK)
+    #define vec_ror_24(x) vec_rl(x, ROR24_MASK)
+    #define vec_ror_16(x) vec_rl(x, ROR16_MASK)
+    #define vec_ror_63(x) vec_rl(x, ROR63_MASK)
+
+    #define BLAKE2B_G1(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1) \
+    do { \
+      row1l = VecAdd(VecAdd(row1l, b0), row2l); \
+      row1h = VecAdd(VecAdd(row1h, b1), row2h); \
+      row4l = VecXor(row4l, row1l); row4h = VecXor(row4h, row1h); \
+      row4l = vec_ror_32(row4l); row4h = vec_ror_32(row4h); \
+      row3l = VecAdd(row3l, row4l); row3h = VecAdd(row3h, row4h); \
+      row2l = VecXor(row2l, row3l); row2h = VecXor(row2h, row3h); \
+      row2l = vec_ror_24(row2l); row2h = vec_ror_24(row2h); \
+    } while(0)
+
+    #define BLAKE2B_G2(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1) \
+    do { \
+      row1l = VecAdd(VecAdd(row1l, b0), row2l); \
+      row1h = VecAdd(VecAdd(row1h, b1), row2h); \
+      row4l = VecXor(row4l, row1l); row4h = VecXor(row4h, row1h); \
+      row4l = vec_ror_16(row4l); row4h = vec_ror_16(row4h); \
+      row3l = VecAdd(row3l, row4l); row3h = VecAdd(row3h, row4h); \
+      row2l = VecXor(row2l, row3l); row2h = VecXor(row2h, row3h); \
+      row2l = vec_ror_63(row2l); row2h = vec_ror_63(row2h); \
+    } while(0)
+
+    #define BLAKE2B_DIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h) \
+    do { \
+      uint64x2_p t0 = vec_shl_8(row2l, row2h); \
+      uint64x2_p t1 = vec_shl_8(row2h, row2l); \
+      row2l = t0; row2h = t1; t0 = row3l;  row3l = row3h; row3h = t0; \
+      t0 = vec_shl_8(row4h, row4l); t1 = vec_shl_8(row4l, row4h); \
+      row4l = t0; row4h = t1; \
+    } while(0)
+
+    #define BLAKE2B_UNDIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h) \
+    do { \
+      uint64x2_p t0 = vec_shl_8(row2h, row2l); \
+      uint64x2_p t1 = vec_shl_8(row2l, row2h); \
+      row2l = t0; row2h = t1; t0 = row3l; row3l = row3h; row3h = t0; \
+      t0 = vec_shl_8(row4l, row4h); t1 = vec_shl_8(row4h, row4l); \
+      row4l = t0; row4h = t1; \
+    } while(0)
+
+    #define BLAKE2B_ROUND(r) \
+    do { \
+      uint64x2_p b0, b1; \
+      BLAKE2B_LOAD_MSG_ ##r ##_1(b0, b1); \
+      BLAKE2B_G1(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+      BLAKE2B_LOAD_MSG_ ##r ##_2(b0, b1); \
+      BLAKE2B_G2(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+      BLAKE2B_DIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h); \
+      BLAKE2B_LOAD_MSG_ ##r ##_3(b0, b1); \
+      BLAKE2B_G1(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+      BLAKE2B_LOAD_MSG_ ##r ##_4(b0, b1); \
+      BLAKE2B_G2(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h,b0,b1); \
+      BLAKE2B_UNDIAGONALIZE(row1l,row2l,row3l,row4l,row1h,row2h,row3h,row4h); \
+    } while(0)
+
+    // Possibly unaligned user messages
+    uint64x2_p m0, m1, m2, m3, m4, m5, m6, m7;
+    // Endian conversion mask
+    const uint8x16_p le_mask = {7,6,5,4, 3,2,1,0, 15,14,13,12, 11,10,9,8};
+
+#if defined(_ARCH_PWR9)
+    // POWER9 provides loads for char's and short's
+    m0 = (uint64x2_p) vec_xl(  0, CONST_V8_CAST( input ));
+    m1 = (uint64x2_p) vec_xl( 16, CONST_V8_CAST( input ));
+    m2 = (uint64x2_p) vec_xl( 32, CONST_V8_CAST( input ));
+    m3 = (uint64x2_p) vec_xl( 48, CONST_V8_CAST( input ));
+    m4 = (uint64x2_p) vec_xl( 64, CONST_V8_CAST( input ));
+    m5 = (uint64x2_p) vec_xl( 80, CONST_V8_CAST( input ));
+    m6 = (uint64x2_p) vec_xl( 96, CONST_V8_CAST( input ));
+    m7 = (uint64x2_p) vec_xl(112, CONST_V8_CAST( input ));
+
+# if defined(CRYPTOPP_BIG_ENDIAN)
+    m0 = vec_perm(m0, m0, le_mask);
+    m1 = vec_perm(m1, m1, le_mask);
+    m2 = vec_perm(m2, m2, le_mask);
+    m3 = vec_perm(m3, m3, le_mask);
+    m4 = vec_perm(m4, m4, le_mask);
+    m5 = vec_perm(m5, m5, le_mask);
+    m6 = vec_perm(m6, m6, le_mask);
+    m7 = vec_perm(m7, m7, le_mask);
+# endif
+#else
+    // Altivec only provides 16-byte aligned loads
+    // http://www.nxp.com/docs/en/reference-manual/ALTIVECPEM.pdf
+    m0 = (uint64x2_p) vec_ld(  0, CONST_V8_CAST( input ));
+    m1 = (uint64x2_p) vec_ld( 16, CONST_V8_CAST( input ));
+    m2 = (uint64x2_p) vec_ld( 32, CONST_V8_CAST( input ));
+    m3 = (uint64x2_p) vec_ld( 48, CONST_V8_CAST( input ));
+    m4 = (uint64x2_p) vec_ld( 64, CONST_V8_CAST( input ));
+    m5 = (uint64x2_p) vec_ld( 80, CONST_V8_CAST( input ));
+    m6 = (uint64x2_p) vec_ld( 96, CONST_V8_CAST( input ));
+    m7 = (uint64x2_p) vec_ld(112, CONST_V8_CAST( input ));
+
+    // Alignment check for load of the message buffer
+    const uintptr_t addr = (uintptr_t)input;
+    if (addr%16 == 0)
+    {
+        // Already aligned. Perform a little-endian swap as required
+# if defined(CRYPTOPP_BIG_ENDIAN)
+        m0 = vec_perm(m0, m0, le_mask);
+        m1 = vec_perm(m1, m1, le_mask);
+        m2 = vec_perm(m2, m2, le_mask);
+        m3 = vec_perm(m3, m3, le_mask);
+        m4 = vec_perm(m4, m4, le_mask);
+        m5 = vec_perm(m5, m5, le_mask);
+        m6 = vec_perm(m6, m6, le_mask);
+        m7 = vec_perm(m7, m7, le_mask);
+# endif
+    }
+    else
+    {
+        // Not aligned. Fix vectors and perform a little-endian swap as required
+        // http://mirror.informatimago.com/next/developer.apple.com/
+        //        hardwaredrivers/ve/code_optimization.html
+        uint64x2_p ex; uint8x16_p perm;
+        ex = (uint64x2_p) vec_ld(112+15, CONST_V8_CAST( input ));
+        perm = vec_lvsl(0, CONST_V8_CAST( addr ));
+
+# if defined(CRYPTOPP_BIG_ENDIAN)
+        // Combine the vector permute with the little-endian swap
+        perm = vec_perm(perm, perm, le_mask);
+# endif
+
+        m0 = vec_perm(m0, m1, perm);
+        m1 = vec_perm(m1, m2, perm);
+        m2 = vec_perm(m2, m3, perm);
+        m3 = vec_perm(m3, m4, perm);
+        m4 = vec_perm(m4, m5, perm);
+        m5 = vec_perm(m5, m6, perm);
+        m6 = vec_perm(m6, m7, perm);
+        m7 = vec_perm(m7, ex, perm);
+    }
+#endif
+
+    uint64x2_p row1l, row1h, row2l, row2h;
+    uint64x2_p row3l, row3h, row4l, row4h;
+
+    const uint64x2_p h0 = row1l = VecLoad64LE(state.h()+0, le_mask);
+    const uint64x2_p h1 = row1h = VecLoad64LE(state.h()+2, le_mask);
+    const uint64x2_p h2 = row2l = VecLoad64LE(state.h()+4, le_mask);
+    const uint64x2_p h3 = row2h = VecLoad64LE(state.h()+6, le_mask);
+
+    row3l = VecLoad64(BLAKE2B_IV+0);
+    row3h = VecLoad64(BLAKE2B_IV+2);
+    row4l = VecXor(VecLoad64(BLAKE2B_IV+4), VecLoad64(state.t()+0));
+    row4h = VecXor(VecLoad64(BLAKE2B_IV+6), VecLoad64(state.f()+0));
+
+    BLAKE2B_ROUND(0);
+    BLAKE2B_ROUND(1);
+    BLAKE2B_ROUND(2);
+    BLAKE2B_ROUND(3);
+    BLAKE2B_ROUND(4);
+    BLAKE2B_ROUND(5);
+    BLAKE2B_ROUND(6);
+    BLAKE2B_ROUND(7);
+    BLAKE2B_ROUND(8);
+    BLAKE2B_ROUND(9);
+    BLAKE2B_ROUND(10);
+    BLAKE2B_ROUND(11);
+
+    VecStore64LE(state.h()+0, VecXor(h0, VecXor(row1l, row3l)), le_mask);
+    VecStore64LE(state.h()+2, VecXor(h1, VecXor(row1h, row3h)), le_mask);
+    VecStore64LE(state.h()+4, VecXor(h2, VecXor(row2l, row4l)), le_mask);
+    VecStore64LE(state.h()+6, VecXor(h3, VecXor(row2h, row4h)), le_mask);
+}
+#endif  // CRYPTOPP_POWER8_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/blake2s_simd.cpp b/runtime/third_party/cryptopp/blake2s_simd.cpp
new file mode 100644
index 0000000..c166d56
--- /dev/null
+++ b/runtime/third_party/cryptopp/blake2s_simd.cpp
@@ -0,0 +1,1091 @@
+// blake2_simd.cpp - written and placed in the public domain by
+//                   Samuel Neves, Jeffrey Walton, Uri Blumenthal
+//                   and Marcel Raad.
+//
+//    This source file uses intrinsics to gain access to ARMv7a/ARMv8a
+//    NEON, Power7 and SSE4.1 instructions. A separate source file is
+//    needed because additional CXXFLAGS are required to enable the
+//    appropriate instructions sets in some build configurations.
+
+// The BLAKE2b and BLAKE2s numbers are consistent with the BLAKE2 team's
+// numbers. However, we have an Altivec implementation of BLAKE2s,
+// and a POWER8 implementation of BLAKE2b (BLAKE2 team is missing them).
+// Altivec code is about 2x faster than C++ when using GCC 5.0 or
+// above. The POWER8 code is about 2.5x faster than C++ when using GCC 5.0
+// or above. If you use GCC 4.0 (PowerMac) or GCC 4.8 (GCC Compile Farm)
+// then the PowerPC code will be slower than C++. Be sure to use GCC 5.0
+// or above for PowerPC builds or disable Altivec for BLAKE2b and BLAKE2s
+// if using the old compilers.
+
+#include "pch.h"
+#include "config.h"
+#include "misc.h"
+#include "blake2.h"
+
+// Uncomment for benchmarking C++ against SSE2 or NEON.
+// Do so in both blake2.cpp and blake2_simd.cpp.
+// #undef CRYPTOPP_SSE41_AVAILABLE
+// #undef CRYPTOPP_ARM_NEON_AVAILABLE
+// #undef CRYPTOPP_ALTIVEC_AVAILABLE
+
+// Disable NEON/ASIMD for Cortex-A53 and A57. The shifts are too slow and C/C++ is about
+// 3 cpb faster than NEON/ASIMD. Also see http://github.com/weidai11/cryptopp/issues/367.
+#if (defined(__aarch32__) || defined(__aarch64__)) && defined(CRYPTOPP_SLOW_ARMV8_SHIFT)
+# undef CRYPTOPP_ARM_NEON_AVAILABLE
+#endif
+
+// BLAKE2s bug on AIX 7.1 (POWER7) with XLC 12.01
+// https://github.com/weidai11/cryptopp/issues/743
+#if defined(__xlC__) && (__xlC__ < 0x0d01)
+# define CRYPTOPP_DISABLE_ALTIVEC 1
+# undef CRYPTOPP_POWER7_AVAILABLE
+# undef CRYPTOPP_ALTIVEC_AVAILABLE
+#endif
+
+#if defined(__XOP__)
+# if defined(CRYPTOPP_GCC_COMPATIBLE)
+#  include <x86intrin.h>
+# endif
+# include <ammintrin.h>
+#endif  // XOP
+
+#if (CRYPTOPP_SSE41_AVAILABLE)
+# include <emmintrin.h>
+# include <tmmintrin.h>
+# include <smmintrin.h>
+#endif
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include <arm_neon.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+# include "ppc_simd.h"
+#endif
+
+#if defined(CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE)
+/* Ignore "warning: vec_lvsl is deprecated..." */
+# pragma GCC diagnostic ignored "-Wdeprecated"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char BLAKE2S_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Exported by blake2.cpp
+extern const word32 BLAKE2S_IV[8];
+extern const word64 BLAKE2B_IV[8];
+
+#if CRYPTOPP_SSE41_AVAILABLE
+
+#define LOADU(p)  _mm_loadu_si128((const __m128i *)(const void*)(p))
+#define STOREU(p,r) _mm_storeu_si128((__m128i *)(void*)(p), r)
+#define TOF(reg) _mm_castsi128_ps((reg))
+#define TOI(reg) _mm_castps_si128((reg))
+
+void BLAKE2_Compress32_SSE4(const byte* input, BLAKE2s_State& state)
+{
+    #define BLAKE2S_LOAD_MSG_0_1(buf) \
+    buf = TOI(_mm_shuffle_ps(TOF(m0), TOF(m1), _MM_SHUFFLE(2,0,2,0)));
+
+    #define BLAKE2S_LOAD_MSG_0_2(buf) \
+    buf = TOI(_mm_shuffle_ps(TOF(m0), TOF(m1), _MM_SHUFFLE(3,1,3,1)));
+
+    #define BLAKE2S_LOAD_MSG_0_3(buf) \
+    t0 = _mm_shuffle_epi32(m2, _MM_SHUFFLE(3,2,0,1)); \
+    t1 = _mm_shuffle_epi32(m3, _MM_SHUFFLE(0,1,3,2)); \
+    buf = _mm_blend_epi16(t0, t1, 0xC3);
+
+    #define BLAKE2S_LOAD_MSG_0_4(buf) \
+    t0 = _mm_blend_epi16(t0, t1, 0x3C); \
+    buf = _mm_shuffle_epi32(t0, _MM_SHUFFLE(2,3,0,1));
+
+    #define BLAKE2S_LOAD_MSG_1_1(buf) \
+    t0 = _mm_blend_epi16(m1, m2, 0x0C); \
+    t1 = _mm_slli_si128(m3, 4); \
+    t2 = _mm_blend_epi16(t0, t1, 0xF0); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(2,1,0,3));
+
+    #define BLAKE2S_LOAD_MSG_1_2(buf) \
+    t0 = _mm_shuffle_epi32(m2,_MM_SHUFFLE(0,0,2,0)); \
+    t1 = _mm_blend_epi16(m1,m3,0xC0); \
+    t2 = _mm_blend_epi16(t0, t1, 0xF0); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(2,3,0,1));
+
+    #define BLAKE2S_LOAD_MSG_1_3(buf) \
+    t0 = _mm_slli_si128(m1, 4); \
+    t1 = _mm_blend_epi16(m2, t0, 0x30); \
+    t2 = _mm_blend_epi16(m0, t1, 0xF0); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(3,0,1,2));
+
+    #define BLAKE2S_LOAD_MSG_1_4(buf) \
+    t0 = _mm_unpackhi_epi32(m0,m1); \
+    t1 = _mm_slli_si128(m3, 4); \
+    t2 = _mm_blend_epi16(t0, t1, 0x0C); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(3,0,1,2));
+
+    #define BLAKE2S_LOAD_MSG_2_1(buf) \
+    t0 = _mm_unpackhi_epi32(m2,m3); \
+    t1 = _mm_blend_epi16(m3,m1,0x0C); \
+    t2 = _mm_blend_epi16(t0, t1, 0x0F); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(3,1,0,2));
+
+    #define BLAKE2S_LOAD_MSG_2_2(buf) \
+    t0 = _mm_unpacklo_epi32(m2,m0); \
+    t1 = _mm_blend_epi16(t0, m0, 0xF0); \
+    t2 = _mm_slli_si128(m3, 8); \
+    buf = _mm_blend_epi16(t1, t2, 0xC0);
+
+    #define BLAKE2S_LOAD_MSG_2_3(buf) \
+    t0 = _mm_blend_epi16(m0, m2, 0x3C); \
+    t1 = _mm_srli_si128(m1, 12); \
+    t2 = _mm_blend_epi16(t0,t1,0x03); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(0,3,2,1));
+
+    #define BLAKE2S_LOAD_MSG_2_4(buf) \
+    t0 = _mm_slli_si128(m3, 4); \
+    t1 = _mm_blend_epi16(m0, m1, 0x33); \
+    t2 = _mm_blend_epi16(t1, t0, 0xC0); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(1,2,3,0));
+
+    #define BLAKE2S_LOAD_MSG_3_1(buf) \
+    t0 = _mm_unpackhi_epi32(m0,m1); \
+    t1 = _mm_unpackhi_epi32(t0, m2); \
+    t2 = _mm_blend_epi16(t1, m3, 0x0C); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(3,1,0,2));
+
+    #define BLAKE2S_LOAD_MSG_3_2(buf) \
+    t0 = _mm_slli_si128(m2, 8); \
+    t1 = _mm_blend_epi16(m3,m0,0x0C); \
+    t2 = _mm_blend_epi16(t1, t0, 0xC0); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(2,0,1,3));
+
+    #define BLAKE2S_LOAD_MSG_3_3(buf) \
+    t0 = _mm_blend_epi16(m0,m1,0x0F); \
+    t1 = _mm_blend_epi16(t0, m3, 0xC0); \
+    buf = _mm_shuffle_epi32(t1, _MM_SHUFFLE(0,1,2,3));
+
+    #define BLAKE2S_LOAD_MSG_3_4(buf) \
+    t0 = _mm_alignr_epi8(m0, m1, 4); \
+    buf = _mm_blend_epi16(t0, m2, 0x33);
+
+    #define BLAKE2S_LOAD_MSG_4_1(buf) \
+    t0 = _mm_unpacklo_epi64(m1,m2); \
+    t1 = _mm_unpackhi_epi64(m0,m2); \
+    t2 = _mm_blend_epi16(t0,t1,0x33); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(2,0,1,3));
+
+    #define BLAKE2S_LOAD_MSG_4_2(buf) \
+    t0 = _mm_unpackhi_epi64(m1,m3); \
+    t1 = _mm_unpacklo_epi64(m0,m1); \
+    buf = _mm_blend_epi16(t0,t1,0x33);
+
+    #define BLAKE2S_LOAD_MSG_4_3(buf) \
+    t0 = _mm_unpackhi_epi64(m3,m1); \
+    t1 = _mm_unpackhi_epi64(m2,m0); \
+    t2 = _mm_blend_epi16(t1,t0,0x33); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(2,1,0,3));
+
+    #define BLAKE2S_LOAD_MSG_4_4(buf) \
+    t0 = _mm_blend_epi16(m0,m2,0x03); \
+    t1 = _mm_slli_si128(t0, 8); \
+    t2 = _mm_blend_epi16(t1,m3,0x0F); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(2,0,3,1));
+
+    #define BLAKE2S_LOAD_MSG_5_1(buf) \
+    t0 = _mm_unpackhi_epi32(m0,m1); \
+    t1 = _mm_unpacklo_epi32(m0,m2); \
+    buf = _mm_unpacklo_epi64(t0,t1);
+
+    #define BLAKE2S_LOAD_MSG_5_2(buf) \
+    t0 = _mm_srli_si128(m2, 4); \
+    t1 = _mm_blend_epi16(m0,m3,0x03); \
+    buf = _mm_blend_epi16(t1,t0,0x3C);
+
+    #define BLAKE2S_LOAD_MSG_5_3(buf) \
+    t0 = _mm_blend_epi16(m1,m0,0x0C); \
+    t1 = _mm_srli_si128(m3, 4); \
+    t2 = _mm_blend_epi16(t0,t1,0x30); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(2,3,0,1));
+
+    #define BLAKE2S_LOAD_MSG_5_4(buf) \
+    t0 = _mm_unpacklo_epi64(m2,m1); \
+    t1 = _mm_shuffle_epi32(m3, _MM_SHUFFLE(2,0,1,0)); \
+    t2 = _mm_srli_si128(t0, 4); \
+    buf = _mm_blend_epi16(t1,t2,0x33);
+
+    #define BLAKE2S_LOAD_MSG_6_1(buf) \
+    t0 = _mm_slli_si128(m1, 12); \
+    t1 = _mm_blend_epi16(m0,m3,0x33); \
+    buf = _mm_blend_epi16(t1,t0,0xC0);
+
+    #define BLAKE2S_LOAD_MSG_6_2(buf) \
+    t0 = _mm_blend_epi16(m3,m2,0x30); \
+    t1 = _mm_srli_si128(m1, 4); \
+    t2 = _mm_blend_epi16(t0,t1,0x03); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(2,1,3,0));
+
+    #define BLAKE2S_LOAD_MSG_6_3(buf) \
+    t0 = _mm_unpacklo_epi64(m0,m2); \
+    t1 = _mm_srli_si128(m1, 4); \
+    t2 = _mm_blend_epi16(t0,t1,0x0C); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(3,1,0,2));
+
+    #define BLAKE2S_LOAD_MSG_6_4(buf) \
+    t0 = _mm_unpackhi_epi32(m1,m2); \
+    t1 = _mm_unpackhi_epi64(m0,t0); \
+    buf = _mm_shuffle_epi32(t1, _MM_SHUFFLE(0,1,2,3));
+
+    #define BLAKE2S_LOAD_MSG_7_1(buf) \
+    t0 = _mm_unpackhi_epi32(m0,m1); \
+    t1 = _mm_blend_epi16(t0,m3,0x0F); \
+    buf = _mm_shuffle_epi32(t1,_MM_SHUFFLE(2,0,3,1));
+
+    #define BLAKE2S_LOAD_MSG_7_2(buf) \
+    t0 = _mm_blend_epi16(m2,m3,0x30); \
+    t1 = _mm_srli_si128(m0,4); \
+    t2 = _mm_blend_epi16(t0,t1,0x03); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(1,0,2,3));
+
+    #define BLAKE2S_LOAD_MSG_7_3(buf) \
+    t0 = _mm_unpackhi_epi64(m0,m3); \
+    t1 = _mm_unpacklo_epi64(m1,m2); \
+    t2 = _mm_blend_epi16(t0,t1,0x3C); \
+    buf = _mm_shuffle_epi32(t2,_MM_SHUFFLE(2,3,1,0));
+
+    #define BLAKE2S_LOAD_MSG_7_4(buf) \
+    t0 = _mm_unpacklo_epi32(m0,m1); \
+    t1 = _mm_unpackhi_epi32(m1,m2); \
+    t2 = _mm_unpacklo_epi64(t0,t1); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(2,1,0,3));
+
+    #define BLAKE2S_LOAD_MSG_8_1(buf) \
+    t0 = _mm_unpackhi_epi32(m1,m3); \
+    t1 = _mm_unpacklo_epi64(t0,m0); \
+    t2 = _mm_blend_epi16(t1,m2,0xC0); \
+    buf = _mm_shufflehi_epi16(t2,_MM_SHUFFLE(1,0,3,2));
+
+    #define BLAKE2S_LOAD_MSG_8_2(buf) \
+    t0 = _mm_unpackhi_epi32(m0,m3); \
+    t1 = _mm_blend_epi16(m2,t0,0xF0); \
+    buf = _mm_shuffle_epi32(t1,_MM_SHUFFLE(0,2,1,3));
+
+    #define BLAKE2S_LOAD_MSG_8_3(buf) \
+    t0 = _mm_unpacklo_epi64(m0,m3); \
+    t1 = _mm_srli_si128(m2,8); \
+    t2 = _mm_blend_epi16(t0,t1,0x03); \
+    buf = _mm_shuffle_epi32(t2, _MM_SHUFFLE(1,3,2,0));
+
+    #define BLAKE2S_LOAD_MSG_8_4(buf) \
+    t0 = _mm_blend_epi16(m1,m0,0x30); \
+    buf = _mm_shuffle_epi32(t0,_MM_SHUFFLE(0,3,2,1));
+
+    #define BLAKE2S_LOAD_MSG_9_1(buf) \
+    t0 = _mm_blend_epi16(m0,m2,0x03); \
+    t1 = _mm_blend_epi16(m1,m2,0x30); \
+    t2 = _mm_blend_epi16(t1,t0,0x0F); \
+    buf = _mm_shuffle_epi32(t2,_MM_SHUFFLE(1,3,0,2));
+
+    #define BLAKE2S_LOAD_MSG_9_2(buf) \
+    t0 = _mm_slli_si128(m0,4); \
+    t1 = _mm_blend_epi16(m1,t0,0xC0); \
+    buf = _mm_shuffle_epi32(t1,_MM_SHUFFLE(1,2,0,3));
+
+    #define BLAKE2S_LOAD_MSG_9_3(buf) \
+    t0 = _mm_unpackhi_epi32(m0,m3); \
+    t1 = _mm_unpacklo_epi32(m2,m3); \
+    t2 = _mm_unpackhi_epi64(t0,t1); \
+    buf = _mm_shuffle_epi32(t2,_MM_SHUFFLE(0,2,1,3));
+
+    #define BLAKE2S_LOAD_MSG_9_4(buf) \
+    t0 = _mm_blend_epi16(m3,m2,0xC0); \
+    t1 = _mm_unpacklo_epi32(m0,m3); \
+    t2 = _mm_blend_epi16(t0,t1,0x0F); \
+    buf = _mm_shuffle_epi32(t2,_MM_SHUFFLE(1,2,3,0));
+
+#ifdef __XOP__
+# define MM_ROTI_EPI32(r, c) \
+    _mm_roti_epi32(r, c)
+#else
+# define MM_ROTI_EPI32(r, c) ( \
+      (8==-(c)) ? _mm_shuffle_epi8(r,r8) \
+    : (16==-(c)) ? _mm_shuffle_epi8(r,r16) \
+    : _mm_xor_si128(_mm_srli_epi32((r), -(c)), \
+      _mm_slli_epi32((r), 32-(-(c)))))
+#endif
+
+#define BLAKE2S_G1(row1,row2,row3,row4,buf) \
+    row1 = _mm_add_epi32( _mm_add_epi32( row1, buf), row2 ); \
+    row4 = _mm_xor_si128( row4, row1 ); \
+    row4 = MM_ROTI_EPI32(row4, -16); \
+    row3 = _mm_add_epi32( row3, row4 );   \
+    row2 = _mm_xor_si128( row2, row3 ); \
+    row2 = MM_ROTI_EPI32(row2, -12);
+
+#define BLAKE2S_G2(row1,row2,row3,row4,buf) \
+    row1 = _mm_add_epi32( _mm_add_epi32( row1, buf), row2 ); \
+    row4 = _mm_xor_si128( row4, row1 ); \
+    row4 = MM_ROTI_EPI32(row4, -8); \
+    row3 = _mm_add_epi32( row3, row4 );   \
+    row2 = _mm_xor_si128( row2, row3 ); \
+    row2 = MM_ROTI_EPI32(row2, -7);
+
+#define DIAGONALIZE(row1,row2,row3,row4) \
+    row1 = _mm_shuffle_epi32( row1, _MM_SHUFFLE(2,1,0,3) ); \
+    row4 = _mm_shuffle_epi32( row4, _MM_SHUFFLE(1,0,3,2) ); \
+    row3 = _mm_shuffle_epi32( row3, _MM_SHUFFLE(0,3,2,1) );
+
+#define UNDIAGONALIZE(row1,row2,row3,row4) \
+    row1 = _mm_shuffle_epi32( row1, _MM_SHUFFLE(0,3,2,1) ); \
+    row4 = _mm_shuffle_epi32( row4, _MM_SHUFFLE(1,0,3,2) ); \
+    row3 = _mm_shuffle_epi32( row3, _MM_SHUFFLE(2,1,0,3) );
+
+#define BLAKE2S_ROUND(r)  \
+    BLAKE2S_LOAD_MSG_ ##r ##_1(buf1); \
+    BLAKE2S_G1(row1,row2,row3,row4,buf1); \
+    BLAKE2S_LOAD_MSG_ ##r ##_2(buf2); \
+    BLAKE2S_G2(row1,row2,row3,row4,buf2); \
+    DIAGONALIZE(row1,row2,row3,row4); \
+    BLAKE2S_LOAD_MSG_ ##r ##_3(buf3); \
+    BLAKE2S_G1(row1,row2,row3,row4,buf3); \
+    BLAKE2S_LOAD_MSG_ ##r ##_4(buf4); \
+    BLAKE2S_G2(row1,row2,row3,row4,buf4); \
+    UNDIAGONALIZE(row1,row2,row3,row4);
+
+    __m128i row1, row2, row3, row4;
+    __m128i buf1, buf2, buf3, buf4;
+    __m128i t0, t1, t2, ff0, ff1;
+
+    const __m128i r8 = _mm_set_epi8(12, 15, 14, 13, 8, 11, 10, 9, 4, 7, 6, 5, 0, 3, 2, 1);
+    const __m128i r16 = _mm_set_epi8(13, 12, 15, 14, 9, 8, 11, 10, 5, 4, 7, 6, 1, 0, 3, 2);
+
+    const __m128i m0 = LOADU(input + 00);
+    const __m128i m1 = LOADU(input + 16);
+    const __m128i m2 = LOADU(input + 32);
+    const __m128i m3 = LOADU(input + 48);
+
+    row1 = ff0 = LOADU(state.h()+0);
+    row2 = ff1 = LOADU(state.h()+4);
+    row3 = LOADU(BLAKE2S_IV+0);
+    row4 = _mm_xor_si128(LOADU(BLAKE2S_IV+4), LOADU(state.t()+0));
+
+    BLAKE2S_ROUND(0);
+    BLAKE2S_ROUND(1);
+    BLAKE2S_ROUND(2);
+    BLAKE2S_ROUND(3);
+    BLAKE2S_ROUND(4);
+    BLAKE2S_ROUND(5);
+    BLAKE2S_ROUND(6);
+    BLAKE2S_ROUND(7);
+    BLAKE2S_ROUND(8);
+    BLAKE2S_ROUND(9);
+
+    STOREU(state.h()+0, _mm_xor_si128(ff0, _mm_xor_si128(row1, row3)));
+    STOREU(state.h()+4, _mm_xor_si128(ff1, _mm_xor_si128(row2, row4)));
+}
+#endif  // CRYPTOPP_SSE41_AVAILABLE
+
+#if CRYPTOPP_ARM_NEON_AVAILABLE
+void BLAKE2_Compress32_NEON(const byte* input, BLAKE2s_State& state)
+{
+    #define BLAKE2S_LOAD_MSG_0_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m0), vget_high_u32(m0)).val[0]; \
+    t1 = vzip_u32(vget_low_u32(m1), vget_high_u32(m1)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_0_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m0), vget_high_u32(m0)).val[1]; \
+    t1 = vzip_u32(vget_low_u32(m1), vget_high_u32(m1)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_0_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m2), vget_high_u32(m2)).val[0]; \
+    t1 = vzip_u32(vget_low_u32(m3), vget_high_u32(m3)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_0_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m2), vget_high_u32(m2)).val[1]; \
+    t1 = vzip_u32(vget_low_u32(m3), vget_high_u32(m3)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_1_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m3), vget_low_u32(m1)).val[0]; \
+    t1 = vzip_u32(vget_low_u32(m2), vget_low_u32(m3)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_1_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m2), vget_low_u32(m2)).val[0]; \
+    t1 = vext_u32(vget_high_u32(m3), vget_high_u32(m1), 1); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_1_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vext_u32(vget_low_u32(m0), vget_low_u32(m0), 1); \
+    t1 = vzip_u32(vget_high_u32(m2), vget_low_u32(m1)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_1_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m3), vget_high_u32(m0)).val[0]; \
+    t1 = vzip_u32(vget_high_u32(m1), vget_high_u32(m0)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_2_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vext_u32(vget_high_u32(m2), vget_low_u32(m3), 1); \
+    t1 = vzip_u32(vget_low_u32(m1), vget_high_u32(m3)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_2_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m2), vget_low_u32(m0)).val[0]; \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_high_u32(m0), vget_low_u32(m3)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_2_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_high_u32(m2), vget_high_u32(m0)); \
+    t1 = vzip_u32(vget_high_u32(m1), vget_low_u32(m2)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_2_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m3), vget_high_u32(m1)).val[0]; \
+    t1 = vext_u32(vget_low_u32(m0), vget_low_u32(m1), 1); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_3_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m1), vget_high_u32(m0)).val[1]; \
+    t1 = vzip_u32(vget_low_u32(m3), vget_high_u32(m2)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_3_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m2), vget_low_u32(m0)).val[1]; \
+    t1 = vzip_u32(vget_low_u32(m3), vget_high_u32(m3)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_3_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_high_u32(m0), vget_low_u32(m1)); \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_low_u32(m1), vget_high_u32(m3)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_3_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m1), vget_high_u32(m2)).val[0]; \
+    t1 = vzip_u32(vget_low_u32(m0), vget_low_u32(m2)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_4_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m2), vget_low_u32(m1)).val[1]; \
+    t1 = vzip_u32((vget_high_u32(m0)), vget_high_u32(m2)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_4_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_low_u32(m0), vget_high_u32(m1)); \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_low_u32(m1), vget_high_u32(m3)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_4_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_high_u32(m3), vget_high_u32(m2)); \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_high_u32(m1), vget_high_u32(m0)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_4_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vext_u32(vget_low_u32(m0), vget_low_u32(m3), 1); \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_low_u32(m2), vget_low_u32(m3)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_5_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32((vget_high_u32(m0)), vget_high_u32(m1)).val[0]; \
+    t1 = vzip_u32(vget_low_u32(m0), vget_low_u32(m2)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_5_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m3), vget_high_u32(m2)).val[0]; \
+    t1 = vzip_u32(vget_high_u32(m2), vget_high_u32(m0)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_5_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_low_u32(m1), vget_high_u32(m1)); \
+    t1 = vzip_u32(vget_high_u32(m3), vget_low_u32(m0)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_5_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m3), vget_low_u32(m1)).val[1]; \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_high_u32(m3), vget_low_u32(m2)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_6_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_low_u32(m3), vget_low_u32(m0)); \
+    t1 = vzip_u32(vget_high_u32(m3), vget_low_u32(m1)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_6_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m1), vget_high_u32(m3)).val[1]; \
+    t1 = vext_u32(vget_low_u32(m3), vget_high_u32(m2), 1); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_6_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m0), vget_high_u32(m1)).val[0]; \
+    t1 = vext_u32(vget_low_u32(m2), vget_low_u32(m2), 1); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_6_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m1), vget_high_u32(m0)).val[1]; \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_high_u32(m0), vget_high_u32(m2)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_7_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m3), vget_high_u32(m1)).val[1]; \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_low_u32(m3), vget_high_u32(m0)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_7_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vext_u32(vget_high_u32(m2), vget_high_u32(m3), 1); \
+    t1 = vzip_u32(vget_low_u32(m0), vget_low_u32(m2)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_7_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m1), vget_high_u32(m3)).val[1]; \
+    t1 = vzip_u32(vget_low_u32(m2), vget_high_u32(m0)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_7_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_low_u32(m0), vget_low_u32(m1)).val[0]; \
+    t1 = vzip_u32(vget_high_u32(m1), vget_high_u32(m2)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_8_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m1), vget_high_u32(m3)).val[0]; \
+    t1 = vext_u32(vget_high_u32(m2), vget_low_u32(m0), 1); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_8_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m3), vget_low_u32(m2)).val[1]; \
+    t1 = vext_u32(vget_high_u32(m0), vget_low_u32(m2), 1); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_8_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_low_u32(m3), vget_low_u32(m3)); \
+    t1 = vext_u32(vget_low_u32(m0), vget_high_u32(m2), 1); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_8_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_high_u32(m0), vget_high_u32(m1)); \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_low_u32(m1), vget_low_u32(m1)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_9_1(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m2), vget_low_u32(m2)).val[0]; \
+    t1 = vzip_u32(vget_high_u32(m1), vget_low_u32(m0)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_9_2(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32((vget_high_u32(m0)), vget_low_u32(m1)).val[0]; \
+    t1 = vbsl_u32(vcreate_u32(0xFFFFFFFF), vget_high_u32(m1), vget_low_u32(m1)); \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_9_3(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vzip_u32(vget_high_u32(m3), vget_low_u32(m2)).val[1]; \
+    t1 = vzip_u32((vget_high_u32(m0)), vget_low_u32(m3)).val[1]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define BLAKE2S_LOAD_MSG_9_4(buf) \
+    do { uint32x2_t t0, t1; \
+    t0 = vext_u32(vget_high_u32(m2), vget_high_u32(m3), 1); \
+    t1 = vzip_u32(vget_low_u32(m3), vget_low_u32(m0)).val[0]; \
+    buf = vcombine_u32(t0, t1); } while(0)
+
+    #define vrorq_n_u32_16(x) vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(x)))
+
+    #define vrorq_n_u32_8(x) vsriq_n_u32(vshlq_n_u32((x), 24), (x), 8)
+
+    #define vrorq_n_u32(x, c) vsriq_n_u32(vshlq_n_u32((x), 32-(c)), (x), (c))
+
+    #define BLAKE2S_G1(row1,row2,row3,row4,buf) \
+    do { \
+      row1 = vaddq_u32(vaddq_u32(row1, buf), row2); row4 = veorq_u32(row4, row1); \
+      row4 = vrorq_n_u32_16(row4); row3 = vaddq_u32(row3, row4); \
+      row2 = veorq_u32(row2, row3); row2 = vrorq_n_u32(row2, 12); \
+    } while(0)
+
+    #define BLAKE2S_G2(row1,row2,row3,row4,buf) \
+    do { \
+      row1 = vaddq_u32(vaddq_u32(row1, buf), row2); row4 = veorq_u32(row4, row1); \
+      row4 = vrorq_n_u32_8(row4); row3 = vaddq_u32(row3, row4); \
+      row2 = veorq_u32(row2, row3); row2 = vrorq_n_u32(row2, 7); \
+    } while(0)
+
+    #define BLAKE2S_DIAGONALIZE(row1,row2,row3,row4) \
+    do { \
+      row4 = vextq_u32(row4, row4, 3); row3 = vextq_u32(row3, row3, 2); row2 = vextq_u32(row2, row2, 1); \
+    } while(0)
+
+    #define BLAKE2S_UNDIAGONALIZE(row1,row2,row3,row4) \
+    do { \
+      row4 = vextq_u32(row4, row4, 1); \
+      row3 = vextq_u32(row3, row3, 2); \
+      row2 = vextq_u32(row2, row2, 3); \
+    } while(0)
+
+    #define BLAKE2S_ROUND(r)  \
+    do { \
+      uint32x4_t buf1, buf2, buf3, buf4; \
+      BLAKE2S_LOAD_MSG_ ##r ##_1(buf1); \
+      BLAKE2S_G1(row1,row2,row3,row4,buf1); \
+      BLAKE2S_LOAD_MSG_ ##r ##_2(buf2); \
+      BLAKE2S_G2(row1,row2,row3,row4,buf2); \
+      BLAKE2S_DIAGONALIZE(row1,row2,row3,row4); \
+      BLAKE2S_LOAD_MSG_ ##r ##_3(buf3); \
+      BLAKE2S_G1(row1,row2,row3,row4,buf3); \
+      BLAKE2S_LOAD_MSG_ ##r ##_4(buf4); \
+      BLAKE2S_G2(row1,row2,row3,row4,buf4); \
+      BLAKE2S_UNDIAGONALIZE(row1,row2,row3,row4); \
+    } while(0)
+
+    const uint32x4_t m0 = vreinterpretq_u32_u8(vld1q_u8(input + 00));
+    const uint32x4_t m1 = vreinterpretq_u32_u8(vld1q_u8(input + 16));
+    const uint32x4_t m2 = vreinterpretq_u32_u8(vld1q_u8(input + 32));
+    const uint32x4_t m3 = vreinterpretq_u32_u8(vld1q_u8(input + 48));
+
+    uint32x4_t row1, row2, row3, row4;
+
+    const uint32x4_t f0 = row1 = vld1q_u32(state.h()+0);
+    const uint32x4_t f1 = row2 = vld1q_u32(state.h()+4);
+    row3 = vld1q_u32(BLAKE2S_IV+0);
+    row4 = veorq_u32(vld1q_u32(BLAKE2S_IV+4), vld1q_u32(state.t()+0));
+
+    BLAKE2S_ROUND(0);
+    BLAKE2S_ROUND(1);
+    BLAKE2S_ROUND(2);
+    BLAKE2S_ROUND(3);
+    BLAKE2S_ROUND(4);
+    BLAKE2S_ROUND(5);
+    BLAKE2S_ROUND(6);
+    BLAKE2S_ROUND(7);
+    BLAKE2S_ROUND(8);
+    BLAKE2S_ROUND(9);
+
+    vst1q_u32(state.h()+0, veorq_u32(f0, veorq_u32(row1, row3)));
+    vst1q_u32(state.h()+4, veorq_u32(f1, veorq_u32(row2, row4)));
+}
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+
+template <class T>
+inline uint32x4_p VecLoad32(const T* p)
+{
+    return VecLoad(p);
+}
+
+template <class T>
+inline uint32x4_p VecLoad32LE(const T* p, const uint8x16_p le_mask)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    const uint32x4_p v = VecLoad(p);
+    return VecPermute(v, v, le_mask);
+#else
+    CRYPTOPP_UNUSED(le_mask);
+    return VecLoad(p);
+#endif
+}
+
+template <class T>
+inline void VecStore32(T* p, const uint32x4_p x)
+{
+    VecStore(x, p);
+}
+
+template <class T>
+inline void VecStore32LE(T* p, const uint32x4_p x, const uint8x16_p le_mask)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    const uint32x4_p v = VecPermute(x, x, le_mask);
+    VecStore(v, p);
+#else
+    CRYPTOPP_UNUSED(le_mask);
+    VecStore(x, p);
+#endif
+}
+
+template <unsigned int E1, unsigned int E2>
+inline uint32x4_p VectorSet32(const uint32x4_p a, const uint32x4_p b)
+{
+    // Re-index. I'd like to use something like Z=Y*4 and then
+    // VecShiftLeftOctet<Z>(b) but it crashes early Red Hat
+    // GCC compilers.
+    enum {X=E1&3, Y=E2&3};
+
+    // Don't care element
+    const unsigned int DC = 31;
+
+    // Element 0 combinations
+    if (X == 0 && Y == 0)
+    {
+        const uint8x16_p mask = {0,1,2,3, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, b, mask);
+    }
+    else if (X == 0 && Y == 1)
+    {
+        const uint8x16_p mask = {0,1,2,3, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<4>(b), mask);
+    }
+    else if (X == 0 && Y == 2)
+    {
+        const uint8x16_p mask = {0,1,2,3, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<8>(b), mask);
+    }
+    else if (X == 0 && Y == 3)
+    {
+        const uint8x16_p mask = {0,1,2,3, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<12>(b), mask);
+    }
+
+    // Element 1 combinations
+    else if (X == 1 && Y == 0)
+    {
+        const uint8x16_p mask = {4,5,6,7, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, b, mask);
+    }
+    else if (X == 1 && Y == 1)
+    {
+        const uint8x16_p mask = {4,5,6,7, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<4>(b), mask);
+    }
+    else if (X == 1 && Y == 2)
+    {
+        const uint8x16_p mask = {4,5,6,7, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<8>(b), mask);
+    }
+    else if (X == 1 && Y == 3)
+    {
+        const uint8x16_p mask = {4,5,6,7, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<12>(b), mask);
+    }
+
+    // Element 2 combinations
+    else if (X == 2 && Y == 0)
+    {
+        const uint8x16_p mask = {8,9,10,11, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, b, mask);
+    }
+    else if (X == 2 && Y == 1)
+    {
+        const uint8x16_p mask = {8,9,10,11, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<4>(b), mask);
+    }
+    else if (X == 2 && Y == 2)
+    {
+        const uint8x16_p mask = {8,9,10,11, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<8>(b), mask);
+    }
+    else if (X == 2 && Y == 3)
+    {
+        const uint8x16_p mask = {8,9,10,11, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<12>(b), mask);
+    }
+
+    // Element 3 combinations
+    else if (X == 3 && Y == 0)
+    {
+        const uint8x16_p mask = {12,13,14,15, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, b, mask);
+    }
+    else if (X == 3 && Y == 1)
+    {
+        const uint8x16_p mask = {12,13,14,15, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<4>(b), mask);
+    }
+    else if (X == 3 && Y == 2)
+    {
+        const uint8x16_p mask = {12,13,14,15, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<8>(b), mask);
+    }
+    else if (X == 3 && Y == 3)
+    {
+        const uint8x16_p mask = {12,13,14,15, 16,17,18,19, DC,DC,DC,DC, DC,DC,DC,DC};
+        return VecPermute(a, VecShiftLeftOctet<12>(b), mask);
+    }
+
+    // Quiet IBM XLC warning
+    return VecXor(a, a);
+}
+
+template <unsigned int E1, unsigned int E2, unsigned int E3, unsigned int E4>
+inline uint32x4_p VectorSet32(const uint32x4_p a, const uint32x4_p b,
+                              const uint32x4_p c, const uint32x4_p d)
+{
+    // Re-index
+    enum {W=E1&3, X=E2&3, Y=E3&3, Z=E4&3};
+
+    const uint32x4_p t0 = VectorSet32<W,X>(a, b);
+    const uint32x4_p t1 = VectorSet32<Y,Z>(c, d);
+
+    // PowerPC follows SSE2's implementation, and this is _mm_set_epi32.
+    const uint8x16_p mask = {20,21,22,23, 16,17,18,19, 4,5,6,7, 0,1,2,3};
+    return VecPermute(t0, t1, mask);
+}
+
+template<>
+uint32x4_p VectorSet32<2,0,2,0>(const uint32x4_p a, const uint32x4_p b,
+                                const uint32x4_p c, const uint32x4_p d)
+{
+    // a=b, c=d, mask is {2,0, 2,0}
+    CRYPTOPP_UNUSED(b); CRYPTOPP_UNUSED(d);
+    const uint8x16_p mask = {16,17,18,19, 24,25,26,27, 0,1,2,3, 8,9,10,11};
+    return VecPermute(a, c, mask);
+}
+
+template<>
+uint32x4_p VectorSet32<3,1,3,1>(const uint32x4_p a, const uint32x4_p b,
+                                const uint32x4_p c, const uint32x4_p d)
+{
+    // a=b, c=d, mask is {3,1, 3,1}
+    CRYPTOPP_UNUSED(b); CRYPTOPP_UNUSED(d);
+    const uint8x16_p mask = {20,21,22,23, 28,29,30,31, 4,5,6,7, 12,13,14,15};
+    return VecPermute(a, c, mask);
+}
+
+void BLAKE2_Compress32_ALTIVEC(const byte* input, BLAKE2s_State& state)
+{
+    # define m1 m0
+    # define m2 m0
+    # define m3 m0
+
+    # define m5 m4
+    # define m6 m4
+    # define m7 m4
+
+    # define m9 m8
+    # define m10 m8
+    # define m11 m8
+
+    # define m13 m12
+    # define m14 m12
+    # define m15 m12
+
+    // #define BLAKE2S_LOAD_MSG_0_1(buf) buf = VectorSet32<6,4,2,0>(m6,m4,m2,m0);
+    #define BLAKE2S_LOAD_MSG_0_1(buf) buf = VectorSet32<2,0,2,0>(m6,m4,m2,m0);
+    // #define BLAKE2S_LOAD_MSG_0_2(buf) buf = VectorSet32<7,5,3,1>(m7,m5,m3,m1);
+    #define BLAKE2S_LOAD_MSG_0_2(buf) buf = VectorSet32<3,1,3,1>(m7,m5,m3,m1);
+    // #define BLAKE2S_LOAD_MSG_0_3(buf) buf = VectorSet32<14,12,10,8>(m14,m12,m10,m8);
+    #define BLAKE2S_LOAD_MSG_0_3(buf) buf = VectorSet32<2,0,2,0>(m14,m12,m10,m8);
+    // #define BLAKE2S_LOAD_MSG_0_4(buf) buf = VectorSet32<15,13,11,9>(m15,m13,m11,m9);
+    #define BLAKE2S_LOAD_MSG_0_4(buf) buf = VectorSet32<3,1,3,1>(m15,m13,m11,m9);
+
+    #define BLAKE2S_LOAD_MSG_1_1(buf) buf = VectorSet32<13,9,4,14>(m13,m9,m4,m14);
+    #define BLAKE2S_LOAD_MSG_1_2(buf) buf = VectorSet32<6,15,8,10>(m6,m15,m8,m10)
+    #define BLAKE2S_LOAD_MSG_1_3(buf) buf = VectorSet32<5,11,0,1>(m5,m11,m0,m1)
+    #define BLAKE2S_LOAD_MSG_1_4(buf) buf = VectorSet32<3,7,2,12>(m3,m7,m2,m12)
+
+    #define BLAKE2S_LOAD_MSG_2_1(buf) buf = VectorSet32<15,5,12,11>(m15,m5,m12,m11)
+    #define BLAKE2S_LOAD_MSG_2_2(buf) buf = VectorSet32<13,2,0,8>(m13,m2,m0,m8)
+    #define BLAKE2S_LOAD_MSG_2_3(buf) buf = VectorSet32<9,7,3,10>(m9,m7,m3,m10)
+    #define BLAKE2S_LOAD_MSG_2_4(buf) buf = VectorSet32<4,1,6,14>(m4,m1,m6,m14)
+
+    #define BLAKE2S_LOAD_MSG_3_1(buf) buf = VectorSet32<11,13,3,7>(m11,m13,m3,m7)
+    #define BLAKE2S_LOAD_MSG_3_2(buf) buf = VectorSet32<14,12,1,9>(m14,m12,m1,m9)
+    #define BLAKE2S_LOAD_MSG_3_3(buf) buf = VectorSet32<15,4,5,2>(m15,m4,m5,m2)
+    #define BLAKE2S_LOAD_MSG_3_4(buf) buf = VectorSet32<8,0,10,6>(m8,m0,m10,m6)
+
+    #define BLAKE2S_LOAD_MSG_4_1(buf) buf = VectorSet32<10,2,5,9>(m10,m2,m5,m9)
+    #define BLAKE2S_LOAD_MSG_4_2(buf) buf = VectorSet32<15,4,7,0>(m15,m4,m7,m0)
+    #define BLAKE2S_LOAD_MSG_4_3(buf) buf = VectorSet32<3,6,11,14>(m3,m6,m11,m14)
+    #define BLAKE2S_LOAD_MSG_4_4(buf) buf = VectorSet32<13,8,12,1>(m13,m8,m12,m1)
+
+    #define BLAKE2S_LOAD_MSG_5_1(buf) buf = VectorSet32<8,0,6,2>(m8,m0,m6,m2)
+    #define BLAKE2S_LOAD_MSG_5_2(buf) buf = VectorSet32<3,11,10,12>(m3,m11,m10,m12)
+    #define BLAKE2S_LOAD_MSG_5_3(buf) buf = VectorSet32<1,15,7,4>(m1,m15,m7,m4)
+    #define BLAKE2S_LOAD_MSG_5_4(buf) buf = VectorSet32<9,14,5,13>(m9,m14,m5,m13)
+
+    #define BLAKE2S_LOAD_MSG_6_1(buf) buf = VectorSet32<4,14,1,12>(m4,m14,m1,m12)
+    #define BLAKE2S_LOAD_MSG_6_2(buf) buf = VectorSet32<10,13,15,5>(m10,m13,m15,m5)
+    #define BLAKE2S_LOAD_MSG_6_3(buf) buf = VectorSet32<8,9,6,0>(m8,m9,m6,m0)
+    #define BLAKE2S_LOAD_MSG_6_4(buf) buf = VectorSet32<11,2,3,7>(m11,m2,m3,m7)
+
+    #define BLAKE2S_LOAD_MSG_7_1(buf) buf = VectorSet32<3,12,7,13>(m3,m12,m7,m13)
+    #define BLAKE2S_LOAD_MSG_7_2(buf) buf = VectorSet32<9,1,14,11>(m9,m1,m14,m11)
+    #define BLAKE2S_LOAD_MSG_7_3(buf) buf = VectorSet32<2,8,15,5>(m2,m8,m15,m5)
+    #define BLAKE2S_LOAD_MSG_7_4(buf) buf = VectorSet32<10,6,4,0>(m10,m6,m4,m0)
+
+    #define BLAKE2S_LOAD_MSG_8_1(buf) buf = VectorSet32<0,11,14,6>(m0,m11,m14,m6)
+    #define BLAKE2S_LOAD_MSG_8_2(buf) buf = VectorSet32<8,3,9,15>(m8,m3,m9,m15)
+    #define BLAKE2S_LOAD_MSG_8_3(buf) buf = VectorSet32<10,1,13,12>(m10,m1,m13,m12)
+    #define BLAKE2S_LOAD_MSG_8_4(buf) buf = VectorSet32<5,4,7,2>(m5,m4,m7,m2)
+
+    #define BLAKE2S_LOAD_MSG_9_1(buf) buf = VectorSet32<1,7,8,10>(m1,m7,m8,m10)
+    #define BLAKE2S_LOAD_MSG_9_2(buf) buf = VectorSet32<5,6,4,2>(m5,m6,m4,m2)
+    #define BLAKE2S_LOAD_MSG_9_3(buf) buf = VectorSet32<13,3,9,15>(m13,m3,m9,m15)
+    #define BLAKE2S_LOAD_MSG_9_4(buf) buf = VectorSet32<0,12,14,11>(m0,m12,m14,m11)
+
+    #define vec_ror_16(x) VecRotateRight<16>(x)
+    #define vec_ror_12(x) VecRotateRight<12>(x)
+    #define vec_ror_8(x)  VecRotateRight<8>(x)
+    #define vec_ror_7(x)  VecRotateRight<7>(x)
+
+    #define BLAKE2S_G1(row1,row2,row3,row4,buf) \
+      row1 = VecAdd(VecAdd(row1, buf), row2); \
+      row4 = VecXor(row4, row1); \
+      row4 = vec_ror_16(row4); \
+      row3 = VecAdd(row3, row4);   \
+      row2 = VecXor(row2, row3); \
+      row2 = vec_ror_12(row2);
+
+    #define BLAKE2S_G2(row1,row2,row3,row4,buf) \
+      row1 = VecAdd(VecAdd(row1, buf), row2); \
+      row4 = VecXor(row4, row1); \
+      row4 = vec_ror_8(row4); \
+      row3 = VecAdd(row3, row4);   \
+      row2 = VecXor(row2, row3); \
+      row2 = vec_ror_7(row2);
+
+    const uint8x16_p D2103_MASK = {12,13,14,15, 0,1,2,3, 4,5,6,7, 8,9,10,11};
+    const uint8x16_p D1032_MASK = {8,9,10,11, 12,13,14,15, 0,1,2,3, 4,5,6,7};
+    const uint8x16_p D0321_MASK = {4,5,6,7, 8,9,10,11, 12,13,14,15, 0,1,2,3};
+
+    #define BLAKE2S_DIAGONALIZE(row1,row2,row3,row4) \
+      row4 = VecPermute(row4, row4, D2103_MASK); \
+      row3 = VecPermute(row3, row3, D1032_MASK); \
+      row2 = VecPermute(row2, row2, D0321_MASK);
+
+    #define BLAKE2S_UNDIAGONALIZE(row1,row2,row3,row4) \
+      row4 = VecPermute(row4, row4, D0321_MASK); \
+      row3 = VecPermute(row3, row3, D1032_MASK); \
+      row2 = VecPermute(row2, row2, D2103_MASK);
+
+    #define BLAKE2S_ROUND(r)  \
+      BLAKE2S_LOAD_MSG_ ##r ##_1(buf1); \
+      BLAKE2S_G1(row1,row2,row3,row4,buf1); \
+      BLAKE2S_LOAD_MSG_ ##r ##_2(buf2); \
+      BLAKE2S_G2(row1,row2,row3,row4,buf2); \
+      BLAKE2S_DIAGONALIZE(row1,row2,row3,row4); \
+      BLAKE2S_LOAD_MSG_ ##r ##_3(buf3); \
+      BLAKE2S_G1(row1,row2,row3,row4,buf3); \
+      BLAKE2S_LOAD_MSG_ ##r ##_4(buf4); \
+      BLAKE2S_G2(row1,row2,row3,row4,buf4); \
+      BLAKE2S_UNDIAGONALIZE(row1,row2,row3,row4);
+
+    // Possibly unaligned user messages
+    uint32x4_p m0, m4, m8, m12;
+    // Endian conversion mask
+    const uint8x16_p le_mask = {3,2,1,0, 7,6,5,4, 11,10,9,8, 15,14,13,12};
+
+#if defined(_ARCH_PWR9)
+    // POWER9 provides loads for char's and short's
+    m0 = (uint32x4_p) vec_xl(  0, CONST_V8_CAST( input ));
+    m4 = (uint32x4_p) vec_xl( 16, CONST_V8_CAST( input ));
+    m8 = (uint32x4_p) vec_xl( 32, CONST_V8_CAST( input ));
+    m12 = (uint32x4_p) vec_xl( 48, CONST_V8_CAST( input ));
+
+# if defined(CRYPTOPP_BIG_ENDIAN)
+    m0 = vec_perm(m0, m0, le_mask);
+    m4 = vec_perm(m4, m4, le_mask);
+    m8 = vec_perm(m8, m8, le_mask);
+    m12 = vec_perm(m12, m12, le_mask);
+# endif
+#else
+    // Altivec only provides 16-byte aligned loads
+    // http://www.nxp.com/docs/en/reference-manual/ALTIVECPEM.pdf
+    m0 = (uint32x4_p) vec_ld(  0, CONST_V8_CAST( input ));
+    m4 = (uint32x4_p) vec_ld( 16, CONST_V8_CAST( input ));
+    m8 = (uint32x4_p) vec_ld( 32, CONST_V8_CAST( input ));
+    m12 = (uint32x4_p) vec_ld( 48, CONST_V8_CAST( input ));
+
+    // Alignment check for load of the message buffer
+    const uintptr_t addr = (uintptr_t)input;
+    if (addr%16 == 0)
+    {
+        // Already aligned. Perform a little-endian swap as required
+# if defined(CRYPTOPP_BIG_ENDIAN)
+        m0 = vec_perm(m0, m0, le_mask);
+        m4 = vec_perm(m4, m4, le_mask);
+        m8 = vec_perm(m8, m8, le_mask);
+        m12 = vec_perm(m12, m12, le_mask);
+# endif
+    }
+    else
+    {
+        // Not aligned. Fix vectors and perform a little-endian swap as required
+        // http://mirror.informatimago.com/next/developer.apple.com/
+        //        hardwaredrivers/ve/code_optimization.html
+        uint32x4_p ex; uint8x16_p perm;
+        ex = (uint32x4_p) vec_ld(48+15, CONST_V8_CAST( input ));
+        perm = vec_lvsl(0, CONST_V8_CAST( addr ));
+
+# if defined(CRYPTOPP_BIG_ENDIAN)
+        // Combine the vector permute with the little-endian swap
+        perm = vec_perm(perm, perm, le_mask);
+# endif
+
+        m0 = vec_perm(m0, m4, perm);
+        m4 = vec_perm(m4, m8, perm);
+        m8 = vec_perm(m8, m12, perm);
+        m12 = vec_perm(m12, ex, perm);
+    }
+#endif
+
+    uint32x4_p row1, row2, row3, row4;
+    uint32x4_p buf1, buf2, buf3, buf4;
+    uint32x4_p  ff0,  ff1;
+
+    row1 = ff0 = VecLoad32LE(state.h()+0, le_mask);
+    row2 = ff1 = VecLoad32LE(state.h()+4, le_mask);
+    row3 = VecLoad32(BLAKE2S_IV+0);
+    row4 = VecXor(VecLoad32(BLAKE2S_IV+4), VecLoad32(state.t()+0));
+
+    BLAKE2S_ROUND(0);
+    BLAKE2S_ROUND(1);
+    BLAKE2S_ROUND(2);
+    BLAKE2S_ROUND(3);
+    BLAKE2S_ROUND(4);
+    BLAKE2S_ROUND(5);
+    BLAKE2S_ROUND(6);
+    BLAKE2S_ROUND(7);
+    BLAKE2S_ROUND(8);
+    BLAKE2S_ROUND(9);
+
+    VecStore32LE(state.h()+0, VecXor(ff0, VecXor(row1, row3)), le_mask);
+    VecStore32LE(state.h()+4, VecXor(ff1, VecXor(row2, row4)), le_mask);
+}
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/blowfish.cpp b/runtime/third_party/cryptopp/blowfish.cpp
new file mode 100644
index 0000000..f5c30d4
--- /dev/null
+++ b/runtime/third_party/cryptopp/blowfish.cpp
@@ -0,0 +1,99 @@
+// blowfish.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "blowfish.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void Blowfish::Base::UncheckedSetKey(const byte *key_string, unsigned int keylength, const NameValuePairs &)
+{
+	AssertValidKeyLength(keylength);
+
+	unsigned i, j=0, k;
+	word32 data, dspace[2] = {0, 0};
+
+	std::memcpy(pbox, p_init, sizeof(p_init));
+	std::memcpy(sbox, s_init, sizeof(s_init));
+
+	// Xor key string into encryption key vector
+	for (i=0 ; i<ROUNDS+2 ; ++i)
+	{
+		data = 0 ;
+		for (k=0 ; k<4 ; ++k )
+			data = (data << 8) | key_string[j++ % keylength];
+		pbox[i] ^= data;
+	}
+
+	crypt_block(dspace, pbox);
+
+	for (i=0; i<ROUNDS; i+=2)
+		crypt_block(pbox+i, pbox+i+2);
+
+	crypt_block(pbox+ROUNDS, sbox);
+
+	for (i=0; i<4*256-2; i+=2)
+		crypt_block(sbox+i, sbox+i+2);
+
+	if (!IsForwardTransformation())
+		for (i=0; i<(ROUNDS+2)/2; i++)
+			std::swap(pbox[i], pbox[ROUNDS+1-i]);
+}
+
+// this version is only used to make pbox and sbox
+void Blowfish::Base::crypt_block(const word32 in[2], word32 out[2]) const
+{
+	word32 left = in[0];
+	word32 right = in[1];
+
+	const word32 *const s=sbox;
+	const word32 *p=pbox;
+
+	left ^= p[0];
+
+	for (unsigned i=0; i<ROUNDS/2; i++)
+	{
+		right ^= (((s[GETBYTE(left,3)] + s[256+GETBYTE(left,2)])
+			  ^ s[2*256+GETBYTE(left,1)]) + s[3*256+GETBYTE(left,0)])
+			  ^ p[2*i+1];
+
+		left ^= (((s[GETBYTE(right,3)] + s[256+GETBYTE(right,2)])
+			 ^ s[2*256+GETBYTE(right,1)]) + s[3*256+GETBYTE(right,0)])
+			 ^ p[2*i+2];
+	}
+
+	right ^= p[ROUNDS+1];
+
+	out[0] = right;
+	out[1] = left;
+}
+
+void Blowfish::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	typedef BlockGetAndPut<word32, BigEndian> Block;
+
+	word32 left, right;
+	Block::Get(inBlock)(left)(right);
+
+	const word32 *const s=sbox;
+	const word32 *p=pbox;
+
+	left ^= p[0];
+
+	for (unsigned i=0; i<ROUNDS/2; i++)
+	{
+		right ^= (((s[GETBYTE(left,3)] + s[256+GETBYTE(left,2)])
+			  ^ s[2*256+GETBYTE(left,1)]) + s[3*256+GETBYTE(left,0)])
+			  ^ p[2*i+1];
+
+		left ^= (((s[GETBYTE(right,3)] + s[256+GETBYTE(right,2)])
+			 ^ s[2*256+GETBYTE(right,1)]) + s[3*256+GETBYTE(right,0)])
+			 ^ p[2*i+2];
+	}
+
+	right ^= p[ROUNDS+1];
+
+	Block::Put(xorBlock, outBlock)(right)(left);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/blowfish.h b/runtime/third_party/cryptopp/blowfish.h
new file mode 100644
index 0000000..8032491
--- /dev/null
+++ b/runtime/third_party/cryptopp/blowfish.h
@@ -0,0 +1,54 @@
+// blowfish.h - originally written and placed in the public domain by Wei Dai
+
+/// \file blowfish.h
+/// \brief Classes for the Blowfish block cipher
+
+#ifndef CRYPTOPP_BLOWFISH_H
+#define CRYPTOPP_BLOWFISH_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Blowfish block cipher information
+struct Blowfish_Info : public FixedBlockSize<8>, public VariableKeyLength<16, 4, 56>, public FixedRounds<16>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "Blowfish";}
+};
+
+// <a href="http://www.cryptopp.com/wiki/Blowfish">Blowfish</a>
+
+/// \brief Blowfish block cipher
+/// \since Crypto++ 1.0
+class Blowfish : public Blowfish_Info, public BlockCipherDocumentation
+{
+	/// \brief Class specific implementation and overrides used to operate the cipher.
+	/// \details Implementations and overrides in \p Base apply to both \p ENCRYPTION and \p DECRYPTION directions
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<Blowfish_Info>
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+		void UncheckedSetKey(const byte *key_string, unsigned int keylength, const NameValuePairs &params);
+
+	private:
+		void crypt_block(const word32 in[2], word32 out[2]) const;
+
+		static const word32 p_init[ROUNDS+2];
+		static const word32 s_init[4*256];
+
+		FixedSizeSecBlock<word32, ROUNDS+2> pbox;
+		FixedSizeSecBlock<word32, 4*256> sbox;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+typedef Blowfish::Encryption BlowfishEncryption;
+typedef Blowfish::Decryption BlowfishDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/blumshub.cpp b/runtime/third_party/cryptopp/blumshub.cpp
new file mode 100644
index 0000000..0e2620f
--- /dev/null
+++ b/runtime/third_party/cryptopp/blumshub.cpp
@@ -0,0 +1,64 @@
+// blumshub.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "blumshub.h"
+#include "integer.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+PublicBlumBlumShub::PublicBlumBlumShub(const Integer &n, const Integer &seed)
+	: modn(n),
+	  current(modn.Square(modn.Square(seed))),
+	  maxBits(BitPrecision(n.BitCount())-1),
+	  bitsLeft(maxBits)
+{
+}
+
+unsigned int PublicBlumBlumShub::GenerateBit()
+{
+	if (bitsLeft==0)
+	{
+		current = modn.Square(current);
+		bitsLeft = maxBits;
+	}
+
+	return static_cast<unsigned int>(current.GetBit(--bitsLeft));
+}
+
+byte PublicBlumBlumShub::GenerateByte()
+{
+	byte b=0;
+	for (int i=0; i<8; i++)
+		b = byte((b << 1) | PublicBlumBlumShub::GenerateBit());
+	return b;
+}
+
+void PublicBlumBlumShub::GenerateBlock(byte *output, size_t size)
+{
+	while (size--)
+		*output++ = PublicBlumBlumShub::GenerateByte();
+}
+
+void PublicBlumBlumShub::ProcessData(byte *outString, const byte *inString, size_t length)
+{
+	while (length--)
+		*outString++ = *inString++ ^ PublicBlumBlumShub::GenerateByte();
+}
+
+BlumBlumShub::BlumBlumShub(const Integer &p, const Integer &q, const Integer &seed)
+	: PublicBlumBlumShub(p*q, seed),
+	  p(p), q(q),
+	  x0(modn.Square(seed))
+{
+}
+
+void BlumBlumShub::Seek(lword index)
+{
+	Integer i(Integer::POSITIVE, index);
+	i *= 8;
+	Integer e = a_exp_b_mod_c (2, i / maxBits + 1, (p-1)*(q-1));
+	current = modn.Exponentiate(x0, e);
+	bitsLeft = maxBits - i % maxBits;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/blumshub.h b/runtime/third_party/cryptopp/blumshub.h
new file mode 100644
index 0000000..997a515
--- /dev/null
+++ b/runtime/third_party/cryptopp/blumshub.h
@@ -0,0 +1,70 @@
+// blumshub.h - originally written and placed in the public domain by Wei Dai
+
+/// \file blumshub.h
+/// \brief Classes for Blum Blum Shub generator
+
+#ifndef CRYPTOPP_BLUMSHUB_H
+#define CRYPTOPP_BLUMSHUB_H
+
+#include "cryptlib.h"
+#include "modarith.h"
+#include "integer.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief BlumBlumShub without factorization of the modulus
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+class PublicBlumBlumShub : public RandomNumberGenerator,
+						   public StreamTransformation
+{
+public:
+	virtual ~PublicBlumBlumShub() {}
+
+	/// \brief Construct a PublicBlumBlumShub
+	/// \param n the modulus
+	/// \param seed the seed for the generator
+	/// \details seed is the secret key and should be about as large as n.
+	PublicBlumBlumShub(const Integer &n, const Integer &seed);
+
+	unsigned int GenerateBit();
+	byte GenerateByte();
+	void GenerateBlock(byte *output, size_t size);
+	void ProcessData(byte *outString, const byte *inString, size_t length);
+
+	bool IsSelfInverting() const {return true;}
+	bool IsForwardTransformation() const {return true;}
+
+protected:
+	ModularArithmetic modn;
+	Integer current;
+	word maxBits, bitsLeft;
+};
+
+/// \brief BlumBlumShub with factorization of the modulus
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+class BlumBlumShub : public PublicBlumBlumShub
+{
+public:
+	virtual ~BlumBlumShub() {}
+
+	/// \brief Construct a BlumBlumShub
+	/// \param p the first prime factor
+	/// \param q the second prime factor
+	/// \param seed the seed for the generator
+	/// \details Esure p and q are both primes congruent to 3 mod 4 and at least 512 bits long.
+	///  seed is the secret key and should be about as large as p*q.
+	BlumBlumShub(const Integer &p, const Integer &q, const Integer &seed);
+
+	bool IsRandomAccess() const {return true;}
+	void Seek(lword index);
+
+protected:
+	const Integer p, q;
+	const Integer x0;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/camellia.cpp b/runtime/third_party/cryptopp/camellia.cpp
new file mode 100644
index 0000000..a6593d9
--- /dev/null
+++ b/runtime/third_party/cryptopp/camellia.cpp
@@ -0,0 +1,539 @@
+// camellia.cpp - by Kevin Springle, 2003
+// This code is hereby placed in the public domain.
+
+/*
+Optimisations and defense against timing attacks added in Jan 2007 by Wei Dai.
+
+The first 2 rounds and the last round seem especially vulnerable to timing
+attacks. The protection is similar to what was implemented for Rijndael.
+See comments at top of rijndael.cpp for more details.
+*/
+
+#include "pch.h"
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4456)
+# if (CRYPTOPP_MSC_VERSION >= 1400)
+#  pragma warning(disable: 6246)
+# endif
+#endif
+
+#include "camellia.h"
+#include "misc.h"
+#include "cpu.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// round implementation that uses a small table for protection against timing attacks
+#define SLOW_ROUND(lh, ll, rh, rl, kh, kl)	{							\
+	word32 zr = ll ^ kl;												\
+	word32 zl = lh ^ kh;												\
+	zr=	rotlConstant<1>(s1[GETBYTE(zr, 3)]) |							\
+		(rotrConstant<1>(s1[GETBYTE(zr, 2)]) << 24) |					\
+		(s1[rotlConstant<1>(CRYPTOPP_GET_BYTE_AS_BYTE(zr, 1))] << 16) |	\
+		(s1[GETBYTE(zr, 0)] << 8);										\
+	zl=	(s1[GETBYTE(zl, 3)] << 24) |									\
+		(rotlConstant<1>(s1[GETBYTE(zl, 2)]) << 16) |					\
+		(rotrConstant<1>(s1[GETBYTE(zl, 1)]) << 8) |					\
+		s1[rotlConstant<1>(CRYPTOPP_GET_BYTE_AS_BYTE(zl, 0))];			\
+	zl ^= zr;															\
+	zr = zl ^ rotlConstant<8>(zr);										\
+	zl = zr ^ rotrConstant<8>(zl);										\
+	rh ^= rotlConstant<16>(zr);											\
+	rh ^= zl;															\
+	rl ^= rotlConstant<8>(zl);											\
+	}
+
+// normal round - same output as above but using larger tables for faster speed
+#define ROUND(lh, ll, rh, rl, kh, kl)	{	\
+	word32 th = lh ^ kh;					\
+	word32 tl = ll ^ kl;					\
+	word32 d = SP[0][GETBYTE(tl,0)] ^ SP[1][GETBYTE(tl,3)] ^ SP[2][GETBYTE(tl,2)] ^ SP[3][GETBYTE(tl,1)];	\
+	word32 u = SP[0][GETBYTE(th,3)] ^ SP[1][GETBYTE(th,2)] ^ SP[2][GETBYTE(th,1)] ^ SP[3][GETBYTE(th,0)];	\
+	d ^= u;									\
+	rh ^= d;								\
+	rl ^= d;								\
+	rl ^= rotrConstant<8>(u);}
+
+#define DOUBLE_ROUND(lh, ll, rh, rl, k0, k1, k2, k3)	\
+	ROUND(lh, ll, rh, rl, k0, k1)						\
+	ROUND(rh, rl, lh, ll, k2, k3)
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+#define EFI(i) (1-(i))
+#else
+#define EFI(i) (i)
+#endif
+
+void Camellia::Base::UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &)
+{
+	m_rounds = (keylen >= 24) ? 4 : 3;
+	unsigned int kslen = (8 * m_rounds + 2);
+	m_key.New(kslen*2);
+	word32 *ks32 = m_key.data();
+	int m=0, a=0;
+	if (!IsForwardTransformation())
+		m = -1, a = kslen-1;
+
+	word32 kl0, kl1, kl2, kl3;
+	GetBlock<word32, BigEndian> getBlock(key);
+	getBlock(kl0)(kl1)(kl2)(kl3);
+	word32 k0=kl0, k1=kl1, k2=kl2, k3=kl3;
+
+#define CALC_ADDR2(base, i, j)	((byte *)(base)+8*(i)+4*(j)+((-16*(i))&m))
+#define CALC_ADDR(base, i)	CALC_ADDR2(base, i, 0)
+
+#if 1
+	word64 kwl, kwr;
+	ks32 += 2*a;
+#define PREPARE_KS_ROUNDS			\
+	kwl = (word64(k0) << 32) | k1;	\
+	kwr = (word64(k2) << 32) | k3
+#define KS_ROUND_0(i)							\
+	CRYPTOPP_ASSERT(IsAlignedOn(CALC_ADDR(ks32, i+EFI(0)),GetAlignmentOf<word64>()));	\
+	CRYPTOPP_ASSERT(IsAlignedOn(CALC_ADDR(ks32, i+EFI(1)),GetAlignmentOf<word64>()));	\
+	*(word64*)(void*)CALC_ADDR(ks32, i+EFI(0)) = kwl;	\
+	*(word64*)(void*)CALC_ADDR(ks32, i+EFI(1)) = kwr
+#define KS_ROUND(i, r, which)																						\
+	CRYPTOPP_ASSERT(IsAlignedOn(CALC_ADDR(ks32, i+EFI(r<64)),GetAlignmentOf<word64>()));	\
+	CRYPTOPP_ASSERT(IsAlignedOn(CALC_ADDR(ks32, i+EFI(r>64)),GetAlignmentOf<word64>()));	\
+	if (which & (1<<int(r<64))) *(word64*)(void*)CALC_ADDR(ks32, i+EFI(r<64)) = (kwr << (r%64)) | (kwl >> (64 - (r%64)));	\
+	if (which & (1<<int(r>64))) *(word64*)(void*)CALC_ADDR(ks32, i+EFI(r>64)) = (kwl << (r%64)) | (kwr >> (64 - (r%64)))
+#else
+	// SSE2 version is 30% faster on Intel Core 2. Doesn't seem worth the hassle of maintenance, but left here
+	// #if'd out in case someone needs it.
+	__m128i kw, kw2;
+	__m128i *ks128 = (__m128i *)ks32+a/2;
+	ks32 += 2*a;
+#define PREPARE_KS_ROUNDS													\
+	kw = _mm_set_epi32(k0, k1, k2, k3);										\
+	if (m) kw2 = kw, kw = _mm_shuffle_epi32(kw, _MM_SHUFFLE(1, 0, 3, 2));	\
+	else kw2 = _mm_shuffle_epi32(kw, _MM_SHUFFLE(1, 0, 3, 2))
+#define KS_ROUND_0(i)										\
+	_mm_store_si128((__m128i *)CALC_ADDR(ks128, i), kw)
+#define KS_ROUND(i, r, which)	{																				\
+	__m128i temp;																								\
+	if (r<64 && (which!=1 || m)) temp = _mm_or_si128(_mm_slli_epi64(kw, r%64), _mm_srli_epi64(kw2, 64-r%64));	\
+	else temp = _mm_or_si128(_mm_slli_epi64(kw2, r%64), _mm_srli_epi64(kw, 64-r%64));							\
+	if (which & 2) _mm_store_si128((__m128i *)CALC_ADDR(ks128, i), temp);										\
+	else _mm_storel_epi64((__m128i*)CALC_ADDR(ks32, i+EFI(0)), temp);											\
+	}
+#endif
+
+	if (keylen == 16)
+	{
+		// KL
+		PREPARE_KS_ROUNDS;
+		KS_ROUND_0(0);
+		KS_ROUND(4, 15, 3);
+		KS_ROUND(10, 45, 3);
+		KS_ROUND(12, 60, 2);
+		KS_ROUND(16, 77, 3);
+		KS_ROUND(18, 94, 3);
+		KS_ROUND(22, 111, 3);
+
+		// KA
+		k0=kl0, k1=kl1, k2=kl2, k3=kl3;
+		DOUBLE_ROUND(k0, k1, k2, k3, 0xA09E667Ful, 0x3BCC908Bul, 0xB67AE858ul, 0x4CAA73B2ul);
+		k0^=kl0, k1^=kl1, k2^=kl2, k3^=kl3;
+		DOUBLE_ROUND(k0, k1, k2, k3, 0xC6EF372Ful, 0xE94F82BEul, 0x54FF53A5ul, 0xF1D36F1Cul);
+
+		PREPARE_KS_ROUNDS;
+		KS_ROUND_0(2);
+		KS_ROUND(6, 15, 3);
+		KS_ROUND(8, 30, 3);
+		KS_ROUND(12, 45, 1);
+		KS_ROUND(14, 60, 3);
+		KS_ROUND(20, 94, 3);
+		KS_ROUND(24, 47, 3);
+	}
+	else
+	{
+		// KL
+		PREPARE_KS_ROUNDS;
+		KS_ROUND_0(0);
+		KS_ROUND(12, 45, 3);
+		KS_ROUND(16, 60, 3);
+		KS_ROUND(22, 77, 3);
+		KS_ROUND(30, 111, 3);
+
+		// KR
+		word32 kr0, kr1, kr2, kr3;
+		GetBlock<word32, BigEndian>(key+16)(kr0)(kr1);
+		if (keylen == 24)
+			kr2 = ~kr0, kr3 = ~kr1;
+		else
+			GetBlock<word32, BigEndian>(key+24)(kr2)(kr3);
+		k0=kr0, k1=kr1, k2=kr2, k3=kr3;
+
+		PREPARE_KS_ROUNDS;
+		KS_ROUND(4, 15, 3);
+		KS_ROUND(8, 30, 3);
+		KS_ROUND(18, 60, 3);
+		KS_ROUND(26, 94, 3);
+
+		// KA
+		k0^=kl0, k1^=kl1, k2^=kl2, k3^=kl3;
+		DOUBLE_ROUND(k0, k1, k2, k3, 0xA09E667Ful, 0x3BCC908Bul, 0xB67AE858ul, 0x4CAA73B2ul);
+		k0^=kl0, k1^=kl1, k2^=kl2, k3^=kl3;
+		DOUBLE_ROUND(k0, k1, k2, k3, 0xC6EF372Ful, 0xE94F82BEul, 0x54FF53A5ul, 0xF1D36F1Cul);
+
+		PREPARE_KS_ROUNDS;
+		KS_ROUND(6, 15, 3);
+		KS_ROUND(14, 45, 3);
+		KS_ROUND(24, 77, 3);
+		KS_ROUND(28, 94, 3);
+
+		// KB
+		k0^=kr0, k1^=kr1, k2^=kr2, k3^=kr3;
+		DOUBLE_ROUND(k0, k1, k2, k3, 0x10E527FAul, 0xDE682D1Dul, 0xB05688C2ul, 0xB3E6C1FDul);
+
+		PREPARE_KS_ROUNDS;
+		KS_ROUND_0(2);
+		KS_ROUND(10, 30, 3);
+		KS_ROUND(20, 60, 3);
+		KS_ROUND(32, 47, 3);
+	}
+}
+
+void Camellia::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+#define KS(i, j) ks[i*4 + EFI(j/2)*2 + EFI(j%2)]
+
+#define FL(klh, kll, krh, krl)		\
+	ll ^= rotlConstant<1>(lh & klh);\
+	lh ^= (ll | kll);				\
+	rh ^= (rl | krl);				\
+	rl ^= rotlConstant<1>(rh & krh);
+
+	word32 lh, ll, rh, rl;
+	typedef BlockGetAndPut<word32, BigEndian> Block;
+	Block::Get(inBlock)(lh)(ll)(rh)(rl);
+	const word32 *ks = m_key.data();
+	lh ^= KS(0,0);
+	ll ^= KS(0,1);
+	rh ^= KS(0,2);
+	rl ^= KS(0,3);
+
+	// Timing attack countermeasure. see comments in Rijndael for more details
+	const int cacheLineSize = GetCacheLineSize();
+	unsigned int i;
+	volatile word32 _u = 0;
+	word32 u = _u;
+
+	for (i=0; i<256; i+=cacheLineSize)
+		u &= *(const word32 *)(void*)(s1+i);
+	u &= *(const word32 *)(void*)(s1+252);
+	lh |= u; ll |= u;
+
+	SLOW_ROUND(lh, ll, rh, rl, KS(1,0), KS(1,1))
+	SLOW_ROUND(rh, rl, lh, ll, KS(1,2), KS(1,3))
+	for (i = m_rounds-1; i > 0; --i)
+	{
+		DOUBLE_ROUND(lh, ll, rh, rl, KS(2,0), KS(2,1), KS(2,2), KS(2,3))
+		DOUBLE_ROUND(lh, ll, rh, rl, KS(3,0), KS(3,1), KS(3,2), KS(3,3))
+		FL(KS(4,0), KS(4,1), KS(4,2), KS(4,3));
+		DOUBLE_ROUND(lh, ll, rh, rl, KS(5,0), KS(5,1), KS(5,2), KS(5,3))
+		ks += 16;
+	}
+	DOUBLE_ROUND(lh, ll, rh, rl, KS(2,0), KS(2,1), KS(2,2), KS(2,3))
+	ROUND(lh, ll, rh, rl, KS(3,0), KS(3,1))
+	SLOW_ROUND(rh, rl, lh, ll, KS(3,2), KS(3,3))
+	lh ^= KS(4,0);
+	ll ^= KS(4,1);
+	rh ^= KS(4,2);
+	rl ^= KS(4,3);
+	Block::Put(xorBlock, outBlock)(rh)(rl)(lh)(ll);
+}
+
+// The Camellia s-boxes
+
+CRYPTOPP_ALIGN_DATA(4)
+const byte Camellia::Base::s1[256] =
+{
+	112,130,44,236,179,39,192,229,228,133,87,53,234,12,174,65,
+	35,239,107,147,69,25,165,33,237,14,79,78,29,101,146,189,
+	134,184,175,143,124,235,31,206,62,48,220,95,94,197,11,26,
+	166,225,57,202,213,71,93,61,217,1,90,214,81,86,108,77,
+	139,13,154,102,251,204,176,45,116,18,43,32,240,177,132,153,
+	223,76,203,194,52,126,118,5,109,183,169,49,209,23,4,215,
+	20,88,58,97,222,27,17,28,50,15,156,22,83,24,242,34,
+	254,68,207,178,195,181,122,145,36,8,232,168,96,252,105,80,
+	170,208,160,125,161,137,98,151,84,91,30,149,224,255,100,210,
+	16,196,0,72,163,247,117,219,138,3,230,218,9,63,221,148,
+	135,92,131,2,205,74,144,51,115,103,246,243,157,127,191,226,
+	82,155,216,38,200,55,198,59,129,150,111,75,19,190,99,46,
+	233,121,167,140,159,110,188,142,41,245,249,182,47,253,180,89,
+	120,152,6,106,231,70,113,186,212,37,171,66,136,162,141,250,
+	114,7,185,85,248,238,172,10,54,73,42,104,60,56,241,164,
+	64,40,211,123,187,201,67,193,21,227,173,244,119,199,128,158
+};
+
+const word32 Camellia::Base::SP[4][256] = {
+	{
+	0x70707000, 0x82828200, 0x2c2c2c00, 0xececec00,
+	0xb3b3b300, 0x27272700, 0xc0c0c000, 0xe5e5e500,
+	0xe4e4e400, 0x85858500, 0x57575700, 0x35353500,
+	0xeaeaea00, 0x0c0c0c00, 0xaeaeae00, 0x41414100,
+	0x23232300, 0xefefef00, 0x6b6b6b00, 0x93939300,
+	0x45454500, 0x19191900, 0xa5a5a500, 0x21212100,
+	0xededed00, 0x0e0e0e00, 0x4f4f4f00, 0x4e4e4e00,
+	0x1d1d1d00, 0x65656500, 0x92929200, 0xbdbdbd00,
+	0x86868600, 0xb8b8b800, 0xafafaf00, 0x8f8f8f00,
+	0x7c7c7c00, 0xebebeb00, 0x1f1f1f00, 0xcecece00,
+	0x3e3e3e00, 0x30303000, 0xdcdcdc00, 0x5f5f5f00,
+	0x5e5e5e00, 0xc5c5c500, 0x0b0b0b00, 0x1a1a1a00,
+	0xa6a6a600, 0xe1e1e100, 0x39393900, 0xcacaca00,
+	0xd5d5d500, 0x47474700, 0x5d5d5d00, 0x3d3d3d00,
+	0xd9d9d900, 0x01010100, 0x5a5a5a00, 0xd6d6d600,
+	0x51515100, 0x56565600, 0x6c6c6c00, 0x4d4d4d00,
+	0x8b8b8b00, 0x0d0d0d00, 0x9a9a9a00, 0x66666600,
+	0xfbfbfb00, 0xcccccc00, 0xb0b0b000, 0x2d2d2d00,
+	0x74747400, 0x12121200, 0x2b2b2b00, 0x20202000,
+	0xf0f0f000, 0xb1b1b100, 0x84848400, 0x99999900,
+	0xdfdfdf00, 0x4c4c4c00, 0xcbcbcb00, 0xc2c2c200,
+	0x34343400, 0x7e7e7e00, 0x76767600, 0x05050500,
+	0x6d6d6d00, 0xb7b7b700, 0xa9a9a900, 0x31313100,
+	0xd1d1d100, 0x17171700, 0x04040400, 0xd7d7d700,
+	0x14141400, 0x58585800, 0x3a3a3a00, 0x61616100,
+	0xdedede00, 0x1b1b1b00, 0x11111100, 0x1c1c1c00,
+	0x32323200, 0x0f0f0f00, 0x9c9c9c00, 0x16161600,
+	0x53535300, 0x18181800, 0xf2f2f200, 0x22222200,
+	0xfefefe00, 0x44444400, 0xcfcfcf00, 0xb2b2b200,
+	0xc3c3c300, 0xb5b5b500, 0x7a7a7a00, 0x91919100,
+	0x24242400, 0x08080800, 0xe8e8e800, 0xa8a8a800,
+	0x60606000, 0xfcfcfc00, 0x69696900, 0x50505000,
+	0xaaaaaa00, 0xd0d0d000, 0xa0a0a000, 0x7d7d7d00,
+	0xa1a1a100, 0x89898900, 0x62626200, 0x97979700,
+	0x54545400, 0x5b5b5b00, 0x1e1e1e00, 0x95959500,
+	0xe0e0e000, 0xffffff00, 0x64646400, 0xd2d2d200,
+	0x10101000, 0xc4c4c400, 0x00000000, 0x48484800,
+	0xa3a3a300, 0xf7f7f700, 0x75757500, 0xdbdbdb00,
+	0x8a8a8a00, 0x03030300, 0xe6e6e600, 0xdadada00,
+	0x09090900, 0x3f3f3f00, 0xdddddd00, 0x94949400,
+	0x87878700, 0x5c5c5c00, 0x83838300, 0x02020200,
+	0xcdcdcd00, 0x4a4a4a00, 0x90909000, 0x33333300,
+	0x73737300, 0x67676700, 0xf6f6f600, 0xf3f3f300,
+	0x9d9d9d00, 0x7f7f7f00, 0xbfbfbf00, 0xe2e2e200,
+	0x52525200, 0x9b9b9b00, 0xd8d8d800, 0x26262600,
+	0xc8c8c800, 0x37373700, 0xc6c6c600, 0x3b3b3b00,
+	0x81818100, 0x96969600, 0x6f6f6f00, 0x4b4b4b00,
+	0x13131300, 0xbebebe00, 0x63636300, 0x2e2e2e00,
+	0xe9e9e900, 0x79797900, 0xa7a7a700, 0x8c8c8c00,
+	0x9f9f9f00, 0x6e6e6e00, 0xbcbcbc00, 0x8e8e8e00,
+	0x29292900, 0xf5f5f500, 0xf9f9f900, 0xb6b6b600,
+	0x2f2f2f00, 0xfdfdfd00, 0xb4b4b400, 0x59595900,
+	0x78787800, 0x98989800, 0x06060600, 0x6a6a6a00,
+	0xe7e7e700, 0x46464600, 0x71717100, 0xbababa00,
+	0xd4d4d400, 0x25252500, 0xababab00, 0x42424200,
+	0x88888800, 0xa2a2a200, 0x8d8d8d00, 0xfafafa00,
+	0x72727200, 0x07070700, 0xb9b9b900, 0x55555500,
+	0xf8f8f800, 0xeeeeee00, 0xacacac00, 0x0a0a0a00,
+	0x36363600, 0x49494900, 0x2a2a2a00, 0x68686800,
+	0x3c3c3c00, 0x38383800, 0xf1f1f100, 0xa4a4a400,
+	0x40404000, 0x28282800, 0xd3d3d300, 0x7b7b7b00,
+	0xbbbbbb00, 0xc9c9c900, 0x43434300, 0xc1c1c100,
+	0x15151500, 0xe3e3e300, 0xadadad00, 0xf4f4f400,
+	0x77777700, 0xc7c7c700, 0x80808000, 0x9e9e9e00
+	},
+	{
+	0x00e0e0e0, 0x00050505, 0x00585858, 0x00d9d9d9,
+	0x00676767, 0x004e4e4e, 0x00818181, 0x00cbcbcb,
+	0x00c9c9c9, 0x000b0b0b, 0x00aeaeae, 0x006a6a6a,
+	0x00d5d5d5, 0x00181818, 0x005d5d5d, 0x00828282,
+	0x00464646, 0x00dfdfdf, 0x00d6d6d6, 0x00272727,
+	0x008a8a8a, 0x00323232, 0x004b4b4b, 0x00424242,
+	0x00dbdbdb, 0x001c1c1c, 0x009e9e9e, 0x009c9c9c,
+	0x003a3a3a, 0x00cacaca, 0x00252525, 0x007b7b7b,
+	0x000d0d0d, 0x00717171, 0x005f5f5f, 0x001f1f1f,
+	0x00f8f8f8, 0x00d7d7d7, 0x003e3e3e, 0x009d9d9d,
+	0x007c7c7c, 0x00606060, 0x00b9b9b9, 0x00bebebe,
+	0x00bcbcbc, 0x008b8b8b, 0x00161616, 0x00343434,
+	0x004d4d4d, 0x00c3c3c3, 0x00727272, 0x00959595,
+	0x00ababab, 0x008e8e8e, 0x00bababa, 0x007a7a7a,
+	0x00b3b3b3, 0x00020202, 0x00b4b4b4, 0x00adadad,
+	0x00a2a2a2, 0x00acacac, 0x00d8d8d8, 0x009a9a9a,
+	0x00171717, 0x001a1a1a, 0x00353535, 0x00cccccc,
+	0x00f7f7f7, 0x00999999, 0x00616161, 0x005a5a5a,
+	0x00e8e8e8, 0x00242424, 0x00565656, 0x00404040,
+	0x00e1e1e1, 0x00636363, 0x00090909, 0x00333333,
+	0x00bfbfbf, 0x00989898, 0x00979797, 0x00858585,
+	0x00686868, 0x00fcfcfc, 0x00ececec, 0x000a0a0a,
+	0x00dadada, 0x006f6f6f, 0x00535353, 0x00626262,
+	0x00a3a3a3, 0x002e2e2e, 0x00080808, 0x00afafaf,
+	0x00282828, 0x00b0b0b0, 0x00747474, 0x00c2c2c2,
+	0x00bdbdbd, 0x00363636, 0x00222222, 0x00383838,
+	0x00646464, 0x001e1e1e, 0x00393939, 0x002c2c2c,
+	0x00a6a6a6, 0x00303030, 0x00e5e5e5, 0x00444444,
+	0x00fdfdfd, 0x00888888, 0x009f9f9f, 0x00656565,
+	0x00878787, 0x006b6b6b, 0x00f4f4f4, 0x00232323,
+	0x00484848, 0x00101010, 0x00d1d1d1, 0x00515151,
+	0x00c0c0c0, 0x00f9f9f9, 0x00d2d2d2, 0x00a0a0a0,
+	0x00555555, 0x00a1a1a1, 0x00414141, 0x00fafafa,
+	0x00434343, 0x00131313, 0x00c4c4c4, 0x002f2f2f,
+	0x00a8a8a8, 0x00b6b6b6, 0x003c3c3c, 0x002b2b2b,
+	0x00c1c1c1, 0x00ffffff, 0x00c8c8c8, 0x00a5a5a5,
+	0x00202020, 0x00898989, 0x00000000, 0x00909090,
+	0x00474747, 0x00efefef, 0x00eaeaea, 0x00b7b7b7,
+	0x00151515, 0x00060606, 0x00cdcdcd, 0x00b5b5b5,
+	0x00121212, 0x007e7e7e, 0x00bbbbbb, 0x00292929,
+	0x000f0f0f, 0x00b8b8b8, 0x00070707, 0x00040404,
+	0x009b9b9b, 0x00949494, 0x00212121, 0x00666666,
+	0x00e6e6e6, 0x00cecece, 0x00ededed, 0x00e7e7e7,
+	0x003b3b3b, 0x00fefefe, 0x007f7f7f, 0x00c5c5c5,
+	0x00a4a4a4, 0x00373737, 0x00b1b1b1, 0x004c4c4c,
+	0x00919191, 0x006e6e6e, 0x008d8d8d, 0x00767676,
+	0x00030303, 0x002d2d2d, 0x00dedede, 0x00969696,
+	0x00262626, 0x007d7d7d, 0x00c6c6c6, 0x005c5c5c,
+	0x00d3d3d3, 0x00f2f2f2, 0x004f4f4f, 0x00191919,
+	0x003f3f3f, 0x00dcdcdc, 0x00797979, 0x001d1d1d,
+	0x00525252, 0x00ebebeb, 0x00f3f3f3, 0x006d6d6d,
+	0x005e5e5e, 0x00fbfbfb, 0x00696969, 0x00b2b2b2,
+	0x00f0f0f0, 0x00313131, 0x000c0c0c, 0x00d4d4d4,
+	0x00cfcfcf, 0x008c8c8c, 0x00e2e2e2, 0x00757575,
+	0x00a9a9a9, 0x004a4a4a, 0x00575757, 0x00848484,
+	0x00111111, 0x00454545, 0x001b1b1b, 0x00f5f5f5,
+	0x00e4e4e4, 0x000e0e0e, 0x00737373, 0x00aaaaaa,
+	0x00f1f1f1, 0x00dddddd, 0x00595959, 0x00141414,
+	0x006c6c6c, 0x00929292, 0x00545454, 0x00d0d0d0,
+	0x00787878, 0x00707070, 0x00e3e3e3, 0x00494949,
+	0x00808080, 0x00505050, 0x00a7a7a7, 0x00f6f6f6,
+	0x00777777, 0x00939393, 0x00868686, 0x00838383,
+	0x002a2a2a, 0x00c7c7c7, 0x005b5b5b, 0x00e9e9e9,
+	0x00eeeeee, 0x008f8f8f, 0x00010101, 0x003d3d3d
+	},
+	{
+	0x38003838, 0x41004141, 0x16001616, 0x76007676,
+	0xd900d9d9, 0x93009393, 0x60006060, 0xf200f2f2,
+	0x72007272, 0xc200c2c2, 0xab00abab, 0x9a009a9a,
+	0x75007575, 0x06000606, 0x57005757, 0xa000a0a0,
+	0x91009191, 0xf700f7f7, 0xb500b5b5, 0xc900c9c9,
+	0xa200a2a2, 0x8c008c8c, 0xd200d2d2, 0x90009090,
+	0xf600f6f6, 0x07000707, 0xa700a7a7, 0x27002727,
+	0x8e008e8e, 0xb200b2b2, 0x49004949, 0xde00dede,
+	0x43004343, 0x5c005c5c, 0xd700d7d7, 0xc700c7c7,
+	0x3e003e3e, 0xf500f5f5, 0x8f008f8f, 0x67006767,
+	0x1f001f1f, 0x18001818, 0x6e006e6e, 0xaf00afaf,
+	0x2f002f2f, 0xe200e2e2, 0x85008585, 0x0d000d0d,
+	0x53005353, 0xf000f0f0, 0x9c009c9c, 0x65006565,
+	0xea00eaea, 0xa300a3a3, 0xae00aeae, 0x9e009e9e,
+	0xec00ecec, 0x80008080, 0x2d002d2d, 0x6b006b6b,
+	0xa800a8a8, 0x2b002b2b, 0x36003636, 0xa600a6a6,
+	0xc500c5c5, 0x86008686, 0x4d004d4d, 0x33003333,
+	0xfd00fdfd, 0x66006666, 0x58005858, 0x96009696,
+	0x3a003a3a, 0x09000909, 0x95009595, 0x10001010,
+	0x78007878, 0xd800d8d8, 0x42004242, 0xcc00cccc,
+	0xef00efef, 0x26002626, 0xe500e5e5, 0x61006161,
+	0x1a001a1a, 0x3f003f3f, 0x3b003b3b, 0x82008282,
+	0xb600b6b6, 0xdb00dbdb, 0xd400d4d4, 0x98009898,
+	0xe800e8e8, 0x8b008b8b, 0x02000202, 0xeb00ebeb,
+	0x0a000a0a, 0x2c002c2c, 0x1d001d1d, 0xb000b0b0,
+	0x6f006f6f, 0x8d008d8d, 0x88008888, 0x0e000e0e,
+	0x19001919, 0x87008787, 0x4e004e4e, 0x0b000b0b,
+	0xa900a9a9, 0x0c000c0c, 0x79007979, 0x11001111,
+	0x7f007f7f, 0x22002222, 0xe700e7e7, 0x59005959,
+	0xe100e1e1, 0xda00dada, 0x3d003d3d, 0xc800c8c8,
+	0x12001212, 0x04000404, 0x74007474, 0x54005454,
+	0x30003030, 0x7e007e7e, 0xb400b4b4, 0x28002828,
+	0x55005555, 0x68006868, 0x50005050, 0xbe00bebe,
+	0xd000d0d0, 0xc400c4c4, 0x31003131, 0xcb00cbcb,
+	0x2a002a2a, 0xad00adad, 0x0f000f0f, 0xca00caca,
+	0x70007070, 0xff00ffff, 0x32003232, 0x69006969,
+	0x08000808, 0x62006262, 0x00000000, 0x24002424,
+	0xd100d1d1, 0xfb00fbfb, 0xba00baba, 0xed00eded,
+	0x45004545, 0x81008181, 0x73007373, 0x6d006d6d,
+	0x84008484, 0x9f009f9f, 0xee00eeee, 0x4a004a4a,
+	0xc300c3c3, 0x2e002e2e, 0xc100c1c1, 0x01000101,
+	0xe600e6e6, 0x25002525, 0x48004848, 0x99009999,
+	0xb900b9b9, 0xb300b3b3, 0x7b007b7b, 0xf900f9f9,
+	0xce00cece, 0xbf00bfbf, 0xdf00dfdf, 0x71007171,
+	0x29002929, 0xcd00cdcd, 0x6c006c6c, 0x13001313,
+	0x64006464, 0x9b009b9b, 0x63006363, 0x9d009d9d,
+	0xc000c0c0, 0x4b004b4b, 0xb700b7b7, 0xa500a5a5,
+	0x89008989, 0x5f005f5f, 0xb100b1b1, 0x17001717,
+	0xf400f4f4, 0xbc00bcbc, 0xd300d3d3, 0x46004646,
+	0xcf00cfcf, 0x37003737, 0x5e005e5e, 0x47004747,
+	0x94009494, 0xfa00fafa, 0xfc00fcfc, 0x5b005b5b,
+	0x97009797, 0xfe00fefe, 0x5a005a5a, 0xac00acac,
+	0x3c003c3c, 0x4c004c4c, 0x03000303, 0x35003535,
+	0xf300f3f3, 0x23002323, 0xb800b8b8, 0x5d005d5d,
+	0x6a006a6a, 0x92009292, 0xd500d5d5, 0x21002121,
+	0x44004444, 0x51005151, 0xc600c6c6, 0x7d007d7d,
+	0x39003939, 0x83008383, 0xdc00dcdc, 0xaa00aaaa,
+	0x7c007c7c, 0x77007777, 0x56005656, 0x05000505,
+	0x1b001b1b, 0xa400a4a4, 0x15001515, 0x34003434,
+	0x1e001e1e, 0x1c001c1c, 0xf800f8f8, 0x52005252,
+	0x20002020, 0x14001414, 0xe900e9e9, 0xbd00bdbd,
+	0xdd00dddd, 0xe400e4e4, 0xa100a1a1, 0xe000e0e0,
+	0x8a008a8a, 0xf100f1f1, 0xd600d6d6, 0x7a007a7a,
+	0xbb00bbbb, 0xe300e3e3, 0x40004040, 0x4f004f4f
+	},
+	{
+	0x70700070, 0x2c2c002c, 0xb3b300b3, 0xc0c000c0,
+	0xe4e400e4, 0x57570057, 0xeaea00ea, 0xaeae00ae,
+	0x23230023, 0x6b6b006b, 0x45450045, 0xa5a500a5,
+	0xeded00ed, 0x4f4f004f, 0x1d1d001d, 0x92920092,
+	0x86860086, 0xafaf00af, 0x7c7c007c, 0x1f1f001f,
+	0x3e3e003e, 0xdcdc00dc, 0x5e5e005e, 0x0b0b000b,
+	0xa6a600a6, 0x39390039, 0xd5d500d5, 0x5d5d005d,
+	0xd9d900d9, 0x5a5a005a, 0x51510051, 0x6c6c006c,
+	0x8b8b008b, 0x9a9a009a, 0xfbfb00fb, 0xb0b000b0,
+	0x74740074, 0x2b2b002b, 0xf0f000f0, 0x84840084,
+	0xdfdf00df, 0xcbcb00cb, 0x34340034, 0x76760076,
+	0x6d6d006d, 0xa9a900a9, 0xd1d100d1, 0x04040004,
+	0x14140014, 0x3a3a003a, 0xdede00de, 0x11110011,
+	0x32320032, 0x9c9c009c, 0x53530053, 0xf2f200f2,
+	0xfefe00fe, 0xcfcf00cf, 0xc3c300c3, 0x7a7a007a,
+	0x24240024, 0xe8e800e8, 0x60600060, 0x69690069,
+	0xaaaa00aa, 0xa0a000a0, 0xa1a100a1, 0x62620062,
+	0x54540054, 0x1e1e001e, 0xe0e000e0, 0x64640064,
+	0x10100010, 0x00000000, 0xa3a300a3, 0x75750075,
+	0x8a8a008a, 0xe6e600e6, 0x09090009, 0xdddd00dd,
+	0x87870087, 0x83830083, 0xcdcd00cd, 0x90900090,
+	0x73730073, 0xf6f600f6, 0x9d9d009d, 0xbfbf00bf,
+	0x52520052, 0xd8d800d8, 0xc8c800c8, 0xc6c600c6,
+	0x81810081, 0x6f6f006f, 0x13130013, 0x63630063,
+	0xe9e900e9, 0xa7a700a7, 0x9f9f009f, 0xbcbc00bc,
+	0x29290029, 0xf9f900f9, 0x2f2f002f, 0xb4b400b4,
+	0x78780078, 0x06060006, 0xe7e700e7, 0x71710071,
+	0xd4d400d4, 0xabab00ab, 0x88880088, 0x8d8d008d,
+	0x72720072, 0xb9b900b9, 0xf8f800f8, 0xacac00ac,
+	0x36360036, 0x2a2a002a, 0x3c3c003c, 0xf1f100f1,
+	0x40400040, 0xd3d300d3, 0xbbbb00bb, 0x43430043,
+	0x15150015, 0xadad00ad, 0x77770077, 0x80800080,
+	0x82820082, 0xecec00ec, 0x27270027, 0xe5e500e5,
+	0x85850085, 0x35350035, 0x0c0c000c, 0x41410041,
+	0xefef00ef, 0x93930093, 0x19190019, 0x21210021,
+	0x0e0e000e, 0x4e4e004e, 0x65650065, 0xbdbd00bd,
+	0xb8b800b8, 0x8f8f008f, 0xebeb00eb, 0xcece00ce,
+	0x30300030, 0x5f5f005f, 0xc5c500c5, 0x1a1a001a,
+	0xe1e100e1, 0xcaca00ca, 0x47470047, 0x3d3d003d,
+	0x01010001, 0xd6d600d6, 0x56560056, 0x4d4d004d,
+	0x0d0d000d, 0x66660066, 0xcccc00cc, 0x2d2d002d,
+	0x12120012, 0x20200020, 0xb1b100b1, 0x99990099,
+	0x4c4c004c, 0xc2c200c2, 0x7e7e007e, 0x05050005,
+	0xb7b700b7, 0x31310031, 0x17170017, 0xd7d700d7,
+	0x58580058, 0x61610061, 0x1b1b001b, 0x1c1c001c,
+	0x0f0f000f, 0x16160016, 0x18180018, 0x22220022,
+	0x44440044, 0xb2b200b2, 0xb5b500b5, 0x91910091,
+	0x08080008, 0xa8a800a8, 0xfcfc00fc, 0x50500050,
+	0xd0d000d0, 0x7d7d007d, 0x89890089, 0x97970097,
+	0x5b5b005b, 0x95950095, 0xffff00ff, 0xd2d200d2,
+	0xc4c400c4, 0x48480048, 0xf7f700f7, 0xdbdb00db,
+	0x03030003, 0xdada00da, 0x3f3f003f, 0x94940094,
+	0x5c5c005c, 0x02020002, 0x4a4a004a, 0x33330033,
+	0x67670067, 0xf3f300f3, 0x7f7f007f, 0xe2e200e2,
+	0x9b9b009b, 0x26260026, 0x37370037, 0x3b3b003b,
+	0x96960096, 0x4b4b004b, 0xbebe00be, 0x2e2e002e,
+	0x79790079, 0x8c8c008c, 0x6e6e006e, 0x8e8e008e,
+	0xf5f500f5, 0xb6b600b6, 0xfdfd00fd, 0x59590059,
+	0x98980098, 0x6a6a006a, 0x46460046, 0xbaba00ba,
+	0x25250025, 0x42420042, 0xa2a200a2, 0xfafa00fa,
+	0x07070007, 0x55550055, 0xeeee00ee, 0x0a0a000a,
+	0x49490049, 0x68680068, 0x38380038, 0xa4a400a4,
+	0x28280028, 0x7b7b007b, 0xc9c900c9, 0xc1c100c1,
+	0xe3e300e3, 0xf4f400f4, 0xc7c700c7, 0x9e9e009e
+	}};
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/camellia.h b/runtime/third_party/cryptopp/camellia.h
new file mode 100644
index 0000000..2d551dc
--- /dev/null
+++ b/runtime/third_party/cryptopp/camellia.h
@@ -0,0 +1,49 @@
+// camellia.h - originally written and placed in the public domain by Wei Dai
+
+/// \file camellia.h
+/// \brief Classes for the Camellia block cipher
+
+#ifndef CRYPTOPP_CAMELLIA_H
+#define CRYPTOPP_CAMELLIA_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Camellia block cipher information
+struct Camellia_Info : public FixedBlockSize<16>, public VariableKeyLength<16, 16, 32, 8>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "Camellia";}
+};
+
+/// \brief Camellia block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/Camellia">Camellia</a>
+class Camellia : public Camellia_Info, public BlockCipherDocumentation
+{
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<Camellia_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &params);
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+	protected:
+		CRYPTOPP_ALIGN_DATA(4) static const byte s1[256];
+		static const word32 SP[4][256];
+
+		unsigned int m_rounds;
+		SecBlock<word32> m_key;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+typedef Camellia::Encryption CamelliaEncryption;
+typedef Camellia::Decryption CamelliaDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/cast.cpp b/runtime/third_party/cryptopp/cast.cpp
new file mode 100644
index 0000000..a2e75b3
--- /dev/null
+++ b/runtime/third_party/cryptopp/cast.cpp
@@ -0,0 +1,292 @@
+// cast.cpp - originally written and placed in the public domain by Wei Dai and Leonard Janke
+// based on Steve Reid's public domain cast.c
+
+#include "pch.h"
+#include "cast.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/* Macros to access 8-bit bytes out of a 32-bit word */
+#define U8a(x) GETBYTE(x,3)
+#define U8b(x) GETBYTE(x,2)
+#define U8c(x) GETBYTE(x,1)
+#define U8d(x) GETBYTE(x,0)
+
+/* CAST uses three different round functions */
+#define f1(l, r, km, kr) \
+	t = rotlVariable(km + r, kr); \
+	l ^= ((S[0][U8a(t)] ^ S[1][U8b(t)]) - \
+	 S[2][U8c(t)]) + S[3][U8d(t)];
+#define f2(l, r, km, kr) \
+	t = rotlVariable(km ^ r, kr); \
+	l ^= ((S[0][U8a(t)] - S[1][U8b(t)]) + \
+	 S[2][U8c(t)]) ^ S[3][U8d(t)];
+#define f3(l, r, km, kr) \
+	t = rotlVariable(km - r, kr); \
+	l ^= ((S[0][U8a(t)] + S[1][U8b(t)]) ^ \
+	 S[2][U8c(t)]) - S[3][U8d(t)];
+
+#define F1(l, r, i, j) f1(l, r, K[i], K[i+j])
+#define F2(l, r, i, j) f2(l, r, K[i], K[i+j])
+#define F3(l, r, i, j) f3(l, r, K[i], K[i+j])
+
+typedef BlockGetAndPut<word32, BigEndian> Block;
+
+void CAST128::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 &t=m_t[0], &l=m_t[1], &r=m_t[2];
+
+	/* Get inblock into l,r */
+	Block::Get(inBlock)(l)(r);
+	/* Do the work */
+	F1(l, r,  0, 16);
+	F2(r, l,  1, 16);
+	F3(l, r,  2, 16);
+	F1(r, l,  3, 16);
+	F2(l, r,  4, 16);
+	F3(r, l,  5, 16);
+	F1(l, r,  6, 16);
+	F2(r, l,  7, 16);
+	F3(l, r,  8, 16);
+	F1(r, l,  9, 16);
+	F2(l, r, 10, 16);
+	F3(r, l, 11, 16);
+	/* Only do full 16 rounds if key length > 80 bits */
+	if (!reduced) {
+		F1(l, r, 12, 16);
+		F2(r, l, 13, 16);
+		F3(l, r, 14, 16);
+		F1(r, l, 15, 16);
+	}
+	/* Put l,r into outblock */
+	Block::Put(xorBlock, outBlock)(r)(l);
+}
+
+void CAST128::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 &t=m_t[0], &l=m_t[1], &r=m_t[2];
+
+	/* Get inblock into l,r */
+	Block::Get(inBlock)(r)(l);
+	/* Only do full 16 rounds if key length > 80 bits */
+	if (!reduced) {
+		F1(r, l, 15, 16);
+		F3(l, r, 14, 16);
+		F2(r, l, 13, 16);
+		F1(l, r, 12, 16);
+	}
+	F3(r, l, 11, 16);
+	F2(l, r, 10, 16);
+	F1(r, l,  9, 16);
+	F3(l, r,  8, 16);
+	F2(r, l,  7, 16);
+	F1(l, r,  6, 16);
+	F3(r, l,  5, 16);
+	F2(l, r,  4, 16);
+	F1(r, l,  3, 16);
+	F3(l, r,  2, 16);
+	F2(r, l,  1, 16);
+	F1(l, r,  0, 16);
+	/* Put l,r into outblock */
+	Block::Put(xorBlock, outBlock)(l)(r);
+}
+
+void CAST128::Base::UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &)
+{
+	AssertValidKeyLength(keylength);
+
+	reduced = (keylength <= 10);
+
+	word32 X[4], Z[4]={0};
+	GetUserKey(BIG_ENDIAN_ORDER, X, 4, userKey, keylength);
+
+#define x(i) GETBYTE(X[i/4], 3-i%4)
+#define z(i) GETBYTE(Z[i/4], 3-i%4)
+
+	unsigned int i;
+	for (i=0; i<=16; i+=16)
+	{
+		// this part is copied directly from RFC 2144 (with some search and replace) by Wei Dai
+		Z[0] = X[0] ^ S[4][x(0xD)] ^ S[5][x(0xF)] ^ S[6][x(0xC)] ^ S[7][x(0xE)] ^ S[6][x(0x8)];
+		Z[1] = X[2] ^ S[4][z(0x0)] ^ S[5][z(0x2)] ^ S[6][z(0x1)] ^ S[7][z(0x3)] ^ S[7][x(0xA)];
+		Z[2] = X[3] ^ S[4][z(0x7)] ^ S[5][z(0x6)] ^ S[6][z(0x5)] ^ S[7][z(0x4)] ^ S[4][x(0x9)];
+		Z[3] = X[1] ^ S[4][z(0xA)] ^ S[5][z(0x9)] ^ S[6][z(0xB)] ^ S[7][z(0x8)] ^ S[5][x(0xB)];
+		K[i+0] = S[4][z(0x8)] ^ S[5][z(0x9)] ^ S[6][z(0x7)] ^ S[7][z(0x6)] ^ S[4][z(0x2)];
+		K[i+1] = S[4][z(0xA)] ^ S[5][z(0xB)] ^ S[6][z(0x5)] ^ S[7][z(0x4)] ^ S[5][z(0x6)];
+		K[i+2] = S[4][z(0xC)] ^ S[5][z(0xD)] ^ S[6][z(0x3)] ^ S[7][z(0x2)] ^ S[6][z(0x9)];
+		K[i+3] = S[4][z(0xE)] ^ S[5][z(0xF)] ^ S[6][z(0x1)] ^ S[7][z(0x0)] ^ S[7][z(0xC)];
+		X[0] = Z[2] ^ S[4][z(0x5)] ^ S[5][z(0x7)] ^ S[6][z(0x4)] ^ S[7][z(0x6)] ^ S[6][z(0x0)];
+		X[1] = Z[0] ^ S[4][x(0x0)] ^ S[5][x(0x2)] ^ S[6][x(0x1)] ^ S[7][x(0x3)] ^ S[7][z(0x2)];
+		X[2] = Z[1] ^ S[4][x(0x7)] ^ S[5][x(0x6)] ^ S[6][x(0x5)] ^ S[7][x(0x4)] ^ S[4][z(0x1)];
+		X[3] = Z[3] ^ S[4][x(0xA)] ^ S[5][x(0x9)] ^ S[6][x(0xB)] ^ S[7][x(0x8)] ^ S[5][z(0x3)];
+		K[i+4] = S[4][x(0x3)] ^ S[5][x(0x2)] ^ S[6][x(0xC)] ^ S[7][x(0xD)] ^ S[4][x(0x8)];
+		K[i+5] = S[4][x(0x1)] ^ S[5][x(0x0)] ^ S[6][x(0xE)] ^ S[7][x(0xF)] ^ S[5][x(0xD)];
+		K[i+6] = S[4][x(0x7)] ^ S[5][x(0x6)] ^ S[6][x(0x8)] ^ S[7][x(0x9)] ^ S[6][x(0x3)];
+		K[i+7] = S[4][x(0x5)] ^ S[5][x(0x4)] ^ S[6][x(0xA)] ^ S[7][x(0xB)] ^ S[7][x(0x7)];
+		Z[0] = X[0] ^ S[4][x(0xD)] ^ S[5][x(0xF)] ^ S[6][x(0xC)] ^ S[7][x(0xE)] ^ S[6][x(0x8)];
+		Z[1] = X[2] ^ S[4][z(0x0)] ^ S[5][z(0x2)] ^ S[6][z(0x1)] ^ S[7][z(0x3)] ^ S[7][x(0xA)];
+		Z[2] = X[3] ^ S[4][z(0x7)] ^ S[5][z(0x6)] ^ S[6][z(0x5)] ^ S[7][z(0x4)] ^ S[4][x(0x9)];
+		Z[3] = X[1] ^ S[4][z(0xA)] ^ S[5][z(0x9)] ^ S[6][z(0xB)] ^ S[7][z(0x8)] ^ S[5][x(0xB)];
+		K[i+8] = S[4][z(0x3)] ^ S[5][z(0x2)] ^ S[6][z(0xC)] ^ S[7][z(0xD)] ^ S[4][z(0x9)];
+		K[i+9] = S[4][z(0x1)] ^ S[5][z(0x0)] ^ S[6][z(0xE)] ^ S[7][z(0xF)] ^ S[5][z(0xC)];
+		K[i+10] = S[4][z(0x7)] ^ S[5][z(0x6)] ^ S[6][z(0x8)] ^ S[7][z(0x9)] ^ S[6][z(0x2)];
+		K[i+11] = S[4][z(0x5)] ^ S[5][z(0x4)] ^ S[6][z(0xA)] ^ S[7][z(0xB)] ^ S[7][z(0x6)];
+		X[0] = Z[2] ^ S[4][z(0x5)] ^ S[5][z(0x7)] ^ S[6][z(0x4)] ^ S[7][z(0x6)] ^ S[6][z(0x0)];
+		X[1] = Z[0] ^ S[4][x(0x0)] ^ S[5][x(0x2)] ^ S[6][x(0x1)] ^ S[7][x(0x3)] ^ S[7][z(0x2)];
+		X[2] = Z[1] ^ S[4][x(0x7)] ^ S[5][x(0x6)] ^ S[6][x(0x5)] ^ S[7][x(0x4)] ^ S[4][z(0x1)];
+		X[3] = Z[3] ^ S[4][x(0xA)] ^ S[5][x(0x9)] ^ S[6][x(0xB)] ^ S[7][x(0x8)] ^ S[5][z(0x3)];
+		K[i+12] = S[4][x(0x8)] ^ S[5][x(0x9)] ^ S[6][x(0x7)] ^ S[7][x(0x6)] ^ S[4][x(0x3)];
+		K[i+13] = S[4][x(0xA)] ^ S[5][x(0xB)] ^ S[6][x(0x5)] ^ S[7][x(0x4)] ^ S[5][x(0x7)];
+		K[i+14] = S[4][x(0xC)] ^ S[5][x(0xD)] ^ S[6][x(0x3)] ^ S[7][x(0x2)] ^ S[6][x(0x8)];
+		K[i+15] = S[4][x(0xE)] ^ S[5][x(0xF)] ^ S[6][x(0x1)] ^ S[7][x(0x0)] ^ S[7][x(0xD)];
+	}
+
+	for (i=16; i<32; i++)
+		K[i] &= 0x1f;
+}
+
+// The following CAST-256 implementation was contributed by Leonard Janke
+
+const word32 CAST256::Base::t_m[8][24]={
+{	0x5a827999, 0xd151d6a1, 0x482133a9, 0xbef090b1, 0x35bfedb9, 0xac8f4ac1,
+	0x235ea7c9, 0x9a2e04d1, 0x10fd61d9, 0x87ccbee1, 0xfe9c1be9, 0x756b78f1,
+	0xec3ad5f9, 0x630a3301, 0xd9d99009, 0x50a8ed11, 0xc7784a19, 0x3e47a721,
+	0xb5170429, 0x2be66131, 0xa2b5be39, 0x19851b41, 0x90547849, 0x0723d551},
+{	0xc95c653a, 0x402bc242, 0xb6fb1f4a, 0x2dca7c52, 0xa499d95a, 0x1b693662,
+	0x9238936a, 0x0907f072, 0x7fd74d7a, 0xf6a6aa82, 0x6d76078a, 0xe4456492,
+	0x5b14c19a, 0xd1e41ea2, 0x48b37baa, 0xbf82d8b2, 0x365235ba, 0xad2192c2,
+	0x23f0efca, 0x9ac04cd2, 0x118fa9da, 0x885f06e2, 0xff2e63ea, 0x75fdc0f2},
+{	0x383650db, 0xaf05ade3, 0x25d50aeb, 0x9ca467f3, 0x1373c4fb, 0x8a432203,
+	0x01127f0b, 0x77e1dc13, 0xeeb1391b, 0x65809623, 0xdc4ff32b, 0x531f5033,
+	0xc9eead3b, 0x40be0a43, 0xb78d674b, 0x2e5cc453, 0xa52c215b, 0x1bfb7e63,
+	0x92cadb6b, 0x099a3873, 0x8069957b, 0xf738f283, 0x6e084f8b, 0xe4d7ac93},
+{	0xa7103c7c, 0x1ddf9984, 0x94aef68c, 0x0b7e5394, 0x824db09c, 0xf91d0da4,
+	0x6fec6aac, 0xe6bbc7b4, 0x5d8b24bc, 0xd45a81c4, 0x4b29decc, 0xc1f93bd4,
+	0x38c898dc, 0xaf97f5e4, 0x266752ec, 0x9d36aff4, 0x14060cfc, 0x8ad56a04,
+	0x01a4c70c, 0x78742414, 0xef43811c, 0x6612de24, 0xdce23b2c, 0x53b19834},
+{	0x15ea281d, 0x8cb98525, 0x0388e22d, 0x7a583f35, 0xf1279c3d, 0x67f6f945,
+	0xdec6564d, 0x5595b355, 0xcc65105d, 0x43346d65, 0xba03ca6d, 0x30d32775,
+	0xa7a2847d, 0x1e71e185, 0x95413e8d, 0x0c109b95, 0x82dff89d, 0xf9af55a5,
+	0x707eb2ad, 0xe74e0fb5, 0x5e1d6cbd, 0xd4ecc9c5, 0x4bbc26cd, 0xc28b83d5},
+{	0x84c413be, 0xfb9370c6, 0x7262cdce, 0xe9322ad6, 0x600187de, 0xd6d0e4e6,
+	0x4da041ee, 0xc46f9ef6, 0x3b3efbfe, 0xb20e5906, 0x28ddb60e, 0x9fad1316,
+	0x167c701e, 0x8d4bcd26, 0x041b2a2e, 0x7aea8736, 0xf1b9e43e, 0x68894146,
+	0xdf589e4e, 0x5627fb56, 0xccf7585e, 0x43c6b566, 0xba96126e, 0x31656f76},
+{	0xf39dff5f, 0x6a6d5c67, 0xe13cb96f, 0x580c1677, 0xcedb737f, 0x45aad087,
+	0xbc7a2d8f, 0x33498a97, 0xaa18e79f, 0x20e844a7, 0x97b7a1af, 0x0e86feb7,
+	0x85565bbf, 0xfc25b8c7, 0x72f515cf, 0xe9c472d7, 0x6093cfdf, 0xd7632ce7,
+	0x4e3289ef, 0xc501e6f7, 0x3bd143ff, 0xb2a0a107, 0x296ffe0f, 0xa03f5b17},
+{	0x6277eb00, 0xd9474808, 0x5016a510, 0xc6e60218, 0x3db55f20, 0xb484bc28,
+	0x2b541930, 0xa2237638, 0x18f2d340, 0x8fc23048, 0x06918d50, 0x7d60ea58,
+	0xf4304760, 0x6affa468, 0xe1cf0170, 0x589e5e78, 0xcf6dbb80, 0x463d1888,
+	0xbd0c7590, 0x33dbd298, 0xaaab2fa0, 0x217a8ca8, 0x9849e9b0, 0x0f1946b8}
+};
+
+const unsigned int CAST256::Base::t_r[8][24]={
+	{19, 27, 3, 11, 19, 27, 3, 11, 19, 27, 3, 11, 19, 27, 3, 11, 19, 27, 3, 11, 19, 27, 3, 11},
+	{4, 12, 20, 28, 4, 12, 20, 28, 4, 12, 20, 28, 4, 12, 20, 28, 4, 12, 20, 28, 4, 12, 20, 28},
+	{21, 29, 5, 13, 21, 29, 5, 13, 21, 29, 5, 13, 21, 29, 5, 13, 21, 29, 5, 13, 21, 29, 5, 13},
+	{6, 14, 22, 30, 6, 14, 22, 30, 6, 14, 22, 30, 6, 14, 22, 30, 6, 14, 22, 30, 6, 14, 22, 30},
+	{23, 31, 7, 15, 23, 31, 7, 15, 23, 31, 7, 15, 23, 31, 7, 15, 23, 31, 7, 15, 23, 31, 7, 15},
+	{8, 16, 24, 0, 8, 16, 24, 0, 8, 16, 24, 0, 8, 16, 24, 0, 8, 16, 24, 0, 8, 16, 24, 0},
+	{25, 1, 9, 17, 25, 1, 9, 17, 25, 1, 9, 17, 25, 1, 9, 17, 25, 1, 9, 17, 25, 1, 9, 17},
+	{10, 18, 26, 2, 10, 18, 26, 2, 10, 18, 26, 2, 10, 18, 26, 2, 10, 18, 26, 2, 10, 18, 26, 2}
+};
+
+#define Q(i) \
+	F1(block[2],block[3],8*i+4,-4); \
+	F2(block[1],block[2],8*i+5,-4); \
+	F3(block[0],block[1],8*i+6,-4); \
+	F1(block[3],block[0],8*i+7,-4);
+
+#define QBar(i) \
+	F1(block[3],block[0],8*i+7,-4); \
+	F3(block[0],block[1],8*i+6,-4); \
+	F2(block[1],block[2],8*i+5,-4); \
+	F1(block[2],block[3],8*i+4,-4);
+
+/* CAST256's encrypt/decrypt functions  are identical except for the order that
+the keys are used */
+
+void CAST256::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	// TODO: add a SecBlock workspace to the class when the ABI can change
+	word32 t, block[4];
+	Block::Get(inBlock)(block[0])(block[1])(block[2])(block[3]);
+
+	// Perform 6 forward quad rounds
+	Q(0);
+	Q(1);
+	Q(2);
+	Q(3);
+	Q(4);
+	Q(5);
+
+	// Perform 6 reverse quad rounds
+	QBar(6);
+	QBar(7);
+	QBar(8);
+	QBar(9);
+	QBar(10);
+	QBar(11);
+
+	Block::Put(xorBlock, outBlock)(block[0])(block[1])(block[2])(block[3]);
+}
+
+/* Set up a CAST-256 key */
+
+void CAST256::Base::Omega(int i, word32 kappa[8])
+{
+	word32 t;
+
+	f1(kappa[6],kappa[7],t_m[0][i],t_r[0][i]);
+	f2(kappa[5],kappa[6],t_m[1][i],t_r[1][i]);
+	f3(kappa[4],kappa[5],t_m[2][i],t_r[2][i]);
+	f1(kappa[3],kappa[4],t_m[3][i],t_r[3][i]);
+	f2(kappa[2],kappa[3],t_m[4][i],t_r[4][i]);
+	f3(kappa[1],kappa[2],t_m[5][i],t_r[5][i]);
+	f1(kappa[0],kappa[1],t_m[6][i],t_r[6][i]);
+	f2(kappa[7],kappa[0],t_m[7][i],t_r[7][i]);
+}
+
+void CAST256::Base::UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &)
+{
+	AssertValidKeyLength(keylength);
+
+	GetUserKey(BIG_ENDIAN_ORDER, kappa.begin(), 8, userKey, keylength);
+
+	for(int i=0; i<12; ++i)
+	{
+		Omega(2*i,kappa);
+		Omega(2*i+1,kappa);
+
+		K[8*i]=kappa[0] & 31;
+		K[8*i+1]=kappa[2] & 31;
+		K[8*i+2]=kappa[4] & 31;
+		K[8*i+3]=kappa[6] & 31;
+		K[8*i+4]=kappa[7];
+		K[8*i+5]=kappa[5];
+		K[8*i+6]=kappa[3];
+		K[8*i+7]=kappa[1];
+	}
+
+	if (!IsForwardTransformation())
+	{
+		for(int j=0; j<6; ++j)
+		{
+			for(int i=0; i<4; ++i)
+			{
+				int i1=8*j+i;
+				int i2=8*(11-j)+i;
+
+				CRYPTOPP_ASSERT(i1<i2);
+
+				std::swap(K[i1],K[i2]);
+				std::swap(K[i1+4],K[i2+4]);
+			}
+		}
+	}
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/cast.h b/runtime/third_party/cryptopp/cast.h
new file mode 100644
index 0000000..424cf62
--- /dev/null
+++ b/runtime/third_party/cryptopp/cast.h
@@ -0,0 +1,109 @@
+// cast.h - originally written and placed in the public domain by Wei Dai
+
+/// \file cast.h
+/// \brief Classes for the CAST-128 and CAST-256 block ciphers
+/// \since Crypto++ 2.2
+
+#ifndef CRYPTOPP_CAST_H
+#define CRYPTOPP_CAST_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief CAST block cipher base
+/// \since Crypto++ 2.2
+class CAST
+{
+protected:
+	static const word32 S[8][256];
+};
+
+/// \brief CAST128 block cipher information
+/// \since Crypto++ 2.2
+struct CAST128_Info : public FixedBlockSize<8>, public VariableKeyLength<16, 5, 16>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "CAST-128";}
+};
+
+/// \brief CAST128 block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/CAST-128">CAST-128</a>
+/// \since Crypto++ 2.2
+class CAST128 : public CAST128_Info, public BlockCipherDocumentation
+{
+	/// \brief CAST128 block cipher default operation
+	class CRYPTOPP_NO_VTABLE Base : public CAST, public BlockCipherImpl<CAST128_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		bool reduced;
+		FixedSizeSecBlock<word32, 32> K;
+		mutable FixedSizeSecBlock<word32, 3> m_t;
+	};
+
+	/// \brief CAST128 block cipher encryption operation
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief CAST128 block cipher decryption operation
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+/// \brief CAST256 block cipher information
+/// \since Crypto++ 4.0
+struct CAST256_Info : public FixedBlockSize<16>, public VariableKeyLength<16, 16, 32, 4>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "CAST-256";}
+};
+
+/// \brief CAST256 block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/CAST-256">CAST-256</a>
+/// \since Crypto++ 4.0
+class CAST256 : public CAST256_Info, public BlockCipherDocumentation
+{
+	/// \brief CAST256 block cipher default operation
+	class CRYPTOPP_NO_VTABLE Base : public CAST, public BlockCipherImpl<CAST256_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+	protected:
+		static const word32 t_m[8][24];
+		static const unsigned int t_r[8][24];
+
+		static void Omega(int i, word32 kappa[8]);
+
+		FixedSizeSecBlock<word32, 8*12> K;
+		mutable FixedSizeSecBlock<word32, 8> kappa;
+		mutable FixedSizeSecBlock<word32, 3> m_t;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+typedef CAST128::Encryption CAST128Encryption;
+typedef CAST128::Decryption CAST128Decryption;
+
+typedef CAST256::Encryption CAST256Encryption;
+typedef CAST256::Decryption CAST256Decryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/casts.cpp b/runtime/third_party/cryptopp/casts.cpp
new file mode 100644
index 0000000..16fa2b1
--- /dev/null
+++ b/runtime/third_party/cryptopp/casts.cpp
@@ -0,0 +1,545 @@
+#include "pch.h"
+#include "cast.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// CAST S-boxes
+
+const word32 CAST::S[8][256] = {
+{
+	0x30FB40D4UL, 0x9FA0FF0BUL, 0x6BECCD2FUL, 0x3F258C7AUL,
+	0x1E213F2FUL, 0x9C004DD3UL, 0x6003E540UL, 0xCF9FC949UL,
+	0xBFD4AF27UL, 0x88BBBDB5UL, 0xE2034090UL, 0x98D09675UL,
+	0x6E63A0E0UL, 0x15C361D2UL, 0xC2E7661DUL, 0x22D4FF8EUL,
+	0x28683B6FUL, 0xC07FD059UL, 0xFF2379C8UL, 0x775F50E2UL,
+	0x43C340D3UL, 0xDF2F8656UL, 0x887CA41AUL, 0xA2D2BD2DUL,
+	0xA1C9E0D6UL, 0x346C4819UL, 0x61B76D87UL, 0x22540F2FUL,
+	0x2ABE32E1UL, 0xAA54166BUL, 0x22568E3AUL, 0xA2D341D0UL,
+	0x66DB40C8UL, 0xA784392FUL, 0x004DFF2FUL, 0x2DB9D2DEUL,
+	0x97943FACUL, 0x4A97C1D8UL, 0x527644B7UL, 0xB5F437A7UL,
+	0xB82CBAEFUL, 0xD751D159UL, 0x6FF7F0EDUL, 0x5A097A1FUL,
+	0x827B68D0UL, 0x90ECF52EUL, 0x22B0C054UL, 0xBC8E5935UL,
+	0x4B6D2F7FUL, 0x50BB64A2UL, 0xD2664910UL, 0xBEE5812DUL,
+	0xB7332290UL, 0xE93B159FUL, 0xB48EE411UL, 0x4BFF345DUL,
+	0xFD45C240UL, 0xAD31973FUL, 0xC4F6D02EUL, 0x55FC8165UL,
+	0xD5B1CAADUL, 0xA1AC2DAEUL, 0xA2D4B76DUL, 0xC19B0C50UL,
+	0x882240F2UL, 0x0C6E4F38UL, 0xA4E4BFD7UL, 0x4F5BA272UL,
+	0x564C1D2FUL, 0xC59C5319UL, 0xB949E354UL, 0xB04669FEUL,
+	0xB1B6AB8AUL, 0xC71358DDUL, 0x6385C545UL, 0x110F935DUL,
+	0x57538AD5UL, 0x6A390493UL, 0xE63D37E0UL, 0x2A54F6B3UL,
+	0x3A787D5FUL, 0x6276A0B5UL, 0x19A6FCDFUL, 0x7A42206AUL,
+	0x29F9D4D5UL, 0xF61B1891UL, 0xBB72275EUL, 0xAA508167UL,
+	0x38901091UL, 0xC6B505EBUL, 0x84C7CB8CUL, 0x2AD75A0FUL,
+	0x874A1427UL, 0xA2D1936BUL, 0x2AD286AFUL, 0xAA56D291UL,
+	0xD7894360UL, 0x425C750DUL, 0x93B39E26UL, 0x187184C9UL,
+	0x6C00B32DUL, 0x73E2BB14UL, 0xA0BEBC3CUL, 0x54623779UL,
+	0x64459EABUL, 0x3F328B82UL, 0x7718CF82UL, 0x59A2CEA6UL,
+	0x04EE002EUL, 0x89FE78E6UL, 0x3FAB0950UL, 0x325FF6C2UL,
+	0x81383F05UL, 0x6963C5C8UL, 0x76CB5AD6UL, 0xD49974C9UL,
+	0xCA180DCFUL, 0x380782D5UL, 0xC7FA5CF6UL, 0x8AC31511UL,
+	0x35E79E13UL, 0x47DA91D0UL, 0xF40F9086UL, 0xA7E2419EUL,
+	0x31366241UL, 0x051EF495UL, 0xAA573B04UL, 0x4A805D8DUL,
+	0x548300D0UL, 0x00322A3CUL, 0xBF64CDDFUL, 0xBA57A68EUL,
+	0x75C6372BUL, 0x50AFD341UL, 0xA7C13275UL, 0x915A0BF5UL,
+	0x6B54BFABUL, 0x2B0B1426UL, 0xAB4CC9D7UL, 0x449CCD82UL,
+	0xF7FBF265UL, 0xAB85C5F3UL, 0x1B55DB94UL, 0xAAD4E324UL,
+	0xCFA4BD3FUL, 0x2DEAA3E2UL, 0x9E204D02UL, 0xC8BD25ACUL,
+	0xEADF55B3UL, 0xD5BD9E98UL, 0xE31231B2UL, 0x2AD5AD6CUL,
+	0x954329DEUL, 0xADBE4528UL, 0xD8710F69UL, 0xAA51C90FUL,
+	0xAA786BF6UL, 0x22513F1EUL, 0xAA51A79BUL, 0x2AD344CCUL,
+	0x7B5A41F0UL, 0xD37CFBADUL, 0x1B069505UL, 0x41ECE491UL,
+	0xB4C332E6UL, 0x032268D4UL, 0xC9600ACCUL, 0xCE387E6DUL,
+	0xBF6BB16CUL, 0x6A70FB78UL, 0x0D03D9C9UL, 0xD4DF39DEUL,
+	0xE01063DAUL, 0x4736F464UL, 0x5AD328D8UL, 0xB347CC96UL,
+	0x75BB0FC3UL, 0x98511BFBUL, 0x4FFBCC35UL, 0xB58BCF6AUL,
+	0xE11F0ABCUL, 0xBFC5FE4AUL, 0xA70AEC10UL, 0xAC39570AUL,
+	0x3F04442FUL, 0x6188B153UL, 0xE0397A2EUL, 0x5727CB79UL,
+	0x9CEB418FUL, 0x1CACD68DUL, 0x2AD37C96UL, 0x0175CB9DUL,
+	0xC69DFF09UL, 0xC75B65F0UL, 0xD9DB40D8UL, 0xEC0E7779UL,
+	0x4744EAD4UL, 0xB11C3274UL, 0xDD24CB9EUL, 0x7E1C54BDUL,
+	0xF01144F9UL, 0xD2240EB1UL, 0x9675B3FDUL, 0xA3AC3755UL,
+	0xD47C27AFUL, 0x51C85F4DUL, 0x56907596UL, 0xA5BB15E6UL,
+	0x580304F0UL, 0xCA042CF1UL, 0x011A37EAUL, 0x8DBFAADBUL,
+	0x35BA3E4AUL, 0x3526FFA0UL, 0xC37B4D09UL, 0xBC306ED9UL,
+	0x98A52666UL, 0x5648F725UL, 0xFF5E569DUL, 0x0CED63D0UL,
+	0x7C63B2CFUL, 0x700B45E1UL, 0xD5EA50F1UL, 0x85A92872UL,
+	0xAF1FBDA7UL, 0xD4234870UL, 0xA7870BF3UL, 0x2D3B4D79UL,
+	0x42E04198UL, 0x0CD0EDE7UL, 0x26470DB8UL, 0xF881814CUL,
+	0x474D6AD7UL, 0x7C0C5E5CUL, 0xD1231959UL, 0x381B7298UL,
+	0xF5D2F4DBUL, 0xAB838653UL, 0x6E2F1E23UL, 0x83719C9EUL,
+	0xBD91E046UL, 0x9A56456EUL, 0xDC39200CUL, 0x20C8C571UL,
+	0x962BDA1CUL, 0xE1E696FFUL, 0xB141AB08UL, 0x7CCA89B9UL,
+	0x1A69E783UL, 0x02CC4843UL, 0xA2F7C579UL, 0x429EF47DUL,
+	0x427B169CUL, 0x5AC9F049UL, 0xDD8F0F00UL, 0x5C8165BFUL
+},
+
+{
+	0x1F201094UL, 0xEF0BA75BUL, 0x69E3CF7EUL, 0x393F4380UL,
+	0xFE61CF7AUL, 0xEEC5207AUL, 0x55889C94UL, 0x72FC0651UL,
+	0xADA7EF79UL, 0x4E1D7235UL, 0xD55A63CEUL, 0xDE0436BAUL,
+	0x99C430EFUL, 0x5F0C0794UL, 0x18DCDB7DUL, 0xA1D6EFF3UL,
+	0xA0B52F7BUL, 0x59E83605UL, 0xEE15B094UL, 0xE9FFD909UL,
+	0xDC440086UL, 0xEF944459UL, 0xBA83CCB3UL, 0xE0C3CDFBUL,
+	0xD1DA4181UL, 0x3B092AB1UL, 0xF997F1C1UL, 0xA5E6CF7BUL,
+	0x01420DDBUL, 0xE4E7EF5BUL, 0x25A1FF41UL, 0xE180F806UL,
+	0x1FC41080UL, 0x179BEE7AUL, 0xD37AC6A9UL, 0xFE5830A4UL,
+	0x98DE8B7FUL, 0x77E83F4EUL, 0x79929269UL, 0x24FA9F7BUL,
+	0xE113C85BUL, 0xACC40083UL, 0xD7503525UL, 0xF7EA615FUL,
+	0x62143154UL, 0x0D554B63UL, 0x5D681121UL, 0xC866C359UL,
+	0x3D63CF73UL, 0xCEE234C0UL, 0xD4D87E87UL, 0x5C672B21UL,
+	0x071F6181UL, 0x39F7627FUL, 0x361E3084UL, 0xE4EB573BUL,
+	0x602F64A4UL, 0xD63ACD9CUL, 0x1BBC4635UL, 0x9E81032DUL,
+	0x2701F50CUL, 0x99847AB4UL, 0xA0E3DF79UL, 0xBA6CF38CUL,
+	0x10843094UL, 0x2537A95EUL, 0xF46F6FFEUL, 0xA1FF3B1FUL,
+	0x208CFB6AUL, 0x8F458C74UL, 0xD9E0A227UL, 0x4EC73A34UL,
+	0xFC884F69UL, 0x3E4DE8DFUL, 0xEF0E0088UL, 0x3559648DUL,
+	0x8A45388CUL, 0x1D804366UL, 0x721D9BFDUL, 0xA58684BBUL,
+	0xE8256333UL, 0x844E8212UL, 0x128D8098UL, 0xFED33FB4UL,
+	0xCE280AE1UL, 0x27E19BA5UL, 0xD5A6C252UL, 0xE49754BDUL,
+	0xC5D655DDUL, 0xEB667064UL, 0x77840B4DUL, 0xA1B6A801UL,
+	0x84DB26A9UL, 0xE0B56714UL, 0x21F043B7UL, 0xE5D05860UL,
+	0x54F03084UL, 0x066FF472UL, 0xA31AA153UL, 0xDADC4755UL,
+	0xB5625DBFUL, 0x68561BE6UL, 0x83CA6B94UL, 0x2D6ED23BUL,
+	0xECCF01DBUL, 0xA6D3D0BAUL, 0xB6803D5CUL, 0xAF77A709UL,
+	0x33B4A34CUL, 0x397BC8D6UL, 0x5EE22B95UL, 0x5F0E5304UL,
+	0x81ED6F61UL, 0x20E74364UL, 0xB45E1378UL, 0xDE18639BUL,
+	0x881CA122UL, 0xB96726D1UL, 0x8049A7E8UL, 0x22B7DA7BUL,
+	0x5E552D25UL, 0x5272D237UL, 0x79D2951CUL, 0xC60D894CUL,
+	0x488CB402UL, 0x1BA4FE5BUL, 0xA4B09F6BUL, 0x1CA815CFUL,
+	0xA20C3005UL, 0x8871DF63UL, 0xB9DE2FCBUL, 0x0CC6C9E9UL,
+	0x0BEEFF53UL, 0xE3214517UL, 0xB4542835UL, 0x9F63293CUL,
+	0xEE41E729UL, 0x6E1D2D7CUL, 0x50045286UL, 0x1E6685F3UL,
+	0xF33401C6UL, 0x30A22C95UL, 0x31A70850UL, 0x60930F13UL,
+	0x73F98417UL, 0xA1269859UL, 0xEC645C44UL, 0x52C877A9UL,
+	0xCDFF33A6UL, 0xA02B1741UL, 0x7CBAD9A2UL, 0x2180036FUL,
+	0x50D99C08UL, 0xCB3F4861UL, 0xC26BD765UL, 0x64A3F6ABUL,
+	0x80342676UL, 0x25A75E7BUL, 0xE4E6D1FCUL, 0x20C710E6UL,
+	0xCDF0B680UL, 0x17844D3BUL, 0x31EEF84DUL, 0x7E0824E4UL,
+	0x2CCB49EBUL, 0x846A3BAEUL, 0x8FF77888UL, 0xEE5D60F6UL,
+	0x7AF75673UL, 0x2FDD5CDBUL, 0xA11631C1UL, 0x30F66F43UL,
+	0xB3FAEC54UL, 0x157FD7FAUL, 0xEF8579CCUL, 0xD152DE58UL,
+	0xDB2FFD5EUL, 0x8F32CE19UL, 0x306AF97AUL, 0x02F03EF8UL,
+	0x99319AD5UL, 0xC242FA0FUL, 0xA7E3EBB0UL, 0xC68E4906UL,
+	0xB8DA230CUL, 0x80823028UL, 0xDCDEF3C8UL, 0xD35FB171UL,
+	0x088A1BC8UL, 0xBEC0C560UL, 0x61A3C9E8UL, 0xBCA8F54DUL,
+	0xC72FEFFAUL, 0x22822E99UL, 0x82C570B4UL, 0xD8D94E89UL,
+	0x8B1C34BCUL, 0x301E16E6UL, 0x273BE979UL, 0xB0FFEAA6UL,
+	0x61D9B8C6UL, 0x00B24869UL, 0xB7FFCE3FUL, 0x08DC283BUL,
+	0x43DAF65AUL, 0xF7E19798UL, 0x7619B72FUL, 0x8F1C9BA4UL,
+	0xDC8637A0UL, 0x16A7D3B1UL, 0x9FC393B7UL, 0xA7136EEBUL,
+	0xC6BCC63EUL, 0x1A513742UL, 0xEF6828BCUL, 0x520365D6UL,
+	0x2D6A77ABUL, 0x3527ED4BUL, 0x821FD216UL, 0x095C6E2EUL,
+	0xDB92F2FBUL, 0x5EEA29CBUL, 0x145892F5UL, 0x91584F7FUL,
+	0x5483697BUL, 0x2667A8CCUL, 0x85196048UL, 0x8C4BACEAUL,
+	0x833860D4UL, 0x0D23E0F9UL, 0x6C387E8AUL, 0x0AE6D249UL,
+	0xB284600CUL, 0xD835731DUL, 0xDCB1C647UL, 0xAC4C56EAUL,
+	0x3EBD81B3UL, 0x230EABB0UL, 0x6438BC87UL, 0xF0B5B1FAUL,
+	0x8F5EA2B3UL, 0xFC184642UL, 0x0A036B7AUL, 0x4FB089BDUL,
+	0x649DA589UL, 0xA345415EUL, 0x5C038323UL, 0x3E5D3BB9UL,
+	0x43D79572UL, 0x7E6DD07CUL, 0x06DFDF1EUL, 0x6C6CC4EFUL,
+	0x7160A539UL, 0x73BFBE70UL, 0x83877605UL, 0x4523ECF1UL
+},
+
+{
+	0x8DEFC240UL, 0x25FA5D9FUL, 0xEB903DBFUL, 0xE810C907UL,
+	0x47607FFFUL, 0x369FE44BUL, 0x8C1FC644UL, 0xAECECA90UL,
+	0xBEB1F9BFUL, 0xEEFBCAEAUL, 0xE8CF1950UL, 0x51DF07AEUL,
+	0x920E8806UL, 0xF0AD0548UL, 0xE13C8D83UL, 0x927010D5UL,
+	0x11107D9FUL, 0x07647DB9UL, 0xB2E3E4D4UL, 0x3D4F285EUL,
+	0xB9AFA820UL, 0xFADE82E0UL, 0xA067268BUL, 0x8272792EUL,
+	0x553FB2C0UL, 0x489AE22BUL, 0xD4EF9794UL, 0x125E3FBCUL,
+	0x21FFFCEEUL, 0x825B1BFDUL, 0x9255C5EDUL, 0x1257A240UL,
+	0x4E1A8302UL, 0xBAE07FFFUL, 0x528246E7UL, 0x8E57140EUL,
+	0x3373F7BFUL, 0x8C9F8188UL, 0xA6FC4EE8UL, 0xC982B5A5UL,
+	0xA8C01DB7UL, 0x579FC264UL, 0x67094F31UL, 0xF2BD3F5FUL,
+	0x40FFF7C1UL, 0x1FB78DFCUL, 0x8E6BD2C1UL, 0x437BE59BUL,
+	0x99B03DBFUL, 0xB5DBC64BUL, 0x638DC0E6UL, 0x55819D99UL,
+	0xA197C81CUL, 0x4A012D6EUL, 0xC5884A28UL, 0xCCC36F71UL,
+	0xB843C213UL, 0x6C0743F1UL, 0x8309893CUL, 0x0FEDDD5FUL,
+	0x2F7FE850UL, 0xD7C07F7EUL, 0x02507FBFUL, 0x5AFB9A04UL,
+	0xA747D2D0UL, 0x1651192EUL, 0xAF70BF3EUL, 0x58C31380UL,
+	0x5F98302EUL, 0x727CC3C4UL, 0x0A0FB402UL, 0x0F7FEF82UL,
+	0x8C96FDADUL, 0x5D2C2AAEUL, 0x8EE99A49UL, 0x50DA88B8UL,
+	0x8427F4A0UL, 0x1EAC5790UL, 0x796FB449UL, 0x8252DC15UL,
+	0xEFBD7D9BUL, 0xA672597DUL, 0xADA840D8UL, 0x45F54504UL,
+	0xFA5D7403UL, 0xE83EC305UL, 0x4F91751AUL, 0x925669C2UL,
+	0x23EFE941UL, 0xA903F12EUL, 0x60270DF2UL, 0x0276E4B6UL,
+	0x94FD6574UL, 0x927985B2UL, 0x8276DBCBUL, 0x02778176UL,
+	0xF8AF918DUL, 0x4E48F79EUL, 0x8F616DDFUL, 0xE29D840EUL,
+	0x842F7D83UL, 0x340CE5C8UL, 0x96BBB682UL, 0x93B4B148UL,
+	0xEF303CABUL, 0x984FAF28UL, 0x779FAF9BUL, 0x92DC560DUL,
+	0x224D1E20UL, 0x8437AA88UL, 0x7D29DC96UL, 0x2756D3DCUL,
+	0x8B907CEEUL, 0xB51FD240UL, 0xE7C07CE3UL, 0xE566B4A1UL,
+	0xC3E9615EUL, 0x3CF8209DUL, 0x6094D1E3UL, 0xCD9CA341UL,
+	0x5C76460EUL, 0x00EA983BUL, 0xD4D67881UL, 0xFD47572CUL,
+	0xF76CEDD9UL, 0xBDA8229CUL, 0x127DADAAUL, 0x438A074EUL,
+	0x1F97C090UL, 0x081BDB8AUL, 0x93A07EBEUL, 0xB938CA15UL,
+	0x97B03CFFUL, 0x3DC2C0F8UL, 0x8D1AB2ECUL, 0x64380E51UL,
+	0x68CC7BFBUL, 0xD90F2788UL, 0x12490181UL, 0x5DE5FFD4UL,
+	0xDD7EF86AUL, 0x76A2E214UL, 0xB9A40368UL, 0x925D958FUL,
+	0x4B39FFFAUL, 0xBA39AEE9UL, 0xA4FFD30BUL, 0xFAF7933BUL,
+	0x6D498623UL, 0x193CBCFAUL, 0x27627545UL, 0x825CF47AUL,
+	0x61BD8BA0UL, 0xD11E42D1UL, 0xCEAD04F4UL, 0x127EA392UL,
+	0x10428DB7UL, 0x8272A972UL, 0x9270C4A8UL, 0x127DE50BUL,
+	0x285BA1C8UL, 0x3C62F44FUL, 0x35C0EAA5UL, 0xE805D231UL,
+	0x428929FBUL, 0xB4FCDF82UL, 0x4FB66A53UL, 0x0E7DC15BUL,
+	0x1F081FABUL, 0x108618AEUL, 0xFCFD086DUL, 0xF9FF2889UL,
+	0x694BCC11UL, 0x236A5CAEUL, 0x12DECA4DUL, 0x2C3F8CC5UL,
+	0xD2D02DFEUL, 0xF8EF5896UL, 0xE4CF52DAUL, 0x95155B67UL,
+	0x494A488CUL, 0xB9B6A80CUL, 0x5C8F82BCUL, 0x89D36B45UL,
+	0x3A609437UL, 0xEC00C9A9UL, 0x44715253UL, 0x0A874B49UL,
+	0xD773BC40UL, 0x7C34671CUL, 0x02717EF6UL, 0x4FEB5536UL,
+	0xA2D02FFFUL, 0xD2BF60C4UL, 0xD43F03C0UL, 0x50B4EF6DUL,
+	0x07478CD1UL, 0x006E1888UL, 0xA2E53F55UL, 0xB9E6D4BCUL,
+	0xA2048016UL, 0x97573833UL, 0xD7207D67UL, 0xDE0F8F3DUL,
+	0x72F87B33UL, 0xABCC4F33UL, 0x7688C55DUL, 0x7B00A6B0UL,
+	0x947B0001UL, 0x570075D2UL, 0xF9BB88F8UL, 0x8942019EUL,
+	0x4264A5FFUL, 0x856302E0UL, 0x72DBD92BUL, 0xEE971B69UL,
+	0x6EA22FDEUL, 0x5F08AE2BUL, 0xAF7A616DUL, 0xE5C98767UL,
+	0xCF1FEBD2UL, 0x61EFC8C2UL, 0xF1AC2571UL, 0xCC8239C2UL,
+	0x67214CB8UL, 0xB1E583D1UL, 0xB7DC3E62UL, 0x7F10BDCEUL,
+	0xF90A5C38UL, 0x0FF0443DUL, 0x606E6DC6UL, 0x60543A49UL,
+	0x5727C148UL, 0x2BE98A1DUL, 0x8AB41738UL, 0x20E1BE24UL,
+	0xAF96DA0FUL, 0x68458425UL, 0x99833BE5UL, 0x600D457DUL,
+	0x282F9350UL, 0x8334B362UL, 0xD91D1120UL, 0x2B6D8DA0UL,
+	0x642B1E31UL, 0x9C305A00UL, 0x52BCE688UL, 0x1B03588AUL,
+	0xF7BAEFD5UL, 0x4142ED9CUL, 0xA4315C11UL, 0x83323EC5UL,
+	0xDFEF4636UL, 0xA133C501UL, 0xE9D3531CUL, 0xEE353783UL
+},
+
+{
+	0x9DB30420UL, 0x1FB6E9DEUL, 0xA7BE7BEFUL, 0xD273A298UL,
+	0x4A4F7BDBUL, 0x64AD8C57UL, 0x85510443UL, 0xFA020ED1UL,
+	0x7E287AFFUL, 0xE60FB663UL, 0x095F35A1UL, 0x79EBF120UL,
+	0xFD059D43UL, 0x6497B7B1UL, 0xF3641F63UL, 0x241E4ADFUL,
+	0x28147F5FUL, 0x4FA2B8CDUL, 0xC9430040UL, 0x0CC32220UL,
+	0xFDD30B30UL, 0xC0A5374FUL, 0x1D2D00D9UL, 0x24147B15UL,
+	0xEE4D111AUL, 0x0FCA5167UL, 0x71FF904CUL, 0x2D195FFEUL,
+	0x1A05645FUL, 0x0C13FEFEUL, 0x081B08CAUL, 0x05170121UL,
+	0x80530100UL, 0xE83E5EFEUL, 0xAC9AF4F8UL, 0x7FE72701UL,
+	0xD2B8EE5FUL, 0x06DF4261UL, 0xBB9E9B8AUL, 0x7293EA25UL,
+	0xCE84FFDFUL, 0xF5718801UL, 0x3DD64B04UL, 0xA26F263BUL,
+	0x7ED48400UL, 0x547EEBE6UL, 0x446D4CA0UL, 0x6CF3D6F5UL,
+	0x2649ABDFUL, 0xAEA0C7F5UL, 0x36338CC1UL, 0x503F7E93UL,
+	0xD3772061UL, 0x11B638E1UL, 0x72500E03UL, 0xF80EB2BBUL,
+	0xABE0502EUL, 0xEC8D77DEUL, 0x57971E81UL, 0xE14F6746UL,
+	0xC9335400UL, 0x6920318FUL, 0x081DBB99UL, 0xFFC304A5UL,
+	0x4D351805UL, 0x7F3D5CE3UL, 0xA6C866C6UL, 0x5D5BCCA9UL,
+	0xDAEC6FEAUL, 0x9F926F91UL, 0x9F46222FUL, 0x3991467DUL,
+	0xA5BF6D8EUL, 0x1143C44FUL, 0x43958302UL, 0xD0214EEBUL,
+	0x022083B8UL, 0x3FB6180CUL, 0x18F8931EUL, 0x281658E6UL,
+	0x26486E3EUL, 0x8BD78A70UL, 0x7477E4C1UL, 0xB506E07CUL,
+	0xF32D0A25UL, 0x79098B02UL, 0xE4EABB81UL, 0x28123B23UL,
+	0x69DEAD38UL, 0x1574CA16UL, 0xDF871B62UL, 0x211C40B7UL,
+	0xA51A9EF9UL, 0x0014377BUL, 0x041E8AC8UL, 0x09114003UL,
+	0xBD59E4D2UL, 0xE3D156D5UL, 0x4FE876D5UL, 0x2F91A340UL,
+	0x557BE8DEUL, 0x00EAE4A7UL, 0x0CE5C2ECUL, 0x4DB4BBA6UL,
+	0xE756BDFFUL, 0xDD3369ACUL, 0xEC17B035UL, 0x06572327UL,
+	0x99AFC8B0UL, 0x56C8C391UL, 0x6B65811CUL, 0x5E146119UL,
+	0x6E85CB75UL, 0xBE07C002UL, 0xC2325577UL, 0x893FF4ECUL,
+	0x5BBFC92DUL, 0xD0EC3B25UL, 0xB7801AB7UL, 0x8D6D3B24UL,
+	0x20C763EFUL, 0xC366A5FCUL, 0x9C382880UL, 0x0ACE3205UL,
+	0xAAC9548AUL, 0xECA1D7C7UL, 0x041AFA32UL, 0x1D16625AUL,
+	0x6701902CUL, 0x9B757A54UL, 0x31D477F7UL, 0x9126B031UL,
+	0x36CC6FDBUL, 0xC70B8B46UL, 0xD9E66A48UL, 0x56E55A79UL,
+	0x026A4CEBUL, 0x52437EFFUL, 0x2F8F76B4UL, 0x0DF980A5UL,
+	0x8674CDE3UL, 0xEDDA04EBUL, 0x17A9BE04UL, 0x2C18F4DFUL,
+	0xB7747F9DUL, 0xAB2AF7B4UL, 0xEFC34D20UL, 0x2E096B7CUL,
+	0x1741A254UL, 0xE5B6A035UL, 0x213D42F6UL, 0x2C1C7C26UL,
+	0x61C2F50FUL, 0x6552DAF9UL, 0xD2C231F8UL, 0x25130F69UL,
+	0xD8167FA2UL, 0x0418F2C8UL, 0x001A96A6UL, 0x0D1526ABUL,
+	0x63315C21UL, 0x5E0A72ECUL, 0x49BAFEFDUL, 0x187908D9UL,
+	0x8D0DBD86UL, 0x311170A7UL, 0x3E9B640CUL, 0xCC3E10D7UL,
+	0xD5CAD3B6UL, 0x0CAEC388UL, 0xF73001E1UL, 0x6C728AFFUL,
+	0x71EAE2A1UL, 0x1F9AF36EUL, 0xCFCBD12FUL, 0xC1DE8417UL,
+	0xAC07BE6BUL, 0xCB44A1D8UL, 0x8B9B0F56UL, 0x013988C3UL,
+	0xB1C52FCAUL, 0xB4BE31CDUL, 0xD8782806UL, 0x12A3A4E2UL,
+	0x6F7DE532UL, 0x58FD7EB6UL, 0xD01EE900UL, 0x24ADFFC2UL,
+	0xF4990FC5UL, 0x9711AAC5UL, 0x001D7B95UL, 0x82E5E7D2UL,
+	0x109873F6UL, 0x00613096UL, 0xC32D9521UL, 0xADA121FFUL,
+	0x29908415UL, 0x7FBB977FUL, 0xAF9EB3DBUL, 0x29C9ED2AUL,
+	0x5CE2A465UL, 0xA730F32CUL, 0xD0AA3FE8UL, 0x8A5CC091UL,
+	0xD49E2CE7UL, 0x0CE454A9UL, 0xD60ACD86UL, 0x015F1919UL,
+	0x77079103UL, 0xDEA03AF6UL, 0x78A8565EUL, 0xDEE356DFUL,
+	0x21F05CBEUL, 0x8B75E387UL, 0xB3C50651UL, 0xB8A5C3EFUL,
+	0xD8EEB6D2UL, 0xE523BE77UL, 0xC2154529UL, 0x2F69EFDFUL,
+	0xAFE67AFBUL, 0xF470C4B2UL, 0xF3E0EB5BUL, 0xD6CC9876UL,
+	0x39E4460CUL, 0x1FDA8538UL, 0x1987832FUL, 0xCA007367UL,
+	0xA99144F8UL, 0x296B299EUL, 0x492FC295UL, 0x9266BEABUL,
+	0xB5676E69UL, 0x9BD3DDDAUL, 0xDF7E052FUL, 0xDB25701CUL,
+	0x1B5E51EEUL, 0xF65324E6UL, 0x6AFCE36CUL, 0x0316CC04UL,
+	0x8644213EUL, 0xB7DC59D0UL, 0x7965291FUL, 0xCCD6FD43UL,
+	0x41823979UL, 0x932BCDF6UL, 0xB657C34DUL, 0x4EDFD282UL,
+	0x7AE5290CUL, 0x3CB9536BUL, 0x851E20FEUL, 0x9833557EUL,
+	0x13ECF0B0UL, 0xD3FFB372UL, 0x3F85C5C1UL, 0x0AEF7ED2UL
+},
+
+{
+	0x7EC90C04UL, 0x2C6E74B9UL, 0x9B0E66DFUL, 0xA6337911UL,
+	0xB86A7FFFUL, 0x1DD358F5UL, 0x44DD9D44UL, 0x1731167FUL,
+	0x08FBF1FAUL, 0xE7F511CCUL, 0xD2051B00UL, 0x735ABA00UL,
+	0x2AB722D8UL, 0x386381CBUL, 0xACF6243AUL, 0x69BEFD7AUL,
+	0xE6A2E77FUL, 0xF0C720CDUL, 0xC4494816UL, 0xCCF5C180UL,
+	0x38851640UL, 0x15B0A848UL, 0xE68B18CBUL, 0x4CAADEFFUL,
+	0x5F480A01UL, 0x0412B2AAUL, 0x259814FCUL, 0x41D0EFE2UL,
+	0x4E40B48DUL, 0x248EB6FBUL, 0x8DBA1CFEUL, 0x41A99B02UL,
+	0x1A550A04UL, 0xBA8F65CBUL, 0x7251F4E7UL, 0x95A51725UL,
+	0xC106ECD7UL, 0x97A5980AUL, 0xC539B9AAUL, 0x4D79FE6AUL,
+	0xF2F3F763UL, 0x68AF8040UL, 0xED0C9E56UL, 0x11B4958BUL,
+	0xE1EB5A88UL, 0x8709E6B0UL, 0xD7E07156UL, 0x4E29FEA7UL,
+	0x6366E52DUL, 0x02D1C000UL, 0xC4AC8E05UL, 0x9377F571UL,
+	0x0C05372AUL, 0x578535F2UL, 0x2261BE02UL, 0xD642A0C9UL,
+	0xDF13A280UL, 0x74B55BD2UL, 0x682199C0UL, 0xD421E5ECUL,
+	0x53FB3CE8UL, 0xC8ADEDB3UL, 0x28A87FC9UL, 0x3D959981UL,
+	0x5C1FF900UL, 0xFE38D399UL, 0x0C4EFF0BUL, 0x062407EAUL,
+	0xAA2F4FB1UL, 0x4FB96976UL, 0x90C79505UL, 0xB0A8A774UL,
+	0xEF55A1FFUL, 0xE59CA2C2UL, 0xA6B62D27UL, 0xE66A4263UL,
+	0xDF65001FUL, 0x0EC50966UL, 0xDFDD55BCUL, 0x29DE0655UL,
+	0x911E739AUL, 0x17AF8975UL, 0x32C7911CUL, 0x89F89468UL,
+	0x0D01E980UL, 0x524755F4UL, 0x03B63CC9UL, 0x0CC844B2UL,
+	0xBCF3F0AAUL, 0x87AC36E9UL, 0xE53A7426UL, 0x01B3D82BUL,
+	0x1A9E7449UL, 0x64EE2D7EUL, 0xCDDBB1DAUL, 0x01C94910UL,
+	0xB868BF80UL, 0x0D26F3FDUL, 0x9342EDE7UL, 0x04A5C284UL,
+	0x636737B6UL, 0x50F5B616UL, 0xF24766E3UL, 0x8ECA36C1UL,
+	0x136E05DBUL, 0xFEF18391UL, 0xFB887A37UL, 0xD6E7F7D4UL,
+	0xC7FB7DC9UL, 0x3063FCDFUL, 0xB6F589DEUL, 0xEC2941DAUL,
+	0x26E46695UL, 0xB7566419UL, 0xF654EFC5UL, 0xD08D58B7UL,
+	0x48925401UL, 0xC1BACB7FUL, 0xE5FF550FUL, 0xB6083049UL,
+	0x5BB5D0E8UL, 0x87D72E5AUL, 0xAB6A6EE1UL, 0x223A66CEUL,
+	0xC62BF3CDUL, 0x9E0885F9UL, 0x68CB3E47UL, 0x086C010FUL,
+	0xA21DE820UL, 0xD18B69DEUL, 0xF3F65777UL, 0xFA02C3F6UL,
+	0x407EDAC3UL, 0xCBB3D550UL, 0x1793084DUL, 0xB0D70EBAUL,
+	0x0AB378D5UL, 0xD951FB0CUL, 0xDED7DA56UL, 0x4124BBE4UL,
+	0x94CA0B56UL, 0x0F5755D1UL, 0xE0E1E56EUL, 0x6184B5BEUL,
+	0x580A249FUL, 0x94F74BC0UL, 0xE327888EUL, 0x9F7B5561UL,
+	0xC3DC0280UL, 0x05687715UL, 0x646C6BD7UL, 0x44904DB3UL,
+	0x66B4F0A3UL, 0xC0F1648AUL, 0x697ED5AFUL, 0x49E92FF6UL,
+	0x309E374FUL, 0x2CB6356AUL, 0x85808573UL, 0x4991F840UL,
+	0x76F0AE02UL, 0x083BE84DUL, 0x28421C9AUL, 0x44489406UL,
+	0x736E4CB8UL, 0xC1092910UL, 0x8BC95FC6UL, 0x7D869CF4UL,
+	0x134F616FUL, 0x2E77118DUL, 0xB31B2BE1UL, 0xAA90B472UL,
+	0x3CA5D717UL, 0x7D161BBAUL, 0x9CAD9010UL, 0xAF462BA2UL,
+	0x9FE459D2UL, 0x45D34559UL, 0xD9F2DA13UL, 0xDBC65487UL,
+	0xF3E4F94EUL, 0x176D486FUL, 0x097C13EAUL, 0x631DA5C7UL,
+	0x445F7382UL, 0x175683F4UL, 0xCDC66A97UL, 0x70BE0288UL,
+	0xB3CDCF72UL, 0x6E5DD2F3UL, 0x20936079UL, 0x459B80A5UL,
+	0xBE60E2DBUL, 0xA9C23101UL, 0xEBA5315CUL, 0x224E42F2UL,
+	0x1C5C1572UL, 0xF6721B2CUL, 0x1AD2FFF3UL, 0x8C25404EUL,
+	0x324ED72FUL, 0x4067B7FDUL, 0x0523138EUL, 0x5CA3BC78UL,
+	0xDC0FD66EUL, 0x75922283UL, 0x784D6B17UL, 0x58EBB16EUL,
+	0x44094F85UL, 0x3F481D87UL, 0xFCFEAE7BUL, 0x77B5FF76UL,
+	0x8C2302BFUL, 0xAAF47556UL, 0x5F46B02AUL, 0x2B092801UL,
+	0x3D38F5F7UL, 0x0CA81F36UL, 0x52AF4A8AUL, 0x66D5E7C0UL,
+	0xDF3B0874UL, 0x95055110UL, 0x1B5AD7A8UL, 0xF61ED5ADUL,
+	0x6CF6E479UL, 0x20758184UL, 0xD0CEFA65UL, 0x88F7BE58UL,
+	0x4A046826UL, 0x0FF6F8F3UL, 0xA09C7F70UL, 0x5346ABA0UL,
+	0x5CE96C28UL, 0xE176EDA3UL, 0x6BAC307FUL, 0x376829D2UL,
+	0x85360FA9UL, 0x17E3FE2AUL, 0x24B79767UL, 0xF5A96B20UL,
+	0xD6CD2595UL, 0x68FF1EBFUL, 0x7555442CUL, 0xF19F06BEUL,
+	0xF9E0659AUL, 0xEEB9491DUL, 0x34010718UL, 0xBB30CAB8UL,
+	0xE822FE15UL, 0x88570983UL, 0x750E6249UL, 0xDA627E55UL,
+	0x5E76FFA8UL, 0xB1534546UL, 0x6D47DE08UL, 0xEFE9E7D4UL
+},
+
+{
+	0xF6FA8F9DUL, 0x2CAC6CE1UL, 0x4CA34867UL, 0xE2337F7CUL,
+	0x95DB08E7UL, 0x016843B4UL, 0xECED5CBCUL, 0x325553ACUL,
+	0xBF9F0960UL, 0xDFA1E2EDUL, 0x83F0579DUL, 0x63ED86B9UL,
+	0x1AB6A6B8UL, 0xDE5EBE39UL, 0xF38FF732UL, 0x8989B138UL,
+	0x33F14961UL, 0xC01937BDUL, 0xF506C6DAUL, 0xE4625E7EUL,
+	0xA308EA99UL, 0x4E23E33CUL, 0x79CBD7CCUL, 0x48A14367UL,
+	0xA3149619UL, 0xFEC94BD5UL, 0xA114174AUL, 0xEAA01866UL,
+	0xA084DB2DUL, 0x09A8486FUL, 0xA888614AUL, 0x2900AF98UL,
+	0x01665991UL, 0xE1992863UL, 0xC8F30C60UL, 0x2E78EF3CUL,
+	0xD0D51932UL, 0xCF0FEC14UL, 0xF7CA07D2UL, 0xD0A82072UL,
+	0xFD41197EUL, 0x9305A6B0UL, 0xE86BE3DAUL, 0x74BED3CDUL,
+	0x372DA53CUL, 0x4C7F4448UL, 0xDAB5D440UL, 0x6DBA0EC3UL,
+	0x083919A7UL, 0x9FBAEED9UL, 0x49DBCFB0UL, 0x4E670C53UL,
+	0x5C3D9C01UL, 0x64BDB941UL, 0x2C0E636AUL, 0xBA7DD9CDUL,
+	0xEA6F7388UL, 0xE70BC762UL, 0x35F29ADBUL, 0x5C4CDD8DUL,
+	0xF0D48D8CUL, 0xB88153E2UL, 0x08A19866UL, 0x1AE2EAC8UL,
+	0x284CAF89UL, 0xAA928223UL, 0x9334BE53UL, 0x3B3A21BFUL,
+	0x16434BE3UL, 0x9AEA3906UL, 0xEFE8C36EUL, 0xF890CDD9UL,
+	0x80226DAEUL, 0xC340A4A3UL, 0xDF7E9C09UL, 0xA694A807UL,
+	0x5B7C5ECCUL, 0x221DB3A6UL, 0x9A69A02FUL, 0x68818A54UL,
+	0xCEB2296FUL, 0x53C0843AUL, 0xFE893655UL, 0x25BFE68AUL,
+	0xB4628ABCUL, 0xCF222EBFUL, 0x25AC6F48UL, 0xA9A99387UL,
+	0x53BDDB65UL, 0xE76FFBE7UL, 0xE967FD78UL, 0x0BA93563UL,
+	0x8E342BC1UL, 0xE8A11BE9UL, 0x4980740DUL, 0xC8087DFCUL,
+	0x8DE4BF99UL, 0xA11101A0UL, 0x7FD37975UL, 0xDA5A26C0UL,
+	0xE81F994FUL, 0x9528CD89UL, 0xFD339FEDUL, 0xB87834BFUL,
+	0x5F04456DUL, 0x22258698UL, 0xC9C4C83BUL, 0x2DC156BEUL,
+	0x4F628DAAUL, 0x57F55EC5UL, 0xE2220ABEUL, 0xD2916EBFUL,
+	0x4EC75B95UL, 0x24F2C3C0UL, 0x42D15D99UL, 0xCD0D7FA0UL,
+	0x7B6E27FFUL, 0xA8DC8AF0UL, 0x7345C106UL, 0xF41E232FUL,
+	0x35162386UL, 0xE6EA8926UL, 0x3333B094UL, 0x157EC6F2UL,
+	0x372B74AFUL, 0x692573E4UL, 0xE9A9D848UL, 0xF3160289UL,
+	0x3A62EF1DUL, 0xA787E238UL, 0xF3A5F676UL, 0x74364853UL,
+	0x20951063UL, 0x4576698DUL, 0xB6FAD407UL, 0x592AF950UL,
+	0x36F73523UL, 0x4CFB6E87UL, 0x7DA4CEC0UL, 0x6C152DAAUL,
+	0xCB0396A8UL, 0xC50DFE5DUL, 0xFCD707ABUL, 0x0921C42FUL,
+	0x89DFF0BBUL, 0x5FE2BE78UL, 0x448F4F33UL, 0x754613C9UL,
+	0x2B05D08DUL, 0x48B9D585UL, 0xDC049441UL, 0xC8098F9BUL,
+	0x7DEDE786UL, 0xC39A3373UL, 0x42410005UL, 0x6A091751UL,
+	0x0EF3C8A6UL, 0x890072D6UL, 0x28207682UL, 0xA9A9F7BEUL,
+	0xBF32679DUL, 0xD45B5B75UL, 0xB353FD00UL, 0xCBB0E358UL,
+	0x830F220AUL, 0x1F8FB214UL, 0xD372CF08UL, 0xCC3C4A13UL,
+	0x8CF63166UL, 0x061C87BEUL, 0x88C98F88UL, 0x6062E397UL,
+	0x47CF8E7AUL, 0xB6C85283UL, 0x3CC2ACFBUL, 0x3FC06976UL,
+	0x4E8F0252UL, 0x64D8314DUL, 0xDA3870E3UL, 0x1E665459UL,
+	0xC10908F0UL, 0x513021A5UL, 0x6C5B68B7UL, 0x822F8AA0UL,
+	0x3007CD3EUL, 0x74719EEFUL, 0xDC872681UL, 0x073340D4UL,
+	0x7E432FD9UL, 0x0C5EC241UL, 0x8809286CUL, 0xF592D891UL,
+	0x08A930F6UL, 0x957EF305UL, 0xB7FBFFBDUL, 0xC266E96FUL,
+	0x6FE4AC98UL, 0xB173ECC0UL, 0xBC60B42AUL, 0x953498DAUL,
+	0xFBA1AE12UL, 0x2D4BD736UL, 0x0F25FAABUL, 0xA4F3FCEBUL,
+	0xE2969123UL, 0x257F0C3DUL, 0x9348AF49UL, 0x361400BCUL,
+	0xE8816F4AUL, 0x3814F200UL, 0xA3F94043UL, 0x9C7A54C2UL,
+	0xBC704F57UL, 0xDA41E7F9UL, 0xC25AD33AUL, 0x54F4A084UL,
+	0xB17F5505UL, 0x59357CBEUL, 0xEDBD15C8UL, 0x7F97C5ABUL,
+	0xBA5AC7B5UL, 0xB6F6DEAFUL, 0x3A479C3AUL, 0x5302DA25UL,
+	0x653D7E6AUL, 0x54268D49UL, 0x51A477EAUL, 0x5017D55BUL,
+	0xD7D25D88UL, 0x44136C76UL, 0x0404A8C8UL, 0xB8E5A121UL,
+	0xB81A928AUL, 0x60ED5869UL, 0x97C55B96UL, 0xEAEC991BUL,
+	0x29935913UL, 0x01FDB7F1UL, 0x088E8DFAUL, 0x9AB6F6F5UL,
+	0x3B4CBF9FUL, 0x4A5DE3ABUL, 0xE6051D35UL, 0xA0E1D855UL,
+	0xD36B4CF1UL, 0xF544EDEBUL, 0xB0E93524UL, 0xBEBB8FBDUL,
+	0xA2D762CFUL, 0x49C92F54UL, 0x38B5F331UL, 0x7128A454UL,
+	0x48392905UL, 0xA65B1DB8UL, 0x851C97BDUL, 0xD675CF2FUL
+},
+
+{
+	0x85E04019UL, 0x332BF567UL, 0x662DBFFFUL, 0xCFC65693UL,
+	0x2A8D7F6FUL, 0xAB9BC912UL, 0xDE6008A1UL, 0x2028DA1FUL,
+	0x0227BCE7UL, 0x4D642916UL, 0x18FAC300UL, 0x50F18B82UL,
+	0x2CB2CB11UL, 0xB232E75CUL, 0x4B3695F2UL, 0xB28707DEUL,
+	0xA05FBCF6UL, 0xCD4181E9UL, 0xE150210CUL, 0xE24EF1BDUL,
+	0xB168C381UL, 0xFDE4E789UL, 0x5C79B0D8UL, 0x1E8BFD43UL,
+	0x4D495001UL, 0x38BE4341UL, 0x913CEE1DUL, 0x92A79C3FUL,
+	0x089766BEUL, 0xBAEEADF4UL, 0x1286BECFUL, 0xB6EACB19UL,
+	0x2660C200UL, 0x7565BDE4UL, 0x64241F7AUL, 0x8248DCA9UL,
+	0xC3B3AD66UL, 0x28136086UL, 0x0BD8DFA8UL, 0x356D1CF2UL,
+	0x107789BEUL, 0xB3B2E9CEUL, 0x0502AA8FUL, 0x0BC0351EUL,
+	0x166BF52AUL, 0xEB12FF82UL, 0xE3486911UL, 0xD34D7516UL,
+	0x4E7B3AFFUL, 0x5F43671BUL, 0x9CF6E037UL, 0x4981AC83UL,
+	0x334266CEUL, 0x8C9341B7UL, 0xD0D854C0UL, 0xCB3A6C88UL,
+	0x47BC2829UL, 0x4725BA37UL, 0xA66AD22BUL, 0x7AD61F1EUL,
+	0x0C5CBAFAUL, 0x4437F107UL, 0xB6E79962UL, 0x42D2D816UL,
+	0x0A961288UL, 0xE1A5C06EUL, 0x13749E67UL, 0x72FC081AUL,
+	0xB1D139F7UL, 0xF9583745UL, 0xCF19DF58UL, 0xBEC3F756UL,
+	0xC06EBA30UL, 0x07211B24UL, 0x45C28829UL, 0xC95E317FUL,
+	0xBC8EC511UL, 0x38BC46E9UL, 0xC6E6FA14UL, 0xBAE8584AUL,
+	0xAD4EBC46UL, 0x468F508BUL, 0x7829435FUL, 0xF124183BUL,
+	0x821DBA9FUL, 0xAFF60FF4UL, 0xEA2C4E6DUL, 0x16E39264UL,
+	0x92544A8BUL, 0x009B4FC3UL, 0xABA68CEDUL, 0x9AC96F78UL,
+	0x06A5B79AUL, 0xB2856E6EUL, 0x1AEC3CA9UL, 0xBE838688UL,
+	0x0E0804E9UL, 0x55F1BE56UL, 0xE7E5363BUL, 0xB3A1F25DUL,
+	0xF7DEBB85UL, 0x61FE033CUL, 0x16746233UL, 0x3C034C28UL,
+	0xDA6D0C74UL, 0x79AAC56CUL, 0x3CE4E1ADUL, 0x51F0C802UL,
+	0x98F8F35AUL, 0x1626A49FUL, 0xEED82B29UL, 0x1D382FE3UL,
+	0x0C4FB99AUL, 0xBB325778UL, 0x3EC6D97BUL, 0x6E77A6A9UL,
+	0xCB658B5CUL, 0xD45230C7UL, 0x2BD1408BUL, 0x60C03EB7UL,
+	0xB9068D78UL, 0xA33754F4UL, 0xF430C87DUL, 0xC8A71302UL,
+	0xB96D8C32UL, 0xEBD4E7BEUL, 0xBE8B9D2DUL, 0x7979FB06UL,
+	0xE7225308UL, 0x8B75CF77UL, 0x11EF8DA4UL, 0xE083C858UL,
+	0x8D6B786FUL, 0x5A6317A6UL, 0xFA5CF7A0UL, 0x5DDA0033UL,
+	0xF28EBFB0UL, 0xF5B9C310UL, 0xA0EAC280UL, 0x08B9767AUL,
+	0xA3D9D2B0UL, 0x79D34217UL, 0x021A718DUL, 0x9AC6336AUL,
+	0x2711FD60UL, 0x438050E3UL, 0x069908A8UL, 0x3D7FEDC4UL,
+	0x826D2BEFUL, 0x4EEB8476UL, 0x488DCF25UL, 0x36C9D566UL,
+	0x28E74E41UL, 0xC2610ACAUL, 0x3D49A9CFUL, 0xBAE3B9DFUL,
+	0xB65F8DE6UL, 0x92AEAF64UL, 0x3AC7D5E6UL, 0x9EA80509UL,
+	0xF22B017DUL, 0xA4173F70UL, 0xDD1E16C3UL, 0x15E0D7F9UL,
+	0x50B1B887UL, 0x2B9F4FD5UL, 0x625ABA82UL, 0x6A017962UL,
+	0x2EC01B9CUL, 0x15488AA9UL, 0xD716E740UL, 0x40055A2CUL,
+	0x93D29A22UL, 0xE32DBF9AUL, 0x058745B9UL, 0x3453DC1EUL,
+	0xD699296EUL, 0x496CFF6FUL, 0x1C9F4986UL, 0xDFE2ED07UL,
+	0xB87242D1UL, 0x19DE7EAEUL, 0x053E561AUL, 0x15AD6F8CUL,
+	0x66626C1CUL, 0x7154C24CUL, 0xEA082B2AUL, 0x93EB2939UL,
+	0x17DCB0F0UL, 0x58D4F2AEUL, 0x9EA294FBUL, 0x52CF564CUL,
+	0x9883FE66UL, 0x2EC40581UL, 0x763953C3UL, 0x01D6692EUL,
+	0xD3A0C108UL, 0xA1E7160EUL, 0xE4F2DFA6UL, 0x693ED285UL,
+	0x74904698UL, 0x4C2B0EDDUL, 0x4F757656UL, 0x5D393378UL,
+	0xA132234FUL, 0x3D321C5DUL, 0xC3F5E194UL, 0x4B269301UL,
+	0xC79F022FUL, 0x3C997E7EUL, 0x5E4F9504UL, 0x3FFAFBBDUL,
+	0x76F7AD0EUL, 0x296693F4UL, 0x3D1FCE6FUL, 0xC61E45BEUL,
+	0xD3B5AB34UL, 0xF72BF9B7UL, 0x1B0434C0UL, 0x4E72B567UL,
+	0x5592A33DUL, 0xB5229301UL, 0xCFD2A87FUL, 0x60AEB767UL,
+	0x1814386BUL, 0x30BCC33DUL, 0x38A0C07DUL, 0xFD1606F2UL,
+	0xC363519BUL, 0x589DD390UL, 0x5479F8E6UL, 0x1CB8D647UL,
+	0x97FD61A9UL, 0xEA7759F4UL, 0x2D57539DUL, 0x569A58CFUL,
+	0xE84E63ADUL, 0x462E1B78UL, 0x6580F87EUL, 0xF3817914UL,
+	0x91DA55F4UL, 0x40A230F3UL, 0xD1988F35UL, 0xB6E318D2UL,
+	0x3FFA50BCUL, 0x3D40F021UL, 0xC3C0BDAEUL, 0x4958C24CUL,
+	0x518F36B2UL, 0x84B1D370UL, 0x0FEDCE83UL, 0x878DDADAUL,
+	0xF2A279C7UL, 0x94E01BE8UL, 0x90716F4BUL, 0x954B8AA3UL
+},
+
+{
+	0xE216300DUL, 0xBBDDFFFCUL, 0xA7EBDABDUL, 0x35648095UL,
+	0x7789F8B7UL, 0xE6C1121BUL, 0x0E241600UL, 0x052CE8B5UL,
+	0x11A9CFB0UL, 0xE5952F11UL, 0xECE7990AUL, 0x9386D174UL,
+	0x2A42931CUL, 0x76E38111UL, 0xB12DEF3AUL, 0x37DDDDFCUL,
+	0xDE9ADEB1UL, 0x0A0CC32CUL, 0xBE197029UL, 0x84A00940UL,
+	0xBB243A0FUL, 0xB4D137CFUL, 0xB44E79F0UL, 0x049EEDFDUL,
+	0x0B15A15DUL, 0x480D3168UL, 0x8BBBDE5AUL, 0x669DED42UL,
+	0xC7ECE831UL, 0x3F8F95E7UL, 0x72DF191BUL, 0x7580330DUL,
+	0x94074251UL, 0x5C7DCDFAUL, 0xABBE6D63UL, 0xAA402164UL,
+	0xB301D40AUL, 0x02E7D1CAUL, 0x53571DAEUL, 0x7A3182A2UL,
+	0x12A8DDECUL, 0xFDAA335DUL, 0x176F43E8UL, 0x71FB46D4UL,
+	0x38129022UL, 0xCE949AD4UL, 0xB84769ADUL, 0x965BD862UL,
+	0x82F3D055UL, 0x66FB9767UL, 0x15B80B4EUL, 0x1D5B47A0UL,
+	0x4CFDE06FUL, 0xC28EC4B8UL, 0x57E8726EUL, 0x647A78FCUL,
+	0x99865D44UL, 0x608BD593UL, 0x6C200E03UL, 0x39DC5FF6UL,
+	0x5D0B00A3UL, 0xAE63AFF2UL, 0x7E8BD632UL, 0x70108C0CUL,
+	0xBBD35049UL, 0x2998DF04UL, 0x980CF42AUL, 0x9B6DF491UL,
+	0x9E7EDD53UL, 0x06918548UL, 0x58CB7E07UL, 0x3B74EF2EUL,
+	0x522FFFB1UL, 0xD24708CCUL, 0x1C7E27CDUL, 0xA4EB215BUL,
+	0x3CF1D2E2UL, 0x19B47A38UL, 0x424F7618UL, 0x35856039UL,
+	0x9D17DEE7UL, 0x27EB35E6UL, 0xC9AFF67BUL, 0x36BAF5B8UL,
+	0x09C467CDUL, 0xC18910B1UL, 0xE11DBF7BUL, 0x06CD1AF8UL,
+	0x7170C608UL, 0x2D5E3354UL, 0xD4DE495AUL, 0x64C6D006UL,
+	0xBCC0C62CUL, 0x3DD00DB3UL, 0x708F8F34UL, 0x77D51B42UL,
+	0x264F620FUL, 0x24B8D2BFUL, 0x15C1B79EUL, 0x46A52564UL,
+	0xF8D7E54EUL, 0x3E378160UL, 0x7895CDA5UL, 0x859C15A5UL,
+	0xE6459788UL, 0xC37BC75FUL, 0xDB07BA0CUL, 0x0676A3ABUL,
+	0x7F229B1EUL, 0x31842E7BUL, 0x24259FD7UL, 0xF8BEF472UL,
+	0x835FFCB8UL, 0x6DF4C1F2UL, 0x96F5B195UL, 0xFD0AF0FCUL,
+	0xB0FE134CUL, 0xE2506D3DUL, 0x4F9B12EAUL, 0xF215F225UL,
+	0xA223736FUL, 0x9FB4C428UL, 0x25D04979UL, 0x34C713F8UL,
+	0xC4618187UL, 0xEA7A6E98UL, 0x7CD16EFCUL, 0x1436876CUL,
+	0xF1544107UL, 0xBEDEEE14UL, 0x56E9AF27UL, 0xA04AA441UL,
+	0x3CF7C899UL, 0x92ECBAE6UL, 0xDD67016DUL, 0x151682EBUL,
+	0xA842EEDFUL, 0xFDBA60B4UL, 0xF1907B75UL, 0x20E3030FUL,
+	0x24D8C29EUL, 0xE139673BUL, 0xEFA63FB8UL, 0x71873054UL,
+	0xB6F2CF3BUL, 0x9F326442UL, 0xCB15A4CCUL, 0xB01A4504UL,
+	0xF1E47D8DUL, 0x844A1BE5UL, 0xBAE7DFDCUL, 0x42CBDA70UL,
+	0xCD7DAE0AUL, 0x57E85B7AUL, 0xD53F5AF6UL, 0x20CF4D8CUL,
+	0xCEA4D428UL, 0x79D130A4UL, 0x3486EBFBUL, 0x33D3CDDCUL,
+	0x77853B53UL, 0x37EFFCB5UL, 0xC5068778UL, 0xE580B3E6UL,
+	0x4E68B8F4UL, 0xC5C8B37EUL, 0x0D809EA2UL, 0x398FEB7CUL,
+	0x132A4F94UL, 0x43B7950EUL, 0x2FEE7D1CUL, 0x223613BDUL,
+	0xDD06CAA2UL, 0x37DF932BUL, 0xC4248289UL, 0xACF3EBC3UL,
+	0x5715F6B7UL, 0xEF3478DDUL, 0xF267616FUL, 0xC148CBE4UL,
+	0x9052815EUL, 0x5E410FABUL, 0xB48A2465UL, 0x2EDA7FA4UL,
+	0xE87B40E4UL, 0xE98EA084UL, 0x5889E9E1UL, 0xEFD390FCUL,
+	0xDD07D35BUL, 0xDB485694UL, 0x38D7E5B2UL, 0x57720101UL,
+	0x730EDEBCUL, 0x5B643113UL, 0x94917E4FUL, 0x503C2FBAUL,
+	0x646F1282UL, 0x7523D24AUL, 0xE0779695UL, 0xF9C17A8FUL,
+	0x7A5B2121UL, 0xD187B896UL, 0x29263A4DUL, 0xBA510CDFUL,
+	0x81F47C9FUL, 0xAD1163EDUL, 0xEA7B5965UL, 0x1A00726EUL,
+	0x11403092UL, 0x00DA6D77UL, 0x4A0CDD61UL, 0xAD1F4603UL,
+	0x605BDFB0UL, 0x9EEDC364UL, 0x22EBE6A8UL, 0xCEE7D28AUL,
+	0xA0E736A0UL, 0x5564A6B9UL, 0x10853209UL, 0xC7EB8F37UL,
+	0x2DE705CAUL, 0x8951570FUL, 0xDF09822BUL, 0xBD691A6CUL,
+	0xAA12E4F2UL, 0x87451C0FUL, 0xE0F6A27AUL, 0x3ADA4819UL,
+	0x4CF1764FUL, 0x0D771C2BUL, 0x67CDB156UL, 0x350D8384UL,
+	0x5938FA0FUL, 0x42399EF3UL, 0x36997B07UL, 0x0E84093DUL,
+	0x4AA93E61UL, 0x8360D87BUL, 0x1FA98B0CUL, 0x1149382CUL,
+	0xE97625A5UL, 0x0614D1B7UL, 0x0E25244BUL, 0x0C768347UL,
+	0x589E8D82UL, 0x0D2059D1UL, 0xA466BB1EUL, 0xF8DA0A82UL,
+	0x04F19130UL, 0xBA6E4EC0UL, 0x99265164UL, 0x1EE7230DUL,
+	0x50B2AD80UL, 0xEAEE6801UL, 0x8DB2A283UL, 0xEA8BF59EUL
+}};
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/cbcmac.cpp b/runtime/third_party/cryptopp/cbcmac.cpp
new file mode 100644
index 0000000..01e2bea
--- /dev/null
+++ b/runtime/third_party/cryptopp/cbcmac.cpp
@@ -0,0 +1,62 @@
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "cbcmac.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void CBC_MAC_Base::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	AccessCipher().SetKey(key, length, params);
+	m_reg.CleanNew(AccessCipher().BlockSize());
+	m_counter = 0;
+}
+
+void CBC_MAC_Base::Update(const byte *input, size_t length)
+{
+	unsigned int blockSize = AccessCipher().BlockSize();
+
+	while (m_counter && length)
+	{
+		m_reg[m_counter++] ^= *input++;
+		if (m_counter == blockSize)
+			ProcessBuf();
+		length--;
+	}
+
+	if (length >= blockSize)
+	{
+		size_t leftOver = AccessCipher().AdvancedProcessBlocks(m_reg, input, m_reg, length, BlockTransformation::BT_DontIncrementInOutPointers|BlockTransformation::BT_XorInput);
+		input += (length - leftOver);
+		length = leftOver;
+	}
+
+	while (length--)
+	{
+		m_reg[m_counter++] ^= *input++;
+		if (m_counter == blockSize)
+			ProcessBuf();
+	}
+}
+
+void CBC_MAC_Base::TruncatedFinal(byte *mac, size_t size)
+{
+	ThrowIfInvalidTruncatedSize(size);
+
+	if (m_counter)
+		ProcessBuf();
+
+	std::memcpy(mac, m_reg, size);
+	std::memset(m_reg, 0, AccessCipher().BlockSize());
+}
+
+void CBC_MAC_Base::ProcessBuf()
+{
+	AccessCipher().ProcessBlock(m_reg);
+	m_counter = 0;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/cbcmac.h b/runtime/third_party/cryptopp/cbcmac.h
new file mode 100644
index 0000000..5a0c120
--- /dev/null
+++ b/runtime/third_party/cryptopp/cbcmac.h
@@ -0,0 +1,63 @@
+// cbcmac.h - originally written and placed in the public domain by Wei Dai
+
+/// \file
+/// \brief Classes for CBC MAC
+/// \since Crypto++ 3.1
+
+#ifndef CRYPTOPP_CBCMAC_H
+#define CRYPTOPP_CBCMAC_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief CBC-MAC base class
+/// \since Crypto++ 3.1
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CBC_MAC_Base : public MessageAuthenticationCode
+{
+public:
+	CBC_MAC_Base() : m_counter(0) {}
+
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *mac, size_t size);
+	unsigned int DigestSize() const {return const_cast<CBC_MAC_Base*>(this)->AccessCipher().BlockSize();}
+
+protected:
+	virtual BlockCipher & AccessCipher() =0;
+
+private:
+	void ProcessBuf();
+	SecByteBlock m_reg;
+	unsigned int m_counter;
+};
+
+/// \brief CBC-MAC
+/// \tparam T BlockCipherDocumentation derived class
+/// \details CBC-MAC is compatible with FIPS 113. The MAC is secure only for fixed
+///   length messages. For variable length messages use CMAC or DMAC.
+/// \sa <a href="http://www.weidai.com/scan-mirror/mac.html#CBC-MAC">CBC-MAC</a>
+/// \since Crypto++ 3.1
+template <class T>
+class CBC_MAC : public MessageAuthenticationCodeImpl<CBC_MAC_Base, CBC_MAC<T> >, public SameKeyLengthAs<T>
+{
+public:
+	/// \brief Construct a CBC_MAC
+	CBC_MAC() {}
+	/// \brief Construct a CBC_MAC
+	/// \param key a byte buffer used to key the cipher
+	/// \param length the length of the byte buffer
+	CBC_MAC(const byte *key, size_t length=SameKeyLengthAs<T>::DEFAULT_KEYLENGTH)
+		{this->SetKey(key, length);}
+
+	static std::string StaticAlgorithmName() {return std::string("CBC-MAC(") + T::StaticAlgorithmName() + ")";}
+
+private:
+	BlockCipher & AccessCipher() {return m_cipher;}
+	typename T::Encryption m_cipher;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/ccm.cpp b/runtime/third_party/cryptopp/ccm.cpp
new file mode 100644
index 0000000..07d74cc
--- /dev/null
+++ b/runtime/third_party/cryptopp/ccm.cpp
@@ -0,0 +1,139 @@
+// ccm.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "ccm.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void CCM_Base::SetKeyWithoutResync(const byte *userKey, size_t keylength, const NameValuePairs &params)
+{
+	BlockCipher &blockCipher = AccessBlockCipher();
+	blockCipher.SetKey(userKey, keylength, params);
+
+	if (blockCipher.BlockSize() != REQUIRED_BLOCKSIZE)
+		throw InvalidArgument(AlgorithmName() + ": block size of underlying block cipher is not 16");
+
+	m_digestSize = params.GetIntValueWithDefault(Name::DigestSize(), DefaultDigestSize());
+	if (m_digestSize % 2 > 0 || m_digestSize < 4 || m_digestSize > 16)
+		throw InvalidArgument(AlgorithmName() + ": DigestSize must be 4, 6, 8, 10, 12, 14, or 16");
+
+	m_buffer.Grow(2*REQUIRED_BLOCKSIZE);
+	m_L = 8;
+}
+
+void CCM_Base::Resync(const byte *iv, size_t len)
+{
+	BlockCipher &cipher = AccessBlockCipher();
+
+	m_L = REQUIRED_BLOCKSIZE-1-(int)len;
+	CRYPTOPP_ASSERT(m_L >= 2);
+	if (m_L > 8)
+		m_L = 8;
+
+	m_buffer[0] = byte(m_L-1);	// flag
+	std::memcpy(m_buffer+1, iv, len);
+	std::memset(m_buffer+1+len, 0, REQUIRED_BLOCKSIZE-1-len);
+
+	if (m_state >= State_IVSet)
+		m_ctr.Resynchronize(m_buffer, REQUIRED_BLOCKSIZE);
+	else
+		m_ctr.SetCipherWithIV(cipher, m_buffer);
+
+	m_ctr.Seek(REQUIRED_BLOCKSIZE);
+	m_aadLength = 0;
+	m_messageLength = 0;
+}
+
+void CCM_Base::UncheckedSpecifyDataLengths(lword headerLength, lword messageLength, lword /*footerLength*/)
+{
+	if (m_state != State_IVSet)
+		throw BadState(AlgorithmName(), "SpecifyDataLengths", "or after State_IVSet");
+
+	m_aadLength = headerLength;
+	m_messageLength = messageLength;
+
+	byte *cbcBuffer = CBC_Buffer();
+	const BlockCipher &cipher = GetBlockCipher();
+
+	cbcBuffer[0] = byte(64*(headerLength>0) + 8*((m_digestSize-2)/2) + (m_L-1));	// flag
+	PutWord<word64>(true, BIG_ENDIAN_ORDER, cbcBuffer+REQUIRED_BLOCKSIZE-8, m_messageLength);
+	std::memcpy(cbcBuffer+1, m_buffer+1, REQUIRED_BLOCKSIZE-1-m_L);
+	cipher.ProcessBlock(cbcBuffer);
+
+	if (headerLength>0)
+	{
+		CRYPTOPP_ASSERT(m_bufferedDataLength == 0);
+
+		if (headerLength < ((1<<16) - (1<<8)))
+		{
+			PutWord<word16>(true, BIG_ENDIAN_ORDER, m_buffer, (word16)headerLength);
+			m_bufferedDataLength = 2;
+		}
+		else if (headerLength < (W64LIT(1)<<32))
+		{
+			m_buffer[0] = 0xff;
+			m_buffer[1] = 0xfe;
+			PutWord<word32>(false, BIG_ENDIAN_ORDER, m_buffer+2, (word32)headerLength);
+			m_bufferedDataLength = 6;
+		}
+		else
+		{
+			m_buffer[0] = 0xff;
+			m_buffer[1] = 0xff;
+			PutWord<word64>(false, BIG_ENDIAN_ORDER, m_buffer+2, headerLength);
+			m_bufferedDataLength = 10;
+		}
+	}
+}
+
+size_t CCM_Base::AuthenticateBlocks(const byte *data, size_t len)
+{
+	byte *cbcBuffer = CBC_Buffer();
+	const BlockCipher &cipher = GetBlockCipher();
+	return cipher.AdvancedProcessBlocks(cbcBuffer, data, cbcBuffer, len, BlockTransformation::BT_DontIncrementInOutPointers|BlockTransformation::BT_XorInput);
+}
+
+void CCM_Base::AuthenticateLastHeaderBlock()
+{
+	byte *cbcBuffer = CBC_Buffer();
+	const BlockCipher &cipher = GetBlockCipher();
+
+	if (m_aadLength != m_totalHeaderLength)
+		throw InvalidArgument(AlgorithmName() + ": header length doesn't match that given in SpecifyDataLengths");
+
+	if (m_bufferedDataLength > 0)
+	{
+		xorbuf(cbcBuffer, m_buffer, m_bufferedDataLength);
+		cipher.ProcessBlock(cbcBuffer);
+		m_bufferedDataLength = 0;
+	}
+}
+
+void CCM_Base::AuthenticateLastConfidentialBlock()
+{
+	byte *cbcBuffer = CBC_Buffer();
+	const BlockCipher &cipher = GetBlockCipher();
+
+	if (m_messageLength != m_totalMessageLength)
+		throw InvalidArgument(AlgorithmName() + ": message length doesn't match that given in SpecifyDataLengths");
+
+	if (m_bufferedDataLength > 0)
+	{
+		xorbuf(cbcBuffer, m_buffer, m_bufferedDataLength);
+		cipher.ProcessBlock(cbcBuffer);
+		m_bufferedDataLength = 0;
+	}
+}
+
+void CCM_Base::AuthenticateLastFooterBlock(byte *mac, size_t macSize)
+{
+	m_ctr.Seek(0);
+	m_ctr.ProcessData(mac, CBC_Buffer(), macSize);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/ccm.h b/runtime/third_party/cryptopp/ccm.h
new file mode 100644
index 0000000..f4f8ab0
--- /dev/null
+++ b/runtime/third_party/cryptopp/ccm.h
@@ -0,0 +1,123 @@
+// ccm.h - originally written and placed in the public domain by Wei Dai
+
+/// \file ccm.h
+/// \brief CCM block cipher mode of operation
+/// \since Crypto++ 5.6.0
+
+#ifndef CRYPTOPP_CCM_H
+#define CRYPTOPP_CCM_H
+
+#include "authenc.h"
+#include "modes.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief CCM block cipher base implementation
+/// \details Base implementation of the AuthenticatedSymmetricCipher interface
+/// \since Crypto++ 5.6.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CCM_Base : public AuthenticatedSymmetricCipherBase
+{
+public:
+	CCM_Base()
+		: m_digestSize(0), m_L(0), m_messageLength(0), m_aadLength(0) {}
+
+	// AuthenticatedSymmetricCipher
+	std::string AlgorithmName() const
+		{return GetBlockCipher().AlgorithmName() + std::string("/CCM");}
+	std::string AlgorithmProvider() const
+		{return GetBlockCipher().AlgorithmProvider();}
+	size_t MinKeyLength() const
+		{return GetBlockCipher().MinKeyLength();}
+	size_t MaxKeyLength() const
+		{return GetBlockCipher().MaxKeyLength();}
+	size_t DefaultKeyLength() const
+		{return GetBlockCipher().DefaultKeyLength();}
+	size_t GetValidKeyLength(size_t keylength) const
+		{return GetBlockCipher().GetValidKeyLength(keylength);}
+	bool IsValidKeyLength(size_t keylength) const
+		{return GetBlockCipher().IsValidKeyLength(keylength);}
+	unsigned int OptimalDataAlignment() const
+		{return GetBlockCipher().OptimalDataAlignment();}
+	IV_Requirement IVRequirement() const
+		{return UNIQUE_IV;}
+	unsigned int IVSize() const
+		{return 8;}
+	unsigned int MinIVLength() const
+		{return 7;}
+	unsigned int MaxIVLength() const
+		{return 13;}
+	unsigned int DigestSize() const
+		{return m_digestSize;}
+	lword MaxHeaderLength() const
+		{return W64LIT(0)-1;}
+	lword MaxMessageLength() const
+		{return m_L<8 ? (W64LIT(1)<<(8*m_L))-1 : W64LIT(0)-1;}
+	bool NeedsPrespecifiedDataLengths() const
+		{return true;}
+	void UncheckedSpecifyDataLengths(lword headerLength, lword messageLength, lword footerLength);
+
+protected:
+	// AuthenticatedSymmetricCipherBase
+	bool AuthenticationIsOnPlaintext() const
+		{return true;}
+	unsigned int AuthenticationBlockSize() const
+		{return GetBlockCipher().BlockSize();}
+	void SetKeyWithoutResync(const byte *userKey, size_t keylength, const NameValuePairs &params);
+	void Resync(const byte *iv, size_t len);
+	size_t AuthenticateBlocks(const byte *data, size_t len);
+	void AuthenticateLastHeaderBlock();
+	void AuthenticateLastConfidentialBlock();
+	void AuthenticateLastFooterBlock(byte *mac, size_t macSize);
+	SymmetricCipher & AccessSymmetricCipher() {return m_ctr;}
+
+	virtual BlockCipher & AccessBlockCipher() =0;
+	virtual int DefaultDigestSize() const =0;
+
+	const BlockCipher & GetBlockCipher() const {return const_cast<CCM_Base *>(this)->AccessBlockCipher();}
+	byte *CBC_Buffer() {return m_buffer+REQUIRED_BLOCKSIZE;}
+
+	enum {REQUIRED_BLOCKSIZE = 16};
+	int m_digestSize, m_L;
+	word64 m_messageLength, m_aadLength;
+	CTR_Mode_ExternalCipher::Encryption m_ctr;
+};
+
+/// \brief CCM block cipher final implementation
+/// \tparam T_BlockCipher block cipher
+/// \tparam T_DefaultDigestSize default digest size, in bytes
+/// \tparam T_IsEncryption direction in which to operate the cipher
+/// \since Crypto++ 5.6.0
+template <class T_BlockCipher, int T_DefaultDigestSize, bool T_IsEncryption>
+class CCM_Final : public CCM_Base
+{
+public:
+	static std::string StaticAlgorithmName()
+		{return T_BlockCipher::StaticAlgorithmName() + std::string("/CCM");}
+	bool IsForwardTransformation() const
+		{return T_IsEncryption;}
+
+private:
+	BlockCipher & AccessBlockCipher() {return m_cipher;}
+	int DefaultDigestSize() const {return T_DefaultDigestSize;}
+	typename T_BlockCipher::Encryption m_cipher;
+};
+
+/// \brief CCM block cipher mode of operation
+/// \tparam T_BlockCipher block cipher
+/// \tparam T_DefaultDigestSize default digest size, in bytes
+/// \details \p CCM provides the \p Encryption and \p Decryption typedef. See GCM_Base
+///   and GCM_Final for the AuthenticatedSymmetricCipher implementation.
+/// \sa <a href="http://www.cryptopp.com/wiki/CCM_Mode">CCM Mode</a> and
+///   <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+/// \since Crypto++ 5.6.0
+template <class T_BlockCipher, int T_DefaultDigestSize = 16>
+struct CCM : public AuthenticatedSymmetricCipherDocumentation
+{
+	typedef CCM_Final<T_BlockCipher, T_DefaultDigestSize, true> Encryption;
+	typedef CCM_Final<T_BlockCipher, T_DefaultDigestSize, false> Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/chacha.cpp b/runtime/third_party/cryptopp/chacha.cpp
new file mode 100644
index 0000000..719dc2c
--- /dev/null
+++ b/runtime/third_party/cryptopp/chacha.cpp
@@ -0,0 +1,568 @@
+// chacha.cpp - written and placed in the public domain by Jeffrey Walton.
+//              Based on Wei Dai's Salsa20, Botan's SSE2 implementation,
+//              and Bernstein's reference ChaCha family implementation at
+//              http://cr.yp.to/chacha.html.
+
+#include "pch.h"
+#include "config.h"
+#include "chacha.h"
+#include "argnames.h"
+#include "misc.h"
+#include "cpu.h"
+
+// Internal compiler error in GCC 3.3 and below
+#if defined(__GNUC__) && (__GNUC__ < 4)
+# undef CRYPTOPP_SSE2_INTRIN_AVAILABLE
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+extern void ChaCha_OperateKeystream_NEON(const word32 *state, const byte* input, byte *output, unsigned int rounds);
+#endif
+
+#if (CRYPTOPP_AVX2_AVAILABLE)
+extern void ChaCha_OperateKeystream_AVX2(const word32 *state, const byte* input, byte *output, unsigned int rounds);
+#endif
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+extern void ChaCha_OperateKeystream_SSE2(const word32 *state, const byte* input, byte *output, unsigned int rounds);
+#endif
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+extern void ChaCha_OperateKeystream_ALTIVEC(const word32 *state, const byte* input, byte *output, unsigned int rounds);
+#endif
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void ChaCha_TestInstantiations()
+{
+    ChaCha::Encryption x;
+    ChaChaTLS::Encryption y;
+    XChaCha20::Encryption z;
+}
+#endif
+
+NAMESPACE_END  // CryptoPP
+
+////////////////////////////// ChaCha Core //////////////////////////////
+
+#define CHACHA_QUARTER_ROUND(a,b,c,d) \
+    a += b; d ^= a; d = rotlConstant<16,word32>(d); \
+    c += d; b ^= c; b = rotlConstant<12,word32>(b); \
+    a += b; d ^= a; d = rotlConstant<8,word32>(d); \
+    c += d; b ^= c; b = rotlConstant<7,word32>(b);
+
+#define CHACHA_OUTPUT(x){\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 0, x0 + state[0]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 1, x1 + state[1]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 2, x2 + state[2]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 3, x3 + state[3]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 4, x4 + state[4]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 5, x5 + state[5]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 6, x6 + state[6]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 7, x7 + state[7]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 8, x8 + state[8]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 9, x9 + state[9]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 10, x10 + state[10]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 11, x11 + state[11]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 12, x12 + state[12]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 13, x13 + state[13]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 14, x14 + state[14]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 15, x15 + state[15]);}
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+// Hacks... Bring in all symbols, and supply
+// the stuff the templates normally provide.
+using namespace CryptoPP;
+typedef word32 WordType;
+enum {BYTES_PER_ITERATION=64};
+
+// MultiBlockSafe detects a condition that can arise in the SIMD
+// implementations where we overflow one of the 32-bit state words during
+// addition in an intermediate result. Preconditions for the issue include
+// a user seeks to around 2^32 blocks (256 GB of data) for ChaCha; or a
+// user specifies an arbitrarily large initial counter block for ChaChaTLS.
+// Also see https://github.com/weidai11/cryptopp/issues/732.
+inline bool MultiBlockSafe(unsigned int ctrLow, unsigned int blocks)
+{
+    return 0xffffffff - ctrLow > blocks;
+}
+
+// OperateKeystream always produces a key stream. The key stream is written
+// to output. Optionally a message may be supplied to xor with the key stream.
+// The message is input, and output = output ^ input.
+void ChaCha_OperateKeystream(KeystreamOperation operation,
+        word32 state[16], word32& ctrLow, word32& ctrHigh, word32 rounds,
+        byte *output, const byte *input, size_t iterationCount)
+{
+    do
+    {
+#if (CRYPTOPP_AVX2_AVAILABLE)
+        if (HasAVX2())
+        {
+            while (iterationCount >= 8 && MultiBlockSafe(state[12], 8))
+            {
+                const bool xorInput = (operation & EnumToInt(INPUT_NULL)) != EnumToInt(INPUT_NULL);
+                ChaCha_OperateKeystream_AVX2(state, xorInput ? input : NULLPTR, output, rounds);
+
+                // MultiBlockSafe avoids overflow on the counter words
+                state[12] += 8;
+
+                input += (!!xorInput) * 8 * BYTES_PER_ITERATION;
+                output += 8 * BYTES_PER_ITERATION;
+                iterationCount -= 8;
+            }
+        }
+#endif
+
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+        if (HasSSE2())
+        {
+            while (iterationCount >= 4 && MultiBlockSafe(state[12], 4))
+            {
+                const bool xorInput = (operation & EnumToInt(INPUT_NULL)) != EnumToInt(INPUT_NULL);
+                ChaCha_OperateKeystream_SSE2(state, xorInput ? input : NULLPTR, output, rounds);
+
+                // MultiBlockSafe avoids overflow on the counter words
+                state[12] += 4;
+
+                input += (!!xorInput)*4*BYTES_PER_ITERATION;
+                output += 4*BYTES_PER_ITERATION;
+                iterationCount -= 4;
+            }
+        }
+#endif
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+        if (HasNEON())
+        {
+            while (iterationCount >= 4 && MultiBlockSafe(state[12], 4))
+            {
+                const bool xorInput = (operation & EnumToInt(INPUT_NULL)) != EnumToInt(INPUT_NULL);
+                ChaCha_OperateKeystream_NEON(state, xorInput ? input : NULLPTR, output, rounds);
+
+                // MultiBlockSafe avoids overflow on the counter words
+                state[12] += 4;
+
+                input += (!!xorInput)*4*BYTES_PER_ITERATION;
+                output += 4*BYTES_PER_ITERATION;
+                iterationCount -= 4;
+            }
+        }
+#endif
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+        if (HasAltivec())
+        {
+            while (iterationCount >= 4 && MultiBlockSafe(state[12], 4))
+            {
+                const bool xorInput = (operation & EnumToInt(INPUT_NULL)) != EnumToInt(INPUT_NULL);
+                ChaCha_OperateKeystream_ALTIVEC(state, xorInput ? input : NULLPTR, output, rounds);
+
+                // MultiBlockSafe avoids overflow on the counter words
+                state[12] += 4;
+
+                input += (!!xorInput)*4*BYTES_PER_ITERATION;
+                output += 4*BYTES_PER_ITERATION;
+                iterationCount -= 4;
+            }
+        }
+#endif
+
+        if (iterationCount)
+        {
+            word32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+
+            x0 = state[0];    x1 = state[1];    x2 = state[2];    x3 = state[3];
+            x4 = state[4];    x5 = state[5];    x6 = state[6];    x7 = state[7];
+            x8 = state[8];    x9 = state[9];    x10 = state[10];  x11 = state[11];
+            x12 = state[12];  x13 = state[13];  x14 = state[14];  x15 = state[15];
+
+            for (int i = static_cast<int>(rounds); i > 0; i -= 2)
+            {
+                CHACHA_QUARTER_ROUND(x0, x4,  x8, x12);
+                CHACHA_QUARTER_ROUND(x1, x5,  x9, x13);
+                CHACHA_QUARTER_ROUND(x2, x6, x10, x14);
+                CHACHA_QUARTER_ROUND(x3, x7, x11, x15);
+
+                CHACHA_QUARTER_ROUND(x0, x5, x10, x15);
+                CHACHA_QUARTER_ROUND(x1, x6, x11, x12);
+                CHACHA_QUARTER_ROUND(x2, x7,  x8, x13);
+                CHACHA_QUARTER_ROUND(x3, x4,  x9, x14);
+            }
+
+            CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(CHACHA_OUTPUT, BYTES_PER_ITERATION);
+
+            // This is state[12] and state[13] from ChaCha. In the case of
+            // ChaChaTLS ctrHigh is a reference to a discard value.
+            if (++ctrLow == 0)
+                ctrHigh++;
+        }
+
+    // We may re-enter a SIMD keystream operation from here.
+    } while (iterationCount--);
+}
+
+// XChaCha key derivation
+void HChaCha_OperateKeystream(const word32 state[16], word32 output[8])
+{
+    word32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+
+    x0 = state[0];    x1 = state[1];    x2 = state[2];    x3 = state[3];
+    x4 = state[4];    x5 = state[5];    x6 = state[6];    x7 = state[7];
+    x8 = state[8];    x9 = state[9];    x10 = state[10];  x11 = state[11];
+    x12 = state[12];  x13 = state[13];  x14 = state[14];  x15 = state[15];
+
+    for (int i = 20; i > 0; i -= 2)
+    {
+        CHACHA_QUARTER_ROUND(x0, x4,  x8, x12);
+        CHACHA_QUARTER_ROUND(x1, x5,  x9, x13);
+        CHACHA_QUARTER_ROUND(x2, x6, x10, x14);
+        CHACHA_QUARTER_ROUND(x3, x7, x11, x15);
+
+        CHACHA_QUARTER_ROUND(x0, x5, x10, x15);
+        CHACHA_QUARTER_ROUND(x1, x6, x11, x12);
+        CHACHA_QUARTER_ROUND(x2, x7,  x8, x13);
+        CHACHA_QUARTER_ROUND(x3, x4,  x9, x14);
+    }
+
+    output[0] =  x0; output[1] =  x1;
+    output[2] =  x2; output[3] =  x3;
+    output[4] = x12; output[5] = x13;
+    output[6] = x14; output[7] = x15;
+}
+
+std::string ChaCha_AlgorithmProvider()
+{
+#if (CRYPTOPP_AVX2_AVAILABLE)
+    if (HasAVX2())
+        return "AVX2";
+    else
+#endif
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+    if (HasSSE2())
+        return "SSE2";
+    else
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return "NEON";
+    else
+#endif
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return "Altivec";
+    else
+#endif
+    return "C++";
+}
+
+unsigned int ChaCha_GetAlignment()
+{
+#if (CRYPTOPP_AVX2_AVAILABLE)
+    if (HasAVX2())
+        return 16;
+    else
+#endif
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+    if (HasSSE2())
+        return 16;
+    else
+#endif
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return 16;
+    else
+#endif
+        return GetAlignmentOf<word32>();
+}
+
+unsigned int ChaCha_GetOptimalBlockSize()
+{
+#if (CRYPTOPP_AVX2_AVAILABLE)
+    if (HasAVX2())
+        return 8 * BYTES_PER_ITERATION;
+    else
+#endif
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+    if (HasSSE2())
+        return 4*BYTES_PER_ITERATION;
+    else
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return 4*BYTES_PER_ITERATION;
+    else
+#endif
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return 4*BYTES_PER_ITERATION;
+    else
+#endif
+        return BYTES_PER_ITERATION;
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+////////////////////////////// Bernstein ChaCha //////////////////////////////
+
+std::string ChaCha_Policy::AlgorithmName() const
+{
+    return std::string("ChaCha")+IntToString(m_rounds);
+}
+
+std::string ChaCha_Policy::AlgorithmProvider() const
+{
+    return ChaCha_AlgorithmProvider();
+}
+
+void ChaCha_Policy::CipherSetKey(const NameValuePairs &params, const byte *key, size_t length)
+{
+    CRYPTOPP_ASSERT(key); CRYPTOPP_ASSERT(length == 16 || length == 32);
+    CRYPTOPP_UNUSED(key); CRYPTOPP_UNUSED(length);
+
+    // Use previous rounds as the default value
+    int rounds = params.GetIntValueWithDefault(Name::Rounds(), m_rounds);
+    if (rounds != 20 && rounds != 12 && rounds != 8)
+        throw InvalidRounds(ChaCha::StaticAlgorithmName(), rounds);
+
+    // Latch a good value
+    m_rounds = rounds;
+
+    // "expand 16-byte k" or "expand 32-byte k"
+    m_state[0] = 0x61707865;
+    m_state[1] = (length == 16) ? 0x3120646e : 0x3320646e;
+    m_state[2] = (length == 16) ? 0x79622d36 : 0x79622d32;
+    m_state[3] = 0x6b206574;
+
+    GetBlock<word32, LittleEndian> get1(key);
+    get1(m_state[4])(m_state[5])(m_state[6])(m_state[7]);
+
+    GetBlock<word32, LittleEndian> get2(key + ((length == 32) ? 16 : 0));
+    get2(m_state[8])(m_state[9])(m_state[10])(m_state[11]);
+}
+
+void ChaCha_Policy::CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length)
+{
+    CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(length);
+    CRYPTOPP_ASSERT(length==8); CRYPTOPP_UNUSED(length);
+
+    GetBlock<word32, LittleEndian> get(IV);
+    m_state[12] = m_state[13] = 0;
+    get(m_state[14])(m_state[15]);
+}
+
+void ChaCha_Policy::SeekToIteration(lword iterationCount)
+{
+    m_state[12] = (word32)iterationCount;  // low word
+    m_state[13] = (word32)SafeRightShift<32>(iterationCount);
+}
+
+unsigned int ChaCha_Policy::GetAlignment() const
+{
+    return ChaCha_GetAlignment();
+}
+
+unsigned int ChaCha_Policy::GetOptimalBlockSize() const
+{
+    return ChaCha_GetOptimalBlockSize();
+}
+
+void ChaCha_Policy::OperateKeystream(KeystreamOperation operation,
+        byte *output, const byte *input, size_t iterationCount)
+{
+    ChaCha_OperateKeystream(operation, m_state, m_state[12], m_state[13],
+        m_rounds, output, input, iterationCount);
+}
+
+////////////////////////////// IETF ChaChaTLS //////////////////////////////
+
+std::string ChaChaTLS_Policy::AlgorithmName() const
+{
+    return std::string("ChaChaTLS");
+}
+
+std::string ChaChaTLS_Policy::AlgorithmProvider() const
+{
+    return ChaCha_AlgorithmProvider();
+}
+
+void ChaChaTLS_Policy::CipherSetKey(const NameValuePairs &params, const byte *key, size_t length)
+{
+    CRYPTOPP_ASSERT(key); CRYPTOPP_ASSERT(length == 32);
+    CRYPTOPP_UNUSED(length);
+
+    // ChaChaTLS is always 20 rounds. Fetch Rounds() to avoid a spurious failure.
+    int rounds = params.GetIntValueWithDefault(Name::Rounds(), ROUNDS);
+    if (rounds != 20)
+        throw InvalidRounds(ChaChaTLS::StaticAlgorithmName(), rounds);
+
+    // RFC 8439 test vectors use an initial block counter. However, the counter
+    // can be an arbitrary value per RFC 8439 Section 2.4. We stash the counter
+    // away in state[16] and use it for a Resynchronize() operation. I think
+    // the initial counter is used more like a Tweak when non-0, and it should
+    // be provided in Resynchronize() (light-weight re-keying). However,
+    // Resynchronize() does not have an overload that allows us to pass it into
+    // the function, so we have to use the heavier-weight SetKey to change it.
+    word64 block;
+    if (params.GetValue("InitialBlock", block))
+        m_counter = static_cast<word32>(block);
+    else
+        m_counter = 0;
+
+    // State words are defined in RFC 8439, Section 2.3. Key is 32-bytes.
+    GetBlock<word32, LittleEndian> get(key);
+    get(m_state[KEY+0])(m_state[KEY+1])(m_state[KEY+2])(m_state[KEY+3])
+        (m_state[KEY+4])(m_state[KEY+5])(m_state[KEY+6])(m_state[KEY+7]);
+}
+
+void ChaChaTLS_Policy::CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length)
+{
+    CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(length);
+    CRYPTOPP_ASSERT(length==12);
+
+    // State words are defined in RFC 8439, Section 2.3.
+    m_state[0] = 0x61707865; m_state[1] = 0x3320646e;
+    m_state[2] = 0x79622d32; m_state[3] = 0x6b206574;
+
+    // Copy saved key into state
+    std::memcpy(m_state+4, m_state+KEY, 8*sizeof(word32));
+
+    // State words are defined in RFC 8439, Section 2.3
+    GetBlock<word32, LittleEndian> get(IV);
+    m_state[12] = m_counter;
+    get(m_state[13])(m_state[14])(m_state[15]);
+}
+
+void ChaChaTLS_Policy::SeekToIteration(lword iterationCount)
+{
+    // Should we throw here??? If the initial block counter is
+    // large then we can wrap and process more data as long as
+    // data processed in the security context does not exceed
+    // 2^32 blocks or approximately 256 GB of data.
+    CRYPTOPP_ASSERT(iterationCount <= (std::numeric_limits<word32>::max)());
+    m_state[12] = (word32)iterationCount;  // low word
+}
+
+unsigned int ChaChaTLS_Policy::GetAlignment() const
+{
+    return ChaCha_GetAlignment();
+}
+
+unsigned int ChaChaTLS_Policy::GetOptimalBlockSize() const
+{
+    return ChaCha_GetOptimalBlockSize();
+}
+
+void ChaChaTLS_Policy::OperateKeystream(KeystreamOperation operation,
+        byte *output, const byte *input, size_t iterationCount)
+{
+    word32 discard=0;
+    ChaCha_OperateKeystream(operation, m_state, m_state[12], discard,
+            ROUNDS, output, input, iterationCount);
+
+    // If this fires it means ChaCha_OperateKeystream generated a counter
+    // block carry that was discarded. The problem is, the RFC does not
+    // specify what should happen when the counter block wraps. All we can
+    // do is inform the user that something bad may happen because we don't
+    // know what we should do.
+    // Also see https://github.com/weidai11/cryptopp/issues/790 and
+    // https://mailarchive.ietf.org/arch/msg/cfrg/gsOnTJzcbgG6OqD8Sc0GO5aR_tU
+    // CRYPTOPP_ASSERT(discard==0);
+}
+
+////////////////////////////// IETF XChaCha20 //////////////////////////////
+
+std::string XChaCha20_Policy::AlgorithmName() const
+{
+    return std::string("XChaCha20");
+}
+
+std::string XChaCha20_Policy::AlgorithmProvider() const
+{
+    return ChaCha_AlgorithmProvider();
+}
+
+void XChaCha20_Policy::CipherSetKey(const NameValuePairs &params, const byte *key, size_t length)
+{
+    CRYPTOPP_ASSERT(key); CRYPTOPP_ASSERT(length == 32);
+    CRYPTOPP_UNUSED(length);
+
+    // Use previous rounds as the default value
+    int rounds = params.GetIntValueWithDefault(Name::Rounds(), m_rounds);
+    if (rounds != 20 && rounds != 12)
+        throw InvalidRounds(ChaCha::StaticAlgorithmName(), rounds);
+
+    // Latch a good value
+    m_rounds = rounds;
+
+    word64 block;
+    if (params.GetValue("InitialBlock", block))
+        m_counter = static_cast<word32>(block);
+    else
+        m_counter = 1;
+
+    // Stash key away for use in CipherResynchronize
+    GetBlock<word32, LittleEndian> get(key);
+    get(m_state[KEY+0])(m_state[KEY+1])(m_state[KEY+2])(m_state[KEY+3])
+        (m_state[KEY+4])(m_state[KEY+5])(m_state[KEY+6])(m_state[KEY+7]);
+}
+
+void XChaCha20_Policy::CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length)
+{
+    CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(length);
+    CRYPTOPP_ASSERT(length==24);
+
+    // HChaCha derivation
+    m_state[0] = 0x61707865; m_state[1] = 0x3320646e;
+    m_state[2] = 0x79622d32; m_state[3] = 0x6b206574;
+
+    // Copy saved key into state
+    std::memcpy(m_state+4, m_state+KEY, 8*sizeof(word32));
+
+    GetBlock<word32, LittleEndian> get(iv);
+    get(m_state[12])(m_state[13])(m_state[14])(m_state[15]);
+
+    // Operate the keystream without adding state back in.
+    // This function also gathers the key words into a
+    // contiguous 8-word block.
+    HChaCha_OperateKeystream(m_state, m_state+4);
+
+    // XChaCha state
+    m_state[0] = 0x61707865; m_state[1] = 0x3320646e;
+    m_state[2] = 0x79622d32; m_state[3] = 0x6b206574;
+
+    // Setup new IV
+    m_state[12] = m_counter;
+    m_state[13] = 0;
+    m_state[14] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, iv+16);
+    m_state[15] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, iv+20);
+}
+
+void XChaCha20_Policy::SeekToIteration(lword iterationCount)
+{
+    // Should we throw here??? XChaCha does not have a block
+    // counter, so I'm not sure how to seek on it.
+    CRYPTOPP_ASSERT(0); CRYPTOPP_UNUSED(iterationCount);
+}
+
+unsigned int XChaCha20_Policy::GetAlignment() const
+{
+    return ChaCha_GetAlignment();
+}
+
+unsigned int XChaCha20_Policy::GetOptimalBlockSize() const
+{
+    return ChaCha_GetOptimalBlockSize();
+}
+
+void XChaCha20_Policy::OperateKeystream(KeystreamOperation operation,
+        byte *output, const byte *input, size_t iterationCount)
+{
+    ChaCha_OperateKeystream(operation, m_state, m_state[12], m_state[13],
+            m_rounds, output, input, iterationCount);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/chacha.h b/runtime/third_party/cryptopp/chacha.h
new file mode 100644
index 0000000..8b21ebb
--- /dev/null
+++ b/runtime/third_party/cryptopp/chacha.h
@@ -0,0 +1,223 @@
+// chacha.h - written and placed in the public domain by Jeffrey Walton.
+//            Based on Wei Dai's Salsa20, Botan's SSE2 implementation,
+//            and Bernstein's reference ChaCha family implementation at
+//            http://cr.yp.to/chacha.html.
+
+// The library added Bernstein's ChaCha classes at Crypto++ 5.6.4. The IETF
+// uses a slightly different implementation than Bernstein, and the IETF
+// ChaCha and XChaCha classes were added at Crypto++ 8.1. We wanted to maintain
+// ABI compatibility at the 8.1 release so the original ChaCha classes were not
+// disturbed. Instead new classes were added for IETF ChaCha. The back-end
+// implementation shares code as expected, however.
+
+/// \file chacha.h
+/// \brief Classes for ChaCha8, ChaCha12 and ChaCha20 stream ciphers
+/// \details Crypto++ provides Bernstein and ECRYPT's ChaCha from <a
+///  href="http://cr.yp.to/chacha/chacha-20080128.pdf">ChaCha, a
+///  variant of Salsa20</a> (2008.01.28). Crypto++ also provides the
+///  IETF implementation of ChaCha using the ChaChaTLS name. Bernstein's
+///  implementation is _slightly_ different from the TLS working group's
+///  implementation for cipher suites
+///  <tt>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256</tt>,
+///  <tt>TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256</tt>,
+///  and <tt>TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256</tt>. Finally,
+///  the library provides <a
+///  href="https://tools.ietf.org/html/draft-arciszewski-xchacha">XChaCha:
+///  eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305 (rev. 03)</a>.
+/// \since ChaCha since Crypto++ 5.6.4, ChaChaTLS and XChaCha20 since Crypto++ 8.1
+
+#ifndef CRYPTOPP_CHACHA_H
+#define CRYPTOPP_CHACHA_H
+
+#include "strciphr.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+////////////////////////////// Bernstein ChaCha //////////////////////////////
+
+/// \brief ChaCha stream cipher information
+/// \since Crypto++ 5.6.4
+struct ChaCha_Info : public VariableKeyLength<32, 16, 32, 16, SimpleKeyingInterface::UNIQUE_IV, 8>
+{
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///  member function.
+    /// \details Bernstein named the cipher variants ChaCha8, ChaCha12 and
+    ///  ChaCha20. More generally, Bernstein called the family ChaCha{r}.
+    ///  AlgorithmName() provides the exact name once rounds are set.
+    static const char* StaticAlgorithmName() {
+        return "ChaCha";
+    }
+};
+
+/// \brief ChaCha stream cipher implementation
+/// \since Crypto++ 5.6.4
+class CRYPTOPP_NO_VTABLE ChaCha_Policy : public AdditiveCipherConcretePolicy<word32, 16>
+{
+public:
+    virtual ~ChaCha_Policy() {}
+    ChaCha_Policy() : m_rounds(ROUNDS) {}
+
+protected:
+    void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+    void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+    void CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length);
+    bool CipherIsRandomAccess() const {return true;}
+    void SeekToIteration(lword iterationCount);
+    unsigned int GetAlignment() const;
+    unsigned int GetOptimalBlockSize() const;
+
+    std::string AlgorithmName() const;
+    std::string AlgorithmProvider() const;
+
+    CRYPTOPP_CONSTANT(ROUNDS = 20);  // Default rounds
+    FixedSizeAlignedSecBlock<word32, 16> m_state;
+    unsigned int m_rounds;
+};
+
+/// \brief ChaCha stream cipher
+/// \details This is Bernstein and ECRYPT's ChaCha. It is _slightly_ different
+///  from the IETF's version of ChaCha called ChaChaTLS.
+/// \sa <a href="http://cr.yp.to/chacha/chacha-20080208.pdf">ChaCha, a variant
+///  of Salsa20</a> (2008.01.28).
+/// \since Crypto++ 5.6.4
+struct ChaCha : public ChaCha_Info, public SymmetricCipherDocumentation
+{
+    /// \brief ChaCha Encryption
+    typedef SymmetricCipherFinal<ConcretePolicyHolder<ChaCha_Policy, AdditiveCipherTemplate<> >, ChaCha_Info > Encryption;
+    /// \brief ChaCha Decryption
+    typedef Encryption Decryption;
+};
+
+////////////////////////////// IETF ChaChaTLS //////////////////////////////
+
+/// \brief IETF ChaCha20 stream cipher information
+/// \since Crypto++ 8.1
+struct ChaChaTLS_Info : public FixedKeyLength<32, SimpleKeyingInterface::UNIQUE_IV, 12>, FixedRounds<20>
+{
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///  member function.
+    /// \details This is the IETF's variant of Bernstein's ChaCha from RFC
+    ///  8439. IETF ChaCha is called ChaChaTLS in the Crypto++ library. It
+    ///  is _slightly_ different from Bernstein's implementation.
+    static const char* StaticAlgorithmName() {
+        return "ChaChaTLS";
+    }
+};
+
+/// \brief IETF ChaCha20 stream cipher implementation
+/// \since Crypto++ 8.1
+class CRYPTOPP_NO_VTABLE ChaChaTLS_Policy : public AdditiveCipherConcretePolicy<word32, 16>
+{
+public:
+    virtual ~ChaChaTLS_Policy() {}
+    ChaChaTLS_Policy() : m_counter(0) {}
+
+protected:
+    void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+    void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+    void CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length);
+    bool CipherIsRandomAccess() const {return true;}
+    void SeekToIteration(lword iterationCount);
+    unsigned int GetAlignment() const;
+    unsigned int GetOptimalBlockSize() const;
+
+    std::string AlgorithmName() const;
+    std::string AlgorithmProvider() const;
+
+    FixedSizeAlignedSecBlock<word32, 16+8> m_state;
+    unsigned int m_counter;
+    CRYPTOPP_CONSTANT(ROUNDS = ChaChaTLS_Info::ROUNDS);
+    CRYPTOPP_CONSTANT(KEY = 16);  // Index into m_state
+    CRYPTOPP_CONSTANT(CTR = 24);  // Index into m_state
+};
+
+/// \brief IETF ChaCha20 stream cipher
+/// \details This is the IETF's variant of Bernstein's ChaCha from RFC 8439.
+///  IETF ChaCha is called ChaChaTLS in the Crypto++ library. It is
+///  _slightly_ different from the Bernstein implementation. ChaCha-TLS
+///  can be used for cipher suites
+///  <tt>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256</tt>,
+///  <tt>TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256</tt>, and
+///  <tt>TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256</tt>.
+/// \sa <a href="https://tools.ietf.org/html/rfc8439">RFC 8439, ChaCha20 and
+///  Poly1305 for IETF Protocols</a>, <A
+///  HREF="https://mailarchive.ietf.org/arch/msg/cfrg/gsOnTJzcbgG6OqD8Sc0GO5aR_tU">How
+///  to handle block counter wrap in IETF's ChaCha algorithm?</A> and
+///  <A HREF="https://github.com/weidai11/cryptopp/issues/790">Issue
+///  790, ChaChaTLS results when counter block wraps</A>.
+/// \since Crypto++ 8.1
+struct ChaChaTLS : public ChaChaTLS_Info, public SymmetricCipherDocumentation
+{
+    /// \brief ChaCha-TLS Encryption
+    typedef SymmetricCipherFinal<ConcretePolicyHolder<ChaChaTLS_Policy, AdditiveCipherTemplate<> >, ChaChaTLS_Info > Encryption;
+    /// \brief ChaCha-TLS Decryption
+    typedef Encryption Decryption;
+};
+
+////////////////////////////// IETF XChaCha20 draft //////////////////////////////
+
+/// \brief IETF XChaCha20 stream cipher information
+/// \since Crypto++ 8.1
+struct XChaCha20_Info : public FixedKeyLength<32, SimpleKeyingInterface::UNIQUE_IV, 24>
+{
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///  member function.
+    /// \details This is the IETF's XChaCha from draft-arciszewski-xchacha.
+    static const char* StaticAlgorithmName() {
+        return "XChaCha20";
+    }
+};
+
+/// \brief IETF XChaCha20 stream cipher implementation
+/// \since Crypto++ 8.1
+class CRYPTOPP_NO_VTABLE XChaCha20_Policy : public AdditiveCipherConcretePolicy<word32, 16>
+{
+public:
+    virtual ~XChaCha20_Policy() {}
+    XChaCha20_Policy() : m_counter(0), m_rounds(ROUNDS) {}
+
+protected:
+    void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+    void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+    void CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length);
+    bool CipherIsRandomAccess() const {return false;}
+    void SeekToIteration(lword iterationCount);
+    unsigned int GetAlignment() const;
+    unsigned int GetOptimalBlockSize() const;
+
+    std::string AlgorithmName() const;
+    std::string AlgorithmProvider() const;
+
+    FixedSizeAlignedSecBlock<word32, 16+8> m_state;
+    unsigned int m_counter, m_rounds;
+    CRYPTOPP_CONSTANT(ROUNDS = 20);  // Default rounds
+    CRYPTOPP_CONSTANT(KEY = 16);  // Index into m_state
+};
+
+/// \brief IETF XChaCha20 stream cipher
+/// \details This is the IETF's XChaCha from draft-arciszewski-xchacha.
+/// \sa <a href="https://tools.ietf.org/html/draft-arciszewski-xchacha">XChaCha:
+///  eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305 (rev. 03)</a>, <A
+///  HREF="https://mailarchive.ietf.org/arch/msg/cfrg/gsOnTJzcbgG6OqD8Sc0GO5aR_tU">How
+///  to handle block counter wrap in IETF's ChaCha algorithm?</A> and
+///  <A HREF="https://github.com/weidai11/cryptopp/issues/790">Issue
+///  790, ChaCha20 results when counter block wraps</A>.
+/// \since Crypto++ 8.1
+struct XChaCha20 : public XChaCha20_Info, public SymmetricCipherDocumentation
+{
+    /// \brief XChaCha Encryption
+    typedef SymmetricCipherFinal<ConcretePolicyHolder<XChaCha20_Policy, AdditiveCipherTemplate<> >, XChaCha20_Info > Encryption;
+    /// \brief XChaCha Decryption
+    typedef Encryption Decryption;
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_CHACHA_H
diff --git a/runtime/third_party/cryptopp/chacha_avx.cpp b/runtime/third_party/cryptopp/chacha_avx.cpp
new file mode 100644
index 0000000..18f4c57
--- /dev/null
+++ b/runtime/third_party/cryptopp/chacha_avx.cpp
@@ -0,0 +1,421 @@
+// chacha_avx.cpp - written and placed in the public domain by
+//                  Jack Lloyd and Jeffrey Walton
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    AVX2 instructions. A separate source file is needed because
+//    additional CXXFLAGS are required to enable the appropriate
+//    instructions sets in some build configurations.
+//
+//    AVX2 implementation based on Botan's chacha_avx.cpp. Many thanks
+//    to Jack Lloyd and the Botan team for allowing us to use it.
+//
+//    Here are some relative numbers for ChaCha8:
+//    * Intel Skylake,   3.0 GHz: AVX2 at 4411 MB/s; 0.57 cpb.
+//    * Intel Broadwell, 2.3 GHz: AVX2 at 3828 MB/s; 0.58 cpb.
+//    * AMD Bulldozer,   3.3 GHz: AVX2 at 1680 MB/s; 1.47 cpb.
+
+#include "pch.h"
+#include "config.h"
+
+#include "chacha.h"
+#include "misc.h"
+
+#if defined(CRYPTOPP_AVX2_AVAILABLE)
+# include <xmmintrin.h>
+# include <emmintrin.h>
+# include <immintrin.h>
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char CHACHA_AVX_FNAME[] = __FILE__;
+
+// Sun Studio 12.4 OK, 12.5 and 12.6 compile error.
+#if (__SUNPRO_CC >= 0x5140) && (__SUNPRO_CC <= 0x5150)
+# define MAYBE_CONST
+#else
+# define MAYBE_CONST const
+#endif
+
+// VS2017 and global optimization bug. Also see
+// https://github.com/weidai11/cryptopp/issues/649 and
+// https://github.com/weidai11/cryptopp/issues/735. The
+// 649 issue affects AES but it is the same here. The 735
+// issue is ChaCha AVX2 cut-in where it surfaced again.
+#if (CRYPTOPP_MSC_VERSION >= 1910) && (CRYPTOPP_MSC_VERSION <= 1916)
+# ifndef CRYPTOPP_DEBUG
+#  pragma optimize("", off)
+#  pragma optimize("ts", on)
+# endif
+#endif
+
+// The data is aligned, but Clang issues warning based on type
+// and not the actual alignment of the variable and data.
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wcast-align"
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+#if (CRYPTOPP_AVX2_AVAILABLE)
+
+template <unsigned int R>
+inline __m256i RotateLeft(const __m256i val)
+{
+    return _mm256_or_si256(_mm256_slli_epi32(val, R), _mm256_srli_epi32(val, 32-R));
+}
+
+template <>
+inline __m256i RotateLeft<8>(const __m256i val)
+{
+    const __m256i mask = _mm256_set_epi8(14,13,12,15, 10,9,8,11, 6,5,4,7, 2,1,0,3,
+                                         14,13,12,15, 10,9,8,11, 6,5,4,7, 2,1,0,3);
+    return _mm256_shuffle_epi8(val, mask);
+}
+
+template <>
+inline __m256i RotateLeft<16>(const __m256i val)
+{
+    const __m256i mask = _mm256_set_epi8(13,12,15,14, 9,8,11,10, 5,4,7,6, 1,0,3,2,
+                                         13,12,15,14, 9,8,11,10, 5,4,7,6, 1,0,3,2);
+    return _mm256_shuffle_epi8(val, mask);
+}
+
+#endif  // CRYPTOPP_AVX2_AVAILABLE
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (CRYPTOPP_AVX2_AVAILABLE)
+
+void ChaCha_OperateKeystream_AVX2(const word32 *state, const byte* input, byte *output, unsigned int rounds)
+{
+    const __m256i state0 = _mm256_broadcastsi128_si256(
+        _mm_loadu_si128(reinterpret_cast<const __m128i*>(state+0*4)));
+    const __m256i state1 = _mm256_broadcastsi128_si256(
+        _mm_loadu_si128(reinterpret_cast<const __m128i*>(state+1*4)));
+    const __m256i state2 = _mm256_broadcastsi128_si256(
+        _mm_loadu_si128(reinterpret_cast<const __m128i*>(state+2*4)));
+    const __m256i state3 = _mm256_broadcastsi128_si256(
+        _mm_loadu_si128(reinterpret_cast<const __m128i*>(state+3*4)));
+
+    const word32 C = 0xFFFFFFFFu - state[12];
+    const __m256i CTR0 = _mm256_set_epi32(0, 0,     0, 0, 0, 0, C < 4, 4);
+    const __m256i CTR1 = _mm256_set_epi32(0, 0, C < 1, 1, 0, 0, C < 5, 5);
+    const __m256i CTR2 = _mm256_set_epi32(0, 0, C < 2, 2, 0, 0, C < 6, 6);
+    const __m256i CTR3 = _mm256_set_epi32(0, 0, C < 3, 3, 0, 0, C < 7, 7);
+
+    __m256i X0_0 = state0;
+    __m256i X0_1 = state1;
+    __m256i X0_2 = state2;
+    __m256i X0_3 = _mm256_add_epi32(state3, CTR0);
+
+    __m256i X1_0 = state0;
+    __m256i X1_1 = state1;
+    __m256i X1_2 = state2;
+    __m256i X1_3 = _mm256_add_epi32(state3, CTR1);
+
+    __m256i X2_0 = state0;
+    __m256i X2_1 = state1;
+    __m256i X2_2 = state2;
+    __m256i X2_3 = _mm256_add_epi32(state3, CTR2);
+
+    __m256i X3_0 = state0;
+    __m256i X3_1 = state1;
+    __m256i X3_2 = state2;
+    __m256i X3_3 = _mm256_add_epi32(state3, CTR3);
+
+    for (int i = static_cast<int>(rounds); i > 0; i -= 2)
+    {
+        X0_0 = _mm256_add_epi32(X0_0, X0_1);
+        X1_0 = _mm256_add_epi32(X1_0, X1_1);
+        X2_0 = _mm256_add_epi32(X2_0, X2_1);
+        X3_0 = _mm256_add_epi32(X3_0, X3_1);
+
+        X0_3 = _mm256_xor_si256(X0_3, X0_0);
+        X1_3 = _mm256_xor_si256(X1_3, X1_0);
+        X2_3 = _mm256_xor_si256(X2_3, X2_0);
+        X3_3 = _mm256_xor_si256(X3_3, X3_0);
+
+        X0_3 = RotateLeft<16>(X0_3);
+        X1_3 = RotateLeft<16>(X1_3);
+        X2_3 = RotateLeft<16>(X2_3);
+        X3_3 = RotateLeft<16>(X3_3);
+
+        X0_2 = _mm256_add_epi32(X0_2, X0_3);
+        X1_2 = _mm256_add_epi32(X1_2, X1_3);
+        X2_2 = _mm256_add_epi32(X2_2, X2_3);
+        X3_2 = _mm256_add_epi32(X3_2, X3_3);
+
+        X0_1 = _mm256_xor_si256(X0_1, X0_2);
+        X1_1 = _mm256_xor_si256(X1_1, X1_2);
+        X2_1 = _mm256_xor_si256(X2_1, X2_2);
+        X3_1 = _mm256_xor_si256(X3_1, X3_2);
+
+        X0_1 = RotateLeft<12>(X0_1);
+        X1_1 = RotateLeft<12>(X1_1);
+        X2_1 = RotateLeft<12>(X2_1);
+        X3_1 = RotateLeft<12>(X3_1);
+
+        X0_0 = _mm256_add_epi32(X0_0, X0_1);
+        X1_0 = _mm256_add_epi32(X1_0, X1_1);
+        X2_0 = _mm256_add_epi32(X2_0, X2_1);
+        X3_0 = _mm256_add_epi32(X3_0, X3_1);
+
+        X0_3 = _mm256_xor_si256(X0_3, X0_0);
+        X1_3 = _mm256_xor_si256(X1_3, X1_0);
+        X2_3 = _mm256_xor_si256(X2_3, X2_0);
+        X3_3 = _mm256_xor_si256(X3_3, X3_0);
+
+        X0_3 = RotateLeft<8>(X0_3);
+        X1_3 = RotateLeft<8>(X1_3);
+        X2_3 = RotateLeft<8>(X2_3);
+        X3_3 = RotateLeft<8>(X3_3);
+
+        X0_2 = _mm256_add_epi32(X0_2, X0_3);
+        X1_2 = _mm256_add_epi32(X1_2, X1_3);
+        X2_2 = _mm256_add_epi32(X2_2, X2_3);
+        X3_2 = _mm256_add_epi32(X3_2, X3_3);
+
+        X0_1 = _mm256_xor_si256(X0_1, X0_2);
+        X1_1 = _mm256_xor_si256(X1_1, X1_2);
+        X2_1 = _mm256_xor_si256(X2_1, X2_2);
+        X3_1 = _mm256_xor_si256(X3_1, X3_2);
+
+        X0_1 = RotateLeft<7>(X0_1);
+        X1_1 = RotateLeft<7>(X1_1);
+        X2_1 = RotateLeft<7>(X2_1);
+        X3_1 = RotateLeft<7>(X3_1);
+
+        X0_1 = _mm256_shuffle_epi32(X0_1, _MM_SHUFFLE(0, 3, 2, 1));
+        X0_2 = _mm256_shuffle_epi32(X0_2, _MM_SHUFFLE(1, 0, 3, 2));
+        X0_3 = _mm256_shuffle_epi32(X0_3, _MM_SHUFFLE(2, 1, 0, 3));
+
+        X1_1 = _mm256_shuffle_epi32(X1_1, _MM_SHUFFLE(0, 3, 2, 1));
+        X1_2 = _mm256_shuffle_epi32(X1_2, _MM_SHUFFLE(1, 0, 3, 2));
+        X1_3 = _mm256_shuffle_epi32(X1_3, _MM_SHUFFLE(2, 1, 0, 3));
+
+        X2_1 = _mm256_shuffle_epi32(X2_1, _MM_SHUFFLE(0, 3, 2, 1));
+        X2_2 = _mm256_shuffle_epi32(X2_2, _MM_SHUFFLE(1, 0, 3, 2));
+        X2_3 = _mm256_shuffle_epi32(X2_3, _MM_SHUFFLE(2, 1, 0, 3));
+
+        X3_1 = _mm256_shuffle_epi32(X3_1, _MM_SHUFFLE(0, 3, 2, 1));
+        X3_2 = _mm256_shuffle_epi32(X3_2, _MM_SHUFFLE(1, 0, 3, 2));
+        X3_3 = _mm256_shuffle_epi32(X3_3, _MM_SHUFFLE(2, 1, 0, 3));
+
+        X0_0 = _mm256_add_epi32(X0_0, X0_1);
+        X1_0 = _mm256_add_epi32(X1_0, X1_1);
+        X2_0 = _mm256_add_epi32(X2_0, X2_1);
+        X3_0 = _mm256_add_epi32(X3_0, X3_1);
+
+        X0_3 = _mm256_xor_si256(X0_3, X0_0);
+        X1_3 = _mm256_xor_si256(X1_3, X1_0);
+        X2_3 = _mm256_xor_si256(X2_3, X2_0);
+        X3_3 = _mm256_xor_si256(X3_3, X3_0);
+
+        X0_3 = RotateLeft<16>(X0_3);
+        X1_3 = RotateLeft<16>(X1_3);
+        X2_3 = RotateLeft<16>(X2_3);
+        X3_3 = RotateLeft<16>(X3_3);
+
+        X0_2 = _mm256_add_epi32(X0_2, X0_3);
+        X1_2 = _mm256_add_epi32(X1_2, X1_3);
+        X2_2 = _mm256_add_epi32(X2_2, X2_3);
+        X3_2 = _mm256_add_epi32(X3_2, X3_3);
+
+        X0_1 = _mm256_xor_si256(X0_1, X0_2);
+        X1_1 = _mm256_xor_si256(X1_1, X1_2);
+        X2_1 = _mm256_xor_si256(X2_1, X2_2);
+        X3_1 = _mm256_xor_si256(X3_1, X3_2);
+
+        X0_1 = RotateLeft<12>(X0_1);
+        X1_1 = RotateLeft<12>(X1_1);
+        X2_1 = RotateLeft<12>(X2_1);
+        X3_1 = RotateLeft<12>(X3_1);
+
+        X0_0 = _mm256_add_epi32(X0_0, X0_1);
+        X1_0 = _mm256_add_epi32(X1_0, X1_1);
+        X2_0 = _mm256_add_epi32(X2_0, X2_1);
+        X3_0 = _mm256_add_epi32(X3_0, X3_1);
+
+        X0_3 = _mm256_xor_si256(X0_3, X0_0);
+        X1_3 = _mm256_xor_si256(X1_3, X1_0);
+        X2_3 = _mm256_xor_si256(X2_3, X2_0);
+        X3_3 = _mm256_xor_si256(X3_3, X3_0);
+
+        X0_3 = RotateLeft<8>(X0_3);
+        X1_3 = RotateLeft<8>(X1_3);
+        X2_3 = RotateLeft<8>(X2_3);
+        X3_3 = RotateLeft<8>(X3_3);
+
+        X0_2 = _mm256_add_epi32(X0_2, X0_3);
+        X1_2 = _mm256_add_epi32(X1_2, X1_3);
+        X2_2 = _mm256_add_epi32(X2_2, X2_3);
+        X3_2 = _mm256_add_epi32(X3_2, X3_3);
+
+        X0_1 = _mm256_xor_si256(X0_1, X0_2);
+        X1_1 = _mm256_xor_si256(X1_1, X1_2);
+        X2_1 = _mm256_xor_si256(X2_1, X2_2);
+        X3_1 = _mm256_xor_si256(X3_1, X3_2);
+
+        X0_1 = RotateLeft<7>(X0_1);
+        X1_1 = RotateLeft<7>(X1_1);
+        X2_1 = RotateLeft<7>(X2_1);
+        X3_1 = RotateLeft<7>(X3_1);
+
+        X0_1 = _mm256_shuffle_epi32(X0_1, _MM_SHUFFLE(2, 1, 0, 3));
+        X0_2 = _mm256_shuffle_epi32(X0_2, _MM_SHUFFLE(1, 0, 3, 2));
+        X0_3 = _mm256_shuffle_epi32(X0_3, _MM_SHUFFLE(0, 3, 2, 1));
+
+        X1_1 = _mm256_shuffle_epi32(X1_1, _MM_SHUFFLE(2, 1, 0, 3));
+        X1_2 = _mm256_shuffle_epi32(X1_2, _MM_SHUFFLE(1, 0, 3, 2));
+        X1_3 = _mm256_shuffle_epi32(X1_3, _MM_SHUFFLE(0, 3, 2, 1));
+
+        X2_1 = _mm256_shuffle_epi32(X2_1, _MM_SHUFFLE(2, 1, 0, 3));
+        X2_2 = _mm256_shuffle_epi32(X2_2, _MM_SHUFFLE(1, 0, 3, 2));
+        X2_3 = _mm256_shuffle_epi32(X2_3, _MM_SHUFFLE(0, 3, 2, 1));
+
+        X3_1 = _mm256_shuffle_epi32(X3_1, _MM_SHUFFLE(2, 1, 0, 3));
+        X3_2 = _mm256_shuffle_epi32(X3_2, _MM_SHUFFLE(1, 0, 3, 2));
+        X3_3 = _mm256_shuffle_epi32(X3_3, _MM_SHUFFLE(0, 3, 2, 1));
+    }
+
+    X0_0 = _mm256_add_epi32(X0_0, state0);
+    X0_1 = _mm256_add_epi32(X0_1, state1);
+    X0_2 = _mm256_add_epi32(X0_2, state2);
+    X0_3 = _mm256_add_epi32(X0_3, state3);
+    X0_3 = _mm256_add_epi32(X0_3, CTR0);
+
+    X1_0 = _mm256_add_epi32(X1_0, state0);
+    X1_1 = _mm256_add_epi32(X1_1, state1);
+    X1_2 = _mm256_add_epi32(X1_2, state2);
+    X1_3 = _mm256_add_epi32(X1_3, state3);
+    X1_3 = _mm256_add_epi32(X1_3, CTR1);
+
+    X2_0 = _mm256_add_epi32(X2_0, state0);
+    X2_1 = _mm256_add_epi32(X2_1, state1);
+    X2_2 = _mm256_add_epi32(X2_2, state2);
+    X2_3 = _mm256_add_epi32(X2_3, state3);
+    X2_3 = _mm256_add_epi32(X2_3, CTR2);
+
+    X3_0 = _mm256_add_epi32(X3_0, state0);
+    X3_1 = _mm256_add_epi32(X3_1, state1);
+    X3_2 = _mm256_add_epi32(X3_2, state2);
+    X3_3 = _mm256_add_epi32(X3_3, state3);
+    X3_3 = _mm256_add_epi32(X3_3, CTR3);
+
+    if (input)
+    {
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+0*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X0_0, X0_1, 1 + (3 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+0*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+1*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X0_2, X0_3, 1 + (3 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+1*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+2*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X1_0, X1_1, 1 + (3 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+2*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+3*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X1_2, X1_3, 1 + (3 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+3*32)))));
+    }
+    else
+    {
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+0*32),
+            _mm256_permute2x128_si256(X0_0, X0_1, 1 + (3 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+1*32),
+            _mm256_permute2x128_si256(X0_2, X0_3, 1 + (3 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+2*32),
+            _mm256_permute2x128_si256(X1_0, X1_1, 1 + (3 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+3*32),
+            _mm256_permute2x128_si256(X1_2, X1_3, 1 + (3 << 4)));
+    }
+
+    if (input)
+    {
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+4*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X2_0, X2_1, 1 + (3 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+4*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+5*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X2_2, X2_3, 1 + (3 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+5*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+6*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X3_0, X3_1, 1 + (3 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+6*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+7*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X3_2, X3_3, 1 + (3 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+7*32)))));
+    }
+    else
+    {
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+4*32),
+            _mm256_permute2x128_si256(X2_0, X2_1, 1 + (3 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+5*32),
+            _mm256_permute2x128_si256(X2_2, X2_3, 1 + (3 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+6*32),
+            _mm256_permute2x128_si256(X3_0, X3_1, 1 + (3 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+7*32),
+            _mm256_permute2x128_si256(X3_2, X3_3, 1 + (3 << 4)));
+    }
+
+    if (input)
+    {
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+ 8*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X0_0, X0_1, 0 + (2 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+8*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+ 9*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X0_2, X0_3, 0 + (2 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+9*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+10*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X1_0, X1_1, 0 + (2 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+10*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+11*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X1_2, X1_3, 0 + (2 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+11*32)))));
+    }
+    else
+    {
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+ 8*32),
+            _mm256_permute2x128_si256(X0_0, X0_1, 0 + (2 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+ 9*32),
+            _mm256_permute2x128_si256(X0_2, X0_3, 0 + (2 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+10*32),
+            _mm256_permute2x128_si256(X1_0, X1_1, 0 + (2 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+11*32),
+            _mm256_permute2x128_si256(X1_2, X1_3, 0 + (2 << 4)));
+    }
+
+    if (input)
+    {
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+12*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X2_0, X2_1, 0 + (2 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+12*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+13*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X2_2, X2_3, 0 + (2 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+13*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+14*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X3_0, X3_1, 0 + (2 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+14*32)))));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+15*32),
+            _mm256_xor_si256(_mm256_permute2x128_si256(X3_2, X3_3, 0 + (2 << 4)),
+            _mm256_loadu_si256(const_cast<MAYBE_CONST __m256i*>(reinterpret_cast<const __m256i*>(input+15*32)))));
+    }
+    else
+    {
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+12*32),
+            _mm256_permute2x128_si256(X2_0, X2_1, 0 + (2 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+13*32),
+            _mm256_permute2x128_si256(X2_2, X2_3, 0 + (2 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+14*32),
+            _mm256_permute2x128_si256(X3_0, X3_1, 0 + (2 << 4)));
+        _mm256_storeu_si256(reinterpret_cast<__m256i*>(output+15*32),
+            _mm256_permute2x128_si256(X3_2, X3_3, 0 + (2 << 4)));
+    }
+
+    // https://software.intel.com/en-us/articles/avoiding-avx-sse-transition-penalties
+    _mm256_zeroupper();
+}
+
+#endif  // CRYPTOPP_AVX2_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/chacha_simd.cpp b/runtime/third_party/cryptopp/chacha_simd.cpp
new file mode 100644
index 0000000..21272fe
--- /dev/null
+++ b/runtime/third_party/cryptopp/chacha_simd.cpp
@@ -0,0 +1,1109 @@
+// chacha_simd.cpp - written and placed in the public domain by
+//                   Jack Lloyd and Jeffrey Walton
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    SSE2, ARM NEON and ARMv8a, Power7 and Altivec instructions. A separate
+//    source file is needed because additional CXXFLAGS are required to enable
+//    the appropriate instructions sets in some build configurations.
+//
+//    SSE2 implementation based on Botan's chacha_sse2.cpp. Many thanks
+//    to Jack Lloyd and the Botan team for allowing us to use it.
+//
+//    The SSE2 implementation is kind of unusual among Crypto++ algorithms.
+//    We guard on CRYTPOPP_SSE2_AVAILABLE and use HasSSE2() at runtime. However,
+//    if the compiler says a target machine has SSSE3 or XOP available (say, by
+//    way of -march=native), then we can pull another 150 to 800 MB/s out of
+//    ChaCha. To capture SSSE3 and XOP we use the compiler defines __SSSE3__ and
+//    __XOP__ and forgo runtime tests.
+//
+//    Runtime tests for HasSSSE3() and HasXop() are too expensive to make a
+//    sub-case of SSE2. The rotates are on a critical path and the runtime tests
+//    crush performance.
+//
+//    Here are some relative numbers for ChaCha8:
+//    * Intel Skylake, 3.0 GHz: SSE2 at 2160 MB/s; SSSE3 at 2310 MB/s.
+//    * AMD Bulldozer, 3.3 GHz: SSE2 at 1680 MB/s; XOP at 2510 MB/s.
+
+#include "pch.h"
+#include "config.h"
+
+#include "chacha.h"
+#include "misc.h"
+
+// Internal compiler error in GCC 3.3 and below
+#if defined(__GNUC__) && (__GNUC__ < 4)
+# undef CRYPTOPP_SSE2_INTRIN_AVAILABLE
+#endif
+
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+# include <xmmintrin.h>
+# include <emmintrin.h>
+#endif
+
+#if defined(__SSSE3__)
+# include <tmmintrin.h>
+#endif
+
+#if defined(__XOP__)
+# if defined(CRYPTOPP_GCC_COMPATIBLE)
+#  include <x86intrin.h>
+# endif
+# include <ammintrin.h>
+#endif  // XOP
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include <arm_neon.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+# include "ppc_simd.h"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char CHACHA_SIMD_FNAME[] = __FILE__;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+// ***************************** NEON ***************************** //
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+
+template <unsigned int R>
+inline uint32x4_t RotateLeft(const uint32x4_t& val)
+{
+    return vorrq_u32(vshlq_n_u32(val, R), vshrq_n_u32(val, 32 - R));
+}
+
+template <unsigned int R>
+inline uint32x4_t RotateRight(const uint32x4_t& val)
+{
+    return vorrq_u32(vshlq_n_u32(val, 32 - R), vshrq_n_u32(val, R));
+}
+
+template <>
+inline uint32x4_t RotateLeft<8>(const uint32x4_t& val)
+{
+#if defined(__aarch32__) || defined(__aarch64__)
+    const uint8_t maskb[16] = { 3,0,1,2, 7,4,5,6, 11,8,9,10, 15,12,13,14 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+
+    return vreinterpretq_u32_u8(
+        vqtbl1q_u8(vreinterpretq_u8_u32(val), mask));
+#else
+    // fallback to slower C++ rotation.
+    return vorrq_u32(vshlq_n_u32(val, 8),
+        vshrq_n_u32(val, 32 - 8));
+#endif
+}
+
+template <>
+inline uint32x4_t RotateLeft<16>(const uint32x4_t& val)
+{
+#if defined(__aarch32__) || defined(__aarch64__)
+    return vreinterpretq_u32_u16(
+        vrev32q_u16(vreinterpretq_u16_u32(val)));
+#else
+    // fallback to slower C++ rotation.
+    return vorrq_u32(vshlq_n_u32(val, 16),
+        vshrq_n_u32(val, 32 - 16));
+#endif
+}
+
+template <>
+inline uint32x4_t RotateRight<8>(const uint32x4_t& val)
+{
+#if defined(__aarch32__) || defined(__aarch64__)
+    const uint8_t maskb[16] = { 1,2,3,0, 5,6,7,4, 9,10,11,8, 13,14,15,12 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+
+    return vreinterpretq_u32_u8(
+        vqtbl1q_u8(vreinterpretq_u8_u32(val), mask));
+#else
+    // fallback to slower C++ rotation.
+    return vorrq_u32(vshrq_n_u32(val, 8),
+        vshlq_n_u32(val, 32 - 8));
+#endif
+}
+
+template <>
+inline uint32x4_t RotateRight<16>(const uint32x4_t& val)
+{
+#if defined(__aarch32__) || defined(__aarch64__)
+    return vreinterpretq_u32_u16(
+        vrev32q_u16(vreinterpretq_u16_u32(val)));
+#else
+    // fallback to slower C++ rotation.
+    return vorrq_u32(vshrq_n_u32(val, 16),
+        vshlq_n_u32(val, 32 - 16));
+#endif
+}
+
+// ChaCha's use of x86 shuffle is really a 4, 8, or 12 byte
+// rotation on the 128-bit vector word:
+//   * [3,2,1,0] => [0,3,2,1] is Extract<1>(x)
+//   * [3,2,1,0] => [1,0,3,2] is Extract<2>(x)
+//   * [3,2,1,0] => [2,1,0,3] is Extract<3>(x)
+template <unsigned int S>
+inline uint32x4_t Extract(const uint32x4_t& val)
+{
+    return vextq_u32(val, val, S);
+}
+
+// Helper to perform 64-bit addition across two elements of 32-bit vectors
+inline uint32x4_t Add64(const uint32x4_t& a, const uint32x4_t& b)
+{
+    return vreinterpretq_u32_u64(
+        vaddq_u64(
+            vreinterpretq_u64_u32(a),
+            vreinterpretq_u64_u32(b)));
+}
+
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+// ***************************** SSE2 ***************************** //
+
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+
+template <unsigned int R>
+inline __m128i RotateLeft(const __m128i val)
+{
+#ifdef __XOP__
+    return _mm_roti_epi32(val, R);
+#else
+    return _mm_or_si128(_mm_slli_epi32(val, R), _mm_srli_epi32(val, 32-R));
+#endif
+}
+
+template <>
+inline __m128i RotateLeft<8>(const __m128i val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, 8);
+#elif defined(__SSSE3__)
+    const __m128i mask = _mm_set_epi8(14,13,12,15, 10,9,8,11, 6,5,4,7, 2,1,0,3);
+    return _mm_shuffle_epi8(val, mask);
+#else
+    return _mm_or_si128(_mm_slli_epi32(val, 8), _mm_srli_epi32(val, 32-8));
+#endif
+}
+
+template <>
+inline __m128i RotateLeft<16>(const __m128i val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, 16);
+#elif defined(__SSSE3__)
+    const __m128i mask = _mm_set_epi8(13,12,15,14, 9,8,11,10, 5,4,7,6, 1,0,3,2);
+    return _mm_shuffle_epi8(val, mask);
+#else
+    return _mm_or_si128(_mm_slli_epi32(val, 16), _mm_srli_epi32(val, 32-16));
+#endif
+}
+
+#endif  // CRYPTOPP_SSE2_INTRIN_AVAILABLE
+
+// **************************** Altivec **************************** //
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+
+// ChaCha_OperateKeystream is optimized for Altivec. However, Altivec
+// is supported by using vec_ld and vec_st, and using a composite VecAdd
+// that supports 64-bit element adds. vec_ld and vec_st add significant
+// overhead when memory is not aligned. Despite the drawbacks Altivec
+// is profitable. The numbers for ChaCha8 are:
+//
+//   PowerMac, C++, 2.0 GHz: 205 MB/s, 9.29 cpb
+//   PowerMac, Altivec, 2.0 GHz: 471 MB/s, 4.09 cpb
+
+using CryptoPP::uint8x16_p;
+using CryptoPP::uint32x4_p;
+using CryptoPP::VecLoad;
+using CryptoPP::VecLoadAligned;
+using CryptoPP::VecStore;
+using CryptoPP::VecPermute;
+
+// Permutes bytes in packed 32-bit words to little endian.
+// State is already in proper endian order. Input and
+// output must be permuted during load and save.
+inline uint32x4_p VecLoad32LE(const uint8_t src[16])
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p mask = {3,2,1,0, 7,6,5,4, 11,10,9,8, 15,14,13,12};
+    const uint32x4_p val = VecLoad(src);
+    return VecPermute(val, val, mask);
+#else
+    return VecLoad(src);
+#endif
+}
+
+// Permutes bytes in packed 32-bit words to little endian.
+// State is already in proper endian order. Input and
+// output must be permuted during load and save.
+inline void VecStore32LE(uint8_t dest[16], const uint32x4_p& val)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p mask = {3,2,1,0, 7,6,5,4, 11,10,9,8, 15,14,13,12};
+    VecStore(VecPermute(val, val, mask), dest);
+#else
+    return VecStore(val, dest);
+#endif
+}
+
+// ChaCha's use of x86 shuffle is really a 4, 8, or 12 byte
+// rotation on the 128-bit vector word:
+//   * [3,2,1,0] => [0,3,2,1] is Shuffle<1>(x)
+//   * [3,2,1,0] => [1,0,3,2] is Shuffle<2>(x)
+//   * [3,2,1,0] => [2,1,0,3] is Shuffle<3>(x)
+template <unsigned int S>
+inline uint32x4_p Shuffle(const uint32x4_p& val)
+{
+    CRYPTOPP_ASSERT(0);
+    return val;
+}
+
+template <>
+inline uint32x4_p Shuffle<1>(const uint32x4_p& val)
+{
+    const uint8x16_p mask = {4,5,6,7, 8,9,10,11, 12,13,14,15, 0,1,2,3};
+    return VecPermute(val, val, mask);
+}
+
+template <>
+inline uint32x4_p Shuffle<2>(const uint32x4_p& val)
+{
+    const uint8x16_p mask = {8,9,10,11, 12,13,14,15, 0,1,2,3, 4,5,6,7};
+    return VecPermute(val, val, mask);
+}
+
+template <>
+inline uint32x4_p Shuffle<3>(const uint32x4_p& val)
+{
+    const uint8x16_p mask = {12,13,14,15, 0,1,2,3, 4,5,6,7, 8,9,10,11};
+    return VecPermute(val, val, mask);
+}
+
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ***************************** NEON ***************************** //
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+
+void ChaCha_OperateKeystream_NEON(const word32 *state, const byte* input, byte *output, unsigned int rounds)
+{
+    const uint32x4_t state0 = vld1q_u32(state + 0*4);
+    const uint32x4_t state1 = vld1q_u32(state + 1*4);
+    const uint32x4_t state2 = vld1q_u32(state + 2*4);
+    const uint32x4_t state3 = vld1q_u32(state + 3*4);
+
+    const unsigned int w[] = {1,0,0,0, 2,0,0,0, 3,0,0,0};
+    const uint32x4_t CTRS[3] = {
+        vld1q_u32(w+0), vld1q_u32(w+4), vld1q_u32(w+8)
+    };
+
+    uint32x4_t r0_0 = state0;
+    uint32x4_t r0_1 = state1;
+    uint32x4_t r0_2 = state2;
+    uint32x4_t r0_3 = state3;
+
+    uint32x4_t r1_0 = state0;
+    uint32x4_t r1_1 = state1;
+    uint32x4_t r1_2 = state2;
+    uint32x4_t r1_3 = Add64(r0_3, CTRS[0]);
+
+    uint32x4_t r2_0 = state0;
+    uint32x4_t r2_1 = state1;
+    uint32x4_t r2_2 = state2;
+    uint32x4_t r2_3 = Add64(r0_3, CTRS[1]);
+
+    uint32x4_t r3_0 = state0;
+    uint32x4_t r3_1 = state1;
+    uint32x4_t r3_2 = state2;
+    uint32x4_t r3_3 = Add64(r0_3, CTRS[2]);
+
+    for (int i = static_cast<int>(rounds); i > 0; i -= 2)
+    {
+        r0_0 = vaddq_u32(r0_0, r0_1);
+        r1_0 = vaddq_u32(r1_0, r1_1);
+        r2_0 = vaddq_u32(r2_0, r2_1);
+        r3_0 = vaddq_u32(r3_0, r3_1);
+
+        r0_3 = veorq_u32(r0_3, r0_0);
+        r1_3 = veorq_u32(r1_3, r1_0);
+        r2_3 = veorq_u32(r2_3, r2_0);
+        r3_3 = veorq_u32(r3_3, r3_0);
+
+        r0_3 = RotateLeft<16>(r0_3);
+        r1_3 = RotateLeft<16>(r1_3);
+        r2_3 = RotateLeft<16>(r2_3);
+        r3_3 = RotateLeft<16>(r3_3);
+
+        r0_2 = vaddq_u32(r0_2, r0_3);
+        r1_2 = vaddq_u32(r1_2, r1_3);
+        r2_2 = vaddq_u32(r2_2, r2_3);
+        r3_2 = vaddq_u32(r3_2, r3_3);
+
+        r0_1 = veorq_u32(r0_1, r0_2);
+        r1_1 = veorq_u32(r1_1, r1_2);
+        r2_1 = veorq_u32(r2_1, r2_2);
+        r3_1 = veorq_u32(r3_1, r3_2);
+
+        r0_1 = RotateLeft<12>(r0_1);
+        r1_1 = RotateLeft<12>(r1_1);
+        r2_1 = RotateLeft<12>(r2_1);
+        r3_1 = RotateLeft<12>(r3_1);
+
+        r0_0 = vaddq_u32(r0_0, r0_1);
+        r1_0 = vaddq_u32(r1_0, r1_1);
+        r2_0 = vaddq_u32(r2_0, r2_1);
+        r3_0 = vaddq_u32(r3_0, r3_1);
+
+        r0_3 = veorq_u32(r0_3, r0_0);
+        r1_3 = veorq_u32(r1_3, r1_0);
+        r2_3 = veorq_u32(r2_3, r2_0);
+        r3_3 = veorq_u32(r3_3, r3_0);
+
+        r0_3 = RotateLeft<8>(r0_3);
+        r1_3 = RotateLeft<8>(r1_3);
+        r2_3 = RotateLeft<8>(r2_3);
+        r3_3 = RotateLeft<8>(r3_3);
+
+        r0_2 = vaddq_u32(r0_2, r0_3);
+        r1_2 = vaddq_u32(r1_2, r1_3);
+        r2_2 = vaddq_u32(r2_2, r2_3);
+        r3_2 = vaddq_u32(r3_2, r3_3);
+
+        r0_1 = veorq_u32(r0_1, r0_2);
+        r1_1 = veorq_u32(r1_1, r1_2);
+        r2_1 = veorq_u32(r2_1, r2_2);
+        r3_1 = veorq_u32(r3_1, r3_2);
+
+        r0_1 = RotateLeft<7>(r0_1);
+        r1_1 = RotateLeft<7>(r1_1);
+        r2_1 = RotateLeft<7>(r2_1);
+        r3_1 = RotateLeft<7>(r3_1);
+
+        r0_1 = Extract<1>(r0_1);
+        r0_2 = Extract<2>(r0_2);
+        r0_3 = Extract<3>(r0_3);
+
+        r1_1 = Extract<1>(r1_1);
+        r1_2 = Extract<2>(r1_2);
+        r1_3 = Extract<3>(r1_3);
+
+        r2_1 = Extract<1>(r2_1);
+        r2_2 = Extract<2>(r2_2);
+        r2_3 = Extract<3>(r2_3);
+
+        r3_1 = Extract<1>(r3_1);
+        r3_2 = Extract<2>(r3_2);
+        r3_3 = Extract<3>(r3_3);
+
+        r0_0 = vaddq_u32(r0_0, r0_1);
+        r1_0 = vaddq_u32(r1_0, r1_1);
+        r2_0 = vaddq_u32(r2_0, r2_1);
+        r3_0 = vaddq_u32(r3_0, r3_1);
+
+        r0_3 = veorq_u32(r0_3, r0_0);
+        r1_3 = veorq_u32(r1_3, r1_0);
+        r2_3 = veorq_u32(r2_3, r2_0);
+        r3_3 = veorq_u32(r3_3, r3_0);
+
+        r0_3 = RotateLeft<16>(r0_3);
+        r1_3 = RotateLeft<16>(r1_3);
+        r2_3 = RotateLeft<16>(r2_3);
+        r3_3 = RotateLeft<16>(r3_3);
+
+        r0_2 = vaddq_u32(r0_2, r0_3);
+        r1_2 = vaddq_u32(r1_2, r1_3);
+        r2_2 = vaddq_u32(r2_2, r2_3);
+        r3_2 = vaddq_u32(r3_2, r3_3);
+
+        r0_1 = veorq_u32(r0_1, r0_2);
+        r1_1 = veorq_u32(r1_1, r1_2);
+        r2_1 = veorq_u32(r2_1, r2_2);
+        r3_1 = veorq_u32(r3_1, r3_2);
+
+        r0_1 = RotateLeft<12>(r0_1);
+        r1_1 = RotateLeft<12>(r1_1);
+        r2_1 = RotateLeft<12>(r2_1);
+        r3_1 = RotateLeft<12>(r3_1);
+
+        r0_0 = vaddq_u32(r0_0, r0_1);
+        r1_0 = vaddq_u32(r1_0, r1_1);
+        r2_0 = vaddq_u32(r2_0, r2_1);
+        r3_0 = vaddq_u32(r3_0, r3_1);
+
+        r0_3 = veorq_u32(r0_3, r0_0);
+        r1_3 = veorq_u32(r1_3, r1_0);
+        r2_3 = veorq_u32(r2_3, r2_0);
+        r3_3 = veorq_u32(r3_3, r3_0);
+
+        r0_3 = RotateLeft<8>(r0_3);
+        r1_3 = RotateLeft<8>(r1_3);
+        r2_3 = RotateLeft<8>(r2_3);
+        r3_3 = RotateLeft<8>(r3_3);
+
+        r0_2 = vaddq_u32(r0_2, r0_3);
+        r1_2 = vaddq_u32(r1_2, r1_3);
+        r2_2 = vaddq_u32(r2_2, r2_3);
+        r3_2 = vaddq_u32(r3_2, r3_3);
+
+        r0_1 = veorq_u32(r0_1, r0_2);
+        r1_1 = veorq_u32(r1_1, r1_2);
+        r2_1 = veorq_u32(r2_1, r2_2);
+        r3_1 = veorq_u32(r3_1, r3_2);
+
+        r0_1 = RotateLeft<7>(r0_1);
+        r1_1 = RotateLeft<7>(r1_1);
+        r2_1 = RotateLeft<7>(r2_1);
+        r3_1 = RotateLeft<7>(r3_1);
+
+        r0_1 = Extract<3>(r0_1);
+        r0_2 = Extract<2>(r0_2);
+        r0_3 = Extract<1>(r0_3);
+
+        r1_1 = Extract<3>(r1_1);
+        r1_2 = Extract<2>(r1_2);
+        r1_3 = Extract<1>(r1_3);
+
+        r2_1 = Extract<3>(r2_1);
+        r2_2 = Extract<2>(r2_2);
+        r2_3 = Extract<1>(r2_3);
+
+        r3_1 = Extract<3>(r3_1);
+        r3_2 = Extract<2>(r3_2);
+        r3_3 = Extract<1>(r3_3);
+    }
+
+    r0_0 = vaddq_u32(r0_0, state0);
+    r0_1 = vaddq_u32(r0_1, state1);
+    r0_2 = vaddq_u32(r0_2, state2);
+    r0_3 = vaddq_u32(r0_3, state3);
+
+    r1_0 = vaddq_u32(r1_0, state0);
+    r1_1 = vaddq_u32(r1_1, state1);
+    r1_2 = vaddq_u32(r1_2, state2);
+    r1_3 = vaddq_u32(r1_3, state3);
+    r1_3 = Add64(r1_3, CTRS[0]);
+
+    r2_0 = vaddq_u32(r2_0, state0);
+    r2_1 = vaddq_u32(r2_1, state1);
+    r2_2 = vaddq_u32(r2_2, state2);
+    r2_3 = vaddq_u32(r2_3, state3);
+    r2_3 = Add64(r2_3, CTRS[1]);
+
+    r3_0 = vaddq_u32(r3_0, state0);
+    r3_1 = vaddq_u32(r3_1, state1);
+    r3_2 = vaddq_u32(r3_2, state2);
+    r3_3 = vaddq_u32(r3_3, state3);
+    r3_3 = Add64(r3_3, CTRS[2]);
+
+    if (input)
+    {
+        r0_0 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 0*16)), r0_0);
+        r0_1 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 1*16)), r0_1);
+        r0_2 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 2*16)), r0_2);
+        r0_3 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 3*16)), r0_3);
+    }
+
+    vst1q_u8(output + 0*16, vreinterpretq_u8_u32(r0_0));
+    vst1q_u8(output + 1*16, vreinterpretq_u8_u32(r0_1));
+    vst1q_u8(output + 2*16, vreinterpretq_u8_u32(r0_2));
+    vst1q_u8(output + 3*16, vreinterpretq_u8_u32(r0_3));
+
+    if (input)
+    {
+        r1_0 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 4*16)), r1_0);
+        r1_1 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 5*16)), r1_1);
+        r1_2 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 6*16)), r1_2);
+        r1_3 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 7*16)), r1_3);
+    }
+
+    vst1q_u8(output + 4*16, vreinterpretq_u8_u32(r1_0));
+    vst1q_u8(output + 5*16, vreinterpretq_u8_u32(r1_1));
+    vst1q_u8(output + 6*16, vreinterpretq_u8_u32(r1_2));
+    vst1q_u8(output + 7*16, vreinterpretq_u8_u32(r1_3));
+
+    if (input)
+    {
+        r2_0 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input +  8*16)), r2_0);
+        r2_1 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input +  9*16)), r2_1);
+        r2_2 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 10*16)), r2_2);
+        r2_3 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 11*16)), r2_3);
+    }
+
+    vst1q_u8(output +  8*16, vreinterpretq_u8_u32(r2_0));
+    vst1q_u8(output +  9*16, vreinterpretq_u8_u32(r2_1));
+    vst1q_u8(output + 10*16, vreinterpretq_u8_u32(r2_2));
+    vst1q_u8(output + 11*16, vreinterpretq_u8_u32(r2_3));
+
+    if (input)
+    {
+        r3_0 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 12*16)), r3_0);
+        r3_1 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 13*16)), r3_1);
+        r3_2 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 14*16)), r3_2);
+        r3_3 = veorq_u32(vreinterpretq_u32_u8(vld1q_u8(input + 15*16)), r3_3);
+    }
+
+    vst1q_u8(output + 12*16, vreinterpretq_u8_u32(r3_0));
+    vst1q_u8(output + 13*16, vreinterpretq_u8_u32(r3_1));
+    vst1q_u8(output + 14*16, vreinterpretq_u8_u32(r3_2));
+    vst1q_u8(output + 15*16, vreinterpretq_u8_u32(r3_3));
+}
+
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+// ***************************** SSE2 ***************************** //
+
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+
+void ChaCha_OperateKeystream_SSE2(const word32 *state, const byte* input, byte *output, unsigned int rounds)
+{
+    const __m128i state0 = _mm_load_si128(reinterpret_cast<const __m128i*>(state+0*4));
+    const __m128i state1 = _mm_load_si128(reinterpret_cast<const __m128i*>(state+1*4));
+    const __m128i state2 = _mm_load_si128(reinterpret_cast<const __m128i*>(state+2*4));
+    const __m128i state3 = _mm_load_si128(reinterpret_cast<const __m128i*>(state+3*4));
+
+    __m128i r0_0 = state0;
+    __m128i r0_1 = state1;
+    __m128i r0_2 = state2;
+    __m128i r0_3 = state3;
+
+    __m128i r1_0 = state0;
+    __m128i r1_1 = state1;
+    __m128i r1_2 = state2;
+    __m128i r1_3 = _mm_add_epi64(r0_3, _mm_set_epi32(0, 0, 0, 1));
+
+    __m128i r2_0 = state0;
+    __m128i r2_1 = state1;
+    __m128i r2_2 = state2;
+    __m128i r2_3 = _mm_add_epi64(r0_3, _mm_set_epi32(0, 0, 0, 2));
+
+    __m128i r3_0 = state0;
+    __m128i r3_1 = state1;
+    __m128i r3_2 = state2;
+    __m128i r3_3 = _mm_add_epi64(r0_3, _mm_set_epi32(0, 0, 0, 3));
+
+    for (int i = static_cast<int>(rounds); i > 0; i -= 2)
+    {
+        r0_0 = _mm_add_epi32(r0_0, r0_1);
+        r1_0 = _mm_add_epi32(r1_0, r1_1);
+        r2_0 = _mm_add_epi32(r2_0, r2_1);
+        r3_0 = _mm_add_epi32(r3_0, r3_1);
+
+        r0_3 = _mm_xor_si128(r0_3, r0_0);
+        r1_3 = _mm_xor_si128(r1_3, r1_0);
+        r2_3 = _mm_xor_si128(r2_3, r2_0);
+        r3_3 = _mm_xor_si128(r3_3, r3_0);
+
+        r0_3 = RotateLeft<16>(r0_3);
+        r1_3 = RotateLeft<16>(r1_3);
+        r2_3 = RotateLeft<16>(r2_3);
+        r3_3 = RotateLeft<16>(r3_3);
+
+        r0_2 = _mm_add_epi32(r0_2, r0_3);
+        r1_2 = _mm_add_epi32(r1_2, r1_3);
+        r2_2 = _mm_add_epi32(r2_2, r2_3);
+        r3_2 = _mm_add_epi32(r3_2, r3_3);
+
+        r0_1 = _mm_xor_si128(r0_1, r0_2);
+        r1_1 = _mm_xor_si128(r1_1, r1_2);
+        r2_1 = _mm_xor_si128(r2_1, r2_2);
+        r3_1 = _mm_xor_si128(r3_1, r3_2);
+
+        r0_1 = RotateLeft<12>(r0_1);
+        r1_1 = RotateLeft<12>(r1_1);
+        r2_1 = RotateLeft<12>(r2_1);
+        r3_1 = RotateLeft<12>(r3_1);
+
+        r0_0 = _mm_add_epi32(r0_0, r0_1);
+        r1_0 = _mm_add_epi32(r1_0, r1_1);
+        r2_0 = _mm_add_epi32(r2_0, r2_1);
+        r3_0 = _mm_add_epi32(r3_0, r3_1);
+
+        r0_3 = _mm_xor_si128(r0_3, r0_0);
+        r1_3 = _mm_xor_si128(r1_3, r1_0);
+        r2_3 = _mm_xor_si128(r2_3, r2_0);
+        r3_3 = _mm_xor_si128(r3_3, r3_0);
+
+        r0_3 = RotateLeft<8>(r0_3);
+        r1_3 = RotateLeft<8>(r1_3);
+        r2_3 = RotateLeft<8>(r2_3);
+        r3_3 = RotateLeft<8>(r3_3);
+
+        r0_2 = _mm_add_epi32(r0_2, r0_3);
+        r1_2 = _mm_add_epi32(r1_2, r1_3);
+        r2_2 = _mm_add_epi32(r2_2, r2_3);
+        r3_2 = _mm_add_epi32(r3_2, r3_3);
+
+        r0_1 = _mm_xor_si128(r0_1, r0_2);
+        r1_1 = _mm_xor_si128(r1_1, r1_2);
+        r2_1 = _mm_xor_si128(r2_1, r2_2);
+        r3_1 = _mm_xor_si128(r3_1, r3_2);
+
+        r0_1 = RotateLeft<7>(r0_1);
+        r1_1 = RotateLeft<7>(r1_1);
+        r2_1 = RotateLeft<7>(r2_1);
+        r3_1 = RotateLeft<7>(r3_1);
+
+        r0_1 = _mm_shuffle_epi32(r0_1, _MM_SHUFFLE(0, 3, 2, 1));
+        r0_2 = _mm_shuffle_epi32(r0_2, _MM_SHUFFLE(1, 0, 3, 2));
+        r0_3 = _mm_shuffle_epi32(r0_3, _MM_SHUFFLE(2, 1, 0, 3));
+
+        r1_1 = _mm_shuffle_epi32(r1_1, _MM_SHUFFLE(0, 3, 2, 1));
+        r1_2 = _mm_shuffle_epi32(r1_2, _MM_SHUFFLE(1, 0, 3, 2));
+        r1_3 = _mm_shuffle_epi32(r1_3, _MM_SHUFFLE(2, 1, 0, 3));
+
+        r2_1 = _mm_shuffle_epi32(r2_1, _MM_SHUFFLE(0, 3, 2, 1));
+        r2_2 = _mm_shuffle_epi32(r2_2, _MM_SHUFFLE(1, 0, 3, 2));
+        r2_3 = _mm_shuffle_epi32(r2_3, _MM_SHUFFLE(2, 1, 0, 3));
+
+        r3_1 = _mm_shuffle_epi32(r3_1, _MM_SHUFFLE(0, 3, 2, 1));
+        r3_2 = _mm_shuffle_epi32(r3_2, _MM_SHUFFLE(1, 0, 3, 2));
+        r3_3 = _mm_shuffle_epi32(r3_3, _MM_SHUFFLE(2, 1, 0, 3));
+
+        r0_0 = _mm_add_epi32(r0_0, r0_1);
+        r1_0 = _mm_add_epi32(r1_0, r1_1);
+        r2_0 = _mm_add_epi32(r2_0, r2_1);
+        r3_0 = _mm_add_epi32(r3_0, r3_1);
+
+        r0_3 = _mm_xor_si128(r0_3, r0_0);
+        r1_3 = _mm_xor_si128(r1_3, r1_0);
+        r2_3 = _mm_xor_si128(r2_3, r2_0);
+        r3_3 = _mm_xor_si128(r3_3, r3_0);
+
+        r0_3 = RotateLeft<16>(r0_3);
+        r1_3 = RotateLeft<16>(r1_3);
+        r2_3 = RotateLeft<16>(r2_3);
+        r3_3 = RotateLeft<16>(r3_3);
+
+        r0_2 = _mm_add_epi32(r0_2, r0_3);
+        r1_2 = _mm_add_epi32(r1_2, r1_3);
+        r2_2 = _mm_add_epi32(r2_2, r2_3);
+        r3_2 = _mm_add_epi32(r3_2, r3_3);
+
+        r0_1 = _mm_xor_si128(r0_1, r0_2);
+        r1_1 = _mm_xor_si128(r1_1, r1_2);
+        r2_1 = _mm_xor_si128(r2_1, r2_2);
+        r3_1 = _mm_xor_si128(r3_1, r3_2);
+
+        r0_1 = RotateLeft<12>(r0_1);
+        r1_1 = RotateLeft<12>(r1_1);
+        r2_1 = RotateLeft<12>(r2_1);
+        r3_1 = RotateLeft<12>(r3_1);
+
+        r0_0 = _mm_add_epi32(r0_0, r0_1);
+        r1_0 = _mm_add_epi32(r1_0, r1_1);
+        r2_0 = _mm_add_epi32(r2_0, r2_1);
+        r3_0 = _mm_add_epi32(r3_0, r3_1);
+
+        r0_3 = _mm_xor_si128(r0_3, r0_0);
+        r1_3 = _mm_xor_si128(r1_3, r1_0);
+        r2_3 = _mm_xor_si128(r2_3, r2_0);
+        r3_3 = _mm_xor_si128(r3_3, r3_0);
+
+        r0_3 = RotateLeft<8>(r0_3);
+        r1_3 = RotateLeft<8>(r1_3);
+        r2_3 = RotateLeft<8>(r2_3);
+        r3_3 = RotateLeft<8>(r3_3);
+
+        r0_2 = _mm_add_epi32(r0_2, r0_3);
+        r1_2 = _mm_add_epi32(r1_2, r1_3);
+        r2_2 = _mm_add_epi32(r2_2, r2_3);
+        r3_2 = _mm_add_epi32(r3_2, r3_3);
+
+        r0_1 = _mm_xor_si128(r0_1, r0_2);
+        r1_1 = _mm_xor_si128(r1_1, r1_2);
+        r2_1 = _mm_xor_si128(r2_1, r2_2);
+        r3_1 = _mm_xor_si128(r3_1, r3_2);
+
+        r0_1 = RotateLeft<7>(r0_1);
+        r1_1 = RotateLeft<7>(r1_1);
+        r2_1 = RotateLeft<7>(r2_1);
+        r3_1 = RotateLeft<7>(r3_1);
+
+        r0_1 = _mm_shuffle_epi32(r0_1, _MM_SHUFFLE(2, 1, 0, 3));
+        r0_2 = _mm_shuffle_epi32(r0_2, _MM_SHUFFLE(1, 0, 3, 2));
+        r0_3 = _mm_shuffle_epi32(r0_3, _MM_SHUFFLE(0, 3, 2, 1));
+
+        r1_1 = _mm_shuffle_epi32(r1_1, _MM_SHUFFLE(2, 1, 0, 3));
+        r1_2 = _mm_shuffle_epi32(r1_2, _MM_SHUFFLE(1, 0, 3, 2));
+        r1_3 = _mm_shuffle_epi32(r1_3, _MM_SHUFFLE(0, 3, 2, 1));
+
+        r2_1 = _mm_shuffle_epi32(r2_1, _MM_SHUFFLE(2, 1, 0, 3));
+        r2_2 = _mm_shuffle_epi32(r2_2, _MM_SHUFFLE(1, 0, 3, 2));
+        r2_3 = _mm_shuffle_epi32(r2_3, _MM_SHUFFLE(0, 3, 2, 1));
+
+        r3_1 = _mm_shuffle_epi32(r3_1, _MM_SHUFFLE(2, 1, 0, 3));
+        r3_2 = _mm_shuffle_epi32(r3_2, _MM_SHUFFLE(1, 0, 3, 2));
+        r3_3 = _mm_shuffle_epi32(r3_3, _MM_SHUFFLE(0, 3, 2, 1));
+    }
+
+    r0_0 = _mm_add_epi32(r0_0, state0);
+    r0_1 = _mm_add_epi32(r0_1, state1);
+    r0_2 = _mm_add_epi32(r0_2, state2);
+    r0_3 = _mm_add_epi32(r0_3, state3);
+
+    r1_0 = _mm_add_epi32(r1_0, state0);
+    r1_1 = _mm_add_epi32(r1_1, state1);
+    r1_2 = _mm_add_epi32(r1_2, state2);
+    r1_3 = _mm_add_epi32(r1_3, state3);
+    r1_3 = _mm_add_epi64(r1_3, _mm_set_epi32(0, 0, 0, 1));
+
+    r2_0 = _mm_add_epi32(r2_0, state0);
+    r2_1 = _mm_add_epi32(r2_1, state1);
+    r2_2 = _mm_add_epi32(r2_2, state2);
+    r2_3 = _mm_add_epi32(r2_3, state3);
+    r2_3 = _mm_add_epi64(r2_3, _mm_set_epi32(0, 0, 0, 2));
+
+    r3_0 = _mm_add_epi32(r3_0, state0);
+    r3_1 = _mm_add_epi32(r3_1, state1);
+    r3_2 = _mm_add_epi32(r3_2, state2);
+    r3_3 = _mm_add_epi32(r3_3, state3);
+    r3_3 = _mm_add_epi64(r3_3, _mm_set_epi32(0, 0, 0, 3));
+
+    if (input)
+    {
+        r0_0 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+0*16)), r0_0);
+        r0_1 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+1*16)), r0_1);
+        r0_2 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+2*16)), r0_2);
+        r0_3 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+3*16)), r0_3);
+    }
+
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+0*16), r0_0);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+1*16), r0_1);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+2*16), r0_2);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+3*16), r0_3);
+
+    if (input)
+    {
+        r1_0 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+4*16)), r1_0);
+        r1_1 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+5*16)), r1_1);
+        r1_2 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+6*16)), r1_2);
+        r1_3 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+7*16)), r1_3);
+    }
+
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+4*16), r1_0);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+5*16), r1_1);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+6*16), r1_2);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+7*16), r1_3);
+
+    if (input)
+    {
+        r2_0 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+ 8*16)), r2_0);
+        r2_1 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+ 9*16)), r2_1);
+        r2_2 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+10*16)), r2_2);
+        r2_3 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+11*16)), r2_3);
+    }
+
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+ 8*16), r2_0);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+ 9*16), r2_1);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+10*16), r2_2);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+11*16), r2_3);
+
+    if (input)
+    {
+        r3_0 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+12*16)), r3_0);
+        r3_1 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+13*16)), r3_1);
+        r3_2 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+14*16)), r3_2);
+        r3_3 = _mm_xor_si128(_mm_loadu_si128(reinterpret_cast<const __m128i*>(input+15*16)), r3_3);
+    }
+
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+12*16), r3_0);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+13*16), r3_1);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+14*16), r3_2);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(output+15*16), r3_3);
+}
+
+#endif  // CRYPTOPP_SSE2_INTRIN_AVAILABLE
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+
+// ChaCha_OperateKeystream_CORE will use either POWER7 or ALTIVEC,
+// depending on the flags used to compile this source file. The
+// abstractions are handled in VecLoad, VecStore and friends. In
+// the future we may to provide both POWER7 or ALTIVEC at the same
+// time to better support distros.
+inline void ChaCha_OperateKeystream_CORE(const word32 *state, const byte* input, byte *output, unsigned int rounds)
+{
+    const uint32x4_p state0 = VecLoadAligned(state + 0*4);
+    const uint32x4_p state1 = VecLoadAligned(state + 1*4);
+    const uint32x4_p state2 = VecLoadAligned(state + 2*4);
+    const uint32x4_p state3 = VecLoadAligned(state + 3*4);
+
+    const uint32x4_p CTRS[3] = {
+        {1,0,0,0}, {2,0,0,0}, {3,0,0,0}
+    };
+
+    uint32x4_p r0_0 = state0;
+    uint32x4_p r0_1 = state1;
+    uint32x4_p r0_2 = state2;
+    uint32x4_p r0_3 = state3;
+
+    uint32x4_p r1_0 = state0;
+    uint32x4_p r1_1 = state1;
+    uint32x4_p r1_2 = state2;
+    uint32x4_p r1_3 = VecAdd64(r0_3, CTRS[0]);
+
+    uint32x4_p r2_0 = state0;
+    uint32x4_p r2_1 = state1;
+    uint32x4_p r2_2 = state2;
+    uint32x4_p r2_3 = VecAdd64(r0_3, CTRS[1]);
+
+    uint32x4_p r3_0 = state0;
+    uint32x4_p r3_1 = state1;
+    uint32x4_p r3_2 = state2;
+    uint32x4_p r3_3 = VecAdd64(r0_3, CTRS[2]);
+
+    for (int i = static_cast<int>(rounds); i > 0; i -= 2)
+    {
+        r0_0 = VecAdd(r0_0, r0_1);
+        r1_0 = VecAdd(r1_0, r1_1);
+        r2_0 = VecAdd(r2_0, r2_1);
+        r3_0 = VecAdd(r3_0, r3_1);
+
+        r0_3 = VecXor(r0_3, r0_0);
+        r1_3 = VecXor(r1_3, r1_0);
+        r2_3 = VecXor(r2_3, r2_0);
+        r3_3 = VecXor(r3_3, r3_0);
+
+        r0_3 = VecRotateLeft<16>(r0_3);
+        r1_3 = VecRotateLeft<16>(r1_3);
+        r2_3 = VecRotateLeft<16>(r2_3);
+        r3_3 = VecRotateLeft<16>(r3_3);
+
+        r0_2 = VecAdd(r0_2, r0_3);
+        r1_2 = VecAdd(r1_2, r1_3);
+        r2_2 = VecAdd(r2_2, r2_3);
+        r3_2 = VecAdd(r3_2, r3_3);
+
+        r0_1 = VecXor(r0_1, r0_2);
+        r1_1 = VecXor(r1_1, r1_2);
+        r2_1 = VecXor(r2_1, r2_2);
+        r3_1 = VecXor(r3_1, r3_2);
+
+        r0_1 = VecRotateLeft<12>(r0_1);
+        r1_1 = VecRotateLeft<12>(r1_1);
+        r2_1 = VecRotateLeft<12>(r2_1);
+        r3_1 = VecRotateLeft<12>(r3_1);
+
+        r0_0 = VecAdd(r0_0, r0_1);
+        r1_0 = VecAdd(r1_0, r1_1);
+        r2_0 = VecAdd(r2_0, r2_1);
+        r3_0 = VecAdd(r3_0, r3_1);
+
+        r0_3 = VecXor(r0_3, r0_0);
+        r1_3 = VecXor(r1_3, r1_0);
+        r2_3 = VecXor(r2_3, r2_0);
+        r3_3 = VecXor(r3_3, r3_0);
+
+        r0_3 = VecRotateLeft<8>(r0_3);
+        r1_3 = VecRotateLeft<8>(r1_3);
+        r2_3 = VecRotateLeft<8>(r2_3);
+        r3_3 = VecRotateLeft<8>(r3_3);
+
+        r0_2 = VecAdd(r0_2, r0_3);
+        r1_2 = VecAdd(r1_2, r1_3);
+        r2_2 = VecAdd(r2_2, r2_3);
+        r3_2 = VecAdd(r3_2, r3_3);
+
+        r0_1 = VecXor(r0_1, r0_2);
+        r1_1 = VecXor(r1_1, r1_2);
+        r2_1 = VecXor(r2_1, r2_2);
+        r3_1 = VecXor(r3_1, r3_2);
+
+        r0_1 = VecRotateLeft<7>(r0_1);
+        r1_1 = VecRotateLeft<7>(r1_1);
+        r2_1 = VecRotateLeft<7>(r2_1);
+        r3_1 = VecRotateLeft<7>(r3_1);
+
+        r0_1 = Shuffle<1>(r0_1);
+        r0_2 = Shuffle<2>(r0_2);
+        r0_3 = Shuffle<3>(r0_3);
+
+        r1_1 = Shuffle<1>(r1_1);
+        r1_2 = Shuffle<2>(r1_2);
+        r1_3 = Shuffle<3>(r1_3);
+
+        r2_1 = Shuffle<1>(r2_1);
+        r2_2 = Shuffle<2>(r2_2);
+        r2_3 = Shuffle<3>(r2_3);
+
+        r3_1 = Shuffle<1>(r3_1);
+        r3_2 = Shuffle<2>(r3_2);
+        r3_3 = Shuffle<3>(r3_3);
+
+        r0_0 = VecAdd(r0_0, r0_1);
+        r1_0 = VecAdd(r1_0, r1_1);
+        r2_0 = VecAdd(r2_0, r2_1);
+        r3_0 = VecAdd(r3_0, r3_1);
+
+        r0_3 = VecXor(r0_3, r0_0);
+        r1_3 = VecXor(r1_3, r1_0);
+        r2_3 = VecXor(r2_3, r2_0);
+        r3_3 = VecXor(r3_3, r3_0);
+
+        r0_3 = VecRotateLeft<16>(r0_3);
+        r1_3 = VecRotateLeft<16>(r1_3);
+        r2_3 = VecRotateLeft<16>(r2_3);
+        r3_3 = VecRotateLeft<16>(r3_3);
+
+        r0_2 = VecAdd(r0_2, r0_3);
+        r1_2 = VecAdd(r1_2, r1_3);
+        r2_2 = VecAdd(r2_2, r2_3);
+        r3_2 = VecAdd(r3_2, r3_3);
+
+        r0_1 = VecXor(r0_1, r0_2);
+        r1_1 = VecXor(r1_1, r1_2);
+        r2_1 = VecXor(r2_1, r2_2);
+        r3_1 = VecXor(r3_1, r3_2);
+
+        r0_1 = VecRotateLeft<12>(r0_1);
+        r1_1 = VecRotateLeft<12>(r1_1);
+        r2_1 = VecRotateLeft<12>(r2_1);
+        r3_1 = VecRotateLeft<12>(r3_1);
+
+        r0_0 = VecAdd(r0_0, r0_1);
+        r1_0 = VecAdd(r1_0, r1_1);
+        r2_0 = VecAdd(r2_0, r2_1);
+        r3_0 = VecAdd(r3_0, r3_1);
+
+        r0_3 = VecXor(r0_3, r0_0);
+        r1_3 = VecXor(r1_3, r1_0);
+        r2_3 = VecXor(r2_3, r2_0);
+        r3_3 = VecXor(r3_3, r3_0);
+
+        r0_3 = VecRotateLeft<8>(r0_3);
+        r1_3 = VecRotateLeft<8>(r1_3);
+        r2_3 = VecRotateLeft<8>(r2_3);
+        r3_3 = VecRotateLeft<8>(r3_3);
+
+        r0_2 = VecAdd(r0_2, r0_3);
+        r1_2 = VecAdd(r1_2, r1_3);
+        r2_2 = VecAdd(r2_2, r2_3);
+        r3_2 = VecAdd(r3_2, r3_3);
+
+        r0_1 = VecXor(r0_1, r0_2);
+        r1_1 = VecXor(r1_1, r1_2);
+        r2_1 = VecXor(r2_1, r2_2);
+        r3_1 = VecXor(r3_1, r3_2);
+
+        r0_1 = VecRotateLeft<7>(r0_1);
+        r1_1 = VecRotateLeft<7>(r1_1);
+        r2_1 = VecRotateLeft<7>(r2_1);
+        r3_1 = VecRotateLeft<7>(r3_1);
+
+        r0_1 = Shuffle<3>(r0_1);
+        r0_2 = Shuffle<2>(r0_2);
+        r0_3 = Shuffle<1>(r0_3);
+
+        r1_1 = Shuffle<3>(r1_1);
+        r1_2 = Shuffle<2>(r1_2);
+        r1_3 = Shuffle<1>(r1_3);
+
+        r2_1 = Shuffle<3>(r2_1);
+        r2_2 = Shuffle<2>(r2_2);
+        r2_3 = Shuffle<1>(r2_3);
+
+        r3_1 = Shuffle<3>(r3_1);
+        r3_2 = Shuffle<2>(r3_2);
+        r3_3 = Shuffle<1>(r3_3);
+    }
+
+    r0_0 = VecAdd(r0_0, state0);
+    r0_1 = VecAdd(r0_1, state1);
+    r0_2 = VecAdd(r0_2, state2);
+    r0_3 = VecAdd(r0_3, state3);
+
+    r1_0 = VecAdd(r1_0, state0);
+    r1_1 = VecAdd(r1_1, state1);
+    r1_2 = VecAdd(r1_2, state2);
+    r1_3 = VecAdd(r1_3, state3);
+    r1_3 = VecAdd64(r1_3, CTRS[0]);
+
+    r2_0 = VecAdd(r2_0, state0);
+    r2_1 = VecAdd(r2_1, state1);
+    r2_2 = VecAdd(r2_2, state2);
+    r2_3 = VecAdd(r2_3, state3);
+    r2_3 = VecAdd64(r2_3, CTRS[1]);
+
+    r3_0 = VecAdd(r3_0, state0);
+    r3_1 = VecAdd(r3_1, state1);
+    r3_2 = VecAdd(r3_2, state2);
+    r3_3 = VecAdd(r3_3, state3);
+    r3_3 = VecAdd64(r3_3, CTRS[2]);
+
+    if (input)
+    {
+        r0_0 = VecXor(VecLoad32LE(input + 0*16), r0_0);
+        r0_1 = VecXor(VecLoad32LE(input + 1*16), r0_1);
+        r0_2 = VecXor(VecLoad32LE(input + 2*16), r0_2);
+        r0_3 = VecXor(VecLoad32LE(input + 3*16), r0_3);
+    }
+
+    VecStore32LE(output + 0*16, r0_0);
+    VecStore32LE(output + 1*16, r0_1);
+    VecStore32LE(output + 2*16, r0_2);
+    VecStore32LE(output + 3*16, r0_3);
+
+    if (input)
+    {
+        r1_0 = VecXor(VecLoad32LE(input + 4*16), r1_0);
+        r1_1 = VecXor(VecLoad32LE(input + 5*16), r1_1);
+        r1_2 = VecXor(VecLoad32LE(input + 6*16), r1_2);
+        r1_3 = VecXor(VecLoad32LE(input + 7*16), r1_3);
+    }
+
+    VecStore32LE(output + 4*16, r1_0);
+    VecStore32LE(output + 5*16, r1_1);
+    VecStore32LE(output + 6*16, r1_2);
+    VecStore32LE(output + 7*16, r1_3);
+
+    if (input)
+    {
+        r2_0 = VecXor(VecLoad32LE(input +  8*16), r2_0);
+        r2_1 = VecXor(VecLoad32LE(input +  9*16), r2_1);
+        r2_2 = VecXor(VecLoad32LE(input + 10*16), r2_2);
+        r2_3 = VecXor(VecLoad32LE(input + 11*16), r2_3);
+    }
+
+    VecStore32LE(output +  8*16, r2_0);
+    VecStore32LE(output +  9*16, r2_1);
+    VecStore32LE(output + 10*16, r2_2);
+    VecStore32LE(output + 11*16, r2_3);
+
+    if (input)
+    {
+        r3_0 = VecXor(VecLoad32LE(input + 12*16), r3_0);
+        r3_1 = VecXor(VecLoad32LE(input + 13*16), r3_1);
+        r3_2 = VecXor(VecLoad32LE(input + 14*16), r3_2);
+        r3_3 = VecXor(VecLoad32LE(input + 15*16), r3_3);
+    }
+
+    VecStore32LE(output + 12*16, r3_0);
+    VecStore32LE(output + 13*16, r3_1);
+    VecStore32LE(output + 14*16, r3_2);
+    VecStore32LE(output + 15*16, r3_3);
+}
+
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+
+void ChaCha_OperateKeystream_ALTIVEC(const word32 *state, const byte* input, byte *output, unsigned int rounds)
+{
+    ChaCha_OperateKeystream_CORE(state, input, output, rounds);
+}
+
+#endif
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/chachapoly.cpp b/runtime/third_party/cryptopp/chachapoly.cpp
new file mode 100644
index 0000000..8e112d3
--- /dev/null
+++ b/runtime/third_party/cryptopp/chachapoly.cpp
@@ -0,0 +1,211 @@
+// chachapoly.cpp - written and placed in the public domain by Jeffrey Walton
+//                  RFC 8439, Section 2.8, AEAD Construction, http://tools.ietf.org/html/rfc8439
+
+#include "pch.h"
+#include "chachapoly.h"
+#include "algparam.h"
+#include "misc.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4244)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+////////////////////////////// IETF ChaChaTLS //////////////////////////////
+
+// RekeyCipherAndMac is heavier-weight than we like. The Authenc framework was
+// predicated on BlockCiphers, where the key and key schedule could be
+// calculated independent of the IV being used. However, the ChaCha and
+// ChaCha20Poly1305 construction combines key setup and IV. That is, both are
+// needed to key or rekey the cipher. Even a simple Resync() requires us to
+// regenerate the initial state for both ChaCha20 and Poly1305.
+void ChaCha20Poly1305_Base::RekeyCipherAndMac(const byte *userKey, size_t keylength, const NameValuePairs &params)
+{
+	// Derive MAC key
+	AlgorithmParameters block0 = MakeParameters("InitialBlock", (word64)0, true);
+	AccessSymmetricCipher().SetKey(userKey, keylength, CombinedNameValuePairs(params, block0));
+
+	// Only the first 256-bits are used to key the MAC
+	SecByteBlock derived(NULLPTR, 32);
+	AccessSymmetricCipher().ProcessString(derived, derived.size());
+
+	// Key the Poly1305 MAC
+	AccessMAC().SetKey(derived, derived.size(), params);
+
+	// Key the ChaCha20 cipher
+	AlgorithmParameters block1 = MakeParameters("InitialBlock", (word64)1, true);
+	AccessSymmetricCipher().SetKey(userKey, keylength, CombinedNameValuePairs(params, block1));
+}
+
+void ChaCha20Poly1305_Base::SetKeyWithoutResync(const byte *userKey, size_t userKeyLength, const NameValuePairs &params)
+{
+	CRYPTOPP_ASSERT(userKey && userKeyLength == 32);
+	m_userKey.Assign(userKey, userKeyLength);
+
+	// ChaCha/Poly1305 initial state depends on both the key and IV. The
+	// IV may or may not be present during the call to SetKeyWithoutResync.
+	// If the IV is present, the framework will call SetKeyWithoutResync
+	// followed by Resynchronize which calls Resync. In this case we defer
+	// calculating the initial state until the call to Resynchronize.
+	// If the IV is not present, it avoids calling ChaCha's SetKey without
+	// an IV, which results in an exception. In this case the user will need
+	// to call Resynchronize to key ChaCha and Poly1305.
+	// RekeyCipherAndMac(userKey, userKeyLength, params);
+	CRYPTOPP_UNUSED(params);
+}
+
+void ChaCha20Poly1305_Base::Resync(const byte *iv, size_t len)
+{
+	CRYPTOPP_ASSERT(iv && len == 12);
+	RekeyCipherAndMac(m_userKey, m_userKey.SizeInBytes(),
+		MakeParameters(Name::IV(), ConstByteArrayParameter(iv,len)));
+}
+
+size_t ChaCha20Poly1305_Base::AuthenticateBlocks(const byte *data, size_t len)
+{
+	AccessMAC().Update(data, len);
+	return 0;
+}
+
+void ChaCha20Poly1305_Base::AuthenticateLastHeaderBlock()
+{
+	// Pad to a multiple of 16 or 0
+	const byte zero[16] = {0};
+	size_t pad = (16U - (m_totalHeaderLength % 16)) % 16;
+	AccessMAC().Update(zero, pad);
+}
+
+void ChaCha20Poly1305_Base::AuthenticateLastConfidentialBlock()
+{
+	// Pad to a multiple of 16 or 0
+	const byte zero[16] = {0};
+	size_t pad = (16U - (m_totalMessageLength % 16)) % 16;
+	AccessMAC().Update(zero, pad);
+}
+
+void ChaCha20Poly1305_Base::AuthenticateLastFooterBlock(byte *mac, size_t macSize)
+{
+	CRYPTOPP_ALIGN_DATA(8) byte length[2*sizeof(word64)];
+	PutWord(true, LITTLE_ENDIAN_ORDER, length+0, m_totalHeaderLength);
+	PutWord(true, LITTLE_ENDIAN_ORDER, length+8, m_totalMessageLength);
+	AccessMAC().Update(length, sizeof(length));
+	AccessMAC().TruncatedFinal(mac, macSize);
+	m_state = State_KeySet;
+}
+
+void ChaCha20Poly1305_Base::EncryptAndAuthenticate(byte *ciphertext, byte *mac, size_t macSize, const byte *iv, int ivLength, const byte *aad, size_t aadLength, const byte *message, size_t messageLength)
+{
+	Resynchronize(iv, ivLength);
+	Update(aad, aadLength);
+	ProcessString(ciphertext, message, messageLength);
+	TruncatedFinal(mac, macSize);
+}
+
+bool ChaCha20Poly1305_Base::DecryptAndVerify(byte *message, const byte *mac, size_t macLength, const byte *iv, int ivLength, const byte *aad, size_t aadLength, const byte *ciphertext, size_t ciphertextLength)
+{
+	Resynchronize(iv, ivLength);
+	Update(aad, aadLength);
+	ProcessString(message, ciphertext, ciphertextLength);
+	return TruncatedVerify(mac, macLength);
+}
+
+////////////////////////////// IETF XChaCha20 draft //////////////////////////////
+
+// RekeyCipherAndMac is heavier-weight than we like. The Authenc framework was
+// predicated on BlockCiphers, where the key and key schedule could be
+// calculated independent of the IV being used. However, the ChaCha and
+// ChaCha20Poly1305 construction combines key setup and IV. That is, both are
+// needed to key or rekey the cipher. Even a simple Resync() requires us to
+// regenerate the initial state for both ChaCha20 and Poly1305.
+void XChaCha20Poly1305_Base::RekeyCipherAndMac(const byte *userKey, size_t keylength, const NameValuePairs &params)
+{
+	// Derive MAC key
+	AlgorithmParameters block0 = MakeParameters("InitialBlock", (word64)0, true);
+	AccessSymmetricCipher().SetKey(userKey, keylength, CombinedNameValuePairs(params, block0));
+
+	// Only the first 256-bits are used to key the MAC
+	SecByteBlock derived(NULLPTR, 32);
+	AccessSymmetricCipher().ProcessString(derived, derived.size());
+
+	// Key the Poly1305 MAC
+	AccessMAC().SetKey(derived, derived.size(), params);
+
+	// Key the ChaCha20 cipher
+	AlgorithmParameters block1 = MakeParameters("InitialBlock", (word64)1, true);
+	AccessSymmetricCipher().SetKey(userKey, keylength, CombinedNameValuePairs(params, block1));
+}
+
+void XChaCha20Poly1305_Base::SetKeyWithoutResync(const byte *userKey, size_t userKeyLength, const NameValuePairs &params)
+{
+	CRYPTOPP_ASSERT(userKey && userKeyLength == 32);
+	m_userKey.Assign(userKey, userKeyLength);
+
+	// XChaCha20/Poly1305 initial state depends on both the key and IV. The
+	// IV may or may not be present during the call to SetKeyWithoutResync.
+	// If the IV is present, the framework will call SetKeyWithoutResync
+	// followed by Resynchronize which calls Resync. In this case we defer
+	// calculating the initial state until the call to Resynchronize.
+	// If the IV is not present, it avoids calling ChaCha's SetKey without
+	// an IV, which results in an exception. In this case the user will need
+	// to call Resynchronize to key ChaCha and Poly1305.
+	// RekeyCipherAndMac(userKey, userKeyLength, params);
+	CRYPTOPP_UNUSED(params);
+}
+
+void XChaCha20Poly1305_Base::Resync(const byte *iv, size_t len)
+{
+	CRYPTOPP_ASSERT(iv && len == 24);
+	RekeyCipherAndMac(m_userKey, m_userKey.SizeInBytes(),
+		MakeParameters(Name::IV(), ConstByteArrayParameter(iv,len)));
+}
+
+size_t XChaCha20Poly1305_Base::AuthenticateBlocks(const byte *data, size_t len)
+{
+	AccessMAC().Update(data, len);
+	return 0;
+}
+
+void XChaCha20Poly1305_Base::AuthenticateLastHeaderBlock()
+{
+	// Pad to a multiple of 16 or 0
+	const byte zero[16] = {0};
+	size_t pad = (16 - (m_totalHeaderLength % 16)) % 16;
+	AccessMAC().Update(zero, pad);
+}
+
+void XChaCha20Poly1305_Base::AuthenticateLastConfidentialBlock()
+{
+	// Pad to a multiple of 16 or 0
+	const byte zero[16] = {0};
+	size_t pad = (16 - (m_totalMessageLength % 16)) % 16;
+	AccessMAC().Update(zero, pad);
+}
+
+void XChaCha20Poly1305_Base::AuthenticateLastFooterBlock(byte *mac, size_t macSize)
+{
+	CRYPTOPP_ALIGN_DATA(8) byte length[2*sizeof(word64)];
+	PutWord(true, LITTLE_ENDIAN_ORDER, length+0, m_totalHeaderLength);
+	PutWord(true, LITTLE_ENDIAN_ORDER, length+8, m_totalMessageLength);
+	AccessMAC().Update(length, sizeof(length));
+	AccessMAC().TruncatedFinal(mac, macSize);
+	m_state = State_KeySet;
+}
+
+void XChaCha20Poly1305_Base::EncryptAndAuthenticate(byte *ciphertext, byte *mac, size_t macSize, const byte *iv, int ivLength, const byte *aad, size_t aadLength, const byte *message, size_t messageLength)
+{
+	Resynchronize(iv, ivLength);
+	Update(aad, aadLength);
+	ProcessString(ciphertext, message, messageLength);
+	TruncatedFinal(mac, macSize);
+}
+
+bool XChaCha20Poly1305_Base::DecryptAndVerify(byte *message, const byte *mac, size_t macLength, const byte *iv, int ivLength, const byte *aad, size_t aadLength, const byte *ciphertext, size_t ciphertextLength)
+{
+	Resynchronize(iv, ivLength);
+	Update(aad, aadLength);
+	ProcessString(message, ciphertext, ciphertextLength);
+	return TruncatedVerify(mac, macLength);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/chachapoly.h b/runtime/third_party/cryptopp/chachapoly.h
new file mode 100644
index 0000000..27d4d59
--- /dev/null
+++ b/runtime/third_party/cryptopp/chachapoly.h
@@ -0,0 +1,322 @@
+// chachapoly.h - written and placed in the public domain by Jeffrey Walton
+//                RFC 8439, Section 2.8, AEAD Construction, http://tools.ietf.org/html/rfc8439
+
+/// \file chachapoly.h
+/// \brief IETF ChaCha20/Poly1305 AEAD scheme
+/// \details ChaCha20Poly1305 is an authenticated encryption scheme that combines
+///  ChaCha20TLS and Poly1305TLS. The scheme is defined in RFC 8439, section 2.8,
+///  AEAD_CHACHA20_POLY1305 construction, and uses the IETF versions of ChaCha20
+///  and Poly1305.
+/// \sa <A HREF="http://tools.ietf.org/html/rfc8439">RFC 8439, ChaCha20 and Poly1305
+///  for IETF Protocols</A>.
+/// \since Crypto++ 8.1
+
+#ifndef CRYPTOPP_CHACHA_POLY1305_H
+#define CRYPTOPP_CHACHA_POLY1305_H
+
+#include "cryptlib.h"
+#include "authenc.h"
+#include "chacha.h"
+#include "poly1305.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+////////////////////////////// IETF ChaChaTLS //////////////////////////////
+
+/// \brief IETF ChaCha20Poly1305 cipher base implementation
+/// \details Base implementation of the AuthenticatedSymmetricCipher interface
+/// \since Crypto++ 8.1
+class ChaCha20Poly1305_Base : public AuthenticatedSymmetricCipherBase
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName()
+		{return "ChaCha20/Poly1305";}
+
+	virtual ~ChaCha20Poly1305_Base() {}
+
+	// AuthenticatedSymmetricCipher
+	std::string AlgorithmName() const
+		{return std::string("ChaCha20/Poly1305");}
+	std::string AlgorithmProvider() const
+		{return GetSymmetricCipher().AlgorithmProvider();}
+	size_t MinKeyLength() const
+		{return 32;}
+	size_t MaxKeyLength() const
+		{return 32;}
+	size_t DefaultKeyLength() const
+		{return 32;}
+	size_t GetValidKeyLength(size_t n) const
+		{CRYPTOPP_UNUSED(n); return 32;}
+	bool IsValidKeyLength(size_t n) const
+		{return n==32;}
+	unsigned int OptimalDataAlignment() const
+		{return GetSymmetricCipher().OptimalDataAlignment();}
+	IV_Requirement IVRequirement() const
+		{return UNIQUE_IV;}
+	unsigned int IVSize() const
+		{return 12;}
+	unsigned int MinIVLength() const
+		{return 12;}
+	unsigned int MaxIVLength() const
+		{return 12;}
+	unsigned int DigestSize() const
+		{return 16;}
+	lword MaxHeaderLength() const
+		{return LWORD_MAX;}  // 2^64-1 bytes
+	lword MaxMessageLength() const
+		{return W64LIT(274877906880);}  // 2^38-1 blocks
+	lword MaxFooterLength() const
+		{return 0;}
+
+	/// \brief Encrypts and calculates a MAC in one call
+	/// \param ciphertext the encryption buffer
+	/// \param mac the mac buffer
+	/// \param macSize the size of the MAC buffer, in bytes
+	/// \param iv the iv buffer
+	/// \param ivLength the size of the IV buffer, in bytes
+	/// \param aad the AAD buffer
+	/// \param aadLength the size of the AAD buffer, in bytes
+	/// \param message the message buffer
+	/// \param messageLength the size of the messagetext buffer, in bytes
+	/// \details EncryptAndAuthenticate() encrypts and generates the MAC in one call. The function
+	///   truncates the MAC if <tt>macSize < TagSize()</tt>.
+	virtual void EncryptAndAuthenticate(byte *ciphertext, byte *mac, size_t macSize, const byte *iv, int ivLength, const byte *aad, size_t aadLength, const byte *message, size_t messageLength);
+
+	/// \brief Decrypts and verifies a MAC in one call
+	/// \param message the decryption buffer
+	/// \param mac the mac buffer
+	/// \param macSize the size of the MAC buffer, in bytes
+	/// \param iv the iv buffer
+	/// \param ivLength the size of the IV buffer, in bytes
+	/// \param aad the AAD buffer
+	/// \param aadLength the size of the AAD buffer, in bytes
+	/// \param ciphertext the cipher buffer
+	/// \param ciphertextLength the size of the ciphertext buffer, in bytes
+	/// \return true if the MAC is valid and the decoding succeeded, false otherwise
+	/// \details DecryptAndVerify() decrypts and verifies the MAC in one call.
+	/// <tt>message</tt> is a decryption buffer and should be at least as large as the ciphertext buffer.
+	/// \details The function returns true iff MAC is valid. DecryptAndVerify() assumes the MAC
+	///  is truncated if <tt>macLength < TagSize()</tt>.
+	virtual bool DecryptAndVerify(byte *message, const byte *mac, size_t macSize, const byte *iv, int ivLength, const byte *aad, size_t aadLength, const byte *ciphertext, size_t ciphertextLength);
+
+protected:
+	// AuthenticatedSymmetricCipherBase
+	bool AuthenticationIsOnPlaintext() const {return false;}
+	unsigned int AuthenticationBlockSize() const {return 1;}
+	void SetKeyWithoutResync(const byte *userKey, size_t keylength, const NameValuePairs &params);
+	void Resync(const byte *iv, size_t len);
+	size_t AuthenticateBlocks(const byte *data, size_t len);
+	void AuthenticateLastHeaderBlock();
+	void AuthenticateLastConfidentialBlock();
+	void AuthenticateLastFooterBlock(byte *mac, size_t macSize);
+
+	// See comments in chachapoly.cpp
+	void RekeyCipherAndMac(const byte *userKey, size_t userKeyLength, const NameValuePairs &params);
+
+	virtual const MessageAuthenticationCode & GetMAC() const = 0;
+	virtual MessageAuthenticationCode & AccessMAC() = 0;
+
+private:
+	SecByteBlock m_userKey;
+};
+
+/// \brief IETF ChaCha20Poly1305 cipher final implementation
+/// \tparam T_IsEncryption flag indicating cipher direction
+/// \details ChaCha20Poly1305 is an authenticated encryption scheme that combines
+///  ChaCha20TLS and Poly1305TLS. The scheme is defined in RFC 8439, section 2.8,
+///  AEAD_CHACHA20_POLY1305 construction, and uses the IETF versions of ChaCha20
+///  and Poly1305.
+/// \sa <A HREF="http://tools.ietf.org/html/rfc8439">RFC 8439, ChaCha20 and Poly1305
+///  for IETF Protocols</A>.
+/// \since Crypto++ 8.1
+template <bool T_IsEncryption>
+class ChaCha20Poly1305_Final : public ChaCha20Poly1305_Base
+{
+public:
+	virtual ~ChaCha20Poly1305_Final() {}
+
+protected:
+	const SymmetricCipher & GetSymmetricCipher()
+		{return const_cast<ChaCha20Poly1305_Final *>(this)->AccessSymmetricCipher();}
+	SymmetricCipher & AccessSymmetricCipher()
+		{return m_cipher;}
+	bool IsForwardTransformation() const
+		{return T_IsEncryption;}
+
+	const MessageAuthenticationCode & GetMAC() const
+		{return const_cast<ChaCha20Poly1305_Final *>(this)->AccessMAC();}
+	MessageAuthenticationCode & AccessMAC()
+		{return m_mac;}
+
+private:
+	ChaChaTLS::Encryption m_cipher;
+	Poly1305TLS m_mac;
+};
+
+/// \brief IETF ChaCha20/Poly1305 AEAD scheme
+/// \details ChaCha20Poly1305 is an authenticated encryption scheme that combines
+///  ChaCha20TLS and Poly1305TLS. The scheme is defined in RFC 8439, section 2.8,
+///  AEAD_CHACHA20_POLY1305 construction, and uses the IETF versions of ChaCha20
+///  and Poly1305.
+/// \sa <A HREF="http://tools.ietf.org/html/rfc8439">RFC 8439, ChaCha20 and Poly1305
+///  for IETF Protocols</A>.
+/// \since Crypto++ 8.1
+struct ChaCha20Poly1305 : public AuthenticatedSymmetricCipherDocumentation
+{
+	/// \brief ChaCha20Poly1305 encryption
+	typedef ChaCha20Poly1305_Final<true> Encryption;
+	/// \brief ChaCha20Poly1305 decryption
+	typedef ChaCha20Poly1305_Final<false> Decryption;
+};
+
+////////////////////////////// IETF XChaCha20 draft //////////////////////////////
+
+/// \brief IETF XChaCha20Poly1305 cipher base implementation
+/// \details Base implementation of the AuthenticatedSymmetricCipher interface
+/// \since Crypto++ 8.1
+class XChaCha20Poly1305_Base : public AuthenticatedSymmetricCipherBase
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName()
+		{return "XChaCha20/Poly1305";}
+
+	virtual ~XChaCha20Poly1305_Base() {}
+
+	// AuthenticatedSymmetricCipher
+	std::string AlgorithmName() const
+		{return std::string("XChaCha20/Poly1305");}
+	std::string AlgorithmProvider() const
+		{return GetSymmetricCipher().AlgorithmProvider();}
+	size_t MinKeyLength() const
+		{return 32;}
+	size_t MaxKeyLength() const
+		{return 32;}
+	size_t DefaultKeyLength() const
+		{return 32;}
+	size_t GetValidKeyLength(size_t n) const
+		{CRYPTOPP_UNUSED(n); return 32;}
+	bool IsValidKeyLength(size_t n) const
+		{return n==32;}
+	unsigned int OptimalDataAlignment() const
+		{return GetSymmetricCipher().OptimalDataAlignment();}
+	IV_Requirement IVRequirement() const
+		{return UNIQUE_IV;}
+	unsigned int IVSize() const
+		{return 24;}
+	unsigned int MinIVLength() const
+		{return 24;}
+	unsigned int MaxIVLength() const
+		{return 24;}
+	unsigned int DigestSize() const
+		{return 16;}
+	lword MaxHeaderLength() const
+		{return LWORD_MAX;}  // 2^64-1 bytes
+	lword MaxMessageLength() const
+		{return W64LIT(274877906880);}  // 2^38-1 blocks
+	lword MaxFooterLength() const
+		{return 0;}
+
+	/// \brief Encrypts and calculates a MAC in one call
+	/// \param ciphertext the encryption buffer
+	/// \param mac the mac buffer
+	/// \param macSize the size of the MAC buffer, in bytes
+	/// \param iv the iv buffer
+	/// \param ivLength the size of the IV buffer, in bytes
+	/// \param aad the AAD buffer
+	/// \param aadLength the size of the AAD buffer, in bytes
+	/// \param message the message buffer
+	/// \param messageLength the size of the messagetext buffer, in bytes
+	/// \details EncryptAndAuthenticate() encrypts and generates the MAC in one call. The function
+	///   truncates the MAC if <tt>macSize < TagSize()</tt>.
+	virtual void EncryptAndAuthenticate(byte *ciphertext, byte *mac, size_t macSize, const byte *iv, int ivLength, const byte *aad, size_t aadLength, const byte *message, size_t messageLength);
+
+	/// \brief Decrypts and verifies a MAC in one call
+	/// \param message the decryption buffer
+	/// \param mac the mac buffer
+	/// \param macSize the size of the MAC buffer, in bytes
+	/// \param iv the iv buffer
+	/// \param ivLength the size of the IV buffer, in bytes
+	/// \param aad the AAD buffer
+	/// \param aadLength the size of the AAD buffer, in bytes
+	/// \param ciphertext the cipher buffer
+	/// \param ciphertextLength the size of the ciphertext buffer, in bytes
+	/// \return true if the MAC is valid and the decoding succeeded, false otherwise
+	/// \details DecryptAndVerify() decrypts and verifies the MAC in one call.
+	/// <tt>message</tt> is a decryption buffer and should be at least as large as the ciphertext buffer.
+	/// \details The function returns true iff MAC is valid. DecryptAndVerify() assumes the MAC
+	///  is truncated if <tt>macLength < TagSize()</tt>.
+	virtual bool DecryptAndVerify(byte *message, const byte *mac, size_t macSize, const byte *iv, int ivLength, const byte *aad, size_t aadLength, const byte *ciphertext, size_t ciphertextLength);
+
+protected:
+	// AuthenticatedSymmetricCipherBase
+	bool AuthenticationIsOnPlaintext() const {return false;}
+	unsigned int AuthenticationBlockSize() const {return 1;}
+	void SetKeyWithoutResync(const byte *userKey, size_t keylength, const NameValuePairs &params);
+	void Resync(const byte *iv, size_t len);
+	size_t AuthenticateBlocks(const byte *data, size_t len);
+	void AuthenticateLastHeaderBlock();
+	void AuthenticateLastConfidentialBlock();
+	void AuthenticateLastFooterBlock(byte *mac, size_t macSize);
+
+	// See comments in chachapoly.cpp
+	void RekeyCipherAndMac(const byte *userKey, size_t userKeyLength, const NameValuePairs &params);
+
+	virtual const MessageAuthenticationCode & GetMAC() const = 0;
+	virtual MessageAuthenticationCode & AccessMAC() = 0;
+
+private:
+	SecByteBlock m_userKey;
+};
+
+/// \brief IETF XChaCha20Poly1305 cipher final implementation
+/// \tparam T_IsEncryption flag indicating cipher direction
+/// \details XChaCha20Poly1305 is an authenticated encryption scheme that combines
+///  XChaCha20 and Poly1305-TLS. The scheme is defined in RFC 8439, section 2.8,
+///  AEAD_CHACHA20_POLY1305 construction, and uses the IETF versions of ChaCha20
+///  and Poly1305.
+/// \sa <A HREF="http://tools.ietf.org/html/rfc8439">RFC 8439, ChaCha20 and Poly1305
+///  for IETF Protocols</A>.
+/// \since Crypto++ 8.1
+template <bool T_IsEncryption>
+class XChaCha20Poly1305_Final : public XChaCha20Poly1305_Base
+{
+public:
+	virtual ~XChaCha20Poly1305_Final() {}
+
+protected:
+	const SymmetricCipher & GetSymmetricCipher()
+		{return const_cast<XChaCha20Poly1305_Final *>(this)->AccessSymmetricCipher();}
+	SymmetricCipher & AccessSymmetricCipher()
+		{return m_cipher;}
+	bool IsForwardTransformation() const
+		{return T_IsEncryption;}
+
+	const MessageAuthenticationCode & GetMAC() const
+		{return const_cast<XChaCha20Poly1305_Final *>(this)->AccessMAC();}
+	MessageAuthenticationCode & AccessMAC()
+		{return m_mac;}
+
+private:
+	XChaCha20::Encryption m_cipher;
+	Poly1305TLS m_mac;
+};
+
+/// \brief IETF XChaCha20/Poly1305 AEAD scheme
+/// \details XChaCha20Poly1305 is an authenticated encryption scheme that combines
+///  XChaCha20 and Poly1305-TLS. The scheme is defined in RFC 8439, section 2.8,
+///  AEAD_XCHACHA20_POLY1305 construction, and uses the IETF versions of ChaCha20
+///  and Poly1305.
+/// \sa <A HREF="http://tools.ietf.org/html/rfc8439">RFC 8439, ChaCha20 and Poly1305
+///  for IETF Protocols</A>.
+/// \since Crypto++ 8.1
+struct XChaCha20Poly1305 : public AuthenticatedSymmetricCipherDocumentation
+{
+	/// \brief XChaCha20Poly1305 encryption
+	typedef XChaCha20Poly1305_Final<true> Encryption;
+	/// \brief XChaCha20Poly1305 decryption
+	typedef XChaCha20Poly1305_Final<false> Decryption;
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_CHACHA_POLY1305_H
diff --git a/runtime/third_party/cryptopp/cham.cpp b/runtime/third_party/cryptopp/cham.cpp
new file mode 100644
index 0000000..4c05c66
--- /dev/null
+++ b/runtime/third_party/cryptopp/cham.cpp
@@ -0,0 +1,365 @@
+// cham.cpp - written and placed in the public domain by Kim Sung Hee and Jeffrey Walton
+//            Based on "CHAM: A Family of Lightweight Block Ciphers for
+//            Resource-Constrained Devices" by Bonwook Koo, Dongyoung Roh,
+//            Hyeonjin Kim, Younghoon Jung, Dong-Geon Lee, and Daesung Kwon
+
+#include "pch.h"
+#include "config.h"
+
+#include "cham.h"
+#include "misc.h"
+#include "cpu.h"
+
+//                 CHAM table of parameters
+//  +-------------------------------------------------
+//  +cipher          n      k      r     w      k/w
+//  +-------------------------------------------------
+//  +CHAM-64/128     64     128    80    16     8
+//  +CHAM-128/128    128    128    80    32     4
+//  +CHAM-128/256    128    256    96    32     8
+//  +-------------------------------------------------
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::rotlConstant;
+using CryptoPP::rotrConstant;
+
+/// \brief CHAM encryption round
+/// \tparam RR the round number residue
+/// \tparam KW the number of key words
+/// \tparam T words type
+/// \param x the state array
+/// \param k the subkey table
+/// \param i the round number
+/// \details CHAM_EncRound applies the encryption round to the plain text.
+///  RR is the "round residue" and it is used modulo 4. ProcessAndXorBlock
+///  may provide a fully unrolled encryption transformation, or provide
+///  a transformation that loops using multiples of 4 encryption rounds.
+/// \details CHAM_EncRound calculates indexes into the x[] array based
+///  on the round number residue. There is no need for the assignments
+///  that shift values in preparations for the next round.
+/// \details CHAM_EncRound depends on the round number. The actual round
+///  being executed is passed through the parameter <tt>i</tt>. If
+///  ProcessAndXorBlock fully unrolled the loop then the parameter
+///  <tt>i</tt> would be unnecessary.
+template <unsigned int RR, unsigned int KW, class T>
+inline void CHAM_EncRound(T x[4], const T k[KW], unsigned int i)
+{
+    CRYPTOPP_CONSTANT(IDX0 = (RR+0) % 4);
+    CRYPTOPP_CONSTANT(IDX1 = (RR+1) % 4);
+    CRYPTOPP_CONSTANT(IDX3 = (RR+3+1) % 4);
+    CRYPTOPP_CONSTANT(R1 = (RR % 2 == 0) ? 1 : 8);
+    CRYPTOPP_CONSTANT(R2 = (RR % 2 == 0) ? 8 : 1);
+
+    // Follows conventions in the ref impl
+    const T kk = k[i % KW];
+    const T aa = x[IDX0] ^ static_cast<T>(i);
+    const T bb = rotlConstant<R1>(x[IDX1]) ^ kk;
+    x[IDX3] = rotlConstant<R2>(static_cast<T>(aa + bb));
+}
+
+/// \brief CHAM decryption round
+/// \tparam RR the round number residue
+/// \tparam KW the number of key words
+/// \tparam T words type
+/// \param x the state array
+/// \param k the subkey table
+/// \param i the round number
+/// \details CHAM_DecRound applies the decryption round to the cipher text.
+///  RR is the "round residue" and it is used modulo 4. ProcessAndXorBlock
+///  may provide a fully unrolled decryption transformation, or provide
+///  a transformation that loops using multiples of 4 decryption rounds.
+/// \details CHAM_DecRound calculates indexes into the x[] array based
+///  on the round number residue. There is no need for the assignments
+///  that shift values in preparations for the next round.
+/// \details CHAM_DecRound depends on the round number. The actual round
+///  being executed is passed through the parameter <tt>i</tt>. If
+///  ProcessAndXorBlock fully unrolled the loop then the parameter
+///  <tt>i</tt> would be unnecessary.
+template <unsigned int RR, unsigned int KW, class T>
+inline void CHAM_DecRound(T x[4], const T k[KW], unsigned int i)
+{
+    CRYPTOPP_CONSTANT(IDX0 = (RR+0) % 4);
+    CRYPTOPP_CONSTANT(IDX1 = (RR+1) % 4);
+    CRYPTOPP_CONSTANT(IDX3 = (RR+3+1) % 4);
+    CRYPTOPP_CONSTANT(R1 = (RR % 2 == 0) ? 8 : 1);
+    CRYPTOPP_CONSTANT(R2 = (RR % 2 == 0) ? 1 : 8);
+
+    // Follows conventions in the ref impl
+    const T kk = k[i % KW];
+    const T aa = rotrConstant<R1>(x[IDX3]);
+    const T bb = rotlConstant<R2>(x[IDX1]) ^ kk;
+    x[IDX0] = static_cast<T>(aa - bb) ^ static_cast<T>(i);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if CRYPTOPP_CHAM128_ADVANCED_PROCESS_BLOCKS
+# if (CRYPTOPP_SSSE3_AVAILABLE)
+extern size_t CHAM64_Enc_AdvancedProcessBlocks_SSSE3(const word16* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t CHAM64_Dec_AdvancedProcessBlocks_SSSE3(const word16* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t CHAM128_Enc_AdvancedProcessBlocks_SSSE3(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t CHAM128_Dec_AdvancedProcessBlocks_SSSE3(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+# endif  // CRYPTOPP_SSSE3_AVAILABLE
+#endif  // CRYPTOPP_CHAM128_ADVANCED_PROCESS_BLOCKS
+
+void CHAM64::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_UNUSED(params);
+    m_kw = keyLength/sizeof(word16);
+    m_rk.New(2*m_kw);
+
+    for (size_t i = 0; i < m_kw; userKey += sizeof(word32))
+    {
+        // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+        const word32 rk = GetWord<word32>(false, BIG_ENDIAN_ORDER, userKey);
+
+        const word16 rk1 = static_cast<word16>(rk >> 16);
+        m_rk[i] = rk1 ^ rotlConstant<1>(rk1) ^ rotlConstant<8>(rk1);
+        m_rk[(i + m_kw) ^ 1] = rk1 ^ rotlConstant<1>(rk1) ^ rotlConstant<11>(rk1);
+        i++;
+
+        const word16 rk2 = static_cast<word16>(rk & 0xffff);
+        m_rk[i] = rk2 ^ rotlConstant<1>(rk2) ^ rotlConstant<8>(rk2);
+        m_rk[(i + m_kw) ^ 1] = rk2 ^ rotlConstant<1>(rk2) ^ rotlConstant<11>(rk2);
+        i++;
+    }
+}
+
+void CHAM64::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word16, BigEndian> iblock(inBlock);
+    iblock(m_x[0])(m_x[1])(m_x[2])(m_x[3]);
+
+    const int R = 80;
+    for (int i = 0; i < R; i+=16)
+    {
+        CHAM_EncRound< 0, 16>(m_x.begin(), m_rk.begin(),  i+0);
+        CHAM_EncRound< 1, 16>(m_x.begin(), m_rk.begin(),  i+1);
+        CHAM_EncRound< 2, 16>(m_x.begin(), m_rk.begin(),  i+2);
+        CHAM_EncRound< 3, 16>(m_x.begin(), m_rk.begin(),  i+3);
+        CHAM_EncRound< 4, 16>(m_x.begin(), m_rk.begin(),  i+4);
+        CHAM_EncRound< 5, 16>(m_x.begin(), m_rk.begin(),  i+5);
+        CHAM_EncRound< 6, 16>(m_x.begin(), m_rk.begin(),  i+6);
+        CHAM_EncRound< 7, 16>(m_x.begin(), m_rk.begin(),  i+7);
+        CHAM_EncRound< 8, 16>(m_x.begin(), m_rk.begin(),  i+8);
+        CHAM_EncRound< 9, 16>(m_x.begin(), m_rk.begin(),  i+9);
+        CHAM_EncRound<10, 16>(m_x.begin(), m_rk.begin(), i+10);
+        CHAM_EncRound<11, 16>(m_x.begin(), m_rk.begin(), i+11);
+        CHAM_EncRound<12, 16>(m_x.begin(), m_rk.begin(), i+12);
+        CHAM_EncRound<13, 16>(m_x.begin(), m_rk.begin(), i+13);
+        CHAM_EncRound<14, 16>(m_x.begin(), m_rk.begin(), i+14);
+        CHAM_EncRound<15, 16>(m_x.begin(), m_rk.begin(), i+15);
+    }
+
+    PutBlock<word16, BigEndian> oblock(xorBlock, outBlock);
+    oblock(m_x[0])(m_x[1])(m_x[2])(m_x[3]);
+}
+
+void CHAM64::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word16, BigEndian> iblock(inBlock);
+    iblock(m_x[0])(m_x[1])(m_x[2])(m_x[3]);
+
+    const int R = 80;
+    for (int i = R-1; i >=0 ; i-=16)
+    {
+        CHAM_DecRound<15, 16>(m_x.begin(), m_rk.begin(),  i-0);
+        CHAM_DecRound<14, 16>(m_x.begin(), m_rk.begin(),  i-1);
+        CHAM_DecRound<13, 16>(m_x.begin(), m_rk.begin(),  i-2);
+        CHAM_DecRound<12, 16>(m_x.begin(), m_rk.begin(),  i-3);
+        CHAM_DecRound<11, 16>(m_x.begin(), m_rk.begin(),  i-4);
+        CHAM_DecRound<10, 16>(m_x.begin(), m_rk.begin(),  i-5);
+        CHAM_DecRound< 9, 16>(m_x.begin(), m_rk.begin(),  i-6);
+        CHAM_DecRound< 8, 16>(m_x.begin(), m_rk.begin(),  i-7);
+        CHAM_DecRound< 7, 16>(m_x.begin(), m_rk.begin(),  i-8);
+        CHAM_DecRound< 6, 16>(m_x.begin(), m_rk.begin(),  i-9);
+        CHAM_DecRound< 5, 16>(m_x.begin(), m_rk.begin(), i-10);
+        CHAM_DecRound< 4, 16>(m_x.begin(), m_rk.begin(), i-11);
+        CHAM_DecRound< 3, 16>(m_x.begin(), m_rk.begin(), i-12);
+        CHAM_DecRound< 2, 16>(m_x.begin(), m_rk.begin(), i-13);
+        CHAM_DecRound< 1, 16>(m_x.begin(), m_rk.begin(), i-14);
+        CHAM_DecRound< 0, 16>(m_x.begin(), m_rk.begin(), i-15);
+    }
+
+    PutBlock<word16, BigEndian> oblock(xorBlock, outBlock);
+    oblock(m_x[0])(m_x[1])(m_x[2])(m_x[3]);
+}
+
+std::string CHAM128::Base::AlgorithmProvider() const
+{
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return "SSSE3";
+#endif
+    return "C++";
+}
+
+void CHAM128::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_UNUSED(params);
+    m_kw = keyLength/sizeof(word32);
+    m_rk.New(2*m_kw);
+
+    for (size_t i = 0; i < m_kw; userKey += sizeof(word32))
+    {
+        // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+        const word32 rk = GetWord<word32>(false, BIG_ENDIAN_ORDER, userKey);
+        m_rk[i] = rk ^ rotlConstant<1>(rk) ^ rotlConstant<8>(rk);
+        m_rk[(i + m_kw) ^ 1] = rk ^ rotlConstant<1>(rk) ^ rotlConstant<11>(rk);
+        i++;
+    }
+}
+
+void CHAM128::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word32, BigEndian> iblock(inBlock);
+    iblock(m_x[0])(m_x[1])(m_x[2])(m_x[3]);
+
+    switch (m_kw)
+    {
+    case 4:  // 128-bit key
+    {
+        const int R = 80;
+        for (int i = 0; i < R; i+=8)
+        {
+            CHAM_EncRound<0, 8>(m_x.begin(), m_rk.begin(), i+0);
+            CHAM_EncRound<1, 8>(m_x.begin(), m_rk.begin(), i+1);
+            CHAM_EncRound<2, 8>(m_x.begin(), m_rk.begin(), i+2);
+            CHAM_EncRound<3, 8>(m_x.begin(), m_rk.begin(), i+3);
+            CHAM_EncRound<4, 8>(m_x.begin(), m_rk.begin(), i+4);
+            CHAM_EncRound<5, 8>(m_x.begin(), m_rk.begin(), i+5);
+            CHAM_EncRound<6, 8>(m_x.begin(), m_rk.begin(), i+6);
+            CHAM_EncRound<7, 8>(m_x.begin(), m_rk.begin(), i+7);
+        }
+        break;
+    }
+    case 8:  // 256-bit key
+    {
+        const int R = 96;
+        for (int i = 0; i < R; i+=16)
+        {
+            CHAM_EncRound< 0, 16>(m_x.begin(), m_rk.begin(),  i+0);
+            CHAM_EncRound< 1, 16>(m_x.begin(), m_rk.begin(),  i+1);
+            CHAM_EncRound< 2, 16>(m_x.begin(), m_rk.begin(),  i+2);
+            CHAM_EncRound< 3, 16>(m_x.begin(), m_rk.begin(),  i+3);
+            CHAM_EncRound< 4, 16>(m_x.begin(), m_rk.begin(),  i+4);
+            CHAM_EncRound< 5, 16>(m_x.begin(), m_rk.begin(),  i+5);
+            CHAM_EncRound< 6, 16>(m_x.begin(), m_rk.begin(),  i+6);
+            CHAM_EncRound< 7, 16>(m_x.begin(), m_rk.begin(),  i+7);
+            CHAM_EncRound< 8, 16>(m_x.begin(), m_rk.begin(),  i+8);
+            CHAM_EncRound< 9, 16>(m_x.begin(), m_rk.begin(),  i+9);
+            CHAM_EncRound<10, 16>(m_x.begin(), m_rk.begin(), i+10);
+            CHAM_EncRound<11, 16>(m_x.begin(), m_rk.begin(), i+11);
+            CHAM_EncRound<12, 16>(m_x.begin(), m_rk.begin(), i+12);
+            CHAM_EncRound<13, 16>(m_x.begin(), m_rk.begin(), i+13);
+            CHAM_EncRound<14, 16>(m_x.begin(), m_rk.begin(), i+14);
+            CHAM_EncRound<15, 16>(m_x.begin(), m_rk.begin(), i+15);
+        }
+        break;
+    }
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    PutBlock<word32, BigEndian> oblock(xorBlock, outBlock);
+    oblock(m_x[0])(m_x[1])(m_x[2])(m_x[3]);
+}
+
+void CHAM128::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word32, BigEndian> iblock(inBlock);
+    iblock(m_x[0])(m_x[1])(m_x[2])(m_x[3]);
+
+    switch (m_kw)
+    {
+    case 4:  // 128-bit key
+    {
+        const int R = 80;
+        for (int i = R-1; i >= 0; i-=8)
+        {
+            CHAM_DecRound<7, 8>(m_x.begin(), m_rk.begin(), i-0);
+            CHAM_DecRound<6, 8>(m_x.begin(), m_rk.begin(), i-1);
+            CHAM_DecRound<5, 8>(m_x.begin(), m_rk.begin(), i-2);
+            CHAM_DecRound<4, 8>(m_x.begin(), m_rk.begin(), i-3);
+            CHAM_DecRound<3, 8>(m_x.begin(), m_rk.begin(), i-4);
+            CHAM_DecRound<2, 8>(m_x.begin(), m_rk.begin(), i-5);
+            CHAM_DecRound<1, 8>(m_x.begin(), m_rk.begin(), i-6);
+            CHAM_DecRound<0, 8>(m_x.begin(), m_rk.begin(), i-7);
+        }
+        break;
+    }
+    case 8:  // 256-bit key
+    {
+        const int R = 96;
+        for (int i = R-1; i >= 0; i-=16)
+        {
+            CHAM_DecRound<15, 16>(m_x.begin(), m_rk.begin(),  i-0);
+            CHAM_DecRound<14, 16>(m_x.begin(), m_rk.begin(),  i-1);
+            CHAM_DecRound<13, 16>(m_x.begin(), m_rk.begin(),  i-2);
+            CHAM_DecRound<12, 16>(m_x.begin(), m_rk.begin(),  i-3);
+            CHAM_DecRound<11, 16>(m_x.begin(), m_rk.begin(),  i-4);
+            CHAM_DecRound<10, 16>(m_x.begin(), m_rk.begin(),  i-5);
+            CHAM_DecRound< 9, 16>(m_x.begin(), m_rk.begin(),  i-6);
+            CHAM_DecRound< 8, 16>(m_x.begin(), m_rk.begin(),  i-7);
+            CHAM_DecRound< 7, 16>(m_x.begin(), m_rk.begin(),  i-8);
+            CHAM_DecRound< 6, 16>(m_x.begin(), m_rk.begin(),  i-9);
+            CHAM_DecRound< 5, 16>(m_x.begin(), m_rk.begin(), i-10);
+            CHAM_DecRound< 4, 16>(m_x.begin(), m_rk.begin(), i-11);
+            CHAM_DecRound< 3, 16>(m_x.begin(), m_rk.begin(), i-12);
+            CHAM_DecRound< 2, 16>(m_x.begin(), m_rk.begin(), i-13);
+            CHAM_DecRound< 1, 16>(m_x.begin(), m_rk.begin(), i-14);
+            CHAM_DecRound< 0, 16>(m_x.begin(), m_rk.begin(), i-15);
+        }
+        break;
+    }
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    PutBlock<word32, BigEndian> oblock(xorBlock, outBlock);
+    oblock(m_x[0])(m_x[1])(m_x[2])(m_x[3]);
+}
+
+#if CRYPTOPP_CHAM128_ADVANCED_PROCESS_BLOCKS
+size_t CHAM128::Enc::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks,
+        byte *outBlocks, size_t length, word32 flags) const
+{
+# if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3()) {
+        const size_t rounds = (m_kw == 4 ? 80 : 96);
+        return CHAM128_Enc_AdvancedProcessBlocks_SSSE3(m_rk, rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+    }
+# endif  // CRYPTOPP_SSSE3_AVAILABLE
+    return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t CHAM128::Dec::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks,
+        byte *outBlocks, size_t length, word32 flags) const
+{
+# if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3()) {
+        const size_t rounds = (m_kw == 4 ? 80 : 96);
+        return CHAM128_Dec_AdvancedProcessBlocks_SSSE3(m_rk, rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+    }
+# endif  // CRYPTOPP_SSSE3_AVAILABLE
+    return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_CHAM128_ADVANCED_PROCESS_BLOCKS
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/cham.h b/runtime/third_party/cryptopp/cham.h
new file mode 100644
index 0000000..2ce7b8e
--- /dev/null
+++ b/runtime/third_party/cryptopp/cham.h
@@ -0,0 +1,179 @@
+// cham.h - written and placed in the public domain by Kim Sung Hee and Jeffrey Walton
+//          Based on "CHAM: A Family of Lightweight Block Ciphers for
+//          Resource-Constrained Devices" by Bonwook Koo, Dongyoung Roh,
+//          Hyeonjin Kim, Younghoon Jung, Dong-Geon Lee, and Daesung Kwon
+
+/// \file cham.h
+/// \brief Classes for the CHAM block cipher
+/// \since Crypto++ 8.0
+
+#ifndef CRYPTOPP_CHAM_H
+#define CRYPTOPP_CHAM_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+#include "algparam.h"
+
+#if (CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86)
+# define CRYPTOPP_CHAM128_ADVANCED_PROCESS_BLOCKS 1
+#endif
+
+// Yet another SunStudio/SunCC workaround. Failed self tests
+// in SSE code paths on i386 for SunStudio 12.3 and below.
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x5120)
+# undef CRYPTOPP_CHAM128_ADVANCED_PROCESS_BLOCKS
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief CHAM block cipher information
+/// \since Crypto++ 8.0
+struct CHAM64_Info : public FixedBlockSize<8>, public FixedKeyLength<16>
+{
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///   member function.
+    static const std::string StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize
+        return "CHAM-64";
+    }
+};
+
+/// \brief CHAM block cipher information
+/// \since Crypto++ 8.0
+struct CHAM128_Info : public FixedBlockSize<16>, public VariableKeyLength<16,16,32,16>
+{
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///   member function.
+    static const std::string StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize
+        return "CHAM-128";
+    }
+};
+
+/// \brief CHAM 64-bit block cipher
+/// \details CHAM64 provides 64-bit block size. The valid key size is 128-bit.
+/// \note Crypto++ provides a byte oriented implementation
+/// \sa CHAM128, <a href="http://www.cryptopp.com/wiki/CHAM">CHAM</a>,
+///   <a href="https://pdfs.semanticscholar.org/2f57/61b5c2614cffd58a09cc83c375a2b32a2ed3.pdf">
+///   CHAM: A Family of Lightweight Block Ciphers for Resource-Constrained Devices</a>
+/// \since Crypto++ 8.0
+class CRYPTOPP_NO_VTABLE CHAM64 : public CHAM64_Info, public BlockCipherDocumentation
+{
+public:
+    /// \brief CHAM block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<CHAM64_Info>
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+
+        SecBlock<word16> m_rk;
+        mutable FixedSizeSecBlock<word16, 4> m_x;
+        unsigned int m_kw;
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    /// \brief Decryption transformation
+    /// \details Dec provides implementation for decryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    /// \brief CHAM64 encryption
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    /// \brief CHAM64 decryption
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+/// \brief CHAM64 encryption
+typedef CHAM64::Encryption CHAM64Encryption;
+/// \brief CHAM64 decryption
+typedef CHAM64::Decryption CHAM64Decryption;
+
+/// \brief CHAM 128-bit block cipher
+/// \details CHAM128 provides 128-bit block size. The valid key size is 128-bit and 256-bit.
+/// \note Crypto++ provides a byte oriented implementation
+/// \sa CHAM64, <a href="http://www.cryptopp.com/wiki/CHAM">CHAM</a>,
+///   <a href="https://pdfs.semanticscholar.org/2f57/61b5c2614cffd58a09cc83c375a2b32a2ed3.pdf">
+///   CHAM: A Family of Lightweight Block Ciphers for Resource-Constrained Devices</a>
+/// \since Crypto++ 8.0
+class CRYPTOPP_NO_VTABLE CHAM128 : public CHAM128_Info, public BlockCipherDocumentation
+{
+public:
+    /// \brief CHAM block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<CHAM128_Info>
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+        std::string AlgorithmProvider() const;
+
+        SecBlock<word32> m_rk;
+        mutable FixedSizeSecBlock<word32, 4> m_x;
+        unsigned int m_kw;
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+#if CRYPTOPP_CHAM128_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    /// \brief Decryption transformation
+    /// \details Dec provides implementation for decryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+#if CRYPTOPP_CHAM128_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    /// \brief CHAM128 encryption
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    /// \brief CHAM128 decryption
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+/// \brief CHAM128 encryption
+typedef CHAM128::Encryption CHAM128Encryption;
+/// \brief CHAM128 decryption
+typedef CHAM128::Decryption CHAM128Decryption;
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_CHAM_H
diff --git a/runtime/third_party/cryptopp/cham_simd.cpp b/runtime/third_party/cryptopp/cham_simd.cpp
new file mode 100644
index 0000000..45a02bc
--- /dev/null
+++ b/runtime/third_party/cryptopp/cham_simd.cpp
@@ -0,0 +1,478 @@
+// cham_simd.cpp - written and placed in the public domain by Jeffrey Walton
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    SSSE3, ARM NEON and ARMv8a, and Power7 Altivec instructions. A separate
+//    source file is needed because additional CXXFLAGS are required to enable
+//    the appropriate instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+
+#include "cham.h"
+#include "misc.h"
+
+// Uncomment for benchmarking C++ against SSE or NEON.
+// Do so in both simon.cpp and simon_simd.cpp.
+// #undef CRYPTOPP_SSSE3_AVAILABLE
+// #undef CRYPTOPP_ARM_NEON_AVAILABLE
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+#include "adv_simd.h"
+# include <pmmintrin.h>
+# include <tmmintrin.h>
+#endif
+
+#if defined(__XOP__)
+# if defined(CRYPTOPP_GCC_COMPATIBLE)
+#  include <x86intrin.h>
+# endif
+# include <ammintrin.h>
+#endif  // XOP
+
+// Clang intrinsic casts, http://bugs.llvm.org/show_bug.cgi?id=20670
+#define DOUBLE_CAST(x) ((double*)(void*)(x))
+#define CONST_DOUBLE_CAST(x) ((const double*)(const void*)(x))
+
+// Squash MS LNK4221 and libtool warnings
+extern const char CHAM_SIMD_FNAME[] = __FILE__;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word16;
+using CryptoPP::word32;
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+
+//////////////////////////////////////////////////////////////////////////
+
+NAMESPACE_BEGIN(W32)  // CHAM128, 32-bit word size
+
+template <unsigned int R>
+inline __m128i RotateLeft32(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, R);
+#else
+    return _mm_or_si128(
+        _mm_slli_epi32(val, R), _mm_srli_epi32(val, 32-R));
+#endif
+}
+
+template <unsigned int R>
+inline __m128i RotateRight32(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, 32-R);
+#else
+    return _mm_or_si128(
+        _mm_slli_epi32(val, 32-R), _mm_srli_epi32(val, R));
+#endif
+}
+
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+inline __m128i RotateLeft32<8>(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, 8);
+#else
+    const __m128i mask = _mm_set_epi8(14,13,12,15, 10,9,8,11, 6,5,4,7, 2,1,0,3);
+    return _mm_shuffle_epi8(val, mask);
+#endif
+}
+
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+inline __m128i RotateRight32<8>(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, 32-8);
+#else
+    const __m128i mask = _mm_set_epi8(12,15,14,13, 8,11,10,9, 4,7,6,5, 0,3,2,1);
+    return _mm_shuffle_epi8(val, mask);
+#endif
+}
+
+template <unsigned int IDX>
+inline __m128i UnpackXMM(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // Should not be instantiated
+    CRYPTOPP_UNUSED(a); CRYPTOPP_UNUSED(b);
+    CRYPTOPP_UNUSED(c); CRYPTOPP_UNUSED(d);
+    CRYPTOPP_ASSERT(0);
+    return _mm_setzero_si128();
+}
+
+template <>
+inline __m128i UnpackXMM<0>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // The shuffle converts to and from little-endian for SSE. A specialized
+    // CHAM implementation can avoid the shuffle by framing the data for
+    // encryption, decryption and benchmarks. The library cannot take the
+    // speed-up because of the byte oriented API.
+    const __m128i r1 = _mm_unpacklo_epi32(a, b);
+    const __m128i r2 = _mm_unpacklo_epi32(c, d);
+    return _mm_shuffle_epi8(_mm_unpacklo_epi64(r1, r2),
+        _mm_set_epi8(12,13,14,15, 8,9,10,11, 4,5,6,7, 0,1,2,3));
+}
+
+template <>
+inline __m128i UnpackXMM<1>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // The shuffle converts to and from little-endian for SSE. A specialized
+    // CHAM implementation can avoid the shuffle by framing the data for
+    // encryption, decryption and benchmarks. The library cannot take the
+    // speed-up because of the byte oriented API.
+    const __m128i r1 = _mm_unpacklo_epi32(a, b);
+    const __m128i r2 = _mm_unpacklo_epi32(c, d);
+    return _mm_shuffle_epi8(_mm_unpackhi_epi64(r1, r2),
+        _mm_set_epi8(12,13,14,15, 8,9,10,11, 4,5,6,7, 0,1,2,3));
+}
+
+template <>
+inline __m128i UnpackXMM<2>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // The shuffle converts to and from little-endian for SSE. A specialized
+    // CHAM implementation can avoid the shuffle by framing the data for
+    // encryption, decryption and benchmarks. The library cannot take the
+    // speed-up because of the byte oriented API.
+    const __m128i r1 = _mm_unpackhi_epi32(a, b);
+    const __m128i r2 = _mm_unpackhi_epi32(c, d);
+    return _mm_shuffle_epi8(_mm_unpacklo_epi64(r1, r2),
+        _mm_set_epi8(12,13,14,15, 8,9,10,11, 4,5,6,7, 0,1,2,3));
+}
+
+template <>
+inline __m128i UnpackXMM<3>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // The shuffle converts to and from little-endian for SSE. A specialized
+    // CHAM implementation can avoid the shuffle by framing the data for
+    // encryption, decryption and benchmarks. The library cannot take the
+    // speed-up because of the byte oriented API.
+    const __m128i r1 = _mm_unpackhi_epi32(a, b);
+    const __m128i r2 = _mm_unpackhi_epi32(c, d);
+    return _mm_shuffle_epi8(_mm_unpackhi_epi64(r1, r2),
+        _mm_set_epi8(12,13,14,15, 8,9,10,11, 4,5,6,7, 0,1,2,3));
+}
+
+template <unsigned int IDX>
+inline __m128i UnpackXMM(const __m128i& v)
+{
+    // Should not be instantiated
+    CRYPTOPP_UNUSED(v); CRYPTOPP_ASSERT(0);
+    return _mm_setzero_si128();
+}
+
+template <>
+inline __m128i UnpackXMM<0>(const __m128i& v)
+{
+    return _mm_shuffle_epi8(v, _mm_set_epi8(0,1,2,3, 0,1,2,3, 0,1,2,3, 0,1,2,3));
+}
+
+template <>
+inline __m128i UnpackXMM<1>(const __m128i& v)
+{
+    return _mm_shuffle_epi8(v, _mm_set_epi8(4,5,6,7, 4,5,6,7, 4,5,6,7, 4,5,6,7));
+}
+
+template <>
+inline __m128i UnpackXMM<2>(const __m128i& v)
+{
+    return _mm_shuffle_epi8(v, _mm_set_epi8(8,9,10,11, 8,9,10,11, 8,9,10,11, 8,9,10,11));
+}
+
+template <>
+inline __m128i UnpackXMM<3>(const __m128i& v)
+{
+    return _mm_shuffle_epi8(v, _mm_set_epi8(12,13,14,15, 12,13,14,15, 12,13,14,15, 12,13,14,15));
+}
+
+template <unsigned int IDX>
+inline __m128i RepackXMM(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    return UnpackXMM<IDX>(a, b, c, d);
+}
+
+template <unsigned int IDX>
+inline __m128i RepackXMM(const __m128i& v)
+{
+    return UnpackXMM<IDX>(v);
+}
+
+inline void CHAM128_Enc_Block(__m128i &block0,
+    const word32 *subkeys, unsigned int rounds)
+{
+    // Rearrange the data for vectorization. UnpackXMM includes a
+    // little-endian swap for SSE. Thanks to Peter Cordes for help
+    // with packing and unpacking.
+    // [A1 A2 A3 A4][B1 B2 B3 B4] ... => [A1 B1 C1 D1][A2 B2 C2 D2] ...
+    __m128i a = UnpackXMM<0>(block0);
+    __m128i b = UnpackXMM<1>(block0);
+    __m128i c = UnpackXMM<2>(block0);
+    __m128i d = UnpackXMM<3>(block0);
+
+    __m128i counter = _mm_set_epi32(0,0,0,0);
+    __m128i increment = _mm_set_epi32(1,1,1,1);
+
+    const unsigned int MASK = (rounds == 80 ? 7 : 15);
+    for (int i=0; i<static_cast<int>(rounds); i+=4)
+    {
+        __m128i k, k1, k2, t1, t2;
+        k = _mm_castpd_si128(_mm_load_sd(CONST_DOUBLE_CAST(&subkeys[(i+0) & MASK])));
+
+        // Shuffle out two subkeys
+        k1 = _mm_shuffle_epi8(k, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+        k2 = _mm_shuffle_epi8(k, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+
+        t1 = _mm_xor_si128(a, counter);
+        t2 = _mm_xor_si128(RotateLeft32<1>(b), k1);
+        a = RotateLeft32<8>(_mm_add_epi32(t1, t2));
+
+        counter = _mm_add_epi32(counter, increment);
+
+        t1 = _mm_xor_si128(b, counter);
+        t2 = _mm_xor_si128(RotateLeft32<8>(c), k2);
+        b = RotateLeft32<1>(_mm_add_epi32(t1, t2));
+
+        counter = _mm_add_epi32(counter, increment);
+        k = _mm_castpd_si128(_mm_load_sd(CONST_DOUBLE_CAST(&subkeys[(i+2) & MASK])));
+
+        // Shuffle out two subkeys
+        k1 = _mm_shuffle_epi8(k, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+        k2 = _mm_shuffle_epi8(k, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+
+        t1 = _mm_xor_si128(c, counter);
+        t2 = _mm_xor_si128(RotateLeft32<1>(d), k1);
+        c = RotateLeft32<8>(_mm_add_epi32(t1, t2));
+
+        counter = _mm_add_epi32(counter, increment);
+
+        t1 = _mm_xor_si128(d, counter);
+        t2 = _mm_xor_si128(RotateLeft32<8>(a), k2);
+        d = RotateLeft32<1>(_mm_add_epi32(t1, t2));
+
+        counter = _mm_add_epi32(counter, increment);
+    }
+
+    // [A1 B1 C1 D1][A2 B2 C2 D2] ... => [A1 A2 A3 A4][B1 B2 B3 B4] ...
+    block0 = RepackXMM<0>(a,b,c,d);
+}
+
+inline void CHAM128_Dec_Block(__m128i &block0,
+    const word32 *subkeys, unsigned int rounds)
+{
+    // Rearrange the data for vectorization. UnpackXMM includes a
+    // little-endian swap for SSE. Thanks to Peter Cordes for help
+    // with packing and unpacking.
+    // [A1 A2 A3 A4][B1 B2 B3 B4] ... => [A1 B1 C1 D1][A2 B2 C2 D2] ...
+    __m128i a = UnpackXMM<0>(block0);
+    __m128i b = UnpackXMM<1>(block0);
+    __m128i c = UnpackXMM<2>(block0);
+    __m128i d = UnpackXMM<3>(block0);
+
+    __m128i counter = _mm_set_epi32(rounds-1,rounds-1,rounds-1,rounds-1);
+    __m128i decrement = _mm_set_epi32(1,1,1,1);
+
+    const unsigned int MASK = (rounds == 80 ? 7 : 15);
+    for (int i = static_cast<int>(rounds)-1; i >= 0; i-=4)
+    {
+        __m128i k, k1, k2, t1, t2;
+        k = _mm_castpd_si128(_mm_load_sd(CONST_DOUBLE_CAST(&subkeys[(i-1) & MASK])));
+
+        // Shuffle out two subkeys
+        k1 = _mm_shuffle_epi8(k, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+        k2 = _mm_shuffle_epi8(k, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+
+        // Odd round
+        t1 = RotateRight32<1>(d);
+        t2 = _mm_xor_si128(RotateLeft32<8>(a), k1);
+        d = _mm_xor_si128(_mm_sub_epi32(t1, t2), counter);
+
+        counter = _mm_sub_epi32(counter, decrement);
+
+        // Even round
+        t1 = RotateRight32<8>(c);
+        t2 = _mm_xor_si128(RotateLeft32<1>(d), k2);
+        c = _mm_xor_si128(_mm_sub_epi32(t1, t2), counter);
+
+        counter = _mm_sub_epi32(counter, decrement);
+        k = _mm_castpd_si128(_mm_load_sd(CONST_DOUBLE_CAST(&subkeys[(i-3) & MASK])));
+
+        // Shuffle out two subkeys
+        k1 = _mm_shuffle_epi8(k, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+        k2 = _mm_shuffle_epi8(k, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+
+        // Odd round
+        t1 = RotateRight32<1>(b);
+        t2 = _mm_xor_si128(RotateLeft32<8>(c), k1);
+        b = _mm_xor_si128(_mm_sub_epi32(t1, t2), counter);
+
+        counter = _mm_sub_epi32(counter, decrement);
+
+        // Even round
+        t1 = RotateRight32<8>(a);
+        t2 = _mm_xor_si128(RotateLeft32<1>(b), k2);
+        a = _mm_xor_si128(_mm_sub_epi32(t1, t2), counter);
+
+        counter = _mm_sub_epi32(counter, decrement);
+    }
+
+    // [A1 B1 C1 D1][A2 B2 C2 D2] ... => [A1 A2 A3 A4][B1 B2 B3 B4] ...
+    block0 = RepackXMM<0>(a,b,c,d);
+}
+
+inline void CHAM128_Enc_4_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, const word32 *subkeys, unsigned int rounds)
+{
+    // Rearrange the data for vectorization. UnpackXMM includes a
+    // little-endian swap for SSE. Thanks to Peter Cordes for help
+    // with packing and unpacking.
+    // [A1 A2 A3 A4][B1 B2 B3 B4] ... => [A1 B1 C1 D1][A2 B2 C2 D2] ...
+    __m128i a = UnpackXMM<0>(block0, block1, block2, block3);
+    __m128i b = UnpackXMM<1>(block0, block1, block2, block3);
+    __m128i c = UnpackXMM<2>(block0, block1, block2, block3);
+    __m128i d = UnpackXMM<3>(block0, block1, block2, block3);
+
+    __m128i counter = _mm_set_epi32(0,0,0,0);
+    __m128i increment = _mm_set_epi32(1,1,1,1);
+
+    const unsigned int MASK = (rounds == 80 ? 7 : 15);
+    for (int i=0; i<static_cast<int>(rounds); i+=4)
+    {
+        __m128i k, k1, k2, t1, t2;
+        k = _mm_castpd_si128(_mm_load_sd(CONST_DOUBLE_CAST(&subkeys[(i+0) & MASK])));
+
+        // Shuffle out two subkeys
+        k1 = _mm_shuffle_epi8(k, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+        k2 = _mm_shuffle_epi8(k, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+
+        t1 = _mm_xor_si128(a, counter);
+        t2 = _mm_xor_si128(RotateLeft32<1>(b), k1);
+        a = RotateLeft32<8>(_mm_add_epi32(t1, t2));
+
+        counter = _mm_add_epi32(counter, increment);
+
+        t1 = _mm_xor_si128(b, counter);
+        t2 = _mm_xor_si128(RotateLeft32<8>(c), k2);
+        b = RotateLeft32<1>(_mm_add_epi32(t1, t2));
+
+        counter = _mm_add_epi32(counter, increment);
+        k = _mm_castpd_si128(_mm_load_sd(CONST_DOUBLE_CAST(&subkeys[(i+2) & MASK])));
+
+        // Shuffle out two subkeys
+        k1 = _mm_shuffle_epi8(k, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+        k2 = _mm_shuffle_epi8(k, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+
+        t1 = _mm_xor_si128(c, counter);
+        t2 = _mm_xor_si128(RotateLeft32<1>(d), k1);
+        c = RotateLeft32<8>(_mm_add_epi32(t1, t2));
+
+        counter = _mm_add_epi32(counter, increment);
+
+        t1 = _mm_xor_si128(d, counter);
+        t2 = _mm_xor_si128(RotateLeft32<8>(a), k2);
+        d = RotateLeft32<1>(_mm_add_epi32(t1, t2));
+
+        counter = _mm_add_epi32(counter, increment);
+    }
+
+    // [A1 B1 C1 D1][A2 B2 C2 D2] ... => [A1 A2 A3 A4][B1 B2 B3 B4] ...
+    block0 = RepackXMM<0>(a,b,c,d);
+    block1 = RepackXMM<1>(a,b,c,d);
+    block2 = RepackXMM<2>(a,b,c,d);
+    block3 = RepackXMM<3>(a,b,c,d);
+}
+
+inline void CHAM128_Dec_4_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, const word32 *subkeys, unsigned int rounds)
+{
+    // Rearrange the data for vectorization. UnpackXMM includes a
+    // little-endian swap for SSE. Thanks to Peter Cordes for help
+    // with packing and unpacking.
+    // [A1 A2 A3 A4][B1 B2 B3 B4] ... => [A1 B1 C1 D1][A2 B2 C2 D2] ...
+    __m128i a = UnpackXMM<0>(block0, block1, block2, block3);
+    __m128i b = UnpackXMM<1>(block0, block1, block2, block3);
+    __m128i c = UnpackXMM<2>(block0, block1, block2, block3);
+    __m128i d = UnpackXMM<3>(block0, block1, block2, block3);
+
+    __m128i counter = _mm_set_epi32(rounds-1,rounds-1,rounds-1,rounds-1);
+    __m128i decrement = _mm_set_epi32(1,1,1,1);
+
+    const unsigned int MASK = (rounds == 80 ? 7 : 15);
+    for (int i = static_cast<int>(rounds)-1; i >= 0; i-=4)
+    {
+        __m128i k, k1, k2, t1, t2;
+        k = _mm_castpd_si128(_mm_load_sd(CONST_DOUBLE_CAST(&subkeys[(i-1) & MASK])));
+
+        // Shuffle out two subkeys
+        k1 = _mm_shuffle_epi8(k, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+        k2 = _mm_shuffle_epi8(k, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+
+        // Odd round
+        t1 = RotateRight32<1>(d);
+        t2 = _mm_xor_si128(RotateLeft32<8>(a), k1);
+        d = _mm_xor_si128(_mm_sub_epi32(t1, t2), counter);
+
+        counter = _mm_sub_epi32(counter, decrement);
+
+        // Even round
+        t1 = RotateRight32<8>(c);
+        t2 = _mm_xor_si128(RotateLeft32<1>(d), k2);
+        c = _mm_xor_si128(_mm_sub_epi32(t1, t2), counter);
+
+        counter = _mm_sub_epi32(counter, decrement);
+        k = _mm_castpd_si128(_mm_load_sd(CONST_DOUBLE_CAST(&subkeys[(i-3) & MASK])));
+
+        // Shuffle out two subkeys
+        k1 = _mm_shuffle_epi8(k, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+        k2 = _mm_shuffle_epi8(k, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+
+        // Odd round
+        t1 = RotateRight32<1>(b);
+        t2 = _mm_xor_si128(RotateLeft32<8>(c), k1);
+        b = _mm_xor_si128(_mm_sub_epi32(t1, t2), counter);
+
+        counter = _mm_sub_epi32(counter, decrement);
+
+        // Even round
+        t1 = RotateRight32<8>(a);
+        t2 = _mm_xor_si128(RotateLeft32<1>(b), k2);
+        a = _mm_xor_si128(_mm_sub_epi32(t1, t2), counter);
+
+        counter = _mm_sub_epi32(counter, decrement);
+    }
+
+    // [A1 B1 C1 D1][A2 B2 C2 D2] ... => [A1 A2 A3 A4][B1 B2 B3 B4] ...
+    block0 = RepackXMM<0>(a,b,c,d);
+    block1 = RepackXMM<1>(a,b,c,d);
+    block2 = RepackXMM<2>(a,b,c,d);
+    block3 = RepackXMM<3>(a,b,c,d);
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+NAMESPACE_END  // W32
+
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+size_t CHAM128_Enc_AdvancedProcessBlocks_SSSE3(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_4x1_SSE(W32::CHAM128_Enc_Block, W32::CHAM128_Enc_4_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t CHAM128_Dec_AdvancedProcessBlocks_SSSE3(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_4x1_SSE(W32::CHAM128_Dec_Block, W32::CHAM128_Dec_4_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif // CRYPTOPP_SSSE3_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/channels.cpp b/runtime/third_party/cryptopp/channels.cpp
new file mode 100644
index 0000000..5d1c975
--- /dev/null
+++ b/runtime/third_party/cryptopp/channels.cpp
@@ -0,0 +1,316 @@
+// channels.cpp - originally written and placed in the public domain by Wei Dai
+//                CryptoPP::Test namespace added by JW in February 2017
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "cryptlib.h"
+#include "channels.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if 0
+void MessageSwitch::AddDefaultRoute(BufferedTransformation &destination, const std::string &channel)
+{
+	m_defaultRoutes.push_back(Route(&destination, channel));
+}
+
+void MessageSwitch::AddRoute(unsigned int begin, unsigned int end, BufferedTransformation &destination, const std::string &channel)
+{
+	RangeRoute route(begin, end, Route(&destination, channel));
+	RouteList::iterator it = upper_bound(m_routes.begin(), m_routes.end(), route);
+	m_routes.insert(it, route);
+}
+
+/*
+class MessageRouteIterator
+{
+public:
+	typedef MessageSwitch::RouteList::const_iterator RouteIterator;
+	typedef MessageSwitch::DefaultRouteList::const_iterator DefaultIterator;
+
+	bool m_useDefault;
+	RouteIterator m_itRouteCurrent, m_itRouteEnd;
+	DefaultIterator m_itDefaultCurrent, m_itDefaultEnd;
+
+	MessageRouteIterator(MessageSwitch &ms, const std::string &channel)
+		: m_channel(channel)
+	{
+		std::pair<MapIterator, MapIterator> range = cs.m_routeMap.equal_range(channel);
+		if (range.first == range.second)
+		{
+			m_useDefault = true;
+			m_itListCurrent = cs.m_defaultRoutes.begin();
+			m_itListEnd = cs.m_defaultRoutes.end();
+		}
+		else
+		{
+			m_useDefault = false;
+			m_itMapCurrent = range.first;
+			m_itMapEnd = range.second;
+		}
+	}
+
+	bool End() const
+	{
+		return m_useDefault ? m_itListCurrent == m_itListEnd : m_itMapCurrent == m_itMapEnd;
+	}
+
+	void Next()
+	{
+		if (m_useDefault)
+			++m_itListCurrent;
+		else
+			++m_itMapCurrent;
+	}
+
+	BufferedTransformation & Destination()
+	{
+		return m_useDefault ? *m_itListCurrent->first : *m_itMapCurrent->second.first;
+	}
+
+	const std::string & Message()
+	{
+		if (m_useDefault)
+			return m_itListCurrent->second.get() ? *m_itListCurrent->second.get() : m_channel;
+		else
+			return m_itMapCurrent->second.second;
+	}
+};
+
+void MessageSwitch::Put(byte inByte);
+void MessageSwitch::Put(const byte *inString, unsigned int length);
+
+void MessageSwitch::Flush(bool completeFlush, int propagation=-1);
+void MessageSwitch::MessageEnd(int propagation=-1);
+void MessageSwitch::PutMessageEnd(const byte *inString, unsigned int length, int propagation=-1);
+void MessageSwitch::MessageSeriesEnd(int propagation=-1);
+*/
+#endif
+
+
+//
+// ChannelRouteIterator
+//////////////////////////
+
+void ChannelRouteIterator::Reset(const std::string &channel)
+{
+	m_channel = channel;
+	std::pair<MapIterator, MapIterator> range = m_cs.m_routeMap.equal_range(channel);
+	if (range.first == range.second)
+	{
+		m_useDefault = true;
+		m_itListCurrent = m_cs.m_defaultRoutes.begin();
+		m_itListEnd = m_cs.m_defaultRoutes.end();
+	}
+	else
+	{
+		m_useDefault = false;
+		m_itMapCurrent = range.first;
+		m_itMapEnd = range.second;
+	}
+}
+
+bool ChannelRouteIterator::End() const
+{
+	return m_useDefault ? m_itListCurrent == m_itListEnd : m_itMapCurrent == m_itMapEnd;
+}
+
+void ChannelRouteIterator::Next()
+{
+	if (m_useDefault)
+		++m_itListCurrent;
+	else
+		++m_itMapCurrent;
+}
+
+BufferedTransformation & ChannelRouteIterator::Destination()
+{
+	return m_useDefault ? *m_itListCurrent->first : *m_itMapCurrent->second.first;
+}
+
+const std::string & ChannelRouteIterator::Channel()
+{
+	if (m_useDefault)
+		return m_itListCurrent->second.get() ? *m_itListCurrent->second.get() : m_channel;
+	else
+		return m_itMapCurrent->second.second;
+}
+
+
+//
+// ChannelSwitch
+///////////////////
+
+size_t ChannelSwitch::ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	if (m_blocked)
+	{
+		m_blocked = false;
+		goto WasBlocked;
+	}
+
+	m_it.Reset(channel);
+
+	while (!m_it.End())
+	{
+WasBlocked:
+		if (m_it.Destination().ChannelPut2(m_it.Channel(), begin, length, messageEnd, blocking))
+		{
+			m_blocked = true;
+			return 1;
+		}
+
+		m_it.Next();
+	}
+
+	return 0;
+}
+
+void ChannelSwitch::IsolatedInitialize(const NameValuePairs& parameters)
+{
+	CRYPTOPP_UNUSED(parameters);
+	m_routeMap.clear();
+	m_defaultRoutes.clear();
+	m_blocked = false;
+}
+
+bool ChannelSwitch::ChannelFlush(const std::string &channel, bool completeFlush, int propagation, bool blocking)
+{
+	if (m_blocked)
+	{
+		m_blocked = false;
+		goto WasBlocked;
+	}
+
+	m_it.Reset(channel);
+
+	while (!m_it.End())
+	{
+	  WasBlocked:
+		if (m_it.Destination().ChannelFlush(m_it.Channel(), completeFlush, propagation, blocking))
+		{
+			m_blocked = true;
+			return true;
+		}
+
+		m_it.Next();
+	}
+
+	return false;
+}
+
+bool ChannelSwitch::ChannelMessageSeriesEnd(const std::string &channel, int propagation, bool blocking)
+{
+	CRYPTOPP_UNUSED(blocking);
+	if (m_blocked)
+	{
+		m_blocked = false;
+		goto WasBlocked;
+	}
+
+	m_it.Reset(channel);
+
+	while (!m_it.End())
+	{
+	  WasBlocked:
+		if (m_it.Destination().ChannelMessageSeriesEnd(m_it.Channel(), propagation))
+		{
+			m_blocked = true;
+			return true;
+		}
+
+		m_it.Next();
+	}
+
+	return false;
+}
+
+byte * ChannelSwitch::ChannelCreatePutSpace(const std::string &channel, size_t &size)
+{
+	m_it.Reset(channel);
+	if (!m_it.End())
+	{
+		BufferedTransformation &target = m_it.Destination();
+		const std::string &ch = m_it.Channel();
+		m_it.Next();
+		if (m_it.End())	// there is only one target channel
+			return target.ChannelCreatePutSpace(ch, size);
+	}
+	size = 0;
+	return NULLPTR;
+}
+
+size_t ChannelSwitch::ChannelPutModifiable2(const std::string &channel, byte *inString, size_t length, int messageEnd, bool blocking)
+{
+	ChannelRouteIterator it(*this);
+	it.Reset(channel);
+
+	if (!it.End())
+	{
+		BufferedTransformation &target = it.Destination();
+		const std::string &targetChannel = it.Channel();
+		it.Next();
+		if (it.End())	// there is only one target channel
+			return target.ChannelPutModifiable2(targetChannel, inString, length, messageEnd, blocking);
+	}
+
+	return ChannelPut2(channel, inString, length, messageEnd, blocking);
+}
+
+void ChannelSwitch::AddDefaultRoute(BufferedTransformation &destination)
+{
+	m_defaultRoutes.push_back(DefaultRoute(&destination, value_ptr<std::string>(NULLPTR)));
+}
+
+void ChannelSwitch::RemoveDefaultRoute(BufferedTransformation &destination)
+{
+	for (DefaultRouteList::iterator it = m_defaultRoutes.begin(); it != m_defaultRoutes.end(); ++it)
+		if (it->first == &destination && !it->second.get())
+		{
+			m_defaultRoutes.erase(it);
+			break;
+		}
+}
+
+void ChannelSwitch::AddDefaultRoute(BufferedTransformation &destination, const std::string &outChannel)
+{
+	m_defaultRoutes.push_back(DefaultRoute(&destination, outChannel));
+}
+
+void ChannelSwitch::RemoveDefaultRoute(BufferedTransformation &destination, const std::string &outChannel)
+{
+	for (DefaultRouteList::iterator it = m_defaultRoutes.begin(); it != m_defaultRoutes.end(); ++it)
+		if (it->first == &destination && (it->second.get() && *it->second == outChannel))
+		{
+			m_defaultRoutes.erase(it);
+			break;
+		}
+}
+
+void ChannelSwitch::AddRoute(const std::string &inChannel, BufferedTransformation &destination, const std::string &outChannel)
+{
+	m_routeMap.insert(RouteMap::value_type(inChannel, Route(&destination, outChannel)));
+}
+
+void ChannelSwitch::RemoveRoute(const std::string &inChannel, BufferedTransformation &destination, const std::string &outChannel)
+{
+	typedef ChannelSwitch::RouteMap::iterator MapIterator;
+	std::pair<MapIterator, MapIterator> range = m_routeMap.equal_range(inChannel);
+
+	for (MapIterator it = range.first; it != range.second; ++it)
+		if (it->second.first == &destination && it->second.second == outChannel)
+		{
+			m_routeMap.erase(it);
+			break;
+		}
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/channels.h b/runtime/third_party/cryptopp/channels.h
new file mode 100644
index 0000000..d7aecd2
--- /dev/null
+++ b/runtime/third_party/cryptopp/channels.h
@@ -0,0 +1,142 @@
+// channels.h - originally written and placed in the public domain by Wei Dai
+
+/// \file channels.h
+/// \brief Classes for multiple named channels
+
+#ifndef CRYPTOPP_CHANNELS_H
+#define CRYPTOPP_CHANNELS_H
+
+#include "cryptlib.h"
+#include "simple.h"
+#include "smartptr.h"
+#include "stdcpp.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if 0
+/// Route input on default channel to different and/or multiple channels based on message sequence number
+class MessageSwitch : public Sink
+{
+public:
+	void AddDefaultRoute(BufferedTransformation &destination, const std::string &channel);
+	void AddRoute(unsigned int begin, unsigned int end, BufferedTransformation &destination, const std::string &channel);
+
+	void Put(byte inByte);
+	void Put(const byte *inString, unsigned int length);
+
+	void Flush(bool completeFlush, int propagation=-1);
+	void MessageEnd(int propagation=-1);
+	void PutMessageEnd(const byte *inString, unsigned int length, int propagation=-1);
+	void MessageSeriesEnd(int propagation=-1);
+
+private:
+	typedef std::pair<BufferedTransformation *, std::string> Route;
+	struct RangeRoute
+	{
+		RangeRoute(unsigned int begin, unsigned int end, const Route &route)
+			: begin(begin), end(end), route(route) {}
+		bool operator<(const RangeRoute &rhs) const {return begin < rhs.begin;}
+		unsigned int begin, end;
+		Route route;
+	};
+
+	typedef std::list<RangeRoute> RouteList;
+	typedef std::list<Route> DefaultRouteList;
+
+	RouteList m_routes;
+	DefaultRouteList m_defaultRoutes;
+	unsigned int m_nCurrentMessage;
+};
+#endif
+
+class ChannelSwitchTypedefs
+{
+public:
+	typedef std::pair<BufferedTransformation *, std::string> Route;
+	typedef std::multimap<std::string, Route> RouteMap;
+
+	typedef std::pair<BufferedTransformation *, value_ptr<std::string> > DefaultRoute;
+	typedef std::list<DefaultRoute> DefaultRouteList;
+
+	// SunCC workaround: can't use const_iterator here
+	typedef RouteMap::iterator MapIterator;
+	typedef DefaultRouteList::iterator ListIterator;
+};
+
+class ChannelSwitch;
+
+class ChannelRouteIterator : public ChannelSwitchTypedefs
+{
+public:
+	ChannelRouteIterator(ChannelSwitch &cs) : m_cs(cs), m_useDefault(false) {}
+
+	void Reset(const std::string &channel);
+	bool End() const;
+	void Next();
+	BufferedTransformation & Destination();
+	const std::string & Channel();
+
+	ChannelSwitch& m_cs;
+	std::string m_channel;
+	bool m_useDefault;
+	MapIterator m_itMapCurrent, m_itMapEnd;
+	ListIterator m_itListCurrent, m_itListEnd;
+
+protected:
+	// Hide this to see if we break something...
+	ChannelRouteIterator();
+};
+
+/// Route input to different and/or multiple channels based on channel ID
+class CRYPTOPP_DLL ChannelSwitch : public Multichannel<Sink>, public ChannelSwitchTypedefs
+{
+public:
+	ChannelSwitch() : m_it(*this), m_blocked(false) {}
+	ChannelSwitch(BufferedTransformation &destination) : m_it(*this), m_blocked(false)
+	{
+		AddDefaultRoute(destination);
+	}
+	ChannelSwitch(BufferedTransformation &destination, const std::string &outChannel) : m_it(*this), m_blocked(false)
+	{
+		AddDefaultRoute(destination, outChannel);
+	}
+
+	void IsolatedInitialize(const NameValuePairs &parameters=g_nullNameValuePairs);
+
+	size_t ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking);
+	size_t ChannelPutModifiable2(const std::string &channel, byte *begin, size_t length, int messageEnd, bool blocking);
+
+	bool ChannelFlush(const std::string &channel, bool completeFlush, int propagation=-1, bool blocking=true);
+	bool ChannelMessageSeriesEnd(const std::string &channel, int propagation=-1, bool blocking=true);
+
+	byte * ChannelCreatePutSpace(const std::string &channel, size_t &size);
+
+	void AddDefaultRoute(BufferedTransformation &destination);
+	void RemoveDefaultRoute(BufferedTransformation &destination);
+	void AddDefaultRoute(BufferedTransformation &destination, const std::string &outChannel);
+	void RemoveDefaultRoute(BufferedTransformation &destination, const std::string &outChannel);
+	void AddRoute(const std::string &inChannel, BufferedTransformation &destination, const std::string &outChannel);
+	void RemoveRoute(const std::string &inChannel, BufferedTransformation &destination, const std::string &outChannel);
+
+private:
+	RouteMap m_routeMap;
+	DefaultRouteList m_defaultRoutes;
+
+	ChannelRouteIterator m_it;
+	bool m_blocked;
+
+	friend class ChannelRouteIterator;
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/cmac.cpp b/runtime/third_party/cryptopp/cmac.cpp
new file mode 100644
index 0000000..26121b1
--- /dev/null
+++ b/runtime/third_party/cryptopp/cmac.cpp
@@ -0,0 +1,164 @@
+// cmac.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "cmac.h"
+#include "misc.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::IsPowerOf2;
+
+void MulU(byte *k, unsigned int len)
+{
+	byte carry = 0;
+	for (int i=len-1; i>=1; i-=2)
+	{
+		byte carry2 = k[i] >> 7;
+		k[i] += k[i] + carry;
+		carry = k[i-1] >> 7;
+		k[i-1] += k[i-1] + carry2;
+	}
+
+#ifndef CRYPTOPP_CMAC_WIDE_BLOCK_CIPHERS
+	CRYPTOPP_ASSERT(len == 16);
+
+	if (carry)
+	{
+		k[15] ^= 0x87;
+		return;
+	}
+#else
+	CRYPTOPP_ASSERT(IsPowerOf2(len));
+	CRYPTOPP_ASSERT(len >= 8);
+	CRYPTOPP_ASSERT(len <= 128);
+
+	if (carry)
+	{
+		switch (len)
+		{
+		case 8:
+			k[7] ^= 0x1b;
+			break;
+		case 16:
+			k[15] ^= 0x87;
+			break;
+		case 32:
+			// https://crypto.stackexchange.com/q/9815/10496
+			// Polynomial x^256 + x^10 + x^5 + x^2 + 1
+			k[30] ^= 4;
+			k[31] ^= 0x25;
+			break;
+		case 64:
+			// https://crypto.stackexchange.com/q/9815/10496
+			// Polynomial x^512 + x^8 + x^5 + x^2 + 1
+			k[62] ^= 1;
+			k[63] ^= 0x25;
+			break;
+		case 128:
+			// https://crypto.stackexchange.com/q/9815/10496
+			// Polynomial x^1024 + x^19 + x^6 + x + 1
+			k[125] ^= 8;
+			k[126] ^= 0x00;
+			k[127] ^= 0x43;
+			break;
+		default:
+			CRYPTOPP_ASSERT(0);
+		}
+	}
+#endif  // CRYPTOPP_CMAC_WIDE_BLOCK_CIPHERS
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void CMAC_Base::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	BlockCipher &cipher = AccessCipher();
+	cipher.SetKey(key, length, params);
+
+	unsigned int blockSize = cipher.BlockSize();
+	m_reg.CleanNew(3*blockSize);
+	m_counter = 0;
+
+	cipher.ProcessBlock(m_reg, m_reg+blockSize);
+	MulU(m_reg+blockSize, blockSize);
+	std::memcpy(m_reg+2*blockSize, m_reg+blockSize, blockSize);
+	MulU(m_reg+2*blockSize, blockSize);
+}
+
+void CMAC_Base::Update(const byte *input, size_t length)
+{
+	CRYPTOPP_ASSERT((input && length) || !(input || length));
+	if (!length)
+		return;
+
+	BlockCipher &cipher = AccessCipher();
+	unsigned int blockSize = cipher.BlockSize();
+
+	if (m_counter > 0)
+	{
+		const unsigned int len = UnsignedMin(blockSize - m_counter, length);
+		if (len)
+		{
+			xorbuf(m_reg+m_counter, input, len);
+			length -= len;
+			input += len;
+			m_counter += len;
+		}
+
+		if (m_counter == blockSize && length > 0)
+		{
+			cipher.ProcessBlock(m_reg);
+			m_counter = 0;
+		}
+	}
+
+	if (length > blockSize)
+	{
+		CRYPTOPP_ASSERT(m_counter == 0);
+		size_t leftOver = 1 + cipher.AdvancedProcessBlocks(m_reg, input, m_reg, length-1, BlockTransformation::BT_DontIncrementInOutPointers|BlockTransformation::BT_XorInput);
+		input += (length - leftOver);
+		length = leftOver;
+	}
+
+	if (length > 0)
+	{
+		CRYPTOPP_ASSERT(m_counter + length <= blockSize);
+		xorbuf(m_reg+m_counter, input, length);
+		m_counter += (unsigned int)length;
+	}
+
+	CRYPTOPP_ASSERT(m_counter > 0);
+}
+
+void CMAC_Base::TruncatedFinal(byte *mac, size_t size)
+{
+	ThrowIfInvalidTruncatedSize(size);
+
+	BlockCipher &cipher = AccessCipher();
+	unsigned int blockSize = cipher.BlockSize();
+
+	if (m_counter < blockSize)
+	{
+		m_reg[m_counter] ^= 0x80;
+		cipher.AdvancedProcessBlocks(m_reg, m_reg+2*blockSize, m_reg, blockSize, BlockTransformation::BT_DontIncrementInOutPointers|BlockTransformation::BT_XorInput);
+	}
+	else
+		cipher.AdvancedProcessBlocks(m_reg, m_reg+blockSize, m_reg, blockSize, BlockTransformation::BT_DontIncrementInOutPointers|BlockTransformation::BT_XorInput);
+
+	// UBsan finding
+	if (mac)
+		std::memcpy(mac, m_reg, size);
+
+	m_counter = 0;
+	std::memset(m_reg, 0, blockSize);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/cmac.h b/runtime/third_party/cryptopp/cmac.h
new file mode 100644
index 0000000..91d9f7f
--- /dev/null
+++ b/runtime/third_party/cryptopp/cmac.h
@@ -0,0 +1,76 @@
+// cmac.h - originally written and placed in the public domain by Wei Dai
+
+/// \file cmac.h
+/// \brief Classes for CMAC message authentication code
+/// \since Crypto++ 5.6.0
+
+#ifndef CRYPTOPP_CMAC_H
+#define CRYPTOPP_CMAC_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+/// \brief Enable CMAC and wide block ciphers
+/// \details CMAC is only defined for AES. The library can support wide
+///  block ciphers like Kaylna and Threefish since we know the polynomials.
+#ifndef CRYPTOPP_CMAC_WIDE_BLOCK_CIPHERS
+# define CRYPTOPP_CMAC_WIDE_BLOCK_CIPHERS 1
+#endif  // CRYPTOPP_CMAC_WIDE_BLOCK_CIPHERS
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief CMAC base implementation
+/// \since Crypto++ 5.6.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CMAC_Base : public MessageAuthenticationCode
+{
+public:
+
+	virtual ~CMAC_Base() {}
+	CMAC_Base() : m_counter(0) {}
+
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *mac, size_t size);
+	unsigned int DigestSize() const {return GetCipher().BlockSize();}
+	unsigned int OptimalBlockSize() const {return GetCipher().BlockSize();}
+	unsigned int OptimalDataAlignment() const {return GetCipher().OptimalDataAlignment();}
+	std::string AlgorithmProvider() const {return GetCipher().AlgorithmProvider();}
+
+protected:
+	friend class EAX_Base;
+
+	const BlockCipher & GetCipher() const {return const_cast<CMAC_Base*>(this)->AccessCipher();}
+	virtual BlockCipher & AccessCipher() =0;
+
+	void ProcessBuf();
+	SecByteBlock m_reg;
+	unsigned int m_counter;
+};
+
+/// \brief CMAC message authentication code
+/// \tparam T block cipher
+/// \details Template parameter T should be a class derived from BlockCipherDocumentation, for example AES, with a block size of 8, 16, or 32.
+/// \sa <a href="http://www.cryptolounge.org/wiki/CMAC">CMAC</a>
+/// \since Crypto++ 5.6.0
+template <class T>
+class CMAC : public MessageAuthenticationCodeImpl<CMAC_Base, CMAC<T> >, public SameKeyLengthAs<T>
+{
+public:
+	/// \brief Construct a CMAC
+	CMAC() {}
+	/// \brief Construct a CMAC
+	/// \param key the MAC key
+	/// \param length the key size, in bytes
+	CMAC(const byte *key, size_t length=SameKeyLengthAs<T>::DEFAULT_KEYLENGTH)
+		{this->SetKey(key, length);}
+
+	static std::string StaticAlgorithmName() {return std::string("CMAC(") + T::StaticAlgorithmName() + ")";}
+
+private:
+	BlockCipher & AccessCipher() {return m_cipher;}
+	typename T::Encryption m_cipher;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/config.h b/runtime/third_party/cryptopp/config.h
new file mode 100644
index 0000000..e96b112
--- /dev/null
+++ b/runtime/third_party/cryptopp/config.h
@@ -0,0 +1,33 @@
+// config.h - originally written and placed in the public domain by Wei Dai
+
+/// \file config.h
+/// \brief Library configuration file
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+/// \file config.h
+/// \brief Library configuration file
+
+#ifndef CRYPTOPP_CONFIG_H
+#define CRYPTOPP_CONFIG_H
+
+#include "config_align.h"
+#include "config_asm.h"
+#include "config_cpu.h"
+#include "config_cxx.h"
+#include "config_dll.h"
+#include "config_int.h"
+#include "config_misc.h"
+#include "config_ns.h"
+#include "config_os.h"
+#include "config_ver.h"
+
+#endif // CRYPTOPP_CONFIG_H
diff --git a/runtime/third_party/cryptopp/config_align.h b/runtime/third_party/cryptopp/config_align.h
new file mode 100644
index 0000000..d6d85e7
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_align.h
@@ -0,0 +1,72 @@
+// config_align.h - written and placed in public domain by Jeffrey Walton
+//                  the bits that make up this source file are from the
+//                  library's monolithic config.h.
+
+/// \file config_align.h
+/// \brief Library configuration file
+/// \details <tt>config_align.h</tt> provides defines for aligned memory
+///  allocations.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_align.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_CONFIG_ALIGN_H
+#define CRYPTOPP_CONFIG_ALIGN_H
+
+#include "config_asm.h"  // CRYPTOPP_DISABLE_ASM
+#include "config_cpu.h"  // X86, X32, X64, ARM32, ARM64, etc
+#include "config_cxx.h"  // CRYPTOPP_CXX11_ALIGNAS
+#include "config_ver.h"  // Compiler versions
+
+// Nearly all Intel's and AMD's have SSE. Enable it independent of SSE ASM and intrinsics.
+// ARM NEON and ARMv8 ASIMD only need natural alignment of an element in the vector.
+// Altivec through POWER7 need vector alignment. POWER8 and POWER9 relax the requirement.
+#if defined(CRYPTOPP_DISABLE_ASM)
+	#define CRYPTOPP_BOOL_ALIGN16 0
+#elif (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64 || \
+       CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+	#define CRYPTOPP_BOOL_ALIGN16 1
+#else
+	#define CRYPTOPP_BOOL_ALIGN16 0
+#endif
+
+// How to allocate 16-byte aligned memory (for SSE2)
+// posix_memalign see https://forum.kde.org/viewtopic.php?p=66274
+#if defined(CRYPTOPP_MSC_VERSION)
+	#define CRYPTOPP_MM_MALLOC_AVAILABLE
+#elif defined(__linux__) || defined(__sun__) || defined(__CYGWIN__)
+	#define CRYPTOPP_MEMALIGN_AVAILABLE
+#elif defined(__APPLE__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
+	#define CRYPTOPP_MALLOC_ALIGNMENT_IS_16
+#elif (defined(_GNU_SOURCE) || ((_XOPEN_SOURCE + 0) >= 600)) && (_POSIX_ADVISORY_INFO > 0)
+	#define CRYPTOPP_POSIX_MEMALIGN_AVAILABLE
+#else
+	#define CRYPTOPP_NO_ALIGNED_ALLOC
+#endif
+
+// Sun Studio Express 3 (December 2006) provides GCC-style attributes.
+// IBM XL C/C++ alignment modifier per Optimization Guide, pp. 19-20.
+// __IBM_ATTRIBUTES per XLC 12.1 AIX Compiler Manual, p. 473.
+// CRYPTOPP_ALIGN_DATA may not be reliable on AIX.
+#if defined(CRYPTOPP_CXX11_ALIGNAS)
+	#define CRYPTOPP_ALIGN_DATA(x) alignas(x)
+#elif defined(CRYPTOPP_MSC_VERSION)
+	#define CRYPTOPP_ALIGN_DATA(x) __declspec(align(x))
+#elif defined(__GNUC__) || defined(__clang__) || (__SUNPRO_CC >= 0x5100)
+	#define CRYPTOPP_ALIGN_DATA(x) __attribute__((aligned(x)))
+#elif defined(__xlc__) || defined(__xlC__)
+	#define CRYPTOPP_ALIGN_DATA(x) __attribute__((aligned(x)))
+#else
+	#define CRYPTOPP_ALIGN_DATA(x)
+#endif
+
+#endif  // CRYPTOPP_CONFIG_ALIGN_H
diff --git a/runtime/third_party/cryptopp/config_asm.h b/runtime/third_party/cryptopp/config_asm.h
new file mode 100644
index 0000000..d5629c7
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_asm.h
@@ -0,0 +1,492 @@
+// config_asm.h - written and placed in public domain by Jeffrey Walton
+//                the bits that make up this source file are from the
+//                library's monolithic config.h.
+
+/// \file config_asm.h
+/// \brief Library configuration file
+/// \details <tt>config_asm.h</tt> provides defines for instruction set
+///  architectures
+///  and inline assembly.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_asm.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_CONFIG_ASM_H
+#define CRYPTOPP_CONFIG_ASM_H
+
+#include "config_os.h"
+#include "config_cpu.h"
+#include "config_ver.h"
+
+// Define this to disable ASM, intrinsics and built-ins. The library will be
+// compiled using C++ only. The library code will not include SSE2 (and
+// above), NEON, Aarch32, Aarch64, or Altivec (and above). Note the compiler
+// may use higher ISAs depending on compiler options, but the library will not
+// explicitly use the ISAs. When disabling ASM, it is best to do it from
+// config.h to ensure the library and all programs share the setting.
+// #define CRYPTOPP_DISABLE_ASM 1
+
+// https://github.com/weidai11/cryptopp/issues/719
+#if defined(__native_client__)
+# undef CRYPTOPP_DISABLE_ASM
+# define CRYPTOPP_DISABLE_ASM 1
+#endif
+
+// Some Clang and SunCC cannot handle mixed asm with positional arguments,
+// where the body is Intel style with no prefix and the templates are
+// AT&T style. Define this if the Makefile misdetects the configuration.
+// Also see https://bugs.llvm.org/show_bug.cgi?id=39895 .
+// #define CRYPTOPP_DISABLE_MIXED_ASM 1
+
+#if defined(__clang__) || (defined(__APPLE__) && defined(__GNUC__)) || defined(__SUNPRO_CC)
+# undef CRYPTOPP_DISABLE_MIXED_ASM
+# define CRYPTOPP_DISABLE_MIXED_ASM 1
+#endif
+
+// Define this if you need to disable Android advanced ISAs.
+// The problem is, Android-mk does not allow us to specify an
+// ISA option, like -maes or -march=armv8-a+crypto for AES.
+// Lack of an option results in a compile failure. To avoid
+// the compile failure, set this define. Also see
+// https://github.com/weidai11/cryptopp/issues/1015
+// CRYPTOPP_DISABLE_ANDROID_ADVANCED_ISA 1
+
+// ***************** IA32 CPU features ********************
+
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+
+// Apple Clang prior to 5.0 cannot handle SSE2
+#if defined(CRYPTOPP_APPLE_CLANG_VERSION) && (CRYPTOPP_APPLE_CLANG_VERSION < 50000)
+# define CRYPTOPP_DISABLE_ASM 1
+#endif
+
+// Sun Studio 12.1 provides GCC inline assembly
+// http://blogs.oracle.com/x86be/entry/gcc_style_asm_inlining_support
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC < 0x5100)
+# define CRYPTOPP_DISABLE_ASM 1
+#endif
+
+// Guard everything in CRYPTOPP_DISABLE_ASM
+#if !defined(CRYPTOPP_DISABLE_ASM)
+
+#if (defined(_MSC_VER) && defined(_M_IX86)) || ((defined(__GNUC__) && (defined(__i386__)) || defined(__x86_64__)))
+	// C++Builder 2010 does not allow "call label" where label is defined within inline assembly
+	#define CRYPTOPP_X86_ASM_AVAILABLE 1
+
+	#if !defined(CRYPTOPP_DISABLE_SSE2) && (defined(_MSC_VER) || CRYPTOPP_GCC_VERSION >= 30300 || defined(__SSE2__))
+		#define CRYPTOPP_SSE2_ASM_AVAILABLE 1
+	#endif
+
+	#if !defined(CRYPTOPP_DISABLE_SSSE3) && (_MSC_VER >= 1500 || CRYPTOPP_GCC_VERSION >= 40300 || defined(__SSSE3__))
+		#define CRYPTOPP_SSSE3_ASM_AVAILABLE 1
+	#endif
+#endif
+
+#if defined(_MSC_VER) && defined(_M_X64)
+	#define CRYPTOPP_X64_MASM_AVAILABLE 1
+#endif
+
+#if defined(__GNUC__) && defined(__x86_64__)
+	#define CRYPTOPP_X64_ASM_AVAILABLE 1
+#endif
+
+// 32-bit SunCC does not enable SSE2 by default.
+#if !defined(CRYPTOPP_DISABLE_SSE2) && (defined(CRYPTOPP_MSC_VERSION) || CRYPTOPP_GCC_VERSION >= 30300 || defined(__SSE2__) || (__SUNPRO_CC >= 0x5100))
+	#define CRYPTOPP_SSE2_INTRIN_AVAILABLE 1
+#endif
+
+#if !defined(CRYPTOPP_DISABLE_SSSE3)
+# if defined(__SSSE3__) || (CRYPTOPP_MSC_VERSION >= 1500) || \
+	(CRYPTOPP_GCC_VERSION >= 40300) || (__INTEL_COMPILER >= 1000) || (__SUNPRO_CC >= 0x5110) || \
+	(CRYPTOPP_LLVM_CLANG_VERSION >= 20300) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40000)
+	#define CRYPTOPP_SSSE3_AVAILABLE 1
+# endif
+#endif
+
+// Intrinsics available in GCC 4.3 (http://gcc.gnu.org/gcc-4.3/changes.html) and
+// MSVC 2008 (http://msdn.microsoft.com/en-us/library/bb892950%28v=vs.90%29.aspx)
+// SunCC could generate SSE4 at 12.1, but the intrinsics are missing until 12.4.
+#if !defined(CRYPTOPP_DISABLE_SSE4) && defined(CRYPTOPP_SSSE3_AVAILABLE) && \
+	(defined(__SSE4_1__) || (CRYPTOPP_MSC_VERSION >= 1500) || \
+	(CRYPTOPP_GCC_VERSION >= 40300) || (__INTEL_COMPILER >= 1000) || (__SUNPRO_CC >= 0x5110) || \
+	(CRYPTOPP_LLVM_CLANG_VERSION >= 20300) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40000))
+	#define CRYPTOPP_SSE41_AVAILABLE 1
+#endif
+
+#if !defined(CRYPTOPP_DISABLE_SSE4) && defined(CRYPTOPP_SSSE3_AVAILABLE) && \
+	(defined(__SSE4_2__) || (CRYPTOPP_MSC_VERSION >= 1500) || (__SUNPRO_CC >= 0x5110) || \
+	(CRYPTOPP_GCC_VERSION >= 40300) || (__INTEL_COMPILER >= 1000) || \
+	(CRYPTOPP_LLVM_CLANG_VERSION >= 20300) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40000))
+	#define CRYPTOPP_SSE42_AVAILABLE 1
+#endif
+
+// Couple to CRYPTOPP_DISABLE_AESNI, but use CRYPTOPP_CLMUL_AVAILABLE so we can selectively
+//  disable for misbehaving platforms and compilers, like Solaris or some Clang.
+#if defined(CRYPTOPP_DISABLE_AESNI)
+	#define CRYPTOPP_DISABLE_CLMUL 1
+#endif
+
+// Requires Sun Studio 12.3 (SunCC 0x5120) in theory.
+#if !defined(CRYPTOPP_DISABLE_CLMUL) && defined(CRYPTOPP_SSE42_AVAILABLE) && \
+	(defined(__PCLMUL__) || (_MSC_FULL_VER >= 150030729) || (__SUNPRO_CC >= 0x5120) || \
+	(CRYPTOPP_GCC_VERSION >= 40300) || (__INTEL_COMPILER >= 1110) || \
+	(CRYPTOPP_LLVM_CLANG_VERSION >= 30200) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40300))
+	#define CRYPTOPP_CLMUL_AVAILABLE 1
+#endif
+
+// Requires Sun Studio 12.3 (SunCC 0x5120)
+#if !defined(CRYPTOPP_DISABLE_AESNI) && defined(CRYPTOPP_SSE42_AVAILABLE) && \
+	(defined(__AES__) || (_MSC_FULL_VER >= 150030729) || (__SUNPRO_CC >= 0x5120) || \
+	(CRYPTOPP_GCC_VERSION >= 40300) || (__INTEL_COMPILER >= 1110) || \
+	(CRYPTOPP_LLVM_CLANG_VERSION >= 30200) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40300))
+	#define CRYPTOPP_AESNI_AVAILABLE 1
+#endif
+
+// Requires Binutils 2.24
+#if !defined(CRYPTOPP_DISABLE_AVX) && defined(CRYPTOPP_SSE42_AVAILABLE) && \
+	(defined(__AVX2__) || (CRYPTOPP_MSC_VERSION >= 1800) || (__SUNPRO_CC >= 0x5130) || \
+	(CRYPTOPP_GCC_VERSION >= 40700) || (__INTEL_COMPILER >= 1400) || \
+	(CRYPTOPP_LLVM_CLANG_VERSION >= 30100) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40600))
+#define CRYPTOPP_AVX_AVAILABLE 1
+#endif
+
+// Requires Binutils 2.24
+#if !defined(CRYPTOPP_DISABLE_AVX2) && defined(CRYPTOPP_AVX_AVAILABLE) && \
+	(defined(__AVX2__) || (CRYPTOPP_MSC_VERSION >= 1800) || (__SUNPRO_CC >= 0x5130) || \
+	(CRYPTOPP_GCC_VERSION >= 40900) || (__INTEL_COMPILER >= 1400) || \
+	(CRYPTOPP_LLVM_CLANG_VERSION >= 30100) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40600))
+#define CRYPTOPP_AVX2_AVAILABLE 1
+#endif
+
+// Guessing at SHA for SunCC. Its not in Sun Studio 12.6. Also see
+// http://stackoverflow.com/questions/45872180/which-xarch-for-sha-extensions-on-solaris
+// Guessing for Intel ICPC. A slide deck says SHA support is in version 16.0-beta
+// https://www.alcf.anl.gov/files/ken_intel_compiler_optimization.pdf
+#if !defined(CRYPTOPP_DISABLE_SHANI) && defined(CRYPTOPP_SSE42_AVAILABLE) && \
+	(defined(__SHA__) || (CRYPTOPP_MSC_VERSION >= 1900) || (__SUNPRO_CC >= 0x5160) || \
+	(CRYPTOPP_GCC_VERSION >= 40900) || (__INTEL_COMPILER >= 1600) || \
+	(CRYPTOPP_LLVM_CLANG_VERSION >= 30400) || (CRYPTOPP_APPLE_CLANG_VERSION >= 50100))
+	#define CRYPTOPP_SHANI_AVAILABLE 1
+#endif
+
+// RDRAND uses byte codes. All we need is x86 ASM for it.
+// However tie it to AES-NI since SecureKey was available with it.
+#if !defined(CRYPTOPP_DISABLE_RDRAND) && defined(CRYPTOPP_AESNI_AVAILABLE)
+	#define CRYPTOPP_RDRAND_AVAILABLE 1
+#endif
+
+// RDSEED uses byte codes. All we need is x86 ASM for it.
+// However tie it to AES-NI since SecureKey was available with it.
+#if !defined(CRYPTOPP_DISABLE_RDSEED) && defined(CRYPTOPP_AESNI_AVAILABLE)
+	#define CRYPTOPP_RDSEED_AVAILABLE 1
+#endif
+
+// PadlockRNG uses byte codes. All we need is x86 ASM for it.
+#if !defined(CRYPTOPP_DISABLE_PADLOCK) && \
+	!(defined(__ANDROID__) || defined(ANDROID) || defined(__APPLE__)) && \
+	defined(CRYPTOPP_X86_ASM_AVAILABLE)
+	#define CRYPTOPP_PADLOCK_AVAILABLE 1
+	#define CRYPTOPP_PADLOCK_RNG_AVAILABLE 1
+	#define CRYPTOPP_PADLOCK_ACE_AVAILABLE 1
+	#define CRYPTOPP_PADLOCK_ACE2_AVAILABLE 1
+	#define CRYPTOPP_PADLOCK_PHE_AVAILABLE 1
+	#define CRYPTOPP_PADLOCK_PMM_AVAILABLE 1
+#endif
+
+// Fixup for SunCC 12.1-12.4. Bad code generation in AES_Encrypt and friends.
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x5130)
+# undef CRYPTOPP_AESNI_AVAILABLE
+#endif
+
+// Fixup for SunCC 12.1-12.6. Compiler crash on GCM_Reduce_CLMUL.
+// http://github.com/weidai11/cryptopp/issues/226
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x5150)
+# undef CRYPTOPP_CLMUL_AVAILABLE
+#endif
+
+// Clang intrinsic casts, http://bugs.llvm.org/show_bug.cgi?id=20670
+#define M128_CAST(x) ((__m128i *)(void *)(x))
+#define CONST_M128_CAST(x) ((const __m128i *)(const void *)(x))
+#define M256_CAST(x) ((__m256i *)(void *)(x))
+#define CONST_M256_CAST(x) ((const __m256i *)(const void *)(x))
+
+#endif  // CRYPTOPP_DISABLE_ASM
+
+#endif  // X86, X32, X64
+
+// ***************** ARM CPU features ********************
+
+#if (CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8)
+
+// We don't have an ARM big endian test rig. Disable
+// ARM-BE ASM and instrinsics until we can test it.
+#if (CRYPTOPP_BIG_ENDIAN)
+# define CRYPTOPP_DISABLE_ASM 1
+#endif
+
+// Guard everything in CRYPTOPP_DISABLE_ASM
+#if !defined(CRYPTOPP_DISABLE_ASM)
+
+// Requires ACLE 1.0. -mfpu=neon or above must be present
+// Requires GCC 4.3, Clang 2.8 or Visual Studio 2012
+// Do not use APPLE_CLANG_VERSION; use __ARM_FEATURE_XXX instead.
+#if !defined(CRYPTOPP_ARM_NEON_AVAILABLE) && !defined(CRYPTOPP_DISABLE_ARM_NEON)
+# if defined(__arm__) || defined(__ARM_NEON) || defined(__ARM_FEATURE_NEON) || defined(_M_ARM)
+#  if (CRYPTOPP_GCC_VERSION >= 40300) || (CRYPTOPP_LLVM_CLANG_VERSION >= 20800) || \
+      (CRYPTOPP_APPLE_CLANG_VERSION >= 30200) || (CRYPTOPP_MSC_VERSION >= 1700)
+#   define CRYPTOPP_ARM_NEON_AVAILABLE 1
+#  endif  // Compilers
+# endif  // Platforms
+#endif
+
+// ARMv8 and ASIMD. -march=armv8-a or above must be present
+// Requires GCC 4.8, Clang 3.3 or Visual Studio 2017
+// Do not use APPLE_CLANG_VERSION; use __ARM_FEATURE_XXX instead.
+#if !defined(CRYPTOPP_ARM_ASIMD_AVAILABLE) && !defined(CRYPTOPP_DISABLE_ARM_ASIMD)
+# if defined(__aarch32__) || defined(__aarch64__) || defined(__arm64__) || defined(_M_ARM64)
+#  if defined(__ARM_NEON) || defined(__ARM_ASIMD) || defined(__ARM_FEATURE_NEON) || defined(__ARM_FEATURE_ASIMD) || \
+      (CRYPTOPP_GCC_VERSION >= 40800) || (CRYPTOPP_LLVM_CLANG_VERSION >= 30300) || \
+      (CRYPTOPP_APPLE_CLANG_VERSION >= 40000) || (CRYPTOPP_MSC_VERSION >= 1916)
+#   define CRYPTOPP_ARM_NEON_AVAILABLE 1
+#   define CRYPTOPP_ARM_ASIMD_AVAILABLE 1
+#  endif  // Compilers
+# endif  // Platforms
+#endif
+
+// ARMv8 and ASIMD. -march=armv8-a+crc or above must be present
+// Requires GCC 4.8, Clang 3.3 or Visual Studio 2017
+#if !defined(CRYPTOPP_ARM_CRC32_AVAILABLE) && !defined(CRYPTOPP_DISABLE_ARM_CRC32)
+# if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+#  if defined(__ARM_FEATURE_CRC32) || (CRYPTOPP_GCC_VERSION >= 40800) || \
+      (CRYPTOPP_LLVM_CLANG_VERSION >= 30300) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40300) || \
+      (CRYPTOPP_MSC_VERSION >= 1916)
+#   define CRYPTOPP_ARM_CRC32_AVAILABLE 1
+#  endif  // Compilers
+# endif  // Platforms
+#endif
+
+// ARMv8 and AES. -march=armv8-a+crypto or above must be present
+// Requires GCC 4.8, Clang 3.3 or Visual Studio 2017
+#if !defined(CRYPTOPP_ARM_AES_AVAILABLE) && !defined(CRYPTOPP_DISABLE_ARM_AES)
+# if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+#  if defined(__ARM_FEATURE_CRYPTO) || (CRYPTOPP_GCC_VERSION >= 40800) || \
+      (CRYPTOPP_LLVM_CLANG_VERSION >= 30300) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40300) || \
+      (CRYPTOPP_MSC_VERSION >= 1916)
+#   define CRYPTOPP_ARM_AES_AVAILABLE 1
+#  endif  // Compilers
+# endif  // Platforms
+#endif
+
+// ARMv8 and PMULL. -march=armv8-a+crypto or above must be present
+// Requires GCC 4.8, Clang 3.3 or Visual Studio 2017
+#if !defined(CRYPTOPP_ARM_PMULL_AVAILABLE) && !defined(CRYPTOPP_DISABLE_ARM_PMULL)
+# if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+#  if defined(__ARM_FEATURE_CRYPTO) || (CRYPTOPP_GCC_VERSION >= 40800) || \
+      (CRYPTOPP_LLVM_CLANG_VERSION >= 30300) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40300) || \
+      (CRYPTOPP_MSC_VERSION >= 1916)
+#   define CRYPTOPP_ARM_PMULL_AVAILABLE 1
+#  endif  // Compilers
+# endif  // Platforms
+#endif
+
+// ARMv8 and SHA-1, SHA-256. -march=armv8-a+crypto or above must be present
+// Requires GCC 4.8, Clang 3.3 or Visual Studio 2017
+#if !defined(CRYPTOPP_ARM_SHA_AVAILABLE) && !defined(CRYPTOPP_DISABLE_ARM_SHA)
+# if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+#  if defined(__ARM_FEATURE_CRYPTO) || (CRYPTOPP_GCC_VERSION >= 40800) || \
+      (CRYPTOPP_LLVM_CLANG_VERSION >= 30300) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40300) || \
+      (CRYPTOPP_MSC_VERSION >= 1916)
+#   define CRYPTOPP_ARM_SHA1_AVAILABLE 1
+#   define CRYPTOPP_ARM_SHA2_AVAILABLE 1
+#  endif  // Compilers
+# endif  // Platforms
+#endif
+
+// Buggy Microsoft compiler, https://github.com/weidai11/cryptopp/issues/1096
+#if defined(CRYPTOPP_MSC_VERSION)
+# undef CRYPTOPP_ARM_SHA1_AVAILABLE
+# undef CRYPTOPP_ARM_SHA2_AVAILABLE
+#endif
+
+// ARMv8 and SHA-512, SHA-3. -march=armv8.2-a+crypto or above must be present
+// Requires GCC 8.0, Clang 11.0, Apple Clang 12.0 or Visual Studio 20??
+#if !defined(CRYPTOPP_ARM_SHA3_AVAILABLE) && !defined(CRYPTOPP_DISABLE_ARM_SHA)
+# if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+#  if defined(__ARM_FEATURE_SHA3) || (CRYPTOPP_GCC_VERSION >= 80000) || \
+      (CRYPTOPP_APPLE_CLANG_VERSION >= 120000) || (CRYPTOPP_LLVM_CLANG_VERSION >= 110000)
+#   define CRYPTOPP_ARM_SHA512_AVAILABLE 1
+#   define CRYPTOPP_ARM_SHA3_AVAILABLE 1
+#  endif  // Compilers
+# endif  // Platforms
+#endif
+
+// ARMv8 and SM3, SM4. -march=armv8.2-a+crypto or above must be present
+// Requires GCC 8.0, Clang ??? or Visual Studio 20??
+// Do not use APPLE_CLANG_VERSION; use __ARM_FEATURE_XXX instead.
+#if !defined(CRYPTOPP_ARM_SM3_AVAILABLE) && !defined(CRYPTOPP_DISABLE_ARM_SM3)
+# if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+#  if defined(__ARM_FEATURE_SM3) || (CRYPTOPP_GCC_VERSION >= 80000)
+#   define CRYPTOPP_ARM_SM3_AVAILABLE 1
+#   define CRYPTOPP_ARM_SM4_AVAILABLE 1
+#  endif  // Compilers
+# endif  // Platforms
+#endif
+
+// Limit the <arm_neon.h> include.
+#if !defined(CRYPTOPP_ARM_NEON_HEADER)
+# if defined(CRYPTOPP_ARM_NEON_AVAILABLE) || defined (CRYPTOPP_ARM_ASIMD_AVAILABLE)
+#  if !defined(_M_ARM64)
+#   define CRYPTOPP_ARM_NEON_HEADER 1
+#  endif
+# endif
+#endif
+
+// Limit the <arm_acle.h> include.
+#if !defined(CRYPTOPP_ARM_ACLE_HEADER)
+# if defined(__aarch32__) || defined(__aarch64__) || (__ARM_ARCH >= 8) || defined(__ARM_ACLE)
+#  define CRYPTOPP_ARM_ACLE_HEADER 1
+# endif
+#endif
+
+// Apple M1 hack. Xcode cross-compiles for iOS lack
+// arm_acle.h. Apple M1 needs arm_acle.h. The problem
+// in practice is, we can't get CRYPTOPP_ARM_ACLE_HEADER
+// quite right based on ARM preprocessor macros.
+#if defined(__APPLE__) && !defined(__ARM_FEATURE_CRC32)
+# undef CRYPTOPP_ARM_ACLE_HEADER
+#endif
+
+// Cryptogams offers an ARM asm implementations for AES and SHA. Crypto++ does
+// not provide an asm implementation. The Cryptogams AES implementation is
+// about 50% faster than C/C++, and SHA implementation is about 30% faster
+// than C/C++. Define this to use the Cryptogams AES and SHA implementations
+// on GNU Linux systems. When defined, Crypto++ will use aes_armv4.S,
+// sha1_armv4.S and sha256_armv4.S. https://www.cryptopp.com/wiki/Cryptogams.
+#if !defined(CRYPTOPP_DISABLE_ARM_NEON)
+# if defined(__arm__) && defined(__linux__)
+#  if defined(__GNUC__) || defined(__clang__)
+#   define CRYPTOGAMS_ARM_AES      1
+#   define CRYPTOGAMS_ARM_SHA1     1
+#   define CRYPTOGAMS_ARM_SHA256   1
+#   define CRYPTOGAMS_ARM_SHA512   1
+#  endif
+# endif
+#endif
+
+// We are still having trouble with integrating Cryptogams AES. Ugh...
+// https://github.com/weidai11/cryptopp/issues/1236
+#undef CRYPTOGAMS_ARM_AES
+
+// Clang intrinsic casts, http://bugs.llvm.org/show_bug.cgi?id=20670
+#define UINT64_CAST(x) ((uint64_t *)(void *)(x))
+#define CONST_UINT64_CAST(x) ((const uint64_t *)(const void *)(x))
+
+#endif  // CRYPTOPP_DISABLE_ASM
+
+#endif  // ARM32, ARM64
+
+// ***************** AltiVec and Power8 ********************
+
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+
+// Guard everything in CRYPTOPP_DISABLE_ASM
+#if !defined(CRYPTOPP_DISABLE_ASM) && !defined(CRYPTOPP_DISABLE_ALTIVEC)
+
+// An old Apple G5 with GCC 4.01 has AltiVec, but its only Power4 or so.
+#if !defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+# if defined(_ARCH_PWR4) || defined(__ALTIVEC__) || \
+	(CRYPTOPP_XLC_VERSION >= 100000) || (CRYPTOPP_GCC_VERSION >= 40001) || \
+    (CRYPTOPP_LLVM_CLANG_VERSION >= 20900)
+#  define CRYPTOPP_ALTIVEC_AVAILABLE 1
+# endif
+#endif
+
+#if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+
+// We need Power7 for unaligned loads and stores
+#if !defined(CRYPTOPP_POWER7_AVAILABLE) && !defined(CRYPTOPP_DISABLE_POWER7)
+# if defined(_ARCH_PWR7) || (CRYPTOPP_XLC_VERSION >= 100000) || \
+    (CRYPTOPP_GCC_VERSION >= 40100) || (CRYPTOPP_LLVM_CLANG_VERSION >= 30100)
+#  define CRYPTOPP_POWER7_AVAILABLE 1
+# endif
+#endif
+
+#if defined(CRYPTOPP_POWER7_AVAILABLE)
+
+// We need Power8 for in-core crypto and 64-bit vector types
+#if !defined(CRYPTOPP_POWER8_AVAILABLE) && !defined(CRYPTOPP_DISABLE_POWER8)
+# if defined(_ARCH_PWR8) || (CRYPTOPP_XLC_VERSION >= 130000) || \
+    (CRYPTOPP_GCC_VERSION >= 40800) || (CRYPTOPP_LLVM_CLANG_VERSION >= 70000)
+#  define CRYPTOPP_POWER8_AVAILABLE 1
+# endif
+#endif
+
+#if !defined(CRYPTOPP_POWER8_AES_AVAILABLE) && !defined(CRYPTOPP_DISABLE_POWER8_AES) && defined(CRYPTOPP_POWER8_AVAILABLE)
+# if defined(__CRYPTO__) || defined(_ARCH_PWR8) || (CRYPTOPP_XLC_VERSION >= 130000) || \
+    (CRYPTOPP_GCC_VERSION >= 40800) || (CRYPTOPP_LLVM_CLANG_VERSION >= 70000)
+//#  define CRYPTOPP_POWER8_CRC_AVAILABLE 1
+#  define CRYPTOPP_POWER8_AES_AVAILABLE 1
+#  define CRYPTOPP_POWER8_VMULL_AVAILABLE 1
+#  define CRYPTOPP_POWER8_SHA_AVAILABLE 1
+# endif
+#endif
+
+#if defined(CRYPTOPP_POWER8_AVAILABLE)
+
+// Power9 for random numbers
+#if !defined(CRYPTOPP_POWER9_AVAILABLE) && !defined(CRYPTOPP_DISABLE_POWER9)
+# if defined(_ARCH_PWR9) || (CRYPTOPP_XLC_VERSION >= 130200) || \
+    (CRYPTOPP_GCC_VERSION >= 70000) || (CRYPTOPP_LLVM_CLANG_VERSION >= 80000)
+#  define CRYPTOPP_POWER9_AVAILABLE 1
+# endif
+#endif
+
+#endif  // CRYPTOPP_POWER8_AVAILABLE
+#endif  // CRYPTOPP_POWER7_AVAILABLE
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+#endif  // CRYPTOPP_DISABLE_ASM
+#endif  // PPC32, PPC64
+
+// https://github.com/weidai11/cryptopp/issues/1015
+#if defined(CRYPTOPP_DISABLE_ANDROID_ADVANCED_ISA)
+# if defined(__ANDROID__) || defined(ANDROID)
+#  if (CRYPTOPP_BOOL_X86)
+#   undef CRYPTOPP_SSE41_AVAILABLE
+#   undef CRYPTOPP_SSE42_AVAILABLE
+#   undef CRYPTOPP_CLMUL_AVAILABLE
+#   undef CRYPTOPP_AESNI_AVAILABLE
+#   undef CRYPTOPP_SHANI_AVAILABLE
+#   undef CRYPTOPP_RDRAND_AVAILABLE
+#   undef CRYPTOPP_RDSEED_AVAILABLE
+#   undef CRYPTOPP_AVX_AVAILABLE
+#   undef CRYPTOPP_AVX2_AVAILABLE
+#  endif
+#  if (CRYPTOPP_BOOL_X64)
+#   undef CRYPTOPP_CLMUL_AVAILABLE
+#   undef CRYPTOPP_AESNI_AVAILABLE
+#   undef CRYPTOPP_SHANI_AVAILABLE
+#   undef CRYPTOPP_RDRAND_AVAILABLE
+#   undef CRYPTOPP_RDSEED_AVAILABLE
+#   undef CRYPTOPP_AVX_AVAILABLE
+#   undef CRYPTOPP_AVX2_AVAILABLE
+#  endif
+#  if (CRYPTOPP_BOOL_ARMV8)
+#   undef CRYPTOPP_ARM_CRC32_AVAILABLE
+#   undef CRYPTOPP_ARM_PMULL_AVAILABLE
+#   undef CRYPTOPP_ARM_AES_AVAILABLE
+#   undef CRYPTOPP_ARM_SHA1_AVAILABLE
+#   undef CRYPTOPP_ARM_SHA2_AVAILABLE
+#  endif
+# endif  // ANDROID
+#endif   // CRYPTOPP_DISABLE_ANDROID_ADVANCED_ISA
+
+#endif  // CRYPTOPP_CONFIG_ASM_H
diff --git a/runtime/third_party/cryptopp/config_cpu.h b/runtime/third_party/cryptopp/config_cpu.h
new file mode 100644
index 0000000..4020b1b
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_cpu.h
@@ -0,0 +1,212 @@
+// config_cpu.h - written and placed in public domain by Jeffrey Walton
+//                the bits that make up this source file are from the
+//                library's monolithic config.h.
+
+/// \file config_cpu.h
+/// \brief Library configuration file
+/// \details <tt>config_cpu.h</tt> provides defines for the cpu and machine
+///  architecture.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_cpu.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki,
+///  <A HREF="https://sourceforge.net/p/predef/wiki/Architectures/">Sourceforge
+///  Pre-defined Compiler Macros</A>
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_CONFIG_CPU_H
+#define CRYPTOPP_CONFIG_CPU_H
+
+#include "config_ver.h"
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief 32-bit x32 platform
+	/// \details CRYPTOPP_BOOL_X32 is defined to 1 when building the library
+	///  for a 32-bit x32 platform. Otherwise, the macro is not defined.
+	/// \details x32 is sometimes referred to as x86_32. x32 is the ILP32 data
+	///  model on a 64-bit cpu. Integers, longs and pointers are 32-bit but the
+	///  program runs on a 64-bit cpu.
+	/// \details The significance of x32 is, inline assembly must operate on
+	///  64-bit registers, not 32-bit registers. That means, for example,
+	///  function prologues and epilogues must push and pop RSP, not ESP.
+	/// \note: Clang defines __ILP32__ on any 32-bit platform. Therefore,
+	///  CRYPTOPP_BOOL_X32 depends upon both __ILP32__ and __x86_64__.
+	/// \sa <A HREF="https://wiki.debian.org/X32Port">Debian X32 Port</A>,
+	///  <A HREF="https://wiki.gentoo.org/wiki/Project:Multilib/Concepts">Gentoo
+	///  Multilib Concepts</A>
+	#define CRYPTOPP_BOOL_X32 ...
+	/// \brief 32-bit x86 platform
+	/// \details CRYPTOPP_BOOL_X64 is defined to 1 when building the library
+	///  for a 64-bit x64 platform. Otherwise, the macro is not defined.
+	#define CRYPTOPP_BOOL_X64 ...
+	/// \brief 32-bit x86 platform
+	/// \details CRYPTOPP_BOOL_X86 is defined to 1 when building the library
+	///  for a 32-bit x86 platform. Otherwise, the macro is not defined.
+	#define CRYPTOPP_BOOL_X86 ...
+#elif (defined(__ILP32__) || defined(_ILP32)) && defined(__x86_64__)
+	#define CRYPTOPP_BOOL_X32 1
+#elif (defined(_M_X64) || defined(__x86_64__))
+	#define CRYPTOPP_BOOL_X64 1
+#elif (defined(_M_IX86) || defined(__i386__) || defined(__i386) || defined(_X86_) || defined(__I86__) || defined(__INTEL__))
+	#define CRYPTOPP_BOOL_X86 1
+#endif
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief ARMv8 platform
+	/// \details CRYPTOPP_BOOL_ARMV8 is defined to 1 when building the library
+	///  for an ARMv8 platform. Otherwise, the macro is not defined.
+	/// \details ARMv8 includes both Aarch32 and Aarch64. Aarch32 is a 32-bit
+	///  execution environment on Aarch64.
+	#define CRYPTOPP_BOOL_ARMV8 ...
+	/// \brief 64-bit ARM platform
+	/// \details CRYPTOPP_BOOL_ARM64 is defined to 1 when building the library
+	///  for a 64-bit x64 platform. Otherwise, the macro is not defined.
+	/// \details Currently the macro indicates an ARM 64-bit architecture.
+	#define CRYPTOPP_BOOL_ARM64 ...
+	/// \brief 32-bit ARM platform
+	/// \details CRYPTOPP_BOOL_ARM32 is defined to 1 when building the library
+	///  for a 32-bit ARM platform. Otherwise, the macro is not defined.
+	/// \details Currently the macro indicates an ARM A-32 architecture.
+	#define CRYPTOPP_BOOL_ARM32 ...
+#elif defined(__arm64__) || defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+	// Microsoft added ARM64 define December 2017.
+	#define CRYPTOPP_BOOL_ARMV8 1
+#endif
+#if defined(__arm64__) || defined(__aarch64__) || defined(_M_ARM64)
+	#define CRYPTOPP_BOOL_ARM64 1
+#elif defined(__arm__) || defined(_M_ARM)
+	#define CRYPTOPP_BOOL_ARM32 1
+#endif
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief 64-bit PowerPC platform
+	/// \details CRYPTOPP_BOOL_PPC64 is defined to 1 when building the library
+	///  for a 64-bit PowerPC platform. Otherwise, the macro is not defined.
+	#define CRYPTOPP_BOOL_PPC64 ...
+	/// \brief 32-bit PowerPC platform
+	/// \details CRYPTOPP_BOOL_PPC32 is defined to 1 when building the library
+	///  for a 32-bit PowerPC platform. Otherwise, the macro is not defined.
+	#define CRYPTOPP_BOOL_PPC32 ...
+#elif defined(__ppc64__) || defined(__powerpc64__) || defined(__PPC64__) || defined(_ARCH_PPC64)
+	#define CRYPTOPP_BOOL_PPC64 1
+#elif defined(__powerpc__) || defined(__ppc__) || defined(__PPC__) || defined(_ARCH_PPC)
+	#define CRYPTOPP_BOOL_PPC32 1
+#endif
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief 64-bit MIPS platform
+	/// \details CRYPTOPP_BOOL_MIPS64 is defined to 1 when building the library
+	///  for a 64-bit MIPS platform. Otherwise, the macro is not defined.
+	#define CRYPTOPP_BOOL_MIPS64 ...
+	/// \brief 64-bit MIPS platform
+	/// \details CRYPTOPP_BOOL_MIPS32 is defined to 1 when building the library
+	///  for a 32-bit MIPS platform. Otherwise, the macro is not defined.
+	#define CRYPTOPP_BOOL_MIPS32 ...
+#elif defined(__mips64__)
+	#define CRYPTOPP_BOOL_MIPS64 1
+#elif defined(__mips__)
+	#define CRYPTOPP_BOOL_MIPS32 1
+#endif
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief 64-bit SPARC platform
+	/// \details CRYPTOPP_BOOL_SPARC64 is defined to 1 when building the library
+	///  for a 64-bit SPARC platform. Otherwise, the macro is not defined.
+	#define CRYPTOPP_BOOL_SPARC64 ...
+	/// \brief 32-bit SPARC platform
+	/// \details CRYPTOPP_BOOL_SPARC32 is defined to 1 when building the library
+	///  for a 32-bit SPARC platform. Otherwise, the macro is not defined.
+	#define CRYPTOPP_BOOL_SPARC32 ...
+#elif defined(__sparc64__) || defined(__sparc64) || defined(__sparcv9) || defined(__sparc_v9__)
+	#define CRYPTOPP_BOOL_SPARC64 1
+#elif defined(__sparc__) || defined(__sparc) || defined(__sparcv8) || defined(__sparc_v8__)
+	#define CRYPTOPP_BOOL_SPARC32 1
+#endif
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief L1 data cache line size
+	/// \details CRYPTOPP_L1_CACHE_LINE_SIZE should be a lower bound on the L1
+	///  data cache line size. It is used for defense against some timing attacks.
+	/// \details CRYPTOPP_L1_CACHE_LINE_SIZE default value on 32-bit platforms
+	///  is 32, and the default value on 64-bit platforms is 64. On PowerPC the
+	///  default value is 128 since all PowerPC cpu's starting at PPC 970 provide
+	///  it.
+	/// \note The runtime library on some PowerPC platforms misreport the size
+	///  of the cache line size. The runtime library reports 64, while the cpu
+	///  has a cache line size of 128.
+	/// \sa <A HREF="https://bugs.centos.org/view.php?id=14599">CentOS Issue
+	///  14599: sysconf(_SC_LEVEL1_DCACHE_LINESIZE) returns 0 instead of 128</A>
+	/// \since Crypto++ 5.3
+	#define CRYPTOPP_L1_CACHE_LINE_SIZE ...
+#else
+	#ifndef CRYPTOPP_L1_CACHE_LINE_SIZE
+		#if defined(CRYPTOPP_BOOL_X32) || defined(CRYPTOPP_BOOL_X64) || defined(CRYPTOPP_BOOL_ARMV8) || \
+		    defined(CRYPTOPP_BOOL_MIPS64) || defined(CRYPTOPP_BOOL_SPARC64)
+			#define CRYPTOPP_L1_CACHE_LINE_SIZE 64
+		#elif defined(CRYPTOPP_BOOL_PPC32) || defined(CRYPTOPP_BOOL_PPC64)
+			// http://lists.llvm.org/pipermail/llvm-dev/2017-March/110982.html
+			#define CRYPTOPP_L1_CACHE_LINE_SIZE 128
+		#else
+			// L1 cache line size is 32 on Pentium III and earlier
+			#define CRYPTOPP_L1_CACHE_LINE_SIZE 32
+		#endif
+	#endif
+#endif
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief Initialized data section
+	/// \details CRYPTOPP_SECTION_INIT is added to variables to place them in the
+	///  initialized data section (sometimes denoted <tt>.data</tt>). The placement
+	///  helps avoid "uninitialized variable" warnings from Valgrind and other tools.
+	#define CRYPTOPP_SECTION_INIT ...
+#else
+	// The section attribute attempts to initialize CPU flags to avoid Valgrind findings above -O1
+	#if ((defined(__MACH__) && defined(__APPLE__)) && ((CRYPTOPP_LLVM_CLANG_VERSION >= 30600) || \
+	    (CRYPTOPP_APPLE_CLANG_VERSION >= 70100) || (CRYPTOPP_GCC_VERSION >= 40300)))
+		#define CRYPTOPP_SECTION_INIT __attribute__((section ("__DATA,__data")))
+	#elif (defined(__ELF__) && (CRYPTOPP_GCC_VERSION >= 40300))
+		#define CRYPTOPP_SECTION_INIT __attribute__((section ("nocommon")))
+	#elif defined(__ELF__) && (defined(__xlC__) || defined(__ibmxl__))
+		#define CRYPTOPP_SECTION_INIT __attribute__((section ("nocommon")))
+	#else
+		#define CRYPTOPP_SECTION_INIT
+	#endif
+#endif
+
+// How to disable CPU feature probing. We determine machine
+// capabilities by performing an os/platform *query* first,
+// like getauxv(). If the *query* fails, we move onto a
+// cpu *probe*. The cpu *probe* tries to exeute an instruction
+// and then catches a SIGILL on Linux or the exception
+// EXCEPTION_ILLEGAL_INSTRUCTION on Windows. Some OSes
+// fail to hangle a SIGILL gracefully, like Apple OSes. Apple
+// machines corrupt memory and variables around the probe.
+#if defined(__APPLE__)
+	#define CRYPTOPP_NO_CPU_FEATURE_PROBES 1
+#endif
+
+// Flavor of inline assembly language
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief Microsoft style inline assembly
+	/// \details CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY is defined when either
+	///  <tt>_MSC_VER</tt> or <tt>__BORLANDC__</tt> are defined.
+	#define CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY ...
+	/// \brief GNU style inline assembly
+	/// \details CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY is defined when neither
+	///  <tt>_MSC_VER</tt> nor <tt>__BORLANDC__</tt> are defined.
+	#define CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY ...
+#elif defined(CRYPTOPP_MSC_VERSION) || defined(__BORLANDC__) || \
+	(defined(CRYPTOPP_WIN32_AVAILABLE) && defined(CRYPTOPP_LLVM_CLANG_VERSION))
+	#define CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY 1
+#else
+	#define CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY 1
+#endif
+
+#endif  // CRYPTOPP_CONFIG_CPU_H
diff --git a/runtime/third_party/cryptopp/config_cxx.h b/runtime/third_party/cryptopp/config_cxx.h
new file mode 100644
index 0000000..ffd57ad
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_cxx.h
@@ -0,0 +1,250 @@
+// config_cxx.h - written and placed in public domain by Jeffrey Walton
+//                the bits that make up this source file are from the
+//                library's monolithic config.h.
+
+/// \file config_cxx.h
+/// \brief Library configuration file
+/// \details <tt>config_cxx.h</tt> provides defines for C++ language and
+///  runtime library
+///  features.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_cxx.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+// Visual Studio began at VS2010, http://msdn.microsoft.com/en-us/library/hh567368%28v=vs.110%29.aspx
+//   and https://docs.microsoft.com/en-us/cpp/visual-cpp-language-conformance
+// Intel, http://software.intel.com/en-us/articles/c0x-features-supported-by-intel-c-compiler
+// GCC, http://gcc.gnu.org/projects/cxx0x.html
+// Clang, http://clang.llvm.org/cxx_status.html
+
+#ifndef CRYPTOPP_CONFIG_CXX_H
+#define CRYPTOPP_CONFIG_CXX_H
+
+#include "config_os.h"
+#include "config_cpu.h"
+#include "config_ver.h"
+
+// https://github.com/weidai11/cryptopp/issues/960
+#include <string>
+#include <exception>
+
+// You may need to force include a C++ header on Android when using STLPort
+// to ensure _STLPORT_VERSION is defined
+#if (defined(CRYPTOPP_MSC_VERSION) && CRYPTOPP_MSC_VERSION <= 1300) || \
+	defined(__MWERKS__) || \
+	(defined(_STLPORT_VERSION) && ((_STLPORT_VERSION < 0x450) || defined(_STLP_NO_UNCAUGHT_EXCEPT_SUPPORT)) || \
+	(__cplusplus >= 202002L))
+#define CRYPTOPP_DISABLE_UNCAUGHT_EXCEPTION
+#endif
+
+// Ancient Crypto++ define, dating back to C++98.
+#ifndef CRYPTOPP_DISABLE_UNCAUGHT_EXCEPTION
+# define CRYPTOPP_UNCAUGHT_EXCEPTION_AVAILABLE 1
+# define CRYPTOPP_CXX98_UNCAUGHT_EXCEPTION 1
+#endif
+
+// Compatibility with non-clang compilers.
+#ifndef __has_feature
+# define __has_feature(x) 0
+#endif
+
+// C++11 macro version, https://stackoverflow.com/q/7223991/608639
+#if ((CRYPTOPP_MSC_VERSION >= 1600) || (__cplusplus >= 201103L)) && !defined(_STLPORT_VERSION)
+#  define CRYPTOPP_CXX11 1
+#endif
+
+// Hack ahead. Apple's standard library does not have C++'s unique_ptr in C++11.
+// We can't test for unique_ptr directly because some of the non-Apple Clangs
+// on OS X fail the same way. However, modern standard libraries have
+// <forward_list>, so we test for it instead. Thanks to Jonathan Wakely for
+// devising the clever test for modern/ancient versions. TODO: test under
+// Xcode 3, where g++ is really g++.
+#if defined(__APPLE__) && defined(__clang__)
+#  if !(defined(__has_include) && __has_include(<forward_list>))
+#    undef CRYPTOPP_CXX11
+#  endif
+#endif
+
+// C++14 macro version, https://stackoverflow.com/q/26089319/608639
+#if defined(CRYPTOPP_CXX11) && !defined(CRYPTOPP_NO_CXX14)
+#  if ((CRYPTOPP_MSC_VERSION >= 1900) || (__cplusplus >= 201402L)) && !defined(_STLPORT_VERSION)
+#    define CRYPTOPP_CXX14 1
+#  endif
+#endif
+
+// C++17 macro version, https://stackoverflow.com/q/38456127/608639
+#if defined(CRYPTOPP_CXX14) && !defined(CRYPTOPP_NO_CXX17)
+#  if ((CRYPTOPP_MSC_VERSION >= 1900) || (__cplusplus >= 201703L)) && !defined(_STLPORT_VERSION)
+#    define CRYPTOPP_CXX17 1
+#  endif
+#endif
+
+// ***************** C++11 and above ********************
+
+#if defined(CRYPTOPP_CXX11)
+
+// atomics: MS at VS2012 (17.00); GCC at 4.4; Clang at 3.1/3.2; Intel 13.0; SunCC 5.14.
+#if (CRYPTOPP_MSC_VERSION >= 1700) || __has_feature(cxx_atomic) || \
+	(__INTEL_COMPILER >= 1300) || (CRYPTOPP_GCC_VERSION >= 40400) || (__SUNPRO_CC >= 0x5140)
+# define CRYPTOPP_CXX11_ATOMIC 1
+#endif // atomics
+
+// synchronization: MS at VS2012 (17.00); GCC at 4.4; Clang at 3.3; Xcode 5.0; Intel 12.0; SunCC 5.13.
+// TODO: verify Clang and Intel versions; find __has_feature(x) extension for Clang
+#if (CRYPTOPP_MSC_VERSION >= 1700) || (CRYPTOPP_LLVM_CLANG_VERSION >= 30300) || \
+	(CRYPTOPP_APPLE_CLANG_VERSION >= 50000) || (__INTEL_COMPILER >= 1200) || \
+	(CRYPTOPP_GCC_VERSION >= 40400) || (__SUNPRO_CC >= 0x5130)
+// Hack ahead. New GCC compilers like GCC 6 on AIX 7.0 or earlier as well as original MinGW
+// don't have the synchronization gear. However, Wakely's test used for Apple does not work
+// on the GCC/AIX combination. Another twist is we need other stuff from C++11,
+// like no-except destructors. Dumping preprocessors shows the following may
+// apply: http://stackoverflow.com/q/14191566/608639.
+# include <cstddef>
+# if !defined(__GLIBCXX__) || defined(_GLIBCXX_HAS_GTHREADS)
+#  define CRYPTOPP_CXX11_SYNCHRONIZATION 1
+# endif
+#endif // synchronization
+
+// Dynamic Initialization and Destruction with Concurrency ("Magic Statics")
+// MS at VS2015 with Vista (19.00); GCC at 4.3; LLVM Clang at 2.9; Apple Clang at 4.0; Intel 11.1; SunCC 5.13.
+// Microsoft's implementation only works for Vista and above, so its further
+// limited. http://connect.microsoft.com/VisualStudio/feedback/details/1789709
+// Clang may not support this as early as we indicate. Also see https://bugs.llvm.org/show_bug.cgi?id=47012.
+#if (__cpp_threadsafe_static_init >= 200806) || \
+	(CRYPTOPP_MSC_VERSION >= 1900) && ((WINVER >= 0x0600) || (_WIN32_WINNT >= 0x0600)) || \
+	(CRYPTOPP_LLVM_CLANG_VERSION >= 20900) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40000)  || \
+	(__INTEL_COMPILER >= 1110) || (CRYPTOPP_GCC_VERSION >= 40300) || (__SUNPRO_CC >= 0x5130)
+# define CRYPTOPP_CXX11_STATIC_INIT 1
+#endif // Dynamic Initialization compilers
+
+// deleted functions: MS at VS2013 (18.00); GCC at 4.3; Clang at 2.9; Intel 12.1; SunCC 5.13.
+#if (CRYPTOPP_MSC_VERSION >= 1800) || (CRYPTOPP_LLVM_CLANG_VERSION >= 20900) || \
+	(CRYPTOPP_APPLE_CLANG_VERSION >= 40000) || (__INTEL_COMPILER >= 1210) || \
+	(CRYPTOPP_GCC_VERSION >= 40300) || (__SUNPRO_CC >= 0x5130)
+# define CRYPTOPP_CXX11_DELETED_FUNCTIONS 1
+#endif // deleted functions
+
+// alignof/alignas: MS at VS2015 (19.00); GCC at 4.8; Clang at 3.0; Intel 15.0; SunCC 5.13.
+#if (CRYPTOPP_MSC_VERSION >= 1900) || __has_feature(cxx_alignas) || \
+	(__INTEL_COMPILER >= 1500) || (CRYPTOPP_GCC_VERSION >= 40800) || (__SUNPRO_CC >= 0x5130)
+#  define CRYPTOPP_CXX11_ALIGNAS 1
+#endif // alignas
+
+// alignof: MS at VS2015 (19.00); GCC at 4.5; Clang at 2.9; Intel 15.0; SunCC 5.13.
+#if (CRYPTOPP_MSC_VERSION >= 1900) || __has_feature(cxx_alignof) || \
+	(__INTEL_COMPILER >= 1500) || (CRYPTOPP_GCC_VERSION >= 40500) || (__SUNPRO_CC >= 0x5130)
+#  define CRYPTOPP_CXX11_ALIGNOF 1
+#endif // alignof
+
+// initializer lists: MS at VS2013 (18.00); GCC at 4.4; Clang at 3.1; Intel 14.0; SunCC 5.13.
+#if (CRYPTOPP_MSC_VERSION >= 1800) || (CRYPTOPP_LLVM_CLANG_VERSION >= 30100) || \
+	(CRYPTOPP_APPLE_CLANG_VERSION >= 40000) || (__INTEL_COMPILER >= 1400) || \
+	(CRYPTOPP_GCC_VERSION >= 40400) || (__SUNPRO_CC >= 0x5130)
+#  define CRYPTOPP_CXX11_INITIALIZER_LIST 1
+#endif // alignas
+
+// lambdas: MS at VS2012 (17.00); GCC at 4.9; Clang at 3.3; Intel 12.0; SunCC 5.14.
+#if (CRYPTOPP_MSC_VERSION >= 1700) || __has_feature(cxx_lambdas) || \
+	(__INTEL_COMPILER >= 1200) || (CRYPTOPP_GCC_VERSION >= 40900) || (__SUNPRO_CC >= 0x5140)
+#  define CRYPTOPP_CXX11_LAMBDA 1
+#endif // lambdas
+
+// noexcept: MS at VS2015 (19.00); GCC at 4.6; Clang at 3.0; Intel 14.0; SunCC 5.13.
+#if (CRYPTOPP_MSC_VERSION >= 1900) || __has_feature(cxx_noexcept) || \
+	(__INTEL_COMPILER >= 1400) || (CRYPTOPP_GCC_VERSION >= 40600) || (__SUNPRO_CC >= 0x5130)
+# define CRYPTOPP_CXX11_NOEXCEPT 1
+#endif // noexcept compilers
+
+// variadic templates: MS at VS2013 (18.00); GCC at 4.3; Clang at 2.9; Intel 12.1; SunCC 5.13.
+#if (__cpp_variadic_templates >= 200704) || __has_feature(cxx_variadic_templates) || \
+	(CRYPTOPP_MSC_VERSION >= 1800) || (__INTEL_COMPILER >= 1210) || \
+	(CRYPTOPP_GCC_VERSION >= 40300) || (__SUNPRO_CC >= 0x5130)
+# define CRYPTOPP_CXX11_VARIADIC_TEMPLATES 1
+#endif // variadic templates
+
+// constexpr: MS at VS2015 (19.00); GCC at 4.6; Clang at 3.1; Intel 16.0; SunCC 5.13.
+// Intel has mis-supported the feature since at least ICPC 13.00
+#if (__cpp_constexpr >= 200704) || __has_feature(cxx_constexpr) || \
+	(CRYPTOPP_MSC_VERSION >= 1900) || (__INTEL_COMPILER >= 1600) || \
+	(CRYPTOPP_GCC_VERSION >= 40600) || (__SUNPRO_CC >= 0x5130)
+# define CRYPTOPP_CXX11_CONSTEXPR 1
+#endif // constexpr compilers
+
+// strong typed enums: MS at VS2012 (17.00); GCC at 4.4; Clang at 3.3; Intel 14.0; SunCC 5.12.
+// Mircorosft and Intel had partial support earlier, but we require full support.
+#if (CRYPTOPP_MSC_VERSION >= 1700) || __has_feature(cxx_strong_enums) || \
+	(__INTEL_COMPILER >= 1400) || (CRYPTOPP_GCC_VERSION >= 40400) || (__SUNPRO_CC >= 0x5120)
+# define CRYPTOPP_CXX11_STRONG_ENUM 1
+#endif // constexpr compilers
+
+// nullptr_t: MS at VS2010 (16.00); GCC at 4.6; Clang at 3.3; Intel 10.0; SunCC 5.13.
+#if (CRYPTOPP_MSC_VERSION >= 1600) || __has_feature(cxx_nullptr) || \
+	(__INTEL_COMPILER >= 1000) || (CRYPTOPP_GCC_VERSION >= 40600) || \
+    (__SUNPRO_CC >= 0x5130) || defined(__IBMCPP_NULLPTR)
+# define CRYPTOPP_CXX11_NULLPTR 1
+#endif // nullptr_t compilers
+
+#endif // CRYPTOPP_CXX11
+
+// ***************** C++14 and above ********************
+
+#if defined(CRYPTOPP_CXX14)
+
+// Extended static_assert with one argument
+// Microsoft cannot handle the single argument static_assert as of VS2019 (cl.exe 19.00)
+#if (__cpp_static_assert >= 201411)
+# define CRYPTOPP_CXX17_STATIC_ASSERT 1
+#endif // static_assert
+
+#endif
+
+// ***************** C++17 and above ********************
+
+// C++17 is available
+#if defined(CRYPTOPP_CXX17)
+
+// C++17 uncaught_exceptions: MS at VS2015 (19.00); GCC at 6.0; Clang at 3.5; Intel 18.0.
+// Clang and __EXCEPTIONS see http://releases.llvm.org/3.6.0/tools/clang/docs/ReleaseNotes.html
+// Also see https://github.com/weidai11/cryptopp/issues/980. I'm not sure what
+// to do when the compiler defines __cpp_lib_uncaught_exceptions but the platform
+// does not support std::uncaught_exceptions. What was Apple thinking???
+#if defined(__clang__)
+# if __EXCEPTIONS && __has_feature(cxx_exceptions)
+#  if __cpp_lib_uncaught_exceptions >= 201411L
+#   define CRYPTOPP_CXX17_UNCAUGHT_EXCEPTIONS 1
+#  endif
+# endif
+#elif (CRYPTOPP_MSC_VERSION >= 1900) || (__INTEL_COMPILER >= 1800) || \
+      (CRYPTOPP_GCC_VERSION >= 60000) || (__cpp_lib_uncaught_exceptions >= 201411L)
+# define CRYPTOPP_CXX17_UNCAUGHT_EXCEPTIONS 1
+#endif // uncaught_exceptions compilers
+
+#endif  // CRYPTOPP_CXX17
+
+// ***************** C++ fixups ********************
+
+#if defined(CRYPTOPP_CXX11_NOEXCEPT)
+#  define CRYPTOPP_THROW noexcept(false)
+#  define CRYPTOPP_NO_THROW noexcept(true)
+#else
+#  define CRYPTOPP_THROW
+#  define CRYPTOPP_NO_THROW
+#endif // CRYPTOPP_CXX11_NOEXCEPT
+
+// Hack... C++11 nullptr_t type safety and analysis
+#if defined(CRYPTOPP_CXX11_NULLPTR) && !defined(NULLPTR)
+# define NULLPTR nullptr
+#elif !defined(NULLPTR)
+# define NULLPTR NULL
+#endif // CRYPTOPP_CXX11_NULLPTR
+
+#endif  // CRYPTOPP_CONFIG_CXX_H
diff --git a/runtime/third_party/cryptopp/config_dll.h b/runtime/third_party/cryptopp/config_dll.h
new file mode 100644
index 0000000..73d16d9
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_dll.h
@@ -0,0 +1,178 @@
+// config_dll.h - written and placed in public domain by Jeffrey Walton
+//                the bits that make up this source file are from the
+//                library's monolithic config.h.
+
+/// \file config_dll.h
+/// \brief Library configuration file
+/// \details <tt>config_dll.h</tt> provides defines for shared objects and
+///  dynamic libraries. Generally speaking the macros are used to export
+///  classes and template classes from the Win32 dynamic link library.
+///  When not building the Win32 dynamic link library they are mostly an extern
+///  template declaration.
+/// \details In practice they are a furball coughed up by a cat and then peed
+///  on by a dog. They are awful to get just right because of inconsistent
+///  compiler support for extern templates, manual instantiation and the FIPS DLL.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_dll.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Visual_Studio">Visual Studio</A>,
+///  and <A HREF="https://www.cryptopp.com/wiki/FIPS_DLL">FIPS DLL</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_CONFIG_DLL_H
+#define CRYPTOPP_CONFIG_DLL_H
+
+#include "config_os.h"
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+	/// \brief Win32 define for dynamic link libraries
+	/// \details CRYPTOPP_IMPORTS is set in the Visual Studio project files.
+	///  When the macro is set, <tt>CRYPTOPP_DLL</tt> is defined to
+	///  <tt>__declspec(dllimport)</tt>.
+	/// \details This macro has no effect on Unix &amp; Linux.
+	/// \sa <A HREF="https://www.cryptopp.com/wiki/Visual_Studio">Visual Studio</A>,
+	///  and <A HREF="https://www.cryptopp.com/wiki/FIPS_DLL">FIPS DLL</A>
+	///  on the Crypto++ wiki
+	#define CRYPTOPP_IMPORTS ...
+
+	/// \brief Win32 define for dynamic link libraries
+	/// \details CRYPTOPP_EXPORTS is set in the Visual Studio project files.
+	///  When the macro is set, <tt>CRYPTOPP_DLL</tt> is defined to
+	///  <tt>__declspec(dllexport)</tt>.
+	/// \details This macro has no effect on Unix &amp; Linux.
+	/// \sa <A HREF="https://www.cryptopp.com/wiki/Visual_Studio">Visual Studio</A>,
+	///  and <A HREF="https://www.cryptopp.com/wiki/FIPS_DLL">FIPS DLL</A>
+	///  on the Crypto++ wiki
+	#define CRYPTOPP_EXPORTS ...
+
+	/// \brief Win32 define for dynamic link libraries
+	/// \details CRYPTOPP_IS_DLL is set in the Visual Studio project files.
+	/// \sa <A HREF="https://www.cryptopp.com/wiki/Visual_Studio">Visual Studio</A>,
+	///  and <A HREF="https://www.cryptopp.com/wiki/FIPS_DLL">FIPS DLL</A>
+	///  on the Crypto++ wiki
+	#define CRYPTOPP_IS_DLL
+
+	/// \brief Instantiate templates in a dynamic library
+	/// \details CRYPTOPP_DLL_TEMPLATE_CLASS decoration should be used
+	///  for classes intended to be exported from dynamic link libraries.
+	/// \details This macro is primarily used on Win32, but sees some
+	///  action on Unix &amp; Linux due to the source file <tt>dll.cpp</tt>.
+	/// \sa <A HREF="https://www.cryptopp.com/wiki/Visual_Studio">Visual Studio</A>,
+	///  and <A HREF="https://www.cryptopp.com/wiki/FIPS_DLL">FIPS DLL</A>
+	///  on the Crypto++ wiki
+	#define CRYPTOPP_DLL_TEMPLATE_CLASS ...
+
+	/// \brief Instantiate templates in a dynamic library
+	/// \details CRYPTOPP_EXTERN_DLL_TEMPLATE_CLASS decoration should be used
+	///  for template classes intended to be exported from dynamic link libraries.
+	/// \details This macro is primarily used on Win32, but sees some
+	///  action on Unix &amp; Linux due to the source file <tt>dll.cpp</tt>.
+	/// \sa <A HREF="https://www.cryptopp.com/wiki/Visual_Studio">Visual Studio</A>,
+	///  and <A HREF="https://www.cryptopp.com/wiki/FIPS_DLL">FIPS DLL</A>
+	///  on the Crypto++ wiki
+	#define CRYPTOPP_EXTERN_DLL_TEMPLATE_CLASS ...
+
+	/// \brief Instantiate templates in a dynamic library
+	/// \details CRYPTOPP_STATIC_TEMPLATE_CLASS decoration should be used
+	///  for template classes intended to be exported from dynamic link libraries.
+	/// \details This macro is primarily used on Win32, but sees some
+	///  action on Unix &amp; Linux due to the source file <tt>dll.cpp</tt>.
+	/// \sa <A HREF="https://www.cryptopp.com/wiki/Visual_Studio">Visual Studio</A>,
+	///  and <A HREF="https://www.cryptopp.com/wiki/FIPS_DLL">FIPS DLL</A>
+	///  on the Crypto++ wiki
+	#define CRYPTOPP_STATIC_TEMPLATE_CLASS ...
+
+	/// \brief Instantiate templates in a dynamic library
+	/// \details CRYPTOPP_EXTERN_STATIC_TEMPLATE_CLASS decoration should be used
+	///  for template classes intended to be exported from dynamic link libraries.
+	/// \details This macro is primarily used on Win32, but sees some
+	///  action on Unix &amp; Linux due to the source file <tt>dll.cpp</tt>.
+	/// \sa <A HREF="https://www.cryptopp.com/wiki/Visual_Studio">Visual Studio</A>,
+	///  and <A HREF="https://www.cryptopp.com/wiki/FIPS_DLL">FIPS DLL</A>
+	///  on the Crypto++ wiki
+	#define CRYPTOPP_EXTERN_STATIC_TEMPLATE_CLASS ...
+
+	/// \brief Override for internal linkage
+	/// \details CRYPTOPP_TABLE can be used to override internal linkage
+	///  on tables with the <tt>const</tt> qualifier. According to C++ rules
+	///  a declaration with <tt>const</tt> qualifier is internal linkage.
+	/// \note The name CRYPTOPP_TABLE was chosen because it is often used to
+	///  export a table, like AES or SHA constants. The name avoids collisions
+	///  with the DLL gear macros, like CRYPTOPP_EXPORTS and CRYPTOPP_EXTERN.
+	#define CRYPTOPP_TABLE extern
+
+	/// \brief Win32 calling convention
+	/// \details CRYPTOPP_API sets the calling convention on Win32.
+	///  On Win32 CRYPTOPP_API is <tt>__cedcl</tt>. On Unix &amp; Linux
+	///  CRYPTOPP_API is defined to nothing.
+	/// \sa <A HREF="https://www.cryptopp.com/wiki/Visual_Studio">Visual Studio</A>
+	///  on the Crypto++ wiki
+	#define CRYPTOPP_API ...
+
+#else  // CRYPTOPP_DOXYGEN_PROCESSING
+
+#if defined(CRYPTOPP_WIN32_AVAILABLE)
+
+	#if defined(CRYPTOPP_EXPORTS)
+	#  define CRYPTOPP_IS_DLL
+	#  define CRYPTOPP_DLL __declspec(dllexport)
+	#elif defined(CRYPTOPP_IMPORTS)
+	#  define CRYPTOPP_IS_DLL
+	#  define CRYPTOPP_DLL __declspec(dllimport)
+	#else
+	#  define CRYPTOPP_DLL
+	#endif
+
+	// C++ makes const internal linkage
+	#define CRYPTOPP_TABLE extern
+	#define CRYPTOPP_API __cdecl
+
+#else	// not CRYPTOPP_WIN32_AVAILABLE
+
+	// C++ makes const internal linkage
+	#define CRYPTOPP_TABLE extern
+	#define CRYPTOPP_DLL
+	#define CRYPTOPP_API
+
+#endif	// CRYPTOPP_WIN32_AVAILABLE
+
+#if defined(__MWERKS__)
+#  define CRYPTOPP_EXTERN_DLL_TEMPLATE_CLASS extern class CRYPTOPP_DLL
+#elif defined(__BORLANDC__) || defined(__SUNPRO_CC)
+#  define CRYPTOPP_EXTERN_DLL_TEMPLATE_CLASS template class CRYPTOPP_DLL
+#else
+#  define CRYPTOPP_EXTERN_DLL_TEMPLATE_CLASS extern template class CRYPTOPP_DLL
+#endif
+
+#if defined(CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES) && !defined(CRYPTOPP_IMPORTS)
+#  define CRYPTOPP_DLL_TEMPLATE_CLASS template class CRYPTOPP_DLL
+#else
+#  define CRYPTOPP_DLL_TEMPLATE_CLASS CRYPTOPP_EXTERN_DLL_TEMPLATE_CLASS
+#endif
+
+#if defined(__MWERKS__)
+#  define CRYPTOPP_EXTERN_STATIC_TEMPLATE_CLASS extern class
+#elif defined(__BORLANDC__) || defined(__SUNPRO_CC)
+#  define CRYPTOPP_EXTERN_STATIC_TEMPLATE_CLASS template class
+#else
+#  define CRYPTOPP_EXTERN_STATIC_TEMPLATE_CLASS extern template class
+#endif
+
+#if defined(CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES) && !defined(CRYPTOPP_EXPORTS)
+#  define CRYPTOPP_STATIC_TEMPLATE_CLASS template class
+#else
+#  define CRYPTOPP_STATIC_TEMPLATE_CLASS CRYPTOPP_EXTERN_STATIC_TEMPLATE_CLASS
+#endif
+
+#endif  // CRYPTOPP_DOXYGEN_PROCESSING
+
+#endif  // CRYPTOPP_CONFIG_DLL_H
diff --git a/runtime/third_party/cryptopp/config_int.h b/runtime/third_party/cryptopp/config_int.h
new file mode 100644
index 0000000..6d9ebf4
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_int.h
@@ -0,0 +1,268 @@
+// config_int.h - written and placed in public domain by Jeffrey Walton
+//                the bits that make up this source file are from the
+//                library's monolithic config.h.
+
+/// \file config_int.h
+/// \brief Library configuration file
+/// \details <tt>config_int.h</tt> provides defines and typedefs for fixed
+///  size integers. The library's choices for fixed size integers predates other
+///  standard-based integers by about 5 years. After fixed sizes were
+///  made standard, the library continued to use its own definitions for
+///  compatibility with previous versions of the library.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_int.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_CONFIG_INT_H
+#define CRYPTOPP_CONFIG_INT_H
+
+#include "config_ns.h"
+#include "config_ver.h"
+#include "config_misc.h"
+
+// C5264 new for VS2022/v17.4, MSC v17.3.4
+// https://github.com/weidai11/cryptopp/issues/1185
+#if (CRYPTOPP_MSC_VERSION)
+# pragma warning(push)
+# if (CRYPTOPP_MSC_VERSION >= 1933)
+#  pragma warning(disable: 5264)
+# endif
+#endif
+
+/// \brief Library byte guard
+/// \details CRYPTOPP_NO_GLOBAL_BYTE indicates <tt>byte</tt> is in the Crypto++
+///  namespace.
+/// \details The Crypto++ <tt>byte</tt> was originally in global namespace to avoid
+///  ambiguity with other byte typedefs. <tt>byte</tt> was moved to CryptoPP namespace
+///  at Crypto++ 6.0 due to C++17, <tt>std::byte</tt> and potential compile problems.
+/// \sa <A HREF="http://github.com/weidai11/cryptopp/issues/442">Issue 442</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">std::byte</A> on the
+///  Crypto++ wiki
+/// \since Crypto++ 6.0
+#define CRYPTOPP_NO_GLOBAL_BYTE 1
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Signed words added at Issue 609 for early versions of and Visual Studio and
+// the NaCl gear. Also see https://github.com/weidai11/cryptopp/issues/609.
+
+/// \brief 8-bit unsigned datatype
+/// \details The Crypto++ <tt>byte</tt> was originally in global namespace to avoid
+///  ambiguity with other byte typedefs. <tt>byte</tt> was moved to CryptoPP namespace
+///  at Crypto++ 6.0 due to C++17, <tt>std::byte</tt> and potential compile problems.
+/// \sa CRYPTOPP_NO_GLOBAL_BYTE, <A HREF="http://github.com/weidai11/cryptopp/issues/442">Issue 442</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">std::byte</A> on the
+///  Crypto++ wiki
+/// \since Crypto++ 1.0, CryptoPP namespace since Crypto++ 6.0
+typedef unsigned char byte;
+/// \brief 16-bit unsigned datatype
+/// \since Crypto++ 1.0
+typedef unsigned short word16;
+/// \brief 32-bit unsigned datatype
+/// \since Crypto++ 1.0
+typedef unsigned int word32;
+
+/// \brief 8-bit signed datatype
+/// \details The 8-bit signed datatype was added to support constant time
+///  implementations for curve25519, X25519 key agreement and ed25519
+///  signatures.
+/// \since Crypto++ 8.0
+typedef signed char sbyte;
+/// \brief 16-bit signed datatype
+/// \details The 32-bit signed datatype was added to support constant time
+///  implementations for curve25519, X25519 key agreement and ed25519
+///  signatures.
+/// \since Crypto++ 8.0
+typedef signed short sword16;
+/// \brief 32-bit signed datatype
+/// \details The 32-bit signed datatype was added to support constant time
+///  implementations for curve25519, X25519 key agreement and ed25519
+///  signatures.
+/// \since Crypto++ 8.0
+typedef signed int sword32;
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+	/// \brief 64-bit unsigned datatype
+	/// \details The typedef for <tt>word64</tt> varies depending on the platform.
+	///  On Microsoft platforms it is <tt>unsigned __int64</tt>. On Unix &amp; Linux
+	///  with LP64 data model it is <tt>unsigned long</tt>. On Unix &amp; Linux with ILP32
+	///  data model it is <tt>unsigned long long</tt>.
+	/// \since Crypto++ 1.0
+	typedef unsigned long long word64;
+
+	/// \brief 64-bit signed datatype
+	/// \details The typedef for <tt>sword64</tt> varies depending on the platform.
+	///  On Microsoft platforms it is <tt>signed __int64</tt>. On Unix &amp; Linux
+	///  with LP64 data model it is <tt>signed long</tt>. On Unix &amp; Linux with ILP32
+	///  data model it is <tt>signed long long</tt>.
+	/// \since Crypto++ 8.0
+	typedef signed long long sword64;
+
+	/// \brief 128-bit unsigned datatype
+	/// \details The typedef for <tt>word128</tt> varies depending on the platform.
+	///  <tt>word128</tt> is only available on 64-bit machines when
+	///  <tt>CRYPTOPP_WORD128_AVAILABLE</tt> is defined.
+	///  On Unix &amp; Linux with LP64 data model it is <tt>__uint128_t</tt>.
+	///  Microsoft platforms do not provide a 128-bit integer type. 32-bit platforms
+	///  do not provide a 128-bit integer type.
+	/// \since Crypto++ 5.6
+	typedef __uint128_t word128;
+
+	/// \brief Declare an unsigned word64
+	/// \details W64LIT is used to portability declare or assign 64-bit literal values.
+	///  W64LIT will append the proper suffix to ensure the compiler accepts the literal.
+	/// \details Use the macro like shown below.
+	///  <pre>
+	///    word64 x = W64LIT(0xffffffffffffffff);
+	///  </pre>
+	/// \since Crypto++ 1.0
+	#define W64LIT(x) ...
+
+	/// \brief Declare a signed word64
+	/// \details SW64LIT is used to portability declare or assign 64-bit literal values.
+	///  SW64LIT will append the proper suffix to ensure the compiler accepts the literal.
+	/// \details Use the macro like shown below.
+	///  <pre>
+	///    sword64 x = SW64LIT(0xffffffffffffffff);
+	///  </pre>
+	/// \since Crypto++ 8.0
+	#define SW64LIT(x) ...
+
+	/// \brief Declare ops on word64 are slow
+	/// \details CRYPTOPP_BOOL_SLOW_WORD64 is typically defined to 1 on platforms
+	///  that have a machine word smaller than 64-bits. That is, the define
+	///  is present on 32-bit platforms. The define is also present on platforms
+	///  where the cpu is slow even with a 64-bit cpu.
+	#define CRYPTOPP_BOOL_SLOW_WORD64 ...
+
+#elif defined(CRYPTOPP_MSC_VERSION) || defined(__BORLANDC__)
+	typedef signed __int64 sword64;
+	typedef unsigned __int64 word64;
+	#define SW64LIT(x) x##i64
+	#define W64LIT(x) x##ui64
+#elif (_LP64 || __LP64__)
+	typedef signed long sword64;
+	typedef unsigned long word64;
+	#define SW64LIT(x) x##L
+	#define W64LIT(x) x##UL
+#else
+	typedef signed long long sword64;
+	typedef unsigned long long word64;
+	#define SW64LIT(x) x##LL
+	#define W64LIT(x) x##ULL
+#endif
+
+/// \brief Large word type
+/// \details lword is a typedef for large word types. It is used for file
+///  offsets and such.
+typedef word64 lword;
+
+/// \brief Large word type max value
+/// \details LWORD_MAX is the maximum value for large word types.
+///  Since an <tt>lword</tt> is an unsigned type, the value is
+///  <tt>0xffffffffffffffff</tt>. W64LIT will append the proper suffix.
+CRYPTOPP_CONST_OR_CONSTEXPR lword LWORD_MAX = W64LIT(0xffffffffffffffff);
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief Half word used for multiprecision integer arithmetic
+	/// \details hword is used for multiprecision integer arithmetic.
+	///  The typedef for <tt>hword</tt> varies depending on the platform.
+	///  On 32-bit platforms it is usually <tt>word16</tt>. On 64-bit platforms
+	///  it is usually <tt>word32</tt>.
+	/// \details Library users typically use byte, word16, word32 and word64.
+	/// \since Crypto++ 2.0
+	typedef word32 hword;
+	/// \brief Full word used for multiprecision integer arithmetic
+	/// \details word is used for multiprecision integer arithmetic.
+	///  The typedef for <tt>word</tt> varies depending on the platform.
+	///  On 32-bit platforms it is usually <tt>word32</tt>. On 64-bit platforms
+	///  it is usually <tt>word64</tt>.
+	/// \details Library users typically use byte, word16, word32 and word64.
+	/// \since Crypto++ 2.0
+	typedef word64 word;
+	/// \brief Double word used for multiprecision integer arithmetic
+	/// \details dword is used for multiprecision integer arithmetic.
+	///  The typedef for <tt>dword</tt> varies depending on the platform.
+	///  On 32-bit platforms it is usually <tt>word64</tt>. On 64-bit Unix &amp;
+	///  Linux platforms it is usually <tt>word128</tt>. <tt>word128</tt> is
+	///  not available on Microsoft platforms. <tt>word128</tt> is only available
+	///  when <tt>CRYPTOPP_WORD128_AVAILABLE</tt> is defined.
+	/// \details Library users typically use byte, word16, word32 and word64.
+	/// \sa CRYPTOPP_WORD128_AVAILABLE
+	/// \since Crypto++ 2.0
+	typedef word128 dword;
+
+	/// \brief 128-bit word availability
+	/// \details CRYPTOPP_WORD128_AVAILABLE indicates a 128-bit word is
+	///  available from the platform. 128-bit words are usually available on
+	///  64-bit platforms, but not available 32-bit platforms.
+	/// \details If CRYPTOPP_WORD128_AVAILABLE is not defined, then 128-bit
+	///  words are not available.
+	/// \details GCC and compatible compilers signal 128-bit word availability
+	///  with the preporcessor macro <tt>__SIZEOF_INT128__ >= 16</tt>.
+	/// \since Crypto++ 2.0
+	#define CRYPTOPP_WORD128_AVAILABLE ...
+#else
+	// define hword, word, and dword. these are used for multiprecision integer arithmetic
+	// Intel compiler won't have _umul128 until version 10.0. See http://softwarecommunity.intel.com/isn/Community/en-US/forums/thread/30231625.aspx
+	#if (defined(CRYPTOPP_MSC_VERSION) && (!defined(__INTEL_COMPILER) || __INTEL_COMPILER >= 1000) && (defined(_M_X64) || defined(_M_IA64))) || (defined(__DECCXX) && defined(__alpha__)) || (defined(__INTEL_COMPILER) && defined(__x86_64__)) || (defined(__SUNPRO_CC) && defined(__x86_64__))
+		typedef word32 hword;
+		typedef word64 word;
+	#else
+		#define CRYPTOPP_NATIVE_DWORD_AVAILABLE 1
+		#if defined(__alpha__) || defined(__ia64__) || defined(_ARCH_PPC64) || defined(__x86_64__) || defined(__mips64) || defined(__sparc64__) || defined(__aarch64__)
+			#if ((CRYPTOPP_GCC_VERSION >= 30400) || (CRYPTOPP_LLVM_CLANG_VERSION >= 30000) || (CRYPTOPP_APPLE_CLANG_VERSION >= 40300)) && (__SIZEOF_INT128__ >= 16) && !defined(MKW_CRYPTOPP_NO_INT128)
+				// GCC 4.0.1 on MacOS X is missing __umodti3 and __udivti3
+				// GCC 4.8.3 and bad uint128_t ops on PPC64/POWER7 (Issue 421)
+				// mode(TI) division broken on amd64 with GCC earlier than GCC 3.4
+				typedef word32 hword;
+				typedef word64 word;
+				typedef __uint128_t dword;
+				typedef __uint128_t word128;
+				#define CRYPTOPP_WORD128_AVAILABLE 1
+			#else
+				// if we're here, it means we're on a 64-bit CPU but we don't have a way to obtain 128-bit multiplication results
+				typedef word16 hword;
+				typedef word32 word;
+				typedef word64 dword;
+			#endif
+		#else
+			// being here means the native register size is probably 32 bits or less
+			#define CRYPTOPP_BOOL_SLOW_WORD64 1
+			typedef word16 hword;
+			typedef word32 word;
+			typedef word64 dword;
+		#endif
+	#endif
+#endif
+
+#ifndef CRYPTOPP_BOOL_SLOW_WORD64
+# define CRYPTOPP_BOOL_SLOW_WORD64 0
+#endif
+
+/// \brief Size of a platform word in bytes
+/// \details The size of a platform word, in bytes
+CRYPTOPP_CONST_OR_CONSTEXPR unsigned int WORD_SIZE = sizeof(word);
+
+/// \brief Size of a platform word in bits
+/// \details The size of a platform word, in bits
+/// \sa https://github.com/weidai11/cryptopp/issues/1185
+CRYPTOPP_CONST_OR_CONSTEXPR unsigned int WORD_BITS = WORD_SIZE * 8;
+
+NAMESPACE_END
+
+#if (CRYPTOPP_MSC_VERSION)
+# pragma warning(pop)
+#endif
+
+#endif  // CRYPTOPP_CONFIG_INT_H
diff --git a/runtime/third_party/cryptopp/config_misc.h b/runtime/third_party/cryptopp/config_misc.h
new file mode 100644
index 0000000..68e196c
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_misc.h
@@ -0,0 +1,199 @@
+// config_misc.h - written and placed in public domain by Jeffrey Walton
+//                 the bits that make up this source file are from the
+//                 library's monolithic config.h.
+
+/// \file config_misc.h
+/// \brief Library configuration file
+/// \details <tt>config_misc.h</tt> provides miscellaneous defines.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_misc.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_CONFIG_MISC_H
+#define CRYPTOPP_CONFIG_MISC_H
+
+#include "config_asm.h"
+#include "config_cxx.h"
+#include "config_os.h"
+#include "config_ver.h"
+
+// Define this if running on a big-endian CPU
+// big endian will be assumed if CRYPTOPP_LITTLE_ENDIAN is not non-0
+#if !defined(CRYPTOPP_LITTLE_ENDIAN) && !defined(CRYPTOPP_BIG_ENDIAN) && (defined(__BIG_ENDIAN__) || (defined(__s390__) || defined(__s390x__) || defined(__zarch__)) || (defined(__m68k__) || defined(__MC68K__)) || defined(__sparc) || defined(__sparc__) || defined(__hppa__) || defined(__MIPSEB__) || defined(__ARMEB__) || (defined(__MWERKS__) && !defined(__INTEL__)))
+#	define CRYPTOPP_BIG_ENDIAN 1
+#endif
+
+// Define this if running on a little-endian CPU
+// big endian will be assumed if CRYPTOPP_LITTLE_ENDIAN is not non-0
+#if !defined(CRYPTOPP_BIG_ENDIAN) && !defined(CRYPTOPP_LITTLE_ENDIAN)
+#	define CRYPTOPP_LITTLE_ENDIAN 1
+#endif
+
+// Define this if you want to set a prefix for TestData/ and TestVectors/
+// Be sure to add the trailing slash since its simple concatenation.
+// After https://github.com/weidai11/cryptopp/issues/760 the library
+// should find the test vectors and data without much effort. It
+// will search in "./" and "$ORIGIN/../share/cryptopp" automatically.
+#ifndef CRYPTOPP_DATA_DIR
+# define CRYPTOPP_DATA_DIR ""
+#endif
+
+// Define this to disable the test suite from searching for test
+// vectors and data in "./" and "$ORIGIN/../share/cryptopp". The
+// library will still search in CRYPTOPP_DATA_DIR, regardless.
+// Some distros may want to disable this feature. Also see
+// https://github.com/weidai11/cryptopp/issues/760
+// #ifndef CRYPTOPP_DISABLE_DATA_DIR_SEARCH
+// # define CRYPTOPP_DISABLE_DATA_DIR_SEARCH
+// #endif
+
+// Define this if you want or need the library's memcpy_s and memmove_s.
+// See http://github.com/weidai11/cryptopp/issues/28.
+// #if !defined(CRYPTOPP_WANT_SECURE_LIB)
+// # define CRYPTOPP_WANT_SECURE_LIB
+// #endif
+
+// Define this if ARMv8 shifts are slow. ARM Cortex-A53 and Cortex-A57 shift
+// operation perform poorly, so NEON and ASIMD code that relies on shifts
+// or rotates often performs worse than C/C++ code. Also see
+// http://github.com/weidai11/cryptopp/issues/367.
+#define CRYPTOPP_SLOW_ARMV8_SHIFT 1
+
+// CRYPTOPP_DEBUG enables the library's CRYPTOPP_ASSERT. CRYPTOPP_ASSERT
+// raises a SIGTRAP (Unix) or calls DebugBreak() (Windows). CRYPTOPP_ASSERT
+// is only in effect when CRYPTOPP_DEBUG, DEBUG or _DEBUG is defined. Unlike
+// Posix assert, CRYPTOPP_ASSERT is not affected by NDEBUG (or failure to
+// define it). According to the ndk-build docs, Android use NDK_DEBUG=1 to
+// signal a DEBUG build (and NDK_DEBUG=0 to signal non-DEBUG build).
+// Also see http://github.com/weidai11/cryptopp/issues/277, CVE-2016-7420 and
+// https://developer.android.com/ndk/guides/ndk-build
+#if (defined(DEBUG) || defined(_DEBUG)) || (defined(NDK_DEBUG) && (NDK_DEBUG > 0))
+# undef CRYPTOPP_DEBUG
+# define CRYPTOPP_DEBUG 1
+#endif
+
+// File system code to use when creating GZIP archive.
+// http://www.gzip.org/format.txt
+#if !defined(GZIP_OS_CODE)
+# if defined(__macintosh__)
+#  define GZIP_OS_CODE 7
+# elif defined(__unix__) || defined(__linux__)
+#  define GZIP_OS_CODE 3
+# else
+#  define GZIP_OS_CODE 0
+# endif
+#endif
+
+// Try this if your CPU has 256K internal cache or a slow multiply instruction
+// and you want a (possibly) faster IDEA implementation using log tables
+// #define IDEA_LARGECACHE
+
+// Define this if, for the linear congruential RNG, you want to use
+// the original constants as specified in S.K. Park and K.W. Miller's
+// CACM paper.
+// #define LCRNG_ORIGINAL_NUMBERS
+
+// Define this if you want Integer's operator<< to honor std::showbase (and
+// std::noshowbase). If defined, Integer will use a suffix of 'b', 'o', 'h'
+// or '.' (the last for decimal) when std::showbase is in effect. If
+// std::noshowbase is set, then the suffix is not added to the Integer. If
+// not defined, existing behavior is preserved and Integer will use a suffix
+// of 'b', 'o', 'h' or '.' (the last for decimal).
+// #define CRYPTOPP_USE_STD_SHOWBASE
+
+// Define this if you want to decouple AlgorithmParameters and Integer
+// The decoupling should make it easier for the linker to remove Integer
+// related code for those who do not need Integer, and avoid a potential
+// race during AssignIntToInteger pointer initialization. Also
+// see http://github.com/weidai11/cryptopp/issues/389.
+// #define CRYPTOPP_NO_ASSIGN_TO_INTEGER
+
+// Need GCC 4.6/Clang 1.7/Apple Clang 2.0 or above due to "GCC diagnostic {push|pop}"
+#if (CRYPTOPP_GCC_VERSION >= 40600) || (CRYPTOPP_LLVM_CLANG_VERSION >= 10700) || \
+    (CRYPTOPP_APPLE_CLANG_VERSION >= 20000)
+	#define CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE 1
+#endif
+
+// Portable way to suppress warnings.
+// Moved from misc.h due to circular depenedencies.
+#ifndef CRYPTOPP_UNUSED
+	#define CRYPTOPP_UNUSED(x) ((void)(x))
+#endif
+
+// how to disable inlining
+#if defined(CRYPTOPP_MSC_VERSION)
+#	define CRYPTOPP_NOINLINE_DOTDOTDOT
+#	define CRYPTOPP_NOINLINE __declspec(noinline)
+#elif defined(__xlc__) || defined(__xlC__) || defined(__ibmxl__)
+#	define CRYPTOPP_NOINLINE_DOTDOTDOT ...
+#	define CRYPTOPP_NOINLINE __attribute__((noinline))
+#elif defined(__GNUC__)
+#	define CRYPTOPP_NOINLINE_DOTDOTDOT
+#	define CRYPTOPP_NOINLINE __attribute__((noinline))
+#else
+#	define CRYPTOPP_NOINLINE_DOTDOTDOT ...
+#	define CRYPTOPP_NOINLINE
+#endif
+
+// http://stackoverflow.com/a/13867690/608639
+// CRYPTOPP_CONST_OR_CONSTEXPR due to https://github.com/weidai11/cryptopp/issues/1185
+#if defined(CRYPTOPP_CXX11_CONSTEXPR)
+#  define CRYPTOPP_STATIC_CONSTEXPR static constexpr
+#  define CRYPTOPP_STATIC_CONST_OR_CONSTEXPR static constexpr
+#  define CRYPTOPP_CONST_OR_CONSTEXPR constexpr
+#  define CRYPTOPP_CONSTEXPR constexpr
+#else
+#  define CRYPTOPP_STATIC_CONSTEXPR static
+#  define CRYPTOPP_STATIC_CONST_OR_CONSTEXPR static const
+#  define CRYPTOPP_CONST_OR_CONSTEXPR const
+#  define CRYPTOPP_CONSTEXPR
+#endif // CRYPTOPP_CXX11_CONSTEXPR
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+# define CRYPTOPP_CONSTANT(x) static const int x
+#elif defined(CRYPTOPP_CXX11_STRONG_ENUM)
+# define CRYPTOPP_CONSTANT(x) enum : int { x }
+#elif defined(CRYPTOPP_CXX11_CONSTEXPR)
+# define CRYPTOPP_CONSTANT(x) constexpr static int x
+#else
+# define CRYPTOPP_CONSTANT(x) static const int x
+#endif
+
+// Warnings
+#ifdef CRYPTOPP_MSC_VERSION
+	// 4127: conditional expression is constant
+	// 4512: assignment operator not generated
+	// 4661: no suitable definition provided for explicit template instantiation request
+	// 4910: '__declspec(dllexport)' and 'extern' are incompatible on an explicit instantiation
+#	pragma warning(disable: 4127 4512 4661 4910)
+	// CRYPTOPP_MSC_VERSION 1920 is VS2019
+#	if CRYPTOPP_MSC_VERSION >= 1920
+		// 5054: operator '|': deprecated between enumerations of different types
+#		pragma warning(disable: 5054)
+#	endif
+	// Security related, possible defects
+	// http://blogs.msdn.com/b/vcblog/archive/2010/12/14/off-by-default-compiler-warnings-in-visual-c.aspx
+#	pragma warning(once: 4191 4242 4263 4264 4266 4302 4826 4905 4906 4928)
+#endif
+
+#ifdef __BORLANDC__
+// 8037: non-const function called for const object. needed to work around BCB2006 bug
+#	pragma warn -8037
+#endif
+
+// [GCC Bug 53431] "C++ preprocessor ignores #pragma GCC diagnostic". Clang honors it.
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wunknown-pragmas"
+# pragma GCC diagnostic ignored "-Wunused-function"
+#endif
+
+#endif  // CRYPTOPP_CONFIG_MISC_H
diff --git a/runtime/third_party/cryptopp/config_ns.h b/runtime/third_party/cryptopp/config_ns.h
new file mode 100644
index 0000000..256b791
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_ns.h
@@ -0,0 +1,76 @@
+// config_ns.h - written and placed in public domain by Jeffrey Walton
+//               the bits that make up this source file are from the
+//               library's monolithic config.h.
+
+/// \file config_ns.h
+/// \brief Library configuration file
+/// \details <tt>config_ns.h</tt> provides defines for C++ and library
+///  namespaces.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_ns.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_CONFIG_NAMESPACE_H
+#define CRYPTOPP_CONFIG_NAMESPACE_H
+
+// namespace support is now required
+#ifdef NO_NAMESPACE
+# error namespace support is now required
+#endif
+
+#ifdef CRYPTOPP_DOXYGEN_PROCESSING
+
+/// \namespace CryptoPP
+/// \brief Crypto++ library namespace
+/// \details Nearly all classes are located in the CryptoPP namespace. Within
+///  the namespace, there are four additional namespaces.
+///   <ul>
+///     <li>Name - namespace for names used with NameValuePairs and documented
+///         in argnames.h
+///     <li>NaCl - namespace for NaCl test functions like crypto_box,
+///         crypto_box_open, crypto_sign, and crypto_sign_open
+///     <li>Donna - namespace for curve25519 library operations. The name was
+///         selected due to use of Langley and Moon's curve25519-donna.
+///     <li>Test - namespace for testing and benchmarks classes
+///     <li>Weak - namespace for weak and wounded algorithms, like ARC4, MD5
+///         and Pananma
+///   </ul>
+/// \since Crypto++ 3.0
+namespace CryptoPP { }
+
+// Bring in the symbols found in the weak namespace; and fold Weak1 into Weak
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+#define Weak1 Weak
+// Avoid putting "CryptoPP::" in front of everything in Doxygen output
+#define CryptoPP
+#define NAMESPACE_BEGIN(x)
+#define NAMESPACE_END
+// Get Doxygen to generate better documentation for these typedefs
+#define DOCUMENTED_TYPEDEF(x, y) class y : public x {}
+// Make "protected" "private" so the functions and members are not documented
+#define protected private
+
+#else
+// Not Doxygen
+#define NAMESPACE_BEGIN(x) namespace x {
+#define NAMESPACE_END }
+#define DOCUMENTED_TYPEDEF(x, y) typedef x y
+
+#endif  // CRYPTOPP_DOXYGEN_PROCESSING
+
+#define ANONYMOUS_NAMESPACE_BEGIN namespace {
+#define ANONYMOUS_NAMESPACE_END }
+#define USING_NAMESPACE(x) using namespace x;
+#define DOCUMENTED_NAMESPACE_BEGIN(x) namespace x {
+#define DOCUMENTED_NAMESPACE_END }
+
+#endif  // CRYPTOPP_CONFIG_NAMESPACE_H
diff --git a/runtime/third_party/cryptopp/config_os.h b/runtime/third_party/cryptopp/config_os.h
new file mode 100644
index 0000000..20dbd51
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_os.h
@@ -0,0 +1,168 @@
+// config_os.h - written and placed in public domain by Jeffrey Walton
+//               the bits that make up this source file are from the
+//               library's monolithic config.h.
+
+/// \file config_os.h
+/// \brief Library configuration file
+/// \details <tt>config_os.h</tt> provides defines for platforms and operating
+///  systems.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_os.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_CONFIG_OS_H
+#define CRYPTOPP_CONFIG_OS_H
+
+#include "config_ver.h"
+
+// It is OK to remove the hard stop below, but you are on your own.
+// After building the library be sure to run self tests described
+// https://www.cryptopp.com/wiki/Release_Process#Self_Tests
+// The problems with Clang pretending to be other compilers is
+// discussed at http://github.com/weidai11/cryptopp/issues/147.
+#if (defined(_MSC_VER) && defined(__clang__)) && !defined(MKW_CRYPTOPP_ALLOW_CLANG_MSVC_ABI)
+# error: "Unsupported configuration"
+#endif
+
+// Windows platform
+#if defined(_WIN32) || defined(_WIN64) || defined(__CYGWIN__)
+#define CRYPTOPP_WIN32_AVAILABLE
+#endif
+
+// Unix and Linux platforms
+#if defined(__unix__) || defined(__MACH__) || defined(__NetBSD__) || defined(__sun)
+#define CRYPTOPP_UNIX_AVAILABLE
+#endif
+
+// BSD platforms
+#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
+#define CRYPTOPP_BSD_AVAILABLE
+#endif
+
+// Microsoft compilers
+#if defined(CRYPTOPP_MSC_VERSION) || defined(__fastcall)
+	#define CRYPTOPP_FASTCALL __fastcall
+#else
+	#define CRYPTOPP_FASTCALL
+#endif
+
+// Microsoft compilers
+#if defined(CRYPTOPP_MSC_VERSION)
+	#define CRYPTOPP_NO_VTABLE __declspec(novtable)
+#else
+	#define CRYPTOPP_NO_VTABLE
+#endif
+
+// Define this if you want to disable all OS-dependent features,
+// such as sockets and OS-provided random number generators
+// #define NO_OS_DEPENDENCE
+
+// Define this to use features provided by Microsoft's CryptoAPI.
+// Currently the only feature used is Windows random number generation.
+// This macro will be ignored if NO_OS_DEPENDENCE is defined.
+// #define USE_MS_CRYPTOAPI
+
+// Define this to use features provided by Microsoft's CryptoNG API.
+// CryptoNG API is available in Vista and above and its cross platform,
+// including desktop apps and store apps. Currently the only feature
+// used is Windows random number generation.
+// This macro will be ignored if NO_OS_DEPENDENCE is defined.
+// #define USE_MS_CNGAPI
+
+// If the user did not make a choice, then select CryptoNG if
+// targeting Windows 8 or above.
+#if !defined(USE_MS_CRYPTOAPI) && !defined(USE_MS_CNGAPI)
+# if !defined(_USING_V110_SDK71_) && ((WINVER >= 0x0602 /*_WIN32_WINNT_WIN8*/) || \
+     (_WIN32_WINNT >= 0x0602 /*_WIN32_WINNT_WIN8*/))
+#  define USE_MS_CNGAPI
+# else
+#  define USE_MS_CRYPTOAPI
+# endif
+#endif
+
+// Begin OS features, like init priorities and random numbers
+#ifndef NO_OS_DEPENDENCE
+
+// CRYPTOPP_INIT_PRIORITY attempts to manage initialization of C++ static objects.
+// Under GCC, the library uses init_priority attribute in the range
+// [CRYPTOPP_INIT_PRIORITY, CRYPTOPP_INIT_PRIORITY+100]. Under Windows,
+// CRYPTOPP_INIT_PRIORITY enlists "#pragma init_seg(lib)". The platforms
+// with gaps are Apple and Sun because they require linker scripts. Apple and
+// Sun will use the library's Singletons to initialize and acquire resources.
+// Also see http://cryptopp.com/wiki/Static_Initialization_Order_Fiasco
+#ifndef CRYPTOPP_INIT_PRIORITY
+# define CRYPTOPP_INIT_PRIORITY 250
+#endif
+
+// CRYPTOPP_USER_PRIORITY is for other libraries and user code that is using Crypto++
+// and managing C++ static object creation. It is guaranteed not to conflict with
+// values used by (or would be used by) the Crypto++ library.
+#ifndef CRYPTOPP_USER_PRIORITY
+# define CRYPTOPP_USER_PRIORITY (CRYPTOPP_INIT_PRIORITY+101)
+#endif
+
+// Most platforms allow us to specify when to create C++ objects. Apple and Sun do not.
+#if (CRYPTOPP_INIT_PRIORITY > 0) && !(defined(NO_OS_DEPENDENCE) || defined(__APPLE__) || defined(__sun__))
+# if (CRYPTOPP_GCC_VERSION >= 30000) || (CRYPTOPP_LLVM_CLANG_VERSION >= 20900) || (_INTEL_COMPILER >= 800)
+#  define HAVE_GCC_INIT_PRIORITY 1
+# elif (CRYPTOPP_MSC_VERSION >= 1310)
+#  define HAVE_MSC_INIT_PRIORITY 1
+# elif defined(__xlc__) || defined(__xlC__) || defined(__ibmxl__)
+#  define HAVE_XLC_INIT_PRIORITY 1
+# endif
+#endif  // CRYPTOPP_INIT_PRIORITY, NO_OS_DEPENDENCE, Apple, Sun
+
+#if defined(CRYPTOPP_WIN32_AVAILABLE) || defined(CRYPTOPP_UNIX_AVAILABLE)
+#	define HIGHRES_TIMER_AVAILABLE
+#endif
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+# if !defined(WINAPI_FAMILY)
+#	define THREAD_TIMER_AVAILABLE
+# elif defined(WINAPI_FAMILY)
+#   if (WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP))
+#	  define THREAD_TIMER_AVAILABLE
+#  endif
+# endif
+#endif
+
+#if defined(CRYPTOPP_UNIX_AVAILABLE) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+#	define NONBLOCKING_RNG_AVAILABLE
+#	define BLOCKING_RNG_AVAILABLE
+#	define OS_RNG_AVAILABLE
+#endif
+
+// Cygwin/Newlib requires _XOPEN_SOURCE=600
+#if defined(CRYPTOPP_UNIX_AVAILABLE)
+# define UNIX_SIGNALS_AVAILABLE 1
+#endif
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+# if !defined(WINAPI_FAMILY)
+#	define NONBLOCKING_RNG_AVAILABLE
+#	define OS_RNG_AVAILABLE
+# elif defined(WINAPI_FAMILY)
+#   if (WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP))
+#	  define NONBLOCKING_RNG_AVAILABLE
+#	  define OS_RNG_AVAILABLE
+#   elif !(WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP))
+#     if ((WINVER >= 0x0A00 /*_WIN32_WINNT_WIN10*/) || (_WIN32_WINNT >= 0x0A00 /*_WIN32_WINNT_WIN10*/))
+#	    define NONBLOCKING_RNG_AVAILABLE
+#	    define OS_RNG_AVAILABLE
+#     endif
+#   endif
+# endif
+#endif
+
+#endif	// NO_OS_DEPENDENCE
+
+#endif  // CRYPTOPP_CONFIG_OS_H
diff --git a/runtime/third_party/cryptopp/config_ver.h b/runtime/third_party/cryptopp/config_ver.h
new file mode 100644
index 0000000..4752692
--- /dev/null
+++ b/runtime/third_party/cryptopp/config_ver.h
@@ -0,0 +1,96 @@
+// config_ver.h - written and placed in public domain by Jeffrey Walton
+//                the bits that make up this source file are from the
+//                library's monolithic config.h.
+
+/// \file config_ver.h
+/// \brief Library configuration file
+/// \details <tt>config_ver.h</tt> provides defines for library and compiler
+///  versions.
+/// \details <tt>config.h</tt> was split into components in May 2019 to better
+///  integrate with Autoconf and its feature tests. The splitting occurred so
+///  users could continue to include <tt>config.h</tt> while allowing Autoconf
+///  to write new <tt>config_asm.h</tt> and new <tt>config_cxx.h</tt> using
+///  its feature tests.
+/// \note You should include <tt>config.h</tt> rather than <tt>config_ver.h</tt>
+///  directly.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/835">Issue 835,
+///  Make config.h more autoconf friendly</A>,
+///  <A HREF="https://www.cryptopp.com/wiki/Configure.sh">Configure.sh script</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_CONFIG_VERSION_H
+#define CRYPTOPP_CONFIG_VERSION_H
+
+/// \brief Library major version
+/// \details CRYPTOPP_MAJOR reflects the major version of the library the
+///  headers came from. It is not necessarily the version of the library built
+///  as a shared object if versions are inadvertently mixed and matched.
+/// \sa CRYPTOPP_VERSION, LibraryVersion(), HeaderVersion()
+/// \since Crypto++ 8.2
+#define CRYPTOPP_MAJOR 8
+/// \brief Library minor version
+/// \details CRYPTOPP_MINOR reflects the minor version of the library the
+///  headers came from. It is not necessarily the version of the library built
+///  as a shared object if versions are inadvertently mixed and matched.
+/// \sa CRYPTOPP_VERSION, LibraryVersion(), HeaderVersion()
+/// \since Crypto++ 8.2
+#define CRYPTOPP_MINOR 9
+/// \brief Library revision number
+/// \details CRYPTOPP_REVISION reflects the revision number of the library the
+///  headers came from. It is not necessarily the revision of the library built
+///  as a shared object if versions are inadvertently mixed and matched.
+/// \sa CRYPTOPP_VERSION, LibraryVersion(), HeaderVersion()
+/// \since Crypto++ 8.2
+#define CRYPTOPP_REVISION 0
+
+/// \brief Full library version
+/// \details CRYPTOPP_VERSION reflects the version of the library the headers
+///  came from. It is not necessarily the version of the library built as a
+///  shared object if versions are inadvertently mixed and matched.
+/// \sa CRYPTOPP_MAJOR, CRYPTOPP_MINOR, CRYPTOPP_REVISION, LibraryVersion(), HeaderVersion()
+/// \since Crypto++ 5.6
+#define CRYPTOPP_VERSION 890
+
+// Compiler version macros
+
+// Apple and LLVM Clang versions. Apple Clang version 7.0 roughly equals
+// LLVM Clang version 3.7. Also see https://gist.github.com/yamaya/2924292
+#if defined(__clang__) && defined(__apple_build_version__)
+# define CRYPTOPP_APPLE_CLANG_VERSION (__clang_major__ * 10000 + __clang_minor__ * 100 + __clang_patchlevel__)
+#elif defined(__clang__)
+# define CRYPTOPP_LLVM_CLANG_VERSION  (__clang_major__ * 10000 + __clang_minor__ * 100 + __clang_patchlevel__)
+#endif
+
+// Clang pretends to be other compilers. The compiler gets into
+// code paths that it cannot compile. Unset Clang to save the grief.
+// Also see http://github.com/weidai11/cryptopp/issues/147.
+
+#if defined(__GNUC__) && !defined(__clang__)
+# undef CRYPTOPP_APPLE_CLANG_VERSION
+# undef CRYPTOPP_LLVM_CLANG_VERSION
+# define CRYPTOPP_GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+#endif
+
+#if defined(__xlc__) || defined(__xlC__) && !defined(__clang__)
+# undef CRYPTOPP_LLVM_CLANG_VERSION
+# define CRYPTOPP_XLC_VERSION ((__xlC__ / 256) * 10000 + (__xlC__ % 256) * 100)
+#endif
+
+#if defined(__INTEL_COMPILER) && !defined(__clang__)
+# undef CRYPTOPP_LLVM_CLANG_VERSION
+# define CRYPTOPP_INTEL_VERSION (__INTEL_COMPILER)
+#endif
+
+#if defined(_MSC_VER) && !defined(__clang__)
+# undef CRYPTOPP_LLVM_CLANG_VERSION
+# define CRYPTOPP_MSC_VERSION (_MSC_VER)
+#endif
+
+// To control <x86intrin.h> include. May need a guard, like GCC 4.5 and above
+// Also see https://stackoverflow.com/a/42493893 and https://github.com/weidai11/cryptopp/issues/1198
+#if defined(CRYPTOPP_GCC_VERSION) || defined(CRYPTOPP_APPLE_CLANG_VERSION) || defined(CRYPTOPP_LLVM_CLANG_VERSION)
+# define CRYPTOPP_GCC_COMPATIBLE 1
+#endif
+
+#endif  // CRYPTOPP_CONFIG_VERSION_H
diff --git a/runtime/third_party/cryptopp/cpu.cpp b/runtime/third_party/cryptopp/cpu.cpp
new file mode 100644
index 0000000..bc2a35d
--- /dev/null
+++ b/runtime/third_party/cryptopp/cpu.cpp
@@ -0,0 +1,1472 @@
+// cpu.cpp - originally written and placed in the public domain by Wei Dai
+//           modified by Jeffrey Walton and the community over the years.
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef EXCEPTION_EXECUTE_HANDLER
+# define EXCEPTION_EXECUTE_HANDLER 1
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "cpu.h"
+#include "misc.h"
+#include "stdcpp.h"
+
+// For _xgetbv on Microsoft 32-bit and 64-bit Intel platforms
+// https://github.com/weidai11/cryptopp/issues/972
+#if (CRYPTOPP_MSC_VERSION >= 1600) && (defined(_M_IX86) || defined(_M_X64))
+# include <immintrin.h>
+#endif
+
+// For IsProcessorFeaturePresent on Microsoft Arm64 platforms,
+// https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-isprocessorfeaturepresent
+#if defined(_WIN32) && defined(_M_ARM64)
+# include <Windows.h>
+# include <processthreadsapi.h>
+#endif
+
+#ifdef _AIX
+# include <sys/systemcfg.h>
+#endif
+
+#ifdef __linux__
+# include <unistd.h>
+#endif
+
+// Capability queries, requires Glibc 2.16, http://lwn.net/Articles/519085/
+// CRYPTOPP_GLIBC_VERSION not used because config.h is missing <feature.h>
+#if (((__GLIBC__ * 100) + __GLIBC_MINOR__) >= 216)
+# define CRYPTOPP_GETAUXV_AVAILABLE 1
+#endif
+
+#if CRYPTOPP_GETAUXV_AVAILABLE
+# include <sys/auxv.h>
+#else
+#ifndef AT_HWCAP
+# define AT_HWCAP 16
+#endif
+#ifndef AT_HWCAP2
+# define AT_HWCAP2 26
+#endif
+unsigned long int getauxval(unsigned long int) { return 0; }
+#endif
+
+#if defined(__APPLE__)
+# include <sys/utsname.h>
+# include <sys/sysctl.h>
+#endif
+
+// FreeBSD headers are giving us trouble...
+// https://github.com/weidai11/cryptopp/pull/1029
+#if defined(__FreeBSD__)
+# include <sys/auxv.h>
+# include <sys/elf_common.h>
+#endif
+
+// The cpu-features header and source file are located in
+// "$ANDROID_NDK_ROOT/sources/android/cpufeatures".
+// setenv-android.sh will copy the header and source file
+// into PWD and the makefile will build it in place.
+#if defined(__ANDROID__)
+# include "cpu-features.h"
+#endif
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+// Required by Visual Studio 2008 and below and Clang on Windows.
+// Use it for all MSVC-compatible compilers.
+// XGETBV64 and CPUID64 are in x64dll.asm.
+#if defined(_M_X64) && defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+extern "C" unsigned long long __fastcall XGETBV64(unsigned int);
+extern "C" unsigned long long __fastcall CPUID64(unsigned int, unsigned int, unsigned int*);
+#endif
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+}
+
+extern "C"
+{
+	static jmp_buf s_jmpNoCPUID;
+	static void SigIllHandler(int)
+	{
+		longjmp(s_jmpNoCPUID, 1);
+	}
+}
+#endif  // CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+
+using CryptoPP::word32;
+
+inline bool IsIntel(const word32 output[4])
+{
+	// This is the "GenuineIntel" string
+	return (output[1] /*EBX*/ == 0x756e6547) &&
+		(output[2] /*ECX*/ == 0x6c65746e) &&
+		(output[3] /*EDX*/ == 0x49656e69);
+}
+
+inline bool IsAMD(const word32 output[4])
+{
+	// This is the "AuthenticAMD" string.
+	return ((output[1] /*EBX*/ == 0x68747541) &&
+		(output[2] /*ECX*/ == 0x444D4163) &&
+		(output[3] /*EDX*/ == 0x69746E65)) ||
+		// Early K5's can return "AMDisbetter!"
+		((output[1] /*EBX*/ == 0x69444d41) &&
+		(output[2] /*ECX*/ == 0x74656273) &&
+		(output[3] /*EDX*/ == 0x21726574));
+}
+
+inline bool IsHygon(const word32 output[4])
+{
+	// This is the "HygonGenuine" string.
+	return (output[1] /*EBX*/ == 0x6f677948) &&
+		(output[2] /*ECX*/ == 0x656e6975) &&
+		(output[3] /*EDX*/ == 0x6e65476e);
+}
+
+inline bool IsVIA(const word32 output[4])
+{
+	// This is the "CentaurHauls" string.
+	return ((output[1] /*EBX*/ == 0x746e6543) &&
+		(output[2] /*ECX*/ == 0x736c7561) &&
+		(output[3] /*EDX*/ == 0x48727561)) ||
+		// Some non-PadLock's return "VIA VIA VIA "
+		((output[1] /*EBX*/ == 0x32414956) &&
+		(output[2] /*ECX*/ == 0x32414956) &&
+		(output[3] /*EDX*/ == 0x32414956));
+}
+
+#endif  // X86, X32 and X64
+
+#if defined(__APPLE__)
+
+// http://stackoverflow.com/questions/45637888/how-to-determine-armv8-features-at-runtime-on-ios
+class AppleMachineInfo
+{
+public:
+	enum { PowerMac=1, Mac, iPhone, iPod, iPad, AppleTV, AppleWatch };
+	enum { PowerPC=1, I386, I686, X86_64, ARM32, ARMV8, ARMV82, ARMV83 };
+
+	AppleMachineInfo() : m_device(0), m_version(0), m_arch(0)
+	{
+		struct utsname systemInfo;
+		systemInfo.machine[0] = '\0';
+		uname(&systemInfo);
+
+		std::string machine(systemInfo.machine);
+
+		std::string::size_type pos = machine.find_first_of("0123456789");
+		if (pos != std::string::npos)
+			m_version = std::atoi(machine.substr(pos).c_str());
+
+		if (machine.find("iPhone") != std::string::npos)
+		{
+			m_device = iPhone;
+			if (m_version >= 6) { m_arch = ARMV8; }
+			else { m_arch = ARM32; }
+		}
+		else if (machine.find("iPod") != std::string::npos)
+		{
+			m_device = iPod;
+			if (m_version >= 6) { m_arch = ARMV8; }
+			else { m_arch = ARM32; }
+		}
+		else if (machine.find("iPad") != std::string::npos)
+		{
+			m_device = iPad;
+			if (m_version >= 5) { m_arch = ARMV8; }
+			else { m_arch = ARM32; }
+		}
+		else if (machine.find("PowerMac") != std::string::npos ||
+			 machine.find("Power Macintosh") != std::string::npos)
+		{
+			m_device = PowerMac;
+			m_arch = PowerPC;
+		}
+		else if (machine.find("Mac") != std::string::npos ||
+			 machine.find("Macintosh") != std::string::npos)
+		{
+#if defined(__x86_64) || defined(__amd64)
+			m_device = Mac;
+			m_arch = X86_64;
+#elif defined(__i386)
+			m_device = Mac;
+			m_arch = I386;
+#elif defined(__i686)
+			m_device = Mac;
+			m_arch = I686;
+#else
+			// Should never get here
+			m_device = Mac;
+			m_arch = 0;
+#endif
+		}
+		else if (machine.find("AppleTV") != std::string::npos)
+		{
+			m_device = AppleTV;
+			if (m_version >= 4) { m_arch = ARMV8; }
+			else { m_arch = ARM32; }
+		}
+		else if (machine.find("AppleWatch") != std::string::npos)
+		{
+			m_device = AppleWatch;
+			if (m_version >= 4) { m_arch = ARMV8; }
+			else { m_arch = ARM32; }
+		}
+		else if (machine.find("arm64") != std::string::npos)
+		{
+			// M1 machine?
+			std::string brand;
+			size_t size = 32;
+
+			// Supply an oversized buffer, and avoid
+			// an extra call to sysctlbyname.
+			brand.resize(size);
+			if (sysctlbyname("machdep.cpu.brand_string", &brand[0], &size, NULL, 0) == 0 && size > 0)
+			{
+				if (brand[size-1] == '\0')
+					size--;
+				brand.resize(size);
+			}
+
+			if (brand == "Apple M1")
+			{
+				m_device = Mac;
+				m_arch = ARMV82;
+			}
+			else
+			{
+				// ???
+				m_device = 0;
+				m_arch = ARMV8;
+			}
+		}
+		else
+		{
+			CRYPTOPP_ASSERT(0);
+		}
+	}
+
+	unsigned int Device() const {
+		return m_device;
+	}
+
+	unsigned int Version() const {
+		return m_version;
+	}
+
+	unsigned int Arch() const {
+		return m_arch;
+	}
+
+	bool IsARM32() const {
+		return m_arch == ARM32;
+	}
+
+	bool IsARMv8() const {
+		return m_arch >= ARMV8;
+	}
+
+	bool IsARMv82() const {
+		return m_arch >= ARMV82;
+	}
+
+	bool IsARMv83() const {
+		return m_arch >= ARMV83;
+	}
+
+private:
+	unsigned int m_device, m_version, m_arch;
+};
+
+void GetAppleMachineInfo(unsigned int& device, unsigned int& version, unsigned int& arch)
+{
+#if CRYPTOPP_CXX11_STATIC_INIT
+	static const AppleMachineInfo info;
+#else
+	using CryptoPP::Singleton;
+	const AppleMachineInfo& info = Singleton<AppleMachineInfo>().Ref();
+#endif
+
+	device = info.Device();
+	version = info.Version();
+	arch = info.Arch();
+}
+
+inline bool IsAppleMachineARM32()
+{
+	static unsigned int arch;
+	if (arch == 0)
+	{
+		unsigned int unused;
+		GetAppleMachineInfo(unused, unused, arch);
+	}
+	return arch == AppleMachineInfo::ARM32;
+}
+
+inline bool IsAppleMachineARMv8()
+{
+	static unsigned int arch;
+	if (arch == 0)
+	{
+		unsigned int unused;
+		GetAppleMachineInfo(unused, unused, arch);
+	}
+	return arch >= AppleMachineInfo::ARMV8;
+}
+
+inline bool IsAppleMachineARMv82()
+{
+	static unsigned int arch;
+	if (arch == 0)
+	{
+		unsigned int unused;
+		GetAppleMachineInfo(unused, unused, arch);
+	}
+	return arch >= AppleMachineInfo::ARMV82;
+}
+
+inline bool IsAppleMachineARMv83()
+{
+	static unsigned int arch;
+	if (arch == 0)
+	{
+		unsigned int unused;
+		GetAppleMachineInfo(unused, unused, arch);
+	}
+	return arch >= AppleMachineInfo::ARMV83;
+}
+
+#endif  // __APPLE__
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// *************************** IA-32 CPUs ***************************
+
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+
+bool CRYPTOPP_SECTION_INIT g_x86DetectionDone = false;
+bool CRYPTOPP_SECTION_INIT g_hasSSE2 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSSSE3 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSSE41 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSSE42 = false;
+bool CRYPTOPP_SECTION_INIT g_hasAESNI = false;
+bool CRYPTOPP_SECTION_INIT g_hasCLMUL = false;
+bool CRYPTOPP_SECTION_INIT g_hasMOVBE = false;
+bool CRYPTOPP_SECTION_INIT g_hasAVX = false;
+bool CRYPTOPP_SECTION_INIT g_hasAVX2 = false;
+bool CRYPTOPP_SECTION_INIT g_hasADX = false;
+bool CRYPTOPP_SECTION_INIT g_hasSHA = false;
+bool CRYPTOPP_SECTION_INIT g_hasRDRAND = false;
+bool CRYPTOPP_SECTION_INIT g_hasRDSEED = false;
+bool CRYPTOPP_SECTION_INIT g_isP4 = false;
+bool CRYPTOPP_SECTION_INIT g_hasPadlockRNG = false;
+bool CRYPTOPP_SECTION_INIT g_hasPadlockACE = false;
+bool CRYPTOPP_SECTION_INIT g_hasPadlockACE2 = false;
+bool CRYPTOPP_SECTION_INIT g_hasPadlockPHE = false;
+bool CRYPTOPP_SECTION_INIT g_hasPadlockPMM = false;
+word32 CRYPTOPP_SECTION_INIT g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
+
+// For Solaris 11
+extern bool CPU_ProbeSSE2();
+
+// xcr0 is available when xgetbv is present.
+// The intrinsic is broke on GCC 8.1 and earlier. Also see
+// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85684.
+word64 XGetBV(word32 num)
+{
+#if defined(CRYPTOPP_DISABLE_ASM)
+
+	CRYPTOPP_UNUSED(num);
+	return 0;
+
+// Required by Visual Studio 2008 and below and Clang on Windows.
+// Use it for all MSVC-compatible compilers.
+#elif defined(_M_X64) && defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+
+	return XGETBV64(num);
+
+// Required by Visual Studio 2008 and below and Clang on Windows.
+// Use it for all MSVC-compatible compilers.
+#elif defined(_M_IX86) && defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+
+	word32 a=0, d=0;
+	__asm {
+		push eax
+		push edx
+		push ecx
+		mov ecx, num
+		_emit 0x0f
+		_emit 0x01
+		_emit 0xd0
+		mov a, eax
+		mov d, edx
+		pop ecx
+		pop edx
+		pop eax
+	}
+	return (static_cast<word64>(d) << 32) | a;
+
+// GCC 4.4 and above
+#elif (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 4))
+
+	word32 a=0, d=0;
+	__asm__
+	(
+		"xgetbv" : "=a"(a), "=d"(d) : "c"(num) : "cc"
+	);
+	return (static_cast<word64>(d) << 32) | a;
+
+// Remainder of GCC and compatibles.
+#elif defined(__GNUC__) || defined(__clang__) || defined(__SUNPRO_CC)
+
+	// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71659 and
+	// http://www.agner.org/optimize/vectorclass/read.php?i=65
+	word32 a=0, d=0;
+	__asm__
+	(
+		".byte 0x0f, 0x01, 0xd0"      "\n\t"
+		: "=a"(a), "=d"(d) : "c"(num) : "cc"
+	);
+	return (static_cast<word64>(d) << 32) | a;
+#else
+	# error "Need an xgetbv function"
+#endif
+}
+
+// No inline due to Borland/Embarcadero and Issue 498
+// cpu.cpp (131): E2211 Inline assembly not allowed in inline and template functions
+bool CpuId(word32 func, word32 subfunc, word32 output[4])
+{
+#if defined(CRYPTOPP_DISABLE_ASM)
+
+	CRYPTOPP_UNUSED(func); CRYPTOPP_UNUSED(subfunc);
+	output[0] = output[1] = output[2] = output[3] = 0;
+	return false;
+
+// Required by Visual Studio 2008 and below and Clang on Windows.
+// Use it for all MSVC-compatible compilers.
+#elif defined(_M_X64) && defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+
+	CPUID64(func, subfunc, output);
+	return true;
+
+// Required by Visual Studio 2008 and below and Clang on Windows.
+// Use it for all MSVC-compatible compilers.
+#elif defined(_M_IX86) && defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+
+	__try
+	{
+		// Borland/Embarcadero and Issue 500
+		// Local variables for cpuid output
+		word32 a, b, c, d;
+		__asm
+		{
+			push ebx
+			mov eax, func
+			mov ecx, subfunc
+			cpuid
+			mov [a], eax
+			mov [b], ebx
+			mov [c], ecx
+			mov [d], edx
+			pop ebx
+		}
+		output[0] = a;
+		output[1] = b;
+		output[2] = c;
+		output[3] = d;
+	}
+	__except (EXCEPTION_EXECUTE_HANDLER)
+	{
+		return false;
+	}
+
+	return true;
+
+// Linux, Unix, OS X, Solaris, Cygwin, MinGW
+#else
+
+	// longjmp and clobber warnings. Volatile is required.
+	// http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+	volatile bool result = true;
+
+	volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+	if (oldHandler == SIG_ERR)
+		return false;
+
+# ifndef __MINGW32__
+	volatile sigset_t oldMask;
+	if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask) != 0)
+	{
+		signal(SIGILL, oldHandler);
+		return false;
+	}
+# endif
+
+	if (setjmp(s_jmpNoCPUID))
+		result = false;
+	else
+	{
+		asm volatile
+		(
+			// save ebx in case -fPIC is being used
+# if CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64
+			"pushq %%rbx; cpuid; mov %%ebx, %%edi; popq %%rbx"
+# else
+			"push %%ebx; cpuid; mov %%ebx, %%edi; pop %%ebx"
+# endif
+			: "=a" (output[0]), "=D" (output[1]), "=c" (output[2]), "=d" (output[3])
+			: "a" (func), "c" (subfunc)
+			: "cc"
+		);
+	}
+
+# ifndef __MINGW32__
+	sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+# endif
+
+	signal(SIGILL, oldHandler);
+	return result;
+#endif
+}
+
+void DetectX86Features()
+{
+	// Coverity finding CID 171239. Initialize arrays.
+	// Indexes: EAX=0, EBX=1, ECX=2, EDX=3
+	word32 cpuid0[4]={0}, cpuid1[4]={0}, cpuid2[4]={0};
+
+#if defined(CRYPTOPP_DISABLE_ASM)
+	// Not available
+	goto done;
+#else
+	if (!CpuId(0, 0, cpuid0))
+		goto done;
+	if (!CpuId(1, 0, cpuid1))
+		goto done;
+#endif
+
+	CRYPTOPP_CONSTANT(EAX_REG = 0);
+	CRYPTOPP_CONSTANT(EBX_REG = 1);
+	CRYPTOPP_CONSTANT(ECX_REG = 2);
+	CRYPTOPP_CONSTANT(EDX_REG = 3);
+
+	CRYPTOPP_CONSTANT(MMX_FLAG   = (1 << 24));   // EDX
+	CRYPTOPP_CONSTANT(SSE_FLAG   = (1 << 25));   // EDX
+	CRYPTOPP_CONSTANT(SSE2_FLAG  = (1 << 26));   // EDX
+
+	CRYPTOPP_CONSTANT(SSE3_FLAG  = (1 <<  0));   // ECX
+	CRYPTOPP_CONSTANT(SSSE3_FLAG = (1 <<  9));   // ECX
+	CRYPTOPP_CONSTANT(SSE41_FLAG = (1 << 19));   // ECX
+	CRYPTOPP_CONSTANT(SSE42_FLAG = (1 << 20));   // ECX
+	CRYPTOPP_CONSTANT(MOVBE_FLAG = (1 << 22));   // ECX
+	CRYPTOPP_CONSTANT(AESNI_FLAG = (1 << 25));   // ECX
+	CRYPTOPP_CONSTANT(CLMUL_FLAG = (1 <<  1));   // ECX
+
+	CRYPTOPP_CONSTANT(XSAVE_FLAG   = (1 << 26)); // ECX
+	CRYPTOPP_CONSTANT(OSXSAVE_FLAG = (1 << 27)); // ECX
+
+	CRYPTOPP_CONSTANT(AVX_FLAG = (3 << 27));     // ECX
+	CRYPTOPP_CONSTANT(YMM_FLAG = (3 <<  1));     // CR0
+
+    // x86_64 machines don't check some flags because SSE2
+    // is part of the core instruction set architecture
+    CRYPTOPP_UNUSED(MMX_FLAG); CRYPTOPP_UNUSED(SSE_FLAG);
+    CRYPTOPP_UNUSED(SSE2_FLAG); CRYPTOPP_UNUSED(SSE3_FLAG);
+    CRYPTOPP_UNUSED(XSAVE_FLAG);
+
+#if (CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+	// 64-bit core instruction set includes SSE2. Just check
+	// the OS enabled SSE2 support using OSXSAVE.
+	g_hasSSE2 = (cpuid1[ECX_REG] & OSXSAVE_FLAG) != 0;
+#else
+	// Check the processor supports SSE2. Then use OSXSAVE to
+	// signal OS support for SSE2 to avoid probes.
+	// Also see http://stackoverflow.com/a/22521619/608639
+	// and http://github.com/weidai11/cryptopp/issues/511.
+	if ((cpuid1[EDX_REG] & SSE2_FLAG) == SSE2_FLAG)
+		g_hasSSE2 = (cpuid1[ECX_REG] & XSAVE_FLAG) != 0 &&
+		            (cpuid1[ECX_REG] & OSXSAVE_FLAG) != 0;
+#endif
+
+#if defined(__sun)
+	// Solaris 11 i86pc does not signal SSE support using
+	// OSXSAVE. We need to probe for SSE support.
+	if (g_hasSSE2 == false)
+		g_hasSSE2 = CPU_ProbeSSE2();
+#endif
+
+	if (g_hasSSE2 == false)
+		goto done;
+
+	g_hasSSSE3 = (cpuid1[ECX_REG] & SSSE3_FLAG) != 0;
+	g_hasSSE41 = (cpuid1[ECX_REG] & SSE41_FLAG) != 0;
+	g_hasSSE42 = (cpuid1[ECX_REG] & SSE42_FLAG) != 0;
+	g_hasMOVBE = (cpuid1[ECX_REG] & MOVBE_FLAG) != 0;
+	g_hasAESNI = (cpuid1[ECX_REG] & AESNI_FLAG) != 0;
+	g_hasCLMUL = (cpuid1[ECX_REG] & CLMUL_FLAG) != 0;
+
+	// AVX is similar to SSE. Check if AVX is available on the cpu, then
+	// check if the OS enabled XSAVE/XRESTORE for the extended registers.
+	// https://software.intel.com/en-us/blogs/2011/04/14/is-avx-enabled
+	if ((cpuid1[ECX_REG] & AVX_FLAG) == AVX_FLAG)
+	{
+		word64 xcr0 = XGetBV(0);
+		g_hasAVX = (xcr0 & YMM_FLAG) == YMM_FLAG;
+	}
+
+	if (IsIntel(cpuid0))
+	{
+		CRYPTOPP_CONSTANT(RDRAND_FLAG = (1 << 30));
+		CRYPTOPP_CONSTANT(RDSEED_FLAG = (1 << 18));
+		CRYPTOPP_CONSTANT(   ADX_FLAG = (1 << 19));
+		CRYPTOPP_CONSTANT(   SHA_FLAG = (1 << 29));
+		CRYPTOPP_CONSTANT(  AVX2_FLAG = (1 <<  5));
+
+		g_isP4 = ((cpuid1[0] >> 8) & 0xf) == 0xf;
+		g_cacheLineSize = 8 * GETBYTE(cpuid1[1], 1);
+		g_hasRDRAND = (cpuid1[ECX_REG] & RDRAND_FLAG) != 0;
+
+		if (cpuid0[EAX_REG] >= 7)
+		{
+			if (CpuId(7, 0, cpuid2))
+			{
+				g_hasRDSEED = (cpuid2[EBX_REG] & RDSEED_FLAG) != 0;
+				g_hasADX    = (cpuid2[EBX_REG] & ADX_FLAG) != 0;
+				g_hasSHA    = (cpuid2[EBX_REG] & SHA_FLAG) != 0;
+				g_hasAVX2   = (cpuid2[EBX_REG] & AVX2_FLAG) != 0;
+			}
+		}
+	}
+	else if (IsAMD(cpuid0) || IsHygon(cpuid0))
+	{
+		CRYPTOPP_CONSTANT(RDRAND_FLAG = (1 << 30));
+		CRYPTOPP_CONSTANT(RDSEED_FLAG = (1 << 18));
+		CRYPTOPP_CONSTANT(   ADX_FLAG = (1 << 19));
+		CRYPTOPP_CONSTANT(   SHA_FLAG = (1 << 29));
+		CRYPTOPP_CONSTANT(  AVX2_FLAG = (1 <<  5));
+
+		CpuId(0x80000005, 0, cpuid2);
+		g_cacheLineSize = GETBYTE(cpuid2[ECX_REG], 0);
+		g_hasRDRAND = (cpuid1[ECX_REG] & RDRAND_FLAG) != 0;
+
+		if (cpuid0[EAX_REG] >= 7)
+		{
+			if (CpuId(7, 0, cpuid2))
+			{
+				g_hasRDSEED = (cpuid2[EBX_REG] & RDSEED_FLAG) != 0;
+				g_hasADX    = (cpuid2[EBX_REG] & ADX_FLAG) != 0;
+				g_hasSHA    = (cpuid2[EBX_REG] & SHA_FLAG) != 0;
+				g_hasAVX2   = (cpuid2[EBX_REG] & AVX2_FLAG) != 0;
+			}
+		}
+
+		// Unconditionally disable RDRAND and RDSEED on AMD cpu's with family 15h or 16h.
+		// See Crypto++ Issue 924, https://github.com/weidai11/cryptopp/issues/924,
+		// Clear RDRAND CPUID bit on AMD family 15h/16h, https://lore.kernel.org/patchwork/patch/1115413/,
+		// and AMD CPUID Specification, https://www.amd.com/system/files/TechDocs/25481.pdf
+		{
+			CRYPTOPP_CONSTANT(FAMILY_BASE_FLAG = (0x0f << 8));
+			CRYPTOPP_CONSTANT(FAMILY_EXT_FLAG = (0xff << 20));
+
+			word32 family = (cpuid1[0] & FAMILY_BASE_FLAG) >> 8;
+			if (family == 0xf)
+				family += (cpuid1[0] & FAMILY_EXT_FLAG) >> 20;
+			if (family == 0x15 || family == 0x16)
+			{
+				g_hasRDRAND = false;
+				g_hasRDSEED = false;
+			}
+		}
+	}
+	else if (IsVIA(cpuid0))
+	{
+		// Two bits: available and enabled
+		CRYPTOPP_CONSTANT( RNG_FLAGS = (0x3 << 2));
+		CRYPTOPP_CONSTANT( ACE_FLAGS = (0x3 << 6));
+		CRYPTOPP_CONSTANT(ACE2_FLAGS = (0x3 << 8));
+		CRYPTOPP_CONSTANT( PHE_FLAGS = (0x3 << 10));
+		CRYPTOPP_CONSTANT( PMM_FLAGS = (0x3 << 12));
+
+		CpuId(0xC0000000, 0, cpuid2);
+		word32 extendedFeatures = cpuid2[0];
+
+		if (extendedFeatures >= 0xC0000001)
+		{
+			CpuId(0xC0000001, 0, cpuid2);
+			g_hasPadlockRNG  = (cpuid2[EDX_REG] & RNG_FLAGS) != 0;
+			g_hasPadlockACE  = (cpuid2[EDX_REG] & ACE_FLAGS) != 0;
+			g_hasPadlockACE2 = (cpuid2[EDX_REG] & ACE2_FLAGS) != 0;
+			g_hasPadlockPHE  = (cpuid2[EDX_REG] & PHE_FLAGS) != 0;
+			g_hasPadlockPMM  = (cpuid2[EDX_REG] & PMM_FLAGS) != 0;
+		}
+
+		if (extendedFeatures >= 0xC0000005)
+		{
+			CpuId(0xC0000005, 0, cpuid2);
+			g_cacheLineSize = GETBYTE(cpuid2[ECX_REG], 0);
+		}
+	}
+
+	// Keep AVX2 in sync with OS support for AVX. AVX tests both
+	// cpu support and OS support, while AVX2 only tests cpu support.
+	g_hasAVX2 &= g_hasAVX;
+
+done:
+
+#if defined(_SC_LEVEL1_DCACHE_LINESIZE)
+	// Glibc does not implement on some platforms. The runtime returns 0 instead of error.
+	// https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/posix/sysconf.c
+	int cacheLineSize = (int)sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+	if (g_cacheLineSize == 0 && cacheLineSize > 0)
+		g_cacheLineSize = cacheLineSize;
+#endif
+
+	if (g_cacheLineSize == 0)
+		g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
+
+	*const_cast<volatile bool*>(&g_x86DetectionDone) = true;
+}
+
+// *************************** ARM-32, Aarch32 and Aarch64 ***************************
+
+#elif (CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8)
+
+bool CRYPTOPP_SECTION_INIT g_ArmDetectionDone = false;
+bool CRYPTOPP_SECTION_INIT g_hasARMv7 = false;
+bool CRYPTOPP_SECTION_INIT g_hasNEON = false;
+bool CRYPTOPP_SECTION_INIT g_hasPMULL = false;
+bool CRYPTOPP_SECTION_INIT g_hasCRC32 = false;
+bool CRYPTOPP_SECTION_INIT g_hasAES = false;
+bool CRYPTOPP_SECTION_INIT g_hasSHA1 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSHA2 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSHA512 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSHA3 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSM3 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSM4 = false;
+word32 CRYPTOPP_SECTION_INIT g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
+
+// ARM does not have an unprivileged equivalent to CPUID on IA-32. We have to
+// jump through some hoops to detect features on a wide array of platforms.
+// Our strategy is two part. First, attempt to *Query* the OS for a feature,
+// like using getauxval on Linux. If that fails, then *Probe* the cpu
+// executing an instruction and an observe a SIGILL if unsupported. The probes
+// are in source files where compilation options like -march=armv8-a+crc make
+// intrinsics available. They are expensive when compared to a standard OS
+// feature query. Always perform the feature query first. For Linux see
+// http://sourceware.org/ml/libc-help/2017-08/msg00012.html
+// Avoid probes on Apple platforms because Apple's signal handling for SIGILLs
+// appears broken. We are trying to figure out a way to feature test without
+// probes. Also see http://stackoverflow.com/a/11197770/608639 and
+// http://gist.github.com/erkanyildiz/390a480f27e86f8cd6ba.
+
+extern bool CPU_ProbeARMv7();
+extern bool CPU_ProbeNEON();
+extern bool CPU_ProbeCRC32();
+extern bool CPU_ProbeAES();
+extern bool CPU_ProbeSHA1();
+extern bool CPU_ProbeSHA256();
+extern bool CPU_ProbeSHA512();
+extern bool CPU_ProbeSHA3();
+extern bool CPU_ProbeSM3();
+extern bool CPU_ProbeSM4();
+extern bool CPU_ProbePMULL();
+
+// https://github.com/torvalds/linux/blob/master/arch/arm/include/uapi/asm/hwcap.h
+// https://github.com/torvalds/linux/blob/master/arch/arm64/include/uapi/asm/hwcap.h
+#ifndef HWCAP_ARMv7
+# define HWCAP_ARMv7 (1 << 29)
+#endif
+#ifndef HWCAP_ASIMD
+# define HWCAP_ASIMD (1 << 1)
+#endif
+#ifndef HWCAP_NEON
+# define HWCAP_NEON (1 << 12)
+#endif
+#ifndef HWCAP_CRC32
+# define HWCAP_CRC32 (1 << 7)
+#endif
+#ifndef HWCAP2_CRC32
+# define HWCAP2_CRC32 (1 << 4)
+#endif
+#ifndef HWCAP_PMULL
+# define HWCAP_PMULL (1 << 4)
+#endif
+#ifndef HWCAP2_PMULL
+# define HWCAP2_PMULL (1 << 1)
+#endif
+#ifndef HWCAP_AES
+# define HWCAP_AES (1 << 3)
+#endif
+#ifndef HWCAP2_AES
+# define HWCAP2_AES (1 << 0)
+#endif
+#ifndef HWCAP_SHA1
+# define HWCAP_SHA1 (1 << 5)
+#endif
+#ifndef HWCAP_SHA2
+# define HWCAP_SHA2 (1 << 6)
+#endif
+#ifndef HWCAP2_SHA1
+# define HWCAP2_SHA1 (1 << 2)
+#endif
+#ifndef HWCAP2_SHA2
+# define HWCAP2_SHA2 (1 << 3)
+#endif
+#ifndef HWCAP_SHA3
+# define HWCAP_SHA3 (1 << 17)
+#endif
+#ifndef HWCAP_SM3
+# define HWCAP_SM3 (1 << 18)
+#endif
+#ifndef HWCAP_SM4
+# define HWCAP_SM4 (1 << 19)
+#endif
+#ifndef HWCAP_SHA512
+# define HWCAP_SHA512 (1 << 21)
+#endif
+
+inline bool CPU_QueryARMv7()
+{
+#if defined(__ANDROID__) && defined(__arm__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_ARMv7) != 0))
+		return true;
+#elif defined(__linux__) && defined(__arm__)
+	if ((getauxval(AT_HWCAP) & HWCAP_ARMv7) != 0 ||
+	    (getauxval(AT_HWCAP) & HWCAP_NEON) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__arm__)
+	// Apple hardware is ARMv7 or above.
+	return true;
+#elif defined(_WIN32) && defined(_M_ARM64)
+	// Windows 10 ARM64 is only supported on Armv8a and above
+	return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QueryNEON()
+{
+#if defined(__ANDROID__) && defined(__aarch64__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_ASIMD) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__arm__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_NEON) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_ASIMD) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_ASIMD) != 0)
+		return true;
+#elif defined(__linux__) && defined(__arm__)
+	if ((getauxval(AT_HWCAP) & HWCAP_NEON) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__)
+	// Core feature set for Aarch32 and Aarch64.
+	if (IsAppleMachineARMv8())
+		return true;
+#elif defined(_WIN32) && defined(_M_ARM64)
+	// Windows 10 ARM64 is only supported on Armv8a and above
+	if (IsProcessorFeaturePresent(PF_ARM_V8_INSTRUCTIONS_AVAILABLE) != 0)
+		return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QueryCRC32()
+{
+#if defined(__ANDROID__) && defined(__aarch64__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_CRC32) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__aarch32__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_CRC32) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_CRC32) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_CRC32) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__)
+	// M1 processor
+	if (IsAppleMachineARMv82())
+		return true;
+#elif defined(_WIN32) && defined(_M_ARM64)
+	if (IsProcessorFeaturePresent(PF_ARM_V8_CRC32_INSTRUCTIONS_AVAILABLE) != 0)
+		return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QueryPMULL()
+{
+#if defined(__ANDROID__) && defined(__aarch64__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_PMULL) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__aarch32__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_PMULL) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_PMULL) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_PMULL) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__)
+	// M1 processor
+	if (IsAppleMachineARMv82())
+		return true;
+#elif defined(_WIN32) && defined(_M_ARM64)
+	if (IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE) != 0)
+		return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QueryAES()
+{
+#if defined(__ANDROID__) && defined(__aarch64__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_AES) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__aarch32__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_AES) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_AES) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_AES) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__)
+	// M1 processor
+	if (IsAppleMachineARMv82())
+		return true;
+#elif defined(_WIN32) && defined(_M_ARM64)
+	if (IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE) != 0)
+		return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QuerySHA1()
+{
+#if defined(__ANDROID__) && defined(__aarch64__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_SHA1) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__aarch32__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_SHA1) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_SHA1) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_SHA1) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__)
+	// M1 processor
+	if (IsAppleMachineARMv82())
+		return true;
+#elif defined(_WIN32) && defined(_M_ARM64)
+	if (IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE) != 0)
+		return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QuerySHA256()
+{
+#if defined(__ANDROID__) && defined(__aarch64__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_SHA2) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__aarch32__)
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_SHA2) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_SHA2) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_SHA2) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__)
+	// M1 processor
+	if (IsAppleMachineARMv82())
+		return true;
+#elif defined(_WIN32) && defined(_M_ARM64)
+	if (IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE) != 0)
+		return true;
+#endif
+	return false;
+}
+
+// Some ARMv8.2 features are disabled at the moment
+inline bool CPU_QuerySHA3()
+{
+	// According to the ARM manual, SHA3 depends upon SHA1 and SHA2.
+	// If SHA1 and SHA2 are not present, then SHA3 and SHA512 are
+	// not present. Also see Arm A64 Instruction Set Architecture,
+	// https://developer.arm.com/documentation/ddi0596/2020-12/
+	if (!g_hasSHA1 || !g_hasSHA2) { return false; }
+
+#if defined(__ANDROID__) && defined(__aarch64__) && 0
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_SHA3) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__aarch32__) && 0
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_SHA3) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_SHA3) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_SHA3) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__)
+	// M1 processor
+	if (IsAppleMachineARMv82())
+		return true;
+#endif
+	return false;
+}
+
+// Some ARMv8.2 features are disabled at the moment
+inline bool CPU_QuerySHA512()
+{
+	// According to the ARM manual, SHA512 depends upon SHA1 and SHA2.
+	// If SHA1 and SHA2 are not present, then SHA3 and SHA512 are
+	// not present. Also see Arm A64 Instruction Set Architecture,
+	// https://developer.arm.com/documentation/ddi0596/2020-12/
+	if (!g_hasSHA1 || !g_hasSHA2) { return false; }
+
+#if defined(__ANDROID__) && defined(__aarch64__) && 0
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_SHA512) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__aarch32__) && 0
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_SHA512) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_SHA512) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_SHA512) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__)
+	// M1 processor
+	if (IsAppleMachineARMv82())
+		return true;
+#endif
+	return false;
+}
+
+// Some ARMv8.2 features are disabled at the moment
+inline bool CPU_QuerySM3()
+{
+#if defined(__ANDROID__) && defined(__aarch64__) && 0
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_SM3) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__aarch32__) && 0
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_SM3) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_SM3) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_SM3) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__) && 0
+	// No Apple support yet.
+#endif
+	return false;
+}
+
+// Some ARMv8.2 features are disabled at the moment
+inline bool CPU_QuerySM4()
+{
+#if defined(__ANDROID__) && defined(__aarch64__) && 0
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM64) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM64_FEATURE_SM4) != 0))
+		return true;
+#elif defined(__ANDROID__) && defined(__aarch32__) && 0
+	if (((android_getCpuFamily() & ANDROID_CPU_FAMILY_ARM) != 0) &&
+		((android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_SM4) != 0))
+		return true;
+#elif defined(__linux__) && defined(__aarch64__)
+	if ((getauxval(AT_HWCAP) & HWCAP_SM4) != 0)
+		return true;
+#elif defined(__linux__) && defined(__aarch32__)
+	if ((getauxval(AT_HWCAP2) & HWCAP2_SM4) != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__aarch64__) && 0
+	// No Apple support yet.
+#endif
+	return false;
+}
+
+void DetectArmFeatures()
+{
+#ifndef CRYPTOPP_DISABLE_ASM
+
+	// The CPU_ProbeXXX's return false for OSes which
+	// can't tolerate SIGILL-based probes
+	g_hasARMv7 = CPU_QueryARMv7() || CPU_ProbeARMv7();
+	g_hasNEON = CPU_QueryNEON() || CPU_ProbeNEON();
+	g_hasCRC32 = CPU_QueryCRC32() || CPU_ProbeCRC32();
+	g_hasPMULL = CPU_QueryPMULL() || CPU_ProbePMULL();
+	g_hasAES  = CPU_QueryAES() || CPU_ProbeAES();
+	g_hasSHA1 = CPU_QuerySHA1() || CPU_ProbeSHA1();
+	g_hasSHA2 = CPU_QuerySHA256() || CPU_ProbeSHA256();
+	g_hasSHA512 = CPU_QuerySHA512(); // || CPU_ProbeSHA512();
+	g_hasSHA3 = CPU_QuerySHA3(); // || CPU_ProbeSHA3();
+	g_hasSM3 = CPU_QuerySM3(); // || CPU_ProbeSM3();
+	g_hasSM4 = CPU_QuerySM4(); // || CPU_ProbeSM4();
+
+#if defined(_SC_LEVEL1_DCACHE_LINESIZE)
+	// Glibc does not implement on some platforms. The runtime returns 0 instead of error.
+	// https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/posix/sysconf.c
+	int cacheLineSize = (int)sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+	if (cacheLineSize > 0)
+		g_cacheLineSize = cacheLineSize;
+#endif
+
+	if (g_cacheLineSize == 0)
+		g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
+
+#endif  // CRYPTOPP_DISABLE_ASM
+
+	*const_cast<volatile bool*>(&g_ArmDetectionDone) = true;
+}
+
+// *************************** PowerPC and PowerPC64 ***************************
+
+#elif (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+
+bool CRYPTOPP_SECTION_INIT g_PowerPcDetectionDone = false;
+bool CRYPTOPP_SECTION_INIT g_hasAltivec = false;
+bool CRYPTOPP_SECTION_INIT g_hasPower7 = false;
+bool CRYPTOPP_SECTION_INIT g_hasPower8 = false;
+bool CRYPTOPP_SECTION_INIT g_hasPower9 = false;
+bool CRYPTOPP_SECTION_INIT g_hasAES = false;
+bool CRYPTOPP_SECTION_INIT g_hasPMULL = false;
+bool CRYPTOPP_SECTION_INIT g_hasSHA256 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSHA512 = false;
+bool CRYPTOPP_SECTION_INIT g_hasDARN = false;
+word32 CRYPTOPP_SECTION_INIT g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
+
+extern bool CPU_ProbeAltivec();
+extern bool CPU_ProbePower7();
+extern bool CPU_ProbePower8();
+extern bool CPU_ProbePower9();
+extern bool CPU_ProbeAES();
+extern bool CPU_ProbePMULL();
+extern bool CPU_ProbeSHA256();
+extern bool CPU_ProbeSHA512();
+extern bool CPU_ProbeDARN();
+
+// AIX defines. We used to just call __power_7_andup()
+// and friends but at Power9, too many compilers were
+// missing __power_9_andup(). Instead we switched to
+// a pattern similar to OpenSSL caps testing.
+#ifndef __power_6_andup
+# define __power_6_andup() __power_set(0xffffffffU<<14)
+#endif
+#ifndef __power_7_andup
+# define __power_7_andup() __power_set(0xffffffffU<<15)
+#endif
+#ifndef __power_8_andup
+# define __power_8_andup() __power_set(0xffffffffU<<16)
+#endif
+#ifndef __power_9_andup
+# define __power_9_andup() __power_set(0xffffffffU<<17)
+#endif
+
+// AIX first supported Altivec at Power6, though it
+// was available much earlier for other vendors.
+inline bool CPU_QueryAltivec()
+{
+#if defined(__linux__) && defined(PPC_FEATURE_HAS_ALTIVEC)
+	if ((getauxval(AT_HWCAP) & PPC_FEATURE_HAS_ALTIVEC) != 0)
+		return true;
+#elif defined(_AIX)
+	if (__power_6_andup() != 0)
+		return true;
+#elif defined(__APPLE__) && defined(__POWERPC__)
+	unsigned int unused, arch;
+	GetAppleMachineInfo(unused, unused, arch);
+	return arch == AppleMachineInfo::PowerMac;
+#elif defined(__FreeBSD__) && defined(PPC_FEATURE_HAS_ALTIVEC)
+	unsigned long cpufeatures;
+	if (elf_aux_info(AT_HWCAP, &cpufeatures, sizeof(cpufeatures)) == 0)
+		if ((cpufeatures & PPC_FEATURE_HAS_ALTIVEC) != 0)
+			return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QueryPower7()
+{
+	// Power7 and ISA 2.06
+#if defined(__linux__) && defined(PPC_FEATURE_ARCH_2_06)
+	if ((getauxval(AT_HWCAP) & PPC_FEATURE_ARCH_2_06) != 0)
+		return true;
+#elif defined(_AIX)
+	if (__power_7_andup() != 0)
+		return true;
+#elif defined(__FreeBSD__) && defined(PPC_FEATURE_ARCH_2_06)
+	unsigned long cpufeatures;
+	if (elf_aux_info(AT_HWCAP, &cpufeatures, sizeof(cpufeatures)) == 0)
+		if ((cpufeatures & PPC_FEATURE_ARCH_2_06) != 0)
+			return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QueryPower8()
+{
+	// Power8 and ISA 2.07 provide in-core crypto.
+#if defined(__linux__) && defined(PPC_FEATURE2_ARCH_2_07)
+	if ((getauxval(AT_HWCAP2) & PPC_FEATURE2_ARCH_2_07) != 0)
+		return true;
+#elif defined(_AIX)
+	if (__power_8_andup() != 0)
+		return true;
+#elif defined(__FreeBSD__) && defined(PPC_FEATURE2_ARCH_2_07)
+	unsigned long cpufeatures;
+	if (elf_aux_info(AT_HWCAP, &cpufeatures, sizeof(cpufeatures)) == 0)
+		if ((cpufeatures & PPC_FEATURE_ARCH_2_07) != 0)
+			return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QueryPower9()
+{
+	// Power9 and ISA 3.0.
+#if defined(__linux__) && defined(PPC_FEATURE2_ARCH_3_00)
+	if ((getauxval(AT_HWCAP2) & PPC_FEATURE2_ARCH_3_00) != 0)
+		return true;
+#elif defined(_AIX)
+	if (__power_9_andup() != 0)
+		return true;
+#elif defined(__FreeBSD__) && defined(PPC_FEATURE2_ARCH_3_00)
+	unsigned long cpufeatures;
+	if (elf_aux_info(AT_HWCAP, &cpufeatures, sizeof(cpufeatures)) == 0)
+		if ((cpufeatures & PPC_FEATURE_ARCH2_3_00) != 0)
+			return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QueryAES()
+{
+	// Power8 and ISA 2.07 provide in-core crypto. Glibc
+	// 2.24 or higher is required for PPC_FEATURE2_VEC_CRYPTO.
+#if defined(__linux__) && defined(PPC_FEATURE2_VEC_CRYPTO)
+	if ((getauxval(AT_HWCAP2) & PPC_FEATURE2_VEC_CRYPTO) != 0)
+		return true;
+#elif defined(_AIX)
+	if (__power_8_andup() != 0)
+		return true;
+#elif defined(__FreeBSD__) && defined(PPC_FEATURE2_HAS_VEC_CRYPTO)
+	unsigned long cpufeatures;
+	if (elf_aux_info(AT_HWCAP2, &cpufeatures, sizeof(cpufeatures)) == 0)
+		if ((cpufeatures & PPC_FEATURE2_HAS_VEC_CRYPTO != 0)
+			return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QueryPMULL()
+{
+	// Power8 and ISA 2.07 provide in-core crypto. Glibc
+	// 2.24 or higher is required for PPC_FEATURE2_VEC_CRYPTO.
+#if defined(__linux__) && defined(PPC_FEATURE2_VEC_CRYPTO)
+	if ((getauxval(AT_HWCAP2) & PPC_FEATURE2_VEC_CRYPTO) != 0)
+		return true;
+#elif defined(_AIX)
+	if (__power_8_andup() != 0)
+		return true;
+#elif defined(__FreeBSD__) && defined(PPC_FEATURE2_HAS_VEC_CRYPTO)
+	unsigned long cpufeatures;
+	if (elf_aux_info(AT_HWCAP2, &cpufeatures, sizeof(cpufeatures)) == 0)
+		if ((cpufeatures & PPC_FEATURE2_HAS_VEC_CRYPTO != 0)
+			return true;
+#endif
+	return false;
+}
+
+inline bool CPU_QuerySHA256()
+{
+	// Power8 and ISA 2.07 provide in-core crypto. Glibc
+	// 2.24 or higher is required for PPC_FEATURE2_VEC_CRYPTO.
+#if defined(__linux__) && defined(PPC_FEATURE2_VEC_CRYPTO)
+	if ((getauxval(AT_HWCAP2) & PPC_FEATURE2_VEC_CRYPTO) != 0)
+		return true;
+#elif defined(_AIX)
+	if (__power_8_andup() != 0)
+		return true;
+#elif defined(__FreeBSD__) && defined(PPC_FEATURE2_HAS_VEC_CRYPTO)
+	unsigned long cpufeatures;
+	if (elf_aux_info(AT_HWCAP2, &cpufeatures, sizeof(cpufeatures)) == 0)
+		if ((cpufeatures & PPC_FEATURE2_HAS_VEC_CRYPTO != 0)
+			return true;
+#endif
+	return false;
+}
+inline bool CPU_QuerySHA512()
+{
+	// Power8 and ISA 2.07 provide in-core crypto. Glibc
+	// 2.24 or higher is required for PPC_FEATURE2_VEC_CRYPTO.
+#if defined(__linux__) && defined(PPC_FEATURE2_VEC_CRYPTO)
+	if ((getauxval(AT_HWCAP2) & PPC_FEATURE2_VEC_CRYPTO) != 0)
+		return true;
+#elif defined(_AIX)
+	if (__power_8_andup() != 0)
+		return true;
+#elif defined(__FreeBSD__) && defined(PPC_FEATURE2_HAS_VEC_CRYPTO)
+	unsigned long cpufeatures;
+	if (elf_aux_info(AT_HWCAP2, &cpufeatures, sizeof(cpufeatures)) == 0)
+		if ((cpufeatures & PPC_FEATURE2_HAS_VEC_CRYPTO != 0)
+			return true;
+#endif
+	return false;
+}
+
+// Power9 random number generator
+inline bool CPU_QueryDARN()
+{
+	// Power9 and ISA 3.0 provide DARN. It looks like
+	// Glibc offers PPC_FEATURE2_DARN.
+#if defined(__linux__) && defined(PPC_FEATURE2_ARCH_3_00)
+	if ((getauxval(AT_HWCAP2) & PPC_FEATURE2_ARCH_3_00) != 0)
+		return true;
+#elif defined(_AIX)
+	if (__power_9_andup() != 0)
+		return true;
+#elif defined(__FreeBSD__) && defined(PPC_FEATURE2_ARCH_3_00)
+	unsigned long cpufeatures;
+	if (elf_aux_info(AT_HWCAP2, &cpufeatures, sizeof(cpufeatures)) == 0)
+		if ((cpufeatures & PPC_FEATURE2_ARCH_3_00) != 0)
+			return true;
+#endif
+	return false;
+}
+
+void DetectPowerPcFeatures()
+{
+	// GCC 10 is giving us trouble in CPU_ProbePower9() and CPU_ProbeDARN().
+	// GCC is generating POWER9 instructions on POWER8 for ppc_power9.cpp.
+	// The compiler idiots did not think through the consequences of
+	// requiring us to use -mcpu=power9 to unlock the ISA. Epic fail.
+	// https://github.com/weidai11/cryptopp/issues/986
+
+#ifndef CRYPTOPP_DISABLE_ASM
+
+	// The CPU_ProbeXXX's return false for OSes which
+	// can't tolerate SIGILL-based probes, like Apple
+	g_hasAltivec  = CPU_QueryAltivec() || CPU_ProbeAltivec();
+	g_hasPower7 = CPU_QueryPower7() || CPU_ProbePower7();
+	g_hasPower8 = CPU_QueryPower8() || CPU_ProbePower8();
+	g_hasPower9 = CPU_QueryPower9() || CPU_ProbePower9();
+	g_hasPMULL = CPU_QueryPMULL() || CPU_ProbePMULL();
+	g_hasAES  = CPU_QueryAES() || CPU_ProbeAES();
+	g_hasSHA256 = CPU_QuerySHA256() || CPU_ProbeSHA256();
+	g_hasSHA512 = CPU_QuerySHA512() || CPU_ProbeSHA512();
+	g_hasDARN = CPU_QueryDARN() || CPU_ProbeDARN();
+
+#if defined(_AIX) && defined(SC_L1C_DLS)
+	// /usr/include/sys/systemcfg.h
+	int cacheLineSize = getsystemcfg(SC_L1C_DLS);
+	if (cacheLineSize > 0)
+		g_cacheLineSize = cacheLineSize;
+#elif defined(_SC_LEVEL1_DCACHE_LINESIZE)
+	// Glibc does not implement on some platforms. The runtime returns 0 instead of error.
+	// https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/posix/sysconf.c
+	int cacheLineSize = (int)sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+	if (cacheLineSize > 0)
+		g_cacheLineSize = cacheLineSize;
+#endif
+
+	if (g_cacheLineSize == 0)
+		g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
+
+#endif // CRYPTOPP_DISABLE_ASM
+
+	*const_cast<volatile bool*>(&g_PowerPcDetectionDone) = true;
+}
+
+#endif
+NAMESPACE_END
+
+// *************************** C++ Static Initialization ***************************
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+class InitCpu
+{
+public:
+	InitCpu()
+	{
+#if CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64
+		CryptoPP::DetectX86Features();
+#elif CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8
+		CryptoPP::DetectArmFeatures();
+#elif CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64
+		CryptoPP::DetectPowerPcFeatures();
+#endif
+	}
+};
+
+// This is not really needed because HasSSE() and friends can dynamically initialize.
+// Everything depends on CPU features so we initialize it once at load time.
+// Dynamic initialization will be used if init priorities are not available.
+
+#if HAVE_GCC_INIT_PRIORITY
+	const InitCpu s_init __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 10))) = InitCpu();
+#elif HAVE_MSC_INIT_PRIORITY
+	#pragma warning(disable: 4075)
+	#pragma init_seg(".CRT$XCU")
+	const InitCpu s_init;
+	#pragma warning(default: 4075)
+#elif HAVE_XLC_INIT_PRIORITY
+	// XLC needs constant, not a define
+	#pragma priority(270)
+	const InitCpu s_init;
+#else
+	const InitCpu s_init;
+#endif
+
+ANONYMOUS_NAMESPACE_END
+
+#endif  // CRYPTOPP_IMPORTS
diff --git a/runtime/third_party/cryptopp/cpu.h b/runtime/third_party/cryptopp/cpu.h
new file mode 100644
index 0000000..29ab6d4
--- /dev/null
+++ b/runtime/third_party/cryptopp/cpu.h
@@ -0,0 +1,1089 @@
+// cpu.h - originally written and placed in the public domain by Wei Dai
+//         updated for ARM and PowerPC by Jeffrey Walton.
+//         updated to split CPU_Query() and CPU_Probe() by Jeffrey Walton.
+
+/// \file cpu.h
+/// \brief Functions for CPU features and intrinsics
+/// \details The CPU functions are used in IA-32, ARM and PowerPC code paths. The
+///  functions provide cpu specific feature testing on IA-32, ARM and PowerPC machines.
+/// \details Feature detection uses CPUID on IA-32, like Intel and AMD. On other platforms
+///  a two-part strategy is used. First, the library attempts to *Query* the OS for a feature,
+///  like using Linux getauxval() or android_getCpuFeatures(). If that fails, then *Probe*
+///  the cpu executing an instruction and an observe a SIGILL if unsupported. The general
+///  pattern used by the library is:
+/// <pre>
+///    g_hasCRC32 = CPU_QueryCRC32() || CPU_ProbeCRC32();
+///    g_hasPMULL = CPU_QueryPMULL() || CPU_ProbePMULL();
+///    g_hasAES  = CPU_QueryAES() || CPU_ProbeAES();
+/// </pre>
+/// \details Generally speaking, CPU_Query() is in the source file <tt>cpu.cpp</tt> because it
+///  does not require special architectural flags. CPU_Probe() is in a source file that receives
+///  architectural flags, like <tt>sse_simd.cpp</tt>, <tt>neon_simd.cpp</tt> and
+///  <tt>ppc_simd.cpp</tt>. For example, compiling <tt>neon_simd.cpp</tt> on an ARM64 machine will
+///  have <tt>-march=armv8-a</tt> applied during a compile to make the instruction set architecture
+///  (ISA) available.
+/// \details The cpu probes are expensive when compared to a standard OS feature query. The library
+///  also avoids probes on Apple platforms because Apple's signal handling for SIGILLs appears to
+///  corrupt memory. CPU_Probe() will unconditionally return false for Apple platforms. OpenSSL
+///  experienced the same problem and moved away from SIGILL probes on Apple.
+
+#ifndef CRYPTOPP_CPU_H
+#define CRYPTOPP_CPU_H
+
+#include "config.h"
+
+// Issue 340
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wconversion"
+# pragma GCC diagnostic ignored "-Wsign-conversion"
+#endif
+
+// Applies to both X86/X32/X64 and ARM32/ARM64
+#if defined(CRYPTOPP_LLVM_CLANG_VERSION) || defined(CRYPTOPP_APPLE_CLANG_VERSION)
+	#define NEW_LINE "\n"
+	#define INTEL_PREFIX ".intel_syntax;"
+	#define INTEL_NOPREFIX ".intel_syntax;"
+	#define ATT_PREFIX ".att_syntax;"
+	#define ATT_NOPREFIX ".att_syntax;"
+#elif defined(CRYPTOPP_GCC_VERSION)
+	#define NEW_LINE
+	#define INTEL_PREFIX ".intel_syntax prefix;"
+	#define INTEL_NOPREFIX ".intel_syntax noprefix;"
+	#define ATT_PREFIX ".att_syntax prefix;"
+	#define ATT_NOPREFIX ".att_syntax noprefix;"
+#else
+	#define NEW_LINE
+	#define INTEL_PREFIX
+	#define INTEL_NOPREFIX
+	#define ATT_PREFIX
+	#define ATT_NOPREFIX
+#endif
+
+// Thanks to v1ne at https://github.com/weidai11/cryptopp/pull/1133
+#define PERCENT_PASTE(x) "%" #x
+#define PERCENT_REG(x) PERCENT_PASTE(x)
+
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+
+#define CRYPTOPP_X86_ASM_AVAILABLE
+#define CRYPTOPP_BOOL_X64 1
+#define CRYPTOPP_SSE2_ASM_AVAILABLE 1
+#define NAMESPACE_END
+
+#else
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ***************************** IA-32 ***************************** //
+
+#if CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64 || CRYPTOPP_DOXYGEN_PROCESSING
+
+#define CRYPTOPP_CPUID_AVAILABLE 1
+
+// Hide from Doxygen
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+// These should not be used directly
+extern CRYPTOPP_DLL bool g_x86DetectionDone;
+extern CRYPTOPP_DLL bool g_hasSSE2;
+extern CRYPTOPP_DLL bool g_hasSSSE3;
+extern CRYPTOPP_DLL bool g_hasSSE41;
+extern CRYPTOPP_DLL bool g_hasSSE42;
+extern CRYPTOPP_DLL bool g_hasMOVBE;
+extern CRYPTOPP_DLL bool g_hasAESNI;
+extern CRYPTOPP_DLL bool g_hasCLMUL;
+extern CRYPTOPP_DLL bool g_hasAVX;
+extern CRYPTOPP_DLL bool g_hasAVX2;
+extern CRYPTOPP_DLL bool g_hasSHA;
+extern CRYPTOPP_DLL bool g_hasADX;
+extern CRYPTOPP_DLL bool g_isP4;
+extern CRYPTOPP_DLL bool g_hasRDRAND;
+extern CRYPTOPP_DLL bool g_hasRDSEED;
+extern CRYPTOPP_DLL bool g_hasPadlockRNG;
+extern CRYPTOPP_DLL bool g_hasPadlockACE;
+extern CRYPTOPP_DLL bool g_hasPadlockACE2;
+extern CRYPTOPP_DLL bool g_hasPadlockPHE;
+extern CRYPTOPP_DLL bool g_hasPadlockPMM;
+extern CRYPTOPP_DLL word32 g_cacheLineSize;
+
+CRYPTOPP_DLL void CRYPTOPP_API DetectX86Features();
+CRYPTOPP_DLL bool CRYPTOPP_API CpuId(word32 func, word32 subfunc, word32 output[4]);
+#endif // CRYPTOPP_DOXYGEN_PROCESSING
+
+/// \name IA-32 CPU FEATURES
+//@{
+
+/// \brief Determine SSE2 availability
+/// \return true if SSE2 is determined to be available, false otherwise
+/// \details MMX, SSE and SSE2 are core processor features for x86_64, and
+///  the function return value is based on OSXSAVE. On i386 both
+///  SSE2 and OSXSAVE are used for the return value.
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasSSE2()
+{
+#if (CRYPTOPP_SSE2_ASM_AVAILABLE || CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasSSE2;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine SSSE3 availability
+/// \return true if SSSE3 is determined to be available, false otherwise
+/// \details HasSSSE3() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasSSSE3()
+{
+#if CRYPTOPP_SSSE3_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasSSSE3;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine SSE4.1 availability
+/// \return true if SSE4.1 is determined to be available, false otherwise
+/// \details HasSSE41() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasSSE41()
+{
+#if CRYPTOPP_SSE41_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasSSE41;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine SSE4.2 availability
+/// \return true if SSE4.2 is determined to be available, false otherwise
+/// \details HasSSE42() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasSSE42()
+{
+#if CRYPTOPP_SSE42_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasSSE42;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine MOVBE availability
+/// \return true if MOVBE is determined to be available, false otherwise
+/// \details HasMOVBE() is a runtime check performed using CPUID
+/// \since Crypto++ 8.3
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasMOVBE()
+{
+#if CRYPTOPP_SSE42_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasMOVBE;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine AES-NI availability
+/// \return true if AES-NI is determined to be available, false otherwise
+/// \details HasAESNI() is a runtime check performed using CPUID
+/// \since Crypto++ 5.6.1
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasAESNI()
+{
+#if CRYPTOPP_AESNI_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasAESNI;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine Carryless Multiply availability
+/// \return true if pclmulqdq is determined to be available, false otherwise
+/// \details HasCLMUL() is a runtime check performed using CPUID
+/// \since Crypto++ 5.6.1
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasCLMUL()
+{
+#if CRYPTOPP_CLMUL_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasCLMUL;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine SHA availability
+/// \return true if SHA is determined to be available, false otherwise
+/// \details HasSHA() is a runtime check performed using CPUID
+/// \since Crypto++ 6.0
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasSHA()
+{
+#if CRYPTOPP_SHANI_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasSHA;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine ADX availability
+/// \return true if ADX is determined to be available, false otherwise
+/// \details HasADX() is a runtime check performed using CPUID
+/// \since Crypto++ 7.0
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasADX()
+{
+#if CRYPTOPP_ADX_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasADX;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine AVX availability
+/// \return true if AVX is determined to be available, false otherwise
+/// \details HasAVX() is a runtime check performed using CPUID
+/// \since Crypto++ 8.0
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasAVX()
+{
+#if CRYPTOPP_AVX_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasAVX;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine AVX2 availability
+/// \return true if AVX2 is determined to be available, false otherwise
+/// \details HasAVX2() is a runtime check performed using CPUID
+/// \since Crypto++ 8.0
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasAVX2()
+{
+#if CRYPTOPP_AVX2_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasAVX2;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine RDRAND availability
+/// \return true if RDRAND is determined to be available, false otherwise
+/// \details HasRDRAND() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasRDRAND()
+{
+#if CRYPTOPP_RDRAND_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasRDRAND;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine RDSEED availability
+/// \return true if RDSEED is determined to be available, false otherwise
+/// \details HasRDSEED() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasRDSEED()
+{
+#if CRYPTOPP_RDSEED_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasRDSEED;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine Padlock RNG availability
+/// \return true if VIA Padlock RNG is determined to be available, false otherwise
+/// \details HasPadlockRNG() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasPadlockRNG()
+{
+#if CRYPTOPP_PADLOCK_RNG_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasPadlockRNG;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine Padlock ACE availability
+/// \return true if VIA Padlock ACE is determined to be available, false otherwise
+/// \details HasPadlockACE() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasPadlockACE()
+{
+#if CRYPTOPP_PADLOCK_ACE_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasPadlockACE;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine Padlock ACE2 availability
+/// \return true if VIA Padlock ACE2 is determined to be available, false otherwise
+/// \details HasPadlockACE2() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasPadlockACE2()
+{
+#if CRYPTOPP_PADLOCK_ACE2_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasPadlockACE2;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine Padlock PHE availability
+/// \return true if VIA Padlock PHE is determined to be available, false otherwise
+/// \details HasPadlockPHE() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasPadlockPHE()
+{
+#if CRYPTOPP_PADLOCK_PHE_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasPadlockPHE;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine Padlock PMM availability
+/// \return true if VIA Padlock PMM is determined to be available, false otherwise
+/// \details HasPadlockPMM() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool HasPadlockPMM()
+{
+#if CRYPTOPP_PADLOCK_PMM_AVAILABLE
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_hasPadlockPMM;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if the CPU is an Intel P4
+/// \return true if the CPU is a P4, false otherwise
+/// \details IsP4() is a runtime check performed using CPUID
+/// \note This function is only available on Intel IA-32 platforms
+inline bool IsP4()
+{
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_isP4;
+}
+
+/// \brief Provides the cache line size
+/// \return lower bound on the size of a cache line in bytes, if available
+/// \details GetCacheLineSize() returns the lower bound on the size of a cache line, if it
+///  is available. If the value is not available at runtime, then 32 is returned for a 32-bit
+///  processor and 64 is returned for a 64-bit processor.
+/// \details x86/x32/x64 uses CPUID to determine the value and it is usually accurate. PowerPC
+///  and AIX also makes the value available to user space and it is also usually accurate. The
+///  ARM processor equivalent is a privileged instruction, so a compile time value is returned.
+inline int GetCacheLineSize()
+{
+	if (!g_x86DetectionDone)
+		DetectX86Features();
+	return g_cacheLineSize;
+}
+//@}
+
+#endif  // CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64
+
+// ***************************** ARM-32, Aarch32 and Aarch64 ***************************** //
+
+#if CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8 || CRYPTOPP_DOXYGEN_PROCESSING
+
+// Hide from Doxygen
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+extern bool g_ArmDetectionDone;
+extern bool g_hasARMv7;
+extern bool g_hasNEON;
+extern bool g_hasPMULL;
+extern bool g_hasCRC32;
+extern bool g_hasAES;
+extern bool g_hasSHA1;
+extern bool g_hasSHA2;
+extern bool g_hasSHA512;
+extern bool g_hasSHA3;
+extern bool g_hasSM3;
+extern bool g_hasSM4;
+void CRYPTOPP_API DetectArmFeatures();
+#endif  // CRYPTOPP_DOXYGEN_PROCESSING
+
+/// \name ARM A-32, Aarch32 and AArch64 CPU FEATURES
+//@{
+
+/// \brief Determine if an ARM processor is ARMv7 or above
+/// \return true if the hardware is ARMv7 or above, false otherwise.
+/// \details Some AES code requires ARMv7 or above
+/// \since Crypto++ 8.0
+/// \note This function is only available on ARM-32, Aarch32 and Aarch64 platforms
+inline bool HasARMv7()
+{
+	// ASIMD is a core feature on Aarch32 and Aarch64 like SSE2 is a core feature on x86_64
+#if defined(__aarch32__) || defined(__aarch64__)
+	return true;
+#else
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasARMv7;
+#endif
+}
+
+/// \brief Determine if an ARM processor has Advanced SIMD available
+/// \return true if the hardware is capable of Advanced SIMD at runtime, false otherwise.
+/// \details Advanced SIMD instructions are available under most ARMv7, Aarch32 and Aarch64.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mfpu=neon</tt> (32-bit) or <tt>-march=armv8-a</tt>
+///  (64-bit). Also see ARM's <tt>__ARM_NEON</tt> preprocessor macro.
+/// \since Crypto++ 5.6.4
+/// \note This function is only available on ARM-32, Aarch32 and Aarch64 platforms
+inline bool HasNEON()
+{
+	// ASIMD is a core feature on Aarch32 and Aarch64 like SSE2 is a core feature on x86_64
+#if defined(CRYPTOPP_ARM_ASIMD_AVAILABLE)
+	return true;
+#elif defined(CRYPTOPP_ARM_NEON_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasNEON;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if an ARM processor has CRC32 available
+/// \return true if the hardware is capable of CRC32 at runtime, false otherwise.
+/// \details CRC32 instructions provide access to the processor's CRC-32 and CRC-32C
+///  instructions. They are provided by ARM C Language Extensions 2.0 (ACLE 2.0) and
+///  available under Aarch32 and Aarch64.
+/// \details Runtime support requires compile time support. When compiling with GCC,
+///  you may need to compile with <tt>-march=armv8-a+crc</tt>; while Apple requires
+///  <tt>-arch arm64</tt>. Also see ARM's <tt>__ARM_FEATURE_CRC32</tt> preprocessor macro.
+/// \since Crypto++ 5.6.4
+/// \note This function is only available on Aarch32 and Aarch64 platforms
+inline bool HasCRC32()
+{
+#if defined(CRYPTOPP_ARM_CRC32_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasCRC32;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if an ARM processor has AES available
+/// \return true if the hardware is capable of AES at runtime, false otherwise.
+/// \details AES is part of the optional Crypto extensions on Aarch32 and Aarch64. They are
+///  accessed using ARM C Language Extensions 2.0 (ACLE 2.0).
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-march=armv8-a+crypto</tt>; while Apple requires
+///  <tt>-arch arm64</tt>. Also see ARM's <tt>__ARM_FEATURE_CRYPTO</tt> preprocessor macro.
+/// \since Crypto++ 5.6.4
+/// \note This function is only available on Aarch32 and Aarch64 platforms
+inline bool HasAES()
+{
+#if defined(CRYPTOPP_ARM_AES_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasAES;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if an ARM processor provides Polynomial Multiplication
+/// \return true if the hardware is capable of polynomial multiplications at runtime,
+///  false otherwise.
+/// \details The multiplication instructions are available under Aarch32 and Aarch64.
+/// \details Runtime support requires compile time support. When compiling with GCC,
+///  you may need to compile with <tt>-march=armv8-a+crypto</tt>; while Apple requires
+///  <tt>-arch arm64</tt>. Also see ARM's <tt>__ARM_FEATURE_CRYPTO</tt> preprocessor macro.
+/// \since Crypto++ 5.6.4
+/// \note This function is only available on Aarch32 and Aarch64 platforms
+inline bool HasPMULL()
+{
+#if defined(CRYPTOPP_ARM_PMULL_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasPMULL;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if an ARM processor has SHA1 available
+/// \return true if the hardware is capable of SHA1 at runtime, false otherwise.
+/// \details SHA1 is part of the optional Crypto extensions on Aarch32 and Aarch64. They are
+///  accessed using ARM C Language Extensions 2.0 (ACLE 2.0).
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-march=armv8-a+crypto</tt>; while Apple requires
+///  <tt>-arch arm64</tt>. Also see ARM's <tt>__ARM_FEATURE_CRYPTO</tt> preprocessor macro.
+/// \since Crypto++ 5.6.4
+/// \note This function is only available on Aarch32 and Aarch64 platforms
+inline bool HasSHA1()
+{
+#if defined(CRYPTOPP_ARM_SHA1_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasSHA1;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if an ARM processor has SHA256 available
+/// \return true if the hardware is capable of SHA256 at runtime, false otherwise.
+/// \details SHA256 is part of the optional Crypto extensions on Aarch32 and Aarch64. They are
+///  accessed using ARM C Language Extensions 2.0 (ACLE 2.0).
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-march=armv8-a+crypto</tt>; while Apple requires
+///  <tt>-arch arm64</tt>. Also see ARM's <tt>__ARM_FEATURE_CRYPTO</tt> preprocessor macro.
+/// \since Crypto++ 5.6.4
+/// \note This function is only available on Aarch32 and Aarch64 platforms
+inline bool HasSHA2()
+{
+#if defined(CRYPTOPP_ARM_SHA2_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasSHA2;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if an ARM processor has SHA3 available
+/// \return true if the hardware is capable of SHA3 at runtime, false otherwise.
+/// \details SHA3 is part of the ARMv8.2 Crypto extensions on Aarch32 and Aarch64. They
+///  are accessed using ARM C Language Extensions 2.0 (ACLE 2.0).
+/// \details Runtime support requires compile time support. When compiling with GCC, you
+///  may need to compile with <tt>-march=armv8.2-a+crypto</tt>; while Apple requires
+///  <tt>-arch arm64</tt>. Also see ARM's <tt>__ARM_FEATURE_CRYPTO</tt> preprocessor macro.
+/// \since Crypto++ 8.0
+/// \note This function is only available on Aarch32 and Aarch64 platforms
+inline bool HasSHA3()
+{
+#if defined(CRYPTOPP_ARM_SHA3_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasSHA3;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if an ARM processor has SHA512 available
+/// \return true if the hardware is capable of SHA512 at runtime, false otherwise.
+/// \details SHA512 is part of the ARMv8.2 Crypto extensions on Aarch32 and Aarch64. They
+///  are accessed using ARM C Language Extensions 2.0 (ACLE 2.0).
+/// \details Runtime support requires compile time support. When compiling with GCC, you
+///  may need to compile with <tt>-march=armv8.2-a+crypto</tt>; while Apple requires
+///  <tt>-arch arm64</tt>. Also see ARM's <tt>__ARM_FEATURE_CRYPTO</tt> preprocessor macro.
+/// \since Crypto++ 8.0
+/// \note This function is only available on Aarch32 and Aarch64 platforms
+inline bool HasSHA512()
+{
+#if defined(CRYPTOPP_ARM_SHA512_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasSHA512;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if an ARM processor has SM3 available
+/// \return true if the hardware is capable of SM3 at runtime, false otherwise.
+/// \details SM3 is part of the ARMv8.2 Crypto extensions on Aarch32 and Aarch64. They
+///  are accessed using ARM C Language Extensions 2.0 (ACLE 2.0).
+/// \details Runtime support requires compile time support. When compiling with GCC, you
+///  may need to compile with <tt>-march=armv8.2-a+crypto</tt>; while Apple requires
+///  <tt>-arch arm64</tt>. Also see ARM's <tt>__ARM_FEATURE_CRYPTO</tt> preprocessor macro.
+/// \since Crypto++ 8.0
+/// \note This function is only available on Aarch32 and Aarch64 platforms
+inline bool HasSM3()
+{
+#if defined(CRYPTOPP_ARM_SM3_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasSM3;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if an ARM processor has SM4 available
+/// \return true if the hardware is capable of SM4 at runtime, false otherwise.
+/// \details SM4 is part of the ARMv8.2 Crypto extensions on Aarch32 and Aarch64. They
+///  are accessed using ARM C Language Extensions 2.0 (ACLE 2.0).
+/// \details Runtime support requires compile time support. When compiling with GCC, you
+///  may need to compile with <tt>-march=armv8.2-a+crypto</tt>; while Apple requires
+///  <tt>-arch arm64</tt>. Also see ARM's <tt>__ARM_FEATURE_CRYPTO</tt> preprocessor macro.
+/// \since Crypto++ 8.0
+/// \note This function is only available on Aarch32 and Aarch64 platforms
+inline bool HasSM4()
+{
+#if defined(CRYPTOPP_ARM_SM4_AVAILABLE)
+	if (!g_ArmDetectionDone)
+		DetectArmFeatures();
+	return g_hasSM4;
+#else
+	return false;
+#endif
+}
+
+//@}
+
+#endif  // CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8
+
+// ***************************** PowerPC ***************************** //
+
+#if CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64 || CRYPTOPP_DOXYGEN_PROCESSING
+
+// Hide from Doxygen
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+extern bool g_PowerPcDetectionDone;
+extern bool g_hasAltivec;
+extern bool g_hasPower7;
+extern bool g_hasPower8;
+extern bool g_hasPower9;
+extern bool g_hasAES;
+extern bool g_hasPMULL;
+extern bool g_hasSHA256;
+extern bool g_hasSHA512;
+extern bool g_hasDARN;
+extern word32 g_cacheLineSize;
+void CRYPTOPP_API DetectPowerPcFeatures();
+#endif  // CRYPTOPP_DOXYGEN_PROCESSING
+
+/// \name POWERPC CPU FEATURES
+//@{
+
+/// \brief Determine if a PowerPC processor has Altivec available
+/// \return true if the hardware is capable of Altivec at runtime, false otherwise.
+/// \details Altivec instructions are available on modern PowerPCs.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mcpu=power4</tt>; while IBM XL C/C++ compilers require
+///  <tt>-qarch=pwr6 -qaltivec</tt>. Also see PowerPC's <tt>_ALTIVEC_</tt> preprocessor macro.
+/// \note This function is only available on PowerPC and PowerPC-64 platforms
+inline bool HasAltivec()
+{
+#if CRYPTOPP_ALTIVEC_AVAILABLE
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	return g_hasAltivec;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if a PowerPC processor has Power7 available
+/// \return true if the hardware is capable of Power7 at runtime, false otherwise.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mcpu=power7</tt>; while IBM XL C/C++ compilers require
+///  <tt>-qarch=pwr7 -qaltivec</tt>. Also see PowerPC's <tt>_ALTIVEC_</tt> preprocessor macro.
+/// \note This function is only available on PowerPC and PowerPC-64 platforms
+inline bool HasPower7()
+{
+#if CRYPTOPP_POWER7_AVAILABLE
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	return g_hasPower7;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if a PowerPC processor has Power8 available
+/// \return true if the hardware is capable of Power8 at runtime, false otherwise.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mcpu=power8</tt>; while IBM XL C/C++ compilers require
+///  <tt>-qarch=pwr8 -qaltivec</tt>. Also see PowerPC's <tt>_ALTIVEC_</tt> preprocessor macro.
+/// \note This function is only available on PowerPC and PowerPC-64 platforms
+inline bool HasPower8()
+{
+#if CRYPTOPP_POWER8_AVAILABLE
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	return g_hasPower8;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if a PowerPC processor has Power9 available
+/// \return true if the hardware is capable of Power9 at runtime, false otherwise.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mcpu=power9</tt>; while IBM XL C/C++ compilers require
+///  <tt>-qarch=pwr9 -qaltivec</tt>. Also see PowerPC's <tt>_ALTIVEC_</tt> preprocessor macro.
+/// \note This function is only available on PowerPC and PowerPC-64 platforms
+inline bool HasPower9()
+{
+#if CRYPTOPP_POWER9_AVAILABLE
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	return g_hasPower9;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if a PowerPC processor has AES available
+/// \return true if the hardware is capable of AES at runtime, false otherwise.
+/// \details AES is part of the in-crypto extensions on Power8 and Power9.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mcpu=power8</tt>; while IBM XL C/C++ compilers require
+///  <tt>-qarch=pwr8 -qaltivec</tt>. Also see PowerPC's <tt>__CRYPTO</tt> preprocessor macro.
+/// \note This function is only available on PowerPC and PowerPC-64 platforms
+inline bool HasAES()
+{
+#if CRYPTOPP_POWER8_AES_AVAILABLE
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	return g_hasAES;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if a PowerPC processor has Polynomial Multiply available
+/// \return true if the hardware is capable of PMULL at runtime, false otherwise.
+/// \details PMULL is part of the in-crypto extensions on Power8 and Power9.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mcpu=power8</tt>; while IBM XL C/C++ compilers require
+///  <tt>-qarch=pwr8 -qaltivec</tt>. Also see PowerPC's <tt>__CRYPTO</tt> preprocessor macro.
+/// \note This function is only available on PowerPC and PowerPC-64 platforms
+inline bool HasPMULL()
+{
+#if CRYPTOPP_POWER8_VMULL_AVAILABLE
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	return g_hasPMULL;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if a PowerPC processor has SHA256 available
+/// \return true if the hardware is capable of SHA256 at runtime, false otherwise.
+/// \details SHA is part of the in-crypto extensions on Power8 and Power9.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mcpu=power8</tt>; while IBM XL C/C++ compilers require
+///  <tt>-qarch=pwr8 -qaltivec</tt>. Also see PowerPC's <tt>__CRYPTO</tt> preprocessor macro.
+/// \note This function is only available on PowerPC and PowerPC-64 platforms
+inline bool HasSHA256()
+{
+#if CRYPTOPP_POWER8_SHA_AVAILABLE
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	return g_hasSHA256;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if a PowerPC processor has SHA512 available
+/// \return true if the hardware is capable of SHA512 at runtime, false otherwise.
+/// \details SHA is part of the in-crypto extensions on Power8 and Power9.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mcpu=power8</tt>; while IBM XL C/C++ compilers require
+///  <tt>-qarch=pwr8 -qaltivec</tt>. Also see PowerPC's <tt>__CRYPTO</tt> preprocessor macro.
+/// \note This function is only available on PowerPC and PowerPC-64 platforms
+inline bool HasSHA512()
+{
+#if CRYPTOPP_POWER8_SHA_AVAILABLE
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	return g_hasSHA512;
+#else
+	return false;
+#endif
+}
+
+/// \brief Determine if a PowerPC processor has DARN available
+/// \return true if the hardware is capable of DARN at runtime, false otherwise.
+/// \details Runtime support requires compile time support. When compiling with GCC, you may
+///  need to compile with <tt>-mcpu=power9</tt>; while IBM XL C/C++ compilers require
+///  <tt>-qarch=pwr9 -qaltivec</tt>. Also see PowerPC's <tt>_ALTIVEC_</tt> preprocessor macro.
+/// \note This function is only available on PowerPC and PowerPC-64 platforms
+inline bool HasDARN()
+{
+#if CRYPTOPP_POWER9_AVAILABLE
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	// see comments in cpu.cpp
+#  if defined(__ibmxl__) && defined(__linux__)
+	return false;
+#  else
+	return g_hasDARN;
+#  endif
+#else
+	return false;
+#endif
+}
+
+/// \brief Provides the cache line size
+/// \return lower bound on the size of a cache line in bytes, if available
+/// \details GetCacheLineSize() returns the lower bound on the size of a cache line, if it
+///  is available. If the value is not available at runtime, then 32 is returned for a 32-bit
+///  processor and 64 is returned for a 64-bit processor.
+/// \details x86/x32/x64 uses CPUID to determine the value and it is usually accurate. PowerPC
+///  and AIX also makes the value available to user space and it is also usually accurate. The
+///  ARM processor equivalent is a privileged instruction, so a compile time value is returned.
+inline int GetCacheLineSize()
+{
+	if (!g_PowerPcDetectionDone)
+		DetectPowerPcFeatures();
+	return g_cacheLineSize;
+}
+
+//@}
+
+#endif  // CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64
+
+// ***************************** L1 cache line ***************************** //
+
+// Non-Intel systems
+#if !(CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+/// \brief Provides the cache line size
+/// \return lower bound on the size of a cache line in bytes, if available
+/// \details GetCacheLineSize() returns the lower bound on the size of a cache line, if it
+///  is available. If the value is not available at runtime, then 32 is returned for a 32-bit
+///  processor and 64 is returned for a 64-bit processor.
+/// \details x86/x32/x64 uses CPUID to determine the value and it is usually accurate. PowerPC
+///  and AIX also makes the value available to user space and it is also usually accurate. The
+///  ARM processor equivalent is a privileged instruction, so a compile time value is returned.
+inline int GetCacheLineSize()
+{
+	return CRYPTOPP_L1_CACHE_LINE_SIZE;
+}
+#endif  // Non-Intel systems
+
+#endif  // CRYPTOPP_GENERATE_X64_MASM
+
+// ***************************** Inline ASM Helper ***************************** //
+
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+
+#if CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64
+
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+	#define AS1(x) x*newline*
+	#define AS2(x, y) x, y*newline*
+	#define AS3(x, y, z) x, y, z*newline*
+	#define ASS(x, y, a, b, c, d) x, y, a*64+b*16+c*4+d*newline*
+	#define ASL(x) label##x:*newline*
+	#define ASJ(x, y, z) x label##y*newline*
+	#define ASC(x, y) x label##y*newline*
+	#define AS_HEX(y) 0##y##h
+#elif defined(CRYPTOPP_MSC_VERSION) || defined(__BORLANDC__)
+	#define AS1(x) __asm {x}
+	#define AS2(x, y) __asm {x, y}
+	#define AS3(x, y, z) __asm {x, y, z}
+	#define ASS(x, y, a, b, c, d) __asm {x, y, (a)*64+(b)*16+(c)*4+(d)}
+	#define ASL(x) __asm {label##x:}
+	#define ASJ(x, y, z) __asm {x label##y}
+	#define ASC(x, y) __asm {x label##y}
+	#define CRYPTOPP_NAKED __declspec(naked)
+	#define AS_HEX(y) 0x##y
+#else
+	// define these in two steps to allow arguments to be expanded
+	#define GNU_AS1(x) #x ";" NEW_LINE
+	#define GNU_AS2(x, y) #x ", " #y ";" NEW_LINE
+	#define GNU_AS3(x, y, z) #x ", " #y ", " #z ";" NEW_LINE
+	#define GNU_ASL(x) "\n" #x ":" NEW_LINE
+// clang 5.0.0 and apple clang 9.0.0 don't support numerical backward jumps
+#if (CRYPTOPP_LLVM_CLANG_VERSION >= 50000) || (CRYPTOPP_APPLE_CLANG_VERSION >= 90000)
+	#define GNU_ASJ(x, y, z) ATT_PREFIX ";" NEW_LINE #x " " #y #z ";" NEW_LINE INTEL_PREFIX ";" NEW_LINE
+#else
+	#define GNU_ASJ(x, y, z) #x " " #y #z ";" NEW_LINE
+#endif
+	#define AS1(x) GNU_AS1(x)
+	#define AS2(x, y) GNU_AS2(x, y)
+	#define AS3(x, y, z) GNU_AS3(x, y, z)
+	#define ASS(x, y, a, b, c, d) #x ", " #y ", " #a "*64+" #b "*16+" #c "*4+" #d ";"
+	#define ASL(x) GNU_ASL(x)
+	#define ASJ(x, y, z) GNU_ASJ(x, y, z)
+	#define ASC(x, y) #x " " #y ";"
+	#define CRYPTOPP_NAKED
+	#define AS_HEX(y) 0x##y
+#endif
+
+#define IF0(y)
+#define IF1(y) y
+
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+#define ASM_MOD(x, y) ((x) MOD (y))
+#define XMMWORD_PTR XMMWORD PTR
+#else
+// GNU assembler doesn't seem to have mod operator
+#define ASM_MOD(x, y) ((x)-((x)/(y))*(y))
+// GAS 2.15 doesn't support XMMWORD PTR. it seems necessary only for MASM
+#define XMMWORD_PTR
+#endif
+
+#if CRYPTOPP_BOOL_X86
+	#define AS_REG_1 ecx
+	#define AS_REG_2 edx
+	#define AS_REG_3 esi
+	#define AS_REG_4 edi
+	#define AS_REG_5 eax
+	#define AS_REG_6 ebx
+	#define AS_REG_7 ebp
+	#define AS_REG_1d ecx
+	#define AS_REG_2d edx
+	#define AS_REG_3d esi
+	#define AS_REG_4d edi
+	#define AS_REG_5d eax
+	#define AS_REG_6d ebx
+	#define AS_REG_7d ebp
+	#define WORD_SZ 4
+	#define WORD_REG(x)	e##x
+	#define WORD_PTR DWORD PTR
+	#define AS_PUSH_IF86(x) AS1(push e##x)
+	#define AS_POP_IF86(x) AS1(pop e##x)
+	#define AS_JCXZ jecxz
+#elif CRYPTOPP_BOOL_X32
+	#define AS_REG_1 ecx
+	#define AS_REG_2 edx
+	#define AS_REG_3 r8d
+	#define AS_REG_4 r9d
+	#define AS_REG_5 eax
+	#define AS_REG_6 r10d
+	#define AS_REG_7 r11d
+	#define AS_REG_1d ecx
+	#define AS_REG_2d edx
+	#define AS_REG_3d r8d
+	#define AS_REG_4d r9d
+	#define AS_REG_5d eax
+	#define AS_REG_6d r10d
+	#define AS_REG_7d r11d
+	#define WORD_SZ 4
+	#define WORD_REG(x)	e##x
+	#define WORD_PTR DWORD PTR
+	#define AS_PUSH_IF86(x) AS1(push r##x)
+	#define AS_POP_IF86(x) AS1(pop r##x)
+	#define AS_JCXZ jecxz
+#elif CRYPTOPP_BOOL_X64
+	#ifdef CRYPTOPP_GENERATE_X64_MASM
+		#define AS_REG_1 rcx
+		#define AS_REG_2 rdx
+		#define AS_REG_3 r8
+		#define AS_REG_4 r9
+		#define AS_REG_5 rax
+		#define AS_REG_6 r10
+		#define AS_REG_7 r11
+		#define AS_REG_1d ecx
+		#define AS_REG_2d edx
+		#define AS_REG_3d r8d
+		#define AS_REG_4d r9d
+		#define AS_REG_5d eax
+		#define AS_REG_6d r10d
+		#define AS_REG_7d r11d
+	#else
+		#define AS_REG_1 rdi
+		#define AS_REG_2 rsi
+		#define AS_REG_3 rdx
+		#define AS_REG_4 rcx
+		#define AS_REG_5 r8
+		#define AS_REG_6 r9
+		#define AS_REG_7 r10
+		#define AS_REG_1d edi
+		#define AS_REG_2d esi
+		#define AS_REG_3d edx
+		#define AS_REG_4d ecx
+		#define AS_REG_5d r8d
+		#define AS_REG_6d r9d
+		#define AS_REG_7d r10d
+	#endif
+	#define WORD_SZ 8
+	#define WORD_REG(x)	r##x
+	#define WORD_PTR QWORD PTR
+	#define AS_PUSH_IF86(x)
+	#define AS_POP_IF86(x)
+	#define AS_JCXZ jrcxz
+#endif
+
+// helper macro for stream cipher output
+#define AS_XMM_OUTPUT4(labelPrefix, inputPtr, outputPtr, x0, x1, x2, x3, t, p0, p1, p2, p3, increment)\
+	AS2(	test	inputPtr, inputPtr)\
+	ASC(	jz,		labelPrefix##3)\
+	AS2(	test	inputPtr, 15)\
+	ASC(	jnz,	labelPrefix##7)\
+	AS2(	pxor	xmm##x0, [inputPtr+p0*16])\
+	AS2(	pxor	xmm##x1, [inputPtr+p1*16])\
+	AS2(	pxor	xmm##x2, [inputPtr+p2*16])\
+	AS2(	pxor	xmm##x3, [inputPtr+p3*16])\
+	AS2(	add		inputPtr, increment*16)\
+	ASC(	jmp,	labelPrefix##3)\
+	ASL(labelPrefix##7)\
+	AS2(	movdqu	xmm##t, [inputPtr+p0*16])\
+	AS2(	pxor	xmm##x0, xmm##t)\
+	AS2(	movdqu	xmm##t, [inputPtr+p1*16])\
+	AS2(	pxor	xmm##x1, xmm##t)\
+	AS2(	movdqu	xmm##t, [inputPtr+p2*16])\
+	AS2(	pxor	xmm##x2, xmm##t)\
+	AS2(	movdqu	xmm##t, [inputPtr+p3*16])\
+	AS2(	pxor	xmm##x3, xmm##t)\
+	AS2(	add		inputPtr, increment*16)\
+	ASL(labelPrefix##3)\
+	AS2(	test	outputPtr, 15)\
+	ASC(	jnz,	labelPrefix##8)\
+	AS2(	movdqa	[outputPtr+p0*16], xmm##x0)\
+	AS2(	movdqa	[outputPtr+p1*16], xmm##x1)\
+	AS2(	movdqa	[outputPtr+p2*16], xmm##x2)\
+	AS2(	movdqa	[outputPtr+p3*16], xmm##x3)\
+	ASC(	jmp,	labelPrefix##9)\
+	ASL(labelPrefix##8)\
+	AS2(	movdqu	[outputPtr+p0*16], xmm##x0)\
+	AS2(	movdqu	[outputPtr+p1*16], xmm##x1)\
+	AS2(	movdqu	[outputPtr+p2*16], xmm##x2)\
+	AS2(	movdqu	[outputPtr+p3*16], xmm##x3)\
+	ASL(labelPrefix##9)\
+	AS2(	add		outputPtr, increment*16)
+
+#endif  // CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64
+
+#endif  // Not CRYPTOPP_DOXYGEN_PROCESSING
+
+NAMESPACE_END
+
+// Issue 340
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic pop
+#endif
+
+#endif  // CRYPTOPP_CPU_H
diff --git a/runtime/third_party/cryptopp/crc.cpp b/runtime/third_party/cryptopp/crc.cpp
new file mode 100644
index 0000000..421c542
--- /dev/null
+++ b/runtime/third_party/cryptopp/crc.cpp
@@ -0,0 +1,367 @@
+// crc.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+#include "crc.h"
+#include "misc.h"
+#include "cpu.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// crc_simd.cpp
+#if (CRYPTOPP_ARM_CRC32_AVAILABLE)
+extern void CRC32_Update_ARMV8(const byte *s, size_t n, word32& c);
+extern void CRC32C_Update_ARMV8(const byte *s, size_t n, word32& c);
+#endif
+
+// crc_simd.cpp
+#if (CRYPTOPP_SSE42_AVAILABLE)
+extern void CRC32C_Update_SSE42(const byte *s, size_t n, word32& c);
+#endif
+
+/* Table of CRC-32's of all single byte values (made by makecrc.c) */
+const word32 CRC32::m_tab[] = {
+#if (CRYPTOPP_LITTLE_ENDIAN)
+	0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
+	0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
+	0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
+	0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
+	0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
+	0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
+	0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
+	0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
+	0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
+	0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
+	0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
+	0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
+	0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
+	0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
+	0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
+	0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
+	0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
+	0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
+	0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
+	0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
+	0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
+	0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
+	0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
+	0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
+	0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
+	0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
+	0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
+	0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
+	0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
+	0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
+	0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
+	0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
+	0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
+	0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
+	0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
+	0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
+	0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
+	0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
+	0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
+	0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
+	0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
+	0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
+	0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
+	0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
+	0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
+	0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
+	0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
+	0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
+	0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
+	0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
+	0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
+	0x2d02ef8dL
+#else
+	0x00000000L, 0x96300777L, 0x2c610eeeL, 0xba510999L, 0x19c46d07L,
+	0x8ff46a70L, 0x35a563e9L, 0xa395649eL, 0x3288db0eL, 0xa4b8dc79L,
+	0x1ee9d5e0L, 0x88d9d297L, 0x2b4cb609L, 0xbd7cb17eL, 0x072db8e7L,
+	0x911dbf90L, 0x6410b71dL, 0xf220b06aL, 0x4871b9f3L, 0xde41be84L,
+	0x7dd4da1aL, 0xebe4dd6dL, 0x51b5d4f4L, 0xc785d383L, 0x56986c13L,
+	0xc0a86b64L, 0x7af962fdL, 0xecc9658aL, 0x4f5c0114L, 0xd96c0663L,
+	0x633d0ffaL, 0xf50d088dL, 0xc8206e3bL, 0x5e10694cL, 0xe44160d5L,
+	0x727167a2L, 0xd1e4033cL, 0x47d4044bL, 0xfd850dd2L, 0x6bb50aa5L,
+	0xfaa8b535L, 0x6c98b242L, 0xd6c9bbdbL, 0x40f9bcacL, 0xe36cd832L,
+	0x755cdf45L, 0xcf0dd6dcL, 0x593dd1abL, 0xac30d926L, 0x3a00de51L,
+	0x8051d7c8L, 0x1661d0bfL, 0xb5f4b421L, 0x23c4b356L, 0x9995bacfL,
+	0x0fa5bdb8L, 0x9eb80228L, 0x0888055fL, 0xb2d90cc6L, 0x24e90bb1L,
+	0x877c6f2fL, 0x114c6858L, 0xab1d61c1L, 0x3d2d66b6L, 0x9041dc76L,
+	0x0671db01L, 0xbc20d298L, 0x2a10d5efL, 0x8985b171L, 0x1fb5b606L,
+	0xa5e4bf9fL, 0x33d4b8e8L, 0xa2c90778L, 0x34f9000fL, 0x8ea80996L,
+	0x18980ee1L, 0xbb0d6a7fL, 0x2d3d6d08L, 0x976c6491L, 0x015c63e6L,
+	0xf4516b6bL, 0x62616c1cL, 0xd8306585L, 0x4e0062f2L, 0xed95066cL,
+	0x7ba5011bL, 0xc1f40882L, 0x57c40ff5L, 0xc6d9b065L, 0x50e9b712L,
+	0xeab8be8bL, 0x7c88b9fcL, 0xdf1ddd62L, 0x492dda15L, 0xf37cd38cL,
+	0x654cd4fbL, 0x5861b24dL, 0xce51b53aL, 0x7400bca3L, 0xe230bbd4L,
+	0x41a5df4aL, 0xd795d83dL, 0x6dc4d1a4L, 0xfbf4d6d3L, 0x6ae96943L,
+	0xfcd96e34L, 0x468867adL, 0xd0b860daL, 0x732d0444L, 0xe51d0333L,
+	0x5f4c0aaaL, 0xc97c0dddL, 0x3c710550L, 0xaa410227L, 0x10100bbeL,
+	0x86200cc9L, 0x25b56857L, 0xb3856f20L, 0x09d466b9L, 0x9fe461ceL,
+	0x0ef9de5eL, 0x98c9d929L, 0x2298d0b0L, 0xb4a8d7c7L, 0x173db359L,
+	0x810db42eL, 0x3b5cbdb7L, 0xad6cbac0L, 0x2083b8edL, 0xb6b3bf9aL,
+	0x0ce2b603L, 0x9ad2b174L, 0x3947d5eaL, 0xaf77d29dL, 0x1526db04L,
+	0x8316dc73L, 0x120b63e3L, 0x843b6494L, 0x3e6a6d0dL, 0xa85a6a7aL,
+	0x0bcf0ee4L, 0x9dff0993L, 0x27ae000aL, 0xb19e077dL, 0x44930ff0L,
+	0xd2a30887L, 0x68f2011eL, 0xfec20669L, 0x5d5762f7L, 0xcb676580L,
+	0x71366c19L, 0xe7066b6eL, 0x761bd4feL, 0xe02bd389L, 0x5a7ada10L,
+	0xcc4add67L, 0x6fdfb9f9L, 0xf9efbe8eL, 0x43beb717L, 0xd58eb060L,
+	0xe8a3d6d6L, 0x7e93d1a1L, 0xc4c2d838L, 0x52f2df4fL, 0xf167bbd1L,
+	0x6757bca6L, 0xdd06b53fL, 0x4b36b248L, 0xda2b0dd8L, 0x4c1b0aafL,
+	0xf64a0336L, 0x607a0441L, 0xc3ef60dfL, 0x55df67a8L, 0xef8e6e31L,
+	0x79be6946L, 0x8cb361cbL, 0x1a8366bcL, 0xa0d26f25L, 0x36e26852L,
+	0x95770cccL, 0x03470bbbL, 0xb9160222L, 0x2f260555L, 0xbe3bbac5L,
+	0x280bbdb2L, 0x925ab42bL, 0x046ab35cL, 0xa7ffd7c2L, 0x31cfd0b5L,
+	0x8b9ed92cL, 0x1daede5bL, 0xb0c2649bL, 0x26f263ecL, 0x9ca36a75L,
+	0x0a936d02L, 0xa906099cL, 0x3f360eebL, 0x85670772L, 0x13570005L,
+	0x824abf95L, 0x147ab8e2L, 0xae2bb17bL, 0x381bb60cL, 0x9b8ed292L,
+	0x0dbed5e5L, 0xb7efdc7cL, 0x21dfdb0bL, 0xd4d2d386L, 0x42e2d4f1L,
+	0xf8b3dd68L, 0x6e83da1fL, 0xcd16be81L, 0x5b26b9f6L, 0xe177b06fL,
+	0x7747b718L, 0xe65a0888L, 0x706a0fffL, 0xca3b0666L, 0x5c0b0111L,
+	0xff9e658fL, 0x69ae62f8L, 0xd3ff6b61L, 0x45cf6c16L, 0x78e20aa0L,
+	0xeed20dd7L, 0x5483044eL, 0xc2b30339L, 0x612667a7L, 0xf71660d0L,
+	0x4d476949L, 0xdb776e3eL, 0x4a6ad1aeL, 0xdc5ad6d9L, 0x660bdf40L,
+	0xf03bd837L, 0x53aebca9L, 0xc59ebbdeL, 0x7fcfb247L, 0xe9ffb530L,
+	0x1cf2bdbdL, 0x8ac2bacaL, 0x3093b353L, 0xa6a3b424L, 0x0536d0baL,
+	0x9306d7cdL, 0x2957de54L, 0xbf67d923L, 0x2e7a66b3L, 0xb84a61c4L,
+	0x021b685dL, 0x942b6f2aL, 0x37be0bb4L, 0xa18e0cc3L, 0x1bdf055aL,
+	0x8def022dL
+#endif
+};
+
+std::string CRC32::AlgorithmProvider() const
+{
+#if (CRYPTOPP_ARM_CRC32_AVAILABLE)
+	if (HasCRC32())
+		return "ARMv8";
+#endif
+	return "C++";
+}
+
+CRC32::CRC32()
+{
+	Reset();
+}
+
+void CRC32::Update(const byte *s, size_t n)
+{
+#if (CRYPTOPP_ARM_CRC32_AVAILABLE)
+	if (HasCRC32())
+	{
+		CRC32_Update_ARMV8(s, n, m_crc);
+		return;
+	}
+#endif
+
+	word32 crc = m_crc;
+
+	for(; !IsAligned<word32>(s) && n > 0; n--)
+		crc = m_tab[CRC32_INDEX(crc) ^ *s++] ^ CRC32_SHIFTED(crc);
+
+	while (n >= 4)
+	{
+		crc ^= *(const word32 *)(void*)s;
+		crc = m_tab[CRC32_INDEX(crc)] ^ CRC32_SHIFTED(crc);
+		crc = m_tab[CRC32_INDEX(crc)] ^ CRC32_SHIFTED(crc);
+		crc = m_tab[CRC32_INDEX(crc)] ^ CRC32_SHIFTED(crc);
+		crc = m_tab[CRC32_INDEX(crc)] ^ CRC32_SHIFTED(crc);
+		n -= 4; s += 4;
+	}
+
+	while (n--)
+		crc = m_tab[CRC32_INDEX(crc) ^ *s++] ^ CRC32_SHIFTED(crc);
+
+	m_crc = crc;
+}
+
+void CRC32::TruncatedFinal(byte *hash, size_t size)
+{
+	ThrowIfInvalidTruncatedSize(size);
+
+	m_crc ^= CRC32_NEGL;
+	for (size_t i=0; i<size; i++)
+		hash[i] = GetCrcByte(i);
+
+	Reset();
+}
+
+// Castagnoli CRC32C (iSCSI)
+
+const word32 CRC32C::m_tab[] = {
+#if (CRYPTOPP_LITTLE_ENDIAN)
+    0x00000000L, 0xf26b8303L, 0xe13b70f7L, 0x1350f3f4L, 0xc79a971fL,
+    0x35f1141cL, 0x26a1e7e8L, 0xd4ca64ebL, 0x8ad958cfL, 0x78b2dbccL,
+    0x6be22838L, 0x9989ab3bL, 0x4d43cfd0L, 0xbf284cd3L, 0xac78bf27L,
+    0x5e133c24L, 0x105ec76fL, 0xe235446cL, 0xf165b798L, 0x030e349bL,
+    0xd7c45070L, 0x25afd373L, 0x36ff2087L, 0xc494a384L, 0x9a879fa0L,
+    0x68ec1ca3L, 0x7bbcef57L, 0x89d76c54L, 0x5d1d08bfL, 0xaf768bbcL,
+    0xbc267848L, 0x4e4dfb4bL, 0x20bd8edeL, 0xd2d60dddL, 0xc186fe29L,
+    0x33ed7d2aL, 0xe72719c1L, 0x154c9ac2L, 0x061c6936L, 0xf477ea35L,
+    0xaa64d611L, 0x580f5512L, 0x4b5fa6e6L, 0xb93425e5L, 0x6dfe410eL,
+    0x9f95c20dL, 0x8cc531f9L, 0x7eaeb2faL, 0x30e349b1L, 0xc288cab2L,
+    0xd1d83946L, 0x23b3ba45L, 0xf779deaeL, 0x05125dadL, 0x1642ae59L,
+    0xe4292d5aL, 0xba3a117eL, 0x4851927dL, 0x5b016189L, 0xa96ae28aL,
+    0x7da08661L, 0x8fcb0562L, 0x9c9bf696L, 0x6ef07595L, 0x417b1dbcL,
+    0xb3109ebfL, 0xa0406d4bL, 0x522bee48L, 0x86e18aa3L, 0x748a09a0L,
+    0x67dafa54L, 0x95b17957L, 0xcba24573L, 0x39c9c670L, 0x2a993584L,
+    0xd8f2b687L, 0x0c38d26cL, 0xfe53516fL, 0xed03a29bL, 0x1f682198L,
+    0x5125dad3L, 0xa34e59d0L, 0xb01eaa24L, 0x42752927L, 0x96bf4dccL,
+    0x64d4cecfL, 0x77843d3bL, 0x85efbe38L, 0xdbfc821cL, 0x2997011fL,
+    0x3ac7f2ebL, 0xc8ac71e8L, 0x1c661503L, 0xee0d9600L, 0xfd5d65f4L,
+    0x0f36e6f7L, 0x61c69362L, 0x93ad1061L, 0x80fde395L, 0x72966096L,
+    0xa65c047dL, 0x5437877eL, 0x4767748aL, 0xb50cf789L, 0xeb1fcbadL,
+    0x197448aeL, 0x0a24bb5aL, 0xf84f3859L, 0x2c855cb2L, 0xdeeedfb1L,
+    0xcdbe2c45L, 0x3fd5af46L, 0x7198540dL, 0x83f3d70eL, 0x90a324faL,
+    0x62c8a7f9L, 0xb602c312L, 0x44694011L, 0x5739b3e5L, 0xa55230e6L,
+    0xfb410cc2L, 0x092a8fc1L, 0x1a7a7c35L, 0xe811ff36L, 0x3cdb9bddL,
+    0xceb018deL, 0xdde0eb2aL, 0x2f8b6829L, 0x82f63b78L, 0x709db87bL,
+    0x63cd4b8fL, 0x91a6c88cL, 0x456cac67L, 0xb7072f64L, 0xa457dc90L,
+    0x563c5f93L, 0x082f63b7L, 0xfa44e0b4L, 0xe9141340L, 0x1b7f9043L,
+    0xcfb5f4a8L, 0x3dde77abL, 0x2e8e845fL, 0xdce5075cL, 0x92a8fc17L,
+    0x60c37f14L, 0x73938ce0L, 0x81f80fe3L, 0x55326b08L, 0xa759e80bL,
+    0xb4091bffL, 0x466298fcL, 0x1871a4d8L, 0xea1a27dbL, 0xf94ad42fL,
+    0x0b21572cL, 0xdfeb33c7L, 0x2d80b0c4L, 0x3ed04330L, 0xccbbc033L,
+    0xa24bb5a6L, 0x502036a5L, 0x4370c551L, 0xb11b4652L, 0x65d122b9L,
+    0x97baa1baL, 0x84ea524eL, 0x7681d14dL, 0x2892ed69L, 0xdaf96e6aL,
+    0xc9a99d9eL, 0x3bc21e9dL, 0xef087a76L, 0x1d63f975L, 0x0e330a81L,
+    0xfc588982L, 0xb21572c9L, 0x407ef1caL, 0x532e023eL, 0xa145813dL,
+    0x758fe5d6L, 0x87e466d5L, 0x94b49521L, 0x66df1622L, 0x38cc2a06L,
+    0xcaa7a905L, 0xd9f75af1L, 0x2b9cd9f2L, 0xff56bd19L, 0x0d3d3e1aL,
+    0x1e6dcdeeL, 0xec064eedL, 0xc38d26c4L, 0x31e6a5c7L, 0x22b65633L,
+    0xd0ddd530L, 0x0417b1dbL, 0xf67c32d8L, 0xe52cc12cL, 0x1747422fL,
+    0x49547e0bL, 0xbb3ffd08L, 0xa86f0efcL, 0x5a048dffL, 0x8ecee914L,
+    0x7ca56a17L, 0x6ff599e3L, 0x9d9e1ae0L, 0xd3d3e1abL, 0x21b862a8L,
+    0x32e8915cL, 0xc083125fL, 0x144976b4L, 0xe622f5b7L, 0xf5720643L,
+    0x07198540L, 0x590ab964L, 0xab613a67L, 0xb831c993L, 0x4a5a4a90L,
+    0x9e902e7bL, 0x6cfbad78L, 0x7fab5e8cL, 0x8dc0dd8fL, 0xe330a81aL,
+    0x115b2b19L, 0x020bd8edL, 0xf0605beeL, 0x24aa3f05L, 0xd6c1bc06L,
+    0xc5914ff2L, 0x37faccf1L, 0x69e9f0d5L, 0x9b8273d6L, 0x88d28022L,
+    0x7ab90321L, 0xae7367caL, 0x5c18e4c9L, 0x4f48173dL, 0xbd23943eL,
+    0xf36e6f75L, 0x0105ec76L, 0x12551f82L, 0xe03e9c81L, 0x34f4f86aL,
+    0xc69f7b69L, 0xd5cf889dL, 0x27a40b9eL, 0x79b737baL, 0x8bdcb4b9L,
+    0x988c474dL, 0x6ae7c44eL, 0xbe2da0a5L, 0x4c4623a6L, 0x5f16d052L,
+    0xad7d5351L
+#else
+    0x00000000L, 0x03836bf2L, 0xf7703be1L, 0xf4f35013L, 0x1f979ac7L,
+    0x1c14f135L, 0xe8e7a126L, 0xeb64cad4L, 0xcf58d98aL, 0xccdbb278L,
+    0x3828e26bL, 0x3bab8999L, 0xd0cf434dL, 0xd34c28bfL, 0x27bf78acL,
+    0x243c135eL, 0x6fc75e10L, 0x6c4435e2L, 0x98b765f1L, 0x9b340e03L,
+    0x7050c4d7L, 0x73d3af25L, 0x8720ff36L, 0x84a394c4L, 0xa09f879aL,
+    0xa31cec68L, 0x57efbc7bL, 0x546cd789L, 0xbf081d5dL, 0xbc8b76afL,
+    0x487826bcL, 0x4bfb4d4eL, 0xde8ebd20L, 0xdd0dd6d2L, 0x29fe86c1L,
+    0x2a7ded33L, 0xc11927e7L, 0xc29a4c15L, 0x36691c06L, 0x35ea77f4L,
+    0x11d664aaL, 0x12550f58L, 0xe6a65f4bL, 0xe52534b9L, 0x0e41fe6dL,
+    0x0dc2959fL, 0xf931c58cL, 0xfab2ae7eL, 0xb149e330L, 0xb2ca88c2L,
+    0x4639d8d1L, 0x45bab323L, 0xaede79f7L, 0xad5d1205L, 0x59ae4216L,
+    0x5a2d29e4L, 0x7e113abaL, 0x7d925148L, 0x8961015bL, 0x8ae26aa9L,
+    0x6186a07dL, 0x6205cb8fL, 0x96f69b9cL, 0x9575f06eL, 0xbc1d7b41L,
+    0xbf9e10b3L, 0x4b6d40a0L, 0x48ee2b52L, 0xa38ae186L, 0xa0098a74L,
+    0x54fada67L, 0x5779b195L, 0x7345a2cbL, 0x70c6c939L, 0x8435992aL,
+    0x87b6f2d8L, 0x6cd2380cL, 0x6f5153feL, 0x9ba203edL, 0x9821681fL,
+    0xd3da2551L, 0xd0594ea3L, 0x24aa1eb0L, 0x27297542L, 0xcc4dbf96L,
+    0xcfced464L, 0x3b3d8477L, 0x38beef85L, 0x1c82fcdbL, 0x1f019729L,
+    0xebf2c73aL, 0xe871acc8L, 0x0315661cL, 0x00960deeL, 0xf4655dfdL,
+    0xf7e6360fL, 0x6293c661L, 0x6110ad93L, 0x95e3fd80L, 0x96609672L,
+    0x7d045ca6L, 0x7e873754L, 0x8a746747L, 0x89f70cb5L, 0xadcb1febL,
+    0xae487419L, 0x5abb240aL, 0x59384ff8L, 0xb25c852cL, 0xb1dfeedeL,
+    0x452cbecdL, 0x46afd53fL, 0x0d549871L, 0x0ed7f383L, 0xfa24a390L,
+    0xf9a7c862L, 0x12c302b6L, 0x11406944L, 0xe5b33957L, 0xe63052a5L,
+    0xc20c41fbL, 0xc18f2a09L, 0x357c7a1aL, 0x36ff11e8L, 0xdd9bdb3cL,
+    0xde18b0ceL, 0x2aebe0ddL, 0x29688b2fL, 0x783bf682L, 0x7bb89d70L,
+    0x8f4bcd63L, 0x8cc8a691L, 0x67ac6c45L, 0x642f07b7L, 0x90dc57a4L,
+    0x935f3c56L, 0xb7632f08L, 0xb4e044faL, 0x401314e9L, 0x43907f1bL,
+    0xa8f4b5cfL, 0xab77de3dL, 0x5f848e2eL, 0x5c07e5dcL, 0x17fca892L,
+    0x147fc360L, 0xe08c9373L, 0xe30ff881L, 0x086b3255L, 0x0be859a7L,
+    0xff1b09b4L, 0xfc986246L, 0xd8a47118L, 0xdb271aeaL, 0x2fd44af9L,
+    0x2c57210bL, 0xc733ebdfL, 0xc4b0802dL, 0x3043d03eL, 0x33c0bbccL,
+    0xa6b54ba2L, 0xa5362050L, 0x51c57043L, 0x52461bb1L, 0xb922d165L,
+    0xbaa1ba97L, 0x4e52ea84L, 0x4dd18176L, 0x69ed9228L, 0x6a6ef9daL,
+    0x9e9da9c9L, 0x9d1ec23bL, 0x767a08efL, 0x75f9631dL, 0x810a330eL,
+    0x828958fcL, 0xc97215b2L, 0xcaf17e40L, 0x3e022e53L, 0x3d8145a1L,
+    0xd6e58f75L, 0xd566e487L, 0x2195b494L, 0x2216df66L, 0x062acc38L,
+    0x05a9a7caL, 0xf15af7d9L, 0xf2d99c2bL, 0x19bd56ffL, 0x1a3e3d0dL,
+    0xeecd6d1eL, 0xed4e06ecL, 0xc4268dc3L, 0xc7a5e631L, 0x3356b622L,
+    0x30d5ddd0L, 0xdbb11704L, 0xd8327cf6L, 0x2cc12ce5L, 0x2f424717L,
+    0x0b7e5449L, 0x08fd3fbbL, 0xfc0e6fa8L, 0xff8d045aL, 0x14e9ce8eL,
+    0x176aa57cL, 0xe399f56fL, 0xe01a9e9dL, 0xabe1d3d3L, 0xa862b821L,
+    0x5c91e832L, 0x5f1283c0L, 0xb4764914L, 0xb7f522e6L, 0x430672f5L,
+    0x40851907L, 0x64b90a59L, 0x673a61abL, 0x93c931b8L, 0x904a5a4aL,
+    0x7b2e909eL, 0x78adfb6cL, 0x8c5eab7fL, 0x8fddc08dL, 0x1aa830e3L,
+    0x192b5b11L, 0xedd80b02L, 0xee5b60f0L, 0x053faa24L, 0x06bcc1d6L,
+    0xf24f91c5L, 0xf1ccfa37L, 0xd5f0e969L, 0xd673829bL, 0x2280d288L,
+    0x2103b97aL, 0xca6773aeL, 0xc9e4185cL, 0x3d17484fL, 0x3e9423bdL,
+    0x756f6ef3L, 0x76ec0501L, 0x821f5512L, 0x819c3ee0L, 0x6af8f434L,
+    0x697b9fc6L, 0x9d88cfd5L, 0x9e0ba427L, 0xba37b779L, 0xb9b4dc8bL,
+    0x4d478c98L, 0x4ec4e76aL, 0xa5a02dbeL, 0xa623464cL, 0x52d0165fL,
+    0x51537dadL
+#endif
+};
+
+std::string CRC32C::AlgorithmProvider() const
+{
+#if (CRYPTOPP_ARM_CRC32_AVAILABLE)
+	if (HasCRC32())
+		return "ARMv8";
+#endif
+#if (CRYPTOPP_SSE42_AVAILABLE)
+	if (HasSSE42())
+		return "SSE4.2";
+#endif
+	return "C++";
+}
+
+CRC32C::CRC32C()
+{
+	Reset();
+}
+
+void CRC32C::Update(const byte *s, size_t n)
+{
+#if (CRYPTOPP_SSE42_AVAILABLE)
+	if (HasSSE42())
+	{
+		CRC32C_Update_SSE42(s, n, m_crc);
+		return;
+	}
+#elif (CRYPTOPP_ARM_CRC32_AVAILABLE)
+	if (HasCRC32())
+	{
+		CRC32C_Update_ARMV8(s, n, m_crc);
+		return;
+	}
+#endif
+
+	word32 crc = m_crc;
+
+	for(; !IsAligned<word32>(s) && n > 0; n--)
+		crc = m_tab[CRC32_INDEX(crc) ^ *s++] ^ CRC32_SHIFTED(crc);
+
+	while (n >= 4)
+	{
+		crc ^= *(const word32 *)(void*)s;
+		crc = m_tab[CRC32_INDEX(crc)] ^ CRC32_SHIFTED(crc);
+		crc = m_tab[CRC32_INDEX(crc)] ^ CRC32_SHIFTED(crc);
+		crc = m_tab[CRC32_INDEX(crc)] ^ CRC32_SHIFTED(crc);
+		crc = m_tab[CRC32_INDEX(crc)] ^ CRC32_SHIFTED(crc);
+		n -= 4; s += 4;
+	}
+
+	while (n--)
+		crc = m_tab[CRC32_INDEX(crc) ^ *s++] ^ CRC32_SHIFTED(crc);
+
+	m_crc = crc;
+}
+
+void CRC32C::TruncatedFinal(byte *hash, size_t size)
+{
+	ThrowIfInvalidTruncatedSize(size);
+
+	m_crc ^= CRC32_NEGL;
+	for (size_t i=0; i<size; i++)
+		hash[i] = GetCrcByte(i);
+
+	Reset();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/crc.h b/runtime/third_party/cryptopp/crc.h
new file mode 100644
index 0000000..17e5977
--- /dev/null
+++ b/runtime/third_party/cryptopp/crc.h
@@ -0,0 +1,90 @@
+// crc.h - originally written and placed in the public domain by Wei Dai
+
+/// \file crc.h
+/// \brief Classes for CRC-32 and CRC-32C checksum algorithm
+
+#ifndef CRYPTOPP_CRC32_H
+#define CRYPTOPP_CRC32_H
+
+#include "cryptlib.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const word32 CRC32_NEGL = 0xffffffffL;
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+#define CRC32_INDEX(c) (c & 0xff)
+#define CRC32_SHIFTED(c) (c >> 8)
+#else
+#define CRC32_INDEX(c) (c >> 24)
+#define CRC32_SHIFTED(c) (c << 8)
+#endif
+
+/// \brief CRC-32 Checksum Calculation
+/// \details Uses CRC polynomial 0xEDB88320
+class CRC32 : public HashTransformation
+{
+public:
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 4);
+	CRC32();
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *hash, size_t size);
+	unsigned int DigestSize() const {return DIGESTSIZE;}
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "CRC32";}
+	std::string AlgorithmName() const {return StaticAlgorithmName();}
+
+	/// \brief Updates a CRC with additional input
+	/// \param b the additional input as a byte
+	void UpdateByte(byte b) {m_crc = m_tab[CRC32_INDEX(m_crc) ^ b] ^ CRC32_SHIFTED(m_crc);}
+
+	/// \brief Retrieves the i-th byte of the CRC
+	/// \param i the additional input as a byte
+	/// \return the byte at the i-th position
+	byte GetCrcByte(size_t i) const {return reinterpret_cast<const byte *>(&m_crc)[i];}
+
+	std::string AlgorithmProvider() const;
+
+protected:
+	void Reset() {m_crc = CRC32_NEGL;}
+
+private:
+	static const word32 m_tab[256];
+	word32 m_crc;
+};
+
+/// \brief CRC-32C Checksum Calculation
+/// \details Uses CRC polynomial 0x82F63B78
+/// \since Crypto++ 5.6.4
+class CRC32C : public HashTransformation
+{
+public:
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 4);
+	CRC32C();
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *hash, size_t size);
+	unsigned int DigestSize() const {return DIGESTSIZE;}
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "CRC32C";}
+	std::string AlgorithmName() const {return StaticAlgorithmName();}
+
+	/// \brief Updates a CRC with additional input
+	/// \param b the additional input as a byte
+	void UpdateByte(byte b) {m_crc = m_tab[CRC32_INDEX(m_crc) ^ b] ^ CRC32_SHIFTED(m_crc);}
+
+	/// \brief Retrieves the i-th byte of the CRC
+	/// \param i the additional input as a byte
+	/// \return the byte at the i-th position
+	byte GetCrcByte(size_t i) const {return reinterpret_cast<const byte *>(&m_crc)[i];}
+
+	std::string AlgorithmProvider() const;
+
+protected:
+	void Reset() {m_crc = CRC32_NEGL;}
+
+private:
+	static const word32 m_tab[256];
+	word32 m_crc;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/crc_simd.cpp b/runtime/third_party/cryptopp/crc_simd.cpp
new file mode 100644
index 0000000..c311628
--- /dev/null
+++ b/runtime/third_party/cryptopp/crc_simd.cpp
@@ -0,0 +1,197 @@
+// crc_simd.cpp - written and placed in the public domain by
+//                Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//
+//    This source file uses intrinsics to gain access to SSE4.2 and
+//    ARMv8a CRC-32 and CRC-32C instructions. A separate source file
+//    is needed because additional CXXFLAGS are required to enable
+//    the appropriate instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+#include "misc.h"
+
+#if (CRYPTOPP_SSE42_AVAILABLE)
+# include <nmmintrin.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#if (CRYPTOPP_ARM_CRC32_AVAILABLE)
+# include "arm_simd.h"
+#endif
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4244)
+#endif
+
+#ifndef EXCEPTION_EXECUTE_HANDLER
+# define EXCEPTION_EXECUTE_HANDLER 1
+#endif
+
+#define CONST_WORD32_CAST(x) ((const word32 *)(void*)(x))
+#define CONST_WORD64_CAST(x) ((const word64 *)(void*)(x))
+
+// Squash MS LNK4221 and libtool warnings
+extern const char CRC_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+
+    static jmp_buf s_jmpSIGILL;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpSIGILL, 1);
+    }
+}
+#endif  // Not CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
+
+#if (CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8)
+
+bool CPU_ProbeCRC32()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif (CRYPTOPP_ARM_CRC32_AVAILABLE)
+# if defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+    volatile bool result = true;
+    __try
+    {
+        word32 w=0, x=1; byte z=3;
+        w = CRC32W(w,x);
+        w = CRC32B(w,z);
+        w = CRC32CW(w,x);
+        w = CRC32CB(w,z);
+
+        result = !!w;
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        return false;
+    }
+    return result;
+#else
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile bool result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        word32 w=0, x=1; byte z=3;
+        w = CRC32W(w,x);
+        w = CRC32B(w,z);
+        w = CRC32CW(w,x);
+        w = CRC32CB(w,z);
+
+        // Hack... GCC optimizes away the code and returns true
+        result = !!w;
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_ARM_CRC32_AVAILABLE
+}
+#endif  // ARM32 or ARM64
+
+#if (CRYPTOPP_ARM_CRC32_AVAILABLE)
+void CRC32_Update_ARMV8(const byte *s, size_t n, word32& c)
+{
+    for(; !IsAligned<word32>(s) && n > 0; s++, n--)
+        c = CRC32B(c, *s);
+
+    for(; n >= 16; s+=16, n-=16)
+        c = CRC32Wx4(c, CONST_WORD32_CAST(s));
+
+    for(; n >= 4; s+=4, n-=4)
+        c = CRC32W(c, *CONST_WORD32_CAST(s));
+
+    for(; n > 0; s++, n--)
+        c = CRC32B(c, *s);
+}
+
+void CRC32C_Update_ARMV8(const byte *s, size_t n, word32& c)
+{
+    for(; !IsAligned<word32>(s) && n > 0; s++, n--)
+        c = CRC32CB(c, *s);
+
+    for(; n >= 16; s+=16, n-=16)
+        c = CRC32CWx4(c, CONST_WORD32_CAST(s));
+
+    for(; n >= 4; s+=4, n-=4)
+        c = CRC32CW(c, *CONST_WORD32_CAST(s));
+
+    for(; n > 0; s++, n--)
+        c = CRC32CB(c, *s);
+}
+#endif
+
+#if (CRYPTOPP_SSE42_AVAILABLE)
+void CRC32C_Update_SSE42(const byte *s, size_t n, word32& c)
+{
+    // Temporary due to https://github.com/weidai11/cryptopp/issues/1202
+    word32 v = c;
+
+    // 64-bit code path due to https://github.com/weidai11/cryptopp/issues/1202
+#if CRYPTOPP_BOOL_X64
+    for(; !IsAligned<word64>(s) && n > 0; s++, n--)
+        v = _mm_crc32_u8(v, *s);
+#else
+    for(; !IsAligned<word32>(s) && n > 0; s++, n--)
+        v = _mm_crc32_u8(v, *s);
+#endif
+
+#if CRYPTOPP_BOOL_X64
+    for(; n >= 32; s+=32, n-=32)
+    {
+        v = _mm_crc32_u64(_mm_crc32_u64(_mm_crc32_u64(_mm_crc32_u64(v,
+            *CONST_WORD64_CAST(s+ 0)), *CONST_WORD64_CAST(s+ 8)),
+            *CONST_WORD64_CAST(s+16)), *CONST_WORD64_CAST(s+24));
+    }
+#endif
+
+    for(; n >= 16; s+=16, n-=16)
+    {
+        v = _mm_crc32_u32(_mm_crc32_u32(_mm_crc32_u32(_mm_crc32_u32(v,
+            *CONST_WORD32_CAST(s+ 0)), *CONST_WORD32_CAST(s+ 4)),
+            *CONST_WORD32_CAST(s+ 8)), *CONST_WORD32_CAST(s+12));
+    }
+
+    for(; n >= 4; s+=4, n-=4)
+        v = _mm_crc32_u32(v, *CONST_WORD32_CAST(s));
+
+    for(; n > 0; s++, n--)
+        v = _mm_crc32_u8(v, *s);
+
+    c = static_cast<word32>(v);
+}
+#endif
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/cryptlib.cpp b/runtime/third_party/cryptopp/cryptlib.cpp
new file mode 100644
index 0000000..9130215
--- /dev/null
+++ b/runtime/third_party/cryptopp/cryptlib.cpp
@@ -0,0 +1,1054 @@
+// cryptlib.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4127 4189 4459)
+#endif
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wunused-value"
+# pragma GCC diagnostic ignored "-Wunused-variable"
+# pragma GCC diagnostic ignored "-Wunused-parameter"
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "cryptlib.h"
+#include "filters.h"
+#include "algparam.h"
+#include "fips140.h"
+#include "argnames.h"
+#include "fltrimpl.h"
+#include "osrng.h"
+#include "secblock.h"
+#include "smartptr.h"
+#include "stdcpp.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+CRYPTOPP_COMPILE_ASSERT(sizeof(byte) == 1);
+CRYPTOPP_COMPILE_ASSERT(sizeof(word16) == 2);
+CRYPTOPP_COMPILE_ASSERT(sizeof(word32) == 4);
+CRYPTOPP_COMPILE_ASSERT(sizeof(word64) == 8);
+#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+CRYPTOPP_COMPILE_ASSERT(sizeof(dword) == 2*sizeof(word));
+#endif
+
+BufferedTransformation & TheBitBucket()
+{
+	static BitBucket bitBucket;
+	return bitBucket;
+}
+
+Algorithm::Algorithm(bool checkSelfTestStatus)
+{
+	if (checkSelfTestStatus && FIPS_140_2_ComplianceEnabled())
+	{
+		if (GetPowerUpSelfTestStatus() == POWER_UP_SELF_TEST_NOT_DONE && !PowerUpSelfTestInProgressOnThisThread())
+			throw SelfTestFailure("Cryptographic algorithms are disabled before the power-up self tests are performed.");
+
+		if (GetPowerUpSelfTestStatus() == POWER_UP_SELF_TEST_FAILED)
+			throw SelfTestFailure("Cryptographic algorithms are disabled after a power-up self test failed.");
+	}
+}
+
+void SimpleKeyingInterface::SetKey(const byte *key, size_t length, const NameValuePairs &params)
+{
+	this->ThrowIfInvalidKeyLength(length);
+	this->UncheckedSetKey(key, static_cast<unsigned int>(length), params);
+}
+
+void SimpleKeyingInterface::SetKeyWithRounds(const byte *key, size_t length, int rounds)
+{
+	SetKey(key, length, MakeParameters(Name::Rounds(), rounds));
+}
+
+void SimpleKeyingInterface::SetKeyWithIV(const byte *key, size_t length, const byte *iv, size_t ivLength)
+{
+	SetKey(key, length, MakeParameters(Name::IV(), ConstByteArrayParameter(iv, ivLength)));
+}
+
+void SimpleKeyingInterface::ThrowIfInvalidKeyLength(size_t length)
+{
+	if (!IsValidKeyLength(length))
+		throw InvalidKeyLength(GetAlgorithm().AlgorithmName(), length);
+}
+
+void SimpleKeyingInterface::ThrowIfResynchronizable()
+{
+	if (IsResynchronizable())
+		throw InvalidArgument(GetAlgorithm().AlgorithmName() + ": this object requires an IV");
+}
+
+void SimpleKeyingInterface::ThrowIfInvalidIV(const byte *iv)
+{
+	if (!iv && IVRequirement() == UNPREDICTABLE_RANDOM_IV)
+		throw InvalidArgument(GetAlgorithm().AlgorithmName() + ": this object cannot use a null IV");
+}
+
+size_t SimpleKeyingInterface::ThrowIfInvalidIVLength(int length)
+{
+	size_t size = 0;
+	if (length < 0)
+		size = static_cast<size_t>(IVSize());
+	else if ((size_t)length < MinIVLength())
+		throw InvalidArgument(GetAlgorithm().AlgorithmName() + ": IV length " + IntToString(length) + " is less than the minimum of " + IntToString(MinIVLength()));
+	else if ((size_t)length > MaxIVLength())
+		throw InvalidArgument(GetAlgorithm().AlgorithmName() + ": IV length " + IntToString(length) + " exceeds the maximum of " + IntToString(MaxIVLength()));
+	else
+		size = static_cast<size_t>(length);
+
+	return size;
+}
+
+const byte * SimpleKeyingInterface::GetIVAndThrowIfInvalid(const NameValuePairs &params, size_t &size)
+{
+	ConstByteArrayParameter ivWithLength;
+	const byte *iv = NULLPTR;
+	bool found = false;
+
+	try {found = params.GetValue(Name::IV(), ivWithLength);}
+	catch (const NameValuePairs::ValueTypeMismatch &) {}
+
+	if (found)
+	{
+		iv = ivWithLength.begin();
+		ThrowIfInvalidIV(iv);
+		size = ThrowIfInvalidIVLength(static_cast<int>(ivWithLength.size()));
+	}
+	else if (params.GetValue(Name::IV(), iv))
+	{
+		ThrowIfInvalidIV(iv);
+		size = static_cast<size_t>(IVSize());
+	}
+	else
+	{
+		ThrowIfResynchronizable();
+		size = 0;
+	}
+
+	return iv;
+}
+
+void SimpleKeyingInterface::GetNextIV(RandomNumberGenerator &rng, byte *iv)
+{
+	rng.GenerateBlock(iv, IVSize());
+}
+
+size_t BlockTransformation::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const
+{
+	CRYPTOPP_ASSERT(inBlocks);
+	CRYPTOPP_ASSERT(outBlocks);
+	CRYPTOPP_ASSERT(length);
+
+	const unsigned int blockSize = BlockSize();
+	size_t inIncrement = (flags & (BT_InBlockIsCounter|BT_DontIncrementInOutPointers)) ? 0 : blockSize;
+	size_t xorIncrement = xorBlocks ? blockSize : 0;
+	size_t outIncrement = (flags & BT_DontIncrementInOutPointers) ? 0 : blockSize;
+
+	if (flags & BT_ReverseDirection)
+	{
+		inBlocks = PtrAdd(inBlocks, length - blockSize);
+		xorBlocks = PtrAdd(xorBlocks, length - blockSize);
+		outBlocks = PtrAdd(outBlocks, length - blockSize);
+		inIncrement = 0-inIncrement;
+		xorIncrement = 0-xorIncrement;
+		outIncrement = 0-outIncrement;
+	}
+
+	// Coverity finding.
+	const bool xorFlag = xorBlocks && (flags & BT_XorInput);
+	while (length >= blockSize)
+	{
+		if (xorFlag)
+		{
+			// xorBlocks non-NULL and with BT_XorInput.
+			xorbuf(outBlocks, xorBlocks, inBlocks, blockSize);
+			ProcessBlock(outBlocks);
+		}
+		else
+		{
+			// xorBlocks may be non-NULL and without BT_XorInput.
+			ProcessAndXorBlock(inBlocks, xorBlocks, outBlocks);
+		}
+
+		if (flags & BT_InBlockIsCounter)
+			const_cast<byte *>(inBlocks)[blockSize-1]++;
+
+		inBlocks = PtrAdd(inBlocks, inIncrement);
+		outBlocks = PtrAdd(outBlocks, outIncrement);
+		xorBlocks = PtrAdd(xorBlocks, xorIncrement);
+		length -= blockSize;
+	}
+
+	return length;
+}
+
+unsigned int BlockTransformation::OptimalDataAlignment() const
+{
+	return GetAlignmentOf<word32>();
+}
+
+unsigned int StreamTransformation::OptimalDataAlignment() const
+{
+	return GetAlignmentOf<word32>();
+}
+
+unsigned int HashTransformation::OptimalDataAlignment() const
+{
+	return GetAlignmentOf<word32>();
+}
+
+#if 0
+void StreamTransformation::ProcessLastBlock(byte *outString, const byte *inString, size_t length)
+{
+	CRYPTOPP_ASSERT(MinLastBlockSize() == 0);	// this function should be overridden otherwise
+
+	if (length == MandatoryBlockSize())
+		ProcessData(outString, inString, length);
+	else if (length != 0)
+		throw NotImplemented(AlgorithmName() + ": this object doesn't support a special last block");
+}
+#endif
+
+size_t StreamTransformation::ProcessLastBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength)
+{
+	// this function should be overridden otherwise
+	CRYPTOPP_ASSERT(MinLastBlockSize() == 0);
+
+	if (inLength == MandatoryBlockSize())
+	{
+		outLength = inLength; // squash unused warning
+		ProcessData(outString, inString, inLength);
+	}
+	else if (inLength != 0)
+		throw NotImplemented(AlgorithmName() + ": this object doesn't support a special last block");
+
+	return outLength;
+}
+
+void AuthenticatedSymmetricCipher::SpecifyDataLengths(lword headerLength, lword messageLength, lword footerLength)
+{
+	if (headerLength > MaxHeaderLength())
+		throw InvalidArgument(GetAlgorithm().AlgorithmName() + ": header length " + IntToString(headerLength) + " exceeds the maximum of " + IntToString(MaxHeaderLength()));
+
+	if (messageLength > MaxMessageLength())
+		throw InvalidArgument(GetAlgorithm().AlgorithmName() + ": message length " + IntToString(messageLength) + " exceeds the maximum of " + IntToString(MaxMessageLength()));
+
+	if (footerLength > MaxFooterLength())
+		throw InvalidArgument(GetAlgorithm().AlgorithmName() + ": footer length " + IntToString(footerLength) + " exceeds the maximum of " + IntToString(MaxFooterLength()));
+
+	UncheckedSpecifyDataLengths(headerLength, messageLength, footerLength);
+}
+
+void AuthenticatedSymmetricCipher::EncryptAndAuthenticate(byte *ciphertext, byte *mac, size_t macSize, const byte *iv, int ivLength, const byte *header, size_t headerLength, const byte *message, size_t messageLength)
+{
+	Resynchronize(iv, ivLength);
+	SpecifyDataLengths(headerLength, messageLength);
+	Update(header, headerLength);
+	ProcessString(ciphertext, message, messageLength);
+	TruncatedFinal(mac, macSize);
+}
+
+bool AuthenticatedSymmetricCipher::DecryptAndVerify(byte *message, const byte *mac, size_t macLength, const byte *iv, int ivLength, const byte *header, size_t headerLength, const byte *ciphertext, size_t ciphertextLength)
+{
+	Resynchronize(iv, ivLength);
+	SpecifyDataLengths(headerLength, ciphertextLength);
+	Update(header, headerLength);
+	ProcessString(message, ciphertext, ciphertextLength);
+	return TruncatedVerify(mac, macLength);
+}
+
+std::string AuthenticatedSymmetricCipher::AlgorithmName() const
+{
+	// Squash C4505 on Visual Studio 2008 and friends
+	return "Unknown";
+}
+
+unsigned int RandomNumberGenerator::GenerateBit()
+{
+	return GenerateByte() & 1;
+}
+
+byte RandomNumberGenerator::GenerateByte()
+{
+	byte b;
+	GenerateBlock(&b, 1);
+	return b;
+}
+
+word32 RandomNumberGenerator::GenerateWord32(word32 min, word32 max)
+{
+	const word32 range = max-min;
+	const unsigned int maxBits = BitPrecision(range);
+
+	word32 value;
+
+	do
+	{
+		GenerateBlock((byte *)&value, sizeof(value));
+		value = Crop(value, maxBits);
+	} while (value > range);
+
+	return value+min;
+}
+
+// Stack recursion below... GenerateIntoBufferedTransformation calls GenerateBlock,
+// and GenerateBlock calls GenerateIntoBufferedTransformation. Ad infinitum. Also
+// see http://github.com/weidai11/cryptopp/issues/38.
+//
+// According to Wei, RandomNumberGenerator is an interface, and it should not
+// be instantiable. Its now spilt milk, and we are going to CRYPTOPP_ASSERT it in Debug
+// builds to alert the programmer and throw in Release builds. Developers have
+// a reference implementation in case its needed. If a programmer
+// unintentionally lands here, then they should ensure use of a
+// RandomNumberGenerator pointer or reference so polymorphism can provide the
+// proper runtime dispatching.
+
+void RandomNumberGenerator::GenerateBlock(byte *output, size_t size)
+{
+	CRYPTOPP_UNUSED(output), CRYPTOPP_UNUSED(size);
+
+	ArraySink s(output, size);
+	GenerateIntoBufferedTransformation(s, DEFAULT_CHANNEL, size);
+}
+
+void RandomNumberGenerator::DiscardBytes(size_t n)
+{
+	GenerateIntoBufferedTransformation(TheBitBucket(), DEFAULT_CHANNEL, n);
+}
+
+void RandomNumberGenerator::GenerateIntoBufferedTransformation(BufferedTransformation &target, const std::string &channel, lword length)
+{
+	FixedSizeSecBlock<byte, 256> buffer;
+	while (length)
+	{
+		size_t len = UnsignedMin(buffer.size(), length);
+		GenerateBlock(buffer, len);
+		(void)target.ChannelPut(channel, buffer, len);
+		length -= len;
+	}
+}
+
+size_t KeyDerivationFunction::MinDerivedKeyLength() const
+{
+	return 0;
+}
+
+size_t KeyDerivationFunction::MaxDerivedKeyLength() const
+{
+	return static_cast<size_t>(-1);
+}
+
+void KeyDerivationFunction::ThrowIfInvalidDerivedKeyLength(size_t length) const
+{
+	if (!IsValidDerivedLength(length))
+		throw InvalidDerivedKeyLength(GetAlgorithm().AlgorithmName(), length);
+}
+
+void KeyDerivationFunction::SetParameters(const NameValuePairs& params) {
+	CRYPTOPP_UNUSED(params);
+}
+
+/// \brief Random Number Generator that does not produce random numbers
+/// \details ClassNullRNG can be used for functions that require a RandomNumberGenerator
+///   but don't actually use it. The class throws NotImplemented when a generation function is called.
+/// \sa NullRNG()
+class ClassNullRNG : public RandomNumberGenerator
+{
+public:
+	/// \brief The name of the generator
+	/// \returns the string \a NullRNGs
+	std::string AlgorithmName() const {return "NullRNG";}
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief An implementation that throws NotImplemented
+	byte GenerateByte () {}
+	/// \brief An implementation that throws NotImplemented
+	unsigned int GenerateBit () {}
+	/// \brief An implementation that throws NotImplemented
+	word32 GenerateWord32 (word32 min, word32 max) {}
+#endif
+
+	/// \brief An implementation that throws NotImplemented
+	void GenerateBlock(byte *output, size_t size)
+	{
+		CRYPTOPP_UNUSED(output); CRYPTOPP_UNUSED(size);
+		throw NotImplemented("NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes");
+	}
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	/// \brief An implementation that throws NotImplemented
+	void GenerateIntoBufferedTransformation (BufferedTransformation &target, const std::string &channel, lword length) {}
+	/// \brief An implementation that throws NotImplemented
+	void IncorporateEntropy (const byte *input, size_t length) {}
+	/// \brief An implementation that returns \p false
+	bool CanIncorporateEntropy () const {}
+	/// \brief An implementation that does nothing
+	void DiscardBytes (size_t n) {}
+	/// \brief An implementation that does nothing
+	void Shuffle (IT begin, IT end) {}
+
+private:
+	Clonable* Clone () const { return NULLPTR; }
+#endif
+};
+
+RandomNumberGenerator & NullRNG()
+{
+	static ClassNullRNG s_nullRNG;
+	return s_nullRNG;
+}
+
+bool HashTransformation::TruncatedVerify(const byte *digest, size_t digestLength)
+{
+	// Allocate at least 1 for calculated to avoid triggering diagnostics
+	ThrowIfInvalidTruncatedSize(digestLength);
+	SecByteBlock calculated(digestLength ? digestLength : 1);
+	TruncatedFinal(calculated, digestLength);
+	return VerifyBufsEqual(calculated, digest, digestLength);
+}
+
+void HashTransformation::ThrowIfInvalidTruncatedSize(size_t size) const
+{
+	if (size > DigestSize())
+		throw InvalidArgument("HashTransformation: can't truncate a " + IntToString(DigestSize()) + " byte digest to " + IntToString(size) + " bytes");
+}
+
+unsigned int BufferedTransformation::GetMaxWaitObjectCount() const
+{
+	const BufferedTransformation *t = AttachedTransformation();
+	return t ? t->GetMaxWaitObjectCount() : 0;
+}
+
+void BufferedTransformation::GetWaitObjects(WaitObjectContainer &container, CallStack const& callStack)
+{
+	BufferedTransformation *t = AttachedTransformation();
+	if (t)
+		t->GetWaitObjects(container, callStack);  // reduce clutter by not adding to stack here
+}
+
+void BufferedTransformation::Initialize(const NameValuePairs &parameters, int propagation)
+{
+	CRYPTOPP_UNUSED(propagation);
+	CRYPTOPP_ASSERT(!AttachedTransformation());
+	IsolatedInitialize(parameters);
+}
+
+bool BufferedTransformation::Flush(bool hardFlush, int propagation, bool blocking)
+{
+	CRYPTOPP_UNUSED(propagation);
+	CRYPTOPP_ASSERT(!AttachedTransformation());
+	return IsolatedFlush(hardFlush, blocking);
+}
+
+bool BufferedTransformation::MessageSeriesEnd(int propagation, bool blocking)
+{
+	CRYPTOPP_UNUSED(propagation);
+	CRYPTOPP_ASSERT(!AttachedTransformation());
+	return IsolatedMessageSeriesEnd(blocking);
+}
+
+byte * BufferedTransformation::ChannelCreatePutSpace(const std::string &channel, size_t &size)
+{
+	byte* space = NULLPTR;
+	if (channel.empty())
+		space = CreatePutSpace(size);
+	else
+		throw NoChannelSupport(AlgorithmName());
+	return space;
+}
+
+size_t BufferedTransformation::ChannelPut2(const std::string &channel, const byte *inString, size_t length, int messageEnd, bool blocking)
+{
+	size_t size = 0;
+	if (channel.empty())
+		size = Put2(inString, length, messageEnd, blocking);
+	else
+		throw NoChannelSupport(AlgorithmName());
+	return size;
+}
+
+size_t BufferedTransformation::ChannelPutModifiable2(const std::string &channel, byte *inString, size_t length, int messageEnd, bool blocking)
+{
+	size_t size = 0;
+	if (channel.empty())
+		size = PutModifiable2(inString, length, messageEnd, blocking);
+	else
+		size = ChannelPut2(channel, inString, length, messageEnd, blocking);
+	return size;
+}
+
+bool BufferedTransformation::ChannelFlush(const std::string &channel, bool hardFlush, int propagation, bool blocking)
+{
+	bool result = 0;
+	if (channel.empty())
+		result = Flush(hardFlush, propagation, blocking);
+	else
+		throw NoChannelSupport(AlgorithmName());
+	return result;
+}
+
+bool BufferedTransformation::ChannelMessageSeriesEnd(const std::string &channel, int propagation, bool blocking)
+{
+	bool result = false;
+	if (channel.empty())
+		result = MessageSeriesEnd(propagation, blocking);
+	else
+		throw NoChannelSupport(AlgorithmName());
+	return result;
+}
+
+lword BufferedTransformation::MaxRetrievable() const
+{
+	lword size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->MaxRetrievable();
+	else
+		size = CopyTo(TheBitBucket());
+	return size;
+}
+
+bool BufferedTransformation::AnyRetrievable() const
+{
+	bool result = false;
+	if (AttachedTransformation())
+		result = AttachedTransformation()->AnyRetrievable();
+	else
+	{
+		byte b;
+		result = Peek(b) != 0;
+	}
+	return result;
+}
+
+size_t BufferedTransformation::Get(byte &outByte)
+{
+	size_t size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->Get(outByte);
+	else
+		size = Get(&outByte, 1);
+	return size;
+}
+
+size_t BufferedTransformation::Get(byte *outString, size_t getMax)
+{
+	size_t size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->Get(outString, getMax);
+	else
+	{
+		ArraySink arraySink(outString, getMax);
+		size = (size_t)TransferTo(arraySink, getMax);
+	}
+	return size;
+}
+
+size_t BufferedTransformation::Peek(byte &outByte) const
+{
+	size_t size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->Peek(outByte);
+	else
+		size = Peek(&outByte, 1);
+	return size;
+}
+
+size_t BufferedTransformation::Peek(byte *outString, size_t peekMax) const
+{
+	size_t size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->Peek(outString, peekMax);
+	else
+	{
+		ArraySink arraySink(outString, peekMax);
+		size = (size_t)CopyTo(arraySink, peekMax);
+	}
+	return size;
+}
+
+lword BufferedTransformation::Skip(lword skipMax)
+{
+	lword size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->Skip(skipMax);
+	else
+		size = TransferTo(TheBitBucket(), skipMax);
+	return size;
+}
+
+lword BufferedTransformation::TotalBytesRetrievable() const
+{
+	lword size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->TotalBytesRetrievable();
+	else
+		size = MaxRetrievable();
+	return size;
+}
+
+unsigned int BufferedTransformation::NumberOfMessages() const
+{
+	unsigned int size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->NumberOfMessages();
+	else
+		size = CopyMessagesTo(TheBitBucket());
+	return size;
+}
+
+bool BufferedTransformation::AnyMessages() const
+{
+	bool result = false;
+	if (AttachedTransformation())
+		result = AttachedTransformation()->AnyMessages();
+	else
+		result = NumberOfMessages() != 0;
+	return result;
+}
+
+bool BufferedTransformation::GetNextMessage()
+{
+	bool result = false;
+	if (AttachedTransformation())
+		result = AttachedTransformation()->GetNextMessage();
+	else
+	{
+		CRYPTOPP_ASSERT(!AnyMessages());
+	}
+	return result;
+}
+
+unsigned int BufferedTransformation::SkipMessages(unsigned int count)
+{
+	unsigned int size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->SkipMessages(count);
+	else
+		size = TransferMessagesTo(TheBitBucket(), count);
+	return size;
+}
+
+size_t BufferedTransformation::TransferMessagesTo2(BufferedTransformation &target, unsigned int &messageCount, const std::string &channel, bool blocking)
+{
+	if (AttachedTransformation())
+		return AttachedTransformation()->TransferMessagesTo2(target, messageCount, channel, blocking);
+	else
+	{
+		unsigned int maxMessages = messageCount;
+		for (messageCount=0; messageCount < maxMessages && AnyMessages(); messageCount++)
+		{
+			size_t blockedBytes;
+			lword transferredBytes;
+
+			while (AnyRetrievable())
+			{
+				// MaxRetrievable() instead of LWORD_MAX due to GH #962. If
+				// the target calls CreatePutSpace(), then the allocation
+				// size will be LWORD_MAX. That happens when target is a
+				// ByteQueue. Maybe ByteQueue should check the size, and if
+				// it is LWORD_MAX or -1, then use a default like 4096.
+				transferredBytes = MaxRetrievable();
+				blockedBytes = TransferTo2(target, transferredBytes, channel, blocking);
+				if (blockedBytes > 0)
+					return blockedBytes;
+			}
+
+			if (target.ChannelMessageEnd(channel, GetAutoSignalPropagation(), blocking))
+				return 1;
+
+			bool result = GetNextMessage();
+			CRYPTOPP_UNUSED(result); CRYPTOPP_ASSERT(result);
+		}
+		return 0;
+	}
+}
+
+unsigned int BufferedTransformation::CopyMessagesTo(BufferedTransformation &target, unsigned int count, const std::string &channel) const
+{
+	unsigned int size = 0;
+	if (AttachedTransformation())
+		size = AttachedTransformation()->CopyMessagesTo(target, count, channel);
+	return size;
+}
+
+void BufferedTransformation::SkipAll()
+{
+	if (AttachedTransformation())
+		AttachedTransformation()->SkipAll();
+	else
+	{
+		while (SkipMessages()) {}
+		while (Skip()) {}
+	}
+}
+
+size_t BufferedTransformation::TransferAllTo2(BufferedTransformation &target, const std::string &channel, bool blocking)
+{
+	if (AttachedTransformation())
+		return AttachedTransformation()->TransferAllTo2(target, channel, blocking);
+	else
+	{
+		CRYPTOPP_ASSERT(!NumberOfMessageSeries());
+
+		unsigned int messageCount;
+		do
+		{
+			messageCount = UINT_MAX;
+			size_t blockedBytes = TransferMessagesTo2(target, messageCount, channel, blocking);
+			if (blockedBytes)
+				return blockedBytes;
+		}
+		while (messageCount != 0);
+
+		lword byteCount;
+		do
+		{
+			byteCount = ULONG_MAX;
+			size_t blockedBytes = TransferTo2(target, byteCount, channel, blocking);
+			if (blockedBytes)
+				return blockedBytes;
+		}
+		while (byteCount != 0);
+
+		return 0;
+	}
+}
+
+void BufferedTransformation::CopyAllTo(BufferedTransformation &target, const std::string &channel) const
+{
+	if (AttachedTransformation())
+		AttachedTransformation()->CopyAllTo(target, channel);
+	else
+	{
+		CRYPTOPP_ASSERT(!NumberOfMessageSeries());
+		while (CopyMessagesTo(target, UINT_MAX, channel)) {}
+	}
+}
+
+void BufferedTransformation::SetRetrievalChannel(const std::string &channel)
+{
+	if (AttachedTransformation())
+		AttachedTransformation()->SetRetrievalChannel(channel);
+}
+
+size_t BufferedTransformation::ChannelPutWord16(const std::string &channel, word16 value, ByteOrder order, bool blocking)
+{
+	PutWord(false, order, m_buf, value);
+	return ChannelPut(channel, m_buf, 2, blocking);
+}
+
+size_t BufferedTransformation::ChannelPutWord32(const std::string &channel, word32 value, ByteOrder order, bool blocking)
+{
+	PutWord(false, order, m_buf, value);
+	return ChannelPut(channel, m_buf, 4, blocking);
+}
+
+size_t BufferedTransformation::ChannelPutWord64(const std::string &channel, word64 value, ByteOrder order, bool blocking)
+{
+	PutWord(false, order, m_buf, value);
+	return ChannelPut(channel, m_buf, 8, blocking);
+}
+
+size_t BufferedTransformation::PutWord16(word16 value, ByteOrder order, bool blocking)
+{
+	return ChannelPutWord16(DEFAULT_CHANNEL, value, order, blocking);
+}
+
+size_t BufferedTransformation::PutWord32(word32 value, ByteOrder order, bool blocking)
+{
+	return ChannelPutWord32(DEFAULT_CHANNEL, value, order, blocking);
+}
+
+size_t BufferedTransformation::PutWord64(word64 value, ByteOrder order, bool blocking)
+{
+	return ChannelPutWord64(DEFAULT_CHANNEL, value, order, blocking);
+}
+
+size_t BufferedTransformation::PeekWord16(word16 &value, ByteOrder order) const
+{
+	byte buf[2] = {0, 0};
+	size_t len = Peek(buf, 2);
+
+	if (order == BIG_ENDIAN_ORDER)
+		value = word16((buf[0] << 8) | buf[1]);
+	else
+		value = word16((buf[1] << 8) | buf[0]);
+
+	return len;
+}
+
+size_t BufferedTransformation::PeekWord32(word32 &value, ByteOrder order) const
+{
+	byte buf[4] = {0, 0, 0, 0};
+	size_t len = Peek(buf, 4);
+
+	if (order == BIG_ENDIAN_ORDER)
+		value = word32((buf[0] << 24) | (buf[1] << 16) |
+		               (buf[2] << 8)  | (buf[3] << 0));
+	else
+		value = word32((buf[3] << 24) | (buf[2] << 16) |
+		               (buf[1] << 8)  | (buf[0] << 0));
+
+	return len;
+}
+
+size_t BufferedTransformation::PeekWord64(word64 &value, ByteOrder order) const
+{
+	byte buf[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+	size_t len = Peek(buf, 8);
+
+	if (order == BIG_ENDIAN_ORDER)
+		value = ((word64)buf[0] << 56) | ((word64)buf[1] << 48) | ((word64)buf[2] << 40) |
+		        ((word64)buf[3] << 32) | ((word64)buf[4] << 24) | ((word64)buf[5] << 16) |
+		        ((word64)buf[6] << 8)  |  (word64)buf[7];
+	else
+		value = ((word64)buf[7] << 56) | ((word64)buf[6] << 48) | ((word64)buf[5] << 40) |
+		        ((word64)buf[4] << 32) | ((word64)buf[3] << 24) | ((word64)buf[2] << 16) |
+		        ((word64)buf[1] << 8)  |  (word64)buf[0];
+
+	return len;
+}
+
+size_t BufferedTransformation::GetWord16(word16 &value, ByteOrder order)
+{
+	return (size_t)Skip(PeekWord16(value, order));
+}
+
+size_t BufferedTransformation::GetWord32(word32 &value, ByteOrder order)
+{
+	return (size_t)Skip(PeekWord32(value, order));
+}
+
+size_t BufferedTransformation::GetWord64(word64 &value, ByteOrder order)
+{
+	return (size_t)Skip(PeekWord64(value, order));
+}
+
+void BufferedTransformation::Attach(BufferedTransformation *newAttachment)
+{
+	if (AttachedTransformation() && AttachedTransformation()->Attachable())
+		AttachedTransformation()->Attach(newAttachment);
+	else
+		Detach(newAttachment);
+}
+
+void GeneratableCryptoMaterial::GenerateRandomWithKeySize(RandomNumberGenerator &rng, unsigned int keySize)
+{
+	GenerateRandom(rng, MakeParameters("KeySize", (int)keySize));
+}
+
+class PK_DefaultEncryptionFilter : public Unflushable<Filter>
+{
+public:
+	PK_DefaultEncryptionFilter(RandomNumberGenerator &rng, const PK_Encryptor &encryptor, BufferedTransformation *attachment, const NameValuePairs &parameters)
+		: m_rng(rng), m_encryptor(encryptor), m_parameters(parameters)
+	{
+		Detach(attachment);
+	}
+
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+	{
+		FILTER_BEGIN;
+		m_plaintextQueue.Put(inString, length);
+
+		if (messageEnd)
+		{
+			{
+			size_t plaintextLength;
+			if (!SafeConvert(m_plaintextQueue.CurrentSize(), plaintextLength))
+				throw InvalidArgument("PK_DefaultEncryptionFilter: plaintext too long");
+			size_t ciphertextLength = m_encryptor.CiphertextLength(plaintextLength);
+
+			SecByteBlock plaintext(plaintextLength);
+			m_plaintextQueue.Get(plaintext, plaintextLength);
+			m_ciphertext.resize(ciphertextLength);
+			m_encryptor.Encrypt(m_rng, plaintext, plaintextLength, m_ciphertext, m_parameters);
+			}
+
+			FILTER_OUTPUT(1, m_ciphertext, m_ciphertext.size(), messageEnd);
+		}
+		FILTER_END_NO_MESSAGE_END;
+	}
+
+	RandomNumberGenerator &m_rng;
+	const PK_Encryptor &m_encryptor;
+	const NameValuePairs &m_parameters;
+	ByteQueue m_plaintextQueue;
+	SecByteBlock m_ciphertext;
+};
+
+BufferedTransformation * PK_Encryptor::CreateEncryptionFilter(RandomNumberGenerator &rng, BufferedTransformation *attachment, const NameValuePairs &parameters) const
+{
+	return new PK_DefaultEncryptionFilter(rng, *this, attachment, parameters);
+}
+
+class PK_DefaultDecryptionFilter : public Unflushable<Filter>
+{
+public:
+	PK_DefaultDecryptionFilter(RandomNumberGenerator &rng, const PK_Decryptor &decryptor, BufferedTransformation *attachment, const NameValuePairs &parameters)
+		: m_rng(rng), m_decryptor(decryptor), m_parameters(parameters)
+	{
+		Detach(attachment);
+	}
+
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+	{
+		FILTER_BEGIN;
+		m_ciphertextQueue.Put(inString, length);
+
+		if (messageEnd)
+		{
+			{
+			size_t ciphertextLength;
+			if (!SafeConvert(m_ciphertextQueue.CurrentSize(), ciphertextLength))
+				throw InvalidArgument("PK_DefaultDecryptionFilter: ciphertext too long");
+			size_t maxPlaintextLength = m_decryptor.MaxPlaintextLength(ciphertextLength);
+
+			SecByteBlock ciphertext(ciphertextLength);
+			m_ciphertextQueue.Get(ciphertext, ciphertextLength);
+			m_plaintext.resize(maxPlaintextLength);
+			m_result = m_decryptor.Decrypt(m_rng, ciphertext, ciphertextLength, m_plaintext, m_parameters);
+			if (!m_result.isValidCoding)
+				throw InvalidCiphertext(m_decryptor.AlgorithmName() + ": invalid ciphertext");
+			}
+
+			FILTER_OUTPUT(1, m_plaintext, m_result.messageLength, messageEnd);
+		}
+		FILTER_END_NO_MESSAGE_END;
+	}
+
+	RandomNumberGenerator &m_rng;
+	const PK_Decryptor &m_decryptor;
+	const NameValuePairs &m_parameters;
+	ByteQueue m_ciphertextQueue;
+	SecByteBlock m_plaintext;
+	DecodingResult m_result;
+};
+
+BufferedTransformation * PK_Decryptor::CreateDecryptionFilter(RandomNumberGenerator &rng, BufferedTransformation *attachment, const NameValuePairs &parameters) const
+{
+	return new PK_DefaultDecryptionFilter(rng, *this, attachment, parameters);
+}
+
+size_t PK_Signer::Sign(RandomNumberGenerator &rng, PK_MessageAccumulator *messageAccumulator, byte *signature) const
+{
+	member_ptr<PK_MessageAccumulator> m(messageAccumulator);
+	return SignAndRestart(rng, *m, signature, false);
+}
+
+size_t PK_Signer::SignMessage(RandomNumberGenerator &rng, const byte *message, size_t messageLen, byte *signature) const
+{
+	member_ptr<PK_MessageAccumulator> m(NewSignatureAccumulator(rng));
+	m->Update(message, messageLen);
+	return SignAndRestart(rng, *m, signature, false);
+}
+
+size_t PK_Signer::SignMessageWithRecovery(RandomNumberGenerator &rng, const byte *recoverableMessage, size_t recoverableMessageLength,
+	const byte *nonrecoverableMessage, size_t nonrecoverableMessageLength, byte *signature) const
+{
+	member_ptr<PK_MessageAccumulator> m(NewSignatureAccumulator(rng));
+	InputRecoverableMessage(*m, recoverableMessage, recoverableMessageLength);
+	m->Update(nonrecoverableMessage, nonrecoverableMessageLength);
+	return SignAndRestart(rng, *m, signature, false);
+}
+
+bool PK_Verifier::Verify(PK_MessageAccumulator *messageAccumulator) const
+{
+	member_ptr<PK_MessageAccumulator> m(messageAccumulator);
+	return VerifyAndRestart(*m);
+}
+
+bool PK_Verifier::VerifyMessage(const byte *message, size_t messageLen, const byte *signature, size_t signatureLen) const
+{
+	member_ptr<PK_MessageAccumulator> m(NewVerificationAccumulator());
+	InputSignature(*m, signature, signatureLen);
+	m->Update(message, messageLen);
+	return VerifyAndRestart(*m);
+}
+
+DecodingResult PK_Verifier::Recover(byte *recoveredMessage, PK_MessageAccumulator *messageAccumulator) const
+{
+	member_ptr<PK_MessageAccumulator> m(messageAccumulator);
+	return RecoverAndRestart(recoveredMessage, *m);
+}
+
+DecodingResult PK_Verifier::RecoverMessage(byte *recoveredMessage,
+	const byte *nonrecoverableMessage, size_t nonrecoverableMessageLength,
+	const byte *signature, size_t signatureLength) const
+{
+	member_ptr<PK_MessageAccumulator> m(NewVerificationAccumulator());
+	InputSignature(*m, signature, signatureLength);
+	m->Update(nonrecoverableMessage, nonrecoverableMessageLength);
+	return RecoverAndRestart(recoveredMessage, *m);
+}
+
+void SimpleKeyAgreementDomain::GenerateKeyPair(RandomNumberGenerator &rng, byte *privateKey, byte *publicKey) const
+{
+	GeneratePrivateKey(rng, privateKey);
+	GeneratePublicKey(rng, privateKey, publicKey);
+}
+
+void AuthenticatedKeyAgreementDomain::GenerateStaticKeyPair(RandomNumberGenerator &rng, byte *privateKey, byte *publicKey) const
+{
+	GenerateStaticPrivateKey(rng, privateKey);
+	GenerateStaticPublicKey(rng, privateKey, publicKey);
+}
+
+void AuthenticatedKeyAgreementDomain::GenerateEphemeralKeyPair(RandomNumberGenerator &rng, byte *privateKey, byte *publicKey) const
+{
+	GenerateEphemeralPrivateKey(rng, privateKey);
+	GenerateEphemeralPublicKey(rng, privateKey, publicKey);
+}
+
+// Allow a distro or packager to override the build-time version
+//  http://github.com/weidai11/cryptopp/issues/371
+#ifndef CRYPTOPP_BUILD_VERSION
+# define CRYPTOPP_BUILD_VERSION CRYPTOPP_VERSION
+#endif
+int LibraryVersion(CRYPTOPP_NOINLINE_DOTDOTDOT)
+{
+	return CRYPTOPP_BUILD_VERSION;
+}
+
+class NullNameValuePairs : public NameValuePairs
+{
+public:
+	NullNameValuePairs() {}    //  Clang complains a default ctor must be available
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+		{CRYPTOPP_UNUSED(name); CRYPTOPP_UNUSED(valueType); CRYPTOPP_UNUSED(pValue); return false;}
+};
+
+#if HAVE_GCC_INIT_PRIORITY
+  const std::string DEFAULT_CHANNEL __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 25))) = "";
+  const std::string AAD_CHANNEL __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 26))) = "AAD";
+  const NullNameValuePairs s_nullNameValuePairs __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 27)));
+  const NameValuePairs& g_nullNameValuePairs = s_nullNameValuePairs;
+#elif HAVE_MSC_INIT_PRIORITY
+  #pragma warning(disable: 4073)
+  #pragma init_seg(lib)
+  const std::string DEFAULT_CHANNEL = "";
+  const std::string AAD_CHANNEL = "AAD";
+  const NullNameValuePairs s_nullNameValuePairs;
+  const NameValuePairs& g_nullNameValuePairs = s_nullNameValuePairs;
+  #pragma warning(default: 4073)
+#elif HAVE_XLC_INIT_PRIORITY
+  #pragma priority(260)
+  const std::string DEFAULT_CHANNEL = "";
+  const std::string AAD_CHANNEL = "AAD";
+  const NullNameValuePairs s_nullNameValuePairs;
+  const NameValuePairs& g_nullNameValuePairs = s_nullNameValuePairs;
+#else
+  const std::string DEFAULT_CHANNEL = "";
+  const std::string AAD_CHANNEL = "AAD";
+  const simple_ptr<NullNameValuePairs> s_pNullNameValuePairs(new NullNameValuePairs);
+  const NameValuePairs &g_nullNameValuePairs = *s_pNullNameValuePairs.m_p;
+#endif
+
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_IMPORTS
diff --git a/runtime/third_party/cryptopp/cryptlib.h b/runtime/third_party/cryptopp/cryptlib.h
new file mode 100644
index 0000000..4a5c83b
--- /dev/null
+++ b/runtime/third_party/cryptopp/cryptlib.h
@@ -0,0 +1,3384 @@
+// cryptlib.h - originally written and placed in the public domain by Wei Dai
+
+/// \file cryptlib.h
+/// \brief Abstract base classes that provide a uniform interface to this library.
+
+/*!	\mainpage Crypto++ Library 8.9 API Reference
+<dl>
+<dt>Abstract Base Classes<dd>
+	cryptlib.h
+<dt>Authenticated Encryption Modes<dd>
+	CCM, EAX, \ref GCM "GCM (2K tables)", \ref GCM "GCM (64K tables)"
+<dt>Block Ciphers<dd>
+	\ref Rijndael "AES", ARIA, Weak::ARC4, Blowfish, BTEA, \ref CHAM128 "CHAM (64/128)", Camellia,
+	\ref CAST128 "CAST (128/256)", DES, \ref DES_EDE2 "2-key Triple-DES", \ref DES_EDE3 "3-key Triple-DES",
+	\ref DES_XEX3 "DESX", GOST, HIGHT, IDEA, LEA, \ref LR "Luby-Rackoff", \ref Kalyna128 "Kalyna (128/256/512)",
+	MARS, RC2, RC5, RC6, \ref SAFER_K "SAFER-K", \ref SAFER_SK "SAFER-SK", SEED, Serpent,
+	\ref SHACAL2 "SHACAL-2", SHARK, \ref SIMECK64 "SIMECK (32/64)" SKIPJACK, SM4, Square, TEA,
+	\ref ThreeWay "3-Way", \ref Threefish256 "Threefish (256/512/1024)", Twofish, XTEA
+<dt>Stream Ciphers<dd>
+	\ref ChaCha "ChaCha (8/12/20)", \ref HC128 "HC-128/256", \ref Panama "Panama-LE", \ref Panama "Panama-BE",
+	Rabbit, Salsa20, \ref SEAL "SEAL-LE", \ref SEAL "SEAL-BE", WAKE, XSalsa20
+<dt>Hash Functions<dd>
+	BLAKE2s, BLAKE2b, \ref Keccak "Keccak (F1600)", SHA1, SHA224, SHA256, SHA384, SHA512,
+	\ref SHA3 "SHA-3", SM3, LSH (256/512), Tiger, RIPEMD160, RIPEMD256, SipHash, Whirlpool,
+	Weak::MD2, Weak::MD4, Weak::MD5
+<dt>Non-Cryptographic Checksums<dd>
+	CRC32, CRC32C, Adler32
+<dt>Message Authentication Codes<dd>
+	BLAKE2b, BLAKE2s, CBC_MAC, CMAC, DMAC, \ref GCM "GCM (GMAC)", HMAC, Poly1305, TTMAC, VMAC
+<dt>Random Number Generators<dd>
+	NullRNG, LC_RNG, RandomPool, BlockingRng, NonblockingRng, AutoSeededRandomPool, AutoSeededX917RNG,
+	NIST Hash_DRBG and HMAC_DRBG, \ref MersenneTwister "MersenneTwister (MT19937 and MT19937-AR)",
+	DARN, RDRAND, RDSEED
+<dt>Key Derivation and Password-based Cryptography<dd>
+	HKDF, \ref PKCS12_PBKDF "PBKDF (PKCS #12)", \ref PKCS5_PBKDF1 "PBKDF-1 (PKCS #5)",
+	\ref PKCS5_PBKDF2_HMAC "PBKDF-2/HMAC (PKCS #5)"
+<dt>Public Key Cryptosystems<dd>
+	DLIES, ECIES, LUCES, RSAES, RabinES, LUC_IES
+<dt>Public Key Signature Schemes<dd>
+	DSA, DSA2, \ref ed25519 "Ed25519", GDSA, ECDSA, NR, ECNR, LUCSS, RSASS, RSASS_ISO,
+	RabinSS, RWSS, ESIGN
+<dt>Key Agreement<dd>
+	DH, DH2, \ref x25519 "X25519", \ref MQV_Domain "MQV", \ref HMQV_Domain "HMQV",
+    \ref FHMQV_Domain "FHMQV", ECDH, x25519, ECMQV, ECHMQV, ECFHMQV, XTR_DH
+<dt>Algebraic Structures<dd>
+	Integer, PolynomialMod2, PolynomialOver, RingOfPolynomialsOver,
+	ModularArithmetic, MontgomeryRepresentation, GFP2_ONB, GF2NP, GF256, GF2_32, EC2N, ECP
+<dt>Secret Sharing and Information Dispersal<dd>
+	SecretSharing, SecretRecovery, InformationDispersal, InformationRecovery
+<dt>Compression<dd>
+	Deflator, Inflator, Gzip, Gunzip, ZlibCompressor, ZlibDecompressor
+<dt>Input Source Classes<dd>
+	StringSource, ArraySource, VectorSource, FileSource, RandomNumberSource
+<dt>Output Sink Classes<dd>
+	StringSinkTemplate, StringSink, VectorSink, ArraySink, FileSink, RandomNumberSink
+<dt>Filter Wrappers<dd>
+	StreamTransformationFilter, AuthenticatedEncryptionFilter, AuthenticatedDecryptionFilter, HashFilter,
+	HashVerificationFilter, SignerFilter, SignatureVerificationFilter
+<dt>Binary to Text Encoders and Decoders<dd>
+	HexEncoder, HexDecoder, Base64Encoder, Base64Decoder, Base64URLEncoder, Base64URLDecoder, Base32Encoder,
+	Base32Decoder
+<dt>Wrappers for OS features<dd>
+	Timer, ThreadUserTimer
+
+</dl>
+
+<!--
+
+<dt>FIPS 140 validated cryptography<dd>
+	fips140.h
+
+In the DLL version of Crypto++, only the following implementation class are available.
+<dl>
+<dt>Block Ciphers<dd>
+	AES, \ref DES_EDE2 "2-key Triple-DES", \ref DES_EDE3 "3-key Triple-DES", SKIPJACK
+<dt>Cipher Modes (replace template parameter BC with one of the block ciphers above)<dd>
+	\ref ECB_Mode "ECB_Mode<BC>", \ref CTR_Mode "CTR_Mode<BC>", \ref CBC_Mode "CBC_Mode<BC>",
+	\ref CFB_FIPS_Mode "CFB_FIPS_Mode<BC>", \ref OFB_Mode "OFB_Mode<BC>", \ref GCM "GCM<AES>"
+<dt>Hash Functions<dd>
+	SHA1, SHA224, SHA256, SHA384, SHA512
+<dt>Public Key Signature Schemes (replace template parameter H with one of the hash functions above)<dd>
+	RSASS\<PKCS1v15, H\>, RSASS\<PSS, H\>, RSASS_ISO\<H\>, RWSS\<P1363_EMSA2, H\>, DSA, ECDSA\<ECP, H\>,
+	ECDSA\<EC2N, H\>
+<dt>Message Authentication Codes (replace template parameter H with one of the hash functions above)<dd>
+	HMAC\<H\>, CBC_MAC\<DES_EDE2\>, CBC_MAC\<DES_EDE3\>, GCM\<AES\>
+<dt>Random Number Generators<dd>
+	DefaultAutoSeededRNG (AutoSeededX917RNG\<AES\>)
+<dt>Key Agreement<dd>
+	DH, DH2
+<dt>Public Key Cryptosystems<dd>
+	RSAES\<OAEP\<SHA1\> \>
+</dl>
+
+-->
+
+<p>This reference manual is a work in progress. Some classes lack detailed descriptions.
+<p>Click <a href="CryptoPPRef.zip">here</a> to download a zip archive containing this manual.
+<p>Thanks to Ryan Phillips for providing the Doxygen configuration file
+and getting us started on the manual.
+*/
+
+#ifndef CRYPTOPP_CRYPTLIB_H
+#define CRYPTOPP_CRYPTLIB_H
+
+#include "config.h"
+#include "stdcpp.h"
+#include "trap.h"
+
+// C5264 new for VS2022/v17.4, MSC v17.3.4
+// https://github.com/weidai11/cryptopp/issues/1185
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4127 4189 4505 4702)
+# if (CRYPTOPP_MSC_VERSION >= 1933)
+#  pragma warning(disable: 5264)
+# endif
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// forward declarations
+class Integer;
+class RandomNumberGenerator;
+class BufferedTransformation;
+
+/// \brief Specifies a direction for a cipher to operate
+/// \sa BlockTransformation::IsForwardTransformation(), BlockTransformation::IsPermutation(), BlockTransformation::GetCipherDirection()
+enum CipherDir {
+	/// \brief the cipher is performing encryption
+	ENCRYPTION,
+	/// \brief the cipher is performing decryption
+	DECRYPTION};
+
+/// \brief Represents infinite time
+CRYPTOPP_CONST_OR_CONSTEXPR unsigned long INFINITE_TIME = ULONG_MAX;
+
+// VC60 workaround: using enums as template parameters causes problems
+/// \brief Converts an enumeration to a type suitable for use as a template parameter
+template <typename ENUM_TYPE, int VALUE>
+struct EnumToType
+{
+	static ENUM_TYPE ToEnum() {return static_cast<ENUM_TYPE>(VALUE);}
+};
+
+/// \brief Provides the byte ordering
+/// \details Big-endian and little-endian modes are supported. Bi-endian and PDP-endian modes
+///  are not supported.
+enum ByteOrder {
+	/// \brief byte order is little-endian
+	LITTLE_ENDIAN_ORDER = 0,
+	/// \brief byte order is big-endian
+	BIG_ENDIAN_ORDER = 1};
+
+/// \brief Provides a constant for LittleEndian
+typedef EnumToType<ByteOrder, LITTLE_ENDIAN_ORDER> LittleEndian;
+/// \brief Provides a constant for BigEndian
+typedef EnumToType<ByteOrder, BIG_ENDIAN_ORDER> BigEndian;
+
+/// \brief Base class for all exceptions thrown by the library
+/// \details All library exceptions directly or indirectly inherit from the Exception class.
+///  The Exception class itself inherits from std::exception. The library does not use
+///  std::runtime_error derived classes.
+class CRYPTOPP_DLL Exception : public std::exception
+{
+public:
+	/// \enum ErrorType
+	/// \brief Error types or categories
+	enum ErrorType {
+		/// \brief A method was called which was not implemented
+		NOT_IMPLEMENTED,
+		/// \brief An invalid argument was detected
+		INVALID_ARGUMENT,
+		/// \brief BufferedTransformation received a Flush(true) signal but can't flush buffers
+		CANNOT_FLUSH,
+		/// \brief Data integerity check, such as CRC or MAC, failed
+		DATA_INTEGRITY_CHECK_FAILED,
+		/// \brief Input data was received that did not conform to expected format
+		INVALID_DATA_FORMAT,
+		/// \brief Error reading from input device or writing to output device
+		IO_ERROR,
+		/// \brief Some other error occurred not belonging to other categories
+		OTHER_ERROR
+	};
+
+	virtual ~Exception() throw() {}
+
+	/// \brief Construct a new Exception
+	explicit Exception(ErrorType errorType, const std::string &s) : m_errorType(errorType), m_what(s) {}
+
+	/// \brief Retrieves a C-string describing the exception
+	const char *what() const throw() {return (m_what.c_str());}
+	/// \brief Retrieves a string describing the exception
+	const std::string &GetWhat() const {return m_what;}
+	/// \brief Sets the error string for the exception
+	void SetWhat(const std::string &s) {m_what = s;}
+	/// \brief Retrieves the error type for the exception
+	ErrorType GetErrorType() const {return m_errorType;}
+	/// \brief Sets the error type for the exceptions
+	void SetErrorType(ErrorType errorType) {m_errorType = errorType;}
+
+private:
+	ErrorType m_errorType;
+	std::string m_what;
+};
+
+/// \brief An invalid argument was detected
+class CRYPTOPP_DLL InvalidArgument : public Exception
+{
+public:
+	/// \brief Construct an InvalidArgument
+	/// \param s the message for the exception
+	/// \details The member function <tt>what()</tt> returns <tt>s</tt>.
+	explicit InvalidArgument(const std::string &s) : Exception(INVALID_ARGUMENT, s) {}
+};
+
+/// \brief Input data was received that did not conform to expected format
+class CRYPTOPP_DLL InvalidDataFormat : public Exception
+{
+public:
+	/// \brief Construct an InvalidDataFormat
+	/// \param s the message for the exception
+	/// \details The member function <tt>what()</tt> returns <tt>s</tt>.
+	explicit InvalidDataFormat(const std::string &s) : Exception(INVALID_DATA_FORMAT, s) {}
+};
+
+/// \brief A decryption filter encountered invalid ciphertext
+class CRYPTOPP_DLL InvalidCiphertext : public InvalidDataFormat
+{
+public:
+	/// \brief Construct an InvalidCiphertext
+	/// \param s the message for the exception
+	/// \details The member function <tt>what()</tt> returns <tt>s</tt>.
+	explicit InvalidCiphertext(const std::string &s) : InvalidDataFormat(s) {}
+};
+
+/// \brief A method was called which was not implemented
+class CRYPTOPP_DLL NotImplemented : public Exception
+{
+public:
+	/// \brief Construct an NotImplemented
+	/// \param s the message for the exception
+	/// \details The member function <tt>what()</tt> returns <tt>s</tt>.
+	explicit NotImplemented(const std::string &s) : Exception(NOT_IMPLEMENTED, s) {}
+};
+
+/// \brief Flush(true) was called but it can't completely flush its buffers
+class CRYPTOPP_DLL CannotFlush : public Exception
+{
+public:
+	/// \brief Construct an CannotFlush
+	/// \param s the message for the exception
+	/// \details The member function <tt>what()</tt> returns <tt>s</tt>.
+	explicit CannotFlush(const std::string &s) : Exception(CANNOT_FLUSH, s) {}
+};
+
+/// \brief The operating system reported an error
+class CRYPTOPP_DLL OS_Error : public Exception
+{
+public:
+	virtual ~OS_Error() throw() {}
+
+	/// \brief Construct an OS_Error
+	/// \param errorType the error type
+	/// \param s the message for the exception
+	/// \param operation the operation for the exception
+	/// \param errorCode the error code
+	/// \details The member function <tt>what()</tt> returns <tt>s</tt>.
+	OS_Error(ErrorType errorType, const std::string &s, const std::string& operation, int errorCode)
+		: Exception(errorType, s), m_operation(operation), m_errorCode(errorCode) {}
+
+	/// \brief Retrieve the operating system API that reported the error
+	const std::string & GetOperation() const {return m_operation;}
+	/// \brief Retrieve the error code returned by the operating system
+	int GetErrorCode() const {return m_errorCode;}
+
+protected:
+	std::string m_operation;
+	int m_errorCode;
+};
+
+/// \brief Returns a decoding results
+struct CRYPTOPP_DLL DecodingResult
+{
+	/// \brief Constructs a DecodingResult
+	/// \details isValidCoding is initialized to false and messageLength is
+	///  initialized to 0.
+	explicit DecodingResult() : isValidCoding(false), messageLength(0) {}
+	/// \brief Constructs a DecodingResult
+	/// \param len the message length
+	/// \details isValidCoding is initialized to true.
+	explicit DecodingResult(size_t len) : isValidCoding(true), messageLength(len) {}
+
+	/// \brief Compare two DecodingResult
+	/// \param rhs the other DecodingResult
+	/// \return true if either isValidCoding or messageLength is \a not equal,
+	///  false otherwise
+	bool operator==(const DecodingResult &rhs) const {return isValidCoding == rhs.isValidCoding && messageLength == rhs.messageLength;}
+	/// \brief Compare two DecodingResult
+	/// \param rhs the other DecodingResult
+	/// \return true if either isValidCoding or messageLength is \a not equal,
+	///  false otherwise
+	/// \details Returns <tt>!operator==(rhs)</tt>.
+	bool operator!=(const DecodingResult &rhs) const {return !operator==(rhs);}
+
+	/// \brief Flag to indicate the decoding is valid
+	bool isValidCoding;
+	/// \brief Recovered message length if isValidCoding is true, undefined otherwise
+	size_t messageLength;
+};
+
+/// \brief Interface for retrieving values given their names
+/// \details This class is used to safely pass a variable number of arbitrarily
+///  typed arguments to functions and to read values from keys and crypto parameters.
+/// \details To obtain an object that implements NameValuePairs for the purpose of
+///  parameter passing, use the MakeParameters() function.
+/// \details To get a value from NameValuePairs, you need to know the name and the
+///  type of the value. Call GetValueNames() on a NameValuePairs object to obtain a
+///  list of value names that it supports. then look at the Name namespace
+///  documentation to see what the type of each value is, or alternatively, call
+///  GetIntValue() with the value name, and if the type is not int, a
+///  ValueTypeMismatch exception will be thrown and you can get the actual type from
+///  the exception object.
+/// \sa NullNameValuePairs, g_nullNameValuePairs,
+///  <A HREF="http://www.cryptopp.com/wiki/NameValuePairs">NameValuePairs</A> on the
+///  Crypto++ wiki
+class NameValuePairs
+{
+public:
+	virtual ~NameValuePairs() {}
+
+	/// \brief Thrown when an unexpected type is encountered
+	/// \details Exception thrown when trying to retrieve a value using a different
+	///  type than expected
+	class CRYPTOPP_DLL ValueTypeMismatch : public InvalidArgument
+	{
+	public:
+		/// \brief Construct a ValueTypeMismatch
+		/// \param name the name of the value
+		/// \param stored the \a actual type of the value stored
+		/// \param retrieving the \a presumed type of the value retrieved
+		ValueTypeMismatch(const std::string &name, const std::type_info &stored, const std::type_info &retrieving)
+			: InvalidArgument("NameValuePairs: type mismatch for '" + name + "', stored '" + stored.name() + "', trying to retrieve '" + retrieving.name() + "'")
+			, m_stored(stored), m_retrieving(retrieving) {}
+
+		/// \brief Provides the stored type
+		/// \return the C++ mangled name of the type
+		const std::type_info & GetStoredTypeInfo() const {return m_stored;}
+
+		/// \brief Provides the retrieveing type
+		/// \return the C++ mangled name of the type
+		const std::type_info & GetRetrievingTypeInfo() const {return m_retrieving;}
+
+	private:
+		const std::type_info &m_stored;
+		const std::type_info &m_retrieving;
+	};
+
+	/// \brief Get a copy of this object or subobject
+	/// \tparam T class or type
+	/// \param object reference to a variable that receives the value
+	template <class T>
+	bool GetThisObject(T &object) const
+	{
+		return GetValue((std::string("ThisObject:")+typeid(T).name()).c_str(), object);
+	}
+
+	/// \brief Get a pointer to this object
+	/// \tparam T class or type
+	/// \param ptr reference to a pointer to a variable that receives the value
+	template <class T>
+	bool GetThisPointer(T *&ptr) const
+	{
+		return GetValue((std::string("ThisPointer:")+typeid(T).name()).c_str(), ptr);
+	}
+
+	/// \brief Get a named value
+	/// \tparam T class or type
+	/// \param name the name of the object or value to retrieve
+	/// \param value reference to a variable that receives the value
+	/// \return true if the value was retrieved, false otherwise
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	template <class T>
+	bool GetValue(const char *name, T &value) const
+	{
+		return GetVoidValue(name, typeid(T), &value);
+	}
+
+	/// \brief Get a named value
+	/// \tparam T class or type
+	/// \param name the name of the object or value to retrieve
+	/// \param defaultValue the default value of the class or type if it does not exist
+	/// \return the object or value
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	template <class T>
+	T GetValueWithDefault(const char *name, T defaultValue) const
+	{
+		T value;
+		bool result = GetValue(name, value);
+		// No assert... this recovers from failure
+		if (result) {return value;}
+		return defaultValue;
+	}
+
+	/// \brief Get a list of value names that can be retrieved
+	/// \return a list of names available to retrieve
+	/// \details the items in the list are delimited with a colon.
+	CRYPTOPP_DLL std::string GetValueNames() const
+		{std::string result; GetValue("ValueNames", result); return result;}
+
+	/// \brief Get a named value with type int
+	/// \param name the name of the value to retrieve
+	/// \param value the value retrieved upon success
+	/// \return true if an int value was retrieved, false otherwise
+	/// \details GetIntValue() is used to ensure we don't accidentally try to get an
+	///  unsigned int or some other type when we mean int (which is the most common case)
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	CRYPTOPP_DLL bool GetIntValue(const char *name, int &value) const
+		{return GetValue(name, value);}
+
+	/// \brief Get a named value with type int, with default
+	/// \param name the name of the value to retrieve
+	/// \param defaultValue the default value if the name does not exist
+	/// \return the value retrieved on success or the default value
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	CRYPTOPP_DLL int GetIntValueWithDefault(const char *name, int defaultValue) const
+		{return GetValueWithDefault(name, defaultValue);}
+
+	/// \brief Get a named value with type word64
+	/// \param name the name of the value to retrieve
+	/// \param value the value retrieved upon success
+	/// \return true if an word64 value was retrieved, false otherwise
+	/// \sa GetValue(), GetValueWithDefault(), GetWord64ValueWithDefault(), GetIntValue(),
+	///  GetIntValueWithDefault(), GetRequiredParameter() and GetRequiredIntParameter()
+	CRYPTOPP_DLL bool GetWord64Value(const char *name, word64 &value) const
+		{return GetValue(name, value);}
+
+	/// \brief Get a named value with type word64, with default
+	/// \param name the name of the value to retrieve
+	/// \param defaultValue the default value if the name does not exist
+	/// \return the value retrieved on success or the default value
+	/// \sa GetValue(), GetValueWithDefault(), GetWord64Value(), GetIntValue(),
+	///  GetIntValueWithDefault(), GetRequiredParameter() and GetRequiredWord64Parameter()
+	CRYPTOPP_DLL word64 GetWord64ValueWithDefault(const char *name, word64 defaultValue) const
+		{return GetValueWithDefault(name, defaultValue);}
+
+	/// \brief Ensures an expected name and type is present
+	/// \param name the name of the value
+	/// \param stored the type that was stored for the name
+	/// \param retrieving the type that is being retrieved for the name
+	/// \throw ValueTypeMismatch
+	/// \details ThrowIfTypeMismatch() effectively performs a type safety check.
+	///  stored and retrieving are C++ mangled names for the type.
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	CRYPTOPP_DLL static void CRYPTOPP_API ThrowIfTypeMismatch(const char *name, const std::type_info &stored, const std::type_info &retrieving)
+		{if (stored != retrieving) throw ValueTypeMismatch(name, stored, retrieving);}
+
+	/// \brief Retrieves a required name/value pair
+	/// \tparam T class or type
+	/// \param className the name of the class
+	/// \param name the name of the value
+	/// \param value reference to a variable to receive the value
+	/// \throw InvalidArgument
+	/// \details GetRequiredParameter() throws InvalidArgument if the name
+	///  is not present or not of the expected type T.
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	template <class T>
+	void GetRequiredParameter(const char *className, const char *name, T &value) const
+	{
+		if (!GetValue(name, value))
+			throw InvalidArgument(std::string(className) + ": missing required parameter '" + name + "'");
+	}
+
+	/// \brief Retrieves a required name/value pair
+	/// \param className the name of the class
+	/// \param name the name of the value
+	/// \param value reference to a variable to receive the value
+	/// \throw InvalidArgument
+	/// \details GetRequiredParameter() throws InvalidArgument if the name
+	///  is not present or not of the expected type T.
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	CRYPTOPP_DLL void GetRequiredIntParameter(const char *className, const char *name, int &value) const
+	{
+		if (!GetIntValue(name, value))
+			throw InvalidArgument(std::string(className) + ": missing required parameter '" + name + "'");
+	}
+
+	/// \brief Get a named value
+	/// \param name the name of the object or value to retrieve
+	/// \param valueType reference to a variable that receives the value
+	/// \param pValue void pointer to a variable that receives the value
+	/// \return true if the value was retrieved, false otherwise
+	/// \details GetVoidValue() retrieves the value of name if it exists.
+	/// \note GetVoidValue() is an internal function and should be implemented
+	///  by derived classes. Users should use one of the other functions instead.
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	CRYPTOPP_DLL virtual bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const =0;
+};
+
+// Doxygen cannot handle initialization
+#if CRYPTOPP_DOXYGEN_PROCESSING
+/// \brief Default channel for BufferedTransformation
+/// \details DEFAULT_CHANNEL is equal to an empty string
+/// \details The definition for DEFAULT_CHANNEL is in <tt>cryptlib.cpp</tt>.
+///  It can be subject to <A HREF="https://isocpp.org/wiki/faq/ctors">Static
+///  Initialization Order Fiasco</A>. If you experience a crash in
+///  DEFAULT_CHANNEL where the string object is NULL, then you probably have
+///  a global object using DEFAULT_CHANNEL before it has been constructed.
+const std::string DEFAULT_CHANNEL;
+
+/// \brief Channel for additional authenticated data
+/// \details AAD_CHANNEL is equal to "AAD"
+/// \details The definition for AAD_CHANNEL is in <tt>cryptlib.cpp</tt>.
+///  It can be subject to <A HREF="https://isocpp.org/wiki/faq/ctors">Static
+///  Initialization Order Fiasco</A>. If you experience a crash in
+///  AAD_CHANNEL where the string object is NULL, then you probably have a
+///  global object using AAD_CHANNEL before it has been constructed.
+const std::string AAD_CHANNEL;
+
+/// \brief An empty set of name-value pairs
+/// \details The definition for g_nullNameValuePairs is in <tt>cryptlib.cpp</tt>.
+///  It can be subject to <A HREF="https://isocpp.org/wiki/faq/ctors">Static
+///  Initialization Order Fiasco</A>. If you experience a crash in
+///  g_nullNameValuePairs where the string object is NULL, then you probably
+///  have a global object using g_nullNameValuePairs before it has been
+///  constructed.
+const NameValuePairs& g_nullNameValuePairs;
+
+#else
+extern CRYPTOPP_DLL const std::string DEFAULT_CHANNEL;
+extern CRYPTOPP_DLL const std::string AAD_CHANNEL;
+extern CRYPTOPP_DLL const NameValuePairs& g_nullNameValuePairs;
+#endif
+
+// Document additional name spaces which show up elsewhere in the sources.
+#if CRYPTOPP_DOXYGEN_PROCESSING
+/// \brief Namespace containing value name definitions.
+/// \details Name is part of the CryptoPP namespace.
+/// \details The semantics of value names, types are:
+/// <pre>
+///     ThisObject:ClassName (ClassName, copy of this object or a subobject)
+///     ThisPointer:ClassName (const ClassName *, pointer to this object or a subobject)
+/// </pre>
+DOCUMENTED_NAMESPACE_BEGIN(Name)
+// more names defined in argnames.h
+DOCUMENTED_NAMESPACE_END
+
+/// \brief Namespace containing weak and wounded algorithms.
+/// \details Weak is part of the CryptoPP namespace. Schemes and algorithms are moved into Weak
+///  when their security level is reduced to an unacceptable level by contemporary standards.
+/// \details To use an algorithm in the Weak namespace, you must <tt>\c \#define
+///  CRYPTOPP_ENABLE_NAMESPACE_WEAK 1</tt> before including a header for a weak or wounded
+///  algorithm. For example:
+///  <pre>  \c \#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+///   \c \#include <md5.h>
+///   ...
+///   CryptoPP::Weak::MD5 md5;
+///   </pre>
+DOCUMENTED_NAMESPACE_BEGIN(Weak)
+// weak and wounded algorithms
+DOCUMENTED_NAMESPACE_END
+#endif
+
+/// \brief Namespace containing NaCl library functions
+/// \details TweetNaCl is a compact and portable reimplementation of the NaCl library.
+DOCUMENTED_NAMESPACE_BEGIN(NaCl)
+// crypto_box, crypto_box_open, crypto_sign, and crypto_sign_open (and friends)
+DOCUMENTED_NAMESPACE_END
+
+/// \brief Namespace containing testing and benchmark classes.
+/// \details Source files for classes in the Test namespaces include
+///  <tt>test.cpp</tt>, <tt>validat#.cpp</tt> and <tt>bench#.cpp</tt>.
+DOCUMENTED_NAMESPACE_BEGIN(Test)
+// testing and benchmark classes
+DOCUMENTED_NAMESPACE_END
+
+// ********************************************************
+
+/// \brief Interface for cloning objects
+/// \note this is \a not implemented by most classes
+/// \sa ClonableImpl, NotCopyable
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Clonable
+{
+public:
+	virtual ~Clonable() {}
+
+	/// \brief Copies  this object
+	/// \return a copy of this object
+	/// \throw NotImplemented
+	/// \note this is \a not implemented by most classes
+	/// \sa NotCopyable
+	virtual Clonable* Clone() const {throw NotImplemented("Clone() is not implemented yet.");}	// TODO: make this =0
+};
+
+/// \brief Interface for all crypto algorithms
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Algorithm : public Clonable
+{
+public:
+	virtual ~Algorithm() {}
+
+	/// \brief Interface for all crypto algorithms
+	/// \param checkSelfTestStatus determines whether the object can proceed if the self
+	///  tests have not been run or failed.
+	/// \details When FIPS 140-2 compliance is enabled and checkSelfTestStatus == true,
+	///  this constructor throws SelfTestFailure if the self test hasn't been run or fails.
+	/// \details FIPS 140-2 compliance is disabled by default. It is only used by certain
+	///  versions of the library when the library is built as a DLL on Windows. Also see
+	///  CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2 in config.h.
+	Algorithm(bool checkSelfTestStatus = true);
+
+	/// \brief Provides the name of this algorithm
+	/// \return the standard algorithm name
+	/// \details The standard algorithm name can be a name like <tt>AES</tt> or <tt>AES/GCM</tt>.
+	///  Some algorithms do not have standard names yet. For example, there is no standard
+	///  algorithm name for Shoup's ECIES.
+	/// \note AlgorithmName is not universally implemented yet.
+	virtual std::string AlgorithmName() const {return "unknown";}
+
+	/// \brief Retrieve the provider of this algorithm
+	/// \return the algorithm provider
+	/// \details The algorithm provider can be a name like "C++", "SSE", "NEON", "AESNI",
+	///  "ARMv8" and "Power8". C++ is standard C++ code. Other labels, like SSE,
+	///  usually indicate a specialized implementation using instructions from a higher
+	///  instruction set architecture (ISA). Future labels may include external hardware
+	///  like a hardware security module (HSM).
+	/// \details Generally speaking Wei Dai's original IA-32 ASM code falls under "SSE2".
+	///  Labels like "SSSE3" and "SSE4.1" follow after Wei's code and use intrinsics
+	///  instead of ASM.
+	/// \details Algorithms which combine different instructions or ISAs provide the
+	///  dominant one. For example on x86 <tt>AES/GCM</tt> returns "AESNI" rather than
+	///  "CLMUL" or "AES+SSE4.1" or "AES+CLMUL" or "AES+SSE4.1+CLMUL".
+	/// \note Provider is not universally implemented yet.
+	/// \since Crypto++ 8.0
+	virtual std::string AlgorithmProvider() const {return "C++";}
+};
+
+/// \brief Interface for algorithms that take byte strings as keys
+/// \sa FixedKeyLength(), VariableKeyLength(), SameKeyLengthAs(), SimpleKeyingInterfaceImpl()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE SimpleKeyingInterface
+{
+public:
+	virtual ~SimpleKeyingInterface() {}
+
+	/// \brief Returns smallest valid key length
+	/// \return the minimum key length, in bytes
+	virtual size_t MinKeyLength() const =0;
+
+	/// \brief Returns largest valid key length
+	/// \return the maximum key length, in bytes
+	virtual size_t MaxKeyLength() const =0;
+
+	/// \brief Returns default key length
+	/// \return the default key length, in bytes
+	virtual size_t DefaultKeyLength() const =0;
+
+	/// \brief Returns a valid key length for the algorithm
+	/// \param keylength the size of the key, in bytes
+	/// \return the valid key length, in bytes
+	/// \details keylength is provided in bytes, not bits. If keylength is less than MIN_KEYLENGTH,
+	///  then the function returns MIN_KEYLENGTH. If keylength is greater than MAX_KEYLENGTH,
+	///  then the function returns MAX_KEYLENGTH. if If keylength is a multiple of KEYLENGTH_MULTIPLE,
+	///  then keylength is returned. Otherwise, the function returns a \a lower multiple of
+	///  KEYLENGTH_MULTIPLE.
+	virtual size_t GetValidKeyLength(size_t keylength) const =0;
+
+	/// \brief Returns whether keylength is a valid key length
+	/// \param keylength the requested keylength
+	/// \return true if keylength is valid, false otherwise
+	/// \details Internally the function calls GetValidKeyLength()
+	virtual bool IsValidKeyLength(size_t keylength) const
+		{return keylength == GetValidKeyLength(keylength);}
+
+	/// \brief Sets or reset the key of this object
+	/// \param key the key to use when keying the object
+	/// \param length the size of the key, in bytes
+	/// \param params additional initialization parameters to configure this object
+	virtual void SetKey(const byte *key, size_t length, const NameValuePairs &params = g_nullNameValuePairs);
+
+	/// \brief Sets or reset the key of this object
+	/// \param key the key to use when keying the object
+	/// \param length the size of the key, in bytes
+	/// \param rounds the number of rounds to apply the transformation function,
+	///  if applicable
+	/// \details SetKeyWithRounds() calls SetKey() with a NameValuePairs
+	///  object that only specifies rounds. rounds is an integer parameter,
+	///  and <tt>-1</tt> means use the default number of rounds.
+	void SetKeyWithRounds(const byte *key, size_t length, int rounds);
+
+	/// \brief Sets or reset the key of this object
+	/// \param key the key to use when keying the object
+	/// \param length the size of the key, in bytes
+	/// \param iv the initialization vector to use when keying the object
+	/// \param ivLength the size of the iv, in bytes
+	/// \details SetKeyWithIV() calls SetKey() with a NameValuePairs
+	///  that only specifies IV. The IV is a byte buffer with size ivLength.
+	///  ivLength is an integer parameter, and <tt>-1</tt> means use IVSize().
+	void SetKeyWithIV(const byte *key, size_t length, const byte *iv, size_t ivLength);
+
+	/// \brief Sets or reset the key of this object
+	/// \param key the key to use when keying the object
+	/// \param length the size of the key, in bytes
+	/// \param iv the initialization vector to use when keying the object
+	/// \details SetKeyWithIV() calls SetKey() with a NameValuePairs() object
+	///  that only specifies iv. iv is a byte buffer, and it must have
+	///  a size IVSize().
+	void SetKeyWithIV(const byte *key, size_t length, const byte *iv)
+		{SetKeyWithIV(key, length, iv, IVSize());}
+
+	/// \brief Secure IVs requirements as enumerated values.
+	/// \details Provides secure IV requirements as a monotonically increasing enumerated values.
+	///  Requirements can be compared using less than (&lt;) and greater than (&gt;). For example,
+	///  <tt>UNIQUE_IV &lt; RANDOM_IV</tt> and <tt>UNPREDICTABLE_RANDOM_IV &gt; RANDOM_IV</tt>.
+	/// \details Objects that use SimpleKeyingInterface do not support an optional IV. That is,
+	///	 an IV must be present or it must be absent. If you wish to support an optional IV then
+	///  provide two classes - one with an IV and one without an IV.
+	/// \sa IsResynchronizable(), CanUseRandomIVs(), CanUsePredictableIVs(), CanUseStructuredIVs()
+	enum IV_Requirement {
+		/// \brief The IV must be unique
+		UNIQUE_IV = 0,
+		/// \brief The IV must be random and possibly predictable
+		RANDOM_IV,
+		/// \brief The IV must be random and unpredictable
+		UNPREDICTABLE_RANDOM_IV,
+		/// \brief The IV is set by the object
+		INTERNALLY_GENERATED_IV,
+		/// \brief The object does not use an IV
+		NOT_RESYNCHRONIZABLE
+	};
+
+	/// \brief Minimal requirement for secure IVs
+	/// \return the secure IV requirement of the algorithm
+	virtual IV_Requirement IVRequirement() const =0;
+
+	/// \brief Determines if the object can be resynchronized
+	/// \return true if the object can be resynchronized (i.e. supports initialization vectors), false otherwise
+	/// \note If this function returns true, and no IV is passed to SetKey() and <tt>CanUseStructuredIVs()==true</tt>,
+	///  an IV of all 0's will be assumed.
+	bool IsResynchronizable() const {return IVRequirement() < NOT_RESYNCHRONIZABLE;}
+
+	/// \brief Determines if the object can use random IVs
+	/// \return true if the object can use random IVs (in addition to ones returned by GetNextIV), false otherwise
+	bool CanUseRandomIVs() const {return IVRequirement() <= UNPREDICTABLE_RANDOM_IV;}
+
+	/// \brief Determines if the object can use random but possibly predictable IVs
+	/// \return true if the object can use random but possibly predictable IVs (in addition to ones returned by
+	///  GetNextIV), false otherwise
+	bool CanUsePredictableIVs() const {return IVRequirement() <= RANDOM_IV;}
+
+	/// \brief Determines if the object can use structured IVs
+	/// \return true if the object can use structured IVs, false otherwise
+	/// \details CanUseStructuredIVs() indicates whether the object can use structured IVs; for example a counter
+	///  (in addition to ones returned by GetNextIV).
+	bool CanUseStructuredIVs() const {return IVRequirement() <= UNIQUE_IV;}
+
+	/// \brief Returns length of the IV accepted by this object
+	/// \return the size of an IV, in bytes
+	/// \throw NotImplemented() if the object does not support resynchronization
+	/// \details The default implementation throws NotImplemented
+	virtual unsigned int IVSize() const
+		{throw NotImplemented(GetAlgorithm().AlgorithmName() + ": this object doesn't support resynchronization");}
+
+	/// \brief Provides the default size of an IV
+	/// \return default length of IVs accepted by this object, in bytes
+	unsigned int DefaultIVLength() const {return IVSize();}
+
+	/// \brief Provides the minimum size of an IV
+	/// \return minimal length of IVs accepted by this object, in bytes
+	/// \throw NotImplemented() if the object does not support resynchronization
+	virtual unsigned int MinIVLength() const {return IVSize();}
+
+	/// \brief Provides the maximum size of an IV
+	/// \return maximal length of IVs accepted by this object, in bytes
+	/// \throw NotImplemented() if the object does not support resynchronization
+	virtual unsigned int MaxIVLength() const {return IVSize();}
+
+	/// \brief Resynchronize with an IV
+	/// \param iv the initialization vector
+	/// \param ivLength the size of the initialization vector, in bytes
+	/// \details Resynchronize() resynchronizes with an IV provided by the caller. <tt>ivLength=-1</tt> means use IVSize().
+	/// \throw NotImplemented() if the object does not support resynchronization
+	virtual void Resynchronize(const byte *iv, int ivLength=-1) {
+		CRYPTOPP_UNUSED(iv); CRYPTOPP_UNUSED(ivLength);
+		throw NotImplemented(GetAlgorithm().AlgorithmName() + ": this object doesn't support resynchronization");
+	}
+
+	/// \brief Retrieves a secure IV for the next message
+	/// \param rng a RandomNumberGenerator to produce keying material
+	/// \param iv a block of bytes to receive the IV
+	/// \details The IV must be at least IVSize() in length.
+	/// \details This method should be called after you finish encrypting one message and are ready
+	///  to start the next one. After calling it, you must call SetKey() or Resynchronize().
+	///  before using this object again.
+	/// \details Internally, the base class implementation calls RandomNumberGenerator's GenerateBlock()
+	/// \note This method is not implemented on decryption objects.
+	virtual void GetNextIV(RandomNumberGenerator &rng, byte *iv);
+
+protected:
+	/// \brief Returns the base class Algorithm
+	/// \return the base class Algorithm
+	virtual const Algorithm & GetAlgorithm() const =0;
+
+	/// \brief Sets the key for this object without performing parameter validation
+	/// \param key a byte buffer used to key the cipher
+	/// \param length the length of the byte buffer
+	/// \param params additional parameters passed as NameValuePairs
+	/// \details key must be at least DEFAULT_KEYLENGTH in length.
+	virtual void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params) =0;
+
+	/// \brief Validates the key length
+	/// \param length the size of the keying material, in bytes
+	/// \throw InvalidKeyLength if the key length is invalid
+	void ThrowIfInvalidKeyLength(size_t length);
+
+	/// \brief Validates the object
+	/// \throw InvalidArgument if the IV is present
+	/// \details Internally, the default implementation calls IsResynchronizable() and throws
+	///  InvalidArgument if the function returns  true.
+	/// \note called when no IV is passed
+	void ThrowIfResynchronizable();
+
+	/// \brief Validates the IV
+	/// \param iv the IV with a length of IVSize, in bytes
+	/// \throw InvalidArgument on failure
+	/// \details Internally, the default implementation checks the iv. If iv is not NULL or nullptr,
+	///  then the function succeeds. If iv is NULL, then IVRequirement is checked against
+	///  UNPREDICTABLE_RANDOM_IV. If IVRequirement is UNPREDICTABLE_RANDOM_IV, then
+	///  then the function succeeds. Otherwise, an exception is thrown.
+	void ThrowIfInvalidIV(const byte *iv);
+
+	/// \brief Validates the IV length
+	/// \param length the size of an IV, in bytes
+	/// \throw InvalidArgument if the IV length is invalid
+	size_t ThrowIfInvalidIVLength(int length);
+
+	/// \brief Retrieves and validates the IV
+	/// \param params NameValuePairs with the IV supplied as a ConstByteArrayParameter
+	/// \param size the length of the IV, in bytes
+	/// \return a pointer to the first byte of the IV
+	/// \throw InvalidArgument if the number of rounds are invalid
+	const byte * GetIVAndThrowIfInvalid(const NameValuePairs &params, size_t &size);
+
+	/// \brief Validates the key length
+	/// \param length the size of the keying material, in bytes
+	inline void AssertValidKeyLength(size_t length) const
+		{CRYPTOPP_UNUSED(length); CRYPTOPP_ASSERT(IsValidKeyLength(length));}
+};
+
+/// \brief Interface for the data processing part of block ciphers
+/// \details Classes derived from BlockTransformation are block ciphers
+///  in ECB mode (for example the DES::Encryption class), which are stateless.
+///  These classes should not be used directly, but only in combination with
+///  a mode class (see CipherModeDocumentation in modes.h).
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE BlockTransformation : public Algorithm
+{
+public:
+	virtual ~BlockTransformation() {}
+
+	/// \brief Encrypt or decrypt a block
+	/// \param inBlock the input message before processing
+	/// \param outBlock the output message after processing
+	/// \param xorBlock an optional XOR mask
+	/// \details ProcessAndXorBlock encrypts or decrypts inBlock, xor with xorBlock, and write to outBlock.
+	/// \details The size of the block is determined by the block cipher and its documentation. Use
+	///  BLOCKSIZE at compile time, or BlockSize() at runtime.
+	/// \note The message can be transformed in-place, or the buffers must \a not overlap
+	/// \sa FixedBlockSize, BlockCipherFinal from seckey.h and BlockSize()
+	virtual void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const =0;
+
+	/// \brief Encrypt or decrypt a block
+	/// \param inBlock the input message before processing
+	/// \param outBlock the output message after processing
+	/// \details ProcessBlock encrypts or decrypts inBlock and write to outBlock.
+	/// \details The size of the block is determined by the block cipher and its documentation.
+	///  Use BLOCKSIZE at compile time, or BlockSize() at runtime.
+	/// \sa FixedBlockSize, BlockCipherFinal from seckey.h and BlockSize()
+	/// \note The message can be transformed in-place, or the buffers must \a not overlap
+	void ProcessBlock(const byte *inBlock, byte *outBlock) const
+		{ProcessAndXorBlock(inBlock, NULLPTR, outBlock);}
+
+	/// \brief Encrypt or decrypt a block in place
+	/// \param inoutBlock the input message before processing
+	/// \details ProcessBlock encrypts or decrypts inoutBlock in-place.
+	/// \details The size of the block is determined by the block cipher and its documentation.
+	///  Use BLOCKSIZE at compile time, or BlockSize() at runtime.
+	/// \sa FixedBlockSize, BlockCipherFinal from seckey.h and BlockSize()
+	void ProcessBlock(byte *inoutBlock) const
+		{ProcessAndXorBlock(inoutBlock, NULLPTR, inoutBlock);}
+
+	/// Provides the block size of the cipher
+	/// \return the block size of the cipher, in bytes
+	virtual unsigned int BlockSize() const =0;
+
+	/// \brief Provides input and output data alignment for optimal performance.
+	/// \return the input data alignment that provides optimal performance
+	/// \sa GetAlignment() and OptimalBlockSize()
+	virtual unsigned int OptimalDataAlignment() const;
+
+	/// \brief Determines if the transformation is a permutation
+	/// \return true if this is a permutation (i.e. there is an inverse transformation)
+	virtual bool IsPermutation() const {return true;}
+
+	/// \brief Determines if the cipher is being operated in its forward direction
+	/// \return true if DIR is ENCRYPTION, false otherwise
+	/// \sa IsForwardTransformation(), IsPermutation(), GetCipherDirection()
+	virtual bool IsForwardTransformation() const =0;
+
+	/// \brief Determines the number of blocks that can be processed in parallel
+	/// \return the number of blocks that can be processed in parallel, for bit-slicing implementations
+	/// \details Bit-slicing is often used to improve throughput and minimize timing attacks.
+	virtual unsigned int OptimalNumberOfParallelBlocks() const {return 1;}
+
+	/// \brief Bit flags that control AdvancedProcessBlocks() behavior
+	enum FlagsForAdvancedProcessBlocks {
+		/// \brief inBlock is a counter
+		BT_InBlockIsCounter=1,
+		/// \brief should not modify block pointers
+		BT_DontIncrementInOutPointers=2,
+		/// \brief Xor inputs before transformation
+		BT_XorInput=4,
+		/// \brief perform the transformation in reverse
+		BT_ReverseDirection=8,
+		/// \brief Allow parallel transformations
+		BT_AllowParallel=16};
+
+	/// \brief Encrypt and xor multiple blocks using additional flags
+	/// \param inBlocks the input message before processing
+	/// \param xorBlocks an optional XOR mask
+	/// \param outBlocks the output message after processing
+	/// \param length the size of the blocks, in bytes
+	/// \param flags additional flags to control processing
+	/// \details Encrypt and xor multiple blocks according to FlagsForAdvancedProcessBlocks flags.
+	/// \note If BT_InBlockIsCounter is set, then the last byte of inBlocks may be modified.
+	virtual size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+
+	/// \brief Provides the direction of the cipher
+	/// \return ENCRYPTION if IsForwardTransformation() is true, DECRYPTION otherwise
+	/// \sa IsForwardTransformation(), IsPermutation()
+	inline CipherDir GetCipherDirection() const {return IsForwardTransformation() ? ENCRYPTION : DECRYPTION;}
+};
+
+/// \brief Interface for the data processing portion of stream ciphers
+/// \sa StreamTransformationFilter()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE StreamTransformation : public Algorithm
+{
+public:
+	virtual ~StreamTransformation() {}
+
+	/// \brief Provides a reference to this object
+	/// \return A reference to this object
+	/// \details Useful for passing a temporary object to a function that takes a non-const reference
+	StreamTransformation& Ref() {return *this;}
+
+	/// \brief Provides the mandatory block size of the cipher
+	/// \return The block size of the cipher if input must be processed in blocks, 1 otherwise
+	/// \details Stream ciphers and some block ciphers modes of operation return 1. Modes that
+	///  return 1 must be able to process a single byte at a time, like counter mode. If a
+	///  mode of operation or block cipher cannot stream then it must not return 1.
+	/// \details When filters operate the mode or cipher, ProcessData will be called with a
+	///  string of bytes that is determined by MandatoryBlockSize and OptimalBlockSize. When a
+	///  policy is set, like 16-byte strings for a 16-byte block cipher, the filter will buffer
+	///  bytes until the specified number of bytes is available to the object.
+	/// \sa ProcessData, ProcessLastBlock, MandatoryBlockSize, MinLastBlockSize, BlockPaddingSchemeDef, IsLastBlockSpecial
+	virtual unsigned int MandatoryBlockSize() const {return 1;}
+
+	/// \brief Provides the input block size most efficient for this cipher
+	/// \return The input block size that is most efficient for the cipher
+	/// \details The base class implementation returns MandatoryBlockSize().
+	/// \note Optimal input length is
+	///  <tt>n * OptimalBlockSize() - GetOptimalBlockSizeUsed()</tt> for any <tt>n \> 0</tt>.
+	virtual unsigned int OptimalBlockSize() const {return MandatoryBlockSize();}
+
+	/// \brief Provides the number of bytes used in the current block when processing at optimal block size.
+	/// \return the number of bytes used in the current block when processing at the optimal block size
+	virtual unsigned int GetOptimalBlockSizeUsed() const {return 0;}
+
+	/// \brief Provides input and output data alignment for optimal performance
+	/// \return the input data alignment that provides optimal performance
+	/// \sa GetAlignment() and OptimalBlockSize()
+	virtual unsigned int OptimalDataAlignment() const;
+
+	/// \brief Encrypt or decrypt an array of bytes
+	/// \param outString the output byte buffer
+	/// \param inString the input byte buffer
+	/// \param length the size of the input and output byte buffers, in bytes
+	/// \details ProcessData is called with a string of bytes whose size depends on MandatoryBlockSize.
+	///  Either <tt>inString == outString</tt>, or they must not overlap.
+	/// \sa ProcessData, ProcessLastBlock, MandatoryBlockSize, MinLastBlockSize, BlockPaddingSchemeDef, IsLastBlockSpecial
+	virtual void ProcessData(byte *outString, const byte *inString, size_t length) =0;
+
+	/// \brief Encrypt or decrypt the last block of data
+	/// \param outString the output byte buffer
+	/// \param outLength the size of the output byte buffer, in bytes
+	/// \param inString the input byte buffer
+	/// \param inLength the size of the input byte buffer, in bytes
+	/// \return the number of bytes used in outString
+	/// \details ProcessLastBlock is used when the last block of data is special and requires handling
+	///  by the cipher. The current implementation provides an output buffer with a size
+	///  <tt>inLength+2*MandatoryBlockSize()</tt>. The return value allows the cipher to expand cipher
+	///  text during encryption or shrink plain text during decryption.
+	/// \details This member function is used by CBC-CTS and OCB modes.
+	/// \sa ProcessData, ProcessLastBlock, MandatoryBlockSize, MinLastBlockSize, BlockPaddingSchemeDef, IsLastBlockSpecial
+	virtual size_t ProcessLastBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength);
+
+	/// \brief Provides the size of the last block
+	/// \return the minimum size of the last block
+	/// \details MinLastBlockSize() returns the minimum size of the last block. 0 indicates the last
+	///  block is not special.
+	/// \details MandatoryBlockSize() enlists one of two behaviors. First, if MandatoryBlockSize()
+	///  returns 1, then the cipher can be streamed and ProcessData() is called with the tail bytes.
+	///  Second, if MandatoryBlockSize() returns non-0, then the string of bytes is padded to
+	///  MandatoryBlockSize() according to the padding mode. Then, ProcessData() is called with the
+	///  padded string of bytes.
+	/// \details Some authenticated encryption modes are not expressed well with MandatoryBlockSize()
+	///  and MinLastBlockSize(). For example, AES/OCB uses 16-byte blocks (MandatoryBlockSize = 16)
+	///  and the last block requires special processing (MinLastBlockSize = 0). However, 0 is a valid
+	///  last block size for OCB and the special processing is custom padding, and not standard PKCS
+	///  padding. In response an unambiguous IsLastBlockSpecial() was added.
+	/// \sa ProcessData, ProcessLastBlock, MandatoryBlockSize, MinLastBlockSize, BlockPaddingSchemeDef, IsLastBlockSpecial
+	virtual unsigned int MinLastBlockSize() const {return 0;}
+
+	/// \brief Determines if the last block receives special processing
+	/// \return true if the last block receives special processing, false otherwise.
+	/// \details Some authenticated encryption modes are not expressed well with
+	///  MandatoryBlockSize() and MinLastBlockSize(). For example, AES/OCB uses
+	///  16-byte blocks (MandatoryBlockSize = 16) and the last block requires special processing
+	///  (MinLastBlockSize = 0). However, 0 is a valid last block size for OCB and the special
+	///  processing is custom padding, and not standard PKCS padding. In response an
+	///  unambiguous IsLastBlockSpecial() was added.
+	/// \details When IsLastBlockSpecial() returns false nothing special happens. All the former
+	///  rules and behaviors apply. This is the default behavior of IsLastBlockSpecial().
+	/// \details When IsLastBlockSpecial() returns true four things happen. First, MinLastBlockSize = 0
+	///  means 0 is a valid block size that should be processed. Second, standard block cipher padding is
+	///  \a not \a applied. Third, the caller supplies an outString is larger than inString by
+	///  <tt>2*MandatoryBlockSize()</tt>. That is, there's a reserve available when processing the last block.
+	///  Fourth, the cipher is responsible for finalization like custom padding. The cipher will tell
+	///  the library how many bytes were processed or used by returning the appropriate value from
+	///  ProcessLastBlock().
+	/// \details The return value of ProcessLastBlock() indicates how many bytes were written to
+	///  <tt>outString</tt>. A filter pipelining data will send <tt>outString</tt> and up to <tt>outLength</tt>
+	///  to an <tt>AttachedTransformation()</tt> for additional processing. Below is an example of the code
+	///  used in <tt>StreamTransformationFilter::LastPut</tt>.
+	/// <pre>  if (m_cipher.IsLastBlockSpecial())
+	///   {
+	///     size_t reserve = 2*m_cipher.MandatoryBlockSize();
+	///     space = HelpCreatePutSpace(*AttachedTransformation(), DEFAULT_CHANNEL, length+reserve);
+	///     length = m_cipher.ProcessLastBlock(space, length+reserve, inString, length);
+	///     AttachedTransformation()->Put(space, length);
+	///     return;
+	///   }</pre>
+	/// \sa ProcessData, ProcessLastBlock, MandatoryBlockSize, MinLastBlockSize, BlockPaddingSchemeDef, IsLastBlockSpecial
+	/// \since Crypto++ 6.0
+	virtual bool IsLastBlockSpecial() const {return false;}
+
+	/// \brief Encrypt or decrypt a string of bytes
+	/// \param inoutString the string to process
+	/// \param length the size of the inoutString, in bytes
+	/// \details Internally, the base class implementation calls ProcessData().
+	inline void ProcessString(byte *inoutString, size_t length)
+		{ProcessData(inoutString, inoutString, length);}
+
+	/// \brief Encrypt or decrypt a string of bytes
+	/// \param outString the output string to process
+	/// \param inString the input string to process
+	/// \param length the size of the input and output strings, in bytes
+	/// \details Internally, the base class implementation calls ProcessData().
+	inline void ProcessString(byte *outString, const byte *inString, size_t length)
+		{ProcessData(outString, inString, length);}
+
+	/// \brief Encrypt or decrypt a byte
+	/// \param input the input byte to process
+	/// \details Internally, the base class implementation calls ProcessData() with a size of 1.
+	inline byte ProcessByte(byte input)
+		{ProcessData(&input, &input, 1); return input;}
+
+	/// \brief Determines whether the cipher supports random access
+	/// \return true if the cipher supports random access, false otherwise
+	virtual bool IsRandomAccess() const =0;
+
+	/// \brief Seek to an absolute position
+	/// \param pos position to seek
+	/// \throw NotImplemented
+	/// \details The base class implementation throws NotImplemented. The function
+	///  \ref CRYPTOPP_ASSERT "asserts" IsRandomAccess() in debug builds.
+	virtual void Seek(lword pos)
+	{
+		CRYPTOPP_UNUSED(pos);
+		CRYPTOPP_ASSERT(!IsRandomAccess());
+		throw NotImplemented("StreamTransformation: this object doesn't support random access");
+	}
+
+	/// \brief Determines whether the cipher is self-inverting
+	/// \return true if the cipher is self-inverting, false otherwise
+	/// \details IsSelfInverting determines whether this transformation is
+	///  self-inverting (e.g. xor with a keystream).
+	virtual bool IsSelfInverting() const =0;
+
+	/// \brief Determines if the cipher is being operated in its forward direction
+	/// \return true if DIR is ENCRYPTION, false otherwise
+	/// \sa IsForwardTransformation(), IsPermutation(), GetCipherDirection()
+	virtual bool IsForwardTransformation() const =0;
+};
+
+/// \brief Interface for hash functions and data processing part of MACs
+/// \details HashTransformation objects are stateful. They are created in an initial state,
+///  change state as Update() is called, and return to the initial
+///  state when Final() is called. This interface allows a large message to
+///  be hashed in pieces by calling Update() on each piece followed by
+///  calling Final().
+/// \sa HashFilter(), HashVerificationFilter()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE HashTransformation : public Algorithm
+{
+public:
+	virtual ~HashTransformation() {}
+
+	/// \brief Provides a reference to this object
+	/// \return A reference to this object
+	/// \details Useful for passing a temporary object to a function that takes a non-const reference
+	HashTransformation& Ref() {return *this;}
+
+	/// \brief Updates a hash with additional input
+	/// \param input the additional input as a buffer
+	/// \param length the size of the buffer, in bytes
+	virtual void Update(const byte *input, size_t length) =0;
+
+	/// \brief Request space which can be written into by the caller
+	/// \param size the requested size of the buffer
+	/// \details The purpose of this method is to help avoid extra memory allocations.
+	/// \details size is an \a IN and \a OUT parameter and used as a hint. When the call is made,
+	///  size is the requested size of the buffer. When the call returns, size is the size of
+	///  the array returned to the caller.
+	/// \details The base class implementation sets size to 0 and returns NULL or nullptr.
+	/// \note Some objects, like ArraySink, cannot create a space because its fixed.
+	virtual byte * CreateUpdateSpace(size_t &size) {size=0; return NULLPTR;}
+
+	/// \brief Computes the hash of the current message
+	/// \param digest a pointer to the buffer to receive the hash
+	/// \details Final() restarts the hash for a new message.
+	/// \pre <tt>COUNTOF(digest) <= DigestSize()</tt> or <tt>COUNTOF(digest) <= HASH::DIGESTSIZE</tt> ensures
+	///  the output byte buffer is large enough for the digest.
+	virtual void Final(byte *digest)
+		{TruncatedFinal(digest, DigestSize());}
+
+	/// \brief Restart the hash
+	/// \details Discards the current state, and restart for a new message
+	virtual void Restart()
+		{TruncatedFinal(NULLPTR, 0);}
+
+	/// Provides the digest size of the hash
+	/// \return the digest size of the hash.
+	virtual unsigned int DigestSize() const =0;
+
+	/// Provides the tag size of the hash
+	/// \return the tag size of the hash.
+	/// \details Same as DigestSize().
+	unsigned int TagSize() const {return DigestSize();}
+
+	/// \brief Provides the block size of the compression function
+	/// \return block size of the compression function, in bytes
+	/// \details BlockSize() will return 0 if the hash is not block based
+	///  or does not have an equivalent block size. For example, Keccak
+	///  and SHA-3 do not have a block size, but they do have an equivalent
+	///  block size called rate expressed as <tt>r</tt>.
+	virtual unsigned int BlockSize() const {return 0;}
+
+	/// \brief Provides the input block size most efficient for this hash.
+	/// \return The input block size that is most efficient for the cipher
+	/// \details The base class implementation returns MandatoryBlockSize().
+	/// \details Optimal input length is
+	///  <tt>n * OptimalBlockSize() - GetOptimalBlockSizeUsed()</tt> for any <tt>n \> 0</tt>.
+	virtual unsigned int OptimalBlockSize() const {return 1;}
+
+	/// \brief Provides input and output data alignment for optimal performance
+	/// \return the input data alignment that provides optimal performance
+	/// \sa GetAlignment() and OptimalBlockSize()
+	virtual unsigned int OptimalDataAlignment() const;
+
+	/// \brief Updates the hash with additional input and computes the hash of the current message
+	/// \param digest a pointer to the buffer to receive the hash
+	/// \param input the additional input as a buffer
+	/// \param length the size of the buffer, in bytes
+	/// \details Use this if your input is in one piece and you don't want to call Update()
+	///  and Final() separately
+	/// \details CalculateDigest() restarts the hash for the next message.
+	/// \pre <tt>COUNTOF(digest) == DigestSize()</tt> or <tt>COUNTOF(digest) == HASH::DIGESTSIZE</tt> ensures
+	///  the output byte buffer is a valid size.
+	virtual void CalculateDigest(byte *digest, const byte *input, size_t length)
+		{Update(input, length); Final(digest);}
+
+	/// \brief Verifies the hash of the current message
+	/// \param digest a pointer to the buffer of an \a existing hash
+	/// \return \p true if the existing hash matches the computed hash, \p false otherwise
+	/// \throw InvalidArgument() if the existing hash's size exceeds DigestSize()
+	/// \details Verify() performs a bitwise compare on the buffers using VerifyBufsEqual(), which is
+	///  a constant time comparison function. digestLength cannot exceed DigestSize().
+	/// \details Verify() restarts the hash for the next message.
+	/// \pre <tt>COUNTOF(digest) == DigestSize()</tt> or <tt>COUNTOF(digest) == HASH::DIGESTSIZE</tt> ensures
+	///  the input byte buffer is a valid size.
+	virtual bool Verify(const byte *digest)
+		{return TruncatedVerify(digest, DigestSize());}
+
+	/// \brief Updates the hash with additional input and verifies the hash of the current message
+	/// \param digest a pointer to the buffer of an \a existing hash
+	/// \param input the additional input as a buffer
+	/// \param length the size of the buffer, in bytes
+	/// \return \p true if the existing hash matches the computed hash, \p false otherwise
+	/// \throw InvalidArgument() if the existing hash's size exceeds DigestSize()
+	/// \details Use this if your input is in one piece and you don't want to call Update()
+	///  and Verify() separately
+	/// \details VerifyDigest() performs a bitwise compare on the buffers using VerifyBufsEqual(),
+	///  which is a constant time comparison function.
+	/// \details VerifyDigest() restarts the hash for the next message.
+	/// \pre <tt>COUNTOF(digest) == DigestSize()</tt> or <tt>COUNTOF(digest) == HASH::DIGESTSIZE</tt> ensures
+	///  the output byte buffer is a valid size.
+	virtual bool VerifyDigest(const byte *digest, const byte *input, size_t length)
+		{Update(input, length); return Verify(digest);}
+
+	/// \brief Computes the hash of the current message
+	/// \param digest a pointer to the buffer to receive the hash
+	/// \param digestSize the size of the truncated digest, in bytes
+	/// \details TruncatedFinal() calls Final() and then copies digestSize bytes to digest.
+	///  The hash is restarted the hash for the next message.
+	/// \pre <tt>COUNTOF(digest) <= DigestSize()</tt> or <tt>COUNTOF(digest) <= HASH::DIGESTSIZE</tt> ensures
+	///  the output byte buffer is a valid size.
+	virtual void TruncatedFinal(byte *digest, size_t digestSize) =0;
+
+	/// \brief Updates the hash with additional input and computes the hash of the current message
+	/// \param digest a pointer to the buffer to receive the hash
+	/// \param digestSize the length of the truncated hash, in bytes
+	/// \param input the additional input as a buffer
+	/// \param length the size of the buffer, in bytes
+	/// \details Use this if your input is in one piece and you don't want to call Update()
+	///  and CalculateDigest() separately.
+	/// \details CalculateTruncatedDigest() restarts the hash for the next message.
+	/// \pre <tt>digestSize <= DigestSize()</tt> or <tt>digestSize <= HASH::DIGESTSIZE</tt> ensures
+	///  the output byte buffer is a valid size.
+	virtual void CalculateTruncatedDigest(byte *digest, size_t digestSize, const byte *input, size_t length)
+		{Update(input, length); TruncatedFinal(digest, digestSize);}
+
+	/// \brief Verifies the hash of the current message
+	/// \param digest a pointer to the buffer of an \a existing hash
+	/// \param digestLength the size of the truncated hash, in bytes
+	/// \return \p true if the existing hash matches the computed hash, \p false otherwise
+	/// \throw InvalidArgument() if digestLength exceeds DigestSize()
+	/// \details TruncatedVerify() is a truncated version of Verify(). It can operate on a
+	///  buffer smaller than DigestSize(). However, digestLength cannot exceed DigestSize().
+	/// \details Verify() performs a bitwise compare on the buffers using VerifyBufsEqual(), which is
+	///  a constant time comparison function. digestLength cannot exceed DigestSize().
+	/// \details TruncatedVerify() restarts the hash for the next message.
+	/// \pre <tt>digestLength <= DigestSize()</tt> or <tt>digestLength <= HASH::DIGESTSIZE</tt> ensures
+	///  the input byte buffer is a valid size.
+	virtual bool TruncatedVerify(const byte *digest, size_t digestLength);
+
+	/// \brief Updates the hash with additional input and verifies the hash of the current message
+	/// \param digest a pointer to the buffer of an \a existing hash
+	/// \param digestLength the size of the truncated hash, in bytes
+	/// \param input the additional input as a buffer
+	/// \param length the size of the buffer, in bytes
+	/// \return \p true if the existing hash matches the computed hash, \p false otherwise
+	/// \throw InvalidArgument() if digestLength exceeds DigestSize()
+	/// \details Use this if your input is in one piece and you don't want to call Update()
+	///  and TruncatedVerify() separately.
+	/// \details VerifyTruncatedDigest() is a truncated version of VerifyDigest(). It can operate
+	///  on a buffer smaller than DigestSize(). However, digestLength cannot exceed DigestSize().
+	/// \details VerifyTruncatedDigest() restarts the hash for the next message.
+	/// \pre <tt>digestLength <= DigestSize()</tt> or <tt>digestLength <= HASH::DIGESTSIZE</tt> ensures
+	///  the input byte buffer is a valid size.
+	virtual bool VerifyTruncatedDigest(const byte *digest, size_t digestLength, const byte *input, size_t length)
+		{Update(input, length); return TruncatedVerify(digest, digestLength);}
+
+protected:
+	/// \brief Validates a truncated digest size
+	/// \param size the requested digest size
+	/// \throw InvalidArgument if the algorithm's digest size cannot be truncated to the requested size
+	/// \details Throws an exception when the truncated digest size is greater than DigestSize()
+	void ThrowIfInvalidTruncatedSize(size_t size) const;
+};
+
+/// \brief Interface for one direction (encryption or decryption) of a block cipher
+/// \details These objects usually should not be used directly. See BlockTransformation for more details.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE BlockCipher : public SimpleKeyingInterface, public BlockTransformation
+{
+protected:
+	const Algorithm & GetAlgorithm() const {return *this;}
+};
+
+/// \brief Interface for one direction (encryption or decryption) of a stream cipher or cipher mode
+/// \details These objects usually should not be used directly. See StreamTransformation for more details.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE SymmetricCipher : public SimpleKeyingInterface, public StreamTransformation
+{
+protected:
+	const Algorithm & GetAlgorithm() const {return *this;}
+};
+
+/// \brief Interface for message authentication codes
+/// \details These objects usually should not be used directly. See HashTransformation for more details.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE MessageAuthenticationCode : public SimpleKeyingInterface, public HashTransformation
+{
+protected:
+	const Algorithm & GetAlgorithm() const {return *this;}
+};
+
+/// \brief Interface for authenticated encryption modes of operation
+/// \details AuthenticatedSymmetricCipher() provides the interface for one direction
+///  (encryption or decryption) of a stream cipher or block cipher mode with authentication. The
+///  StreamTransformation() part of this interface is used to encrypt or decrypt the data. The
+///  MessageAuthenticationCode() part of the interface is used to input additional authenticated
+///  data (AAD), which is MAC'ed but not encrypted. The MessageAuthenticationCode() part is also
+///  used to generate and verify the MAC.
+/// \details Crypto++ provides four authenticated encryption modes of operation - CCM, EAX, GCM
+///  and OCB mode. All modes implement AuthenticatedSymmetricCipher() and the motivation for
+///  the API, like calling AAD a &quot;header&quot;, can be found in Bellare, Rogaway and
+///  Wagner's <A HREF="http://web.cs.ucdavis.edu/~rogaway/papers/eax.pdf">The EAX Mode of
+///  Operation</A>. The EAX paper suggested a basic API to help standardize AEAD schemes in
+///  software and promote adoption of the modes.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Authenticated_Encryption">Authenticated
+///  Encryption</A> on the Crypto++ wiki.
+/// \since Crypto++ 5.6.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE AuthenticatedSymmetricCipher : public MessageAuthenticationCode, public StreamTransformation
+{
+public:
+	virtual ~AuthenticatedSymmetricCipher() {}
+
+	/// \brief Exception thrown when the object is in the wrong state for the operation
+	/// \details this indicates that a member function was called in the wrong state, for example trying to encrypt
+	///  a message before having set the key or IV
+	class BadState : public Exception
+	{
+	public:
+		explicit BadState(const std::string &name, const char *message) : Exception(OTHER_ERROR, name + ": " + message) {}
+		explicit BadState(const std::string &name, const char *function, const char *state) : Exception(OTHER_ERROR, name + ": " + function + " was called before " + state) {}
+	};
+
+	/// \brief Provides the maximum length of AAD that can be input
+	/// \return the maximum length of AAD that can be input before the encrypted data
+	virtual lword MaxHeaderLength() const =0;
+
+	/// \brief Provides the maximum length of encrypted data
+	/// \return the maximum length of encrypted data
+	virtual lword MaxMessageLength() const =0;
+
+	/// \brief Provides the maximum length of AAD
+	/// \return the maximum length of AAD that can be input after the encrypted data
+	virtual lword MaxFooterLength() const {return 0;}
+
+	/// \brief Determines if data lengths must be specified prior to inputting data
+	/// \return true if the data lengths are required before inputting data, false otherwise
+	/// \details if this function returns true, SpecifyDataLengths() must be called before attempting to input data.
+	///  This is the case for some schemes, such as CCM.
+	/// \sa SpecifyDataLengths()
+	virtual bool NeedsPrespecifiedDataLengths() const {return false;}
+
+	/// \brief Prescribes the data lengths
+	/// \param headerLength size of data before message is input, in bytes
+	/// \param messageLength size of the message, in bytes
+	/// \param footerLength size of data after message is input, in bytes
+	/// \details SpecifyDataLengths() only needs to be called if NeedsPrespecifiedDataLengths() returns <tt>true</tt>.
+	///  If <tt>true</tt>, then <tt>headerLength</tt> will be validated against <tt>MaxHeaderLength()</tt>,
+	///  <tt>messageLength</tt> will be validated against <tt>MaxMessageLength()</tt>, and
+	///  <tt>footerLength</tt> will be validated against <tt>MaxFooterLength()</tt>.
+	/// \sa NeedsPrespecifiedDataLengths()
+	void SpecifyDataLengths(lword headerLength, lword messageLength, lword footerLength=0);
+
+	/// \brief Encrypts and calculates a MAC in one call
+	/// \param ciphertext the encryption buffer
+	/// \param mac the mac buffer
+	/// \param macSize the size of the MAC buffer, in bytes
+	/// \param iv the iv buffer
+	/// \param ivLength the size of the IV buffer, in bytes
+	/// \param header the AAD buffer
+	/// \param headerLength the size of the AAD buffer, in bytes
+	/// \param message the message buffer
+	/// \param messageLength the size of the messagetext buffer, in bytes
+	/// \details EncryptAndAuthenticate() encrypts and generates the MAC in one call. The function
+	///  truncates the MAC if <tt>macSize < TagSize()</tt>.
+	virtual void EncryptAndAuthenticate(byte *ciphertext, byte *mac, size_t macSize, const byte *iv, int ivLength, const byte *header, size_t headerLength, const byte *message, size_t messageLength);
+
+	/// \brief Decrypts and verifies a MAC in one call
+	/// \param message the decryption buffer
+	/// \param mac the mac buffer
+	/// \param macSize the size of the MAC buffer, in bytes
+	/// \param iv the iv buffer
+	/// \param ivLength the size of the IV buffer, in bytes
+	/// \param header the AAD buffer
+	/// \param headerLength the size of the AAD buffer, in bytes
+	/// \param ciphertext the ciphertext buffer
+	/// \param ciphertextLength the size of the ciphertext buffer, in bytes
+	/// \return true if the MAC is valid and the decoding succeeded, false otherwise
+	/// \details DecryptAndVerify() decrypts and verifies the MAC in one call.
+	/// <tt>message</tt> is a decryption buffer and should be at least as large as the ciphertext buffer.
+	/// \details The function returns true iff MAC is valid. DecryptAndVerify() assumes the MAC
+	///  is truncated if <tt>macLength < TagSize()</tt>.
+	virtual bool DecryptAndVerify(byte *message, const byte *mac, size_t macSize, const byte *iv, int ivLength, const byte *header, size_t headerLength, const byte *ciphertext, size_t ciphertextLength);
+
+	/// \brief Provides the name of this algorithm
+	/// \return the standard algorithm name
+	/// \details The standard algorithm name can be a name like \a AES or \a AES/GCM. Some algorithms
+	///  do not have standard names yet. For example, there is no standard algorithm name for
+	///  Shoup's ECIES.
+	virtual std::string AlgorithmName() const;
+
+	/// \brief Retrieve the provider of this algorithm
+	/// \return the algorithm provider
+	/// \details The algorithm provider can be a name like "C++", "SSE", "NEON", "AESNI",
+	///  "ARMv8" and "Power8". C++ is standard C++ code. Other labels, like SSE,
+	///  usually indicate a specialized implementation using instructions from a higher
+	///  instruction set architecture (ISA). Future labels may include external hardware
+	///  like a hardware security module (HSM).
+	/// \details Generally speaking Wei Dai's original IA-32 ASM code falls under "SSE2".
+	///  Labels like "SSSE3" and "SSE4.1" follow after Wei's code and use intrinsics
+	///  instead of ASM.
+	/// \details Algorithms which combine different instructions or ISAs provide the
+	///  dominant one. For example on x86 <tt>AES/GCM</tt> returns "AESNI" rather than
+	///  "CLMUL" or "AES+SSE4.1" or "AES+CLMUL" or "AES+SSE4.1+CLMUL".
+	/// \note Provider is not universally implemented yet.
+	/// \since Crypto++ 8.0
+	virtual std::string AlgorithmProvider() const {return "C++";}
+
+protected:
+	const Algorithm & GetAlgorithm() const
+		{return *static_cast<const MessageAuthenticationCode *>(this);}
+	virtual void UncheckedSpecifyDataLengths(lword headerLength, lword messageLength, lword footerLength)
+		{CRYPTOPP_UNUSED(headerLength); CRYPTOPP_UNUSED(messageLength); CRYPTOPP_UNUSED(footerLength);}
+};
+
+/// \brief Interface for random number generators
+/// \details The library provides a number of random number generators, from software based
+///  to hardware based generators.
+/// \details All generated values are uniformly distributed over the range specified.
+/// \since Crypto++ 3.1
+/// \sa <A HREF="https://www.cryptopp.com/wiki/RandomNumberGenerator">RandomNumberGenerator</A>
+///  on the Crypto++ wiki
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE RandomNumberGenerator : public Algorithm
+{
+public:
+	virtual ~RandomNumberGenerator() {}
+
+	/// \brief Update RNG state with additional unpredictable values
+	/// \param input the entropy to add to the generator
+	/// \param length the size of the input buffer
+	/// \throw NotImplemented
+	/// \details A generator may or may not accept additional entropy. Call CanIncorporateEntropy()
+	///  to test for the ability to use additional entropy.
+	/// \details If a derived class does not override IncorporateEntropy(), then the base class
+	///  throws NotImplemented.
+	virtual void IncorporateEntropy(const byte *input, size_t length)
+	{
+		CRYPTOPP_UNUSED(input); CRYPTOPP_UNUSED(length);
+		throw NotImplemented("RandomNumberGenerator: IncorporateEntropy not implemented");
+	}
+
+	/// \brief Determines if a generator can accept additional entropy
+	/// \return true if IncorporateEntropy() is implemented
+	virtual bool CanIncorporateEntropy() const {return false;}
+
+	/// \brief Generate new random byte and return it
+	/// \return a random 8-bit byte
+	/// \details Default implementation calls GenerateBlock() with one byte.
+	/// \details All generated values are uniformly distributed over the range specified within the
+	///  the constraints of a particular generator.
+	virtual byte GenerateByte();
+
+	/// \brief Generate new random bit and return it
+	/// \return a random bit
+	/// \details The default implementation calls GenerateByte() and return its lowest bit.
+	/// \details All generated values are uniformly distributed over the range specified within the
+	///  the constraints of a particular generator.
+	virtual unsigned int GenerateBit();
+
+	/// \brief Generate a random 32 bit word in the range min to max, inclusive
+	/// \param min the lower bound of the range
+	/// \param max the upper bound of the range
+	/// \return a random 32-bit word
+	/// \details The default implementation calls Crop() on the difference between max and
+	///  min, and then returns the result added to min.
+	/// \details All generated values are uniformly distributed over the range specified within the
+	///  the constraints of a particular generator.
+	virtual word32 GenerateWord32(word32 min=0, word32 max=0xffffffffUL);
+
+	/// \brief Generate random array of bytes
+	/// \param output the byte buffer
+	/// \param size the length of the buffer, in bytes
+	/// \details All generated values are uniformly distributed over the range specified within the
+	///  the constraints of a particular generator.
+	/// \note A derived generator \a must override either GenerateBlock() or
+	///  GenerateIntoBufferedTransformation(). They can override both, or have one call the other.
+	virtual void GenerateBlock(byte *output, size_t size);
+
+	/// \brief Generate random bytes into a BufferedTransformation
+	/// \param target the BufferedTransformation object which receives the bytes
+	/// \param channel the channel on which the bytes should be pumped
+	/// \param length the number of bytes to generate
+	/// \details The default implementation calls GenerateBlock() and pumps the result into
+	///  the DEFAULT_CHANNEL of the target.
+	/// \details All generated values are uniformly distributed over the range specified within the
+	///  the constraints of a particular generator.
+	/// \note A derived generator \a must override either GenerateBlock() or
+	///  GenerateIntoBufferedTransformation(). They can override both, or have one call the other.
+	virtual void GenerateIntoBufferedTransformation(BufferedTransformation &target, const std::string &channel, lword length);
+
+	/// \brief Generate and discard n bytes
+	/// \param n the number of bytes to generate and discard
+	virtual void DiscardBytes(size_t n);
+
+	/// \brief Randomly shuffle the specified array
+	/// \param begin an iterator to the first element in the array
+	/// \param end an iterator beyond the last element in the array
+	/// \details The resulting permutation is uniformly distributed.
+	template <class IT> void Shuffle(IT begin, IT end)
+	{
+		// TODO: What happens if there are more than 2^32 elements?
+		for (; begin != end; ++begin)
+			std::iter_swap(begin, begin + GenerateWord32(0, static_cast<word32>(end-begin-1)));
+	}
+};
+
+/// \brief Interface for key derivation functions
+/// \since Crypto++ 7.0
+/// \sa <A HREF="https://www.cryptopp.com/wiki/KeyDerivationFunction">KeyDerivationFunction</A>
+///  on the Crypto++ wiki
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE KeyDerivationFunction : public Algorithm
+{
+public:
+	virtual ~KeyDerivationFunction() {}
+
+	/// \brief Provides the name of this algorithm
+	/// \return the standard algorithm name
+	virtual std::string AlgorithmName() const =0;
+
+	/// \brief Determine minimum number of bytes
+	/// \return Minimum number of bytes which can be derived
+	virtual size_t MinDerivedKeyLength() const;
+
+	/// \brief Determine maximum number of bytes
+	/// \return Maximum number of bytes which can be derived
+	virtual size_t MaxDerivedKeyLength() const;
+
+	/// \brief Returns a valid key length for the derivation function
+	/// \param keylength the size of the derived key, in bytes
+	/// \return the valid key length, in bytes
+	virtual size_t GetValidDerivedLength(size_t keylength) const =0;
+
+	/// \brief Returns whether keylength is a valid key length
+	/// \param keylength the requested keylength
+	/// \return true if the derived keylength is valid, false otherwise
+	/// \details Internally the function calls GetValidKeyLength()
+	virtual bool IsValidDerivedLength(size_t keylength) const {
+		return keylength == GetValidDerivedLength(keylength);
+	}
+
+	/// \brief Derive a key from a seed
+	/// \param derived the derived output buffer
+	/// \param derivedLen the size of the derived buffer, in bytes
+	/// \param secret the seed input buffer
+	/// \param secretLen the size of the secret buffer, in bytes
+	/// \param params additional initialization parameters to configure this object
+	/// \return the number of iterations performed
+	/// \throw InvalidDerivedKeyLength if <tt>derivedLen</tt> is invalid for the scheme
+	/// \details DeriveKey() provides a standard interface to derive a key from
+	///  a secret seed and other parameters. Each class that derives from KeyDerivationFunction
+	///  provides an overload that accepts most parameters used by the derivation function.
+	/// \details the number of iterations performed by DeriveKey() may be 1. For example, a
+	///  scheme like HKDF does not use the iteration count so it returns 1.
+	virtual size_t DeriveKey(byte *derived, size_t derivedLen, const byte *secret, size_t secretLen, const NameValuePairs& params = g_nullNameValuePairs) const =0;
+
+	/// \brief Set or change parameters
+	/// \param params additional initialization parameters to configure this object
+	/// \details SetParameters() is useful for setting common parameters when an object is
+	///  reused. Some derivation function classes may choose to implement it.
+	virtual void SetParameters(const NameValuePairs& params);
+
+protected:
+	/// \brief Returns the base class Algorithm
+	/// \return the base class Algorithm
+	virtual const Algorithm & GetAlgorithm() const =0;
+
+	/// \brief Validates the derived key length
+	/// \param length the size of the derived key material, in bytes
+	/// \throw InvalidKeyLength if the key length is invalid
+	void ThrowIfInvalidDerivedKeyLength(size_t length) const;
+};
+
+/// \brief Interface for password based key derivation functions
+/// \since Crypto++ 7.0
+struct PasswordBasedKeyDerivationFunction : public KeyDerivationFunction
+{
+};
+
+/// \brief Random Number Generator that does not produce random numbers
+/// \return reference that can be passed to functions that require a RandomNumberGenerator
+/// \details NullRNG() returns a reference that can be passed to functions that require a
+///  RandomNumberGenerator but don't actually use it. The NullRNG() throws NotImplemented
+///  when a generation function is called.
+/// \sa ClassNullRNG, PK_SignatureScheme::IsProbabilistic()
+CRYPTOPP_DLL RandomNumberGenerator & CRYPTOPP_API NullRNG();
+
+class WaitObjectContainer;
+class CallStack;
+
+/// \brief Interface for objects that can be waited on.
+class CRYPTOPP_NO_VTABLE Waitable
+{
+public:
+	virtual ~Waitable() {}
+
+	/// \brief Maximum number of wait objects that this object can return
+	/// \return the maximum number of wait objects
+	virtual unsigned int GetMaxWaitObjectCount() const =0;
+
+	/// \brief Retrieves waitable objects
+	/// \param container the wait container to receive the references to the objects.
+	/// \param callStack CallStack() object used to select waitable objects
+	/// \details GetWaitObjects() is usually called in one of two ways. First, it can
+	///  be called like <tt>something.GetWaitObjects(c, CallStack("my func after X", 0));</tt>.
+	///  Second, if in an outer GetWaitObjects() method that itself takes a callStack
+	///  parameter, it can be called like
+	///  <tt>innerThing.GetWaitObjects(c, CallStack("MyClass::GetWaitObjects at X", &callStack));</tt>.
+	virtual void GetWaitObjects(WaitObjectContainer &container, CallStack const& callStack) =0;
+
+	/// \brief Wait on this object
+	/// \return true if the wait succeeded, false otherwise
+	/// \details Wait() is the same as creating an empty container, calling GetWaitObjects(), and then calling
+	///  Wait() on the container.
+	bool Wait(unsigned long milliseconds, CallStack const& callStack);
+};
+
+/// \brief Interface for buffered transformations
+/// \details BufferedTransformation is a generalization of BlockTransformation,
+///  StreamTransformation and HashTransformation.
+/// \details A buffered transformation is an object that takes a stream of bytes as input (this may
+///  be done in stages), does some computation on them, and then places the result into an internal
+///  buffer for later retrieval. Any partial result already in the output buffer is not modified
+///  by further input.
+/// \details If a method takes a "blocking" parameter, and you pass false for it, then the method
+///  will return before all input has been processed if the input cannot be processed without waiting
+///  (for network buffers to become available, for example). In this case the method will return true
+///  or a non-zero integer value. When this happens you must continue to call the method with the same
+///  parameters until it returns false or zero, before calling any other method on it or attached
+///  BufferedTransformation. The integer return value in this case is approximately
+///  the number of bytes left to be processed, and can be used to implement a progress bar.
+/// \details For functions that take a "propagation" parameter, <tt>propagation != 0</tt> means pass on
+///  the signal to attached BufferedTransformation objects, with propagation decremented at each
+///  step until it reaches <tt>0</tt>. <tt>-1</tt> means unlimited propagation.
+/// \details \a All of the retrieval functions, like Get() and GetWord32(), return the actual
+///  number of bytes retrieved, which is the lesser of the request number and MaxRetrievable().
+/// \details \a Most of the input functions, like Put() and PutWord32(), return the number of
+///  bytes remaining to be processed. A 0 value means all bytes were processed, and a non-0 value
+///  means bytes remain to be processed.
+/// \nosubgrouping
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE BufferedTransformation : public Algorithm, public Waitable
+{
+public:
+	virtual ~BufferedTransformation() {}
+
+	/// \brief Construct a BufferedTransformation
+	BufferedTransformation() : Algorithm(false) {}
+
+	/// \brief Provides a reference to this object
+	/// \return A reference to this object
+	/// \details Useful for passing a temporary object to a function that takes a non-const reference
+	BufferedTransformation& Ref() {return *this;}
+
+	///	\name INPUT
+	//@{
+
+		/// \brief Input a byte for processing
+		/// \param inByte the 8-bit byte (octet) to be processed.
+		/// \param blocking specifies whether the object should block when processing input.
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+		///  0 indicates all bytes were processed.
+		/// \details <tt>Put(byte)</tt> calls <tt>Put(byte*, size_t)</tt>.
+		size_t Put(byte inByte, bool blocking=true)
+			{return Put(&inByte, 1, blocking);}
+
+		/// \brief Input a byte buffer for processing
+		/// \param inString the byte buffer to process
+		/// \param length the size of the string, in bytes
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+		///  0 indicates all bytes were processed.
+		/// \details Internally, Put() calls Put2().
+		size_t Put(const byte *inString, size_t length, bool blocking=true)
+			{return Put2(inString, length, 0, blocking);}
+
+		/// Input a 16-bit word for processing.
+		/// \param value the 16-bit value to be processed
+		/// \param order the ByteOrder of the value to be processed.
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+		///  0 indicates all bytes were processed.
+		size_t PutWord16(word16 value, ByteOrder order=BIG_ENDIAN_ORDER, bool blocking=true);
+
+		/// Input a 32-bit word for processing.
+		/// \param value the 32-bit value to be processed.
+		/// \param order the ByteOrder of the value to be processed.
+		/// \param blocking specifies whether the object should block when processing input.
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+		///  0 indicates all bytes were processed.
+		size_t PutWord32(word32 value, ByteOrder order=BIG_ENDIAN_ORDER, bool blocking=true);
+
+		/// Input a 64-bit word for processing.
+		/// \param value the 64-bit value to be processed.
+		/// \param order the ByteOrder of the value to be processed.
+		/// \param blocking specifies whether the object should block when processing input.
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+		///  0 indicates all bytes were processed.
+		size_t PutWord64(word64 value, ByteOrder order=BIG_ENDIAN_ORDER, bool blocking=true);
+
+		/// \brief Request space which can be written into by the caller
+		/// \param size the requested size of the buffer
+		/// \return byte pointer to the space to input data
+		/// \details The purpose of this method is to help avoid extra memory allocations.
+		/// \details size is an \a IN and \a OUT parameter and used as a hint. When the call is made,
+		///  size is the requested size of the buffer. When the call returns, size is the size of
+		///  the array returned to the caller.
+		/// \details The base class implementation sets size to 0 and returns NULL.
+		/// \note Some objects, like ArraySink, cannot create a space because its fixed. In the case of
+		/// an ArraySink, the pointer to the array is returned and the size is remaining size.
+		virtual byte * CreatePutSpace(size_t &size)
+			{size=0; return NULLPTR;}
+
+		/// \brief Determines whether input can be modified by the callee
+		/// \return true if input can be modified, false otherwise
+		/// \details The base class implementation returns false.
+		virtual bool CanModifyInput() const
+			{return false;}
+
+		/// \brief Input multiple bytes that may be modified by callee.
+		/// \param inString the byte buffer to process
+		/// \param length the size of the string, in bytes
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed). 0 indicates all
+		///  bytes were processed.
+		size_t PutModifiable(byte *inString, size_t length, bool blocking=true)
+			{return PutModifiable2(inString, length, 0, blocking);}
+
+		/// \brief Signals the end of messages to the object
+		/// \param propagation the number of attached transformations the MessageEnd() signal should be passed
+		/// \param blocking specifies whether the object should block when processing input
+		/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+		///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+		bool MessageEnd(int propagation=-1, bool blocking=true)
+			{return !!Put2(NULLPTR, 0, propagation < 0 ? -1 : propagation+1, blocking);}
+
+		/// \brief Input multiple bytes for processing and signal the end of a message
+		/// \param inString the byte buffer to process
+		/// \param length the size of the string, in bytes
+		/// \param propagation the number of attached transformations the MessageEnd() signal should be passed
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed). 0 indicates all
+		///  bytes were processed.
+		/// \details Internally, PutMessageEnd() calls Put2() with a modified propagation to
+		///  ensure all attached transformations finish processing the message.
+		/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+		///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+		size_t PutMessageEnd(const byte *inString, size_t length, int propagation=-1, bool blocking=true)
+			{return Put2(inString, length, propagation < 0 ? -1 : propagation+1, blocking);}
+
+		/// \brief Input multiple bytes for processing
+		/// \param inString the byte buffer to process
+		/// \param length the size of the string, in bytes
+		/// \param messageEnd means how many filters to signal MessageEnd() to, including this one
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed). 0 indicates all
+		///  bytes were processed.
+		/// \details Derived classes must implement Put2().
+		virtual size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking) =0;
+
+		/// \brief Input multiple bytes that may be modified by callee.
+		/// \param inString the byte buffer to process.
+		/// \param length the size of the string, in bytes.
+		/// \param messageEnd means how many filters to signal MessageEnd() to, including this one.
+		/// \param blocking specifies whether the object should block when processing input.
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed). 0 indicates all
+		///  bytes were processed.
+		/// \details Internally, PutModifiable2() calls Put2().
+		virtual size_t PutModifiable2(byte *inString, size_t length, int messageEnd, bool blocking)
+			{return Put2(inString, length, messageEnd, blocking);}
+
+		/// \brief Exception thrown by objects that have \a not implemented nonblocking input processing
+		/// \details BlockingInputOnly inherits from NotImplemented
+		struct BlockingInputOnly : public NotImplemented
+			{BlockingInputOnly(const std::string &s) : NotImplemented(s + ": Nonblocking input is not implemented by this object.") {}};
+	//@}
+
+	///	\name WAITING
+	//@{
+		/// \brief Retrieves the maximum number of waitable objects
+		unsigned int GetMaxWaitObjectCount() const;
+
+		/// \brief Retrieves waitable objects
+		/// \param container the wait container to receive the references to the objects
+		/// \param callStack CallStack() object used to select waitable objects
+		/// \details GetWaitObjects is usually called in one of two ways. First, it can
+		///  be called like <tt>something.GetWaitObjects(c, CallStack("my func after X", 0));</tt>.
+		///  Second, if in an outer GetWaitObjects() method that itself takes a callStack
+		///  parameter, it can be called like
+		///  <tt>innerThing.GetWaitObjects(c, CallStack("MyClass::GetWaitObjects at X", &callStack));</tt>.
+		void GetWaitObjects(WaitObjectContainer &container, CallStack const& callStack);
+	//@} // WAITING
+
+	///	\name SIGNALS
+	//@{
+
+		/// \brief Initialize or reinitialize this object, without signal propagation
+		/// \param parameters a set of NameValuePairs to initialize this object
+		/// \throw NotImplemented
+		/// \details IsolatedInitialize() is used to initialize or reinitialize an object using a variable
+		///  number of arbitrarily typed arguments. The function avoids the need for multiple constructors providing
+		///  all possible combintations of configurable parameters.
+		/// \details IsolatedInitialize() does not call Initialize() on attached transformations. If initialization
+		///  should be propagated, then use the Initialize() function.
+		/// \details If a derived class does not override IsolatedInitialize(), then the base class throws
+		///  NotImplemented.
+		virtual void IsolatedInitialize(const NameValuePairs &parameters) {
+			CRYPTOPP_UNUSED(parameters);
+			throw NotImplemented("BufferedTransformation: this object can't be reinitialized");
+		}
+
+		/// \brief Flushes data buffered by this object, without signal propagation
+		/// \param hardFlush indicates whether all data should be flushed
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return true if the flush was successful, false otherwise
+		/// \note hardFlush must be used with care
+		virtual bool IsolatedFlush(bool hardFlush, bool blocking) =0;
+
+		/// \brief Marks the end of a series of messages, without signal propagation
+		/// \param blocking specifies whether the object should block when completing the processing on
+		///  the current series of messages
+		/// \return true if the message was successful, false otherwise
+		virtual bool IsolatedMessageSeriesEnd(bool blocking)
+			{CRYPTOPP_UNUSED(blocking); return false;}
+
+		/// \brief Initialize or reinitialize this object, with signal propagation
+		/// \param parameters a set of NameValuePairs to initialize or reinitialize this object
+		/// \param propagation the number of attached transformations the Initialize() signal should be passed
+		/// \details Initialize() is used to initialize or reinitialize an object using a variable number of
+		///  arbitrarily typed arguments. The function avoids the need for multiple constructors providing
+		///  all possible combintations of configurable parameters.
+		/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+		///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+		virtual void Initialize(const NameValuePairs &parameters=g_nullNameValuePairs, int propagation=-1);
+
+		/// \brief Flush buffered input and/or output, with signal propagation
+		/// \param hardFlush is used to indicate whether all data should be flushed
+		/// \param propagation the number of attached transformations the Flush()
+		///  signal should be passed
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return true if the flush was successful, false otherwise
+		/// \details propagation count includes this object. Setting propagation to
+		///  <tt>1</tt> means this object only. Setting propagation to <tt>-1</tt>
+		///  means unlimited propagation.
+		/// \note Hard flushes must be used with care. It means try to process and
+		///  output everything, even if there may not be enough data to complete the
+		///  action. For example, hard flushing a HexDecoder would cause an error if
+		///  you do it after inputing an odd number of hex encoded characters.
+		/// \note For some types of filters, like  ZlibDecompressor, hard flushes can
+		///  only be done at "synchronization points". These synchronization points
+		///  are positions in the data stream that are created by hard flushes on the
+		///  corresponding reverse filters, in this example ZlibCompressor. This is
+		///  useful when zlib compressed data is moved across a network in packets
+		///  and compression state is preserved across packets, as in the SSH2 protocol.
+		virtual bool Flush(bool hardFlush, int propagation=-1, bool blocking=true);
+
+		/// \brief Marks the end of a series of messages, with signal propagation
+		/// \param propagation the number of attached transformations the MessageSeriesEnd() signal should be passed
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return true if the message was successful, false otherwise
+		/// \details Each object that receives the signal will perform its processing, decrement
+		///  propagation, and then pass the signal on to attached transformations if the value is not 0.
+		/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+		///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+		/// \note There should be a MessageEnd() immediately before MessageSeriesEnd().
+		virtual bool MessageSeriesEnd(int propagation=-1, bool blocking=true);
+
+		/// \brief Set propagation of automatically generated and transferred signals
+		/// \param propagation then new value
+		/// \details Setting propagation to <tt>0</tt> means do not automatically generate signals. Setting
+		///  propagation to <tt>-1</tt> means unlimited propagation.
+		virtual void SetAutoSignalPropagation(int propagation)
+			{CRYPTOPP_UNUSED(propagation);}
+
+		/// \brief Retrieve automatic signal propagation value
+		/// \return the number of attached transformations the signal is propagated to. 0 indicates
+		///  the signal is only witnessed by this object
+		virtual int GetAutoSignalPropagation() const {return 0;}
+public:
+
+	///	\name RETRIEVAL OF ONE MESSAGE
+	//@{
+
+		/// \brief Provides the number of bytes ready for retrieval
+		/// \return the number of bytes ready for retrieval
+		/// \details The number of bytes available are dependent on the source. If an exact value is
+		///  available, then the exact value is returned. The exact value can include 0 if the source
+		///  is exhausted.
+		/// \details Some stream-based sources do not allow seeking() on the underlying stream, such
+		///  as some FileSource(). If the stream does not allow seeking() then MaxRetrievable()
+		///  returns LWORD_MAX to indicate there are still bytes to be retrieved.
+		virtual lword MaxRetrievable() const;
+
+		/// \brief Determines whether bytes are ready for retrieval
+		/// \return true if bytes are available for retrieval, false otherwise
+		virtual bool AnyRetrievable() const;
+
+		/// \brief Retrieve a 8-bit byte
+		/// \param outByte the 8-bit value to be retrieved
+		/// \return the number of bytes consumed during the call.
+		/// \details Use the return value of Get to detect short reads.
+		virtual size_t Get(byte &outByte);
+
+		/// \brief Retrieve a block of bytes
+		/// \param outString a block of bytes
+		/// \param getMax the number of bytes to Get
+		/// \return the number of bytes consumed during the call.
+		/// \details Use the return value of Get to detect short reads.
+		virtual size_t Get(byte *outString, size_t getMax);
+
+		/// \brief Peek a 8-bit byte
+		/// \param outByte the 8-bit value to be retrieved
+		/// \return the number of bytes read during the call.
+		/// \details Peek does not remove bytes from the object. Use the return value of
+		///  Get() to detect short reads.
+		virtual size_t Peek(byte &outByte) const;
+
+		/// \brief Peek a block of bytes
+		/// \param outString a block of bytes
+		/// \param peekMax the number of bytes to Peek
+		/// \return the number of bytes read during the call.
+		/// \details Peek does not remove bytes from the object. Use the return value of
+		///  Peek() to detect short reads.
+		virtual size_t Peek(byte *outString, size_t peekMax) const;
+
+		/// \brief Retrieve a 16-bit word
+		/// \param value the 16-bit value to be retrieved
+		/// \param order the ByteOrder of the value to be processed.
+		/// \return the number of bytes consumed during the call.
+		/// \details Use the return value of GetWord16() to detect short reads.
+		size_t GetWord16(word16 &value, ByteOrder order=BIG_ENDIAN_ORDER);
+
+		/// \brief Retrieve a 32-bit word
+		/// \param value the 32-bit value to be retrieved
+		/// \param order the ByteOrder of the value to be processed.
+		/// \return the number of bytes consumed during the call.
+		/// \details Use the return value of GetWord32() to detect short reads.
+		size_t GetWord32(word32 &value, ByteOrder order=BIG_ENDIAN_ORDER);
+
+		/// \brief Retrieve a 64-bit word
+		/// \param value the 64-bit value to be retrieved
+		/// \param order the ByteOrder of the value to be processed.
+		/// \return the number of bytes consumed during the call.
+		/// \details Use the return value of GetWord64() to detect short reads.
+		/// \since Crypto++ 8.3
+		size_t GetWord64(word64 &value, ByteOrder order=BIG_ENDIAN_ORDER);
+
+		/// \brief Peek a 16-bit word
+		/// \param value the 16-bit value to be retrieved
+		/// \param order the ByteOrder of the value to be processed.
+		/// \return the number of bytes consumed during the call.
+		/// \details Peek does not consume bytes in the stream. Use the return value
+		///  of PeekWord16() to detect short reads.
+		size_t PeekWord16(word16 &value, ByteOrder order=BIG_ENDIAN_ORDER) const;
+
+		/// \brief Peek a 32-bit word
+		/// \param value the 32-bit value to be retrieved
+		/// \param order the ByteOrder of the value to be processed.
+		/// \return the number of bytes consumed during the call.
+		/// \details Peek does not consume bytes in the stream. Use the return value
+		///  of PeekWord32() to detect short reads.
+		size_t PeekWord32(word32 &value, ByteOrder order=BIG_ENDIAN_ORDER) const;
+
+		/// \brief Peek a 64-bit word
+		/// \param value the 64-bit value to be retrieved
+		/// \param order the ByteOrder of the value to be processed.
+		/// \return the number of bytes consumed during the call.
+		/// \details Peek does not consume bytes in the stream. Use the return value
+		///  of PeekWord64() to detect short reads.
+		/// \since Crypto++ 8.3
+		size_t PeekWord64(word64 &value, ByteOrder order=BIG_ENDIAN_ORDER) const;
+
+		/// move transferMax bytes of the buffered output to target as input
+
+		/// \brief Transfer bytes from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param transferMax the number of bytes to transfer
+		/// \param channel the channel on which the transfer should occur
+		/// \return the number of bytes transferred during the call.
+		/// \details TransferTo removes bytes from this object and moves them to the destination.
+		/// \details The function always returns transferMax. If an accurate count is needed, then use TransferTo2().
+		lword TransferTo(BufferedTransformation &target, lword transferMax=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL)
+			{TransferTo2(target, transferMax, channel); return transferMax;}
+
+		/// \brief Discard skipMax bytes from the output buffer
+		/// \param skipMax the number of bytes to discard
+		/// \details Skip() discards bytes from the output buffer, which is the AttachedTransformation(), if present.
+		///  The function always returns the parameter <tt>skipMax</tt>.
+		/// \details If you want to skip bytes from a Source, then perform the following.
+		/// <pre>  StringSource ss(str, false, new Redirector(TheBitBucket()));
+		///   ss.Pump(10);    // Skip 10 bytes from Source
+		///   ss.Detach(new FilterChain(...));
+		///   ss.PumpAll();
+		/// </pre>
+		virtual lword Skip(lword skipMax=LWORD_MAX);
+
+		/// \brief Copy bytes from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param copyMax the number of bytes to copy
+		/// \param channel the channel on which the transfer should occur
+		/// \return the number of bytes copied during the call.
+		/// \details CopyTo copies bytes from this object to the destination. The bytes are not removed from this object.
+		/// \details The function always returns copyMax. If an accurate count is needed, then use CopyRangeTo2().
+		lword CopyTo(BufferedTransformation &target, lword copyMax=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL) const
+			{return CopyRangeTo(target, 0, copyMax, channel);}
+
+		/// \brief Copy bytes from this object using an index to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param position the 0-based index of the byte stream to begin the copying
+		/// \param copyMax the number of bytes to copy
+		/// \param channel the channel on which the transfer should occur
+		/// \return the number of bytes copied during the call.
+		/// \details CopyTo copies bytes from this object to the destination. The bytes remain in this
+		///  object. Copying begins at the index position in the current stream, and not from an absolute
+		///  position in the stream.
+		/// \details The function returns the new position in the stream after transferring the bytes starting at the index.
+		lword CopyRangeTo(BufferedTransformation &target, lword position, lword copyMax=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL) const
+			{lword i = position; CopyRangeTo2(target, i, i+copyMax, channel); return i-position;}
+	//@}
+
+	///	\name RETRIEVAL OF MULTIPLE MESSAGES
+	//@{
+
+		/// \brief Provides the number of bytes ready for retrieval
+		/// \return the number of bytes ready for retrieval
+		virtual lword TotalBytesRetrievable() const;
+
+		/// \brief Provides the number of meesages processed by this object
+		/// \return the number of meesages processed by this object
+		/// \details NumberOfMessages returns number of times MessageEnd() has been
+		///  received minus messages retrieved or skipped
+		virtual unsigned int NumberOfMessages() const;
+
+		/// \brief Determines if any messages are available for retrieval
+		/// \return true if <tt>NumberOfMessages() &gt; 0</tt>, false otherwise
+		/// \details AnyMessages returns true if <tt>NumberOfMessages() &gt; 0</tt>
+		virtual bool AnyMessages() const;
+
+		/// \brief Start retrieving the next message
+		/// \return true if a message is ready for retrieval
+		/// \details GetNextMessage() returns true if a message is ready for retrieval; false
+		///  if no more messages exist or this message is not completely retrieved.
+		virtual bool GetNextMessage();
+
+		/// \brief Skip a number of meessages
+		/// \param count number of messages to skip
+		/// \return 0 if the requested number of messages was skipped, non-0 otherwise
+		/// \details SkipMessages() skips count number of messages. If there is an AttachedTransformation()
+		///  then SkipMessages() is called on the attached transformation. If there is no attached
+		///  transformation, then count number of messages are sent to TheBitBucket() using TransferMessagesTo().
+		virtual unsigned int SkipMessages(unsigned int count=UINT_MAX);
+
+		/// \brief Transfer messages from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param count the number of messages to transfer
+		/// \param channel the channel on which the transfer should occur
+		/// \return the number of bytes that remain in the current transfer block (i.e., bytes not transferred)
+		/// \details TransferMessagesTo2() removes messages from this object and moves them to the destination.
+		///  If all bytes are not transferred for a message, then processing stops and the number of remaining
+		///  bytes is returned. TransferMessagesTo() does not proceed to the next message.
+		/// \details A return value of 0 indicates all messages were successfully transferred.
+		unsigned int TransferMessagesTo(BufferedTransformation &target, unsigned int count=UINT_MAX, const std::string &channel=DEFAULT_CHANNEL)
+			{TransferMessagesTo2(target, count, channel); return count;}
+
+		/// \brief Copy messages from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param count the number of messages to copy
+		/// \param channel the channel on which the copy should occur
+		/// \return the number of bytes that remain in the current transfer block (i.e., bytes not transferred)
+		/// \details CopyMessagesTo copies messages from this object to the destination.
+		///  If all bytes are not transferred for a message, then processing stops and the number of remaining
+		///  bytes is returned. CopyMessagesTo() does not proceed to the next message.
+		/// \details A return value of 0 indicates all messages were successfully copied.
+		unsigned int CopyMessagesTo(BufferedTransformation &target, unsigned int count=UINT_MAX, const std::string &channel=DEFAULT_CHANNEL) const;
+
+		/// \brief Skip all messages in the series
+		virtual void SkipAll();
+
+		/// \brief Transfer all bytes from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param channel the channel on which the transfer should occur
+		/// \details TransferMessagesTo2() removes messages from this object and moves them to the destination.
+		///  Internally TransferAllTo() calls TransferAllTo2().
+		void TransferAllTo(BufferedTransformation &target, const std::string &channel=DEFAULT_CHANNEL)
+			{TransferAllTo2(target, channel);}
+
+		/// \brief Copy messages from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param channel the channel on which the transfer should occur
+		/// \details CopyAllTo copies messages from this object and copies them to the destination.
+		void CopyAllTo(BufferedTransformation &target, const std::string &channel=DEFAULT_CHANNEL) const;
+
+		/// \brief Retrieve the next message in a series
+		/// \return true if a message was retrieved, false otherwise
+		/// \details Internally, the base class implementation returns false.
+		virtual bool GetNextMessageSeries() {return false;}
+		/// \brief Provides the number of messages in a series
+		/// \return the number of messages in this series
+		virtual unsigned int NumberOfMessagesInThisSeries() const {return NumberOfMessages();}
+		/// \brief Provides the number of messages in a series
+		/// \return the number of messages in this series
+		virtual unsigned int NumberOfMessageSeries() const {return 0;}
+	//@}
+
+	///	\name NON-BLOCKING TRANSFER OF OUTPUT
+	//@{
+
+		// upon return, byteCount contains number of bytes that have finished being transferred,
+		// and returns the number of bytes left in the current transfer block
+
+		/// \brief Transfer bytes from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param byteCount the number of bytes to transfer
+		/// \param channel the channel on which the transfer should occur
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain in the transfer block (i.e., bytes not transferred)
+		/// \details TransferTo2() removes bytes from this object and moves them to the destination.
+		///  Transfer begins at the index position in the current stream, and not from an absolute
+		///  position in the stream.
+		/// \details byteCount is an \a IN and \a OUT parameter. When the call is made,
+		///  byteCount is the requested size of the transfer. When the call returns, byteCount is
+		///  the number of bytes that were transferred.
+		virtual size_t TransferTo2(BufferedTransformation &target, lword &byteCount, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) =0;
+
+		// upon return, begin contains the start position of data yet to be finished copying,
+		// and returns the number of bytes left in the current transfer block
+
+		/// \brief Copy bytes from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param begin the 0-based index of the first byte to copy in the stream
+		/// \param end the 0-based index of the last byte to copy in the stream
+		/// \param channel the channel on which the transfer should occur
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain in the copy block (i.e., bytes not copied)
+		/// \details CopyRangeTo2 copies bytes from this object to the destination. The bytes are not
+		///  removed from this object. Copying begins at the index position in the current stream, and
+		///  not from an absolute position in the stream.
+		/// \details begin is an \a IN and \a OUT parameter. When the call is made, begin is the
+		///  starting position of the copy. When the call returns, begin is the position of the first
+		///  byte that was \a not copied (which may be different than end). begin can be used for
+		///  subsequent calls to CopyRangeTo2().
+		virtual size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const =0;
+
+		// upon return, messageCount contains number of messages that have finished being transferred,
+		// and returns the number of bytes left in the current transfer block
+
+		/// \brief Transfer messages from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param messageCount the number of messages to transfer
+		/// \param channel the channel on which the transfer should occur
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain in the current transfer block (i.e., bytes not transferred)
+		/// \details TransferMessagesTo2() removes messages from this object and moves them to the destination.
+		/// \details messageCount is an \a IN and \a OUT parameter. When the call is made, messageCount is the
+		///  the number of messages requested to be transferred. When the call returns, messageCount is the
+		///  number of messages actually transferred.
+		size_t TransferMessagesTo2(BufferedTransformation &target, unsigned int &messageCount, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+
+		// returns the number of bytes left in the current transfer block
+
+		/// \brief Transfer all bytes from this object to another BufferedTransformation
+		/// \param target the destination BufferedTransformation
+		/// \param channel the channel on which the transfer should occur
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain in the current transfer block (i.e., bytes not transferred)
+		/// \details TransferMessagesTo2() removes messages from this object and moves them to the destination.
+		size_t TransferAllTo2(BufferedTransformation &target, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+	//@}
+
+	///	\name CHANNELS
+	//@{
+		/// \brief Exception thrown when a filter does not support named channels
+		struct NoChannelSupport : public NotImplemented
+			{NoChannelSupport(const std::string &name) : NotImplemented(name + ": this object doesn't support multiple channels") {}};
+		/// \brief Exception thrown when a filter does not recognize a named channel
+		struct InvalidChannelName : public InvalidArgument
+			{InvalidChannelName(const std::string &name, const std::string &channel) : InvalidArgument(name + ": unexpected channel name \"" + channel + "\"") {}};
+
+		/// \brief Input a byte for processing on a channel
+		/// \param channel the channel to process the data.
+		/// \param inByte the 8-bit byte (octet) to be processed.
+		/// \param blocking specifies whether the object should block when processing input.
+		/// \return 0 indicates all bytes were processed during the call. Non-0 indicates the
+		///  number of bytes that were not processed.
+		size_t ChannelPut(const std::string &channel, byte inByte, bool blocking=true)
+			{return ChannelPut(channel, &inByte, 1, blocking);}
+
+		/// \brief Input a byte buffer for processing on a channel
+		/// \param channel the channel to process the data
+		/// \param inString the byte buffer to process
+		/// \param length the size of the string, in bytes
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return 0 indicates all bytes were processed during the call. Non-0 indicates the
+		///  number of bytes that were not processed.
+		size_t ChannelPut(const std::string &channel, const byte *inString, size_t length, bool blocking=true)
+			{return ChannelPut2(channel, inString, length, 0, blocking);}
+
+		/// \brief Input multiple bytes that may be modified by callee on a channel
+		/// \param channel the channel to process the data.
+		/// \param inString the byte buffer to process
+		/// \param length the size of the string, in bytes
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return 0 indicates all bytes were processed during the call. Non-0 indicates the
+		///  number of bytes that were not processed.
+		size_t ChannelPutModifiable(const std::string &channel, byte *inString, size_t length, bool blocking=true)
+			{return ChannelPutModifiable2(channel, inString, length, 0, blocking);}
+
+		/// \brief Input a 16-bit word for processing on a channel.
+		/// \param channel the channel to process the data.
+		/// \param value the 16-bit value to be processed.
+		/// \param order the ByteOrder of the value to be processed.
+		/// \param blocking specifies whether the object should block when processing input.
+		/// \return 0 indicates all bytes were processed during the call. Non-0 indicates the
+		///  number of bytes that were not processed.
+		size_t ChannelPutWord16(const std::string &channel, word16 value, ByteOrder order=BIG_ENDIAN_ORDER, bool blocking=true);
+
+		/// \brief Input a 32-bit word for processing on a channel.
+		/// \param channel the channel to process the data.
+		/// \param value the 32-bit value to be processed.
+		/// \param order the ByteOrder of the value to be processed.
+		/// \param blocking specifies whether the object should block when processing input.
+		/// \return 0 indicates all bytes were processed during the call. Non-0 indicates the
+		///  number of bytes that were not processed.
+		size_t ChannelPutWord32(const std::string &channel, word32 value, ByteOrder order=BIG_ENDIAN_ORDER, bool blocking=true);
+
+		/// \brief Input a 64-bit word for processing on a channel.
+		/// \param channel the channel to process the data.
+		/// \param value the 64-bit value to be processed.
+		/// \param order the ByteOrder of the value to be processed.
+		/// \param blocking specifies whether the object should block when processing input.
+		/// \return 0 indicates all bytes were processed during the call. Non-0 indicates the
+		///  number of bytes that were not processed.
+		size_t ChannelPutWord64(const std::string &channel, word64 value, ByteOrder order=BIG_ENDIAN_ORDER, bool blocking=true);
+
+		/// \brief Signal the end of a message
+		/// \param channel the channel to process the data.
+		/// \param propagation the number of attached transformations the ChannelMessageEnd() signal should be passed
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return 0 indicates all bytes were processed during the call. Non-0 indicates the
+		///  number of bytes that were not processed.
+		/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+		///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+		bool ChannelMessageEnd(const std::string &channel, int propagation=-1, bool blocking=true)
+			{return !!ChannelPut2(channel, NULLPTR, 0, propagation < 0 ? -1 : propagation+1, blocking);}
+
+		/// \brief Input multiple bytes for processing and signal the end of a message
+		/// \param channel the channel to process the data.
+		/// \param inString the byte buffer to process
+		/// \param length the size of the string, in bytes
+		/// \param propagation the number of attached transformations the ChannelPutMessageEnd() signal should be passed
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed)
+		/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+		///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+		size_t ChannelPutMessageEnd(const std::string &channel, const byte *inString, size_t length, int propagation=-1, bool blocking=true)
+			{return ChannelPut2(channel, inString, length, propagation < 0 ? -1 : propagation+1, blocking);}
+
+		/// \brief Request space which can be written into by the caller
+		/// \param channel the channel to process the data
+		/// \param size the requested size of the buffer
+		/// \return a pointer to a memory block with length size
+		/// \details The purpose of this method is to help avoid extra memory allocations.
+		/// \details size is an \a IN and \a OUT parameter and used as a hint. When the call is made,
+		///  size is the requested size of the buffer. When the call returns, size is the size of
+		///  the array returned to the caller.
+		/// \details The base class implementation sets size to 0 and returns NULL.
+		/// \note Some objects, like ArraySink(), cannot create a space because its fixed. In the case of
+		///  an ArraySink(), the pointer to the array is returned and the size is remaining size.
+		virtual byte * ChannelCreatePutSpace(const std::string &channel, size_t &size);
+
+		/// \brief Input multiple bytes for processing on a channel.
+		/// \param channel the channel to process the data.
+		/// \param inString the byte buffer to process.
+		/// \param length the size of the string, in bytes.
+		/// \param messageEnd means how many filters to signal MessageEnd() to, including this one.
+		/// \param blocking specifies whether the object should block when processing input.
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed)
+		virtual size_t ChannelPut2(const std::string &channel, const byte *inString, size_t length, int messageEnd, bool blocking);
+
+		/// \brief Input multiple bytes that may be modified by callee on a channel
+		/// \param channel the channel to process the data
+		/// \param inString the byte buffer to process
+		/// \param length the size of the string, in bytes
+		/// \param messageEnd means how many filters to signal MessageEnd() to, including this one
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return the number of bytes that remain to be processed (i.e., bytes not processed)
+		virtual size_t ChannelPutModifiable2(const std::string &channel, byte *inString, size_t length, int messageEnd, bool blocking);
+
+		/// \brief Flush buffered input and/or output on a channel
+		/// \param channel the channel to flush the data
+		/// \param hardFlush is used to indicate whether all data should be flushed
+		/// \param propagation the number of attached transformations the ChannelFlush() signal should be passed
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return true of the Flush was successful
+		/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+		///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+		virtual bool ChannelFlush(const std::string &channel, bool hardFlush, int propagation=-1, bool blocking=true);
+
+		/// \brief Marks the end of a series of messages on a channel
+		/// \param channel the channel to signal the end of a series of messages
+		/// \param propagation the number of attached transformations the ChannelMessageSeriesEnd() signal should be passed
+		/// \param blocking specifies whether the object should block when processing input
+		/// \return true if the message was successful, false otherwise
+		/// \details Each object that receives the signal will perform its processing, decrement
+		///  propagation, and then pass the signal on to attached transformations if the value is not 0.
+		/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+		///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+		/// \note There should be a MessageEnd() immediately before MessageSeriesEnd().
+		virtual bool ChannelMessageSeriesEnd(const std::string &channel, int propagation=-1, bool blocking=true);
+
+		/// \brief Sets the default retrieval channel
+		/// \param channel the channel to signal the end of a series of messages
+		/// \note this function may not be implemented in all objects that should support it.
+		virtual void SetRetrievalChannel(const std::string &channel);
+	//@}
+
+	///	\name ATTACHMENT
+	/// \details Some BufferedTransformation objects (e.g. Filter objects) allow other BufferedTransformation objects to be
+	///  attached. When this is done, the first object instead of buffering its output, sends that output to the attached
+	///  object as input. The entire attachment chain is deleted when the anchor object is destructed.
+
+	//@{
+		/// \brief Determines whether the object allows attachment
+		/// \return true if the object allows an attachment, false otherwise
+		/// \details Sources and Filters will returns true, while Sinks and other objects will return false.
+		virtual bool Attachable() {return false;}
+
+		/// \brief Returns the object immediately attached to this object
+		/// \return the attached transformation
+		/// \details AttachedTransformation() returns NULL if there is no attachment. The non-const
+		///  version of AttachedTransformation() always returns NULL.
+		virtual BufferedTransformation *AttachedTransformation() {CRYPTOPP_ASSERT(!Attachable()); return NULLPTR;}
+
+		/// \brief Returns the object immediately attached to this object
+		/// \return the attached transformation
+		/// \details AttachedTransformation() returns NULL if there is no attachment. The non-const
+		///  version of AttachedTransformation() always returns NULL.
+		virtual const BufferedTransformation *AttachedTransformation() const
+			{return const_cast<BufferedTransformation *>(this)->AttachedTransformation();}
+
+		/// \brief Delete the current attachment chain and attach a new one
+		/// \param newAttachment the new BufferedTransformation to attach
+		/// \throw NotImplemented
+		/// \details Detach() deletes the current attachment chain and replace it with an optional newAttachment
+		/// \details If a derived class does not override Detach(), then the base class throws
+		///  NotImplemented.
+		virtual void Detach(BufferedTransformation *newAttachment = NULLPTR) {
+			CRYPTOPP_UNUSED(newAttachment); CRYPTOPP_ASSERT(!Attachable());
+			throw NotImplemented("BufferedTransformation: this object is not attachable");
+		}
+
+		/// \brief Add newAttachment to the end of attachment chain
+		/// \param newAttachment the attachment to add to the end of the chain
+		virtual void Attach(BufferedTransformation *newAttachment);
+	//@}
+
+protected:
+	/// \brief Decrements the propagation count while clamping at 0
+	/// \return the decremented propagation or 0
+	static int DecrementPropagation(int propagation)
+		{return propagation != 0 ? propagation - 1 : 0;}
+
+private:
+	// for ChannelPutWord16, ChannelPutWord32 and ChannelPutWord64,
+	// to ensure the buffer isn't deallocated before non-blocking
+	// operation completes
+	byte m_buf[8];
+};
+
+/// \brief An input discarding BufferedTransformation
+/// \return a reference to a BufferedTransformation object that discards all input
+CRYPTOPP_DLL BufferedTransformation & TheBitBucket();
+
+/// \brief Interface for crypto material
+/// \details CryptoMaterial() is an interface for crypto material, such as
+///  public keys, private keys and crypto parameters. Derived classes generally
+///  do not offer public methods such as GenerateRandom() and
+///  GenerateRandomWithKeySize().
+/// \sa GeneratableCryptoMaterial()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CryptoMaterial : public NameValuePairs
+{
+public:
+	/// Exception thrown when invalid crypto material is detected
+	class CRYPTOPP_DLL InvalidMaterial : public InvalidDataFormat
+	{
+	public:
+		explicit InvalidMaterial(const std::string &s) : InvalidDataFormat(s) {}
+	};
+
+	virtual ~CryptoMaterial() {}
+
+	/// \brief Assign values to this object
+	/// \details This function can be used to create a public key from a private key.
+	virtual void AssignFrom(const NameValuePairs &source) =0;
+
+	/// \brief Check this object for errors
+	/// \param rng a RandomNumberGenerator for objects which use randomized testing
+	/// \param level the level of thoroughness
+	/// \return true if the tests succeed, false otherwise
+	/// \details There are four levels of thoroughness:
+	///   <ul>
+	///   <li>0 - using this object won't cause a crash or exception
+	///   <li>1 - this object will probably function, and encrypt, sign, other operations correctly
+	///   <li>2 - ensure this object will function correctly, and perform reasonable security checks
+	///   <li>3 - perform reasonable security checks, and do checks that may take a long time
+	///   </ul>
+	/// \details Level 0 does not require a RandomNumberGenerator. A NullRNG() can be used for level 0.
+	///  Level 1 may not check for weak keys and such. Levels 2 and 3 are recommended.
+	/// \sa ThrowIfInvalid()
+	virtual bool Validate(RandomNumberGenerator &rng, unsigned int level) const =0;
+
+	/// \brief Check this object for errors
+	/// \param rng a RandomNumberGenerator for objects which use randomized testing
+	/// \param level the level of thoroughness
+	/// \throw InvalidMaterial
+	/// \details Internally, ThrowIfInvalid() calls Validate() and throws InvalidMaterial() if validation fails.
+	/// \sa Validate()
+	virtual void ThrowIfInvalid(RandomNumberGenerator &rng, unsigned int level) const
+		{if (!Validate(rng, level)) throw InvalidMaterial("CryptoMaterial: this object contains invalid values");}
+
+	/// \brief Saves a key to a BufferedTransformation
+	/// \param bt the destination BufferedTransformation
+	/// \throw NotImplemented
+	/// \details Save() writes the material to a BufferedTransformation.
+	/// \details If the material is a key, then the key is written with ASN.1 DER encoding. The key
+	///  includes an object identifier with an algorithm id, like a subjectPublicKeyInfo.
+	/// \details A "raw" key without the "key info" can be saved using a key's DEREncode() method.
+	/// \details If a derived class does not override Save(), then the base class throws
+	///  NotImplemented().
+	virtual void Save(BufferedTransformation &bt) const
+		{CRYPTOPP_UNUSED(bt); throw NotImplemented("CryptoMaterial: this object does not support saving");}
+
+	/// \brief Loads a key from a BufferedTransformation
+	/// \param bt the source BufferedTransformation
+	/// \throw KeyingErr
+	/// \details Load() attempts to read material from a BufferedTransformation. If the
+	///  material is a key that was generated outside the library, then the following
+	///  usually applies:
+	///   <ul>
+	///   <li>the key should be ASN.1 BER encoded
+	///   <li>the key should be a "key info"
+	///   </ul>
+	/// \details "key info" means the key should have an object identifier with an algorithm id,
+	///  like a subjectPublicKeyInfo.
+	/// \details To read a "raw" key without the "key info", then call the key's BERDecode() method.
+	/// \note Load() generally does not check that the key is valid. Call Validate(), if needed.
+	virtual void Load(BufferedTransformation &bt)
+		{CRYPTOPP_UNUSED(bt); throw NotImplemented("CryptoMaterial: this object does not support loading");}
+
+	/// \brief Determines whether the object supports precomputation
+	/// \return true if the object supports precomputation, false otherwise
+	/// \sa Precompute()
+	virtual bool SupportsPrecomputation() const {return false;}
+
+	/// \brief Perform precomputation
+	/// \param precomputationStorage the suggested number of objects for the precompute table
+	/// \throw NotImplemented
+	/// \details The exact semantics of Precompute() varies, but it typically means calculate
+	///  a table of n objects that can be used later to speed up computation.
+	/// \details If a derived class does not override Precompute(), then the base class throws
+	///  NotImplemented.
+	/// \sa SupportsPrecomputation(), LoadPrecomputation(), SavePrecomputation()
+	virtual void Precompute(unsigned int precomputationStorage) {
+		CRYPTOPP_UNUSED(precomputationStorage); CRYPTOPP_ASSERT(!SupportsPrecomputation());
+		throw NotImplemented("CryptoMaterial: this object does not support precomputation");
+	}
+
+	/// \brief Retrieve previously saved precomputation
+	/// \param storedPrecomputation BufferedTransformation with the saved precomputation
+	/// \throw NotImplemented
+	/// \sa SupportsPrecomputation(), Precompute()
+	virtual void LoadPrecomputation(BufferedTransformation &storedPrecomputation)
+		{CRYPTOPP_UNUSED(storedPrecomputation); CRYPTOPP_ASSERT(!SupportsPrecomputation()); throw NotImplemented("CryptoMaterial: this object does not support precomputation");}
+
+	/// \brief Save precomputation for later use
+	/// \param storedPrecomputation BufferedTransformation to write the precomputation
+	/// \throw NotImplemented
+	/// \sa SupportsPrecomputation(), Precompute()
+	virtual void SavePrecomputation(BufferedTransformation &storedPrecomputation) const
+		{CRYPTOPP_UNUSED(storedPrecomputation); CRYPTOPP_ASSERT(!SupportsPrecomputation()); throw NotImplemented("CryptoMaterial: this object does not support precomputation");}
+
+	/// \brief Perform a quick sanity check
+	/// \details DoQuickSanityCheck() is for internal library use, and it should not be called by library users.
+	void DoQuickSanityCheck() const	{ThrowIfInvalid(NullRNG(), 0);}
+
+#if defined(__SUNPRO_CC)
+	// Sun Studio 11/CC 5.8 workaround: it generates incorrect code
+	// when casting to an empty virtual base class. JW, 2018: It is
+	// still a problem in Sun Studio 12.6/CC 5.15 on i386. Just enable
+	// it everywhere in case it affects SPARC (which we don't test).
+	char m_sunCCworkaround;
+#endif
+};
+
+/// \brief Interface for crypto material
+/// \details GeneratableCryptoMaterial() is an interface for crypto material,
+///  such as private keys and crypto parameters. Derived classes offer public
+///  methods such as GenerateRandom() and GenerateRandomWithKeySize().
+/// \sa CryptoMaterial()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE GeneratableCryptoMaterial : virtual public CryptoMaterial
+{
+public:
+	virtual ~GeneratableCryptoMaterial() {}
+
+	/// \brief Generate a random key or crypto parameters
+	/// \param rng a RandomNumberGenerator to produce keying material
+	/// \param params additional initialization parameters
+	/// \throw KeyingErr if a key can't be generated or algorithm parameters are invalid
+	/// \details If a derived class does not override GenerateRandom(), then the base class throws
+	///  NotImplemented.
+	virtual void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params = g_nullNameValuePairs) {
+		CRYPTOPP_UNUSED(rng); CRYPTOPP_UNUSED(params);
+		throw NotImplemented("GeneratableCryptoMaterial: this object does not support key/parameter generation");
+	}
+
+	/// \brief Generate a random key or crypto parameters
+	/// \param rng a RandomNumberGenerator to produce keying material
+	/// \param keySize the size of the key, in bits
+	/// \throw KeyingErr if a key can't be generated or algorithm parameters are invalid
+	/// \details GenerateRandomWithKeySize calls GenerateRandom() with a NameValuePairs
+	///  object with only "KeySize"
+	void GenerateRandomWithKeySize(RandomNumberGenerator &rng, unsigned int keySize);
+};
+
+/// \brief Interface for public keys
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PublicKey : virtual public CryptoMaterial
+{
+};
+
+/// \brief Interface for private keys
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PrivateKey : public GeneratableCryptoMaterial
+{
+};
+
+/// \brief Interface for crypto parameters
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CryptoParameters : public GeneratableCryptoMaterial
+{
+};
+
+/// \brief Interface for certificates
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Certificate : virtual public CryptoMaterial
+{
+};
+
+/// \brief Interface for asymmetric algorithms
+/// \details BERDecode() and DEREncode() were removed under Issue 569
+///  and Commit 9b174e84de7a. Programs should use <tt>AccessMaterial().Load(bt)</tt>
+///  or <tt>GetMaterial().Save(bt)</tt> instead.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/569">Issue 569</A>
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE AsymmetricAlgorithm : public Algorithm
+{
+public:
+	virtual ~AsymmetricAlgorithm() {}
+
+	/// \brief Retrieves a reference to CryptoMaterial
+	/// \return a reference to the crypto material
+	virtual CryptoMaterial & AccessMaterial() =0;
+
+	/// \brief Retrieves a reference to CryptoMaterial
+	/// \return a const reference to the crypto material
+	virtual const CryptoMaterial & GetMaterial() const =0;
+
+#if 0
+	/// \brief Loads this object from a BufferedTransformation
+	/// \param bt a BufferedTransformation object
+	/// \details Use of BERDecode() changed to Load() at Issue 569.
+	/// \deprecated for backwards compatibility, calls <tt>AccessMaterial().Load(bt)</tt>
+	void BERDecode(BufferedTransformation &bt)
+		{AccessMaterial().Load(bt);}
+
+	/// \brief Saves this object to a BufferedTransformation
+	/// \param bt a BufferedTransformation object
+	/// \details Use of DEREncode() changed to Save() at Issue 569.
+	/// \deprecated for backwards compatibility, calls GetMaterial().Save(bt)
+	void DEREncode(BufferedTransformation &bt) const
+		{GetMaterial().Save(bt);}
+#endif
+};
+
+/// \brief Interface for asymmetric algorithms using public keys
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PublicKeyAlgorithm : public AsymmetricAlgorithm
+{
+public:
+	virtual ~PublicKeyAlgorithm() {}
+
+	// VC60 workaround: no co-variant return type
+
+	/// \brief Retrieves a reference to a Public Key
+	/// \return a reference to the public key
+	CryptoMaterial & AccessMaterial()
+		{return AccessPublicKey();}
+	/// \brief Retrieves a reference to a Public Key
+	/// \return a const reference the public key
+	const CryptoMaterial & GetMaterial() const
+		{return GetPublicKey();}
+
+	/// \brief Retrieves a reference to a Public Key
+	/// \return a reference to the public key
+	virtual PublicKey & AccessPublicKey() =0;
+	/// \brief Retrieves a reference to a Public Key
+	/// \return a const reference the public key
+	virtual const PublicKey & GetPublicKey() const
+		{return const_cast<PublicKeyAlgorithm *>(this)->AccessPublicKey();}
+};
+
+/// \brief Interface for asymmetric algorithms using private keys
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PrivateKeyAlgorithm : public AsymmetricAlgorithm
+{
+public:
+	virtual ~PrivateKeyAlgorithm() {}
+
+	/// \brief Retrieves a reference to a Private Key
+	/// \return a reference the private key
+	CryptoMaterial & AccessMaterial() {return AccessPrivateKey();}
+	/// \brief Retrieves a reference to a Private Key
+	/// \return a const reference the private key
+	const CryptoMaterial & GetMaterial() const {return GetPrivateKey();}
+
+	/// \brief Retrieves a reference to a Private Key
+	/// \return a reference the private key
+	virtual PrivateKey & AccessPrivateKey() =0;
+	/// \brief Retrieves a reference to a Private Key
+	/// \return a const reference the private key
+	virtual const PrivateKey & GetPrivateKey() const {return const_cast<PrivateKeyAlgorithm *>(this)->AccessPrivateKey();}
+};
+
+/// \brief Interface for key agreement algorithms
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE KeyAgreementAlgorithm : public AsymmetricAlgorithm
+{
+public:
+	virtual ~KeyAgreementAlgorithm() {}
+
+	/// \brief Retrieves a reference to Crypto Parameters
+	/// \return a reference the crypto parameters
+	CryptoMaterial & AccessMaterial() {return AccessCryptoParameters();}
+	/// \brief Retrieves a reference to Crypto Parameters
+	/// \return a const reference the crypto parameters
+	const CryptoMaterial & GetMaterial() const {return GetCryptoParameters();}
+
+	/// \brief Retrieves a reference to Crypto Parameters
+	/// \return a reference the crypto parameters
+	virtual CryptoParameters & AccessCryptoParameters() =0;
+	/// \brief Retrieves a reference to Crypto Parameters
+	/// \return a const reference the crypto parameters
+	virtual const CryptoParameters & GetCryptoParameters() const {return const_cast<KeyAgreementAlgorithm *>(this)->AccessCryptoParameters();}
+};
+
+/// \brief Interface for public-key encryptors and decryptors
+/// \details This class provides an interface common to encryptors and decryptors
+///  for querying their plaintext and ciphertext lengths.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_CryptoSystem
+{
+public:
+	virtual ~PK_CryptoSystem() {}
+
+	/// \brief Provides the maximum length of plaintext for a given ciphertext length
+	/// \return the maximum size of the plaintext, in bytes
+	/// \details This function returns 0 if ciphertextLength is not valid (too long or too short).
+	virtual size_t MaxPlaintextLength(size_t ciphertextLength) const =0;
+
+	/// \brief Calculate the length of ciphertext given length of plaintext
+	/// \return the maximum size of the ciphertext, in bytes
+	/// \details This function returns 0 if plaintextLength is not valid (too long).
+	virtual size_t CiphertextLength(size_t plaintextLength) const =0;
+
+	/// \brief Determines whether this object supports the use of a named parameter
+	/// \param name the name of the parameter
+	/// \return true if the parameter name is supported, false otherwise
+	/// \details Some possible parameter names: EncodingParameters(), KeyDerivationParameters()
+	///  and others Parameters listed in argnames.h
+	virtual bool ParameterSupported(const char *name) const =0;
+
+	/// \brief Provides the fixed ciphertext length, if one exists
+	/// \return the fixed ciphertext length if one exists, otherwise 0
+	/// \details "Fixed" here means length of ciphertext does not depend on length of plaintext.
+	///  In this case, it usually does depend on the key length.
+	virtual size_t FixedCiphertextLength() const {return 0;}
+
+	/// \brief Provides the maximum plaintext length given a fixed ciphertext length
+	/// \return maximum plaintext length given the fixed ciphertext length, if one exists,
+	///  otherwise return 0.
+	/// \details FixedMaxPlaintextLength(0 returns the maximum plaintext length given the fixed ciphertext
+	///  length, if one exists, otherwise return 0.
+	virtual size_t FixedMaxPlaintextLength() const {return 0;}
+};
+
+/// \brief Interface for public-key encryptors
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_Encryptor : public PK_CryptoSystem, public PublicKeyAlgorithm
+{
+public:
+	/// \brief Exception thrown when trying to encrypt plaintext of invalid length
+	class CRYPTOPP_DLL InvalidPlaintextLength : public Exception
+	{
+	public:
+		InvalidPlaintextLength() : Exception(OTHER_ERROR, "PK_Encryptor: invalid plaintext length") {}
+	};
+
+	/// \brief Encrypt a byte string
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param plaintext the plaintext byte buffer
+	/// \param plaintextLength the size of the plaintext byte buffer
+	/// \param ciphertext a byte buffer to hold the encrypted string
+	/// \param parameters a set of NameValuePairs to initialize this object
+	/// \pre <tt>CiphertextLength(plaintextLength) != 0</tt> ensures the plaintext isn't too large
+	/// \pre <tt>COUNTOF(ciphertext) == CiphertextLength(plaintextLength)</tt> ensures the output
+	///  byte buffer is large enough.
+	/// \sa PK_Decryptor
+	virtual void Encrypt(RandomNumberGenerator &rng,
+		const byte *plaintext, size_t plaintextLength,
+		byte *ciphertext, const NameValuePairs &parameters = g_nullNameValuePairs) const =0;
+
+	/// \brief Create a new encryption filter
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param attachment an attached transformation
+	/// \param parameters a set of NameValuePairs to initialize this object
+	/// \details \p attachment can be \p NULL. The caller is responsible for deleting the returned pointer.
+	///  Encoding parameters should be passed in the "EP" channel.
+	virtual BufferedTransformation * CreateEncryptionFilter(RandomNumberGenerator &rng,
+		BufferedTransformation *attachment=NULLPTR, const NameValuePairs &parameters = g_nullNameValuePairs) const;
+};
+
+/// \brief Interface for public-key decryptors
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_Decryptor : public PK_CryptoSystem, public PrivateKeyAlgorithm
+{
+public:
+	virtual ~PK_Decryptor() {}
+
+	/// \brief Decrypt a byte string
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param ciphertext the encrypted byte buffer
+	/// \param ciphertextLength the size of the encrypted byte buffer
+	/// \param plaintext a byte buffer to hold the decrypted string
+	/// \param parameters a set of NameValuePairs to initialize this object
+	/// \return the result of the decryption operation
+	/// \details If DecodingResult::isValidCoding is true, then DecodingResult::messageLength
+	///  is valid and holds the actual length of the plaintext recovered. The result is undefined
+	///  if decryption failed. If DecodingResult::isValidCoding is false, then DecodingResult::messageLength
+	///  is undefined.
+	/// \pre <tt>COUNTOF(plaintext) == MaxPlaintextLength(ciphertextLength)</tt> ensures the output
+	///  byte buffer is large enough
+	/// \sa PK_Encryptor
+	virtual DecodingResult Decrypt(RandomNumberGenerator &rng,
+		const byte *ciphertext, size_t ciphertextLength,
+		byte *plaintext, const NameValuePairs &parameters = g_nullNameValuePairs) const =0;
+
+	/// \brief Create a new decryption filter
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param attachment an attached transformation
+	/// \param parameters a set of NameValuePairs to initialize this object
+	/// \return the newly created decryption filter
+	/// \note the caller is responsible for deleting the returned pointer
+	virtual BufferedTransformation * CreateDecryptionFilter(RandomNumberGenerator &rng,
+		BufferedTransformation *attachment=NULLPTR, const NameValuePairs &parameters = g_nullNameValuePairs) const;
+
+	/// \brief Decrypt a fixed size ciphertext
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param ciphertext the encrypted byte buffer
+	/// \param plaintext a byte buffer to hold the decrypted string
+	/// \param parameters a set of NameValuePairs to initialize this object
+	/// \return the result of the decryption operation
+	/// \details If DecodingResult::isValidCoding is true, then DecodingResult::messageLength
+	///  is valid and holds the actual length of the plaintext recovered. The result is undefined
+	///  if decryption failed. If DecodingResult::isValidCoding is false, then DecodingResult::messageLength
+	///  is undefined.
+	/// \pre <tt>COUNTOF(plaintext) == MaxPlaintextLength(ciphertextLength)</tt> ensures the output
+	///  byte buffer is large enough
+	/// \sa PK_Encryptor
+	DecodingResult FixedLengthDecrypt(RandomNumberGenerator &rng, const byte *ciphertext, byte *plaintext, const NameValuePairs &parameters = g_nullNameValuePairs) const
+		{return Decrypt(rng, ciphertext, FixedCiphertextLength(), plaintext, parameters);}
+};
+
+/// \brief Interface for public-key signers and verifiers
+/// \details This class provides an interface common to signers and verifiers for querying scheme properties
+/// \sa DL_SignatureSchemeBase, TF_SignatureSchemeBase, DL_SignerBase, TF_SignerBase
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_SignatureScheme
+{
+public:
+	/// \brief Exception throw when the private or public key has a length that can't be used
+	/// \details InvalidKeyLength() may be thrown by any function in this class if the private
+	///  or public key has a length that can't be used
+	class CRYPTOPP_DLL InvalidKeyLength : public Exception
+	{
+	public:
+		InvalidKeyLength(const std::string &message) : Exception(OTHER_ERROR, message) {}
+	};
+
+	/// \brief Exception throw when the private or public key is too short to sign or verify
+	/// \details KeyTooShort() may be thrown by any function in this class if the private or public
+	///  key is too short to sign or verify anything
+	class CRYPTOPP_DLL KeyTooShort : public InvalidKeyLength
+	{
+	public:
+		KeyTooShort() : InvalidKeyLength("PK_Signer: key too short for this signature scheme") {}
+	};
+
+	virtual ~PK_SignatureScheme() {}
+
+	/// \brief Provides the signature length if it only depends on the key
+	/// \return the signature length if it only depends on the key, in bytes
+	/// \details SignatureLength() returns the signature length if it only depends on the key, otherwise 0.
+	virtual size_t SignatureLength() const =0;
+
+	/// \brief Provides the maximum signature length produced given the length of the recoverable message part
+	/// \param recoverablePartLength the length of the recoverable message part, in bytes
+	/// \return the maximum signature length produced for a given length of recoverable message part, in bytes
+	/// \details MaxSignatureLength() returns the maximum signature length produced given the length of the
+	///  recoverable message part.
+	virtual size_t MaxSignatureLength(size_t recoverablePartLength = 0) const
+		{CRYPTOPP_UNUSED(recoverablePartLength); return SignatureLength();}
+
+	/// \brief Provides the length of longest message that can be recovered
+	/// \return the length of longest message that can be recovered, in bytes
+	/// \details MaxRecoverableLength() returns the length of longest message that can be recovered, or 0 if
+	///  this signature scheme does not support message recovery.
+	virtual size_t MaxRecoverableLength() const =0;
+
+	/// \brief Provides the length of longest message that can be recovered from a signature of given length
+	/// \param signatureLength the length of the signature, in bytes
+	/// \return the length of longest message that can be recovered from a signature of given length, in bytes
+	/// \details MaxRecoverableLengthFromSignatureLength() returns the length of longest message that can be
+	///  recovered from a signature of given length, or 0 if this signature scheme does not support message
+	///  recovery.
+	virtual size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const =0;
+
+	/// \brief Determines whether a signature scheme requires a random number generator
+	/// \return true if the signature scheme requires a RandomNumberGenerator() to sign
+	/// \details if IsProbabilistic() returns false, then NullRNG() can be passed to functions that take
+	///  RandomNumberGenerator().
+	virtual bool IsProbabilistic() const =0;
+
+	/// \brief Determines whether the non-recoverable message part can be signed
+	/// \return true if the non-recoverable message part can be signed
+	virtual bool AllowNonrecoverablePart() const =0;
+
+	/// \brief Determines whether the signature must be input before the message
+	/// \return true if the signature must be input before the message during verifcation
+	/// \details if SignatureUpfront() returns true, then you must input the signature before the message
+	///  during verification. Otherwise you can input the signature at anytime.
+	virtual bool SignatureUpfront() const {return false;}
+
+	/// \brief Determines whether the recoverable part must be input before the non-recoverable part
+	/// \return true if the recoverable part must be input before the non-recoverable part during signing
+	/// \details RecoverablePartFirst() determines whether you must input the recoverable part before the
+	///  non-recoverable part during signing
+	virtual bool RecoverablePartFirst() const =0;
+};
+
+/// \brief Interface for accumulating messages to be signed or verified
+/// \details Only Update() should be called from the PK_MessageAccumulator() class. No other functions
+///  inherited from HashTransformation, like DigestSize() and TruncatedFinal(), should be called.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_MessageAccumulator : public HashTransformation
+{
+public:
+	/// \warning DigestSize() should not be called on PK_MessageAccumulator
+	unsigned int DigestSize() const
+		{throw NotImplemented("PK_MessageAccumulator: DigestSize() should not be called");}
+
+	/// \warning TruncatedFinal() should not be called on PK_MessageAccumulator
+	void TruncatedFinal(byte *digest, size_t digestSize)
+	{
+		CRYPTOPP_UNUSED(digest); CRYPTOPP_UNUSED(digestSize);
+		throw NotImplemented("PK_MessageAccumulator: TruncatedFinal() should not be called");
+	}
+};
+
+/// \brief Interface for public-key signers
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_Signer : public PK_SignatureScheme, public PrivateKeyAlgorithm
+{
+public:
+	virtual ~PK_Signer() {}
+
+	/// \brief Create a new HashTransformation to accumulate the message to be signed
+	/// \param rng a RandomNumberGenerator derived class
+	/// \return a pointer to a PK_MessageAccumulator
+	/// \details NewSignatureAccumulator() can be used with all signing methods. Sign() will automatically delete the
+	///  accumulator pointer. The caller is responsible for deletion if a method is called that takes a reference.
+	virtual PK_MessageAccumulator * NewSignatureAccumulator(RandomNumberGenerator &rng) const =0;
+
+	/// \brief Input a recoverable message to an accumulator
+	/// \param messageAccumulator a reference to a PK_MessageAccumulator
+	/// \param recoverableMessage a pointer to the recoverable message part to be signed
+	/// \param recoverableMessageLength the size of the recoverable message part
+	virtual void InputRecoverableMessage(PK_MessageAccumulator &messageAccumulator, const byte *recoverableMessage, size_t recoverableMessageLength) const =0;
+
+	/// \brief Sign and delete the messageAccumulator
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param messageAccumulator a pointer to a PK_MessageAccumulator derived class
+	/// \param signature a block of bytes for the signature
+	/// \return actual signature length
+	/// \details Sign() deletes the messageAccumulator, even if an exception is thrown.
+	/// \pre <tt>COUNTOF(signature) == MaxSignatureLength()</tt>
+	virtual size_t Sign(RandomNumberGenerator &rng, PK_MessageAccumulator *messageAccumulator, byte *signature) const;
+
+	/// \brief Sign and restart messageAccumulator
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param messageAccumulator a pointer to a PK_MessageAccumulator derived class
+	/// \param signature a block of bytes for the signature
+	/// \param restart flag indicating whether the messageAccumulator should be restarted
+	/// \return actual signature length
+	/// \pre <tt>COUNTOF(signature) == MaxSignatureLength()</tt>
+	virtual size_t SignAndRestart(RandomNumberGenerator &rng, PK_MessageAccumulator &messageAccumulator, byte *signature, bool restart=true) const =0;
+
+	/// \brief Sign a message
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param message a pointer to the message
+	/// \param messageLen the size of the message to be signed
+	/// \param signature a block of bytes for the signature
+	/// \return actual signature length
+	/// \pre <tt>COUNTOF(signature) == MaxSignatureLength()</tt>
+	virtual size_t SignMessage(RandomNumberGenerator &rng, const byte *message, size_t messageLen, byte *signature) const;
+
+	/// \brief Sign a recoverable message
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param recoverableMessage a pointer to the recoverable message part to be signed
+	/// \param recoverableMessageLength the size of the recoverable message part
+	/// \param nonrecoverableMessage a pointer to the non-recoverable message part to be signed
+	/// \param nonrecoverableMessageLength the size of the non-recoverable message part
+	/// \param signature a block of bytes for the signature
+	/// \return actual signature length
+	/// \pre <tt>COUNTOF(signature) == MaxSignatureLength(recoverableMessageLength)</tt>
+	virtual size_t SignMessageWithRecovery(RandomNumberGenerator &rng, const byte *recoverableMessage, size_t recoverableMessageLength,
+		const byte *nonrecoverableMessage, size_t nonrecoverableMessageLength, byte *signature) const;
+};
+
+/// \brief Interface for public-key signature verifiers
+/// \details The Recover* functions throw NotImplemented if the signature scheme does not support
+///  message recovery.
+/// \details The Verify* functions throw InvalidDataFormat if the scheme does support message
+///  recovery and the signature contains a non-empty recoverable message part. The
+///  Recover* functions should be used in that case.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_Verifier : public PK_SignatureScheme, public PublicKeyAlgorithm
+{
+public:
+	virtual ~PK_Verifier() {}
+
+	/// \brief Create a new HashTransformation to accumulate the message to be verified
+	/// \return a pointer to a PK_MessageAccumulator
+	/// \details NewVerificationAccumulator() can be used with all verification methods. Verify() will automatically delete
+	///  the accumulator pointer. The caller is responsible for deletion if a method is called that takes a reference.
+	virtual PK_MessageAccumulator * NewVerificationAccumulator() const =0;
+
+	/// \brief Input signature into a message accumulator
+	/// \param messageAccumulator a pointer to a PK_MessageAccumulator derived class
+	/// \param signature the signature on the message
+	/// \param signatureLength the size of the signature
+	virtual void InputSignature(PK_MessageAccumulator &messageAccumulator, const byte *signature, size_t signatureLength) const =0;
+
+	/// \brief Check whether messageAccumulator contains a valid signature and message
+	/// \param messageAccumulator a pointer to a PK_MessageAccumulator derived class
+	/// \return true if the signature is valid, false otherwise
+	/// \details Verify() deletes the messageAccumulator, even if an exception is thrown.
+	virtual bool Verify(PK_MessageAccumulator *messageAccumulator) const;
+
+	/// \brief Check whether messageAccumulator contains a valid signature and message, and restart messageAccumulator
+	/// \param messageAccumulator a reference to a PK_MessageAccumulator derived class
+	/// \return true if the signature is valid, false otherwise
+	/// \details VerifyAndRestart() restarts the messageAccumulator
+	virtual bool VerifyAndRestart(PK_MessageAccumulator &messageAccumulator) const =0;
+
+	/// \brief Check whether input signature is a valid signature for input message
+	/// \param message a pointer to the message to be verified
+	/// \param messageLen the size of the message
+	/// \param signature a pointer to the signature over the message
+	/// \param signatureLen the size of the signature
+	/// \return true if the signature is valid, false otherwise
+	virtual bool VerifyMessage(const byte *message, size_t messageLen,
+		const byte *signature, size_t signatureLen) const;
+
+	/// \brief Recover a message from its signature
+	/// \param recoveredMessage a pointer to the recoverable message part to be verified
+	/// \param messageAccumulator a pointer to a PK_MessageAccumulator derived class
+	/// \return the result of the verification operation
+	/// \details Recover() deletes the messageAccumulator, even if an exception is thrown.
+	/// \pre <tt>COUNTOF(recoveredMessage) == MaxRecoverableLengthFromSignatureLength(signatureLength)</tt>
+	virtual DecodingResult Recover(byte *recoveredMessage, PK_MessageAccumulator *messageAccumulator) const;
+
+	/// \brief Recover a message from its signature
+	/// \param recoveredMessage a pointer to the recoverable message part to be verified
+	/// \param messageAccumulator a pointer to a PK_MessageAccumulator derived class
+	/// \return the result of the verification operation
+	/// \details RecoverAndRestart() restarts the messageAccumulator
+	/// \pre <tt>COUNTOF(recoveredMessage) == MaxRecoverableLengthFromSignatureLength(signatureLength)</tt>
+	virtual DecodingResult RecoverAndRestart(byte *recoveredMessage, PK_MessageAccumulator &messageAccumulator) const =0;
+
+	/// \brief Recover a message from its signature
+	/// \param recoveredMessage a pointer for the recovered message
+	/// \param nonrecoverableMessage a pointer to the non-recoverable message part to be signed
+	/// \param nonrecoverableMessageLength the size of the non-recoverable message part
+	/// \param signature the signature on the message
+	/// \param signatureLength the size of the signature
+	/// \return the result of the verification operation
+	/// \pre <tt>COUNTOF(recoveredMessage) == MaxRecoverableLengthFromSignatureLength(signatureLength)</tt>
+	virtual DecodingResult RecoverMessage(byte *recoveredMessage,
+		const byte *nonrecoverableMessage, size_t nonrecoverableMessageLength,
+		const byte *signature, size_t signatureLength) const;
+};
+
+/// \brief Interface for domains of simple key agreement protocols
+/// \details A key agreement domain is a set of parameters that must be shared
+///  by two parties in a key agreement protocol, along with the algorithms
+///  for generating key pairs and deriving agreed values.
+/// \since Crypto++ 3.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE SimpleKeyAgreementDomain : public KeyAgreementAlgorithm
+{
+public:
+	virtual ~SimpleKeyAgreementDomain() {}
+
+	/// \brief Provides the size of the agreed value
+	/// \return size of agreed value produced in this domain
+	virtual unsigned int AgreedValueLength() const =0;
+
+	/// \brief Provides the size of the private key
+	/// \return size of private keys in this domain
+	virtual unsigned int PrivateKeyLength() const =0;
+
+	/// \brief Provides the size of the public key
+	/// \return size of public keys in this domain
+	virtual unsigned int PublicKeyLength() const =0;
+
+	/// \brief Generate private key in this domain
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer for the generated private key in this domain
+	/// \pre <tt>COUNTOF(privateKey) == PrivateKeyLength()</tt>
+	virtual void GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const =0;
+
+	/// \brief Generate a public key from a private key in this domain
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer with the previously generated private key
+	/// \param publicKey a byte buffer for the generated public key in this domain
+	/// \pre <tt>COUNTOF(publicKey) == PublicKeyLength()</tt>
+	virtual void GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const =0;
+
+	/// \brief Generate a private/public key pair
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer for the generated private key in this domain
+	/// \param publicKey a byte buffer for the generated public key in this domain
+	/// \details GenerateKeyPair() is equivalent to calling GeneratePrivateKey() and then GeneratePublicKey().
+	/// \pre <tt>COUNTOF(privateKey) == PrivateKeyLength()</tt>
+	/// \pre <tt>COUNTOF(publicKey) == PublicKeyLength()</tt>
+	virtual void GenerateKeyPair(RandomNumberGenerator &rng, byte *privateKey, byte *publicKey) const;
+
+	/// \brief Derive agreed value
+	/// \param agreedValue a byte buffer for the shared secret
+	/// \param privateKey a byte buffer with your private key in this domain
+	/// \param otherPublicKey a byte buffer with the other party's public key in this domain
+	/// \param validateOtherPublicKey a flag indicating if the other party's public key should be validated
+	/// \return true upon success, false in case of failure
+	/// \details Agree() derives an agreed value from your private keys and couterparty's public keys.
+	/// \details The other party's public key is validated by default. If you have previously validated the
+	///  static public key, use <tt>validateStaticOtherPublicKey=false</tt> to save time.
+	/// \pre <tt>COUNTOF(agreedValue) == AgreedValueLength()</tt>
+	/// \pre <tt>COUNTOF(privateKey) == PrivateKeyLength()</tt>
+	/// \pre <tt>COUNTOF(otherPublicKey) == PublicKeyLength()</tt>
+	virtual bool Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey=true) const =0;
+};
+
+/// \brief Interface for domains of authenticated key agreement protocols
+/// \details In an authenticated key agreement protocol, each party has two
+///  key pairs. The long-lived key pair is called the static key pair,
+///  and the short-lived key pair is called the ephemeral key pair.
+/// \since Crypto++ 3.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE AuthenticatedKeyAgreementDomain : public KeyAgreementAlgorithm
+{
+public:
+	virtual ~AuthenticatedKeyAgreementDomain() {}
+
+	/// \brief Provides the size of the agreed value
+	/// \return size of agreed value produced in this domain
+	virtual unsigned int AgreedValueLength() const =0;
+
+	/// \brief Provides the size of the static private key
+	/// \return size of static private keys in this domain
+	virtual unsigned int StaticPrivateKeyLength() const =0;
+
+	/// \brief Provides the size of the static public key
+	/// \return size of static public keys in this domain
+	virtual unsigned int StaticPublicKeyLength() const =0;
+
+	/// \brief Generate static private key in this domain
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer for the generated private key in this domain
+	/// \pre <tt>COUNTOF(privateKey) == PrivateStaticKeyLength()</tt>
+	virtual void GenerateStaticPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const =0;
+
+	/// \brief Generate a static public key from a private key in this domain
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer with the previously generated private key
+	/// \param publicKey a byte buffer for the generated public key in this domain
+	/// \pre <tt>COUNTOF(publicKey) == PublicStaticKeyLength()</tt>
+	virtual void GenerateStaticPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const =0;
+
+	/// \brief Generate a static private/public key pair
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer for the generated private key in this domain
+	/// \param publicKey a byte buffer for the generated public key in this domain
+	/// \details GenerateStaticKeyPair() is equivalent to calling GenerateStaticPrivateKey() and then GenerateStaticPublicKey().
+	/// \pre <tt>COUNTOF(privateKey) == PrivateStaticKeyLength()</tt>
+	/// \pre <tt>COUNTOF(publicKey) == PublicStaticKeyLength()</tt>
+	virtual void GenerateStaticKeyPair(RandomNumberGenerator &rng, byte *privateKey, byte *publicKey) const;
+
+	/// \brief Provides the size of ephemeral private key
+	/// \return the size of ephemeral private key in this domain
+	virtual unsigned int EphemeralPrivateKeyLength() const =0;
+
+	/// \brief Provides the size of ephemeral public key
+	/// \return the size of ephemeral public key in this domain
+	virtual unsigned int EphemeralPublicKeyLength() const =0;
+
+	/// \brief Generate ephemeral private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer for the generated private key in this domain
+	/// \pre <tt>COUNTOF(privateKey) == PrivateEphemeralKeyLength()</tt>
+	virtual void GenerateEphemeralPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const =0;
+
+	/// \brief Generate ephemeral public key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer for the generated private key in this domain
+	/// \param publicKey a byte buffer for the generated public key in this domain
+	/// \pre <tt>COUNTOF(publicKey) == PublicEphemeralKeyLength()</tt>
+	virtual void GenerateEphemeralPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const =0;
+
+	/// \brief Generate private/public key pair
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer for the generated private key in this domain
+	/// \param publicKey a byte buffer for the generated public key in this domain
+	/// \details GenerateEphemeralKeyPair() is equivalent to calling GenerateEphemeralPrivateKey() and then GenerateEphemeralPublicKey()
+	virtual void GenerateEphemeralKeyPair(RandomNumberGenerator &rng, byte *privateKey, byte *publicKey) const;
+
+	/// \brief Derive agreed value
+	/// \param agreedValue a byte buffer for the shared secret
+	/// \param staticPrivateKey a byte buffer with your static private key in this domain
+	/// \param ephemeralPrivateKey a byte buffer with your ephemeral private key in this domain
+	/// \param staticOtherPublicKey a byte buffer with the other party's static public key in this domain
+	/// \param ephemeralOtherPublicKey a byte buffer with the other party's ephemeral public key in this domain
+	/// \param validateStaticOtherPublicKey a flag indicating if the other party's public key should be validated
+	/// \return true upon success, false in case of failure
+	/// \details Agree() derives an agreed value from your private keys and couterparty's public keys.
+	/// \details The other party's ephemeral public key is validated by default. If you have previously validated
+	///  the static public key, use <tt>validateStaticOtherPublicKey=false</tt> to save time.
+	/// \pre <tt>COUNTOF(agreedValue) == AgreedValueLength()</tt>
+	/// \pre <tt>COUNTOF(staticPrivateKey) == StaticPrivateKeyLength()</tt>
+	/// \pre <tt>COUNTOF(ephemeralPrivateKey) == EphemeralPrivateKeyLength()</tt>
+	/// \pre <tt>COUNTOF(staticOtherPublicKey) == StaticPublicKeyLength()</tt>
+	/// \pre <tt>COUNTOF(ephemeralOtherPublicKey) == EphemeralPublicKeyLength()</tt>
+	virtual bool Agree(byte *agreedValue,
+		const byte *staticPrivateKey, const byte *ephemeralPrivateKey,
+		const byte *staticOtherPublicKey, const byte *ephemeralOtherPublicKey,
+		bool validateStaticOtherPublicKey=true) const =0;
+};
+
+// interface for password authenticated key agreement protocols, not implemented yet
+#if 0
+/// \brief Interface for protocol sessions
+/*! The methods should be called in the following order:
+
+	InitializeSession(rng, parameters);	// or call initialize method in derived class
+	while (true)
+	{
+		if (OutgoingMessageAvailable())
+		{
+			length = GetOutgoingMessageLength();
+			GetOutgoingMessage(message);
+			; // send outgoing message
+		}
+
+		if (LastMessageProcessed())
+			break;
+
+		; // receive incoming message
+		ProcessIncomingMessage(message);
+	}
+	; // call methods in derived class to obtain result of protocol session
+*/
+class ProtocolSession
+{
+public:
+	/// Exception thrown when an invalid protocol message is processed
+	class ProtocolError : public Exception
+	{
+	public:
+		ProtocolError(ErrorType errorType, const std::string &s) : Exception(errorType, s) {}
+	};
+
+	/// Exception thrown when a function is called unexpectedly
+	/*! for example calling ProcessIncomingMessage() when ProcessedLastMessage() == true */
+	class UnexpectedMethodCall : public Exception
+	{
+	public:
+		UnexpectedMethodCall(const std::string &s) : Exception(OTHER_ERROR, s) {}
+	};
+
+	virtual ~ProtocolSession() {}
+
+	ProtocolSession() : m_rng(NULLPTR), m_throwOnProtocolError(true), m_validState(false) {}
+
+	virtual void InitializeSession(RandomNumberGenerator &rng, const NameValuePairs &parameters) =0;
+
+	bool GetThrowOnProtocolError() const {return m_throwOnProtocolError;}
+	void SetThrowOnProtocolError(bool throwOnProtocolError) {m_throwOnProtocolError = throwOnProtocolError;}
+
+	bool HasValidState() const {return m_validState;}
+
+	virtual bool OutgoingMessageAvailable() const =0;
+	virtual unsigned int GetOutgoingMessageLength() const =0;
+	virtual void GetOutgoingMessage(byte *message) =0;
+
+	virtual bool LastMessageProcessed() const =0;
+	virtual void ProcessIncomingMessage(const byte *message, unsigned int messageLength) =0;
+
+protected:
+	void HandleProtocolError(Exception::ErrorType errorType, const std::string &s) const;
+	void CheckAndHandleInvalidState() const;
+	void SetValidState(bool valid) {m_validState = valid;}
+
+	RandomNumberGenerator *m_rng;
+
+private:
+	bool m_throwOnProtocolError, m_validState;
+};
+
+class KeyAgreementSession : public ProtocolSession
+{
+public:
+	virtual ~KeyAgreementSession() {}
+
+	virtual unsigned int GetAgreedValueLength() const =0;
+	virtual void GetAgreedValue(byte *agreedValue) const =0;
+};
+
+class PasswordAuthenticatedKeyAgreementSession : public KeyAgreementSession
+{
+public:
+	virtual ~PasswordAuthenticatedKeyAgreementSession() {}
+
+	void InitializePasswordAuthenticatedKeyAgreementSession(RandomNumberGenerator &rng,
+		const byte *myId, unsigned int myIdLength,
+		const byte *counterPartyId, unsigned int counterPartyIdLength,
+		const byte *passwordOrVerifier, unsigned int passwordOrVerifierLength);
+};
+
+/// \brief Password based key agreement domain
+/// \since Crypto++ 3.0
+class PasswordAuthenticatedKeyAgreementDomain : public KeyAgreementAlgorithm
+{
+public:
+	virtual ~PasswordAuthenticatedKeyAgreementDomain() {}
+
+	/// return whether the domain parameters stored in this object are valid
+	virtual bool ValidateDomainParameters(RandomNumberGenerator &rng) const
+		{return GetCryptoParameters().Validate(rng, 2);}
+
+	virtual unsigned int GetPasswordVerifierLength(const byte *password, unsigned int passwordLength) const =0;
+	virtual void GeneratePasswordVerifier(RandomNumberGenerator &rng, const byte *userId, unsigned int userIdLength, const byte *password, unsigned int passwordLength, byte *verifier) const =0;
+
+	enum RoleFlags {CLIENT=1, SERVER=2, INITIATOR=4, RESPONDER=8};
+
+	virtual bool IsValidRole(unsigned int role) =0;
+	virtual PasswordAuthenticatedKeyAgreementSession * CreateProtocolSession(unsigned int role) const =0;
+};
+#endif
+
+/// \brief Exception thrown when an ASN.1 BER decoing error is encountered
+class CRYPTOPP_DLL BERDecodeErr : public InvalidArgument
+{
+public:
+	BERDecodeErr() : InvalidArgument("BER decode error") {}
+	BERDecodeErr(const std::string &s) : InvalidArgument(s) {}
+};
+
+/// \brief Interface for encoding and decoding ASN1 objects
+/// \details Each class that derives from ASN1Object should provide a serialization format
+///  that controls subobject layout. Most of the time the serialization format is
+///  taken from a standard, like P1363 or an RFC.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE ASN1Object
+{
+public:
+	virtual ~ASN1Object() {}
+
+	/// \brief Decode this object from a BufferedTransformation
+	/// \param bt BufferedTransformation object
+	/// \details Uses Basic Encoding Rules (BER)
+	virtual void BERDecode(BufferedTransformation &bt) =0;
+
+	/// \brief Encode this object into a BufferedTransformation
+	/// \param bt BufferedTransformation object
+	/// \details Uses Distinguished Encoding Rules (DER)
+	virtual void DEREncode(BufferedTransformation &bt) const =0;
+
+	/// \brief Encode this object into a BufferedTransformation
+	/// \param bt BufferedTransformation object
+	/// \details Uses Basic Encoding Rules (BER).
+	/// \details This may be useful if DEREncode() would be too inefficient.
+	virtual void BEREncode(BufferedTransformation &bt) const {DEREncode(bt);}
+};
+
+/// \brief Specifies the build-time version of the library
+/// \return integer representing the build-time version
+/// \details LibraryVersion can help detect inadvertent mixing and matching of library
+///  versions. When using Crypto++ distributed by a third party, LibraryVersion()
+///  records the version of the shared object that was built by the third party.
+///  The LibraryVersion() record resides in <tt>cryptlib.o</tt> on Unix compatibles
+///  and <tt>cryptlib.obj</tt> on Windows. It does not change when an app links
+///  to the library.
+/// \details LibraryVersion() is declared with C linkage (<tt>extern "C"</tt>) within the
+///  CryptoPP namespace to help programs locate the symbol. If the symbol is present, then
+///  the library version is 5.7 or above. If it is missing, then the library version is
+///  5.6.5 or below.
+/// \details The function could be used as shown below.
+/// <pre>  if (LibraryVersion() != HeaderVersion())
+///   {
+///      cout << "Potential version mismatch" << endl;
+///
+///      const int lmaj = (LibraryVersion() / 100U) % 10;
+///      const int lmin = (LibraryVersion() / 10U) % 10;
+///      const int hmaj = (HeaderVersion() / 100U) % 10;
+///      const int hmin = (HeaderVersion() / 10U) % 10;
+///
+///      if(lmaj != hmaj)
+///         cout << "Major version mismatch" << endl;
+///      else if(lmin != hmin)
+///         cout << "Minor version mismatch" << endl;
+///   }
+/// </pre>
+/// \sa HeaderVersion(), <A HREF="http://github.com/weidai11/cryptopp/issues/371">GitHub Issue 371</A>.
+/// \since Crypto++ 6.0
+extern "C" {
+	int LibraryVersion(CRYPTOPP_NOINLINE_DOTDOTDOT);
+} // C linkage
+
+/// \brief Specifies the runtime version of the library
+/// \return integer representing the runtime version
+/// \details HeaderVersion() can help detect inadvertent mixing and matching of library
+///  versions. When using Crypto++ distributed by a third party, HeaderVersion()
+///  records the version of the headers used by the app when the app is compiled.
+/// \details HeaderVersion() is declared with C linkage (<tt>extern "C"</tt>) within the
+///  CryptoPP namespace to help programs locate the symbol. If the symbol is present, then
+///  the library version is 5.7 or above. If it is missing, then the library version is
+///  5.6.5 or below.
+/// \details The function could be used as shown below.
+/// <pre>  if (LibraryVersion() != HeaderVersion())
+///   {
+///      cout << "Potential version mismatch" << endl;
+///
+///      const int lmaj = (LibraryVersion() / 100U) % 10;
+///      const int lmin = (LibraryVersion() / 10U) % 10;
+///      const int hmaj = (HeaderVersion() / 100U) % 10;
+///      const int hmin = (HeaderVersion() / 10U) % 10;
+///
+///      if(lmaj != hmaj)
+///         cout << "Major version mismatch" << endl;
+///      else if(lmin != hmin)
+///         cout << "Minor version mismatch" << endl;
+///   }
+/// </pre>
+/// \sa LibraryVersion(), <A HREF="http://github.com/weidai11/cryptopp/issues/371">GitHub Issue 371</A>.
+/// \since Crypto++ 6.0
+extern "C" {
+inline int HeaderVersion()
+{
+	return CRYPTOPP_VERSION;
+}
+} // C linkage
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/darn.cpp b/runtime/third_party/cryptopp/darn.cpp
new file mode 100644
index 0000000..d1ab676
--- /dev/null
+++ b/runtime/third_party/cryptopp/darn.cpp
@@ -0,0 +1,236 @@
+// darn.cpp - written and placed in public domain by Jeffrey Walton
+
+#include "pch.h"
+#include "config.h"
+#include "cryptlib.h"
+#include "secblock.h"
+#include "darn.h"
+#include "cpu.h"
+
+// At the moment only GCC 7.0 (and above) seems to support __builtin_darn()
+// and __builtin_darn_32(). Clang 7.0 does not provide them, but it does
+// support assembly instructions. XLC is unknown, but there are no hits when
+// searching IBM's site. To cover more platforms we provide GCC inline
+// assembly like we do with RDRAND and RDSEED. Platforms that don't support
+// GCC inline assembly or the builtin will fail the compile.
+
+// Inline assembler available in GCC 3.2 or above. For practical
+// purposes we check for GCC 4.0 or above. GCC impostors claim
+// to be GCC 4.2.1 so it will capture them, too. We exclude the
+// Apple machines because they are not Power9 and use a slightly
+// different syntax in their assembler.
+#if ((__GNUC__ >= 4) || defined(__IBM_GCC_ASM)) && !defined(__APPLE__)
+# define GCC_DARN_ASM_AVAILABLE 1
+#endif
+
+// warning C4702: unreachable code
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4702)
+#endif
+
+/////////////////////////////////////////////////////////////////////
+/////////////////////////////////////////////////////////////////////
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+
+// *************************** 32-bit *************************** //
+
+#if (CRYPTOPP_BOOL_PPC32)
+
+// Fills 4 bytes, buffer must be aligned
+inline void DARN32(void* output)
+{
+    CRYPTOPP_ASSERT(IsAlignedOn(output, GetAlignmentOf<word32>()));
+    word32* ptr = reinterpret_cast<word32*>(output);
+
+#if defined(GCC_DARN_ASM_AVAILABLE)
+    // This is "darn r3, 0". When L=0 a 32-bit conditioned word
+    // is returned. On failure 0xffffffffffffffff is returned.
+    // The Power manual recommends only checking the low 32-bit
+    // word for this case. See Power ISA 3.0 specification, p. 78.
+    do
+    {
+        __asm__ __volatile__ (
+            #if (CRYPTOPP_BIG_ENDIAN)
+            ".byte 0x7c, 0x60, 0x05, 0xe6  \n\t"  // r3 = darn 3, 0
+            "mr %0, 3                      \n\t"  // val = r3
+            #else
+            ".byte 0xe6, 0x05, 0x60, 0x7c  \n\t"  // r3 = darn 3, 0
+            "mr %0, 3                      \n\t"  // val = r3
+            #endif
+            : "=r" (*ptr) : : "r3"
+        );
+    } while (*ptr == 0xFFFFFFFFu);
+#elif defined(_ARCH_PWR9)
+    // This is probably going to break some platforms.
+    // We will deal with them as we encounter them.
+    *ptr = __builtin_darn_32();
+#elif defined(__APPLE__)
+    // Nop. Apple G4 and G5 machines are too old. They will
+    // avoid this code path because HasPower9() returns false.
+    CRYPTOPP_ASSERT(0);
+#else
+    // Catch other compile breaks
+    int XXX[-1];
+#endif
+}
+#endif  // PPC32
+
+// *************************** 64-bit *************************** //
+
+#if (CRYPTOPP_BOOL_PPC64)
+
+// Fills 8 bytes, buffer must be aligned
+inline void DARN64(void* output)
+{
+    CRYPTOPP_ASSERT(IsAlignedOn(output, GetAlignmentOf<word64>()));
+    word64* ptr = reinterpret_cast<word64*>(output);
+
+#if defined(GCC_DARN_ASM_AVAILABLE)
+    // This is "darn r3, 1". When L=1 a 64-bit conditioned word
+    // is returned. On failure 0xffffffffffffffff is returned.
+    // See Power ISA 3.0 specification, p. 78.
+    do
+    {
+        __asm__ __volatile__ (
+            #if (CRYPTOPP_BIG_ENDIAN)
+            ".byte 0x7c, 0x61, 0x05, 0xe6  \n\t"  // r3 = darn 3, 1
+            "mr %0, 3                      \n\t"  // val = r3
+            #else
+            ".byte 0xe6, 0x05, 0x61, 0x7c  \n\t"  // r3 = darn 3, 1
+            "mr %0, 3                      \n\t"  // val = r3
+            #endif
+            : "=r" (*ptr) : : "r3"
+        );
+    } while (*ptr == 0xFFFFFFFFFFFFFFFFull);
+#elif defined(_ARCH_PWR9)
+    // This is probably going to break some platforms.
+    // We will deal with them as we encounter them.
+    *ptr = __builtin_darn();
+#elif defined(__APPLE__)
+    // Nop. Apple G4 and G5 machines are too old. They will
+    // avoid this code path because HasPower9() returns false.
+    CRYPTOPP_ASSERT(0);
+#else
+    // Catch other compile breaks
+    int XXX[-1];
+#endif
+}
+#endif  // PPC64
+
+// ************************ Standard C++ ************************ //
+
+DARN::DARN()
+{
+    if (!HasDARN())
+        throw DARN_Err("HasDARN");
+
+    // Scratch buffer in case user buffers are unaligned.
+    m_temp.New(8);
+}
+
+void DARN::GenerateBlock(byte *output, size_t size)
+{
+    CRYPTOPP_ASSERT((output && size) || !(output || size));
+    if (size == 0) return;
+    size_t i = 0;
+
+#if (CRYPTOPP_BOOL_PPC64)
+
+    // Check alignment
+    i = reinterpret_cast<uintptr_t>(output) & 0x7;
+    if (i != 0)
+    {
+        DARN64(m_temp);
+        std::memcpy(output, m_temp, i);
+
+        output += i;
+        size -= i;
+    }
+
+    // Output is aligned
+    for (i = 0; i < size/8; i++)
+        DARN64(output+i*8);
+
+    output += i*8;
+    size -= i*8;
+
+    if (size)
+    {
+        DARN64(m_temp);
+        std::memcpy(output, m_temp, size);
+    }
+
+#elif (CRYPTOPP_BOOL_PPC32)
+
+    // Check alignment
+    i = reinterpret_cast<uintptr_t>(output) & 0x3;
+    if (i != 0)
+    {
+        DARN32(m_temp);
+        std::memcpy(output, m_temp, i);
+
+        output += i;
+        size -= i;
+    }
+
+    // Output is aligned
+    for (i = 0; i < size/4; i++)
+        DARN32(output+i*4);
+
+    output += i*4;
+    size -= i*4;
+
+    if (size)
+    {
+        DARN32(m_temp);
+        std::memcpy(output, m_temp, size);
+    }
+
+#else
+    // No suitable compiler found
+    CRYPTOPP_UNUSED(output);
+    throw NotImplemented("DARN: failed to find a suitable implementation");
+#endif
+}
+
+void DARN::DiscardBytes(size_t n)
+{
+    // RoundUpToMultipleOf is used because a full word is read, and its cheaper
+    //   to discard full words. There's no sense in dealing with tail bytes.
+    FixedSizeSecBlock<word64, 16> discard;
+    n = RoundUpToMultipleOf(n, sizeof(word64));
+
+    size_t count = STDMIN(n, discard.SizeInBytes());
+    while (count)
+    {
+        GenerateBlock(discard.BytePtr(), count);
+        n -= count;
+        count = STDMIN(n, discard.SizeInBytes());
+    }
+}
+
+#else  // not PPC32 or PPC64
+
+DARN::DARN()
+{
+    throw DARN_Err("HasDARN");
+}
+
+void DARN::GenerateBlock(byte *output, size_t size)
+{
+    // Constructor will throw, should not get here
+    CRYPTOPP_UNUSED(output); CRYPTOPP_UNUSED(size);
+}
+
+void DARN::DiscardBytes(size_t n)
+{
+    // Constructor will throw, should not get here
+    CRYPTOPP_UNUSED(n);
+}
+
+#endif  // PPC32 or PPC64
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/darn.h b/runtime/third_party/cryptopp/darn.h
new file mode 100644
index 0000000..41062b3
--- /dev/null
+++ b/runtime/third_party/cryptopp/darn.h
@@ -0,0 +1,95 @@
+// darn.h - written and placed in public domain by Jeffrey Walton
+//          DARN requires POWER9/ISA 3.0.
+
+// At the moment only GCC 7.0 (and above) seems to support __builtin_darn()
+// and __builtin_darn_32(). However, GCC generates incorrect code. Clang 7.0
+// does not provide them, but it does support assembly instructions. XLC is
+// unknown, but there are no hits when searching IBM's site. To cover more
+// platforms we provide GCC inline assembly like we do with RDRAND and RDSEED.
+// Platforms that don't support GCC inline assembly or the builtin will fail
+// to compile. Also see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481 and
+// https://gcc.gnu.org/onlinedocs/gcc/Basic-PowerPC-Built-in-Functions-Available-on-ISA-3_002e0.html
+
+/// \file darn.h
+/// \brief Classes for DARN RNG
+/// \sa <A HREF="https://openpowerfoundation.org/?resource_lib=power-isa-version-3-0">Power
+///   ISA Version 3.0B</A>
+/// \since Crypto++ 8.0
+
+#ifndef CRYPTOPP_DARN_H
+#define CRYPTOPP_DARN_H
+
+#include "cryptlib.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Exception thrown when a DARN generator encounters
+///    a generator related error.
+/// \since Crypto++ 8.0
+class DARN_Err : public Exception
+{
+public:
+    DARN_Err(const std::string &operation)
+        : Exception(OTHER_ERROR, "DARN: " + operation + " operation failed") {}
+};
+
+/// \brief Hardware generated random numbers using DARN instruction
+/// \details DARN() provides access to Power9's random number generator. The
+///   Crypto++ implementation provides conditioned random numbers from the
+///   generator as opposed to raw random numbers. According to Power ISA 3.0B
+///   manual, a conditioned random number has been processed by hardware to
+///   reduce bias. A raw random number is unconditioned noise source output.
+/// \details According to Power ISA 3.0B manual, the random number generator
+///   provided by the <tt>darn</tt> instruction is NIST SP800-90B and SP800-90C
+///   compliant to the extent possible given the completeness of the standards
+///   at the time the hardware is designed. The random number generator provides
+///   a minimum of 0.5 bits of entropy per bit.
+/// \par Wraps
+///   darn instruction
+/// \sa <A HREF="https://openpowerfoundation.org/?resource_lib=power-isa-version-3-0">Power
+///   ISA Version 3.0B</A>, MaurerRandomnessTest() for random bit generators
+/// \since Crypto++ 8.0
+class DARN : public RandomNumberGenerator
+{
+public:
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "DARN"; }
+
+    virtual ~DARN() {}
+
+    /// \brief Construct a DARN generator
+     /// \throw DARN_Err if the random number generator is not available
+    DARN();
+
+    /// \brief Generate random array of bytes
+    /// \param output the byte buffer
+    /// \param size the length of the buffer, in bytes
+    virtual void GenerateBlock(byte *output, size_t size);
+
+    /// \brief Generate and discard n bytes
+    /// \param n the number of bytes to generate and discard
+    /// \details the RDSEED generator discards words, not bytes. If n is
+    ///   not a multiple of a machine word, then it is rounded up to
+    ///   that size.
+    virtual void DiscardBytes(size_t n);
+
+    /// \brief Update RNG state with additional unpredictable values
+    /// \param input unused
+    /// \param length unused
+    /// \details The operation is a nop for this generator.
+    virtual void IncorporateEntropy(const byte *input, size_t length)
+    {
+        // Override to avoid the base class' throw.
+        CRYPTOPP_UNUSED(input); CRYPTOPP_UNUSED(length);
+    }
+
+    std::string AlgorithmProvider() const {
+        return "Power9";
+    }
+
+private:
+    SecBlock<byte, AllocatorWithCleanup<byte, true> > m_temp;
+};
+
+NAMESPACE_END
+
+#endif // CRYPTOPP_DARN_H
diff --git a/runtime/third_party/cryptopp/datatest.cpp b/runtime/third_party/cryptopp/datatest.cpp
new file mode 100644
index 0000000..ac82d51
--- /dev/null
+++ b/runtime/third_party/cryptopp/datatest.cpp
@@ -0,0 +1,1443 @@
+// datatest.cpp - originally written and placed in the public domain by Wei Dai
+//                CryptoPP::Test namespace added by JW in February 2017
+
+#define CRYPTOPP_DEFAULT_NO_DLL
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "factory.h"
+#include "integer.h"
+#include "filters.h"
+#include "randpool.h"
+#include "files.h"
+#include "trunhash.h"
+#include "queue.h"
+#include "smartptr.h"
+#include "validate.h"
+#include "stdcpp.h"
+#include "misc.h"
+#include "hex.h"
+#include "trap.h"
+
+#include <iostream>
+#include <sstream>
+#include <cerrno>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+#ifdef CRYPTOPP_MSC_VERSION
+# define STRTOUL64 _strtoui64
+#else
+# define STRTOUL64 strtoull
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+bool s_thorough = false;
+typedef std::map<std::string, std::string> TestData;
+const TestData *s_currentTestData = NULLPTR;
+const std::string testDataFilename = "cryptest.dat";
+
+// Handles CR, LF, and CRLF properly. Early RFC's used '\r\0' on occasion.
+// For istream.fail() see https://stackoverflow.com/q/34395801/608639.
+bool Readline(std::istream& stream, std::string& line)
+{
+	// Ensure old data is cleared
+	line.clear();
+
+	std::string temp;
+	temp.reserve(64);
+
+	while (!stream.fail())
+	{
+		int ch = stream.get();
+		if (ch == '\r')
+		{
+			int next = stream.peek();
+			if (next == '\n')
+				(void)stream.get();
+			else if (next == '\0')
+				(void)stream.get();
+
+			break;
+		}
+		else if (ch == '\n')
+		{
+			break;
+		}
+
+		temp.push_back(static_cast<char>(ch));
+	}
+
+#if defined(CRYPTOPP_CXX11)
+	temp.shrink_to_fit();
+#else
+	// Non-binding shrink to fit
+	temp.reserve(0);
+#endif
+
+	std::swap(line, temp);
+
+	return !stream.fail();
+}
+
+std::string TrimSpace(const std::string& str)
+{
+	if (str.empty()) return "";
+
+	const std::string whitespace(" \r\t\n");
+	std::string::size_type beg = str.find_first_not_of(whitespace);
+	std::string::size_type end = str.find_last_not_of(whitespace);
+
+	if (beg != std::string::npos && end != std::string::npos)
+		return str.substr(beg, end+1);
+	else if (beg != std::string::npos)
+		return str.substr(beg);
+	else
+		return "";
+}
+
+std::string TrimComment(const std::string& str)
+{
+	if (str.empty()) return "";
+
+	std::string::size_type first = str.find("#");
+
+	if (first != std::string::npos)
+		return TrimSpace(str.substr(0, first));
+	else
+		return TrimSpace(str);
+}
+
+class TestFailure : public Exception
+{
+public:
+	TestFailure() : Exception(OTHER_ERROR, "Validation test failed") {}
+};
+
+void OutputTestData(const TestData &v)
+{
+	std::cerr << "\n";
+	for (TestData::const_iterator i = v.begin(); i != v.end(); ++i)
+	{
+		std::cerr << i->first << ": " << i->second << std::endl;
+	}
+}
+
+void SignalTestFailure()
+{
+	OutputTestData(*s_currentTestData);
+	throw TestFailure();
+}
+
+void SignalUnknownAlgorithmError(const std::string& algType)
+{
+	OutputTestData(*s_currentTestData);
+	throw Exception(Exception::OTHER_ERROR, "Unknown algorithm " + algType + " during validation test");
+}
+
+void SignalTestError(const char* msg = NULLPTR)
+{
+	OutputTestData(*s_currentTestData);
+
+	if (msg)
+		throw Exception(Exception::OTHER_ERROR, msg);
+	else
+		throw Exception(Exception::OTHER_ERROR, "Unexpected error during validation test");
+}
+
+bool DataExists(const TestData &data, const char *name)
+{
+	TestData::const_iterator i = data.find(name);
+	return (i != data.end());
+}
+
+const std::string & GetRequiredDatum(const TestData &data, const char *name)
+{
+	TestData::const_iterator i = data.find(name);
+	if (i == data.end())
+	{
+		std::string msg("Required datum \"" + std::string(name) + "\" missing");
+		SignalTestError(msg.c_str());
+	}
+	return i->second;
+}
+
+void RandomizedTransfer(BufferedTransformation &source, BufferedTransformation &target, bool finish, const std::string &channel=DEFAULT_CHANNEL)
+{
+	while (source.MaxRetrievable() > (finish ? 0 : 4096))
+	{
+		byte buf[4096+64];
+		size_t start = Test::GlobalRNG().GenerateWord32(0, 63);
+		size_t len = Test::GlobalRNG().GenerateWord32(1, UnsignedMin(4096U, 3*source.MaxRetrievable()/2));
+		len = source.Get(buf+start, len);
+		target.ChannelPut(channel, buf+start, len);
+	}
+}
+
+void PutDecodedDatumInto(const TestData &data, const char *name, BufferedTransformation &target)
+{
+	std::string s1 = GetRequiredDatum(data, name), s2;
+	ByteQueue q;
+
+	while (!s1.empty())
+	{
+		std::string::size_type pos = s1.find_first_not_of(" ");
+		if (pos != std::string::npos)
+			s1.erase(0, pos);
+
+		if (s1.empty())
+			goto end;
+
+		int repeat = 1;
+		if (s1[0] == 'r')
+		{
+			s1 = s1.erase(0, 1);
+			repeat = std::atoi(s1.c_str());
+			s1 = s1.substr(s1.find(' ')+1);
+		}
+
+		// Convert word32 or word64 to little endian order. Some algorithm test vectors are
+		// presented in the format. We probably should have named them word32le and word64le.
+		if (s1.length() >= 6 && (s1.substr(0,6) == "word32" || s1.substr(0,6) == "word64"))
+		{
+			std::istringstream iss(s1.substr(6));
+			if (s1.substr(0,6) == "word64")
+			{
+				word64 value;
+				while (iss >> std::skipws >> std::hex >> value)
+				{
+					value = ConditionalByteReverse(LITTLE_ENDIAN_ORDER, value);
+					q.Put(reinterpret_cast<const byte *>(&value), 8);
+				}
+			}
+			else
+			{
+				word32 value;
+				while (iss >> std::skipws >> std::hex >> value)
+				{
+					value = ConditionalByteReverse(LITTLE_ENDIAN_ORDER, value);
+					q.Put(reinterpret_cast<const byte *>(&value), 4);
+				}
+			}
+			goto end;
+		}
+
+		s2.clear();
+		if (s1[0] == '\"')
+		{
+			s2 = s1.substr(1, s1.find('\"', 1)-1);
+			s1 = s1.substr(s2.length() + 2);
+		}
+		else if (s1.substr(0, 2) == "0x")
+		{
+			std::string::size_type n = s1.find(' ');
+			StringSource(s1.substr(2, n), true, new HexDecoder(new StringSink(s2)));
+			s1 = s1.substr(STDMIN(n, s1.length()));
+		}
+		else
+		{
+			std::string::size_type n = s1.find(' ');
+			StringSource(s1.substr(0, n), true, new HexDecoder(new StringSink(s2)));
+			s1 = s1.substr(STDMIN(n, s1.length()));
+		}
+
+		while (repeat--)
+		{
+			q.Put(ConstBytePtr(s2), BytePtrSize(s2));
+			RandomizedTransfer(q, target, false);
+		}
+	}
+
+end:
+	RandomizedTransfer(q, target, true);
+}
+
+std::string GetDecodedDatum(const TestData &data, const char *name)
+{
+	std::string s;
+	PutDecodedDatumInto(data, name, StringSink(s).Ref());
+	return s;
+}
+
+std::string GetOptionalDecodedDatum(const TestData &data, const char *name)
+{
+	std::string s;
+	if (DataExists(data, name))
+		PutDecodedDatumInto(data, name, StringSink(s).Ref());
+	return s;
+}
+
+class TestDataNameValuePairs : public NameValuePairs
+{
+public:
+	TestDataNameValuePairs(const TestData &data) : m_data(data) {}
+
+	virtual bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+	{
+		TestData::const_iterator i = m_data.find(name);
+		if (i == m_data.end())
+		{
+			if (std::string(name) == Name::DigestSize() && valueType == typeid(int))
+			{
+				i = m_data.find("MAC");
+				if (i == m_data.end())
+					i = m_data.find("Digest");
+				if (i == m_data.end())
+					return false;
+
+				m_temp.clear();
+				PutDecodedDatumInto(m_data, i->first.c_str(), StringSink(m_temp).Ref());
+				*reinterpret_cast<int *>(pValue) = (int)m_temp.size();
+				return true;
+			}
+			else
+				return false;
+		}
+
+		const std::string &value = i->second;
+
+		if (valueType == typeid(int))
+			*reinterpret_cast<int *>(pValue) = atoi(value.c_str());
+		else if (valueType == typeid(word64))
+		{
+			std::string x(value.empty() ? "0" : value);
+			const char* beg = &x[0];
+			char* end = &x[0] + value.size();
+
+			errno = 0;
+			*reinterpret_cast<word64*>(pValue) = STRTOUL64(beg, &end, 0);
+			if (errno != 0)
+				return false;
+		}
+		else if (valueType == typeid(Integer))
+			*reinterpret_cast<Integer *>(pValue) = Integer((std::string(value) + "h").c_str());
+		else if (valueType == typeid(ConstByteArrayParameter))
+		{
+			m_temp.clear();
+			PutDecodedDatumInto(m_data, name, StringSink(m_temp).Ref());
+			reinterpret_cast<ConstByteArrayParameter *>(pValue)->Assign(ConstBytePtr(m_temp), BytePtrSize(m_temp), false);
+		}
+		else
+			throw ValueTypeMismatch(name, typeid(std::string), valueType);
+
+		return true;
+	}
+
+private:
+	const TestData &m_data;
+	mutable std::string m_temp;
+};
+
+void TestKeyPairValidAndConsistent(CryptoMaterial &pub, const CryptoMaterial &priv, unsigned int &totalTests)
+{
+	totalTests++;
+
+	if (!pub.Validate(Test::GlobalRNG(), 2U+!!s_thorough))
+		SignalTestFailure();
+	if (!priv.Validate(Test::GlobalRNG(), 2U+!!s_thorough))
+		SignalTestFailure();
+
+	ByteQueue bq1, bq2;
+	pub.Save(bq1);
+	pub.AssignFrom(priv);
+	pub.Save(bq2);
+	if (bq1 != bq2)
+		SignalTestFailure();
+}
+
+void TestSignatureScheme(TestData &v, unsigned int &totalTests)
+{
+	std::string name = GetRequiredDatum(v, "Name");
+	std::string test = GetRequiredDatum(v, "Test");
+
+	static member_ptr<PK_Signer> signer;
+	static member_ptr<PK_Verifier> verifier;
+	static std::string lastName;
+
+	if (name != lastName)
+	{
+		signer.reset(ObjectFactoryRegistry<PK_Signer>::Registry().CreateObject(name.c_str()));
+		verifier.reset(ObjectFactoryRegistry<PK_Verifier>::Registry().CreateObject(name.c_str()));
+		lastName = name;
+
+		// Code coverage
+		(void)signer->AlgorithmName();
+		(void)verifier->AlgorithmName();
+		(void)signer->AlgorithmProvider();
+		(void)verifier->AlgorithmProvider();
+	}
+
+	TestDataNameValuePairs pairs(v);
+
+	if (test == "GenerateKey")
+	{
+		totalTests++;
+
+		signer->AccessPrivateKey().GenerateRandom(Test::GlobalRNG(), pairs);
+		verifier->AccessPublicKey().AssignFrom(signer->AccessPrivateKey());
+	}
+	else
+	{
+		std::string keyFormat = GetRequiredDatum(v, "KeyFormat");
+
+		totalTests++;  // key format
+		if (keyFormat == "DER")
+			verifier->AccessMaterial().Load(StringStore(GetDecodedDatum(v, "PublicKey")).Ref());
+		else if (keyFormat == "Component")
+			verifier->AccessMaterial().AssignFrom(pairs);
+
+		if (test == "Verify" || test == "NotVerify")
+		{
+			totalTests++;
+
+			SignatureVerificationFilter verifierFilter(*verifier, NULLPTR, SignatureVerificationFilter::SIGNATURE_AT_BEGIN);
+			PutDecodedDatumInto(v, "Signature", verifierFilter);
+			PutDecodedDatumInto(v, "Message", verifierFilter);
+			verifierFilter.MessageEnd();
+			if (verifierFilter.GetLastResult() == (test == "NotVerify"))
+				SignalTestFailure();
+			return;
+		}
+		else if (test == "PublicKeyValid")
+		{
+			totalTests++;
+
+			if (!verifier->GetMaterial().Validate(Test::GlobalRNG(), 3))
+				SignalTestFailure();
+			return;
+		}
+
+		totalTests++; // key format
+		if (keyFormat == "DER")
+			signer->AccessMaterial().Load(StringStore(GetDecodedDatum(v, "PrivateKey")).Ref());
+		else if (keyFormat == "Component")
+			signer->AccessMaterial().AssignFrom(pairs);
+	}
+
+	if (test == "GenerateKey" || test == "KeyPairValidAndConsistent")
+	{
+		totalTests++;
+
+		TestKeyPairValidAndConsistent(verifier->AccessMaterial(), signer->GetMaterial(),totalTests);
+		SignatureVerificationFilter verifierFilter(*verifier, NULLPTR, SignatureVerificationFilter::THROW_EXCEPTION);
+		const byte msg[3] = {'a', 'b', 'c'};
+		verifierFilter.Put(msg, sizeof(msg));
+		StringSource ss(msg, sizeof(msg), true, new SignerFilter(Test::GlobalRNG(), *signer, new Redirector(verifierFilter)));
+	}
+	else if (test == "Sign")
+	{
+		totalTests++;
+
+		SignerFilter f(Test::GlobalRNG(), *signer, new HexEncoder(new FileSink(std::cout)));
+		StringSource ss(GetDecodedDatum(v, "Message"), true, new Redirector(f));
+		SignalTestFailure();
+	}
+	else if (test == "DeterministicSign")
+	{
+		totalTests++;
+
+		// This test is specialized for RFC 6979. The RFC is a drop-in replacement
+		// for DSA and ECDSA, and access to the seed or secret is not needed. If
+		// additional deterministic signatures are added, then the test harness will
+		// likely need to be extended.
+		std::string signature;
+		SignerFilter f(Test::GlobalRNG(), *signer, new StringSink(signature));
+		StringSource ss(GetDecodedDatum(v, "Message"), true, new Redirector(f));
+
+		if (GetDecodedDatum(v, "Signature") != signature)
+			SignalTestFailure();
+	}
+	else
+	{
+		std::string msg("Unknown signature test \"" + test + "\"");
+		SignalTestError(msg.c_str());
+		CRYPTOPP_ASSERT(false);
+	}
+}
+
+// Subset of TestSignatureScheme. We picked the tests that have data that is easy to write to a file.
+// Also see https://github.com/weidai11/cryptopp/issues/1010, where HIGHT broke when using FileSource.
+void TestSignatureSchemeWithFileSource(TestData &v, unsigned int &totalTests)
+{
+	std::string name = GetRequiredDatum(v, "Name");
+	std::string test = GetRequiredDatum(v, "Test");
+
+	if (test != "Sign" && test != "DeterministicSign") { return; }
+
+	static member_ptr<PK_Signer> signer;
+	static member_ptr<PK_Verifier> verifier;
+	static std::string lastName;
+
+	if (name != lastName)
+	{
+		signer.reset(ObjectFactoryRegistry<PK_Signer>::Registry().CreateObject(name.c_str()));
+		verifier.reset(ObjectFactoryRegistry<PK_Verifier>::Registry().CreateObject(name.c_str()));
+		name = lastName;
+
+		// Code coverage
+		(void)signer->AlgorithmName();
+		(void)verifier->AlgorithmName();
+		(void)signer->AlgorithmProvider();
+		(void)verifier->AlgorithmProvider();
+	}
+
+	TestDataNameValuePairs pairs(v);
+
+	std::string keyFormat = GetRequiredDatum(v, "KeyFormat");
+
+	totalTests++;  // key format
+	if (keyFormat == "DER")
+		verifier->AccessMaterial().Load(StringStore(GetDecodedDatum(v, "PublicKey")).Ref());
+	else if (keyFormat == "Component")
+		verifier->AccessMaterial().AssignFrom(pairs);
+
+	totalTests++; // key format
+	if (keyFormat == "DER")
+		signer->AccessMaterial().Load(StringStore(GetDecodedDatum(v, "PrivateKey")).Ref());
+	else if (keyFormat == "Component")
+		signer->AccessMaterial().AssignFrom(pairs);
+
+	if (test == "Sign")
+	{
+		totalTests++;
+
+		SignerFilter f(Test::GlobalRNG(), *signer, new HexEncoder(new FileSink(std::cout)));
+		StringSource ss(GetDecodedDatum(v, "Message"), true, new FileSink(testDataFilename.c_str()));
+		FileSource fs(testDataFilename.c_str(), true, new Redirector(f));
+		SignalTestFailure();
+	}
+	else if (test == "DeterministicSign")
+	{
+		totalTests++;
+
+		// This test is specialized for RFC 6979. The RFC is a drop-in replacement
+		// for DSA and ECDSA, and access to the seed or secret is not needed. If
+		// additional deterministic signatures are added, then the test harness will
+		// likely need to be extended.
+		std::string signature;
+		SignerFilter f(Test::GlobalRNG(), *signer, new StringSink(signature));
+		StringSource ss(GetDecodedDatum(v, "Message"), true, new FileSink(testDataFilename.c_str()));
+		FileSource fs(testDataFilename.c_str(), true, new Redirector(f));
+
+		if (GetDecodedDatum(v, "Signature") != signature)
+			SignalTestFailure();
+	}
+}
+
+void TestAsymmetricCipher(TestData &v, unsigned int &totalTests)
+{
+	std::string name = GetRequiredDatum(v, "Name");
+	std::string test = GetRequiredDatum(v, "Test");
+
+	static member_ptr<PK_Encryptor> encryptor;
+	static member_ptr<PK_Decryptor> decryptor;
+	static std::string lastName;
+
+	if (name != lastName)
+	{
+		encryptor.reset(ObjectFactoryRegistry<PK_Encryptor>::Registry().CreateObject(name.c_str()));
+		decryptor.reset(ObjectFactoryRegistry<PK_Decryptor>::Registry().CreateObject(name.c_str()));
+		lastName = name;
+
+		// Code coverage
+		(void)encryptor->AlgorithmName();
+		(void)decryptor->AlgorithmName();
+		(void)encryptor->AlgorithmProvider();
+		(void)decryptor->AlgorithmProvider();
+	}
+
+	std::string keyFormat = GetRequiredDatum(v, "KeyFormat");
+
+	if (keyFormat == "DER")
+	{
+		totalTests++;
+
+		decryptor->AccessMaterial().Load(StringStore(GetDecodedDatum(v, "PrivateKey")).Ref());
+		encryptor->AccessMaterial().Load(StringStore(GetDecodedDatum(v, "PublicKey")).Ref());
+	}
+	else if (keyFormat == "Component")
+	{
+		totalTests++;
+
+		TestDataNameValuePairs pairs(v);
+		decryptor->AccessMaterial().AssignFrom(pairs);
+		encryptor->AccessMaterial().AssignFrom(pairs);
+	}
+
+	if (test == "DecryptMatch")
+	{
+		totalTests++;
+
+		std::string decrypted, expected = GetDecodedDatum(v, "Plaintext");
+		StringSource ss(GetDecodedDatum(v, "Ciphertext"), true, new PK_DecryptorFilter(Test::GlobalRNG(), *decryptor, new StringSink(decrypted)));
+		if (decrypted != expected)
+			SignalTestFailure();
+	}
+	else if (test == "KeyPairValidAndConsistent")
+	{
+		totalTests++;
+
+		TestKeyPairValidAndConsistent(encryptor->AccessMaterial(), decryptor->GetMaterial(), totalTests);
+	}
+	else
+	{
+		std::string msg("Unknown asymmetric cipher test \"" + test + "\"");
+		SignalTestError(msg.c_str());
+		CRYPTOPP_ASSERT(false);
+	}
+}
+
+void TestSymmetricCipher(TestData &v, const NameValuePairs &overrideParameters, unsigned int &totalTests)
+{
+	std::string name = GetRequiredDatum(v, "Name");
+	std::string test = GetRequiredDatum(v, "Test");
+
+	std::string key = GetDecodedDatum(v, "Key");
+	std::string plaintext = GetDecodedDatum(v, "Plaintext");
+
+	TestDataNameValuePairs testDataPairs(v);
+	CombinedNameValuePairs pairs(overrideParameters, testDataPairs);
+
+	if (test == "Encrypt" || test == "EncryptXorDigest" || test == "Resync" || test == "EncryptionMCT" || test == "DecryptionMCT")
+	{
+		static member_ptr<SymmetricCipher> encryptor, decryptor;
+		static std::string lastName;
+
+		totalTests++;
+
+		if (name != lastName)
+		{
+			encryptor.reset(ObjectFactoryRegistry<SymmetricCipher, ENCRYPTION>::Registry().CreateObject(name.c_str()));
+			decryptor.reset(ObjectFactoryRegistry<SymmetricCipher, DECRYPTION>::Registry().CreateObject(name.c_str()));
+			lastName = name;
+
+			// Code coverage
+			(void)encryptor->AlgorithmName();
+			(void)decryptor->AlgorithmName();
+			(void)encryptor->AlgorithmProvider();
+			(void)decryptor->AlgorithmProvider();
+			(void)encryptor->IsRandomAccess();
+			(void)decryptor->IsRandomAccess();
+			(void)encryptor->MinKeyLength();
+			(void)decryptor->MinKeyLength();
+			(void)encryptor->MaxKeyLength();
+			(void)decryptor->MaxKeyLength();
+			(void)encryptor->DefaultKeyLength();
+			(void)decryptor->DefaultKeyLength();
+		}
+
+		ConstByteArrayParameter iv;
+		if (pairs.GetValue(Name::IV(), iv) && iv.size() != encryptor->IVSize())
+			SignalTestFailure();
+
+		if (test == "Resync")
+		{
+			encryptor->Resynchronize(iv.begin(), (int)iv.size());
+			decryptor->Resynchronize(iv.begin(), (int)iv.size());
+		}
+		else
+		{
+			encryptor->SetKey(ConstBytePtr(key), BytePtrSize(key), pairs);
+			decryptor->SetKey(ConstBytePtr(key), BytePtrSize(key), pairs);
+		}
+
+		word64 seek64 = pairs.GetWord64ValueWithDefault("Seek64", 0);
+		if (seek64)
+		{
+			encryptor->Seek(seek64);
+			decryptor->Seek(seek64);
+		}
+		else
+		{
+			int seek = pairs.GetIntValueWithDefault("Seek", 0);
+			if (seek)
+			{
+				encryptor->Seek(seek);
+				decryptor->Seek(seek);
+			}
+		}
+
+		// Most block ciphers don't specify BlockPaddingScheme. Kalyna uses it
+		// in test vectors. 0 is NoPadding, 1 is ZerosPadding, 2 is PkcsPadding,
+		// 3 is OneAndZerosPadding, etc. Note: The machinery is wired such that
+		// paddingScheme is effectively latched. An old paddingScheme may be
+		// unintentionally used in a subsequent test.
+		int paddingScheme = pairs.GetIntValueWithDefault(Name::BlockPaddingScheme(), 0);
+
+		std::string encrypted, xorDigest, ciphertext, ciphertextXorDigest;
+		if (test == "EncryptionMCT" || test == "DecryptionMCT")
+		{
+			SymmetricCipher *cipher = encryptor.get();
+			std::string buf(plaintext), keybuf(key);
+
+			if (test == "DecryptionMCT")
+			{
+				cipher = decryptor.get();
+				ciphertext = GetDecodedDatum(v, "Ciphertext");
+				buf.assign(ciphertext.begin(), ciphertext.end());
+			}
+
+			for (int i=0; i<400; i++)
+			{
+				encrypted.reserve(10000 * plaintext.size());
+				for (int j=0; j<10000; j++)
+				{
+					cipher->ProcessString(BytePtr(buf), BytePtrSize(buf));
+					encrypted.append(buf.begin(), buf.end());
+				}
+
+				encrypted.erase(0, encrypted.size() - keybuf.size());
+				xorbuf(BytePtr(keybuf), BytePtr(encrypted), BytePtrSize(keybuf));
+				cipher->SetKey(BytePtr(keybuf), BytePtrSize(keybuf));
+			}
+
+			encrypted.assign(buf.begin(), buf.end());
+			ciphertext = GetDecodedDatum(v, test == "EncryptionMCT" ? "Ciphertext" : "Plaintext");
+			if (encrypted != ciphertext)
+			{
+				std::cout << "\nincorrectly encrypted: ";
+				StringSource ss(encrypted, false, new HexEncoder(new FileSink(std::cout)));
+				ss.Pump(256); ss.Flush(false);
+				std::cout << "\n";
+				SignalTestFailure();
+			}
+			return;
+		}
+
+		StreamTransformationFilter encFilter(*encryptor, new StringSink(encrypted),
+			static_cast<BlockPaddingSchemeDef::BlockPaddingScheme>(paddingScheme));
+
+		StringStore pstore(plaintext);
+		RandomizedTransfer(pstore, encFilter, true);
+		encFilter.MessageEnd();
+
+		if (test != "EncryptXorDigest")
+		{
+			ciphertext = GetDecodedDatum(v, "Ciphertext");
+		}
+		else
+		{
+			ciphertextXorDigest = GetDecodedDatum(v, "CiphertextXorDigest");
+			xorDigest.append(encrypted, 0, 64);
+			for (size_t i=64; i<encrypted.size(); i++)
+				xorDigest[i%64] = static_cast<char>(xorDigest[i%64] ^ encrypted[i]);
+		}
+		if (test != "EncryptXorDigest" ? encrypted != ciphertext : xorDigest != ciphertextXorDigest)
+		{
+			std::cout << "\nincorrectly encrypted: ";
+			StringSource ss(encrypted, false, new HexEncoder(new FileSink(std::cout)));
+			ss.Pump(2048); ss.Flush(false);
+			std::cout << "\n";
+			SignalTestFailure();
+		}
+
+		std::string decrypted;
+		StreamTransformationFilter decFilter(*decryptor, new StringSink(decrypted),
+			static_cast<BlockPaddingSchemeDef::BlockPaddingScheme>(paddingScheme));
+
+		StringStore cstore(encrypted);
+		RandomizedTransfer(cstore, decFilter, true);
+		decFilter.MessageEnd();
+
+		if (decrypted != plaintext)
+		{
+			std::cout << "\nincorrectly decrypted: ";
+			StringSource ss(decrypted, false, new HexEncoder(new FileSink(std::cout)));
+			ss.Pump(256); ss.Flush(false);
+			std::cout << "\n";
+			SignalTestFailure();
+		}
+	}
+	else
+	{
+		std::string msg("Unknown symmetric cipher test \"" + test + "\"");
+		SignalTestError(msg.c_str());
+	}
+}
+
+// Subset of TestSymmetricCipher. The test suite lacked tests for in-place encryption,
+// where inString == outString. Also see https://github.com/weidai11/cryptopp/issues/1231.
+void TestSymmetricCipherWithInplaceEncryption(TestData &v, const NameValuePairs &overrideParameters, unsigned int &totalTests)
+{
+	std::string name = GetRequiredDatum(v, "Name");
+	std::string test = GetRequiredDatum(v, "Test");
+
+	std::string key = GetDecodedDatum(v, "Key");
+	std::string plaintext = GetDecodedDatum(v, "Plaintext");
+
+	TestDataNameValuePairs testDataPairs(v);
+	CombinedNameValuePairs pairs(overrideParameters, testDataPairs);
+
+	if (test != "Encrypt" ) { return; }
+
+	static member_ptr<SymmetricCipher> encryptor, decryptor;
+	static std::string lastName;
+
+	if (name != lastName)
+	{
+		encryptor.reset(ObjectFactoryRegistry<SymmetricCipher, ENCRYPTION>::Registry().CreateObject(name.c_str()));
+		decryptor.reset(ObjectFactoryRegistry<SymmetricCipher, DECRYPTION>::Registry().CreateObject(name.c_str()));
+		lastName = name;
+	}
+
+	// Only test stream ciphers at the moment
+	if (encryptor->MandatoryBlockSize() != 1) { return; }
+
+	totalTests++;
+
+	ConstByteArrayParameter iv;
+	if (pairs.GetValue(Name::IV(), iv) && iv.size() != encryptor->IVSize())
+		SignalTestFailure();
+
+	encryptor->SetKey(ConstBytePtr(key), BytePtrSize(key), pairs);
+	decryptor->SetKey(ConstBytePtr(key), BytePtrSize(key), pairs);
+
+	word64 seek64 = pairs.GetWord64ValueWithDefault("Seek64", 0);
+	if (seek64)
+	{
+		encryptor->Seek(seek64);
+		decryptor->Seek(seek64);
+	}
+	else
+	{
+		int seek = pairs.GetIntValueWithDefault("Seek", 0);
+		if (seek)
+		{
+			encryptor->Seek(seek);
+			decryptor->Seek(seek);
+		}
+	}
+
+	const std::string plainText = GetDecodedDatum(v, "Plaintext");
+	const std::string cipherText = GetDecodedDatum(v, "Ciphertext");
+
+	// Use buffer for in-place encryption and decryption
+	std::string buffer(plainText);
+
+	// Test in-place encryption
+	encryptor->ProcessString(BytePtr(buffer), BytePtrSize(buffer));
+
+	if (buffer != cipherText)
+	{
+		std::cout << "\nincorrectly encrypted: ";
+		StringSource ss(buffer, false, new HexEncoder(new FileSink(std::cout)));
+		ss.Pump(256); ss.Flush(false);
+		std::cout << "\n";
+		SignalTestFailure();
+	}
+
+	// Test in-place decryption
+	decryptor->ProcessString(BytePtr(buffer), BytePtrSize(buffer));
+
+	if (buffer != plainText)
+	{
+		std::cout << "\nincorrectly decrypted: ";
+		StringSource ss(buffer, false, new HexEncoder(new FileSink(std::cout)));
+		ss.Pump(256); ss.Flush(false);
+		std::cout << "\n";
+		SignalTestFailure();
+	}
+}
+
+// Subset of TestSymmetricCipher. We picked the tests that have data that is easy to write to a file.
+// Also see https://github.com/weidai11/cryptopp/issues/1010, where HIGHT broke when using FileSource.
+void TestSymmetricCipherWithFileSource(TestData &v, const NameValuePairs &overrideParameters, unsigned int &totalTests)
+{
+	std::string name = GetRequiredDatum(v, "Name");
+	std::string test = GetRequiredDatum(v, "Test");
+
+	// Limit FileSource tests to Encrypt only.
+	if (test != "Encrypt") { return; }
+
+	totalTests++;
+
+	std::string key = GetDecodedDatum(v, "Key");
+	std::string plaintext = GetDecodedDatum(v, "Plaintext");
+
+	TestDataNameValuePairs testDataPairs(v);
+	CombinedNameValuePairs pairs(overrideParameters, testDataPairs);
+
+	static member_ptr<SymmetricCipher> encryptor, decryptor;
+	static std::string lastName;
+
+	if (name != lastName)
+	{
+		encryptor.reset(ObjectFactoryRegistry<SymmetricCipher, ENCRYPTION>::Registry().CreateObject(name.c_str()));
+		decryptor.reset(ObjectFactoryRegistry<SymmetricCipher, DECRYPTION>::Registry().CreateObject(name.c_str()));
+		lastName = name;
+
+		// Code coverage
+		(void)encryptor->AlgorithmName();
+		(void)decryptor->AlgorithmName();
+		(void)encryptor->AlgorithmProvider();
+		(void)decryptor->AlgorithmProvider();
+		(void)encryptor->MinKeyLength();
+		(void)decryptor->MinKeyLength();
+		(void)encryptor->MaxKeyLength();
+		(void)decryptor->MaxKeyLength();
+		(void)encryptor->DefaultKeyLength();
+		(void)decryptor->DefaultKeyLength();
+	}
+
+	ConstByteArrayParameter iv;
+	if (pairs.GetValue(Name::IV(), iv) && iv.size() != encryptor->IVSize())
+		SignalTestFailure();
+
+	encryptor->SetKey(ConstBytePtr(key), BytePtrSize(key), pairs);
+	decryptor->SetKey(ConstBytePtr(key), BytePtrSize(key), pairs);
+
+	word64 seek64 = pairs.GetWord64ValueWithDefault("Seek64", 0);
+	if (seek64)
+	{
+		encryptor->Seek(seek64);
+		decryptor->Seek(seek64);
+	}
+	else
+	{
+		int seek = pairs.GetIntValueWithDefault("Seek", 0);
+		if (seek)
+		{
+			encryptor->Seek(seek);
+			decryptor->Seek(seek);
+		}
+	}
+
+	// Most block ciphers don't specify BlockPaddingScheme. Kalyna uses it
+	// in test vectors. 0 is NoPadding, 1 is ZerosPadding, 2 is PkcsPadding,
+	// 3 is OneAndZerosPadding, etc. Note: The machinery is wired such that
+	// paddingScheme is effectively latched. An old paddingScheme may be
+	// unintentionally used in a subsequent test.
+	int paddingScheme = pairs.GetIntValueWithDefault(Name::BlockPaddingScheme(), 0);
+
+	std::string encrypted, ciphertext;
+	StreamTransformationFilter encFilter(*encryptor, new StringSink(encrypted),
+		static_cast<BlockPaddingSchemeDef::BlockPaddingScheme>(paddingScheme));
+
+	StringSource ss(plaintext, true, new FileSink(testDataFilename.c_str()));
+	FileSource pstore(testDataFilename.c_str(), true);
+	RandomizedTransfer(pstore, encFilter, true);
+	encFilter.MessageEnd();
+
+	ciphertext = GetDecodedDatum(v, "Ciphertext");
+
+	if (encrypted != ciphertext)
+	{
+		std::cout << "\nincorrectly encrypted: ";
+		StringSource sss(encrypted, false, new HexEncoder(new FileSink(std::cout)));
+		sss.Pump(2048); sss.Flush(false);
+		std::cout << "\n";
+		SignalTestFailure();
+	}
+
+	std::string decrypted;
+	StreamTransformationFilter decFilter(*decryptor, new StringSink(decrypted),
+		static_cast<BlockPaddingSchemeDef::BlockPaddingScheme>(paddingScheme));
+
+	StringStore cstore(encrypted);
+	RandomizedTransfer(cstore, decFilter, true);
+	decFilter.MessageEnd();
+
+	if (decrypted != plaintext)
+	{
+		std::cout << "\nincorrectly decrypted: ";
+		StringSource sss(decrypted, false, new HexEncoder(new FileSink(std::cout)));
+		sss.Pump(256); sss.Flush(false);
+		std::cout << "\n";
+		SignalTestFailure();
+	}
+}
+
+void TestAuthenticatedSymmetricCipher(TestData &v, const NameValuePairs &overrideParameters, unsigned int &totalTests)
+{
+	std::string type = GetRequiredDatum(v, "AlgorithmType");
+	std::string name = GetRequiredDatum(v, "Name");
+	std::string test = GetRequiredDatum(v, "Test");
+	std::string key = GetDecodedDatum(v, "Key");
+
+	std::string plaintext = GetOptionalDecodedDatum(v, "Plaintext");
+	std::string ciphertext = GetOptionalDecodedDatum(v, "Ciphertext");
+	std::string header = GetOptionalDecodedDatum(v, "Header");
+	std::string footer = GetOptionalDecodedDatum(v, "Footer");
+	std::string mac = GetOptionalDecodedDatum(v, "MAC");
+
+	TestDataNameValuePairs testDataPairs(v);
+	CombinedNameValuePairs pairs(overrideParameters, testDataPairs);
+
+	if (test == "Encrypt" || test == "EncryptXorDigest" || test == "NotVerify")
+	{
+		totalTests++;
+
+		static member_ptr<AuthenticatedSymmetricCipher> encryptor;
+		static member_ptr<AuthenticatedSymmetricCipher> decryptor;
+		static std::string lastName;
+
+		if (name != lastName)
+		{
+			encryptor.reset(ObjectFactoryRegistry<AuthenticatedSymmetricCipher, ENCRYPTION>::Registry().CreateObject(name.c_str()));
+			decryptor.reset(ObjectFactoryRegistry<AuthenticatedSymmetricCipher, DECRYPTION>::Registry().CreateObject(name.c_str()));
+			name = lastName;
+
+			// Code coverage
+			(void)encryptor->AlgorithmName();
+			(void)decryptor->AlgorithmName();
+			(void)encryptor->AlgorithmProvider();
+			(void)decryptor->AlgorithmProvider();
+			(void)encryptor->MinKeyLength();
+			(void)decryptor->MinKeyLength();
+			(void)encryptor->MaxKeyLength();
+			(void)decryptor->MaxKeyLength();
+			(void)encryptor->DefaultKeyLength();
+			(void)decryptor->DefaultKeyLength();
+			(void)encryptor->IsRandomAccess();
+			(void)decryptor->IsRandomAccess();
+			(void)encryptor->IsSelfInverting();
+			(void)decryptor->IsSelfInverting();
+			(void)encryptor->MaxHeaderLength();
+			(void)decryptor->MaxHeaderLength();
+			(void)encryptor->MaxMessageLength();
+			(void)decryptor->MaxMessageLength();
+			(void)encryptor->MaxFooterLength();
+			(void)decryptor->MaxFooterLength();
+			(void)encryptor->NeedsPrespecifiedDataLengths();
+			(void)decryptor->NeedsPrespecifiedDataLengths();
+		}
+
+		encryptor->SetKey(ConstBytePtr(key), BytePtrSize(key), pairs);
+		decryptor->SetKey(ConstBytePtr(key), BytePtrSize(key), pairs);
+
+		std::string encrypted, decrypted;
+		AuthenticatedEncryptionFilter ef(*encryptor, new StringSink(encrypted));
+		bool macAtBegin = !mac.empty() && !Test::GlobalRNG().GenerateBit();	// test both ways randomly
+		AuthenticatedDecryptionFilter df(*decryptor, new StringSink(decrypted), macAtBegin ? AuthenticatedDecryptionFilter::MAC_AT_BEGIN : 0);
+
+		if (encryptor->NeedsPrespecifiedDataLengths())
+		{
+			encryptor->SpecifyDataLengths(header.size(), plaintext.size(), footer.size());
+			decryptor->SpecifyDataLengths(header.size(), plaintext.size(), footer.size());
+		}
+
+		StringStore sh(header), sp(plaintext), sc(ciphertext), sf(footer), sm(mac);
+
+		if (macAtBegin)
+			RandomizedTransfer(sm, df, true);
+		sh.CopyTo(df, LWORD_MAX, AAD_CHANNEL);
+		RandomizedTransfer(sc, df, true);
+		sf.CopyTo(df, LWORD_MAX, AAD_CHANNEL);
+		if (!macAtBegin)
+			RandomizedTransfer(sm, df, true);
+		df.MessageEnd();
+
+		RandomizedTransfer(sh, ef, true, AAD_CHANNEL);
+		RandomizedTransfer(sp, ef, true);
+		RandomizedTransfer(sf, ef, true, AAD_CHANNEL);
+		ef.MessageEnd();
+
+		if (test == "Encrypt" && encrypted != ciphertext+mac)
+		{
+			std::cout << "\nincorrectly encrypted: ";
+			StringSource ss(encrypted, false, new HexEncoder(new FileSink(std::cout)));
+			ss.Pump(2048); ss.Flush(false);
+			std::cout << "\n";
+			SignalTestFailure();
+		}
+		if (test == "Encrypt" && decrypted != plaintext)
+		{
+			std::cout << "\nincorrectly decrypted: ";
+			StringSource ss(decrypted, false, new HexEncoder(new FileSink(std::cout)));
+			ss.Pump(256); ss.Flush(false);
+			std::cout << "\n";
+			SignalTestFailure();
+		}
+
+		if (ciphertext.size()+mac.size()-plaintext.size() != encryptor->DigestSize())
+		{
+			std::cout << "\nbad MAC size\n";
+			SignalTestFailure();
+		}
+		if (df.GetLastResult() != (test == "Encrypt"))
+		{
+			std::cout << "\nMAC incorrectly verified\n";
+			SignalTestFailure();
+		}
+	}
+	else
+	{
+		std::string msg("Unknown authenticated symmetric cipher test \"" + test + "\"");
+		SignalTestError(msg.c_str());
+	}
+}
+
+void TestDigestOrMAC(TestData &v, bool testDigest, unsigned int &totalTests)
+{
+	std::string name = GetRequiredDatum(v, "Name");
+	std::string test = GetRequiredDatum(v, "Test");
+	const char *digestName = testDigest ? "Digest" : "MAC";
+
+	member_ptr<MessageAuthenticationCode> mac;
+	member_ptr<HashTransformation> hash;
+	HashTransformation *pHash = NULLPTR;
+
+	TestDataNameValuePairs pairs(v);
+
+	if (testDigest)
+	{
+		hash.reset(ObjectFactoryRegistry<HashTransformation>::Registry().CreateObject(name.c_str()));
+		pHash = hash.get();
+
+		// Code coverage
+		(void)hash->AlgorithmName();
+		(void)hash->AlgorithmProvider();
+		(void)hash->TagSize();
+		(void)hash->DigestSize();
+		(void)hash->Restart();
+	}
+	else
+	{
+		mac.reset(ObjectFactoryRegistry<MessageAuthenticationCode>::Registry().CreateObject(name.c_str()));
+		pHash = mac.get();
+		std::string key = GetDecodedDatum(v, "Key");
+		mac->SetKey(ConstBytePtr(key), BytePtrSize(key), pairs);
+
+		// Code coverage
+		(void)mac->AlgorithmName();
+		(void)mac->AlgorithmProvider();
+		(void)mac->TagSize();
+		(void)mac->DigestSize();
+		(void)mac->Restart();
+		(void)mac->MinKeyLength();
+		(void)mac->MaxKeyLength();
+		(void)mac->DefaultKeyLength();
+	}
+
+	if (test == "Verify" || test == "VerifyTruncated" || test == "NotVerify")
+	{
+		totalTests++;
+
+		int digestSize = -1;
+		if (test == "VerifyTruncated")
+			digestSize = pairs.GetIntValueWithDefault(Name::DigestSize(), digestSize);
+		HashVerificationFilter verifierFilter(*pHash, NULLPTR, HashVerificationFilter::HASH_AT_BEGIN, digestSize);
+		PutDecodedDatumInto(v, digestName, verifierFilter);
+		PutDecodedDatumInto(v, "Message", verifierFilter);
+		verifierFilter.MessageEnd();
+		if (verifierFilter.GetLastResult() == (test == "NotVerify"))
+			SignalTestFailure();
+	}
+	else
+	{
+		std::string msg("Unknown digest or mac test \"" + test + "\"");
+		SignalTestError(msg.c_str());
+	}
+}
+
+void TestKeyDerivationFunction(TestData &v, unsigned int &totalTests)
+{
+	totalTests++;
+
+	std::string name = GetRequiredDatum(v, "Name");
+	std::string test = GetRequiredDatum(v, "Test");
+
+	if(test == "Skip") return;
+
+	std::string secret = GetDecodedDatum(v, "Secret");
+	std::string expected = GetDecodedDatum(v, "DerivedKey");
+
+	TestDataNameValuePairs pairs(v);
+
+	static member_ptr<KeyDerivationFunction> kdf;
+	static std::string lastName;
+
+	if (name != lastName)
+	{
+		kdf.reset(ObjectFactoryRegistry<KeyDerivationFunction>::Registry().CreateObject(name.c_str()));
+		name = lastName;
+
+		// Code coverage
+		(void)kdf->AlgorithmName();
+		(void)kdf->AlgorithmProvider();
+		(void)kdf->MinDerivedKeyLength();
+		(void)kdf->MaxDerivedKeyLength();
+	}
+
+	std::string calculated; calculated.resize(expected.size());
+	kdf->DeriveKey(BytePtr(calculated), BytePtrSize(calculated), BytePtr(secret), BytePtrSize(secret), pairs);
+
+	if(calculated != expected)
+	{
+		std::cerr << "Calculated: ";
+		StringSource(calculated, true, new HexEncoder(new FileSink(std::cerr)));
+		std::cerr << std::endl;
+
+		SignalTestFailure();
+	}
+}
+
+inline char FirstChar(const std::string& str) {
+	if (str.empty()) return 0;
+	return str[0];
+}
+
+inline char LastChar(const std::string& str) {
+	if (str.empty()) return 0;
+	return str[str.length()-1];
+}
+
+// GetField parses the name/value pairs. If this function is modified,
+// then run 'cryptest.exe tv all' to ensure parsing still works.
+bool GetField(std::istream &is, std::string &name, std::string &value)
+{
+	std::string line;
+	name.clear(); value.clear();
+
+	// ***** Name *****
+	while (Readline(is, line))
+	{
+		// Eat empty lines and comments gracefully
+		line = TrimSpace(line);
+		if (line.empty() || line[0] == '#')
+			continue;
+
+		std::string::size_type pos = line.find(':');
+		if (pos == std::string::npos)
+			SignalTestError("Unable to parse name/value pair");
+
+		name = TrimSpace(line.substr(0, pos));
+		line = TrimSpace(line.substr(pos +1));
+
+		// Empty name is bad
+		if (name.empty())
+			return false;
+
+		// Empty value is ok
+		if (line.empty())
+			return true;
+
+		break;
+	}
+
+	// ***** Value *****
+	bool continueLine = true;
+
+	do
+	{
+		continueLine = false;
+
+		// Trim leading and trailing whitespace. Don't parse comments
+		// here because there may be a line continuation at the end.
+		line = TrimSpace(line);
+
+		if (line.empty())
+			continue;
+
+		// Check for continuation. The slash must be the last character.
+		if (LastChar(line) == '\\') {
+			continueLine = true;
+			line.erase(line.end()-1);
+		}
+
+		// Re-trim after parsing
+		line = TrimComment(line);
+		line = TrimSpace(line);
+
+		if (line.empty())
+			continue;
+
+		// Finally... the value
+		value += line;
+
+		if (continueLine)
+			value += ' ';
+	}
+	while (continueLine && Readline(is, line));
+
+	return true;
+}
+
+void OutputPair(const NameValuePairs &v, const char *name)
+{
+	Integer x;
+	bool b = v.GetValue(name, x);
+	CRYPTOPP_UNUSED(b); CRYPTOPP_ASSERT(b);
+	std::cout << name << ": \\\n    ";
+	x.Encode(HexEncoder(new FileSink(std::cout), false, 64, "\\\n    ").Ref(), x.MinEncodedSize());
+	std::cout << std::endl;
+}
+
+void OutputNameValuePairs(const NameValuePairs &v)
+{
+	std::string names = v.GetValueNames();
+	std::string::size_type i = 0;
+	while (i < names.size())
+	{
+		std::string::size_type j = names.find_first_of (';', i);
+
+		if (j == std::string::npos)
+			return;
+		else
+		{
+			std::string name = names.substr(i, j-i);
+			if (name.find(':') == std::string::npos)
+				OutputPair(v, name.c_str());
+		}
+
+		i = j + 1;
+	}
+}
+
+void TestDataFile(std::string filename, const NameValuePairs &overrideParameters, unsigned int &totalTests, unsigned int &failedTests)
+{
+	std::ifstream file(DataDir(filename).c_str());
+	if (!file.good())
+		throw Exception(Exception::OTHER_ERROR, "Can not open file " + DataDir(filename) + " for reading");
+
+	TestData v;
+	s_currentTestData = &v;
+	std::string name, value, lastAlgName;
+
+	while (file)
+	{
+		if (!GetField(file, name, value))
+			break;
+
+		if (name == "AlgorithmType")
+			v.clear();
+
+		// Can't assert value. Plaintext is sometimes empty.
+		// CRYPTOPP_ASSERT(!value.empty());
+		v[name] = value;
+
+		// The name "Test" is special. It tells the framework
+		// to run the test. Otherwise, name/value pairs are
+		// parsed and added to TestData 'v'.
+		if (name == "Test" && (s_thorough || v["SlowTest"] != "1"))
+		{
+			bool failed = false;
+			std::string algType = GetRequiredDatum(v, "AlgorithmType");
+			std::string algName = GetRequiredDatum(v, "Name");
+
+			if (lastAlgName != algName)
+			{
+				std::cout << "\nTesting " << algType << " algorithm " << algName << ".\n";
+				lastAlgName = algName;
+			}
+
+			// In the old days each loop ran one test. Later, things were modified to run the
+			// the same test twice. Some tests are run with both a StringSource and a FileSource
+			// to catch FileSource specific errors. currentTests and deltaTests (below) keep
+			// the book keeping in order.
+			unsigned int currentTests = totalTests;
+
+			try
+			{
+				if (algType == "Signature")
+				{
+					TestSignatureScheme(v, totalTests);
+					TestSignatureSchemeWithFileSource(v, totalTests);
+				}
+				else if (algType == "SymmetricCipher")
+				{
+					TestSymmetricCipher(v, overrideParameters, totalTests);
+					TestSymmetricCipherWithInplaceEncryption(v, overrideParameters, totalTests);
+					TestSymmetricCipherWithFileSource(v, overrideParameters, totalTests);
+				}
+				else if (algType == "AuthenticatedSymmetricCipher")
+					TestAuthenticatedSymmetricCipher(v, overrideParameters, totalTests);
+				else if (algType == "AsymmetricCipher")
+					TestAsymmetricCipher(v, totalTests);
+				else if (algType == "MessageDigest")
+					TestDigestOrMAC(v, true, totalTests);
+				else if (algType == "MAC")
+					TestDigestOrMAC(v, false, totalTests);
+				else if (algType == "KDF")
+					TestKeyDerivationFunction(v, totalTests);
+				else if (algType == "FileList")
+					TestDataFile(GetRequiredDatum(v, "Test"), g_nullNameValuePairs, totalTests, failedTests);
+				else
+					SignalUnknownAlgorithmError(algType);
+			}
+			catch (const TestFailure &)
+			{
+				failed = true;
+				std::cout << "\nTest FAILED.\n";
+			}
+			catch (const Exception &e)
+			{
+				failed = true;
+				std::cout << "\nCryptoPP::Exception caught: " << e.what() << std::endl;
+			}
+			catch (const std::exception &e)
+			{
+				failed = true;
+				std::cout << "\nstd::exception caught: " << e.what() << std::endl;
+			}
+
+			if (failed)
+			{
+				std::cout << "Skipping to next test." << std::endl;
+				failedTests++;
+			}
+			else
+			{
+				if (algType != "FileList")
+				{
+					unsigned int deltaTests = totalTests-currentTests;
+					if (deltaTests)
+					{
+						std::string progress(deltaTests, '.');
+						std::cout << progress;
+						if (currentTests % 4 == 0)
+							std::cout << std::flush;
+					}
+				}
+			}
+
+			// Most tests fully specify parameters, like key and iv. Each test gets
+			// its own unique value. Since each test gets a new value for each test
+			// case, latching a value in 'TestData v' does not matter. The old key
+			// or iv will get overwritten on the next test.
+			//
+			// If a per-test vector parameter was set for a test, like BlockPadding,
+			// BlockSize or Tweak, then it becomes latched in 'TestData v'. The old
+			// value is used in subsequent tests, and it could cause a self test
+			// failure in the next test. The behavior surfaced under Kalyna and
+			// Threefish. The Kalyna test vectors use NO_PADDING for all tests except
+			// one. Threefish occasionally uses a Tweak.
+			//
+			// Unlatch BlockPadding, BlockSize and Tweak now, after the test has been
+			// run. Also note we only unlatch from 'TestData v'. If overrideParameters
+			// are specified, the caller is responsible for managing the parameter.
+			v.erase("Tweak");     v.erase("InitialBlock");
+			v.erase("BlockSize"); v.erase("BlockPaddingScheme");
+		}
+	}
+}
+
+ANONYMOUS_NAMESPACE_END
+
+bool RunTestDataFile(const char *filename, const NameValuePairs &overrideParameters, bool thorough)
+{
+	s_thorough = thorough;
+	unsigned int totalTests = 0, failedTests = 0;
+	TestDataFile((filename ? filename : ""), overrideParameters, totalTests, failedTests);
+
+	std::cout << std::dec << "\nTests complete. Total tests = " << totalTests << ". Failed tests = " << failedTests << "." << std::endl;
+	if (failedTests != 0)
+		std::cout << "SOME TESTS FAILED!\n";
+
+	CRYPTOPP_ASSERT(failedTests == 0);
+	return failedTests == 0;
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/default.cpp b/runtime/third_party/cryptopp/default.cpp
new file mode 100644
index 0000000..e123b9b
--- /dev/null
+++ b/runtime/third_party/cryptopp/default.cpp
@@ -0,0 +1,307 @@
+// default.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4127 4189)
+#endif
+
+#include "cryptlib.h"
+#include "filters.h"
+#include "smartptr.h"
+#include "default.h"
+#include "queue.h"
+
+#include <time.h>
+#include <memory>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// The purpose of this function Mash() is to take an arbitrary length input
+// string and *deterministically* produce an arbitrary length output string such
+// that (1) it looks random, (2) no information about the input is
+// deducible from it, and (3) it contains as much entropy as it can hold, or
+// the amount of entropy in the input string, whichever is smaller.
+
+template <class H>
+static void Mash(const byte *in, size_t inLen, byte *out, size_t outLen, int iterations)
+{
+	if (BytePrecision(outLen) > 2)
+		throw InvalidArgument("Mash: output length too large");
+
+	size_t bufSize = RoundUpToMultipleOf(outLen, (size_t)H::DIGESTSIZE);
+	byte b[2];
+	SecByteBlock buf(bufSize);
+	SecByteBlock outBuf(bufSize);
+	H hash;
+
+	unsigned int i;
+	for(i=0; i<outLen; i+=H::DIGESTSIZE)
+	{
+		b[0] = (byte) (i >> 8);
+		b[1] = (byte) i;
+		hash.Update(b, 2);
+		hash.Update(in, inLen);
+		hash.Final(outBuf+i);
+	}
+
+	while (iterations-- > 1)
+	{
+		std::memcpy(buf, outBuf, bufSize);
+		for (i=0; i<bufSize; i+=H::DIGESTSIZE)
+		{
+			b[0] = (byte) (i >> 8);
+			b[1] = (byte) i;
+			hash.Update(b, 2);
+			hash.Update(buf, bufSize);
+			hash.Final(outBuf+i);
+		}
+	}
+
+	std::memcpy(out, outBuf, outLen);
+}
+
+template <class BC, class H, class Info>
+static void GenerateKeyIV(const byte *passphrase, size_t passphraseLength, const byte *salt, size_t saltLength, unsigned int iterations, byte *key, byte *IV)
+{
+	// UBsan. User supplied params, may be NULL
+	SecByteBlock temp(passphraseLength+saltLength);
+	if (passphrase != NULLPTR)
+		std::memcpy(temp, passphrase, passphraseLength);
+	if (salt != NULLPTR)
+		std::memcpy(temp+passphraseLength, salt, saltLength);
+
+	// OK. Derived params, cannot be NULL
+	SecByteBlock keyIV(EnumToInt(Info::KEYLENGTH)+EnumToInt(+Info::BLOCKSIZE));
+	Mash<H>(temp, passphraseLength + saltLength, keyIV, EnumToInt(Info::KEYLENGTH)+EnumToInt(+Info::BLOCKSIZE), iterations);
+	std::memcpy(key, keyIV, Info::KEYLENGTH);
+	std::memcpy(IV, keyIV+Info::KEYLENGTH, Info::BLOCKSIZE);
+}
+
+// ********************************************************
+
+template <class BC, class H, class Info>
+DataEncryptor<BC,H,Info>::DataEncryptor(const char *passphrase, BufferedTransformation *attachment)
+	: ProxyFilter(NULLPTR, 0, 0, attachment), m_passphrase((const byte *)passphrase, strlen(passphrase))
+{
+	CRYPTOPP_COMPILE_ASSERT((int)SALTLENGTH <= DIGESTSIZE);
+	CRYPTOPP_COMPILE_ASSERT((int)BLOCKSIZE <= (int)DIGESTSIZE);
+}
+
+template <class BC, class H, class Info>
+DataEncryptor<BC,H,Info>::DataEncryptor(const byte *passphrase, size_t passphraseLength, BufferedTransformation *attachment)
+	: ProxyFilter(NULLPTR, 0, 0, attachment), m_passphrase(passphrase, passphraseLength)
+{
+	CRYPTOPP_COMPILE_ASSERT((int)SALTLENGTH <= (int)DIGESTSIZE);
+	CRYPTOPP_COMPILE_ASSERT((int)BLOCKSIZE <= (int)DIGESTSIZE);
+}
+
+template <class BC, class H, class Info>
+void DataEncryptor<BC,H,Info>::FirstPut(const byte *)
+{
+	SecByteBlock salt(DIGESTSIZE), keyCheck(DIGESTSIZE);
+	H hash;
+
+	// use hash(passphrase | time | clock) as salt
+	hash.Update(m_passphrase, m_passphrase.size());
+	time_t t=time(NULLPTR);
+	hash.Update((byte *)&t, sizeof(t));
+	clock_t c=clock();
+	hash.Update((byte *)&c, sizeof(c));
+	hash.Final(salt);
+
+	// use hash(passphrase | salt) as key check
+	hash.Update(m_passphrase, m_passphrase.size());
+	hash.Update(salt, SALTLENGTH);
+	hash.Final(keyCheck);
+
+	AttachedTransformation()->Put(salt, SALTLENGTH);
+
+	// mash passphrase and salt together into key and IV
+	SecByteBlock key(KEYLENGTH);
+	SecByteBlock IV(BLOCKSIZE);
+	GenerateKeyIV<BC,H,Info>(m_passphrase, m_passphrase.size(), salt, SALTLENGTH, ITERATIONS, key, IV);
+
+	m_cipher.SetKeyWithIV(key, key.size(), IV);
+	SetFilter(new StreamTransformationFilter(m_cipher));
+
+	m_filter->Put(keyCheck, BLOCKSIZE);
+}
+
+template <class BC, class H, class Info>
+void DataEncryptor<BC,H,Info>::LastPut(const byte *inString, size_t length)
+{
+	CRYPTOPP_UNUSED(inString); CRYPTOPP_UNUSED(length);
+	m_filter->MessageEnd();
+}
+
+// ********************************************************
+
+template <class BC, class H, class Info>
+DataDecryptor<BC,H,Info>::DataDecryptor(const char *p, BufferedTransformation *attachment, bool throwException)
+	: ProxyFilter(NULLPTR, EnumToInt(SALTLENGTH)+EnumToInt(BLOCKSIZE), 0, attachment)
+	, m_state(WAITING_FOR_KEYCHECK)
+	, m_passphrase((const byte *)p, strlen(p))
+	, m_throwException(throwException)
+{
+	CRYPTOPP_COMPILE_ASSERT((int)SALTLENGTH <= (int)DIGESTSIZE);
+	CRYPTOPP_COMPILE_ASSERT((int)BLOCKSIZE <= (int)DIGESTSIZE);
+}
+
+template <class BC, class H, class Info>
+DataDecryptor<BC,H,Info>::DataDecryptor(const byte *passphrase, size_t passphraseLength, BufferedTransformation *attachment, bool throwException)
+	: ProxyFilter(NULLPTR, EnumToInt(SALTLENGTH)+EnumToInt(BLOCKSIZE), 0, attachment)
+	, m_state(WAITING_FOR_KEYCHECK)
+	, m_passphrase(passphrase, passphraseLength)
+	, m_throwException(throwException)
+{
+	CRYPTOPP_COMPILE_ASSERT((int)SALTLENGTH <= (int)DIGESTSIZE);
+	CRYPTOPP_COMPILE_ASSERT((int)BLOCKSIZE <= (int)DIGESTSIZE);
+}
+
+template <class BC, class H, class Info>
+void DataDecryptor<BC,H,Info>::FirstPut(const byte *inString)
+{
+	CheckKey(inString, inString+SALTLENGTH);
+}
+
+template <class BC, class H, class Info>
+void DataDecryptor<BC,H,Info>::LastPut(const byte *inString, size_t length)
+{
+	CRYPTOPP_UNUSED(inString); CRYPTOPP_UNUSED(length);
+	if (m_filter.get() == NULLPTR)
+	{
+		m_state = KEY_BAD;
+		if (m_throwException)
+			throw KeyBadErr();
+	}
+	else
+	{
+		m_filter->MessageEnd();
+		m_state = WAITING_FOR_KEYCHECK;
+	}
+}
+
+template <class BC, class H, class Info>
+void DataDecryptor<BC,H,Info>::CheckKey(const byte *salt, const byte *keyCheck)
+{
+	SecByteBlock check(STDMAX((unsigned int)2*BLOCKSIZE, (unsigned int)DIGESTSIZE));
+
+	H hash;
+	hash.Update(m_passphrase, m_passphrase.size());
+	hash.Update(salt, SALTLENGTH);
+	hash.Final(check);
+
+	SecByteBlock key(KEYLENGTH);
+	SecByteBlock IV(BLOCKSIZE);
+	GenerateKeyIV<BC,H,Info>(m_passphrase, m_passphrase.size(), salt, SALTLENGTH, ITERATIONS, key, IV);
+
+	m_cipher.SetKeyWithIV(key, key.size(), IV);
+	member_ptr<StreamTransformationFilter> decryptor(new StreamTransformationFilter(m_cipher));
+
+	decryptor->Put(keyCheck, BLOCKSIZE);
+	decryptor->ForceNextPut();
+	decryptor->Get(check+EnumToInt(BLOCKSIZE), BLOCKSIZE);
+
+	SetFilter(decryptor.release());
+
+	if (!VerifyBufsEqual(check, check+EnumToInt(BLOCKSIZE), BLOCKSIZE))
+	{
+		m_state = KEY_BAD;
+		if (m_throwException)
+			throw KeyBadErr();
+	}
+	else
+		m_state = KEY_GOOD;
+}
+
+// ********************************************************
+
+template <class H, class MAC>
+static MAC* NewDataEncryptorMAC(const byte *passphrase, size_t passphraseLength)
+{
+	size_t macKeyLength = MAC::StaticGetValidKeyLength(16);
+	SecByteBlock macKey(macKeyLength);
+	// since the MAC is encrypted there is no reason to mash the passphrase for many iterations
+	Mash<H>(passphrase, passphraseLength, macKey, macKeyLength, 1);
+	return new MAC(macKey, macKeyLength);
+}
+
+template <class BC, class H, class MAC, class Info>
+DataEncryptorWithMAC<BC,H,MAC,Info>::DataEncryptorWithMAC(const char *passphrase, BufferedTransformation *attachment)
+	: ProxyFilter(NULLPTR, 0, 0, attachment)
+	, m_mac(NewDataEncryptorMAC<H,MAC>((const byte *)passphrase, strlen(passphrase)))
+{
+	SetFilter(new HashFilter(*m_mac, new DataEncryptor<BC,H,Info>(passphrase), true));
+}
+
+template <class BC, class H, class MAC, class Info>
+DataEncryptorWithMAC<BC,H,MAC,Info>::DataEncryptorWithMAC(const byte *passphrase, size_t passphraseLength, BufferedTransformation *attachment)
+	: ProxyFilter(NULLPTR, 0, 0, attachment)
+	, m_mac(NewDataEncryptorMAC<H,MAC>(passphrase, passphraseLength))
+{
+	SetFilter(new HashFilter(*m_mac, new DataEncryptor<BC,H,Info>(passphrase, passphraseLength), true));
+}
+
+template <class BC, class H, class MAC, class Info>
+void DataEncryptorWithMAC<BC,H,MAC,Info>::LastPut(const byte *inString, size_t length)
+{
+	CRYPTOPP_UNUSED(inString); CRYPTOPP_UNUSED(length);
+	m_filter->MessageEnd();
+}
+
+// ********************************************************
+
+template <class BC, class H, class MAC, class Info>
+DataDecryptorWithMAC<BC,H,MAC,Info>::DataDecryptorWithMAC(const char *passphrase, BufferedTransformation *attachment, bool throwException)
+	: ProxyFilter(NULLPTR, 0, 0, attachment)
+	, m_mac(NewDataEncryptorMAC<H,MAC>((const byte *)passphrase, strlen(passphrase)))
+	, m_throwException(throwException)
+{
+	SetFilter(new DataDecryptor<BC,H,Info>(passphrase, m_hashVerifier=new HashVerificationFilter(*m_mac, NULLPTR, HashVerificationFilter::PUT_MESSAGE), throwException));
+}
+
+template <class BC, class H, class MAC, class Info>
+DataDecryptorWithMAC<BC,H,MAC,Info>::DataDecryptorWithMAC(const byte *passphrase, size_t passphraseLength, BufferedTransformation *attachment, bool throwException)
+	: ProxyFilter(NULLPTR, 0, 0, attachment)
+	, m_mac(NewDataEncryptorMAC<H,MAC>(passphrase, passphraseLength))
+	, m_throwException(throwException)
+{
+	SetFilter(new DataDecryptor<BC,H,Info>(passphrase, passphraseLength, m_hashVerifier=new HashVerificationFilter(*m_mac, NULLPTR, HashVerificationFilter::PUT_MESSAGE), throwException));
+}
+
+template <class BC, class H, class MAC, class Info>
+typename DataDecryptor<BC,H,Info>::State DataDecryptorWithMAC<BC,H,MAC,Info>::CurrentState() const
+{
+	return static_cast<const DataDecryptor<BC,H,Info> *>(m_filter.get())->CurrentState();
+}
+
+template <class BC, class H, class MAC, class Info>
+bool DataDecryptorWithMAC<BC,H,MAC,Info>::CheckLastMAC() const
+{
+	return m_hashVerifier->GetLastResult();
+}
+
+template <class BC, class H, class MAC, class Info>
+void DataDecryptorWithMAC<BC,H,MAC,Info>::LastPut(const byte *inString, size_t length)
+{
+	CRYPTOPP_UNUSED(inString); CRYPTOPP_UNUSED(length);
+	m_filter->MessageEnd();
+	if (m_throwException && !CheckLastMAC())
+		throw MACBadErr();
+}
+
+template struct DataParametersInfo<LegacyBlockCipher::BLOCKSIZE, LegacyBlockCipher::DEFAULT_KEYLENGTH, LegacyHashModule::DIGESTSIZE, 8, 200>;
+template struct DataParametersInfo<DefaultBlockCipher::BLOCKSIZE, DefaultBlockCipher::DEFAULT_KEYLENGTH, DefaultHashModule::DIGESTSIZE, 8, 2500>;
+
+template class DataEncryptor<LegacyBlockCipher,LegacyHashModule,LegacyParametersInfo>;
+template class DataDecryptor<LegacyBlockCipher,LegacyHashModule,LegacyParametersInfo>;
+template class DataEncryptor<DefaultBlockCipher,DefaultHashModule,DefaultParametersInfo>;
+template class DataDecryptor<DefaultBlockCipher,DefaultHashModule,DefaultParametersInfo>;
+template class DataEncryptorWithMAC<LegacyBlockCipher,LegacyHashModule,LegacyMAC,LegacyParametersInfo>;
+template class DataDecryptorWithMAC<LegacyBlockCipher,LegacyHashModule,LegacyMAC,LegacyParametersInfo>;
+template class DataEncryptorWithMAC<DefaultBlockCipher,DefaultHashModule,DefaultMAC,DefaultParametersInfo>;
+template class DataDecryptorWithMAC<DefaultBlockCipher,DefaultHashModule,DefaultMAC,DefaultParametersInfo>;
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/default.h b/runtime/third_party/cryptopp/default.h
new file mode 100644
index 0000000..cb24afb
--- /dev/null
+++ b/runtime/third_party/cryptopp/default.h
@@ -0,0 +1,310 @@
+// default.h - originally written and placed in the public domain by Wei Dai
+
+/// \file default.h
+/// \brief Classes for DefaultEncryptor, DefaultDecryptor, DefaultEncryptorWithMAC and DefaultDecryptorWithMAC
+
+#ifndef CRYPTOPP_DEFAULT_H
+#define CRYPTOPP_DEFAULT_H
+
+#include "sha.h"
+#include "hmac.h"
+#include "aes.h"
+#include "des.h"
+#include "modes.h"
+#include "filters.h"
+#include "smartptr.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Legacy block cipher for LegacyEncryptor, LegacyDecryptor, LegacyEncryptorWithMAC and LegacyDecryptorWithMAC
+typedef DES_EDE2 LegacyBlockCipher;
+/// \brief Legacy hash for use with LegacyEncryptorWithMAC and LegacyDecryptorWithMAC
+typedef SHA1 LegacyHashModule;
+/// \brief Legacy HMAC for use withLegacyEncryptorWithMAC and LegacyDecryptorWithMAC
+typedef HMAC<LegacyHashModule> LegacyMAC;
+
+/// \brief Default block cipher for DefaultEncryptor, DefaultDecryptor, DefaultEncryptorWithMAC and DefaultDecryptorWithMAC
+typedef AES DefaultBlockCipher;
+/// \brief Default hash for use with DefaultEncryptorWithMAC and DefaultDecryptorWithMAC
+typedef SHA256 DefaultHashModule;
+/// \brief Default HMAC for use withDefaultEncryptorWithMAC and DefaultDecryptorWithMAC
+typedef HMAC<DefaultHashModule> DefaultMAC;
+
+/// \brief Exception thrown when LegacyDecryptorWithMAC or DefaultDecryptorWithMAC decryption error is encountered
+class DataDecryptorErr : public Exception
+{
+public:
+	DataDecryptorErr(const std::string &s)
+		: Exception(DATA_INTEGRITY_CHECK_FAILED, s) {}
+};
+
+/// \brief Exception thrown when a bad key is encountered in DefaultDecryptorWithMAC and LegacyDecryptorWithMAC
+class KeyBadErr : public DataDecryptorErr
+{
+	public: KeyBadErr()
+		: DataDecryptorErr("DataDecryptor: cannot decrypt message with this passphrase") {}
+};
+
+/// \brief Exception thrown when an incorrect MAC is encountered in DefaultDecryptorWithMAC and LegacyDecryptorWithMAC
+class MACBadErr : public DataDecryptorErr
+{
+	public: MACBadErr()
+		: DataDecryptorErr("DataDecryptorWithMAC: MAC check failed") {}
+};
+
+/// \brief Algorithm information for password-based encryptors and decryptors
+template <unsigned int BlockSize, unsigned int KeyLength, unsigned int DigestSize, unsigned int SaltSize, unsigned int Iterations>
+struct DataParametersInfo
+{
+	CRYPTOPP_CONSTANT(BLOCKSIZE  = BlockSize);
+	CRYPTOPP_CONSTANT(KEYLENGTH  = KeyLength);
+	CRYPTOPP_CONSTANT(SALTLENGTH = SaltSize);
+	CRYPTOPP_CONSTANT(DIGESTSIZE = DigestSize);
+	CRYPTOPP_CONSTANT(ITERATIONS = Iterations);
+};
+
+typedef DataParametersInfo<LegacyBlockCipher::BLOCKSIZE, LegacyBlockCipher::DEFAULT_KEYLENGTH, LegacyHashModule::DIGESTSIZE, 8, 200> LegacyParametersInfo;
+typedef DataParametersInfo<DefaultBlockCipher::BLOCKSIZE, DefaultBlockCipher::DEFAULT_KEYLENGTH, DefaultHashModule::DIGESTSIZE, 8, 2500> DefaultParametersInfo;
+
+/// \brief Password-based Encryptor
+/// \tparam BC BlockCipher based class used for encryption
+/// \tparam H HashTransformation based class used for mashing
+/// \tparam Info Constants used by the algorithms
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256.
+/// \sa DefaultEncryptor, DefaultDecryptor, LegacyEncryptor, LegacyDecryptor
+/// \since Crypto++ 2.0
+template <class BC, class H, class Info>
+class DataEncryptor : public ProxyFilter, public Info
+{
+public:
+	CRYPTOPP_CONSTANT(BLOCKSIZE  = Info::BLOCKSIZE);
+	CRYPTOPP_CONSTANT(KEYLENGTH  = Info::KEYLENGTH);
+	CRYPTOPP_CONSTANT(SALTLENGTH = Info::SALTLENGTH);
+	CRYPTOPP_CONSTANT(DIGESTSIZE = Info::DIGESTSIZE);
+	CRYPTOPP_CONSTANT(ITERATIONS = Info::ITERATIONS);
+
+	/// \brief Construct a DataEncryptor
+	/// \param passphrase a C-String password
+	/// \param attachment a BufferedTransformation to attach to this object
+	DataEncryptor(const char *passphrase, BufferedTransformation *attachment = NULLPTR);
+
+	/// \brief Construct a DataEncryptor
+	/// \param passphrase a byte string password
+	/// \param passphraseLength the length of the byte string password
+	/// \param attachment a BufferedTransformation to attach to this object
+	DataEncryptor(const byte *passphrase, size_t passphraseLength, BufferedTransformation *attachment = NULLPTR);
+
+protected:
+	void FirstPut(const byte *);
+	void LastPut(const byte *inString, size_t length);
+
+private:
+	SecByteBlock m_passphrase;
+	typename CBC_Mode<BC>::Encryption m_cipher;
+};
+
+/// \brief Password-based Decryptor
+/// \tparam BC BlockCipher based class used for encryption
+/// \tparam H HashTransformation based class used for mashing
+/// \tparam Info Constants used by the algorithms
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256.
+/// \sa DefaultEncryptor, DefaultDecryptor, LegacyEncryptor, LegacyDecryptor
+/// \since Crypto++ 2.0
+template <class BC, class H, class Info>
+class DataDecryptor : public ProxyFilter, public Info
+{
+public:
+	CRYPTOPP_CONSTANT(BLOCKSIZE  = Info::BLOCKSIZE);
+	CRYPTOPP_CONSTANT(KEYLENGTH  = Info::KEYLENGTH);
+	CRYPTOPP_CONSTANT(SALTLENGTH = Info::SALTLENGTH);
+	CRYPTOPP_CONSTANT(DIGESTSIZE = Info::DIGESTSIZE);
+	CRYPTOPP_CONSTANT(ITERATIONS = Info::ITERATIONS);
+
+	/// \brief Constructs a DataDecryptor
+	/// \param passphrase a C-String password
+	/// \param attachment a BufferedTransformation to attach to this object
+	/// \param throwException a flag specifying whether an Exception should be thrown on error
+	DataDecryptor(const char *passphrase, BufferedTransformation *attachment = NULLPTR, bool throwException=true);
+
+	/// \brief Constructs a DataDecryptor
+	/// \param passphrase a byte string password
+	/// \param passphraseLength the length of the byte string password
+	/// \param attachment a BufferedTransformation to attach to this object
+	/// \param throwException a flag specifying whether an Exception should be thrown on error
+	DataDecryptor(const byte *passphrase, size_t passphraseLength, BufferedTransformation *attachment = NULLPTR, bool throwException=true);
+
+	enum State {WAITING_FOR_KEYCHECK, KEY_GOOD, KEY_BAD};
+	State CurrentState() const {return m_state;}
+
+protected:
+	void FirstPut(const byte *inString);
+	void LastPut(const byte *inString, size_t length);
+
+	State m_state;
+
+private:
+	void CheckKey(const byte *salt, const byte *keyCheck);
+
+	SecByteBlock m_passphrase;
+	typename CBC_Mode<BC>::Decryption m_cipher;
+	member_ptr<FilterWithBufferedInput> m_decryptor;
+	bool m_throwException;
+
+};
+
+/// \brief Password-based encryptor with MAC
+/// \tparam BC BlockCipher based class used for encryption
+/// \tparam H HashTransformation based class used for mashing
+/// \tparam MAC HashTransformation based class used for authentication
+/// \tparam Info Constants used by the algorithms
+/// \details DataEncryptorWithMAC uses a non-standard mashup function called Mash() to derive key
+///   bits from the password.
+/// \details The purpose of the function Mash() is to take an arbitrary length input string and
+///   *deterministically* produce an arbitrary length output string such that (1) it looks random,
+///   (2) no information about the input is deducible from it, and (3) it contains as much entropy
+///   as it can hold, or the amount of entropy in the input string, whichever is smaller.
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256.
+/// \sa DefaultEncryptorWithMAC, DefaultDecryptorWithMAC, LegacyDecryptorWithMAC, LegacyEncryptorWithMAC
+/// \since Crypto++ 2.0
+template <class BC, class H, class MAC, class Info>
+class DataEncryptorWithMAC : public ProxyFilter
+{
+public:
+	CRYPTOPP_CONSTANT(BLOCKSIZE  = Info::BLOCKSIZE);
+	CRYPTOPP_CONSTANT(KEYLENGTH  = Info::KEYLENGTH);
+	CRYPTOPP_CONSTANT(SALTLENGTH = Info::SALTLENGTH);
+	CRYPTOPP_CONSTANT(DIGESTSIZE = Info::DIGESTSIZE);
+	CRYPTOPP_CONSTANT(ITERATIONS = Info::ITERATIONS);
+
+	/// \brief Constructs a DataEncryptorWithMAC
+	/// \param passphrase a C-String password
+	/// \param attachment a BufferedTransformation to attach to this object
+	DataEncryptorWithMAC(const char *passphrase, BufferedTransformation *attachment = NULLPTR);
+
+	/// \brief Constructs a DataEncryptorWithMAC
+	/// \param passphrase a byte string password
+	/// \param passphraseLength the length of the byte string password
+	/// \param attachment a BufferedTransformation to attach to this object
+	DataEncryptorWithMAC(const byte *passphrase, size_t passphraseLength, BufferedTransformation *attachment = NULLPTR);
+
+protected:
+	void FirstPut(const byte *inString) {CRYPTOPP_UNUSED(inString);}
+	void LastPut(const byte *inString, size_t length);
+
+private:
+	member_ptr<MAC> m_mac;
+
+};
+
+/// \brief Password-based decryptor with MAC
+/// \tparam BC BlockCipher based class used for encryption
+/// \tparam H HashTransformation based class used for mashing
+/// \tparam MAC HashTransformation based class used for authentication
+/// \tparam Info Constants used by the algorithms
+/// \details DataDecryptorWithMAC uses a non-standard mashup function called Mash() to derive key
+///   bits from the password.
+/// \details The purpose of the function Mash() is to take an arbitrary length input string and
+///   *deterministically* produce an arbitrary length output string such that (1) it looks random,
+///   (2) no information about the input is deducible from it, and (3) it contains as much entropy
+///   as it can hold, or the amount of entropy in the input string, whichever is smaller.
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256.
+/// \sa DefaultEncryptorWithMAC, DefaultDecryptorWithMAC, LegacyDecryptorWithMAC, LegacyEncryptorWithMAC
+/// \since Crypto++ 2.0
+template <class BC, class H, class MAC, class Info>
+class DataDecryptorWithMAC : public ProxyFilter
+{
+public:
+	CRYPTOPP_CONSTANT(BLOCKSIZE  = Info::BLOCKSIZE);
+	CRYPTOPP_CONSTANT(KEYLENGTH  = Info::KEYLENGTH);
+	CRYPTOPP_CONSTANT(SALTLENGTH = Info::SALTLENGTH);
+	CRYPTOPP_CONSTANT(DIGESTSIZE = Info::DIGESTSIZE);
+	CRYPTOPP_CONSTANT(ITERATIONS = Info::ITERATIONS);
+
+	/// \brief Constructs a DataDecryptor
+	/// \param passphrase a C-String password
+	/// \param attachment a BufferedTransformation to attach to this object
+	/// \param throwException a flag specifying whether an Exception should be thrown on error
+	DataDecryptorWithMAC(const char *passphrase, BufferedTransformation *attachment = NULLPTR, bool throwException=true);
+
+	/// \brief Constructs a DataDecryptor
+	/// \param passphrase a byte string password
+	/// \param passphraseLength the length of the byte string password
+	/// \param attachment a BufferedTransformation to attach to this object
+	/// \param throwException a flag specifying whether an Exception should be thrown on error
+	DataDecryptorWithMAC(const byte *passphrase, size_t passphraseLength, BufferedTransformation *attachment = NULLPTR, bool throwException=true);
+
+	typename DataDecryptor<BC,H,Info>::State CurrentState() const;
+	bool CheckLastMAC() const;
+
+protected:
+	void FirstPut(const byte *inString) {CRYPTOPP_UNUSED(inString);}
+	void LastPut(const byte *inString, size_t length);
+
+private:
+	member_ptr<MAC> m_mac;
+	HashVerificationFilter *m_hashVerifier;
+	bool m_throwException;
+};
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Password-based encryptor (deprecated)
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256. The updated algorithms are available with the
+///   <tt>Default*</tt> classes, and the old algorithms are available with the <tt>Legacy*</tt> classes.
+struct LegacyEncryptor : public DataEncryptor<LegacyBlockCipher,LegacyHashModule,LegacyParametersInfo> {};
+/// \brief Password-based decryptor (deprecated)
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256. The updated algorithms are available with the
+///   <tt>Default*</tt> classes, and the old algorithms are available with the <tt>Legacy*</tt> classes.
+struct LegacyDecryptor : public DataDecryptor<LegacyBlockCipher,LegacyHashModule,LegacyParametersInfo> {};
+/// \brief Password-based encryptor
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256. The updated algorithms are available with the
+///   <tt>Default*</tt> classes, and the old algorithms are available with the <tt>Legacy*</tt> classes.
+struct DefaultEncryptor : public DataEncryptor<DefaultBlockCipher,DefaultHashModule,DefaultParametersInfo> {};
+/// \brief Password-based decryptor
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256. The updated algorithms are available with the
+///   <tt>Default*</tt> classes, and the old algorithms are available with the <tt>Legacy*</tt> classes.
+struct DefaultDecryptor : public DataDecryptor<DefaultBlockCipher,DefaultHashModule,DefaultParametersInfo> {};
+/// \brief Password-based encryptor with MAC (deprecated)
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256. The updated algorithms are available with the
+///   <tt>Default*</tt> classes, and the old algorithms are available with the <tt>Legacy*</tt> classes.
+struct LegacyEncryptorWithMAC : public DataEncryptorWithMAC<LegacyBlockCipher,LegacyHashModule,LegacyMAC,LegacyParametersInfo> {};
+/// \brief Password-based decryptor with MAC (deprecated)
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256. The updated algorithms are available with the
+///   <tt>Default*</tt> classes, and the old algorithms are available with the <tt>Legacy*</tt> classes.
+struct LegacyDecryptorWithMAC : public DataDecryptorWithMAC<LegacyBlockCipher,LegacyHashModule,LegacyMAC,LegacyParametersInfo> {};
+/// \brief Password-based encryptor with MAC
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256. The updated algorithms are available with the
+///   <tt>Default*</tt> classes, and the old algorithms are available with the <tt>Legacy*</tt> classes.
+struct DefaultEncryptorWithMAC : public DataEncryptorWithMAC<DefaultBlockCipher,DefaultHashModule,DefaultMAC,DefaultParametersInfo> {};
+/// \brief Password-based decryptor with MAC
+/// \details Crypto++ 5.6.5 and earlier used the legacy algorithms, including DES_EDE2 and SHA1.
+///   Crypto++ 5.7 switched to AES and SHA256. The updated algorithms are available with the
+///   <tt>Default*</tt> classes, and the old algorithms are available with the <tt>Legacy*</tt> classes.
+struct DefaultDecryptorWithMAC : public DataDecryptorWithMAC<DefaultBlockCipher,DefaultHashModule,DefaultMAC,DefaultParametersInfo> {};
+#else
+typedef DataEncryptor<LegacyBlockCipher,LegacyHashModule,LegacyParametersInfo> LegacyEncryptor;
+typedef DataDecryptor<LegacyBlockCipher,LegacyHashModule,LegacyParametersInfo> LegacyDecryptor;
+
+typedef DataEncryptor<DefaultBlockCipher,DefaultHashModule,DefaultParametersInfo> DefaultEncryptor;
+typedef DataDecryptor<DefaultBlockCipher,DefaultHashModule,DefaultParametersInfo> DefaultDecryptor;
+
+typedef DataEncryptorWithMAC<LegacyBlockCipher,LegacyHashModule,LegacyMAC,LegacyParametersInfo> LegacyEncryptorWithMAC;
+typedef DataDecryptorWithMAC<LegacyBlockCipher,LegacyHashModule,LegacyMAC,LegacyParametersInfo> LegacyDecryptorWithMAC;
+
+typedef DataEncryptorWithMAC<DefaultBlockCipher,DefaultHashModule,DefaultMAC,DefaultParametersInfo> DefaultEncryptorWithMAC;
+typedef DataDecryptorWithMAC<DefaultBlockCipher,DefaultHashModule,DefaultMAC,DefaultParametersInfo> DefaultDecryptorWithMAC;
+#endif
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/des.cpp b/runtime/third_party/cryptopp/des.cpp
new file mode 100644
index 0000000..30b3107
--- /dev/null
+++ b/runtime/third_party/cryptopp/des.cpp
@@ -0,0 +1,465 @@
+// des.cpp - modified by Wei Dai from Phil Karn's des.c
+// The original code and all modifications are in the public domain.
+
+/*
+ * This is a major rewrite of my old public domain DES code written
+ * circa 1987, which in turn borrowed heavily from Jim Gillogly's 1977
+ * public domain code. I pretty much kept my key scheduling code, but
+ * the actual encrypt/decrypt routines are taken from from Richard
+ * Outerbridge's DES code as printed in Schneier's "Applied Cryptography."
+ *
+ * This code is in the public domain. I would appreciate bug reports and
+ * enhancements.
+ *
+ * Phil Karn KA9Q, karn@unix.ka9q.ampr.org, August 1994.
+ */
+
+#include "pch.h"
+#include "misc.h"
+#include "des.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+typedef BlockGetAndPut<word32, BigEndian> Block;
+
+// Richard Outerbridge's initial permutation algorithm
+/*
+inline void IPERM(word32 &left, word32 &right)
+{
+	word32 work;
+
+	work = ((left >> 4) ^ right) & 0x0f0f0f0f;
+	right ^= work;
+	left ^= work << 4;
+	work = ((left >> 16) ^ right) & 0xffff;
+	right ^= work;
+	left ^= work << 16;
+	work = ((right >> 2) ^ left) & 0x33333333;
+	left ^= work;
+	right ^= (work << 2);
+	work = ((right >> 8) ^ left) & 0xff00ff;
+	left ^= work;
+	right ^= (work << 8);
+	right = rotl(right, 1);
+	work = (left ^ right) & 0xaaaaaaaa;
+	left ^= work;
+	right ^= work;
+	left = rotl(left, 1);
+}
+inline void FPERM(word32 &left, word32 &right)
+{
+	word32 work;
+
+	right = rotr(right, 1);
+	work = (left ^ right) & 0xaaaaaaaa;
+	left ^= work;
+	right ^= work;
+	left = rotr(left, 1);
+	work = ((left >> 8) ^ right) & 0xff00ff;
+	right ^= work;
+	left ^= work << 8;
+	work = ((left >> 2) ^ right) & 0x33333333;
+	right ^= work;
+	left ^= work << 2;
+	work = ((right >> 16) ^ left) & 0xffff;
+	left ^= work;
+	right ^= work << 16;
+	work = ((right >> 4) ^ left) & 0x0f0f0f0f;
+	left ^= work;
+	right ^= work << 4;
+}
+*/
+
+// Wei Dai's modification to Richard Outerbridge's initial permutation
+// algorithm, this one is faster if you have access to rotate instructions
+// (like in MSVC)
+static inline void IPERM(word32 &left, word32 &right)
+{
+	word32 work;
+
+	right = rotlConstant<4>(right);
+	work = (left ^ right) & 0xf0f0f0f0;
+	left ^= work;
+	right = rotrConstant<20>(right^work);
+	work = (left ^ right) & 0xffff0000;
+	left ^= work;
+	right = rotrConstant<18>(right^work);
+	work = (left ^ right) & 0x33333333;
+	left ^= work;
+	right = rotrConstant<6>(right^work);
+	work = (left ^ right) & 0x00ff00ff;
+	left ^= work;
+	right = rotlConstant<9>(right^work);
+	work = (left ^ right) & 0xaaaaaaaa;
+	left = rotlConstant<1>(left^work);
+	right ^= work;
+}
+
+static inline void FPERM(word32 &left, word32 &right)
+{
+	word32 work;
+
+	right = rotrConstant<1>(right);
+	work = (left ^ right) & 0xaaaaaaaa;
+	right ^= work;
+	left = rotrConstant<9>(left^work);
+	work = (left ^ right) & 0x00ff00ff;
+	right ^= work;
+	left = rotlConstant<6>(left^work);
+	work = (left ^ right) & 0x33333333;
+	right ^= work;
+	left = rotlConstant<18>(left^work);
+	work = (left ^ right) & 0xffff0000;
+	right ^= work;
+	left = rotlConstant<20>(left^work);
+	work = (left ^ right) & 0xf0f0f0f0;
+	right ^= work;
+	left = rotrConstant<4>(left^work);
+}
+
+void DES::Base::UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &)
+{
+	AssertValidKeyLength(length);
+
+	RawSetKey(GetCipherDirection(), userKey);
+}
+
+#ifndef CRYPTOPP_IMPORTS
+
+/* Tables defined in the Data Encryption Standard documents
+ * Three of these tables, the initial permutation, the final
+ * permutation and the expansion operator, are regular enough that
+ * for speed, we hard-code them. They're here for reference only.
+ * Also, the S and P boxes are used by a separate program, gensp.c,
+ * to build the combined SP box, Spbox[]. They're also here just
+ * for reference.
+ */
+#ifdef notdef
+/* initial permutation IP */
+static byte ip[] = {
+	   58, 50, 42, 34, 26, 18, 10,  2,
+	   60, 52, 44, 36, 28, 20, 12,  4,
+	   62, 54, 46, 38, 30, 22, 14,  6,
+	   64, 56, 48, 40, 32, 24, 16,  8,
+	   57, 49, 41, 33, 25, 17,  9,  1,
+	   59, 51, 43, 35, 27, 19, 11,  3,
+	   61, 53, 45, 37, 29, 21, 13,  5,
+	   63, 55, 47, 39, 31, 23, 15,  7
+};
+
+/* final permutation IP^-1 */
+static byte fp[] = {
+	   40,  8, 48, 16, 56, 24, 64, 32,
+	   39,  7, 47, 15, 55, 23, 63, 31,
+	   38,  6, 46, 14, 54, 22, 62, 30,
+	   37,  5, 45, 13, 53, 21, 61, 29,
+	   36,  4, 44, 12, 52, 20, 60, 28,
+	   35,  3, 43, 11, 51, 19, 59, 27,
+	   34,  2, 42, 10, 50, 18, 58, 26,
+	   33,  1, 41,  9, 49, 17, 57, 25
+};
+/* expansion operation matrix */
+static byte ei[] = {
+	   32,  1,  2,  3,  4,  5,
+		4,  5,  6,  7,  8,  9,
+		8,  9, 10, 11, 12, 13,
+	   12, 13, 14, 15, 16, 17,
+	   16, 17, 18, 19, 20, 21,
+	   20, 21, 22, 23, 24, 25,
+	   24, 25, 26, 27, 28, 29,
+	   28, 29, 30, 31, 32,  1
+};
+/* The (in)famous S-boxes */
+static byte sbox[8][64] = {
+	   /* S1 */
+	   14,  4, 13,  1,  2, 15, 11,  8,  3, 10,  6, 12,  5,  9,  0,  7,
+		0, 15,  7,  4, 14,  2, 13,  1, 10,  6, 12, 11,  9,  5,  3,  8,
+		4,  1, 14,  8, 13,  6,  2, 11, 15, 12,  9,  7,  3, 10,  5,  0,
+	   15, 12,  8,  2,  4,  9,  1,  7,  5, 11,  3, 14, 10,  0,  6, 13,
+
+	   /* S2 */
+	   15,  1,  8, 14,  6, 11,  3,  4,  9,  7,  2, 13, 12,  0,  5, 10,
+		3, 13,  4,  7, 15,  2,  8, 14, 12,  0,  1, 10,  6,  9, 11,  5,
+		0, 14,  7, 11, 10,  4, 13,  1,  5,  8, 12,  6,  9,  3,  2, 15,
+	   13,  8, 10,  1,  3, 15,  4,  2, 11,  6,  7, 12,  0,  5, 14,  9,
+
+	   /* S3 */
+	   10,  0,  9, 14,  6,  3, 15,  5,  1, 13, 12,  7, 11,  4,  2,  8,
+	   13,  7,  0,  9,  3,  4,  6, 10,  2,  8,  5, 14, 12, 11, 15,  1,
+	   13,  6,  4,  9,  8, 15,  3,  0, 11,  1,  2, 12,  5, 10, 14,  7,
+		1, 10, 13,  0,  6,  9,  8,  7,  4, 15, 14,  3, 11,  5,  2, 12,
+
+	   /* S4 */
+		7, 13, 14,  3,  0,  6,  9, 10,  1,  2,  8,  5, 11, 12,  4, 15,
+	   13,  8, 11,  5,  6, 15,  0,  3,  4,  7,  2, 12,  1, 10, 14,  9,
+	   10,  6,  9,  0, 12, 11,  7, 13, 15,  1,  3, 14,  5,  2,  8,  4,
+		3, 15,  0,  6, 10,  1, 13,  8,  9,  4,  5, 11, 12,  7,  2, 14,
+
+	   /* S5 */
+		2, 12,  4,  1,  7, 10, 11,  6,  8,  5,  3, 15, 13,  0, 14,  9,
+	   14, 11,  2, 12,  4,  7, 13,  1,  5,  0, 15, 10,  3,  9,  8,  6,
+		4,  2,  1, 11, 10, 13,  7,  8, 15,  9, 12,  5,  6,  3,  0, 14,
+	   11,  8, 12,  7,  1, 14,  2, 13,  6, 15,  0,  9, 10,  4,  5,  3,
+
+	   /* S6 */
+	   12,  1, 10, 15,  9,  2,  6,  8,  0, 13,  3,  4, 14,  7,  5, 11,
+	   10, 15,  4,  2,  7, 12,  9,  5,  6,  1, 13, 14,  0, 11,  3,  8,
+		9, 14, 15,  5,  2,  8, 12,  3,  7,  0,  4, 10,  1, 13, 11,  6,
+		4,  3,  2, 12,  9,  5, 15, 10, 11, 14,  1,  7,  6,  0,  8, 13,
+
+	   /* S7 */
+		4, 11,  2, 14, 15,  0,  8, 13,  3, 12,  9,  7,  5, 10,  6,  1,
+	   13,  0, 11,  7,  4,  9,  1, 10, 14,  3,  5, 12,  2, 15,  8,  6,
+		1,  4, 11, 13, 12,  3,  7, 14, 10, 15,  6,  8,  0,  5,  9,  2,
+		6, 11, 13,  8,  1,  4, 10,  7,  9,  5,  0, 15, 14,  2,  3, 12,
+
+	   /* S8 */
+	   13,  2,  8,  4,  6, 15, 11,  1, 10,  9,  3, 14,  5,  0, 12,  7,
+		1, 15, 13,  8, 10,  3,  7,  4, 12,  5,  6, 11,  0, 14,  9,  2,
+		7, 11,  4,  1,  9, 12, 14,  2,  0,  6, 10, 13, 15,  3,  5,  8,
+		2,  1, 14,  7,  4, 10,  8, 13, 15, 12,  9,  0,  3,  5,  6, 11
+};
+
+/* 32-bit permutation function P used on the output of the S-boxes */
+namespace {
+	const byte p32i[] = {
+	   16,  7, 20, 21,
+	   29, 12, 28, 17,
+		1, 15, 23, 26,
+		5, 18, 31, 10,
+		2,  8, 24, 14,
+	   32, 27,  3,  9,
+	   19, 13, 30,  6,
+	   22, 11,  4, 25
+	};
+}
+#endif
+
+/* permuted choice table (key) */
+namespace {
+	const byte pc1[] = {
+	   57, 49, 41, 33, 25, 17,  9,
+		1, 58, 50, 42, 34, 26, 18,
+	   10,  2, 59, 51, 43, 35, 27,
+	   19, 11,  3, 60, 52, 44, 36,
+
+	   63, 55, 47, 39, 31, 23, 15,
+		7, 62, 54, 46, 38, 30, 22,
+	   14,  6, 61, 53, 45, 37, 29,
+	   21, 13,  5, 28, 20, 12,  4
+	};
+}
+
+/* number left rotations of pc1 */
+namespace {
+	const byte totrot[] = {
+	   1,2,4,6,8,10,12,14,15,17,19,21,23,25,27,28
+	};
+}
+
+/* permuted choice key (table) */
+namespace {
+	const byte pc2[] = {
+	   14, 17, 11, 24,  1,  5,
+		3, 28, 15,  6, 21, 10,
+	   23, 19, 12,  4, 26,  8,
+	   16,  7, 27, 20, 13,  2,
+	   41, 52, 31, 37, 47, 55,
+	   30, 40, 51, 45, 33, 48,
+	   44, 49, 39, 56, 34, 53,
+	   46, 42, 50, 36, 29, 32
+	};
+}
+
+/* End of DES-defined tables */
+
+/* bit 0 is left-most in byte */
+namespace {
+	const int bytebit[] = {
+	   0200,0100,040,020,010,04,02,01
+	};
+}
+
+/* Set key (initialize key schedule array) */
+void RawDES::RawSetKey(CipherDir dir, const byte *key)
+{
+#if (CRYPTOPP_MSC_VERSION >= 1600) || (__cplusplus >= 201103L)
+# define REGISTER /* Define to nothing for C++11 and above */
+#else
+# define REGISTER register
+#endif
+
+	SecByteBlock buffer(56+56+8);
+	byte *const pc1m=buffer;                 /* place to modify pc1 into */
+	byte *const pcr=pc1m+56;                 /* place to rotate pc1 into */
+	byte *const ks=pcr+56;
+	REGISTER int i,j,l;
+	int m;
+
+	for (j=0; j<56; j++) {          /* convert pc1 to bits of key */
+		l=pc1[j]-1;             /* integer bit location  */
+		m = l & 07;             /* find bit              */
+		pc1m[j]=(key[l>>3] &    /* find which key byte l is in */
+			bytebit[m])     /* and which bit of that byte */
+			? 1 : 0;        /* and store 1-bit result */
+	}
+	for (i=0; i<16; i++) {          /* key chunk for each iteration */
+		std::memset(ks,0,8);         /* Clear key schedule */
+		for (j=0; j<56; j++)    /* rotate pc1 the right amount */
+			pcr[j] = pc1m[(l=j+totrot[i])<(j<28? 28 : 56) ? l: l-28];
+		/* rotate left and right halves independently */
+		for (j=0; j<48; j++){   /* select bits individually */
+			/* check bit that goes to ks[j] */
+			if (pcr[pc2[j]-1]){
+				/* mask it in if it's there */
+				l= j % 6;
+				ks[j/6] |= bytebit[l] >> 2;
+			}
+		}
+		/* Now convert to odd/even interleaved form for use in F */
+		k[2*i] = ((word32)ks[0] << 24)
+			| ((word32)ks[2] << 16)
+			| ((word32)ks[4] << 8)
+			| ((word32)ks[6]);
+		k[2*i+1] = ((word32)ks[1] << 24)
+			| ((word32)ks[3] << 16)
+			| ((word32)ks[5] << 8)
+			| ((word32)ks[7]);
+	}
+
+	if (dir==DECRYPTION)     // reverse key schedule order
+		for (i=0; i<16; i+=2)
+		{
+			std::swap(k[i], k[32-2-i]);
+			std::swap(k[i+1], k[32-1-i]);
+		}
+}
+
+void RawDES::RawProcessBlock(word32 &l_, word32 &r_) const
+{
+	word32 l = l_, r = r_;
+	const word32 *kptr=k;
+
+	for (unsigned i=0; i<8; i++)
+	{
+		word32 work = rotrConstant<4>(r) ^ kptr[4 * i + 0];
+		l ^= Spbox[6][(work) & 0x3f]
+		  ^  Spbox[4][(work >> 8) & 0x3f]
+		  ^  Spbox[2][(work >> 16) & 0x3f]
+		  ^  Spbox[0][(work >> 24) & 0x3f];
+		work = r ^ kptr[4*i+1];
+		l ^= Spbox[7][(work) & 0x3f]
+		  ^  Spbox[5][(work >> 8) & 0x3f]
+		  ^  Spbox[3][(work >> 16) & 0x3f]
+		  ^  Spbox[1][(work >> 24) & 0x3f];
+
+		work = rotrConstant<4>(l) ^ kptr[4 * i + 2];
+		r ^= Spbox[6][(work) & 0x3f]
+		  ^  Spbox[4][(work >> 8) & 0x3f]
+		  ^  Spbox[2][(work >> 16) & 0x3f]
+		  ^  Spbox[0][(work >> 24) & 0x3f];
+		work = l ^ kptr[4*i+3];
+		r ^= Spbox[7][(work) & 0x3f]
+		  ^  Spbox[5][(work >> 8) & 0x3f]
+		  ^  Spbox[3][(work >> 16) & 0x3f]
+		  ^  Spbox[1][(work >> 24) & 0x3f];
+	}
+
+	l_ = l; r_ = r;
+}
+
+void DES_EDE2::Base::UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &)
+{
+	AssertValidKeyLength(length);
+
+	m_des1.RawSetKey(GetCipherDirection(), userKey);
+	m_des2.RawSetKey(ReverseCipherDir(GetCipherDirection()), userKey+8);
+}
+
+void DES_EDE2::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 l,r;
+	Block::Get(inBlock)(l)(r);
+	IPERM(l,r);
+	m_des1.RawProcessBlock(l, r);
+	m_des2.RawProcessBlock(r, l);
+	m_des1.RawProcessBlock(l, r);
+	FPERM(l,r);
+	Block::Put(xorBlock, outBlock)(r)(l);
+}
+
+void DES_EDE3::Base::UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &)
+{
+	AssertValidKeyLength(length);
+
+	m_des1.RawSetKey(GetCipherDirection(), userKey + (IsForwardTransformation() ? 0 : 16));
+	m_des2.RawSetKey(ReverseCipherDir(GetCipherDirection()), userKey + 8);
+	m_des3.RawSetKey(GetCipherDirection(), userKey + (IsForwardTransformation() ? 16 : 0));
+}
+
+void DES_EDE3::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 l,r;
+	Block::Get(inBlock)(l)(r);
+	IPERM(l,r);
+	m_des1.RawProcessBlock(l, r);
+	m_des2.RawProcessBlock(r, l);
+	m_des3.RawProcessBlock(l, r);
+	FPERM(l,r);
+	Block::Put(xorBlock, outBlock)(r)(l);
+}
+
+#endif	// #ifndef CRYPTOPP_IMPORTS
+
+static inline bool CheckParity(byte b)
+{
+	unsigned int a = b ^ (b >> 4);
+	return ((a ^ (a>>1) ^ (a>>2) ^ (a>>3)) & 1) == 1;
+}
+
+bool DES::CheckKeyParityBits(const byte *key)
+{
+	for (unsigned int i=0; i<8; i++)
+		if (!CheckParity(key[i]))
+			return false;
+	return true;
+}
+
+void DES::CorrectKeyParityBits(byte *key)
+{
+	for (unsigned int i=0; i<8; i++)
+		if (!CheckParity(key[i]))
+			key[i] ^= 1;
+}
+
+// Encrypt or decrypt a block of data in ECB mode
+void DES::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 l,r;
+	Block::Get(inBlock)(l)(r);
+	IPERM(l,r);
+	RawProcessBlock(l, r);
+	FPERM(l,r);
+	Block::Put(xorBlock, outBlock)(r)(l);
+}
+
+void DES_XEX3::Base::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &)
+{
+	AssertValidKeyLength(length);
+
+	if (!m_des.get())
+		m_des.reset(new DES::Encryption);
+
+	std::memcpy(m_x1, key + (IsForwardTransformation() ? 0 : 16), BLOCKSIZE);
+	m_des->RawSetKey(GetCipherDirection(), key + 8);
+	std::memcpy(m_x3, key + (IsForwardTransformation() ? 16 : 0), BLOCKSIZE);
+}
+
+void DES_XEX3::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	xorbuf(outBlock, inBlock, m_x1, BLOCKSIZE);
+	m_des->ProcessAndXorBlock(outBlock, xorBlock, outBlock);
+	xorbuf(outBlock, m_x3, BLOCKSIZE);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/des.h b/runtime/third_party/cryptopp/des.h
new file mode 100644
index 0000000..10ba059
--- /dev/null
+++ b/runtime/third_party/cryptopp/des.h
@@ -0,0 +1,163 @@
+// des.h - originally written and placed in the public domain by Wei Dai
+
+/// \file des.h
+/// \brief Classes for DES, 2-key Triple-DES, 3-key Triple-DES and DESX
+
+#ifndef CRYPTOPP_DES_H
+#define CRYPTOPP_DES_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief DES block cipher base class
+/// \since Crypto++ 1.0
+class CRYPTOPP_DLL RawDES
+{
+public:
+	void RawSetKey(CipherDir direction, const byte *userKey);
+	void RawProcessBlock(word32 &l, word32 &r) const;
+
+protected:
+	static const word32 Spbox[8][64];
+
+	FixedSizeSecBlock<word32, 32> k;
+};
+
+/// \brief DES block cipher information
+/// \since Crypto++ 1.0
+struct DES_Info : public FixedBlockSize<8>, public FixedKeyLength<8>
+{
+	// disable DES in DLL version by not exporting this function
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "DES";}
+};
+
+/// \brief DES block cipher
+/// \details The DES implementation in Crypto++ ignores the parity bits
+///   (the least significant bits of each byte) in the key. However you can use CheckKeyParityBits()
+///   and CorrectKeyParityBits() to	check or correct the parity bits if you wish.
+/// \sa <a href="http://www.cryptopp.com/wiki/TripleDES">DES</a>
+/// \since Crypto++ 1.0
+class DES : public DES_Info, public BlockCipherDocumentation
+{
+	/// \brief DES block cipher default operation
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<DES_Info>, public RawDES
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	/// check DES key parity bits
+	static bool CheckKeyParityBits(const byte *key);
+	/// correct DES key parity bits
+	static void CorrectKeyParityBits(byte *key);
+
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+/// \brief 2-key TripleDES block cipher information
+/// \since Crypto++ 1.0
+struct DES_EDE2_Info : public FixedBlockSize<8>, public FixedKeyLength<16>
+{
+	CRYPTOPP_DLL static const char * CRYPTOPP_API StaticAlgorithmName() {return "DES-EDE2";}
+};
+
+/// \brief 2-key TripleDES block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/TripleDES">DES-EDE2</a>
+/// \since Crypto++ 1.0
+class DES_EDE2 : public DES_EDE2_Info, public BlockCipherDocumentation
+{
+	/// \brief DES_EDE2 block cipher default operation
+	class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<DES_EDE2_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+	protected:
+		RawDES m_des1, m_des2;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+/// \brief 3-key TripleDES block cipher information
+/// \since Crypto++ 1.0
+struct DES_EDE3_Info : public FixedBlockSize<8>, public FixedKeyLength<24>
+{
+	CRYPTOPP_DLL static const char * CRYPTOPP_API StaticAlgorithmName() {return "DES-EDE3";}
+};
+
+/// \brief 3-key TripleDES block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/TripleDES">DES-EDE3</a>
+/// \since Crypto++ 1.0
+class DES_EDE3 : public DES_EDE3_Info, public BlockCipherDocumentation
+{
+	/// \brief DES_EDE3 block cipher default operation
+	class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<DES_EDE3_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+	protected:
+		RawDES m_des1, m_des2, m_des3;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+/// \brief DESX block cipher information
+/// \since Crypto++ 3.2
+struct DES_XEX3_Info : public FixedBlockSize<8>, public FixedKeyLength<24>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "DES-XEX3";}
+};
+
+/// \brief DESX block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/TripleDES">DES-XEX3</a>, AKA DESX
+/// \since Crypto++ 3.2
+class DES_XEX3 : public DES_XEX3_Info, public BlockCipherDocumentation
+{
+	/// \brief DES_XEX3 block cipher default operation
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<DES_XEX3_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+	protected:
+		FixedSizeSecBlock<byte, BLOCKSIZE> m_x1, m_x3;
+		// VS2005 workaround: calling modules compiled with /clr gets unresolved external symbol DES::Base::ProcessAndXorBlock
+		// if we use DES::Encryption here directly without value_ptr.
+		value_ptr<DES::Encryption> m_des;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+typedef DES::Encryption DESEncryption;
+typedef DES::Decryption DESDecryption;
+
+typedef DES_EDE2::Encryption DES_EDE2_Encryption;
+typedef DES_EDE2::Decryption DES_EDE2_Decryption;
+
+typedef DES_EDE3::Encryption DES_EDE3_Encryption;
+typedef DES_EDE3::Decryption DES_EDE3_Decryption;
+
+typedef DES_XEX3::Encryption DES_XEX3_Encryption;
+typedef DES_XEX3::Decryption DES_XEX3_Decryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/dessp.cpp b/runtime/third_party/cryptopp/dessp.cpp
new file mode 100644
index 0000000..4c7d68e
--- /dev/null
+++ b/runtime/third_party/cryptopp/dessp.cpp
@@ -0,0 +1,88 @@
+// This file is mostly generated by Phil Karn's gensp.c
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "des.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const word32 RawDES::Spbox[8][64] = {
+{
+0x01010400,0x00000000,0x00010000,0x01010404, 0x01010004,0x00010404,0x00000004,0x00010000,
+0x00000400,0x01010400,0x01010404,0x00000400, 0x01000404,0x01010004,0x01000000,0x00000004,
+0x00000404,0x01000400,0x01000400,0x00010400, 0x00010400,0x01010000,0x01010000,0x01000404,
+0x00010004,0x01000004,0x01000004,0x00010004, 0x00000000,0x00000404,0x00010404,0x01000000,
+0x00010000,0x01010404,0x00000004,0x01010000, 0x01010400,0x01000000,0x01000000,0x00000400,
+0x01010004,0x00010000,0x00010400,0x01000004, 0x00000400,0x00000004,0x01000404,0x00010404,
+0x01010404,0x00010004,0x01010000,0x01000404, 0x01000004,0x00000404,0x00010404,0x01010400,
+0x00000404,0x01000400,0x01000400,0x00000000, 0x00010004,0x00010400,0x00000000,0x01010004},
+{
+0x80108020,0x80008000,0x00008000,0x00108020, 0x00100000,0x00000020,0x80100020,0x80008020,
+0x80000020,0x80108020,0x80108000,0x80000000, 0x80008000,0x00100000,0x00000020,0x80100020,
+0x00108000,0x00100020,0x80008020,0x00000000, 0x80000000,0x00008000,0x00108020,0x80100000,
+0x00100020,0x80000020,0x00000000,0x00108000, 0x00008020,0x80108000,0x80100000,0x00008020,
+0x00000000,0x00108020,0x80100020,0x00100000, 0x80008020,0x80100000,0x80108000,0x00008000,
+0x80100000,0x80008000,0x00000020,0x80108020, 0x00108020,0x00000020,0x00008000,0x80000000,
+0x00008020,0x80108000,0x00100000,0x80000020, 0x00100020,0x80008020,0x80000020,0x00100020,
+0x00108000,0x00000000,0x80008000,0x00008020, 0x80000000,0x80100020,0x80108020,0x00108000},
+{
+0x00000208,0x08020200,0x00000000,0x08020008, 0x08000200,0x00000000,0x00020208,0x08000200,
+0x00020008,0x08000008,0x08000008,0x00020000, 0x08020208,0x00020008,0x08020000,0x00000208,
+0x08000000,0x00000008,0x08020200,0x00000200, 0x00020200,0x08020000,0x08020008,0x00020208,
+0x08000208,0x00020200,0x00020000,0x08000208, 0x00000008,0x08020208,0x00000200,0x08000000,
+0x08020200,0x08000000,0x00020008,0x00000208, 0x00020000,0x08020200,0x08000200,0x00000000,
+0x00000200,0x00020008,0x08020208,0x08000200, 0x08000008,0x00000200,0x00000000,0x08020008,
+0x08000208,0x00020000,0x08000000,0x08020208, 0x00000008,0x00020208,0x00020200,0x08000008,
+0x08020000,0x08000208,0x00000208,0x08020000, 0x00020208,0x00000008,0x08020008,0x00020200},
+{
+0x00802001,0x00002081,0x00002081,0x00000080, 0x00802080,0x00800081,0x00800001,0x00002001,
+0x00000000,0x00802000,0x00802000,0x00802081, 0x00000081,0x00000000,0x00800080,0x00800001,
+0x00000001,0x00002000,0x00800000,0x00802001, 0x00000080,0x00800000,0x00002001,0x00002080,
+0x00800081,0x00000001,0x00002080,0x00800080, 0x00002000,0x00802080,0x00802081,0x00000081,
+0x00800080,0x00800001,0x00802000,0x00802081, 0x00000081,0x00000000,0x00000000,0x00802000,
+0x00002080,0x00800080,0x00800081,0x00000001, 0x00802001,0x00002081,0x00002081,0x00000080,
+0x00802081,0x00000081,0x00000001,0x00002000, 0x00800001,0x00002001,0x00802080,0x00800081,
+0x00002001,0x00002080,0x00800000,0x00802001, 0x00000080,0x00800000,0x00002000,0x00802080},
+{
+0x00000100,0x02080100,0x02080000,0x42000100, 0x00080000,0x00000100,0x40000000,0x02080000,
+0x40080100,0x00080000,0x02000100,0x40080100, 0x42000100,0x42080000,0x00080100,0x40000000,
+0x02000000,0x40080000,0x40080000,0x00000000, 0x40000100,0x42080100,0x42080100,0x02000100,
+0x42080000,0x40000100,0x00000000,0x42000000, 0x02080100,0x02000000,0x42000000,0x00080100,
+0x00080000,0x42000100,0x00000100,0x02000000, 0x40000000,0x02080000,0x42000100,0x40080100,
+0x02000100,0x40000000,0x42080000,0x02080100, 0x40080100,0x00000100,0x02000000,0x42080000,
+0x42080100,0x00080100,0x42000000,0x42080100, 0x02080000,0x00000000,0x40080000,0x42000000,
+0x00080100,0x02000100,0x40000100,0x00080000, 0x00000000,0x40080000,0x02080100,0x40000100},
+{
+0x20000010,0x20400000,0x00004000,0x20404010, 0x20400000,0x00000010,0x20404010,0x00400000,
+0x20004000,0x00404010,0x00400000,0x20000010, 0x00400010,0x20004000,0x20000000,0x00004010,
+0x00000000,0x00400010,0x20004010,0x00004000, 0x00404000,0x20004010,0x00000010,0x20400010,
+0x20400010,0x00000000,0x00404010,0x20404000, 0x00004010,0x00404000,0x20404000,0x20000000,
+0x20004000,0x00000010,0x20400010,0x00404000, 0x20404010,0x00400000,0x00004010,0x20000010,
+0x00400000,0x20004000,0x20000000,0x00004010, 0x20000010,0x20404010,0x00404000,0x20400000,
+0x00404010,0x20404000,0x00000000,0x20400010, 0x00000010,0x00004000,0x20400000,0x00404010,
+0x00004000,0x00400010,0x20004010,0x00000000, 0x20404000,0x20000000,0x00400010,0x20004010},
+{
+0x00200000,0x04200002,0x04000802,0x00000000, 0x00000800,0x04000802,0x00200802,0x04200800,
+0x04200802,0x00200000,0x00000000,0x04000002, 0x00000002,0x04000000,0x04200002,0x00000802,
+0x04000800,0x00200802,0x00200002,0x04000800, 0x04000002,0x04200000,0x04200800,0x00200002,
+0x04200000,0x00000800,0x00000802,0x04200802, 0x00200800,0x00000002,0x04000000,0x00200800,
+0x04000000,0x00200800,0x00200000,0x04000802, 0x04000802,0x04200002,0x04200002,0x00000002,
+0x00200002,0x04000000,0x04000800,0x00200000, 0x04200800,0x00000802,0x00200802,0x04200800,
+0x00000802,0x04000002,0x04200802,0x04200000, 0x00200800,0x00000000,0x00000002,0x04200802,
+0x00000000,0x00200802,0x04200000,0x00000800, 0x04000002,0x04000800,0x00000800,0x00200002},
+{
+0x10001040,0x00001000,0x00040000,0x10041040, 0x10000000,0x10001040,0x00000040,0x10000000,
+0x00040040,0x10040000,0x10041040,0x00041000, 0x10041000,0x00041040,0x00001000,0x00000040,
+0x10040000,0x10000040,0x10001000,0x00001040, 0x00041000,0x00040040,0x10040040,0x10041000,
+0x00001040,0x00000000,0x00000000,0x10040040, 0x10000040,0x10001000,0x00041040,0x00040000,
+0x00041040,0x00040000,0x10041000,0x00001000, 0x00000040,0x10040040,0x00001000,0x00041040,
+0x10001000,0x00000040,0x10000040,0x10040000, 0x10040040,0x10000000,0x00040000,0x10001040,
+0x00000000,0x10041040,0x00040040,0x10000040, 0x10040000,0x10001000,0x10001040,0x00000000,
+0x10041040,0x00041000,0x00041000,0x00001040, 0x00001040,0x00040040,0x10000000,0x10041000}
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/dh.cpp b/runtime/third_party/cryptopp/dh.cpp
new file mode 100644
index 0000000..e9f152a
--- /dev/null
+++ b/runtime/third_party/cryptopp/dh.cpp
@@ -0,0 +1,21 @@
+// dh.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "dh.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void DH_TestInstantiations()
+{
+	DH dh1;
+	DH dh2(NullRNG(), 10);
+}
+#endif
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/dh.h b/runtime/third_party/cryptopp/dh.h
new file mode 100644
index 0000000..e12adba
--- /dev/null
+++ b/runtime/third_party/cryptopp/dh.h
@@ -0,0 +1,275 @@
+// dh.h - originally written and placed in the public domain by Wei Dai
+
+/// \file dh.h
+/// \brief Classes for Diffie-Hellman key exchange
+
+#ifndef CRYPTOPP_DH_H
+#define CRYPTOPP_DH_H
+
+#include "cryptlib.h"
+#include "gfpcrypt.h"
+#include "algebra.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Diffie-Hellman domain
+/// \tparam GROUP_PARAMETERS group parameters
+/// \tparam COFACTOR_OPTION cofactor multiplication option
+/// \details A Diffie-Hellman domain is a set of parameters that must be shared
+///   by two parties in a key agreement protocol, along with the algorithms
+///   for generating key pairs and deriving agreed values.
+/// \details For COFACTOR_OPTION, see CofactorMultiplicationOption.
+/// \sa DL_SimpleKeyAgreementDomainBase
+/// \since Crypto++ 1.0
+template <class GROUP_PARAMETERS, class COFACTOR_OPTION = typename GROUP_PARAMETERS::DefaultCofactorOption>
+class DH_Domain : public DL_SimpleKeyAgreementDomainBase<typename GROUP_PARAMETERS::Element>
+{
+	typedef DL_SimpleKeyAgreementDomainBase<typename GROUP_PARAMETERS::Element> Base;
+
+public:
+	typedef GROUP_PARAMETERS GroupParameters;
+	typedef typename GroupParameters::Element Element;
+	typedef DL_KeyAgreementAlgorithm_DH<Element, COFACTOR_OPTION> DH_Algorithm;
+	typedef DH_Domain<GROUP_PARAMETERS, COFACTOR_OPTION> Domain;
+
+	virtual ~DH_Domain() {}
+
+	/// \brief Construct a Diffie-Hellman domain
+	DH_Domain() {}
+
+	/// \brief Construct a Diffie-Hellman domain
+	/// \param params group parameters and options
+	DH_Domain(const GroupParameters &params)
+		: m_groupParameters(params) {}
+
+	/// \brief Construct a Diffie-Hellman domain
+	/// \param bt BufferedTransformation with group parameters and options
+	DH_Domain(BufferedTransformation &bt)
+		{m_groupParameters.BERDecode(bt);}
+
+	/// \brief Create a Diffie-Hellman domain
+	/// \tparam T2 template parameter used as a constructor parameter
+	/// \param v1 RandomNumberGenerator derived class
+	/// \param v2 second parameter
+	/// \details v1 and v2 are passed directly to the GROUP_PARAMETERS object.
+	template <class T2>
+	DH_Domain(RandomNumberGenerator &v1, const T2 &v2)
+		{m_groupParameters.Initialize(v1, v2);}
+
+	/// \brief Create a Diffie-Hellman domain
+	/// \tparam T2 template parameter used as a constructor parameter
+	/// \tparam T3 template parameter used as a constructor parameter
+	/// \param v1 RandomNumberGenerator derived class
+	/// \param v2 second parameter
+	/// \param v3 third parameter
+	/// \details v1, v2 and v3 are passed directly to the GROUP_PARAMETERS object.
+	template <class T2, class T3>
+	DH_Domain(RandomNumberGenerator &v1, const T2 &v2, const T3 &v3)
+		{m_groupParameters.Initialize(v1, v2, v3);}
+
+	/// \brief Create a Diffie-Hellman domain
+	/// \tparam T2 template parameter used as a constructor parameter
+	/// \tparam T3 template parameter used as a constructor parameter
+	/// \tparam T4 template parameter used as a constructor parameter
+	/// \param v1 RandomNumberGenerator derived class
+	/// \param v2 second parameter
+	/// \param v3 third parameter
+	/// \param v4 fourth parameter
+	/// \details v1, v2, v3 and v4 are passed directly to the GROUP_PARAMETERS object.
+	template <class T2, class T3, class T4>
+	DH_Domain(RandomNumberGenerator &v1, const T2 &v2, const T3 &v3, const T4 &v4)
+		{m_groupParameters.Initialize(v1, v2, v3, v4);}
+
+	/// \brief Construct a Diffie-Hellman domain
+	/// \tparam T1 template parameter used as a constructor parameter
+	/// \tparam T2 template parameter used as a constructor parameter
+	/// \param v1 first parameter
+	/// \param v2 second parameter
+	/// \details v1 and v2 are passed directly to the GROUP_PARAMETERS object.
+	template <class T1, class T2>
+	DH_Domain(const T1 &v1, const T2 &v2)
+		{m_groupParameters.Initialize(v1, v2);}
+
+	/// \brief Construct a Diffie-Hellman domain
+	/// \tparam T1 template parameter used as a constructor parameter
+	/// \tparam T2 template parameter used as a constructor parameter
+	/// \tparam T3 template parameter used as a constructor parameter
+	/// \param v1 first parameter
+	/// \param v2 second parameter
+	/// \param v3 third parameter
+	/// \details v1, v2 and v3 are passed directly to the GROUP_PARAMETERS object.
+	template <class T1, class T2, class T3>
+	DH_Domain(const T1 &v1, const T2 &v2, const T3 &v3)
+		{m_groupParameters.Initialize(v1, v2, v3);}
+
+	/// \brief Construct a Diffie-Hellman domain
+	/// \tparam T1 template parameter used as a constructor parameter
+	/// \tparam T2 template parameter used as a constructor parameter
+	/// \tparam T3 template parameter used as a constructor parameter
+	/// \tparam T4 template parameter used as a constructor parameter
+	/// \param v1 first parameter
+	/// \param v2 second parameter
+	/// \param v3 third parameter
+	/// \param v4 fourth parameter
+	/// \details v1, v2, v3 and v4 are passed directly to the GROUP_PARAMETERS object.
+	template <class T1, class T2, class T3, class T4>
+	DH_Domain(const T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4)
+		{m_groupParameters.Initialize(v1, v2, v3, v4);}
+
+	/// \brief Retrieves the group parameters for this domain
+	/// \return the group parameters for this domain as a const reference
+	const GroupParameters & GetGroupParameters() const {return m_groupParameters;}
+	/// \brief Retrieves the group parameters for this domain
+	/// \return the group parameters for this domain as a non-const reference
+	GroupParameters & AccessGroupParameters() {return m_groupParameters;}
+
+	/// \brief Generate a public key from a private key in this domain
+	/// \param rng RandomNumberGenerator derived class
+	/// \param privateKey byte buffer with the previously generated private key
+	/// \param publicKey byte buffer for the generated public key in this domain
+	/// \details If using a FIPS 140-2 validated library on Windows, then this class will perform
+	///   a self test to ensure the key pair is pairwise consistent. Non-FIPS and non-Windows
+	///   builds of the library do not provide FIPS validated cryptography, so the code should be
+	///   removed by the optimizer.
+	/// \pre <tt>COUNTOF(publicKey) == PublicKeyLength()</tt>
+	void GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+	{
+		Base::GeneratePublicKey(rng, privateKey, publicKey);
+
+		if (FIPS_140_2_ComplianceEnabled())
+		{
+			SecByteBlock privateKey2(this->PrivateKeyLength());
+			this->GeneratePrivateKey(rng, privateKey2);
+
+			SecByteBlock publicKey2(this->PublicKeyLength());
+			Base::GeneratePublicKey(rng, privateKey2, publicKey2);
+
+			SecByteBlock agreedValue(this->AgreedValueLength()), agreedValue2(this->AgreedValueLength());
+			bool agreed1 = this->Agree(agreedValue, privateKey, publicKey2);
+			bool agreed2 = this->Agree(agreedValue2, privateKey2, publicKey);
+
+			if (!agreed1 || !agreed2 || agreedValue != agreedValue2)
+				throw SelfTestFailure(this->AlgorithmName() + ": pairwise consistency test failed");
+		}
+	}
+
+	static std::string CRYPTOPP_API StaticAlgorithmName()
+		{return GroupParameters::StaticAlgorithmNamePrefix() + DH_Algorithm::StaticAlgorithmName();}
+	std::string AlgorithmName() const {return StaticAlgorithmName();}
+
+private:
+	const DL_KeyAgreementAlgorithm<Element> & GetKeyAgreementAlgorithm() const
+		{return Singleton<DH_Algorithm>().Ref();}
+	DL_GroupParameters<Element> & AccessAbstractGroupParameters()
+		{return m_groupParameters;}
+
+	GroupParameters m_groupParameters;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS DH_Domain<DL_GroupParameters_GFP_DefaultSafePrime>;
+
+/// \brief Diffie-Hellman in GF(p)
+/// \details DH() class is a typedef of DH_Domain(). The documentation that follows
+///   does not exist. Rather the documentation was created in response to <a href="https://github.com/weidai11/cryptopp/issues/328">Issue
+///   328, Diffie-Hellman example code not compiling</a>.
+/// \details Generally speaking, a DH() object is ephemeral and is intended to execute one instance of the Diffie-Hellman protocol. The
+///   private and public key parts are not intended to be set or persisted. Rather, a new set of domain parameters are generated each
+///   time an object is created.
+/// \details Once a DH() object is created, once can retrieve the ephemeral public key for the other party with code similar to the
+///   following.
+/// <pre>   AutoSeededRandomPool prng;
+///   Integer p, q, g;
+///   PrimeAndGenerator pg;
+///
+///   pg.Generate(1, prng, 512, 511);
+///   p = pg.Prime();
+///   q = pg.SubPrime();
+///   g = pg.Generator();
+///
+///   DH dh(p, q, g);
+///   SecByteBlock t1(dh.PrivateKeyLength()), t2(dh.PublicKeyLength());
+///   dh.GenerateKeyPair(prng, t1, t2);
+///   Integer k1(t1, t1.size()), k2(t2, t2.size());
+///
+///   cout << "Private key:\n";
+///   cout << hex << k1 << endl;
+///
+///   cout << "Public key:\n";
+///   cout << hex << k2 << endl;</pre>
+///
+/// \details Output of the program above will be similar to the following.
+/// <pre>   $ ./cryptest.exe
+///   Private key:
+///   72b45a42371545e9d4880f48589aefh
+///   Public key:
+///   45fdb13f97b1840626f0250cec1dba4a23b894100b51fb5d2dd13693d789948f8bfc88f9200014b2
+///   ba8dd8a6debc471c69ef1e2326c61184a2eca88ec866346bh</pre>
+/// \sa <a href="http://www.cryptopp.com/wiki/Diffie-Hellman">Diffie-Hellman on the Crypto++ wiki</a> and
+///   <a href="http://www.weidai.com/scan-mirror/ka.html#DH">Diffie-Hellman</a> in GF(p) with key validation
+/// \since Crypto++ 1.0
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+struct DH : public DH_Domain<DL_GroupParameters_GFP_DefaultSafePrime>
+{
+	typedef DH_Domain<DL_GroupParameters_GFP_DefaultSafePrime> GroupParameters;
+	typedef GroupParameters::Element Element;
+
+	virtual ~DH() {}
+
+	/// \brief Create an uninitialized Diffie-Hellman object
+	DH() : DH_Domain() {}
+
+	/// \brief Initialize a Diffie-Hellman object
+	/// \param bt BufferedTransformation with group parameters and options
+	DH(BufferedTransformation &bt) : DH_Domain(bt) {}
+
+	/// \brief Initialize a Diffie-Hellman object
+	/// \param params group parameters and options
+	DH(const GroupParameters &params) : DH_Domain(params) {}
+
+	/// \brief Create a Diffie-Hellman object
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param modulusBits the size of the modulus, in bits
+	/// \details This function overload of Initialize() creates a new Diffie-Hellman object because it
+	///   takes a RandomNumberGenerator() as a parameter.
+	DH(RandomNumberGenerator &rng, unsigned int modulusBits) : DH_Domain(rng, modulusBits) {}
+
+	/// \brief Initialize a Diffie-Hellman object
+	/// \param p the modulus
+	/// \param g the generator
+	DH(const Integer &p, const Integer &g) : DH_Domain(p, g) {}
+
+	/// \brief Initialize a Diffie-Hellman object
+	/// \param p the modulus
+	/// \param q the subgroup order
+	/// \param g the generator
+	DH(const Integer &p, const Integer &q, const Integer &g) : DH_Domain(p, q, g) {}
+
+	/// \brief Creates a Diffie-Hellman object
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param modulusBits the size of the modulus, in bits
+	/// \details This function overload of Initialize() creates a new Diffie-Hellman object because it
+	///   takes a RandomNumberGenerator() as a parameter.
+	void Initialize(RandomNumberGenerator &rng, unsigned int modulusBits)
+		{AccessGroupParameters().Initialize(rng, modulusBits);}
+
+	/// \brief Initialize a Diffie-Hellman object
+	/// \param p the modulus
+	/// \param g the generator
+	void Initialize(const Integer &p, const Integer &g)
+		{AccessGroupParameters().Initialize(p, g);}
+
+	/// \brief Initialize a Diffie-Hellman object
+	/// \param p the modulus
+	/// \param q the subgroup order
+	/// \param g the generator
+	void Initialize(const Integer &p, const Integer &q, const Integer &g)
+		{AccessGroupParameters().Initialize(p, q, g);}
+};
+#else
+// The real DH class is a typedef.
+typedef DH_Domain<DL_GroupParameters_GFP_DefaultSafePrime> DH;
+#endif
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/dh2.cpp b/runtime/third_party/cryptopp/dh2.cpp
new file mode 100644
index 0000000..3787ddc
--- /dev/null
+++ b/runtime/third_party/cryptopp/dh2.cpp
@@ -0,0 +1,69 @@
+// dh2.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "cryptlib.h"
+#include "misc.h"
+#include "dh2.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+struct NullCryptoParameters : public CryptoParameters
+{
+	void AssignFrom(const NameValuePairs &source) {
+		CRYPTOPP_UNUSED(source);
+	}
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const {
+		CRYPTOPP_UNUSED(rng); CRYPTOPP_UNUSED(level);
+		return false;
+	}
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const {
+		CRYPTOPP_UNUSED(name); CRYPTOPP_UNUSED(valueType); CRYPTOPP_UNUSED(pValue);
+		return false;
+	}
+};
+
+struct NullSimpleKeyAgreementDomain : public TwoBases<NullCryptoParameters, SimpleKeyAgreementDomain>
+{
+	CryptoParameters & AccessCryptoParameters() {
+		return *this;
+	}
+	unsigned int AgreedValueLength() const {
+		return 1;
+	}
+	unsigned int PrivateKeyLength() const {
+		return 1;
+	}
+	unsigned int PublicKeyLength() const {
+		return 1;
+	}
+	void GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const {
+		CRYPTOPP_UNUSED(rng); CRYPTOPP_UNUSED(privateKey);
+	}
+	void GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const {
+		CRYPTOPP_UNUSED(rng); CRYPTOPP_UNUSED(privateKey); CRYPTOPP_UNUSED(publicKey);
+	}
+	bool Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey=true) const {
+		CRYPTOPP_UNUSED(agreedValue); CRYPTOPP_UNUSED(privateKey);
+		CRYPTOPP_UNUSED(otherPublicKey); CRYPTOPP_UNUSED(validateOtherPublicKey);
+		return false;
+	}
+};
+
+void DH2_TestInstantiations()
+{
+	NullSimpleKeyAgreementDomain dom;
+	DH2 dh(dom);
+}
+#endif
+
+bool DH2::Agree(byte *agreedValue,
+		const byte *staticSecretKey, const byte *ephemeralSecretKey,
+		const byte *staticOtherPublicKey, const byte *ephemeralOtherPublicKey,
+		bool validateStaticOtherPublicKey) const
+{
+	return d1.Agree(agreedValue, staticSecretKey, staticOtherPublicKey, validateStaticOtherPublicKey)
+		&& d2.Agree(agreedValue+d1.AgreedValueLength(), ephemeralSecretKey, ephemeralOtherPublicKey, true);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/dh2.h b/runtime/third_party/cryptopp/dh2.h
new file mode 100644
index 0000000..6cbfe46
--- /dev/null
+++ b/runtime/third_party/cryptopp/dh2.h
@@ -0,0 +1,70 @@
+// dh2.h - originally written and placed in the public domain by Wei Dai
+
+/// \file dh2.h
+/// \brief Classes for Unified Diffie-Hellman key exchange
+/// \since Crypto++ 3.0
+
+#ifndef CRYPTOPP_DH2_H
+#define CRYPTOPP_DH2_H
+
+#include "cryptlib.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Unified Diffie-Hellman in GF(p)
+/// \details A Diffie-Hellman domain is a set of parameters that must be shared
+///   by two parties in a key agreement protocol, along with the algorithms
+///   for generating key pairs and deriving agreed values.
+/// \sa AuthenticatedKeyAgreementDomain, <a href="http://www.weidai.com/scan-mirror/ka.html#DH2">Unified Diffie-Hellman</a>
+/// \since Crypto++ 3.0
+class DH2 : public AuthenticatedKeyAgreementDomain
+{
+public:
+	virtual ~DH2() {}
+
+	/// \brief Construct a DH2
+	DH2(SimpleKeyAgreementDomain &domain)
+		: d1(domain), d2(domain) {}
+	/// \brief Construct a DH2
+	DH2(SimpleKeyAgreementDomain &staticDomain, SimpleKeyAgreementDomain &ephemeralDomain)
+		: d1(staticDomain), d2(ephemeralDomain) {}
+
+	CryptoParameters & AccessCryptoParameters() {return d1.AccessCryptoParameters();}
+
+	unsigned int AgreedValueLength() const
+		{return d1.AgreedValueLength() + d2.AgreedValueLength();}
+
+	unsigned int StaticPrivateKeyLength() const
+		{return d1.PrivateKeyLength();}
+	unsigned int StaticPublicKeyLength() const
+		{return d1.PublicKeyLength();}
+	void GenerateStaticPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+		{d1.GeneratePrivateKey(rng, privateKey);}
+	void GenerateStaticPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+		{d1.GeneratePublicKey(rng, privateKey, publicKey);}
+	void GenerateStaticKeyPair(RandomNumberGenerator &rng, byte *privateKey, byte *publicKey) const
+		{d1.GenerateKeyPair(rng, privateKey, publicKey);}
+
+	unsigned int EphemeralPrivateKeyLength() const
+		{return d2.PrivateKeyLength();}
+	unsigned int EphemeralPublicKeyLength() const
+		{return d2.PublicKeyLength();}
+	void GenerateEphemeralPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+		{d2.GeneratePrivateKey(rng, privateKey);}
+	void GenerateEphemeralPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+		{d2.GeneratePublicKey(rng, privateKey, publicKey);}
+	void GenerateEphemeralKeyPair(RandomNumberGenerator &rng, byte *privateKey, byte *publicKey) const
+		{d2.GenerateKeyPair(rng, privateKey, publicKey);}
+
+	bool Agree(byte *agreedValue,
+		const byte *staticPrivateKey, const byte *ephemeralPrivateKey,
+		const byte *staticOtherPublicKey, const byte *ephemeralOtherPublicKey,
+		bool validateStaticOtherPublicKey=true) const;
+
+protected:
+	SimpleKeyAgreementDomain &d1, &d2;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/dll.cpp b/runtime/third_party/cryptopp/dll.cpp
new file mode 100644
index 0000000..19bef80
--- /dev/null
+++ b/runtime/third_party/cryptopp/dll.cpp
@@ -0,0 +1,167 @@
+// dll.cpp - originally written and placed in the public domain by Wei Dai
+
+#define CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES
+#define CRYPTOPP_DEFAULT_NO_DLL
+
+#include "dll.h"
+#include "config.h"
+#include "iterhash.h"
+#include "pkcspad.h"
+#include "emsa2.h"
+
+#if defined(CRYPTOPP_MSC_VERSION)
+// Cast from FARPROC to funcptr with args, http://stackoverflow.com/q/4192058/608639
+# pragma warning(disable: 4191)
+#endif
+
+#if defined(CRYPTOPP_EXPORTS) && defined(CRYPTOPP_WIN32_AVAILABLE)
+# include <windows.h>
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Guarding based on DLL due to Clang, http://github.com/weidai11/cryptopp/issues/300
+#ifdef CRYPTOPP_IS_DLL
+template<> const byte PKCS_DigestDecoration<SHA1>::decoration[] = {0x30,0x21,0x30,0x09,0x06,0x05,0x2B,0x0E,0x03,0x02,0x1A,0x05,0x00,0x04,0x14};
+template<> const unsigned int PKCS_DigestDecoration<SHA1>::length = sizeof(PKCS_DigestDecoration<SHA1>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA224>::decoration[] = {0x30,0x2d,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x04,0x05,0x00,0x04,0x1c};
+template<> const unsigned int PKCS_DigestDecoration<SHA224>::length = sizeof(PKCS_DigestDecoration<SHA224>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA256>::decoration[] = {0x30,0x31,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x01,0x05,0x00,0x04,0x20};
+template<> const unsigned int PKCS_DigestDecoration<SHA256>::length = sizeof(PKCS_DigestDecoration<SHA256>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA384>::decoration[] = {0x30,0x41,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x02,0x05,0x00,0x04,0x30};
+template<> const unsigned int PKCS_DigestDecoration<SHA384>::length = sizeof(PKCS_DigestDecoration<SHA384>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA512>::decoration[] = {0x30,0x51,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x03,0x05,0x00,0x04,0x40};
+template<> const unsigned int PKCS_DigestDecoration<SHA512>::length = sizeof(PKCS_DigestDecoration<SHA512>::decoration);
+
+// http://github.com/weidai11/cryptopp/issues/517. OIDs and encoded prefixes found at
+// http://www.ietf.org/archive/id/draft-jivsov-openpgp-sha3-01.txt
+template<> const byte PKCS_DigestDecoration<SHA3_256>::decoration[] = {0x30,0x31,0x30,0x0d, 0x06,0x09,0x60,0x86, 0x48,0x01,0x65,0x03, 0x04,0x02,0x08,0x05, 0x00,0x04,0x20};
+template<> const unsigned int PKCS_DigestDecoration<SHA3_256>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA3_256>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA3_384>::decoration[] = {0x30,0x41,0x30,0x0d, 0x06,0x09,0x60,0x86, 0x48,0x01,0x65,0x03, 0x04,0x02,0x09,0x05, 0x00,0x04,0x30};
+template<> const unsigned int PKCS_DigestDecoration<SHA3_384>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA3_384>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA3_512>::decoration[] = {0x30,0x51,0x30,0x0d, 0x06,0x09,0x60,0x86, 0x48,0x01,0x65,0x03, 0x04,0x02,0x0a,0x05, 0x00,0x04,0x40};
+template<> const unsigned int PKCS_DigestDecoration<SHA3_512>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA3_512>::decoration);
+
+template<> const byte EMSA2HashId<SHA1>::id = 0x33;
+template<> const byte EMSA2HashId<SHA224>::id = 0x38;
+template<> const byte EMSA2HashId<SHA256>::id = 0x34;
+template<> const byte EMSA2HashId<SHA384>::id = 0x36;
+template<> const byte EMSA2HashId<SHA512>::id = 0x35;
+
+#endif	// CRYPTOPP_IS_DLL
+
+NAMESPACE_END
+
+#endif
+
+#ifdef CRYPTOPP_EXPORTS
+
+USING_NAMESPACE(CryptoPP)
+
+static PNew s_pNew = NULLPTR;
+static PDelete s_pDelete = NULLPTR;
+
+static void * New (size_t size)
+{
+	void *p;
+	while ((p = malloc(size)) == NULLPTR)
+		CallNewHandler();
+
+	return p;
+}
+
+static void SetNewAndDeleteFunctionPointers()
+{
+	void *p = NULLPTR;
+	HMODULE hModule = NULLPTR;
+	MEMORY_BASIC_INFORMATION mbi;
+
+	while (true)
+	{
+		VirtualQuery(p, &mbi, sizeof(mbi));
+
+		if (p >= (char *)mbi.BaseAddress + mbi.RegionSize)
+			break;
+
+		p = (char *)mbi.BaseAddress + mbi.RegionSize;
+
+		if (!mbi.AllocationBase || mbi.AllocationBase == hModule)
+			continue;
+
+		hModule = HMODULE(mbi.AllocationBase);
+		PGetNewAndDelete pGetNewAndDelete = (PGetNewAndDelete)GetProcAddress(hModule, "GetNewAndDeleteForCryptoPP");
+		if (pGetNewAndDelete)
+		{
+			pGetNewAndDelete(s_pNew, s_pDelete);
+			return;
+		}
+
+		PSetNewAndDelete pSetNewAndDelete = (PSetNewAndDelete)GetProcAddress(hModule, "SetNewAndDeleteFromCryptoPP");
+		if (pSetNewAndDelete)
+		{
+			s_pNew = &New;
+			s_pDelete = &free;
+			pSetNewAndDelete(s_pNew, s_pDelete, &std::set_new_handler);
+			return;
+		}
+	}
+
+	// try getting these directly using mangled names of new and delete operators
+
+	hModule = GetModuleHandle("msvcrtd");
+	if (!hModule)
+		hModule = GetModuleHandle("msvcrt");
+	if (hModule)
+	{
+		// 32-bit versions
+		s_pNew = (PNew)GetProcAddress(hModule, "??2@YAPAXI@Z");
+		s_pDelete = (PDelete)GetProcAddress(hModule, "??3@YAXPAX@Z");
+		if (s_pNew && s_pDelete)
+			return;
+
+		// 64-bit versions
+		s_pNew = (PNew)GetProcAddress(hModule, "??2@YAPEAX_K@Z");
+		s_pDelete = (PDelete)GetProcAddress(hModule, "??3@YAXPEAX@Z");
+		if (s_pNew && s_pDelete)
+			return;
+	}
+
+	OutputDebugStringA("Crypto++ DLL was not able to obtain new and delete function pointers.\n");
+	throw 0;
+}
+
+// Cast from FARPROC to funcptr with args
+#pragma warning(default: 4191)
+
+void * operator new (size_t size)
+{
+	if (!s_pNew)
+		SetNewAndDeleteFunctionPointers();
+
+	return s_pNew(size);
+}
+
+void operator delete (void * p)
+{
+	s_pDelete(p);
+}
+
+void * operator new [] (size_t size)
+{
+	return operator new (size);
+}
+
+void operator delete [] (void * p)
+{
+	operator delete (p);
+}
+
+#endif	// CRYPTOPP_EXPORTS
diff --git a/runtime/third_party/cryptopp/dll.h b/runtime/third_party/cryptopp/dll.h
new file mode 100644
index 0000000..1537ee6
--- /dev/null
+++ b/runtime/third_party/cryptopp/dll.h
@@ -0,0 +1,71 @@
+// dll.h - originally written and placed in the public domain by Wei Dai
+
+/// \file dll.h
+/// \brief Functions and definitions required for building the FIPS-140 DLL on Windows
+
+#ifndef CRYPTOPP_DLL_H
+#define CRYPTOPP_DLL_H
+
+#if !defined(CRYPTOPP_IMPORTS) && !defined(CRYPTOPP_EXPORTS) && !defined(CRYPTOPP_DEFAULT_NO_DLL)
+#ifdef CRYPTOPP_CONFIG_H
+#error To use the DLL version of Crypto++, this file must be included before any other Crypto++ header files.
+#endif
+#define CRYPTOPP_IMPORTS
+#endif
+
+#include "aes.h"
+#include "cbcmac.h"
+#include "ccm.h"
+#include "cmac.h"
+#include "channels.h"
+#include "des.h"
+#include "dh.h"
+#include "dsa.h"
+#include "ec2n.h"
+#include "eccrypto.h"
+#include "ecp.h"
+#include "files.h"
+#include "fips140.h"
+#include "gcm.h"
+#include "hex.h"
+#include "hmac.h"
+#include "modes.h"
+#include "mqueue.h"
+#include "nbtheory.h"
+#include "osrng.h"
+#include "pkcspad.h"
+#include "pssr.h"
+#include "randpool.h"
+#include "rsa.h"
+#include "rw.h"
+#include "sha.h"
+#include "skipjack.h"
+
+#ifdef CRYPTOPP_IMPORTS
+
+#ifdef _DLL
+// cause CRT DLL to be initialized before Crypto++ so that we can use malloc and free during DllMain()
+#ifdef CRYPTOPP_DEBUG
+# pragma comment(lib, "msvcrtd")
+# pragma comment(lib, "cryptopp")
+#else
+# pragma comment(lib, "msvcrt")
+# pragma comment(lib, "cryptopp")
+#endif
+#endif
+
+#endif		// #ifdef CRYPTOPP_IMPORTS
+
+#include <new>	// for new_handler
+
+NAMESPACE_BEGIN(CryptoPP)
+
+typedef void * (CRYPTOPP_API * PNew)(size_t);
+typedef void (CRYPTOPP_API * PDelete)(void *);
+typedef void (CRYPTOPP_API * PGetNewAndDelete)(PNew &, PDelete &);
+typedef std::new_handler (CRYPTOPP_API * PSetNewHandler)(std::new_handler);
+typedef void (CRYPTOPP_API * PSetNewAndDelete)(PNew, PDelete, PSetNewHandler);
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/dlltest.cpp b/runtime/third_party/cryptopp/dlltest.cpp
new file mode 100644
index 0000000..2ad8f2f
--- /dev/null
+++ b/runtime/third_party/cryptopp/dlltest.cpp
@@ -0,0 +1,212 @@
+#ifndef CRYPTOPP_DLL_ONLY
+# define CRYPTOPP_DEFAULT_NO_DLL
+#endif
+
+#include "dll.h"
+#include "cryptlib.h"
+#include "filters.h"
+#include "pkcspad.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+USING_NAMESPACE(CryptoPP)
+
+void FIPS140_SampleApplication()
+{
+	if (!FIPS_140_2_ComplianceEnabled())
+	{
+		std::cerr << "FIPS 140-2 compliance was turned off at compile time.\n";
+		abort();
+	}
+
+	// check self test status
+	if (GetPowerUpSelfTestStatus() != POWER_UP_SELF_TEST_PASSED)
+	{
+		std::cerr << "Automatic power-up self test failed.\n";
+		abort();
+	}
+	std::cout << "0. Automatic power-up self test passed.\n";
+
+	// simulate a power-up self test error
+	SimulatePowerUpSelfTestFailure();
+	try
+	{
+		// trying to use a crypto algorithm after power-up self test error will result in an exception
+		AES::Encryption aes;
+
+		// should not be here
+		std::cerr << "Use of AES failed to cause an exception after power-up self test error.\n";
+		abort();
+	}
+	catch (SelfTestFailure &e)
+	{
+		std::cout << "1. Caught expected exception when simulating self test failure. Exception message follows: ";
+		std::cout << e.what() << std::endl;
+	}
+
+	// clear the self test error state and redo power-up self test
+	DoDllPowerUpSelfTest();
+	if (GetPowerUpSelfTestStatus() != POWER_UP_SELF_TEST_PASSED)
+	{
+		std::cerr << "Re-do power-up self test failed.\n";
+		abort();
+	}
+	std::cout << "2. Re-do power-up self test passed.\n";
+
+	// encrypt and decrypt
+	const byte key[] = {0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef, 0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef, 0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
+	const byte iv[] = {0x12,0x34,0x56,0x78,0x90,0xab,0xcd,0xef};
+	const byte plaintext[] = {	// "Now is the time for all " without tailing 0
+		0x4e,0x6f,0x77,0x20,0x69,0x73,0x20,0x74,
+		0x68,0x65,0x20,0x74,0x69,0x6d,0x65,0x20,
+		0x66,0x6f,0x72,0x20,0x61,0x6c,0x6c,0x20};
+	byte ciphertext[24];
+	byte decrypted[24];
+
+	CFB_FIPS_Mode<DES_EDE3>::Encryption encryption_DES_EDE3_CFB;
+	encryption_DES_EDE3_CFB.SetKeyWithIV(key, sizeof(key), iv);
+	encryption_DES_EDE3_CFB.ProcessString(ciphertext, plaintext, 24);
+
+	CFB_FIPS_Mode<DES_EDE3>::Decryption decryption_DES_EDE3_CFB;
+	decryption_DES_EDE3_CFB.SetKeyWithIV(key, sizeof(key), iv);
+	decryption_DES_EDE3_CFB.ProcessString(decrypted, ciphertext, 24);
+
+	if (std::memcmp(plaintext, decrypted, 24) != 0)
+	{
+		std::cerr << "DES-EDE3-CFB Encryption/decryption failed.\n";
+		abort();
+	}
+	std::cout << "3. DES-EDE3-CFB Encryption/decryption succeeded.\n";
+
+	// hash
+	const byte message[] = {'a', 'b', 'c'};
+	const byte expectedDigest[] = {0xA9,0x99,0x3E,0x36,0x47,0x06,0x81,0x6A,0xBA,0x3E,0x25,0x71,0x78,0x50,0xC2,0x6C,0x9C,0xD0,0xD8,0x9D};
+	byte digest[20];
+
+	SHA1 sha;
+	sha.Update(message, 3);
+	sha.Final(digest);
+
+	if (std::memcmp(digest, expectedDigest, 20) != 0)
+	{
+		std::cerr << "SHA-1 hash failed.\n";
+		abort();
+	}
+	std::cout << "4. SHA-1 hash succeeded.\n";
+
+	// create auto-seeded X9.17 RNG object, if available
+#ifdef OS_RNG_AVAILABLE
+	AutoSeededX917RNG<AES> rng;
+#else
+	// this is used to allow this function to compile on platforms that don't have auto-seeded RNGs
+	RandomNumberGenerator &rng(NullRNG());
+#endif
+
+	// generate DSA key
+	DSA::PrivateKey dsaPrivateKey;
+	dsaPrivateKey.GenerateRandomWithKeySize(rng, 1024);
+	DSA::PublicKey dsaPublicKey;
+	dsaPublicKey.AssignFrom(dsaPrivateKey);
+	if (!dsaPrivateKey.Validate(rng, 3) || !dsaPublicKey.Validate(rng, 3))
+	{
+		std::cerr << "DSA key generation failed.\n";
+		abort();
+	}
+	std::cout << "5. DSA key generation succeeded.\n";
+
+	// encode DSA key
+	std::string encodedDsaPublicKey, encodedDsaPrivateKey;
+	dsaPublicKey.DEREncode(StringSink(encodedDsaPublicKey).Ref());
+	dsaPrivateKey.DEREncode(StringSink(encodedDsaPrivateKey).Ref());
+
+	// decode DSA key
+	DSA::PrivateKey decodedDsaPrivateKey;
+	decodedDsaPrivateKey.BERDecode(StringStore(encodedDsaPrivateKey).Ref());
+	DSA::PublicKey decodedDsaPublicKey;
+	decodedDsaPublicKey.BERDecode(StringStore(encodedDsaPublicKey).Ref());
+
+	if (!decodedDsaPrivateKey.Validate(rng, 3) || !decodedDsaPublicKey.Validate(rng, 3))
+	{
+		std::cerr << "DSA key encode/decode failed.\n";
+		abort();
+	}
+	std::cout << "6. DSA key encode/decode succeeded.\n";
+
+	// sign and verify
+	byte signature[40];
+	DSA::Signer signer(dsaPrivateKey);
+	CRYPTOPP_ASSERT(signer.SignatureLength() == 40);
+	signer.SignMessage(rng, message, 3, signature);
+
+	DSA::Verifier verifier(dsaPublicKey);
+	if (!verifier.VerifyMessage(message, 3, signature, sizeof(signature)))
+	{
+		std::cerr << "DSA signature and verification failed.\n";
+		abort();
+	}
+	std::cout << "7. DSA signature and verification succeeded.\n";
+
+
+	// try to verify an invalid signature
+	signature[0] ^= 1;
+	if (verifier.VerifyMessage(message, 3, signature, sizeof(signature)))
+	{
+		std::cerr << "DSA signature verification failed to detect bad signature.\n";
+		abort();
+	}
+	std::cout << "8. DSA signature verification successfully detected bad signature.\n";
+
+	// try to use an invalid key length
+	try
+	{
+		ECB_Mode<DES_EDE3>::Encryption encryption_DES_EDE3_ECB;
+		encryption_DES_EDE3_ECB.SetKey(key, 5);
+
+		// should not be here
+		std::cerr << "DES-EDE3 implementation did not detect use of invalid key length.\n";
+		abort();
+	}
+	catch (InvalidArgument &e)
+	{
+		std::cout << "9. Caught expected exception when using invalid key length. Exception message follows: ";
+		std::cout << e.what() << std::endl;
+	}
+
+	std::cout << "\nFIPS 140-2 Sample Application completed normally.\n";
+}
+
+#ifdef CRYPTOPP_IMPORTS
+
+static PNew s_pNew = NULLPTR;
+static PDelete s_pDelete = NULLPTR;
+
+extern "C" __declspec(dllexport) void __cdecl SetNewAndDeleteFromCryptoPP(PNew pNew, PDelete pDelete, PSetNewHandler pSetNewHandler)
+{
+	(void)(pSetNewHandler);
+	s_pNew = pNew;
+	s_pDelete = pDelete;
+}
+
+void * __cdecl operator new (size_t size)
+{
+	return s_pNew(size);
+}
+
+void __cdecl operator delete (void * p)
+{
+	s_pDelete(p);
+}
+
+#endif
+
+#ifdef CRYPTOPP_DLL_ONLY
+
+int __cdecl main()
+{
+	FIPS140_SampleApplication();
+	return 0;
+}
+
+#endif
diff --git a/runtime/third_party/cryptopp/dmac.h b/runtime/third_party/cryptopp/dmac.h
new file mode 100644
index 0000000..ef2fa18
--- /dev/null
+++ b/runtime/third_party/cryptopp/dmac.h
@@ -0,0 +1,114 @@
+// dmac.h - originally written and placed in the public domain by Wei Dai
+
+/// \file dmac.h
+/// \brief Classes for DMAC message authentication code
+
+#ifndef CRYPTOPP_DMAC_H
+#define CRYPTOPP_DMAC_H
+
+#include "cbcmac.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief DMAC message authentication code base class
+/// \tparam T class derived from BlockCipherDocumentation
+/// \since Crypto++ 3.1
+template <class T>
+class CRYPTOPP_NO_VTABLE DMAC_Base : public SameKeyLengthAs<T>, public MessageAuthenticationCode
+{
+public:
+	CRYPTOPP_CONSTANT(DIGESTSIZE=T::BLOCKSIZE);
+	static std::string StaticAlgorithmName() {return std::string("DMAC(") + T::StaticAlgorithmName() + ")";}
+
+	virtual~DMAC_Base() {}
+	DMAC_Base() : m_subkeylength(0), m_counter(0) {}
+
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *mac, size_t size);
+	unsigned int DigestSize() const {return DIGESTSIZE;}
+
+	std::string AlgorithmProvider() const;
+
+private:
+	byte *GenerateSubKeys(const byte *key, size_t keylength);
+
+	size_t m_subkeylength;
+	SecByteBlock m_subkeys;
+	CBC_MAC<T> m_mac1;
+	typename T::Encryption m_f2;
+	unsigned int m_counter;
+};
+
+template <class T>
+std::string DMAC_Base<T>::AlgorithmProvider() const
+{
+	return m_f2.AlgorithmProvider();
+}
+
+/// \brief DMAC message authentication code
+/// \tparam T class derived from BlockCipherDocumentation
+/// \sa <A HREF="https://eprint.iacr.org/1997/010">CBC MAC for Real-Time Data Sources (08.15.1997)</A>
+///   by Erez Petrank and Charles Rackoff
+/// \since Crypto++ 3.1
+template <class T>
+class DMAC : public MessageAuthenticationCodeFinal<DMAC_Base<T> >
+{
+public:
+	/// \brief Construct a DMAC
+	DMAC() {}
+
+	/// \brief Construct a DMAC
+	/// \param key a byte array used to key the cipher
+	/// \param length the size of the byte array, in bytes
+	DMAC(const byte *key, size_t length=DMAC_Base<T>::DEFAULT_KEYLENGTH)
+		{this->SetKey(key, length);}
+};
+
+template <class T>
+void DMAC_Base<T>::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	m_subkeylength = T::StaticGetValidKeyLength(T::BLOCKSIZE);
+	m_subkeys.resize(2*UnsignedMin((unsigned int)T::BLOCKSIZE, m_subkeylength));
+	m_mac1.SetKey(GenerateSubKeys(key, length), m_subkeylength, params);
+	m_f2.SetKey(m_subkeys+m_subkeys.size()/2, m_subkeylength, params);
+	m_counter = 0;
+	m_subkeys.resize(0);
+}
+
+template <class T>
+void DMAC_Base<T>::Update(const byte *input, size_t length)
+{
+	m_mac1.Update(input, length);
+	m_counter = (unsigned int)((m_counter + length) % T::BLOCKSIZE);
+}
+
+template <class T>
+void DMAC_Base<T>::TruncatedFinal(byte *mac, size_t size)
+{
+	ThrowIfInvalidTruncatedSize(size);
+
+	byte pad[T::BLOCKSIZE];
+	byte padByte = byte(T::BLOCKSIZE-m_counter);
+	std::memset(pad, padByte, padByte);
+	m_mac1.Update(pad, padByte);
+	m_mac1.TruncatedFinal(mac, size);
+	m_f2.ProcessBlock(mac);
+
+	m_counter = 0;	// reset for next message
+}
+
+template <class T>
+byte *DMAC_Base<T>::GenerateSubKeys(const byte *key, size_t keylength)
+{
+	typename T::Encryption cipher(key, keylength);
+	std::memset(m_subkeys, 0, m_subkeys.size());
+	cipher.ProcessBlock(m_subkeys);
+	m_subkeys[m_subkeys.size()/2 + T::BLOCKSIZE - 1] = 1;
+	cipher.ProcessBlock(m_subkeys+m_subkeys.size()/2);
+	return m_subkeys;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/donna.h b/runtime/third_party/cryptopp/donna.h
new file mode 100644
index 0000000..d37f269
--- /dev/null
+++ b/runtime/third_party/cryptopp/donna.h
@@ -0,0 +1,179 @@
+// donna.h - written and placed in public domain by Jeffrey Walton
+//           Crypto++ specific implementation wrapped around Andrew
+//           Moon's public domain curve25519-donna and ed25519-donna,
+//           https://github.com/floodyberry/curve25519-donna and
+//           https://github.com/floodyberry/ed25519-donna.
+
+// The curve25519 and ed25519 source files multiplex different repos and
+// architectures using namespaces. The repos are Andrew Moon's
+// curve25519-donna and ed25519-donna. The architectures are 32-bit, 64-bit
+// and SSE. For example, 32-bit x25519 uses symbols from Donna::X25519 and
+// Donna::Arch32.
+
+// If needed, see Moon's commit "Go back to ignoring 256th bit [sic]",
+// https://github.com/floodyberry/curve25519-donna/commit/57a683d18721a658
+
+/// \file donna.h
+/// \details Functions for curve25519 and ed25519 operations
+/// \details This header provides the entry points into Andrew Moon's
+///   curve25519 and ed25519 curve functions. The Crypto++ classes x25519
+///   and ed25519 use the functions. The functions are in the <tt>Donna</tt>
+///   namespace and are curve25519_mult(), ed25519_publickey(),
+///   ed25519_sign() and ed25519_sign_open().
+/// \details At the moment the hash function for signing is fixed at
+///   SHA512.
+
+#ifndef CRYPTOPP_DONNA_H
+#define CRYPTOPP_DONNA_H
+
+#include "config.h"
+#include "cryptlib.h"
+#include "stdcpp.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+
+//***************************** curve25519 *****************************//
+
+/// \brief Generate a public key
+/// \param publicKey byte array for the public key
+/// \param secretKey byte array with the private key
+/// \return 0 on success, non-0 otherwise
+/// \details curve25519_mult() generates a public key from an existing
+///   secret key. Internally curve25519_mult() performs a scalar
+///   multiplication using the base point and writes the result to
+///   <tt>pubkey</tt>.
+int curve25519_mult(byte publicKey[32], const byte secretKey[32]);
+
+/// \brief Generate a shared key
+/// \param sharedKey byte array for the shared secret
+/// \param secretKey byte array with the private key
+/// \param othersKey byte array with the peer's public key
+/// \return 0 on success, non-0 otherwise
+/// \details curve25519_mult() generates a shared key from an existing
+///   secret key and the other party's public key. Internally
+///   curve25519_mult() performs a scalar multiplication using the two keys
+///   and writes the result to <tt>sharedKey</tt>.
+int curve25519_mult(byte sharedKey[32], const byte secretKey[32], const byte othersKey[32]);
+
+//******************************* ed25519 *******************************//
+
+/// \brief Creates a public key from a secret key
+/// \param publicKey byte array for the public key
+/// \param secretKey byte array with the private key
+/// \return 0 on success, non-0 otherwise
+/// \details ed25519_publickey() generates a public key from a secret key.
+///   Internally ed25519_publickey() performs a scalar multiplication
+///   using the secret key and then writes the result to <tt>publicKey</tt>.
+int ed25519_publickey(byte publicKey[32], const byte secretKey[32]);
+
+/// \brief Creates a signature on a message
+/// \param message byte array with the message
+/// \param messageLength size of the message, in bytes
+/// \param publicKey byte array with the public key
+/// \param secretKey byte array with the private key
+/// \param signature byte array for the signature
+/// \return 0 on success, non-0 otherwise
+/// \details ed25519_sign() generates a signature on a message using
+///   the public and private keys. The various buffers can be exact
+///   sizes, and do not require extra space like when using the
+///   NaCl library functions.
+/// \details At the moment the hash function for signing is fixed at
+///   SHA512.
+int ed25519_sign(const byte* message, size_t messageLength, const byte secretKey[32], const byte publicKey[32], byte signature[64]);
+
+/// \brief Creates a signature on a message
+/// \param stream std::istream derived class
+/// \param publicKey byte array with the public key
+/// \param secretKey byte array with the private key
+/// \param signature byte array for the signature
+/// \return 0 on success, non-0 otherwise
+/// \details ed25519_sign() generates a signature on a message using
+///   the public and private keys. The various buffers can be exact
+///   sizes, and do not require extra space like when using the
+///   NaCl library functions.
+/// \details This ed25519_sign() overload handles large streams. It
+///   was added for signing and verifying files that are too large
+///   for a memory allocation.
+/// \details At the moment the hash function for signing is fixed at
+///   SHA512.
+int ed25519_sign(std::istream& stream, const byte secretKey[32], const byte publicKey[32], byte signature[64]);
+
+/// \brief Verifies a signature on a message
+/// \param message byte array with the message
+/// \param messageLength size of the message, in bytes
+/// \param publicKey byte array with the public key
+/// \param signature byte array with the signature
+/// \return 0 on success, non-0 otherwise
+/// \details ed25519_sign_open() verifies a signature on a message using
+///   the public key. The various buffers can be exact sizes, and do not
+///   require extra space like when using the NaCl library functions.
+/// \details At the moment the hash function for signing is fixed at
+///   SHA512.
+int
+ed25519_sign_open(const byte *message, size_t messageLength, const byte publicKey[32], const byte signature[64]);
+
+/// \brief Verifies a signature on a message
+/// \param stream std::istream derived class
+/// \param publicKey byte array with the public key
+/// \param signature byte array with the signature
+/// \return 0 on success, non-0 otherwise
+/// \details ed25519_sign_open() verifies a signature on a message using
+///   the public key. The various buffers can be exact sizes, and do not
+///   require extra space like when using the NaCl library functions.
+/// \details This ed25519_sign_open() overload handles large streams. It
+///   was added for signing and verifying files that are too large
+///   for a memory allocation.
+/// \details At the moment the hash function for signing is fixed at
+///   SHA512.
+int
+ed25519_sign_open(std::istream& stream, const byte publicKey[32], const byte signature[64]);
+
+//****************************** Internal ******************************//
+
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+
+// CRYPTOPP_WORD128_AVAILABLE mostly depends upon GCC support for
+// __SIZEOF_INT128__. If __SIZEOF_INT128__ is not available then Moon
+// provides routines for MSC and GCC. It should cover most platforms,
+// but there are gaps like MS ARM64 and XLC. We tried to enable the
+// 64-bit path for SunCC from 12.5 but we got the dreaded compile
+// error "The operand ___LCM cannot be assigned to".
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE) || \
+   (defined(CRYPTOPP_MSC_VERSION) && defined(_M_X64))
+# define CRYPTOPP_CURVE25519_64BIT 1
+#else
+# define CRYPTOPP_CURVE25519_32BIT 1
+#endif
+
+// Benchmarking on a modern 64-bit Core i5-6400 @2.7 GHz shows SSE2 on Linux
+// is not profitable. Here are the numbers in milliseconds/operation:
+//
+//   * Langley, C++, 0.050
+//   * Moon, C++: 0.040
+//   * Moon, SSE2: 0.061
+//   * Moon, native: 0.045
+//
+// However, a modern 64-bit Core i5-3200 @2.5 GHz shows SSE2 is profitable
+// for MS compilers. Here are the numbers in milliseconds/operation:
+//
+//   * x86, no SSE2, 0.294
+//   * x86, SSE2, 0.097
+//   * x64, no SSE2, 0.081
+//   * x64, SSE2, 0.071
+
+#if defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+# define CRYPTOPP_CURVE25519_SSE2 1
+#endif
+
+#if (CRYPTOPP_CURVE25519_SSE2)
+  extern int curve25519_mult_SSE2(byte sharedKey[32], const byte secretKey[32], const byte othersKey[32]);
+#endif
+
+#endif  // CRYPTOPP_DOXYGEN_PROCESSING
+
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_DONNA_H
diff --git a/runtime/third_party/cryptopp/donna_32.cpp b/runtime/third_party/cryptopp/donna_32.cpp
new file mode 100644
index 0000000..4c6ab97
--- /dev/null
+++ b/runtime/third_party/cryptopp/donna_32.cpp
@@ -0,0 +1,2102 @@
+// donna_32.cpp - written and placed in public domain by Jeffrey Walton
+//                Crypto++ specific implementation wrapped around Andrew
+//                Moon's public domain curve25519-donna and ed25519-donna,
+//                https://github.com/floodyberry/curve25519-donna and
+//                https://github.com/floodyberry/ed25519-donna.
+
+// The curve25519 and ed25519 source files multiplex different repos and
+// architectures using namespaces. The repos are Andrew Moon's
+// curve25519-donna and ed25519-donna. The architectures are 32-bit, 64-bit
+// and SSE. For example, 32-bit x25519 uses symbols from Donna::X25519 and
+// Donna::Arch32.
+
+// A fair amount of duplication happens below, but we could not directly
+// use curve25519 for both x25519 and ed25519. A close examination reveals
+// slight differences in the implementation. For example, look at the
+// two curve25519_sub functions.
+
+// If needed, see Moon's commit "Go back to ignoring 256th bit [sic]",
+// https://github.com/floodyberry/curve25519-donna/commit/57a683d18721a658
+
+#include "pch.h"
+
+#include "config.h"
+#include "donna.h"
+#include "secblock.h"
+#include "sha.h"
+#include "misc.h"
+#include "cpu.h"
+
+#include <istream>
+#include <sstream>
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wunused-function"
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4244)
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char DONNA32_FNAME[] = __FILE__;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+// Can't use GetAlignmentOf<word32>() because of C++11 and constexpr
+// Can use 'const unsigned int' because of MSVC 2013
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+# define ALIGN_SPEC 16
+#else
+# define ALIGN_SPEC 4
+#endif
+
+ANONYMOUS_NAMESPACE_END
+
+#if defined(CRYPTOPP_CURVE25519_32BIT)
+
+#include "donna_32.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::GetWord;
+using CryptoPP::PutWord;
+using CryptoPP::LITTLE_ENDIAN_ORDER;
+
+inline word32 U8TO32_LE(const byte* p)
+{
+    return GetWord<word32>(false, LITTLE_ENDIAN_ORDER, p);
+}
+
+inline void U32TO8_LE(byte* p, word32 w)
+{
+    PutWord(false, LITTLE_ENDIAN_ORDER, p, w);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+NAMESPACE_BEGIN(X25519)
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::sword32;
+using CryptoPP::word64;
+using CryptoPP::sword64;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+
+// Bring in all the symbols from the 32-bit header
+using namespace CryptoPP::Donna::Arch32;
+
+/* out = in */
+inline void
+curve25519_copy(bignum25519 out, const bignum25519 in) {
+    out[0] = in[0]; out[1] = in[1];
+    out[2] = in[2]; out[3] = in[3];
+    out[4] = in[4]; out[5] = in[5];
+    out[6] = in[6]; out[7] = in[7];
+    out[8] = in[8]; out[9] = in[9];
+}
+
+/* out = a + b */
+inline void
+curve25519_add(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    out[0] = a[0] + b[0]; out[1] = a[1] + b[1];
+    out[2] = a[2] + b[2]; out[3] = a[3] + b[3];
+    out[4] = a[4] + b[4]; out[5] = a[5] + b[5];
+    out[6] = a[6] + b[6]; out[7] = a[7] + b[7];
+    out[8] = a[8] + b[8]; out[9] = a[9] + b[9];
+}
+
+/* out = a - b */
+inline void
+curve25519_sub(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word32 c;
+    out[0] = 0x7ffffda + a[0] - b[0]    ; c = (out[0] >> 26); out[0] &= reduce_mask_26;
+    out[1] = 0x3fffffe + a[1] - b[1] + c; c = (out[1] >> 25); out[1] &= reduce_mask_25;
+    out[2] = 0x7fffffe + a[2] - b[2] + c; c = (out[2] >> 26); out[2] &= reduce_mask_26;
+    out[3] = 0x3fffffe + a[3] - b[3] + c; c = (out[3] >> 25); out[3] &= reduce_mask_25;
+    out[4] = 0x7fffffe + a[4] - b[4] + c; c = (out[4] >> 26); out[4] &= reduce_mask_26;
+    out[5] = 0x3fffffe + a[5] - b[5] + c; c = (out[5] >> 25); out[5] &= reduce_mask_25;
+    out[6] = 0x7fffffe + a[6] - b[6] + c; c = (out[6] >> 26); out[6] &= reduce_mask_26;
+    out[7] = 0x3fffffe + a[7] - b[7] + c; c = (out[7] >> 25); out[7] &= reduce_mask_25;
+    out[8] = 0x7fffffe + a[8] - b[8] + c; c = (out[8] >> 26); out[8] &= reduce_mask_26;
+    out[9] = 0x3fffffe + a[9] - b[9] + c; c = (out[9] >> 25); out[9] &= reduce_mask_25;
+    out[0] += 19 * c;
+}
+
+/* out = in * scalar */
+inline void
+curve25519_scalar_product(bignum25519 out, const bignum25519 in, const word32 scalar) {
+    word64 a;
+    word32 c;
+    a = mul32x32_64(in[0], scalar);     out[0] = (word32)a & reduce_mask_26; c = (word32)(a >> 26);
+    a = mul32x32_64(in[1], scalar) + c; out[1] = (word32)a & reduce_mask_25; c = (word32)(a >> 25);
+    a = mul32x32_64(in[2], scalar) + c; out[2] = (word32)a & reduce_mask_26; c = (word32)(a >> 26);
+    a = mul32x32_64(in[3], scalar) + c; out[3] = (word32)a & reduce_mask_25; c = (word32)(a >> 25);
+    a = mul32x32_64(in[4], scalar) + c; out[4] = (word32)a & reduce_mask_26; c = (word32)(a >> 26);
+    a = mul32x32_64(in[5], scalar) + c; out[5] = (word32)a & reduce_mask_25; c = (word32)(a >> 25);
+    a = mul32x32_64(in[6], scalar) + c; out[6] = (word32)a & reduce_mask_26; c = (word32)(a >> 26);
+    a = mul32x32_64(in[7], scalar) + c; out[7] = (word32)a & reduce_mask_25; c = (word32)(a >> 25);
+    a = mul32x32_64(in[8], scalar) + c; out[8] = (word32)a & reduce_mask_26; c = (word32)(a >> 26);
+    a = mul32x32_64(in[9], scalar) + c; out[9] = (word32)a & reduce_mask_25; c = (word32)(a >> 25);
+                                        out[0] += c * 19;
+}
+
+/* out = a * b */
+inline void
+curve25519_mul(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word32 r0,r1,r2,r3,r4,r5,r6,r7,r8,r9;
+    word32 s0,s1,s2,s3,s4,s5,s6,s7,s8,s9;
+    word64 m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,c;
+    word32 p;
+
+    r0 = b[0]; r1 = b[1]; r2 = b[2]; r3 = b[3]; r4 = b[4];
+    r5 = b[5]; r6 = b[6]; r7 = b[7]; r8 = b[8]; r9 = b[9];
+
+    s0 = a[0]; s1 = a[1]; s2 = a[2]; s3 = a[3]; s4 = a[4];
+    s5 = a[5]; s6 = a[6]; s7 = a[7]; s8 = a[8]; s9 = a[9];
+
+    m1 = mul32x32_64(r0, s1) + mul32x32_64(r1, s0);
+    m3 = mul32x32_64(r0, s3) + mul32x32_64(r1, s2) + mul32x32_64(r2, s1) + mul32x32_64(r3, s0);
+    m5 = mul32x32_64(r0, s5) + mul32x32_64(r1, s4) + mul32x32_64(r2, s3) + mul32x32_64(r3, s2) + mul32x32_64(r4, s1) + mul32x32_64(r5, s0);
+    m7 = mul32x32_64(r0, s7) + mul32x32_64(r1, s6) + mul32x32_64(r2, s5) + mul32x32_64(r3, s4) + mul32x32_64(r4, s3) + mul32x32_64(r5, s2) + mul32x32_64(r6, s1) + mul32x32_64(r7, s0);
+    m9 = mul32x32_64(r0, s9) + mul32x32_64(r1, s8) + mul32x32_64(r2, s7) + mul32x32_64(r3, s6) + mul32x32_64(r4, s5) + mul32x32_64(r5, s4) + mul32x32_64(r6, s3) + mul32x32_64(r7, s2) + mul32x32_64(r8, s1) + mul32x32_64(r9, s0);
+
+    r1 *= 2; r3 *= 2; r5 *= 2; r7 *= 2;
+
+    m0 = mul32x32_64(r0, s0);
+    m2 = mul32x32_64(r0, s2) + mul32x32_64(r1, s1) + mul32x32_64(r2, s0);
+    m4 = mul32x32_64(r0, s4) + mul32x32_64(r1, s3) + mul32x32_64(r2, s2) + mul32x32_64(r3, s1) + mul32x32_64(r4, s0);
+    m6 = mul32x32_64(r0, s6) + mul32x32_64(r1, s5) + mul32x32_64(r2, s4) + mul32x32_64(r3, s3) + mul32x32_64(r4, s2) + mul32x32_64(r5, s1) + mul32x32_64(r6, s0);
+    m8 = mul32x32_64(r0, s8) + mul32x32_64(r1, s7) + mul32x32_64(r2, s6) + mul32x32_64(r3, s5) + mul32x32_64(r4, s4) + mul32x32_64(r5, s3) + mul32x32_64(r6, s2) + mul32x32_64(r7, s1) + mul32x32_64(r8, s0);
+
+    r1 *= 19; r2 *= 19;
+    r3 = (r3 / 2) * 19;
+    r4 *= 19;
+    r5 = (r5 / 2) * 19;
+    r6 *= 19;
+    r7 = (r7 / 2) * 19;
+    r8 *= 19; r9 *= 19;
+
+    m1 += (mul32x32_64(r9, s2) + mul32x32_64(r8, s3) + mul32x32_64(r7, s4) + mul32x32_64(r6, s5) + mul32x32_64(r5, s6) + mul32x32_64(r4, s7) + mul32x32_64(r3, s8) + mul32x32_64(r2, s9));
+    m3 += (mul32x32_64(r9, s4) + mul32x32_64(r8, s5) + mul32x32_64(r7, s6) + mul32x32_64(r6, s7) + mul32x32_64(r5, s8) + mul32x32_64(r4, s9));
+    m5 += (mul32x32_64(r9, s6) + mul32x32_64(r8, s7) + mul32x32_64(r7, s8) + mul32x32_64(r6, s9));
+    m7 += (mul32x32_64(r9, s8) + mul32x32_64(r8, s9));
+
+    r3 *= 2; r5 *= 2; r7 *= 2; r9 *= 2;
+
+    m0 += (mul32x32_64(r9, s1) + mul32x32_64(r8, s2) + mul32x32_64(r7, s3) + mul32x32_64(r6, s4) + mul32x32_64(r5, s5) + mul32x32_64(r4, s6) + mul32x32_64(r3, s7) + mul32x32_64(r2, s8) + mul32x32_64(r1, s9));
+    m2 += (mul32x32_64(r9, s3) + mul32x32_64(r8, s4) + mul32x32_64(r7, s5) + mul32x32_64(r6, s6) + mul32x32_64(r5, s7) + mul32x32_64(r4, s8) + mul32x32_64(r3, s9));
+    m4 += (mul32x32_64(r9, s5) + mul32x32_64(r8, s6) + mul32x32_64(r7, s7) + mul32x32_64(r6, s8) + mul32x32_64(r5, s9));
+    m6 += (mul32x32_64(r9, s7) + mul32x32_64(r8, s8) + mul32x32_64(r7, s9));
+    m8 += (mul32x32_64(r9, s9));
+
+                                 r0 = (word32)m0 & reduce_mask_26; c = (m0 >> 26);
+    m1 += c;                     r1 = (word32)m1 & reduce_mask_25; c = (m1 >> 25);
+    m2 += c;                     r2 = (word32)m2 & reduce_mask_26; c = (m2 >> 26);
+    m3 += c;                     r3 = (word32)m3 & reduce_mask_25; c = (m3 >> 25);
+    m4 += c;                     r4 = (word32)m4 & reduce_mask_26; c = (m4 >> 26);
+    m5 += c;                     r5 = (word32)m5 & reduce_mask_25; c = (m5 >> 25);
+    m6 += c;                     r6 = (word32)m6 & reduce_mask_26; c = (m6 >> 26);
+    m7 += c;                     r7 = (word32)m7 & reduce_mask_25; c = (m7 >> 25);
+    m8 += c;                     r8 = (word32)m8 & reduce_mask_26; c = (m8 >> 26);
+    m9 += c;                     r9 = (word32)m9 & reduce_mask_25; p = (word32)(m9 >> 25);
+    m0 = r0 + mul32x32_64(p,19); r0 = (word32)m0 & reduce_mask_26; p = (word32)(m0 >> 26);
+    r1 += p;
+
+    out[0] = r0; out[1] = r1; out[2] = r2; out[3] = r3; out[4] = r4;
+    out[5] = r5; out[6] = r6; out[7] = r7; out[8] = r8; out[9] = r9;
+}
+
+/* out = in * in */
+inline void
+curve25519_square(bignum25519 out, const bignum25519 in) {
+    word32 r0,r1,r2,r3,r4,r5,r6,r7,r8,r9;
+    word32 d6,d7,d8,d9;
+    word64 m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,c;
+    word32 p;
+
+    r0 = in[0]; r1 = in[1]; r2 = in[2]; r3 = in[3]; r4 = in[4];
+    r5 = in[5]; r6 = in[6]; r7 = in[7]; r8 = in[8]; r9 = in[9];
+
+    m0 = mul32x32_64(r0, r0);
+    r0 *= 2;
+    m1 = mul32x32_64(r0, r1);
+    m2 = mul32x32_64(r0, r2) + mul32x32_64(r1, r1 * 2);
+    r1 *= 2;
+    m3 = mul32x32_64(r0, r3) + mul32x32_64(r1, r2    );
+    m4 = mul32x32_64(r0, r4) + mul32x32_64(r1, r3 * 2) + mul32x32_64(r2, r2);
+    r2 *= 2;
+    m5 = mul32x32_64(r0, r5) + mul32x32_64(r1, r4    ) + mul32x32_64(r2, r3);
+    m6 = mul32x32_64(r0, r6) + mul32x32_64(r1, r5 * 2) + mul32x32_64(r2, r4) + mul32x32_64(r3, r3 * 2);
+    r3 *= 2;
+    m7 = mul32x32_64(r0, r7) + mul32x32_64(r1, r6    ) + mul32x32_64(r2, r5) + mul32x32_64(r3, r4    );
+    m8 = mul32x32_64(r0, r8) + mul32x32_64(r1, r7 * 2) + mul32x32_64(r2, r6) + mul32x32_64(r3, r5 * 2) + mul32x32_64(r4, r4    );
+    m9 = mul32x32_64(r0, r9) + mul32x32_64(r1, r8    ) + mul32x32_64(r2, r7) + mul32x32_64(r3, r6    ) + mul32x32_64(r4, r5 * 2);
+
+    d6 = r6 * 19; d7 = r7 * 2 * 19;
+    d8 = r8 * 19; d9 = r9 * 2 * 19;
+
+    m0 += (mul32x32_64(d9, r1    ) + mul32x32_64(d8, r2    ) + mul32x32_64(d7, r3    ) + mul32x32_64(d6, r4 * 2) + mul32x32_64(r5, r5 * 2 * 19));
+    m1 += (mul32x32_64(d9, r2 / 2) + mul32x32_64(d8, r3    ) + mul32x32_64(d7, r4    ) + mul32x32_64(d6, r5 * 2));
+    m2 += (mul32x32_64(d9, r3    ) + mul32x32_64(d8, r4 * 2) + mul32x32_64(d7, r5 * 2) + mul32x32_64(d6, r6    ));
+    m3 += (mul32x32_64(d9, r4    ) + mul32x32_64(d8, r5 * 2) + mul32x32_64(d7, r6    ));
+    m4 += (mul32x32_64(d9, r5 * 2) + mul32x32_64(d8, r6 * 2) + mul32x32_64(d7, r7    ));
+    m5 += (mul32x32_64(d9, r6    ) + mul32x32_64(d8, r7 * 2));
+    m6 += (mul32x32_64(d9, r7 * 2) + mul32x32_64(d8, r8    ));
+    m7 += (mul32x32_64(d9, r8    ));
+    m8 += (mul32x32_64(d9, r9    ));
+
+                                 r0 = (word32)m0 & reduce_mask_26; c = (m0 >> 26);
+    m1 += c;                     r1 = (word32)m1 & reduce_mask_25; c = (m1 >> 25);
+    m2 += c;                     r2 = (word32)m2 & reduce_mask_26; c = (m2 >> 26);
+    m3 += c;                     r3 = (word32)m3 & reduce_mask_25; c = (m3 >> 25);
+    m4 += c;                     r4 = (word32)m4 & reduce_mask_26; c = (m4 >> 26);
+    m5 += c;                     r5 = (word32)m5 & reduce_mask_25; c = (m5 >> 25);
+    m6 += c;                     r6 = (word32)m6 & reduce_mask_26; c = (m6 >> 26);
+    m7 += c;                     r7 = (word32)m7 & reduce_mask_25; c = (m7 >> 25);
+    m8 += c;                     r8 = (word32)m8 & reduce_mask_26; c = (m8 >> 26);
+    m9 += c;                     r9 = (word32)m9 & reduce_mask_25; p = (word32)(m9 >> 25);
+    m0 = r0 + mul32x32_64(p,19); r0 = (word32)m0 & reduce_mask_26; p = (word32)(m0 >> 26);
+    r1 += p;
+
+    out[0] = r0; out[1] = r1; out[2] = r2; out[3] = r3; out[4] = r4;
+    out[5] = r5; out[6] = r6; out[7] = r7; out[8] = r8; out[9] = r9;
+}
+
+/* out = in^(2 * count) */
+void
+curve25519_square_times(bignum25519 out, const bignum25519 in, int count) {
+    word32 r0,r1,r2,r3,r4,r5,r6,r7,r8,r9;
+    word32 d6,d7,d8,d9;
+    word64 m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,c;
+    word32 p;
+
+    r0 = in[0]; r1 = in[1]; r2 = in[2]; r3 = in[3]; r4 = in[4];
+    r5 = in[5]; r6 = in[6]; r7 = in[7]; r8 = in[8]; r9 = in[9];
+
+    do {
+        m0 = mul32x32_64(r0, r0);
+        r0 *= 2;
+        m1 = mul32x32_64(r0, r1);
+        m2 = mul32x32_64(r0, r2) + mul32x32_64(r1, r1 * 2);
+        r1 *= 2;
+        m3 = mul32x32_64(r0, r3) + mul32x32_64(r1, r2    );
+        m4 = mul32x32_64(r0, r4) + mul32x32_64(r1, r3 * 2) + mul32x32_64(r2, r2);
+        r2 *= 2;
+        m5 = mul32x32_64(r0, r5) + mul32x32_64(r1, r4    ) + mul32x32_64(r2, r3);
+        m6 = mul32x32_64(r0, r6) + mul32x32_64(r1, r5 * 2) + mul32x32_64(r2, r4) + mul32x32_64(r3, r3 * 2);
+        r3 *= 2;
+        m7 = mul32x32_64(r0, r7) + mul32x32_64(r1, r6    ) + mul32x32_64(r2, r5) + mul32x32_64(r3, r4    );
+        m8 = mul32x32_64(r0, r8) + mul32x32_64(r1, r7 * 2) + mul32x32_64(r2, r6) + mul32x32_64(r3, r5 * 2) + mul32x32_64(r4, r4    );
+        m9 = mul32x32_64(r0, r9) + mul32x32_64(r1, r8    ) + mul32x32_64(r2, r7) + mul32x32_64(r3, r6    ) + mul32x32_64(r4, r5 * 2);
+
+        d6 = r6 * 19; d7 = r7 * 2 * 19;
+        d8 = r8 * 19; d9 = r9 * 2 * 19;
+
+        m0 += (mul32x32_64(d9, r1    ) + mul32x32_64(d8, r2    ) + mul32x32_64(d7, r3    ) + mul32x32_64(d6, r4 * 2) + mul32x32_64(r5, r5 * 2 * 19));
+        m1 += (mul32x32_64(d9, r2 / 2) + mul32x32_64(d8, r3    ) + mul32x32_64(d7, r4    ) + mul32x32_64(d6, r5 * 2));
+        m2 += (mul32x32_64(d9, r3    ) + mul32x32_64(d8, r4 * 2) + mul32x32_64(d7, r5 * 2) + mul32x32_64(d6, r6    ));
+        m3 += (mul32x32_64(d9, r4    ) + mul32x32_64(d8, r5 * 2) + mul32x32_64(d7, r6    ));
+        m4 += (mul32x32_64(d9, r5 * 2) + mul32x32_64(d8, r6 * 2) + mul32x32_64(d7, r7    ));
+        m5 += (mul32x32_64(d9, r6    ) + mul32x32_64(d8, r7 * 2));
+        m6 += (mul32x32_64(d9, r7 * 2) + mul32x32_64(d8, r8    ));
+        m7 += (mul32x32_64(d9, r8    ));
+        m8 += (mul32x32_64(d9, r9    ));
+
+                                     r0 = (word32)m0 & reduce_mask_26; c = (m0 >> 26);
+        m1 += c;                     r1 = (word32)m1 & reduce_mask_25; c = (m1 >> 25);
+        m2 += c;                     r2 = (word32)m2 & reduce_mask_26; c = (m2 >> 26);
+        m3 += c;                     r3 = (word32)m3 & reduce_mask_25; c = (m3 >> 25);
+        m4 += c;                     r4 = (word32)m4 & reduce_mask_26; c = (m4 >> 26);
+        m5 += c;                     r5 = (word32)m5 & reduce_mask_25; c = (m5 >> 25);
+        m6 += c;                     r6 = (word32)m6 & reduce_mask_26; c = (m6 >> 26);
+        m7 += c;                     r7 = (word32)m7 & reduce_mask_25; c = (m7 >> 25);
+        m8 += c;                     r8 = (word32)m8 & reduce_mask_26; c = (m8 >> 26);
+        m9 += c;                     r9 = (word32)m9 & reduce_mask_25; p = (word32)(m9 >> 25);
+        m0 = r0 + mul32x32_64(p,19); r0 = (word32)m0 & reduce_mask_26; p = (word32)(m0 >> 26);
+        r1 += p;
+    } while (--count);
+
+    out[0] = r0; out[1] = r1; out[2] = r2; out[3] = r3; out[4] = r4;
+    out[5] = r5; out[6] = r6; out[7] = r7; out[8] = r8; out[9] = r9;
+}
+
+/* Take a little-endian, 32-byte number and expand it into polynomial form */
+void
+curve25519_expand(bignum25519 out, const byte in[32]) {
+    word32 x0,x1,x2,x3,x4,x5,x6,x7;
+    GetBlock<word32, LittleEndian> block(in);
+    block(x0)(x1)(x2)(x3)(x4)(x5)(x6)(x7);
+
+    out[0] = (                      x0       ) & reduce_mask_26;
+    out[1] = ((((word64)x1 << 32) | x0) >> 26) & reduce_mask_25;
+    out[2] = ((((word64)x2 << 32) | x1) >> 19) & reduce_mask_26;
+    out[3] = ((((word64)x3 << 32) | x2) >> 13) & reduce_mask_25;
+    out[4] = ((                     x3) >>  6) & reduce_mask_26;
+    out[5] = (                      x4       ) & reduce_mask_25;
+    out[6] = ((((word64)x5 << 32) | x4) >> 25) & reduce_mask_26;
+    out[7] = ((((word64)x6 << 32) | x5) >> 19) & reduce_mask_25;
+    out[8] = ((((word64)x7 << 32) | x6) >> 12) & reduce_mask_26;
+    out[9] = ((                     x7) >>  6) & reduce_mask_25; /* ignore the top bit */
+}
+
+/* Take a fully reduced polynomial form number and contract it into a little-endian, 32-byte array */
+void
+curve25519_contract(byte out[32], const bignum25519 in) {
+    bignum25519 f;
+    curve25519_copy(f, in);
+
+    #define carry_pass() \
+        f[1] += f[0] >> 26; f[0] &= reduce_mask_26; \
+        f[2] += f[1] >> 25; f[1] &= reduce_mask_25; \
+        f[3] += f[2] >> 26; f[2] &= reduce_mask_26; \
+        f[4] += f[3] >> 25; f[3] &= reduce_mask_25; \
+        f[5] += f[4] >> 26; f[4] &= reduce_mask_26; \
+        f[6] += f[5] >> 25; f[5] &= reduce_mask_25; \
+        f[7] += f[6] >> 26; f[6] &= reduce_mask_26; \
+        f[8] += f[7] >> 25; f[7] &= reduce_mask_25; \
+        f[9] += f[8] >> 26; f[8] &= reduce_mask_26;
+
+    #define carry_pass_full() \
+        carry_pass() \
+        f[0] += 19 * (f[9] >> 25); f[9] &= reduce_mask_25;
+
+    #define carry_pass_final() \
+        carry_pass() \
+        f[9] &= reduce_mask_25;
+
+    carry_pass_full()
+    carry_pass_full()
+
+    /* now t is between 0 and 2^255-1, properly carried. */
+    /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */
+    f[0] += 19;
+    carry_pass_full()
+
+    /* now between 19 and 2^255-1 in both cases, and offset by 19. */
+    f[0] += (1 << 26) - 19;
+    f[1] += (1 << 25) - 1;
+    f[2] += (1 << 26) - 1;
+    f[3] += (1 << 25) - 1;
+    f[4] += (1 << 26) - 1;
+    f[5] += (1 << 25) - 1;
+    f[6] += (1 << 26) - 1;
+    f[7] += (1 << 25) - 1;
+    f[8] += (1 << 26) - 1;
+    f[9] += (1 << 25) - 1;
+
+    /* now between 2^255 and 2^256-20, and offset by 2^255. */
+    carry_pass_final()
+
+    #undef carry_pass
+    #undef carry_full
+    #undef carry_final
+
+    f[1] <<= 2;
+    f[2] <<= 3;
+    f[3] <<= 5;
+    f[4] <<= 6;
+    f[6] <<= 1;
+    f[7] <<= 3;
+    f[8] <<= 4;
+    f[9] <<= 6;
+
+    #define F(i, s) \
+        out[s+0] |= (byte)( f[i] & 0xff); \
+        out[s+1]  = (byte)((f[i] >>  8) & 0xff); \
+        out[s+2]  = (byte)((f[i] >> 16) & 0xff); \
+        out[s+3]  = (byte)((f[i] >> 24) & 0xff);
+
+    out[0] = out[16] = 0;
+    F(0,0); F(1,3);
+    F(2,6); F(3,9);
+    F(4,12); F(5,16);
+    F(6,19); F(7,22);
+    F(8,25); F(9,28);
+    #undef F
+}
+
+inline void
+curve25519_swap_conditional(bignum25519 x, bignum25519 qpx, word32 iswap) {
+    const word32 swap = (word32)(-(sword32)iswap);
+    word32 x0,x1,x2,x3,x4,x5,x6,x7,x8,x9;
+
+    x0 = swap & (x[0] ^ qpx[0]); x[0] ^= x0; qpx[0] ^= x0;
+    x1 = swap & (x[1] ^ qpx[1]); x[1] ^= x1; qpx[1] ^= x1;
+    x2 = swap & (x[2] ^ qpx[2]); x[2] ^= x2; qpx[2] ^= x2;
+    x3 = swap & (x[3] ^ qpx[3]); x[3] ^= x3; qpx[3] ^= x3;
+    x4 = swap & (x[4] ^ qpx[4]); x[4] ^= x4; qpx[4] ^= x4;
+    x5 = swap & (x[5] ^ qpx[5]); x[5] ^= x5; qpx[5] ^= x5;
+    x6 = swap & (x[6] ^ qpx[6]); x[6] ^= x6; qpx[6] ^= x6;
+    x7 = swap & (x[7] ^ qpx[7]); x[7] ^= x7; qpx[7] ^= x7;
+    x8 = swap & (x[8] ^ qpx[8]); x[8] ^= x8; qpx[8] ^= x8;
+    x9 = swap & (x[9] ^ qpx[9]); x[9] ^= x9; qpx[9] ^= x9;
+}
+
+/*
+ * In:  b =   2^5 - 2^0
+ * Out: b = 2^250 - 2^0
+ */
+void
+curve25519_pow_two5mtwo0_two250mtwo0(bignum25519 b) {
+    ALIGN(ALIGN_SPEC) bignum25519 t0,c;
+
+    /* 2^5  - 2^0 */ /* b */
+    /* 2^10 - 2^5 */ curve25519_square_times(t0, b, 5);
+    /* 2^10 - 2^0 */ curve25519_mul(b, t0, b);
+    /* 2^20 - 2^10 */ curve25519_square_times(t0, b, 10);
+    /* 2^20 - 2^0 */ curve25519_mul(c, t0, b);
+    /* 2^40 - 2^20 */ curve25519_square_times(t0, c, 20);
+    /* 2^40 - 2^0 */ curve25519_mul(t0, t0, c);
+    /* 2^50 - 2^10 */ curve25519_square_times(t0, t0, 10);
+    /* 2^50 - 2^0 */ curve25519_mul(b, t0, b);
+    /* 2^100 - 2^50 */ curve25519_square_times(t0, b, 50);
+    /* 2^100 - 2^0 */ curve25519_mul(c, t0, b);
+    /* 2^200 - 2^100 */ curve25519_square_times(t0, c, 100);
+    /* 2^200 - 2^0 */ curve25519_mul(t0, t0, c);
+    /* 2^250 - 2^50 */ curve25519_square_times(t0, t0, 50);
+    /* 2^250 - 2^0 */ curve25519_mul(b, t0, b);
+}
+
+/*
+ * z^(p - 2) = z(2^255 - 21)
+ */
+void
+curve25519_recip(bignum25519 out, const bignum25519 z) {
+    ALIGN(ALIGN_SPEC) bignum25519 a, t0, b;
+
+    /* 2 */ curve25519_square(a, z); /* a = 2 */
+    /* 8 */ curve25519_square_times(t0, a, 2);
+    /* 9 */ curve25519_mul(b, t0, z); /* b = 9 */
+    /* 11 */ curve25519_mul(a, b, a); /* a = 11 */
+    /* 22 */ curve25519_square(t0, a);
+    /* 2^5 - 2^0 = 31 */ curve25519_mul(b, t0, b);
+    /* 2^250 - 2^0 */ curve25519_pow_two5mtwo0_two250mtwo0(b);
+    /* 2^255 - 2^5 */ curve25519_square_times(b, b, 5);
+    /* 2^255 - 21 */  curve25519_mul(out, b, a);
+}
+
+ANONYMOUS_NAMESPACE_END
+NAMESPACE_END  // X25519
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+//******************************* ed25519 *******************************//
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+NAMESPACE_BEGIN(Ed25519)
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::sword32;
+using CryptoPP::word64;
+using CryptoPP::sword64;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+
+using CryptoPP::SHA512;
+
+// Bring in all the symbols from the 32-bit header
+using namespace CryptoPP::Donna::Arch32;
+
+/* out = in */
+inline void
+curve25519_copy(bignum25519 out, const bignum25519 in) {
+    out[0] = in[0]; out[1] = in[1];
+    out[2] = in[2]; out[3] = in[3];
+    out[4] = in[4]; out[5] = in[5];
+    out[6] = in[6]; out[7] = in[7];
+    out[8] = in[8]; out[9] = in[9];
+}
+
+/* out = a + b */
+inline void
+curve25519_add(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    out[0] = a[0] + b[0]; out[1] = a[1] + b[1];
+    out[2] = a[2] + b[2]; out[3] = a[3] + b[3];
+    out[4] = a[4] + b[4]; out[5] = a[5] + b[5];
+    out[6] = a[6] + b[6]; out[7] = a[7] + b[7];
+    out[8] = a[8] + b[8]; out[9] = a[9] + b[9];
+}
+
+inline void
+curve25519_add_after_basic(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word32 c;
+    out[0] = a[0] + b[0]    ; c = (out[0] >> 26); out[0] &= reduce_mask_26;
+    out[1] = a[1] + b[1] + c; c = (out[1] >> 25); out[1] &= reduce_mask_25;
+    out[2] = a[2] + b[2] + c; c = (out[2] >> 26); out[2] &= reduce_mask_26;
+    out[3] = a[3] + b[3] + c; c = (out[3] >> 25); out[3] &= reduce_mask_25;
+    out[4] = a[4] + b[4] + c; c = (out[4] >> 26); out[4] &= reduce_mask_26;
+    out[5] = a[5] + b[5] + c; c = (out[5] >> 25); out[5] &= reduce_mask_25;
+    out[6] = a[6] + b[6] + c; c = (out[6] >> 26); out[6] &= reduce_mask_26;
+    out[7] = a[7] + b[7] + c; c = (out[7] >> 25); out[7] &= reduce_mask_25;
+    out[8] = a[8] + b[8] + c; c = (out[8] >> 26); out[8] &= reduce_mask_26;
+    out[9] = a[9] + b[9] + c; c = (out[9] >> 25); out[9] &= reduce_mask_25;
+    out[0] += 19 * c;
+}
+
+inline void
+curve25519_add_reduce(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word32 c;
+    out[0] = a[0] + b[0]    ; c = (out[0] >> 26); out[0] &= reduce_mask_26;
+    out[1] = a[1] + b[1] + c; c = (out[1] >> 25); out[1] &= reduce_mask_25;
+    out[2] = a[2] + b[2] + c; c = (out[2] >> 26); out[2] &= reduce_mask_26;
+    out[3] = a[3] + b[3] + c; c = (out[3] >> 25); out[3] &= reduce_mask_25;
+    out[4] = a[4] + b[4] + c; c = (out[4] >> 26); out[4] &= reduce_mask_26;
+    out[5] = a[5] + b[5] + c; c = (out[5] >> 25); out[5] &= reduce_mask_25;
+    out[6] = a[6] + b[6] + c; c = (out[6] >> 26); out[6] &= reduce_mask_26;
+    out[7] = a[7] + b[7] + c; c = (out[7] >> 25); out[7] &= reduce_mask_25;
+    out[8] = a[8] + b[8] + c; c = (out[8] >> 26); out[8] &= reduce_mask_26;
+    out[9] = a[9] + b[9] + c; c = (out[9] >> 25); out[9] &= reduce_mask_25;
+    out[0] += 19 * c;
+}
+
+/* out = a - b */
+inline void
+curve25519_sub(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word32 c;
+    out[0] = twoP0     + a[0] - b[0]    ; c = (out[0] >> 26); out[0] &= reduce_mask_26;
+    out[1] = twoP13579 + a[1] - b[1] + c; c = (out[1] >> 25); out[1] &= reduce_mask_25;
+    out[2] = twoP2468  + a[2] - b[2] + c; c = (out[2] >> 26); out[2] &= reduce_mask_26;
+    out[3] = twoP13579 + a[3] - b[3] + c; c = (out[3] >> 25); out[3] &= reduce_mask_25;
+    out[4] = twoP2468  + a[4] - b[4] + c;
+    out[5] = twoP13579 + a[5] - b[5]    ;
+    out[6] = twoP2468  + a[6] - b[6]    ;
+    out[7] = twoP13579 + a[7] - b[7]    ;
+    out[8] = twoP2468  + a[8] - b[8]    ;
+    out[9] = twoP13579 + a[9] - b[9]    ;
+}
+
+/* out = a - b, where a is the result of a basic op (add,sub) */
+inline void
+curve25519_sub_after_basic(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word32 c;
+    out[0] = fourP0     + a[0] - b[0]    ; c = (out[0] >> 26); out[0] &= reduce_mask_26;
+    out[1] = fourP13579 + a[1] - b[1] + c; c = (out[1] >> 25); out[1] &= reduce_mask_25;
+    out[2] = fourP2468  + a[2] - b[2] + c; c = (out[2] >> 26); out[2] &= reduce_mask_26;
+    out[3] = fourP13579 + a[3] - b[3] + c; c = (out[3] >> 25); out[3] &= reduce_mask_25;
+    out[4] = fourP2468  + a[4] - b[4] + c; c = (out[4] >> 26); out[4] &= reduce_mask_26;
+    out[5] = fourP13579 + a[5] - b[5] + c; c = (out[5] >> 25); out[5] &= reduce_mask_25;
+    out[6] = fourP2468  + a[6] - b[6] + c; c = (out[6] >> 26); out[6] &= reduce_mask_26;
+    out[7] = fourP13579 + a[7] - b[7] + c; c = (out[7] >> 25); out[7] &= reduce_mask_25;
+    out[8] = fourP2468  + a[8] - b[8] + c; c = (out[8] >> 26); out[8] &= reduce_mask_26;
+    out[9] = fourP13579 + a[9] - b[9] + c; c = (out[9] >> 25); out[9] &= reduce_mask_25;
+    out[0] += 19 * c;
+}
+
+inline void
+curve25519_sub_reduce(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word32 c;
+    out[0] = fourP0     + a[0] - b[0]    ; c = (out[0] >> 26); out[0] &= reduce_mask_26;
+    out[1] = fourP13579 + a[1] - b[1] + c; c = (out[1] >> 25); out[1] &= reduce_mask_25;
+    out[2] = fourP2468  + a[2] - b[2] + c; c = (out[2] >> 26); out[2] &= reduce_mask_26;
+    out[3] = fourP13579 + a[3] - b[3] + c; c = (out[3] >> 25); out[3] &= reduce_mask_25;
+    out[4] = fourP2468  + a[4] - b[4] + c; c = (out[4] >> 26); out[4] &= reduce_mask_26;
+    out[5] = fourP13579 + a[5] - b[5] + c; c = (out[5] >> 25); out[5] &= reduce_mask_25;
+    out[6] = fourP2468  + a[6] - b[6] + c; c = (out[6] >> 26); out[6] &= reduce_mask_26;
+    out[7] = fourP13579 + a[7] - b[7] + c; c = (out[7] >> 25); out[7] &= reduce_mask_25;
+    out[8] = fourP2468  + a[8] - b[8] + c; c = (out[8] >> 26); out[8] &= reduce_mask_26;
+    out[9] = fourP13579 + a[9] - b[9] + c; c = (out[9] >> 25); out[9] &= reduce_mask_25;
+    out[0] += 19 * c;
+}
+
+/* out = -a */
+inline void
+curve25519_neg(bignum25519 out, const bignum25519 a) {
+    word32 c;
+    out[0] = twoP0     - a[0]    ; c = (out[0] >> 26); out[0] &= reduce_mask_26;
+    out[1] = twoP13579 - a[1] + c; c = (out[1] >> 25); out[1] &= reduce_mask_25;
+    out[2] = twoP2468  - a[2] + c; c = (out[2] >> 26); out[2] &= reduce_mask_26;
+    out[3] = twoP13579 - a[3] + c; c = (out[3] >> 25); out[3] &= reduce_mask_25;
+    out[4] = twoP2468  - a[4] + c; c = (out[4] >> 26); out[4] &= reduce_mask_26;
+    out[5] = twoP13579 - a[5] + c; c = (out[5] >> 25); out[5] &= reduce_mask_25;
+    out[6] = twoP2468  - a[6] + c; c = (out[6] >> 26); out[6] &= reduce_mask_26;
+    out[7] = twoP13579 - a[7] + c; c = (out[7] >> 25); out[7] &= reduce_mask_25;
+    out[8] = twoP2468  - a[8] + c; c = (out[8] >> 26); out[8] &= reduce_mask_26;
+    out[9] = twoP13579 - a[9] + c; c = (out[9] >> 25); out[9] &= reduce_mask_25;
+    out[0] += 19 * c;
+}
+
+/* out = a * b */
+void
+curve25519_mul(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word32 r0,r1,r2,r3,r4,r5,r6,r7,r8,r9;
+    word32 s0,s1,s2,s3,s4,s5,s6,s7,s8,s9;
+    word64 m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,c;
+    word32 p;
+
+    r0 = b[0]; r1 = b[1];
+    r2 = b[2]; r3 = b[3];
+    r4 = b[4]; r5 = b[5];
+    r6 = b[6]; r7 = b[7];
+    r8 = b[8]; r9 = b[9];
+
+    s0 = a[0]; s1 = a[1];
+    s2 = a[2]; s3 = a[3];
+    s4 = a[4]; s5 = a[5];
+    s6 = a[6]; s7 = a[7];
+    s8 = a[8]; s9 = a[9];
+
+    m1 = mul32x32_64(r0, s1) + mul32x32_64(r1, s0);
+    m3 = mul32x32_64(r0, s3) + mul32x32_64(r1, s2) + mul32x32_64(r2, s1) + mul32x32_64(r3, s0);
+    m5 = mul32x32_64(r0, s5) + mul32x32_64(r1, s4) + mul32x32_64(r2, s3) + mul32x32_64(r3, s2) + mul32x32_64(r4, s1) + mul32x32_64(r5, s0);
+    m7 = mul32x32_64(r0, s7) + mul32x32_64(r1, s6) + mul32x32_64(r2, s5) + mul32x32_64(r3, s4) + mul32x32_64(r4, s3) + mul32x32_64(r5, s2) + mul32x32_64(r6, s1) + mul32x32_64(r7, s0);
+    m9 = mul32x32_64(r0, s9) + mul32x32_64(r1, s8) + mul32x32_64(r2, s7) + mul32x32_64(r3, s6) + mul32x32_64(r4, s5) + mul32x32_64(r5, s4) + mul32x32_64(r6, s3) + mul32x32_64(r7, s2) + mul32x32_64(r8, s1) + mul32x32_64(r9, s0);
+
+    r1 *= 2; r3 *= 2;
+    r5 *= 2; r7 *= 2;
+
+    m0 = mul32x32_64(r0, s0);
+    m2 = mul32x32_64(r0, s2) + mul32x32_64(r1, s1) + mul32x32_64(r2, s0);
+    m4 = mul32x32_64(r0, s4) + mul32x32_64(r1, s3) + mul32x32_64(r2, s2) + mul32x32_64(r3, s1) + mul32x32_64(r4, s0);
+    m6 = mul32x32_64(r0, s6) + mul32x32_64(r1, s5) + mul32x32_64(r2, s4) + mul32x32_64(r3, s3) + mul32x32_64(r4, s2) + mul32x32_64(r5, s1) + mul32x32_64(r6, s0);
+    m8 = mul32x32_64(r0, s8) + mul32x32_64(r1, s7) + mul32x32_64(r2, s6) + mul32x32_64(r3, s5) + mul32x32_64(r4, s4) + mul32x32_64(r5, s3) + mul32x32_64(r6, s2) + mul32x32_64(r7, s1) + mul32x32_64(r8, s0);
+
+    r1 *= 19; r2 *= 19;
+    r3 = (r3 / 2) * 19;
+    r4 *= 19;
+    r5 = (r5 / 2) * 19;
+    r6 *= 19;
+    r7 = (r7 / 2) * 19;
+    r8 *= 19; r9 *= 19;
+
+    m1 += (mul32x32_64(r9, s2) + mul32x32_64(r8, s3) + mul32x32_64(r7, s4) + mul32x32_64(r6, s5) + mul32x32_64(r5, s6) + mul32x32_64(r4, s7) + mul32x32_64(r3, s8) + mul32x32_64(r2, s9));
+    m3 += (mul32x32_64(r9, s4) + mul32x32_64(r8, s5) + mul32x32_64(r7, s6) + mul32x32_64(r6, s7) + mul32x32_64(r5, s8) + mul32x32_64(r4, s9));
+    m5 += (mul32x32_64(r9, s6) + mul32x32_64(r8, s7) + mul32x32_64(r7, s8) + mul32x32_64(r6, s9));
+    m7 += (mul32x32_64(r9, s8) + mul32x32_64(r8, s9));
+
+    r3 *= 2; r5 *= 2;
+    r7 *= 2; r9 *= 2;
+
+    m0 += (mul32x32_64(r9, s1) + mul32x32_64(r8, s2) + mul32x32_64(r7, s3) + mul32x32_64(r6, s4) + mul32x32_64(r5, s5) + mul32x32_64(r4, s6) + mul32x32_64(r3, s7) + mul32x32_64(r2, s8) + mul32x32_64(r1, s9));
+    m2 += (mul32x32_64(r9, s3) + mul32x32_64(r8, s4) + mul32x32_64(r7, s5) + mul32x32_64(r6, s6) + mul32x32_64(r5, s7) + mul32x32_64(r4, s8) + mul32x32_64(r3, s9));
+    m4 += (mul32x32_64(r9, s5) + mul32x32_64(r8, s6) + mul32x32_64(r7, s7) + mul32x32_64(r6, s8) + mul32x32_64(r5, s9));
+    m6 += (mul32x32_64(r9, s7) + mul32x32_64(r8, s8) + mul32x32_64(r7, s9));
+    m8 += (mul32x32_64(r9, s9));
+
+                                 r0 = (word32)m0 & reduce_mask_26; c = (m0 >> 26);
+    m1 += c;                     r1 = (word32)m1 & reduce_mask_25; c = (m1 >> 25);
+    m2 += c;                     r2 = (word32)m2 & reduce_mask_26; c = (m2 >> 26);
+    m3 += c;                     r3 = (word32)m3 & reduce_mask_25; c = (m3 >> 25);
+    m4 += c;                     r4 = (word32)m4 & reduce_mask_26; c = (m4 >> 26);
+    m5 += c;                     r5 = (word32)m5 & reduce_mask_25; c = (m5 >> 25);
+    m6 += c;                     r6 = (word32)m6 & reduce_mask_26; c = (m6 >> 26);
+    m7 += c;                     r7 = (word32)m7 & reduce_mask_25; c = (m7 >> 25);
+    m8 += c;                     r8 = (word32)m8 & reduce_mask_26; c = (m8 >> 26);
+    m9 += c;                     r9 = (word32)m9 & reduce_mask_25; p = (word32)(m9 >> 25);
+    m0 = r0 + mul32x32_64(p,19); r0 = (word32)m0 & reduce_mask_26; p = (word32)(m0 >> 26);
+    r1 += p;
+
+    out[0] = r0; out[1] = r1;
+    out[2] = r2; out[3] = r3;
+    out[4] = r4; out[5] = r5;
+    out[6] = r6; out[7] = r7;
+    out[8] = r8; out[9] = r9;
+}
+
+/* out = in*in */
+void
+curve25519_square(bignum25519 out, const bignum25519 in) {
+    word32 r0,r1,r2,r3,r4,r5,r6,r7,r8,r9;
+    word32 d6,d7,d8,d9;
+    word64 m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,c;
+    word32 p;
+
+    r0 = in[0]; r1 = in[1];
+    r2 = in[2]; r3 = in[3];
+    r4 = in[4]; r5 = in[5];
+    r6 = in[6]; r7 = in[7];
+    r8 = in[8]; r9 = in[9];
+
+    m0 = mul32x32_64(r0, r0);
+    r0 *= 2;
+    m1 = mul32x32_64(r0, r1);
+    m2 = mul32x32_64(r0, r2) + mul32x32_64(r1, r1 * 2);
+    r1 *= 2;
+    m3 = mul32x32_64(r0, r3) + mul32x32_64(r1, r2    );
+    m4 = mul32x32_64(r0, r4) + mul32x32_64(r1, r3 * 2) + mul32x32_64(r2, r2);
+    r2 *= 2;
+    m5 = mul32x32_64(r0, r5) + mul32x32_64(r1, r4    ) + mul32x32_64(r2, r3);
+    m6 = mul32x32_64(r0, r6) + mul32x32_64(r1, r5 * 2) + mul32x32_64(r2, r4) + mul32x32_64(r3, r3 * 2);
+    r3 *= 2;
+    m7 = mul32x32_64(r0, r7) + mul32x32_64(r1, r6    ) + mul32x32_64(r2, r5) + mul32x32_64(r3, r4    );
+    m8 = mul32x32_64(r0, r8) + mul32x32_64(r1, r7 * 2) + mul32x32_64(r2, r6) + mul32x32_64(r3, r5 * 2) + mul32x32_64(r4, r4    );
+    m9 = mul32x32_64(r0, r9) + mul32x32_64(r1, r8    ) + mul32x32_64(r2, r7) + mul32x32_64(r3, r6    ) + mul32x32_64(r4, r5 * 2);
+
+    d6 = r6 * 19;
+    d7 = r7 * 2 * 19;
+    d8 = r8 * 19;
+    d9 = r9 * 2 * 19;
+
+    m0 += (mul32x32_64(d9, r1    ) + mul32x32_64(d8, r2    ) + mul32x32_64(d7, r3    ) + mul32x32_64(d6, r4 * 2) + mul32x32_64(r5, r5 * 2 * 19));
+    m1 += (mul32x32_64(d9, r2 / 2) + mul32x32_64(d8, r3    ) + mul32x32_64(d7, r4    ) + mul32x32_64(d6, r5 * 2));
+    m2 += (mul32x32_64(d9, r3    ) + mul32x32_64(d8, r4 * 2) + mul32x32_64(d7, r5 * 2) + mul32x32_64(d6, r6    ));
+    m3 += (mul32x32_64(d9, r4    ) + mul32x32_64(d8, r5 * 2) + mul32x32_64(d7, r6    ));
+    m4 += (mul32x32_64(d9, r5 * 2) + mul32x32_64(d8, r6 * 2) + mul32x32_64(d7, r7    ));
+    m5 += (mul32x32_64(d9, r6    ) + mul32x32_64(d8, r7 * 2));
+    m6 += (mul32x32_64(d9, r7 * 2) + mul32x32_64(d8, r8    ));
+    m7 += (mul32x32_64(d9, r8    ));
+    m8 += (mul32x32_64(d9, r9    ));
+
+                                 r0 = (word32)m0 & reduce_mask_26; c = (m0 >> 26);
+    m1 += c;                     r1 = (word32)m1 & reduce_mask_25; c = (m1 >> 25);
+    m2 += c;                     r2 = (word32)m2 & reduce_mask_26; c = (m2 >> 26);
+    m3 += c;                     r3 = (word32)m3 & reduce_mask_25; c = (m3 >> 25);
+    m4 += c;                     r4 = (word32)m4 & reduce_mask_26; c = (m4 >> 26);
+    m5 += c;                     r5 = (word32)m5 & reduce_mask_25; c = (m5 >> 25);
+    m6 += c;                     r6 = (word32)m6 & reduce_mask_26; c = (m6 >> 26);
+    m7 += c;                     r7 = (word32)m7 & reduce_mask_25; c = (m7 >> 25);
+    m8 += c;                     r8 = (word32)m8 & reduce_mask_26; c = (m8 >> 26);
+    m9 += c;                     r9 = (word32)m9 & reduce_mask_25; p = (word32)(m9 >> 25);
+    m0 = r0 + mul32x32_64(p,19); r0 = (word32)m0 & reduce_mask_26; p = (word32)(m0 >> 26);
+    r1 += p;
+
+    out[0] = r0; out[1] = r1;
+    out[2] = r2; out[3] = r3;
+    out[4] = r4; out[5] = r5;
+    out[6] = r6; out[7] = r7;
+    out[8] = r8; out[9] = r9;
+}
+
+/* out = in ^ (2 * count) */
+void
+curve25519_square_times(bignum25519 out, const bignum25519 in, int count) {
+    word32 r0,r1,r2,r3,r4,r5,r6,r7,r8,r9;
+    word32 d6,d7,d8,d9,p;
+    word64 m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,c;
+
+    r0 = in[0]; r1 = in[1];
+    r2 = in[2]; r3 = in[3];
+    r4 = in[4]; r5 = in[5];
+    r6 = in[6]; r7 = in[7];
+    r8 = in[8]; r9 = in[9];
+
+    do {
+        m0 = mul32x32_64(r0, r0);
+        r0 *= 2;
+        m1 = mul32x32_64(r0, r1);
+        m2 = mul32x32_64(r0, r2) + mul32x32_64(r1, r1 * 2);
+        r1 *= 2;
+        m3 = mul32x32_64(r0, r3) + mul32x32_64(r1, r2    );
+        m4 = mul32x32_64(r0, r4) + mul32x32_64(r1, r3 * 2) + mul32x32_64(r2, r2);
+        r2 *= 2;
+        m5 = mul32x32_64(r0, r5) + mul32x32_64(r1, r4    ) + mul32x32_64(r2, r3);
+        m6 = mul32x32_64(r0, r6) + mul32x32_64(r1, r5 * 2) + mul32x32_64(r2, r4) + mul32x32_64(r3, r3 * 2);
+        r3 *= 2;
+        m7 = mul32x32_64(r0, r7) + mul32x32_64(r1, r6    ) + mul32x32_64(r2, r5) + mul32x32_64(r3, r4    );
+        m8 = mul32x32_64(r0, r8) + mul32x32_64(r1, r7 * 2) + mul32x32_64(r2, r6) + mul32x32_64(r3, r5 * 2) + mul32x32_64(r4, r4    );
+        m9 = mul32x32_64(r0, r9) + mul32x32_64(r1, r8    ) + mul32x32_64(r2, r7) + mul32x32_64(r3, r6    ) + mul32x32_64(r4, r5 * 2);
+
+        d6 = r6 * 19;
+        d7 = r7 * 2 * 19;
+        d8 = r8 * 19;
+        d9 = r9 * 2 * 19;
+
+        m0 += (mul32x32_64(d9, r1    ) + mul32x32_64(d8, r2    ) + mul32x32_64(d7, r3    ) + mul32x32_64(d6, r4 * 2) + mul32x32_64(r5, r5 * 2 * 19));
+        m1 += (mul32x32_64(d9, r2 / 2) + mul32x32_64(d8, r3    ) + mul32x32_64(d7, r4    ) + mul32x32_64(d6, r5 * 2));
+        m2 += (mul32x32_64(d9, r3    ) + mul32x32_64(d8, r4 * 2) + mul32x32_64(d7, r5 * 2) + mul32x32_64(d6, r6    ));
+        m3 += (mul32x32_64(d9, r4    ) + mul32x32_64(d8, r5 * 2) + mul32x32_64(d7, r6    ));
+        m4 += (mul32x32_64(d9, r5 * 2) + mul32x32_64(d8, r6 * 2) + mul32x32_64(d7, r7    ));
+        m5 += (mul32x32_64(d9, r6    ) + mul32x32_64(d8, r7 * 2));
+        m6 += (mul32x32_64(d9, r7 * 2) + mul32x32_64(d8, r8    ));
+        m7 += (mul32x32_64(d9, r8    ));
+        m8 += (mul32x32_64(d9, r9    ));
+
+                                     r0 = (word32)m0 & reduce_mask_26; c = (m0 >> 26);
+        m1 += c;                     r1 = (word32)m1 & reduce_mask_25; c = (m1 >> 25);
+        m2 += c;                     r2 = (word32)m2 & reduce_mask_26; c = (m2 >> 26);
+        m3 += c;                     r3 = (word32)m3 & reduce_mask_25; c = (m3 >> 25);
+        m4 += c;                     r4 = (word32)m4 & reduce_mask_26; c = (m4 >> 26);
+        m5 += c;                     r5 = (word32)m5 & reduce_mask_25; c = (m5 >> 25);
+        m6 += c;                     r6 = (word32)m6 & reduce_mask_26; c = (m6 >> 26);
+        m7 += c;                     r7 = (word32)m7 & reduce_mask_25; c = (m7 >> 25);
+        m8 += c;                     r8 = (word32)m8 & reduce_mask_26; c = (m8 >> 26);
+        m9 += c;                     r9 = (word32)m9 & reduce_mask_25; p = (word32)(m9 >> 25);
+        m0 = r0 + mul32x32_64(p,19); r0 = (word32)m0 & reduce_mask_26; p = (word32)(m0 >> 26);
+        r1 += p;
+    } while (--count);
+
+    out[0] = r0; out[1] = r1;
+    out[2] = r2; out[3] = r3;
+    out[4] = r4; out[5] = r5;
+    out[6] = r6; out[7] = r7;
+    out[8] = r8; out[9] = r9;
+}
+
+/* Take a little-endian, 32-byte number and expand it into polynomial form */
+void
+curve25519_expand(bignum25519 out, const byte in[32]) {
+    word32 x0,x1,x2,x3,x4,x5,x6,x7;
+    GetBlock<word32, LittleEndian> block(in);
+    block(x0)(x1)(x2)(x3)(x4)(x5)(x6)(x7);
+
+    out[0] = (                      x0       ) & 0x3ffffff;
+    out[1] = ((((word64)x1 << 32) | x0) >> 26) & 0x1ffffff;
+    out[2] = ((((word64)x2 << 32) | x1) >> 19) & 0x3ffffff;
+    out[3] = ((((word64)x3 << 32) | x2) >> 13) & 0x1ffffff;
+    out[4] = ((                     x3) >>  6) & 0x3ffffff;
+    out[5] = (                      x4       ) & 0x1ffffff;
+    out[6] = ((((word64)x5 << 32) | x4) >> 25) & 0x3ffffff;
+    out[7] = ((((word64)x6 << 32) | x5) >> 19) & 0x1ffffff;
+    out[8] = ((((word64)x7 << 32) | x6) >> 12) & 0x3ffffff;
+    out[9] = ((                     x7) >>  6) & 0x1ffffff;
+}
+
+/* Take a fully reduced polynomial form number and contract it into a
+ * little-endian, 32-byte array
+ */
+void
+curve25519_contract(byte out[32], const bignum25519 in) {
+    bignum25519 f;
+    curve25519_copy(f, in);
+
+    #define carry_pass() \
+        f[1] += f[0] >> 26; f[0] &= reduce_mask_26; \
+        f[2] += f[1] >> 25; f[1] &= reduce_mask_25; \
+        f[3] += f[2] >> 26; f[2] &= reduce_mask_26; \
+        f[4] += f[3] >> 25; f[3] &= reduce_mask_25; \
+        f[5] += f[4] >> 26; f[4] &= reduce_mask_26; \
+        f[6] += f[5] >> 25; f[5] &= reduce_mask_25; \
+        f[7] += f[6] >> 26; f[6] &= reduce_mask_26; \
+        f[8] += f[7] >> 25; f[7] &= reduce_mask_25; \
+        f[9] += f[8] >> 26; f[8] &= reduce_mask_26;
+
+    #define carry_pass_full() \
+        carry_pass() \
+        f[0] += 19 * (f[9] >> 25); f[9] &= reduce_mask_25;
+
+    #define carry_pass_final() \
+        carry_pass() \
+        f[9] &= reduce_mask_25;
+
+    carry_pass_full()
+    carry_pass_full()
+
+    /* now t is between 0 and 2^255-1, properly carried. */
+    /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */
+    f[0] += 19;
+    carry_pass_full()
+
+    /* now between 19 and 2^255-1 in both cases, and offset by 19. */
+    f[0] += (reduce_mask_26 + 1) - 19;
+    f[1] += (reduce_mask_25 + 1) - 1;
+    f[2] += (reduce_mask_26 + 1) - 1;
+    f[3] += (reduce_mask_25 + 1) - 1;
+    f[4] += (reduce_mask_26 + 1) - 1;
+    f[5] += (reduce_mask_25 + 1) - 1;
+    f[6] += (reduce_mask_26 + 1) - 1;
+    f[7] += (reduce_mask_25 + 1) - 1;
+    f[8] += (reduce_mask_26 + 1) - 1;
+    f[9] += (reduce_mask_25 + 1) - 1;
+
+    /* now between 2^255 and 2^256-20, and offset by 2^255. */
+    carry_pass_final()
+
+    #undef carry_pass
+    #undef carry_full
+    #undef carry_final
+
+    f[1] <<= 2; f[2] <<= 3;
+    f[3] <<= 5; f[4] <<= 6;
+    f[6] <<= 1; f[7] <<= 3;
+    f[8] <<= 4; f[9] <<= 6;
+
+    #define F(i, s) \
+        out[s+0] |= (byte)( f[i] & 0xff); \
+        out[s+1]  = (byte)((f[i] >> 8) & 0xff); \
+        out[s+2]  = (byte)((f[i] >> 16) & 0xff); \
+        out[s+3]  = (byte)((f[i] >> 24) & 0xff);
+
+    out[0] = out[16] = 0;
+    F(0,0); F(1,3);
+    F(2,6); F(3,9);
+    F(4,12); F(5,16);
+    F(6,19); F(7,22);
+    F(8,25); F(9,28);
+    #undef F
+}
+
+/* out = (flag) ? in : out */
+inline void
+curve25519_move_conditional_bytes(byte out[96], const byte in[96], word32 flag)
+{
+    // TODO: enable this code path once we can test and benchmark it.
+    // It is about 48 insns shorter, it avoids punning which may be UB,
+    // and it is guaranteed constant time.
+#if defined(__GNUC__) && defined(__i686__) && 0
+    const word32 iter = 96/sizeof(word32);
+    word32* outl = reinterpret_cast<word32*>(out);
+    const word32* inl = reinterpret_cast<const word32*>(in);
+    word32 idx=0, val;
+
+    __asm__ __volatile__ (
+        ".att_syntax                         ;\n"
+        "cmpl     $0, %[flag]                ;\n"  // compare, set ZERO flag
+        "movl     %[iter], %%ecx             ;\n"  // load iteration count
+        "1:                                  ;\n"
+        "  movl     (%[idx],%[out]), %[val]  ;\n"  // val = out[idx]
+        "  cmovnzl  (%[idx],%[in]), %[val]   ;\n"  // copy in[idx] to val if NZ
+        "  movl     %[val], (%[idx],%[out])  ;\n"  // out[idx] = val
+        "  leal     4(%[idx]), %[idx]        ;\n"  // increment index
+        "  loopnz   1b                       ;\n"  // does not affect flags
+        : [out] "+S" (outl), [in] "+D" (inl),
+          [idx] "+b" (idx), [val] "=r" (val)
+        : [flag] "g" (flag), [iter] "I" (iter)
+        : "ecx", "memory", "cc"
+    );
+#else
+    const word32 nb = flag - 1, b = ~nb;
+    const word32 *inl = (const word32 *)in;
+    word32 *outl = (word32 *)out;
+    outl[0] = (outl[0] & nb) | (inl[0] & b);
+    outl[1] = (outl[1] & nb) | (inl[1] & b);
+    outl[2] = (outl[2] & nb) | (inl[2] & b);
+    outl[3] = (outl[3] & nb) | (inl[3] & b);
+    outl[4] = (outl[4] & nb) | (inl[4] & b);
+    outl[5] = (outl[5] & nb) | (inl[5] & b);
+    outl[6] = (outl[6] & nb) | (inl[6] & b);
+    outl[7] = (outl[7] & nb) | (inl[7] & b);
+    outl[8] = (outl[8] & nb) | (inl[8] & b);
+    outl[9] = (outl[9] & nb) | (inl[9] & b);
+    outl[10] = (outl[10] & nb) | (inl[10] & b);
+    outl[11] = (outl[11] & nb) | (inl[11] & b);
+    outl[12] = (outl[12] & nb) | (inl[12] & b);
+    outl[13] = (outl[13] & nb) | (inl[13] & b);
+    outl[14] = (outl[14] & nb) | (inl[14] & b);
+    outl[15] = (outl[15] & nb) | (inl[15] & b);
+    outl[16] = (outl[16] & nb) | (inl[16] & b);
+    outl[17] = (outl[17] & nb) | (inl[17] & b);
+    outl[18] = (outl[18] & nb) | (inl[18] & b);
+    outl[19] = (outl[19] & nb) | (inl[19] & b);
+    outl[20] = (outl[20] & nb) | (inl[20] & b);
+    outl[21] = (outl[21] & nb) | (inl[21] & b);
+    outl[22] = (outl[22] & nb) | (inl[22] & b);
+    outl[23] = (outl[23] & nb) | (inl[23] & b);
+#endif
+}
+
+/* if (iswap) swap(a, b) */
+inline void
+curve25519_swap_conditional(bignum25519 a, bignum25519 b, word32 iswap) {
+    const word32 swap = (word32)(-(sword32)iswap);
+    word32 x0,x1,x2,x3,x4,x5,x6,x7,x8,x9;
+
+    x0 = swap & (a[0] ^ b[0]); a[0] ^= x0; b[0] ^= x0;
+    x1 = swap & (a[1] ^ b[1]); a[1] ^= x1; b[1] ^= x1;
+    x2 = swap & (a[2] ^ b[2]); a[2] ^= x2; b[2] ^= x2;
+    x3 = swap & (a[3] ^ b[3]); a[3] ^= x3; b[3] ^= x3;
+    x4 = swap & (a[4] ^ b[4]); a[4] ^= x4; b[4] ^= x4;
+    x5 = swap & (a[5] ^ b[5]); a[5] ^= x5; b[5] ^= x5;
+    x6 = swap & (a[6] ^ b[6]); a[6] ^= x6; b[6] ^= x6;
+    x7 = swap & (a[7] ^ b[7]); a[7] ^= x7; b[7] ^= x7;
+    x8 = swap & (a[8] ^ b[8]); a[8] ^= x8; b[8] ^= x8;
+    x9 = swap & (a[9] ^ b[9]); a[9] ^= x9; b[9] ^= x9;
+}
+
+/*
+ * In:  b =   2^5 - 2^0
+ * Out: b = 2^250 - 2^0
+ */
+void
+curve25519_pow_two5mtwo0_two250mtwo0(bignum25519 b) {
+    ALIGN(ALIGN_SPEC) bignum25519 t0,c;
+
+    /* 2^5  - 2^0 */ /* b */
+    /* 2^10 - 2^5 */ curve25519_square_times(t0, b, 5);
+    /* 2^10 - 2^0 */ curve25519_mul(b, t0, b);
+    /* 2^20 - 2^10 */ curve25519_square_times(t0, b, 10);
+    /* 2^20 - 2^0 */ curve25519_mul(c, t0, b);
+    /* 2^40 - 2^20 */ curve25519_square_times(t0, c, 20);
+    /* 2^40 - 2^0 */ curve25519_mul(t0, t0, c);
+    /* 2^50 - 2^10 */ curve25519_square_times(t0, t0, 10);
+    /* 2^50 - 2^0 */ curve25519_mul(b, t0, b);
+    /* 2^100 - 2^50 */ curve25519_square_times(t0, b, 50);
+    /* 2^100 - 2^0 */ curve25519_mul(c, t0, b);
+    /* 2^200 - 2^100 */ curve25519_square_times(t0, c, 100);
+    /* 2^200 - 2^0 */ curve25519_mul(t0, t0, c);
+    /* 2^250 - 2^50 */ curve25519_square_times(t0, t0, 50);
+    /* 2^250 - 2^0 */ curve25519_mul(b, t0, b);
+}
+
+/*
+ * z^(p - 2) = z(2^255 - 21)
+ */
+void
+curve25519_recip(bignum25519 out, const bignum25519 z) {
+    ALIGN(ALIGN_SPEC) bignum25519 a,t0,b;
+
+    /* 2 */ curve25519_square_times(a, z, 1); /* a = 2 */
+    /* 8 */ curve25519_square_times(t0, a, 2);
+    /* 9 */ curve25519_mul(b, t0, z); /* b = 9 */
+    /* 11 */ curve25519_mul(a, b, a); /* a = 11 */
+    /* 22 */ curve25519_square_times(t0, a, 1);
+    /* 2^5 - 2^0 = 31 */ curve25519_mul(b, t0, b);
+    /* 2^250 - 2^0 */ curve25519_pow_two5mtwo0_two250mtwo0(b);
+    /* 2^255 - 2^5 */ curve25519_square_times(b, b, 5);
+    /* 2^255 - 21 */ curve25519_mul(out, b, a);
+}
+
+/*
+ * z^((p-5)/8) = z^(2^252 - 3)
+ */
+void
+curve25519_pow_two252m3(bignum25519 two252m3, const bignum25519 z) {
+    ALIGN(ALIGN_SPEC) bignum25519 b,c,t0;
+
+    /* 2 */ curve25519_square_times(c, z, 1); /* c = 2 */
+    /* 8 */ curve25519_square_times(t0, c, 2); /* t0 = 8 */
+    /* 9 */ curve25519_mul(b, t0, z); /* b = 9 */
+    /* 11 */ curve25519_mul(c, b, c); /* c = 11 */
+    /* 22 */ curve25519_square_times(t0, c, 1);
+    /* 2^5 - 2^0 = 31 */ curve25519_mul(b, t0, b);
+    /* 2^250 - 2^0 */ curve25519_pow_two5mtwo0_two250mtwo0(b);
+    /* 2^252 - 2^2 */ curve25519_square_times(b, b, 2);
+    /* 2^252 - 3 */ curve25519_mul(two252m3, b, z);
+}
+
+inline void
+ed25519_hash(byte *hash, const byte *in, size_t inlen) {
+    SHA512().CalculateDigest(hash, in, inlen);
+}
+
+inline void
+ed25519_extsk(hash_512bits extsk, const byte sk[32]) {
+    ed25519_hash(extsk, sk, 32);
+    extsk[0] &= 248;
+    extsk[31] &= 127;
+    extsk[31] |= 64;
+}
+
+void
+UpdateFromStream(HashTransformation& hash, std::istream& stream)
+{
+    SecByteBlock block(4096);
+    while (stream.read((char*)block.begin(), block.size()))
+        hash.Update(block, block.size());
+
+    std::streamsize rem = stream.gcount();
+    if (rem)
+        hash.Update(block, (size_t)rem);
+
+    block.SetMark(0);
+}
+
+void
+ed25519_hram(hash_512bits hram, const byte RS[64], const byte pk[32], const byte *m, size_t mlen) {
+    SHA512 hash;
+    hash.Update(RS, 32);
+    hash.Update(pk, 32);
+    hash.Update(m, mlen);
+    hash.Final(hram);
+}
+
+void
+ed25519_hram(hash_512bits hram, const byte RS[64], const byte pk[32], std::istream& stream) {
+    SHA512 hash;
+    hash.Update(RS, 32);
+    hash.Update(pk, 32);
+    UpdateFromStream(hash, stream);
+    hash.Final(hram);
+}
+
+inline bignum256modm_element_t
+lt_modm(bignum256modm_element_t a, bignum256modm_element_t b) {
+    return (a - b) >> 31;
+}
+
+/* see HAC, Alg. 14.42 Step 4 */
+void
+reduce256_modm(bignum256modm r) {
+    bignum256modm t;
+    bignum256modm_element_t b = 0, pb, mask;
+
+    /* t = r - m */
+    pb = 0;
+    pb += modm_m[0]; b = lt_modm(r[0], pb); t[0] = (r[0] - pb + (b << 30)); pb = b;
+    pb += modm_m[1]; b = lt_modm(r[1], pb); t[1] = (r[1] - pb + (b << 30)); pb = b;
+    pb += modm_m[2]; b = lt_modm(r[2], pb); t[2] = (r[2] - pb + (b << 30)); pb = b;
+    pb += modm_m[3]; b = lt_modm(r[3], pb); t[3] = (r[3] - pb + (b << 30)); pb = b;
+    pb += modm_m[4]; b = lt_modm(r[4], pb); t[4] = (r[4] - pb + (b << 30)); pb = b;
+    pb += modm_m[5]; b = lt_modm(r[5], pb); t[5] = (r[5] - pb + (b << 30)); pb = b;
+    pb += modm_m[6]; b = lt_modm(r[6], pb); t[6] = (r[6] - pb + (b << 30)); pb = b;
+    pb += modm_m[7]; b = lt_modm(r[7], pb); t[7] = (r[7] - pb + (b << 30)); pb = b;
+    pb += modm_m[8]; b = lt_modm(r[8], pb); t[8] = (r[8] - pb + (b << 16));
+
+    /* keep r if r was smaller than m */
+    mask = b - 1;
+    r[0] ^= mask & (r[0] ^ t[0]);
+    r[1] ^= mask & (r[1] ^ t[1]);
+    r[2] ^= mask & (r[2] ^ t[2]);
+    r[3] ^= mask & (r[3] ^ t[3]);
+    r[4] ^= mask & (r[4] ^ t[4]);
+    r[5] ^= mask & (r[5] ^ t[5]);
+    r[6] ^= mask & (r[6] ^ t[6]);
+    r[7] ^= mask & (r[7] ^ t[7]);
+    r[8] ^= mask & (r[8] ^ t[8]);
+}
+
+/* Barrett reduction, see HAC, Alg. 14.42 */
+void
+barrett_reduce256_modm(bignum256modm r, const bignum256modm q1, const bignum256modm r1) {
+    bignum256modm q3, r2;
+    word64 c;
+    bignum256modm_element_t f, b, pb;
+
+    /* q1 = x >> 248 = 264 bits = 9 30 bit elements
+       q2 = mu * q1
+       q3 = (q2 / 256(32+1)) = q2 / (2^8)^(32+1) = q2 >> 264
+     */
+    c  = mul32x32_64(modm_mu[0], q1[7]) + mul32x32_64(modm_mu[1], q1[6]) + mul32x32_64(modm_mu[2], q1[5]) + mul32x32_64(modm_mu[3], q1[4]) + mul32x32_64(modm_mu[4], q1[3]) + mul32x32_64(modm_mu[5], q1[2]) + mul32x32_64(modm_mu[6], q1[1]) + mul32x32_64(modm_mu[7], q1[0]);
+    c >>= 30;
+    c += mul32x32_64(modm_mu[0], q1[8]) + mul32x32_64(modm_mu[1], q1[7]) + mul32x32_64(modm_mu[2], q1[6]) + mul32x32_64(modm_mu[3], q1[5]) + mul32x32_64(modm_mu[4], q1[4]) + mul32x32_64(modm_mu[5], q1[3]) + mul32x32_64(modm_mu[6], q1[2]) + mul32x32_64(modm_mu[7], q1[1]) + mul32x32_64(modm_mu[8], q1[0]);
+    f = (bignum256modm_element_t)c; q3[0] = (f >> 24) & 0x3f; c >>= 30;
+    c += mul32x32_64(modm_mu[1], q1[8]) + mul32x32_64(modm_mu[2], q1[7]) + mul32x32_64(modm_mu[3], q1[6]) + mul32x32_64(modm_mu[4], q1[5]) + mul32x32_64(modm_mu[5], q1[4]) + mul32x32_64(modm_mu[6], q1[3]) + mul32x32_64(modm_mu[7], q1[2]) + mul32x32_64(modm_mu[8], q1[1]);
+    f = (bignum256modm_element_t)c; q3[0] |= (f << 6) & 0x3fffffff; q3[1] = (f >> 24) & 0x3f; c >>= 30;
+    c += mul32x32_64(modm_mu[2], q1[8]) + mul32x32_64(modm_mu[3], q1[7]) + mul32x32_64(modm_mu[4], q1[6]) + mul32x32_64(modm_mu[5], q1[5]) + mul32x32_64(modm_mu[6], q1[4]) + mul32x32_64(modm_mu[7], q1[3]) + mul32x32_64(modm_mu[8], q1[2]);
+    f = (bignum256modm_element_t)c; q3[1] |= (f << 6) & 0x3fffffff; q3[2] = (f >> 24) & 0x3f; c >>= 30;
+    c += mul32x32_64(modm_mu[3], q1[8]) + mul32x32_64(modm_mu[4], q1[7]) + mul32x32_64(modm_mu[5], q1[6]) + mul32x32_64(modm_mu[6], q1[5]) + mul32x32_64(modm_mu[7], q1[4]) + mul32x32_64(modm_mu[8], q1[3]);
+    f = (bignum256modm_element_t)c; q3[2] |= (f << 6) & 0x3fffffff; q3[3] = (f >> 24) & 0x3f; c >>= 30;
+    c += mul32x32_64(modm_mu[4], q1[8]) + mul32x32_64(modm_mu[5], q1[7]) + mul32x32_64(modm_mu[6], q1[6]) + mul32x32_64(modm_mu[7], q1[5]) + mul32x32_64(modm_mu[8], q1[4]);
+    f = (bignum256modm_element_t)c; q3[3] |= (f << 6) & 0x3fffffff; q3[4] = (f >> 24) & 0x3f; c >>= 30;
+    c += mul32x32_64(modm_mu[5], q1[8]) + mul32x32_64(modm_mu[6], q1[7]) + mul32x32_64(modm_mu[7], q1[6]) + mul32x32_64(modm_mu[8], q1[5]);
+    f = (bignum256modm_element_t)c; q3[4] |= (f << 6) & 0x3fffffff; q3[5] = (f >> 24) & 0x3f; c >>= 30;
+    c += mul32x32_64(modm_mu[6], q1[8]) + mul32x32_64(modm_mu[7], q1[7]) + mul32x32_64(modm_mu[8], q1[6]);
+    f = (bignum256modm_element_t)c; q3[5] |= (f << 6) & 0x3fffffff; q3[6] = (f >> 24) & 0x3f; c >>= 30;
+    c += mul32x32_64(modm_mu[7], q1[8]) + mul32x32_64(modm_mu[8], q1[7]);
+    f = (bignum256modm_element_t)c; q3[6] |= (f << 6) & 0x3fffffff; q3[7] = (f >> 24) & 0x3f; c >>= 30;
+    c += mul32x32_64(modm_mu[8], q1[8]);
+    f = (bignum256modm_element_t)c; q3[7] |= (f << 6) & 0x3fffffff; q3[8] = (bignum256modm_element_t)(c >> 24);
+
+    /* r1 = (x mod 256^(32+1)) = x mod (2^8)(31+1) = x & ((1 << 264) - 1)
+       r2 = (q3 * m) mod (256^(32+1)) = (q3 * m) & ((1 << 264) - 1)
+     */
+    c = mul32x32_64(modm_m[0], q3[0]);
+    r2[0] = (bignum256modm_element_t)(c & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(modm_m[0], q3[1]) + mul32x32_64(modm_m[1], q3[0]);
+    r2[1] = (bignum256modm_element_t)(c & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(modm_m[0], q3[2]) + mul32x32_64(modm_m[1], q3[1]) + mul32x32_64(modm_m[2], q3[0]);
+    r2[2] = (bignum256modm_element_t)(c & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(modm_m[0], q3[3]) + mul32x32_64(modm_m[1], q3[2]) + mul32x32_64(modm_m[2], q3[1]) + mul32x32_64(modm_m[3], q3[0]);
+    r2[3] = (bignum256modm_element_t)(c & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(modm_m[0], q3[4]) + mul32x32_64(modm_m[1], q3[3]) + mul32x32_64(modm_m[2], q3[2]) + mul32x32_64(modm_m[3], q3[1]) + mul32x32_64(modm_m[4], q3[0]);
+    r2[4] = (bignum256modm_element_t)(c & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(modm_m[0], q3[5]) + mul32x32_64(modm_m[1], q3[4]) + mul32x32_64(modm_m[2], q3[3]) + mul32x32_64(modm_m[3], q3[2]) + mul32x32_64(modm_m[4], q3[1]) + mul32x32_64(modm_m[5], q3[0]);
+    r2[5] = (bignum256modm_element_t)(c & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(modm_m[0], q3[6]) + mul32x32_64(modm_m[1], q3[5]) + mul32x32_64(modm_m[2], q3[4]) + mul32x32_64(modm_m[3], q3[3]) + mul32x32_64(modm_m[4], q3[2]) + mul32x32_64(modm_m[5], q3[1]) + mul32x32_64(modm_m[6], q3[0]);
+    r2[6] = (bignum256modm_element_t)(c & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(modm_m[0], q3[7]) + mul32x32_64(modm_m[1], q3[6]) + mul32x32_64(modm_m[2], q3[5]) + mul32x32_64(modm_m[3], q3[4]) + mul32x32_64(modm_m[4], q3[3]) + mul32x32_64(modm_m[5], q3[2]) + mul32x32_64(modm_m[6], q3[1]) + mul32x32_64(modm_m[7], q3[0]);
+    r2[7] = (bignum256modm_element_t)(c & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(modm_m[0], q3[8]) + mul32x32_64(modm_m[1], q3[7]) + mul32x32_64(modm_m[2], q3[6]) + mul32x32_64(modm_m[3], q3[5]) + mul32x32_64(modm_m[4], q3[4]) + mul32x32_64(modm_m[5], q3[3]) + mul32x32_64(modm_m[6], q3[2]) + mul32x32_64(modm_m[7], q3[1]) + mul32x32_64(modm_m[8], q3[0]);
+    r2[8] = (bignum256modm_element_t)(c & 0xffffff);
+
+    /* r = r1 - r2
+       if (r < 0) r += (1 << 264) */
+    pb = 0;
+    pb += r2[0]; b = lt_modm(r1[0], pb); r[0] = (r1[0] - pb + (b << 30)); pb = b;
+    pb += r2[1]; b = lt_modm(r1[1], pb); r[1] = (r1[1] - pb + (b << 30)); pb = b;
+    pb += r2[2]; b = lt_modm(r1[2], pb); r[2] = (r1[2] - pb + (b << 30)); pb = b;
+    pb += r2[3]; b = lt_modm(r1[3], pb); r[3] = (r1[3] - pb + (b << 30)); pb = b;
+    pb += r2[4]; b = lt_modm(r1[4], pb); r[4] = (r1[4] - pb + (b << 30)); pb = b;
+    pb += r2[5]; b = lt_modm(r1[5], pb); r[5] = (r1[5] - pb + (b << 30)); pb = b;
+    pb += r2[6]; b = lt_modm(r1[6], pb); r[6] = (r1[6] - pb + (b << 30)); pb = b;
+    pb += r2[7]; b = lt_modm(r1[7], pb); r[7] = (r1[7] - pb + (b << 30)); pb = b;
+    pb += r2[8]; b = lt_modm(r1[8], pb); r[8] = (r1[8] - pb + (b << 24));
+
+    reduce256_modm(r);
+    reduce256_modm(r);
+}
+
+/* addition modulo m */
+void
+add256_modm(bignum256modm r, const bignum256modm x, const bignum256modm y) {
+    bignum256modm_element_t c;
+
+    c  = x[0] + y[0]; r[0] = c & 0x3fffffff; c >>= 30;
+    c += x[1] + y[1]; r[1] = c & 0x3fffffff; c >>= 30;
+    c += x[2] + y[2]; r[2] = c & 0x3fffffff; c >>= 30;
+    c += x[3] + y[3]; r[3] = c & 0x3fffffff; c >>= 30;
+    c += x[4] + y[4]; r[4] = c & 0x3fffffff; c >>= 30;
+    c += x[5] + y[5]; r[5] = c & 0x3fffffff; c >>= 30;
+    c += x[6] + y[6]; r[6] = c & 0x3fffffff; c >>= 30;
+    c += x[7] + y[7]; r[7] = c & 0x3fffffff; c >>= 30;
+    c += x[8] + y[8]; r[8] = c;
+
+    reduce256_modm(r);
+}
+
+/* multiplication modulo m */
+void
+mul256_modm(bignum256modm r, const bignum256modm x, const bignum256modm y) {
+    bignum256modm r1, q1;
+    word64 c;
+    bignum256modm_element_t f;
+
+    c = mul32x32_64(x[0], y[0]);
+    f = (bignum256modm_element_t)c; r1[0] = (f & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(x[0], y[1]) + mul32x32_64(x[1], y[0]);
+    f = (bignum256modm_element_t)c; r1[1] = (f & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(x[0], y[2]) + mul32x32_64(x[1], y[1]) + mul32x32_64(x[2], y[0]);
+    f = (bignum256modm_element_t)c; r1[2] = (f & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(x[0], y[3]) + mul32x32_64(x[1], y[2]) + mul32x32_64(x[2], y[1]) + mul32x32_64(x[3], y[0]);
+    f = (bignum256modm_element_t)c; r1[3] = (f & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(x[0], y[4]) + mul32x32_64(x[1], y[3]) + mul32x32_64(x[2], y[2]) + mul32x32_64(x[3], y[1]) + mul32x32_64(x[4], y[0]);
+    f = (bignum256modm_element_t)c; r1[4] = (f & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(x[0], y[5]) + mul32x32_64(x[1], y[4]) + mul32x32_64(x[2], y[3]) + mul32x32_64(x[3], y[2]) + mul32x32_64(x[4], y[1]) + mul32x32_64(x[5], y[0]);
+    f = (bignum256modm_element_t)c; r1[5] = (f & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(x[0], y[6]) + mul32x32_64(x[1], y[5]) + mul32x32_64(x[2], y[4]) + mul32x32_64(x[3], y[3]) + mul32x32_64(x[4], y[2]) + mul32x32_64(x[5], y[1]) + mul32x32_64(x[6], y[0]);
+    f = (bignum256modm_element_t)c; r1[6] = (f & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(x[0], y[7]) + mul32x32_64(x[1], y[6]) + mul32x32_64(x[2], y[5]) + mul32x32_64(x[3], y[4]) + mul32x32_64(x[4], y[3]) + mul32x32_64(x[5], y[2]) + mul32x32_64(x[6], y[1]) + mul32x32_64(x[7], y[0]);
+    f = (bignum256modm_element_t)c; r1[7] = (f & 0x3fffffff); c >>= 30;
+    c += mul32x32_64(x[0], y[8]) + mul32x32_64(x[1], y[7]) + mul32x32_64(x[2], y[6]) + mul32x32_64(x[3], y[5]) + mul32x32_64(x[4], y[4]) + mul32x32_64(x[5], y[3]) + mul32x32_64(x[6], y[2]) + mul32x32_64(x[7], y[1]) + mul32x32_64(x[8], y[0]);
+    f = (bignum256modm_element_t)c; r1[8] = (f & 0x00ffffff); q1[0] = (f >> 8) & 0x3fffff; c >>= 30;
+    c += mul32x32_64(x[1], y[8]) + mul32x32_64(x[2], y[7]) + mul32x32_64(x[3], y[6]) + mul32x32_64(x[4], y[5]) + mul32x32_64(x[5], y[4]) + mul32x32_64(x[6], y[3]) + mul32x32_64(x[7], y[2]) + mul32x32_64(x[8], y[1]);
+    f = (bignum256modm_element_t)c; q1[0] = (q1[0] | (f << 22)) & 0x3fffffff; q1[1] = (f >> 8) & 0x3fffff; c >>= 30;
+    c += mul32x32_64(x[2], y[8]) + mul32x32_64(x[3], y[7]) + mul32x32_64(x[4], y[6]) + mul32x32_64(x[5], y[5]) + mul32x32_64(x[6], y[4]) + mul32x32_64(x[7], y[3]) + mul32x32_64(x[8], y[2]);
+    f = (bignum256modm_element_t)c; q1[1] = (q1[1] | (f << 22)) & 0x3fffffff; q1[2] = (f >> 8) & 0x3fffff; c >>= 30;
+    c += mul32x32_64(x[3], y[8]) + mul32x32_64(x[4], y[7]) + mul32x32_64(x[5], y[6]) + mul32x32_64(x[6], y[5]) + mul32x32_64(x[7], y[4]) + mul32x32_64(x[8], y[3]);
+    f = (bignum256modm_element_t)c; q1[2] = (q1[2] | (f << 22)) & 0x3fffffff; q1[3] = (f >> 8) & 0x3fffff; c >>= 30;
+    c += mul32x32_64(x[4], y[8]) + mul32x32_64(x[5], y[7]) + mul32x32_64(x[6], y[6]) + mul32x32_64(x[7], y[5]) + mul32x32_64(x[8], y[4]);
+    f = (bignum256modm_element_t)c; q1[3] = (q1[3] | (f << 22)) & 0x3fffffff; q1[4] = (f >> 8) & 0x3fffff; c >>= 30;
+    c += mul32x32_64(x[5], y[8]) + mul32x32_64(x[6], y[7]) + mul32x32_64(x[7], y[6]) + mul32x32_64(x[8], y[5]);
+    f = (bignum256modm_element_t)c; q1[4] = (q1[4] | (f << 22)) & 0x3fffffff; q1[5] = (f >> 8) & 0x3fffff; c >>= 30;
+    c += mul32x32_64(x[6], y[8]) + mul32x32_64(x[7], y[7]) + mul32x32_64(x[8], y[6]);
+    f = (bignum256modm_element_t)c; q1[5] = (q1[5] | (f << 22)) & 0x3fffffff; q1[6] = (f >> 8) & 0x3fffff; c >>= 30;
+    c += mul32x32_64(x[7], y[8]) + mul32x32_64(x[8], y[7]);
+    f = (bignum256modm_element_t)c; q1[6] = (q1[6] | (f << 22)) & 0x3fffffff; q1[7] = (f >> 8) & 0x3fffff; c >>= 30;
+    c += mul32x32_64(x[8], y[8]);
+    f = (bignum256modm_element_t)c; q1[7] = (q1[7] | (f << 22)) & 0x3fffffff; q1[8] = (f >> 8) & 0x3fffff;
+
+    barrett_reduce256_modm(r, q1, r1);
+}
+
+void
+expand256_modm(bignum256modm out, const byte *in, size_t len) {
+    byte work[64] = {0};
+    bignum256modm_element_t x[16];
+    bignum256modm q1;
+
+    std::memcpy(work, in, len);
+    x[0] = U8TO32_LE(work +  0);
+    x[1] = U8TO32_LE(work +  4);
+    x[2] = U8TO32_LE(work +  8);
+    x[3] = U8TO32_LE(work + 12);
+    x[4] = U8TO32_LE(work + 16);
+    x[5] = U8TO32_LE(work + 20);
+    x[6] = U8TO32_LE(work + 24);
+    x[7] = U8TO32_LE(work + 28);
+    x[8] = U8TO32_LE(work + 32);
+    x[9] = U8TO32_LE(work + 36);
+    x[10] = U8TO32_LE(work + 40);
+    x[11] = U8TO32_LE(work + 44);
+    x[12] = U8TO32_LE(work + 48);
+    x[13] = U8TO32_LE(work + 52);
+    x[14] = U8TO32_LE(work + 56);
+    x[15] = U8TO32_LE(work + 60);
+
+    /* r1 = (x mod 256^(32+1)) = x mod (2^8)(31+1) = x & ((1 << 264) - 1) */
+    out[0] = (                         x[0]) & 0x3fffffff;
+    out[1] = ((x[ 0] >> 30) | (x[ 1] <<  2)) & 0x3fffffff;
+    out[2] = ((x[ 1] >> 28) | (x[ 2] <<  4)) & 0x3fffffff;
+    out[3] = ((x[ 2] >> 26) | (x[ 3] <<  6)) & 0x3fffffff;
+    out[4] = ((x[ 3] >> 24) | (x[ 4] <<  8)) & 0x3fffffff;
+    out[5] = ((x[ 4] >> 22) | (x[ 5] << 10)) & 0x3fffffff;
+    out[6] = ((x[ 5] >> 20) | (x[ 6] << 12)) & 0x3fffffff;
+    out[7] = ((x[ 6] >> 18) | (x[ 7] << 14)) & 0x3fffffff;
+    out[8] = ((x[ 7] >> 16) | (x[ 8] << 16)) & 0x00ffffff;
+
+    /* 8*31 = 248 bits, no need to reduce */
+    if (len < 32)
+            return;
+
+    /* q1 = x >> 248 = 264 bits = 9 30 bit elements */
+    q1[0] = ((x[ 7] >> 24) | (x[ 8] <<  8)) & 0x3fffffff;
+    q1[1] = ((x[ 8] >> 22) | (x[ 9] << 10)) & 0x3fffffff;
+    q1[2] = ((x[ 9] >> 20) | (x[10] << 12)) & 0x3fffffff;
+    q1[3] = ((x[10] >> 18) | (x[11] << 14)) & 0x3fffffff;
+    q1[4] = ((x[11] >> 16) | (x[12] << 16)) & 0x3fffffff;
+    q1[5] = ((x[12] >> 14) | (x[13] << 18)) & 0x3fffffff;
+    q1[6] = ((x[13] >> 12) | (x[14] << 20)) & 0x3fffffff;
+    q1[7] = ((x[14] >> 10) | (x[15] << 22)) & 0x3fffffff;
+    q1[8] = ((x[15] >>  8)                );
+
+    barrett_reduce256_modm(out, q1, out);
+}
+
+void
+expand_raw256_modm(bignum256modm out, const byte in[32]) {
+    bignum256modm_element_t x[8];
+
+    x[0] = U8TO32_LE(in +  0);
+    x[1] = U8TO32_LE(in +  4);
+    x[2] = U8TO32_LE(in +  8);
+    x[3] = U8TO32_LE(in + 12);
+    x[4] = U8TO32_LE(in + 16);
+    x[5] = U8TO32_LE(in + 20);
+    x[6] = U8TO32_LE(in + 24);
+    x[7] = U8TO32_LE(in + 28);
+
+    out[0] = (                         x[0]) & 0x3fffffff;
+    out[1] = ((x[ 0] >> 30) | (x[ 1] <<  2)) & 0x3fffffff;
+    out[2] = ((x[ 1] >> 28) | (x[ 2] <<  4)) & 0x3fffffff;
+    out[3] = ((x[ 2] >> 26) | (x[ 3] <<  6)) & 0x3fffffff;
+    out[4] = ((x[ 3] >> 24) | (x[ 4] <<  8)) & 0x3fffffff;
+    out[5] = ((x[ 4] >> 22) | (x[ 5] << 10)) & 0x3fffffff;
+    out[6] = ((x[ 5] >> 20) | (x[ 6] << 12)) & 0x3fffffff;
+    out[7] = ((x[ 6] >> 18) | (x[ 7] << 14)) & 0x3fffffff;
+    out[8] = ((x[ 7] >> 16)                ) & 0x0000ffff;
+}
+
+void
+contract256_modm(byte out[32], const bignum256modm in) {
+    U32TO8_LE(out +  0, (in[0]      ) | (in[1] << 30));
+    U32TO8_LE(out +  4, (in[1] >>  2) | (in[2] << 28));
+    U32TO8_LE(out +  8, (in[2] >>  4) | (in[3] << 26));
+    U32TO8_LE(out + 12, (in[3] >>  6) | (in[4] << 24));
+    U32TO8_LE(out + 16, (in[4] >>  8) | (in[5] << 22));
+    U32TO8_LE(out + 20, (in[5] >> 10) | (in[6] << 20));
+    U32TO8_LE(out + 24, (in[6] >> 12) | (in[7] << 18));
+    U32TO8_LE(out + 28, (in[7] >> 14) | (in[8] << 16));
+}
+
+void
+contract256_window4_modm(signed char r[64], const bignum256modm in) {
+    char carry;
+    signed char *quads = r;
+    bignum256modm_element_t i, j, v;
+
+    for (i = 0; i < 8; i += 2) {
+        v = in[i];
+        for (j = 0; j < 7; j++) {
+            *quads++ = (v & 15);
+            v >>= 4;
+        }
+        v |= (in[i+1] << 2);
+        for (j = 0; j < 8; j++) {
+            *quads++ = (v & 15);
+            v >>= 4;
+        }
+    }
+
+    v = in[8];
+    *quads++ = (v & 15); v >>= 4;
+    *quads++ = (v & 15); v >>= 4;
+    *quads++ = (v & 15); v >>= 4;
+    *quads++ = (v & 15); v >>= 4;
+
+    /* making it signed */
+    carry = 0;
+    for(i = 0; i < 63; i++) {
+        r[i] += carry;
+        r[i+1] += (r[i] >> 4);
+        r[i] &= 15;
+        carry = (r[i] >> 3);
+        r[i] -= (carry << 4);
+    }
+    r[63] += carry;
+}
+
+void
+contract256_slidingwindow_modm(signed char r[256], const bignum256modm s, int windowsize) {
+    int i,j,k,b;
+    int m = (1 << (windowsize - 1)) - 1, soplen = 256;
+    signed char *bits = r;
+    bignum256modm_element_t v;
+
+    /* first put the binary expansion into r  */
+    for (i = 0; i < 8; i++) {
+        v = s[i];
+        for (j = 0; j < 30; j++, v >>= 1)
+            *bits++ = (v & 1);
+    }
+    v = s[8];
+    for (j = 0; j < 16; j++, v >>= 1)
+        *bits++ = (v & 1);
+
+    /* Making it sliding window */
+    for (j = 0; j < soplen; j++) {
+        if (!r[j])
+            continue;
+
+        for (b = 1; (b < (soplen - j)) && (b <= 6); b++) {
+            if ((r[j] + (r[j + b] << b)) <= m) {
+                r[j] += r[j + b] << b;
+                r[j + b] = 0;
+            } else if ((r[j] - (r[j + b] << b)) >= -m) {
+                r[j] -= r[j + b] << b;
+                for (k = j + b; k < soplen; k++) {
+                    if (!r[k]) {
+                        r[k] = 1;
+                        break;
+                    }
+                    r[k] = 0;
+                }
+            } else if (r[j + b]) {
+                break;
+            }
+        }
+    }
+}
+
+inline void
+ge25519_p1p1_to_partial(ge25519 *r, const ge25519_p1p1 *p) {
+    curve25519_mul(r->x, p->x, p->t);
+    curve25519_mul(r->y, p->y, p->z);
+    curve25519_mul(r->z, p->z, p->t);
+}
+
+inline void
+ge25519_p1p1_to_full(ge25519 *r, const ge25519_p1p1 *p) {
+    curve25519_mul(r->x, p->x, p->t);
+    curve25519_mul(r->y, p->y, p->z);
+    curve25519_mul(r->z, p->z, p->t);
+    curve25519_mul(r->t, p->x, p->y);
+}
+
+void
+ge25519_full_to_pniels(ge25519_pniels *p, const ge25519 *r) {
+    curve25519_sub(p->ysubx, r->y, r->x);
+    curve25519_add(p->xaddy, r->y, r->x);
+    curve25519_copy(p->z, r->z);
+    curve25519_mul(p->t2d, r->t, ge25519_ec2d);
+}
+
+void
+ge25519_add_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519 *q) {
+    bignum25519 a,b,c,d,t,u;
+
+    curve25519_sub(a, p->y, p->x);
+    curve25519_add(b, p->y, p->x);
+    curve25519_sub(t, q->y, q->x);
+    curve25519_add(u, q->y, q->x);
+    curve25519_mul(a, a, t);
+    curve25519_mul(b, b, u);
+    curve25519_mul(c, p->t, q->t);
+    curve25519_mul(c, c, ge25519_ec2d);
+    curve25519_mul(d, p->z, q->z);
+    curve25519_add(d, d, d);
+    curve25519_sub(r->x, b, a);
+    curve25519_add(r->y, b, a);
+    curve25519_add_after_basic(r->z, d, c);
+    curve25519_sub_after_basic(r->t, d, c);
+}
+
+void
+ge25519_double_p1p1(ge25519_p1p1 *r, const ge25519 *p) {
+    bignum25519 a,b,c;
+
+    curve25519_square(a, p->x);
+    curve25519_square(b, p->y);
+    curve25519_square(c, p->z);
+    curve25519_add_reduce(c, c, c);
+    curve25519_add(r->x, p->x, p->y);
+    curve25519_square(r->x, r->x);
+    curve25519_add(r->y, b, a);
+    curve25519_sub(r->z, b, a);
+    curve25519_sub_after_basic(r->x, r->x, r->y);
+    curve25519_sub_after_basic(r->t, c, r->z);
+}
+
+void
+ge25519_nielsadd2_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_niels *q, byte signbit) {
+    const bignum25519 *qb = (const bignum25519 *)q;
+    bignum25519 *rb = (bignum25519 *)r;
+    bignum25519 a,b,c;
+
+    curve25519_sub(a, p->y, p->x);
+    curve25519_add(b, p->y, p->x);
+    curve25519_mul(a, a, qb[signbit]); /* x for +, y for - */
+    curve25519_mul(r->x, b, qb[signbit^1]); /* y for +, x for - */
+    curve25519_add(r->y, r->x, a);
+    curve25519_sub(r->x, r->x, a);
+    curve25519_mul(c, p->t, q->t2d);
+    curve25519_add_reduce(r->t, p->z, p->z);
+    curve25519_copy(r->z, r->t);
+    curve25519_add(rb[2+signbit], rb[2+signbit], c); /* z for +, t for - */
+    curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c); /* t for +, z for - */
+}
+
+void
+ge25519_pnielsadd_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_pniels *q, byte signbit) {
+    const bignum25519 *qb = (const bignum25519 *)q;
+    bignum25519 *rb = (bignum25519 *)r;
+    bignum25519 a,b,c;
+
+    curve25519_sub(a, p->y, p->x);
+    curve25519_add(b, p->y, p->x);
+    curve25519_mul(a, a, qb[signbit]); /* ysubx for +, xaddy for - */
+    curve25519_mul(r->x, b, qb[signbit^1]); /* xaddy for +, ysubx for - */
+    curve25519_add(r->y, r->x, a);
+    curve25519_sub(r->x, r->x, a);
+    curve25519_mul(c, p->t, q->t2d);
+    curve25519_mul(r->t, p->z, q->z);
+    curve25519_add_reduce(r->t, r->t, r->t);
+    curve25519_copy(r->z, r->t);
+    curve25519_add(rb[2+signbit], rb[2+signbit], c); /* z for +, t for - */
+    curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c); /* t for +, z for - */
+}
+
+void
+ge25519_double_partial(ge25519 *r, const ge25519 *p) {
+    ge25519_p1p1 t;
+    ge25519_double_p1p1(&t, p);
+    ge25519_p1p1_to_partial(r, &t);
+}
+
+void
+ge25519_double(ge25519 *r, const ge25519 *p) {
+    ge25519_p1p1 t;
+    ge25519_double_p1p1(&t, p);
+    ge25519_p1p1_to_full(r, &t);
+}
+
+void
+ge25519_add(ge25519 *r, const ge25519 *p,  const ge25519 *q) {
+    ge25519_p1p1 t;
+    ge25519_add_p1p1(&t, p, q);
+    ge25519_p1p1_to_full(r, &t);
+}
+
+void
+ge25519_nielsadd2(ge25519 *r, const ge25519_niels *q) {
+    bignum25519 a,b,c,e,f,g,h;
+
+    curve25519_sub(a, r->y, r->x);
+    curve25519_add(b, r->y, r->x);
+    curve25519_mul(a, a, q->ysubx);
+    curve25519_mul(e, b, q->xaddy);
+    curve25519_add(h, e, a);
+    curve25519_sub(e, e, a);
+    curve25519_mul(c, r->t, q->t2d);
+    curve25519_add(f, r->z, r->z);
+    curve25519_add_after_basic(g, f, c);
+    curve25519_sub_after_basic(f, f, c);
+    curve25519_mul(r->x, e, f);
+    curve25519_mul(r->y, h, g);
+    curve25519_mul(r->z, g, f);
+    curve25519_mul(r->t, e, h);
+}
+
+void
+ge25519_pnielsadd(ge25519_pniels *r, const ge25519 *p, const ge25519_pniels *q) {
+    bignum25519 a,b,c,x,y,z,t;
+
+    curve25519_sub(a, p->y, p->x);
+    curve25519_add(b, p->y, p->x);
+    curve25519_mul(a, a, q->ysubx);
+    curve25519_mul(x, b, q->xaddy);
+    curve25519_add(y, x, a);
+    curve25519_sub(x, x, a);
+    curve25519_mul(c, p->t, q->t2d);
+    curve25519_mul(t, p->z, q->z);
+    curve25519_add(t, t, t);
+    curve25519_add_after_basic(z, t, c);
+    curve25519_sub_after_basic(t, t, c);
+    curve25519_mul(r->xaddy, x, t);
+    curve25519_mul(r->ysubx, y, z);
+    curve25519_mul(r->z, z, t);
+    curve25519_mul(r->t2d, x, y);
+    curve25519_copy(y, r->ysubx);
+    curve25519_sub(r->ysubx, r->ysubx, r->xaddy);
+    curve25519_add(r->xaddy, r->xaddy, y);
+    curve25519_mul(r->t2d, r->t2d, ge25519_ec2d);
+}
+
+void
+ge25519_pack(byte r[32], const ge25519 *p) {
+    bignum25519 tx, ty, zi;
+    byte parity[32];
+    curve25519_recip(zi, p->z);
+    curve25519_mul(tx, p->x, zi);
+    curve25519_mul(ty, p->y, zi);
+    curve25519_contract(r, ty);
+    curve25519_contract(parity, tx);
+    r[31] ^= ((parity[0] & 1) << 7);
+}
+
+int
+ed25519_verify(const byte *x, const byte *y, size_t len) {
+    size_t differentbits = 0;
+    while (len--)
+        differentbits |= (*x++ ^ *y++);
+    return (int) (1 & ((differentbits - 1) >> 8));
+}
+
+int
+ge25519_unpack_negative_vartime(ge25519 *r, const byte p[32]) {
+    const byte zero[32] = {0};
+    const bignum25519 one = {1};
+    byte parity = p[31] >> 7;
+    byte check[32];
+    bignum25519 t, root, num, den, d3;
+
+    curve25519_expand(r->y, p);
+    curve25519_copy(r->z, one);
+    curve25519_square(num, r->y); /* x = y^2 */
+    curve25519_mul(den, num, ge25519_ecd); /* den = dy^2 */
+    curve25519_sub_reduce(num, num, r->z); /* x = y^1 - 1 */
+    curve25519_add(den, den, r->z); /* den = dy^2 + 1 */
+
+    /* Computation of sqrt(num/den) */
+    /* 1.: computation of num^((p-5)/8)*den^((7p-35)/8) = (num*den^7)^((p-5)/8) */
+    curve25519_square(t, den);
+    curve25519_mul(d3, t, den);
+    curve25519_square(r->x, d3);
+    curve25519_mul(r->x, r->x, den);
+    curve25519_mul(r->x, r->x, num);
+    curve25519_pow_two252m3(r->x, r->x);
+
+    /* 2. computation of r->x = num * den^3 * (num*den^7)^((p-5)/8) */
+    curve25519_mul(r->x, r->x, d3);
+    curve25519_mul(r->x, r->x, num);
+
+    /* 3. Check if either of the roots works: */
+    curve25519_square(t, r->x);
+    curve25519_mul(t, t, den);
+    curve25519_sub_reduce(root, t, num);
+    curve25519_contract(check, root);
+    if (!ed25519_verify(check, zero, 32)) {
+        curve25519_add_reduce(t, t, num);
+        curve25519_contract(check, t);
+        if (!ed25519_verify(check, zero, 32))
+            return 0;
+        curve25519_mul(r->x, r->x, ge25519_sqrtneg1);
+    }
+
+    curve25519_contract(check, r->x);
+    if ((check[0] & 1) == parity) {
+        curve25519_copy(t, r->x);
+        curve25519_neg(r->x, t);
+    }
+    curve25519_mul(r->t, r->x, r->y);
+    return 1;
+}
+
+/* computes [s1]p1 + [s2]basepoint */
+void
+ge25519_double_scalarmult_vartime(ge25519 *r, const ge25519 *p1, const bignum256modm s1, const bignum256modm s2) {
+    signed char slide1[256], slide2[256];
+    ge25519_pniels pre1[S1_TABLE_SIZE];
+    ge25519 d1;
+    ge25519_p1p1 t;
+    sword32 i;
+
+    contract256_slidingwindow_modm(slide1, s1, S1_SWINDOWSIZE);
+    contract256_slidingwindow_modm(slide2, s2, S2_SWINDOWSIZE);
+
+    ge25519_double(&d1, p1);
+    ge25519_full_to_pniels(pre1, p1);
+    for (i = 0; i < S1_TABLE_SIZE - 1; i++)
+        ge25519_pnielsadd(&pre1[i+1], &d1, &pre1[i]);
+
+    /* set neutral */
+    std::memset(r, 0, sizeof(ge25519));
+    r->y[0] = 1;
+    r->z[0] = 1;
+
+    i = 255;
+    while ((i >= 0) && !(slide1[i] | slide2[i]))
+        i--;
+
+    for (; i >= 0; i--) {
+        ge25519_double_p1p1(&t, r);
+
+        if (slide1[i]) {
+            ge25519_p1p1_to_full(r, &t);
+            ge25519_pnielsadd_p1p1(&t, r, &pre1[abs(slide1[i]) / 2], (byte)slide1[i] >> 7);
+        }
+
+        if (slide2[i]) {
+            ge25519_p1p1_to_full(r, &t);
+            ge25519_nielsadd2_p1p1(&t, r, &ge25519_niels_sliding_multiples[abs(slide2[i]) / 2], (byte)slide2[i] >> 7);
+        }
+
+        ge25519_p1p1_to_partial(r, &t);
+    }
+}
+
+#if !defined(HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS)
+
+word32
+ge25519_windowb_equal(word32 b, word32 c) {
+    return ((b ^ c) - 1) >> 31;
+}
+
+void
+ge25519_scalarmult_base_choose_niels(ge25519_niels *t, const byte table[256][96], word32 pos, signed char b) {
+    bignum25519 neg;
+    word32 sign = (word32)((byte)b >> 7);
+    word32 mask = ~(sign - 1);
+    word32 u = (b + mask) ^ mask;
+    word32 i;
+
+    /* ysubx, xaddy, t2d in packed form. initialize to ysubx = 1, xaddy = 1, t2d = 0 */
+    byte packed[96] = {0};
+    packed[0] = 1;
+    packed[32] = 1;
+
+    for (i = 0; i < 8; i++)
+        curve25519_move_conditional_bytes(packed, table[(pos * 8) + i], ge25519_windowb_equal(u, i + 1));
+
+    /* expand in to t */
+    curve25519_expand(t->ysubx, packed +  0);
+    curve25519_expand(t->xaddy, packed + 32);
+    curve25519_expand(t->t2d  , packed + 64);
+
+    /* adjust for sign */
+    curve25519_swap_conditional(t->ysubx, t->xaddy, sign);
+    curve25519_neg(neg, t->t2d);
+    curve25519_swap_conditional(t->t2d, neg, sign);
+}
+
+#endif /* HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS */
+
+/* computes [s]basepoint */
+void
+ge25519_scalarmult_base_niels(ge25519 *r, const byte basepoint_table[256][96], const bignum256modm s) {
+    signed char b[64];
+    word32 i;
+    ge25519_niels t;
+
+    contract256_window4_modm(b, s);
+
+    ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[1]);
+    curve25519_sub_reduce(r->x, t.xaddy, t.ysubx);
+    curve25519_add_reduce(r->y, t.xaddy, t.ysubx);
+    std::memset(r->z, 0, sizeof(bignum25519));
+    curve25519_copy(r->t, t.t2d);
+    r->z[0] = 2;
+    for (i = 3; i < 64; i += 2) {
+        ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);
+        ge25519_nielsadd2(r, &t);
+    }
+    ge25519_double_partial(r, r);
+    ge25519_double_partial(r, r);
+    ge25519_double_partial(r, r);
+    ge25519_double(r, r);
+    ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[0]);
+    curve25519_mul(t.t2d, t.t2d, ge25519_ecd);
+    ge25519_nielsadd2(r, &t);
+    for(i = 2; i < 64; i += 2) {
+        ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);
+        ge25519_nielsadd2(r, &t);
+    }
+}
+
+ANONYMOUS_NAMESPACE_END
+NAMESPACE_END  // Ed25519
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+//***************************** curve25519 *****************************//
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+
+int curve25519_mult_CXX(byte sharedKey[32], const byte secretKey[32], const byte othersKey[32])
+{
+    using namespace CryptoPP::Donna::X25519;
+
+    FixedSizeSecBlock<byte, 32> e;
+    for (size_t i = 0; i < 32; ++i)
+        e[i] = secretKey[i];
+    e[0] &= 0xf8; e[31] &= 0x7f; e[31] |= 0x40;
+
+    bignum25519 nqpqx = {1}, nqpqz = {0}, nqz = {1}, nqx;
+    bignum25519 q, qx, qpqx, qqx, zzz, zmone;
+    size_t bit, lastbit;
+
+    curve25519_expand(q, othersKey);
+    curve25519_copy(nqx, q);
+
+    /* bit 255 is always 0, and bit 254 is always 1, so skip bit 255 and
+       start pre-swapped on bit 254 */
+    lastbit = 1;
+
+    /* we are doing bits 254..3 in the loop, but are swapping in bits 253..2 */
+    for (int i = 253; i >= 2; i--) {
+        curve25519_add(qx, nqx, nqz);
+        curve25519_sub(nqz, nqx, nqz);
+        curve25519_add(qpqx, nqpqx, nqpqz);
+        curve25519_sub(nqpqz, nqpqx, nqpqz);
+        curve25519_mul(nqpqx, qpqx, nqz);
+        curve25519_mul(nqpqz, qx, nqpqz);
+        curve25519_add(qqx, nqpqx, nqpqz);
+        curve25519_sub(nqpqz, nqpqx, nqpqz);
+        curve25519_square(nqpqz, nqpqz);
+        curve25519_square(nqpqx, qqx);
+        curve25519_mul(nqpqz, nqpqz, q);
+        curve25519_square(qx, qx);
+        curve25519_square(nqz, nqz);
+        curve25519_mul(nqx, qx, nqz);
+        curve25519_sub(nqz, qx, nqz);
+        curve25519_scalar_product(zzz, nqz, 121665);
+        curve25519_add(zzz, zzz, qx);
+        curve25519_mul(nqz, nqz, zzz);
+
+        bit = (e[i/8] >> (i & 7)) & 1;
+        curve25519_swap_conditional(nqx, nqpqx, (word32)(bit ^ lastbit));
+        curve25519_swap_conditional(nqz, nqpqz, (word32)(bit ^ lastbit));
+        lastbit = bit;
+    }
+
+    /* the final 3 bits are always zero, so we only need to double */
+    for (int i = 0; i < 3; i++) {
+        curve25519_add(qx, nqx, nqz);
+        curve25519_sub(nqz, nqx, nqz);
+        curve25519_square(qx, qx);
+        curve25519_square(nqz, nqz);
+        curve25519_mul(nqx, qx, nqz);
+        curve25519_sub(nqz, qx, nqz);
+        curve25519_scalar_product(zzz, nqz, 121665);
+        curve25519_add(zzz, zzz, qx);
+        curve25519_mul(nqz, nqz, zzz);
+    }
+
+    curve25519_recip(zmone, nqz);
+    curve25519_mul(nqz, nqx, zmone);
+    curve25519_contract(sharedKey, nqz);
+
+    return 0;
+}
+
+int curve25519_mult(byte publicKey[32], const byte secretKey[32])
+{
+    using namespace CryptoPP::Donna::X25519;
+
+#if (CRYPTOPP_CURVE25519_SSE2)
+    if (HasSSE2())
+        return curve25519_mult_SSE2(publicKey, secretKey, basePoint);
+    else
+#endif
+
+    return curve25519_mult_CXX(publicKey, secretKey, basePoint);
+}
+
+int curve25519_mult(byte sharedKey[32], const byte secretKey[32], const byte othersKey[32])
+{
+#if (CRYPTOPP_CURVE25519_SSE2)
+    if (HasSSE2())
+        return curve25519_mult_SSE2(sharedKey, secretKey, othersKey);
+    else
+#endif
+
+    return curve25519_mult_CXX(sharedKey, secretKey, othersKey);
+}
+
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+//******************************* ed25519 *******************************//
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+
+int
+ed25519_publickey_CXX(byte publicKey[32], const byte secretKey[32])
+{
+    using namespace CryptoPP::Donna::Ed25519;
+
+    bignum256modm a;
+    ALIGN(ALIGN_SPEC) ge25519 A;
+    hash_512bits extsk;
+
+    /* A = aB */
+    ed25519_extsk(extsk, secretKey);
+    expand256_modm(a, extsk, 32);
+    ge25519_scalarmult_base_niels(&A, ge25519_niels_base_multiples, a);
+    ge25519_pack(publicKey, &A);
+
+    return 0;
+}
+
+int
+ed25519_publickey(byte publicKey[32], const byte secretKey[32])
+{
+    return ed25519_publickey_CXX(publicKey, secretKey);
+}
+
+int
+ed25519_sign_CXX(std::istream& stream, const byte sk[32], const byte pk[32], byte RS[64])
+{
+    using namespace CryptoPP::Donna::Ed25519;
+
+    bignum256modm r, S, a;
+    ALIGN(ALIGN_SPEC) ge25519 R;
+    hash_512bits extsk, hashr, hram;
+
+    // Unfortunately we need to read the stream twice. The first time calculates
+    // 'r = H(aExt[32..64], m)'. The second time calculates 'S = H(R,A,m)'. There
+    // is a data dependency due to hashing 'RS' with 'R = [r]B' that does not
+    // allow us to read the stream once.
+    std::streampos where = stream.tellg();
+
+    ed25519_extsk(extsk, sk);
+
+    /* r = H(aExt[32..64], m) */
+    SHA512 hash;
+    hash.Update(extsk + 32, 32);
+    UpdateFromStream(hash, stream);
+    hash.Final(hashr);
+    expand256_modm(r, hashr, 64);
+
+    /* R = rB */
+    ge25519_scalarmult_base_niels(&R, ge25519_niels_base_multiples, r);
+    ge25519_pack(RS, &R);
+
+    // Reset stream for the second digest
+    stream.clear();
+    stream.seekg(where);
+
+    /* S = H(R,A,m).. */
+    ed25519_hram(hram, RS, pk, stream);
+    expand256_modm(S, hram, 64);
+
+    /* S = H(R,A,m)a */
+    expand256_modm(a, extsk, 32);
+    mul256_modm(S, S, a);
+
+    /* S = (r + H(R,A,m)a) */
+    add256_modm(S, S, r);
+
+    /* S = (r + H(R,A,m)a) mod L */
+    contract256_modm(RS + 32, S);
+
+    return 0;
+}
+
+int
+ed25519_sign_CXX(const byte *m, size_t mlen, const byte sk[32], const byte pk[32], byte RS[64])
+{
+    using namespace CryptoPP::Donna::Ed25519;
+
+    bignum256modm r, S, a;
+    ALIGN(ALIGN_SPEC) ge25519 R;
+    hash_512bits extsk, hashr, hram;
+
+    ed25519_extsk(extsk, sk);
+
+    /* r = H(aExt[32..64], m) */
+    SHA512 hash;
+    hash.Update(extsk + 32, 32);
+    hash.Update(m, mlen);
+    hash.Final(hashr);
+    expand256_modm(r, hashr, 64);
+
+    /* R = rB */
+    ge25519_scalarmult_base_niels(&R, ge25519_niels_base_multiples, r);
+    ge25519_pack(RS, &R);
+
+    /* S = H(R,A,m).. */
+    ed25519_hram(hram, RS, pk, m, mlen);
+    expand256_modm(S, hram, 64);
+
+    /* S = H(R,A,m)a */
+    expand256_modm(a, extsk, 32);
+    mul256_modm(S, S, a);
+
+    /* S = (r + H(R,A,m)a) */
+    add256_modm(S, S, r);
+
+    /* S = (r + H(R,A,m)a) mod L */
+    contract256_modm(RS + 32, S);
+
+    return 0;
+}
+
+int
+ed25519_sign(std::istream& stream, const byte secretKey[32], const byte publicKey[32],
+             byte signature[64])
+{
+    return ed25519_sign_CXX(stream, secretKey, publicKey, signature);
+}
+
+int
+ed25519_sign(const byte* message, size_t messageLength, const byte secretKey[32],
+             const byte publicKey[32], byte signature[64])
+{
+    return ed25519_sign_CXX(message, messageLength, secretKey, publicKey, signature);
+}
+
+int
+ed25519_sign_open_CXX(std::istream& stream, const byte pk[32], const byte RS[64]) {
+
+    using namespace CryptoPP::Donna::Ed25519;
+
+    ALIGN(ALIGN_SPEC) ge25519 R, A;
+    hash_512bits hash;
+    bignum256modm hram, S;
+    byte checkR[32];
+
+    if ((RS[63] & 224) || !ge25519_unpack_negative_vartime(&A, pk))
+        return -1;
+
+    /* hram = H(R,A,m) */
+    ed25519_hram(hash, RS, pk, stream);
+    expand256_modm(hram, hash, 64);
+
+    /* S */
+    expand256_modm(S, RS + 32, 32);
+
+    /* SB - H(R,A,m)A */
+    ge25519_double_scalarmult_vartime(&R, &A, hram, S);
+    ge25519_pack(checkR, &R);
+
+    /* check that R = SB - H(R,A,m)A */
+    return ed25519_verify(RS, checkR, 32) ? 0 : -1;
+}
+
+int
+ed25519_sign_open_CXX(const byte *m, size_t mlen, const byte pk[32], const byte RS[64]) {
+
+    using namespace CryptoPP::Donna::Ed25519;
+
+    ALIGN(ALIGN_SPEC) ge25519 R, A;
+    hash_512bits hash;
+    bignum256modm hram, S;
+    byte checkR[32];
+
+    if ((RS[63] & 224) || !ge25519_unpack_negative_vartime(&A, pk))
+        return -1;
+
+    /* hram = H(R,A,m) */
+    ed25519_hram(hash, RS, pk, m, mlen);
+    expand256_modm(hram, hash, 64);
+
+    /* S */
+    expand256_modm(S, RS + 32, 32);
+
+    /* SB - H(R,A,m)A */
+    ge25519_double_scalarmult_vartime(&R, &A, hram, S);
+    ge25519_pack(checkR, &R);
+
+    /* check that R = SB - H(R,A,m)A */
+    return ed25519_verify(RS, checkR, 32) ? 0 : -1;
+}
+
+int
+ed25519_sign_open(const byte *message, size_t messageLength, const byte publicKey[32], const byte signature[64])
+{
+    return ed25519_sign_open_CXX(message, messageLength, publicKey, signature);
+}
+
+int
+ed25519_sign_open(std::istream& stream, const byte publicKey[32], const byte signature[64])
+{
+    return ed25519_sign_open_CXX(stream, publicKey, signature);
+}
+
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_CURVE25519_32BIT
diff --git a/runtime/third_party/cryptopp/donna_32.h b/runtime/third_party/cryptopp/donna_32.h
new file mode 100644
index 0000000..50d6b82
--- /dev/null
+++ b/runtime/third_party/cryptopp/donna_32.h
@@ -0,0 +1,411 @@
+// donna_32.h - written and placed in public domain by Jeffrey Walton
+//              Crypto++ specific implementation wrapped around Andrew
+//              Moon's public domain curve25519-donna and ed25519-donna,
+//              https://github.com/floodyberry/curve25519-donna and
+//              https://github.com/floodyberry/ed25519-donna.
+
+// This source file multiplexes two different repos using namespaces. This
+// was a little easier from a project management standpoint. We only need
+// two files per architecture at the expense of namespaces and bloat.
+
+#ifndef CRYPTOPP_DONNA_32_H
+#define CRYPTOPP_DONNA_32_H
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+
+#include "config.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+NAMESPACE_BEGIN(Arch32)
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::word64;
+
+// ******************** x25519 Agreement ************************* //
+
+#define ALIGN(n) CRYPTOPP_ALIGN_DATA(n)
+#define mul32x32_64(a,b) (((word64)(a))*(b))
+
+typedef word32 bignum25519[10];
+
+const byte basePoint[32] = {9};
+const word32 reduce_mask_25 = (1 << 25) - 1;
+const word32 reduce_mask_26 = (1 << 26) - 1;
+
+// ****************** ed25519 Signatures *********************** //
+
+typedef byte hash_512bits[64];
+
+const int bignum256modm_bits_per_limb = 30;
+const int bignum256modm_limb_size = 9;
+typedef word32 bignum256modm_element_t;
+typedef bignum256modm_element_t bignum256modm[9];
+
+struct ge25519 {
+    bignum25519 x, y, z, t;
+};
+
+struct ge25519_p1p1 {
+    bignum25519 x, y, z, t;
+};
+
+struct ge25519_niels {
+    bignum25519 ysubx, xaddy, t2d;
+};
+
+struct ge25519_pniels {
+    bignum25519 ysubx, xaddy, z, t2d;
+};
+
+#define S1_SWINDOWSIZE 5
+#define S1_TABLE_SIZE (1<<(S1_SWINDOWSIZE-2))
+#define S2_SWINDOWSIZE 7
+#define S2_TABLE_SIZE (1<<(S2_SWINDOWSIZE-2))
+
+// *************** ed25519-donna-32bit-tables.h *************** //
+
+ALIGN(16) const ge25519 ge25519_basepoint = {
+    {0x0325d51a,0x018b5823,0x00f6592a,0x0104a92d,0x01a4b31d,0x01d6dc5c,0x027118fe,0x007fd814,0x013cd6e5,0x0085a4db},
+    {0x02666658,0x01999999,0x00cccccc,0x01333333,0x01999999,0x00666666,0x03333333,0x00cccccc,0x02666666,0x01999999},
+    {0x00000001,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000},
+    {0x01b7dda3,0x01a2ace9,0x025eadbb,0x0003ba8a,0x0083c27e,0x00abe37d,0x01274732,0x00ccacdd,0x00fd78b7,0x019e1d7c}
+};
+
+ALIGN(16) const bignum25519 ge25519_ecd = {
+    0x035978a3,0x00d37284,0x03156ebd,0x006a0a0e,0x0001c029,0x0179e898,0x03a03cbb,0x01ce7198,0x02e2b6ff,0x01480db3
+};
+
+ALIGN(16) const bignum25519 ge25519_ec2d = {
+    0x02b2f159,0x01a6e509,0x022add7a,0x00d4141d,0x00038052,0x00f3d130,0x03407977,0x019ce331,0x01c56dff,0x00901b67
+};
+
+ALIGN(16) const bignum25519 ge25519_sqrtneg1 = {
+    0x020ea0b0,0x0186c9d2,0x008f189d,0x0035697f,0x00bd0c60,0x01fbd7a7,0x02804c9e,0x01e16569,0x0004fc1d,0x00ae0c92
+};
+
+ALIGN(16) const ge25519_niels ge25519_niels_sliding_multiples[32] = {
+    {{0x0340913e,0x000e4175,0x03d673a2,0x002e8a05,0x03f4e67c,0x008f8a09,0x00c21a34,0x004cf4b8,0x01298f81,0x0113f4be},{0x018c3b85,0x0124f1bd,0x01c325f7,0x0037dc60,0x033e4cb7,0x003d42c2,0x01a44c32,0x014ca4e1,0x03a33d4b,0x001f3e74},{0x037aaa68,0x00448161,0x0093d579,0x011e6556,0x009b67a0,0x0143598c,0x01bee5ee,0x00b50b43,0x0289f0c6,0x01bc45ed}},
+    {{0x00fcd265,0x0047fa29,0x034faacc,0x01ef2e0d,0x00ef4d4f,0x014bd6bd,0x00f98d10,0x014c5026,0x007555bd,0x00aae456},{0x00ee9730,0x016c2a13,0x017155e4,0x01874432,0x00096a10,0x01016732,0x01a8014f,0x011e9823,0x01b9a80f,0x01e85938},{0x01d0d889,0x01a4cfc3,0x034c4295,0x0110e1ae,0x0162508c,0x00f2db4c,0x0072a2c6,0x0098da2e,0x02f12b9b,0x0168a09a}},
+    {{0x0047d6ba,0x0060b0e9,0x0136eff2,0x008a5939,0x03540053,0x0064a087,0x02788e5c,0x00be7c67,0x033eb1b5,0x005529f9},{0x00a5bb33,0x00af1102,0x01a05442,0x001e3af7,0x02354123,0x00bfec44,0x01f5862d,0x00dd7ba3,0x03146e20,0x00a51733},{0x012a8285,0x00f6fc60,0x023f9797,0x003e85ee,0x009c3820,0x01bda72d,0x01b3858d,0x00d35683,0x0296b3bb,0x010eaaf9}},
+    {{0x023221b1,0x01cb26aa,0x0074f74d,0x0099ddd1,0x01b28085,0x00192c3a,0x013b27c9,0x00fc13bd,0x01d2e531,0x0075bb75},{0x004ea3bf,0x00973425,0x001a4d63,0x01d59cee,0x01d1c0d4,0x00542e49,0x01294114,0x004fce36,0x029283c9,0x01186fa9},{0x01b8b3a2,0x00db7200,0x00935e30,0x003829f5,0x02cc0d7d,0x0077adf3,0x0220dd2c,0x0014ea53,0x01c6a0f9,0x01ea7eec}},
+    {{0x039d8064,0x01885f80,0x00337e6d,0x01b7a902,0x02628206,0x015eb044,0x01e30473,0x0191f2d9,0x011fadc9,0x01270169},{0x02a8632f,0x0199e2a9,0x00d8b365,0x017a8de2,0x02994279,0x0086f5b5,0x0119e4e3,0x01eb39d6,0x0338add7,0x00d2e7b4},{0x0045af1b,0x013a2fe4,0x0245e0d6,0x014538ce,0x038bfe0f,0x01d4cf16,0x037e14c9,0x0160d55e,0x0021b008,0x01cf05c8}},
+    {{0x01864348,0x01d6c092,0x0070262b,0x014bb844,0x00fb5acd,0x008deb95,0x003aaab5,0x00eff474,0x00029d5c,0x0062ad66},{0x02802ade,0x01c02122,0x01c4e5f7,0x00781181,0x039767fb,0x01703406,0x0342388b,0x01f5e227,0x022546d8,0x0109d6ab},{0x016089e9,0x00cb317f,0x00949b05,0x01099417,0x000c7ad2,0x011a8622,0x0088ccda,0x01290886,0x022b53df,0x00f71954}},
+    {{0x027fbf93,0x01c04ecc,0x01ed6a0d,0x004cdbbb,0x02bbf3af,0x00ad5968,0x01591955,0x0094f3a2,0x02d17602,0x00099e20},{0x02007f6d,0x003088a8,0x03db77ee,0x00d5ade6,0x02fe12ce,0x0107ba07,0x0107097d,0x00482a6f,0x02ec346f,0x008d3f5f},{0x032ea378,0x0028465c,0x028e2a6c,0x018efc6e,0x0090df9a,0x01a7e533,0x039bfc48,0x010c745d,0x03daa097,0x0125ee9b}},
+    {{0x028ccf0b,0x00f36191,0x021ac081,0x012154c8,0x034e0a6e,0x01b25192,0x00180403,0x01d7eea1,0x00218d05,0x010ed735},{0x03cfeaa0,0x01b300c4,0x008da499,0x0068c4e1,0x0219230a,0x01f2d4d0,0x02defd60,0x00e565b7,0x017f12de,0x018788a4},{0x03d0b516,0x009d8be6,0x03ddcbb3,0x0071b9fe,0x03ace2bd,0x01d64270,0x032d3ec9,0x01084065,0x0210ae4d,0x01447584}},
+    {{0x0020de87,0x00e19211,0x01b68102,0x00b5ac97,0x022873c0,0x01942d25,0x01271394,0x0102073f,0x02fe2482,0x01c69ff9},{0x010e9d81,0x019dbbe5,0x0089f258,0x006e06b8,0x02951883,0x018f1248,0x019b3237,0x00bc7553,0x024ddb85,0x01b4c964},{0x01c8c854,0x0060ae29,0x01406d8e,0x01cff2f9,0x00cff451,0x01778d0c,0x03ac8c41,0x01552e59,0x036559ee,0x011d1b12}},
+    {{0x00741147,0x0151b219,0x01092690,0x00e877e6,0x01f4d6bb,0x0072a332,0x01cd3b03,0x00dadff2,0x0097db5e,0x0086598d},{0x01c69a2b,0x01decf1b,0x02c2fa6e,0x013b7c4f,0x037beac8,0x013a16b5,0x028e7bda,0x01f6e8ac,0x01e34fe9,0x01726947},{0x01f10e67,0x003c73de,0x022b7ea2,0x010f32c2,0x03ff776a,0x00142277,0x01d38b88,0x00776138,0x03c60822,0x01201140}},
+    {{0x0236d175,0x0008748e,0x03c6476d,0x013f4cdc,0x02eed02a,0x00838a47,0x032e7210,0x018bcbb3,0x00858de4,0x01dc7826},{0x00a37fc7,0x0127b40b,0x01957884,0x011d30ad,0x02816683,0x016e0e23,0x00b76be4,0x012db115,0x02516506,0x0154ce62},{0x00451edf,0x00bd749e,0x03997342,0x01cc2c4c,0x00eb6975,0x01a59508,0x03a516cf,0x00c228ef,0x0168ff5a,0x01697b47}},
+    {{0x00527359,0x01783156,0x03afd75c,0x00ce56dc,0x00e4b970,0x001cabe9,0x029e0f6d,0x0188850c,0x0135fefd,0x00066d80},{0x02150e83,0x01448abf,0x02bb0232,0x012bf259,0x033c8268,0x00711e20,0x03fc148f,0x005e0e70,0x017d8bf9,0x0112b2e2},{0x02134b83,0x001a0517,0x0182c3cc,0x00792182,0x0313d799,0x001a3ed7,0x0344547e,0x01f24a0d,0x03de6ad2,0x00543127}},
+    {{0x00dca868,0x00618f27,0x015a1709,0x00ddc38a,0x0320fd13,0x0036168d,0x0371ab06,0x01783fc7,0x0391e05f,0x01e29b5d},{0x01471138,0x00fca542,0x00ca31cf,0x01ca7bad,0x0175bfbc,0x01a708ad,0x03bce212,0x01244215,0x0075bb99,0x01acad68},{0x03a0b976,0x01dc12d1,0x011aab17,0x00aba0ba,0x029806cd,0x0142f590,0x018fd8ea,0x01a01545,0x03c4ad55,0x01c971ff}},
+    {{0x00d098c0,0x000afdc7,0x006cd230,0x01276af3,0x03f905b2,0x0102994c,0x002eb8a4,0x015cfbeb,0x025f855f,0x01335518},{0x01cf99b2,0x0099c574,0x01a69c88,0x00881510,0x01cd4b54,0x0112109f,0x008abdc5,0x0074647a,0x0277cb1f,0x01e53324},{0x02ac5053,0x01b109b0,0x024b095e,0x016997b3,0x02f26bb6,0x00311021,0x00197885,0x01d0a55a,0x03b6fcc8,0x01c020d5}},
+    {{0x02584a34,0x00e7eee0,0x03257a03,0x011e95a3,0x011ead91,0x00536202,0x00b1ce24,0x008516c6,0x03669d6d,0x004ea4a8},{0x00773f01,0x0019c9ce,0x019f6171,0x01d4afde,0x02e33323,0x01ad29b6,0x02ead1dc,0x01ed51a5,0x01851ad0,0x001bbdfa},{0x00577de5,0x00ddc730,0x038b9952,0x00f281ae,0x01d50390,0x0002e071,0x000780ec,0x010d448d,0x01f8a2af,0x00f0a5b7}},
+    {{0x031f2541,0x00d34bae,0x0323ff9d,0x003a056d,0x02e25443,0x00a1ad05,0x00d1bee8,0x002f7f8e,0x03007477,0x002a24b1},{0x0114a713,0x01457e76,0x032255d5,0x01cc647f,0x02a4bdef,0x0153d730,0x00118bcf,0x00f755ff,0x013490c7,0x01ea674e},{0x02bda3e8,0x00bb490d,0x00f291ea,0x000abf40,0x01dea321,0x002f9ce0,0x00b2b193,0x00fa54b5,0x0128302f,0x00a19d8b}},
+    {{0x022ef5bd,0x01638af3,0x038c6f8a,0x01a33a3d,0x039261b2,0x01bb89b8,0x010bcf9d,0x00cf42a9,0x023d6f17,0x01da1bca},{0x00e35b25,0x000d824f,0x0152e9cf,0x00ed935d,0x020b8460,0x01c7b83f,0x00c969e5,0x01a74198,0x0046a9d9,0x00cbc768},{0x01597c6a,0x0144a99b,0x00a57551,0x0018269c,0x023c464c,0x0009b022,0x00ee39e1,0x0114c7f2,0x038a9ad2,0x01584c17}},
+    {{0x03b0c0d5,0x00b30a39,0x038a6ce4,0x01ded83a,0x01c277a6,0x01010a61,0x0346d3eb,0x018d995e,0x02f2c57c,0x000c286b},{0x0092aed1,0x0125e37b,0x027ca201,0x001a6b6b,0x03290f55,0x0047ba48,0x018d916c,0x01a59062,0x013e35d4,0x0002abb1},{0x003ad2aa,0x007ddcc0,0x00c10f76,0x0001590b,0x002cfca6,0x000ed23e,0x00ee4329,0x00900f04,0x01c24065,0x0082fa70}},
+    {{0x02025e60,0x003912b8,0x0327041c,0x017e5ee5,0x02c0ecec,0x015a0d1c,0x02b1ce7c,0x0062220b,0x0145067e,0x01a5d931},{0x009673a6,0x00e1f609,0x00927c2a,0x016faa37,0x01650ef0,0x016f63b5,0x03cd40e1,0x003bc38f,0x0361f0ac,0x01d42acc},{0x02f81037,0x008ca0e8,0x017e23d1,0x011debfe,0x01bcbb68,0x002e2563,0x03e8add6,0x000816e5,0x03fb7075,0x0153e5ac}},
+    {{0x02b11ecd,0x016bf185,0x008f22ef,0x00e7d2bb,0x0225d92e,0x00ece785,0x00508873,0x017e16f5,0x01fbe85d,0x01e39a0e},{0x01669279,0x017c810a,0x024941f5,0x0023ebeb,0x00eb7688,0x005760f1,0x02ca4146,0x0073cde7,0x0052bb75,0x00f5ffa7},{0x03b8856b,0x00cb7dcd,0x02f14e06,0x001820d0,0x01d74175,0x00e59e22,0x03fba550,0x00484641,0x03350088,0x01c3c9a3}},
+    {{0x00dcf355,0x0104481c,0x0022e464,0x01f73fe7,0x00e03325,0x0152b698,0x02ef769a,0x00973663,0x00039b8c,0x0101395b},{0x01805f47,0x019160ec,0x03832cd0,0x008b06eb,0x03d4d717,0x004cb006,0x03a75b8f,0x013b3d30,0x01cfad88,0x01f034d1},{0x0078338a,0x01c7d2e3,0x02bc2b23,0x018b3f05,0x0280d9aa,0x005f3d44,0x0220a95a,0x00eeeb97,0x0362aaec,0x00835d51}},
+    {{0x01b9f543,0x013fac4d,0x02ad93ae,0x018ef464,0x0212cdf7,0x01138ba9,0x011583ab,0x019c3d26,0x028790b4,0x00e2e2b6},{0x033bb758,0x01f0dbf1,0x03734bd1,0x0129b1e5,0x02b3950e,0x003bc922,0x01a53ec8,0x018c5532,0x006f3cee,0x00ae3c79},{0x0351f95d,0x0012a737,0x03d596b8,0x017658fe,0x00ace54a,0x008b66da,0x0036c599,0x012a63a2,0x032ceba1,0x00126bac}},
+    {{0x03dcfe7e,0x019f4f18,0x01c81aee,0x0044bc2b,0x00827165,0x014f7c13,0x03b430f0,0x00bf96cc,0x020c8d62,0x01471997},{0x01fc7931,0x001f42dd,0x00ba754a,0x005bd339,0x003fbe49,0x016b3930,0x012a159c,0x009f83b0,0x03530f67,0x01e57b85},{0x02ecbd81,0x0096c294,0x01fce4a9,0x017701a5,0x0175047d,0x00ee4a31,0x012686e5,0x008efcd4,0x0349dc54,0x01b3466f}},
+    {{0x02179ca3,0x01d86414,0x03f0afd0,0x00305964,0x015c7428,0x0099711e,0x015d5442,0x00c71014,0x01b40b2e,0x01d483cf},{0x01afc386,0x01984859,0x036203ff,0x0045c6a8,0x0020a8aa,0x00990baa,0x03313f10,0x007ceede,0x027429e4,0x017806ce},{0x039357a1,0x0142f8f4,0x0294a7b6,0x00eaccf4,0x0259edb3,0x01311e6e,0x004d326f,0x0130c346,0x01ccef3c,0x01c424b2}},
+    {{0x0364918c,0x00148fc0,0x01638a7b,0x01a1fd5b,0x028ad013,0x0081e5a4,0x01a54f33,0x0174e101,0x003d0257,0x003a856c},{0x00051dcf,0x00f62b1d,0x0143d0ad,0x0042adbd,0x000fda90,0x01743ceb,0x0173e5e4,0x017bc749,0x03b7137a,0x0105ce96},{0x00f9218a,0x015b8c7c,0x00e102f8,0x0158d7e2,0x0169a5b8,0x00b2f176,0x018b347a,0x014cfef2,0x0214a4e3,0x017f1595}},
+    {{0x006d7ae5,0x0195c371,0x0391e26d,0x0062a7c6,0x003f42ab,0x010dad86,0x024f8198,0x01542b2a,0x0014c454,0x0189c471},{0x0390988e,0x00b8799d,0x02e44912,0x0078e2e6,0x00075654,0x01923eed,0x0040cd72,0x00a37c76,0x0009d466,0x00c8531d},{0x02651770,0x00609d01,0x0286c265,0x0134513c,0x00ee9281,0x005d223c,0x035c760c,0x00679b36,0x0073ecb8,0x016faa50}},
+    {{0x02c89be4,0x016fc244,0x02f38c83,0x018beb72,0x02b3ce2c,0x0097b065,0x034f017b,0x01dd957f,0x00148f61,0x00eab357},{0x0343d2f8,0x003398fc,0x011e368e,0x00782a1f,0x00019eea,0x00117b6f,0x0128d0d1,0x01a5e6bb,0x01944f1b,0x012b41e1},{0x03318301,0x018ecd30,0x0104d0b1,0x0038398b,0x03726701,0x019da88c,0x002d9769,0x00a7a681,0x031d9028,0x00ebfc32}},
+    {{0x0220405e,0x0171face,0x02d930f8,0x017f6d6a,0x023b8c47,0x0129d5f9,0x02972456,0x00a3a524,0x006f4cd2,0x004439fa},{0x00c53505,0x0190c2fd,0x00507244,0x009930f9,0x01a39270,0x01d327c6,0x0399bc47,0x01cfe13d,0x0332bd99,0x00b33e7d},{0x0203f5e4,0x003627b5,0x00018af8,0x01478581,0x004a2218,0x002e3bb7,0x039384d0,0x0146ea62,0x020b9693,0x0017155f}},
+    {{0x03c97e6f,0x00738c47,0x03b5db1f,0x01808fcf,0x01e8fc98,0x01ed25dd,0x01bf5045,0x00eb5c2b,0x0178fe98,0x01b85530},{0x01c20eb0,0x01aeec22,0x030b9eee,0x01b7d07e,0x0187e16f,0x014421fb,0x009fa731,0x0040b6d7,0x00841861,0x00a27fbc},{0x02d69abf,0x0058cdbf,0x0129f9ec,0x013c19ae,0x026c5b93,0x013a7fe7,0x004bb2ba,0x0063226f,0x002a95ca,0x01abefd9}},
+    {{0x02f5d2c1,0x00378318,0x03734fb5,0x01258073,0x0263f0f6,0x01ad70e0,0x01b56d06,0x01188fbd,0x011b9503,0x0036d2e1},{0x0113a8cc,0x01541c3e,0x02ac2bbc,0x01d95867,0x01f47459,0x00ead489,0x00ab5b48,0x01db3b45,0x00edb801,0x004b024f},{0x00b8190f,0x011fe4c2,0x00621f82,0x010508d7,0x001a5a76,0x00c7d7fd,0x03aab96d,0x019cd9dc,0x019c6635,0x00ceaa1e}},
+    {{0x01085cf2,0x01fd47af,0x03e3f5e1,0x004b3e99,0x01e3d46a,0x0060033c,0x015ff0a8,0x0150cdd8,0x029e8e21,0x008cf1bc},{0x00156cb1,0x003d623f,0x01a4f069,0x00d8d053,0x01b68aea,0x01ca5ab6,0x0316ae43,0x0134dc44,0x001c8d58,0x0084b343},{0x0318c781,0x0135441f,0x03a51a5e,0x019293f4,0x0048bb37,0x013d3341,0x0143151e,0x019c74e1,0x00911914,0x0076ddde}},
+    {{0x006bc26f,0x00d48e5f,0x00227bbe,0x00629ea8,0x01ea5f8b,0x0179a330,0x027a1d5f,0x01bf8f8e,0x02d26e2a,0x00c6b65e},{0x01701ab6,0x0051da77,0x01b4b667,0x00a0ce7c,0x038ae37b,0x012ac852,0x03a0b0fe,0x0097c2bb,0x00a017d2,0x01eb8b2a},{0x0120b962,0x0005fb42,0x0353b6fd,0x0061f8ce,0x007a1463,0x01560a64,0x00e0a792,0x01907c92,0x013a6622,0x007b47f1}}
+};
+
+// *************** modm-donna-32bit.h *************** //
+
+const bignum256modm modm_m = {
+    0x1cf5d3ed, 0x20498c69, 0x2f79cd65, 0x37be77a8,
+    0x00000014, 0x00000000, 0x00000000, 0x00000000,
+    0x00001000
+};
+
+const bignum256modm modm_mu = {
+    0x0a2c131b, 0x3673968c, 0x06329a7e, 0x01885742,
+    0x3fffeb21, 0x3fffffff, 0x3fffffff, 0x3fffffff,
+    0x000fffff
+};
+
+/* multiples of p */
+const word32 twoP0       = 0x07ffffda;
+const word32 twoP13579   = 0x03fffffe;
+const word32 twoP2468    = 0x07fffffe;
+const word32 fourP0      = 0x0fffffb4;
+const word32 fourP13579  = 0x07fffffc;
+const word32 fourP2468   = 0x0ffffffc;
+
+// *************** ed25519-donna-basepoint-table.h *************** //
+
+/* multiples of the base point in packed {ysubx, xaddy, t2d} form */
+ALIGN(16) const byte ge25519_niels_base_multiples[256][96] = {
+    {0x3e,0x91,0x40,0xd7,0x05,0x39,0x10,0x9d,0xb3,0xbe,0x40,0xd1,0x05,0x9f,0x39,0xfd,0x09,0x8a,0x8f,0x68,0x34,0x84,0xc1,0xa5,0x67,0x12,0xf8,0x98,0x92,0x2f,0xfd,0x44,0x85,0x3b,0x8c,0xf5,0xc6,0x93,0xbc,0x2f,0x19,0x0e,0x8c,0xfb,0xc6,0x2d,0x93,0xcf,0xc2,0x42,0x3d,0x64,0x98,0x48,0x0b,0x27,0x65,0xba,0xd4,0x33,0x3a,0x9d,0xcf,0x07,0x59,0xbb,0x6f,0x4b,0x67,0x15,0xbd,0xdb,0xea,0xa5,0xa2,0xee,0x00,0x3f,0xe1,0x41,0xfa,0xc6,0x57,0xc9,0x1c,0x9d,0xd4,0xcd,0xca,0xec,0x16,0xaf,0x1f,0xbe,0x0e,0x4f},
+    {0xa8,0xd5,0xb4,0x42,0x60,0xa5,0x99,0x8a,0xf6,0xac,0x60,0x4e,0x0c,0x81,0x2b,0x8f,0xaa,0x37,0x6e,0xb1,0x6b,0x23,0x9e,0xe0,0x55,0x25,0xc9,0x69,0xa6,0x95,0xb5,0x6b,0xd7,0x71,0x3c,0x93,0xfc,0xe7,0x24,0x92,0xb5,0xf5,0x0f,0x7a,0x96,0x9d,0x46,0x9f,0x02,0x07,0xd6,0xe1,0x65,0x9a,0xa6,0x5a,0x2e,0x2e,0x7d,0xa8,0x3f,0x06,0x0c,0x59,0x02,0x68,0xd3,0xda,0xaa,0x7e,0x34,0x6e,0x05,0x48,0xee,0x83,0x93,0x59,0xf3,0xba,0x26,0x68,0x07,0xe6,0x10,0xbe,0xca,0x3b,0xb8,0xd1,0x5e,0x16,0x0a,0x4f,0x31,0x49},
+    {0x65,0xd2,0xfc,0xa4,0xe8,0x1f,0x61,0x56,0x7d,0xba,0xc1,0xe5,0xfd,0x53,0xd3,0x3b,0xbd,0xd6,0x4b,0x21,0x1a,0xf3,0x31,0x81,0x62,0xda,0x5b,0x55,0x87,0x15,0xb9,0x2a,0x30,0x97,0xee,0x4c,0xa8,0xb0,0x25,0xaf,0x8a,0x4b,0x86,0xe8,0x30,0x84,0x5a,0x02,0x32,0x67,0x01,0x9f,0x02,0x50,0x1b,0xc1,0xf4,0xf8,0x80,0x9a,0x1b,0x4e,0x16,0x7a,0x34,0x48,0x67,0xf1,0xf4,0x11,0xf2,0x9b,0x95,0xf8,0x2d,0xf6,0x17,0x6b,0x4e,0xb8,0x4e,0x2a,0x72,0x5b,0x07,0x6f,0xde,0xd7,0x21,0x2a,0xbb,0x63,0xb9,0x04,0x9a,0x54},
+    {0xbf,0x18,0x68,0x05,0x0a,0x05,0xfe,0x95,0xa9,0xfa,0x60,0x56,0x71,0x89,0x7e,0x32,0x73,0x50,0xa0,0x06,0xcd,0xe3,0xe8,0xc3,0x9a,0xa4,0x45,0x74,0x4c,0x3f,0x93,0x27,0x9f,0x09,0xfc,0x8e,0xb9,0x51,0x73,0x28,0x38,0x25,0xfd,0x7d,0xf4,0xc6,0x65,0x67,0x65,0x92,0x0a,0xfb,0x3d,0x8d,0x34,0xca,0x27,0x87,0xe5,0x21,0x03,0x91,0x0e,0x68,0xb0,0x26,0x14,0xe5,0xec,0x45,0x1e,0xbf,0x94,0x0f,0xba,0x6d,0x3d,0xc6,0x2b,0xe3,0xc0,0x52,0xf8,0x8c,0xd5,0x74,0x29,0xe4,0x18,0x4c,0xe6,0xb0,0xb1,0x79,0xf0,0x44},
+    {0xba,0xd6,0x47,0xa4,0xc3,0x82,0x91,0x7f,0xb7,0x29,0x27,0x4b,0xd1,0x14,0x00,0xd5,0x87,0xa0,0x64,0xb8,0x1c,0xf1,0x3c,0xe3,0xf3,0x55,0x1b,0xeb,0x73,0x7e,0x4a,0x15,0x33,0xbb,0xa5,0x08,0x44,0xbc,0x12,0xa2,0x02,0xed,0x5e,0xc7,0xc3,0x48,0x50,0x8d,0x44,0xec,0xbf,0x5a,0x0c,0xeb,0x1b,0xdd,0xeb,0x06,0xe2,0x46,0xf1,0xcc,0x45,0x29,0xb3,0x03,0xd0,0xe7,0x79,0xa1,0x32,0xc8,0x7e,0x4d,0x12,0x00,0x0a,0x9d,0x72,0x5f,0xf3,0x8f,0x6d,0x0e,0xa1,0xd4,0xc1,0x62,0x98,0x7a,0xb2,0x38,0x59,0xac,0xb8,0x68},
+    {0xa4,0x8c,0x7d,0x7b,0xb6,0x06,0x98,0x49,0x39,0x27,0xd2,0x27,0x84,0xe2,0x5b,0x57,0xb9,0x53,0x45,0x20,0xe7,0x5c,0x08,0xbb,0x84,0x78,0x41,0xae,0x41,0x4c,0xb6,0x38,0x31,0x71,0x15,0x77,0xeb,0xee,0x0c,0x3a,0x88,0xaf,0xc8,0x00,0x89,0x15,0x27,0x9b,0x36,0xa7,0x59,0xda,0x68,0xb6,0x65,0x80,0xbd,0x38,0xcc,0xa2,0xb6,0x7b,0xe5,0x51,0xa4,0xe3,0x9d,0x68,0x91,0xad,0x9d,0x8f,0x37,0x91,0xfb,0xf8,0x28,0x24,0x5f,0x17,0x88,0xb9,0xcf,0x9f,0x32,0xb5,0x0a,0x05,0x9f,0xc0,0x54,0x13,0xa2,0xdf,0x65,0x78},
+    {0xb1,0x21,0x32,0xaa,0x9a,0x2c,0x6f,0xba,0xa7,0x23,0xba,0x3b,0x53,0x21,0xa0,0x6c,0x3a,0x2c,0x19,0x92,0x4f,0x76,0xea,0x9d,0xe0,0x17,0x53,0x2e,0x5d,0xdd,0x6e,0x1d,0xbf,0xa3,0x4e,0x94,0xd0,0x5c,0x1a,0x6b,0xd2,0xc0,0x9d,0xb3,0x3a,0x35,0x70,0x74,0x49,0x2e,0x54,0x28,0x82,0x52,0xb2,0x71,0x7e,0x92,0x3c,0x28,0x69,0xea,0x1b,0x46,0x36,0xda,0x0f,0xab,0xac,0x8a,0x7a,0x21,0xc8,0x49,0x35,0x3d,0x54,0xc6,0x28,0xa5,0x68,0x75,0xab,0x13,0x8b,0x5b,0xd0,0x37,0x37,0xbc,0x2c,0x3a,0x62,0xef,0x3c,0x23},
+    {0xd9,0x34,0x92,0xf3,0xed,0x5d,0xa7,0xe2,0xf9,0x58,0xb5,0xe1,0x80,0x76,0x3d,0x96,0xfb,0x23,0x3c,0x6e,0xac,0x41,0x27,0x2c,0xc3,0x01,0x0e,0x32,0xa1,0x24,0x90,0x3a,0x8f,0x3e,0xdd,0x04,0x66,0x59,0xb7,0x59,0x2c,0x70,0x88,0xe2,0x77,0x03,0xb3,0x6c,0x23,0xc3,0xd9,0x5e,0x66,0x9c,0x33,0xb1,0x2f,0xe5,0xbc,0x61,0x60,0xe7,0x15,0x09,0x7e,0xa3,0x34,0xa8,0x35,0xe8,0x7d,0xdf,0xea,0x57,0x98,0x68,0xda,0x9c,0xe1,0x8b,0x26,0xb3,0x67,0x71,0x36,0x85,0x11,0x2c,0xc2,0xd5,0xef,0xdb,0xd9,0xb3,0x9e,0x58},
+    {0x5e,0x51,0xaa,0x49,0x54,0x63,0x5b,0xed,0x3a,0x82,0xc6,0x0b,0x9f,0xc4,0x65,0xa8,0xc4,0xd1,0x42,0x5b,0xe9,0x1f,0x0c,0x85,0xb9,0x15,0xd3,0x03,0x6f,0x6d,0xd7,0x30,0x1d,0x9c,0x2f,0x63,0x0e,0xdd,0xcc,0x2e,0x15,0x31,0x89,0x76,0x96,0xb6,0xd0,0x51,0x58,0x7a,0x63,0xa8,0x6b,0xb7,0xdf,0x52,0x39,0xef,0x0e,0xa0,0x49,0x7d,0xd3,0x6d,0xc7,0xe4,0x06,0x21,0x17,0x44,0x44,0x6c,0x69,0x7f,0x8d,0x92,0x80,0xd6,0x53,0xfb,0x26,0x3f,0x4d,0x69,0xa4,0x9e,0x73,0xb4,0xb0,0x4b,0x86,0x2e,0x11,0x97,0xc6,0x10},
+    {0xde,0x5f,0xbe,0x7d,0x27,0xc4,0x93,0x64,0xa2,0x7e,0xad,0x19,0xad,0x4f,0x5d,0x26,0x90,0x45,0x30,0x46,0xc8,0xdf,0x00,0x0e,0x09,0xfe,0x66,0xed,0xab,0x1c,0xe6,0x25,0x05,0xc8,0x58,0x83,0xa0,0x2a,0xa6,0x0c,0x47,0x42,0x20,0x7a,0xe3,0x4a,0x3d,0x6a,0xdc,0xed,0x11,0x3b,0xa6,0xd3,0x64,0x74,0xef,0x06,0x08,0x55,0xaf,0x9b,0xbf,0x03,0x04,0x66,0x58,0xcc,0x28,0xe1,0x13,0x3f,0x7e,0x74,0x59,0xb4,0xec,0x73,0x58,0x6f,0xf5,0x68,0x12,0xcc,0xed,0x3d,0xb6,0xa0,0x2c,0xe2,0x86,0x45,0x63,0x78,0x6d,0x56},
+    {0x34,0x08,0xc1,0x9c,0x9f,0xa4,0x37,0x16,0x51,0xc4,0x9b,0xa8,0xd5,0x56,0x8e,0xbc,0xdb,0xd2,0x7f,0x7f,0x0f,0xec,0xb5,0x1c,0xd9,0x35,0xcc,0x5e,0xca,0x5b,0x97,0x33,0xd0,0x2f,0x5a,0xc6,0x85,0x42,0x05,0xa1,0xc3,0x67,0x16,0xf3,0x2a,0x11,0x64,0x6c,0x58,0xee,0x1a,0x73,0x40,0xe2,0x0a,0x68,0x2a,0xb2,0x93,0x47,0xf3,0xa5,0xfb,0x14,0xd4,0xf7,0x85,0x69,0x16,0x46,0xd7,0x3c,0x57,0x00,0xc8,0xc9,0x84,0x5e,0x3e,0x59,0x1e,0x13,0x61,0x7b,0xb6,0xf2,0xc3,0x2f,0x6c,0x52,0xfc,0x83,0xea,0x9c,0x82,0x14},
+    {0xc2,0x95,0xdd,0x97,0x84,0x7b,0x43,0xff,0xa7,0xb5,0x4e,0xaa,0x30,0x4e,0x74,0x6c,0x8b,0xe8,0x85,0x3c,0x61,0x5d,0x0c,0x9e,0x73,0x81,0x75,0x5f,0x1e,0xc7,0xd9,0x2f,0xb8,0xec,0x71,0x4e,0x2f,0x0b,0xe7,0x21,0xe3,0x77,0xa4,0x40,0xb9,0xdd,0x56,0xe6,0x80,0x4f,0x1d,0xce,0xce,0x56,0x65,0xbf,0x7e,0x7b,0x5d,0x53,0xc4,0x3b,0xfc,0x05,0xdd,0xde,0xaf,0x52,0xae,0xb3,0xb8,0x24,0xcf,0x30,0x3b,0xed,0x8c,0x63,0x95,0x34,0x95,0x81,0xbe,0xa9,0x83,0xbc,0xa4,0x33,0x04,0x1f,0x65,0x5c,0x47,0x67,0x37,0x37},
+    {0xd9,0xad,0xd1,0x40,0xfd,0x99,0xba,0x2f,0x27,0xd0,0xf4,0x96,0x6f,0x16,0x07,0xb3,0xae,0x3b,0xf0,0x15,0x52,0xf0,0x63,0x43,0x99,0xf9,0x18,0x3b,0x6c,0xa5,0xbe,0x1f,0x90,0x65,0x24,0x14,0xcb,0x95,0x40,0x63,0x35,0x55,0xc1,0x16,0x40,0x14,0x12,0xef,0x60,0xbc,0x10,0x89,0x0c,0x14,0x38,0x9e,0x8c,0x7c,0x90,0x30,0x57,0x90,0xf5,0x6b,0x8a,0x5b,0x41,0xe1,0xf1,0x78,0xa7,0x0f,0x7e,0xa7,0xc3,0xba,0xf7,0x9f,0x40,0x06,0x50,0x9a,0xa2,0x9a,0xb8,0xd7,0x52,0x6f,0x56,0x5a,0x63,0x7a,0xf6,0x1c,0x52,0x02},
+    {0x94,0x52,0x9d,0x0a,0x0b,0xee,0x3f,0x51,0x66,0x5a,0xdf,0x0f,0x5c,0xe7,0x98,0x8f,0xce,0x07,0xe1,0xbf,0x88,0x86,0x61,0xd4,0xed,0x2c,0x38,0x71,0x7e,0x0a,0xa0,0x3f,0xe4,0x5e,0x2f,0x77,0x20,0x67,0x14,0xb1,0xce,0x9a,0x07,0x96,0xb1,0x94,0xf8,0xe8,0x4a,0x82,0xac,0x00,0x4d,0x22,0xf8,0x4a,0xc4,0x6c,0xcd,0xf7,0xd9,0x53,0x17,0x00,0x34,0xdb,0x3d,0x96,0x2d,0x23,0x69,0x3c,0x58,0x38,0x97,0xb4,0xda,0x87,0xde,0x1d,0x85,0xf2,0x91,0xa0,0xf9,0xd1,0xd7,0xaa,0xb6,0xed,0x48,0xa0,0x2f,0xfe,0xb5,0x12},
+    {0x4d,0xe3,0xfc,0x96,0xc4,0xfb,0xf0,0x71,0xed,0x5b,0xf3,0xad,0x6b,0x82,0xb9,0x73,0x61,0xc5,0x28,0xff,0x61,0x72,0x04,0xd2,0x6f,0x20,0xb1,0x6f,0xf9,0x76,0x9b,0x74,0x92,0x1e,0x6f,0xad,0x26,0x7c,0x2b,0xdf,0x13,0x89,0x4b,0x50,0x23,0xd3,0x66,0x4b,0xc3,0x8b,0x1c,0x75,0xc0,0x9d,0x40,0x8c,0xb8,0xc7,0x96,0x07,0xc2,0x93,0x7e,0x6f,0x05,0xae,0xa6,0xae,0x04,0xf6,0x5a,0x1f,0x99,0x9c,0xe4,0xbe,0xf1,0x51,0x23,0xc1,0x66,0x6b,0xff,0xee,0xb5,0x08,0xa8,0x61,0x51,0x21,0xe0,0x01,0x0f,0xc1,0xce,0x0f},
+    {0x44,0x1e,0xfe,0x49,0xa6,0x58,0x4d,0x64,0x7e,0x77,0xad,0x31,0xa2,0xae,0xfc,0x21,0xd2,0xd0,0x7f,0x88,0x5a,0x1c,0x44,0x02,0xf3,0x11,0xc5,0x83,0x71,0xaa,0x01,0x49,0x45,0x4e,0x24,0xc4,0x9d,0xd2,0xf2,0x3d,0x0a,0xde,0xd8,0x93,0x74,0x0e,0x02,0x2b,0x4d,0x21,0x0c,0x82,0x7e,0x06,0xc8,0x6c,0x0a,0xb9,0xea,0x6f,0x16,0x79,0x37,0x41,0xf0,0xf8,0x1a,0x8c,0x54,0xb7,0xb1,0x08,0xb4,0x99,0x62,0x24,0x7c,0x7a,0x0f,0xce,0x39,0xd9,0x06,0x1e,0xf9,0xb0,0x60,0xf7,0x13,0x12,0x6d,0x72,0x7b,0x88,0xbb,0x41},
+    {0xbe,0x46,0x43,0x74,0x44,0x7d,0xe8,0x40,0x25,0x2b,0xb5,0x15,0xd4,0xda,0x48,0x1d,0x3e,0x60,0x3b,0xa1,0x18,0x8a,0x3a,0x7c,0xf7,0xbd,0xcd,0x2f,0xc1,0x28,0xb7,0x4e,0xae,0x91,0x66,0x7c,0x59,0x4c,0x23,0x7e,0xc8,0xb4,0x85,0x0a,0x3d,0x9d,0x88,0x64,0xe7,0xfa,0x4a,0x35,0x0c,0xc9,0xe2,0xda,0x1d,0x9e,0x6a,0x0c,0x07,0x1e,0x87,0x0a,0x89,0x89,0xbc,0x4b,0x99,0xb5,0x01,0x33,0x60,0x42,0xdd,0x5b,0x3a,0xae,0x6b,0x73,0x3c,0x9e,0xd5,0x19,0xe2,0xad,0x61,0x0d,0x64,0xd4,0x85,0x26,0x0f,0x30,0xe7,0x3e},
+    {0xb7,0xd6,0x7d,0x9e,0xe4,0x55,0xd2,0xf5,0xac,0x1e,0x0b,0x61,0x5c,0x11,0x16,0x80,0xca,0x87,0xe1,0x92,0x5d,0x97,0x99,0x3c,0xc2,0x25,0x91,0x97,0x62,0x57,0x81,0x13,0x18,0x75,0x1e,0x84,0x47,0x79,0xfa,0x43,0xd7,0x46,0x9c,0x63,0x59,0xfa,0xc6,0xe5,0x74,0x2b,0x05,0xe3,0x1d,0x5e,0x06,0xa1,0x30,0x90,0xb8,0xcf,0xa2,0xc6,0x47,0x7d,0xe0,0xd6,0xf0,0x8e,0x14,0xd0,0xda,0x3f,0x3c,0x6f,0x54,0x91,0x9a,0x74,0x3e,0x9d,0x57,0x81,0xbb,0x26,0x10,0x62,0xec,0x71,0x80,0xec,0xc9,0x34,0x8d,0xf5,0x8c,0x14},
+    {0x27,0xf0,0x34,0x79,0xf6,0x92,0xa4,0x46,0xa9,0x0a,0x84,0xf6,0xbe,0x84,0x99,0x46,0x54,0x18,0x61,0x89,0x2a,0xbc,0xa1,0x5c,0xd4,0xbb,0x5d,0xbd,0x1e,0xfa,0xf2,0x3f,0x6d,0x75,0xe4,0x9a,0x7d,0x2f,0x57,0xe2,0x7f,0x48,0xf3,0x88,0xbb,0x45,0xc3,0x56,0x8d,0xa8,0x60,0x69,0x6d,0x0b,0xd1,0x9f,0xb9,0xa1,0xae,0x4e,0xad,0xeb,0x8f,0x27,0x66,0x39,0x93,0x8c,0x1f,0x68,0xaa,0xb1,0x98,0x0c,0x29,0x20,0x9c,0x94,0x21,0x8c,0x52,0x3c,0x9d,0x21,0x91,0x52,0x11,0x39,0x7b,0x67,0x9c,0xfe,0x02,0xdd,0x04,0x41},
+    {0x2a,0x42,0x24,0x11,0x5e,0xbf,0xb2,0x72,0xb5,0x3a,0xa3,0x98,0x33,0x0c,0xfa,0xa1,0x66,0xb6,0x52,0xfa,0x01,0x61,0xcb,0x94,0xd5,0x53,0xaf,0xaf,0x00,0x3b,0x86,0x2c,0xb8,0x6a,0x09,0xdb,0x06,0x4e,0x21,0x81,0x35,0x4f,0xe4,0x0c,0xc9,0xb6,0xa8,0x21,0xf5,0x2a,0x9e,0x40,0x2a,0xc1,0x24,0x65,0x81,0xa4,0xfc,0x8e,0xa4,0xb5,0x65,0x01,0x76,0x6a,0x84,0xa0,0x74,0xa4,0x90,0xf1,0xc0,0x7c,0x2f,0xcd,0x84,0xf9,0xef,0x12,0x8f,0x2b,0xaa,0x58,0x06,0x29,0x5e,0x69,0xb8,0xc8,0xfe,0xbf,0xd9,0x67,0x1b,0x59},
+    {0xfa,0x9b,0xb4,0x80,0x1c,0x0d,0x2f,0x31,0x8a,0xec,0xf3,0xab,0x5e,0x51,0x79,0x59,0x88,0x1c,0xf0,0x9e,0xc0,0x33,0x70,0x72,0xcb,0x7b,0x8f,0xca,0xc7,0x2e,0xe0,0x3d,0x5d,0xb5,0x18,0x9f,0x71,0xb3,0xb9,0x99,0x1e,0x64,0x8c,0xa1,0xfa,0xe5,0x65,0xe4,0xed,0x05,0x9f,0xc2,0x36,0x11,0x08,0x61,0x8b,0x12,0x30,0x70,0x86,0x4f,0x9b,0x48,0xef,0x92,0xeb,0x3a,0x2d,0x10,0x32,0xd2,0x61,0xa8,0x16,0x61,0xb4,0x53,0x62,0xe1,0x24,0xaa,0x0b,0x19,0xe7,0xab,0x7e,0x3d,0xbf,0xbe,0x6c,0x49,0xba,0xfb,0xf5,0x49},
+    {0xd4,0xcf,0x5b,0x8a,0x10,0x9a,0x94,0x30,0xeb,0x73,0x64,0xbc,0x70,0xdd,0x40,0xdc,0x1c,0x0d,0x7c,0x30,0xc1,0x94,0xc2,0x92,0x74,0x6e,0xfa,0xcb,0x6d,0xa8,0x04,0x56,0x2e,0x57,0x9c,0x1e,0x8c,0x62,0x5d,0x15,0x41,0x47,0x88,0xc5,0xac,0x86,0x4d,0x8a,0xeb,0x63,0x57,0x51,0xf6,0x52,0xa3,0x91,0x5b,0x51,0x67,0x88,0xc2,0xa6,0xa1,0x06,0xb6,0x64,0x17,0x7c,0xd4,0xd1,0x88,0x72,0x51,0x8b,0x41,0xe0,0x40,0x11,0x54,0x72,0xd1,0xf6,0xac,0x18,0x60,0x1a,0x03,0x9f,0xc6,0x42,0x27,0xfe,0x89,0x9e,0x98,0x20},
+    {0x7f,0xcc,0x2d,0x3a,0xfd,0x77,0x97,0x49,0x92,0xd8,0x4f,0xa5,0x2c,0x7c,0x85,0x32,0xa0,0xe3,0x07,0xd2,0x64,0xd8,0x79,0xa2,0x29,0x7e,0xa6,0x0c,0x1d,0xed,0x03,0x04,0x2e,0xec,0xea,0x85,0x8b,0x27,0x74,0x16,0xdf,0x2b,0xcb,0x7a,0x07,0xdc,0x21,0x56,0x5a,0xf4,0xcb,0x61,0x16,0x4c,0x0a,0x64,0xd3,0x95,0x05,0xf7,0x50,0x99,0x0b,0x73,0x52,0xc5,0x4e,0x87,0x35,0x2d,0x4b,0xc9,0x8d,0x6f,0x24,0x98,0xcf,0xc8,0xe6,0xc5,0xce,0x35,0xc0,0x16,0xfa,0x46,0xcb,0xf7,0xcc,0x3d,0x30,0x08,0x43,0x45,0xd7,0x5b},
+    {0xc2,0x4c,0xb2,0x28,0x95,0xd1,0x9a,0x7f,0x81,0xc1,0x35,0x63,0x65,0x54,0x6b,0x7f,0x36,0x72,0xc0,0x4f,0x6e,0xb6,0xb8,0x66,0x83,0xad,0x80,0x73,0x00,0x78,0x3a,0x13,0x2a,0x79,0xe7,0x15,0x21,0x93,0xc4,0x85,0xc9,0xdd,0xcd,0xbd,0xa2,0x89,0x4c,0xc6,0x62,0xd7,0xa3,0xad,0xa8,0x3d,0x1e,0x9d,0x2c,0xf8,0x67,0x30,0x12,0xdb,0xb7,0x5b,0xbe,0x62,0xca,0xc6,0x67,0xf4,0x61,0x09,0xee,0x52,0x19,0x21,0xd6,0x21,0xec,0x04,0x70,0x47,0xd5,0x9b,0x77,0x60,0x23,0x18,0xd2,0xe0,0xf0,0x58,0x6d,0xca,0x0d,0x74},
+    {0x4e,0xce,0xcf,0x52,0x07,0xee,0x48,0xdf,0xb7,0x08,0xec,0x06,0xf3,0xfa,0xff,0xc3,0xc4,0x59,0x54,0xb9,0x2a,0x0b,0x71,0x05,0x8d,0xa3,0x3e,0x96,0xfa,0x25,0x1d,0x16,0x3c,0x43,0x78,0x04,0x57,0x8c,0x1a,0x23,0x9d,0x43,0x81,0xc2,0x0e,0x27,0xb5,0xb7,0x9f,0x07,0xd9,0xe3,0xea,0x99,0xaa,0xdb,0xd9,0x03,0x2b,0x6c,0x25,0xf5,0x03,0x2c,0x7d,0xa4,0x53,0x7b,0x75,0x18,0x0f,0x79,0x79,0x58,0x0c,0xcf,0x30,0x01,0x7b,0x30,0xf9,0xf7,0x7e,0x25,0x77,0x3d,0x90,0x31,0xaf,0xbb,0x96,0xbd,0xbd,0x68,0x94,0x69},
+    {0xcf,0xfe,0xda,0xf4,0x46,0x2f,0x1f,0xbd,0xf7,0xd6,0x7f,0xa4,0x14,0x01,0xef,0x7c,0x7f,0xb3,0x47,0x4a,0xda,0xfd,0x1f,0xd3,0x85,0x57,0x90,0x73,0xa4,0x19,0x52,0x52,0x48,0x19,0xa9,0x6a,0xe6,0x3d,0xdd,0xd8,0xcc,0xd2,0xc0,0x2f,0xc2,0x64,0x50,0x48,0x2f,0xea,0xfd,0x34,0x66,0x24,0x48,0x9b,0x3a,0x2e,0x4a,0x6c,0x4e,0x1c,0x3e,0x29,0xe1,0x12,0x51,0x92,0x4b,0x13,0x6e,0x37,0xa0,0x5d,0xa1,0xdc,0xb5,0x78,0x37,0x70,0x11,0x31,0x1c,0x46,0xaf,0x89,0x45,0xb0,0x23,0x28,0x03,0x7f,0x44,0x5c,0x60,0x5b},
+    {0x89,0x7c,0xc4,0x20,0x59,0x80,0x65,0xb9,0xcc,0x8f,0x3b,0x92,0x0c,0x10,0xf0,0xe7,0x77,0xef,0xe2,0x02,0x65,0x25,0x01,0x00,0xee,0xb3,0xae,0xa8,0xce,0x6d,0xa7,0x24,0x4c,0xf0,0xe7,0xf0,0xc6,0xfe,0xe9,0x3b,0x62,0x49,0xe3,0x75,0x9e,0x57,0x6a,0x86,0x1a,0xe6,0x1d,0x1e,0x16,0xef,0x42,0x55,0xd5,0xbd,0x5a,0xcc,0xf4,0xfe,0x12,0x2f,0x40,0xc7,0xc0,0xdf,0xb2,0x22,0x45,0x0a,0x07,0xa4,0xc9,0x40,0x7f,0x6e,0xd0,0x10,0x68,0xf6,0xcf,0x78,0x41,0x14,0xcf,0xc6,0x90,0x37,0xa4,0x18,0x25,0x7b,0x60,0x5e},
+    {0x18,0x18,0xdf,0x6c,0x8f,0x1d,0xb3,0x58,0xa2,0x58,0x62,0xc3,0x4f,0xa7,0xcf,0x35,0x6e,0x1d,0xe6,0x66,0x4f,0xff,0xb3,0xe1,0xf7,0xd5,0xcd,0x6c,0xab,0xac,0x67,0x50,0x14,0xcf,0x96,0xa5,0x1c,0x43,0x2c,0xa0,0x00,0xe4,0xd3,0xae,0x40,0x2d,0xc4,0xe3,0xdb,0x26,0x0f,0x2e,0x80,0x26,0x45,0xd2,0x68,0x70,0x45,0x9e,0x13,0x33,0x1f,0x20,0x51,0x9d,0x03,0x08,0x6b,0x7f,0x52,0xfd,0x06,0x00,0x7c,0x01,0x64,0x49,0xb1,0x18,0xa8,0xa4,0x25,0x2e,0xb0,0x0e,0x22,0xd5,0x75,0x03,0x46,0x62,0x88,0xba,0x7c,0x39},
+    {0xb2,0x59,0x59,0xf0,0x93,0x30,0xc1,0x30,0x76,0x79,0xa9,0xe9,0x8d,0xa1,0x3a,0xe2,0x26,0x5e,0x1d,0x72,0x91,0xd4,0x2f,0x22,0x3a,0x6c,0x6e,0x76,0x20,0xd3,0x39,0x23,0xe7,0x79,0x13,0xc8,0xfb,0xc3,0x15,0x78,0xf1,0x2a,0xe1,0xdd,0x20,0x94,0x61,0xa6,0xd5,0xfd,0xa8,0x85,0xf8,0xc0,0xa9,0xff,0x52,0xc2,0xe1,0xc1,0x22,0x40,0x1b,0x77,0xa7,0x2f,0x3a,0x51,0x86,0xd9,0x7d,0xd8,0x08,0xcf,0xd4,0xf9,0x71,0x9b,0xac,0xf5,0xb3,0x83,0xa2,0x1e,0x1b,0xc3,0x6b,0xd0,0x76,0x1a,0x97,0x19,0x92,0x18,0x1a,0x33},
+    {0xc6,0x80,0x4f,0xfb,0x45,0x6f,0x16,0xf5,0xcf,0x75,0xc7,0x61,0xde,0xc7,0x36,0x9c,0x1c,0xd9,0x41,0x90,0x1b,0xe8,0xd4,0xe3,0x21,0xfe,0xbd,0x83,0x6b,0x7c,0x16,0x31,0xaf,0x72,0x75,0x9d,0x3a,0x2f,0x51,0x26,0x9e,0x4a,0x07,0x68,0x88,0xe2,0xcb,0x5b,0xc4,0xf7,0x80,0x11,0xc1,0xc1,0xed,0x84,0x7b,0xa6,0x49,0xf6,0x9f,0x61,0xc9,0x1a,0x68,0x10,0x4b,0x52,0x42,0x38,0x2b,0xf2,0x87,0xe9,0x9c,0xee,0x3b,0x34,0x68,0x50,0xc8,0x50,0x62,0x4a,0x84,0x71,0x9d,0xfc,0x11,0xb1,0x08,0x1f,0x34,0x36,0x24,0x61},
+    {0x8d,0x89,0x4e,0x87,0xdb,0x41,0x9d,0xd9,0x20,0xdc,0x07,0x6c,0xf1,0xa5,0xfe,0x09,0xbc,0x9b,0x0f,0xd0,0x67,0x2c,0x3d,0x79,0x40,0xff,0x5e,0x9e,0x30,0xe2,0xeb,0x46,0x38,0x26,0x2d,0x1a,0xe3,0x49,0x63,0x8b,0x35,0xfd,0xd3,0x9b,0x00,0xb7,0xdf,0x9d,0xa4,0x6b,0xa0,0xa3,0xb8,0xf1,0x8b,0x7f,0x45,0x04,0xd9,0x78,0x31,0xaa,0x22,0x15,0x38,0x49,0x61,0x69,0x53,0x2f,0x38,0x2c,0x10,0x6d,0x2d,0xb7,0x9a,0x40,0xfe,0xda,0x27,0xf2,0x46,0xb6,0x91,0x33,0xc8,0xe8,0x6c,0x30,0x24,0x05,0xf5,0x70,0xfe,0x45},
+    {0x8c,0x0b,0x0c,0x96,0xa6,0x75,0x48,0xda,0x20,0x2f,0x0e,0xef,0x76,0xd0,0x68,0x5b,0xd4,0x8f,0x0b,0x3d,0xcf,0x51,0xfb,0x07,0xd4,0x92,0xe3,0xa0,0x23,0x16,0x8d,0x42,0x91,0x14,0x95,0xc8,0x20,0x49,0xf2,0x62,0xa2,0x0c,0x63,0x3f,0xc8,0x07,0xf0,0x05,0xb8,0xd4,0xc9,0xf5,0xd2,0x45,0xbb,0x6f,0x45,0x22,0x7a,0xb5,0x6d,0x9f,0x61,0x16,0xfd,0x08,0xa3,0x01,0x44,0x4a,0x4f,0x08,0xac,0xca,0xa5,0x76,0xc3,0x19,0x22,0xa8,0x7d,0xbc,0xd1,0x43,0x46,0xde,0xb8,0xde,0xc6,0x38,0xbd,0x60,0x2d,0x59,0x81,0x1d},
+    {0x5f,0xac,0x0d,0xa6,0x56,0x87,0x36,0x61,0x57,0xdc,0xab,0xeb,0x6a,0x2f,0xe0,0x17,0x7d,0x0f,0xce,0x4c,0x2d,0x3f,0x19,0x7f,0xf0,0xdc,0xec,0x89,0x77,0x4a,0x23,0x20,0xe8,0xc5,0x85,0x7b,0x9f,0xb6,0x65,0x87,0xb2,0xba,0x68,0xd1,0x8b,0x67,0xf0,0x6f,0x9b,0x0f,0x33,0x1d,0x7c,0xe7,0x70,0x3a,0x7c,0x8e,0xaf,0xb0,0x51,0x6d,0x5f,0x3a,0x52,0xb2,0x78,0x71,0xb6,0x0d,0xd2,0x76,0x60,0xd1,0x1e,0xd5,0xf9,0x34,0x1c,0x07,0x70,0x11,0xe4,0xb3,0x20,0x4a,0x2a,0xf6,0x66,0xe3,0xff,0x3c,0x35,0x82,0xd6,0x7c},
+    {0xb6,0xfa,0x87,0xd8,0x5b,0xa4,0xe1,0x0b,0x6e,0x3b,0x40,0xba,0x32,0x6a,0x84,0x2a,0x00,0x60,0x6e,0xe9,0x12,0x10,0x92,0xd9,0x43,0x09,0xdc,0x3b,0x86,0xc8,0x38,0x28,0xf3,0xf4,0xac,0x68,0x60,0xcd,0x65,0xa6,0xd3,0xe3,0xd7,0x3c,0x18,0x2d,0xd9,0x42,0xd9,0x25,0x60,0x33,0x9d,0x38,0x59,0x57,0xff,0xd8,0x2c,0x2b,0x3b,0x25,0xf0,0x3e,0x30,0x50,0x46,0x4a,0xcf,0xb0,0x6b,0xd1,0xab,0x77,0xc5,0x15,0x41,0x6b,0x49,0xfa,0x9d,0x41,0xab,0xf4,0x8a,0xae,0xcf,0x82,0x12,0x28,0xa8,0x06,0xa6,0xb8,0xdc,0x21},
+    {0xc8,0x9f,0x9d,0x8c,0x46,0x04,0x60,0x5c,0xcb,0xa3,0x2a,0xd4,0x6e,0x09,0x40,0x25,0x9c,0x2f,0xee,0x12,0x4c,0x4d,0x5b,0x12,0xab,0x1d,0xa3,0x94,0x81,0xd0,0xc3,0x0b,0xba,0x31,0x77,0xbe,0xfa,0x00,0x8d,0x9a,0x89,0x18,0x9e,0x62,0x7e,0x60,0x03,0x82,0x7f,0xd9,0xf3,0x43,0x37,0x02,0xcc,0xb2,0x8b,0x67,0x6f,0x6c,0xbf,0x0d,0x84,0x5d,0x8b,0xe1,0x9f,0x30,0x0d,0x38,0x6e,0x70,0xc7,0x65,0xe1,0xb9,0xa6,0x2d,0xb0,0x6e,0xab,0x20,0xae,0x7d,0x99,0xba,0xbb,0x57,0xdd,0x96,0xc1,0x2a,0x23,0x76,0x42,0x3a},
+    {0xfa,0x84,0x70,0x8a,0x2c,0x43,0x42,0x4b,0x45,0xe5,0xb9,0xdf,0xe3,0x19,0x8a,0x89,0x5d,0xe4,0x58,0x9c,0x21,0x00,0x9f,0xbe,0xd1,0xeb,0x6d,0xa1,0xce,0x77,0xf1,0x1f,0xcb,0x7e,0x44,0xdb,0x72,0xc1,0xf8,0x3b,0xbd,0x2d,0x28,0xc6,0x1f,0xc4,0xcf,0x5f,0xfe,0x15,0xaa,0x75,0xc0,0xff,0xac,0x80,0xf9,0xa9,0xe1,0x24,0xe8,0xc9,0x70,0x07,0xfd,0xb5,0xb5,0x45,0x9a,0xd9,0x61,0xcf,0x24,0x79,0x3a,0x1b,0xe9,0x84,0x09,0x86,0x89,0x3e,0x3e,0x30,0x19,0x09,0x30,0xe7,0x1e,0x0b,0x50,0x41,0xfd,0x64,0xf2,0x39},
+    {0x9c,0xe2,0xe7,0xdb,0x17,0x34,0xad,0xa7,0x9c,0x13,0x9c,0x2b,0x6a,0x37,0x94,0xbd,0xa9,0x7b,0x59,0x93,0x8e,0x1b,0xe9,0xa0,0x40,0x98,0x88,0x68,0x34,0xd7,0x12,0x17,0xe1,0x7b,0x09,0xfe,0xab,0x4a,0x9b,0xd1,0x29,0x19,0xe0,0xdf,0xe1,0xfc,0x6d,0xa4,0xff,0xf1,0xa6,0x2c,0x94,0x08,0xc9,0xc3,0x4e,0xf1,0x35,0x2c,0x27,0x21,0xc6,0x65,0xdd,0x93,0x31,0xce,0xf8,0x89,0x2b,0xe7,0xbb,0xc0,0x25,0xa1,0x56,0x33,0x10,0x4d,0x83,0xfe,0x1c,0x2e,0x3d,0xa9,0x19,0x04,0x72,0xe2,0x9c,0xb1,0x0a,0x80,0xf9,0x22},
+    {0xcb,0xf8,0x9e,0x3e,0x8a,0x36,0x5a,0x60,0x15,0x47,0x50,0xa5,0x22,0xc0,0xe9,0xe3,0x8f,0x24,0x24,0x5f,0xb0,0x48,0x3d,0x55,0xe5,0x26,0x76,0x64,0xcd,0x16,0xf4,0x13,0xac,0xfd,0x6e,0x9a,0xdd,0x9f,0x02,0x42,0x41,0x49,0xa5,0x34,0xbe,0xce,0x12,0xb9,0x7b,0xf3,0xbd,0x87,0xb9,0x64,0x0f,0x64,0xb4,0xca,0x98,0x85,0xd3,0xa4,0x71,0x41,0x8c,0x4c,0xc9,0x99,0xaa,0x58,0x27,0xfa,0x07,0xb8,0x00,0xb0,0x6f,0x6f,0x00,0x23,0x92,0x53,0xda,0xad,0xdd,0x91,0xd2,0xfb,0xab,0xd1,0x4b,0x57,0xfa,0x14,0x82,0x50},
+    {0x4b,0xfe,0xd6,0x3e,0x15,0x69,0x02,0xc2,0xc4,0x77,0x1d,0x51,0x39,0x67,0x5a,0xa6,0x94,0xaf,0x14,0x2c,0x46,0x26,0xde,0xcb,0x4b,0xa7,0xab,0x6f,0xec,0x60,0xf9,0x22,0xd6,0x03,0xd0,0x53,0xbb,0x15,0x1a,0x46,0x65,0xc9,0xf3,0xbc,0x88,0x28,0x10,0xb2,0x5a,0x3a,0x68,0x6c,0x75,0x76,0xc5,0x27,0x47,0xb4,0x6c,0xc8,0xa4,0x58,0x77,0x3a,0x76,0x50,0xae,0x93,0xf6,0x11,0x81,0x54,0xa6,0x54,0xfd,0x1d,0xdf,0x21,0xae,0x1d,0x65,0x5e,0x11,0xf3,0x90,0x8c,0x24,0x12,0x94,0xf4,0xe7,0x8d,0x5f,0xd1,0x9f,0x5d},
+    {0x7f,0x72,0x63,0x6d,0xd3,0x08,0x14,0x03,0x33,0xb5,0xc7,0xd7,0xef,0x9a,0x37,0x6a,0x4b,0xe2,0xae,0xcc,0xc5,0x8f,0xe1,0xa9,0xd3,0xbe,0x8f,0x4f,0x91,0x35,0x2f,0x33,0x1e,0x52,0xd7,0xee,0x2a,0x4d,0x24,0x3f,0x15,0x96,0x2e,0x43,0x28,0x90,0x3a,0x8e,0xd4,0x16,0x9c,0x2e,0x77,0xba,0x64,0xe1,0xd8,0x98,0xeb,0x47,0xfa,0x87,0xc1,0x3b,0x0c,0xc2,0x86,0xea,0x15,0x01,0x47,0x6d,0x25,0xd1,0x46,0x6c,0xcb,0xb7,0x8a,0x99,0x88,0x01,0x66,0x3a,0xb5,0x32,0x78,0xd7,0x03,0xba,0x6f,0x90,0xce,0x81,0x0d,0x45},
+    {0x75,0x52,0x20,0xa6,0xa1,0xb6,0x7b,0x6e,0x83,0x8e,0x3c,0x41,0xd7,0x21,0x4f,0xaa,0xb2,0x5c,0x8f,0xe8,0x55,0xd1,0x56,0x6f,0xe1,0x5b,0x34,0xa6,0x4b,0x5d,0xe2,0x2d,0x3f,0x74,0xae,0x1c,0x96,0xd8,0x74,0xd0,0xed,0x63,0x1c,0xee,0xf5,0x18,0x6d,0xf8,0x29,0xed,0xf4,0xe7,0x5b,0xc5,0xbd,0x97,0x08,0xb1,0x3a,0x66,0x79,0xd2,0xba,0x4c,0xcd,0x1f,0xd7,0xa0,0x24,0x90,0xd1,0x80,0xf8,0x8a,0x28,0xfb,0x0a,0xc2,0x25,0xc5,0x19,0x64,0x3a,0x5f,0x4b,0x97,0xa3,0xb1,0x33,0x72,0x00,0xe2,0xef,0xbc,0x7f,0x7d},
+    {0x01,0x28,0x6b,0x26,0x6a,0x1e,0xef,0xfa,0x16,0x9f,0x73,0xd5,0xc4,0x68,0x6c,0x86,0x2c,0x76,0x03,0x1b,0xbc,0x2f,0x8a,0xf6,0x8d,0x5a,0xb7,0x87,0x5e,0x43,0x75,0x59,0x94,0x90,0xc2,0xf3,0xc5,0x5d,0x7c,0xcd,0xab,0x05,0x91,0x2a,0x9a,0xa2,0x81,0xc7,0x58,0x30,0x1c,0x42,0x36,0x1d,0xc6,0x80,0xd7,0xd4,0xd8,0xdc,0x96,0xd1,0x9c,0x4f,0x68,0x37,0x7b,0x6a,0xd8,0x97,0x92,0x19,0x63,0x7a,0xd1,0x1a,0x24,0x58,0xd0,0xd0,0x17,0x0c,0x1c,0x5c,0xad,0x9c,0x02,0xba,0x07,0x03,0x7a,0x38,0x84,0xd0,0xcd,0x7c},
+    {0x17,0x04,0x26,0x6d,0x2c,0x42,0xa6,0xdc,0xbd,0x40,0x82,0x94,0x50,0x3d,0x15,0xae,0x77,0xc6,0x68,0xfb,0xb4,0xc1,0xc0,0xa9,0x53,0xcf,0xd0,0x61,0xed,0xd0,0x8b,0x42,0x93,0xcc,0x60,0x67,0x18,0x84,0x0c,0x9b,0x99,0x2a,0xb3,0x1a,0x7a,0x00,0xae,0xcd,0x18,0xda,0x0b,0x62,0x86,0xec,0x8d,0xa8,0x44,0xca,0x90,0x81,0x84,0xca,0x93,0x35,0xa7,0x9a,0x84,0x5e,0x9a,0x18,0x13,0x92,0xcd,0xfa,0xd8,0x65,0x35,0xc3,0xd8,0xd4,0xd1,0xbb,0xfd,0x53,0x5b,0x54,0x52,0x8c,0xe6,0x63,0x2d,0xda,0x08,0x83,0x39,0x27},
+    {0x13,0xd4,0x5e,0x43,0x28,0x8d,0xc3,0x42,0xc9,0xcc,0x78,0x32,0x60,0xf3,0x50,0xbd,0xef,0x03,0xda,0x79,0x1a,0xab,0x07,0xbb,0x55,0x33,0x8c,0xbe,0xae,0x97,0x95,0x26,0x53,0x24,0x70,0x0a,0x4c,0x0e,0xa1,0xb9,0xde,0x1b,0x7d,0xd5,0x66,0x58,0xa2,0x0f,0xf7,0xda,0x27,0xcd,0xb5,0xd9,0xb9,0xff,0xfd,0x33,0x2c,0x49,0x45,0x29,0x2c,0x57,0xbe,0x30,0xcd,0xd6,0x45,0xc7,0x7f,0xc7,0xfb,0xae,0xba,0xe3,0xd3,0xe8,0xdf,0xe4,0x0c,0xda,0x5d,0xaa,0x30,0x88,0x2c,0xa2,0x80,0xca,0x5b,0xc0,0x98,0x54,0x98,0x7f},
+    {0x17,0xe1,0x0b,0x9f,0x88,0xce,0x49,0x38,0x88,0xa2,0x54,0x7b,0x1b,0xad,0x05,0x80,0x1c,0x92,0xfc,0x23,0x9f,0xc3,0xa3,0x3d,0x04,0xf3,0x31,0x0a,0x47,0xec,0xc2,0x76,0x63,0x63,0xbf,0x0f,0x52,0x15,0x56,0xd3,0xa6,0xfb,0x4d,0xcf,0x45,0x5a,0x04,0x08,0xc2,0xa0,0x3f,0x87,0xbc,0x4f,0xc2,0xee,0xe7,0x12,0x9b,0xd6,0x3c,0x65,0xf2,0x30,0x85,0x0c,0xc1,0xaa,0x38,0xc9,0x08,0x8a,0xcb,0x6b,0x27,0xdb,0x60,0x9b,0x17,0x46,0x70,0xac,0x6f,0x0e,0x1e,0xc0,0x20,0xa9,0xda,0x73,0x64,0x59,0xf1,0x73,0x12,0x2f},
+    {0x11,0x1e,0xe0,0x8a,0x7c,0xfc,0x39,0x47,0x9f,0xab,0x6a,0x4a,0x90,0x74,0x52,0xfd,0x2e,0x8f,0x72,0x87,0x82,0x8a,0xd9,0x41,0xf2,0x69,0x5b,0xd8,0x2a,0x57,0x9e,0x5d,0xc0,0x0b,0xa7,0x55,0xd7,0x8b,0x48,0x30,0xe7,0x42,0xd4,0xf1,0xa4,0xb5,0xd6,0x06,0x62,0x61,0x59,0xbc,0x9e,0xa6,0xd1,0xea,0x84,0xf7,0xc5,0xed,0x97,0x19,0xac,0x38,0x3b,0xb1,0x51,0xa7,0x17,0xb5,0x66,0x06,0x8c,0x85,0x9b,0x7e,0x86,0x06,0x7d,0x74,0x49,0xde,0x4d,0x45,0x11,0xc0,0xac,0xac,0x9c,0xe6,0xe9,0xbf,0x9c,0xcd,0xdf,0x22},
+    {0xd9,0x0c,0x0d,0xc3,0xe0,0xd2,0xdb,0x8d,0x33,0x43,0xbb,0xac,0x5f,0x66,0x8e,0xad,0x1f,0x96,0x2a,0x32,0x8c,0x25,0x6b,0x8f,0xc7,0xc1,0x48,0x54,0xc0,0x16,0x29,0x6b,0xa1,0xe0,0x3b,0x10,0xb4,0x59,0xec,0x56,0x69,0xf9,0x59,0xd2,0xec,0xba,0xe3,0x2e,0x32,0xcd,0xf5,0x13,0x94,0xb2,0x7c,0x79,0x72,0xe4,0xcd,0x24,0x78,0x87,0xe9,0x0f,0x3b,0x91,0xba,0x0a,0xd1,0x34,0xdb,0x7e,0x0e,0xac,0x6d,0x2e,0x82,0xcd,0xa3,0x4e,0x15,0xf8,0x78,0x65,0xff,0x3d,0x08,0x66,0x17,0x0a,0xf0,0x7f,0x30,0x3f,0x30,0x4c},
+    {0x85,0x8c,0xb2,0x17,0xd6,0x3b,0x0a,0xd3,0xea,0x3b,0x77,0x39,0xb7,0x77,0xd3,0xc5,0xbf,0x5c,0x6a,0x1e,0x8c,0xe7,0xc6,0xc6,0xc4,0xb7,0x2a,0x8b,0xf7,0xb8,0x61,0x0d,0x00,0x45,0xd9,0x0d,0x58,0x03,0xfc,0x29,0x93,0xec,0xbb,0x6f,0xa4,0x7a,0xd2,0xec,0xf8,0xa7,0xe2,0xc2,0x5f,0x15,0x0a,0x13,0xd5,0xa1,0x06,0xb7,0x1a,0x15,0x6b,0x41,0xb0,0x36,0xc1,0xe9,0xef,0xd7,0xa8,0x56,0x20,0x4b,0xe4,0x58,0xcd,0xe5,0x07,0xbd,0xab,0xe0,0x57,0x1b,0xda,0x2f,0xe6,0xaf,0xd2,0xe8,0x77,0x42,0xf7,0x2a,0x1a,0x19},
+    {0x31,0x14,0x3c,0xc5,0x4b,0xf7,0x16,0xce,0xde,0xed,0x72,0x20,0xce,0x25,0x97,0x2b,0xe7,0x3e,0xb2,0xb5,0x6f,0xc3,0xb9,0xb8,0x08,0xc9,0x5c,0x0b,0x45,0x0e,0x2e,0x7e,0xfb,0x0e,0x46,0x4f,0x43,0x2b,0xe6,0x9f,0xd6,0x07,0x36,0xa6,0xd4,0x03,0xd3,0xde,0x24,0xda,0xa0,0xb7,0x0e,0x21,0x52,0xf0,0x93,0x5b,0x54,0x00,0xbe,0x7d,0x7e,0x23,0x30,0xb4,0x01,0x67,0xed,0x75,0x35,0x01,0x10,0xfd,0x0b,0x9f,0xe6,0x94,0x10,0x23,0x22,0x7f,0xe4,0x83,0x15,0x0f,0x32,0x75,0xe3,0x55,0x11,0xb1,0x99,0xa6,0xaf,0x71},
+    {0x1d,0xb6,0x53,0x39,0x9b,0x6f,0xce,0x65,0xe6,0x41,0xa1,0xaf,0xea,0x39,0x58,0xc6,0xfe,0x59,0xf7,0xa9,0xfd,0x5f,0x43,0x0f,0x8e,0xc2,0xb1,0xc2,0xe9,0x42,0x11,0x02,0xd6,0x50,0x3b,0x47,0x1c,0x3c,0x42,0xea,0x10,0xef,0x38,0x3b,0x1f,0x7a,0xe8,0x51,0x95,0xbe,0xc9,0xb2,0x5f,0xbf,0x84,0x9b,0x1c,0x9a,0xf8,0x78,0xbc,0x1f,0x73,0x00,0x80,0x18,0xf8,0x48,0x18,0xc7,0x30,0xe4,0x19,0xc1,0xce,0x5e,0x22,0x0c,0x96,0xbf,0xe3,0x15,0xba,0x6b,0x83,0xe0,0xda,0xb6,0x08,0x58,0xe1,0x47,0x33,0x6f,0x4d,0x4c},
+    {0xc9,0x1f,0x7d,0xc1,0xcf,0xec,0xf7,0x18,0x14,0x3c,0x40,0x51,0xa6,0xf5,0x75,0x6c,0xdf,0x0c,0xee,0xf7,0x2b,0x71,0xde,0xdb,0x22,0x7a,0xe4,0xa7,0xaa,0xdd,0x3f,0x19,0x70,0x19,0x8f,0x98,0xfc,0xdd,0x0c,0x2f,0x1b,0xf5,0xb9,0xb0,0x27,0x62,0x91,0x6b,0xbe,0x76,0x91,0x77,0xc4,0xb6,0xc7,0x6e,0xa8,0x9f,0x8f,0xa8,0x00,0x95,0xbf,0x38,0x6f,0x87,0xe8,0x37,0x3c,0xc9,0xd2,0x1f,0x2c,0x46,0xd1,0x18,0x5a,0x1e,0xf6,0xa2,0x76,0x12,0x24,0x39,0x82,0xf5,0x80,0x50,0x69,0x49,0x0d,0xbf,0x9e,0xb9,0x6f,0x6a},
+    {0xeb,0x55,0x08,0x56,0xbb,0xc1,0x46,0x6a,0x9d,0xf0,0x93,0xf8,0x38,0xbb,0x16,0x24,0xc1,0xac,0x71,0x8f,0x37,0x11,0x1d,0xd7,0xea,0x96,0x18,0xa3,0x14,0x69,0xf7,0x75,0xc6,0x23,0xe4,0xb6,0xb5,0x22,0xb1,0xee,0x8e,0xff,0x86,0xf2,0x10,0x70,0x9d,0x93,0x8c,0x5d,0xcf,0x1d,0x83,0x2a,0xa9,0x90,0x10,0xeb,0xc5,0x42,0x9f,0xda,0x6f,0x13,0xd1,0xbd,0x05,0xa3,0xb1,0xdf,0x4c,0xf9,0x08,0x2c,0xf8,0x9f,0x9d,0x4b,0x36,0x0f,0x8a,0x58,0xbb,0xc3,0xa5,0xd8,0x87,0x2a,0xba,0xdc,0xe8,0x0b,0x51,0x83,0x21,0x02},
+    {0x14,0x2d,0xad,0x5e,0x38,0x66,0xf7,0x4a,0x30,0x58,0x7c,0xca,0x80,0xd8,0x8e,0xa0,0x3d,0x1e,0x21,0x10,0xe6,0xa6,0x13,0x0d,0x03,0x6c,0x80,0x7b,0xe1,0x1c,0x07,0x6a,0x7f,0x7a,0x30,0x43,0x01,0x71,0x5a,0x9d,0x5f,0xa4,0x7d,0xc4,0x9e,0xde,0x63,0xb0,0xd3,0x7a,0x92,0xbe,0x52,0xfe,0xbb,0x22,0x6c,0x42,0x40,0xfd,0x41,0xc4,0x87,0x13,0xf8,0x8a,0x97,0x87,0xd1,0xc3,0xd3,0xb5,0x13,0x44,0x0e,0x7f,0x3d,0x5a,0x2b,0x72,0xa0,0x7c,0x47,0xbb,0x48,0x48,0x7b,0x0d,0x92,0xdc,0x1e,0xaf,0x6a,0xb2,0x71,0x31},
+    {0xa8,0x4c,0x56,0x97,0x90,0x31,0x2f,0xa9,0x19,0xe1,0x75,0x22,0x4c,0xb8,0x7b,0xff,0x50,0x51,0x87,0xa4,0x37,0xfe,0x55,0x4f,0x5a,0x83,0xf0,0x3c,0x87,0xd4,0x1f,0x22,0xd1,0x47,0x8a,0xb2,0xd8,0xb7,0x0d,0xa6,0xf1,0xa4,0x70,0x17,0xd6,0x14,0xbf,0xa6,0x58,0xbd,0xdd,0x53,0x93,0xf8,0xa1,0xd4,0xe9,0x43,0x42,0x34,0x63,0x4a,0x51,0x6c,0x41,0x63,0x15,0x3a,0x4f,0x20,0x22,0x23,0x2d,0x03,0x0a,0xba,0xe9,0xe0,0x73,0xfb,0x0e,0x03,0x0f,0x41,0x4c,0xdd,0xe0,0xfc,0xaa,0x4a,0x92,0xfb,0x96,0xa5,0xda,0x48},
+    {0xc7,0x9c,0xa5,0x5c,0x66,0x8e,0xca,0x6e,0xa0,0xac,0x38,0x2e,0x4b,0x25,0x47,0xa8,0xce,0x17,0x1e,0xd2,0x08,0xc7,0xaf,0x31,0xf7,0x4a,0xd8,0xca,0xfc,0xd6,0x6d,0x67,0x93,0x97,0x4c,0xc8,0x5d,0x1d,0xf6,0x14,0x06,0x82,0x41,0xef,0xe3,0xf9,0x41,0x99,0xac,0x77,0x62,0x34,0x8f,0xb8,0xf5,0xcd,0xa9,0x79,0x8a,0x0e,0xfa,0x37,0xc8,0x58,0x58,0x90,0xfc,0x96,0x85,0x68,0xf9,0x0c,0x1b,0xa0,0x56,0x7b,0xf3,0xbb,0xdc,0x1d,0x6a,0xd6,0x35,0x49,0x7d,0xe7,0xc2,0xdc,0x0a,0x7f,0xa5,0xc6,0xf2,0x73,0x4f,0x1c},
+    {0xbb,0xa0,0x5f,0x30,0xbd,0x4f,0x7a,0x0e,0xad,0x63,0xc6,0x54,0xe0,0x4c,0x9d,0x82,0x48,0x38,0xe3,0x2f,0x83,0xc3,0x21,0xf4,0x42,0x4c,0xf6,0x1b,0x0d,0xc8,0x5a,0x79,0x84,0x34,0x7c,0xfc,0x6e,0x70,0x6e,0xb3,0x61,0xcf,0xc1,0xc3,0xb4,0xc9,0xdf,0x73,0xe5,0xc7,0x1c,0x78,0xc9,0x79,0x1d,0xeb,0x5c,0x67,0xaf,0x7d,0xdb,0x9a,0x45,0x70,0xb3,0x2b,0xb4,0x91,0x49,0xdb,0x91,0x1b,0xca,0xdc,0x02,0x4b,0x23,0x96,0x26,0x57,0xdc,0x78,0x8c,0x1f,0xe5,0x9e,0xdf,0x9f,0xd3,0x1f,0xe2,0x8c,0x84,0x62,0xe1,0x5f},
+    {0x1a,0x96,0x94,0xe1,0x4f,0x21,0x59,0x4e,0x4f,0xcd,0x71,0x0d,0xc7,0x7d,0xbe,0x49,0x2d,0xf2,0x50,0x3b,0xd2,0xcf,0x00,0x93,0x32,0x72,0x91,0xfc,0x46,0xd4,0x89,0x47,0x08,0xb2,0x7c,0x5d,0x2d,0x85,0x79,0x28,0xe7,0xf2,0x7d,0x68,0x70,0xdd,0xde,0xb8,0x91,0x78,0x68,0x21,0xab,0xff,0x0b,0xdc,0x35,0xaa,0x7d,0x67,0x43,0xc0,0x44,0x2b,0x8e,0xb7,0x4e,0x07,0xab,0x87,0x1c,0x1a,0x67,0xf4,0xda,0x99,0x8e,0xd1,0xc6,0xfa,0x67,0x90,0x4f,0x48,0xcd,0xbb,0xac,0x3e,0xe4,0xa4,0xb9,0x2b,0xef,0x2e,0xc5,0x60},
+    {0xf1,0x8b,0xfd,0x3b,0xbc,0x89,0x5d,0x0b,0x1a,0x55,0xf3,0xc9,0x37,0x92,0x6b,0xb0,0xf5,0x28,0x30,0xd5,0xb0,0x16,0x4c,0x0e,0xab,0xca,0xcf,0x2c,0x31,0x9c,0xbc,0x10,0x11,0x6d,0xae,0x7c,0xc2,0xc5,0x2b,0x70,0xab,0x8c,0xa4,0x54,0x9b,0x69,0xc7,0x44,0xb2,0x2e,0x49,0xba,0x56,0x40,0xbc,0xef,0x6d,0x67,0xb6,0xd9,0x48,0x72,0xd7,0x70,0x5b,0xa0,0xc2,0x3e,0x4b,0xe8,0x8a,0xaa,0xe0,0x81,0x17,0xed,0xf4,0x9e,0x69,0x98,0xd1,0x85,0x8e,0x70,0xe4,0x13,0x45,0x79,0x13,0xf4,0x76,0xa9,0xd3,0x5b,0x75,0x63},
+    {0x53,0x08,0xd1,0x2a,0x3e,0xa0,0x5f,0xb5,0x69,0x35,0xe6,0x9e,0x90,0x75,0x6f,0x35,0x90,0xb8,0x69,0xbe,0xfd,0xf1,0xf9,0x9f,0x84,0x6f,0xc1,0x8b,0xc4,0xc1,0x8c,0x0d,0xb7,0xac,0xf1,0x97,0x18,0x10,0xc7,0x3d,0xd8,0xbb,0x65,0xc1,0x5e,0x7d,0xda,0x5d,0x0f,0x02,0xa1,0x0f,0x9c,0x5b,0x8e,0x50,0x56,0x2a,0xc5,0x37,0x17,0x75,0x63,0x27,0xa9,0x19,0xb4,0x6e,0xd3,0x02,0x94,0x02,0xa5,0x60,0xb4,0x77,0x7e,0x4e,0xb4,0xf0,0x56,0x49,0x3c,0xd4,0x30,0x62,0xa8,0xcf,0xe7,0x66,0xd1,0x7a,0x8a,0xdd,0xc2,0x70},
+    {0x0e,0xec,0x6f,0x9f,0x50,0x94,0x61,0x65,0x8d,0x51,0xc6,0x46,0xa9,0x7e,0x2e,0xee,0x5c,0x9b,0xe0,0x67,0xf3,0xc1,0x33,0x97,0x95,0x84,0x94,0x63,0x63,0xac,0x0f,0x2e,0x13,0x7e,0xed,0xb8,0x7d,0x96,0xd4,0x91,0x7a,0x81,0x76,0xd7,0x0a,0x2f,0x25,0x74,0x64,0x25,0x85,0x0d,0xe0,0x82,0x09,0xe4,0xe5,0x3c,0xa5,0x16,0x38,0x61,0xb8,0x32,0x64,0xcd,0x48,0xe4,0xbe,0xf7,0xe7,0x79,0xd0,0x86,0x78,0x08,0x67,0x3a,0xc8,0x6a,0x2e,0xdb,0xe4,0xa0,0xd9,0xd4,0x9f,0xf8,0x41,0x4f,0x5a,0x73,0x5c,0x21,0x79,0x41},
+    {0x2a,0xed,0xdc,0xd7,0xe7,0x94,0x70,0x8c,0x70,0x9c,0xd3,0x47,0xc3,0x8a,0xfb,0x97,0x02,0xd9,0x06,0xa9,0x33,0xe0,0x3b,0xe1,0x76,0x9d,0xd9,0x0c,0xa3,0x44,0x03,0x70,0x34,0xcd,0x6b,0x28,0xb9,0x33,0xae,0xe4,0xdc,0xd6,0x9d,0x55,0xb6,0x7e,0xef,0xb7,0x1f,0x8e,0xd3,0xb3,0x1f,0x14,0x8b,0x27,0x86,0xc2,0x41,0x22,0x66,0x85,0xfa,0x31,0xf4,0x22,0x36,0x2e,0x42,0x6c,0x82,0xaf,0x2d,0x50,0x33,0x98,0x87,0x29,0x20,0xc1,0x23,0x91,0x38,0x2b,0xe1,0xb7,0xc1,0x9b,0x89,0x24,0x95,0xa9,0x12,0x23,0xbb,0x24},
+    {0xc3,0x67,0xde,0x32,0x17,0xed,0xa8,0xb1,0x48,0x49,0x1b,0x46,0x18,0x94,0xb4,0x3c,0xd2,0xbc,0xcf,0x76,0x43,0x43,0xbd,0x8e,0x08,0x80,0x18,0x1e,0x87,0x3e,0xee,0x0f,0x6b,0x5c,0xf8,0xf5,0x2a,0x0c,0xf8,0x41,0x94,0x67,0xfa,0x04,0xc3,0x84,0x72,0x68,0xad,0x1b,0xba,0xa3,0x99,0xdf,0x45,0x89,0x16,0x5d,0xeb,0xff,0xf9,0x2a,0x1d,0x0d,0xdf,0x1e,0x62,0x32,0xa1,0x8a,0xda,0xa9,0x79,0x65,0x22,0x59,0xa1,0x22,0xb8,0x30,0x93,0xc1,0x9a,0xa7,0x7b,0x19,0x04,0x40,0x76,0x1d,0x53,0x18,0x97,0xd7,0xac,0x16},
+    {0x3d,0x1d,0x9b,0x2d,0xaf,0x72,0xdf,0x72,0x5a,0x24,0x32,0xa4,0x36,0x2a,0x46,0x63,0x37,0x96,0xb3,0x16,0x79,0xa0,0xce,0x3e,0x09,0x23,0x30,0xb9,0xf6,0x0e,0x3e,0x12,0xad,0xb6,0x87,0x78,0xc5,0xc6,0x59,0xc9,0xba,0xfe,0x90,0x5f,0xad,0x9e,0xe1,0x94,0x04,0xf5,0x42,0xa3,0x62,0x4e,0xe2,0x16,0x00,0x17,0x16,0x18,0x4b,0xd3,0x4e,0x16,0x9a,0xe6,0x2f,0x19,0x4c,0xd9,0x7e,0x48,0x13,0x15,0x91,0x3a,0xea,0x2c,0xae,0x61,0x27,0xde,0xa4,0xb9,0xd3,0xf6,0x7b,0x87,0xeb,0xf3,0x73,0x10,0xc6,0x0f,0xda,0x78},
+    {0x6a,0xc6,0x2b,0xe5,0x28,0x5d,0xf1,0x5b,0x8e,0x1a,0xf0,0x70,0x18,0xe3,0x47,0x2c,0xdd,0x8b,0xc2,0x06,0xbc,0xaf,0x19,0x24,0x3a,0x17,0x6b,0x25,0xeb,0xde,0x25,0x2d,0x94,0x3a,0x0c,0x68,0xf1,0x80,0x9f,0xa2,0xe6,0xe7,0xe9,0x1a,0x15,0x7e,0xf7,0x71,0x73,0x79,0x01,0x48,0x58,0xf1,0x00,0x11,0xdd,0x8d,0xb3,0x16,0xb3,0xa4,0x4a,0x05,0xb8,0x7c,0x26,0x19,0x8d,0x46,0xc8,0xdf,0xaf,0x4d,0xe5,0x66,0x9c,0x78,0x28,0x0b,0x17,0xec,0x6e,0x66,0x2a,0x1d,0xeb,0x2a,0x60,0xa7,0x7d,0xab,0xa6,0x10,0x46,0x13},
+    {0xfe,0xb0,0xf6,0x8d,0xc7,0x8e,0x13,0x51,0x1b,0xf5,0x75,0xe5,0x89,0xda,0x97,0x53,0xb9,0xf1,0x7a,0x71,0x1d,0x7a,0x20,0x09,0x50,0xd6,0x20,0x2b,0xba,0xfd,0x02,0x21,0x15,0xf5,0xd1,0x77,0xe7,0x65,0x2a,0xcd,0xf1,0x60,0xaa,0x8f,0x87,0x91,0x89,0x54,0xe5,0x06,0xbc,0xda,0xbc,0x3b,0xb7,0xb1,0xfb,0xc9,0x7c,0xa9,0xcb,0x78,0x48,0x65,0xa1,0xe6,0x5c,0x05,0x05,0xe4,0x9e,0x96,0x29,0xad,0x51,0x12,0x68,0xa7,0xbc,0x36,0x15,0xa4,0x7d,0xaa,0x17,0xf5,0x1a,0x3a,0xba,0xb2,0xec,0x29,0xdb,0x25,0xd7,0x0a},
+    {0x57,0x24,0x4e,0x83,0xb1,0x67,0x42,0xdc,0xc5,0x1b,0xce,0x70,0xb5,0x44,0x75,0xb6,0xd7,0x5e,0xd1,0xf7,0x0b,0x7a,0xf0,0x1a,0x50,0x36,0xa0,0x71,0xfb,0xcf,0xef,0x4a,0x85,0x6f,0x05,0x9b,0x0c,0xbc,0xc7,0xfe,0xd7,0xff,0xf5,0xe7,0x68,0x52,0x7d,0x53,0xfa,0xae,0x12,0x43,0x62,0xc6,0xaf,0x77,0xd9,0x9f,0x39,0x02,0x53,0x5f,0x67,0x4f,0x1e,0x17,0x15,0x04,0x36,0x36,0x2d,0xc3,0x3b,0x48,0x98,0x89,0x11,0xef,0x2b,0xcd,0x10,0x51,0x94,0xd0,0xad,0x6e,0x0a,0x87,0x61,0x65,0xa8,0xa2,0x72,0xbb,0xcc,0x0b},
+    {0xc8,0xa9,0xb1,0xea,0x2f,0x96,0x5e,0x18,0xcd,0x7d,0x14,0x65,0x35,0xe6,0xe7,0x86,0xf2,0x6d,0x5b,0xbb,0x31,0xe0,0x92,0xb0,0x3e,0xb7,0xd6,0x59,0xab,0xf0,0x24,0x40,0x96,0x12,0xfe,0x50,0x4c,0x5e,0x6d,0x18,0x7e,0x9f,0xe8,0xfe,0x82,0x7b,0x39,0xe0,0xb0,0x31,0x70,0x50,0xc5,0xf6,0xc7,0x3b,0xc2,0x37,0x8f,0x10,0x69,0xfd,0x78,0x66,0xc2,0x63,0x68,0x63,0x31,0xfa,0x86,0x15,0xf2,0x33,0x2d,0x57,0x48,0x8c,0xf6,0x07,0xfc,0xae,0x9e,0x78,0x9f,0xcc,0x73,0x4f,0x01,0x47,0xad,0x8e,0x10,0xe2,0x42,0x2d},
+    {0x9b,0xd2,0xdf,0x94,0x15,0x13,0xf5,0x97,0x6a,0x4c,0x3f,0x31,0x5d,0x98,0x55,0x61,0x10,0x50,0x45,0x08,0x07,0x3f,0xa1,0xeb,0x22,0xd3,0xd2,0xb8,0x08,0x26,0x6b,0x67,0x93,0x75,0x53,0x0f,0x0d,0x7b,0x71,0x21,0x4c,0x06,0x1e,0x13,0x0b,0x69,0x4e,0x91,0x9f,0xe0,0x2a,0x75,0xae,0x87,0xb6,0x1b,0x6e,0x3c,0x42,0x9b,0xa7,0xf3,0x0b,0x42,0x47,0x2b,0x5b,0x1c,0x65,0xba,0x38,0x81,0x80,0x1b,0x1b,0x31,0xec,0xb6,0x71,0x86,0xb0,0x35,0x31,0xbc,0xb1,0x0c,0xff,0x7b,0xe0,0xf1,0x0c,0x9c,0xfa,0x2f,0x5d,0x74},
+    {0xbd,0xc8,0xc9,0x2b,0x1e,0x5a,0x52,0xbf,0x81,0x9d,0x47,0x26,0x08,0x26,0x5b,0xea,0xdb,0x55,0x01,0xdf,0x0e,0xc7,0x11,0xd5,0xd0,0xf5,0x0c,0x96,0xeb,0x3c,0xe2,0x1a,0x6a,0x4e,0xd3,0x21,0x57,0xdf,0x36,0x60,0xd0,0xb3,0x7b,0x99,0x27,0x88,0xdb,0xb1,0xfa,0x6a,0x75,0xc8,0xc3,0x09,0xc2,0xd3,0x39,0xc8,0x1d,0x4c,0xe5,0x5b,0xe1,0x06,0x4a,0x99,0x32,0x19,0x87,0x5d,0x72,0x5b,0xb0,0xda,0xb1,0xce,0xb5,0x1c,0x35,0x32,0x05,0xca,0xb7,0xda,0x49,0x15,0xc4,0x7d,0xf7,0xc1,0x8e,0x27,0x61,0xd8,0xde,0x58},
+    {0x5c,0xc5,0x66,0xf2,0x93,0x37,0x17,0xd8,0x49,0x4e,0x45,0xcc,0xc5,0x76,0xc9,0xc8,0xa8,0xc3,0x26,0xbc,0xf8,0x82,0xe3,0x5c,0xf9,0xf6,0x85,0x54,0xe8,0x9d,0xf3,0x2f,0xa8,0xc9,0xc2,0xb6,0xa8,0x5b,0xfb,0x2d,0x8c,0x59,0x2c,0xf5,0x8e,0xef,0xee,0x48,0x73,0x15,0x2d,0xf1,0x07,0x91,0x80,0x33,0xd8,0x5b,0x1d,0x53,0x6b,0x69,0xba,0x08,0x7a,0xc5,0xef,0xc3,0xee,0x3e,0xed,0x77,0x11,0x48,0xff,0xd4,0x17,0x55,0xe0,0x04,0xcb,0x71,0xa6,0xf1,0x3f,0x7a,0x3d,0xea,0x54,0xfe,0x7c,0x94,0xb4,0x33,0x06,0x12},
+    {0x42,0x00,0x61,0x91,0x78,0x98,0x94,0x0b,0xe8,0xfa,0xeb,0xec,0x3c,0xb1,0xe7,0x4e,0xc0,0xa4,0xf0,0x94,0x95,0x73,0xbe,0x70,0x85,0x91,0xd5,0xb4,0x99,0x0a,0xd3,0x35,0x0a,0x10,0x12,0x49,0x47,0x31,0xbd,0x82,0x06,0xbe,0x6f,0x7e,0x6d,0x7b,0x23,0xde,0xc6,0x79,0xea,0x11,0x19,0x76,0x1e,0xe1,0xde,0x3b,0x39,0xcb,0xe3,0x3b,0x43,0x07,0xf4,0x97,0xe9,0x5c,0xc0,0x44,0x79,0xff,0xa3,0x51,0x5c,0xb0,0xe4,0x3d,0x5d,0x57,0x7c,0x84,0x76,0x5a,0xfd,0x81,0x33,0x58,0x9f,0xda,0xf6,0x7a,0xde,0x3e,0x87,0x2d},
+    {0x09,0x34,0x37,0x43,0x64,0x31,0x7a,0x15,0xd9,0x81,0xaa,0xf4,0xee,0xb7,0xb8,0xfa,0x06,0x48,0xa6,0xf5,0xe6,0xfe,0x93,0xb0,0xb6,0xa7,0x7f,0x70,0x54,0x36,0x77,0x2e,0x81,0xf9,0x5d,0x4e,0xe1,0x02,0x62,0xaa,0xf5,0xe1,0x15,0x50,0x17,0x59,0x0d,0xa2,0x6c,0x1d,0xe2,0xba,0xd3,0x75,0xa2,0x18,0x53,0x02,0x60,0x01,0x8a,0x61,0x43,0x05,0xc1,0x23,0x4c,0x97,0xf4,0xbd,0xea,0x0d,0x93,0x46,0xce,0x9d,0x25,0x0a,0x6f,0xaa,0x2c,0xba,0x9a,0xa2,0xb8,0x2c,0x20,0x04,0x0d,0x96,0x07,0x2d,0x36,0x43,0x14,0x4b},
+    {0x7a,0x1f,0x6e,0xb6,0xc7,0xb7,0xc4,0xcc,0x7e,0x2f,0x0c,0xf5,0x25,0x7e,0x15,0x44,0x1c,0xaf,0x3e,0x71,0xfc,0x6d,0xf0,0x3e,0xf7,0x63,0xda,0x52,0x67,0x44,0x2f,0x58,0xcb,0x9c,0x52,0x1c,0xe9,0x54,0x7c,0x96,0xfb,0x35,0xc6,0x64,0x92,0x26,0xf6,0x30,0x65,0x19,0x12,0x78,0xf4,0xaf,0x47,0x27,0x5c,0x6f,0xf6,0xea,0x18,0x84,0x03,0x17,0xe4,0x4c,0x32,0x20,0xd3,0x7b,0x31,0xc6,0xc4,0x8b,0x48,0xa4,0xe8,0x42,0x10,0xa8,0x64,0x13,0x5a,0x4e,0x8b,0xf1,0x1e,0xb2,0xc9,0x8d,0xa2,0xcd,0x4b,0x1c,0x2a,0x0c},
+    {0x47,0x04,0x1f,0x6f,0xd0,0xc7,0x4d,0xd2,0x59,0xc0,0x87,0xdb,0x3e,0x9e,0x26,0xb2,0x8f,0xd2,0xb2,0xfb,0x72,0x02,0x5b,0xd1,0x77,0x48,0xf6,0xc6,0xd1,0x8b,0x55,0x7c,0x45,0x69,0xbd,0x69,0x48,0x81,0xc4,0xed,0x22,0x8d,0x1c,0xbe,0x7d,0x90,0x6d,0x0d,0xab,0xc5,0x5c,0xd5,0x12,0xd2,0x3b,0xc6,0x83,0xdc,0x14,0xa3,0x30,0x9b,0x6a,0x5a,0x3d,0x46,0x96,0xd3,0x24,0x15,0xec,0xd0,0xf0,0x24,0x5a,0xc3,0x8a,0x62,0xbb,0x12,0xa4,0x5f,0xbc,0x1c,0x79,0x3a,0x0c,0xa5,0xc3,0xaf,0xfb,0x0a,0xca,0xa5,0x04,0x04},
+    {0xd6,0x43,0xa7,0x0a,0x07,0x40,0x1f,0x8c,0xe8,0x5e,0x26,0x5b,0xcb,0xd0,0xba,0xcc,0xde,0xd2,0x8f,0x66,0x6b,0x04,0x4b,0x57,0x33,0x96,0xdd,0xca,0xfd,0x5b,0x39,0x46,0xd1,0x6f,0x41,0x2a,0x1b,0x9e,0xbc,0x62,0x8b,0x59,0x50,0xe3,0x28,0xf7,0xc6,0xb5,0x67,0x69,0x5d,0x3d,0xd8,0x3f,0x34,0x04,0x98,0xee,0xf8,0xe7,0x16,0x75,0x52,0x39,0x9c,0x9a,0x5d,0x1a,0x2d,0xdb,0x7f,0x11,0x2a,0x5c,0x00,0xd1,0xbc,0x45,0x77,0x9c,0xea,0x6f,0xd5,0x54,0xf1,0xbe,0xd4,0xef,0x16,0xd0,0x22,0xe8,0x29,0x9a,0x57,0x76},
+    {0x17,0x2a,0xc0,0x49,0x7e,0x8e,0xb6,0x45,0x7f,0xa3,0xa9,0xbc,0xa2,0x51,0xcd,0x23,0x1b,0x4c,0x22,0xec,0x11,0x5f,0xd6,0x3e,0xb1,0xbd,0x05,0x9e,0xdc,0x84,0xa3,0x43,0xf2,0x34,0xb4,0x52,0x13,0xb5,0x3c,0x33,0xe1,0x80,0xde,0x93,0x49,0x28,0x32,0xd8,0xce,0x35,0x0d,0x75,0x87,0x28,0x51,0xb5,0xc1,0x77,0x27,0x2a,0xbb,0x14,0xc5,0x02,0x45,0xb6,0xf1,0x8b,0xda,0xd5,0x4b,0x68,0x53,0x4b,0xb5,0xf6,0x7e,0xd3,0x8b,0xfb,0x53,0xd2,0xb0,0xa9,0xd7,0x16,0x39,0x31,0x59,0x80,0x54,0x61,0x09,0x92,0x60,0x11},
+    {0xaa,0xcf,0xda,0x29,0x69,0x16,0x4d,0xb4,0x8f,0x59,0x13,0x84,0x4c,0x9f,0x52,0xda,0x59,0x55,0x3d,0x45,0xca,0x63,0xef,0xe9,0x0b,0x8e,0x69,0xc5,0x5b,0x12,0x1e,0x35,0xcd,0x4d,0x9b,0x36,0x16,0x56,0x38,0x7a,0x63,0x35,0x5c,0x65,0xa7,0x2c,0xc0,0x75,0x21,0x80,0xf1,0xd4,0xf9,0x1b,0xc2,0x7d,0x42,0xe0,0xe6,0x91,0x74,0x7d,0x63,0x2f,0xbe,0x7b,0xf6,0x1a,0x46,0x9b,0xb4,0xd4,0x61,0x89,0xab,0xc8,0x7a,0x03,0x03,0xd6,0xfb,0x99,0xa6,0xf9,0x9f,0xe1,0xde,0x71,0x9a,0x2a,0xce,0xe7,0x06,0x2d,0x18,0x7f},
+    {0xec,0x68,0x01,0xab,0x64,0x8e,0x7c,0x7a,0x43,0xc5,0xed,0x15,0x55,0x4a,0x5a,0xcb,0xda,0x0e,0xcd,0x47,0xd3,0x19,0x55,0x09,0xb0,0x93,0x3e,0x34,0x8c,0xac,0xd4,0x67,0x22,0x75,0x21,0x8e,0x72,0x4b,0x45,0x09,0xd8,0xb8,0x84,0xd4,0xf4,0xe8,0x58,0xaa,0x3c,0x90,0x46,0x7f,0x4d,0x25,0x58,0xd3,0x17,0x52,0x1c,0x24,0x43,0xc0,0xac,0x44,0x77,0x57,0x7a,0x4f,0xbb,0x6b,0x7d,0x1c,0xe1,0x13,0x83,0x91,0xd4,0xfe,0x35,0x8b,0x84,0x46,0x6b,0xc9,0xc6,0xa1,0xdc,0x4a,0xbd,0x71,0xad,0x12,0x83,0x1c,0x6d,0x55},
+    {0x82,0x39,0x8d,0x0c,0xe3,0x40,0xef,0x17,0x34,0xfa,0xa3,0x15,0x3e,0x07,0xf7,0x31,0x6e,0x64,0x73,0x07,0xcb,0xf3,0x21,0x4f,0xff,0x4e,0x82,0x1d,0x6d,0x6c,0x6c,0x74,0x21,0xe8,0x1b,0xb1,0x56,0x67,0xf0,0x81,0xdd,0xf3,0xa3,0x10,0x23,0xf8,0xaf,0x0f,0x5d,0x46,0x99,0x6a,0x55,0xd0,0xb2,0xf8,0x05,0x7f,0x8c,0xcc,0x38,0xbe,0x7a,0x09,0xa4,0x2d,0xa5,0x7e,0x87,0xc9,0x49,0x0c,0x43,0x1d,0xdc,0x9b,0x55,0x69,0x43,0x4c,0xd2,0xeb,0xcc,0xf7,0x09,0x38,0x2c,0x02,0xbd,0x84,0xee,0x4b,0xa3,0x14,0x7e,0x57},
+    {0x0a,0x3b,0xa7,0x61,0xac,0x68,0xe2,0xf0,0xf5,0xa5,0x91,0x37,0x10,0xfa,0xfa,0xf2,0xe9,0x00,0x6d,0x6b,0x82,0x3e,0xe1,0xc1,0x42,0x8f,0xd7,0x6f,0xe9,0x7e,0xfa,0x60,0x2b,0xd7,0x4d,0xbd,0xbe,0xce,0xfe,0x94,0x11,0x22,0x0f,0x06,0xda,0x4f,0x6a,0xf4,0xff,0xd1,0xc8,0xc0,0x77,0x59,0x4a,0x12,0x95,0x92,0x00,0xfb,0xb8,0x04,0x53,0x70,0xc6,0x6e,0x29,0x4d,0x35,0x1d,0x3d,0xb6,0xd8,0x31,0xad,0x5f,0x3e,0x05,0xc3,0xf3,0xec,0x42,0xbd,0xb4,0x8c,0x95,0x0b,0x67,0xfd,0x53,0x63,0xa1,0x0c,0x8e,0x39,0x21},
+    {0xf3,0x33,0x2b,0x38,0x8a,0x05,0xf5,0x89,0xb4,0xc0,0x48,0xad,0x0b,0xba,0xe2,0x5a,0x6e,0xb3,0x3d,0xa5,0x03,0xb5,0x93,0x8f,0xe6,0x32,0xa2,0x95,0x9d,0xed,0xa3,0x5a,0x01,0x56,0xb7,0xb4,0xf9,0xaa,0x98,0x27,0x72,0xad,0x8d,0x5c,0x13,0x72,0xac,0x5e,0x23,0xa0,0xb7,0x61,0x61,0xaa,0xce,0xd2,0x4e,0x7d,0x8f,0xe9,0x84,0xb2,0xbf,0x1b,0x61,0x65,0xd9,0xc7,0xe9,0x77,0x67,0x65,0x36,0x80,0xc7,0x72,0x54,0x12,0x2b,0xcb,0xee,0x6e,0x50,0xd9,0x99,0x32,0x05,0x65,0xcc,0x57,0x89,0x5e,0x4e,0xe1,0x07,0x4a},
+    {0x99,0xf9,0x0d,0x98,0xcb,0x12,0xe4,0x4e,0x71,0xc7,0x6e,0x3c,0x6f,0xd7,0x15,0xa3,0xfd,0x77,0x5c,0x92,0xde,0xed,0xa5,0xbb,0x02,0x34,0x31,0x1d,0x39,0xac,0x0b,0x3f,0x9b,0xa4,0x77,0xc4,0xcd,0x58,0x0b,0x24,0x17,0xf0,0x47,0x64,0xde,0xda,0x38,0xfd,0xad,0x6a,0xc8,0xa7,0x32,0x8d,0x92,0x19,0x81,0xa0,0xaf,0x84,0xed,0x7a,0xaf,0x50,0xe5,0x5b,0xf6,0x15,0x01,0xde,0x4f,0x6e,0xb2,0x09,0x61,0x21,0x21,0x26,0x98,0x29,0xd9,0xd6,0xad,0x0b,0x81,0x05,0x02,0x78,0x06,0xd0,0xeb,0xba,0x16,0xa3,0x21,0x19},
+    {0xfc,0x70,0xb8,0xdf,0x7e,0x2f,0x42,0x89,0xbd,0xb3,0x76,0x4f,0xeb,0x6b,0x29,0x2c,0xf7,0x4d,0xc2,0x36,0xd4,0xf1,0x38,0x07,0xb0,0xae,0x73,0xe2,0x41,0xdf,0x58,0x64,0x8b,0xc1,0xf3,0xd9,0x9a,0xad,0x5a,0xd7,0x9c,0xc1,0xb1,0x60,0xef,0x0e,0x6a,0x56,0xd9,0x0e,0x5c,0x25,0xac,0x0b,0x9a,0x3e,0xf5,0xc7,0x62,0xa0,0xec,0x9d,0x04,0x7b,0x83,0x44,0x44,0x35,0x7a,0xe3,0xcb,0xdc,0x93,0xbe,0xed,0x0f,0x33,0x79,0x88,0x75,0x87,0xdd,0xc5,0x12,0xc3,0x04,0x60,0x78,0x64,0x0e,0x95,0xc2,0xcb,0xdc,0x93,0x60},
+    {0x6d,0x70,0xe0,0x85,0x85,0x9a,0xf3,0x1f,0x33,0x39,0xe7,0xb3,0xd8,0xa5,0xd0,0x36,0x3b,0x45,0x8f,0x71,0xe1,0xf2,0xb9,0x43,0x7c,0xa9,0x27,0x48,0x08,0xea,0xd1,0x57,0x4b,0x03,0x84,0x60,0xbe,0xee,0xde,0x6b,0x54,0xb8,0x0f,0x78,0xb6,0xc2,0x99,0x31,0x95,0x06,0x2d,0xb6,0xab,0x76,0x33,0x97,0x90,0x7d,0x64,0x8b,0xc9,0x80,0x31,0x6e,0x71,0xb0,0x28,0xa1,0xe7,0xb6,0x7a,0xee,0xaa,0x8b,0xa8,0x93,0x6d,0x59,0xc1,0xa4,0x30,0x61,0x21,0xb2,0x82,0xde,0xb4,0xf7,0x18,0xbd,0x97,0xdd,0x9d,0x99,0x3e,0x36},
+    {0xc4,0x1f,0xee,0x35,0xc1,0x43,0xa8,0x96,0xcf,0xc8,0xe4,0x08,0x55,0xb3,0x6e,0x97,0x30,0xd3,0x8c,0xb5,0x01,0x68,0x2f,0xb4,0x2b,0x05,0x3a,0x69,0x78,0x9b,0xee,0x48,0xc6,0xae,0x4b,0xe2,0xdc,0x48,0x18,0x2f,0x60,0xaf,0xbc,0xba,0x55,0x72,0x9b,0x76,0x31,0xe9,0xef,0x3c,0x6e,0x3c,0xcb,0x90,0x55,0xb3,0xf9,0xc6,0x9b,0x97,0x1f,0x23,0xc6,0xf3,0x2a,0xcc,0x4b,0xde,0x31,0x5c,0x1f,0x8d,0x20,0xfe,0x30,0xb0,0x4b,0xb0,0x66,0xb4,0x4f,0xc1,0x09,0x70,0x8d,0xb7,0x13,0x24,0x79,0x08,0x9b,0xfa,0x9b,0x07},
+    {0xf4,0x0d,0x30,0xda,0x51,0x3a,0x90,0xe3,0xb0,0x5a,0xa9,0x3d,0x23,0x64,0x39,0x84,0x80,0x64,0x35,0x0b,0x2d,0xf1,0x3c,0xed,0x94,0x71,0x81,0x84,0xf6,0x77,0x8c,0x03,0x45,0x42,0xd5,0xa2,0x80,0xed,0xc9,0xf3,0x52,0x39,0xf6,0x77,0x78,0x8b,0xa0,0x0a,0x75,0x54,0x08,0xd1,0x63,0xac,0x6d,0xd7,0x6b,0x63,0x70,0x94,0x15,0xfb,0xf4,0x1e,0xec,0x7b,0x16,0x5b,0xe6,0x5e,0x4e,0x85,0xc2,0xcd,0xd0,0x96,0x42,0x0a,0x59,0x59,0x99,0x21,0x10,0x98,0x34,0xdf,0xb2,0x72,0x56,0xff,0x0b,0x4a,0x2a,0xe9,0x5e,0x57},
+    {0xcf,0x2f,0x18,0x8a,0x90,0x80,0xc0,0xd4,0xbd,0x9d,0x48,0x99,0xc2,0x70,0xe1,0x30,0xde,0x33,0xf7,0x52,0x57,0xbd,0xba,0x05,0x00,0xfd,0xd3,0x2c,0x11,0xe7,0xd4,0x43,0x01,0xd8,0xa4,0x0a,0x45,0xbc,0x46,0x5d,0xd8,0xb9,0x33,0xa5,0x27,0x12,0xaf,0xc3,0xc2,0x06,0x89,0x2b,0x26,0x3b,0x9e,0x38,0x1b,0x58,0x2f,0x38,0x7e,0x1e,0x0a,0x20,0xc5,0x3a,0xf9,0xea,0x67,0xb9,0x8d,0x51,0xc0,0x52,0x66,0x05,0x9b,0x98,0xbc,0x71,0xf5,0x97,0x71,0x56,0xd9,0x85,0x2b,0xfe,0x38,0x4e,0x1e,0x65,0x52,0xca,0x0e,0x05},
+    {0x9c,0x0c,0x3f,0x45,0xde,0x1a,0x43,0xc3,0x9b,0x3b,0x70,0xff,0x5e,0x04,0xf5,0xe9,0x3d,0x7b,0x84,0xed,0xc9,0x7a,0xd9,0xfc,0xc6,0xf4,0x58,0x1c,0xc2,0xe6,0x0e,0x4b,0xea,0x68,0xe6,0x60,0x76,0x39,0xac,0x97,0x97,0xb4,0x3a,0x15,0xfe,0xbb,0x19,0x9b,0x9f,0xa7,0xec,0x34,0xb5,0x79,0xb1,0x4c,0x57,0xae,0x31,0xa1,0x9f,0xc0,0x51,0x61,0x96,0x5d,0xf0,0xfd,0x0d,0x5c,0xf5,0x3a,0x7a,0xee,0xb4,0x2a,0xe0,0x2e,0x26,0xdd,0x09,0x17,0x17,0x12,0x87,0xbb,0xb2,0x11,0x0b,0x03,0x0f,0x80,0xfa,0x24,0xef,0x1f},
+    {0x96,0x31,0xa7,0x1a,0xfb,0x53,0xd6,0x37,0x18,0x64,0xd7,0x3f,0x30,0x95,0x94,0x0f,0xb2,0x17,0x3a,0xfb,0x09,0x0b,0x20,0xad,0x3e,0x61,0xc8,0x2f,0x29,0x49,0x4d,0x54,0x86,0x6b,0x97,0x30,0xf5,0xaf,0xd2,0x22,0x04,0x46,0xd2,0xc2,0x06,0xb8,0x90,0x8d,0xe5,0xba,0xe5,0x4d,0x6c,0x89,0xa1,0xdc,0x17,0x0c,0x34,0xc8,0xe6,0x5f,0x00,0x28,0x88,0x86,0x52,0x34,0x9f,0xba,0xef,0x6a,0xa1,0x7d,0x10,0x25,0x94,0xff,0x1b,0x5c,0x36,0x4b,0xd9,0x66,0xcd,0xbb,0x5b,0xf7,0xfa,0x6d,0x31,0x0f,0x93,0x72,0xe4,0x72},
+    {0x4f,0x08,0x81,0x97,0x8c,0x20,0x95,0x26,0xe1,0x0e,0x45,0x23,0x0b,0x2a,0x50,0xb1,0x02,0xde,0xef,0x03,0xa6,0xae,0x9d,0xfd,0x4c,0xa3,0x33,0x27,0x8c,0x2e,0x9d,0x5a,0x27,0x76,0x2a,0xd3,0x35,0xf6,0xf3,0x07,0xf0,0x66,0x65,0x5f,0x86,0x4d,0xaa,0x7a,0x50,0x44,0xd0,0x28,0x97,0xe7,0x85,0x3c,0x38,0x64,0xe0,0x0f,0x00,0x7f,0xee,0x1f,0xe5,0xf7,0xdb,0x03,0xda,0x05,0x53,0x76,0xbd,0xcd,0x34,0x14,0x49,0xf2,0xda,0xa4,0xec,0x88,0x4a,0xd2,0xcd,0xd5,0x4a,0x7b,0x43,0x05,0x04,0xee,0x51,0x40,0xf9,0x00},
+    {0xb2,0x30,0xd3,0xc3,0x23,0x6b,0x35,0x8d,0x06,0x1b,0x47,0xb0,0x9b,0x8b,0x1c,0xf2,0x3c,0xb8,0x42,0x6e,0x6c,0x31,0x6c,0xb3,0x0d,0xb1,0xea,0x8b,0x7e,0x9c,0xd7,0x07,0x53,0x97,0xaf,0x07,0xbb,0x93,0xef,0xd7,0xa7,0x66,0xb7,0x3d,0xcf,0xd0,0x3e,0x58,0xc5,0x1e,0x0b,0x6e,0xbf,0x98,0x69,0xce,0x52,0x04,0xd4,0x5d,0xd2,0xff,0xb7,0x47,0x12,0xdd,0x08,0xbc,0x9c,0xfb,0xfb,0x87,0x9b,0xc2,0xee,0xe1,0x3a,0x6b,0x06,0x8a,0xbf,0xc1,0x1f,0xdb,0x2b,0x24,0x57,0x0d,0xb6,0x4b,0xa6,0x5e,0xa3,0x20,0x35,0x1c},
+    {0x4a,0xa3,0xcb,0xbc,0xa6,0x53,0xd2,0x80,0x9b,0x21,0x38,0x38,0xa1,0xc3,0x61,0x3e,0x96,0xe3,0x82,0x98,0x01,0xb6,0xc3,0x90,0x6f,0xe6,0x0e,0x5d,0x77,0x05,0x3d,0x1c,0x59,0xc0,0x6b,0x21,0x40,0x6f,0xa8,0xcd,0x7e,0xd8,0xbc,0x12,0x1d,0x23,0xbb,0x1f,0x90,0x09,0xc7,0x17,0x9e,0x6a,0x95,0xb4,0x55,0x2e,0xd1,0x66,0x3b,0x0c,0x75,0x38,0x1a,0xe5,0x22,0x94,0x40,0xf1,0x2e,0x69,0x71,0xf6,0x5d,0x2b,0x3c,0xc7,0xc0,0xcb,0x29,0xe0,0x4c,0x74,0xe7,0x4f,0x01,0x21,0x7c,0x48,0x30,0xd3,0xc7,0xe2,0x21,0x06},
+    {0x8d,0x83,0x59,0x82,0xcc,0x60,0x98,0xaf,0xdc,0x9a,0x9f,0xc6,0xc1,0x48,0xea,0x90,0x30,0x1e,0x58,0x65,0x37,0x48,0x26,0x65,0xbc,0xa5,0xd3,0x7b,0x09,0xd6,0x07,0x00,0xf3,0xf0,0xdb,0xb0,0x96,0x17,0xae,0xb7,0x96,0xe1,0x7c,0xe1,0xb9,0xaf,0xdf,0x54,0xb4,0xa3,0xaa,0xe9,0x71,0x30,0x92,0x25,0x9d,0x2e,0x00,0xa1,0x9c,0x58,0x8e,0x5d,0x4b,0xa9,0x42,0x08,0x95,0x1d,0xbf,0xc0,0x3e,0x2e,0x8f,0x58,0x63,0xc3,0xd3,0xb2,0xef,0xe2,0x51,0xbb,0x38,0x14,0x96,0x0a,0x86,0xbf,0x1c,0x3c,0x78,0xd7,0x83,0x15},
+    {0xe1,0x7a,0xa2,0x5d,0xef,0xa2,0xee,0xec,0x74,0x01,0x67,0x55,0x14,0x3a,0x7c,0x59,0x7a,0x16,0x09,0x66,0x12,0x2a,0xa6,0xc9,0x70,0x8f,0xed,0x81,0x2e,0x5f,0x2a,0x25,0xc7,0x28,0x9d,0xcc,0x04,0x47,0x03,0x90,0x8f,0xc5,0x2c,0xf7,0x9e,0x67,0x1b,0x1d,0x26,0x87,0x5b,0xbe,0x5f,0x2b,0xe1,0x16,0x0a,0x58,0xc5,0x83,0x4e,0x06,0x58,0x49,0x0d,0xe8,0x66,0x50,0x26,0x94,0x28,0x0d,0x6b,0x8c,0x7c,0x30,0x85,0xf7,0xc3,0xfc,0xfd,0x12,0x11,0x0c,0x78,0xda,0x53,0x1b,0x88,0xb3,0x43,0xd8,0x0b,0x17,0x9c,0x07},
+    {0xff,0x6f,0xfa,0x64,0xe4,0xec,0x06,0x05,0x23,0xe5,0x05,0x62,0x1e,0x43,0xe3,0xbe,0x42,0xea,0xb8,0x51,0x24,0x42,0x79,0x35,0x00,0xfb,0xc9,0x4a,0xe3,0x05,0xec,0x6d,0x56,0xd0,0xd5,0xc0,0x50,0xcd,0xd6,0xcd,0x3b,0x57,0x03,0xbb,0x6d,0x68,0xf7,0x9a,0x48,0xef,0xc3,0xf3,0x3f,0x72,0xa6,0x3c,0xcc,0x8a,0x7b,0x31,0xd7,0xc0,0x68,0x67,0xb3,0xc1,0x55,0xf1,0xe5,0x25,0xb6,0x94,0x91,0x7b,0x7b,0x99,0xa7,0xf3,0x7b,0x41,0x00,0x26,0x6b,0x6d,0xdc,0xbd,0x2c,0xc2,0xf4,0x52,0xcd,0xdd,0x14,0x5e,0x44,0x51},
+    {0x51,0x49,0x14,0x3b,0x4b,0x2b,0x50,0x57,0xb3,0xbc,0x4b,0x44,0x6b,0xff,0x67,0x8e,0xdb,0x85,0x63,0x16,0x27,0x69,0xbd,0xb8,0xc8,0x95,0x92,0xe3,0x31,0x6f,0x18,0x13,0x55,0xa4,0xbe,0x2b,0xab,0x47,0x31,0x89,0x29,0x91,0x07,0x92,0x4f,0xa2,0x53,0x8c,0xa7,0xf7,0x30,0xbe,0x48,0xf9,0x49,0x4b,0x3d,0xd4,0x4f,0x6e,0x08,0x90,0xe9,0x12,0x2e,0xbb,0xdf,0x7f,0xb3,0x96,0x0c,0xf1,0xf9,0xea,0x1c,0x12,0x5e,0x93,0x9a,0x9f,0x3f,0x98,0x5b,0x3a,0xc4,0x36,0x11,0xdf,0xaf,0x99,0x3e,0x5d,0xf0,0xe3,0xb2,0x77},
+    {0xde,0xc4,0x2e,0x9c,0xc5,0xa9,0x6f,0x29,0xcb,0xf3,0x84,0x4f,0xbf,0x61,0x8b,0xbc,0x08,0xf9,0xa8,0x17,0xd9,0x06,0x77,0x1c,0x5d,0x25,0xd3,0x7a,0xfc,0x95,0xb7,0x63,0xa4,0xb0,0xdd,0x12,0x9c,0x63,0x98,0xd5,0x6b,0x86,0x24,0xc0,0x30,0x9f,0xd1,0xa5,0x60,0xe4,0xfc,0x58,0x03,0x2f,0x7c,0xd1,0x8a,0x5e,0x09,0x2e,0x15,0x95,0xa1,0x07,0xc8,0x5f,0x9e,0x38,0x02,0x8f,0x36,0xa8,0x3b,0xe4,0x8d,0xcf,0x02,0x3b,0x43,0x90,0x43,0x26,0x41,0xc5,0x5d,0xfd,0xa1,0xaf,0x37,0x01,0x2f,0x03,0x3d,0xe8,0x8f,0x3e},
+    {0x94,0xa2,0x70,0x05,0xb9,0x15,0x8b,0x2f,0x49,0x45,0x08,0x67,0x70,0x42,0xf2,0x94,0x84,0xfd,0xbb,0x61,0xe1,0x5a,0x1c,0xde,0x07,0x40,0xac,0x7f,0x79,0x3b,0xba,0x75,0x3c,0xd1,0xef,0xe8,0x8d,0x4c,0x70,0x08,0x31,0x37,0xe0,0x33,0x8e,0x1a,0xc5,0xdf,0xe3,0xcd,0x60,0x12,0xa5,0x5d,0x9d,0xa5,0x86,0x8c,0x25,0xa6,0x99,0x08,0xd6,0x22,0x96,0xd1,0xcd,0x70,0xc0,0xdb,0x39,0x62,0x9a,0x8a,0x7d,0x6c,0x8b,0x8a,0xfe,0x60,0x60,0x12,0x40,0xeb,0xbc,0x47,0x88,0xb3,0x5e,0x9e,0x77,0x87,0x7b,0xd0,0x04,0x09},
+    {0x9c,0x91,0xba,0xdd,0xd4,0x1f,0xce,0xb4,0xaa,0x8d,0x4c,0xc7,0x3e,0xdb,0x31,0xcf,0x51,0xcc,0x86,0xad,0x63,0xcc,0x63,0x2c,0x07,0xde,0x1d,0xbc,0x3f,0x14,0xe2,0x43,0xb9,0x40,0xf9,0x48,0x66,0x2d,0x32,0xf4,0x39,0x0c,0x2d,0xbd,0x0c,0x2f,0x95,0x06,0x31,0xf9,0x81,0xa0,0xad,0x97,0x76,0x16,0x6c,0x2a,0xf7,0xba,0xce,0xaa,0x40,0x62,0xa0,0x95,0xa2,0x5b,0x9c,0x74,0x34,0xf8,0x5a,0xd2,0x37,0xca,0x5b,0x7c,0x94,0xd6,0x6a,0x31,0xc9,0xe7,0xa7,0x3b,0xf1,0x66,0xac,0x0c,0xb4,0x8d,0x23,0xaf,0xbd,0x56},
+    {0xeb,0x33,0x35,0xf5,0xe3,0xb9,0x2a,0x36,0x40,0x3d,0xb9,0x6e,0xd5,0x68,0x85,0x33,0x72,0x55,0x5a,0x1d,0x52,0x14,0x0e,0x9e,0x18,0x13,0x74,0x83,0x6d,0xa8,0x24,0x1d,0xb2,0x3b,0x9d,0xc1,0x6c,0xd3,0x10,0x13,0xb9,0x86,0x23,0x62,0xb7,0x6b,0x2a,0x06,0x5c,0x4f,0xa1,0xd7,0x91,0x85,0x9b,0x7c,0x54,0x57,0x1e,0x7e,0x50,0x31,0xaa,0x03,0x1f,0xce,0xd4,0xff,0x48,0x76,0xec,0xf4,0x1c,0x8c,0xac,0x54,0xf0,0xea,0x45,0xe0,0x7c,0x35,0x09,0x1d,0x82,0x25,0xd2,0x88,0x59,0x48,0xeb,0x9a,0xdc,0x61,0xb2,0x43},
+    {0xbb,0x79,0xbb,0x88,0x19,0x1e,0x5b,0xe5,0x9d,0x35,0x7a,0xc1,0x7d,0xd0,0x9e,0xa0,0x33,0xea,0x3d,0x60,0xe2,0x2e,0x2c,0xb0,0xc2,0x6b,0x27,0x5b,0xcf,0x55,0x60,0x32,0x64,0x13,0x95,0x6c,0x8b,0x3d,0x51,0x19,0x7b,0xf4,0x0b,0x00,0x26,0x71,0xfe,0x94,0x67,0x95,0x4f,0xd5,0xdd,0x10,0x8d,0x02,0x64,0x09,0x94,0x42,0xe2,0xd5,0xb4,0x02,0xf2,0x8d,0xd1,0x28,0xcb,0x55,0xa1,0xb4,0x08,0xe5,0x6c,0x18,0x46,0x46,0xcc,0xea,0x89,0x43,0x82,0x6c,0x93,0xf4,0x9c,0xc4,0x10,0x34,0x5d,0xae,0x09,0xc8,0xa6,0x27},
+    {0x88,0xb1,0x0d,0x1f,0xcd,0xeb,0xa6,0x8b,0xe8,0x5b,0x5a,0x67,0x3a,0xd7,0xd3,0x37,0x5a,0x58,0xf5,0x15,0xa3,0xdf,0x2e,0xf2,0x7e,0xa1,0x60,0xff,0x74,0x71,0xb6,0x2c,0x54,0x69,0x3d,0xc4,0x0a,0x27,0x2c,0xcd,0xb2,0xca,0x66,0x6a,0x57,0x3e,0x4a,0xdd,0x6c,0x03,0xd7,0x69,0x24,0x59,0xfa,0x79,0x99,0x25,0x8c,0x3d,0x60,0x03,0x15,0x22,0xd0,0xe1,0x0b,0x39,0xf9,0xcd,0xee,0x59,0xf1,0xe3,0x8c,0x72,0x44,0x20,0x42,0xa9,0xf4,0xf0,0x94,0x7a,0x66,0x1c,0x89,0x82,0x36,0xf4,0x90,0x38,0xb7,0xf4,0x1d,0x7b},
+    {0x24,0xa2,0xb2,0xb3,0xe0,0xf2,0x92,0xe4,0x60,0x11,0x55,0x2b,0x06,0x9e,0x6c,0x7c,0x0e,0x7b,0x7f,0x0d,0xe2,0x8f,0xeb,0x15,0x92,0x59,0xfc,0x58,0x26,0xef,0xfc,0x61,0x8c,0xf5,0xf8,0x07,0x18,0x22,0x2e,0x5f,0xd4,0x09,0x94,0xd4,0x9f,0x5c,0x55,0xe3,0x30,0xa6,0xb6,0x1f,0x8d,0xa8,0xaa,0xb2,0x3d,0xe0,0x52,0xd3,0x45,0x82,0x69,0x68,0x7a,0x18,0x18,0x2a,0x85,0x5d,0xb1,0xdb,0xd7,0xac,0xdd,0x86,0xd3,0xaa,0xe4,0xf3,0x82,0xc4,0xf6,0x0f,0x81,0xe2,0xba,0x44,0xcf,0x01,0xaf,0x3d,0x47,0x4c,0xcf,0x46},
+    {0xf9,0xe5,0xc4,0x9e,0xed,0x25,0x65,0x42,0x03,0x33,0x90,0x16,0x01,0xda,0x5e,0x0e,0xdc,0xca,0xe5,0xcb,0xf2,0xa7,0xb1,0x72,0x40,0x5f,0xeb,0x14,0xcd,0x7b,0x38,0x29,0x40,0x81,0x49,0xf1,0xa7,0x6e,0x3c,0x21,0x54,0x48,0x2b,0x39,0xf8,0x7e,0x1e,0x7c,0xba,0xce,0x29,0x56,0x8c,0xc3,0x88,0x24,0xbb,0xc5,0x8c,0x0d,0xe5,0xaa,0x65,0x10,0x57,0x0d,0x20,0xdf,0x25,0x45,0x2c,0x1c,0x4a,0x67,0xca,0xbf,0xd6,0x2d,0x3b,0x5c,0x30,0x40,0x83,0xe1,0xb1,0xe7,0x07,0x0a,0x16,0xe7,0x1c,0x4f,0xe6,0x98,0xa1,0x69},
+    {0xbc,0x78,0x1a,0xd9,0xe0,0xb2,0x62,0x90,0x67,0x96,0x50,0xc8,0x9c,0x88,0xc9,0x47,0xb8,0x70,0x50,0x40,0x66,0x4a,0xf5,0x9d,0xbf,0xa1,0x93,0x24,0xa9,0xe6,0x69,0x73,0xed,0xca,0xc5,0xdc,0x34,0x44,0x01,0xe1,0x33,0xfb,0x84,0x3c,0x96,0x5d,0xed,0x47,0xe7,0xa0,0x86,0xed,0x76,0x95,0x01,0x70,0xe4,0xf9,0x67,0xd2,0x7b,0x69,0xb2,0x25,0x64,0x68,0x98,0x13,0xfb,0x3f,0x67,0x9d,0xb8,0xc7,0x5d,0x41,0xd9,0xfb,0xa5,0x3c,0x5e,0x3b,0x27,0xdf,0x3b,0xcc,0x4e,0xe0,0xd2,0x4c,0x4e,0xb5,0x3d,0x68,0x20,0x14},
+    {0x97,0xd1,0x9d,0x24,0x1e,0xbd,0x78,0xb4,0x02,0xc1,0x58,0x5e,0x00,0x35,0x0c,0x62,0x5c,0xac,0xba,0xcc,0x2f,0xd3,0x02,0xfb,0x2d,0xa7,0x08,0xf5,0xeb,0x3b,0xb6,0x60,0xd0,0x5a,0xcc,0xc1,0x6f,0xbb,0xee,0x34,0x8b,0xac,0x46,0x96,0xe9,0x0c,0x1b,0x6a,0x53,0xde,0x6b,0xa6,0x49,0xda,0xb0,0xd3,0xc1,0x81,0xd0,0x61,0x41,0x3b,0xe8,0x31,0x4f,0x2b,0x06,0x9e,0x12,0xc7,0xe8,0x97,0xd8,0x0a,0x32,0x29,0x4f,0x8f,0xe4,0x49,0x3f,0x68,0x18,0x6f,0x4b,0xe1,0xec,0x5b,0x17,0x03,0x55,0x2d,0xb6,0x1e,0xcf,0x55},
+    {0x58,0x3d,0xc2,0x65,0x10,0x10,0x79,0x58,0x9c,0x81,0x94,0x50,0x6d,0x08,0x9d,0x8b,0xa7,0x5f,0xc5,0x12,0xa9,0x2f,0x40,0xe2,0xd4,0x91,0x08,0x57,0x64,0x65,0x9a,0x66,0x52,0x8c,0xf5,0x7d,0xe3,0xb5,0x76,0x30,0x36,0xcc,0x99,0xe7,0xdd,0xb9,0x3a,0xd7,0x20,0xee,0x13,0x49,0xe3,0x1c,0x83,0xbd,0x33,0x01,0xba,0x62,0xaa,0xfb,0x56,0x1a,0xec,0xc9,0x9d,0x5c,0x50,0x6b,0x3e,0x94,0x1a,0x37,0x7c,0xa7,0xbb,0x57,0x25,0x30,0x51,0x76,0x34,0x41,0x56,0xae,0x73,0x98,0x5c,0x8a,0xc5,0x99,0x67,0x83,0xc4,0x13},
+    {0xb9,0xe1,0xb3,0x5a,0x46,0x5d,0x3a,0x42,0x61,0x3f,0xf1,0xc7,0x87,0xc1,0x13,0xfc,0xb6,0xb9,0xb5,0xec,0x64,0x36,0xf8,0x19,0x07,0xb6,0x37,0xa6,0x93,0x0c,0xf8,0x66,0x80,0xd0,0x8b,0x5d,0x6a,0xfb,0xdc,0xc4,0x42,0x48,0x1a,0x57,0xec,0xc4,0xeb,0xde,0x65,0x53,0xe5,0xb8,0x83,0xe8,0xb2,0xd4,0x27,0xb8,0xe5,0xc8,0x7d,0xc8,0xbd,0x50,0x11,0xe1,0xdf,0x6e,0x83,0x37,0x6d,0x60,0xd9,0xab,0x11,0xf0,0x15,0x3e,0x35,0x32,0x96,0x3b,0xb7,0x25,0xc3,0x3a,0xb0,0x64,0xae,0xd5,0x5f,0x72,0x44,0x64,0xd5,0x1d},
+    {0x7d,0x12,0x62,0x33,0xf8,0x7f,0xa4,0x8f,0x15,0x7c,0xcd,0x71,0xc4,0x6a,0x9f,0xbc,0x8b,0x0c,0x22,0x49,0x43,0x45,0x71,0x6e,0x2e,0x73,0x9f,0x21,0x12,0x59,0x64,0x0e,0x9a,0xc8,0xba,0x08,0x00,0xe6,0x97,0xc2,0xe0,0xc3,0xe1,0xea,0x11,0xea,0x4c,0x7d,0x7c,0x97,0xe7,0x9f,0xe1,0x8b,0xe3,0xf3,0xcd,0x05,0xa3,0x63,0x0f,0x45,0x3a,0x3a,0x27,0x46,0x39,0xd8,0x31,0x2f,0x8f,0x07,0x10,0xa5,0x94,0xde,0x83,0x31,0x9d,0x38,0x80,0x6f,0x99,0x17,0x6d,0x6c,0xe3,0xd1,0x7b,0xa8,0xa9,0x93,0x93,0x8d,0x8c,0x31},
+    {0x19,0xfe,0xff,0x2a,0x03,0x5d,0x74,0xf2,0x66,0xdb,0x24,0x7f,0x49,0x3c,0x9f,0x0c,0xef,0x98,0x85,0xba,0xe3,0xd3,0x98,0xbc,0x14,0x53,0x1d,0x9a,0x67,0x7c,0x4c,0x22,0x98,0xd3,0x1d,0xab,0x29,0x9e,0x66,0x5d,0x3b,0x9e,0x2d,0x34,0x58,0x16,0x92,0xfc,0xcd,0x73,0x59,0xf3,0xfd,0x1d,0x85,0x55,0xf6,0x0a,0x95,0x25,0xc3,0x41,0x9a,0x50,0xe9,0x25,0xf9,0xa6,0xdc,0x6e,0xc0,0xbd,0x33,0x1f,0x1b,0x64,0xf4,0xf3,0x3e,0x79,0x89,0x3e,0x83,0x9d,0x80,0x12,0xec,0x82,0x89,0x13,0xa1,0x28,0x23,0xf0,0xbf,0x05},
+    {0x0b,0xe0,0xca,0x23,0x70,0x13,0x32,0x36,0x59,0xcf,0xac,0xd1,0x0a,0xcf,0x4a,0x54,0x88,0x1c,0x1a,0xd2,0x49,0x10,0x74,0x96,0xa7,0x44,0x2a,0xfa,0xc3,0x8c,0x0b,0x78,0xe4,0x12,0xc5,0x0d,0xdd,0xa0,0x81,0x68,0xfe,0xfa,0xa5,0x44,0xc8,0x0d,0xe7,0x4f,0x40,0x52,0x4a,0x8f,0x6b,0x8e,0x74,0x1f,0xea,0xa3,0x01,0xee,0xcd,0x77,0x62,0x57,0x5f,0x30,0x4f,0x23,0xbc,0x8a,0xf3,0x1e,0x08,0xde,0x05,0x14,0xbd,0x7f,0x57,0x9a,0x0d,0x2a,0xe6,0x34,0x14,0xa5,0x82,0x5e,0xa1,0xb7,0x71,0x62,0x72,0x18,0xf4,0x5f},
+    {0x9d,0xdb,0x89,0x17,0x0c,0x08,0x8e,0x39,0xf5,0x78,0xe7,0xf3,0x25,0x20,0x60,0xa7,0x5d,0x03,0xbd,0x06,0x4c,0x89,0x98,0xfa,0xbe,0x66,0xa9,0x25,0xdc,0x03,0x6a,0x10,0x40,0x95,0xb6,0x13,0xe8,0x47,0xdb,0xe5,0xe1,0x10,0x26,0x43,0x3b,0x2a,0x5d,0xf3,0x76,0x12,0x78,0x38,0xe9,0x26,0x1f,0xac,0x69,0xcb,0xa0,0xa0,0x8c,0xdb,0xd4,0x29,0xd0,0x53,0x33,0x33,0xaf,0x0a,0xad,0xd9,0xe5,0x09,0xd3,0xac,0xa5,0x9d,0x66,0x38,0xf0,0xf7,0x88,0xc8,0x8a,0x65,0x57,0x3c,0xfa,0xbe,0x2c,0x05,0x51,0x8a,0xb3,0x4a},
+    {0x93,0xd5,0x68,0x67,0x25,0x2b,0x7c,0xda,0x13,0xca,0x22,0x44,0x57,0xc0,0xc1,0x98,0x1d,0xce,0x0a,0xca,0xd5,0x0b,0xa8,0xf1,0x90,0xa6,0x88,0xc0,0xad,0xd1,0xcd,0x29,0x9c,0xc0,0xdd,0x5f,0xef,0xd1,0xcf,0xd6,0xce,0x5d,0x57,0xf7,0xfd,0x3e,0x2b,0xe8,0xc2,0x34,0x16,0x20,0x5d,0x6b,0xd5,0x25,0x9b,0x2b,0xed,0x04,0xbb,0xc6,0x41,0x30,0x48,0xe1,0x56,0xd9,0xf9,0xf2,0xf2,0x0f,0x2e,0x6b,0x35,0x9f,0x75,0x97,0xe7,0xad,0x5c,0x02,0x6c,0x5f,0xbb,0x98,0x46,0x1a,0x7b,0x9a,0x04,0x14,0x68,0xbd,0x4b,0x10},
+    {0x67,0xed,0xf1,0x68,0x31,0xfd,0xf0,0x51,0xc2,0x3b,0x6f,0xd8,0xcd,0x1d,0x81,0x2c,0xde,0xf2,0xd2,0x04,0x43,0x5c,0xdc,0x44,0x49,0x71,0x2a,0x09,0x57,0xcc,0xe8,0x5b,0x63,0xf1,0x7f,0xd6,0x5f,0x9a,0x5d,0xa9,0x81,0x56,0xc7,0x4c,0x9d,0xe6,0x2b,0xe9,0x57,0xf2,0x20,0xde,0x4c,0x02,0xf8,0xb7,0xf5,0x2d,0x07,0xfb,0x20,0x2a,0x4f,0x20,0x79,0xb0,0xeb,0x30,0x3d,0x3b,0x14,0xc8,0x30,0x2e,0x65,0xbd,0x5a,0x15,0x89,0x75,0x31,0x5c,0x6d,0x8f,0x31,0x3c,0x3c,0x65,0x1f,0x16,0x79,0xc2,0x17,0xfb,0x70,0x25},
+    {0x75,0x15,0xb6,0x2c,0x7f,0x36,0xfa,0x3e,0x6c,0x02,0xd6,0x1c,0x76,0x6f,0xf9,0xf5,0x62,0x25,0xb5,0x65,0x2a,0x14,0xc7,0xe8,0xcd,0x0a,0x03,0x53,0xea,0x65,0xcb,0x3d,0x5a,0x24,0xb8,0x0b,0x55,0xa9,0x2e,0x19,0xd1,0x50,0x90,0x8f,0xa8,0xfb,0xe6,0xc8,0x35,0xc9,0xa4,0x88,0x2d,0xea,0x86,0x79,0x68,0x86,0x01,0xde,0x91,0x5f,0x1c,0x24,0xaa,0x6c,0xde,0x40,0x29,0x17,0xd8,0x28,0x3a,0x73,0xd9,0x22,0xf0,0x2c,0xbf,0x8f,0xd1,0x01,0x5b,0x23,0xdd,0xfc,0xd7,0x16,0xe5,0xf0,0xcd,0x5f,0xdd,0x0e,0x42,0x08},
+    {0x4a,0xfa,0x62,0x83,0xab,0x20,0xff,0xcd,0x6e,0x3e,0x1a,0xe2,0xd4,0x18,0xe1,0x57,0x2b,0xe6,0x39,0xfc,0x17,0x96,0x17,0xe3,0xfd,0x69,0x17,0xbc,0xef,0x53,0x9a,0x0d,0xce,0x10,0xf4,0x04,0x4e,0xc3,0x58,0x03,0x85,0x06,0x6e,0x27,0x5a,0x5b,0x13,0xb6,0x21,0x15,0xb9,0xeb,0xc7,0x70,0x96,0x5d,0x9c,0x88,0xdb,0x21,0xf3,0x54,0xd6,0x04,0xd5,0xb5,0xbd,0xdd,0x16,0xc1,0x7d,0x5e,0x2d,0xdd,0xa5,0x8d,0xb6,0xde,0x54,0x29,0x92,0xa2,0x34,0x33,0x17,0x08,0xb6,0x1c,0xd7,0x1a,0x99,0x18,0x26,0x4f,0x7a,0x4a},
+    {0x95,0x5f,0xb1,0x5f,0x02,0x18,0xa7,0xf4,0x8f,0x1b,0x5c,0x6b,0x34,0x5f,0xf6,0x3d,0x12,0x11,0xe0,0x00,0x85,0xf0,0xfc,0xcd,0x48,0x18,0xd3,0xdd,0x4c,0x0c,0xb5,0x11,0x4b,0x2a,0x37,0xaf,0x91,0xb2,0xc3,0x24,0xf2,0x47,0x81,0x71,0x70,0x82,0xda,0x93,0xf2,0x9e,0x89,0x86,0x64,0x85,0x84,0xdd,0x33,0xee,0xe0,0x23,0x42,0x31,0x96,0x4a,0xd6,0xff,0xa4,0x08,0x44,0x27,0xe8,0xa6,0xd9,0x76,0x15,0x9c,0x7e,0x17,0x8e,0x73,0xf2,0xb3,0x02,0x3d,0xb6,0x48,0x33,0x77,0x51,0xcc,0x6b,0xce,0x4d,0xce,0x4b,0x4f},
+    {0x84,0x25,0x24,0xe2,0x5a,0xce,0x1f,0xa7,0x9e,0x8a,0xf5,0x92,0x56,0x72,0xea,0x26,0xf4,0x3c,0xea,0x1c,0xd7,0x09,0x1a,0xd2,0xe6,0x01,0x1c,0xb7,0x14,0xdd,0xfc,0x73,0x6f,0x0b,0x9d,0xc4,0x6e,0x61,0xe2,0x30,0x17,0x23,0xec,0xca,0x8f,0x71,0x56,0xe4,0xa6,0x4f,0x6b,0xf2,0x9b,0x40,0xeb,0x48,0x37,0x5f,0x59,0x61,0xe5,0xce,0x42,0x30,0x41,0xac,0x9b,0x44,0x79,0x70,0x7e,0x42,0x0a,0x31,0xe2,0xbc,0x6d,0xe3,0x5a,0x85,0x7c,0x1a,0x84,0x5f,0x21,0x76,0xae,0x4c,0xd6,0xe1,0x9c,0x9a,0x0c,0x74,0x9e,0x38},
+    {0xce,0xb9,0xdc,0x34,0xae,0xb3,0xfc,0x64,0xad,0xd0,0x48,0xe3,0x23,0x03,0x50,0x97,0x1b,0x38,0xc6,0x62,0x7d,0xf0,0xb3,0x45,0x88,0x67,0x5a,0x46,0x79,0x53,0x54,0x61,0x28,0xac,0x0e,0x57,0xf6,0x78,0xbd,0xc9,0xe1,0x9c,0x91,0x27,0x32,0x0b,0x5b,0xe5,0xed,0x91,0x9b,0xa1,0xab,0x3e,0xfc,0x65,0x90,0x36,0x26,0xd6,0xe5,0x25,0xc4,0x25,0x6e,0xde,0xd7,0xf1,0xa6,0x06,0x3e,0x3f,0x08,0x23,0x06,0x8e,0x27,0x76,0xf9,0x3e,0x77,0x6c,0x8a,0x4e,0x26,0xf6,0x14,0x8c,0x59,0x47,0x48,0x15,0x89,0xa0,0x39,0x65},
+    {0x73,0xf7,0xd2,0xc3,0x74,0x1f,0xd2,0xe9,0x45,0x68,0xc4,0x25,0x41,0x54,0x50,0xc1,0x33,0x9e,0xb9,0xf9,0xe8,0x5c,0x4e,0x62,0x6c,0x18,0xcd,0xc5,0xaa,0xe4,0xc5,0x11,0x19,0x4a,0xbb,0x14,0xd4,0xdb,0xc4,0xdd,0x8e,0x4f,0x42,0x98,0x3c,0xbc,0xb2,0x19,0x69,0x71,0xca,0x36,0xd7,0x9f,0xa8,0x48,0x90,0xbd,0x19,0xf0,0x0e,0x32,0x65,0x0f,0xc6,0xe0,0xfd,0xca,0xb1,0xd1,0x86,0xd4,0x81,0x51,0x3b,0x16,0xe3,0xe6,0x3f,0x4f,0x9a,0x93,0xf2,0xfa,0x0d,0xaf,0xa8,0x59,0x2a,0x07,0x33,0xec,0xbd,0xc7,0xab,0x4c},
+    {0x2e,0x0a,0x9c,0x08,0x24,0x96,0x9e,0x23,0x38,0x47,0xfe,0x3a,0xc0,0xc4,0x48,0xc7,0x2a,0xa1,0x4f,0x76,0x2a,0xed,0xdb,0x17,0x82,0x85,0x1c,0x32,0xf0,0x93,0x9b,0x63,0x89,0xd2,0x78,0x3f,0x8f,0x78,0x8f,0xc0,0x9f,0x4d,0x40,0xa1,0x2c,0xa7,0x30,0xfe,0x9d,0xcc,0x65,0xcf,0xfc,0x8b,0x77,0xf2,0x21,0x20,0xcb,0x5a,0x16,0x98,0xe4,0x7e,0xc3,0xa1,0x11,0x91,0xe3,0x08,0xd5,0x7b,0x89,0x74,0x90,0x80,0xd4,0x90,0x2b,0x2b,0x19,0xfd,0x72,0xae,0xc2,0xae,0xd2,0xe7,0xa6,0x02,0xb6,0x85,0x3c,0x49,0xdf,0x0e},
+    {0x68,0x5a,0x9b,0x59,0x58,0x81,0xcc,0xae,0x0e,0xe2,0xad,0xeb,0x0f,0x4f,0x57,0xea,0x07,0x7f,0xb6,0x22,0x74,0x1d,0xe4,0x4f,0xb4,0x4f,0x9d,0x01,0xe3,0x92,0x3b,0x40,0x13,0x41,0x76,0x84,0xd2,0xc4,0x67,0x67,0x35,0xf8,0xf5,0xf7,0x3f,0x40,0x90,0xa0,0xde,0xbe,0xe6,0xca,0xfa,0xcf,0x8f,0x1c,0x69,0xa3,0xdf,0xd1,0x54,0x0c,0xc0,0x04,0xf8,0x5c,0x46,0x8b,0x81,0x2f,0xc2,0x4d,0xf8,0xef,0x80,0x14,0x5a,0xf3,0xa0,0x71,0x57,0xd6,0xc7,0x04,0xad,0xbf,0xe8,0xae,0xf4,0x76,0x61,0xb2,0x2a,0xb1,0x5b,0x35},
+    {0xf4,0xbb,0x93,0x74,0xcc,0x64,0x1e,0xa7,0xc3,0xb0,0xa3,0xec,0xd9,0x84,0xbd,0xe5,0x85,0xe7,0x05,0xfa,0x0c,0xc5,0x6b,0x0a,0x12,0xc3,0x2e,0x18,0x32,0x81,0x9b,0x0f,0x18,0x73,0x8c,0x5a,0xc7,0xda,0x01,0xa3,0x11,0xaa,0xce,0xb3,0x9d,0x03,0x90,0xed,0x2d,0x3f,0xae,0x3b,0xbf,0x7c,0x07,0x6f,0x8e,0xad,0x52,0xe0,0xf8,0xea,0x18,0x75,0x32,0x6c,0x7f,0x1b,0xc4,0x59,0x88,0xa4,0x98,0x32,0x38,0xf4,0xbc,0x60,0x2d,0x0f,0xd9,0xd1,0xb1,0xc9,0x29,0xa9,0x15,0x18,0xc4,0x55,0x17,0xbb,0x1b,0x87,0xc3,0x47},
+    {0x48,0x4f,0xec,0x71,0x97,0x53,0x44,0x51,0x6e,0x5d,0x8c,0xc9,0x7d,0xb1,0x05,0xf8,0x6b,0xc6,0xc3,0x47,0x1a,0xc1,0x62,0xf7,0xdc,0x99,0x46,0x76,0x85,0x9b,0xb8,0x00,0xb0,0x66,0x50,0xc8,0x50,0x5d,0xe6,0xfb,0xb0,0x99,0xa2,0xb3,0xb0,0xc4,0xec,0x62,0xe0,0xe8,0x1a,0x44,0xea,0x54,0x37,0xe5,0x5f,0x8d,0xd4,0xe8,0x2c,0xa0,0xfe,0x08,0xd0,0xea,0xde,0x68,0x76,0xdd,0x4d,0x82,0x23,0x5d,0x68,0x4b,0x20,0x45,0x64,0xc8,0x65,0xd6,0x89,0x5d,0xcd,0xcf,0x14,0xb5,0x37,0xd5,0x75,0x4f,0xa7,0x29,0x38,0x47},
+    {0x18,0xc4,0x79,0x46,0x75,0xda,0xd2,0x82,0xf0,0x8d,0x61,0xb2,0xd8,0xd7,0x3b,0xe6,0x0a,0xeb,0x47,0xac,0x24,0xef,0x5e,0x35,0xb4,0xc6,0x33,0x48,0x4c,0x68,0x78,0x20,0xc9,0x02,0x39,0xad,0x3a,0x53,0xd9,0x23,0x8f,0x58,0x03,0xef,0xce,0xdd,0xc2,0x64,0xb4,0x2f,0xe1,0xcf,0x90,0x73,0x25,0x15,0x90,0xd3,0xe4,0x44,0x4d,0x8b,0x66,0x6c,0x0c,0x82,0x78,0x7a,0x21,0xcf,0x48,0x3b,0x97,0x3e,0x27,0x81,0xb2,0x0a,0x6a,0xf7,0x7b,0xed,0x8e,0x8c,0xa7,0x65,0x6c,0xa9,0x3f,0x43,0x8a,0x4f,0x05,0xa6,0x11,0x74},
+    {0x6d,0xc8,0x9d,0xb9,0x32,0x9d,0x65,0x4d,0x15,0xf1,0x3a,0x60,0x75,0xdc,0x4c,0x04,0x88,0xe4,0xc2,0xdc,0x2c,0x71,0x4c,0xb3,0xff,0x34,0x81,0xfb,0x74,0x65,0x13,0x7c,0xb4,0x75,0xb1,0x18,0x3d,0xe5,0x9a,0x57,0x02,0xa1,0x92,0xf3,0x59,0x31,0x71,0x68,0xf5,0x35,0xef,0x1e,0xba,0xec,0x55,0x84,0x8f,0x39,0x8c,0x45,0x72,0xa8,0xc9,0x1e,0x9b,0x50,0xa2,0x00,0xd4,0xa4,0xe6,0xb8,0xb4,0x82,0xc8,0x0b,0x02,0xd7,0x81,0x9b,0x61,0x75,0x95,0xf1,0x9b,0xcc,0xe7,0x57,0x60,0x64,0xcd,0xc7,0xa5,0x88,0xdd,0x3a},
+    {0xf2,0xdc,0x35,0xb6,0x70,0x57,0x89,0xab,0xbc,0x1f,0x6c,0xf6,0x6c,0xef,0xdf,0x02,0x87,0xd1,0xb6,0xbe,0x68,0x02,0x53,0x85,0x74,0x9e,0x87,0xcc,0xfc,0x29,0x99,0x24,0x46,0x30,0x39,0x59,0xd4,0x98,0xc2,0x85,0xec,0x59,0xf6,0x5f,0x98,0x35,0x7e,0x8f,0x3a,0x6e,0xf6,0xf2,0x2a,0xa2,0x2c,0x1d,0x20,0xa7,0x06,0xa4,0x31,0x11,0xba,0x61,0x29,0x90,0x95,0x16,0xf1,0xa0,0xd0,0xa3,0x89,0xbd,0x7e,0xba,0x6c,0x6b,0x3b,0x02,0x07,0x33,0x78,0x26,0x3e,0x5a,0xf1,0x7b,0xe7,0xec,0xd8,0xbb,0x0c,0x31,0x20,0x56},
+    {0x43,0xd6,0x34,0x49,0x43,0x93,0x89,0x52,0xf5,0x22,0x12,0xa5,0x06,0xf8,0xdb,0xb9,0x22,0x1c,0xf4,0xc3,0x8f,0x87,0x6d,0x8f,0x30,0x97,0x9d,0x4d,0x2a,0x6a,0x67,0x37,0xd6,0x85,0xe2,0x77,0xf4,0xb5,0x46,0x66,0x93,0x61,0x8f,0x6c,0x67,0xff,0xe8,0x40,0xdd,0x94,0xb5,0xab,0x11,0x73,0xec,0xa6,0x4d,0xec,0x8c,0x65,0xf3,0x46,0xc8,0x7e,0xc7,0x2e,0xa2,0x1d,0x3f,0x8f,0x5e,0x9b,0x13,0xcd,0x01,0x6c,0x77,0x1d,0x0f,0x13,0xb8,0x9f,0x98,0xa2,0xcf,0x8f,0x4c,0x21,0xd5,0x9d,0x9b,0x39,0x23,0xf7,0xaa,0x6d},
+    {0x47,0xbe,0x3d,0xeb,0x62,0x75,0x3a,0x5f,0xb8,0xa0,0xbd,0x8e,0x54,0x38,0xea,0xf7,0x99,0x72,0x74,0x45,0x31,0xe5,0xc3,0x00,0x51,0xd5,0x27,0x16,0xe7,0xe9,0x04,0x13,0xa2,0x8e,0xad,0xac,0xbf,0x04,0x3b,0x58,0x84,0xe8,0x8b,0x14,0xe8,0x43,0xb7,0x29,0xdb,0xc5,0x10,0x08,0x3b,0x58,0x1e,0x2b,0xaa,0xbb,0xb3,0x8e,0xe5,0x49,0x54,0x2b,0xfe,0x9c,0xdc,0x6a,0xd2,0x14,0x98,0x78,0x0b,0xdd,0x48,0x8b,0x3f,0xab,0x1b,0x3c,0x0a,0xc6,0x79,0xf9,0xff,0xe1,0x0f,0xda,0x93,0xd6,0x2d,0x7c,0x2d,0xde,0x68,0x44},
+    {0x9e,0x46,0x19,0x94,0x5e,0x35,0xbb,0x51,0x54,0xc7,0xdd,0x23,0x4c,0xdc,0xe6,0x33,0x62,0x99,0x7f,0x44,0xd6,0xb6,0xa5,0x93,0x63,0xbd,0x44,0xfb,0x6f,0x7c,0xce,0x6c,0xce,0x07,0x63,0xf8,0xc6,0xd8,0x9a,0x4b,0x28,0x0c,0x5d,0x43,0x31,0x35,0x11,0x21,0x2c,0x77,0x7a,0x65,0xc5,0x66,0xa8,0xd4,0x52,0x73,0x24,0x63,0x7e,0x42,0xa6,0x5d,0xca,0x22,0xac,0xde,0x88,0xc6,0x94,0x1a,0xf8,0x1f,0xae,0xbb,0xf7,0x6e,0x06,0xb9,0x0f,0x58,0x59,0x8d,0x38,0x8c,0xad,0x88,0xa8,0x2c,0x9f,0xe7,0xbf,0x9a,0xf2,0x58},
+    {0x68,0x3e,0xe7,0x8d,0xab,0xcf,0x0e,0xe9,0xa5,0x76,0x7e,0x37,0x9f,0x6f,0x03,0x54,0x82,0x59,0x01,0xbe,0x0b,0x5b,0x49,0xf0,0x36,0x1e,0xf4,0xa7,0xc4,0x29,0x76,0x57,0xf6,0xcd,0x0e,0x71,0xbf,0x64,0x5a,0x4b,0x3c,0x29,0x2c,0x46,0x38,0xe5,0x4c,0xb1,0xb9,0x3a,0x0b,0xd5,0x56,0xd0,0x43,0x36,0x70,0x48,0x5b,0x18,0x24,0x37,0xf9,0x6a,0x88,0xa8,0xc6,0x09,0x45,0x02,0x20,0x32,0x73,0x89,0x55,0x4b,0x13,0x36,0xe0,0xd2,0x9f,0x28,0x33,0x3c,0x23,0x36,0xe2,0x83,0x8f,0xc1,0xae,0x0c,0xbb,0x25,0x1f,0x70},
+    {0xed,0x6c,0x61,0xe4,0xf8,0xb0,0xa8,0xc3,0x7d,0xa8,0x25,0x9e,0x0e,0x66,0x00,0xf7,0x9c,0xa5,0xbc,0xf4,0x1f,0x06,0xe3,0x61,0xe9,0x0b,0xc4,0xbd,0xbf,0x92,0x0c,0x2e,0x13,0xc1,0xbe,0x7c,0xd9,0xf6,0x18,0x9d,0xe4,0xdb,0xbf,0x74,0xe6,0x06,0x4a,0x84,0xd6,0x60,0x4e,0xac,0x22,0xb5,0xf5,0x20,0x51,0x5e,0x95,0x50,0xc0,0x5b,0x0a,0x72,0x35,0x5a,0x80,0x9b,0x43,0x09,0x3f,0x0c,0xfc,0xab,0x42,0x62,0x37,0x8b,0x4e,0xe8,0x46,0x93,0x22,0x5c,0xf3,0x17,0x14,0x69,0xec,0xf0,0x4e,0x14,0xbb,0x9c,0x9b,0x0e},
+    {0xad,0x20,0x57,0xfb,0x8f,0xd4,0xba,0xfb,0x0e,0x0d,0xf9,0xdb,0x6b,0x91,0x81,0xee,0xbf,0x43,0x55,0x63,0x52,0x31,0x81,0xd4,0xd8,0x7b,0x33,0x3f,0xeb,0x04,0x11,0x22,0xee,0xbe,0xb1,0x5d,0xd5,0x9b,0xee,0x8d,0xb9,0x3f,0x72,0x0a,0x37,0xab,0xc3,0xc9,0x91,0xd7,0x68,0x1c,0xbf,0xf1,0xa8,0x44,0xde,0x3c,0xfd,0x1c,0x19,0x44,0x6d,0x36,0x14,0x8c,0xbc,0xf2,0x43,0x17,0x3c,0x9e,0x3b,0x6c,0x85,0xb5,0xfc,0x26,0xda,0x2e,0x97,0xfb,0xa7,0x68,0x0e,0x2f,0xb8,0xcc,0x44,0x32,0x59,0xbc,0xe6,0xa4,0x67,0x41},
+    {0x00,0x27,0xf6,0x76,0x28,0x9d,0x3b,0x64,0xeb,0x68,0x76,0x0e,0x40,0x9d,0x1d,0x5d,0x84,0x06,0xfc,0x21,0x03,0x43,0x4b,0x1b,0x6a,0x24,0x55,0x22,0x7e,0xbb,0x38,0x79,0xee,0x8f,0xce,0xf8,0x65,0x26,0xbe,0xc2,0x2c,0xd6,0x80,0xe8,0x14,0xff,0x67,0xe9,0xee,0x4e,0x36,0x2f,0x7e,0x6e,0x2e,0xf1,0xf6,0xd2,0x7e,0xcb,0x70,0x33,0xb3,0x34,0xcc,0xd6,0x81,0x86,0xee,0x91,0xc5,0xcd,0x53,0xa7,0x85,0xed,0x9c,0x10,0x02,0xce,0x83,0x88,0x80,0x58,0xc1,0x85,0x74,0xed,0xe4,0x65,0xfe,0x2d,0x6e,0xfc,0x76,0x11},
+    {0x9b,0x61,0x9c,0x5b,0xd0,0x6c,0xaf,0xb4,0x80,0x84,0xa5,0xb2,0xf4,0xc9,0xdf,0x2d,0xc4,0x4d,0xe9,0xeb,0x02,0xa5,0x4f,0x3d,0x34,0x5f,0x7d,0x67,0x4c,0x3a,0xfc,0x08,0xb8,0x0e,0x77,0x49,0x89,0xe2,0x90,0xdb,0xa3,0x40,0xf4,0xac,0x2a,0xcc,0xfb,0x98,0x9b,0x87,0xd7,0xde,0xfe,0x4f,0x35,0x21,0xb6,0x06,0x69,0xf2,0x54,0x3e,0x6a,0x1f,0xea,0x34,0x07,0xd3,0x99,0xc1,0xa4,0x60,0xd6,0x5c,0x16,0x31,0xb6,0x85,0xc0,0x40,0x95,0x82,0x59,0xf7,0x23,0x3e,0x33,0xe2,0xd1,0x00,0xb9,0x16,0x01,0xad,0x2f,0x4f},
+    {0x54,0x4e,0xae,0x94,0x41,0xb2,0xbe,0x44,0x6c,0xef,0x57,0x18,0x51,0x1c,0x54,0x5f,0x98,0x04,0x8d,0x36,0x2d,0x6b,0x1e,0xa6,0xab,0xf7,0x2e,0x97,0xa4,0x84,0x54,0x44,0x38,0xb6,0x3b,0xb7,0x1d,0xd9,0x2c,0x96,0x08,0x9c,0x12,0xfc,0xaa,0x77,0x05,0xe6,0x89,0x16,0xb6,0xf3,0x39,0x9b,0x61,0x6f,0x81,0xee,0x44,0x29,0x5f,0x99,0x51,0x34,0x7c,0x7d,0xea,0x9f,0xd0,0xfc,0x52,0x91,0xf6,0x5c,0x93,0xb0,0x94,0x6c,0x81,0x4a,0x40,0x5c,0x28,0x47,0xaa,0x9a,0x8e,0x25,0xb7,0x93,0x28,0x04,0xa6,0x9c,0xb8,0x10},
+    {0x9c,0x28,0x18,0x97,0x49,0x47,0x59,0x3d,0x26,0x3f,0x53,0x24,0xc5,0xf8,0xeb,0x12,0x15,0xef,0xc3,0x14,0xcb,0xbf,0x62,0x02,0x8e,0x51,0xb7,0x77,0xd5,0x78,0xb8,0x20,0x6e,0xf0,0x45,0x5a,0xbe,0x41,0x39,0x75,0x65,0x5f,0x9c,0x6d,0xed,0xae,0x7c,0xd0,0xb6,0x51,0xff,0x72,0x9c,0x6b,0x77,0x11,0xa9,0x4d,0x0d,0xef,0xd9,0xd1,0xd2,0x17,0x6a,0x3e,0x3f,0x07,0x18,0xaf,0xf2,0x27,0x69,0x10,0x52,0xd7,0x19,0xe5,0x3f,0xfd,0x22,0x00,0xa6,0x3c,0x2c,0xb7,0xe3,0x22,0xa7,0xc6,0x65,0xcc,0x63,0x4f,0x21,0x72},
+    {0x93,0xa6,0x07,0x53,0x40,0x7f,0xe3,0xb4,0x95,0x67,0x33,0x2f,0xd7,0x14,0xa7,0xab,0x99,0x10,0x76,0x73,0xa7,0xd0,0xfb,0xd6,0xc9,0xcb,0x71,0x81,0xc5,0x48,0xdf,0x5f,0xc9,0x29,0x3b,0xf4,0xb9,0xb7,0x9d,0x1d,0x75,0x8f,0x51,0x4f,0x4a,0x82,0x05,0xd6,0xc4,0x9d,0x2f,0x31,0xbd,0x72,0xc0,0xf2,0xb0,0x45,0x15,0x5a,0x85,0xac,0x24,0x1f,0xaa,0x05,0x95,0x8e,0x32,0x08,0xd6,0x24,0xee,0x20,0x14,0x0c,0xd1,0xc1,0x48,0x47,0xa2,0x25,0xfb,0x06,0x5c,0xe4,0xff,0xc7,0xe6,0x95,0xe3,0x2a,0x9e,0x73,0xba,0x00},
+    {0xd6,0x90,0x87,0x5c,0xde,0x98,0x2e,0x59,0xdf,0xa2,0xc2,0x45,0xd3,0xb7,0xbf,0xe5,0x22,0x99,0xb4,0xf9,0x60,0x3b,0x5a,0x11,0xf3,0x78,0xad,0x67,0x3e,0x3a,0x28,0x03,0x26,0xbb,0x88,0xea,0xf5,0x26,0x44,0xae,0xfb,0x3b,0x97,0x84,0xd9,0x79,0x06,0x36,0x50,0x4e,0x69,0x26,0x0c,0x03,0x9f,0x5c,0x26,0xd2,0x18,0xd5,0xe7,0x7d,0x29,0x72,0x39,0xb9,0x0c,0xbe,0xc7,0x1d,0x24,0x48,0x80,0x30,0x63,0x8b,0x4d,0x9b,0xf1,0x32,0x08,0x93,0x28,0x02,0x0d,0xc9,0xdf,0xd3,0x45,0x19,0x27,0x46,0x68,0x29,0xe1,0x05},
+    {0x5a,0x49,0x9c,0x2d,0xb3,0xee,0x82,0xba,0x7c,0xb9,0x2b,0xf1,0xfc,0xc8,0xef,0xce,0xe0,0xd1,0xb5,0x93,0xae,0xab,0x2d,0xb0,0x9b,0x8d,0x69,0x13,0x9c,0x0c,0xc0,0x39,0x50,0x45,0x2c,0x24,0xc8,0xbb,0xbf,0xad,0xd9,0x81,0x30,0xd0,0xec,0x0c,0xc8,0xbc,0x92,0xdf,0xc8,0xf5,0xa6,0x66,0x35,0x84,0x4c,0xce,0x58,0x82,0xd3,0x25,0xcf,0x78,0x68,0x9d,0x48,0x31,0x8e,0x6b,0xae,0x15,0x87,0xf0,0x2b,0x9c,0xab,0x1c,0x85,0xaa,0x05,0xfa,0x4e,0xf0,0x97,0x5a,0xa7,0xc9,0x32,0xf8,0x3f,0x6b,0x07,0x52,0x6b,0x00},
+    {0x1c,0x78,0x95,0x9d,0xe1,0xcf,0xe0,0x29,0xe2,0x10,0x63,0x96,0x18,0xdf,0x81,0xb6,0x39,0x6b,0x51,0x70,0xd3,0x39,0xdf,0x57,0x22,0x61,0xc7,0x3b,0x44,0xe3,0x57,0x4d,0x2d,0x08,0xce,0xb9,0x16,0x7e,0xcb,0xf5,0x29,0xbc,0x7a,0x41,0x4c,0xf1,0x07,0x34,0xab,0xa7,0xf4,0x2b,0xce,0x6b,0xb3,0xd4,0xce,0x75,0x9f,0x1a,0x56,0xe9,0xe2,0x7d,0xcb,0x5e,0xa5,0xb6,0xf4,0xd4,0x70,0xde,0x99,0xdb,0x85,0x5d,0x7f,0x52,0x01,0x48,0x81,0x9a,0xee,0xd3,0x40,0xc4,0xc9,0xdb,0xed,0x29,0x60,0x1a,0xaf,0x90,0x2a,0x6b},
+    {0x97,0x1e,0xe6,0x9a,0xfc,0xf4,0x23,0x69,0xd1,0x5f,0x3f,0xe0,0x1d,0x28,0x35,0x57,0x2d,0xd1,0xed,0xe6,0x43,0xae,0x64,0xa7,0x4a,0x3e,0x2d,0xd1,0xe9,0xf4,0xd8,0x5f,0x0a,0xd8,0xb2,0x5b,0x24,0xf3,0xeb,0x77,0x9b,0x07,0xb9,0x2f,0x47,0x1b,0x30,0xd8,0x33,0x73,0xee,0x4c,0xf2,0xe6,0x47,0xc6,0x09,0x21,0x6c,0x27,0xc8,0x12,0x58,0x46,0xd9,0x62,0x10,0x2a,0xb2,0xbe,0x43,0x4d,0x16,0xdc,0x31,0x38,0x75,0xfb,0x65,0x70,0xd7,0x68,0x29,0xde,0x7b,0x4a,0x0d,0x18,0x90,0x67,0xb1,0x1c,0x2b,0x2c,0xb3,0x05},
+    {0xfd,0xa8,0x4d,0xd2,0xcc,0x5e,0xc0,0xc8,0x83,0xef,0xdf,0x05,0xac,0x1a,0xcf,0xa1,0x61,0xcd,0xf9,0x7d,0xf2,0xef,0xbe,0xdb,0x99,0x1e,0x47,0x7b,0xa3,0x56,0x55,0x3b,0x95,0x81,0xd5,0x7a,0x2c,0xa4,0xfc,0xf7,0xcc,0xf3,0x33,0x43,0x6e,0x28,0x14,0x32,0x9d,0x97,0x0b,0x34,0x0d,0x9d,0xc2,0xb6,0xe1,0x07,0x73,0x56,0x48,0x1a,0x77,0x31,0x82,0xd4,0x4d,0xe1,0x24,0xc5,0xb0,0x32,0xb6,0xa4,0x2b,0x1a,0x54,0x51,0xb3,0xed,0xf3,0x5a,0x2b,0x28,0x48,0x60,0xd1,0xa3,0xeb,0x36,0x73,0x7a,0xd2,0x79,0xc0,0x4f},
+    {0x7f,0x2f,0xbf,0x89,0xb0,0x38,0xc9,0x51,0xa7,0xe9,0xdf,0x02,0x65,0xbd,0x97,0x24,0x53,0xe4,0x80,0x78,0x9c,0xc0,0xff,0xff,0x92,0x8e,0xf9,0xca,0xce,0x67,0x45,0x12,0x0d,0xc5,0x86,0x0c,0x44,0x8b,0x34,0xdc,0x51,0xe6,0x94,0xcc,0xc9,0xcb,0x37,0x13,0xb9,0x3c,0x3e,0x64,0x4d,0xf7,0x22,0x64,0x08,0xcd,0xe3,0xba,0xc2,0x70,0x11,0x24,0xb4,0x73,0xc4,0x0a,0x86,0xab,0xf9,0x3f,0x35,0xe4,0x13,0x01,0xee,0x1d,0x91,0xf0,0xaf,0xc4,0xc6,0xeb,0x60,0x50,0xe7,0x4a,0x0d,0x00,0x87,0x6c,0x96,0x12,0x86,0x3f},
+    {0xde,0x0d,0x2a,0x78,0xc9,0x0c,0x9a,0x55,0x85,0x83,0x71,0xea,0xb2,0xcd,0x1d,0x55,0x8c,0x23,0xef,0x31,0x5b,0x86,0x62,0x7f,0x3d,0x61,0x73,0x79,0x76,0xa7,0x4a,0x50,0x13,0x8d,0x04,0x36,0xfa,0xfc,0x18,0x9c,0xdd,0x9d,0x89,0x73,0xb3,0x9d,0x15,0x29,0xaa,0xd0,0x92,0x9f,0x0b,0x35,0x9f,0xdc,0xd4,0x19,0x8a,0x87,0xee,0x7e,0xf5,0x26,0xb1,0xef,0x87,0x56,0xd5,0x2c,0xab,0x0c,0x7b,0xf1,0x7a,0x24,0x62,0xd1,0x80,0x51,0x67,0x24,0x5a,0x4f,0x34,0x5a,0xc1,0x85,0x69,0x30,0xba,0x9d,0x3d,0x94,0x41,0x40},
+    {0x96,0xcc,0xeb,0x43,0xba,0xee,0xc0,0xc3,0xaf,0x9c,0xea,0x26,0x9c,0x9c,0x74,0x8d,0xc6,0xcc,0x77,0x1c,0xee,0x95,0xfa,0xd9,0x0f,0x34,0x84,0x76,0xd9,0xa1,0x20,0x14,0xdd,0xaa,0x6c,0xa2,0x43,0x77,0x21,0x4b,0xce,0xb7,0x8a,0x64,0x24,0xb4,0xa6,0x47,0xe3,0xc9,0xfb,0x03,0x7a,0x4f,0x1d,0xcb,0x19,0xd0,0x00,0x98,0x42,0x31,0xd9,0x12,0x4f,0x59,0x37,0xd3,0x99,0x77,0xc6,0x00,0x7b,0xa4,0x3a,0xb2,0x40,0x51,0x3c,0x5e,0x95,0xf3,0x5f,0xe3,0x54,0x28,0x18,0x44,0x12,0xa0,0x59,0x43,0x31,0x92,0x4f,0x1b},
+    {0x51,0x09,0x15,0x89,0x9d,0x10,0x5c,0x3e,0x6a,0x69,0xe9,0x2d,0x91,0xfa,0xce,0x39,0x20,0x30,0x5f,0x97,0x3f,0xe4,0xea,0x20,0xae,0x2d,0x13,0x7f,0x2a,0x57,0x9b,0x23,0xb1,0x66,0x98,0xa4,0x30,0x30,0xcf,0x33,0x59,0x48,0x5f,0x21,0xd2,0x73,0x1f,0x25,0xf6,0xf4,0xde,0x51,0x40,0xaa,0x82,0xab,0xf6,0x23,0x9a,0x6f,0xd5,0x91,0xf1,0x5f,0x68,0x90,0x2d,0xac,0x33,0xd4,0x9e,0x81,0x23,0x85,0xc9,0x5f,0x79,0xab,0x83,0x28,0x3d,0xeb,0x93,0x55,0x80,0x72,0x45,0xef,0xcb,0x36,0x8f,0x75,0x6a,0x52,0x0c,0x02},
+    {0xbc,0xdb,0xd8,0x9e,0xf8,0x34,0x98,0x77,0x6c,0xa4,0x7c,0xdc,0xf9,0xaa,0xf2,0xc8,0x74,0xb0,0xe1,0xa3,0xdc,0x4c,0x52,0xa9,0x77,0x38,0x31,0x15,0x46,0xcc,0xaa,0x02,0x89,0xcc,0x42,0xf0,0x59,0xef,0x31,0xe9,0xb6,0x4b,0x12,0x8e,0x9d,0x9c,0x58,0x2c,0x97,0x59,0xc7,0xae,0x8a,0xe1,0xc8,0xad,0x0c,0xc5,0x02,0x56,0x0a,0xfe,0x2c,0x45,0xdf,0x77,0x78,0x64,0xa0,0xf7,0xa0,0x86,0x9f,0x7c,0x60,0x0e,0x27,0x64,0xc4,0xbb,0xc9,0x11,0xfb,0xf1,0x25,0xea,0x17,0xab,0x7b,0x87,0x4b,0x30,0x7b,0x7d,0xfb,0x4c},
+    {0xfe,0x75,0x9b,0xb8,0x6c,0x3d,0xb4,0x72,0x80,0xdc,0x6a,0x9c,0xd9,0x94,0xc6,0x54,0x9f,0x4c,0xe3,0x3e,0x37,0xaa,0xc3,0xb8,0x64,0x53,0x07,0x39,0x2b,0x62,0xb4,0x14,0x12,0xef,0x89,0x97,0xc2,0x99,0x86,0xe2,0x0d,0x19,0x57,0xdf,0x71,0xcd,0x6e,0x2b,0xd0,0x70,0xc9,0xec,0x57,0xc8,0x43,0xc3,0xc5,0x3a,0x4d,0x43,0xbc,0x4c,0x1d,0x5b,0x26,0x9f,0x0a,0xcc,0x15,0x26,0xfb,0xb6,0xe5,0xcc,0x8d,0xb8,0x2b,0x0e,0x4f,0x3a,0x05,0xa7,0x69,0x33,0x8b,0x49,0x01,0x13,0xd1,0x2d,0x59,0x58,0x12,0xf7,0x98,0x2f},
+    {0x56,0x9e,0x0f,0xb5,0x4c,0xa7,0x94,0x0c,0x20,0x13,0x8e,0x8e,0xa9,0xf4,0x1f,0x5b,0x67,0x0f,0x30,0x82,0x21,0xcc,0x2a,0x9a,0xf9,0xaa,0x06,0xd8,0x49,0xe2,0x6a,0x3a,0x01,0xa7,0x54,0x4f,0x44,0xae,0x12,0x2e,0xde,0xd7,0xcb,0xa9,0xf0,0x3e,0xfe,0xfc,0xe0,0x5d,0x83,0x75,0x0d,0x89,0xbf,0xce,0x54,0x45,0x61,0xe7,0xe9,0x62,0x80,0x1d,0x5a,0x7c,0x90,0xa9,0x85,0xda,0x7a,0x65,0x62,0x0f,0xb9,0x91,0xb5,0xa8,0x0e,0x1a,0xe9,0xb4,0x34,0xdf,0xfb,0x1d,0x0e,0x8d,0xf3,0x5f,0xf2,0xae,0xe8,0x8c,0x8b,0x29},
+    {0xb2,0x0c,0xf7,0xef,0x53,0x79,0x92,0x2a,0x76,0x70,0x15,0x79,0x2a,0xc9,0x89,0x4b,0x6a,0xcf,0xa7,0x30,0x7a,0x45,0x18,0x94,0x85,0xe4,0x5c,0x4d,0x40,0xa8,0xb8,0x34,0xde,0x65,0x21,0x0a,0xea,0x72,0x7a,0x83,0xf6,0x79,0xcf,0x0b,0xb4,0x07,0xab,0x3f,0x70,0xae,0x38,0x77,0xc7,0x36,0x16,0x52,0xdc,0xd7,0xa7,0x03,0x18,0x27,0xa6,0x6b,0x35,0x33,0x69,0x83,0xb5,0xec,0x6e,0xc2,0xfd,0xfe,0xb5,0x63,0xdf,0x13,0xa8,0xd5,0x73,0x25,0xb2,0xa4,0x9a,0xaa,0x93,0xa2,0x6a,0x1c,0x5e,0x46,0xdd,0x2b,0xd6,0x71},
+    {0x80,0xdf,0x78,0xd3,0x28,0xcc,0x33,0x65,0xb4,0xa4,0x0f,0x0a,0x79,0x43,0xdb,0xf6,0x5a,0xda,0x01,0xf7,0xf9,0x5f,0x64,0xe3,0xa4,0x2b,0x17,0xf3,0x17,0xf3,0xd5,0x74,0xf5,0x5e,0xf7,0xb1,0xda,0xb5,0x2d,0xcd,0xf5,0x65,0xb0,0x16,0xcf,0x95,0x7f,0xd7,0x85,0xf0,0x49,0x3f,0xea,0x1f,0x57,0x14,0x3d,0x2b,0x2b,0x26,0x21,0x36,0x33,0x1c,0x81,0xca,0xd9,0x67,0x54,0xe5,0x6f,0xa8,0x37,0x8c,0x29,0x2b,0x75,0x7c,0x8b,0x39,0x3b,0x62,0xac,0xe3,0x92,0x08,0x6d,0xda,0x8c,0xd9,0xe9,0x47,0x45,0xcc,0xeb,0x4a},
+    {0xc9,0x01,0x6d,0x27,0x1b,0x07,0xf0,0x12,0x70,0x8c,0xc4,0x86,0xc5,0xba,0xb8,0xe7,0xa9,0xfb,0xd6,0x71,0x9b,0x12,0x08,0x53,0x92,0xb7,0x3d,0x5a,0xf9,0xfb,0x88,0x5d,0x10,0xb6,0x54,0x73,0x9e,0x8d,0x40,0x0b,0x6e,0x5b,0xa8,0x5b,0x53,0x32,0x6b,0x80,0x07,0xa2,0x58,0x4a,0x03,0x3a,0xe6,0xdb,0x2c,0xdf,0xa1,0xc9,0xdd,0xd9,0x3b,0x17,0xdf,0x72,0x58,0xfe,0x1e,0x0f,0x50,0x2b,0xc1,0x18,0x39,0xd4,0x2e,0x58,0xd6,0x58,0xe0,0x3a,0x67,0xc9,0x8e,0x27,0xed,0xe6,0x19,0xa3,0x9e,0xb1,0x13,0xcd,0xe1,0x06},
+    {0x23,0x6f,0x16,0x6f,0x51,0xad,0xd0,0x40,0xbe,0x6a,0xab,0x1f,0x93,0x32,0x8e,0x11,0x8e,0x08,0x4d,0xa0,0x14,0x5e,0xe3,0x3f,0x66,0x62,0xe1,0x26,0x35,0x60,0x80,0x30,0x53,0x03,0x5b,0x9e,0x62,0xaf,0x2b,0x47,0x47,0x04,0x8d,0x27,0x90,0x0b,0xaa,0x3b,0x27,0xbf,0x43,0x96,0x46,0x5f,0x78,0x0c,0x13,0x7b,0x83,0x8d,0x1a,0x6a,0x3a,0x7f,0x0b,0x80,0x3d,0x5d,0x39,0x44,0xe6,0xf7,0xf6,0xed,0x01,0xc9,0x55,0xd5,0xa8,0x95,0x39,0x63,0x2c,0x59,0x30,0x78,0xcd,0x68,0x7e,0x30,0x51,0x2e,0xed,0xfd,0xd0,0x30},
+    {0xb3,0x33,0x12,0xf2,0x1a,0x4d,0x59,0xe0,0x9c,0x4d,0xcc,0xf0,0x8e,0xe7,0xdb,0x1b,0x77,0x9a,0x49,0x8f,0x7f,0x18,0x65,0x69,0x68,0x98,0x09,0x2c,0x20,0x14,0x92,0x0a,0x50,0x47,0xb8,0x68,0x1e,0x97,0xb4,0x9c,0xcf,0xbb,0x64,0x66,0x29,0x72,0x95,0xa0,0x2b,0x41,0xfa,0x72,0x26,0xe7,0x8d,0x5c,0xd9,0x89,0xc5,0x51,0x43,0x08,0x15,0x46,0x2e,0xa0,0xb9,0xae,0xc0,0x19,0x90,0xbc,0xae,0x4c,0x03,0x16,0x0d,0x11,0xc7,0x55,0xec,0x32,0x99,0x65,0x01,0xf5,0x6d,0x0e,0xfe,0x5d,0xca,0x95,0x28,0x0d,0xca,0x3b},
+    {0xa4,0x62,0x5d,0x3c,0xbc,0x31,0xf0,0x40,0x60,0x7a,0xf0,0xcf,0x3e,0x8b,0xfc,0x19,0x45,0xb5,0x0f,0x13,0xa2,0x3d,0x18,0x98,0xcd,0x13,0x8f,0xae,0xdd,0xde,0x31,0x56,0xbf,0x01,0xcc,0x9e,0xb6,0x8e,0x68,0x9c,0x6f,0x89,0x44,0xa6,0xad,0x83,0xbc,0xf0,0xe2,0x9f,0x7a,0x5f,0x5f,0x95,0x2d,0xca,0x41,0x82,0xf2,0x8d,0x03,0xb4,0xa8,0x4e,0x02,0xd2,0xca,0xf1,0x0a,0x46,0xed,0x2a,0x83,0xee,0x8c,0xa4,0x05,0x53,0x30,0x46,0x5f,0x1a,0xf1,0x49,0x45,0x77,0x21,0x91,0x63,0xa4,0x2c,0x54,0x30,0x09,0xce,0x24},
+    {0x06,0xc1,0x06,0xfd,0xf5,0x90,0xe8,0x1f,0xf2,0x10,0x88,0x5d,0x35,0x68,0xc4,0xb5,0x3e,0xaf,0x8c,0x6e,0xfe,0x08,0x78,0x82,0x4b,0xd7,0x06,0x8a,0xc2,0xe3,0xd4,0x41,0x85,0x0b,0xf3,0xfd,0x55,0xa1,0xcf,0x3f,0xa4,0x2e,0x37,0x36,0x8e,0x16,0xf7,0xd2,0x44,0xf8,0x92,0x64,0xde,0x64,0xe0,0xb2,0x80,0x42,0x4f,0x32,0xa7,0x28,0x99,0x54,0x2e,0x1a,0xee,0x63,0xa7,0x32,0x6e,0xf2,0xea,0xfd,0x5f,0xd2,0xb7,0xe4,0x91,0xae,0x69,0x4d,0x7f,0xd1,0x3b,0xd3,0x3b,0xbc,0x6a,0xff,0xdc,0xc0,0xde,0x66,0x1b,0x49},
+    {0xa7,0x32,0xea,0xc7,0x3d,0xb1,0xf5,0x98,0x98,0xdb,0x16,0x7e,0xcc,0xf8,0xd5,0xe3,0x47,0xd9,0xf8,0xcb,0x52,0xbf,0x0a,0xac,0xac,0xe4,0x5e,0xc8,0xd0,0x38,0xf3,0x08,0xa1,0x64,0xda,0xd0,0x8e,0x4a,0xf0,0x75,0x4b,0x28,0xe2,0x67,0xaf,0x2c,0x22,0xed,0xa4,0x7b,0x7b,0x1f,0x79,0xa3,0x34,0x82,0x67,0x8b,0x01,0xb7,0xb0,0xb8,0xf6,0x4c,0xbd,0x73,0x1a,0x99,0x21,0xa8,0x83,0xc3,0x7a,0x0c,0x32,0xdf,0x01,0xbc,0x27,0xab,0x63,0x70,0x77,0x84,0x1b,0x33,0x3d,0xc1,0x99,0x8a,0x07,0xeb,0x82,0x4a,0x0d,0x53},
+    {0x25,0x48,0xf9,0xe1,0x30,0x36,0x4c,0x00,0x5a,0x53,0xab,0x8c,0x26,0x78,0x2d,0x7e,0x8b,0xff,0x84,0xcc,0x23,0x23,0x48,0xc7,0xb9,0x70,0x17,0x10,0x3f,0x75,0xea,0x65,0x9e,0xbf,0x9a,0x6c,0x45,0x73,0x69,0x6d,0x80,0xa8,0x00,0x49,0xfc,0xb2,0x7f,0x25,0x50,0xb8,0xcf,0xc8,0x12,0xf4,0xac,0x2b,0x5b,0xbd,0xbf,0x0c,0xe0,0xe7,0xb3,0x0d,0x63,0x63,0x09,0xe2,0x3e,0xfc,0x66,0x3d,0x6b,0xcb,0xb5,0x61,0x7f,0x2c,0xd6,0x81,0x1a,0x3b,0x44,0x13,0x42,0x04,0xbe,0x0f,0xdb,0xa1,0xe1,0x21,0x19,0xec,0xa4,0x02},
+    {0xa2,0xb8,0x24,0x3b,0x9a,0x25,0xe6,0x5c,0xb8,0xa0,0xaf,0x45,0xcc,0x7a,0x57,0xb8,0x37,0x70,0xa0,0x8b,0xe8,0xe6,0xcb,0xcc,0xbf,0x09,0x78,0x12,0x51,0x3c,0x14,0x3d,0x5f,0x79,0xcf,0xf1,0x62,0x61,0xc8,0xf5,0xf2,0x57,0xee,0x26,0x19,0x86,0x8c,0x11,0x78,0x35,0x06,0x1c,0x85,0x24,0x21,0x17,0xcf,0x7f,0x06,0xec,0x5d,0x2b,0xd1,0x36,0x57,0x45,0x15,0x79,0x91,0x27,0x6d,0x12,0x0a,0x3a,0x78,0xfc,0x5c,0x8f,0xe4,0xd5,0xac,0x9b,0x17,0xdf,0xe8,0xb6,0xbd,0x36,0x59,0x28,0xa8,0x5b,0x88,0x17,0xf5,0x2e},
+    {0xdc,0xae,0x58,0x8c,0x4e,0x97,0x37,0x46,0xa4,0x41,0xf0,0xab,0xfb,0x22,0xef,0xb9,0x8a,0x71,0x80,0xe9,0x56,0xd9,0x85,0xe1,0xa6,0xa8,0x43,0xb1,0xfa,0x78,0x1b,0x2f,0x51,0x2f,0x5b,0x30,0xfb,0xbf,0xee,0x96,0xb8,0x96,0x95,0x88,0xad,0x38,0xf9,0xd3,0x25,0xdd,0xd5,0x46,0xc7,0x2d,0xf5,0xf0,0x95,0x00,0x3a,0xbb,0x90,0x82,0x96,0x57,0x01,0xe1,0x20,0x0a,0x43,0xb8,0x1a,0xf7,0x47,0xec,0xf0,0x24,0x8d,0x65,0x93,0xf3,0xd1,0xee,0xe2,0x6e,0xa8,0x09,0x75,0xcf,0xe1,0xa3,0x2a,0xdc,0x35,0x3e,0xc4,0x7d},
+    {0xc3,0xd9,0x7d,0x88,0x65,0x66,0x96,0x85,0x55,0x53,0xb0,0x4b,0x31,0x9b,0x0f,0xc9,0xb1,0x79,0x20,0xef,0xf8,0x8d,0xe0,0xc6,0x2f,0xc1,0x8c,0x75,0x16,0x20,0xf7,0x7e,0x18,0x97,0x3e,0x27,0x5c,0x2a,0x78,0x5a,0x94,0xfd,0x4e,0x5e,0x99,0xc6,0x76,0x35,0x3e,0x7d,0x23,0x1f,0x05,0xd8,0x2e,0x0f,0x99,0x0a,0xd5,0x82,0x1d,0xb8,0x4f,0x04,0xd9,0xe3,0x07,0xa9,0xc5,0x18,0xdf,0xc1,0x59,0x63,0x4c,0xce,0x1d,0x37,0xb3,0x57,0x49,0xbb,0x01,0xb2,0x34,0x45,0x70,0xca,0x2e,0xdd,0x30,0x9c,0x3f,0x82,0x79,0x7f},
+    {0xe8,0x13,0xb5,0xa3,0x39,0xd2,0x34,0x83,0xd8,0xa8,0x1f,0xb9,0xd4,0x70,0x36,0xc1,0x33,0xbd,0x90,0xf5,0x36,0x41,0xb5,0x12,0xb4,0xd9,0x84,0xd7,0x73,0x03,0x4e,0x0a,0xba,0x87,0xf5,0x68,0xf0,0x1f,0x9c,0x6a,0xde,0xc8,0x50,0x00,0x4e,0x89,0x27,0x08,0xe7,0x5b,0xed,0x7d,0x55,0x99,0xbf,0x3c,0xf0,0xd6,0x06,0x1c,0x43,0xb0,0xa9,0x64,0x19,0x29,0x7d,0x5b,0xa1,0xd6,0xb3,0x2e,0x35,0x82,0x3a,0xd5,0xa0,0xf6,0xb4,0xb0,0x47,0x5d,0xa4,0x89,0x43,0xce,0x56,0x71,0x6c,0x34,0x18,0xce,0x0a,0x7d,0x1a,0x07},
+    {0x0b,0xba,0x87,0xc8,0xaa,0x2d,0x07,0xd3,0xee,0x62,0xa5,0xbf,0x05,0x29,0x26,0x01,0x8b,0x76,0xef,0xc0,0x02,0x30,0x54,0xcf,0x9c,0x7e,0xea,0x46,0x71,0xcc,0x3b,0x2c,0x31,0x44,0xe1,0x20,0x52,0x35,0x0c,0xcc,0x41,0x51,0xb1,0x09,0x07,0x95,0x65,0x0d,0x36,0x5f,0x9d,0x20,0x1b,0x62,0xf5,0x9a,0xd3,0x55,0x77,0x61,0xf7,0xbc,0x69,0x7c,0x5f,0x29,0xe8,0x04,0xeb,0xd7,0xf0,0x07,0x7d,0xf3,0x50,0x2f,0x25,0x18,0xdb,0x10,0xd7,0x98,0x17,0x17,0xa3,0xa9,0x51,0xe9,0x1d,0xa5,0xac,0x22,0x73,0x9a,0x5a,0x6f},
+    {0xc5,0xc6,0x41,0x2f,0x0c,0x00,0xa1,0x8b,0x9b,0xfb,0xfe,0x0c,0xc1,0x79,0x9f,0xc4,0x9f,0x1c,0xc5,0x3c,0x70,0x47,0xfa,0x4e,0xca,0xaf,0x47,0xe1,0xa2,0x21,0x4e,0x49,0xbe,0x44,0xd9,0xa3,0xeb,0xd4,0x29,0xe7,0x9e,0xaf,0x78,0x80,0x40,0x09,0x9e,0x8d,0x03,0x9c,0x86,0x47,0x7a,0x56,0x25,0x45,0x24,0x3b,0x8d,0xee,0x80,0x96,0xab,0x02,0x9a,0x0d,0xe5,0xdd,0x85,0x8a,0xa4,0xef,0x49,0xa2,0xb9,0x0f,0x4e,0x22,0x9a,0x21,0xd9,0xf6,0x1e,0xd9,0x1d,0x1f,0x09,0xfa,0x34,0xbb,0x46,0xea,0xcb,0x76,0x5d,0x6b},
+    {0x94,0xd9,0x0c,0xec,0x6c,0x55,0x57,0x88,0xba,0x1d,0xd0,0x5c,0x6f,0xdc,0x72,0x64,0x77,0xb4,0x42,0x8f,0x14,0x69,0x01,0xaf,0x54,0x73,0x27,0x85,0xf6,0x33,0xe3,0x0a,0x22,0x25,0x78,0x1e,0x17,0x41,0xf9,0xe0,0xd3,0x36,0x69,0x03,0x74,0xae,0xe6,0xf1,0x46,0xc7,0xfc,0xd0,0xa2,0x3e,0x8b,0x40,0x3e,0x31,0xdd,0x03,0x9c,0x86,0xfb,0x16,0x62,0x09,0xb6,0x33,0x97,0x19,0x8e,0x28,0x33,0xe1,0xab,0xd8,0xb4,0x72,0xfc,0x24,0x3e,0xd0,0x91,0x09,0xed,0xf7,0x11,0x48,0x75,0xd0,0x70,0x8f,0x8b,0xe3,0x81,0x3f},
+    {0xfe,0xaf,0xd9,0x7e,0xcc,0x0f,0x91,0x7f,0x4b,0x87,0x65,0x24,0xa1,0xb8,0x5c,0x54,0x04,0x47,0x0c,0x4b,0xd2,0x7e,0x39,0xa8,0x93,0x09,0xf5,0x04,0xc1,0x0f,0x51,0x50,0x24,0xc8,0x17,0x5f,0x35,0x7f,0xdb,0x0a,0xa4,0x99,0x42,0xd7,0xc3,0x23,0xb9,0x74,0xf7,0xea,0xf8,0xcb,0x8b,0x3e,0x7c,0xd5,0x3d,0xdc,0xde,0x4c,0xd3,0xe2,0xd3,0x0a,0x9d,0x24,0x6e,0x33,0xc5,0x0f,0x0c,0x6f,0xd9,0xcf,0x31,0xc3,0x19,0xde,0x5e,0x74,0x1c,0xfe,0xee,0x09,0x00,0xfd,0xd6,0xf2,0xbe,0x1e,0xfa,0xf0,0x8b,0x15,0x7c,0x12},
+    {0xa2,0x79,0x98,0x2e,0x42,0x7c,0x19,0xf6,0x47,0x36,0xca,0x52,0xd4,0xdd,0x4a,0xa4,0xcb,0xac,0x4e,0x4b,0xc1,0x3f,0x41,0x9b,0x68,0x4f,0xef,0x07,0x7d,0xf8,0x4e,0x35,0x74,0xb9,0x51,0xae,0xc4,0x8f,0xa2,0xde,0x96,0xfe,0x4d,0x74,0xd3,0x73,0x99,0x1d,0xa8,0x48,0x38,0x87,0x0b,0x68,0x40,0x62,0x95,0xdf,0x67,0xd1,0x79,0x24,0xd8,0x4e,0x75,0xd9,0xc5,0x60,0x22,0xb5,0xe3,0xfe,0xb8,0xb0,0x41,0xeb,0xfc,0x2e,0x35,0x50,0x3c,0x65,0xf6,0xa9,0x30,0xac,0x08,0x88,0x6d,0x23,0x39,0x05,0xd2,0x92,0x2d,0x30},
+    {0x3d,0x28,0xa4,0xbc,0xa2,0xc1,0x13,0x78,0xd9,0x3d,0x86,0xa1,0x91,0xf0,0x62,0xed,0x86,0xfa,0x68,0xc2,0xb8,0xbc,0xc7,0xae,0x4c,0xae,0x1c,0x6f,0xb7,0xd3,0xe5,0x10,0x77,0xf1,0xe0,0xe4,0xb6,0x6f,0xbc,0x2d,0x93,0x6a,0xbd,0xa4,0x29,0xbf,0xe1,0x04,0xe8,0xf6,0x7a,0x78,0xd4,0x66,0x19,0x5e,0x60,0xd0,0x26,0xb4,0x5e,0x5f,0xdc,0x0e,0x67,0x8e,0xda,0x53,0xd6,0xbf,0x53,0x54,0x41,0xf6,0xa9,0x24,0xec,0x1e,0xdc,0xe9,0x23,0x8a,0x57,0x03,0x3b,0x26,0x87,0xbf,0x72,0xba,0x1c,0x36,0x51,0x6c,0xb4,0x45},
+    {0xa1,0x7f,0x4f,0x31,0xbf,0x2a,0x40,0xa9,0x50,0xf4,0x8c,0x8e,0xdc,0xf1,0x57,0xe2,0x84,0xbe,0xa8,0x23,0x4b,0xd5,0xbb,0x1d,0x3b,0x71,0xcb,0x6d,0xa3,0xbf,0x77,0x21,0xe4,0xe3,0x7f,0x8a,0xdd,0x4d,0x9d,0xce,0x30,0x0e,0x62,0x76,0x56,0x64,0x13,0xab,0x58,0x99,0x0e,0xb3,0x7b,0x4f,0x59,0x4b,0xdf,0x29,0x12,0x32,0xef,0x0a,0x1c,0x5c,0x8f,0xdb,0x79,0xfa,0xbc,0x1b,0x08,0x37,0xb3,0x59,0x5f,0xc2,0x1e,0x81,0x48,0x60,0x87,0x24,0x83,0x9c,0x65,0x76,0x7a,0x08,0xbb,0xb5,0x8a,0x7d,0x38,0x19,0xe6,0x4a},
+    {0x2e,0xa3,0x44,0x53,0xaa,0xf6,0xdb,0x8d,0x78,0x40,0x1b,0xb4,0xb4,0xea,0x88,0x7d,0x60,0x0d,0x13,0x4a,0x97,0xeb,0xb0,0x5e,0x03,0x3e,0xbf,0x17,0x1b,0xd9,0x00,0x1a,0x83,0xfb,0x5b,0x98,0x44,0x7e,0x11,0x61,0x36,0x31,0x96,0x71,0x2a,0x46,0xe0,0xfc,0x4b,0x90,0x25,0xd4,0x48,0x34,0xac,0x83,0x64,0x3d,0xa4,0x5b,0xbe,0x5a,0x68,0x75,0xb2,0xf2,0x61,0xeb,0x33,0x09,0x96,0x6e,0x52,0x49,0xff,0xc9,0xa8,0x0f,0x3d,0x54,0x69,0x65,0xf6,0x7a,0x10,0x75,0x72,0xdf,0xaa,0xe6,0xb0,0x23,0xb6,0x29,0x55,0x13},
+    {0x18,0xd5,0xd1,0xad,0xd7,0xdb,0xf0,0x18,0x11,0x1f,0xc1,0xcf,0x88,0x78,0x9f,0x97,0x9b,0x75,0x14,0x71,0xf0,0xe1,0x32,0x87,0x01,0x3a,0xca,0x65,0x1a,0xb8,0xb5,0x79,0xfe,0x83,0x2e,0xe2,0xbc,0x16,0xc7,0xf5,0xc1,0x85,0x09,0xe8,0x19,0xeb,0x2b,0xb4,0xae,0x4a,0x25,0x14,0x37,0xa6,0x9d,0xec,0x13,0xa6,0x90,0x15,0x05,0xea,0x72,0x59,0x11,0x78,0x8f,0xdc,0x20,0xac,0xd4,0x0f,0xa8,0x4f,0x4d,0xac,0x94,0xd2,0x9a,0x9a,0x34,0x04,0x36,0xb3,0x64,0x2d,0x1b,0xc0,0xdb,0x3b,0x5f,0x90,0x95,0x9c,0x7e,0x4f},
+    {0x2e,0x30,0x81,0x57,0xbc,0x4b,0x67,0x62,0x0f,0xdc,0xad,0x89,0x39,0x0f,0x52,0xd8,0xc6,0xd9,0xfb,0x53,0xae,0x99,0x29,0x8c,0x4c,0x8e,0x63,0x2e,0xd9,0x3a,0x99,0x31,0xfe,0x99,0x52,0x35,0x3d,0x44,0xc8,0x71,0xd7,0xea,0xeb,0xdb,0x1c,0x3b,0xcd,0x8b,0x66,0x94,0xa4,0xf1,0x9e,0x49,0x92,0x80,0xc8,0xad,0x44,0xa1,0xc4,0xee,0x42,0x19,0x92,0x49,0x23,0xae,0x19,0x53,0xac,0x7d,0x92,0x3e,0xea,0x0c,0x91,0x3d,0x1b,0x2c,0x22,0x11,0x3c,0x25,0x94,0xe4,0x3c,0x55,0x75,0xca,0xf9,0x4e,0x31,0x65,0x0a,0x2a},
+    {0xc2,0x27,0xf9,0xf7,0x7f,0x93,0xb7,0x2d,0x35,0xa6,0xd0,0x17,0x06,0x1f,0x74,0xdb,0x76,0xaf,0x55,0x11,0xa2,0xf3,0x82,0x59,0xed,0x2d,0x7c,0x64,0x18,0xe2,0xf6,0x4c,0x3a,0x79,0x1c,0x3c,0xcd,0x1a,0x36,0xcf,0x3b,0xbc,0x35,0x5a,0xac,0xbc,0x9e,0x2f,0xab,0xa6,0xcd,0xa8,0xe9,0x60,0xe8,0x60,0x13,0x1a,0xea,0x6d,0x9b,0xc3,0x5d,0x05,0xb6,0x5b,0x8d,0xc2,0x7c,0x22,0x19,0xb1,0xab,0xff,0x4d,0x77,0xbc,0x4e,0xe2,0x07,0x89,0x2c,0xa3,0xe4,0xce,0x78,0x3c,0xa8,0xb6,0x24,0xaa,0x10,0x77,0x30,0x1a,0x12},
+    {0x97,0x4a,0x03,0x9f,0x5e,0x5d,0xdb,0xe4,0x2d,0xbc,0x34,0x30,0x09,0xfc,0x53,0xe1,0xb1,0xd3,0x51,0x95,0x91,0x46,0x05,0x46,0x2d,0xe5,0x40,0x7a,0x6c,0xc7,0x3f,0x33,0xc9,0x83,0x74,0xc7,0x3e,0x71,0x59,0xd6,0xaf,0x96,0x2b,0xb8,0x77,0xe0,0xbf,0x88,0xd3,0xbc,0x97,0x10,0x23,0x28,0x9e,0x28,0x9b,0x3a,0xed,0x6c,0x4a,0xb9,0x7b,0x52,0x2e,0x48,0x5b,0x99,0x2a,0x99,0x3d,0x56,0x01,0x38,0x38,0x6e,0x7c,0xd0,0x05,0x34,0xe5,0xd8,0x64,0x2f,0xde,0x35,0x50,0x48,0xf7,0xa9,0xa7,0x20,0x9b,0x06,0x89,0x6b},
+    {0x0d,0x22,0x70,0x62,0x41,0xa0,0x2a,0x81,0x4e,0x5b,0x24,0xf9,0xfa,0x89,0x5a,0x99,0x05,0xef,0x72,0x50,0xce,0xc4,0xad,0xff,0x73,0xeb,0x73,0xaa,0x03,0x21,0xbc,0x23,0x77,0xdb,0xc7,0xb5,0x8c,0xfa,0x82,0x40,0x55,0xc1,0x34,0xc7,0xf8,0x86,0x86,0x06,0x7e,0xa5,0xe7,0xf6,0xd9,0xc8,0xe6,0x29,0xcf,0x9b,0x63,0xa7,0x08,0xd3,0x73,0x04,0x05,0x9e,0x58,0x03,0x26,0x79,0xee,0xca,0x92,0xc4,0xdc,0x46,0x12,0x42,0x4b,0x2b,0x4f,0xa9,0x01,0xe6,0x74,0xef,0xa1,0x02,0x1a,0x34,0x04,0xde,0xbf,0x73,0x2f,0x10},
+    {0xc6,0x45,0x57,0x7f,0xab,0xb9,0x18,0xeb,0x90,0xc6,0x87,0x57,0xee,0x8a,0x3a,0x02,0xa9,0xaf,0xf7,0x2d,0xda,0x12,0x27,0xb7,0x3d,0x01,0x5c,0xea,0x25,0x7d,0x59,0x36,0x9a,0x1c,0x51,0xb5,0xe0,0xda,0xb4,0xa2,0x06,0xff,0xff,0x2b,0x29,0x60,0xc8,0x7a,0x34,0x42,0x50,0xf5,0x5d,0x37,0x1f,0x98,0x2d,0xa1,0x4e,0xda,0x25,0xd7,0x6b,0x3f,0xac,0x58,0x60,0x10,0x7b,0x8d,0x4d,0x73,0x5f,0x90,0xc6,0x6f,0x9e,0x57,0x40,0xd9,0x2d,0x93,0x02,0x92,0xf9,0xf8,0x66,0x64,0xd0,0xd6,0x60,0xda,0x19,0xcc,0x7e,0x7b},
+    {0x0d,0x69,0x5c,0x69,0x3c,0x37,0xc2,0x78,0x6e,0x90,0x42,0x06,0x66,0x2e,0x25,0xdd,0xd2,0x2b,0xe1,0x4a,0x44,0x44,0x1d,0x95,0x56,0x39,0x74,0x01,0x76,0xad,0x35,0x42,0x9b,0xfa,0x7c,0xa7,0x51,0x4a,0xae,0x6d,0x50,0x86,0xa3,0xe7,0x54,0x36,0x26,0x82,0xdb,0x82,0x2d,0x8f,0xcd,0xff,0xbb,0x09,0xba,0xca,0xf5,0x1b,0x66,0xdc,0xbe,0x03,0xf5,0x75,0x89,0x07,0x0d,0xcb,0x58,0x62,0x98,0xf2,0x89,0x91,0x54,0x42,0x29,0x49,0xe4,0x6e,0xe3,0xe2,0x23,0xb4,0xca,0xa0,0xa1,0x66,0xf0,0xcd,0xb0,0xe2,0x7c,0x0e},
+    {0xa3,0x85,0x8c,0xc4,0x3a,0x64,0x94,0xc4,0xad,0x39,0x61,0x3c,0xf4,0x1d,0x36,0xfd,0x48,0x4d,0xe9,0x3a,0xdd,0x17,0xdb,0x09,0x4a,0x67,0xb4,0x8f,0x5d,0x0a,0x6e,0x66,0xf9,0x70,0x4b,0xd9,0xdf,0xfe,0xa6,0xfe,0x2d,0xba,0xfc,0xc1,0x51,0xc0,0x30,0xf1,0x89,0xab,0x2f,0x7f,0x7e,0xd4,0x82,0x48,0xb5,0xee,0xec,0x8a,0x13,0x56,0x52,0x61,0x0d,0xcb,0x70,0x48,0x4e,0xf6,0xbb,0x2a,0x6b,0x8b,0x45,0xaa,0xf0,0xbc,0x65,0xcd,0x5d,0x98,0xe8,0x75,0xba,0x4e,0xbe,0x9a,0xe4,0xde,0x14,0xd5,0x10,0xc8,0x0b,0x7f},
+    {0x6f,0x13,0xf4,0x26,0xa4,0x6b,0x00,0xb9,0x35,0x30,0xe0,0x57,0x9e,0x36,0x67,0x8d,0x28,0x3c,0x46,0x4f,0xd9,0xdf,0xc8,0xcb,0xf5,0xdb,0xee,0xf8,0xbc,0x8d,0x1f,0x0d,0xa0,0x13,0x72,0x73,0xad,0x9d,0xac,0x83,0x98,0x2e,0xf7,0x2e,0xba,0xf8,0xf6,0x9f,0x57,0x69,0xec,0x43,0xdd,0x2e,0x1e,0x31,0x75,0xab,0xc5,0xde,0x7d,0x90,0x3a,0x1d,0xdc,0x81,0xd0,0x3e,0x31,0x93,0x16,0xba,0x80,0x34,0x1b,0x85,0xad,0x9f,0x32,0x29,0xcb,0x21,0x03,0x03,0x3c,0x01,0x28,0x01,0xe3,0xfd,0x1b,0xa3,0x44,0x1b,0x01,0x00},
+    {0x0c,0x6c,0xc6,0x3f,0x6c,0xa0,0xdf,0x3f,0xd2,0x0d,0xd6,0x4d,0x8e,0xe3,0x40,0x5d,0x71,0x4d,0x8e,0x26,0x38,0x8b,0xe3,0x7a,0xe1,0x57,0x83,0x6e,0x91,0x8d,0xc4,0x3a,0x5c,0xa7,0x0a,0x6a,0x69,0x1f,0x56,0x16,0x6a,0xbd,0x52,0x58,0x5c,0x72,0xbf,0xc1,0xad,0x66,0x79,0x9a,0x7f,0xdd,0xa8,0x11,0x26,0x10,0x85,0xd2,0xa2,0x88,0xd9,0x63,0x2e,0x23,0xbd,0xaf,0x53,0x07,0x12,0x00,0x83,0xf6,0xd8,0xfd,0xb8,0xce,0x2b,0xe9,0x91,0x2b,0xe7,0x84,0xb3,0x69,0x16,0xf8,0x66,0xa0,0x68,0x23,0x2b,0xd5,0xfa,0x33},
+    {0x16,0x1e,0xe4,0xc5,0xc6,0x49,0x06,0x54,0x35,0x77,0x3f,0x33,0x30,0x64,0xf8,0x0a,0x46,0xe7,0x05,0xf3,0xd2,0xfc,0xac,0xb2,0xa7,0xdc,0x56,0xa2,0x29,0xf4,0xc0,0x16,0xe8,0xcf,0x22,0xc4,0xd0,0xc8,0x2c,0x8d,0xcb,0x3a,0xa1,0x05,0x7b,0x4f,0x2b,0x07,0x6f,0xa5,0xf6,0xec,0xe6,0xb6,0xfe,0xa3,0xe2,0x71,0x0a,0xb9,0xcc,0x55,0xc3,0x3c,0x31,0x91,0x3e,0x90,0x43,0x94,0xb6,0xe9,0xce,0x37,0x56,0x7a,0xcb,0x94,0xa4,0xb8,0x44,0x92,0xba,0xba,0xa4,0xd1,0x7c,0xc8,0x68,0x75,0xae,0x6b,0x42,0xaf,0x1e,0x63},
+    {0x9f,0xfe,0x66,0xda,0x10,0x04,0xe9,0xb3,0xa6,0xe5,0x16,0x6c,0x52,0x4b,0xdd,0x85,0x83,0xbf,0xf9,0x1e,0x61,0x97,0x3d,0xbc,0xb5,0x19,0xa9,0x1e,0x8b,0x64,0x99,0x55,0xe8,0x0d,0x70,0xa3,0xb9,0x75,0xd9,0x47,0x52,0x05,0xf8,0xe2,0xfb,0xc5,0x80,0x72,0xe1,0x5d,0xe4,0x32,0x27,0x8f,0x65,0x53,0xb5,0x80,0x5f,0x66,0x7f,0x2c,0x1f,0x43,0x19,0x7b,0x8f,0x85,0x44,0x63,0x02,0xd6,0x4a,0x51,0xea,0xa1,0x2f,0x35,0xab,0x14,0xd7,0xa9,0x90,0x20,0x1a,0x44,0x00,0x89,0x26,0x3b,0x25,0x91,0x5f,0x71,0x04,0x7b},
+    {0x43,0xae,0xf6,0xac,0x28,0xbd,0xed,0x83,0xb4,0x7a,0x5c,0x7d,0x8b,0x7c,0x35,0x86,0x44,0x2c,0xeb,0xb7,0x69,0x47,0x40,0xc0,0x3f,0x58,0xf6,0xc2,0xf5,0x7b,0xb3,0x59,0xc6,0xba,0xe6,0xc4,0x80,0xc2,0x76,0xb3,0x0b,0x9b,0x1d,0x6d,0xdd,0xd3,0x0e,0x97,0x44,0xf9,0x0b,0x45,0x58,0x95,0x9a,0xb0,0x23,0xe2,0xcd,0x57,0xfa,0xac,0xd0,0x48,0x71,0xe6,0xab,0x7d,0xe4,0x26,0x0f,0xb6,0x37,0x3a,0x2f,0x62,0x97,0xa1,0xd1,0xf1,0x94,0x03,0x96,0xe9,0x7e,0xce,0x08,0x42,0xdb,0x3b,0x6d,0x33,0x91,0x41,0x23,0x16},
+    {0xf6,0x7f,0x26,0xf6,0xde,0x99,0xe4,0xb9,0x43,0x08,0x2c,0x74,0x7b,0xca,0x72,0x77,0xb1,0xf2,0xa4,0xe9,0x3f,0x15,0xa0,0x23,0x06,0x50,0xd0,0xd5,0xec,0xdf,0xdf,0x2c,0x40,0x86,0xf3,0x1f,0xd6,0x9c,0x49,0xdd,0xa0,0x25,0x36,0x06,0xc3,0x9b,0xcd,0x29,0xc3,0x3d,0xd7,0x3d,0x02,0xd8,0xe2,0x51,0x31,0x92,0x3b,0x20,0x7a,0x70,0x25,0x4a,0x6a,0xed,0xf6,0x53,0x8a,0x66,0xb7,0x2a,0xa1,0x70,0xd1,0x1d,0x58,0x42,0x42,0x30,0x61,0x01,0xe2,0x3a,0x4c,0x14,0x00,0x40,0xfc,0x49,0x8e,0x24,0x6d,0x89,0x21,0x57},
+    {0xae,0x1b,0x18,0xfd,0x17,0x55,0x6e,0x0b,0xb4,0x63,0xb9,0x2b,0x9f,0x62,0x22,0x90,0x25,0x46,0x06,0x32,0xe9,0xbc,0x09,0x55,0xda,0x13,0x3c,0xf6,0x74,0xdd,0x8e,0x57,0x4e,0xda,0xd0,0xa1,0x91,0x50,0x5d,0x28,0x08,0x3e,0xfe,0xb5,0xa7,0x6f,0xaa,0x4b,0xb3,0x93,0x93,0xe1,0x7c,0x17,0xe5,0x63,0xfd,0x30,0xb0,0xc4,0xaf,0x35,0xc9,0x03,0x3d,0x0c,0x2b,0x49,0xc6,0x76,0x72,0x99,0xfc,0x05,0xe2,0xdf,0xc4,0xc2,0xcc,0x47,0x3c,0x3a,0x62,0xdd,0x84,0x9b,0xd2,0xdc,0xa2,0xc7,0x88,0x02,0x59,0xab,0xc2,0x3e},
+    {0xb9,0x7b,0xd8,0xe4,0x7b,0xd2,0xa0,0xa1,0xed,0x1a,0x39,0x61,0xeb,0x4d,0x8b,0xa9,0x83,0x9b,0xcb,0x73,0xd0,0xdd,0xa0,0x99,0xce,0xca,0x0f,0x20,0x5a,0xc2,0xd5,0x2d,0xcb,0xd1,0x32,0xae,0x09,0x3a,0x21,0xa7,0xd5,0xc2,0xf5,0x40,0xdf,0x87,0x2b,0x0f,0x29,0xab,0x1e,0xe8,0xc6,0xa4,0xae,0x0b,0x5e,0xac,0xdb,0x6a,0x6c,0xf6,0x1b,0x0e,0x7e,0x88,0x2c,0x79,0xe9,0xd5,0xab,0xe2,0x5d,0x6d,0x92,0xcb,0x18,0x00,0x02,0x1a,0x1e,0x5f,0xae,0xba,0xcd,0x69,0xba,0xbf,0x5f,0x8f,0xe8,0x5a,0xb3,0x48,0x05,0x73},
+    {0xee,0xb8,0xa8,0xcb,0xa3,0x51,0x35,0xc4,0x16,0x5f,0x11,0xb2,0x1d,0x6f,0xa2,0x65,0x50,0x38,0x8c,0xab,0x52,0x4f,0x0f,0x76,0xca,0xb8,0x1d,0x41,0x3b,0x44,0x43,0x30,0x34,0xe3,0xd6,0xa1,0x4b,0x09,0x5b,0x80,0x19,0x3f,0x35,0x09,0x77,0xf1,0x3e,0xbf,0x2b,0x70,0x22,0x06,0xcb,0x06,0x3f,0x42,0xdd,0x45,0x78,0xd8,0x77,0x22,0x5a,0x58,0x62,0x89,0xd4,0x33,0x82,0x5f,0x8a,0xa1,0x7f,0x25,0x78,0xec,0xb5,0xc4,0x98,0x66,0xff,0x41,0x3e,0x37,0xa5,0x6f,0x8e,0xa7,0x1f,0x98,0xef,0x50,0x89,0x27,0x56,0x76},
+    {0xc0,0xc8,0x1f,0xd5,0x59,0xcf,0xc3,0x38,0xf2,0xb6,0x06,0x05,0xfd,0xd2,0xed,0x9b,0x8f,0x0e,0x57,0xab,0x9f,0x10,0xbf,0x26,0xa6,0x46,0xb8,0xc1,0xa8,0x60,0x41,0x3f,0x9d,0xcf,0x86,0xea,0xa3,0x73,0x70,0xe1,0xdc,0x5f,0x15,0x07,0xb7,0xfb,0x8c,0x3a,0x8e,0x8a,0x83,0x31,0xfc,0xe7,0x53,0x48,0x16,0xf6,0x13,0xb6,0x84,0xf4,0xbb,0x28,0x7c,0x6c,0x13,0x6f,0x5c,0x2f,0x61,0xf2,0xbe,0x11,0xdd,0xf6,0x07,0xd1,0xea,0xaf,0x33,0x6f,0xde,0x13,0xd2,0x9a,0x7e,0x52,0x5d,0xf7,0x88,0x81,0x35,0xcb,0x79,0x1e},
+    {0xf1,0xe3,0xf7,0xee,0xc3,0x36,0x34,0x01,0xf8,0x10,0x9e,0xfe,0x7f,0x6a,0x8b,0x82,0xfc,0xde,0xf9,0xbc,0xe5,0x08,0xf9,0x7f,0x31,0x38,0x3b,0x3a,0x1b,0x95,0xd7,0x65,0x81,0x81,0xe0,0xf5,0xd8,0x53,0xe9,0x77,0xd9,0xde,0x9d,0x29,0x44,0x0c,0xa5,0x84,0xe5,0x25,0x45,0x86,0x0c,0x2d,0x6c,0xdc,0xf4,0xf2,0xd1,0x39,0x2d,0xb5,0x8a,0x47,0x59,0xd1,0x52,0x92,0xd3,0xa4,0xa6,0x66,0x07,0xc8,0x1a,0x87,0xbc,0xe1,0xdd,0xe5,0x6f,0xc9,0xc1,0xa6,0x40,0x6b,0x2c,0xb8,0x14,0x22,0x21,0x1a,0x41,0x7a,0xd8,0x16},
+    {0x15,0x62,0x06,0x42,0x5a,0x7e,0xbd,0xb3,0xc1,0x24,0x5a,0x0c,0xcd,0xe3,0x9b,0x87,0xb7,0x94,0xf9,0xd6,0xb1,0x5d,0xc0,0x57,0xa6,0x8c,0xf3,0x65,0x81,0x7c,0xf8,0x28,0x83,0x05,0x4e,0xd5,0xe2,0xd5,0xa4,0xfb,0xfa,0x99,0xbd,0x2e,0xd7,0xaf,0x1f,0xe2,0x8f,0x77,0xe9,0x6e,0x73,0xc2,0x7a,0x49,0xde,0x6d,0x5a,0x7a,0x57,0x0b,0x99,0x1f,0xd6,0xf7,0xe8,0x1b,0xad,0x4e,0x34,0xa3,0x8f,0x79,0xea,0xac,0xeb,0x50,0x1e,0x7d,0x52,0xe0,0x0d,0x52,0x9e,0x56,0xc6,0x77,0x3e,0x6d,0x4d,0x53,0xe1,0x2f,0x88,0x45},
+    {0xd6,0x83,0x79,0x75,0x5d,0x34,0x69,0x66,0xa6,0x11,0xaa,0x17,0x11,0xed,0xb6,0x62,0x8f,0x12,0x5e,0x98,0x57,0x18,0xdd,0x7d,0xdd,0xf6,0x26,0xf6,0xb8,0xe5,0x8f,0x68,0xe4,0x6f,0x3c,0x94,0x29,0x99,0xac,0xd8,0xa2,0x92,0x83,0xa3,0x61,0xf1,0xf9,0xb5,0xf3,0x9a,0xc8,0xbe,0x13,0xdb,0x99,0x26,0x74,0xf0,0x05,0xe4,0x3c,0x84,0xcf,0x7d,0xc0,0x32,0x47,0x4a,0x48,0xd6,0x90,0x6c,0x99,0x32,0x56,0xca,0xfd,0x43,0x21,0xd5,0xe1,0xc6,0x5d,0x91,0xc3,0x28,0xbe,0xb3,0x1b,0x19,0x27,0x73,0x7e,0x68,0x39,0x67},
+    {0xa6,0x75,0x56,0x38,0x14,0x20,0x78,0xef,0xe8,0xa9,0xfd,0xaa,0x30,0x9f,0x64,0xa2,0xcb,0xa8,0xdf,0x5c,0x50,0xeb,0xd1,0x4c,0xb3,0xc0,0x4d,0x1d,0xba,0x5a,0x11,0x46,0xc0,0x1a,0x0c,0xc8,0x9d,0xcc,0x6d,0xa6,0x36,0xa4,0x38,0x1b,0xf4,0x5c,0xa0,0x97,0xc6,0xd7,0xdb,0x95,0xbe,0xf3,0xeb,0xa7,0xab,0x7d,0x7e,0x8d,0xf6,0xb8,0xa0,0x7d,0x76,0xda,0xb5,0xc3,0x53,0x19,0x0f,0xd4,0x9b,0x9e,0x11,0x21,0x73,0x6f,0xac,0x1d,0x60,0x59,0xb2,0xfe,0x21,0x60,0xcc,0x03,0x4b,0x4b,0x67,0x83,0x7e,0x88,0x5f,0x5a},
+    {0x11,0x3d,0xa1,0x70,0xcf,0x01,0x63,0x8f,0xc4,0xd0,0x0d,0x35,0x15,0xb8,0xce,0xcf,0x7e,0xa4,0xbc,0xa4,0xd4,0x97,0x02,0xf7,0x34,0x14,0x4d,0xe4,0x56,0xb6,0x69,0x36,0xb9,0x43,0xa6,0xa0,0xd3,0x28,0x96,0x9e,0x64,0x20,0xc3,0xe6,0x00,0xcb,0xc3,0xb5,0x32,0xec,0x2d,0x7c,0x89,0x02,0x53,0x9b,0x0c,0xc7,0xd1,0xd5,0xe2,0x7a,0xe3,0x43,0x33,0xe1,0xa6,0xed,0x06,0x3f,0x7e,0x38,0xc0,0x3a,0xa1,0x99,0x51,0x1d,0x30,0x67,0x11,0x38,0x26,0x36,0xf8,0xd8,0x5a,0xbd,0xbe,0xe9,0xd5,0x4f,0xcd,0xe6,0x21,0x6a},
+    {0x5f,0xe6,0x46,0x30,0x0a,0x17,0xc6,0xf1,0x24,0x35,0xd2,0x00,0x2a,0x2a,0x71,0x58,0x55,0xb7,0x82,0x8c,0x3c,0xbd,0xdb,0x69,0x57,0xff,0x95,0xa1,0xf1,0xf9,0x6b,0x58,0xe3,0xb2,0x99,0x66,0x12,0x29,0x41,0xef,0x01,0x13,0x8d,0x70,0x47,0x08,0xd3,0x71,0xbd,0xb0,0x82,0x11,0xd0,0x32,0x54,0x32,0x36,0x8b,0x1e,0x00,0x07,0x1b,0x37,0x45,0x0b,0x79,0xf8,0x5e,0x8d,0x08,0xdb,0xa6,0xe5,0x37,0x09,0x61,0xdc,0xf0,0x78,0x52,0xb8,0x6e,0xa1,0x61,0xd2,0x49,0x03,0xac,0x79,0x21,0xe5,0x90,0x37,0xb0,0xaf,0x0e},
+    {0x2f,0x04,0x48,0x37,0xc1,0x55,0x05,0x96,0x11,0xaa,0x0b,0x82,0xe6,0x41,0x9a,0x21,0x0c,0x6d,0x48,0x73,0x38,0xf7,0x81,0x1c,0x61,0xc6,0x02,0x5a,0x67,0xcc,0x9a,0x30,0x1d,0xae,0x75,0x0f,0x5e,0x80,0x40,0x51,0x30,0xcc,0x62,0x26,0xe3,0xfb,0x02,0xec,0x6d,0x39,0x92,0xea,0x1e,0xdf,0xeb,0x2c,0xb3,0x5b,0x43,0xc5,0x44,0x33,0xae,0x44,0xee,0x43,0xa5,0xbb,0xb9,0x89,0xf2,0x9c,0x42,0x71,0xc9,0x5a,0x9d,0x0e,0x76,0xf3,0xaa,0x60,0x93,0x4f,0xc6,0xe5,0x82,0x1d,0x8f,0x67,0x94,0x7f,0x1b,0x22,0xd5,0x62},
+    {0x6d,0x93,0xd0,0x18,0x9c,0x29,0x4c,0x52,0x0c,0x1a,0x0c,0x8a,0x6c,0xb5,0x6b,0xc8,0x31,0x86,0x4a,0xdb,0x2e,0x05,0x75,0xa3,0x62,0x45,0x75,0xbc,0xe4,0xfd,0x0e,0x5c,0x3c,0x7a,0xf7,0x3a,0x26,0xd4,0x85,0x75,0x4d,0x14,0xe9,0xfe,0x11,0x7b,0xae,0xdf,0x3d,0x19,0xf7,0x59,0x80,0x70,0x06,0xa5,0x37,0x20,0x92,0x83,0x53,0x9a,0xf2,0x14,0xf5,0xd7,0xb2,0x25,0xdc,0x7e,0x71,0xdf,0x40,0x30,0xb5,0x99,0xdb,0x70,0xf9,0x21,0x62,0x4c,0xed,0xc3,0xb7,0x34,0x92,0xda,0x3e,0x09,0xee,0x7b,0x5c,0x36,0x72,0x5e},
+    {0x7f,0x21,0x71,0x45,0x07,0xfc,0x5b,0x57,0x5b,0xd9,0x94,0x06,0x5d,0x67,0x79,0x37,0x33,0x1e,0x19,0xf4,0xbb,0x37,0x0a,0x9a,0xbc,0xea,0xb4,0x47,0x4c,0x10,0xf1,0x77,0x3e,0xb3,0x08,0x2f,0x06,0x39,0x93,0x7d,0xbe,0x32,0x9f,0xdf,0xe5,0x59,0x96,0x5b,0xfd,0xbd,0x9e,0x1f,0xad,0x3d,0xff,0xac,0xb7,0x49,0x73,0xcb,0x55,0x05,0xb2,0x70,0x4c,0x2c,0x11,0x55,0xc5,0x13,0x51,0xbe,0xcd,0x1f,0x88,0x9a,0x3a,0x42,0x88,0x66,0x47,0x3b,0x50,0x5e,0x85,0x77,0x66,0x44,0x4a,0x40,0x06,0x4a,0x8f,0x39,0x34,0x0e},
+    {0xe8,0xbd,0xce,0x3e,0xd9,0x22,0x7d,0xb6,0x07,0x2f,0x82,0x27,0x41,0xe8,0xb3,0x09,0x8d,0x6d,0x5b,0xb0,0x1f,0xa6,0x3f,0x74,0x72,0x23,0x36,0x8a,0x36,0x05,0x54,0x5e,0x28,0x19,0x4b,0x3e,0x09,0x0b,0x93,0x18,0x40,0xf6,0xf3,0x73,0x0e,0xe1,0xe3,0x7d,0x6f,0x5d,0x39,0x73,0xda,0x17,0x32,0xf4,0x3e,0x9c,0x37,0xca,0xd6,0xde,0x8a,0x6f,0x9a,0xb2,0xb7,0xfd,0x3d,0x12,0x40,0xe3,0x91,0xb2,0x1a,0xa2,0xe1,0x97,0x7b,0x48,0x9e,0x94,0xe6,0xfd,0x02,0x7d,0x96,0xf9,0x97,0xde,0xd3,0xc8,0x2e,0xe7,0x0d,0x78},
+    {0xbc,0xe7,0x9a,0x08,0x45,0x85,0xe2,0x0a,0x06,0x4d,0x7f,0x1c,0xcf,0xde,0x8d,0x38,0xb8,0x11,0x48,0x0a,0x51,0x15,0xac,0x38,0xe4,0x8c,0x92,0x71,0xf6,0x8b,0xb2,0x0e,0x72,0x27,0xf4,0x00,0xf3,0xea,0x1f,0x67,0xaa,0x41,0x8c,0x2a,0x2a,0xeb,0x72,0x8f,0x92,0x32,0x37,0x97,0xd7,0x7f,0xa1,0x29,0xa6,0x87,0xb5,0x32,0xad,0xc6,0xef,0x1d,0xa7,0x95,0x51,0xef,0x1a,0xbe,0x5b,0xaf,0xed,0x15,0x7b,0x91,0x77,0x12,0x8c,0x14,0x2e,0xda,0xe5,0x7a,0xfb,0xf7,0x91,0x29,0x67,0x28,0xdd,0xf8,0x1b,0x20,0x7d,0x46},
+    {0xad,0x4f,0xef,0x74,0x9a,0x91,0xfe,0x95,0xa2,0x08,0xa3,0xf6,0xec,0x7b,0x82,0x3a,0x01,0x7b,0xa4,0x09,0xd3,0x01,0x4e,0x96,0x97,0xc7,0xa3,0x5b,0x4f,0x3c,0xc4,0x71,0xa9,0xe7,0x7a,0x56,0xbd,0xf4,0x1e,0xbc,0xbd,0x98,0x44,0xd6,0xb2,0x4c,0x62,0x3f,0xc8,0x4e,0x1f,0x2c,0xd2,0x64,0x10,0xe4,0x01,0x40,0x38,0xba,0xa5,0xc5,0xf9,0x2e,0xcd,0x74,0x9e,0xfa,0xf6,0x6d,0xfd,0xb6,0x7a,0x26,0xaf,0xe4,0xbc,0x78,0x82,0xf1,0x0e,0x99,0xef,0xf1,0xd0,0xb3,0x55,0x82,0x93,0xf2,0xc5,0x90,0xa3,0x8c,0x75,0x5a},
+    {0x95,0x24,0x46,0xd9,0x10,0x27,0xb7,0xa2,0x03,0x50,0x7d,0xd5,0xd2,0xc6,0xa8,0x3a,0xca,0x87,0xb4,0xa0,0xbf,0x00,0xd4,0xe3,0xec,0x72,0xeb,0xb3,0x44,0xe2,0xba,0x2d,0x94,0xdc,0x61,0x1d,0x8b,0x91,0xe0,0x8c,0x66,0x30,0x81,0x9a,0x46,0x36,0xed,0x8d,0xd3,0xaa,0xe8,0xaf,0x29,0xa8,0xe6,0xd4,0x3f,0xd4,0x39,0xf6,0x27,0x80,0x73,0x0a,0xcc,0xe1,0xff,0x57,0x2f,0x4a,0x0f,0x98,0x43,0x98,0x83,0xe1,0x0d,0x0d,0x67,0x00,0xfd,0x15,0xfb,0x49,0x4a,0x3f,0x5c,0x10,0x9c,0xa6,0x26,0x51,0x63,0xca,0x98,0x26},
+    {0x78,0xba,0xb0,0x32,0x88,0x31,0x65,0xe7,0x8b,0xff,0x5c,0x92,0xf7,0x31,0x18,0x38,0xcc,0x1f,0x29,0xa0,0x91,0x1b,0xa8,0x08,0x07,0xeb,0xca,0x49,0xcc,0x3d,0xb4,0x1f,0x0e,0xd9,0x3d,0x5e,0x2f,0x70,0x3d,0x2e,0x86,0x53,0xd2,0xe4,0x18,0x09,0x3f,0x9e,0x6a,0xa9,0x4d,0x02,0xf6,0x3e,0x77,0x5e,0x32,0x33,0xfa,0x4a,0x0c,0x4b,0x00,0x3c,0x2b,0xb8,0xf4,0x06,0xac,0x46,0xa9,0x9a,0xf3,0xc4,0x06,0xa8,0xa5,0x84,0xa2,0x1c,0x87,0x47,0xcd,0xc6,0x5f,0x26,0xd3,0x3e,0x17,0xd2,0x1f,0xcd,0x01,0xfd,0x43,0x6b},
+    {0x44,0xc5,0x97,0x46,0x4b,0x5d,0xa7,0xc7,0xbf,0xff,0x0f,0xdf,0x48,0xf8,0xfd,0x15,0x5a,0x78,0x46,0xaa,0xeb,0xb9,0x68,0x28,0x14,0xf7,0x52,0x5b,0x10,0xd7,0x68,0x5a,0xf3,0x0e,0x76,0x3e,0x58,0x42,0xc7,0xb5,0x90,0xb9,0x0a,0xee,0xb9,0x52,0xdc,0x75,0x3f,0x92,0x2b,0x07,0xc2,0x27,0x14,0xbf,0xf0,0xd9,0xf0,0x6f,0x2d,0x0b,0x42,0x73,0x06,0x1e,0x85,0x9e,0xcb,0xf6,0x2c,0xaf,0xc4,0x38,0x22,0xc6,0x13,0x39,0x59,0x8f,0x73,0xf3,0xfb,0x99,0x96,0xb8,0x8a,0xda,0x9e,0xbc,0x34,0xea,0x2f,0x63,0xb5,0x3d},
+    {0xd8,0xd9,0x5d,0xf7,0x2b,0xee,0x6e,0xf4,0xa5,0x59,0x67,0x39,0xf6,0xb1,0x17,0x0d,0x73,0x72,0x9e,0x49,0x31,0xd1,0xf2,0x1b,0x13,0x5f,0xd7,0x49,0xdf,0x1a,0x32,0x04,0xd5,0x25,0x98,0x82,0xb1,0x90,0x49,0x2e,0x91,0x89,0x9a,0x3e,0x87,0xeb,0xea,0xed,0xf8,0x4a,0x70,0x4c,0x39,0x3d,0xf0,0xee,0x0e,0x2b,0xdf,0x95,0xa4,0x7e,0x19,0x59,0xae,0x5a,0xe5,0xe4,0x19,0x60,0xe1,0x04,0xe9,0x92,0x2f,0x7e,0x7a,0x43,0x7b,0xe7,0xa4,0x9a,0x15,0x6f,0xc1,0x2d,0xce,0xc7,0xc0,0x0c,0xd7,0xf4,0xc1,0xfd,0xea,0x45},
+    {0x2b,0xd7,0x45,0x80,0x85,0x01,0x84,0x69,0x51,0x06,0x2f,0xcf,0xa2,0xfa,0x22,0x4c,0xc6,0x2d,0x22,0x6b,0x65,0x36,0x1a,0x94,0xde,0xda,0x62,0x03,0xc8,0xeb,0x5e,0x5a,0xed,0xb1,0xcc,0xcf,0x24,0x46,0x0e,0xb6,0x95,0x03,0x5c,0xbd,0x92,0xc2,0xdb,0x59,0xc9,0x81,0x04,0xdc,0x1d,0x9d,0xa0,0x31,0x40,0xd9,0x56,0x5d,0xea,0xce,0x73,0x3f,0xc6,0x8d,0x4e,0x0a,0xd1,0xbf,0xa7,0xb7,0x39,0xb3,0xc9,0x44,0x7e,0x00,0x57,0xbe,0xfa,0xae,0x57,0x15,0x7f,0x20,0xc1,0x60,0xdb,0x18,0x62,0x26,0x91,0x88,0x05,0x26},
+    {0x04,0xff,0x60,0x83,0xa6,0x04,0xf7,0x59,0xf4,0xe6,0x61,0x76,0xde,0x3f,0xd9,0xc3,0x51,0x35,0x87,0x12,0x73,0x2a,0x1b,0x83,0x57,0x5d,0x61,0x4e,0x2e,0x0c,0xad,0x54,0x42,0xe5,0x76,0xc6,0x3c,0x8e,0x81,0x4c,0xad,0xcc,0xce,0x03,0x93,0x2c,0x42,0x5e,0x08,0x9f,0x12,0xb4,0xca,0xcc,0x07,0xec,0xb8,0x43,0x44,0xb2,0x10,0xfa,0xed,0x0d,0x2a,0x52,0x2b,0xb8,0xd5,0x67,0x3b,0xee,0xeb,0xc1,0xa5,0x9f,0x46,0x63,0xf1,0x36,0xd3,0x9f,0xc1,0x6e,0xf2,0xd2,0xb4,0xa5,0x08,0x94,0x7a,0xa7,0xba,0xb2,0xec,0x62},
+    {0x3d,0x2b,0x15,0x61,0x52,0x79,0xed,0xe5,0xd1,0xd7,0xdd,0x0e,0x7d,0x35,0x62,0x49,0x71,0x4c,0x6b,0xb9,0xd0,0xc8,0x82,0x74,0xbe,0xd8,0x66,0xa9,0x19,0xf9,0x59,0x2e,0x74,0x28,0xb6,0xaf,0x36,0x28,0x07,0x92,0xa5,0x04,0xe1,0x79,0x85,0x5e,0xcd,0x5f,0x4a,0xa1,0x30,0xc6,0xad,0x01,0xad,0x5a,0x98,0x3f,0x66,0x75,0x50,0x3d,0x91,0x61,0xda,0x31,0x32,0x1a,0x36,0x2d,0xc6,0x0d,0x70,0x02,0x20,0x94,0x32,0x58,0x47,0xfa,0xce,0x94,0x95,0x3f,0x51,0x01,0xd8,0x02,0x5c,0x5d,0xc0,0x31,0xa1,0xc2,0xdb,0x3d},
+    {0x4b,0xc5,0x5e,0xce,0xf9,0x0f,0xdc,0x9a,0x0d,0x13,0x2f,0x8c,0x6b,0x2a,0x9c,0x03,0x15,0x95,0xf8,0xf0,0xc7,0x07,0x80,0x02,0x6b,0xb3,0x04,0xac,0x14,0x83,0x96,0x78,0x14,0xbb,0x96,0x27,0xa2,0x57,0xaa,0xf3,0x21,0xda,0x07,0x9b,0xb7,0xba,0x3a,0x88,0x1c,0x39,0xa0,0x31,0x18,0xe2,0x4b,0xe5,0xf9,0x05,0x32,0xd8,0x38,0xfb,0xe7,0x5e,0x8e,0x6a,0x44,0x41,0xcb,0xfd,0x8d,0x53,0xf9,0x37,0x49,0x43,0xa9,0xfd,0xac,0xa5,0x78,0x8c,0x3c,0x26,0x8d,0x90,0xaf,0x46,0x09,0x0d,0xca,0x9b,0x3c,0x63,0xd0,0x61},
+    {0x66,0x25,0xdb,0xff,0x35,0x49,0x74,0x63,0xbb,0x68,0x0b,0x78,0x89,0x6b,0xbd,0xc5,0x03,0xec,0x3e,0x55,0x80,0x32,0x1b,0x6f,0xf5,0xd7,0xae,0x47,0xd8,0x5f,0x96,0x6e,0xdf,0x73,0xfc,0xf8,0xbc,0x28,0xa3,0xad,0xfc,0x37,0xf0,0xa6,0x5d,0x69,0x84,0xee,0x09,0xa9,0xc2,0x38,0xdb,0xb4,0x7f,0x63,0xdc,0x7b,0x06,0xf8,0x2d,0xac,0x23,0x5b,0x7b,0x52,0x80,0xee,0x53,0xb9,0xd2,0x9a,0x8d,0x6d,0xde,0xfa,0xaa,0x19,0x8f,0xe8,0xcf,0x82,0x0e,0x15,0x04,0x17,0x71,0x0e,0xdc,0xde,0x95,0xdd,0xb9,0xbb,0xb9,0x79},
+    {0xc2,0x26,0x31,0x6a,0x40,0x55,0xb3,0xeb,0x93,0xc3,0xc8,0x68,0xa8,0x83,0x63,0xd2,0x82,0x7a,0xb9,0xe5,0x29,0x64,0x0c,0x6c,0x47,0x21,0xfd,0xc9,0x58,0xf1,0x65,0x50,0x74,0x73,0x9f,0x8e,0xae,0x7d,0x99,0xd1,0x16,0x08,0xbb,0xcf,0xf8,0xa2,0x32,0xa0,0x0a,0x5f,0x44,0x6d,0x12,0xba,0x6c,0xcd,0x34,0xb8,0xcc,0x0a,0x46,0x11,0xa8,0x1b,0x54,0x99,0x42,0x0c,0xfb,0x69,0x81,0x70,0x67,0xcf,0x6e,0xd7,0xac,0x00,0x46,0xe1,0xba,0x45,0xe6,0x70,0x8a,0xb9,0xaa,0x2e,0xf2,0xfa,0xa4,0x58,0x9e,0xf3,0x81,0x39},
+    {0x93,0x0a,0x23,0x59,0x75,0x8a,0xfb,0x18,0x5d,0xf4,0xe6,0x60,0x69,0x8f,0x16,0x1d,0xb5,0x3c,0xa9,0x14,0x45,0xa9,0x85,0x3a,0xfd,0xd0,0xac,0x05,0x37,0x08,0xdc,0x38,0xde,0x6f,0xe6,0x6d,0xa5,0xdf,0x45,0xc8,0x3a,0x48,0x40,0x2c,0x00,0xa5,0x52,0xe1,0x32,0xf6,0xb4,0xc7,0x63,0xe1,0xd2,0xe9,0x65,0x1b,0xbc,0xdc,0x2e,0x45,0xf4,0x30,0x40,0x97,0x75,0xc5,0x82,0x27,0x6d,0x85,0xcc,0xbe,0x9c,0xf9,0x69,0x45,0x13,0xfa,0x71,0x4e,0xea,0xc0,0x73,0xfc,0x44,0x88,0x69,0x24,0x3f,0x59,0x1a,0x9a,0x2d,0x63},
+    {0xa6,0xcb,0x07,0xb8,0x15,0x6b,0xbb,0xf6,0xd7,0xf0,0x54,0xbc,0xdf,0xc7,0x23,0x18,0x0b,0x67,0x29,0x6e,0x03,0x97,0x1d,0xbb,0x57,0x4a,0xed,0x47,0x88,0xf4,0x24,0x0b,0xa7,0x84,0x0c,0xed,0x11,0xfd,0x09,0xbf,0x3a,0x69,0x9f,0x0d,0x81,0x71,0xf0,0x63,0x79,0x87,0xcf,0x57,0x2d,0x8c,0x90,0x21,0xa2,0x4b,0xf6,0x8a,0xf2,0x7d,0x5a,0x3a,0xc7,0xea,0x1b,0x51,0xbe,0xd4,0xda,0xdc,0xf2,0xcc,0x26,0xed,0x75,0x80,0x53,0xa4,0x65,0x9a,0x5f,0x00,0x9f,0xff,0x9c,0xe1,0x63,0x1f,0x48,0x75,0x44,0xf7,0xfc,0x34},
+    {0xca,0x67,0x97,0x78,0x4c,0xe0,0x97,0xc1,0x7d,0x46,0xd9,0x38,0xcb,0x4d,0x71,0xb8,0xa8,0x5f,0xf9,0x83,0x82,0x88,0xde,0x55,0xf7,0x63,0xfa,0x4d,0x16,0xdc,0x3b,0x3d,0x98,0xaa,0xcf,0x78,0xab,0x1d,0xbb,0xa5,0xf2,0x72,0x0b,0x19,0x67,0xa2,0xed,0x5c,0x8e,0x60,0x92,0x0a,0x11,0xc9,0x09,0x93,0xb0,0x74,0xb3,0x2f,0x04,0xa3,0x19,0x01,0x7d,0x17,0xc2,0xe8,0x9c,0xd8,0xa2,0x67,0xc1,0xd0,0x95,0x68,0xf6,0xa5,0x9d,0x66,0xb0,0xa2,0x82,0xb2,0xe5,0x98,0x65,0xf5,0x73,0x0a,0xe2,0xed,0xf1,0x88,0xc0,0x56},
+    {0x17,0x6e,0xa8,0x10,0x11,0x3d,0x6d,0x33,0xfa,0xb2,0x75,0x0b,0x32,0x88,0xf3,0xd7,0x88,0x29,0x07,0x25,0x76,0x33,0x15,0xf9,0x87,0x8b,0x10,0x99,0x6b,0x4c,0x67,0x09,0x02,0x8f,0xf3,0x24,0xac,0x5f,0x1b,0x58,0xbd,0x0c,0xe3,0xba,0xfe,0xe9,0x0b,0xa9,0xf0,0x92,0xcf,0x8a,0x02,0x69,0x21,0x9a,0x8f,0x03,0x59,0x83,0xa4,0x7e,0x8b,0x03,0xf8,0x6f,0x31,0x99,0x21,0xf8,0x4e,0x9f,0x4f,0x8d,0xa7,0xea,0x82,0xd2,0x49,0x2f,0x74,0x31,0xef,0x5a,0xab,0xa5,0x71,0x09,0x65,0xeb,0x69,0x59,0x02,0x31,0x5e,0x6e},
+    {0xfb,0x93,0xe5,0x87,0xf5,0x62,0x6c,0xb1,0x71,0x3e,0x5d,0xca,0xde,0xed,0x99,0x49,0x6d,0x3e,0xcc,0x14,0xe0,0xc1,0x91,0xb4,0xa8,0xdb,0xa8,0x89,0x47,0x11,0xf5,0x08,0x22,0x62,0x06,0x63,0x0e,0xfb,0x04,0x33,0x3f,0xba,0xac,0x87,0x89,0x06,0x35,0xfb,0xa3,0x61,0x10,0x8c,0x77,0x24,0x19,0xbd,0x20,0x86,0x83,0xd1,0x43,0xad,0x58,0x30,0xd0,0x63,0x76,0xe5,0xfd,0x0f,0x3c,0x32,0x10,0xa6,0x2e,0xa2,0x38,0xdf,0xc3,0x05,0x9a,0x4f,0x99,0xac,0xbd,0x8a,0xc7,0xbd,0x99,0xdc,0xe3,0xef,0xa4,0x9f,0x54,0x26},
+    {0xd6,0xf9,0x6b,0x1e,0x46,0x5a,0x1d,0x74,0x81,0xa5,0x77,0x77,0xfc,0xb3,0x05,0x23,0xd9,0xd3,0x74,0x64,0xa2,0x74,0x55,0xd4,0xff,0xe0,0x01,0x64,0xdc,0xe1,0x26,0x19,0x6e,0x66,0x3f,0xaf,0x49,0x85,0x46,0xdb,0xa5,0x0e,0x4a,0xf1,0x04,0xcf,0x7f,0xd7,0x47,0x0c,0xba,0xa4,0xf7,0x3f,0xf2,0x3d,0x85,0x3c,0xce,0x32,0xe1,0xdf,0x10,0x3a,0xa0,0xce,0x17,0xea,0x8a,0x4e,0x7f,0xe0,0xfd,0xc1,0x1f,0x3a,0x46,0x15,0xd5,0x2f,0xf1,0xc0,0xf2,0x31,0xfd,0x22,0x53,0x17,0x15,0x5d,0x1e,0x86,0x1d,0xd0,0xa1,0x1f},
+    {0x32,0x98,0x59,0x7d,0x94,0x55,0x80,0xcc,0x20,0x55,0xf1,0x37,0xda,0x56,0x46,0x1e,0x20,0x93,0x05,0x4e,0x74,0xf7,0xf6,0x99,0x33,0xcf,0x75,0x6a,0xbc,0x63,0x35,0x77,0xab,0x94,0xdf,0xd1,0x00,0xac,0xdc,0x38,0xe9,0x0d,0x08,0xd1,0xdd,0x2b,0x71,0x2e,0x62,0xe2,0xd5,0xfd,0x3e,0xe9,0x13,0x7f,0xe5,0x01,0x9a,0xee,0x18,0xed,0xfc,0x73,0xb3,0x9c,0x13,0x63,0x08,0xe9,0xb1,0x06,0xcd,0x3e,0xa0,0xc5,0x67,0xda,0x93,0xa4,0x32,0x89,0x63,0xad,0xc8,0xce,0x77,0x8d,0x44,0x4f,0x86,0x1b,0x70,0x6b,0x42,0x1f},
+    {0x01,0x1c,0x91,0x41,0x4c,0x26,0xc9,0xef,0x25,0x2c,0xa2,0x17,0xb8,0xb7,0xa3,0xf1,0x47,0x14,0x0f,0xf3,0x6b,0xda,0x75,0x58,0x90,0xb0,0x31,0x1d,0x27,0xf5,0x1a,0x4e,0x52,0x25,0xa1,0x91,0xc8,0x35,0x7e,0xf1,0x76,0x9c,0x5e,0x57,0x53,0x81,0x6b,0xb7,0x3e,0x72,0x9b,0x0d,0x6f,0x40,0x83,0xfa,0x38,0xe4,0xa7,0x3f,0x1b,0xbb,0x76,0x0b,0x9b,0x93,0x92,0x7f,0xf9,0xc1,0xb8,0x08,0x6e,0xab,0x44,0xd4,0xcb,0x71,0x67,0xbe,0x17,0x80,0xbb,0x99,0x63,0x64,0xe5,0x22,0x55,0xa9,0x72,0xb7,0x1e,0xd6,0x6d,0x7b},
+    {0x92,0x3d,0xf3,0x50,0xe8,0xc1,0xad,0xb7,0xcf,0xd5,0x8c,0x60,0x4f,0xfa,0x98,0x79,0xdb,0x5b,0xfc,0x8d,0xbd,0x2d,0x96,0xad,0x4f,0x2f,0x1d,0xaf,0xce,0x9b,0x3e,0x70,0xc7,0xd2,0x01,0xab,0xf9,0xab,0x30,0x57,0x18,0x3b,0x14,0x40,0xdc,0x76,0xfb,0x16,0x81,0xb2,0xcb,0xa0,0x65,0xbe,0x6c,0x86,0xfe,0x6a,0xff,0x9b,0x65,0x9b,0xfa,0x53,0x55,0x54,0x88,0x94,0xe9,0xc8,0x14,0x6c,0xe5,0xd4,0xae,0x65,0x66,0x5d,0x3a,0x84,0xf1,0x5a,0xd6,0xbc,0x3e,0xb7,0x1b,0x18,0x50,0x1f,0xc6,0xc4,0xe5,0x93,0x8d,0x39},
+    {0xf3,0x48,0xe2,0x33,0x67,0xd1,0x4b,0x1c,0x5f,0x0a,0xbf,0x15,0x87,0x12,0x9e,0xbd,0x76,0x03,0x0b,0xa1,0xf0,0x8c,0x3f,0xd4,0x13,0x1b,0x19,0xdf,0x5d,0x9b,0xb0,0x53,0xf2,0xe3,0xe7,0xd2,0x60,0x7c,0x87,0xc3,0xb1,0x8b,0x82,0x30,0xa0,0xaa,0x34,0x3b,0x38,0xf1,0x9e,0x73,0xe7,0x26,0x3e,0x28,0x77,0x05,0xc3,0x02,0x90,0x9c,0x9c,0x69,0xcc,0xf1,0x46,0x59,0x23,0xa7,0x06,0xf3,0x7d,0xd9,0xe5,0xcc,0xb5,0x18,0x17,0x92,0x75,0xe9,0xb4,0x81,0x47,0xd2,0xcd,0x28,0x07,0xd9,0xcd,0x6f,0x0c,0xf3,0xca,0x51},
+    {0x0a,0xe0,0x74,0x76,0x42,0xa7,0x0b,0xa6,0xf3,0x7b,0x7a,0xa1,0x70,0x85,0x0e,0x63,0xcc,0x24,0x33,0xcf,0x3d,0x56,0x58,0x37,0xaa,0xfd,0x83,0x23,0x29,0xaa,0x04,0x55,0xc7,0x54,0xac,0x18,0x9a,0xf9,0x7a,0x73,0x0f,0xb3,0x1c,0xc5,0xdc,0x78,0x33,0x90,0xc7,0x0c,0xe1,0x4c,0x33,0xbc,0x89,0x2b,0x9a,0xe9,0xf8,0x89,0xc1,0x29,0xae,0x12,0xcf,0x01,0x0d,0x1f,0xcb,0xc0,0x9e,0xa9,0xae,0xf7,0x34,0x3a,0xcc,0xef,0xd1,0x0d,0x22,0x4e,0x9c,0xd0,0x21,0x75,0xca,0x55,0xea,0xa5,0xeb,0x58,0xe9,0x4f,0xd1,0x5f},
+    {0x2c,0xab,0x45,0x28,0xdf,0x2d,0xdc,0xb5,0x93,0xe9,0x7f,0x0a,0xb1,0x91,0x94,0x06,0x46,0xe3,0x02,0x40,0xd6,0xf3,0xaa,0x4d,0xd1,0x74,0x64,0x58,0x6e,0xf2,0x3f,0x09,0x8e,0xcb,0x93,0xbf,0x5e,0xfe,0x42,0x3c,0x5f,0x56,0xd4,0x36,0x51,0xa8,0xdf,0xbe,0xe8,0x20,0x42,0x88,0x9e,0x85,0xf0,0xe0,0x28,0xd1,0x25,0x07,0x96,0x3f,0xd7,0x7d,0x29,0x98,0x05,0x68,0xfe,0x24,0x0d,0xb1,0xe5,0x23,0xaf,0xdb,0x72,0x06,0x73,0x75,0x29,0xac,0x57,0xb4,0x3a,0x25,0x67,0x13,0xa4,0x70,0xb4,0x86,0xbc,0xbc,0x59,0x2f},
+    {0x5f,0x13,0x17,0x99,0x42,0x7d,0x84,0x83,0xd7,0x03,0x7d,0x56,0x1f,0x91,0x1b,0xad,0xd1,0xaa,0x77,0xbe,0xd9,0x48,0x77,0x7e,0x4a,0xaf,0x51,0x2e,0x2e,0xb4,0x58,0x54,0x01,0xc3,0x91,0xb6,0x60,0xd5,0x41,0x70,0x1e,0xe7,0xd7,0xad,0x3f,0x1b,0x20,0x85,0x85,0x55,0x33,0x11,0x63,0xe1,0xc2,0x16,0xb1,0x28,0x08,0x01,0x3d,0x5e,0xa5,0x2a,0x4f,0x44,0x07,0x0c,0xe6,0x92,0x51,0xed,0x10,0x1d,0x42,0x74,0x2d,0x4e,0xc5,0x42,0x64,0xc8,0xb5,0xfd,0x82,0x4c,0x2b,0x35,0x64,0x86,0x76,0x8a,0x4a,0x00,0xe9,0x13},
+    {0xdb,0xce,0x2f,0x83,0x45,0x88,0x9d,0x73,0x63,0xf8,0x6b,0xae,0xc9,0xd6,0x38,0xfa,0xf7,0xfe,0x4f,0xb7,0xca,0x0d,0xbc,0x32,0x5e,0xe4,0xbc,0x14,0x88,0x7e,0x93,0x73,0x7f,0x87,0x3b,0x19,0xc9,0x00,0x2e,0xbb,0x6b,0x50,0xdc,0xe0,0x90,0xa8,0xe3,0xec,0x9f,0x64,0xde,0x36,0xc0,0xb7,0xf3,0xec,0x1a,0x9e,0xde,0x98,0x08,0x04,0x46,0x5f,0x8d,0xf4,0x7b,0x29,0x16,0x71,0x03,0xb9,0x34,0x68,0xf0,0xd4,0x22,0x3b,0xd1,0xa9,0xc6,0xbd,0x96,0x46,0x57,0x15,0x97,0xe1,0x35,0xe8,0xd5,0x91,0xe8,0xa4,0xf8,0x2c},
+    {0x67,0x0f,0x11,0x07,0x87,0xfd,0x93,0x6d,0x49,0xb5,0x38,0x7c,0xd3,0x09,0x4c,0xdd,0x86,0x6a,0x73,0xc2,0x4c,0x6a,0xb1,0x7c,0x09,0x2a,0x25,0x58,0x6e,0xbd,0x49,0x20,0xa2,0x6b,0xd0,0x17,0x7e,0x48,0xb5,0x2c,0x6b,0x19,0x50,0x39,0x1c,0x38,0xd2,0x24,0x30,0x8a,0x97,0x85,0x81,0x9c,0x65,0xd7,0xf6,0xa4,0xd6,0x91,0x28,0x7f,0x6f,0x7a,0x49,0xef,0x9a,0x6a,0x8d,0xfd,0x09,0x7d,0x0b,0xb9,0x3d,0x5b,0xbe,0x60,0xee,0xf0,0xd4,0xbf,0x9e,0x51,0x2c,0xb5,0x21,0x4c,0x1d,0x94,0x45,0xc5,0xdf,0xaa,0x11,0x60},
+    {0x3c,0xf8,0x95,0xcf,0x6d,0x92,0x67,0x5f,0x71,0x90,0x28,0x71,0x61,0x85,0x7e,0x7c,0x5b,0x7a,0x8f,0x99,0xf3,0xe7,0xa1,0xd6,0xe0,0xf9,0x62,0x0b,0x1b,0xcc,0xc5,0x6f,0x90,0xf8,0xcb,0x02,0xc8,0xd0,0xde,0x63,0xaa,0x6a,0xff,0x0d,0xca,0x98,0xd0,0xfb,0x99,0xed,0xb6,0xb9,0xfd,0x0a,0x4d,0x62,0x1e,0x0b,0x34,0x79,0xb7,0x18,0xce,0x69,0xcb,0x79,0x98,0xb2,0x28,0x55,0xef,0xd1,0x92,0x90,0x7e,0xd4,0x3c,0xae,0x1a,0xdd,0x52,0x23,0x9f,0x18,0x42,0x04,0x7e,0x12,0xf1,0x01,0x71,0xe5,0x3a,0x6b,0x59,0x15},
+    {0xa2,0x79,0x91,0x3f,0xd2,0x39,0x27,0x46,0xcf,0xdd,0xd6,0x97,0x31,0x12,0x83,0xff,0x8a,0x14,0xf2,0x53,0xb5,0xde,0x07,0x13,0xda,0x4d,0x5f,0x7b,0x68,0x37,0x22,0x0d,0xca,0x24,0x51,0x7e,0x16,0x31,0xff,0x09,0xdf,0x45,0xc7,0xd9,0x8b,0x15,0xe4,0x0b,0xe5,0x56,0xf5,0x7e,0x22,0x7d,0x2b,0x29,0x38,0xd1,0xb6,0xaf,0x41,0xe2,0xa4,0x3a,0xf5,0x05,0x33,0x2a,0xbf,0x38,0xc1,0x2c,0xc3,0x26,0xe9,0xa2,0x8f,0x3f,0x58,0x48,0xeb,0xd2,0x49,0x55,0xa2,0xb1,0x3a,0x08,0x6c,0xa3,0x87,0x46,0x6e,0xaa,0xfc,0x32},
+    {0xf5,0x9a,0x7d,0xc5,0x8d,0x6e,0xc5,0x7b,0xf2,0xbd,0xf0,0x9d,0xed,0xd2,0x0b,0x3e,0xa3,0xe4,0xef,0x22,0xde,0x14,0xc0,0xaa,0x5c,0x6a,0xbd,0xfe,0xce,0xe9,0x27,0x46,0xdf,0xcc,0x87,0x27,0x73,0xa4,0x07,0x32,0xf8,0xe3,0x13,0xf2,0x08,0x19,0xe3,0x17,0x4e,0x96,0x0d,0xf6,0xd7,0xec,0xb2,0xd5,0xe9,0x0b,0x60,0xc2,0x36,0x63,0x6f,0x74,0x1c,0x97,0x6c,0xab,0x45,0xf3,0x4a,0x3f,0x1f,0x73,0x43,0x99,0x72,0xeb,0x88,0xe2,0x6d,0x18,0x44,0x03,0x8a,0x6a,0x59,0x33,0x93,0x62,0xd6,0x7e,0x00,0x17,0x49,0x7b},
+    {0x64,0xb0,0x84,0xab,0x5c,0xfb,0x85,0x2d,0x14,0xbc,0xf3,0x89,0xd2,0x10,0x78,0x49,0x0c,0xce,0x15,0x7b,0x44,0xdc,0x6a,0x47,0x7b,0xfd,0x44,0xf8,0x76,0xa3,0x2b,0x12,0xdd,0xa2,0x53,0xdd,0x28,0x1b,0x34,0x54,0x3f,0xfc,0x42,0xdf,0x5b,0x90,0x17,0xaa,0xf4,0xf8,0xd2,0x4d,0xd9,0x92,0xf5,0x0f,0x7d,0xd3,0x8c,0xe0,0x0f,0x62,0x03,0x1d,0x54,0xe5,0xb4,0xa2,0xcd,0x32,0x02,0xc2,0x7f,0x18,0x5d,0x11,0x42,0xfd,0xd0,0x9e,0xd9,0x79,0xd4,0x7d,0xbe,0xb4,0xab,0x2e,0x4c,0xec,0x68,0x2b,0xf5,0x0b,0xc7,0x02},
+    {0xbb,0x2f,0x0b,0x5d,0x4b,0xec,0x87,0xa2,0xca,0x82,0x48,0x07,0x90,0x57,0x5c,0x41,0x5c,0x81,0xd0,0xc1,0x1e,0xa6,0x44,0xe0,0xe0,0xf5,0x9e,0x40,0x0a,0x4f,0x33,0x26,0xe1,0x72,0x8d,0x45,0xbf,0x32,0xe5,0xac,0xb5,0x3c,0xb7,0x7c,0xe0,0x68,0xe7,0x5b,0xe7,0xbd,0x8b,0xee,0x94,0x7d,0xcf,0x56,0x03,0x3a,0xb4,0xfe,0xe3,0x97,0x06,0x6b,0xc0,0xa3,0x62,0xdf,0x4a,0xf0,0xc8,0xb6,0x5d,0xa4,0x6d,0x07,0xef,0x00,0xf0,0x3e,0xa9,0xd2,0xf0,0x49,0x58,0xb9,0x9c,0x9c,0xae,0x2f,0x1b,0x44,0x43,0x7f,0xc3,0x1c},
+    {0x4f,0x32,0xc7,0x5c,0x5a,0x56,0x8f,0x50,0x22,0xa9,0x06,0xe5,0xc0,0xc4,0x61,0xd0,0x19,0xac,0x45,0x5c,0xdb,0xab,0x18,0xfb,0x4a,0x31,0x80,0x03,0xc1,0x09,0x68,0x6c,0xb9,0xae,0xce,0xc9,0xf1,0x56,0x66,0xd7,0x6a,0x65,0xe5,0x18,0xf8,0x15,0x5b,0x1c,0x34,0x23,0x4c,0x84,0x32,0x28,0xe7,0x26,0x38,0x68,0x19,0x2f,0x77,0x6f,0x34,0x3a,0xc8,0x6a,0xda,0xe2,0x12,0x51,0xd5,0xd2,0xed,0x51,0xe8,0xb1,0x31,0x03,0xbd,0xe9,0x62,0x72,0xc6,0x8e,0xdd,0x46,0x07,0x96,0xd0,0xc5,0xf7,0x6e,0x9f,0x1b,0x91,0x05},
+    {0xbb,0x0e,0xdf,0xf5,0x83,0x99,0x33,0xc1,0xac,0x4c,0x2c,0x51,0x8f,0x75,0xf3,0xc0,0xe1,0x98,0xb3,0x0b,0x0a,0x13,0xf1,0x2c,0x62,0x0c,0x27,0xaa,0xf9,0xec,0x3c,0x6b,0xef,0xea,0x2e,0x51,0xf3,0xac,0x49,0x53,0x49,0xcb,0xc1,0x1c,0xd3,0x41,0xc1,0x20,0x8d,0x68,0x9a,0xa9,0x07,0x0c,0x18,0x24,0x17,0x2d,0x4b,0xc6,0xd1,0xf9,0x5e,0x55,0x08,0xbd,0x73,0x3b,0xba,0x70,0xa7,0x36,0x0c,0xbf,0xaf,0xa3,0x08,0xef,0x4a,0x62,0xf2,0x46,0x09,0xb4,0x98,0xff,0x37,0x57,0x9d,0x74,0x81,0x33,0xe1,0x4d,0x5f,0x67},
+    {0xfc,0x82,0x17,0x6b,0x03,0x52,0x2c,0x0e,0xb4,0x83,0xad,0x6c,0x81,0x6c,0x81,0x64,0x3e,0x07,0x64,0x69,0xd9,0xbd,0xdc,0xd0,0x20,0xc5,0x64,0x01,0xf7,0x9d,0xd9,0x13,0x1d,0xb3,0xda,0x3b,0xd9,0xf6,0x2f,0xa1,0xfe,0x2d,0x65,0x9d,0x0f,0xd8,0x25,0x07,0x87,0x94,0xbe,0x9a,0xf3,0x4f,0x9c,0x01,0x43,0x3c,0xcd,0x82,0xb8,0x50,0xf4,0x60,0xca,0xc0,0xe5,0x21,0xc3,0x5e,0x4b,0x01,0xa2,0xbf,0x19,0xd7,0xc9,0x69,0xcb,0x4f,0xa0,0x23,0x00,0x75,0x18,0x1c,0x5f,0x4e,0x80,0xac,0xed,0x55,0x9e,0xde,0x06,0x1c},
+    {0xe2,0xc4,0x3e,0xa3,0xd6,0x7a,0x0f,0x99,0x8e,0xe0,0x2e,0xbe,0x38,0xf9,0x08,0x66,0x15,0x45,0x28,0x63,0xc5,0x43,0xa1,0x9c,0x0d,0xb6,0x2d,0xec,0x1f,0x8a,0xf3,0x4c,0xaa,0x69,0x6d,0xff,0x40,0x2b,0xd5,0xff,0xbb,0x49,0x40,0xdc,0x18,0x0b,0x53,0x34,0x97,0x98,0x4d,0xa3,0x2f,0x5c,0x4a,0x5e,0x2d,0xba,0x32,0x7d,0x8e,0x6f,0x09,0x78,0xe7,0x5c,0xfa,0x0d,0x65,0xaa,0xaa,0xa0,0x8c,0x47,0xb5,0x48,0x2a,0x9e,0xc4,0xf9,0x5b,0x72,0x03,0x70,0x7d,0xcc,0x09,0x4f,0xbe,0x1a,0x09,0x26,0x3a,0xad,0x3c,0x37},
+    {0x7c,0xf5,0xc9,0x82,0x4d,0x63,0x94,0xb2,0x36,0x45,0x93,0x24,0xe1,0xfd,0xcb,0x1f,0x5a,0xdb,0x8c,0x41,0xb3,0x4d,0x9c,0x9e,0xfc,0x19,0x44,0x45,0xd9,0xf3,0x40,0x00,0xad,0xbb,0xdd,0x89,0xfb,0xa8,0xbe,0xf1,0xcb,0xae,0xae,0x61,0xbc,0x2c,0xcb,0x3b,0x9d,0x8d,0x9b,0x1f,0xbb,0xa7,0x58,0x8f,0x86,0xa6,0x12,0x51,0xda,0x7e,0x54,0x21,0xd3,0x86,0x59,0xfd,0x39,0xe9,0xfd,0xde,0x0c,0x38,0x0a,0x51,0x89,0x2c,0x27,0xf4,0xb9,0x19,0x31,0xbb,0x07,0xa4,0x2b,0xb7,0xf4,0x4d,0x25,0x4a,0x33,0x0a,0x55,0x63},
+    {0x37,0xcf,0x69,0xb5,0xed,0xd6,0x07,0x65,0xe1,0x2e,0xa5,0x0c,0xb0,0x29,0x84,0x17,0x5d,0xd6,0x6b,0xeb,0x90,0x00,0x7c,0xea,0x51,0x8f,0xf7,0xda,0xc7,0x62,0xea,0x3e,0x49,0x7b,0x54,0x72,0x45,0x58,0xba,0x9b,0xe0,0x08,0xc4,0xe2,0xfa,0xc6,0x05,0xf3,0x8d,0xf1,0x34,0xc7,0x69,0xfa,0xe8,0x60,0x7a,0x76,0x7d,0xaa,0xaf,0x2b,0xa9,0x39,0x4e,0x27,0x93,0xe6,0x13,0xc7,0x24,0x9d,0x75,0xd3,0xdb,0x68,0x77,0x85,0x63,0x5f,0x9a,0xb3,0x8a,0xeb,0x60,0x55,0x52,0x70,0xcd,0xc4,0xc9,0x65,0x06,0x6a,0x43,0x68},
+    {0x27,0x3f,0x2f,0x20,0xe8,0x35,0x02,0xbc,0xb0,0x75,0xf9,0x64,0xe2,0x00,0x5c,0xc7,0x16,0x24,0x8c,0xa3,0xd5,0xe9,0xa4,0x91,0xf9,0x89,0xb7,0x8a,0xf6,0xe7,0xb6,0x17,0x7c,0x10,0x20,0xe8,0x17,0xd3,0x56,0x1e,0x65,0xe9,0x0a,0x84,0x44,0x68,0x26,0xc5,0x7a,0xfc,0x0f,0x32,0xc6,0xa1,0xe0,0xc1,0x72,0x14,0x61,0x91,0x9c,0x66,0x73,0x53,0x57,0x52,0x0e,0x9a,0xab,0x14,0x28,0x5d,0xfc,0xb3,0xca,0xc9,0x84,0x20,0x8f,0x90,0xca,0x1e,0x2d,0x5b,0x88,0xf5,0xca,0xaf,0x11,0x7d,0xf8,0x78,0xa6,0xb5,0xb4,0x1c},
+    {0x6c,0xfc,0x4a,0x39,0x6b,0xc0,0x64,0xb6,0xb1,0x5f,0xda,0x98,0x24,0xde,0x88,0x0c,0x34,0xd8,0xca,0x4b,0x16,0x03,0x8d,0x4f,0xa2,0x34,0x74,0xde,0x78,0xca,0x0b,0x33,0xe7,0x07,0xa0,0xa2,0x62,0xaa,0x74,0x6b,0xb1,0xc7,0x71,0xf0,0xb0,0xe0,0x11,0xf3,0x23,0xe2,0x0b,0x00,0x38,0xe4,0x07,0x57,0xac,0x6e,0xef,0x82,0x2d,0xfd,0xc0,0x2d,0x4e,0x74,0x19,0x11,0x84,0xff,0x2e,0x98,0x24,0x47,0x07,0x2b,0x96,0x5e,0x69,0xf9,0xfb,0x53,0xc9,0xbf,0x4f,0xc1,0x8a,0xc5,0xf5,0x1c,0x9f,0x36,0x1b,0xbe,0x31,0x3c},
+    {0xee,0x8a,0x94,0x08,0x4d,0x86,0xf4,0xb0,0x6f,0x1c,0xba,0x91,0xee,0x19,0xdc,0x07,0x58,0xa1,0xac,0xa6,0xae,0xcd,0x75,0x79,0xbb,0xd4,0x62,0x42,0x13,0x61,0x0b,0x33,0x72,0x42,0xcb,0xf9,0x93,0xbc,0x68,0xc1,0x98,0xdb,0xce,0xc7,0x1f,0x71,0xb8,0xae,0x7a,0x8d,0xac,0x34,0xaa,0x52,0x0e,0x7f,0xbb,0x55,0x7d,0x7e,0x09,0xc1,0xce,0x41,0x8a,0x80,0x6d,0xa2,0xd7,0x19,0x96,0xf7,0x6d,0x15,0x9e,0x1d,0x9e,0xd4,0x1f,0xbb,0x27,0xdf,0xa1,0xdb,0x6c,0xc3,0xd7,0x73,0x7d,0x77,0x28,0x1f,0xd9,0x4c,0xb4,0x26},
+    {0x75,0x74,0x38,0x8f,0x47,0x48,0xf0,0x51,0x3c,0xcb,0xbe,0x9c,0xf4,0xbc,0x5d,0xb2,0x55,0x20,0x9f,0xd9,0x44,0x12,0xab,0x9a,0xd6,0xa5,0x10,0x1c,0x6c,0x9e,0x70,0x2c,0x83,0x03,0x73,0x62,0x93,0xf2,0xb7,0xe1,0x2c,0x8a,0xca,0xeb,0xff,0x79,0x52,0x4b,0x14,0x13,0xd4,0xbf,0x8a,0x77,0xfc,0xda,0x0f,0x61,0x72,0x9c,0x14,0x10,0xeb,0x7d,0x7a,0xee,0x66,0x87,0x6a,0xaf,0x62,0xcb,0x0e,0xcd,0x53,0x55,0x04,0xec,0xcb,0x66,0xb5,0xe4,0x0b,0x0f,0x38,0x01,0x80,0x58,0xea,0xe2,0x2c,0xf6,0x9f,0x8e,0xe6,0x08},
+    {0xad,0x30,0xc1,0x4b,0x0a,0x50,0xad,0x34,0x9c,0xd4,0x0b,0x3d,0x49,0xdb,0x38,0x8d,0xbe,0x89,0x0a,0x50,0x98,0x3d,0x5c,0xa2,0x09,0x3b,0xba,0xee,0x87,0x3f,0x1f,0x2f,0xf9,0xf2,0xb8,0x0a,0xd5,0x09,0x2d,0x2f,0xdf,0x23,0x59,0xc5,0x8d,0x21,0xb9,0xac,0xb9,0x6c,0x76,0x73,0x26,0x34,0x8f,0x4a,0xf5,0x19,0xf7,0x38,0xd7,0x3b,0xb1,0x4c,0x4a,0xb6,0x15,0xe5,0x75,0x8c,0x84,0xf7,0x38,0x90,0x4a,0xdb,0xba,0x01,0x95,0xa5,0x50,0x1b,0x75,0x3f,0x3f,0x31,0x0d,0xc2,0xe8,0x2e,0xae,0xc0,0x53,0xe3,0xa1,0x19},
+    {0xc3,0x05,0xfa,0xba,0x60,0x75,0x1c,0x7d,0x61,0x5e,0xe5,0xc6,0xa0,0xa0,0xe1,0xb3,0x73,0x64,0xd6,0xc0,0x18,0x97,0x52,0xe3,0x86,0x34,0x0c,0xc2,0x11,0x6b,0x54,0x41,0xbd,0xbd,0x96,0xd5,0xcd,0x72,0x21,0xb4,0x40,0xfc,0xee,0x98,0x43,0x45,0xe0,0x93,0xb5,0x09,0x41,0xb4,0x47,0x53,0xb1,0x9f,0x34,0xae,0x66,0x02,0x99,0xd3,0x6b,0x73,0xb4,0xb3,0x34,0x93,0x50,0x2d,0x53,0x85,0x73,0x65,0x81,0x60,0x4b,0x11,0xfd,0x46,0x75,0x83,0x5c,0x42,0x30,0x5f,0x5f,0xcc,0x5c,0xab,0x7f,0xb8,0xa2,0x95,0x22,0x41},
+    {0xe9,0xd6,0x7e,0xf5,0x88,0x9b,0xc9,0x19,0x25,0xc8,0xf8,0x6d,0x26,0xcb,0x93,0x53,0x73,0xd2,0x0a,0xb3,0x13,0x32,0xee,0x5c,0x34,0x2e,0x2d,0xb5,0xeb,0x53,0xe1,0x14,0xc6,0xea,0x93,0xe2,0x61,0x52,0x65,0x2e,0xdb,0xac,0x33,0x21,0x03,0x92,0x5a,0x84,0x6b,0x99,0x00,0x79,0xcb,0x75,0x09,0x46,0x80,0xdd,0x5a,0x19,0x8d,0xbb,0x60,0x07,0x8a,0x81,0xe6,0xcd,0x17,0x1a,0x3e,0x41,0x84,0xa0,0x69,0xed,0xa9,0x6d,0x15,0x57,0xb1,0xcc,0xca,0x46,0x8f,0x26,0xbf,0x2c,0xf2,0xc5,0x3a,0xc3,0x9b,0xbe,0x34,0x6b},
+    {0xb2,0xc0,0x78,0x3a,0x64,0x2f,0xdf,0xf3,0x7c,0x02,0x2e,0xf2,0x1e,0x97,0x3e,0x4c,0xa3,0xb5,0xc1,0x49,0x5e,0x1c,0x7d,0xec,0x2d,0xdd,0x22,0x09,0x8f,0xc1,0x12,0x20,0xd3,0xf2,0x71,0x65,0x65,0x69,0xfc,0x11,0x7a,0x73,0x0e,0x53,0x45,0xe8,0xc9,0xc6,0x35,0x50,0xfe,0xd4,0xa2,0xe7,0x3a,0xe3,0x0b,0xd3,0x6d,0x2e,0xb6,0xc7,0xb9,0x01,0x29,0x9d,0xc8,0x5a,0xe5,0x55,0x0b,0x88,0x63,0xa7,0xa0,0x45,0x1f,0x24,0x83,0x14,0x1f,0x6c,0xe7,0xc2,0xdf,0xef,0x36,0x3d,0xe8,0xad,0x4b,0x4e,0x78,0x5b,0xaf,0x08},
+    {0x33,0x25,0x1f,0x88,0xdc,0x99,0x34,0x28,0xb6,0x23,0x93,0x77,0xda,0x25,0x05,0x9d,0xf4,0x41,0x34,0x67,0xfb,0xdd,0x7a,0x89,0x8d,0x16,0x3a,0x16,0x71,0x9d,0xb7,0x32,0x4b,0x2c,0xcc,0x89,0xd2,0x14,0x73,0xe2,0x8d,0x17,0x87,0xa2,0x11,0xbd,0xe4,0x4b,0xce,0x64,0x33,0xfa,0xd6,0x28,0xd5,0x18,0x6e,0x82,0xd9,0xaf,0xd5,0xc1,0x23,0x64,0x6a,0xb3,0xfc,0xed,0xd9,0xf8,0x85,0xcc,0xf9,0xe5,0x46,0x37,0x8f,0xc2,0xbc,0x22,0xcd,0xd3,0xe5,0xf9,0x38,0xe3,0x9d,0xe4,0xcc,0x2d,0x3e,0xc1,0xfb,0x5e,0x0a,0x48},
+    {0x71,0x20,0x62,0x01,0x0b,0xe7,0x51,0x0b,0xc5,0xaf,0x1d,0x8b,0xcf,0x05,0xb5,0x06,0xcd,0xab,0x5a,0xef,0x61,0xb0,0x6b,0x2c,0x31,0xbf,0xb7,0x0c,0x60,0x27,0xaa,0x47,0x1f,0x22,0xce,0x42,0xe4,0x4c,0x61,0xb6,0x28,0x39,0x05,0x4c,0xcc,0x9d,0x19,0x6e,0x03,0xbe,0x1c,0xdc,0xa4,0xb4,0x3f,0x66,0x06,0x8e,0x1c,0x69,0x47,0x1d,0xb3,0x24,0xc3,0xf8,0x15,0xc0,0xed,0x1e,0x54,0x2a,0x7c,0x3f,0x69,0x7c,0x7e,0xfe,0xa4,0x11,0xd6,0x78,0xa2,0x4e,0x13,0x66,0xaf,0xf0,0x94,0xa0,0xdd,0x14,0x5d,0x58,0x5b,0x54},
+    {0x0f,0x3a,0xd4,0xa0,0x5e,0x27,0xbf,0x67,0xbe,0xee,0x9b,0x08,0x34,0x8e,0xe6,0xad,0x2e,0xe7,0x79,0xd4,0x4c,0x13,0x89,0x42,0x54,0x54,0xba,0x32,0xc3,0xf9,0x62,0x0f,0xe1,0x21,0xb3,0xe3,0xd0,0xe4,0x04,0x62,0x95,0x1e,0xff,0x28,0x7a,0x63,0xaa,0x3b,0x9e,0xbd,0x99,0x5b,0xfd,0xcf,0x0c,0x0b,0x71,0xd0,0xc8,0x64,0x3e,0xdc,0x22,0x4d,0x39,0x5f,0x3b,0xd6,0x89,0x65,0xb4,0xfc,0x61,0xcf,0xcb,0x57,0x3f,0x6a,0xae,0x5c,0x05,0xfa,0x3a,0x95,0xd2,0xc2,0xba,0xfe,0x36,0x14,0x37,0x36,0x1a,0xa0,0x0f,0x1c},
+    {0xff,0x3d,0x94,0x22,0xb6,0x04,0xc6,0xd2,0xa0,0xb3,0xcf,0x44,0xce,0xbe,0x8c,0xbc,0x78,0x86,0x80,0x97,0xf3,0x4f,0x25,0x5d,0xbf,0xa6,0x1c,0x3b,0x4f,0x61,0xa3,0x0f,0x50,0x6a,0x93,0x8c,0x0e,0x2b,0x08,0x69,0xb6,0xc5,0xda,0xc1,0x35,0xa0,0xc9,0xf9,0x34,0xb6,0xdf,0xc4,0x54,0x3e,0xb7,0x6f,0x40,0xc1,0x2b,0x1d,0x9b,0x41,0x05,0x40,0xf0,0x82,0xbe,0xb9,0xbd,0xfe,0x03,0xa0,0x90,0xac,0x44,0x3a,0xaf,0xc1,0x89,0x20,0x8e,0xfa,0x54,0x19,0x91,0x9f,0x49,0xf8,0x42,0xab,0x40,0xef,0x8a,0x21,0xba,0x1f},
+    {0x3e,0xf5,0xc8,0xfa,0x48,0x94,0x54,0xab,0x41,0x37,0xa6,0x7b,0x9a,0xe8,0xf6,0x81,0x01,0x5e,0x2b,0x6c,0x7d,0x6c,0xfd,0x74,0x42,0x6e,0xc8,0xa8,0xca,0x3a,0x2e,0x39,0x94,0x01,0x7b,0x3e,0x04,0x57,0x3e,0x4f,0x7f,0xaf,0xda,0x08,0xee,0x3e,0x1d,0xa8,0xf1,0xde,0xdc,0x99,0xab,0xc6,0x39,0xc8,0xd5,0x61,0x77,0xff,0x13,0x5d,0x53,0x6c,0xaf,0x35,0x8a,0x3e,0xe9,0x34,0xbd,0x4c,0x16,0xe8,0x87,0x58,0x44,0x81,0x07,0x2e,0xab,0xb0,0x9a,0xf2,0x76,0x9c,0x31,0x19,0x3b,0xc1,0x0a,0xd5,0xe4,0x7f,0xe1,0x25},
+    {0x76,0xf6,0x04,0x1e,0xd7,0x9b,0x28,0x0a,0x95,0x0f,0x42,0xd6,0x52,0x1c,0x8e,0x20,0xab,0x1f,0x69,0x34,0xb0,0xd8,0x86,0x51,0x51,0xb3,0x9f,0x2a,0x44,0x51,0x57,0x25,0xa7,0x21,0xf1,0x76,0xf5,0x7f,0x5f,0x91,0xe3,0x87,0xcd,0x2f,0x27,0x32,0x4a,0xc3,0x26,0xe5,0x1b,0x4d,0xde,0x2f,0xba,0xcc,0x9b,0x89,0x69,0x89,0x8f,0x82,0xba,0x6b,0x01,0x39,0xfe,0x90,0x66,0xbc,0xd1,0xe2,0xd5,0x7a,0x99,0xa0,0x18,0x4a,0xb5,0x4c,0xd4,0x60,0x84,0xaf,0x14,0x69,0x1d,0x97,0xe4,0x7b,0x6b,0x7f,0x4f,0x50,0x9d,0x55},
+    {0xd5,0x54,0xeb,0xb3,0x78,0x83,0x73,0xa7,0x7c,0x3c,0x55,0xa5,0x66,0xd3,0x69,0x1d,0xba,0x00,0x28,0xf9,0x62,0xcf,0x26,0x0a,0x17,0x32,0x7e,0x80,0xd5,0x12,0xab,0x01,0xfd,0x66,0xd2,0xf6,0xe7,0x91,0x48,0x9c,0x1b,0x78,0x07,0x03,0x9b,0xa1,0x44,0x07,0x3b,0xe2,0x61,0x60,0x1d,0x8f,0x38,0x88,0x0e,0xd5,0x4b,0x35,0xa3,0xa6,0x3e,0x12,0x96,0x2d,0xe3,0x41,0x90,0x18,0x8d,0x11,0x48,0x58,0x31,0xd8,0xc2,0xe3,0xed,0xb9,0xd9,0x45,0x32,0xd8,0x71,0x42,0xab,0x1e,0x54,0xa1,0x18,0xc9,0xe2,0x61,0x39,0x4a},
+    {0xa0,0xbb,0xe6,0xf8,0xe0,0x3b,0xdc,0x71,0x0a,0xe3,0xff,0x7e,0x34,0xf8,0xce,0xd6,0x6a,0x47,0x3a,0xe1,0x5f,0x42,0x92,0xa9,0x63,0xb7,0x1d,0xfb,0xe3,0xbc,0xd6,0x2c,0x1e,0x3f,0x23,0xf3,0x44,0xd6,0x27,0x03,0x16,0xf0,0xfc,0x34,0x0e,0x26,0x9a,0x49,0x79,0xb9,0xda,0xf2,0x16,0xa7,0xb5,0x83,0x1f,0x11,0xd4,0x9b,0xad,0xee,0xac,0x68,0x10,0xc2,0xd7,0xf3,0x0e,0xc9,0xb4,0x38,0x0c,0x04,0xad,0xb7,0x24,0x6e,0x8e,0x30,0x23,0x3e,0xe7,0xb7,0xf1,0xd9,0x60,0x38,0x97,0xf5,0x08,0xb5,0xd5,0x60,0x57,0x59},
+    {0x97,0x63,0xaa,0x04,0xe1,0xbf,0x29,0x61,0xcb,0xfc,0xa7,0xa4,0x08,0x00,0x96,0x8f,0x58,0x94,0x90,0x7d,0x89,0xc0,0x8b,0x3f,0xa9,0x91,0xb2,0xdc,0x3e,0xa4,0x9f,0x70,0x90,0x27,0x02,0xfd,0xeb,0xcb,0x2a,0x88,0x60,0x57,0x11,0xc4,0x05,0x33,0xaf,0x89,0xf4,0x73,0x34,0x7d,0xe3,0x92,0xf4,0x65,0x2b,0x5a,0x51,0x54,0xdf,0xc5,0xb2,0x2c,0xca,0x2a,0xfd,0x63,0x8c,0x5d,0x0a,0xeb,0xff,0x4e,0x69,0x2e,0x66,0xc1,0x2b,0xd2,0x3a,0xb0,0xcb,0xf8,0x6e,0xf3,0x23,0x27,0x1f,0x13,0xc8,0xf0,0xec,0x29,0xf0,0x70},
+    {0x33,0x3e,0xed,0x2e,0xb3,0x07,0x13,0x46,0xe7,0x81,0x55,0xa4,0x33,0x2f,0x04,0xae,0x66,0x03,0x5f,0x19,0xd3,0x49,0x44,0xc9,0x58,0x48,0x31,0x6c,0x8a,0x5d,0x7d,0x0b,0xb9,0xb0,0x10,0x5e,0xaa,0xaf,0x6a,0x2a,0xa9,0x1a,0x04,0xef,0x70,0xa3,0xf0,0x78,0x1f,0xd6,0x3a,0xaa,0x77,0xfb,0x3e,0x77,0xe1,0xd9,0x4b,0xa7,0xa2,0xa5,0xec,0x44,0x43,0xd5,0x95,0x7b,0x32,0x48,0xd4,0x25,0x1d,0x0f,0x34,0xa3,0x00,0x83,0xd3,0x70,0x2b,0xc5,0xe1,0x60,0x1c,0x53,0x1c,0xde,0xe4,0xe9,0x7d,0x2c,0x51,0x24,0x22,0x27},
+    {0x2e,0x34,0xc5,0x49,0xaf,0x92,0xbc,0x1a,0xd0,0xfa,0xe6,0xb2,0x11,0xd8,0xee,0xff,0x29,0x4e,0xc8,0xfc,0x8d,0x8c,0xa2,0xef,0x43,0xc5,0x4c,0xa4,0x18,0xdf,0xb5,0x11,0xfc,0x75,0xa9,0x42,0x8a,0xbb,0x7b,0xbf,0x58,0xa3,0xad,0x96,0x77,0x39,0x5c,0x8c,0x48,0xaa,0xed,0xcd,0x6f,0xc7,0x7f,0xe2,0xa6,0x20,0xbc,0xf6,0xd7,0x5f,0x73,0x19,0x66,0x42,0xc8,0x42,0xd0,0x90,0xab,0xe3,0x7e,0x54,0x19,0x7f,0x0f,0x8e,0x84,0xeb,0xb9,0x97,0xa4,0x65,0xd0,0xa1,0x03,0x25,0x5f,0x89,0xdf,0x91,0x11,0x91,0xef,0x0f}
+};
+
+NAMESPACE_END  // Arch32
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_DOXYGEN_PROCESSING
+#endif  // CRYPTOPP_DONNA_32_H
diff --git a/runtime/third_party/cryptopp/donna_64.cpp b/runtime/third_party/cryptopp/donna_64.cpp
new file mode 100644
index 0000000..85d0421
--- /dev/null
+++ b/runtime/third_party/cryptopp/donna_64.cpp
@@ -0,0 +1,1815 @@
+// donna_64.cpp - written and placed in public domain by Jeffrey Walton
+//                Crypto++ specific implementation wrapped around Andrew
+//                Moon's public domain curve25519-donna and ed25519-donna,
+//                https://github.com/floodyberry/curve25519-donna and
+//                https://github.com/floodyberry/ed25519-donna.
+
+// The curve25519 and ed25519 source files multiplex different repos and
+// architectures using namespaces. The repos are Andrew Moon's
+// curve25519-donna and ed25519-donna. The architectures are 32-bit, 64-bit
+// and SSE. For example, 32-bit x25519 uses symbols from Donna::X25519 and
+// Donna::Arch32.
+
+// A fair amount of duplication happens below, but we could not directly
+// use curve25519 for both x25519 and ed25519. A close examination reveals
+// slight differences in the implementation. For example, look at the
+// two curve25519_sub functions.
+
+// If needed, see Moon's commit "Go back to ignoring 256th bit [sic]",
+// https://github.com/floodyberry/curve25519-donna/commit/57a683d18721a658
+
+#include "pch.h"
+
+#include "config.h"
+#include "donna.h"
+#include "secblock.h"
+#include "sha.h"
+#include "misc.h"
+#include "cpu.h"
+
+#include <istream>
+#include <sstream>
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wunused-function"
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4244)
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char DONNA64_FNAME[] = __FILE__;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+// Can't use GetAlignmentOf<word64>() because of C++11 and constexpr
+// Can use 'const unsigned int' because of MSVC 2013
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+# define ALIGN_SPEC 16
+#else
+# define ALIGN_SPEC 8
+#endif
+
+ANONYMOUS_NAMESPACE_END
+
+#if defined(CRYPTOPP_CURVE25519_64BIT)
+
+#include "donna_64.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word64;
+using CryptoPP::GetWord;
+using CryptoPP::PutWord;
+using CryptoPP::LITTLE_ENDIAN_ORDER;
+
+inline word64 U8TO64_LE(const byte* p)
+{
+    return GetWord<word64>(false, LITTLE_ENDIAN_ORDER, p);
+}
+
+inline void U64TO8_LE(byte* p, word64 w)
+{
+    PutWord(false, LITTLE_ENDIAN_ORDER, p, w);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+NAMESPACE_BEGIN(X25519)
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::sword32;
+using CryptoPP::word64;
+using CryptoPP::sword64;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+
+// Bring in all the symbols from the 64-bit header
+using namespace CryptoPP::Donna::Arch64;
+
+/* out = in */
+inline void
+curve25519_copy(bignum25519 out, const bignum25519 in) {
+    out[0] = in[0]; out[1] = in[1];
+    out[2] = in[2]; out[3] = in[3];
+    out[4] = in[4];
+}
+
+/* out = a + b */
+inline void
+curve25519_add(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    out[0] = a[0] + b[0];
+    out[1] = a[1] + b[1];
+    out[2] = a[2] + b[2];
+    out[3] = a[3] + b[3];
+    out[4] = a[4] + b[4];
+}
+
+/* out = a - b */
+inline void
+curve25519_sub(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    out[0] = a[0] + two54m152 - b[0];
+    out[1] = a[1] + two54m8 - b[1];
+    out[2] = a[2] + two54m8 - b[2];
+    out[3] = a[3] + two54m8 - b[3];
+    out[4] = a[4] + two54m8 - b[4];
+}
+
+/* out = (in * scalar) */
+inline void
+curve25519_scalar_product(bignum25519 out, const bignum25519 in, const word64 scalar) {
+  word128 a;
+  word64 c;
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    a = ((word128) in[0]) * scalar;     out[0] = (word64)a & reduce_mask_51; c = (word64)(a >> 51);
+    a = ((word128) in[1]) * scalar + c; out[1] = (word64)a & reduce_mask_51; c = (word64)(a >> 51);
+    a = ((word128) in[2]) * scalar + c; out[2] = (word64)a & reduce_mask_51; c = (word64)(a >> 51);
+    a = ((word128) in[3]) * scalar + c; out[3] = (word64)a & reduce_mask_51; c = (word64)(a >> 51);
+    a = ((word128) in[4]) * scalar + c; out[4] = (word64)a & reduce_mask_51; c = (word64)(a >> 51);
+                                          out[0] += c * 19;
+#else
+    mul64x64_128(a, in[0], scalar)                  out[0] = lo128(a) & reduce_mask_51; shr128(c, a, 51);
+    mul64x64_128(a, in[1], scalar) add128_64(a, c)  out[1] = lo128(a) & reduce_mask_51; shr128(c, a, 51);
+    mul64x64_128(a, in[2], scalar) add128_64(a, c)  out[2] = lo128(a) & reduce_mask_51; shr128(c, a, 51);
+    mul64x64_128(a, in[3], scalar) add128_64(a, c)  out[3] = lo128(a) & reduce_mask_51; shr128(c, a, 51);
+    mul64x64_128(a, in[4], scalar) add128_64(a, c)  out[4] = lo128(a) & reduce_mask_51; shr128(c, a, 51);
+                                                    out[0] += c * 19;
+#endif
+}
+
+/* out = a * b */
+inline void
+curve25519_mul(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+#if !defined(CRYPTOPP_WORD128_AVAILABLE)
+    word128 mul;
+#endif
+    word128 t[5];
+    word64 r0,r1,r2,r3,r4,s0,s1,s2,s3,s4,c;
+
+    r0 = b[0]; r1 = b[1]; r2 = b[2]; r3 = b[3]; r4 = b[4];
+    s0 = a[0]; s1 = a[1]; s2 = a[2]; s3 = a[3]; s4 = a[4];
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    t[0]  =  ((word128) r0) * s0;
+    t[1]  =  ((word128) r0) * s1 + ((word128) r1) * s0;
+    t[2]  =  ((word128) r0) * s2 + ((word128) r2) * s0 + ((word128) r1) * s1;
+    t[3]  =  ((word128) r0) * s3 + ((word128) r3) * s0 + ((word128) r1) * s2 + ((word128) r2) * s1;
+    t[4]  =  ((word128) r0) * s4 + ((word128) r4) * s0 + ((word128) r3) * s1 + ((word128) r1) * s3 + ((word128) r2) * s2;
+#else
+    mul64x64_128(t[0], r0, s0)
+    mul64x64_128(t[1], r0, s1) mul64x64_128(mul, r1, s0) add128(t[1], mul)
+    mul64x64_128(t[2], r0, s2) mul64x64_128(mul, r2, s0) add128(t[2], mul) mul64x64_128(mul, r1, s1) add128(t[2], mul)
+    mul64x64_128(t[3], r0, s3) mul64x64_128(mul, r3, s0) add128(t[3], mul) mul64x64_128(mul, r1, s2) add128(t[3], mul) mul64x64_128(mul, r2, s1) add128(t[3], mul)
+    mul64x64_128(t[4], r0, s4) mul64x64_128(mul, r4, s0) add128(t[4], mul) mul64x64_128(mul, r3, s1) add128(t[4], mul) mul64x64_128(mul, r1, s3) add128(t[4], mul) mul64x64_128(mul, r2, s2) add128(t[4], mul)
+#endif
+
+    r1 *= 19; r2 *= 19; r3 *= 19; r4 *= 19;
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    t[0] += ((word128) r4) * s1 + ((word128) r1) * s4 + ((word128) r2) * s3 + ((word128) r3) * s2;
+    t[1] += ((word128) r4) * s2 + ((word128) r2) * s4 + ((word128) r3) * s3;
+    t[2] += ((word128) r4) * s3 + ((word128) r3) * s4;
+    t[3] += ((word128) r4) * s4;
+#else
+    mul64x64_128(mul, r4, s1) add128(t[0], mul) mul64x64_128(mul, r1, s4) add128(t[0], mul) mul64x64_128(mul, r2, s3) add128(t[0], mul) mul64x64_128(mul, r3, s2) add128(t[0], mul)
+    mul64x64_128(mul, r4, s2) add128(t[1], mul) mul64x64_128(mul, r2, s4) add128(t[1], mul) mul64x64_128(mul, r3, s3) add128(t[1], mul)
+    mul64x64_128(mul, r4, s3) add128(t[2], mul) mul64x64_128(mul, r3, s4) add128(t[2], mul)
+    mul64x64_128(mul, r4, s4) add128(t[3], mul)
+#endif
+
+                         r0 = lo128(t[0]) & reduce_mask_51; shr128(c, t[0], 51);
+    add128_64(t[1], c)   r1 = lo128(t[1]) & reduce_mask_51; shr128(c, t[1], 51);
+    add128_64(t[2], c)   r2 = lo128(t[2]) & reduce_mask_51; shr128(c, t[2], 51);
+    add128_64(t[3], c)   r3 = lo128(t[3]) & reduce_mask_51; shr128(c, t[3], 51);
+    add128_64(t[4], c)   r4 = lo128(t[4]) & reduce_mask_51; shr128(c, t[4], 51);
+    r0 +=   c * 19; c = r0 >> 51; r0 = r0 & reduce_mask_51;
+    r1 +=   c;
+
+    out[0] = r0; out[1] = r1; out[2] = r2; out[3] = r3; out[4] = r4;
+}
+
+/* out = in^(2 * count) */
+inline void
+curve25519_square_times(bignum25519 out, const bignum25519 in, word64 count) {
+#if !defined(CRYPTOPP_WORD128_AVAILABLE)
+    word128 mul;
+#endif
+    word128 t[5];
+    word64 r0,r1,r2,r3,r4,c;
+    word64 d0,d1,d2,d4,d419;
+
+    r0 = in[0]; r1 = in[1]; r2 = in[2]; r3 = in[3]; r4 = in[4];
+
+    do {
+        d0 = r0 * 2; d1 = r1 * 2;
+        d2 = r2 * 2 * 19;
+        d419 = r4 * 19; d4 = d419 * 2;
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+        t[0] = ((word128) r0) * r0 + ((word128) d4) * r1 + (((word128) d2) * (r3     ));
+        t[1] = ((word128) d0) * r1 + ((word128) d4) * r2 + (((word128) r3) * (r3 * 19));
+        t[2] = ((word128) d0) * r2 + ((word128) r1) * r1 + (((word128) d4) * (r3     ));
+        t[3] = ((word128) d0) * r3 + ((word128) d1) * r2 + (((word128) r4) * (d419   ));
+        t[4] = ((word128) d0) * r4 + ((word128) d1) * r3 + (((word128) r2) * (r2     ));
+#else
+        mul64x64_128(t[0], r0, r0) mul64x64_128(mul, d4, r1) add128(t[0], mul) mul64x64_128(mul, d2,      r3) add128(t[0], mul)
+        mul64x64_128(t[1], d0, r1) mul64x64_128(mul, d4, r2) add128(t[1], mul) mul64x64_128(mul, r3, r3 * 19) add128(t[1], mul)
+        mul64x64_128(t[2], d0, r2) mul64x64_128(mul, r1, r1) add128(t[2], mul) mul64x64_128(mul, d4,      r3) add128(t[2], mul)
+        mul64x64_128(t[3], d0, r3) mul64x64_128(mul, d1, r2) add128(t[3], mul) mul64x64_128(mul, r4,    d419) add128(t[3], mul)
+        mul64x64_128(t[4], d0, r4) mul64x64_128(mul, d1, r3) add128(t[4], mul) mul64x64_128(mul, r2,      r2) add128(t[4], mul)
+#endif
+
+                             r0 = lo128(t[0]) & reduce_mask_51; shr128(c, t[0], 51);
+        add128_64(t[1], c)   r1 = lo128(t[1]) & reduce_mask_51; shr128(c, t[1], 51);
+        add128_64(t[2], c)   r2 = lo128(t[2]) & reduce_mask_51; shr128(c, t[2], 51);
+        add128_64(t[3], c)   r3 = lo128(t[3]) & reduce_mask_51; shr128(c, t[3], 51);
+        add128_64(t[4], c)   r4 = lo128(t[4]) & reduce_mask_51; shr128(c, t[4], 51);
+        r0 +=   c * 19; c = r0 >> 51; r0 = r0 & reduce_mask_51;
+        r1 +=   c;
+    } while(--count);
+
+    out[0] = r0; out[1] = r1; out[2] = r2; out[3] = r3; out[4] = r4;
+}
+
+inline void
+curve25519_square(bignum25519 out, const bignum25519 in) {
+#if !defined(CRYPTOPP_WORD128_AVAILABLE)
+    word128 mul;
+#endif
+    word128 t[5];
+    word64 r0,r1,r2,r3,r4,c;
+    word64 d0,d1,d2,d4,d419;
+
+    r0 = in[0]; r1 = in[1]; r2 = in[2]; r3 = in[3]; r4 = in[4];
+
+    d0 = r0 * 2; d1 = r1 * 2;
+    d2 = r2 * 2 * 19;
+    d419 = r4 * 19; d4 = d419 * 2;
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    t[0] = ((word128) r0) * r0 + ((word128) d4) * r1 + (((word128) d2) * (r3     ));
+    t[1] = ((word128) d0) * r1 + ((word128) d4) * r2 + (((word128) r3) * (r3 * 19));
+    t[2] = ((word128) d0) * r2 + ((word128) r1) * r1 + (((word128) d4) * (r3     ));
+    t[3] = ((word128) d0) * r3 + ((word128) d1) * r2 + (((word128) r4) * (d419   ));
+    t[4] = ((word128) d0) * r4 + ((word128) d1) * r3 + (((word128) r2) * (r2     ));
+#else
+    mul64x64_128(t[0], r0, r0) mul64x64_128(mul, d4, r1) add128(t[0], mul) mul64x64_128(mul, d2,      r3) add128(t[0], mul)
+    mul64x64_128(t[1], d0, r1) mul64x64_128(mul, d4, r2) add128(t[1], mul) mul64x64_128(mul, r3, r3 * 19) add128(t[1], mul)
+    mul64x64_128(t[2], d0, r2) mul64x64_128(mul, r1, r1) add128(t[2], mul) mul64x64_128(mul, d4,      r3) add128(t[2], mul)
+    mul64x64_128(t[3], d0, r3) mul64x64_128(mul, d1, r2) add128(t[3], mul) mul64x64_128(mul, r4,    d419) add128(t[3], mul)
+    mul64x64_128(t[4], d0, r4) mul64x64_128(mul, d1, r3) add128(t[4], mul) mul64x64_128(mul, r2,      r2) add128(t[4], mul)
+#endif
+
+                         r0 = lo128(t[0]) & reduce_mask_51; shr128(c, t[0], 51);
+    add128_64(t[1], c)   r1 = lo128(t[1]) & reduce_mask_51; shr128(c, t[1], 51);
+    add128_64(t[2], c)   r2 = lo128(t[2]) & reduce_mask_51; shr128(c, t[2], 51);
+    add128_64(t[3], c)   r3 = lo128(t[3]) & reduce_mask_51; shr128(c, t[3], 51);
+    add128_64(t[4], c)   r4 = lo128(t[4]) & reduce_mask_51; shr128(c, t[4], 51);
+    r0 +=   c * 19; c = r0 >> 51; r0 = r0 & reduce_mask_51;
+    r1 +=   c;
+
+    out[0] = r0; out[1] = r1; out[2] = r2; out[3] = r3; out[4] = r4;
+}
+
+/* Take a little-endian, 32-byte number and expand it into polynomial form */
+inline void
+curve25519_expand(bignum25519 out, const byte *in) {
+    word64 x0,x1,x2,x3;
+    GetBlock<word64, LittleEndian> block(in);
+    block(x0)(x1)(x2)(x3);
+
+    out[0] = x0 & reduce_mask_51; x0 = (x0 >> 51) | (x1 << 13);
+    out[1] = x0 & reduce_mask_51; x1 = (x1 >> 38) | (x2 << 26);
+    out[2] = x1 & reduce_mask_51; x2 = (x2 >> 25) | (x3 << 39);
+    out[3] = x2 & reduce_mask_51; x3 = (x3 >> 12);
+    out[4] = x3 & reduce_mask_51; /* ignore the top bit */
+}
+
+/* Take a fully reduced polynomial form number and contract it into a
+ * little-endian, 32-byte array
+ */
+inline void
+curve25519_contract(byte *out, const bignum25519 input) {
+    word64 t[5];
+    word64 f, i;
+
+    t[0] = input[0];
+    t[1] = input[1];
+    t[2] = input[2];
+    t[3] = input[3];
+    t[4] = input[4];
+
+    #define curve25519_contract_carry() \
+        t[1] += t[0] >> 51; t[0] &= reduce_mask_51; \
+        t[2] += t[1] >> 51; t[1] &= reduce_mask_51; \
+        t[3] += t[2] >> 51; t[2] &= reduce_mask_51; \
+        t[4] += t[3] >> 51; t[3] &= reduce_mask_51;
+
+    #define curve25519_contract_carry_full() curve25519_contract_carry() \
+        t[0] += 19 * (t[4] >> 51); t[4] &= reduce_mask_51;
+
+    #define curve25519_contract_carry_final() curve25519_contract_carry() \
+        t[4] &= reduce_mask_51;
+
+    curve25519_contract_carry_full()
+    curve25519_contract_carry_full()
+
+    /* now t is between 0 and 2^255-1, properly carried. */
+    /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */
+    t[0] += 19;
+    curve25519_contract_carry_full()
+
+    /* now between 19 and 2^255-1 in both cases, and offset by 19. */
+    t[0] += 0x8000000000000 - 19;
+    t[1] += 0x8000000000000 - 1;
+    t[2] += 0x8000000000000 - 1;
+    t[3] += 0x8000000000000 - 1;
+    t[4] += 0x8000000000000 - 1;
+
+    /* now between 2^255 and 2^256-20, and offset by 2^255. */
+    curve25519_contract_carry_final()
+
+    #define write51full(n,shift) \
+        f = ((t[n] >> shift) | (t[n+1] << (51 - shift))); \
+        for (i = 0; i < 8; i++, f >>= 8) *out++ = (byte)f;
+    #define write51(n) write51full(n,13*n)
+
+    write51(0)
+    write51(1)
+    write51(2)
+    write51(3)
+
+    #undef curve25519_contract_carry
+    #undef curve25519_contract_carry_full
+    #undef curve25519_contract_carry_final
+    #undef write51full
+    #undef write51
+}
+
+/*
+ * Swap the contents of [qx] and [qpx] iff @swap is non-zero
+ */
+inline void
+curve25519_swap_conditional(bignum25519 x, bignum25519 qpx, word64 iswap) {
+    const word64 swap = (word64)(-(sword64)iswap);
+    word64 x0,x1,x2,x3,x4;
+
+    x0 = swap & (x[0] ^ qpx[0]); x[0] ^= x0; qpx[0] ^= x0;
+    x1 = swap & (x[1] ^ qpx[1]); x[1] ^= x1; qpx[1] ^= x1;
+    x2 = swap & (x[2] ^ qpx[2]); x[2] ^= x2; qpx[2] ^= x2;
+    x3 = swap & (x[3] ^ qpx[3]); x[3] ^= x3; qpx[3] ^= x3;
+    x4 = swap & (x[4] ^ qpx[4]); x[4] ^= x4; qpx[4] ^= x4;
+}
+
+/*
+ * In:  b =   2^5 - 2^0
+ * Out: b = 2^250 - 2^0
+ */
+void
+curve25519_pow_two5mtwo0_two250mtwo0(bignum25519 b) {
+    ALIGN(ALIGN_SPEC) bignum25519 t0,c;
+
+    /* 2^5  - 2^0 */ /* b */
+    /* 2^10 - 2^5 */ curve25519_square_times(t0, b, 5);
+    /* 2^10 - 2^0 */ curve25519_mul(b, t0, b);
+    /* 2^20 - 2^10 */ curve25519_square_times(t0, b, 10);
+    /* 2^20 - 2^0 */ curve25519_mul(c, t0, b);
+    /* 2^40 - 2^20 */ curve25519_square_times(t0, c, 20);
+    /* 2^40 - 2^0 */ curve25519_mul(t0, t0, c);
+    /* 2^50 - 2^10 */ curve25519_square_times(t0, t0, 10);
+    /* 2^50 - 2^0 */ curve25519_mul(b, t0, b);
+    /* 2^100 - 2^50 */ curve25519_square_times(t0, b, 50);
+    /* 2^100 - 2^0 */ curve25519_mul(c, t0, b);
+    /* 2^200 - 2^100 */ curve25519_square_times(t0, c, 100);
+    /* 2^200 - 2^0 */ curve25519_mul(t0, t0, c);
+    /* 2^250 - 2^50 */ curve25519_square_times(t0, t0, 50);
+    /* 2^250 - 2^0 */ curve25519_mul(b, t0, b);
+}
+
+/*
+ * z^(p - 2) = z(2^255 - 21)
+ */
+void
+curve25519_recip(bignum25519 out, const bignum25519 z) {
+    ALIGN(ALIGN_SPEC) bignum25519 a, t0, b;
+
+    /* 2 */ curve25519_square(a, z); /* a = 2 */
+    /* 8 */ curve25519_square_times(t0, a, 2);
+    /* 9 */ curve25519_mul(b, t0, z); /* b = 9 */
+    /* 11 */ curve25519_mul(a, b, a); /* a = 11 */
+    /* 22 */ curve25519_square(t0, a);
+    /* 2^5 - 2^0 = 31 */ curve25519_mul(b, t0, b);
+    /* 2^250 - 2^0 */ curve25519_pow_two5mtwo0_two250mtwo0(b);
+    /* 2^255 - 2^5 */ curve25519_square_times(b, b, 5);
+    /* 2^255 - 21 */  curve25519_mul(out, b, a);
+}
+
+ANONYMOUS_NAMESPACE_END
+NAMESPACE_END  // X25519
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+//******************************* ed25519 *******************************//
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+NAMESPACE_BEGIN(Ed25519)
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::sword32;
+using CryptoPP::word64;
+using CryptoPP::sword64;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+
+using CryptoPP::SHA512;
+
+// Bring in all the symbols from the 64-bit header
+using namespace CryptoPP::Donna::Arch64;
+
+/* out = in */
+inline void
+curve25519_copy(bignum25519 out, const bignum25519 in) {
+    out[0] = in[0]; out[1] = in[1];
+    out[2] = in[2]; out[3] = in[3];
+    out[4] = in[4];
+}
+
+/* out = a + b */
+inline void
+curve25519_add(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    out[0] = a[0] + b[0]; out[1] = a[1] + b[1];
+    out[2] = a[2] + b[2]; out[3] = a[3] + b[3];
+    out[4] = a[4] + b[4];
+}
+
+/* out = a + b, where a and/or b are the result of a basic op (add,sub) */
+inline void
+curve25519_add_after_basic(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    out[0] = a[0] + b[0]; out[1] = a[1] + b[1];
+    out[2] = a[2] + b[2]; out[3] = a[3] + b[3];
+    out[4] = a[4] + b[4];
+}
+
+inline void
+curve25519_add_reduce(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word64 c;
+    out[0] = a[0] + b[0]    ; c = (out[0] >> 51); out[0] &= reduce_mask_51;
+    out[1] = a[1] + b[1] + c; c = (out[1] >> 51); out[1] &= reduce_mask_51;
+    out[2] = a[2] + b[2] + c; c = (out[2] >> 51); out[2] &= reduce_mask_51;
+    out[3] = a[3] + b[3] + c; c = (out[3] >> 51); out[3] &= reduce_mask_51;
+    out[4] = a[4] + b[4] + c; c = (out[4] >> 51); out[4] &= reduce_mask_51;
+    out[0] += c * 19;
+}
+
+/* out = a - b */
+inline void
+curve25519_sub(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    out[0] = a[0] + twoP0    - b[0];
+    out[1] = a[1] + twoP1234 - b[1];
+    out[2] = a[2] + twoP1234 - b[2];
+    out[3] = a[3] + twoP1234 - b[3];
+    out[4] = a[4] + twoP1234 - b[4];
+}
+
+/* out = a - b, where a and/or b are the result of a basic op (add,sub) */
+inline void
+curve25519_sub_after_basic(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    out[0] = a[0] + fourP0    - b[0];
+    out[1] = a[1] + fourP1234 - b[1];
+    out[2] = a[2] + fourP1234 - b[2];
+    out[3] = a[3] + fourP1234 - b[3];
+    out[4] = a[4] + fourP1234 - b[4];
+}
+
+inline void
+curve25519_sub_reduce(bignum25519 out, const bignum25519 a, const bignum25519 b) {
+    word64 c;
+    out[0] = a[0] + fourP0    - b[0]    ; c = (out[0] >> 51); out[0] &= reduce_mask_51;
+    out[1] = a[1] + fourP1234 - b[1] + c; c = (out[1] >> 51); out[1] &= reduce_mask_51;
+    out[2] = a[2] + fourP1234 - b[2] + c; c = (out[2] >> 51); out[2] &= reduce_mask_51;
+    out[3] = a[3] + fourP1234 - b[3] + c; c = (out[3] >> 51); out[3] &= reduce_mask_51;
+    out[4] = a[4] + fourP1234 - b[4] + c; c = (out[4] >> 51); out[4] &= reduce_mask_51;
+    out[0] += c * 19;
+}
+
+/* out = -a */
+inline void
+curve25519_neg(bignum25519 out, const bignum25519 a) {
+    word64 c;
+    out[0] = twoP0    - a[0]    ; c = (out[0] >> 51); out[0] &= reduce_mask_51;
+    out[1] = twoP1234 - a[1] + c; c = (out[1] >> 51); out[1] &= reduce_mask_51;
+    out[2] = twoP1234 - a[2] + c; c = (out[2] >> 51); out[2] &= reduce_mask_51;
+    out[3] = twoP1234 - a[3] + c; c = (out[3] >> 51); out[3] &= reduce_mask_51;
+    out[4] = twoP1234 - a[4] + c; c = (out[4] >> 51); out[4] &= reduce_mask_51;
+    out[0] += c * 19;
+}
+
+/* out = a * b */
+inline void
+curve25519_mul(bignum25519 out, const bignum25519 in2, const bignum25519 in) {
+#if !defined(CRYPTOPP_WORD128_AVAILABLE)
+    word128 mul;
+#endif
+    word128 t[5];
+    word64 r0,r1,r2,r3,r4,s0,s1,s2,s3,s4,c;
+
+    r0 = in[0]; r1 = in[1];
+    r2 = in[2]; r3 = in[3];
+    r4 = in[4];
+
+    s0 = in2[0]; s1 = in2[1];
+    s2 = in2[2]; s3 = in2[3];
+    s4 = in2[4];
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    t[0]  =  ((word128) r0) * s0;
+    t[1]  =  ((word128) r0) * s1 + ((word128) r1) * s0;
+    t[2]  =  ((word128) r0) * s2 + ((word128) r2) * s0 + ((word128) r1) * s1;
+    t[3]  =  ((word128) r0) * s3 + ((word128) r3) * s0 + ((word128) r1) * s2 + ((word128) r2) * s1;
+    t[4]  =  ((word128) r0) * s4 + ((word128) r4) * s0 + ((word128) r3) * s1 + ((word128) r1) * s3 + ((word128) r2) * s2;
+#else
+    mul64x64_128(t[0], r0, s0)
+    mul64x64_128(t[1], r0, s1) mul64x64_128(mul, r1, s0) add128(t[1], mul)
+    mul64x64_128(t[2], r0, s2) mul64x64_128(mul, r2, s0) add128(t[2], mul) mul64x64_128(mul, r1, s1) add128(t[2], mul)
+    mul64x64_128(t[3], r0, s3) mul64x64_128(mul, r3, s0) add128(t[3], mul) mul64x64_128(mul, r1, s2) add128(t[3], mul) mul64x64_128(mul, r2, s1) add128(t[3], mul)
+    mul64x64_128(t[4], r0, s4) mul64x64_128(mul, r4, s0) add128(t[4], mul) mul64x64_128(mul, r3, s1) add128(t[4], mul) mul64x64_128(mul, r1, s3) add128(t[4], mul) mul64x64_128(mul, r2, s2) add128(t[4], mul)
+#endif
+
+    r1 *= 19; r2 *= 19;
+    r3 *= 19; r4 *= 19;
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    t[0] += ((word128) r4) * s1 + ((word128) r1) * s4 + ((word128) r2) * s3 + ((word128) r3) * s2;
+    t[1] += ((word128) r4) * s2 + ((word128) r2) * s4 + ((word128) r3) * s3;
+    t[2] += ((word128) r4) * s3 + ((word128) r3) * s4;
+    t[3] += ((word128) r4) * s4;
+#else
+    mul64x64_128(mul, r4, s1) add128(t[0], mul) mul64x64_128(mul, r1, s4) add128(t[0], mul) mul64x64_128(mul, r2, s3) add128(t[0], mul) mul64x64_128(mul, r3, s2) add128(t[0], mul)
+    mul64x64_128(mul, r4, s2) add128(t[1], mul) mul64x64_128(mul, r2, s4) add128(t[1], mul) mul64x64_128(mul, r3, s3) add128(t[1], mul)
+    mul64x64_128(mul, r4, s3) add128(t[2], mul) mul64x64_128(mul, r3, s4) add128(t[2], mul)
+    mul64x64_128(mul, r4, s4) add128(t[3], mul)
+#endif
+
+                         r0 = lo128(t[0]) & reduce_mask_51; shr128(c, t[0], 51);
+    add128_64(t[1], c)   r1 = lo128(t[1]) & reduce_mask_51; shr128(c, t[1], 51);
+    add128_64(t[2], c)   r2 = lo128(t[2]) & reduce_mask_51; shr128(c, t[2], 51);
+    add128_64(t[3], c)   r3 = lo128(t[3]) & reduce_mask_51; shr128(c, t[3], 51);
+    add128_64(t[4], c)   r4 = lo128(t[4]) & reduce_mask_51; shr128(c, t[4], 51);
+    r0 +=   c * 19; c = r0 >> 51; r0 = r0 & reduce_mask_51;
+    r1 +=   c;
+
+    out[0] = r0; out[1] = r1;
+    out[2] = r2; out[3] = r3;
+    out[4] = r4;
+}
+
+void
+curve25519_mul_noinline(bignum25519 out, const bignum25519 in2, const bignum25519 in) {
+    curve25519_mul(out, in2, in);
+}
+
+/* out = in^(2 * count) */
+void
+curve25519_square_times(bignum25519 out, const bignum25519 in, word64 count) {
+#if !defined(CRYPTOPP_WORD128_AVAILABLE)
+    word128 mul;
+#endif
+    word128 t[5];
+    word64 r0,r1,r2,r3,r4,c;
+    word64 d0,d1,d2,d4,d419;
+
+    r0 = in[0]; r1 = in[1];
+    r2 = in[2]; r3 = in[3];
+    r4 = in[4];
+
+    do {
+        d0 = r0 * 2;
+        d1 = r1 * 2;
+        d2 = r2 * 2 * 19;
+        d419 = r4 * 19;
+        d4 = d419 * 2;
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+        t[0] = ((word128) r0) * r0 + ((word128) d4) * r1 + (((word128) d2) * (r3     ));
+        t[1] = ((word128) d0) * r1 + ((word128) d4) * r2 + (((word128) r3) * (r3 * 19));
+        t[2] = ((word128) d0) * r2 + ((word128) r1) * r1 + (((word128) d4) * (r3     ));
+        t[3] = ((word128) d0) * r3 + ((word128) d1) * r2 + (((word128) r4) * (d419   ));
+        t[4] = ((word128) d0) * r4 + ((word128) d1) * r3 + (((word128) r2) * (r2     ));
+#else
+        mul64x64_128(t[0], r0, r0) mul64x64_128(mul, d4, r1) add128(t[0], mul) mul64x64_128(mul, d2,      r3) add128(t[0], mul)
+        mul64x64_128(t[1], d0, r1) mul64x64_128(mul, d4, r2) add128(t[1], mul) mul64x64_128(mul, r3, r3 * 19) add128(t[1], mul)
+        mul64x64_128(t[2], d0, r2) mul64x64_128(mul, r1, r1) add128(t[2], mul) mul64x64_128(mul, d4,      r3) add128(t[2], mul)
+        mul64x64_128(t[3], d0, r3) mul64x64_128(mul, d1, r2) add128(t[3], mul) mul64x64_128(mul, r4,    d419) add128(t[3], mul)
+        mul64x64_128(t[4], d0, r4) mul64x64_128(mul, d1, r3) add128(t[4], mul) mul64x64_128(mul, r2,      r2) add128(t[4], mul)
+#endif
+
+        r0 = lo128(t[0]) & reduce_mask_51;
+        r1 = lo128(t[1]) & reduce_mask_51; shl128(c, t[0], 13); r1 += c;
+        r2 = lo128(t[2]) & reduce_mask_51; shl128(c, t[1], 13); r2 += c;
+        r3 = lo128(t[3]) & reduce_mask_51; shl128(c, t[2], 13); r3 += c;
+        r4 = lo128(t[4]) & reduce_mask_51; shl128(c, t[3], 13); r4 += c;
+                                           shl128(c, t[4], 13); r0 += c * 19;
+                       c = r0 >> 51; r0 &= reduce_mask_51;
+        r1 += c     ;  c = r1 >> 51; r1 &= reduce_mask_51;
+        r2 += c     ;  c = r2 >> 51; r2 &= reduce_mask_51;
+        r3 += c     ;  c = r3 >> 51; r3 &= reduce_mask_51;
+        r4 += c     ;  c = r4 >> 51; r4 &= reduce_mask_51;
+        r0 += c * 19;
+    } while(--count);
+
+    out[0] = r0; out[1] = r1;
+    out[2] = r2; out[3] = r3;
+    out[4] = r4;
+}
+
+inline void
+curve25519_square(bignum25519 out, const bignum25519 in) {
+#if !defined(CRYPTOPP_WORD128_AVAILABLE)
+    word128 mul;
+#endif
+    word128 t[5];
+    word64 r0,r1,r2,r3,r4,c;
+    word64 d0,d1,d2,d4,d419;
+
+    r0 = in[0]; r1 = in[1];
+    r2 = in[2]; r3 = in[3];
+    r4 = in[4];
+
+    d0 = r0 * 2; d1 = r1 * 2;
+    d2 = r2 * 2 * 19;
+    d419 = r4 * 19;
+    d4 = d419 * 2;
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    t[0] = ((word128) r0) * r0 + ((word128) d4) * r1 + (((word128) d2) * (r3     ));
+    t[1] = ((word128) d0) * r1 + ((word128) d4) * r2 + (((word128) r3) * (r3 * 19));
+    t[2] = ((word128) d0) * r2 + ((word128) r1) * r1 + (((word128) d4) * (r3     ));
+    t[3] = ((word128) d0) * r3 + ((word128) d1) * r2 + (((word128) r4) * (d419   ));
+    t[4] = ((word128) d0) * r4 + ((word128) d1) * r3 + (((word128) r2) * (r2     ));
+#else
+    mul64x64_128(t[0], r0, r0) mul64x64_128(mul, d4, r1) add128(t[0], mul) mul64x64_128(mul, d2,      r3) add128(t[0], mul)
+    mul64x64_128(t[1], d0, r1) mul64x64_128(mul, d4, r2) add128(t[1], mul) mul64x64_128(mul, r3, r3 * 19) add128(t[1], mul)
+    mul64x64_128(t[2], d0, r2) mul64x64_128(mul, r1, r1) add128(t[2], mul) mul64x64_128(mul, d4,      r3) add128(t[2], mul)
+    mul64x64_128(t[3], d0, r3) mul64x64_128(mul, d1, r2) add128(t[3], mul) mul64x64_128(mul, r4,    d419) add128(t[3], mul)
+    mul64x64_128(t[4], d0, r4) mul64x64_128(mul, d1, r3) add128(t[4], mul) mul64x64_128(mul, r2,      r2) add128(t[4], mul)
+#endif
+
+                         r0 = lo128(t[0]) & reduce_mask_51; shr128(c, t[0], 51);
+    add128_64(t[1], c)   r1 = lo128(t[1]) & reduce_mask_51; shr128(c, t[1], 51);
+    add128_64(t[2], c)   r2 = lo128(t[2]) & reduce_mask_51; shr128(c, t[2], 51);
+    add128_64(t[3], c)   r3 = lo128(t[3]) & reduce_mask_51; shr128(c, t[3], 51);
+    add128_64(t[4], c)   r4 = lo128(t[4]) & reduce_mask_51; shr128(c, t[4], 51);
+    r0 +=   c * 19; c = r0 >> 51; r0 = r0 & reduce_mask_51;
+    r1 +=   c;
+
+    out[0] = r0; out[1] = r1;
+    out[2] = r2; out[3] = r3;
+    out[4] = r4;
+}
+
+/* Take a little-endian, 32-byte number and expand it into polynomial form */
+inline void
+curve25519_expand(bignum25519 out, const byte *in) {
+    word64 x0,x1,x2,x3;
+    GetBlock<word64, LittleEndian> block(in);
+    block(x0)(x1)(x2)(x3);
+
+    out[0] = x0 & reduce_mask_51; x0 = (x0 >> 51) | (x1 << 13);
+    out[1] = x0 & reduce_mask_51; x1 = (x1 >> 38) | (x2 << 26);
+    out[2] = x1 & reduce_mask_51; x2 = (x2 >> 25) | (x3 << 39);
+    out[3] = x2 & reduce_mask_51; x3 = (x3 >> 12);
+    out[4] = x3 & reduce_mask_51;
+}
+
+/* Take a fully reduced polynomial form number and contract it into a
+ * little-endian, 32-byte array
+ */
+inline void
+curve25519_contract(byte *out, const bignum25519 input) {
+    word64 t[5];
+    word64 f, i;
+
+    t[0] = input[0];
+    t[1] = input[1];
+    t[2] = input[2];
+    t[3] = input[3];
+    t[4] = input[4];
+
+    #define curve25519_contract_carry() \
+        t[1] += t[0] >> 51; t[0] &= reduce_mask_51; \
+        t[2] += t[1] >> 51; t[1] &= reduce_mask_51; \
+        t[3] += t[2] >> 51; t[2] &= reduce_mask_51; \
+        t[4] += t[3] >> 51; t[3] &= reduce_mask_51;
+
+    #define curve25519_contract_carry_full() curve25519_contract_carry() \
+        t[0] += 19 * (t[4] >> 51); t[4] &= reduce_mask_51;
+
+    #define curve25519_contract_carry_final() curve25519_contract_carry() \
+        t[4] &= reduce_mask_51;
+
+    curve25519_contract_carry_full()
+    curve25519_contract_carry_full()
+
+    /* now t is between 0 and 2^255-1, properly carried. */
+    /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */
+    t[0] += 19;
+    curve25519_contract_carry_full()
+
+    /* now between 19 and 2^255-1 in both cases, and offset by 19. */
+    t[0] += (reduce_mask_51 + 1) - 19;
+    t[1] += (reduce_mask_51 + 1) - 1;
+    t[2] += (reduce_mask_51 + 1) - 1;
+    t[3] += (reduce_mask_51 + 1) - 1;
+    t[4] += (reduce_mask_51 + 1) - 1;
+
+    /* now between 2^255 and 2^256-20, and offset by 2^255. */
+    curve25519_contract_carry_final()
+
+    #define write51full(n,shift) \
+        f = ((t[n] >> shift) | (t[n+1] << (51 - shift))); \
+        for (i = 0; i < 8; i++, f >>= 8) *out++ = (byte)f;
+    #define write51(n) write51full(n,13*n)
+    write51(0)
+    write51(1)
+    write51(2)
+    write51(3)
+}
+
+#if !defined(ED25519_GCC_64BIT_CHOOSE)
+
+/* out = (flag) ? in : out */
+inline void
+curve25519_move_conditional_bytes(byte out[96], const byte in[96], word64 flag)
+{
+    // TODO: enable this code path once we can test and benchmark it.
+    // It is about 24 insns shorter, it avoids punning which may be UB,
+    // and it is guaranteed constant time.
+#if defined(__GNUC__) && defined(__x86_64__) && 0
+    const word32 iter = 96/sizeof(word64);
+    word64* outq = reinterpret_cast<word64*>(out);
+    const word64* inq = reinterpret_cast<const word64*>(in);
+    word64 idx=0, val;
+
+    __asm__ __volatile__ (
+        ".att_syntax                         ;\n"
+        "cmpq     $0, %[flag]                ;\n"  // compare, set ZERO flag
+        "movq     %[iter], %%rcx             ;\n"  // load iteration count
+        "1:                                  ;\n"
+        "  movq     (%[idx],%[out]), %[val]  ;\n"  // val = out[idx]
+        "  cmovnzq  (%[idx],%[in]), %[val]   ;\n"  // copy in[idx] to val if NZ
+        "  movq     %[val], (%[idx],%[out])  ;\n"  // out[idx] = val
+        "  leaq     8(%[idx]), %[idx]        ;\n"  // increment index
+        "  loopnz   1b                       ;\n"  // does not affect flags
+        : [out] "+S" (outq), [in] "+D" (inq),
+          [idx] "+b" (idx), [val] "=r" (val)
+        : [flag] "g" (flag), [iter] "I" (iter)
+        : "rcx", "memory", "cc"
+    );
+#else
+    const word64 nb = flag - 1, b = ~nb;
+    const word64 *inq = (const word64 *)(const void*)in;
+    word64 *outq = (word64 *)(void *)out;
+    outq[0] = (outq[0] & nb) | (inq[0] & b);
+    outq[1] = (outq[1] & nb) | (inq[1] & b);
+    outq[2] = (outq[2] & nb) | (inq[2] & b);
+    outq[3] = (outq[3] & nb) | (inq[3] & b);
+    outq[4] = (outq[4] & nb) | (inq[4] & b);
+    outq[5] = (outq[5] & nb) | (inq[5] & b);
+    outq[6] = (outq[6] & nb) | (inq[6] & b);
+    outq[7] = (outq[7] & nb) | (inq[7] & b);
+    outq[8] = (outq[8] & nb) | (inq[8] & b);
+    outq[9] = (outq[9] & nb) | (inq[9] & b);
+    outq[10] = (outq[10] & nb) | (inq[10] & b);
+    outq[11] = (outq[11] & nb) | (inq[11] & b);
+#endif
+}
+
+/* if (iswap) swap(a, b) */
+inline void
+curve25519_swap_conditional(bignum25519 a, bignum25519 b, word64 iswap) {
+    const word64 swap = (word64)(-(sword64)iswap);
+    word64 x0,x1,x2,x3,x4;
+
+    x0 = swap & (a[0] ^ b[0]); a[0] ^= x0; b[0] ^= x0;
+    x1 = swap & (a[1] ^ b[1]); a[1] ^= x1; b[1] ^= x1;
+    x2 = swap & (a[2] ^ b[2]); a[2] ^= x2; b[2] ^= x2;
+    x3 = swap & (a[3] ^ b[3]); a[3] ^= x3; b[3] ^= x3;
+    x4 = swap & (a[4] ^ b[4]); a[4] ^= x4; b[4] ^= x4;
+}
+
+#endif /* ED25519_GCC_64BIT_CHOOSE */
+
+// ************************************************************************************
+
+inline void
+ed25519_hash(byte *hash, const byte *in, size_t inlen) {
+    SHA512().CalculateDigest(hash, in, inlen);
+}
+
+inline void
+ed25519_extsk(hash_512bits extsk, const byte sk[32]) {
+    ed25519_hash(extsk, sk, 32);
+    extsk[0] &= 248;
+    extsk[31] &= 127;
+    extsk[31] |= 64;
+}
+
+void
+UpdateFromStream(HashTransformation& hash, std::istream& stream)
+{
+    SecByteBlock block(4096);
+    while (stream.read((char*)block.begin(), block.size()))
+        hash.Update(block, block.size());
+
+    std::streamsize rem = stream.gcount();
+    if (rem)
+        hash.Update(block, rem);
+
+    block.SetMark(0);
+}
+
+void
+ed25519_hram(hash_512bits hram, const byte RS[64], const byte pk[32], const byte *m, size_t mlen) {
+    SHA512 hash;
+    hash.Update(RS, 32);
+    hash.Update(pk, 32);
+    hash.Update(m, mlen);
+    hash.Final(hram);
+}
+
+void
+ed25519_hram(hash_512bits hram, const byte RS[64], const byte pk[32], std::istream& stream) {
+    SHA512 hash;
+    hash.Update(RS, 32);
+    hash.Update(pk, 32);
+    UpdateFromStream(hash, stream);
+    hash.Final(hram);
+}
+
+bignum256modm_element_t
+lt_modm(bignum256modm_element_t a, bignum256modm_element_t b) {
+    return (a - b) >> 63;
+}
+
+void
+reduce256_modm(bignum256modm r) {
+    bignum256modm t;
+    bignum256modm_element_t b = 0, pb, mask;
+
+    /* t = r - m */
+    pb = 0;
+    pb += modm_m[0]; b = lt_modm(r[0], pb); t[0] = (r[0] - pb + (b << 56)); pb = b;
+    pb += modm_m[1]; b = lt_modm(r[1], pb); t[1] = (r[1] - pb + (b << 56)); pb = b;
+    pb += modm_m[2]; b = lt_modm(r[2], pb); t[2] = (r[2] - pb + (b << 56)); pb = b;
+    pb += modm_m[3]; b = lt_modm(r[3], pb); t[3] = (r[3] - pb + (b << 56)); pb = b;
+    pb += modm_m[4]; b = lt_modm(r[4], pb); t[4] = (r[4] - pb + (b << 32));
+
+    /* keep r if r was smaller than m */
+    mask = b - 1;
+
+    r[0] ^= mask & (r[0] ^ t[0]);
+    r[1] ^= mask & (r[1] ^ t[1]);
+    r[2] ^= mask & (r[2] ^ t[2]);
+    r[3] ^= mask & (r[3] ^ t[3]);
+    r[4] ^= mask & (r[4] ^ t[4]);
+}
+
+void
+barrett_reduce256_modm(bignum256modm r, const bignum256modm q1, const bignum256modm r1) {
+    bignum256modm q3, r2;
+    word128 c, mul;
+    bignum256modm_element_t f, b, pb;
+
+    /* q1 = x >> 248 = 264 bits = 5 56 bit elements
+    q2 = mu * q1
+    q3 = (q2 / 256(32+1)) = q2 / (2^8)^(32+1) = q2 >> 264 */
+    mul64x64_128(c, modm_mu[0], q1[3])                 mul64x64_128(mul, modm_mu[3], q1[0]) add128(c, mul) mul64x64_128(mul, modm_mu[1], q1[2]) add128(c, mul) mul64x64_128(mul, modm_mu[2], q1[1]) add128(c, mul) shr128(f, c, 56);
+    mul64x64_128(c, modm_mu[0], q1[4]) add128_64(c, f) mul64x64_128(mul, modm_mu[4], q1[0]) add128(c, mul) mul64x64_128(mul, modm_mu[3], q1[1]) add128(c, mul) mul64x64_128(mul, modm_mu[1], q1[3]) add128(c, mul) mul64x64_128(mul, modm_mu[2], q1[2]) add128(c, mul)
+    f = lo128(c); q3[0] = (f >> 40) & 0xffff; shr128(f, c, 56);
+    mul64x64_128(c, modm_mu[4], q1[1]) add128_64(c, f) mul64x64_128(mul, modm_mu[1], q1[4]) add128(c, mul) mul64x64_128(mul, modm_mu[2], q1[3]) add128(c, mul) mul64x64_128(mul, modm_mu[3], q1[2]) add128(c, mul)
+    f = lo128(c); q3[0] |= (f << 16) & 0xffffffffffffff; q3[1] = (f >> 40) & 0xffff; shr128(f, c, 56);
+    mul64x64_128(c, modm_mu[4], q1[2]) add128_64(c, f) mul64x64_128(mul, modm_mu[2], q1[4]) add128(c, mul) mul64x64_128(mul, modm_mu[3], q1[3]) add128(c, mul)
+    f = lo128(c); q3[1] |= (f << 16) & 0xffffffffffffff; q3[2] = (f >> 40) & 0xffff; shr128(f, c, 56);
+    mul64x64_128(c, modm_mu[4], q1[3]) add128_64(c, f) mul64x64_128(mul, modm_mu[3], q1[4]) add128(c, mul)
+    f = lo128(c); q3[2] |= (f << 16) & 0xffffffffffffff; q3[3] = (f >> 40) & 0xffff; shr128(f, c, 56);
+    mul64x64_128(c, modm_mu[4], q1[4]) add128_64(c, f)
+    f = lo128(c); q3[3] |= (f << 16) & 0xffffffffffffff; q3[4] = (f >> 40) & 0xffff; shr128(f, c, 56);
+    q3[4] |= (f << 16);
+
+    mul64x64_128(c, modm_m[0], q3[0])
+    r2[0] = lo128(c) & 0xffffffffffffff; shr128(f, c, 56);
+    mul64x64_128(c, modm_m[0], q3[1]) add128_64(c, f) mul64x64_128(mul, modm_m[1], q3[0]) add128(c, mul)
+    r2[1] = lo128(c) & 0xffffffffffffff; shr128(f, c, 56);
+    mul64x64_128(c, modm_m[0], q3[2]) add128_64(c, f) mul64x64_128(mul, modm_m[2], q3[0]) add128(c, mul) mul64x64_128(mul, modm_m[1], q3[1]) add128(c, mul)
+    r2[2] = lo128(c) & 0xffffffffffffff; shr128(f, c, 56);
+    mul64x64_128(c, modm_m[0], q3[3]) add128_64(c, f) mul64x64_128(mul, modm_m[3], q3[0]) add128(c, mul) mul64x64_128(mul, modm_m[1], q3[2]) add128(c, mul) mul64x64_128(mul, modm_m[2], q3[1]) add128(c, mul)
+    r2[3] = lo128(c) & 0xffffffffffffff; shr128(f, c, 56);
+    mul64x64_128(c, modm_m[0], q3[4]) add128_64(c, f) mul64x64_128(mul, modm_m[4], q3[0]) add128(c, mul) mul64x64_128(mul, modm_m[3], q3[1]) add128(c, mul) mul64x64_128(mul, modm_m[1], q3[3]) add128(c, mul) mul64x64_128(mul, modm_m[2], q3[2]) add128(c, mul)
+    r2[4] = lo128(c) & 0x0000ffffffffff;
+
+    pb = 0;
+    pb += r2[0]; b = lt_modm(r1[0], pb); r[0] = (r1[0] - pb + (b << 56)); pb = b;
+    pb += r2[1]; b = lt_modm(r1[1], pb); r[1] = (r1[1] - pb + (b << 56)); pb = b;
+    pb += r2[2]; b = lt_modm(r1[2], pb); r[2] = (r1[2] - pb + (b << 56)); pb = b;
+    pb += r2[3]; b = lt_modm(r1[3], pb); r[3] = (r1[3] - pb + (b << 56)); pb = b;
+    pb += r2[4]; b = lt_modm(r1[4], pb); r[4] = (r1[4] - pb + (b << 40));
+
+    reduce256_modm(r);
+    reduce256_modm(r);
+}
+
+void
+add256_modm(bignum256modm r, const bignum256modm x, const bignum256modm y) {
+    bignum256modm_element_t c;
+
+    c  = x[0] + y[0]; r[0] = c & 0xffffffffffffff; c >>= 56;
+    c += x[1] + y[1]; r[1] = c & 0xffffffffffffff; c >>= 56;
+    c += x[2] + y[2]; r[2] = c & 0xffffffffffffff; c >>= 56;
+    c += x[3] + y[3]; r[3] = c & 0xffffffffffffff; c >>= 56;
+    c += x[4] + y[4]; r[4] = c;
+
+    reduce256_modm(r);
+}
+
+void
+mul256_modm(bignum256modm r, const bignum256modm x, const bignum256modm y) {
+    bignum256modm q1, r1;
+    word128 c, mul;
+    bignum256modm_element_t f;
+
+    mul64x64_128(c, x[0], y[0])
+    f = lo128(c); r1[0] = f & 0xffffffffffffff; shr128(f, c, 56);
+    mul64x64_128(c, x[0], y[1]) add128_64(c, f) mul64x64_128(mul, x[1], y[0]) add128(c, mul)
+    f = lo128(c); r1[1] = f & 0xffffffffffffff; shr128(f, c, 56);
+    mul64x64_128(c, x[0], y[2]) add128_64(c, f) mul64x64_128(mul, x[2], y[0]) add128(c, mul) mul64x64_128(mul, x[1], y[1]) add128(c, mul)
+    f = lo128(c); r1[2] = f & 0xffffffffffffff; shr128(f, c, 56);
+    mul64x64_128(c, x[0], y[3]) add128_64(c, f) mul64x64_128(mul, x[3], y[0]) add128(c, mul) mul64x64_128(mul, x[1], y[2]) add128(c, mul) mul64x64_128(mul, x[2], y[1]) add128(c, mul)
+    f = lo128(c); r1[3] = f & 0xffffffffffffff; shr128(f, c, 56);
+    mul64x64_128(c, x[0], y[4]) add128_64(c, f) mul64x64_128(mul, x[4], y[0]) add128(c, mul) mul64x64_128(mul, x[3], y[1]) add128(c, mul) mul64x64_128(mul, x[1], y[3]) add128(c, mul) mul64x64_128(mul, x[2], y[2]) add128(c, mul)
+    f = lo128(c); r1[4] = f & 0x0000ffffffffff; q1[0] = (f >> 24) & 0xffffffff; shr128(f, c, 56);
+    mul64x64_128(c, x[4], y[1]) add128_64(c, f) mul64x64_128(mul, x[1], y[4]) add128(c, mul) mul64x64_128(mul, x[2], y[3]) add128(c, mul) mul64x64_128(mul, x[3], y[2]) add128(c, mul)
+    f = lo128(c); q1[0] |= (f << 32) & 0xffffffffffffff; q1[1] = (f >> 24) & 0xffffffff; shr128(f, c, 56);
+    mul64x64_128(c, x[4], y[2]) add128_64(c, f) mul64x64_128(mul, x[2], y[4]) add128(c, mul) mul64x64_128(mul, x[3], y[3]) add128(c, mul)
+    f = lo128(c); q1[1] |= (f << 32) & 0xffffffffffffff; q1[2] = (f >> 24) & 0xffffffff; shr128(f, c, 56);
+    mul64x64_128(c, x[4], y[3]) add128_64(c, f) mul64x64_128(mul, x[3], y[4]) add128(c, mul)
+    f = lo128(c); q1[2] |= (f << 32) & 0xffffffffffffff; q1[3] = (f >> 24) & 0xffffffff; shr128(f, c, 56);
+    mul64x64_128(c, x[4], y[4]) add128_64(c, f)
+    f = lo128(c); q1[3] |= (f << 32) & 0xffffffffffffff; q1[4] = (f >> 24) & 0xffffffff; shr128(f, c, 56);
+    q1[4] |= (f << 32);
+
+    barrett_reduce256_modm(r, q1, r1);
+}
+
+void
+expand256_modm(bignum256modm out, const byte *in, size_t len) {
+    byte work[64] = {0};
+    bignum256modm_element_t x[16];
+    bignum256modm q1;
+
+    std::memcpy(work, in, len);
+    x[0] = U8TO64_LE(work +  0);
+    x[1] = U8TO64_LE(work +  8);
+    x[2] = U8TO64_LE(work + 16);
+    x[3] = U8TO64_LE(work + 24);
+    x[4] = U8TO64_LE(work + 32);
+    x[5] = U8TO64_LE(work + 40);
+    x[6] = U8TO64_LE(work + 48);
+    x[7] = U8TO64_LE(work + 56);
+
+    /* r1 = (x mod 256^(32+1)) = x mod (2^8)(31+1) = x & ((1 << 264) - 1) */
+    out[0] = (                         x[0]) & 0xffffffffffffff;
+    out[1] = ((x[ 0] >> 56) | (x[ 1] <<  8)) & 0xffffffffffffff;
+    out[2] = ((x[ 1] >> 48) | (x[ 2] << 16)) & 0xffffffffffffff;
+    out[3] = ((x[ 2] >> 40) | (x[ 3] << 24)) & 0xffffffffffffff;
+    out[4] = ((x[ 3] >> 32) | (x[ 4] << 32)) & 0x0000ffffffffff;
+
+    /* under 252 bits, no need to reduce */
+    if (len < 32)
+        return;
+
+    /* q1 = x >> 248 = 264 bits */
+    q1[0] = ((x[ 3] >> 56) | (x[ 4] <<  8)) & 0xffffffffffffff;
+    q1[1] = ((x[ 4] >> 48) | (x[ 5] << 16)) & 0xffffffffffffff;
+    q1[2] = ((x[ 5] >> 40) | (x[ 6] << 24)) & 0xffffffffffffff;
+    q1[3] = ((x[ 6] >> 32) | (x[ 7] << 32)) & 0xffffffffffffff;
+    q1[4] = ((x[ 7] >> 24)                );
+
+    barrett_reduce256_modm(out, q1, out);
+}
+
+void
+expand_raw256_modm(bignum256modm out, const byte in[32]) {
+    bignum256modm_element_t x[4];
+
+    x[0] = U8TO64_LE(in +  0);
+    x[1] = U8TO64_LE(in +  8);
+    x[2] = U8TO64_LE(in + 16);
+    x[3] = U8TO64_LE(in + 24);
+
+    out[0] = (                         x[0]) & 0xffffffffffffff;
+    out[1] = ((x[ 0] >> 56) | (x[ 1] <<  8)) & 0xffffffffffffff;
+    out[2] = ((x[ 1] >> 48) | (x[ 2] << 16)) & 0xffffffffffffff;
+    out[3] = ((x[ 2] >> 40) | (x[ 3] << 24)) & 0xffffffffffffff;
+    out[4] = ((x[ 3] >> 32)                ) & 0x000000ffffffff;
+}
+
+void
+contract256_modm(byte out[32], const bignum256modm in) {
+    U64TO8_LE(out +  0, (in[0]      ) | (in[1] << 56));
+    U64TO8_LE(out +  8, (in[1] >>  8) | (in[2] << 48));
+    U64TO8_LE(out + 16, (in[2] >> 16) | (in[3] << 40));
+    U64TO8_LE(out + 24, (in[3] >> 24) | (in[4] << 32));
+}
+
+void
+contract256_window4_modm(signed char r[64], const bignum256modm in) {
+    char carry;
+    signed char *quads = r;
+    bignum256modm_element_t i, j, v, m;
+
+    for (i = 0; i < 5; i++) {
+        v = in[i];
+        m = (i == 4) ? 8 : 14;
+        for (j = 0; j < m; j++) {
+            *quads++ = (v & 15);
+            v >>= 4;
+        }
+    }
+
+    /* making it signed */
+    carry = 0;
+    for(i = 0; i < 63; i++) {
+        r[i] += carry;
+        r[i+1] += (r[i] >> 4);
+        r[i] &= 15;
+        carry = (r[i] >> 3);
+        r[i] -= (carry << 4);
+    }
+    r[63] += carry;
+}
+
+void
+contract256_slidingwindow_modm(signed char r[256], const bignum256modm s, int windowsize) {
+    int i,j,k,b;
+    int m = (1 << (windowsize - 1)) - 1, soplen = 256;
+    signed char *bits = r;
+    bignum256modm_element_t v;
+
+    /* first put the binary expansion into r  */
+    for (i = 0; i < 4; i++) {
+        v = s[i];
+        for (j = 0; j < 56; j++, v >>= 1)
+            *bits++ = (v & 1);
+    }
+    v = s[4];
+    for (j = 0; j < 32; j++, v >>= 1)
+        *bits++ = (v & 1);
+
+    /* Making it sliding window */
+    for (j = 0; j < soplen; j++) {
+        if (!r[j])
+            continue;
+
+        for (b = 1; (b < (soplen - j)) && (b <= 6); b++) {
+            if ((r[j] + (r[j + b] << b)) <= m) {
+                r[j] += r[j + b] << b;
+                r[j + b] = 0;
+            } else if ((r[j] - (r[j + b] << b)) >= -m) {
+                r[j] -= r[j + b] << b;
+                for (k = j + b; k < soplen; k++) {
+                    if (!r[k]) {
+                        r[k] = 1;
+                        break;
+                    }
+                    r[k] = 0;
+                }
+            } else if (r[j + b]) {
+                break;
+            }
+        }
+    }
+}
+
+/*
+ * In:  b =   2^5 - 2^0
+ * Out: b = 2^250 - 2^0
+ */
+void
+curve25519_pow_two5mtwo0_two250mtwo0(bignum25519 b) {
+    ALIGN(ALIGN_SPEC) bignum25519 t0,c;
+
+    /* 2^5  - 2^0 */ /* b */
+    /* 2^10 - 2^5 */ curve25519_square_times(t0, b, 5);
+    /* 2^10 - 2^0 */ curve25519_mul_noinline(b, t0, b);
+    /* 2^20 - 2^10 */ curve25519_square_times(t0, b, 10);
+    /* 2^20 - 2^0 */ curve25519_mul_noinline(c, t0, b);
+    /* 2^40 - 2^20 */ curve25519_square_times(t0, c, 20);
+    /* 2^40 - 2^0 */ curve25519_mul_noinline(t0, t0, c);
+    /* 2^50 - 2^10 */ curve25519_square_times(t0, t0, 10);
+    /* 2^50 - 2^0 */ curve25519_mul_noinline(b, t0, b);
+    /* 2^100 - 2^50 */ curve25519_square_times(t0, b, 50);
+    /* 2^100 - 2^0 */ curve25519_mul_noinline(c, t0, b);
+    /* 2^200 - 2^100 */ curve25519_square_times(t0, c, 100);
+    /* 2^200 - 2^0 */ curve25519_mul_noinline(t0, t0, c);
+    /* 2^250 - 2^50 */ curve25519_square_times(t0, t0, 50);
+    /* 2^250 - 2^0 */ curve25519_mul_noinline(b, t0, b);
+}
+
+/*
+ * z^(p - 2) = z(2^255 - 21)
+ */
+void
+curve25519_recip(bignum25519 out, const bignum25519 z) {
+    ALIGN(ALIGN_SPEC) bignum25519 a,t0,b;
+
+    /* 2 */ curve25519_square_times(a, z, 1); /* a = 2 */
+    /* 8 */ curve25519_square_times(t0, a, 2);
+    /* 9 */ curve25519_mul_noinline(b, t0, z); /* b = 9 */
+    /* 11 */ curve25519_mul_noinline(a, b, a); /* a = 11 */
+    /* 22 */ curve25519_square_times(t0, a, 1);
+    /* 2^5 - 2^0 = 31 */ curve25519_mul_noinline(b, t0, b);
+    /* 2^250 - 2^0 */ curve25519_pow_two5mtwo0_two250mtwo0(b);
+    /* 2^255 - 2^5 */ curve25519_square_times(b, b, 5);
+    /* 2^255 - 21 */ curve25519_mul_noinline(out, b, a);
+}
+
+/*
+ * z^((p-5)/8) = z^(2^252 - 3)
+ */
+void
+curve25519_pow_two252m3(bignum25519 two252m3, const bignum25519 z) {
+    ALIGN(ALIGN_SPEC) bignum25519 b,c,t0;
+
+    /* 2 */ curve25519_square_times(c, z, 1); /* c = 2 */
+    /* 8 */ curve25519_square_times(t0, c, 2); /* t0 = 8 */
+    /* 9 */ curve25519_mul_noinline(b, t0, z); /* b = 9 */
+    /* 11 */ curve25519_mul_noinline(c, b, c); /* c = 11 */
+    /* 22 */ curve25519_square_times(t0, c, 1);
+    /* 2^5 - 2^0 = 31 */ curve25519_mul_noinline(b, t0, b);
+    /* 2^250 - 2^0 */ curve25519_pow_two5mtwo0_two250mtwo0(b);
+    /* 2^252 - 2^2 */ curve25519_square_times(b, b, 2);
+    /* 2^252 - 3 */ curve25519_mul_noinline(two252m3, b, z);
+}
+
+inline void
+ge25519_p1p1_to_partial(ge25519 *r, const ge25519_p1p1 *p) {
+    curve25519_mul(r->x, p->x, p->t);
+    curve25519_mul(r->y, p->y, p->z);
+    curve25519_mul(r->z, p->z, p->t);
+}
+
+inline void
+ge25519_p1p1_to_full(ge25519 *r, const ge25519_p1p1 *p) {
+    curve25519_mul(r->x, p->x, p->t);
+    curve25519_mul(r->y, p->y, p->z);
+    curve25519_mul(r->z, p->z, p->t);
+    curve25519_mul(r->t, p->x, p->y);
+}
+
+void
+ge25519_full_to_pniels(ge25519_pniels *p, const ge25519 *r) {
+    curve25519_sub(p->ysubx, r->y, r->x);
+    curve25519_add(p->xaddy, r->y, r->x);
+    curve25519_copy(p->z, r->z);
+    curve25519_mul(p->t2d, r->t, ge25519_ec2d);
+}
+
+void
+ge25519_add_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519 *q) {
+    bignum25519 a,b,c,d,t,u;
+
+    curve25519_sub(a, p->y, p->x);
+    curve25519_add(b, p->y, p->x);
+    curve25519_sub(t, q->y, q->x);
+    curve25519_add(u, q->y, q->x);
+    curve25519_mul(a, a, t);
+    curve25519_mul(b, b, u);
+    curve25519_mul(c, p->t, q->t);
+    curve25519_mul(c, c, ge25519_ec2d);
+    curve25519_mul(d, p->z, q->z);
+    curve25519_add(d, d, d);
+    curve25519_sub(r->x, b, a);
+    curve25519_add(r->y, b, a);
+    curve25519_add_after_basic(r->z, d, c);
+    curve25519_sub_after_basic(r->t, d, c);
+}
+
+void
+ge25519_double_p1p1(ge25519_p1p1 *r, const ge25519 *p) {
+    bignum25519 a,b,c;
+
+    curve25519_square(a, p->x);
+    curve25519_square(b, p->y);
+    curve25519_square(c, p->z);
+    curve25519_add_reduce(c, c, c);
+    curve25519_add(r->x, p->x, p->y);
+    curve25519_square(r->x, r->x);
+    curve25519_add(r->y, b, a);
+    curve25519_sub(r->z, b, a);
+    curve25519_sub_after_basic(r->x, r->x, r->y);
+    curve25519_sub_after_basic(r->t, c, r->z);
+}
+
+void
+ge25519_nielsadd2_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_niels *q, byte signbit) {
+    const bignum25519 *qb = (const bignum25519 *)q;
+    bignum25519 *rb = (bignum25519 *)r;
+    bignum25519 a,b,c;
+
+    curve25519_sub(a, p->y, p->x);
+    curve25519_add(b, p->y, p->x);
+    curve25519_mul(a, a, qb[signbit]); /* x for +, y for - */
+    curve25519_mul(r->x, b, qb[signbit^1]); /* y for +, x for - */
+    curve25519_add(r->y, r->x, a);
+    curve25519_sub(r->x, r->x, a);
+    curve25519_mul(c, p->t, q->t2d);
+    curve25519_add_reduce(r->t, p->z, p->z);
+    curve25519_copy(r->z, r->t);
+    curve25519_add(rb[2+signbit], rb[2+signbit], c); /* z for +, t for - */
+    curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c); /* t for +, z for - */
+}
+
+void
+ge25519_pnielsadd_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_pniels *q, byte signbit) {
+    const bignum25519 *qb = (const bignum25519 *)q;
+    bignum25519 *rb = (bignum25519 *)r;
+    bignum25519 a,b,c;
+
+    curve25519_sub(a, p->y, p->x);
+    curve25519_add(b, p->y, p->x);
+    curve25519_mul(a, a, qb[signbit]); /* ysubx for +, xaddy for - */
+    curve25519_mul(r->x, b, qb[signbit^1]); /* xaddy for +, ysubx for - */
+    curve25519_add(r->y, r->x, a);
+    curve25519_sub(r->x, r->x, a);
+    curve25519_mul(c, p->t, q->t2d);
+    curve25519_mul(r->t, p->z, q->z);
+    curve25519_add_reduce(r->t, r->t, r->t);
+    curve25519_copy(r->z, r->t);
+    curve25519_add(rb[2+signbit], rb[2+signbit], c); /* z for +, t for - */
+    curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c); /* t for +, z for - */
+}
+
+void
+ge25519_double_partial(ge25519 *r, const ge25519 *p) {
+    ge25519_p1p1 t;
+    ge25519_double_p1p1(&t, p);
+    ge25519_p1p1_to_partial(r, &t);
+}
+
+void
+ge25519_double(ge25519 *r, const ge25519 *p) {
+    ge25519_p1p1 t;
+    ge25519_double_p1p1(&t, p);
+    ge25519_p1p1_to_full(r, &t);
+}
+
+void
+ge25519_add(ge25519 *r, const ge25519 *p,  const ge25519 *q) {
+    ge25519_p1p1 t;
+    ge25519_add_p1p1(&t, p, q);
+    ge25519_p1p1_to_full(r, &t);
+}
+
+void
+ge25519_nielsadd2(ge25519 *r, const ge25519_niels *q) {
+    bignum25519 a,b,c,e,f,g,h;
+
+    curve25519_sub(a, r->y, r->x);
+    curve25519_add(b, r->y, r->x);
+    curve25519_mul(a, a, q->ysubx);
+    curve25519_mul(e, b, q->xaddy);
+    curve25519_add(h, e, a);
+    curve25519_sub(e, e, a);
+    curve25519_mul(c, r->t, q->t2d);
+    curve25519_add(f, r->z, r->z);
+    curve25519_add_after_basic(g, f, c);
+    curve25519_sub_after_basic(f, f, c);
+    curve25519_mul(r->x, e, f);
+    curve25519_mul(r->y, h, g);
+    curve25519_mul(r->z, g, f);
+    curve25519_mul(r->t, e, h);
+}
+
+void
+ge25519_pnielsadd(ge25519_pniels *r, const ge25519 *p, const ge25519_pniels *q) {
+    bignum25519 a,b,c,x,y,z,t;
+
+    curve25519_sub(a, p->y, p->x);
+    curve25519_add(b, p->y, p->x);
+    curve25519_mul(a, a, q->ysubx);
+    curve25519_mul(x, b, q->xaddy);
+    curve25519_add(y, x, a);
+    curve25519_sub(x, x, a);
+    curve25519_mul(c, p->t, q->t2d);
+    curve25519_mul(t, p->z, q->z);
+    curve25519_add(t, t, t);
+    curve25519_add_after_basic(z, t, c);
+    curve25519_sub_after_basic(t, t, c);
+    curve25519_mul(r->xaddy, x, t);
+    curve25519_mul(r->ysubx, y, z);
+    curve25519_mul(r->z, z, t);
+    curve25519_mul(r->t2d, x, y);
+    curve25519_copy(y, r->ysubx);
+    curve25519_sub(r->ysubx, r->ysubx, r->xaddy);
+    curve25519_add(r->xaddy, r->xaddy, y);
+    curve25519_mul(r->t2d, r->t2d, ge25519_ec2d);
+}
+
+void
+ge25519_pack(byte r[32], const ge25519 *p) {
+    bignum25519 tx, ty, zi;
+    byte parity[32];
+    curve25519_recip(zi, p->z);
+    curve25519_mul(tx, p->x, zi);
+    curve25519_mul(ty, p->y, zi);
+    curve25519_contract(r, ty);
+    curve25519_contract(parity, tx);
+    r[31] ^= ((parity[0] & 1) << 7);
+}
+
+int
+ed25519_verify(const byte *x, const byte *y, size_t len) {
+    size_t differentbits = 0;
+    while (len--)
+        differentbits |= (*x++ ^ *y++);
+    return (int) (1 & ((differentbits - 1) >> 8));
+}
+
+int
+ge25519_unpack_negative_vartime(ge25519 *r, const byte p[32]) {
+    const byte zero[32] = {0};
+    const bignum25519 one = {1};
+    byte parity = p[31] >> 7;
+    byte check[32];
+    bignum25519 t, root, num, den, d3;
+
+    curve25519_expand(r->y, p);
+    curve25519_copy(r->z, one);
+    curve25519_square(num, r->y); /* x = y^2 */
+    curve25519_mul(den, num, ge25519_ecd); /* den = dy^2 */
+    curve25519_sub_reduce(num, num, r->z); /* x = y^1 - 1 */
+    curve25519_add(den, den, r->z); /* den = dy^2 + 1 */
+
+    /* Computation of sqrt(num/den) */
+    /* 1.: computation of num^((p-5)/8)*den^((7p-35)/8) = (num*den^7)^((p-5)/8) */
+    curve25519_square(t, den);
+    curve25519_mul(d3, t, den);
+    curve25519_square(r->x, d3);
+    curve25519_mul(r->x, r->x, den);
+    curve25519_mul(r->x, r->x, num);
+    curve25519_pow_two252m3(r->x, r->x);
+
+    /* 2. computation of r->x = num * den^3 * (num*den^7)^((p-5)/8) */
+    curve25519_mul(r->x, r->x, d3);
+    curve25519_mul(r->x, r->x, num);
+
+    /* 3. Check if either of the roots works: */
+    curve25519_square(t, r->x);
+    curve25519_mul(t, t, den);
+    curve25519_sub_reduce(root, t, num);
+    curve25519_contract(check, root);
+    if (!ed25519_verify(check, zero, 32)) {
+        curve25519_add_reduce(t, t, num);
+        curve25519_contract(check, t);
+        if (!ed25519_verify(check, zero, 32))
+            return 0;
+        curve25519_mul(r->x, r->x, ge25519_sqrtneg1);
+    }
+
+    curve25519_contract(check, r->x);
+    if ((check[0] & 1) == parity) {
+        curve25519_copy(t, r->x);
+        curve25519_neg(r->x, t);
+    }
+    curve25519_mul(r->t, r->x, r->y);
+    return 1;
+}
+
+/* computes [s1]p1 + [s2]basepoint */
+void
+ge25519_double_scalarmult_vartime(ge25519 *r, const ge25519 *p1, const bignum256modm s1, const bignum256modm s2) {
+    signed char slide1[256], slide2[256];
+    ge25519_pniels pre1[S1_TABLE_SIZE];
+    ge25519 d1;
+    ge25519_p1p1 t;
+    sword32 i;
+
+    contract256_slidingwindow_modm(slide1, s1, S1_SWINDOWSIZE);
+    contract256_slidingwindow_modm(slide2, s2, S2_SWINDOWSIZE);
+
+    ge25519_double(&d1, p1);
+    ge25519_full_to_pniels(pre1, p1);
+    for (i = 0; i < S1_TABLE_SIZE - 1; i++)
+            ge25519_pnielsadd(&pre1[i+1], &d1, &pre1[i]);
+
+    /* set neutral */
+    std::memset(r, 0, sizeof(ge25519));
+    r->y[0] = 1;
+    r->z[0] = 1;
+
+    i = 255;
+    while ((i >= 0) && !(slide1[i] | slide2[i]))
+        i--;
+
+    for (; i >= 0; i--) {
+        ge25519_double_p1p1(&t, r);
+
+        if (slide1[i]) {
+            ge25519_p1p1_to_full(r, &t);
+            ge25519_pnielsadd_p1p1(&t, r, &pre1[abs(slide1[i]) / 2], (byte)slide1[i] >> 7);
+        }
+
+        if (slide2[i]) {
+            ge25519_p1p1_to_full(r, &t);
+            ge25519_nielsadd2_p1p1(&t, r, &ge25519_niels_sliding_multiples[abs(slide2[i]) / 2], (byte)slide2[i] >> 7);
+        }
+
+        ge25519_p1p1_to_partial(r, &t);
+    }
+}
+
+#if !defined(HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS)
+
+word32
+ge25519_windowb_equal(word32 b, word32 c) {
+    return ((b ^ c) - 1) >> 31;
+}
+
+void
+ge25519_scalarmult_base_choose_niels(ge25519_niels *t, const byte table[256][96], word32 pos, signed char b) {
+    bignum25519 neg;
+    word32 sign = (word32)((byte)b >> 7);
+    word32 mask = ~(sign - 1);
+    word32 u = (b + mask) ^ mask;
+    word32 i;
+
+    /* ysubx, xaddy, t2d in packed form. initialize to ysubx = 1, xaddy = 1, t2d = 0 */
+    byte packed[96] = {0};
+    packed[0] = 1;
+    packed[32] = 1;
+
+    for (i = 0; i < 8; i++)
+        curve25519_move_conditional_bytes(packed, table[(pos * 8) + i], ge25519_windowb_equal(u, i + 1));
+
+    /* expand in to t */
+    curve25519_expand(t->ysubx, packed +  0);
+    curve25519_expand(t->xaddy, packed + 32);
+    curve25519_expand(t->t2d  , packed + 64);
+
+    /* adjust for sign */
+    curve25519_swap_conditional(t->ysubx, t->xaddy, sign);
+    curve25519_neg(neg, t->t2d);
+    curve25519_swap_conditional(t->t2d, neg, sign);
+}
+
+#endif /* HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS */
+
+/* computes [s]basepoint */
+void
+ge25519_scalarmult_base_niels(ge25519 *r, const byte basepoint_table[256][96], const bignum256modm s) {
+    signed char b[64];
+    word32 i;
+    ge25519_niels t;
+
+    contract256_window4_modm(b, s);
+
+    ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[1]);
+    curve25519_sub_reduce(r->x, t.xaddy, t.ysubx);
+    curve25519_add_reduce(r->y, t.xaddy, t.ysubx);
+    std::memset(r->z, 0, sizeof(bignum25519));
+    curve25519_copy(r->t, t.t2d);
+    r->z[0] = 2;
+    for (i = 3; i < 64; i += 2) {
+        ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);
+        ge25519_nielsadd2(r, &t);
+    }
+    ge25519_double_partial(r, r);
+    ge25519_double_partial(r, r);
+    ge25519_double_partial(r, r);
+    ge25519_double(r, r);
+    ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[0]);
+    curve25519_mul(t.t2d, t.t2d, ge25519_ecd);
+    ge25519_nielsadd2(r, &t);
+    for(i = 2; i < 64; i += 2) {
+        ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);
+        ge25519_nielsadd2(r, &t);
+    }
+}
+
+ANONYMOUS_NAMESPACE_END
+NAMESPACE_END  // Ed25519
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+//***************************** curve25519 *****************************//
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+
+int curve25519_mult_CXX(byte sharedKey[32], const byte secretKey[32], const byte othersKey[32])
+{
+    using namespace CryptoPP::Donna::X25519;
+
+    FixedSizeSecBlock<byte, 32> e;
+    for (size_t i = 0;i < 32;++i)
+        e[i] = secretKey[i];
+    e[0] &= 0xf8; e[31] &= 0x7f; e[31] |= 0x40;
+
+    bignum25519 nqpqx = {1}, nqpqz = {0}, nqz = {1}, nqx;
+    bignum25519 q, qx, qpqx, qqx, zzz, zmone;
+    size_t bit, lastbit;
+
+    curve25519_expand(q, othersKey);
+    curve25519_copy(nqx, q);
+
+    /* bit 255 is always 0, and bit 254 is always 1, so skip bit 255 and
+       start pre-swapped on bit 254 */
+    lastbit = 1;
+
+    /* we are doing bits 254..3 in the loop, but are swapping in bits 253..2 */
+    for (int i = 253; i >= 2; i--) {
+        curve25519_add(qx, nqx, nqz);
+        curve25519_sub(nqz, nqx, nqz);
+        curve25519_add(qpqx, nqpqx, nqpqz);
+        curve25519_sub(nqpqz, nqpqx, nqpqz);
+        curve25519_mul(nqpqx, qpqx, nqz);
+        curve25519_mul(nqpqz, qx, nqpqz);
+        curve25519_add(qqx, nqpqx, nqpqz);
+        curve25519_sub(nqpqz, nqpqx, nqpqz);
+        curve25519_square(nqpqz, nqpqz);
+        curve25519_square(nqpqx, qqx);
+        curve25519_mul(nqpqz, nqpqz, q);
+        curve25519_square(qx, qx);
+        curve25519_square(nqz, nqz);
+        curve25519_mul(nqx, qx, nqz);
+        curve25519_sub(nqz, qx, nqz);
+        curve25519_scalar_product(zzz, nqz, 121665);
+        curve25519_add(zzz, zzz, qx);
+        curve25519_mul(nqz, nqz, zzz);
+
+        bit = (e[i/8] >> (i & 7)) & 1;
+        curve25519_swap_conditional(nqx, nqpqx, bit ^ lastbit);
+        curve25519_swap_conditional(nqz, nqpqz, bit ^ lastbit);
+        lastbit = bit;
+    }
+
+    /* the final 3 bits are always zero, so we only need to double */
+    for (int i = 0; i < 3; i++) {
+        curve25519_add(qx, nqx, nqz);
+        curve25519_sub(nqz, nqx, nqz);
+        curve25519_square(qx, qx);
+        curve25519_square(nqz, nqz);
+        curve25519_mul(nqx, qx, nqz);
+        curve25519_sub(nqz, qx, nqz);
+        curve25519_scalar_product(zzz, nqz, 121665);
+        curve25519_add(zzz, zzz, qx);
+        curve25519_mul(nqz, nqz, zzz);
+    }
+
+    curve25519_recip(zmone, nqz);
+    curve25519_mul(nqz, nqx, zmone);
+    curve25519_contract(sharedKey, nqz);
+
+    return 0;
+}
+
+int curve25519_mult(byte publicKey[32], const byte secretKey[32])
+{
+    using namespace CryptoPP::Donna::X25519;
+
+#if (CRYPTOPP_CURVE25519_SSE2)
+    if (HasSSE2())
+        return curve25519_mult_SSE2(publicKey, secretKey, basePoint);
+    else
+#endif
+
+    return curve25519_mult_CXX(publicKey, secretKey, basePoint);
+}
+
+int curve25519_mult(byte sharedKey[32], const byte secretKey[32], const byte othersKey[32])
+{
+#if (CRYPTOPP_CURVE25519_SSE2)
+    if (HasSSE2())
+        return curve25519_mult_SSE2(sharedKey, secretKey, othersKey);
+    else
+#endif
+
+    return curve25519_mult_CXX(sharedKey, secretKey, othersKey);
+}
+
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+//******************************* ed25519 *******************************//
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+
+int
+ed25519_publickey_CXX(byte publicKey[32], const byte secretKey[32])
+{
+    using namespace CryptoPP::Donna::Ed25519;
+
+    bignum256modm a;
+    ALIGN(ALIGN_SPEC) ge25519 A;
+    hash_512bits extsk;
+
+    /* A = aB */
+    ed25519_extsk(extsk, secretKey);
+    expand256_modm(a, extsk, 32);
+    ge25519_scalarmult_base_niels(&A, ge25519_niels_base_multiples, a);
+    ge25519_pack(publicKey, &A);
+
+    return 0;
+}
+
+int
+ed25519_publickey(byte publicKey[32], const byte secretKey[32])
+{
+    return ed25519_publickey_CXX(publicKey, secretKey);
+}
+
+int
+ed25519_sign_CXX(std::istream& stream, const byte sk[32], const byte pk[32], byte RS[64])
+{
+    using namespace CryptoPP::Donna::Ed25519;
+
+    bignum256modm r, S, a;
+    ALIGN(ALIGN_SPEC) ge25519 R;
+    hash_512bits extsk, hashr, hram;
+
+    // Unfortunately we need to read the stream twice. The first time calculates
+    // 'r = H(aExt[32..64], m)'. The second time calculates 'S = H(R,A,m)'. There
+    // is a data dependency due to hashing 'RS' with 'R = [r]B' that does not
+    // allow us to read the stream once.
+    std::streampos where = stream.tellg();
+
+    ed25519_extsk(extsk, sk);
+
+    /* r = H(aExt[32..64], m) */
+    SHA512 hash;
+    hash.Update(extsk + 32, 32);
+    UpdateFromStream(hash, stream);
+    hash.Final(hashr);
+    expand256_modm(r, hashr, 64);
+
+    /* R = rB */
+    ge25519_scalarmult_base_niels(&R, ge25519_niels_base_multiples, r);
+    ge25519_pack(RS, &R);
+
+    // Reset stream for the second digest
+    stream.clear();
+    stream.seekg(where);
+
+    /* S = H(R,A,m).. */
+    ed25519_hram(hram, RS, pk, stream);
+    expand256_modm(S, hram, 64);
+
+    /* S = H(R,A,m)a */
+    expand256_modm(a, extsk, 32);
+    mul256_modm(S, S, a);
+
+    /* S = (r + H(R,A,m)a) */
+    add256_modm(S, S, r);
+
+    /* S = (r + H(R,A,m)a) mod L */
+    contract256_modm(RS + 32, S);
+    return 0;
+}
+
+int
+ed25519_sign_CXX(const byte *m, size_t mlen, const byte sk[32], const byte pk[32], byte RS[64])
+{
+    using namespace CryptoPP::Donna::Ed25519;
+
+    bignum256modm r, S, a;
+    ALIGN(ALIGN_SPEC) ge25519 R;
+    hash_512bits extsk, hashr, hram;
+
+    ed25519_extsk(extsk, sk);
+
+    /* r = H(aExt[32..64], m) */
+    SHA512 hash;
+    hash.Update(extsk + 32, 32);
+    hash.Update(m, mlen);
+    hash.Final(hashr);
+    expand256_modm(r, hashr, 64);
+
+    /* R = rB */
+    ge25519_scalarmult_base_niels(&R, ge25519_niels_base_multiples, r);
+    ge25519_pack(RS, &R);
+
+    /* S = H(R,A,m).. */
+    ed25519_hram(hram, RS, pk, m, mlen);
+    expand256_modm(S, hram, 64);
+
+    /* S = H(R,A,m)a */
+    expand256_modm(a, extsk, 32);
+    mul256_modm(S, S, a);
+
+    /* S = (r + H(R,A,m)a) */
+    add256_modm(S, S, r);
+
+    /* S = (r + H(R,A,m)a) mod L */
+    contract256_modm(RS + 32, S);
+    return 0;
+}
+
+int
+ed25519_sign(std::istream& stream, const byte secretKey[32], const byte publicKey[32],
+             byte signature[64])
+{
+    return ed25519_sign_CXX(stream, secretKey, publicKey, signature);
+}
+
+int
+ed25519_sign(const byte* message, size_t messageLength, const byte secretKey[32],
+             const byte publicKey[32], byte signature[64])
+{
+    return ed25519_sign_CXX(message, messageLength, secretKey, publicKey, signature);
+}
+
+int
+ed25519_sign_open_CXX(const byte *m, size_t mlen, const byte pk[32], const byte RS[64]) {
+
+    using namespace CryptoPP::Donna::Ed25519;
+
+    ALIGN(ALIGN_SPEC) ge25519 R, A;
+    hash_512bits hash;
+    bignum256modm hram, S;
+    byte checkR[32];
+
+    if ((RS[63] & 224) || !ge25519_unpack_negative_vartime(&A, pk))
+        return -1;
+
+    /* hram = H(R,A,m) */
+    ed25519_hram(hash, RS, pk, m, mlen);
+    expand256_modm(hram, hash, 64);
+
+    /* S */
+    expand256_modm(S, RS + 32, 32);
+
+    /* SB - H(R,A,m)A */
+    ge25519_double_scalarmult_vartime(&R, &A, hram, S);
+    ge25519_pack(checkR, &R);
+
+    /* check that R = SB - H(R,A,m)A */
+    return ed25519_verify(RS, checkR, 32) ? 0 : -1;
+}
+
+int
+ed25519_sign_open_CXX(std::istream& stream, const byte pk[32], const byte RS[64]) {
+
+    using namespace CryptoPP::Donna::Ed25519;
+
+    ALIGN(ALIGN_SPEC) ge25519 R, A;
+    hash_512bits hash;
+    bignum256modm hram, S;
+    byte checkR[32];
+
+    if ((RS[63] & 224) || !ge25519_unpack_negative_vartime(&A, pk))
+        return -1;
+
+    /* hram = H(R,A,m) */
+    ed25519_hram(hash, RS, pk, stream);
+    expand256_modm(hram, hash, 64);
+
+    /* S */
+    expand256_modm(S, RS + 32, 32);
+
+    /* SB - H(R,A,m)A */
+    ge25519_double_scalarmult_vartime(&R, &A, hram, S);
+    ge25519_pack(checkR, &R);
+
+    /* check that R = SB - H(R,A,m)A */
+    return ed25519_verify(RS, checkR, 32) ? 0 : -1;
+}
+
+int
+ed25519_sign_open(std::istream& stream, const byte publicKey[32], const byte signature[64])
+{
+    return ed25519_sign_open_CXX(stream, publicKey, signature);
+}
+
+int
+ed25519_sign_open(const byte *message, size_t messageLength, const byte publicKey[32], const byte signature[64])
+{
+    return ed25519_sign_open_CXX(message, messageLength, publicKey, signature);
+}
+
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_CURVE25519_64BIT
diff --git a/runtime/third_party/cryptopp/donna_64.h b/runtime/third_party/cryptopp/donna_64.h
new file mode 100644
index 0000000..3180d60
--- /dev/null
+++ b/runtime/third_party/cryptopp/donna_64.h
@@ -0,0 +1,457 @@
+// donna_64.h - written and placed in public domain by Jeffrey Walton
+//              Crypto++ specific implementation wrapped around Andrew
+//              Moon's public domain curve25519-donna and ed25519-donna,
+//              https://github.com/floodyberry/curve25519-donna and
+//              https://github.com/floodyberry/ed25519-donna.
+
+// This source file multiplexes two different repos using namespaces. This
+// was a little easier from a project management standpoint. We only need
+// two files per architecture at the expense of namespaces and bloat.
+
+#ifndef CRYPTOPP_DONNA_64_H
+#define CRYPTOPP_DONNA_64_H
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+
+#include "config.h"
+
+#if defined(CRYPTOPP_MSC_VERSION)
+# include <intrin.h>
+# pragma intrinsic(_umul128)
+# pragma intrinsic(__shiftright128)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+NAMESPACE_BEGIN(Arch64)
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::word64;
+
+// ******************** x25519 Agreement ************************* //
+
+#define ALIGN(n) CRYPTOPP_ALIGN_DATA(n)
+typedef word64 bignum25519[5];
+
+const byte basePoint[32] = {9};
+const word64 reduce_mask_40 = ((word64)1 << 40) - 1;
+const word64 reduce_mask_51 = ((word64)1 << 51) - 1;
+const word64 reduce_mask_52 = ((word64)1 << 52) - 1;
+const word64 reduce_mask_56 = ((word64)1 << 56) - 1;
+
+const word64 two54m152      = (((word64)1) << 54) - 152;
+const word64 two54m8        = (((word64)1) << 54) - 8;
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+using CryptoPP::word128;
+# define lo128(a) ((word64)a)
+# define hi128(a) ((word64)(a >> 64))
+# define add128(a,b) a += b;
+# define add128_64(a,b) a += (word64)b;
+# define mul64x64_128(out,a,b) out = (word128)a * b;
+# define shr128(out,in,shift) out = (word64)(in >> (shift));
+# define shl128(out,in,shift) out = (word64)((in << shift) >> 64);
+
+#elif defined(CRYPTOPP_MSC_VERSION)
+struct word128 { word64 lo, hi; };
+# define mul64x64_128(out,a,b) out.lo = _umul128(a,b,&out.hi);
+# define shr128_pair(out,hi,lo,shift) out = __shiftright128(lo, hi, shift);
+# define shl128_pair(out,hi,lo,shift) out = __shiftleft128(lo, hi, shift);
+# define shr128(out,in,shift) shr128_pair(out, in.hi, in.lo, shift)
+# define shl128(out,in,shift) shl128_pair(out, in.hi, in.lo, shift)
+# define add128(a,b) { word64 p = a.lo; a.lo += b.lo; a.hi += b.hi + (a.lo < p); }
+# define add128_64(a,b) { word64 p = a.lo; a.lo += b; a.hi += (a.lo < p); }
+# define lo128(a) (a.lo)
+# define hi128(a) (a.hi)
+
+#elif defined(__GNUC__) && (defined(__amd64__) || defined(__x86_64__))
+struct word128 { word64 lo, hi; };
+# define mul64x64_128(out,a,b) __asm__ ("mulq %3" : "=a" (out.lo), "=d" (out.hi) : "a" (a), "rm" (b));
+# define shr128_pair(out,hi,lo,shift) __asm__ ("shrdq %2,%1,%0" : "+r" (lo) : "r" (hi), "J" (shift)); out = lo;
+# define shl128_pair(out,hi,lo,shift) __asm__ ("shldq %2,%1,%0" : "+r" (hi) : "r" (lo), "J" (shift)); out = hi;
+# define shr128(out,in,shift) shr128_pair(out,in.hi, in.lo, shift)
+# define shl128(out,in,shift) shl128_pair(out,in.hi, in.lo, shift)
+# define add128(a,b) __asm__ ("addq %4,%2; adcq %5,%3" : "=r" (a.hi), "=r" (a.lo) : "1" (a.lo), "0" (a.hi), "rm" (b.lo), "rm" (b.hi) : "cc");
+# define add128_64(a,b) __asm__ ("addq %4,%2; adcq $0,%3" : "=r" (a.hi), "=r" (a.lo) : "1" (a.lo), "0" (a.hi), "rm" (b) : "cc");
+# define lo128(a) (a.lo)
+# define hi128(a) (a.hi)
+
+#else
+// https://groups.google.com/forum/#!forum/cryptopp-users
+# error "Unsupported platform"
+#endif
+
+// ****************** ed25519 Signatures *********************** //
+
+typedef byte hash_512bits[64];
+
+const int bignum256modm_bits_per_limb = 56;
+const int bignum256modm_limb_size = 5;
+typedef word64 bignum256modm_element_t;
+typedef bignum256modm_element_t bignum256modm[5];
+
+/* multiples of p */
+const word64 twoP0      = 0x0fffffffffffda;
+const word64 twoP1234   = 0x0ffffffffffffe;
+const word64 fourP0     = 0x1fffffffffffb4;
+const word64 fourP1234  = 0x1ffffffffffffc;
+
+struct ge25519 {
+    bignum25519 x, y, z, t;
+};
+
+struct ge25519_p1p1 {
+    bignum25519 x, y, z, t;
+};
+
+struct ge25519_niels {
+    bignum25519 ysubx, xaddy, t2d;
+};
+
+struct ge25519_pniels {
+    bignum25519 ysubx, xaddy, z, t2d;
+};
+
+#define S1_SWINDOWSIZE 5
+#define S1_TABLE_SIZE (1<<(S1_SWINDOWSIZE-2))
+#define S2_SWINDOWSIZE 7
+#define S2_TABLE_SIZE (1<<(S2_SWINDOWSIZE-2))
+
+// *************** ed25519-donna-64bit-tables.h *************** //
+
+const ge25519 ge25519_basepoint = {
+    {0x00062d608f25d51a,0x000412a4b4f6592a,0x00075b7171a4b31d,0x0001ff60527118fe,0x000216936d3cd6e5},
+    {0x0006666666666658,0x0004cccccccccccc,0x0001999999999999,0x0003333333333333,0x0006666666666666},
+    {0x0000000000000001,0x0000000000000000,0x0000000000000000,0x0000000000000000,0x0000000000000000},
+    {0x00068ab3a5b7dda3,0x00000eea2a5eadbb,0x0002af8df483c27e,0x000332b375274732,0x00067875f0fd78b7}
+};
+
+const bignum25519 ge25519_ecd = {
+    0x00034dca135978a3,0x0001a8283b156ebd,0x0005e7a26001c029,0x000739c663a03cbb,0x00052036cee2b6ff
+};
+
+const bignum25519 ge25519_ec2d = {
+    0x00069b9426b2f159,0x00035050762add7a,0x0003cf44c0038052,0x0006738cc7407977,0x0002406d9dc56dff
+};
+
+const bignum25519 ge25519_sqrtneg1 = {
+    0x00061b274a0ea0b0,0x0000d5a5fc8f189d,0x0007ef5e9cbd0c60,0x00078595a6804c9e,0x0002b8324804fc1d
+};
+
+const ge25519_niels ge25519_niels_sliding_multiples[32] = {
+    {{0x00003905d740913e,0x0000ba2817d673a2,0x00023e2827f4e67c,0x000133d2e0c21a34,0x00044fd2f9298f81},{0x000493c6f58c3b85,0x0000df7181c325f7,0x0000f50b0b3e4cb7,0x0005329385a44c32,0x00007cf9d3a33d4b},{0x00011205877aaa68,0x000479955893d579,0x00050d66309b67a0,0x0002d42d0dbee5ee,0x0006f117b689f0c6}},
+    {{0x00011fe8a4fcd265,0x0007bcb8374faacc,0x00052f5af4ef4d4f,0x0005314098f98d10,0x0002ab91587555bd},{0x0005b0a84cee9730,0x00061d10c97155e4,0x0004059cc8096a10,0x00047a608da8014f,0x0007a164e1b9a80f},{0x0006933f0dd0d889,0x00044386bb4c4295,0x0003cb6d3162508c,0x00026368b872a2c6,0x0005a2826af12b9b}},
+    {{0x000182c3a447d6ba,0x00022964e536eff2,0x000192821f540053,0x0002f9f19e788e5c,0x000154a7e73eb1b5},{0x0002bc4408a5bb33,0x000078ebdda05442,0x0002ffb112354123,0x000375ee8df5862d,0x0002945ccf146e20},{0x0003dbf1812a8285,0x0000fa17ba3f9797,0x0006f69cb49c3820,0x00034d5a0db3858d,0x00043aabe696b3bb}},
+    {{0x00072c9aaa3221b1,0x000267774474f74d,0x000064b0e9b28085,0x0003f04ef53b27c9,0x0001d6edd5d2e531},{0x00025cd0944ea3bf,0x00075673b81a4d63,0x000150b925d1c0d4,0x00013f38d9294114,0x000461bea69283c9},{0x00036dc801b8b3a2,0x0000e0a7d4935e30,0x0001deb7cecc0d7d,0x000053a94e20dd2c,0x0007a9fbb1c6a0f9}},
+    {{0x0006217e039d8064,0x0006dea408337e6d,0x00057ac112628206,0x000647cb65e30473,0x00049c05a51fadc9},{0x0006678aa6a8632f,0x0005ea3788d8b365,0x00021bd6d6994279,0x0007ace75919e4e3,0x00034b9ed338add7},{0x0004e8bf9045af1b,0x000514e33a45e0d6,0x0007533c5b8bfe0f,0x000583557b7e14c9,0x00073c172021b008}},
+    {{0x00075b0249864348,0x00052ee11070262b,0x000237ae54fb5acd,0x0003bfd1d03aaab5,0x00018ab598029d5c},{0x000700848a802ade,0x0001e04605c4e5f7,0x0005c0d01b9767fb,0x0007d7889f42388b,0x0004275aae2546d8},{0x00032cc5fd6089e9,0x000426505c949b05,0x00046a18880c7ad2,0x0004a4221888ccda,0x0003dc65522b53df}},
+    {{0x0007013b327fbf93,0x0001336eeded6a0d,0x0002b565a2bbf3af,0x000253ce89591955,0x0000267882d17602},{0x0000c222a2007f6d,0x000356b79bdb77ee,0x00041ee81efe12ce,0x000120a9bd07097d,0x000234fd7eec346f},{0x0000a119732ea378,0x00063bf1ba8e2a6c,0x00069f94cc90df9a,0x000431d1779bfc48,0x000497ba6fdaa097}},
+    {{0x0003cd86468ccf0b,0x00048553221ac081,0x0006c9464b4e0a6e,0x00075fba84180403,0x00043b5cd4218d05},{0x0006cc0313cfeaa0,0x0001a313848da499,0x0007cb534219230a,0x00039596dedefd60,0x00061e22917f12de},{0x0002762f9bd0b516,0x0001c6e7fbddcbb3,0x00075909c3ace2bd,0x00042101972d3ec9,0x000511d61210ae4d}},
+    {{0x000386484420de87,0x0002d6b25db68102,0x000650b4962873c0,0x0004081cfd271394,0x00071a7fe6fe2482},{0x000676ef950e9d81,0x0001b81ae089f258,0x00063c4922951883,0x0002f1d54d9b3237,0x0006d325924ddb85},{0x000182b8a5c8c854,0x00073fcbe5406d8e,0x0005de3430cff451,0x000554b967ac8c41,0x0004746c4b6559ee}},
+    {{0x000546c864741147,0x0003a1df99092690,0x0001ca8cc9f4d6bb,0x00036b7fc9cd3b03,0x000219663497db5e},{0x00077b3c6dc69a2b,0x0004edf13ec2fa6e,0x0004e85ad77beac8,0x0007dba2b28e7bda,0x0005c9a51de34fe9},{0x0000f1cf79f10e67,0x00043ccb0a2b7ea2,0x00005089dfff776a,0x0001dd84e1d38b88,0x0004804503c60822}},
+    {{0x000021d23a36d175,0x0004fd3373c6476d,0x00020e291eeed02a,0x00062f2ecf2e7210,0x000771e098858de4},{0x00049ed02ca37fc7,0x000474c2b5957884,0x0005b8388e816683,0x0004b6c454b76be4,0x000553398a516506},{0x0002f5d278451edf,0x000730b133997342,0x0006965420eb6975,0x000308a3bfa516cf,0x0005a5ed1d68ff5a}},
+    {{0x0005e0c558527359,0x0003395b73afd75c,0x000072afa4e4b970,0x00062214329e0f6d,0x000019b60135fefd},{0x0005122afe150e83,0x0004afc966bb0232,0x0001c478833c8268,0x00017839c3fc148f,0x00044acb897d8bf9},{0x000068145e134b83,0x0001e4860982c3cc,0x000068fb5f13d799,0x0007c9283744547e,0x000150c49fde6ad2}},
+    {{0x0001863c9cdca868,0x0003770e295a1709,0x0000d85a3720fd13,0x0005e0ff1f71ab06,0x00078a6d7791e05f},{0x0003f29509471138,0x000729eeb4ca31cf,0x00069c22b575bfbc,0x0004910857bce212,0x0006b2b5a075bb99},{0x0007704b47a0b976,0x0002ae82e91aab17,0x00050bd6429806cd,0x00068055158fd8ea,0x000725c7ffc4ad55}},
+    {{0x00002bf71cd098c0,0x00049dabcc6cd230,0x00040a6533f905b2,0x000573efac2eb8a4,0x0004cd54625f855f},{0x00026715d1cf99b2,0x0002205441a69c88,0x000448427dcd4b54,0x0001d191e88abdc5,0x000794cc9277cb1f},{0x0006c426c2ac5053,0x0005a65ece4b095e,0x0000c44086f26bb6,0x0007429568197885,0x0007008357b6fcc8}},
+    {{0x00039fbb82584a34,0x00047a568f257a03,0x00014d88091ead91,0x0002145b18b1ce24,0x00013a92a3669d6d},{0x0000672738773f01,0x000752bf799f6171,0x0006b4a6dae33323,0x0007b54696ead1dc,0x00006ef7e9851ad0},{0x0003771cc0577de5,0x0003ca06bb8b9952,0x00000b81c5d50390,0x00043512340780ec,0x0003c296ddf8a2af}},
+    {{0x00034d2ebb1f2541,0x0000e815b723ff9d,0x000286b416e25443,0x0000bdfe38d1bee8,0x0000a892c7007477},{0x000515f9d914a713,0x00073191ff2255d5,0x00054f5cc2a4bdef,0x0003dd57fc118bcf,0x0007a99d393490c7},{0x0002ed2436bda3e8,0x00002afd00f291ea,0x0000be7381dea321,0x0003e952d4b2b193,0x000286762d28302f}},
+    {{0x00058e2bce2ef5bd,0x00068ce8f78c6f8a,0x0006ee26e39261b2,0x00033d0aa50bcf9d,0x0007686f2a3d6f17},{0x000036093ce35b25,0x0003b64d7552e9cf,0x00071ee0fe0b8460,0x00069d0660c969e5,0x00032f1da046a9d9},{0x000512a66d597c6a,0x0000609a70a57551,0x000026c08a3c464c,0x0004531fc8ee39e1,0x000561305f8a9ad2}},
+    {{0x0002cc28e7b0c0d5,0x00077b60eb8a6ce4,0x0004042985c277a6,0x000636657b46d3eb,0x000030a1aef2c57c},{0x0004978dec92aed1,0x000069adae7ca201,0x00011ee923290f55,0x00069641898d916c,0x00000aaec53e35d4},{0x0001f773003ad2aa,0x000005642cc10f76,0x00003b48f82cfca6,0x0002403c10ee4329,0x00020be9c1c24065}},
+    {{0x0000e44ae2025e60,0x0005f97b9727041c,0x0005683472c0ecec,0x000188882eb1ce7c,0x00069764c545067e},{0x000387d8249673a6,0x0005bea8dc927c2a,0x0005bd8ed5650ef0,0x0000ef0e3fcd40e1,0x000750ab3361f0ac},{0x00023283a2f81037,0x000477aff97e23d1,0x0000b8958dbcbb68,0x0000205b97e8add6,0x00054f96b3fb7075}},
+    {{0x0005afc616b11ecd,0x00039f4aec8f22ef,0x0003b39e1625d92e,0x0005f85bd4508873,0x00078e6839fbe85d},{0x0005f20429669279,0x00008fafae4941f5,0x00015d83c4eb7688,0x0001cf379eca4146,0x0003d7fe9c52bb75},{0x00032df737b8856b,0x0000608342f14e06,0x0003967889d74175,0x0001211907fba550,0x00070f268f350088}},
+    {{0x0004112070dcf355,0x0007dcff9c22e464,0x00054ada60e03325,0x00025cd98eef769a,0x000404e56c039b8c},{0x00064583b1805f47,0x00022c1baf832cd0,0x000132c01bd4d717,0x0004ecf4c3a75b8f,0x0007c0d345cfad88},{0x00071f4b8c78338a,0x00062cfc16bc2b23,0x00017cf51280d9aa,0x0003bbae5e20a95a,0x00020d754762aaec}},
+    {{0x0004feb135b9f543,0x00063bd192ad93ae,0x00044e2ea612cdf7,0x000670f4991583ab,0x00038b8ada8790b4},{0x0007c36fc73bb758,0x0004a6c797734bd1,0x0000ef248ab3950e,0x00063154c9a53ec8,0x0002b8f1e46f3cee},{0x00004a9cdf51f95d,0x0005d963fbd596b8,0x00022d9b68ace54a,0x0004a98e8836c599,0x000049aeb32ceba1}},
+    {{0x00067d3c63dcfe7e,0x000112f0adc81aee,0x00053df04c827165,0x0002fe5b33b430f0,0x00051c665e0c8d62},{0x00007d0b75fc7931,0x00016f4ce4ba754a,0x0005ace4c03fbe49,0x00027e0ec12a159c,0x000795ee17530f67},{0x00025b0a52ecbd81,0x0005dc0695fce4a9,0x0003b928c575047d,0x00023bf3512686e5,0x0006cd19bf49dc54}},
+    {{0x0007619052179ca3,0x0000c16593f0afd0,0x000265c4795c7428,0x00031c40515d5442,0x0007520f3db40b2e},{0x0006612165afc386,0x0001171aa36203ff,0x0002642ea820a8aa,0x0001f3bb7b313f10,0x0005e01b3a7429e4},{0x00050be3d39357a1,0x0003ab33d294a7b6,0x0004c479ba59edb3,0x0004c30d184d326f,0x00071092c9ccef3c}},
+    {{0x0000523f0364918c,0x000687f56d638a7b,0x00020796928ad013,0x0005d38405a54f33,0x0000ea15b03d0257},{0x0003d8ac74051dcf,0x00010ab6f543d0ad,0x0005d0f3ac0fda90,0x0005ef1d2573e5e4,0x0004173a5bb7137a},{0x00056e31f0f9218a,0x0005635f88e102f8,0x0002cbc5d969a5b8,0x000533fbc98b347a,0x0005fc565614a4e3}},
+    {{0x0006570dc46d7ae5,0x00018a9f1b91e26d,0x000436b6183f42ab,0x000550acaa4f8198,0x00062711c414c454},{0x0002e1e67790988e,0x0001e38b9ae44912,0x000648fbb4075654,0x00028df1d840cd72,0x0003214c7409d466},{0x0001827406651770,0x0004d144f286c265,0x00017488f0ee9281,0x00019e6cdb5c760c,0x0005bea94073ecb8}},
+    {{0x0005bf0912c89be4,0x00062fadcaf38c83,0x00025ec196b3ce2c,0x00077655ff4f017b,0x0003aacd5c148f61},{0x0000ce63f343d2f8,0x0001e0a87d1e368e,0x000045edbc019eea,0x0006979aed28d0d1,0x0004ad0785944f1b},{0x00063b34c3318301,0x0000e0e62d04d0b1,0x000676a233726701,0x00029e9a042d9769,0x0003aff0cb1d9028}},
+    {{0x0005c7eb3a20405e,0x0005fdb5aad930f8,0x0004a757e63b8c47,0x00028e9492972456,0x000110e7e86f4cd2},{0x0006430bf4c53505,0x000264c3e4507244,0x00074c9f19a39270,0x00073f84f799bc47,0x0002ccf9f732bd99},{0x0000d89ed603f5e4,0x00051e1604018af8,0x0000b8eedc4a2218,0x00051ba98b9384d0,0x00005c557e0b9693}},
+    {{0x0001ce311fc97e6f,0x0006023f3fb5db1f,0x0007b49775e8fc98,0x0003ad70adbf5045,0x0006e154c178fe98},{0x0006bbb089c20eb0,0x0006df41fb0b9eee,0x00051087ed87e16f,0x000102db5c9fa731,0x000289fef0841861},{0x00016336fed69abf,0x0004f066b929f9ec,0x0004e9ff9e6c5b93,0x00018c89bc4bb2ba,0x0006afbf642a95ca}},
+    {{0x0000de0c62f5d2c1,0x00049601cf734fb5,0x0006b5c38263f0f6,0x0004623ef5b56d06,0x0000db4b851b9503},{0x00055070f913a8cc,0x000765619eac2bbc,0x0003ab5225f47459,0x00076ced14ab5b48,0x00012c093cedb801},{0x00047f9308b8190f,0x000414235c621f82,0x00031f5ff41a5a76,0x0006736773aab96d,0x00033aa8799c6635}},
+    {{0x0007f51ebd085cf2,0x00012cfa67e3f5e1,0x0001800cf1e3d46a,0x00054337615ff0a8,0x000233c6f29e8e21},{0x0000f588fc156cb1,0x000363414da4f069,0x0007296ad9b68aea,0x0004d3711316ae43,0x000212cd0c1c8d58},{0x0004d5107f18c781,0x00064a4fd3a51a5e,0x0004f4cd0448bb37,0x000671d38543151e,0x0001db7778911914}},
+    {{0x000352397c6bc26f,0x00018a7aa0227bbe,0x0005e68cc1ea5f8b,0x0006fe3e3a7a1d5f,0x00031ad97ad26e2a},{0x00014769dd701ab6,0x00028339f1b4b667,0x0004ab214b8ae37b,0x00025f0aefa0b0fe,0x0007ae2ca8a017d2},{0x000017ed0920b962,0x000187e33b53b6fd,0x00055829907a1463,0x000641f248e0a792,0x0001ed1fc53a6622}}
+};
+
+// ****************** modm-donna-64bit.h *********************** //
+
+const bignum256modm modm_m = {
+    0x12631a5cf5d3ed, 0xf9dea2f79cd658,
+    0x000000000014de, 0x00000000000000,
+    0x00000010000000
+};
+
+const bignum256modm modm_mu = {
+    0x9ce5a30a2c131b, 0x215d086329a7ed,
+    0xffffffffeb2106, 0xffffffffffffff,
+    0x00000fffffffff
+};
+
+// *************** ed25519-donna-basepoint-table.h *************** //
+
+/* multiples of the base point in packed {ysubx, xaddy, t2d} form */
+ALIGN(16) const byte ge25519_niels_base_multiples[256][96] = {
+    {0x3e,0x91,0x40,0xd7,0x05,0x39,0x10,0x9d,0xb3,0xbe,0x40,0xd1,0x05,0x9f,0x39,0xfd,0x09,0x8a,0x8f,0x68,0x34,0x84,0xc1,0xa5,0x67,0x12,0xf8,0x98,0x92,0x2f,0xfd,0x44,0x85,0x3b,0x8c,0xf5,0xc6,0x93,0xbc,0x2f,0x19,0x0e,0x8c,0xfb,0xc6,0x2d,0x93,0xcf,0xc2,0x42,0x3d,0x64,0x98,0x48,0x0b,0x27,0x65,0xba,0xd4,0x33,0x3a,0x9d,0xcf,0x07,0x59,0xbb,0x6f,0x4b,0x67,0x15,0xbd,0xdb,0xea,0xa5,0xa2,0xee,0x00,0x3f,0xe1,0x41,0xfa,0xc6,0x57,0xc9,0x1c,0x9d,0xd4,0xcd,0xca,0xec,0x16,0xaf,0x1f,0xbe,0x0e,0x4f},
+    {0xa8,0xd5,0xb4,0x42,0x60,0xa5,0x99,0x8a,0xf6,0xac,0x60,0x4e,0x0c,0x81,0x2b,0x8f,0xaa,0x37,0x6e,0xb1,0x6b,0x23,0x9e,0xe0,0x55,0x25,0xc9,0x69,0xa6,0x95,0xb5,0x6b,0xd7,0x71,0x3c,0x93,0xfc,0xe7,0x24,0x92,0xb5,0xf5,0x0f,0x7a,0x96,0x9d,0x46,0x9f,0x02,0x07,0xd6,0xe1,0x65,0x9a,0xa6,0x5a,0x2e,0x2e,0x7d,0xa8,0x3f,0x06,0x0c,0x59,0x02,0x68,0xd3,0xda,0xaa,0x7e,0x34,0x6e,0x05,0x48,0xee,0x83,0x93,0x59,0xf3,0xba,0x26,0x68,0x07,0xe6,0x10,0xbe,0xca,0x3b,0xb8,0xd1,0x5e,0x16,0x0a,0x4f,0x31,0x49},
+    {0x65,0xd2,0xfc,0xa4,0xe8,0x1f,0x61,0x56,0x7d,0xba,0xc1,0xe5,0xfd,0x53,0xd3,0x3b,0xbd,0xd6,0x4b,0x21,0x1a,0xf3,0x31,0x81,0x62,0xda,0x5b,0x55,0x87,0x15,0xb9,0x2a,0x30,0x97,0xee,0x4c,0xa8,0xb0,0x25,0xaf,0x8a,0x4b,0x86,0xe8,0x30,0x84,0x5a,0x02,0x32,0x67,0x01,0x9f,0x02,0x50,0x1b,0xc1,0xf4,0xf8,0x80,0x9a,0x1b,0x4e,0x16,0x7a,0x34,0x48,0x67,0xf1,0xf4,0x11,0xf2,0x9b,0x95,0xf8,0x2d,0xf6,0x17,0x6b,0x4e,0xb8,0x4e,0x2a,0x72,0x5b,0x07,0x6f,0xde,0xd7,0x21,0x2a,0xbb,0x63,0xb9,0x04,0x9a,0x54},
+    {0xbf,0x18,0x68,0x05,0x0a,0x05,0xfe,0x95,0xa9,0xfa,0x60,0x56,0x71,0x89,0x7e,0x32,0x73,0x50,0xa0,0x06,0xcd,0xe3,0xe8,0xc3,0x9a,0xa4,0x45,0x74,0x4c,0x3f,0x93,0x27,0x9f,0x09,0xfc,0x8e,0xb9,0x51,0x73,0x28,0x38,0x25,0xfd,0x7d,0xf4,0xc6,0x65,0x67,0x65,0x92,0x0a,0xfb,0x3d,0x8d,0x34,0xca,0x27,0x87,0xe5,0x21,0x03,0x91,0x0e,0x68,0xb0,0x26,0x14,0xe5,0xec,0x45,0x1e,0xbf,0x94,0x0f,0xba,0x6d,0x3d,0xc6,0x2b,0xe3,0xc0,0x52,0xf8,0x8c,0xd5,0x74,0x29,0xe4,0x18,0x4c,0xe6,0xb0,0xb1,0x79,0xf0,0x44},
+    {0xba,0xd6,0x47,0xa4,0xc3,0x82,0x91,0x7f,0xb7,0x29,0x27,0x4b,0xd1,0x14,0x00,0xd5,0x87,0xa0,0x64,0xb8,0x1c,0xf1,0x3c,0xe3,0xf3,0x55,0x1b,0xeb,0x73,0x7e,0x4a,0x15,0x33,0xbb,0xa5,0x08,0x44,0xbc,0x12,0xa2,0x02,0xed,0x5e,0xc7,0xc3,0x48,0x50,0x8d,0x44,0xec,0xbf,0x5a,0x0c,0xeb,0x1b,0xdd,0xeb,0x06,0xe2,0x46,0xf1,0xcc,0x45,0x29,0xb3,0x03,0xd0,0xe7,0x79,0xa1,0x32,0xc8,0x7e,0x4d,0x12,0x00,0x0a,0x9d,0x72,0x5f,0xf3,0x8f,0x6d,0x0e,0xa1,0xd4,0xc1,0x62,0x98,0x7a,0xb2,0x38,0x59,0xac,0xb8,0x68},
+    {0xa4,0x8c,0x7d,0x7b,0xb6,0x06,0x98,0x49,0x39,0x27,0xd2,0x27,0x84,0xe2,0x5b,0x57,0xb9,0x53,0x45,0x20,0xe7,0x5c,0x08,0xbb,0x84,0x78,0x41,0xae,0x41,0x4c,0xb6,0x38,0x31,0x71,0x15,0x77,0xeb,0xee,0x0c,0x3a,0x88,0xaf,0xc8,0x00,0x89,0x15,0x27,0x9b,0x36,0xa7,0x59,0xda,0x68,0xb6,0x65,0x80,0xbd,0x38,0xcc,0xa2,0xb6,0x7b,0xe5,0x51,0xa4,0xe3,0x9d,0x68,0x91,0xad,0x9d,0x8f,0x37,0x91,0xfb,0xf8,0x28,0x24,0x5f,0x17,0x88,0xb9,0xcf,0x9f,0x32,0xb5,0x0a,0x05,0x9f,0xc0,0x54,0x13,0xa2,0xdf,0x65,0x78},
+    {0xb1,0x21,0x32,0xaa,0x9a,0x2c,0x6f,0xba,0xa7,0x23,0xba,0x3b,0x53,0x21,0xa0,0x6c,0x3a,0x2c,0x19,0x92,0x4f,0x76,0xea,0x9d,0xe0,0x17,0x53,0x2e,0x5d,0xdd,0x6e,0x1d,0xbf,0xa3,0x4e,0x94,0xd0,0x5c,0x1a,0x6b,0xd2,0xc0,0x9d,0xb3,0x3a,0x35,0x70,0x74,0x49,0x2e,0x54,0x28,0x82,0x52,0xb2,0x71,0x7e,0x92,0x3c,0x28,0x69,0xea,0x1b,0x46,0x36,0xda,0x0f,0xab,0xac,0x8a,0x7a,0x21,0xc8,0x49,0x35,0x3d,0x54,0xc6,0x28,0xa5,0x68,0x75,0xab,0x13,0x8b,0x5b,0xd0,0x37,0x37,0xbc,0x2c,0x3a,0x62,0xef,0x3c,0x23},
+    {0xd9,0x34,0x92,0xf3,0xed,0x5d,0xa7,0xe2,0xf9,0x58,0xb5,0xe1,0x80,0x76,0x3d,0x96,0xfb,0x23,0x3c,0x6e,0xac,0x41,0x27,0x2c,0xc3,0x01,0x0e,0x32,0xa1,0x24,0x90,0x3a,0x8f,0x3e,0xdd,0x04,0x66,0x59,0xb7,0x59,0x2c,0x70,0x88,0xe2,0x77,0x03,0xb3,0x6c,0x23,0xc3,0xd9,0x5e,0x66,0x9c,0x33,0xb1,0x2f,0xe5,0xbc,0x61,0x60,0xe7,0x15,0x09,0x7e,0xa3,0x34,0xa8,0x35,0xe8,0x7d,0xdf,0xea,0x57,0x98,0x68,0xda,0x9c,0xe1,0x8b,0x26,0xb3,0x67,0x71,0x36,0x85,0x11,0x2c,0xc2,0xd5,0xef,0xdb,0xd9,0xb3,0x9e,0x58},
+    {0x5e,0x51,0xaa,0x49,0x54,0x63,0x5b,0xed,0x3a,0x82,0xc6,0x0b,0x9f,0xc4,0x65,0xa8,0xc4,0xd1,0x42,0x5b,0xe9,0x1f,0x0c,0x85,0xb9,0x15,0xd3,0x03,0x6f,0x6d,0xd7,0x30,0x1d,0x9c,0x2f,0x63,0x0e,0xdd,0xcc,0x2e,0x15,0x31,0x89,0x76,0x96,0xb6,0xd0,0x51,0x58,0x7a,0x63,0xa8,0x6b,0xb7,0xdf,0x52,0x39,0xef,0x0e,0xa0,0x49,0x7d,0xd3,0x6d,0xc7,0xe4,0x06,0x21,0x17,0x44,0x44,0x6c,0x69,0x7f,0x8d,0x92,0x80,0xd6,0x53,0xfb,0x26,0x3f,0x4d,0x69,0xa4,0x9e,0x73,0xb4,0xb0,0x4b,0x86,0x2e,0x11,0x97,0xc6,0x10},
+    {0xde,0x5f,0xbe,0x7d,0x27,0xc4,0x93,0x64,0xa2,0x7e,0xad,0x19,0xad,0x4f,0x5d,0x26,0x90,0x45,0x30,0x46,0xc8,0xdf,0x00,0x0e,0x09,0xfe,0x66,0xed,0xab,0x1c,0xe6,0x25,0x05,0xc8,0x58,0x83,0xa0,0x2a,0xa6,0x0c,0x47,0x42,0x20,0x7a,0xe3,0x4a,0x3d,0x6a,0xdc,0xed,0x11,0x3b,0xa6,0xd3,0x64,0x74,0xef,0x06,0x08,0x55,0xaf,0x9b,0xbf,0x03,0x04,0x66,0x58,0xcc,0x28,0xe1,0x13,0x3f,0x7e,0x74,0x59,0xb4,0xec,0x73,0x58,0x6f,0xf5,0x68,0x12,0xcc,0xed,0x3d,0xb6,0xa0,0x2c,0xe2,0x86,0x45,0x63,0x78,0x6d,0x56},
+    {0x34,0x08,0xc1,0x9c,0x9f,0xa4,0x37,0x16,0x51,0xc4,0x9b,0xa8,0xd5,0x56,0x8e,0xbc,0xdb,0xd2,0x7f,0x7f,0x0f,0xec,0xb5,0x1c,0xd9,0x35,0xcc,0x5e,0xca,0x5b,0x97,0x33,0xd0,0x2f,0x5a,0xc6,0x85,0x42,0x05,0xa1,0xc3,0x67,0x16,0xf3,0x2a,0x11,0x64,0x6c,0x58,0xee,0x1a,0x73,0x40,0xe2,0x0a,0x68,0x2a,0xb2,0x93,0x47,0xf3,0xa5,0xfb,0x14,0xd4,0xf7,0x85,0x69,0x16,0x46,0xd7,0x3c,0x57,0x00,0xc8,0xc9,0x84,0x5e,0x3e,0x59,0x1e,0x13,0x61,0x7b,0xb6,0xf2,0xc3,0x2f,0x6c,0x52,0xfc,0x83,0xea,0x9c,0x82,0x14},
+    {0xc2,0x95,0xdd,0x97,0x84,0x7b,0x43,0xff,0xa7,0xb5,0x4e,0xaa,0x30,0x4e,0x74,0x6c,0x8b,0xe8,0x85,0x3c,0x61,0x5d,0x0c,0x9e,0x73,0x81,0x75,0x5f,0x1e,0xc7,0xd9,0x2f,0xb8,0xec,0x71,0x4e,0x2f,0x0b,0xe7,0x21,0xe3,0x77,0xa4,0x40,0xb9,0xdd,0x56,0xe6,0x80,0x4f,0x1d,0xce,0xce,0x56,0x65,0xbf,0x7e,0x7b,0x5d,0x53,0xc4,0x3b,0xfc,0x05,0xdd,0xde,0xaf,0x52,0xae,0xb3,0xb8,0x24,0xcf,0x30,0x3b,0xed,0x8c,0x63,0x95,0x34,0x95,0x81,0xbe,0xa9,0x83,0xbc,0xa4,0x33,0x04,0x1f,0x65,0x5c,0x47,0x67,0x37,0x37},
+    {0xd9,0xad,0xd1,0x40,0xfd,0x99,0xba,0x2f,0x27,0xd0,0xf4,0x96,0x6f,0x16,0x07,0xb3,0xae,0x3b,0xf0,0x15,0x52,0xf0,0x63,0x43,0x99,0xf9,0x18,0x3b,0x6c,0xa5,0xbe,0x1f,0x90,0x65,0x24,0x14,0xcb,0x95,0x40,0x63,0x35,0x55,0xc1,0x16,0x40,0x14,0x12,0xef,0x60,0xbc,0x10,0x89,0x0c,0x14,0x38,0x9e,0x8c,0x7c,0x90,0x30,0x57,0x90,0xf5,0x6b,0x8a,0x5b,0x41,0xe1,0xf1,0x78,0xa7,0x0f,0x7e,0xa7,0xc3,0xba,0xf7,0x9f,0x40,0x06,0x50,0x9a,0xa2,0x9a,0xb8,0xd7,0x52,0x6f,0x56,0x5a,0x63,0x7a,0xf6,0x1c,0x52,0x02},
+    {0x94,0x52,0x9d,0x0a,0x0b,0xee,0x3f,0x51,0x66,0x5a,0xdf,0x0f,0x5c,0xe7,0x98,0x8f,0xce,0x07,0xe1,0xbf,0x88,0x86,0x61,0xd4,0xed,0x2c,0x38,0x71,0x7e,0x0a,0xa0,0x3f,0xe4,0x5e,0x2f,0x77,0x20,0x67,0x14,0xb1,0xce,0x9a,0x07,0x96,0xb1,0x94,0xf8,0xe8,0x4a,0x82,0xac,0x00,0x4d,0x22,0xf8,0x4a,0xc4,0x6c,0xcd,0xf7,0xd9,0x53,0x17,0x00,0x34,0xdb,0x3d,0x96,0x2d,0x23,0x69,0x3c,0x58,0x38,0x97,0xb4,0xda,0x87,0xde,0x1d,0x85,0xf2,0x91,0xa0,0xf9,0xd1,0xd7,0xaa,0xb6,0xed,0x48,0xa0,0x2f,0xfe,0xb5,0x12},
+    {0x4d,0xe3,0xfc,0x96,0xc4,0xfb,0xf0,0x71,0xed,0x5b,0xf3,0xad,0x6b,0x82,0xb9,0x73,0x61,0xc5,0x28,0xff,0x61,0x72,0x04,0xd2,0x6f,0x20,0xb1,0x6f,0xf9,0x76,0x9b,0x74,0x92,0x1e,0x6f,0xad,0x26,0x7c,0x2b,0xdf,0x13,0x89,0x4b,0x50,0x23,0xd3,0x66,0x4b,0xc3,0x8b,0x1c,0x75,0xc0,0x9d,0x40,0x8c,0xb8,0xc7,0x96,0x07,0xc2,0x93,0x7e,0x6f,0x05,0xae,0xa6,0xae,0x04,0xf6,0x5a,0x1f,0x99,0x9c,0xe4,0xbe,0xf1,0x51,0x23,0xc1,0x66,0x6b,0xff,0xee,0xb5,0x08,0xa8,0x61,0x51,0x21,0xe0,0x01,0x0f,0xc1,0xce,0x0f},
+    {0x44,0x1e,0xfe,0x49,0xa6,0x58,0x4d,0x64,0x7e,0x77,0xad,0x31,0xa2,0xae,0xfc,0x21,0xd2,0xd0,0x7f,0x88,0x5a,0x1c,0x44,0x02,0xf3,0x11,0xc5,0x83,0x71,0xaa,0x01,0x49,0x45,0x4e,0x24,0xc4,0x9d,0xd2,0xf2,0x3d,0x0a,0xde,0xd8,0x93,0x74,0x0e,0x02,0x2b,0x4d,0x21,0x0c,0x82,0x7e,0x06,0xc8,0x6c,0x0a,0xb9,0xea,0x6f,0x16,0x79,0x37,0x41,0xf0,0xf8,0x1a,0x8c,0x54,0xb7,0xb1,0x08,0xb4,0x99,0x62,0x24,0x7c,0x7a,0x0f,0xce,0x39,0xd9,0x06,0x1e,0xf9,0xb0,0x60,0xf7,0x13,0x12,0x6d,0x72,0x7b,0x88,0xbb,0x41},
+    {0xbe,0x46,0x43,0x74,0x44,0x7d,0xe8,0x40,0x25,0x2b,0xb5,0x15,0xd4,0xda,0x48,0x1d,0x3e,0x60,0x3b,0xa1,0x18,0x8a,0x3a,0x7c,0xf7,0xbd,0xcd,0x2f,0xc1,0x28,0xb7,0x4e,0xae,0x91,0x66,0x7c,0x59,0x4c,0x23,0x7e,0xc8,0xb4,0x85,0x0a,0x3d,0x9d,0x88,0x64,0xe7,0xfa,0x4a,0x35,0x0c,0xc9,0xe2,0xda,0x1d,0x9e,0x6a,0x0c,0x07,0x1e,0x87,0x0a,0x89,0x89,0xbc,0x4b,0x99,0xb5,0x01,0x33,0x60,0x42,0xdd,0x5b,0x3a,0xae,0x6b,0x73,0x3c,0x9e,0xd5,0x19,0xe2,0xad,0x61,0x0d,0x64,0xd4,0x85,0x26,0x0f,0x30,0xe7,0x3e},
+    {0xb7,0xd6,0x7d,0x9e,0xe4,0x55,0xd2,0xf5,0xac,0x1e,0x0b,0x61,0x5c,0x11,0x16,0x80,0xca,0x87,0xe1,0x92,0x5d,0x97,0x99,0x3c,0xc2,0x25,0x91,0x97,0x62,0x57,0x81,0x13,0x18,0x75,0x1e,0x84,0x47,0x79,0xfa,0x43,0xd7,0x46,0x9c,0x63,0x59,0xfa,0xc6,0xe5,0x74,0x2b,0x05,0xe3,0x1d,0x5e,0x06,0xa1,0x30,0x90,0xb8,0xcf,0xa2,0xc6,0x47,0x7d,0xe0,0xd6,0xf0,0x8e,0x14,0xd0,0xda,0x3f,0x3c,0x6f,0x54,0x91,0x9a,0x74,0x3e,0x9d,0x57,0x81,0xbb,0x26,0x10,0x62,0xec,0x71,0x80,0xec,0xc9,0x34,0x8d,0xf5,0x8c,0x14},
+    {0x27,0xf0,0x34,0x79,0xf6,0x92,0xa4,0x46,0xa9,0x0a,0x84,0xf6,0xbe,0x84,0x99,0x46,0x54,0x18,0x61,0x89,0x2a,0xbc,0xa1,0x5c,0xd4,0xbb,0x5d,0xbd,0x1e,0xfa,0xf2,0x3f,0x6d,0x75,0xe4,0x9a,0x7d,0x2f,0x57,0xe2,0x7f,0x48,0xf3,0x88,0xbb,0x45,0xc3,0x56,0x8d,0xa8,0x60,0x69,0x6d,0x0b,0xd1,0x9f,0xb9,0xa1,0xae,0x4e,0xad,0xeb,0x8f,0x27,0x66,0x39,0x93,0x8c,0x1f,0x68,0xaa,0xb1,0x98,0x0c,0x29,0x20,0x9c,0x94,0x21,0x8c,0x52,0x3c,0x9d,0x21,0x91,0x52,0x11,0x39,0x7b,0x67,0x9c,0xfe,0x02,0xdd,0x04,0x41},
+    {0x2a,0x42,0x24,0x11,0x5e,0xbf,0xb2,0x72,0xb5,0x3a,0xa3,0x98,0x33,0x0c,0xfa,0xa1,0x66,0xb6,0x52,0xfa,0x01,0x61,0xcb,0x94,0xd5,0x53,0xaf,0xaf,0x00,0x3b,0x86,0x2c,0xb8,0x6a,0x09,0xdb,0x06,0x4e,0x21,0x81,0x35,0x4f,0xe4,0x0c,0xc9,0xb6,0xa8,0x21,0xf5,0x2a,0x9e,0x40,0x2a,0xc1,0x24,0x65,0x81,0xa4,0xfc,0x8e,0xa4,0xb5,0x65,0x01,0x76,0x6a,0x84,0xa0,0x74,0xa4,0x90,0xf1,0xc0,0x7c,0x2f,0xcd,0x84,0xf9,0xef,0x12,0x8f,0x2b,0xaa,0x58,0x06,0x29,0x5e,0x69,0xb8,0xc8,0xfe,0xbf,0xd9,0x67,0x1b,0x59},
+    {0xfa,0x9b,0xb4,0x80,0x1c,0x0d,0x2f,0x31,0x8a,0xec,0xf3,0xab,0x5e,0x51,0x79,0x59,0x88,0x1c,0xf0,0x9e,0xc0,0x33,0x70,0x72,0xcb,0x7b,0x8f,0xca,0xc7,0x2e,0xe0,0x3d,0x5d,0xb5,0x18,0x9f,0x71,0xb3,0xb9,0x99,0x1e,0x64,0x8c,0xa1,0xfa,0xe5,0x65,0xe4,0xed,0x05,0x9f,0xc2,0x36,0x11,0x08,0x61,0x8b,0x12,0x30,0x70,0x86,0x4f,0x9b,0x48,0xef,0x92,0xeb,0x3a,0x2d,0x10,0x32,0xd2,0x61,0xa8,0x16,0x61,0xb4,0x53,0x62,0xe1,0x24,0xaa,0x0b,0x19,0xe7,0xab,0x7e,0x3d,0xbf,0xbe,0x6c,0x49,0xba,0xfb,0xf5,0x49},
+    {0xd4,0xcf,0x5b,0x8a,0x10,0x9a,0x94,0x30,0xeb,0x73,0x64,0xbc,0x70,0xdd,0x40,0xdc,0x1c,0x0d,0x7c,0x30,0xc1,0x94,0xc2,0x92,0x74,0x6e,0xfa,0xcb,0x6d,0xa8,0x04,0x56,0x2e,0x57,0x9c,0x1e,0x8c,0x62,0x5d,0x15,0x41,0x47,0x88,0xc5,0xac,0x86,0x4d,0x8a,0xeb,0x63,0x57,0x51,0xf6,0x52,0xa3,0x91,0x5b,0x51,0x67,0x88,0xc2,0xa6,0xa1,0x06,0xb6,0x64,0x17,0x7c,0xd4,0xd1,0x88,0x72,0x51,0x8b,0x41,0xe0,0x40,0x11,0x54,0x72,0xd1,0xf6,0xac,0x18,0x60,0x1a,0x03,0x9f,0xc6,0x42,0x27,0xfe,0x89,0x9e,0x98,0x20},
+    {0x7f,0xcc,0x2d,0x3a,0xfd,0x77,0x97,0x49,0x92,0xd8,0x4f,0xa5,0x2c,0x7c,0x85,0x32,0xa0,0xe3,0x07,0xd2,0x64,0xd8,0x79,0xa2,0x29,0x7e,0xa6,0x0c,0x1d,0xed,0x03,0x04,0x2e,0xec,0xea,0x85,0x8b,0x27,0x74,0x16,0xdf,0x2b,0xcb,0x7a,0x07,0xdc,0x21,0x56,0x5a,0xf4,0xcb,0x61,0x16,0x4c,0x0a,0x64,0xd3,0x95,0x05,0xf7,0x50,0x99,0x0b,0x73,0x52,0xc5,0x4e,0x87,0x35,0x2d,0x4b,0xc9,0x8d,0x6f,0x24,0x98,0xcf,0xc8,0xe6,0xc5,0xce,0x35,0xc0,0x16,0xfa,0x46,0xcb,0xf7,0xcc,0x3d,0x30,0x08,0x43,0x45,0xd7,0x5b},
+    {0xc2,0x4c,0xb2,0x28,0x95,0xd1,0x9a,0x7f,0x81,0xc1,0x35,0x63,0x65,0x54,0x6b,0x7f,0x36,0x72,0xc0,0x4f,0x6e,0xb6,0xb8,0x66,0x83,0xad,0x80,0x73,0x00,0x78,0x3a,0x13,0x2a,0x79,0xe7,0x15,0x21,0x93,0xc4,0x85,0xc9,0xdd,0xcd,0xbd,0xa2,0x89,0x4c,0xc6,0x62,0xd7,0xa3,0xad,0xa8,0x3d,0x1e,0x9d,0x2c,0xf8,0x67,0x30,0x12,0xdb,0xb7,0x5b,0xbe,0x62,0xca,0xc6,0x67,0xf4,0x61,0x09,0xee,0x52,0x19,0x21,0xd6,0x21,0xec,0x04,0x70,0x47,0xd5,0x9b,0x77,0x60,0x23,0x18,0xd2,0xe0,0xf0,0x58,0x6d,0xca,0x0d,0x74},
+    {0x4e,0xce,0xcf,0x52,0x07,0xee,0x48,0xdf,0xb7,0x08,0xec,0x06,0xf3,0xfa,0xff,0xc3,0xc4,0x59,0x54,0xb9,0x2a,0x0b,0x71,0x05,0x8d,0xa3,0x3e,0x96,0xfa,0x25,0x1d,0x16,0x3c,0x43,0x78,0x04,0x57,0x8c,0x1a,0x23,0x9d,0x43,0x81,0xc2,0x0e,0x27,0xb5,0xb7,0x9f,0x07,0xd9,0xe3,0xea,0x99,0xaa,0xdb,0xd9,0x03,0x2b,0x6c,0x25,0xf5,0x03,0x2c,0x7d,0xa4,0x53,0x7b,0x75,0x18,0x0f,0x79,0x79,0x58,0x0c,0xcf,0x30,0x01,0x7b,0x30,0xf9,0xf7,0x7e,0x25,0x77,0x3d,0x90,0x31,0xaf,0xbb,0x96,0xbd,0xbd,0x68,0x94,0x69},
+    {0xcf,0xfe,0xda,0xf4,0x46,0x2f,0x1f,0xbd,0xf7,0xd6,0x7f,0xa4,0x14,0x01,0xef,0x7c,0x7f,0xb3,0x47,0x4a,0xda,0xfd,0x1f,0xd3,0x85,0x57,0x90,0x73,0xa4,0x19,0x52,0x52,0x48,0x19,0xa9,0x6a,0xe6,0x3d,0xdd,0xd8,0xcc,0xd2,0xc0,0x2f,0xc2,0x64,0x50,0x48,0x2f,0xea,0xfd,0x34,0x66,0x24,0x48,0x9b,0x3a,0x2e,0x4a,0x6c,0x4e,0x1c,0x3e,0x29,0xe1,0x12,0x51,0x92,0x4b,0x13,0x6e,0x37,0xa0,0x5d,0xa1,0xdc,0xb5,0x78,0x37,0x70,0x11,0x31,0x1c,0x46,0xaf,0x89,0x45,0xb0,0x23,0x28,0x03,0x7f,0x44,0x5c,0x60,0x5b},
+    {0x89,0x7c,0xc4,0x20,0x59,0x80,0x65,0xb9,0xcc,0x8f,0x3b,0x92,0x0c,0x10,0xf0,0xe7,0x77,0xef,0xe2,0x02,0x65,0x25,0x01,0x00,0xee,0xb3,0xae,0xa8,0xce,0x6d,0xa7,0x24,0x4c,0xf0,0xe7,0xf0,0xc6,0xfe,0xe9,0x3b,0x62,0x49,0xe3,0x75,0x9e,0x57,0x6a,0x86,0x1a,0xe6,0x1d,0x1e,0x16,0xef,0x42,0x55,0xd5,0xbd,0x5a,0xcc,0xf4,0xfe,0x12,0x2f,0x40,0xc7,0xc0,0xdf,0xb2,0x22,0x45,0x0a,0x07,0xa4,0xc9,0x40,0x7f,0x6e,0xd0,0x10,0x68,0xf6,0xcf,0x78,0x41,0x14,0xcf,0xc6,0x90,0x37,0xa4,0x18,0x25,0x7b,0x60,0x5e},
+    {0x18,0x18,0xdf,0x6c,0x8f,0x1d,0xb3,0x58,0xa2,0x58,0x62,0xc3,0x4f,0xa7,0xcf,0x35,0x6e,0x1d,0xe6,0x66,0x4f,0xff,0xb3,0xe1,0xf7,0xd5,0xcd,0x6c,0xab,0xac,0x67,0x50,0x14,0xcf,0x96,0xa5,0x1c,0x43,0x2c,0xa0,0x00,0xe4,0xd3,0xae,0x40,0x2d,0xc4,0xe3,0xdb,0x26,0x0f,0x2e,0x80,0x26,0x45,0xd2,0x68,0x70,0x45,0x9e,0x13,0x33,0x1f,0x20,0x51,0x9d,0x03,0x08,0x6b,0x7f,0x52,0xfd,0x06,0x00,0x7c,0x01,0x64,0x49,0xb1,0x18,0xa8,0xa4,0x25,0x2e,0xb0,0x0e,0x22,0xd5,0x75,0x03,0x46,0x62,0x88,0xba,0x7c,0x39},
+    {0xb2,0x59,0x59,0xf0,0x93,0x30,0xc1,0x30,0x76,0x79,0xa9,0xe9,0x8d,0xa1,0x3a,0xe2,0x26,0x5e,0x1d,0x72,0x91,0xd4,0x2f,0x22,0x3a,0x6c,0x6e,0x76,0x20,0xd3,0x39,0x23,0xe7,0x79,0x13,0xc8,0xfb,0xc3,0x15,0x78,0xf1,0x2a,0xe1,0xdd,0x20,0x94,0x61,0xa6,0xd5,0xfd,0xa8,0x85,0xf8,0xc0,0xa9,0xff,0x52,0xc2,0xe1,0xc1,0x22,0x40,0x1b,0x77,0xa7,0x2f,0x3a,0x51,0x86,0xd9,0x7d,0xd8,0x08,0xcf,0xd4,0xf9,0x71,0x9b,0xac,0xf5,0xb3,0x83,0xa2,0x1e,0x1b,0xc3,0x6b,0xd0,0x76,0x1a,0x97,0x19,0x92,0x18,0x1a,0x33},
+    {0xc6,0x80,0x4f,0xfb,0x45,0x6f,0x16,0xf5,0xcf,0x75,0xc7,0x61,0xde,0xc7,0x36,0x9c,0x1c,0xd9,0x41,0x90,0x1b,0xe8,0xd4,0xe3,0x21,0xfe,0xbd,0x83,0x6b,0x7c,0x16,0x31,0xaf,0x72,0x75,0x9d,0x3a,0x2f,0x51,0x26,0x9e,0x4a,0x07,0x68,0x88,0xe2,0xcb,0x5b,0xc4,0xf7,0x80,0x11,0xc1,0xc1,0xed,0x84,0x7b,0xa6,0x49,0xf6,0x9f,0x61,0xc9,0x1a,0x68,0x10,0x4b,0x52,0x42,0x38,0x2b,0xf2,0x87,0xe9,0x9c,0xee,0x3b,0x34,0x68,0x50,0xc8,0x50,0x62,0x4a,0x84,0x71,0x9d,0xfc,0x11,0xb1,0x08,0x1f,0x34,0x36,0x24,0x61},
+    {0x8d,0x89,0x4e,0x87,0xdb,0x41,0x9d,0xd9,0x20,0xdc,0x07,0x6c,0xf1,0xa5,0xfe,0x09,0xbc,0x9b,0x0f,0xd0,0x67,0x2c,0x3d,0x79,0x40,0xff,0x5e,0x9e,0x30,0xe2,0xeb,0x46,0x38,0x26,0x2d,0x1a,0xe3,0x49,0x63,0x8b,0x35,0xfd,0xd3,0x9b,0x00,0xb7,0xdf,0x9d,0xa4,0x6b,0xa0,0xa3,0xb8,0xf1,0x8b,0x7f,0x45,0x04,0xd9,0x78,0x31,0xaa,0x22,0x15,0x38,0x49,0x61,0x69,0x53,0x2f,0x38,0x2c,0x10,0x6d,0x2d,0xb7,0x9a,0x40,0xfe,0xda,0x27,0xf2,0x46,0xb6,0x91,0x33,0xc8,0xe8,0x6c,0x30,0x24,0x05,0xf5,0x70,0xfe,0x45},
+    {0x8c,0x0b,0x0c,0x96,0xa6,0x75,0x48,0xda,0x20,0x2f,0x0e,0xef,0x76,0xd0,0x68,0x5b,0xd4,0x8f,0x0b,0x3d,0xcf,0x51,0xfb,0x07,0xd4,0x92,0xe3,0xa0,0x23,0x16,0x8d,0x42,0x91,0x14,0x95,0xc8,0x20,0x49,0xf2,0x62,0xa2,0x0c,0x63,0x3f,0xc8,0x07,0xf0,0x05,0xb8,0xd4,0xc9,0xf5,0xd2,0x45,0xbb,0x6f,0x45,0x22,0x7a,0xb5,0x6d,0x9f,0x61,0x16,0xfd,0x08,0xa3,0x01,0x44,0x4a,0x4f,0x08,0xac,0xca,0xa5,0x76,0xc3,0x19,0x22,0xa8,0x7d,0xbc,0xd1,0x43,0x46,0xde,0xb8,0xde,0xc6,0x38,0xbd,0x60,0x2d,0x59,0x81,0x1d},
+    {0x5f,0xac,0x0d,0xa6,0x56,0x87,0x36,0x61,0x57,0xdc,0xab,0xeb,0x6a,0x2f,0xe0,0x17,0x7d,0x0f,0xce,0x4c,0x2d,0x3f,0x19,0x7f,0xf0,0xdc,0xec,0x89,0x77,0x4a,0x23,0x20,0xe8,0xc5,0x85,0x7b,0x9f,0xb6,0x65,0x87,0xb2,0xba,0x68,0xd1,0x8b,0x67,0xf0,0x6f,0x9b,0x0f,0x33,0x1d,0x7c,0xe7,0x70,0x3a,0x7c,0x8e,0xaf,0xb0,0x51,0x6d,0x5f,0x3a,0x52,0xb2,0x78,0x71,0xb6,0x0d,0xd2,0x76,0x60,0xd1,0x1e,0xd5,0xf9,0x34,0x1c,0x07,0x70,0x11,0xe4,0xb3,0x20,0x4a,0x2a,0xf6,0x66,0xe3,0xff,0x3c,0x35,0x82,0xd6,0x7c},
+    {0xb6,0xfa,0x87,0xd8,0x5b,0xa4,0xe1,0x0b,0x6e,0x3b,0x40,0xba,0x32,0x6a,0x84,0x2a,0x00,0x60,0x6e,0xe9,0x12,0x10,0x92,0xd9,0x43,0x09,0xdc,0x3b,0x86,0xc8,0x38,0x28,0xf3,0xf4,0xac,0x68,0x60,0xcd,0x65,0xa6,0xd3,0xe3,0xd7,0x3c,0x18,0x2d,0xd9,0x42,0xd9,0x25,0x60,0x33,0x9d,0x38,0x59,0x57,0xff,0xd8,0x2c,0x2b,0x3b,0x25,0xf0,0x3e,0x30,0x50,0x46,0x4a,0xcf,0xb0,0x6b,0xd1,0xab,0x77,0xc5,0x15,0x41,0x6b,0x49,0xfa,0x9d,0x41,0xab,0xf4,0x8a,0xae,0xcf,0x82,0x12,0x28,0xa8,0x06,0xa6,0xb8,0xdc,0x21},
+    {0xc8,0x9f,0x9d,0x8c,0x46,0x04,0x60,0x5c,0xcb,0xa3,0x2a,0xd4,0x6e,0x09,0x40,0x25,0x9c,0x2f,0xee,0x12,0x4c,0x4d,0x5b,0x12,0xab,0x1d,0xa3,0x94,0x81,0xd0,0xc3,0x0b,0xba,0x31,0x77,0xbe,0xfa,0x00,0x8d,0x9a,0x89,0x18,0x9e,0x62,0x7e,0x60,0x03,0x82,0x7f,0xd9,0xf3,0x43,0x37,0x02,0xcc,0xb2,0x8b,0x67,0x6f,0x6c,0xbf,0x0d,0x84,0x5d,0x8b,0xe1,0x9f,0x30,0x0d,0x38,0x6e,0x70,0xc7,0x65,0xe1,0xb9,0xa6,0x2d,0xb0,0x6e,0xab,0x20,0xae,0x7d,0x99,0xba,0xbb,0x57,0xdd,0x96,0xc1,0x2a,0x23,0x76,0x42,0x3a},
+    {0xfa,0x84,0x70,0x8a,0x2c,0x43,0x42,0x4b,0x45,0xe5,0xb9,0xdf,0xe3,0x19,0x8a,0x89,0x5d,0xe4,0x58,0x9c,0x21,0x00,0x9f,0xbe,0xd1,0xeb,0x6d,0xa1,0xce,0x77,0xf1,0x1f,0xcb,0x7e,0x44,0xdb,0x72,0xc1,0xf8,0x3b,0xbd,0x2d,0x28,0xc6,0x1f,0xc4,0xcf,0x5f,0xfe,0x15,0xaa,0x75,0xc0,0xff,0xac,0x80,0xf9,0xa9,0xe1,0x24,0xe8,0xc9,0x70,0x07,0xfd,0xb5,0xb5,0x45,0x9a,0xd9,0x61,0xcf,0x24,0x79,0x3a,0x1b,0xe9,0x84,0x09,0x86,0x89,0x3e,0x3e,0x30,0x19,0x09,0x30,0xe7,0x1e,0x0b,0x50,0x41,0xfd,0x64,0xf2,0x39},
+    {0x9c,0xe2,0xe7,0xdb,0x17,0x34,0xad,0xa7,0x9c,0x13,0x9c,0x2b,0x6a,0x37,0x94,0xbd,0xa9,0x7b,0x59,0x93,0x8e,0x1b,0xe9,0xa0,0x40,0x98,0x88,0x68,0x34,0xd7,0x12,0x17,0xe1,0x7b,0x09,0xfe,0xab,0x4a,0x9b,0xd1,0x29,0x19,0xe0,0xdf,0xe1,0xfc,0x6d,0xa4,0xff,0xf1,0xa6,0x2c,0x94,0x08,0xc9,0xc3,0x4e,0xf1,0x35,0x2c,0x27,0x21,0xc6,0x65,0xdd,0x93,0x31,0xce,0xf8,0x89,0x2b,0xe7,0xbb,0xc0,0x25,0xa1,0x56,0x33,0x10,0x4d,0x83,0xfe,0x1c,0x2e,0x3d,0xa9,0x19,0x04,0x72,0xe2,0x9c,0xb1,0x0a,0x80,0xf9,0x22},
+    {0xcb,0xf8,0x9e,0x3e,0x8a,0x36,0x5a,0x60,0x15,0x47,0x50,0xa5,0x22,0xc0,0xe9,0xe3,0x8f,0x24,0x24,0x5f,0xb0,0x48,0x3d,0x55,0xe5,0x26,0x76,0x64,0xcd,0x16,0xf4,0x13,0xac,0xfd,0x6e,0x9a,0xdd,0x9f,0x02,0x42,0x41,0x49,0xa5,0x34,0xbe,0xce,0x12,0xb9,0x7b,0xf3,0xbd,0x87,0xb9,0x64,0x0f,0x64,0xb4,0xca,0x98,0x85,0xd3,0xa4,0x71,0x41,0x8c,0x4c,0xc9,0x99,0xaa,0x58,0x27,0xfa,0x07,0xb8,0x00,0xb0,0x6f,0x6f,0x00,0x23,0x92,0x53,0xda,0xad,0xdd,0x91,0xd2,0xfb,0xab,0xd1,0x4b,0x57,0xfa,0x14,0x82,0x50},
+    {0x4b,0xfe,0xd6,0x3e,0x15,0x69,0x02,0xc2,0xc4,0x77,0x1d,0x51,0x39,0x67,0x5a,0xa6,0x94,0xaf,0x14,0x2c,0x46,0x26,0xde,0xcb,0x4b,0xa7,0xab,0x6f,0xec,0x60,0xf9,0x22,0xd6,0x03,0xd0,0x53,0xbb,0x15,0x1a,0x46,0x65,0xc9,0xf3,0xbc,0x88,0x28,0x10,0xb2,0x5a,0x3a,0x68,0x6c,0x75,0x76,0xc5,0x27,0x47,0xb4,0x6c,0xc8,0xa4,0x58,0x77,0x3a,0x76,0x50,0xae,0x93,0xf6,0x11,0x81,0x54,0xa6,0x54,0xfd,0x1d,0xdf,0x21,0xae,0x1d,0x65,0x5e,0x11,0xf3,0x90,0x8c,0x24,0x12,0x94,0xf4,0xe7,0x8d,0x5f,0xd1,0x9f,0x5d},
+    {0x7f,0x72,0x63,0x6d,0xd3,0x08,0x14,0x03,0x33,0xb5,0xc7,0xd7,0xef,0x9a,0x37,0x6a,0x4b,0xe2,0xae,0xcc,0xc5,0x8f,0xe1,0xa9,0xd3,0xbe,0x8f,0x4f,0x91,0x35,0x2f,0x33,0x1e,0x52,0xd7,0xee,0x2a,0x4d,0x24,0x3f,0x15,0x96,0x2e,0x43,0x28,0x90,0x3a,0x8e,0xd4,0x16,0x9c,0x2e,0x77,0xba,0x64,0xe1,0xd8,0x98,0xeb,0x47,0xfa,0x87,0xc1,0x3b,0x0c,0xc2,0x86,0xea,0x15,0x01,0x47,0x6d,0x25,0xd1,0x46,0x6c,0xcb,0xb7,0x8a,0x99,0x88,0x01,0x66,0x3a,0xb5,0x32,0x78,0xd7,0x03,0xba,0x6f,0x90,0xce,0x81,0x0d,0x45},
+    {0x75,0x52,0x20,0xa6,0xa1,0xb6,0x7b,0x6e,0x83,0x8e,0x3c,0x41,0xd7,0x21,0x4f,0xaa,0xb2,0x5c,0x8f,0xe8,0x55,0xd1,0x56,0x6f,0xe1,0x5b,0x34,0xa6,0x4b,0x5d,0xe2,0x2d,0x3f,0x74,0xae,0x1c,0x96,0xd8,0x74,0xd0,0xed,0x63,0x1c,0xee,0xf5,0x18,0x6d,0xf8,0x29,0xed,0xf4,0xe7,0x5b,0xc5,0xbd,0x97,0x08,0xb1,0x3a,0x66,0x79,0xd2,0xba,0x4c,0xcd,0x1f,0xd7,0xa0,0x24,0x90,0xd1,0x80,0xf8,0x8a,0x28,0xfb,0x0a,0xc2,0x25,0xc5,0x19,0x64,0x3a,0x5f,0x4b,0x97,0xa3,0xb1,0x33,0x72,0x00,0xe2,0xef,0xbc,0x7f,0x7d},
+    {0x01,0x28,0x6b,0x26,0x6a,0x1e,0xef,0xfa,0x16,0x9f,0x73,0xd5,0xc4,0x68,0x6c,0x86,0x2c,0x76,0x03,0x1b,0xbc,0x2f,0x8a,0xf6,0x8d,0x5a,0xb7,0x87,0x5e,0x43,0x75,0x59,0x94,0x90,0xc2,0xf3,0xc5,0x5d,0x7c,0xcd,0xab,0x05,0x91,0x2a,0x9a,0xa2,0x81,0xc7,0x58,0x30,0x1c,0x42,0x36,0x1d,0xc6,0x80,0xd7,0xd4,0xd8,0xdc,0x96,0xd1,0x9c,0x4f,0x68,0x37,0x7b,0x6a,0xd8,0x97,0x92,0x19,0x63,0x7a,0xd1,0x1a,0x24,0x58,0xd0,0xd0,0x17,0x0c,0x1c,0x5c,0xad,0x9c,0x02,0xba,0x07,0x03,0x7a,0x38,0x84,0xd0,0xcd,0x7c},
+    {0x17,0x04,0x26,0x6d,0x2c,0x42,0xa6,0xdc,0xbd,0x40,0x82,0x94,0x50,0x3d,0x15,0xae,0x77,0xc6,0x68,0xfb,0xb4,0xc1,0xc0,0xa9,0x53,0xcf,0xd0,0x61,0xed,0xd0,0x8b,0x42,0x93,0xcc,0x60,0x67,0x18,0x84,0x0c,0x9b,0x99,0x2a,0xb3,0x1a,0x7a,0x00,0xae,0xcd,0x18,0xda,0x0b,0x62,0x86,0xec,0x8d,0xa8,0x44,0xca,0x90,0x81,0x84,0xca,0x93,0x35,0xa7,0x9a,0x84,0x5e,0x9a,0x18,0x13,0x92,0xcd,0xfa,0xd8,0x65,0x35,0xc3,0xd8,0xd4,0xd1,0xbb,0xfd,0x53,0x5b,0x54,0x52,0x8c,0xe6,0x63,0x2d,0xda,0x08,0x83,0x39,0x27},
+    {0x13,0xd4,0x5e,0x43,0x28,0x8d,0xc3,0x42,0xc9,0xcc,0x78,0x32,0x60,0xf3,0x50,0xbd,0xef,0x03,0xda,0x79,0x1a,0xab,0x07,0xbb,0x55,0x33,0x8c,0xbe,0xae,0x97,0x95,0x26,0x53,0x24,0x70,0x0a,0x4c,0x0e,0xa1,0xb9,0xde,0x1b,0x7d,0xd5,0x66,0x58,0xa2,0x0f,0xf7,0xda,0x27,0xcd,0xb5,0xd9,0xb9,0xff,0xfd,0x33,0x2c,0x49,0x45,0x29,0x2c,0x57,0xbe,0x30,0xcd,0xd6,0x45,0xc7,0x7f,0xc7,0xfb,0xae,0xba,0xe3,0xd3,0xe8,0xdf,0xe4,0x0c,0xda,0x5d,0xaa,0x30,0x88,0x2c,0xa2,0x80,0xca,0x5b,0xc0,0x98,0x54,0x98,0x7f},
+    {0x17,0xe1,0x0b,0x9f,0x88,0xce,0x49,0x38,0x88,0xa2,0x54,0x7b,0x1b,0xad,0x05,0x80,0x1c,0x92,0xfc,0x23,0x9f,0xc3,0xa3,0x3d,0x04,0xf3,0x31,0x0a,0x47,0xec,0xc2,0x76,0x63,0x63,0xbf,0x0f,0x52,0x15,0x56,0xd3,0xa6,0xfb,0x4d,0xcf,0x45,0x5a,0x04,0x08,0xc2,0xa0,0x3f,0x87,0xbc,0x4f,0xc2,0xee,0xe7,0x12,0x9b,0xd6,0x3c,0x65,0xf2,0x30,0x85,0x0c,0xc1,0xaa,0x38,0xc9,0x08,0x8a,0xcb,0x6b,0x27,0xdb,0x60,0x9b,0x17,0x46,0x70,0xac,0x6f,0x0e,0x1e,0xc0,0x20,0xa9,0xda,0x73,0x64,0x59,0xf1,0x73,0x12,0x2f},
+    {0x11,0x1e,0xe0,0x8a,0x7c,0xfc,0x39,0x47,0x9f,0xab,0x6a,0x4a,0x90,0x74,0x52,0xfd,0x2e,0x8f,0x72,0x87,0x82,0x8a,0xd9,0x41,0xf2,0x69,0x5b,0xd8,0x2a,0x57,0x9e,0x5d,0xc0,0x0b,0xa7,0x55,0xd7,0x8b,0x48,0x30,0xe7,0x42,0xd4,0xf1,0xa4,0xb5,0xd6,0x06,0x62,0x61,0x59,0xbc,0x9e,0xa6,0xd1,0xea,0x84,0xf7,0xc5,0xed,0x97,0x19,0xac,0x38,0x3b,0xb1,0x51,0xa7,0x17,0xb5,0x66,0x06,0x8c,0x85,0x9b,0x7e,0x86,0x06,0x7d,0x74,0x49,0xde,0x4d,0x45,0x11,0xc0,0xac,0xac,0x9c,0xe6,0xe9,0xbf,0x9c,0xcd,0xdf,0x22},
+    {0xd9,0x0c,0x0d,0xc3,0xe0,0xd2,0xdb,0x8d,0x33,0x43,0xbb,0xac,0x5f,0x66,0x8e,0xad,0x1f,0x96,0x2a,0x32,0x8c,0x25,0x6b,0x8f,0xc7,0xc1,0x48,0x54,0xc0,0x16,0x29,0x6b,0xa1,0xe0,0x3b,0x10,0xb4,0x59,0xec,0x56,0x69,0xf9,0x59,0xd2,0xec,0xba,0xe3,0x2e,0x32,0xcd,0xf5,0x13,0x94,0xb2,0x7c,0x79,0x72,0xe4,0xcd,0x24,0x78,0x87,0xe9,0x0f,0x3b,0x91,0xba,0x0a,0xd1,0x34,0xdb,0x7e,0x0e,0xac,0x6d,0x2e,0x82,0xcd,0xa3,0x4e,0x15,0xf8,0x78,0x65,0xff,0x3d,0x08,0x66,0x17,0x0a,0xf0,0x7f,0x30,0x3f,0x30,0x4c},
+    {0x85,0x8c,0xb2,0x17,0xd6,0x3b,0x0a,0xd3,0xea,0x3b,0x77,0x39,0xb7,0x77,0xd3,0xc5,0xbf,0x5c,0x6a,0x1e,0x8c,0xe7,0xc6,0xc6,0xc4,0xb7,0x2a,0x8b,0xf7,0xb8,0x61,0x0d,0x00,0x45,0xd9,0x0d,0x58,0x03,0xfc,0x29,0x93,0xec,0xbb,0x6f,0xa4,0x7a,0xd2,0xec,0xf8,0xa7,0xe2,0xc2,0x5f,0x15,0x0a,0x13,0xd5,0xa1,0x06,0xb7,0x1a,0x15,0x6b,0x41,0xb0,0x36,0xc1,0xe9,0xef,0xd7,0xa8,0x56,0x20,0x4b,0xe4,0x58,0xcd,0xe5,0x07,0xbd,0xab,0xe0,0x57,0x1b,0xda,0x2f,0xe6,0xaf,0xd2,0xe8,0x77,0x42,0xf7,0x2a,0x1a,0x19},
+    {0x31,0x14,0x3c,0xc5,0x4b,0xf7,0x16,0xce,0xde,0xed,0x72,0x20,0xce,0x25,0x97,0x2b,0xe7,0x3e,0xb2,0xb5,0x6f,0xc3,0xb9,0xb8,0x08,0xc9,0x5c,0x0b,0x45,0x0e,0x2e,0x7e,0xfb,0x0e,0x46,0x4f,0x43,0x2b,0xe6,0x9f,0xd6,0x07,0x36,0xa6,0xd4,0x03,0xd3,0xde,0x24,0xda,0xa0,0xb7,0x0e,0x21,0x52,0xf0,0x93,0x5b,0x54,0x00,0xbe,0x7d,0x7e,0x23,0x30,0xb4,0x01,0x67,0xed,0x75,0x35,0x01,0x10,0xfd,0x0b,0x9f,0xe6,0x94,0x10,0x23,0x22,0x7f,0xe4,0x83,0x15,0x0f,0x32,0x75,0xe3,0x55,0x11,0xb1,0x99,0xa6,0xaf,0x71},
+    {0x1d,0xb6,0x53,0x39,0x9b,0x6f,0xce,0x65,0xe6,0x41,0xa1,0xaf,0xea,0x39,0x58,0xc6,0xfe,0x59,0xf7,0xa9,0xfd,0x5f,0x43,0x0f,0x8e,0xc2,0xb1,0xc2,0xe9,0x42,0x11,0x02,0xd6,0x50,0x3b,0x47,0x1c,0x3c,0x42,0xea,0x10,0xef,0x38,0x3b,0x1f,0x7a,0xe8,0x51,0x95,0xbe,0xc9,0xb2,0x5f,0xbf,0x84,0x9b,0x1c,0x9a,0xf8,0x78,0xbc,0x1f,0x73,0x00,0x80,0x18,0xf8,0x48,0x18,0xc7,0x30,0xe4,0x19,0xc1,0xce,0x5e,0x22,0x0c,0x96,0xbf,0xe3,0x15,0xba,0x6b,0x83,0xe0,0xda,0xb6,0x08,0x58,0xe1,0x47,0x33,0x6f,0x4d,0x4c},
+    {0xc9,0x1f,0x7d,0xc1,0xcf,0xec,0xf7,0x18,0x14,0x3c,0x40,0x51,0xa6,0xf5,0x75,0x6c,0xdf,0x0c,0xee,0xf7,0x2b,0x71,0xde,0xdb,0x22,0x7a,0xe4,0xa7,0xaa,0xdd,0x3f,0x19,0x70,0x19,0x8f,0x98,0xfc,0xdd,0x0c,0x2f,0x1b,0xf5,0xb9,0xb0,0x27,0x62,0x91,0x6b,0xbe,0x76,0x91,0x77,0xc4,0xb6,0xc7,0x6e,0xa8,0x9f,0x8f,0xa8,0x00,0x95,0xbf,0x38,0x6f,0x87,0xe8,0x37,0x3c,0xc9,0xd2,0x1f,0x2c,0x46,0xd1,0x18,0x5a,0x1e,0xf6,0xa2,0x76,0x12,0x24,0x39,0x82,0xf5,0x80,0x50,0x69,0x49,0x0d,0xbf,0x9e,0xb9,0x6f,0x6a},
+    {0xeb,0x55,0x08,0x56,0xbb,0xc1,0x46,0x6a,0x9d,0xf0,0x93,0xf8,0x38,0xbb,0x16,0x24,0xc1,0xac,0x71,0x8f,0x37,0x11,0x1d,0xd7,0xea,0x96,0x18,0xa3,0x14,0x69,0xf7,0x75,0xc6,0x23,0xe4,0xb6,0xb5,0x22,0xb1,0xee,0x8e,0xff,0x86,0xf2,0x10,0x70,0x9d,0x93,0x8c,0x5d,0xcf,0x1d,0x83,0x2a,0xa9,0x90,0x10,0xeb,0xc5,0x42,0x9f,0xda,0x6f,0x13,0xd1,0xbd,0x05,0xa3,0xb1,0xdf,0x4c,0xf9,0x08,0x2c,0xf8,0x9f,0x9d,0x4b,0x36,0x0f,0x8a,0x58,0xbb,0xc3,0xa5,0xd8,0x87,0x2a,0xba,0xdc,0xe8,0x0b,0x51,0x83,0x21,0x02},
+    {0x14,0x2d,0xad,0x5e,0x38,0x66,0xf7,0x4a,0x30,0x58,0x7c,0xca,0x80,0xd8,0x8e,0xa0,0x3d,0x1e,0x21,0x10,0xe6,0xa6,0x13,0x0d,0x03,0x6c,0x80,0x7b,0xe1,0x1c,0x07,0x6a,0x7f,0x7a,0x30,0x43,0x01,0x71,0x5a,0x9d,0x5f,0xa4,0x7d,0xc4,0x9e,0xde,0x63,0xb0,0xd3,0x7a,0x92,0xbe,0x52,0xfe,0xbb,0x22,0x6c,0x42,0x40,0xfd,0x41,0xc4,0x87,0x13,0xf8,0x8a,0x97,0x87,0xd1,0xc3,0xd3,0xb5,0x13,0x44,0x0e,0x7f,0x3d,0x5a,0x2b,0x72,0xa0,0x7c,0x47,0xbb,0x48,0x48,0x7b,0x0d,0x92,0xdc,0x1e,0xaf,0x6a,0xb2,0x71,0x31},
+    {0xa8,0x4c,0x56,0x97,0x90,0x31,0x2f,0xa9,0x19,0xe1,0x75,0x22,0x4c,0xb8,0x7b,0xff,0x50,0x51,0x87,0xa4,0x37,0xfe,0x55,0x4f,0x5a,0x83,0xf0,0x3c,0x87,0xd4,0x1f,0x22,0xd1,0x47,0x8a,0xb2,0xd8,0xb7,0x0d,0xa6,0xf1,0xa4,0x70,0x17,0xd6,0x14,0xbf,0xa6,0x58,0xbd,0xdd,0x53,0x93,0xf8,0xa1,0xd4,0xe9,0x43,0x42,0x34,0x63,0x4a,0x51,0x6c,0x41,0x63,0x15,0x3a,0x4f,0x20,0x22,0x23,0x2d,0x03,0x0a,0xba,0xe9,0xe0,0x73,0xfb,0x0e,0x03,0x0f,0x41,0x4c,0xdd,0xe0,0xfc,0xaa,0x4a,0x92,0xfb,0x96,0xa5,0xda,0x48},
+    {0xc7,0x9c,0xa5,0x5c,0x66,0x8e,0xca,0x6e,0xa0,0xac,0x38,0x2e,0x4b,0x25,0x47,0xa8,0xce,0x17,0x1e,0xd2,0x08,0xc7,0xaf,0x31,0xf7,0x4a,0xd8,0xca,0xfc,0xd6,0x6d,0x67,0x93,0x97,0x4c,0xc8,0x5d,0x1d,0xf6,0x14,0x06,0x82,0x41,0xef,0xe3,0xf9,0x41,0x99,0xac,0x77,0x62,0x34,0x8f,0xb8,0xf5,0xcd,0xa9,0x79,0x8a,0x0e,0xfa,0x37,0xc8,0x58,0x58,0x90,0xfc,0x96,0x85,0x68,0xf9,0x0c,0x1b,0xa0,0x56,0x7b,0xf3,0xbb,0xdc,0x1d,0x6a,0xd6,0x35,0x49,0x7d,0xe7,0xc2,0xdc,0x0a,0x7f,0xa5,0xc6,0xf2,0x73,0x4f,0x1c},
+    {0xbb,0xa0,0x5f,0x30,0xbd,0x4f,0x7a,0x0e,0xad,0x63,0xc6,0x54,0xe0,0x4c,0x9d,0x82,0x48,0x38,0xe3,0x2f,0x83,0xc3,0x21,0xf4,0x42,0x4c,0xf6,0x1b,0x0d,0xc8,0x5a,0x79,0x84,0x34,0x7c,0xfc,0x6e,0x70,0x6e,0xb3,0x61,0xcf,0xc1,0xc3,0xb4,0xc9,0xdf,0x73,0xe5,0xc7,0x1c,0x78,0xc9,0x79,0x1d,0xeb,0x5c,0x67,0xaf,0x7d,0xdb,0x9a,0x45,0x70,0xb3,0x2b,0xb4,0x91,0x49,0xdb,0x91,0x1b,0xca,0xdc,0x02,0x4b,0x23,0x96,0x26,0x57,0xdc,0x78,0x8c,0x1f,0xe5,0x9e,0xdf,0x9f,0xd3,0x1f,0xe2,0x8c,0x84,0x62,0xe1,0x5f},
+    {0x1a,0x96,0x94,0xe1,0x4f,0x21,0x59,0x4e,0x4f,0xcd,0x71,0x0d,0xc7,0x7d,0xbe,0x49,0x2d,0xf2,0x50,0x3b,0xd2,0xcf,0x00,0x93,0x32,0x72,0x91,0xfc,0x46,0xd4,0x89,0x47,0x08,0xb2,0x7c,0x5d,0x2d,0x85,0x79,0x28,0xe7,0xf2,0x7d,0x68,0x70,0xdd,0xde,0xb8,0x91,0x78,0x68,0x21,0xab,0xff,0x0b,0xdc,0x35,0xaa,0x7d,0x67,0x43,0xc0,0x44,0x2b,0x8e,0xb7,0x4e,0x07,0xab,0x87,0x1c,0x1a,0x67,0xf4,0xda,0x99,0x8e,0xd1,0xc6,0xfa,0x67,0x90,0x4f,0x48,0xcd,0xbb,0xac,0x3e,0xe4,0xa4,0xb9,0x2b,0xef,0x2e,0xc5,0x60},
+    {0xf1,0x8b,0xfd,0x3b,0xbc,0x89,0x5d,0x0b,0x1a,0x55,0xf3,0xc9,0x37,0x92,0x6b,0xb0,0xf5,0x28,0x30,0xd5,0xb0,0x16,0x4c,0x0e,0xab,0xca,0xcf,0x2c,0x31,0x9c,0xbc,0x10,0x11,0x6d,0xae,0x7c,0xc2,0xc5,0x2b,0x70,0xab,0x8c,0xa4,0x54,0x9b,0x69,0xc7,0x44,0xb2,0x2e,0x49,0xba,0x56,0x40,0xbc,0xef,0x6d,0x67,0xb6,0xd9,0x48,0x72,0xd7,0x70,0x5b,0xa0,0xc2,0x3e,0x4b,0xe8,0x8a,0xaa,0xe0,0x81,0x17,0xed,0xf4,0x9e,0x69,0x98,0xd1,0x85,0x8e,0x70,0xe4,0x13,0x45,0x79,0x13,0xf4,0x76,0xa9,0xd3,0x5b,0x75,0x63},
+    {0x53,0x08,0xd1,0x2a,0x3e,0xa0,0x5f,0xb5,0x69,0x35,0xe6,0x9e,0x90,0x75,0x6f,0x35,0x90,0xb8,0x69,0xbe,0xfd,0xf1,0xf9,0x9f,0x84,0x6f,0xc1,0x8b,0xc4,0xc1,0x8c,0x0d,0xb7,0xac,0xf1,0x97,0x18,0x10,0xc7,0x3d,0xd8,0xbb,0x65,0xc1,0x5e,0x7d,0xda,0x5d,0x0f,0x02,0xa1,0x0f,0x9c,0x5b,0x8e,0x50,0x56,0x2a,0xc5,0x37,0x17,0x75,0x63,0x27,0xa9,0x19,0xb4,0x6e,0xd3,0x02,0x94,0x02,0xa5,0x60,0xb4,0x77,0x7e,0x4e,0xb4,0xf0,0x56,0x49,0x3c,0xd4,0x30,0x62,0xa8,0xcf,0xe7,0x66,0xd1,0x7a,0x8a,0xdd,0xc2,0x70},
+    {0x0e,0xec,0x6f,0x9f,0x50,0x94,0x61,0x65,0x8d,0x51,0xc6,0x46,0xa9,0x7e,0x2e,0xee,0x5c,0x9b,0xe0,0x67,0xf3,0xc1,0x33,0x97,0x95,0x84,0x94,0x63,0x63,0xac,0x0f,0x2e,0x13,0x7e,0xed,0xb8,0x7d,0x96,0xd4,0x91,0x7a,0x81,0x76,0xd7,0x0a,0x2f,0x25,0x74,0x64,0x25,0x85,0x0d,0xe0,0x82,0x09,0xe4,0xe5,0x3c,0xa5,0x16,0x38,0x61,0xb8,0x32,0x64,0xcd,0x48,0xe4,0xbe,0xf7,0xe7,0x79,0xd0,0x86,0x78,0x08,0x67,0x3a,0xc8,0x6a,0x2e,0xdb,0xe4,0xa0,0xd9,0xd4,0x9f,0xf8,0x41,0x4f,0x5a,0x73,0x5c,0x21,0x79,0x41},
+    {0x2a,0xed,0xdc,0xd7,0xe7,0x94,0x70,0x8c,0x70,0x9c,0xd3,0x47,0xc3,0x8a,0xfb,0x97,0x02,0xd9,0x06,0xa9,0x33,0xe0,0x3b,0xe1,0x76,0x9d,0xd9,0x0c,0xa3,0x44,0x03,0x70,0x34,0xcd,0x6b,0x28,0xb9,0x33,0xae,0xe4,0xdc,0xd6,0x9d,0x55,0xb6,0x7e,0xef,0xb7,0x1f,0x8e,0xd3,0xb3,0x1f,0x14,0x8b,0x27,0x86,0xc2,0x41,0x22,0x66,0x85,0xfa,0x31,0xf4,0x22,0x36,0x2e,0x42,0x6c,0x82,0xaf,0x2d,0x50,0x33,0x98,0x87,0x29,0x20,0xc1,0x23,0x91,0x38,0x2b,0xe1,0xb7,0xc1,0x9b,0x89,0x24,0x95,0xa9,0x12,0x23,0xbb,0x24},
+    {0xc3,0x67,0xde,0x32,0x17,0xed,0xa8,0xb1,0x48,0x49,0x1b,0x46,0x18,0x94,0xb4,0x3c,0xd2,0xbc,0xcf,0x76,0x43,0x43,0xbd,0x8e,0x08,0x80,0x18,0x1e,0x87,0x3e,0xee,0x0f,0x6b,0x5c,0xf8,0xf5,0x2a,0x0c,0xf8,0x41,0x94,0x67,0xfa,0x04,0xc3,0x84,0x72,0x68,0xad,0x1b,0xba,0xa3,0x99,0xdf,0x45,0x89,0x16,0x5d,0xeb,0xff,0xf9,0x2a,0x1d,0x0d,0xdf,0x1e,0x62,0x32,0xa1,0x8a,0xda,0xa9,0x79,0x65,0x22,0x59,0xa1,0x22,0xb8,0x30,0x93,0xc1,0x9a,0xa7,0x7b,0x19,0x04,0x40,0x76,0x1d,0x53,0x18,0x97,0xd7,0xac,0x16},
+    {0x3d,0x1d,0x9b,0x2d,0xaf,0x72,0xdf,0x72,0x5a,0x24,0x32,0xa4,0x36,0x2a,0x46,0x63,0x37,0x96,0xb3,0x16,0x79,0xa0,0xce,0x3e,0x09,0x23,0x30,0xb9,0xf6,0x0e,0x3e,0x12,0xad,0xb6,0x87,0x78,0xc5,0xc6,0x59,0xc9,0xba,0xfe,0x90,0x5f,0xad,0x9e,0xe1,0x94,0x04,0xf5,0x42,0xa3,0x62,0x4e,0xe2,0x16,0x00,0x17,0x16,0x18,0x4b,0xd3,0x4e,0x16,0x9a,0xe6,0x2f,0x19,0x4c,0xd9,0x7e,0x48,0x13,0x15,0x91,0x3a,0xea,0x2c,0xae,0x61,0x27,0xde,0xa4,0xb9,0xd3,0xf6,0x7b,0x87,0xeb,0xf3,0x73,0x10,0xc6,0x0f,0xda,0x78},
+    {0x6a,0xc6,0x2b,0xe5,0x28,0x5d,0xf1,0x5b,0x8e,0x1a,0xf0,0x70,0x18,0xe3,0x47,0x2c,0xdd,0x8b,0xc2,0x06,0xbc,0xaf,0x19,0x24,0x3a,0x17,0x6b,0x25,0xeb,0xde,0x25,0x2d,0x94,0x3a,0x0c,0x68,0xf1,0x80,0x9f,0xa2,0xe6,0xe7,0xe9,0x1a,0x15,0x7e,0xf7,0x71,0x73,0x79,0x01,0x48,0x58,0xf1,0x00,0x11,0xdd,0x8d,0xb3,0x16,0xb3,0xa4,0x4a,0x05,0xb8,0x7c,0x26,0x19,0x8d,0x46,0xc8,0xdf,0xaf,0x4d,0xe5,0x66,0x9c,0x78,0x28,0x0b,0x17,0xec,0x6e,0x66,0x2a,0x1d,0xeb,0x2a,0x60,0xa7,0x7d,0xab,0xa6,0x10,0x46,0x13},
+    {0xfe,0xb0,0xf6,0x8d,0xc7,0x8e,0x13,0x51,0x1b,0xf5,0x75,0xe5,0x89,0xda,0x97,0x53,0xb9,0xf1,0x7a,0x71,0x1d,0x7a,0x20,0x09,0x50,0xd6,0x20,0x2b,0xba,0xfd,0x02,0x21,0x15,0xf5,0xd1,0x77,0xe7,0x65,0x2a,0xcd,0xf1,0x60,0xaa,0x8f,0x87,0x91,0x89,0x54,0xe5,0x06,0xbc,0xda,0xbc,0x3b,0xb7,0xb1,0xfb,0xc9,0x7c,0xa9,0xcb,0x78,0x48,0x65,0xa1,0xe6,0x5c,0x05,0x05,0xe4,0x9e,0x96,0x29,0xad,0x51,0x12,0x68,0xa7,0xbc,0x36,0x15,0xa4,0x7d,0xaa,0x17,0xf5,0x1a,0x3a,0xba,0xb2,0xec,0x29,0xdb,0x25,0xd7,0x0a},
+    {0x57,0x24,0x4e,0x83,0xb1,0x67,0x42,0xdc,0xc5,0x1b,0xce,0x70,0xb5,0x44,0x75,0xb6,0xd7,0x5e,0xd1,0xf7,0x0b,0x7a,0xf0,0x1a,0x50,0x36,0xa0,0x71,0xfb,0xcf,0xef,0x4a,0x85,0x6f,0x05,0x9b,0x0c,0xbc,0xc7,0xfe,0xd7,0xff,0xf5,0xe7,0x68,0x52,0x7d,0x53,0xfa,0xae,0x12,0x43,0x62,0xc6,0xaf,0x77,0xd9,0x9f,0x39,0x02,0x53,0x5f,0x67,0x4f,0x1e,0x17,0x15,0x04,0x36,0x36,0x2d,0xc3,0x3b,0x48,0x98,0x89,0x11,0xef,0x2b,0xcd,0x10,0x51,0x94,0xd0,0xad,0x6e,0x0a,0x87,0x61,0x65,0xa8,0xa2,0x72,0xbb,0xcc,0x0b},
+    {0xc8,0xa9,0xb1,0xea,0x2f,0x96,0x5e,0x18,0xcd,0x7d,0x14,0x65,0x35,0xe6,0xe7,0x86,0xf2,0x6d,0x5b,0xbb,0x31,0xe0,0x92,0xb0,0x3e,0xb7,0xd6,0x59,0xab,0xf0,0x24,0x40,0x96,0x12,0xfe,0x50,0x4c,0x5e,0x6d,0x18,0x7e,0x9f,0xe8,0xfe,0x82,0x7b,0x39,0xe0,0xb0,0x31,0x70,0x50,0xc5,0xf6,0xc7,0x3b,0xc2,0x37,0x8f,0x10,0x69,0xfd,0x78,0x66,0xc2,0x63,0x68,0x63,0x31,0xfa,0x86,0x15,0xf2,0x33,0x2d,0x57,0x48,0x8c,0xf6,0x07,0xfc,0xae,0x9e,0x78,0x9f,0xcc,0x73,0x4f,0x01,0x47,0xad,0x8e,0x10,0xe2,0x42,0x2d},
+    {0x9b,0xd2,0xdf,0x94,0x15,0x13,0xf5,0x97,0x6a,0x4c,0x3f,0x31,0x5d,0x98,0x55,0x61,0x10,0x50,0x45,0x08,0x07,0x3f,0xa1,0xeb,0x22,0xd3,0xd2,0xb8,0x08,0x26,0x6b,0x67,0x93,0x75,0x53,0x0f,0x0d,0x7b,0x71,0x21,0x4c,0x06,0x1e,0x13,0x0b,0x69,0x4e,0x91,0x9f,0xe0,0x2a,0x75,0xae,0x87,0xb6,0x1b,0x6e,0x3c,0x42,0x9b,0xa7,0xf3,0x0b,0x42,0x47,0x2b,0x5b,0x1c,0x65,0xba,0x38,0x81,0x80,0x1b,0x1b,0x31,0xec,0xb6,0x71,0x86,0xb0,0x35,0x31,0xbc,0xb1,0x0c,0xff,0x7b,0xe0,0xf1,0x0c,0x9c,0xfa,0x2f,0x5d,0x74},
+    {0xbd,0xc8,0xc9,0x2b,0x1e,0x5a,0x52,0xbf,0x81,0x9d,0x47,0x26,0x08,0x26,0x5b,0xea,0xdb,0x55,0x01,0xdf,0x0e,0xc7,0x11,0xd5,0xd0,0xf5,0x0c,0x96,0xeb,0x3c,0xe2,0x1a,0x6a,0x4e,0xd3,0x21,0x57,0xdf,0x36,0x60,0xd0,0xb3,0x7b,0x99,0x27,0x88,0xdb,0xb1,0xfa,0x6a,0x75,0xc8,0xc3,0x09,0xc2,0xd3,0x39,0xc8,0x1d,0x4c,0xe5,0x5b,0xe1,0x06,0x4a,0x99,0x32,0x19,0x87,0x5d,0x72,0x5b,0xb0,0xda,0xb1,0xce,0xb5,0x1c,0x35,0x32,0x05,0xca,0xb7,0xda,0x49,0x15,0xc4,0x7d,0xf7,0xc1,0x8e,0x27,0x61,0xd8,0xde,0x58},
+    {0x5c,0xc5,0x66,0xf2,0x93,0x37,0x17,0xd8,0x49,0x4e,0x45,0xcc,0xc5,0x76,0xc9,0xc8,0xa8,0xc3,0x26,0xbc,0xf8,0x82,0xe3,0x5c,0xf9,0xf6,0x85,0x54,0xe8,0x9d,0xf3,0x2f,0xa8,0xc9,0xc2,0xb6,0xa8,0x5b,0xfb,0x2d,0x8c,0x59,0x2c,0xf5,0x8e,0xef,0xee,0x48,0x73,0x15,0x2d,0xf1,0x07,0x91,0x80,0x33,0xd8,0x5b,0x1d,0x53,0x6b,0x69,0xba,0x08,0x7a,0xc5,0xef,0xc3,0xee,0x3e,0xed,0x77,0x11,0x48,0xff,0xd4,0x17,0x55,0xe0,0x04,0xcb,0x71,0xa6,0xf1,0x3f,0x7a,0x3d,0xea,0x54,0xfe,0x7c,0x94,0xb4,0x33,0x06,0x12},
+    {0x42,0x00,0x61,0x91,0x78,0x98,0x94,0x0b,0xe8,0xfa,0xeb,0xec,0x3c,0xb1,0xe7,0x4e,0xc0,0xa4,0xf0,0x94,0x95,0x73,0xbe,0x70,0x85,0x91,0xd5,0xb4,0x99,0x0a,0xd3,0x35,0x0a,0x10,0x12,0x49,0x47,0x31,0xbd,0x82,0x06,0xbe,0x6f,0x7e,0x6d,0x7b,0x23,0xde,0xc6,0x79,0xea,0x11,0x19,0x76,0x1e,0xe1,0xde,0x3b,0x39,0xcb,0xe3,0x3b,0x43,0x07,0xf4,0x97,0xe9,0x5c,0xc0,0x44,0x79,0xff,0xa3,0x51,0x5c,0xb0,0xe4,0x3d,0x5d,0x57,0x7c,0x84,0x76,0x5a,0xfd,0x81,0x33,0x58,0x9f,0xda,0xf6,0x7a,0xde,0x3e,0x87,0x2d},
+    {0x09,0x34,0x37,0x43,0x64,0x31,0x7a,0x15,0xd9,0x81,0xaa,0xf4,0xee,0xb7,0xb8,0xfa,0x06,0x48,0xa6,0xf5,0xe6,0xfe,0x93,0xb0,0xb6,0xa7,0x7f,0x70,0x54,0x36,0x77,0x2e,0x81,0xf9,0x5d,0x4e,0xe1,0x02,0x62,0xaa,0xf5,0xe1,0x15,0x50,0x17,0x59,0x0d,0xa2,0x6c,0x1d,0xe2,0xba,0xd3,0x75,0xa2,0x18,0x53,0x02,0x60,0x01,0x8a,0x61,0x43,0x05,0xc1,0x23,0x4c,0x97,0xf4,0xbd,0xea,0x0d,0x93,0x46,0xce,0x9d,0x25,0x0a,0x6f,0xaa,0x2c,0xba,0x9a,0xa2,0xb8,0x2c,0x20,0x04,0x0d,0x96,0x07,0x2d,0x36,0x43,0x14,0x4b},
+    {0x7a,0x1f,0x6e,0xb6,0xc7,0xb7,0xc4,0xcc,0x7e,0x2f,0x0c,0xf5,0x25,0x7e,0x15,0x44,0x1c,0xaf,0x3e,0x71,0xfc,0x6d,0xf0,0x3e,0xf7,0x63,0xda,0x52,0x67,0x44,0x2f,0x58,0xcb,0x9c,0x52,0x1c,0xe9,0x54,0x7c,0x96,0xfb,0x35,0xc6,0x64,0x92,0x26,0xf6,0x30,0x65,0x19,0x12,0x78,0xf4,0xaf,0x47,0x27,0x5c,0x6f,0xf6,0xea,0x18,0x84,0x03,0x17,0xe4,0x4c,0x32,0x20,0xd3,0x7b,0x31,0xc6,0xc4,0x8b,0x48,0xa4,0xe8,0x42,0x10,0xa8,0x64,0x13,0x5a,0x4e,0x8b,0xf1,0x1e,0xb2,0xc9,0x8d,0xa2,0xcd,0x4b,0x1c,0x2a,0x0c},
+    {0x47,0x04,0x1f,0x6f,0xd0,0xc7,0x4d,0xd2,0x59,0xc0,0x87,0xdb,0x3e,0x9e,0x26,0xb2,0x8f,0xd2,0xb2,0xfb,0x72,0x02,0x5b,0xd1,0x77,0x48,0xf6,0xc6,0xd1,0x8b,0x55,0x7c,0x45,0x69,0xbd,0x69,0x48,0x81,0xc4,0xed,0x22,0x8d,0x1c,0xbe,0x7d,0x90,0x6d,0x0d,0xab,0xc5,0x5c,0xd5,0x12,0xd2,0x3b,0xc6,0x83,0xdc,0x14,0xa3,0x30,0x9b,0x6a,0x5a,0x3d,0x46,0x96,0xd3,0x24,0x15,0xec,0xd0,0xf0,0x24,0x5a,0xc3,0x8a,0x62,0xbb,0x12,0xa4,0x5f,0xbc,0x1c,0x79,0x3a,0x0c,0xa5,0xc3,0xaf,0xfb,0x0a,0xca,0xa5,0x04,0x04},
+    {0xd6,0x43,0xa7,0x0a,0x07,0x40,0x1f,0x8c,0xe8,0x5e,0x26,0x5b,0xcb,0xd0,0xba,0xcc,0xde,0xd2,0x8f,0x66,0x6b,0x04,0x4b,0x57,0x33,0x96,0xdd,0xca,0xfd,0x5b,0x39,0x46,0xd1,0x6f,0x41,0x2a,0x1b,0x9e,0xbc,0x62,0x8b,0x59,0x50,0xe3,0x28,0xf7,0xc6,0xb5,0x67,0x69,0x5d,0x3d,0xd8,0x3f,0x34,0x04,0x98,0xee,0xf8,0xe7,0x16,0x75,0x52,0x39,0x9c,0x9a,0x5d,0x1a,0x2d,0xdb,0x7f,0x11,0x2a,0x5c,0x00,0xd1,0xbc,0x45,0x77,0x9c,0xea,0x6f,0xd5,0x54,0xf1,0xbe,0xd4,0xef,0x16,0xd0,0x22,0xe8,0x29,0x9a,0x57,0x76},
+    {0x17,0x2a,0xc0,0x49,0x7e,0x8e,0xb6,0x45,0x7f,0xa3,0xa9,0xbc,0xa2,0x51,0xcd,0x23,0x1b,0x4c,0x22,0xec,0x11,0x5f,0xd6,0x3e,0xb1,0xbd,0x05,0x9e,0xdc,0x84,0xa3,0x43,0xf2,0x34,0xb4,0x52,0x13,0xb5,0x3c,0x33,0xe1,0x80,0xde,0x93,0x49,0x28,0x32,0xd8,0xce,0x35,0x0d,0x75,0x87,0x28,0x51,0xb5,0xc1,0x77,0x27,0x2a,0xbb,0x14,0xc5,0x02,0x45,0xb6,0xf1,0x8b,0xda,0xd5,0x4b,0x68,0x53,0x4b,0xb5,0xf6,0x7e,0xd3,0x8b,0xfb,0x53,0xd2,0xb0,0xa9,0xd7,0x16,0x39,0x31,0x59,0x80,0x54,0x61,0x09,0x92,0x60,0x11},
+    {0xaa,0xcf,0xda,0x29,0x69,0x16,0x4d,0xb4,0x8f,0x59,0x13,0x84,0x4c,0x9f,0x52,0xda,0x59,0x55,0x3d,0x45,0xca,0x63,0xef,0xe9,0x0b,0x8e,0x69,0xc5,0x5b,0x12,0x1e,0x35,0xcd,0x4d,0x9b,0x36,0x16,0x56,0x38,0x7a,0x63,0x35,0x5c,0x65,0xa7,0x2c,0xc0,0x75,0x21,0x80,0xf1,0xd4,0xf9,0x1b,0xc2,0x7d,0x42,0xe0,0xe6,0x91,0x74,0x7d,0x63,0x2f,0xbe,0x7b,0xf6,0x1a,0x46,0x9b,0xb4,0xd4,0x61,0x89,0xab,0xc8,0x7a,0x03,0x03,0xd6,0xfb,0x99,0xa6,0xf9,0x9f,0xe1,0xde,0x71,0x9a,0x2a,0xce,0xe7,0x06,0x2d,0x18,0x7f},
+    {0xec,0x68,0x01,0xab,0x64,0x8e,0x7c,0x7a,0x43,0xc5,0xed,0x15,0x55,0x4a,0x5a,0xcb,0xda,0x0e,0xcd,0x47,0xd3,0x19,0x55,0x09,0xb0,0x93,0x3e,0x34,0x8c,0xac,0xd4,0x67,0x22,0x75,0x21,0x8e,0x72,0x4b,0x45,0x09,0xd8,0xb8,0x84,0xd4,0xf4,0xe8,0x58,0xaa,0x3c,0x90,0x46,0x7f,0x4d,0x25,0x58,0xd3,0x17,0x52,0x1c,0x24,0x43,0xc0,0xac,0x44,0x77,0x57,0x7a,0x4f,0xbb,0x6b,0x7d,0x1c,0xe1,0x13,0x83,0x91,0xd4,0xfe,0x35,0x8b,0x84,0x46,0x6b,0xc9,0xc6,0xa1,0xdc,0x4a,0xbd,0x71,0xad,0x12,0x83,0x1c,0x6d,0x55},
+    {0x82,0x39,0x8d,0x0c,0xe3,0x40,0xef,0x17,0x34,0xfa,0xa3,0x15,0x3e,0x07,0xf7,0x31,0x6e,0x64,0x73,0x07,0xcb,0xf3,0x21,0x4f,0xff,0x4e,0x82,0x1d,0x6d,0x6c,0x6c,0x74,0x21,0xe8,0x1b,0xb1,0x56,0x67,0xf0,0x81,0xdd,0xf3,0xa3,0x10,0x23,0xf8,0xaf,0x0f,0x5d,0x46,0x99,0x6a,0x55,0xd0,0xb2,0xf8,0x05,0x7f,0x8c,0xcc,0x38,0xbe,0x7a,0x09,0xa4,0x2d,0xa5,0x7e,0x87,0xc9,0x49,0x0c,0x43,0x1d,0xdc,0x9b,0x55,0x69,0x43,0x4c,0xd2,0xeb,0xcc,0xf7,0x09,0x38,0x2c,0x02,0xbd,0x84,0xee,0x4b,0xa3,0x14,0x7e,0x57},
+    {0x0a,0x3b,0xa7,0x61,0xac,0x68,0xe2,0xf0,0xf5,0xa5,0x91,0x37,0x10,0xfa,0xfa,0xf2,0xe9,0x00,0x6d,0x6b,0x82,0x3e,0xe1,0xc1,0x42,0x8f,0xd7,0x6f,0xe9,0x7e,0xfa,0x60,0x2b,0xd7,0x4d,0xbd,0xbe,0xce,0xfe,0x94,0x11,0x22,0x0f,0x06,0xda,0x4f,0x6a,0xf4,0xff,0xd1,0xc8,0xc0,0x77,0x59,0x4a,0x12,0x95,0x92,0x00,0xfb,0xb8,0x04,0x53,0x70,0xc6,0x6e,0x29,0x4d,0x35,0x1d,0x3d,0xb6,0xd8,0x31,0xad,0x5f,0x3e,0x05,0xc3,0xf3,0xec,0x42,0xbd,0xb4,0x8c,0x95,0x0b,0x67,0xfd,0x53,0x63,0xa1,0x0c,0x8e,0x39,0x21},
+    {0xf3,0x33,0x2b,0x38,0x8a,0x05,0xf5,0x89,0xb4,0xc0,0x48,0xad,0x0b,0xba,0xe2,0x5a,0x6e,0xb3,0x3d,0xa5,0x03,0xb5,0x93,0x8f,0xe6,0x32,0xa2,0x95,0x9d,0xed,0xa3,0x5a,0x01,0x56,0xb7,0xb4,0xf9,0xaa,0x98,0x27,0x72,0xad,0x8d,0x5c,0x13,0x72,0xac,0x5e,0x23,0xa0,0xb7,0x61,0x61,0xaa,0xce,0xd2,0x4e,0x7d,0x8f,0xe9,0x84,0xb2,0xbf,0x1b,0x61,0x65,0xd9,0xc7,0xe9,0x77,0x67,0x65,0x36,0x80,0xc7,0x72,0x54,0x12,0x2b,0xcb,0xee,0x6e,0x50,0xd9,0x99,0x32,0x05,0x65,0xcc,0x57,0x89,0x5e,0x4e,0xe1,0x07,0x4a},
+    {0x99,0xf9,0x0d,0x98,0xcb,0x12,0xe4,0x4e,0x71,0xc7,0x6e,0x3c,0x6f,0xd7,0x15,0xa3,0xfd,0x77,0x5c,0x92,0xde,0xed,0xa5,0xbb,0x02,0x34,0x31,0x1d,0x39,0xac,0x0b,0x3f,0x9b,0xa4,0x77,0xc4,0xcd,0x58,0x0b,0x24,0x17,0xf0,0x47,0x64,0xde,0xda,0x38,0xfd,0xad,0x6a,0xc8,0xa7,0x32,0x8d,0x92,0x19,0x81,0xa0,0xaf,0x84,0xed,0x7a,0xaf,0x50,0xe5,0x5b,0xf6,0x15,0x01,0xde,0x4f,0x6e,0xb2,0x09,0x61,0x21,0x21,0x26,0x98,0x29,0xd9,0xd6,0xad,0x0b,0x81,0x05,0x02,0x78,0x06,0xd0,0xeb,0xba,0x16,0xa3,0x21,0x19},
+    {0xfc,0x70,0xb8,0xdf,0x7e,0x2f,0x42,0x89,0xbd,0xb3,0x76,0x4f,0xeb,0x6b,0x29,0x2c,0xf7,0x4d,0xc2,0x36,0xd4,0xf1,0x38,0x07,0xb0,0xae,0x73,0xe2,0x41,0xdf,0x58,0x64,0x8b,0xc1,0xf3,0xd9,0x9a,0xad,0x5a,0xd7,0x9c,0xc1,0xb1,0x60,0xef,0x0e,0x6a,0x56,0xd9,0x0e,0x5c,0x25,0xac,0x0b,0x9a,0x3e,0xf5,0xc7,0x62,0xa0,0xec,0x9d,0x04,0x7b,0x83,0x44,0x44,0x35,0x7a,0xe3,0xcb,0xdc,0x93,0xbe,0xed,0x0f,0x33,0x79,0x88,0x75,0x87,0xdd,0xc5,0x12,0xc3,0x04,0x60,0x78,0x64,0x0e,0x95,0xc2,0xcb,0xdc,0x93,0x60},
+    {0x6d,0x70,0xe0,0x85,0x85,0x9a,0xf3,0x1f,0x33,0x39,0xe7,0xb3,0xd8,0xa5,0xd0,0x36,0x3b,0x45,0x8f,0x71,0xe1,0xf2,0xb9,0x43,0x7c,0xa9,0x27,0x48,0x08,0xea,0xd1,0x57,0x4b,0x03,0x84,0x60,0xbe,0xee,0xde,0x6b,0x54,0xb8,0x0f,0x78,0xb6,0xc2,0x99,0x31,0x95,0x06,0x2d,0xb6,0xab,0x76,0x33,0x97,0x90,0x7d,0x64,0x8b,0xc9,0x80,0x31,0x6e,0x71,0xb0,0x28,0xa1,0xe7,0xb6,0x7a,0xee,0xaa,0x8b,0xa8,0x93,0x6d,0x59,0xc1,0xa4,0x30,0x61,0x21,0xb2,0x82,0xde,0xb4,0xf7,0x18,0xbd,0x97,0xdd,0x9d,0x99,0x3e,0x36},
+    {0xc4,0x1f,0xee,0x35,0xc1,0x43,0xa8,0x96,0xcf,0xc8,0xe4,0x08,0x55,0xb3,0x6e,0x97,0x30,0xd3,0x8c,0xb5,0x01,0x68,0x2f,0xb4,0x2b,0x05,0x3a,0x69,0x78,0x9b,0xee,0x48,0xc6,0xae,0x4b,0xe2,0xdc,0x48,0x18,0x2f,0x60,0xaf,0xbc,0xba,0x55,0x72,0x9b,0x76,0x31,0xe9,0xef,0x3c,0x6e,0x3c,0xcb,0x90,0x55,0xb3,0xf9,0xc6,0x9b,0x97,0x1f,0x23,0xc6,0xf3,0x2a,0xcc,0x4b,0xde,0x31,0x5c,0x1f,0x8d,0x20,0xfe,0x30,0xb0,0x4b,0xb0,0x66,0xb4,0x4f,0xc1,0x09,0x70,0x8d,0xb7,0x13,0x24,0x79,0x08,0x9b,0xfa,0x9b,0x07},
+    {0xf4,0x0d,0x30,0xda,0x51,0x3a,0x90,0xe3,0xb0,0x5a,0xa9,0x3d,0x23,0x64,0x39,0x84,0x80,0x64,0x35,0x0b,0x2d,0xf1,0x3c,0xed,0x94,0x71,0x81,0x84,0xf6,0x77,0x8c,0x03,0x45,0x42,0xd5,0xa2,0x80,0xed,0xc9,0xf3,0x52,0x39,0xf6,0x77,0x78,0x8b,0xa0,0x0a,0x75,0x54,0x08,0xd1,0x63,0xac,0x6d,0xd7,0x6b,0x63,0x70,0x94,0x15,0xfb,0xf4,0x1e,0xec,0x7b,0x16,0x5b,0xe6,0x5e,0x4e,0x85,0xc2,0xcd,0xd0,0x96,0x42,0x0a,0x59,0x59,0x99,0x21,0x10,0x98,0x34,0xdf,0xb2,0x72,0x56,0xff,0x0b,0x4a,0x2a,0xe9,0x5e,0x57},
+    {0xcf,0x2f,0x18,0x8a,0x90,0x80,0xc0,0xd4,0xbd,0x9d,0x48,0x99,0xc2,0x70,0xe1,0x30,0xde,0x33,0xf7,0x52,0x57,0xbd,0xba,0x05,0x00,0xfd,0xd3,0x2c,0x11,0xe7,0xd4,0x43,0x01,0xd8,0xa4,0x0a,0x45,0xbc,0x46,0x5d,0xd8,0xb9,0x33,0xa5,0x27,0x12,0xaf,0xc3,0xc2,0x06,0x89,0x2b,0x26,0x3b,0x9e,0x38,0x1b,0x58,0x2f,0x38,0x7e,0x1e,0x0a,0x20,0xc5,0x3a,0xf9,0xea,0x67,0xb9,0x8d,0x51,0xc0,0x52,0x66,0x05,0x9b,0x98,0xbc,0x71,0xf5,0x97,0x71,0x56,0xd9,0x85,0x2b,0xfe,0x38,0x4e,0x1e,0x65,0x52,0xca,0x0e,0x05},
+    {0x9c,0x0c,0x3f,0x45,0xde,0x1a,0x43,0xc3,0x9b,0x3b,0x70,0xff,0x5e,0x04,0xf5,0xe9,0x3d,0x7b,0x84,0xed,0xc9,0x7a,0xd9,0xfc,0xc6,0xf4,0x58,0x1c,0xc2,0xe6,0x0e,0x4b,0xea,0x68,0xe6,0x60,0x76,0x39,0xac,0x97,0x97,0xb4,0x3a,0x15,0xfe,0xbb,0x19,0x9b,0x9f,0xa7,0xec,0x34,0xb5,0x79,0xb1,0x4c,0x57,0xae,0x31,0xa1,0x9f,0xc0,0x51,0x61,0x96,0x5d,0xf0,0xfd,0x0d,0x5c,0xf5,0x3a,0x7a,0xee,0xb4,0x2a,0xe0,0x2e,0x26,0xdd,0x09,0x17,0x17,0x12,0x87,0xbb,0xb2,0x11,0x0b,0x03,0x0f,0x80,0xfa,0x24,0xef,0x1f},
+    {0x96,0x31,0xa7,0x1a,0xfb,0x53,0xd6,0x37,0x18,0x64,0xd7,0x3f,0x30,0x95,0x94,0x0f,0xb2,0x17,0x3a,0xfb,0x09,0x0b,0x20,0xad,0x3e,0x61,0xc8,0x2f,0x29,0x49,0x4d,0x54,0x86,0x6b,0x97,0x30,0xf5,0xaf,0xd2,0x22,0x04,0x46,0xd2,0xc2,0x06,0xb8,0x90,0x8d,0xe5,0xba,0xe5,0x4d,0x6c,0x89,0xa1,0xdc,0x17,0x0c,0x34,0xc8,0xe6,0x5f,0x00,0x28,0x88,0x86,0x52,0x34,0x9f,0xba,0xef,0x6a,0xa1,0x7d,0x10,0x25,0x94,0xff,0x1b,0x5c,0x36,0x4b,0xd9,0x66,0xcd,0xbb,0x5b,0xf7,0xfa,0x6d,0x31,0x0f,0x93,0x72,0xe4,0x72},
+    {0x4f,0x08,0x81,0x97,0x8c,0x20,0x95,0x26,0xe1,0x0e,0x45,0x23,0x0b,0x2a,0x50,0xb1,0x02,0xde,0xef,0x03,0xa6,0xae,0x9d,0xfd,0x4c,0xa3,0x33,0x27,0x8c,0x2e,0x9d,0x5a,0x27,0x76,0x2a,0xd3,0x35,0xf6,0xf3,0x07,0xf0,0x66,0x65,0x5f,0x86,0x4d,0xaa,0x7a,0x50,0x44,0xd0,0x28,0x97,0xe7,0x85,0x3c,0x38,0x64,0xe0,0x0f,0x00,0x7f,0xee,0x1f,0xe5,0xf7,0xdb,0x03,0xda,0x05,0x53,0x76,0xbd,0xcd,0x34,0x14,0x49,0xf2,0xda,0xa4,0xec,0x88,0x4a,0xd2,0xcd,0xd5,0x4a,0x7b,0x43,0x05,0x04,0xee,0x51,0x40,0xf9,0x00},
+    {0xb2,0x30,0xd3,0xc3,0x23,0x6b,0x35,0x8d,0x06,0x1b,0x47,0xb0,0x9b,0x8b,0x1c,0xf2,0x3c,0xb8,0x42,0x6e,0x6c,0x31,0x6c,0xb3,0x0d,0xb1,0xea,0x8b,0x7e,0x9c,0xd7,0x07,0x53,0x97,0xaf,0x07,0xbb,0x93,0xef,0xd7,0xa7,0x66,0xb7,0x3d,0xcf,0xd0,0x3e,0x58,0xc5,0x1e,0x0b,0x6e,0xbf,0x98,0x69,0xce,0x52,0x04,0xd4,0x5d,0xd2,0xff,0xb7,0x47,0x12,0xdd,0x08,0xbc,0x9c,0xfb,0xfb,0x87,0x9b,0xc2,0xee,0xe1,0x3a,0x6b,0x06,0x8a,0xbf,0xc1,0x1f,0xdb,0x2b,0x24,0x57,0x0d,0xb6,0x4b,0xa6,0x5e,0xa3,0x20,0x35,0x1c},
+    {0x4a,0xa3,0xcb,0xbc,0xa6,0x53,0xd2,0x80,0x9b,0x21,0x38,0x38,0xa1,0xc3,0x61,0x3e,0x96,0xe3,0x82,0x98,0x01,0xb6,0xc3,0x90,0x6f,0xe6,0x0e,0x5d,0x77,0x05,0x3d,0x1c,0x59,0xc0,0x6b,0x21,0x40,0x6f,0xa8,0xcd,0x7e,0xd8,0xbc,0x12,0x1d,0x23,0xbb,0x1f,0x90,0x09,0xc7,0x17,0x9e,0x6a,0x95,0xb4,0x55,0x2e,0xd1,0x66,0x3b,0x0c,0x75,0x38,0x1a,0xe5,0x22,0x94,0x40,0xf1,0x2e,0x69,0x71,0xf6,0x5d,0x2b,0x3c,0xc7,0xc0,0xcb,0x29,0xe0,0x4c,0x74,0xe7,0x4f,0x01,0x21,0x7c,0x48,0x30,0xd3,0xc7,0xe2,0x21,0x06},
+    {0x8d,0x83,0x59,0x82,0xcc,0x60,0x98,0xaf,0xdc,0x9a,0x9f,0xc6,0xc1,0x48,0xea,0x90,0x30,0x1e,0x58,0x65,0x37,0x48,0x26,0x65,0xbc,0xa5,0xd3,0x7b,0x09,0xd6,0x07,0x00,0xf3,0xf0,0xdb,0xb0,0x96,0x17,0xae,0xb7,0x96,0xe1,0x7c,0xe1,0xb9,0xaf,0xdf,0x54,0xb4,0xa3,0xaa,0xe9,0x71,0x30,0x92,0x25,0x9d,0x2e,0x00,0xa1,0x9c,0x58,0x8e,0x5d,0x4b,0xa9,0x42,0x08,0x95,0x1d,0xbf,0xc0,0x3e,0x2e,0x8f,0x58,0x63,0xc3,0xd3,0xb2,0xef,0xe2,0x51,0xbb,0x38,0x14,0x96,0x0a,0x86,0xbf,0x1c,0x3c,0x78,0xd7,0x83,0x15},
+    {0xe1,0x7a,0xa2,0x5d,0xef,0xa2,0xee,0xec,0x74,0x01,0x67,0x55,0x14,0x3a,0x7c,0x59,0x7a,0x16,0x09,0x66,0x12,0x2a,0xa6,0xc9,0x70,0x8f,0xed,0x81,0x2e,0x5f,0x2a,0x25,0xc7,0x28,0x9d,0xcc,0x04,0x47,0x03,0x90,0x8f,0xc5,0x2c,0xf7,0x9e,0x67,0x1b,0x1d,0x26,0x87,0x5b,0xbe,0x5f,0x2b,0xe1,0x16,0x0a,0x58,0xc5,0x83,0x4e,0x06,0x58,0x49,0x0d,0xe8,0x66,0x50,0x26,0x94,0x28,0x0d,0x6b,0x8c,0x7c,0x30,0x85,0xf7,0xc3,0xfc,0xfd,0x12,0x11,0x0c,0x78,0xda,0x53,0x1b,0x88,0xb3,0x43,0xd8,0x0b,0x17,0x9c,0x07},
+    {0xff,0x6f,0xfa,0x64,0xe4,0xec,0x06,0x05,0x23,0xe5,0x05,0x62,0x1e,0x43,0xe3,0xbe,0x42,0xea,0xb8,0x51,0x24,0x42,0x79,0x35,0x00,0xfb,0xc9,0x4a,0xe3,0x05,0xec,0x6d,0x56,0xd0,0xd5,0xc0,0x50,0xcd,0xd6,0xcd,0x3b,0x57,0x03,0xbb,0x6d,0x68,0xf7,0x9a,0x48,0xef,0xc3,0xf3,0x3f,0x72,0xa6,0x3c,0xcc,0x8a,0x7b,0x31,0xd7,0xc0,0x68,0x67,0xb3,0xc1,0x55,0xf1,0xe5,0x25,0xb6,0x94,0x91,0x7b,0x7b,0x99,0xa7,0xf3,0x7b,0x41,0x00,0x26,0x6b,0x6d,0xdc,0xbd,0x2c,0xc2,0xf4,0x52,0xcd,0xdd,0x14,0x5e,0x44,0x51},
+    {0x51,0x49,0x14,0x3b,0x4b,0x2b,0x50,0x57,0xb3,0xbc,0x4b,0x44,0x6b,0xff,0x67,0x8e,0xdb,0x85,0x63,0x16,0x27,0x69,0xbd,0xb8,0xc8,0x95,0x92,0xe3,0x31,0x6f,0x18,0x13,0x55,0xa4,0xbe,0x2b,0xab,0x47,0x31,0x89,0x29,0x91,0x07,0x92,0x4f,0xa2,0x53,0x8c,0xa7,0xf7,0x30,0xbe,0x48,0xf9,0x49,0x4b,0x3d,0xd4,0x4f,0x6e,0x08,0x90,0xe9,0x12,0x2e,0xbb,0xdf,0x7f,0xb3,0x96,0x0c,0xf1,0xf9,0xea,0x1c,0x12,0x5e,0x93,0x9a,0x9f,0x3f,0x98,0x5b,0x3a,0xc4,0x36,0x11,0xdf,0xaf,0x99,0x3e,0x5d,0xf0,0xe3,0xb2,0x77},
+    {0xde,0xc4,0x2e,0x9c,0xc5,0xa9,0x6f,0x29,0xcb,0xf3,0x84,0x4f,0xbf,0x61,0x8b,0xbc,0x08,0xf9,0xa8,0x17,0xd9,0x06,0x77,0x1c,0x5d,0x25,0xd3,0x7a,0xfc,0x95,0xb7,0x63,0xa4,0xb0,0xdd,0x12,0x9c,0x63,0x98,0xd5,0x6b,0x86,0x24,0xc0,0x30,0x9f,0xd1,0xa5,0x60,0xe4,0xfc,0x58,0x03,0x2f,0x7c,0xd1,0x8a,0x5e,0x09,0x2e,0x15,0x95,0xa1,0x07,0xc8,0x5f,0x9e,0x38,0x02,0x8f,0x36,0xa8,0x3b,0xe4,0x8d,0xcf,0x02,0x3b,0x43,0x90,0x43,0x26,0x41,0xc5,0x5d,0xfd,0xa1,0xaf,0x37,0x01,0x2f,0x03,0x3d,0xe8,0x8f,0x3e},
+    {0x94,0xa2,0x70,0x05,0xb9,0x15,0x8b,0x2f,0x49,0x45,0x08,0x67,0x70,0x42,0xf2,0x94,0x84,0xfd,0xbb,0x61,0xe1,0x5a,0x1c,0xde,0x07,0x40,0xac,0x7f,0x79,0x3b,0xba,0x75,0x3c,0xd1,0xef,0xe8,0x8d,0x4c,0x70,0x08,0x31,0x37,0xe0,0x33,0x8e,0x1a,0xc5,0xdf,0xe3,0xcd,0x60,0x12,0xa5,0x5d,0x9d,0xa5,0x86,0x8c,0x25,0xa6,0x99,0x08,0xd6,0x22,0x96,0xd1,0xcd,0x70,0xc0,0xdb,0x39,0x62,0x9a,0x8a,0x7d,0x6c,0x8b,0x8a,0xfe,0x60,0x60,0x12,0x40,0xeb,0xbc,0x47,0x88,0xb3,0x5e,0x9e,0x77,0x87,0x7b,0xd0,0x04,0x09},
+    {0x9c,0x91,0xba,0xdd,0xd4,0x1f,0xce,0xb4,0xaa,0x8d,0x4c,0xc7,0x3e,0xdb,0x31,0xcf,0x51,0xcc,0x86,0xad,0x63,0xcc,0x63,0x2c,0x07,0xde,0x1d,0xbc,0x3f,0x14,0xe2,0x43,0xb9,0x40,0xf9,0x48,0x66,0x2d,0x32,0xf4,0x39,0x0c,0x2d,0xbd,0x0c,0x2f,0x95,0x06,0x31,0xf9,0x81,0xa0,0xad,0x97,0x76,0x16,0x6c,0x2a,0xf7,0xba,0xce,0xaa,0x40,0x62,0xa0,0x95,0xa2,0x5b,0x9c,0x74,0x34,0xf8,0x5a,0xd2,0x37,0xca,0x5b,0x7c,0x94,0xd6,0x6a,0x31,0xc9,0xe7,0xa7,0x3b,0xf1,0x66,0xac,0x0c,0xb4,0x8d,0x23,0xaf,0xbd,0x56},
+    {0xeb,0x33,0x35,0xf5,0xe3,0xb9,0x2a,0x36,0x40,0x3d,0xb9,0x6e,0xd5,0x68,0x85,0x33,0x72,0x55,0x5a,0x1d,0x52,0x14,0x0e,0x9e,0x18,0x13,0x74,0x83,0x6d,0xa8,0x24,0x1d,0xb2,0x3b,0x9d,0xc1,0x6c,0xd3,0x10,0x13,0xb9,0x86,0x23,0x62,0xb7,0x6b,0x2a,0x06,0x5c,0x4f,0xa1,0xd7,0x91,0x85,0x9b,0x7c,0x54,0x57,0x1e,0x7e,0x50,0x31,0xaa,0x03,0x1f,0xce,0xd4,0xff,0x48,0x76,0xec,0xf4,0x1c,0x8c,0xac,0x54,0xf0,0xea,0x45,0xe0,0x7c,0x35,0x09,0x1d,0x82,0x25,0xd2,0x88,0x59,0x48,0xeb,0x9a,0xdc,0x61,0xb2,0x43},
+    {0xbb,0x79,0xbb,0x88,0x19,0x1e,0x5b,0xe5,0x9d,0x35,0x7a,0xc1,0x7d,0xd0,0x9e,0xa0,0x33,0xea,0x3d,0x60,0xe2,0x2e,0x2c,0xb0,0xc2,0x6b,0x27,0x5b,0xcf,0x55,0x60,0x32,0x64,0x13,0x95,0x6c,0x8b,0x3d,0x51,0x19,0x7b,0xf4,0x0b,0x00,0x26,0x71,0xfe,0x94,0x67,0x95,0x4f,0xd5,0xdd,0x10,0x8d,0x02,0x64,0x09,0x94,0x42,0xe2,0xd5,0xb4,0x02,0xf2,0x8d,0xd1,0x28,0xcb,0x55,0xa1,0xb4,0x08,0xe5,0x6c,0x18,0x46,0x46,0xcc,0xea,0x89,0x43,0x82,0x6c,0x93,0xf4,0x9c,0xc4,0x10,0x34,0x5d,0xae,0x09,0xc8,0xa6,0x27},
+    {0x88,0xb1,0x0d,0x1f,0xcd,0xeb,0xa6,0x8b,0xe8,0x5b,0x5a,0x67,0x3a,0xd7,0xd3,0x37,0x5a,0x58,0xf5,0x15,0xa3,0xdf,0x2e,0xf2,0x7e,0xa1,0x60,0xff,0x74,0x71,0xb6,0x2c,0x54,0x69,0x3d,0xc4,0x0a,0x27,0x2c,0xcd,0xb2,0xca,0x66,0x6a,0x57,0x3e,0x4a,0xdd,0x6c,0x03,0xd7,0x69,0x24,0x59,0xfa,0x79,0x99,0x25,0x8c,0x3d,0x60,0x03,0x15,0x22,0xd0,0xe1,0x0b,0x39,0xf9,0xcd,0xee,0x59,0xf1,0xe3,0x8c,0x72,0x44,0x20,0x42,0xa9,0xf4,0xf0,0x94,0x7a,0x66,0x1c,0x89,0x82,0x36,0xf4,0x90,0x38,0xb7,0xf4,0x1d,0x7b},
+    {0x24,0xa2,0xb2,0xb3,0xe0,0xf2,0x92,0xe4,0x60,0x11,0x55,0x2b,0x06,0x9e,0x6c,0x7c,0x0e,0x7b,0x7f,0x0d,0xe2,0x8f,0xeb,0x15,0x92,0x59,0xfc,0x58,0x26,0xef,0xfc,0x61,0x8c,0xf5,0xf8,0x07,0x18,0x22,0x2e,0x5f,0xd4,0x09,0x94,0xd4,0x9f,0x5c,0x55,0xe3,0x30,0xa6,0xb6,0x1f,0x8d,0xa8,0xaa,0xb2,0x3d,0xe0,0x52,0xd3,0x45,0x82,0x69,0x68,0x7a,0x18,0x18,0x2a,0x85,0x5d,0xb1,0xdb,0xd7,0xac,0xdd,0x86,0xd3,0xaa,0xe4,0xf3,0x82,0xc4,0xf6,0x0f,0x81,0xe2,0xba,0x44,0xcf,0x01,0xaf,0x3d,0x47,0x4c,0xcf,0x46},
+    {0xf9,0xe5,0xc4,0x9e,0xed,0x25,0x65,0x42,0x03,0x33,0x90,0x16,0x01,0xda,0x5e,0x0e,0xdc,0xca,0xe5,0xcb,0xf2,0xa7,0xb1,0x72,0x40,0x5f,0xeb,0x14,0xcd,0x7b,0x38,0x29,0x40,0x81,0x49,0xf1,0xa7,0x6e,0x3c,0x21,0x54,0x48,0x2b,0x39,0xf8,0x7e,0x1e,0x7c,0xba,0xce,0x29,0x56,0x8c,0xc3,0x88,0x24,0xbb,0xc5,0x8c,0x0d,0xe5,0xaa,0x65,0x10,0x57,0x0d,0x20,0xdf,0x25,0x45,0x2c,0x1c,0x4a,0x67,0xca,0xbf,0xd6,0x2d,0x3b,0x5c,0x30,0x40,0x83,0xe1,0xb1,0xe7,0x07,0x0a,0x16,0xe7,0x1c,0x4f,0xe6,0x98,0xa1,0x69},
+    {0xbc,0x78,0x1a,0xd9,0xe0,0xb2,0x62,0x90,0x67,0x96,0x50,0xc8,0x9c,0x88,0xc9,0x47,0xb8,0x70,0x50,0x40,0x66,0x4a,0xf5,0x9d,0xbf,0xa1,0x93,0x24,0xa9,0xe6,0x69,0x73,0xed,0xca,0xc5,0xdc,0x34,0x44,0x01,0xe1,0x33,0xfb,0x84,0x3c,0x96,0x5d,0xed,0x47,0xe7,0xa0,0x86,0xed,0x76,0x95,0x01,0x70,0xe4,0xf9,0x67,0xd2,0x7b,0x69,0xb2,0x25,0x64,0x68,0x98,0x13,0xfb,0x3f,0x67,0x9d,0xb8,0xc7,0x5d,0x41,0xd9,0xfb,0xa5,0x3c,0x5e,0x3b,0x27,0xdf,0x3b,0xcc,0x4e,0xe0,0xd2,0x4c,0x4e,0xb5,0x3d,0x68,0x20,0x14},
+    {0x97,0xd1,0x9d,0x24,0x1e,0xbd,0x78,0xb4,0x02,0xc1,0x58,0x5e,0x00,0x35,0x0c,0x62,0x5c,0xac,0xba,0xcc,0x2f,0xd3,0x02,0xfb,0x2d,0xa7,0x08,0xf5,0xeb,0x3b,0xb6,0x60,0xd0,0x5a,0xcc,0xc1,0x6f,0xbb,0xee,0x34,0x8b,0xac,0x46,0x96,0xe9,0x0c,0x1b,0x6a,0x53,0xde,0x6b,0xa6,0x49,0xda,0xb0,0xd3,0xc1,0x81,0xd0,0x61,0x41,0x3b,0xe8,0x31,0x4f,0x2b,0x06,0x9e,0x12,0xc7,0xe8,0x97,0xd8,0x0a,0x32,0x29,0x4f,0x8f,0xe4,0x49,0x3f,0x68,0x18,0x6f,0x4b,0xe1,0xec,0x5b,0x17,0x03,0x55,0x2d,0xb6,0x1e,0xcf,0x55},
+    {0x58,0x3d,0xc2,0x65,0x10,0x10,0x79,0x58,0x9c,0x81,0x94,0x50,0x6d,0x08,0x9d,0x8b,0xa7,0x5f,0xc5,0x12,0xa9,0x2f,0x40,0xe2,0xd4,0x91,0x08,0x57,0x64,0x65,0x9a,0x66,0x52,0x8c,0xf5,0x7d,0xe3,0xb5,0x76,0x30,0x36,0xcc,0x99,0xe7,0xdd,0xb9,0x3a,0xd7,0x20,0xee,0x13,0x49,0xe3,0x1c,0x83,0xbd,0x33,0x01,0xba,0x62,0xaa,0xfb,0x56,0x1a,0xec,0xc9,0x9d,0x5c,0x50,0x6b,0x3e,0x94,0x1a,0x37,0x7c,0xa7,0xbb,0x57,0x25,0x30,0x51,0x76,0x34,0x41,0x56,0xae,0x73,0x98,0x5c,0x8a,0xc5,0x99,0x67,0x83,0xc4,0x13},
+    {0xb9,0xe1,0xb3,0x5a,0x46,0x5d,0x3a,0x42,0x61,0x3f,0xf1,0xc7,0x87,0xc1,0x13,0xfc,0xb6,0xb9,0xb5,0xec,0x64,0x36,0xf8,0x19,0x07,0xb6,0x37,0xa6,0x93,0x0c,0xf8,0x66,0x80,0xd0,0x8b,0x5d,0x6a,0xfb,0xdc,0xc4,0x42,0x48,0x1a,0x57,0xec,0xc4,0xeb,0xde,0x65,0x53,0xe5,0xb8,0x83,0xe8,0xb2,0xd4,0x27,0xb8,0xe5,0xc8,0x7d,0xc8,0xbd,0x50,0x11,0xe1,0xdf,0x6e,0x83,0x37,0x6d,0x60,0xd9,0xab,0x11,0xf0,0x15,0x3e,0x35,0x32,0x96,0x3b,0xb7,0x25,0xc3,0x3a,0xb0,0x64,0xae,0xd5,0x5f,0x72,0x44,0x64,0xd5,0x1d},
+    {0x7d,0x12,0x62,0x33,0xf8,0x7f,0xa4,0x8f,0x15,0x7c,0xcd,0x71,0xc4,0x6a,0x9f,0xbc,0x8b,0x0c,0x22,0x49,0x43,0x45,0x71,0x6e,0x2e,0x73,0x9f,0x21,0x12,0x59,0x64,0x0e,0x9a,0xc8,0xba,0x08,0x00,0xe6,0x97,0xc2,0xe0,0xc3,0xe1,0xea,0x11,0xea,0x4c,0x7d,0x7c,0x97,0xe7,0x9f,0xe1,0x8b,0xe3,0xf3,0xcd,0x05,0xa3,0x63,0x0f,0x45,0x3a,0x3a,0x27,0x46,0x39,0xd8,0x31,0x2f,0x8f,0x07,0x10,0xa5,0x94,0xde,0x83,0x31,0x9d,0x38,0x80,0x6f,0x99,0x17,0x6d,0x6c,0xe3,0xd1,0x7b,0xa8,0xa9,0x93,0x93,0x8d,0x8c,0x31},
+    {0x19,0xfe,0xff,0x2a,0x03,0x5d,0x74,0xf2,0x66,0xdb,0x24,0x7f,0x49,0x3c,0x9f,0x0c,0xef,0x98,0x85,0xba,0xe3,0xd3,0x98,0xbc,0x14,0x53,0x1d,0x9a,0x67,0x7c,0x4c,0x22,0x98,0xd3,0x1d,0xab,0x29,0x9e,0x66,0x5d,0x3b,0x9e,0x2d,0x34,0x58,0x16,0x92,0xfc,0xcd,0x73,0x59,0xf3,0xfd,0x1d,0x85,0x55,0xf6,0x0a,0x95,0x25,0xc3,0x41,0x9a,0x50,0xe9,0x25,0xf9,0xa6,0xdc,0x6e,0xc0,0xbd,0x33,0x1f,0x1b,0x64,0xf4,0xf3,0x3e,0x79,0x89,0x3e,0x83,0x9d,0x80,0x12,0xec,0x82,0x89,0x13,0xa1,0x28,0x23,0xf0,0xbf,0x05},
+    {0x0b,0xe0,0xca,0x23,0x70,0x13,0x32,0x36,0x59,0xcf,0xac,0xd1,0x0a,0xcf,0x4a,0x54,0x88,0x1c,0x1a,0xd2,0x49,0x10,0x74,0x96,0xa7,0x44,0x2a,0xfa,0xc3,0x8c,0x0b,0x78,0xe4,0x12,0xc5,0x0d,0xdd,0xa0,0x81,0x68,0xfe,0xfa,0xa5,0x44,0xc8,0x0d,0xe7,0x4f,0x40,0x52,0x4a,0x8f,0x6b,0x8e,0x74,0x1f,0xea,0xa3,0x01,0xee,0xcd,0x77,0x62,0x57,0x5f,0x30,0x4f,0x23,0xbc,0x8a,0xf3,0x1e,0x08,0xde,0x05,0x14,0xbd,0x7f,0x57,0x9a,0x0d,0x2a,0xe6,0x34,0x14,0xa5,0x82,0x5e,0xa1,0xb7,0x71,0x62,0x72,0x18,0xf4,0x5f},
+    {0x9d,0xdb,0x89,0x17,0x0c,0x08,0x8e,0x39,0xf5,0x78,0xe7,0xf3,0x25,0x20,0x60,0xa7,0x5d,0x03,0xbd,0x06,0x4c,0x89,0x98,0xfa,0xbe,0x66,0xa9,0x25,0xdc,0x03,0x6a,0x10,0x40,0x95,0xb6,0x13,0xe8,0x47,0xdb,0xe5,0xe1,0x10,0x26,0x43,0x3b,0x2a,0x5d,0xf3,0x76,0x12,0x78,0x38,0xe9,0x26,0x1f,0xac,0x69,0xcb,0xa0,0xa0,0x8c,0xdb,0xd4,0x29,0xd0,0x53,0x33,0x33,0xaf,0x0a,0xad,0xd9,0xe5,0x09,0xd3,0xac,0xa5,0x9d,0x66,0x38,0xf0,0xf7,0x88,0xc8,0x8a,0x65,0x57,0x3c,0xfa,0xbe,0x2c,0x05,0x51,0x8a,0xb3,0x4a},
+    {0x93,0xd5,0x68,0x67,0x25,0x2b,0x7c,0xda,0x13,0xca,0x22,0x44,0x57,0xc0,0xc1,0x98,0x1d,0xce,0x0a,0xca,0xd5,0x0b,0xa8,0xf1,0x90,0xa6,0x88,0xc0,0xad,0xd1,0xcd,0x29,0x9c,0xc0,0xdd,0x5f,0xef,0xd1,0xcf,0xd6,0xce,0x5d,0x57,0xf7,0xfd,0x3e,0x2b,0xe8,0xc2,0x34,0x16,0x20,0x5d,0x6b,0xd5,0x25,0x9b,0x2b,0xed,0x04,0xbb,0xc6,0x41,0x30,0x48,0xe1,0x56,0xd9,0xf9,0xf2,0xf2,0x0f,0x2e,0x6b,0x35,0x9f,0x75,0x97,0xe7,0xad,0x5c,0x02,0x6c,0x5f,0xbb,0x98,0x46,0x1a,0x7b,0x9a,0x04,0x14,0x68,0xbd,0x4b,0x10},
+    {0x67,0xed,0xf1,0x68,0x31,0xfd,0xf0,0x51,0xc2,0x3b,0x6f,0xd8,0xcd,0x1d,0x81,0x2c,0xde,0xf2,0xd2,0x04,0x43,0x5c,0xdc,0x44,0x49,0x71,0x2a,0x09,0x57,0xcc,0xe8,0x5b,0x63,0xf1,0x7f,0xd6,0x5f,0x9a,0x5d,0xa9,0x81,0x56,0xc7,0x4c,0x9d,0xe6,0x2b,0xe9,0x57,0xf2,0x20,0xde,0x4c,0x02,0xf8,0xb7,0xf5,0x2d,0x07,0xfb,0x20,0x2a,0x4f,0x20,0x79,0xb0,0xeb,0x30,0x3d,0x3b,0x14,0xc8,0x30,0x2e,0x65,0xbd,0x5a,0x15,0x89,0x75,0x31,0x5c,0x6d,0x8f,0x31,0x3c,0x3c,0x65,0x1f,0x16,0x79,0xc2,0x17,0xfb,0x70,0x25},
+    {0x75,0x15,0xb6,0x2c,0x7f,0x36,0xfa,0x3e,0x6c,0x02,0xd6,0x1c,0x76,0x6f,0xf9,0xf5,0x62,0x25,0xb5,0x65,0x2a,0x14,0xc7,0xe8,0xcd,0x0a,0x03,0x53,0xea,0x65,0xcb,0x3d,0x5a,0x24,0xb8,0x0b,0x55,0xa9,0x2e,0x19,0xd1,0x50,0x90,0x8f,0xa8,0xfb,0xe6,0xc8,0x35,0xc9,0xa4,0x88,0x2d,0xea,0x86,0x79,0x68,0x86,0x01,0xde,0x91,0x5f,0x1c,0x24,0xaa,0x6c,0xde,0x40,0x29,0x17,0xd8,0x28,0x3a,0x73,0xd9,0x22,0xf0,0x2c,0xbf,0x8f,0xd1,0x01,0x5b,0x23,0xdd,0xfc,0xd7,0x16,0xe5,0xf0,0xcd,0x5f,0xdd,0x0e,0x42,0x08},
+    {0x4a,0xfa,0x62,0x83,0xab,0x20,0xff,0xcd,0x6e,0x3e,0x1a,0xe2,0xd4,0x18,0xe1,0x57,0x2b,0xe6,0x39,0xfc,0x17,0x96,0x17,0xe3,0xfd,0x69,0x17,0xbc,0xef,0x53,0x9a,0x0d,0xce,0x10,0xf4,0x04,0x4e,0xc3,0x58,0x03,0x85,0x06,0x6e,0x27,0x5a,0x5b,0x13,0xb6,0x21,0x15,0xb9,0xeb,0xc7,0x70,0x96,0x5d,0x9c,0x88,0xdb,0x21,0xf3,0x54,0xd6,0x04,0xd5,0xb5,0xbd,0xdd,0x16,0xc1,0x7d,0x5e,0x2d,0xdd,0xa5,0x8d,0xb6,0xde,0x54,0x29,0x92,0xa2,0x34,0x33,0x17,0x08,0xb6,0x1c,0xd7,0x1a,0x99,0x18,0x26,0x4f,0x7a,0x4a},
+    {0x95,0x5f,0xb1,0x5f,0x02,0x18,0xa7,0xf4,0x8f,0x1b,0x5c,0x6b,0x34,0x5f,0xf6,0x3d,0x12,0x11,0xe0,0x00,0x85,0xf0,0xfc,0xcd,0x48,0x18,0xd3,0xdd,0x4c,0x0c,0xb5,0x11,0x4b,0x2a,0x37,0xaf,0x91,0xb2,0xc3,0x24,0xf2,0x47,0x81,0x71,0x70,0x82,0xda,0x93,0xf2,0x9e,0x89,0x86,0x64,0x85,0x84,0xdd,0x33,0xee,0xe0,0x23,0x42,0x31,0x96,0x4a,0xd6,0xff,0xa4,0x08,0x44,0x27,0xe8,0xa6,0xd9,0x76,0x15,0x9c,0x7e,0x17,0x8e,0x73,0xf2,0xb3,0x02,0x3d,0xb6,0x48,0x33,0x77,0x51,0xcc,0x6b,0xce,0x4d,0xce,0x4b,0x4f},
+    {0x84,0x25,0x24,0xe2,0x5a,0xce,0x1f,0xa7,0x9e,0x8a,0xf5,0x92,0x56,0x72,0xea,0x26,0xf4,0x3c,0xea,0x1c,0xd7,0x09,0x1a,0xd2,0xe6,0x01,0x1c,0xb7,0x14,0xdd,0xfc,0x73,0x6f,0x0b,0x9d,0xc4,0x6e,0x61,0xe2,0x30,0x17,0x23,0xec,0xca,0x8f,0x71,0x56,0xe4,0xa6,0x4f,0x6b,0xf2,0x9b,0x40,0xeb,0x48,0x37,0x5f,0x59,0x61,0xe5,0xce,0x42,0x30,0x41,0xac,0x9b,0x44,0x79,0x70,0x7e,0x42,0x0a,0x31,0xe2,0xbc,0x6d,0xe3,0x5a,0x85,0x7c,0x1a,0x84,0x5f,0x21,0x76,0xae,0x4c,0xd6,0xe1,0x9c,0x9a,0x0c,0x74,0x9e,0x38},
+    {0xce,0xb9,0xdc,0x34,0xae,0xb3,0xfc,0x64,0xad,0xd0,0x48,0xe3,0x23,0x03,0x50,0x97,0x1b,0x38,0xc6,0x62,0x7d,0xf0,0xb3,0x45,0x88,0x67,0x5a,0x46,0x79,0x53,0x54,0x61,0x28,0xac,0x0e,0x57,0xf6,0x78,0xbd,0xc9,0xe1,0x9c,0x91,0x27,0x32,0x0b,0x5b,0xe5,0xed,0x91,0x9b,0xa1,0xab,0x3e,0xfc,0x65,0x90,0x36,0x26,0xd6,0xe5,0x25,0xc4,0x25,0x6e,0xde,0xd7,0xf1,0xa6,0x06,0x3e,0x3f,0x08,0x23,0x06,0x8e,0x27,0x76,0xf9,0x3e,0x77,0x6c,0x8a,0x4e,0x26,0xf6,0x14,0x8c,0x59,0x47,0x48,0x15,0x89,0xa0,0x39,0x65},
+    {0x73,0xf7,0xd2,0xc3,0x74,0x1f,0xd2,0xe9,0x45,0x68,0xc4,0x25,0x41,0x54,0x50,0xc1,0x33,0x9e,0xb9,0xf9,0xe8,0x5c,0x4e,0x62,0x6c,0x18,0xcd,0xc5,0xaa,0xe4,0xc5,0x11,0x19,0x4a,0xbb,0x14,0xd4,0xdb,0xc4,0xdd,0x8e,0x4f,0x42,0x98,0x3c,0xbc,0xb2,0x19,0x69,0x71,0xca,0x36,0xd7,0x9f,0xa8,0x48,0x90,0xbd,0x19,0xf0,0x0e,0x32,0x65,0x0f,0xc6,0xe0,0xfd,0xca,0xb1,0xd1,0x86,0xd4,0x81,0x51,0x3b,0x16,0xe3,0xe6,0x3f,0x4f,0x9a,0x93,0xf2,0xfa,0x0d,0xaf,0xa8,0x59,0x2a,0x07,0x33,0xec,0xbd,0xc7,0xab,0x4c},
+    {0x2e,0x0a,0x9c,0x08,0x24,0x96,0x9e,0x23,0x38,0x47,0xfe,0x3a,0xc0,0xc4,0x48,0xc7,0x2a,0xa1,0x4f,0x76,0x2a,0xed,0xdb,0x17,0x82,0x85,0x1c,0x32,0xf0,0x93,0x9b,0x63,0x89,0xd2,0x78,0x3f,0x8f,0x78,0x8f,0xc0,0x9f,0x4d,0x40,0xa1,0x2c,0xa7,0x30,0xfe,0x9d,0xcc,0x65,0xcf,0xfc,0x8b,0x77,0xf2,0x21,0x20,0xcb,0x5a,0x16,0x98,0xe4,0x7e,0xc3,0xa1,0x11,0x91,0xe3,0x08,0xd5,0x7b,0x89,0x74,0x90,0x80,0xd4,0x90,0x2b,0x2b,0x19,0xfd,0x72,0xae,0xc2,0xae,0xd2,0xe7,0xa6,0x02,0xb6,0x85,0x3c,0x49,0xdf,0x0e},
+    {0x68,0x5a,0x9b,0x59,0x58,0x81,0xcc,0xae,0x0e,0xe2,0xad,0xeb,0x0f,0x4f,0x57,0xea,0x07,0x7f,0xb6,0x22,0x74,0x1d,0xe4,0x4f,0xb4,0x4f,0x9d,0x01,0xe3,0x92,0x3b,0x40,0x13,0x41,0x76,0x84,0xd2,0xc4,0x67,0x67,0x35,0xf8,0xf5,0xf7,0x3f,0x40,0x90,0xa0,0xde,0xbe,0xe6,0xca,0xfa,0xcf,0x8f,0x1c,0x69,0xa3,0xdf,0xd1,0x54,0x0c,0xc0,0x04,0xf8,0x5c,0x46,0x8b,0x81,0x2f,0xc2,0x4d,0xf8,0xef,0x80,0x14,0x5a,0xf3,0xa0,0x71,0x57,0xd6,0xc7,0x04,0xad,0xbf,0xe8,0xae,0xf4,0x76,0x61,0xb2,0x2a,0xb1,0x5b,0x35},
+    {0xf4,0xbb,0x93,0x74,0xcc,0x64,0x1e,0xa7,0xc3,0xb0,0xa3,0xec,0xd9,0x84,0xbd,0xe5,0x85,0xe7,0x05,0xfa,0x0c,0xc5,0x6b,0x0a,0x12,0xc3,0x2e,0x18,0x32,0x81,0x9b,0x0f,0x18,0x73,0x8c,0x5a,0xc7,0xda,0x01,0xa3,0x11,0xaa,0xce,0xb3,0x9d,0x03,0x90,0xed,0x2d,0x3f,0xae,0x3b,0xbf,0x7c,0x07,0x6f,0x8e,0xad,0x52,0xe0,0xf8,0xea,0x18,0x75,0x32,0x6c,0x7f,0x1b,0xc4,0x59,0x88,0xa4,0x98,0x32,0x38,0xf4,0xbc,0x60,0x2d,0x0f,0xd9,0xd1,0xb1,0xc9,0x29,0xa9,0x15,0x18,0xc4,0x55,0x17,0xbb,0x1b,0x87,0xc3,0x47},
+    {0x48,0x4f,0xec,0x71,0x97,0x53,0x44,0x51,0x6e,0x5d,0x8c,0xc9,0x7d,0xb1,0x05,0xf8,0x6b,0xc6,0xc3,0x47,0x1a,0xc1,0x62,0xf7,0xdc,0x99,0x46,0x76,0x85,0x9b,0xb8,0x00,0xb0,0x66,0x50,0xc8,0x50,0x5d,0xe6,0xfb,0xb0,0x99,0xa2,0xb3,0xb0,0xc4,0xec,0x62,0xe0,0xe8,0x1a,0x44,0xea,0x54,0x37,0xe5,0x5f,0x8d,0xd4,0xe8,0x2c,0xa0,0xfe,0x08,0xd0,0xea,0xde,0x68,0x76,0xdd,0x4d,0x82,0x23,0x5d,0x68,0x4b,0x20,0x45,0x64,0xc8,0x65,0xd6,0x89,0x5d,0xcd,0xcf,0x14,0xb5,0x37,0xd5,0x75,0x4f,0xa7,0x29,0x38,0x47},
+    {0x18,0xc4,0x79,0x46,0x75,0xda,0xd2,0x82,0xf0,0x8d,0x61,0xb2,0xd8,0xd7,0x3b,0xe6,0x0a,0xeb,0x47,0xac,0x24,0xef,0x5e,0x35,0xb4,0xc6,0x33,0x48,0x4c,0x68,0x78,0x20,0xc9,0x02,0x39,0xad,0x3a,0x53,0xd9,0x23,0x8f,0x58,0x03,0xef,0xce,0xdd,0xc2,0x64,0xb4,0x2f,0xe1,0xcf,0x90,0x73,0x25,0x15,0x90,0xd3,0xe4,0x44,0x4d,0x8b,0x66,0x6c,0x0c,0x82,0x78,0x7a,0x21,0xcf,0x48,0x3b,0x97,0x3e,0x27,0x81,0xb2,0x0a,0x6a,0xf7,0x7b,0xed,0x8e,0x8c,0xa7,0x65,0x6c,0xa9,0x3f,0x43,0x8a,0x4f,0x05,0xa6,0x11,0x74},
+    {0x6d,0xc8,0x9d,0xb9,0x32,0x9d,0x65,0x4d,0x15,0xf1,0x3a,0x60,0x75,0xdc,0x4c,0x04,0x88,0xe4,0xc2,0xdc,0x2c,0x71,0x4c,0xb3,0xff,0x34,0x81,0xfb,0x74,0x65,0x13,0x7c,0xb4,0x75,0xb1,0x18,0x3d,0xe5,0x9a,0x57,0x02,0xa1,0x92,0xf3,0x59,0x31,0x71,0x68,0xf5,0x35,0xef,0x1e,0xba,0xec,0x55,0x84,0x8f,0x39,0x8c,0x45,0x72,0xa8,0xc9,0x1e,0x9b,0x50,0xa2,0x00,0xd4,0xa4,0xe6,0xb8,0xb4,0x82,0xc8,0x0b,0x02,0xd7,0x81,0x9b,0x61,0x75,0x95,0xf1,0x9b,0xcc,0xe7,0x57,0x60,0x64,0xcd,0xc7,0xa5,0x88,0xdd,0x3a},
+    {0xf2,0xdc,0x35,0xb6,0x70,0x57,0x89,0xab,0xbc,0x1f,0x6c,0xf6,0x6c,0xef,0xdf,0x02,0x87,0xd1,0xb6,0xbe,0x68,0x02,0x53,0x85,0x74,0x9e,0x87,0xcc,0xfc,0x29,0x99,0x24,0x46,0x30,0x39,0x59,0xd4,0x98,0xc2,0x85,0xec,0x59,0xf6,0x5f,0x98,0x35,0x7e,0x8f,0x3a,0x6e,0xf6,0xf2,0x2a,0xa2,0x2c,0x1d,0x20,0xa7,0x06,0xa4,0x31,0x11,0xba,0x61,0x29,0x90,0x95,0x16,0xf1,0xa0,0xd0,0xa3,0x89,0xbd,0x7e,0xba,0x6c,0x6b,0x3b,0x02,0x07,0x33,0x78,0x26,0x3e,0x5a,0xf1,0x7b,0xe7,0xec,0xd8,0xbb,0x0c,0x31,0x20,0x56},
+    {0x43,0xd6,0x34,0x49,0x43,0x93,0x89,0x52,0xf5,0x22,0x12,0xa5,0x06,0xf8,0xdb,0xb9,0x22,0x1c,0xf4,0xc3,0x8f,0x87,0x6d,0x8f,0x30,0x97,0x9d,0x4d,0x2a,0x6a,0x67,0x37,0xd6,0x85,0xe2,0x77,0xf4,0xb5,0x46,0x66,0x93,0x61,0x8f,0x6c,0x67,0xff,0xe8,0x40,0xdd,0x94,0xb5,0xab,0x11,0x73,0xec,0xa6,0x4d,0xec,0x8c,0x65,0xf3,0x46,0xc8,0x7e,0xc7,0x2e,0xa2,0x1d,0x3f,0x8f,0x5e,0x9b,0x13,0xcd,0x01,0x6c,0x77,0x1d,0x0f,0x13,0xb8,0x9f,0x98,0xa2,0xcf,0x8f,0x4c,0x21,0xd5,0x9d,0x9b,0x39,0x23,0xf7,0xaa,0x6d},
+    {0x47,0xbe,0x3d,0xeb,0x62,0x75,0x3a,0x5f,0xb8,0xa0,0xbd,0x8e,0x54,0x38,0xea,0xf7,0x99,0x72,0x74,0x45,0x31,0xe5,0xc3,0x00,0x51,0xd5,0x27,0x16,0xe7,0xe9,0x04,0x13,0xa2,0x8e,0xad,0xac,0xbf,0x04,0x3b,0x58,0x84,0xe8,0x8b,0x14,0xe8,0x43,0xb7,0x29,0xdb,0xc5,0x10,0x08,0x3b,0x58,0x1e,0x2b,0xaa,0xbb,0xb3,0x8e,0xe5,0x49,0x54,0x2b,0xfe,0x9c,0xdc,0x6a,0xd2,0x14,0x98,0x78,0x0b,0xdd,0x48,0x8b,0x3f,0xab,0x1b,0x3c,0x0a,0xc6,0x79,0xf9,0xff,0xe1,0x0f,0xda,0x93,0xd6,0x2d,0x7c,0x2d,0xde,0x68,0x44},
+    {0x9e,0x46,0x19,0x94,0x5e,0x35,0xbb,0x51,0x54,0xc7,0xdd,0x23,0x4c,0xdc,0xe6,0x33,0x62,0x99,0x7f,0x44,0xd6,0xb6,0xa5,0x93,0x63,0xbd,0x44,0xfb,0x6f,0x7c,0xce,0x6c,0xce,0x07,0x63,0xf8,0xc6,0xd8,0x9a,0x4b,0x28,0x0c,0x5d,0x43,0x31,0x35,0x11,0x21,0x2c,0x77,0x7a,0x65,0xc5,0x66,0xa8,0xd4,0x52,0x73,0x24,0x63,0x7e,0x42,0xa6,0x5d,0xca,0x22,0xac,0xde,0x88,0xc6,0x94,0x1a,0xf8,0x1f,0xae,0xbb,0xf7,0x6e,0x06,0xb9,0x0f,0x58,0x59,0x8d,0x38,0x8c,0xad,0x88,0xa8,0x2c,0x9f,0xe7,0xbf,0x9a,0xf2,0x58},
+    {0x68,0x3e,0xe7,0x8d,0xab,0xcf,0x0e,0xe9,0xa5,0x76,0x7e,0x37,0x9f,0x6f,0x03,0x54,0x82,0x59,0x01,0xbe,0x0b,0x5b,0x49,0xf0,0x36,0x1e,0xf4,0xa7,0xc4,0x29,0x76,0x57,0xf6,0xcd,0x0e,0x71,0xbf,0x64,0x5a,0x4b,0x3c,0x29,0x2c,0x46,0x38,0xe5,0x4c,0xb1,0xb9,0x3a,0x0b,0xd5,0x56,0xd0,0x43,0x36,0x70,0x48,0x5b,0x18,0x24,0x37,0xf9,0x6a,0x88,0xa8,0xc6,0x09,0x45,0x02,0x20,0x32,0x73,0x89,0x55,0x4b,0x13,0x36,0xe0,0xd2,0x9f,0x28,0x33,0x3c,0x23,0x36,0xe2,0x83,0x8f,0xc1,0xae,0x0c,0xbb,0x25,0x1f,0x70},
+    {0xed,0x6c,0x61,0xe4,0xf8,0xb0,0xa8,0xc3,0x7d,0xa8,0x25,0x9e,0x0e,0x66,0x00,0xf7,0x9c,0xa5,0xbc,0xf4,0x1f,0x06,0xe3,0x61,0xe9,0x0b,0xc4,0xbd,0xbf,0x92,0x0c,0x2e,0x13,0xc1,0xbe,0x7c,0xd9,0xf6,0x18,0x9d,0xe4,0xdb,0xbf,0x74,0xe6,0x06,0x4a,0x84,0xd6,0x60,0x4e,0xac,0x22,0xb5,0xf5,0x20,0x51,0x5e,0x95,0x50,0xc0,0x5b,0x0a,0x72,0x35,0x5a,0x80,0x9b,0x43,0x09,0x3f,0x0c,0xfc,0xab,0x42,0x62,0x37,0x8b,0x4e,0xe8,0x46,0x93,0x22,0x5c,0xf3,0x17,0x14,0x69,0xec,0xf0,0x4e,0x14,0xbb,0x9c,0x9b,0x0e},
+    {0xad,0x20,0x57,0xfb,0x8f,0xd4,0xba,0xfb,0x0e,0x0d,0xf9,0xdb,0x6b,0x91,0x81,0xee,0xbf,0x43,0x55,0x63,0x52,0x31,0x81,0xd4,0xd8,0x7b,0x33,0x3f,0xeb,0x04,0x11,0x22,0xee,0xbe,0xb1,0x5d,0xd5,0x9b,0xee,0x8d,0xb9,0x3f,0x72,0x0a,0x37,0xab,0xc3,0xc9,0x91,0xd7,0x68,0x1c,0xbf,0xf1,0xa8,0x44,0xde,0x3c,0xfd,0x1c,0x19,0x44,0x6d,0x36,0x14,0x8c,0xbc,0xf2,0x43,0x17,0x3c,0x9e,0x3b,0x6c,0x85,0xb5,0xfc,0x26,0xda,0x2e,0x97,0xfb,0xa7,0x68,0x0e,0x2f,0xb8,0xcc,0x44,0x32,0x59,0xbc,0xe6,0xa4,0x67,0x41},
+    {0x00,0x27,0xf6,0x76,0x28,0x9d,0x3b,0x64,0xeb,0x68,0x76,0x0e,0x40,0x9d,0x1d,0x5d,0x84,0x06,0xfc,0x21,0x03,0x43,0x4b,0x1b,0x6a,0x24,0x55,0x22,0x7e,0xbb,0x38,0x79,0xee,0x8f,0xce,0xf8,0x65,0x26,0xbe,0xc2,0x2c,0xd6,0x80,0xe8,0x14,0xff,0x67,0xe9,0xee,0x4e,0x36,0x2f,0x7e,0x6e,0x2e,0xf1,0xf6,0xd2,0x7e,0xcb,0x70,0x33,0xb3,0x34,0xcc,0xd6,0x81,0x86,0xee,0x91,0xc5,0xcd,0x53,0xa7,0x85,0xed,0x9c,0x10,0x02,0xce,0x83,0x88,0x80,0x58,0xc1,0x85,0x74,0xed,0xe4,0x65,0xfe,0x2d,0x6e,0xfc,0x76,0x11},
+    {0x9b,0x61,0x9c,0x5b,0xd0,0x6c,0xaf,0xb4,0x80,0x84,0xa5,0xb2,0xf4,0xc9,0xdf,0x2d,0xc4,0x4d,0xe9,0xeb,0x02,0xa5,0x4f,0x3d,0x34,0x5f,0x7d,0x67,0x4c,0x3a,0xfc,0x08,0xb8,0x0e,0x77,0x49,0x89,0xe2,0x90,0xdb,0xa3,0x40,0xf4,0xac,0x2a,0xcc,0xfb,0x98,0x9b,0x87,0xd7,0xde,0xfe,0x4f,0x35,0x21,0xb6,0x06,0x69,0xf2,0x54,0x3e,0x6a,0x1f,0xea,0x34,0x07,0xd3,0x99,0xc1,0xa4,0x60,0xd6,0x5c,0x16,0x31,0xb6,0x85,0xc0,0x40,0x95,0x82,0x59,0xf7,0x23,0x3e,0x33,0xe2,0xd1,0x00,0xb9,0x16,0x01,0xad,0x2f,0x4f},
+    {0x54,0x4e,0xae,0x94,0x41,0xb2,0xbe,0x44,0x6c,0xef,0x57,0x18,0x51,0x1c,0x54,0x5f,0x98,0x04,0x8d,0x36,0x2d,0x6b,0x1e,0xa6,0xab,0xf7,0x2e,0x97,0xa4,0x84,0x54,0x44,0x38,0xb6,0x3b,0xb7,0x1d,0xd9,0x2c,0x96,0x08,0x9c,0x12,0xfc,0xaa,0x77,0x05,0xe6,0x89,0x16,0xb6,0xf3,0x39,0x9b,0x61,0x6f,0x81,0xee,0x44,0x29,0x5f,0x99,0x51,0x34,0x7c,0x7d,0xea,0x9f,0xd0,0xfc,0x52,0x91,0xf6,0x5c,0x93,0xb0,0x94,0x6c,0x81,0x4a,0x40,0x5c,0x28,0x47,0xaa,0x9a,0x8e,0x25,0xb7,0x93,0x28,0x04,0xa6,0x9c,0xb8,0x10},
+    {0x9c,0x28,0x18,0x97,0x49,0x47,0x59,0x3d,0x26,0x3f,0x53,0x24,0xc5,0xf8,0xeb,0x12,0x15,0xef,0xc3,0x14,0xcb,0xbf,0x62,0x02,0x8e,0x51,0xb7,0x77,0xd5,0x78,0xb8,0x20,0x6e,0xf0,0x45,0x5a,0xbe,0x41,0x39,0x75,0x65,0x5f,0x9c,0x6d,0xed,0xae,0x7c,0xd0,0xb6,0x51,0xff,0x72,0x9c,0x6b,0x77,0x11,0xa9,0x4d,0x0d,0xef,0xd9,0xd1,0xd2,0x17,0x6a,0x3e,0x3f,0x07,0x18,0xaf,0xf2,0x27,0x69,0x10,0x52,0xd7,0x19,0xe5,0x3f,0xfd,0x22,0x00,0xa6,0x3c,0x2c,0xb7,0xe3,0x22,0xa7,0xc6,0x65,0xcc,0x63,0x4f,0x21,0x72},
+    {0x93,0xa6,0x07,0x53,0x40,0x7f,0xe3,0xb4,0x95,0x67,0x33,0x2f,0xd7,0x14,0xa7,0xab,0x99,0x10,0x76,0x73,0xa7,0xd0,0xfb,0xd6,0xc9,0xcb,0x71,0x81,0xc5,0x48,0xdf,0x5f,0xc9,0x29,0x3b,0xf4,0xb9,0xb7,0x9d,0x1d,0x75,0x8f,0x51,0x4f,0x4a,0x82,0x05,0xd6,0xc4,0x9d,0x2f,0x31,0xbd,0x72,0xc0,0xf2,0xb0,0x45,0x15,0x5a,0x85,0xac,0x24,0x1f,0xaa,0x05,0x95,0x8e,0x32,0x08,0xd6,0x24,0xee,0x20,0x14,0x0c,0xd1,0xc1,0x48,0x47,0xa2,0x25,0xfb,0x06,0x5c,0xe4,0xff,0xc7,0xe6,0x95,0xe3,0x2a,0x9e,0x73,0xba,0x00},
+    {0xd6,0x90,0x87,0x5c,0xde,0x98,0x2e,0x59,0xdf,0xa2,0xc2,0x45,0xd3,0xb7,0xbf,0xe5,0x22,0x99,0xb4,0xf9,0x60,0x3b,0x5a,0x11,0xf3,0x78,0xad,0x67,0x3e,0x3a,0x28,0x03,0x26,0xbb,0x88,0xea,0xf5,0x26,0x44,0xae,0xfb,0x3b,0x97,0x84,0xd9,0x79,0x06,0x36,0x50,0x4e,0x69,0x26,0x0c,0x03,0x9f,0x5c,0x26,0xd2,0x18,0xd5,0xe7,0x7d,0x29,0x72,0x39,0xb9,0x0c,0xbe,0xc7,0x1d,0x24,0x48,0x80,0x30,0x63,0x8b,0x4d,0x9b,0xf1,0x32,0x08,0x93,0x28,0x02,0x0d,0xc9,0xdf,0xd3,0x45,0x19,0x27,0x46,0x68,0x29,0xe1,0x05},
+    {0x5a,0x49,0x9c,0x2d,0xb3,0xee,0x82,0xba,0x7c,0xb9,0x2b,0xf1,0xfc,0xc8,0xef,0xce,0xe0,0xd1,0xb5,0x93,0xae,0xab,0x2d,0xb0,0x9b,0x8d,0x69,0x13,0x9c,0x0c,0xc0,0x39,0x50,0x45,0x2c,0x24,0xc8,0xbb,0xbf,0xad,0xd9,0x81,0x30,0xd0,0xec,0x0c,0xc8,0xbc,0x92,0xdf,0xc8,0xf5,0xa6,0x66,0x35,0x84,0x4c,0xce,0x58,0x82,0xd3,0x25,0xcf,0x78,0x68,0x9d,0x48,0x31,0x8e,0x6b,0xae,0x15,0x87,0xf0,0x2b,0x9c,0xab,0x1c,0x85,0xaa,0x05,0xfa,0x4e,0xf0,0x97,0x5a,0xa7,0xc9,0x32,0xf8,0x3f,0x6b,0x07,0x52,0x6b,0x00},
+    {0x1c,0x78,0x95,0x9d,0xe1,0xcf,0xe0,0x29,0xe2,0x10,0x63,0x96,0x18,0xdf,0x81,0xb6,0x39,0x6b,0x51,0x70,0xd3,0x39,0xdf,0x57,0x22,0x61,0xc7,0x3b,0x44,0xe3,0x57,0x4d,0x2d,0x08,0xce,0xb9,0x16,0x7e,0xcb,0xf5,0x29,0xbc,0x7a,0x41,0x4c,0xf1,0x07,0x34,0xab,0xa7,0xf4,0x2b,0xce,0x6b,0xb3,0xd4,0xce,0x75,0x9f,0x1a,0x56,0xe9,0xe2,0x7d,0xcb,0x5e,0xa5,0xb6,0xf4,0xd4,0x70,0xde,0x99,0xdb,0x85,0x5d,0x7f,0x52,0x01,0x48,0x81,0x9a,0xee,0xd3,0x40,0xc4,0xc9,0xdb,0xed,0x29,0x60,0x1a,0xaf,0x90,0x2a,0x6b},
+    {0x97,0x1e,0xe6,0x9a,0xfc,0xf4,0x23,0x69,0xd1,0x5f,0x3f,0xe0,0x1d,0x28,0x35,0x57,0x2d,0xd1,0xed,0xe6,0x43,0xae,0x64,0xa7,0x4a,0x3e,0x2d,0xd1,0xe9,0xf4,0xd8,0x5f,0x0a,0xd8,0xb2,0x5b,0x24,0xf3,0xeb,0x77,0x9b,0x07,0xb9,0x2f,0x47,0x1b,0x30,0xd8,0x33,0x73,0xee,0x4c,0xf2,0xe6,0x47,0xc6,0x09,0x21,0x6c,0x27,0xc8,0x12,0x58,0x46,0xd9,0x62,0x10,0x2a,0xb2,0xbe,0x43,0x4d,0x16,0xdc,0x31,0x38,0x75,0xfb,0x65,0x70,0xd7,0x68,0x29,0xde,0x7b,0x4a,0x0d,0x18,0x90,0x67,0xb1,0x1c,0x2b,0x2c,0xb3,0x05},
+    {0xfd,0xa8,0x4d,0xd2,0xcc,0x5e,0xc0,0xc8,0x83,0xef,0xdf,0x05,0xac,0x1a,0xcf,0xa1,0x61,0xcd,0xf9,0x7d,0xf2,0xef,0xbe,0xdb,0x99,0x1e,0x47,0x7b,0xa3,0x56,0x55,0x3b,0x95,0x81,0xd5,0x7a,0x2c,0xa4,0xfc,0xf7,0xcc,0xf3,0x33,0x43,0x6e,0x28,0x14,0x32,0x9d,0x97,0x0b,0x34,0x0d,0x9d,0xc2,0xb6,0xe1,0x07,0x73,0x56,0x48,0x1a,0x77,0x31,0x82,0xd4,0x4d,0xe1,0x24,0xc5,0xb0,0x32,0xb6,0xa4,0x2b,0x1a,0x54,0x51,0xb3,0xed,0xf3,0x5a,0x2b,0x28,0x48,0x60,0xd1,0xa3,0xeb,0x36,0x73,0x7a,0xd2,0x79,0xc0,0x4f},
+    {0x7f,0x2f,0xbf,0x89,0xb0,0x38,0xc9,0x51,0xa7,0xe9,0xdf,0x02,0x65,0xbd,0x97,0x24,0x53,0xe4,0x80,0x78,0x9c,0xc0,0xff,0xff,0x92,0x8e,0xf9,0xca,0xce,0x67,0x45,0x12,0x0d,0xc5,0x86,0x0c,0x44,0x8b,0x34,0xdc,0x51,0xe6,0x94,0xcc,0xc9,0xcb,0x37,0x13,0xb9,0x3c,0x3e,0x64,0x4d,0xf7,0x22,0x64,0x08,0xcd,0xe3,0xba,0xc2,0x70,0x11,0x24,0xb4,0x73,0xc4,0x0a,0x86,0xab,0xf9,0x3f,0x35,0xe4,0x13,0x01,0xee,0x1d,0x91,0xf0,0xaf,0xc4,0xc6,0xeb,0x60,0x50,0xe7,0x4a,0x0d,0x00,0x87,0x6c,0x96,0x12,0x86,0x3f},
+    {0xde,0x0d,0x2a,0x78,0xc9,0x0c,0x9a,0x55,0x85,0x83,0x71,0xea,0xb2,0xcd,0x1d,0x55,0x8c,0x23,0xef,0x31,0x5b,0x86,0x62,0x7f,0x3d,0x61,0x73,0x79,0x76,0xa7,0x4a,0x50,0x13,0x8d,0x04,0x36,0xfa,0xfc,0x18,0x9c,0xdd,0x9d,0x89,0x73,0xb3,0x9d,0x15,0x29,0xaa,0xd0,0x92,0x9f,0x0b,0x35,0x9f,0xdc,0xd4,0x19,0x8a,0x87,0xee,0x7e,0xf5,0x26,0xb1,0xef,0x87,0x56,0xd5,0x2c,0xab,0x0c,0x7b,0xf1,0x7a,0x24,0x62,0xd1,0x80,0x51,0x67,0x24,0x5a,0x4f,0x34,0x5a,0xc1,0x85,0x69,0x30,0xba,0x9d,0x3d,0x94,0x41,0x40},
+    {0x96,0xcc,0xeb,0x43,0xba,0xee,0xc0,0xc3,0xaf,0x9c,0xea,0x26,0x9c,0x9c,0x74,0x8d,0xc6,0xcc,0x77,0x1c,0xee,0x95,0xfa,0xd9,0x0f,0x34,0x84,0x76,0xd9,0xa1,0x20,0x14,0xdd,0xaa,0x6c,0xa2,0x43,0x77,0x21,0x4b,0xce,0xb7,0x8a,0x64,0x24,0xb4,0xa6,0x47,0xe3,0xc9,0xfb,0x03,0x7a,0x4f,0x1d,0xcb,0x19,0xd0,0x00,0x98,0x42,0x31,0xd9,0x12,0x4f,0x59,0x37,0xd3,0x99,0x77,0xc6,0x00,0x7b,0xa4,0x3a,0xb2,0x40,0x51,0x3c,0x5e,0x95,0xf3,0x5f,0xe3,0x54,0x28,0x18,0x44,0x12,0xa0,0x59,0x43,0x31,0x92,0x4f,0x1b},
+    {0x51,0x09,0x15,0x89,0x9d,0x10,0x5c,0x3e,0x6a,0x69,0xe9,0x2d,0x91,0xfa,0xce,0x39,0x20,0x30,0x5f,0x97,0x3f,0xe4,0xea,0x20,0xae,0x2d,0x13,0x7f,0x2a,0x57,0x9b,0x23,0xb1,0x66,0x98,0xa4,0x30,0x30,0xcf,0x33,0x59,0x48,0x5f,0x21,0xd2,0x73,0x1f,0x25,0xf6,0xf4,0xde,0x51,0x40,0xaa,0x82,0xab,0xf6,0x23,0x9a,0x6f,0xd5,0x91,0xf1,0x5f,0x68,0x90,0x2d,0xac,0x33,0xd4,0x9e,0x81,0x23,0x85,0xc9,0x5f,0x79,0xab,0x83,0x28,0x3d,0xeb,0x93,0x55,0x80,0x72,0x45,0xef,0xcb,0x36,0x8f,0x75,0x6a,0x52,0x0c,0x02},
+    {0xbc,0xdb,0xd8,0x9e,0xf8,0x34,0x98,0x77,0x6c,0xa4,0x7c,0xdc,0xf9,0xaa,0xf2,0xc8,0x74,0xb0,0xe1,0xa3,0xdc,0x4c,0x52,0xa9,0x77,0x38,0x31,0x15,0x46,0xcc,0xaa,0x02,0x89,0xcc,0x42,0xf0,0x59,0xef,0x31,0xe9,0xb6,0x4b,0x12,0x8e,0x9d,0x9c,0x58,0x2c,0x97,0x59,0xc7,0xae,0x8a,0xe1,0xc8,0xad,0x0c,0xc5,0x02,0x56,0x0a,0xfe,0x2c,0x45,0xdf,0x77,0x78,0x64,0xa0,0xf7,0xa0,0x86,0x9f,0x7c,0x60,0x0e,0x27,0x64,0xc4,0xbb,0xc9,0x11,0xfb,0xf1,0x25,0xea,0x17,0xab,0x7b,0x87,0x4b,0x30,0x7b,0x7d,0xfb,0x4c},
+    {0xfe,0x75,0x9b,0xb8,0x6c,0x3d,0xb4,0x72,0x80,0xdc,0x6a,0x9c,0xd9,0x94,0xc6,0x54,0x9f,0x4c,0xe3,0x3e,0x37,0xaa,0xc3,0xb8,0x64,0x53,0x07,0x39,0x2b,0x62,0xb4,0x14,0x12,0xef,0x89,0x97,0xc2,0x99,0x86,0xe2,0x0d,0x19,0x57,0xdf,0x71,0xcd,0x6e,0x2b,0xd0,0x70,0xc9,0xec,0x57,0xc8,0x43,0xc3,0xc5,0x3a,0x4d,0x43,0xbc,0x4c,0x1d,0x5b,0x26,0x9f,0x0a,0xcc,0x15,0x26,0xfb,0xb6,0xe5,0xcc,0x8d,0xb8,0x2b,0x0e,0x4f,0x3a,0x05,0xa7,0x69,0x33,0x8b,0x49,0x01,0x13,0xd1,0x2d,0x59,0x58,0x12,0xf7,0x98,0x2f},
+    {0x56,0x9e,0x0f,0xb5,0x4c,0xa7,0x94,0x0c,0x20,0x13,0x8e,0x8e,0xa9,0xf4,0x1f,0x5b,0x67,0x0f,0x30,0x82,0x21,0xcc,0x2a,0x9a,0xf9,0xaa,0x06,0xd8,0x49,0xe2,0x6a,0x3a,0x01,0xa7,0x54,0x4f,0x44,0xae,0x12,0x2e,0xde,0xd7,0xcb,0xa9,0xf0,0x3e,0xfe,0xfc,0xe0,0x5d,0x83,0x75,0x0d,0x89,0xbf,0xce,0x54,0x45,0x61,0xe7,0xe9,0x62,0x80,0x1d,0x5a,0x7c,0x90,0xa9,0x85,0xda,0x7a,0x65,0x62,0x0f,0xb9,0x91,0xb5,0xa8,0x0e,0x1a,0xe9,0xb4,0x34,0xdf,0xfb,0x1d,0x0e,0x8d,0xf3,0x5f,0xf2,0xae,0xe8,0x8c,0x8b,0x29},
+    {0xb2,0x0c,0xf7,0xef,0x53,0x79,0x92,0x2a,0x76,0x70,0x15,0x79,0x2a,0xc9,0x89,0x4b,0x6a,0xcf,0xa7,0x30,0x7a,0x45,0x18,0x94,0x85,0xe4,0x5c,0x4d,0x40,0xa8,0xb8,0x34,0xde,0x65,0x21,0x0a,0xea,0x72,0x7a,0x83,0xf6,0x79,0xcf,0x0b,0xb4,0x07,0xab,0x3f,0x70,0xae,0x38,0x77,0xc7,0x36,0x16,0x52,0xdc,0xd7,0xa7,0x03,0x18,0x27,0xa6,0x6b,0x35,0x33,0x69,0x83,0xb5,0xec,0x6e,0xc2,0xfd,0xfe,0xb5,0x63,0xdf,0x13,0xa8,0xd5,0x73,0x25,0xb2,0xa4,0x9a,0xaa,0x93,0xa2,0x6a,0x1c,0x5e,0x46,0xdd,0x2b,0xd6,0x71},
+    {0x80,0xdf,0x78,0xd3,0x28,0xcc,0x33,0x65,0xb4,0xa4,0x0f,0x0a,0x79,0x43,0xdb,0xf6,0x5a,0xda,0x01,0xf7,0xf9,0x5f,0x64,0xe3,0xa4,0x2b,0x17,0xf3,0x17,0xf3,0xd5,0x74,0xf5,0x5e,0xf7,0xb1,0xda,0xb5,0x2d,0xcd,0xf5,0x65,0xb0,0x16,0xcf,0x95,0x7f,0xd7,0x85,0xf0,0x49,0x3f,0xea,0x1f,0x57,0x14,0x3d,0x2b,0x2b,0x26,0x21,0x36,0x33,0x1c,0x81,0xca,0xd9,0x67,0x54,0xe5,0x6f,0xa8,0x37,0x8c,0x29,0x2b,0x75,0x7c,0x8b,0x39,0x3b,0x62,0xac,0xe3,0x92,0x08,0x6d,0xda,0x8c,0xd9,0xe9,0x47,0x45,0xcc,0xeb,0x4a},
+    {0xc9,0x01,0x6d,0x27,0x1b,0x07,0xf0,0x12,0x70,0x8c,0xc4,0x86,0xc5,0xba,0xb8,0xe7,0xa9,0xfb,0xd6,0x71,0x9b,0x12,0x08,0x53,0x92,0xb7,0x3d,0x5a,0xf9,0xfb,0x88,0x5d,0x10,0xb6,0x54,0x73,0x9e,0x8d,0x40,0x0b,0x6e,0x5b,0xa8,0x5b,0x53,0x32,0x6b,0x80,0x07,0xa2,0x58,0x4a,0x03,0x3a,0xe6,0xdb,0x2c,0xdf,0xa1,0xc9,0xdd,0xd9,0x3b,0x17,0xdf,0x72,0x58,0xfe,0x1e,0x0f,0x50,0x2b,0xc1,0x18,0x39,0xd4,0x2e,0x58,0xd6,0x58,0xe0,0x3a,0x67,0xc9,0x8e,0x27,0xed,0xe6,0x19,0xa3,0x9e,0xb1,0x13,0xcd,0xe1,0x06},
+    {0x23,0x6f,0x16,0x6f,0x51,0xad,0xd0,0x40,0xbe,0x6a,0xab,0x1f,0x93,0x32,0x8e,0x11,0x8e,0x08,0x4d,0xa0,0x14,0x5e,0xe3,0x3f,0x66,0x62,0xe1,0x26,0x35,0x60,0x80,0x30,0x53,0x03,0x5b,0x9e,0x62,0xaf,0x2b,0x47,0x47,0x04,0x8d,0x27,0x90,0x0b,0xaa,0x3b,0x27,0xbf,0x43,0x96,0x46,0x5f,0x78,0x0c,0x13,0x7b,0x83,0x8d,0x1a,0x6a,0x3a,0x7f,0x0b,0x80,0x3d,0x5d,0x39,0x44,0xe6,0xf7,0xf6,0xed,0x01,0xc9,0x55,0xd5,0xa8,0x95,0x39,0x63,0x2c,0x59,0x30,0x78,0xcd,0x68,0x7e,0x30,0x51,0x2e,0xed,0xfd,0xd0,0x30},
+    {0xb3,0x33,0x12,0xf2,0x1a,0x4d,0x59,0xe0,0x9c,0x4d,0xcc,0xf0,0x8e,0xe7,0xdb,0x1b,0x77,0x9a,0x49,0x8f,0x7f,0x18,0x65,0x69,0x68,0x98,0x09,0x2c,0x20,0x14,0x92,0x0a,0x50,0x47,0xb8,0x68,0x1e,0x97,0xb4,0x9c,0xcf,0xbb,0x64,0x66,0x29,0x72,0x95,0xa0,0x2b,0x41,0xfa,0x72,0x26,0xe7,0x8d,0x5c,0xd9,0x89,0xc5,0x51,0x43,0x08,0x15,0x46,0x2e,0xa0,0xb9,0xae,0xc0,0x19,0x90,0xbc,0xae,0x4c,0x03,0x16,0x0d,0x11,0xc7,0x55,0xec,0x32,0x99,0x65,0x01,0xf5,0x6d,0x0e,0xfe,0x5d,0xca,0x95,0x28,0x0d,0xca,0x3b},
+    {0xa4,0x62,0x5d,0x3c,0xbc,0x31,0xf0,0x40,0x60,0x7a,0xf0,0xcf,0x3e,0x8b,0xfc,0x19,0x45,0xb5,0x0f,0x13,0xa2,0x3d,0x18,0x98,0xcd,0x13,0x8f,0xae,0xdd,0xde,0x31,0x56,0xbf,0x01,0xcc,0x9e,0xb6,0x8e,0x68,0x9c,0x6f,0x89,0x44,0xa6,0xad,0x83,0xbc,0xf0,0xe2,0x9f,0x7a,0x5f,0x5f,0x95,0x2d,0xca,0x41,0x82,0xf2,0x8d,0x03,0xb4,0xa8,0x4e,0x02,0xd2,0xca,0xf1,0x0a,0x46,0xed,0x2a,0x83,0xee,0x8c,0xa4,0x05,0x53,0x30,0x46,0x5f,0x1a,0xf1,0x49,0x45,0x77,0x21,0x91,0x63,0xa4,0x2c,0x54,0x30,0x09,0xce,0x24},
+    {0x06,0xc1,0x06,0xfd,0xf5,0x90,0xe8,0x1f,0xf2,0x10,0x88,0x5d,0x35,0x68,0xc4,0xb5,0x3e,0xaf,0x8c,0x6e,0xfe,0x08,0x78,0x82,0x4b,0xd7,0x06,0x8a,0xc2,0xe3,0xd4,0x41,0x85,0x0b,0xf3,0xfd,0x55,0xa1,0xcf,0x3f,0xa4,0x2e,0x37,0x36,0x8e,0x16,0xf7,0xd2,0x44,0xf8,0x92,0x64,0xde,0x64,0xe0,0xb2,0x80,0x42,0x4f,0x32,0xa7,0x28,0x99,0x54,0x2e,0x1a,0xee,0x63,0xa7,0x32,0x6e,0xf2,0xea,0xfd,0x5f,0xd2,0xb7,0xe4,0x91,0xae,0x69,0x4d,0x7f,0xd1,0x3b,0xd3,0x3b,0xbc,0x6a,0xff,0xdc,0xc0,0xde,0x66,0x1b,0x49},
+    {0xa7,0x32,0xea,0xc7,0x3d,0xb1,0xf5,0x98,0x98,0xdb,0x16,0x7e,0xcc,0xf8,0xd5,0xe3,0x47,0xd9,0xf8,0xcb,0x52,0xbf,0x0a,0xac,0xac,0xe4,0x5e,0xc8,0xd0,0x38,0xf3,0x08,0xa1,0x64,0xda,0xd0,0x8e,0x4a,0xf0,0x75,0x4b,0x28,0xe2,0x67,0xaf,0x2c,0x22,0xed,0xa4,0x7b,0x7b,0x1f,0x79,0xa3,0x34,0x82,0x67,0x8b,0x01,0xb7,0xb0,0xb8,0xf6,0x4c,0xbd,0x73,0x1a,0x99,0x21,0xa8,0x83,0xc3,0x7a,0x0c,0x32,0xdf,0x01,0xbc,0x27,0xab,0x63,0x70,0x77,0x84,0x1b,0x33,0x3d,0xc1,0x99,0x8a,0x07,0xeb,0x82,0x4a,0x0d,0x53},
+    {0x25,0x48,0xf9,0xe1,0x30,0x36,0x4c,0x00,0x5a,0x53,0xab,0x8c,0x26,0x78,0x2d,0x7e,0x8b,0xff,0x84,0xcc,0x23,0x23,0x48,0xc7,0xb9,0x70,0x17,0x10,0x3f,0x75,0xea,0x65,0x9e,0xbf,0x9a,0x6c,0x45,0x73,0x69,0x6d,0x80,0xa8,0x00,0x49,0xfc,0xb2,0x7f,0x25,0x50,0xb8,0xcf,0xc8,0x12,0xf4,0xac,0x2b,0x5b,0xbd,0xbf,0x0c,0xe0,0xe7,0xb3,0x0d,0x63,0x63,0x09,0xe2,0x3e,0xfc,0x66,0x3d,0x6b,0xcb,0xb5,0x61,0x7f,0x2c,0xd6,0x81,0x1a,0x3b,0x44,0x13,0x42,0x04,0xbe,0x0f,0xdb,0xa1,0xe1,0x21,0x19,0xec,0xa4,0x02},
+    {0xa2,0xb8,0x24,0x3b,0x9a,0x25,0xe6,0x5c,0xb8,0xa0,0xaf,0x45,0xcc,0x7a,0x57,0xb8,0x37,0x70,0xa0,0x8b,0xe8,0xe6,0xcb,0xcc,0xbf,0x09,0x78,0x12,0x51,0x3c,0x14,0x3d,0x5f,0x79,0xcf,0xf1,0x62,0x61,0xc8,0xf5,0xf2,0x57,0xee,0x26,0x19,0x86,0x8c,0x11,0x78,0x35,0x06,0x1c,0x85,0x24,0x21,0x17,0xcf,0x7f,0x06,0xec,0x5d,0x2b,0xd1,0x36,0x57,0x45,0x15,0x79,0x91,0x27,0x6d,0x12,0x0a,0x3a,0x78,0xfc,0x5c,0x8f,0xe4,0xd5,0xac,0x9b,0x17,0xdf,0xe8,0xb6,0xbd,0x36,0x59,0x28,0xa8,0x5b,0x88,0x17,0xf5,0x2e},
+    {0xdc,0xae,0x58,0x8c,0x4e,0x97,0x37,0x46,0xa4,0x41,0xf0,0xab,0xfb,0x22,0xef,0xb9,0x8a,0x71,0x80,0xe9,0x56,0xd9,0x85,0xe1,0xa6,0xa8,0x43,0xb1,0xfa,0x78,0x1b,0x2f,0x51,0x2f,0x5b,0x30,0xfb,0xbf,0xee,0x96,0xb8,0x96,0x95,0x88,0xad,0x38,0xf9,0xd3,0x25,0xdd,0xd5,0x46,0xc7,0x2d,0xf5,0xf0,0x95,0x00,0x3a,0xbb,0x90,0x82,0x96,0x57,0x01,0xe1,0x20,0x0a,0x43,0xb8,0x1a,0xf7,0x47,0xec,0xf0,0x24,0x8d,0x65,0x93,0xf3,0xd1,0xee,0xe2,0x6e,0xa8,0x09,0x75,0xcf,0xe1,0xa3,0x2a,0xdc,0x35,0x3e,0xc4,0x7d},
+    {0xc3,0xd9,0x7d,0x88,0x65,0x66,0x96,0x85,0x55,0x53,0xb0,0x4b,0x31,0x9b,0x0f,0xc9,0xb1,0x79,0x20,0xef,0xf8,0x8d,0xe0,0xc6,0x2f,0xc1,0x8c,0x75,0x16,0x20,0xf7,0x7e,0x18,0x97,0x3e,0x27,0x5c,0x2a,0x78,0x5a,0x94,0xfd,0x4e,0x5e,0x99,0xc6,0x76,0x35,0x3e,0x7d,0x23,0x1f,0x05,0xd8,0x2e,0x0f,0x99,0x0a,0xd5,0x82,0x1d,0xb8,0x4f,0x04,0xd9,0xe3,0x07,0xa9,0xc5,0x18,0xdf,0xc1,0x59,0x63,0x4c,0xce,0x1d,0x37,0xb3,0x57,0x49,0xbb,0x01,0xb2,0x34,0x45,0x70,0xca,0x2e,0xdd,0x30,0x9c,0x3f,0x82,0x79,0x7f},
+    {0xe8,0x13,0xb5,0xa3,0x39,0xd2,0x34,0x83,0xd8,0xa8,0x1f,0xb9,0xd4,0x70,0x36,0xc1,0x33,0xbd,0x90,0xf5,0x36,0x41,0xb5,0x12,0xb4,0xd9,0x84,0xd7,0x73,0x03,0x4e,0x0a,0xba,0x87,0xf5,0x68,0xf0,0x1f,0x9c,0x6a,0xde,0xc8,0x50,0x00,0x4e,0x89,0x27,0x08,0xe7,0x5b,0xed,0x7d,0x55,0x99,0xbf,0x3c,0xf0,0xd6,0x06,0x1c,0x43,0xb0,0xa9,0x64,0x19,0x29,0x7d,0x5b,0xa1,0xd6,0xb3,0x2e,0x35,0x82,0x3a,0xd5,0xa0,0xf6,0xb4,0xb0,0x47,0x5d,0xa4,0x89,0x43,0xce,0x56,0x71,0x6c,0x34,0x18,0xce,0x0a,0x7d,0x1a,0x07},
+    {0x0b,0xba,0x87,0xc8,0xaa,0x2d,0x07,0xd3,0xee,0x62,0xa5,0xbf,0x05,0x29,0x26,0x01,0x8b,0x76,0xef,0xc0,0x02,0x30,0x54,0xcf,0x9c,0x7e,0xea,0x46,0x71,0xcc,0x3b,0x2c,0x31,0x44,0xe1,0x20,0x52,0x35,0x0c,0xcc,0x41,0x51,0xb1,0x09,0x07,0x95,0x65,0x0d,0x36,0x5f,0x9d,0x20,0x1b,0x62,0xf5,0x9a,0xd3,0x55,0x77,0x61,0xf7,0xbc,0x69,0x7c,0x5f,0x29,0xe8,0x04,0xeb,0xd7,0xf0,0x07,0x7d,0xf3,0x50,0x2f,0x25,0x18,0xdb,0x10,0xd7,0x98,0x17,0x17,0xa3,0xa9,0x51,0xe9,0x1d,0xa5,0xac,0x22,0x73,0x9a,0x5a,0x6f},
+    {0xc5,0xc6,0x41,0x2f,0x0c,0x00,0xa1,0x8b,0x9b,0xfb,0xfe,0x0c,0xc1,0x79,0x9f,0xc4,0x9f,0x1c,0xc5,0x3c,0x70,0x47,0xfa,0x4e,0xca,0xaf,0x47,0xe1,0xa2,0x21,0x4e,0x49,0xbe,0x44,0xd9,0xa3,0xeb,0xd4,0x29,0xe7,0x9e,0xaf,0x78,0x80,0x40,0x09,0x9e,0x8d,0x03,0x9c,0x86,0x47,0x7a,0x56,0x25,0x45,0x24,0x3b,0x8d,0xee,0x80,0x96,0xab,0x02,0x9a,0x0d,0xe5,0xdd,0x85,0x8a,0xa4,0xef,0x49,0xa2,0xb9,0x0f,0x4e,0x22,0x9a,0x21,0xd9,0xf6,0x1e,0xd9,0x1d,0x1f,0x09,0xfa,0x34,0xbb,0x46,0xea,0xcb,0x76,0x5d,0x6b},
+    {0x94,0xd9,0x0c,0xec,0x6c,0x55,0x57,0x88,0xba,0x1d,0xd0,0x5c,0x6f,0xdc,0x72,0x64,0x77,0xb4,0x42,0x8f,0x14,0x69,0x01,0xaf,0x54,0x73,0x27,0x85,0xf6,0x33,0xe3,0x0a,0x22,0x25,0x78,0x1e,0x17,0x41,0xf9,0xe0,0xd3,0x36,0x69,0x03,0x74,0xae,0xe6,0xf1,0x46,0xc7,0xfc,0xd0,0xa2,0x3e,0x8b,0x40,0x3e,0x31,0xdd,0x03,0x9c,0x86,0xfb,0x16,0x62,0x09,0xb6,0x33,0x97,0x19,0x8e,0x28,0x33,0xe1,0xab,0xd8,0xb4,0x72,0xfc,0x24,0x3e,0xd0,0x91,0x09,0xed,0xf7,0x11,0x48,0x75,0xd0,0x70,0x8f,0x8b,0xe3,0x81,0x3f},
+    {0xfe,0xaf,0xd9,0x7e,0xcc,0x0f,0x91,0x7f,0x4b,0x87,0x65,0x24,0xa1,0xb8,0x5c,0x54,0x04,0x47,0x0c,0x4b,0xd2,0x7e,0x39,0xa8,0x93,0x09,0xf5,0x04,0xc1,0x0f,0x51,0x50,0x24,0xc8,0x17,0x5f,0x35,0x7f,0xdb,0x0a,0xa4,0x99,0x42,0xd7,0xc3,0x23,0xb9,0x74,0xf7,0xea,0xf8,0xcb,0x8b,0x3e,0x7c,0xd5,0x3d,0xdc,0xde,0x4c,0xd3,0xe2,0xd3,0x0a,0x9d,0x24,0x6e,0x33,0xc5,0x0f,0x0c,0x6f,0xd9,0xcf,0x31,0xc3,0x19,0xde,0x5e,0x74,0x1c,0xfe,0xee,0x09,0x00,0xfd,0xd6,0xf2,0xbe,0x1e,0xfa,0xf0,0x8b,0x15,0x7c,0x12},
+    {0xa2,0x79,0x98,0x2e,0x42,0x7c,0x19,0xf6,0x47,0x36,0xca,0x52,0xd4,0xdd,0x4a,0xa4,0xcb,0xac,0x4e,0x4b,0xc1,0x3f,0x41,0x9b,0x68,0x4f,0xef,0x07,0x7d,0xf8,0x4e,0x35,0x74,0xb9,0x51,0xae,0xc4,0x8f,0xa2,0xde,0x96,0xfe,0x4d,0x74,0xd3,0x73,0x99,0x1d,0xa8,0x48,0x38,0x87,0x0b,0x68,0x40,0x62,0x95,0xdf,0x67,0xd1,0x79,0x24,0xd8,0x4e,0x75,0xd9,0xc5,0x60,0x22,0xb5,0xe3,0xfe,0xb8,0xb0,0x41,0xeb,0xfc,0x2e,0x35,0x50,0x3c,0x65,0xf6,0xa9,0x30,0xac,0x08,0x88,0x6d,0x23,0x39,0x05,0xd2,0x92,0x2d,0x30},
+    {0x3d,0x28,0xa4,0xbc,0xa2,0xc1,0x13,0x78,0xd9,0x3d,0x86,0xa1,0x91,0xf0,0x62,0xed,0x86,0xfa,0x68,0xc2,0xb8,0xbc,0xc7,0xae,0x4c,0xae,0x1c,0x6f,0xb7,0xd3,0xe5,0x10,0x77,0xf1,0xe0,0xe4,0xb6,0x6f,0xbc,0x2d,0x93,0x6a,0xbd,0xa4,0x29,0xbf,0xe1,0x04,0xe8,0xf6,0x7a,0x78,0xd4,0x66,0x19,0x5e,0x60,0xd0,0x26,0xb4,0x5e,0x5f,0xdc,0x0e,0x67,0x8e,0xda,0x53,0xd6,0xbf,0x53,0x54,0x41,0xf6,0xa9,0x24,0xec,0x1e,0xdc,0xe9,0x23,0x8a,0x57,0x03,0x3b,0x26,0x87,0xbf,0x72,0xba,0x1c,0x36,0x51,0x6c,0xb4,0x45},
+    {0xa1,0x7f,0x4f,0x31,0xbf,0x2a,0x40,0xa9,0x50,0xf4,0x8c,0x8e,0xdc,0xf1,0x57,0xe2,0x84,0xbe,0xa8,0x23,0x4b,0xd5,0xbb,0x1d,0x3b,0x71,0xcb,0x6d,0xa3,0xbf,0x77,0x21,0xe4,0xe3,0x7f,0x8a,0xdd,0x4d,0x9d,0xce,0x30,0x0e,0x62,0x76,0x56,0x64,0x13,0xab,0x58,0x99,0x0e,0xb3,0x7b,0x4f,0x59,0x4b,0xdf,0x29,0x12,0x32,0xef,0x0a,0x1c,0x5c,0x8f,0xdb,0x79,0xfa,0xbc,0x1b,0x08,0x37,0xb3,0x59,0x5f,0xc2,0x1e,0x81,0x48,0x60,0x87,0x24,0x83,0x9c,0x65,0x76,0x7a,0x08,0xbb,0xb5,0x8a,0x7d,0x38,0x19,0xe6,0x4a},
+    {0x2e,0xa3,0x44,0x53,0xaa,0xf6,0xdb,0x8d,0x78,0x40,0x1b,0xb4,0xb4,0xea,0x88,0x7d,0x60,0x0d,0x13,0x4a,0x97,0xeb,0xb0,0x5e,0x03,0x3e,0xbf,0x17,0x1b,0xd9,0x00,0x1a,0x83,0xfb,0x5b,0x98,0x44,0x7e,0x11,0x61,0x36,0x31,0x96,0x71,0x2a,0x46,0xe0,0xfc,0x4b,0x90,0x25,0xd4,0x48,0x34,0xac,0x83,0x64,0x3d,0xa4,0x5b,0xbe,0x5a,0x68,0x75,0xb2,0xf2,0x61,0xeb,0x33,0x09,0x96,0x6e,0x52,0x49,0xff,0xc9,0xa8,0x0f,0x3d,0x54,0x69,0x65,0xf6,0x7a,0x10,0x75,0x72,0xdf,0xaa,0xe6,0xb0,0x23,0xb6,0x29,0x55,0x13},
+    {0x18,0xd5,0xd1,0xad,0xd7,0xdb,0xf0,0x18,0x11,0x1f,0xc1,0xcf,0x88,0x78,0x9f,0x97,0x9b,0x75,0x14,0x71,0xf0,0xe1,0x32,0x87,0x01,0x3a,0xca,0x65,0x1a,0xb8,0xb5,0x79,0xfe,0x83,0x2e,0xe2,0xbc,0x16,0xc7,0xf5,0xc1,0x85,0x09,0xe8,0x19,0xeb,0x2b,0xb4,0xae,0x4a,0x25,0x14,0x37,0xa6,0x9d,0xec,0x13,0xa6,0x90,0x15,0x05,0xea,0x72,0x59,0x11,0x78,0x8f,0xdc,0x20,0xac,0xd4,0x0f,0xa8,0x4f,0x4d,0xac,0x94,0xd2,0x9a,0x9a,0x34,0x04,0x36,0xb3,0x64,0x2d,0x1b,0xc0,0xdb,0x3b,0x5f,0x90,0x95,0x9c,0x7e,0x4f},
+    {0x2e,0x30,0x81,0x57,0xbc,0x4b,0x67,0x62,0x0f,0xdc,0xad,0x89,0x39,0x0f,0x52,0xd8,0xc6,0xd9,0xfb,0x53,0xae,0x99,0x29,0x8c,0x4c,0x8e,0x63,0x2e,0xd9,0x3a,0x99,0x31,0xfe,0x99,0x52,0x35,0x3d,0x44,0xc8,0x71,0xd7,0xea,0xeb,0xdb,0x1c,0x3b,0xcd,0x8b,0x66,0x94,0xa4,0xf1,0x9e,0x49,0x92,0x80,0xc8,0xad,0x44,0xa1,0xc4,0xee,0x42,0x19,0x92,0x49,0x23,0xae,0x19,0x53,0xac,0x7d,0x92,0x3e,0xea,0x0c,0x91,0x3d,0x1b,0x2c,0x22,0x11,0x3c,0x25,0x94,0xe4,0x3c,0x55,0x75,0xca,0xf9,0x4e,0x31,0x65,0x0a,0x2a},
+    {0xc2,0x27,0xf9,0xf7,0x7f,0x93,0xb7,0x2d,0x35,0xa6,0xd0,0x17,0x06,0x1f,0x74,0xdb,0x76,0xaf,0x55,0x11,0xa2,0xf3,0x82,0x59,0xed,0x2d,0x7c,0x64,0x18,0xe2,0xf6,0x4c,0x3a,0x79,0x1c,0x3c,0xcd,0x1a,0x36,0xcf,0x3b,0xbc,0x35,0x5a,0xac,0xbc,0x9e,0x2f,0xab,0xa6,0xcd,0xa8,0xe9,0x60,0xe8,0x60,0x13,0x1a,0xea,0x6d,0x9b,0xc3,0x5d,0x05,0xb6,0x5b,0x8d,0xc2,0x7c,0x22,0x19,0xb1,0xab,0xff,0x4d,0x77,0xbc,0x4e,0xe2,0x07,0x89,0x2c,0xa3,0xe4,0xce,0x78,0x3c,0xa8,0xb6,0x24,0xaa,0x10,0x77,0x30,0x1a,0x12},
+    {0x97,0x4a,0x03,0x9f,0x5e,0x5d,0xdb,0xe4,0x2d,0xbc,0x34,0x30,0x09,0xfc,0x53,0xe1,0xb1,0xd3,0x51,0x95,0x91,0x46,0x05,0x46,0x2d,0xe5,0x40,0x7a,0x6c,0xc7,0x3f,0x33,0xc9,0x83,0x74,0xc7,0x3e,0x71,0x59,0xd6,0xaf,0x96,0x2b,0xb8,0x77,0xe0,0xbf,0x88,0xd3,0xbc,0x97,0x10,0x23,0x28,0x9e,0x28,0x9b,0x3a,0xed,0x6c,0x4a,0xb9,0x7b,0x52,0x2e,0x48,0x5b,0x99,0x2a,0x99,0x3d,0x56,0x01,0x38,0x38,0x6e,0x7c,0xd0,0x05,0x34,0xe5,0xd8,0x64,0x2f,0xde,0x35,0x50,0x48,0xf7,0xa9,0xa7,0x20,0x9b,0x06,0x89,0x6b},
+    {0x0d,0x22,0x70,0x62,0x41,0xa0,0x2a,0x81,0x4e,0x5b,0x24,0xf9,0xfa,0x89,0x5a,0x99,0x05,0xef,0x72,0x50,0xce,0xc4,0xad,0xff,0x73,0xeb,0x73,0xaa,0x03,0x21,0xbc,0x23,0x77,0xdb,0xc7,0xb5,0x8c,0xfa,0x82,0x40,0x55,0xc1,0x34,0xc7,0xf8,0x86,0x86,0x06,0x7e,0xa5,0xe7,0xf6,0xd9,0xc8,0xe6,0x29,0xcf,0x9b,0x63,0xa7,0x08,0xd3,0x73,0x04,0x05,0x9e,0x58,0x03,0x26,0x79,0xee,0xca,0x92,0xc4,0xdc,0x46,0x12,0x42,0x4b,0x2b,0x4f,0xa9,0x01,0xe6,0x74,0xef,0xa1,0x02,0x1a,0x34,0x04,0xde,0xbf,0x73,0x2f,0x10},
+    {0xc6,0x45,0x57,0x7f,0xab,0xb9,0x18,0xeb,0x90,0xc6,0x87,0x57,0xee,0x8a,0x3a,0x02,0xa9,0xaf,0xf7,0x2d,0xda,0x12,0x27,0xb7,0x3d,0x01,0x5c,0xea,0x25,0x7d,0x59,0x36,0x9a,0x1c,0x51,0xb5,0xe0,0xda,0xb4,0xa2,0x06,0xff,0xff,0x2b,0x29,0x60,0xc8,0x7a,0x34,0x42,0x50,0xf5,0x5d,0x37,0x1f,0x98,0x2d,0xa1,0x4e,0xda,0x25,0xd7,0x6b,0x3f,0xac,0x58,0x60,0x10,0x7b,0x8d,0x4d,0x73,0x5f,0x90,0xc6,0x6f,0x9e,0x57,0x40,0xd9,0x2d,0x93,0x02,0x92,0xf9,0xf8,0x66,0x64,0xd0,0xd6,0x60,0xda,0x19,0xcc,0x7e,0x7b},
+    {0x0d,0x69,0x5c,0x69,0x3c,0x37,0xc2,0x78,0x6e,0x90,0x42,0x06,0x66,0x2e,0x25,0xdd,0xd2,0x2b,0xe1,0x4a,0x44,0x44,0x1d,0x95,0x56,0x39,0x74,0x01,0x76,0xad,0x35,0x42,0x9b,0xfa,0x7c,0xa7,0x51,0x4a,0xae,0x6d,0x50,0x86,0xa3,0xe7,0x54,0x36,0x26,0x82,0xdb,0x82,0x2d,0x8f,0xcd,0xff,0xbb,0x09,0xba,0xca,0xf5,0x1b,0x66,0xdc,0xbe,0x03,0xf5,0x75,0x89,0x07,0x0d,0xcb,0x58,0x62,0x98,0xf2,0x89,0x91,0x54,0x42,0x29,0x49,0xe4,0x6e,0xe3,0xe2,0x23,0xb4,0xca,0xa0,0xa1,0x66,0xf0,0xcd,0xb0,0xe2,0x7c,0x0e},
+    {0xa3,0x85,0x8c,0xc4,0x3a,0x64,0x94,0xc4,0xad,0x39,0x61,0x3c,0xf4,0x1d,0x36,0xfd,0x48,0x4d,0xe9,0x3a,0xdd,0x17,0xdb,0x09,0x4a,0x67,0xb4,0x8f,0x5d,0x0a,0x6e,0x66,0xf9,0x70,0x4b,0xd9,0xdf,0xfe,0xa6,0xfe,0x2d,0xba,0xfc,0xc1,0x51,0xc0,0x30,0xf1,0x89,0xab,0x2f,0x7f,0x7e,0xd4,0x82,0x48,0xb5,0xee,0xec,0x8a,0x13,0x56,0x52,0x61,0x0d,0xcb,0x70,0x48,0x4e,0xf6,0xbb,0x2a,0x6b,0x8b,0x45,0xaa,0xf0,0xbc,0x65,0xcd,0x5d,0x98,0xe8,0x75,0xba,0x4e,0xbe,0x9a,0xe4,0xde,0x14,0xd5,0x10,0xc8,0x0b,0x7f},
+    {0x6f,0x13,0xf4,0x26,0xa4,0x6b,0x00,0xb9,0x35,0x30,0xe0,0x57,0x9e,0x36,0x67,0x8d,0x28,0x3c,0x46,0x4f,0xd9,0xdf,0xc8,0xcb,0xf5,0xdb,0xee,0xf8,0xbc,0x8d,0x1f,0x0d,0xa0,0x13,0x72,0x73,0xad,0x9d,0xac,0x83,0x98,0x2e,0xf7,0x2e,0xba,0xf8,0xf6,0x9f,0x57,0x69,0xec,0x43,0xdd,0x2e,0x1e,0x31,0x75,0xab,0xc5,0xde,0x7d,0x90,0x3a,0x1d,0xdc,0x81,0xd0,0x3e,0x31,0x93,0x16,0xba,0x80,0x34,0x1b,0x85,0xad,0x9f,0x32,0x29,0xcb,0x21,0x03,0x03,0x3c,0x01,0x28,0x01,0xe3,0xfd,0x1b,0xa3,0x44,0x1b,0x01,0x00},
+    {0x0c,0x6c,0xc6,0x3f,0x6c,0xa0,0xdf,0x3f,0xd2,0x0d,0xd6,0x4d,0x8e,0xe3,0x40,0x5d,0x71,0x4d,0x8e,0x26,0x38,0x8b,0xe3,0x7a,0xe1,0x57,0x83,0x6e,0x91,0x8d,0xc4,0x3a,0x5c,0xa7,0x0a,0x6a,0x69,0x1f,0x56,0x16,0x6a,0xbd,0x52,0x58,0x5c,0x72,0xbf,0xc1,0xad,0x66,0x79,0x9a,0x7f,0xdd,0xa8,0x11,0x26,0x10,0x85,0xd2,0xa2,0x88,0xd9,0x63,0x2e,0x23,0xbd,0xaf,0x53,0x07,0x12,0x00,0x83,0xf6,0xd8,0xfd,0xb8,0xce,0x2b,0xe9,0x91,0x2b,0xe7,0x84,0xb3,0x69,0x16,0xf8,0x66,0xa0,0x68,0x23,0x2b,0xd5,0xfa,0x33},
+    {0x16,0x1e,0xe4,0xc5,0xc6,0x49,0x06,0x54,0x35,0x77,0x3f,0x33,0x30,0x64,0xf8,0x0a,0x46,0xe7,0x05,0xf3,0xd2,0xfc,0xac,0xb2,0xa7,0xdc,0x56,0xa2,0x29,0xf4,0xc0,0x16,0xe8,0xcf,0x22,0xc4,0xd0,0xc8,0x2c,0x8d,0xcb,0x3a,0xa1,0x05,0x7b,0x4f,0x2b,0x07,0x6f,0xa5,0xf6,0xec,0xe6,0xb6,0xfe,0xa3,0xe2,0x71,0x0a,0xb9,0xcc,0x55,0xc3,0x3c,0x31,0x91,0x3e,0x90,0x43,0x94,0xb6,0xe9,0xce,0x37,0x56,0x7a,0xcb,0x94,0xa4,0xb8,0x44,0x92,0xba,0xba,0xa4,0xd1,0x7c,0xc8,0x68,0x75,0xae,0x6b,0x42,0xaf,0x1e,0x63},
+    {0x9f,0xfe,0x66,0xda,0x10,0x04,0xe9,0xb3,0xa6,0xe5,0x16,0x6c,0x52,0x4b,0xdd,0x85,0x83,0xbf,0xf9,0x1e,0x61,0x97,0x3d,0xbc,0xb5,0x19,0xa9,0x1e,0x8b,0x64,0x99,0x55,0xe8,0x0d,0x70,0xa3,0xb9,0x75,0xd9,0x47,0x52,0x05,0xf8,0xe2,0xfb,0xc5,0x80,0x72,0xe1,0x5d,0xe4,0x32,0x27,0x8f,0x65,0x53,0xb5,0x80,0x5f,0x66,0x7f,0x2c,0x1f,0x43,0x19,0x7b,0x8f,0x85,0x44,0x63,0x02,0xd6,0x4a,0x51,0xea,0xa1,0x2f,0x35,0xab,0x14,0xd7,0xa9,0x90,0x20,0x1a,0x44,0x00,0x89,0x26,0x3b,0x25,0x91,0x5f,0x71,0x04,0x7b},
+    {0x43,0xae,0xf6,0xac,0x28,0xbd,0xed,0x83,0xb4,0x7a,0x5c,0x7d,0x8b,0x7c,0x35,0x86,0x44,0x2c,0xeb,0xb7,0x69,0x47,0x40,0xc0,0x3f,0x58,0xf6,0xc2,0xf5,0x7b,0xb3,0x59,0xc6,0xba,0xe6,0xc4,0x80,0xc2,0x76,0xb3,0x0b,0x9b,0x1d,0x6d,0xdd,0xd3,0x0e,0x97,0x44,0xf9,0x0b,0x45,0x58,0x95,0x9a,0xb0,0x23,0xe2,0xcd,0x57,0xfa,0xac,0xd0,0x48,0x71,0xe6,0xab,0x7d,0xe4,0x26,0x0f,0xb6,0x37,0x3a,0x2f,0x62,0x97,0xa1,0xd1,0xf1,0x94,0x03,0x96,0xe9,0x7e,0xce,0x08,0x42,0xdb,0x3b,0x6d,0x33,0x91,0x41,0x23,0x16},
+    {0xf6,0x7f,0x26,0xf6,0xde,0x99,0xe4,0xb9,0x43,0x08,0x2c,0x74,0x7b,0xca,0x72,0x77,0xb1,0xf2,0xa4,0xe9,0x3f,0x15,0xa0,0x23,0x06,0x50,0xd0,0xd5,0xec,0xdf,0xdf,0x2c,0x40,0x86,0xf3,0x1f,0xd6,0x9c,0x49,0xdd,0xa0,0x25,0x36,0x06,0xc3,0x9b,0xcd,0x29,0xc3,0x3d,0xd7,0x3d,0x02,0xd8,0xe2,0x51,0x31,0x92,0x3b,0x20,0x7a,0x70,0x25,0x4a,0x6a,0xed,0xf6,0x53,0x8a,0x66,0xb7,0x2a,0xa1,0x70,0xd1,0x1d,0x58,0x42,0x42,0x30,0x61,0x01,0xe2,0x3a,0x4c,0x14,0x00,0x40,0xfc,0x49,0x8e,0x24,0x6d,0x89,0x21,0x57},
+    {0xae,0x1b,0x18,0xfd,0x17,0x55,0x6e,0x0b,0xb4,0x63,0xb9,0x2b,0x9f,0x62,0x22,0x90,0x25,0x46,0x06,0x32,0xe9,0xbc,0x09,0x55,0xda,0x13,0x3c,0xf6,0x74,0xdd,0x8e,0x57,0x4e,0xda,0xd0,0xa1,0x91,0x50,0x5d,0x28,0x08,0x3e,0xfe,0xb5,0xa7,0x6f,0xaa,0x4b,0xb3,0x93,0x93,0xe1,0x7c,0x17,0xe5,0x63,0xfd,0x30,0xb0,0xc4,0xaf,0x35,0xc9,0x03,0x3d,0x0c,0x2b,0x49,0xc6,0x76,0x72,0x99,0xfc,0x05,0xe2,0xdf,0xc4,0xc2,0xcc,0x47,0x3c,0x3a,0x62,0xdd,0x84,0x9b,0xd2,0xdc,0xa2,0xc7,0x88,0x02,0x59,0xab,0xc2,0x3e},
+    {0xb9,0x7b,0xd8,0xe4,0x7b,0xd2,0xa0,0xa1,0xed,0x1a,0x39,0x61,0xeb,0x4d,0x8b,0xa9,0x83,0x9b,0xcb,0x73,0xd0,0xdd,0xa0,0x99,0xce,0xca,0x0f,0x20,0x5a,0xc2,0xd5,0x2d,0xcb,0xd1,0x32,0xae,0x09,0x3a,0x21,0xa7,0xd5,0xc2,0xf5,0x40,0xdf,0x87,0x2b,0x0f,0x29,0xab,0x1e,0xe8,0xc6,0xa4,0xae,0x0b,0x5e,0xac,0xdb,0x6a,0x6c,0xf6,0x1b,0x0e,0x7e,0x88,0x2c,0x79,0xe9,0xd5,0xab,0xe2,0x5d,0x6d,0x92,0xcb,0x18,0x00,0x02,0x1a,0x1e,0x5f,0xae,0xba,0xcd,0x69,0xba,0xbf,0x5f,0x8f,0xe8,0x5a,0xb3,0x48,0x05,0x73},
+    {0xee,0xb8,0xa8,0xcb,0xa3,0x51,0x35,0xc4,0x16,0x5f,0x11,0xb2,0x1d,0x6f,0xa2,0x65,0x50,0x38,0x8c,0xab,0x52,0x4f,0x0f,0x76,0xca,0xb8,0x1d,0x41,0x3b,0x44,0x43,0x30,0x34,0xe3,0xd6,0xa1,0x4b,0x09,0x5b,0x80,0x19,0x3f,0x35,0x09,0x77,0xf1,0x3e,0xbf,0x2b,0x70,0x22,0x06,0xcb,0x06,0x3f,0x42,0xdd,0x45,0x78,0xd8,0x77,0x22,0x5a,0x58,0x62,0x89,0xd4,0x33,0x82,0x5f,0x8a,0xa1,0x7f,0x25,0x78,0xec,0xb5,0xc4,0x98,0x66,0xff,0x41,0x3e,0x37,0xa5,0x6f,0x8e,0xa7,0x1f,0x98,0xef,0x50,0x89,0x27,0x56,0x76},
+    {0xc0,0xc8,0x1f,0xd5,0x59,0xcf,0xc3,0x38,0xf2,0xb6,0x06,0x05,0xfd,0xd2,0xed,0x9b,0x8f,0x0e,0x57,0xab,0x9f,0x10,0xbf,0x26,0xa6,0x46,0xb8,0xc1,0xa8,0x60,0x41,0x3f,0x9d,0xcf,0x86,0xea,0xa3,0x73,0x70,0xe1,0xdc,0x5f,0x15,0x07,0xb7,0xfb,0x8c,0x3a,0x8e,0x8a,0x83,0x31,0xfc,0xe7,0x53,0x48,0x16,0xf6,0x13,0xb6,0x84,0xf4,0xbb,0x28,0x7c,0x6c,0x13,0x6f,0x5c,0x2f,0x61,0xf2,0xbe,0x11,0xdd,0xf6,0x07,0xd1,0xea,0xaf,0x33,0x6f,0xde,0x13,0xd2,0x9a,0x7e,0x52,0x5d,0xf7,0x88,0x81,0x35,0xcb,0x79,0x1e},
+    {0xf1,0xe3,0xf7,0xee,0xc3,0x36,0x34,0x01,0xf8,0x10,0x9e,0xfe,0x7f,0x6a,0x8b,0x82,0xfc,0xde,0xf9,0xbc,0xe5,0x08,0xf9,0x7f,0x31,0x38,0x3b,0x3a,0x1b,0x95,0xd7,0x65,0x81,0x81,0xe0,0xf5,0xd8,0x53,0xe9,0x77,0xd9,0xde,0x9d,0x29,0x44,0x0c,0xa5,0x84,0xe5,0x25,0x45,0x86,0x0c,0x2d,0x6c,0xdc,0xf4,0xf2,0xd1,0x39,0x2d,0xb5,0x8a,0x47,0x59,0xd1,0x52,0x92,0xd3,0xa4,0xa6,0x66,0x07,0xc8,0x1a,0x87,0xbc,0xe1,0xdd,0xe5,0x6f,0xc9,0xc1,0xa6,0x40,0x6b,0x2c,0xb8,0x14,0x22,0x21,0x1a,0x41,0x7a,0xd8,0x16},
+    {0x15,0x62,0x06,0x42,0x5a,0x7e,0xbd,0xb3,0xc1,0x24,0x5a,0x0c,0xcd,0xe3,0x9b,0x87,0xb7,0x94,0xf9,0xd6,0xb1,0x5d,0xc0,0x57,0xa6,0x8c,0xf3,0x65,0x81,0x7c,0xf8,0x28,0x83,0x05,0x4e,0xd5,0xe2,0xd5,0xa4,0xfb,0xfa,0x99,0xbd,0x2e,0xd7,0xaf,0x1f,0xe2,0x8f,0x77,0xe9,0x6e,0x73,0xc2,0x7a,0x49,0xde,0x6d,0x5a,0x7a,0x57,0x0b,0x99,0x1f,0xd6,0xf7,0xe8,0x1b,0xad,0x4e,0x34,0xa3,0x8f,0x79,0xea,0xac,0xeb,0x50,0x1e,0x7d,0x52,0xe0,0x0d,0x52,0x9e,0x56,0xc6,0x77,0x3e,0x6d,0x4d,0x53,0xe1,0x2f,0x88,0x45},
+    {0xd6,0x83,0x79,0x75,0x5d,0x34,0x69,0x66,0xa6,0x11,0xaa,0x17,0x11,0xed,0xb6,0x62,0x8f,0x12,0x5e,0x98,0x57,0x18,0xdd,0x7d,0xdd,0xf6,0x26,0xf6,0xb8,0xe5,0x8f,0x68,0xe4,0x6f,0x3c,0x94,0x29,0x99,0xac,0xd8,0xa2,0x92,0x83,0xa3,0x61,0xf1,0xf9,0xb5,0xf3,0x9a,0xc8,0xbe,0x13,0xdb,0x99,0x26,0x74,0xf0,0x05,0xe4,0x3c,0x84,0xcf,0x7d,0xc0,0x32,0x47,0x4a,0x48,0xd6,0x90,0x6c,0x99,0x32,0x56,0xca,0xfd,0x43,0x21,0xd5,0xe1,0xc6,0x5d,0x91,0xc3,0x28,0xbe,0xb3,0x1b,0x19,0x27,0x73,0x7e,0x68,0x39,0x67},
+    {0xa6,0x75,0x56,0x38,0x14,0x20,0x78,0xef,0xe8,0xa9,0xfd,0xaa,0x30,0x9f,0x64,0xa2,0xcb,0xa8,0xdf,0x5c,0x50,0xeb,0xd1,0x4c,0xb3,0xc0,0x4d,0x1d,0xba,0x5a,0x11,0x46,0xc0,0x1a,0x0c,0xc8,0x9d,0xcc,0x6d,0xa6,0x36,0xa4,0x38,0x1b,0xf4,0x5c,0xa0,0x97,0xc6,0xd7,0xdb,0x95,0xbe,0xf3,0xeb,0xa7,0xab,0x7d,0x7e,0x8d,0xf6,0xb8,0xa0,0x7d,0x76,0xda,0xb5,0xc3,0x53,0x19,0x0f,0xd4,0x9b,0x9e,0x11,0x21,0x73,0x6f,0xac,0x1d,0x60,0x59,0xb2,0xfe,0x21,0x60,0xcc,0x03,0x4b,0x4b,0x67,0x83,0x7e,0x88,0x5f,0x5a},
+    {0x11,0x3d,0xa1,0x70,0xcf,0x01,0x63,0x8f,0xc4,0xd0,0x0d,0x35,0x15,0xb8,0xce,0xcf,0x7e,0xa4,0xbc,0xa4,0xd4,0x97,0x02,0xf7,0x34,0x14,0x4d,0xe4,0x56,0xb6,0x69,0x36,0xb9,0x43,0xa6,0xa0,0xd3,0x28,0x96,0x9e,0x64,0x20,0xc3,0xe6,0x00,0xcb,0xc3,0xb5,0x32,0xec,0x2d,0x7c,0x89,0x02,0x53,0x9b,0x0c,0xc7,0xd1,0xd5,0xe2,0x7a,0xe3,0x43,0x33,0xe1,0xa6,0xed,0x06,0x3f,0x7e,0x38,0xc0,0x3a,0xa1,0x99,0x51,0x1d,0x30,0x67,0x11,0x38,0x26,0x36,0xf8,0xd8,0x5a,0xbd,0xbe,0xe9,0xd5,0x4f,0xcd,0xe6,0x21,0x6a},
+    {0x5f,0xe6,0x46,0x30,0x0a,0x17,0xc6,0xf1,0x24,0x35,0xd2,0x00,0x2a,0x2a,0x71,0x58,0x55,0xb7,0x82,0x8c,0x3c,0xbd,0xdb,0x69,0x57,0xff,0x95,0xa1,0xf1,0xf9,0x6b,0x58,0xe3,0xb2,0x99,0x66,0x12,0x29,0x41,0xef,0x01,0x13,0x8d,0x70,0x47,0x08,0xd3,0x71,0xbd,0xb0,0x82,0x11,0xd0,0x32,0x54,0x32,0x36,0x8b,0x1e,0x00,0x07,0x1b,0x37,0x45,0x0b,0x79,0xf8,0x5e,0x8d,0x08,0xdb,0xa6,0xe5,0x37,0x09,0x61,0xdc,0xf0,0x78,0x52,0xb8,0x6e,0xa1,0x61,0xd2,0x49,0x03,0xac,0x79,0x21,0xe5,0x90,0x37,0xb0,0xaf,0x0e},
+    {0x2f,0x04,0x48,0x37,0xc1,0x55,0x05,0x96,0x11,0xaa,0x0b,0x82,0xe6,0x41,0x9a,0x21,0x0c,0x6d,0x48,0x73,0x38,0xf7,0x81,0x1c,0x61,0xc6,0x02,0x5a,0x67,0xcc,0x9a,0x30,0x1d,0xae,0x75,0x0f,0x5e,0x80,0x40,0x51,0x30,0xcc,0x62,0x26,0xe3,0xfb,0x02,0xec,0x6d,0x39,0x92,0xea,0x1e,0xdf,0xeb,0x2c,0xb3,0x5b,0x43,0xc5,0x44,0x33,0xae,0x44,0xee,0x43,0xa5,0xbb,0xb9,0x89,0xf2,0x9c,0x42,0x71,0xc9,0x5a,0x9d,0x0e,0x76,0xf3,0xaa,0x60,0x93,0x4f,0xc6,0xe5,0x82,0x1d,0x8f,0x67,0x94,0x7f,0x1b,0x22,0xd5,0x62},
+    {0x6d,0x93,0xd0,0x18,0x9c,0x29,0x4c,0x52,0x0c,0x1a,0x0c,0x8a,0x6c,0xb5,0x6b,0xc8,0x31,0x86,0x4a,0xdb,0x2e,0x05,0x75,0xa3,0x62,0x45,0x75,0xbc,0xe4,0xfd,0x0e,0x5c,0x3c,0x7a,0xf7,0x3a,0x26,0xd4,0x85,0x75,0x4d,0x14,0xe9,0xfe,0x11,0x7b,0xae,0xdf,0x3d,0x19,0xf7,0x59,0x80,0x70,0x06,0xa5,0x37,0x20,0x92,0x83,0x53,0x9a,0xf2,0x14,0xf5,0xd7,0xb2,0x25,0xdc,0x7e,0x71,0xdf,0x40,0x30,0xb5,0x99,0xdb,0x70,0xf9,0x21,0x62,0x4c,0xed,0xc3,0xb7,0x34,0x92,0xda,0x3e,0x09,0xee,0x7b,0x5c,0x36,0x72,0x5e},
+    {0x7f,0x21,0x71,0x45,0x07,0xfc,0x5b,0x57,0x5b,0xd9,0x94,0x06,0x5d,0x67,0x79,0x37,0x33,0x1e,0x19,0xf4,0xbb,0x37,0x0a,0x9a,0xbc,0xea,0xb4,0x47,0x4c,0x10,0xf1,0x77,0x3e,0xb3,0x08,0x2f,0x06,0x39,0x93,0x7d,0xbe,0x32,0x9f,0xdf,0xe5,0x59,0x96,0x5b,0xfd,0xbd,0x9e,0x1f,0xad,0x3d,0xff,0xac,0xb7,0x49,0x73,0xcb,0x55,0x05,0xb2,0x70,0x4c,0x2c,0x11,0x55,0xc5,0x13,0x51,0xbe,0xcd,0x1f,0x88,0x9a,0x3a,0x42,0x88,0x66,0x47,0x3b,0x50,0x5e,0x85,0x77,0x66,0x44,0x4a,0x40,0x06,0x4a,0x8f,0x39,0x34,0x0e},
+    {0xe8,0xbd,0xce,0x3e,0xd9,0x22,0x7d,0xb6,0x07,0x2f,0x82,0x27,0x41,0xe8,0xb3,0x09,0x8d,0x6d,0x5b,0xb0,0x1f,0xa6,0x3f,0x74,0x72,0x23,0x36,0x8a,0x36,0x05,0x54,0x5e,0x28,0x19,0x4b,0x3e,0x09,0x0b,0x93,0x18,0x40,0xf6,0xf3,0x73,0x0e,0xe1,0xe3,0x7d,0x6f,0x5d,0x39,0x73,0xda,0x17,0x32,0xf4,0x3e,0x9c,0x37,0xca,0xd6,0xde,0x8a,0x6f,0x9a,0xb2,0xb7,0xfd,0x3d,0x12,0x40,0xe3,0x91,0xb2,0x1a,0xa2,0xe1,0x97,0x7b,0x48,0x9e,0x94,0xe6,0xfd,0x02,0x7d,0x96,0xf9,0x97,0xde,0xd3,0xc8,0x2e,0xe7,0x0d,0x78},
+    {0xbc,0xe7,0x9a,0x08,0x45,0x85,0xe2,0x0a,0x06,0x4d,0x7f,0x1c,0xcf,0xde,0x8d,0x38,0xb8,0x11,0x48,0x0a,0x51,0x15,0xac,0x38,0xe4,0x8c,0x92,0x71,0xf6,0x8b,0xb2,0x0e,0x72,0x27,0xf4,0x00,0xf3,0xea,0x1f,0x67,0xaa,0x41,0x8c,0x2a,0x2a,0xeb,0x72,0x8f,0x92,0x32,0x37,0x97,0xd7,0x7f,0xa1,0x29,0xa6,0x87,0xb5,0x32,0xad,0xc6,0xef,0x1d,0xa7,0x95,0x51,0xef,0x1a,0xbe,0x5b,0xaf,0xed,0x15,0x7b,0x91,0x77,0x12,0x8c,0x14,0x2e,0xda,0xe5,0x7a,0xfb,0xf7,0x91,0x29,0x67,0x28,0xdd,0xf8,0x1b,0x20,0x7d,0x46},
+    {0xad,0x4f,0xef,0x74,0x9a,0x91,0xfe,0x95,0xa2,0x08,0xa3,0xf6,0xec,0x7b,0x82,0x3a,0x01,0x7b,0xa4,0x09,0xd3,0x01,0x4e,0x96,0x97,0xc7,0xa3,0x5b,0x4f,0x3c,0xc4,0x71,0xa9,0xe7,0x7a,0x56,0xbd,0xf4,0x1e,0xbc,0xbd,0x98,0x44,0xd6,0xb2,0x4c,0x62,0x3f,0xc8,0x4e,0x1f,0x2c,0xd2,0x64,0x10,0xe4,0x01,0x40,0x38,0xba,0xa5,0xc5,0xf9,0x2e,0xcd,0x74,0x9e,0xfa,0xf6,0x6d,0xfd,0xb6,0x7a,0x26,0xaf,0xe4,0xbc,0x78,0x82,0xf1,0x0e,0x99,0xef,0xf1,0xd0,0xb3,0x55,0x82,0x93,0xf2,0xc5,0x90,0xa3,0x8c,0x75,0x5a},
+    {0x95,0x24,0x46,0xd9,0x10,0x27,0xb7,0xa2,0x03,0x50,0x7d,0xd5,0xd2,0xc6,0xa8,0x3a,0xca,0x87,0xb4,0xa0,0xbf,0x00,0xd4,0xe3,0xec,0x72,0xeb,0xb3,0x44,0xe2,0xba,0x2d,0x94,0xdc,0x61,0x1d,0x8b,0x91,0xe0,0x8c,0x66,0x30,0x81,0x9a,0x46,0x36,0xed,0x8d,0xd3,0xaa,0xe8,0xaf,0x29,0xa8,0xe6,0xd4,0x3f,0xd4,0x39,0xf6,0x27,0x80,0x73,0x0a,0xcc,0xe1,0xff,0x57,0x2f,0x4a,0x0f,0x98,0x43,0x98,0x83,0xe1,0x0d,0x0d,0x67,0x00,0xfd,0x15,0xfb,0x49,0x4a,0x3f,0x5c,0x10,0x9c,0xa6,0x26,0x51,0x63,0xca,0x98,0x26},
+    {0x78,0xba,0xb0,0x32,0x88,0x31,0x65,0xe7,0x8b,0xff,0x5c,0x92,0xf7,0x31,0x18,0x38,0xcc,0x1f,0x29,0xa0,0x91,0x1b,0xa8,0x08,0x07,0xeb,0xca,0x49,0xcc,0x3d,0xb4,0x1f,0x0e,0xd9,0x3d,0x5e,0x2f,0x70,0x3d,0x2e,0x86,0x53,0xd2,0xe4,0x18,0x09,0x3f,0x9e,0x6a,0xa9,0x4d,0x02,0xf6,0x3e,0x77,0x5e,0x32,0x33,0xfa,0x4a,0x0c,0x4b,0x00,0x3c,0x2b,0xb8,0xf4,0x06,0xac,0x46,0xa9,0x9a,0xf3,0xc4,0x06,0xa8,0xa5,0x84,0xa2,0x1c,0x87,0x47,0xcd,0xc6,0x5f,0x26,0xd3,0x3e,0x17,0xd2,0x1f,0xcd,0x01,0xfd,0x43,0x6b},
+    {0x44,0xc5,0x97,0x46,0x4b,0x5d,0xa7,0xc7,0xbf,0xff,0x0f,0xdf,0x48,0xf8,0xfd,0x15,0x5a,0x78,0x46,0xaa,0xeb,0xb9,0x68,0x28,0x14,0xf7,0x52,0x5b,0x10,0xd7,0x68,0x5a,0xf3,0x0e,0x76,0x3e,0x58,0x42,0xc7,0xb5,0x90,0xb9,0x0a,0xee,0xb9,0x52,0xdc,0x75,0x3f,0x92,0x2b,0x07,0xc2,0x27,0x14,0xbf,0xf0,0xd9,0xf0,0x6f,0x2d,0x0b,0x42,0x73,0x06,0x1e,0x85,0x9e,0xcb,0xf6,0x2c,0xaf,0xc4,0x38,0x22,0xc6,0x13,0x39,0x59,0x8f,0x73,0xf3,0xfb,0x99,0x96,0xb8,0x8a,0xda,0x9e,0xbc,0x34,0xea,0x2f,0x63,0xb5,0x3d},
+    {0xd8,0xd9,0x5d,0xf7,0x2b,0xee,0x6e,0xf4,0xa5,0x59,0x67,0x39,0xf6,0xb1,0x17,0x0d,0x73,0x72,0x9e,0x49,0x31,0xd1,0xf2,0x1b,0x13,0x5f,0xd7,0x49,0xdf,0x1a,0x32,0x04,0xd5,0x25,0x98,0x82,0xb1,0x90,0x49,0x2e,0x91,0x89,0x9a,0x3e,0x87,0xeb,0xea,0xed,0xf8,0x4a,0x70,0x4c,0x39,0x3d,0xf0,0xee,0x0e,0x2b,0xdf,0x95,0xa4,0x7e,0x19,0x59,0xae,0x5a,0xe5,0xe4,0x19,0x60,0xe1,0x04,0xe9,0x92,0x2f,0x7e,0x7a,0x43,0x7b,0xe7,0xa4,0x9a,0x15,0x6f,0xc1,0x2d,0xce,0xc7,0xc0,0x0c,0xd7,0xf4,0xc1,0xfd,0xea,0x45},
+    {0x2b,0xd7,0x45,0x80,0x85,0x01,0x84,0x69,0x51,0x06,0x2f,0xcf,0xa2,0xfa,0x22,0x4c,0xc6,0x2d,0x22,0x6b,0x65,0x36,0x1a,0x94,0xde,0xda,0x62,0x03,0xc8,0xeb,0x5e,0x5a,0xed,0xb1,0xcc,0xcf,0x24,0x46,0x0e,0xb6,0x95,0x03,0x5c,0xbd,0x92,0xc2,0xdb,0x59,0xc9,0x81,0x04,0xdc,0x1d,0x9d,0xa0,0x31,0x40,0xd9,0x56,0x5d,0xea,0xce,0x73,0x3f,0xc6,0x8d,0x4e,0x0a,0xd1,0xbf,0xa7,0xb7,0x39,0xb3,0xc9,0x44,0x7e,0x00,0x57,0xbe,0xfa,0xae,0x57,0x15,0x7f,0x20,0xc1,0x60,0xdb,0x18,0x62,0x26,0x91,0x88,0x05,0x26},
+    {0x04,0xff,0x60,0x83,0xa6,0x04,0xf7,0x59,0xf4,0xe6,0x61,0x76,0xde,0x3f,0xd9,0xc3,0x51,0x35,0x87,0x12,0x73,0x2a,0x1b,0x83,0x57,0x5d,0x61,0x4e,0x2e,0x0c,0xad,0x54,0x42,0xe5,0x76,0xc6,0x3c,0x8e,0x81,0x4c,0xad,0xcc,0xce,0x03,0x93,0x2c,0x42,0x5e,0x08,0x9f,0x12,0xb4,0xca,0xcc,0x07,0xec,0xb8,0x43,0x44,0xb2,0x10,0xfa,0xed,0x0d,0x2a,0x52,0x2b,0xb8,0xd5,0x67,0x3b,0xee,0xeb,0xc1,0xa5,0x9f,0x46,0x63,0xf1,0x36,0xd3,0x9f,0xc1,0x6e,0xf2,0xd2,0xb4,0xa5,0x08,0x94,0x7a,0xa7,0xba,0xb2,0xec,0x62},
+    {0x3d,0x2b,0x15,0x61,0x52,0x79,0xed,0xe5,0xd1,0xd7,0xdd,0x0e,0x7d,0x35,0x62,0x49,0x71,0x4c,0x6b,0xb9,0xd0,0xc8,0x82,0x74,0xbe,0xd8,0x66,0xa9,0x19,0xf9,0x59,0x2e,0x74,0x28,0xb6,0xaf,0x36,0x28,0x07,0x92,0xa5,0x04,0xe1,0x79,0x85,0x5e,0xcd,0x5f,0x4a,0xa1,0x30,0xc6,0xad,0x01,0xad,0x5a,0x98,0x3f,0x66,0x75,0x50,0x3d,0x91,0x61,0xda,0x31,0x32,0x1a,0x36,0x2d,0xc6,0x0d,0x70,0x02,0x20,0x94,0x32,0x58,0x47,0xfa,0xce,0x94,0x95,0x3f,0x51,0x01,0xd8,0x02,0x5c,0x5d,0xc0,0x31,0xa1,0xc2,0xdb,0x3d},
+    {0x4b,0xc5,0x5e,0xce,0xf9,0x0f,0xdc,0x9a,0x0d,0x13,0x2f,0x8c,0x6b,0x2a,0x9c,0x03,0x15,0x95,0xf8,0xf0,0xc7,0x07,0x80,0x02,0x6b,0xb3,0x04,0xac,0x14,0x83,0x96,0x78,0x14,0xbb,0x96,0x27,0xa2,0x57,0xaa,0xf3,0x21,0xda,0x07,0x9b,0xb7,0xba,0x3a,0x88,0x1c,0x39,0xa0,0x31,0x18,0xe2,0x4b,0xe5,0xf9,0x05,0x32,0xd8,0x38,0xfb,0xe7,0x5e,0x8e,0x6a,0x44,0x41,0xcb,0xfd,0x8d,0x53,0xf9,0x37,0x49,0x43,0xa9,0xfd,0xac,0xa5,0x78,0x8c,0x3c,0x26,0x8d,0x90,0xaf,0x46,0x09,0x0d,0xca,0x9b,0x3c,0x63,0xd0,0x61},
+    {0x66,0x25,0xdb,0xff,0x35,0x49,0x74,0x63,0xbb,0x68,0x0b,0x78,0x89,0x6b,0xbd,0xc5,0x03,0xec,0x3e,0x55,0x80,0x32,0x1b,0x6f,0xf5,0xd7,0xae,0x47,0xd8,0x5f,0x96,0x6e,0xdf,0x73,0xfc,0xf8,0xbc,0x28,0xa3,0xad,0xfc,0x37,0xf0,0xa6,0x5d,0x69,0x84,0xee,0x09,0xa9,0xc2,0x38,0xdb,0xb4,0x7f,0x63,0xdc,0x7b,0x06,0xf8,0x2d,0xac,0x23,0x5b,0x7b,0x52,0x80,0xee,0x53,0xb9,0xd2,0x9a,0x8d,0x6d,0xde,0xfa,0xaa,0x19,0x8f,0xe8,0xcf,0x82,0x0e,0x15,0x04,0x17,0x71,0x0e,0xdc,0xde,0x95,0xdd,0xb9,0xbb,0xb9,0x79},
+    {0xc2,0x26,0x31,0x6a,0x40,0x55,0xb3,0xeb,0x93,0xc3,0xc8,0x68,0xa8,0x83,0x63,0xd2,0x82,0x7a,0xb9,0xe5,0x29,0x64,0x0c,0x6c,0x47,0x21,0xfd,0xc9,0x58,0xf1,0x65,0x50,0x74,0x73,0x9f,0x8e,0xae,0x7d,0x99,0xd1,0x16,0x08,0xbb,0xcf,0xf8,0xa2,0x32,0xa0,0x0a,0x5f,0x44,0x6d,0x12,0xba,0x6c,0xcd,0x34,0xb8,0xcc,0x0a,0x46,0x11,0xa8,0x1b,0x54,0x99,0x42,0x0c,0xfb,0x69,0x81,0x70,0x67,0xcf,0x6e,0xd7,0xac,0x00,0x46,0xe1,0xba,0x45,0xe6,0x70,0x8a,0xb9,0xaa,0x2e,0xf2,0xfa,0xa4,0x58,0x9e,0xf3,0x81,0x39},
+    {0x93,0x0a,0x23,0x59,0x75,0x8a,0xfb,0x18,0x5d,0xf4,0xe6,0x60,0x69,0x8f,0x16,0x1d,0xb5,0x3c,0xa9,0x14,0x45,0xa9,0x85,0x3a,0xfd,0xd0,0xac,0x05,0x37,0x08,0xdc,0x38,0xde,0x6f,0xe6,0x6d,0xa5,0xdf,0x45,0xc8,0x3a,0x48,0x40,0x2c,0x00,0xa5,0x52,0xe1,0x32,0xf6,0xb4,0xc7,0x63,0xe1,0xd2,0xe9,0x65,0x1b,0xbc,0xdc,0x2e,0x45,0xf4,0x30,0x40,0x97,0x75,0xc5,0x82,0x27,0x6d,0x85,0xcc,0xbe,0x9c,0xf9,0x69,0x45,0x13,0xfa,0x71,0x4e,0xea,0xc0,0x73,0xfc,0x44,0x88,0x69,0x24,0x3f,0x59,0x1a,0x9a,0x2d,0x63},
+    {0xa6,0xcb,0x07,0xb8,0x15,0x6b,0xbb,0xf6,0xd7,0xf0,0x54,0xbc,0xdf,0xc7,0x23,0x18,0x0b,0x67,0x29,0x6e,0x03,0x97,0x1d,0xbb,0x57,0x4a,0xed,0x47,0x88,0xf4,0x24,0x0b,0xa7,0x84,0x0c,0xed,0x11,0xfd,0x09,0xbf,0x3a,0x69,0x9f,0x0d,0x81,0x71,0xf0,0x63,0x79,0x87,0xcf,0x57,0x2d,0x8c,0x90,0x21,0xa2,0x4b,0xf6,0x8a,0xf2,0x7d,0x5a,0x3a,0xc7,0xea,0x1b,0x51,0xbe,0xd4,0xda,0xdc,0xf2,0xcc,0x26,0xed,0x75,0x80,0x53,0xa4,0x65,0x9a,0x5f,0x00,0x9f,0xff,0x9c,0xe1,0x63,0x1f,0x48,0x75,0x44,0xf7,0xfc,0x34},
+    {0xca,0x67,0x97,0x78,0x4c,0xe0,0x97,0xc1,0x7d,0x46,0xd9,0x38,0xcb,0x4d,0x71,0xb8,0xa8,0x5f,0xf9,0x83,0x82,0x88,0xde,0x55,0xf7,0x63,0xfa,0x4d,0x16,0xdc,0x3b,0x3d,0x98,0xaa,0xcf,0x78,0xab,0x1d,0xbb,0xa5,0xf2,0x72,0x0b,0x19,0x67,0xa2,0xed,0x5c,0x8e,0x60,0x92,0x0a,0x11,0xc9,0x09,0x93,0xb0,0x74,0xb3,0x2f,0x04,0xa3,0x19,0x01,0x7d,0x17,0xc2,0xe8,0x9c,0xd8,0xa2,0x67,0xc1,0xd0,0x95,0x68,0xf6,0xa5,0x9d,0x66,0xb0,0xa2,0x82,0xb2,0xe5,0x98,0x65,0xf5,0x73,0x0a,0xe2,0xed,0xf1,0x88,0xc0,0x56},
+    {0x17,0x6e,0xa8,0x10,0x11,0x3d,0x6d,0x33,0xfa,0xb2,0x75,0x0b,0x32,0x88,0xf3,0xd7,0x88,0x29,0x07,0x25,0x76,0x33,0x15,0xf9,0x87,0x8b,0x10,0x99,0x6b,0x4c,0x67,0x09,0x02,0x8f,0xf3,0x24,0xac,0x5f,0x1b,0x58,0xbd,0x0c,0xe3,0xba,0xfe,0xe9,0x0b,0xa9,0xf0,0x92,0xcf,0x8a,0x02,0x69,0x21,0x9a,0x8f,0x03,0x59,0x83,0xa4,0x7e,0x8b,0x03,0xf8,0x6f,0x31,0x99,0x21,0xf8,0x4e,0x9f,0x4f,0x8d,0xa7,0xea,0x82,0xd2,0x49,0x2f,0x74,0x31,0xef,0x5a,0xab,0xa5,0x71,0x09,0x65,0xeb,0x69,0x59,0x02,0x31,0x5e,0x6e},
+    {0xfb,0x93,0xe5,0x87,0xf5,0x62,0x6c,0xb1,0x71,0x3e,0x5d,0xca,0xde,0xed,0x99,0x49,0x6d,0x3e,0xcc,0x14,0xe0,0xc1,0x91,0xb4,0xa8,0xdb,0xa8,0x89,0x47,0x11,0xf5,0x08,0x22,0x62,0x06,0x63,0x0e,0xfb,0x04,0x33,0x3f,0xba,0xac,0x87,0x89,0x06,0x35,0xfb,0xa3,0x61,0x10,0x8c,0x77,0x24,0x19,0xbd,0x20,0x86,0x83,0xd1,0x43,0xad,0x58,0x30,0xd0,0x63,0x76,0xe5,0xfd,0x0f,0x3c,0x32,0x10,0xa6,0x2e,0xa2,0x38,0xdf,0xc3,0x05,0x9a,0x4f,0x99,0xac,0xbd,0x8a,0xc7,0xbd,0x99,0xdc,0xe3,0xef,0xa4,0x9f,0x54,0x26},
+    {0xd6,0xf9,0x6b,0x1e,0x46,0x5a,0x1d,0x74,0x81,0xa5,0x77,0x77,0xfc,0xb3,0x05,0x23,0xd9,0xd3,0x74,0x64,0xa2,0x74,0x55,0xd4,0xff,0xe0,0x01,0x64,0xdc,0xe1,0x26,0x19,0x6e,0x66,0x3f,0xaf,0x49,0x85,0x46,0xdb,0xa5,0x0e,0x4a,0xf1,0x04,0xcf,0x7f,0xd7,0x47,0x0c,0xba,0xa4,0xf7,0x3f,0xf2,0x3d,0x85,0x3c,0xce,0x32,0xe1,0xdf,0x10,0x3a,0xa0,0xce,0x17,0xea,0x8a,0x4e,0x7f,0xe0,0xfd,0xc1,0x1f,0x3a,0x46,0x15,0xd5,0x2f,0xf1,0xc0,0xf2,0x31,0xfd,0x22,0x53,0x17,0x15,0x5d,0x1e,0x86,0x1d,0xd0,0xa1,0x1f},
+    {0x32,0x98,0x59,0x7d,0x94,0x55,0x80,0xcc,0x20,0x55,0xf1,0x37,0xda,0x56,0x46,0x1e,0x20,0x93,0x05,0x4e,0x74,0xf7,0xf6,0x99,0x33,0xcf,0x75,0x6a,0xbc,0x63,0x35,0x77,0xab,0x94,0xdf,0xd1,0x00,0xac,0xdc,0x38,0xe9,0x0d,0x08,0xd1,0xdd,0x2b,0x71,0x2e,0x62,0xe2,0xd5,0xfd,0x3e,0xe9,0x13,0x7f,0xe5,0x01,0x9a,0xee,0x18,0xed,0xfc,0x73,0xb3,0x9c,0x13,0x63,0x08,0xe9,0xb1,0x06,0xcd,0x3e,0xa0,0xc5,0x67,0xda,0x93,0xa4,0x32,0x89,0x63,0xad,0xc8,0xce,0x77,0x8d,0x44,0x4f,0x86,0x1b,0x70,0x6b,0x42,0x1f},
+    {0x01,0x1c,0x91,0x41,0x4c,0x26,0xc9,0xef,0x25,0x2c,0xa2,0x17,0xb8,0xb7,0xa3,0xf1,0x47,0x14,0x0f,0xf3,0x6b,0xda,0x75,0x58,0x90,0xb0,0x31,0x1d,0x27,0xf5,0x1a,0x4e,0x52,0x25,0xa1,0x91,0xc8,0x35,0x7e,0xf1,0x76,0x9c,0x5e,0x57,0x53,0x81,0x6b,0xb7,0x3e,0x72,0x9b,0x0d,0x6f,0x40,0x83,0xfa,0x38,0xe4,0xa7,0x3f,0x1b,0xbb,0x76,0x0b,0x9b,0x93,0x92,0x7f,0xf9,0xc1,0xb8,0x08,0x6e,0xab,0x44,0xd4,0xcb,0x71,0x67,0xbe,0x17,0x80,0xbb,0x99,0x63,0x64,0xe5,0x22,0x55,0xa9,0x72,0xb7,0x1e,0xd6,0x6d,0x7b},
+    {0x92,0x3d,0xf3,0x50,0xe8,0xc1,0xad,0xb7,0xcf,0xd5,0x8c,0x60,0x4f,0xfa,0x98,0x79,0xdb,0x5b,0xfc,0x8d,0xbd,0x2d,0x96,0xad,0x4f,0x2f,0x1d,0xaf,0xce,0x9b,0x3e,0x70,0xc7,0xd2,0x01,0xab,0xf9,0xab,0x30,0x57,0x18,0x3b,0x14,0x40,0xdc,0x76,0xfb,0x16,0x81,0xb2,0xcb,0xa0,0x65,0xbe,0x6c,0x86,0xfe,0x6a,0xff,0x9b,0x65,0x9b,0xfa,0x53,0x55,0x54,0x88,0x94,0xe9,0xc8,0x14,0x6c,0xe5,0xd4,0xae,0x65,0x66,0x5d,0x3a,0x84,0xf1,0x5a,0xd6,0xbc,0x3e,0xb7,0x1b,0x18,0x50,0x1f,0xc6,0xc4,0xe5,0x93,0x8d,0x39},
+    {0xf3,0x48,0xe2,0x33,0x67,0xd1,0x4b,0x1c,0x5f,0x0a,0xbf,0x15,0x87,0x12,0x9e,0xbd,0x76,0x03,0x0b,0xa1,0xf0,0x8c,0x3f,0xd4,0x13,0x1b,0x19,0xdf,0x5d,0x9b,0xb0,0x53,0xf2,0xe3,0xe7,0xd2,0x60,0x7c,0x87,0xc3,0xb1,0x8b,0x82,0x30,0xa0,0xaa,0x34,0x3b,0x38,0xf1,0x9e,0x73,0xe7,0x26,0x3e,0x28,0x77,0x05,0xc3,0x02,0x90,0x9c,0x9c,0x69,0xcc,0xf1,0x46,0x59,0x23,0xa7,0x06,0xf3,0x7d,0xd9,0xe5,0xcc,0xb5,0x18,0x17,0x92,0x75,0xe9,0xb4,0x81,0x47,0xd2,0xcd,0x28,0x07,0xd9,0xcd,0x6f,0x0c,0xf3,0xca,0x51},
+    {0x0a,0xe0,0x74,0x76,0x42,0xa7,0x0b,0xa6,0xf3,0x7b,0x7a,0xa1,0x70,0x85,0x0e,0x63,0xcc,0x24,0x33,0xcf,0x3d,0x56,0x58,0x37,0xaa,0xfd,0x83,0x23,0x29,0xaa,0x04,0x55,0xc7,0x54,0xac,0x18,0x9a,0xf9,0x7a,0x73,0x0f,0xb3,0x1c,0xc5,0xdc,0x78,0x33,0x90,0xc7,0x0c,0xe1,0x4c,0x33,0xbc,0x89,0x2b,0x9a,0xe9,0xf8,0x89,0xc1,0x29,0xae,0x12,0xcf,0x01,0x0d,0x1f,0xcb,0xc0,0x9e,0xa9,0xae,0xf7,0x34,0x3a,0xcc,0xef,0xd1,0x0d,0x22,0x4e,0x9c,0xd0,0x21,0x75,0xca,0x55,0xea,0xa5,0xeb,0x58,0xe9,0x4f,0xd1,0x5f},
+    {0x2c,0xab,0x45,0x28,0xdf,0x2d,0xdc,0xb5,0x93,0xe9,0x7f,0x0a,0xb1,0x91,0x94,0x06,0x46,0xe3,0x02,0x40,0xd6,0xf3,0xaa,0x4d,0xd1,0x74,0x64,0x58,0x6e,0xf2,0x3f,0x09,0x8e,0xcb,0x93,0xbf,0x5e,0xfe,0x42,0x3c,0x5f,0x56,0xd4,0x36,0x51,0xa8,0xdf,0xbe,0xe8,0x20,0x42,0x88,0x9e,0x85,0xf0,0xe0,0x28,0xd1,0x25,0x07,0x96,0x3f,0xd7,0x7d,0x29,0x98,0x05,0x68,0xfe,0x24,0x0d,0xb1,0xe5,0x23,0xaf,0xdb,0x72,0x06,0x73,0x75,0x29,0xac,0x57,0xb4,0x3a,0x25,0x67,0x13,0xa4,0x70,0xb4,0x86,0xbc,0xbc,0x59,0x2f},
+    {0x5f,0x13,0x17,0x99,0x42,0x7d,0x84,0x83,0xd7,0x03,0x7d,0x56,0x1f,0x91,0x1b,0xad,0xd1,0xaa,0x77,0xbe,0xd9,0x48,0x77,0x7e,0x4a,0xaf,0x51,0x2e,0x2e,0xb4,0x58,0x54,0x01,0xc3,0x91,0xb6,0x60,0xd5,0x41,0x70,0x1e,0xe7,0xd7,0xad,0x3f,0x1b,0x20,0x85,0x85,0x55,0x33,0x11,0x63,0xe1,0xc2,0x16,0xb1,0x28,0x08,0x01,0x3d,0x5e,0xa5,0x2a,0x4f,0x44,0x07,0x0c,0xe6,0x92,0x51,0xed,0x10,0x1d,0x42,0x74,0x2d,0x4e,0xc5,0x42,0x64,0xc8,0xb5,0xfd,0x82,0x4c,0x2b,0x35,0x64,0x86,0x76,0x8a,0x4a,0x00,0xe9,0x13},
+    {0xdb,0xce,0x2f,0x83,0x45,0x88,0x9d,0x73,0x63,0xf8,0x6b,0xae,0xc9,0xd6,0x38,0xfa,0xf7,0xfe,0x4f,0xb7,0xca,0x0d,0xbc,0x32,0x5e,0xe4,0xbc,0x14,0x88,0x7e,0x93,0x73,0x7f,0x87,0x3b,0x19,0xc9,0x00,0x2e,0xbb,0x6b,0x50,0xdc,0xe0,0x90,0xa8,0xe3,0xec,0x9f,0x64,0xde,0x36,0xc0,0xb7,0xf3,0xec,0x1a,0x9e,0xde,0x98,0x08,0x04,0x46,0x5f,0x8d,0xf4,0x7b,0x29,0x16,0x71,0x03,0xb9,0x34,0x68,0xf0,0xd4,0x22,0x3b,0xd1,0xa9,0xc6,0xbd,0x96,0x46,0x57,0x15,0x97,0xe1,0x35,0xe8,0xd5,0x91,0xe8,0xa4,0xf8,0x2c},
+    {0x67,0x0f,0x11,0x07,0x87,0xfd,0x93,0x6d,0x49,0xb5,0x38,0x7c,0xd3,0x09,0x4c,0xdd,0x86,0x6a,0x73,0xc2,0x4c,0x6a,0xb1,0x7c,0x09,0x2a,0x25,0x58,0x6e,0xbd,0x49,0x20,0xa2,0x6b,0xd0,0x17,0x7e,0x48,0xb5,0x2c,0x6b,0x19,0x50,0x39,0x1c,0x38,0xd2,0x24,0x30,0x8a,0x97,0x85,0x81,0x9c,0x65,0xd7,0xf6,0xa4,0xd6,0x91,0x28,0x7f,0x6f,0x7a,0x49,0xef,0x9a,0x6a,0x8d,0xfd,0x09,0x7d,0x0b,0xb9,0x3d,0x5b,0xbe,0x60,0xee,0xf0,0xd4,0xbf,0x9e,0x51,0x2c,0xb5,0x21,0x4c,0x1d,0x94,0x45,0xc5,0xdf,0xaa,0x11,0x60},
+    {0x3c,0xf8,0x95,0xcf,0x6d,0x92,0x67,0x5f,0x71,0x90,0x28,0x71,0x61,0x85,0x7e,0x7c,0x5b,0x7a,0x8f,0x99,0xf3,0xe7,0xa1,0xd6,0xe0,0xf9,0x62,0x0b,0x1b,0xcc,0xc5,0x6f,0x90,0xf8,0xcb,0x02,0xc8,0xd0,0xde,0x63,0xaa,0x6a,0xff,0x0d,0xca,0x98,0xd0,0xfb,0x99,0xed,0xb6,0xb9,0xfd,0x0a,0x4d,0x62,0x1e,0x0b,0x34,0x79,0xb7,0x18,0xce,0x69,0xcb,0x79,0x98,0xb2,0x28,0x55,0xef,0xd1,0x92,0x90,0x7e,0xd4,0x3c,0xae,0x1a,0xdd,0x52,0x23,0x9f,0x18,0x42,0x04,0x7e,0x12,0xf1,0x01,0x71,0xe5,0x3a,0x6b,0x59,0x15},
+    {0xa2,0x79,0x91,0x3f,0xd2,0x39,0x27,0x46,0xcf,0xdd,0xd6,0x97,0x31,0x12,0x83,0xff,0x8a,0x14,0xf2,0x53,0xb5,0xde,0x07,0x13,0xda,0x4d,0x5f,0x7b,0x68,0x37,0x22,0x0d,0xca,0x24,0x51,0x7e,0x16,0x31,0xff,0x09,0xdf,0x45,0xc7,0xd9,0x8b,0x15,0xe4,0x0b,0xe5,0x56,0xf5,0x7e,0x22,0x7d,0x2b,0x29,0x38,0xd1,0xb6,0xaf,0x41,0xe2,0xa4,0x3a,0xf5,0x05,0x33,0x2a,0xbf,0x38,0xc1,0x2c,0xc3,0x26,0xe9,0xa2,0x8f,0x3f,0x58,0x48,0xeb,0xd2,0x49,0x55,0xa2,0xb1,0x3a,0x08,0x6c,0xa3,0x87,0x46,0x6e,0xaa,0xfc,0x32},
+    {0xf5,0x9a,0x7d,0xc5,0x8d,0x6e,0xc5,0x7b,0xf2,0xbd,0xf0,0x9d,0xed,0xd2,0x0b,0x3e,0xa3,0xe4,0xef,0x22,0xde,0x14,0xc0,0xaa,0x5c,0x6a,0xbd,0xfe,0xce,0xe9,0x27,0x46,0xdf,0xcc,0x87,0x27,0x73,0xa4,0x07,0x32,0xf8,0xe3,0x13,0xf2,0x08,0x19,0xe3,0x17,0x4e,0x96,0x0d,0xf6,0xd7,0xec,0xb2,0xd5,0xe9,0x0b,0x60,0xc2,0x36,0x63,0x6f,0x74,0x1c,0x97,0x6c,0xab,0x45,0xf3,0x4a,0x3f,0x1f,0x73,0x43,0x99,0x72,0xeb,0x88,0xe2,0x6d,0x18,0x44,0x03,0x8a,0x6a,0x59,0x33,0x93,0x62,0xd6,0x7e,0x00,0x17,0x49,0x7b},
+    {0x64,0xb0,0x84,0xab,0x5c,0xfb,0x85,0x2d,0x14,0xbc,0xf3,0x89,0xd2,0x10,0x78,0x49,0x0c,0xce,0x15,0x7b,0x44,0xdc,0x6a,0x47,0x7b,0xfd,0x44,0xf8,0x76,0xa3,0x2b,0x12,0xdd,0xa2,0x53,0xdd,0x28,0x1b,0x34,0x54,0x3f,0xfc,0x42,0xdf,0x5b,0x90,0x17,0xaa,0xf4,0xf8,0xd2,0x4d,0xd9,0x92,0xf5,0x0f,0x7d,0xd3,0x8c,0xe0,0x0f,0x62,0x03,0x1d,0x54,0xe5,0xb4,0xa2,0xcd,0x32,0x02,0xc2,0x7f,0x18,0x5d,0x11,0x42,0xfd,0xd0,0x9e,0xd9,0x79,0xd4,0x7d,0xbe,0xb4,0xab,0x2e,0x4c,0xec,0x68,0x2b,0xf5,0x0b,0xc7,0x02},
+    {0xbb,0x2f,0x0b,0x5d,0x4b,0xec,0x87,0xa2,0xca,0x82,0x48,0x07,0x90,0x57,0x5c,0x41,0x5c,0x81,0xd0,0xc1,0x1e,0xa6,0x44,0xe0,0xe0,0xf5,0x9e,0x40,0x0a,0x4f,0x33,0x26,0xe1,0x72,0x8d,0x45,0xbf,0x32,0xe5,0xac,0xb5,0x3c,0xb7,0x7c,0xe0,0x68,0xe7,0x5b,0xe7,0xbd,0x8b,0xee,0x94,0x7d,0xcf,0x56,0x03,0x3a,0xb4,0xfe,0xe3,0x97,0x06,0x6b,0xc0,0xa3,0x62,0xdf,0x4a,0xf0,0xc8,0xb6,0x5d,0xa4,0x6d,0x07,0xef,0x00,0xf0,0x3e,0xa9,0xd2,0xf0,0x49,0x58,0xb9,0x9c,0x9c,0xae,0x2f,0x1b,0x44,0x43,0x7f,0xc3,0x1c},
+    {0x4f,0x32,0xc7,0x5c,0x5a,0x56,0x8f,0x50,0x22,0xa9,0x06,0xe5,0xc0,0xc4,0x61,0xd0,0x19,0xac,0x45,0x5c,0xdb,0xab,0x18,0xfb,0x4a,0x31,0x80,0x03,0xc1,0x09,0x68,0x6c,0xb9,0xae,0xce,0xc9,0xf1,0x56,0x66,0xd7,0x6a,0x65,0xe5,0x18,0xf8,0x15,0x5b,0x1c,0x34,0x23,0x4c,0x84,0x32,0x28,0xe7,0x26,0x38,0x68,0x19,0x2f,0x77,0x6f,0x34,0x3a,0xc8,0x6a,0xda,0xe2,0x12,0x51,0xd5,0xd2,0xed,0x51,0xe8,0xb1,0x31,0x03,0xbd,0xe9,0x62,0x72,0xc6,0x8e,0xdd,0x46,0x07,0x96,0xd0,0xc5,0xf7,0x6e,0x9f,0x1b,0x91,0x05},
+    {0xbb,0x0e,0xdf,0xf5,0x83,0x99,0x33,0xc1,0xac,0x4c,0x2c,0x51,0x8f,0x75,0xf3,0xc0,0xe1,0x98,0xb3,0x0b,0x0a,0x13,0xf1,0x2c,0x62,0x0c,0x27,0xaa,0xf9,0xec,0x3c,0x6b,0xef,0xea,0x2e,0x51,0xf3,0xac,0x49,0x53,0x49,0xcb,0xc1,0x1c,0xd3,0x41,0xc1,0x20,0x8d,0x68,0x9a,0xa9,0x07,0x0c,0x18,0x24,0x17,0x2d,0x4b,0xc6,0xd1,0xf9,0x5e,0x55,0x08,0xbd,0x73,0x3b,0xba,0x70,0xa7,0x36,0x0c,0xbf,0xaf,0xa3,0x08,0xef,0x4a,0x62,0xf2,0x46,0x09,0xb4,0x98,0xff,0x37,0x57,0x9d,0x74,0x81,0x33,0xe1,0x4d,0x5f,0x67},
+    {0xfc,0x82,0x17,0x6b,0x03,0x52,0x2c,0x0e,0xb4,0x83,0xad,0x6c,0x81,0x6c,0x81,0x64,0x3e,0x07,0x64,0x69,0xd9,0xbd,0xdc,0xd0,0x20,0xc5,0x64,0x01,0xf7,0x9d,0xd9,0x13,0x1d,0xb3,0xda,0x3b,0xd9,0xf6,0x2f,0xa1,0xfe,0x2d,0x65,0x9d,0x0f,0xd8,0x25,0x07,0x87,0x94,0xbe,0x9a,0xf3,0x4f,0x9c,0x01,0x43,0x3c,0xcd,0x82,0xb8,0x50,0xf4,0x60,0xca,0xc0,0xe5,0x21,0xc3,0x5e,0x4b,0x01,0xa2,0xbf,0x19,0xd7,0xc9,0x69,0xcb,0x4f,0xa0,0x23,0x00,0x75,0x18,0x1c,0x5f,0x4e,0x80,0xac,0xed,0x55,0x9e,0xde,0x06,0x1c},
+    {0xe2,0xc4,0x3e,0xa3,0xd6,0x7a,0x0f,0x99,0x8e,0xe0,0x2e,0xbe,0x38,0xf9,0x08,0x66,0x15,0x45,0x28,0x63,0xc5,0x43,0xa1,0x9c,0x0d,0xb6,0x2d,0xec,0x1f,0x8a,0xf3,0x4c,0xaa,0x69,0x6d,0xff,0x40,0x2b,0xd5,0xff,0xbb,0x49,0x40,0xdc,0x18,0x0b,0x53,0x34,0x97,0x98,0x4d,0xa3,0x2f,0x5c,0x4a,0x5e,0x2d,0xba,0x32,0x7d,0x8e,0x6f,0x09,0x78,0xe7,0x5c,0xfa,0x0d,0x65,0xaa,0xaa,0xa0,0x8c,0x47,0xb5,0x48,0x2a,0x9e,0xc4,0xf9,0x5b,0x72,0x03,0x70,0x7d,0xcc,0x09,0x4f,0xbe,0x1a,0x09,0x26,0x3a,0xad,0x3c,0x37},
+    {0x7c,0xf5,0xc9,0x82,0x4d,0x63,0x94,0xb2,0x36,0x45,0x93,0x24,0xe1,0xfd,0xcb,0x1f,0x5a,0xdb,0x8c,0x41,0xb3,0x4d,0x9c,0x9e,0xfc,0x19,0x44,0x45,0xd9,0xf3,0x40,0x00,0xad,0xbb,0xdd,0x89,0xfb,0xa8,0xbe,0xf1,0xcb,0xae,0xae,0x61,0xbc,0x2c,0xcb,0x3b,0x9d,0x8d,0x9b,0x1f,0xbb,0xa7,0x58,0x8f,0x86,0xa6,0x12,0x51,0xda,0x7e,0x54,0x21,0xd3,0x86,0x59,0xfd,0x39,0xe9,0xfd,0xde,0x0c,0x38,0x0a,0x51,0x89,0x2c,0x27,0xf4,0xb9,0x19,0x31,0xbb,0x07,0xa4,0x2b,0xb7,0xf4,0x4d,0x25,0x4a,0x33,0x0a,0x55,0x63},
+    {0x37,0xcf,0x69,0xb5,0xed,0xd6,0x07,0x65,0xe1,0x2e,0xa5,0x0c,0xb0,0x29,0x84,0x17,0x5d,0xd6,0x6b,0xeb,0x90,0x00,0x7c,0xea,0x51,0x8f,0xf7,0xda,0xc7,0x62,0xea,0x3e,0x49,0x7b,0x54,0x72,0x45,0x58,0xba,0x9b,0xe0,0x08,0xc4,0xe2,0xfa,0xc6,0x05,0xf3,0x8d,0xf1,0x34,0xc7,0x69,0xfa,0xe8,0x60,0x7a,0x76,0x7d,0xaa,0xaf,0x2b,0xa9,0x39,0x4e,0x27,0x93,0xe6,0x13,0xc7,0x24,0x9d,0x75,0xd3,0xdb,0x68,0x77,0x85,0x63,0x5f,0x9a,0xb3,0x8a,0xeb,0x60,0x55,0x52,0x70,0xcd,0xc4,0xc9,0x65,0x06,0x6a,0x43,0x68},
+    {0x27,0x3f,0x2f,0x20,0xe8,0x35,0x02,0xbc,0xb0,0x75,0xf9,0x64,0xe2,0x00,0x5c,0xc7,0x16,0x24,0x8c,0xa3,0xd5,0xe9,0xa4,0x91,0xf9,0x89,0xb7,0x8a,0xf6,0xe7,0xb6,0x17,0x7c,0x10,0x20,0xe8,0x17,0xd3,0x56,0x1e,0x65,0xe9,0x0a,0x84,0x44,0x68,0x26,0xc5,0x7a,0xfc,0x0f,0x32,0xc6,0xa1,0xe0,0xc1,0x72,0x14,0x61,0x91,0x9c,0x66,0x73,0x53,0x57,0x52,0x0e,0x9a,0xab,0x14,0x28,0x5d,0xfc,0xb3,0xca,0xc9,0x84,0x20,0x8f,0x90,0xca,0x1e,0x2d,0x5b,0x88,0xf5,0xca,0xaf,0x11,0x7d,0xf8,0x78,0xa6,0xb5,0xb4,0x1c},
+    {0x6c,0xfc,0x4a,0x39,0x6b,0xc0,0x64,0xb6,0xb1,0x5f,0xda,0x98,0x24,0xde,0x88,0x0c,0x34,0xd8,0xca,0x4b,0x16,0x03,0x8d,0x4f,0xa2,0x34,0x74,0xde,0x78,0xca,0x0b,0x33,0xe7,0x07,0xa0,0xa2,0x62,0xaa,0x74,0x6b,0xb1,0xc7,0x71,0xf0,0xb0,0xe0,0x11,0xf3,0x23,0xe2,0x0b,0x00,0x38,0xe4,0x07,0x57,0xac,0x6e,0xef,0x82,0x2d,0xfd,0xc0,0x2d,0x4e,0x74,0x19,0x11,0x84,0xff,0x2e,0x98,0x24,0x47,0x07,0x2b,0x96,0x5e,0x69,0xf9,0xfb,0x53,0xc9,0xbf,0x4f,0xc1,0x8a,0xc5,0xf5,0x1c,0x9f,0x36,0x1b,0xbe,0x31,0x3c},
+    {0xee,0x8a,0x94,0x08,0x4d,0x86,0xf4,0xb0,0x6f,0x1c,0xba,0x91,0xee,0x19,0xdc,0x07,0x58,0xa1,0xac,0xa6,0xae,0xcd,0x75,0x79,0xbb,0xd4,0x62,0x42,0x13,0x61,0x0b,0x33,0x72,0x42,0xcb,0xf9,0x93,0xbc,0x68,0xc1,0x98,0xdb,0xce,0xc7,0x1f,0x71,0xb8,0xae,0x7a,0x8d,0xac,0x34,0xaa,0x52,0x0e,0x7f,0xbb,0x55,0x7d,0x7e,0x09,0xc1,0xce,0x41,0x8a,0x80,0x6d,0xa2,0xd7,0x19,0x96,0xf7,0x6d,0x15,0x9e,0x1d,0x9e,0xd4,0x1f,0xbb,0x27,0xdf,0xa1,0xdb,0x6c,0xc3,0xd7,0x73,0x7d,0x77,0x28,0x1f,0xd9,0x4c,0xb4,0x26},
+    {0x75,0x74,0x38,0x8f,0x47,0x48,0xf0,0x51,0x3c,0xcb,0xbe,0x9c,0xf4,0xbc,0x5d,0xb2,0x55,0x20,0x9f,0xd9,0x44,0x12,0xab,0x9a,0xd6,0xa5,0x10,0x1c,0x6c,0x9e,0x70,0x2c,0x83,0x03,0x73,0x62,0x93,0xf2,0xb7,0xe1,0x2c,0x8a,0xca,0xeb,0xff,0x79,0x52,0x4b,0x14,0x13,0xd4,0xbf,0x8a,0x77,0xfc,0xda,0x0f,0x61,0x72,0x9c,0x14,0x10,0xeb,0x7d,0x7a,0xee,0x66,0x87,0x6a,0xaf,0x62,0xcb,0x0e,0xcd,0x53,0x55,0x04,0xec,0xcb,0x66,0xb5,0xe4,0x0b,0x0f,0x38,0x01,0x80,0x58,0xea,0xe2,0x2c,0xf6,0x9f,0x8e,0xe6,0x08},
+    {0xad,0x30,0xc1,0x4b,0x0a,0x50,0xad,0x34,0x9c,0xd4,0x0b,0x3d,0x49,0xdb,0x38,0x8d,0xbe,0x89,0x0a,0x50,0x98,0x3d,0x5c,0xa2,0x09,0x3b,0xba,0xee,0x87,0x3f,0x1f,0x2f,0xf9,0xf2,0xb8,0x0a,0xd5,0x09,0x2d,0x2f,0xdf,0x23,0x59,0xc5,0x8d,0x21,0xb9,0xac,0xb9,0x6c,0x76,0x73,0x26,0x34,0x8f,0x4a,0xf5,0x19,0xf7,0x38,0xd7,0x3b,0xb1,0x4c,0x4a,0xb6,0x15,0xe5,0x75,0x8c,0x84,0xf7,0x38,0x90,0x4a,0xdb,0xba,0x01,0x95,0xa5,0x50,0x1b,0x75,0x3f,0x3f,0x31,0x0d,0xc2,0xe8,0x2e,0xae,0xc0,0x53,0xe3,0xa1,0x19},
+    {0xc3,0x05,0xfa,0xba,0x60,0x75,0x1c,0x7d,0x61,0x5e,0xe5,0xc6,0xa0,0xa0,0xe1,0xb3,0x73,0x64,0xd6,0xc0,0x18,0x97,0x52,0xe3,0x86,0x34,0x0c,0xc2,0x11,0x6b,0x54,0x41,0xbd,0xbd,0x96,0xd5,0xcd,0x72,0x21,0xb4,0x40,0xfc,0xee,0x98,0x43,0x45,0xe0,0x93,0xb5,0x09,0x41,0xb4,0x47,0x53,0xb1,0x9f,0x34,0xae,0x66,0x02,0x99,0xd3,0x6b,0x73,0xb4,0xb3,0x34,0x93,0x50,0x2d,0x53,0x85,0x73,0x65,0x81,0x60,0x4b,0x11,0xfd,0x46,0x75,0x83,0x5c,0x42,0x30,0x5f,0x5f,0xcc,0x5c,0xab,0x7f,0xb8,0xa2,0x95,0x22,0x41},
+    {0xe9,0xd6,0x7e,0xf5,0x88,0x9b,0xc9,0x19,0x25,0xc8,0xf8,0x6d,0x26,0xcb,0x93,0x53,0x73,0xd2,0x0a,0xb3,0x13,0x32,0xee,0x5c,0x34,0x2e,0x2d,0xb5,0xeb,0x53,0xe1,0x14,0xc6,0xea,0x93,0xe2,0x61,0x52,0x65,0x2e,0xdb,0xac,0x33,0x21,0x03,0x92,0x5a,0x84,0x6b,0x99,0x00,0x79,0xcb,0x75,0x09,0x46,0x80,0xdd,0x5a,0x19,0x8d,0xbb,0x60,0x07,0x8a,0x81,0xe6,0xcd,0x17,0x1a,0x3e,0x41,0x84,0xa0,0x69,0xed,0xa9,0x6d,0x15,0x57,0xb1,0xcc,0xca,0x46,0x8f,0x26,0xbf,0x2c,0xf2,0xc5,0x3a,0xc3,0x9b,0xbe,0x34,0x6b},
+    {0xb2,0xc0,0x78,0x3a,0x64,0x2f,0xdf,0xf3,0x7c,0x02,0x2e,0xf2,0x1e,0x97,0x3e,0x4c,0xa3,0xb5,0xc1,0x49,0x5e,0x1c,0x7d,0xec,0x2d,0xdd,0x22,0x09,0x8f,0xc1,0x12,0x20,0xd3,0xf2,0x71,0x65,0x65,0x69,0xfc,0x11,0x7a,0x73,0x0e,0x53,0x45,0xe8,0xc9,0xc6,0x35,0x50,0xfe,0xd4,0xa2,0xe7,0x3a,0xe3,0x0b,0xd3,0x6d,0x2e,0xb6,0xc7,0xb9,0x01,0x29,0x9d,0xc8,0x5a,0xe5,0x55,0x0b,0x88,0x63,0xa7,0xa0,0x45,0x1f,0x24,0x83,0x14,0x1f,0x6c,0xe7,0xc2,0xdf,0xef,0x36,0x3d,0xe8,0xad,0x4b,0x4e,0x78,0x5b,0xaf,0x08},
+    {0x33,0x25,0x1f,0x88,0xdc,0x99,0x34,0x28,0xb6,0x23,0x93,0x77,0xda,0x25,0x05,0x9d,0xf4,0x41,0x34,0x67,0xfb,0xdd,0x7a,0x89,0x8d,0x16,0x3a,0x16,0x71,0x9d,0xb7,0x32,0x4b,0x2c,0xcc,0x89,0xd2,0x14,0x73,0xe2,0x8d,0x17,0x87,0xa2,0x11,0xbd,0xe4,0x4b,0xce,0x64,0x33,0xfa,0xd6,0x28,0xd5,0x18,0x6e,0x82,0xd9,0xaf,0xd5,0xc1,0x23,0x64,0x6a,0xb3,0xfc,0xed,0xd9,0xf8,0x85,0xcc,0xf9,0xe5,0x46,0x37,0x8f,0xc2,0xbc,0x22,0xcd,0xd3,0xe5,0xf9,0x38,0xe3,0x9d,0xe4,0xcc,0x2d,0x3e,0xc1,0xfb,0x5e,0x0a,0x48},
+    {0x71,0x20,0x62,0x01,0x0b,0xe7,0x51,0x0b,0xc5,0xaf,0x1d,0x8b,0xcf,0x05,0xb5,0x06,0xcd,0xab,0x5a,0xef,0x61,0xb0,0x6b,0x2c,0x31,0xbf,0xb7,0x0c,0x60,0x27,0xaa,0x47,0x1f,0x22,0xce,0x42,0xe4,0x4c,0x61,0xb6,0x28,0x39,0x05,0x4c,0xcc,0x9d,0x19,0x6e,0x03,0xbe,0x1c,0xdc,0xa4,0xb4,0x3f,0x66,0x06,0x8e,0x1c,0x69,0x47,0x1d,0xb3,0x24,0xc3,0xf8,0x15,0xc0,0xed,0x1e,0x54,0x2a,0x7c,0x3f,0x69,0x7c,0x7e,0xfe,0xa4,0x11,0xd6,0x78,0xa2,0x4e,0x13,0x66,0xaf,0xf0,0x94,0xa0,0xdd,0x14,0x5d,0x58,0x5b,0x54},
+    {0x0f,0x3a,0xd4,0xa0,0x5e,0x27,0xbf,0x67,0xbe,0xee,0x9b,0x08,0x34,0x8e,0xe6,0xad,0x2e,0xe7,0x79,0xd4,0x4c,0x13,0x89,0x42,0x54,0x54,0xba,0x32,0xc3,0xf9,0x62,0x0f,0xe1,0x21,0xb3,0xe3,0xd0,0xe4,0x04,0x62,0x95,0x1e,0xff,0x28,0x7a,0x63,0xaa,0x3b,0x9e,0xbd,0x99,0x5b,0xfd,0xcf,0x0c,0x0b,0x71,0xd0,0xc8,0x64,0x3e,0xdc,0x22,0x4d,0x39,0x5f,0x3b,0xd6,0x89,0x65,0xb4,0xfc,0x61,0xcf,0xcb,0x57,0x3f,0x6a,0xae,0x5c,0x05,0xfa,0x3a,0x95,0xd2,0xc2,0xba,0xfe,0x36,0x14,0x37,0x36,0x1a,0xa0,0x0f,0x1c},
+    {0xff,0x3d,0x94,0x22,0xb6,0x04,0xc6,0xd2,0xa0,0xb3,0xcf,0x44,0xce,0xbe,0x8c,0xbc,0x78,0x86,0x80,0x97,0xf3,0x4f,0x25,0x5d,0xbf,0xa6,0x1c,0x3b,0x4f,0x61,0xa3,0x0f,0x50,0x6a,0x93,0x8c,0x0e,0x2b,0x08,0x69,0xb6,0xc5,0xda,0xc1,0x35,0xa0,0xc9,0xf9,0x34,0xb6,0xdf,0xc4,0x54,0x3e,0xb7,0x6f,0x40,0xc1,0x2b,0x1d,0x9b,0x41,0x05,0x40,0xf0,0x82,0xbe,0xb9,0xbd,0xfe,0x03,0xa0,0x90,0xac,0x44,0x3a,0xaf,0xc1,0x89,0x20,0x8e,0xfa,0x54,0x19,0x91,0x9f,0x49,0xf8,0x42,0xab,0x40,0xef,0x8a,0x21,0xba,0x1f},
+    {0x3e,0xf5,0xc8,0xfa,0x48,0x94,0x54,0xab,0x41,0x37,0xa6,0x7b,0x9a,0xe8,0xf6,0x81,0x01,0x5e,0x2b,0x6c,0x7d,0x6c,0xfd,0x74,0x42,0x6e,0xc8,0xa8,0xca,0x3a,0x2e,0x39,0x94,0x01,0x7b,0x3e,0x04,0x57,0x3e,0x4f,0x7f,0xaf,0xda,0x08,0xee,0x3e,0x1d,0xa8,0xf1,0xde,0xdc,0x99,0xab,0xc6,0x39,0xc8,0xd5,0x61,0x77,0xff,0x13,0x5d,0x53,0x6c,0xaf,0x35,0x8a,0x3e,0xe9,0x34,0xbd,0x4c,0x16,0xe8,0x87,0x58,0x44,0x81,0x07,0x2e,0xab,0xb0,0x9a,0xf2,0x76,0x9c,0x31,0x19,0x3b,0xc1,0x0a,0xd5,0xe4,0x7f,0xe1,0x25},
+    {0x76,0xf6,0x04,0x1e,0xd7,0x9b,0x28,0x0a,0x95,0x0f,0x42,0xd6,0x52,0x1c,0x8e,0x20,0xab,0x1f,0x69,0x34,0xb0,0xd8,0x86,0x51,0x51,0xb3,0x9f,0x2a,0x44,0x51,0x57,0x25,0xa7,0x21,0xf1,0x76,0xf5,0x7f,0x5f,0x91,0xe3,0x87,0xcd,0x2f,0x27,0x32,0x4a,0xc3,0x26,0xe5,0x1b,0x4d,0xde,0x2f,0xba,0xcc,0x9b,0x89,0x69,0x89,0x8f,0x82,0xba,0x6b,0x01,0x39,0xfe,0x90,0x66,0xbc,0xd1,0xe2,0xd5,0x7a,0x99,0xa0,0x18,0x4a,0xb5,0x4c,0xd4,0x60,0x84,0xaf,0x14,0x69,0x1d,0x97,0xe4,0x7b,0x6b,0x7f,0x4f,0x50,0x9d,0x55},
+    {0xd5,0x54,0xeb,0xb3,0x78,0x83,0x73,0xa7,0x7c,0x3c,0x55,0xa5,0x66,0xd3,0x69,0x1d,0xba,0x00,0x28,0xf9,0x62,0xcf,0x26,0x0a,0x17,0x32,0x7e,0x80,0xd5,0x12,0xab,0x01,0xfd,0x66,0xd2,0xf6,0xe7,0x91,0x48,0x9c,0x1b,0x78,0x07,0x03,0x9b,0xa1,0x44,0x07,0x3b,0xe2,0x61,0x60,0x1d,0x8f,0x38,0x88,0x0e,0xd5,0x4b,0x35,0xa3,0xa6,0x3e,0x12,0x96,0x2d,0xe3,0x41,0x90,0x18,0x8d,0x11,0x48,0x58,0x31,0xd8,0xc2,0xe3,0xed,0xb9,0xd9,0x45,0x32,0xd8,0x71,0x42,0xab,0x1e,0x54,0xa1,0x18,0xc9,0xe2,0x61,0x39,0x4a},
+    {0xa0,0xbb,0xe6,0xf8,0xe0,0x3b,0xdc,0x71,0x0a,0xe3,0xff,0x7e,0x34,0xf8,0xce,0xd6,0x6a,0x47,0x3a,0xe1,0x5f,0x42,0x92,0xa9,0x63,0xb7,0x1d,0xfb,0xe3,0xbc,0xd6,0x2c,0x1e,0x3f,0x23,0xf3,0x44,0xd6,0x27,0x03,0x16,0xf0,0xfc,0x34,0x0e,0x26,0x9a,0x49,0x79,0xb9,0xda,0xf2,0x16,0xa7,0xb5,0x83,0x1f,0x11,0xd4,0x9b,0xad,0xee,0xac,0x68,0x10,0xc2,0xd7,0xf3,0x0e,0xc9,0xb4,0x38,0x0c,0x04,0xad,0xb7,0x24,0x6e,0x8e,0x30,0x23,0x3e,0xe7,0xb7,0xf1,0xd9,0x60,0x38,0x97,0xf5,0x08,0xb5,0xd5,0x60,0x57,0x59},
+    {0x97,0x63,0xaa,0x04,0xe1,0xbf,0x29,0x61,0xcb,0xfc,0xa7,0xa4,0x08,0x00,0x96,0x8f,0x58,0x94,0x90,0x7d,0x89,0xc0,0x8b,0x3f,0xa9,0x91,0xb2,0xdc,0x3e,0xa4,0x9f,0x70,0x90,0x27,0x02,0xfd,0xeb,0xcb,0x2a,0x88,0x60,0x57,0x11,0xc4,0x05,0x33,0xaf,0x89,0xf4,0x73,0x34,0x7d,0xe3,0x92,0xf4,0x65,0x2b,0x5a,0x51,0x54,0xdf,0xc5,0xb2,0x2c,0xca,0x2a,0xfd,0x63,0x8c,0x5d,0x0a,0xeb,0xff,0x4e,0x69,0x2e,0x66,0xc1,0x2b,0xd2,0x3a,0xb0,0xcb,0xf8,0x6e,0xf3,0x23,0x27,0x1f,0x13,0xc8,0xf0,0xec,0x29,0xf0,0x70},
+    {0x33,0x3e,0xed,0x2e,0xb3,0x07,0x13,0x46,0xe7,0x81,0x55,0xa4,0x33,0x2f,0x04,0xae,0x66,0x03,0x5f,0x19,0xd3,0x49,0x44,0xc9,0x58,0x48,0x31,0x6c,0x8a,0x5d,0x7d,0x0b,0xb9,0xb0,0x10,0x5e,0xaa,0xaf,0x6a,0x2a,0xa9,0x1a,0x04,0xef,0x70,0xa3,0xf0,0x78,0x1f,0xd6,0x3a,0xaa,0x77,0xfb,0x3e,0x77,0xe1,0xd9,0x4b,0xa7,0xa2,0xa5,0xec,0x44,0x43,0xd5,0x95,0x7b,0x32,0x48,0xd4,0x25,0x1d,0x0f,0x34,0xa3,0x00,0x83,0xd3,0x70,0x2b,0xc5,0xe1,0x60,0x1c,0x53,0x1c,0xde,0xe4,0xe9,0x7d,0x2c,0x51,0x24,0x22,0x27},
+    {0x2e,0x34,0xc5,0x49,0xaf,0x92,0xbc,0x1a,0xd0,0xfa,0xe6,0xb2,0x11,0xd8,0xee,0xff,0x29,0x4e,0xc8,0xfc,0x8d,0x8c,0xa2,0xef,0x43,0xc5,0x4c,0xa4,0x18,0xdf,0xb5,0x11,0xfc,0x75,0xa9,0x42,0x8a,0xbb,0x7b,0xbf,0x58,0xa3,0xad,0x96,0x77,0x39,0x5c,0x8c,0x48,0xaa,0xed,0xcd,0x6f,0xc7,0x7f,0xe2,0xa6,0x20,0xbc,0xf6,0xd7,0x5f,0x73,0x19,0x66,0x42,0xc8,0x42,0xd0,0x90,0xab,0xe3,0x7e,0x54,0x19,0x7f,0x0f,0x8e,0x84,0xeb,0xb9,0x97,0xa4,0x65,0xd0,0xa1,0x03,0x25,0x5f,0x89,0xdf,0x91,0x11,0x91,0xef,0x0f}
+};
+
+NAMESPACE_END  // Arch64
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_DOXYGEN_PROCESSING
+#endif  // CRYPTOPP_DONNA_64_H
diff --git a/runtime/third_party/cryptopp/donna_sse.cpp b/runtime/third_party/cryptopp/donna_sse.cpp
new file mode 100644
index 0000000..7fad92a
--- /dev/null
+++ b/runtime/third_party/cryptopp/donna_sse.cpp
@@ -0,0 +1,1123 @@
+// donna_sse.cpp - written and placed in public domain by Jeffrey Walton
+//                 This is a integration of Andrew Moon's public domain code.
+//                 Also see https://github.com/floodyberry/curve25519-donna.
+
+// This is a integration of Andrew Moon's public domain code. The port was
+// clean, but it has one potential problem. The original code is C and relies
+// upon unions. Accessing the inactive union member is undefined behavior in
+// C++. That means copying the array into packedelem8.u is OK; but then using
+// packedelem8.v in a calculation is UB. Fortunately most (all?) compilers
+// take pity on C++ developers and compile the code. We will have to keep an
+// eye on things or rewrite significant portions of this code.
+
+// If needed, see Moon's commit "Go back to ignoring 256th bit [sic]",
+// https://github.com/floodyberry/curve25519-donna/commit/57a683d18721a658
+
+#include "pch.h"
+
+#include "config.h"
+#include "donna.h"
+#include "secblock.h"
+#include "misc.h"
+
+// The data is aligned, but Clang issues warning based on type
+// and not the actual alignment of the variable and data.
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wcast-align"
+# pragma GCC diagnostic ignored "-Wunused-function"
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4244)
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char DONNA_SSE_FNAME[] = __FILE__;
+
+#if (CRYPTOPP_CURVE25519_SSE2)
+
+#include "donna_sse.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::sword32;
+using CryptoPP::word64;
+using CryptoPP::sword64;
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+
+// Bring in all the symbols from the SSE header
+using namespace CryptoPP::Donna::ArchSSE;
+
+/* Copy a bignum to another: out = in */
+inline void
+curve25519_copy(bignum25519 out, const bignum25519 in) {
+    xmmi x0,x1,x2;
+    x0 = _mm_load_si128((xmmi*)in + 0);
+    x1 = _mm_load_si128((xmmi*)in + 1);
+    x2 = _mm_load_si128((xmmi*)in + 2);
+    _mm_store_si128((xmmi*)out + 0, x0);
+    _mm_store_si128((xmmi*)out + 1, x1);
+    _mm_store_si128((xmmi*)out + 2, x2);
+}
+
+/* Take a little-endian, 32-byte number and expand it into polynomial form */
+inline void
+curve25519_expand(bignum25519 out, const byte in[32]) {
+    word32 x0,x1,x2,x3,x4,x5,x6,x7;
+
+    x0 = *(word32 *)(in + 0);
+    x1 = *(word32 *)(in + 4);
+    x2 = *(word32 *)(in + 8);
+    x3 = *(word32 *)(in + 12);
+    x4 = *(word32 *)(in + 16);
+    x5 = *(word32 *)(in + 20);
+    x6 = *(word32 *)(in + 24);
+    x7 = *(word32 *)(in + 28);
+
+    out[0] = (                      x0       ) & reduce_mask_26;
+    out[1] = ((((word64)x1 << 32) | x0) >> 26) & reduce_mask_25;
+    out[2] = ((((word64)x2 << 32) | x1) >> 19) & reduce_mask_26;
+    out[3] = ((((word64)x3 << 32) | x2) >> 13) & reduce_mask_25;
+    out[4] = ((                     x3) >>  6) & reduce_mask_26;
+    out[5] = (                      x4       ) & reduce_mask_25;
+    out[6] = ((((word64)x5 << 32) | x4) >> 25) & reduce_mask_26;
+    out[7] = ((((word64)x6 << 32) | x5) >> 19) & reduce_mask_25;
+    out[8] = ((((word64)x7 << 32) | x6) >> 12) & reduce_mask_26;
+    out[9] = ((                     x7) >>  6) & reduce_mask_25; /* ignore the top bit */
+
+    out[10] = 0;
+    out[11] = 0;
+}
+
+/* Take a fully reduced polynomial form number and contract it into a
+ * little-endian, 32-byte array
+ */
+inline void
+curve25519_contract(byte out[32], const bignum25519 in) {
+    ALIGN(16) bignum25519 f;
+
+    curve25519_copy(f, in);
+
+    #define carry_pass() \
+        f[1] += f[0] >> 26; f[0] &= reduce_mask_26; \
+        f[2] += f[1] >> 25; f[1] &= reduce_mask_25; \
+        f[3] += f[2] >> 26; f[2] &= reduce_mask_26; \
+        f[4] += f[3] >> 25; f[3] &= reduce_mask_25; \
+        f[5] += f[4] >> 26; f[4] &= reduce_mask_26; \
+        f[6] += f[5] >> 25; f[5] &= reduce_mask_25; \
+        f[7] += f[6] >> 26; f[6] &= reduce_mask_26; \
+        f[8] += f[7] >> 25; f[7] &= reduce_mask_25; \
+        f[9] += f[8] >> 26; f[8] &= reduce_mask_26;
+
+    #define carry_pass_full() \
+        carry_pass() \
+        f[0] += 19 * (f[9] >> 25); f[9] &= reduce_mask_25;
+
+    #define carry_pass_final() \
+        carry_pass() \
+        f[9] &= reduce_mask_25;
+
+    carry_pass_full()
+    carry_pass_full()
+
+    /* now t is between 0 and 2^255-1, properly carried. */
+    /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */
+    f[0] += 19;
+    carry_pass_full()
+
+    /* now between 19 and 2^255-1 in both cases, and offset by 19. */
+    f[0] += (1 << 26) - 19;
+    f[1] += (1 << 25) - 1;
+    f[2] += (1 << 26) - 1;
+    f[3] += (1 << 25) - 1;
+    f[4] += (1 << 26) - 1;
+    f[5] += (1 << 25) - 1;
+    f[6] += (1 << 26) - 1;
+    f[7] += (1 << 25) - 1;
+    f[8] += (1 << 26) - 1;
+    f[9] += (1 << 25) - 1;
+
+    /* now between 2^255 and 2^256-20, and offset by 2^255. */
+    carry_pass_final()
+
+    #undef carry_pass
+    #undef carry_full
+    #undef carry_final
+
+    *(word32 *)(out +  0) = ((f[0]      ) | (f[1] << 26));
+    *(word32 *)(out +  4) = ((f[1] >>  6) | (f[2] << 19));
+    *(word32 *)(out +  8) = ((f[2] >> 13) | (f[3] << 13));
+    *(word32 *)(out + 12) = ((f[3] >> 19) | (f[4] <<  6));
+    *(word32 *)(out + 16) = ((f[5]      ) | (f[6] << 25));
+    *(word32 *)(out + 20) = ((f[6] >>  7) | (f[7] << 19));
+    *(word32 *)(out + 24) = ((f[7] >> 13) | (f[8] << 12));
+    *(word32 *)(out + 28) = ((f[8] >> 20) | (f[9] <<  6));
+}
+
+/*
+ * Maybe swap the contents of two felem arrays (@a and @b), each 5 elements
+ * long. Perform the swap iff @swap is non-zero.
+ */
+inline void
+curve25519_swap_conditional(bignum25519 a, bignum25519 b, word32 iswap) {
+    const word32 swap = (word32)(-(sword32)iswap);
+    xmmi a0,a1,a2,b0,b1,b2,x0,x1,x2;
+    xmmi mask = _mm_cvtsi32_si128(swap);
+    mask = _mm_shuffle_epi32(mask, 0);
+    a0 = _mm_load_si128((xmmi *)a + 0);
+    a1 = _mm_load_si128((xmmi *)a + 1);
+    a2 = _mm_load_si128((xmmi *)a + 2);
+    b0 = _mm_load_si128((xmmi *)b + 0);
+    b1 = _mm_load_si128((xmmi *)b + 1);
+    b2 = _mm_load_si128((xmmi *)b + 2);
+    b0 = _mm_xor_si128(a0, b0);
+    b1 = _mm_xor_si128(a1, b1);
+    b2 = _mm_xor_si128(a2, b2);
+    x0 = _mm_and_si128(b0, mask);
+    x1 = _mm_and_si128(b1, mask);
+    x2 = _mm_and_si128(b2, mask);
+    x0 = _mm_xor_si128(x0, a0);
+    x1 = _mm_xor_si128(x1, a1);
+    x2 = _mm_xor_si128(x2, a2);
+    a0 = _mm_xor_si128(x0, b0);
+    a1 = _mm_xor_si128(x1, b1);
+    a2 = _mm_xor_si128(x2, b2);
+    _mm_store_si128((xmmi *)a + 0, x0);
+    _mm_store_si128((xmmi *)a + 1, x1);
+    _mm_store_si128((xmmi *)a + 2, x2);
+    _mm_store_si128((xmmi *)b + 0, a0);
+    _mm_store_si128((xmmi *)b + 1, a1);
+    _mm_store_si128((xmmi *)b + 2, a2);
+}
+
+/* interleave two bignums */
+inline void
+curve25519_tangle32(packedelem32 *out, const bignum25519 x, const bignum25519 z) {
+    xmmi x0,x1,x2,z0,z1,z2;
+
+    x0 = _mm_load_si128((xmmi *)(x + 0));
+    x1 = _mm_load_si128((xmmi *)(x + 4));
+    x2 = _mm_load_si128((xmmi *)(x + 8));
+    z0 = _mm_load_si128((xmmi *)(z + 0));
+    z1 = _mm_load_si128((xmmi *)(z + 4));
+    z2 = _mm_load_si128((xmmi *)(z + 8));
+
+    out[0].v = _mm_unpacklo_epi32(x0, z0);
+    out[1].v = _mm_unpackhi_epi32(x0, z0);
+    out[2].v = _mm_unpacklo_epi32(x1, z1);
+    out[3].v = _mm_unpackhi_epi32(x1, z1);
+    out[4].v = _mm_unpacklo_epi32(x2, z2);
+}
+
+/* split a packed bignum in to it's two parts */
+inline void
+curve25519_untangle64(bignum25519 x, bignum25519 z, const packedelem64 *in) {
+    _mm_store_si128((xmmi *)(x + 0), _mm_unpacklo_epi64(_mm_unpacklo_epi32(in[0].v, in[1].v), _mm_unpacklo_epi32(in[2].v, in[3].v)));
+    _mm_store_si128((xmmi *)(x + 4), _mm_unpacklo_epi64(_mm_unpacklo_epi32(in[4].v, in[5].v), _mm_unpacklo_epi32(in[6].v, in[7].v)));
+    _mm_store_si128((xmmi *)(x + 8), _mm_unpacklo_epi32(in[8].v, in[9].v)                                                          );
+    _mm_store_si128((xmmi *)(z + 0), _mm_unpacklo_epi64(_mm_unpackhi_epi32(in[0].v, in[1].v), _mm_unpackhi_epi32(in[2].v, in[3].v)));
+    _mm_store_si128((xmmi *)(z + 4), _mm_unpacklo_epi64(_mm_unpackhi_epi32(in[4].v, in[5].v), _mm_unpackhi_epi32(in[6].v, in[7].v)));
+    _mm_store_si128((xmmi *)(z + 8), _mm_unpackhi_epi32(in[8].v, in[9].v)                                                          );
+}
+
+/* add two packed bignums */
+inline void
+curve25519_add_packed32(packedelem32 *out, const packedelem32 *r, const packedelem32 *s) {
+    out[0].v = _mm_add_epi32(r[0].v, s[0].v);
+    out[1].v = _mm_add_epi32(r[1].v, s[1].v);
+    out[2].v = _mm_add_epi32(r[2].v, s[2].v);
+    out[3].v = _mm_add_epi32(r[3].v, s[3].v);
+    out[4].v = _mm_add_epi32(r[4].v, s[4].v);
+}
+
+/* subtract two packed bignums */
+inline void
+curve25519_sub_packed32(packedelem32 *out, const packedelem32 *r, const packedelem32 *s) {
+    xmmi r0,r1,r2,r3,r4;
+    xmmi s0,s1,s2,s3;
+    xmmi c1,c2;
+
+    r0 = _mm_add_epi32(r[0].v, packed32zeromodp0.v);
+    r1 = _mm_add_epi32(r[1].v, packed32zeromodp1.v);
+    r2 = _mm_add_epi32(r[2].v, packed32zeromodp1.v);
+    r3 = _mm_add_epi32(r[3].v, packed32zeromodp1.v);
+    r4 = _mm_add_epi32(r[4].v, packed32zeromodp1.v);
+    r0 = _mm_sub_epi32(r0, s[0].v); /* 00 11 */
+    r1 = _mm_sub_epi32(r1, s[1].v); /* 22 33 */
+    r2 = _mm_sub_epi32(r2, s[2].v); /* 44 55 */
+    r3 = _mm_sub_epi32(r3, s[3].v); /* 66 77 */
+    r4 = _mm_sub_epi32(r4, s[4].v); /* 88 99 */
+
+    s0 = _mm_unpacklo_epi64(r0, r2); /* 00 44 */
+    s1 = _mm_unpackhi_epi64(r0, r2); /* 11 55 */
+    s2 = _mm_unpacklo_epi64(r1, r3); /* 22 66 */
+    s3 = _mm_unpackhi_epi64(r1, r3); /* 33 77 */
+
+    c1 = _mm_srli_epi32(s0, 26); c2 = _mm_srli_epi32(s2, 26); s0 = _mm_and_si128(s0, packedmask26262626.v); s2 = _mm_and_si128(s2, packedmask26262626.v); s1 = _mm_add_epi32(s1, c1); s3 = _mm_add_epi32(s3, c2);
+    c1 = _mm_srli_epi32(s1, 25); c2 = _mm_srli_epi32(s3, 25); s1 = _mm_and_si128(s1, packedmask25252525.v); s3 = _mm_and_si128(s3, packedmask25252525.v); s2 = _mm_add_epi32(s2, c1); r4 = _mm_add_epi32(r4, _mm_srli_si128(c2, 8)); s0 = _mm_add_epi32(s0,  _mm_slli_si128(c2, 8));
+
+    out[0].v = _mm_unpacklo_epi64(s0, s1); /* 00 11 */
+    out[1].v = _mm_unpacklo_epi64(s2, s3); /* 22 33 */
+    out[2].v = _mm_unpackhi_epi64(s0, s1); /* 44 55 */
+    out[3].v = _mm_unpackhi_epi64(s2, s3); /* 66 77 */
+    out[4].v = r4;                         /* 88 99 */
+}
+
+/* multiply two packed bignums */
+inline void
+curve25519_mul_packed64(packedelem64 *out, const packedelem64 *r, const packedelem64 *s) {
+    xmmi r1,r2,r3,r4,r5,r6,r7,r8,r9;
+    xmmi r1_2,r3_2,r5_2,r7_2,r9_2;
+    xmmi c1,c2;
+
+    out[0].v = _mm_mul_epu32(r[0].v, s[0].v);
+    out[1].v = _mm_add_epi64(_mm_mul_epu32(r[0].v, s[1].v), _mm_mul_epu32(r[1].v, s[0].v));
+    r1_2 = _mm_slli_epi32(r[1].v, 1);
+    out[2].v = _mm_add_epi64(_mm_mul_epu32(r[0].v, s[2].v), _mm_add_epi64(_mm_mul_epu32(r1_2  , s[1].v), _mm_mul_epu32(r[2].v, s[0].v)));
+    out[3].v = _mm_add_epi64(_mm_mul_epu32(r[0].v, s[3].v), _mm_add_epi64(_mm_mul_epu32(r[1].v, s[2].v), _mm_add_epi64(_mm_mul_epu32(r[2].v, s[1].v), _mm_mul_epu32(r[3].v, s[0].v))));
+    r3_2 = _mm_slli_epi32(r[3].v, 1);
+    out[4].v = _mm_add_epi64(_mm_mul_epu32(r[0].v, s[4].v), _mm_add_epi64(_mm_mul_epu32(r1_2  , s[3].v), _mm_add_epi64(_mm_mul_epu32(r[2].v, s[2].v), _mm_add_epi64(_mm_mul_epu32(r3_2  , s[1].v), _mm_mul_epu32(r[4].v, s[0].v)))));
+    out[5].v = _mm_add_epi64(_mm_mul_epu32(r[0].v, s[5].v), _mm_add_epi64(_mm_mul_epu32(r[1].v, s[4].v), _mm_add_epi64(_mm_mul_epu32(r[2].v, s[3].v), _mm_add_epi64(_mm_mul_epu32(r[3].v, s[2].v), _mm_add_epi64(_mm_mul_epu32(r[4].v, s[1].v), _mm_mul_epu32(r[5].v, s[0].v))))));
+    r5_2 = _mm_slli_epi32(r[5].v, 1);
+    out[6].v = _mm_add_epi64(_mm_mul_epu32(r[0].v, s[6].v), _mm_add_epi64(_mm_mul_epu32(r1_2  , s[5].v), _mm_add_epi64(_mm_mul_epu32(r[2].v, s[4].v), _mm_add_epi64(_mm_mul_epu32(r3_2  , s[3].v), _mm_add_epi64(_mm_mul_epu32(r[4].v, s[2].v), _mm_add_epi64(_mm_mul_epu32(r5_2  , s[1].v), _mm_mul_epu32(r[6].v, s[0].v)))))));
+    out[7].v = _mm_add_epi64(_mm_mul_epu32(r[0].v, s[7].v), _mm_add_epi64(_mm_mul_epu32(r[1].v, s[6].v), _mm_add_epi64(_mm_mul_epu32(r[2].v, s[5].v), _mm_add_epi64(_mm_mul_epu32(r[3].v, s[4].v), _mm_add_epi64(_mm_mul_epu32(r[4].v, s[3].v), _mm_add_epi64(_mm_mul_epu32(r[5].v, s[2].v), _mm_add_epi64(_mm_mul_epu32(r[6].v, s[1].v), _mm_mul_epu32(r[7].v  , s[0].v))))))));
+    r7_2 = _mm_slli_epi32(r[7].v, 1);
+    out[8].v = _mm_add_epi64(_mm_mul_epu32(r[0].v, s[8].v), _mm_add_epi64(_mm_mul_epu32(r1_2  , s[7].v), _mm_add_epi64(_mm_mul_epu32(r[2].v, s[6].v), _mm_add_epi64(_mm_mul_epu32(r3_2  , s[5].v), _mm_add_epi64(_mm_mul_epu32(r[4].v, s[4].v), _mm_add_epi64(_mm_mul_epu32(r5_2  , s[3].v), _mm_add_epi64(_mm_mul_epu32(r[6].v, s[2].v), _mm_add_epi64(_mm_mul_epu32(r7_2  , s[1].v), _mm_mul_epu32(r[8].v, s[0].v)))))))));
+    out[9].v = _mm_add_epi64(_mm_mul_epu32(r[0].v, s[9].v), _mm_add_epi64(_mm_mul_epu32(r[1].v, s[8].v), _mm_add_epi64(_mm_mul_epu32(r[2].v, s[7].v), _mm_add_epi64(_mm_mul_epu32(r[3].v, s[6].v), _mm_add_epi64(_mm_mul_epu32(r[4].v, s[5].v), _mm_add_epi64(_mm_mul_epu32(r[5].v, s[4].v), _mm_add_epi64(_mm_mul_epu32(r[6].v, s[3].v), _mm_add_epi64(_mm_mul_epu32(r[7].v, s[2].v), _mm_add_epi64(_mm_mul_epu32(r[8].v, s[1].v), _mm_mul_epu32(r[9].v, s[0].v))))))))));
+
+    r1 = _mm_mul_epu32(r[1].v, packednineteen.v);
+    r2 = _mm_mul_epu32(r[2].v, packednineteen.v);
+    r1_2 = _mm_slli_epi32(r1, 1);
+    r3 = _mm_mul_epu32(r[3].v, packednineteen.v);
+    r4 = _mm_mul_epu32(r[4].v, packednineteen.v);
+    r3_2 = _mm_slli_epi32(r3, 1);
+    r5 = _mm_mul_epu32(r[5].v, packednineteen.v);
+    r6 = _mm_mul_epu32(r[6].v, packednineteen.v);
+    r5_2 = _mm_slli_epi32(r5, 1);
+    r7 = _mm_mul_epu32(r[7].v, packednineteen.v);
+    r8 = _mm_mul_epu32(r[8].v, packednineteen.v);
+    r7_2 = _mm_slli_epi32(r7, 1);
+    r9 = _mm_mul_epu32(r[9].v, packednineteen.v);
+    r9_2 = _mm_slli_epi32(r9, 1);
+
+    out[0].v = _mm_add_epi64(out[0].v, _mm_add_epi64(_mm_mul_epu32(r9_2, s[1].v), _mm_add_epi64(_mm_mul_epu32(r8, s[2].v), _mm_add_epi64(_mm_mul_epu32(r7_2, s[3].v), _mm_add_epi64(_mm_mul_epu32(r6, s[4].v), _mm_add_epi64(_mm_mul_epu32(r5_2, s[5].v), _mm_add_epi64(_mm_mul_epu32(r4, s[6].v), _mm_add_epi64(_mm_mul_epu32(r3_2, s[7].v), _mm_add_epi64(_mm_mul_epu32(r2, s[8].v), _mm_mul_epu32(r1_2, s[9].v))))))))));
+    out[1].v = _mm_add_epi64(out[1].v, _mm_add_epi64(_mm_mul_epu32(r9  , s[2].v), _mm_add_epi64(_mm_mul_epu32(r8, s[3].v), _mm_add_epi64(_mm_mul_epu32(r7  , s[4].v), _mm_add_epi64(_mm_mul_epu32(r6, s[5].v), _mm_add_epi64(_mm_mul_epu32(r5  , s[6].v), _mm_add_epi64(_mm_mul_epu32(r4, s[7].v), _mm_add_epi64(_mm_mul_epu32(r3  , s[8].v), _mm_mul_epu32(r2, s[9].v)))))))));
+    out[2].v = _mm_add_epi64(out[2].v, _mm_add_epi64(_mm_mul_epu32(r9_2, s[3].v), _mm_add_epi64(_mm_mul_epu32(r8, s[4].v), _mm_add_epi64(_mm_mul_epu32(r7_2, s[5].v), _mm_add_epi64(_mm_mul_epu32(r6, s[6].v), _mm_add_epi64(_mm_mul_epu32(r5_2, s[7].v), _mm_add_epi64(_mm_mul_epu32(r4, s[8].v), _mm_mul_epu32(r3_2, s[9].v))))))));
+    out[3].v = _mm_add_epi64(out[3].v, _mm_add_epi64(_mm_mul_epu32(r9  , s[4].v), _mm_add_epi64(_mm_mul_epu32(r8, s[5].v), _mm_add_epi64(_mm_mul_epu32(r7  , s[6].v), _mm_add_epi64(_mm_mul_epu32(r6, s[7].v), _mm_add_epi64(_mm_mul_epu32(r5  , s[8].v), _mm_mul_epu32(r4, s[9].v)))))));
+    out[4].v = _mm_add_epi64(out[4].v, _mm_add_epi64(_mm_mul_epu32(r9_2, s[5].v), _mm_add_epi64(_mm_mul_epu32(r8, s[6].v), _mm_add_epi64(_mm_mul_epu32(r7_2, s[7].v), _mm_add_epi64(_mm_mul_epu32(r6, s[8].v), _mm_mul_epu32(r5_2, s[9].v))))));
+    out[5].v = _mm_add_epi64(out[5].v, _mm_add_epi64(_mm_mul_epu32(r9  , s[6].v), _mm_add_epi64(_mm_mul_epu32(r8, s[7].v), _mm_add_epi64(_mm_mul_epu32(r7  , s[8].v), _mm_mul_epu32(r6, s[9].v)))));
+    out[6].v = _mm_add_epi64(out[6].v, _mm_add_epi64(_mm_mul_epu32(r9_2, s[7].v), _mm_add_epi64(_mm_mul_epu32(r8, s[8].v), _mm_mul_epu32(r7_2, s[9].v))));
+    out[7].v = _mm_add_epi64(out[7].v, _mm_add_epi64(_mm_mul_epu32(r9  , s[8].v), _mm_mul_epu32(r8, s[9].v)));
+    out[8].v = _mm_add_epi64(out[8].v, _mm_mul_epu32(r9_2, s[9].v));
+
+    c1 = _mm_srli_epi64(out[0].v, 26); c2 = _mm_srli_epi64(out[4].v, 26); out[0].v = _mm_and_si128(out[0].v, packedmask26.v); out[4].v = _mm_and_si128(out[4].v, packedmask26.v); out[1].v = _mm_add_epi64(out[1].v, c1); out[5].v = _mm_add_epi64(out[5].v, c2);
+    c1 = _mm_srli_epi64(out[1].v, 25); c2 = _mm_srli_epi64(out[5].v, 25); out[1].v = _mm_and_si128(out[1].v, packedmask25.v); out[5].v = _mm_and_si128(out[5].v, packedmask25.v); out[2].v = _mm_add_epi64(out[2].v, c1); out[6].v = _mm_add_epi64(out[6].v, c2);
+    c1 = _mm_srli_epi64(out[2].v, 26); c2 = _mm_srli_epi64(out[6].v, 26); out[2].v = _mm_and_si128(out[2].v, packedmask26.v); out[6].v = _mm_and_si128(out[6].v, packedmask26.v); out[3].v = _mm_add_epi64(out[3].v, c1); out[7].v = _mm_add_epi64(out[7].v, c2);
+    c1 = _mm_srli_epi64(out[3].v, 25); c2 = _mm_srli_epi64(out[7].v, 25); out[3].v = _mm_and_si128(out[3].v, packedmask25.v); out[7].v = _mm_and_si128(out[7].v, packedmask25.v); out[4].v = _mm_add_epi64(out[4].v, c1); out[8].v = _mm_add_epi64(out[8].v, c2);
+                                       c2 = _mm_srli_epi64(out[8].v, 26);                                                     out[8].v = _mm_and_si128(out[8].v, packedmask26.v);                                         out[9].v = _mm_add_epi64(out[9].v, c2);
+                                       c2 = _mm_srli_epi64(out[9].v, 25);                                                     out[9].v = _mm_and_si128(out[9].v, packedmask25.v);                                         out[0].v = _mm_add_epi64(out[0].v, _mm_mul_epu32(c2, packednineteen.v));
+    c1 = _mm_srli_epi64(out[0].v, 26); c2 = _mm_srli_epi64(out[4].v, 26); out[0].v = _mm_and_si128(out[0].v, packedmask26.v); out[4].v = _mm_and_si128(out[4].v, packedmask26.v); out[1].v = _mm_add_epi64(out[1].v, c1); out[5].v = _mm_add_epi64(out[5].v, c2);
+}
+
+/* multiply a bignum */
+void
+curve25519_mul(bignum25519 out, const bignum25519 r, const bignum25519 s) {
+    xmmi m01,m23,m45,m67,m89;
+    xmmi m0123,m4567;
+    xmmi s0123,s4567;
+    xmmi s01,s23,s45,s67,s89;
+    xmmi s12,s34,s56,s78,s9;
+    xmmi r0,r2,r4,r6,r8;
+    xmmi r1,r3,r5,r7,r9;
+    xmmi r119,r219,r319,r419,r519,r619,r719,r819,r919;
+    xmmi c1,c2,c3;
+
+    s0123 = _mm_load_si128((xmmi*)s + 0);
+    s01 = _mm_shuffle_epi32(s0123,_MM_SHUFFLE(3,1,2,0));
+    s12 = _mm_shuffle_epi32(s0123, _MM_SHUFFLE(2,2,1,1));
+    s23 = _mm_shuffle_epi32(s0123,_MM_SHUFFLE(3,3,2,2));
+    s4567 = _mm_load_si128((xmmi*)s + 1);
+    s34 = _mm_unpacklo_epi64(_mm_srli_si128(s0123,12),s4567);
+    s45 = _mm_shuffle_epi32(s4567,_MM_SHUFFLE(3,1,2,0));
+    s56 = _mm_shuffle_epi32(s4567, _MM_SHUFFLE(2,2,1,1));
+    s67 = _mm_shuffle_epi32(s4567,_MM_SHUFFLE(3,3,2,2));
+    s89 = _mm_load_si128((xmmi*)s + 2);
+    s78 = _mm_unpacklo_epi64(_mm_srli_si128(s4567,12),s89);
+    s89 = _mm_shuffle_epi32(s89,_MM_SHUFFLE(3,1,2,0));
+    s9 = _mm_shuffle_epi32(s89, _MM_SHUFFLE(3,3,2,2));
+
+    r0 = _mm_load_si128((xmmi*)r + 0);
+    r1 = _mm_shuffle_epi32(r0, _MM_SHUFFLE(1,1,1,1));
+    r1 = _mm_add_epi64(r1, _mm_and_si128(r1, sse2_top64bitmask.v));
+    r2 = _mm_shuffle_epi32(r0, _MM_SHUFFLE(2,2,2,2));
+    r3 = _mm_shuffle_epi32(r0, _MM_SHUFFLE(3,3,3,3));
+    r3 = _mm_add_epi64(r3, _mm_and_si128(r3, sse2_top64bitmask.v));
+    r0 = _mm_shuffle_epi32(r0, _MM_SHUFFLE(0,0,0,0));
+    r4 = _mm_load_si128((xmmi*)r + 1);
+    r5 = _mm_shuffle_epi32(r4, _MM_SHUFFLE(1,1,1,1));
+    r5 = _mm_add_epi64(r5, _mm_and_si128(r5, sse2_top64bitmask.v));
+    r6 = _mm_shuffle_epi32(r4, _MM_SHUFFLE(2,2,2,2));
+    r7 = _mm_shuffle_epi32(r4, _MM_SHUFFLE(3,3,3,3));
+    r7 = _mm_add_epi64(r7, _mm_and_si128(r7, sse2_top64bitmask.v));
+    r4 = _mm_shuffle_epi32(r4, _MM_SHUFFLE(0,0,0,0));
+    r8 = _mm_load_si128((xmmi*)r + 2);
+    r9 = _mm_shuffle_epi32(r8, _MM_SHUFFLE(3,1,3,1));
+    r9 = _mm_add_epi64(r9, _mm_and_si128(r9, sse2_top64bitmask.v));
+    r8 = _mm_shuffle_epi32(r8, _MM_SHUFFLE(3,0,3,0));
+
+    m01 = _mm_mul_epu32(r1,s01);
+    m23 = _mm_mul_epu32(r1,s23);
+    m45 = _mm_mul_epu32(r1,s45);
+    m67 = _mm_mul_epu32(r1,s67);
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r3,s01));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r3,s23));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r3,s45));
+    m89 = _mm_mul_epu32(r1,s89);
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r5,s01));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r5,s23));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r3,s67));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r7,s01));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r5,s45));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r7,s23));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r9,s01));
+
+    /* shift up */
+    m89 = _mm_unpackhi_epi64(m67,_mm_slli_si128(m89,8));
+    m67 = _mm_unpackhi_epi64(m45,_mm_slli_si128(m67,8));
+    m45 = _mm_unpackhi_epi64(m23,_mm_slli_si128(m45,8));
+    m23 = _mm_unpackhi_epi64(m01,_mm_slli_si128(m23,8));
+    m01 = _mm_unpackhi_epi64(_mm_setzero_si128(),_mm_slli_si128(m01,8));
+
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r0,s01));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r0,s23));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r0,s45));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r0,s67));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r2,s01));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r2,s23));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r4,s23));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r0,s89));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r4,s01));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r2,s45));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r2,s67));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r6,s01));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r4,s45));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r6,s23));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r8,s01));
+
+    r219 = _mm_mul_epu32(r2, packednineteen.v);
+    r419 = _mm_mul_epu32(r4, packednineteen.v);
+    r619 = _mm_mul_epu32(r6, packednineteen.v);
+    r819 = _mm_mul_epu32(r8, packednineteen.v);
+    r119 = _mm_shuffle_epi32(r1,_MM_SHUFFLE(0,0,2,2)); r119 = _mm_mul_epu32(r119, packednineteen.v);
+    r319 = _mm_shuffle_epi32(r3,_MM_SHUFFLE(0,0,2,2)); r319 = _mm_mul_epu32(r319, packednineteen.v);
+    r519 = _mm_shuffle_epi32(r5,_MM_SHUFFLE(0,0,2,2)); r519 = _mm_mul_epu32(r519, packednineteen.v);
+    r719 = _mm_shuffle_epi32(r7,_MM_SHUFFLE(0,0,2,2)); r719 = _mm_mul_epu32(r719, packednineteen.v);
+    r919 = _mm_shuffle_epi32(r9,_MM_SHUFFLE(0,0,2,2)); r919 = _mm_mul_epu32(r919, packednineteen.v);
+
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r919,s12));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r919,s34));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r919,s56));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r919,s78));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r719,s34));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r719,s56));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r719,s78));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r719,s9));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r519,s56));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r519,s78));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r519,s9));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r819,s89));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r319,s78));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r319,s9));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r619,s89));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r919,s9));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r819,s23));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r819,s45));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r819,s67));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r619,s45));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r619,s67));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r419,s67));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r419,s89));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r219,s89));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r119,s9));
+
+    r0 = _mm_unpacklo_epi64(m01, m45);
+    r1 = _mm_unpackhi_epi64(m01, m45);
+    r2 = _mm_unpacklo_epi64(m23, m67);
+    r3 = _mm_unpackhi_epi64(m23, m67);
+    r4 = _mm_unpacklo_epi64(m89, m89);
+    r5 = _mm_unpackhi_epi64(m89, m89);
+
+    c1 = _mm_srli_epi64(r0, 26); c2 = _mm_srli_epi64(r2, 26); r0 = _mm_and_si128(r0, packedmask26.v); r2 = _mm_and_si128(r2, packedmask26.v); r1 = _mm_add_epi64(r1, c1); r3 = _mm_add_epi64(r3, c2);
+    c1 = _mm_srli_epi64(r1, 25); c2 = _mm_srli_epi64(r3, 25); r1 = _mm_and_si128(r1, packedmask25.v); r3 = _mm_and_si128(r3, packedmask25.v); r2 = _mm_add_epi64(r2, c1); r4 = _mm_add_epi64(r4, c2); c3 = _mm_slli_si128(c2, 8);
+    c1 = _mm_srli_epi64(r4, 26);                                                                      r4 = _mm_and_si128(r4, packedmask26.v);                             r5 = _mm_add_epi64(r5, c1);
+    c1 = _mm_srli_epi64(r5, 25);                                                                      r5 = _mm_and_si128(r5, packedmask25.v);                             r0 = _mm_add_epi64(r0, _mm_unpackhi_epi64(_mm_mul_epu32(c1, packednineteen.v), c3));
+    c1 = _mm_srli_epi64(r0, 26); c2 = _mm_srli_epi64(r2, 26); r0 = _mm_and_si128(r0, packedmask26.v); r2 = _mm_and_si128(r2, packedmask26.v); r1 = _mm_add_epi64(r1, c1); r3 = _mm_add_epi64(r3, c2);
+
+    m0123 = _mm_unpacklo_epi32(r0, r1);
+    m4567 = _mm_unpackhi_epi32(r0, r1);
+    m0123 = _mm_unpacklo_epi64(m0123, _mm_unpacklo_epi32(r2, r3));
+    m4567 = _mm_unpacklo_epi64(m4567, _mm_unpackhi_epi32(r2, r3));
+    m89 = _mm_unpackhi_epi32(r4, r5);
+
+    _mm_store_si128((xmmi*)out + 0, m0123);
+    _mm_store_si128((xmmi*)out + 1, m4567);
+    _mm_store_si128((xmmi*)out + 2, m89);
+}
+
+typedef struct bignum25519mulprecomp_t {
+    xmmi r0,r2,r4,r6,r8;
+    xmmi r1,r3,r5,r7,r9;
+    xmmi r119,r219,r319,r419,r519,r619,r719,r819,r919;
+} bignum25519mulprecomp;
+
+/* precompute a constant to multiply by */
+inline void
+curve25519_mul_precompute(bignum25519mulprecomp *pre, const bignum25519 r) {
+    pre->r0 = _mm_load_si128((xmmi*)r + 0);
+    pre->r1 = _mm_shuffle_epi32(pre->r0, _MM_SHUFFLE(1,1,1,1));
+    pre->r1 = _mm_add_epi64(pre->r1, _mm_and_si128(pre->r1, sse2_top64bitmask.v));
+    pre->r2 = _mm_shuffle_epi32(pre->r0, _MM_SHUFFLE(2,2,2,2));
+    pre->r3 = _mm_shuffle_epi32(pre->r0, _MM_SHUFFLE(3,3,3,3));
+    pre->r3 = _mm_add_epi64(pre->r3, _mm_and_si128(pre->r3, sse2_top64bitmask.v));
+    pre->r0 = _mm_shuffle_epi32(pre->r0, _MM_SHUFFLE(0,0,0,0));
+    pre->r4 = _mm_load_si128((xmmi*)r + 1);
+    pre->r5 = _mm_shuffle_epi32(pre->r4, _MM_SHUFFLE(1,1,1,1));
+    pre->r5 = _mm_add_epi64(pre->r5, _mm_and_si128(pre->r5, sse2_top64bitmask.v));
+    pre->r6 = _mm_shuffle_epi32(pre->r4, _MM_SHUFFLE(2,2,2,2));
+    pre->r7 = _mm_shuffle_epi32(pre->r4, _MM_SHUFFLE(3,3,3,3));
+    pre->r7 = _mm_add_epi64(pre->r7, _mm_and_si128(pre->r7, sse2_top64bitmask.v));
+    pre->r4 = _mm_shuffle_epi32(pre->r4, _MM_SHUFFLE(0,0,0,0));
+    pre->r8 = _mm_load_si128((xmmi*)r + 2);
+    pre->r9 = _mm_shuffle_epi32(pre->r8, _MM_SHUFFLE(3,1,3,1));
+    pre->r9 = _mm_add_epi64(pre->r9, _mm_and_si128(pre->r9, sse2_top64bitmask.v));
+    pre->r8 = _mm_shuffle_epi32(pre->r8, _MM_SHUFFLE(3,0,3,0));
+
+    pre->r219 = _mm_mul_epu32(pre->r2, packednineteen.v);
+    pre->r419 = _mm_mul_epu32(pre->r4, packednineteen.v);
+    pre->r619 = _mm_mul_epu32(pre->r6, packednineteen.v);
+    pre->r819 = _mm_mul_epu32(pre->r8, packednineteen.v);
+    pre->r119 = _mm_shuffle_epi32(pre->r1,_MM_SHUFFLE(0,0,2,2)); pre->r119 = _mm_mul_epu32(pre->r119, packednineteen.v);
+    pre->r319 = _mm_shuffle_epi32(pre->r3,_MM_SHUFFLE(0,0,2,2)); pre->r319 = _mm_mul_epu32(pre->r319, packednineteen.v);
+    pre->r519 = _mm_shuffle_epi32(pre->r5,_MM_SHUFFLE(0,0,2,2)); pre->r519 = _mm_mul_epu32(pre->r519, packednineteen.v);
+    pre->r719 = _mm_shuffle_epi32(pre->r7,_MM_SHUFFLE(0,0,2,2)); pre->r719 = _mm_mul_epu32(pre->r719, packednineteen.v);
+    pre->r919 = _mm_shuffle_epi32(pre->r9,_MM_SHUFFLE(0,0,2,2)); pre->r919 = _mm_mul_epu32(pre->r919, packednineteen.v);
+}
+
+
+/* multiply a bignum by a pre-computed constant */
+inline void
+curve25519_mul_precomputed(bignum25519 out, const bignum25519 s, const bignum25519mulprecomp *r) {
+    xmmi m01,m23,m45,m67,m89;
+    xmmi m0123,m4567;
+    xmmi s0123,s4567;
+    xmmi s01,s23,s45,s67,s89;
+    xmmi s12,s34,s56,s78,s9;
+    xmmi r0,r1,r2,r3,r4,r5;
+    xmmi c1,c2,c3;
+
+    s0123 = _mm_load_si128((xmmi*)s + 0);
+    s01 = _mm_shuffle_epi32(s0123,_MM_SHUFFLE(3,1,2,0));
+    s12 = _mm_shuffle_epi32(s0123, _MM_SHUFFLE(2,2,1,1));
+    s23 = _mm_shuffle_epi32(s0123,_MM_SHUFFLE(3,3,2,2));
+    s4567 = _mm_load_si128((xmmi*)s + 1);
+    s34 = _mm_unpacklo_epi64(_mm_srli_si128(s0123,12),s4567);
+    s45 = _mm_shuffle_epi32(s4567,_MM_SHUFFLE(3,1,2,0));
+    s56 = _mm_shuffle_epi32(s4567, _MM_SHUFFLE(2,2,1,1));
+    s67 = _mm_shuffle_epi32(s4567,_MM_SHUFFLE(3,3,2,2));
+    s89 = _mm_load_si128((xmmi*)s + 2);
+    s78 = _mm_unpacklo_epi64(_mm_srli_si128(s4567,12),s89);
+    s89 = _mm_shuffle_epi32(s89,_MM_SHUFFLE(3,1,2,0));
+    s9 = _mm_shuffle_epi32(s89, _MM_SHUFFLE(3,3,2,2));
+
+    m01 = _mm_mul_epu32(r->r1,s01);
+    m23 = _mm_mul_epu32(r->r1,s23);
+    m45 = _mm_mul_epu32(r->r1,s45);
+    m67 = _mm_mul_epu32(r->r1,s67);
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r3,s01));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r3,s23));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r3,s45));
+    m89 = _mm_mul_epu32(r->r1,s89);
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r5,s01));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r5,s23));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r3,s67));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r7,s01));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r5,s45));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r7,s23));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r9,s01));
+
+    /* shift up */
+    m89 = _mm_unpackhi_epi64(m67,_mm_slli_si128(m89,8));
+    m67 = _mm_unpackhi_epi64(m45,_mm_slli_si128(m67,8));
+    m45 = _mm_unpackhi_epi64(m23,_mm_slli_si128(m45,8));
+    m23 = _mm_unpackhi_epi64(m01,_mm_slli_si128(m23,8));
+    m01 = _mm_unpackhi_epi64(_mm_setzero_si128(),_mm_slli_si128(m01,8));
+
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r0,s01));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r0,s23));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r0,s45));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r0,s67));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r2,s01));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r2,s23));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r4,s23));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r0,s89));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r4,s01));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r2,s45));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r2,s67));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r6,s01));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r4,s45));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r6,s23));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r8,s01));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r919,s12));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r919,s34));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r919,s56));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r919,s78));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r719,s34));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r719,s56));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r719,s78));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r719,s9));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r519,s56));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r519,s78));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r519,s9));
+    m67 = _mm_add_epi64(m67,_mm_mul_epu32(r->r819,s89));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r319,s78));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r319,s9));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r619,s89));
+    m89 = _mm_add_epi64(m89,_mm_mul_epu32(r->r919,s9));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r819,s23));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r819,s45));
+    m45 = _mm_add_epi64(m45,_mm_mul_epu32(r->r819,s67));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r619,s45));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r619,s67));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r419,s67));
+    m23 = _mm_add_epi64(m23,_mm_mul_epu32(r->r419,s89));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r219,s89));
+    m01 = _mm_add_epi64(m01,_mm_mul_epu32(r->r119,s9));
+
+    r0 = _mm_unpacklo_epi64(m01, m45);
+    r1 = _mm_unpackhi_epi64(m01, m45);
+    r2 = _mm_unpacklo_epi64(m23, m67);
+    r3 = _mm_unpackhi_epi64(m23, m67);
+    r4 = _mm_unpacklo_epi64(m89, m89);
+    r5 = _mm_unpackhi_epi64(m89, m89);
+
+    c1 = _mm_srli_epi64(r0, 26); c2 = _mm_srli_epi64(r2, 26); r0 = _mm_and_si128(r0, packedmask26.v); r2 = _mm_and_si128(r2, packedmask26.v); r1 = _mm_add_epi64(r1, c1); r3 = _mm_add_epi64(r3, c2);
+    c1 = _mm_srli_epi64(r1, 25); c2 = _mm_srli_epi64(r3, 25); r1 = _mm_and_si128(r1, packedmask25.v); r3 = _mm_and_si128(r3, packedmask25.v); r2 = _mm_add_epi64(r2, c1); r4 = _mm_add_epi64(r4, c2); c3 = _mm_slli_si128(c2, 8);
+    c1 = _mm_srli_epi64(r4, 26);                                                                      r4 = _mm_and_si128(r4, packedmask26.v);                             r5 = _mm_add_epi64(r5, c1);
+    c1 = _mm_srli_epi64(r5, 25);                                                                      r5 = _mm_and_si128(r5, packedmask25.v);                             r0 = _mm_add_epi64(r0, _mm_unpackhi_epi64(_mm_mul_epu32(c1, packednineteen.v), c3));
+    c1 = _mm_srli_epi64(r0, 26); c2 = _mm_srli_epi64(r2, 26); r0 = _mm_and_si128(r0, packedmask26.v); r2 = _mm_and_si128(r2, packedmask26.v); r1 = _mm_add_epi64(r1, c1); r3 = _mm_add_epi64(r3, c2);
+
+    m0123 = _mm_unpacklo_epi32(r0, r1);
+    m4567 = _mm_unpackhi_epi32(r0, r1);
+    m0123 = _mm_unpacklo_epi64(m0123, _mm_unpacklo_epi32(r2, r3));
+    m4567 = _mm_unpacklo_epi64(m4567, _mm_unpackhi_epi32(r2, r3));
+    m89 = _mm_unpackhi_epi32(r4, r5);
+
+    _mm_store_si128((xmmi*)out + 0, m0123);
+    _mm_store_si128((xmmi*)out + 1, m4567);
+    _mm_store_si128((xmmi*)out + 2, m89);
+}
+
+/* square a bignum 'count' times */
+#define curve25519_square(r,x) curve25519_square_times(r,x,1)
+
+void
+curve25519_square_times(bignum25519 r, const bignum25519 in, int count) {
+    xmmi m01,m23,m45,m67,m89;
+    xmmi r0,r1,r2,r3,r4,r5,r6,r7,r8,r9;
+    xmmi r0a,r1a,r2a,r3a,r7a,r9a;
+    xmmi r0123,r4567;
+    xmmi r01,r23,r45,r67,r6x,r89,r8x;
+    xmmi r12,r34,r56,r78,r9x;
+    xmmi r5619;
+    xmmi c1,c2,c3;
+
+    r0123 = _mm_load_si128((xmmi*)in + 0);
+    r01 = _mm_shuffle_epi32(r0123,_MM_SHUFFLE(3,1,2,0));
+    r23 = _mm_shuffle_epi32(r0123,_MM_SHUFFLE(3,3,2,2));
+    r4567 = _mm_load_si128((xmmi*)in + 1);
+    r45 = _mm_shuffle_epi32(r4567,_MM_SHUFFLE(3,1,2,0));
+    r67 = _mm_shuffle_epi32(r4567,_MM_SHUFFLE(3,3,2,2));
+    r89 = _mm_load_si128((xmmi*)in + 2);
+    r89 = _mm_shuffle_epi32(r89,_MM_SHUFFLE(3,1,2,0));
+
+    do {
+        r12 = _mm_unpackhi_epi64(r01, _mm_slli_si128(r23, 8));
+        r0 = _mm_shuffle_epi32(r01, _MM_SHUFFLE(0,0,0,0));
+        r0 = _mm_add_epi64(r0, _mm_and_si128(r0, sse2_top64bitmask.v));
+        r0a = _mm_shuffle_epi32(r0,_MM_SHUFFLE(3,2,1,2));
+        r1 = _mm_shuffle_epi32(r01, _MM_SHUFFLE(2,2,2,2));
+        r2 = _mm_shuffle_epi32(r23, _MM_SHUFFLE(0,0,0,0));
+        r2 = _mm_add_epi64(r2, _mm_and_si128(r2, sse2_top64bitmask.v));
+        r2a = _mm_shuffle_epi32(r2,_MM_SHUFFLE(3,2,1,2));
+        r3 = _mm_shuffle_epi32(r23, _MM_SHUFFLE(2,2,2,2));
+        r34 = _mm_unpackhi_epi64(r23, _mm_slli_si128(r45, 8));
+        r4 = _mm_shuffle_epi32(r45, _MM_SHUFFLE(0,0,0,0));
+        r4 = _mm_add_epi64(r4, _mm_and_si128(r4, sse2_top64bitmask.v));
+        r56 = _mm_unpackhi_epi64(r45, _mm_slli_si128(r67, 8));
+        r5619 = _mm_mul_epu32(r56, packednineteen.v);
+        r5 = _mm_shuffle_epi32(r5619, _MM_SHUFFLE(1,1,1,0));
+        r6 = _mm_shuffle_epi32(r5619, _MM_SHUFFLE(3,2,3,2));
+        r78 = _mm_unpackhi_epi64(r67, _mm_slli_si128(r89, 8));
+        r6x = _mm_unpacklo_epi64(r67, _mm_setzero_si128());
+        r7 = _mm_shuffle_epi32(r67, _MM_SHUFFLE(2,2,2,2));
+        r7 = _mm_mul_epu32(r7, packed3819.v);
+        r7a = _mm_shuffle_epi32(r7, _MM_SHUFFLE(3,3,3,2));
+        r8x = _mm_unpacklo_epi64(r89, _mm_setzero_si128());
+        r8 = _mm_shuffle_epi32(r89, _MM_SHUFFLE(0,0,0,0));
+        r8 = _mm_mul_epu32(r8, packednineteen.v);
+        r9  = _mm_shuffle_epi32(r89, _MM_SHUFFLE(2,2,2,2));
+        r9x  = _mm_slli_epi32(_mm_shuffle_epi32(r89, _MM_SHUFFLE(3,3,3,2)), 1);
+        r9 = _mm_mul_epu32(r9, packed3819.v);
+        r9a = _mm_shuffle_epi32(r9, _MM_SHUFFLE(2,2,2,2));
+
+        m01 = _mm_mul_epu32(r01, r0);
+        m23 = _mm_mul_epu32(r23, r0a);
+        m45 = _mm_mul_epu32(r45, r0a);
+        m45 = _mm_add_epi64(m45, _mm_mul_epu32(r23, r2));
+        r23 = _mm_slli_epi32(r23, 1);
+        m67 = _mm_mul_epu32(r67, r0a);
+        m67 = _mm_add_epi64(m67, _mm_mul_epu32(r45, r2a));
+        m89 = _mm_mul_epu32(r89, r0a);
+        m89 = _mm_add_epi64(m89, _mm_mul_epu32(r67, r2a));
+        r67 = _mm_slli_epi32(r67, 1);
+        m89 = _mm_add_epi64(m89, _mm_mul_epu32(r45, r4));
+        r45 = _mm_slli_epi32(r45, 1);
+
+        r1 = _mm_slli_epi32(r1, 1);
+        r3 = _mm_slli_epi32(r3, 1);
+        r1a = _mm_add_epi64(r1, _mm_and_si128(r1, sse2_bot64bitmask.v));
+        r3a = _mm_add_epi64(r3, _mm_and_si128(r3, sse2_bot64bitmask.v));
+
+        m23 = _mm_add_epi64(m23, _mm_mul_epu32(r12, r1));
+        m45 = _mm_add_epi64(m45, _mm_mul_epu32(r34, r1a));
+        m67 = _mm_add_epi64(m67, _mm_mul_epu32(r56, r1a));
+        m67 = _mm_add_epi64(m67, _mm_mul_epu32(r34, r3));
+        r34 = _mm_slli_epi32(r34, 1);
+        m89 = _mm_add_epi64(m89, _mm_mul_epu32(r78, r1a));
+        r78 = _mm_slli_epi32(r78, 1);
+        m89 = _mm_add_epi64(m89, _mm_mul_epu32(r56, r3a));
+        r56 = _mm_slli_epi32(r56, 1);
+
+        m01 = _mm_add_epi64(m01, _mm_mul_epu32(_mm_slli_epi32(r12, 1), r9));
+        m01 = _mm_add_epi64(m01, _mm_mul_epu32(r34, r7));
+        m23 = _mm_add_epi64(m23, _mm_mul_epu32(r34, r9));
+        m01 = _mm_add_epi64(m01, _mm_mul_epu32(r56, r5));
+        m23 = _mm_add_epi64(m23, _mm_mul_epu32(r56, r7));
+        m45 = _mm_add_epi64(m45, _mm_mul_epu32(r56, r9));
+        m01 = _mm_add_epi64(m01, _mm_mul_epu32(r23, r8));
+        m01 = _mm_add_epi64(m01, _mm_mul_epu32(r45, r6));
+        m23 = _mm_add_epi64(m23, _mm_mul_epu32(r45, r8));
+        m23 = _mm_add_epi64(m23, _mm_mul_epu32(r6x, r6));
+        m45 = _mm_add_epi64(m45, _mm_mul_epu32(r78, r7a));
+        m67 = _mm_add_epi64(m67, _mm_mul_epu32(r78, r9));
+        m45 = _mm_add_epi64(m45, _mm_mul_epu32(r67, r8));
+        m67 = _mm_add_epi64(m67, _mm_mul_epu32(r8x, r8));
+        m89 = _mm_add_epi64(m89, _mm_mul_epu32(r9x, r9a));
+
+        r0 = _mm_unpacklo_epi64(m01, m45);
+        r1 = _mm_unpackhi_epi64(m01, m45);
+        r2 = _mm_unpacklo_epi64(m23, m67);
+        r3 = _mm_unpackhi_epi64(m23, m67);
+        r4 = _mm_unpacklo_epi64(m89, m89);
+        r5 = _mm_unpackhi_epi64(m89, m89);
+
+        c1 = _mm_srli_epi64(r0, 26); c2 = _mm_srli_epi64(r2, 26); r0 = _mm_and_si128(r0, packedmask26.v); r2 = _mm_and_si128(r2, packedmask26.v); r1 = _mm_add_epi64(r1, c1); r3 = _mm_add_epi64(r3, c2);
+        c1 = _mm_srli_epi64(r1, 25); c2 = _mm_srli_epi64(r3, 25); r1 = _mm_and_si128(r1, packedmask25.v); r3 = _mm_and_si128(r3, packedmask25.v); r2 = _mm_add_epi64(r2, c1); r4 = _mm_add_epi64(r4, c2); c3 = _mm_slli_si128(c2, 8);
+        c1 = _mm_srli_epi64(r4, 26);                                                                      r4 = _mm_and_si128(r4, packedmask26.v);                             r5 = _mm_add_epi64(r5, c1);
+        c1 = _mm_srli_epi64(r5, 25);                                                                      r5 = _mm_and_si128(r5, packedmask25.v);                             r0 = _mm_add_epi64(r0, _mm_unpackhi_epi64(_mm_mul_epu32(c1, packednineteen.v), c3));
+        c1 = _mm_srli_epi64(r0, 26); c2 = _mm_srli_epi64(r2, 26); r0 = _mm_and_si128(r0, packedmask26.v); r2 = _mm_and_si128(r2, packedmask26.v); r1 = _mm_add_epi64(r1, c1); r3 = _mm_add_epi64(r3, c2);
+
+        r01 = _mm_unpacklo_epi64(r0, r1);
+        r45 = _mm_unpackhi_epi64(r0, r1);
+        r23 = _mm_unpacklo_epi64(r2, r3);
+        r67 = _mm_unpackhi_epi64(r2, r3);
+        r89 = _mm_unpackhi_epi64(r4, r5);
+    } while (--count);
+
+    r0123 = _mm_shuffle_epi32(r23, _MM_SHUFFLE(2,0,3,3));
+    r4567 = _mm_shuffle_epi32(r67, _MM_SHUFFLE(2,0,3,3));
+    r0123 = _mm_or_si128(r0123, _mm_shuffle_epi32(r01, _MM_SHUFFLE(3,3,2,0)));
+    r4567 = _mm_or_si128(r4567, _mm_shuffle_epi32(r45, _MM_SHUFFLE(3,3,2,0)));
+    r89 = _mm_shuffle_epi32(r89, _MM_SHUFFLE(3,3,2,0));
+
+    _mm_store_si128((xmmi*)r + 0, r0123);
+    _mm_store_si128((xmmi*)r + 1, r4567);
+    _mm_store_si128((xmmi*)r + 2, r89);
+}
+
+/* square two packed bignums */
+inline void
+curve25519_square_packed64(packedelem64 *out, const packedelem64 *r) {
+    xmmi r0,r1,r2,r3;
+    xmmi r1_2,r3_2,r4_2,r5_2,r6_2,r7_2;
+    xmmi d5,d6,d7,d8,d9;
+    xmmi c1,c2;
+
+    r0 = r[0].v;
+    r1 = r[1].v;
+    r2 = r[2].v;
+    r3 = r[3].v;
+
+    out[0].v = _mm_mul_epu32(r0, r0);
+    r0 = _mm_slli_epi32(r0, 1);
+    out[1].v = _mm_mul_epu32(r0, r1);
+    r1_2 = _mm_slli_epi32(r1, 1);
+    out[2].v = _mm_add_epi64(_mm_mul_epu32(r0, r2    ), _mm_mul_epu32(r1, r1_2));
+    r1 = r1_2;
+    out[3].v = _mm_add_epi64(_mm_mul_epu32(r0, r3    ), _mm_mul_epu32(r1, r2  ));
+    r3_2 = _mm_slli_epi32(r3, 1);
+    out[4].v = _mm_add_epi64(_mm_mul_epu32(r0, r[4].v), _mm_add_epi64(_mm_mul_epu32(r1, r3_2  ), _mm_mul_epu32(r2, r2)));
+    r2 = _mm_slli_epi32(r2, 1);
+    out[5].v = _mm_add_epi64(_mm_mul_epu32(r0, r[5].v), _mm_add_epi64(_mm_mul_epu32(r1, r[4].v), _mm_mul_epu32(r2, r3)));
+    r5_2 = _mm_slli_epi32(r[5].v, 1);
+    out[6].v = _mm_add_epi64(_mm_mul_epu32(r0, r[6].v), _mm_add_epi64(_mm_mul_epu32(r1, r5_2  ), _mm_add_epi64(_mm_mul_epu32(r2, r[4].v), _mm_mul_epu32(r3, r3_2  ))));
+    r3 = r3_2;
+    out[7].v = _mm_add_epi64(_mm_mul_epu32(r0, r[7].v), _mm_add_epi64(_mm_mul_epu32(r1, r[6].v), _mm_add_epi64(_mm_mul_epu32(r2, r[5].v), _mm_mul_epu32(r3, r[4].v))));
+    r7_2 = _mm_slli_epi32(r[7].v, 1);
+    out[8].v = _mm_add_epi64(_mm_mul_epu32(r0, r[8].v), _mm_add_epi64(_mm_mul_epu32(r1, r7_2  ), _mm_add_epi64(_mm_mul_epu32(r2, r[6].v), _mm_add_epi64(_mm_mul_epu32(r3, r5_2  ), _mm_mul_epu32(r[4].v, r[4].v)))));
+    out[9].v = _mm_add_epi64(_mm_mul_epu32(r0, r[9].v), _mm_add_epi64(_mm_mul_epu32(r1, r[8].v), _mm_add_epi64(_mm_mul_epu32(r2, r[7].v), _mm_add_epi64(_mm_mul_epu32(r3, r[6].v), _mm_mul_epu32(r[4].v, r5_2  )))));
+
+    d5 = _mm_mul_epu32(r[5].v, packedthirtyeight.v);
+    d6 = _mm_mul_epu32(r[6].v, packednineteen.v);
+    d7 = _mm_mul_epu32(r[7].v, packedthirtyeight.v);
+    d8 = _mm_mul_epu32(r[8].v, packednineteen.v);
+    d9 = _mm_mul_epu32(r[9].v, packedthirtyeight.v);
+
+    r4_2 = _mm_slli_epi32(r[4].v, 1);
+    r6_2 = _mm_slli_epi32(r[6].v, 1);
+    out[0].v = _mm_add_epi64(out[0].v, _mm_add_epi64(_mm_mul_epu32(d9, r1                   ), _mm_add_epi64(_mm_mul_epu32(d8, r2  ), _mm_add_epi64(_mm_mul_epu32(d7, r3    ), _mm_add_epi64(_mm_mul_epu32(d6, r4_2), _mm_mul_epu32(d5, r[5].v))))));
+    out[1].v = _mm_add_epi64(out[1].v, _mm_add_epi64(_mm_mul_epu32(d9, _mm_srli_epi32(r2, 1)), _mm_add_epi64(_mm_mul_epu32(d8, r3  ), _mm_add_epi64(_mm_mul_epu32(d7, r[4].v), _mm_mul_epu32(d6, r5_2  )))));
+    out[2].v = _mm_add_epi64(out[2].v, _mm_add_epi64(_mm_mul_epu32(d9, r3                   ), _mm_add_epi64(_mm_mul_epu32(d8, r4_2), _mm_add_epi64(_mm_mul_epu32(d7, r5_2  ), _mm_mul_epu32(d6, r[6].v)))));
+    out[3].v = _mm_add_epi64(out[3].v, _mm_add_epi64(_mm_mul_epu32(d9, r[4].v               ), _mm_add_epi64(_mm_mul_epu32(d8, r5_2), _mm_mul_epu32(d7, r[6].v))));
+    out[4].v = _mm_add_epi64(out[4].v, _mm_add_epi64(_mm_mul_epu32(d9, r5_2                 ), _mm_add_epi64(_mm_mul_epu32(d8, r6_2), _mm_mul_epu32(d7, r[7].v))));
+    out[5].v = _mm_add_epi64(out[5].v, _mm_add_epi64(_mm_mul_epu32(d9, r[6].v               ), _mm_mul_epu32(d8, r7_2  )));
+    out[6].v = _mm_add_epi64(out[6].v, _mm_add_epi64(_mm_mul_epu32(d9, r7_2                 ), _mm_mul_epu32(d8, r[8].v)));
+    out[7].v = _mm_add_epi64(out[7].v, _mm_mul_epu32(d9, r[8].v));
+    out[8].v = _mm_add_epi64(out[8].v, _mm_mul_epu32(d9, r[9].v));
+
+    c1 = _mm_srli_epi64(out[0].v, 26); c2 = _mm_srli_epi64(out[4].v, 26); out[0].v = _mm_and_si128(out[0].v, packedmask26.v); out[4].v = _mm_and_si128(out[4].v, packedmask26.v); out[1].v = _mm_add_epi64(out[1].v, c1); out[5].v = _mm_add_epi64(out[5].v, c2);
+    c1 = _mm_srli_epi64(out[1].v, 25); c2 = _mm_srli_epi64(out[5].v, 25); out[1].v = _mm_and_si128(out[1].v, packedmask25.v); out[5].v = _mm_and_si128(out[5].v, packedmask25.v); out[2].v = _mm_add_epi64(out[2].v, c1); out[6].v = _mm_add_epi64(out[6].v, c2);
+    c1 = _mm_srli_epi64(out[2].v, 26); c2 = _mm_srli_epi64(out[6].v, 26); out[2].v = _mm_and_si128(out[2].v, packedmask26.v); out[6].v = _mm_and_si128(out[6].v, packedmask26.v); out[3].v = _mm_add_epi64(out[3].v, c1); out[7].v = _mm_add_epi64(out[7].v, c2);
+    c1 = _mm_srli_epi64(out[3].v, 25); c2 = _mm_srli_epi64(out[7].v, 25); out[3].v = _mm_and_si128(out[3].v, packedmask25.v); out[7].v = _mm_and_si128(out[7].v, packedmask25.v); out[4].v = _mm_add_epi64(out[4].v, c1); out[8].v = _mm_add_epi64(out[8].v, c2);
+                                       c2 = _mm_srli_epi64(out[8].v, 26);                                                     out[8].v = _mm_and_si128(out[8].v, packedmask26.v);                                         out[9].v = _mm_add_epi64(out[9].v, c2);
+                                       c2 = _mm_srli_epi64(out[9].v, 25);                                                     out[9].v = _mm_and_si128(out[9].v, packedmask25.v);                                         out[0].v = _mm_add_epi64(out[0].v, _mm_mul_epu32(c2, packednineteen.v));
+    c1 = _mm_srli_epi64(out[0].v, 26); c2 = _mm_srli_epi64(out[4].v, 26); out[0].v = _mm_and_si128(out[0].v, packedmask26.v); out[4].v = _mm_and_si128(out[4].v, packedmask26.v); out[1].v = _mm_add_epi64(out[1].v, c1); out[5].v = _mm_add_epi64(out[5].v, c2);
+}
+
+/* make [nqx+nqz,nqpqx+nqpqz], [nqpqx-nqpqz,nqx-nqz] from [nqx+nqz,nqpqx+nqpqz], [nqx-nqz,nqpqx-nqpqz] */
+inline void
+curve25519_make_nqpq(packedelem64 *primex, packedelem64 *primez, const packedelem32 *pqx, const packedelem32 *pqz) {
+    primex[0].v = _mm_shuffle_epi32(pqx[0].v, _MM_SHUFFLE(1,1,0,0));
+    primex[1].v = _mm_shuffle_epi32(pqx[0].v, _MM_SHUFFLE(3,3,2,2));
+    primex[2].v = _mm_shuffle_epi32(pqx[1].v, _MM_SHUFFLE(1,1,0,0));
+    primex[3].v = _mm_shuffle_epi32(pqx[1].v, _MM_SHUFFLE(3,3,2,2));
+    primex[4].v = _mm_shuffle_epi32(pqx[2].v, _MM_SHUFFLE(1,1,0,0));
+    primex[5].v = _mm_shuffle_epi32(pqx[2].v, _MM_SHUFFLE(3,3,2,2));
+    primex[6].v = _mm_shuffle_epi32(pqx[3].v, _MM_SHUFFLE(1,1,0,0));
+    primex[7].v = _mm_shuffle_epi32(pqx[3].v, _MM_SHUFFLE(3,3,2,2));
+    primex[8].v = _mm_shuffle_epi32(pqx[4].v, _MM_SHUFFLE(1,1,0,0));
+    primex[9].v = _mm_shuffle_epi32(pqx[4].v, _MM_SHUFFLE(3,3,2,2));
+    primez[0].v = _mm_shuffle_epi32(pqz[0].v, _MM_SHUFFLE(0,0,1,1));
+    primez[1].v = _mm_shuffle_epi32(pqz[0].v, _MM_SHUFFLE(2,2,3,3));
+    primez[2].v = _mm_shuffle_epi32(pqz[1].v, _MM_SHUFFLE(0,0,1,1));
+    primez[3].v = _mm_shuffle_epi32(pqz[1].v, _MM_SHUFFLE(2,2,3,3));
+    primez[4].v = _mm_shuffle_epi32(pqz[2].v, _MM_SHUFFLE(0,0,1,1));
+    primez[5].v = _mm_shuffle_epi32(pqz[2].v, _MM_SHUFFLE(2,2,3,3));
+    primez[6].v = _mm_shuffle_epi32(pqz[3].v, _MM_SHUFFLE(0,0,1,1));
+    primez[7].v = _mm_shuffle_epi32(pqz[3].v, _MM_SHUFFLE(2,2,3,3));
+    primez[8].v = _mm_shuffle_epi32(pqz[4].v, _MM_SHUFFLE(0,0,1,1));
+    primez[9].v = _mm_shuffle_epi32(pqz[4].v, _MM_SHUFFLE(2,2,3,3));
+}
+
+/* make [nqx+nqz,nqx-nqz] from [nqx+nqz,nqpqx+nqpqz], [nqx-nqz,nqpqx-nqpqz] */
+inline void
+curve25519_make_nq(packedelem64 *nq, const packedelem32 *pqx, const packedelem32 *pqz) {
+    nq[0].v = _mm_unpacklo_epi64(pqx[0].v, pqz[0].v);
+    nq[1].v = _mm_unpackhi_epi64(pqx[0].v, pqz[0].v);
+    nq[2].v = _mm_unpacklo_epi64(pqx[1].v, pqz[1].v);
+    nq[3].v = _mm_unpackhi_epi64(pqx[1].v, pqz[1].v);
+    nq[4].v = _mm_unpacklo_epi64(pqx[2].v, pqz[2].v);
+    nq[5].v = _mm_unpackhi_epi64(pqx[2].v, pqz[2].v);
+    nq[6].v = _mm_unpacklo_epi64(pqx[3].v, pqz[3].v);
+    nq[7].v = _mm_unpackhi_epi64(pqx[3].v, pqz[3].v);
+    nq[8].v = _mm_unpacklo_epi64(pqx[4].v, pqz[4].v);
+    nq[9].v = _mm_unpackhi_epi64(pqx[4].v, pqz[4].v);
+}
+
+/* compute [nqx+nqz,nqx-nqz] from nqx, nqz */
+inline void
+curve25519_compute_nq(packedelem64 *nq, const bignum25519 nqx, const bignum25519 nqz) {
+    xmmi x0,x1,x2;
+    xmmi z0,z1,z2;
+    xmmi a0,a1,a2;
+    xmmi s0,s1,s2;
+    xmmi r0,r1;
+    xmmi c1,c2;
+    x0 = _mm_load_si128((xmmi*)nqx + 0);
+    x1 = _mm_load_si128((xmmi*)nqx + 1);
+    x2 = _mm_load_si128((xmmi*)nqx + 2);
+    z0 = _mm_load_si128((xmmi*)nqz + 0);
+    z1 = _mm_load_si128((xmmi*)nqz + 1);
+    z2 = _mm_load_si128((xmmi*)nqz + 2);
+    a0 = _mm_add_epi32(x0, z0);
+    a1 = _mm_add_epi32(x1, z1);
+    a2 = _mm_add_epi32(x2, z2);
+    s0 = _mm_add_epi32(x0, packed2p0.v);
+    s1 = _mm_add_epi32(x1, packed2p1.v);
+    s2 = _mm_add_epi32(x2, packed2p2.v);
+    s0 = _mm_sub_epi32(s0, z0);
+    s1 = _mm_sub_epi32(s1, z1);
+    s2 = _mm_sub_epi32(s2, z2);
+    r0 = _mm_and_si128(_mm_shuffle_epi32(s0, _MM_SHUFFLE(2,2,0,0)), sse2_bot32bitmask.v);
+    r1 = _mm_and_si128(_mm_shuffle_epi32(s0, _MM_SHUFFLE(3,3,1,1)), sse2_bot32bitmask.v);
+    c1 = _mm_srli_epi32(r0, 26);
+    c2 = _mm_srli_epi32(r1, 25);
+    r0 = _mm_and_si128(r0, packedmask26.v);
+    r1 = _mm_and_si128(r1, packedmask25.v);
+    r0 = _mm_add_epi32(r0, _mm_slli_si128(c2, 8));
+    r1 = _mm_add_epi32(r1, c1);
+    s0 = _mm_unpacklo_epi64(_mm_unpacklo_epi32(r0, r1), _mm_unpackhi_epi32(r0, r1));
+    s1 = _mm_add_epi32(s1, _mm_srli_si128(c2, 8));
+    nq[0].v = _mm_unpacklo_epi64(a0, s0);
+    nq[2].v = _mm_unpackhi_epi64(a0, s0);
+    nq[4].v = _mm_unpacklo_epi64(a1, s1);
+    nq[6].v = _mm_unpackhi_epi64(a1, s1);
+    nq[8].v = _mm_unpacklo_epi64(a2, s2);
+    nq[1].v = _mm_shuffle_epi32(nq[0].v, _MM_SHUFFLE(3,3,1,1));
+    nq[3].v = _mm_shuffle_epi32(nq[2].v, _MM_SHUFFLE(3,3,1,1));
+    nq[5].v = _mm_shuffle_epi32(nq[4].v, _MM_SHUFFLE(3,3,1,1));
+    nq[7].v = _mm_shuffle_epi32(nq[6].v, _MM_SHUFFLE(3,3,1,1));
+    nq[9].v = _mm_shuffle_epi32(nq[8].v, _MM_SHUFFLE(3,3,1,1));
+}
+
+
+/* compute [x+z,x-z] from [x,z] */
+inline void
+curve25519_addsub_packed64(packedelem64 *r)  {
+    packed32bignum25519 x,z,add,sub;
+
+    x[0].v = _mm_unpacklo_epi64(r[0].v, r[1].v);
+    z[0].v = _mm_unpackhi_epi64(r[0].v, r[1].v);
+    x[1].v = _mm_unpacklo_epi64(r[2].v, r[3].v);
+    z[1].v = _mm_unpackhi_epi64(r[2].v, r[3].v);
+    x[2].v = _mm_unpacklo_epi64(r[4].v, r[5].v);
+    z[2].v = _mm_unpackhi_epi64(r[4].v, r[5].v);
+    x[3].v = _mm_unpacklo_epi64(r[6].v, r[7].v);
+    z[3].v = _mm_unpackhi_epi64(r[6].v, r[7].v);
+    x[4].v = _mm_unpacklo_epi64(r[8].v, r[9].v);
+    z[4].v = _mm_unpackhi_epi64(r[8].v, r[9].v);
+
+    curve25519_add_packed32(add, x, z);
+    curve25519_sub_packed32(sub, x, z);
+
+    r[0].v = _mm_unpacklo_epi64(add[0].v, sub[0].v);
+    r[1].v = _mm_unpackhi_epi64(add[0].v, sub[0].v);
+    r[2].v = _mm_unpacklo_epi64(add[1].v, sub[1].v);
+    r[3].v = _mm_unpackhi_epi64(add[1].v, sub[1].v);
+    r[4].v = _mm_unpacklo_epi64(add[2].v, sub[2].v);
+    r[5].v = _mm_unpackhi_epi64(add[2].v, sub[2].v);
+    r[6].v = _mm_unpacklo_epi64(add[3].v, sub[3].v);
+    r[7].v = _mm_unpackhi_epi64(add[3].v, sub[3].v);
+    r[8].v = _mm_unpacklo_epi64(add[4].v, sub[4].v);
+    r[9].v = _mm_unpackhi_epi64(add[4].v, sub[4].v);
+}
+
+/* compute [x,z] * [121666,121665] */
+inline void
+curve25519_121665_packed64(packedelem64 *out, const packedelem64 *in) {
+    xmmi c1,c2;
+
+    out[0].v = _mm_mul_epu32(in[0].v, packed121666121665.v);
+    out[1].v = _mm_mul_epu32(in[1].v, packed121666121665.v);
+    out[2].v = _mm_mul_epu32(in[2].v, packed121666121665.v);
+    out[3].v = _mm_mul_epu32(in[3].v, packed121666121665.v);
+    out[4].v = _mm_mul_epu32(in[4].v, packed121666121665.v);
+    out[5].v = _mm_mul_epu32(in[5].v, packed121666121665.v);
+    out[6].v = _mm_mul_epu32(in[6].v, packed121666121665.v);
+    out[7].v = _mm_mul_epu32(in[7].v, packed121666121665.v);
+    out[8].v = _mm_mul_epu32(in[8].v, packed121666121665.v);
+    out[9].v = _mm_mul_epu32(in[9].v, packed121666121665.v);
+
+    c1 = _mm_srli_epi64(out[0].v, 26); c2 = _mm_srli_epi64(out[4].v, 26); out[0].v = _mm_and_si128(out[0].v, packedmask26.v); out[4].v = _mm_and_si128(out[4].v, packedmask26.v); out[1].v = _mm_add_epi64(out[1].v, c1); out[5].v = _mm_add_epi64(out[5].v, c2);
+    c1 = _mm_srli_epi64(out[1].v, 25); c2 = _mm_srli_epi64(out[5].v, 25); out[1].v = _mm_and_si128(out[1].v, packedmask25.v); out[5].v = _mm_and_si128(out[5].v, packedmask25.v); out[2].v = _mm_add_epi64(out[2].v, c1); out[6].v = _mm_add_epi64(out[6].v, c2);
+    c1 = _mm_srli_epi64(out[2].v, 26); c2 = _mm_srli_epi64(out[6].v, 26); out[2].v = _mm_and_si128(out[2].v, packedmask26.v); out[6].v = _mm_and_si128(out[6].v, packedmask26.v); out[3].v = _mm_add_epi64(out[3].v, c1); out[7].v = _mm_add_epi64(out[7].v, c2);
+    c1 = _mm_srli_epi64(out[3].v, 25); c2 = _mm_srli_epi64(out[7].v, 25); out[3].v = _mm_and_si128(out[3].v, packedmask25.v); out[7].v = _mm_and_si128(out[7].v, packedmask25.v); out[4].v = _mm_add_epi64(out[4].v, c1); out[8].v = _mm_add_epi64(out[8].v, c2);
+                                       c2 = _mm_srli_epi64(out[8].v, 26);                                                     out[8].v = _mm_and_si128(out[8].v, packedmask26.v);                                         out[9].v = _mm_add_epi64(out[9].v, c2);
+                                       c2 = _mm_srli_epi64(out[9].v, 25);                                                     out[9].v = _mm_and_si128(out[9].v, packedmask25.v);                                         out[0].v = _mm_add_epi64(out[0].v, _mm_mul_epu32(c2, packednineteen.v));
+    c1 = _mm_srli_epi64(out[0].v, 26); c2 = _mm_srli_epi64(out[4].v, 26); out[0].v = _mm_and_si128(out[0].v, packedmask26.v); out[4].v = _mm_and_si128(out[4].v, packedmask26.v); out[1].v = _mm_add_epi64(out[1].v, c1); out[5].v = _mm_add_epi64(out[5].v, c2);
+}
+
+/* compute [sq.x,sqscalar.x-sqscalar.z] * [sq.z,sq.x-sq.z] */
+inline void
+curve25519_final_nq(packedelem64 *nq, const packedelem64 *sq, const packedelem64 *sq121665) {
+    packed32bignum25519 x, z, sub;
+    packed64bignum25519 t, nqa, nqb;
+
+    x[0].v = _mm_or_si128(_mm_unpacklo_epi64(sq[0].v, sq[1].v), _mm_slli_si128(_mm_unpacklo_epi64(sq121665[0].v, sq121665[1].v), 4));
+    z[0].v = _mm_or_si128(_mm_unpackhi_epi64(sq[0].v, sq[1].v), _mm_slli_si128(_mm_unpackhi_epi64(sq121665[0].v, sq121665[1].v), 4));
+    x[1].v = _mm_or_si128(_mm_unpacklo_epi64(sq[2].v, sq[3].v), _mm_slli_si128(_mm_unpacklo_epi64(sq121665[2].v, sq121665[3].v), 4));
+    z[1].v = _mm_or_si128(_mm_unpackhi_epi64(sq[2].v, sq[3].v), _mm_slli_si128(_mm_unpackhi_epi64(sq121665[2].v, sq121665[3].v), 4));
+    x[2].v = _mm_or_si128(_mm_unpacklo_epi64(sq[4].v, sq[5].v), _mm_slli_si128(_mm_unpacklo_epi64(sq121665[4].v, sq121665[5].v), 4));
+    z[2].v = _mm_or_si128(_mm_unpackhi_epi64(sq[4].v, sq[5].v), _mm_slli_si128(_mm_unpackhi_epi64(sq121665[4].v, sq121665[5].v), 4));
+    x[3].v = _mm_or_si128(_mm_unpacklo_epi64(sq[6].v, sq[7].v), _mm_slli_si128(_mm_unpacklo_epi64(sq121665[6].v, sq121665[7].v), 4));
+    z[3].v = _mm_or_si128(_mm_unpackhi_epi64(sq[6].v, sq[7].v), _mm_slli_si128(_mm_unpackhi_epi64(sq121665[6].v, sq121665[7].v), 4));
+    x[4].v = _mm_or_si128(_mm_unpacklo_epi64(sq[8].v, sq[9].v), _mm_slli_si128(_mm_unpacklo_epi64(sq121665[8].v, sq121665[9].v), 4));
+    z[4].v = _mm_or_si128(_mm_unpackhi_epi64(sq[8].v, sq[9].v), _mm_slli_si128(_mm_unpackhi_epi64(sq121665[8].v, sq121665[9].v), 4));
+
+    curve25519_sub_packed32(sub, x, z);
+
+    t[0].v = _mm_shuffle_epi32(sub[0].v, _MM_SHUFFLE(1,1,0,0));
+    t[1].v = _mm_shuffle_epi32(sub[0].v, _MM_SHUFFLE(3,3,2,2));
+    t[2].v = _mm_shuffle_epi32(sub[1].v, _MM_SHUFFLE(1,1,0,0));
+    t[3].v = _mm_shuffle_epi32(sub[1].v, _MM_SHUFFLE(3,3,2,2));
+    t[4].v = _mm_shuffle_epi32(sub[2].v, _MM_SHUFFLE(1,1,0,0));
+    t[5].v = _mm_shuffle_epi32(sub[2].v, _MM_SHUFFLE(3,3,2,2));
+    t[6].v = _mm_shuffle_epi32(sub[3].v, _MM_SHUFFLE(1,1,0,0));
+    t[7].v = _mm_shuffle_epi32(sub[3].v, _MM_SHUFFLE(3,3,2,2));
+    t[8].v = _mm_shuffle_epi32(sub[4].v, _MM_SHUFFLE(1,1,0,0));
+    t[9].v = _mm_shuffle_epi32(sub[4].v, _MM_SHUFFLE(3,3,2,2));
+
+    nqa[0].v = _mm_unpacklo_epi64(sq[0].v, t[0].v);
+    nqb[0].v = _mm_unpackhi_epi64(sq[0].v, t[0].v);
+    nqa[1].v = _mm_unpacklo_epi64(sq[1].v, t[1].v);
+    nqb[1].v = _mm_unpackhi_epi64(sq[1].v, t[1].v);
+    nqa[2].v = _mm_unpacklo_epi64(sq[2].v, t[2].v);
+    nqb[2].v = _mm_unpackhi_epi64(sq[2].v, t[2].v);
+    nqa[3].v = _mm_unpacklo_epi64(sq[3].v, t[3].v);
+    nqb[3].v = _mm_unpackhi_epi64(sq[3].v, t[3].v);
+    nqa[4].v = _mm_unpacklo_epi64(sq[4].v, t[4].v);
+    nqb[4].v = _mm_unpackhi_epi64(sq[4].v, t[4].v);
+    nqa[5].v = _mm_unpacklo_epi64(sq[5].v, t[5].v);
+    nqb[5].v = _mm_unpackhi_epi64(sq[5].v, t[5].v);
+    nqa[6].v = _mm_unpacklo_epi64(sq[6].v, t[6].v);
+    nqb[6].v = _mm_unpackhi_epi64(sq[6].v, t[6].v);
+    nqa[7].v = _mm_unpacklo_epi64(sq[7].v, t[7].v);
+    nqb[7].v = _mm_unpackhi_epi64(sq[7].v, t[7].v);
+    nqa[8].v = _mm_unpacklo_epi64(sq[8].v, t[8].v);
+    nqb[8].v = _mm_unpackhi_epi64(sq[8].v, t[8].v);
+    nqa[9].v = _mm_unpacklo_epi64(sq[9].v, t[9].v);
+    nqb[9].v = _mm_unpackhi_epi64(sq[9].v, t[9].v);
+
+    curve25519_mul_packed64(nq, nqa, nqb);
+}
+
+/*
+ * In:  b =   2^5 - 2^0
+ * Out: b = 2^250 - 2^0
+ */
+void
+curve25519_pow_two5mtwo0_two250mtwo0(bignum25519 b) {
+    ALIGN(16) bignum25519 t0,c;
+
+    /* 2^5  - 2^0 */ /* b */
+    /* 2^10 - 2^5 */ curve25519_square_times(t0, b, 5);
+    /* 2^10 - 2^0 */ curve25519_mul(b, t0, b);
+    /* 2^20 - 2^10 */ curve25519_square_times(t0, b, 10);
+    /* 2^20 - 2^0 */ curve25519_mul(c, t0, b);
+    /* 2^40 - 2^20 */ curve25519_square_times(t0, c, 20);
+    /* 2^40 - 2^0 */ curve25519_mul(t0, t0, c);
+    /* 2^50 - 2^10 */ curve25519_square_times(t0, t0, 10);
+    /* 2^50 - 2^0 */ curve25519_mul(b, t0, b);
+    /* 2^100 - 2^50 */ curve25519_square_times(t0, b, 50);
+    /* 2^100 - 2^0 */ curve25519_mul(c, t0, b);
+    /* 2^200 - 2^100 */ curve25519_square_times(t0, c, 100);
+    /* 2^200 - 2^0 */ curve25519_mul(t0, t0, c);
+    /* 2^250 - 2^50 */ curve25519_square_times(t0, t0, 50);
+    /* 2^250 - 2^0 */ curve25519_mul(b, t0, b);
+}
+
+/*
+ * z^(p - 2) = z(2^255 - 21)
+ */
+void
+curve25519_recip(bignum25519 out, const bignum25519 z) {
+    ALIGN(16) bignum25519 a, t0, b;
+
+    /* 2 */ curve25519_square(a, z); /* a = 2 */
+    /* 8 */ curve25519_square_times(t0, a, 2);
+    /* 9 */ curve25519_mul(b, t0, z); /* b = 9 */
+    /* 11 */ curve25519_mul(a, b, a); /* a = 11 */
+    /* 22 */ curve25519_square(t0, a);
+    /* 2^5 - 2^0 = 31 */ curve25519_mul(b, t0, b);
+    /* 2^250 - 2^0 */ curve25519_pow_two5mtwo0_two250mtwo0(b);
+    /* 2^255 - 2^5 */ curve25519_square_times(b, b, 5);
+    /* 2^255 - 21 */  curve25519_mul(out, b, a);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+
+int curve25519_mult_SSE2(byte sharedKey[32], const byte secretKey[32], const byte othersKey[32])
+{
+    FixedSizeSecBlock<byte, 32> e;
+    for (size_t i = 0;i < 32;++i)
+        e[i] = secretKey[i];
+    e[0] &= 0xf8; e[31] &= 0x7f; e[31] |= 0x40;
+
+    ALIGN(16) bignum25519 nqx = {1}, nqpqz = {1}, nqz = {0}, nqpqx, zmone;
+    packed32bignum25519 qx, qz, pqz, pqx;
+    packed64bignum25519 nq, sq, sqscalar, prime, primex, primez, nqpq;
+    bignum25519mulprecomp preq;
+    size_t bit=0;
+
+    curve25519_expand(nqpqx, othersKey);
+    curve25519_mul_precompute(&preq, nqpqx);
+
+    /* do bits 254..3 */
+    for (size_t i = 254, lastbit=0; i >= 3; i--) {
+        bit = (e[i/8] >> (i & 7)) & 1;
+        curve25519_swap_conditional(nqx, nqpqx, (word32)(bit ^ lastbit));
+        curve25519_swap_conditional(nqz, nqpqz, (word32)(bit ^ lastbit));
+        lastbit = bit;
+
+        curve25519_tangle32(qx, nqx, nqpqx); /* qx = [nqx,nqpqx] */
+        curve25519_tangle32(qz, nqz, nqpqz); /* qz = [nqz,nqpqz] */
+
+        curve25519_add_packed32(pqx, qx, qz); /* pqx = [nqx+nqz,nqpqx+nqpqz] */
+        curve25519_sub_packed32(pqz, qx, qz); /* pqz = [nqx-nqz,nqpqx-nqpqz] */
+
+        curve25519_make_nqpq(primex, primez, pqx, pqz); /* primex = [nqx+nqz,nqpqx+nqpqz], primez = [nqpqx-nqpqz,nqx-nqz] */
+        curve25519_mul_packed64(prime, primex, primez); /* prime = [nqx+nqz,nqpqx+nqpqz] * [nqpqx-nqpqz,nqx-nqz] */
+        curve25519_addsub_packed64(prime); /* prime = [prime.x+prime.z,prime.x-prime.z] */
+        curve25519_square_packed64(nqpq, prime); /* nqpq = prime^2 */
+        curve25519_untangle64(nqpqx, nqpqz, nqpq);
+        curve25519_mul_precomputed(nqpqz, nqpqz, &preq); /* nqpqz = nqpqz * q */
+
+        /* (((sq.x-sq.z)*121665)+sq.x) * (sq.x-sq.z) is equivalent to (sq.x*121666-sq.z*121665) * (sq.x-sq.z) */
+        curve25519_make_nq(nq, pqx, pqz); /* nq = [nqx+nqz,nqx-nqz] */
+        curve25519_square_packed64(sq, nq); /* sq = nq^2 */
+        curve25519_121665_packed64(sqscalar, sq); /* sqscalar = sq * [121666,121665] */
+        curve25519_final_nq(nq, sq, sqscalar); /* nq = [sq.x,sqscalar.x-sqscalar.z] * [sq.z,sq.x-sq.z] */
+        curve25519_untangle64(nqx, nqz, nq);
+    };
+
+    /* it's possible to get rid of this swap with the swap in the above loop
+       at the bottom instead of the top, but compilers seem to optimize better this way */
+    curve25519_swap_conditional(nqx, nqpqx, (word32)bit);
+    curve25519_swap_conditional(nqz, nqpqz, (word32)bit);
+
+    /* do bits 2..0 */
+    for (size_t i = 0; i < 3; i++) {
+        curve25519_compute_nq(nq, nqx, nqz);
+        curve25519_square_packed64(sq, nq); /* sq = nq^2 */
+        curve25519_121665_packed64(sqscalar, sq); /* sqscalar = sq * [121666,121665] */
+        curve25519_final_nq(nq, sq, sqscalar); /* nq = [sq.x,sqscalar.x-sqscalar.z] * [sq.z,sq.x-sq.z] */
+        curve25519_untangle64(nqx, nqz, nq);
+    }
+
+    curve25519_recip(zmone, nqz);
+    curve25519_mul(nqz, nqx, zmone);
+    curve25519_contract(sharedKey, nqz);
+
+    return 0;
+}
+
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_CURVE25519_SSE2
diff --git a/runtime/third_party/cryptopp/donna_sse.h b/runtime/third_party/cryptopp/donna_sse.h
new file mode 100644
index 0000000..581bf60
--- /dev/null
+++ b/runtime/third_party/cryptopp/donna_sse.h
@@ -0,0 +1,86 @@
+// donna_sse.h - written and placed in public domain by Jeffrey Walton
+//               Crypto++ specific implementation wrapped around Andrew
+//               Moon's public domain curve25519-donna and ed25519-donna,
+//               https://github.com/floodyberry/curve25519-donna and
+//               https://github.com/floodyberry/ed25519-donna.
+
+// This source file multiplexes two different repos using namespaces. This
+// was a little easier from a project management standpoint. We only need
+// two files per architecture at the expense of namespaces and bloat.
+
+#ifndef CRYPTOPP_DONNA_SSE_H
+#define CRYPTOPP_DONNA_SSE_H
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+
+#include "config.h"
+#include <emmintrin.h>
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Donna)
+NAMESPACE_BEGIN(ArchSSE)
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+
+typedef __m128i xmmi;
+#define ALIGN(n) CRYPTOPP_ALIGN_DATA(n)
+
+typedef union packedelem8_t {
+    byte u[16];
+    xmmi v;
+} packedelem8;
+
+typedef union packedelem32_t {
+    word32 u[4];
+    xmmi v;
+} packedelem32;
+
+typedef union packedelem64_t {
+    word64 u[2];
+    xmmi v;
+} packedelem64;
+
+/* 10 elements + an extra 2 to fit in 3 xmm registers */
+typedef word32 bignum25519[12];
+typedef packedelem32 packed32bignum25519[5];
+typedef packedelem64 packed64bignum25519[10];
+
+const word32 reduce_mask_26 = (1 << 26) - 1;
+const word32 reduce_mask_25 = (1 << 25) - 1;
+
+const packedelem32 sse2_bot32bitmask = {{0xffffffff, 0x00000000, 0xffffffff, 0x00000000}};
+const packedelem32 sse2_top32bitmask = {{0x00000000, 0xffffffff, 0x00000000, 0xffffffff}};
+const packedelem32 sse2_top64bitmask = {{0x00000000, 0x00000000, 0xffffffff, 0xffffffff}};
+const packedelem32 sse2_bot64bitmask = {{0xffffffff, 0xffffffff, 0x00000000, 0x00000000}};
+
+/* reduction masks */
+const packedelem64 packedmask26 = {{0x03ffffff, 0x03ffffff}};
+const packedelem64 packedmask25 = {{0x01ffffff, 0x01ffffff}};
+const packedelem32 packedmask2625 = {{0x3ffffff,0,0x1ffffff,0}};
+const packedelem32 packedmask26262626 = {{0x03ffffff, 0x03ffffff, 0x03ffffff, 0x03ffffff}};
+const packedelem32 packedmask25252525 = {{0x01ffffff, 0x01ffffff, 0x01ffffff, 0x01ffffff}};
+
+/* multipliers */
+const packedelem64 packednineteen = {{19, 19}};
+const packedelem64 packednineteenone = {{19, 1}};
+const packedelem64 packedthirtyeight = {{38, 38}};
+const packedelem64 packed3819 = {{19*2,19}};
+const packedelem64 packed9638 = {{19*4,19*2}};
+
+/* 121666,121665 */
+const packedelem64 packed121666121665 = {{121666, 121665}};
+
+/* 2*(2^255 - 19) = 0 mod p */
+const packedelem32 packed2p0 = {{0x7ffffda,0x3fffffe,0x7fffffe,0x3fffffe}};
+const packedelem32 packed2p1 = {{0x7fffffe,0x3fffffe,0x7fffffe,0x3fffffe}};
+const packedelem32 packed2p2 = {{0x7fffffe,0x3fffffe,0x0000000,0x0000000}};
+
+const packedelem32 packed32zeromodp0 = {{0x7ffffda,0x7ffffda,0x3fffffe,0x3fffffe}};
+const packedelem32 packed32zeromodp1 = {{0x7fffffe,0x7fffffe,0x3fffffe,0x3fffffe}};
+
+NAMESPACE_END  // ArchSSE
+NAMESPACE_END  // Donna
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_DOXYGEN_PROCESSING
+#endif  // CRYPTOPP_DONNA_SSE_H
diff --git a/runtime/third_party/cryptopp/drbg.h b/runtime/third_party/cryptopp/drbg.h
new file mode 100644
index 0000000..8192077
--- /dev/null
+++ b/runtime/third_party/cryptopp/drbg.h
@@ -0,0 +1,718 @@
+// drbg.h - written and placed in public domain by Jeffrey Walton.
+
+/// \file drbg.h
+/// \brief Classes for NIST DRBGs from SP 800-90A
+/// \sa <A HREF="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf">Recommendation
+///  for Random Number Generation Using Deterministic Random Bit Generators, Rev 1 (June 2015)</A>
+/// \since Crypto++ 6.0
+
+#ifndef CRYPTOPP_NIST_DRBG_H
+#define CRYPTOPP_NIST_DRBG_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "hmac.h"
+#include "sha.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Interface for NIST DRBGs from SP 800-90A
+/// \details NIST_DRBG is the base class interface for NIST DRBGs from SP 800-90A Rev 1 (June 2015)
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \sa <A HREF="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf">Recommendation
+///  for Random Number Generation Using Deterministic Random Bit Generators, Rev 1 (June 2015)</A>
+/// \since Crypto++ 6.0
+class NIST_DRBG : public RandomNumberGenerator
+{
+public:
+    /// \brief Exception thrown when a NIST DRBG encounters an error
+    class Err : public Exception
+    {
+    public:
+        explicit Err(const std::string &c, const std::string &m)
+        : Exception(OTHER_ERROR, c + ": " + m) {}
+    };
+
+public:
+    virtual ~NIST_DRBG() {}
+
+    /// \brief Determines if a generator can accept additional entropy
+    /// \return true
+    /// \details All NIST_DRBG return true
+    virtual bool CanIncorporateEntropy() const {return true;}
+
+    /// \brief Update RNG state with additional unpredictable values
+    /// \param input the entropy to add to the generator
+    /// \param length the size of the input buffer
+    /// \throw NIST_DRBG::Err if the generator is reseeded with insufficient entropy
+    /// \details NIST instantiation and reseed requirements demand the generator is constructed
+    ///  with at least <tt>MINIMUM_ENTROPY</tt> entropy. The byte array for <tt>input</tt> must
+    ///  meet <A HREF ="http://csrc.nist.gov/publications/PubsSPs.html">NIST SP 800-90B or
+    ///  SP 800-90C</A> requirements.
+    virtual void IncorporateEntropy(const byte *input, size_t length)=0;
+
+    /// \brief Update RNG state with additional unpredictable values
+    /// \param entropy the entropy to add to the generator
+    /// \param entropyLength the size of the input buffer
+    /// \param additional additional input to add to the generator
+    /// \param additionaLength the size of the additional input buffer
+    /// \throw NIST_DRBG::Err if the generator is reseeded with insufficient entropy
+    /// \details IncorporateEntropy() is an overload provided to match NIST requirements. NIST
+    ///  instantiation and reseed requirements demand the generator is constructed with at least
+    ///  <tt>MINIMUM_ENTROPY</tt> entropy. The byte array for <tt>entropy</tt> must meet
+    ///  <A HREF ="http://csrc.nist.gov/publications/PubsSPs.html">NIST SP 800-90B or
+    ///!  SP 800-90C</A> requirements.
+    virtual void IncorporateEntropy(const byte *entropy, size_t entropyLength, const byte* additional, size_t additionaLength)=0;
+
+    /// \brief Generate random array of bytes
+    /// \param output the byte buffer
+    /// \param size the length of the buffer, in bytes
+    /// \throw NIST_DRBG::Err if a reseed is required
+    /// \throw NIST_DRBG::Err if the size exceeds <tt>MAXIMUM_BYTES_PER_REQUEST</tt>
+    virtual void GenerateBlock(byte *output, size_t size)=0;
+
+    /// \brief Generate random array of bytes
+    /// \param additional additional input to add to the generator
+    /// \param additionaLength the size of the additional input buffer
+    /// \param output the byte buffer
+    /// \param size the length of the buffer, in bytes
+    /// \throw NIST_DRBG::Err if a reseed is required
+    /// \throw NIST_DRBG::Err if the size exceeds <tt>MAXIMUM_BYTES_PER_REQUEST</tt>
+    /// \details GenerateBlock() is an overload provided to match NIST requirements. The byte
+    ///  array for <tt>additional</tt> input is optional. If present the additional randomness
+    ///  is mixed before generating the output bytes.
+    virtual void GenerateBlock(const byte* additional, size_t additionaLength, byte *output, size_t size)=0;
+
+    /// \brief Provides the security strength
+    /// \return The security strength of the generator, in bytes
+    /// \details The equivalent class constant is <tt>SECURITY_STRENGTH</tt>
+    virtual unsigned int SecurityStrength() const=0;
+
+    /// \brief Provides the seed length
+    /// \return The seed size of the generator, in bytes
+    /// \details The equivalent class constant is <tt>SEED_LENGTH</tt>. The size is
+    ///  used to maintain internal state of <tt>V</tt> and <tt>C</tt>.
+    virtual unsigned int SeedLength() const=0;
+
+    /// \brief Provides the minimum entropy size
+    /// \return The minimum entropy size required by the generator, in bytes
+    /// \details The equivalent class constant is <tt>MINIMUM_ENTROPY</tt>. All NIST DRBGs must
+    ///  be instaniated with at least <tt>MINIMUM_ENTROPY</tt> bytes of entropy. The bytes must
+    ///  meet <A HREF="http://csrc.nist.gov/publications/PubsSPs.html">NIST SP 800-90B or
+    ///  SP 800-90C</A> requirements.
+    virtual unsigned int MinEntropyLength() const=0;
+
+    /// \brief Provides the maximum entropy size
+    /// \return The maximum entropy size that can be consumed by the generator, in bytes
+    /// \details The equivalent class constant is <tt>MAXIMUM_ENTROPY</tt>. The bytes must
+    ///  meet <A HREF="http://csrc.nist.gov/publications/PubsSPs.html">NIST SP 800-90B or
+    ///  SP 800-90C</A> requirements. <tt>MAXIMUM_ENTROPY</tt> has been reduced from
+    ///  2<sup>35</sup> to <tt>INT_MAX</tt> to fit the underlying C++ datatype.
+    virtual unsigned int MaxEntropyLength() const=0;
+
+    /// \brief Provides the minimum nonce size
+    /// \return The minimum nonce size recommended for the generator, in bytes
+    /// \details The equivalent class constant is <tt>MINIMUM_NONCE</tt>. If a nonce is not
+    ///  required then <tt>MINIMUM_NONCE</tt> is 0. <tt>Hash_DRBG</tt> does not require a
+    ///  nonce, while <tt>HMAC_DRBG</tt> and <tt>CTR_DRBG</tt> require a nonce.
+    virtual unsigned int MinNonceLength() const=0;
+
+    /// \brief Provides the maximum nonce size
+    /// \return The maximum nonce that can be consumed by the generator, in bytes
+    /// \details The equivalent class constant is <tt>MAXIMUM_NONCE</tt>. <tt>MAXIMUM_NONCE</tt>
+    ///  has been reduced from 2<sup>35</sup> to <tt>INT_MAX</tt> to fit the underlying C++ datatype.
+    ///  If a nonce is not required then <tt>MINIMUM_NONCE</tt> is 0. <tt>Hash_DRBG</tt> does not
+    ///  require a nonce, while <tt>HMAC_DRBG</tt> and <tt>CTR_DRBG</tt> require a nonce.
+    virtual unsigned int MaxNonceLength() const=0;
+
+    /// \brief Provides the maximum size of a request to GenerateBlock
+    /// \return The maximum size of a request to GenerateBlock(), in bytes
+    /// \details The equivalent class constant is <tt>MAXIMUM_BYTES_PER_REQUEST</tt>
+    virtual unsigned int MaxBytesPerRequest() const=0;
+
+    /// \brief Provides the maximum number of requests before a reseed
+    /// \return The maximum number of requests before a reseed, in bytes
+    /// \details The equivalent class constant is <tt>MAXIMUM_REQUESTS_BEFORE_RESEED</tt>.
+    ///  <tt>MAXIMUM_REQUESTS_BEFORE_RESEED</tt> has been reduced from 2<sup>48</sup> to <tt>INT_MAX</tt>
+    ///  to fit the underlying C++ datatype.
+    virtual unsigned int MaxRequestBeforeReseed() const=0;
+
+protected:
+    virtual void DRBG_Instantiate(const byte* entropy, size_t entropyLength,
+        const byte* nonce, size_t nonceLength, const byte* personalization, size_t personalizationLength)=0;
+
+    virtual void DRBG_Reseed(const byte* entropy, size_t entropyLength, const byte* additional, size_t additionaLength)=0;
+};
+
+// *************************************************************
+
+/// \tparam HASH NIST approved hash derived from HashTransformation
+/// \tparam STRENGTH security strength, in bytes
+/// \tparam SEEDLENGTH seed length, in bytes
+/// \brief Hash_DRBG from SP 800-90A Rev 1 (June 2015)
+/// \details The NIST Hash DRBG is instantiated with a number of parameters. Two of the parameters,
+///  Security Strength and Seed Length, depend on the hash and are specified as template parameters.
+///  The remaining parameters are included in the class. The parameters and their values are listed
+///  in NIST SP 800-90A Rev. 1, Table 2: Definitions for Hash-Based DRBG Mechanisms (p.38).
+/// \details Some parameters have been reduce to fit C++ datatypes. For example, NIST allows upto
+///  2<sup>48</sup> requests before a reseed. However, Hash_DRBG limits it to <tt>INT_MAX</tt> due
+///  to the limited data range of an int.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \sa <A HREF="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf">Recommendation
+///  for Random Number Generation Using Deterministic Random Bit Generators, Rev 1 (June 2015)</A>
+/// \since Crypto++ 6.0
+template <typename HASH=SHA256, unsigned int STRENGTH=128/8, unsigned int SEEDLENGTH=440/8>
+class Hash_DRBG : public NIST_DRBG, public NotCopyable
+{
+public:
+    CRYPTOPP_CONSTANT(SECURITY_STRENGTH=STRENGTH);
+    CRYPTOPP_CONSTANT(SEED_LENGTH=SEEDLENGTH);
+    CRYPTOPP_CONSTANT(MINIMUM_ENTROPY=STRENGTH);
+    CRYPTOPP_CONSTANT(MINIMUM_NONCE=0);
+    CRYPTOPP_CONSTANT(MINIMUM_ADDITIONAL=0);
+    CRYPTOPP_CONSTANT(MINIMUM_PERSONALIZATION=0);
+    CRYPTOPP_CONSTANT(MAXIMUM_ENTROPY=INT_MAX);
+    CRYPTOPP_CONSTANT(MAXIMUM_NONCE=INT_MAX);
+    CRYPTOPP_CONSTANT(MAXIMUM_ADDITIONAL=INT_MAX);
+    CRYPTOPP_CONSTANT(MAXIMUM_PERSONALIZATION=INT_MAX);
+    CRYPTOPP_CONSTANT(MAXIMUM_BYTES_PER_REQUEST=65536);
+    CRYPTOPP_CONSTANT(MAXIMUM_REQUESTS_BEFORE_RESEED=INT_MAX);
+
+    static std::string StaticAlgorithmName() { return std::string("Hash_DRBG(") + HASH::StaticAlgorithmName() + std::string(")"); }
+
+    /// \brief Construct a Hash DRBG
+    /// \param entropy the entropy to instantiate the generator
+    /// \param entropyLength the size of the entropy buffer
+    /// \param nonce additional input to instantiate the generator
+    /// \param nonceLength the size of the nonce buffer
+    /// \param personalization additional input to instantiate the generator
+    /// \param personalizationLength the size of the personalization buffer
+    /// \throw NIST_DRBG::Err if the generator is instantiated with insufficient entropy
+    /// \details All NIST DRBGs must be instaniated with at least <tt>MINIMUM_ENTROPY</tt> bytes of entropy.
+    ///  The byte array for <tt>entropy</tt> must meet <A HREF ="http://csrc.nist.gov/publications/PubsSPs.html">NIST
+    ///  SP 800-90B or SP 800-90C</A> requirements.
+    /// \details The <tt>nonce</tt> and <tt>personalization</tt> are optional byte arrays. If <tt>nonce</tt> is supplied,
+    ///  then it should be at least <tt>MINIMUM_NONCE</tt> bytes of entropy.
+    /// \details An example of instantiating a SHA256 generator is shown below.
+    ///  The example provides more entropy than required for SHA256. The <tt>NonblockingRng</tt> meets the
+    ///  requirements of <A HREF ="http://csrc.nist.gov/publications/PubsSPs.html">NIST SP 800-90B or SP 800-90C</A>.
+    ///  RDRAND() and RDSEED() generators would work as well.
+    /// <pre>
+    ///   SecByteBlock entropy(48), result(128);
+    ///   NonblockingRng prng;
+    ///   RandomNumberSource rns(prng, entropy.size(), new ArraySink(entropy, entropy.size()));
+    ///
+    ///   Hash_DRBG<SHA256, 128/8, 440/8> drbg(entropy, 32, entropy+32, 16);
+    ///   drbg.GenerateBlock(result, result.size());
+    /// </pre>
+    Hash_DRBG(const byte* entropy=NULLPTR, size_t entropyLength=STRENGTH, const byte* nonce=NULLPTR,
+        size_t nonceLength=0, const byte* personalization=NULLPTR, size_t personalizationLength=0)
+        : NIST_DRBG(), m_c(SEEDLENGTH), m_v(SEEDLENGTH), m_reseed(0)
+    {
+        if (m_c.data())  // GCC analyzer warning
+            std::memset(m_c.data(), 0x00, m_c.size());
+        if (m_v.data())  // GCC analyzer warning
+            std::memset(m_v.data(), 0x00, m_v.size());
+
+        if (entropy != NULLPTR && entropyLength != 0)
+            DRBG_Instantiate(entropy, entropyLength, nonce, nonceLength, personalization, personalizationLength);
+    }
+
+    unsigned int SecurityStrength() const {return SECURITY_STRENGTH;}
+    unsigned int SeedLength() const {return SEED_LENGTH;}
+    unsigned int MinEntropyLength() const {return MINIMUM_ENTROPY;}
+    unsigned int MaxEntropyLength() const {return MAXIMUM_ENTROPY;}
+    unsigned int MinNonceLength() const {return MINIMUM_NONCE;}
+    unsigned int MaxNonceLength() const {return MAXIMUM_NONCE;}
+    unsigned int MaxBytesPerRequest() const {return MAXIMUM_BYTES_PER_REQUEST;}
+    unsigned int MaxRequestBeforeReseed() const {return MAXIMUM_REQUESTS_BEFORE_RESEED;}
+
+    void IncorporateEntropy(const byte *input, size_t length)
+        {return DRBG_Reseed(input, length, NULLPTR, 0);}
+
+    void IncorporateEntropy(const byte *entropy, size_t entropyLength, const byte* additional, size_t additionaLength)
+        {return DRBG_Reseed(entropy, entropyLength, additional, additionaLength);}
+
+    void GenerateBlock(byte *output, size_t size)
+        {return Hash_Generate(NULLPTR, 0, output, size);}
+
+    void GenerateBlock(const byte* additional, size_t additionaLength, byte *output, size_t size)
+        {return Hash_Generate(additional, additionaLength, output, size);}
+
+    std::string AlgorithmProvider() const
+        {/*Hack*/HASH hash; return hash.AlgorithmProvider();}
+
+protected:
+    // 10.1.1.2 Instantiation of Hash_DRBG (p.39)
+    void DRBG_Instantiate(const byte* entropy, size_t entropyLength, const byte* nonce, size_t nonceLength,
+        const byte* personalization, size_t personalizationLength);
+
+    // 10.1.1.3 Reseeding a Hash_DRBG Instantiation (p.40)
+    void DRBG_Reseed(const byte* entropy, size_t entropyLength, const byte* additional, size_t additionaLength);
+
+    // 10.1.1.4 Generating Pseudorandom Bits Using Hash_DRBG (p.41)
+    void Hash_Generate(const byte* additional, size_t additionaLength, byte *output, size_t size);
+
+    // 10.3.1 Derivation Function Using a Hash Function (Hash_df) (p.49)
+    void Hash_Update(const byte* input1, size_t inlen1, const byte* input2, size_t inlen2,
+        const byte* input3, size_t inlen3, const byte* input4, size_t inlen4, byte* output, size_t outlen);
+
+private:
+    HASH m_hash;
+    SecByteBlock m_c, m_v, m_temp;
+    word64 m_reseed;
+};
+
+// typedef Hash_DRBG<SHA1,   128/8, 440/8> Hash_SHA1_DRBG;
+// typedef Hash_DRBG<SHA256, 128/8, 440/8> Hash_SHA256_DRBG;
+// typedef Hash_DRBG<SHA384, 256/8, 888/8> Hash_SHA384_DRBG;
+// typedef Hash_DRBG<SHA512, 256/8, 888/8> Hash_SHA512_DRBG;
+
+// *************************************************************
+
+/// \tparam HASH NIST approved hash derived from HashTransformation
+/// \tparam STRENGTH security strength, in bytes
+/// \tparam SEEDLENGTH seed length, in bytes
+/// \brief HMAC_DRBG from SP 800-90A Rev 1 (June 2015)
+/// \details The NIST HMAC DRBG is instantiated with a number of parameters. Two of the parameters,
+///  Security Strength and Seed Length, depend on the hash and are specified as template parameters.
+///  The remaining parameters are included in the class. The parameters and their values are listed
+///  in NIST SP 800-90A Rev. 1, Table 2: Definitions for Hash-Based DRBG Mechanisms (p.38).
+/// \details Some parameters have been reduce to fit C++ datatypes. For example, NIST allows upto 2<sup>48</sup> requests
+///  before a reseed. However, HMAC_DRBG limits it to <tt>INT_MAX</tt> due to the limited data range of an int.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \sa <A HREF="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf">Recommendation
+///  for Random Number Generation Using Deterministic Random Bit Generators, Rev 1 (June 2015)</A>
+/// \since Crypto++ 6.0
+template <typename HASH=SHA256, unsigned int STRENGTH=128/8, unsigned int SEEDLENGTH=440/8>
+class HMAC_DRBG : public NIST_DRBG, public NotCopyable
+{
+public:
+    CRYPTOPP_CONSTANT(SECURITY_STRENGTH=STRENGTH);
+    CRYPTOPP_CONSTANT(SEED_LENGTH=SEEDLENGTH);
+    CRYPTOPP_CONSTANT(MINIMUM_ENTROPY=STRENGTH);
+    CRYPTOPP_CONSTANT(MINIMUM_NONCE=0);
+    CRYPTOPP_CONSTANT(MINIMUM_ADDITIONAL=0);
+    CRYPTOPP_CONSTANT(MINIMUM_PERSONALIZATION=0);
+    CRYPTOPP_CONSTANT(MAXIMUM_ENTROPY=INT_MAX);
+    CRYPTOPP_CONSTANT(MAXIMUM_NONCE=INT_MAX);
+    CRYPTOPP_CONSTANT(MAXIMUM_ADDITIONAL=INT_MAX);
+    CRYPTOPP_CONSTANT(MAXIMUM_PERSONALIZATION=INT_MAX);
+    CRYPTOPP_CONSTANT(MAXIMUM_BYTES_PER_REQUEST=65536);
+    CRYPTOPP_CONSTANT(MAXIMUM_REQUESTS_BEFORE_RESEED=INT_MAX);
+
+    static std::string StaticAlgorithmName() { return std::string("HMAC_DRBG(") + HASH::StaticAlgorithmName() + std::string(")"); }
+
+    /// \brief Construct a HMAC DRBG
+    /// \param entropy the entropy to instantiate the generator
+    /// \param entropyLength the size of the entropy buffer
+    /// \param nonce additional input to instantiate the generator
+    /// \param nonceLength the size of the nonce buffer
+    /// \param personalization additional input to instantiate the generator
+    /// \param personalizationLength the size of the personalization buffer
+    /// \throw NIST_DRBG::Err if the generator is instantiated with insufficient entropy
+    /// \details All NIST DRBGs must be instaniated with at least <tt>MINIMUM_ENTROPY</tt> bytes of entropy.
+    ///  The byte array for <tt>entropy</tt> must meet <A HREF ="http://csrc.nist.gov/publications/PubsSPs.html">NIST
+    ///  SP 800-90B or SP 800-90C</A> requirements.
+    /// \details The <tt>nonce</tt> and <tt>personalization</tt> are optional byte arrays. If <tt>nonce</tt> is supplied,
+    ///  then it should be at least <tt>MINIMUM_NONCE</tt> bytes of entropy.
+    /// \details An example of instantiating a SHA256 generator is shown below.
+    ///  The example provides more entropy than required for SHA256. The <tt>NonblockingRng</tt> meets the
+    ///  requirements of <A HREF ="http://csrc.nist.gov/publications/PubsSPs.html">NIST SP 800-90B or SP 800-90C</A>.
+    ///  RDRAND() and RDSEED() generators would work as well.
+    /// <pre>
+    ///   SecByteBlock entropy(48), result(128);
+    ///   NonblockingRng prng;
+    ///   RandomNumberSource rns(prng, entropy.size(), new ArraySink(entropy, entropy.size()));
+    ///
+    ///   HMAC_DRBG<SHA256, 128/8, 440/8> drbg(entropy, 32, entropy+32, 16);
+    ///   drbg.GenerateBlock(result, result.size());
+    /// </pre>
+    HMAC_DRBG(const byte* entropy=NULLPTR, size_t entropyLength=STRENGTH, const byte* nonce=NULLPTR,
+        size_t nonceLength=0, const byte* personalization=NULLPTR, size_t personalizationLength=0)
+        : NIST_DRBG(), m_k(HASH::DIGESTSIZE), m_v(HASH::DIGESTSIZE), m_reseed(0)
+    {
+        if (m_k.data())  // GCC analyzer warning
+            std::memset(m_k, 0x00, m_k.size());
+        if (m_v.data())  // GCC analyzer warning
+            std::memset(m_v, 0x00, m_v.size());
+
+        if (entropy != NULLPTR && entropyLength != 0)
+            DRBG_Instantiate(entropy, entropyLength, nonce, nonceLength, personalization, personalizationLength);
+    }
+
+    unsigned int SecurityStrength() const {return SECURITY_STRENGTH;}
+    unsigned int SeedLength() const {return SEED_LENGTH;}
+    unsigned int MinEntropyLength() const {return MINIMUM_ENTROPY;}
+    unsigned int MaxEntropyLength() const {return MAXIMUM_ENTROPY;}
+    unsigned int MinNonceLength() const {return MINIMUM_NONCE;}
+    unsigned int MaxNonceLength() const {return MAXIMUM_NONCE;}
+    unsigned int MaxBytesPerRequest() const {return MAXIMUM_BYTES_PER_REQUEST;}
+    unsigned int MaxRequestBeforeReseed() const {return MAXIMUM_REQUESTS_BEFORE_RESEED;}
+
+    void IncorporateEntropy(const byte *input, size_t length)
+        {return DRBG_Reseed(input, length, NULLPTR, 0);}
+
+    void IncorporateEntropy(const byte *entropy, size_t entropyLength, const byte* additional, size_t additionaLength)
+        {return DRBG_Reseed(entropy, entropyLength, additional, additionaLength);}
+
+    void GenerateBlock(byte *output, size_t size)
+        {return HMAC_Generate(NULLPTR, 0, output, size);}
+
+    void GenerateBlock(const byte* additional, size_t additionaLength, byte *output, size_t size)
+        {return HMAC_Generate(additional, additionaLength, output, size);}
+
+    std::string AlgorithmProvider() const
+        {/*Hack*/HASH hash; return hash.AlgorithmProvider();}
+
+protected:
+    // 10.1.2.3 Instantiation of HMAC_DRBG (p.45)
+    void DRBG_Instantiate(const byte* entropy, size_t entropyLength, const byte* nonce, size_t nonceLength,
+        const byte* personalization, size_t personalizationLength);
+
+    // 10.1.2.4 Reseeding a HMAC_DRBG Instantiation (p.46)
+    void DRBG_Reseed(const byte* entropy, size_t entropyLength, const byte* additional, size_t additionaLength);
+
+    // 10.1.2.5 Generating Pseudorandom Bits Using HMAC_DRBG (p.46)
+    void HMAC_Generate(const byte* additional, size_t additionaLength, byte *output, size_t size);
+
+    // 10.1.2.2 Derivation Function Using a HMAC Function (HMAC_Update) (p.44)
+    void HMAC_Update(const byte* input1, size_t inlen1, const byte* input2, size_t inlen2, const byte* input3, size_t inlen3);
+
+private:
+    HMAC<HASH> m_hmac;
+    SecByteBlock m_k, m_v;
+    word64 m_reseed;
+};
+
+// typedef HMAC_DRBG<SHA1,   128/8, 440/8> HMAC_SHA1_DRBG;
+// typedef HMAC_DRBG<SHA256, 128/8, 440/8> HMAC_SHA256_DRBG;
+// typedef HMAC_DRBG<SHA384, 256/8, 888/8> HMAC_SHA384_DRBG;
+// typedef HMAC_DRBG<SHA512, 256/8, 888/8> HMAC_SHA512_DRBG;
+
+// *************************************************************
+
+// 10.1.1.2 Instantiation of Hash_DRBG (p.39)
+template <typename HASH, unsigned int STRENGTH, unsigned int SEEDLENGTH>
+void Hash_DRBG<HASH, STRENGTH, SEEDLENGTH>::DRBG_Instantiate(const byte* entropy, size_t entropyLength, const byte* nonce, size_t nonceLength,
+    const byte* personalization, size_t personalizationLength)
+{
+    //  SP 800-90A, 8.6.3: The entropy input shall have entropy that is equal to or greater than the security
+    //  strength of the instantiation. Additional entropy may be provided in the nonce or the optional
+    //  personalization string during instantiation, or in the additional input during reseeding and generation,
+    //  but this is not required and does not increase the "official" security strength of the DRBG
+    //  instantiation that is recorded in the internal state.
+    CRYPTOPP_ASSERT(entropyLength >= MINIMUM_ENTROPY);
+    if (entropyLength < MINIMUM_ENTROPY)
+        throw NIST_DRBG::Err("Hash_DRBG", "Insufficient entropy during instantiate");
+
+    // SP 800-90A, Section 9, says we should throw if we have too much entropy, too large a nonce,
+    // or too large a persoanlization string. We warn in Debug builds, but do nothing in Release builds.
+    CRYPTOPP_ASSERT(entropyLength <= MAXIMUM_ENTROPY);
+    CRYPTOPP_ASSERT(nonceLength <= MAXIMUM_NONCE);
+    CRYPTOPP_ASSERT(personalizationLength <= MAXIMUM_PERSONALIZATION);
+
+    const byte zero = 0;
+    SecByteBlock t1(SEEDLENGTH), t2(SEEDLENGTH);
+    Hash_Update(entropy, entropyLength, nonce, nonceLength, personalization, personalizationLength, NULLPTR, 0, t1, t1.size());
+    Hash_Update(&zero, 1, t1, t1.size(), NULLPTR, 0, NULLPTR, 0, t2, t2.size());
+
+    m_v.swap(t1); m_c.swap(t2);
+    m_reseed = 1;
+}
+
+// 10.1.1.3 Reseeding a Hash_DRBG Instantiation (p.40)
+template <typename HASH, unsigned int STRENGTH, unsigned int SEEDLENGTH>
+void Hash_DRBG<HASH, STRENGTH, SEEDLENGTH>::DRBG_Reseed(const byte* entropy, size_t entropyLength, const byte* additional, size_t additionaLength)
+{
+    //  SP 800-90A, 8.6.3: The entropy input shall have entropy that is equal to or greater than the security
+    //  strength of the instantiation. Additional entropy may be provided in the nonce or the optional
+    //  personalization string during instantiation, or in the additional input during reseeding and generation,
+    //  but this is not required and does not increase the "official" security strength of the DRBG
+    //  instantiation that is recorded in the internal state..
+    CRYPTOPP_ASSERT(entropyLength >= MINIMUM_ENTROPY);
+    if (entropyLength < MINIMUM_ENTROPY)
+        throw NIST_DRBG::Err("Hash_DRBG", "Insufficient entropy during reseed");
+
+    // SP 800-90A, Section 9, says we should throw if we have too much entropy, too large a nonce,
+    // or too large a persoanlization string. We warn in Debug builds, but do nothing in Release builds.
+    CRYPTOPP_ASSERT(entropyLength <= MAXIMUM_ENTROPY);
+    CRYPTOPP_ASSERT(additionaLength <= MAXIMUM_ADDITIONAL);
+
+    const byte zero = 0, one = 1;
+    SecByteBlock t1(SEEDLENGTH), t2(SEEDLENGTH);
+    Hash_Update(&one, 1, m_v, m_v.size(), entropy, entropyLength, additional, additionaLength, t1, t1.size());
+    Hash_Update(&zero, 1, t1, t1.size(), NULLPTR, 0, NULLPTR, 0, t2, t2.size());
+
+    m_v.swap(t1); m_c.swap(t2);
+    m_reseed = 1;
+}
+
+// 10.1.1.4 Generating Pseudorandom Bits Using Hash_DRBG (p.41)
+template <typename HASH, unsigned int STRENGTH, unsigned int SEEDLENGTH>
+void Hash_DRBG<HASH, STRENGTH, SEEDLENGTH>::Hash_Generate(const byte* additional, size_t additionaLength, byte *output, size_t size)
+{
+    // Step 1
+    if (static_cast<word64>(m_reseed) >= static_cast<word64>(MaxRequestBeforeReseed()))
+        throw NIST_DRBG::Err("Hash_DRBG", "Reseed required");
+
+    if (size > MaxBytesPerRequest())
+        throw NIST_DRBG::Err("Hash_DRBG", "Request size exceeds limit");
+
+    // SP 800-90A, Section 9, says we should throw if we have too much entropy, too large a nonce,
+    // or too large a persoanlization string. We warn in Debug builds, but do nothing in Release builds.
+    CRYPTOPP_ASSERT(additionaLength <= MAXIMUM_ADDITIONAL);
+
+    // Step 2
+    if (additional && additionaLength)
+    {
+        const byte two = 2;
+        m_temp.New(HASH::DIGESTSIZE);
+
+        m_hash.Update(&two, 1);
+        m_hash.Update(m_v, m_v.size());
+        m_hash.Update(additional, additionaLength);
+        m_hash.Final(m_temp);
+
+        CRYPTOPP_ASSERT(SEEDLENGTH >= HASH::DIGESTSIZE);
+        int carry=0, j=HASH::DIGESTSIZE-1, i=SEEDLENGTH-1;
+        while (j>=0)
+        {
+            carry = m_v[i] + m_temp[j] + carry;
+            m_v[i] = static_cast<byte>(carry);
+            i--; j--; carry >>= 8;
+        }
+        while (i>=0)
+        {
+            carry = m_v[i] + carry;
+            m_v[i] = static_cast<byte>(carry);
+            i--; carry >>= 8;
+        }
+    }
+
+    // Step 3
+    {
+        m_temp.Assign(m_v);
+        while (size)
+        {
+            m_hash.Update(m_temp, m_temp.size());
+            size_t count = STDMIN(size, (size_t)HASH::DIGESTSIZE);
+            m_hash.TruncatedFinal(output, count);
+
+            IncrementCounterByOne(m_temp, static_cast<unsigned int>(m_temp.size()));
+            size -= count; output += count;
+        }
+    }
+
+    // Steps 4-7
+    {
+        const byte three = 3;
+        m_temp.New(HASH::DIGESTSIZE);
+
+        m_hash.Update(&three, 1);
+        m_hash.Update(m_v, m_v.size());
+        m_hash.Final(m_temp);
+
+        CRYPTOPP_ASSERT(SEEDLENGTH >= HASH::DIGESTSIZE);
+        CRYPTOPP_ASSERT(HASH::DIGESTSIZE >= sizeof(m_reseed));
+        int carry=0, k=sizeof(m_reseed)-1, j=HASH::DIGESTSIZE-1, i=SEEDLENGTH-1;
+
+        while (k>=0)
+        {
+            carry = m_v[i] + m_c[i] + m_temp[j] + GetByte<word64>(BIG_ENDIAN_ORDER, m_reseed, k) + carry;
+            m_v[i] = static_cast<byte>(carry);
+            i--; j--; k--; carry >>= 8;
+        }
+
+        while (j>=0)
+        {
+            carry = m_v[i] + m_c[i] + m_temp[j] + carry;
+            m_v[i] = static_cast<byte>(carry);
+            i--; j--; carry >>= 8;
+        }
+
+        while (i>=0)
+        {
+            carry = m_v[i] + m_c[i] + carry;
+            m_v[i] = static_cast<byte>(carry);
+            i--; carry >>= 8;
+        }
+    }
+
+    m_reseed++;
+}
+
+// 10.3.1 Derivation Function Using a Hash Function (Hash_df) (p.49)
+template <typename HASH, unsigned int STRENGTH, unsigned int SEEDLENGTH>
+void Hash_DRBG<HASH, STRENGTH, SEEDLENGTH>::Hash_Update(const byte* input1, size_t inlen1, const byte* input2, size_t inlen2,
+    const byte* input3, size_t inlen3, const byte* input4, size_t inlen4, byte* output, size_t outlen)
+{
+    byte counter = 1;
+    word32 bits = ConditionalByteReverse(BIG_ENDIAN_ORDER, static_cast<word32>(outlen*8));
+
+    while (outlen)
+    {
+        m_hash.Update(&counter, 1);
+        m_hash.Update(reinterpret_cast<const byte*>(&bits), 4);
+
+        if (input1 && inlen1)
+            m_hash.Update(input1, inlen1);
+        if (input2 && inlen2)
+            m_hash.Update(input2, inlen2);
+        if (input3 && inlen3)
+            m_hash.Update(input3, inlen3);
+        if (input4 && inlen4)
+            m_hash.Update(input4, inlen4);
+
+        size_t count = STDMIN(outlen, (size_t)HASH::DIGESTSIZE);
+        m_hash.TruncatedFinal(output, count);
+
+        output += count; outlen -= count;
+        counter++;
+    }
+}
+
+// *************************************************************
+
+// 10.1.2.3 Instantiation of HMAC_DRBG (p.45)
+template <typename HASH, unsigned int STRENGTH, unsigned int SEEDLENGTH>
+void HMAC_DRBG<HASH, STRENGTH, SEEDLENGTH>::DRBG_Instantiate(const byte* entropy, size_t entropyLength, const byte* nonce, size_t nonceLength,
+    const byte* personalization, size_t personalizationLength)
+{
+    //  SP 800-90A, 8.6.3: The entropy input shall have entropy that is equal to or greater than the security
+    //  strength of the instantiation. Additional entropy may be provided in the nonce or the optional
+    //  personalization string during instantiation, or in the additional input during reseeding and generation,
+    //  but this is not required and does not increase the "official" security strength of the DRBG
+    //  instantiation that is recorded in the internal state.
+    CRYPTOPP_ASSERT(entropyLength >= MINIMUM_ENTROPY);
+    if (entropyLength < MINIMUM_ENTROPY)
+        throw NIST_DRBG::Err("HMAC_DRBG", "Insufficient entropy during instantiate");
+
+    // SP 800-90A, Section 9, says we should throw if we have too much entropy, too large a nonce,
+    // or too large a persoanlization string. We warn in Debug builds, but do nothing in Release builds.
+    CRYPTOPP_ASSERT(entropyLength <= MAXIMUM_ENTROPY);
+    CRYPTOPP_ASSERT(nonceLength <= MAXIMUM_NONCE);
+    CRYPTOPP_ASSERT(personalizationLength <= MAXIMUM_PERSONALIZATION);
+
+    std::fill(m_k.begin(), m_k.begin()+m_k.size(), byte(0));
+    std::fill(m_v.begin(), m_v.begin()+m_v.size(), byte(1));
+
+    HMAC_Update(entropy, entropyLength, nonce, nonceLength, personalization, personalizationLength);
+    m_reseed = 1;
+}
+
+// 10.1.2.4 Reseeding a HMAC_DRBG Instantiation (p.46)
+template <typename HASH, unsigned int STRENGTH, unsigned int SEEDLENGTH>
+void HMAC_DRBG<HASH, STRENGTH, SEEDLENGTH>::DRBG_Reseed(const byte* entropy, size_t entropyLength, const byte* additional, size_t additionaLength)
+{
+    //  SP 800-90A, 8.6.3: The entropy input shall have entropy that is equal to or greater than the security
+    //  strength of the instantiation. Additional entropy may be provided in the nonce or the optional
+    //  personalization string during instantiation, or in the additional input during reseeding and generation,
+    //  but this is not required and does not increase the "official" security strength of the DRBG
+    //  instantiation that is recorded in the internal state..
+    CRYPTOPP_ASSERT(entropyLength >= MINIMUM_ENTROPY);
+    if (entropyLength < MINIMUM_ENTROPY)
+        throw NIST_DRBG::Err("HMAC_DRBG", "Insufficient entropy during reseed");
+
+    // SP 800-90A, Section 9, says we should throw if we have too much entropy, too large a nonce,
+    // or too large a persoanlization string. We warn in Debug builds, but do nothing in Release builds.
+    CRYPTOPP_ASSERT(entropyLength <= MAXIMUM_ENTROPY);
+    CRYPTOPP_ASSERT(additionaLength <= MAXIMUM_ADDITIONAL);
+
+    HMAC_Update(entropy, entropyLength, additional, additionaLength, NULLPTR, 0);
+    m_reseed = 1;
+}
+
+// 10.1.2.5 Generating Pseudorandom Bits Using HMAC_DRBG (p.46)
+template <typename HASH, unsigned int STRENGTH, unsigned int SEEDLENGTH>
+void HMAC_DRBG<HASH, STRENGTH, SEEDLENGTH>::HMAC_Generate(const byte* additional, size_t additionaLength, byte *output, size_t size)
+{
+    // Step 1
+    if (static_cast<word64>(m_reseed) >= static_cast<word64>(MaxRequestBeforeReseed()))
+        throw NIST_DRBG::Err("HMAC_DRBG", "Reseed required");
+
+    if (size > MaxBytesPerRequest())
+        throw NIST_DRBG::Err("HMAC_DRBG", "Request size exceeds limit");
+
+    // SP 800-90A, Section 9, says we should throw if we have too much entropy, too large a nonce,
+    // or too large a persoanlization string. We warn in Debug builds, but do nothing in Release builds.
+    CRYPTOPP_ASSERT(additionaLength <= MAXIMUM_ADDITIONAL);
+
+    // Step 2
+    if (additional && additionaLength)
+        HMAC_Update(additional, additionaLength, NULLPTR, 0, NULLPTR, 0);
+
+    // Step 3
+    m_hmac.SetKey(m_k, m_k.size());
+
+    while (size)
+    {
+        m_hmac.Update(m_v, m_v.size());
+        m_hmac.TruncatedFinal(m_v, m_v.size());
+
+        size_t count = STDMIN(size, (size_t)HASH::DIGESTSIZE);
+        std::memcpy(output, m_v, count);
+        size -= count; output += count;
+    }
+
+    HMAC_Update(additional, additionaLength, NULLPTR, 0, NULLPTR, 0);
+    m_reseed++;
+}
+
+// 10.1.2.2 Derivation Function Using a HMAC Function (HMAC_Update) (p.44)
+template <typename HASH, unsigned int STRENGTH, unsigned int SEEDLENGTH>
+void HMAC_DRBG<HASH, STRENGTH, SEEDLENGTH>::HMAC_Update(const byte* input1, size_t inlen1, const byte* input2, size_t inlen2, const byte* input3, size_t inlen3)
+{
+    const byte zero = 0, one = 1;
+
+    // Step 1
+    m_hmac.SetKey(m_k, m_k.size());
+    m_hmac.Update(m_v, m_v.size());
+    m_hmac.Update(&zero, 1);
+
+    if (input1 && inlen1)
+        m_hmac.Update(input1, inlen1);
+    if (input2 && inlen2)
+        m_hmac.Update(input2, inlen2);
+    if (input3 && inlen3)
+        m_hmac.Update(input3, inlen3);
+
+    m_hmac.TruncatedFinal(m_k, m_k.size());
+
+    // Step 2
+    m_hmac.SetKey(m_k, m_k.size());
+    m_hmac.Update(m_v, m_v.size());
+
+    m_hmac.TruncatedFinal(m_v, m_v.size());
+
+    // Step 3
+    if ((inlen1 | inlen2 | inlen3) == 0)
+        return;
+
+    // Step 4
+    m_hmac.SetKey(m_k, m_k.size());
+    m_hmac.Update(m_v, m_v.size());
+    m_hmac.Update(&one, 1);
+
+    if (input1 && inlen1)
+        m_hmac.Update(input1, inlen1);
+    if (input2 && inlen2)
+        m_hmac.Update(input2, inlen2);
+    if (input3 && inlen3)
+        m_hmac.Update(input3, inlen3);
+
+    m_hmac.TruncatedFinal(m_k, m_k.size());
+
+    // Step 5
+    m_hmac.SetKey(m_k, m_k.size());
+    m_hmac.Update(m_v, m_v.size());
+
+    m_hmac.TruncatedFinal(m_v, m_v.size());
+}
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_NIST_DRBG_H
diff --git a/runtime/third_party/cryptopp/dsa.cpp b/runtime/third_party/cryptopp/dsa.cpp
new file mode 100644
index 0000000..1d2fc51
--- /dev/null
+++ b/runtime/third_party/cryptopp/dsa.cpp
@@ -0,0 +1,66 @@
+// dsa.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "dsa.h"
+#include "asn.h"
+#include "integer.h"
+#include "filters.h"
+#include "nbtheory.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+size_t DSAConvertSignatureFormat(byte *buffer, size_t bufferSize, DSASignatureFormat toFormat, const byte *signature, size_t signatureLen, DSASignatureFormat fromFormat)
+{
+	Integer r, s;
+	StringStore store(signature, signatureLen);
+	ArraySink sink(buffer, bufferSize);
+
+	switch (fromFormat)
+	{
+	case DSA_P1363:
+		r.Decode(store, signatureLen/2);
+		s.Decode(store, signatureLen/2);
+		break;
+	case DSA_DER:
+	{
+		BERSequenceDecoder seq(store);
+		r.BERDecode(seq);
+		s.BERDecode(seq);
+		seq.MessageEnd();
+		break;
+	}
+	case DSA_OPENPGP:
+		r.OpenPGPDecode(store);
+		s.OpenPGPDecode(store);
+		break;
+	}
+
+	switch (toFormat)
+	{
+	case DSA_P1363:
+		r.Encode(sink, bufferSize/2);
+		s.Encode(sink, bufferSize/2);
+		break;
+	case DSA_DER:
+	{
+		DERSequenceEncoder seq(sink);
+		r.DEREncode(seq);
+		s.DEREncode(seq);
+		seq.MessageEnd();
+		break;
+	}
+	case DSA_OPENPGP:
+		r.OpenPGPEncode(sink);
+		s.OpenPGPEncode(sink);
+		break;
+	}
+
+	return (size_t)sink.TotalPutLength();
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/dsa.h b/runtime/third_party/cryptopp/dsa.h
new file mode 100644
index 0000000..f49ed92
--- /dev/null
+++ b/runtime/third_party/cryptopp/dsa.h
@@ -0,0 +1,53 @@
+// dsa.h - originally written and placed in the public domain by Wei Dai
+
+/// \file dsa.h
+/// \brief Classes for the DSA signature algorithm
+
+#ifndef CRYPTOPP_DSA_H
+#define CRYPTOPP_DSA_H
+
+#include "cryptlib.h"
+#include "gfpcrypt.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief DSA Signature Format
+/// \details The DSA signature format used by Crypto++ is as defined by IEEE P1363.
+///  OpenSSL, Java and .Net use the DER format, and OpenPGP uses the OpenPGP format.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/DSAConvertSignatureFormat">DSAConvertSignatureFormat</A>
+///  on the Crypto++ wiki.
+/// \since Crypto++ 1.0
+enum DSASignatureFormat {
+	/// \brief Crypto++ native signature encoding format
+	DSA_P1363,
+	/// \brief signature encoding format used by OpenSSL, Java and .Net
+	DSA_DER,
+	/// \brief OpenPGP signature encoding format
+	DSA_OPENPGP
+};
+
+/// \brief Converts between signature encoding formats
+/// \param buffer byte buffer for the converted signature encoding
+/// \param bufferSize the length of the converted signature encoding buffer
+/// \param toFormat the source signature format
+/// \param signature byte buffer for the existing signature encoding
+/// \param signatureLen the length of the existing signature encoding buffer
+/// \param fromFormat the source signature format
+/// \return the number of bytes written during encoding
+/// \details This function converts between these formats, and returns length
+///  of signature in the target format. If <tt>toFormat == DSA_P1363</tt>, then
+///  <tt>bufferSize</tt> must equal <tt>publicKey.SignatureLength()</tt> or
+///  <tt>verifier.SignatureLength()</tt>.
+/// \details If the destination buffer is too small then the output of the
+///  encoded <tt>r</tt> and <tt>s</tt> will be truncated. Be sure to provide
+///  an adequately sized buffer and check the return value for the number of
+///  bytes written.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/DSAConvertSignatureFormat">DSAConvertSignatureFormat</A>
+///  on the Crypto++ wiki.
+/// \since Crypto++ 1.0
+size_t DSAConvertSignatureFormat(byte *buffer, size_t bufferSize, DSASignatureFormat toFormat,
+	const byte *signature, size_t signatureLen, DSASignatureFormat fromFormat);
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_DSA_H
diff --git a/runtime/third_party/cryptopp/eax.cpp b/runtime/third_party/cryptopp/eax.cpp
new file mode 100644
index 0000000..52cfaf3
--- /dev/null
+++ b/runtime/third_party/cryptopp/eax.cpp
@@ -0,0 +1,59 @@
+// eax.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "eax.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void EAX_Base::SetKeyWithoutResync(const byte *userKey, size_t keylength, const NameValuePairs &params)
+{
+	AccessMAC().SetKey(userKey, keylength, params);
+	m_buffer.New(2*AccessMAC().TagSize());
+}
+
+void EAX_Base::Resync(const byte *iv, size_t len)
+{
+	MessageAuthenticationCode &mac = AccessMAC();
+	unsigned int blockSize = mac.TagSize();
+
+	std::memset(m_buffer, 0, blockSize);
+	mac.Update(m_buffer, blockSize);
+	mac.CalculateDigest(m_buffer+blockSize, iv, len);
+
+	m_buffer[blockSize-1] = 1;
+	mac.Update(m_buffer, blockSize);
+
+	m_ctr.SetCipherWithIV(AccessMAC().AccessCipher(), m_buffer+blockSize, blockSize);
+}
+
+size_t EAX_Base::AuthenticateBlocks(const byte *data, size_t len)
+{
+	AccessMAC().Update(data, len);
+	return 0;
+}
+
+void EAX_Base::AuthenticateLastHeaderBlock()
+{
+	CRYPTOPP_ASSERT(m_bufferedDataLength == 0);
+	MessageAuthenticationCode &mac = AccessMAC();
+	const unsigned int blockSize = mac.TagSize();
+
+	mac.Final(m_buffer);
+	xorbuf(m_buffer+blockSize, m_buffer, blockSize);
+
+	std::memset(m_buffer, 0, blockSize);
+	m_buffer[blockSize-1] = 2;
+	mac.Update(m_buffer, blockSize);
+}
+
+void EAX_Base::AuthenticateLastFooterBlock(byte *tag, size_t macSize)
+{
+	CRYPTOPP_ASSERT(m_bufferedDataLength == 0);
+	MessageAuthenticationCode &mac = AccessMAC();
+	unsigned int blockSize = mac.TagSize();
+
+	mac.TruncatedFinal(m_buffer, macSize);
+	xorbuf(tag, m_buffer, m_buffer+blockSize, macSize);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/eax.h b/runtime/third_party/cryptopp/eax.h
new file mode 100644
index 0000000..6dc1fa6
--- /dev/null
+++ b/runtime/third_party/cryptopp/eax.h
@@ -0,0 +1,112 @@
+// eax.h - originally written and placed in the public domain by Wei Dai
+
+/// \file eax.h
+/// \brief EAX block cipher mode of operation
+
+#ifndef CRYPTOPP_EAX_H
+#define CRYPTOPP_EAX_H
+
+#include "authenc.h"
+#include "modes.h"
+#include "cmac.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief EAX block cipher base implementation
+/// \details Base implementation of the AuthenticatedSymmetricCipher interface
+/// \since Crypto++ 5.6.0
+class CRYPTOPP_NO_VTABLE EAX_Base : public AuthenticatedSymmetricCipherBase
+{
+public:
+	// AuthenticatedSymmetricCipher
+	std::string AlgorithmName() const
+		{return GetMAC().GetCipher().AlgorithmName() + std::string("/EAX");}
+	std::string AlgorithmProvider() const
+		{return GetMAC().GetCipher().AlgorithmProvider();}
+	size_t MinKeyLength() const
+		{return GetMAC().MinKeyLength();}
+	size_t MaxKeyLength() const
+		{return GetMAC().MaxKeyLength();}
+	size_t DefaultKeyLength() const
+		{return GetMAC().DefaultKeyLength();}
+	size_t GetValidKeyLength(size_t n) const
+		{return GetMAC().GetValidKeyLength(n);}
+	bool IsValidKeyLength(size_t n) const
+		{return GetMAC().IsValidKeyLength(n);}
+	unsigned int OptimalDataAlignment() const
+		{return GetMAC().OptimalDataAlignment();}
+	IV_Requirement IVRequirement() const
+		{return UNIQUE_IV;}
+	unsigned int IVSize() const
+		{return GetMAC().TagSize();}
+	unsigned int MinIVLength() const
+		{return 0;}
+	unsigned int MaxIVLength() const
+		{return UINT_MAX;}
+	unsigned int DigestSize() const
+		{return GetMAC().TagSize();}
+	lword MaxHeaderLength() const
+		{return LWORD_MAX;}
+	lword MaxMessageLength() const
+		{return LWORD_MAX;}
+
+protected:
+	// AuthenticatedSymmetricCipherBase
+	bool AuthenticationIsOnPlaintext() const
+		{return false;}
+	unsigned int AuthenticationBlockSize() const
+		{return 1;}
+	void SetKeyWithoutResync(const byte *userKey, size_t keylength, const NameValuePairs &params);
+	void Resync(const byte *iv, size_t len);
+	size_t AuthenticateBlocks(const byte *data, size_t len);
+	void AuthenticateLastHeaderBlock();
+	void AuthenticateLastFooterBlock(byte *mac, size_t macSize);
+	SymmetricCipher & AccessSymmetricCipher() {return m_ctr;}
+	const CMAC_Base & GetMAC() const {return const_cast<EAX_Base *>(this)->AccessMAC();}
+	virtual CMAC_Base & AccessMAC() =0;
+
+	CTR_Mode_ExternalCipher::Encryption m_ctr;
+};
+
+/// \brief EAX block cipher final implementation
+/// \tparam T_BlockCipher block cipher
+/// \tparam T_IsEncryption direction in which to operate the cipher
+/// \since Crypto++ 5.6.0
+template <class T_BlockCipher, bool T_IsEncryption>
+class EAX_Final : public EAX_Base
+{
+public:
+	static std::string StaticAlgorithmName()
+		{return T_BlockCipher::StaticAlgorithmName() + std::string("/EAX");}
+	std::string AlgorithmProvider() const
+		{return m_cmac.AlgorithmProvider();}
+	bool IsForwardTransformation() const
+		{return T_IsEncryption;}
+
+private:
+	CMAC_Base & AccessMAC() {return m_cmac;}
+	CMAC<T_BlockCipher> m_cmac;
+};
+
+#ifdef EAX	// EAX is defined to 11 on GCC 3.4.3, OpenSolaris 8.11
+#undef EAX
+#endif
+
+/// \brief EAX block cipher mode of operation
+/// \tparam T_BlockCipher block cipher
+/// \details \p EAX provides the \p Encryption and \p Decryption typedef. See EAX_Base
+///   and EAX_Final for the AuthenticatedSymmetricCipher implementation.
+/// \sa <a href="http://www.cryptopp.com/wiki/EAX_Mode">EAX Mode</a> and
+///   <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+/// \since Crypto++ 5.6.0
+template <class T_BlockCipher>
+struct EAX : public AuthenticatedSymmetricCipherDocumentation
+{
+	typedef EAX_Final<T_BlockCipher, true> Encryption;
+	typedef EAX_Final<T_BlockCipher, false> Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/ec2n.cpp b/runtime/third_party/cryptopp/ec2n.cpp
new file mode 100644
index 0000000..5eee6ac
--- /dev/null
+++ b/runtime/third_party/cryptopp/ec2n.cpp
@@ -0,0 +1,320 @@
+// ec2n.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "ec2n.h"
+#include "asn.h"
+#include "integer.h"
+#include "filters.h"
+#include "algebra.cpp"
+#include "eprecomp.cpp"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::EC2N;
+
+#if defined(HAVE_GCC_INIT_PRIORITY)
+	#define INIT_ATTRIBUTE __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 51)))
+	const EC2N::Point g_identity INIT_ATTRIBUTE = EC2N::Point();
+#elif defined(HAVE_MSC_INIT_PRIORITY)
+	#pragma warning(disable: 4075)
+	#pragma init_seg(".CRT$XCU")
+	const EC2N::Point g_identity;
+	#pragma warning(default: 4075)
+#elif defined(HAVE_XLC_INIT_PRIORITY)
+	#pragma priority(290)
+	const EC2N::Point g_identity;
+#endif
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+EC2N::EC2N(BufferedTransformation &bt)
+	: m_field(BERDecodeGF2NP(bt))
+{
+	BERSequenceDecoder seq(bt);
+	m_field->BERDecodeElement(seq, m_a);
+	m_field->BERDecodeElement(seq, m_b);
+	// skip optional seed
+	if (!seq.EndReached())
+	{
+		SecByteBlock seed;
+		unsigned int unused;
+		BERDecodeBitString(seq, seed, unused);
+	}
+	seq.MessageEnd();
+}
+
+void EC2N::DEREncode(BufferedTransformation &bt) const
+{
+	m_field->DEREncode(bt);
+	DERSequenceEncoder seq(bt);
+	   m_field->DEREncodeElement(seq, m_a);
+	   m_field->DEREncodeElement(seq, m_b);
+	seq.MessageEnd();
+}
+
+bool EC2N::DecodePoint(EC2N::Point &P, const byte *encodedPoint, size_t encodedPointLen) const
+{
+	StringStore store(encodedPoint, encodedPointLen);
+	return DecodePoint(P, store, encodedPointLen);
+}
+
+bool EC2N::DecodePoint(EC2N::Point &P, BufferedTransformation &bt, size_t encodedPointLen) const
+{
+	byte type;
+	if (encodedPointLen < 1 || !bt.Get(type))
+		return false;
+
+	switch (type)
+	{
+	case 0:
+		P.identity = true;
+		return true;
+	case 2:
+	case 3:
+	{
+		if (encodedPointLen != EncodedPointSize(true))
+			return false;
+
+		P.identity = false;
+		P.x.Decode(bt, m_field->MaxElementByteLength());
+
+		if (P.x.IsZero())
+		{
+			P.y = m_field->SquareRoot(m_b);
+			return true;
+		}
+
+		FieldElement z = m_field->Square(P.x);
+		CRYPTOPP_ASSERT(P.x == m_field->SquareRoot(z));
+		P.y = m_field->Divide(m_field->Add(m_field->Multiply(z, m_field->Add(P.x, m_a)), m_b), z);
+		CRYPTOPP_ASSERT(P.x == m_field->Subtract(m_field->Divide(m_field->Subtract(m_field->Multiply(P.y, z), m_b), z), m_a));
+		z = m_field->SolveQuadraticEquation(P.y);
+		CRYPTOPP_ASSERT(m_field->Add(m_field->Square(z), z) == P.y);
+		z.SetCoefficient(0, type & 1);
+
+		P.y = m_field->Multiply(z, P.x);
+		return true;
+	}
+	case 4:
+	{
+		if (encodedPointLen != EncodedPointSize(false))
+			return false;
+
+		unsigned int len = m_field->MaxElementByteLength();
+		P.identity = false;
+		P.x.Decode(bt, len);
+		P.y.Decode(bt, len);
+		return true;
+	}
+	default:
+		return false;
+	}
+}
+
+void EC2N::EncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const
+{
+	if (P.identity)
+		NullStore().TransferTo(bt, EncodedPointSize(compressed));
+	else if (compressed)
+	{
+		bt.Put((byte)(2U + (!P.x ? 0U : m_field->Divide(P.y, P.x).GetBit(0))));
+		P.x.Encode(bt, m_field->MaxElementByteLength());
+	}
+	else
+	{
+		unsigned int len = m_field->MaxElementByteLength();
+		bt.Put(4);	// uncompressed
+		P.x.Encode(bt, len);
+		P.y.Encode(bt, len);
+	}
+}
+
+void EC2N::EncodePoint(byte *encodedPoint, const Point &P, bool compressed) const
+{
+	ArraySink sink(encodedPoint, EncodedPointSize(compressed));
+	EncodePoint(sink, P, compressed);
+	CRYPTOPP_ASSERT(sink.TotalPutLength() == EncodedPointSize(compressed));
+}
+
+EC2N::Point EC2N::BERDecodePoint(BufferedTransformation &bt) const
+{
+	SecByteBlock str;
+	BERDecodeOctetString(bt, str);
+	Point P;
+	if (!DecodePoint(P, str, str.size()))
+		BERDecodeError();
+	return P;
+}
+
+void EC2N::DEREncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const
+{
+	SecByteBlock str(EncodedPointSize(compressed));
+	EncodePoint(str, P, compressed);
+	DEREncodeOctetString(bt, str);
+}
+
+bool EC2N::ValidateParameters(RandomNumberGenerator &rng, unsigned int level) const
+{
+	CRYPTOPP_UNUSED(rng);
+	bool pass = !!m_b;
+	pass = pass && m_a.CoefficientCount() <= m_field->MaxElementBitLength();
+	pass = pass && m_b.CoefficientCount() <= m_field->MaxElementBitLength();
+
+	if (level >= 1)
+		pass = pass && m_field->GetModulus().IsIrreducible();
+
+	return pass;
+}
+
+bool EC2N::VerifyPoint(const Point &P) const
+{
+	const FieldElement &x = P.x, &y = P.y;
+	return P.identity ||
+		(x.CoefficientCount() <= m_field->MaxElementBitLength()
+		&& y.CoefficientCount() <= m_field->MaxElementBitLength()
+		&& !(((x+m_a)*x*x+m_b-(x+y)*y)%m_field->GetModulus()));
+}
+
+bool EC2N::Equal(const Point &P, const Point &Q) const
+{
+	if (P.identity && Q.identity)
+		return true;
+
+	if (P.identity && !Q.identity)
+		return false;
+
+	if (!P.identity && Q.identity)
+		return false;
+
+	return (m_field->Equal(P.x,Q.x) && m_field->Equal(P.y,Q.y));
+}
+
+const EC2N::Point& EC2N::Identity() const
+{
+#if defined(HAVE_GCC_INIT_PRIORITY) || defined(HAVE_MSC_INIT_PRIORITY) || defined(HAVE_XLC_INIT_PRIORITY)
+	return g_identity;
+#elif defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static const EC2N::Point g_identity;
+	return g_identity;
+#else
+	return Singleton<Point>().Ref();
+#endif
+}
+
+const EC2N::Point& EC2N::Inverse(const Point &P) const
+{
+	if (P.identity)
+		return P;
+	else
+	{
+		m_R.identity = false;
+		m_R.y = m_field->Add(P.x, P.y);
+		m_R.x = P.x;
+		return m_R;
+	}
+}
+
+const EC2N::Point& EC2N::Add(const Point &P, const Point &Q) const
+{
+	if (P.identity) return Q;
+	if (Q.identity) return P;
+	if (Equal(P, Q)) return Double(P);
+	if (m_field->Equal(P.x, Q.x) && m_field->Equal(P.y, m_field->Add(Q.x, Q.y))) return Identity();
+
+	FieldElement t = m_field->Add(P.y, Q.y);
+	t = m_field->Divide(t, m_field->Add(P.x, Q.x));
+	FieldElement x = m_field->Square(t);
+	m_field->Accumulate(x, t);
+	m_field->Accumulate(x, Q.x);
+	m_field->Accumulate(x, m_a);
+	m_R.y = m_field->Add(P.y, m_field->Multiply(t, x));
+	m_field->Accumulate(x, P.x);
+	m_field->Accumulate(m_R.y, x);
+
+	m_R.x.swap(x);
+	m_R.identity = false;
+	return m_R;
+}
+
+const EC2N::Point& EC2N::Double(const Point &P) const
+{
+	if (P.identity) return P;
+	if (!m_field->IsUnit(P.x)) return Identity();
+
+	FieldElement t = m_field->Divide(P.y, P.x);
+	m_field->Accumulate(t, P.x);
+	m_R.y = m_field->Square(P.x);
+	m_R.x = m_field->Square(t);
+	m_field->Accumulate(m_R.x, t);
+	m_field->Accumulate(m_R.x, m_a);
+	m_field->Accumulate(m_R.y, m_field->Multiply(t, m_R.x));
+	m_field->Accumulate(m_R.y, m_R.x);
+
+	m_R.identity = false;
+	return m_R;
+}
+
+// ********************************************************
+
+#if 0
+EcPrecomputation<EC2N>& EcPrecomputation<EC2N>::operator=(const EcPrecomputation<EC2N> &rhs)
+{
+	m_ec = rhs.m_ec;
+	m_ep = rhs.m_ep;
+	m_ep.m_group = m_ec.get();
+	return *this;
+}
+
+void EcPrecomputation<EC2N>::SetCurveAndBase(const EC2N &ec, const EC2N::Point &base)
+{
+	m_ec.reset(new EC2N(ec));
+	m_ep.SetGroupAndBase(*m_ec, base);
+}
+
+void EcPrecomputation<EC2N>::Precompute(unsigned int maxExpBits, unsigned int storage)
+{
+	m_ep.Precompute(maxExpBits, storage);
+}
+
+void EcPrecomputation<EC2N>::Load(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	word32 version;
+	BERDecodeUnsigned<word32>(seq, version, INTEGER, 1, 1);
+	m_ep.m_exponentBase.BERDecode(seq);
+	m_ep.m_windowSize = m_ep.m_exponentBase.BitCount() - 1;
+	m_ep.m_bases.clear();
+	while (!seq.EndReached())
+		m_ep.m_bases.push_back(m_ec->BERDecodePoint(seq));
+	seq.MessageEnd();
+}
+
+void EcPrecomputation<EC2N>::Save(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+	DEREncodeUnsigned<word32>(seq, 1);	// version
+	m_ep.m_exponentBase.DEREncode(seq);
+	for (unsigned i=0; i<m_ep.m_bases.size(); i++)
+		m_ec->DEREncodePoint(seq, m_ep.m_bases[i]);
+	seq.MessageEnd();
+}
+
+EC2N::Point EcPrecomputation<EC2N>::Exponentiate(const Integer &exponent) const
+{
+	return m_ep.Exponentiate(exponent);
+}
+
+EC2N::Point EcPrecomputation<EC2N>::CascadeExponentiate(const Integer &exponent, const DL_FixedBasePrecomputation<Element> &pc2, const Integer &exponent2) const
+{
+	return m_ep.CascadeExponentiate(exponent, static_cast<const EcPrecomputation<EC2N> &>(pc2).m_ep, exponent2);
+}
+#endif
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/ec2n.h b/runtime/third_party/cryptopp/ec2n.h
new file mode 100644
index 0000000..529da04
--- /dev/null
+++ b/runtime/third_party/cryptopp/ec2n.h
@@ -0,0 +1,136 @@
+// ec2n.h - originally written and placed in the public domain by Wei Dai
+
+/// \file ec2n.h
+/// \brief Classes for Elliptic Curves over binary fields
+
+#ifndef CRYPTOPP_EC2N_H
+#define CRYPTOPP_EC2N_H
+
+#include "cryptlib.h"
+#include "gf2n.h"
+#include "integer.h"
+#include "algebra.h"
+#include "ecpoint.h"
+#include "eprecomp.h"
+#include "smartptr.h"
+#include "pubkey.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4231 4275)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Elliptic Curve over GF(2^n)
+class CRYPTOPP_DLL EC2N : public AbstractGroup<EC2NPoint>, public EncodedPoint<EC2NPoint>
+{
+public:
+	typedef GF2NP Field;
+	typedef Field::Element FieldElement;
+	typedef EC2NPoint Point;
+
+	virtual ~EC2N() {}
+
+	/// \brief Construct an EC2N
+	EC2N() {}
+
+	/// \brief Construct an EC2N
+	/// \param field Field, GF2NP derived class
+	/// \param a Field::Element
+	/// \param b Field::Element
+	EC2N(const Field &field, const Field::Element &a, const Field::Element &b)
+		: m_field(field), m_a(a), m_b(b) {}
+
+	/// \brief Construct an EC2N from BER encoded parameters
+	/// \param bt BufferedTransformation derived object
+	/// \details This constructor will decode and extract the fields fieldID and curve of the sequence ECParameters
+	EC2N(BufferedTransformation &bt);
+
+	/// \brief Encode the fields fieldID and curve of the sequence ECParameters
+	/// \param bt BufferedTransformation derived object
+	void DEREncode(BufferedTransformation &bt) const;
+
+	bool Equal(const Point &P, const Point &Q) const;
+	const Point& Identity() const;
+	const Point& Inverse(const Point &P) const;
+	bool InversionIsFast() const {return true;}
+	const Point& Add(const Point &P, const Point &Q) const;
+	const Point& Double(const Point &P) const;
+
+	Point Multiply(const Integer &k, const Point &P) const
+		{return ScalarMultiply(P, k);}
+	Point CascadeMultiply(const Integer &k1, const Point &P, const Integer &k2, const Point &Q) const
+		{return CascadeScalarMultiply(P, k1, Q, k2);}
+
+	bool ValidateParameters(RandomNumberGenerator &rng, unsigned int level=3) const;
+	bool VerifyPoint(const Point &P) const;
+
+	unsigned int EncodedPointSize(bool compressed = false) const
+		{return 1 + (compressed?1:2)*m_field->MaxElementByteLength();}
+	// returns false if point is compressed and not valid (doesn't check if uncompressed)
+	bool DecodePoint(Point &P, BufferedTransformation &bt, size_t len) const;
+	bool DecodePoint(Point &P, const byte *encodedPoint, size_t len) const;
+	void EncodePoint(byte *encodedPoint, const Point &P, bool compressed) const;
+	void EncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const;
+
+	Point BERDecodePoint(BufferedTransformation &bt) const;
+	void DEREncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const;
+
+	Integer FieldSize() const {return Integer::Power2(m_field->MaxElementBitLength());}
+	const Field & GetField() const {return *m_field;}
+	const FieldElement & GetA() const {return m_a;}
+	const FieldElement & GetB() const {return m_b;}
+
+	bool operator==(const EC2N &rhs) const
+		{return GetField() == rhs.GetField() && m_a == rhs.m_a && m_b == rhs.m_b;}
+
+private:
+	clonable_ptr<Field> m_field;
+	FieldElement m_a, m_b;
+	mutable Point m_R;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_FixedBasePrecomputationImpl<EC2N::Point>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_GroupPrecomputation<EC2N::Point>;
+
+/// \brief Elliptic Curve precomputation
+/// \tparam EC elliptic curve field
+template <class EC> class EcPrecomputation;
+
+/// \brief EC2N precomputation specialization
+/// \details Implementation of <tt>DL_GroupPrecomputation<EC2N::Point></tt>
+/// \sa DL_GroupPrecomputation
+template<> class EcPrecomputation<EC2N> : public DL_GroupPrecomputation<EC2N::Point>
+{
+public:
+	typedef EC2N EllipticCurve;
+
+	virtual ~EcPrecomputation() {}
+
+	// DL_GroupPrecomputation
+	const AbstractGroup<Element> & GetGroup() const {return m_ec;}
+	Element BERDecodeElement(BufferedTransformation &bt) const {return m_ec.BERDecodePoint(bt);}
+	void DEREncodeElement(BufferedTransformation &bt, const Element &v) const {m_ec.DEREncodePoint(bt, v, false);}
+
+	/// \brief Set the elliptic curve
+	/// \param ec ECP derived class
+	/// \details SetCurve() is not inherited
+	void SetCurve(const EC2N &ec) {m_ec = ec;}
+
+	/// \brief Get the elliptic curve
+	/// \return EC2N curve
+	/// \details GetCurve() is not inherited
+	const EC2N & GetCurve() const {return m_ec;}
+
+private:
+	EC2N m_ec;
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/eccrypto.cpp b/runtime/third_party/cryptopp/eccrypto.cpp
new file mode 100644
index 0000000..a90c1e9
--- /dev/null
+++ b/runtime/third_party/cryptopp/eccrypto.cpp
@@ -0,0 +1,840 @@
+// eccrypto.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4127 4189 4505)
+#endif
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wunused-function"
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "eccrypto.h"
+#include "integer.h"
+#include "nbtheory.h"
+#include "filters.h"
+#include "argnames.h"
+#include "smartptr.h"
+#include "oids.h"
+#include "asn.h"
+#include "hex.h"
+#include "ec2n.h"
+#include "misc.h"
+
+#include <iostream>
+#include <sstream>
+
+// Squash MS LNK4221 and libtool warnings
+#ifndef CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES
+extern const char ECCRYPTO_FNAME[] = __FILE__;
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if 0
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+static void ECDSA_TestInstantiations()
+{
+	ECDSA<EC2N>::Signer t1;
+	ECDSA<EC2N>::Verifier t2(t1);
+	ECNR<ECP>::Signer t3;
+	ECNR<ECP>::Verifier t4(t3);
+	ECIES<ECP>::Encryptor t5;
+	ECIES<EC2N>::Decryptor t6;
+	ECDH<ECP>::Domain t7;
+	ECMQV<ECP>::Domain t8;
+}
+#endif
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+inline Integer ConvertToInteger(const PolynomialMod2 &x)
+{
+	unsigned int l = x.ByteCount();
+	SecByteBlock temp(l);
+	x.Encode(temp, l);
+	return Integer(temp, l);
+}
+
+inline Integer ConvertToInteger(const Integer &x)
+{
+	return x;
+}
+
+inline bool CheckMOVCondition(const Integer &q, const Integer &r)
+{
+	// see "Updated standards for validating elliptic curves", http://eprint.iacr.org/2007/343
+	Integer t = 1;
+	unsigned int n = q.IsEven() ? 1 : q.BitCount(), m = r.BitCount();
+
+	for (unsigned int i=n; DiscreteLogWorkFactor(i)<m/2; i+=n)
+	{
+		if (q.IsEven())
+			t = (t+t)%r;
+		else
+			t = (t*q)%r;
+		if (t == 1)
+			return false;
+	}
+	return true;
+}
+ANONYMOUS_NAMESPACE_END
+
+// ******************************************************************
+
+template <class T> struct EcRecommendedParameters;
+
+template<> struct EcRecommendedParameters<EC2N>
+{
+	EcRecommendedParameters(const OID &oid, unsigned int t2, unsigned int t3, unsigned int t4, const char *a, const char *b, const char *g, const char *n, unsigned int h)
+		: oid(oid), a(a), b(b), g(g), n(n), h(h), t0(0), t1(0), t2(t2), t3(t3), t4(t4) {}
+	EcRecommendedParameters(const OID &oid, unsigned int t0, unsigned int t1, unsigned int t2, unsigned int t3, unsigned int t4, const char *a, const char *b, const char *g, const char *n, unsigned int h)
+		: oid(oid), a(a), b(b), g(g), n(n), h(h), t0(t0), t1(t1), t2(t2), t3(t3), t4(t4) {}
+	EC2N *NewEC() const
+	{
+		StringSource ssA(a, true, new HexDecoder);
+		StringSource ssB(b, true, new HexDecoder);
+		if (t0 == 0)
+		{
+			if (t2 == 233 && t3 == 74 && t4 == 0)
+				return new EC2N(GF2NT233(233, 74, 0), EC2N::FieldElement(ssA, (size_t)ssA.MaxRetrievable()), EC2N::FieldElement(ssB, (size_t)ssB.MaxRetrievable()));
+			else
+				return new EC2N(GF2NT(t2, t3, t4), EC2N::FieldElement(ssA, (size_t)ssA.MaxRetrievable()), EC2N::FieldElement(ssB, (size_t)ssB.MaxRetrievable()));
+		}
+		else
+			return new EC2N(GF2NPP(t0, t1, t2, t3, t4), EC2N::FieldElement(ssA, (size_t)ssA.MaxRetrievable()), EC2N::FieldElement(ssB, (size_t)ssB.MaxRetrievable()));
+	};
+
+	OID oid;
+	const char *a, *b, *g, *n;
+	unsigned int h, t0, t1, t2, t3, t4;
+};
+
+template<> struct EcRecommendedParameters<ECP>
+{
+	EcRecommendedParameters(const OID &oid, const char *p, const char *a, const char *b, const char *g, const char *n, unsigned int h)
+		: oid(oid), p(p), a(a), b(b), g(g), n(n), h(h) {}
+	ECP *NewEC() const
+	{
+		StringSource ssP(p, true, new HexDecoder);
+		StringSource ssA(a, true, new HexDecoder);
+		StringSource ssB(b, true, new HexDecoder);
+		return new ECP(Integer(ssP, (size_t)ssP.MaxRetrievable()), ECP::FieldElement(ssA, (size_t)ssA.MaxRetrievable()), ECP::FieldElement(ssB, (size_t)ssB.MaxRetrievable()));
+	};
+
+	OID oid;
+	const char *p, *a, *b, *g, *n;
+	unsigned int h;
+};
+
+struct OIDLessThan
+{
+	template <typename T>
+	inline bool operator()(const EcRecommendedParameters<T>& a, const OID& b) {return a.oid < b;}
+	template <typename T>
+	inline bool operator()(const OID& a, const EcRecommendedParameters<T>& b) {return a < b.oid;}
+	template <typename T>
+	inline bool operator()(const EcRecommendedParameters<T>& a, const EcRecommendedParameters<T>& b) {return a.oid < b.oid;}
+};
+
+static void GetRecommendedParameters(const EcRecommendedParameters<EC2N> *&begin, const EcRecommendedParameters<EC2N> *&end)
+{
+	// this array must be sorted by OID
+	static const EcRecommendedParameters<EC2N> rec[] = {
+		EcRecommendedParameters<EC2N>(ASN1::sect163k1(),
+			163, 7, 6, 3, 0,
+			"000000000000000000000000000000000000000001",
+			"000000000000000000000000000000000000000001",
+			"0402FE13C0537BBC11ACAA07D793DE4E6D5E5C94EEE80289070FB05D38FF58321F2E800536D538CCDAA3D9",
+			"04000000000000000000020108A2E0CC0D99F8A5EF",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect163r1(),
+			163, 7, 6, 3, 0,
+			"07B6882CAAEFA84F9554FF8428BD88E246D2782AE2",
+			"0713612DCDDCB40AAB946BDA29CA91F73AF958AFD9",
+			"040369979697AB43897789566789567F787A7876A65400435EDB42EFAFB2989D51FEFCE3C80988F41FF883",
+			"03FFFFFFFFFFFFFFFFFFFF48AAB689C29CA710279B",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect239k1(),
+			239, 158, 0,
+			"000000000000000000000000000000000000000000000000000000000000",
+			"000000000000000000000000000000000000000000000000000000000001",
+			"0429A0B6A887A983E9730988A68727A8B2D126C44CC2CC7B2A6555193035DC76310804F12E549BDB011C103089E73510ACB275FC312A5DC6B76553F0CA",
+			"2000000000000000000000000000005A79FEC67CB6E91F1C1DA800E478A5",
+			4),
+		EcRecommendedParameters<EC2N>(ASN1::sect113r1(),
+			113, 9, 0,
+			"003088250CA6E7C7FE649CE85820F7",
+			"00E8BEE4D3E2260744188BE0E9C723",
+			"04009D73616F35F4AB1407D73562C10F00A52830277958EE84D1315ED31886",
+			"0100000000000000D9CCEC8A39E56F",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect113r2(),
+			113, 9, 0,
+			"00689918DBEC7E5A0DD6DFC0AA55C7",
+			"0095E9A9EC9B297BD4BF36E059184F",
+			"0401A57A6A7B26CA5EF52FCDB816479700B3ADC94ED1FE674C06E695BABA1D",
+			"010000000000000108789B2496AF93",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect163r2(),
+			163, 7, 6, 3, 0,
+			"000000000000000000000000000000000000000001",
+			"020A601907B8C953CA1481EB10512F78744A3205FD",
+			"0403F0EBA16286A2D57EA0991168D4994637E8343E3600D51FBC6C71A0094FA2CDD545B11C5C0C797324F1",
+			"040000000000000000000292FE77E70C12A4234C33",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect283k1(),
+			283, 12, 7, 5, 0,
+			"000000000000000000000000000000000000000000000000000000000000000000000000",
+			"000000000000000000000000000000000000000000000000000000000000000000000001",
+			"040503213F78CA44883F1A3B8162F188E553CD265F23C1567A16876913B0C2AC245849283601CCDA380F1C9E318D90F95D07E5426FE87E45C0E8184698E45962364E34116177DD2259",
+			"01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163C61",
+			4),
+		EcRecommendedParameters<EC2N>(ASN1::sect283r1(),
+			283, 12, 7, 5, 0,
+			"000000000000000000000000000000000000000000000000000000000000000000000001",
+			"027B680AC8B8596DA5A4AF8A19A0303FCA97FD7645309FA2A581485AF6263E313B79A2F5",
+			"0405F939258DB7DD90E1934F8C70B0DFEC2EED25B8557EAC9C80E2E198F8CDBECD86B1205303676854FE24141CB98FE6D4B20D02B4516FF702350EDDB0826779C813F0DF45BE8112F4",
+			"03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB307",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect131r1(),
+			131, 8, 3, 2, 0,
+			"07A11B09A76B562144418FF3FF8C2570B8",
+			"0217C05610884B63B9C6C7291678F9D341",
+			"040081BAF91FDF9833C40F9C181343638399078C6E7EA38C001F73C8134B1B4EF9E150",
+			"0400000000000000023123953A9464B54D",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect131r2(),
+			131, 8, 3, 2, 0,
+			"03E5A88919D7CAFCBF415F07C2176573B2",
+			"04B8266A46C55657AC734CE38F018F2192",
+			"040356DCD8F2F95031AD652D23951BB366A80648F06D867940A5366D9E265DE9EB240F",
+			"0400000000000000016954A233049BA98F",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect193r1(),
+			193, 15, 0,
+			"0017858FEB7A98975169E171F77B4087DE098AC8A911DF7B01",
+			"00FDFB49BFE6C3A89FACADAA7A1E5BBC7CC1C2E5D831478814",
+			"0401F481BC5F0FF84A74AD6CDF6FDEF4BF6179625372D8C0C5E10025E399F2903712CCF3EA9E3A1AD17FB0B3201B6AF7CE1B05",
+			"01000000000000000000000000C7F34A778F443ACC920EBA49",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect193r2(),
+			193, 15, 0,
+			"0163F35A5137C2CE3EA6ED8667190B0BC43ECD69977702709B",
+			"00C9BB9E8927D4D64C377E2AB2856A5B16E3EFB7F61D4316AE",
+			"0400D9B67D192E0367C803F39E1A7E82CA14A651350AAE617E8F01CE94335607C304AC29E7DEFBD9CA01F596F927224CDECF6C",
+			"010000000000000000000000015AAB561B005413CCD4EE99D5",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect233k1(),
+			233, 74, 0,
+			"000000000000000000000000000000000000000000000000000000000000",
+			"000000000000000000000000000000000000000000000000000000000001",
+			"04017232BA853A7E731AF129F22FF4149563A419C26BF50A4C9D6EEFAD612601DB537DECE819B7F70F555A67C427A8CD9BF18AEB9B56E0C11056FAE6A3",
+			"8000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF",
+			4),
+		EcRecommendedParameters<EC2N>(ASN1::sect233r1(),
+			233, 74, 0,
+			"000000000000000000000000000000000000000000000000000000000001",
+			"0066647EDE6C332C7F8C0923BB58213B333B20E9CE4281FE115F7D8F90AD",
+			"0400FAC9DFCBAC8313BB2139F1BB755FEF65BC391F8B36F8F8EB7371FD558B01006A08A41903350678E58528BEBF8A0BEFF867A7CA36716F7E01F81052",
+			"01000000000000000000000000000013E974E72F8A6922031D2603CFE0D7",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect409k1(),
+			409, 87, 0,
+			"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+			"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+			"040060F05F658F49C1AD3AB1890F7184210EFD0987E307C84C27ACCFB8F9F67CC2C460189EB5AAAA62EE222EB1B35540CFE902374601E369050B7C4E42ACBA1DACBF04299C3460782F918EA427E6325165E9EA10E3DA5F6C42E9C55215AA9CA27A5863EC48D8E0286B",
+			"7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE5F83B2D4EA20400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF",
+			4),
+		EcRecommendedParameters<EC2N>(ASN1::sect409r1(),
+			409, 87, 0,
+			"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+			"0021A5C2C8EE9FEB5C4B9A753B7B476B7FD6422EF1F3DD674761FA99D6AC27C8A9A197B272822F6CD57A55AA4F50AE317B13545F",
+			"04015D4860D088DDB3496B0C6064756260441CDE4AF1771D4DB01FFE5B34E59703DC255A868A1180515603AEAB60794E54BB7996A70061B1CFAB6BE5F32BBFA78324ED106A7636B9C5A7BD198D0158AA4F5488D08F38514F1FDF4B4F40D2181B3681C364BA0273C706",
+			"010000000000000000000000000000000000000000000000000001E2AAD6A612F33307BE5FA47C3C9E052F838164CD37D9A21173",
+			2),
+		EcRecommendedParameters<EC2N>(ASN1::sect571k1(),
+			571, 10, 5, 2, 0,
+			"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+			"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+			"04026EB7A859923FBC82189631F8103FE4AC9CA2970012D5D46024804801841CA44370958493B205E647DA304DB4CEB08CBBD1BA39494776FB988B47174DCA88C7E2945283A01C89720349DC807F4FBF374F4AEADE3BCA95314DD58CEC9F307A54FFC61EFC006D8A2C9D4979C0AC44AEA74FBEBBB9F772AEDCB620B01A7BA7AF1B320430C8591984F601CD4C143EF1C7A3",
+			"020000000000000000000000000000000000000000000000000000000000000000000000131850E1F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F637C1001",
+			4),
+		EcRecommendedParameters<EC2N>(ASN1::sect571r1(),
+			571, 10, 5, 2, 0,
+			"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+			"02F40E7E2221F295DE297117B7F3D62F5C6A97FFCB8CEFF1CD6BA8CE4A9A18AD84FFABBD8EFA59332BE7AD6756A66E294AFD185A78FF12AA520E4DE739BACA0C7FFEFF7F2955727A",
+			"040303001D34B856296C16C0D40D3CD7750A93D1D2955FA80AA5F40FC8DB7B2ABDBDE53950F4C0D293CDD711A35B67FB1499AE60038614F1394ABFA3B4C850D927E1E7769C8EEC2D19037BF27342DA639B6DCCFFFEB73D69D78C6C27A6009CBBCA1980F8533921E8A684423E43BAB08A576291AF8F461BB2A8B3531D2F0485C19B16E2F1516E23DD3C1A4827AF1B8AC15B",
+			"03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE661CE18FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2FE84E47",
+			2),
+	};
+	begin = rec;
+	end = rec + sizeof(rec)/sizeof(rec[0]);
+}
+
+// See https://www.cryptopp.com/wiki/SM2 for details on sm2p256v1 and sm2encrypt_recommendedParameters
+static void GetRecommendedParameters(const EcRecommendedParameters<ECP> *&begin, const EcRecommendedParameters<ECP> *&end)
+{
+	// this array must be sorted by OID
+	static const EcRecommendedParameters<ECP> rec[] = {
+		EcRecommendedParameters<ECP>(ASN1::sm2p256v1(),
+			"FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFF",
+			"FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFC",
+			"28E9FA9E 9D9F5E34 4D5A9E4B CF6509A7 F39789F5 15AB8F92 DDBCBD41 4D940E93",
+			"04" "32C4AE2C 1F198119 5F990446 6A39C994 8FE30BBF F2660BE1 715A4589 334C74C7"
+			     "BC3736A2 F4F6779C 59BDCEE3 6B692153 D0A9877C C62A4740 02DF32E5 2139F0A0",
+			"FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF 7203DF6B 21C6052B 53BBF409 39D54123",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::sm2encrypt_recommendedParameters(),
+			"FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFF",
+			"FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFC",
+			"28E9FA9E 9D9F5E34 4D5A9E4B CF6509A7 F39789F5 15AB8F92 DDBCBD41 4D940E93",
+			"04" "32C4AE2C 1F198119 5F990446 6A39C994 8FE30BBF F2660BE1 715A4589 334C74C7"
+			     "BC3736A2 F4F6779C 59BDCEE3 6B692153 D0A9877C C62A4740 02DF32E5 2139F0A0",
+			"FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF 7203DF6B 21C6052B 53BBF409 39D54123",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp192r1(),
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
+			"64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1",
+			"04188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF101207192B95FFC8DA78631011ED6B24CDD573F977A11E794811",
+			"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp256r1(),
+			"FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF",
+			"FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC",
+			"5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B",
+			"046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5",
+			"FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::brainpoolP160r1(),
+			"E95E4A5F737059DC60DFC7AD95B3D8139515620F",
+			"340E7BE2A280EB74E2BE61BADA745D97E8F7C300",
+			"1E589A8595423412134FAA2DBDEC95C8D8675E58",
+			"04BED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC31667CB477A1A8EC338F94741669C976316DA6321",
+			"E95E4A5F737059DC60DF5991D45029409E60FC09",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::brainpoolP192r1(),
+			"C302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297",
+			"6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF",
+			"469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9",
+			"04C0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD614B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F",
+			"C302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::brainpoolP224r1(),
+			"D7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF",
+			"68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43",
+			"2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B",
+			"040D9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD",
+			"D7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::brainpoolP256r1(),
+			"A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377",
+			"7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9",
+			"26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6",
+			"048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997",
+			"A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::brainpoolP320r1(),
+			"D35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27",
+			"3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4",
+			"520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6",
+			"0443BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E2061114FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1",
+			"D35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::brainpoolP384r1(),
+			"8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53",
+			"7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826",
+			"04A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11",
+			"041D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315",
+			"8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::brainpoolP512r1(),
+			"AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3",
+			"7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA",
+			"3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723",
+			"0481AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F8227DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892",
+			"AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp112r1(),
+			"DB7C2ABF62E35E668076BEAD208B",
+			"DB7C2ABF62E35E668076BEAD2088",
+			"659EF8BA043916EEDE8911702B22",
+			"0409487239995A5EE76B55F9C2F098A89CE5AF8724C0A23E0E0FF77500",
+			"DB7C2ABF62E35E7628DFAC6561C5",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp112r2(),
+			"DB7C2ABF62E35E668076BEAD208B",
+			"6127C24C05F38A0AAAF65C0EF02C",
+			"51DEF1815DB5ED74FCC34C85D709",
+			"044BA30AB5E892B4E1649DD0928643ADCD46F5882E3747DEF36E956E97",
+			"36DF0AAFD8B8D7597CA10520D04B",
+			4),
+		EcRecommendedParameters<ECP>(ASN1::secp160r1(),
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC",
+			"1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45",
+			"044A96B5688EF573284664698968C38BB913CBFC8223A628553168947D59DCC912042351377AC5FB32",
+			"0100000000000000000001F4C8F927AED3CA752257",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp160k1(),
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
+			"0000000000000000000000000000000000000000",
+			"0000000000000000000000000000000000000007",
+			"043B4C382CE37AA192A4019E763036F4F5DD4D7EBB938CF935318FDCED6BC28286531733C3F03C4FEE",
+			"0100000000000000000001B8FA16DFAB9ACA16B6B3",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp256k1(),
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F",
+			"0000000000000000000000000000000000000000000000000000000000000000",
+			"0000000000000000000000000000000000000000000000000000000000000007",
+			"0479BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp128r1(),
+			"FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF",
+			"FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFC",
+			"E87579C11079F43DD824993C2CEE5ED3",
+			"04161FF7528B899B2D0C28607CA52C5B86CF5AC8395BAFEB13C02DA292DDED7A83",
+			"FFFFFFFE0000000075A30D1B9038A115",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp128r2(),
+			"FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF",
+			"D6031998D1B3BBFEBF59CC9BBFF9AEE1",
+			"5EEEFCA380D02919DC2C6558BB6D8A5D",
+			"047B6AA5D85E572983E6FB32A7CDEBC14027B6916A894D3AEE7106FE805FC34B44",
+			"3FFFFFFF7FFFFFFFBE0024720613B5A3",
+			4),
+		EcRecommendedParameters<ECP>(ASN1::secp160r2(),
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70",
+			"B4E134D3FB59EB8BAB57274904664D5AF50388BA",
+			"0452DCB034293A117E1F4FF11B30F7199D3144CE6DFEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E",
+			"0100000000000000000000351EE786A818F3A1A16B",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp192k1(),
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37",
+			"000000000000000000000000000000000000000000000000",
+			"000000000000000000000000000000000000000000000003",
+			"04DB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D",
+			"FFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp224k1(),
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D",
+			"00000000000000000000000000000000000000000000000000000000",
+			"00000000000000000000000000000000000000000000000000000005",
+			"04A1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5",
+			"010000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp224r1(),
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
+			"B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
+			"04B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp384r1(),
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC",
+			"B3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF",
+			"04AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB73617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F",
+			"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973",
+			1),
+		EcRecommendedParameters<ECP>(ASN1::secp521r1(),
+			"01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
+			"01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC",
+			"0051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00",
+			"0400C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66011839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650",
+			"01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409",
+			1),
+	};
+	begin = rec;
+	end = rec + sizeof(rec)/sizeof(rec[0]);
+}
+
+template <class EC> OID DL_GroupParameters_EC<EC>::GetNextRecommendedParametersOID(const OID &oid)
+{
+	const EcRecommendedParameters<EllipticCurve> *begin, *end;
+	GetRecommendedParameters(begin, end);
+	const EcRecommendedParameters<EllipticCurve> *it = std::upper_bound(begin, end, oid, OIDLessThan());
+	return (it == end ? OID() : it->oid);
+}
+
+template <class EC> void DL_GroupParameters_EC<EC>::Initialize(const OID &oid)
+{
+	const EcRecommendedParameters<EllipticCurve> *begin, *end;
+	GetRecommendedParameters(begin, end);
+	const EcRecommendedParameters<EllipticCurve> *it = std::lower_bound(begin, end, oid, OIDLessThan());
+	if (it == end || it->oid != oid)
+		throw UnknownOID();
+
+	const EcRecommendedParameters<EllipticCurve> &param = *it;
+	m_oid = oid;
+	member_ptr<EllipticCurve> ec(param.NewEC());
+	this->m_groupPrecomputation.SetCurve(*ec);
+
+	StringSource ssG(param.g, true, new HexDecoder);
+	Element G;
+	bool result = GetCurve().DecodePoint(G, ssG, (size_t)ssG.MaxRetrievable());
+	this->SetSubgroupGenerator(G);
+
+	// TODO: this fails in practice. Should it throw?
+	CRYPTOPP_UNUSED(result); CRYPTOPP_ASSERT(result);
+
+	StringSource ssN(param.n, true, new HexDecoder);
+	m_n.Decode(ssN, (size_t)ssN.MaxRetrievable());
+	m_k = param.h;
+}
+
+template <class EC>
+bool DL_GroupParameters_EC<EC>::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	if (strcmp(name, Name::GroupOID()) == 0)
+	{
+		if (m_oid.Empty())
+			return false;
+
+		this->ThrowIfTypeMismatch(name, typeid(OID), valueType);
+		*reinterpret_cast<OID *>(pValue) = m_oid;
+		return true;
+	}
+	else
+		return GetValueHelper<DL_GroupParameters<Element> >(this, name, valueType, pValue).Assignable()
+			CRYPTOPP_GET_FUNCTION_ENTRY(Curve);
+}
+
+template <class EC>
+void DL_GroupParameters_EC<EC>::AssignFrom(const NameValuePairs &source)
+{
+	OID oid;
+	if (source.GetValue(Name::GroupOID(), oid))
+		Initialize(oid);
+	else
+	{
+		EllipticCurve ec;
+		Point G;
+		Integer n;
+
+		source.GetRequiredParameter("DL_GroupParameters_EC<EC>", Name::Curve(), ec);
+		source.GetRequiredParameter("DL_GroupParameters_EC<EC>", Name::SubgroupGenerator(), G);
+		source.GetRequiredParameter("DL_GroupParameters_EC<EC>", Name::SubgroupOrder(), n);
+		Integer k = source.GetValueWithDefault(Name::Cofactor(), Integer::Zero());
+
+		Initialize(ec, G, n, k);
+	}
+}
+
+template <class EC>
+void DL_GroupParameters_EC<EC>::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg)
+{
+	try
+	{
+		CRYPTOPP_UNUSED(rng);
+		AssignFrom(alg);
+	}
+	catch (InvalidArgument &)
+	{
+		throw NotImplemented("DL_GroupParameters_EC<EC>: curve generation is not implemented yet");
+	}
+}
+
+template <class EC>
+void DL_GroupParameters_EC<EC>::BERDecode(BufferedTransformation &bt)
+{
+	byte b;
+	if (!bt.Peek(b))
+		BERDecodeError();
+	if (b == OBJECT_IDENTIFIER)
+		Initialize(OID(bt));
+	else
+	{
+		BERSequenceDecoder seq(bt);
+			word32 version;
+			BERDecodeUnsigned<word32>(seq, version, INTEGER, 1, 1);	// check version
+			EllipticCurve ec(seq);
+			Point G = ec.BERDecodePoint(seq);
+			Integer n(seq);
+			Integer k;
+			bool cofactorPresent = !seq.EndReached();
+			if (cofactorPresent)
+				k.BERDecode(seq);
+			else
+				k = Integer::Zero();
+		seq.MessageEnd();
+
+		Initialize(ec, G, n, k);
+	}
+}
+
+template <class EC>
+void DL_GroupParameters_EC<EC>::DEREncode(BufferedTransformation &bt) const
+{
+	if (m_encodeAsOID && !m_oid.Empty())
+		m_oid.DEREncode(bt);
+	else
+	{
+		DERSequenceEncoder seq(bt);
+		DEREncodeUnsigned<word32>(seq, 1);	// version
+		GetCurve().DEREncode(seq);
+		GetCurve().DEREncodePoint(seq, this->GetSubgroupGenerator(), m_compress);
+		m_n.DEREncode(seq);
+		if (m_k.NotZero())
+			m_k.DEREncode(seq);
+		seq.MessageEnd();
+	}
+}
+
+template <class EC>
+Integer DL_GroupParameters_EC<EC>::GetCofactor() const
+{
+	if (!m_k)
+	{
+		Integer q = GetCurve().FieldSize();
+		Integer qSqrt = q.SquareRoot();
+		m_k = (q+2*qSqrt+1)/m_n;
+	}
+
+	return m_k;
+}
+
+template <class EC>
+Integer DL_GroupParameters_EC<EC>::ConvertElementToInteger(const Element &element) const
+{
+	return ConvertToInteger(element.x);
+}
+
+template <class EC>
+bool DL_GroupParameters_EC<EC>::ValidateGroup(RandomNumberGenerator &rng, unsigned int level) const
+{
+	bool pass = GetCurve().ValidateParameters(rng, level);
+	CRYPTOPP_ASSERT(pass);
+
+	Integer q = GetCurve().FieldSize();
+	pass = pass && m_n!=q;
+	CRYPTOPP_ASSERT(pass);
+
+	if (level >= 2)
+	{
+		Integer qSqrt = q.SquareRoot();
+		pass = pass && m_n>4*qSqrt;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && VerifyPrime(rng, m_n, level-2);
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && (m_k.IsZero() || m_k == (q+2*qSqrt+1)/m_n);
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && CheckMOVCondition(q, m_n);
+		CRYPTOPP_ASSERT(pass);
+	}
+
+	return pass;
+}
+
+template <class EC>
+bool DL_GroupParameters_EC<EC>::ValidateElement(unsigned int level, const Element &g, const DL_FixedBasePrecomputation<Element> *gpc) const
+{
+	bool pass = !IsIdentity(g);
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && GetCurve().VerifyPoint(g);
+	CRYPTOPP_ASSERT(pass);
+
+	if (level >= 1)
+	{
+		if (gpc)
+		{
+			pass = pass && gpc->Exponentiate(this->GetGroupPrecomputation(), Integer::One()) == g;
+			CRYPTOPP_ASSERT(pass);
+		}
+	}
+	if (level >= 2 && pass)
+	{
+		const Integer &q = GetSubgroupOrder();
+		Element gq = gpc ? gpc->Exponentiate(this->GetGroupPrecomputation(), q) : this->ExponentiateElement(g, q);
+		pass = pass && IsIdentity(gq);
+		CRYPTOPP_ASSERT(pass);
+	}
+	return pass;
+}
+
+template <class EC>
+void DL_GroupParameters_EC<EC>::SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const
+{
+	GetCurve().SimultaneousMultiply(results, base, exponents, exponentsCount);
+}
+
+template <class EC>
+typename DL_GroupParameters_EC<EC>::Element DL_GroupParameters_EC<EC>::MultiplyElements(const Element &a, const Element &b) const
+{
+	return GetCurve().Add(a, b);
+}
+
+template <class EC>
+typename DL_GroupParameters_EC<EC>::Element DL_GroupParameters_EC<EC>::CascadeExponentiate(const Element &element1, const Integer &exponent1, const Element &element2, const Integer &exponent2) const
+{
+	return GetCurve().CascadeMultiply(exponent1, element1, exponent2, element2);
+}
+
+template <class EC>
+OID DL_GroupParameters_EC<EC>::GetAlgorithmID() const
+{
+	return ASN1::id_ecPublicKey();
+}
+
+std::ostream& operator<<(std::ostream& os, const DL_GroupParameters_EC<ECP>::Element& obj)
+{
+	std::ostringstream oss;
+	oss << "(" << std::hex << obj.x << ", " << std::hex  << obj.y << ")";
+	return os << oss.str();
+}
+
+// ******************************************************************
+
+template <class EC>
+void DL_PublicKey_EC<EC>::BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size)
+{
+	CRYPTOPP_UNUSED(parametersPresent);
+
+	typename EC::Point P;
+	if (!this->GetGroupParameters().GetCurve().DecodePoint(P, bt, size))
+		BERDecodeError();
+	this->SetPublicElement(P);
+}
+
+template <class EC>
+void DL_PublicKey_EC<EC>::DEREncodePublicKey(BufferedTransformation &bt) const
+{
+	this->GetGroupParameters().GetCurve().EncodePoint(bt, this->GetPublicElement(), this->GetGroupParameters().GetPointCompression());
+}
+
+// ******************************************************************
+
+template <class EC>
+void DL_PrivateKey_EC<EC>::BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size)
+{
+	CRYPTOPP_UNUSED(size);
+	BERSequenceDecoder seq(bt);
+		word32 version;
+		BERDecodeUnsigned<word32>(seq, version, INTEGER, 1, 1);	// check version
+
+		BERGeneralDecoder dec(seq, OCTET_STRING);
+		if (!dec.IsDefiniteLength())
+			BERDecodeError();
+		Integer x;
+		x.Decode(dec, (size_t)dec.RemainingLength());
+		dec.MessageEnd();
+		if (!parametersPresent && seq.PeekByte() != (CONTEXT_SPECIFIC | CONSTRUCTED | 0))
+			BERDecodeError();
+		if (!seq.EndReached() && seq.PeekByte() == (CONTEXT_SPECIFIC | CONSTRUCTED | 0))
+		{
+			BERGeneralDecoder parameters(seq, CONTEXT_SPECIFIC | CONSTRUCTED | 0);
+			this->AccessGroupParameters().BERDecode(parameters);
+			parameters.MessageEnd();
+		}
+		if (!seq.EndReached())
+		{
+			// skip over the public element
+			SecByteBlock subjectPublicKey;
+			unsigned int unusedBits;
+			BERGeneralDecoder publicKey(seq, CONTEXT_SPECIFIC | CONSTRUCTED | 1);
+			BERDecodeBitString(publicKey, subjectPublicKey, unusedBits);
+			publicKey.MessageEnd();
+			Element Q;
+			if (!(unusedBits == 0 && this->GetGroupParameters().GetCurve().DecodePoint(Q, subjectPublicKey, subjectPublicKey.size())))
+				BERDecodeError();
+		}
+	seq.MessageEnd();
+
+	this->SetPrivateExponent(x);
+}
+
+template <class EC>
+void DL_PrivateKey_EC<EC>::DEREncodePrivateKey(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder privateKey(bt);
+		DEREncodeUnsigned<word32>(privateKey, 1);	// version
+		// SEC 1 ver 1.0 says privateKey (m_d) has the same length as order of the curve
+		// this will be changed to order of base point in a future version
+		this->GetPrivateExponent().DEREncodeAsOctetString(privateKey, this->GetGroupParameters().GetSubgroupOrder().ByteCount());
+	privateKey.MessageEnd();
+}
+
+// ******************************************************************
+
+template <class EC>
+void DL_PublicKey_ECGDSA<EC>::BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size)
+{
+	CRYPTOPP_UNUSED(parametersPresent);
+
+	typename EC::Point P;
+	if (!this->GetGroupParameters().GetCurve().DecodePoint(P, bt, size))
+		BERDecodeError();
+	this->SetPublicElement(P);
+}
+
+template <class EC>
+void DL_PublicKey_ECGDSA<EC>::DEREncodePublicKey(BufferedTransformation &bt) const
+{
+	this->GetGroupParameters().GetCurve().EncodePoint(bt, this->GetPublicElement(), this->GetGroupParameters().GetPointCompression());
+}
+
+// ******************************************************************
+
+template <class EC>
+void DL_PrivateKey_ECGDSA<EC>::BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size)
+{
+	CRYPTOPP_UNUSED(size);
+	BERSequenceDecoder seq(bt);
+		word32 version;
+		BERDecodeUnsigned<word32>(seq, version, INTEGER, 1, 1);	// check version
+
+		BERGeneralDecoder dec(seq, OCTET_STRING);
+		if (!dec.IsDefiniteLength())
+			BERDecodeError();
+		Integer x;
+		x.Decode(dec, (size_t)dec.RemainingLength());
+		dec.MessageEnd();
+		if (!parametersPresent && seq.PeekByte() != (CONTEXT_SPECIFIC | CONSTRUCTED | 0))
+			BERDecodeError();
+		if (!seq.EndReached() && seq.PeekByte() == (CONTEXT_SPECIFIC | CONSTRUCTED | 0))
+		{
+			BERGeneralDecoder parameters(seq, CONTEXT_SPECIFIC | CONSTRUCTED | 0);
+			this->AccessGroupParameters().BERDecode(parameters);
+			parameters.MessageEnd();
+		}
+		if (!seq.EndReached())
+		{
+			// skip over the public element
+			SecByteBlock subjectPublicKey;
+			unsigned int unusedBits;
+			BERGeneralDecoder publicKey(seq, CONTEXT_SPECIFIC | CONSTRUCTED | 1);
+			BERDecodeBitString(publicKey, subjectPublicKey, unusedBits);
+			publicKey.MessageEnd();
+			Element Q;
+			if (!(unusedBits == 0 && this->GetGroupParameters().GetCurve().DecodePoint(Q, subjectPublicKey, subjectPublicKey.size())))
+				BERDecodeError();
+		}
+	seq.MessageEnd();
+
+	this->SetPrivateExponent(x);
+}
+
+template <class EC>
+void DL_PrivateKey_ECGDSA<EC>::DEREncodePrivateKey(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder privateKey(bt);
+		DEREncodeUnsigned<word32>(privateKey, 1);	// version
+		// SEC 1 ver 1.0 says privateKey (m_d) has the same length as order of the curve
+		// this will be changed to order of base point in a future version
+		this->GetPrivateExponent().DEREncodeAsOctetString(privateKey, this->GetGroupParameters().GetSubgroupOrder().ByteCount());
+	privateKey.MessageEnd();
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/eccrypto.h b/runtime/third_party/cryptopp/eccrypto.h
new file mode 100644
index 0000000..17ccb13
--- /dev/null
+++ b/runtime/third_party/cryptopp/eccrypto.h
@@ -0,0 +1,686 @@
+// eccrypto.h - originally written and placed in the public domain by Wei Dai
+//              deterministic signatures added by by Douglas Roark
+
+/// \file eccrypto.h
+/// \brief Classes and functions for Elliptic Curves over prime and binary fields
+
+#ifndef CRYPTOPP_ECCRYPTO_H
+#define CRYPTOPP_ECCRYPTO_H
+
+#include "config.h"
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "integer.h"
+#include "asn.h"
+#include "hmac.h"
+#include "sha.h"
+#include "gfpcrypt.h"
+#include "dh.h"
+#include "mqv.h"
+#include "hmqv.h"
+#include "fhmqv.h"
+#include "ecp.h"
+#include "ec2n.h"
+
+#include <iosfwd>
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4231 4275)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Elliptic Curve Parameters
+/// \tparam EC elliptic curve field
+/// \details This class corresponds to the ASN.1 sequence of the same name
+///  in ANSI X9.62 and SEC 1. EC is currently defined for ECP and EC2N.
+template <class EC>
+class DL_GroupParameters_EC : public DL_GroupParametersImpl<EcPrecomputation<EC> >
+{
+	typedef DL_GroupParameters_EC<EC> ThisClass;
+
+public:
+	typedef EC EllipticCurve;
+	typedef typename EllipticCurve::Point Point;
+	typedef Point Element;
+	typedef IncompatibleCofactorMultiplication DefaultCofactorOption;
+
+	virtual ~DL_GroupParameters_EC() {}
+
+	/// \brief Construct an EC GroupParameters
+	DL_GroupParameters_EC() : m_compress(false), m_encodeAsOID(true) {}
+
+	/// \brief Construct an EC GroupParameters
+	/// \param oid the OID of a curve
+	DL_GroupParameters_EC(const OID &oid)
+		: m_compress(false), m_encodeAsOID(true) {Initialize(oid);}
+
+	/// \brief Construct an EC GroupParameters
+	/// \param ec the elliptic curve
+	/// \param G the base point
+	/// \param n the order of the base point
+	/// \param k the cofactor
+	DL_GroupParameters_EC(const EllipticCurve &ec, const Point &G, const Integer &n, const Integer &k = Integer::Zero())
+		: m_compress(false), m_encodeAsOID(true) {Initialize(ec, G, n, k);}
+
+	/// \brief Construct an EC GroupParameters
+	/// \param bt BufferedTransformation with group parameters
+	DL_GroupParameters_EC(BufferedTransformation &bt)
+		: m_compress(false), m_encodeAsOID(true) {BERDecode(bt);}
+
+	/// \brief Initialize an EC GroupParameters using {EC,G,n,k}
+	/// \param ec the elliptic curve
+	/// \param G the base point
+	/// \param n the order of the base point
+	/// \param k the cofactor
+	/// \details This Initialize() function overload initializes group parameters from existing parameters.
+	void Initialize(const EllipticCurve &ec, const Point &G, const Integer &n, const Integer &k = Integer::Zero())
+	{
+		this->m_groupPrecomputation.SetCurve(ec);
+		this->SetSubgroupGenerator(G);
+		m_n = n;
+		m_k = k;
+	}
+
+	/// \brief Initialize a DL_GroupParameters_EC {EC,G,n,k}
+	/// \param oid the OID of a curve
+	/// \details This Initialize() function overload initializes group parameters from existing parameters.
+	void Initialize(const OID &oid);
+
+	// NameValuePairs
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+
+	// GeneratibleCryptoMaterial interface
+	/// this implementation doesn't actually generate a curve, it just initializes the parameters with existing values
+	/*! parameters: (Curve, SubgroupGenerator, SubgroupOrder, Cofactor (optional)), or (GroupOID) */
+	void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
+
+	// DL_GroupParameters
+	const DL_FixedBasePrecomputation<Element> & GetBasePrecomputation() const {return this->m_gpc;}
+	DL_FixedBasePrecomputation<Element> & AccessBasePrecomputation() {return this->m_gpc;}
+	const Integer & GetSubgroupOrder() const {return m_n;}
+	Integer GetCofactor() const;
+	bool ValidateGroup(RandomNumberGenerator &rng, unsigned int level) const;
+	bool ValidateElement(unsigned int level, const Element &element, const DL_FixedBasePrecomputation<Element> *precomp) const;
+	bool FastSubgroupCheckAvailable() const {return false;}
+	void EncodeElement(bool reversible, const Element &element, byte *encoded) const
+	{
+		if (reversible)
+			GetCurve().EncodePoint(encoded, element, m_compress);
+		else
+			element.x.Encode(encoded, GetEncodedElementSize(false));
+	}
+	virtual unsigned int GetEncodedElementSize(bool reversible) const
+	{
+		if (reversible)
+			return GetCurve().EncodedPointSize(m_compress);
+		else
+			return GetCurve().GetField().MaxElementByteLength();
+	}
+	Element DecodeElement(const byte *encoded, bool checkForGroupMembership) const
+	{
+		Point result;
+		if (!GetCurve().DecodePoint(result, encoded, GetEncodedElementSize(true)))
+			throw DL_BadElement();
+		if (checkForGroupMembership && !ValidateElement(1, result, NULLPTR))
+			throw DL_BadElement();
+		return result;
+	}
+	Integer ConvertElementToInteger(const Element &element) const;
+	Integer GetMaxExponent() const {return GetSubgroupOrder()-1;}
+	bool IsIdentity(const Element &element) const {return element.identity;}
+	void SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const;
+	static std::string CRYPTOPP_API StaticAlgorithmNamePrefix() {return "EC";}
+
+	// ASN1Key
+	OID GetAlgorithmID() const;
+
+	// used by MQV
+	Element MultiplyElements(const Element &a, const Element &b) const;
+	Element CascadeExponentiate(const Element &element1, const Integer &exponent1, const Element &element2, const Integer &exponent2) const;
+
+	// non-inherited
+
+	// enumerate OIDs for recommended parameters, use OID() to get first one
+	static OID CRYPTOPP_API GetNextRecommendedParametersOID(const OID &oid);
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	void SetPointCompression(bool compress) {m_compress = compress;}
+	bool GetPointCompression() const {return m_compress;}
+
+	void SetEncodeAsOID(bool encodeAsOID) {m_encodeAsOID = encodeAsOID;}
+	bool GetEncodeAsOID() const {return m_encodeAsOID;}
+
+	const EllipticCurve& GetCurve() const {return this->m_groupPrecomputation.GetCurve();}
+
+	bool operator==(const ThisClass &rhs) const
+		{return this->m_groupPrecomputation.GetCurve() == rhs.m_groupPrecomputation.GetCurve() && this->m_gpc.GetBase(this->m_groupPrecomputation) == rhs.m_gpc.GetBase(rhs.m_groupPrecomputation);}
+
+protected:
+	unsigned int FieldElementLength() const {return GetCurve().GetField().MaxElementByteLength();}
+	unsigned int ExponentLength() const {return m_n.ByteCount();}
+
+	OID m_oid;			// set if parameters loaded from a recommended curve
+	Integer m_n;		// order of base point
+	mutable Integer m_k;		// cofactor
+	mutable bool m_compress, m_encodeAsOID;		// presentation details
+};
+
+inline std::ostream& operator<<(std::ostream& os, const DL_GroupParameters_EC<ECP>::Element& obj);
+
+/// \brief Elliptic Curve Discrete Log (DL) public key
+/// \tparam EC elliptic curve field
+template <class EC>
+class DL_PublicKey_EC : public DL_PublicKeyImpl<DL_GroupParameters_EC<EC> >
+{
+public:
+	typedef typename EC::Point Element;
+
+	virtual ~DL_PublicKey_EC() {}
+
+	/// \brief Initialize an EC Public Key using {GP,Q}
+	/// \param params group parameters
+	/// \param Q the public point
+	/// \details This Initialize() function overload initializes a public key from existing parameters.
+	void Initialize(const DL_GroupParameters_EC<EC> &params, const Element &Q)
+		{this->AccessGroupParameters() = params; this->SetPublicElement(Q);}
+
+	/// \brief Initialize an EC Public Key using {EC,G,n,Q}
+	/// \param ec the elliptic curve
+	/// \param G the base point
+	/// \param n the order of the base point
+	/// \param Q the public point
+	/// \details This Initialize() function overload initializes a public key from existing parameters.
+	void Initialize(const EC &ec, const Element &G, const Integer &n, const Element &Q)
+		{this->AccessGroupParameters().Initialize(ec, G, n); this->SetPublicElement(Q);}
+
+	// X509PublicKey
+	void BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
+	void DEREncodePublicKey(BufferedTransformation &bt) const;
+};
+
+/// \brief Elliptic Curve Discrete Log (DL) private key
+/// \tparam EC elliptic curve field
+template <class EC>
+class DL_PrivateKey_EC : public DL_PrivateKeyImpl<DL_GroupParameters_EC<EC> >
+{
+public:
+	typedef typename EC::Point Element;
+
+	virtual ~DL_PrivateKey_EC();
+
+	/// \brief Initialize an EC Private Key using {GP,x}
+	/// \param params group parameters
+	/// \param x the private exponent
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	void Initialize(const DL_GroupParameters_EC<EC> &params, const Integer &x)
+		{this->AccessGroupParameters() = params; this->SetPrivateExponent(x);}
+
+	/// \brief Initialize an EC Private Key using {EC,G,n,x}
+	/// \param ec the elliptic curve
+	/// \param G the base point
+	/// \param n the order of the base point
+	/// \param x the private exponent
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	void Initialize(const EC &ec, const Element &G, const Integer &n, const Integer &x)
+		{this->AccessGroupParameters().Initialize(ec, G, n); this->SetPrivateExponent(x);}
+
+	/// \brief Create an EC private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param params the EC group parameters
+	/// \details This function overload of Initialize() creates a new private key because it
+	///  takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+	///  then use one of the other Initialize() overloads.
+	void Initialize(RandomNumberGenerator &rng, const DL_GroupParameters_EC<EC> &params)
+		{this->GenerateRandom(rng, params);}
+
+	/// \brief Create an EC private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param ec the elliptic curve
+	/// \param G the base point
+	/// \param n the order of the base point
+	/// \details This function overload of Initialize() creates a new private key because it
+	///  takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+	///  then use one of the other Initialize() overloads.
+	void Initialize(RandomNumberGenerator &rng, const EC &ec, const Element &G, const Integer &n)
+		{this->GenerateRandom(rng, DL_GroupParameters_EC<EC>(ec, G, n));}
+
+	// PKCS8PrivateKey
+	void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
+	void DEREncodePrivateKey(BufferedTransformation &bt) const;
+};
+
+// Out-of-line dtor due to AIX and GCC, http://github.com/weidai11/cryptopp/issues/499
+template<class EC>
+DL_PrivateKey_EC<EC>::~DL_PrivateKey_EC() {}
+
+/// \brief Elliptic Curve Diffie-Hellman
+/// \tparam EC elliptic curve field
+/// \tparam COFACTOR_OPTION cofactor multiplication option
+/// \sa CofactorMultiplicationOption, <a href="http://www.weidai.com/scan-mirror/ka.html#ECDH">Elliptic Curve Diffie-Hellman, AKA ECDH</a>
+/// \since Crypto++ 3.0
+template <class EC, class COFACTOR_OPTION = typename DL_GroupParameters_EC<EC>::DefaultCofactorOption>
+struct ECDH
+{
+	typedef DH_Domain<DL_GroupParameters_EC<EC>, COFACTOR_OPTION> Domain;
+};
+
+/// \brief Elliptic Curve Menezes-Qu-Vanstone
+/// \tparam EC elliptic curve field
+/// \tparam COFACTOR_OPTION cofactor multiplication option
+/// \sa CofactorMultiplicationOption, <a href="http://www.weidai.com/scan-mirror/ka.html#ECMQV">Elliptic Curve Menezes-Qu-Vanstone, AKA ECMQV</a>
+template <class EC, class COFACTOR_OPTION = typename DL_GroupParameters_EC<EC>::DefaultCofactorOption>
+struct ECMQV
+{
+	typedef MQV_Domain<DL_GroupParameters_EC<EC>, COFACTOR_OPTION> Domain;
+};
+
+/// \brief Hashed Elliptic Curve Menezes-Qu-Vanstone
+/// \tparam EC elliptic curve field
+/// \tparam COFACTOR_OPTION cofactor multiplication option
+/// \details This implementation follows Hugo Krawczyk's <a href="http://eprint.iacr.org/2005/176">HMQV: A High-Performance
+///  Secure Diffie-Hellman Protocol</a>. Note: this implements HMQV only. HMQV-C with Key Confirmation is not provided.
+/// \sa CofactorMultiplicationOption
+template <class EC, class COFACTOR_OPTION = typename DL_GroupParameters_EC<EC>::DefaultCofactorOption, class HASH = SHA256>
+struct ECHMQV
+{
+	typedef HMQV_Domain<DL_GroupParameters_EC<EC>, COFACTOR_OPTION, HASH> Domain;
+};
+
+typedef ECHMQV< ECP, DL_GroupParameters_EC< ECP >::DefaultCofactorOption,   SHA1 >::Domain ECHMQV160;
+typedef ECHMQV< ECP, DL_GroupParameters_EC< ECP >::DefaultCofactorOption, SHA256 >::Domain ECHMQV256;
+typedef ECHMQV< ECP, DL_GroupParameters_EC< ECP >::DefaultCofactorOption, SHA384 >::Domain ECHMQV384;
+typedef ECHMQV< ECP, DL_GroupParameters_EC< ECP >::DefaultCofactorOption, SHA512 >::Domain ECHMQV512;
+
+/// \brief Fully Hashed Elliptic Curve Menezes-Qu-Vanstone
+/// \tparam EC elliptic curve field
+/// \tparam COFACTOR_OPTION cofactor multiplication option
+/// \details This implementation follows Augustin P. Sarr and Philippe Elbaz–Vincent, and Jean–Claude Bajard's
+///  <a href="http://eprint.iacr.org/2009/408">A Secure and Efficient Authenticated Diffie-Hellman Protocol</a>.
+///  Note: this is FHMQV, Protocol 5, from page 11; and not FHMQV-C.
+/// \sa CofactorMultiplicationOption
+template <class EC, class COFACTOR_OPTION = typename DL_GroupParameters_EC<EC>::DefaultCofactorOption, class HASH = SHA256>
+struct ECFHMQV
+{
+	typedef FHMQV_Domain<DL_GroupParameters_EC<EC>, COFACTOR_OPTION, HASH> Domain;
+};
+
+typedef ECFHMQV< ECP, DL_GroupParameters_EC< ECP >::DefaultCofactorOption,   SHA1 >::Domain ECFHMQV160;
+typedef ECFHMQV< ECP, DL_GroupParameters_EC< ECP >::DefaultCofactorOption, SHA256 >::Domain ECFHMQV256;
+typedef ECFHMQV< ECP, DL_GroupParameters_EC< ECP >::DefaultCofactorOption, SHA384 >::Domain ECFHMQV384;
+typedef ECFHMQV< ECP, DL_GroupParameters_EC< ECP >::DefaultCofactorOption, SHA512 >::Domain ECFHMQV512;
+
+/// \brief Elliptic Curve Discrete Log (DL) keys
+/// \tparam EC elliptic curve field
+template <class EC>
+struct DL_Keys_EC
+{
+	typedef DL_PublicKey_EC<EC> PublicKey;
+	typedef DL_PrivateKey_EC<EC> PrivateKey;
+};
+
+// Forward declaration; documented below
+template <class EC, class H>
+struct ECDSA;
+
+/// \brief Elliptic Curve DSA keys
+/// \tparam EC elliptic curve field
+/// \since Crypto++ 3.2
+template <class EC>
+struct DL_Keys_ECDSA
+{
+	typedef DL_PublicKey_EC<EC> PublicKey;
+	typedef DL_PrivateKey_WithSignaturePairwiseConsistencyTest<DL_PrivateKey_EC<EC>, ECDSA<EC, SHA256> > PrivateKey;
+};
+
+/// \brief Elliptic Curve DSA (ECDSA) signature algorithm
+/// \tparam EC elliptic curve field
+/// \since Crypto++ 3.2
+template <class EC>
+class DL_Algorithm_ECDSA : public DL_Algorithm_GDSA<typename EC::Point>
+{
+public:
+  CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "ECDSA";}
+};
+
+/// \brief Elliptic Curve DSA (ECDSA) signature algorithm based on RFC 6979
+/// \tparam EC elliptic curve field
+/// \sa <a href="http://tools.ietf.org/rfc/rfc6979.txt">RFC 6979, Deterministic Usage of the
+///  Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)</a>
+/// \since Crypto++ 6.0
+template <class EC, class H>
+class DL_Algorithm_ECDSA_RFC6979 : public DL_Algorithm_DSA_RFC6979<typename EC::Point, H>
+{
+public:
+  CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "ECDSA-RFC6979";}
+};
+
+/// \brief Elliptic Curve NR (ECNR) signature algorithm
+/// \tparam EC elliptic curve field
+template <class EC>
+class DL_Algorithm_ECNR : public DL_Algorithm_NR<typename EC::Point>
+{
+public:
+  CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "ECNR";}
+};
+
+/// \brief Elliptic Curve DSA (ECDSA) signature scheme
+/// \tparam EC elliptic curve field
+/// \tparam H HashTransformation derived class
+/// \sa <a href="http://www.weidai.com/scan-mirror/sig.html#ECDSA">ECDSA</a>
+/// \since Crypto++ 3.2
+template <class EC, class H>
+struct ECDSA : public DL_SS<DL_Keys_ECDSA<EC>, DL_Algorithm_ECDSA<EC>, DL_SignatureMessageEncodingMethod_DSA, H>
+{
+};
+
+/// \brief Elliptic Curve DSA (ECDSA) deterministic signature scheme
+/// \tparam EC elliptic curve field
+/// \tparam H HashTransformation derived class
+/// \sa <a href="http://tools.ietf.org/rfc/rfc6979.txt">Deterministic Usage of the
+///  Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)</a>
+/// \since Crypto++ 6.0
+template <class EC, class H>
+struct ECDSA_RFC6979 : public DL_SS<
+	DL_Keys_ECDSA<EC>,
+	DL_Algorithm_ECDSA_RFC6979<EC, H>,
+	DL_SignatureMessageEncodingMethod_DSA,
+	H,
+	ECDSA_RFC6979<EC,H> >
+{
+	static std::string CRYPTOPP_API StaticAlgorithmName() {return std::string("ECDSA-RFC6979/") + H::StaticAlgorithmName();}
+};
+
+/// \brief Elliptic Curve NR (ECNR) signature scheme
+/// \tparam EC elliptic curve field
+/// \tparam H HashTransformation derived class
+template <class EC, class H = SHA1>
+struct ECNR : public DL_SS<DL_Keys_EC<EC>, DL_Algorithm_ECNR<EC>, DL_SignatureMessageEncodingMethod_NR, H>
+{
+};
+
+// ******************************************
+
+template <class EC>
+class DL_PublicKey_ECGDSA;
+template <class EC>
+class DL_PrivateKey_ECGDSA;
+
+/// \brief Elliptic Curve German DSA key for ISO/IEC 15946
+/// \tparam EC elliptic curve field
+/// \sa ECGDSA
+/// \since Crypto++ 6.0
+template <class EC>
+class DL_PrivateKey_ECGDSA : public DL_PrivateKeyImpl<DL_GroupParameters_EC<EC> >
+{
+public:
+	typedef typename EC::Point Element;
+
+	virtual ~DL_PrivateKey_ECGDSA() {}
+
+	/// \brief Initialize an EC Private Key using {GP,x}
+	/// \param params group parameters
+	/// \param x the private exponent
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	void Initialize(const DL_GroupParameters_EC<EC> &params, const Integer &x)
+	{
+		this->AccessGroupParameters() = params;
+		this->SetPrivateExponent(x);
+		CRYPTOPP_ASSERT(x>=1 && x<=params.GetSubgroupOrder()-1);
+	}
+
+	/// \brief Initialize an EC Private Key using {EC,G,n,x}
+	/// \param ec the elliptic curve
+	/// \param G the base point
+	/// \param n the order of the base point
+	/// \param x the private exponent
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	void Initialize(const EC &ec, const Element &G, const Integer &n, const Integer &x)
+	{
+		this->AccessGroupParameters().Initialize(ec, G, n);
+		this->SetPrivateExponent(x);
+		CRYPTOPP_ASSERT(x>=1 && x<=this->AccessGroupParameters().GetSubgroupOrder()-1);
+	}
+
+	/// \brief Create an EC private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param params the EC group parameters
+	/// \details This function overload of Initialize() creates a new private key because it
+	///  takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+	///  then use one of the other Initialize() overloads.
+	void Initialize(RandomNumberGenerator &rng, const DL_GroupParameters_EC<EC> &params)
+		{this->GenerateRandom(rng, params);}
+
+	/// \brief Create an EC private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param ec the elliptic curve
+	/// \param G the base point
+	/// \param n the order of the base point
+	/// \details This function overload of Initialize() creates a new private key because it
+	///  takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+	///  then use one of the other Initialize() overloads.
+	void Initialize(RandomNumberGenerator &rng, const EC &ec, const Element &G, const Integer &n)
+		{this->GenerateRandom(rng, DL_GroupParameters_EC<EC>(ec, G, n));}
+
+	virtual void MakePublicKey(DL_PublicKey_ECGDSA<EC> &pub) const
+	{
+		const DL_GroupParameters<Element>& params = this->GetAbstractGroupParameters();
+		pub.AccessAbstractGroupParameters().AssignFrom(params);
+		const Integer &xInv = this->GetPrivateExponent().InverseMod(params.GetSubgroupOrder());
+		pub.SetPublicElement(params.ExponentiateBase(xInv));
+		CRYPTOPP_ASSERT(xInv.NotZero());
+	}
+
+	virtual bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+	{
+		return GetValueHelper<DL_PrivateKey_ECGDSA<EC>,
+			DL_PrivateKey_ECGDSA<EC> >(this, name, valueType, pValue).Assignable();
+	}
+
+	virtual void AssignFrom(const NameValuePairs &source)
+	{
+		AssignFromHelper<DL_PrivateKey_ECGDSA<EC>,
+			DL_PrivateKey_ECGDSA<EC> >(this, source);
+	}
+
+	// PKCS8PrivateKey
+	void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
+	void DEREncodePrivateKey(BufferedTransformation &bt) const;
+};
+
+/// \brief Elliptic Curve German DSA key for ISO/IEC 15946
+/// \tparam EC elliptic curve field
+/// \sa ECGDSA
+/// \since Crypto++ 6.0
+template <class EC>
+class DL_PublicKey_ECGDSA : public DL_PublicKeyImpl<DL_GroupParameters_EC<EC> >
+{
+	typedef DL_PublicKey_ECGDSA<EC> ThisClass;
+
+public:
+	typedef typename EC::Point Element;
+
+	virtual ~DL_PublicKey_ECGDSA() {}
+
+	/// \brief Initialize an EC Public Key using {GP,Q}
+	/// \param params group parameters
+	/// \param Q the public point
+	/// \details This Initialize() function overload initializes a public key from existing parameters.
+	void Initialize(const DL_GroupParameters_EC<EC> &params, const Element &Q)
+		{this->AccessGroupParameters() = params; this->SetPublicElement(Q);}
+
+	/// \brief Initialize an EC Public Key using {EC,G,n,Q}
+	/// \param ec the elliptic curve
+	/// \param G the base point
+	/// \param n the order of the base point
+	/// \param Q the public point
+	/// \details This Initialize() function overload initializes a public key from existing parameters.
+	void Initialize(const EC &ec, const Element &G, const Integer &n, const Element &Q)
+		{this->AccessGroupParameters().Initialize(ec, G, n); this->SetPublicElement(Q);}
+
+	virtual void AssignFrom(const NameValuePairs &source)
+	{
+		DL_PrivateKey_ECGDSA<EC> *pPrivateKey = NULLPTR;
+		if (source.GetThisPointer(pPrivateKey))
+			pPrivateKey->MakePublicKey(*this);
+		else
+		{
+			this->AccessAbstractGroupParameters().AssignFrom(source);
+			AssignFromHelper(this, source)
+				CRYPTOPP_SET_FUNCTION_ENTRY(PublicElement);
+		}
+	}
+
+	// DL_PublicKey<T>
+	virtual void SetPublicElement(const Element &y)
+		{this->AccessPublicPrecomputation().SetBase(this->GetAbstractGroupParameters().GetGroupPrecomputation(), y);}
+
+	// X509PublicKey
+	void BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
+	void DEREncodePublicKey(BufferedTransformation &bt) const;
+};
+
+/// \brief Elliptic Curve German DSA keys for ISO/IEC 15946
+/// \tparam EC elliptic curve field
+/// \sa ECGDSA
+/// \since Crypto++ 6.0
+template <class EC>
+struct DL_Keys_ECGDSA
+{
+	typedef DL_PublicKey_ECGDSA<EC> PublicKey;
+	typedef DL_PrivateKey_ECGDSA<EC> PrivateKey;
+};
+
+/// \brief Elliptic Curve German DSA signature algorithm
+/// \tparam EC elliptic curve field
+/// \sa ECGDSA
+/// \since Crypto++ 6.0
+template <class EC>
+class DL_Algorithm_ECGDSA : public DL_Algorithm_GDSA_ISO15946<typename EC::Point>
+{
+public:
+  CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "ECGDSA";}
+};
+
+/// \brief Elliptic Curve German Digital Signature Algorithm signature scheme
+/// \tparam EC elliptic curve field
+/// \tparam H HashTransformation derived class
+/// \sa Erwin Hess, Marcus Schafheutle, and Pascale Serf <A
+///  HREF="http://www.teletrust.de/fileadmin/files/oid/ecgdsa_final.pdf">The Digital Signature Scheme
+///  ECGDSA (October 24, 2006)</A>
+/// \since Crypto++ 6.0
+template <class EC, class H>
+struct ECGDSA : public DL_SS<
+	DL_Keys_ECGDSA<EC>,
+	DL_Algorithm_ECGDSA<EC>,
+	DL_SignatureMessageEncodingMethod_DSA,
+	H>
+{
+	static std::string CRYPTOPP_API StaticAlgorithmName() {return std::string("ECGDSA-ISO15946/") + H::StaticAlgorithmName();}
+};
+
+// ******************************************
+
+/// \brief Elliptic Curve Integrated Encryption Scheme
+/// \tparam COFACTOR_OPTION cofactor multiplication option
+/// \tparam HASH HashTransformation derived class used for key derivation and MAC computation
+/// \tparam DHAES_MODE flag indicating if the MAC includes additional context parameters such as <em>u·V</em>, <em>v·U</em> and label
+/// \tparam LABEL_OCTETS flag indicating if the label size is specified in octets or bits
+/// \details ECIES is an Elliptic Curve based Integrated Encryption Scheme (IES). The scheme combines a Key Encapsulation
+///  Method (KEM) with a Data Encapsulation Method (DEM) and a MAC tag. The scheme is
+///  <A HREF="http://en.wikipedia.org/wiki/ciphertext_indistinguishability">IND-CCA2</A>, which is a strong notion of security.
+///  You should prefer an Integrated Encryption Scheme over homegrown schemes.
+/// \details If you desire an Integrated Encryption Scheme with Crypto++ 4.2 compatibility, then use the ECIES_P1363.
+///  If you desire an Integrated Encryption Scheme compatible with Bouncy Castle 1.54 and Botan 1.11 compatibility, then use the ECIES
+///  template class with <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=true</tt> and <tt>LABEL_OCTETS=false</tt>.
+/// \details The default template parameters ensure compatibility with Bouncy Castle 1.54 and Botan 1.11. The combination of
+///  <tt>IncompatibleCofactorMultiplication</tt> and <tt>DHAES_MODE=true</tt> is recommended for best efficiency and security.
+///  SHA1 is used for compatibility reasons, but it can be changed if desired.
+/// \sa DLIES, ECIES_P1363, <a href="http://www.weidai.com/scan-mirror/ca.html#ECIES">Elliptic Curve Integrated Encryption Scheme (ECIES)</a>,
+///  Martínez, Encinas, and Ávila's <A HREF="http://digital.csic.es/bitstream/10261/32671/1/V2-I2-P7-13.pdf">A Survey of the Elliptic
+///  Curve Integrated Encryption Schemes</A>
+/// \since Crypto++ 4.0, Crypto++ 5.7 for Bouncy Castle and Botan compatibility
+template <class EC, class HASH = SHA1, class COFACTOR_OPTION = NoCofactorMultiplication, bool DHAES_MODE = true, bool LABEL_OCTETS = false>
+struct ECIES
+	: public DL_ES<
+		DL_Keys_EC<EC>,
+		DL_KeyAgreementAlgorithm_DH<typename EC::Point, COFACTOR_OPTION>,
+		DL_KeyDerivationAlgorithm_P1363<typename EC::Point, DHAES_MODE, P1363_KDF2<HASH> >,
+		DL_EncryptionAlgorithm_Xor<HMAC<HASH>, DHAES_MODE, LABEL_OCTETS>,
+		ECIES<EC> >
+{
+	// TODO: fix this after name is standardized
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "ECIES";}
+};
+
+/// \brief Elliptic Curve Integrated Encryption Scheme for P1363
+/// \tparam COFACTOR_OPTION cofactor multiplication option
+/// \tparam HASH HashTransformation derived class used for key derivation and MAC computation
+/// \details ECIES_P1363 is an Elliptic Curve based Integrated Encryption Scheme (IES) for P1363. The scheme combines a Key Encapsulation
+///  Method (KEM) with a Data Encapsulation Method (DEM) and a MAC tag. The scheme is
+///  <A HREF="http://en.wikipedia.org/wiki/ciphertext_indistinguishability">IND-CCA2</A>, which is a strong notion of security.
+///  You should prefer an Integrated Encryption Scheme over homegrown schemes.
+/// \details The library's original implementation is based on an early P1363 draft, which itself appears to be based on an early Certicom
+///  SEC-1 draft (or an early SEC-1 draft was based on a P1363 draft). Crypto++ 4.2 used the early draft in its Integrated Enryption
+///  Schemes with <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=false</tt> and <tt>LABEL_OCTETS=true</tt>.
+/// \details If you desire an Integrated Encryption Scheme with Crypto++ 4.2 compatibility, then use the ECIES_P1363.
+///  If you desire an Integrated Encryption Scheme compatible with Bouncy Castle 1.54 and Botan 1.11 compatibility, then use the ECIES
+///  template class with <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=true</tt> and <tt>LABEL_OCTETS=false</tt>.
+/// \details The default template parameters ensure compatibility with P1363. The combination of
+///  <tt>IncompatibleCofactorMultiplication</tt> and <tt>DHAES_MODE=true</tt> is recommended for best efficiency and security.
+///  SHA1 is used for compatibility reasons, but it can be changed if desired.
+/// \sa DLIES, ECIES, <a href="http://www.weidai.com/scan-mirror/ca.html#ECIES">Elliptic Curve Integrated Encryption Scheme (ECIES)</a>,
+///  Martínez, Encinas, and Ávila's <A HREF="http://digital.csic.es/bitstream/10261/32671/1/V2-I2-P7-13.pdf">A Survey of the Elliptic
+///  Curve Integrated Encryption Schemes</A>
+/// \since Crypto++ 4.0
+template <class EC, class HASH = SHA1, class COFACTOR_OPTION = NoCofactorMultiplication>
+struct ECIES_P1363
+	: public DL_ES<
+		DL_Keys_EC<EC>,
+		DL_KeyAgreementAlgorithm_DH<typename EC::Point, COFACTOR_OPTION>,
+		DL_KeyDerivationAlgorithm_P1363<typename EC::Point, false, P1363_KDF2<HASH> >,
+		DL_EncryptionAlgorithm_Xor<HMAC<HASH>, false, true>,
+		ECIES<EC> >
+{
+	// TODO: fix this after name is standardized
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "ECIES-P1363";}
+};
+
+NAMESPACE_END
+
+#ifdef CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES
+#include "eccrypto.cpp"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_GroupParameters_EC<ECP>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_GroupParameters_EC<EC2N>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PublicKeyImpl<DL_GroupParameters_EC<ECP> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PublicKeyImpl<DL_GroupParameters_EC<EC2N> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PublicKey_EC<ECP>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PublicKey_EC<EC2N>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PublicKey_ECGDSA<ECP>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PublicKey_ECGDSA<EC2N>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKeyImpl<DL_GroupParameters_EC<ECP> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKeyImpl<DL_GroupParameters_EC<EC2N> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_EC<ECP>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_EC<EC2N>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_ECGDSA<ECP>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_ECGDSA<EC2N>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_GDSA<ECP::Point>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_GDSA<EC2N::Point>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_WithSignaturePairwiseConsistencyTest<DL_PrivateKey_EC<ECP>, ECDSA<ECP, SHA256> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_WithSignaturePairwiseConsistencyTest<DL_PrivateKey_EC<EC2N>, ECDSA<EC2N, SHA256> >;
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/ecp.cpp b/runtime/third_party/cryptopp/ecp.cpp
new file mode 100644
index 0000000..f8ba60f
--- /dev/null
+++ b/runtime/third_party/cryptopp/ecp.cpp
@@ -0,0 +1,506 @@
+// ecp.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "ecp.h"
+#include "asn.h"
+#include "integer.h"
+#include "nbtheory.h"
+#include "modarith.h"
+#include "filters.h"
+#include "algebra.cpp"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::ECP;
+using CryptoPP::Integer;
+using CryptoPP::ModularArithmetic;
+
+#if defined(HAVE_GCC_INIT_PRIORITY)
+	#define INIT_ATTRIBUTE __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 50)))
+	const ECP::Point g_identity INIT_ATTRIBUTE = ECP::Point();
+#elif defined(HAVE_MSC_INIT_PRIORITY)
+	#pragma warning(disable: 4075)
+	#pragma init_seg(".CRT$XCU")
+	const ECP::Point g_identity;
+	#pragma warning(default: 4075)
+#elif defined(HAVE_XLC_INIT_PRIORITY)
+	#pragma priority(290)
+	const ECP::Point g_identity;
+#endif
+
+inline ECP::Point ToMontgomery(const ModularArithmetic &mr, const ECP::Point &P)
+{
+	return P.identity ? P : ECP::Point(mr.ConvertIn(P.x), mr.ConvertIn(P.y));
+}
+
+inline ECP::Point FromMontgomery(const ModularArithmetic &mr, const ECP::Point &P)
+{
+	return P.identity ? P : ECP::Point(mr.ConvertOut(P.x), mr.ConvertOut(P.y));
+}
+
+inline Integer IdentityToInteger(bool val)
+{
+	return val ? Integer::One() : Integer::Zero();
+}
+
+struct ProjectivePoint
+{
+	ProjectivePoint() {}
+	ProjectivePoint(const Integer &x, const Integer &y, const Integer &z)
+		: x(x), y(y), z(z)	{}
+
+	Integer x, y, z;
+};
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+ECP::ECP(const ECP &ecp, bool convertToMontgomeryRepresentation)
+{
+	if (convertToMontgomeryRepresentation && !ecp.GetField().IsMontgomeryRepresentation())
+	{
+		m_fieldPtr.reset(new MontgomeryRepresentation(ecp.GetField().GetModulus()));
+		m_a = GetField().ConvertIn(ecp.m_a);
+		m_b = GetField().ConvertIn(ecp.m_b);
+	}
+	else
+		operator=(ecp);
+}
+
+ECP::ECP(BufferedTransformation &bt)
+	: m_fieldPtr(new Field(bt))
+{
+	BERSequenceDecoder seq(bt);
+	GetField().BERDecodeElement(seq, m_a);
+	GetField().BERDecodeElement(seq, m_b);
+	// skip optional seed
+	if (!seq.EndReached())
+	{
+		SecByteBlock seed;
+		unsigned int unused;
+		BERDecodeBitString(seq, seed, unused);
+	}
+	seq.MessageEnd();
+}
+
+void ECP::DEREncode(BufferedTransformation &bt) const
+{
+	GetField().DEREncode(bt);
+	DERSequenceEncoder seq(bt);
+	GetField().DEREncodeElement(seq, m_a);
+	GetField().DEREncodeElement(seq, m_b);
+	seq.MessageEnd();
+}
+
+bool ECP::DecodePoint(ECP::Point &P, const byte *encodedPoint, size_t encodedPointLen) const
+{
+	StringStore store(encodedPoint, encodedPointLen);
+	return DecodePoint(P, store, encodedPointLen);
+}
+
+bool ECP::DecodePoint(ECP::Point &P, BufferedTransformation &bt, size_t encodedPointLen) const
+{
+	byte type;
+	if (encodedPointLen < 1 || !bt.Get(type))
+		return false;
+
+	switch (type)
+	{
+	case 0:
+		P.identity = true;
+		return true;
+	case 2:
+	case 3:
+	{
+		if (encodedPointLen != EncodedPointSize(true))
+			return false;
+
+		Integer p = FieldSize();
+
+		P.identity = false;
+		P.x.Decode(bt, GetField().MaxElementByteLength());
+		P.y = ((P.x*P.x+m_a)*P.x+m_b) % p;
+
+		if (Jacobi(P.y, p) !=1)
+			return false;
+
+		P.y = ModularSquareRoot(P.y, p);
+
+		if ((type & 1) != P.y.GetBit(0))
+			P.y = p-P.y;
+
+		return true;
+	}
+	case 4:
+	{
+		if (encodedPointLen != EncodedPointSize(false))
+			return false;
+
+		unsigned int len = GetField().MaxElementByteLength();
+		P.identity = false;
+		P.x.Decode(bt, len);
+		P.y.Decode(bt, len);
+		return true;
+	}
+	default:
+		return false;
+	}
+}
+
+void ECP::EncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const
+{
+	if (P.identity)
+		NullStore().TransferTo(bt, EncodedPointSize(compressed));
+	else if (compressed)
+	{
+		bt.Put((byte)(2U + P.y.GetBit(0)));
+		P.x.Encode(bt, GetField().MaxElementByteLength());
+	}
+	else
+	{
+		unsigned int len = GetField().MaxElementByteLength();
+		bt.Put(4U);	// uncompressed
+		P.x.Encode(bt, len);
+		P.y.Encode(bt, len);
+	}
+}
+
+void ECP::EncodePoint(byte *encodedPoint, const Point &P, bool compressed) const
+{
+	ArraySink sink(encodedPoint, EncodedPointSize(compressed));
+	EncodePoint(sink, P, compressed);
+	CRYPTOPP_ASSERT(sink.TotalPutLength() == EncodedPointSize(compressed));
+}
+
+ECP::Point ECP::BERDecodePoint(BufferedTransformation &bt) const
+{
+	SecByteBlock str;
+	BERDecodeOctetString(bt, str);
+	Point P;
+	if (!DecodePoint(P, str, str.size()))
+		BERDecodeError();
+	return P;
+}
+
+void ECP::DEREncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const
+{
+	SecByteBlock str(EncodedPointSize(compressed));
+	EncodePoint(str, P, compressed);
+	DEREncodeOctetString(bt, str);
+}
+
+bool ECP::ValidateParameters(RandomNumberGenerator &rng, unsigned int level) const
+{
+	Integer p = FieldSize();
+
+	bool pass = p.IsOdd();
+	pass = pass && !m_a.IsNegative() && m_a<p && !m_b.IsNegative() && m_b<p;
+
+	if (level >= 1)
+		pass = pass && ((4*m_a*m_a*m_a+27*m_b*m_b)%p).IsPositive();
+
+	if (level >= 2)
+		pass = pass && VerifyPrime(rng, p);
+
+	return pass;
+}
+
+bool ECP::VerifyPoint(const Point &P) const
+{
+	const FieldElement &x = P.x, &y = P.y;
+	Integer p = FieldSize();
+	return P.identity ||
+		(!x.IsNegative() && x<p && !y.IsNegative() && y<p
+		&& !(((x*x+m_a)*x+m_b-y*y)%p));
+}
+
+bool ECP::Equal(const Point &P, const Point &Q) const
+{
+	if (P.identity && Q.identity)
+		return true;
+
+	if (P.identity && !Q.identity)
+		return false;
+
+	if (!P.identity && Q.identity)
+		return false;
+
+	return (GetField().Equal(P.x,Q.x) && GetField().Equal(P.y,Q.y));
+}
+
+const ECP::Point& ECP::Identity() const
+{
+#if defined(HAVE_GCC_INIT_PRIORITY) || defined(HAVE_MSC_INIT_PRIORITY) || defined(HAVE_XLC_INIT_PRIORITY)
+	return g_identity;
+#elif defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static const ECP::Point g_identity;
+	return g_identity;
+#else
+	return Singleton<Point>().Ref();
+#endif
+}
+
+const ECP::Point& ECP::Inverse(const Point &P) const
+{
+	if (P.identity)
+		return P;
+	else
+	{
+		m_R.identity = false;
+		m_R.x = P.x;
+		m_R.y = GetField().Inverse(P.y);
+		return m_R;
+	}
+}
+
+const ECP::Point& ECP::Add(const Point &P, const Point &Q) const
+{
+	if (P.identity) return Q;
+	if (Q.identity) return P;
+	if (GetField().Equal(P.x, Q.x))
+		return GetField().Equal(P.y, Q.y) ? Double(P) : Identity();
+
+	FieldElement t = GetField().Subtract(Q.y, P.y);
+	t = GetField().Divide(t, GetField().Subtract(Q.x, P.x));
+	FieldElement x = GetField().Subtract(GetField().Subtract(GetField().Square(t), P.x), Q.x);
+	m_R.y = GetField().Subtract(GetField().Multiply(t, GetField().Subtract(P.x, x)), P.y);
+
+	m_R.x.swap(x);
+	m_R.identity = false;
+	return m_R;
+}
+
+const ECP::Point& ECP::Double(const Point &P) const
+{
+	if (P.identity || P.y==GetField().Identity()) return Identity();
+
+	FieldElement t = GetField().Square(P.x);
+	t = GetField().Add(GetField().Add(GetField().Double(t), t), m_a);
+	t = GetField().Divide(t, GetField().Double(P.y));
+	FieldElement x = GetField().Subtract(GetField().Subtract(GetField().Square(t), P.x), P.x);
+	m_R.y = GetField().Subtract(GetField().Multiply(t, GetField().Subtract(P.x, x)), P.y);
+
+	m_R.x.swap(x);
+	m_R.identity = false;
+	return m_R;
+}
+
+template <class T, class Iterator> void ParallelInvert(const AbstractRing<T> &ring, Iterator begin, Iterator end)
+{
+	size_t n = end-begin;
+	if (n == 1)
+		*begin = ring.MultiplicativeInverse(*begin);
+	else if (n > 1)
+	{
+		std::vector<T> vec((n+1)/2);
+		unsigned int i;
+		Iterator it;
+
+		for (i=0, it=begin; i<n/2; i++, it+=2)
+			vec[i] = ring.Multiply(*it, *(it+1));
+		if (n%2 == 1)
+			vec[n/2] = *it;
+
+		ParallelInvert(ring, vec.begin(), vec.end());
+
+		for (i=0, it=begin; i<n/2; i++, it+=2)
+		{
+			if (!vec[i])
+			{
+				*it = ring.MultiplicativeInverse(*it);
+				*(it+1) = ring.MultiplicativeInverse(*(it+1));
+			}
+			else
+			{
+				std::swap(*it, *(it+1));
+				*it = ring.Multiply(*it, vec[i]);
+				*(it+1) = ring.Multiply(*(it+1), vec[i]);
+			}
+		}
+		if (n%2 == 1)
+			*it = vec[n/2];
+	}
+}
+
+class ProjectiveDoubling
+{
+public:
+	ProjectiveDoubling(const ModularArithmetic &m_mr, const Integer &m_a, const Integer &m_b, const ECPPoint &Q)
+		: mr(m_mr)
+	{
+		CRYPTOPP_UNUSED(m_b);
+		if (Q.identity)
+		{
+			sixteenY4 = P.x = P.y = mr.MultiplicativeIdentity();
+			aZ4 = P.z = mr.Identity();
+		}
+		else
+		{
+			P.x = Q.x;
+			P.y = Q.y;
+			sixteenY4 = P.z = mr.MultiplicativeIdentity();
+			aZ4 = m_a;
+		}
+	}
+
+	void Double()
+	{
+		twoY = mr.Double(P.y);
+		P.z = mr.Multiply(P.z, twoY);
+		fourY2 = mr.Square(twoY);
+		S = mr.Multiply(fourY2, P.x);
+		aZ4 = mr.Multiply(aZ4, sixteenY4);
+		M = mr.Square(P.x);
+		M = mr.Add(mr.Add(mr.Double(M), M), aZ4);
+		P.x = mr.Square(M);
+		mr.Reduce(P.x, S);
+		mr.Reduce(P.x, S);
+		mr.Reduce(S, P.x);
+		P.y = mr.Multiply(M, S);
+		sixteenY4 = mr.Square(fourY2);
+		mr.Reduce(P.y, mr.Half(sixteenY4));
+	}
+
+	const ModularArithmetic &mr;
+	ProjectivePoint P;
+	Integer sixteenY4, aZ4, twoY, fourY2, S, M;
+};
+
+struct ZIterator
+{
+	ZIterator() {}
+	ZIterator(std::vector<ProjectivePoint>::iterator it) : it(it) {}
+	Integer& operator*() {return it->z;}
+	int operator-(ZIterator it2) {return int(it-it2.it);}
+	ZIterator operator+(int i) {return ZIterator(it+i);}
+	ZIterator& operator+=(int i) {it+=i; return *this;}
+	std::vector<ProjectivePoint>::iterator it;
+};
+
+ECP::Point ECP::ScalarMultiply(const Point &P, const Integer &k) const
+{
+	Element result;
+	if (k.BitCount() <= 5)
+		AbstractGroup<ECPPoint>::SimultaneousMultiply(&result, P, &k, 1);
+	else
+		ECP::SimultaneousMultiply(&result, P, &k, 1);
+	return result;
+}
+
+void ECP::SimultaneousMultiply(ECP::Point *results, const ECP::Point &P, const Integer *expBegin, unsigned int expCount) const
+{
+	if (!GetField().IsMontgomeryRepresentation())
+	{
+		ECP ecpmr(*this, true);
+		const ModularArithmetic &mr = ecpmr.GetField();
+		ecpmr.SimultaneousMultiply(results, ToMontgomery(mr, P), expBegin, expCount);
+		for (unsigned int i=0; i<expCount; i++)
+			results[i] = FromMontgomery(mr, results[i]);
+		return;
+	}
+
+	ProjectiveDoubling rd(GetField(), m_a, m_b, P);
+	std::vector<ProjectivePoint> bases;
+	std::vector<WindowSlider> exponents;
+	exponents.reserve(expCount);
+	std::vector<std::vector<word32> > baseIndices(expCount);
+	std::vector<std::vector<bool> > negateBase(expCount);
+	std::vector<std::vector<word32> > exponentWindows(expCount);
+	unsigned int i;
+
+	for (i=0; i<expCount; i++)
+	{
+		CRYPTOPP_ASSERT(expBegin->NotNegative());
+		exponents.push_back(WindowSlider(*expBegin++, InversionIsFast(), 5));
+		exponents[i].FindNextWindow();
+	}
+
+	unsigned int expBitPosition = 0;
+	bool notDone = true;
+
+	while (notDone)
+	{
+		notDone = false;
+		bool baseAdded = false;
+		for (i=0; i<expCount; i++)
+		{
+			if (!exponents[i].finished && expBitPosition == exponents[i].windowBegin)
+			{
+				if (!baseAdded)
+				{
+					bases.push_back(rd.P);
+					baseAdded =true;
+				}
+
+				exponentWindows[i].push_back(exponents[i].expWindow);
+				baseIndices[i].push_back((word32)bases.size()-1);
+				negateBase[i].push_back(exponents[i].negateNext);
+
+				exponents[i].FindNextWindow();
+			}
+			notDone = notDone || !exponents[i].finished;
+		}
+
+		if (notDone)
+		{
+			rd.Double();
+			expBitPosition++;
+		}
+	}
+
+	// convert from projective to affine coordinates
+	ParallelInvert(GetField(), ZIterator(bases.begin()), ZIterator(bases.end()));
+	for (i=0; i<bases.size(); i++)
+	{
+		if (bases[i].z.NotZero())
+		{
+			bases[i].y = GetField().Multiply(bases[i].y, bases[i].z);
+			bases[i].z = GetField().Square(bases[i].z);
+			bases[i].x = GetField().Multiply(bases[i].x, bases[i].z);
+			bases[i].y = GetField().Multiply(bases[i].y, bases[i].z);
+		}
+	}
+
+	std::vector<BaseAndExponent<Point, Integer> > finalCascade;
+	for (i=0; i<expCount; i++)
+	{
+		finalCascade.resize(baseIndices[i].size());
+		for (unsigned int j=0; j<baseIndices[i].size(); j++)
+		{
+			ProjectivePoint &base = bases[baseIndices[i][j]];
+			if (base.z.IsZero())
+				finalCascade[j].base.identity = true;
+			else
+			{
+				finalCascade[j].base.identity = false;
+				finalCascade[j].base.x = base.x;
+				if (negateBase[i][j])
+					finalCascade[j].base.y = GetField().Inverse(base.y);
+				else
+					finalCascade[j].base.y = base.y;
+			}
+			finalCascade[j].exponent = Integer(Integer::POSITIVE, 0, exponentWindows[i][j]);
+		}
+		results[i] = GeneralCascadeMultiplication(*this, finalCascade.begin(), finalCascade.end());
+	}
+}
+
+ECP::Point ECP::CascadeScalarMultiply(const Point &P, const Integer &k1, const Point &Q, const Integer &k2) const
+{
+	if (!GetField().IsMontgomeryRepresentation())
+	{
+		ECP ecpmr(*this, true);
+		const ModularArithmetic &mr = ecpmr.GetField();
+		return FromMontgomery(mr, ecpmr.CascadeScalarMultiply(ToMontgomery(mr, P), k1, ToMontgomery(mr, Q), k2));
+	}
+	else
+		return AbstractGroup<Point>::CascadeScalarMultiply(P, k1, Q, k2);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/ecp.h b/runtime/third_party/cryptopp/ecp.h
new file mode 100644
index 0000000..28929d0
--- /dev/null
+++ b/runtime/third_party/cryptopp/ecp.h
@@ -0,0 +1,167 @@
+// ecp.h - originally written and placed in the public domain by Wei Dai
+
+/// \file ecp.h
+/// \brief Classes for Elliptic Curves over prime fields
+
+#ifndef CRYPTOPP_ECP_H
+#define CRYPTOPP_ECP_H
+
+#include "cryptlib.h"
+#include "integer.h"
+#include "algebra.h"
+#include "modarith.h"
+#include "ecpoint.h"
+#include "eprecomp.h"
+#include "smartptr.h"
+#include "pubkey.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4231 4275)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Elliptic Curve over GF(p), where p is prime
+class CRYPTOPP_DLL ECP : public AbstractGroup<ECPPoint>, public EncodedPoint<ECPPoint>
+{
+public:
+	typedef ModularArithmetic Field;
+	typedef Integer FieldElement;
+	typedef ECPPoint Point;
+
+	virtual ~ECP() {}
+
+	/// \brief Construct an ECP
+	ECP() {}
+
+	/// \brief Construct an ECP
+	/// \param ecp the other ECP object
+	/// \param convertToMontgomeryRepresentation flag indicating if the curve
+	///  should be converted to a MontgomeryRepresentation.
+	/// \details Prior to Crypto++ 8.3 the default value for
+	///  convertToMontgomeryRepresentation was false. it was changed due to
+	///  two audit tools finding, "Signature-compatible with a copy constructor".
+	/// \sa ModularArithmetic, MontgomeryRepresentation
+	ECP(const ECP &ecp, bool convertToMontgomeryRepresentation);
+
+	/// \brief Construct an ECP
+	/// \param modulus the prime modulus
+	/// \param a Field::Element
+	/// \param b Field::Element
+	ECP(const Integer &modulus, const FieldElement &a, const FieldElement &b)
+		: m_fieldPtr(new Field(modulus)), m_a(a.IsNegative() ? modulus+a : a), m_b(b) {}
+
+	/// \brief Construct an ECP from BER encoded parameters
+	/// \param bt BufferedTransformation derived object
+	/// \details This constructor will decode and extract the fields
+	///  fieldID and curve of the sequence ECParameters
+	ECP(BufferedTransformation &bt);
+
+	/// \brief DER Encode
+	/// \param bt BufferedTransformation derived object
+	/// \details DEREncode encode the fields fieldID and curve of the sequence
+	///  ECParameters
+	void DEREncode(BufferedTransformation &bt) const;
+
+	/// \brief Compare two points
+	/// \param P the first point
+	/// \param Q the second point
+	/// \return true if equal, false otherwise
+	bool Equal(const Point &P, const Point &Q) const;
+
+	const Point& Identity() const;
+	const Point& Inverse(const Point &P) const;
+	bool InversionIsFast() const {return true;}
+	const Point& Add(const Point &P, const Point &Q) const;
+	const Point& Double(const Point &P) const;
+	Point ScalarMultiply(const Point &P, const Integer &k) const;
+	Point CascadeScalarMultiply(const Point &P, const Integer &k1, const Point &Q, const Integer &k2) const;
+	void SimultaneousMultiply(Point *results, const Point &base, const Integer *exponents, unsigned int exponentsCount) const;
+
+	Point Multiply(const Integer &k, const Point &P) const
+		{return ScalarMultiply(P, k);}
+	Point CascadeMultiply(const Integer &k1, const Point &P, const Integer &k2, const Point &Q) const
+		{return CascadeScalarMultiply(P, k1, Q, k2);}
+
+	bool ValidateParameters(RandomNumberGenerator &rng, unsigned int level=3) const;
+	bool VerifyPoint(const Point &P) const;
+
+	unsigned int EncodedPointSize(bool compressed = false) const
+		{return 1 + (compressed?1:2)*GetField().MaxElementByteLength();}
+	// returns false if point is compressed and not valid (doesn't check if uncompressed)
+	bool DecodePoint(Point &P, BufferedTransformation &bt, size_t len) const;
+	bool DecodePoint(Point &P, const byte *encodedPoint, size_t len) const;
+	void EncodePoint(byte *encodedPoint, const Point &P, bool compressed) const;
+	void EncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const;
+
+	Point BERDecodePoint(BufferedTransformation &bt) const;
+	void DEREncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const;
+
+	Integer FieldSize() const {return GetField().GetModulus();}
+	const Field & GetField() const {return *m_fieldPtr;}
+	const FieldElement & GetA() const {return m_a;}
+	const FieldElement & GetB() const {return m_b;}
+
+	bool operator==(const ECP &rhs) const
+		{return GetField() == rhs.GetField() && m_a == rhs.m_a && m_b == rhs.m_b;}
+
+private:
+	clonable_ptr<Field> m_fieldPtr;
+	FieldElement m_a, m_b;
+	mutable Point m_R;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_FixedBasePrecomputationImpl<ECP::Point>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_GroupPrecomputation<ECP::Point>;
+
+/// \brief Elliptic Curve precomputation
+/// \tparam EC elliptic curve field
+template <class EC> class EcPrecomputation;
+
+/// \brief ECP precomputation specialization
+/// \details Implementation of <tt>DL_GroupPrecomputation<ECP::Point></tt> with input and output
+///   conversions for Montgomery modular multiplication.
+/// \sa DL_GroupPrecomputation, ModularArithmetic, MontgomeryRepresentation
+template<> class EcPrecomputation<ECP> : public DL_GroupPrecomputation<ECP::Point>
+{
+public:
+	typedef ECP EllipticCurve;
+
+	virtual ~EcPrecomputation() {}
+
+	// DL_GroupPrecomputation
+	bool NeedConversions() const {return true;}
+	Element ConvertIn(const Element &P) const
+		{return P.identity ? P : ECP::Point(m_ec->GetField().ConvertIn(P.x), m_ec->GetField().ConvertIn(P.y));};
+	Element ConvertOut(const Element &P) const
+		{return P.identity ? P : ECP::Point(m_ec->GetField().ConvertOut(P.x), m_ec->GetField().ConvertOut(P.y));}
+	const AbstractGroup<Element> & GetGroup() const {return *m_ec;}
+	Element BERDecodeElement(BufferedTransformation &bt) const {return m_ec->BERDecodePoint(bt);}
+	void DEREncodeElement(BufferedTransformation &bt, const Element &v) const {m_ec->DEREncodePoint(bt, v, false);}
+
+	/// \brief Set the elliptic curve
+	/// \param ec ECP derived class
+	/// \details SetCurve() is not inherited
+	void SetCurve(const ECP &ec)
+	{
+		m_ec.reset(new ECP(ec, true));
+		m_ecOriginal = ec;
+	}
+
+	/// \brief Get the elliptic curve
+	/// \return ECP curve
+	/// \details GetCurve() is not inherited
+	const ECP & GetCurve() const {return *m_ecOriginal;}
+
+private:
+	value_ptr<ECP> m_ec, m_ecOriginal;
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/ecpoint.h b/runtime/third_party/cryptopp/ecpoint.h
new file mode 100644
index 0000000..2be93bc
--- /dev/null
+++ b/runtime/third_party/cryptopp/ecpoint.h
@@ -0,0 +1,146 @@
+// ecpoint.h - written and placed in the public domain by Jeffrey Walton
+//             Data structures moved from ecp.h and ec2n.h. Added EncodedPoint interface
+
+/// \file ecpoint.h
+/// \brief Classes for Elliptic Curve points
+/// \since Crypto++ 6.0
+
+#ifndef CRYPTOPP_ECPOINT_H
+#define CRYPTOPP_ECPOINT_H
+
+#include "cryptlib.h"
+#include "integer.h"
+#include "algebra.h"
+#include "gf2n.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Elliptical Curve Point over GF(p), where p is prime
+/// \since Crypto++ 2.0
+struct CRYPTOPP_DLL ECPPoint
+{
+	virtual ~ECPPoint() {}
+
+	/// \brief Construct an ECPPoint
+	/// \details identity is set to <tt>true</tt>
+	ECPPoint() : identity(true) {}
+
+	/// \brief Construct an ECPPoint from coordinates
+	/// \details identity is set to <tt>false</tt>
+	ECPPoint(const Integer &x, const Integer &y)
+		: x(x), y(y), identity(false) {}
+
+	/// \brief Tests points for equality
+	/// \param t the other point
+	/// \return true if the points are equal, false otherwise
+	bool operator==(const ECPPoint &t) const
+		{return (identity && t.identity) || (!identity && !t.identity && x==t.x && y==t.y);}
+
+	/// \brief Tests points for ordering
+	/// \param t the other point
+	/// \return true if this point is less than other, false otherwise
+	bool operator< (const ECPPoint &t) const
+		{return identity ? !t.identity : (!t.identity && (x<t.x || (x==t.x && y<t.y)));}
+
+	Integer x, y;
+	bool identity;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS AbstractGroup<ECPPoint>;
+
+/// \brief Elliptical Curve Point over GF(2^n)
+/// \since Crypto++ 2.0
+struct CRYPTOPP_DLL EC2NPoint
+{
+	virtual ~EC2NPoint() {}
+
+	/// \brief Construct an EC2NPoint
+	/// \details identity is set to <tt>true</tt>
+	EC2NPoint() : identity(true) {}
+
+	/// \brief Construct an EC2NPoint from coordinates
+	/// \details identity is set to <tt>false</tt>
+	EC2NPoint(const PolynomialMod2 &x, const PolynomialMod2 &y)
+		: x(x), y(y), identity(false) {}
+
+	/// \brief Tests points for equality
+	/// \param t the other point
+	/// \return true if the points are equal, false otherwise
+	bool operator==(const EC2NPoint &t) const
+		{return (identity && t.identity) || (!identity && !t.identity && x==t.x && y==t.y);}
+
+	/// \brief Tests points for ordering
+	/// \param t the other point
+	/// \return true if this point is less than other, false otherwise
+	bool operator< (const EC2NPoint &t) const
+		{return identity ? !t.identity : (!t.identity && (x<t.x || (x==t.x && y<t.y)));}
+
+	PolynomialMod2 x, y;
+	bool identity;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS AbstractGroup<EC2NPoint>;
+
+/// \brief Abstract class for encoding and decoding ellicptic curve points
+/// \tparam Point ellicptic curve point
+/// \details EncodedPoint is an interface for encoding and decoding elliptic curve points.
+///   The template parameter <tt>Point</tt> should be a class like ECP or EC2N.
+/// \since Crypto++ 6.0
+template <class Point>
+class EncodedPoint
+{
+public:
+	virtual ~EncodedPoint() {}
+
+	/// \brief Decodes an elliptic curve point
+	/// \param P point which is decoded
+	/// \param bt source BufferedTransformation
+	/// \param len number of bytes to read from the BufferedTransformation
+	/// \return true if a point was decoded, false otherwise
+	virtual bool DecodePoint(Point &P, BufferedTransformation &bt, size_t len) const =0;
+
+	/// \brief Decodes an elliptic curve point
+	/// \param P point which is decoded
+	/// \param encodedPoint byte array with the encoded point
+	/// \param len the size of the array
+	/// \return true if a point was decoded, false otherwise
+	virtual bool DecodePoint(Point &P, const byte *encodedPoint, size_t len) const =0;
+
+	/// \brief Verifies points on elliptic curve
+	/// \param P point to verify
+	/// \return true if the point is valid, false otherwise
+	virtual bool VerifyPoint(const Point &P) const =0;
+
+	/// \brief Determines encoded point size
+	/// \param compressed flag indicating if the point is compressed
+	/// \return the minimum number of bytes required to encode the point
+	virtual unsigned int EncodedPointSize(bool compressed = false) const =0;
+
+	/// \brief Encodes an elliptic curve point
+	/// \param P point which is decoded
+	/// \param encodedPoint byte array for the encoded point
+	/// \param compressed flag indicating if the point is compressed
+	/// \details <tt>encodedPoint</tt> must be at least EncodedPointSize() in length
+	virtual void EncodePoint(byte *encodedPoint, const Point &P, bool compressed) const =0;
+
+	/// \brief Encodes an elliptic curve point
+	/// \param bt target BufferedTransformation
+	/// \param P point which is encoded
+	/// \param compressed flag indicating if the point is compressed
+	virtual void EncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const =0;
+
+	/// \brief BER Decodes an elliptic curve point
+	/// \param bt source BufferedTransformation
+	/// \return the decoded elliptic curve point
+	virtual Point BERDecodePoint(BufferedTransformation &bt) const =0;
+
+	/// \brief DER Encodes an elliptic curve point
+	/// \param bt target BufferedTransformation
+	/// \param P point which is encoded
+	/// \param compressed flag indicating if the point is compressed
+	virtual void DEREncodePoint(BufferedTransformation &bt, const Point &P, bool compressed) const =0;
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_ECPOINT_H
diff --git a/runtime/third_party/cryptopp/elgamal.cpp b/runtime/third_party/cryptopp/elgamal.cpp
new file mode 100644
index 0000000..53d8dbe
--- /dev/null
+++ b/runtime/third_party/cryptopp/elgamal.cpp
@@ -0,0 +1,22 @@
+// elgamal.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "elgamal.h"
+#include "asn.h"
+#include "nbtheory.h"
+
+// Squash MS LNK4221 and libtool warnings
+extern const char ELGAMAL_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void ElGamal_TestInstantiations()
+{
+	ElGamalEncryptor test1(1, 1, 1);
+	ElGamalDecryptor test2(NullRNG(), 123);
+	ElGamalEncryptor test3(test2);
+}
+#endif
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/elgamal.h b/runtime/third_party/cryptopp/elgamal.h
new file mode 100644
index 0000000..f979f0a
--- /dev/null
+++ b/runtime/third_party/cryptopp/elgamal.h
@@ -0,0 +1,308 @@
+// elgamal.h - originally written and placed in the public domain by Wei Dai
+
+/// \file elgamal.h
+/// \brief Classes and functions for ElGamal key agreement and encryption schemes
+
+#ifndef CRYPTOPP_ELGAMAL_H
+#define CRYPTOPP_ELGAMAL_H
+
+#include "cryptlib.h"
+#include "modexppc.h"
+#include "integer.h"
+#include "gfpcrypt.h"
+#include "pubkey.h"
+#include "misc.h"
+#include "oids.h"
+#include "dsa.h"
+#include "asn.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief ElGamal key agreement and encryption schemes base class
+/// \since Crypto++ 1.0
+class CRYPTOPP_NO_VTABLE ElGamalBase :
+	public DL_KeyAgreementAlgorithm_DH<Integer, NoCofactorMultiplication>,
+	public DL_KeyDerivationAlgorithm<Integer>,
+	public DL_SymmetricEncryptionAlgorithm
+{
+public:
+	virtual ~ElGamalBase() {}
+
+	void Derive(const DL_GroupParameters<Integer> &groupParams, byte *derivedKey, size_t derivedLength, const Integer &agreedElement, const Integer &ephemeralPublicKey, const NameValuePairs &derivationParams) const
+	{
+		CRYPTOPP_UNUSED(groupParams); CRYPTOPP_UNUSED(ephemeralPublicKey);
+		CRYPTOPP_UNUSED(derivationParams);
+		agreedElement.Encode(derivedKey, derivedLength);
+	}
+
+	size_t GetSymmetricKeyLength(size_t plainTextLength) const
+	{
+		CRYPTOPP_UNUSED(plainTextLength);
+		return GetGroupParameters().GetModulus().ByteCount();
+	}
+
+	size_t GetSymmetricCiphertextLength(size_t plainTextLength) const
+	{
+		unsigned int len = GetGroupParameters().GetModulus().ByteCount();
+		if (plainTextLength <= GetMaxSymmetricPlaintextLength(len))
+			return len;
+		else
+			return 0;
+	}
+
+	size_t GetMaxSymmetricPlaintextLength(size_t cipherTextLength) const
+	{
+		unsigned int len = GetGroupParameters().GetModulus().ByteCount();
+		CRYPTOPP_ASSERT(len >= 3);
+
+		if (cipherTextLength == len)
+			return STDMIN(255U, len-3);
+		else
+			return 0;
+	}
+
+	void SymmetricEncrypt(RandomNumberGenerator &rng, const byte *key, const byte *plainText, size_t plainTextLength, byte *cipherText, const NameValuePairs &parameters) const
+	{
+		CRYPTOPP_UNUSED(parameters);
+		const Integer &p = GetGroupParameters().GetModulus();
+		unsigned int modulusLen = p.ByteCount();
+
+		SecByteBlock block(modulusLen-1);
+		rng.GenerateBlock(block, modulusLen-2-plainTextLength);
+		std::memcpy(block+modulusLen-2-plainTextLength, plainText, plainTextLength);
+		block[modulusLen-2] = (byte)plainTextLength;
+
+		a_times_b_mod_c(Integer(key, modulusLen), Integer(block, modulusLen-1), p).Encode(cipherText, modulusLen);
+	}
+
+	DecodingResult SymmetricDecrypt(const byte *key, const byte *cipherText, size_t cipherTextLength, byte *plainText, const NameValuePairs &parameters) const
+	{
+		CRYPTOPP_UNUSED(parameters);
+		const Integer &p = GetGroupParameters().GetModulus();
+		unsigned int modulusLen = p.ByteCount();
+
+		if (cipherTextLength != modulusLen)
+			return DecodingResult();
+
+		Integer m = a_times_b_mod_c(Integer(cipherText, modulusLen), Integer(key, modulusLen).InverseMod(p), p);
+
+		m.Encode(plainText, 1);
+		unsigned int plainTextLength = plainText[0];
+		if (plainTextLength > GetMaxSymmetricPlaintextLength(modulusLen))
+			return DecodingResult();
+		m >>= 8;
+		m.Encode(plainText, plainTextLength);
+		return DecodingResult(plainTextLength);
+	}
+
+	virtual const DL_GroupParameters_GFP & GetGroupParameters() const =0;
+};
+
+/// \brief ElGamal key agreement and encryption schemes default implementation
+/// \tparam BASE Base class implementation
+/// \tparam SCHEME_OPTIONS Scheme options
+/// \tparam KEY ElGamal key classes
+/// \since Crypto++ 1.0
+template <class BASE, class SCHEME_OPTIONS, class KEY>
+class ElGamalObjectImpl :
+	public DL_ObjectImplBase<BASE, SCHEME_OPTIONS, KEY>,
+	public ElGamalBase
+{
+public:
+	virtual ~ElGamalObjectImpl() {}
+
+	size_t FixedMaxPlaintextLength() const {return this->MaxPlaintextLength(FixedCiphertextLength());}
+	size_t FixedCiphertextLength() const {return this->CiphertextLength(0);}
+
+	const DL_GroupParameters_GFP & GetGroupParameters() const {return this->GetKey().GetGroupParameters();}
+
+	DecodingResult FixedLengthDecrypt(RandomNumberGenerator &rng, const byte *cipherText, byte *plainText) const
+		{return Decrypt(rng, cipherText, FixedCiphertextLength(), plainText);}
+
+protected:
+	const DL_KeyAgreementAlgorithm<Integer> & GetKeyAgreementAlgorithm() const {return *this;}
+	const DL_KeyDerivationAlgorithm<Integer> & GetKeyDerivationAlgorithm() const {return *this;}
+	const DL_SymmetricEncryptionAlgorithm & GetSymmetricEncryptionAlgorithm() const {return *this;}
+};
+
+/// \brief ElGamal Public Key adapter
+/// \tparam BASE PublicKey derived class
+/// \details DL_PublicKey_ElGamal provides an override for GetAlgorithmID()
+///  to utilize 1.3.14.7.2.1.1. Prior to DL_PublicKey_ElGamal, the ElGamal
+///  keys [mistakenly] used the OID from DSA due to DL_GroupParmaters_GFP().
+///  If you need to <tt>Load</tt> an ElGamal key with the wrong OID then
+///  see <A HREF="https://www.cryptopp.com/wiki/ElGamal">ElGamal</A> on
+///  the Crypto++ wiki.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/876">Issue 876</A>,
+///  <A HREF="https://github.com/weidai11/cryptopp/issues/567">Issue 567</A>
+/// \since Crypto++ 8.3
+template <class BASE>
+struct DL_PublicKey_ElGamal : public BASE
+{
+	virtual ~DL_PublicKey_ElGamal() {}
+
+	/// \brief Retrieves the OID of the algorithm
+	/// \return OID of the algorithm
+	/// \details DL_PrivateKey_ElGamal provides an override for GetAlgorithmID()
+	///  to utilize 1.3.14.7.2.1.1. Prior to DL_PrivateKey_ElGamal, the ElGamal
+	///  keys [mistakenly] used the OID from DSA due to DL_GroupParmaters_GFP().
+	///  If you need to <tt>Load</tt> an ElGamal key with the wrong OID then
+	///  see <A HREF="https://www.cryptopp.com/wiki/ElGamal">ElGamal</A> on
+	///  the Crypto++ wiki.
+	/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/876">Issue 876</A>,
+	///  <A HREF="https://github.com/weidai11/cryptopp/issues/567">Issue 567</A>
+	virtual OID GetAlgorithmID() const {
+		return ASN1::elGamal();
+	}
+};
+
+/// \brief ElGamal Private Key adapter
+/// \tparam BASE PrivateKey derived class
+/// \details DL_PrivateKey_ElGamal provides an override for GetAlgorithmID()
+///  to utilize 1.3.14.7.2.1.1. Prior to DL_PrivateKey_ElGamal, the ElGamal
+///  keys [mistakenly] used the OID from DSA due to DL_GroupParmaters_GFP().
+///  If you need to <tt>Load</tt> an ElGamal key with the wrong OID then
+///  see <A HREF="https://www.cryptopp.com/wiki/ElGamal">ElGamal</A> on
+///  the Crypto++ wiki.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/876">Issue 876</A>,
+///  <A HREF="https://github.com/weidai11/cryptopp/issues/567">Issue 567</A>
+/// \since Crypto++ 8.3
+template <class BASE>
+struct DL_PrivateKey_ElGamal : public BASE
+{
+	virtual ~DL_PrivateKey_ElGamal() {}
+
+	/// \brief Retrieves the OID of the algorithm
+	/// \return OID of the algorithm
+	/// \details DL_PrivateKey_ElGamal provides an override for GetAlgorithmID()
+	///  to utilize 1.3.14.7.2.1.1. Prior to DL_PrivateKey_ElGamal, the ElGamal
+	///  keys [mistakenly] used the OID from DSA due to DL_GroupParmaters_GFP().
+	///  If you need to <tt>Load</tt> an ElGamal key with the wrong OID then
+	///  see <A HREF="https://www.cryptopp.com/wiki/ElGamal">ElGamal</A> on
+	///  the Crypto++ wiki.
+	/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/876">Issue 876</A>,
+	///  <A HREF="https://github.com/weidai11/cryptopp/issues/567">Issue 567</A>
+	virtual OID GetAlgorithmID() const {
+		return ASN1::elGamal();
+	}
+
+	/// \brief Check the key for errors
+	/// \param rng RandomNumberGenerator for objects which use randomized testing
+	/// \param level level of thoroughness
+	/// \return true if the tests succeed, false otherwise
+	/// \details There are four levels of thoroughness:
+	///   <ul>
+	///   <li>0 - using this object won't cause a crash or exception
+	///   <li>1 - this object will probably function, and encrypt, sign, other
+	///           operations correctly
+	///   <li>2 - ensure this object will function correctly, and perform
+	///           reasonable security checks
+	///   <li>3 - perform reasonable security checks, and do checks that may
+	///           take a long time
+	///   </ul>
+	/// \details Level 0 does not require a RandomNumberGenerator. A NullRNG() can
+	///  be used for level 0. Level 1 may not check for weak keys and such.
+	///  Levels 2 and 3 are recommended.
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const
+	{
+		// Validate() formerly used DL_PrivateKey_GFP implementation through
+		// inheritance. However, it would reject keys from other libraries
+		// like BouncyCastle. The failure was x < q. According to ElGamal's
+		// paper and the HAC, the private key is selected in over [1,p-1],
+		// Later Tsiounis and Yung showed the lower limit as [1,q-1] in
+		// "On the Security of EIGamal Based Encryption". As such, Crypto++
+		// will generate a key in the range [1,q-1], but accept a key
+		// in [1,p-1]. Thanks to JPM for finding the reference. Also see
+		// https://github.com/weidai11/cryptopp/commit/a5a684d92986.
+
+		CRYPTOPP_ASSERT(this->GetAbstractGroupParameters().Validate(rng, level));
+		bool pass = this->GetAbstractGroupParameters().Validate(rng, level);
+
+		const Integer &p = this->GetGroupParameters().GetModulus();
+		const Integer &q = this->GetAbstractGroupParameters().GetSubgroupOrder();
+		const Integer &x = this->GetPrivateExponent();
+
+		// Changed to x < p-1 based on ElGamal's paper and the HAC.
+		CRYPTOPP_ASSERT(x.IsPositive());
+		CRYPTOPP_ASSERT(x < p-1);
+		pass = pass && x.IsPositive() && x < p-1;
+
+		if (level >= 1)
+		{
+			// Minimum security level due to Tsiounis and Yung.
+			CRYPTOPP_ASSERT(Integer::Gcd(x, q) == Integer::One());
+			pass = pass && Integer::Gcd(x, q) == Integer::One();
+		}
+		return pass;
+	}
+};
+
+/// \brief ElGamal key agreement and encryption schemes keys
+/// \details ElGamalKeys provide the algorithm implementation ElGamal key
+///  agreement and encryption schemes.
+/// \details The ElGamalKeys class used <tt>DL_PrivateKey_GFP_OldFormat</tt>
+///  and <tt>DL_PublicKey_GFP_OldFormat</tt> for the <tt>PrivateKey</tt> and
+///  <tt>PublicKey</tt> from about Crypto++ 1.0 through Crypto++ 5.6.5. At
+///  Crypto++ 6.0 the serialization format was cutover to standard PKCS8 and
+///  X509 encodings.
+/// \details The ElGamalKeys class [mistakenly] used the OID for DSA from
+///  about Crypto++ 1.0 through Crypto++ 8.2. At Crypto++ 8.3 the OID was
+///  fixed and now uses ElGamal encryption, which is 1.3.14.7.2.1.1.
+///  If you need to <tt>Load</tt> an ElGamal key with the wrong OID then
+///  see <A HREF="https://www.cryptopp.com/wiki/ElGamal">ElGamal</A> on
+///  the Crypto++ wiki.
+/// \details At Crypto++ 8.6 ElGamalKeys were changed to use DL_CryptoKeys_ElGamal
+///  due to Issue 1069 and CVE-2021-40530. DL_CryptoKeys_ElGamal group parameters
+///  use the subgroup order, and not an estimated work factor.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/876">Issue 876</A>,
+///  <A HREF="https://github.com/weidai11/cryptopp/issues/567">Issue 567</A>,
+///  <A HREF="https://github.com/weidai11/cryptopp/issues/1059">Issue 1059</A>
+/// \since Crypto++ 1.0
+struct ElGamalKeys
+{
+	/// \brief Implements DL_GroupParameters interface
+	typedef DL_CryptoKeys_ElGamal::GroupParameters GroupParameters;
+	/// \brief Implements DL_PrivateKey interface
+	typedef DL_PrivateKey_ElGamal<DL_CryptoKeys_ElGamal::PrivateKey> PrivateKey;
+	/// \brief Implements DL_PublicKey interface
+	typedef DL_PublicKey_ElGamal<DL_CryptoKeys_ElGamal::PublicKey> PublicKey;
+};
+
+/// \brief ElGamal encryption scheme with non-standard padding
+/// \details ElGamal provide the algorithm implementation ElGamal key
+///  agreement and encryption schemes.
+/// \details The ElGamal class [mistakenly] used the OID for DSA from about
+///  Crypto++ 1.0 through Crypto++ 8.2. At Crypto++ 8.3 the OID was fixed
+///  and now uses ElGamal encryption, which is 1.3.14.7.2.1.1.
+///  If you need to <tt>Load</tt> an ElGamal key with the wrong OID then
+///  see <A HREF="https://www.cryptopp.com/wiki/ElGamal">ElGamal</A> on
+///  the Crypto++ wiki.
+/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/876">Issue 876</A>,
+///  <A HREF="https://github.com/weidai11/cryptopp/issues/567">Issue 567</A>
+/// \since Crypto++ 1.0
+struct ElGamal
+{
+	typedef DL_CryptoSchemeOptions<ElGamal, ElGamalKeys, int, int, int> SchemeOptions;
+	typedef SchemeOptions::PrivateKey PrivateKey;
+	typedef SchemeOptions::PublicKey PublicKey;
+
+	/// \brief The algorithm name
+	/// \return the algorithm name
+	/// \details StaticAlgorithmName returns the algorithm's name as a static
+	///  member function.
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "ElgamalEnc/Crypto++Padding";}
+
+	/// \brief Implements DL_GroupParameters interface
+	typedef SchemeOptions::GroupParameters GroupParameters;
+	/// \brief Implements PK_Encryptor interface
+	typedef PK_FinalTemplate<ElGamalObjectImpl<DL_EncryptorBase<Integer>, SchemeOptions, SchemeOptions::PublicKey> > Encryptor;
+	/// \brief Implements PK_Encryptor interface
+	typedef PK_FinalTemplate<ElGamalObjectImpl<DL_DecryptorBase<Integer>, SchemeOptions, SchemeOptions::PrivateKey> > Decryptor;
+};
+
+typedef ElGamal::Encryptor ElGamalEncryptor;
+typedef ElGamal::Decryptor ElGamalDecryptor;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/emsa2.cpp b/runtime/third_party/cryptopp/emsa2.cpp
new file mode 100644
index 0000000..5400223
--- /dev/null
+++ b/runtime/third_party/cryptopp/emsa2.cpp
@@ -0,0 +1,44 @@
+// emsa2.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "emsa2.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Inclusion based on DLL due to Clang, http://github.com/weidai11/cryptopp/issues/300
+#ifndef CRYPTOPP_IS_DLL
+template<> const byte EMSA2HashId<SHA1>::id = 0x33;
+template<> const byte EMSA2HashId<SHA224>::id = 0x38;
+template<> const byte EMSA2HashId<SHA256>::id = 0x34;
+template<> const byte EMSA2HashId<SHA384>::id = 0x36;
+template<> const byte EMSA2HashId<SHA512>::id = 0x35;
+#endif
+
+void EMSA2Pad::ComputeMessageRepresentative(RandomNumberGenerator& /*rng*/,
+	const byte* recoverableMessage, size_t recoverableMessageLength,
+	HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+	byte *representative, size_t representativeBitLength) const
+{
+	CRYPTOPP_UNUSED(recoverableMessage), CRYPTOPP_UNUSED(recoverableMessageLength), CRYPTOPP_UNUSED(representativeBitLength);
+	CRYPTOPP_ASSERT(representativeBitLength >= MinRepresentativeBitLength(hashIdentifier.second, hash.DigestSize()));
+
+	if (representativeBitLength % 8 != 7)
+		throw PK_SignatureScheme::InvalidKeyLength("EMSA2: EMSA2 requires a key length that is a multiple of 8");
+
+	size_t digestSize = hash.DigestSize();
+	size_t representativeByteLength = BitsToBytes(representativeBitLength);
+
+	representative[0] = messageEmpty ? 0x4b : 0x6b;
+	std::memset(representative+1, 0xbb, representativeByteLength-digestSize-4);	// pad with 0xbb
+	byte *afterP2 = representative+representativeByteLength-digestSize-3;
+	afterP2[0] = 0xba;
+	hash.Final(afterP2+1);
+	representative[representativeByteLength-2] = *hashIdentifier.first;
+	representative[representativeByteLength-1] = 0xcc;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/emsa2.h b/runtime/third_party/cryptopp/emsa2.h
new file mode 100644
index 0000000..d39e73d
--- /dev/null
+++ b/runtime/third_party/cryptopp/emsa2.h
@@ -0,0 +1,101 @@
+// emsa2.h - originally written and placed in the public domain by Wei Dai
+
+/// \file emsa2.h
+/// \brief Classes and functions for various padding schemes used in public key algorithms
+
+#ifndef CRYPTOPP_EMSA2_H
+#define CRYPTOPP_EMSA2_H
+
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "hashfwd.h"
+#include "misc.h"
+
+#ifdef CRYPTOPP_IS_DLL
+# include "sha.h"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief EMSA2 hash identifier
+/// \tparam H HashTransformation derived class
+/// \since Crypto++ 5.0
+template <class H> class EMSA2HashId
+{
+public:
+	static const byte id;
+};
+
+/// \brief EMSA2 padding method
+/// \tparam BASE Message encoding method
+/// \since Crypto++ 5.0
+template <class BASE>
+class EMSA2HashIdLookup : public BASE
+{
+public:
+	struct HashIdentifierLookup
+	{
+		template <class H> struct HashIdentifierLookup2
+		{
+			static HashIdentifier Lookup()
+			{
+				return HashIdentifier(&EMSA2HashId<H>::id, 1);
+			}
+		};
+	};
+};
+
+// EMSA2HashId can be instantiated with the following classes.
+// SHA1, SHA224, SHA256, SHA384, SHA512, RIPEMD128, RIPEMD160, Whirlpool
+
+#ifdef CRYPTOPP_IS_DLL
+CRYPTOPP_DLL_TEMPLATE_CLASS EMSA2HashId<SHA1>;
+CRYPTOPP_DLL_TEMPLATE_CLASS EMSA2HashId<SHA224>;
+CRYPTOPP_DLL_TEMPLATE_CLASS EMSA2HashId<SHA256>;
+CRYPTOPP_DLL_TEMPLATE_CLASS EMSA2HashId<SHA384>;
+CRYPTOPP_DLL_TEMPLATE_CLASS EMSA2HashId<SHA512>;
+#endif
+
+// https://github.com/weidai11/cryptopp/issues/300 and
+// https://github.com/weidai11/cryptopp/issues/533
+#if defined(__clang__)
+template<> const byte EMSA2HashId<SHA1>::id;
+template<> const byte EMSA2HashId<SHA224>::id;
+template<> const byte EMSA2HashId<SHA256>::id;
+template<> const byte EMSA2HashId<SHA384>::id;
+template<> const byte EMSA2HashId<SHA512>::id;
+#endif
+
+/// \brief EMSA2 padding method
+/// \since Crypto++ 5.0
+class CRYPTOPP_DLL EMSA2Pad : public EMSA2HashIdLookup<PK_DeterministicSignatureMessageEncodingMethod>
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "EMSA2";}
+
+	size_t MinRepresentativeBitLength(size_t hashIdentifierLength, size_t digestLength) const
+		{CRYPTOPP_UNUSED(hashIdentifierLength); return 8*digestLength + 31;}
+
+	void ComputeMessageRepresentative(RandomNumberGenerator &rng,
+		const byte *recoverableMessage, size_t recoverableMessageLength,
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const;
+};
+
+// EMSA2, for use with RWSS and RSA_ISO
+// Only the following hash functions are supported by this signature standard:
+//  \dontinclude emsa2.h
+//  \skip EMSA2HashId can be instantiated
+//  \until end of list
+
+/// \brief EMSA2/P1363 padding method
+/// \details Use with RWSS and RSA_ISO
+/// \since Crypto++ 5.0
+struct P1363_EMSA2 : public SignatureStandard
+{
+	typedef EMSA2Pad SignatureMessageEncodingMethod;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/eprecomp.cpp b/runtime/third_party/cryptopp/eprecomp.cpp
new file mode 100644
index 0000000..873869a
--- /dev/null
+++ b/runtime/third_party/cryptopp/eprecomp.cpp
@@ -0,0 +1,114 @@
+// eprecomp.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "eprecomp.h"
+#include "integer.h"
+#include "algebra.h"
+#include "asn.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+template <class T> void DL_FixedBasePrecomputationImpl<T>::SetBase(const DL_GroupPrecomputation<Element> &group, const Element &i_base)
+{
+	m_base = group.NeedConversions() ? group.ConvertIn(i_base) : i_base;
+
+	if (m_bases.empty() || !(m_base == m_bases[0]))
+	{
+		m_bases.resize(1);
+		m_bases[0] = m_base;
+	}
+
+	if (group.NeedConversions())
+		m_base = i_base;
+}
+
+template <class T> void DL_FixedBasePrecomputationImpl<T>::Precompute(const DL_GroupPrecomputation<Element> &group, unsigned int maxExpBits, unsigned int storage)
+{
+	CRYPTOPP_ASSERT(m_bases.size() > 0);
+	CRYPTOPP_ASSERT(storage <= maxExpBits);
+
+	if (storage > 1)
+	{
+		m_windowSize = (maxExpBits+storage-1)/storage;
+		m_exponentBase = Integer::Power2(m_windowSize);
+	}
+
+	m_bases.resize(storage);
+	for (unsigned i=1; i<storage; i++)
+		m_bases[i] = group.GetGroup().ScalarMultiply(m_bases[i-1], m_exponentBase);
+}
+
+template <class T> void DL_FixedBasePrecomputationImpl<T>::Load(const DL_GroupPrecomputation<Element> &group, BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	word32 version;
+	BERDecodeUnsigned<word32>(seq, version, INTEGER, 1, 1);
+	m_exponentBase.BERDecode(seq);
+	m_windowSize = m_exponentBase.BitCount() - 1;
+	m_bases.clear();
+	while (!seq.EndReached())
+		m_bases.push_back(group.BERDecodeElement(seq));
+	if (!m_bases.empty() && group.NeedConversions())
+		m_base = group.ConvertOut(m_bases[0]);
+	seq.MessageEnd();
+}
+
+template <class T> void DL_FixedBasePrecomputationImpl<T>::Save(const DL_GroupPrecomputation<Element> &group, BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+	DEREncodeUnsigned<word32>(seq, 1);	// version
+	m_exponentBase.DEREncode(seq);
+	for (unsigned i=0; i<m_bases.size(); i++)
+		group.DEREncodeElement(seq, m_bases[i]);
+	seq.MessageEnd();
+}
+
+template <class T> void DL_FixedBasePrecomputationImpl<T>::PrepareCascade(const DL_GroupPrecomputation<Element> &i_group, std::vector<BaseAndExponent<Element> > &eb, const Integer &exponent) const
+{
+	const AbstractGroup<T> &group = i_group.GetGroup();
+
+	Integer r, q, e = exponent;
+	bool fastNegate = group.InversionIsFast() && m_windowSize > 1;
+	unsigned int i;
+
+	for (i=0; i+1<m_bases.size(); i++)
+	{
+		Integer::DivideByPowerOf2(r, q, e, m_windowSize);
+		std::swap(q, e);
+		if (fastNegate && r.GetBit(m_windowSize-1))
+		{
+			++e;
+			eb.push_back(BaseAndExponent<Element>(group.Inverse(m_bases[i]), m_exponentBase - r));
+		}
+		else
+			eb.push_back(BaseAndExponent<Element>(m_bases[i], r));
+	}
+	eb.push_back(BaseAndExponent<Element>(m_bases[i], e));
+}
+
+template <class T> T DL_FixedBasePrecomputationImpl<T>::Exponentiate(const DL_GroupPrecomputation<Element> &group, const Integer &exponent) const
+{
+	std::vector<BaseAndExponent<Element> > eb;	// array of segments of the exponent and precalculated bases
+	eb.reserve(m_bases.size());
+	PrepareCascade(group, eb, exponent);
+	return group.ConvertOut(GeneralCascadeMultiplication<Element>(group.GetGroup(), eb.begin(), eb.end()));
+}
+
+template <class T> T
+	DL_FixedBasePrecomputationImpl<T>::CascadeExponentiate(const DL_GroupPrecomputation<Element> &group, const Integer &exponent,
+		const DL_FixedBasePrecomputation<T> &i_pc2, const Integer &exponent2) const
+{
+	std::vector<BaseAndExponent<Element> > eb;	// array of segments of the exponent and precalculated bases
+	const DL_FixedBasePrecomputationImpl<T> &pc2 = static_cast<const DL_FixedBasePrecomputationImpl<T> &>(i_pc2);
+	eb.reserve(m_bases.size() + pc2.m_bases.size());
+	PrepareCascade(group, eb, exponent);
+	pc2.PrepareCascade(group, eb, exponent2);
+	return group.ConvertOut(GeneralCascadeMultiplication<Element>(group.GetGroup(), eb.begin(), eb.end()));
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/eprecomp.h b/runtime/third_party/cryptopp/eprecomp.h
new file mode 100644
index 0000000..7049d4b
--- /dev/null
+++ b/runtime/third_party/cryptopp/eprecomp.h
@@ -0,0 +1,162 @@
+// eprecomp.h - originally written and placed in the public domain by Wei Dai
+
+/// \file eprecomp.h
+/// \brief Classes for precomputation in a group
+
+#ifndef CRYPTOPP_EPRECOMP_H
+#define CRYPTOPP_EPRECOMP_H
+
+#include "cryptlib.h"
+#include "integer.h"
+#include "algebra.h"
+#include "stdcpp.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief DL_GroupPrecomputation interface
+/// \tparam T Field element
+template <class T>
+class DL_GroupPrecomputation
+{
+public:
+	typedef T Element;
+
+	virtual ~DL_GroupPrecomputation() {}
+
+	/// \brief Determines if elements needs conversion
+	/// \return true if the element needs conversion, false otherwise
+	/// \details NeedConversions determines if an element must convert between representations.
+	virtual bool NeedConversions() const {return false;}
+
+	/// \brief Converts an element between representations
+	/// \param v element to convert
+	/// \return an element converted to an alternate representation for internal use
+	/// \details ConvertIn is used when an element must convert between representations.
+	virtual Element ConvertIn(const Element &v) const {return v;}
+
+	/// \brief Converts an element between representations
+	/// \param v element to convert
+	/// \return an element converted from an alternate representation
+	virtual Element ConvertOut(const Element &v) const {return v;}
+
+	/// \brief Retrieves AbstractGroup interface
+	/// \return GetGroup() returns the AbstractGroup interface
+	virtual const AbstractGroup<Element> & GetGroup() const =0;
+
+	/// \brief Decodes element in DER format
+	/// \param bt BufferedTransformation object
+	/// \return element in the group
+	virtual Element BERDecodeElement(BufferedTransformation &bt) const =0;
+
+	/// \brief Encodes element in DER format
+	/// \param bt BufferedTransformation object
+	/// \param P Element to encode
+	virtual void DEREncodeElement(BufferedTransformation &bt, const Element &P) const =0;
+};
+
+/// \brief DL_FixedBasePrecomputation interface
+/// \tparam T Field element
+template <class T>
+class DL_FixedBasePrecomputation
+{
+public:
+	typedef T Element;
+
+	virtual ~DL_FixedBasePrecomputation() {}
+
+	/// \brief Determines whether this object is initialized
+	/// \return true if this object is initialized, false otherwise
+	virtual bool IsInitialized() const =0;
+
+	/// \brief Set the base element
+	/// \param group the group
+	/// \param base element in the group
+	virtual void SetBase(const DL_GroupPrecomputation<Element> &group, const Element &base) =0;
+
+	/// \brief Get the base element
+	/// \param group the group
+	/// \return base element in the group
+	virtual const Element & GetBase(const DL_GroupPrecomputation<Element> &group) const =0;
+
+	/// \brief Perform precomputation
+	/// \param group the group
+	/// \param maxExpBits used to calculate the exponent base
+	/// \param storage the suggested number of objects for the precompute table
+	/// \details The exact semantics of Precompute() varies, but it typically means calculate
+	///   a table of n objects that can be used later to speed up computation.
+	/// \details If a derived class does not override Precompute(), then the base class throws
+	///   NotImplemented.
+	/// \sa SupportsPrecomputation(), LoadPrecomputation(), SavePrecomputation()
+	virtual void Precompute(const DL_GroupPrecomputation<Element> &group, unsigned int maxExpBits, unsigned int storage) =0;
+
+	/// \brief Retrieve previously saved precomputation
+	/// \param group the group
+	/// \param storedPrecomputation BufferedTransformation with the saved precomputation
+	/// \throw NotImplemented
+	/// \sa SupportsPrecomputation(), Precompute()
+	virtual void Load(const DL_GroupPrecomputation<Element> &group, BufferedTransformation &storedPrecomputation) =0;
+
+	/// \brief Save precomputation for later use
+	/// \param group the group
+	/// \param storedPrecomputation BufferedTransformation to write the precomputation
+	/// \throw NotImplemented
+	/// \sa SupportsPrecomputation(), Precompute()
+	virtual void Save(const DL_GroupPrecomputation<Element> &group, BufferedTransformation &storedPrecomputation) const =0;
+
+	/// \brief Exponentiates an element
+	/// \param group the group
+	/// \param exponent the exponent
+	/// \return the result of the exponentiation
+	virtual Element Exponentiate(const DL_GroupPrecomputation<Element> &group, const Integer &exponent) const =0;
+
+	/// \brief Exponentiates an element
+	/// \param pc1 the first the group precomputation
+	/// \param exponent1 the first exponent
+	/// \param pc2 the second the group precomputation
+	/// \param exponent2 the first exponent2
+	/// \return the public element raised to the exponent
+	/// \details CascadeExponentiateBaseAndPublicElement raises the public element to
+	///   the base element and precomputation.
+	virtual Element CascadeExponentiate(const DL_GroupPrecomputation<Element> &pc1, const Integer &exponent1, const DL_FixedBasePrecomputation<Element> &pc2, const Integer &exponent2) const =0;
+};
+
+/// \brief DL_FixedBasePrecomputation adapter class
+/// \tparam T Field element
+template <class T>
+class DL_FixedBasePrecomputationImpl : public DL_FixedBasePrecomputation<T>
+{
+public:
+	typedef T Element;
+
+	virtual ~DL_FixedBasePrecomputationImpl() {}
+
+	DL_FixedBasePrecomputationImpl() : m_windowSize(0) {}
+
+	// DL_FixedBasePrecomputation
+	bool IsInitialized() const
+		{return !m_bases.empty();}
+	void SetBase(const DL_GroupPrecomputation<Element> &group, const Element &base);
+	const Element & GetBase(const DL_GroupPrecomputation<Element> &group) const
+		{return group.NeedConversions() ? m_base : m_bases[0];}
+	void Precompute(const DL_GroupPrecomputation<Element> &group, unsigned int maxExpBits, unsigned int storage);
+	void Load(const DL_GroupPrecomputation<Element> &group, BufferedTransformation &storedPrecomputation);
+	void Save(const DL_GroupPrecomputation<Element> &group, BufferedTransformation &storedPrecomputation) const;
+	Element Exponentiate(const DL_GroupPrecomputation<Element> &group, const Integer &exponent) const;
+	Element CascadeExponentiate(const DL_GroupPrecomputation<Element> &pc1, const Integer &exponent1, const DL_FixedBasePrecomputation<Element> &pc2, const Integer &exponent2) const;
+
+private:
+	void PrepareCascade(const DL_GroupPrecomputation<Element> &group, std::vector<BaseAndExponent<Element> > &eb, const Integer &exponent) const;
+
+	Element m_base;
+	unsigned int m_windowSize;
+	Integer m_exponentBase;			// what base to represent the exponent in
+	std::vector<Element> m_bases;	// precalculated bases
+};
+
+NAMESPACE_END
+
+#ifdef CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES
+#include "eprecomp.cpp"
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/esign.cpp b/runtime/third_party/cryptopp/esign.cpp
new file mode 100644
index 0000000..70dde2f
--- /dev/null
+++ b/runtime/third_party/cryptopp/esign.cpp
@@ -0,0 +1,223 @@
+// esign.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+// TODO: fix the C4589 warnings
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4589)
+#endif
+
+#include "esign.h"
+#include "modarith.h"
+#include "integer.h"
+#include "nbtheory.h"
+#include "algparam.h"
+#include "sha.h"
+#include "asn.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void ESIGN_TestInstantiations()
+{
+	ESIGN<SHA1>::Verifier x1(1, 1);
+	ESIGN<SHA1>::Signer x2(NullRNG(), 1);
+	ESIGN<SHA1>::Verifier x3(x2);
+	ESIGN<SHA1>::Verifier x4(x2.GetKey());
+	ESIGN<SHA1>::Verifier x5(x3);
+	ESIGN<SHA1>::Signer x6 = x2;
+
+	x6 = x2;
+	x3 = ESIGN<SHA1>::Verifier(x2);
+	x4 = x2.GetKey();
+}
+#endif
+
+void ESIGNFunction::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+		m_n.BERDecode(seq);
+		m_e.BERDecode(seq);
+	seq.MessageEnd();
+}
+
+void ESIGNFunction::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+		m_n.DEREncode(seq);
+		m_e.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+Integer ESIGNFunction::ApplyFunction(const Integer &x) const
+{
+	DoQuickSanityCheck();
+	return STDMIN(a_exp_b_mod_c(x, m_e, m_n) >> (2*GetK()+2), MaxImage());
+}
+
+bool ESIGNFunction::Validate(RandomNumberGenerator& rng, unsigned int level) const
+{
+	CRYPTOPP_UNUSED(rng), CRYPTOPP_UNUSED(level);
+	bool pass = true;
+	pass = pass && m_n > Integer::One() && m_n.IsOdd();
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_e >= 8 && m_e < m_n;
+	CRYPTOPP_ASSERT(pass);
+	return pass;
+}
+
+bool ESIGNFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_GET_FUNCTION_ENTRY(PublicExponent)
+		;
+}
+
+void ESIGNFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_SET_FUNCTION_ENTRY(PublicExponent)
+		;
+}
+
+// *****************************************************************************
+
+void InvertibleESIGNFunction::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &param)
+{
+	int modulusSize = 1023*2;
+	param.GetIntValue("ModulusSize", modulusSize) || param.GetIntValue("KeySize", modulusSize);
+
+	if (modulusSize < 24)
+		throw InvalidArgument("InvertibleESIGNFunction: specified modulus size is too small");
+
+	if (modulusSize % 3 != 0)
+		throw InvalidArgument("InvertibleESIGNFunction: modulus size must be divisible by 3");
+
+	m_e = param.GetValueWithDefault("PublicExponent", Integer(32));
+
+	if (m_e < 8)
+		throw InvalidArgument("InvertibleESIGNFunction: public exponents less than 8 may not be secure");
+
+	// VC70 workaround: putting these after primeParam causes overlapped stack allocation
+	ConstByteArrayParameter seedParam;
+	SecByteBlock seed;
+
+	const Integer minP = Integer(204) << (modulusSize/3-8);
+	const Integer maxP = Integer::Power2(modulusSize/3)-1;
+	AlgorithmParameters primeParam = MakeParameters("Min", minP)("Max", maxP)("RandomNumberType", Integer::PRIME);
+
+	if (param.GetValue("Seed", seedParam))
+	{
+		seed.resize(seedParam.size() + 4);
+		std::memcpy(seed + 4, seedParam.begin(), seedParam.size());
+
+		PutWord(false, BIG_ENDIAN_ORDER, seed, (word32)0);
+		m_p.GenerateRandom(rng, CombinedNameValuePairs(primeParam, MakeParameters("Seed", ConstByteArrayParameter(seed))));
+		PutWord(false, BIG_ENDIAN_ORDER, seed, (word32)1);
+		m_q.GenerateRandom(rng, CombinedNameValuePairs(primeParam, MakeParameters("Seed", ConstByteArrayParameter(seed))));
+	}
+	else
+	{
+		m_p.GenerateRandom(rng, primeParam);
+		m_q.GenerateRandom(rng, primeParam);
+	}
+
+	m_n = m_p * m_p * m_q;
+
+	CRYPTOPP_ASSERT(m_n.BitCount() == (unsigned int)modulusSize);
+}
+
+void InvertibleESIGNFunction::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder privateKey(bt);
+		m_n.BERDecode(privateKey);
+		m_e.BERDecode(privateKey);
+		m_p.BERDecode(privateKey);
+		m_q.BERDecode(privateKey);
+	privateKey.MessageEnd();
+}
+
+void InvertibleESIGNFunction::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder privateKey(bt);
+		m_n.DEREncode(privateKey);
+		m_e.DEREncode(privateKey);
+		m_p.DEREncode(privateKey);
+		m_q.DEREncode(privateKey);
+	privateKey.MessageEnd();
+}
+
+Integer InvertibleESIGNFunction::CalculateRandomizedInverse(RandomNumberGenerator &rng, const Integer &x) const
+{
+	DoQuickSanityCheck();
+
+	Integer pq = m_p * m_q;
+	Integer p2 = m_p * m_p;
+	Integer r, z, re, a, w0, w1;
+
+	do
+	{
+		r.Randomize(rng, Integer::Zero(), pq);
+		z = x << (2*GetK()+2);
+		re = a_exp_b_mod_c(r, m_e, m_n);
+		a = (z - re) % m_n;
+		Integer::Divide(w1, w0, a, pq);
+		if (w1.NotZero())
+		{
+			++w0;
+			w1 = pq - w1;
+		}
+	}
+	while ((w1 >> (2*GetK()+1)).IsPositive());
+
+	ModularArithmetic modp(m_p);
+	Integer t = modp.Divide(w0 * r % m_p, m_e * re % m_p);
+	Integer s = r + t*pq;
+	CRYPTOPP_ASSERT(s < m_n);
+
+	return s;
+}
+
+bool InvertibleESIGNFunction::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+	bool pass = ESIGNFunction::Validate(rng, level);
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_p > Integer::One() && m_p.IsOdd() && m_p < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_q > Integer::One() && m_q.IsOdd() && m_q < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_p.BitCount() == m_q.BitCount();
+	CRYPTOPP_ASSERT(pass);
+	if (level >= 1)
+	{
+		pass = pass && m_p * m_p * m_q == m_n;
+		CRYPTOPP_ASSERT(pass);
+	}
+	if (level >= 2)
+	{
+		pass = pass && VerifyPrime(rng, m_p, level-2) && VerifyPrime(rng, m_q, level-2);
+		CRYPTOPP_ASSERT(pass);
+	}
+	return pass;
+}
+
+bool InvertibleESIGNFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper<ESIGNFunction>(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime2)
+		;
+}
+
+void InvertibleESIGNFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper<ESIGNFunction>(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime2)
+		;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/esign.h b/runtime/third_party/cryptopp/esign.h
new file mode 100644
index 0000000..2c597c2
--- /dev/null
+++ b/runtime/third_party/cryptopp/esign.h
@@ -0,0 +1,169 @@
+// esign.h - originally written and placed in the public domain by Wei Dai
+
+/// \file esign.h
+/// \brief Classes providing ESIGN signature schemes as defined in IEEE P1363a
+/// \since Crypto++ 5.0
+
+#ifndef CRYPTOPP_ESIGN_H
+#define CRYPTOPP_ESIGN_H
+
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "integer.h"
+#include "asn.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief ESIGN trapdoor function using the public key
+/// \since Crypto++ 5.0
+class ESIGNFunction : public TrapdoorFunction, public ASN1CryptoMaterial<PublicKey>
+{
+	typedef ESIGNFunction ThisClass;
+
+public:
+
+	/// \brief Initialize a ESIGN public key with {n,e}
+	/// \param n the modulus
+	/// \param e the public exponent
+	void Initialize(const Integer &n, const Integer &e)
+		{m_n = n; m_e = e;}
+
+	// PublicKey
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	// CryptoMaterial
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+
+	// TrapdoorFunction
+	Integer ApplyFunction(const Integer &x) const;
+	Integer PreimageBound() const {return m_n;}
+	Integer ImageBound() const {return Integer::Power2(GetK());}
+
+	// non-derived
+	const Integer & GetModulus() const {return m_n;}
+	const Integer & GetPublicExponent() const {return m_e;}
+
+	void SetModulus(const Integer &n) {m_n = n;}
+	void SetPublicExponent(const Integer &e) {m_e = e;}
+
+protected:
+	// Covertiy finding on overflow. The library allows small values for research purposes.
+	unsigned int GetK() const {return SaturatingSubtract(m_n.BitCount()/3, 1U);}
+
+	Integer m_n, m_e;
+};
+
+/// \brief ESIGN trapdoor function using the private key
+/// \since Crypto++ 5.0
+class InvertibleESIGNFunction : public ESIGNFunction, public RandomizedTrapdoorFunctionInverse, public PrivateKey
+{
+	typedef InvertibleESIGNFunction ThisClass;
+
+public:
+
+	/// \brief Initialize a ESIGN private key with {n,e,p,q}
+	/// \param n modulus
+	/// \param e public exponent
+	/// \param p first prime factor
+	/// \param q second prime factor
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	void Initialize(const Integer &n, const Integer &e, const Integer &p, const Integer &q)
+		{m_n = n; m_e = e; m_p = p; m_q = q;}
+
+	/// \brief Create a ESIGN private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param modulusBits the size of the modulud, in bits
+	/// \details This function overload of Initialize() creates a new private key because it
+	///   takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+	///   then use one of the other Initialize() overloads.
+	void Initialize(RandomNumberGenerator &rng, unsigned int modulusBits)
+		{GenerateRandomWithKeySize(rng, modulusBits);}
+
+	// Squash Visual Studio C4250 warning
+	void Save(BufferedTransformation &bt) const
+		{BEREncode(bt);}
+
+	// Squash Visual Studio C4250 warning
+	void Load(BufferedTransformation &bt)
+		{BERDecode(bt);}
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	Integer CalculateRandomizedInverse(RandomNumberGenerator &rng, const Integer &x) const;
+
+	// GeneratibleCryptoMaterial
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+	/*! parameters: (ModulusSize) */
+	void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
+
+	const Integer& GetPrime1() const {return m_p;}
+	const Integer& GetPrime2() const {return m_q;}
+
+	void SetPrime1(const Integer &p) {m_p = p;}
+	void SetPrime2(const Integer &q) {m_q = q;}
+
+protected:
+	Integer m_p, m_q;
+};
+
+/// \brief EMSA5 padding method
+/// \tparam T Mask Generation Function
+/// \since Crypto++ 5.0
+template <class T>
+class EMSA5Pad : public PK_DeterministicSignatureMessageEncodingMethod
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "EMSA5";}
+
+	void ComputeMessageRepresentative(RandomNumberGenerator &rng,
+		const byte *recoverableMessage, size_t recoverableMessageLength,
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const
+	{
+		CRYPTOPP_UNUSED(rng), CRYPTOPP_UNUSED(recoverableMessage), CRYPTOPP_UNUSED(recoverableMessageLength);
+		CRYPTOPP_UNUSED(messageEmpty), CRYPTOPP_UNUSED(hashIdentifier);
+		SecByteBlock digest(hash.DigestSize());
+		hash.Final(digest);
+		size_t representativeByteLength = BitsToBytes(representativeBitLength);
+		T mgf;
+		mgf.GenerateAndMask(hash, representative, representativeByteLength, digest, digest.size(), false);
+		if (representativeBitLength % 8 != 0)
+			representative[0] = (byte)Crop(representative[0], representativeBitLength % 8);
+	}
+};
+
+/// \brief EMSA5 padding method, for use with ESIGN
+/// \since Crypto++ 5.0
+struct P1363_EMSA5 : public SignatureStandard
+{
+	typedef EMSA5Pad<P1363_MGF1> SignatureMessageEncodingMethod;
+};
+
+/// \brief ESIGN keys
+/// \since Crypto++ 5.0
+struct ESIGN_Keys
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "ESIGN";}
+	typedef ESIGNFunction PublicKey;
+	typedef InvertibleESIGNFunction PrivateKey;
+};
+
+/// \brief ESIGN signature scheme, IEEE P1363a
+/// \tparam H HashTransformation derived class
+/// \tparam STANDARD Signature encoding method
+/// \since Crypto++ 5.0
+template <class H, class STANDARD = P1363_EMSA5>
+struct ESIGN : public TF_SS<ESIGN_Keys, STANDARD, H>
+{
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/factory.h b/runtime/third_party/cryptopp/factory.h
new file mode 100644
index 0000000..82dc5f5
--- /dev/null
+++ b/runtime/third_party/cryptopp/factory.h
@@ -0,0 +1,179 @@
+// factory.h - originally written and placed in the public domain by Wei Dai
+
+/// \file factory.h
+/// \brief Classes and functions for registering and locating library objects
+
+#ifndef CRYPTOPP_OBJFACT_H
+#define CRYPTOPP_OBJFACT_H
+
+#include "cryptlib.h"
+#include "misc.h"
+#include "stdcpp.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Object factory interface for registering objects
+/// \tparam AbstractClass Base class interface of the object
+template <class AbstractClass>
+class ObjectFactory
+{
+public:
+	virtual ~ObjectFactory () {}
+	virtual AbstractClass * CreateObject() const =0;
+};
+
+/// \brief Object factory for registering objects
+/// \tparam AbstractClass Base class interface of the object
+/// \tparam ConcreteClass Class object
+template <class AbstractClass, class ConcreteClass>
+class DefaultObjectFactory : public ObjectFactory<AbstractClass>
+{
+public:
+	AbstractClass * CreateObject() const
+	{
+		return new ConcreteClass;
+	}
+};
+
+/// \brief Object factory registry
+/// \tparam AbstractClass Base class interface of the object
+/// \tparam instance unique identifier
+template <class AbstractClass, int instance=0>
+class ObjectFactoryRegistry
+{
+public:
+	class FactoryNotFound : public Exception
+	{
+	public:
+		FactoryNotFound(const char *name) : Exception(OTHER_ERROR, std::string("ObjectFactoryRegistry: could not find factory for algorithm ") + name)  {}
+	};
+
+	~ObjectFactoryRegistry()
+	{
+		for (typename Map::iterator i = m_map.begin(); i != m_map.end(); ++i)
+		{
+			delete (ObjectFactory<AbstractClass> *)i->second;
+			i->second = NULLPTR;
+		}
+	}
+
+	void RegisterFactory(const std::string &name, ObjectFactory<AbstractClass> *factory)
+	{
+		m_map[name] = factory;
+	}
+
+	const ObjectFactory<AbstractClass> * GetFactory(const char *name) const
+	{
+		typename Map::const_iterator i = m_map.find(name);
+		return i == m_map.end() ? NULLPTR : (ObjectFactory<AbstractClass> *)i->second;
+	}
+
+	AbstractClass *CreateObject(const char *name) const
+	{
+		const ObjectFactory<AbstractClass> *factory = GetFactory(name);
+		if (!factory)
+			throw FactoryNotFound(name);
+		return factory->CreateObject();
+	}
+
+	// Return a vector containing the factory names. This is easier than returning an iterator.
+	// from Andrew Pitonyak
+	std::vector<std::string> GetFactoryNames() const
+	{
+		std::vector<std::string> names;
+		typename Map::const_iterator iter;
+		for (iter = m_map.begin(); iter != m_map.end(); ++iter)
+			names.push_back(iter->first);
+		return names;
+	}
+
+	CRYPTOPP_NOINLINE static ObjectFactoryRegistry<AbstractClass, instance> & Registry(CRYPTOPP_NOINLINE_DOTDOTDOT);
+
+private:
+	// use void * instead of ObjectFactory<AbstractClass> * to save code size
+	typedef std::map<std::string, void *> Map;
+	Map m_map;
+};
+
+template <class AbstractClass, int instance>
+ObjectFactoryRegistry<AbstractClass, instance> & ObjectFactoryRegistry<AbstractClass, instance>::Registry(CRYPTOPP_NOINLINE_DOTDOTDOT)
+{
+	static ObjectFactoryRegistry<AbstractClass, instance> s_registry;
+	return s_registry;
+}
+
+/// \brief Object factory registry helper
+/// \tparam AbstractClass Base class interface of the object
+/// \tparam ConcreteClass Class object
+/// \tparam instance unique identifier
+template <class AbstractClass, class ConcreteClass, int instance = 0>
+struct RegisterDefaultFactoryFor
+{
+	RegisterDefaultFactoryFor(const char *name=NULLPTR)
+	{
+		// BCB2006 workaround
+		std::string n = name ? std::string(name) : std::string(ConcreteClass::StaticAlgorithmName());
+		ObjectFactoryRegistry<AbstractClass, instance>::Registry().
+		RegisterFactory(n, new DefaultObjectFactory<AbstractClass, ConcreteClass>);
+	}
+};
+
+/// \fn RegisterAsymmetricCipherDefaultFactories
+/// \brief Register asymmetric ciphers
+/// \tparam SchemeClass interface of the object under a scheme
+/// \details Schemes include asymmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>),
+///   signature schemes (registers <tt>SchemeClass::Signer</tt> and <tt>SchemeClass::Verifier</tt>),
+///   symmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>),
+///   authenticated symmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>), etc.
+template <class SchemeClass>
+void RegisterAsymmetricCipherDefaultFactories(const char *name=NULLPTR)
+{
+	RegisterDefaultFactoryFor<PK_Encryptor, typename SchemeClass::Encryptor>((const char *)name);
+	RegisterDefaultFactoryFor<PK_Decryptor, typename SchemeClass::Decryptor>((const char *)name);
+}
+
+/// \fn RegisterSignatureSchemeDefaultFactories
+/// \brief Register signature schemes
+/// \tparam SchemeClass interface of the object under a scheme
+/// \details Schemes include asymmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>),
+///   signature schemes (registers <tt>SchemeClass::Signer</tt> and <tt>SchemeClass::Verifier</tt>),
+///   symmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>),
+///   authenticated symmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>), etc.
+template <class SchemeClass>
+void RegisterSignatureSchemeDefaultFactories(const char *name=NULLPTR)
+{
+	RegisterDefaultFactoryFor<PK_Signer, typename SchemeClass::Signer>((const char *)name);
+	RegisterDefaultFactoryFor<PK_Verifier, typename SchemeClass::Verifier>((const char *)name);
+}
+
+/// \fn RegisterSymmetricCipherDefaultFactories
+/// \brief Register symmetric ciphers
+/// \tparam SchemeClass interface of the object under a scheme
+/// \details Schemes include asymmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>),
+///   signature schemes (registers <tt>SchemeClass::Signer</tt> and <tt>SchemeClass::Verifier</tt>),
+///   symmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>),
+///   authenticated symmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>), etc.
+template <class SchemeClass>
+void RegisterSymmetricCipherDefaultFactories(const char *name=NULLPTR)
+{
+	RegisterDefaultFactoryFor<SymmetricCipher, typename SchemeClass::Encryption, ENCRYPTION>((const char *)name);
+	RegisterDefaultFactoryFor<SymmetricCipher, typename SchemeClass::Decryption, DECRYPTION>((const char *)name);
+}
+
+/// \fn RegisterAuthenticatedSymmetricCipherDefaultFactories
+/// \brief Register authenticated symmetric ciphers
+/// \tparam SchemeClass interface of the object under a scheme
+/// \details Schemes include asymmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>),
+///   signature schemes (registers <tt>SchemeClass::Signer</tt> and <tt>SchemeClass::Verifier</tt>),
+///   symmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>),
+///   authenticated symmetric ciphers (registers <tt>SchemeClass::Encryptor</tt> and <tt>SchemeClass::Decryptor</tt>), etc.
+template <class SchemeClass>
+void RegisterAuthenticatedSymmetricCipherDefaultFactories(const char *name=NULLPTR)
+{
+	RegisterDefaultFactoryFor<AuthenticatedSymmetricCipher, typename SchemeClass::Encryption, ENCRYPTION>((const char *)name);
+	RegisterDefaultFactoryFor<AuthenticatedSymmetricCipher, typename SchemeClass::Decryption, DECRYPTION>((const char *)name);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/fhmqv.h b/runtime/third_party/cryptopp/fhmqv.h
new file mode 100644
index 0000000..505d286
--- /dev/null
+++ b/runtime/third_party/cryptopp/fhmqv.h
@@ -0,0 +1,408 @@
+// fhmqv.h - written and placed in the public domain by Jeffrey Walton, Ray Clayton and Uri Blumenthal
+//           Shamelessly based upon Wei Dai's MQV source files
+
+#ifndef CRYPTOPP_FHMQV_H
+#define CRYPTOPP_FHMQV_H
+
+/// \file fhmqv.h
+/// \brief Classes for Fully Hashed Menezes-Qu-Vanstone key agreement in GF(p)
+/// \since Crypto++ 5.6.4
+
+#include "gfpcrypt.h"
+#include "algebra.h"
+#include "sha.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Fully Hashed Menezes-Qu-Vanstone in GF(p)
+/// \details This implementation follows Augustin P. Sarr and Philippe Elbaz–Vincent, and Jean–Claude Bajard's
+///   <a href="http://eprint.iacr.org/2009/408">A Secure and Efficient Authenticated Diffie-Hellman Protocol</a>.
+///   Note: this is FHMQV, Protocol 5, from page 11; and not FHMQV-C.
+/// \sa MQV, HMQV, FHMQV, and AuthenticatedKeyAgreementDomain
+/// \since Crypto++ 5.6.4
+template <class GROUP_PARAMETERS, class COFACTOR_OPTION = typename GROUP_PARAMETERS::DefaultCofactorOption, class HASH = SHA512>
+class FHMQV_Domain : public AuthenticatedKeyAgreementDomain
+{
+public:
+  typedef GROUP_PARAMETERS GroupParameters;
+  typedef typename GroupParameters::Element Element;
+  typedef FHMQV_Domain<GROUP_PARAMETERS, COFACTOR_OPTION, HASH> Domain;
+
+  virtual ~FHMQV_Domain() {}
+
+  /// \brief Construct a FHMQV domain
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  FHMQV_Domain(bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer) {}
+
+  /// \brief Construct a FHMQV domain
+  /// \param params group parameters and options
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  FHMQV_Domain(const GroupParameters &params, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer), m_groupParameters(params) {}
+
+  /// \brief Construct a FHMQV domain
+  /// \param bt BufferedTransformation with group parameters and options
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  FHMQV_Domain(BufferedTransformation &bt, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.BERDecode(bt);}
+
+  /// \brief Construct a FHMQV domain
+  /// \tparam T1 template parameter used as a constructor parameter
+  /// \param v1 first parameter
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details v1 is passed directly to the GROUP_PARAMETERS object.
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  template <class T1>
+  FHMQV_Domain(T1 v1, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.Initialize(v1);}
+
+  /// \brief Construct a FHMQV domain
+  /// \tparam T1 template parameter used as a constructor parameter
+  /// \tparam T2 template parameter used as a constructor parameter
+  /// \param v1 first parameter
+  /// \param v2 second parameter
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details v1 and v2 are passed directly to the GROUP_PARAMETERS object.
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  template <class T1, class T2>
+  FHMQV_Domain(T1 v1, T2 v2, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.Initialize(v1, v2);}
+
+  /// \brief Construct a FHMQV domain
+  /// \tparam T1 template parameter used as a constructor parameter
+  /// \tparam T2 template parameter used as a constructor parameter
+  /// \tparam T3 template parameter used as a constructor parameter
+  /// \param v1 first parameter
+  /// \param v2 second parameter
+  /// \param v3 third parameter
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details v1, v2 and v3 are passed directly to the GROUP_PARAMETERS object.
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  template <class T1, class T2, class T3>
+  FHMQV_Domain(T1 v1, T2 v2, T3 v3, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.Initialize(v1, v2, v3);}
+
+  /// \brief Construct a FHMQV domain
+  /// \tparam T1 template parameter used as a constructor parameter
+  /// \tparam T2 template parameter used as a constructor parameter
+  /// \tparam T3 template parameter used as a constructor parameter
+  /// \tparam T4 template parameter used as a constructor parameter
+  /// \param v1 first parameter
+  /// \param v2 second parameter
+  /// \param v3 third parameter
+  /// \param v4 third parameter
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details v1, v2, v3 and v4 are passed directly to the GROUP_PARAMETERS object.
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  template <class T1, class T2, class T3, class T4>
+  FHMQV_Domain(T1 v1, T2 v2, T3 v3, T4 v4, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.Initialize(v1, v2, v3, v4);}
+
+public:
+
+  /// \brief Retrieves the group parameters for this domain
+  /// \return the group parameters for this domain as a const reference
+  const GroupParameters & GetGroupParameters() const {return m_groupParameters;}
+
+  /// \brief Retrieves the group parameters for this domain
+  /// \return the group parameters for this domain as a non-const reference
+  GroupParameters & AccessGroupParameters() {return m_groupParameters;}
+
+  /// \brief Retrieves the crypto parameters for this domain
+  /// \return the crypto parameters for this domain as a non-const reference
+  CryptoParameters & AccessCryptoParameters() {return AccessAbstractGroupParameters();}
+
+  /// \brief Provides the size of the agreed value
+  /// \return size of agreed value produced in this domain
+  /// \details The length is calculated using <tt>GetEncodedElementSize(false)</tt>,
+  ///  which means the element is encoded in a non-reversible format. A
+  ///  non-reversible format means its a raw byte array, and it lacks presentation
+  ///  format like an ASN.1 BIT_STRING or OCTET_STRING.
+  unsigned int AgreedValueLength() const
+    {return GetAbstractGroupParameters().GetEncodedElementSize(false);}
+
+  /// \brief Provides the size of the static private key
+  /// \return size of static private keys in this domain
+  /// \details The length is calculated using the byte count of the subgroup order.
+  unsigned int StaticPrivateKeyLength() const
+    {return GetAbstractGroupParameters().GetSubgroupOrder().ByteCount();}
+
+  /// \brief Provides the size of the static public key
+  /// \return size of static public keys in this domain
+  /// \details The length is calculated using <tt>GetEncodedElementSize(true)</tt>,
+  ///  which means the element is encoded in a reversible format. A reversible
+  ///  format means it has a presentation format, and its an ANS.1 encoded element
+  ///  or point.
+  unsigned int StaticPublicKeyLength() const
+    {return GetAbstractGroupParameters().GetEncodedElementSize(true);}
+
+  /// \brief Generate static private key in this domain
+  /// \param rng a RandomNumberGenerator derived class
+  /// \param privateKey a byte buffer for the generated private key in this domain
+  /// \details The private key is a random scalar used as an exponent in the range
+  ///  <tt>[1,MaxExponent()]</tt>.
+  /// \pre <tt>COUNTOF(privateKey) == PrivateStaticKeyLength()</tt>
+  void GenerateStaticPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+  {
+    Integer x(rng, Integer::One(), GetAbstractGroupParameters().GetMaxExponent());
+    x.Encode(privateKey, StaticPrivateKeyLength());
+  }
+
+  /// \brief Generate a static public key from a private key in this domain
+  /// \param rng a RandomNumberGenerator derived class
+  /// \param privateKey a byte buffer with the previously generated private key
+  /// \param publicKey a byte buffer for the generated public key in this domain
+  /// \details The public key is an element or point on the curve, and its stored
+  ///  in a revrsible format. A reversible format means it has a presentation
+  ///  format, and its an ANS.1 encoded element or point.
+  /// \pre <tt>COUNTOF(publicKey) == PublicStaticKeyLength()</tt>
+  void GenerateStaticPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+  {
+    CRYPTOPP_UNUSED(rng);
+    const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
+    Integer x(privateKey, StaticPrivateKeyLength());
+    Element y = params.ExponentiateBase(x);
+    params.EncodeElement(true, y, publicKey);
+  }
+
+  /// \brief Provides the size of the ephemeral private key
+  /// \return size of ephemeral private keys in this domain
+  /// \details An ephemeral private key is a private key and public key.
+  ///  The serialized size is different than a static private key.
+  unsigned int EphemeralPrivateKeyLength() const {return StaticPrivateKeyLength() + StaticPublicKeyLength();}
+
+  /// \brief Provides the size of the ephemeral public key
+  /// \return size of ephemeral public keys in this domain
+  /// \details An ephemeral public key is a public key.
+  ///  The serialized size is the same as a static public key.
+  unsigned int EphemeralPublicKeyLength() const{return StaticPublicKeyLength();}
+
+  /// \brief Generate ephemeral private key in this domain
+  /// \param rng a RandomNumberGenerator derived class
+  /// \param privateKey a byte buffer for the generated private key in this domain
+  /// \pre <tt>COUNTOF(privateKey) == EphemeralPrivateKeyLength()</tt>
+  void GenerateEphemeralPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+  {
+    const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
+    Integer x(rng, Integer::One(), params.GetMaxExponent());
+    x.Encode(privateKey, StaticPrivateKeyLength());
+    Element y = params.ExponentiateBase(x);
+    params.EncodeElement(true, y, privateKey+StaticPrivateKeyLength());
+  }
+
+  /// \brief Generate ephemeral public key from a private key in this domain
+  /// \param rng a RandomNumberGenerator derived class
+  /// \param privateKey a byte buffer with the previously generated private key
+  /// \param publicKey a byte buffer for the generated public key in this domain
+  /// \pre <tt>COUNTOF(publicKey) == EphemeralPublicKeyLength()</tt>
+  void GenerateEphemeralPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+  {
+    CRYPTOPP_UNUSED(rng);
+    std::memcpy(publicKey, privateKey+StaticPrivateKeyLength(), EphemeralPublicKeyLength());
+  }
+
+  /// \brief Derive agreed value or shared secret
+  /// \param agreedValue the shared secret
+  /// \param staticPrivateKey your long term private key
+  /// \param ephemeralPrivateKey your ephemeral private key
+  /// \param staticOtherPublicKey couterparty's long term public key
+  /// \param ephemeralOtherPublicKey couterparty's ephemeral public key
+  /// \param validateStaticOtherPublicKey flag indicating validation
+  /// \return true upon success, false in case of failure
+  /// \details Agree() performs the authenticated key agreement. Agree()
+  ///  derives a shared secret from your private keys and couterparty's
+  ///  public keys. Each instance or run of the protocol should use a new
+  ///  ephemeral key pair.
+  /// \details The other's ephemeral public key will always be validated at
+  ///  Level 1 to ensure it is a point on the curve.
+  ///  <tt>validateStaticOtherPublicKey</tt> determines how thoroughly other's
+  ///  static public key is validated. If you have previously validated the
+  ///  couterparty's static public key, then use
+  ///  <tt>validateStaticOtherPublicKey=false</tt> to save time.
+  /// \pre <tt>COUNTOF(agreedValue) == AgreedValueLength()</tt>
+  /// \pre <tt>COUNTOF(staticPrivateKey) == StaticPrivateKeyLength()</tt>
+  /// \pre <tt>COUNTOF(ephemeralPrivateKey) == EphemeralPrivateKeyLength()</tt>
+  /// \pre <tt>COUNTOF(staticOtherPublicKey) == StaticPublicKeyLength()</tt>
+  /// \pre <tt>COUNTOF(ephemeralOtherPublicKey) == EphemeralPublicKeyLength()</tt>
+  bool Agree(byte *agreedValue,
+    const byte *staticPrivateKey, const byte *ephemeralPrivateKey,
+    const byte *staticOtherPublicKey, const byte *ephemeralOtherPublicKey,
+    bool validateStaticOtherPublicKey=true) const
+  {
+    const byte *XX = NULLPTR, *YY = NULLPTR, *AA = NULLPTR, *BB = NULLPTR;
+    size_t xxs = 0, yys = 0, aas = 0, bbs = 0;
+
+    // Depending on the role, this will hold either A's or B's static
+    // (long term) public key. AA or BB will then point into tt.
+    SecByteBlock tt(StaticPublicKeyLength());
+
+    try
+    {
+      this->GetMaterial().DoQuickSanityCheck();
+      const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
+
+      if(m_role == RoleServer)
+      {
+        Integer b(staticPrivateKey, StaticPrivateKeyLength());
+        Element B = params.ExponentiateBase(b);
+        params.EncodeElement(true, B, tt);
+
+        XX = ephemeralOtherPublicKey;
+        xxs = EphemeralPublicKeyLength();
+        YY = ephemeralPrivateKey + StaticPrivateKeyLength();
+        yys = EphemeralPublicKeyLength();
+        AA = staticOtherPublicKey;
+        aas = StaticPublicKeyLength();
+        BB = tt.BytePtr();
+        bbs = tt.SizeInBytes();
+      }
+      else
+      {
+        Integer a(staticPrivateKey, StaticPrivateKeyLength());
+        Element A = params.ExponentiateBase(a);
+        params.EncodeElement(true, A, tt);
+
+        XX = ephemeralPrivateKey + StaticPrivateKeyLength();
+        xxs = EphemeralPublicKeyLength();
+        YY = ephemeralOtherPublicKey;
+        yys = EphemeralPublicKeyLength();
+        AA = tt.BytePtr();
+        aas = tt.SizeInBytes();
+        BB = staticOtherPublicKey;
+        bbs = StaticPublicKeyLength();
+      }
+
+      Element VV1 = params.DecodeElement(staticOtherPublicKey, validateStaticOtherPublicKey);
+      Element VV2 = params.DecodeElement(ephemeralOtherPublicKey, true);
+
+      const Integer& q = params.GetSubgroupOrder();
+      const unsigned int len /*bytes*/ = (((q.BitCount()+1)/2 +7)/8);
+      SecByteBlock dd(len), ee(len);
+
+      Hash(NULLPTR, XX, xxs, YY, yys, AA, aas, BB, bbs, dd.BytePtr(), dd.SizeInBytes());
+      Integer d(dd.BytePtr(), dd.SizeInBytes());
+
+      Hash(NULLPTR, YY, yys, XX, xxs, AA, aas, BB, bbs, ee.BytePtr(), ee.SizeInBytes());
+      Integer e(ee.BytePtr(), ee.SizeInBytes());
+
+      Element sigma;
+      if(m_role == RoleServer)
+      {
+        Integer y(ephemeralPrivateKey, StaticPrivateKeyLength());
+        Integer b(staticPrivateKey, StaticPrivateKeyLength());
+        Integer s_B = (y + e * b) % q;
+
+        Element A = params.DecodeElement(AA, false);
+        Element X = params.DecodeElement(XX, false);
+
+        Element t1 = params.ExponentiateElement(A, d);
+        Element t2 = m_groupParameters.MultiplyElements(X, t1);
+
+        sigma = params.ExponentiateElement(t2, s_B);
+      }
+      else
+      {
+        Integer x(ephemeralPrivateKey, StaticPrivateKeyLength());
+        Integer a(staticPrivateKey, StaticPrivateKeyLength());
+        Integer s_A = (x + d * a) % q;
+
+        Element B = params.DecodeElement(BB, false);
+        Element Y = params.DecodeElement(YY, false);
+
+        Element t1 = params.ExponentiateElement(B, e);
+        Element t2 = m_groupParameters.MultiplyElements(Y, t1);
+
+        sigma = params.ExponentiateElement(t2, s_A);
+      }
+
+      Hash(&sigma, XX, xxs, YY, yys, AA, aas, BB, bbs, agreedValue, AgreedValueLength());
+    }
+    catch (DL_BadElement &)
+    {
+      CRYPTOPP_ASSERT(0);
+      return false;
+    }
+    return true;
+  }
+
+protected:
+
+  inline void Hash(const Element* sigma,
+    const byte* e1, size_t e1len, const byte* e2, size_t e2len,
+    const byte* s1, size_t s1len, const byte* s2, size_t s2len,
+    byte* digest, size_t dlen) const
+  {
+    HASH hash;
+    size_t idx = 0, req = dlen;
+    size_t blk = STDMIN(dlen, (size_t)HASH::DIGESTSIZE);
+
+    if(sigma)
+    {
+      //Integer x = GetAbstractGroupParameters().ConvertElementToInteger(*sigma);
+      //SecByteBlock sbb(x.MinEncodedSize());
+      //x.Encode(sbb.BytePtr(), sbb.SizeInBytes());
+      SecByteBlock sbb(GetAbstractGroupParameters().GetEncodedElementSize(false));
+      GetAbstractGroupParameters().EncodeElement(false, *sigma, sbb);
+      hash.Update(sbb.BytePtr(), sbb.SizeInBytes());
+    }
+
+    hash.Update(e1, e1len);
+    hash.Update(e2, e2len);
+    hash.Update(s1, s1len);
+    hash.Update(s2, s2len);
+
+    hash.TruncatedFinal(digest, blk);
+    req -= blk;
+
+    // All this to catch tail bytes for large curves and small hashes
+    while(req != 0)
+    {
+      hash.Update(&digest[idx], (size_t)HASH::DIGESTSIZE);
+
+      idx += (size_t)HASH::DIGESTSIZE;
+      blk = STDMIN(req, (size_t)HASH::DIGESTSIZE);
+      hash.TruncatedFinal(&digest[idx], blk);
+
+      req -= blk;
+    }
+  }
+
+private:
+
+  // The paper uses Initiator and Recipient - make it classical.
+  enum KeyAgreementRole { RoleServer = 1, RoleClient };
+
+  DL_GroupParameters<Element> & AccessAbstractGroupParameters() {return m_groupParameters;}
+  const DL_GroupParameters<Element> & GetAbstractGroupParameters() const{return m_groupParameters;}
+
+  GroupParameters m_groupParameters;
+  KeyAgreementRole m_role;
+};
+
+/// \brief Fully Hashed Menezes-Qu-Vanstone in GF(p)
+/// \details This implementation follows Augustin P. Sarr and Philippe Elbaz–Vincent, and Jean–Claude Bajard's
+///   <a href="http://eprint.iacr.org/2009/408">A Secure and Efficient Authenticated Diffie-Hellman Protocol</a>.
+///   Note: this is FHMQV, Protocol 5, from page 11; and not FHMQV-C.
+/// \sa FHMQV, MQV_Domain, FHMQV_Domain, AuthenticatedKeyAgreementDomain
+/// \since Crypto++ 5.6.4
+typedef FHMQV_Domain<DL_GroupParameters_GFP_DefaultSafePrime> FHMQV;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/files.cpp b/runtime/third_party/cryptopp/files.cpp
new file mode 100644
index 0000000..51f87c2
--- /dev/null
+++ b/runtime/third_party/cryptopp/files.cpp
@@ -0,0 +1,300 @@
+// files.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "files.h"
+
+#include <iostream>
+#include <fstream>
+#include <limits>
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+/// \brief Disable badbit, failbit and eof exceptions
+/// \sa https://github.com/weidai11/cryptopp/pull/968 and
+///  https://www.cplusplus.com/reference/ios/ios/exceptions
+class IosExceptionMask
+{
+public:
+	IosExceptionMask(std::istream& stream) : m_stream(stream) {
+		m_mask = m_stream.exceptions();
+		m_stream.exceptions(static_cast<std::ios::iostate>(0));
+	}
+
+	IosExceptionMask(std::istream& stream, std::ios::iostate newMask) : m_stream(stream) {
+		m_mask = m_stream.exceptions();
+		m_stream.exceptions(newMask);
+	}
+
+	~IosExceptionMask() {
+		m_stream.exceptions(m_mask);
+	}
+
+private:
+	std::istream& m_stream;
+	std::ios::iostate m_mask;
+};
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void Files_TestInstantiations()
+{
+	FileStore f0;
+	FileSource f1;
+	FileSink f2;
+}
+#endif
+
+void FileStore::StoreInitialize(const NameValuePairs &parameters)
+{
+	m_waiting = false;
+	m_stream = NULLPTR;
+	m_file.release();
+
+	const char *fileName = NULLPTR;
+#if defined(CRYPTOPP_UNIX_AVAILABLE) || CRYPTOPP_MSC_VERSION >= 1400
+	const wchar_t *fileNameWide = NULLPTR;
+	if (!parameters.GetValue(Name::InputFileNameWide(), fileNameWide))
+#endif
+		if (!parameters.GetValue(Name::InputFileName(), fileName))
+		{
+			parameters.GetValue(Name::InputStreamPointer(), m_stream);
+			return;
+		}
+
+	std::ios::openmode binary = parameters.GetValueWithDefault(Name::InputBinaryMode(), true) ? std::ios::binary : std::ios::openmode(0);
+	m_file.reset(new std::ifstream);
+#ifdef CRYPTOPP_UNIX_AVAILABLE
+	std::string narrowed;
+	if (fileNameWide)
+		fileName = (narrowed = StringNarrow(fileNameWide)).c_str();
+#endif
+#if CRYPTOPP_MSC_VERSION >= 1400
+	if (fileNameWide)
+	{
+		m_file->open(fileNameWide, std::ios::in | binary);
+		if (!*m_file)
+			throw OpenErr(StringNarrow(fileNameWide, false));
+	}
+#endif
+	if (fileName)
+	{
+		m_file->open(fileName, std::ios::in | binary);
+		if (!*m_file)
+			throw OpenErr(fileName);
+	}
+	m_stream = m_file.get();
+}
+
+lword FileStore::MaxRetrievable() const
+{
+	if (!m_stream)
+		return 0;
+
+	// Disable badbit, failbit and eof exceptions
+	IosExceptionMask guard(*m_stream);
+
+	// Clear error bits due to seekg(). Also see
+	// https://github.com/weidai11/cryptopp/pull/968
+	std::streampos current = m_stream->tellg();
+	std::streampos end = m_stream->seekg(0, std::ios::end).tellg();
+	m_stream->clear();
+	m_stream->seekg(current);
+	m_stream->clear();
+
+	// Return max for a non-seekable stream
+	// https://www.cplusplus.com/reference/istream/istream/tellg
+	if (end == static_cast<std::streampos>(-1))
+		return LWORD_MAX;
+
+	return end-current;
+}
+
+size_t FileStore::TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel, bool blocking)
+{
+	if (!m_stream)
+	{
+		transferBytes = 0;
+		return 0;
+	}
+
+	lword size=transferBytes;
+	transferBytes = 0;
+
+	if (m_waiting)
+		goto output;
+
+	size_t spaceSize, blockedBytes;
+	while (size && m_stream->good())
+	{
+		spaceSize = 1024;
+		m_space = HelpCreatePutSpace(target, channel, 1, UnsignedMin(size_t(SIZE_MAX), size), spaceSize);
+		m_stream->read((char *)m_space, (std::streamsize)STDMIN(size, (lword)spaceSize));
+		m_len = (size_t)m_stream->gcount();
+
+output:
+		blockedBytes = target.ChannelPutModifiable2(channel, m_space, m_len, 0, blocking);
+		m_waiting = blockedBytes > 0;
+		if (m_waiting)
+			return blockedBytes;
+		size -= m_len;
+		transferBytes += m_len;
+	}
+
+	if (!m_stream->good() && !m_stream->eof())
+		throw ReadErr();
+
+	return 0;
+}
+
+size_t FileStore::CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end, const std::string &channel, bool blocking) const
+{
+	if (!m_stream)
+		return 0;
+
+	if (begin == 0 && end == 1)
+	{
+		int result = m_stream->peek();
+		if (result == std::char_traits<char>::eof())
+			return 0;
+		else
+		{
+			size_t blockedBytes = target.ChannelPut(channel, byte(result), blocking);
+			begin += 1-blockedBytes;
+			return blockedBytes;
+		}
+	}
+
+	// TODO: figure out what happens on cin
+	std::streampos current = m_stream->tellg();
+	std::streampos endPosition = m_stream->seekg(0, std::ios::end).tellg();
+	std::streampos newPosition = current + static_cast<std::streamoff>(begin);
+
+	if (newPosition >= endPosition)
+	{
+		m_stream->seekg(current);
+		return 0;	// don't try to seek beyond the end of file
+	}
+	m_stream->seekg(newPosition);
+	try
+	{
+		CRYPTOPP_ASSERT(!m_waiting);
+		lword copyMax = end-begin;
+		size_t blockedBytes = const_cast<FileStore *>(this)->TransferTo2(target, copyMax, channel, blocking);
+		begin += copyMax;
+		if (blockedBytes)
+		{
+			const_cast<FileStore *>(this)->m_waiting = false;
+			return blockedBytes;
+		}
+	}
+	catch(...)
+	{
+		m_stream->clear();
+		m_stream->seekg(current);
+		throw;
+	}
+	m_stream->clear();
+	m_stream->seekg(current);
+
+	return 0;
+}
+
+lword FileStore::Skip(lword skipMax)
+{
+	if (!m_stream)
+		return 0;
+
+	lword oldPos = m_stream->tellg();
+	std::istream::off_type offset;
+	if (!SafeConvert(skipMax, offset))
+		throw InvalidArgument("FileStore: maximum seek offset exceeded");
+	m_stream->seekg(offset, std::ios::cur);
+	return (lword)m_stream->tellg() - oldPos;
+}
+
+void FileSink::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_stream = NULLPTR;
+	m_file.release();
+
+	const char *fileName = NULLPTR;
+#if defined(CRYPTOPP_UNIX_AVAILABLE) || CRYPTOPP_MSC_VERSION >= 1400
+	const wchar_t *fileNameWide = NULLPTR;
+	if (!parameters.GetValue(Name::OutputFileNameWide(), fileNameWide))
+#endif
+		if (!parameters.GetValue(Name::OutputFileName(), fileName))
+		{
+			parameters.GetValue(Name::OutputStreamPointer(), m_stream);
+			return;
+		}
+
+	std::ios::openmode binary = parameters.GetValueWithDefault(Name::OutputBinaryMode(), true) ? std::ios::binary : std::ios::openmode(0);
+	m_file.reset(new std::ofstream);
+#ifdef CRYPTOPP_UNIX_AVAILABLE
+	std::string narrowed;
+	if (fileNameWide)
+		fileName = (narrowed = StringNarrow(fileNameWide)).c_str();
+#elif (CRYPTOPP_MSC_VERSION >= 1400)
+	if (fileNameWide)
+	{
+		m_file->open(fileNameWide, std::ios::out | std::ios::trunc | binary);
+		if (!*m_file)
+			throw OpenErr(StringNarrow(fileNameWide, false));
+	}
+#endif
+	if (fileName)
+	{
+		m_file->open(fileName, std::ios::out | std::ios::trunc | binary);
+		if (!*m_file)
+			throw OpenErr(fileName);
+	}
+	m_stream = m_file.get();
+}
+
+bool FileSink::IsolatedFlush(bool hardFlush, bool blocking)
+{
+	CRYPTOPP_UNUSED(hardFlush), CRYPTOPP_UNUSED(blocking);
+	if (!m_stream)
+		throw Err("FileSink: output stream not opened");
+
+	m_stream->flush();
+	if (!m_stream->good())
+		throw WriteErr();
+
+	return false;
+}
+
+size_t FileSink::Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+{
+	CRYPTOPP_UNUSED(blocking);
+	if (!m_stream)
+		throw Err("FileSink: output stream not opened");
+
+	while (length > 0)
+	{
+		std::streamsize size;
+		if (!SafeConvert(length, size))
+			size = ((std::numeric_limits<std::streamsize>::max)());
+		m_stream->write((const char *)inString, size);
+		inString += size;
+		length -= (size_t)size;
+	}
+
+	if (messageEnd)
+		m_stream->flush();
+
+	if (!m_stream->good())
+		throw WriteErr();
+
+	return 0;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/files.h b/runtime/third_party/cryptopp/files.h
new file mode 100644
index 0000000..c09da5a
--- /dev/null
+++ b/runtime/third_party/cryptopp/files.h
@@ -0,0 +1,181 @@
+// files.h - originally written and placed in the public domain by Wei Dai
+
+/// \file files.h
+/// \brief Classes providing file-based library services
+/// \since Crypto++ 1.0
+
+#ifndef CRYPTOPP_FILES_H
+#define CRYPTOPP_FILES_H
+
+#include "cryptlib.h"
+#include "filters.h"
+#include "argnames.h"
+#include "smartptr.h"
+
+#include <iostream>
+#include <fstream>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Implementation of Store interface
+/// \details file-based implementation of Store interface
+class CRYPTOPP_DLL FileStore : public Store, private FilterPutSpaceHelper, public NotCopyable
+{
+public:
+	/// \brief Exception thrown when file-based error is encountered
+	class Err : public Exception
+	{
+	public:
+		Err(const std::string &s) : Exception(IO_ERROR, s) {}
+	};
+	/// \brief Exception thrown when file-based open error is encountered
+	class OpenErr : public Err {public: OpenErr(const std::string &filename) : Err("FileStore: error opening file for reading: " + filename) {}};
+	/// \brief Exception thrown when file-based read error is encountered
+	class ReadErr : public Err {public: ReadErr() : Err("FileStore: error reading file") {}};
+
+	/// \brief Construct a FileStore
+	FileStore() : m_stream(NULLPTR), m_space(NULLPTR), m_len(0), m_waiting(0) {}
+
+	/// \brief Construct a FileStore
+	/// \param in an existing stream
+	FileStore(std::istream &in) : m_stream(NULLPTR), m_space(NULLPTR), m_len(0), m_waiting(0)
+		{StoreInitialize(MakeParameters(Name::InputStreamPointer(), &in));}
+
+	/// \brief Construct a FileStore
+	/// \param filename the narrow name of the file to open
+	FileStore(const char *filename) : m_stream(NULLPTR), m_space(NULLPTR), m_len(0), m_waiting(0)
+		{StoreInitialize(MakeParameters(Name::InputFileName(), filename ? filename : ""));}
+
+#if defined(CRYPTOPP_UNIX_AVAILABLE) || defined(CRYPTOPP_DOXYGEN_PROCESSING) || (CRYPTOPP_MSC_VERSION >= 1400)
+	/// \brief Construct a FileStore
+	/// \param filename the Unicode name of the file to open
+	/// \details On non-Windows OS, this function assumes that setlocale() has been called.
+	FileStore(const wchar_t *filename)
+		{StoreInitialize(MakeParameters(Name::InputFileNameWide(), filename));}
+#endif
+
+	/// \brief Retrieves the internal stream
+	/// \return the internal stream pointer
+	std::istream* GetStream() {return m_stream;}
+
+	/// \brief Retrieves the internal stream
+	/// \return the internal stream pointer
+	const std::istream* GetStream() const {return m_stream;}
+
+	/// \brief Provides the number of bytes ready for retrieval
+	/// \return the number of bytes ready for retrieval
+	/// \details All retrieval functions return the actual number of bytes retrieved, which is
+	///  the lesser of the request number and  MaxRetrievable()
+	lword MaxRetrievable() const;
+	size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+	size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const;
+	lword Skip(lword skipMax=ULONG_MAX);
+
+private:
+	void StoreInitialize(const NameValuePairs &parameters);
+
+	member_ptr<std::ifstream> m_file;
+	std::istream *m_stream;
+	byte *m_space;
+	size_t m_len;
+	bool m_waiting;
+};
+
+/// \brief Implementation of Store interface
+/// \details file-based implementation of Store interface
+class CRYPTOPP_DLL FileSource : public SourceTemplate<FileStore>
+{
+public:
+	typedef FileStore::Err Err;
+	typedef FileStore::OpenErr OpenErr;
+	typedef FileStore::ReadErr ReadErr;
+
+	/// \brief Construct a FileSource
+	FileSource(BufferedTransformation *attachment = NULLPTR)
+		: SourceTemplate<FileStore>(attachment) {}
+
+	/// \brief Construct a FileSource
+	/// \param in an existing stream
+	/// \param pumpAll flag indicating if source data should be pumped to its attached transformation
+	/// \param attachment an optional attached transformation
+	FileSource(std::istream &in, bool pumpAll, BufferedTransformation *attachment = NULLPTR)
+		: SourceTemplate<FileStore>(attachment) {SourceInitialize(pumpAll, MakeParameters(Name::InputStreamPointer(), &in));}
+
+	/// \brief Construct a FileSource
+	/// \param filename the narrow name of the file to open
+	/// \param pumpAll flag indicating if source data should be pumped to its attached transformation
+	/// \param attachment an optional attached transformation
+	/// \param binary flag indicating if the file is binary
+	FileSource(const char *filename, bool pumpAll, BufferedTransformation *attachment = NULLPTR, bool binary=true)
+		: SourceTemplate<FileStore>(attachment) {SourceInitialize(pumpAll, MakeParameters(Name::InputFileName(), filename)(Name::InputBinaryMode(), binary));}
+
+#if defined(CRYPTOPP_UNIX_AVAILABLE) || defined(CRYPTOPP_DOXYGEN_PROCESSING) || (CRYPTOPP_MSC_VERSION >= 1400)
+	/// \brief Construct a FileSource
+	/// \param filename the Unicode name of the file to open
+	/// \param pumpAll flag indicating if source data should be pumped to its attached transformation
+	/// \param attachment an optional attached transformation
+	/// \param binary flag indicating if the file is binary
+	/// \details On non-Windows OS, this function assumes that setlocale() has been called.
+	FileSource(const wchar_t *filename, bool pumpAll, BufferedTransformation *attachment = NULLPTR, bool binary=true)
+		: SourceTemplate<FileStore>(attachment) {SourceInitialize(pumpAll, MakeParameters(Name::InputFileNameWide(), filename)(Name::InputBinaryMode(), binary));}
+#endif
+
+	/// \brief Retrieves the internal stream
+	/// \return the internal stream pointer
+	std::istream* GetStream() {return m_store.GetStream();}
+};
+
+/// \brief Implementation of Store interface
+/// \details file-based implementation of Sink interface
+class CRYPTOPP_DLL FileSink : public Sink, public NotCopyable
+{
+public:
+	/// \brief Exception thrown when file-based error is encountered
+	class Err : public Exception
+	{
+	public:
+		Err(const std::string &s) : Exception(IO_ERROR, s) {}
+	};
+	/// \brief Exception thrown when file-based open error is encountered
+	class OpenErr : public Err {public: OpenErr(const std::string &filename) : Err("FileSink: error opening file for writing: " + filename) {}};
+	/// \brief Exception thrown when file-based write error is encountered
+	class WriteErr : public Err {public: WriteErr() : Err("FileSink: error writing file") {}};
+
+	/// \brief Construct a FileSink
+	FileSink() : m_stream(NULLPTR) {}
+
+	/// \brief Construct a FileSink
+	/// \param out an existing stream
+	FileSink(std::ostream &out)
+		{IsolatedInitialize(MakeParameters(Name::OutputStreamPointer(), &out));}
+
+	/// \brief Construct a FileSink
+	/// \param filename the narrow name of the file to open
+	/// \param binary flag indicating if the file is binary
+	FileSink(const char *filename, bool binary=true)
+		{IsolatedInitialize(MakeParameters(Name::OutputFileName(), filename)(Name::OutputBinaryMode(), binary));}
+
+#if defined(CRYPTOPP_UNIX_AVAILABLE) || (CRYPTOPP_MSC_VERSION >= 1400)
+	/// \brief Construct a FileSink
+	/// \param filename the Unicode name of the file to open
+	/// \details On non-Windows OS, this function assumes that setlocale() has been called.
+	FileSink(const wchar_t *filename, bool binary=true)
+		{IsolatedInitialize(MakeParameters(Name::OutputFileNameWide(), filename)(Name::OutputBinaryMode(), binary));}
+#endif
+
+	/// \brief Retrieves the internal stream
+	/// \return the internal stream pointer
+	std::ostream* GetStream() {return m_stream;}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+	bool IsolatedFlush(bool hardFlush, bool blocking);
+
+private:
+	member_ptr<std::ofstream> m_file;
+	std::ostream *m_stream;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/filters.cpp b/runtime/third_party/cryptopp/filters.cpp
new file mode 100644
index 0000000..af2672b
--- /dev/null
+++ b/runtime/third_party/cryptopp/filters.cpp
@@ -0,0 +1,1266 @@
+// filters.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4189 4355)
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "filters.h"
+#include "mqueue.h"
+#include "fltrimpl.h"
+#include "argnames.h"
+#include "smartptr.h"
+#include "stdcpp.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+Filter::Filter(BufferedTransformation *attachment)
+	: m_attachment(attachment), m_inputPosition(0), m_continueAt(0)
+{
+}
+
+BufferedTransformation * Filter::NewDefaultAttachment() const
+{
+	return new MessageQueue;
+}
+
+BufferedTransformation * Filter::AttachedTransformation()
+{
+	if (m_attachment.get() == NULLPTR)
+		m_attachment.reset(NewDefaultAttachment());
+	return m_attachment.get();
+}
+
+const BufferedTransformation *Filter::AttachedTransformation() const
+{
+	if (m_attachment.get() == NULLPTR)
+		const_cast<Filter *>(this)->m_attachment.reset(NewDefaultAttachment());
+	return m_attachment.get();
+}
+
+void Filter::Detach(BufferedTransformation *newOut)
+{
+	m_attachment.reset(newOut);
+}
+
+void Filter::Insert(Filter *filter)
+{
+	filter->m_attachment.reset(m_attachment.release());
+	m_attachment.reset(filter);
+}
+
+size_t Filter::CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end, const std::string &channel, bool blocking) const
+{
+	return AttachedTransformation()->CopyRangeTo2(target, begin, end, channel, blocking);
+}
+
+size_t Filter::TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel, bool blocking)
+{
+	return AttachedTransformation()->TransferTo2(target, transferBytes, channel, blocking);
+}
+
+void Filter::Initialize(const NameValuePairs &parameters, int propagation)
+{
+	m_inputPosition = m_continueAt = 0;
+	IsolatedInitialize(parameters);
+	PropagateInitialize(parameters, propagation);
+}
+
+bool Filter::Flush(bool hardFlush, int propagation, bool blocking)
+{
+	switch (m_continueAt)
+	{
+	case 0:
+		if (IsolatedFlush(hardFlush, blocking))
+			return true;
+		// fall through
+	case 1:
+		if (OutputFlush(1, hardFlush, propagation, blocking))
+			return true;
+		// fall through
+	default: ;
+	}
+	return false;
+}
+
+bool Filter::MessageSeriesEnd(int propagation, bool blocking)
+{
+	switch (m_continueAt)
+	{
+	case 0:
+		if (IsolatedMessageSeriesEnd(blocking))
+			return true;
+		// fall through
+	case 1:
+		if (ShouldPropagateMessageSeriesEnd() && OutputMessageSeriesEnd(1, propagation, blocking))
+			return true;
+		// fall through
+	default: ;
+	}
+	return false;
+}
+
+void Filter::PropagateInitialize(const NameValuePairs &parameters, int propagation)
+{
+	if (propagation)
+		AttachedTransformation()->Initialize(parameters, propagation-1);
+}
+
+size_t Filter::OutputModifiable(int outputSite, byte *inString, size_t length, int messageEnd, bool blocking, const std::string &channel)
+{
+	if (messageEnd)
+		messageEnd--;
+	size_t result = AttachedTransformation()->ChannelPutModifiable2(channel, inString, length, messageEnd, blocking);
+	m_continueAt = result ? outputSite : 0;
+	return result;
+}
+
+size_t Filter::Output(int outputSite, const byte *inString, size_t length, int messageEnd, bool blocking, const std::string &channel)
+{
+	if (messageEnd)
+		messageEnd--;
+	size_t result = AttachedTransformation()->ChannelPut2(channel, inString, length, messageEnd, blocking);
+	m_continueAt = result ? outputSite : 0;
+	return result;
+}
+
+bool Filter::OutputFlush(int outputSite, bool hardFlush, int propagation, bool blocking, const std::string &channel)
+{
+	if (propagation && AttachedTransformation()->ChannelFlush(channel, hardFlush, propagation-1, blocking))
+	{
+		m_continueAt = outputSite;
+		return true;
+	}
+	m_continueAt = 0;
+	return false;
+}
+
+bool Filter::OutputMessageSeriesEnd(int outputSite, int propagation, bool blocking, const std::string &channel)
+{
+	if (propagation && AttachedTransformation()->ChannelMessageSeriesEnd(channel, propagation-1, blocking))
+	{
+		m_continueAt = outputSite;
+		return true;
+	}
+	m_continueAt = 0;
+	return false;
+}
+
+// *************************************************************
+
+void MeterFilter::ResetMeter()
+{
+	m_currentMessageBytes = m_totalBytes = m_currentSeriesMessages = m_totalMessages = m_totalMessageSeries = 0;
+	m_rangesToSkip.clear();
+}
+
+void MeterFilter::AddRangeToSkip(unsigned int message, lword position, lword size, bool sortNow)
+{
+	MessageRange r = {message, position, size};
+	m_rangesToSkip.push_back(r);
+	if (sortNow)
+		std::sort(m_rangesToSkip.begin(), m_rangesToSkip.end());
+}
+
+size_t MeterFilter::PutMaybeModifiable(byte *begin, size_t length, int messageEnd, bool blocking, bool modifiable)
+{
+	if (!m_transparent)
+		return 0;
+
+	size_t t;
+	FILTER_BEGIN;
+
+	m_begin = begin;
+	m_length = length;
+
+	while (m_length > 0 || messageEnd)
+	{
+		if (m_length > 0  && !m_rangesToSkip.empty() && m_rangesToSkip.front().message == m_totalMessages && m_currentMessageBytes + m_length > m_rangesToSkip.front().position)
+		{
+			FILTER_OUTPUT_MAYBE_MODIFIABLE(1, m_begin, t = (size_t)SaturatingSubtract(m_rangesToSkip.front().position, m_currentMessageBytes), false, modifiable);
+
+			CRYPTOPP_ASSERT(t < m_length);
+			m_begin = PtrAdd(m_begin, t);
+			m_length -= t;
+			m_currentMessageBytes += t;
+			m_totalBytes += t;
+
+			if (m_currentMessageBytes + m_length < m_rangesToSkip.front().position + m_rangesToSkip.front().size)
+				t = m_length;
+			else
+			{
+				t = (size_t)SaturatingSubtract(m_rangesToSkip.front().position + m_rangesToSkip.front().size, m_currentMessageBytes);
+				CRYPTOPP_ASSERT(t <= m_length);
+				m_rangesToSkip.pop_front();
+			}
+
+			m_begin = PtrAdd(m_begin, t);
+			m_length -= t;
+			m_currentMessageBytes += t;
+			m_totalBytes += t;
+		}
+		else
+		{
+			FILTER_OUTPUT_MAYBE_MODIFIABLE(2, m_begin, m_length, messageEnd, modifiable);
+
+			m_currentMessageBytes += m_length;
+			m_totalBytes += m_length;
+			m_length = 0;
+
+			if (messageEnd)
+			{
+				m_currentMessageBytes = 0;
+				m_currentSeriesMessages++;
+				m_totalMessages++;
+				messageEnd = false;
+			}
+		}
+	}
+
+	FILTER_END_NO_MESSAGE_END;
+}
+
+size_t MeterFilter::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	return PutMaybeModifiable(const_cast<byte *>(begin), length, messageEnd, blocking, false);
+}
+
+size_t MeterFilter::PutModifiable2(byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	return PutMaybeModifiable(begin, length, messageEnd, blocking, true);
+}
+
+bool MeterFilter::IsolatedMessageSeriesEnd(bool blocking)
+{
+	CRYPTOPP_UNUSED(blocking);
+	m_currentMessageBytes = 0;
+	m_currentSeriesMessages = 0;
+	m_totalMessageSeries++;
+	return false;
+}
+
+// *************************************************************
+
+void FilterWithBufferedInput::BlockQueue::ResetQueue(size_t blockSize, size_t maxBlocks)
+{
+	m_buffer.New(blockSize * maxBlocks);
+	m_blockSize = blockSize;
+	m_maxBlocks = maxBlocks;
+	m_size = 0;
+	m_begin = m_buffer;
+}
+
+byte *FilterWithBufferedInput::BlockQueue::GetBlock()
+{
+	if (m_size >= m_blockSize)
+	{
+		byte *ptr = m_begin;
+		if ((m_begin = PtrAdd(m_begin, m_blockSize)) == m_buffer.end())
+			m_begin = m_buffer;
+		m_size -= m_blockSize;
+		return ptr;
+	}
+	else
+		return NULLPTR;
+}
+
+byte *FilterWithBufferedInput::BlockQueue::GetContigousBlocks(size_t &numberOfBytes)
+{
+	numberOfBytes = STDMIN(numberOfBytes, STDMIN<size_t>(PtrDiff(m_buffer.end(), m_begin), m_size));
+	byte *ptr = m_begin;
+	m_begin = PtrAdd(m_begin, numberOfBytes);
+	m_size -= numberOfBytes;
+	if (m_size == 0 || m_begin == m_buffer.end())
+		m_begin = m_buffer;
+	return ptr;
+}
+
+size_t FilterWithBufferedInput::BlockQueue::GetAll(byte *outString)
+{
+	// Avoid passing NULL pointer to memcpy
+	if (!outString) return 0;
+
+	size_t size = m_size;
+	size_t numberOfBytes = m_maxBlocks*m_blockSize;
+	const byte *ptr = GetContigousBlocks(numberOfBytes);
+	std::memcpy(outString, ptr, numberOfBytes);
+	std::memcpy(PtrAdd(outString, numberOfBytes), m_begin, m_size);
+	m_size = 0;
+	return size;
+}
+
+void FilterWithBufferedInput::BlockQueue::Put(const byte *inString, size_t length)
+{
+	// Avoid passing NULL pointer to memcpy
+	if (!inString || !length) return;
+
+	CRYPTOPP_ASSERT(m_size + length <= m_buffer.size());
+	byte *end = (m_size < static_cast<size_t>(PtrDiff(m_buffer.end(), m_begin)) ?
+		PtrAdd(m_begin, m_size) : PtrAdd(m_begin, m_size - m_buffer.size()));
+	size_t len = STDMIN(length, size_t(m_buffer.end()-end));
+	std::memcpy(end, inString, len);
+	if (len < length)
+		std::memcpy(m_buffer, PtrAdd(inString, len), length-len);
+	m_size += length;
+}
+
+FilterWithBufferedInput::FilterWithBufferedInput(BufferedTransformation *attachment)
+	: Filter(attachment), m_firstSize(SIZE_MAX), m_blockSize(0), m_lastSize(SIZE_MAX), m_firstInputDone(false)
+{
+}
+
+FilterWithBufferedInput::FilterWithBufferedInput(size_t firstSize, size_t blockSize, size_t lastSize, BufferedTransformation *attachment)
+	: Filter(attachment), m_firstSize(firstSize), m_blockSize(blockSize), m_lastSize(lastSize), m_firstInputDone(false)
+{
+	if (m_firstSize == SIZE_MAX || m_blockSize < 1 || m_lastSize == SIZE_MAX)
+		throw InvalidArgument("FilterWithBufferedInput: invalid buffer size");
+
+	m_queue.ResetQueue(1, m_firstSize);
+}
+
+void FilterWithBufferedInput::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	InitializeDerivedAndReturnNewSizes(parameters, m_firstSize, m_blockSize, m_lastSize);
+	if (m_firstSize == SIZE_MAX || m_blockSize < 1 || m_lastSize == SIZE_MAX)
+		throw InvalidArgument("FilterWithBufferedInput: invalid buffer size");
+	m_queue.ResetQueue(1, m_firstSize);
+	m_firstInputDone = false;
+}
+
+bool FilterWithBufferedInput::IsolatedFlush(bool hardFlush, bool blocking)
+{
+	if (!blocking)
+		throw BlockingInputOnly("FilterWithBufferedInput");
+
+	if (hardFlush)
+		ForceNextPut();
+	FlushDerived();
+
+	return false;
+}
+
+size_t FilterWithBufferedInput::PutMaybeModifiable(byte *inString, size_t length, int messageEnd, bool blocking, bool modifiable)
+{
+	if (!blocking)
+		throw BlockingInputOnly("FilterWithBufferedInput");
+
+	if (length != 0)
+	{
+		size_t newLength = m_queue.CurrentSize() + length;
+
+		if (!m_firstInputDone && newLength >= m_firstSize)
+		{
+			size_t len = m_firstSize - m_queue.CurrentSize();
+			m_queue.Put(inString, len);
+			FirstPut(m_queue.GetContigousBlocks(m_firstSize));
+			CRYPTOPP_ASSERT(m_queue.CurrentSize() == 0);
+			m_queue.ResetQueue(m_blockSize, (2*m_blockSize+m_lastSize-2)/m_blockSize);
+
+			inString = PtrAdd(inString, len);
+			newLength -= m_firstSize;
+			m_firstInputDone = true;
+		}
+
+		if (m_firstInputDone)
+		{
+			if (m_blockSize == 1)
+			{
+				while (newLength > m_lastSize && m_queue.CurrentSize() > 0)
+				{
+					size_t len = newLength - m_lastSize;
+					byte *ptr = m_queue.GetContigousBlocks(len);
+					NextPutModifiable(ptr, len);
+					newLength -= len;
+				}
+
+				if (newLength > m_lastSize)
+				{
+					size_t len = newLength - m_lastSize;
+					NextPutMaybeModifiable(inString, len, modifiable);
+					inString = PtrAdd(inString, len);
+					newLength -= len;
+				}
+			}
+			else
+			{
+				while (newLength >= m_blockSize + m_lastSize && m_queue.CurrentSize() >= m_blockSize)
+				{
+					NextPutModifiable(m_queue.GetBlock(), m_blockSize);
+					newLength -= m_blockSize;
+				}
+
+				if (newLength >= m_blockSize + m_lastSize && m_queue.CurrentSize() > 0)
+				{
+					CRYPTOPP_ASSERT(m_queue.CurrentSize() < m_blockSize);
+					size_t len = m_blockSize - m_queue.CurrentSize();
+					m_queue.Put(inString, len);
+					inString = PtrAdd(inString, len);
+					NextPutModifiable(m_queue.GetBlock(), m_blockSize);
+					newLength -= m_blockSize;
+				}
+
+				if (newLength >= m_blockSize + m_lastSize)
+				{
+					size_t len = RoundDownToMultipleOf(newLength - m_lastSize, m_blockSize);
+					NextPutMaybeModifiable(inString, len, modifiable);
+					inString = PtrAdd(inString, len);
+					newLength -= len;
+				}
+			}
+		}
+
+		m_queue.Put(inString, newLength - m_queue.CurrentSize());
+	}
+
+	if (messageEnd)
+	{
+		if (!m_firstInputDone && m_firstSize==0)
+			FirstPut(NULLPTR);
+
+		SecByteBlock temp(m_queue.CurrentSize());
+		m_queue.GetAll(temp);
+		LastPut(temp, temp.size());
+
+		m_firstInputDone = false;
+		m_queue.ResetQueue(1, m_firstSize);
+
+		// Cast to void to suppress Coverity finding
+		(void)Output(1, NULLPTR, 0, messageEnd, blocking);
+	}
+	return 0;
+}
+
+void FilterWithBufferedInput::ForceNextPut()
+{
+	if (!m_firstInputDone)
+		return;
+
+	if (m_blockSize > 1)
+	{
+		while (m_queue.CurrentSize() >= m_blockSize)
+			NextPutModifiable(m_queue.GetBlock(), m_blockSize);
+	}
+	else
+	{
+		size_t len;
+		while ((len = m_queue.CurrentSize()) > 0)
+			NextPutModifiable(m_queue.GetContigousBlocks(len), len);
+	}
+}
+
+void FilterWithBufferedInput::NextPutMultiple(const byte *inString, size_t length)
+{
+	CRYPTOPP_ASSERT(m_blockSize > 1);	// m_blockSize = 1 should always override this function
+	while (length > 0)
+	{
+		CRYPTOPP_ASSERT(length >= m_blockSize);
+		NextPutSingle(inString);
+		inString = PtrAdd(inString, m_blockSize);
+		length -= m_blockSize;
+	}
+}
+
+// *************************************************************
+
+void Redirector::Initialize(const NameValuePairs &parameters, int propagation)
+{
+	m_target = parameters.GetValueWithDefault("RedirectionTargetPointer", (BufferedTransformation*)NULLPTR);
+	m_behavior = parameters.GetIntValueWithDefault("RedirectionBehavior", PASS_EVERYTHING);
+
+	if (m_target && GetPassSignals())
+		m_target->Initialize(parameters, propagation);
+}
+
+// *************************************************************
+
+ProxyFilter::ProxyFilter(BufferedTransformation *filter, size_t firstSize, size_t lastSize, BufferedTransformation *attachment)
+	: FilterWithBufferedInput(firstSize, 1, lastSize, attachment), m_filter(filter)
+{
+	if (m_filter.get())
+		m_filter->Attach(new OutputProxy(*this, false));
+}
+
+bool ProxyFilter::IsolatedFlush(bool hardFlush, bool blocking)
+{
+	return m_filter.get() ? m_filter->Flush(hardFlush, -1, blocking) : false;
+}
+
+void ProxyFilter::SetFilter(Filter *filter)
+{
+	m_filter.reset(filter);
+	if (filter)
+	{
+		OutputProxy *proxy;
+		member_ptr<OutputProxy> temp(proxy = new OutputProxy(*this, false));
+		m_filter->TransferAllTo(*proxy);
+		m_filter->Attach(temp.release());
+	}
+}
+
+void ProxyFilter::NextPutMultiple(const byte *s, size_t len)
+{
+	if (m_filter.get())
+		m_filter->Put(s, len);
+}
+
+void ProxyFilter::NextPutModifiable(byte *s, size_t len)
+{
+	if (m_filter.get())
+		m_filter->PutModifiable(s, len);
+}
+
+// *************************************************************
+
+void RandomNumberSink::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	parameters.GetRequiredParameter("RandomNumberSink", "RandomNumberGeneratorPointer", m_rng);
+}
+
+size_t RandomNumberSink::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	CRYPTOPP_UNUSED(messageEnd); CRYPTOPP_UNUSED(blocking);
+	m_rng->IncorporateEntropy(begin, length);
+	return 0;
+}
+
+size_t ArraySink::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	CRYPTOPP_UNUSED(messageEnd); CRYPTOPP_UNUSED(blocking);
+
+	// Avoid passing NULL pointer to memcpy. Using std::memmove due to
+	//  Valgrind finding on overlapping buffers.
+	size_t copied = 0;
+	if (m_buf && begin)
+	{
+		copied = STDMIN(length, SaturatingSubtract(m_size, m_total));
+		std::memmove(PtrAdd(m_buf, m_total), begin, copied);
+	}
+	m_total += copied;
+	return length - copied;
+}
+
+byte * ArraySink::CreatePutSpace(size_t &size)
+{
+	size = SaturatingSubtract(m_size, m_total);
+	return PtrAdd(m_buf, m_total);
+}
+
+void ArraySink::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	ByteArrayParameter array;
+	if (!parameters.GetValue(Name::OutputBuffer(), array))
+		throw InvalidArgument("ArraySink: missing OutputBuffer argument");
+	m_buf = array.begin();
+	m_size = array.size();
+}
+
+size_t ArrayXorSink::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	CRYPTOPP_UNUSED(messageEnd); CRYPTOPP_UNUSED(blocking);
+
+	// Avoid passing NULL pointer to xorbuf
+	size_t copied = 0;
+	if (m_buf && begin)
+	{
+		copied = STDMIN(length, SaturatingSubtract(m_size, m_total));
+		xorbuf(PtrAdd(m_buf, m_total), begin, copied);
+	}
+	m_total += copied;
+	return length - copied;
+}
+
+// *************************************************************
+
+StreamTransformationFilter::StreamTransformationFilter(StreamTransformation &c, BufferedTransformation *attachment, BlockPaddingScheme padding)
+	: FilterWithBufferedInput(attachment), m_cipher(c), m_padding(DEFAULT_PADDING)
+{
+	CRYPTOPP_ASSERT(c.MinLastBlockSize() == 0 || c.MinLastBlockSize() > c.MandatoryBlockSize());
+
+	const bool authenticatedFilter = dynamic_cast<AuthenticatedSymmetricCipher *>(&c) != NULLPTR;
+	if (authenticatedFilter)
+		throw InvalidArgument("StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher");
+
+	// InitializeDerivedAndReturnNewSizes may override some of these
+	m_mandatoryBlockSize = m_cipher.MandatoryBlockSize();
+	m_optimalBufferSize = m_cipher.OptimalBlockSize();
+	m_isSpecial = m_cipher.IsLastBlockSpecial() && m_mandatoryBlockSize > 1;
+	m_reservedBufferSize = STDMAX(2*m_mandatoryBlockSize, m_optimalBufferSize);
+
+	FilterWithBufferedInput::IsolatedInitialize(
+		MakeParameters
+			(Name::BlockPaddingScheme(), padding));
+}
+
+StreamTransformationFilter::StreamTransformationFilter(StreamTransformation &c, BufferedTransformation *attachment, BlockPaddingScheme padding, bool authenticated)
+	: FilterWithBufferedInput(attachment), m_cipher(c), m_padding(DEFAULT_PADDING)
+{
+	const bool authenticatedFilter = dynamic_cast<AuthenticatedSymmetricCipher *>(&c) != NULLPTR;
+	if (!authenticatedFilter)
+	{
+		CRYPTOPP_ASSERT(c.MinLastBlockSize() == 0 || c.MinLastBlockSize() > c.MandatoryBlockSize());
+	}
+
+	if (authenticatedFilter && !authenticated)
+		throw InvalidArgument("StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher");
+
+	// InitializeDerivedAndReturnNewSizes may override some of these
+	m_mandatoryBlockSize = m_cipher.MandatoryBlockSize();
+	m_optimalBufferSize = m_cipher.OptimalBlockSize();
+	m_isSpecial = m_cipher.IsLastBlockSpecial() && m_mandatoryBlockSize > 1;
+	m_reservedBufferSize = STDMAX(2*m_mandatoryBlockSize, m_optimalBufferSize);
+
+	FilterWithBufferedInput::IsolatedInitialize(
+		MakeParameters
+			(Name::BlockPaddingScheme(), padding));
+}
+
+size_t StreamTransformationFilter::LastBlockSize(StreamTransformation &c, BlockPaddingScheme padding)
+{
+	if (c.MinLastBlockSize() > 0)
+		return c.MinLastBlockSize();
+	else if (c.MandatoryBlockSize() > 1 && !c.IsForwardTransformation() && padding != NO_PADDING && padding != ZEROS_PADDING)
+		return c.MandatoryBlockSize();
+
+	return 0;
+}
+
+void StreamTransformationFilter::InitializeDerivedAndReturnNewSizes(const NameValuePairs &parameters, size_t &firstSize, size_t &blockSize, size_t &lastSize)
+{
+	BlockPaddingScheme padding = parameters.GetValueWithDefault(Name::BlockPaddingScheme(), DEFAULT_PADDING);
+	bool isBlockCipher = (m_mandatoryBlockSize > 1 && m_cipher.MinLastBlockSize() == 0);
+
+	if (padding == DEFAULT_PADDING)
+		m_padding = isBlockCipher ? PKCS_PADDING : NO_PADDING;
+	else
+		m_padding = padding;
+
+	if (!isBlockCipher)
+	{
+		if (m_padding == PKCS_PADDING)
+			throw InvalidArgument("StreamTransformationFilter: PKCS_PADDING cannot be used with " + m_cipher.AlgorithmName());
+		else if (m_padding == W3C_PADDING)
+			throw InvalidArgument("StreamTransformationFilter: W3C_PADDING cannot be used with " + m_cipher.AlgorithmName());
+		else if (m_padding == ONE_AND_ZEROS_PADDING)
+			throw InvalidArgument("StreamTransformationFilter: ONE_AND_ZEROS_PADDING cannot be used with " + m_cipher.AlgorithmName());
+	}
+
+	firstSize = 0;
+	blockSize = m_mandatoryBlockSize;
+	lastSize = LastBlockSize(m_cipher, m_padding);
+}
+
+void StreamTransformationFilter::FirstPut(const byte* inString)
+{
+	CRYPTOPP_UNUSED(inString);
+	m_optimalBufferSize = STDMAX<unsigned int>(m_optimalBufferSize, RoundDownToMultipleOf(4096U, m_optimalBufferSize));
+}
+
+void StreamTransformationFilter::NextPutMultiple(const byte *inString, size_t length)
+{
+	if (!length)
+		{return;}
+
+	const size_t s = m_cipher.MandatoryBlockSize();
+	do
+	{
+		size_t len = m_optimalBufferSize;
+		byte *space = HelpCreatePutSpace(*AttachedTransformation(), DEFAULT_CHANNEL, s, length, len);
+		if (len < length)
+		{
+			if (len == m_optimalBufferSize)
+				len -= m_cipher.GetOptimalBlockSizeUsed();
+			len = RoundDownToMultipleOf(len, s);
+		}
+		else
+			len = length;
+		m_cipher.ProcessString(space, inString, len);
+		AttachedTransformation()->PutModifiable(space, len);
+		inString = PtrAdd(inString, len);
+		length -= len;
+	}
+	while (length > 0);
+}
+
+void StreamTransformationFilter::NextPutModifiable(byte *inString, size_t length)
+{
+	m_cipher.ProcessString(inString, length);
+	AttachedTransformation()->PutModifiable(inString, length);
+}
+
+void StreamTransformationFilter::LastPut(const byte *inString, size_t length)
+{
+	// This block is new to StreamTransformationFilter. It is somewhat of a hack and was
+	//  added for OCB mode; see GitHub Issue 515. The rub with OCB is, its a block cipher
+	//  and the last block size can be 0. However, "last block = 0" is not the 0 predicated
+	//  in the original code. In the original code 0 means "nothing special" so
+	//  DEFAULT_PADDING is applied. OCB's 0 literally means a final block size can be 0 or
+	//  non-0; and no padding is needed in either case because OCB has its own scheme (see
+	//  handling of P_* and A_*).
+	// Stream ciphers have policy objects to convey how to operate the cipher. The Crypto++
+	//  framework operates well when MinLastBlockSize() is 1. However, it did not appear to
+	//  cover the OCB case either because we can't stream OCB. It needs full block sizes. In
+	//  response we hacked a IsLastBlockSpecial(). When true StreamTransformationFilter
+	//  defers to the mode for processing of the last block.
+	// The behavior supplied when IsLastBlockSpecial() will likely have to evolve to capture
+	//  more complex cases from different authenc modes. I suspect it will have to change
+	//  from a simple bool to something that conveys more information, like "last block
+	//  no padding" or "custom padding applied by cipher".
+	// In some respect we have already hit the need for more information. For example, OCB
+	//  calculates the checksum on the cipher text at the same time, so we don't need the
+	//  disjoint behavior of calling "EncryptBlock" followed by a separate "AuthenticateBlock".
+	//  Additional information may allow us to avoid the two separate calls.
+	if (m_isSpecial)
+	{
+		const size_t leftOver = length % m_mandatoryBlockSize;
+		byte* space = HelpCreatePutSpace(*AttachedTransformation(), DEFAULT_CHANNEL, m_reservedBufferSize);
+		length -= leftOver;
+
+		if (length)
+		{
+			// Process full blocks
+			m_cipher.ProcessData(space, inString, length);
+			AttachedTransformation()->Put(space, length);
+			inString = PtrAdd(inString, length);
+		}
+
+		if (leftOver)
+		{
+			// Process final partial block
+			length = m_cipher.ProcessLastBlock(space, m_reservedBufferSize, inString, leftOver);
+			AttachedTransformation()->Put(space, length);
+		}
+		else
+		{
+			// Process final empty block
+			length = m_cipher.ProcessLastBlock(space, m_reservedBufferSize, NULLPTR, 0);
+			AttachedTransformation()->Put(space, length);
+		}
+
+		return;
+	}
+
+	switch (m_padding)
+	{
+	case NO_PADDING:
+	case ZEROS_PADDING:
+		if (length > 0)
+		{
+			const size_t minLastBlockSize = m_cipher.MinLastBlockSize();
+			const bool isForwardTransformation = m_cipher.IsForwardTransformation();
+
+			if (isForwardTransformation && m_padding == ZEROS_PADDING && (minLastBlockSize == 0 || length < minLastBlockSize))
+			{
+				// do padding
+				size_t blockSize = STDMAX(minLastBlockSize, (size_t)m_mandatoryBlockSize);
+				byte* space = HelpCreatePutSpace(*AttachedTransformation(), DEFAULT_CHANNEL, blockSize);
+				if (inString) {std::memcpy(space, inString, length);}
+				std::memset(PtrAdd(space, length), 0, blockSize - length);
+				size_t used = m_cipher.ProcessLastBlock(space, blockSize, space, blockSize);
+				AttachedTransformation()->Put(space, used);
+			}
+			else
+			{
+				if (minLastBlockSize == 0)
+				{
+					if (isForwardTransformation)
+						throw InvalidDataFormat("StreamTransformationFilter: plaintext length is not a multiple of block size and NO_PADDING is specified");
+					else
+						throw InvalidCiphertext("StreamTransformationFilter: ciphertext length is not a multiple of block size");
+				}
+
+				byte* space = HelpCreatePutSpace(*AttachedTransformation(), DEFAULT_CHANNEL, length, m_optimalBufferSize);
+				size_t used = m_cipher.ProcessLastBlock(space, length, inString, length);
+				AttachedTransformation()->Put(space, used);
+			}
+		}
+		break;
+
+	case PKCS_PADDING:
+	case W3C_PADDING:
+	case ONE_AND_ZEROS_PADDING:
+		unsigned int s;
+		byte* space;
+		s = m_mandatoryBlockSize;
+		CRYPTOPP_ASSERT(s > 1);
+		space = HelpCreatePutSpace(*AttachedTransformation(), DEFAULT_CHANNEL, s, m_optimalBufferSize);
+		if (m_cipher.IsForwardTransformation())
+		{
+			CRYPTOPP_ASSERT(length < s);
+			if (inString) {std::memcpy(space, inString, length);}
+			if (m_padding == PKCS_PADDING)
+			{
+				CRYPTOPP_ASSERT(s < 256);
+				byte pad = static_cast<byte>(s-length);
+				std::memset(PtrAdd(space, length), pad, s-length);
+			}
+			else if (m_padding == W3C_PADDING)
+			{
+				CRYPTOPP_ASSERT(s < 256);
+				std::memset(PtrAdd(space, length), 0, s-length-1);
+				space[s-1] = static_cast<byte>(s-length);
+			}
+			else
+			{
+				space[length] = 0x80;
+				std::memset(PtrAdd(space, length+1), 0, s-length-1);
+			}
+			m_cipher.ProcessData(space, space, s);
+			AttachedTransformation()->Put(space, s);
+		}
+		else
+		{
+			if (length != s)
+				throw InvalidCiphertext("StreamTransformationFilter: ciphertext length is not a multiple of block size");
+			m_cipher.ProcessData(space, inString, s);
+			if (m_padding == PKCS_PADDING)
+			{
+				byte pad = space[s-1];
+                                if (pad < 1 || pad > s || FindIfNot(PtrAdd(space, s-pad), PtrAdd(space, s), pad) != PtrAdd(space, s))
+                                    throw InvalidCiphertext("StreamTransformationFilter: invalid PKCS #7 block padding found");
+				length = s-pad;
+			}
+			else if (m_padding == W3C_PADDING)
+			{
+				byte pad = space[s - 1];
+				if (pad < 1 || pad > s)
+					throw InvalidCiphertext("StreamTransformationFilter: invalid W3C block padding found");
+				length = s - pad;
+			}
+			else
+			{
+				while (length > 1 && space[length-1] == 0)
+					--length;
+				if (space[--length] != 0x80)
+					throw InvalidCiphertext("StreamTransformationFilter: invalid ones-and-zeros padding found");
+			}
+			AttachedTransformation()->Put(space, length);
+		}
+		break;
+
+	default:
+		CRYPTOPP_ASSERT(false);
+	}
+}
+
+// *************************************************************
+
+HashFilter::HashFilter(HashTransformation &hm, BufferedTransformation *attachment, bool putMessage, int truncatedDigestSize, const std::string &messagePutChannel, const std::string &hashPutChannel)
+	: m_hashModule(hm), m_putMessage(putMessage), m_digestSize(0), m_space(NULLPTR)
+	, m_messagePutChannel(messagePutChannel), m_hashPutChannel(hashPutChannel)
+{
+	m_digestSize = truncatedDigestSize < 0 ? m_hashModule.DigestSize() : truncatedDigestSize;
+	Detach(attachment);
+}
+
+void HashFilter::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_putMessage = parameters.GetValueWithDefault(Name::PutMessage(), false);
+	int s = parameters.GetIntValueWithDefault(Name::TruncatedDigestSize(), -1);
+	m_digestSize = s < 0 ? m_hashModule.DigestSize() : s;
+}
+
+size_t HashFilter::Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+{
+	FILTER_BEGIN;
+	if (m_putMessage)
+		FILTER_OUTPUT3(1, 0, inString, length, 0, m_messagePutChannel);
+	if (inString && length)
+		m_hashModule.Update(inString, length);
+	if (messageEnd)
+	{
+		{
+			size_t size;
+			m_space = HelpCreatePutSpace(*AttachedTransformation(), m_hashPutChannel, m_digestSize, m_digestSize, size = m_digestSize);
+			m_hashModule.TruncatedFinal(m_space, m_digestSize);
+		}
+		FILTER_OUTPUT3(2, 0, m_space, m_digestSize, messageEnd, m_hashPutChannel);
+	}
+	FILTER_END_NO_MESSAGE_END;
+}
+
+// *************************************************************
+
+HashVerificationFilter::HashVerificationFilter(HashTransformation &hm, BufferedTransformation *attachment, word32 flags, int truncatedDigestSize)
+	: FilterWithBufferedInput(attachment)
+	, m_hashModule(hm), m_flags(0), m_digestSize(0), m_verified(false)
+{
+	FilterWithBufferedInput::IsolatedInitialize(
+		MakeParameters
+			(Name::HashVerificationFilterFlags(), flags)
+			(Name::TruncatedDigestSize(), truncatedDigestSize));
+}
+
+void HashVerificationFilter::InitializeDerivedAndReturnNewSizes(const NameValuePairs &parameters, size_t &firstSize, size_t &blockSize, size_t &lastSize)
+{
+	m_flags = parameters.GetValueWithDefault(Name::HashVerificationFilterFlags(), (word32)DEFAULT_FLAGS);
+	int s = parameters.GetIntValueWithDefault(Name::TruncatedDigestSize(), -1);
+	m_digestSize = s < 0 ? m_hashModule.DigestSize() : s;
+	m_verified = false;
+	firstSize = m_flags & HASH_AT_BEGIN ? m_digestSize : 0;
+	blockSize = 1;
+	lastSize = m_flags & HASH_AT_BEGIN ? 0 : m_digestSize;
+}
+
+void HashVerificationFilter::FirstPut(const byte *inString)
+{
+	if (m_flags & HASH_AT_BEGIN)
+	{
+		m_expectedHash.New(m_digestSize);
+		if (inString) {std::memcpy(m_expectedHash, inString, m_expectedHash.size());}
+		if (m_flags & PUT_HASH)
+			AttachedTransformation()->Put(inString, m_expectedHash.size());
+	}
+}
+
+void HashVerificationFilter::NextPutMultiple(const byte *inString, size_t length)
+{
+	m_hashModule.Update(inString, length);
+	if (m_flags & PUT_MESSAGE)
+		AttachedTransformation()->Put(inString, length);
+}
+
+void HashVerificationFilter::LastPut(const byte *inString, size_t length)
+{
+	if (m_flags & HASH_AT_BEGIN)
+	{
+		CRYPTOPP_ASSERT(length == 0);
+		m_verified = m_hashModule.TruncatedVerify(m_expectedHash, m_digestSize);
+	}
+	else
+	{
+		m_verified = (length==m_digestSize && m_hashModule.TruncatedVerify(inString, length));
+		if (m_flags & PUT_HASH)
+			AttachedTransformation()->Put(inString, length);
+	}
+
+	if (m_flags & PUT_RESULT)
+		AttachedTransformation()->Put(m_verified);
+
+	if ((m_flags & THROW_EXCEPTION) && !m_verified)
+		throw HashVerificationFailed();
+}
+
+// *************************************************************
+
+AuthenticatedEncryptionFilter::AuthenticatedEncryptionFilter(AuthenticatedSymmetricCipher &c, BufferedTransformation *attachment,
+								bool putAAD, int truncatedDigestSize, const std::string &macChannel, BlockPaddingScheme padding)
+	: StreamTransformationFilter(c, attachment, padding, true)
+	, m_hf(c, new OutputProxy(*this, false), putAAD, truncatedDigestSize, AAD_CHANNEL, macChannel)
+{
+	CRYPTOPP_ASSERT(c.IsForwardTransformation());
+}
+
+void AuthenticatedEncryptionFilter::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_hf.IsolatedInitialize(parameters);
+	StreamTransformationFilter::IsolatedInitialize(parameters);
+}
+
+byte * AuthenticatedEncryptionFilter::ChannelCreatePutSpace(const std::string &channel, size_t &size)
+{
+	if (channel.empty())
+		return StreamTransformationFilter::CreatePutSpace(size);
+
+	if (channel == AAD_CHANNEL)
+		return m_hf.CreatePutSpace(size);
+
+	throw InvalidChannelName("AuthenticatedEncryptionFilter", channel);
+}
+
+size_t AuthenticatedEncryptionFilter::ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	if (channel.empty())
+		return StreamTransformationFilter::Put2(begin, length, messageEnd, blocking);
+
+	if (channel == AAD_CHANNEL)
+		return m_hf.Put2(begin, length, 0, blocking);
+
+	throw InvalidChannelName("AuthenticatedEncryptionFilter", channel);
+}
+
+void AuthenticatedEncryptionFilter::LastPut(const byte *inString, size_t length)
+{
+	StreamTransformationFilter::LastPut(inString, length);
+	m_hf.MessageEnd();
+}
+
+// *************************************************************
+
+AuthenticatedDecryptionFilter::AuthenticatedDecryptionFilter(AuthenticatedSymmetricCipher &c, BufferedTransformation *attachment, word32 flags, int truncatedDigestSize, BlockPaddingScheme padding)
+	: FilterWithBufferedInput(attachment)
+	, m_hashVerifier(c, new OutputProxy(*this, false))
+	, m_streamFilter(c, new OutputProxy(*this, false), padding, true)
+{
+	CRYPTOPP_ASSERT(!c.IsForwardTransformation() || c.IsSelfInverting());
+	FilterWithBufferedInput::IsolatedInitialize(
+		MakeParameters
+			(Name::BlockPaddingScheme(), padding)
+			(Name::AuthenticatedDecryptionFilterFlags(), flags)
+			(Name::TruncatedDigestSize(), truncatedDigestSize));
+}
+
+void AuthenticatedDecryptionFilter::InitializeDerivedAndReturnNewSizes(const NameValuePairs &parameters, size_t &firstSize, size_t &blockSize, size_t &lastSize)
+{
+	word32 flags = parameters.GetValueWithDefault(Name::AuthenticatedDecryptionFilterFlags(), (word32)DEFAULT_FLAGS);
+
+	m_hashVerifier.Initialize(CombinedNameValuePairs(parameters, MakeParameters(Name::HashVerificationFilterFlags(), flags)));
+	m_streamFilter.Initialize(parameters);
+
+	firstSize = m_hashVerifier.m_firstSize;
+	blockSize = 1;
+	lastSize = m_hashVerifier.m_lastSize;
+}
+
+byte * AuthenticatedDecryptionFilter::ChannelCreatePutSpace(const std::string &channel, size_t &size)
+{
+	if (channel.empty())
+		return m_streamFilter.CreatePutSpace(size);
+
+	if (channel == AAD_CHANNEL)
+		return m_hashVerifier.CreatePutSpace(size);
+
+	throw InvalidChannelName("AuthenticatedDecryptionFilter", channel);
+}
+
+size_t AuthenticatedDecryptionFilter::ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	if (channel.empty())
+	{
+		if (m_lastSize > 0)
+			m_hashVerifier.ForceNextPut();
+		return FilterWithBufferedInput::Put2(begin, length, messageEnd, blocking);
+	}
+
+	if (channel == AAD_CHANNEL)
+		return m_hashVerifier.Put2(begin, length, 0, blocking);
+
+	throw InvalidChannelName("AuthenticatedDecryptionFilter", channel);
+}
+
+void AuthenticatedDecryptionFilter::FirstPut(const byte *inString)
+{
+	m_hashVerifier.Put(inString, m_firstSize);
+}
+
+void AuthenticatedDecryptionFilter::NextPutMultiple(const byte *inString, size_t length)
+{
+	m_streamFilter.Put(inString, length);
+}
+
+void AuthenticatedDecryptionFilter::LastPut(const byte *inString, size_t length)
+{
+	m_streamFilter.MessageEnd();
+	m_hashVerifier.PutMessageEnd(inString, length);
+}
+
+// *************************************************************
+
+void SignerFilter::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_putMessage = parameters.GetValueWithDefault(Name::PutMessage(), false);
+	m_messageAccumulator.reset(m_signer.NewSignatureAccumulator(m_rng));
+}
+
+size_t SignerFilter::Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+{
+	FILTER_BEGIN;
+	m_messageAccumulator->Update(inString, length);
+	if (m_putMessage)
+		FILTER_OUTPUT(1, inString, length, 0);
+	if (messageEnd)
+	{
+		m_buf.New(m_signer.SignatureLength());
+		m_signer.Sign(m_rng, m_messageAccumulator.release(), m_buf);
+		FILTER_OUTPUT(2, m_buf, m_buf.size(), messageEnd);
+		m_messageAccumulator.reset(m_signer.NewSignatureAccumulator(m_rng));
+	}
+	FILTER_END_NO_MESSAGE_END;
+}
+
+SignatureVerificationFilter::SignatureVerificationFilter(const PK_Verifier &verifier, BufferedTransformation *attachment, word32 flags)
+	: FilterWithBufferedInput(attachment)
+	, m_verifier(verifier), m_flags(0), m_verified(0)
+{
+	FilterWithBufferedInput::IsolatedInitialize(
+		MakeParameters
+			(Name::SignatureVerificationFilterFlags(), flags));
+}
+
+void SignatureVerificationFilter::InitializeDerivedAndReturnNewSizes(const NameValuePairs &parameters, size_t &firstSize, size_t &blockSize, size_t &lastSize)
+{
+	m_flags = parameters.GetValueWithDefault(Name::SignatureVerificationFilterFlags(), (word32)DEFAULT_FLAGS);
+	m_messageAccumulator.reset(m_verifier.NewVerificationAccumulator());
+	size_t size = m_verifier.SignatureLength();
+	CRYPTOPP_ASSERT(size != 0);	// TODO: handle recoverable signature scheme
+	m_verified = false;
+	firstSize = m_flags & SIGNATURE_AT_BEGIN ? size : 0;
+	blockSize = 1;
+	lastSize = m_flags & SIGNATURE_AT_BEGIN ? 0 : size;
+}
+
+void SignatureVerificationFilter::FirstPut(const byte *inString)
+{
+	if (m_flags & SIGNATURE_AT_BEGIN)
+	{
+		if (m_verifier.SignatureUpfront())
+			m_verifier.InputSignature(*m_messageAccumulator, inString, m_verifier.SignatureLength());
+		else
+		{
+			m_signature.New(m_verifier.SignatureLength());
+			if (inString) {std::memcpy(m_signature, inString, m_signature.size());}
+		}
+
+		if (m_flags & PUT_SIGNATURE)
+			AttachedTransformation()->Put(inString, m_signature.size());
+	}
+	else
+	{
+		CRYPTOPP_ASSERT(!m_verifier.SignatureUpfront());
+	}
+}
+
+void SignatureVerificationFilter::NextPutMultiple(const byte *inString, size_t length)
+{
+	m_messageAccumulator->Update(inString, length);
+	if (m_flags & PUT_MESSAGE)
+		AttachedTransformation()->Put(inString, length);
+}
+
+void SignatureVerificationFilter::LastPut(const byte *inString, size_t length)
+{
+	if (m_flags & SIGNATURE_AT_BEGIN)
+	{
+		CRYPTOPP_ASSERT(length == 0);
+		m_verifier.InputSignature(*m_messageAccumulator, m_signature, m_signature.size());
+		m_verified = m_verifier.VerifyAndRestart(*m_messageAccumulator);
+	}
+	else
+	{
+		m_verifier.InputSignature(*m_messageAccumulator, inString, length);
+		m_verified = m_verifier.VerifyAndRestart(*m_messageAccumulator);
+		if (m_flags & PUT_SIGNATURE)
+			AttachedTransformation()->Put(inString, length);
+	}
+
+	if (m_flags & PUT_RESULT)
+		AttachedTransformation()->Put(m_verified);
+
+	if ((m_flags & THROW_EXCEPTION) && !m_verified)
+		throw SignatureVerificationFailed();
+}
+
+// *************************************************************
+
+size_t Source::PumpAll2(bool blocking)
+{
+	unsigned int messageCount = UINT_MAX;
+	do {
+		RETURN_IF_NONZERO(PumpMessages2(messageCount, blocking));
+	} while(messageCount == UINT_MAX);
+
+	return 0;
+}
+
+bool Store::GetNextMessage()
+{
+	if (!m_messageEnd && !AnyRetrievable())
+	{
+		m_messageEnd=true;
+		return true;
+	}
+	else
+		return false;
+}
+
+unsigned int Store::CopyMessagesTo(BufferedTransformation &target, unsigned int count, const std::string &channel) const
+{
+	if (m_messageEnd || count == 0)
+		return 0;
+	else
+	{
+		CopyTo(target, ULONG_MAX, channel);
+		if (GetAutoSignalPropagation())
+			target.ChannelMessageEnd(channel, GetAutoSignalPropagation()-1);
+		return 1;
+	}
+}
+
+void StringStore::StoreInitialize(const NameValuePairs &parameters)
+{
+	ConstByteArrayParameter array;
+	if (!parameters.GetValue(Name::InputBuffer(), array))
+		throw InvalidArgument("StringStore: missing InputBuffer argument");
+	m_store = array.begin();
+	m_length = array.size();
+	m_count = 0;
+}
+
+size_t StringStore::TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel, bool blocking)
+{
+	lword position = 0;
+	size_t blockedBytes = CopyRangeTo2(target, position, transferBytes, channel, blocking);
+	m_count += static_cast<size_t>(position);
+	transferBytes = position;
+	return blockedBytes;
+}
+
+size_t StringStore::CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end, const std::string &channel, bool blocking) const
+{
+	size_t i = UnsignedMin(m_length, m_count+begin);
+	size_t len = UnsignedMin(m_length-i, end-begin);
+	size_t blockedBytes = target.ChannelPut2(channel, PtrAdd(m_store, i), len, 0, blocking);
+	if (!blockedBytes)
+		begin = PtrAdd(begin, len);
+	return blockedBytes;
+}
+
+void RandomNumberStore::StoreInitialize(const NameValuePairs &parameters)
+{
+	parameters.GetRequiredParameter("RandomNumberStore", "RandomNumberGeneratorPointer", m_rng);
+	int length;
+	parameters.GetRequiredIntParameter("RandomNumberStore", "RandomNumberStoreSize", length);
+	m_length = length;
+}
+
+size_t RandomNumberStore::TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel, bool blocking)
+{
+	if (!blocking)
+		throw NotImplemented("RandomNumberStore: nonblocking transfer is not implemented by this object");
+
+	transferBytes = UnsignedMin(transferBytes, m_length - m_count);
+	m_rng->GenerateIntoBufferedTransformation(target, channel, transferBytes);
+	m_count += transferBytes;
+
+	return 0;
+}
+
+size_t NullStore::CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end, const std::string &channel, bool blocking) const
+{
+	static const byte nullBytes[128] = {0};
+	while (begin < end)
+	{
+		size_t len = (size_t)STDMIN(end-begin, lword(128));
+		size_t blockedBytes = target.ChannelPut2(channel, nullBytes, len, 0, blocking);
+		if (blockedBytes)
+			return blockedBytes;
+		begin = PtrAdd(begin, len);
+	}
+	return 0;
+}
+
+size_t NullStore::TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel, bool blocking)
+{
+	lword begin = 0;
+	size_t blockedBytes = NullStore::CopyRangeTo2(target, begin, transferBytes, channel, blocking);
+	transferBytes = begin; m_size -= begin;
+	return blockedBytes;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/filters.h b/runtime/third_party/cryptopp/filters.h
new file mode 100644
index 0000000..0de46c4
--- /dev/null
+++ b/runtime/third_party/cryptopp/filters.h
@@ -0,0 +1,1529 @@
+// filters.h - originally written and placed in the public domain by Wei Dai
+
+/// \file filters.h
+/// \brief Implementation of BufferedTransformation's attachment interface.
+
+#ifndef CRYPTOPP_FILTERS_H
+#define CRYPTOPP_FILTERS_H
+
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4127 4189 4231 4275 4514)
+#endif
+
+#include "cryptlib.h"
+#include "simple.h"
+#include "secblock.h"
+#include "misc.h"
+#include "smartptr.h"
+#include "queue.h"
+#include "algparam.h"
+#include "stdcpp.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Implementation of BufferedTransformation's attachment interface
+/// \details Filter is a cornerstone of the Pipeline trinity. Data flows from
+///  Sources, through Filters, and then terminates in Sinks. The difference
+///  between a Source and Filter is a Source \a pumps data, while a Filter does
+///  not. The difference between a Filter and a Sink is a Filter allows an
+///  attached transformation, while a Sink does not.
+/// \details See the discussion of BufferedTransformation in cryptlib.h for
+///  more details.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Filter : public BufferedTransformation, public NotCopyable
+{
+public:
+	virtual ~Filter() {}
+
+	///	\name ATTACHMENT
+	//@{
+
+	/// \brief Construct a Filter
+	/// \param attachment an optional attached transformation
+	/// \details attachment can be NULL.
+	Filter(BufferedTransformation *attachment = NULLPTR);
+
+	/// \brief Determine if attachable
+	/// \return true if the object allows attached transformations, false otherwise.
+	/// \note Source and Filter offer attached transformations; while Sink does not.
+	bool Attachable() {return true;}
+
+	/// \brief Retrieve attached transformation
+	/// \return pointer to a BufferedTransformation if there is an attached transformation, NULL otherwise.
+	BufferedTransformation *AttachedTransformation();
+
+	/// \brief Retrieve attached transformation
+	/// \return pointer to a BufferedTransformation if there is an attached transformation, NULL otherwise.
+	const BufferedTransformation *AttachedTransformation() const;
+
+	/// \brief Replace an attached transformation
+	/// \param newAttachment an optional attached transformation
+	/// \details newAttachment can be a single filter, a chain of filters or NULL.
+	///  Pass NULL to remove an existing BufferedTransformation or chain of filters
+	void Detach(BufferedTransformation *newAttachment = NULLPTR);
+
+	//@}
+
+	///	\name RETRIEVAL OF ONE MESSAGE
+	//@{
+
+	// BufferedTransformation in cryptlib.h
+	size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+	size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const;
+
+	//@}
+
+	///	\name SIGNALS
+	//@{
+
+	// BufferedTransformation in cryptlib.h
+	void Initialize(const NameValuePairs &parameters=g_nullNameValuePairs, int propagation=-1);
+	bool Flush(bool hardFlush, int propagation=-1, bool blocking=true);
+	bool MessageSeriesEnd(int propagation=-1, bool blocking=true);
+
+	//@}
+
+protected:
+	virtual BufferedTransformation * NewDefaultAttachment() const;
+	void Insert(Filter *nextFilter);	// insert filter after this one
+
+	virtual bool ShouldPropagateMessageEnd() const {return true;}
+	virtual bool ShouldPropagateMessageSeriesEnd() const {return true;}
+
+	void PropagateInitialize(const NameValuePairs &parameters, int propagation);
+
+	/// \brief Forward processed data on to attached transformation
+	/// \param outputSite unknown, system crash between keyboard and chair...
+	/// \param inString the byte buffer to process
+	/// \param length the size of the string, in bytes
+	/// \param messageEnd means how many filters to signal MessageEnd() to, including this one
+	/// \param blocking specifies whether the object should block when processing input
+	/// \param channel the channel to process the data
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+	///  0 indicates all bytes were processed.
+	size_t Output(int outputSite, const byte *inString, size_t length, int messageEnd, bool blocking, const std::string &channel=DEFAULT_CHANNEL);
+
+	/// \brief Output multiple bytes that may be modified by callee.
+	/// \param outputSite unknown, system crash between keyboard and chair...
+	/// \param inString the byte buffer to process
+	/// \param length the size of the string, in bytes
+	/// \param messageEnd means how many filters to signal MessageEnd() to, including this one
+	/// \param blocking specifies whether the object should block when processing input
+	/// \param channel the channel to process the data
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+	///  0 indicates all bytes were processed.
+	size_t OutputModifiable(int outputSite, byte *inString, size_t length, int messageEnd, bool blocking, const std::string &channel=DEFAULT_CHANNEL);
+
+	/// \brief Signals the end of messages to the object
+	/// \param outputSite unknown, system crash between keyboard and chair...
+	/// \param propagation the number of attached transformations the  MessageEnd() signal should be passed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \param channel the channel to process the data
+	/// \return true is the MessageEnd signal was successful, false otherwise.
+	/// \details propagation count includes this object. Setting  propagation to <tt>1</tt> means this
+	///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+	bool OutputMessageEnd(int outputSite, int propagation, bool blocking, const std::string &channel=DEFAULT_CHANNEL);
+
+	/// \brief Flush buffered input and/or output, with signal propagation
+	/// \param outputSite unknown, system crash between keyboard and chair...
+	/// \param hardFlush is used to indicate whether all data should be flushed
+	/// \param propagation the number of attached transformations the  Flush() signal should be passed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \param channel the channel to process the data
+	/// \return true is the Flush signal was successful, false otherwise.
+	/// \details propagation count includes this object. Setting  propagation to <tt>1</tt> means this
+	///  object only. Setting  propagation to <tt>-1</tt> means unlimited propagation.
+	/// \note Hard flushes must be used with care. It means try to process and output everything, even if
+	///  there may not be enough data to complete the action. For example, hard flushing a  HexDecoder
+	///  would cause an error if you do it after inputing an odd number of hex encoded characters.
+	/// \note For some types of filters, like  ZlibDecompressor, hard flushes can only
+	///  be done at "synchronization points". These synchronization points are positions in the data
+	///  stream that are created by hard flushes on the corresponding reverse filters, in this
+	///  example ZlibCompressor. This is useful when zlib compressed data is moved across a
+	///  network in packets and compression state is preserved across packets, as in the SSH2 protocol.
+	bool OutputFlush(int outputSite, bool hardFlush, int propagation, bool blocking, const std::string &channel=DEFAULT_CHANNEL);
+
+	/// \brief Marks the end of a series of messages, with signal propagation
+	/// \param outputSite unknown, system crash between keyboard and chair...
+	/// \param propagation the number of attached transformations the  MessageSeriesEnd() signal should be passed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \param channel the channel to process the data
+	/// \return true is the MessageEnd signal was successful, false otherwise.
+	/// \details Each object that receives the signal will perform its processing, decrement
+	///  propagation, and then pass the signal on to attached transformations if the value is not 0.
+	/// \details propagation count includes this object. Setting  propagation to <tt>1</tt> means this
+	///  object only. Setting  propagation to <tt>-1</tt> means unlimited propagation.
+	/// \note There should be a MessageEnd() immediately before MessageSeriesEnd().
+	bool OutputMessageSeriesEnd(int outputSite, int propagation, bool blocking, const std::string &channel=DEFAULT_CHANNEL);
+
+private:
+	member_ptr<BufferedTransformation> m_attachment;
+
+protected:
+	size_t m_inputPosition;
+	int m_continueAt;
+};
+
+/// \brief Create a working space in a BufferedTransformation
+struct CRYPTOPP_DLL FilterPutSpaceHelper
+{
+	virtual ~FilterPutSpaceHelper() {}
+
+	/// \brief Create a working space in a BufferedTransformation
+	/// \param target BufferedTransformation for the working space
+	/// \param channel channel for the working space
+	/// \param minSize minimum size of the allocation, in bytes
+	/// \param desiredSize preferred size of the allocation, in bytes
+	/// \param bufferSize actual size of the allocation, in bytes
+	/// \pre <tt>desiredSize >= minSize</tt> and <tt>bufferSize >= minSize</tt>.
+	/// \details bufferSize is an IN and OUT parameter. If HelpCreatePutSpace() returns a non-NULL value, then
+	///  bufferSize is valid and provides the size of the working space created for the caller.
+	/// \details Internally, HelpCreatePutSpace() calls \ref BufferedTransformation::ChannelCreatePutSpace
+	///  "ChannelCreatePutSpace()" using desiredSize. If the target returns desiredSize with a size less
+	///  than minSize (i.e., the request could not be fulfilled), then an internal SecByteBlock
+	///  called m_tempSpace is resized and used for the caller.
+	byte *HelpCreatePutSpace(BufferedTransformation &target, const std::string &channel, size_t minSize, size_t desiredSize, size_t &bufferSize)
+	{
+		CRYPTOPP_ASSERT(desiredSize >= minSize && bufferSize >= minSize);
+		if (m_tempSpace.size() < minSize)
+		{
+			byte *result = target.ChannelCreatePutSpace(channel, desiredSize);
+			if (desiredSize >= minSize)
+			{
+				bufferSize = desiredSize;
+				return result;
+			}
+			m_tempSpace.New(bufferSize);
+		}
+
+		bufferSize = m_tempSpace.size();
+		return m_tempSpace.begin();
+	}
+
+	/// \brief Create a working space in a BufferedTransformation
+	/// \param target the BufferedTransformation for the working space
+	/// \param channel channel for the working space
+	/// \param minSize minimum size of the allocation, in bytes
+	/// \return pointer to the created space
+	/// \details Internally, the overload calls HelpCreatePutSpace() using minSize for missing arguments.
+	/// \details The filter will delete the space. The caller does not need to delete the space.
+	byte *HelpCreatePutSpace(BufferedTransformation &target, const std::string &channel, size_t minSize)
+		{return HelpCreatePutSpace(target, channel, minSize, minSize, minSize);}
+
+	/// \brief Create a working space in a BufferedTransformation
+	/// \param target the BufferedTransformation for the working space
+	/// \param channel channel for the working space
+	/// \param minSize minimum size of the allocation, in bytes
+	/// \param bufferSize the actual size of the allocation, in bytes
+	/// \details Internally, the overload calls HelpCreatePutSpace() using minSize for missing arguments.
+	/// \details The filter will delete the space. The caller does not need to delete the space.
+	byte *HelpCreatePutSpace(BufferedTransformation &target, const std::string &channel, size_t minSize, size_t bufferSize)
+		{return HelpCreatePutSpace(target, channel, minSize, minSize, bufferSize);}
+
+	/// \brief Temporary working space
+	SecByteBlock m_tempSpace;
+};
+
+/// \brief Measure how many bytes and messages pass through the filter
+/// \details measure how many bytes and messages pass through the filter. The filter also serves as valve by
+///  maintaining a list of ranges to skip during processing.
+class CRYPTOPP_DLL MeterFilter : public Bufferless<Filter>
+{
+public:
+	virtual ~MeterFilter() {}
+
+	/// \brief Construct a MeterFilter
+	/// \param attachment an optional attached transformation
+	/// \param transparent flag indicating if the filter should function transparently
+	/// \details attachment can be NULL. The filter is transparent by default. If the filter is
+	///  transparent, then PutMaybeModifiable() does not process a request and always returns 0.
+	MeterFilter(BufferedTransformation *attachment=NULLPTR, bool transparent=true)
+		: m_transparent(transparent), m_currentMessageBytes(0), m_totalBytes(0)
+		, m_currentSeriesMessages(0), m_totalMessages(0), m_totalMessageSeries(0)
+		, m_begin(NULLPTR), m_length(0) {Detach(attachment); ResetMeter();}
+
+	/// \brief Set or change the transparent mode of this object
+	/// \param transparent the new transparent mode
+	void SetTransparent(bool transparent) {m_transparent = transparent;}
+
+	/// \brief Adds a range to skip during processing
+	/// \param message the message to apply the range
+	/// \param position the 0-based index in the current stream
+	/// \param size the length of the range
+	/// \param sortNow flag indicating whether the range should be sorted
+	/// \details Internally, MeterFilter maitains a deque of ranges to skip. As messages are processed,
+	///  ranges of bytes are skipped according to the list of ranges.
+	void AddRangeToSkip(unsigned int message, lword position, lword size, bool sortNow = true);
+
+	/// \brief Resets the meter
+	/// \details ResetMeter() reinitializes the meter by setting counters to 0 and removing previous
+	///  skip ranges.
+	void ResetMeter();
+
+	// BufferedTransformation in cryptlib.h
+	void IsolatedInitialize(const NameValuePairs &parameters)
+		{CRYPTOPP_UNUSED(parameters); ResetMeter();}
+
+	/// \brief Number of bytes in the current message
+	/// \return the number of bytes in the current message
+	lword GetCurrentMessageBytes() const {return m_currentMessageBytes;}
+
+	/// \brief Number of bytes processed by the filter
+	/// \return the number of bytes processed by the filter
+	lword GetTotalBytes() const {return m_totalBytes;}
+
+	/// \brief Message number in the series
+	/// \return the message number in the series
+	unsigned int GetCurrentSeriesMessages() const {return m_currentSeriesMessages;}
+
+	/// \brief Number of messages in the message series
+	/// \return the number of messages in the message series
+	unsigned int GetTotalMessages() const {return m_totalMessages;}
+
+	/// \brief Number of messages processed by the filter
+	/// \return the number of messages processed by the filter
+	unsigned int GetTotalMessageSeries() const {return m_totalMessageSeries;}
+
+	// BufferedTransformation in cryptlib.h
+	byte * CreatePutSpace(size_t &size) {return AttachedTransformation()->CreatePutSpace(size);}
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+	size_t PutModifiable2(byte *inString, size_t length, int messageEnd, bool blocking);
+	bool IsolatedMessageSeriesEnd(bool blocking);
+
+private:
+	size_t PutMaybeModifiable(byte *inString, size_t length, int messageEnd, bool blocking, bool modifiable);
+	bool ShouldPropagateMessageEnd() const {return m_transparent;}
+	bool ShouldPropagateMessageSeriesEnd() const {return m_transparent;}
+
+	struct MessageRange
+	{
+		inline bool operator<(const MessageRange &b) const	// BCB2006 workaround: this has to be a member function
+			{return message < b.message || (message == b.message && position < b.position);}
+		unsigned int message; lword position; lword size;
+	};
+
+	bool m_transparent;
+	lword m_currentMessageBytes, m_totalBytes;
+	unsigned int m_currentSeriesMessages, m_totalMessages, m_totalMessageSeries;
+	std::deque<MessageRange> m_rangesToSkip;
+	byte *m_begin;
+	size_t m_length;
+};
+
+/// \brief A transparent MeterFilter
+/// \sa MeterFilter, OpaqueFilter
+class CRYPTOPP_DLL TransparentFilter : public MeterFilter
+{
+public:
+	/// \brief Construct a TransparentFilter
+	/// \param attachment an optional attached transformation
+	TransparentFilter(BufferedTransformation *attachment=NULLPTR) : MeterFilter(attachment, true) {}
+};
+
+/// \brief A non-transparent MeterFilter
+/// \sa MeterFilter, TransparentFilter
+class CRYPTOPP_DLL OpaqueFilter : public MeterFilter
+{
+public:
+	/// \brief Construct an OpaqueFilter
+	/// \param attachment an optional attached transformation
+	OpaqueFilter(BufferedTransformation *attachment=NULLPTR) : MeterFilter(attachment, false) {}
+};
+
+/// \brief Divides an input stream into discrete blocks
+/// \details FilterWithBufferedInput divides the input stream into a first block, a number of
+///  middle blocks, and a last block. First and last blocks are optional, and middle blocks may
+///  be a stream instead (i.e. <tt>blockSize == 1</tt>).
+/// \sa AuthenticatedEncryptionFilter, AuthenticatedDecryptionFilter, HashVerificationFilter,
+///  SignatureVerificationFilter, StreamTransformationFilter
+class CRYPTOPP_DLL FilterWithBufferedInput : public Filter
+{
+public:
+	virtual ~FilterWithBufferedInput() {}
+
+	/// \brief Construct a FilterWithBufferedInput with an attached transformation
+	/// \param attachment an attached transformation
+	FilterWithBufferedInput(BufferedTransformation *attachment);
+
+	/// \brief Construct a FilterWithBufferedInput with an attached transformation
+	/// \param firstSize the size of the first block
+	/// \param blockSize the size of middle blocks
+	/// \param lastSize the size of the last block
+	/// \param attachment an attached transformation
+	/// \details firstSize and lastSize may be 0. blockSize must be at least 1.
+	FilterWithBufferedInput(size_t firstSize, size_t blockSize, size_t lastSize, BufferedTransformation *attachment);
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+	{
+		return PutMaybeModifiable(const_cast<byte *>(inString), length, messageEnd, blocking, false);
+	}
+
+	size_t PutModifiable2(byte *inString, size_t length, int messageEnd, bool blocking)
+	{
+		return PutMaybeModifiable(inString, length, messageEnd, blocking, true);
+	}
+
+	/// \brief Flushes data buffered by this object, without signal propagation
+	/// \param hardFlush indicates whether all data should be flushed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \return true if the Flush was successful, false otherwise
+	/// \details IsolatedFlush() calls ForceNextPut() if hardFlush is true
+	/// \note  hardFlush must be used with care
+	bool IsolatedFlush(bool hardFlush, bool blocking);
+
+	/// \brief Flushes data buffered by this object
+	/// \details The input buffer may contain more than blockSize bytes if <tt>lastSize != 0</tt>.
+	///  ForceNextPut() forces a call to NextPut() if this is the case.
+	void ForceNextPut();
+
+protected:
+	virtual bool DidFirstPut() const {return m_firstInputDone;}
+	virtual size_t GetFirstPutSize() const {return m_firstSize;}
+	virtual size_t GetBlockPutSize() const {return m_blockSize;}
+	virtual size_t GetLastPutSize() const {return m_lastSize;}
+
+	virtual void InitializeDerivedAndReturnNewSizes(const NameValuePairs &parameters, size_t &firstSize, size_t &blockSize, size_t &lastSize)
+		{CRYPTOPP_UNUSED(parameters); CRYPTOPP_UNUSED(firstSize); CRYPTOPP_UNUSED(blockSize); CRYPTOPP_UNUSED(lastSize); InitializeDerived(parameters);}
+	virtual void InitializeDerived(const NameValuePairs &parameters)
+		{CRYPTOPP_UNUSED(parameters);}
+	// FirstPut() is called if (firstSize != 0 and totalLength >= firstSize)
+	// or (firstSize == 0 and (totalLength > 0 or a MessageEnd() is received)).
+	// inString is m_firstSize in length.
+	virtual void FirstPut(const byte *inString) =0;
+	// NextPut() is called if totalLength >= firstSize+blockSize+lastSize
+	virtual void NextPutSingle(const byte *inString)
+		{CRYPTOPP_UNUSED(inString); CRYPTOPP_ASSERT(false);}
+	// Same as NextPut() except length can be a multiple of blockSize
+	// Either NextPut() or NextPutMultiple() must be overridden
+	virtual void NextPutMultiple(const byte *inString, size_t length);
+	// Same as NextPutMultiple(), but inString can be modified
+	virtual void NextPutModifiable(byte *inString, size_t length)
+		{NextPutMultiple(inString, length);}
+	/// \brief Input the last block of data
+	/// \param inString the input byte buffer
+	/// \param length the size of the input buffer, in bytes
+	/// \details LastPut() processes the last block of data and signals attached filters to do the same.
+	///  LastPut() is always called. The pseudo algorithm for the logic is:
+	/// <pre>
+	///     if totalLength < firstSize then length == totalLength
+	///     else if totalLength <= firstSize+lastSize then length == totalLength-firstSize
+	///     else lastSize <= length < lastSize+blockSize
+	/// </pre>
+	virtual void LastPut(const byte *inString, size_t length) =0;
+	virtual void FlushDerived() {}
+
+protected:
+	size_t PutMaybeModifiable(byte *begin, size_t length, int messageEnd, bool blocking, bool modifiable);
+	void NextPutMaybeModifiable(byte *inString, size_t length, bool modifiable)
+	{
+		if (modifiable) NextPutModifiable(inString, length);
+		else NextPutMultiple(inString, length);
+	}
+
+	// This function should no longer be used, put this here to cause a compiler error
+	// if someone tries to override NextPut().
+	virtual int NextPut(const byte *inString, size_t length)
+		{CRYPTOPP_UNUSED(inString); CRYPTOPP_UNUSED(length); CRYPTOPP_ASSERT(false); return 0;}
+
+	class BlockQueue
+	{
+	public:
+		void ResetQueue(size_t blockSize, size_t maxBlocks);
+		byte *GetBlock();
+		byte *GetContigousBlocks(size_t &numberOfBytes);
+		size_t GetAll(byte *outString);
+		void Put(const byte *inString, size_t length);
+		size_t CurrentSize() const {return m_size;}
+		size_t MaxSize() const {return m_buffer.size();}
+
+	private:
+		SecByteBlock m_buffer;
+		size_t m_blockSize, m_maxBlocks, m_size;
+		byte *m_begin;
+	};
+
+	size_t m_firstSize, m_blockSize, m_lastSize;
+	bool m_firstInputDone;
+	BlockQueue m_queue;
+};
+
+/// \brief A filter that buffers input using a ByteQueue
+/// \details FilterWithInputQueue will buffer input using a ByteQueue. When the filter receives
+///  a \ref BufferedTransformation::MessageEnd() "MessageEnd()" signal it will pass the data
+///  on to its attached transformation.
+class CRYPTOPP_DLL FilterWithInputQueue : public Filter
+{
+public:
+	virtual ~FilterWithInputQueue() {}
+
+	/// \brief Construct a FilterWithInputQueue
+	/// \param attachment an optional attached transformation
+	FilterWithInputQueue(BufferedTransformation *attachment=NULLPTR) : Filter(attachment) {}
+
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+	{
+		if (!blocking)
+			throw BlockingInputOnly("FilterWithInputQueue");
+
+		m_inQueue.Put(inString, length);
+		if (messageEnd)
+		{
+			IsolatedMessageEnd(blocking);
+			Output(0, NULLPTR, 0, messageEnd, blocking);
+		}
+		return 0;
+	}
+
+protected:
+	virtual bool IsolatedMessageEnd(bool blocking) =0;
+	void IsolatedInitialize(const NameValuePairs &parameters)
+		{CRYPTOPP_UNUSED(parameters); m_inQueue.Clear();}
+
+	ByteQueue m_inQueue;
+};
+
+/// \struct BlockPaddingSchemeDef
+/// \brief Padding schemes used for block ciphers
+/// \since Crypto++ 5.0
+struct BlockPaddingSchemeDef
+{
+	/// \enum BlockPaddingScheme
+	/// \brief Padding schemes used for block ciphers.
+	/// \details DEFAULT_PADDING means PKCS_PADDING if <tt>cipher.MandatoryBlockSize() > 1 &&
+	///  cipher.MinLastBlockSize() == 0</tt>, which holds for ECB or CBC mode. Otherwise,
+	///  NO_PADDING for modes like OFB, CFB, CTR, CBC-CTS.
+	/// \sa <A HREF="http://www.weidai.com/scan-mirror/csp.html">Block Cipher Padding</A> for
+	///  additional details.
+	/// \since Crypto++ 5.0
+	enum BlockPaddingScheme {
+		/// \brief No padding added to a block
+		/// \since Crypto++ 5.0
+		NO_PADDING,
+		/// \brief 0's padding added to a block
+		/// \since Crypto++ 5.0
+		ZEROS_PADDING,
+		/// \brief PKCS padding added to a block
+		/// \since Crypto++ 5.0
+		PKCS_PADDING,
+		/// \brief 1 and 0's padding added to a block
+		/// \since Crypto++ 5.0
+		ONE_AND_ZEROS_PADDING,
+		/// \brief W3C padding added to a block
+		/// \sa <A HREF="http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/Overview.html">XML
+		///  Encryption Syntax and Processing</A>
+		/// \since Crypto++ 6.0
+		W3C_PADDING,
+		/// \brief Default padding scheme
+		/// \since Crypto++ 5.0
+		DEFAULT_PADDING
+	};
+};
+
+/// \brief Filter wrapper for StreamTransformation
+/// \details StreamTransformationFilter() is a filter wrapper for StreamTransformation(). It is used when
+///  pipelining data for stream ciphers and confidentiality-only block ciphers. The filter will optionally
+///  handle padding and unpadding when needed. If you are using an authenticated encryption mode of operation,
+///  then use AuthenticatedEncryptionFilter() and AuthenticatedDecryptionFilter()
+/// \since Crypto++ 5.0
+class CRYPTOPP_DLL StreamTransformationFilter : public FilterWithBufferedInput, public BlockPaddingSchemeDef, private FilterPutSpaceHelper
+{
+public:
+	virtual ~StreamTransformationFilter() {}
+
+	/// \brief Construct a StreamTransformationFilter
+	/// \param c reference to a StreamTransformation
+	/// \param attachment an optional attached transformation
+	/// \param padding the \ref BlockPaddingSchemeDef "padding scheme"
+	/// \details This constructor creates a StreamTransformationFilter() for stream ciphers and
+	///  confidentiality-only block cipher modes of operation. If you are using an authenticated
+	///  encryption mode of operation, then use either AuthenticatedEncryptionFilter() or
+	///  AuthenticatedDecryptionFilter().
+	/// \sa AuthenticatedEncryptionFilter() and AuthenticatedDecryptionFilter()
+	StreamTransformationFilter(StreamTransformation &c, BufferedTransformation *attachment = NULLPTR, BlockPaddingScheme padding = DEFAULT_PADDING);
+
+	std::string AlgorithmName() const {return m_cipher.AlgorithmName();}
+
+protected:
+
+	friend class AuthenticatedEncryptionFilter;
+	friend class AuthenticatedDecryptionFilter;
+
+	/// \brief Construct a StreamTransformationFilter
+	/// \param c reference to a StreamTransformation
+	/// \param attachment an optional attached transformation
+	/// \param padding the \ref BlockPaddingSchemeDef "padding scheme"
+	/// \param authenticated flag indicating whether the filter should allow authenticated encryption schemes
+	/// \details This constructor is used for authenticated encryption mode of operation and by
+	///  AuthenticatedEncryptionFilter() and AuthenticatedDecryptionFilter().
+	StreamTransformationFilter(StreamTransformation &c, BufferedTransformation *attachment, BlockPaddingScheme padding, bool authenticated);
+
+	void InitializeDerivedAndReturnNewSizes(const NameValuePairs &parameters, size_t &firstSize, size_t &blockSize, size_t &lastSize);
+	void FirstPut(const byte *inString);
+	void NextPutMultiple(const byte *inString, size_t length);
+	void NextPutModifiable(byte *inString, size_t length);
+	void LastPut(const byte *inString, size_t length);
+
+	static size_t LastBlockSize(StreamTransformation &c, BlockPaddingScheme padding);
+
+	StreamTransformation &m_cipher;
+	BlockPaddingScheme m_padding;
+	unsigned int m_mandatoryBlockSize;
+	unsigned int m_optimalBufferSize;
+	unsigned int m_reservedBufferSize;
+	bool m_isSpecial;
+};
+
+/// \brief Filter wrapper for HashTransformation
+/// \since Crypto++ 1.0
+class CRYPTOPP_DLL HashFilter : public Bufferless<Filter>, private FilterPutSpaceHelper
+{
+public:
+	virtual ~HashFilter() {}
+
+	/// \brief Construct a HashFilter
+	/// \param hm reference to a HashTransformation
+	/// \param attachment an optional attached transformation
+	/// \param putMessage flag indicating whether the original message should be passed to an attached transformation
+	/// \param truncatedDigestSize the size of the digest
+	/// \param messagePutChannel the channel on which the message should be output
+	/// \param hashPutChannel the channel on which the digest should be output
+	HashFilter(HashTransformation &hm, BufferedTransformation *attachment = NULLPTR, bool putMessage=false, int truncatedDigestSize=-1, const std::string &messagePutChannel=DEFAULT_CHANNEL, const std::string &hashPutChannel=DEFAULT_CHANNEL);
+
+	std::string AlgorithmName() const {return m_hashModule.AlgorithmName();}
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+	byte * CreatePutSpace(size_t &size) {return m_hashModule.CreateUpdateSpace(size);}
+
+private:
+	HashTransformation &m_hashModule;
+	bool m_putMessage;
+	unsigned int m_digestSize;
+	byte *m_space;
+	std::string m_messagePutChannel, m_hashPutChannel;
+};
+
+/// \brief Filter wrapper for HashTransformation
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL HashVerificationFilter : public FilterWithBufferedInput
+{
+public:
+	virtual ~HashVerificationFilter() {}
+
+	/// \brief Exception thrown when a data integrity check failure is encountered
+	class HashVerificationFailed : public Exception
+	{
+	public:
+		HashVerificationFailed()
+			: Exception(DATA_INTEGRITY_CHECK_FAILED, "HashVerificationFilter: message hash or MAC not valid") {}
+	};
+
+	/// \enum Flags
+	/// \brief Flags controlling filter behavior.
+	/// \details The flags are a bitmask and can be OR'd together.
+	enum Flags {
+		/// \brief The hash is at the end of the message (i.e., concatenation of message+hash)
+		HASH_AT_END=0,
+		/// \brief The hash is at the beginning of the message (i.e., concatenation of hash+message)
+		HASH_AT_BEGIN=1,
+		/// \brief The message should be passed to an attached transformation
+		PUT_MESSAGE=2,
+		/// \brief The hash should be passed to an attached transformation
+		PUT_HASH=4,
+		/// \brief The result of the verification should be passed to an attached transformation
+		PUT_RESULT=8,
+		/// \brief The filter should throw a HashVerificationFailed if a failure is encountered
+		THROW_EXCEPTION=16,
+		/// \brief Default flags using HASH_AT_BEGIN and PUT_RESULT
+		DEFAULT_FLAGS = HASH_AT_BEGIN | PUT_RESULT
+	};
+
+	/// \brief Construct a HashVerificationFilter
+	/// \param hm reference to a HashTransformation
+	/// \param attachment an optional attached transformation
+	/// \param flags flags indicating behaviors for the filter
+	/// \param truncatedDigestSize the size of the digest
+	/// \details <tt>truncatedDigestSize = -1</tt> indicates \ref HashTransformation::DigestSize() "DigestSize" should be used.
+	HashVerificationFilter(HashTransformation &hm, BufferedTransformation *attachment = NULLPTR, word32 flags = DEFAULT_FLAGS, int truncatedDigestSize=-1);
+
+	std::string AlgorithmName() const {return m_hashModule.AlgorithmName();}
+	bool GetLastResult() const {return m_verified;}
+
+protected:
+	void InitializeDerivedAndReturnNewSizes(const NameValuePairs &parameters, size_t &firstSize, size_t &blockSize, size_t &lastSize);
+	void FirstPut(const byte *inString);
+	void NextPutMultiple(const byte *inString, size_t length);
+	void LastPut(const byte *inString, size_t length);
+
+private:
+	friend class AuthenticatedDecryptionFilter;
+
+	HashTransformation &m_hashModule;
+	word32 m_flags;
+	unsigned int m_digestSize;
+	bool m_verified;
+	SecByteBlock m_expectedHash;
+};
+
+/// \brief Filter wrapper for encrypting with AuthenticatedSymmetricCipher
+/// \details AuthenticatedEncryptionFilter() is a wrapper for encrypting with
+///  AuthenticatedSymmetricCipher(), optionally handling padding/unpadding when needed.
+/// \details AuthenticatedDecryptionFilter() for Crypto++ 8.2 and earlier
+///  had a bug where a FileSource() would cause an exception, but a StringSource()
+///  was OK. Also see <A HREF=
+///  "https://github.com/weidai11/cryptopp/issues/817">Issue 817</A> and <A HREF=
+///  "https://github.com/weidai11/cryptopp/commit/ff110c6e183e">Commit ff110c6e183e</A>.
+/// \sa AuthenticatedSymmetricCipher, AuthenticatedDecryptionFilter, EAX, CCM, GCM,
+///  and <A HREF="https://www.cryptopp.com/wiki/AadSource">AadSource</A> on the
+///  Crypto++ wiki.
+/// \since Crypto++ 5.6.0
+class CRYPTOPP_DLL AuthenticatedEncryptionFilter : public StreamTransformationFilter
+{
+public:
+	virtual ~AuthenticatedEncryptionFilter() {}
+
+	/// \brief Construct a AuthenticatedEncryptionFilter
+	/// \param c reference to a AuthenticatedSymmetricCipher
+	/// \param attachment an optional attached transformation
+	/// \param putAAD flag indicating whether the AAD should be passed to an attached transformation
+	/// \param truncatedDigestSize the size of the digest
+	/// \param macChannel the channel on which the MAC should be output
+	/// \param padding the \ref BlockPaddingSchemeDef "padding scheme"
+	/// \details <tt>truncatedDigestSize = -1</tt> indicates \ref HashTransformation::DigestSize() "DigestSize" should be used.
+	/// \since Crypto++ 5.6.0
+	AuthenticatedEncryptionFilter(AuthenticatedSymmetricCipher &c, BufferedTransformation *attachment = NULLPTR, bool putAAD=false, int truncatedDigestSize=-1, const std::string &macChannel=DEFAULT_CHANNEL, BlockPaddingScheme padding = DEFAULT_PADDING);
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	byte * ChannelCreatePutSpace(const std::string &channel, size_t &size);
+	size_t ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking);
+
+	/// \brief Input the last block of data
+	/// \param inString the input byte buffer
+	/// \param length the size of the input buffer, in bytes
+	/// \details LastPut() processes the last block of data and signals attached filters to do the same.
+	///  LastPut() is always called. The pseudo algorithm for the logic is:
+	/// <pre>
+	///     if totalLength < firstSize then length == totalLength
+	///     else if totalLength <= firstSize+lastSize then length == totalLength-firstSize
+	///     else lastSize <= length < lastSize+blockSize
+	/// </pre>
+	void LastPut(const byte *inString, size_t length);
+
+protected:
+	HashFilter m_hf;
+};
+
+/// \brief Filter wrapper for decrypting with AuthenticatedSymmetricCipher
+/// \details AuthenticatedDecryptionFilter() is a wrapper for decrypting with
+///  AuthenticatedSymmetricCipher(), optionally handling padding/unpadding when
+///  needed.
+/// \details AuthenticatedDecryptionFilter() for Crypto++ 8.2 and earlier
+///  had a bug where a FileSource() would cause an exception, but a StringSource()
+///  was OK. Also see <A HREF=
+///  "https://github.com/weidai11/cryptopp/issues/817">Issue 817</A> and <A HREF=
+///  "https://github.com/weidai11/cryptopp/commit/ff110c6e183e">Commit ff110c6e183e</A>.
+/// \sa AuthenticatedSymmetricCipher, AuthenticatedEncryptionFilter, EAX, CCM, GCM,
+///  and <A HREF="https://www.cryptopp.com/wiki/AadSource">AadSource</A> on the
+///  Crypto++ wiki.
+/// \since Crypto++ 5.6.0
+class CRYPTOPP_DLL AuthenticatedDecryptionFilter : public FilterWithBufferedInput, public BlockPaddingSchemeDef
+{
+public:
+	/// \enum Flags
+	/// \brief Flags controlling filter behavior.
+	/// \details The flags are a bitmask and can be OR'd together.
+	enum Flags {
+		/// \brief The MAC is at the end of the message (i.e., concatenation of message+mac)
+		MAC_AT_END=0,
+		/// \brief The MAC is at the beginning of the message (i.e., concatenation of mac+message)
+		MAC_AT_BEGIN=1,
+		/// \brief The filter should throw a HashVerificationFailed if a failure is encountered
+		THROW_EXCEPTION=16,
+		/// \brief Default flags using THROW_EXCEPTION
+		DEFAULT_FLAGS = THROW_EXCEPTION
+	};
+
+	virtual ~AuthenticatedDecryptionFilter() {}
+
+	/// \brief Construct a AuthenticatedDecryptionFilter
+	/// \param c reference to a AuthenticatedSymmetricCipher
+	/// \param attachment an optional attached transformation
+	/// \param flags flags indicating behaviors for the filter
+	/// \param truncatedDigestSize the size of the digest
+	/// \param padding the \ref BlockPaddingSchemeDef "padding scheme"
+	/// \details Additional authenticated data should be given in channel "AAD".
+	/// \details <tt>truncatedDigestSize = -1</tt> indicates \ref HashTransformation::DigestSize() "DigestSize" should be used.
+	/// \since Crypto++ 5.6.0
+	AuthenticatedDecryptionFilter(AuthenticatedSymmetricCipher &c, BufferedTransformation *attachment = NULLPTR, word32 flags = DEFAULT_FLAGS, int truncatedDigestSize=-1, BlockPaddingScheme padding = DEFAULT_PADDING);
+
+	std::string AlgorithmName() const {return m_hashVerifier.AlgorithmName();}
+	byte * ChannelCreatePutSpace(const std::string &channel, size_t &size);
+	size_t ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking);
+	size_t ChannelPutModifiable2(const std::string &channel, byte *begin, size_t length, int messageEnd, bool blocking)
+		{ return ChannelPut2(channel, begin, length, messageEnd, blocking); }
+	/// \brief Get verifier result
+	/// \return true if the digest on the previosus message was valid, false otherwise
+	bool GetLastResult() const {return m_hashVerifier.GetLastResult();}
+
+protected:
+	void InitializeDerivedAndReturnNewSizes(const NameValuePairs &parameters, size_t &firstSize, size_t &blockSize, size_t &lastSize);
+	void FirstPut(const byte *inString);
+	void NextPutMultiple(const byte *inString, size_t length);
+
+	/// \brief Input the last block of data
+	/// \param inString the input byte buffer
+	/// \param length the size of the input buffer, in bytes
+	/// \details LastPut() processes the last block of data and signals attached filters to do the same.
+	///  LastPut() is always called. The pseudo algorithm for the logic is:
+	/// <pre>
+	///     if totalLength < firstSize then length == totalLength
+	///     else if totalLength <= firstSize+lastSize then length == totalLength-firstSize
+	///     else lastSize <= length < lastSize+blockSize
+	/// </pre>
+	void LastPut(const byte *inString, size_t length);
+
+	HashVerificationFilter m_hashVerifier;
+	StreamTransformationFilter m_streamFilter;
+};
+
+/// \brief Filter wrapper for PK_Signer
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL SignerFilter : public Unflushable<Filter>
+{
+public:
+	virtual ~SignerFilter() {}
+
+	/// \brief Construct a SignerFilter
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param signer a PK_Signer derived class
+	/// \param attachment an optional attached transformation
+	/// \param putMessage flag indicating whether the original message should be passed to an attached transformation
+	SignerFilter(RandomNumberGenerator &rng, const PK_Signer &signer, BufferedTransformation *attachment = NULLPTR, bool putMessage=false)
+		: m_rng(rng), m_signer(signer), m_messageAccumulator(signer.NewSignatureAccumulator(rng)), m_putMessage(putMessage) {Detach(attachment);}
+
+	std::string AlgorithmName() const {return m_signer.AlgorithmName();}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+
+private:
+	RandomNumberGenerator &m_rng;
+	const PK_Signer &m_signer;
+	member_ptr<PK_MessageAccumulator> m_messageAccumulator;
+	bool m_putMessage;
+	SecByteBlock m_buf;
+};
+
+/// \brief Filter wrapper for PK_Verifier
+/// \details This filter was formerly named <tt>VerifierFilter</tt>. The name changed at Crypto++ 5.0.
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL SignatureVerificationFilter : public FilterWithBufferedInput
+{
+public:
+	/// \brief Exception thrown when an invalid signature is encountered
+	class SignatureVerificationFailed : public Exception
+	{
+	public:
+		SignatureVerificationFailed()
+			: Exception(DATA_INTEGRITY_CHECK_FAILED, "VerifierFilter: digital signature not valid") {}
+	};
+
+	/// \enum Flags
+	/// \brief Flags controlling filter behavior.
+	/// \details The flags are a bitmask and can be OR'd together.
+	enum Flags {
+		/// \brief The signature is at the end of the message (i.e., concatenation of message+signature)
+		SIGNATURE_AT_END=0,
+		/// \brief The signature is at the beginning of the message (i.e., concatenation of signature+message)
+		SIGNATURE_AT_BEGIN=1,
+		/// \brief The message should be passed to an attached transformation
+		PUT_MESSAGE=2,
+		/// \brief The signature should be passed to an attached transformation
+		PUT_SIGNATURE=4,
+		/// \brief The result of the verification should be passed to an attached transformation
+		PUT_RESULT=8,
+		/// \brief The filter should throw a HashVerificationFailed if a failure is encountered
+		THROW_EXCEPTION=16,
+		/// \brief Default flags using SIGNATURE_AT_BEGIN and PUT_RESULT
+		DEFAULT_FLAGS = SIGNATURE_AT_BEGIN | PUT_RESULT
+	};
+
+	virtual ~SignatureVerificationFilter() {}
+
+	/// \brief Construct a SignatureVerificationFilter
+	/// \param verifier a PK_Verifier derived class
+	/// \param attachment an optional attached transformation
+	/// \param flags flags indicating behaviors for the filter
+	SignatureVerificationFilter(const PK_Verifier &verifier, BufferedTransformation *attachment = NULLPTR, word32 flags = DEFAULT_FLAGS);
+
+	std::string AlgorithmName() const {return m_verifier.AlgorithmName();}
+
+	/// \brief Retrieves the result of the last verification
+	/// \return true if the signature on the previosus message was valid, false otherwise
+	bool GetLastResult() const {return m_verified;}
+
+protected:
+	void InitializeDerivedAndReturnNewSizes(const NameValuePairs &parameters, size_t &firstSize, size_t &blockSize, size_t &lastSize);
+	void FirstPut(const byte *inString);
+	void NextPutMultiple(const byte *inString, size_t length);
+	void LastPut(const byte *inString, size_t length);
+
+private:
+	const PK_Verifier &m_verifier;
+	member_ptr<PK_MessageAccumulator> m_messageAccumulator;
+	word32 m_flags;
+	SecByteBlock m_signature;
+	bool m_verified;
+};
+
+/// \brief Redirect input to another BufferedTransformation without owning it
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL Redirector : public CustomSignalPropagation<Sink>
+{
+public:
+	/// \enum Behavior
+	/// \brief Controls signal propagation behavior
+	enum Behavior
+	{
+		/// \brief Pass data only
+		DATA_ONLY = 0x00,
+		/// \brief Pass signals
+		PASS_SIGNALS = 0x01,
+		/// \brief Pass wait events
+		PASS_WAIT_OBJECTS = 0x02,
+		/// \brief Pass everything
+		/// \details PASS_EVERYTHING is default
+		PASS_EVERYTHING = PASS_SIGNALS | PASS_WAIT_OBJECTS
+	};
+
+	virtual ~Redirector() {}
+
+	/// \brief Construct a Redirector
+	Redirector() : m_target(NULLPTR), m_behavior(PASS_EVERYTHING) {}
+
+	/// \brief Construct a Redirector
+	/// \param target the destination BufferedTransformation
+	/// \param behavior Behavior "flags" specifying signal propagation
+	Redirector(BufferedTransformation &target, Behavior behavior=PASS_EVERYTHING)
+		: m_target(&target), m_behavior(behavior) {}
+
+	/// \brief Redirect input to another BufferedTransformation
+	/// \param target the destination BufferedTransformation
+	void Redirect(BufferedTransformation &target) {m_target = &target;}
+	/// \brief Stop redirecting input
+	void StopRedirection() {m_target = NULLPTR;}
+
+	/// \brief Retrieve signal propagation behavior
+	/// \return the current signal propagation behavior
+	Behavior GetBehavior() {return static_cast<Behavior>(m_behavior);}
+	/// \brief Set signal propagation behavior
+	/// \param behavior the new signal propagation behavior
+	void SetBehavior(Behavior behavior) {m_behavior=behavior;}
+	/// \brief Retrieve signal propagation behavior
+	/// \return true if the Redirector passes signals, false otherwise.
+	bool GetPassSignals() const {return (m_behavior & PASS_SIGNALS) != 0;}
+	/// \brief Set signal propagation behavior
+	/// \param pass flag indicating if the Redirector should pass signals
+	void SetPassSignals(bool pass) { if (pass) m_behavior |= PASS_SIGNALS; else m_behavior &= ~static_cast<word32>(PASS_SIGNALS); }
+	/// \brief Retrieve signal propagation behavior
+	/// \return true if the Redirector passes wait objects, false otherwise.
+	bool GetPassWaitObjects() const {return (m_behavior & PASS_WAIT_OBJECTS) != 0;}
+	/// \brief Set signal propagation behavior
+	/// \param pass flag indicating if the Redirector should pass wait objects
+	void SetPassWaitObjects(bool pass) { if (pass) m_behavior |= PASS_WAIT_OBJECTS; else m_behavior &= ~static_cast<word32>(PASS_WAIT_OBJECTS); }
+
+	bool CanModifyInput() const
+		{return m_target ? m_target->CanModifyInput() : false;}
+
+	void Initialize(const NameValuePairs &parameters, int propagation);
+	byte * CreatePutSpace(size_t &size)
+	{
+		if (m_target)
+			return m_target->CreatePutSpace(size);
+		else
+		{
+			size = 0;
+			return NULLPTR;
+		}
+	}
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+		{return m_target ? m_target->Put2(inString, length, GetPassSignals() ? messageEnd : 0, blocking) : 0;}
+	bool Flush(bool hardFlush, int propagation=-1, bool blocking=true)
+		{return m_target && GetPassSignals() ? m_target->Flush(hardFlush, propagation, blocking) : false;}
+	bool MessageSeriesEnd(int propagation=-1, bool blocking=true)
+		{return m_target && GetPassSignals() ? m_target->MessageSeriesEnd(propagation, blocking) : false;}
+
+	byte * ChannelCreatePutSpace(const std::string &channel, size_t &size)
+	{
+		if (m_target)
+			return m_target->ChannelCreatePutSpace(channel, size);
+		else
+		{
+			size = 0;
+			return NULLPTR;
+		}
+	}
+	size_t ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking)
+		{return m_target ? m_target->ChannelPut2(channel, begin, length, GetPassSignals() ? messageEnd : 0, blocking) : 0;}
+	size_t ChannelPutModifiable2(const std::string &channel, byte *begin, size_t length, int messageEnd, bool blocking)
+		{return m_target ? m_target->ChannelPutModifiable2(channel, begin, length, GetPassSignals() ? messageEnd : 0, blocking) : 0;}
+	bool ChannelFlush(const std::string &channel, bool completeFlush, int propagation=-1, bool blocking=true)
+		{return m_target && GetPassSignals() ? m_target->ChannelFlush(channel, completeFlush, propagation, blocking) : false;}
+	bool ChannelMessageSeriesEnd(const std::string &channel, int propagation=-1, bool blocking=true)
+		{return m_target && GetPassSignals() ? m_target->ChannelMessageSeriesEnd(channel, propagation, blocking) : false;}
+
+	unsigned int GetMaxWaitObjectCount() const
+		{ return m_target && GetPassWaitObjects() ? m_target->GetMaxWaitObjectCount() : 0; }
+	void GetWaitObjects(WaitObjectContainer &container, CallStack const& callStack)
+		{ if (m_target && GetPassWaitObjects()) m_target->GetWaitObjects(container, callStack); }
+
+private:
+	BufferedTransformation *m_target;
+	word32 m_behavior;
+};
+
+/// \brief Filter class that is a proxy for a sink
+/// \details Used By ProxyFilter
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL OutputProxy : public CustomSignalPropagation<Sink>
+{
+public:
+	virtual ~OutputProxy() {}
+
+	/// \brief Construct an OutputProxy
+	/// \param owner the owning transformation
+	/// \param passSignal flag indicating if signals should be passed
+	OutputProxy(BufferedTransformation &owner, bool passSignal) : m_owner(owner), m_passSignal(passSignal) {}
+
+	/// \brief Retrieve passSignal flag
+	/// \return flag indicating if signals should be passed
+	bool GetPassSignal() const {return m_passSignal;}
+	/// \brief Set passSignal flag
+	/// \param passSignal flag indicating if signals should be passed
+	void SetPassSignal(bool passSignal) {m_passSignal = passSignal;}
+
+	byte * CreatePutSpace(size_t &size)
+		{return m_owner.AttachedTransformation()->CreatePutSpace(size);}
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+		{return m_owner.AttachedTransformation()->Put2(inString, length, m_passSignal ? messageEnd : 0, blocking);}
+	size_t PutModifiable2(byte *begin, size_t length, int messageEnd, bool blocking)
+		{return m_owner.AttachedTransformation()->PutModifiable2(begin, length, m_passSignal ? messageEnd : 0, blocking);}
+	void Initialize(const NameValuePairs &parameters=g_nullNameValuePairs, int propagation=-1)
+		{if (m_passSignal) m_owner.AttachedTransformation()->Initialize(parameters, propagation);}
+	bool Flush(bool hardFlush, int propagation=-1, bool blocking=true)
+		{return m_passSignal ? m_owner.AttachedTransformation()->Flush(hardFlush, propagation, blocking) : false;}
+	bool MessageSeriesEnd(int propagation=-1, bool blocking=true)
+		{return m_passSignal ? m_owner.AttachedTransformation()->MessageSeriesEnd(propagation, blocking) : false;}
+
+	byte * ChannelCreatePutSpace(const std::string &channel, size_t &size)
+		{return m_owner.AttachedTransformation()->ChannelCreatePutSpace(channel, size);}
+	size_t ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking)
+		{return m_owner.AttachedTransformation()->ChannelPut2(channel, begin, length, m_passSignal ? messageEnd : 0, blocking);}
+	size_t ChannelPutModifiable2(const std::string &channel, byte *begin, size_t length, int messageEnd, bool blocking)
+		{return m_owner.AttachedTransformation()->ChannelPutModifiable2(channel, begin, length, m_passSignal ? messageEnd : 0, blocking);}
+	bool ChannelFlush(const std::string &channel, bool completeFlush, int propagation=-1, bool blocking=true)
+		{return m_passSignal ? m_owner.AttachedTransformation()->ChannelFlush(channel, completeFlush, propagation, blocking) : false;}
+	bool ChannelMessageSeriesEnd(const std::string &channel, int propagation=-1, bool blocking=true)
+		{return m_passSignal ? m_owner.AttachedTransformation()->ChannelMessageSeriesEnd(channel, propagation, blocking) : false;}
+
+private:
+	BufferedTransformation &m_owner;
+	bool m_passSignal;
+};
+
+/// \brief Base class for Filter classes that are proxies for a chain of other filters
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL ProxyFilter : public FilterWithBufferedInput
+{
+public:
+	virtual ~ProxyFilter() {}
+
+	/// \brief Construct a ProxyFilter
+	/// \param filter an output filter
+	/// \param firstSize the first Put size
+	/// \param lastSize the last Put size
+	/// \param attachment an attached transformation
+	ProxyFilter(BufferedTransformation *filter, size_t firstSize, size_t lastSize, BufferedTransformation *attachment);
+
+	bool IsolatedFlush(bool hardFlush, bool blocking);
+
+	/// \brief Sets the OutputProxy filter
+	/// \param filter an OutputProxy filter
+	void SetFilter(Filter *filter);
+	void NextPutMultiple(const byte *s, size_t len);
+	void NextPutModifiable(byte *inString, size_t length);
+
+protected:
+	member_ptr<BufferedTransformation> m_filter;
+};
+
+/// \brief Proxy filter that doesn't modify the underlying filter's input or output
+/// \since Crypto++ 5.0
+class CRYPTOPP_DLL SimpleProxyFilter : public ProxyFilter
+{
+public:
+	/// \brief Construct a SimpleProxyFilter
+	/// \param filter an output filter
+	/// \param attachment an attached transformation
+	SimpleProxyFilter(BufferedTransformation *filter, BufferedTransformation *attachment)
+		: ProxyFilter(filter, 0, 0, attachment) {}
+
+	void FirstPut(const byte * inString)
+		{CRYPTOPP_UNUSED(inString);}
+
+	/// \brief Input the last block of data
+	/// \param inString the input byte buffer
+	/// \param length the size of the input buffer, in bytes
+	/// \details LastPut() processes the last block of data and signals attached filters to do the same.
+	///  LastPut() is always called. The pseudo algorithm for the logic is:
+	/// <pre>
+	///     if totalLength < firstSize then length == totalLength
+	///     else if totalLength <= firstSize+lastSize then length == totalLength-firstSize
+	///     else lastSize <= length < lastSize+blockSize
+	/// </pre>
+	void LastPut(const byte *inString, size_t length)
+		{CRYPTOPP_UNUSED(inString), CRYPTOPP_UNUSED(length); m_filter->MessageEnd();}
+};
+
+/// \brief Filter wrapper for PK_Encryptor
+/// \details PK_DecryptorFilter is a proxy for the filter created by PK_Encryptor::CreateEncryptionFilter.
+///  This class provides symmetry with VerifierFilter.
+/// \since Crypto++ 5.0
+class CRYPTOPP_DLL PK_EncryptorFilter : public SimpleProxyFilter
+{
+public:
+	/// \brief Construct a PK_EncryptorFilter
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param encryptor a PK_Encryptor derived class
+	/// \param attachment an optional attached transformation
+	PK_EncryptorFilter(RandomNumberGenerator &rng, const PK_Encryptor &encryptor, BufferedTransformation *attachment = NULLPTR)
+		: SimpleProxyFilter(encryptor.CreateEncryptionFilter(rng), attachment) {}
+};
+
+/// \brief Filter wrapper for PK_Decryptor
+/// \details PK_DecryptorFilter is a proxy for the filter created by PK_Decryptor::CreateDecryptionFilter.
+///  This class provides symmetry with SignerFilter.
+/// \since Crypto++ 5.0
+class CRYPTOPP_DLL PK_DecryptorFilter : public SimpleProxyFilter
+{
+public:
+	/// \brief Construct a PK_DecryptorFilter
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param decryptor a PK_Decryptor derived class
+	/// \param attachment an optional attached transformation
+	PK_DecryptorFilter(RandomNumberGenerator &rng, const PK_Decryptor &decryptor, BufferedTransformation *attachment = NULLPTR)
+		: SimpleProxyFilter(decryptor.CreateDecryptionFilter(rng), attachment) {}
+};
+
+/// \brief Append input to a string object
+/// \tparam T std::basic_string<char> type
+/// \details StringSinkTemplate is a StringSinkTemplate typedef
+/// \since Crypto++ 5.0
+template <class T>
+class StringSinkTemplate : public Bufferless<Sink>
+{
+public:
+	typedef typename T::value_type value_type;
+	virtual ~StringSinkTemplate() {}
+
+	/// \brief Construct a StringSinkTemplate
+	/// \param output std::basic_string<char> or std::vector<byte> type
+	StringSinkTemplate(T &output)
+		: m_output(&output) {CRYPTOPP_ASSERT(sizeof(value_type)==1);}
+
+	void IsolatedInitialize(const NameValuePairs &parameters)
+		{if (!parameters.GetValue("OutputStringPointer", m_output)) throw InvalidArgument("StringSink: OutputStringPointer not specified");}
+
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+	{
+		CRYPTOPP_UNUSED(messageEnd); CRYPTOPP_UNUSED(blocking);
+		if (length > 0)
+		{
+			typename T::size_type size = m_output->size();
+			if (length < size && size + length > m_output->capacity())
+				m_output->reserve(2*size);
+			m_output->insert(m_output->end(), (const value_type *)inString, (const value_type *)inString+length);
+		}
+		return 0;
+	}
+
+private:
+	T *m_output;
+};
+
+/// \brief Append input to a string object
+/// \details StringSink is a typedef for StringSinkTemplate<std::string>.
+/// \sa ArraySink, ArrayXorSink
+/// \since Crypto++ 4.0
+DOCUMENTED_TYPEDEF(StringSinkTemplate<std::string>, StringSink);
+CRYPTOPP_DLL_TEMPLATE_CLASS StringSinkTemplate<std::string>;
+
+/// \brief Append input to a std::vector<byte> object
+/// \details VectorSink is a typedef for StringSinkTemplate<std::vector<byte> >.
+/// \since Crypto++ 8.0
+DOCUMENTED_TYPEDEF(StringSinkTemplate<std::vector<byte> >, VectorSink);
+CRYPTOPP_DLL_TEMPLATE_CLASS StringSinkTemplate<std::vector<byte> >;
+
+/// \brief Incorporates input into RNG as additional entropy
+/// \since Crypto++ 4.0
+class RandomNumberSink : public Bufferless<Sink>
+{
+public:
+	virtual ~RandomNumberSink() {}
+
+	/// \brief Construct a RandomNumberSink
+	RandomNumberSink()
+		: m_rng(NULLPTR) {}
+
+	/// \brief Construct a RandomNumberSink
+	/// \param rng a RandomNumberGenerator derived class
+	RandomNumberSink(RandomNumberGenerator &rng)
+		: m_rng(&rng) {}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+
+private:
+	RandomNumberGenerator *m_rng;
+};
+
+/// \brief Copy input to a memory buffer
+/// \details ArraySink wraps a fixed size buffer. The buffer is full once Put returns non-0.
+///  When used in a pipeline, ArraySink silently discards input if the buffer is full.
+///  AvailableSize() can be used to determine how much space remains in the buffer.
+///  TotalPutLength() can be used to determine how many bytes were processed.
+/// \sa StringSink, ArrayXorSink
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL ArraySink : public Bufferless<Sink>
+{
+public:
+	virtual ~ArraySink() {}
+
+	/// \brief Construct an ArraySink
+	/// \param parameters a set of NameValuePairs to initialize this object
+	/// \details Name::OutputBuffer() is a mandatory parameter using this constructor.
+	ArraySink(const NameValuePairs &parameters = g_nullNameValuePairs)
+		: m_buf(NULLPTR), m_size(0), m_total(0) {IsolatedInitialize(parameters);}
+
+	/// \brief Construct an ArraySink
+	/// \param buf pointer to a memory buffer
+	/// \param size length of the memory buffer
+	ArraySink(byte *buf, size_t size)
+		: m_buf(buf), m_size(size), m_total(0) {}
+
+	/// \brief Provides the size remaining in the Sink
+	/// \return size remaining in the Sink, in bytes
+	size_t AvailableSize() {return SaturatingSubtract(m_size, m_total);}
+
+	/// \brief Provides the number of bytes written to the Sink
+	/// \return number of bytes written to the Sink, in bytes
+	lword TotalPutLength() {return m_total;}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	byte * CreatePutSpace(size_t &size);
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+
+protected:
+	byte *m_buf;
+	size_t m_size;
+	lword m_total;
+};
+
+/// \brief Xor input to a memory buffer
+/// \details ArrayXorSink wraps a fixed size buffer. The buffer is full once Put returns non-0.
+///  When used in a pipeline, ArrayXorSink silently discards input if the buffer is full.
+///  AvailableSize() can be used to determine how much space remains in the buffer.
+///  TotalPutLength() can be used to determine how many bytes were processed.
+/// \sa StringSink, ArraySink
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL ArrayXorSink : public ArraySink
+{
+public:
+	virtual ~ArrayXorSink() {}
+
+	/// \brief Construct an ArrayXorSink
+	/// \param buf pointer to a memory buffer
+	/// \param size length of the memory buffer
+	ArrayXorSink(byte *buf, size_t size)
+		: ArraySink(buf, size) {}
+
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+	byte * CreatePutSpace(size_t &size) {return BufferedTransformation::CreatePutSpace(size);}
+};
+
+/// \brief String-based implementation of Store interface
+/// \since Crypto++ 4.0
+class StringStore : public Store
+{
+public:
+	/// \brief Construct a StringStore
+	/// \param string pointer to a C-String
+	StringStore(const char *string = NULLPTR)
+		{StoreInitialize(MakeParameters("InputBuffer", ConstByteArrayParameter(string)));}
+
+	/// \brief Construct a StringStore
+	/// \param string pointer to a memory buffer
+	/// \param length size of the memory buffer
+	StringStore(const byte *string, size_t length)
+		{StoreInitialize(MakeParameters("InputBuffer", ConstByteArrayParameter(string, length)));}
+
+	/// \brief Construct a StringStore
+	/// \tparam T std::basic_string<char> type
+	/// \param string reference to a std::basic_string<char> type
+	template <class T> StringStore(const T &string)
+		{StoreInitialize(MakeParameters("InputBuffer", ConstByteArrayParameter(string)));}
+
+	CRYPTOPP_DLL size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+	CRYPTOPP_DLL size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const;
+
+private:
+	CRYPTOPP_DLL void StoreInitialize(const NameValuePairs &parameters);
+
+	const byte *m_store;
+	size_t m_length, m_count;
+};
+
+/// \brief RNG-based implementation of Source interface
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL RandomNumberStore : public Store
+{
+public:
+	virtual ~RandomNumberStore() {}
+
+	RandomNumberStore()
+		: m_rng(NULLPTR), m_length(0), m_count(0) {}
+
+	RandomNumberStore(RandomNumberGenerator &rng, lword length)
+		: m_rng(&rng), m_length(length), m_count(0) {}
+
+	bool AnyRetrievable() const {return MaxRetrievable() != 0;}
+	lword MaxRetrievable() const {return m_length-m_count;}
+
+	size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+	size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const
+	{
+		CRYPTOPP_UNUSED(target); CRYPTOPP_UNUSED(begin); CRYPTOPP_UNUSED(end); CRYPTOPP_UNUSED(channel); CRYPTOPP_UNUSED(blocking);
+		throw NotImplemented("RandomNumberStore: CopyRangeTo2() is not supported by this store");
+	}
+
+private:
+	void StoreInitialize(const NameValuePairs &parameters);
+
+	RandomNumberGenerator *m_rng;
+	lword m_length, m_count;
+};
+
+/// \brief Empty store
+/// \since Crypto++ 5.0
+class CRYPTOPP_DLL NullStore : public Store
+{
+public:
+	NullStore(lword size = ULONG_MAX) : m_size(size) {}
+	void StoreInitialize(const NameValuePairs &parameters)
+		{CRYPTOPP_UNUSED(parameters);}
+	lword MaxRetrievable() const {return m_size;}
+	size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+	size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const;
+
+private:
+	lword m_size;
+};
+
+/// \brief Implementation of BufferedTransformation's attachment interface
+/// \details Source is a cornerstone of the Pipeline trinitiy. Data flows from
+///  Sources, through Filters, and then terminates in Sinks. The difference
+///  between a Source and Filter is a Source \a pumps data, while a Filter does
+///  not. The difference between a Filter and a Sink is a Filter allows an
+///  attached transformation, while a Sink does not.
+/// \details See the discussion of BufferedTransformation in cryptlib.h for
+///  more details.
+/// \sa Store and SourceTemplate
+/// \since Crypto++ 1.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Source : public InputRejecting<Filter>
+{
+public:
+	virtual ~Source() {}
+
+	/// \brief Construct a Source
+	/// \param attachment an optional attached transformation
+	Source(BufferedTransformation *attachment = NULLPTR)
+		{Source::Detach(attachment);}
+
+	///	\name PIPELINE
+	//@{
+
+	/// \brief Pump data to attached transformation
+	/// \param pumpMax the maximum number of bytes to pump
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+	///  0 indicates all bytes were processed.
+	/// \details Internally, Pump() calls Pump2().
+	/// \note pumpMax is a <tt>lword</tt>, which is a 64-bit value that typically uses
+	///  <tt>LWORD_MAX</tt>. The default argument is <tt>SIZE_MAX</tt>, and it can be
+	///  32-bits or 64-bits.
+	/// \sa Pump2, PumpAll, AnyRetrievable, MaxRetrievable
+	lword Pump(lword pumpMax=SIZE_MAX)
+		{Pump2(pumpMax); return pumpMax;}
+
+	/// \brief Pump messages to attached transformation
+	/// \param count the maximum number of messages to pump
+	/// \return TODO
+	/// \details Internally, PumpMessages() calls PumpMessages2().
+	unsigned int PumpMessages(unsigned int count=UINT_MAX)
+		{PumpMessages2(count); return count;}
+
+	/// \brief Pump all data to attached transformation
+	/// \details Pumps all data to the attached transformation and signal the end of the current
+	///  message. To avoid the MessageEnd() signal call \ref Pump "Pump(LWORD_MAX)" or \ref Pump2
+	///  "Pump2(LWORD_MAX, bool)".
+	/// \details Internally, PumpAll() calls PumpAll2(), which calls PumpMessages().
+	/// \sa Pump, Pump2, AnyRetrievable, MaxRetrievable
+	void PumpAll()
+		{PumpAll2();}
+
+	/// \brief Pump data to attached transformation
+	/// \param byteCount the maximum number of bytes to pump
+	/// \param blocking specifies whether the object should block when processing input
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+	///  0 indicates all bytes were processed.
+	/// \details byteCount is an \a IN and \a OUT parameter. When the call is made, byteCount is the
+	///  requested size of the pump. When the call returns, byteCount is the number of bytes that
+	///  were pumped.
+	/// \sa Pump, PumpAll, AnyRetrievable, MaxRetrievable
+	virtual size_t Pump2(lword &byteCount, bool blocking=true) =0;
+
+	/// \brief Pump messages to attached transformation
+	/// \param messageCount the maximum number of messages to pump
+	/// \param blocking specifies whether the object should block when processing input
+	/// \details messageCount is an IN and OUT parameter.
+	virtual size_t PumpMessages2(unsigned int &messageCount, bool blocking=true) =0;
+
+	/// \brief Pump all data to attached transformation
+	/// \param blocking specifies whether the object should block when processing input
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed).
+	///  0 indicates all bytes were processed.
+	/// \sa Pump, Pump2, AnyRetrievable, MaxRetrievable
+	virtual size_t PumpAll2(bool blocking=true);
+
+	/// \brief Determines if the Source is exhausted
+	/// \return true if the source has been exhausted
+	virtual bool SourceExhausted() const =0;
+
+	//@}
+
+protected:
+	void SourceInitialize(bool pumpAll, const NameValuePairs &parameters)
+	{
+		IsolatedInitialize(parameters);
+		if (pumpAll)
+			PumpAll();
+	}
+};
+
+/// \brief Transform a Store into a Source
+/// \tparam T the class or type
+/// \since Crypto++ 5.0
+template <class T>
+class SourceTemplate : public Source
+{
+public:
+	virtual ~SourceTemplate() {}
+
+	/// \brief Construct a SourceTemplate
+	/// \param attachment an attached transformation
+	SourceTemplate(BufferedTransformation *attachment)
+		: Source(attachment) {}
+	void IsolatedInitialize(const NameValuePairs &parameters)
+		{m_store.IsolatedInitialize(parameters);}
+	size_t Pump2(lword &byteCount, bool blocking=true)
+		{return m_store.TransferTo2(*AttachedTransformation(), byteCount, DEFAULT_CHANNEL, blocking);}
+	size_t PumpMessages2(unsigned int &messageCount, bool blocking=true)
+		{return m_store.TransferMessagesTo2(*AttachedTransformation(), messageCount, DEFAULT_CHANNEL, blocking);}
+	size_t PumpAll2(bool blocking=true)
+		{return m_store.TransferAllTo2(*AttachedTransformation(), DEFAULT_CHANNEL, blocking);}
+	bool SourceExhausted() const
+		{return !m_store.AnyRetrievable() && !m_store.AnyMessages();}
+	void SetAutoSignalPropagation(int propagation)
+		{m_store.SetAutoSignalPropagation(propagation);}
+	int GetAutoSignalPropagation() const
+		{return m_store.GetAutoSignalPropagation();}
+
+protected:
+	T m_store;
+};
+
+/// \brief String-based implementation of the Source interface
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL StringSource : public SourceTemplate<StringStore>
+{
+public:
+	/// \brief Construct a StringSource
+	/// \param attachment an optional attached transformation
+	StringSource(BufferedTransformation *attachment = NULLPTR)
+		: SourceTemplate<StringStore>(attachment) {}
+
+	/// \brief Construct a StringSource
+	/// \param string C-String
+	/// \param pumpAll flag indicating if source data should be pumped to its attached transformation
+	/// \param attachment an optional attached transformation
+	StringSource(const char *string, bool pumpAll, BufferedTransformation *attachment = NULLPTR)
+		: SourceTemplate<StringStore>(attachment) {SourceInitialize(pumpAll, MakeParameters("InputBuffer", ConstByteArrayParameter(string)));}
+
+	/// \brief Construct a StringSource
+	/// \param string binary byte array
+	/// \param length size of the byte array
+	/// \param pumpAll flag indicating if source data should be pumped to its attached transformation
+	/// \param attachment an optional attached transformation
+	StringSource(const byte *string, size_t length, bool pumpAll, BufferedTransformation *attachment = NULLPTR)
+		: SourceTemplate<StringStore>(attachment) {SourceInitialize(pumpAll, MakeParameters("InputBuffer", ConstByteArrayParameter(string, length)));}
+
+	/// \brief Construct a StringSource
+	/// \param string std::string
+	/// \param pumpAll flag indicating if source data should be pumped to its attached transformation
+	/// \param attachment an optional attached transformation
+	StringSource(const std::string &string, bool pumpAll, BufferedTransformation *attachment = NULLPTR)
+		: SourceTemplate<StringStore>(attachment) {SourceInitialize(pumpAll, MakeParameters("InputBuffer", ConstByteArrayParameter(string)));}
+};
+
+/// \brief Pointer-based implementation of the Source interface
+/// \details ArraySource is a typedef for StringSource. Use the third constructor for an array source.
+///  The third constructor takes a pointer and length.
+/// \since Crypto++ 5.6.0
+DOCUMENTED_TYPEDEF(StringSource, ArraySource);
+
+/// \brief std::vector-based implementation of the Source interface
+/// \since Crypto++ 8.0
+class CRYPTOPP_DLL VectorSource : public SourceTemplate<StringStore>
+{
+public:
+	/// \brief Construct a VectorSource
+	/// \param attachment an optional attached transformation
+	VectorSource(BufferedTransformation *attachment = NULLPTR)
+		: SourceTemplate<StringStore>(attachment) {}
+
+	/// \brief Construct a VectorSource
+	/// \param vec vector of bytes
+	/// \param pumpAll flag indicating if source data should be pumped to its attached transformation
+	/// \param attachment an optional attached transformation
+	VectorSource(const std::vector<byte> &vec, bool pumpAll, BufferedTransformation *attachment = NULLPTR)
+		: SourceTemplate<StringStore>(attachment) {SourceInitialize(pumpAll, MakeParameters("InputBuffer", ConstByteArrayParameter(vec)));}
+};
+
+/// \brief RNG-based implementation of Source interface
+/// \since Crypto++ 4.0
+class CRYPTOPP_DLL RandomNumberSource : public SourceTemplate<RandomNumberStore>
+{
+public:
+	RandomNumberSource(RandomNumberGenerator &rng, int length, bool pumpAll, BufferedTransformation *attachment = NULLPTR)
+		: SourceTemplate<RandomNumberStore>(attachment)
+		{SourceInitialize(pumpAll, MakeParameters("RandomNumberGeneratorPointer", &rng)("RandomNumberStoreSize", length));}
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/fips140.cpp b/runtime/third_party/cryptopp/fips140.cpp
new file mode 100644
index 0000000..e449eed
--- /dev/null
+++ b/runtime/third_party/cryptopp/fips140.cpp
@@ -0,0 +1,84 @@
+// fips140.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "fips140.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Define this to 1 to turn on FIPS 140-2 compliance features, including additional tests during
+// startup, random number generation, and key generation. These tests may affect performance.
+#ifndef CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2
+#define CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2 0
+#endif
+
+#if (CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2 && !defined(OS_RNG_AVAILABLE))
+#error FIPS 140-2 compliance requires the availability of OS provided RNG.
+#endif
+
+PowerUpSelfTestStatus g_powerUpSelfTestStatus = POWER_UP_SELF_TEST_NOT_DONE;
+
+bool FIPS_140_2_ComplianceEnabled()
+{
+	return CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2;
+}
+
+void SimulatePowerUpSelfTestFailure()
+{
+	g_powerUpSelfTestStatus = POWER_UP_SELF_TEST_FAILED;
+}
+
+PowerUpSelfTestStatus CRYPTOPP_API GetPowerUpSelfTestStatus()
+{
+	return g_powerUpSelfTestStatus;
+}
+
+#if CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2
+// One variable for all threads for compatibility. Previously this
+// was a ThreadLocalStorage variable, which is per-thread. Also see
+// https://github.com/weidai11/cryptopp/issues/208
+static bool s_inProgress = false;
+#endif
+
+bool PowerUpSelfTestInProgressOnThisThread()
+{
+#if CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2
+	return s_inProgress;
+#else
+	return false;
+#endif
+}
+
+void SetPowerUpSelfTestInProgressOnThisThread(bool inProgress)
+{
+#if CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2
+	s_inProgress = inProgress;
+#else
+	CRYPTOPP_UNUSED(inProgress);
+#endif
+}
+
+void EncryptionPairwiseConsistencyTest_FIPS_140_Only(const PK_Encryptor &encryptor, const PK_Decryptor &decryptor)
+{
+#if CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2
+	EncryptionPairwiseConsistencyTest(encryptor, decryptor);
+#else
+	CRYPTOPP_UNUSED(encryptor), CRYPTOPP_UNUSED(decryptor);
+#endif
+}
+
+void SignaturePairwiseConsistencyTest_FIPS_140_Only(const PK_Signer &signer, const PK_Verifier &verifier)
+{
+#if CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2
+	SignaturePairwiseConsistencyTest(signer, verifier);
+#else
+	CRYPTOPP_UNUSED(signer), CRYPTOPP_UNUSED(verifier);
+#endif
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/fips140.h b/runtime/third_party/cryptopp/fips140.h
new file mode 100644
index 0000000..ebc67ed
--- /dev/null
+++ b/runtime/third_party/cryptopp/fips140.h
@@ -0,0 +1,112 @@
+// fips140.h - originally written and placed in the public domain by Wei Dai
+
+/// \file fips140.h
+/// \brief Classes and functions for the FIPS 140-2 validated library
+/// \details The FIPS validated library is only available on Windows as a DLL. Once compiled,
+///   the library is always in FIPS mode contingent upon successful execution of
+///   DoPowerUpSelfTest() or DoDllPowerUpSelfTest().
+/// \sa <A HREF="http://cryptopp.com/wiki/Visual_Studio">Visual Studio</A> and
+///   <A HREF="http://cryptopp.com/wiki/config.h">config.h</A> on the Crypto++ wiki.
+
+#ifndef CRYPTOPP_FIPS140_H
+#define CRYPTOPP_FIPS140_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// Exception thrown when a crypto algorithm is used after a self test fails
+/// \details The self tests for an algorithm are performed by Algorithm class
+///   when CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2 is defined.
+class CRYPTOPP_DLL SelfTestFailure : public Exception
+{
+public:
+	explicit SelfTestFailure(const std::string &s) : Exception(OTHER_ERROR, s) {}
+};
+
+/// \brief Determines whether the library provides FIPS validated cryptography
+/// \return true if FIPS 140-2 validated features were enabled at compile time.
+/// \details true if FIPS 140-2 validated features were enabled at compile time,
+///   false otherwise.
+/// \note FIPS mode is enabled at compile time. A program or other module cannot
+///   arbitrarily enter or exit the mode.
+CRYPTOPP_DLL bool CRYPTOPP_API FIPS_140_2_ComplianceEnabled();
+
+/// \brief Status of the power-up self test
+enum PowerUpSelfTestStatus {
+
+	/// \brief The self tests have not been performed.
+	POWER_UP_SELF_TEST_NOT_DONE,
+	/// \brief The self tests were executed via DoPowerUpSelfTest() or
+	///   DoDllPowerUpSelfTest(), but the result was failure.
+	POWER_UP_SELF_TEST_FAILED,
+	/// \brief The self tests were executed via DoPowerUpSelfTest() or
+	///   DoDllPowerUpSelfTest(), and the result was success.
+	POWER_UP_SELF_TEST_PASSED
+};
+
+/// \brief Performs the power-up self test
+/// \param moduleFilename the fully qualified name of the module
+/// \param expectedModuleMac the expected MAC of the components protected by the integrity check
+/// \details Performs the power-up self test, and sets the self test status to
+///   POWER_UP_SELF_TEST_PASSED or POWER_UP_SELF_TEST_FAILED.
+/// \details The self tests for an algorithm are performed by the Algorithm class
+///   when CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2 is defined.
+CRYPTOPP_DLL void CRYPTOPP_API DoPowerUpSelfTest(const char *moduleFilename, const byte *expectedModuleMac);
+
+/// \brief Performs the power-up self test on the DLL
+/// \details Performs the power-up self test using the filename of this DLL and the
+///   embedded module MAC, and sets the self test status to POWER_UP_SELF_TEST_PASSED or
+///   POWER_UP_SELF_TEST_FAILED.
+/// \details The self tests for an algorithm are performed by the Algorithm class
+///   when CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2 is defined.
+CRYPTOPP_DLL void CRYPTOPP_API DoDllPowerUpSelfTest();
+
+/// \brief Sets the power-up self test status to POWER_UP_SELF_TEST_FAILED
+/// \details Sets the power-up self test status to POWER_UP_SELF_TEST_FAILED to simulate failure.
+CRYPTOPP_DLL void CRYPTOPP_API SimulatePowerUpSelfTestFailure();
+
+/// \brief Provides the current power-up self test status
+/// \return the current power-up self test status
+CRYPTOPP_DLL PowerUpSelfTestStatus CRYPTOPP_API GetPowerUpSelfTestStatus();
+
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+typedef PowerUpSelfTestStatus (CRYPTOPP_API * PGetPowerUpSelfTestStatus)();
+#endif
+
+/// \brief Class object that calculates the MAC on the module
+/// \return the MAC for the module
+CRYPTOPP_DLL MessageAuthenticationCode * CRYPTOPP_API NewIntegrityCheckingMAC();
+
+/// \brief Verifies the MAC on the module
+/// \param moduleFilename the fully qualified name of the module
+/// \param expectedModuleMac the expected MAC of the components protected by the integrity check
+/// \param pActualMac the actual MAC of the components calculated by the integrity check
+/// \param pMacFileLocation the offset of the MAC in the PE/PE+ module
+/// \return true if the MAC is valid, false otherwise
+CRYPTOPP_DLL bool CRYPTOPP_API IntegrityCheckModule(const char *moduleFilename, const byte *expectedModuleMac, SecByteBlock *pActualMac = NULLPTR, unsigned long *pMacFileLocation = NULLPTR);
+
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+// this is used by Algorithm constructor to allow Algorithm objects to be constructed for the self test
+bool PowerUpSelfTestInProgressOnThisThread();
+
+void SetPowerUpSelfTestInProgressOnThisThread(bool inProgress);
+
+void SignaturePairwiseConsistencyTest(const PK_Signer &signer, const PK_Verifier &verifier);
+void EncryptionPairwiseConsistencyTest(const PK_Encryptor &encryptor, const PK_Decryptor &decryptor);
+
+void SignaturePairwiseConsistencyTest_FIPS_140_Only(const PK_Signer &signer, const PK_Verifier &verifier);
+void EncryptionPairwiseConsistencyTest_FIPS_140_Only(const PK_Encryptor &encryptor, const PK_Decryptor &decryptor);
+#endif
+
+/// \brief The placeholder used prior to embedding the actual MAC in the module.
+/// \details After the DLL is built but before it is MAC'd, the string CRYPTOPP_DUMMY_DLL_MAC
+///   is used as a placeholder for the actual MAC. A post-build step is performed which calculates
+///   the MAC of the DLL and embeds it in the module. The actual MAC is written by the
+///   <tt>cryptest.exe</tt> program using the <tt>mac_dll</tt> subcommand.
+#define CRYPTOPP_DUMMY_DLL_MAC "MAC_51f34b8db820ae8"
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/fipsalgt.cpp b/runtime/third_party/cryptopp/fipsalgt.cpp
new file mode 100644
index 0000000..1f2061b
--- /dev/null
+++ b/runtime/third_party/cryptopp/fipsalgt.cpp
@@ -0,0 +1,1293 @@
+// fipsalgt.cpp - originally written and placed in the public domain by Wei Dai
+
+// This file implements the various algorithm tests needed to pass FIPS 140 validation.
+// They're preserved here (commented out) in case Crypto++ needs to be revalidated.
+
+#if 0
+#ifndef CRYPTOPP_IMPORTS
+#define CRYPTOPP_DEFAULT_NO_DLL
+#endif
+
+#include "dll.h"
+#include "cryptlib.h"
+#include "smartptr.h"
+#include "filters.h"
+#include "oids.h"
+
+USING_NAMESPACE(CryptoPP)
+
+class LineBreakParser : public AutoSignaling<Bufferless<Filter> >
+{
+public:
+	LineBreakParser(BufferedTransformation *attachment=NULLPTR, byte lineEnd='\n')
+		: m_lineEnd(lineEnd) {Detach(attachment);}
+
+	size_t Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+	{
+		if (!blocking)
+			throw BlockingInputOnly("LineBreakParser");
+
+		unsigned int i, last = 0;
+		for (i=0; i<length; i++)
+		{
+			if (begin[i] == m_lineEnd)
+			{
+				AttachedTransformation()->Put2(begin+last, i-last, GetAutoSignalPropagation(), blocking);
+				last = i+1;
+			}
+		}
+		if (last != i)
+			AttachedTransformation()->Put2(begin+last, i-last, 0, blocking);
+
+		if (messageEnd && GetAutoSignalPropagation())
+		{
+			AttachedTransformation()->MessageEnd(GetAutoSignalPropagation()-1, blocking);
+			AttachedTransformation()->MessageSeriesEnd(GetAutoSignalPropagation()-1, blocking);
+		}
+
+		return 0;
+	}
+
+private:
+	byte m_lineEnd;
+};
+
+class TestDataParser : public Unflushable<FilterWithInputQueue>
+{
+public:
+	enum DataType {OTHER, COUNT, KEY_T, IV, INPUT, OUTPUT};
+
+	TestDataParser(std::string algorithm, std::string test, std::string mode, unsigned int feedbackSize, bool encrypt, BufferedTransformation *attachment)
+		: m_algorithm(algorithm), m_test(test), m_mode(mode), m_feedbackSize(feedbackSize)
+		, m_firstLine(true), m_blankLineTransition(0)
+	{
+		Detach(attachment);
+
+		m_typeToName[COUNT] = "COUNT";
+
+		m_nameToType["COUNT"] = COUNT;
+		m_nameToType["KEY"] = KEY_T;
+		m_nameToType["KEYs"] = KEY_T;
+		m_nameToType["key"] = KEY_T;
+		m_nameToType["Key"] = KEY_T;
+		m_nameToType["IV"] = IV;
+		m_nameToType["IV1"] = IV;
+		m_nameToType["CV"] = IV;
+		m_nameToType["CV1"] = IV;
+		m_nameToType["IB"] = IV;
+		m_nameToType["TEXT"] = INPUT;
+		m_nameToType["RESULT"] = OUTPUT;
+		m_nameToType["Msg"] = INPUT;
+		m_nameToType["Seed"] = INPUT;
+		m_nameToType["V"] = INPUT;
+		m_nameToType["DT"] = IV;
+		SetEncrypt(encrypt);
+
+		if (m_algorithm == "DSA" || m_algorithm == "ECDSA")
+		{
+			if (m_test == "PKV")
+				m_trigger = "Qy";
+			else if (m_test == "KeyPair")
+				m_trigger = "N";
+			else if (m_test == "SigGen")
+				m_trigger = "Msg";
+			else if (m_test == "SigVer")
+				m_trigger = "S";
+			else if (m_test == "PQGGen")
+				m_trigger = "N";
+			else if (m_test == "PQGVer")
+				m_trigger = "H";
+		}
+		else if (m_algorithm == "HMAC")
+			m_trigger = "Msg";
+		else if (m_algorithm == "SHA")
+			m_trigger = (m_test == "MONTE") ? "Seed" : "Msg";
+		else if (m_algorithm == "RNG")
+			m_trigger = "V";
+		else if (m_algorithm == "RSA")
+			m_trigger = (m_test == "Ver") ? "S" : "Msg";
+	}
+
+	void SetEncrypt(bool encrypt)
+	{
+		m_encrypt = encrypt;
+		if (encrypt)
+		{
+			m_nameToType["PLAINTEXT"] = INPUT;
+			m_nameToType["CIPHERTEXT"] = OUTPUT;
+			m_nameToType["PT"] = INPUT;
+			m_nameToType["CT"] = OUTPUT;
+		}
+		else
+		{
+			m_nameToType["PLAINTEXT"] = OUTPUT;
+			m_nameToType["CIPHERTEXT"] = INPUT;
+			m_nameToType["PT"] = OUTPUT;
+			m_nameToType["CT"] = INPUT;
+		}
+
+		if (m_algorithm == "AES" || m_algorithm == "TDES")
+		{
+			if (encrypt)
+			{
+				m_trigger = "PLAINTEXT";
+				m_typeToName[OUTPUT] = "CIPHERTEXT";
+			}
+			else
+			{
+				m_trigger = "CIPHERTEXT";
+				m_typeToName[OUTPUT] = "PLAINTEXT";
+			}
+			m_count = 0;
+		}
+	}
+
+protected:
+	void OutputData(std::string &output, const std::string &key, const std::string &data)
+	{
+		output += key;
+		output += "= ";
+		output += data;
+		output += "\n";
+	}
+
+	void OutputData(std::string &output, const std::string &key, int data)
+	{
+		OutputData(output, key, IntToString(data));
+	}
+
+	void OutputData(std::string &output, const std::string &key, const SecByteBlock &data)
+	{
+		output += key;
+		output += "= ";
+		HexEncoder(new StringSink(output), false).Put(data, data.size());
+		output += "\n";
+	}
+
+	void OutputData(std::string &output, const std::string &key, const Integer &data, int size=-1)
+	{
+		SecByteBlock s(size < 0 ? data.MinEncodedSize() : size);
+		data.Encode(s, s.size());
+		OutputData(output, key, s);
+	}
+
+	void OutputData(std::string &output, const std::string &key, const PolynomialMod2 &data, int size=-1)
+	{
+		SecByteBlock s(size < 0 ? data.MinEncodedSize() : size);
+		data.Encode(s, s.size());
+		OutputData(output, key, s);
+	}
+
+	void OutputData(std::string &output, DataType t, const std::string &data)
+	{
+		if (m_algorithm == "SKIPJACK")
+		{
+			if (m_test == "KAT")
+			{
+				if (t == OUTPUT)
+					output = m_line + data + "\n";
+			}
+			else
+			{
+				if (t != COUNT)
+				{
+					output += m_typeToName[t];
+					output += "=";
+				}
+				output += data;
+				output += t == OUTPUT ? "\n" : "  ";
+			}
+		}
+		else if (m_algorithm == "TDES" && t == KEY_T && m_typeToName[KEY_T].empty())
+		{
+			output += "KEY1 = ";
+			output += data.substr(0, 16);
+			output += "\nKEY2 = ";
+			output += data.size() > 16 ? data.substr(16, 16) : data.substr(0, 16);
+			output += "\nKEY3 = ";
+			output += data.size() > 32 ? data.substr(32, 16) : data.substr(0, 16);
+			output += "\n";
+		}
+		else
+		{
+			output += m_typeToName[t];
+			output += " = ";
+			output += data;
+			output += "\n";
+		}
+	}
+
+	void OutputData(std::string &output, DataType t, int i)
+	{
+		OutputData(output, t, IntToString(i));
+	}
+
+	void OutputData(std::string &output, DataType t, const SecByteBlock &data)
+	{
+		std::string hexData;
+		StringSource(data.begin(), data.size(), true, new HexEncoder(new StringSink(hexData), false));
+		OutputData(output, t, hexData);
+	}
+
+	void OutputGivenData(std::string &output, DataType t, bool optional = false)
+	{
+		if (m_data.find(m_typeToName[t]) == m_data.end())
+		{
+			if (optional)
+				return;
+			throw Exception(Exception::OTHER_ERROR, "TestDataParser: key not found: " + m_typeToName[t]);
+		}
+
+		OutputData(output, t, m_data[m_typeToName[t]]);
+	}
+
+	template <class T>
+		BlockCipher * NewBT(T *)
+	{
+		if (!m_encrypt && (m_mode == "ECB" || m_mode == "CBC"))
+			return new typename T::Decryption;
+		else
+			return new typename T::Encryption;
+	}
+
+	template <class T>
+		SymmetricCipher * NewMode(T *, BlockCipher &bt, const byte *iv)
+	{
+		if (!m_encrypt)
+			return new typename T::Decryption(bt, iv, m_feedbackSize/8);
+		else
+			return new typename T::Encryption(bt, iv, m_feedbackSize/8);
+	}
+
+	static inline void Xor(SecByteBlock &z, const SecByteBlock &x, const SecByteBlock &y)
+	{
+		CRYPTOPP_ASSERT(x.size() == y.size());
+		z.resize(x.size());
+		xorbuf(z, x, y, x.size());
+	}
+
+	SecByteBlock UpdateKey(SecByteBlock key, const SecByteBlock *text)
+	{
+		unsigned int innerCount = (m_algorithm == "AES") ? 1000 : 10000;
+		int keySize = key.size(), blockSize = text[0].size();
+		SecByteBlock x(keySize);
+		for (int k=0; k<keySize;)
+		{
+			int pos = innerCount * blockSize - keySize + k;
+			std::memcpy(x + k, text[pos / blockSize] + pos % blockSize, blockSize - pos % blockSize);
+			k += blockSize - pos % blockSize;
+		}
+
+		if (m_algorithm == "TDES" || m_algorithm == "DES")
+		{
+			for (int i=0; i<keySize; i+=8)
+			{
+				xorbuf(key+i, x+keySize-8-i, 8);
+				DES::CorrectKeyParityBits(key+i);
+			}
+		}
+		else
+			xorbuf(key, x, keySize);
+
+		return key;
+	}
+
+	static inline void AssignLeftMostBits(SecByteBlock &z, const SecByteBlock &x, unsigned int K)
+	{
+		z.Assign(x, K/8);
+	}
+
+	template <class EC>
+	void EC_KeyPair(string &output, int n, const OID &oid)
+	{
+		DL_GroupParameters_EC<EC> params(oid);
+		for (int i=0; i<n; i++)
+		{
+			DL_PrivateKey_EC<EC> priv;
+			DL_PublicKey_EC<EC> pub;
+			priv.Initialize(m_rng, params);
+			priv.MakePublicKey(pub);
+
+			OutputData(output, "d ", priv.GetPrivateExponent());
+			OutputData(output, "Qx ", pub.GetPublicElement().x, params.GetCurve().GetField().MaxElementByteLength());
+			OutputData(output, "Qy ", pub.GetPublicElement().y, params.GetCurve().GetField().MaxElementByteLength());
+		}
+	}
+
+	template <class EC>
+	void EC_SigGen(string &output, const OID &oid)
+	{
+		DL_GroupParameters_EC<EC> params(oid);
+		typename ECDSA<EC, SHA1>::PrivateKey priv;
+		typename ECDSA<EC, SHA1>::PublicKey pub;
+		priv.Initialize(m_rng, params);
+		priv.MakePublicKey(pub);
+
+		typename ECDSA<EC, SHA1>::Signer signer(priv);
+		SecByteBlock sig(signer.SignatureLength());
+		StringSource(m_data["Msg"], true, new HexDecoder(new SignerFilter(m_rng, signer, new ArraySink(sig, sig.size()))));
+		SecByteBlock R(sig, sig.size()/2), S(sig+sig.size()/2, sig.size()/2);
+
+		OutputData(output, "Qx ", pub.GetPublicElement().x, params.GetCurve().GetField().MaxElementByteLength());
+		OutputData(output, "Qy ", pub.GetPublicElement().y, params.GetCurve().GetField().MaxElementByteLength());
+		OutputData(output, "R ", R);
+		OutputData(output, "S ", S);
+	}
+
+	template <class EC>
+	void EC_SigVer(string &output, const OID &oid)
+	{
+		SecByteBlock x(DecodeHex(m_data["Qx"]));
+		SecByteBlock y(DecodeHex(m_data["Qy"]));
+		Integer r((m_data["R"]+"h").c_str());
+		Integer s((m_data["S"]+"h").c_str());
+
+		typename EC::FieldElement Qx(x, x.size());
+		typename EC::FieldElement Qy(y, y.size());
+		typename EC::Element Q(Qx, Qy);
+
+		DL_GroupParameters_EC<EC> params(oid);
+		typename ECDSA<EC, SHA1>::PublicKey pub;
+		pub.Initialize(params, Q);
+		typename ECDSA<EC, SHA1>::Verifier verifier(pub);
+
+		SecByteBlock sig(verifier.SignatureLength());
+		r.Encode(sig, sig.size()/2);
+		s.Encode(sig+sig.size()/2, sig.size()/2);
+
+		SignatureVerificationFilter filter(verifier);
+		filter.Put(sig, sig.size());
+		StringSource(m_data["Msg"], true, new HexDecoder(new Redirector(filter, Redirector::DATA_ONLY)));
+		filter.MessageEnd();
+		byte b;
+		filter.Get(b);
+		OutputData(output, "Result ", b ? "P" : "F");
+	}
+
+	template <class EC>
+	static bool EC_PKV(RandomNumberGenerator &rng, const SecByteBlock &x, const SecByteBlock &y, const OID &oid)
+	{
+		typename EC::FieldElement Qx(x, x.size());
+		typename EC::FieldElement Qy(y, y.size());
+		typename EC::Element Q(Qx, Qy);
+
+		DL_GroupParameters_EC<EC> params(oid);
+		typename ECDSA<EC, SHA1>::PublicKey pub;
+		pub.Initialize(params, Q);
+		return pub.Validate(rng, 3);
+	}
+
+	template <class H, class Result>
+	Result * CreateRSA2(const std::string &standard)
+	{
+		if (typeid(Result) == typeid(PK_Verifier))
+		{
+			if (standard == "R")
+				return (Result *) new typename RSASS_ISO<H>::Verifier;
+			else if (standard == "P")
+				return (Result *) new typename RSASS<PSS, H>::Verifier;
+			else if (standard == "1")
+				return (Result *) new typename RSASS<PKCS1v15, H>::Verifier;
+		}
+		else if (typeid(Result) == typeid(PK_Signer))
+		{
+			if (standard == "R")
+				return (Result *) new typename RSASS_ISO<H>::Signer;
+			else if (standard == "P")
+				return (Result *) new typename RSASS<PSS, H>::Signer;
+			else if (standard == "1")
+				return (Result *) new typename RSASS<PKCS1v15, H>::Signer;
+		}
+
+		return NULLPTR;
+	}
+
+	template <class Result>
+	Result * CreateRSA(const std::string &standard, const std::string &hash)
+	{
+		if (hash == "1")
+			return CreateRSA2<SHA1, Result>(standard);
+		else if (hash == "224")
+			return CreateRSA2<SHA224, Result>(standard);
+		else if (hash == "256")
+			return CreateRSA2<SHA256, Result>(standard);
+		else if (hash == "384")
+			return CreateRSA2<SHA384, Result>(standard);
+		else if (hash == "512")
+			return CreateRSA2<SHA512, Result>(standard);
+		else
+			return NULLPTR;
+	}
+
+	virtual void DoTest()
+	{
+		std::string output;
+
+		if (m_algorithm == "DSA")
+		{
+			if (m_test == "KeyPair")
+			{
+				DL_GroupParameters_DSA pqg;
+				int modLen = atol(m_bracketString.substr(6).c_str());
+				pqg.GenerateRandomWithKeySize(m_rng, modLen);
+
+				OutputData(output, "P ", pqg.GetModulus());
+				OutputData(output, "Q ", pqg.GetSubgroupOrder());
+				OutputData(output, "G ", pqg.GetSubgroupGenerator());
+
+				int n = atol(m_data["N"].c_str());
+				for (int i=0; i<n; i++)
+				{
+					DSA::Signer priv;
+					priv.AccessKey().GenerateRandom(m_rng, pqg);
+					DSA::Verifier pub(priv);
+
+					OutputData(output, "X ", priv.GetKey().GetPrivateExponent());
+					OutputData(output, "Y ", pub.GetKey().GetPublicElement());
+					AttachedTransformation()->Put((byte *)output.data(), output.size());
+					output.resize(0);
+				}
+			}
+			else if (m_test == "PQGGen")
+			{
+				int n = atol(m_data["N"].c_str());
+				for (int i=0; i<n; i++)
+				{
+					Integer p, q, h, g;
+					int counter;
+
+					SecByteBlock seed(SHA1::DIGESTSIZE);
+					do
+					{
+						m_rng.GenerateBlock(seed, seed.size());
+					}
+					while (!DSA::GeneratePrimes(seed, seed.size()*8, counter, p, 1024, q));
+					h.Randomize(m_rng, 2, p-2);
+					g = a_exp_b_mod_c(h, (p-1)/q, p);
+
+					OutputData(output, "P ", p);
+					OutputData(output, "Q ", q);
+					OutputData(output, "G ", g);
+					OutputData(output, "Seed ", seed);
+					OutputData(output, "c ", counter);
+					OutputData(output, "H ", h, p.ByteCount());
+					AttachedTransformation()->Put((byte *)output.data(), output.size());
+					output.resize(0);
+				}
+			}
+			else if (m_test == "SigGen")
+			{
+				std::string &encodedKey = m_data["PrivKey"];
+				int modLen = atol(m_bracketString.substr(6).c_str());
+				DSA::PrivateKey priv;
+
+				if (!encodedKey.empty())
+				{
+					StringStore s(encodedKey);
+					priv.BERDecode(s);
+					if (priv.GetGroupParameters().GetModulus().BitCount() != modLen)
+						encodedKey.clear();
+				}
+
+				if (encodedKey.empty())
+				{
+					priv.Initialize(m_rng, modLen);
+					StringSink s(encodedKey);
+					priv.DEREncode(s);
+					OutputData(output, "P ", priv.GetGroupParameters().GetModulus());
+					OutputData(output, "Q ", priv.GetGroupParameters().GetSubgroupOrder());
+					OutputData(output, "G ", priv.GetGroupParameters().GetSubgroupGenerator());
+				}
+
+				DSA::Signer signer(priv);
+				DSA::Verifier pub(signer);
+				OutputData(output, "Msg ", m_data["Msg"]);
+				OutputData(output, "Y ", pub.GetKey().GetPublicElement());
+
+				SecByteBlock sig(signer.SignatureLength());
+				StringSource(m_data["Msg"], true, new HexDecoder(new SignerFilter(m_rng, signer, new ArraySink(sig, sig.size()))));
+				SecByteBlock R(sig, sig.size()/2), S(sig+sig.size()/2, sig.size()/2);
+				OutputData(output, "R ", R);
+				OutputData(output, "S ", S);
+				AttachedTransformation()->Put((byte *)output.data(), output.size());
+				output.resize(0);
+			}
+			else if (m_test == "SigVer")
+			{
+				Integer p((m_data["P"] + "h").c_str());
+				Integer	q((m_data["Q"] + "h").c_str());
+				Integer g((m_data["G"] + "h").c_str());
+				Integer y((m_data["Y"] + "h").c_str());
+				DSA::Verifier verifier(p, q, g, y);
+
+				HexDecoder filter(new SignatureVerificationFilter(verifier));
+				StringSource(m_data["R"], true, new Redirector(filter, Redirector::DATA_ONLY));
+				StringSource(m_data["S"], true, new Redirector(filter, Redirector::DATA_ONLY));
+				StringSource(m_data["Msg"], true, new Redirector(filter, Redirector::DATA_ONLY));
+				filter.MessageEnd();
+				byte b;
+				filter.Get(b);
+				OutputData(output, "Result ", b ? "P" : "F");
+				AttachedTransformation()->Put((byte *)output.data(), output.size());
+				output.resize(0);
+			}
+			else if (m_test == "PQGVer")
+			{
+				Integer p((m_data["P"] + "h").c_str());
+				Integer	q((m_data["Q"] + "h").c_str());
+				Integer g((m_data["G"] + "h").c_str());
+				Integer h((m_data["H"] + "h").c_str());
+				int c = atol(m_data["c"].c_str());
+				SecByteBlock seed(m_data["Seed"].size()/2);
+				StringSource(m_data["Seed"], true, new HexDecoder(new ArraySink(seed, seed.size())));
+
+				Integer p1, q1;
+				bool result = DSA::GeneratePrimes(seed, seed.size()*8, c, p1, 1024, q1, true);
+				result = result && (p1 == p && q1 == q);
+				result = result && g == a_exp_b_mod_c(h, (p-1)/q, p);
+
+				OutputData(output, "Result ", result ? "P" : "F");
+				AttachedTransformation()->Put((byte *)output.data(), output.size());
+				output.resize(0);
+			}
+
+			return;
+		}
+
+		if (m_algorithm == "ECDSA")
+		{
+			std::map<std::string, OID> name2oid;
+			name2oid["P-192"] = ASN1::secp192r1();
+			name2oid["P-224"] = ASN1::secp224r1();
+			name2oid["P-256"] = ASN1::secp256r1();
+			name2oid["P-384"] = ASN1::secp384r1();
+			name2oid["P-521"] = ASN1::secp521r1();
+			name2oid["K-163"] = ASN1::sect163k1();
+			name2oid["K-233"] = ASN1::sect233k1();
+			name2oid["K-283"] = ASN1::sect283k1();
+			name2oid["K-409"] = ASN1::sect409k1();
+			name2oid["K-571"] = ASN1::sect571k1();
+			name2oid["B-163"] = ASN1::sect163r2();
+			name2oid["B-233"] = ASN1::sect233r1();
+			name2oid["B-283"] = ASN1::sect283r1();
+			name2oid["B-409"] = ASN1::sect409r1();
+			name2oid["B-571"] = ASN1::sect571r1();
+
+			if (m_test == "PKV")
+			{
+				bool pass;
+				if (m_bracketString[0] == 'P')
+					pass = EC_PKV<ECP>(m_rng, DecodeHex(m_data["Qx"]), DecodeHex(m_data["Qy"]), name2oid[m_bracketString]);
+				else
+					pass = EC_PKV<EC2N>(m_rng, DecodeHex(m_data["Qx"]), DecodeHex(m_data["Qy"]), name2oid[m_bracketString]);
+
+				OutputData(output, "Result ", pass ? "P" : "F");
+			}
+			else if (m_test == "KeyPair")
+			{
+				if (m_bracketString[0] == 'P')
+					EC_KeyPair<ECP>(output, atol(m_data["N"].c_str()), name2oid[m_bracketString]);
+				else
+					EC_KeyPair<EC2N>(output, atol(m_data["N"].c_str()), name2oid[m_bracketString]);
+			}
+			else if (m_test == "SigGen")
+			{
+				if (m_bracketString[0] == 'P')
+					EC_SigGen<ECP>(output, name2oid[m_bracketString]);
+				else
+					EC_SigGen<EC2N>(output, name2oid[m_bracketString]);
+			}
+			else if (m_test == "SigVer")
+			{
+				if (m_bracketString[0] == 'P')
+					EC_SigVer<ECP>(output, name2oid[m_bracketString]);
+				else
+					EC_SigVer<EC2N>(output, name2oid[m_bracketString]);
+			}
+
+			AttachedTransformation()->Put((byte *)output.data(), output.size());
+			output.resize(0);
+			return;
+		}
+
+		if (m_algorithm == "RSA")
+		{
+			std::string shaAlg = m_data["SHAAlg"].substr(3);
+
+			if (m_test == "Ver")
+			{
+				Integer n((m_data["n"] + "h").c_str());
+				Integer e((m_data["e"] + "h").c_str());
+				RSA::PublicKey pub;
+				pub.Initialize(n, e);
+
+				member_ptr<PK_Verifier> pV(CreateRSA<PK_Verifier>(m_mode, shaAlg));
+				pV->AccessMaterial().AssignFrom(pub);
+
+				HexDecoder filter(new SignatureVerificationFilter(*pV));
+				for (unsigned int i=m_data["S"].size(); i<pV->SignatureLength()*2; i++)
+					filter.Put('0');
+				StringSource(m_data["S"], true, new Redirector(filter, Redirector::DATA_ONLY));
+				StringSource(m_data["Msg"], true, new Redirector(filter, Redirector::DATA_ONLY));
+				filter.MessageEnd();
+				byte b;
+				filter.Get(b);
+				OutputData(output, "Result ", b ? "P" : "F");
+			}
+			else
+			{
+				CRYPTOPP_ASSERT(m_test == "Gen");
+				int modLen = atol(m_bracketString.substr(6).c_str());
+				std::string &encodedKey = m_data["PrivKey"];
+				RSA::PrivateKey priv;
+
+				if (!encodedKey.empty())
+				{
+					StringStore s(encodedKey);
+					priv.BERDecode(s);
+					if (priv.GetModulus().BitCount() != modLen)
+						encodedKey.clear();
+				}
+
+				if (encodedKey.empty())
+				{
+					priv.Initialize(m_rng, modLen);
+					StringSink s(encodedKey);
+					priv.DEREncode(s);
+					OutputData(output, "n ", priv.GetModulus());
+					OutputData(output, "e ", priv.GetPublicExponent(), modLen/8);
+				}
+
+				member_ptr<PK_Signer> pS(CreateRSA<PK_Signer>(m_mode, shaAlg));
+				pS->AccessMaterial().AssignFrom(priv);
+
+				SecByteBlock sig(pS->SignatureLength());
+				StringSource(m_data["Msg"], true, new HexDecoder(new SignerFilter(m_rng, *pS, new ArraySink(sig, sig.size()))));
+				OutputData(output, "SHAAlg ", m_data["SHAAlg"]);
+				OutputData(output, "Msg ", m_data["Msg"]);
+				OutputData(output, "S ", sig);
+			}
+
+			AttachedTransformation()->Put((byte *)output.data(), output.size());
+			output.resize(0);
+			return;
+		}
+
+		if (m_algorithm == "SHA")
+		{
+			member_ptr<HashFunction> pHF;
+
+			if (m_mode == "1")
+				pHF.reset(new SHA1);
+			else if (m_mode == "224")
+				pHF.reset(new SHA224);
+			else if (m_mode == "256")
+				pHF.reset(new SHA256);
+			else if (m_mode == "384")
+				pHF.reset(new SHA384);
+			else if (m_mode == "512")
+				pHF.reset(new SHA512);
+
+			if (m_test == "MONTE")
+			{
+				SecByteBlock seed = m_data2[INPUT];
+				SecByteBlock MD[1003];
+				int i,j;
+
+				for (j=0; j<100; j++)
+				{
+					MD[0] = MD[1] = MD[2] = seed;
+					for (i=3; i<1003; i++)
+					{
+						SecByteBlock Mi = MD[i-3] + MD[i-2] + MD[i-1];
+						MD[i].resize(pHF->DigestSize());
+						pHF->CalculateDigest(MD[i], Mi, Mi.size());
+					}
+					seed = MD[1002];
+					OutputData(output, "COUNT ", j);
+					OutputData(output, "MD ", seed);
+					AttachedTransformation()->Put((byte *)output.data(), output.size());
+					output.resize(0);
+				}
+			}
+			else
+			{
+				SecByteBlock tag(pHF->DigestSize());
+				SecByteBlock &msg(m_data2[INPUT]);
+				int len = atol(m_data["Len"].c_str());
+				StringSource(msg.begin(), len/8, true, new HashFilter(*pHF, new ArraySink(tag, tag.size())));
+				OutputData(output, "MD ", tag);
+				AttachedTransformation()->Put((byte *)output.data(), output.size());
+				output.resize(0);
+			}
+			return;
+		}
+
+		SecByteBlock &key = m_data2[KEY_T];
+
+		if (m_algorithm == "TDES")
+		{
+			if (!m_data["KEY1"].empty())
+			{
+				const std::string keys[3] = {m_data["KEY1"], m_data["KEY2"], m_data["KEY3"]};
+				key.resize(24);
+				HexDecoder hexDec(new ArraySink(key, key.size()));
+				for (int i=0; i<3; i++)
+					hexDec.Put((byte *)keys[i].data(), keys[i].size());
+
+				if (keys[0] == keys[2])
+				{
+					if (keys[0] == keys[1])
+						key.resize(8);
+					else
+						key.resize(16);
+				}
+				else
+					key.resize(24);
+			}
+		}
+
+		if (m_algorithm == "RNG")
+		{
+			key.resize(24);
+			StringSource(m_data["Key1"] + m_data["Key2"] + m_data["Key3"], true, new HexDecoder(new ArraySink(key, key.size())));
+
+			SecByteBlock seed(m_data2[INPUT]), dt(m_data2[IV]), r(8);
+			X917RNG rng(new DES_EDE3::Encryption(key, key.size()), seed, dt);
+
+			if (m_test == "MCT")
+			{
+				for (int i=0; i<10000; i++)
+					rng.GenerateBlock(r, r.size());
+			}
+			else
+			{
+				rng.GenerateBlock(r, r.size());
+			}
+
+			OutputData(output, "R ", r);
+			AttachedTransformation()->Put((byte *)output.data(), output.size());
+			output.resize(0);
+			return;
+		}
+
+		if (m_algorithm == "HMAC")
+		{
+			member_ptr<MessageAuthenticationCode> pMAC;
+
+			if (m_bracketString == "L=20")
+				pMAC.reset(new HMAC<SHA1>);
+			else if (m_bracketString == "L=28")
+				pMAC.reset(new HMAC<SHA224>);
+			else if (m_bracketString == "L=32")
+				pMAC.reset(new HMAC<SHA256>);
+			else if (m_bracketString == "L=48")
+				pMAC.reset(new HMAC<SHA384>);
+			else if (m_bracketString == "L=64")
+				pMAC.reset(new HMAC<SHA512>);
+			else
+				throw Exception(Exception::OTHER_ERROR, "TestDataParser: unexpected HMAC bracket string: " + m_bracketString);
+
+			pMAC->SetKey(key, key.size());
+			int Tlen = atol(m_data["Tlen"].c_str());
+			SecByteBlock tag(Tlen);
+			StringSource(m_data["Msg"], true, new HexDecoder(new HashFilter(*pMAC, new ArraySink(tag, Tlen), false, Tlen)));
+			OutputData(output, "Mac ", tag);
+			AttachedTransformation()->Put((byte *)output.data(), output.size());
+			output.resize(0);
+			return;
+		}
+
+		member_ptr<BlockCipher> pBT;
+		if (m_algorithm == "DES")
+			pBT.reset(NewBT((DES*)0));
+		else if (m_algorithm == "TDES")
+		{
+			if (key.size() == 8)
+				pBT.reset(NewBT((DES*)0));
+			else if (key.size() == 16)
+				pBT.reset(NewBT((DES_EDE2*)0));
+			else
+				pBT.reset(NewBT((DES_EDE3*)0));
+		}
+		else if (m_algorithm == "SKIPJACK")
+			pBT.reset(NewBT((SKIPJACK*)0));
+		else if (m_algorithm == "AES")
+			pBT.reset(NewBT((AES*)0));
+		else
+			throw Exception(Exception::OTHER_ERROR, "TestDataParser: unexpected algorithm: " + m_algorithm);
+
+		if (!pBT->IsValidKeyLength(key.size()))
+			key.CleanNew(pBT->DefaultKeyLength());	// for Scbcvrct
+		pBT->SetKey(key.data(), key.size());
+
+		SecByteBlock &iv = m_data2[IV];
+		if (iv.empty())
+			iv.CleanNew(pBT->BlockSize());
+
+		member_ptr<SymmetricCipher> pCipher;
+		unsigned int K = m_feedbackSize;
+
+		if (m_mode == "ECB")
+			pCipher.reset(NewMode((ECB_Mode_ExternalCipher*)0, *pBT, iv));
+		else if (m_mode == "CBC")
+			pCipher.reset(NewMode((CBC_Mode_ExternalCipher*)0, *pBT, iv));
+		else if (m_mode == "CFB")
+			pCipher.reset(NewMode((CFB_Mode_ExternalCipher*)0, *pBT, iv));
+		else if (m_mode == "OFB")
+			pCipher.reset(NewMode((OFB_Mode_ExternalCipher*)0, *pBT, iv));
+		else
+			throw Exception(Exception::OTHER_ERROR, "TestDataParser: unexpected mode: " + m_mode);
+
+		bool encrypt = m_encrypt;
+
+		if (m_test == "MONTE")
+		{
+			SecByteBlock KEY[401];
+			KEY[0] = key;
+			int keySize = key.size();
+			int blockSize = pBT->BlockSize();
+
+			std::vector<SecByteBlock> IB(10001), OB(10001), PT(10001), CT(10001), RESULT(10001), TXT(10001), CV(10001);
+			PT[0] = GetData("PLAINTEXT");
+			CT[0] = GetData("CIPHERTEXT");
+			CV[0] = IB[0] = iv;
+			TXT[0] = GetData("TEXT");
+
+			int outerCount = (m_algorithm == "AES") ? 100 : 400;
+			int innerCount = (m_algorithm == "AES") ? 1000 : 10000;
+
+			for (int i=0; i<outerCount; i++)
+			{
+				pBT->SetKey(KEY[i], keySize);
+
+				for (int j=0; j<innerCount; j++)
+				{
+					if (m_mode == "ECB")
+					{
+						if (encrypt)
+						{
+							IB[j] = PT[j];
+							CT[j].resize(blockSize);
+							pBT->ProcessBlock(IB[j], CT[j]);
+							PT[j+1] = CT[j];
+						}
+						else
+						{
+							IB[j] = CT[j];
+							PT[j].resize(blockSize);
+							pBT->ProcessBlock(IB[j], PT[j]);
+							CT[j+1] = PT[j];
+						}
+					}
+					else if (m_mode == "OFB")
+					{
+						OB[j].resize(blockSize);
+						pBT->ProcessBlock(IB[j], OB[j]);
+						Xor(RESULT[j], OB[j], TXT[j]);
+						TXT[j+1] = IB[j];
+						IB[j+1] = OB[j];
+					}
+					else if (m_mode == "CBC")
+					{
+						if (encrypt)
+						{
+							Xor(IB[j], PT[j], CV[j]);
+							CT[j].resize(blockSize);
+							pBT->ProcessBlock(IB[j], CT[j]);
+							PT[j+1] = CV[j];
+							CV[j+1] = CT[j];
+						}
+						else
+						{
+							IB[j] = CT[j];
+							OB[j].resize(blockSize);
+							pBT->ProcessBlock(IB[j], OB[j]);
+							Xor(PT[j], OB[j], CV[j]);
+							CV[j+1] = CT[j];
+							CT[j+1] = PT[j];
+						}
+					}
+					else if (m_mode == "CFB")
+					{
+						if (encrypt)
+						{
+							OB[j].resize(blockSize);
+							pBT->ProcessBlock(IB[j], OB[j]);
+							AssignLeftMostBits(CT[j], OB[j], K);
+							Xor(CT[j], CT[j], PT[j]);
+							AssignLeftMostBits(PT[j+1], IB[j], K);
+							IB[j+1].resize(blockSize);
+							std::memcpy(IB[j+1], IB[j]+K/8, blockSize-K/8);
+							std::memcpy(IB[j+1]+blockSize-K/8, CT[j], K/8);
+						}
+						else
+						{
+							OB[j].resize(blockSize);
+							pBT->ProcessBlock(IB[j], OB[j]);
+							AssignLeftMostBits(PT[j], OB[j], K);
+							Xor(PT[j], PT[j], CT[j]);
+							IB[j+1].resize(blockSize);
+							std::memcpy(IB[j+1], IB[j]+K/8, blockSize-K/8);
+							std::memcpy(IB[j+1]+blockSize-K/8, CT[j], K/8);
+							AssignLeftMostBits(CT[j+1], OB[j], K);
+						}
+					}
+					else
+						throw Exception(Exception::OTHER_ERROR, "TestDataParser: unexpected mode: " + m_mode);
+				}
+
+				OutputData(output, COUNT, IntToString(i));
+				OutputData(output, KEY_T, KEY[i]);
+				if (m_mode == "CBC")
+					OutputData(output, IV, CV[0]);
+				if (m_mode == "OFB" || m_mode == "CFB")
+					OutputData(output, IV, IB[0]);
+				if (m_mode == "ECB" || m_mode == "CBC" || m_mode == "CFB")
+				{
+					if (encrypt)
+					{
+						OutputData(output, INPUT, PT[0]);
+						OutputData(output, OUTPUT, CT[innerCount-1]);
+						KEY[i+1] = UpdateKey(KEY[i], &CT[0]);
+					}
+					else
+					{
+						OutputData(output, INPUT, CT[0]);
+						OutputData(output, OUTPUT, PT[innerCount-1]);
+						KEY[i+1] = UpdateKey(KEY[i], &PT[0]);
+					}
+					PT[0] = PT[innerCount];
+					IB[0] = IB[innerCount];
+					CV[0] = CV[innerCount];
+					CT[0] = CT[innerCount];
+				}
+				else if (m_mode == "OFB")
+				{
+					OutputData(output, INPUT, TXT[0]);
+					OutputData(output, OUTPUT, RESULT[innerCount-1]);
+					KEY[i+1] = UpdateKey(KEY[i], &RESULT[0]);
+					Xor(TXT[0], TXT[0], IB[innerCount-1]);
+					IB[0] = OB[innerCount-1];
+				}
+				output += "\n";
+				AttachedTransformation()->Put((byte *)output.data(), output.size());
+				output.resize(0);
+			}
+		}
+		else if (m_test == "MCT")
+		{
+			SecByteBlock KEY[101];
+			KEY[0] = key;
+			int keySize = key.size();
+			int blockSize = pBT->BlockSize();
+
+			SecByteBlock ivs[101], inputs[1001], outputs[1001];
+			ivs[0] = iv;
+			inputs[0] = m_data2[INPUT];
+
+			for (int i=0; i<100; i++)
+			{
+				pCipher->SetKey(KEY[i], keySize, MakeParameters(Name::IV(), (const byte *)ivs[i])(Name::FeedbackSize(), (int)K/8, false));
+
+				for (int j=0; j<1000; j++)
+				{
+					outputs[j] = inputs[j];
+					pCipher->ProcessString(outputs[j], outputs[j].size());
+					if (K==8 && m_mode == "CFB")
+					{
+						if (j<16)
+							inputs[j+1].Assign(ivs[i]+j, 1);
+						else
+							inputs[j+1] = outputs[j-16];
+					}
+					else if (m_mode == "ECB")
+						inputs[j+1] = outputs[j];
+					else if (j == 0)
+						inputs[j+1] = ivs[i];
+					else
+						inputs[j+1] = outputs[j-1];
+				}
+
+				if (m_algorithm == "AES")
+					OutputData(output, COUNT, m_count++);
+				OutputData(output, KEY_T, KEY[i]);
+				if (m_mode != "ECB")
+					OutputData(output, IV, ivs[i]);
+				OutputData(output, INPUT, inputs[0]);
+				OutputData(output, OUTPUT, outputs[999]);
+				output += "\n";
+				AttachedTransformation()->Put((byte *)output.data(), output.size());
+				output.resize(0);
+
+				KEY[i+1] = UpdateKey(KEY[i], outputs);
+				ivs[i+1].CleanNew(pCipher->IVSize());
+				ivs[i+1] = UpdateKey(ivs[i+1], outputs);
+				if (K==8 && m_mode == "CFB")
+					inputs[0] = outputs[999-16];
+				else if (m_mode == "ECB")
+					inputs[0] = outputs[999];
+				else
+					inputs[0] = outputs[998];
+			}
+		}
+		else
+		{
+			CRYPTOPP_ASSERT(m_test == "KAT");
+
+			SecByteBlock &input = m_data2[INPUT];
+			SecByteBlock result(input.size());
+			member_ptr<Filter> pFilter(new StreamTransformationFilter(*pCipher, new ArraySink(result, result.size()), StreamTransformationFilter::NO_PADDING));
+			StringSource(input.data(), input.size(), true, pFilter.release());
+
+			OutputGivenData(output, COUNT, true);
+			OutputData(output, KEY_T, key);
+			OutputGivenData(output, IV, true);
+			OutputGivenData(output, INPUT);
+			OutputData(output, OUTPUT, result);
+			output += "\n";
+			AttachedTransformation()->Put((byte *)output.data(), output.size());
+		}
+	}
+
+	std::vector<std::string> Tokenize(const std::string &line)
+	{
+		std::vector<std::string> result;
+		std::string s;
+		for (unsigned int i=0; i<line.size(); i++)
+		{
+			if (isalnum(line[i]) || line[i] == '^')
+				s += line[i];
+			else if (!s.empty())
+			{
+				result.push_back(s);
+				s = "";
+			}
+			if (line[i] == '=')
+				result.push_back("=");
+		}
+		if (!s.empty())
+			result.push_back(s);
+		return result;
+	}
+
+	bool IsolatedMessageEnd(bool blocking)
+	{
+		if (!blocking)
+			throw BlockingInputOnly("TestDataParser");
+
+		m_line.resize(0);
+		m_inQueue.TransferTo(StringSink(m_line).Ref());
+
+		if (m_line[0] == '#')
+			return false;
+
+		bool copyLine = false;
+
+		if (m_line[0] == '[')
+		{
+			m_bracketString = m_line.substr(1, m_line.size()-2);
+			if (m_bracketString == "ENCRYPT")
+				SetEncrypt(true);
+			if (m_bracketString == "DECRYPT")
+				SetEncrypt(false);
+			copyLine = true;
+		}
+
+		if (m_line.substr(0, 2) == "H>")
+		{
+			CRYPTOPP_ASSERT(m_test == "sha");
+			m_bracketString = m_line.substr(2, m_line.size()-4);
+			m_line = m_line.substr(0, 13) + "Hashes<H";
+			copyLine = true;
+		}
+
+		if (m_line == "D>")
+			copyLine = true;
+
+		if (m_line == "<D")
+		{
+			m_line += "\n";
+			copyLine = true;
+		}
+
+		if (copyLine)
+		{
+			m_line += '\n';
+			AttachedTransformation()->Put((byte *)m_line.data(), m_line.size(), blocking);
+			return false;
+		}
+
+		std::vector<std::string> tokens = Tokenize(m_line);
+
+		if (m_algorithm == "DSA" && m_test == "sha")
+		{
+			for (unsigned int i = 0; i < tokens.size(); i++)
+			{
+				if (tokens[i] == "^")
+					DoTest();
+				else if (tokens[i] != "")
+					m_compactString.push_back(atol(tokens[i].c_str()));
+			}
+		}
+		else
+		{
+			if (!m_line.empty() && ((m_algorithm == "RSA" && m_test != "Gen") || m_algorithm == "RNG" || m_algorithm == "HMAC" || m_algorithm == "SHA" || (m_algorithm == "ECDSA" && m_test != "KeyPair") || (m_algorithm == "DSA" && (m_test == "PQGVer" || m_test == "SigVer"))))
+			{
+				// copy input to output
+				std::string output = m_line + '\n';
+				AttachedTransformation()->Put((byte *)output.data(), output.size());
+			}
+
+			for (unsigned int i = 0; i < tokens.size(); i++)
+			{
+				if (m_firstLine && m_algorithm != "DSA")
+				{
+					if (tokens[i] == "Encrypt" || tokens[i] == "OFB")
+						SetEncrypt(true);
+					else if (tokens[i] == "Decrypt")
+						SetEncrypt(false);
+					else if (tokens[i] == "Modes")
+						m_test = "MONTE";
+				}
+				else
+				{
+					if (tokens[i] != "=")
+						continue;
+
+					if (i == 0)
+						throw Exception(Exception::OTHER_ERROR, "TestDataParser: unexpected data: " + m_line);
+
+					const std::string &key = tokens[i-1];
+					std::string &data = m_data[key];
+					data = (tokens.size() > i+1) ? tokens[i+1] : "";
+					DataType t = m_nameToType[key];
+					m_typeToName[t] = key;
+					m_data2[t] = DecodeHex(data);
+
+					if (key == m_trigger || (t == OUTPUT && !m_data2[INPUT].empty() && !isspace(m_line[0])))
+						DoTest();
+				}
+			}
+		}
+
+		m_firstLine = false;
+
+		return false;
+	}
+
+	inline const SecByteBlock & GetData(const std::string &key)
+	{
+		return m_data2[m_nameToType[key]];
+	}
+
+	static SecByteBlock DecodeHex(const std::string &data)
+	{
+		SecByteBlock data2(data.size() / 2);
+		StringSource(data, true, new HexDecoder(new ArraySink(data2, data2.size())));
+		return data2;
+	}
+
+	std::string m_algorithm, m_test, m_mode, m_line, m_bracketString, m_trigger;
+	unsigned int m_feedbackSize, m_blankLineTransition;
+	bool m_encrypt, m_firstLine;
+
+	typedef std::map<std::string, DataType> NameToTypeMap;
+	NameToTypeMap m_nameToType;
+	typedef std::map<DataType, std::string> TypeToNameMap;
+	TypeToNameMap m_typeToName;
+
+	typedef std::map<std::string, std::string> Map;
+	Map m_data;		// raw data
+	typedef std::map<DataType, SecByteBlock> Map2;
+	Map2 m_data2;
+	int m_count;
+
+	AutoSeededX917RNG<AES> m_rng;
+	std::vector<unsigned int> m_compactString;
+};
+
+int FIPS_140_AlgorithmTest(int argc, char **argv)
+{
+	argc--;
+	argv++;
+
+	std::string algorithm = argv[1];
+	std::string pathname = argv[2];
+	unsigned int i = pathname.find_last_of("\\/");
+	std::string filename = pathname.substr(i == std::string::npos ? 0 : i+1);
+	std::string dirname = pathname.substr(0, i);
+
+	if (algorithm == "auto")
+	{
+		string algTable[] = {"AES", "ECDSA", "DSA", "HMAC", "RNG", "RSA", "TDES", "SKIPJACK", "SHA"};	// order is important here
+		for (i=0; i<sizeof(algTable)/sizeof(algTable[0]); i++)
+		{
+			if (dirname.find(algTable[i]) != std::string::npos)
+			{
+				algorithm = algTable[i];
+				break;
+			}
+		}
+	}
+
+	try
+	{
+		std::string mode;
+		if (algorithm == "SHA")
+			mode = IntToString(atol(filename.substr(3, 3).c_str()));
+		else if (algorithm == "RSA")
+			mode = filename.substr(6, 1);
+		else if (filename[0] == 'S' || filename[0] == 'T')
+			mode = filename.substr(1, 3);
+		else
+			mode = filename.substr(0, 3);
+		for (i = 0; i<mode.size(); i++)
+			mode[i] = toupper(mode[i]);
+		unsigned int feedbackSize = mode == "CFB" ? atoi(filename.substr(filename.find_first_of("0123456789")).c_str()) : 0;
+		std::string test;
+		if (algorithm == "DSA" || algorithm == "ECDSA")
+			test = filename.substr(0, filename.size() - 4);
+		else if (algorithm == "RSA")
+			test = filename.substr(3, 3);
+		else if (filename.find("Monte") != std::string::npos)
+			test = "MONTE";
+		else if (filename.find("MCT") != std::string::npos)
+			test = "MCT";
+		else
+			test = "KAT";
+		bool encrypt = (filename.find("vrct") == std::string::npos);
+
+		BufferedTransformation *pSink = NULLPTR;
+
+		if (argc > 3)
+		{
+			std::string outDir = argv[3];
+
+			if (outDir == "auto")
+			{
+				if (dirname.substr(dirname.size()-3) == "req")
+					outDir = dirname.substr(0, dirname.size()-3) + "resp";
+			}
+
+			if (*outDir.rbegin() != '\\' && *outDir.rbegin() != '/')
+				outDir += '/';
+			std::string outPathname = outDir + filename.substr(0, filename.size() - 3) + "rsp";
+			pSink = new FileSink(outPathname.c_str(), false);
+		}
+		else
+			pSink = new FileSink(cout);
+
+		FileSource(pathname.c_str(), true, new LineBreakParser(new TestDataParser(algorithm, test, mode, feedbackSize, encrypt, pSink)), false);
+	}
+	catch (...)
+	{
+		cout << "file: " << filename << endl;
+		throw;
+	}
+	return 0;
+}
+
+extern int (*AdhocTest)(int argc, char *argv[]);
+static int s_i = (AdhocTest = &FIPS_140_AlgorithmTest, 0);
+#endif
diff --git a/runtime/third_party/cryptopp/fipstest.cpp b/runtime/third_party/cryptopp/fipstest.cpp
new file mode 100644
index 0000000..145f425
--- /dev/null
+++ b/runtime/third_party/cryptopp/fipstest.cpp
@@ -0,0 +1,652 @@
+// fipstest.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#define CRYPTOPP_DEFAULT_NO_DLL
+#include "dll.h"
+#include "cryptlib.h"
+#include "filters.h"
+#include "smartptr.h"
+#include "pkcspad.h"
+#include "misc.h"
+
+// Simply disable CRYPTOPP_WIN32_AVAILABLE for Windows Phone and Windows Store apps
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+# if defined(WINAPI_FAMILY)
+#   if !(WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP))
+#	  undef CRYPTOPP_WIN32_AVAILABLE
+#   endif
+# endif
+#endif
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+#ifndef _WIN32_WINNT
+#define _WIN32_WINNT 0x0400
+#endif
+
+#include <windows.h>
+
+#if defined(CRYPTOPP_MSC_VERSION) && CRYPTOPP_MSC_VERSION >= 1400
+# ifdef _M_IX86
+#  define _CRT_DEBUGGER_HOOK _crt_debugger_hook
+# else
+#  define _CRT_DEBUGGER_HOOK __crt_debugger_hook
+# endif
+# if CRYPTOPP_MSC_VERSION < 1900
+extern "C" {_CRTIMP void __cdecl _CRT_DEBUGGER_HOOK(int);}
+# else
+extern "C" {void __cdecl _CRT_DEBUGGER_HOOK(int); }
+# endif
+#endif
+#endif  // CRYPTOPP_WIN32_AVAILABLE
+
+#include <sstream>
+#include <iostream>
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4702)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+extern PowerUpSelfTestStatus g_powerUpSelfTestStatus;
+SecByteBlock g_actualMac;
+unsigned long g_macFileLocation = 0;
+
+// $ grep -iIR baseaddress *.*proj
+// cryptdll.vcxproj:      <BaseAddress>0x42900000</BaseAddress>
+// cryptdll.vcxproj:      <BaseAddress>0x42900000</BaseAddress>
+// cryptdll.vcxproj:      <BaseAddress>0x42900000</BaseAddress>
+// cryptdll.vcxproj:      <BaseAddress>0x42900000</BaseAddress>
+const void* g_BaseAddressOfMAC = reinterpret_cast<void*>(0x42900000);
+
+// use a random dummy string here, to be searched/replaced later with the real MAC
+static const byte s_moduleMac[CryptoPP::HMAC<CryptoPP::SHA1>::DIGESTSIZE] = CRYPTOPP_DUMMY_DLL_MAC;
+CRYPTOPP_COMPILE_ASSERT(sizeof(s_moduleMac) == CryptoPP::SHA1::DIGESTSIZE);
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+static HMODULE s_hModule = NULLPTR;
+#endif
+
+const byte * CRYPTOPP_API GetActualMacAndLocation(unsigned int &macSize, unsigned int &fileLocation)
+{
+	macSize = (unsigned int)g_actualMac.size();
+	fileLocation = g_macFileLocation;
+	return g_actualMac;
+}
+
+void KnownAnswerTest(RandomNumberGenerator &rng, const char *output)
+{
+	EqualityComparisonFilter comparison;
+
+	RandomNumberStore(rng, strlen(output)/2).TransferAllTo(comparison, "0");
+	StringSource(output, true, new HexDecoder(new ChannelSwitch(comparison, "1")));
+
+	comparison.ChannelMessageSeriesEnd("0");
+	comparison.ChannelMessageSeriesEnd("1");
+}
+
+template <class CIPHER>
+void X917RNG_KnownAnswerTest(
+	const char *key,
+	const char *seed,
+	const char *deterministicTimeVector,
+	const char *output)
+{
+#ifdef OS_RNG_AVAILABLE
+	std::string decodedKey, decodedSeed, decodedDeterministicTimeVector;
+	StringSource(key, true, new HexDecoder(new StringSink(decodedKey)));
+	StringSource(seed, true, new HexDecoder(new StringSink(decodedSeed)));
+	StringSource(deterministicTimeVector, true, new HexDecoder(new StringSink(decodedDeterministicTimeVector)));
+
+	AutoSeededX917RNG<CIPHER> rng(false, false);
+	rng.Reseed((const byte *)decodedKey.data(), decodedKey.size(), (const byte *)decodedSeed.data(), (const byte *)decodedDeterministicTimeVector.data());
+	KnownAnswerTest(rng, output);
+#else
+	throw 0;
+#endif
+}
+
+void KnownAnswerTest(StreamTransformation &encryption, StreamTransformation &decryption, const char *plaintext, const char *ciphertext)
+{
+	EqualityComparisonFilter comparison;
+
+	StringSource(plaintext, true, new HexDecoder(new StreamTransformationFilter(encryption, new ChannelSwitch(comparison, "0"), StreamTransformationFilter::NO_PADDING)));
+	StringSource(ciphertext, true, new HexDecoder(new ChannelSwitch(comparison, "1")));
+
+	StringSource(ciphertext, true, new HexDecoder(new StreamTransformationFilter(decryption, new ChannelSwitch(comparison, "0"), StreamTransformationFilter::NO_PADDING)));
+	StringSource(plaintext, true, new HexDecoder(new ChannelSwitch(comparison, "1")));
+
+	comparison.ChannelMessageSeriesEnd("0");
+	comparison.ChannelMessageSeriesEnd("1");
+}
+
+template <class CIPHER>
+void SymmetricEncryptionKnownAnswerTest(
+	const char *key,
+	const char *hexIV,
+	const char *plaintext,
+	const char *ecb,
+	const char *cbc,
+	const char *cfb,
+	const char *ofb,
+	const char *ctr)
+{
+	std::string decodedKey;
+	StringSource(key, true, new HexDecoder(new StringSink(decodedKey)));
+
+	typename CIPHER::Encryption encryption((const byte *)decodedKey.data(), decodedKey.size());
+	typename CIPHER::Decryption decryption((const byte *)decodedKey.data(), decodedKey.size());
+
+	SecByteBlock iv(encryption.BlockSize());
+	StringSource(hexIV, true, new HexDecoder(new ArraySink(iv, iv.size())));
+
+	if (ecb)
+		KnownAnswerTest(ECB_Mode_ExternalCipher::Encryption(encryption).Ref(), ECB_Mode_ExternalCipher::Decryption(decryption).Ref(), plaintext, ecb);
+	if (cbc)
+		KnownAnswerTest(CBC_Mode_ExternalCipher::Encryption(encryption, iv).Ref(), CBC_Mode_ExternalCipher::Decryption(decryption, iv).Ref(), plaintext, cbc);
+	if (cfb)
+		KnownAnswerTest(CFB_Mode_ExternalCipher::Encryption(encryption, iv).Ref(), CFB_Mode_ExternalCipher::Decryption(encryption, iv).Ref(), plaintext, cfb);
+	if (ofb)
+		KnownAnswerTest(OFB_Mode_ExternalCipher::Encryption(encryption, iv).Ref(), OFB_Mode_ExternalCipher::Decryption(encryption, iv).Ref(), plaintext, ofb);
+	if (ctr)
+		KnownAnswerTest(CTR_Mode_ExternalCipher::Encryption(encryption, iv).Ref(), CTR_Mode_ExternalCipher::Decryption(encryption, iv).Ref(), plaintext, ctr);
+}
+
+void KnownAnswerTest(HashTransformation &hash, const char *message, const char *digest)
+{
+	EqualityComparisonFilter comparison;
+	StringSource(digest, true, new HexDecoder(new ChannelSwitch(comparison, "1")));
+	StringSource(message, true, new HashFilter(hash, new ChannelSwitch(comparison, "0")));
+
+	comparison.ChannelMessageSeriesEnd("0");
+	comparison.ChannelMessageSeriesEnd("1");
+}
+
+template <class HASH>
+void SecureHashKnownAnswerTest(const char *message, const char *digest)
+{
+	HASH hash;
+	KnownAnswerTest(hash, message, digest);
+}
+
+template <class MAC>
+void MAC_KnownAnswerTest(const char *key, const char *message, const char *digest)
+{
+	std::string decodedKey;
+	StringSource(key, true, new HexDecoder(new StringSink(decodedKey)));
+
+	MAC mac((const byte *)decodedKey.data(), decodedKey.size());
+	KnownAnswerTest(mac, message, digest);
+}
+
+template <class SCHEME>
+void SignatureKnownAnswerTest(const char *key, const char *message, const char *signature)
+{
+	typename SCHEME::Signer signer(StringSource(key, true, new HexDecoder).Ref());
+	typename SCHEME::Verifier verifier(signer);
+
+	RandomPool rng;
+	EqualityComparisonFilter comparison;
+
+	StringSource(message, true, new SignerFilter(rng, signer, new ChannelSwitch(comparison, "0")));
+	StringSource(signature, true, new HexDecoder(new ChannelSwitch(comparison, "1")));
+
+	comparison.ChannelMessageSeriesEnd("0");
+	comparison.ChannelMessageSeriesEnd("1");
+
+	SignatureVerificationFilter verifierFilter(verifier, NULLPTR, SignatureVerificationFilter::SIGNATURE_AT_BEGIN | SignatureVerificationFilter::THROW_EXCEPTION);
+	StringSource(signature, true, new HexDecoder(new Redirector(verifierFilter, Redirector::DATA_ONLY)));
+	StringSource(message, true, new Redirector(verifierFilter));
+}
+
+void EncryptionPairwiseConsistencyTest(const PK_Encryptor &encryptor, const PK_Decryptor &decryptor)
+{
+	try
+	{
+		RandomPool rng;
+		const char *testMessage ="test message";
+		std::string ciphertext, decrypted;
+
+		StringSource(
+			testMessage,
+			true,
+			new PK_EncryptorFilter(
+				rng,
+				encryptor,
+				new StringSink(ciphertext)));
+
+		if (ciphertext == testMessage)
+			throw 0;
+
+		StringSource(
+			ciphertext,
+			true,
+			new PK_DecryptorFilter(
+				rng,
+				decryptor,
+				new StringSink(decrypted)));
+
+		if (decrypted != testMessage)
+			throw 0;
+	}
+	catch (...)
+	{
+		throw SelfTestFailure(encryptor.AlgorithmName() + ": pairwise consistency test failed");
+	}
+}
+
+void SignaturePairwiseConsistencyTest(const PK_Signer &signer, const PK_Verifier &verifier)
+{
+	try
+	{
+		RandomPool rng;
+
+		StringSource(
+			"test message",
+			true,
+			new SignerFilter(
+				rng,
+				signer,
+				new SignatureVerificationFilter(verifier, NULLPTR, SignatureVerificationFilter::THROW_EXCEPTION),
+				true));
+	}
+	catch (...)
+	{
+		throw SelfTestFailure(signer.AlgorithmName() + ": pairwise consistency test failed");
+	}
+}
+
+template <class SCHEME>
+void SignaturePairwiseConsistencyTest(const char *key)
+{
+	typename SCHEME::Signer signer(StringSource(key, true, new HexDecoder).Ref());
+	typename SCHEME::Verifier verifier(signer);
+
+	SignaturePairwiseConsistencyTest(signer, verifier);
+}
+
+MessageAuthenticationCode * NewIntegrityCheckingMAC()
+{
+	byte key[] = {0x47, 0x1E, 0x33, 0x96, 0x65, 0xB1, 0x6A, 0xED, 0x0B, 0xF8, 0x6B, 0xFD, 0x01, 0x65, 0x05, 0xCC};
+	return new HMAC<SHA1>(key, sizeof(key));
+}
+
+bool IntegrityCheckModule(const char *moduleFilename, const byte *expectedModuleMac, SecByteBlock *pActualMac, unsigned long *pMacFileLocation)
+{
+	member_ptr<MessageAuthenticationCode> mac(NewIntegrityCheckingMAC());
+	unsigned int macSize = mac->DigestSize();
+
+	SecByteBlock tempMac;
+	SecByteBlock &actualMac = pActualMac ? *pActualMac : tempMac;
+	actualMac.resize(macSize);
+
+	unsigned long tempLocation = 0;
+	unsigned long &macFileLocation = pMacFileLocation ? *pMacFileLocation : tempLocation;
+	macFileLocation = 0;
+
+	MeterFilter verifier(new HashFilter(*mac, new ArraySink(actualMac, actualMac.size())));
+//	MeterFilter verifier(new FileSink("c:\\dt.tmp"));
+	std::ifstream moduleStream;
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+	HMODULE h = NULLPTR;
+	{
+	const size_t FIPS_MODULE_MAX_PATH = 2*MAX_PATH;
+	char moduleFilenameBuf[FIPS_MODULE_MAX_PATH] = "";
+	if (moduleFilename == NULLPTR)
+	{
+#if (CRYPTOPP_MSC_VERSION >= 1400 && !defined(_STLPORT_VERSION))	// ifstream doesn't support wide filename on other compilers
+		wchar_t wideModuleFilename[FIPS_MODULE_MAX_PATH];
+		if (GetModuleFileNameW(s_hModule, wideModuleFilename, FIPS_MODULE_MAX_PATH) > 0)
+		{
+			moduleStream.open(wideModuleFilename, std::ios::in | std::ios::binary);
+			h = GetModuleHandleW(wideModuleFilename);
+		}
+		else
+#endif
+		{
+			GetModuleFileNameA(s_hModule, moduleFilenameBuf, FIPS_MODULE_MAX_PATH);
+			moduleFilename = moduleFilenameBuf;
+		}
+	}
+#endif
+	if (moduleFilename != NULLPTR)
+	{
+			moduleStream.open(moduleFilename, std::ios::in | std::ios::binary);
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+			h = GetModuleHandleA(moduleFilename);
+			moduleFilename = NULLPTR;
+	}
+#endif
+	}
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+	if (h == g_BaseAddressOfMAC)
+	{
+		std::ostringstream oss;
+		oss << "Crypto++ DLL loaded at base address " << std::hex << h << ".\n";
+		OutputDebugStringA(oss.str().c_str());
+	}
+	else
+	{
+		std::ostringstream oss;
+		oss << "Crypto++ DLL integrity check may fail. Expected module base address is ";
+		oss << std::hex << g_BaseAddressOfMAC << ", but module loaded at " << h << ".\n";
+		OutputDebugStringA(oss.str().c_str());
+	}
+#endif
+
+	if (!moduleStream)
+	{
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+		OutputDebugStringA("Crypto++ DLL integrity check failed. Cannot open file for reading.");
+#endif
+		return false;
+	}
+	FileStore file(moduleStream);
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+	// try to hash from memory first
+	const byte *memBase = (const byte *)h;
+	const IMAGE_DOS_HEADER *ph = (IMAGE_DOS_HEADER *)memBase;
+	const IMAGE_NT_HEADERS *phnt = (IMAGE_NT_HEADERS *)(memBase + ph->e_lfanew);
+	const IMAGE_SECTION_HEADER *phs = IMAGE_FIRST_SECTION(phnt);
+	DWORD nSections = phnt->FileHeader.NumberOfSections;
+	size_t currentFilePos = 0;
+
+	size_t checksumPos = (byte *)&phnt->OptionalHeader.CheckSum - memBase;
+	size_t checksumSize = sizeof(phnt->OptionalHeader.CheckSum);
+	size_t certificateTableDirectoryPos = (byte *)&phnt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY] - memBase;
+	size_t certificateTableDirectorySize = sizeof(phnt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY]);
+	size_t certificateTablePos = phnt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress;
+	size_t certificateTableSize = phnt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size;
+
+	verifier.AddRangeToSkip(0, checksumPos, checksumSize);
+	verifier.AddRangeToSkip(0, certificateTableDirectoryPos, certificateTableDirectorySize);
+	verifier.AddRangeToSkip(0, certificateTablePos, certificateTableSize);
+
+	while (nSections--)
+	{
+		switch (phs->Characteristics)
+		{
+		default:
+			break;
+		case IMAGE_SCN_CNT_CODE | IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ:
+		case IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ:
+			unsigned int sectionSize = STDMIN(phs->SizeOfRawData, phs->Misc.VirtualSize);
+			const byte *sectionMemStart = memBase + phs->VirtualAddress;
+			unsigned int sectionFileStart = phs->PointerToRawData;
+			size_t subSectionStart = 0, nextSubSectionStart;
+
+			do
+			{
+				const byte *subSectionMemStart = sectionMemStart + subSectionStart;
+				size_t subSectionFileStart = sectionFileStart + subSectionStart;
+				size_t subSectionSize = sectionSize - subSectionStart;
+				nextSubSectionStart = 0;
+
+				unsigned int entriesToReadFromDisk[] = {IMAGE_DIRECTORY_ENTRY_IMPORT, IMAGE_DIRECTORY_ENTRY_IAT};
+				for (unsigned int i=0; i<sizeof(entriesToReadFromDisk)/sizeof(entriesToReadFromDisk[0]); i++)
+				{
+					const IMAGE_DATA_DIRECTORY &entry = phnt->OptionalHeader.DataDirectory[entriesToReadFromDisk[i]];
+					const byte *entryMemStart = memBase + entry.VirtualAddress;
+					if (subSectionMemStart <= entryMemStart && entryMemStart < subSectionMemStart + subSectionSize)
+					{
+						subSectionSize = entryMemStart - subSectionMemStart;
+						nextSubSectionStart = entryMemStart - sectionMemStart + entry.Size;
+					}
+				}
+
+				// Visual Studio 2019 is MSC_VER == 1920
+				// https://dev.to/yumetodo/list-of-mscver-and-mscfullver-8nds
+#if (CRYPTOPP_MSC_VERSION >= 1400 && CRYPTOPP_MSC_VERSION < 1920) && (defined(_M_IX86) || defined(_M_X64))
+				// first byte of _CRT_DEBUGGER_HOOK gets modified in memory by the debugger invisibly, so read it from file
+				if (IsDebuggerPresent())
+				{
+					if (subSectionMemStart <= (byte *)&_CRT_DEBUGGER_HOOK && (byte *)&_CRT_DEBUGGER_HOOK < subSectionMemStart + subSectionSize)
+					{
+						subSectionSize = (byte *)&_CRT_DEBUGGER_HOOK - subSectionMemStart;
+						nextSubSectionStart = (byte *)&_CRT_DEBUGGER_HOOK - sectionMemStart + 1;
+					}
+				}
+#endif
+
+				if (subSectionMemStart <= expectedModuleMac && expectedModuleMac < subSectionMemStart + subSectionSize)
+				{
+					// found stored MAC
+					macFileLocation = (unsigned long)(subSectionFileStart + (expectedModuleMac - subSectionMemStart));
+					verifier.AddRangeToSkip(0, macFileLocation, macSize);
+				}
+
+				file.TransferTo(verifier, subSectionFileStart - currentFilePos);
+				verifier.Put(subSectionMemStart, subSectionSize);
+				file.Skip(subSectionSize);
+				currentFilePos = subSectionFileStart + subSectionSize;
+				subSectionStart = nextSubSectionStart;
+			} while (nextSubSectionStart != 0);
+		}
+		phs++;
+	}
+#endif
+	file.TransferAllTo(verifier);
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+	// if that fails (could be caused by debug breakpoints or DLL base relocation modifying image in memory),
+	// hash from disk instead
+	if (!VerifyBufsEqual(expectedModuleMac, actualMac, macSize))
+	{
+		OutputDebugStringA("Crypto++ DLL in-memory integrity check failed. This may be caused by debug breakpoints or DLL relocation.\n");
+		moduleStream.clear();
+		moduleStream.seekg(0);
+		verifier.Initialize(MakeParameters(Name::OutputBuffer(), ByteArrayParameter(actualMac, (unsigned int)actualMac.size())));
+//		verifier.Initialize(MakeParameters(Name::OutputFileName(), (const char *)"c:\\dt2.tmp"));
+		verifier.AddRangeToSkip(0, checksumPos, checksumSize);
+		verifier.AddRangeToSkip(0, certificateTableDirectoryPos, certificateTableDirectorySize);
+		verifier.AddRangeToSkip(0, certificateTablePos, certificateTableSize);
+		verifier.AddRangeToSkip(0, macFileLocation, macSize);
+		FileStore(moduleStream).TransferAllTo(verifier);
+	}
+#endif
+
+	if (VerifyBufsEqual(expectedModuleMac, actualMac, macSize))
+		return true;
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+	std::string hexMac;
+	HexEncoder(new StringSink(hexMac)).PutMessageEnd(actualMac, actualMac.size());
+	OutputDebugStringA((("Crypto++ DLL integrity check failed. Actual MAC is: " + hexMac) + ".\n").c_str());
+#endif
+	return false;
+}
+
+void DoPowerUpSelfTest(const char *moduleFilename, const byte *expectedModuleMac)
+{
+	g_powerUpSelfTestStatus = POWER_UP_SELF_TEST_NOT_DONE;
+	SetPowerUpSelfTestInProgressOnThisThread(true);
+
+	try
+	{
+		if (FIPS_140_2_ComplianceEnabled() || expectedModuleMac != NULLPTR)
+		{
+			if (!IntegrityCheckModule(moduleFilename, expectedModuleMac, &g_actualMac, &g_macFileLocation))
+				throw 0;	// throw here so we break in the debugger, this will be caught right away
+		}
+
+		// algorithm tests
+
+		X917RNG_KnownAnswerTest<AES>(
+			"2b7e151628aed2a6abf7158809cf4f3c",										// key
+			"000102030405060708090a0b0c0d0e0f",										// seed
+			"00000000000000000000000000000001",										// time vector
+			"D176EDD27493B0395F4D10546232B0693DC7061C03C3A554F09CECF6F6B46D945A");	// output
+
+		SymmetricEncryptionKnownAnswerTest<DES_EDE3>(
+			"385D7189A5C3D485E1370AA5D408082B5CCCCB5E19F2D90E",
+			"C141B5FCCD28DC8A",
+			"6E1BD7C6120947A464A6AAB293A0F89A563D8D40D3461B68",
+			"64EAAD4ACBB9CEAD6C7615E7C7E4792FE587D91F20C7D2F4",
+			"6235A461AFD312973E3B4F7AA7D23E34E03371F8E8C376C9",
+			"E26BA806A59B0330DE40CA38E77A3E494BE2B212F6DD624B",
+			"E26BA806A59B03307DE2BCC25A08BA40A8BA335F5D604C62",
+			"E26BA806A59B03303C62C2EFF32D3ACDD5D5F35EBCC53371");
+
+		SymmetricEncryptionKnownAnswerTest<SKIPJACK>(
+			"1555E5531C3A169B2D65",
+			"6EC9795701F49864",
+			"00AFA48E9621E52E8CBDA312660184EDDB1F33D9DACDA8DA",
+			"DBEC73562EFCAEB56204EB8AE9557EBF77473FBB52D17CD1",
+			"0C7B0B74E21F99B8F2C8DF37879F6C044967F42A796DCA8B",
+			"79FDDA9724E36CC2E023E9A5C717A8A8A7FDA465CADCBF63",
+			"79FDDA9724E36CC26CACBD83C1ABC06EAF5B249BE5B1E040",
+			"79FDDA9724E36CC211B0AEC607B95A96BCDA318440B82F49");
+
+		SymmetricEncryptionKnownAnswerTest<AES>(
+			"2b7e151628aed2a6abf7158809cf4f3c",
+			"000102030405060708090a0b0c0d0e0f",
+			"6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e5130c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710",	// plaintext
+			"3ad77bb40d7a3660a89ecaf32466ef97f5d3d58503b9699de785895a96fdbaaf43b1cd7f598ece23881b00e3ed0306887b0c785e27e8ad3f8223207104725dd4", // ecb
+			"7649abac8119b246cee98e9b12e9197d5086cb9b507219ee95db113a917678b273bed6b8e3c1743b7116e69e222295163ff1caa1681fac09120eca307586e1a7",	// cbc
+			"3b3fd92eb72dad20333449f8e83cfb4ac8a64537a0b3a93fcde3cdad9f1ce58b26751f67a3cbb140b1808cf187a4f4dfc04b05357c5d1c0eeac4c66f9ff7f2e6", // cfb
+			"3b3fd92eb72dad20333449f8e83cfb4a7789508d16918f03f53c52dac54ed8259740051e9c5fecf64344f7a82260edcc304c6528f659c77866a510d9c1d6ae5e", // ofb
+			NULLPTR);
+
+		SymmetricEncryptionKnownAnswerTest<AES>(
+			"2b7e151628aed2a6abf7158809cf4f3c",
+			"f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
+			"6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e5130c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710",
+			NULLPTR,
+			NULLPTR,
+			NULLPTR,
+			NULLPTR,
+			"874d6191b620e3261bef6864990db6ce9806f66b7970fdff8617187bb9fffdff5ae4df3edbd5d35e5b4f09020db03eab1e031dda2fbe03d1792170a0f3009cee"); // ctr
+
+
+		SecureHashKnownAnswerTest<SHA1>(
+			"abc",
+			"A9993E364706816ABA3E25717850C26C9CD0D89D");
+
+		SecureHashKnownAnswerTest<SHA224>(
+			"abc",
+			"23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7");
+
+		SecureHashKnownAnswerTest<SHA256>(
+			"abc",
+			"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
+
+		SecureHashKnownAnswerTest<SHA384>(
+			"abc",
+			"cb00753f45a35e8bb5a03d699ac65007272c32ab0eded1631a8b605a43ff5bed8086072ba1e7cc2358baeca134c825a7");
+
+		SecureHashKnownAnswerTest<SHA512>(
+			"abc",
+			"ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f");
+
+		MAC_KnownAnswerTest<HMAC<SHA1> >(
+			"303132333435363738393a3b3c3d3e3f40414243",
+			"Sample #2",
+			"0922d3405faa3d194f82a45830737d5cc6c75d24");
+
+		const char *keyRSA1 =
+			"30820150020100300d06092a864886f70d01010105000482013a3082013602010002400a66791dc6988168de7ab77419bb7fb0"
+			"c001c62710270075142942e19a8d8c51d053b3e3782a1de5dc5af4ebe99468170114a1dfe67cdc9a9af55d655620bbab0203010001"
+			"02400123c5b61ba36edb1d3679904199a89ea80c09b9122e1400c09adcf7784676d01d23356a7d44d6bd8bd50e94bfc723fa"
+			"87d8862b75177691c11d757692df8881022033d48445c859e52340de704bcdda065fbb4058d740bd1d67d29e9c146c11cf61"
+			"0220335e8408866b0fd38dc7002d3f972c67389a65d5d8306566d5c4f2a5aa52628b0220045ec90071525325d3d46db79695e9af"
+			"acc4523964360e02b119baa366316241022015eb327360c7b60d12e5e2d16bdcd97981d17fba6b70db13b20b436e24eada590220"
+			"2ca6366d72781dfa24d34a9a24cbc2ae927a9958af426563ff63fb11658a461d";
+
+		const char *keyRSA2 =
+			"30820273020100300D06092A864886F70D01010105000482025D3082025902010002818100D40AF9"
+			"A2B713034249E5780056D70FC7DE75D76E44565AA6A6B8ED9646F3C19F9E254D72D7DE6E49DB2264"
+			"0C1D05AB9E2A5F901D8F3FE1F7AE02CEE2ECCE54A40ABAE55A004692752E70725AEEE7CDEA67628A"
+			"82A9239B4AB660C2BC56D9F01E90CBAAB9BF0FC8E17173CEFC5709A29391A7DDF3E0B758691AAF30"
+			"725B292F4F020111027F18C0BA087D082C45D75D3594E0767E4820818EB35612B80CEAB8C880ACA5"
+			"44B6876DFFEF85A576C0D45B551AFAA1FD63209CD745DF75C5A0F0B580296EA466CD0338207E4752"
+			"FF4E7DB724D8AE18CE5CF4153BB94C27869FBB50E64F02546E4B02997A0B8623E64017CC770759C6"
+			"695DB649EEFD829D688D441BCC4E7348F1024100EF86DD7AF3F32CDE8A9F6564E43A559A0C9F8BAD"
+			"36CC25330548B347AC158A345631FA90F7B873C36EFFAE2F7823227A3F580B5DD18304D5932751E7"
+			"43E9234F024100E2A039854B55688740E32A51DF4AF88613D91A371CF8DDD95D780A89D7CF2119A9"
+			"54F1AC0F3DCDB2F6959926E6D9D37D8BC07A4C634DE6F16315BD5F0DAC340102407ECEEDB9903572"
+			"1B76909F174BA6698DCA72953D957B22C0A871C8531EDE3A1BB52984A719BC010D1CA57A555DB83F"
+			"6DE54CBAB932AEC652F38D497A6F3F30CF024100854F30E4FF232E6DADB2CD99926855F484255AB7"
+			"01FBCDCB27EC426F33A7046972AA700ADBCA008763DF87440F52F4E070531AC385B55AAC1C2AE7DD"
+			"8F9278F1024100C313F4AF9E4A9DE1253C21080CE524251560C111550772FD08690F13FBE658342E"
+			"BD2D41C9DCB12374E871B1839E26CAE252E1AE3DAAD5F1EE1F42B4D0EE7581";
+
+		SignatureKnownAnswerTest<RSASS<PKCS1v15, SHA1> >(
+			keyRSA1,
+			"Everyone gets Friday off.",
+			"0610761F95FFD1B8F29DA34212947EC2AA0E358866A722F03CC3C41487ADC604A48FF54F5C6BEDB9FB7BD59F82D6E55D8F3174BA361B2214B2D74E8825E04E81");
+
+		SignatureKnownAnswerTest<RSASS_ISO<SHA1> >(
+			keyRSA2,
+			"test",
+			"32F6BA41C8930DE71EE67F2627172CC539EDE04267FDE03AC295E3C50311F26C3B275D3AF513AC96"
+			"8EE493BAB7DA3A754661D1A7C4A0D1A2B7EE8B313AACD8CB8BFBC5C15EFB0EF15C86A9334A1E87AD"
+			"291EB961B5CA0E84930429B28780816AA94F96FC2367B71E2D2E4866FA966795B147F00600E5207E"
+			"2F189C883B37477C");
+
+		SignaturePairwiseConsistencyTest<DSA>(
+			"3082014A0201003082012B06072A8648CE3804013082011E02818100F468699A6F6EBCC0120D3B34C8E007F125EC7D81F763B8D0F33869AE3BD6B9F2ECCC7DF34DF84C0307449E9B85D30D57194BCCEB310F48141914DD13A077AAF9B624A6CBE666BBA1D7EBEA95B5BA6F54417FD5D4E4220C601E071D316A24EA814E8B0122DBF47EE8AEEFD319EBB01DD95683F10DBB4FEB023F8262A07EAEB7FD02150082AD4E034DA6EEACDFDAE68C36F2BAD614F9E53B02818071AAF73361A26081529F7D84078ADAFCA48E031DB54AD57FB1A833ADBD8672328AABAA0C756247998D7A5B10DACA359D231332CE8120B483A784FE07D46EEBFF0D7D374A10691F78653E6DC29E27CCB1B174923960DFE5B959B919B2C3816C19251832AFD8E35D810E598F82877ABF7D40A041565168BD7F0E21E3FE2A8D8C1C0416021426EBA66E846E755169F84A1DA981D86502405DDF");
+
+		SignaturePairwiseConsistencyTest<ECDSA<EC2N, SHA1> >(
+			"302D020100301006072A8648CE3D020106052B8104000404163014020101040F0070337065E1E196980A9D00E37211");
+
+		SignaturePairwiseConsistencyTest<ECDSA<ECP, SHA1> >(
+			"3039020100301306072A8648CE3D020106082A8648CE3D030101041F301D02010104182BB8A13C8B867010BD9471D9E81FDB01ABD0538C64D6249A");
+
+		SignaturePairwiseConsistencyTest<RSASS<PSS, SHA1> >(keyRSA1);
+	}
+	catch (...)
+	{
+		g_powerUpSelfTestStatus = POWER_UP_SELF_TEST_FAILED;
+		goto done;
+	}
+
+	g_powerUpSelfTestStatus = POWER_UP_SELF_TEST_PASSED;
+
+done:
+	SetPowerUpSelfTestInProgressOnThisThread(false);
+	return;
+}
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+
+void DoDllPowerUpSelfTest()
+{
+	CryptoPP::DoPowerUpSelfTest(NULLPTR, s_moduleMac);
+}
+
+#else
+
+void DoDllPowerUpSelfTest()
+{
+	throw NotImplemented("DoDllPowerUpSelfTest() only available on Windows");
+}
+
+#endif	// #ifdef CRYPTOPP_WIN32_AVAILABLE
+
+NAMESPACE_END
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+
+// DllMain needs to be in the global namespace
+BOOL APIENTRY DllMain(HANDLE hModule,
+                      DWORD  dwReason,
+                      LPVOID /*lpReserved*/)
+{
+	if (dwReason == DLL_PROCESS_ATTACH)
+	{
+		CryptoPP::s_hModule = (HMODULE)hModule;
+		CryptoPP::DoDllPowerUpSelfTest();
+	}
+    return TRUE;
+}
+
+#endif	// #ifdef CRYPTOPP_WIN32_AVAILABLE
+
+#endif	// #ifndef CRYPTOPP_IMPORTS
diff --git a/runtime/third_party/cryptopp/fltrimpl.h b/runtime/third_party/cryptopp/fltrimpl.h
new file mode 100644
index 0000000..399a729
--- /dev/null
+++ b/runtime/third_party/cryptopp/fltrimpl.h
@@ -0,0 +1,69 @@
+#ifndef CRYPTOPP_FLTRIMPL_H
+#define CRYPTOPP_FLTRIMPL_H
+
+#define FILTER_BEGIN	\
+	switch (m_continueAt)	\
+	{	\
+	case 0:	\
+		m_inputPosition = 0;
+
+#define FILTER_END_NO_MESSAGE_END_NO_RETURN	\
+		break;	\
+	default:	\
+		CRYPTOPP_ASSERT(false);	\
+	}
+
+#define FILTER_END_NO_MESSAGE_END	\
+	FILTER_END_NO_MESSAGE_END_NO_RETURN	\
+	return 0;
+
+/*
+#define FILTER_END	\
+	case -1:	\
+		if (messageEnd && Output(-1, NULLPTR, 0, messageEnd, blocking))	\
+			return 1;	\
+	FILTER_END_NO_MESSAGE_END
+*/
+
+#define FILTER_OUTPUT3(site, statement, output, length, messageEnd, channel)	\
+	{\
+	case site:	\
+	(void) statement;	\
+	if (Output(site, output, length, messageEnd, blocking, channel))	\
+		return STDMAX(size_t(1), length-m_inputPosition);\
+	}
+
+#define FILTER_OUTPUT2(site, statement, output, length, messageEnd)	\
+	FILTER_OUTPUT3(site, statement, output, length, messageEnd, DEFAULT_CHANNEL)
+
+#define FILTER_OUTPUT(site, output, length, messageEnd)	\
+	FILTER_OUTPUT2(site, 0, output, length, messageEnd)
+
+#define FILTER_OUTPUT_BYTE(site, output)	\
+	FILTER_OUTPUT(site, &(const byte &)(byte)output, 1, 0)
+
+#define FILTER_OUTPUT2_MODIFIABLE(site, statement, output, length, messageEnd)	\
+	{\
+	/* fall through */ \
+	case site:	\
+	(void) statement;	\
+	if (OutputModifiable(site, output, length, messageEnd, blocking))	\
+		return STDMAX(size_t(1), length-m_inputPosition);\
+	}
+
+#define FILTER_OUTPUT_MODIFIABLE(site, output, length, messageEnd)	\
+	FILTER_OUTPUT2_MODIFIABLE(site, 0, output, length, messageEnd)
+
+#define FILTER_OUTPUT2_MAYBE_MODIFIABLE(site, statement, output, length, messageEnd, modifiable)	\
+	{\
+	/* fall through */ \
+	case site:	\
+	(void) statement;	\
+	if (modifiable ? OutputModifiable(site, output, length, messageEnd, blocking) : Output(site, output, length, messageEnd, blocking))	\
+		return STDMAX(size_t(1), length-m_inputPosition);\
+	}
+
+#define FILTER_OUTPUT_MAYBE_MODIFIABLE(site, output, length, messageEnd, modifiable)	\
+	FILTER_OUTPUT2_MAYBE_MODIFIABLE(site, 0, output, length, messageEnd, modifiable)
+
+#endif
diff --git a/runtime/third_party/cryptopp/gcm.cpp b/runtime/third_party/cryptopp/gcm.cpp
new file mode 100644
index 0000000..56109b8
--- /dev/null
+++ b/runtime/third_party/cryptopp/gcm.cpp
@@ -0,0 +1,856 @@
+// gcm.cpp - originally written and placed in the public domain by Wei Dai.
+//           ARM and Aarch64 added by Jeffrey Walton. The ARM carryless
+//           multiply routines are less efficient because they shadow x86.
+//           The precomputed key table integration makes it tricky to use the
+//           more efficient ARMv8 implementation of the multiply and reduce.
+
+// use "cl /EP /P /DCRYPTOPP_GENERATE_X64_MASM gcm.cpp" to generate MASM code
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+// Visual Studio .Net 2003 compiler crash
+#if defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION < 1400)
+# pragma optimize("", off)
+#endif
+
+#include "gcm.h"
+#include "cpu.h"
+
+#if defined(CRYPTOPP_DISABLE_GCM_ASM)
+# undef CRYPTOPP_X86_ASM_AVAILABLE
+# undef CRYPTOPP_X32_ASM_AVAILABLE
+# undef CRYPTOPP_X64_ASM_AVAILABLE
+# undef CRYPTOPP_SSE2_ASM_AVAILABLE
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+// Different assemblers accept different mnemonics: 'movd eax, xmm0' vs
+//   'movd rax, xmm0' vs 'mov eax, xmm0' vs 'mov rax, xmm0'
+#if defined(CRYPTOPP_DISABLE_MIXED_ASM)
+// 'movd eax, xmm0' only. REG_WORD() macro not used. Clang path.
+# define USE_MOVD_REG32 1
+#elif defined(__GNUC__) || defined(CRYPTOPP_MSC_VERSION)
+// 'movd eax, xmm0' or 'movd rax, xmm0'. REG_WORD() macro supplies REG32 or REG64.
+# define USE_MOVD_REG32_OR_REG64 1
+#else
+// 'mov eax, xmm0' or 'mov rax, xmm0'. REG_WORD() macro supplies REG32 or REG64.
+# define USE_MOV_REG32_OR_REG64 1
+#endif
+#endif  // CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64
+
+word16 GCM_Base::s_reductionTable[256];
+volatile bool GCM_Base::s_reductionTableInitialized = false;
+
+void GCM_Base::GCTR::IncrementCounterBy256()
+{
+    IncrementCounterByOne(m_counterArray+BlockSize()-4, 3);
+}
+
+static inline void Xor16(byte *a, const byte *b, const byte *c)
+{
+    CRYPTOPP_ASSERT(IsAlignedOn(a,GetAlignmentOf<word64>()));
+    CRYPTOPP_ASSERT(IsAlignedOn(b,GetAlignmentOf<word64>()));
+    CRYPTOPP_ASSERT(IsAlignedOn(c,GetAlignmentOf<word64>()));
+    ((word64 *)(void *)a)[0] = ((word64 *)(void *)b)[0] ^ ((word64 *)(void *)c)[0];
+    ((word64 *)(void *)a)[1] = ((word64 *)(void *)b)[1] ^ ((word64 *)(void *)c)[1];
+}
+
+#if CRYPTOPP_SSE2_INTRIN_AVAILABLE || CRYPTOPP_SSE2_ASM_AVAILABLE
+// SunCC 5.10-5.11 compiler crash. Move GCM_Xor16_SSE2 out-of-line, and place in
+// a source file with a SSE architecture switch. Also see GH #226 and GH #284.
+extern void GCM_Xor16_SSE2(byte *a, const byte *b, const byte *c);
+#endif  // SSE2
+
+#if CRYPTOPP_ARM_NEON_AVAILABLE
+extern void GCM_Xor16_NEON(byte *a, const byte *b, const byte *c);
+#endif
+
+#if CRYPTOPP_POWER8_AVAILABLE
+extern void GCM_Xor16_POWER8(byte *a, const byte *b, const byte *c);
+#endif
+
+#if CRYPTOPP_CLMUL_AVAILABLE
+extern void GCM_SetKeyWithoutResync_CLMUL(const byte *hashKey, byte *mulTable, unsigned int tableSize);
+extern size_t GCM_AuthenticateBlocks_CLMUL(const byte *data, size_t len, const byte *mtable, byte *hbuffer);
+const unsigned int s_cltableSizeInBlocks = 8;
+extern void GCM_ReverseHashBufferIfNeeded_CLMUL(byte *hashBuffer);
+#endif  // CRYPTOPP_CLMUL_AVAILABLE
+
+#if CRYPTOPP_ARM_PMULL_AVAILABLE
+extern void GCM_SetKeyWithoutResync_PMULL(const byte *hashKey, byte *mulTable, unsigned int tableSize);
+extern size_t GCM_AuthenticateBlocks_PMULL(const byte *data, size_t len, const byte *mtable, byte *hbuffer);
+const unsigned int s_cltableSizeInBlocks = 8;
+extern void GCM_ReverseHashBufferIfNeeded_PMULL(byte *hashBuffer);
+#endif  // CRYPTOPP_ARM_PMULL_AVAILABLE
+
+#if CRYPTOPP_POWER8_VMULL_AVAILABLE
+extern void GCM_SetKeyWithoutResync_VMULL(const byte *hashKey, byte *mulTable, unsigned int tableSize);
+extern size_t GCM_AuthenticateBlocks_VMULL(const byte *data, size_t len, const byte *mtable, byte *hbuffer);
+const unsigned int s_cltableSizeInBlocks = 8;
+extern void GCM_ReverseHashBufferIfNeeded_VMULL(byte *hashBuffer);
+#endif  // CRYPTOPP_POWER8_VMULL_AVAILABLE
+
+void GCM_Base::SetKeyWithoutResync(const byte *userKey, size_t keylength, const NameValuePairs &params)
+{
+    BlockCipher &blockCipher = AccessBlockCipher();
+    blockCipher.SetKey(userKey, keylength, params);
+
+    // GCM is only defined for 16-byte block ciphers at the moment.
+    // However, variable blocksize support means we have to defer
+    // blocksize checks to runtime after the key is set. Also see
+    // https://github.com/weidai11/cryptopp/issues/408.
+    const unsigned int blockSize = blockCipher.BlockSize();
+    CRYPTOPP_ASSERT(blockSize == REQUIRED_BLOCKSIZE);
+    if (blockCipher.BlockSize() != REQUIRED_BLOCKSIZE)
+        throw InvalidArgument(AlgorithmName() + ": block size of underlying block cipher is not 16");
+
+    int tableSize, i, j, k;
+
+#if CRYPTOPP_CLMUL_AVAILABLE
+    if (HasCLMUL())
+    {
+        // Avoid "parameter not used" error and suppress Coverity finding
+        (void)params.GetIntValue(Name::TableSize(), tableSize);
+        tableSize = s_cltableSizeInBlocks * blockSize;
+        CRYPTOPP_ASSERT(tableSize > static_cast<int>(blockSize));
+    }
+    else
+#elif CRYPTOPP_ARM_PMULL_AVAILABLE
+    if (HasPMULL())
+    {
+        // Avoid "parameter not used" error and suppress Coverity finding
+        (void)params.GetIntValue(Name::TableSize(), tableSize);
+        tableSize = s_cltableSizeInBlocks * blockSize;
+        CRYPTOPP_ASSERT(tableSize > static_cast<int>(blockSize));
+    }
+    else
+#elif CRYPTOPP_POWER8_VMULL_AVAILABLE
+    if (HasPMULL())
+    {
+        // Avoid "parameter not used" error and suppress Coverity finding
+        (void)params.GetIntValue(Name::TableSize(), tableSize);
+        tableSize = s_cltableSizeInBlocks * blockSize;
+        CRYPTOPP_ASSERT(tableSize > static_cast<int>(blockSize));
+    }
+    else
+#endif
+    {
+        if (params.GetIntValue(Name::TableSize(), tableSize))
+            tableSize = (tableSize >= 64*1024) ? 64*1024 : 2*1024;
+        else
+            tableSize = (GetTablesOption() == GCM_64K_Tables) ? 64*1024 : 2*1024;
+
+        //#if defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION < 1400)
+        // VC 2003 workaround: compiler generates bad code for 64K tables
+        //tableSize = 2*1024;
+        //#endif
+    }
+
+    m_buffer.resize(3*blockSize + tableSize);
+    byte *mulTable = MulTable();
+    byte *hashKey = HashKey();
+    std::memset(hashKey, 0, REQUIRED_BLOCKSIZE);
+    blockCipher.ProcessBlock(hashKey);
+
+#if CRYPTOPP_CLMUL_AVAILABLE
+    if (HasCLMUL())
+    {
+        GCM_SetKeyWithoutResync_CLMUL(hashKey, mulTable, tableSize);
+        return;
+    }
+#elif CRYPTOPP_ARM_PMULL_AVAILABLE
+    if (HasPMULL())
+    {
+        GCM_SetKeyWithoutResync_PMULL(hashKey, mulTable, tableSize);
+        return;
+    }
+#elif CRYPTOPP_POWER8_VMULL_AVAILABLE
+    if (HasPMULL())
+    {
+        GCM_SetKeyWithoutResync_VMULL(hashKey, mulTable, tableSize);
+        return;
+    }
+#endif
+
+    word64 V0, V1;
+    typedef BlockGetAndPut<word64, BigEndian> Block;
+    Block::Get(hashKey)(V0)(V1);
+
+    if (tableSize == 64*1024)
+    {
+        for (i=0; i<128; i++)
+        {
+            k = i%8;
+            Block::Put(NULLPTR, mulTable+(i/8)*256*16+(size_t(1)<<(11-k)))(V0)(V1);
+
+            int x = (int)V1 & 1;
+            V1 = (V1>>1) | (V0<<63);
+            V0 = (V0>>1) ^ (x ? W64LIT(0xe1) << 56 : 0);
+        }
+
+        for (i=0; i<16; i++)
+        {
+            std::memset(mulTable+i*256*16, 0, 16);
+#if CRYPTOPP_SSE2_INTRIN_AVAILABLE || CRYPTOPP_SSE2_ASM_AVAILABLE
+            if (HasSSE2())
+                for (j=2; j<=0x80; j*=2)
+                    for (k=1; k<j; k++)
+                        GCM_Xor16_SSE2(mulTable+i*256*16+(j+k)*16, mulTable+i*256*16+j*16, mulTable+i*256*16+k*16);
+            else
+#elif CRYPTOPP_ARM_NEON_AVAILABLE
+            if (HasNEON())
+                for (j=2; j<=0x80; j*=2)
+                    for (k=1; k<j; k++)
+                        GCM_Xor16_NEON(mulTable+i*256*16+(j+k)*16, mulTable+i*256*16+j*16, mulTable+i*256*16+k*16);
+            else
+#elif CRYPTOPP_POWER8_AVAILABLE
+            if (HasPower8())
+                for (j=2; j<=0x80; j*=2)
+                    for (k=1; k<j; k++)
+                        GCM_Xor16_POWER8(mulTable+i*256*16+(j+k)*16, mulTable+i*256*16+j*16, mulTable+i*256*16+k*16);
+            else
+#endif
+                for (j=2; j<=0x80; j*=2)
+                    for (k=1; k<j; k++)
+                        Xor16(mulTable+i*256*16+(j+k)*16, mulTable+i*256*16+j*16, mulTable+i*256*16+k*16);
+        }
+    }
+    else
+    {
+        if (!s_reductionTableInitialized)
+        {
+            s_reductionTable[0] = 0;
+            word16 x = 0x01c2;
+            s_reductionTable[1] = ByteReverse(x);
+            for (unsigned int ii=2; ii<=0x80; ii*=2)
+            {
+                x <<= 1;
+                s_reductionTable[ii] = ByteReverse(x);
+                for (unsigned int jj=1; jj<ii; jj++)
+                    s_reductionTable[ii+jj] = s_reductionTable[ii] ^ s_reductionTable[jj];
+            }
+            s_reductionTableInitialized = true;
+        }
+
+        for (i=0; i<128-24; i++)
+        {
+            k = i%32;
+            if (k < 4)
+                Block::Put(NULLPTR, mulTable+1024+(i/32)*256+(size_t(1)<<(7-k)))(V0)(V1);
+            else if (k < 8)
+                Block::Put(NULLPTR, mulTable+(i/32)*256+(size_t(1)<<(11-k)))(V0)(V1);
+
+            int x = (int)V1 & 1;
+            V1 = (V1>>1) | (V0<<63);
+            V0 = (V0>>1) ^ (x ? W64LIT(0xe1) << 56 : 0);
+        }
+
+        for (i=0; i<4; i++)
+        {
+            std::memset(mulTable+i*256, 0, 16);
+            std::memset(mulTable+1024+i*256, 0, 16);
+#if CRYPTOPP_SSE2_INTRIN_AVAILABLE || CRYPTOPP_SSE2_ASM_AVAILABLE
+            if (HasSSE2())
+                for (j=2; j<=8; j*=2)
+                    for (k=1; k<j; k++)
+                    {
+                        GCM_Xor16_SSE2(mulTable+i*256+(j+k)*16, mulTable+i*256+j*16, mulTable+i*256+k*16);
+                        GCM_Xor16_SSE2(mulTable+1024+i*256+(j+k)*16, mulTable+1024+i*256+j*16, mulTable+1024+i*256+k*16);
+                    }
+            else
+#elif CRYPTOPP_ARM_NEON_AVAILABLE
+            if (HasNEON())
+                for (j=2; j<=8; j*=2)
+                    for (k=1; k<j; k++)
+                    {
+                        GCM_Xor16_NEON(mulTable+i*256+(j+k)*16, mulTable+i*256+j*16, mulTable+i*256+k*16);
+                        GCM_Xor16_NEON(mulTable+1024+i*256+(j+k)*16, mulTable+1024+i*256+j*16, mulTable+1024+i*256+k*16);
+                    }
+            else
+#elif CRYPTOPP_POWER8_AVAILABLE
+            if (HasPower8())
+                for (j=2; j<=8; j*=2)
+                    for (k=1; k<j; k++)
+                    {
+                        GCM_Xor16_POWER8(mulTable+i*256+(j+k)*16, mulTable+i*256+j*16, mulTable+i*256+k*16);
+                        GCM_Xor16_POWER8(mulTable+1024+i*256+(j+k)*16, mulTable+1024+i*256+j*16, mulTable+1024+i*256+k*16);
+                    }
+            else
+#endif
+                for (j=2; j<=8; j*=2)
+                    for (k=1; k<j; k++)
+                    {
+                        Xor16(mulTable+i*256+(j+k)*16, mulTable+i*256+j*16, mulTable+i*256+k*16);
+                        Xor16(mulTable+1024+i*256+(j+k)*16, mulTable+1024+i*256+j*16, mulTable+1024+i*256+k*16);
+                    }
+        }
+    }
+}
+
+inline void GCM_Base::ReverseHashBufferIfNeeded()
+{
+#if CRYPTOPP_CLMUL_AVAILABLE
+    if (HasCLMUL())
+    {
+        GCM_ReverseHashBufferIfNeeded_CLMUL(HashBuffer());
+    }
+#elif CRYPTOPP_ARM_PMULL_AVAILABLE
+    if (HasPMULL())
+    {
+        GCM_ReverseHashBufferIfNeeded_PMULL(HashBuffer());
+    }
+#elif CRYPTOPP_POWER8_VMULL_AVAILABLE
+    if (HasPMULL())
+    {
+        GCM_ReverseHashBufferIfNeeded_VMULL(HashBuffer());
+    }
+#endif
+}
+
+void GCM_Base::Resync(const byte *iv, size_t len)
+{
+    BlockCipher &cipher = AccessBlockCipher();
+    byte *hashBuffer = HashBuffer();
+
+    if (len == 12)
+    {
+        std::memcpy(hashBuffer, iv, len);
+        std::memset(hashBuffer+len, 0, 3);
+        hashBuffer[len+3] = 1;
+    }
+    else
+    {
+        size_t origLen = len;
+        std::memset(hashBuffer, 0, HASH_BLOCKSIZE);
+
+        if (len >= HASH_BLOCKSIZE)
+        {
+            len = GCM_Base::AuthenticateBlocks(iv, len);
+            iv += (origLen - len);
+        }
+
+        if (len > 0)
+        {
+            std::memcpy(m_buffer, iv, len);
+            std::memset(m_buffer+len, 0, HASH_BLOCKSIZE-len);
+            GCM_Base::AuthenticateBlocks(m_buffer, HASH_BLOCKSIZE);
+        }
+
+        PutBlock<word64, BigEndian, true>(NULLPTR, m_buffer)(0)(origLen*8);
+        GCM_Base::AuthenticateBlocks(m_buffer, HASH_BLOCKSIZE);
+
+        ReverseHashBufferIfNeeded();
+    }
+
+    if (m_state >= State_IVSet)
+        m_ctr.Resynchronize(hashBuffer, REQUIRED_BLOCKSIZE);
+    else
+        m_ctr.SetCipherWithIV(cipher, hashBuffer);
+
+    m_ctr.Seek(HASH_BLOCKSIZE);
+
+    std::memset(hashBuffer, 0, HASH_BLOCKSIZE);
+}
+
+unsigned int GCM_Base::OptimalDataAlignment() const
+{
+    return
+#if CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)
+        HasSSE2() ? 16 :
+#elif CRYPTOPP_ARM_NEON_AVAILABLE
+        HasNEON() ? 4 :
+#elif CRYPTOPP_POWER8_AVAILABLE
+        HasPower8() ? 16 :
+#endif
+        GetBlockCipher().OptimalDataAlignment();
+}
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4731)    // frame pointer register 'ebp' modified by inline assembly code
+#endif
+
+#endif    // Not CRYPTOPP_GENERATE_X64_MASM
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+extern "C" {
+void GCM_AuthenticateBlocks_2K_SSE2(const byte *data, size_t blocks, word64 *hashBuffer, const word16 *reductionTable);
+void GCM_AuthenticateBlocks_64K_SSE2(const byte *data, size_t blocks, word64 *hashBuffer);
+}
+#endif
+
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+size_t GCM_Base::AuthenticateBlocks(const byte *data, size_t len)
+{
+#if CRYPTOPP_CLMUL_AVAILABLE
+    if (HasCLMUL())
+    {
+        return GCM_AuthenticateBlocks_CLMUL(data, len, MulTable(), HashBuffer());
+    }
+#elif CRYPTOPP_ARM_PMULL_AVAILABLE
+    if (HasPMULL())
+    {
+        return GCM_AuthenticateBlocks_PMULL(data, len, MulTable(), HashBuffer());
+    }
+#elif CRYPTOPP_POWER8_VMULL_AVAILABLE
+    if (HasPMULL())
+    {
+        return GCM_AuthenticateBlocks_VMULL(data, len, MulTable(), HashBuffer());
+    }
+#endif
+
+    typedef BlockGetAndPut<word64, NativeByteOrder> Block;
+    word64 *hashBuffer = (word64 *)(void *)HashBuffer();
+    CRYPTOPP_ASSERT(IsAlignedOn(hashBuffer,GetAlignmentOf<word64>()));
+
+    switch (2*(m_buffer.size()>=64*1024)
+#if CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)
+        + HasSSE2()
+//#elif CRYPTOPP_ARM_NEON_AVAILABLE
+//      + HasNEON()
+#endif
+        )
+    {
+    case 0:        // non-SSE2 and 2K tables
+        {
+        byte *mulTable = MulTable();
+        word64 x0 = hashBuffer[0], x1 = hashBuffer[1];
+
+        do
+        {
+            word64 y0, y1, a0, a1, b0, b1, c0, c1, d0, d1;
+            Block::Get(data)(y0)(y1);
+            x0 ^= y0;
+            x1 ^= y1;
+
+            data += HASH_BLOCKSIZE;
+            len -= HASH_BLOCKSIZE;
+
+            #define READ_TABLE_WORD64_COMMON(a, b, c, d)    *(word64 *)(void *)(mulTable+(a*1024)+(b*256)+c+d*8)
+
+            #if (CRYPTOPP_LITTLE_ENDIAN)
+                #if CRYPTOPP_BOOL_SLOW_WORD64
+                    word32 z0 = (word32)x0;
+                    word32 z1 = (word32)(x0>>32);
+                    word32 z2 = (word32)x1;
+                    word32 z3 = (word32)(x1>>32);
+                    #define READ_TABLE_WORD64(a, b, c, d, e)    READ_TABLE_WORD64_COMMON((d%2), c, (d?(z##c>>((d?d-1:0)*4))&0xf0:(z##c&0xf)<<4), e)
+                #else
+                    #define READ_TABLE_WORD64(a, b, c, d, e)    READ_TABLE_WORD64_COMMON((d%2), c, ((d+8*b)?(x##a>>(((d+8*b)?(d+8*b)-1:1)*4))&0xf0:(x##a&0xf)<<4), e)
+                #endif
+                #define GF_MOST_SIG_8BITS(a) (a##1 >> 7*8)
+                #define GF_SHIFT_8(a) a##1 = (a##1 << 8) ^ (a##0 >> 7*8); a##0 <<= 8;
+            #else
+                #define READ_TABLE_WORD64(a, b, c, d, e)    READ_TABLE_WORD64_COMMON((1-d%2), c, ((15-d-8*b)?(x##a>>(((15-d-8*b)?(15-d-8*b)-1:0)*4))&0xf0:(x##a&0xf)<<4), e)
+                #define GF_MOST_SIG_8BITS(a) (a##1 & 0xff)
+                #define GF_SHIFT_8(a) a##1 = (a##1 >> 8) ^ (a##0 << 7*8); a##0 >>= 8;
+            #endif
+
+            #define GF_MUL_32BY128(op, a, b, c)                                            \
+                a0 op READ_TABLE_WORD64(a, b, c, 0, 0) ^ READ_TABLE_WORD64(a, b, c, 1, 0); \
+                a1 op READ_TABLE_WORD64(a, b, c, 0, 1) ^ READ_TABLE_WORD64(a, b, c, 1, 1); \
+                b0 op READ_TABLE_WORD64(a, b, c, 2, 0) ^ READ_TABLE_WORD64(a, b, c, 3, 0); \
+                b1 op READ_TABLE_WORD64(a, b, c, 2, 1) ^ READ_TABLE_WORD64(a, b, c, 3, 1); \
+                c0 op READ_TABLE_WORD64(a, b, c, 4, 0) ^ READ_TABLE_WORD64(a, b, c, 5, 0); \
+                c1 op READ_TABLE_WORD64(a, b, c, 4, 1) ^ READ_TABLE_WORD64(a, b, c, 5, 1); \
+                d0 op READ_TABLE_WORD64(a, b, c, 6, 0) ^ READ_TABLE_WORD64(a, b, c, 7, 0); \
+                d1 op READ_TABLE_WORD64(a, b, c, 6, 1) ^ READ_TABLE_WORD64(a, b, c, 7, 1); \
+
+            GF_MUL_32BY128(=, 0, 0, 0)
+            GF_MUL_32BY128(^=, 0, 1, 1)
+            GF_MUL_32BY128(^=, 1, 0, 2)
+            GF_MUL_32BY128(^=, 1, 1, 3)
+
+            word32 r = (word32)s_reductionTable[GF_MOST_SIG_8BITS(d)] << 16;
+            GF_SHIFT_8(d)
+            c0 ^= d0; c1 ^= d1;
+            r ^= (word32)s_reductionTable[GF_MOST_SIG_8BITS(c)] << 8;
+            GF_SHIFT_8(c)
+            b0 ^= c0; b1 ^= c1;
+            r ^= s_reductionTable[GF_MOST_SIG_8BITS(b)];
+            GF_SHIFT_8(b)
+            a0 ^= b0; a1 ^= b1;
+            a0 ^= ConditionalByteReverse<word64>(LITTLE_ENDIAN_ORDER, r);
+            x0 = a0; x1 = a1;
+        }
+        while (len >= HASH_BLOCKSIZE);
+
+        hashBuffer[0] = x0; hashBuffer[1] = x1;
+        return len;
+        }
+
+    case 2:        // non-SSE2 and 64K tables
+        {
+        byte *mulTable = MulTable();
+        word64 x0 = hashBuffer[0], x1 = hashBuffer[1];
+
+        do
+        {
+            word64 y0, y1, a0, a1;
+            Block::Get(data)(y0)(y1);
+            x0 ^= y0;
+            x1 ^= y1;
+
+            data += HASH_BLOCKSIZE;
+            len -= HASH_BLOCKSIZE;
+
+            #undef READ_TABLE_WORD64_COMMON
+            #undef READ_TABLE_WORD64
+
+            #define READ_TABLE_WORD64_COMMON(a, c, d)    *(word64 *)(void *)(mulTable+(a)*256*16+(c)+(d)*8)
+
+            #if (CRYPTOPP_LITTLE_ENDIAN)
+                #if CRYPTOPP_BOOL_SLOW_WORD64
+                    word32 z0 = (word32)x0;
+                    word32 z1 = (word32)(x0>>32);
+                    word32 z2 = (word32)x1;
+                    word32 z3 = (word32)(x1>>32);
+                    #define READ_TABLE_WORD64(b, c, d, e)    READ_TABLE_WORD64_COMMON(c*4+d, (d?(z##c>>((d?d:1)*8-4))&0xff0:(z##c&0xff)<<4), e)
+                #else
+                    #define READ_TABLE_WORD64(b, c, d, e)    READ_TABLE_WORD64_COMMON(c*4+d, ((d+4*(c%2))?(x##b>>(((d+4*(c%2))?(d+4*(c%2)):1)*8-4))&0xff0:(x##b&0xff)<<4), e)
+                #endif
+            #else
+                #define READ_TABLE_WORD64(b, c, d, e)    READ_TABLE_WORD64_COMMON(c*4+d, ((7-d-4*(c%2))?(x##b>>(((7-d-4*(c%2))?(7-d-4*(c%2)):1)*8-4))&0xff0:(x##b&0xff)<<4), e)
+            #endif
+
+            #define GF_MUL_8BY128(op, b, c, d)        \
+                a0 op READ_TABLE_WORD64(b, c, d, 0);\
+                a1 op READ_TABLE_WORD64(b, c, d, 1);\
+
+            GF_MUL_8BY128(=, 0, 0, 0)
+            GF_MUL_8BY128(^=, 0, 0, 1)
+            GF_MUL_8BY128(^=, 0, 0, 2)
+            GF_MUL_8BY128(^=, 0, 0, 3)
+            GF_MUL_8BY128(^=, 0, 1, 0)
+            GF_MUL_8BY128(^=, 0, 1, 1)
+            GF_MUL_8BY128(^=, 0, 1, 2)
+            GF_MUL_8BY128(^=, 0, 1, 3)
+            GF_MUL_8BY128(^=, 1, 2, 0)
+            GF_MUL_8BY128(^=, 1, 2, 1)
+            GF_MUL_8BY128(^=, 1, 2, 2)
+            GF_MUL_8BY128(^=, 1, 2, 3)
+            GF_MUL_8BY128(^=, 1, 3, 0)
+            GF_MUL_8BY128(^=, 1, 3, 1)
+            GF_MUL_8BY128(^=, 1, 3, 2)
+            GF_MUL_8BY128(^=, 1, 3, 3)
+
+            x0 = a0; x1 = a1;
+        }
+        while (len >= HASH_BLOCKSIZE);
+
+        hashBuffer[0] = x0; hashBuffer[1] = x1;
+        return len;
+        }
+#endif    // #ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+    case 1:        // SSE2 and 2K tables
+        GCM_AuthenticateBlocks_2K_SSE2(data, len/16, hashBuffer, s_reductionTable);
+        return len % 16;
+    case 3:        // SSE2 and 64K tables
+        GCM_AuthenticateBlocks_64K_SSE2(data, len/16, hashBuffer);
+        return len % 16;
+#endif
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+
+    case 1:        // SSE2 and 2K tables
+        {
+        #ifdef __GNUC__
+            __asm__ __volatile__
+            (
+            INTEL_NOPREFIX
+        #elif defined(CRYPTOPP_GENERATE_X64_MASM)
+            ALIGN   8
+            GCM_AuthenticateBlocks_2K_SSE2    PROC FRAME
+            rex_push_reg rsi
+            push_reg rdi
+            push_reg rbx
+            .endprolog
+            mov rsi, r8
+            mov r11, r9
+        #else
+            AS2(    mov        WORD_REG(cx), data        )
+            AS2(    mov        WORD_REG(dx), len         )
+            AS2(    mov        WORD_REG(si), hashBuffer  )
+            AS2(    shr        WORD_REG(dx), 4           )
+        #endif
+
+        #if CRYPTOPP_BOOL_X32
+            AS1(push    rbx)
+            AS1(push    rbp)
+        #else
+            AS_PUSH_IF86(    bx)
+            AS_PUSH_IF86(    bp)
+        #endif
+
+        #ifdef __GNUC__
+            AS2(    mov      AS_REG_7, WORD_REG(di))
+        #elif CRYPTOPP_BOOL_X86
+            AS2(    lea      AS_REG_7, s_reductionTable)
+        #endif
+
+        AS2(    movdqa   xmm0, [WORD_REG(si)]            )
+
+        #define MUL_TABLE_0 WORD_REG(si) + 32
+        #define MUL_TABLE_1 WORD_REG(si) + 32 + 1024
+        #define RED_TABLE AS_REG_7
+
+        ASL(0)
+        AS2(    movdqu   xmm4, [WORD_REG(cx)]            )
+        AS2(    pxor     xmm0, xmm4                      )
+
+        AS2(    movd     ebx, xmm0                       )
+        AS2(    mov      eax, AS_HEX(f0f0f0f0)           )
+        AS2(    and      eax, ebx                        )
+        AS2(    shl      ebx, 4                          )
+        AS2(    and      ebx, AS_HEX(f0f0f0f0)           )
+        AS2(    movzx    edi, ah                         )
+        AS2(    movdqa   xmm5, XMMWORD_PTR [MUL_TABLE_1 + WORD_REG(di)]    )
+        AS2(    movzx    edi, al                         )
+        AS2(    movdqa   xmm4, XMMWORD_PTR [MUL_TABLE_1 + WORD_REG(di)]    )
+        AS2(    shr      eax, 16                         )
+        AS2(    movzx    edi, ah                         )
+        AS2(    movdqa   xmm3, XMMWORD_PTR [MUL_TABLE_1 + WORD_REG(di)]    )
+        AS2(    movzx    edi, al                         )
+        AS2(    movdqa   xmm2, XMMWORD_PTR [MUL_TABLE_1 + WORD_REG(di)]    )
+
+        #define SSE2_MUL_32BITS(i)                                                       \
+            AS2(    psrldq  xmm0, 4                                                     )\
+            AS2(    movd    eax, xmm0                                                   )\
+            AS2(    and     eax, AS_HEX(f0f0f0f0)                                       )\
+            AS2(    movzx   edi, bh                                                     )\
+            AS2(    pxor    xmm5, XMMWORD_PTR [MUL_TABLE_0 + (i-1)*256 + WORD_REG(di)]  )\
+            AS2(    movzx   edi, bl                                                     )\
+            AS2(    pxor    xmm4, XMMWORD_PTR [MUL_TABLE_0 + (i-1)*256 + WORD_REG(di)]  )\
+            AS2(    shr     ebx, 16                                                     )\
+            AS2(    movzx   edi, bh                                                     )\
+            AS2(    pxor    xmm3, XMMWORD_PTR [MUL_TABLE_0 + (i-1)*256 + WORD_REG(di)]  )\
+            AS2(    movzx   edi, bl                                                     )\
+            AS2(    pxor    xmm2, XMMWORD_PTR [MUL_TABLE_0 + (i-1)*256 + WORD_REG(di)]  )\
+            AS2(    movd    ebx, xmm0                                                   )\
+            AS2(    shl     ebx, 4                                                      )\
+            AS2(    and     ebx, AS_HEX(f0f0f0f0)                                       )\
+            AS2(    movzx   edi, ah                                                     )\
+            AS2(    pxor    xmm5, XMMWORD_PTR [MUL_TABLE_1 + i*256 + WORD_REG(di)]      )\
+            AS2(    movzx   edi, al                                                     )\
+            AS2(    pxor    xmm4, XMMWORD_PTR [MUL_TABLE_1 + i*256 + WORD_REG(di)]      )\
+            AS2(    shr     eax, 16                                                     )\
+            AS2(    movzx   edi, ah                                                     )\
+            AS2(    pxor    xmm3, XMMWORD_PTR [MUL_TABLE_1 + i*256 + WORD_REG(di)]      )\
+            AS2(    movzx   edi, al                                                     )\
+            AS2(    pxor    xmm2, XMMWORD_PTR [MUL_TABLE_1 + i*256 + WORD_REG(di)]      )\
+
+        SSE2_MUL_32BITS(1)
+        SSE2_MUL_32BITS(2)
+        SSE2_MUL_32BITS(3)
+
+        AS2(    movzx   edi, bh                    )
+        AS2(    pxor    xmm5, XMMWORD_PTR [MUL_TABLE_0 + 3*256 + WORD_REG(di)]    )
+        AS2(    movzx   edi, bl                    )
+        AS2(    pxor    xmm4, XMMWORD_PTR [MUL_TABLE_0 + 3*256 + WORD_REG(di)]    )
+        AS2(    shr     ebx, 16                    )
+        AS2(    movzx   edi, bh                    )
+        AS2(    pxor    xmm3, XMMWORD_PTR [MUL_TABLE_0 + 3*256 + WORD_REG(di)]    )
+        AS2(    movzx   edi, bl                    )
+        AS2(    pxor    xmm2, XMMWORD_PTR [MUL_TABLE_0 + 3*256 + WORD_REG(di)]    )
+
+        AS2(    movdqa  xmm0, xmm3                 )
+        AS2(    pslldq  xmm3, 1                    )
+        AS2(    pxor    xmm2, xmm3                 )
+        AS2(    movdqa  xmm1, xmm2                 )
+        AS2(    pslldq  xmm2, 1                    )
+        AS2(    pxor    xmm5, xmm2                 )
+
+        AS2(    psrldq  xmm0, 15                   )
+#if USE_MOVD_REG32
+        AS2(    movd    edi, xmm0                  )
+#elif USE_MOV_REG32_OR_REG64
+        AS2(    mov     WORD_REG(di), xmm0         )
+#else    // GNU Assembler
+        AS2(    movd    WORD_REG(di), xmm0         )
+#endif
+        AS2(    movzx   eax, WORD PTR [RED_TABLE + WORD_REG(di)*2]  )
+        AS2(    shl     eax, 8                     )
+
+        AS2(    movdqa  xmm0, xmm5                 )
+        AS2(    pslldq  xmm5, 1                    )
+        AS2(    pxor    xmm4, xmm5                 )
+
+        AS2(    psrldq  xmm1, 15                   )
+#if USE_MOVD_REG32
+        AS2(    movd    edi, xmm1                  )
+#elif USE_MOV_REG32_OR_REG64
+        AS2(    mov     WORD_REG(di), xmm1         )
+#else
+        AS2(    movd    WORD_REG(di), xmm1         )
+#endif
+        AS2(    xor     ax, WORD PTR [RED_TABLE + WORD_REG(di)*2]  )
+        AS2(    shl     eax, 8                     )
+
+        AS2(    psrldq  xmm0, 15                   )
+#if USE_MOVD_REG32
+        AS2(    movd    edi, xmm0                  )
+#elif USE_MOV_REG32_OR_REG64
+        AS2(    mov     WORD_REG(di), xmm0         )
+#else
+        AS2(    movd    WORD_REG(di), xmm0         )
+#endif
+        AS2(    xor     ax, WORD PTR [RED_TABLE + WORD_REG(di)*2]  )
+
+        AS2(    movd    xmm0, eax                  )
+        AS2(    pxor    xmm0, xmm4                 )
+
+        AS2(    add     WORD_REG(cx), 16           )
+        AS2(    sub     WORD_REG(dx), 1            )
+        // ATT_NOPREFIX
+        ASJ(    jnz,    0, b                       )
+        INTEL_NOPREFIX
+        AS2(    movdqa  [WORD_REG(si)], xmm0       )
+
+        #if CRYPTOPP_BOOL_X32
+            AS1(pop        rbp)
+            AS1(pop        rbx)
+        #else
+            AS_POP_IF86(    bp)
+            AS_POP_IF86(    bx)
+        #endif
+
+        #ifdef __GNUC__
+                ATT_PREFIX
+                    :
+                    : "c" (data), "d" (len/16), "S" (hashBuffer), "D" (s_reductionTable)
+                    : "memory", "cc", "%eax", "%ebx"
+#if (CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+                    , PERCENT_REG(AS_REG_7), "%xmm0", "%xmm1", "%xmm2", "%xmm3", "%xmm4", "%xmm5"
+#endif
+                );
+        #elif defined(CRYPTOPP_GENERATE_X64_MASM)
+            pop rbx
+            pop rdi
+            pop rsi
+            ret
+            GCM_AuthenticateBlocks_2K_SSE2 ENDP
+        #endif
+
+        return len%16;
+        }
+    case 3:        // SSE2 and 64K tables
+        {
+        #ifdef __GNUC__
+            __asm__ __volatile__
+            (
+            INTEL_NOPREFIX
+        #elif defined(CRYPTOPP_GENERATE_X64_MASM)
+            ALIGN   8
+            GCM_AuthenticateBlocks_64K_SSE2    PROC FRAME
+            rex_push_reg rsi
+            push_reg rdi
+            .endprolog
+            mov rsi, r8
+        #else
+            AS2(    mov        WORD_REG(cx), data       )
+            AS2(    mov        WORD_REG(dx), len        )
+            AS2(    mov        WORD_REG(si), hashBuffer )
+            AS2(    shr        WORD_REG(dx), 4          )
+        #endif
+
+        AS2(    movdqa    xmm0, [WORD_REG(si)]          )
+
+        #undef MUL_TABLE
+        #define MUL_TABLE(i,j) WORD_REG(si) + 32 + (i*4+j)*256*16
+
+        ASL(1)
+        AS2(    movdqu    xmm1, [WORD_REG(cx)]          )
+        AS2(    pxor    xmm1, xmm0                      )
+        AS2(    pxor    xmm0, xmm0                      )
+
+        #undef SSE2_MUL_32BITS
+        #define SSE2_MUL_32BITS(i)                                   \
+            AS2(    movd    eax, xmm1                               )\
+            AS2(    psrldq    xmm1, 4                               )\
+            AS2(    movzx    edi, al                                )\
+            AS2(    add        WORD_REG(di), WORD_REG(di)           )\
+            AS2(    pxor    xmm0, [MUL_TABLE(i,0) + WORD_REG(di)*8] )\
+            AS2(    movzx    edi, ah                                )\
+            AS2(    add        WORD_REG(di), WORD_REG(di)           )\
+            AS2(    pxor    xmm0, [MUL_TABLE(i,1) + WORD_REG(di)*8] )\
+            AS2(    shr        eax, 16                              )\
+            AS2(    movzx    edi, al                                )\
+            AS2(    add        WORD_REG(di), WORD_REG(di)           )\
+            AS2(    pxor    xmm0, [MUL_TABLE(i,2) + WORD_REG(di)*8] )\
+            AS2(    movzx    edi, ah                                )\
+            AS2(    add        WORD_REG(di), WORD_REG(di)           )\
+            AS2(    pxor    xmm0, [MUL_TABLE(i,3) + WORD_REG(di)*8] )\
+
+        SSE2_MUL_32BITS(0)
+        SSE2_MUL_32BITS(1)
+        SSE2_MUL_32BITS(2)
+        SSE2_MUL_32BITS(3)
+
+        AS2(    add     WORD_REG(cx), 16      )
+        AS2(    sub     WORD_REG(dx), 1       )
+        // ATT_NOPREFIX
+        ASJ(    jnz,    1, b                  )
+        INTEL_NOPREFIX
+        AS2(    movdqa  [WORD_REG(si)], xmm0  )
+
+        #ifdef __GNUC__
+                ATT_PREFIX
+                    :
+                    : "c" (data), "d" (len/16), "S" (hashBuffer)
+                    : "memory", "cc", "%edi", "%eax"
+#if (CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+                    , "%xmm0", "%xmm1"
+#endif
+                );
+        #elif defined(CRYPTOPP_GENERATE_X64_MASM)
+            pop rdi
+            pop rsi
+            ret
+            GCM_AuthenticateBlocks_64K_SSE2 ENDP
+        #endif
+
+        return len%16;
+        }
+#endif
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+    }
+
+    return len%16;
+}
+
+void GCM_Base::AuthenticateLastHeaderBlock()
+{
+    if (m_bufferedDataLength > 0)
+    {
+        std::memset(m_buffer+m_bufferedDataLength, 0, HASH_BLOCKSIZE-m_bufferedDataLength);
+        m_bufferedDataLength = 0;
+        GCM_Base::AuthenticateBlocks(m_buffer, HASH_BLOCKSIZE);
+    }
+}
+
+void GCM_Base::AuthenticateLastConfidentialBlock()
+{
+    GCM_Base::AuthenticateLastHeaderBlock();
+    PutBlock<word64, BigEndian, true>(NULLPTR, m_buffer)(m_totalHeaderLength*8)(m_totalMessageLength*8);
+    GCM_Base::AuthenticateBlocks(m_buffer, HASH_BLOCKSIZE);
+}
+
+void GCM_Base::AuthenticateLastFooterBlock(byte *mac, size_t macSize)
+{
+    m_ctr.Seek(0);
+    ReverseHashBufferIfNeeded();
+    m_ctr.ProcessData(mac, HashBuffer(), macSize);
+}
+
+NAMESPACE_END
+
+#endif    // Not CRYPTOPP_GENERATE_X64_MASM
+#endif
diff --git a/runtime/third_party/cryptopp/gcm.h b/runtime/third_party/cryptopp/gcm.h
new file mode 100644
index 0000000..0f4d702
--- /dev/null
+++ b/runtime/third_party/cryptopp/gcm.h
@@ -0,0 +1,139 @@
+// gcm.h - originally written and placed in the public domain by Wei Dai
+
+/// \file gcm.h
+/// \brief GCM block cipher mode of operation
+/// \since Crypto++ 5.6.0
+
+#ifndef CRYPTOPP_GCM_H
+#define CRYPTOPP_GCM_H
+
+#include "authenc.h"
+#include "modes.h"
+
+// Clang 3.3 integrated assembler crash on Linux. Clang 3.4 due to compiler
+// error with .intel_syntax, http://llvm.org/bugs/show_bug.cgi?id=24232
+#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+# define CRYPTOPP_DISABLE_GCM_ASM 1
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \enum GCM_TablesOption
+/// \brief GCM table size options
+enum GCM_TablesOption {
+	/// \brief Use a table with 2K entries
+	GCM_2K_Tables,
+	/// \brief Use a table with 64K entries
+	GCM_64K_Tables};
+
+/// \brief GCM block cipher base implementation
+/// \details Base implementation of the AuthenticatedSymmetricCipher interface
+/// \since Crypto++ 5.6.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE GCM_Base : public AuthenticatedSymmetricCipherBase
+{
+public:
+	// AuthenticatedSymmetricCipher
+	std::string AlgorithmName() const
+		{return GetBlockCipher().AlgorithmName() + std::string("/GCM");}
+	std::string AlgorithmProvider() const
+		{return GetBlockCipher().AlgorithmProvider();}
+	size_t MinKeyLength() const
+		{return GetBlockCipher().MinKeyLength();}
+	size_t MaxKeyLength() const
+		{return GetBlockCipher().MaxKeyLength();}
+	size_t DefaultKeyLength() const
+		{return GetBlockCipher().DefaultKeyLength();}
+	size_t GetValidKeyLength(size_t n) const
+		{return GetBlockCipher().GetValidKeyLength(n);}
+	bool IsValidKeyLength(size_t n) const
+		{return GetBlockCipher().IsValidKeyLength(n);}
+	unsigned int OptimalDataAlignment() const;
+	IV_Requirement IVRequirement() const
+		{return UNIQUE_IV;}
+	unsigned int IVSize() const
+		{return 12;}
+	unsigned int MinIVLength() const
+		{return 1;}
+	unsigned int MaxIVLength() const
+		{return UINT_MAX;}		// (W64LIT(1)<<61)-1 in the standard
+	unsigned int DigestSize() const
+		{return 16;}
+	lword MaxHeaderLength() const
+		{return (W64LIT(1)<<61)-1;}
+	lword MaxMessageLength() const
+		{return ((W64LIT(1)<<39)-256)/8;}
+
+protected:
+	// AuthenticatedSymmetricCipherBase
+	bool AuthenticationIsOnPlaintext() const
+		{return false;}
+	unsigned int AuthenticationBlockSize() const
+		{return HASH_BLOCKSIZE;}
+	void SetKeyWithoutResync(const byte *userKey, size_t keylength, const NameValuePairs &params);
+	void Resync(const byte *iv, size_t len);
+	size_t AuthenticateBlocks(const byte *data, size_t len);
+	void AuthenticateLastHeaderBlock();
+	void AuthenticateLastConfidentialBlock();
+	void AuthenticateLastFooterBlock(byte *mac, size_t macSize);
+	SymmetricCipher & AccessSymmetricCipher() {return m_ctr;}
+
+	virtual BlockCipher & AccessBlockCipher() =0;
+	virtual GCM_TablesOption GetTablesOption() const =0;
+
+	const BlockCipher & GetBlockCipher() const {return const_cast<GCM_Base *>(this)->AccessBlockCipher();}
+	byte *HashBuffer() {return m_buffer+REQUIRED_BLOCKSIZE;}
+	byte *HashKey() {return m_buffer+2*REQUIRED_BLOCKSIZE;}
+	byte *MulTable() {return m_buffer+3*REQUIRED_BLOCKSIZE;}
+	inline void ReverseHashBufferIfNeeded();
+
+	class CRYPTOPP_DLL GCTR : public CTR_Mode_ExternalCipher::Encryption
+	{
+	protected:
+		void IncrementCounterBy256();
+	};
+
+	GCTR m_ctr;
+	static word16 s_reductionTable[256];
+	static volatile bool s_reductionTableInitialized;
+	enum {REQUIRED_BLOCKSIZE = 16, HASH_BLOCKSIZE = 16};
+};
+
+/// \brief GCM block cipher final implementation
+/// \tparam T_BlockCipher block cipher
+/// \tparam T_TablesOption table size, either \p GCM_2K_Tables or \p GCM_64K_Tables
+/// \tparam T_IsEncryption direction in which to operate the cipher
+/// \since Crypto++ 5.6.0
+template <class T_BlockCipher, GCM_TablesOption T_TablesOption, bool T_IsEncryption>
+class GCM_Final : public GCM_Base
+{
+public:
+	static std::string StaticAlgorithmName()
+		{return T_BlockCipher::StaticAlgorithmName() + std::string("/GCM");}
+	bool IsForwardTransformation() const
+		{return T_IsEncryption;}
+
+private:
+	GCM_TablesOption GetTablesOption() const {return T_TablesOption;}
+	BlockCipher & AccessBlockCipher() {return m_cipher;}
+	typename T_BlockCipher::Encryption m_cipher;
+};
+
+/// \brief GCM block cipher mode of operation
+/// \tparam T_BlockCipher block cipher
+/// \tparam T_TablesOption table size, either \p GCM_2K_Tables or \p GCM_64K_Tables
+/// \details \p GCM provides the \p Encryption and \p Decryption typedef. See GCM_Base
+///   and GCM_Final for the AuthenticatedSymmetricCipher implementation.
+/// \sa <a href="http://www.cryptopp.com/wiki/GCM_Mode">GCM Mode</a> and
+///   <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+/// \since Crypto++ 5.6.0
+template <class T_BlockCipher, GCM_TablesOption T_TablesOption=GCM_2K_Tables>
+struct GCM : public AuthenticatedSymmetricCipherDocumentation
+{
+	typedef GCM_Final<T_BlockCipher, T_TablesOption, true> Encryption;
+	typedef GCM_Final<T_BlockCipher, T_TablesOption, false> Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/gcm_simd.cpp b/runtime/third_party/cryptopp/gcm_simd.cpp
new file mode 100644
index 0000000..bdff423
--- /dev/null
+++ b/runtime/third_party/cryptopp/gcm_simd.cpp
@@ -0,0 +1,681 @@
+// gcm_simd.cpp - written and placed in the public domain by
+//                Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//                Original x86 CLMUL by Wei Dai. ARM and POWER8
+//                PMULL and VMULL by JW, UB and MR.
+//
+//    This source file uses intrinsics to gain access to SSE4.2 and
+//    ARMv8a CRC-32 and CRC-32C instructions. A separate source file
+//    is needed because additional CXXFLAGS are required to enable
+//    the appropriate instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+#include "misc.h"
+
+#if defined(CRYPTOPP_DISABLE_GCM_ASM)
+# undef CRYPTOPP_X86_ASM_AVAILABLE
+# undef CRYPTOPP_X32_ASM_AVAILABLE
+# undef CRYPTOPP_X64_ASM_AVAILABLE
+# undef CRYPTOPP_SSE2_ASM_AVAILABLE
+#endif
+
+#if (CRYPTOPP_SSE2_INTRIN_AVAILABLE)
+# include <emmintrin.h>
+# include <xmmintrin.h>
+#endif
+
+#if (CRYPTOPP_CLMUL_AVAILABLE)
+# include <tmmintrin.h>
+# include <wmmintrin.h>
+#endif
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include <stdint.h>
+# include <arm_neon.h>
+#endif
+
+#if defined(CRYPTOPP_ARM_PMULL_AVAILABLE)
+# include "arm_simd.h"
+#endif
+
+#if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+# include "ppc_simd.h"
+#endif
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#ifndef EXCEPTION_EXECUTE_HANDLER
+# define EXCEPTION_EXECUTE_HANDLER 1
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char GCM_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ************************* Feature Probes ************************* //
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+
+    static jmp_buf s_jmpSIGILL;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpSIGILL, 1);
+    }
+}
+#endif  // Not CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
+
+#if (CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8)
+bool CPU_ProbePMULL()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif (CRYPTOPP_ARM_PMULL_AVAILABLE)
+# if defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+    volatile bool result = true;
+    __try
+    {
+        // Linaro is missing a lot of pmull gear. Also see http://github.com/weidai11/cryptopp/issues/233.
+        const uint64_t wa1[]={0,0x9090909090909090}, wb1[]={0,0xb0b0b0b0b0b0b0b0};
+        const uint64x2_t a1=vld1q_u64(wa1), b1=vld1q_u64(wb1);
+
+        const uint8_t wa2[]={0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,
+                             0xa0,0xa0,0xa0,0xa0,0xa0,0xa0,0xa0,0xa0},
+                      wb2[]={0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,
+                             0xe0,0xe0,0xe0,0xe0,0xe0,0xe0,0xe0,0xe0};
+        const uint8x16_t a2=vld1q_u8(wa2), b2=vld1q_u8(wb2);
+
+        const uint64x2_t r1 = PMULL_00(a1, b1);
+        const uint64x2_t r2 = PMULL_11(vreinterpretq_u64_u8(a2),
+                                       vreinterpretq_u64_u8(b2));
+
+        result = !!(vgetq_lane_u64(r1,0) == 0x5300530053005300 &&
+                    vgetq_lane_u64(r1,1) == 0x5300530053005300 &&
+                    vgetq_lane_u64(r2,0) == 0x6c006c006c006c00 &&
+                    vgetq_lane_u64(r2,1) == 0x6c006c006c006c00);
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        return false;
+    }
+    return result;
+# else
+
+    // longjmp and clobber warnings. Volatile is required.
+    volatile bool result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // Linaro is missing a lot of pmull gear. Also see http://github.com/weidai11/cryptopp/issues/233.
+        const uint64_t wa1[]={0,0x9090909090909090}, wb1[]={0,0xb0b0b0b0b0b0b0b0};
+        const uint64x2_t a1=vld1q_u64(wa1), b1=vld1q_u64(wb1);
+
+        const uint8_t wa2[]={0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,
+                             0xa0,0xa0,0xa0,0xa0,0xa0,0xa0,0xa0,0xa0},
+                      wb2[]={0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,
+                             0xe0,0xe0,0xe0,0xe0,0xe0,0xe0,0xe0,0xe0};
+        const uint8x16_t a2=vld1q_u8(wa2), b2=vld1q_u8(wb2);
+
+        const uint64x2_t r1 = PMULL_00(a1, b1);
+        const uint64x2_t r2 = PMULL_11(vreinterpretq_u64_u8(a2),
+                                       vreinterpretq_u64_u8(b2));
+
+        result = !!(vgetq_lane_u64(r1,0) == 0x5300530053005300 &&
+                    vgetq_lane_u64(r1,1) == 0x5300530053005300 &&
+                    vgetq_lane_u64(r2,0) == 0x6c006c006c006c00 &&
+                    vgetq_lane_u64(r2,1) == 0x6c006c006c006c00);
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_ARM_PMULL_AVAILABLE
+}
+#endif  // ARM32 or ARM64
+
+// *************************** ARM NEON *************************** //
+
+#if CRYPTOPP_ARM_NEON_AVAILABLE
+void GCM_Xor16_NEON(byte *a, const byte *b, const byte *c)
+{
+	vst1q_u8(a, veorq_u8(vld1q_u8(b), vld1q_u8(c)));
+}
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+#if CRYPTOPP_ARM_PMULL_AVAILABLE
+
+// Swaps high and low 64-bit words
+inline uint64x2_t SwapWords(const uint64x2_t& data)
+{
+    return (uint64x2_t)vcombine_u64(
+        vget_high_u64(data), vget_low_u64(data));
+}
+
+uint64x2_t GCM_Reduce_PMULL(uint64x2_t c0, uint64x2_t c1, uint64x2_t c2, const uint64x2_t &r)
+{
+    c1 = veorq_u64(c1, VEXT_U8<8>(vdupq_n_u64(0), c0));
+    c1 = veorq_u64(c1, PMULL_01(c0, r));
+    c0 = VEXT_U8<8>(c0, vdupq_n_u64(0));
+    c0 = vshlq_n_u64(veorq_u64(c0, c1), 1);
+    c0 = PMULL_00(c0, r);
+    c2 = veorq_u64(c2, c0);
+    c2 = veorq_u64(c2, VEXT_U8<8>(c1, vdupq_n_u64(0)));
+    c1 = vshrq_n_u64(vcombine_u64(vget_low_u64(c1), vget_low_u64(c2)), 63);
+    c2 = vshlq_n_u64(c2, 1);
+
+    return veorq_u64(c2, c1);
+}
+
+uint64x2_t GCM_Multiply_PMULL(const uint64x2_t &x, const uint64x2_t &h, const uint64x2_t &r)
+{
+    const uint64x2_t c0 = PMULL_00(x, h);
+    const uint64x2_t c1 = veorq_u64(PMULL_10(x, h), PMULL_01(x, h));
+    const uint64x2_t c2 = PMULL_11(x, h);
+
+    return GCM_Reduce_PMULL(c0, c1, c2, r);
+}
+
+void GCM_SetKeyWithoutResync_PMULL(const byte *hashKey, byte *mulTable, unsigned int tableSize)
+{
+    const uint64x2_t r = {0xe100000000000000ull, 0xc200000000000000ull};
+    const uint64x2_t t = vreinterpretq_u64_u8(vrev64q_u8(vld1q_u8(hashKey)));
+    const uint64x2_t h0 = vextq_u64(t, t, 1);
+
+    uint64x2_t h = h0;
+    unsigned int i;
+    for (i=0; i<tableSize-32; i+=32)
+    {
+        const uint64x2_t h1 = GCM_Multiply_PMULL(h, h0, r);
+        vst1_u64(UINT64_CAST(mulTable+i), vget_low_u64(h));
+        vst1q_u64(UINT64_CAST(mulTable+i+16), h1);
+        vst1q_u64(UINT64_CAST(mulTable+i+8), h);
+        vst1_u64(UINT64_CAST(mulTable+i+8), vget_low_u64(h1));
+        h = GCM_Multiply_PMULL(h1, h0, r);
+    }
+
+    const uint64x2_t h1 = GCM_Multiply_PMULL(h, h0, r);
+    vst1_u64(UINT64_CAST(mulTable+i), vget_low_u64(h));
+    vst1q_u64(UINT64_CAST(mulTable+i+16), h1);
+    vst1q_u64(UINT64_CAST(mulTable+i+8), h);
+    vst1_u64(UINT64_CAST(mulTable+i+8), vget_low_u64(h1));
+}
+
+size_t GCM_AuthenticateBlocks_PMULL(const byte *data, size_t len, const byte *mtable, byte *hbuffer)
+{
+    const uint64x2_t r = {0xe100000000000000ull, 0xc200000000000000ull};
+    uint64x2_t x = vreinterpretq_u64_u8(vld1q_u8(hbuffer));
+
+    while (len >= 16)
+    {
+        size_t i=0, s = UnsignedMin(len/16U, 8U);
+        uint64x2_t d1, d2 = vreinterpretq_u64_u8(vrev64q_u8(vld1q_u8(data+(s-1)*16U)));
+        uint64x2_t c0 = vdupq_n_u64(0);
+        uint64x2_t c1 = vdupq_n_u64(0);
+        uint64x2_t c2 = vdupq_n_u64(0);
+
+        while (true)
+        {
+            const uint64x2_t h0 = vld1q_u64(CONST_UINT64_CAST(mtable+(i+0)*16));
+            const uint64x2_t h1 = vld1q_u64(CONST_UINT64_CAST(mtable+(i+1)*16));
+            const uint64x2_t h2 = veorq_u64(h0, h1);
+
+            if (++i == s)
+            {
+                const uint64x2_t t1 = vreinterpretq_u64_u8(vrev64q_u8(vld1q_u8(data)));
+                d1 = veorq_u64(vextq_u64(t1, t1, 1), x);
+                c0 = veorq_u64(c0, PMULL_00(d1, h0));
+                c2 = veorq_u64(c2, PMULL_10(d1, h1));
+                d1 = veorq_u64(d1, SwapWords(d1));
+                c1 = veorq_u64(c1, PMULL_00(d1, h2));
+
+                break;
+            }
+
+            d1 = vreinterpretq_u64_u8(vrev64q_u8(vld1q_u8(data+(s-i)*16-8)));
+            c0 = veorq_u64(c0, PMULL_10(d2, h0));
+            c2 = veorq_u64(c2, PMULL_10(d1, h1));
+            d2 = veorq_u64(d2, d1);
+            c1 = veorq_u64(c1, PMULL_10(d2, h2));
+
+            if (++i == s)
+            {
+                const uint64x2_t t2 = vreinterpretq_u64_u8(vrev64q_u8(vld1q_u8(data)));
+                d1 = veorq_u64(vextq_u64(t2, t2, 1), x);
+                c0 = veorq_u64(c0, PMULL_01(d1, h0));
+                c2 = veorq_u64(c2, PMULL_11(d1, h1));
+                d1 = veorq_u64(d1, SwapWords(d1));
+                c1 = veorq_u64(c1, PMULL_01(d1, h2));
+
+                break;
+            }
+
+            const uint64x2_t t3 = vreinterpretq_u64_u8(vrev64q_u8(vld1q_u8(data+(s-i)*16-8)));
+            d2 = vextq_u64(t3, t3, 1);
+            c0 = veorq_u64(c0, PMULL_01(d1, h0));
+            c2 = veorq_u64(c2, PMULL_01(d2, h1));
+            d1 = veorq_u64(d1, d2);
+            c1 = veorq_u64(c1, PMULL_01(d1, h2));
+        }
+        data += s*16;
+        len -= s*16;
+
+        c1 = veorq_u64(veorq_u64(c1, c0), c2);
+        x = GCM_Reduce_PMULL(c0, c1, c2, r);
+    }
+
+    vst1q_u64(UINT64_CAST(hbuffer), x);
+    return len;
+}
+
+void GCM_ReverseHashBufferIfNeeded_PMULL(byte *hashBuffer)
+{
+    if (GetNativeByteOrder() != BIG_ENDIAN_ORDER)
+    {
+        const uint8x16_t x = vrev64q_u8(vld1q_u8(hashBuffer));
+        vst1q_u8(hashBuffer, vextq_u8(x, x, 8));
+    }
+}
+#endif  // CRYPTOPP_ARM_PMULL_AVAILABLE
+
+// ***************************** SSE ***************************** //
+
+#if CRYPTOPP_SSE2_INTRIN_AVAILABLE || CRYPTOPP_SSE2_ASM_AVAILABLE
+// SunCC 5.10-5.11 compiler crash. Move GCM_Xor16_SSE2 out-of-line, and place in
+// a source file with a SSE architecture switch. Also see GH #226 and GH #284.
+void GCM_Xor16_SSE2(byte *a, const byte *b, const byte *c)
+{
+# if CRYPTOPP_SSE2_ASM_AVAILABLE && defined(__GNUC__)
+    asm ("movdqa %1, %%xmm0; pxor %2, %%xmm0; movdqa %%xmm0, %0;"
+         : "=m" (a[0]) : "m"(b[0]), "m"(c[0]));
+# else  // CRYPTOPP_SSE2_INTRIN_AVAILABLE
+    _mm_store_si128(M128_CAST(a), _mm_xor_si128(
+        _mm_load_si128(CONST_M128_CAST(b)),
+        _mm_load_si128(CONST_M128_CAST(c))));
+# endif
+}
+#endif  // CRYPTOPP_SSE2_ASM_AVAILABLE
+
+#if CRYPTOPP_CLMUL_AVAILABLE
+
+#if 0
+// preserved for testing
+void gcm_gf_mult(const unsigned char *a, const unsigned char *b, unsigned char *c)
+{
+    word64 Z0=0, Z1=0, V0, V1;
+
+    typedef BlockGetAndPut<word64, BigEndian> Block;
+    Block::Get(a)(V0)(V1);
+
+    for (int i=0; i<16; i++)
+    {
+        for (int j=0x80; j!=0; j>>=1)
+        {
+            int x = b[i] & j;
+            Z0 ^= x ? V0 : 0;
+            Z1 ^= x ? V1 : 0;
+            x = (int)V1 & 1;
+            V1 = (V1>>1) | (V0<<63);
+            V0 = (V0>>1) ^ (x ? W64LIT(0xe1) << 56 : 0);
+        }
+    }
+    Block::Put(NULLPTR, c)(Z0)(Z1);
+}
+
+__m128i _mm_clmulepi64_si128(const __m128i &a, const __m128i &b, int i)
+{
+    word64 A[1] = {ByteReverse(((word64*)&a)[i&1])};
+    word64 B[1] = {ByteReverse(((word64*)&b)[i>>4])};
+
+    PolynomialMod2 pa((byte *)A, 8);
+    PolynomialMod2 pb((byte *)B, 8);
+    PolynomialMod2 c = pa*pb;
+
+    __m128i output;
+    for (int i=0; i<16; i++)
+        ((byte *)&output)[i] = c.GetByte(i);
+    return output;
+}
+#endif  // Testing
+
+// Swaps high and low 64-bit words
+inline __m128i SwapWords(const __m128i& val)
+{
+    return _mm_shuffle_epi32(val, _MM_SHUFFLE(1, 0, 3, 2));
+}
+
+// SunCC 5.11-5.15 compiler crash. Make the function inline
+// and parameters non-const. Also see GH #188 and GH #224.
+inline __m128i GCM_Reduce_CLMUL(__m128i c0, __m128i c1, __m128i c2, const __m128i& r)
+{
+    /*
+    The polynomial to be reduced is c0 * x^128 + c1 * x^64 + c2. c0t below refers to the most
+    significant half of c0 as a polynomial, which, due to GCM's bit reflection, are in the
+    rightmost bit positions, and the lowest byte addresses.
+
+    c1 ^= c0t * 0xc200000000000000
+    c2t ^= c0t
+    t = shift (c1t ^ c0b) left 1 bit
+    c2 ^= t * 0xe100000000000000
+    c2t ^= c1b
+    shift c2 left 1 bit and xor in lowest bit of c1t
+    */
+    c1 = _mm_xor_si128(c1, _mm_slli_si128(c0, 8));
+    c1 = _mm_xor_si128(c1, _mm_clmulepi64_si128(c0, r, 0x10));
+    c0 = _mm_xor_si128(c1, _mm_srli_si128(c0, 8));
+    c0 = _mm_slli_epi64(c0, 1);
+    c0 = _mm_clmulepi64_si128(c0, r, 0);
+    c2 = _mm_xor_si128(c2, c0);
+    c2 = _mm_xor_si128(c2, _mm_srli_si128(c1, 8));
+    c1 = _mm_unpacklo_epi64(c1, c2);
+    c1 = _mm_srli_epi64(c1, 63);
+    c2 = _mm_slli_epi64(c2, 1);
+    return _mm_xor_si128(c2, c1);
+}
+
+// SunCC 5.13-5.14 compiler crash. Don't make the function inline.
+// This is in contrast to GCM_Reduce_CLMUL, which must be inline.
+__m128i GCM_Multiply_CLMUL(const __m128i &x, const __m128i &h, const __m128i &r)
+{
+    const __m128i c0 = _mm_clmulepi64_si128(x,h,0);
+    const __m128i c1 = _mm_xor_si128(_mm_clmulepi64_si128(x,h,1), _mm_clmulepi64_si128(x,h,0x10));
+    const __m128i c2 = _mm_clmulepi64_si128(x,h,0x11);
+
+    return GCM_Reduce_CLMUL(c0, c1, c2, r);
+}
+
+void GCM_SetKeyWithoutResync_CLMUL(const byte *hashKey, byte *mulTable, unsigned int tableSize)
+{
+    const __m128i r = _mm_set_epi32(0xc2000000, 0x00000000, 0xe1000000, 0x00000000);
+    const __m128i m = _mm_set_epi32(0x00010203, 0x04050607, 0x08090a0b, 0x0c0d0e0f);
+    __m128i h0 = _mm_shuffle_epi8(_mm_load_si128(CONST_M128_CAST(hashKey)), m), h = h0;
+
+    unsigned int i;
+    for (i=0; i<tableSize-32; i+=32)
+    {
+        const __m128i h1 = GCM_Multiply_CLMUL(h, h0, r);
+        _mm_storel_epi64(M128_CAST(mulTable+i), h);
+        _mm_storeu_si128(M128_CAST(mulTable+i+16), h1);
+        _mm_storeu_si128(M128_CAST(mulTable+i+8), h);
+        _mm_storel_epi64(M128_CAST(mulTable+i+8), h1);
+        h = GCM_Multiply_CLMUL(h1, h0, r);
+    }
+
+    const __m128i h1 = GCM_Multiply_CLMUL(h, h0, r);
+    _mm_storel_epi64(M128_CAST(mulTable+i), h);
+    _mm_storeu_si128(M128_CAST(mulTable+i+16), h1);
+    _mm_storeu_si128(M128_CAST(mulTable+i+8), h);
+    _mm_storel_epi64(M128_CAST(mulTable+i+8), h1);
+}
+
+size_t GCM_AuthenticateBlocks_CLMUL(const byte *data, size_t len, const byte *mtable, byte *hbuffer)
+{
+    const __m128i r = _mm_set_epi32(0xc2000000, 0x00000000, 0xe1000000, 0x00000000);
+    const __m128i m1 = _mm_set_epi32(0x00010203, 0x04050607, 0x08090a0b, 0x0c0d0e0f);
+    const __m128i m2 = _mm_set_epi32(0x08090a0b, 0x0c0d0e0f, 0x00010203, 0x04050607);
+    __m128i x = _mm_load_si128(M128_CAST(hbuffer));
+
+    while (len >= 16)
+    {
+        size_t i=0, s = UnsignedMin(len/16, 8U);
+        __m128i d1 = _mm_loadu_si128(CONST_M128_CAST(data+(s-1)*16));
+        __m128i d2 = _mm_shuffle_epi8(d1, m2);
+        __m128i c0 = _mm_setzero_si128();
+        __m128i c1 = _mm_setzero_si128();
+        __m128i c2 = _mm_setzero_si128();
+
+        while (true)
+        {
+            const __m128i h0 = _mm_load_si128(CONST_M128_CAST(mtable+(i+0)*16));
+            const __m128i h1 = _mm_load_si128(CONST_M128_CAST(mtable+(i+1)*16));
+            const __m128i h2 = _mm_xor_si128(h0, h1);
+
+            if (++i == s)
+            {
+                d1 = _mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(data)), m1);
+                d1 = _mm_xor_si128(d1, x);
+                c0 = _mm_xor_si128(c0, _mm_clmulepi64_si128(d1, h0, 0));
+                c2 = _mm_xor_si128(c2, _mm_clmulepi64_si128(d1, h1, 1));
+                d1 = _mm_xor_si128(d1, SwapWords(d1));
+                c1 = _mm_xor_si128(c1, _mm_clmulepi64_si128(d1, h2, 0));
+                break;
+            }
+
+            d1 = _mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(data+(s-i)*16-8)), m2);
+            c0 = _mm_xor_si128(c0, _mm_clmulepi64_si128(d2, h0, 1));
+            c2 = _mm_xor_si128(c2, _mm_clmulepi64_si128(d1, h1, 1));
+            d2 = _mm_xor_si128(d2, d1);
+            c1 = _mm_xor_si128(c1, _mm_clmulepi64_si128(d2, h2, 1));
+
+            if (++i == s)
+            {
+                d1 = _mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(data)), m1);
+                d1 = _mm_xor_si128(d1, x);
+                c0 = _mm_xor_si128(c0, _mm_clmulepi64_si128(d1, h0, 0x10));
+                c2 = _mm_xor_si128(c2, _mm_clmulepi64_si128(d1, h1, 0x11));
+                d1 = _mm_xor_si128(d1, SwapWords(d1));
+                c1 = _mm_xor_si128(c1, _mm_clmulepi64_si128(d1, h2, 0x10));
+                break;
+            }
+
+            d2 = _mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(data+(s-i)*16-8)), m1);
+            c0 = _mm_xor_si128(c0, _mm_clmulepi64_si128(d1, h0, 0x10));
+            c2 = _mm_xor_si128(c2, _mm_clmulepi64_si128(d2, h1, 0x10));
+            d1 = _mm_xor_si128(d1, d2);
+            c1 = _mm_xor_si128(c1, _mm_clmulepi64_si128(d1, h2, 0x10));
+        }
+        data += s*16;
+        len -= s*16;
+
+        c1 = _mm_xor_si128(_mm_xor_si128(c1, c0), c2);
+        x = GCM_Reduce_CLMUL(c0, c1, c2, r);
+    }
+
+    _mm_store_si128(M128_CAST(hbuffer), x);
+    return len;
+}
+
+void GCM_ReverseHashBufferIfNeeded_CLMUL(byte *hashBuffer)
+{
+    // SSSE3 instruction, but only used with CLMUL
+    const __m128i mask = _mm_set_epi32(0x00010203, 0x04050607, 0x08090a0b, 0x0c0d0e0f);
+    _mm_storeu_si128(M128_CAST(hashBuffer), _mm_shuffle_epi8(
+        _mm_loadu_si128(CONST_M128_CAST(hashBuffer)), mask));
+}
+#endif  // CRYPTOPP_CLMUL_AVAILABLE
+
+// ***************************** POWER8 ***************************** //
+
+#if CRYPTOPP_POWER8_AVAILABLE
+void GCM_Xor16_POWER8(byte *a, const byte *b, const byte *c)
+{
+    VecStore(VecXor(VecLoad(b), VecLoad(c)), a);
+}
+#endif  // CRYPTOPP_POWER8_AVAILABLE
+
+#if CRYPTOPP_POWER8_VMULL_AVAILABLE
+
+uint64x2_p GCM_Reduce_VMULL(uint64x2_p c0, uint64x2_p c1, uint64x2_p c2, uint64x2_p r)
+{
+    const uint64x2_p m1 = {1,1}, m63 = {63,63};
+
+    c1 = VecXor(c1, VecShiftRightOctet<8>(c0));
+    c1 = VecXor(c1, VecIntelMultiply10(c0, r));
+    c0 = VecXor(c1, VecShiftLeftOctet<8>(c0));
+    c0 = VecIntelMultiply00(vec_sl(c0, m1), r);
+    c2 = VecXor(c2, c0);
+    c2 = VecXor(c2, VecShiftLeftOctet<8>(c1));
+    c1 = vec_sr(vec_mergeh(c1, c2), m63);
+    c2 = vec_sl(c2, m1);
+
+    return VecXor(c2, c1);
+}
+
+inline uint64x2_p GCM_Multiply_VMULL(uint64x2_p x, uint64x2_p h, uint64x2_p r)
+{
+    const uint64x2_p c0 = VecIntelMultiply00(x, h);
+    const uint64x2_p c1 = VecXor(VecIntelMultiply01(x, h), VecIntelMultiply10(x, h));
+    const uint64x2_p c2 = VecIntelMultiply11(x, h);
+
+    return GCM_Reduce_VMULL(c0, c1, c2, r);
+}
+
+inline uint64x2_p LoadHashKey(const byte *hashKey)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint64x2_p key = (uint64x2_p)VecLoad(hashKey);
+    const uint8x16_p mask = {8,9,10,11, 12,13,14,15, 0,1,2,3, 4,5,6,7};
+    return VecPermute(key, key, mask);
+#else
+    const uint64x2_p key = (uint64x2_p)VecLoad(hashKey);
+    const uint8x16_p mask = {15,14,13,12, 11,10,9,8, 7,6,5,4, 3,2,1,0};
+    return VecPermute(key, key, mask);
+#endif
+}
+
+void GCM_SetKeyWithoutResync_VMULL(const byte *hashKey, byte *mulTable, unsigned int tableSize)
+{
+    const uint64x2_p r = {0xe100000000000000ull, 0xc200000000000000ull};
+    uint64x2_p h = LoadHashKey(hashKey), h0 = h;
+
+    unsigned int i;
+    uint64_t temp[2];
+
+    for (i=0; i<tableSize-32; i+=32)
+    {
+        const uint64x2_p h1 = GCM_Multiply_VMULL(h, h0, r);
+        VecStore(h, (byte*)temp);
+        std::memcpy(mulTable+i, temp+0, 8);
+        VecStore(h1, mulTable+i+16);
+        VecStore(h, mulTable+i+8);
+        VecStore(h1, (byte*)temp);
+        std::memcpy(mulTable+i+8, temp+0, 8);
+        h = GCM_Multiply_VMULL(h1, h0, r);
+    }
+
+    const uint64x2_p h1 = GCM_Multiply_VMULL(h, h0, r);
+    VecStore(h, (byte*)temp);
+    std::memcpy(mulTable+i, temp+0, 8);
+    VecStore(h1, mulTable+i+16);
+    VecStore(h, mulTable+i+8);
+    VecStore(h1, (byte*)temp);
+    std::memcpy(mulTable+i+8, temp+0, 8);
+}
+
+// Swaps high and low 64-bit words
+template <class T>
+inline T SwapWords(const T& data)
+{
+    return (T)VecRotateLeftOctet<8>(data);
+}
+
+inline uint64x2_p LoadBuffer1(const byte *dataBuffer)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    return (uint64x2_p)VecLoad(dataBuffer);
+#else
+    const uint64x2_p data = (uint64x2_p)VecLoad(dataBuffer);
+    const uint8x16_p mask = {7,6,5,4, 3,2,1,0, 15,14,13,12, 11,10,9,8};
+    return VecPermute(data, data, mask);
+#endif
+}
+
+inline uint64x2_p LoadBuffer2(const byte *dataBuffer)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    return (uint64x2_p)SwapWords(VecLoadBE(dataBuffer));
+#else
+    return (uint64x2_p)VecLoadBE(dataBuffer);
+#endif
+}
+
+size_t GCM_AuthenticateBlocks_VMULL(const byte *data, size_t len, const byte *mtable, byte *hbuffer)
+{
+    const uint64x2_p r = {0xe100000000000000ull, 0xc200000000000000ull};
+    uint64x2_p x = (uint64x2_p)VecLoad(hbuffer);
+
+    while (len >= 16)
+    {
+        size_t i=0, s = UnsignedMin(len/16, 8U);
+        uint64x2_p d1, d2 = LoadBuffer1(data+(s-1)*16);
+        uint64x2_p c0 = {0}, c1 = {0}, c2 = {0};
+
+        while (true)
+        {
+            const uint64x2_p h0 = (uint64x2_p)VecLoad(mtable+(i+0)*16);
+            const uint64x2_p h1 = (uint64x2_p)VecLoad(mtable+(i+1)*16);
+            const uint64x2_p h2 = (uint64x2_p)VecXor(h0, h1);
+
+            if (++i == s)
+            {
+                d1 = LoadBuffer2(data);
+                d1 = VecXor(d1, x);
+                c0 = VecXor(c0, VecIntelMultiply00(d1, h0));
+                c2 = VecXor(c2, VecIntelMultiply01(d1, h1));
+                d1 = VecXor(d1, SwapWords(d1));
+                c1 = VecXor(c1, VecIntelMultiply00(d1, h2));
+                break;
+            }
+
+            d1 = LoadBuffer1(data+(s-i)*16-8);
+            c0 = VecXor(c0, VecIntelMultiply01(d2, h0));
+            c2 = VecXor(c2, VecIntelMultiply01(d1, h1));
+            d2 = VecXor(d2, d1);
+            c1 = VecXor(c1, VecIntelMultiply01(d2, h2));
+
+            if (++i == s)
+            {
+                d1 = LoadBuffer2(data);
+                d1 = VecXor(d1, x);
+                c0 = VecXor(c0, VecIntelMultiply10(d1, h0));
+                c2 = VecXor(c2, VecIntelMultiply11(d1, h1));
+                d1 = VecXor(d1, SwapWords(d1));
+                c1 = VecXor(c1, VecIntelMultiply10(d1, h2));
+                break;
+            }
+
+            d2 = LoadBuffer2(data+(s-i)*16-8);
+            c0 = VecXor(c0, VecIntelMultiply10(d1, h0));
+            c2 = VecXor(c2, VecIntelMultiply10(d2, h1));
+            d1 = VecXor(d1, d2);
+            c1 = VecXor(c1, VecIntelMultiply10(d1, h2));
+        }
+        data += s*16;
+        len -= s*16;
+
+        c1 = VecXor(VecXor(c1, c0), c2);
+        x = GCM_Reduce_VMULL(c0, c1, c2, r);
+    }
+
+    VecStore(x, hbuffer);
+    return len;
+}
+
+void GCM_ReverseHashBufferIfNeeded_VMULL(byte *hashBuffer)
+{
+    const uint64x2_p mask = {0x08090a0b0c0d0e0full, 0x0001020304050607ull};
+    VecStore(VecPermute(VecLoad(hashBuffer), mask), hashBuffer);
+}
+#endif  // CRYPTOPP_POWER8_VMULL_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/gf256.cpp b/runtime/third_party/cryptopp/gf256.cpp
new file mode 100644
index 0000000..a7b90eb
--- /dev/null
+++ b/runtime/third_party/cryptopp/gf256.cpp
@@ -0,0 +1,34 @@
+// gf256.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "gf256.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+GF256::Element GF256::Multiply(Element a, Element b) const
+{
+	word result = 0, t = b;
+
+	for (unsigned int i=0; i<8; i++)
+	{
+		result <<= 1;
+		if (result & 0x100)
+			result ^= m_modulus;
+
+		t <<= 1;
+		if (t & 0x100)
+			result ^= a;
+	}
+
+	return (GF256::Element) result;
+}
+
+GF256::Element GF256::MultiplicativeInverse(Element a) const
+{
+	Element result = a;
+	for (int i=1; i<7; i++)
+		result = Multiply(Square(result), a);
+	return Square(result);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/gf256.h b/runtime/third_party/cryptopp/gf256.h
new file mode 100644
index 0000000..3c5c3f6
--- /dev/null
+++ b/runtime/third_party/cryptopp/gf256.h
@@ -0,0 +1,72 @@
+// gf256.h - originally written and placed in the public domain by Wei Dai
+
+/// \file gf256.h
+/// \brief Classes and functions for schemes over GF(256)
+
+#ifndef CRYPTOPP_GF256_H
+#define CRYPTOPP_GF256_H
+
+#include "cryptlib.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief GF(256) with polynomial basis
+class GF256
+{
+public:
+	typedef byte Element;
+	typedef int RandomizationParameter;
+
+	GF256(byte modulus) : m_modulus(modulus) {}
+
+	Element RandomElement(RandomNumberGenerator &rng, int ignored = 0) const
+		{CRYPTOPP_UNUSED(ignored); return rng.GenerateByte();}
+
+	bool Equal(Element a, Element b) const
+		{return a==b;}
+
+	Element Zero() const
+		{return 0;}
+
+	Element Add(Element a, Element b) const
+		{return a^b;}
+
+	Element& Accumulate(Element &a, Element b) const
+		{return a^=b;}
+
+	Element Inverse(Element a) const
+		{return a;}
+
+	Element Subtract(Element a, Element b) const
+		{return a^b;}
+
+	Element& Reduce(Element &a, Element b) const
+		{return a^=b;}
+
+	Element Double(Element a) const
+		{CRYPTOPP_UNUSED(a); return 0;}
+
+	Element One() const
+		{return 1;}
+
+	Element Multiply(Element a, Element b) const;
+
+	Element Square(Element a) const
+		{return Multiply(a, a);}
+
+	bool IsUnit(Element a) const
+		{return a != 0;}
+
+	Element MultiplicativeInverse(Element a) const;
+
+	Element Divide(Element a, Element b) const
+		{return Multiply(a, MultiplicativeInverse(b));}
+
+private:
+	word m_modulus;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/gf2_32.cpp b/runtime/third_party/cryptopp/gf2_32.cpp
new file mode 100644
index 0000000..9d80124
--- /dev/null
+++ b/runtime/third_party/cryptopp/gf2_32.cpp
@@ -0,0 +1,99 @@
+// gf2_32.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "misc.h"
+#include "gf2_32.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+GF2_32::Element GF2_32::Multiply(Element a, Element b) const
+{
+	word32 table[4];
+	table[0] = 0;
+	table[1] = m_modulus;
+	if (a & 0x80000000)
+	{
+		table[2] = m_modulus ^ (a<<1);
+		table[3] = a<<1;
+	}
+	else
+	{
+		table[2] = a<<1;
+		table[3] = m_modulus ^ (a<<1);
+	}
+
+#if CRYPTOPP_FAST_ROTATE(32)
+	b = rotrConstant<30>(b);
+	word32 result = table[b&2];
+
+	for (int i=29; i>=0; --i)
+	{
+		b = rotlConstant<1>(b);
+		result = (result<<1) ^ table[(b&2) + (result>>31)];
+	}
+
+	return (b&1) ? result ^ a : result;
+#else
+	word32 result = table[(b>>30) & 2];
+
+	for (int i=29; i>=0; --i)
+		result = (result<<1) ^ table[((b>>i)&2) + (result>>31)];
+
+	return (b&1) ? result ^ a : result;
+#endif
+}
+
+GF2_32::Element GF2_32::MultiplicativeInverse(Element a) const
+{
+	if (a <= 1)		// 1 is a special case
+		return a;
+
+	// warning - don't try to adapt this algorithm for another situation
+	word32 g0=m_modulus, g1=a, g2=a;
+	word32 v0=0, v1=1, v2=1;
+
+	CRYPTOPP_ASSERT(g1);
+
+	while (!(g2 & 0x80000000))
+	{
+		g2 <<= 1;
+		v2 <<= 1;
+	}
+
+	g2 <<= 1;
+	v2 <<= 1;
+
+	g0 ^= g2;
+	v0 ^= v2;
+
+	while (g0 != 1)
+	{
+		if (g1 < g0 || ((g0^g1) < g0 && (g0^g1) < g1))
+		{
+			CRYPTOPP_ASSERT(BitPrecision(g1) <= BitPrecision(g0));
+			g2 = g1;
+			v2 = v1;
+		}
+		else
+		{
+			CRYPTOPP_ASSERT(BitPrecision(g1) > BitPrecision(g0));
+			g2 = g0; g0 = g1; g1 = g2;
+			v2 = v0; v0 = v1; v1 = v2;
+		}
+
+		while ((g0^g2) >= g2)
+		{
+			CRYPTOPP_ASSERT(BitPrecision(g0) > BitPrecision(g2));
+			g2 <<= 1;
+			v2 <<= 1;
+		}
+
+		CRYPTOPP_ASSERT(BitPrecision(g0) == BitPrecision(g2));
+		g0 ^= g2;
+		v0 ^= v2;
+	}
+
+	return v0;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/gf2_32.h b/runtime/third_party/cryptopp/gf2_32.h
new file mode 100644
index 0000000..9e794fe
--- /dev/null
+++ b/runtime/third_party/cryptopp/gf2_32.h
@@ -0,0 +1,73 @@
+// gf2_32.h - originally written and placed in the public domain by Wei Dai
+
+/// \file gf2_32.h
+/// \brief Classes and functions for schemes over GF(2^32)
+
+#ifndef CRYPTOPP_GF2_32_H
+#define CRYPTOPP_GF2_32_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief GF(2^32) with polynomial basis
+class GF2_32
+{
+public:
+	typedef word32 Element;
+	typedef int RandomizationParameter;
+
+	GF2_32(word32 modulus=0x0000008D) : m_modulus(modulus) {}
+
+	Element RandomElement(RandomNumberGenerator &rng, int ignored = 0) const
+		{CRYPTOPP_UNUSED(ignored); return rng.GenerateWord32();}
+
+	bool Equal(Element a, Element b) const
+		{return a==b;}
+
+	Element Identity() const
+		{return 0;}
+
+	Element Add(Element a, Element b) const
+		{return a^b;}
+
+	Element& Accumulate(Element &a, Element b) const
+		{return a^=b;}
+
+	Element Inverse(Element a) const
+		{return a;}
+
+	Element Subtract(Element a, Element b) const
+		{return a^b;}
+
+	Element& Reduce(Element &a, Element b) const
+		{return a^=b;}
+
+	Element Double(Element a) const
+		{CRYPTOPP_UNUSED(a); return 0;}
+
+	Element MultiplicativeIdentity() const
+		{return 1;}
+
+	Element Multiply(Element a, Element b) const;
+
+	Element Square(Element a) const
+		{return Multiply(a, a);}
+
+	bool IsUnit(Element a) const
+		{return a != 0;}
+
+	Element MultiplicativeInverse(Element a) const;
+
+	Element Divide(Element a, Element b) const
+		{return Multiply(a, MultiplicativeInverse(b));}
+
+private:
+	word32 m_modulus;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/gf2n.cpp b/runtime/third_party/cryptopp/gf2n.cpp
new file mode 100644
index 0000000..7854db1
--- /dev/null
+++ b/runtime/third_party/cryptopp/gf2n.cpp
@@ -0,0 +1,1070 @@
+// gf2n.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "cryptlib.h"
+#include "algebra.h"
+#include "randpool.h"
+#include "filters.h"
+#include "smartptr.h"
+#include "words.h"
+#include "misc.h"
+#include "gf2n.h"
+#include "oids.h"
+#include "asn.h"
+#include "cpu.h"
+
+#include <iostream>
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::PolynomialMod2;
+
+#if defined(HAVE_GCC_INIT_PRIORITY)
+  const PolynomialMod2 g_zero __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 60))) = PolynomialMod2();
+  const PolynomialMod2 g_one __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 61))) = PolynomialMod2(1);
+#elif defined(HAVE_MSC_INIT_PRIORITY)
+  #pragma warning(disable: 4075)
+  #pragma init_seg(".CRT$XCU")
+  const PolynomialMod2 g_zero;
+  const PolynomialMod2 g_one(1);
+  #pragma warning(default: 4075)
+#elif defined(HAVE_XLC_INIT_PRIORITY)
+  #pragma priority(290)
+  const PolynomialMod2 g_zero;
+  const PolynomialMod2 g_one(1);
+#endif
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (CRYPTOPP_CLMUL_AVAILABLE)
+extern CRYPTOPP_DLL void GF2NT_233_Multiply_Reduce_CLMUL(const word* pA, const word* pB, word* pC);
+extern CRYPTOPP_DLL void GF2NT_233_Square_Reduce_CLMUL(const word* pA, word* pC);
+#endif
+
+#if (CRYPTOPP_ARM_PMULL_AVAILABLE)
+extern void GF2NT_233_Multiply_Reduce_ARMv8(const word* pA, const word* pB, word* pC);
+extern void GF2NT_233_Square_Reduce_ARMv8(const word* pA, word* pC);
+#endif
+
+#if (CRYPTOPP_POWER8_VMULL_AVAILABLE) && 0
+extern void GF2NT_233_Multiply_Reduce_POWER8(const word* pA, const word* pB, word* pC);
+extern void GF2NT_233_Square_Reduce_POWER8(const word* pA, word* pC);
+#endif
+
+PolynomialMod2::PolynomialMod2()
+{
+}
+
+PolynomialMod2::PolynomialMod2(word value, size_t bitLength)
+	: reg(BitsToWords(bitLength))
+{
+	CRYPTOPP_ASSERT(value==0 || reg.size()>0);
+
+	if (reg.size() > 0)
+	{
+		reg[0] = value;
+		SetWords(reg+1, 0, reg.size()-1);
+	}
+}
+
+PolynomialMod2::PolynomialMod2(const PolynomialMod2& t)
+	: reg(t.reg.size())
+{
+	CopyWords(reg, t.reg, reg.size());
+}
+
+void PolynomialMod2::Randomize(RandomNumberGenerator &rng, size_t nbits)
+{
+	const size_t nbytes = nbits/8 + 1;
+	SecByteBlock buf(nbytes);
+	rng.GenerateBlock(buf, nbytes);
+	buf[0] = (byte)Crop(buf[0], nbits % 8);
+	Decode(buf, nbytes);
+}
+
+PolynomialMod2 PolynomialMod2::AllOnes(size_t bitLength)
+{
+	PolynomialMod2 result((word)0, bitLength);
+	SetWords(result.reg, ~(word(0)), result.reg.size());
+	if (bitLength%WORD_BITS)
+		result.reg[result.reg.size()-1] = (word)Crop(result.reg[result.reg.size()-1], bitLength%WORD_BITS);
+	return result;
+}
+
+void PolynomialMod2::SetBit(size_t n, int value)
+{
+	if (value)
+	{
+		reg.CleanGrow(n/WORD_BITS + 1);
+		reg[n/WORD_BITS] |= (word(1) << (n%WORD_BITS));
+	}
+	else
+	{
+		if (n/WORD_BITS < reg.size())
+			reg[n/WORD_BITS] &= ~(word(1) << (n%WORD_BITS));
+	}
+}
+
+byte PolynomialMod2::GetByte(size_t n) const
+{
+	if (n/WORD_SIZE >= reg.size())
+		return 0;
+	else
+		return byte(reg[n/WORD_SIZE] >> ((n%WORD_SIZE)*8));
+}
+
+void PolynomialMod2::SetByte(size_t n, byte value)
+{
+	reg.CleanGrow(BytesToWords(n+1));
+	reg[n/WORD_SIZE] &= ~(word(0xff) << 8*(n%WORD_SIZE));
+	reg[n/WORD_SIZE] |= (word(value) << 8*(n%WORD_SIZE));
+}
+
+PolynomialMod2 PolynomialMod2::Monomial(size_t i)
+{
+	PolynomialMod2 r((word)0, i+1);
+	r.SetBit(i);
+	return r;
+}
+
+PolynomialMod2 PolynomialMod2::Trinomial(size_t t0, size_t t1, size_t t2)
+{
+	PolynomialMod2 r((word)0, t0+1);
+	r.SetBit(t0);
+	r.SetBit(t1);
+	r.SetBit(t2);
+	return r;
+}
+
+PolynomialMod2 PolynomialMod2::Pentanomial(size_t t0, size_t t1, size_t t2, size_t t3, size_t t4)
+{
+	PolynomialMod2 r((word)0, t0+1);
+	r.SetBit(t0);
+	r.SetBit(t1);
+	r.SetBit(t2);
+	r.SetBit(t3);
+	r.SetBit(t4);
+	return r;
+}
+
+template <word i>
+struct NewPolynomialMod2
+{
+	PolynomialMod2 * operator()() const
+	{
+		return new PolynomialMod2(i);
+	}
+};
+
+const PolynomialMod2 &PolynomialMod2::Zero()
+{
+#if defined(HAVE_GCC_INIT_PRIORITY) || defined(HAVE_MSC_INIT_PRIORITY) || defined(HAVE_XLC_INIT_PRIORITY)
+	return g_zero;
+#elif defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static const PolynomialMod2 g_zero;
+	return g_zero;
+#else
+	return Singleton<PolynomialMod2>().Ref();
+#endif
+}
+
+const PolynomialMod2 &PolynomialMod2::One()
+{
+#if defined(HAVE_GCC_INIT_PRIORITY) || defined(HAVE_MSC_INIT_PRIORITY) || defined(HAVE_XLC_INIT_PRIORITY)
+	return g_one;
+#elif defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static const PolynomialMod2 g_one(1);
+	return g_one;
+#else
+	return Singleton<PolynomialMod2, NewPolynomialMod2<1> >().Ref();
+#endif
+}
+
+void PolynomialMod2::Decode(const byte *input, size_t inputLen)
+{
+	StringStore store(input, inputLen);
+	Decode(store, inputLen);
+}
+
+void PolynomialMod2::Encode(byte *output, size_t outputLen) const
+{
+	ArraySink sink(output, outputLen);
+	Encode(sink, outputLen);
+}
+
+void PolynomialMod2::Decode(BufferedTransformation &bt, size_t inputLen)
+{
+	CRYPTOPP_ASSERT(bt.MaxRetrievable() >= inputLen);
+	if (bt.MaxRetrievable() < inputLen)
+		throw InvalidArgument("PolynomialMod2: input length is too small");
+
+	reg.CleanNew(BytesToWords(inputLen));
+
+	for (size_t i=inputLen; i > 0; i--)
+	{
+		byte b;
+		(void)bt.Get(b);
+		reg[(i-1)/WORD_SIZE] |= word(b) << ((i-1)%WORD_SIZE)*8;
+	}
+}
+
+void PolynomialMod2::Encode(BufferedTransformation &bt, size_t outputLen) const
+{
+	for (size_t i=outputLen; i > 0; i--)
+		bt.Put(GetByte(i-1));
+}
+
+void PolynomialMod2::DEREncodeAsOctetString(BufferedTransformation &bt, size_t length) const
+{
+	DERGeneralEncoder enc(bt, OCTET_STRING);
+	Encode(enc, length);
+	enc.MessageEnd();
+}
+
+void PolynomialMod2::BERDecodeAsOctetString(BufferedTransformation &bt, size_t length)
+{
+	BERGeneralDecoder dec(bt, OCTET_STRING);
+	if (!dec.IsDefiniteLength() || dec.RemainingLength() != length)
+		BERDecodeError();
+	Decode(dec, length);
+	dec.MessageEnd();
+}
+
+unsigned int PolynomialMod2::WordCount() const
+{
+	return (unsigned int)CountWords(reg, reg.size());
+}
+
+unsigned int PolynomialMod2::ByteCount() const
+{
+	unsigned wordCount = WordCount();
+	if (wordCount)
+		return (wordCount-1)*WORD_SIZE + BytePrecision(reg[wordCount-1]);
+	else
+		return 0;
+}
+
+unsigned int PolynomialMod2::BitCount() const
+{
+	unsigned wordCount = WordCount();
+	if (wordCount)
+		return (wordCount-1)*WORD_BITS + BitPrecision(reg[wordCount-1]);
+	else
+		return 0;
+}
+
+unsigned int PolynomialMod2::Parity() const
+{
+	unsigned i;
+	word temp=0;
+	for (i=0; i<reg.size(); i++)
+		temp ^= reg[i];
+	return CryptoPP::Parity(temp);
+}
+
+PolynomialMod2& PolynomialMod2::operator=(const PolynomialMod2& t)
+{
+	reg.Assign(t.reg);
+	return *this;
+}
+
+PolynomialMod2& PolynomialMod2::operator^=(const PolynomialMod2& t)
+{
+	reg.CleanGrow(t.reg.size());
+	XorWords(reg, t.reg, t.reg.size());
+	return *this;
+}
+
+PolynomialMod2 PolynomialMod2::Xor(const PolynomialMod2 &b) const
+{
+	if (b.reg.size() >= reg.size())
+	{
+		PolynomialMod2 result((word)0, b.reg.size()*WORD_BITS);
+		XorWords(result.reg, reg, b.reg, reg.size());
+		CopyWords(result.reg+reg.size(), b.reg+reg.size(), b.reg.size()-reg.size());
+		return result;
+	}
+	else
+	{
+		PolynomialMod2 result((word)0, reg.size()*WORD_BITS);
+		XorWords(result.reg, reg, b.reg, b.reg.size());
+		CopyWords(result.reg+b.reg.size(), reg+b.reg.size(), reg.size()-b.reg.size());
+		return result;
+	}
+}
+
+PolynomialMod2 PolynomialMod2::And(const PolynomialMod2 &b) const
+{
+	PolynomialMod2 result((word)0, WORD_BITS*STDMIN(reg.size(), b.reg.size()));
+	AndWords(result.reg, reg, b.reg, result.reg.size());
+	return result;
+}
+
+PolynomialMod2 PolynomialMod2::Times(const PolynomialMod2 &b) const
+{
+	PolynomialMod2 result((word)0, BitCount() + b.BitCount());
+
+	for (int i=b.Degree(); i>=0; i--)
+	{
+		result <<= 1;
+		if (b[i])
+			XorWords(result.reg, reg, reg.size());
+	}
+	return result;
+}
+
+PolynomialMod2 PolynomialMod2::Squared() const
+{
+	static const word map[16] = {0, 1, 4, 5, 16, 17, 20, 21, 64, 65, 68, 69, 80, 81, 84, 85};
+
+	PolynomialMod2 result((word)0, 2*reg.size()*WORD_BITS);
+
+	for (unsigned i=0; i<reg.size(); i++)
+	{
+		unsigned j;
+
+		for (j=0; j<WORD_BITS; j+=8)
+			result.reg[2*i] |= map[(reg[i] >> (j/2)) % 16] << j;
+
+		for (j=0; j<WORD_BITS; j+=8)
+			result.reg[2*i+1] |= map[(reg[i] >> (j/2 + WORD_BITS/2)) % 16] << j;
+	}
+
+	return result;
+}
+
+void PolynomialMod2::Divide(PolynomialMod2 &remainder, PolynomialMod2 &quotient,
+				   const PolynomialMod2 &dividend, const PolynomialMod2 &divisor)
+{
+	if (!divisor)
+		throw PolynomialMod2::DivideByZero();
+
+	int degree = divisor.Degree();
+	remainder.reg.CleanNew(BitsToWords(degree+1));
+	if (dividend.BitCount() >= divisor.BitCount())
+		quotient.reg.CleanNew(BitsToWords(dividend.BitCount() - divisor.BitCount() + 1));
+	else
+		quotient.reg.CleanNew(0);
+
+	for (int i=dividend.Degree(); i>=0; i--)
+	{
+		remainder <<= 1;
+		remainder.reg[0] |= dividend[i];
+		if (remainder[degree])
+		{
+			remainder -= divisor;
+			quotient.SetBit(i);
+		}
+	}
+}
+
+PolynomialMod2 PolynomialMod2::DividedBy(const PolynomialMod2 &b) const
+{
+	PolynomialMod2 remainder, quotient;
+	PolynomialMod2::Divide(remainder, quotient, *this, b);
+	return quotient;
+}
+
+PolynomialMod2 PolynomialMod2::Modulo(const PolynomialMod2 &b) const
+{
+	PolynomialMod2 remainder, quotient;
+	PolynomialMod2::Divide(remainder, quotient, *this, b);
+	return remainder;
+}
+
+PolynomialMod2& PolynomialMod2::operator<<=(unsigned int n)
+{
+#if defined(CRYPTOPP_DEBUG)
+	int x=0; CRYPTOPP_UNUSED(x);
+	CRYPTOPP_ASSERT(SafeConvert(n,x));
+#endif
+
+	if (!reg.size())
+		return *this;
+
+	int i;
+	word u;
+	word carry=0;
+	word *r=reg;
+
+	if (n==1)	// special case code for most frequent case
+	{
+		i = (int)reg.size();
+		while (i--)
+		{
+			u = *r;
+			*r = (u << 1) | carry;
+			carry = u >> (WORD_BITS-1);
+			r++;
+		}
+
+		if (carry)
+		{
+			reg.Grow(reg.size()+1);
+			reg[reg.size()-1] = carry;
+		}
+
+		return *this;
+	}
+
+	const int shiftWords = n / WORD_BITS;
+	const int shiftBits = n % WORD_BITS;
+
+	if (shiftBits)
+	{
+		i = (int)reg.size();
+		while (i--)
+		{
+			u = *r;
+			*r = (u << shiftBits) | carry;
+			carry = u >> (WORD_BITS-shiftBits);
+			r++;
+		}
+	}
+
+	if (carry)
+	{
+		// Thanks to Apatryda, http://github.com/weidai11/cryptopp/issues/64
+		const size_t carryIndex = reg.size();
+		reg.Grow(reg.size()+shiftWords+!!shiftBits);
+		reg[carryIndex] = carry;
+	}
+	else
+		reg.Grow(reg.size()+shiftWords);
+
+	if (shiftWords)
+	{
+		for (i = (int)reg.size()-1; i>=shiftWords; i--)
+			reg[i] = reg[i-shiftWords];
+		for (; i>=0; i--)
+			reg[i] = 0;
+	}
+
+	return *this;
+}
+
+PolynomialMod2& PolynomialMod2::operator>>=(unsigned int n)
+{
+	if (!reg.size())
+		return *this;
+
+	int shiftWords = n / WORD_BITS;
+	int shiftBits = n % WORD_BITS;
+
+	size_t i;
+	word u;
+	word carry=0;
+	word *r=reg+reg.size()-1;
+
+	if (shiftBits)
+	{
+		i = reg.size();
+		while (i--)
+		{
+			u = *r;
+			*r = (u >> shiftBits) | carry;
+			carry = u << (WORD_BITS-shiftBits);
+			r--;
+		}
+	}
+
+	if (shiftWords)
+	{
+		for (i=0; i<reg.size()-shiftWords; i++)
+			reg[i] = reg[i+shiftWords];
+		for (; i<reg.size(); i++)
+			reg[i] = 0;
+	}
+
+	return *this;
+}
+
+PolynomialMod2 PolynomialMod2::operator<<(unsigned int n) const
+{
+	PolynomialMod2 result(*this);
+	return result<<=n;
+}
+
+PolynomialMod2 PolynomialMod2::operator>>(unsigned int n) const
+{
+	PolynomialMod2 result(*this);
+	return result>>=n;
+}
+
+bool PolynomialMod2::operator!() const
+{
+	for (unsigned i=0; i<reg.size(); i++)
+		if (reg[i]) return false;
+	return true;
+}
+
+bool PolynomialMod2::Equals(const PolynomialMod2 &rhs) const
+{
+	size_t i, smallerSize = STDMIN(reg.size(), rhs.reg.size());
+
+	for (i=0; i<smallerSize; i++)
+		if (reg[i] != rhs.reg[i]) return false;
+
+	for (i=smallerSize; i<reg.size(); i++)
+		if (reg[i] != 0) return false;
+
+	for (i=smallerSize; i<rhs.reg.size(); i++)
+		if (rhs.reg[i] != 0) return false;
+
+	return true;
+}
+
+std::ostream& operator<<(std::ostream& out, const PolynomialMod2 &a)
+{
+	// Get relevant conversion specifications from ostream.
+	long f = out.flags() & std::ios::basefield;	// Get base digits.
+	int bits, block;
+	char suffix;
+	switch(f)
+	{
+	case std::ios::oct :
+		bits = 3;
+		block = 4;
+		suffix = 'o';
+		break;
+	case std::ios::hex :
+		bits = 4;
+		block = 2;
+		suffix = 'h';
+		break;
+	default :
+		bits = 1;
+		block = 8;
+		suffix = 'b';
+	}
+
+	if (!a)
+		return out << '0' << suffix;
+
+	SecBlock<char> s(a.BitCount()/bits+1);
+	unsigned i;
+
+	static const char upper[]="0123456789ABCDEF";
+	static const char lower[]="0123456789abcdef";
+	const char* const vec = (out.flags() & std::ios::uppercase) ? upper : lower;
+
+	for (i=0; i*bits < a.BitCount(); i++)
+	{
+		int digit=0;
+		for (int j=0; j<bits; j++)
+			digit |= a[i*bits+j] << j;
+		s[i]=vec[digit];
+	}
+
+	while (i--)
+	{
+		out << s[i];
+		if (i && (i%block)==0)
+			out << ',';
+	}
+
+	return out << suffix;
+}
+
+PolynomialMod2 PolynomialMod2::Gcd(const PolynomialMod2 &a, const PolynomialMod2 &b)
+{
+	return EuclideanDomainOf<PolynomialMod2>().Gcd(a, b);
+}
+
+PolynomialMod2 PolynomialMod2::InverseMod(const PolynomialMod2 &modulus) const
+{
+	typedef EuclideanDomainOf<PolynomialMod2> Domain;
+	return QuotientRing<Domain>(Domain(), modulus).MultiplicativeInverse(*this);
+}
+
+bool PolynomialMod2::IsIrreducible() const
+{
+	signed int d = Degree();
+	if (d <= 0)
+		return false;
+
+	PolynomialMod2 t(2), u(t);
+	for (int i=1; i<=d/2; i++)
+	{
+		u = u.Squared()%(*this);
+		if (!Gcd(u+t, *this).IsUnit())
+			return false;
+	}
+	return true;
+}
+
+// ********************************************************
+
+GF2NP::GF2NP(const PolynomialMod2 &modulus)
+	: QuotientRing<EuclideanDomainOf<PolynomialMod2> >(EuclideanDomainOf<PolynomialMod2>(), modulus), m(modulus.Degree())
+{
+}
+
+GF2NP::Element GF2NP::SquareRoot(const Element &a) const
+{
+	Element r = a;
+	for (unsigned int i=1; i<m; i++)
+		r = Square(r);
+	return r;
+}
+
+GF2NP::Element GF2NP::HalfTrace(const Element &a) const
+{
+	CRYPTOPP_ASSERT(m%2 == 1);
+	Element h = a;
+	for (unsigned int i=1; i<=(m-1)/2; i++)
+		h = Add(Square(Square(h)), a);
+	return h;
+}
+
+GF2NP::Element GF2NP::SolveQuadraticEquation(const Element &a) const
+{
+	if (m%2 == 0)
+	{
+		Element z, w;
+		RandomPool rng;
+		do
+		{
+			Element p((RandomNumberGenerator &)rng, m);
+			z = PolynomialMod2::Zero();
+			w = p;
+			for (unsigned int i=1; i<=m-1; i++)
+			{
+				w = Square(w);
+				z = Square(z);
+				Accumulate(z, Multiply(w, a));
+				Accumulate(w, p);
+			}
+		} while (w.IsZero());
+		return z;
+	}
+	else
+		return HalfTrace(a);
+}
+
+// ********************************************************
+
+GF2NT::GF2NT(unsigned int c0, unsigned int c1, unsigned int c2)
+	: GF2NP(PolynomialMod2::Trinomial(c0, c1, c2))
+	, t0(c0), t1(c1)
+	, result((word)0, m)
+{
+	CRYPTOPP_ASSERT(c0 > c1 && c1 > c2 && c2==0);
+}
+
+const GF2NT::Element& GF2NT::MultiplicativeInverse(const Element &a) const
+{
+	if (t0-t1 < WORD_BITS)
+		return GF2NP::MultiplicativeInverse(a);
+
+	SecWordBlock T(m_modulus.reg.size() * 4);
+	word *b = T;
+	word *c = T+m_modulus.reg.size();
+	word *f = T+2*m_modulus.reg.size();
+	word *g = T+3*m_modulus.reg.size();
+	size_t bcLen=1, fgLen=m_modulus.reg.size();
+	unsigned int k=0;
+
+	SetWords(T, 0, 3*m_modulus.reg.size());
+	b[0]=1;
+	CRYPTOPP_ASSERT(a.reg.size() <= m_modulus.reg.size());
+	CopyWords(f, a.reg, a.reg.size());
+	CopyWords(g, m_modulus.reg, m_modulus.reg.size());
+
+	while (1)
+	{
+		word t=f[0];
+		while (!t)
+		{
+			ShiftWordsRightByWords(f, fgLen, 1);
+			if (c[bcLen-1])
+				bcLen++;
+			CRYPTOPP_ASSERT(bcLen <= m_modulus.reg.size());
+			ShiftWordsLeftByWords(c, bcLen, 1);
+			k+=WORD_BITS;
+			t=f[0];
+		}
+
+		unsigned int i=0;
+		while (t%2 == 0)
+		{
+			t>>=1;
+			i++;
+		}
+		k+=i;
+
+		if (t==1 && CountWords(f, fgLen)==1)
+			break;
+
+		if (i==1)
+		{
+			ShiftWordsRightByBits(f, fgLen, 1);
+			t=ShiftWordsLeftByBits(c, bcLen, 1);
+		}
+		else
+		{
+			ShiftWordsRightByBits(f, fgLen, i);
+			t=ShiftWordsLeftByBits(c, bcLen, i);
+		}
+		if (t)
+		{
+			c[bcLen] = t;
+			bcLen++;
+			CRYPTOPP_ASSERT(bcLen <= m_modulus.reg.size());
+		}
+
+		if (f[fgLen-1]==0 && g[fgLen-1]==0)
+			fgLen--;
+
+		if (f[fgLen-1] < g[fgLen-1])
+		{
+			std::swap(f, g);
+			std::swap(b, c);
+		}
+
+		XorWords(f, g, fgLen);
+		XorWords(b, c, bcLen);
+	}
+
+	while (k >= WORD_BITS)
+	{
+		word temp = b[0];
+		// right shift b
+		for (unsigned i=0; i+1<BitsToWords(m); i++)
+			b[i] = b[i+1];
+		b[BitsToWords(m)-1] = 0;
+
+		if (t1 < WORD_BITS)
+			for (unsigned int j=0; j<WORD_BITS-t1; j++)
+			{
+				// Coverity finding on shift amount of 'word x << (t1+j)'.
+				//   temp ^= ((temp >> j) & 1) << (t1 + j);
+				const unsigned int shift = t1 + j;
+				CRYPTOPP_ASSERT(shift < WORD_BITS);
+				temp ^= (shift < WORD_BITS) ? (((temp >> j) & 1) << shift) : 0;
+			}
+		else
+			b[t1/WORD_BITS-1] ^= temp << t1%WORD_BITS;
+
+		if (t1 % WORD_BITS)
+			b[t1/WORD_BITS] ^= temp >> (WORD_BITS - t1%WORD_BITS);
+
+		if (t0%WORD_BITS)
+		{
+			b[t0/WORD_BITS-1] ^= temp << t0%WORD_BITS;
+			b[t0/WORD_BITS] ^= temp >> (WORD_BITS - t0%WORD_BITS);
+		}
+		else
+			b[t0/WORD_BITS-1] ^= temp;
+
+		k -= WORD_BITS;
+	}
+
+	if (k)
+	{
+		word temp = b[0] << (WORD_BITS - k);
+		ShiftWordsRightByBits(b, BitsToWords(m), k);
+
+		if (t1 < WORD_BITS)
+		{
+			for (unsigned int j=0; j<WORD_BITS-t1; j++)
+			{
+				// Coverity finding on shift amount of 'word x << (t1+j)'.
+				//   temp ^= ((temp >> j) & 1) << (t1 + j);
+				const unsigned int shift = t1 + j;
+				CRYPTOPP_ASSERT(shift < WORD_BITS);
+				temp ^= (shift < WORD_BITS) ? (((temp >> j) & 1) << shift) : 0;
+			}
+		}
+		else
+		{
+			b[t1/WORD_BITS-1] ^= temp << t1%WORD_BITS;
+		}
+
+		if (t1 % WORD_BITS)
+			b[t1/WORD_BITS] ^= temp >> (WORD_BITS - t1%WORD_BITS);
+
+		if (t0%WORD_BITS)
+		{
+			b[t0/WORD_BITS-1] ^= temp << t0%WORD_BITS;
+			b[t0/WORD_BITS] ^= temp >> (WORD_BITS - t0%WORD_BITS);
+		}
+		else
+			b[t0/WORD_BITS-1] ^= temp;
+	}
+
+	CopyWords(result.reg.begin(), b, result.reg.size());
+	return result;
+}
+
+const GF2NT::Element& GF2NT::Multiply(const Element &a, const Element &b) const
+{
+	size_t aSize = STDMIN(a.reg.size(), result.reg.size());
+	Element r((word)0, m);
+
+	for (int i=m-1; i>=0; i--)
+	{
+		if (r[m-1])
+		{
+			ShiftWordsLeftByBits(r.reg.begin(), r.reg.size(), 1);
+			XorWords(r.reg.begin(), m_modulus.reg, r.reg.size());
+		}
+		else
+			ShiftWordsLeftByBits(r.reg.begin(), r.reg.size(), 1);
+
+		if (b[i])
+			XorWords(r.reg.begin(), a.reg, aSize);
+	}
+
+	if (m%WORD_BITS)
+		r.reg.begin()[r.reg.size()-1] = (word)Crop(r.reg[r.reg.size()-1], m%WORD_BITS);
+
+	CopyWords(result.reg.begin(), r.reg.begin(), result.reg.size());
+	return result;
+}
+
+const GF2NT::Element& GF2NT::Reduced(const Element &a) const
+{
+	if (t0-t1 < WORD_BITS)
+		return m_domain.Mod(a, m_modulus);
+
+	SecWordBlock b(a.reg);
+
+	size_t i;
+	for (i=b.size()-1; i>=BitsToWords(t0); i--)
+	{
+		word temp = b[i];
+
+		if (t0%WORD_BITS)
+		{
+			b[i-t0/WORD_BITS] ^= temp >> t0%WORD_BITS;
+			b[i-t0/WORD_BITS-1] ^= temp << (WORD_BITS - t0%WORD_BITS);
+		}
+		else
+			b[i-t0/WORD_BITS] ^= temp;
+
+		if ((t0-t1)%WORD_BITS)
+		{
+			b[i-(t0-t1)/WORD_BITS] ^= temp >> (t0-t1)%WORD_BITS;
+			b[i-(t0-t1)/WORD_BITS-1] ^= temp << (WORD_BITS - (t0-t1)%WORD_BITS);
+		}
+		else
+			b[i-(t0-t1)/WORD_BITS] ^= temp;
+	}
+
+	if (i==BitsToWords(t0)-1 && t0%WORD_BITS)
+	{
+		word mask = ((word)1<<(t0%WORD_BITS))-1;
+		word temp = b[i] & ~mask;
+		b[i] &= mask;
+
+		b[i-t0/WORD_BITS] ^= temp >> t0%WORD_BITS;
+
+		if ((t0-t1)%WORD_BITS)
+		{
+			b[i-(t0-t1)/WORD_BITS] ^= temp >> (t0-t1)%WORD_BITS;
+			if ((t0-t1)%WORD_BITS > t0%WORD_BITS)
+				b[i-(t0-t1)/WORD_BITS-1] ^= temp << (WORD_BITS - (t0-t1)%WORD_BITS);
+			else
+				CRYPTOPP_ASSERT(temp << (WORD_BITS - (t0-t1)%WORD_BITS) == 0);
+		}
+		else
+			b[i-(t0-t1)/WORD_BITS] ^= temp;
+	}
+
+	SetWords(result.reg.begin(), 0, result.reg.size());
+	CopyWords(result.reg.begin(), b, STDMIN(b.size(), result.reg.size()));
+	return result;
+}
+
+void GF2NP::DEREncodeElement(BufferedTransformation &out, const Element &a) const
+{
+	a.DEREncodeAsOctetString(out, MaxElementByteLength());
+}
+
+void GF2NP::BERDecodeElement(BufferedTransformation &in, Element &a) const
+{
+	a.BERDecodeAsOctetString(in, MaxElementByteLength());
+}
+
+void GF2NT::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+		ASN1::characteristic_two_field().DEREncode(seq);
+		DERSequenceEncoder parameters(seq);
+			DEREncodeUnsigned(parameters, m);
+			ASN1::tpBasis().DEREncode(parameters);
+			DEREncodeUnsigned(parameters, t1);
+		parameters.MessageEnd();
+	seq.MessageEnd();
+}
+
+void GF2NPP::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+		ASN1::characteristic_two_field().DEREncode(seq);
+		DERSequenceEncoder parameters(seq);
+			DEREncodeUnsigned(parameters, m);
+			ASN1::ppBasis().DEREncode(parameters);
+			DERSequenceEncoder pentanomial(parameters);
+				DEREncodeUnsigned(pentanomial, t3);
+				DEREncodeUnsigned(pentanomial, t2);
+				DEREncodeUnsigned(pentanomial, t1);
+			pentanomial.MessageEnd();
+		parameters.MessageEnd();
+	seq.MessageEnd();
+}
+
+GF2NP * BERDecodeGF2NP(BufferedTransformation &bt)
+{
+	member_ptr<GF2NP> result;
+
+	BERSequenceDecoder seq(bt);
+		if (OID(seq) != ASN1::characteristic_two_field())
+			BERDecodeError();
+		BERSequenceDecoder parameters(seq);
+			unsigned int m;
+			BERDecodeUnsigned(parameters, m);
+			OID oid(parameters);
+			if (oid == ASN1::tpBasis())
+			{
+				unsigned int t1;
+				BERDecodeUnsigned(parameters, t1);
+				result.reset(new GF2NT(m, t1, 0));
+			}
+			else if (oid == ASN1::ppBasis())
+			{
+				unsigned int t1, t2, t3;
+				BERSequenceDecoder pentanomial(parameters);
+				BERDecodeUnsigned(pentanomial, t3);
+				BERDecodeUnsigned(pentanomial, t2);
+				BERDecodeUnsigned(pentanomial, t1);
+				pentanomial.MessageEnd();
+				result.reset(new GF2NPP(m, t3, t2, t1, 0));
+			}
+			else
+			{
+				BERDecodeError();
+				return NULLPTR;
+			}
+		parameters.MessageEnd();
+	seq.MessageEnd();
+
+	return result.release();
+}
+
+// ********************************************************
+
+GF2NT233::GF2NT233(unsigned int c0, unsigned int c1, unsigned int c2)
+	: GF2NT(c0, c1, c2)
+{
+	CRYPTOPP_ASSERT(c0 > c1 && c1 > c2 && c2==0);
+}
+
+const GF2NT::Element& GF2NT233::Multiply(const Element &a, const Element &b) const
+{
+#if (CRYPTOPP_CLMUL_AVAILABLE)
+	if (HasCLMUL())
+	{
+		CRYPTOPP_ASSERT(a.reg.size()*WORD_BITS == 256);
+		CRYPTOPP_ASSERT(b.reg.size()*WORD_BITS == 256);
+		CRYPTOPP_ASSERT(result.reg.size()*WORD_BITS == 256);
+
+		const word* pA = a.reg.begin();
+		const word* pB = b.reg.begin();
+		word* pR = result.reg.begin();
+
+		GF2NT_233_Multiply_Reduce_CLMUL(pA, pB, pR);
+		return result;
+	}
+	else
+#elif (CRYPTOPP_ARM_PMULL_AVAILABLE)
+	if (HasPMULL())
+	{
+		CRYPTOPP_ASSERT(a.reg.size()*WORD_BITS == 256);
+		CRYPTOPP_ASSERT(b.reg.size()*WORD_BITS == 256);
+		CRYPTOPP_ASSERT(result.reg.size()*WORD_BITS == 256);
+
+		const word* pA = a.reg.begin();
+		const word* pB = b.reg.begin();
+		word* pR = result.reg.begin();
+
+		GF2NT_233_Multiply_Reduce_ARMv8(pA, pB, pR);
+		return result;
+	}
+	else
+#elif (CRYPTOPP_POWER8_VMULL_AVAILABLE) && 0
+	if (HasPMULL())
+	{
+		CRYPTOPP_ASSERT(a.reg.size()*WORD_BITS == 256);
+		CRYPTOPP_ASSERT(b.reg.size()*WORD_BITS == 256);
+		CRYPTOPP_ASSERT(result.reg.size()*WORD_BITS == 256);
+
+		const word* pA = a.reg.begin();
+		const word* pB = b.reg.begin();
+		word* pR = result.reg.begin();
+
+		GF2NT_233_Multiply_Reduce_POWER8(pA, pB, pR);
+		return result;
+	}
+	else
+#endif
+
+	return GF2NT::Multiply(a, b);
+}
+
+const GF2NT::Element& GF2NT233::Square(const Element &a) const
+{
+#if (CRYPTOPP_CLMUL_AVAILABLE)
+	if (HasCLMUL())
+	{
+		CRYPTOPP_ASSERT(a.reg.size()*WORD_BITS == 256);
+		CRYPTOPP_ASSERT(result.reg.size()*WORD_BITS == 256);
+
+		const word* pA = a.reg.begin();
+		word* pR = result.reg.begin();
+
+		GF2NT_233_Square_Reduce_CLMUL(pA, pR);
+		return result;
+	}
+	else
+#elif (CRYPTOPP_ARM_PMULL_AVAILABLE)
+	if (HasPMULL())
+	{
+		CRYPTOPP_ASSERT(a.reg.size()*WORD_BITS == 256);
+		CRYPTOPP_ASSERT(result.reg.size()*WORD_BITS == 256);
+
+		const word* pA = a.reg.begin();
+		word* pR = result.reg.begin();
+
+		GF2NT_233_Square_Reduce_ARMv8(pA, pR);
+		return result;
+	}
+	else
+#elif (CRYPTOPP_POWER8_VMULL_AVAILABLE) && 0
+	if (HasPMULL())
+	{
+		CRYPTOPP_ASSERT(a.reg.size()*WORD_BITS == 256);
+		CRYPTOPP_ASSERT(result.reg.size()*WORD_BITS == 256);
+
+		const word* pA = a.reg.begin();
+		word* pR = result.reg.begin();
+
+		GF2NT_233_Square_Reduce_POWER8(pA, pR);
+		return result;
+	}
+	else
+#endif
+
+	return GF2NT::Square(a);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/gf2n.h b/runtime/third_party/cryptopp/gf2n.h
new file mode 100644
index 0000000..0756352
--- /dev/null
+++ b/runtime/third_party/cryptopp/gf2n.h
@@ -0,0 +1,404 @@
+// gf2n.h - originally written and placed in the public domain by Wei Dai
+
+/// \file gf2n.h
+/// \brief Classes and functions for schemes over GF(2^n)
+
+#ifndef CRYPTOPP_GF2N_H
+#define CRYPTOPP_GF2N_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "algebra.h"
+#include "misc.h"
+#include "asn.h"
+
+#include <iosfwd>
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4231 4275)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Polynomial with Coefficients in GF(2)
+/*!	\nosubgrouping */
+class CRYPTOPP_DLL PolynomialMod2
+{
+public:
+	/// \name ENUMS, EXCEPTIONS, and TYPEDEFS
+	//@{
+		/// \brief Exception thrown when divide by zero is encountered
+		class DivideByZero : public Exception
+		{
+		public:
+			DivideByZero() : Exception(OTHER_ERROR, "PolynomialMod2: division by zero") {}
+		};
+
+		typedef unsigned int RandomizationParameter;
+	//@}
+
+	/// \name CREATORS
+	//@{
+		/// \brief Construct the zero polynomial
+		PolynomialMod2();
+		/// Copy construct a PolynomialMod2
+		PolynomialMod2(const PolynomialMod2& t);
+
+		/// \brief Construct a PolynomialMod2 from a word
+		/// \details value should be encoded with the least significant bit as coefficient to x^0
+		///   and most significant bit as coefficient to x^(WORD_BITS-1)
+		///   bitLength denotes how much memory to allocate initially
+		PolynomialMod2(word value, size_t bitLength=WORD_BITS);
+
+		/// \brief Construct a PolynomialMod2 from big-endian byte array
+		PolynomialMod2(const byte *encodedPoly, size_t byteCount)
+			{Decode(encodedPoly, byteCount);}
+
+		/// \brief Construct a PolynomialMod2 from big-endian form stored in a BufferedTransformation
+		PolynomialMod2(BufferedTransformation &encodedPoly, size_t byteCount)
+			{Decode(encodedPoly, byteCount);}
+
+		/// \brief Create a uniformly distributed random polynomial
+		/// \details Create a random polynomial uniformly distributed over all polynomials with degree less than bitcount
+		PolynomialMod2(RandomNumberGenerator &rng, size_t bitcount)
+			{Randomize(rng, bitcount);}
+
+		/// \brief Provides x^i
+		/// \return x^i
+		static PolynomialMod2 CRYPTOPP_API Monomial(size_t i);
+		/// \brief Provides x^t0 + x^t1 + x^t2
+		/// \return x^t0 + x^t1 + x^t2
+		static PolynomialMod2 CRYPTOPP_API Trinomial(size_t t0, size_t t1, size_t t2);
+		/// \brief Provides x^t0 + x^t1 + x^t2 + x^t3 + x^t4
+		/// \return x^t0 + x^t1 + x^t2 + x^t3 + x^t4
+		static PolynomialMod2 CRYPTOPP_API Pentanomial(size_t t0, size_t t1, size_t t2, size_t t3, size_t t4);
+		/// \brief Provides x^(n-1) + ... + x + 1
+		/// \return x^(n-1) + ... + x + 1
+		static PolynomialMod2 CRYPTOPP_API AllOnes(size_t n);
+
+		/// \brief The Zero polinomial
+		/// \return the zero polynomial
+		static const PolynomialMod2 & CRYPTOPP_API Zero();
+		/// \brief The One polinomial
+		/// \return the one polynomial
+		static const PolynomialMod2 & CRYPTOPP_API One();
+	//@}
+
+	/// \name ENCODE/DECODE
+	//@{
+		/// minimum number of bytes to encode this polynomial
+		/*! MinEncodedSize of 0 is 1 */
+		unsigned int MinEncodedSize() const {return STDMAX(1U, ByteCount());}
+
+		/// encode in big-endian format
+		/// \details if outputLen < MinEncodedSize, the most significant bytes will be dropped
+		///   if outputLen > MinEncodedSize, the most significant bytes will be padded
+		void Encode(byte *output, size_t outputLen) const;
+		///
+		void Encode(BufferedTransformation &bt, size_t outputLen) const;
+
+		///
+		void Decode(const byte *input, size_t inputLen);
+		///
+		//* Precondition: bt.MaxRetrievable() >= inputLen
+		void Decode(BufferedTransformation &bt, size_t inputLen);
+
+		/// encode value as big-endian octet string
+		void DEREncodeAsOctetString(BufferedTransformation &bt, size_t length) const;
+		/// decode value as big-endian octet string
+		void BERDecodeAsOctetString(BufferedTransformation &bt, size_t length);
+	//@}
+
+	/// \name ACCESSORS
+	//@{
+		/// number of significant bits = Degree() + 1
+		unsigned int BitCount() const;
+		/// number of significant bytes = ceiling(BitCount()/8)
+		unsigned int ByteCount() const;
+		/// number of significant words = ceiling(ByteCount()/sizeof(word))
+		unsigned int WordCount() const;
+
+		/// return the n-th bit, n=0 being the least significant bit
+		bool GetBit(size_t n) const {return GetCoefficient(n)!=0;}
+		/// return the n-th byte
+		byte GetByte(size_t n) const;
+
+		/// the zero polynomial will return a degree of -1
+		signed int Degree() const {return (signed int)(BitCount()-1U);}
+		/// degree + 1
+		unsigned int CoefficientCount() const {return BitCount();}
+		/// return coefficient for x^i
+		int GetCoefficient(size_t i) const
+			{return (i/WORD_BITS < reg.size()) ? int(reg[i/WORD_BITS] >> (i % WORD_BITS)) & 1 : 0;}
+		/// return coefficient for x^i
+		int operator[](unsigned int i) const {return GetCoefficient(i);}
+
+		///
+		bool IsZero() const {return !*this;}
+		///
+		bool Equals(const PolynomialMod2 &rhs) const;
+	//@}
+
+	/// \name MANIPULATORS
+	//@{
+		///
+		PolynomialMod2&  operator=(const PolynomialMod2& t);
+		///
+		PolynomialMod2&  operator&=(const PolynomialMod2& t);
+		///
+		PolynomialMod2&  operator^=(const PolynomialMod2& t);
+		///
+		PolynomialMod2&  operator+=(const PolynomialMod2& t) {return *this ^= t;}
+		///
+		PolynomialMod2&  operator-=(const PolynomialMod2& t) {return *this ^= t;}
+		///
+		PolynomialMod2&  operator*=(const PolynomialMod2& t);
+		///
+		PolynomialMod2&  operator/=(const PolynomialMod2& t);
+		///
+		PolynomialMod2&  operator%=(const PolynomialMod2& t);
+		///
+		PolynomialMod2&  operator<<=(unsigned int);
+		///
+		PolynomialMod2&  operator>>=(unsigned int);
+
+		///
+		void Randomize(RandomNumberGenerator &rng, size_t bitcount);
+
+		///
+		void SetBit(size_t i, int value = 1);
+		/// set the n-th byte to value
+		void SetByte(size_t n, byte value);
+
+		///
+		void SetCoefficient(size_t i, int value) {SetBit(i, value);}
+
+		///
+		void swap(PolynomialMod2 &a) {reg.swap(a.reg);}
+	//@}
+
+	/// \name UNARY OPERATORS
+	//@{
+		///
+		bool			operator!() const;
+		///
+		PolynomialMod2	operator+() const {return *this;}
+		///
+		PolynomialMod2	operator-() const {return *this;}
+	//@}
+
+	/// \name BINARY OPERATORS
+	//@{
+		///
+		PolynomialMod2 And(const PolynomialMod2 &b) const;
+		///
+		PolynomialMod2 Xor(const PolynomialMod2 &b) const;
+		///
+		PolynomialMod2 Plus(const PolynomialMod2 &b) const {return Xor(b);}
+		///
+		PolynomialMod2 Minus(const PolynomialMod2 &b) const {return Xor(b);}
+		///
+		PolynomialMod2 Times(const PolynomialMod2 &b) const;
+		///
+		PolynomialMod2 DividedBy(const PolynomialMod2 &b) const;
+		///
+		PolynomialMod2 Modulo(const PolynomialMod2 &b) const;
+
+		///
+		PolynomialMod2 operator>>(unsigned int n) const;
+		///
+		PolynomialMod2 operator<<(unsigned int n) const;
+	//@}
+
+	/// \name OTHER ARITHMETIC FUNCTIONS
+	//@{
+		/// sum modulo 2 of all coefficients
+		unsigned int Parity() const;
+
+		/// check for irreducibility
+		bool IsIrreducible() const;
+
+		/// is always zero since we're working modulo 2
+		PolynomialMod2 Doubled() const {return Zero();}
+		///
+		PolynomialMod2 Squared() const;
+
+		/// only 1 is a unit
+		bool IsUnit() const {return Equals(One());}
+		/// return inverse if *this is a unit, otherwise return 0
+		PolynomialMod2 MultiplicativeInverse() const {return IsUnit() ? One() : Zero();}
+
+		/// greatest common divisor
+		static PolynomialMod2 CRYPTOPP_API Gcd(const PolynomialMod2 &a, const PolynomialMod2 &n);
+		/// calculate multiplicative inverse of *this mod n
+		PolynomialMod2 InverseMod(const PolynomialMod2 &) const;
+
+		/// calculate r and q such that (a == d*q + r) && (deg(r) < deg(d))
+		static void CRYPTOPP_API Divide(PolynomialMod2 &r, PolynomialMod2 &q, const PolynomialMod2 &a, const PolynomialMod2 &d);
+	//@}
+
+	/// \name INPUT/OUTPUT
+	//@{
+		///
+		friend std::ostream& operator<<(std::ostream& out, const PolynomialMod2 &a);
+	//@}
+
+private:
+	friend class GF2NT;
+	friend class GF2NT233;
+
+	SecWordBlock reg;
+};
+
+///
+inline bool operator==(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b)
+{return a.Equals(b);}
+///
+inline bool operator!=(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b)
+{return !(a==b);}
+/// compares degree
+inline bool operator> (const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b)
+{return a.Degree() > b.Degree();}
+/// compares degree
+inline bool operator>=(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b)
+{return a.Degree() >= b.Degree();}
+/// compares degree
+inline bool operator< (const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b)
+{return a.Degree() < b.Degree();}
+/// compares degree
+inline bool operator<=(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b)
+{return a.Degree() <= b.Degree();}
+///
+inline CryptoPP::PolynomialMod2 operator&(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b) {return a.And(b);}
+///
+inline CryptoPP::PolynomialMod2 operator^(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b) {return a.Xor(b);}
+///
+inline CryptoPP::PolynomialMod2 operator+(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b) {return a.Plus(b);}
+///
+inline CryptoPP::PolynomialMod2 operator-(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b) {return a.Minus(b);}
+///
+inline CryptoPP::PolynomialMod2 operator*(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b) {return a.Times(b);}
+///
+inline CryptoPP::PolynomialMod2 operator/(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b) {return a.DividedBy(b);}
+///
+inline CryptoPP::PolynomialMod2 operator%(const CryptoPP::PolynomialMod2 &a, const CryptoPP::PolynomialMod2 &b) {return a.Modulo(b);}
+
+// CodeWarrior 8 workaround: put these template instantiations after overloaded operator declarations,
+// but before the use of QuotientRing<EuclideanDomainOf<PolynomialMod2> > for VC .NET 2003
+CRYPTOPP_DLL_TEMPLATE_CLASS AbstractGroup<PolynomialMod2>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AbstractRing<PolynomialMod2>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AbstractEuclideanDomain<PolynomialMod2>;
+CRYPTOPP_DLL_TEMPLATE_CLASS EuclideanDomainOf<PolynomialMod2>;
+CRYPTOPP_DLL_TEMPLATE_CLASS QuotientRing<EuclideanDomainOf<PolynomialMod2> >;
+
+/// \brief GF(2^n) with Polynomial Basis
+class CRYPTOPP_DLL GF2NP : public QuotientRing<EuclideanDomainOf<PolynomialMod2> >
+{
+public:
+	GF2NP(const PolynomialMod2 &modulus);
+
+	virtual GF2NP * Clone() const {return new GF2NP(*this);}
+	virtual void DEREncode(BufferedTransformation &bt) const
+		{CRYPTOPP_UNUSED(bt); CRYPTOPP_ASSERT(false);}	// no ASN.1 syntax yet for general polynomial basis
+
+	void DEREncodeElement(BufferedTransformation &out, const Element &a) const;
+	void BERDecodeElement(BufferedTransformation &in, Element &a) const;
+
+	bool Equal(const Element &a, const Element &b) const
+		{CRYPTOPP_ASSERT(a.Degree() < m_modulus.Degree() && b.Degree() < m_modulus.Degree()); return a.Equals(b);}
+
+	bool IsUnit(const Element &a) const
+		{CRYPTOPP_ASSERT(a.Degree() < m_modulus.Degree()); return !!a;}
+
+	unsigned int MaxElementBitLength() const
+		{return m;}
+
+	unsigned int MaxElementByteLength() const
+		{return (unsigned int)BitsToBytes(MaxElementBitLength());}
+
+	Element SquareRoot(const Element &a) const;
+
+	Element HalfTrace(const Element &a) const;
+
+	// returns z such that z^2 + z == a
+	Element SolveQuadraticEquation(const Element &a) const;
+
+protected:
+	unsigned int m;
+};
+
+/// \brief GF(2^n) with Trinomial Basis
+class CRYPTOPP_DLL GF2NT : public GF2NP
+{
+public:
+	// polynomial modulus = x^t0 + x^t1 + x^t2, t0 > t1 > t2
+	GF2NT(unsigned int t0, unsigned int t1, unsigned int t2);
+
+	GF2NP * Clone() const {return new GF2NT(*this);}
+	void DEREncode(BufferedTransformation &bt) const;
+
+	const Element& Multiply(const Element &a, const Element &b) const;
+
+	const Element& Square(const Element &a) const
+		{return Reduced(a.Squared());}
+
+	const Element& MultiplicativeInverse(const Element &a) const;
+
+protected:
+	const Element& Reduced(const Element &a) const;
+
+	unsigned int t0, t1;
+	mutable PolynomialMod2 result;
+};
+
+/// \brief GF(2^n) for b233 and k233
+/// \details GF2NT233 is a specialization of GF2NT that provides Multiply()
+///   and Square() operations when carryless multiplies is available.
+class CRYPTOPP_DLL GF2NT233 : public GF2NT
+{
+public:
+	// polynomial modulus = x^t0 + x^t1 + x^t2, t0 > t1 > t2
+	GF2NT233(unsigned int t0, unsigned int t1, unsigned int t2);
+
+	GF2NP * Clone() const {return new GF2NT233(*this);}
+
+	const Element& Multiply(const Element &a, const Element &b) const;
+
+	const Element& Square(const Element &a) const;
+};
+
+/// \brief GF(2^n) with Pentanomial Basis
+class CRYPTOPP_DLL GF2NPP : public GF2NP
+{
+public:
+	// polynomial modulus = x^t0 + x^t1 + x^t2 + x^t3 + x^t4, t0 > t1 > t2 > t3 > t4
+	GF2NPP(unsigned int t0, unsigned int t1, unsigned int t2, unsigned int t3, unsigned int t4)
+		: GF2NP(PolynomialMod2::Pentanomial(t0, t1, t2, t3, t4)), t1(t1), t2(t2), t3(t3) {}
+
+	GF2NP * Clone() const {return new GF2NPP(*this);}
+	void DEREncode(BufferedTransformation &bt) const;
+
+private:
+	unsigned int t1, t2, t3;
+};
+
+// construct new GF2NP from the ASN.1 sequence Characteristic-two
+CRYPTOPP_DLL GF2NP * CRYPTOPP_API BERDecodeGF2NP(BufferedTransformation &bt);
+
+NAMESPACE_END
+
+#ifndef __BORLANDC__
+NAMESPACE_BEGIN(std)
+template<> inline void swap(CryptoPP::PolynomialMod2 &a, CryptoPP::PolynomialMod2 &b)
+{
+	a.swap(b);
+}
+NAMESPACE_END
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/gf2n_simd.cpp b/runtime/third_party/cryptopp/gf2n_simd.cpp
new file mode 100644
index 0000000..32032eb
--- /dev/null
+++ b/runtime/third_party/cryptopp/gf2n_simd.cpp
@@ -0,0 +1,614 @@
+// gf2n_simd.cpp - written and placed in the public domain by Jeffrey Walton
+//                 Also based on PCLMULQDQ code by Jankowski, Laurent and
+//                 O'Mahony from Intel (see reference below).
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    CLMUL, ARMv8a, and Power8 instructions. A separate source file is
+//    needed because additional CXXFLAGS are required to enable the
+//    appropriate instructions sets in some build configurations.
+//
+//    Several speedups were taken from Intel Polynomial Multiplication
+//    Instruction and its Usage for Elliptic Curve Cryptography, by
+//    Krzysztof Jankowski, Pierre Laurent and Aidan O'Mahony,
+//    https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/polynomial-multiplication-instructions-paper.pdf
+//    There may be more speedups available, see https://eprint.iacr.org/2011/589.pdf.
+//    The IACR paper performs some optimizations that the compiler is
+//    expected to perform, like Common Subexpression Elimination to save
+//    on variables (among others). Note that the compiler may miss the
+//    optimization so the IACR paper is useful. However, the code is GPL3
+//    and toxic for some users of the library, so it is not used here...
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "gf2n.h"
+
+#if (CRYPTOPP_CLMUL_AVAILABLE)
+# include <emmintrin.h>
+# include <wmmintrin.h>
+#endif
+
+#if (CRYPTOPP_ARM_PMULL_AVAILABLE)
+# include "arm_simd.h"
+#endif
+
+#if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+# include "ppc_simd.h"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char GF2N_SIMD_FNAME[] = __FILE__;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+// ************************** ARMv8 ************************** //
+
+using CryptoPP::word;
+
+#if (CRYPTOPP_ARM_PMULL_AVAILABLE)
+
+// c1c0 = a * b
+inline void
+F2N_Multiply_128x128_ARMv8(uint64x2_t& c1, uint64x2_t& c0, const uint64x2_t& a, const uint64x2_t& b)
+{
+    uint64x2_t t1, t2, z0={0};
+
+    c0 = PMULL_00(a, b);
+    c1 = PMULL_11(a, b);
+    t1 = vmovq_n_u64(vgetq_lane_u64(a, 1));
+    t1 = veorq_u64(a, t1);
+    t2 = vmovq_n_u64(vgetq_lane_u64(b, 1));
+    t2 = veorq_u64(b, t2);
+    t1 = PMULL_00(t1, t2);
+    t1 = veorq_u64(c0, t1);
+    t1 = veorq_u64(c1, t1);
+    t2 = t1;
+    t1 = vextq_u64(z0, t1, 1);
+    t2 = vextq_u64(t2, z0, 1);
+    c0 = veorq_u64(c0, t1);
+    c1 = veorq_u64(c1, t2);
+}
+
+// c3c2c1c0 = a1a0 * b1b0
+inline void
+F2N_Multiply_256x256_ARMv8(uint64x2_t& c3, uint64x2_t& c2, uint64x2_t& c1, uint64x2_t& c0,
+    const uint64x2_t& b1, const uint64x2_t& b0, const uint64x2_t& a1, const uint64x2_t& a0)
+{
+    uint64x2_t c4, c5;
+    uint64x2_t x0=a0, x1=a1, y0=b0, y1=b1;
+
+    F2N_Multiply_128x128_ARMv8(c1, c0, x0, y0);
+    F2N_Multiply_128x128_ARMv8(c3, c2, x1, y1);
+
+    x0 = veorq_u64(x0, x1);
+    y0 = veorq_u64(y0, y1);
+
+    F2N_Multiply_128x128_ARMv8(c5, c4, x0, y0);
+
+    c4 = veorq_u64(c4, c0);
+    c4 = veorq_u64(c4, c2);
+    c5 = veorq_u64(c5, c1);
+    c5 = veorq_u64(c5, c3);
+    c1 = veorq_u64(c1, c4);
+    c2 = veorq_u64(c2, c5);
+}
+
+// c3c2c1c0 = a1a0 * a1a0
+inline void
+F2N_Square_256_ARMv8(uint64x2_t& c3, uint64x2_t& c2, uint64x2_t& c1,
+    uint64x2_t& c0, const uint64x2_t& a1, const uint64x2_t& a0)
+{
+    c0 = PMULL_00(a0, a0);
+    c1 = PMULL_11(a0, a0);
+    c2 = PMULL_00(a1, a1);
+    c3 = PMULL_11(a1, a1);
+}
+
+// x = (x << n), z = 0
+template <unsigned int N>
+inline uint64x2_t ShiftLeft128_ARMv8(uint64x2_t x)
+{
+    uint64x2_t u=x, v, z={0};
+    x = vshlq_n_u64(x, N);
+    u = vshrq_n_u64(u, (64-N));
+    v = vcombine_u64(vget_low_u64(z), vget_low_u64(u));
+    x = vorrq_u64(x, v);
+    return x;
+}
+
+// c1c0 = c3c2c1c0 MOD p. This is a Barrett reduction. Reading at
+// Intel paper or https://github.com/antonblanchard/crc32-vpmsum.
+inline void
+GF2NT_233_Reduce_ARMv8(uint64x2_t& c3, uint64x2_t& c2, uint64x2_t& c1, uint64x2_t& c0)
+{
+    const unsigned int mask[4] = {
+        0xffffffff, 0xffffffff, 0xffffffff, 0x000001ff,
+    };
+
+    uint64x2_t b3, b2, b1, /*b0,*/ a1, a0, m0, z0={0};
+    m0 = vreinterpretq_u64_u32(vld1q_u32(mask));
+    b1 = c1; a1 = c1;
+    a0 = vcombine_u64(vget_low_u64(c1), vget_low_u64(z0));
+    a1 = vshlq_n_u64(a1, 23);
+    a1 = vshrq_n_u64(a1, 23);
+    c1 = vorrq_u64(a1, a0);
+    b2 = vshrq_n_u64(c2, (64-23));
+    c3 = ShiftLeft128_ARMv8<23>(c3);
+    a0 = vcombine_u64(vget_high_u64(b2), vget_high_u64(z0));
+    c3 = vorrq_u64(c3, a0);
+    b1 = vshrq_n_u64(b1, (64-23));
+    c2 = ShiftLeft128_ARMv8<23>(c2);
+    a0 = vcombine_u64(vget_high_u64(b1), vget_high_u64(z0));
+    c2 = vorrq_u64(c2, a0);
+    b3 = c3;
+    b2 = vshrq_n_u64(c2, (64-10));
+    b3 = ShiftLeft128_ARMv8<10>(b3);
+    a0 = vcombine_u64(vget_high_u64(b2), vget_high_u64(z0));
+    b3 = vorrq_u64(b3, a0);
+    a0 = vcombine_u64(vget_high_u64(c3), vget_high_u64(z0));
+    b3 = veorq_u64(b3, a0);
+    b1 = vshrq_n_u64(b3, (64-23));
+    b3 = ShiftLeft128_ARMv8<23>(b3);
+    b3 = vcombine_u64(vget_high_u64(b3), vget_high_u64(z0));
+    b3 = vorrq_u64(b3, b1);
+    c2 = veorq_u64(c2, b3);
+    b3 = c3;
+    b2 = vshrq_n_u64(c2, (64-10));
+    b3 = ShiftLeft128_ARMv8<10>(b3);
+    b2 = vcombine_u64(vget_high_u64(b2), vget_high_u64(z0));
+    b3 = vorrq_u64(b3, b2);
+    b2 = c2;
+    b2 = ShiftLeft128_ARMv8<10>(b2);
+    a0 = vcombine_u64(vget_low_u64(z0), vget_low_u64(b2));
+    c2 = veorq_u64(c2, a0);
+    a0 = vcombine_u64(vget_low_u64(z0), vget_low_u64(b3));
+    a1 = vcombine_u64(vget_high_u64(b2), vget_high_u64(z0));
+    a0 = vorrq_u64(a0, a1);
+    c3 = veorq_u64(c3, a0);
+    c0 = veorq_u64(c0, c2);
+    c1 = veorq_u64(c1, c3);
+    c1 = vandq_u64(c1, m0);
+}
+
+#endif
+
+// ************************** SSE ************************** //
+
+#if (CRYPTOPP_CLMUL_AVAILABLE)
+
+using CryptoPP::word;
+
+// c1c0 = a * b
+inline void
+F2N_Multiply_128x128_CLMUL(__m128i& c1, __m128i& c0, const __m128i& a, const __m128i& b)
+{
+    __m128i t1, t2;
+
+    c0 = _mm_clmulepi64_si128(a, b, 0x00);
+    c1 = _mm_clmulepi64_si128(a, b, 0x11);
+    t1 = _mm_shuffle_epi32(a, 0xEE);
+    t1 = _mm_xor_si128(a, t1);
+    t2 = _mm_shuffle_epi32(b, 0xEE);
+    t2 = _mm_xor_si128(b, t2);
+    t1 = _mm_clmulepi64_si128(t1, t2, 0x00);
+    t1 = _mm_xor_si128(c0, t1);
+    t1 = _mm_xor_si128(c1, t1);
+    t2 = t1;
+    t1 = _mm_slli_si128(t1, 8);
+    t2 = _mm_srli_si128(t2, 8);
+    c0 = _mm_xor_si128(c0, t1);
+    c1 = _mm_xor_si128(c1, t2);
+}
+
+// c3c2c1c0 = a1a0 * b1b0
+inline void
+F2N_Multiply_256x256_CLMUL(__m128i& c3, __m128i& c2, __m128i& c1, __m128i& c0,
+    const __m128i& b1, const __m128i& b0, const __m128i& a1, const __m128i& a0)
+{
+    __m128i c4, c5;
+    __m128i x0=a0, x1=a1, y0=b0, y1=b1;
+
+    F2N_Multiply_128x128_CLMUL(c1, c0, x0, y0);
+    F2N_Multiply_128x128_CLMUL(c3, c2, x1, y1);
+
+    x0 = _mm_xor_si128(x0, x1);
+    y0 = _mm_xor_si128(y0, y1);
+
+    F2N_Multiply_128x128_CLMUL(c5, c4, x0, y0);
+
+    c4 = _mm_xor_si128(c4, c0);
+    c4 = _mm_xor_si128(c4, c2);
+    c5 = _mm_xor_si128(c5, c1);
+    c5 = _mm_xor_si128(c5, c3);
+    c1 = _mm_xor_si128(c1, c4);
+    c2 = _mm_xor_si128(c2, c5);
+}
+
+// c3c2c1c0 = a1a0 * a1a0
+inline void
+F2N_Square_256_CLMUL(__m128i& c3, __m128i& c2, __m128i& c1,
+    __m128i& c0, const __m128i& a1, const __m128i& a0)
+{
+    c0 = _mm_clmulepi64_si128(a0, a0, 0x00);
+    c1 = _mm_clmulepi64_si128(a0, a0, 0x11);
+    c2 = _mm_clmulepi64_si128(a1, a1, 0x00);
+    c3 = _mm_clmulepi64_si128(a1, a1, 0x11);
+}
+
+// x = (x << n), z = 0
+template <unsigned int N>
+inline __m128i ShiftLeft128_SSE(__m128i x, const __m128i& z)
+{
+    __m128i u=x, v;
+    x = _mm_slli_epi64(x, N);
+    u = _mm_srli_epi64(u, (64-N));
+    v = _mm_unpacklo_epi64(z, u);
+    x = _mm_or_si128(x, v);
+    return x;
+}
+
+// c1c0 = c3c2c1c0 MOD p. This is a Barrett reduction. Reading at
+// Intel paper or https://github.com/antonblanchard/crc32-vpmsum.
+inline void
+GF2NT_233_Reduce_CLMUL(__m128i& c3, __m128i& c2, __m128i& c1, __m128i& c0)
+{
+    const unsigned int m[4] = {
+        0xffffffff, 0xffffffff, 0xffffffff, 0x000001ff
+    };
+
+    __m128i b3, b2, b1, /*b0,*/ a1, a0, m0, z0;
+    m0 = _mm_set_epi32(m[3], m[2], m[1], m[0]);
+    z0 = _mm_setzero_si128();
+    b1 = c1; a1 = c1;
+    a0 = _mm_move_epi64(c1);
+    a1 = _mm_slli_epi64(a1, 23);
+    a1 = _mm_srli_epi64(a1, 23);
+    c1 = _mm_or_si128(a1, a0);
+    b2 = _mm_srli_epi64(c2, (64-23));
+    c3 = ShiftLeft128_SSE<23>(c3, z0);
+    a0 = _mm_unpackhi_epi64(b2, z0);
+    c3 = _mm_or_si128(c3, a0);
+    b1 = _mm_srli_epi64(b1, (64-23));
+    c2 = ShiftLeft128_SSE<23>(c2, z0);
+    a0 = _mm_unpackhi_epi64(b1, z0);
+    c2 = _mm_or_si128(c2, a0);
+    b3 = c3;
+    b2 = _mm_srli_epi64(c2, (64-10));
+    b3 = ShiftLeft128_SSE<10>(b3, z0);
+    a0 = _mm_unpackhi_epi64(b2, z0);
+    b3 = _mm_or_si128(b3, a0);
+    a0 = _mm_unpackhi_epi64(c3, z0);
+    b3 = _mm_xor_si128(b3, a0);
+    b1 = _mm_srli_epi64(b3, (64-23));
+    b3 = ShiftLeft128_SSE<23>(b3, z0);
+    b3 = _mm_unpackhi_epi64(b3, z0);
+    b3 = _mm_or_si128(b3, b1);
+    c2 = _mm_xor_si128(c2, b3);
+    b3 = c3;
+    b2 = _mm_srli_epi64(c2, (64-10));
+    b3 = ShiftLeft128_SSE<10>(b3, z0);
+    b2 = _mm_unpackhi_epi64(b2, z0);
+    b3 = _mm_or_si128(b3, b2);
+    b2 = c2;
+    b2 = ShiftLeft128_SSE<10>(b2, z0);
+    a0 = _mm_unpacklo_epi64(z0, b2);
+    c2 = _mm_xor_si128(c2, a0);
+    a0 = _mm_unpacklo_epi64(z0, b3);
+    a1 = _mm_unpackhi_epi64(b2, z0);
+    a0 = _mm_or_si128(a0, a1);
+    c3 = _mm_xor_si128(c3, a0);
+    c0 = _mm_xor_si128(c0, c2);
+    c1 = _mm_xor_si128(c1, c3);
+    c1 = _mm_and_si128(c1, m0);
+}
+
+#endif
+
+// ************************* Power8 ************************* //
+
+#if (CRYPTOPP_POWER8_VMULL_AVAILABLE) && 0
+
+using CryptoPP::byte;
+using CryptoPP::word;
+using CryptoPP::uint8x16_p;
+using CryptoPP::uint64x2_p;
+
+using CryptoPP::VecLoad;
+using CryptoPP::VecStore;
+
+using CryptoPP::VecOr;
+using CryptoPP::VecXor;
+using CryptoPP::VecAnd;
+
+using CryptoPP::VecPermute;
+using CryptoPP::VecMergeLow;
+using CryptoPP::VecMergeHigh;
+using CryptoPP::VecShiftLeft;
+using CryptoPP::VecShiftRight;
+
+using CryptoPP::VecIntelMultiply00;
+using CryptoPP::VecIntelMultiply11;
+
+// c1c0 = a * b
+inline void
+F2N_Multiply_128x128_POWER8(uint64x2_p& c1, uint64x2_p& c0, const uint64x2_p& a, const uint64x2_p& b)
+{
+    uint64x2_p t1, t2;
+    const uint64x2_p z0={0};
+
+    c0 = VecIntelMultiply00(a, b);
+    c1 = VecIntelMultiply11(a, b);
+    t1 = VecMergeLow(a, a);
+    t1 = VecXor(a, t1);
+    t2 = VecMergeLow(b, b);
+    t2 = VecXor(b, t2);
+    t1 = VecIntelMultiply00(t1, t2);
+    t1 = VecXor(c0, t1);
+    t1 = VecXor(c1, t1);
+    t2 = t1;
+    t1 = VecMergeHigh(z0, t1);
+    t2 = VecMergeLow(t2, z0);
+    c0 = VecXor(c0, t1);
+    c1 = VecXor(c1, t2);
+}
+
+// c3c2c1c0 = a1a0 * b1b0
+inline void
+F2N_Multiply_256x256_POWER8(uint64x2_p& c3, uint64x2_p& c2, uint64x2_p& c1, uint64x2_p& c0,
+    const uint64x2_p& b1, const uint64x2_p& b0, const uint64x2_p& a1, const uint64x2_p& a0)
+{
+    uint64x2_p c4, c5;
+    uint64x2_p x0=a0, x1=a1, y0=b0, y1=b1;
+
+    F2N_Multiply_128x128_POWER8(c1, c0, x0, y0);
+    F2N_Multiply_128x128_POWER8(c3, c2, x1, y1);
+
+    x0 = VecXor(x0, x1);
+    y0 = VecXor(y0, y1);
+
+    F2N_Multiply_128x128_POWER8(c5, c4, x0, y0);
+
+    c4 = VecXor(c4, c0);
+    c4 = VecXor(c4, c2);
+    c5 = VecXor(c5, c1);
+    c5 = VecXor(c5, c3);
+    c1 = VecXor(c1, c4);
+    c2 = VecXor(c2, c5);
+}
+
+// c3c2c1c0 = a1a0 * a1a0
+inline void
+F2N_Square_256_POWER8(uint64x2_p& c3, uint64x2_p& c2, uint64x2_p& c1,
+    uint64x2_p& c0, const uint64x2_p& a1, const uint64x2_p& a0)
+{
+    c0 = VecIntelMultiply00(a0, a0);
+    c1 = VecIntelMultiply11(a0, a0);
+    c2 = VecIntelMultiply00(a1, a1);
+    c3 = VecIntelMultiply11(a1, a1);
+}
+
+// x = (x << n), z = 0
+template <unsigned int N>
+inline uint64x2_p ShiftLeft128_POWER8(uint64x2_p x)
+{
+    uint64x2_p u=x, v;
+    const uint64x2_p z={0};
+
+    x = VecShiftLeft<N>(x);
+    u = VecShiftRight<64-N>(u);
+    v = VecMergeHigh(z, u);
+    x = VecOr(x, v);
+    return x;
+}
+
+// c1c0 = c3c2c1c0 MOD p. This is a Barrett reduction. Reading at
+// Intel paper or https://github.com/antonblanchard/crc32-vpmsum.
+inline void
+GF2NT_233_Reduce_POWER8(uint64x2_p& c3, uint64x2_p& c2, uint64x2_p& c1, uint64x2_p& c0)
+{
+    const uint64_t mod[] = {W64LIT(0xffffffffffffffff), W64LIT(0x01ffffffffff)};
+    const uint64x2_p m0 = (uint64x2_p)VecLoad(mod);
+
+    uint64x2_p b3, b2, b1, /*b0,*/ a1, a0;
+    const uint64x2_p z0={0};
+
+    b1 = c1; a1 = c1;
+    a0 = VecMergeHigh(c1, z0);
+    a1 = VecShiftLeft<23>(a1);
+    a1 = VecShiftRight<23>(a1);
+    c1 = VecOr(a1, a0);
+    b2 = VecShiftRight<64-23>(c2);
+    c3 = ShiftLeft128_POWER8<23>(c3);
+    a0 = VecMergeLow(b2, z0);
+    c3 = VecOr(c3, a0);
+    b1 = VecShiftRight<64-23>(b1);
+    c2 = ShiftLeft128_POWER8<23>(c2);
+    a0 = VecMergeLow(b1, z0);
+    c2 = VecOr(c2, a0);
+    b3 = c3;
+    b2 = VecShiftRight<64-10>(c2);
+    b3 = ShiftLeft128_POWER8<10>(b3);
+    a0 = VecMergeLow(b2, z0);
+    b3 = VecOr(b3, a0);
+    a0 = VecMergeLow(c3, z0);
+    b3 = VecXor(b3, a0);
+    b1 = VecShiftRight<64-23>(b3);
+    b3 = ShiftLeft128_POWER8<23>(b3);
+    b3 = VecMergeLow(b3, z0);
+    b3 = VecOr(b3, b1);
+    c2 = VecXor(c2, b3);
+    b3 = c3;
+    b2 = VecShiftRight<64-10>(c2);
+    b3 = ShiftLeft128_POWER8<10>(b3);
+    b2 = VecMergeLow(b2, z0);
+    b3 = VecOr(b3, b2);
+    b2 = c2;
+    b2 = ShiftLeft128_POWER8<10>(b2);
+    a0 = VecMergeHigh(z0, b2);
+    c2 = VecXor(c2, a0);
+    a0 = VecMergeHigh(z0, b3);
+    a1 = VecMergeLow(b2, z0);
+    a0 = VecOr(a0, a1);
+    c3 = VecXor(c3, a0);
+    c0 = VecXor(c0, c2);
+    c1 = VecXor(c1, c3);
+    c1 = VecAnd(c1, m0);
+}
+
+#endif
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (CRYPTOPP_CLMUL_AVAILABLE)
+
+void
+GF2NT_233_Multiply_Reduce_CLMUL(const word* pA, const word* pB, word* pC)
+{
+    enum {S=sizeof(__m128i)/sizeof(word)};
+    __m128i a0 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(pA+0*S));
+    __m128i a1 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(pA+1*S));
+    __m128i b0 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(pB+0*S));
+    __m128i b1 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(pB+1*S));
+
+    __m128i c0, c1, c2, c3;
+    F2N_Multiply_256x256_CLMUL(c3, c2, c1, c0, a1, a0, b1, b0);
+    GF2NT_233_Reduce_CLMUL(c3, c2, c1, c0);
+
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(pC+0*S), c0);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(pC+1*S), c1);
+}
+
+void
+GF2NT_233_Square_Reduce_CLMUL(const word* pA, word* pC)
+{
+    enum {S=sizeof(__m128i)/sizeof(word)};
+    __m128i a0 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(pA+0*S));
+    __m128i a1 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(pA+1*S));
+
+    __m128i c0, c1, c2, c3;
+    F2N_Square_256_CLMUL(c3, c2, c1, c0, a1, a0);
+    GF2NT_233_Reduce_CLMUL(c3, c2, c1, c0);
+
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(pC+0*S), c0);
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(pC+1*S), c1);
+}
+
+#elif (CRYPTOPP_ARM_PMULL_AVAILABLE)
+
+void
+GF2NT_233_Multiply_Reduce_ARMv8(const word* pA, const word* pB, word* pC)
+{
+    // word is either 32-bit or 64-bit, depending on the platform.
+    // Load using a 32-bit pointer to avoid possible alignment issues.
+    const uint32_t* pAA = reinterpret_cast<const uint32_t*>(pA);
+    const uint32_t* pBB = reinterpret_cast<const uint32_t*>(pB);
+
+    uint64x2_t a0 = vreinterpretq_u64_u32(vld1q_u32(pAA+0));
+    uint64x2_t a1 = vreinterpretq_u64_u32(vld1q_u32(pAA+4));
+    uint64x2_t b0 = vreinterpretq_u64_u32(vld1q_u32(pBB+0));
+    uint64x2_t b1 = vreinterpretq_u64_u32(vld1q_u32(pBB+4));
+
+    uint64x2_t c0, c1, c2, c3;
+    F2N_Multiply_256x256_ARMv8(c3, c2, c1, c0, a1, a0, b1, b0);
+    GF2NT_233_Reduce_ARMv8(c3, c2, c1, c0);
+
+    uint32_t* pCC = reinterpret_cast<uint32_t*>(pC);
+    vst1q_u32(pCC+0, vreinterpretq_u32_u64(c0));
+    vst1q_u32(pCC+4, vreinterpretq_u32_u64(c1));
+}
+
+void
+GF2NT_233_Square_Reduce_ARMv8(const word* pA, word* pC)
+{
+    // word is either 32-bit or 64-bit, depending on the platform.
+    // Load using a 32-bit pointer to avoid possible alignment issues.
+    const uint32_t* pAA = reinterpret_cast<const uint32_t*>(pA);
+    uint64x2_t a0 = vreinterpretq_u64_u32(vld1q_u32(pAA+0));
+    uint64x2_t a1 = vreinterpretq_u64_u32(vld1q_u32(pAA+4));
+
+    uint64x2_t c0, c1, c2, c3;
+    F2N_Square_256_ARMv8(c3, c2, c1, c0, a1, a0);
+    GF2NT_233_Reduce_ARMv8(c3, c2, c1, c0);
+
+    uint32_t* pCC = reinterpret_cast<uint32_t*>(pC);
+    vst1q_u32(pCC+0, vreinterpretq_u32_u64(c0));
+    vst1q_u32(pCC+4, vreinterpretq_u32_u64(c1));
+}
+
+#elif (CRYPTOPP_POWER8_VMULL_AVAILABLE) && 0
+
+void
+GF2NT_233_Multiply_Reduce_POWER8(const word* pA, const word* pB, word* pC)
+{
+    // word is either 32-bit or 64-bit, depending on the platform.
+    // Load using a byte pointer to avoid possible alignment issues.
+    const byte* pAA = reinterpret_cast<const byte*>(pA);
+    const byte* pBB = reinterpret_cast<const byte*>(pB);
+
+    uint64x2_p a0 = (uint64x2_p)VecLoad(pAA+0);
+    uint64x2_p a1 = (uint64x2_p)VecLoad(pAA+16);
+    uint64x2_p b0 = (uint64x2_p)VecLoad(pBB+0);
+    uint64x2_p b1 = (uint64x2_p)VecLoad(pBB+16);
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8_t mb[] = {4,5,6,7, 0,1,2,3, 12,13,14,15, 8,9,10,11};
+    const uint8x16_p m = (uint8x16_p)VecLoad(mb);
+    a0 = VecPermute(a0, m);
+    a1 = VecPermute(a1, m);
+    b0 = VecPermute(b0, m);
+    b1 = VecPermute(b1, m);
+#endif
+
+    uint64x2_p c0, c1, c2, c3;
+    F2N_Multiply_256x256_POWER8(c3, c2, c1, c0, a1, a0, b1, b0);
+    GF2NT_233_Reduce_POWER8(c3, c2, c1, c0);
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    c0 = VecPermute(c0, m);
+    c1 = VecPermute(c1, m);
+#endif
+
+    byte* pCC = reinterpret_cast<byte*>(pC);
+    VecStore(c0, pCC+0);
+    VecStore(c1, pCC+16);
+}
+
+void
+GF2NT_233_Square_Reduce_POWER8(const word* pA, word* pC)
+{
+    // word is either 32-bit or 64-bit, depending on the platform.
+    // Load using a byte pointer to avoid possible alignment issues.
+    const byte* pAA = reinterpret_cast<const byte*>(pA);
+    uint64x2_p a0 = (uint64x2_p)VecLoad(pAA+0);
+    uint64x2_p a1 = (uint64x2_p)VecLoad(pAA+16);
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8_t mb[] = {4,5,6,7, 0,1,2,3, 12,13,14,15, 8,9,10,11};
+    const uint8x16_p m = (uint8x16_p)VecLoad(mb);
+    a0 = VecPermute(a0, m);
+    a1 = VecPermute(a1, m);
+#endif
+
+    uint64x2_p c0, c1, c2, c3;
+    F2N_Square_256_POWER8(c3, c2, c1, c0, a1, a0);
+    GF2NT_233_Reduce_POWER8(c3, c2, c1, c0);
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    c0 = VecPermute(c0, m);
+    c1 = VecPermute(c1, m);
+#endif
+
+    byte* pCC = reinterpret_cast<byte*>(pC);
+    VecStore(c0, pCC+0);
+    VecStore(c1, pCC+16);
+}
+
+#endif
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_IMPORTS
diff --git a/runtime/third_party/cryptopp/gfpcrypt.cpp b/runtime/third_party/cryptopp/gfpcrypt.cpp
new file mode 100644
index 0000000..18e9274
--- /dev/null
+++ b/runtime/third_party/cryptopp/gfpcrypt.cpp
@@ -0,0 +1,334 @@
+// dsa.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+// TODO: fix the C4589 warnings
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4189 4589)
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "gfpcrypt.h"
+#include "nbtheory.h"
+#include "modarith.h"
+#include "integer.h"
+#include "asn.h"
+#include "oids.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void TestInstantiations_gfpcrypt()
+{
+	GDSA<SHA1>::Signer test;
+	GDSA<SHA1>::Verifier test1;
+	DSA::Signer test5(NullRNG(), 100);
+	DSA::Signer test2(test5);
+	NR<SHA1>::Signer test3;
+	NR<SHA1>::Verifier test4;
+	DLIES<>::Encryptor test6;
+	DLIES<>::Decryptor test7;
+}
+#endif
+
+void DL_GroupParameters_DSA::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg)
+{
+	Integer p, q, g;
+
+	if (alg.GetValue("Modulus", p) && alg.GetValue("SubgroupGenerator", g))
+	{
+		q = alg.GetValueWithDefault("SubgroupOrder", ComputeGroupOrder(p)/2);
+		Initialize(p, q, g);
+	}
+	else
+	{
+		int modulusSize = 2048, defaultSubgroupOrderSize;
+		alg.GetIntValue("ModulusSize", modulusSize) || alg.GetIntValue("KeySize", modulusSize);
+
+		switch (modulusSize)
+		{
+		case 1024:
+			defaultSubgroupOrderSize = 160;
+			break;
+		case 2048:
+			defaultSubgroupOrderSize = 224;
+			break;
+		case 3072:
+			defaultSubgroupOrderSize = 256;
+			break;
+		default:
+			throw InvalidArgument("DSA: not a valid prime length");
+		}
+
+		DL_GroupParameters_GFP::GenerateRandom(rng, CombinedNameValuePairs(alg, MakeParameters(Name::SubgroupOrderSize(), defaultSubgroupOrderSize, false)));
+	}
+}
+
+bool DL_GroupParameters_DSA::ValidateGroup(RandomNumberGenerator &rng, unsigned int level) const
+{
+	bool pass = DL_GroupParameters_GFP::ValidateGroup(rng, level);
+	CRYPTOPP_ASSERT(pass);
+
+	const int pSize = GetModulus().BitCount(), qSize = GetSubgroupOrder().BitCount();
+	pass = pass && ((pSize==1024 && qSize==160) || (pSize==2048 && qSize==224) || (pSize==2048 && qSize==256) || (pSize==3072 && qSize==256));
+	CRYPTOPP_ASSERT(pass);
+
+	return pass;
+}
+
+void DL_SignatureMessageEncodingMethod_DSA::ComputeMessageRepresentative(RandomNumberGenerator &rng,
+	const byte *recoverableMessage, size_t recoverableMessageLength,
+	HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+	byte *representative, size_t representativeBitLength) const
+{
+	CRYPTOPP_UNUSED(rng), CRYPTOPP_UNUSED(recoverableMessage), CRYPTOPP_UNUSED(recoverableMessageLength);
+	CRYPTOPP_UNUSED(messageEmpty), CRYPTOPP_UNUSED(hashIdentifier);
+	CRYPTOPP_ASSERT(recoverableMessageLength == 0);
+	CRYPTOPP_ASSERT(hashIdentifier.second == 0);
+
+	const size_t representativeByteLength = BitsToBytes(representativeBitLength);
+	const size_t digestSize = hash.DigestSize();
+	const size_t paddingLength = SaturatingSubtract(representativeByteLength, digestSize);
+
+	std::memset(representative, 0, paddingLength);
+	hash.TruncatedFinal(representative+paddingLength, STDMIN(representativeByteLength, digestSize));
+
+	if (digestSize*8 > representativeBitLength)
+	{
+		Integer h(representative, representativeByteLength);
+		h >>= representativeByteLength*8 - representativeBitLength;
+		h.Encode(representative, representativeByteLength);
+	}
+}
+
+void DL_SignatureMessageEncodingMethod_NR::ComputeMessageRepresentative(RandomNumberGenerator &rng,
+	const byte *recoverableMessage, size_t recoverableMessageLength,
+	HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+	byte *representative, size_t representativeBitLength) const
+{
+	CRYPTOPP_UNUSED(rng);CRYPTOPP_UNUSED(recoverableMessage); CRYPTOPP_UNUSED(recoverableMessageLength);
+	CRYPTOPP_UNUSED(hash); CRYPTOPP_UNUSED(hashIdentifier); CRYPTOPP_UNUSED(messageEmpty);
+	CRYPTOPP_UNUSED(representative); CRYPTOPP_UNUSED(representativeBitLength);
+
+	CRYPTOPP_ASSERT(recoverableMessageLength == 0);
+	CRYPTOPP_ASSERT(hashIdentifier.second == 0);
+	const size_t representativeByteLength = BitsToBytes(representativeBitLength);
+	const size_t digestSize = hash.DigestSize();
+	const size_t paddingLength = SaturatingSubtract(representativeByteLength, digestSize);
+
+	std::memset(representative, 0, paddingLength);
+	hash.TruncatedFinal(representative+paddingLength, STDMIN(representativeByteLength, digestSize));
+
+	if (digestSize*8 >= representativeBitLength)
+	{
+		Integer h(representative, representativeByteLength);
+		h >>= representativeByteLength*8 - representativeBitLength + 1;
+		h.Encode(representative, representativeByteLength);
+	}
+}
+
+bool DL_GroupParameters_IntegerBased::ValidateGroup(RandomNumberGenerator &rng, unsigned int level) const
+{
+	const Integer &p = GetModulus(), &q = GetSubgroupOrder();
+	bool pass = true;
+
+	CRYPTOPP_ASSERT(p > Integer::One() && p.IsOdd());
+	pass = pass && p > Integer::One() && p.IsOdd();
+
+	CRYPTOPP_ASSERT(q > Integer::One() && q.IsOdd());
+	pass = pass && q > Integer::One() && q.IsOdd();
+
+	if (level >= 1)
+	{
+		CRYPTOPP_ASSERT(GetCofactor() > Integer::One());
+		CRYPTOPP_ASSERT(GetGroupOrder() % q == Integer::Zero());
+
+		pass = pass && GetCofactor() > Integer::One() && GetGroupOrder() % q == Integer::Zero();
+	}
+	if (level >= 2)
+	{
+		CRYPTOPP_ASSERT(VerifyPrime(rng, q, level-2));
+		CRYPTOPP_ASSERT(VerifyPrime(rng, p, level-2));
+
+		pass = pass && VerifyPrime(rng, q, level-2) && VerifyPrime(rng, p, level-2);
+	}
+
+	return pass;
+}
+
+bool DL_GroupParameters_IntegerBased::ValidateElement(unsigned int level, const Integer &g, const DL_FixedBasePrecomputation<Integer> *gpc) const
+{
+	const Integer &p = GetModulus(), &q = GetSubgroupOrder();
+	bool pass = true;
+
+	CRYPTOPP_ASSERT(GetFieldType() == 1 ? g.IsPositive() : g.NotNegative());
+	pass = pass && GetFieldType() == 1 ? g.IsPositive() : g.NotNegative();
+
+	CRYPTOPP_ASSERT(g < p && !IsIdentity(g));
+	pass = pass && g < p && !IsIdentity(g);
+
+	if (level >= 1)
+	{
+		if (gpc)
+		{
+			CRYPTOPP_ASSERT(gpc->Exponentiate(GetGroupPrecomputation(), Integer::One()) == g);
+			pass = pass && gpc->Exponentiate(GetGroupPrecomputation(), Integer::One()) == g;
+		}
+	}
+	if (level >= 2)
+	{
+		if (GetFieldType() == 2)
+		{
+			CRYPTOPP_ASSERT(Jacobi(g*g-4, p)==-1);
+			pass = pass && Jacobi(g*g-4, p)==-1;
+		}
+
+		// verifying that Lucas((p+1)/2, w, p)==2 is omitted because it's too costly
+		// and at most 1 bit is leaked if it's false
+		bool fullValidate = (GetFieldType() == 2 && level >= 3) || !FastSubgroupCheckAvailable();
+
+		if (fullValidate && pass)
+		{
+			Integer gp = gpc ? gpc->Exponentiate(GetGroupPrecomputation(), q) : ExponentiateElement(g, q);
+			CRYPTOPP_ASSERT(IsIdentity(gp));
+			pass = pass && IsIdentity(gp);
+		}
+		else if (GetFieldType() == 1)
+		{
+			CRYPTOPP_ASSERT(Jacobi(g, p) == 1);
+			pass = pass && Jacobi(g, p) == 1;
+		}
+	}
+
+	return pass;
+}
+
+void DL_GroupParameters_IntegerBased::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg)
+{
+	Integer p, q, g;
+
+	if (alg.GetValue("Modulus", p) && alg.GetValue("SubgroupGenerator", g))
+	{
+		q = alg.GetValueWithDefault("SubgroupOrder", ComputeGroupOrder(p)/2);
+	}
+	else
+	{
+		int modulusSize, subgroupOrderSize;
+
+		if (!alg.GetIntValue("ModulusSize", modulusSize))
+			modulusSize = alg.GetIntValueWithDefault("KeySize", 2048);
+
+		if (!alg.GetIntValue("SubgroupOrderSize", subgroupOrderSize))
+			subgroupOrderSize = GetDefaultSubgroupOrderSize(modulusSize);
+
+		PrimeAndGenerator pg;
+		pg.Generate(GetFieldType() == 1 ? 1 : -1, rng, modulusSize, subgroupOrderSize);
+		p = pg.Prime();
+		q = pg.SubPrime();
+		g = pg.Generator();
+	}
+
+	Initialize(p, q, g);
+}
+
+void DL_GroupParameters_IntegerBased::EncodeElement(bool reversible, const Element &element, byte *encoded) const
+{
+	CRYPTOPP_UNUSED(reversible);
+	element.Encode(encoded, GetModulus().ByteCount());
+}
+
+unsigned int DL_GroupParameters_IntegerBased::GetEncodedElementSize(bool reversible) const
+{
+	CRYPTOPP_UNUSED(reversible);
+	return GetModulus().ByteCount();
+}
+
+Integer DL_GroupParameters_IntegerBased::DecodeElement(const byte *encoded, bool checkForGroupMembership) const
+{
+	CRYPTOPP_UNUSED(checkForGroupMembership);
+	Integer g(encoded, GetModulus().ByteCount());
+	if (!ValidateElement(1, g, NULLPTR))
+		throw DL_BadElement();
+	return g;
+}
+
+void DL_GroupParameters_IntegerBased::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder parameters(bt);
+		Integer p(parameters);
+		Integer q(parameters);
+		Integer g;
+		if (parameters.EndReached())
+		{
+			g = q;
+			q = ComputeGroupOrder(p) / 2;
+		}
+		else
+			g.BERDecode(parameters);
+	parameters.MessageEnd();
+
+	SetModulusAndSubgroupGenerator(p, g);
+	SetSubgroupOrder(q);
+}
+
+void DL_GroupParameters_IntegerBased::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder parameters(bt);
+		GetModulus().DEREncode(parameters);
+		m_q.DEREncode(parameters);
+		GetSubgroupGenerator().DEREncode(parameters);
+	parameters.MessageEnd();
+}
+
+bool DL_GroupParameters_IntegerBased::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper<DL_GroupParameters<Element> >(this, name, valueType, pValue)
+		CRYPTOPP_GET_FUNCTION_ENTRY(Modulus);
+}
+
+void DL_GroupParameters_IntegerBased::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY2(Modulus, SubgroupGenerator)
+		CRYPTOPP_SET_FUNCTION_ENTRY(SubgroupOrder)
+		;
+}
+
+OID DL_GroupParameters_IntegerBased::GetAlgorithmID() const
+{
+	return ASN1::id_dsa();
+}
+
+void DL_GroupParameters_GFP::SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const
+{
+	ModularArithmetic ma(GetModulus());
+	ma.SimultaneousExponentiate(results, base, exponents, exponentsCount);
+}
+
+DL_GroupParameters_GFP::Element DL_GroupParameters_GFP::MultiplyElements(const Element &a, const Element &b) const
+{
+	return a_times_b_mod_c(a, b, GetModulus());
+}
+
+DL_GroupParameters_GFP::Element DL_GroupParameters_GFP::CascadeExponentiate(const Element &element1, const Integer &exponent1, const Element &element2, const Integer &exponent2) const
+{
+	ModularArithmetic ma(GetModulus());
+	return ma.CascadeExponentiate(element1, exponent1, element2, exponent2);
+}
+
+Integer DL_GroupParameters_IntegerBased::GetMaxExponent() const
+{
+	return STDMIN(GetSubgroupOrder()-1, Integer::Power2(2*DiscreteLogWorkFactor(GetFieldType()*GetModulus().BitCount())));
+}
+
+unsigned int DL_GroupParameters_IntegerBased::GetDefaultSubgroupOrderSize(unsigned int modulusSize) const
+{
+	return 2*DiscreteLogWorkFactor(GetFieldType()*modulusSize);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/gfpcrypt.h b/runtime/third_party/cryptopp/gfpcrypt.h
new file mode 100644
index 0000000..741ee47
--- /dev/null
+++ b/runtime/third_party/cryptopp/gfpcrypt.h
@@ -0,0 +1,1036 @@
+// gfpcrypt.h - originally written and placed in the public domain by Wei Dai
+//              RFC6979 deterministic signatures added by Douglas Roark
+//              ECGDSA added by Jeffrey Walton
+
+/// \file gfpcrypt.h
+/// \brief Classes and functions for schemes based on Discrete Logs (DL) over GF(p)
+
+#ifndef CRYPTOPP_GFPCRYPT_H
+#define CRYPTOPP_GFPCRYPT_H
+
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4189 4231 4275)
+#endif
+
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "integer.h"
+#include "modexppc.h"
+#include "algparam.h"
+#include "smartptr.h"
+#include "sha.h"
+#include "asn.h"
+#include "hmac.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_GroupParameters<Integer>;
+
+/// \brief Integer-based GroupParameters specialization
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE DL_GroupParameters_IntegerBased : public ASN1CryptoMaterial<DL_GroupParameters<Integer> >
+{
+    typedef DL_GroupParameters_IntegerBased ThisClass;
+
+public:
+    virtual ~DL_GroupParameters_IntegerBased() {}
+
+    /// \brief Initialize a group parameters over integers
+    /// \param params the group parameters
+    void Initialize(const DL_GroupParameters_IntegerBased &params)
+        {Initialize(params.GetModulus(), params.GetSubgroupOrder(), params.GetSubgroupGenerator());}
+
+    /// \brief Create a group parameters over integers
+    /// \param rng a RandomNumberGenerator derived class
+    /// \param pbits the size of p, in bits
+    /// \details This function overload of Initialize() creates a new private key because it
+    ///  takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+    ///  then use one of the other Initialize() overloads.
+    void Initialize(RandomNumberGenerator &rng, unsigned int pbits)
+        {GenerateRandom(rng, MakeParameters("ModulusSize", (int)pbits));}
+
+    /// \brief Initialize a group parameters over integers
+    /// \param p the modulus
+    /// \param g the generator
+    void Initialize(const Integer &p, const Integer &g)
+        {SetModulusAndSubgroupGenerator(p, g); SetSubgroupOrder(ComputeGroupOrder(p)/2);}
+
+    /// \brief Initialize a group parameters over integers
+    /// \param p the modulus
+    /// \param q the subgroup order
+    /// \param g the generator
+    void Initialize(const Integer &p, const Integer &q, const Integer &g)
+        {SetModulusAndSubgroupGenerator(p, g); SetSubgroupOrder(q);}
+
+    // ASN1Object interface
+    void BERDecode(BufferedTransformation &bt);
+    void DEREncode(BufferedTransformation &bt) const;
+
+    /// \brief Generate a random key
+    /// \param rng a RandomNumberGenerator to produce keying material
+    /// \param alg additional initialization parameters
+    /// \details Recognised NameValuePairs are ModulusSize and
+    ///  SubgroupOrderSize (optional)
+    /// \throw KeyingErr if a key can't be generated or algorithm parameters
+    ///  are invalid
+    void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
+
+    /// \brief Get a named value
+    /// \param name the name of the object or value to retrieve
+    /// \param valueType reference to a variable that receives the value
+    /// \param pValue void pointer to a variable that receives the value
+    /// \return true if the value was retrieved, false otherwise
+    /// \details GetVoidValue() retrieves the value of name if it exists.
+    /// \note GetVoidValue() is an internal function and should be implemented
+    ///  by derived classes. Users should use one of the other functions instead.
+    /// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+    ///  GetRequiredParameter() and GetRequiredIntParameter()
+    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+
+    /// \brief Initialize or reinitialize this key
+    /// \param source NameValuePairs to assign
+    void AssignFrom(const NameValuePairs &source);
+
+    // DL_GroupParameters
+    const Integer & GetSubgroupOrder() const {return m_q;}
+    Integer GetGroupOrder() const {return GetFieldType() == 1 ? GetModulus()-Integer::One() : GetModulus()+Integer::One();}
+    bool ValidateGroup(RandomNumberGenerator &rng, unsigned int level) const;
+    bool ValidateElement(unsigned int level, const Integer &element, const DL_FixedBasePrecomputation<Integer> *precomp) const;
+
+    /// \brief Determine if subgroup membership check is fast
+    /// \return true or false
+    bool FastSubgroupCheckAvailable() const {return GetCofactor() == 2;}
+
+    /// \brief Encodes the element
+    /// \param reversible flag indicating the encoding format
+    /// \param element reference to the element to encode
+    /// \param encoded destination byte array for the encoded element
+    /// \details EncodeElement() must be implemented in a derived class.
+    /// \pre <tt>COUNTOF(encoded) == GetEncodedElementSize()</tt>
+    /// \sa GetEncodedElementSize(), DecodeElement(), <A
+    ///  HREF="http://github.com/weidai11/cryptopp/issues/40">Cygwin
+    ///  i386 crash at -O3</A>
+    void EncodeElement(bool reversible, const Element &element, byte *encoded) const;
+
+    /// \brief Retrieve the encoded element's size
+    /// \param reversible flag indicating the encoding format
+    /// \return encoded element's size, in bytes
+    /// \details The format of the encoded element varies by the underlying
+    ///  type of the element and the reversible flag.
+    /// \sa EncodeElement(), DecodeElement()
+    unsigned int GetEncodedElementSize(bool reversible) const;
+
+    /// \brief Decodes the element
+    /// \param encoded byte array with the encoded element
+    /// \param checkForGroupMembership flag indicating if the element should be validated
+    /// \return Element after decoding
+    /// \details DecodeElement() must be implemented in a derived class.
+    /// \pre <tt>COUNTOF(encoded) == GetEncodedElementSize()</tt>
+    /// \sa GetEncodedElementSize(), EncodeElement()
+    Integer DecodeElement(const byte *encoded, bool checkForGroupMembership) const;
+
+    /// \brief Converts an element to an Integer
+    /// \param element the element to convert to an Integer
+    /// \return Element after converting to an Integer
+    /// \details ConvertElementToInteger() must be implemented in a derived class.
+    Integer ConvertElementToInteger(const Element &element) const
+        {return element;}
+
+    /// \brief Retrieve the maximum exponent for the group
+    /// \return the maximum exponent for the group
+    Integer GetMaxExponent() const;
+
+    /// \brief Retrieve the OID of the algorithm
+    /// \return OID of the algorithm
+    OID GetAlgorithmID() const;
+
+    /// \brief Retrieve the modulus for the group
+    /// \return the modulus for the group
+    virtual const Integer & GetModulus() const =0;
+
+    /// \brief Set group parameters
+    /// \param p the prime modulus
+    /// \param g the group generator
+    virtual void SetModulusAndSubgroupGenerator(const Integer &p, const Integer &g) =0;
+
+    /// \brief Set subgroup order
+    /// \param q the subgroup order
+    void SetSubgroupOrder(const Integer &q)
+        {m_q = q; ParametersChanged();}
+
+    static std::string CRYPTOPP_API StaticAlgorithmNamePrefix() {return "";}
+
+protected:
+    Integer ComputeGroupOrder(const Integer &modulus) const
+        {return modulus-(GetFieldType() == 1 ? 1 : -1);}
+
+    // GF(p) = 1, GF(p^2) = 2
+    virtual int GetFieldType() const =0;
+    virtual unsigned int GetDefaultSubgroupOrderSize(unsigned int modulusSize) const;
+
+private:
+    Integer m_q;
+};
+
+/// \brief Integer-based GroupParameters default implementation
+/// \tparam GROUP_PRECOMP group parameters precomputation specialization
+/// \tparam BASE_PRECOMP base class precomputation specialization
+template <class GROUP_PRECOMP, class BASE_PRECOMP = DL_FixedBasePrecomputationImpl<typename GROUP_PRECOMP::Element> >
+class CRYPTOPP_NO_VTABLE DL_GroupParameters_IntegerBasedImpl : public DL_GroupParametersImpl<GROUP_PRECOMP, BASE_PRECOMP, DL_GroupParameters_IntegerBased>
+{
+    typedef DL_GroupParameters_IntegerBasedImpl<GROUP_PRECOMP, BASE_PRECOMP> ThisClass;
+
+public:
+    typedef typename GROUP_PRECOMP::Element Element;
+
+    virtual ~DL_GroupParameters_IntegerBasedImpl() {}
+
+    // GeneratibleCryptoMaterial interface
+    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+        {return GetValueHelper<DL_GroupParameters_IntegerBased>(this, name, valueType, pValue).Assignable();}
+
+    void AssignFrom(const NameValuePairs &source)
+        {AssignFromHelper<DL_GroupParameters_IntegerBased>(this, source);}
+
+    // DL_GroupParameters
+    const DL_FixedBasePrecomputation<Element> & GetBasePrecomputation() const {return this->m_gpc;}
+    DL_FixedBasePrecomputation<Element> & AccessBasePrecomputation() {return this->m_gpc;}
+
+    // IntegerGroupParameters
+    /// \brief Retrieve the modulus for the group
+    /// \return the modulus for the group
+    const Integer & GetModulus() const {return this->m_groupPrecomputation.GetModulus();}
+
+    /// \brief Retrieves a reference to the group generator
+    /// \return const reference to the group generator
+    const Integer & GetGenerator() const {return this->m_gpc.GetBase(this->GetGroupPrecomputation());}
+
+    void SetModulusAndSubgroupGenerator(const Integer &p, const Integer &g)        // these have to be set together
+        {this->m_groupPrecomputation.SetModulus(p); this->m_gpc.SetBase(this->GetGroupPrecomputation(), g); this->ParametersChanged();}
+
+    // non-inherited
+    bool operator==(const DL_GroupParameters_IntegerBasedImpl<GROUP_PRECOMP, BASE_PRECOMP> &rhs) const
+        {return GetModulus() == rhs.GetModulus() && GetGenerator() == rhs.GetGenerator() && this->GetSubgroupOrder() == rhs.GetSubgroupOrder();}
+    bool operator!=(const DL_GroupParameters_IntegerBasedImpl<GROUP_PRECOMP, BASE_PRECOMP> &rhs) const
+        {return !operator==(rhs);}
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_GroupParameters_IntegerBasedImpl<ModExpPrecomputation>;
+
+/// \brief GF(p) group parameters
+class CRYPTOPP_DLL DL_GroupParameters_GFP : public DL_GroupParameters_IntegerBasedImpl<ModExpPrecomputation>
+{
+public:
+    virtual ~DL_GroupParameters_GFP() {}
+
+    /// \brief Determines if an element is an identity
+    /// \param element element to check
+    /// \return true if the element is an identity, false otherwise
+    /// \details The identity element or or neutral element is a special element
+    ///  in a group that leaves other elements unchanged when combined with it.
+    /// \details IsIdentity() must be implemented in a derived class.
+    bool IsIdentity(const Integer &element) const {return element == Integer::One();}
+
+    /// \brief Exponentiates a base to multiple exponents
+    /// \param results an array of Elements
+    /// \param base the base to raise to the exponents
+    /// \param exponents an array of exponents
+    /// \param exponentsCount the number of exponents in the array
+    /// \details SimultaneousExponentiate() raises the base to each exponent in
+    ///  the exponents array and stores the result at the respective position in
+    ///  the results array.
+    /// \details SimultaneousExponentiate() must be implemented in a derived class.
+    /// \pre <tt>COUNTOF(results) == exponentsCount</tt>
+    /// \pre <tt>COUNTOF(exponents) == exponentsCount</tt>
+    void SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const;
+
+    /// \brief Get a named value
+    /// \param name the name of the object or value to retrieve
+    /// \param valueType reference to a variable that receives the value
+    /// \param pValue void pointer to a variable that receives the value
+    /// \return true if the value was retrieved, false otherwise
+    /// \details GetVoidValue() retrieves the value of name if it exists.
+    /// \note GetVoidValue() is an internal function and should be implemented
+    ///  by derived classes. Users should use one of the other functions instead.
+    /// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+    ///  GetRequiredParameter() and GetRequiredIntParameter()
+    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+    {
+        return GetValueHelper<DL_GroupParameters_IntegerBased>(this, name, valueType, pValue).Assignable();
+    }
+
+    // used by MQV
+    Element MultiplyElements(const Element &a, const Element &b) const;
+    Element CascadeExponentiate(const Element &element1, const Integer &exponent1, const Element &element2, const Integer &exponent2) const;
+
+protected:
+    int GetFieldType() const {return 1;}
+};
+
+/// \brief GF(p) group parameters that default to safe primes
+class CRYPTOPP_DLL DL_GroupParameters_GFP_DefaultSafePrime : public DL_GroupParameters_GFP
+{
+public:
+    typedef NoCofactorMultiplication DefaultCofactorOption;
+
+    virtual ~DL_GroupParameters_GFP_DefaultSafePrime() {}
+
+protected:
+    unsigned int GetDefaultSubgroupOrderSize(unsigned int modulusSize) const {return modulusSize-1;}
+};
+
+/// ElGamal encryption for safe interop
+/// \sa <A HREF="https://eprint.iacr.org/2021/923.pdf">On the
+///  (in)security of ElGamal in OpenPGP</A>,
+///  <A HREF="https://github.com/weidai11/cryptopp/issues/1059">Issue 1059</A>,
+///  <A HREF="https://nvd.nist.gov/vuln/detail/CVE-2021-40530">CVE-2021-40530</A>
+/// \since Crypto++ 8.6
+class CRYPTOPP_DLL DL_GroupParameters_ElGamal : public DL_GroupParameters_GFP_DefaultSafePrime
+{
+public:
+    typedef NoCofactorMultiplication DefaultCofactorOption;
+
+    virtual ~DL_GroupParameters_ElGamal() {}
+
+	Integer GetMaxExponent() const
+	{
+		return GetSubgroupOrder()-1;
+	}
+};
+
+/// \brief GDSA algorithm
+/// \tparam T FieldElement type or class
+/// \details FieldElement <tt>T</tt> can be Integer, ECP or EC2N.
+template <class T>
+class DL_Algorithm_GDSA : public DL_ElgamalLikeSignatureAlgorithm<T>
+{
+public:
+    CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "DSA-1363";}
+
+    virtual ~DL_Algorithm_GDSA() {}
+
+    void Sign(const DL_GroupParameters<T> &params, const Integer &x, const Integer &k, const Integer &e, Integer &r, Integer &s) const
+    {
+        const Integer &q = params.GetSubgroupOrder();
+        r %= q;
+        Integer kInv = k.InverseMod(q);
+        s = (kInv * (x*r + e)) % q;
+        CRYPTOPP_ASSERT(!!r && !!s);
+    }
+
+    bool Verify(const DL_GroupParameters<T> &params, const DL_PublicKey<T> &publicKey, const Integer &e, const Integer &r, const Integer &s) const
+    {
+        const Integer &q = params.GetSubgroupOrder();
+        if (r>=q || r<1 || s>=q || s<1)
+            return false;
+
+        Integer w = s.InverseMod(q);
+        Integer u1 = (e * w) % q;
+        Integer u2 = (r * w) % q;
+        // verify r == (g^u1 * y^u2 mod p) mod q
+        return r == params.ConvertElementToInteger(publicKey.CascadeExponentiateBaseAndPublicElement(u1, u2)) % q;
+    }
+};
+
+/// \brief DSA signature algorithm based on RFC 6979
+/// \tparam T FieldElement type or class
+/// \tparam H HashTransformation derived class
+/// \details FieldElement <tt>T</tt> can be Integer, ECP or EC2N.
+/// \sa <a href="http://tools.ietf.org/rfc/rfc6979.txt">RFC 6979, Deterministic Usage of the
+///  Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)</a>
+/// \since Crypto++ 6.0
+template <class T, class H>
+class DL_Algorithm_DSA_RFC6979 : public DL_Algorithm_GDSA<T>, public DeterministicSignatureAlgorithm
+{
+public:
+    CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "DSA-RFC6979";}
+
+    virtual ~DL_Algorithm_DSA_RFC6979() {}
+
+    bool IsProbabilistic() const
+        {return false;}
+    bool IsDeterministic() const
+        {return true;}
+
+    // Deterministic K
+    Integer GenerateRandom(const Integer &x, const Integer &q, const Integer &e) const
+    {
+        static const byte zero = 0, one = 1;
+        const size_t qlen = q.BitCount();
+        const size_t rlen = BitsToBytes(qlen);
+
+        // Step (a) - formatted E(m)
+        SecByteBlock BH(e.MinEncodedSize());
+        e.Encode(BH, BH.size());
+        BH = bits2octets(BH, q);
+
+        // Step (a) - private key to byte array
+        SecByteBlock BX(STDMAX(rlen, x.MinEncodedSize()));
+        x.Encode(BX, BX.size());
+
+        // Step (b)
+        SecByteBlock V(H::DIGESTSIZE);
+        std::fill(V.begin(), V.begin()+H::DIGESTSIZE, one);
+
+        // Step (c)
+        SecByteBlock K(H::DIGESTSIZE);
+        std::fill(K.begin(), K.begin()+H::DIGESTSIZE, zero);
+
+        // Step (d)
+        m_hmac.SetKey(K, K.size());
+        m_hmac.Update(V, V.size());
+        m_hmac.Update(&zero, 1);
+        m_hmac.Update(BX, BX.size());
+        m_hmac.Update(BH, BH.size());
+        m_hmac.TruncatedFinal(K, K.size());
+
+        // Step (e)
+        m_hmac.SetKey(K, K.size());
+        m_hmac.Update(V, V.size());
+        m_hmac.TruncatedFinal(V, V.size());
+
+        // Step (f)
+        m_hmac.SetKey(K, K.size());
+        m_hmac.Update(V, V.size());
+        m_hmac.Update(&one, 1);
+        m_hmac.Update(BX, BX.size());
+        m_hmac.Update(BH, BH.size());
+        m_hmac.TruncatedFinal(K, K.size());
+
+        // Step (g)
+        m_hmac.SetKey(K, K.size());
+        m_hmac.Update(V, V.size());
+        m_hmac.TruncatedFinal(V, V.size());
+
+        Integer k;
+        SecByteBlock temp(rlen);
+        for (;;)
+        {
+            // We want qlen bits, but we support only hash functions with an output length
+            //   multiple of 8; hence, we will gather rlen bits, i.e., rolen octets.
+            size_t toff = 0;
+            while (toff < rlen)
+            {
+                m_hmac.Update(V, V.size());
+                m_hmac.TruncatedFinal(V, V.size());
+
+                size_t cc = STDMIN(V.size(), temp.size() - toff);
+                memcpy_s(temp+toff, temp.size() - toff, V, cc);
+                toff += cc;
+            }
+
+            k = bits2int(temp, qlen);
+            if (k > 0 && k < q)
+                break;
+
+            // k is not in the proper range; update K and V, and loop.
+            m_hmac.Update(V, V.size());
+            m_hmac.Update(&zero, 1);
+            m_hmac.TruncatedFinal(K, K.size());
+
+            m_hmac.SetKey(K, K.size());
+            m_hmac.Update(V, V.size());
+            m_hmac.TruncatedFinal(V, V.size());
+        }
+
+        return k;
+    }
+
+protected:
+
+    Integer bits2int(const SecByteBlock& bits, size_t qlen) const
+    {
+        Integer ret(bits, bits.size());
+        size_t blen = bits.size()*8;
+
+        if (blen > qlen)
+            ret >>= blen - qlen;
+
+        return ret;
+    }
+
+    // RFC 6979 support function. Takes an integer and converts it into bytes that
+    // are the same length as an elliptic curve's order.
+    SecByteBlock int2octets(const Integer& val, size_t rlen) const
+    {
+        SecByteBlock block(val.MinEncodedSize());
+        val.Encode(block, val.MinEncodedSize());
+
+        if (block.size() == rlen)
+            return block;
+
+        // The least significant bytes are the ones we need to preserve.
+        SecByteBlock t(rlen);
+        if (block.size() > rlen)
+        {
+            size_t offset = block.size() - rlen;
+            std::memcpy(t, block + offset, rlen);
+        }
+        else // block.size() < rlen
+        {
+            size_t offset = rlen - block.size();
+            std::memset(t, '\x00', offset);
+            std::memcpy(t + offset, block, rlen - offset);
+        }
+
+        return t;
+    }
+
+    // Turn a stream of bits into a set of bytes with the same length as an elliptic
+    // curve's order.
+    SecByteBlock bits2octets(const SecByteBlock& in, const Integer& q) const
+    {
+        Integer b2 = bits2int(in, q.BitCount());
+        Integer b1 = b2 - q;
+        return int2octets(b1.IsNegative() ? b2 : b1, q.ByteCount());
+    }
+
+private:
+    mutable H m_hash;
+    mutable HMAC<H> m_hmac;
+};
+
+/// \brief German Digital Signature Algorithm
+/// \tparam T FieldElement type or class
+/// \details FieldElement <tt>T</tt> can be Integer, ECP or EC2N.
+/// \details The Digital Signature Scheme ECGDSA does not define the algorithm over integers. Rather, the
+///  signature algorithm is only defined over elliptic curves. However, the library design is such that the
+///  generic algorithm reside in <tt>gfpcrypt.h</tt>.
+/// \sa Erwin Hess, Marcus Schafheutle, and Pascale Serf <A HREF="http://www.teletrust.de/fileadmin/files/oid/ecgdsa_final.pdf">
+///  The Digital Signature Scheme ECGDSA (October 24, 2006)</A>
+template <class T>
+class DL_Algorithm_GDSA_ISO15946 : public DL_ElgamalLikeSignatureAlgorithm<T>
+{
+public:
+    CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "GDSA-ISO15946";}
+
+    virtual ~DL_Algorithm_GDSA_ISO15946() {}
+
+    void Sign(const DL_GroupParameters<T> &params, const Integer &x, const Integer &k, const Integer &e, Integer &r, Integer &s) const
+    {
+        const Integer &q = params.GetSubgroupOrder();
+        // r = x(k * G) mod q
+        r = params.ConvertElementToInteger(params.ExponentiateBase(k)) % q;
+        // s = (k * r - h(m)) * d_A mod q
+        s = (k * r - e) * x % q;
+        CRYPTOPP_ASSERT(!!r && !!s);
+    }
+
+    bool Verify(const DL_GroupParameters<T> &params, const DL_PublicKey<T> &publicKey, const Integer &e, const Integer &r, const Integer &s) const
+    {
+        const Integer &q = params.GetSubgroupOrder();
+        if (r>=q || r<1 || s>=q || s<1)
+            return false;
+
+        const Integer& rInv = r.InverseMod(q);
+        const Integer u1 = (rInv * e) % q;
+        const Integer u2 = (rInv * s) % q;
+        // verify x(G^u1 + P_A^u2) mod q
+        return r == params.ConvertElementToInteger(publicKey.CascadeExponentiateBaseAndPublicElement(u1, u2)) % q;
+    }
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_GDSA<Integer>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA1>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA224>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA256>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA384>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA512>;
+
+/// \brief NR algorithm
+/// \tparam T FieldElement type or class
+/// \details FieldElement <tt>T</tt> can be Integer, ECP or EC2N.
+template <class T>
+class DL_Algorithm_NR : public DL_ElgamalLikeSignatureAlgorithm<T>
+{
+public:
+    CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "NR";}
+
+    virtual ~DL_Algorithm_NR() {}
+
+    void Sign(const DL_GroupParameters<T> &params, const Integer &x, const Integer &k, const Integer &e, Integer &r, Integer &s) const
+    {
+        const Integer &q = params.GetSubgroupOrder();
+        r = (r + e) % q;
+        s = (k - x*r) % q;
+        CRYPTOPP_ASSERT(!!r);
+    }
+
+    bool Verify(const DL_GroupParameters<T> &params, const DL_PublicKey<T> &publicKey, const Integer &e, const Integer &r, const Integer &s) const
+    {
+        const Integer &q = params.GetSubgroupOrder();
+        if (r>=q || r<1 || s>=q)
+            return false;
+
+        // check r == (m_g^s * m_y^r + m) mod m_q
+        return r == (params.ConvertElementToInteger(publicKey.CascadeExponentiateBaseAndPublicElement(s, r)) + e) % q;
+    }
+};
+
+/// \brief Discrete Log (DL) public key in GF(p) groups
+/// \tparam GP GroupParameters derived class
+/// \details DSA public key format is defined in 7.3.3 of RFC 2459. The    private key format is defined in 12.9 of PKCS #11 v2.10.
+template <class GP>
+class DL_PublicKey_GFP : public DL_PublicKeyImpl<GP>
+{
+public:
+    virtual ~DL_PublicKey_GFP() {}
+
+    /// \brief Initialize a public key over GF(p)
+    /// \param params the group parameters
+    /// \param y the public element
+    void Initialize(const DL_GroupParameters_IntegerBased &params, const Integer &y)
+        {this->AccessGroupParameters().Initialize(params); this->SetPublicElement(y);}
+
+    /// \brief Initialize a public key over GF(p)
+    /// \param p the modulus
+    /// \param g the generator
+    /// \param y the public element
+    void Initialize(const Integer &p, const Integer &g, const Integer &y)
+        {this->AccessGroupParameters().Initialize(p, g); this->SetPublicElement(y);}
+
+    /// \brief Initialize a public key over GF(p)
+    /// \param p the modulus
+    /// \param q the subgroup order
+    /// \param g the generator
+    /// \param y the public element
+    void Initialize(const Integer &p, const Integer &q, const Integer &g, const Integer &y)
+        {this->AccessGroupParameters().Initialize(p, q, g); this->SetPublicElement(y);}
+
+    // X509PublicKey
+    void BERDecodePublicKey(BufferedTransformation &bt, bool, size_t)
+        {this->SetPublicElement(Integer(bt));}
+    void DEREncodePublicKey(BufferedTransformation &bt) const
+        {this->GetPublicElement().DEREncode(bt);}
+};
+
+/// \brief Discrete Log (DL) private key in GF(p) groups
+/// \tparam GP GroupParameters derived class
+template <class GP>
+class DL_PrivateKey_GFP : public DL_PrivateKeyImpl<GP>
+{
+public:
+    virtual ~DL_PrivateKey_GFP();
+
+    /// \brief Create a private key
+    /// \param rng a RandomNumberGenerator derived class
+    /// \param modulusBits the size of the modulus, in bits
+    /// \details This function overload of Initialize() creates a new private key because it
+    ///  takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+    ///  then use one of the other Initialize() overloads.
+    void Initialize(RandomNumberGenerator &rng, unsigned int modulusBits)
+        {this->GenerateRandomWithKeySize(rng, modulusBits);}
+
+    /// \brief Create a private key
+    /// \param rng a RandomNumberGenerator derived class
+    /// \param p the modulus
+    /// \param g the generator
+    /// \details This function overload of Initialize() creates a new private key because it
+    ///  takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+    ///  then use one of the other Initialize() overloads.
+    void Initialize(RandomNumberGenerator &rng, const Integer &p, const Integer &g)
+        {this->GenerateRandom(rng, MakeParameters("Modulus", p)("SubgroupGenerator", g));}
+
+    /// \brief Create a private key
+    /// \param rng a RandomNumberGenerator derived class
+    /// \param p the modulus
+    /// \param q the subgroup order
+    /// \param g the generator
+    /// \details This function overload of Initialize() creates a new private key because it
+    ///  takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+    ///  then use one of the other Initialize() overloads.
+    void Initialize(RandomNumberGenerator &rng, const Integer &p, const Integer &q, const Integer &g)
+        {this->GenerateRandom(rng, MakeParameters("Modulus", p)("SubgroupOrder", q)("SubgroupGenerator", g));}
+
+    /// \brief Initialize a private key over GF(p)
+    /// \param params the group parameters
+    /// \param x the private exponent
+    void Initialize(const DL_GroupParameters_IntegerBased &params, const Integer &x)
+        {this->AccessGroupParameters().Initialize(params); this->SetPrivateExponent(x);}
+
+    /// \brief Initialize a private key over GF(p)
+    /// \param p the modulus
+    /// \param g the generator
+    /// \param x the private exponent
+    void Initialize(const Integer &p, const Integer &g, const Integer &x)
+        {this->AccessGroupParameters().Initialize(p, g); this->SetPrivateExponent(x);}
+
+    /// \brief Initialize a private key over GF(p)
+    /// \param p the modulus
+    /// \param q the subgroup order
+    /// \param g the generator
+    /// \param x the private exponent
+    void Initialize(const Integer &p, const Integer &q, const Integer &g, const Integer &x)
+        {this->AccessGroupParameters().Initialize(p, q, g); this->SetPrivateExponent(x);}
+};
+
+// Out-of-line dtor due to AIX and GCC, http://github.com/weidai11/cryptopp/issues/499
+template <class GP>
+DL_PrivateKey_GFP<GP>::~DL_PrivateKey_GFP() {}
+
+/// \brief Discrete Log (DL) signing/verification keys in GF(p) groups
+struct DL_SignatureKeys_GFP
+{
+    typedef DL_GroupParameters_GFP GroupParameters;
+    typedef DL_PublicKey_GFP<GroupParameters> PublicKey;
+    typedef DL_PrivateKey_GFP<GroupParameters> PrivateKey;
+};
+
+/// \brief Discrete Log (DL) encryption/decryption keys in GF(p) groups
+struct DL_CryptoKeys_GFP
+{
+    typedef DL_GroupParameters_GFP_DefaultSafePrime GroupParameters;
+    typedef DL_PublicKey_GFP<GroupParameters> PublicKey;
+    typedef DL_PrivateKey_GFP<GroupParameters> PrivateKey;
+};
+
+/// ElGamal encryption keys for safe interop
+/// \sa <A HREF="https://eprint.iacr.org/2021/923.pdf">On the
+///  (in)security of ElGamal in OpenPGP</A>,
+///  <A HREF="https://github.com/weidai11/cryptopp/issues/1059">Issue 1059</A>,
+///  <A HREF="https://nvd.nist.gov/vuln/detail/CVE-2021-40530">CVE-2021-40530</A>
+/// \since Crypto++ 8.6
+struct DL_CryptoKeys_ElGamal
+{
+    typedef DL_GroupParameters_ElGamal GroupParameters;
+    typedef DL_PublicKey_GFP<GroupParameters> PublicKey;
+    typedef DL_PrivateKey_GFP<GroupParameters> PrivateKey;
+};
+
+/// \brief DSA signature scheme
+/// \tparam H HashTransformation derived class
+/// \sa <a href="http://www.weidai.com/scan-mirror/sig.html#DSA-1363">DSA-1363</a>
+/// \since Crypto++ 1.0 for DSA, Crypto++ 5.6.2 for DSA2
+template <class H>
+struct GDSA : public DL_SS<
+    DL_SignatureKeys_GFP,
+    DL_Algorithm_GDSA<Integer>,
+    DL_SignatureMessageEncodingMethod_DSA,
+    H>
+{
+};
+
+/// \brief NR signature scheme
+/// \tparam H HashTransformation derived class
+/// \sa <a href="http://www.weidai.com/scan-mirror/sig.html#NR">NR</a>
+template <class H>
+struct NR : public DL_SS<
+    DL_SignatureKeys_GFP,
+    DL_Algorithm_NR<Integer>,
+    DL_SignatureMessageEncodingMethod_NR,
+    H>
+{
+};
+
+/// \brief DSA group parameters
+/// \details These are GF(p) group parameters that are allowed by the DSA standard
+/// \sa DL_Keys_DSA
+/// \since Crypto++ 1.0
+class CRYPTOPP_DLL DL_GroupParameters_DSA : public DL_GroupParameters_GFP
+{
+public:
+    virtual ~DL_GroupParameters_DSA() {}
+
+    /// \brief Check the group for errors
+    /// \param rng RandomNumberGenerator for objects which use randomized testing
+    /// \param level level of thoroughness
+    /// \return true if the tests succeed, false otherwise
+    /// \details ValidateGroup() also checks that the lengths of p and q are allowed
+    ///  by the DSA standard.
+    /// \details There are four levels of thoroughness:
+    ///  <ul>
+    ///  <li>0 - using this object won't cause a crash or exception
+    ///  <li>1 - this object will probably function, and encrypt, sign, other operations correctly
+    ///  <li>2 - ensure this object will function correctly, and perform reasonable security checks
+    ///  <li>3 - perform reasonable security checks, and do checks that may take a long time
+    ///  </ul>
+    /// \details Level 0 does not require a RandomNumberGenerator. A NullRNG() can be used for level 0.
+    ///  Level 1 may not check for weak keys and such. Levels 2 and 3 are recommended.
+    bool ValidateGroup(RandomNumberGenerator &rng, unsigned int level) const;
+
+    /// \brief Generate a random key or crypto parameters
+    /// \param rng a RandomNumberGenerator to produce keying material
+    /// \param alg additional initialization parameters
+    /// \details NameValuePairs can be ModulusSize alone; or Modulus, SubgroupOrder, and
+    ///  SubgroupGenerator. ModulusSize must be between <tt>DSA::MIN_PRIME_LENGTH</tt> and
+    ///  <tt>DSA::MAX_PRIME_LENGTH</tt>, and divisible by <tt>DSA::PRIME_LENGTH_MULTIPLE</tt>.
+    /// \details An example of changing the modulus size using NameValuePairs is shown below.
+    /// <pre>
+    ///  AlgorithmParameters params = MakeParameters
+    ///    (Name::ModulusSize(), 2048);
+    ///
+    ///  DL_GroupParameters_DSA groupParams;
+    ///  groupParams.GenerateRandom(prng, params);
+    /// </pre>
+    /// \throw KeyingErr if a key can't be generated or algorithm parameters are invalid.
+    void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
+
+    /// \brief Check the prime length for errors
+    /// \param pbits number of bits in the prime number
+    /// \return true if the tests succeed, false otherwise
+    static bool CRYPTOPP_API IsValidPrimeLength(unsigned int pbits)
+        {return pbits >= MIN_PRIME_LENGTH && pbits <= MAX_PRIME_LENGTH && pbits % PRIME_LENGTH_MULTIPLE == 0;}
+
+    /// \brief DSA prime length
+    enum {
+        /// \brief Minimum prime length
+        MIN_PRIME_LENGTH = 1024,
+        /// \brief Maximum prime length
+        MAX_PRIME_LENGTH = 3072,
+        /// \brief Prime length multiple
+        PRIME_LENGTH_MULTIPLE = 1024
+    };
+};
+
+template <class H>
+class DSA2;
+
+/// \brief DSA keys
+/// \sa DL_GroupParameters_DSA
+/// \since Crypto++ 1.0
+struct DL_Keys_DSA
+{
+    typedef DL_PublicKey_GFP<DL_GroupParameters_DSA> PublicKey;
+    typedef DL_PrivateKey_WithSignaturePairwiseConsistencyTest<DL_PrivateKey_GFP<DL_GroupParameters_DSA>, DSA2<SHA1> > PrivateKey;
+};
+
+/// \brief DSA signature scheme
+/// \tparam H HashTransformation derived class
+/// \details The class is named DSA2 instead of DSA for backwards compatibility because
+///  DSA was a non-template class.
+/// \details DSA default method GenerateRandom uses a 2048-bit modulus and a 224-bit subgoup by default.
+///  The modulus can be changed using the following code:
+/// <pre>
+///  DSA::PrivateKey privateKey;
+///  privateKey.GenerateRandomWithKeySize(prng, 2048);
+/// </pre>
+/// \details The subgroup order can be changed using the following code:
+/// <pre>
+///  AlgorithmParameters params = MakeParameters
+///    (Name::ModulusSize(), 2048)
+///    (Name::SubgroupOrderSize(), 256);
+///
+///  DSA::PrivateKey privateKey;
+///  privateKey.GenerateRandom(prng, params);
+/// </pre>
+/// \sa <a href="http://en.wikipedia.org/wiki/Digital_Signature_Algorithm">DSA</a>, as specified in FIPS 186-3,
+///  <a href="https://www.cryptopp.com/wiki/Digital_Signature_Algorithm">Digital Signature Algorithm</a> on the wiki, and
+///  <a href="https://www.cryptopp.com/wiki/NameValuePairs">NameValuePairs</a> on the wiki.
+/// \since Crypto++ 1.0 for DSA, Crypto++ 5.6.2 for DSA2, Crypto++ 6.1 for 2048-bit modulus.
+template <class H>
+class DSA2 : public DL_SS<
+    DL_Keys_DSA,
+    DL_Algorithm_GDSA<Integer>,
+    DL_SignatureMessageEncodingMethod_DSA,
+    H,
+    DSA2<H> >
+{
+public:
+    static std::string CRYPTOPP_API StaticAlgorithmName() {return "DSA/" + (std::string)H::StaticAlgorithmName();}
+};
+
+/// \brief DSA deterministic signature scheme
+/// \tparam H HashTransformation derived class
+/// \sa <a href="http://www.weidai.com/scan-mirror/sig.html#DSA-1363">DSA-1363</a>
+/// \since Crypto++ 1.0 for DSA, Crypto++ 5.6.2 for DSA2
+template <class H>
+struct DSA_RFC6979 : public DL_SS<
+    DL_SignatureKeys_GFP,
+    DL_Algorithm_DSA_RFC6979<Integer, H>,
+    DL_SignatureMessageEncodingMethod_DSA,
+    H,
+    DSA_RFC6979<H> >
+{
+    static std::string CRYPTOPP_API StaticAlgorithmName() {return std::string("DSA-RFC6979/") + H::StaticAlgorithmName();}
+};
+
+/// DSA with SHA-1, typedef'd for backwards compatibility
+typedef DSA2<SHA1> DSA;
+
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PublicKey_GFP<DL_GroupParameters_DSA>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_GFP<DL_GroupParameters_DSA>;
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_WithSignaturePairwiseConsistencyTest<DL_PrivateKey_GFP<DL_GroupParameters_DSA>, DSA2<SHA1> >;
+
+/// \brief P1363 based XOR Encryption Method
+/// \tparam MAC MessageAuthenticationCode derived class used for MAC computation
+/// \tparam DHAES_MODE flag indicating DHAES mode
+/// \tparam LABEL_OCTETS flag indicating the label is octet count
+/// \details DL_EncryptionAlgorithm_Xor is based on an early P1363 draft, which itself appears to be based on an
+///  early Certicom SEC-1 draft (or an early SEC-1 draft was based on a P1363 draft). Crypto++ 4.2 used it in its Integrated
+///  Ecryption Schemes with <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=false</tt> and <tt>LABEL_OCTETS=true</tt>.
+/// \details If you need this method for Crypto++ 4.2 compatibility, then use the ECIES template class with
+///  <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=false</tt> and <tt>LABEL_OCTETS=true</tt>.
+/// \details If you need this method for Bouncy Castle 1.54 and Botan 1.11 compatibility, then use the ECIES template class with
+///  <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=true</tt> and <tt>LABEL_OCTETS=false</tt>.
+/// \details Bouncy Castle 1.54 and Botan 1.11 compatibility are the default template parameters.
+/// \since Crypto++ 4.0
+template <class MAC, bool DHAES_MODE, bool LABEL_OCTETS=false>
+class DL_EncryptionAlgorithm_Xor : public DL_SymmetricEncryptionAlgorithm
+{
+public:
+    virtual ~DL_EncryptionAlgorithm_Xor() {}
+
+    bool ParameterSupported(const char *name) const {return strcmp(name, Name::EncodingParameters()) == 0;}
+    size_t GetSymmetricKeyLength(size_t plaintextLength) const
+        {return plaintextLength + static_cast<size_t>(MAC::DEFAULT_KEYLENGTH);}
+    size_t GetSymmetricCiphertextLength(size_t plaintextLength) const
+        {return plaintextLength + static_cast<size_t>(MAC::DIGESTSIZE);}
+    size_t GetMaxSymmetricPlaintextLength(size_t ciphertextLength) const
+        {return SaturatingSubtract(ciphertextLength, static_cast<size_t>(MAC::DIGESTSIZE));}
+    void SymmetricEncrypt(RandomNumberGenerator &rng, const byte *key, const byte *plaintext, size_t plaintextLength, byte *ciphertext, const NameValuePairs &parameters) const
+    {
+        CRYPTOPP_UNUSED(rng);
+        const byte *cipherKey = NULLPTR, *macKey = NULLPTR;
+        if (DHAES_MODE)
+        {
+            macKey = key;
+            cipherKey = key + MAC::DEFAULT_KEYLENGTH;
+        }
+        else
+        {
+            cipherKey = key;
+            macKey = key + plaintextLength;
+        }
+
+        ConstByteArrayParameter encodingParameters;
+        parameters.GetValue(Name::EncodingParameters(), encodingParameters);
+
+        if (plaintextLength)    // Coverity finding
+            xorbuf(ciphertext, plaintext, cipherKey, plaintextLength);
+
+        MAC mac(macKey);
+        mac.Update(ciphertext, plaintextLength);
+        mac.Update(encodingParameters.begin(), encodingParameters.size());
+        if (DHAES_MODE)
+        {
+            byte L[8];
+            PutWord(false, BIG_ENDIAN_ORDER, L, (LABEL_OCTETS ? word64(encodingParameters.size()) : 8 * word64(encodingParameters.size())));
+            mac.Update(L, 8);
+        }
+        mac.Final(ciphertext + plaintextLength);
+    }
+    DecodingResult SymmetricDecrypt(const byte *key, const byte *ciphertext, size_t ciphertextLength, byte *plaintext, const NameValuePairs &parameters) const
+    {
+        size_t plaintextLength = GetMaxSymmetricPlaintextLength(ciphertextLength);
+        const byte *cipherKey, *macKey;
+        if (DHAES_MODE)
+        {
+            macKey = key;
+            cipherKey = key + MAC::DEFAULT_KEYLENGTH;
+        }
+        else
+        {
+            cipherKey = key;
+            macKey = key + plaintextLength;
+        }
+
+        ConstByteArrayParameter encodingParameters;
+        parameters.GetValue(Name::EncodingParameters(), encodingParameters);
+
+        MAC mac(macKey);
+        mac.Update(ciphertext, plaintextLength);
+        mac.Update(encodingParameters.begin(), encodingParameters.size());
+        if (DHAES_MODE)
+        {
+            byte L[8];
+            PutWord(false, BIG_ENDIAN_ORDER, L, (LABEL_OCTETS ? word64(encodingParameters.size()) : 8 * word64(encodingParameters.size())));
+            mac.Update(L, 8);
+        }
+        if (!mac.Verify(ciphertext + plaintextLength))
+            return DecodingResult();
+
+        if (plaintextLength)    // Coverity finding
+            xorbuf(plaintext, ciphertext, cipherKey, plaintextLength);
+
+        return DecodingResult(plaintextLength);
+    }
+};
+
+/// \brief P1363 based Key Derivation Method
+/// \tparam T FieldElement type or class
+/// \tparam DHAES_MODE flag indicating DHAES mode
+/// \tparam KDF key derivation function
+/// \details FieldElement <tt>T</tt> can be Integer, ECP or EC2N.
+template <class T, bool DHAES_MODE, class KDF>
+class DL_KeyDerivationAlgorithm_P1363 : public DL_KeyDerivationAlgorithm<T>
+{
+public:
+    virtual ~DL_KeyDerivationAlgorithm_P1363() {}
+
+    bool ParameterSupported(const char *name) const {return strcmp(name, Name::KeyDerivationParameters()) == 0;}
+    void Derive(const DL_GroupParameters<T> &params, byte *derivedKey, size_t derivedLength, const T &agreedElement, const T &ephemeralPublicKey, const NameValuePairs &parameters) const
+    {
+        SecByteBlock agreedSecret;
+        if (DHAES_MODE)
+        {
+            agreedSecret.New(params.GetEncodedElementSize(true) + params.GetEncodedElementSize(false));
+            params.EncodeElement(true, ephemeralPublicKey, agreedSecret);
+            params.EncodeElement(false, agreedElement, agreedSecret + params.GetEncodedElementSize(true));
+        }
+        else
+        {
+            agreedSecret.New(params.GetEncodedElementSize(false));
+            params.EncodeElement(false, agreedElement, agreedSecret);
+        }
+
+        ConstByteArrayParameter derivationParameters;
+        parameters.GetValue(Name::KeyDerivationParameters(), derivationParameters);
+        KDF::DeriveKey(derivedKey, derivedLength, agreedSecret, agreedSecret.size(), derivationParameters.begin(), derivationParameters.size());
+    }
+};
+
+/// \brief Discrete Log Integrated Encryption Scheme
+/// \tparam COFACTOR_OPTION cofactor multiplication option
+/// \tparam HASH HashTransformation derived class used for key drivation and MAC computation
+/// \tparam DHAES_MODE flag indicating if the MAC includes addition context parameters such as the label
+/// \tparam LABEL_OCTETS flag indicating if the label size is specified in octets or bits
+/// \details DLIES is an Integer based Integrated Encryption Scheme (IES). The scheme combines a Key Encapsulation Method (KEM)
+///  with a Data Encapsulation Method (DEM) and a MAC tag. The scheme is
+///  <A HREF="http://en.wikipedia.org/wiki/ciphertext_indistinguishability">IND-CCA2</A>, which is a strong notion of security.
+///  You should prefer an Integrated Encryption Scheme over homegrown schemes.
+/// \details The library's original implementation is based on an early P1363 draft, which itself appears to be based on an early Certicom
+///  SEC-1 draft (or an early SEC-1 draft was based on a P1363 draft). Crypto++ 4.2 used the early draft in its Integrated Ecryption
+///  Schemes with <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=false</tt> and <tt>LABEL_OCTETS=true</tt>.
+/// \details If you desire an Integrated Encryption Scheme with Crypto++ 4.2 compatibility, then use the DLIES template class with
+///  <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=false</tt> and <tt>LABEL_OCTETS=true</tt>.
+/// \details If you desire an Integrated Encryption Scheme with Bouncy Castle 1.54 and Botan 1.11 compatibility, then use the DLIES
+///  template class with <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=true</tt> and <tt>LABEL_OCTETS=false</tt>.
+/// \details The default template parameters ensure compatibility with Bouncy Castle 1.54 and Botan 1.11. The combination of
+///  <tt>IncompatibleCofactorMultiplication</tt> and <tt>DHAES_MODE=true</tt> is recommended for best efficiency and security.
+///  SHA1 is used for compatibility reasons, but it can be changed if desired. SHA-256 or another hash will likely improve the
+///  security provided by the MAC. The hash is also used in the key derivation function as a PRF.
+/// \details Below is an example of constructing a Crypto++ 4.2 compatible DLIES encryptor and decryptor.
+/// <pre>
+///    AutoSeededRandomPool prng;
+///    DL_PrivateKey_GFP<DL_GroupParameters_GFP> key;
+///    key.Initialize(prng, 2048);
+///
+///    DLIES<SHA1,NoCofactorMultiplication,true,true>::Decryptor decryptor(key);
+///    DLIES<SHA1,NoCofactorMultiplication,true,true>::Encryptor encryptor(decryptor);
+/// </pre>
+/// \sa ECIES, <a href="http://www.weidai.com/scan-mirror/ca.html#DLIES">Discrete Log Integrated Encryption Scheme (DLIES)</a>,
+///  Martínez, Encinas, and Ávila's <A HREF="http://digital.csic.es/bitstream/10261/32671/1/V2-I2-P7-13.pdf">A Survey of the Elliptic
+///  Curve Integrated Encryption Schemes</A>
+/// \since Crypto++ 4.0, Crypto++ 5.7 for Bouncy Castle and Botan compatibility
+template <class HASH = SHA1, class COFACTOR_OPTION = NoCofactorMultiplication, bool DHAES_MODE = true, bool LABEL_OCTETS=false>
+struct DLIES
+    : public DL_ES<
+        DL_CryptoKeys_GFP,
+        DL_KeyAgreementAlgorithm_DH<Integer, COFACTOR_OPTION>,
+        DL_KeyDerivationAlgorithm_P1363<Integer, DHAES_MODE, P1363_KDF2<HASH> >,
+        DL_EncryptionAlgorithm_Xor<HMAC<HASH>, DHAES_MODE, LABEL_OCTETS>,
+        DLIES<> >
+{
+    static std::string CRYPTOPP_API StaticAlgorithmName() {return "DLIES";}    // TODO: fix this after name is standardized
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/gost.cpp b/runtime/third_party/cryptopp/gost.cpp
new file mode 100644
index 0000000..208fdcd
--- /dev/null
+++ b/runtime/third_party/cryptopp/gost.cpp
@@ -0,0 +1,123 @@
+#include "pch.h"
+#include "gost.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// these are the S-boxes given in Applied Cryptography 2nd Ed., p. 333
+const byte GOST::Base::sBox[8][16]={
+	{4, 10, 9, 2, 13, 8, 0, 14, 6, 11, 1, 12, 7, 15, 5, 3},
+	{14, 11, 4, 12, 6, 13, 15, 10, 2, 3, 8, 1, 0, 7, 5, 9},
+	{5, 8, 1, 13, 10, 3, 4, 2, 14, 15, 12, 7, 6, 0, 9, 11},
+	{7, 13, 10, 1, 0, 8, 9, 15, 14, 4, 6, 12, 11, 2, 5, 3},
+	{6, 12, 7, 1, 5, 15, 13, 8, 4, 10, 9, 14, 0, 3, 11, 2},
+	{4, 11, 10, 0, 7, 2, 1, 13, 3, 6, 8, 5, 9, 12, 15, 14},
+	{13, 11, 4, 1, 3, 15, 5, 9, 0, 10, 14, 7, 6, 8, 2, 12},
+	{1, 15, 13, 0, 5, 7, 10, 4, 9, 2, 3, 14, 6, 11, 8, 12}};
+
+/*	// these are the S-boxes given in the GOST source code listing in Applied
+	// Cryptography 2nd Ed., p. 644.  they appear to be from the DES S-boxes
+	{13,  2,  8,  4,  6, 15, 11,  1, 10,  9,  3, 14,  5,  0, 12,  7 },
+	{ 4, 11,  2, 14, 15,  0,  8, 13,  3, 12,  9,  7,  5, 10,  6,  1 },
+	{12,  1, 10, 15,  9,  2,  6,  8,  0, 13,  3,  4, 14,  7,  5, 11 },
+	{ 2, 12,  4,  1,  7, 10, 11,  6,  8,  5,  3, 15, 13,  0, 14,  9 },
+	{ 7, 13, 14,  3,  0,  6,  9, 10,  1,  2,  8,  5, 11, 12,  4, 15 },
+	{10,  0,  9, 14,  6,  3, 15,  5,  1, 13, 12,  7, 11,  4,  2,  8 },
+	{15,  1,  8, 14,  6, 11,  3,  4,  9,  7,  2, 13, 12,  0,  5, 10 },
+	{14,  4, 13,  1,  2, 15, 11,  8,  3, 10,  6, 12,  5,  9,  0,  7 }};
+*/
+
+volatile bool GOST::Base::sTableCalculated = false;
+word32 GOST::Base::sTable[4][256];
+
+void GOST::Base::UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &)
+{
+	AssertValidKeyLength(length);
+
+	PrecalculateSTable();
+
+	GetUserKey(LITTLE_ENDIAN_ORDER, m_key.begin(), 8, userKey, KEYLENGTH);
+}
+
+void GOST::Base::PrecalculateSTable()
+{
+	if (!sTableCalculated)
+	{
+		for (unsigned i = 0; i < 4; i++)
+			for (unsigned j = 0; j < 256; j++)
+			{
+				word32 temp = sBox[2*i][j%16] | (sBox[2*i+1][j/16] << 4);
+				sTable[i][j] = rotlMod(temp, 11+8*i);
+			}
+
+		sTableCalculated=true;
+	}
+}
+
+#define f(x)  ( t=x,												\
+				sTable[3][GETBYTE(t, 3)] ^ sTable[2][GETBYTE(t, 2)]	\
+			  ^ sTable[1][GETBYTE(t, 1)] ^ sTable[0][GETBYTE(t, 0)]	)
+
+typedef BlockGetAndPut<word32, LittleEndian> Block;
+
+void GOST::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 n1, n2, t;
+
+	Block::Get(inBlock)(n1)(n2);
+
+	for (unsigned int i=0; i<3; i++)
+	{
+		n2 ^= f(n1+m_key[0]);
+		n1 ^= f(n2+m_key[1]);
+		n2 ^= f(n1+m_key[2]);
+		n1 ^= f(n2+m_key[3]);
+		n2 ^= f(n1+m_key[4]);
+		n1 ^= f(n2+m_key[5]);
+		n2 ^= f(n1+m_key[6]);
+		n1 ^= f(n2+m_key[7]);
+	}
+
+	n2 ^= f(n1+m_key[7]);
+	n1 ^= f(n2+m_key[6]);
+	n2 ^= f(n1+m_key[5]);
+	n1 ^= f(n2+m_key[4]);
+	n2 ^= f(n1+m_key[3]);
+	n1 ^= f(n2+m_key[2]);
+	n2 ^= f(n1+m_key[1]);
+	n1 ^= f(n2+m_key[0]);
+
+	Block::Put(xorBlock, outBlock)(n2)(n1);
+}
+
+void GOST::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 n1, n2, t;
+
+	Block::Get(inBlock)(n1)(n2);
+
+	n2 ^= f(n1+m_key[0]);
+	n1 ^= f(n2+m_key[1]);
+	n2 ^= f(n1+m_key[2]);
+	n1 ^= f(n2+m_key[3]);
+	n2 ^= f(n1+m_key[4]);
+	n1 ^= f(n2+m_key[5]);
+	n2 ^= f(n1+m_key[6]);
+	n1 ^= f(n2+m_key[7]);
+
+	for (unsigned int i=0; i<3; i++)
+	{
+		n2 ^= f(n1+m_key[7]);
+		n1 ^= f(n2+m_key[6]);
+		n2 ^= f(n1+m_key[5]);
+		n1 ^= f(n2+m_key[4]);
+		n2 ^= f(n1+m_key[3]);
+		n1 ^= f(n2+m_key[2]);
+		n2 ^= f(n1+m_key[1]);
+		n1 ^= f(n2+m_key[0]);
+	}
+
+	Block::Put(xorBlock, outBlock)(n2)(n1);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/gost.h b/runtime/third_party/cryptopp/gost.h
new file mode 100644
index 0000000..87082a1
--- /dev/null
+++ b/runtime/third_party/cryptopp/gost.h
@@ -0,0 +1,66 @@
+// gost.h - originally written and placed in the public domain by Wei Dai
+
+/// \file gost.h
+/// \brief Classes for the GIST block cipher
+
+#ifndef CRYPTOPP_GOST_H
+#define CRYPTOPP_GOST_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief GOST block cipher information
+/// \since Crypto++ 2.1
+struct GOST_Info : public FixedBlockSize<8>, public FixedKeyLength<32>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "GOST";}
+};
+
+/// \brief GOST block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/GOST">GOST</a>
+/// \since Crypto++ 2.1
+class GOST : public GOST_Info, public BlockCipherDocumentation
+{
+	/// \brief GOST block cipher default operation
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<GOST_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		static void PrecalculateSTable();
+
+		static const byte sBox[8][16];
+		static volatile bool sTableCalculated;
+		static word32 sTable[4][256];
+
+		FixedSizeSecBlock<word32, 8> m_key;
+	};
+
+	/// \brief GOST block cipher encryption operation
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief GOST block cipher decryption operation
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef GOST::Encryption GOSTEncryption;
+typedef GOST::Decryption GOSTDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/gzip.cpp b/runtime/third_party/cryptopp/gzip.cpp
new file mode 100644
index 0000000..6ab9c73
--- /dev/null
+++ b/runtime/third_party/cryptopp/gzip.cpp
@@ -0,0 +1,208 @@
+// gzip.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "gzip.h"
+#include "argnames.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Checks whether the character is valid for ISO/IEC 8859-1 as required by RFC 1952
+static inline bool Is8859Character(char c) {
+	const unsigned char cc = static_cast<unsigned char>(c);
+	return (cc >= 32 && cc <= 126) || (cc >= 160);
+}
+
+void Gzip::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	Deflator::IsolatedInitialize(parameters);
+
+	ConstByteArrayParameter v;
+	if (parameters.GetValue(Name::FileName(), v))
+		m_filename.assign(reinterpret_cast<const char*>(v.begin()), v.size());
+	if (parameters.GetValue(Name::Comment(), v))
+		m_comment.assign(reinterpret_cast<const char*>(v.begin()), v.size());
+	m_filetime = parameters.GetIntValueWithDefault(Name::FileTime(), 0);
+}
+
+void Gzip::WritePrestreamHeader()
+{
+	m_totalLen = 0;
+	m_crc.Restart();
+
+	int flags = 0;
+	if(!m_filename.empty())
+		flags |= FILENAME;
+	if(!m_comment.empty())
+		flags |= COMMENTS;
+
+	AttachedTransformation()->Put(MAGIC1);
+	AttachedTransformation()->Put(MAGIC2);
+	AttachedTransformation()->Put(DEFLATED);
+	AttachedTransformation()->Put((byte)flags);		// general flag
+	AttachedTransformation()->PutWord32(m_filetime, LITTLE_ENDIAN_ORDER);	// time stamp
+	byte extra = static_cast<byte>((GetDeflateLevel() == 1) ?
+	                FAST : ((GetDeflateLevel() == 9) ? SLOW : 0));
+	AttachedTransformation()->Put(extra);
+	AttachedTransformation()->Put(GZIP_OS_CODE);
+
+	// Filename is NULL terminated, hence the +1
+	if(!m_filename.empty())
+		AttachedTransformation()->Put((const unsigned char*)m_filename.data(), m_filename.size() +1);
+
+	// Comment is NULL terminated, hence the +1
+	if(!m_comment.empty())
+		AttachedTransformation()->Put((const unsigned char*)m_comment.data(), m_comment.size() +1);
+}
+
+void Gzip::ProcessUncompressedData(const byte *inString, size_t length)
+{
+	m_crc.Update(inString, length);
+	m_totalLen += (word32)length;
+}
+
+void Gzip::WritePoststreamTail()
+{
+	SecByteBlock crc(4);
+	m_crc.Final(crc);
+	AttachedTransformation()->Put(crc, 4);
+	AttachedTransformation()->PutWord32(m_totalLen, LITTLE_ENDIAN_ORDER);
+
+	m_filetime = 0;
+	m_filename.clear();
+	m_comment.clear();
+}
+
+void Gzip::SetComment(const std::string& comment, bool throwOnEncodingError)
+{
+	if(throwOnEncodingError)
+	{
+		for(size_t i = 0; i < comment.length(); i++) {
+			const char c = comment[i];
+			if(!Is8859Character(c))
+				throw InvalidDataFormat("The comment is not ISO/IEC 8859-1 encoded");
+		}
+	}
+
+	m_comment = comment;
+}
+
+void Gzip::SetFilename(const std::string& filename, bool throwOnEncodingError)
+{
+	if(throwOnEncodingError)
+	{
+		for(size_t i = 0; i < filename.length(); i++) {
+			const char c = filename[i];
+			if(!Is8859Character(c))
+				throw InvalidDataFormat("The filename is not ISO/IEC 8859-1 encoded");
+		}
+	}
+
+	m_filename = filename;
+}
+
+// *************************************************************
+
+Gunzip::Gunzip(BufferedTransformation *attachment, bool repeat, int propagation)
+	: Inflator(attachment, repeat, propagation), m_length(0), m_filetime(0)
+{
+}
+
+void Gunzip::ProcessPrestreamHeader()
+{
+	m_length = 0;
+	m_crc.Restart();
+
+	m_filetime = 0;
+	m_filename.clear();
+	m_comment.clear();
+
+	byte buf[6];
+	byte b, flags;
+
+	if (m_inQueue.Get(buf, 2)!=2) throw HeaderErr();
+	if (buf[0] != MAGIC1 || buf[1] != MAGIC2) throw HeaderErr();
+	if (!m_inQueue.Get(b) || (b != DEFLATED)) throw HeaderErr();	 // skip CM flag
+	if (!m_inQueue.Get(flags)) throw HeaderErr();
+	if (flags & (ENCRYPTED | CONTINUED)) throw HeaderErr();
+	if (m_inQueue.GetWord32(m_filetime, LITTLE_ENDIAN_ORDER) != 4) throw HeaderErr();
+	if (m_inQueue.Skip(2)!=2) throw HeaderErr();    // Skip extra flags and OS type
+
+	if (flags & EXTRA_FIELDS)	// skip extra fields
+	{
+		word16 length;
+		if (m_inQueue.GetWord16(length, LITTLE_ENDIAN_ORDER) != 2) throw HeaderErr();
+		if (m_inQueue.Skip(length)!=length) throw HeaderErr();
+	}
+
+	if (flags & FILENAME)	// extract filename
+	{
+		do
+		{
+			if(!m_inQueue.Get(b)) throw HeaderErr();
+			if(b) m_filename.append( 1, (char)b );
+		}
+		while (b);
+	}
+
+	if (flags & COMMENTS)	// extract comments
+	{
+		do
+		{
+			if(!m_inQueue.Get(b)) throw HeaderErr();
+			if(b) m_comment.append( 1, (char)b );
+		}
+		while (b);
+	}
+}
+
+void Gunzip::ProcessDecompressedData(const byte *inString, size_t length)
+{
+	AttachedTransformation()->Put(inString, length);
+	m_crc.Update(inString, length);
+	m_length += (word32)length;
+}
+
+void Gunzip::ProcessPoststreamTail()
+{
+	SecByteBlock crc(4);
+	if (m_inQueue.Get(crc, 4) != 4)
+		throw TailErr();
+	if (!m_crc.Verify(crc))
+		throw CrcErr();
+
+	word32 lengthCheck;
+	if (m_inQueue.GetWord32(lengthCheck, LITTLE_ENDIAN_ORDER) != 4)
+		throw TailErr();
+	if (lengthCheck != m_length)
+		throw LengthErr();
+}
+
+const std::string& Gunzip::GetComment(bool throwOnEncodingError) const
+{
+	if(throwOnEncodingError)
+	{
+		for(size_t i = 0; i < m_comment.length(); i++) {
+			const char c = m_comment[i];
+			if(!Is8859Character(c))
+				throw InvalidDataFormat("The comment is not ISO/IEC 8859-1 encoded");
+		}
+	}
+
+	return m_comment;
+}
+
+const std::string& Gunzip::GetFilename(bool throwOnEncodingError) const
+{
+	if(throwOnEncodingError)
+	{
+		for(size_t i = 0; i < m_filename.length(); i++) {
+			const char c = m_filename[i];
+			if(!Is8859Character(c))
+				throw InvalidDataFormat("The filename is not ISO/IEC 8859-1 encoded");
+		}
+	}
+
+	return m_filename;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/gzip.h b/runtime/third_party/cryptopp/gzip.h
new file mode 100644
index 0000000..437a520
--- /dev/null
+++ b/runtime/third_party/cryptopp/gzip.h
@@ -0,0 +1,144 @@
+// gzip.h - originally written and placed in the public domain by Wei Dai
+
+/// \file gzip.h
+/// \brief GZIP compression and decompression (RFC 1952)
+
+#ifndef CRYPTOPP_GZIP_H
+#define CRYPTOPP_GZIP_H
+
+#include "cryptlib.h"
+#include "zdeflate.h"
+#include "zinflate.h"
+#include "crc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief GZIP Compression (RFC 1952)
+class Gzip : public Deflator
+{
+public:
+	/// \brief Construct a Gzip compressor
+	/// \param attachment an attached transformation
+	/// \param deflateLevel the deflate level
+	/// \param log2WindowSize the window size
+	/// \param detectUncompressible flag to detect if data is compressible
+	/// \details detectUncompressible makes it faster to process uncompressible files, but
+	///   if a file has both compressible and uncompressible parts, it may fail to compress
+	///   some of the compressible parts.
+	Gzip(BufferedTransformation *attachment=NULLPTR, unsigned int deflateLevel=DEFAULT_DEFLATE_LEVEL, unsigned int log2WindowSize=DEFAULT_LOG2_WINDOW_SIZE, bool detectUncompressible=true)
+		: Deflator(attachment, deflateLevel, log2WindowSize, detectUncompressible), m_totalLen(0), m_filetime(0) { }
+
+	/// \brief Construct a Gzip compressor
+	/// \param parameters a set of NameValuePairs to initialize this object
+	/// \param attachment an attached transformation
+	/// \details Possible parameter names: Log2WindowSize, DeflateLevel, DetectUncompressible
+	Gzip(const NameValuePairs &parameters, BufferedTransformation *attachment=NULLPTR)
+		: Deflator(parameters, attachment), m_totalLen(0), m_filetime(0)
+	{
+		IsolatedInitialize(parameters);
+	}
+
+	/// \param filetime the filetime to set in the header. The application is responsible for setting it.
+	void SetFiletime(word32 filetime) { m_filetime = filetime; }
+
+	/// \param filename the original filename to set in the header. The application is responsible for setting it.
+	///        RFC 1952 requires a ISO/IEC 8859-1 encoding.
+	/// \param throwOnEncodingError if throwOnEncodingError is true, then the filename is checked to ensure it is
+	///        ISO/IEC 8859-1 encoded. If the filename does not adhere to ISO/IEC 8859-1, then a InvalidDataFormat
+	///        is thrown. If throwOnEncodingError is false then the filename is not checked.
+	void SetFilename(const std::string& filename, bool throwOnEncodingError = false);
+
+	/// \param comment the comment to set in the header. The application is responsible for setting it.
+	///        RFC 1952 requires a ISO/IEC 8859-1 encoding.
+	/// \param throwOnEncodingError if throwOnEncodingError is true, then the comment is checked to ensure it is
+	///        ISO/IEC 8859-1 encoded. If the comment does not adhere to ISO/IEC 8859-1, then a InvalidDataFormat
+	///        is thrown. If throwOnEncodingError is false then the comment is not checked.
+	void SetComment(const std::string& comment, bool throwOnEncodingError = false);
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+
+protected:
+	enum {MAGIC1=0x1f, MAGIC2=0x8b,   // flags for the header
+		  DEFLATED=8, FAST=4, SLOW=2};
+
+	enum FLAG_MASKS {
+		FILENAME=8, COMMENTS=16};
+
+	void WritePrestreamHeader();
+	void ProcessUncompressedData(const byte *string, size_t length);
+	void WritePoststreamTail();
+
+	word32 m_totalLen;
+	CRC32 m_crc;
+
+	word32 m_filetime;
+	std::string m_filename;
+	std::string m_comment;
+};
+
+/// \brief GZIP Decompression (RFC 1952)
+class Gunzip : public Inflator
+{
+public:
+	typedef Inflator::Err Err;
+
+	/// \brief Exception thrown when a header decoding error occurs
+	class HeaderErr : public Err {public: HeaderErr() : Err(INVALID_DATA_FORMAT, "Gunzip: header decoding error") {}};
+	/// \brief Exception thrown when the tail is too short
+	class TailErr : public Err {public: TailErr() : Err(INVALID_DATA_FORMAT, "Gunzip: tail too short") {}};
+	/// \brief Exception thrown when a CRC error occurs
+	class CrcErr : public Err {public: CrcErr() : Err(DATA_INTEGRITY_CHECK_FAILED, "Gunzip: CRC check error") {}};
+	/// \brief Exception thrown when a length error occurs
+	class LengthErr : public Err {public: LengthErr() : Err(DATA_INTEGRITY_CHECK_FAILED, "Gunzip: length check error") {}};
+
+	/// \brief Construct a Gunzip decompressor
+	/// \param attachment an attached transformation
+	/// \param repeat decompress multiple compressed streams in series
+	/// \param autoSignalPropagation 0 to turn off MessageEnd signal
+	Gunzip(BufferedTransformation *attachment = NULLPTR, bool repeat = false, int autoSignalPropagation = -1);
+
+	/// \return the filetime of the stream as set in the header. The application is responsible for setting it on the decompressed file.
+	word32 GetFiletime() const { return m_filetime; }
+
+	/// \return the filename of the stream as set in the header. The application is responsible for setting it on the decompressed file.
+	/// \param throwOnEncodingError if throwOnEncodingError is true, then the filename is checked to ensure it is
+	///        ISO/IEC 8859-1 encoded. If the filename does not adhere to ISO/IEC 8859-1, then a InvalidDataFormat is thrown.
+	///        If throwOnEncodingError is false then the filename is not checked.
+	const std::string& GetFilename(bool throwOnEncodingError = false) const;
+
+	/// \return the comment of the stream as set in the header.
+	/// \param throwOnEncodingError if throwOnEncodingError is true, then the comment is checked to ensure it is
+	///        ISO/IEC 8859-1 encoded. If the comment does not adhere to ISO/IEC 8859-1, then a InvalidDataFormat is thrown.
+	///        If throwOnEncodingError is false then the comment is not checked.
+	const std::string& GetComment(bool throwOnEncodingError = false) const;
+
+protected:
+	enum {
+		/// \brief First header magic value
+		MAGIC1=0x1f,
+		/// \brief Second header magic value
+		MAGIC2=0x8b,
+		/// \brief Deflated flag
+		DEFLATED=8
+	};
+
+	enum FLAG_MASKS {
+		CONTINUED=2, EXTRA_FIELDS=4, FILENAME=8, COMMENTS=16, ENCRYPTED=32};
+
+	unsigned int MaxPrestreamHeaderSize() const {return 1024;}
+	void ProcessPrestreamHeader();
+	void ProcessDecompressedData(const byte *string, size_t length);
+	unsigned int MaxPoststreamTailSize() const {return 8;}
+	void ProcessPoststreamTail();
+
+	word32 m_length;
+	CRC32 m_crc;
+
+	word32 m_filetime;
+	std::string m_filename;
+	std::string m_comment;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/hashfwd.h b/runtime/third_party/cryptopp/hashfwd.h
new file mode 100644
index 0000000..5e1309d
--- /dev/null
+++ b/runtime/third_party/cryptopp/hashfwd.h
@@ -0,0 +1,38 @@
+// hashfwd.h - written and placed in the public domain by Jeffrey Walton
+
+/// \file hashfwd.h
+/// \brief Forward declarations for hash functions used in signature encoding methods
+
+#ifndef CRYPTOPP_HASHFWD_H
+#define CRYPTOPP_HASHFWD_H
+
+#include "config.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+class SHA1;
+class SHA224;
+class SHA256;
+class SHA384;
+class SHA512;
+
+class SHA3_256;
+class SHA3_384;
+class SHA3_512;
+
+class SHAKE128;
+class SHAKE256;
+
+class Tiger;
+class RIPEMD128;
+class RIPEMD160;
+class Whirlpool;
+
+namespace Weak1 {
+  class MD2;
+  class MD5;
+}
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_HASHFWD_H
diff --git a/runtime/third_party/cryptopp/hc128.cpp b/runtime/third_party/cryptopp/hc128.cpp
new file mode 100644
index 0000000..3c50f9e
--- /dev/null
+++ b/runtime/third_party/cryptopp/hc128.cpp
@@ -0,0 +1,272 @@
+// hc128.cpp - written and placed in the public domain by Jeffrey Walton
+//             based on public domain code by Hongjun Wu.
+//
+//             The reference materials and source files are available at
+//             The eSTREAM Project, http://www.ecrypt.eu.org/stream/e2-hc128.html.
+
+#include "pch.h"
+#include "config.h"
+
+#include "hc128.h"
+#include "secblock.h"
+#include "strciphr.h"
+#include "misc.h"
+
+/*h1 function*/
+#define h1(x, y) {           \
+     byte a,c;               \
+     a = (byte) (x);         \
+     c = (byte) ((x) >> 16); \
+     y = (m_T[512+a])+(m_T[512+256+c]); \
+}
+
+/*h2 function*/
+#define h2(x, y) {           \
+     byte a,c;               \
+     a = (byte) (x);         \
+     c = (byte) ((x) >> 16); \
+     y = (m_T[a])+(m_T[256+c]); \
+}
+
+/*one step of HC-128, update P and generate 32 bits keystream*/
+#define step_P(u,v,a,b,c,d,n){           \
+     word32 tem0,tem1,tem2,tem3;         \
+     h1(m_X[(d)],tem3);                  \
+     tem0 = rotrConstant<23>(m_T[(v)]);  \
+     tem1 = rotrConstant<10>(m_X[(c)]);  \
+     tem2 = rotrConstant<8>(m_X[(b)]);   \
+     (m_T[(u)]) += tem2+(tem0 ^ tem1);   \
+     (m_X[(a)]) = (m_T[(u)]);            \
+     (n) = tem3 ^ (m_T[(u)]);            \
+}
+
+/*one step of HC-128, update Q and generate 32 bits keystream*/
+#define step_Q(u,v,a,b,c,d,n){                \
+     word32 tem0,tem1,tem2,tem3;              \
+     h2(m_Y[(d)],tem3);                       \
+     tem0 = rotrConstant<(32-23)>(m_T[(v)]);  \
+     tem1 = rotrConstant<(32-10)>(m_Y[(c)]);  \
+     tem2 = rotrConstant<(32-8)>(m_Y[(b)]);   \
+     (m_T[(u)]) += tem2 + (tem0 ^ tem1);      \
+     (m_Y[(a)]) = (m_T[(u)]);                 \
+     (n) = tem3 ^ (m_T[(u)]) ;                \
+}
+
+/*update table P*/
+#define update_P(u,v,a,b,c,d){                \
+     word32 tem0,tem1,tem2,tem3;              \
+     tem0 = rotrConstant<23>(m_T[(v)]);       \
+     tem1 = rotrConstant<10>(m_X[(c)]);       \
+     tem2 = rotrConstant<8>(m_X[(b)]);        \
+     h1(m_X[(d)],tem3);                       \
+     (m_T[(u)]) = ((m_T[(u)]) + tem2+(tem0^tem1)) ^ tem3;  \
+     (m_X[(a)]) = (m_T[(u)]);                 \
+}
+
+/*update table Q*/
+#define update_Q(u,v,a,b,c,d){                \
+     word32 tem0,tem1,tem2,tem3;              \
+     tem0 = rotrConstant<(32-23)>(m_T[(v)]);  \
+     tem1 = rotrConstant<(32-10)>(m_Y[(c)]);  \
+     tem2 = rotrConstant<(32-8)>(m_Y[(b)]);   \
+     h2(m_Y[(d)],tem3);                       \
+     (m_T[(u)]) = ((m_T[(u)]) + tem2+(tem0^tem1)) ^ tem3; \
+     (m_Y[(a)]) = (m_T[(u)]);                 \
+}
+
+#define BYTES_PER_ITERATION 64
+
+#define WordType word32
+
+#define HC128_OUTPUT(x){\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  0, keystream[ 0]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  1, keystream[ 1]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  2, keystream[ 2]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  3, keystream[ 3]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  4, keystream[ 4]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  5, keystream[ 5]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  6, keystream[ 6]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  7, keystream[ 7]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  8, keystream[ 8]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  9, keystream[ 9]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 10, keystream[10]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 11, keystream[11]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 12, keystream[12]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 13, keystream[13]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 14, keystream[14]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 15, keystream[15]);}
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+using CryptoPP::rotrConstant;
+
+inline word32 f1(word32 x)
+{
+	return rotrConstant<7>(x) ^ rotrConstant<18>(x) ^ ((x) >> 3);
+}
+
+inline word32 f2(word32 x)
+{
+	return rotrConstant<17>(x) ^ rotrConstant<19>(x) ^ ((x) >> 10);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/*16 steps of HC-128, generate 512 bits keystream*/
+void HC128Policy::GenerateKeystream(word32 keystream[16])
+{
+	unsigned int cc = m_ctr & 0x1ff;
+	unsigned int dd = (cc + 16) & 0x1ff;
+
+	if (m_ctr < 512)
+	{
+		m_ctr = (m_ctr + 16) & 0x3ff;
+		step_P(cc + 0, cc + 1, 0, 6, 13, 4, keystream[0]);
+		step_P(cc + 1, cc + 2, 1, 7, 14, 5, keystream[1]);
+		step_P(cc + 2, cc + 3, 2, 8, 15, 6, keystream[2]);
+		step_P(cc + 3, cc + 4, 3, 9, 0, 7, keystream[3]);
+		step_P(cc + 4, cc + 5, 4, 10, 1, 8, keystream[4]);
+		step_P(cc + 5, cc + 6, 5, 11, 2, 9, keystream[5]);
+		step_P(cc + 6, cc + 7, 6, 12, 3, 10, keystream[6]);
+		step_P(cc + 7, cc + 8, 7, 13, 4, 11, keystream[7]);
+		step_P(cc + 8, cc + 9, 8, 14, 5, 12, keystream[8]);
+		step_P(cc + 9, cc + 10, 9, 15, 6, 13, keystream[9]);
+		step_P(cc + 10, cc + 11, 10, 0, 7, 14, keystream[10]);
+		step_P(cc + 11, cc + 12, 11, 1, 8, 15, keystream[11]);
+		step_P(cc + 12, cc + 13, 12, 2, 9, 0, keystream[12]);
+		step_P(cc + 13, cc + 14, 13, 3, 10, 1, keystream[13]);
+		step_P(cc + 14, cc + 15, 14, 4, 11, 2, keystream[14]);
+		step_P(cc + 15, dd + 0, 15, 5, 12, 3, keystream[15]);
+	}
+	else
+	{
+		m_ctr = (m_ctr + 16) & 0x3ff;
+		step_Q(512 + cc + 0, 512 + cc + 1, 0, 6, 13, 4, keystream[0]);
+		step_Q(512 + cc + 1, 512 + cc + 2, 1, 7, 14, 5, keystream[1]);
+		step_Q(512 + cc + 2, 512 + cc + 3, 2, 8, 15, 6, keystream[2]);
+		step_Q(512 + cc + 3, 512 + cc + 4, 3, 9, 0, 7, keystream[3]);
+		step_Q(512 + cc + 4, 512 + cc + 5, 4, 10, 1, 8, keystream[4]);
+		step_Q(512 + cc + 5, 512 + cc + 6, 5, 11, 2, 9, keystream[5]);
+		step_Q(512 + cc + 6, 512 + cc + 7, 6, 12, 3, 10, keystream[6]);
+		step_Q(512 + cc + 7, 512 + cc + 8, 7, 13, 4, 11, keystream[7]);
+		step_Q(512 + cc + 8, 512 + cc + 9, 8, 14, 5, 12, keystream[8]);
+		step_Q(512 + cc + 9, 512 + cc + 10, 9, 15, 6, 13, keystream[9]);
+		step_Q(512 + cc + 10, 512 + cc + 11, 10, 0, 7, 14, keystream[10]);
+		step_Q(512 + cc + 11, 512 + cc + 12, 11, 1, 8, 15, keystream[11]);
+		step_Q(512 + cc + 12, 512 + cc + 13, 12, 2, 9, 0, keystream[12]);
+		step_Q(512 + cc + 13, 512 + cc + 14, 13, 3, 10, 1, keystream[13]);
+		step_Q(512 + cc + 14, 512 + cc + 15, 14, 4, 11, 2, keystream[14]);
+		step_Q(512 + cc + 15, 512 + dd + 0, 15, 5, 12, 3, keystream[15]);
+	}
+}
+
+/*16 steps of HC-128, without generating keystream, */
+/*but use the outputs to update P and Q*/
+void HC128Policy::SetupUpdate()  /*each time 16 steps*/
+{
+	unsigned int cc = m_ctr & 0x1ff;
+	unsigned int dd = (cc + 16) & 0x1ff;
+
+	if (m_ctr < 512)
+	{
+		m_ctr = (m_ctr + 16) & 0x3ff;
+		update_P(cc + 0, cc + 1, 0, 6, 13, 4);
+		update_P(cc + 1, cc + 2, 1, 7, 14, 5);
+		update_P(cc + 2, cc + 3, 2, 8, 15, 6);
+		update_P(cc + 3, cc + 4, 3, 9, 0, 7);
+		update_P(cc + 4, cc + 5, 4, 10, 1, 8);
+		update_P(cc + 5, cc + 6, 5, 11, 2, 9);
+		update_P(cc + 6, cc + 7, 6, 12, 3, 10);
+		update_P(cc + 7, cc + 8, 7, 13, 4, 11);
+		update_P(cc + 8, cc + 9, 8, 14, 5, 12);
+		update_P(cc + 9, cc + 10, 9, 15, 6, 13);
+		update_P(cc + 10, cc + 11, 10, 0, 7, 14);
+		update_P(cc + 11, cc + 12, 11, 1, 8, 15);
+		update_P(cc + 12, cc + 13, 12, 2, 9, 0);
+		update_P(cc + 13, cc + 14, 13, 3, 10, 1);
+		update_P(cc + 14, cc + 15, 14, 4, 11, 2);
+		update_P(cc + 15, dd + 0, 15, 5, 12, 3);
+	}
+	else
+	{
+		m_ctr = (m_ctr + 16) & 0x3ff;
+		update_Q(512 + cc + 0, 512 + cc + 1, 0, 6, 13, 4);
+		update_Q(512 + cc + 1, 512 + cc + 2, 1, 7, 14, 5);
+		update_Q(512 + cc + 2, 512 + cc + 3, 2, 8, 15, 6);
+		update_Q(512 + cc + 3, 512 + cc + 4, 3, 9, 0, 7);
+		update_Q(512 + cc + 4, 512 + cc + 5, 4, 10, 1, 8);
+		update_Q(512 + cc + 5, 512 + cc + 6, 5, 11, 2, 9);
+		update_Q(512 + cc + 6, 512 + cc + 7, 6, 12, 3, 10);
+		update_Q(512 + cc + 7, 512 + cc + 8, 7, 13, 4, 11);
+		update_Q(512 + cc + 8, 512 + cc + 9, 8, 14, 5, 12);
+		update_Q(512 + cc + 9, 512 + cc + 10, 9, 15, 6, 13);
+		update_Q(512 + cc + 10, 512 + cc + 11, 10, 0, 7, 14);
+		update_Q(512 + cc + 11, 512 + cc + 12, 11, 1, 8, 15);
+		update_Q(512 + cc + 12, 512 + cc + 13, 12, 2, 9, 0);
+		update_Q(512 + cc + 13, 512 + cc + 14, 13, 3, 10, 1);
+		update_Q(512 + cc + 14, 512 + cc + 15, 14, 4, 11, 2);
+		update_Q(512 + cc + 15, 512 + dd + 0, 15, 5, 12, 3);
+	}
+}
+
+void HC128Policy::CipherSetKey(const NameValuePairs &params, const byte *userKey, size_t keylen)
+{
+	CRYPTOPP_UNUSED(params);
+
+	GetUserKey(LITTLE_ENDIAN_ORDER, m_key.begin(), 4, userKey, keylen);
+	for (unsigned int i = 4; i < 8; i++)
+		m_key[i] = m_key[i - 4];
+}
+
+void HC128Policy::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+	while (iterationCount--)
+	{
+		FixedSizeSecBlock<word32, 16> keystream;
+		GenerateKeystream(keystream);
+
+		CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(HC128_OUTPUT, BYTES_PER_ITERATION);
+	}
+}
+
+void HC128Policy::CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer);
+
+	GetUserKey(LITTLE_ENDIAN_ORDER, m_iv.begin(), 4, iv, length);
+	for (unsigned int i = 4; i < 8; i++)
+		m_iv[i] = m_iv[i - 4];
+
+	/* expand the key and IV into the table T */
+	/* (expand the key and IV into the table P and Q) */
+
+	for (unsigned int i = 0; i < 8; i++)
+		m_T[i] = m_key[i];
+	for (unsigned int i = 8; i < 16; i++)
+		m_T[i] = m_iv[i - 8];
+
+	for (unsigned int i = 16; i < (256 + 16); i++)
+		m_T[i] = f2(m_T[i - 2]) + m_T[i - 7] + f1(m_T[i - 15]) + m_T[i - 16] + i;
+
+	for (unsigned int i = 0; i < 16; i++)
+		m_T[i] = m_T[256 + i];
+
+	for (unsigned int i = 16; i < 1024; i++)
+		m_T[i] = f2(m_T[i - 2]) + m_T[i - 7] + f1(m_T[i - 15]) + m_T[i - 16] + 256 + i;
+
+	/* initialize counter1024, X and Y */
+	m_ctr = 0;
+	for (unsigned int i = 0; i < 16; i++)
+		m_X[i] = m_T[512 - 16 + i];
+	for (unsigned int i = 0; i < 16; i++)
+		m_Y[i] = m_T[512 + 512 - 16 + i];
+
+	/* run the cipher 1024 steps before generating the output */
+	for (unsigned int i = 0; i < 64; i++)
+		SetupUpdate();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/hc128.h b/runtime/third_party/cryptopp/hc128.h
new file mode 100644
index 0000000..a35352c
--- /dev/null
+++ b/runtime/third_party/cryptopp/hc128.h
@@ -0,0 +1,67 @@
+// hc128.h - written and placed in the public domain by Jeffrey Walton
+//           based on public domain code by Hongjun Wu.
+//
+//           The reference materials and source files are available at
+//           The eSTREAM Project, http://www.ecrypt.eu.org/stream/e2-hc128.html.
+
+/// \file hc128.h
+/// \brief Classes for HC-128 stream cipher
+/// \sa <A HREF="http://www.ecrypt.eu.org/stream/e2-hc128.html">The
+///   eSTREAM Project | HC-128</A> and
+///   <A HREF="https://www.cryptopp.com/wiki/HC-128">Crypto++ Wiki | HC-128</A>.
+/// \since Crypto++ 8.0
+
+#ifndef CRYPTOPP_HC128_H
+#define CRYPTOPP_HC128_H
+
+#include "strciphr.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief HC-128 stream cipher information
+/// \since Crypto++ 8.0
+struct HC128Info : public FixedKeyLength<16, SimpleKeyingInterface::UNIQUE_IV, 16>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "HC-128"; }
+};
+
+/// \brief HC-128 stream cipher implementation
+/// \since Crypto++ 8.0
+class HC128Policy : public AdditiveCipherConcretePolicy<word32, 16>, public HC128Info
+{
+protected:
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	void CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length);
+	bool CanOperateKeystream() const { return true; }
+	bool CipherIsRandomAccess() const { return false; }
+
+	void GenerateKeystream(word32* keystream);
+	void SetupUpdate();
+
+private:
+	FixedSizeSecBlock<word32, 16> m_X;
+	FixedSizeSecBlock<word32, 16> m_Y;
+	FixedSizeSecBlock<word32, 8> m_key;
+	FixedSizeSecBlock<word32, 8> m_iv;
+	word32 m_T[1024];
+	word32 m_ctr;
+};
+
+/// \brief HC-128 stream cipher
+/// \details HC-128 is a stream cipher developed by Hongjun Wu. HC-128 is one of the
+///   final four Profile 1 (software) ciphers selected for the eSTREAM portfolio.
+/// \sa <A HREF="http://www.ecrypt.eu.org/stream/e2-hc128.html">The
+///   eSTREAM Project | HC-128</A> and
+///   <A HREF="https://www.cryptopp.com/wiki/HC-128">Crypto++ Wiki | HC-128</A>.
+/// \since Crypto++ 8.0
+struct HC128 : public HC128Info, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<HC128Policy, AdditiveCipherTemplate<> >, HC128Info> Encryption;
+	typedef Encryption Decryption;
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_HC128_H
diff --git a/runtime/third_party/cryptopp/hc256.cpp b/runtime/third_party/cryptopp/hc256.cpp
new file mode 100644
index 0000000..693f420
--- /dev/null
+++ b/runtime/third_party/cryptopp/hc256.cpp
@@ -0,0 +1,163 @@
+// hc256.cpp - written and placed in the public domain by Jeffrey Walton
+//             based on public domain code by Hongjun Wu.
+//
+//             The reference materials and source files are available at
+//             The eSTREAM Project, http://www.ecrypt.eu.org/stream/hc256.html.
+
+#include "pch.h"
+#include "config.h"
+
+#include "hc256.h"
+#include "secblock.h"
+#include "strciphr.h"
+#include "misc.h"
+
+#define BYTES_PER_ITERATION 16
+
+#define WordType word32
+
+#define HC256_OUTPUT(x){\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  0, keystream[0]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  1, keystream[1]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  2, keystream[2]);\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER,  3, keystream[3]);}
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+using CryptoPP::rotrConstant;
+
+inline word32 f1(word32 x)
+{
+	return rotrConstant<7>(x) ^ rotrConstant<18>(x) ^ (x >> 3);
+}
+
+inline word32 f2(word32 x)
+{
+	return rotrConstant<17>(x) ^ rotrConstant<19>(x) ^ (x >> 10);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+inline word32 HC256Policy::H1(word32 u)
+{
+	word32 tem;
+	byte a, b, c, d;
+	a = (byte)(u);
+	b = (byte)(u >> 8);
+	c = (byte)(u >> 16);
+	d = (byte)(u >> 24);
+	tem = m_Q[a] + m_Q[256 + b] + m_Q[512 + c] + m_Q[768 + d];
+	return (tem);
+}
+
+inline word32 HC256Policy::H2(word32 u)
+{
+	word32 tem;
+	byte a, b, c, d;
+	a = (byte)(u);
+	b = (byte)(u >> 8);
+	c = (byte)(u >> 16);
+	d = (byte)(u >> 24);
+	tem = m_P[a] + m_P[256 + b] + m_P[512 + c] + m_P[768 + d];
+	return (tem);
+}
+
+inline word32 HC256Policy::Generate() /*one step of the cipher*/
+{
+	word32 i, i3, i10, i12, i1023;
+	word32 output;
+
+	i = m_ctr & 0x3ff;
+	i3 = (i - 3) & 0x3ff;
+	i10 = (i - 10) & 0x3ff;
+	i12 = (i - 12) & 0x3ff;
+	i1023 = (i - 1023) & 0x3ff;
+
+	if (m_ctr < 1024) {
+		m_P[i] = m_P[i] + m_P[i10] + (rotrConstant<10>(m_P[i3]) ^ rotrConstant<23>(m_P[i1023])) + m_Q[(m_P[i3] ^ m_P[i1023]) & 0x3ff];
+		output = H1(m_P[i12]) ^ m_P[i];
+	}
+	else {
+		m_Q[i] = m_Q[i] + m_Q[i10] + (rotrConstant<10>(m_Q[i3]) ^ rotrConstant<23>(m_Q[i1023])) + m_P[(m_Q[i3] ^ m_Q[i1023]) & 0x3ff];
+		output = H2(m_Q[i12]) ^ m_Q[i];
+	}
+	m_ctr = (m_ctr + 1) & 0x7ff;
+	return (output);
+}
+
+void HC256Policy::GenerateKeystream(word32 keystream[4])
+{
+	keystream[0] = Generate();
+	keystream[1] = Generate();
+	keystream[2] = Generate();
+	keystream[3] = Generate();
+}
+
+void HC256Policy::CipherSetKey(const NameValuePairs &params, const byte *userKey, size_t keylen)
+{
+	CRYPTOPP_UNUSED(params); CRYPTOPP_UNUSED(keylen);
+	CRYPTOPP_ASSERT(keylen == 32);
+
+	for (unsigned int i = 0; i < 8; i++)
+		m_key[i] = 0;
+
+	for (unsigned int i = 0; i < 32; i++)
+	{
+		m_key[i >> 2] = m_key[i >> 2] | userKey[i];
+		m_key[i >> 2] = rotlConstant<8>(m_key[i >> 2]);
+	}
+}
+
+void HC256Policy::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+	while (iterationCount--)
+	{
+		FixedSizeSecBlock<word32, 4> keystream;
+		GenerateKeystream(keystream);
+
+		CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(HC256_OUTPUT, BYTES_PER_ITERATION);
+	}
+}
+
+void HC256Policy::CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer); CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(length == 32);
+
+	/* initialize the iv */
+	word32 W[2560];
+	for (unsigned int i = 0; i < 8; i++)
+		m_iv[i] = 0;
+
+	for (unsigned int i = 0; i < 32; i++)
+	{
+		m_iv[i >> 2] = m_iv[i >> 2] | iv[i];
+		m_iv[i >> 2] = rotlConstant<8>(m_iv[i >> 2]);
+	}
+
+	/* setup the table P and Q */
+
+	for (unsigned int i = 0; i < 8; i++)
+		W[i] = m_key[i];
+	for (unsigned int i = 8; i < 16; i++)
+		W[i] = m_iv[i - 8];
+
+	for (unsigned int i = 16; i < 2560; i++)
+		W[i] = f2(W[i - 2]) + W[i - 7] + f1(W[i - 15]) + W[i - 16] + i;
+
+	for (unsigned int i = 0; i < 1024; i++)
+		m_P[i] = W[i + 512];
+	for (unsigned int i = 0; i < 1024; i++)
+		m_Q[i] = W[i + 1536];
+
+	m_ctr = 0;
+
+	/* run the cipher 4096 steps before generating the output */
+	for (unsigned int i = 0; i < 4096; i++)
+		Generate();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/hc256.h b/runtime/third_party/cryptopp/hc256.h
new file mode 100644
index 0000000..169d0b9
--- /dev/null
+++ b/runtime/third_party/cryptopp/hc256.h
@@ -0,0 +1,69 @@
+// hc256.h - written and placed in the public domain by Jeffrey Walton
+//           based on public domain code by Hongjun Wu.
+//
+//           The reference materials and source files are available at
+//           The eSTREAM Project, http://www.ecrypt.eu.org/stream/hc256.html.
+
+/// \file hc256.h
+/// \brief Classes for HC-256 stream cipher
+/// \sa <A HREF="http://www.ecrypt.eu.org/stream/hc256.html">The
+///   eSTREAM Project | HC-256</A> and
+///   <A HREF="https://www.cryptopp.com/wiki/HC-128">Crypto++ Wiki | HC-128</A>.
+/// \since Crypto++ 8.0
+
+#ifndef CRYPTOPP_HC256_H
+#define CRYPTOPP_HC256_H
+
+#include "strciphr.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief HC-256 stream cipher information
+/// \since Crypto++ 8.0
+struct HC256Info : public FixedKeyLength<32, SimpleKeyingInterface::UNIQUE_IV, 32>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "HC-256"; }
+};
+
+/// \brief HC-256 stream cipher implementation
+/// \since Crypto++ 8.0
+class HC256Policy : public AdditiveCipherConcretePolicy<word32, 4>, public HC256Info
+{
+protected:
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	void CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length);
+	bool CanOperateKeystream() const { return true; }
+	bool CipherIsRandomAccess() const { return false; }
+
+	word32 H1(word32 u);
+	word32 H2(word32 u);
+
+	void GenerateKeystream(word32* keystream);
+	word32 Generate();
+
+private:
+	FixedSizeSecBlock<word32, 8> m_key;
+	FixedSizeSecBlock<word32, 8> m_iv;
+	word32 m_P[1024];
+	word32 m_Q[1024];
+	word32 m_ctr;
+};
+
+/// \brief HC-256 stream cipher
+/// \details HC-256 is a stream cipher developed by Hongjun Wu. HC-256 is the
+///   successor to HC-128 from the eSTREAM project.
+/// \sa <A HREF="http://www.ecrypt.eu.org/stream/hc256.html">The
+///   eSTREAM Project | HC-256</A> and
+///   <A HREF="https://www.cryptopp.com/wiki/HC-128">Crypto++ Wiki | HC-128</A>.
+/// \since Crypto++ 8.0
+struct HC256 : public HC256Info, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<HC256Policy, AdditiveCipherTemplate<> >, HC256Info> Encryption;
+	typedef Encryption Decryption;
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_HC256_H
diff --git a/runtime/third_party/cryptopp/hex.cpp b/runtime/third_party/cryptopp/hex.cpp
new file mode 100644
index 0000000..32ca56f
--- /dev/null
+++ b/runtime/third_party/cryptopp/hex.cpp
@@ -0,0 +1,58 @@
+// hex.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "hex.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+ANONYMOUS_NAMESPACE_BEGIN
+
+const byte s_vecUpper[] = "0123456789ABCDEF";
+const byte s_vecLower[] = "0123456789abcdef";
+const int s_array[256] = {
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, -1, -1, -1, -1, -1, -1,
+	-1, 10, 11, 12, 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, 10, 11, 12, 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+};
+
+ANONYMOUS_NAMESPACE_END
+
+void HexEncoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	bool uppercase = parameters.GetValueWithDefault(Name::Uppercase(), true);
+	m_filter->Initialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::EncodingLookupArray(), uppercase ? &s_vecUpper[0] : &s_vecLower[0], false)(Name::Log2Base(), 4, true)));
+}
+
+void HexDecoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	BaseN_Decoder::IsolatedInitialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::DecodingLookupArray(), GetDefaultDecodingLookupArray(), false)(Name::Log2Base(), 4, true)));
+}
+
+// Unrolled initialization, http://github.com/weidai11/cryptopp/issues/376
+const int *HexDecoder::GetDefaultDecodingLookupArray()
+{
+	return s_array;
+}
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_IMPORTS
diff --git a/runtime/third_party/cryptopp/hex.h b/runtime/third_party/cryptopp/hex.h
new file mode 100644
index 0000000..bcf2bd0
--- /dev/null
+++ b/runtime/third_party/cryptopp/hex.h
@@ -0,0 +1,50 @@
+// hex.h - originally written and placed in the public domain by Wei Dai
+
+/// \file hex.h
+/// \brief Classes for HexEncoder and HexDecoder
+
+#ifndef CRYPTOPP_HEX_H
+#define CRYPTOPP_HEX_H
+
+#include "cryptlib.h"
+#include "basecode.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Converts given data to base 16
+class CRYPTOPP_DLL HexEncoder : public SimpleProxyFilter
+{
+public:
+	/// \brief Construct a HexEncoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	/// \param uppercase a flag indicating uppercase output
+	/// \param groupSize the size of the output grouping
+	/// \param separator the separator to use between groups
+	/// \param terminator the terminator append after processing
+	HexEncoder(BufferedTransformation *attachment = NULLPTR, bool uppercase = true, int groupSize = 0, const std::string &separator = ":", const std::string &terminator = "")
+		: SimpleProxyFilter(new BaseN_Encoder(new Grouper), attachment)
+	{
+		IsolatedInitialize(MakeParameters(Name::Uppercase(), uppercase)(Name::GroupSize(), groupSize)(Name::Separator(), ConstByteArrayParameter(separator))(Name::Terminator(), ConstByteArrayParameter(terminator)));
+	}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+};
+
+/// \brief Decode base 16 data back to bytes
+class CRYPTOPP_DLL HexDecoder : public BaseN_Decoder
+{
+public:
+	/// \brief Construct a HexDecoder
+	/// \param attachment a BufferedTrasformation to attach to this object
+	HexDecoder(BufferedTransformation *attachment = NULLPTR)
+		: BaseN_Decoder(GetDefaultDecodingLookupArray(), 4, attachment) {}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+
+private:
+	static const int * CRYPTOPP_API GetDefaultDecodingLookupArray();
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/hight.cpp b/runtime/third_party/cryptopp/hight.cpp
new file mode 100644
index 0000000..499bfcb
--- /dev/null
+++ b/runtime/third_party/cryptopp/hight.cpp
@@ -0,0 +1,298 @@
+// lea.cpp - written and placed in the public domain by Kim Sung Hee and Jeffrey Walton
+//           Based on "HIGHT: A 128-Bit Block Cipher for Fast Encryption on Common
+//           Processors" by Deukjo Hong, Jung-Keun Lee, Dong-Chan Kim, Daesung Kwon,
+//           Kwon Ho Ryu, and Dong-Geon Lee.
+//
+//           This implementation is based on source files found in a zip file at the
+//           Korea Internet and Security Agency (https://www.kisa.or.kr/eng/main.jsp).
+//           The zip files was downloaded from the Korean language area of the site so we
+//           don't have a url or english zip filename to cite. The source filename from
+//           the zip is KISA_HIGHT_ECB.c.
+
+#include "pch.h"
+#include "config.h"
+
+#include "hight.h"
+#include "misc.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+
+const byte DELTA[128] = {
+    0x5A,0x6D,0x36,0x1B,0x0D,0x06,0x03,0x41,
+    0x60,0x30,0x18,0x4C,0x66,0x33,0x59,0x2C,
+    0x56,0x2B,0x15,0x4A,0x65,0x72,0x39,0x1C,
+    0x4E,0x67,0x73,0x79,0x3C,0x5E,0x6F,0x37,
+    0x5B,0x2D,0x16,0x0B,0x05,0x42,0x21,0x50,
+    0x28,0x54,0x2A,0x55,0x6A,0x75,0x7A,0x7D,
+    0x3E,0x5F,0x2F,0x17,0x4B,0x25,0x52,0x29,
+    0x14,0x0A,0x45,0x62,0x31,0x58,0x6C,0x76,
+    0x3B,0x1D,0x0E,0x47,0x63,0x71,0x78,0x7C,
+    0x7E,0x7F,0x3F,0x1F,0x0F,0x07,0x43,0x61,
+    0x70,0x38,0x5C,0x6E,0x77,0x7B,0x3D,0x1E,
+    0x4F,0x27,0x53,0x69,0x34,0x1A,0x4D,0x26,
+    0x13,0x49,0x24,0x12,0x09,0x04,0x02,0x01,
+    0x40,0x20,0x10,0x08,0x44,0x22,0x11,0x48,
+    0x64,0x32,0x19,0x0C,0x46,0x23,0x51,0x68,
+    0x74,0x3A,0x5D,0x2E,0x57,0x6B,0x35,0x5A
+};
+
+const byte HIGHT_F0[256] = {
+    0x00,0x86,0x0D,0x8B,0x1A,0x9C,0x17,0x91,
+    0x34,0xB2,0x39,0xBF,0x2E,0xA8,0x23,0xA5,
+    0x68,0xEE,0x65,0xE3,0x72,0xF4,0x7F,0xF9,
+    0x5C,0xDA,0x51,0xD7,0x46,0xC0,0x4B,0xCD,
+    0xD0,0x56,0xDD,0x5B,0xCA,0x4C,0xC7,0x41,
+    0xE4,0x62,0xE9,0x6F,0xFE,0x78,0xF3,0x75,
+    0xB8,0x3E,0xB5,0x33,0xA2,0x24,0xAF,0x29,
+    0x8C,0x0A,0x81,0x07,0x96,0x10,0x9B,0x1D,
+    0xA1,0x27,0xAC,0x2A,0xBB,0x3D,0xB6,0x30,
+    0x95,0x13,0x98,0x1E,0x8F,0x09,0x82,0x04,
+    0xC9,0x4F,0xC4,0x42,0xD3,0x55,0xDE,0x58,
+    0xFD,0x7B,0xF0,0x76,0xE7,0x61,0xEA,0x6C,
+    0x71,0xF7,0x7C,0xFA,0x6B,0xED,0x66,0xE0,
+    0x45,0xC3,0x48,0xCE,0x5F,0xD9,0x52,0xD4,
+    0x19,0x9F,0x14,0x92,0x03,0x85,0x0E,0x88,
+    0x2D,0xAB,0x20,0xA6,0x37,0xB1,0x3A,0xBC,
+    0x43,0xC5,0x4E,0xC8,0x59,0xDF,0x54,0xD2,
+    0x77,0xF1,0x7A,0xFC,0x6D,0xEB,0x60,0xE6,
+    0x2B,0xAD,0x26,0xA0,0x31,0xB7,0x3C,0xBA,
+    0x1F,0x99,0x12,0x94,0x05,0x83,0x08,0x8E,
+    0x93,0x15,0x9E,0x18,0x89,0x0F,0x84,0x02,
+    0xA7,0x21,0xAA,0x2C,0xBD,0x3B,0xB0,0x36,
+    0xFB,0x7D,0xF6,0x70,0xE1,0x67,0xEC,0x6A,
+    0xCF,0x49,0xC2,0x44,0xD5,0x53,0xD8,0x5E,
+    0xE2,0x64,0xEF,0x69,0xF8,0x7E,0xF5,0x73,
+    0xD6,0x50,0xDB,0x5D,0xCC,0x4A,0xC1,0x47,
+    0x8A,0x0C,0x87,0x01,0x90,0x16,0x9D,0x1B,
+    0xBE,0x38,0xB3,0x35,0xA4,0x22,0xA9,0x2F,
+    0x32,0xB4,0x3F,0xB9,0x28,0xAE,0x25,0xA3,
+    0x06,0x80,0x0B,0x8D,0x1C,0x9A,0x11,0x97,
+    0x5A,0xDC,0x57,0xD1,0x40,0xC6,0x4D,0xCB,
+    0x6E,0xE8,0x63,0xE5,0x74,0xF2,0x79,0xFF
+};
+
+const byte HIGHT_F1[256] = {
+    0x00,0x58,0xB0,0xE8,0x61,0x39,0xD1,0x89,
+    0xC2,0x9A,0x72,0x2A,0xA3,0xFB,0x13,0x4B,
+    0x85,0xDD,0x35,0x6D,0xE4,0xBC,0x54,0x0C,
+    0x47,0x1F,0xF7,0xAF,0x26,0x7E,0x96,0xCE,
+    0x0B,0x53,0xBB,0xE3,0x6A,0x32,0xDA,0x82,
+    0xC9,0x91,0x79,0x21,0xA8,0xF0,0x18,0x40,
+    0x8E,0xD6,0x3E,0x66,0xEF,0xB7,0x5F,0x07,
+    0x4C,0x14,0xFC,0xA4,0x2D,0x75,0x9D,0xC5,
+    0x16,0x4E,0xA6,0xFE,0x77,0x2F,0xC7,0x9F,
+    0xD4,0x8C,0x64,0x3C,0xB5,0xED,0x05,0x5D,
+    0x93,0xCB,0x23,0x7B,0xF2,0xAA,0x42,0x1A,
+    0x51,0x09,0xE1,0xB9,0x30,0x68,0x80,0xD8,
+    0x1D,0x45,0xAD,0xF5,0x7C,0x24,0xCC,0x94,
+    0xDF,0x87,0x6F,0x37,0xBE,0xE6,0x0E,0x56,
+    0x98,0xC0,0x28,0x70,0xF9,0xA1,0x49,0x11,
+    0x5A,0x02,0xEA,0xB2,0x3B,0x63,0x8B,0xD3,
+    0x2C,0x74,0x9C,0xC4,0x4D,0x15,0xFD,0xA5,
+    0xEE,0xB6,0x5E,0x06,0x8F,0xD7,0x3F,0x67,
+    0xA9,0xF1,0x19,0x41,0xC8,0x90,0x78,0x20,
+    0x6B,0x33,0xDB,0x83,0x0A,0x52,0xBA,0xE2,
+    0x27,0x7F,0x97,0xCF,0x46,0x1E,0xF6,0xAE,
+    0xE5,0xBD,0x55,0x0D,0x84,0xDC,0x34,0x6C,
+    0xA2,0xFA,0x12,0x4A,0xC3,0x9B,0x73,0x2B,
+    0x60,0x38,0xD0,0x88,0x01,0x59,0xB1,0xE9,
+    0x3A,0x62,0x8A,0xD2,0x5B,0x03,0xEB,0xB3,
+    0xF8,0xA0,0x48,0x10,0x99,0xC1,0x29,0x71,
+    0xBF,0xE7,0x0F,0x57,0xDE,0x86,0x6E,0x36,
+    0x7D,0x25,0xCD,0x95,0x1C,0x44,0xAC,0xF4,
+    0x31,0x69,0x81,0xD9,0x50,0x08,0xE0,0xB8,
+    0xF3,0xAB,0x43,0x1B,0x92,0xCA,0x22,0x7A,
+    0xB4,0xEC,0x04,0x5C,0xD5,0x8D,0x65,0x3D,
+    0x76,0x2E,0xC6,0x9E,0x17,0x4F,0xA7,0xFF
+};
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void HIGHT::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_UNUSED(params);
+    CRYPTOPP_UNUSED(keyLength);
+
+    for(unsigned int i=0; i<4; i++) {
+        m_rkey[i  ] = userKey[i+12];
+        m_rkey[i+4] = userKey[i   ];
+    }
+
+    for(unsigned int i=0; i<8; i++) {
+        for(unsigned int j=0; j<8; j++) {
+            m_rkey[8+16*i+j] = static_cast<byte>(userKey[(j-i)&7] + DELTA[16*i+j]);
+        }
+
+        for(unsigned int j=0; j<8; j++) {
+            m_rkey[8+16*i+j+8] = static_cast<byte>(userKey[((j-i)&7)+8] + DELTA[16*i+j+8]);
+        }
+    }
+}
+
+void HIGHT::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // First Round
+    m_xx[1] = inBlock[1];
+    m_xx[3] = inBlock[3];
+    m_xx[5] = inBlock[5];
+    m_xx[7] = inBlock[7];
+
+    m_xx[0] = (inBlock[0] + m_rkey[0]) & 0xFF;
+    m_xx[2] = (inBlock[2] ^ m_rkey[1]);
+    m_xx[4] = (inBlock[4] + m_rkey[2]) & 0xFF;
+    m_xx[6] = (inBlock[6] ^ m_rkey[3]);
+
+    // Encryption Round
+    #define HIGHT_ENC(k, i0,i1,i2,i3,i4,i5,i6,i7) {                             \
+        m_xx[i0] = (m_xx[i0] ^ (HIGHT_F0[m_xx[i1]] + m_rkey[4*k+3])) & 0xFF;    \
+        m_xx[i2] = (m_xx[i2] + (HIGHT_F1[m_xx[i3]] ^ m_rkey[4*k+2])) & 0xFF;    \
+        m_xx[i4] = (m_xx[i4] ^ (HIGHT_F0[m_xx[i5]] + m_rkey[4*k+1])) & 0xFF;    \
+        m_xx[i6] = (m_xx[i6] + (HIGHT_F1[m_xx[i7]] ^ m_rkey[4*k+0])) & 0xFF;    \
+    }
+
+    HIGHT_ENC( 2,  7,6,5,4,3,2,1,0);
+    HIGHT_ENC( 3,  6,5,4,3,2,1,0,7);
+    HIGHT_ENC( 4,  5,4,3,2,1,0,7,6);
+    HIGHT_ENC( 5,  4,3,2,1,0,7,6,5);
+    HIGHT_ENC( 6,  3,2,1,0,7,6,5,4);
+    HIGHT_ENC( 7,  2,1,0,7,6,5,4,3);
+    HIGHT_ENC( 8,  1,0,7,6,5,4,3,2);
+    HIGHT_ENC( 9,  0,7,6,5,4,3,2,1);
+    HIGHT_ENC(10,  7,6,5,4,3,2,1,0);
+    HIGHT_ENC(11,  6,5,4,3,2,1,0,7);
+    HIGHT_ENC(12,  5,4,3,2,1,0,7,6);
+    HIGHT_ENC(13,  4,3,2,1,0,7,6,5);
+    HIGHT_ENC(14,  3,2,1,0,7,6,5,4);
+    HIGHT_ENC(15,  2,1,0,7,6,5,4,3);
+    HIGHT_ENC(16,  1,0,7,6,5,4,3,2);
+    HIGHT_ENC(17,  0,7,6,5,4,3,2,1);
+    HIGHT_ENC(18,  7,6,5,4,3,2,1,0);
+    HIGHT_ENC(19,  6,5,4,3,2,1,0,7);
+    HIGHT_ENC(20,  5,4,3,2,1,0,7,6);
+    HIGHT_ENC(21,  4,3,2,1,0,7,6,5);
+    HIGHT_ENC(22,  3,2,1,0,7,6,5,4);
+    HIGHT_ENC(23,  2,1,0,7,6,5,4,3);
+    HIGHT_ENC(24,  1,0,7,6,5,4,3,2);
+    HIGHT_ENC(25,  0,7,6,5,4,3,2,1);
+    HIGHT_ENC(26,  7,6,5,4,3,2,1,0);
+    HIGHT_ENC(27,  6,5,4,3,2,1,0,7);
+    HIGHT_ENC(28,  5,4,3,2,1,0,7,6);
+    HIGHT_ENC(29,  4,3,2,1,0,7,6,5);
+    HIGHT_ENC(30,  3,2,1,0,7,6,5,4);
+    HIGHT_ENC(31,  2,1,0,7,6,5,4,3);
+    HIGHT_ENC(32,  1,0,7,6,5,4,3,2);
+    HIGHT_ENC(33,  0,7,6,5,4,3,2,1);
+
+    if (xorBlock)
+    {
+        // Final Round
+        outBlock[1] = static_cast<byte>(m_xx[2] ^ xorBlock[1]);
+        outBlock[3] = static_cast<byte>(m_xx[4] ^ xorBlock[3]);
+        outBlock[5] = static_cast<byte>(m_xx[6] ^ xorBlock[5]);
+        outBlock[7] = static_cast<byte>(m_xx[0] ^ xorBlock[7]);
+
+        outBlock[0] = static_cast<byte>((m_xx[1] + m_rkey[4]) ^ xorBlock[0]);
+        outBlock[2] = static_cast<byte>((m_xx[3] ^ m_rkey[5]) ^ xorBlock[2]);
+        outBlock[4] = static_cast<byte>((m_xx[5] + m_rkey[6]) ^ xorBlock[4]);
+        outBlock[6] = static_cast<byte>((m_xx[7] ^ m_rkey[7]) ^ xorBlock[6]);
+    }
+    else
+    {
+        // Final Round
+        outBlock[1] = static_cast<byte>(m_xx[2]);
+        outBlock[3] = static_cast<byte>(m_xx[4]);
+        outBlock[5] = static_cast<byte>(m_xx[6]);
+        outBlock[7] = static_cast<byte>(m_xx[0]);
+
+        outBlock[0] = static_cast<byte>(m_xx[1] + m_rkey[4]);
+        outBlock[2] = static_cast<byte>(m_xx[3] ^ m_rkey[5]);
+        outBlock[4] = static_cast<byte>(m_xx[5] + m_rkey[6]);
+        outBlock[6] = static_cast<byte>(m_xx[7] ^ m_rkey[7]);
+    }
+}
+
+void HIGHT::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    m_xx[2] = static_cast<byte>(inBlock[1]);
+    m_xx[4] = static_cast<byte>(inBlock[3]);
+    m_xx[6] = static_cast<byte>(inBlock[5]);
+    m_xx[0] = static_cast<byte>(inBlock[7]);
+
+    m_xx[1] = static_cast<byte>(inBlock[0] - m_rkey[4]);
+    m_xx[3] = static_cast<byte>(inBlock[2] ^ m_rkey[5]);
+    m_xx[5] = static_cast<byte>(inBlock[4] - m_rkey[6]);
+    m_xx[7] = static_cast<byte>(inBlock[6] ^ m_rkey[7]);
+
+    #define HIGHT_DEC(k, i0,i1,i2,i3,i4,i5,i6,i7) {                             \
+        m_xx[i1] = (m_xx[i1] - (HIGHT_F1[m_xx[i2]] ^ m_rkey[4*k+2])) & 0xFF;    \
+        m_xx[i3] = (m_xx[i3] ^ (HIGHT_F0[m_xx[i4]] + m_rkey[4*k+1])) & 0xFF;    \
+        m_xx[i5] = (m_xx[i5] - (HIGHT_F1[m_xx[i6]] ^ m_rkey[4*k+0])) & 0xFF;    \
+        m_xx[i7] = (m_xx[i7] ^ (HIGHT_F0[m_xx[i0]] + m_rkey[4*k+3])) & 0xFF;    \
+    }
+
+    HIGHT_DEC(33,  7,6,5,4,3,2,1,0);
+    HIGHT_DEC(32,  0,7,6,5,4,3,2,1);
+    HIGHT_DEC(31,  1,0,7,6,5,4,3,2);
+    HIGHT_DEC(30,  2,1,0,7,6,5,4,3);
+    HIGHT_DEC(29,  3,2,1,0,7,6,5,4);
+    HIGHT_DEC(28,  4,3,2,1,0,7,6,5);
+    HIGHT_DEC(27,  5,4,3,2,1,0,7,6);
+    HIGHT_DEC(26,  6,5,4,3,2,1,0,7);
+    HIGHT_DEC(25,  7,6,5,4,3,2,1,0);
+    HIGHT_DEC(24,  0,7,6,5,4,3,2,1);
+    HIGHT_DEC(23,  1,0,7,6,5,4,3,2);
+    HIGHT_DEC(22,  2,1,0,7,6,5,4,3);
+    HIGHT_DEC(21,  3,2,1,0,7,6,5,4);
+    HIGHT_DEC(20,  4,3,2,1,0,7,6,5);
+    HIGHT_DEC(19,  5,4,3,2,1,0,7,6);
+    HIGHT_DEC(18,  6,5,4,3,2,1,0,7);
+    HIGHT_DEC(17,  7,6,5,4,3,2,1,0);
+    HIGHT_DEC(16,  0,7,6,5,4,3,2,1);
+    HIGHT_DEC(15,  1,0,7,6,5,4,3,2);
+    HIGHT_DEC(14,  2,1,0,7,6,5,4,3);
+    HIGHT_DEC(13,  3,2,1,0,7,6,5,4);
+    HIGHT_DEC(12,  4,3,2,1,0,7,6,5);
+    HIGHT_DEC(11,  5,4,3,2,1,0,7,6);
+    HIGHT_DEC(10,  6,5,4,3,2,1,0,7);
+    HIGHT_DEC( 9,  7,6,5,4,3,2,1,0);
+    HIGHT_DEC( 8,  0,7,6,5,4,3,2,1);
+    HIGHT_DEC( 7,  1,0,7,6,5,4,3,2);
+    HIGHT_DEC( 6,  2,1,0,7,6,5,4,3);
+    HIGHT_DEC( 5,  3,2,1,0,7,6,5,4);
+    HIGHT_DEC( 4,  4,3,2,1,0,7,6,5);
+    HIGHT_DEC( 3,  5,4,3,2,1,0,7,6);
+    HIGHT_DEC( 2,  6,5,4,3,2,1,0,7);
+
+    if (xorBlock)
+    {
+        // Final Round
+        outBlock[1] = static_cast<byte>(m_xx[1] ^ xorBlock[1]);
+        outBlock[3] = static_cast<byte>(m_xx[3] ^ xorBlock[3]);
+        outBlock[5] = static_cast<byte>(m_xx[5] ^ xorBlock[5]);
+        outBlock[7] = static_cast<byte>(m_xx[7] ^ xorBlock[7]);
+
+        outBlock[0] = static_cast<byte>((m_xx[0] - m_rkey[0]) ^ xorBlock[0]);
+        outBlock[2] = static_cast<byte>((m_xx[2] ^ m_rkey[1]) ^ xorBlock[2]);
+        outBlock[4] = static_cast<byte>((m_xx[4] - m_rkey[2]) ^ xorBlock[4]);
+        outBlock[6] = static_cast<byte>((m_xx[6] ^ m_rkey[3]) ^ xorBlock[6]);
+    }
+    else
+    {
+        // Final Round
+        outBlock[1] = static_cast<byte>(m_xx[1]);
+        outBlock[3] = static_cast<byte>(m_xx[3]);
+        outBlock[5] = static_cast<byte>(m_xx[5]);
+        outBlock[7] = static_cast<byte>(m_xx[7]);
+
+        outBlock[0] = static_cast<byte>(m_xx[0] - m_rkey[0]);
+        outBlock[2] = static_cast<byte>(m_xx[2] ^ m_rkey[1]);
+        outBlock[4] = static_cast<byte>(m_xx[4] - m_rkey[2]);
+        outBlock[6] = static_cast<byte>(m_xx[6] ^ m_rkey[3]);
+    }
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/hight.h b/runtime/third_party/cryptopp/hight.h
new file mode 100644
index 0000000..c1ecd79
--- /dev/null
+++ b/runtime/third_party/cryptopp/hight.h
@@ -0,0 +1,81 @@
+// hight.h - written and placed in the public domain by Kim Sung Hee and Jeffrey Walton
+//           Based on "HIGHT: A New Block Cipher Suitable for Low-Resource Device"
+//           by Deukjo Hong, Jaechul Sung, Seokhie Hong, Jongin Lim, Sangjin Lee,
+//           Bon-Seok Koo, Changhoon Lee, Donghoon Chang, Jesang Lee, Kitae Jeong,
+//           Hyun Kim, Jongsung Kim, and Seongtaek Chee
+
+/// \file hight.h
+/// \brief Classes for the HIGHT block cipher
+/// \since Crypto++ 8.0
+
+#ifndef CRYPTOPP_HIGHT_H
+#define CRYPTOPP_HIGHT_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+#include "algparam.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief HIGHT block cipher information
+/// \since Crypto++ 8.0
+struct HIGHT_Info : public FixedBlockSize<8>, public FixedKeyLength<16>
+{
+    static const std::string StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize
+        return "HIGHT";
+    }
+};
+
+/// \brief HIGHT 64-bit block cipher
+/// \details HIGHT provides 64-bit block size. The valid key size is 128-bits.
+/// \note Crypto++ provides a byte oriented implementation
+/// \sa <a href="http://www.cryptopp.com/wiki/HIGHT">HIGHT</a>,
+///   <a href="https://seed.kisa.or.kr/">Korea Internet &amp; Security
+///   Agency</a> website
+/// \since Crypto++ 8.0
+class CRYPTOPP_NO_VTABLE HIGHT : public HIGHT_Info, public BlockCipherDocumentation
+{
+public:
+    /// \brief HIGHT block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<HIGHT_Info>
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+
+        FixedSizeSecBlock<byte, 136> m_rkey;
+        mutable FixedSizeSecBlock<word32, 8> m_xx;
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    /// \brief Decryption transformation
+    /// \details Dec provides implementation for decryption transformation.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef HIGHT::Encryption HIGHTEncryption;
+typedef HIGHT::Decryption HIGHTDecryption;
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_HIGHT_H
diff --git a/runtime/third_party/cryptopp/hkdf.h b/runtime/third_party/cryptopp/hkdf.h
new file mode 100644
index 0000000..490f212
--- /dev/null
+++ b/runtime/third_party/cryptopp/hkdf.h
@@ -0,0 +1,179 @@
+// hkdf.h - written and placed in public domain by Jeffrey Walton.
+
+/// \file hkdf.h
+/// \brief Classes for HKDF from RFC 5869
+/// \since Crypto++ 5.6.3
+
+#ifndef CRYPTOPP_HKDF_H
+#define CRYPTOPP_HKDF_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "algparam.h"
+#include "hmac.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Extract-and-Expand Key Derivation Function (HKDF)
+/// \tparam T HashTransformation class
+/// \sa <A HREF="http://eprint.iacr.org/2010/264">Cryptographic Extraction and Key
+///   Derivation: The HKDF Scheme</A> and
+///   <A HREF="http://tools.ietf.org/html/rfc5869">HMAC-based Extract-and-Expand Key
+///   Derivation Function (HKDF)</A>
+/// \since Crypto++ 5.6.3
+template <class T>
+class HKDF : public KeyDerivationFunction
+{
+public:
+	virtual ~HKDF() {}
+
+	static std::string StaticAlgorithmName () {
+		const std::string name(std::string("HKDF(") +
+			std::string(T::StaticAlgorithmName()) + std::string(")"));
+		return name;
+	}
+
+	// KeyDerivationFunction interface
+	std::string AlgorithmName() const {
+		return StaticAlgorithmName();
+	}
+
+	// KeyDerivationFunction interface
+	size_t MaxDerivedKeyLength() const {
+		return static_cast<size_t>(T::DIGESTSIZE) * 255;
+	}
+
+	// KeyDerivationFunction interface
+	size_t GetValidDerivedLength(size_t keylength) const;
+
+	// KeyDerivationFunction interface
+	size_t DeriveKey(byte *derived, size_t derivedLen, const byte *secret, size_t secretLen,
+	    const NameValuePairs& params) const;
+
+	/// \brief Derive a key from a seed
+	/// \param derived the derived output buffer
+	/// \param derivedLen the size of the derived buffer, in bytes
+	/// \param secret the seed input buffer
+	/// \param secretLen the size of the secret buffer, in bytes
+	/// \param salt the salt input buffer
+	/// \param saltLen the size of the salt buffer, in bytes
+	/// \param info the additional input buffer
+	/// \param infoLen the size of the info buffer, in bytes
+	/// \return the number of iterations performed
+	/// \throw InvalidDerivedKeyLength if <tt>derivedLen</tt> is invalid for the scheme
+	/// \details DeriveKey() provides a standard interface to derive a key from
+	///   a seed and other parameters. Each class that derives from KeyDerivationFunction
+	///   provides an overload that accepts most parameters used by the derivation function.
+	/// \details <tt>salt</tt> and <tt>info</tt> can be <tt>nullptr</tt> with 0 length.
+	///   HKDF is unusual in that a non-NULL salt with length 0 is different than a
+	///   NULL <tt>salt</tt>. A NULL <tt>salt</tt> causes HKDF to use a string of 0's
+	///   of length <tt>T::DIGESTSIZE</tt> for the <tt>salt</tt>.
+	/// \details HKDF always returns 1 because it only performs 1 iteration. Other
+	///   derivation functions, like PBKDF's, will return more interesting values.
+	size_t DeriveKey(byte *derived, size_t derivedLen, const byte *secret, size_t secretLen,
+	    const byte *salt, size_t saltLen, const byte* info, size_t infoLen) const;
+
+protected:
+	// KeyDerivationFunction interface
+	const Algorithm & GetAlgorithm() const {
+		return *this;
+	}
+
+	// If salt is absent (NULL), then use the NULL vector. Missing is different than
+	// EMPTY (Non-NULL, 0 length). The length of s_NullVector used depends on the Hash
+	// function. SHA-256 will use 32 bytes of s_NullVector.
+	typedef byte NullVectorType[T::DIGESTSIZE];
+	static const NullVectorType& GetNullVector() {
+		static const NullVectorType s_NullVector = {0};
+		return s_NullVector;
+	}
+};
+
+template <class T>
+size_t HKDF<T>::GetValidDerivedLength(size_t keylength) const
+{
+	if (keylength > MaxDerivedKeyLength())
+		return MaxDerivedKeyLength();
+	return keylength;
+}
+
+template <class T>
+size_t HKDF<T>::DeriveKey(byte *derived, size_t derivedLen,
+    const byte *secret, size_t secretLen, const NameValuePairs& params) const
+{
+	CRYPTOPP_ASSERT(secret && secretLen);
+	CRYPTOPP_ASSERT(derived && derivedLen);
+	CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+
+	ConstByteArrayParameter p;
+	SecByteBlock salt, info;
+
+	if (params.GetValue("Salt", p))
+		salt.Assign(p.begin(), p.size());
+	else
+		salt.Assign(GetNullVector(), T::DIGESTSIZE);
+
+	if (params.GetValue("Info", p))
+		info.Assign(p.begin(), p.size());
+	else
+		info.Assign(GetNullVector(), 0);
+
+	return DeriveKey(derived, derivedLen, secret, secretLen, salt.begin(), salt.size(), info.begin(), info.size());
+}
+
+template <class T>
+size_t HKDF<T>::DeriveKey(byte *derived, size_t derivedLen, const byte *secret, size_t secretLen,
+    const byte *salt, size_t saltLen, const byte* info, size_t infoLen) const
+{
+	CRYPTOPP_ASSERT(secret && secretLen);
+	CRYPTOPP_ASSERT(derived && derivedLen);
+	CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+
+	ThrowIfInvalidDerivedKeyLength(derivedLen);
+
+	// HKDF business logic. NULL is different than empty.
+	if (salt == NULLPTR)
+	{
+		salt = GetNullVector();
+		saltLen = T::DIGESTSIZE;
+	}
+
+	// key is PRK from the RFC, salt is IKM from the RFC
+	HMAC<T> hmac;
+	SecByteBlock key(T::DIGESTSIZE), buffer(T::DIGESTSIZE);
+
+	// Extract
+	hmac.SetKey(salt, saltLen);
+	hmac.CalculateDigest(key, secret, secretLen);
+
+	// Key
+	hmac.SetKey(key.begin(), key.size());
+	byte block = 0;
+
+	// Expand
+	while (derivedLen > 0)
+	{
+		if (block++) {hmac.Update(buffer, buffer.size());}
+		if (infoLen) {hmac.Update(info, infoLen);}
+		hmac.CalculateDigest(buffer, &block, 1);
+
+#if CRYPTOPP_MSC_VERSION
+		const size_t digestSize = static_cast<size_t>(T::DIGESTSIZE);
+		const size_t segmentLen = STDMIN(derivedLen, digestSize);
+		memcpy_s(derived, segmentLen, buffer, segmentLen);
+#else
+		const size_t digestSize = static_cast<size_t>(T::DIGESTSIZE);
+		const size_t segmentLen = STDMIN(derivedLen, digestSize);
+		std::memcpy(derived, buffer, segmentLen);
+#endif
+
+		derived += segmentLen;
+		derivedLen -= segmentLen;
+	}
+
+	return 1;
+}
+
+NAMESPACE_END
+
+#endif // CRYPTOPP_HKDF_H
diff --git a/runtime/third_party/cryptopp/hmac.cpp b/runtime/third_party/cryptopp/hmac.cpp
new file mode 100644
index 0000000..df11b12
--- /dev/null
+++ b/runtime/third_party/cryptopp/hmac.cpp
@@ -0,0 +1,90 @@
+// hmac.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "hmac.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void HMAC_Base::UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &)
+{
+	AssertValidKeyLength(keylength);
+
+	Restart();
+
+	HashTransformation &hash = AccessHash();
+	unsigned int blockSize = hash.BlockSize();
+
+	if (!blockSize)
+		throw InvalidArgument("HMAC: can only be used with a block-based hash function");
+
+	m_buf.resize(2*AccessHash().BlockSize() + AccessHash().DigestSize());
+
+	if (keylength <= blockSize)
+	{
+		// hmac.cpp:26:9: runtime error: null pointer passed as argument 2
+		if (AccessIpad() && userKey && keylength)
+			std::memcpy(AccessIpad(), userKey, keylength);
+	}
+	else
+	{
+		AccessHash().CalculateDigest(AccessIpad(), userKey, keylength);
+		keylength = hash.DigestSize();
+	}
+
+	CRYPTOPP_ASSERT(keylength <= blockSize);
+	std::memset(AccessIpad()+keylength, 0, blockSize-keylength);
+
+	for (unsigned int i=0; i<blockSize; i++)
+	{
+		AccessOpad()[i] = AccessIpad()[i] ^ 0x5c;
+		AccessIpad()[i] ^= 0x36;
+	}
+}
+
+void HMAC_Base::KeyInnerHash()
+{
+	CRYPTOPP_ASSERT(!m_innerHashKeyed);
+	HashTransformation &hash = AccessHash();
+	hash.Update(AccessIpad(), hash.BlockSize());
+	m_innerHashKeyed = true;
+}
+
+void HMAC_Base::Restart()
+{
+	if (m_innerHashKeyed)
+	{
+		AccessHash().Restart();
+		m_innerHashKeyed = false;
+	}
+}
+
+void HMAC_Base::Update(const byte *input, size_t length)
+{
+	if (!m_innerHashKeyed)
+		KeyInnerHash();
+	AccessHash().Update(input, length);
+}
+
+void HMAC_Base::TruncatedFinal(byte *mac, size_t size)
+{
+	ThrowIfInvalidTruncatedSize(size);
+
+	HashTransformation &hash = AccessHash();
+
+	if (!m_innerHashKeyed)
+		KeyInnerHash();
+	hash.Final(AccessInnerHash());
+
+	hash.Update(AccessOpad(), hash.BlockSize());
+	hash.Update(AccessInnerHash(), hash.DigestSize());
+	hash.TruncatedFinal(mac, size);
+
+	m_innerHashKeyed = false;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/hmac.h b/runtime/third_party/cryptopp/hmac.h
new file mode 100644
index 0000000..79ba1aa
--- /dev/null
+++ b/runtime/third_party/cryptopp/hmac.h
@@ -0,0 +1,80 @@
+// hmac.h - originally written and placed in the public domain by Wei Dai
+
+/// \file hmac.h
+/// \brief Classes for HMAC message authentication codes
+
+#ifndef CRYPTOPP_HMAC_H
+#define CRYPTOPP_HMAC_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief HMAC information
+/// \details HMAC_Base derives from VariableKeyLength and MessageAuthenticationCode
+/// \since Crypto++ 2.1
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE HMAC_Base : public VariableKeyLength<16, 0, INT_MAX>, public MessageAuthenticationCode
+{
+public:
+	virtual ~HMAC_Base() {}
+
+	/// \brief Construct a HMAC_Base
+	HMAC_Base() : m_innerHashKeyed(false) {}
+	void UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &params);
+
+	void Restart();
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *mac, size_t size);
+	unsigned int OptimalBlockSize() const {return const_cast<HMAC_Base*>(this)->AccessHash().OptimalBlockSize();}
+	unsigned int DigestSize() const {return const_cast<HMAC_Base*>(this)->AccessHash().DigestSize();}
+
+protected:
+	virtual HashTransformation & AccessHash() =0;
+	byte * AccessIpad() {return m_buf;}
+	byte * AccessOpad() {return m_buf + AccessHash().BlockSize();}
+	byte * AccessInnerHash() {return m_buf + 2*AccessHash().BlockSize();}
+
+private:
+	void KeyInnerHash();
+
+	SecByteBlock m_buf;
+	bool m_innerHashKeyed;
+};
+
+/// \brief HMAC
+/// \tparam T HashTransformation derived class
+/// \details HMAC derives from MessageAuthenticationCodeImpl. It calculates the HMAC using
+///   <tt>HMAC(K, text) = H(K XOR opad, H(K XOR ipad, text))</tt>.
+/// \sa <a href="http://www.weidai.com/scan-mirror/mac.html#HMAC">HMAC</a>
+/// \since Crypto++ 2.1
+template <class T>
+class HMAC : public MessageAuthenticationCodeImpl<HMAC_Base, HMAC<T> >
+{
+public:
+	CRYPTOPP_CONSTANT(DIGESTSIZE=T::DIGESTSIZE);
+	CRYPTOPP_CONSTANT(BLOCKSIZE=T::BLOCKSIZE);
+
+	virtual ~HMAC() {}
+
+	/// \brief Construct a HMAC
+	HMAC() {}
+	/// \brief Construct a HMAC
+	/// \param key the HMAC key
+	/// \param length the size of the HMAC key
+	HMAC(const byte *key, size_t length=HMAC_Base::DEFAULT_KEYLENGTH)
+		{this->SetKey(key, length);}
+
+	static std::string StaticAlgorithmName() {return std::string("HMAC(") + T::StaticAlgorithmName() + ")";}
+	std::string AlgorithmName() const {return std::string("HMAC(") + m_hash.AlgorithmName() + ")";}
+	std::string AlgorithmProvider() const {return m_hash.AlgorithmProvider();}
+
+private:
+	HashTransformation & AccessHash() {return m_hash;}
+
+	T m_hash;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/hmqv.h b/runtime/third_party/cryptopp/hmqv.h
new file mode 100644
index 0000000..4736b05
--- /dev/null
+++ b/runtime/third_party/cryptopp/hmqv.h
@@ -0,0 +1,417 @@
+// hmqv.h - written and placed in the public domain by Uri Blumenthal
+//          Shamelessly based upon Wei Dai's MQV source files
+
+#ifndef CRYPTOPP_HMQV_H
+#define CRYPTOPP_HMQV_H
+
+/// \file hmqv.h
+/// \brief Classes for Hashed Menezes-Qu-Vanstone key agreement in GF(p)
+/// \since Crypto++ 5.6.4
+
+#include "gfpcrypt.h"
+#include "algebra.h"
+#include "sha.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Hashed Menezes-Qu-Vanstone in GF(p)
+/// \details This implementation follows Hugo Krawczyk's <a href="http://eprint.iacr.org/2005/176">HMQV: A High-Performance
+///   Secure Diffie-Hellman Protocol</a>. Note: this implements HMQV only. HMQV-C with Key Confirmation is not provided.
+/// \sa MQV, HMQV, FHMQV, and AuthenticatedKeyAgreementDomain
+/// \since Crypto++ 5.6.4
+template <class GROUP_PARAMETERS, class COFACTOR_OPTION = typename GROUP_PARAMETERS::DefaultCofactorOption, class HASH = SHA512>
+class HMQV_Domain: public AuthenticatedKeyAgreementDomain
+{
+public:
+  typedef GROUP_PARAMETERS GroupParameters;
+  typedef typename GroupParameters::Element Element;
+  typedef HMQV_Domain<GROUP_PARAMETERS, COFACTOR_OPTION, HASH> Domain;
+
+  virtual ~HMQV_Domain() {}
+
+  /// \brief Construct a HMQV domain
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  HMQV_Domain(bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer) {}
+
+  /// \brief Construct a HMQV domain
+  /// \param params group parameters and options
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  HMQV_Domain(const GroupParameters &params, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer), m_groupParameters(params) {}
+
+  /// \brief Construct a HMQV domain
+  /// \param bt BufferedTransformation with group parameters and options
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  HMQV_Domain(BufferedTransformation &bt, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.BERDecode(bt);}
+
+  /// \brief Construct a HMQV domain
+  /// \tparam T1 template parameter used as a constructor parameter
+  /// \param v1 first parameter
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details v1 is passed directly to the GROUP_PARAMETERS object.
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  template <class T1>
+  HMQV_Domain(T1 v1, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.Initialize(v1);}
+
+  /// \brief Construct a HMQV domain
+  /// \tparam T1 template parameter used as a constructor parameter
+  /// \tparam T2 template parameter used as a constructor parameter
+  /// \param v1 first parameter
+  /// \param v2 second parameter
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details v1 and v2 are passed directly to the GROUP_PARAMETERS object.
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  template <class T1, class T2>
+  HMQV_Domain(T1 v1, T2 v2, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.Initialize(v1, v2);}
+
+  /// \brief Construct a HMQV domain
+  /// \tparam T1 template parameter used as a constructor parameter
+  /// \tparam T2 template parameter used as a constructor parameter
+  /// \tparam T3 template parameter used as a constructor parameter
+  /// \param v1 first parameter
+  /// \param v2 second parameter
+  /// \param v3 third parameter
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details v1, v2 and v3 are passed directly to the GROUP_PARAMETERS object.
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  template <class T1, class T2, class T3>
+  HMQV_Domain(T1 v1, T2 v2, T3 v3, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.Initialize(v1, v2, v3);}
+
+  /// \brief Construct a HMQV domain
+  /// \tparam T1 template parameter used as a constructor parameter
+  /// \tparam T2 template parameter used as a constructor parameter
+  /// \tparam T3 template parameter used as a constructor parameter
+  /// \tparam T4 template parameter used as a constructor parameter
+  /// \param v1 first parameter
+  /// \param v2 second parameter
+  /// \param v3 third parameter
+  /// \param v4 third parameter
+  /// \param clientRole flag indicating initiator or recipient
+  /// \details v1, v2, v3 and v4 are passed directly to the GROUP_PARAMETERS object.
+  /// \details <tt>clientRole = true</tt> indicates initiator, and
+  ///  <tt>clientRole = false</tt> indicates recipient or server.
+  template <class T1, class T2, class T3, class T4>
+  HMQV_Domain(T1 v1, T2 v2, T3 v3, T4 v4, bool clientRole = true)
+    : m_role(clientRole ? RoleClient : RoleServer)
+    {m_groupParameters.Initialize(v1, v2, v3, v4);}
+
+public:
+
+  /// \brief Retrieves the group parameters for this domain
+  /// \return the group parameters for this domain as a const reference
+  const GroupParameters & GetGroupParameters() const {return m_groupParameters;}
+
+  /// \brief Retrieves the group parameters for this domain
+  /// \return the group parameters for this domain as a non-const reference
+  GroupParameters & AccessGroupParameters() {return m_groupParameters;}
+
+  /// \brief Retrieves the crypto parameters for this domain
+  /// \return the crypto parameters for this domain as a non-const reference
+  CryptoParameters & AccessCryptoParameters() {return AccessAbstractGroupParameters();}
+
+  /// \brief Provides the size of the agreed value
+  /// \return size of agreed value produced in this domain
+  /// \details The length is calculated using <tt>GetEncodedElementSize(false)</tt>,
+  ///  which means the element is encoded in a non-reversible format. A
+  ///  non-reversible format means its a raw byte array, and it lacks presentation
+  ///  format like an ASN.1 BIT_STRING or OCTET_STRING.
+  unsigned int AgreedValueLength() const
+    {return GetAbstractGroupParameters().GetEncodedElementSize(false);}
+
+  /// \brief Provides the size of the static private key
+  /// \return size of static private keys in this domain
+  /// \details The length is calculated using the byte count of the subgroup order.
+  unsigned int StaticPrivateKeyLength() const
+    {return GetAbstractGroupParameters().GetSubgroupOrder().ByteCount();}
+
+  /// \brief Provides the size of the static public key
+  /// \return size of static public keys in this domain
+  /// \details The length is calculated using <tt>GetEncodedElementSize(true)</tt>,
+  ///  which means the element is encoded in a reversible format. A reversible
+  ///  format means it has a presentation format, and its an ANS.1 encoded element
+  ///  or point.
+  unsigned int StaticPublicKeyLength() const
+    {return GetAbstractGroupParameters().GetEncodedElementSize(true);}
+
+  /// \brief Generate static private key in this domain
+  /// \param rng a RandomNumberGenerator derived class
+  /// \param privateKey a byte buffer for the generated private key in this domain
+  /// \details The private key is a random scalar used as an exponent in the range
+  ///  <tt>[1,MaxExponent()]</tt>.
+  /// \pre <tt>COUNTOF(privateKey) == PrivateStaticKeyLength()</tt>
+  void GenerateStaticPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+  {
+    Integer x(rng, Integer::One(), GetAbstractGroupParameters().GetMaxExponent());
+    x.Encode(privateKey, StaticPrivateKeyLength());
+  }
+
+  /// \brief Generate a static public key from a private key in this domain
+  /// \param rng a RandomNumberGenerator derived class
+  /// \param privateKey a byte buffer with the previously generated private key
+  /// \param publicKey a byte buffer for the generated public key in this domain
+  /// \details The public key is an element or point on the curve, and its stored
+  ///  in a revrsible format. A reversible format means it has a presentation
+  ///  format, and its an ANS.1 encoded element or point.
+  /// \pre <tt>COUNTOF(publicKey) == PublicStaticKeyLength()</tt>
+  void GenerateStaticPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+  {
+    CRYPTOPP_UNUSED(rng);
+    const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
+    Integer x(privateKey, StaticPrivateKeyLength());
+    Element y = params.ExponentiateBase(x);
+    params.EncodeElement(true, y, publicKey);
+  }
+
+  /// \brief Provides the size of the ephemeral private key
+  /// \return size of ephemeral private keys in this domain
+  /// \details An ephemeral private key is a private key and public key.
+  ///  The serialized size is different than a static private key.
+  unsigned int EphemeralPrivateKeyLength() const {return StaticPrivateKeyLength() + StaticPublicKeyLength();}
+
+  /// \brief Provides the size of the ephemeral public key
+  /// \return size of ephemeral public keys in this domain
+  /// \details An ephemeral public key is a public key.
+  ///  The serialized size is the same as a static public key.
+  unsigned int EphemeralPublicKeyLength() const{return StaticPublicKeyLength();}
+
+  /// \brief Generate ephemeral private key in this domain
+  /// \param rng a RandomNumberGenerator derived class
+  /// \param privateKey a byte buffer for the generated private key in this domain
+  /// \pre <tt>COUNTOF(privateKey) == EphemeralPrivateKeyLength()</tt>
+  void GenerateEphemeralPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+  {
+    const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
+    Integer x(rng, Integer::One(), params.GetMaxExponent());
+    x.Encode(privateKey, StaticPrivateKeyLength());
+    Element y = params.ExponentiateBase(x);
+    params.EncodeElement(true, y, privateKey+StaticPrivateKeyLength());
+  }
+
+  /// \brief Generate ephemeral public key from a private key in this domain
+  /// \param rng a RandomNumberGenerator derived class
+  /// \param privateKey a byte buffer with the previously generated private key
+  /// \param publicKey a byte buffer for the generated public key in this domain
+  /// \pre <tt>COUNTOF(publicKey) == EphemeralPublicKeyLength()</tt>
+  void GenerateEphemeralPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+  {
+    CRYPTOPP_UNUSED(rng);
+    std::memcpy(publicKey, privateKey+StaticPrivateKeyLength(), EphemeralPublicKeyLength());
+  }
+
+  /// \brief Derive agreed value or shared secret
+  /// \param agreedValue the shared secret
+  /// \param staticPrivateKey your long term private key
+  /// \param ephemeralPrivateKey your ephemeral private key
+  /// \param staticOtherPublicKey couterparty's long term public key
+  /// \param ephemeralOtherPublicKey couterparty's ephemeral public key
+  /// \param validateStaticOtherPublicKey flag indicating validation
+  /// \return true upon success, false in case of failure
+  /// \details Agree() performs the authenticated key agreement. Agree()
+  ///  derives a shared secret from your private keys and couterparty's
+  ///  public keys. Each instance or run of the protocol should use a new
+  ///  ephemeral key pair.
+  /// \details The other's ephemeral public key will always be validated at
+  ///  Level 1 to ensure it is a point on the curve.
+  ///  <tt>validateStaticOtherPublicKey</tt> determines how thoroughly other's
+  ///  static public key is validated. If you have previously validated the
+  ///  couterparty's static public key, then use
+  ///  <tt>validateStaticOtherPublicKey=false</tt> to save time.
+  /// \pre <tt>COUNTOF(agreedValue) == AgreedValueLength()</tt>
+  /// \pre <tt>COUNTOF(staticPrivateKey) == StaticPrivateKeyLength()</tt>
+  /// \pre <tt>COUNTOF(ephemeralPrivateKey) == EphemeralPrivateKeyLength()</tt>
+  /// \pre <tt>COUNTOF(staticOtherPublicKey) == StaticPublicKeyLength()</tt>
+  /// \pre <tt>COUNTOF(ephemeralOtherPublicKey) == EphemeralPublicKeyLength()</tt>
+  bool Agree(byte *agreedValue,
+    const byte *staticPrivateKey, const byte *ephemeralPrivateKey,
+    const byte *staticOtherPublicKey, const byte *ephemeralOtherPublicKey,
+    bool validateStaticOtherPublicKey=true) const
+  {
+    const byte *XX = NULLPTR, *YY = NULLPTR, *AA = NULLPTR, *BB = NULLPTR;
+    size_t xxs = 0, yys = 0, aas = 0, bbs = 0;
+
+    // Depending on the role, this will hold either A's or B's static
+    // (long term) public key. AA or BB will then point into tt.
+    SecByteBlock tt(StaticPublicKeyLength());
+
+    try
+    {
+      this->GetMaterial().DoQuickSanityCheck();
+      const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
+
+      if(m_role == RoleServer)
+      {
+        Integer b(staticPrivateKey, StaticPrivateKeyLength());
+        Element B = params.ExponentiateBase(b);
+        params.EncodeElement(true, B, tt);
+
+        XX = ephemeralOtherPublicKey;
+        xxs = EphemeralPublicKeyLength();
+        YY = ephemeralPrivateKey + StaticPrivateKeyLength();
+        yys = EphemeralPublicKeyLength();
+        AA = staticOtherPublicKey;
+        aas = StaticPublicKeyLength();
+        BB = tt.BytePtr();
+        bbs = tt.SizeInBytes();
+      }
+      else
+      {
+        Integer a(staticPrivateKey, StaticPrivateKeyLength());
+        Element A = params.ExponentiateBase(a);
+        params.EncodeElement(true, A, tt);
+
+        XX = ephemeralPrivateKey + StaticPrivateKeyLength();
+        xxs = EphemeralPublicKeyLength();
+        YY = ephemeralOtherPublicKey;
+        yys = EphemeralPublicKeyLength();
+        AA = tt.BytePtr();
+        aas = tt.SizeInBytes();
+        BB = staticOtherPublicKey;
+        bbs = StaticPublicKeyLength();
+      }
+
+      Element VV1 = params.DecodeElement(staticOtherPublicKey, validateStaticOtherPublicKey);
+      Element VV2 = params.DecodeElement(ephemeralOtherPublicKey, true);
+
+      const Integer& q = params.GetSubgroupOrder();
+      const unsigned int len /*bytes*/ = (((q.BitCount()+1)/2 +7)/8);
+      SecByteBlock dd(len), ee(len);
+
+      // Compute $d = \hat{H}(X, \hat{B})$
+      Hash(NULLPTR, XX, xxs, BB, bbs, dd.BytePtr(), dd.SizeInBytes());
+      Integer d(dd.BytePtr(), dd.SizeInBytes());
+
+      // Compute $e = \hat{H}(Y, \hat{A})$
+      Hash(NULLPTR, YY, yys, AA, aas, ee.BytePtr(), ee.SizeInBytes());
+      Integer e(ee.BytePtr(), ee.SizeInBytes());
+
+      Element sigma;
+      if(m_role == RoleServer)
+      {
+        Integer y(ephemeralPrivateKey, StaticPrivateKeyLength());
+        Integer b(staticPrivateKey, StaticPrivateKeyLength());
+        Integer s_B = (y + e * b) % q;
+
+        Element A = params.DecodeElement(AA, false);
+        Element X = params.DecodeElement(XX, false);
+
+        Element t1 = params.ExponentiateElement(A, d);
+        Element t2 = m_groupParameters.MultiplyElements(X, t1);
+
+        // $\sigma_B}=(X \cdot A^{d})^{s_B}
+        sigma = params.ExponentiateElement(t2, s_B);
+      }
+      else
+      {
+        Integer x(ephemeralPrivateKey, StaticPrivateKeyLength());
+        Integer a(staticPrivateKey, StaticPrivateKeyLength());
+        Integer s_A = (x + d * a) % q;
+
+        Element B = params.DecodeElement(BB, false);
+        Element Y = params.DecodeElement(YY, false);
+
+        Element t3 = params.ExponentiateElement(B, e);
+        Element t4 = m_groupParameters.MultiplyElements(Y, t3);
+
+        // $\sigma_A}=(Y \cdot B^{e})^{s_A}
+        sigma = params.ExponentiateElement(t4, s_A);
+      }
+      Hash(&sigma, NULLPTR, 0, NULLPTR, 0, agreedValue, AgreedValueLength());
+    }
+    catch (DL_BadElement &)
+    {
+      CRYPTOPP_ASSERT(0);
+      return false;
+    }
+    return true;
+  }
+
+protected:
+  // Hash invocation by client and server differ only in what keys
+  // each provides.
+
+  inline void Hash(const Element* sigma,
+    const byte* e1, size_t e1len, // Ephemeral key and key length
+    const byte* s1, size_t s1len, // Static key and key length
+    byte* digest, size_t dlen) const
+  {
+    HASH hash;
+    size_t idx = 0, req = dlen;
+    size_t blk = STDMIN(dlen, (size_t)HASH::DIGESTSIZE);
+
+    if(sigma)
+    {
+      if (e1len != 0 || s1len != 0) {
+        CRYPTOPP_ASSERT(0);
+      }
+      //Integer x = GetAbstractGroupParameters().ConvertElementToInteger(*sigma);
+      //SecByteBlock sbb(x.MinEncodedSize());
+      //x.Encode(sbb.BytePtr(), sbb.SizeInBytes());
+      SecByteBlock sbb(GetAbstractGroupParameters().GetEncodedElementSize(false));
+      GetAbstractGroupParameters().EncodeElement(false, *sigma, sbb);
+      hash.Update(sbb.BytePtr(), sbb.SizeInBytes());
+    } else {
+      if (e1len == 0 || s1len == 0) {
+        CRYPTOPP_ASSERT(0);
+      }
+      hash.Update(e1, e1len);
+      hash.Update(s1, s1len);
+    }
+
+    hash.TruncatedFinal(digest, blk);
+    req -= blk;
+
+    // All this to catch tail bytes for large curves and small hashes
+    while(req != 0)
+    {
+      hash.Update(&digest[idx], (size_t)HASH::DIGESTSIZE);
+
+      idx += (size_t)HASH::DIGESTSIZE;
+      blk = STDMIN(req, (size_t)HASH::DIGESTSIZE);
+      hash.TruncatedFinal(&digest[idx], blk);
+
+      req -= blk;
+    }
+  }
+
+private:
+
+  // The paper uses Initiator and Recipient - make it classical.
+  enum KeyAgreementRole { RoleServer = 1, RoleClient };
+
+  DL_GroupParameters<Element> & AccessAbstractGroupParameters()
+    {return m_groupParameters;}
+  const DL_GroupParameters<Element> & GetAbstractGroupParameters() const
+    {return m_groupParameters;}
+
+  GroupParameters m_groupParameters;
+  KeyAgreementRole m_role;
+};
+
+/// \brief Hashed Menezes-Qu-Vanstone in GF(p)
+/// \details This implementation follows Hugo Krawczyk's <a href="http://eprint.iacr.org/2005/176">HMQV: A High-Performance
+///   Secure Diffie-Hellman Protocol</a>. Note: this implements HMQV only. HMQV-C with Key Confirmation is not provided.
+/// \sa HMQV, HMQV_Domain, FHMQV_Domain, AuthenticatedKeyAgreementDomain
+/// \since Crypto++ 5.6.4
+typedef HMQV_Domain<DL_GroupParameters_GFP_DefaultSafePrime> HMQV;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/hrtimer.cpp b/runtime/third_party/cryptopp/hrtimer.cpp
new file mode 100644
index 0000000..bf3facf
--- /dev/null
+++ b/runtime/third_party/cryptopp/hrtimer.cpp
@@ -0,0 +1,174 @@
+// hrtimer.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "hrtimer.h"
+#include "misc.h"
+
+#include <stddef.h>		// for NULL
+#include <time.h>
+
+#if defined(CRYPTOPP_WIN32_AVAILABLE)
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+# if ((WINVER >= 0x0602 /*_WIN32_WINNT_WIN8*/) || (_WIN32_WINNT >= 0x0602 /*_WIN32_WINNT_WIN8*/))
+# include <processthreadsapi.h>
+# if defined(WINAPI_FAMILY)
+#  if (WINAPI_FAMILY_PARTITION(WINAPI_FAMILY_PHONE_APP))
+#   include <profileapi.h>
+#  endif
+# endif
+#endif
+#endif
+
+#if defined(CRYPTOPP_UNIX_AVAILABLE)
+#include <sys/time.h>
+#include <sys/times.h>
+#include <unistd.h>
+#endif
+
+#include "trap.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_WIN32_AVAILABLE)
+static TimerWord InitializePerformanceCounterFrequency()
+{
+	LARGE_INTEGER freq = {{0,0}};
+	if (!QueryPerformanceFrequency(&freq))
+		throw Exception(Exception::OTHER_ERROR, "Timer: QueryPerformanceFrequency failed with error " + IntToString(GetLastError()));
+	return freq.QuadPart;
+}
+
+inline TimerWord PerformanceCounterFrequency()
+{
+	static const word64 freq = InitializePerformanceCounterFrequency();
+	return freq;
+}
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+
+double TimerBase::ConvertTo(TimerWord t, Unit unit)
+{
+	static unsigned long unitsPerSecondTable[] = {1, 1000, 1000*1000, 1000*1000*1000};
+
+	// When 'unit' is an enum 'Unit', a Clang warning is generated.
+	CRYPTOPP_ASSERT(static_cast<unsigned int>(unit) < COUNTOF(unitsPerSecondTable));
+	return static_cast<double>(t) * unitsPerSecondTable[unit] / TicksPerSecond();
+}
+
+void TimerBase::StartTimer()
+{
+	m_last = m_start = GetCurrentTimerValue();
+	m_started = true;
+}
+
+double TimerBase::ElapsedTimeAsDouble()
+{
+	if (m_stuckAtZero)
+		return 0;
+
+	if (m_started)
+	{
+		TimerWord now = GetCurrentTimerValue();
+		if (m_last < now)	// protect against OS bugs where time goes backwards
+			m_last = now;
+		return ConvertTo(m_last - m_start, m_timerUnit);
+	}
+
+	StartTimer();
+	return 0;
+}
+
+unsigned long TimerBase::ElapsedTime()
+{
+	double elapsed = ElapsedTimeAsDouble();
+	CRYPTOPP_ASSERT(elapsed <= (double)ULONG_MAX);
+	return (unsigned long)elapsed;
+}
+
+TimerWord Timer::GetCurrentTimerValue()
+{
+#if defined(CRYPTOPP_WIN32_AVAILABLE)
+	// Use the first union member to avoid an uninitialized warning
+	LARGE_INTEGER now = {{0,0}};
+	if (!QueryPerformanceCounter(&now))
+		throw Exception(Exception::OTHER_ERROR, "Timer: QueryPerformanceCounter failed with error " + IntToString(GetLastError()));
+	return now.QuadPart;
+#elif defined(CRYPTOPP_UNIX_AVAILABLE)
+	timeval now;
+	gettimeofday(&now, NULLPTR);
+	return (TimerWord)now.tv_sec * 1000000 + now.tv_usec;
+#else
+	// clock_t now;
+	return clock();
+#endif
+}
+
+TimerWord Timer::TicksPerSecond()
+{
+#if defined(CRYPTOPP_WIN32_AVAILABLE)
+	return PerformanceCounterFrequency();
+#elif defined(CRYPTOPP_UNIX_AVAILABLE)
+	return 1000000;
+#else
+	return CLOCKS_PER_SEC;
+#endif
+}
+
+#endif	// #ifndef CRYPTOPP_IMPORTS
+
+TimerWord ThreadUserTimer::GetCurrentTimerValue()
+{
+#if defined(CRYPTOPP_WIN32_AVAILABLE) && defined(THREAD_TIMER_AVAILABLE)
+	static bool getCurrentThreadImplemented = true;
+	if (getCurrentThreadImplemented)
+	{
+		FILETIME now, ignored;
+		if (!GetThreadTimes(GetCurrentThread(), &ignored, &ignored, &ignored, &now))
+		{
+			const DWORD lastError = GetLastError();
+			if (lastError == ERROR_CALL_NOT_IMPLEMENTED)
+			{
+				getCurrentThreadImplemented = false;
+				goto GetCurrentThreadNotImplemented;
+			}
+			throw Exception(Exception::OTHER_ERROR, "ThreadUserTimer: GetThreadTimes failed with error " + IntToString(lastError));
+		}
+		return now.dwLowDateTime + ((TimerWord)now.dwHighDateTime << 32);
+	}
+GetCurrentThreadNotImplemented:
+	return (TimerWord)clock() * (10*1000*1000 / CLOCKS_PER_SEC);
+#elif defined(CRYPTOPP_WIN32_AVAILABLE) && !defined(THREAD_TIMER_AVAILABLE)
+	LARGE_INTEGER now;
+	if (!QueryPerformanceCounter(&now))
+	{
+		const DWORD lastError = GetLastError();
+		throw Exception(Exception::OTHER_ERROR, "ThreadUserTimer: QueryPerformanceCounter failed with error " + IntToString(lastError));
+	}
+	return now.QuadPart;
+#elif defined(CRYPTOPP_UNIX_AVAILABLE)
+	tms now;
+	times(&now);
+	return now.tms_utime;
+#else
+	return clock();
+#endif
+}
+
+TimerWord ThreadUserTimer::TicksPerSecond()
+{
+#if defined(CRYPTOPP_WIN32_AVAILABLE) && defined(THREAD_TIMER_AVAILABLE)
+	return 10*1000*1000;
+#elif defined(CRYPTOPP_WIN32_AVAILABLE) && !defined(THREAD_TIMER_AVAILABLE)
+	static const TimerWord ticksPerSecond = PerformanceCounterFrequency();
+	return ticksPerSecond;
+#elif defined(CRYPTOPP_UNIX_AVAILABLE)
+	static const long ticksPerSecond = sysconf(_SC_CLK_TCK);
+	return ticksPerSecond;
+#else
+	return CLOCKS_PER_SEC;
+#endif
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/hrtimer.h b/runtime/third_party/cryptopp/hrtimer.h
new file mode 100644
index 0000000..db6ad18
--- /dev/null
+++ b/runtime/third_party/cryptopp/hrtimer.h
@@ -0,0 +1,134 @@
+// hrtimer.h - originally written and placed in the public domain by Wei Dai
+
+/// \file hrtimer.h
+/// \brief Classes for timers
+
+#ifndef CRYPTOPP_HRTIMER_H
+#define CRYPTOPP_HRTIMER_H
+
+#include "config.h"
+
+#if !defined(HIGHRES_TIMER_AVAILABLE) || (defined(CRYPTOPP_WIN32_AVAILABLE) && !defined(THREAD_TIMER_AVAILABLE))
+#include <time.h>
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#ifdef HIGHRES_TIMER_AVAILABLE
+	/// \brief TimerWord is a 64-bit word
+	typedef word64 TimerWord;
+#else
+	/// \brief TimerWord is a clock_t
+	typedef clock_t TimerWord;
+#endif
+
+/// \brief Base class for timers
+/// \sa ThreadUserTimer, Timer
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE TimerBase
+{
+public:
+	/// \brief Unit of measure
+	/// \details Unit selects the unit of measure as returned by functions
+	///  ElapsedTimeAsDouble() and ElapsedTime().
+	/// \sa ElapsedTimeAsDouble, ElapsedTime
+	enum Unit {
+		/// \brief Timer unit is seconds
+		/// \details All timers support seconds
+		SECONDS = 0,
+		/// \brief Timer unit is milliseconds
+		/// \details All timers support milliseconds
+		MILLISECONDS,
+		/// \brief Timer unit is microseconds
+		/// \details The timer requires hardware support microseconds
+		MICROSECONDS,
+		/// \brief Timer unit is nanoseconds
+		/// \details The timer requires hardware support nanoseconds
+		NANOSECONDS
+	};
+
+	/// \brief Construct a TimerBase
+	/// \param unit the unit of measure
+	/// \param stuckAtZero flag
+	TimerBase(Unit unit, bool stuckAtZero)
+		: m_timerUnit(unit), m_stuckAtZero(stuckAtZero), m_started(false)
+		, m_start(0), m_last(0) {}
+
+	/// \brief Retrieve the current timer value
+	/// \return the current timer value
+	virtual TimerWord GetCurrentTimerValue() =0;
+
+	/// \brief Retrieve ticks per second
+	/// \return ticks per second
+	/// \details TicksPerSecond() is not the timer resolution. It is a
+	///  conversion factor into seconds.
+	virtual TimerWord TicksPerSecond() =0;
+
+	/// \brief Start the timer
+	void StartTimer();
+
+	/// \brief Retrieve the elapsed time
+	/// \return the elapsed time as a double
+	/// \details The return value of ElapsedTimeAsDouble() depends upon
+	///  the Unit selected during construction of the timer. For example,
+	///  if <tt>Unit = SECONDS</tt> and ElapsedTimeAsDouble() returns 3,
+	///  then the timer has run for 3 seconds. If
+	///  <tt>Unit = MILLISECONDS</tt> and ElapsedTimeAsDouble() returns
+	///  3000, then the timer has run for 3 seconds.
+	/// \sa Unit, ElapsedTime
+	double ElapsedTimeAsDouble();
+
+	/// \brief Retrieve the elapsed time
+	/// \return the elapsed time as an unsigned long
+	/// \details The return value of ElapsedTime() depends upon the
+	///  Unit selected during construction of the timer. For example, if
+	///  <tt>Unit = SECONDS</tt> and ElapsedTime() returns 3, then
+	///  the timer has run for 3 seconds. If <tt>Unit = MILLISECONDS</tt>
+	///  and ElapsedTime() returns 3000, then the timer has run for 3
+	///  seconds.
+	/// \sa Unit, ElapsedTimeAsDouble
+	unsigned long ElapsedTime();
+
+private:
+	double ConvertTo(TimerWord t, Unit unit);
+
+	Unit m_timerUnit;	// HPUX workaround: m_unit is a system macro on HPUX
+	bool m_stuckAtZero, m_started;
+	TimerWord m_start, m_last;
+};
+
+/// \brief Measure CPU time spent executing instructions of this thread
+/// \details ThreadUserTimer requires support of the OS. On Unix-based it
+///  reports process time. On Windows NT or later desktops and servers it
+///  reports thread times with performance counter precision.. On Windows
+///  Phone and Windows Store it reports wall clock time with performance
+///  counter precision. On all others it reports wall clock time.
+/// \note ThreadUserTimer only works correctly on Windows NT or later
+///  desktops and servers.
+/// \sa Timer
+class ThreadUserTimer : public TimerBase
+{
+public:
+	/// \brief Construct a ThreadUserTimer
+	/// \param unit the unit of measure
+	/// \param stuckAtZero flag
+	ThreadUserTimer(Unit unit = TimerBase::SECONDS, bool stuckAtZero = false) : TimerBase(unit, stuckAtZero) {}
+	TimerWord GetCurrentTimerValue();
+	TimerWord TicksPerSecond();
+};
+
+/// \brief High resolution timer
+/// \sa ThreadUserTimer
+class CRYPTOPP_DLL Timer : public TimerBase
+{
+public:
+	/// \brief Construct a Timer
+	/// \param unit the unit of measure
+	/// \param stuckAtZero flag
+	Timer(Unit unit = TimerBase::SECONDS, bool stuckAtZero = false)	: TimerBase(unit, stuckAtZero) {}
+	TimerWord GetCurrentTimerValue();
+	TimerWord TicksPerSecond();
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/ida.cpp b/runtime/third_party/cryptopp/ida.cpp
new file mode 100644
index 0000000..98fb1e5
--- /dev/null
+++ b/runtime/third_party/cryptopp/ida.cpp
@@ -0,0 +1,418 @@
+// ida.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#include "ida.h"
+#include "stdcpp.h"
+#include "algebra.h"
+#include "polynomi.h"
+#include "polynomi.cpp"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION < 1400)) && !defined(__MWERKS__)
+	// VC60 and VC7 workaround: built-in reverse_iterator has two template parameters, Dinkumware only has one
+	typedef std::reverse_bidirectional_iterator<const byte *, const byte> RevIt;
+#elif defined(_RWSTD_NO_CLASS_PARTIAL_SPEC)
+	typedef std::reverse_iterator<const byte *, std::random_access_iterator_tag, const byte> RevIt;
+#else
+	typedef std::reverse_iterator<const byte *> RevIt;
+#endif
+
+void RawIDA::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	if (!parameters.GetIntValue("RecoveryThreshold", m_threshold))
+		throw InvalidArgument("RawIDA: missing RecoveryThreshold argument");
+
+	CRYPTOPP_ASSERT(m_threshold > 0);
+	if (m_threshold <= 0)
+		throw InvalidArgument("RawIDA: RecoveryThreshold must be greater than 0");
+
+	m_lastMapPosition = m_inputChannelMap.end();
+	m_channelsReady = 0;
+	m_channelsFinished = 0;
+	m_w.New(m_threshold);
+	m_y.New(m_threshold);
+	m_inputQueues.reserve(m_threshold);
+
+	m_outputChannelIds.clear();
+	m_outputChannelIdStrings.clear();
+	m_outputQueues.clear();
+
+	word32 outputChannelID;
+	if (parameters.GetValue("OutputChannelID", outputChannelID))
+		AddOutputChannel(outputChannelID);
+	else
+	{
+		int nShares = parameters.GetIntValueWithDefault("NumberOfShares", m_threshold);
+		CRYPTOPP_ASSERT(nShares > 0);
+		if (nShares <= 0) {nShares = m_threshold;}
+		for (unsigned int i=0; i< (unsigned int)(nShares); i++)
+			AddOutputChannel(i);
+	}
+}
+
+unsigned int RawIDA::InsertInputChannel(word32 channelId)
+{
+	if (m_lastMapPosition != m_inputChannelMap.end())
+	{
+		if (m_lastMapPosition->first == channelId)
+			goto skipFind;
+		++m_lastMapPosition;
+		if (m_lastMapPosition != m_inputChannelMap.end() && m_lastMapPosition->first == channelId)
+			goto skipFind;
+	}
+	m_lastMapPosition = m_inputChannelMap.find(channelId);
+
+skipFind:
+	if (m_lastMapPosition == m_inputChannelMap.end())
+	{
+		if (m_inputChannelIds.size() == size_t(m_threshold))
+			return m_threshold;
+
+		m_lastMapPosition = m_inputChannelMap.insert(InputChannelMap::value_type(channelId, (unsigned int)m_inputChannelIds.size())).first;
+		m_inputQueues.push_back(MessageQueue());
+		m_inputChannelIds.push_back(channelId);
+
+		if (m_inputChannelIds.size() == size_t(m_threshold))
+			PrepareInterpolation();
+	}
+	return m_lastMapPosition->second;
+}
+
+unsigned int RawIDA::LookupInputChannel(word32 channelId) const
+{
+	std::map<word32, unsigned int>::const_iterator it = m_inputChannelMap.find(channelId);
+	if (it == m_inputChannelMap.end())
+		return m_threshold;
+	else
+		return it->second;
+}
+
+void RawIDA::ChannelData(word32 channelId, const byte *inString, size_t length, bool messageEnd)
+{
+	int i = InsertInputChannel(channelId);
+	if (i < m_threshold)
+	{
+		lword size = m_inputQueues[i].MaxRetrievable();
+		m_inputQueues[i].Put(inString, length);
+		if (size < 4 && size + length >= 4)
+		{
+			m_channelsReady++;
+			if (m_channelsReady == size_t(m_threshold))
+				ProcessInputQueues();
+		}
+
+		if (messageEnd)
+		{
+			m_inputQueues[i].MessageEnd();
+			if (m_inputQueues[i].NumberOfMessages() == 1)
+			{
+				m_channelsFinished++;
+				if (m_channelsFinished == size_t(m_threshold))
+				{
+					m_channelsReady = 0;
+					for (i=0; i<m_threshold; i++)
+						m_channelsReady += m_inputQueues[i].AnyRetrievable();
+					ProcessInputQueues();
+				}
+			}
+		}
+	}
+}
+
+lword RawIDA::InputBuffered(word32 channelId) const
+{
+	int i = LookupInputChannel(channelId);
+	return i < m_threshold ? m_inputQueues[i].MaxRetrievable() : 0;
+}
+
+void RawIDA::ComputeV(unsigned int i)
+{
+	if (i >= m_v.size())
+	{
+		m_v.resize(i+1);
+		m_outputToInput.resize(i+1);
+	}
+
+	m_outputToInput[i] = LookupInputChannel(m_outputChannelIds[i]);
+	if (m_outputToInput[i] == size_t(m_threshold) && i * size_t(m_threshold) <= 1000*1000)
+	{
+		m_v[i].resize(m_threshold);
+		PrepareBulkPolynomialInterpolationAt(m_gf32, m_v[i].begin(), m_outputChannelIds[i], &(m_inputChannelIds[0]), m_w.begin(), m_threshold);
+	}
+}
+
+void RawIDA::AddOutputChannel(word32 channelId)
+{
+	m_outputChannelIds.push_back(channelId);
+	m_outputChannelIdStrings.push_back(WordToString(channelId));
+	m_outputQueues.push_back(ByteQueue());
+	if (m_inputChannelIds.size() == size_t(m_threshold))
+		ComputeV((unsigned int)m_outputChannelIds.size() - 1);
+}
+
+void RawIDA::PrepareInterpolation()
+{
+	CRYPTOPP_ASSERT(m_inputChannelIds.size() == size_t(m_threshold));
+	PrepareBulkPolynomialInterpolation(m_gf32, m_w.begin(), &(m_inputChannelIds[0]), (unsigned int)(m_threshold));
+	for (unsigned int i=0; i<m_outputChannelIds.size(); i++)
+		ComputeV(i);
+}
+
+void RawIDA::ProcessInputQueues()
+{
+	bool finished = (m_channelsFinished == size_t(m_threshold));
+	unsigned int i;
+
+	while (finished ? m_channelsReady > 0 : m_channelsReady == size_t(m_threshold))
+	{
+		m_channelsReady = 0;
+		for (i=0; i<size_t(m_threshold); i++)
+		{
+			MessageQueue &queue = m_inputQueues[i];
+			queue.GetWord32(m_y[i]);
+
+			if (finished)
+				m_channelsReady += queue.AnyRetrievable();
+			else
+				m_channelsReady += queue.NumberOfMessages() > 0 || queue.MaxRetrievable() >= 4;
+		}
+
+		for (i=0; (unsigned int)i<m_outputChannelIds.size(); i++)
+		{
+			if (m_outputToInput[i] != size_t(m_threshold))
+				m_outputQueues[i].PutWord32(m_y[m_outputToInput[i]]);
+			else if (m_v[i].size() == size_t(m_threshold))
+				m_outputQueues[i].PutWord32(BulkPolynomialInterpolateAt(m_gf32, m_y.begin(), m_v[i].begin(), m_threshold));
+			else
+			{
+				m_u.resize(m_threshold);
+				PrepareBulkPolynomialInterpolationAt(m_gf32, m_u.begin(), m_outputChannelIds[i], &(m_inputChannelIds[0]), m_w.begin(), m_threshold);
+				m_outputQueues[i].PutWord32(BulkPolynomialInterpolateAt(m_gf32, m_y.begin(), m_u.begin(), m_threshold));
+			}
+		}
+	}
+
+	if (m_outputChannelIds.size() > 0 && m_outputQueues[0].AnyRetrievable())
+		FlushOutputQueues();
+
+	if (finished)
+	{
+		OutputMessageEnds();
+
+		m_channelsReady = 0;
+		m_channelsFinished = 0;
+		m_v.clear();
+
+		std::vector<MessageQueue> inputQueues;
+		std::vector<word32> inputChannelIds;
+
+		inputQueues.swap(m_inputQueues);
+		inputChannelIds.swap(m_inputChannelIds);
+		m_inputChannelMap.clear();
+		m_lastMapPosition = m_inputChannelMap.end();
+
+		for (i=0; i<size_t(m_threshold); i++)
+		{
+			inputQueues[i].GetNextMessage();
+			inputQueues[i].TransferAllTo(*AttachedTransformation(), WordToString(inputChannelIds[i]));
+		}
+	}
+}
+
+void RawIDA::FlushOutputQueues()
+{
+	for (unsigned int i=0; i<m_outputChannelIds.size(); i++)
+		m_outputQueues[i].TransferAllTo(*AttachedTransformation(), m_outputChannelIdStrings[i]);
+}
+
+void RawIDA::OutputMessageEnds()
+{
+	if (GetAutoSignalPropagation() != 0)
+	{
+		for (unsigned int i=0; i<m_outputChannelIds.size(); i++)
+			AttachedTransformation()->ChannelMessageEnd(m_outputChannelIdStrings[i], GetAutoSignalPropagation()-1);
+	}
+}
+
+// ****************************************************************
+
+void SecretSharing::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_pad = parameters.GetValueWithDefault("AddPadding", true);
+	m_ida.IsolatedInitialize(parameters);
+}
+
+size_t SecretSharing::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	if (!blocking)
+		throw BlockingInputOnly("SecretSharing");
+
+	SecByteBlock buf(UnsignedMin(256u, length));
+	unsigned int threshold = m_ida.GetThreshold();
+	while (length > 0)
+	{
+		size_t len = STDMIN(length, buf.size());
+		m_ida.ChannelData(0xffffffff, begin, len, false);
+		for (unsigned int i=0; i<threshold-1; i++)
+		{
+			m_rng.GenerateBlock(buf, len);
+			m_ida.ChannelData(i, buf, len, false);
+		}
+		length -= len;
+		begin += len;
+	}
+
+	if (messageEnd)
+	{
+		m_ida.SetAutoSignalPropagation(messageEnd-1);
+		if (m_pad)
+		{
+			SecretSharing::Put(1);
+			while (m_ida.InputBuffered(0xffffffff) > 0)
+				SecretSharing::Put(0);
+		}
+		m_ida.ChannelData(0xffffffff, NULLPTR, 0, true);
+		for (unsigned int i=0; i<m_ida.GetThreshold()-1; i++)
+			m_ida.ChannelData(i, NULLPTR, 0, true);
+	}
+
+	return 0;
+}
+
+void SecretRecovery::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_pad = parameters.GetValueWithDefault("RemovePadding", true);
+	RawIDA::IsolatedInitialize(CombinedNameValuePairs(parameters, MakeParameters("OutputChannelID", (word32)0xffffffff)));
+}
+
+void SecretRecovery::FlushOutputQueues()
+{
+	if (m_pad)
+		m_outputQueues[0].TransferTo(*AttachedTransformation(), m_outputQueues[0].MaxRetrievable()-4);
+	else
+		m_outputQueues[0].TransferTo(*AttachedTransformation());
+}
+
+void SecretRecovery::OutputMessageEnds()
+{
+	if (m_pad)
+	{
+		PaddingRemover paddingRemover(new Redirector(*AttachedTransformation()));
+		m_outputQueues[0].TransferAllTo(paddingRemover);
+	}
+
+	if (GetAutoSignalPropagation() != 0)
+		AttachedTransformation()->MessageEnd(GetAutoSignalPropagation()-1);
+}
+
+// ****************************************************************
+
+void InformationDispersal::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_nextChannel = 0;
+	m_pad = parameters.GetValueWithDefault("AddPadding", true);
+	m_ida.IsolatedInitialize(parameters);
+}
+
+size_t InformationDispersal::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	if (!blocking)
+		throw BlockingInputOnly("InformationDispersal");
+
+	while (length--)
+	{
+		m_ida.ChannelData(m_nextChannel, begin, 1, false);
+		begin++;
+		m_nextChannel++;
+		if (m_nextChannel == m_ida.GetThreshold())
+			m_nextChannel = 0;
+	}
+
+	if (messageEnd)
+	{
+		m_ida.SetAutoSignalPropagation(messageEnd-1);
+		if (m_pad)
+			InformationDispersal::Put(1);
+		for (word32 i=0; i<m_ida.GetThreshold(); i++)
+			m_ida.ChannelData(i, NULLPTR, 0, true);
+	}
+
+	return 0;
+}
+
+void InformationRecovery::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_pad = parameters.GetValueWithDefault("RemovePadding", true);
+	RawIDA::IsolatedInitialize(parameters);
+}
+
+void InformationRecovery::FlushOutputQueues()
+{
+	while (m_outputQueues[0].AnyRetrievable())
+	{
+		for (unsigned int i=0; i<m_outputChannelIds.size(); i++)
+			m_outputQueues[i].TransferTo(m_queue, 1);
+	}
+
+	if (m_pad)
+		m_queue.TransferTo(*AttachedTransformation(), m_queue.MaxRetrievable()-4*m_threshold);
+	else
+		m_queue.TransferTo(*AttachedTransformation());
+}
+
+void InformationRecovery::OutputMessageEnds()
+{
+	if (m_pad)
+	{
+		PaddingRemover paddingRemover(new Redirector(*AttachedTransformation()));
+		m_queue.TransferAllTo(paddingRemover);
+	}
+
+	if (GetAutoSignalPropagation() != 0)
+		AttachedTransformation()->MessageEnd(GetAutoSignalPropagation()-1);
+}
+
+size_t PaddingRemover::Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+{
+	if (!blocking)
+		throw BlockingInputOnly("PaddingRemover");
+
+	const byte *const end = begin + length;
+
+	if (m_possiblePadding)
+	{
+		size_t len = FindIfNot(begin, end, byte(0)) - begin;
+		m_zeroCount += len;
+		begin += len;
+		if (begin == end)
+			return 0;
+
+		AttachedTransformation()->Put(1);
+		while (m_zeroCount--)
+			AttachedTransformation()->Put(0);
+		AttachedTransformation()->Put(*begin++);
+		m_possiblePadding = false;
+	}
+
+	const byte *x = FindIfNot(RevIt(end), RevIt(begin), byte(0)).base();
+	if (x != begin && *(x-1) == 1)
+	{
+		AttachedTransformation()->Put(begin, x-begin-1);
+		m_possiblePadding = true;
+		m_zeroCount = end - x;
+	}
+	else
+		AttachedTransformation()->Put(begin, end-begin);
+
+	if (messageEnd)
+	{
+		m_possiblePadding = false;
+		Output(0, begin, length, messageEnd, blocking);
+	}
+	return 0;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/ida.h b/runtime/third_party/cryptopp/ida.h
new file mode 100644
index 0000000..534a9ba
--- /dev/null
+++ b/runtime/third_party/cryptopp/ida.h
@@ -0,0 +1,182 @@
+// ida.h - originally written and placed in the public domain by Wei Dai
+
+/// \file ida.h
+/// \brief Classes for Rabin's Information Dispersal and Shamir's Secret Sharing algorithms
+
+#ifndef CRYPTOPP_IDA_H
+#define CRYPTOPP_IDA_H
+
+#include "cryptlib.h"
+#include "mqueue.h"
+#include "filters.h"
+#include "channels.h"
+#include "secblock.h"
+#include "gf2_32.h"
+#include "stdcpp.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Secret sharing and information dispersal base class
+/// \since Crypto++ 1.0
+class RawIDA : public AutoSignaling<Unflushable<Multichannel<Filter> > >
+{
+public:
+	RawIDA(BufferedTransformation *attachment=NULLPTR)
+		: m_channelsReady(0), m_channelsFinished(0), m_threshold (0)
+			{Detach(attachment);}
+
+	unsigned int GetThreshold() const {return m_threshold;}
+	void AddOutputChannel(word32 channelId);
+	void ChannelData(word32 channelId, const byte *inString, size_t length, bool messageEnd);
+	lword InputBuffered(word32 channelId) const;
+
+	void IsolatedInitialize(const NameValuePairs &parameters=g_nullNameValuePairs);
+	size_t ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking)
+	{
+		if (!blocking)
+			throw BlockingInputOnly("RawIDA");
+		ChannelData(StringToWord<word32>(channel), begin, length, messageEnd != 0);
+		return 0;
+	}
+
+protected:
+	virtual void FlushOutputQueues();
+	virtual void OutputMessageEnds();
+
+	unsigned int InsertInputChannel(word32 channelId);
+	unsigned int LookupInputChannel(word32 channelId) const;
+	void ComputeV(unsigned int);
+	void PrepareInterpolation();
+	void ProcessInputQueues();
+
+	typedef std::map<word32, unsigned int> InputChannelMap;
+	InputChannelMap m_inputChannelMap;
+	InputChannelMap::iterator m_lastMapPosition;
+	std::vector<MessageQueue> m_inputQueues;
+	std::vector<word32> m_inputChannelIds, m_outputChannelIds, m_outputToInput;
+	std::vector<std::string> m_outputChannelIdStrings;
+	std::vector<ByteQueue> m_outputQueues;
+	std::vector<SecBlock<word32> > m_v;
+	SecBlock<word32> m_u, m_w, m_y;
+	const GF2_32 m_gf32;
+	unsigned int m_channelsReady, m_channelsFinished;
+	int m_threshold;
+};
+
+/// \brief Shamir's Secret Sharing Algorithm
+/// \details SecretSharing is a variant of Shamir's secret sharing algorithm
+/// \sa SecretRecovery, SecretRecovery, InformationDispersal, InformationRecovery
+/// \since Crypto++ 1.0
+class SecretSharing : public CustomFlushPropagation<Filter>
+{
+public:
+	/// \brief Construct a SecretSharing
+	SecretSharing(RandomNumberGenerator &rng, int threshold, int nShares, BufferedTransformation *attachment=NULLPTR, bool addPadding=true)
+		: m_rng(rng), m_ida(new OutputProxy(*this, true))
+	{
+		Detach(attachment);
+		IsolatedInitialize(MakeParameters("RecoveryThreshold", threshold)("NumberOfShares", nShares)("AddPadding", addPadding));
+	}
+
+	void IsolatedInitialize(const NameValuePairs &parameters=g_nullNameValuePairs);
+	size_t Put2(const byte *begin, size_t length, int messageEnd, bool blocking);
+	bool Flush(bool hardFlush, int propagation=-1, bool blocking=true) {return m_ida.Flush(hardFlush, propagation, blocking);}
+
+protected:
+	RandomNumberGenerator &m_rng;
+	RawIDA m_ida;
+	bool m_pad;
+};
+
+/// \brief Shamir's Secret Sharing Algorithm
+/// \details SecretSharing is a variant of Shamir's secret sharing algorithm
+/// \sa SecretRecovery, SecretRecovery, InformationDispersal, InformationRecovery
+/// \since Crypto++ 1.0
+class SecretRecovery : public RawIDA
+{
+public:
+	/// \brief Construct a SecretRecovery
+	SecretRecovery(int threshold, BufferedTransformation *attachment=NULLPTR, bool removePadding=true)
+		: RawIDA(attachment)
+		{IsolatedInitialize(MakeParameters("RecoveryThreshold", threshold)("RemovePadding", removePadding));}
+
+	void IsolatedInitialize(const NameValuePairs &parameters=g_nullNameValuePairs);
+
+protected:
+	void FlushOutputQueues();
+	void OutputMessageEnds();
+
+	bool m_pad;
+};
+
+/// a variant of Rabin's Information Dispersal Algorithm
+
+/// \brief Rabin's Information Dispersal Algorithm
+/// \details InformationDispersal is a variant of Rabin's information dispersal algorithm
+/// \sa SecretRecovery, SecretRecovery, InformationDispersal, InformationRecovery
+/// \since Crypto++ 1.0
+class InformationDispersal : public CustomFlushPropagation<Filter>
+{
+public:
+	/// \brief Construct a InformationDispersal
+	InformationDispersal(int threshold, int nShares, BufferedTransformation *attachment=NULLPTR, bool addPadding=true)
+		: m_ida(new OutputProxy(*this, true)), m_pad(false), m_nextChannel(0)
+	{
+		Detach(attachment);
+		IsolatedInitialize(MakeParameters("RecoveryThreshold", threshold)("NumberOfShares", nShares)("AddPadding", addPadding));
+	}
+
+	void IsolatedInitialize(const NameValuePairs &parameters=g_nullNameValuePairs);
+	size_t Put2(const byte *begin, size_t length, int messageEnd, bool blocking);
+	bool Flush(bool hardFlush, int propagation=-1, bool blocking=true) {return m_ida.Flush(hardFlush, propagation, blocking);}
+
+protected:
+	RawIDA m_ida;
+	bool m_pad;
+	unsigned int m_nextChannel;
+};
+
+/// \brief Rabin's Information Dispersal Algorithm
+/// \details InformationDispersal is a variant of Rabin's information dispersal algorithm
+/// \sa SecretRecovery, SecretRecovery, InformationDispersal, InformationRecovery
+/// \since Crypto++ 1.0
+class InformationRecovery : public RawIDA
+{
+public:
+	/// \brief Construct a InformationRecovery
+	InformationRecovery(int threshold, BufferedTransformation *attachment=NULLPTR, bool removePadding=true)
+		: RawIDA(attachment), m_pad(false)
+		{IsolatedInitialize(MakeParameters("RecoveryThreshold", threshold)("RemovePadding", removePadding));}
+
+	void IsolatedInitialize(const NameValuePairs &parameters=g_nullNameValuePairs);
+
+protected:
+	void FlushOutputQueues();
+	void OutputMessageEnds();
+
+	bool m_pad;
+	ByteQueue m_queue;
+};
+
+class PaddingRemover : public Unflushable<Filter>
+{
+public:
+	PaddingRemover(BufferedTransformation *attachment=NULLPTR)
+		: m_possiblePadding(false), m_zeroCount(0) {Detach(attachment);}
+
+	void IsolatedInitialize(const NameValuePairs &parameters)
+		{CRYPTOPP_UNUSED(parameters); m_possiblePadding = false;}
+	size_t Put2(const byte *begin, size_t length, int messageEnd, bool blocking);
+
+	// GetPossiblePadding() == false at the end of a message indicates incorrect padding
+	bool GetPossiblePadding() const {return m_possiblePadding;}
+
+private:
+	bool m_possiblePadding;
+	lword m_zeroCount;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/idea.cpp b/runtime/third_party/cryptopp/idea.cpp
new file mode 100644
index 0000000..104cea7
--- /dev/null
+++ b/runtime/third_party/cryptopp/idea.cpp
@@ -0,0 +1,191 @@
+// idea.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "idea.h"
+#include "misc.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+static const int IDEA_KEYLEN=(6*IDEA::ROUNDS+4);  // key schedule length in # of word16s
+
+#define low16(x) ((x)&0xffff)	// compiler should be able to optimize this away if word is 16 bits
+#define high16(x) ((x)>>16)
+
+CRYPTOPP_COMPILE_ASSERT(sizeof(IDEA::Word) >= 2);
+
+// should use an inline function but macros are still faster in MSVC 4.0
+#define DirectMUL(a,b)					\
+{										\
+	word32 p=(word32)low16(a)*b;		\
+										\
+	if (p)								\
+	{									\
+		p = low16(p) - high16(p);		\
+		a = (IDEA::Word)p - (IDEA::Word)high16(p);	\
+	}									\
+	else								\
+		a = 1-a-b;						\
+}
+
+#ifdef IDEA_LARGECACHE
+volatile bool IDEA::Base::tablesBuilt = false;
+word16 IDEA::Base::log[0x10000];
+word16 IDEA::Base::antilog[0x10000];
+
+void IDEA::Base::BuildLogTables()
+{
+	if (tablesBuilt)
+		return;
+	else
+	{
+		tablesBuilt = true;
+
+		IDEA::Word x=1;
+		word32 i;
+
+		for (i=0; i<0x10000; i++)
+		{
+			antilog[i] = (word16)x;
+			DirectMUL(x, 3);
+		}
+
+		for (i=0; i<0x10000; i++)
+			log[antilog[i]] = (word16)i;
+	}
+}
+
+void IDEA::Base::LookupKeyLogs()
+{
+	IDEA::Word* Z=key;
+	int r=ROUNDS;
+	do
+	{
+		Z[0] = log[Z[0]];
+		Z[3] = log[Z[3]];
+		Z[4] = log[Z[4]];
+		Z[5] = log[Z[5]];
+		Z+=6;
+	} while (--r);
+	Z[0] = log[Z[0]];
+	Z[3] = log[Z[3]];
+}
+
+inline void IDEA::Base::LookupMUL(IDEA::Word &a, IDEA::Word b)
+{
+	a = antilog[low16(log[low16(a)]+b)];
+}
+#endif // IDEA_LARGECACHE
+
+void IDEA::Base::UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &)
+{
+	AssertValidKeyLength(length);
+
+#ifdef IDEA_LARGECACHE
+	BuildLogTables();
+#endif
+
+	EnKey(userKey);
+
+	if (!IsForwardTransformation())
+		DeKey();
+
+#ifdef IDEA_LARGECACHE
+	LookupKeyLogs();
+#endif
+}
+
+void IDEA::Base::EnKey (const byte *userKey)
+{
+	unsigned int i;
+
+	for (i=0; i<8; i++)
+		m_key[i] = ((IDEA::Word)userKey[2*i]<<8) | userKey[2*i+1];
+
+	for (; i<IDEA_KEYLEN; i++)
+	{
+		unsigned int j = RoundDownToMultipleOf(i,8U)-8;
+		m_key[i] = low16((m_key[j+(i+1)%8] << 9) | (m_key[j+(i+2)%8] >> 7));
+	}
+}
+
+static IDEA::Word MulInv(IDEA::Word x)
+{
+	IDEA::Word y=x;
+	for (unsigned i=0; i<15; i++)
+	{
+		DirectMUL(y,low16(y));
+		DirectMUL(y,x);
+	}
+	return low16(y);
+}
+
+static inline IDEA::Word AddInv(IDEA::Word x)
+{
+	return low16(0-x);
+}
+
+void IDEA::Base::DeKey()
+{
+	FixedSizeSecBlock<IDEA::Word, 6*ROUNDS+4> tempkey;
+	size_t i;
+
+	for (i=0; i<ROUNDS; i++)
+	{
+		tempkey[i*6+0] = MulInv(m_key[(ROUNDS-i)*6+0]);
+		tempkey[i*6+1] = AddInv(m_key[(ROUNDS-i)*6+1+(i>0)]);
+		tempkey[i*6+2] = AddInv(m_key[(ROUNDS-i)*6+2-(i>0)]);
+		tempkey[i*6+3] = MulInv(m_key[(ROUNDS-i)*6+3]);
+		tempkey[i*6+4] =        m_key[(ROUNDS-1-i)*6+4];
+		tempkey[i*6+5] =        m_key[(ROUNDS-1-i)*6+5];
+	}
+
+	tempkey[i*6+0] = MulInv(m_key[(ROUNDS-i)*6+0]);
+	tempkey[i*6+1] = AddInv(m_key[(ROUNDS-i)*6+1]);
+	tempkey[i*6+2] = AddInv(m_key[(ROUNDS-i)*6+2]);
+	tempkey[i*6+3] = MulInv(m_key[(ROUNDS-i)*6+3]);
+
+	m_key = tempkey;
+}
+
+#ifdef IDEA_LARGECACHE
+#define MUL(a,b) LookupMUL(a,b)
+#else
+#define MUL(a,b) DirectMUL(a,b)
+#endif
+
+void IDEA::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	typedef BlockGetAndPut<word16, BigEndian> Block;
+
+	const IDEA::Word *key = m_key;
+	IDEA::Word x0,x1,x2,x3,t0,t1;
+	Block::Get(inBlock)(x0)(x1)(x2)(x3);
+
+	for (unsigned int i=0; i<ROUNDS; i++)
+	{
+		MUL(x0, key[i*6+0]);
+		x1 += key[i*6+1];
+		x2 += key[i*6+2];
+		MUL(x3, key[i*6+3]);
+		t0 = x0^x2;
+		MUL(t0, key[i*6+4]);
+		t1 = t0 + (x1^x3);
+		MUL(t1, key[i*6+5]);
+		t0 += t1;
+		x0 ^= t1;
+		x3 ^= t0;
+		t0 ^= x1;
+		x1 = x2^t1;
+		x2 = t0;
+	}
+
+	MUL(x0, key[ROUNDS*6+0]);
+	x2 += key[ROUNDS*6+1];
+	x1 += key[ROUNDS*6+2];
+	MUL(x3, key[ROUNDS*6+3]);
+
+	Block::Put(xorBlock, outBlock)(x0)(x2)(x1)(x3);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/idea.h b/runtime/third_party/cryptopp/idea.h
new file mode 100644
index 0000000..f4846b3
--- /dev/null
+++ b/runtime/third_party/cryptopp/idea.h
@@ -0,0 +1,66 @@
+// idea.h - originally written and placed in the public domain by Wei Dai
+
+/// \file idea.h
+/// \brief Classes for the IDEA block cipher
+
+#ifndef CRYPTOPP_IDEA_H
+#define CRYPTOPP_IDEA_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief IDEA block cipher information
+/// \since Crypto++ 1.0
+struct IDEA_Info : public FixedBlockSize<8>, public FixedKeyLength<16>, public FixedRounds<8>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "IDEA";}
+};
+
+/// \brief IDEA block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/IDEA">IDEA</a>
+/// \since Crypto++ 1.0
+class IDEA : public IDEA_Info, public BlockCipherDocumentation
+{
+public:		// made public for internal purposes
+#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+	typedef word Word;
+#else
+	typedef hword Word;
+#endif
+
+private:
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<IDEA_Info>
+	{
+	public:
+		unsigned int OptimalDataAlignment() const {return 2;}
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	private:
+		void EnKey(const byte *);
+		void DeKey();
+		FixedSizeSecBlock<Word, 6*ROUNDS+4> m_key;
+
+	#ifdef IDEA_LARGECACHE
+		static inline void LookupMUL(word &a, word b);
+		void LookupKeyLogs();
+		static void BuildLogTables();
+		static volatile bool tablesBuilt;
+		static word16 log[0x10000], antilog[0x10000];
+	#endif
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+typedef IDEA::Encryption IDEAEncryption;
+typedef IDEA::Decryption IDEADecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/integer.cpp b/runtime/third_party/cryptopp/integer.cpp
new file mode 100644
index 0000000..b851924
--- /dev/null
+++ b/runtime/third_party/cryptopp/integer.cpp
@@ -0,0 +1,4950 @@
+// integer.cpp - originally written and placed in the public domain by Wei Dai
+// contains public domain code contributed by Alister Lee and Leonard Janke
+
+// Notes by JW: The Integer class needs to do two things. First, it needs
+//  to set function pointers on some platforms, like X86 and X64. The
+//  function pointers select a fast multiply and addition based on the cpu.
+//  Second, it wants to create Integer::Zero(), Integer::One() and
+//  Integer::Two().
+// The function pointers are initialized in the InitializeInteger class by
+//  calling SetFunctionPointers(). The call to SetFunctionPointers() is
+//  guarded to run once using a double-checked pattern. We don't use C++
+//  std::call_once due to bad interactions between libstdc++, glibc and
+//  pthreads. The bad interactions were causing crashes for us on platforms
+//  like Sparc and PowerPC. Since we are only setting function pointers we
+//  don't have to worry about leaking memory. The worst case seems to be the
+//  pointers gets written twice until the init flag is set and visible to
+//  all threads.
+// For Integer::Zero(), Integer::One() and Integer::Two(), we use one of three
+//  strategies. First, if initialization priorities are available then we use
+//  them. Initialization priorities are init_priority() on Linux and init_seg()
+//  on Windows. OS X and several other platforms lack them. Initialization
+//  priorities are platform specific but they are also the most trouble free
+//  with deterministic destruction.
+// Second, if C++11 dynamic initialization is available, then we use it. After
+//  the std::call_once fiasco we moved to dynamic initialization to avoid
+//  unknown troubles platforms that are tested less frequently. In addition
+//  Microsoft platforms mostly do not provide dynamic initialization.
+//  The MSDN docs claim they do but they don't in practice because we need
+//  Visual Studio 2017 and Windows 10 or above.
+// Third, we fall back to Wei's original code of a Singleton. Wei's original
+//  code was much simpler. It simply used the Singleton pattern, but it always
+//  produced memory findings on some platforms. The Singleton generates memory
+//  findings because it uses a Create On First Use pattern (a dumb Nifty
+//  Counter) and the compiler had to be smart enough to fold them to return
+//  the same object. Unix and Linux compilers do a good job of folding objects,
+//  but Microsoft compilers do a rather poor job for some versions of the
+//  compiler.
+// Another problem with the Singleton is resource destruction requires running
+//  resource acquisition in reverse. For resources provided through the
+//  Singletons, there is no way to express the dependency order to safely
+//  destroy resources. (That's one of the problems C++11 dynamic
+//  initialization with concurrent execution is supposed to solve).
+// The final problem with Singletons is resource/memory exhaustion in languages
+//  like Java and .Net. Java and .Net load and unload a native DLL hundreds or
+//  thousands of times during the life of a program. Each load produces a
+//  memory leak and they can add up quickly. If they library is being used in
+//  Java or .Net then Singleton must be avoided at all costs.
+//
+// The code below has a path cut-in for BMI2 using mulx and adcx instructions.
+//  There was a modest speedup of approximately 0.03 ms in public key Integer
+//  operations. We had to disable BMI2 for the moment because some OS X machines
+//  were advertising BMI/BMI2 support but caused SIGILL's at runtime. Also see
+//  https://github.com/weidai11/cryptopp/issues/850.
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "integer.h"
+#include "secblock.h"
+#include "modarith.h"
+#include "nbtheory.h"
+#include "smartptr.h"
+#include "algparam.h"
+#include "filters.h"
+#include "stdcpp.h"
+#include "asn.h"
+#include "oids.h"
+#include "words.h"
+#include "pubkey.h"		// for P1363_KDF2
+#include "sha.h"
+#include "cpu.h"
+#include "misc.h"
+
+#include <iostream>
+
+#if (CRYPTOPP_MSC_VERSION >= 1400) && !defined(_M_ARM)
+	#include <intrin.h>
+#endif
+
+#ifdef __DECCXX
+	#include <c_asm.h>
+#endif
+
+// "Error: The operand ___LKDB cannot be assigned to",
+// http://github.com/weidai11/cryptopp/issues/188
+#if (__SUNPRO_CC >= 0x5130)
+# define MAYBE_CONST
+# define MAYBE_UNCONST_CAST(x) const_cast<word*>(x)
+#else
+# define MAYBE_CONST const
+# define MAYBE_UNCONST_CAST(x) x
+#endif
+
+// "Inline assembly operands don't work with .intel_syntax",
+//  http://llvm.org/bugs/show_bug.cgi?id=24232
+#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+# undef CRYPTOPP_X86_ASM_AVAILABLE
+# undef CRYPTOPP_X32_ASM_AVAILABLE
+# undef CRYPTOPP_X64_ASM_AVAILABLE
+# undef CRYPTOPP_SSE2_ASM_AVAILABLE
+# undef CRYPTOPP_SSSE3_ASM_AVAILABLE
+#else
+# define CRYPTOPP_INTEGER_SSE2 (CRYPTOPP_SSE2_ASM_AVAILABLE && (CRYPTOPP_BOOL_X86))
+#endif
+
+// ***************** C++ Static Initialization ********************
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Function body near the middle of the file
+static void SetFunctionPointers();
+
+// Use a double-checked pattern. We are not leaking anything so it
+// does not matter if a pointer is written twice during a race.
+// Avoid std::call_once due to too many problems on platforms like
+// Solaris and Sparc. Also see
+// http://gcc.gnu.org/bugzilla/show_bug.cgi?id=66146 and
+// http://github.com/weidai11/cryptopp/issues/707.
+InitializeInteger::InitializeInteger()
+{
+	static bool s_flag;
+	MEMORY_BARRIER();
+	if (s_flag == false)
+	{
+		SetFunctionPointers();
+		s_flag = true;
+		MEMORY_BARRIER();
+	}
+}
+
+template <long i>
+struct NewInteger
+{
+	Integer * operator()() const
+	{
+		return new Integer(i);
+	}
+};
+
+// ***************** Library code ********************
+
+inline static int Compare(const word *A, const word *B, size_t N)
+{
+	while (N--)
+		if (A[N] > B[N])
+			return 1;
+		else if (A[N] < B[N])
+			return -1;
+
+	return 0;
+}
+
+inline static int Increment(word *A, size_t N, word B=1)
+{
+	CRYPTOPP_ASSERT(N);
+	word t = A[0];
+	A[0] = t+B;
+	if (A[0] >= t)
+		return 0;
+	for (unsigned i=1; i<N; i++)
+		if (++A[i])
+			return 0;
+	return 1;
+}
+
+inline static int Decrement(word *A, size_t N, word B=1)
+{
+	CRYPTOPP_ASSERT(N);
+	word t = A[0];
+	A[0] = t-B;
+	if (A[0] <= t)
+		return 0;
+	for (unsigned i=1; i<N; i++)
+		if (A[i]--)
+			return 0;
+	return 1;
+}
+
+static void TwosComplement(word *A, size_t N)
+{
+	Decrement(A, N);
+	for (unsigned i=0; i<N; i++)
+		A[i] = ~A[i];
+}
+
+static word AtomicInverseModPower2(word A)
+{
+	CRYPTOPP_ASSERT(A%2==1);
+
+	word R=A%8;
+
+	for (unsigned i=3; i<WORD_BITS; i*=2)
+		R = R*(2-R*A);
+
+	CRYPTOPP_ASSERT(R*A==1);
+	return R;
+}
+
+// ********************************************************
+
+#if !defined(CRYPTOPP_NATIVE_DWORD_AVAILABLE) || ((defined(__aarch64__) || defined(__x86_64__)) && defined(CRYPTOPP_WORD128_AVAILABLE))
+	#define TWO_64_BIT_WORDS 1
+	#define Declare2Words(x)			word x##0, x##1;
+	#define AssignWord(a, b)			a##0 = b; a##1 = 0;
+	#define Add2WordsBy1(a, b, c)		a##0 = b##0 + c; a##1 = b##1 + (a##0 < c);
+	#define LowWord(a)					a##0
+	#define HighWord(a)					a##1
+	#ifdef CRYPTOPP_MSC_VERSION
+		#define MultiplyWordsLoHi(p0, p1, a, b)		p0 = _umul128(a, b, &p1);
+		#ifndef __INTEL_COMPILER
+			#define Double3Words(c, d)		d##1 = __shiftleft128(d##0, d##1, 1); d##0 = __shiftleft128(c, d##0, 1); c *= 2;
+		#endif
+	#elif defined(__aarch32__) || defined(__aarch64__)
+		#define MultiplyWordsLoHi(p0, p1, a, b)		p0 = a*b; asm ("umulh %0,%1,%2" : "=r"(p1) : "r"(a), "r"(b));
+	#elif defined(__DECCXX)
+		#define MultiplyWordsLoHi(p0, p1, a, b)		p0 = a*b; p1 = asm("umulh %a0, %a1, %v0", a, b);
+	#elif defined(__x86_64__)
+		#if defined(__SUNPRO_CC) && __SUNPRO_CC < 0x5100
+			// Sun Studio's gcc-style inline assembly is heavily bugged as of version 5.9 Patch 124864-09 2008/12/16, but this one works
+			#define MultiplyWordsLoHi(p0, p1, a, b)		asm ("mulq %3" : "=a"(p0), "=d"(p1) : "a"(a), "r"(b) : "cc");
+		#elif defined(__BMI2__) && 0
+			#define MultiplyWordsLoHi(p0, p1, a, b)		asm ("mulxq %3, %0, %1" : "=r"(p0), "=r"(p1) : "d"(a), "r"(b));
+			#define MulAcc(c, d, a, b)		asm ("mulxq %6, %3, %4; addq %3, %0; adcxq %4, %1; adcxq %7, %2;" : "+&r"(c), "+&r"(d##0), "+&r"(d##1), "=&r"(p0), "=&r"(p1) : "d"(a), "r"(b), "r"(W64LIT(0)) : "cc");
+			#define Double3Words(c, d)		asm ("addq %0, %0; adcxq %1, %1; adcxq %2, %2;" : "+r"(c), "+r"(d##0), "+r"(d##1) : : "cc");
+			#define Acc2WordsBy1(a, b)		asm ("addq %2, %0; adcxq %3, %1;" : "+&r"(a##0), "+r"(a##1) : "r"(b), "r"(W64LIT(0)) : "cc");
+			#define Acc2WordsBy2(a, b)		asm ("addq %2, %0; adcxq %3, %1;" : "+r"(a##0), "+r"(a##1) : "r"(b##0), "r"(b##1) : "cc");
+			#define Acc3WordsBy2(c, d, e)	asm ("addq %5, %0; adcxq %6, %1; adcxq %7, %2;" : "+r"(c), "=&r"(e##0), "=&r"(e##1) : "1"(d##0), "2"(d##1), "r"(e##0), "r"(e##1), "r"(W64LIT(0)) : "cc");
+		#else
+			#define MultiplyWordsLoHi(p0, p1, a, b)		asm ("mulq %3" : "=a"(p0), "=d"(p1) : "a"(a), "g"(b) : "cc");
+			#define MulAcc(c, d, a, b)		asm ("mulq %6; addq %3, %0; adcq %4, %1; adcq $0, %2;" : "+r"(c), "+r"(d##0), "+r"(d##1), "=a"(p0), "=d"(p1) : "a"(a), "g"(b) : "cc");
+			#define Double3Words(c, d)		asm ("addq %0, %0; adcq %1, %1; adcq %2, %2;" : "+r"(c), "+r"(d##0), "+r"(d##1) : : "cc");
+			#define Acc2WordsBy1(a, b)		asm ("addq %2, %0; adcq $0, %1;" : "+r"(a##0), "+r"(a##1) : "r"(b) : "cc");
+			#define Acc2WordsBy2(a, b)		asm ("addq %2, %0; adcq %3, %1;" : "+r"(a##0), "+r"(a##1) : "r"(b##0), "r"(b##1) : "cc");
+			#define Acc3WordsBy2(c, d, e)	asm ("addq %5, %0; adcq %6, %1; adcq $0, %2;" : "+r"(c), "=r"(e##0), "=r"(e##1) : "1"(d##0), "2"(d##1), "r"(e##0), "r"(e##1) : "cc");
+		#endif
+	#endif
+	#define MultiplyWords(p, a, b)		MultiplyWordsLoHi(p##0, p##1, a, b)
+	#ifndef Double3Words
+		#define Double3Words(c, d)		d##1 = 2*d##1 + (d##0>>(WORD_BITS-1)); d##0 = 2*d##0 + (c>>(WORD_BITS-1)); c *= 2;
+	#endif
+	#ifndef Acc2WordsBy2
+		#define Acc2WordsBy2(a, b)		a##0 += b##0; a##1 += a##0 < b##0; a##1 += b##1;
+	#endif
+	#define AddWithCarry(u, a, b)		{word t = a+b; u##0 = t + u##1; u##1 = (t<a) + (u##0<t);}
+	#define SubtractWithBorrow(u, a, b)	{word t = a-b; u##0 = t - u##1; u##1 = (t>a) + (u##0>t);}
+	#define GetCarry(u)					u##1
+	#define GetBorrow(u)				u##1
+#else
+	#define Declare2Words(x)			dword x;
+	#if CRYPTOPP_MSC_VERSION >= 1400 && !defined(__INTEL_COMPILER) && (defined(_M_IX86) || defined(_M_X64) || defined(_M_IA64))
+		#define MultiplyWords(p, a, b)		p = __emulu(a, b);
+	#else
+		#define MultiplyWords(p, a, b)		p = (dword)a*b;
+	#endif
+	#define AssignWord(a, b)			a = b;
+	#define Add2WordsBy1(a, b, c)		a = b + c;
+	#define Acc2WordsBy2(a, b)			a += b;
+	#define LowWord(a)					word(a)
+	#define HighWord(a)					word(a>>WORD_BITS)
+	#define Double3Words(c, d)			d = 2*d + (c>>(WORD_BITS-1)); c *= 2;
+	#define AddWithCarry(u, a, b)		u = dword(a) + b + GetCarry(u);
+	#define SubtractWithBorrow(u, a, b)	u = dword(a) - b - GetBorrow(u);
+	#define GetCarry(u)					HighWord(u)
+	#define GetBorrow(u)				word(u>>(WORD_BITS*2-1))
+#endif
+#ifndef MulAcc
+	#define MulAcc(c, d, a, b)			MultiplyWords(p, a, b); Acc2WordsBy1(p, c); c = LowWord(p); Acc2WordsBy1(d, HighWord(p));
+#endif
+#ifndef Acc2WordsBy1
+	#define Acc2WordsBy1(a, b)			Add2WordsBy1(a, a, b)
+#endif
+#ifndef Acc3WordsBy2
+	#define Acc3WordsBy2(c, d, e)		Acc2WordsBy1(e, c); c = LowWord(e); Add2WordsBy1(e, d, HighWord(e));
+#endif
+
+class DWord
+{
+public:
+#if defined(CRYPTOPP_NATIVE_DWORD_AVAILABLE)
+	DWord() {std::memset(&m_whole, 0x00, sizeof(m_whole));}
+#else
+	DWord() {std::memset(&m_halfs, 0x00, sizeof(m_halfs));}
+#endif
+
+#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+	explicit DWord(word low) : m_whole(low) { }
+#else
+	explicit DWord(word low)
+	{
+		m_halfs.high = 0;
+		m_halfs.low = low;
+	}
+#endif
+
+#if defined(CRYPTOPP_NATIVE_DWORD_AVAILABLE)
+	DWord(word low, word high) : m_whole()
+#else
+	DWord(word low, word high) : m_halfs()
+#endif
+	{
+#if defined(CRYPTOPP_NATIVE_DWORD_AVAILABLE)
+#  if (CRYPTOPP_LITTLE_ENDIAN)
+		const word t[2] = {low,high};
+		std::memcpy(&m_whole, t, sizeof(m_whole));
+#  else
+		const word t[2] = {high,low};
+		std::memcpy(&m_whole, t, sizeof(m_whole));
+#  endif
+#else
+		m_halfs.low = low;
+		m_halfs.high = high;
+#endif
+	}
+
+	static DWord Multiply(word a, word b)
+	{
+		DWord r;
+		#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+			r.m_whole = (dword)a * b;
+		#elif defined(MultiplyWordsLoHi)
+			MultiplyWordsLoHi(r.m_halfs.low, r.m_halfs.high, a, b);
+		#else
+			CRYPTOPP_ASSERT(0);
+		#endif
+		return r;
+	}
+
+	static DWord MultiplyAndAdd(word a, word b, word c)
+	{
+		DWord r = Multiply(a, b);
+		return r += c;
+	}
+
+	DWord & operator+=(word a)
+	{
+		#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+			m_whole = m_whole + a;
+		#else
+			m_halfs.low += a;
+			m_halfs.high += (m_halfs.low < a);
+		#endif
+		return *this;
+	}
+
+	DWord operator+(word a)
+	{
+		DWord r;
+		#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+			r.m_whole = m_whole + a;
+		#else
+			r.m_halfs.low = m_halfs.low + a;
+			r.m_halfs.high = m_halfs.high + (r.m_halfs.low < a);
+		#endif
+		return r;
+	}
+
+	DWord operator-(DWord a)
+	{
+		DWord r;
+		#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+			r.m_whole = m_whole - a.m_whole;
+		#else
+			r.m_halfs.low = m_halfs.low - a.m_halfs.low;
+			r.m_halfs.high = m_halfs.high - a.m_halfs.high - (r.m_halfs.low > m_halfs.low);
+		#endif
+		return r;
+	}
+
+	DWord operator-(word a)
+	{
+		DWord r;
+		#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+			r.m_whole = m_whole - a;
+		#else
+			r.m_halfs.low = m_halfs.low - a;
+			r.m_halfs.high = m_halfs.high - (r.m_halfs.low > m_halfs.low);
+		#endif
+		return r;
+	}
+
+	// returns quotient, which must fit in a word
+	word operator/(word divisor);
+
+	word operator%(word a);
+
+	bool operator!() const
+	{
+	#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+		return !m_whole;
+	#else
+		return !m_halfs.high && !m_halfs.low;
+	#endif
+	}
+
+	// TODO: When NATIVE_DWORD is in effect, we access high and low, which are inactive
+	//  union members, and that's UB. Also see http://stackoverflow.com/q/11373203.
+	word GetLowHalf() const {return m_halfs.low;}
+	word GetHighHalf() const {return m_halfs.high;}
+	word GetHighHalfAsBorrow() const {return 0-m_halfs.high;}
+
+private:
+	// Issue 274, "Types cannot be declared in anonymous union",
+	//   http://github.com/weidai11/cryptopp/issues/274
+	//   Thanks to Martin Bonner at http://stackoverflow.com/a/39507183
+    struct half_words
+    {
+    #if (CRYPTOPP_LITTLE_ENDIAN)
+        word low;
+        word high;
+    #else
+        word high;
+        word low;
+    #endif
+   };
+   union
+   {
+   #ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+       dword m_whole;
+   #endif
+       half_words m_halfs;
+   };
+};
+
+class Word
+{
+public:
+	Word() : m_whole(0) {}
+	Word(word value) : m_whole(value) {}
+	Word(hword low, hword high) : m_whole(low | (word(high) << (WORD_BITS/2))) {}
+
+	static Word Multiply(hword a, hword b)
+	{
+		Word r;
+		r.m_whole = (word)a * b;
+		return r;
+	}
+
+	Word operator-(Word a)
+	{
+		Word r;
+		r.m_whole = m_whole - a.m_whole;
+		return r;
+	}
+
+	Word operator-(hword a)
+	{
+		Word r;
+		r.m_whole = m_whole - a;
+		return r;
+	}
+
+	// returns quotient, which must fit in a word
+	hword operator/(hword divisor)
+	{
+		return hword(m_whole / divisor);
+	}
+
+	bool operator!() const
+	{
+		return !m_whole;
+	}
+
+	word GetWhole() const {return m_whole;}
+	hword GetLowHalf() const {return hword(m_whole);}
+	hword GetHighHalf() const {return hword(m_whole>>(WORD_BITS/2));}
+	hword GetHighHalfAsBorrow() const {return 0-hword(m_whole>>(WORD_BITS/2));}
+
+private:
+	word m_whole;
+};
+
+// do a 3 word by 2 word divide, returns quotient and leaves remainder in A
+template <class S, class D>
+S DivideThreeWordsByTwo(S *A, S B0, S B1, D *dummy=NULLPTR)
+{
+	CRYPTOPP_UNUSED(dummy);
+
+	// Assert {A[2],A[1]} < {B1,B0}, so quotient can fit in a S
+	CRYPTOPP_ASSERT(A[2] < B1 || (A[2]==B1 && A[1] < B0));
+
+	// Profiling guided the flow below.
+
+	// estimate the quotient: do a 2 S by 1 S divide.
+	S Q; bool pre = (S(B1+1) == 0);
+	if (B1 > 0 && !pre)
+		Q = D(A[1], A[2]) / S(B1+1);
+	else if (pre)
+		Q = A[2];
+	else
+		Q = D(A[0], A[1]) / B0;
+
+	// now subtract Q*B from A
+	D p = D::Multiply(B0, Q);
+	D u = (D) A[0] - p.GetLowHalf();
+	A[0] = u.GetLowHalf();
+	u = (D) A[1] - p.GetHighHalf() - u.GetHighHalfAsBorrow() - D::Multiply(B1, Q);
+	A[1] = u.GetLowHalf();
+	A[2] += u.GetHighHalf();
+
+	// Q <= actual quotient, so fix it
+	while (A[2] || A[1] > B1 || (A[1]==B1 && A[0]>=B0))
+	{
+		u = (D) A[0] - B0;
+		A[0] = u.GetLowHalf();
+		u = (D) A[1] - B1 - u.GetHighHalfAsBorrow();
+		A[1] = u.GetLowHalf();
+		A[2] += u.GetHighHalf();
+		Q++;
+		CRYPTOPP_ASSERT(Q);	// shouldn't overflow
+	}
+
+	return Q;
+}
+
+// do a 4 word by 2 word divide, returns 2 word quotient in Q0 and Q1
+template <class S, class D>
+inline D DivideFourWordsByTwo(S *T, const D &Al, const D &Ah, const D &B)
+{
+	// Profiling guided the flow below.
+
+	if (!!B)
+	{
+		S Q[2];
+		T[0] = Al.GetLowHalf();
+		T[1] = Al.GetHighHalf();
+		T[2] = Ah.GetLowHalf();
+		T[3] = Ah.GetHighHalf();
+		Q[1] = DivideThreeWordsByTwo<S, D>(T+1, B.GetLowHalf(), B.GetHighHalf());
+		Q[0] = DivideThreeWordsByTwo<S, D>(T, B.GetLowHalf(), B.GetHighHalf());
+		return D(Q[0], Q[1]);
+	}
+	else  // if divisor is 0, we assume divisor==2**(2*WORD_BITS)
+	{
+		return D(Ah.GetLowHalf(), Ah.GetHighHalf());
+	}
+}
+
+// returns quotient, which must fit in a word
+inline word DWord::operator/(word a)
+{
+	#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+		return word(m_whole / a);
+	#else
+		hword r[4];
+		return DivideFourWordsByTwo<hword, Word>(r, m_halfs.low, m_halfs.high, a).GetWhole();
+	#endif
+}
+
+inline word DWord::operator%(word a)
+{
+	#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+		return word(m_whole % a);
+	#else
+		if (a < (word(1) << (WORD_BITS/2)))
+		{
+			hword h = hword(a);
+			word r = m_halfs.high % h;
+			r = ((m_halfs.low >> (WORD_BITS/2)) + (r << (WORD_BITS/2))) % h;
+			return hword((hword(m_halfs.low) + (r << (WORD_BITS/2))) % h);
+		}
+		else
+		{
+			hword r[4];
+			DivideFourWordsByTwo<hword, Word>(r, m_halfs.low, m_halfs.high, a);
+			return Word(r[0], r[1]).GetWhole();
+		}
+	#endif
+}
+
+// ********************************************************
+
+// Use some tricks to share assembly code between MSVC, GCC, Clang and Sun CC.
+#if defined(__GNUC__)
+	#define AddPrologue \
+		int result;	\
+		__asm__ __volatile__ \
+		( \
+			INTEL_NOPREFIX
+	#define AddEpilogue \
+			ATT_PREFIX \
+					: "=a" (result)\
+					: "d" (C), "a" (A), "D" (B), "c" (N) \
+					: "%esi", "memory", "cc" \
+		);\
+		return result;
+	#define MulPrologue \
+		__asm__ __volatile__ \
+		( \
+			INTEL_NOPREFIX \
+			AS1(	push	ebx) \
+			AS2(	mov		ebx, edx)
+	#define MulEpilogue \
+			AS1(	pop		ebx) \
+			ATT_PREFIX \
+			: \
+			: "d" (s_maskLow16), "c" (C), "a" (A), "D" (B) \
+			: "%esi", "memory", "cc" \
+		);
+	#define SquPrologue		MulPrologue
+	#define SquEpilogue	\
+			AS1(	pop		ebx) \
+			ATT_PREFIX \
+			: \
+			: "d" (s_maskLow16), "c" (C), "a" (A) \
+			: "%esi", "%edi", "memory", "cc" \
+		);
+	#define TopPrologue		MulPrologue
+	#define TopEpilogue	\
+			AS1(	pop		ebx) \
+			ATT_PREFIX \
+			: \
+			: "d" (s_maskLow16), "c" (C), "a" (A), "D" (B), "S" (L) \
+			: "memory", "cc" \
+		);
+#else
+	#define AddPrologue \
+		__asm	push edi \
+		__asm	push esi \
+		__asm	mov		eax, [esp+12] \
+		__asm	mov		edi, [esp+16]
+	#define AddEpilogue \
+		__asm	pop esi \
+		__asm	pop edi \
+		__asm	ret 8
+	#define SaveEBX
+	#define RestoreEBX
+	#define SquPrologue					\
+		AS2(	mov		eax, A)			\
+		AS2(	mov		ecx, C)			\
+		SaveEBX							\
+		AS2(	lea		ebx, s_maskLow16)
+	#define MulPrologue					\
+		AS2(	mov		eax, A)			\
+		AS2(	mov		edi, B)			\
+		AS2(	mov		ecx, C)			\
+		SaveEBX							\
+		AS2(	lea		ebx, s_maskLow16)
+	#define TopPrologue					\
+		AS2(	mov		eax, A)			\
+		AS2(	mov		edi, B)			\
+		AS2(	mov		ecx, C)			\
+		AS2(	mov		esi, L)			\
+		SaveEBX							\
+		AS2(	lea		ebx, s_maskLow16)
+	#define SquEpilogue		RestoreEBX
+	#define MulEpilogue		RestoreEBX
+	#define TopEpilogue		RestoreEBX
+#endif
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+extern "C" {
+int Baseline_Add(size_t N, word *C, const word *A, const word *B);
+int Baseline_Sub(size_t N, word *C, const word *A, const word *B);
+}
+#elif defined(CRYPTOPP_X64_ASM_AVAILABLE) && defined(__GNUC__) && defined(CRYPTOPP_WORD128_AVAILABLE)
+int Baseline_Add(size_t N, word *C, const word *A, const word *B)
+{
+	word result;
+	__asm__ __volatile__
+	(
+	INTEL_NOPREFIX
+	AS1(	neg		%1)
+	ASJ(	jz,		1, f)
+	AS2(	mov		%0,[%3+8*%1])
+	AS2(	add		%0,[%4+8*%1])
+	AS2(	mov		[%2+8*%1],%0)
+	ASL(0)
+	AS2(	mov		%0,[%3+8*%1+8])
+	AS2(	adc		%0,[%4+8*%1+8])
+	AS2(	mov		[%2+8*%1+8],%0)
+	AS2(	lea		%1,[%1+2])
+	ASJ(	jrcxz,	1, f)
+	AS2(	mov		%0,[%3+8*%1])
+	AS2(	adc		%0,[%4+8*%1])
+	AS2(	mov		[%2+8*%1],%0)
+	ASJ(	jmp,	0, b)
+	ASL(1)
+	AS2(	mov		%0, 0)
+	AS2(	adc		%0, %0)
+	ATT_NOPREFIX
+	: "=&r" (result), "+c" (N)
+	: "r" (C+N), "r" (A+N), "r" (B+N)
+	: "memory", "cc"
+	);
+	return (int)result;
+}
+
+int Baseline_Sub(size_t N, word *C, const word *A, const word *B)
+{
+	word result;
+	__asm__ __volatile__
+	(
+	INTEL_NOPREFIX
+	AS1(	neg		%1)
+	ASJ(	jz,		1, f)
+	AS2(	mov		%0,[%3+8*%1])
+	AS2(	sub		%0,[%4+8*%1])
+	AS2(	mov		[%2+8*%1],%0)
+	ASL(0)
+	AS2(	mov		%0,[%3+8*%1+8])
+	AS2(	sbb		%0,[%4+8*%1+8])
+	AS2(	mov		[%2+8*%1+8],%0)
+	AS2(	lea		%1,[%1+2])
+	ASJ(	jrcxz,	1, f)
+	AS2(	mov		%0,[%3+8*%1])
+	AS2(	sbb		%0,[%4+8*%1])
+	AS2(	mov		[%2+8*%1],%0)
+	ASJ(	jmp,	0, b)
+	ASL(1)
+	AS2(	mov		%0, 0)
+	AS2(	adc		%0, %0)
+	ATT_NOPREFIX
+	: "=&r" (result), "+c" (N)
+	: "r" (C+N), "r" (A+N), "r" (B+N)
+	: "memory", "cc"
+	);
+	return (int)result;
+}
+#elif defined(CRYPTOPP_X86_ASM_AVAILABLE) && CRYPTOPP_BOOL_X86
+CRYPTOPP_NAKED int CRYPTOPP_FASTCALL Baseline_Add(size_t N, word *C, const word *A, const word *B)
+{
+	AddPrologue
+
+	// now: eax = A, edi = B, edx = C, ecx = N
+	AS2(	lea		eax, [eax+4*ecx])
+	AS2(	lea		edi, [edi+4*ecx])
+	AS2(	lea		edx, [edx+4*ecx])
+
+	AS1(	neg		ecx)				// ecx is negative index
+	AS2(	test	ecx, 2)				// this clears carry flag
+	ASJ(	jz,		0, f)
+	AS2(	sub		ecx, 2)
+	ASJ(	jmp,	1, f)
+
+	ASL(0)
+	ASJ(	jecxz,	2, f)				// loop until ecx overflows and becomes zero
+	AS2(	mov		esi,[eax+4*ecx])
+	AS2(	adc		esi,[edi+4*ecx])
+	AS2(	mov		[edx+4*ecx],esi)
+	AS2(	mov		esi,[eax+4*ecx+4])
+	AS2(	adc		esi,[edi+4*ecx+4])
+	AS2(	mov		[edx+4*ecx+4],esi)
+	ASL(1)
+	AS2(	mov		esi,[eax+4*ecx+8])
+	AS2(	adc		esi,[edi+4*ecx+8])
+	AS2(	mov		[edx+4*ecx+8],esi)
+	AS2(	mov		esi,[eax+4*ecx+12])
+	AS2(	adc		esi,[edi+4*ecx+12])
+	AS2(	mov		[edx+4*ecx+12],esi)
+
+	AS2(	lea		ecx,[ecx+4])		// advance index, avoid inc which causes slowdown on Intel Core 2
+	ASJ(	jmp,	0, b)
+
+	ASL(2)
+	AS2(	mov		eax, 0)
+	AS1(	setc	al)					// store carry into eax (return result register)
+
+	AddEpilogue
+
+	// http://github.com/weidai11/cryptopp/issues/340
+	CRYPTOPP_UNUSED(A); CRYPTOPP_UNUSED(B);
+	CRYPTOPP_UNUSED(C); CRYPTOPP_UNUSED(N);
+}
+
+CRYPTOPP_NAKED int CRYPTOPP_FASTCALL Baseline_Sub(size_t N, word *C, const word *A, const word *B)
+{
+	AddPrologue
+
+	// now: eax = A, edi = B, edx = C, ecx = N
+	AS2(	lea		eax, [eax+4*ecx])
+	AS2(	lea		edi, [edi+4*ecx])
+	AS2(	lea		edx, [edx+4*ecx])
+
+	AS1(	neg		ecx)				// ecx is negative index
+	AS2(	test	ecx, 2)				// this clears carry flag
+	ASJ(	jz,		0, f)
+	AS2(	sub		ecx, 2)
+	ASJ(	jmp,	1, f)
+
+	ASL(0)
+	ASJ(	jecxz,	2, f)				// loop until ecx overflows and becomes zero
+	AS2(	mov		esi,[eax+4*ecx])
+	AS2(	sbb		esi,[edi+4*ecx])
+	AS2(	mov		[edx+4*ecx],esi)
+	AS2(	mov		esi,[eax+4*ecx+4])
+	AS2(	sbb		esi,[edi+4*ecx+4])
+	AS2(	mov		[edx+4*ecx+4],esi)
+	ASL(1)
+	AS2(	mov		esi,[eax+4*ecx+8])
+	AS2(	sbb		esi,[edi+4*ecx+8])
+	AS2(	mov		[edx+4*ecx+8],esi)
+	AS2(	mov		esi,[eax+4*ecx+12])
+	AS2(	sbb		esi,[edi+4*ecx+12])
+	AS2(	mov		[edx+4*ecx+12],esi)
+
+	AS2(	lea		ecx,[ecx+4])		// advance index, avoid inc which causes slowdown on Intel Core 2
+	ASJ(	jmp,	0, b)
+
+	ASL(2)
+	AS2(	mov		eax, 0)
+	AS1(	setc	al)					// store carry into eax (return result register)
+
+	AddEpilogue
+
+	// http://github.com/weidai11/cryptopp/issues/340
+	CRYPTOPP_UNUSED(A); CRYPTOPP_UNUSED(B);
+	CRYPTOPP_UNUSED(C); CRYPTOPP_UNUSED(N);
+}
+
+#if CRYPTOPP_INTEGER_SSE2
+CRYPTOPP_NAKED int CRYPTOPP_FASTCALL SSE2_Add(size_t N, word *C, const word *A, const word *B)
+{
+	AddPrologue
+
+	// now: eax = A, edi = B, edx = C, ecx = N
+	AS2(	lea		eax, [eax+4*ecx])
+	AS2(	lea		edi, [edi+4*ecx])
+	AS2(	lea		edx, [edx+4*ecx])
+
+	AS1(	neg		ecx)				// ecx is negative index
+	AS2(	pxor    mm2, mm2)
+	ASJ(	jz,		2, f)
+	AS2(	test	ecx, 2)				// this clears carry flag
+	ASJ(	jz,		0, f)
+	AS2(	sub		ecx, 2)
+	ASJ(	jmp,	1, f)
+
+	ASL(0)
+	AS2(	movd     mm0, DWORD PTR [eax+4*ecx])
+	AS2(	movd     mm1, DWORD PTR [edi+4*ecx])
+	AS2(	paddq    mm0, mm1)
+	AS2(	paddq	 mm2, mm0)
+	AS2(	movd	 DWORD PTR [edx+4*ecx], mm2)
+	AS2(	psrlq    mm2, 32)
+
+	AS2(	movd     mm0, DWORD PTR [eax+4*ecx+4])
+	AS2(	movd     mm1, DWORD PTR [edi+4*ecx+4])
+	AS2(	paddq    mm0, mm1)
+	AS2(	paddq	 mm2, mm0)
+	AS2(	movd	 DWORD PTR [edx+4*ecx+4], mm2)
+	AS2(	psrlq    mm2, 32)
+
+	ASL(1)
+	AS2(	movd     mm0, DWORD PTR [eax+4*ecx+8])
+	AS2(	movd     mm1, DWORD PTR [edi+4*ecx+8])
+	AS2(	paddq    mm0, mm1)
+	AS2(	paddq	 mm2, mm0)
+	AS2(	movd	 DWORD PTR [edx+4*ecx+8], mm2)
+	AS2(	psrlq    mm2, 32)
+
+	AS2(	movd     mm0, DWORD PTR [eax+4*ecx+12])
+	AS2(	movd     mm1, DWORD PTR [edi+4*ecx+12])
+	AS2(	paddq    mm0, mm1)
+	AS2(	paddq	 mm2, mm0)
+	AS2(	movd	 DWORD PTR [edx+4*ecx+12], mm2)
+	AS2(	psrlq    mm2, 32)
+
+	AS2(	add		ecx, 4)
+	ASJ(	jnz,	0, b)
+
+	ASL(2)
+	AS2(	movd	eax, mm2)
+	AS1(	emms)
+
+	AddEpilogue
+
+	// http://github.com/weidai11/cryptopp/issues/340
+	CRYPTOPP_UNUSED(A); CRYPTOPP_UNUSED(B);
+	CRYPTOPP_UNUSED(C); CRYPTOPP_UNUSED(N);
+}
+CRYPTOPP_NAKED int CRYPTOPP_FASTCALL SSE2_Sub(size_t N, word *C, const word *A, const word *B)
+{
+	AddPrologue
+
+	// now: eax = A, edi = B, edx = C, ecx = N
+	AS2(	lea		eax, [eax+4*ecx])
+	AS2(	lea		edi, [edi+4*ecx])
+	AS2(	lea		edx, [edx+4*ecx])
+
+	AS1(	neg		ecx)				// ecx is negative index
+	AS2(	pxor    mm2, mm2)
+	ASJ(	jz,		2, f)
+	AS2(	test	ecx, 2)				// this clears carry flag
+	ASJ(	jz,		0, f)
+	AS2(	sub		ecx, 2)
+	ASJ(	jmp,	1, f)
+
+	ASL(0)
+	AS2(	movd     mm0, DWORD PTR [eax+4*ecx])
+	AS2(	movd     mm1, DWORD PTR [edi+4*ecx])
+	AS2(	psubq    mm0, mm1)
+	AS2(	psubq	 mm0, mm2)
+	AS2(	movd	 DWORD PTR [edx+4*ecx], mm0)
+	AS2(	psrlq    mm0, 63)
+
+	AS2(	movd     mm2, DWORD PTR [eax+4*ecx+4])
+	AS2(	movd     mm1, DWORD PTR [edi+4*ecx+4])
+	AS2(	psubq    mm2, mm1)
+	AS2(	psubq	 mm2, mm0)
+	AS2(	movd	 DWORD PTR [edx+4*ecx+4], mm2)
+	AS2(	psrlq    mm2, 63)
+
+	ASL(1)
+	AS2(	movd     mm0, DWORD PTR [eax+4*ecx+8])
+	AS2(	movd     mm1, DWORD PTR [edi+4*ecx+8])
+	AS2(	psubq    mm0, mm1)
+	AS2(	psubq	 mm0, mm2)
+	AS2(	movd	 DWORD PTR [edx+4*ecx+8], mm0)
+	AS2(	psrlq    mm0, 63)
+
+	AS2(	movd     mm2, DWORD PTR [eax+4*ecx+12])
+	AS2(	movd     mm1, DWORD PTR [edi+4*ecx+12])
+	AS2(	psubq    mm2, mm1)
+	AS2(	psubq	 mm2, mm0)
+	AS2(	movd	 DWORD PTR [edx+4*ecx+12], mm2)
+	AS2(	psrlq    mm2, 63)
+
+	AS2(	add		ecx, 4)
+	ASJ(	jnz,	0, b)
+
+	ASL(2)
+	AS2(	movd	eax, mm2)
+	AS1(	emms)
+
+	AddEpilogue
+
+	// http://github.com/weidai11/cryptopp/issues/340
+	CRYPTOPP_UNUSED(A); CRYPTOPP_UNUSED(B);
+	CRYPTOPP_UNUSED(C); CRYPTOPP_UNUSED(N);
+}
+#endif	// CRYPTOPP_INTEGER_SSE2
+#else   // CRYPTOPP_SSE2_ASM_AVAILABLE
+int CRYPTOPP_FASTCALL Baseline_Add(size_t N, word *C, const word *A, const word *B)
+{
+	CRYPTOPP_ASSERT (N%2 == 0);
+
+	Declare2Words(u);
+	AssignWord(u, 0);
+	for (size_t i=0; i<N; i+=2)
+	{
+		AddWithCarry(u, A[i], B[i]);
+		C[i] = LowWord(u);
+		AddWithCarry(u, A[i+1], B[i+1]);
+		C[i+1] = LowWord(u);
+	}
+	return int(GetCarry(u));
+}
+
+int CRYPTOPP_FASTCALL Baseline_Sub(size_t N, word *C, const word *A, const word *B)
+{
+	CRYPTOPP_ASSERT (N%2 == 0);
+
+	Declare2Words(u);
+	AssignWord(u, 0);
+	for (size_t i=0; i<N; i+=2)
+	{
+		SubtractWithBorrow(u, A[i], B[i]);
+		C[i] = LowWord(u);
+		SubtractWithBorrow(u, A[i+1], B[i+1]);
+		C[i+1] = LowWord(u);
+	}
+	return int(GetBorrow(u));
+}
+#endif
+
+static word LinearMultiply(word *C, const word *AA, word B, size_t N)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+
+	word carry=0;
+	for(unsigned i=0; i<N; i++)
+	{
+		Declare2Words(p);
+		MultiplyWords(p, A[i], B);
+		Acc2WordsBy1(p, carry);
+		C[i] = LowWord(p);
+		carry = HighWord(p);
+	}
+	return carry;
+}
+
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+
+#define Mul_2 \
+	Mul_Begin(2) \
+	Mul_SaveAcc(0, 0, 1) Mul_Acc(1, 0) \
+	Mul_End(1, 1)
+
+#define Mul_4 \
+	Mul_Begin(4) \
+	Mul_SaveAcc(0, 0, 1) Mul_Acc(1, 0) \
+	Mul_SaveAcc(1, 0, 2) Mul_Acc(1, 1) Mul_Acc(2, 0)  \
+	Mul_SaveAcc(2, 0, 3) Mul_Acc(1, 2) Mul_Acc(2, 1) Mul_Acc(3, 0)  \
+	Mul_SaveAcc(3, 1, 3) Mul_Acc(2, 2) Mul_Acc(3, 1)  \
+	Mul_SaveAcc(4, 2, 3) Mul_Acc(3, 2) \
+	Mul_End(5, 3)
+
+#define Mul_8 \
+	Mul_Begin(8) \
+	Mul_SaveAcc(0, 0, 1) Mul_Acc(1, 0) \
+	Mul_SaveAcc(1, 0, 2) Mul_Acc(1, 1) Mul_Acc(2, 0)  \
+	Mul_SaveAcc(2, 0, 3) Mul_Acc(1, 2) Mul_Acc(2, 1) Mul_Acc(3, 0)  \
+	Mul_SaveAcc(3, 0, 4) Mul_Acc(1, 3) Mul_Acc(2, 2) Mul_Acc(3, 1) Mul_Acc(4, 0) \
+	Mul_SaveAcc(4, 0, 5) Mul_Acc(1, 4) Mul_Acc(2, 3) Mul_Acc(3, 2) Mul_Acc(4, 1) Mul_Acc(5, 0) \
+	Mul_SaveAcc(5, 0, 6) Mul_Acc(1, 5) Mul_Acc(2, 4) Mul_Acc(3, 3) Mul_Acc(4, 2) Mul_Acc(5, 1) Mul_Acc(6, 0) \
+	Mul_SaveAcc(6, 0, 7) Mul_Acc(1, 6) Mul_Acc(2, 5) Mul_Acc(3, 4) Mul_Acc(4, 3) Mul_Acc(5, 2) Mul_Acc(6, 1) Mul_Acc(7, 0) \
+	Mul_SaveAcc(7, 1, 7) Mul_Acc(2, 6) Mul_Acc(3, 5) Mul_Acc(4, 4) Mul_Acc(5, 3) Mul_Acc(6, 2) Mul_Acc(7, 1) \
+	Mul_SaveAcc(8, 2, 7) Mul_Acc(3, 6) Mul_Acc(4, 5) Mul_Acc(5, 4) Mul_Acc(6, 3) Mul_Acc(7, 2) \
+	Mul_SaveAcc(9, 3, 7) Mul_Acc(4, 6) Mul_Acc(5, 5) Mul_Acc(6, 4) Mul_Acc(7, 3) \
+	Mul_SaveAcc(10, 4, 7) Mul_Acc(5, 6) Mul_Acc(6, 5) Mul_Acc(7, 4) \
+	Mul_SaveAcc(11, 5, 7) Mul_Acc(6, 6) Mul_Acc(7, 5) \
+	Mul_SaveAcc(12, 6, 7) Mul_Acc(7, 6) \
+	Mul_End(13, 7)
+
+#define Mul_16 \
+	Mul_Begin(16) \
+	Mul_SaveAcc(0, 0, 1) Mul_Acc(1, 0) \
+	Mul_SaveAcc(1, 0, 2) Mul_Acc(1, 1) Mul_Acc(2, 0) \
+	Mul_SaveAcc(2, 0, 3) Mul_Acc(1, 2) Mul_Acc(2, 1) Mul_Acc(3, 0) \
+	Mul_SaveAcc(3, 0, 4) Mul_Acc(1, 3) Mul_Acc(2, 2) Mul_Acc(3, 1) Mul_Acc(4, 0) \
+	Mul_SaveAcc(4, 0, 5) Mul_Acc(1, 4) Mul_Acc(2, 3) Mul_Acc(3, 2) Mul_Acc(4, 1) Mul_Acc(5, 0) \
+	Mul_SaveAcc(5, 0, 6) Mul_Acc(1, 5) Mul_Acc(2, 4) Mul_Acc(3, 3) Mul_Acc(4, 2) Mul_Acc(5, 1) Mul_Acc(6, 0) \
+	Mul_SaveAcc(6, 0, 7) Mul_Acc(1, 6) Mul_Acc(2, 5) Mul_Acc(3, 4) Mul_Acc(4, 3) Mul_Acc(5, 2) Mul_Acc(6, 1) Mul_Acc(7, 0) \
+	Mul_SaveAcc(7, 0, 8) Mul_Acc(1, 7) Mul_Acc(2, 6) Mul_Acc(3, 5) Mul_Acc(4, 4) Mul_Acc(5, 3) Mul_Acc(6, 2) Mul_Acc(7, 1) Mul_Acc(8, 0) \
+	Mul_SaveAcc(8, 0, 9) Mul_Acc(1, 8) Mul_Acc(2, 7) Mul_Acc(3, 6) Mul_Acc(4, 5) Mul_Acc(5, 4) Mul_Acc(6, 3) Mul_Acc(7, 2) Mul_Acc(8, 1) Mul_Acc(9, 0) \
+	Mul_SaveAcc(9, 0, 10) Mul_Acc(1, 9) Mul_Acc(2, 8) Mul_Acc(3, 7) Mul_Acc(4, 6) Mul_Acc(5, 5) Mul_Acc(6, 4) Mul_Acc(7, 3) Mul_Acc(8, 2) Mul_Acc(9, 1) Mul_Acc(10, 0) \
+	Mul_SaveAcc(10, 0, 11) Mul_Acc(1, 10) Mul_Acc(2, 9) Mul_Acc(3, 8) Mul_Acc(4, 7) Mul_Acc(5, 6) Mul_Acc(6, 5) Mul_Acc(7, 4) Mul_Acc(8, 3) Mul_Acc(9, 2) Mul_Acc(10, 1) Mul_Acc(11, 0) \
+	Mul_SaveAcc(11, 0, 12) Mul_Acc(1, 11) Mul_Acc(2, 10) Mul_Acc(3, 9) Mul_Acc(4, 8) Mul_Acc(5, 7) Mul_Acc(6, 6) Mul_Acc(7, 5) Mul_Acc(8, 4) Mul_Acc(9, 3) Mul_Acc(10, 2) Mul_Acc(11, 1) Mul_Acc(12, 0) \
+	Mul_SaveAcc(12, 0, 13) Mul_Acc(1, 12) Mul_Acc(2, 11) Mul_Acc(3, 10) Mul_Acc(4, 9) Mul_Acc(5, 8) Mul_Acc(6, 7) Mul_Acc(7, 6) Mul_Acc(8, 5) Mul_Acc(9, 4) Mul_Acc(10, 3) Mul_Acc(11, 2) Mul_Acc(12, 1) Mul_Acc(13, 0) \
+	Mul_SaveAcc(13, 0, 14) Mul_Acc(1, 13) Mul_Acc(2, 12) Mul_Acc(3, 11) Mul_Acc(4, 10) Mul_Acc(5, 9) Mul_Acc(6, 8) Mul_Acc(7, 7) Mul_Acc(8, 6) Mul_Acc(9, 5) Mul_Acc(10, 4) Mul_Acc(11, 3) Mul_Acc(12, 2) Mul_Acc(13, 1) Mul_Acc(14, 0) \
+	Mul_SaveAcc(14, 0, 15) Mul_Acc(1, 14) Mul_Acc(2, 13) Mul_Acc(3, 12) Mul_Acc(4, 11) Mul_Acc(5, 10) Mul_Acc(6, 9) Mul_Acc(7, 8) Mul_Acc(8, 7) Mul_Acc(9, 6) Mul_Acc(10, 5) Mul_Acc(11, 4) Mul_Acc(12, 3) Mul_Acc(13, 2) Mul_Acc(14, 1) Mul_Acc(15, 0) \
+	Mul_SaveAcc(15, 1, 15) Mul_Acc(2, 14) Mul_Acc(3, 13) Mul_Acc(4, 12) Mul_Acc(5, 11) Mul_Acc(6, 10) Mul_Acc(7, 9) Mul_Acc(8, 8) Mul_Acc(9, 7) Mul_Acc(10, 6) Mul_Acc(11, 5) Mul_Acc(12, 4) Mul_Acc(13, 3) Mul_Acc(14, 2) Mul_Acc(15, 1) \
+	Mul_SaveAcc(16, 2, 15) Mul_Acc(3, 14) Mul_Acc(4, 13) Mul_Acc(5, 12) Mul_Acc(6, 11) Mul_Acc(7, 10) Mul_Acc(8, 9) Mul_Acc(9, 8) Mul_Acc(10, 7) Mul_Acc(11, 6) Mul_Acc(12, 5) Mul_Acc(13, 4) Mul_Acc(14, 3) Mul_Acc(15, 2) \
+	Mul_SaveAcc(17, 3, 15) Mul_Acc(4, 14) Mul_Acc(5, 13) Mul_Acc(6, 12) Mul_Acc(7, 11) Mul_Acc(8, 10) Mul_Acc(9, 9) Mul_Acc(10, 8) Mul_Acc(11, 7) Mul_Acc(12, 6) Mul_Acc(13, 5) Mul_Acc(14, 4) Mul_Acc(15, 3) \
+	Mul_SaveAcc(18, 4, 15) Mul_Acc(5, 14) Mul_Acc(6, 13) Mul_Acc(7, 12) Mul_Acc(8, 11) Mul_Acc(9, 10) Mul_Acc(10, 9) Mul_Acc(11, 8) Mul_Acc(12, 7) Mul_Acc(13, 6) Mul_Acc(14, 5) Mul_Acc(15, 4) \
+	Mul_SaveAcc(19, 5, 15) Mul_Acc(6, 14) Mul_Acc(7, 13) Mul_Acc(8, 12) Mul_Acc(9, 11) Mul_Acc(10, 10) Mul_Acc(11, 9) Mul_Acc(12, 8) Mul_Acc(13, 7) Mul_Acc(14, 6) Mul_Acc(15, 5) \
+	Mul_SaveAcc(20, 6, 15) Mul_Acc(7, 14) Mul_Acc(8, 13) Mul_Acc(9, 12) Mul_Acc(10, 11) Mul_Acc(11, 10) Mul_Acc(12, 9) Mul_Acc(13, 8) Mul_Acc(14, 7) Mul_Acc(15, 6) \
+	Mul_SaveAcc(21, 7, 15) Mul_Acc(8, 14) Mul_Acc(9, 13) Mul_Acc(10, 12) Mul_Acc(11, 11) Mul_Acc(12, 10) Mul_Acc(13, 9) Mul_Acc(14, 8) Mul_Acc(15, 7) \
+	Mul_SaveAcc(22, 8, 15) Mul_Acc(9, 14) Mul_Acc(10, 13) Mul_Acc(11, 12) Mul_Acc(12, 11) Mul_Acc(13, 10) Mul_Acc(14, 9) Mul_Acc(15, 8) \
+	Mul_SaveAcc(23, 9, 15) Mul_Acc(10, 14) Mul_Acc(11, 13) Mul_Acc(12, 12) Mul_Acc(13, 11) Mul_Acc(14, 10) Mul_Acc(15, 9) \
+	Mul_SaveAcc(24, 10, 15) Mul_Acc(11, 14) Mul_Acc(12, 13) Mul_Acc(13, 12) Mul_Acc(14, 11) Mul_Acc(15, 10) \
+	Mul_SaveAcc(25, 11, 15) Mul_Acc(12, 14) Mul_Acc(13, 13) Mul_Acc(14, 12) Mul_Acc(15, 11) \
+	Mul_SaveAcc(26, 12, 15) Mul_Acc(13, 14) Mul_Acc(14, 13) Mul_Acc(15, 12) \
+	Mul_SaveAcc(27, 13, 15) Mul_Acc(14, 14) Mul_Acc(15, 13) \
+	Mul_SaveAcc(28, 14, 15) Mul_Acc(15, 14) \
+	Mul_End(29, 15)
+
+#define Squ_2 \
+	Squ_Begin(2) \
+	Squ_End(2)
+
+#define Squ_4 \
+	Squ_Begin(4) \
+	Squ_SaveAcc(1, 0, 2) Squ_Diag(1) \
+	Squ_SaveAcc(2, 0, 3) Squ_Acc(1, 2) Squ_NonDiag \
+	Squ_SaveAcc(3, 1, 3) Squ_Diag(2) \
+	Squ_SaveAcc(4, 2, 3) Squ_NonDiag \
+	Squ_End(4)
+
+#define Squ_8 \
+	Squ_Begin(8) \
+	Squ_SaveAcc(1, 0, 2) Squ_Diag(1) \
+	Squ_SaveAcc(2, 0, 3) Squ_Acc(1, 2) Squ_NonDiag \
+	Squ_SaveAcc(3, 0, 4) Squ_Acc(1, 3) Squ_Diag(2) \
+	Squ_SaveAcc(4, 0, 5) Squ_Acc(1, 4) Squ_Acc(2, 3) Squ_NonDiag \
+	Squ_SaveAcc(5, 0, 6) Squ_Acc(1, 5) Squ_Acc(2, 4) Squ_Diag(3) \
+	Squ_SaveAcc(6, 0, 7) Squ_Acc(1, 6) Squ_Acc(2, 5) Squ_Acc(3, 4) Squ_NonDiag \
+	Squ_SaveAcc(7, 1, 7) Squ_Acc(2, 6) Squ_Acc(3, 5) Squ_Diag(4) \
+	Squ_SaveAcc(8, 2, 7) Squ_Acc(3, 6) Squ_Acc(4, 5)  Squ_NonDiag \
+	Squ_SaveAcc(9, 3, 7) Squ_Acc(4, 6) Squ_Diag(5) \
+	Squ_SaveAcc(10, 4, 7) Squ_Acc(5, 6) Squ_NonDiag \
+	Squ_SaveAcc(11, 5, 7) Squ_Diag(6) \
+	Squ_SaveAcc(12, 6, 7) Squ_NonDiag \
+	Squ_End(8)
+
+#define Squ_16 \
+	Squ_Begin(16) \
+	Squ_SaveAcc(1, 0, 2) Squ_Diag(1) \
+	Squ_SaveAcc(2, 0, 3) Squ_Acc(1, 2) Squ_NonDiag \
+	Squ_SaveAcc(3, 0, 4) Squ_Acc(1, 3) Squ_Diag(2) \
+	Squ_SaveAcc(4, 0, 5) Squ_Acc(1, 4) Squ_Acc(2, 3) Squ_NonDiag \
+	Squ_SaveAcc(5, 0, 6) Squ_Acc(1, 5) Squ_Acc(2, 4) Squ_Diag(3) \
+	Squ_SaveAcc(6, 0, 7) Squ_Acc(1, 6) Squ_Acc(2, 5) Squ_Acc(3, 4) Squ_NonDiag \
+	Squ_SaveAcc(7, 0, 8) Squ_Acc(1, 7) Squ_Acc(2, 6) Squ_Acc(3, 5) Squ_Diag(4) \
+	Squ_SaveAcc(8, 0, 9) Squ_Acc(1, 8) Squ_Acc(2, 7) Squ_Acc(3, 6) Squ_Acc(4, 5) Squ_NonDiag \
+	Squ_SaveAcc(9, 0, 10) Squ_Acc(1, 9) Squ_Acc(2, 8) Squ_Acc(3, 7) Squ_Acc(4, 6) Squ_Diag(5) \
+	Squ_SaveAcc(10, 0, 11) Squ_Acc(1, 10) Squ_Acc(2, 9) Squ_Acc(3, 8) Squ_Acc(4, 7) Squ_Acc(5, 6) Squ_NonDiag \
+	Squ_SaveAcc(11, 0, 12) Squ_Acc(1, 11) Squ_Acc(2, 10) Squ_Acc(3, 9) Squ_Acc(4, 8) Squ_Acc(5, 7) Squ_Diag(6) \
+	Squ_SaveAcc(12, 0, 13) Squ_Acc(1, 12) Squ_Acc(2, 11) Squ_Acc(3, 10) Squ_Acc(4, 9) Squ_Acc(5, 8) Squ_Acc(6, 7) Squ_NonDiag \
+	Squ_SaveAcc(13, 0, 14) Squ_Acc(1, 13) Squ_Acc(2, 12) Squ_Acc(3, 11) Squ_Acc(4, 10) Squ_Acc(5, 9) Squ_Acc(6, 8) Squ_Diag(7) \
+	Squ_SaveAcc(14, 0, 15) Squ_Acc(1, 14) Squ_Acc(2, 13) Squ_Acc(3, 12) Squ_Acc(4, 11) Squ_Acc(5, 10) Squ_Acc(6, 9) Squ_Acc(7, 8) Squ_NonDiag \
+	Squ_SaveAcc(15, 1, 15) Squ_Acc(2, 14) Squ_Acc(3, 13) Squ_Acc(4, 12) Squ_Acc(5, 11) Squ_Acc(6, 10) Squ_Acc(7, 9) Squ_Diag(8) \
+	Squ_SaveAcc(16, 2, 15) Squ_Acc(3, 14) Squ_Acc(4, 13) Squ_Acc(5, 12) Squ_Acc(6, 11) Squ_Acc(7, 10) Squ_Acc(8, 9) Squ_NonDiag \
+	Squ_SaveAcc(17, 3, 15) Squ_Acc(4, 14) Squ_Acc(5, 13) Squ_Acc(6, 12) Squ_Acc(7, 11) Squ_Acc(8, 10) Squ_Diag(9) \
+	Squ_SaveAcc(18, 4, 15) Squ_Acc(5, 14) Squ_Acc(6, 13) Squ_Acc(7, 12) Squ_Acc(8, 11) Squ_Acc(9, 10) Squ_NonDiag \
+	Squ_SaveAcc(19, 5, 15) Squ_Acc(6, 14) Squ_Acc(7, 13) Squ_Acc(8, 12) Squ_Acc(9, 11) Squ_Diag(10) \
+	Squ_SaveAcc(20, 6, 15) Squ_Acc(7, 14) Squ_Acc(8, 13) Squ_Acc(9, 12) Squ_Acc(10, 11) Squ_NonDiag \
+	Squ_SaveAcc(21, 7, 15) Squ_Acc(8, 14) Squ_Acc(9, 13) Squ_Acc(10, 12) Squ_Diag(11) \
+	Squ_SaveAcc(22, 8, 15) Squ_Acc(9, 14) Squ_Acc(10, 13) Squ_Acc(11, 12) Squ_NonDiag \
+	Squ_SaveAcc(23, 9, 15) Squ_Acc(10, 14) Squ_Acc(11, 13) Squ_Diag(12) \
+	Squ_SaveAcc(24, 10, 15) Squ_Acc(11, 14) Squ_Acc(12, 13) Squ_NonDiag \
+	Squ_SaveAcc(25, 11, 15) Squ_Acc(12, 14) Squ_Diag(13) \
+	Squ_SaveAcc(26, 12, 15) Squ_Acc(13, 14) Squ_NonDiag \
+	Squ_SaveAcc(27, 13, 15) Squ_Diag(14) \
+	Squ_SaveAcc(28, 14, 15) Squ_NonDiag \
+	Squ_End(16)
+
+#define Bot_2 \
+	Mul_Begin(2) \
+	Bot_SaveAcc(0, 0, 1) Bot_Acc(1, 0) \
+	Bot_End(2)
+
+#define Bot_4 \
+	Mul_Begin(4) \
+	Mul_SaveAcc(0, 0, 1) Mul_Acc(1, 0) \
+	Mul_SaveAcc(1, 2, 0) Mul_Acc(1, 1) Mul_Acc(0, 2)  \
+	Bot_SaveAcc(2, 0, 3) Bot_Acc(1, 2) Bot_Acc(2, 1) Bot_Acc(3, 0)  \
+	Bot_End(4)
+
+#define Bot_8 \
+	Mul_Begin(8) \
+	Mul_SaveAcc(0, 0, 1) Mul_Acc(1, 0) \
+	Mul_SaveAcc(1, 0, 2) Mul_Acc(1, 1) Mul_Acc(2, 0)  \
+	Mul_SaveAcc(2, 0, 3) Mul_Acc(1, 2) Mul_Acc(2, 1) Mul_Acc(3, 0)  \
+	Mul_SaveAcc(3, 0, 4) Mul_Acc(1, 3) Mul_Acc(2, 2) Mul_Acc(3, 1) Mul_Acc(4, 0) \
+	Mul_SaveAcc(4, 0, 5) Mul_Acc(1, 4) Mul_Acc(2, 3) Mul_Acc(3, 2) Mul_Acc(4, 1) Mul_Acc(5, 0) \
+	Mul_SaveAcc(5, 0, 6) Mul_Acc(1, 5) Mul_Acc(2, 4) Mul_Acc(3, 3) Mul_Acc(4, 2) Mul_Acc(5, 1) Mul_Acc(6, 0) \
+	Bot_SaveAcc(6, 0, 7) Bot_Acc(1, 6) Bot_Acc(2, 5) Bot_Acc(3, 4) Bot_Acc(4, 3) Bot_Acc(5, 2) Bot_Acc(6, 1) Bot_Acc(7, 0) \
+	Bot_End(8)
+
+#define Bot_16 \
+	Mul_Begin(16) \
+	Mul_SaveAcc(0, 0, 1) Mul_Acc(1, 0) \
+	Mul_SaveAcc(1, 0, 2) Mul_Acc(1, 1) Mul_Acc(2, 0) \
+	Mul_SaveAcc(2, 0, 3) Mul_Acc(1, 2) Mul_Acc(2, 1) Mul_Acc(3, 0) \
+	Mul_SaveAcc(3, 0, 4) Mul_Acc(1, 3) Mul_Acc(2, 2) Mul_Acc(3, 1) Mul_Acc(4, 0) \
+	Mul_SaveAcc(4, 0, 5) Mul_Acc(1, 4) Mul_Acc(2, 3) Mul_Acc(3, 2) Mul_Acc(4, 1) Mul_Acc(5, 0) \
+	Mul_SaveAcc(5, 0, 6) Mul_Acc(1, 5) Mul_Acc(2, 4) Mul_Acc(3, 3) Mul_Acc(4, 2) Mul_Acc(5, 1) Mul_Acc(6, 0) \
+	Mul_SaveAcc(6, 0, 7) Mul_Acc(1, 6) Mul_Acc(2, 5) Mul_Acc(3, 4) Mul_Acc(4, 3) Mul_Acc(5, 2) Mul_Acc(6, 1) Mul_Acc(7, 0) \
+	Mul_SaveAcc(7, 0, 8) Mul_Acc(1, 7) Mul_Acc(2, 6) Mul_Acc(3, 5) Mul_Acc(4, 4) Mul_Acc(5, 3) Mul_Acc(6, 2) Mul_Acc(7, 1) Mul_Acc(8, 0) \
+	Mul_SaveAcc(8, 0, 9) Mul_Acc(1, 8) Mul_Acc(2, 7) Mul_Acc(3, 6) Mul_Acc(4, 5) Mul_Acc(5, 4) Mul_Acc(6, 3) Mul_Acc(7, 2) Mul_Acc(8, 1) Mul_Acc(9, 0) \
+	Mul_SaveAcc(9, 0, 10) Mul_Acc(1, 9) Mul_Acc(2, 8) Mul_Acc(3, 7) Mul_Acc(4, 6) Mul_Acc(5, 5) Mul_Acc(6, 4) Mul_Acc(7, 3) Mul_Acc(8, 2) Mul_Acc(9, 1) Mul_Acc(10, 0) \
+	Mul_SaveAcc(10, 0, 11) Mul_Acc(1, 10) Mul_Acc(2, 9) Mul_Acc(3, 8) Mul_Acc(4, 7) Mul_Acc(5, 6) Mul_Acc(6, 5) Mul_Acc(7, 4) Mul_Acc(8, 3) Mul_Acc(9, 2) Mul_Acc(10, 1) Mul_Acc(11, 0) \
+	Mul_SaveAcc(11, 0, 12) Mul_Acc(1, 11) Mul_Acc(2, 10) Mul_Acc(3, 9) Mul_Acc(4, 8) Mul_Acc(5, 7) Mul_Acc(6, 6) Mul_Acc(7, 5) Mul_Acc(8, 4) Mul_Acc(9, 3) Mul_Acc(10, 2) Mul_Acc(11, 1) Mul_Acc(12, 0) \
+	Mul_SaveAcc(12, 0, 13) Mul_Acc(1, 12) Mul_Acc(2, 11) Mul_Acc(3, 10) Mul_Acc(4, 9) Mul_Acc(5, 8) Mul_Acc(6, 7) Mul_Acc(7, 6) Mul_Acc(8, 5) Mul_Acc(9, 4) Mul_Acc(10, 3) Mul_Acc(11, 2) Mul_Acc(12, 1) Mul_Acc(13, 0) \
+	Mul_SaveAcc(13, 0, 14) Mul_Acc(1, 13) Mul_Acc(2, 12) Mul_Acc(3, 11) Mul_Acc(4, 10) Mul_Acc(5, 9) Mul_Acc(6, 8) Mul_Acc(7, 7) Mul_Acc(8, 6) Mul_Acc(9, 5) Mul_Acc(10, 4) Mul_Acc(11, 3) Mul_Acc(12, 2) Mul_Acc(13, 1) Mul_Acc(14, 0) \
+	Bot_SaveAcc(14, 0, 15) Bot_Acc(1, 14) Bot_Acc(2, 13) Bot_Acc(3, 12) Bot_Acc(4, 11) Bot_Acc(5, 10) Bot_Acc(6, 9) Bot_Acc(7, 8) Bot_Acc(8, 7) Bot_Acc(9, 6) Bot_Acc(10, 5) Bot_Acc(11, 4) Bot_Acc(12, 3) Bot_Acc(13, 2) Bot_Acc(14, 1) Bot_Acc(15, 0) \
+	Bot_End(16)
+
+#endif
+
+#if 0
+#define Mul_Begin(n)				\
+	Declare2Words(p)				\
+	Declare2Words(c)				\
+	Declare2Words(d)				\
+	MultiplyWords(p, A[0], B[0])	\
+	AssignWord(c, LowWord(p))		\
+	AssignWord(d, HighWord(p))
+
+#define Mul_Acc(i, j)				\
+	MultiplyWords(p, A[i], B[j])	\
+	Acc2WordsBy1(c, LowWord(p))		\
+	Acc2WordsBy1(d, HighWord(p))
+
+#define Mul_SaveAcc(k, i, j) 		\
+	R[k] = LowWord(c);				\
+	Add2WordsBy1(c, d, HighWord(c))	\
+	MultiplyWords(p, A[i], B[j])	\
+	AssignWord(d, HighWord(p))		\
+	Acc2WordsBy1(c, LowWord(p))
+
+#define Mul_End(n)					\
+	R[2*n-3] = LowWord(c);			\
+	Acc2WordsBy1(d, HighWord(c))	\
+	MultiplyWords(p, A[n-1], B[n-1])\
+	Acc2WordsBy2(d, p)				\
+	R[2*n-2] = LowWord(d);			\
+	R[2*n-1] = HighWord(d);
+
+#define Bot_SaveAcc(k, i, j)		\
+	R[k] = LowWord(c);				\
+	word e = LowWord(d) + HighWord(c);	\
+	e += A[i] * B[j];
+
+#define Bot_Acc(i, j)	\
+	e += A[i] * B[j];
+
+#define Bot_End(n)		\
+	R[n-1] = e;
+#else
+#define Mul_Begin(n)				\
+	Declare2Words(p)				\
+	word c;	\
+	Declare2Words(d)				\
+	MultiplyWords(p, A[0], B[0])	\
+	c = LowWord(p);		\
+	AssignWord(d, HighWord(p))
+
+#define Mul_Acc(i, j)				\
+	MulAcc(c, d, A[i], B[j])
+
+#define Mul_SaveAcc(k, i, j) 		\
+	R[k] = c;				\
+	c = LowWord(d);	\
+	AssignWord(d, HighWord(d))	\
+	MulAcc(c, d, A[i], B[j])
+
+#define Mul_End(k, i)					\
+	R[k] = c;			\
+	MultiplyWords(p, A[i], B[i])	\
+	Acc2WordsBy2(p, d)				\
+	R[k+1] = LowWord(p);			\
+	R[k+2] = HighWord(p);
+
+#define Bot_SaveAcc(k, i, j)		\
+	R[k] = c;				\
+	c = LowWord(d);	\
+	c += A[i] * B[j];
+
+#define Bot_Acc(i, j)	\
+	c += A[i] * B[j];
+
+#define Bot_End(n)		\
+	R[n-1] = c;
+#endif
+
+#define Squ_Begin(n)				\
+	Declare2Words(p)				\
+	word c;				\
+	Declare2Words(d)				\
+	Declare2Words(e)				\
+	MultiplyWords(p, A[0], A[0])	\
+	R[0] = LowWord(p);				\
+	AssignWord(e, HighWord(p))		\
+	MultiplyWords(p, A[0], A[1])	\
+	c = LowWord(p);		\
+	AssignWord(d, HighWord(p))		\
+	Squ_NonDiag						\
+
+#define Squ_NonDiag				\
+	Double3Words(c, d)
+
+#define Squ_SaveAcc(k, i, j) 		\
+	Acc3WordsBy2(c, d, e)			\
+	R[k] = c;				\
+	MultiplyWords(p, A[i], A[j])	\
+	c = LowWord(p);		\
+	AssignWord(d, HighWord(p))		\
+
+#define Squ_Acc(i, j)				\
+	MulAcc(c, d, A[i], A[j])
+
+#define Squ_Diag(i)					\
+	Squ_NonDiag						\
+	MulAcc(c, d, A[i], A[i])
+
+#define Squ_End(n)					\
+	Acc3WordsBy2(c, d, e)			\
+	R[2*n-3] = c;			\
+	MultiplyWords(p, A[n-1], A[n-1])\
+	Acc2WordsBy2(p, e)				\
+	R[2*n-2] = LowWord(p);			\
+	R[2*n-1] = HighWord(p);
+
+
+void Baseline_Multiply2(word *R, const word *AA, const word *BB)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Mul_2
+}
+
+void Baseline_Multiply4(word *R, const word *AA, const word *BB)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Mul_4
+}
+
+void Baseline_Multiply8(word *R, const word *AA, const word *BB)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Mul_8
+}
+
+void Baseline_Square2(word *R, const word *AA)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+
+	Squ_2
+}
+
+void Baseline_Square4(word *R, const word *AA)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+
+	Squ_4
+}
+
+void Baseline_Square8(word *R, const word *AA)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+
+	Squ_8
+}
+
+void Baseline_MultiplyBottom2(word *R, const word *AA, const word *BB)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Bot_2
+
+// http://github.com/weidai11/cryptopp/issues/340
+#if defined(TWO_64_BIT_WORDS)
+	CRYPTOPP_UNUSED(d0); CRYPTOPP_UNUSED(d1);
+#endif
+}
+
+void Baseline_MultiplyBottom4(word *R, const word *AA, const word *BB)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Bot_4
+}
+
+void Baseline_MultiplyBottom8(word *R, const word *AA, const word *BB)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Bot_8
+}
+
+#define Top_Begin(n)				\
+	Declare2Words(p)				\
+	word c;	\
+	Declare2Words(d)				\
+	MultiplyWords(p, A[0], B[n-2]);\
+	AssignWord(d, HighWord(p));
+
+#define Top_Acc(i, j)	\
+	MultiplyWords(p, A[i], B[j]);\
+	Acc2WordsBy1(d, HighWord(p));
+
+#define Top_SaveAcc0(i, j) 		\
+	c = LowWord(d);	\
+	AssignWord(d, HighWord(d))	\
+	MulAcc(c, d, A[i], B[j])
+
+#define Top_SaveAcc1(i, j) 		\
+	c = L<c; \
+	Acc2WordsBy1(d, c);	\
+	c = LowWord(d);	\
+	AssignWord(d, HighWord(d))	\
+	MulAcc(c, d, A[i], B[j])
+
+void Baseline_MultiplyTop2(word *R, const word *A, const word *B, word L)
+{
+	CRYPTOPP_UNUSED(L);
+	word T[4];
+	Baseline_Multiply2(T, A, B);
+	R[0] = T[2];
+	R[1] = T[3];
+}
+
+void Baseline_MultiplyTop4(word *R, const word *AA, const word *BB, word L)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Top_Begin(4)
+	Top_Acc(1, 1) Top_Acc(2, 0)  \
+	Top_SaveAcc0(0, 3) Mul_Acc(1, 2) Mul_Acc(2, 1) Mul_Acc(3, 0)  \
+	Top_SaveAcc1(1, 3) Mul_Acc(2, 2) Mul_Acc(3, 1)  \
+	Mul_SaveAcc(0, 2, 3) Mul_Acc(3, 2) \
+	Mul_End(1, 3)
+}
+
+void Baseline_MultiplyTop8(word *R, const word *AA, const word *BB, word L)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Top_Begin(8)
+	Top_Acc(1, 5) Top_Acc(2, 4) Top_Acc(3, 3) Top_Acc(4, 2) Top_Acc(5, 1) Top_Acc(6, 0) \
+	Top_SaveAcc0(0, 7) Mul_Acc(1, 6) Mul_Acc(2, 5) Mul_Acc(3, 4) Mul_Acc(4, 3) Mul_Acc(5, 2) Mul_Acc(6, 1) Mul_Acc(7, 0) \
+	Top_SaveAcc1(1, 7) Mul_Acc(2, 6) Mul_Acc(3, 5) Mul_Acc(4, 4) Mul_Acc(5, 3) Mul_Acc(6, 2) Mul_Acc(7, 1) \
+	Mul_SaveAcc(0, 2, 7) Mul_Acc(3, 6) Mul_Acc(4, 5) Mul_Acc(5, 4) Mul_Acc(6, 3) Mul_Acc(7, 2) \
+	Mul_SaveAcc(1, 3, 7) Mul_Acc(4, 6) Mul_Acc(5, 5) Mul_Acc(6, 4) Mul_Acc(7, 3) \
+	Mul_SaveAcc(2, 4, 7) Mul_Acc(5, 6) Mul_Acc(6, 5) Mul_Acc(7, 4) \
+	Mul_SaveAcc(3, 5, 7) Mul_Acc(6, 6) Mul_Acc(7, 5) \
+	Mul_SaveAcc(4, 6, 7) Mul_Acc(7, 6) \
+	Mul_End(5, 7)
+}
+
+#if !CRYPTOPP_INTEGER_SSE2	// save memory by not compiling these functions when SSE2 is available
+void Baseline_Multiply16(word *R, const word *AA, const word *BB)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Mul_16
+}
+
+void Baseline_Square16(word *R, const word *AA)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+
+	Squ_16
+}
+
+void Baseline_MultiplyBottom16(word *R, const word *AA, const word *BB)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Bot_16
+}
+
+void Baseline_MultiplyTop16(word *R, const word *AA, const word *BB, word L)
+{
+	// http://github.com/weidai11/cryptopp/issues/188
+	MAYBE_CONST word* A = MAYBE_UNCONST_CAST(AA);
+	MAYBE_CONST word* B = MAYBE_UNCONST_CAST(BB);
+
+	Top_Begin(16)
+	Top_Acc(1, 13) Top_Acc(2, 12) Top_Acc(3, 11) Top_Acc(4, 10) Top_Acc(5, 9) Top_Acc(6, 8) Top_Acc(7, 7) Top_Acc(8, 6) Top_Acc(9, 5) Top_Acc(10, 4) Top_Acc(11, 3) Top_Acc(12, 2) Top_Acc(13, 1) Top_Acc(14, 0) \
+	Top_SaveAcc0(0, 15) Mul_Acc(1, 14) Mul_Acc(2, 13) Mul_Acc(3, 12) Mul_Acc(4, 11) Mul_Acc(5, 10) Mul_Acc(6, 9) Mul_Acc(7, 8) Mul_Acc(8, 7) Mul_Acc(9, 6) Mul_Acc(10, 5) Mul_Acc(11, 4) Mul_Acc(12, 3) Mul_Acc(13, 2) Mul_Acc(14, 1) Mul_Acc(15, 0) \
+	Top_SaveAcc1(1, 15) Mul_Acc(2, 14) Mul_Acc(3, 13) Mul_Acc(4, 12) Mul_Acc(5, 11) Mul_Acc(6, 10) Mul_Acc(7, 9) Mul_Acc(8, 8) Mul_Acc(9, 7) Mul_Acc(10, 6) Mul_Acc(11, 5) Mul_Acc(12, 4) Mul_Acc(13, 3) Mul_Acc(14, 2) Mul_Acc(15, 1) \
+	Mul_SaveAcc(0, 2, 15) Mul_Acc(3, 14) Mul_Acc(4, 13) Mul_Acc(5, 12) Mul_Acc(6, 11) Mul_Acc(7, 10) Mul_Acc(8, 9) Mul_Acc(9, 8) Mul_Acc(10, 7) Mul_Acc(11, 6) Mul_Acc(12, 5) Mul_Acc(13, 4) Mul_Acc(14, 3) Mul_Acc(15, 2) \
+	Mul_SaveAcc(1, 3, 15) Mul_Acc(4, 14) Mul_Acc(5, 13) Mul_Acc(6, 12) Mul_Acc(7, 11) Mul_Acc(8, 10) Mul_Acc(9, 9) Mul_Acc(10, 8) Mul_Acc(11, 7) Mul_Acc(12, 6) Mul_Acc(13, 5) Mul_Acc(14, 4) Mul_Acc(15, 3) \
+	Mul_SaveAcc(2, 4, 15) Mul_Acc(5, 14) Mul_Acc(6, 13) Mul_Acc(7, 12) Mul_Acc(8, 11) Mul_Acc(9, 10) Mul_Acc(10, 9) Mul_Acc(11, 8) Mul_Acc(12, 7) Mul_Acc(13, 6) Mul_Acc(14, 5) Mul_Acc(15, 4) \
+	Mul_SaveAcc(3, 5, 15) Mul_Acc(6, 14) Mul_Acc(7, 13) Mul_Acc(8, 12) Mul_Acc(9, 11) Mul_Acc(10, 10) Mul_Acc(11, 9) Mul_Acc(12, 8) Mul_Acc(13, 7) Mul_Acc(14, 6) Mul_Acc(15, 5) \
+	Mul_SaveAcc(4, 6, 15) Mul_Acc(7, 14) Mul_Acc(8, 13) Mul_Acc(9, 12) Mul_Acc(10, 11) Mul_Acc(11, 10) Mul_Acc(12, 9) Mul_Acc(13, 8) Mul_Acc(14, 7) Mul_Acc(15, 6) \
+	Mul_SaveAcc(5, 7, 15) Mul_Acc(8, 14) Mul_Acc(9, 13) Mul_Acc(10, 12) Mul_Acc(11, 11) Mul_Acc(12, 10) Mul_Acc(13, 9) Mul_Acc(14, 8) Mul_Acc(15, 7) \
+	Mul_SaveAcc(6, 8, 15) Mul_Acc(9, 14) Mul_Acc(10, 13) Mul_Acc(11, 12) Mul_Acc(12, 11) Mul_Acc(13, 10) Mul_Acc(14, 9) Mul_Acc(15, 8) \
+	Mul_SaveAcc(7, 9, 15) Mul_Acc(10, 14) Mul_Acc(11, 13) Mul_Acc(12, 12) Mul_Acc(13, 11) Mul_Acc(14, 10) Mul_Acc(15, 9) \
+	Mul_SaveAcc(8, 10, 15) Mul_Acc(11, 14) Mul_Acc(12, 13) Mul_Acc(13, 12) Mul_Acc(14, 11) Mul_Acc(15, 10) \
+	Mul_SaveAcc(9, 11, 15) Mul_Acc(12, 14) Mul_Acc(13, 13) Mul_Acc(14, 12) Mul_Acc(15, 11) \
+	Mul_SaveAcc(10, 12, 15) Mul_Acc(13, 14) Mul_Acc(14, 13) Mul_Acc(15, 12) \
+	Mul_SaveAcc(11, 13, 15) Mul_Acc(14, 14) Mul_Acc(15, 13) \
+	Mul_SaveAcc(12, 14, 15) Mul_Acc(15, 14) \
+	Mul_End(13, 15)
+}
+#endif
+
+// ********************************************************
+
+#if CRYPTOPP_INTEGER_SSE2
+
+CRYPTOPP_ALIGN_DATA(16)
+CRYPTOPP_TABLE
+const word32 s_maskLow16[4] = {
+	0xffff,0xffff,0xffff,0xffff
+};
+
+#undef Mul_Begin
+#undef Mul_Acc
+#undef Top_Begin
+#undef Top_Acc
+#undef Squ_Acc
+#undef Squ_NonDiag
+#undef Squ_Diag
+#undef Squ_SaveAcc
+#undef Squ_Begin
+#undef Mul_SaveAcc
+#undef Bot_Acc
+#undef Bot_SaveAcc
+#undef Bot_End
+#undef Squ_End
+#undef Mul_End
+
+#define SSE2_FinalSave(k)			\
+	AS2(	psllq		xmm5, 16)	\
+	AS2(	paddq		xmm4, xmm5)	\
+	AS2(	movq		QWORD PTR [ecx+8*(k)], xmm4)
+
+#define SSE2_SaveShift(k)			\
+	AS2(	movq		xmm0, xmm6)	\
+	AS2(	punpckhqdq	xmm6, xmm0)	\
+	AS2(	movq		xmm1, xmm7)	\
+	AS2(	punpckhqdq	xmm7, xmm1)	\
+	AS2(	paddd		xmm6, xmm0)	\
+	AS2(	pslldq		xmm6, 4)	\
+	AS2(	paddd		xmm7, xmm1)	\
+	AS2(	paddd		xmm4, xmm6)	\
+	AS2(	pslldq		xmm7, 4)	\
+	AS2(	movq		xmm6, xmm4)	\
+	AS2(	paddd		xmm5, xmm7)	\
+	AS2(	movq		xmm7, xmm5)	\
+	AS2(	movd		DWORD PTR [ecx+8*(k)], xmm4)	\
+	AS2(	psrlq		xmm6, 16)	\
+	AS2(	paddq		xmm6, xmm7)	\
+	AS2(	punpckhqdq	xmm4, xmm0)	\
+	AS2(	punpckhqdq	xmm5, xmm0)	\
+	AS2(	movq		QWORD PTR [ecx+8*(k)+2], xmm6)	\
+	AS2(	psrlq		xmm6, 3*16)	\
+	AS2(	paddd		xmm4, xmm6)	\
+
+#define Squ_SSE2_SaveShift(k)			\
+	AS2(	movq		xmm0, xmm6)	\
+	AS2(	punpckhqdq	xmm6, xmm0)	\
+	AS2(	movq		xmm1, xmm7)	\
+	AS2(	punpckhqdq	xmm7, xmm1)	\
+	AS2(	paddd		xmm6, xmm0)	\
+	AS2(	pslldq		xmm6, 4)	\
+	AS2(	paddd		xmm7, xmm1)	\
+	AS2(	paddd		xmm4, xmm6)	\
+	AS2(	pslldq		xmm7, 4)	\
+	AS2(	movhlps		xmm6, xmm4)	\
+	AS2(	movd		DWORD PTR [ecx+8*(k)], xmm4)	\
+	AS2(	paddd		xmm5, xmm7)	\
+	AS2(	movhps		QWORD PTR [esp+12], xmm5)\
+	AS2(	psrlq		xmm4, 16)	\
+	AS2(	paddq		xmm4, xmm5)	\
+	AS2(	movq		QWORD PTR [ecx+8*(k)+2], xmm4)	\
+	AS2(	psrlq		xmm4, 3*16)	\
+	AS2(	paddd		xmm4, xmm6)	\
+	AS2(	movq		QWORD PTR [esp+4], xmm4)\
+
+#define SSE2_FirstMultiply(i)				\
+	AS2(	movdqa		xmm7, [esi+(i)*16])\
+	AS2(	movdqa		xmm5, [edi-(i)*16])\
+	AS2(	pmuludq		xmm5, xmm7)		\
+	AS2(	movdqa		xmm4, [ebx])\
+	AS2(	movdqa		xmm6, xmm4)		\
+	AS2(	pand		xmm4, xmm5)		\
+	AS2(	psrld		xmm5, 16)		\
+	AS2(	pmuludq		xmm7, [edx-(i)*16])\
+	AS2(	pand		xmm6, xmm7)		\
+	AS2(	psrld		xmm7, 16)
+
+#define Squ_Begin(n)							\
+	SquPrologue									\
+	AS2(	mov		esi, esp)\
+	AS2(	and		esp, 0xfffffff0)\
+	AS2(	lea		edi, [esp-32*n])\
+	AS2(	sub		esp, 32*n+16)\
+	AS1(	push	esi)\
+	AS2(	mov		esi, edi)					\
+	AS2(	xor		edx, edx)					\
+	ASL(1)										\
+	ASS(	pshufd	xmm0, [eax+edx], 3,1,2,0)	\
+	ASS(	pshufd	xmm1, [eax+edx], 2,0,3,1)	\
+	AS2(	movdqa	[edi+2*edx], xmm0)		\
+	AS2(	psrlq	xmm0, 32)					\
+	AS2(	movdqa	[edi+2*edx+16], xmm0)	\
+	AS2(	movdqa	[edi+16*n+2*edx], xmm1)		\
+	AS2(	psrlq	xmm1, 32)					\
+	AS2(	movdqa	[edi+16*n+2*edx+16], xmm1)	\
+	AS2(	add		edx, 16)					\
+	AS2(	cmp		edx, 8*(n))					\
+	ASJ(	jne,	1, b)						\
+	AS2(	lea		edx, [edi+16*n])\
+	SSE2_FirstMultiply(0)							\
+
+#define Squ_Acc(i)								\
+	ASL(LSqu##i)								\
+	AS2(	movdqa		xmm1, [esi+(i)*16])	\
+	AS2(	movdqa		xmm0, [edi-(i)*16])	\
+	AS2(	movdqa		xmm2, [ebx])	\
+	AS2(	pmuludq		xmm0, xmm1)				\
+	AS2(	pmuludq		xmm1, [edx-(i)*16])	\
+	AS2(	movdqa		xmm3, xmm2)			\
+	AS2(	pand		xmm2, xmm0)			\
+	AS2(	psrld		xmm0, 16)			\
+	AS2(	paddd		xmm4, xmm2)			\
+	AS2(	paddd		xmm5, xmm0)			\
+	AS2(	pand		xmm3, xmm1)			\
+	AS2(	psrld		xmm1, 16)			\
+	AS2(	paddd		xmm6, xmm3)			\
+	AS2(	paddd		xmm7, xmm1)		\
+
+#define Squ_Acc1(i)
+#define Squ_Acc2(i)		ASC(call, LSqu##i)
+#define Squ_Acc3(i)		Squ_Acc2(i)
+#define Squ_Acc4(i)		Squ_Acc2(i)
+#define Squ_Acc5(i)		Squ_Acc2(i)
+#define Squ_Acc6(i)		Squ_Acc2(i)
+#define Squ_Acc7(i)		Squ_Acc2(i)
+#define Squ_Acc8(i)		Squ_Acc2(i)
+
+#define SSE2_End(E, n)					\
+	SSE2_SaveShift(2*(n)-3)			\
+	AS2(	movdqa		xmm7, [esi+16])	\
+	AS2(	movdqa		xmm0, [edi])	\
+	AS2(	pmuludq		xmm0, xmm7)				\
+	AS2(	movdqa		xmm2, [ebx])		\
+	AS2(	pmuludq		xmm7, [edx])	\
+	AS2(	movdqa		xmm6, xmm2)				\
+	AS2(	pand		xmm2, xmm0)				\
+	AS2(	psrld		xmm0, 16)				\
+	AS2(	paddd		xmm4, xmm2)				\
+	AS2(	paddd		xmm5, xmm0)				\
+	AS2(	pand		xmm6, xmm7)				\
+	AS2(	psrld		xmm7, 16)	\
+	SSE2_SaveShift(2*(n)-2)			\
+	SSE2_FinalSave(2*(n)-1)			\
+	AS1(	pop		esp)\
+	E
+
+#define Squ_End(n)		SSE2_End(SquEpilogue, n)
+#define Mul_End(n)		SSE2_End(MulEpilogue, n)
+#define Top_End(n)		SSE2_End(TopEpilogue, n)
+
+#define Squ_Column1(k, i)	\
+	Squ_SSE2_SaveShift(k)					\
+	AS2(	add			esi, 16)	\
+	SSE2_FirstMultiply(1)\
+	Squ_Acc##i(i)	\
+	AS2(	paddd		xmm4, xmm4)		\
+	AS2(	paddd		xmm5, xmm5)		\
+	AS2(	movdqa		xmm3, [esi])				\
+	AS2(	movq		xmm1, QWORD PTR [esi+8])	\
+	AS2(	pmuludq		xmm1, xmm3)		\
+	AS2(	pmuludq		xmm3, xmm3)		\
+	AS2(	movdqa		xmm0, [ebx])\
+	AS2(	movdqa		xmm2, xmm0)		\
+	AS2(	pand		xmm0, xmm1)		\
+	AS2(	psrld		xmm1, 16)		\
+	AS2(	paddd		xmm6, xmm0)		\
+	AS2(	paddd		xmm7, xmm1)		\
+	AS2(	pand		xmm2, xmm3)		\
+	AS2(	psrld		xmm3, 16)		\
+	AS2(	paddd		xmm6, xmm6)		\
+	AS2(	paddd		xmm7, xmm7)		\
+	AS2(	paddd		xmm4, xmm2)		\
+	AS2(	paddd		xmm5, xmm3)		\
+	AS2(	movq		xmm0, QWORD PTR [esp+4])\
+	AS2(	movq		xmm1, QWORD PTR [esp+12])\
+	AS2(	paddd		xmm4, xmm0)\
+	AS2(	paddd		xmm5, xmm1)\
+
+#define Squ_Column0(k, i)	\
+	Squ_SSE2_SaveShift(k)					\
+	AS2(	add			edi, 16)	\
+	AS2(	add			edx, 16)	\
+	SSE2_FirstMultiply(1)\
+	Squ_Acc##i(i)	\
+	AS2(	paddd		xmm6, xmm6)		\
+	AS2(	paddd		xmm7, xmm7)		\
+	AS2(	paddd		xmm4, xmm4)		\
+	AS2(	paddd		xmm5, xmm5)		\
+	AS2(	movq		xmm0, QWORD PTR [esp+4])\
+	AS2(	movq		xmm1, QWORD PTR [esp+12])\
+	AS2(	paddd		xmm4, xmm0)\
+	AS2(	paddd		xmm5, xmm1)\
+
+#define SSE2_MulAdd45						\
+	AS2(	movdqa		xmm7, [esi])	\
+	AS2(	movdqa		xmm0, [edi])	\
+	AS2(	pmuludq		xmm0, xmm7)				\
+	AS2(	movdqa		xmm2, [ebx])		\
+	AS2(	pmuludq		xmm7, [edx])	\
+	AS2(	movdqa		xmm6, xmm2)				\
+	AS2(	pand		xmm2, xmm0)				\
+	AS2(	psrld		xmm0, 16)				\
+	AS2(	paddd		xmm4, xmm2)				\
+	AS2(	paddd		xmm5, xmm0)				\
+	AS2(	pand		xmm6, xmm7)				\
+	AS2(	psrld		xmm7, 16)
+
+#define Mul_Begin(n)							\
+	MulPrologue									\
+	AS2(	mov		esi, esp)\
+	AS2(	and		esp, 0xfffffff0)\
+	AS2(	sub		esp, 48*n+16)\
+	AS1(	push	esi)\
+	AS2(	xor		edx, edx)					\
+	ASL(1)										\
+	ASS(	pshufd	xmm0, [eax+edx], 3,1,2,0)	\
+	ASS(	pshufd	xmm1, [eax+edx], 2,0,3,1)	\
+	ASS(	pshufd	xmm2, [edi+edx], 3,1,2,0)	\
+	AS2(	movdqa	[esp+20+2*edx], xmm0)		\
+	AS2(	psrlq	xmm0, 32)					\
+	AS2(	movdqa	[esp+20+2*edx+16], xmm0)	\
+	AS2(	movdqa	[esp+20+16*n+2*edx], xmm1)		\
+	AS2(	psrlq	xmm1, 32)					\
+	AS2(	movdqa	[esp+20+16*n+2*edx+16], xmm1)	\
+	AS2(	movdqa	[esp+20+32*n+2*edx], xmm2)		\
+	AS2(	psrlq	xmm2, 32)					\
+	AS2(	movdqa	[esp+20+32*n+2*edx+16], xmm2)	\
+	AS2(	add		edx, 16)					\
+	AS2(	cmp		edx, 8*(n))					\
+	ASJ(	jne,	1, b)						\
+	AS2(	lea		edi, [esp+20])\
+	AS2(	lea		edx, [esp+20+16*n])\
+	AS2(	lea		esi, [esp+20+32*n])\
+	SSE2_FirstMultiply(0)							\
+
+#define Mul_Acc(i)								\
+	ASL(LMul##i)										\
+	AS2(	movdqa		xmm1, [esi+i/2*(1-(i-2*(i/2))*2)*16])	\
+	AS2(	movdqa		xmm0, [edi-i/2*(1-(i-2*(i/2))*2)*16])	\
+	AS2(	movdqa		xmm2, [ebx])	\
+	AS2(	pmuludq		xmm0, xmm1)				\
+	AS2(	pmuludq		xmm1, [edx-i/2*(1-(i-2*(i/2))*2)*16])	\
+	AS2(	movdqa		xmm3, xmm2)			\
+	AS2(	pand		xmm2, xmm0)			\
+	AS2(	psrld		xmm0, 16)			\
+	AS2(	paddd		xmm4, xmm2)			\
+	AS2(	paddd		xmm5, xmm0)			\
+	AS2(	pand		xmm3, xmm1)			\
+	AS2(	psrld		xmm1, 16)			\
+	AS2(	paddd		xmm6, xmm3)			\
+	AS2(	paddd		xmm7, xmm1)		\
+
+#define Mul_Acc1(i)
+#define Mul_Acc2(i)		ASC(call, LMul##i)
+#define Mul_Acc3(i)		Mul_Acc2(i)
+#define Mul_Acc4(i)		Mul_Acc2(i)
+#define Mul_Acc5(i)		Mul_Acc2(i)
+#define Mul_Acc6(i)		Mul_Acc2(i)
+#define Mul_Acc7(i)		Mul_Acc2(i)
+#define Mul_Acc8(i)		Mul_Acc2(i)
+#define Mul_Acc9(i)		Mul_Acc2(i)
+#define Mul_Acc10(i)	Mul_Acc2(i)
+#define Mul_Acc11(i)	Mul_Acc2(i)
+#define Mul_Acc12(i)	Mul_Acc2(i)
+#define Mul_Acc13(i)	Mul_Acc2(i)
+#define Mul_Acc14(i)	Mul_Acc2(i)
+#define Mul_Acc15(i)	Mul_Acc2(i)
+#define Mul_Acc16(i)	Mul_Acc2(i)
+
+#define Mul_Column1(k, i)	\
+	SSE2_SaveShift(k)					\
+	AS2(	add			esi, 16)	\
+	SSE2_MulAdd45\
+	Mul_Acc##i(i)	\
+
+#define Mul_Column0(k, i)	\
+	SSE2_SaveShift(k)					\
+	AS2(	add			edi, 16)	\
+	AS2(	add			edx, 16)	\
+	SSE2_MulAdd45\
+	Mul_Acc##i(i)	\
+
+#define Bot_Acc(i)							\
+	AS2(	movdqa		xmm1, [esi+i/2*(1-(i-2*(i/2))*2)*16])	\
+	AS2(	movdqa		xmm0, [edi-i/2*(1-(i-2*(i/2))*2)*16])	\
+	AS2(	pmuludq		xmm0, xmm1)				\
+	AS2(	pmuludq		xmm1, [edx-i/2*(1-(i-2*(i/2))*2)*16])		\
+	AS2(	paddq		xmm4, xmm0)				\
+	AS2(	paddd		xmm6, xmm1)
+
+#define Bot_SaveAcc(k)					\
+	SSE2_SaveShift(k)							\
+	AS2(	add			edi, 16)	\
+	AS2(	add			edx, 16)	\
+	AS2(	movdqa		xmm6, [esi])	\
+	AS2(	movdqa		xmm0, [edi])	\
+	AS2(	pmuludq		xmm0, xmm6)				\
+	AS2(	paddq		xmm4, xmm0)				\
+	AS2(	psllq		xmm5, 16)				\
+	AS2(	paddq		xmm4, xmm5)				\
+	AS2(	pmuludq		xmm6, [edx])
+
+#define Bot_End(n)							\
+	AS2(	movhlps		xmm7, xmm6)			\
+	AS2(	paddd		xmm6, xmm7)			\
+	AS2(	psllq		xmm6, 32)			\
+	AS2(	paddd		xmm4, xmm6)			\
+	AS2(	movq		QWORD PTR [ecx+8*((n)-1)], xmm4)	\
+	AS1(	pop		esp)\
+	MulEpilogue
+
+#define Top_Begin(n)							\
+	TopPrologue									\
+	AS2(	mov		edx, esp)\
+	AS2(	and		esp, 0xfffffff0)\
+	AS2(	sub		esp, 48*n+16)\
+	AS1(	push	edx)\
+	AS2(	xor		edx, edx)					\
+	ASL(1)										\
+	ASS(	pshufd	xmm0, [eax+edx], 3,1,2,0)	\
+	ASS(	pshufd	xmm1, [eax+edx], 2,0,3,1)	\
+	ASS(	pshufd	xmm2, [edi+edx], 3,1,2,0)	\
+	AS2(	movdqa	[esp+20+2*edx], xmm0)		\
+	AS2(	psrlq	xmm0, 32)					\
+	AS2(	movdqa	[esp+20+2*edx+16], xmm0)	\
+	AS2(	movdqa	[esp+20+16*n+2*edx], xmm1)		\
+	AS2(	psrlq	xmm1, 32)					\
+	AS2(	movdqa	[esp+20+16*n+2*edx+16], xmm1)	\
+	AS2(	movdqa	[esp+20+32*n+2*edx], xmm2)		\
+	AS2(	psrlq	xmm2, 32)					\
+	AS2(	movdqa	[esp+20+32*n+2*edx+16], xmm2)	\
+	AS2(	add		edx, 16)					\
+	AS2(	cmp		edx, 8*(n))					\
+	ASJ(	jne,	1, b)						\
+	AS2(	mov		eax, esi)					\
+	AS2(	lea		edi, [esp+20+00*n+16*(n/2-1)])\
+	AS2(	lea		edx, [esp+20+16*n+16*(n/2-1)])\
+	AS2(	lea		esi, [esp+20+32*n+16*(n/2-1)])\
+	AS2(	pxor	xmm4, xmm4)\
+	AS2(	pxor	xmm5, xmm5)
+
+#define Top_Acc(i)							\
+	AS2(	movq		xmm0, QWORD PTR [esi+i/2*(1-(i-2*(i/2))*2)*16+8])	\
+	AS2(	pmuludq		xmm0, [edx-i/2*(1-(i-2*(i/2))*2)*16])	\
+	AS2(	psrlq		xmm0, 48)				\
+	AS2(	paddd		xmm5, xmm0)\
+
+#define Top_Column0(i)	\
+	AS2(	psllq		xmm5, 32)				\
+	AS2(	add			edi, 16)	\
+	AS2(	add			edx, 16)	\
+	SSE2_MulAdd45\
+	Mul_Acc##i(i)	\
+
+#define Top_Column1(i)	\
+	SSE2_SaveShift(0)					\
+	AS2(	add			esi, 16)	\
+	SSE2_MulAdd45\
+	Mul_Acc##i(i)	\
+	AS2(	shr			eax, 16)	\
+	AS2(	movd		xmm0, eax)\
+	AS2(	movd		xmm1, [ecx+4])\
+	AS2(	psrld		xmm1, 16)\
+	AS2(	pcmpgtd		xmm1, xmm0)\
+	AS2(	psrld		xmm1, 31)\
+	AS2(	paddd		xmm4, xmm1)\
+
+void SSE2_Square4(word *C, const word *A)
+{
+	Squ_Begin(2)
+	Squ_Column0(0, 1)
+	Squ_End(2)
+}
+
+void SSE2_Square8(word *C, const word *A)
+{
+	Squ_Begin(4)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Squ_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Squ_Column0(0, 1)
+	Squ_Column1(1, 1)
+	Squ_Column0(2, 2)
+	Squ_Column1(3, 1)
+	Squ_Column0(4, 1)
+	Squ_End(4)
+}
+
+void SSE2_Square16(word *C, const word *A)
+{
+	Squ_Begin(8)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Squ_Acc(4) Squ_Acc(3) Squ_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Squ_Column0(0, 1)
+	Squ_Column1(1, 1)
+	Squ_Column0(2, 2)
+	Squ_Column1(3, 2)
+	Squ_Column0(4, 3)
+	Squ_Column1(5, 3)
+	Squ_Column0(6, 4)
+	Squ_Column1(7, 3)
+	Squ_Column0(8, 3)
+	Squ_Column1(9, 2)
+	Squ_Column0(10, 2)
+	Squ_Column1(11, 1)
+	Squ_Column0(12, 1)
+	Squ_End(8)
+}
+
+void SSE2_Square32(word *C, const word *A)
+{
+	Squ_Begin(16)
+	ASJ(	jmp,	0, f)
+	Squ_Acc(8) Squ_Acc(7) Squ_Acc(6) Squ_Acc(5) Squ_Acc(4) Squ_Acc(3) Squ_Acc(2)
+	AS1(	ret) ASL(0)
+	Squ_Column0(0, 1)
+	Squ_Column1(1, 1)
+	Squ_Column0(2, 2)
+	Squ_Column1(3, 2)
+	Squ_Column0(4, 3)
+	Squ_Column1(5, 3)
+	Squ_Column0(6, 4)
+	Squ_Column1(7, 4)
+	Squ_Column0(8, 5)
+	Squ_Column1(9, 5)
+	Squ_Column0(10, 6)
+	Squ_Column1(11, 6)
+	Squ_Column0(12, 7)
+	Squ_Column1(13, 7)
+	Squ_Column0(14, 8)
+	Squ_Column1(15, 7)
+	Squ_Column0(16, 7)
+	Squ_Column1(17, 6)
+	Squ_Column0(18, 6)
+	Squ_Column1(19, 5)
+	Squ_Column0(20, 5)
+	Squ_Column1(21, 4)
+	Squ_Column0(22, 4)
+	Squ_Column1(23, 3)
+	Squ_Column0(24, 3)
+	Squ_Column1(25, 2)
+	Squ_Column0(26, 2)
+	Squ_Column1(27, 1)
+	Squ_Column0(28, 1)
+	Squ_End(16)
+}
+
+void SSE2_Multiply4(word *C, const word *A, const word *B)
+{
+	Mul_Begin(2)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Mul_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Mul_Column0(0, 2)
+	Mul_End(2)
+}
+
+void SSE2_Multiply8(word *C, const word *A, const word *B)
+{
+	Mul_Begin(4)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Mul_Acc(4) Mul_Acc(3) Mul_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Mul_Column0(0, 2)
+	Mul_Column1(1, 3)
+	Mul_Column0(2, 4)
+	Mul_Column1(3, 3)
+	Mul_Column0(4, 2)
+	Mul_End(4)
+}
+
+void SSE2_Multiply16(word *C, const word *A, const word *B)
+{
+	Mul_Begin(8)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Mul_Acc(8) Mul_Acc(7) Mul_Acc(6) Mul_Acc(5) Mul_Acc(4) Mul_Acc(3) Mul_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Mul_Column0(0, 2)
+	Mul_Column1(1, 3)
+	Mul_Column0(2, 4)
+	Mul_Column1(3, 5)
+	Mul_Column0(4, 6)
+	Mul_Column1(5, 7)
+	Mul_Column0(6, 8)
+	Mul_Column1(7, 7)
+	Mul_Column0(8, 6)
+	Mul_Column1(9, 5)
+	Mul_Column0(10, 4)
+	Mul_Column1(11, 3)
+	Mul_Column0(12, 2)
+	Mul_End(8)
+}
+
+void SSE2_Multiply32(word *C, const word *A, const word *B)
+{
+	Mul_Begin(16)
+	ASJ(	jmp,	0, f)
+	Mul_Acc(16) Mul_Acc(15) Mul_Acc(14) Mul_Acc(13) Mul_Acc(12) Mul_Acc(11) Mul_Acc(10) Mul_Acc(9) Mul_Acc(8) Mul_Acc(7) Mul_Acc(6) Mul_Acc(5) Mul_Acc(4) Mul_Acc(3) Mul_Acc(2)
+	AS1(	ret) ASL(0)
+	Mul_Column0(0, 2)
+	Mul_Column1(1, 3)
+	Mul_Column0(2, 4)
+	Mul_Column1(3, 5)
+	Mul_Column0(4, 6)
+	Mul_Column1(5, 7)
+	Mul_Column0(6, 8)
+	Mul_Column1(7, 9)
+	Mul_Column0(8, 10)
+	Mul_Column1(9, 11)
+	Mul_Column0(10, 12)
+	Mul_Column1(11, 13)
+	Mul_Column0(12, 14)
+	Mul_Column1(13, 15)
+	Mul_Column0(14, 16)
+	Mul_Column1(15, 15)
+	Mul_Column0(16, 14)
+	Mul_Column1(17, 13)
+	Mul_Column0(18, 12)
+	Mul_Column1(19, 11)
+	Mul_Column0(20, 10)
+	Mul_Column1(21, 9)
+	Mul_Column0(22, 8)
+	Mul_Column1(23, 7)
+	Mul_Column0(24, 6)
+	Mul_Column1(25, 5)
+	Mul_Column0(26, 4)
+	Mul_Column1(27, 3)
+	Mul_Column0(28, 2)
+	Mul_End(16)
+}
+
+void SSE2_MultiplyBottom4(word *C, const word *A, const word *B)
+{
+	Mul_Begin(2)
+	Bot_SaveAcc(0) Bot_Acc(2)
+	Bot_End(2)
+}
+
+void SSE2_MultiplyBottom8(word *C, const word *A, const word *B)
+{
+	Mul_Begin(4)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Mul_Acc(3) Mul_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Mul_Column0(0, 2)
+	Mul_Column1(1, 3)
+	Bot_SaveAcc(2) Bot_Acc(4) Bot_Acc(3) Bot_Acc(2)
+	Bot_End(4)
+}
+
+void SSE2_MultiplyBottom16(word *C, const word *A, const word *B)
+{
+	Mul_Begin(8)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Mul_Acc(7) Mul_Acc(6) Mul_Acc(5) Mul_Acc(4) Mul_Acc(3) Mul_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Mul_Column0(0, 2)
+	Mul_Column1(1, 3)
+	Mul_Column0(2, 4)
+	Mul_Column1(3, 5)
+	Mul_Column0(4, 6)
+	Mul_Column1(5, 7)
+	Bot_SaveAcc(6) Bot_Acc(8) Bot_Acc(7) Bot_Acc(6) Bot_Acc(5) Bot_Acc(4) Bot_Acc(3) Bot_Acc(2)
+	Bot_End(8)
+}
+
+void SSE2_MultiplyBottom32(word *C, const word *A, const word *B)
+{
+	Mul_Begin(16)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Mul_Acc(15) Mul_Acc(14) Mul_Acc(13) Mul_Acc(12) Mul_Acc(11) Mul_Acc(10) Mul_Acc(9) Mul_Acc(8) Mul_Acc(7) Mul_Acc(6) Mul_Acc(5) Mul_Acc(4) Mul_Acc(3) Mul_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Mul_Column0(0, 2)
+	Mul_Column1(1, 3)
+	Mul_Column0(2, 4)
+	Mul_Column1(3, 5)
+	Mul_Column0(4, 6)
+	Mul_Column1(5, 7)
+	Mul_Column0(6, 8)
+	Mul_Column1(7, 9)
+	Mul_Column0(8, 10)
+	Mul_Column1(9, 11)
+	Mul_Column0(10, 12)
+	Mul_Column1(11, 13)
+	Mul_Column0(12, 14)
+	Mul_Column1(13, 15)
+	Bot_SaveAcc(14) Bot_Acc(16) Bot_Acc(15) Bot_Acc(14) Bot_Acc(13) Bot_Acc(12) Bot_Acc(11) Bot_Acc(10) Bot_Acc(9) Bot_Acc(8) Bot_Acc(7) Bot_Acc(6) Bot_Acc(5) Bot_Acc(4) Bot_Acc(3) Bot_Acc(2)
+	Bot_End(16)
+}
+
+void SSE2_MultiplyTop8(word *C, const word *A, const word *B, word L)
+{
+	Top_Begin(4)
+	Top_Acc(3) Top_Acc(2) Top_Acc(1)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Mul_Acc(4) Mul_Acc(3) Mul_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Top_Column0(4)
+	Top_Column1(3)
+	Mul_Column0(0, 2)
+	Top_End(2)
+}
+
+void SSE2_MultiplyTop16(word *C, const word *A, const word *B, word L)
+{
+	Top_Begin(8)
+	Top_Acc(7) Top_Acc(6) Top_Acc(5) Top_Acc(4) Top_Acc(3) Top_Acc(2) Top_Acc(1)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Mul_Acc(8) Mul_Acc(7) Mul_Acc(6) Mul_Acc(5) Mul_Acc(4) Mul_Acc(3) Mul_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Top_Column0(8)
+	Top_Column1(7)
+	Mul_Column0(0, 6)
+	Mul_Column1(1, 5)
+	Mul_Column0(2, 4)
+	Mul_Column1(3, 3)
+	Mul_Column0(4, 2)
+	Top_End(4)
+}
+
+void SSE2_MultiplyTop32(word *C, const word *A, const word *B, word L)
+{
+	Top_Begin(16)
+	Top_Acc(15) Top_Acc(14) Top_Acc(13) Top_Acc(12) Top_Acc(11) Top_Acc(10) Top_Acc(9) Top_Acc(8) Top_Acc(7) Top_Acc(6) Top_Acc(5) Top_Acc(4) Top_Acc(3) Top_Acc(2) Top_Acc(1)
+#ifndef __GNUC__
+	ASJ(	jmp,	0, f)
+	Mul_Acc(16) Mul_Acc(15) Mul_Acc(14) Mul_Acc(13) Mul_Acc(12) Mul_Acc(11) Mul_Acc(10) Mul_Acc(9) Mul_Acc(8) Mul_Acc(7) Mul_Acc(6) Mul_Acc(5) Mul_Acc(4) Mul_Acc(3) Mul_Acc(2)
+	AS1(	ret) ASL(0)
+#endif
+	Top_Column0(16)
+	Top_Column1(15)
+	Mul_Column0(0, 14)
+	Mul_Column1(1, 13)
+	Mul_Column0(2, 12)
+	Mul_Column1(3, 11)
+	Mul_Column0(4, 10)
+	Mul_Column1(5, 9)
+	Mul_Column0(6, 8)
+	Mul_Column1(7, 7)
+	Mul_Column0(8, 6)
+	Mul_Column1(9, 5)
+	Mul_Column0(10, 4)
+	Mul_Column1(11, 3)
+	Mul_Column0(12, 2)
+	Top_End(8)
+}
+
+#endif	// #if CRYPTOPP_INTEGER_SSE2
+
+// ********************************************************
+
+typedef int (CRYPTOPP_FASTCALL * PAdd)(size_t N, word *C, const word *A, const word *B);
+typedef void (* PMul)(word *C, const word *A, const word *B);
+typedef void (* PSqu)(word *C, const word *A);
+typedef void (* PMulTop)(word *C, const word *A, const word *B, word L);
+
+#if CRYPTOPP_INTEGER_SSE2
+static PAdd s_pAdd = &Baseline_Add, s_pSub = &Baseline_Sub;
+static size_t s_recursionLimit = 8;
+#else
+static const size_t s_recursionLimit = 16;
+#endif  // CRYPTOPP_INTEGER_SSE2
+
+static PMul s_pMul[9], s_pBot[9];
+static PSqu s_pSqu[9];
+static PMulTop s_pTop[9];
+
+void SetFunctionPointers()
+{
+	s_pMul[0] = &Baseline_Multiply2;
+	s_pBot[0] = &Baseline_MultiplyBottom2;
+	s_pSqu[0] = &Baseline_Square2;
+	s_pTop[0] = &Baseline_MultiplyTop2;
+	s_pTop[1] = &Baseline_MultiplyTop4;
+
+#if CRYPTOPP_INTEGER_SSE2
+	if (HasSSE2())
+	{
+		if (IsP4())
+		{
+			s_pAdd = &SSE2_Add;
+			s_pSub = &SSE2_Sub;
+		}
+
+		s_recursionLimit = 32;
+
+		s_pMul[1] = &SSE2_Multiply4;
+		s_pMul[2] = &SSE2_Multiply8;
+		s_pMul[4] = &SSE2_Multiply16;
+		s_pMul[8] = &SSE2_Multiply32;
+
+		s_pBot[1] = &SSE2_MultiplyBottom4;
+		s_pBot[2] = &SSE2_MultiplyBottom8;
+		s_pBot[4] = &SSE2_MultiplyBottom16;
+		s_pBot[8] = &SSE2_MultiplyBottom32;
+
+		s_pSqu[1] = &SSE2_Square4;
+		s_pSqu[2] = &SSE2_Square8;
+		s_pSqu[4] = &SSE2_Square16;
+		s_pSqu[8] = &SSE2_Square32;
+
+		s_pTop[2] = &SSE2_MultiplyTop8;
+		s_pTop[4] = &SSE2_MultiplyTop16;
+		s_pTop[8] = &SSE2_MultiplyTop32;
+	}
+	else
+#endif  // CRYPTOPP_INTEGER_SSE2
+	{
+		s_pMul[1] = &Baseline_Multiply4;
+		s_pMul[2] = &Baseline_Multiply8;
+
+		s_pBot[1] = &Baseline_MultiplyBottom4;
+		s_pBot[2] = &Baseline_MultiplyBottom8;
+
+		s_pSqu[1] = &Baseline_Square4;
+		s_pSqu[2] = &Baseline_Square8;
+
+		s_pTop[2] = &Baseline_MultiplyTop8;
+
+#if	!CRYPTOPP_INTEGER_SSE2
+		s_pMul[4] = &Baseline_Multiply16;
+		s_pBot[4] = &Baseline_MultiplyBottom16;
+		s_pSqu[4] = &Baseline_Square16;
+		s_pTop[4] = &Baseline_MultiplyTop16;
+#endif  // !CRYPTOPP_INTEGER_SSE2
+	}
+}
+
+inline int Add(word *C, const word *A, const word *B, size_t N)
+{
+#if CRYPTOPP_INTEGER_SSE2
+	return s_pAdd(N, C, A, B);
+#else
+	return Baseline_Add(N, C, A, B);
+#endif  // CRYPTOPP_INTEGER_SSE2
+}
+
+inline int Subtract(word *C, const word *A, const word *B, size_t N)
+{
+#if CRYPTOPP_INTEGER_SSE2
+	return s_pSub(N, C, A, B);
+#else
+	return Baseline_Sub(N, C, A, B);
+#endif  // CRYPTOPP_INTEGER_SSE2
+}
+
+// ********************************************************
+
+
+#define A0		A
+#define A1		(A+N2)
+#define B0		B
+#define B1		(B+N2)
+
+#define T0		T
+#define T1		(T+N2)
+#define T2		(T+N)
+#define T3		(T+N+N2)
+
+#define R0		R
+#define R1		(R+N2)
+#define R2		(R+N)
+#define R3		(R+N+N2)
+
+// R[2*N] - result = A*B
+// T[2*N] - temporary work space
+// A[N] --- multiplier
+// B[N] --- multiplicant
+
+void RecursiveMultiply(word *R, word *T, const word *A, const word *B, size_t N)
+{
+	CRYPTOPP_ASSERT(N>=2 && N%2==0);
+
+	if (N <= s_recursionLimit)
+		s_pMul[N/4](R, A, B);
+	else
+	{
+		const size_t N2 = N/2;
+
+		size_t AN2 = Compare(A0, A1, N2) > 0 ?  0 : N2;
+		Subtract(R0, A + AN2, A + (N2 ^ AN2), N2);
+
+		size_t BN2 = Compare(B0, B1, N2) > 0 ?  0 : N2;
+		Subtract(R1, B + BN2, B + (N2 ^ BN2), N2);
+
+		RecursiveMultiply(R2, T2, A1, B1, N2);
+		RecursiveMultiply(T0, T2, R0, R1, N2);
+		RecursiveMultiply(R0, T2, A0, B0, N2);
+
+		// now T[01] holds (A1-A0)*(B0-B1), R[01] holds A0*B0, R[23] holds A1*B1
+
+		int c2 = Add(R2, R2, R1, N2);
+		int c3 = c2;
+		c2 += Add(R1, R2, R0, N2);
+		c3 += Add(R2, R2, R3, N2);
+
+		if (AN2 == BN2)
+			c3 -= Subtract(R1, R1, T0, N);
+		else
+			c3 += Add(R1, R1, T0, N);
+
+		c3 += Increment(R2, N2, c2);
+		CRYPTOPP_ASSERT (c3 >= 0 && c3 <= 2);
+		Increment(R3, N2, c3);
+	}
+}
+
+// R[2*N] - result = A*A
+// T[2*N] - temporary work space
+// A[N] --- number to be squared
+
+void RecursiveSquare(word *R, word *T, const word *A, size_t N)
+{
+	CRYPTOPP_ASSERT(N && N%2==0);
+
+	if (N <= s_recursionLimit)
+		s_pSqu[N/4](R, A);
+	else
+	{
+		const size_t N2 = N/2;
+
+		RecursiveSquare(R0, T2, A0, N2);
+		RecursiveSquare(R2, T2, A1, N2);
+		RecursiveMultiply(T0, T2, A0, A1, N2);
+
+		int carry = Add(R1, R1, T0, N);
+		carry += Add(R1, R1, T0, N);
+		Increment(R3, N2, carry);
+	}
+}
+
+// R[N] - bottom half of A*B
+// T[3*N/2] - temporary work space
+// A[N] - multiplier
+// B[N] - multiplicant
+
+void RecursiveMultiplyBottom(word *R, word *T, const word *A, const word *B, size_t N)
+{
+	CRYPTOPP_ASSERT(N>=2 && N%2==0);
+
+	if (N <= s_recursionLimit)
+		s_pBot[N/4](R, A, B);
+	else
+	{
+		const size_t N2 = N/2;
+
+		RecursiveMultiply(R, T, A0, B0, N2);
+		RecursiveMultiplyBottom(T0, T1, A1, B0, N2);
+		Add(R1, R1, T0, N2);
+		RecursiveMultiplyBottom(T0, T1, A0, B1, N2);
+		Add(R1, R1, T0, N2);
+	}
+}
+
+// R[N] --- upper half of A*B
+// T[2*N] - temporary work space
+// L[N] --- lower half of A*B
+// A[N] --- multiplier
+// B[N] --- multiplicant
+
+void MultiplyTop(word *R, word *T, const word *L, const word *A, const word *B, size_t N)
+{
+	CRYPTOPP_ASSERT(N>=2 && N%2==0);
+
+	if (N <= s_recursionLimit)
+		s_pTop[N/4](R, A, B, L[N-1]);
+	else
+	{
+		const size_t N2 = N/2;
+
+		size_t AN2 = Compare(A0, A1, N2) > 0 ?  0 : N2;
+		Subtract(R0, A + AN2, A + (N2 ^ AN2), N2);
+
+		size_t BN2 = Compare(B0, B1, N2) > 0 ?  0 : N2;
+		Subtract(R1, B + BN2, B + (N2 ^ BN2), N2);
+
+		RecursiveMultiply(T0, T2, R0, R1, N2);
+		RecursiveMultiply(R0, T2, A1, B1, N2);
+
+		// now T[01] holds (A1-A0)*(B0-B1) = A1*B0+A0*B1-A1*B1-A0*B0, R[01] holds A1*B1
+
+		int t, c3;
+		int c2 = Subtract(T2, L+N2, L, N2);
+
+		if (AN2 == BN2)
+		{
+			c2 -= Add(T2, T2, T0, N2);
+			t = (Compare(T2, R0, N2) == -1);
+			c3 = t - Subtract(T2, T2, T1, N2);
+		}
+		else
+		{
+			c2 += Subtract(T2, T2, T0, N2);
+			t = (Compare(T2, R0, N2) == -1);
+			c3 = t + Add(T2, T2, T1, N2);
+		}
+
+		c2 += t;
+		if (c2 >= 0)
+			c3 += Increment(T2, N2, c2);
+		else
+			c3 -= Decrement(T2, N2, -c2);
+		c3 += Add(R0, T2, R1, N2);
+
+		CRYPTOPP_ASSERT (c3 >= 0 && c3 <= 2);
+		Increment(R1, N2, c3);
+	}
+}
+
+inline void Multiply(word *R, word *T, const word *A, const word *B, size_t N)
+{
+	RecursiveMultiply(R, T, A, B, N);
+}
+
+inline void Square(word *R, word *T, const word *A, size_t N)
+{
+	RecursiveSquare(R, T, A, N);
+}
+
+inline void MultiplyBottom(word *R, word *T, const word *A, const word *B, size_t N)
+{
+	RecursiveMultiplyBottom(R, T, A, B, N);
+}
+
+// R[NA+NB] - result = A*B
+// T[NA+NB] - temporary work space
+// A[NA] ---- multiplier
+// B[NB] ---- multiplicant
+
+void AsymmetricMultiply(word *R, word *T, const word *A, size_t NA, const word *B, size_t NB)
+{
+	if (NA == NB)
+	{
+		// Profiling guided the flow below.
+		if (A != B)
+			Multiply(R, T, A, B, NA);
+		else
+			Square(R, T, A, NA);
+
+		return;
+	}
+
+	if (NA > NB)
+	{
+		std::swap(A, B);
+		std::swap(NA, NB);
+	}
+
+	CRYPTOPP_ASSERT(NB % NA == 0);
+
+	if (NA==2 && !A[1])
+	{
+		// Profiling guided the flow below.
+		switch (A[0])
+		{
+		default:
+			R[NB] = LinearMultiply(R, B, A[0], NB);
+			R[NB+1] = 0;
+			return;
+		case 0:
+			SetWords(R, 0, NB+2);
+			return;
+		case 1:
+			CopyWords(R, B, NB);
+			R[NB] = R[NB+1] = 0;
+			return;
+		}
+	}
+
+	size_t i;
+	if ((NB/NA)%2 == 0)
+	{
+		Multiply(R, T, A, B, NA);
+		CopyWords(T+2*NA, R+NA, NA);
+
+		for (i=2*NA; i<NB; i+=2*NA)
+			Multiply(T+NA+i, T, A, B+i, NA);
+		for (i=NA; i<NB; i+=2*NA)
+			Multiply(R+i, T, A, B+i, NA);
+	}
+	else
+	{
+		for (i=0; i<NB; i+=2*NA)
+			Multiply(R+i, T, A, B+i, NA);
+		for (i=NA; i<NB; i+=2*NA)
+			Multiply(T+NA+i, T, A, B+i, NA);
+	}
+
+	if (Add(R+NA, R+NA, T+2*NA, NB-NA))
+		Increment(R+NB, NA);
+}
+
+// R[N] ----- result = A inverse mod 2**(WORD_BITS*N)
+// T[3*N/2] - temporary work space
+// A[N] ----- an odd number as input
+
+void RecursiveInverseModPower2(word *R, word *T, const word *A, size_t N)
+{
+	// Profiling guided the flow below.
+	if (N!=2)
+	{
+		const size_t N2 = N/2;
+		RecursiveInverseModPower2(R0, T0, A0, N2);
+		T0[0] = 1;
+		SetWords(T0+1, 0, N2-1);
+		MultiplyTop(R1, T1, T0, R0, A0, N2);
+		MultiplyBottom(T0, T1, R0, A1, N2);
+		Add(T0, R1, T0, N2);
+		TwosComplement(T0, N2);
+		MultiplyBottom(R1, T1, R0, T0, N2);
+	}
+	else
+	{
+		T[0] = AtomicInverseModPower2(A[0]);
+		T[1] = 0;
+		s_pBot[0](T+2, T, A);
+		TwosComplement(T+2, 2);
+		Increment(T+2, 2, 2);
+		s_pBot[0](R, T, T+2);
+	}
+}
+
+// R[N] --- result = X/(2**(WORD_BITS*N)) mod M
+// T[3*N] - temporary work space
+// X[2*N] - number to be reduced
+// M[N] --- modulus
+// U[N] --- multiplicative inverse of M mod 2**(WORD_BITS*N)
+
+void MontgomeryReduce(word *R, word *T, word *X, const word *M, const word *U, size_t N)
+{
+#if 1
+	MultiplyBottom(R, T, X, U, N);
+	MultiplyTop(T, T+N, X, R, M, N);
+	word borrow = Subtract(T, X+N, T, N);
+	// defend against timing attack by doing this Add even when not needed
+	word carry = Add(T+N, T, M, N);
+	CRYPTOPP_ASSERT(carry | !borrow);
+	CRYPTOPP_UNUSED(carry), CRYPTOPP_UNUSED(borrow);
+	CopyWords(R, T + ((0-borrow) & N), N);
+#elif 0
+	const word u = 0-U[0];
+	Declare2Words(p)
+	for (size_t i=0; i<N; i++)
+	{
+		const word t = u * X[i];
+		word c = 0;
+		for (size_t j=0; j<N; j+=2)
+		{
+			MultiplyWords(p, t, M[j]);
+			Acc2WordsBy1(p, X[i+j]);
+			Acc2WordsBy1(p, c);
+			X[i+j] = LowWord(p);
+			c = HighWord(p);
+			MultiplyWords(p, t, M[j+1]);
+			Acc2WordsBy1(p, X[i+j+1]);
+			Acc2WordsBy1(p, c);
+			X[i+j+1] = LowWord(p);
+			c = HighWord(p);
+		}
+
+		if (Increment(X+N+i, N-i, c))
+			while (!Subtract(X+N, X+N, M, N)) {}
+	}
+
+	std::memcpy(R, X+N, N*WORD_SIZE);
+#else
+	__m64 u = _mm_cvtsi32_si64(0-U[0]), p;
+	for (size_t i=0; i<N; i++)
+	{
+		__m64 t = _mm_cvtsi32_si64(X[i]);
+		t = _mm_mul_su32(t, u);
+		__m64 c = _mm_setzero_si64();
+		for (size_t j=0; j<N; j+=2)
+		{
+			p = _mm_mul_su32(t, _mm_cvtsi32_si64(M[j]));
+			p = _mm_add_si64(p, _mm_cvtsi32_si64(X[i+j]));
+			c = _mm_add_si64(c, p);
+			X[i+j] = _mm_cvtsi64_si32(c);
+			c = _mm_srli_si64(c, 32);
+			p = _mm_mul_su32(t, _mm_cvtsi32_si64(M[j+1]));
+			p = _mm_add_si64(p, _mm_cvtsi32_si64(X[i+j+1]));
+			c = _mm_add_si64(c, p);
+			X[i+j+1] = _mm_cvtsi64_si32(c);
+			c = _mm_srli_si64(c, 32);
+		}
+
+		if (Increment(X+N+i, N-i, _mm_cvtsi64_si32(c)))
+			while (!Subtract(X+N, X+N, M, N)) {}
+	}
+
+	std::memcpy(R, X+N, N*WORD_SIZE);
+	_mm_empty();
+#endif
+}
+
+// R[N] --- result = X/(2**(WORD_BITS*N/2)) mod M
+// T[2*N] - temporary work space
+// X[2*N] - number to be reduced
+// M[N] --- modulus
+// U[N/2] - multiplicative inverse of M mod 2**(WORD_BITS*N/2)
+// V[N] --- 2**(WORD_BITS*3*N/2) mod M
+
+void HalfMontgomeryReduce(word *R, word *T, const word *X, const word *M, const word *U, const word *V, size_t N)
+{
+	CRYPTOPP_ASSERT(N%2==0 && N>=4);
+
+#define M0		M
+#define M1		(M+N2)
+#define V0		V
+#define V1		(V+N2)
+
+#define X0		X
+#define X1		(X+N2)
+#define X2		(X+N)
+#define X3		(X+N+N2)
+
+	const size_t N2 = N/2;
+	Multiply(T0, T2, V0, X3, N2);
+	int c2 = Add(T0, T0, X0, N);
+	MultiplyBottom(T3, T2, T0, U, N2);
+	MultiplyTop(T2, R, T0, T3, M0, N2);
+	c2 -= Subtract(T2, T1, T2, N2);
+	Multiply(T0, R, T3, M1, N2);
+	c2 -= Subtract(T0, T2, T0, N2);
+	int c3 = -(int)Subtract(T1, X2, T1, N2);
+	Multiply(R0, T2, V1, X3, N2);
+	c3 += Add(R, R, T, N);
+
+	if (c2>0)
+		c3 += Increment(R1, N2);
+	else if (c2<0)
+		c3 -= Decrement(R1, N2, -c2);
+
+	CRYPTOPP_ASSERT(c3>=-1 && c3<=1);
+	if (c3>0)
+		Subtract(R, R, M, N);
+	else if (c3<0)
+		Add(R, R, M, N);
+
+#undef M0
+#undef M1
+#undef V0
+#undef V1
+
+#undef X0
+#undef X1
+#undef X2
+#undef X3
+}
+
+#undef A0
+#undef A1
+#undef B0
+#undef B1
+
+#undef T0
+#undef T1
+#undef T2
+#undef T3
+
+#undef R0
+#undef R1
+#undef R2
+#undef R3
+
+/*
+// do a 3 word by 2 word divide, returns quotient and leaves remainder in A
+static word SubatomicDivide(word *A, word B0, word B1)
+{
+	// Assert {A[2],A[1]} < {B1,B0}, so quotient can fit in a word
+	CRYPTOPP_ASSERT(A[2] < B1 || (A[2]==B1 && A[1] < B0));
+
+	// estimate the quotient: do a 2 word by 1 word divide
+	word Q;
+	if (B1+1 == 0)
+		Q = A[2];
+	else
+		Q = DWord(A[1], A[2]).DividedBy(B1+1);
+
+	// now subtract Q*B from A
+	DWord p = DWord::Multiply(B0, Q);
+	DWord u = (DWord) A[0] - p.GetLowHalf();
+	A[0] = u.GetLowHalf();
+	u = (DWord) A[1] - p.GetHighHalf() - u.GetHighHalfAsBorrow() - DWord::Multiply(B1, Q);
+	A[1] = u.GetLowHalf();
+	A[2] += u.GetHighHalf();
+
+	// Q <= actual quotient, so fix it
+	while (A[2] || A[1] > B1 || (A[1]==B1 && A[0]>=B0))
+	{
+		u = (DWord) A[0] - B0;
+		A[0] = u.GetLowHalf();
+		u = (DWord) A[1] - B1 - u.GetHighHalfAsBorrow();
+		A[1] = u.GetLowHalf();
+		A[2] += u.GetHighHalf();
+		Q++;
+		CRYPTOPP_ASSERT(Q);	// shouldn't overflow
+	}
+
+	return Q;
+}
+
+// do a 4 word by 2 word divide, returns 2 word quotient in Q0 and Q1
+static inline void AtomicDivide(word *Q, const word *A, const word *B)
+{
+	if (!B[0] && !B[1]) // if divisor is 0, we assume divisor==2**(2*WORD_BITS)
+	{
+		Q[0] = A[2];
+		Q[1] = A[3];
+	}
+	else
+	{
+		word T[4];
+		T[0] = A[0]; T[1] = A[1]; T[2] = A[2]; T[3] = A[3];
+		Q[1] = SubatomicDivide(T+1, B[0], B[1]);
+		Q[0] = SubatomicDivide(T, B[0], B[1]);
+
+#if defined(CRYPTOPP_DEBUG)
+		// multiply quotient and divisor and add remainder, make sure it equals dividend
+		CRYPTOPP_ASSERT(!T[2] && !T[3] && (T[1] < B[1] || (T[1]==B[1] && T[0]<B[0])));
+		word P[4];
+		LowLevel::Multiply2(P, Q, B);
+		Add(P, P, T, 4);
+		CRYPTOPP_ASSERT(std::memcmp(P, A, 4*WORD_SIZE)==0);
+#endif
+	}
+}
+*/
+
+static inline void AtomicDivide(word *Q, const word *A, const word *B)
+{
+	word T[4];
+	DWord q = DivideFourWordsByTwo<word, DWord>(T, DWord(A[0], A[1]), DWord(A[2], A[3]), DWord(B[0], B[1]));
+	Q[0] = q.GetLowHalf();
+	Q[1] = q.GetHighHalf();
+
+#if defined(CRYPTOPP_DEBUG)
+	if (B[0] || B[1])
+	{
+		// multiply quotient and divisor and add remainder, make sure it equals dividend
+		CRYPTOPP_ASSERT(!T[2] && !T[3] && (T[1] < B[1] || (T[1]==B[1] && T[0]<B[0])));
+		word P[4];
+		s_pMul[0](P, Q, B);
+		Add(P, P, T, 4);
+		CRYPTOPP_ASSERT(std::memcmp(P, A, 4*WORD_SIZE)==0);
+	}
+#endif
+}
+
+// for use by Divide(), corrects the underestimated quotient {Q1,Q0}
+static void CorrectQuotientEstimate(word *R, word *T, word *Q, const word *B, size_t N)
+{
+	CRYPTOPP_ASSERT(N && N%2==0);
+
+	AsymmetricMultiply(T, T+N+2, Q, 2, B, N);
+
+	word borrow = Subtract(R, R, T, N+2);
+	CRYPTOPP_ASSERT(!borrow && !R[N+1]);
+	CRYPTOPP_UNUSED(borrow);
+
+	while (R[N] || Compare(R, B, N) >= 0)
+	{
+		R[N] -= Subtract(R, R, B, N);
+		Q[1] += (++Q[0]==0);
+		CRYPTOPP_ASSERT(Q[0] || Q[1]); // no overflow
+	}
+}
+
+// R[NB] -------- remainder = A%B
+// Q[NA-NB+2] --- quotient	= A/B
+// T[NA+3*(NB+2)] - temp work space
+// A[NA] -------- dividend
+// B[NB] -------- divisor
+
+void Divide(word *R, word *Q, word *T, const word *A, size_t NA, const word *B, size_t NB)
+{
+	CRYPTOPP_ASSERT(NA && NB && NA%2==0 && NB%2==0);
+	CRYPTOPP_ASSERT(B[NB-1] || B[NB-2]);
+	CRYPTOPP_ASSERT(NB <= NA);
+
+	// set up temporary work space
+	word *const TA=T;
+	word *const TB=T+NA+2;
+	word *const TP=T+NA+2+NB;
+
+	// copy B into TB and normalize it so that TB has highest bit set to 1
+	unsigned shiftWords = (B[NB-1]==0);
+	TB[0] = TB[NB-1] = 0;
+	CopyWords(TB+shiftWords, B, NB-shiftWords);
+	unsigned shiftBits = WORD_BITS - BitPrecision(TB[NB-1]);
+	CRYPTOPP_ASSERT(shiftBits < WORD_BITS);
+	ShiftWordsLeftByBits(TB, NB, shiftBits);
+
+	// copy A into TA and normalize it
+	TA[0] = TA[NA] = TA[NA+1] = 0;
+	CopyWords(TA+shiftWords, A, NA);
+	ShiftWordsLeftByBits(TA, NA+2, shiftBits);
+
+	if (TA[NA+1]==0 && TA[NA] <= 1)
+	{
+		Q[NA-NB+1] = Q[NA-NB] = 0;
+		while (TA[NA] || Compare(TA+NA-NB, TB, NB) >= 0)
+		{
+			TA[NA] -= Subtract(TA+NA-NB, TA+NA-NB, TB, NB);
+			++Q[NA-NB];
+		}
+	}
+	else
+	{
+		NA+=2;
+		CRYPTOPP_ASSERT(Compare(TA+NA-NB, TB, NB) < 0);
+	}
+
+	word BT[2];
+	BT[0] = TB[NB-2] + 1;
+	BT[1] = TB[NB-1] + (BT[0]==0);
+
+	// start reducing TA mod TB, 2 words at a time
+	for (size_t i=NA-2; i>=NB; i-=2)
+	{
+		AtomicDivide(Q+i-NB, TA+i-2, BT);
+		CorrectQuotientEstimate(TA+i-NB, TP, Q+i-NB, TB, NB);
+	}
+
+	// copy TA into R, and denormalize it
+	CopyWords(R, TA+shiftWords, NB);
+	ShiftWordsRightByBits(R, NB, shiftBits);
+}
+
+static inline size_t EvenWordCount(const word *X, size_t N)
+{
+	while (N && X[N-2]==0 && X[N-1]==0)
+		N-=2;
+	return N;
+}
+
+// return k
+// R[N] --- result = A^(-1) * 2^k mod M
+// T[4*N] - temporary work space
+// A[NA] -- number to take inverse of
+// M[N] --- modulus
+
+unsigned int AlmostInverse(word *R, word *T, const word *A, size_t NA, const word *M, size_t N)
+{
+	CRYPTOPP_ASSERT(NA<=N && N && N%2==0);
+
+	word *b = T;
+	word *c = T+N;
+	word *f = T+2*N;
+	word *g = T+3*N;
+	size_t bcLen=2, fgLen=EvenWordCount(M, N);
+	unsigned int k=0;
+	bool s=false;
+
+	SetWords(T, 0, 3*N);
+	b[0]=1;
+	CopyWords(f, A, NA);
+	CopyWords(g, M, N);
+
+	while (1)
+	{
+		word t=f[0];
+		while (!t)
+		{
+			if (EvenWordCount(f, fgLen)==0)
+			{
+				SetWords(R, 0, N);
+				return 0;
+			}
+
+			ShiftWordsRightByWords(f, fgLen, 1);
+			bcLen += 2 * (c[bcLen-1] != 0);
+			CRYPTOPP_ASSERT(bcLen <= N);
+			ShiftWordsLeftByWords(c, bcLen, 1);
+			k+=WORD_BITS;
+			t=f[0];
+		}
+
+		// t must be non-0; otherwise undefined.
+		unsigned int i = TrailingZeros(t);
+		t >>= i;
+		k += i;
+
+		if (t==1 && f[1]==0 && EvenWordCount(f+2, fgLen-2)==0)
+		{
+			if (s)
+				Subtract(R, M, b, N);
+			else
+				CopyWords(R, b, N);
+			return k;
+		}
+
+		ShiftWordsRightByBits(f, fgLen, i);
+		t = ShiftWordsLeftByBits(c, bcLen, i);
+		c[bcLen] += t;
+		bcLen += 2 * (t!=0);
+		CRYPTOPP_ASSERT(bcLen <= N);
+
+		bool swap = Compare(f, g, fgLen)==-1;
+		ConditionalSwapPointers(swap, f, g);
+		ConditionalSwapPointers(swap, b, c);
+		s ^= swap;
+
+		fgLen -= 2 * !(f[fgLen-2] | f[fgLen-1]);
+
+		Subtract(f, f, g, fgLen);
+		t = Add(b, b, c, bcLen);
+		b[bcLen] += t;
+		bcLen += 2*t;
+		CRYPTOPP_ASSERT(bcLen <= N);
+	}
+}
+
+// R[N] - result = A/(2^k) mod M
+// A[N] - input
+// M[N] - modulus
+
+void DivideByPower2Mod(word *R, const word *A, size_t k, const word *M, size_t N)
+{
+	CopyWords(R, A, N);
+
+	while (k--)
+	{
+		if (R[0]%2==0)
+			ShiftWordsRightByBits(R, N, 1);
+		else
+		{
+			word carry = Add(R, R, M, N);
+			ShiftWordsRightByBits(R, N, 1);
+			R[N-1] += carry<<(WORD_BITS-1);
+		}
+	}
+}
+
+// R[N] - result = A*(2^k) mod M
+// A[N] - input
+// M[N] - modulus
+
+void MultiplyByPower2Mod(word *R, const word *A, size_t k, const word *M, size_t N)
+{
+	CopyWords(R, A, N);
+
+	while (k--)
+		if (ShiftWordsLeftByBits(R, N, 1) || Compare(R, M, N)>=0)
+			Subtract(R, R, M, N);
+}
+
+// ******************************************************************
+
+static const unsigned int RoundupSizeTable[] = {2, 2, 2, 4, 4, 8, 8, 8, 8};
+
+static inline size_t RoundupSize(size_t n)
+{
+	if (n<=8)
+		return RoundupSizeTable[n];
+	else if (n<=16)
+		return 16;
+	else if (n<=32)
+		return 32;
+	else if (n<=64)
+		return 64;
+	else
+		return size_t(1) << BitPrecision(n-1);
+}
+
+Integer::Integer()
+	: reg(2), sign(POSITIVE)
+{
+	reg[0] = reg[1] = 0;
+}
+
+Integer::Integer(const Integer& t)
+	: reg(RoundupSize(t.WordCount())), sign(t.sign)
+{
+	CopyWords(reg, t.reg, reg.size());
+}
+
+Integer::Integer(Sign s, lword value)
+	: reg(2), sign(s)
+{
+	reg[0] = word(value);
+	reg[1] = word(SafeRightShift<WORD_BITS>(value));
+}
+
+Integer::Integer(signed long value)
+	: reg(2)
+{
+	if (value >= 0)
+		sign = POSITIVE;
+	else
+	{
+		sign = NEGATIVE;
+		value = -value;
+	}
+	reg[0] = word(value);
+	reg[1] = word(SafeRightShift<WORD_BITS>((unsigned long)value));
+}
+
+Integer::Integer(Sign s, word high, word low)
+	: reg(2), sign(s)
+{
+	reg[0] = low;
+	reg[1] = high;
+}
+
+bool Integer::IsConvertableToLong() const
+{
+	if (ByteCount() > sizeof(long))
+		return false;
+
+	unsigned long value = (unsigned long)reg[0];
+	value += SafeLeftShift<WORD_BITS, unsigned long>((unsigned long)reg[1]);
+
+	if (sign==POSITIVE)
+		return (signed long)value >= 0;
+	else
+		return -(signed long)value < 0;
+}
+
+signed long Integer::ConvertToLong() const
+{
+	CRYPTOPP_ASSERT(IsConvertableToLong());
+
+	unsigned long value = (unsigned long)reg[0];
+	value += SafeLeftShift<WORD_BITS, unsigned long>((unsigned long)reg[1]);
+	return sign==POSITIVE ? value : -(signed long)value;
+}
+
+Integer::Integer(BufferedTransformation &encodedInteger, size_t byteCount, Signedness s, ByteOrder o)
+{
+	CRYPTOPP_ASSERT(o == BIG_ENDIAN_ORDER || o == LITTLE_ENDIAN_ORDER);
+
+	if (o != LITTLE_ENDIAN_ORDER)
+	{
+		Decode(encodedInteger, byteCount, s);
+	}
+	else
+	{
+		SecByteBlock block(byteCount);
+		encodedInteger.Get(block, block.size());
+		std::reverse(block.begin(), block.begin()+block.size());
+
+		Decode(block.begin(), block.size(), s);
+	}
+}
+
+Integer::Integer(const byte *encodedInteger, size_t byteCount, Signedness s, ByteOrder o)
+{
+	CRYPTOPP_ASSERT(encodedInteger && byteCount); // NULL buffer
+	CRYPTOPP_ASSERT(o == BIG_ENDIAN_ORDER || o == LITTLE_ENDIAN_ORDER);
+
+	if (o != LITTLE_ENDIAN_ORDER)
+	{
+		Decode(encodedInteger, byteCount, s);
+	}
+	else
+	{
+		SecByteBlock block(byteCount);
+#if (CRYPTOPP_MSC_VERSION >= 1500)
+		std::reverse_copy(encodedInteger, encodedInteger+byteCount,
+			stdext::make_checked_array_iterator(block.begin(), block.size()));
+#else
+		std::reverse_copy(encodedInteger, encodedInteger+byteCount, block.begin());
+#endif
+		Decode(block.begin(), block.size(), s);
+		return;
+	}
+}
+
+Integer::Integer(BufferedTransformation &bt)
+{
+	// Make explicit call to avoid virtual-dispatch findings in ctor
+	Integer::BERDecode(bt);
+}
+
+Integer::Integer(RandomNumberGenerator &rng, size_t bitcount)
+{
+	Randomize(rng, bitcount);
+}
+
+Integer::Integer(RandomNumberGenerator &rng, const Integer &min, const Integer &max, RandomNumberType rnType, const Integer &equiv, const Integer &mod)
+{
+	if (!Randomize(rng, min, max, rnType, equiv, mod))
+		throw Integer::RandomNumberNotFound();
+}
+
+Integer Integer::Power2(size_t e)
+{
+	Integer r((word)0, BitsToWords(e+1));
+	r.SetBit(e);
+	return r;
+}
+
+bool Integer::operator!() const
+{
+	return IsNegative() ? false : (reg[0]==0 && WordCount()==0);
+}
+
+Integer& Integer::operator=(const Integer& t)
+{
+	if (this != &t)
+	{
+		if (reg.size() != t.reg.size() || t.reg[t.reg.size()/2] == 0)
+			reg.New(RoundupSize(t.WordCount()));
+		CopyWords(reg, t.reg, reg.size());
+		sign = t.sign;
+	}
+	return *this;
+}
+
+bool Integer::GetBit(size_t n) const
+{
+	// Profiling guided the flow below.
+	if (n/WORD_BITS < reg.size())
+		return bool((reg[n/WORD_BITS] >> (n % WORD_BITS)) & 1);
+	else
+		return 0;
+}
+
+void Integer::SetBit(size_t n, bool value)
+{
+	if (value)
+	{
+		reg.CleanGrow(RoundupSize(BitsToWords(n+1)));
+		reg[n/WORD_BITS] |= (word(1) << (n%WORD_BITS));
+	}
+	else
+	{
+		if (n/WORD_BITS < reg.size())
+			reg[n/WORD_BITS] &= ~(word(1) << (n%WORD_BITS));
+	}
+}
+
+byte Integer::GetByte(size_t n) const
+{
+	// Profiling guided the flow below.
+	if (n/WORD_SIZE < reg.size())
+		return byte(reg[n/WORD_SIZE] >> ((n%WORD_SIZE)*8));
+	else
+		return 0;
+}
+
+void Integer::SetByte(size_t n, byte value)
+{
+	reg.CleanGrow(RoundupSize(BytesToWords(n+1)));
+	reg[n/WORD_SIZE] &= ~(word(0xff) << 8*(n%WORD_SIZE));
+	reg[n/WORD_SIZE] |= (word(value) << 8*(n%WORD_SIZE));
+}
+
+lword Integer::GetBits(size_t i, size_t n) const
+{
+	lword v = 0;
+	CRYPTOPP_ASSERT(n <= sizeof(v)*8);
+	for (unsigned int j=0; j<n; j++)
+		v |= lword(GetBit(i+j)) << j;
+	return v;
+}
+
+Integer Integer::operator-() const
+{
+	Integer result(*this);
+	result.Negate();
+	return result;
+}
+
+Integer Integer::AbsoluteValue() const
+{
+	Integer result(*this);
+	result.sign = POSITIVE;
+	return result;
+}
+
+void Integer::swap(Integer &a)
+{
+	reg.swap(a.reg);
+	std::swap(sign, a.sign);
+}
+
+Integer::Integer(word value, size_t length)
+	: reg(RoundupSize(length)), sign(POSITIVE)
+{
+	reg[0] = value;
+	SetWords(reg+1, 0, reg.size()-1);
+}
+
+template <class T>
+static Integer StringToInteger(const T *str, ByteOrder order)
+{
+	CRYPTOPP_ASSERT( order == BIG_ENDIAN_ORDER || order == LITTLE_ENDIAN_ORDER );
+
+	int radix, sign = 1;
+	// GCC workaround
+	// std::char_traits<wchar_t>::length() not defined in GCC 3.2 and STLport 4.5.3
+	unsigned int length;
+	for (length = 0; str[length] != 0; length++) {}
+
+	Integer v;
+
+	if (length == 0)
+		return Integer::Zero();
+
+	// 'str' is of length 1 or more
+	switch (str[length-1])
+	{
+	case 'h':
+	case 'H':
+		radix=16;
+		break;
+	case 'o':
+	case 'O':
+		radix=8;
+		break;
+	case 'b':
+	case 'B':
+		radix=2;
+		break;
+	default:
+		radix=10;
+	}
+
+	// 'str' is of length 1 or more
+	if (str[0] == '-')
+	{
+		sign = -1;
+		str += 1, length -= 1;
+	}
+
+	// Recognize common prefixes for hexadecimal, octal and decimal.
+	// Microsoft's MASM also recognizes 0t for octal, but not here.
+	if (length > 2 && str[0] == '0')
+	{
+		if (str[1] == 'x' || str[1] == 'X')
+		{
+			radix = 16;
+			str += 2, length -= 2;
+		}
+		else if (str[1] == 'n' || str[1] == 'N')
+		{
+			radix = 10;
+			str += 2, length -= 2;
+		}
+		else if (str[1] == 'o' || str[1] == 'O')
+		{
+			radix = 8;
+			str += 2, length -= 2;
+		}
+	}
+
+	if (order == BIG_ENDIAN_ORDER)
+	{
+		for (unsigned int i=0; i<length; i++)
+		{
+			int digit, ch = static_cast<int>(str[i]);
+
+			// Profiling guided the flow below.
+			if (ch >= '0' && ch <= '9')
+				digit = ch - '0';
+			else if (ch >= 'a' && ch <= 'f')
+				digit = ch - 'a' + 10;
+			else if (ch >= 'A' && ch <= 'F')
+				digit = ch - 'A' + 10;
+			else
+				digit = radix;
+
+			if (digit < radix)
+			{
+				v *= radix;
+				v += digit;
+			}
+		}
+	}
+	else if (radix == 16 && order == LITTLE_ENDIAN_ORDER)
+	{
+		// Nibble high, low and count
+		unsigned int nh = 0, nl = 0, nc = 0;
+		Integer position(Integer::One());
+
+		for (unsigned int i=0; i<length; i++)
+		{
+			int digit, ch = static_cast<int>(str[i]);
+
+			if (ch >= '0' && ch <= '9')
+				digit = ch - '0';
+			else if (ch >= 'a' && ch <= 'f')
+				digit = ch - 'a' + 10;
+			else if (ch >= 'A' && ch <= 'F')
+				digit = ch - 'A' + 10;
+			else
+				digit = radix;
+
+			if (digit < radix)
+			{
+				if (nc++ == 0)
+					nh = digit;
+				else
+					nl = digit;
+
+				if (nc == 2)
+				{
+					v += position * (nh << 4 | nl);
+					nc = 0, position <<= 8;
+				}
+			}
+		}
+
+		if (nc == 1)
+			v += nh * position;
+	}
+	else // LITTLE_ENDIAN_ORDER && radix != 16
+	{
+		for (int i=static_cast<int>(length)-1; i>=0; i--)
+		{
+			int digit, ch = static_cast<int>(str[i]);
+
+			if (ch >= '0' && ch <= '9')
+				digit = ch - '0';
+			else if (ch >= 'a' && ch <= 'f')
+				digit = ch - 'a' + 10;
+			else if (ch >= 'A' && ch <= 'F')
+				digit = ch - 'A' + 10;
+			else
+				digit = radix;
+
+			if (digit < radix)
+			{
+				v *= radix;
+				v += digit;
+			}
+		}
+	}
+
+	if (sign == -1)
+		v.Negate();
+
+	return v;
+}
+
+Integer::Integer(const char *str, ByteOrder order)
+	: reg(2), sign(POSITIVE)
+{
+	*this = StringToInteger(str,order);
+}
+
+Integer::Integer(const wchar_t *str, ByteOrder order)
+	: reg(2), sign(POSITIVE)
+{
+	*this = StringToInteger(str,order);
+}
+
+unsigned int Integer::WordCount() const
+{
+	return (unsigned int)CountWords(reg, reg.size());
+}
+
+unsigned int Integer::ByteCount() const
+{
+	unsigned wordCount = WordCount();
+	if (wordCount)
+		return (wordCount-1)*WORD_SIZE + BytePrecision(reg[wordCount-1]);
+	else
+		return 0;
+}
+
+unsigned int Integer::BitCount() const
+{
+	unsigned wordCount = WordCount();
+	if (wordCount)
+		return (wordCount-1)*WORD_BITS + BitPrecision(reg[wordCount-1]);
+	else
+		return 0;
+}
+
+void Integer::Decode(const byte *input, size_t inputLen, Signedness s)
+{
+	CRYPTOPP_ASSERT(input && inputLen); // NULL buffer
+	StringStore store(input, inputLen);
+	Decode(store, inputLen, s);
+}
+
+void Integer::Decode(BufferedTransformation &bt, size_t inputLen, Signedness s)
+{
+	CRYPTOPP_ASSERT(bt.MaxRetrievable() >= inputLen);
+	if (bt.MaxRetrievable() < inputLen)
+		throw InvalidArgument("Integer: input length is too small");
+
+	byte b;
+	bt.Peek(b);
+	sign = ((s==SIGNED) && (b & 0x80)) ? NEGATIVE : POSITIVE;
+
+	while (inputLen>0 && (sign==POSITIVE ? b==0 : b==0xff))
+	{
+		bt.Skip(1);
+		inputLen--;
+		bt.Peek(b);
+	}
+
+	reg.CleanNew(RoundupSize(BytesToWords(inputLen)));
+	for (size_t i=inputLen; i > 0; i--)
+	{
+		(void)bt.Get(b);
+		reg[(i-1)/WORD_SIZE] |= word(b) << ((i-1)%WORD_SIZE)*8;
+	}
+
+	if (sign == NEGATIVE)
+	{
+		for (size_t i=inputLen; i<reg.size()*WORD_SIZE; i++)
+			reg[i/WORD_SIZE] |= word(0xff) << (i%WORD_SIZE)*8;
+		TwosComplement(reg, reg.size());
+	}
+}
+
+size_t Integer::MinEncodedSize(Signedness signedness) const
+{
+	// Profiling guided the flow below.
+	unsigned int outputLen = STDMAX(1U, ByteCount());
+	const bool pre = (signedness == UNSIGNED);
+	if (!pre && NotNegative() && (GetByte(outputLen-1) & 0x80))
+		outputLen++;
+	if (pre)
+		return outputLen;
+	if (IsNegative() && *this < -Power2(outputLen*8-1))
+		outputLen++;
+	return outputLen;
+}
+
+// PKCS12_PBKDF and other classes use undersized buffers
+void Integer::Encode(byte *output, size_t outputLen, Signedness signedness) const
+{
+	CRYPTOPP_ASSERT(output && outputLen);            // NULL buffer
+	ArraySink sink(output, outputLen);
+	Encode(sink, outputLen, signedness);
+}
+
+void Integer::Encode(BufferedTransformation &bt, size_t outputLen, Signedness signedness) const
+{
+	if (signedness == UNSIGNED || NotNegative())
+	{
+		for (size_t i=outputLen; i > 0; i--)
+			bt.Put(GetByte(i-1));
+	}
+	else
+	{
+		// take two's complement of *this
+		Integer temp = Integer::Power2(8*STDMAX((size_t)ByteCount(), outputLen)) + *this;
+		temp.Encode(bt, outputLen, UNSIGNED);
+	}
+}
+
+void Integer::DEREncode(BufferedTransformation &bt) const
+{
+	DERGeneralEncoder enc(bt, INTEGER);
+	Encode(enc, MinEncodedSize(SIGNED), SIGNED);
+	enc.MessageEnd();
+}
+
+void Integer::BERDecode(const byte *input, size_t len)
+{
+	CRYPTOPP_ASSERT(input && len); // NULL buffer
+	StringStore store(input, len);
+	BERDecode(store);
+}
+
+void Integer::BERDecode(BufferedTransformation &bt)
+{
+	BERGeneralDecoder dec(bt, INTEGER);
+	if (!dec.IsDefiniteLength() || dec.MaxRetrievable() < dec.RemainingLength())
+		BERDecodeError();
+	Decode(dec, (size_t)dec.RemainingLength(), SIGNED);
+	dec.MessageEnd();
+}
+
+void Integer::DEREncodeAsOctetString(BufferedTransformation &bt, size_t length) const
+{
+	DERGeneralEncoder enc(bt, OCTET_STRING);
+	Encode(enc, length);
+	enc.MessageEnd();
+}
+
+void Integer::BERDecodeAsOctetString(BufferedTransformation &bt, size_t length)
+{
+	BERGeneralDecoder dec(bt, OCTET_STRING);
+	if (!dec.IsDefiniteLength() || dec.RemainingLength() != length)
+		BERDecodeError();
+	Decode(dec, length);
+	dec.MessageEnd();
+}
+
+size_t Integer::OpenPGPEncode(byte *output, size_t bufferSize) const
+{
+	CRYPTOPP_ASSERT(output && bufferSize);         // NULL buffer
+	CRYPTOPP_ASSERT(bufferSize >= 2+ByteCount());  // Undersized buffer
+	ArraySink sink(output, bufferSize);
+	return OpenPGPEncode(sink);
+}
+
+size_t Integer::OpenPGPEncode(BufferedTransformation &bt) const
+{
+	word16 bitCount = word16(BitCount());
+	bt.PutWord16(bitCount);
+	size_t byteCount = BitsToBytes(bitCount);
+	Encode(bt, byteCount);
+	return 2 + byteCount;
+}
+
+void Integer::OpenPGPDecode(const byte *input, size_t len)
+{
+	CRYPTOPP_ASSERT(input && len);  // NULL buffer
+	StringStore store(input, len);
+	OpenPGPDecode(store);
+}
+
+void Integer::OpenPGPDecode(BufferedTransformation &bt)
+{
+	word16 bitCount;
+	if (bt.GetWord16(bitCount) != 2 || bt.MaxRetrievable() < BitsToBytes(bitCount))
+		throw OpenPGPDecodeErr();
+	Decode(bt, BitsToBytes(bitCount));
+}
+
+void Integer::Randomize(RandomNumberGenerator &rng, size_t nbits)
+{
+	const size_t nbytes = nbits/8 + 1;
+	SecByteBlock buf(nbytes);
+	rng.GenerateBlock(buf, nbytes);
+
+	// https://github.com/weidai11/cryptopp/issues/1206
+	// if (nbytes)
+	//     buf[0] = (byte)Crop(buf[0], nbits % 8);
+
+	buf[0] = (byte)Crop(buf[0], nbits % 8);
+	Decode(buf, nbytes, UNSIGNED);
+}
+
+void Integer::Randomize(RandomNumberGenerator &rng, const Integer &min, const Integer &max)
+{
+	if (min > max)
+		throw InvalidArgument("Integer: Min must be no greater than Max");
+
+	Integer range = max - min;
+	const unsigned int nbits = range.BitCount();
+
+	do
+	{
+		Randomize(rng, nbits);
+	}
+	while (*this > range);
+
+	*this += min;
+}
+
+bool Integer::Randomize(RandomNumberGenerator &rng, const Integer &min, const Integer &max, RandomNumberType rnType, const Integer &equiv, const Integer &mod)
+{
+	return GenerateRandomNoThrow(rng, MakeParameters("Min", min)("Max", max)
+		("RandomNumberType", rnType)("EquivalentTo", equiv)("Mod", mod));
+}
+
+class KDF2_RNG : public RandomNumberGenerator
+{
+public:
+	KDF2_RNG(const byte *seed, size_t seedSize)
+		: m_counter(0), m_counterAndSeed(ClampSize(seedSize) + 4)
+	{
+		std::memcpy(m_counterAndSeed + 4, seed, ClampSize(seedSize));
+	}
+
+	void GenerateBlock(byte *output, size_t size)
+	{
+		CRYPTOPP_ASSERT(output && size); // NULL buffer
+		PutWord(false, BIG_ENDIAN_ORDER, m_counterAndSeed, m_counter);
+		++m_counter;
+		P1363_KDF2<SHA1>::DeriveKey(output, size, m_counterAndSeed, m_counterAndSeed.size(), NULLPTR, 0);
+	}
+
+	// UBsan finding, -Wstringop-overflow
+	inline size_t ClampSize(size_t req) const
+	{
+		// Clamp at 16 MB
+		if (req > 16U*1024*1024)
+			return 16U*1024*1024;
+		return req;
+	}
+
+private:
+	word32 m_counter;
+	SecByteBlock m_counterAndSeed;
+};
+
+bool Integer::GenerateRandomNoThrow(RandomNumberGenerator &i_rng, const NameValuePairs &params)
+{
+	Integer min = params.GetValueWithDefault("Min", Integer::Zero());
+	Integer max;
+	if (!params.GetValue("Max", max))
+	{
+		int bitLength;
+		if (params.GetIntValue("BitLength", bitLength))
+			max = Integer::Power2(bitLength);
+		else
+			throw InvalidArgument("Integer: missing Max argument");
+	}
+	if (min > max)
+		throw InvalidArgument("Integer: Min must be no greater than Max");
+
+	Integer equiv = params.GetValueWithDefault("EquivalentTo", Integer::Zero());
+	Integer mod = params.GetValueWithDefault("Mod", Integer::One());
+
+	if (equiv.IsNegative() || equiv >= mod)
+		throw InvalidArgument("Integer: invalid EquivalentTo and/or Mod argument");
+
+	Integer::RandomNumberType rnType = params.GetValueWithDefault("RandomNumberType", Integer::ANY);
+
+	member_ptr<KDF2_RNG> kdf2Rng;
+	ConstByteArrayParameter seed;
+	if (params.GetValue(Name::Seed(), seed))
+	{
+		ByteQueue bq;
+		DERSequenceEncoder seq(bq);
+		min.DEREncode(seq);
+		max.DEREncode(seq);
+		equiv.DEREncode(seq);
+		mod.DEREncode(seq);
+		DEREncodeUnsigned(seq, rnType);
+		DEREncodeOctetString(seq, seed.begin(), seed.size());
+		seq.MessageEnd();
+
+		SecByteBlock finalSeed((size_t)bq.MaxRetrievable());
+		bq.Get(finalSeed, finalSeed.size());
+		kdf2Rng.reset(new KDF2_RNG(finalSeed.begin(), finalSeed.size()));
+	}
+	RandomNumberGenerator &rng = kdf2Rng.get() ? (RandomNumberGenerator &)*kdf2Rng : i_rng;
+
+	switch (rnType)
+	{
+		case ANY:
+			if (mod == One())
+				Randomize(rng, min, max);
+			else
+			{
+				Integer min1 = min + (equiv-min)%mod;
+				if (max < min1)
+					return false;
+				Randomize(rng, Zero(), (max - min1) / mod);
+				*this *= mod;
+				*this += min1;
+			}
+			return true;
+
+		case PRIME:
+		{
+			const PrimeSelector *pSelector = params.GetValueWithDefault(Name::PointerToPrimeSelector(), (const PrimeSelector *)NULLPTR);
+
+			int i;
+			i = 0;
+			while (1)
+			{
+				if (++i==16)
+				{
+					// check if there are any suitable primes in [min, max]
+					Integer first = min;
+					if (FirstPrime(first, max, equiv, mod, pSelector))
+					{
+						// if there is only one suitable prime, we're done
+						*this = first;
+						if (!FirstPrime(first, max, equiv, mod, pSelector))
+							return true;
+					}
+					else
+						return false;
+				}
+
+				Randomize(rng, min, max);
+				if (FirstPrime(*this, STDMIN(*this+mod*PrimeSearchInterval(max), max), equiv, mod, pSelector))
+					return true;
+			}
+		}
+
+		default:
+			throw InvalidArgument("Integer: invalid RandomNumberType argument");
+	}
+}
+
+std::istream& operator>>(std::istream& in, Integer &a)
+{
+	char c;
+	unsigned int length = 0;
+	SecBlock<char> str(length + 16);
+
+	std::ws(in);
+
+	do
+	{
+		in.read(&c, 1);
+		str[length++] = c;
+		if (length >= str.size())
+			str.Grow(length + 16);
+	}
+	while (in && (c=='-' || c=='x' || (c>='0' && c<='9') || (c>='a' && c<='f') || (c>='A' && c<='F') || c=='h' || c=='H' || c=='o' || c=='O' || c==',' || c=='.'));
+
+	if (in.gcount())
+		in.putback(c);
+	str[length-1] = '\0';
+	a = Integer(str);
+
+	return in;
+}
+
+// Ensure base 10 is default
+inline int FlagToBase(long f) {
+	return f == std::ios::hex ? 16 : (f == std::ios::oct ? 8 : 10);
+}
+
+inline char FlagToSuffix(long f) {
+	return f == std::ios::hex ? 'h' : (f == std::ios::oct ? 'o' : '.');
+}
+
+// Ensure base 10 is default
+std::ostream& operator<<(std::ostream& out, const Integer &a)
+{
+	// Get relevant conversion specifications from ostream.
+	const long f = out.flags() & std::ios::basefield;
+	const int base = FlagToBase(f);
+	const char suffix = FlagToSuffix(f);
+
+	Integer temp1=a, temp2;
+	if (a.IsNegative())
+	{
+		out << '-';
+		temp1.Negate();
+	}
+
+	if (!a)
+		out << '0';
+
+	static const char upper[]="0123456789ABCDEF";
+	static const char lower[]="0123456789abcdef";
+
+	const char* vec = (out.flags() & std::ios::uppercase) ? upper : lower;
+	unsigned int i=0;
+	SecBlock<char> s(a.BitCount() / (SaturatingSubtract1(BitPrecision(base),1U)) + 1);
+
+	while (!!temp1)
+	{
+		word digit;
+		Integer::Divide(digit, temp2, temp1, base);
+		s[i++]=vec[digit];
+		temp1.swap(temp2);
+	}
+
+	while (i--)
+	{
+		out << s[i];
+	}
+
+#ifdef CRYPTOPP_USE_STD_SHOWBASE
+	if (out.flags() & std::ios_base::showbase)
+		out << suffix;
+
+	return out;
+#else
+ 	return out << suffix;
+#endif
+}
+
+Integer& Integer::operator++()
+{
+	if (NotNegative())
+	{
+		if (Increment(reg, reg.size()))
+		{
+			reg.CleanGrow(2*reg.size());
+			reg[reg.size()/2]=1;
+		}
+	}
+	else
+	{
+		word borrow = Decrement(reg, reg.size());
+		CRYPTOPP_ASSERT(!borrow); CRYPTOPP_UNUSED(borrow);
+
+		if (WordCount()==0)
+			*this = Zero();
+	}
+	return *this;
+}
+
+Integer& Integer::operator--()
+{
+	if (IsNegative())
+	{
+		if (Increment(reg, reg.size()))
+		{
+			reg.CleanGrow(2*reg.size());
+			reg[reg.size()/2]=1;
+		}
+	}
+	else
+	{
+		if (Decrement(reg, reg.size()))
+			*this = -One();
+	}
+	return *this;
+}
+
+// This is a bit operation. We set sign to POSITIVE, so there's no need to
+//  worry about negative zero. Also see http://stackoverflow.com/q/11644362.
+Integer Integer::And(const Integer& t) const
+{
+	// Grow due to https://github.com/weidai11/cryptopp/issues/1072
+	// The temporary Integer 'result' may have fewer blocks than
+	// 'this' or 't', if leading 0-blocks are trimmed in copy ctor.
+
+	if (this == &t)
+	{
+		return AbsoluteValue();
+	}
+	else if (reg.size() >= t.reg.size())
+	{
+		IntegerSecBlock temp(t.reg.size());
+		// AndWords(temp, reg, t.reg, t.reg.size());
+		for (size_t i=0; i<t.reg.size(); ++i)
+			temp[i] = reg[i] & t.reg[i];
+
+		Integer result;
+		std::swap(result.reg, temp);
+
+		return result;
+	}
+	else // reg.size() < t.reg.size()
+	{
+		IntegerSecBlock temp(reg.size());
+		// AndWords(temp, reg, t.reg, reg.size());
+		for (size_t i=0; i<reg.size(); ++i)
+			temp[i] = reg[i] & t.reg[i];
+
+		Integer result;
+		std::swap(result.reg, temp);
+
+		return result;
+	}
+}
+
+// This is a bit operation. We set sign to POSITIVE, so there's no need to
+//  worry about negative zero. Also see http://stackoverflow.com/q/11644362.
+Integer Integer::Or(const Integer& t) const
+{
+	// Grow due to https://github.com/weidai11/cryptopp/issues/1072
+	// The temporary Integer 'result' may have fewer blocks than
+	// 'this' or 't', if leading 0-blocks are trimmed in copy ctor.
+
+	if (this == &t)
+	{
+		return AbsoluteValue();
+	}
+	else if (reg.size() >= t.reg.size())
+	{
+		IntegerSecBlock temp(reg, reg.size());
+		// OrWords(temp, t.reg, t.reg.size());
+		for (size_t i=0; i<t.reg.size(); ++i)
+			temp[i] |= t.reg[i];
+
+		Integer result;
+		std::swap(result.reg, temp);
+
+		return result;
+	}
+	else // reg.size() < t.reg.size()
+	{
+		IntegerSecBlock temp(t.reg, t.reg.size());
+		// OrWords(temp, reg, reg.size());
+		for (size_t i=0; i<reg.size(); ++i)
+			temp[i] |= reg[i];
+
+		Integer result;
+		std::swap(result.reg, temp);
+
+		return result;
+	}
+}
+
+// This is a bit operation. We set sign to POSITIVE, so there's no need to
+//  worry about negative zero. Also see http://stackoverflow.com/q/11644362.
+Integer Integer::Xor(const Integer& t) const
+{
+	// Grow due to https://github.com/weidai11/cryptopp/issues/1072
+	// The temporary Integer 'result' may have fewer blocks than
+	// 'this' or 't', if leading 0-blocks are trimmed in copy ctor.
+
+	if (this == &t)
+	{
+		return Integer::Zero();
+	}
+	else if (reg.size() >= t.reg.size())
+	{
+		IntegerSecBlock temp(reg, reg.size());
+		// OrWords(temp, t.reg, t.reg.size());
+		for (size_t i=0; i<t.reg.size(); ++i)
+			temp[i] ^= t.reg[i];
+
+		Integer result;
+		std::swap(result.reg, temp);
+
+		return result;
+	}
+	else // reg.size() < t.reg.size()
+	{
+		IntegerSecBlock temp(t.reg, t.reg.size());
+		// OrWords(temp, reg, reg.size());
+		for (size_t i=0; i<reg.size(); ++i)
+			temp[i] ^= reg[i];
+
+		Integer result;
+		std::swap(result.reg, temp);
+
+		return result;
+	}
+}
+
+void PositiveAdd(Integer &sum, const Integer &a, const Integer& b)
+{
+	// Profiling guided the flow below.
+	int carry; const bool pre = (a.reg.size() == b.reg.size());
+	if (!pre && a.reg.size() > b.reg.size())
+	{
+		carry = Add(sum.reg, a.reg, b.reg, b.reg.size());
+		CopyWords(sum.reg+b.reg.size(), a.reg+b.reg.size(), a.reg.size()-b.reg.size());
+		carry = Increment(sum.reg+b.reg.size(), a.reg.size()-b.reg.size(), carry);
+	}
+	else if (pre)
+	{
+		carry = Add(sum.reg, a.reg, b.reg, a.reg.size());
+	}
+	else
+	{
+		carry = Add(sum.reg, a.reg, b.reg, a.reg.size());
+		CopyWords(sum.reg+a.reg.size(), b.reg+a.reg.size(), b.reg.size()-a.reg.size());
+		carry = Increment(sum.reg+a.reg.size(), b.reg.size()-a.reg.size(), carry);
+	}
+
+	if (carry)
+	{
+		sum.reg.CleanGrow(2*sum.reg.size());
+		sum.reg[sum.reg.size()/2] = 1;
+	}
+	sum.sign = Integer::POSITIVE;
+}
+
+void PositiveSubtract(Integer &diff, const Integer &a, const Integer& b)
+{
+	unsigned aSize = a.WordCount();
+	aSize += aSize%2;
+	unsigned bSize = b.WordCount();
+	bSize += bSize%2;
+
+	// Profiling guided the flow below.
+	if (aSize > bSize)
+	{
+		word borrow = Subtract(diff.reg, a.reg, b.reg, bSize);
+		CopyWords(diff.reg+bSize, a.reg+bSize, aSize-bSize);
+		borrow = Decrement(diff.reg+bSize, aSize-bSize, borrow);
+		CRYPTOPP_ASSERT(!borrow); CRYPTOPP_UNUSED(borrow);
+		diff.sign = Integer::POSITIVE;
+	}
+	else if (aSize == bSize)
+	{
+		if (Compare(a.reg, b.reg, aSize) >= 0)
+		{
+			Subtract(diff.reg, a.reg, b.reg, aSize);
+			diff.sign = Integer::POSITIVE;
+		}
+		else
+		{
+			Subtract(diff.reg, b.reg, a.reg, aSize);
+			diff.sign = Integer::NEGATIVE;
+		}
+	}
+	else
+	{
+		word borrow = Subtract(diff.reg, b.reg, a.reg, aSize);
+		CopyWords(diff.reg+aSize, b.reg+aSize, bSize-aSize);
+		borrow = Decrement(diff.reg+aSize, bSize-aSize, borrow);
+		CRYPTOPP_ASSERT(!borrow); CRYPTOPP_UNUSED(borrow);
+		diff.sign = Integer::NEGATIVE;
+	}
+}
+
+// MSVC .NET 2003 workaround
+template <class T> inline const T& STDMAX2(const T& a, const T& b)
+{
+	return a < b ? b : a;
+}
+
+Integer Integer::Plus(const Integer& b) const
+{
+	Integer sum((word)0, STDMAX2(reg.size(), b.reg.size()));
+	if (NotNegative())
+	{
+		if (b.NotNegative())
+			PositiveAdd(sum, *this, b);
+		else
+			PositiveSubtract(sum, *this, b);
+	}
+	else
+	{
+		if (b.NotNegative())
+			PositiveSubtract(sum, b, *this);
+		else
+		{
+			PositiveAdd(sum, *this, b);
+			sum.sign = Integer::NEGATIVE;
+		}
+	}
+	return sum;
+}
+
+Integer& Integer::operator+=(const Integer& t)
+{
+	reg.CleanGrow(t.reg.size());
+	if (NotNegative())
+	{
+		if (t.NotNegative())
+			PositiveAdd(*this, *this, t);
+		else
+			PositiveSubtract(*this, *this, t);
+	}
+	else
+	{
+		if (t.NotNegative())
+			PositiveSubtract(*this, t, *this);
+		else
+		{
+			PositiveAdd(*this, *this, t);
+			sign = Integer::NEGATIVE;
+		}
+	}
+	return *this;
+}
+
+Integer Integer::Minus(const Integer& b) const
+{
+	Integer diff((word)0, STDMAX2(reg.size(), b.reg.size()));
+	if (NotNegative())
+	{
+		if (b.NotNegative())
+			PositiveSubtract(diff, *this, b);
+		else
+			PositiveAdd(diff, *this, b);
+	}
+	else
+	{
+		if (b.NotNegative())
+		{
+			PositiveAdd(diff, *this, b);
+			diff.sign = Integer::NEGATIVE;
+		}
+		else
+			PositiveSubtract(diff, b, *this);
+	}
+	return diff;
+}
+
+Integer& Integer::operator-=(const Integer& t)
+{
+	reg.CleanGrow(t.reg.size());
+	if (NotNegative())
+	{
+		if (t.NotNegative())
+			PositiveSubtract(*this, *this, t);
+		else
+			PositiveAdd(*this, *this, t);
+	}
+	else
+	{
+		if (t.NotNegative())
+		{
+			PositiveAdd(*this, *this, t);
+			sign = Integer::NEGATIVE;
+		}
+		else
+			PositiveSubtract(*this, t, *this);
+	}
+	return *this;
+}
+
+Integer& Integer::operator<<=(size_t n)
+{
+	const size_t wordCount = WordCount();
+	const size_t shiftWords = n / WORD_BITS;
+	const unsigned int shiftBits = (unsigned int)(n % WORD_BITS);
+
+	reg.CleanGrow(RoundupSize(wordCount+BitsToWords(n)));
+	ShiftWordsLeftByWords(reg, wordCount + shiftWords, shiftWords);
+	ShiftWordsLeftByBits(reg+shiftWords, wordCount+BitsToWords(shiftBits), shiftBits);
+	return *this;
+}
+
+Integer& Integer::operator>>=(size_t n)
+{
+	const size_t wordCount = WordCount();
+	const size_t shiftWords = n / WORD_BITS;
+	const unsigned int shiftBits = (unsigned int)(n % WORD_BITS);
+
+	ShiftWordsRightByWords(reg, wordCount, shiftWords);
+	if (wordCount > shiftWords)
+		ShiftWordsRightByBits(reg, wordCount-shiftWords, shiftBits);
+	if (IsNegative() && WordCount()==0)   // avoid -0
+		*this = Zero();
+	return *this;
+}
+
+Integer& Integer::operator&=(const Integer& t)
+{
+	if (this != &t)
+	{
+		const size_t size = STDMIN(reg.size(), t.reg.size());
+		reg.resize(size);
+		AndWords(reg, t.reg, size);
+	}
+	sign = POSITIVE;
+	return *this;
+}
+
+Integer& Integer::operator|=(const Integer& t)
+{
+	if (this != &t)
+	{
+		if (reg.size() >= t.reg.size())
+		{
+			OrWords(reg, t.reg, t.reg.size());
+		}
+		else  // reg.size() < t.reg.size()
+		{
+			const size_t head = reg.size();
+			const size_t tail = t.reg.size() - reg.size();
+			reg.resize(head+tail);
+			OrWords(reg, t.reg, head);
+			CopyWords(reg+head,t.reg+head,tail);
+		}
+	}
+	sign = POSITIVE;
+	return *this;
+}
+
+Integer& Integer::operator^=(const Integer& t)
+{
+	if (this == &t)
+	{
+		*this = Zero();
+	}
+	else
+	{
+		if (reg.size() >= t.reg.size())
+		{
+			XorWords(reg, t.reg, t.reg.size());
+		}
+		else  // reg.size() < t.reg.size()
+		{
+			const size_t head = reg.size();
+			const size_t tail = t.reg.size() - reg.size();
+			reg.resize(head+tail);
+			XorWords(reg, t.reg, head);
+			CopyWords(reg+head,t.reg+head,tail);
+		}
+	}
+	sign = POSITIVE;
+	return *this;
+}
+
+void PositiveMultiply(Integer &product, const Integer &a, const Integer &b)
+{
+	size_t aSize = RoundupSize(a.WordCount());
+	size_t bSize = RoundupSize(b.WordCount());
+
+	product.reg.CleanNew(RoundupSize(aSize+bSize));
+	product.sign = Integer::POSITIVE;
+
+	IntegerSecBlock workspace(aSize + bSize);
+	AsymmetricMultiply(product.reg, workspace, a.reg, aSize, b.reg, bSize);
+}
+
+void Multiply(Integer &product, const Integer &a, const Integer &b)
+{
+	PositiveMultiply(product, a, b);
+
+	if (a.NotNegative() != b.NotNegative())
+		product.Negate();
+}
+
+Integer Integer::Times(const Integer &b) const
+{
+	Integer product;
+	Multiply(product, *this, b);
+	return product;
+}
+
+/*
+void PositiveDivide(Integer &remainder, Integer &quotient,
+				   const Integer &dividend, const Integer &divisor)
+{
+	remainder.reg.CleanNew(divisor.reg.size());
+	remainder.sign = Integer::POSITIVE;
+	quotient.reg.New(0);
+	quotient.sign = Integer::POSITIVE;
+	unsigned i=dividend.BitCount();
+	while (i--)
+	{
+		word overflow = ShiftWordsLeftByBits(remainder.reg, remainder.reg.size(), 1);
+		remainder.reg[0] |= dividend[i];
+		if (overflow || remainder >= divisor)
+		{
+			Subtract(remainder.reg, remainder.reg, divisor.reg, remainder.reg.size());
+			quotient.SetBit(i);
+		}
+	}
+}
+*/
+
+void PositiveDivide(Integer &remainder, Integer &quotient,
+				   const Integer &a, const Integer &b)
+{
+	unsigned aSize = a.WordCount();
+	unsigned bSize = b.WordCount();
+
+	if (!bSize)
+		throw Integer::DivideByZero();
+
+	if (aSize < bSize)
+	{
+		remainder = a;
+		remainder.sign = Integer::POSITIVE;
+		quotient = Integer::Zero();
+		return;
+	}
+
+	aSize += aSize%2;	// round up to next even number
+	bSize += bSize%2;
+
+	remainder.reg.CleanNew(RoundupSize(bSize));
+	remainder.sign = Integer::POSITIVE;
+	quotient.reg.CleanNew(RoundupSize(aSize-bSize+2));
+	quotient.sign = Integer::POSITIVE;
+
+	IntegerSecBlock T(aSize+3*(bSize+2));
+	Divide(remainder.reg, quotient.reg, T, a.reg, aSize, b.reg, bSize);
+}
+
+void Integer::Divide(Integer &remainder, Integer &quotient, const Integer &dividend, const Integer &divisor)
+{
+	PositiveDivide(remainder, quotient, dividend, divisor);
+
+	if (dividend.IsNegative())
+	{
+		quotient.Negate();
+		if (remainder.NotZero())
+		{
+			--quotient;
+			remainder = divisor.AbsoluteValue() - remainder;
+		}
+	}
+
+	if (divisor.IsNegative())
+		quotient.Negate();
+}
+
+void Integer::DivideByPowerOf2(Integer &r, Integer &q, const Integer &a, unsigned int n)
+{
+	q = a;
+	q >>= n;
+
+	const size_t wordCount = BitsToWords(n);
+	if (wordCount <= a.WordCount())
+	{
+		r.reg.resize(RoundupSize(wordCount));
+		CopyWords(r.reg, a.reg, wordCount);
+		SetWords(r.reg+wordCount, 0, r.reg.size()-wordCount);
+		if (n % WORD_BITS != 0)
+			r.reg[wordCount-1] %= (word(1) << (n % WORD_BITS));
+	}
+	else
+	{
+		r.reg.resize(RoundupSize(a.WordCount()));
+		CopyWords(r.reg, a.reg, r.reg.size());
+	}
+	r.sign = POSITIVE;
+
+	if (a.IsNegative() && r.NotZero())
+	{
+		--q;
+		r = Power2(n) - r;
+	}
+}
+
+Integer Integer::DividedBy(const Integer &b) const
+{
+	Integer remainder, quotient;
+	Integer::Divide(remainder, quotient, *this, b);
+	return quotient;
+}
+
+Integer Integer::Modulo(const Integer &b) const
+{
+	Integer remainder, quotient;
+	Integer::Divide(remainder, quotient, *this, b);
+	return remainder;
+}
+
+void Integer::Divide(word &remainder, Integer &quotient, const Integer &dividend, word divisor)
+{
+	if (!divisor)
+		throw Integer::DivideByZero();
+
+	// IsPowerOf2 uses BMI on x86 if available. There is a small
+	// but measurable improvement during decryption and signing.
+	if (IsPowerOf2(divisor))
+	{
+		quotient = dividend >> (BitPrecision(divisor)-1);
+		remainder = dividend.reg[0] & (divisor-1);
+		return;
+	}
+
+	unsigned int i = dividend.WordCount();
+	quotient.reg.CleanNew(RoundupSize(i));
+	remainder = 0;
+	while (i--)
+	{
+		quotient.reg[i] = DWord(dividend.reg[i], remainder) / divisor;
+		remainder = DWord(dividend.reg[i], remainder) % divisor;
+	}
+
+	if (dividend.NotNegative())
+		quotient.sign = POSITIVE;
+	else
+	{
+		quotient.sign = NEGATIVE;
+		if (remainder)
+		{
+			--quotient;
+			remainder = divisor - remainder;
+		}
+	}
+}
+
+Integer Integer::DividedBy(word b) const
+{
+	word remainder;
+	Integer quotient;
+	Integer::Divide(remainder, quotient, *this, b);
+	return quotient;
+}
+
+word Integer::Modulo(word divisor) const
+{
+	if (!divisor)
+		throw Integer::DivideByZero();
+
+	word remainder;
+
+	// Profiling guided the flow below.
+	if ((divisor & (divisor-1)) != 0)	// divisor is not a power of 2
+	{
+		// Profiling guided the flow below.
+		unsigned int i = WordCount();
+		if (divisor > 5)
+		{
+			remainder = 0;
+			while (i--)
+				remainder = DWord(reg[i], remainder) % divisor;
+		}
+		else
+		{
+			DWord sum(0, 0);
+			while (i--)
+				sum += reg[i];
+			remainder = sum % divisor;
+		}
+	}
+	else  // divisor is a power of 2
+	{
+		remainder = reg[0] & (divisor-1);
+	}
+
+	if (IsNegative() && remainder)
+		remainder = divisor - remainder;
+
+	return remainder;
+}
+
+void Integer::Negate()
+{
+	if (!!(*this))	// don't flip sign if *this==0
+		sign = Sign(1-sign);
+}
+
+int Integer::PositiveCompare(const Integer& t) const
+{
+	// Profiling guided the flow below.
+	const unsigned size = WordCount(), tSize = t.WordCount();
+	if (size != tSize)
+		return size > tSize ? 1 : -1;
+	else
+		return CryptoPP::Compare(reg, t.reg, size);
+}
+
+int Integer::Compare(const Integer& t) const
+{
+	if (NotNegative())
+	{
+		if (t.NotNegative())
+			return PositiveCompare(t);
+		else
+			return 1;
+	}
+	else
+	{
+		if (t.NotNegative())
+			return -1;
+		else
+			return -PositiveCompare(t);
+	}
+}
+
+Integer Integer::SquareRoot() const
+{
+	if (!IsPositive())
+		return Zero();
+
+	// overestimate square root
+	Integer x, y = Power2((BitCount()+1)/2);
+	CRYPTOPP_ASSERT(y*y >= *this);
+
+	do
+	{
+		x = y;
+		y = (x + *this/x) >> 1;
+	} while (y<x);
+
+	return x;
+}
+
+bool Integer::IsSquare() const
+{
+	Integer r = SquareRoot();
+	return *this == r.Squared();
+}
+
+bool Integer::IsUnit() const
+{
+	return (WordCount() == 1) && (reg[0] == 1);
+}
+
+Integer Integer::MultiplicativeInverse() const
+{
+	return IsUnit() ? *this : Zero();
+}
+
+Integer a_times_b_mod_c(const Integer &x, const Integer& y, const Integer& m)
+{
+	CRYPTOPP_ASSERT(m.NotZero());
+	if (m.IsZero())
+		throw Integer::DivideByZero();
+
+	return x*y%m;
+}
+
+Integer a_exp_b_mod_c(const Integer &x, const Integer& e, const Integer& m)
+{
+	CRYPTOPP_ASSERT(m.NotZero());
+	if (m.IsZero())
+		throw Integer::DivideByZero();
+
+	ModularArithmetic mr(m);
+	return mr.Exponentiate(x, e);
+}
+
+Integer Integer::Gcd(const Integer &a, const Integer &b)
+{
+	return EuclideanDomainOf<Integer>().Gcd(a, b);
+}
+
+Integer Integer::InverseMod(const Integer &m) const
+{
+	CRYPTOPP_ASSERT(m.NotNegative());
+	CRYPTOPP_ASSERT(m.NotZero());
+
+	if (IsNegative())
+		return Modulo(m).InverseModNext(m);
+
+	// http://github.com/weidai11/cryptopp/issues/602
+	if (*this >= m)
+		return Modulo(m).InverseModNext(m);
+
+	return InverseModNext(m);
+}
+
+Integer Integer::InverseModNext(const Integer &m) const
+{
+	CRYPTOPP_ASSERT(m.NotNegative());
+	CRYPTOPP_ASSERT(m.NotZero());
+
+	if (m.IsEven())
+	{
+		if (!m || IsEven())
+			return Zero();	// no inverse
+		if (*this == One())
+			return One();
+
+		Integer u = m.Modulo(*this).InverseModNext(*this);
+		return !u ? Zero() : (m*(*this-u)+1)/(*this);
+	}
+
+	// AlmostInverse requires a 4x workspace
+	IntegerSecBlock T(m.reg.size() * 4);
+	Integer r((word)0, m.reg.size());
+	unsigned k = AlmostInverse(r.reg, T, reg, reg.size(), m.reg, m.reg.size());
+	DivideByPower2Mod(r.reg, r.reg, k, m.reg, m.reg.size());
+	return r;
+}
+
+word Integer::InverseMod(word mod) const
+{
+	CRYPTOPP_ASSERT(mod != 0);
+
+	word g0 = mod, g1 = *this % mod;
+	word v0 = 0, v1 = 1;
+	word y;
+
+	while (g1)
+	{
+		if (g1 == 1)
+			return v1;
+		y = g0 / g1;
+		g0 = g0 % g1;
+		v0 += y * v1;
+
+		if (!g0)
+			break;
+		if (g0 == 1)
+			return mod-v0;
+		y = g1 / g0;
+		g1 = g1 % g0;
+		v1 += y * v0;
+	}
+	return 0;
+}
+
+// ********************************************************
+
+ModularArithmetic::ModularArithmetic(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	OID oid(seq);
+	if (oid != ASN1::prime_field())
+		BERDecodeError();
+	m_modulus.BERDecode(seq);
+	seq.MessageEnd();
+	m_result.reg.resize(m_modulus.reg.size());
+}
+
+void ModularArithmetic::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+	ASN1::prime_field().DEREncode(seq);
+	m_modulus.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+void ModularArithmetic::DEREncodeElement(BufferedTransformation &out, const Element &a) const
+{
+	a.DEREncodeAsOctetString(out, MaxElementByteLength());
+}
+
+void ModularArithmetic::BERDecodeElement(BufferedTransformation &in, Element &a) const
+{
+	a.BERDecodeAsOctetString(in, MaxElementByteLength());
+}
+
+const Integer& ModularArithmetic::Half(const Integer &a) const
+{
+	if (a.reg.size()==m_modulus.reg.size())
+	{
+		CryptoPP::DivideByPower2Mod(m_result.reg.begin(), a.reg, 1, m_modulus.reg, a.reg.size());
+		return m_result;
+	}
+	else
+		return m_result1 = (a.IsEven() ? (a >> 1) : ((a+m_modulus) >> 1));
+}
+
+const Integer& ModularArithmetic::Add(const Integer &a, const Integer &b) const
+{
+	if (a.reg.size()==m_modulus.reg.size() && b.reg.size()==m_modulus.reg.size())
+	{
+		if (CryptoPP::Add(m_result.reg.begin(), a.reg, b.reg, a.reg.size())
+			|| Compare(m_result.reg, m_modulus.reg, a.reg.size()) >= 0)
+		{
+			CryptoPP::Subtract(m_result.reg.begin(), m_result.reg, m_modulus.reg, a.reg.size());
+		}
+		return m_result;
+	}
+	else
+	{
+		m_result1 = a+b;
+		if (m_result1 >= m_modulus)
+			m_result1 -= m_modulus;
+		return m_result1;
+	}
+}
+
+Integer& ModularArithmetic::Accumulate(Integer &a, const Integer &b) const
+{
+	if (a.reg.size()==m_modulus.reg.size() && b.reg.size()==m_modulus.reg.size())
+	{
+		if (CryptoPP::Add(a.reg, a.reg, b.reg, a.reg.size())
+			|| Compare(a.reg, m_modulus.reg, a.reg.size()) >= 0)
+		{
+			CryptoPP::Subtract(a.reg, a.reg, m_modulus.reg, a.reg.size());
+		}
+	}
+	else
+	{
+		a+=b;
+		if (a>=m_modulus)
+			a-=m_modulus;
+	}
+
+	return a;
+}
+
+const Integer& ModularArithmetic::Subtract(const Integer &a, const Integer &b) const
+{
+	if (a.reg.size()==m_modulus.reg.size() && b.reg.size()==m_modulus.reg.size())
+	{
+		if (CryptoPP::Subtract(m_result.reg.begin(), a.reg, b.reg, a.reg.size()))
+			CryptoPP::Add(m_result.reg.begin(), m_result.reg, m_modulus.reg, a.reg.size());
+		return m_result;
+	}
+	else
+	{
+		m_result1 = a-b;
+		if (m_result1.IsNegative())
+			m_result1 += m_modulus;
+		return m_result1;
+	}
+}
+
+Integer& ModularArithmetic::Reduce(Integer &a, const Integer &b) const
+{
+	if (a.reg.size()==m_modulus.reg.size() && b.reg.size()==m_modulus.reg.size())
+	{
+		if (CryptoPP::Subtract(a.reg, a.reg, b.reg, a.reg.size()))
+			CryptoPP::Add(a.reg, a.reg, m_modulus.reg, a.reg.size());
+	}
+	else
+	{
+		a-=b;
+		if (a.IsNegative())
+			a+=m_modulus;
+	}
+
+	return a;
+}
+
+const Integer& ModularArithmetic::Inverse(const Integer &a) const
+{
+	if (!a)
+		return a;
+
+	CopyWords(m_result.reg.begin(), m_modulus.reg, m_modulus.reg.size());
+	if (CryptoPP::Subtract(m_result.reg.begin(), m_result.reg, a.reg, a.reg.size()))
+		Decrement(m_result.reg.begin()+a.reg.size(), m_modulus.reg.size()-a.reg.size());
+
+	return m_result;
+}
+
+Integer ModularArithmetic::CascadeExponentiate(const Integer &x, const Integer &e1, const Integer &y, const Integer &e2) const
+{
+	if (m_modulus.IsOdd())
+	{
+		MontgomeryRepresentation dr(m_modulus);
+		return dr.ConvertOut(dr.CascadeExponentiate(dr.ConvertIn(x), e1, dr.ConvertIn(y), e2));
+	}
+	else
+		return AbstractRing<Integer>::CascadeExponentiate(x, e1, y, e2);
+}
+
+void ModularArithmetic::SimultaneousExponentiate(Integer *results, const Integer &base, const Integer *exponents, unsigned int exponentsCount) const
+{
+	if (m_modulus.IsOdd())
+	{
+		MontgomeryRepresentation dr(m_modulus);
+		dr.SimultaneousExponentiate(results, dr.ConvertIn(base), exponents, exponentsCount);
+		for (unsigned int i=0; i<exponentsCount; i++)
+			results[i] = dr.ConvertOut(results[i]);
+	}
+	else
+		AbstractRing<Integer>::SimultaneousExponentiate(results, base, exponents, exponentsCount);
+}
+
+MontgomeryRepresentation::MontgomeryRepresentation(const Integer &m)	// modulus must be odd
+	: ModularArithmetic(m),
+	  m_u((word)0, m_modulus.reg.size()),
+	  m_workspace(5*m_modulus.reg.size())
+{
+	if (!m_modulus.IsOdd())
+		throw InvalidArgument("MontgomeryRepresentation: Montgomery representation requires an odd modulus");
+
+	RecursiveInverseModPower2(m_u.reg, m_workspace, m_modulus.reg, m_modulus.reg.size());
+}
+
+const Integer& MontgomeryRepresentation::Multiply(const Integer &a, const Integer &b) const
+{
+	word *const T = m_workspace.begin();
+	word *const R = m_result.reg.begin();
+	const size_t N = m_modulus.reg.size();
+	CRYPTOPP_ASSERT(a.reg.size()<=N && b.reg.size()<=N);
+
+	AsymmetricMultiply(T, T+2*N, a.reg, a.reg.size(), b.reg, b.reg.size());
+	SetWords(T+a.reg.size()+b.reg.size(), 0, 2*N-a.reg.size()-b.reg.size());
+	MontgomeryReduce(R, T+2*N, T, m_modulus.reg, m_u.reg, N);
+	return m_result;
+}
+
+const Integer& MontgomeryRepresentation::Square(const Integer &a) const
+{
+	word *const T = m_workspace.begin();
+	word *const R = m_result.reg.begin();
+	const size_t N = m_modulus.reg.size();
+	CRYPTOPP_ASSERT(a.reg.size()<=N);
+
+	CryptoPP::Square(T, T+2*N, a.reg, a.reg.size());
+	SetWords(T+2*a.reg.size(), 0, 2*N-2*a.reg.size());
+	MontgomeryReduce(R, T+2*N, T, m_modulus.reg, m_u.reg, N);
+	return m_result;
+}
+
+Integer MontgomeryRepresentation::ConvertOut(const Integer &a) const
+{
+	word *const T = m_workspace.begin();
+	word *const R = m_result.reg.begin();
+	const size_t N = m_modulus.reg.size();
+	CRYPTOPP_ASSERT(a.reg.size()<=N);
+
+	CopyWords(T, a.reg, a.reg.size());
+	SetWords(T+a.reg.size(), 0, 2*N-a.reg.size());
+	MontgomeryReduce(R, T+2*N, T, m_modulus.reg, m_u.reg, N);
+	return m_result;
+}
+
+const Integer& MontgomeryRepresentation::MultiplicativeInverse(const Integer &a) const
+{
+//	  return (EuclideanMultiplicativeInverse(a, modulus)<<(2*WORD_BITS*modulus.reg.size()))%modulus;
+	word *const T = m_workspace.begin();
+	word *const R = m_result.reg.begin();
+	const size_t N = m_modulus.reg.size();
+	CRYPTOPP_ASSERT(a.reg.size()<=N);
+
+	CopyWords(T, a.reg, a.reg.size());
+	SetWords(T+a.reg.size(), 0, 2*N-a.reg.size());
+	MontgomeryReduce(R, T+2*N, T, m_modulus.reg, m_u.reg, N);
+	unsigned k = AlmostInverse(R, T, R, N, m_modulus.reg, N);
+
+//	cout << "k=" << k << " N*32=" << 32*N << endl;
+
+	if (k>N*WORD_BITS)
+		DivideByPower2Mod(R, R, k-N*WORD_BITS, m_modulus.reg, N);
+	else
+		MultiplyByPower2Mod(R, R, N*WORD_BITS-k, m_modulus.reg, N);
+
+	return m_result;
+}
+
+// Specialization declared in misc.h to allow us to print integers
+//  with additional control options, like arbitrary bases and uppercase.
+template <> CRYPTOPP_DLL
+std::string IntToString<Integer>(Integer value, unsigned int base)
+{
+	// Hack... set the high bit for uppercase. Set the next bit fo a suffix.
+	static const unsigned int BIT_32 = (1U << 31);
+	const bool UPPER = !!(base & BIT_32);
+	static const unsigned int BIT_31 = (1U << 30);
+	const bool BASE = !!(base & BIT_31);
+
+	const char CH = UPPER ? 'A' : 'a';
+	base &= ~(BIT_32|BIT_31);
+	CRYPTOPP_ASSERT(base >= 2 && base <= 32);
+
+	if (value == 0)
+		return "0";
+
+	bool negative = false, zero = false;
+	if (value.IsNegative())
+	{
+		negative = true;
+		value.Negate();
+	}
+
+	if (!value)
+		zero = true;
+
+	SecBlock<char> s(value.BitCount() / (SaturatingSubtract1(BitPrecision(base),1U)) + 1);
+	Integer temp;
+
+	unsigned int i=0;
+	while (!!value)
+	{
+		word digit;
+		Integer::Divide(digit, temp, value, word(base));
+		s[i++]=char((digit < 10 ? '0' : (CH - 10)) + digit);
+		value.swap(temp);
+	}
+
+	std::string result;
+	result.reserve(i+2);
+
+	if (negative)
+		result += '-';
+
+	if (zero)
+		result += '0';
+
+	while (i--)
+		result += s[i];
+
+	if (BASE)
+	{
+		if (base == 10)
+			result += '.';
+		else if (base == 16)
+			result += 'h';
+		else if (base == 8)
+			result += 'o';
+		else if (base == 2)
+			result += 'b';
+	}
+
+	return result;
+}
+
+// Specialization declared in misc.h to avoid Coverity findings.
+template <> CRYPTOPP_DLL
+std::string IntToString<word64>(word64 value, unsigned int base)
+{
+	// Hack... set the high bit for uppercase.
+	static const unsigned int HIGH_BIT = (1U << 31);
+	const char CH = !!(base & HIGH_BIT) ? 'A' : 'a';
+	base &= ~HIGH_BIT;
+
+	CRYPTOPP_ASSERT(base >= 2);
+	if (value == 0)
+		return "0";
+
+	std::string result;
+	while (value > 0)
+	{
+		word64 digit = value % base;
+		result = char((digit < 10 ? '0' : (CH - 10)) + digit) + result;
+		value /= base;
+	}
+	return result;
+}
+
+#ifndef CRYPTOPP_NO_ASSIGN_TO_INTEGER
+// Allow the linker to discard Integer code if not needed.
+// Also see http://github.com/weidai11/cryptopp/issues/389.
+bool AssignIntToInteger(const std::type_info &valueType, void *pInteger, const void *pInt)
+{
+	if (valueType != typeid(Integer))
+		return false;
+	*reinterpret_cast<Integer *>(pInteger) = *reinterpret_cast<const int *>(pInt);
+	return true;
+}
+#endif  // CRYPTOPP_NO_ASSIGN_TO_INTEGER
+
+// *************************** C++ Static Initialization ***************************
+
+class InitInteger
+{
+public:
+	InitInteger()
+	{
+		SetFunctionPointers();
+	}
+};
+
+// This is not really needed because each Integer can dynamically initialize
+// itself, but we take a peephole optimization and initialize the class once
+// if init priorities are available. Dynamic initialization will be used if
+// init priorities are not available.
+
+#if defined(HAVE_GCC_INIT_PRIORITY)
+	const InitInteger s_init __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 10))) = InitInteger();
+	const Integer g_zero __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 11))) = Integer(0L);
+	const Integer g_one __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 12))) = Integer(1L);
+	const Integer g_two __attribute__ ((init_priority (CRYPTOPP_INIT_PRIORITY + 13))) = Integer(2L);
+#elif defined(HAVE_MSC_INIT_PRIORITY)
+	#pragma warning(disable: 4075)
+	#pragma init_seg(".CRT$XCU")
+	const InitInteger s_init;
+	const Integer g_zero(0L);
+	const Integer g_one(1L);
+	const Integer g_two(2L);
+	#pragma warning(default: 4075)
+#elif HAVE_XLC_INIT_PRIORITY
+	// XLC needs constant, not a define
+	#pragma priority(280)
+	const InitInteger s_init;
+	const Integer g_zero(0L);
+	const Integer g_one(1L);
+	const Integer g_two(2L);
+#else
+	const InitInteger s_init;
+#endif
+
+// ***************** Library code ********************
+
+const Integer &Integer::Zero()
+{
+#if defined(HAVE_GCC_INIT_PRIORITY) || defined(HAVE_MSC_INIT_PRIORITY) || defined(HAVE_XLC_INIT_PRIORITY)
+	return g_zero;
+#elif defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static const Integer s_zero(0L);
+	return s_zero;
+#else  // Potential memory leak. Avoid if possible.
+	return Singleton<Integer, NewInteger<0L> >().Ref();
+#endif
+}
+
+const Integer &Integer::One()
+{
+#if defined(HAVE_GCC_INIT_PRIORITY) || defined(HAVE_MSC_INIT_PRIORITY) || defined(HAVE_XLC_INIT_PRIORITY)
+	return g_one;
+#elif defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static const Integer s_one(1L);
+	return s_one;
+#else  // Potential memory leak. Avoid if possible.
+	return Singleton<Integer, NewInteger<1L> >().Ref();
+#endif
+}
+
+const Integer &Integer::Two()
+{
+#if defined(HAVE_GCC_INIT_PRIORITY) || defined(HAVE_MSC_INIT_PRIORITY) || defined(HAVE_XLC_INIT_PRIORITY)
+	return g_two;
+#elif defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static const Integer s_two(2L);
+	return s_two;
+#else  // Potential memory leak. Avoid if possible.
+	return Singleton<Integer, NewInteger<2L> >().Ref();
+#endif
+}
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_IMPORTS
diff --git a/runtime/third_party/cryptopp/integer.h b/runtime/third_party/cryptopp/integer.h
new file mode 100644
index 0000000..05d7d6a
--- /dev/null
+++ b/runtime/third_party/cryptopp/integer.h
@@ -0,0 +1,840 @@
+// integer.h - originally written and placed in the public domain by Wei Dai
+
+/// \file integer.h
+/// \brief Multiple precision integer with arithmetic operations
+/// \details The Integer class can represent positive and negative integers
+///  with absolute value less than (256**sizeof(word))<sup>(256**sizeof(int))</sup>.
+/// \details Internally, the library uses a sign magnitude representation, and the class
+///  has two data members. The first is a IntegerSecBlock (a SecBlock<word>) and it is
+///  used to hold the representation. The second is a Sign (an enumeration), and it is
+///  used to track the sign of the Integer.
+/// \details For details on how the Integer class initializes its function pointers using
+///  InitializeInteger and how it creates Integer::Zero(), Integer::One(), and
+///  Integer::Two(), then see the comments at the top of <tt>integer.cpp</tt>.
+/// \since Crypto++ 1.0
+
+#ifndef CRYPTOPP_INTEGER_H
+#define CRYPTOPP_INTEGER_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "stdcpp.h"
+
+#include <iosfwd>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \struct InitializeInteger
+/// \brief Performs static initialization of the Integer class
+struct InitializeInteger
+{
+	InitializeInteger();
+};
+
+// Always align, http://github.com/weidai11/cryptopp/issues/256
+typedef SecBlock<word, AllocatorWithCleanup<word, true> > IntegerSecBlock;
+
+/// \brief Multiple precision integer with arithmetic operations
+/// \details The Integer class can represent positive and negative integers
+///  with absolute value less than (256**sizeof(word))<sup>(256**sizeof(int))</sup>.
+/// \details Internally, the library uses a sign magnitude representation, and the class
+///  has two data members. The first is a IntegerSecBlock (a SecBlock<word>) and it is
+///  used to hold the representation. The second is a Sign (an enumeration), and it is
+///  used to track the sign of the Integer.
+/// \details For details on how the Integer class initializes its function pointers using
+///  InitializeInteger and how it creates Integer::Zero(), Integer::One(), and
+///  Integer::Two(), then see the comments at the top of <tt>integer.cpp</tt>.
+/// \since Crypto++ 1.0
+/// \nosubgrouping
+class CRYPTOPP_DLL Integer : private InitializeInteger, public ASN1Object
+{
+public:
+	/// \name ENUMS, EXCEPTIONS, and TYPEDEFS
+	//@{
+		/// \brief Exception thrown when division by 0 is encountered
+		class DivideByZero : public Exception
+		{
+		public:
+			DivideByZero() : Exception(OTHER_ERROR, "Integer: division by zero") {}
+		};
+
+		/// \brief Exception thrown when a random number cannot be found that
+		///  satisfies the condition
+		class RandomNumberNotFound : public Exception
+		{
+		public:
+			RandomNumberNotFound() : Exception(OTHER_ERROR, "Integer: no integer satisfies the given parameters") {}
+		};
+
+		/// \enum Sign
+		/// \brief Used internally to represent the integer
+		/// \details Sign is used internally to represent the integer. It is also used in a few API functions.
+		/// \sa SetPositive(), SetNegative(), Signedness
+		enum Sign {
+			/// \brief the value is positive or 0
+			POSITIVE=0,
+			/// \brief the value is negative
+			NEGATIVE=1};
+
+		/// \enum Signedness
+		/// \brief Used when importing and exporting integers
+		/// \details Signedness is usually used in API functions.
+		/// \sa Sign
+		enum Signedness {
+			/// \brief an unsigned value
+			UNSIGNED,
+			/// \brief a signed value
+			SIGNED};
+
+		/// \enum RandomNumberType
+		/// \brief Properties of a random integer
+		enum RandomNumberType {
+			/// \brief a number with no special properties
+			ANY,
+			/// \brief a number which is probabilistically prime
+			PRIME};
+	//@}
+
+	/// \name CREATORS
+	//@{
+		/// \brief Creates the zero integer
+		Integer();
+
+		/// copy constructor
+		Integer(const Integer& t);
+
+		/// \brief Convert from signed long
+		Integer(signed long value);
+
+		/// \brief Convert from lword
+		/// \param sign enumeration indicating Sign
+		/// \param value the long word
+		Integer(Sign sign, lword value);
+
+		/// \brief Convert from two words
+		/// \param sign enumeration indicating Sign
+		/// \param highWord the high word
+		/// \param lowWord the low word
+		Integer(Sign sign, word highWord, word lowWord);
+
+		/// \brief Convert from a C-string
+		/// \param str C-string value
+		/// \param order the ByteOrder of the string to be processed
+		/// \details \p str can be in base 8, 10, or 16. Base is determined
+		///  by a case insensitive suffix of 'o' (8), '.' (10), or 'h' (16).
+		///  No suffix means base 10.
+		/// \details Byte order was added at Crypto++ 5.7 to allow use of little-endian
+		///  integers with curve25519, Poly1305 and Microsoft CAPI.
+		explicit Integer(const char *str, ByteOrder order = BIG_ENDIAN_ORDER);
+
+		/// \brief Convert from a wide C-string
+		/// \param str wide C-string value
+		/// \param order the ByteOrder of the string to be processed
+		/// \details \p str can be in base 8, 10, or 16. Base is determined
+		///  by a case insensitive suffix of 'o' (8), '.' (10), or 'h' (16).
+		///  No suffix means base 10.
+		/// \details Byte order was added at Crypto++ 5.7 to allow use of little-endian
+		///  integers with curve25519, Poly1305 and Microsoft CAPI.
+		explicit Integer(const wchar_t *str, ByteOrder order = BIG_ENDIAN_ORDER);
+
+		/// \brief Convert from a big-endian byte array
+		/// \param encodedInteger big-endian byte array
+		/// \param byteCount length of the byte array
+		/// \param sign enumeration indicating Signedness
+		/// \param order the ByteOrder of the array to be processed
+		/// \details Byte order was added at Crypto++ 5.7 to allow use of little-endian
+		///  integers with curve25519, Poly1305 and Microsoft CAPI.
+		Integer(const byte *encodedInteger, size_t byteCount, Signedness sign=UNSIGNED, ByteOrder order = BIG_ENDIAN_ORDER);
+
+		/// \brief Convert from a big-endian array
+		/// \param bt BufferedTransformation object with big-endian byte array
+		/// \param byteCount length of the byte array
+		/// \param sign enumeration indicating Signedness
+		/// \param order the ByteOrder of the data to be processed
+		/// \details Byte order was added at Crypto++ 5.7 to allow use of little-endian
+		///  integers with curve25519, Poly1305 and Microsoft CAPI.
+		Integer(BufferedTransformation &bt, size_t byteCount, Signedness sign=UNSIGNED, ByteOrder order = BIG_ENDIAN_ORDER);
+
+		/// \brief Convert from a BER encoded byte array
+		/// \param bt BufferedTransformation object with BER encoded byte array
+		explicit Integer(BufferedTransformation &bt);
+
+		/// \brief Create a random integer
+		/// \param rng RandomNumberGenerator used to generate material
+		/// \param bitCount the number of bits in the resulting integer
+		/// \details The random integer created is uniformly distributed over <tt>[0, 2<sup>bitCount</sup>]</tt>.
+		Integer(RandomNumberGenerator &rng, size_t bitCount);
+
+		/// \brief Integer representing 0
+		/// \return an Integer representing 0
+		/// \details Zero() avoids calling constructors for frequently used integers
+		static const Integer & CRYPTOPP_API Zero();
+		/// \brief Integer representing 1
+		/// \return an Integer representing 1
+		/// \details One() avoids calling constructors for frequently used integers
+		static const Integer & CRYPTOPP_API One();
+		/// \brief Integer representing 2
+		/// \return an Integer representing 2
+		/// \details Two() avoids calling constructors for frequently used integers
+		static const Integer & CRYPTOPP_API Two();
+
+		/// \brief Create a random integer of special form
+		/// \param rng RandomNumberGenerator used to generate material
+		/// \param min the minimum value
+		/// \param max the maximum value
+		/// \param rnType RandomNumberType to specify the type
+		/// \param equiv the equivalence class based on the parameter \p mod
+		/// \param mod the modulus used to reduce the equivalence class
+		/// \throw RandomNumberNotFound if the set is empty.
+		/// \details Ideally, the random integer created should be uniformly distributed
+		///  over <tt>{x | min \<= x \<= max</tt> and \p x is of rnType and <tt>x \% mod == equiv}</tt>.
+		///  However the actual distribution may not be uniform because sequential
+		///  search is used to find an appropriate number from a random starting
+		///  point.
+		/// \details May return (with very small probability) a pseudoprime when a prime
+		///  is requested and <tt>max \> lastSmallPrime*lastSmallPrime</tt>. \p lastSmallPrime
+		///  is declared in nbtheory.h.
+		Integer(RandomNumberGenerator &rng, const Integer &min, const Integer &max, RandomNumberType rnType=ANY, const Integer &equiv=Zero(), const Integer &mod=One());
+
+		/// \brief Exponentiates to a power of 2
+		/// \return the Integer 2<sup>e</sup>
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		static Integer CRYPTOPP_API Power2(size_t e);
+	//@}
+
+	/// \name ENCODE/DECODE
+	//@{
+		/// \brief Minimum number of bytes to encode this integer
+		/// \param sign enumeration indicating Signedness
+		/// \note The MinEncodedSize() of 0 is 1.
+		size_t MinEncodedSize(Signedness sign=UNSIGNED) const;
+
+		/// \brief Encode in big-endian format
+		/// \param output big-endian byte array
+		/// \param outputLen length of the byte array
+		/// \param sign enumeration indicating Signedness
+		/// \details Unsigned means encode absolute value, signed means encode two's complement if negative.
+		/// \details outputLen can be used to ensure an Integer is encoded to an exact size (rather than a
+		///  minimum size). An exact size is useful, for example, when encoding to a field element size.
+		void Encode(byte *output, size_t outputLen, Signedness sign=UNSIGNED) const;
+
+		/// \brief Encode in big-endian format
+		/// \param bt BufferedTransformation object
+		/// \param outputLen length of the encoding
+		/// \param sign enumeration indicating Signedness
+		/// \details Unsigned means encode absolute value, signed means encode two's complement if negative.
+		/// \details outputLen can be used to ensure an Integer is encoded to an exact size (rather than a
+		///  minimum size). An exact size is useful, for example, when encoding to a field element size.
+		void Encode(BufferedTransformation &bt, size_t outputLen, Signedness sign=UNSIGNED) const;
+
+		/// \brief Encode in DER format
+		/// \param bt BufferedTransformation object
+		/// \details Encodes the Integer using Distinguished Encoding Rules
+		///  The result is placed into a BufferedTransformation object
+		void DEREncode(BufferedTransformation &bt) const;
+
+		/// \brief Encode absolute value as big-endian octet string
+		/// \param bt BufferedTransformation object
+		/// \param length the number of mytes to decode
+		void DEREncodeAsOctetString(BufferedTransformation &bt, size_t length) const;
+
+		/// \brief Encode absolute value in OpenPGP format
+		/// \param output big-endian byte array
+		/// \param bufferSize length of the byte array
+		/// \return length of the output
+		/// \details OpenPGPEncode places result into the buffer and returns the
+		///  number of bytes used for the encoding
+		size_t OpenPGPEncode(byte *output, size_t bufferSize) const;
+
+		/// \brief Encode absolute value in OpenPGP format
+		/// \param bt BufferedTransformation object
+		/// \return length of the output
+		/// \details OpenPGPEncode places result into a BufferedTransformation object and returns the
+		///  number of bytes used for the encoding
+		size_t OpenPGPEncode(BufferedTransformation &bt) const;
+
+		/// \brief Decode from big-endian byte array
+		/// \param input big-endian byte array
+		/// \param inputLen length of the byte array
+		/// \param sign enumeration indicating Signedness
+		void Decode(const byte *input, size_t inputLen, Signedness sign=UNSIGNED);
+
+		/// \brief Decode nonnegative value from big-endian byte array
+		/// \param bt BufferedTransformation object
+		/// \param inputLen length of the byte array
+		/// \param sign enumeration indicating Signedness
+		/// \note <tt>bt.MaxRetrievable() \>= inputLen</tt>.
+		void Decode(BufferedTransformation &bt, size_t inputLen, Signedness sign=UNSIGNED);
+
+		/// \brief Decode from BER format
+		/// \param input big-endian byte array
+		/// \param inputLen length of the byte array
+		void BERDecode(const byte *input, size_t inputLen);
+
+		/// \brief Decode from BER format
+		/// \param bt BufferedTransformation object
+		void BERDecode(BufferedTransformation &bt);
+
+		/// \brief Decode nonnegative value from big-endian octet string
+		/// \param bt BufferedTransformation object
+		/// \param length length of the byte array
+		void BERDecodeAsOctetString(BufferedTransformation &bt, size_t length);
+
+		/// \brief Exception thrown when an error is encountered decoding an OpenPGP integer
+		class OpenPGPDecodeErr : public Exception
+		{
+		public:
+			OpenPGPDecodeErr() : Exception(INVALID_DATA_FORMAT, "OpenPGP decode error") {}
+		};
+
+		/// \brief Decode from OpenPGP format
+		/// \param input big-endian byte array
+		/// \param inputLen length of the byte array
+		void OpenPGPDecode(const byte *input, size_t inputLen);
+		/// \brief Decode from OpenPGP format
+		/// \param bt BufferedTransformation object
+		void OpenPGPDecode(BufferedTransformation &bt);
+	//@}
+
+	/// \name ACCESSORS
+	//@{
+		/// \brief Determines if the Integer is convertable to Long
+		/// \return true if <tt>*this</tt> can be represented as a signed long
+		/// \sa ConvertToLong()
+		bool IsConvertableToLong() const;
+		/// \brief Convert the Integer to Long
+		/// \return equivalent signed long if possible, otherwise undefined
+		/// \sa IsConvertableToLong()
+		signed long ConvertToLong() const;
+
+		/// \brief Determines the number of bits required to represent the Integer
+		/// \return number of significant bits
+		/// \details BitCount is calculated as <tt>floor(log2(abs(*this))) + 1</tt>.
+		unsigned int BitCount() const;
+		/// \brief Determines the number of bytes required to represent the Integer
+		/// \return number of significant bytes
+		/// \details ByteCount is calculated as <tt>ceiling(BitCount()/8)</tt>.
+		unsigned int ByteCount() const;
+		/// \brief Determines the number of words required to represent the Integer
+		/// \return number of significant words
+		/// \details WordCount is calculated as <tt>ceiling(ByteCount()/sizeof(word))</tt>.
+		unsigned int WordCount() const;
+
+		/// \brief Provides the i-th bit of the Integer
+		/// \return the i-th bit, i=0 being the least significant bit
+		bool GetBit(size_t i) const;
+		/// \brief Provides the i-th byte of the Integer
+		/// \return the i-th byte
+		byte GetByte(size_t i) const;
+		/// \brief Provides the low order bits of the Integer
+		/// \return n lowest bits of <tt>*this >> i</tt>
+		lword GetBits(size_t i, size_t n) const;
+
+		/// \brief Determines if the Integer is 0
+		/// \return true if the Integer is 0, false otherwise
+		bool IsZero() const {return !*this;}
+		/// \brief Determines if the Integer is non-0
+		/// \return true if the Integer is non-0, false otherwise
+		bool NotZero() const {return !IsZero();}
+		/// \brief Determines if the Integer is negative
+		/// \return true if the Integer is negative, false otherwise
+		bool IsNegative() const {return sign == NEGATIVE;}
+		/// \brief Determines if the Integer is non-negative
+		/// \return true if the Integer is non-negative, false otherwise
+		bool NotNegative() const {return !IsNegative();}
+		/// \brief Determines if the Integer is positive
+		/// \return true if the Integer is positive, false otherwise
+		bool IsPositive() const {return NotNegative() && NotZero();}
+		/// \brief Determines if the Integer is non-positive
+		/// \return true if the Integer is non-positive, false otherwise
+		bool NotPositive() const {return !IsPositive();}
+		/// \brief Determines if the Integer is even parity
+		/// \return true if the Integer is even, false otherwise
+		bool IsEven() const {return GetBit(0) == 0;}
+		/// \brief Determines if the Integer is odd parity
+		/// \return true if the Integer is odd, false otherwise
+		bool IsOdd() const	{return GetBit(0) == 1;}
+	//@}
+
+	/// \name MANIPULATORS
+	//@{
+		/// \brief Assignment
+		/// \param t the other Integer
+		/// \return the result of assignment
+		Integer&  operator=(const Integer& t);
+		/// \brief Addition Assignment
+		/// \param t the other Integer
+		/// \return the result of <tt>*this + t</tt>
+		Integer&  operator+=(const Integer& t);
+		/// \brief Subtraction Assignment
+		/// \param t the other Integer
+		/// \return the result of <tt>*this - t</tt>
+		Integer&  operator-=(const Integer& t);
+		/// \brief Multiplication Assignment
+		/// \param t the other Integer
+		/// \return the result of <tt>*this * t</tt>
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		Integer&  operator*=(const Integer& t)	{return *this = Times(t);}
+		/// \brief Division Assignment
+		/// \param t the other Integer
+		/// \return the result of <tt>*this / t</tt>
+		Integer&  operator/=(const Integer& t)	{return *this = DividedBy(t);}
+		/// \brief Remainder Assignment
+		/// \param t the other Integer
+		/// \return the result of <tt>*this % t</tt>
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		Integer&  operator%=(const Integer& t)	{return *this = Modulo(t);}
+		/// \brief Division Assignment
+		/// \param t the other word
+		/// \return the result of <tt>*this / t</tt>
+		Integer&  operator/=(word t)  {return *this = DividedBy(t);}
+		/// \brief Remainder Assignment
+		/// \param t the other word
+		/// \return the result of <tt>*this % t</tt>
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		Integer&  operator%=(word t)  {return *this = Integer(POSITIVE, 0, Modulo(t));}
+
+		/// \brief Left-shift Assignment
+		/// \param n number of bits to shift
+		/// \return reference to this Integer
+		Integer&  operator<<=(size_t n);
+		/// \brief Right-shift Assignment
+		/// \param n number of bits to shift
+		/// \return reference to this Integer
+		Integer&  operator>>=(size_t n);
+
+		/// \brief Bitwise AND Assignment
+		/// \param t the other Integer
+		/// \return the result of <tt>*this & t</tt>
+		/// \details operator&=() performs a bitwise AND on <tt>*this</tt>. Missing bits are truncated
+		///  at the most significant bit positions, so the result is as small as the
+		///  smaller of the operands.
+		/// \details Internally, Crypto++ uses a sign-magnitude representation. The library
+		///  does not attempt to interpret bits, and the result is always POSITIVE. If needed,
+		///  the integer should be converted to a 2's compliment representation before performing
+		///  the operation.
+		/// \since Crypto++ 6.0
+		Integer& operator&=(const Integer& t);
+		/// \brief Bitwise OR Assignment
+		/// \param t the second Integer
+		/// \return the result of <tt>*this | t</tt>
+		/// \details operator|=() performs a bitwise OR on <tt>*this</tt>. Missing bits are shifted in
+		///  at the most significant bit positions, so the result is as large as the
+		///  larger of the operands.
+		/// \details Internally, Crypto++ uses a sign-magnitude representation. The library
+		///  does not attempt to interpret bits, and the result is always POSITIVE. If needed,
+		///  the integer should be converted to a 2's compliment representation before performing
+		///  the operation.
+		/// \since Crypto++ 6.0
+		Integer& operator|=(const Integer& t);
+		/// \brief Bitwise XOR Assignment
+		/// \param t the other Integer
+		/// \return the result of <tt>*this ^ t</tt>
+		/// \details operator^=() performs a bitwise XOR on <tt>*this</tt>. Missing bits are shifted
+		///  in at the most significant bit positions, so the result is as large as the
+		///  larger of the operands.
+		/// \details Internally, Crypto++ uses a sign-magnitude representation. The library
+		///  does not attempt to interpret bits, and the result is always POSITIVE. If needed,
+		///  the integer should be converted to a 2's compliment representation before performing
+		///  the operation.
+		/// \since Crypto++ 6.0
+		Integer& operator^=(const Integer& t);
+
+		/// \brief Set this Integer to random integer
+		/// \param rng RandomNumberGenerator used to generate material
+		/// \param bitCount the number of bits in the resulting integer
+		/// \details The random integer created is uniformly distributed over <tt>[0, 2<sup>bitCount</sup>]</tt>.
+		/// \note If \p bitCount is 0, then this Integer is set to 0 (and not 0 or 1).
+		void Randomize(RandomNumberGenerator &rng, size_t bitCount);
+
+		/// \brief Set this Integer to random integer
+		/// \param rng RandomNumberGenerator used to generate material
+		/// \param min the minimum value
+		/// \param max the maximum value
+		/// \details The random integer created is uniformly distributed over <tt>[min, max]</tt>.
+		void Randomize(RandomNumberGenerator &rng, const Integer &min, const Integer &max);
+
+		/// \brief Set this Integer to random integer of special form
+		/// \param rng RandomNumberGenerator used to generate material
+		/// \param min the minimum value
+		/// \param max the maximum value
+		/// \param rnType RandomNumberType to specify the type
+		/// \param equiv the equivalence class based on the parameter \p mod
+		/// \param mod the modulus used to reduce the equivalence class
+		/// \throw RandomNumberNotFound if the set is empty.
+		/// \details Ideally, the random integer created should be uniformly distributed
+		///  over <tt>{x | min \<= x \<= max</tt> and \p x is of rnType and <tt>x \% mod == equiv}</tt>.
+		///  However the actual distribution may not be uniform because sequential
+		///  search is used to find an appropriate number from a random starting
+		///  point.
+		/// \details May return (with very small probability) a pseudoprime when a prime
+		///  is requested and <tt>max \> lastSmallPrime*lastSmallPrime</tt>. \p lastSmallPrime
+		///  is declared in nbtheory.h.
+		bool Randomize(RandomNumberGenerator &rng, const Integer &min, const Integer &max, RandomNumberType rnType, const Integer &equiv=Zero(), const Integer &mod=One());
+
+		/// \brief Generate a random number
+		/// \param rng RandomNumberGenerator used to generate material
+		/// \param params additional parameters that cannot be passed directly to the function
+		/// \return true if a random number was generated, false otherwise
+		/// \details GenerateRandomNoThrow attempts to generate a random number according to the
+		///  parameters specified in params. The function does not throw RandomNumberNotFound.
+		/// \details The example below generates a prime number using NameValuePairs that Integer
+		///  class recognizes. The names are not provided in argnames.h.
+		/// <pre>
+		///    AutoSeededRandomPool prng;
+		///    AlgorithmParameters params = MakeParameters("BitLength", 2048)
+		///                                               ("RandomNumberType", Integer::PRIME);
+		///    Integer x;
+		///    if (x.GenerateRandomNoThrow(prng, params) == false)
+		///        throw std::runtime_error("Failed to generate prime number");
+		/// </pre>
+		bool GenerateRandomNoThrow(RandomNumberGenerator &rng, const NameValuePairs &params = g_nullNameValuePairs);
+
+		/// \brief Generate a random number
+		/// \param rng RandomNumberGenerator used to generate material
+		/// \param params additional parameters that cannot be passed directly to the function
+		/// \throw RandomNumberNotFound if a random number is not found
+		/// \details GenerateRandom attempts to generate a random number according to the
+		///  parameters specified in params.
+		/// \details The example below generates a prime number using NameValuePairs that Integer
+		///  class recognizes. The names are not provided in argnames.h.
+		/// <pre>
+		///    AutoSeededRandomPool prng;
+		///    AlgorithmParameters params = MakeParameters("BitLength", 2048)
+		///                                               ("RandomNumberType", Integer::PRIME);
+		///    Integer x;
+		///    try { x.GenerateRandom(prng, params); }
+		///    catch (RandomNumberNotFound&) { x = -1; }
+		/// </pre>
+		void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params = g_nullNameValuePairs)
+		{
+			if (!GenerateRandomNoThrow(rng, params))
+				throw RandomNumberNotFound();
+		}
+
+		/// \brief Set the n-th bit to value
+		/// \details 0-based numbering.
+		void SetBit(size_t n, bool value=1);
+
+		/// \brief Set the n-th byte to value
+		/// \details 0-based numbering.
+		void SetByte(size_t n, byte value);
+
+		/// \brief Reverse the Sign of the Integer
+		void Negate();
+
+		/// \brief Sets the Integer to positive
+		void SetPositive() {sign = POSITIVE;}
+
+		/// \brief Sets the Integer to negative
+		void SetNegative() {if (!!(*this)) sign = NEGATIVE;}
+
+		/// \brief Swaps this Integer with another Integer
+		void swap(Integer &a);
+	//@}
+
+	/// \name UNARY OPERATORS
+	//@{
+		/// \brief Negation
+		bool		operator!() const;
+		/// \brief Addition
+		Integer 	operator+() const {return *this;}
+		/// \brief Subtraction
+		Integer 	operator-() const;
+		/// \brief Pre-increment
+		Integer&	operator++();
+		/// \brief Pre-decrement
+		Integer&	operator--();
+		/// \brief Post-increment
+		Integer 	operator++(int) {Integer temp = *this; ++*this; return temp;}
+		/// \brief Post-decrement
+		Integer 	operator--(int) {Integer temp = *this; --*this; return temp;}
+	//@}
+
+	/// \name BINARY OPERATORS
+	//@{
+		/// \brief Perform signed comparison
+		/// \param a the Integer to compare
+		/// \retval -1 if <tt>*this < a</tt>
+		/// \retval  0 if <tt>*this = a</tt>
+		/// \retval  1 if <tt>*this > a</tt>
+		int Compare(const Integer& a) const;
+
+		/// \brief Addition
+		Integer Plus(const Integer &b) const;
+		/// \brief Subtraction
+		Integer Minus(const Integer &b) const;
+		/// \brief Multiplication
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		Integer Times(const Integer &b) const;
+		/// \brief Division
+		Integer DividedBy(const Integer &b) const;
+		/// \brief Remainder
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		Integer Modulo(const Integer &b) const;
+		/// \brief Division
+		Integer DividedBy(word b) const;
+		/// \brief Remainder
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		word Modulo(word b) const;
+
+		/// \brief Bitwise AND
+		/// \param t the other Integer
+		/// \return the result of <tt>*this & t</tt>
+		/// \details And() performs a bitwise AND on the operands. Missing bits are truncated
+		///  at the most significant bit positions, so the result is as small as the
+		///  smaller of the operands.
+		/// \details Internally, Crypto++ uses a sign-magnitude representation. The library
+		///  does not attempt to interpret bits, and the result is always POSITIVE. If needed,
+		///  the integer should be converted to a 2's compliment representation before performing
+		///  the operation.
+		/// \since Crypto++ 6.0
+		Integer And(const Integer& t) const;
+
+		/// \brief Bitwise OR
+		/// \param t the other Integer
+		/// \return the result of <tt>*this | t</tt>
+		/// \details Or() performs a bitwise OR on the operands. Missing bits are shifted in
+		///  at the most significant bit positions, so the result is as large as the
+		///  larger of the operands.
+		/// \details Internally, Crypto++ uses a sign-magnitude representation. The library
+		///  does not attempt to interpret bits, and the result is always POSITIVE. If needed,
+		///  the integer should be converted to a 2's compliment representation before performing
+		///  the operation.
+		/// \since Crypto++ 6.0
+		Integer Or(const Integer& t) const;
+
+		/// \brief Bitwise XOR
+		/// \param t the other Integer
+		/// \return the result of <tt>*this ^ t</tt>
+		/// \details Xor() performs a bitwise XOR on the operands. Missing bits are shifted in
+		///  at the most significant bit positions, so the result is as large as the
+		///  larger of the operands.
+		/// \details Internally, Crypto++ uses a sign-magnitude representation. The library
+		///  does not attempt to interpret bits, and the result is always POSITIVE. If needed,
+		///  the integer should be converted to a 2's compliment representation before performing
+		///  the operation.
+		/// \since Crypto++ 6.0
+		Integer Xor(const Integer& t) const;
+
+		/// \brief Right-shift
+		Integer operator>>(size_t n) const	{return Integer(*this)>>=n;}
+		/// \brief Left-shift
+		Integer operator<<(size_t n) const	{return Integer(*this)<<=n;}
+	//@}
+
+	/// \name OTHER ARITHMETIC FUNCTIONS
+	//@{
+		/// \brief Retrieve the absolute value of this integer
+		Integer AbsoluteValue() const;
+		/// \brief Add this integer to itself
+		Integer Doubled() const {return Plus(*this);}
+		/// \brief Multiply this integer by itself
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		Integer Squared() const {return Times(*this);}
+		/// \brief Extract square root
+		/// \details if negative return 0, else return floor of square root
+		Integer SquareRoot() const;
+		/// \brief Determine whether this integer is a perfect square
+		bool IsSquare() const;
+
+		/// \brief Determine if 1 or -1
+		/// \return true if this integer is 1 or -1, false otherwise
+		bool IsUnit() const;
+		/// \brief Calculate multiplicative inverse
+		/// \return MultiplicativeInverse inverse if 1 or -1, otherwise return 0.
+		Integer MultiplicativeInverse() const;
+
+		/// \brief Extended Division
+		/// \param r a reference for the remainder
+		/// \param q a reference for the quotient
+		/// \param a reference to the dividend
+		/// \param d reference to the divisor
+		/// \details Divide calculates r and q such that (a == d*q + r) && (0 <= r < abs(d)).
+		static void CRYPTOPP_API Divide(Integer &r, Integer &q, const Integer &a, const Integer &d);
+
+		/// \brief Extended Division
+		/// \param r a reference for the remainder
+		/// \param q a reference for the quotient
+		/// \param a reference to the dividend
+		/// \param d reference to the divisor
+		/// \details Divide calculates r and q such that (a == d*q + r) && (0 <= r < abs(d)).
+		///  This overload uses a faster division algorithm because the divisor is short.
+		static void CRYPTOPP_API Divide(word &r, Integer &q, const Integer &a, word d);
+
+		/// \brief Extended Division
+		/// \param r a reference for the remainder
+		/// \param q a reference for the quotient
+		/// \param a reference to the dividend
+		/// \param n reference to the divisor
+		/// \details DivideByPowerOf2 calculates r and q such that (a == d*q + r) && (0 <= r < abs(d)).
+		///  It returns same result as Divide(r, q, a, Power2(n)), but faster.
+		///  This overload uses a faster division algorithm because the divisor is a power of 2.
+		static void CRYPTOPP_API DivideByPowerOf2(Integer &r, Integer &q, const Integer &a, unsigned int n);
+
+		/// \brief Calculate greatest common divisor
+		/// \param a reference to the first number
+		/// \param n reference to the secind number
+		/// \return the greatest common divisor <tt>a</tt> and <tt>n</tt>.
+		static Integer CRYPTOPP_API Gcd(const Integer &a, const Integer &n);
+
+		/// \brief Calculate multiplicative inverse
+		/// \param n reference to the modulus
+		/// \return an Integer <tt>*this % n</tt>.
+		/// \details InverseMod returns the multiplicative inverse of the Integer <tt>*this</tt>
+		///  modulo the Integer <tt>n</tt>. If no Integer exists then Integer 0 is returned.
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		Integer InverseMod(const Integer &n) const;
+
+		/// \brief Calculate multiplicative inverse
+		/// \param n the modulus
+		/// \return a word <tt>*this % n</tt>.
+		/// \details InverseMod returns the multiplicative inverse of the Integer <tt>*this</tt>
+		///  modulo the word <tt>n</tt>. If no Integer exists then word 0 is returned.
+		/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+		word InverseMod(word n) const;
+	//@}
+
+	/// \name INPUT/OUTPUT
+	//@{
+		/// \brief Extraction operator
+		/// \param in reference to a std::istream
+		/// \param a reference to an Integer
+		/// \return reference to a std::istream reference
+		friend CRYPTOPP_DLL std::istream& CRYPTOPP_API operator>>(std::istream& in, Integer &a);
+
+		/// \brief Insertion operator
+		/// \param out reference to a std::ostream
+		/// \param a a constant reference to an Integer
+		/// \return reference to a std::ostream reference
+		/// \details The output integer responds to hex, std::oct, std::hex, std::upper and
+		///  std::lower. The output includes the suffix \a h (for hex), \a . (\a dot, for dec)
+		///  and \a o (for octal). There is currently no way to suppress the suffix.
+		/// \details If you want to print an Integer without the suffix or using an arbitrary base, then
+		///  use IntToString<Integer>().
+		/// \sa IntToString<Integer>
+		friend CRYPTOPP_DLL std::ostream& CRYPTOPP_API operator<<(std::ostream& out, const Integer &a);
+	//@}
+
+	/// \brief Modular multiplication
+	/// \param x reference to the first term
+	/// \param y reference to the second term
+	/// \param m reference to the modulus
+	/// \return an Integer <tt>(a * b) % m</tt>.
+	CRYPTOPP_DLL friend Integer CRYPTOPP_API a_times_b_mod_c(const Integer &x, const Integer& y, const Integer& m);
+	/// \brief Modular exponentiation
+	/// \param x reference to the base
+	/// \param e reference to the exponent
+	/// \param m reference to the modulus
+	/// \return an Integer <tt>(a ^ b) % m</tt>.
+	CRYPTOPP_DLL friend Integer CRYPTOPP_API a_exp_b_mod_c(const Integer &x, const Integer& e, const Integer& m);
+
+protected:
+
+	// http://github.com/weidai11/cryptopp/issues/602
+	Integer InverseModNext(const Integer &n) const;
+
+private:
+
+	Integer(word value, size_t length);
+	int PositiveCompare(const Integer &t) const;
+
+	IntegerSecBlock reg;
+	Sign sign;
+
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+	friend class ModularArithmetic;
+	friend class MontgomeryRepresentation;
+	friend class HalfMontgomeryRepresentation;
+
+	friend void PositiveAdd(Integer &sum, const Integer &a, const Integer &b);
+	friend void PositiveSubtract(Integer &diff, const Integer &a, const Integer &b);
+	friend void PositiveMultiply(Integer &product, const Integer &a, const Integer &b);
+	friend void PositiveDivide(Integer &remainder, Integer &quotient, const Integer &dividend, const Integer &divisor);
+#endif
+};
+
+/// \brief Comparison
+inline bool operator==(const CryptoPP::Integer& a, const CryptoPP::Integer& b) {return a.Compare(b)==0;}
+/// \brief Comparison
+inline bool operator!=(const CryptoPP::Integer& a, const CryptoPP::Integer& b) {return a.Compare(b)!=0;}
+/// \brief Comparison
+inline bool operator> (const CryptoPP::Integer& a, const CryptoPP::Integer& b) {return a.Compare(b)> 0;}
+/// \brief Comparison
+inline bool operator>=(const CryptoPP::Integer& a, const CryptoPP::Integer& b) {return a.Compare(b)>=0;}
+/// \brief Comparison
+inline bool operator< (const CryptoPP::Integer& a, const CryptoPP::Integer& b) {return a.Compare(b)< 0;}
+/// \brief Comparison
+inline bool operator<=(const CryptoPP::Integer& a, const CryptoPP::Integer& b) {return a.Compare(b)<=0;}
+/// \brief Addition
+inline CryptoPP::Integer operator+(const CryptoPP::Integer &a, const CryptoPP::Integer &b) {return a.Plus(b);}
+/// \brief Subtraction
+inline CryptoPP::Integer operator-(const CryptoPP::Integer &a, const CryptoPP::Integer &b) {return a.Minus(b);}
+/// \brief Multiplication
+/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+inline CryptoPP::Integer operator*(const CryptoPP::Integer &a, const CryptoPP::Integer &b) {return a.Times(b);}
+/// \brief Division
+inline CryptoPP::Integer operator/(const CryptoPP::Integer &a, const CryptoPP::Integer &b) {return a.DividedBy(b);}
+/// \brief Remainder
+/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+inline CryptoPP::Integer operator%(const CryptoPP::Integer &a, const CryptoPP::Integer &b) {return a.Modulo(b);}
+/// \brief Division
+inline CryptoPP::Integer operator/(const CryptoPP::Integer &a, CryptoPP::word b) {return a.DividedBy(b);}
+/// \brief Remainder
+/// \sa a_times_b_mod_c() and a_exp_b_mod_c()
+inline CryptoPP::word    operator%(const CryptoPP::Integer &a, CryptoPP::word b) {return a.Modulo(b);}
+
+/// \brief Bitwise AND
+/// \param a the first Integer
+/// \param b the second Integer
+/// \return the result of a & b
+/// \details operator&() performs a bitwise AND on the operands. Missing bits are truncated
+///  at the most significant bit positions, so the result is as small as the
+///  smaller of the operands.
+/// \details Internally, Crypto++ uses a sign-magnitude representation. The library
+///  does not attempt to interpret bits, and the result is always POSITIVE. If needed,
+///  the integer should be converted to a 2's compliment representation before performing
+///  the operation.
+/// \since Crypto++ 6.0
+inline CryptoPP::Integer operator&(const CryptoPP::Integer &a, const CryptoPP::Integer &b) {return a.And(b);}
+
+/// \brief Bitwise OR
+/// \param a the first Integer
+/// \param b the second Integer
+/// \return the result of a | b
+/// \details operator|() performs a bitwise OR on the operands. Missing bits are shifted in
+///  at the most significant bit positions, so the result is as large as the
+///  larger of the operands.
+/// \details Internally, Crypto++ uses a sign-magnitude representation. The library
+///  does not attempt to interpret bits, and the result is always POSITIVE. If needed,
+///  the integer should be converted to a 2's compliment representation before performing
+///  the operation.
+/// \since Crypto++ 6.0
+inline CryptoPP::Integer operator|(const CryptoPP::Integer &a, const CryptoPP::Integer &b) {return a.Or(b);}
+
+/// \brief Bitwise XOR
+/// \param a the first Integer
+/// \param b the second Integer
+/// \return the result of a ^ b
+/// \details operator^() performs a bitwise XOR on the operands. Missing bits are shifted
+///  in at the most significant bit positions, so the result is as large as the
+///  larger of the operands.
+/// \details Internally, Crypto++ uses a sign-magnitude representation. The library
+///  does not attempt to interpret bits, and the result is always POSITIVE. If needed,
+///  the integer should be converted to a 2's compliment representation before performing
+///  the operation.
+/// \since Crypto++ 6.0
+inline CryptoPP::Integer operator^(const CryptoPP::Integer &a, const CryptoPP::Integer &b) {return a.Xor(b);}
+
+NAMESPACE_END
+
+#ifndef __BORLANDC__
+NAMESPACE_BEGIN(std)
+inline void swap(CryptoPP::Integer &a, CryptoPP::Integer &b)
+{
+	a.swap(b);
+}
+NAMESPACE_END
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/iterhash.cpp b/runtime/third_party/cryptopp/iterhash.cpp
new file mode 100644
index 0000000..c004d4f
--- /dev/null
+++ b/runtime/third_party/cryptopp/iterhash.cpp
@@ -0,0 +1,200 @@
+// iterhash.cpp - originally written and placed in the public domain by Wei Dai
+
+#ifndef __GNUC__
+#define CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES
+#endif
+
+#include "iterhash.h"
+#include "misc.h"
+#include "cpu.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+template <class T, class BASE> void IteratedHashBase<T, BASE>::Update(const byte *input, size_t length)
+{
+	CRYPTOPP_ASSERT(!(input == NULLPTR && length != 0));
+	if (length == 0) { return; }
+
+	HashWordType oldCountLo = m_countLo, oldCountHi = m_countHi;
+	if ((m_countLo = oldCountLo + HashWordType(length)) < oldCountLo)
+		m_countHi++;             // carry from low to high
+	m_countHi += (HashWordType)SafeRightShift<8*sizeof(HashWordType)>(length);
+	if (m_countHi < oldCountHi || SafeRightShift<2*8*sizeof(HashWordType)>(length) != 0)
+		throw HashInputTooLong(this->AlgorithmName());
+
+	const unsigned int blockSize = this->BlockSize();
+	unsigned int num = ModPowerOf2(oldCountLo, blockSize);
+
+	T* dataBuf = this->DataBuf();
+	byte* data = (byte *)dataBuf;
+
+	if (num != 0)	// process left over data
+	{
+		if (num+length >= blockSize)
+		{
+			if (input)
+				{std::memcpy(data+num, input, blockSize-num);}
+
+			HashBlock(dataBuf);
+			input += (blockSize-num);
+			length -= (blockSize-num);
+			num = 0;
+			// drop through and do the rest
+		}
+		else
+		{
+			if (input && length)
+				{std::memcpy(data+num, input, length);}
+			return;
+		}
+	}
+
+	// now process the input data in blocks of blockSize bytes and save the leftovers to m_data
+	if (length >= blockSize)
+	{
+		if (input == data)
+		{
+			CRYPTOPP_ASSERT(length == blockSize);
+			HashBlock(dataBuf);
+			return;
+		}
+		else if (IsAligned<T>(input))
+		{
+			size_t leftOver = HashMultipleBlocks((T *)(void*)input, length);
+			input += (length - leftOver);
+			length = leftOver;
+		}
+		else
+		{
+			do
+			{   // copy input first if it's not aligned correctly
+				if (input)
+					{ std::memcpy(data, input, blockSize); }
+
+				HashBlock(dataBuf);
+				input+=blockSize;
+				length-=blockSize;
+			} while (length >= blockSize);
+		}
+	}
+
+	if (input && data != input)
+		std::memcpy(data, input, length);
+}
+
+template <class T, class BASE> byte * IteratedHashBase<T, BASE>::CreateUpdateSpace(size_t &size)
+{
+	unsigned int blockSize = this->BlockSize();
+	unsigned int num = ModPowerOf2(m_countLo, blockSize);
+	size = blockSize - num;
+	return (byte *)DataBuf() + num;
+}
+
+template <class T, class BASE> size_t IteratedHashBase<T, BASE>::HashMultipleBlocks(const T *input, size_t length)
+{
+	const unsigned int blockSize = this->BlockSize();
+	bool noReverse = NativeByteOrderIs(this->GetByteOrder());
+	T* dataBuf = this->DataBuf();
+
+	// Alignment checks due to http://github.com/weidai11/cryptopp/issues/690.
+	// Sparc requires 8-byte aligned buffer when HashWordType is word64.
+	// We also had to provide a GetAlignmentOf specialization for word64 on Sparc.
+
+	do
+	{
+		if (noReverse)
+		{
+			if (IsAligned<HashWordType>(input))
+			{
+				// Sparc bus error with non-aligned input.
+				this->HashEndianCorrectedBlock(input);
+			}
+			else
+			{
+				std::memcpy(dataBuf, input, blockSize);
+				this->HashEndianCorrectedBlock(dataBuf);
+			}
+		}
+		else
+		{
+			if (IsAligned<HashWordType>(input))
+			{
+				// Sparc bus error with non-aligned input.
+				ByteReverse(dataBuf, input, blockSize);
+				this->HashEndianCorrectedBlock(dataBuf);
+			}
+			else
+			{
+				std::memcpy(dataBuf, input, blockSize);
+				ByteReverse(dataBuf, dataBuf, blockSize);
+				this->HashEndianCorrectedBlock(dataBuf);
+			}
+		}
+
+		input += blockSize/sizeof(T);
+		length -= blockSize;
+	}
+	while (length >= blockSize);
+	return length;
+}
+
+template <class T, class BASE> void IteratedHashBase<T, BASE>::PadLastBlock(unsigned int lastBlockSize, byte padFirst)
+{
+	unsigned int blockSize = this->BlockSize();
+	unsigned int num = ModPowerOf2(m_countLo, blockSize);
+	T* dataBuf = this->DataBuf();
+	byte* data = (byte *)dataBuf;
+
+	data[num++] = padFirst;
+	if (num <= lastBlockSize)
+		std::memset(data+num, 0, lastBlockSize-num);
+	else
+	{
+		std::memset(data+num, 0, blockSize-num);
+		HashBlock(dataBuf);
+		std::memset(data, 0, lastBlockSize);
+	}
+}
+
+template <class T, class BASE> void IteratedHashBase<T, BASE>::Restart()
+{
+	m_countLo = m_countHi = 0;
+	Init();
+}
+
+template <class T, class BASE> void IteratedHashBase<T, BASE>::TruncatedFinal(byte *digest, size_t size)
+{
+	CRYPTOPP_ASSERT(digest != NULLPTR);
+	this->ThrowIfInvalidTruncatedSize(size);
+
+	T* dataBuf = this->DataBuf();
+	T* stateBuf = this->StateBuf();
+	unsigned int blockSize = this->BlockSize();
+	ByteOrder order = this->GetByteOrder();
+
+	PadLastBlock(blockSize - 2*sizeof(HashWordType));
+	dataBuf[blockSize/sizeof(T)-2+order] = ConditionalByteReverse(order, this->GetBitCountLo());
+	dataBuf[blockSize/sizeof(T)-1-order] = ConditionalByteReverse(order, this->GetBitCountHi());
+
+	HashBlock(dataBuf);
+
+	if (IsAligned<HashWordType>(digest) && size%sizeof(HashWordType)==0)
+		ConditionalByteReverse<HashWordType>(order, (HashWordType *)(void*)digest, stateBuf, size);
+	else
+	{
+		ConditionalByteReverse<HashWordType>(order, stateBuf, stateBuf, this->DigestSize());
+		std::memcpy(digest, stateBuf, size);
+	}
+
+	this->Restart();		// reinit for next use
+}
+
+#if defined(__GNUC__) || defined(__clang__)
+	template class IteratedHashBase<word64, HashTransformation>;
+	template class IteratedHashBase<word64, MessageAuthenticationCode>;
+
+	template class IteratedHashBase<word32, HashTransformation>;
+	template class IteratedHashBase<word32, MessageAuthenticationCode>;
+#endif
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/iterhash.h b/runtime/third_party/cryptopp/iterhash.h
new file mode 100644
index 0000000..af916d9
--- /dev/null
+++ b/runtime/third_party/cryptopp/iterhash.h
@@ -0,0 +1,218 @@
+// iterhash.h - originally written and placed in the public domain by Wei Dai
+
+/// \file iterhash.h
+/// \brief Base classes for iterated hashes
+
+#ifndef CRYPTOPP_ITERHASH_H
+#define CRYPTOPP_ITERHASH_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "misc.h"
+#include "simple.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4231 4275)
+# if (CRYPTOPP_MSC_VERSION >= 1400)
+#  pragma warning(disable: 6011 6386 28193)
+# endif
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Exception thrown when trying to hash more data than is allowed by a hash function
+class CRYPTOPP_DLL HashInputTooLong : public InvalidDataFormat
+{
+public:
+	explicit HashInputTooLong(const std::string &alg)
+		: InvalidDataFormat("IteratedHashBase: input data exceeds maximum allowed by hash function " + alg) {}
+};
+
+/// \brief Iterated hash base class
+/// \tparam T Hash word type
+/// \tparam BASE HashTransformation derived class
+/// \details IteratedHashBase provides an interface for block-based iterated hashes
+/// \sa HashTransformation, MessageAuthenticationCode
+template <class T, class BASE>
+class CRYPTOPP_NO_VTABLE IteratedHashBase : public BASE
+{
+public:
+	typedef T HashWordType;
+
+	virtual ~IteratedHashBase() {}
+
+	/// \brief Construct an IteratedHashBase
+	IteratedHashBase() : m_countLo(0), m_countHi(0) {}
+
+	/// \brief Provides the input block size most efficient for this cipher.
+	/// \return The input block size that is most efficient for the cipher
+	/// \details The base class implementation returns MandatoryBlockSize().
+	/// \note Optimal input length is
+	///   <tt>n * OptimalBlockSize() - GetOptimalBlockSizeUsed()</tt> for any <tt>n \> 0</tt>.
+	unsigned int OptimalBlockSize() const {return this->BlockSize();}
+
+	/// \brief Provides input and output data alignment for optimal performance.
+	/// \return the input data alignment that provides optimal performance
+	/// \details OptimalDataAlignment returns the natural alignment of the hash word.
+	unsigned int OptimalDataAlignment() const {return GetAlignmentOf<T>();}
+
+	/// \brief Updates a hash with additional input
+	/// \param input the additional input as a buffer
+	/// \param length the size of the buffer, in bytes
+	void Update(const byte *input, size_t length);
+
+	/// \brief Requests space which can be written into by the caller
+	/// \param size the requested size of the buffer
+	/// \details The purpose of this method is to help avoid extra memory allocations.
+	/// \details size is an \a IN and \a OUT parameter and used as a hint. When the call is made,
+	///   size is the requested size of the buffer. When the call returns, size is the size of
+	///   the array returned to the caller.
+	/// \details The base class implementation sets  size to 0 and returns  NULL.
+	/// \note Some objects, like ArraySink, cannot create a space because its fixed.
+	byte * CreateUpdateSpace(size_t &size);
+
+	/// \brief Restart the hash
+	/// \details Discards the current state, and restart for a new message
+	void Restart();
+
+	/// \brief Computes the hash of the current message
+	/// \param digest a pointer to the buffer to receive the hash
+	/// \param digestSize the size of the truncated digest, in bytes
+	/// \details TruncatedFinal() calls Final() and then copies digestSize bytes to digest.
+	///   The hash is restarted the hash for the next message.
+	void TruncatedFinal(byte *digest, size_t digestSize);
+
+	/// \brief Retrieve the provider of this algorithm
+	/// \return the algorithm provider
+	/// \details The algorithm provider can be a name like "C++", "SSE", "NEON", "AESNI",
+	///    "ARMv8" and "Power8". C++ is standard C++ code. Other labels, like SSE,
+	///    usually indicate a specialized implementation using instructions from a higher
+	///    instruction set architecture (ISA). Future labels may include external hardware
+	///    like a hardware security module (HSM).
+	/// \note  Provider is not universally implemented yet.
+	virtual std::string AlgorithmProvider() const { return "C++"; }
+
+protected:
+	inline T GetBitCountHi() const
+		{return (m_countLo >> (8*sizeof(T)-3)) + (m_countHi << 3);}
+	inline T GetBitCountLo() const
+		{return m_countLo << 3;}
+
+	void PadLastBlock(unsigned int lastBlockSize, byte padFirst=0x80);
+	virtual void Init() =0;
+
+	virtual ByteOrder GetByteOrder() const =0;
+	virtual void HashEndianCorrectedBlock(const HashWordType *data) =0;
+	virtual size_t HashMultipleBlocks(const T *input, size_t length);
+	void HashBlock(const HashWordType *input)
+		{HashMultipleBlocks(input, this->BlockSize());}
+
+	virtual T* DataBuf() =0;
+	virtual T* StateBuf() =0;
+
+private:
+	T m_countLo, m_countHi;
+};
+
+/// \brief Iterated hash base class
+/// \tparam T_HashWordType Hash word type
+/// \tparam T_Endianness Endianness type of hash
+/// \tparam T_BlockSize Block size of the hash
+/// \tparam T_Base HashTransformation derived class
+/// \details IteratedHash provides a default implementation for block-based iterated hashes
+/// \sa HashTransformation, MessageAuthenticationCode
+template <class T_HashWordType, class T_Endianness, unsigned int T_BlockSize, class T_Base = HashTransformation>
+class CRYPTOPP_NO_VTABLE IteratedHash : public IteratedHashBase<T_HashWordType, T_Base>
+{
+public:
+	typedef T_Endianness ByteOrderClass;
+	typedef T_HashWordType HashWordType;
+
+	CRYPTOPP_CONSTANT(BLOCKSIZE = T_BlockSize);
+	// BCB2006 workaround: can't use BLOCKSIZE here
+	CRYPTOPP_COMPILE_ASSERT((T_BlockSize & (T_BlockSize - 1)) == 0);	// blockSize is a power of 2
+
+	virtual ~IteratedHash() {}
+
+	/// \brief Provides the block size of the hash
+	/// \return the block size of the hash, in bytes
+	/// \details BlockSize() returns <tt>T_BlockSize</tt>.
+	unsigned int BlockSize() const {return T_BlockSize;}
+
+	/// \brief Provides the byte order of the hash
+	/// \return the byte order of the hash as an enumeration
+	/// \details GetByteOrder() returns <tt>T_Endianness::ToEnum()</tt>.
+	/// \sa ByteOrder()
+	ByteOrder GetByteOrder() const {return T_Endianness::ToEnum();}
+
+	/// \brief Adjusts the byte ordering of the hash
+	/// \param out the output buffer
+	/// \param in the input buffer
+	/// \param byteCount the size of the buffers, in bytes
+	/// \details CorrectEndianess() calls ConditionalByteReverse() using <tt>T_Endianness</tt>.
+	inline void CorrectEndianess(HashWordType *out, const HashWordType *in, size_t byteCount)
+	{
+		CRYPTOPP_ASSERT(in != NULLPTR);
+		CRYPTOPP_ASSERT(out != NULLPTR);
+		CRYPTOPP_ASSERT(IsAligned<T_HashWordType>(in));
+		CRYPTOPP_ASSERT(IsAligned<T_HashWordType>(out));
+
+		ConditionalByteReverse(T_Endianness::ToEnum(), out, in, byteCount);
+	}
+
+protected:
+	enum { Blocks = T_BlockSize/sizeof(T_HashWordType) };
+	T_HashWordType* DataBuf() {return this->m_data;}
+	FixedSizeSecBlock<T_HashWordType, Blocks> m_data;
+};
+
+/// \brief Iterated hash with a static transformation function
+/// \tparam T_HashWordType Hash word type
+/// \tparam T_Endianness Endianness type of hash
+/// \tparam T_BlockSize Block size of the hash
+/// \tparam T_StateSize Internal state size of the hash
+/// \tparam T_Transform HashTransformation derived class
+/// \tparam T_DigestSize Digest size of the hash
+/// \tparam T_StateAligned Flag indicating if state is 16-byte aligned
+/// \sa HashTransformation, MessageAuthenticationCode
+template <class T_HashWordType, class T_Endianness, unsigned int T_BlockSize, unsigned int T_StateSize, class T_Transform, unsigned int T_DigestSize = 0, bool T_StateAligned = false>
+class CRYPTOPP_NO_VTABLE IteratedHashWithStaticTransform
+	: public ClonableImpl<T_Transform, AlgorithmImpl<IteratedHash<T_HashWordType, T_Endianness, T_BlockSize>, T_Transform> >
+{
+public:
+	CRYPTOPP_CONSTANT(DIGESTSIZE = T_DigestSize ? T_DigestSize : T_StateSize);
+
+	virtual ~IteratedHashWithStaticTransform() {}
+
+	/// \brief Provides the digest size of the hash
+	/// \return the digest size of the hash, in bytes
+	/// \details DigestSize() returns <tt>DIGESTSIZE</tt>.
+	unsigned int DigestSize() const {return DIGESTSIZE;}
+
+protected:
+	// https://github.com/weidai11/cryptopp/issues/147#issuecomment-766231864
+	IteratedHashWithStaticTransform() {IteratedHashWithStaticTransform::Init();}
+	void HashEndianCorrectedBlock(const T_HashWordType *data) {T_Transform::Transform(this->m_state, data);}
+	void Init() {T_Transform::InitState(this->m_state);}
+
+	enum { Blocks = T_BlockSize/sizeof(T_HashWordType) };
+	T_HashWordType* StateBuf() {return this->m_state;}
+	FixedSizeAlignedSecBlock<T_HashWordType, Blocks, T_StateAligned> m_state;
+};
+
+#if !defined(__GNUC__) && !defined(__clang__)
+	CRYPTOPP_DLL_TEMPLATE_CLASS IteratedHashBase<word64, HashTransformation>;
+	CRYPTOPP_STATIC_TEMPLATE_CLASS IteratedHashBase<word64, MessageAuthenticationCode>;
+
+	CRYPTOPP_DLL_TEMPLATE_CLASS IteratedHashBase<word32, HashTransformation>;
+	CRYPTOPP_STATIC_TEMPLATE_CLASS IteratedHashBase<word32, MessageAuthenticationCode>;
+#endif
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/kalyna.cpp b/runtime/third_party/cryptopp/kalyna.cpp
new file mode 100644
index 0000000..4163e6c
--- /dev/null
+++ b/runtime/third_party/cryptopp/kalyna.cpp
@@ -0,0 +1,1362 @@
+// kalyna.cpp - written and placed in the public domain by Jeffrey Walton
+//              This code relied upon three sources. First was Oliynykov, Gorbenko, Kazymyrov, Ruzhentsev,
+//              Kuznetsov, Gorbenko, Dyrda, Dolgov, Pushkaryov, Mordvinov and Kaidalov's "A New Encryption
+//              Standard of Ukraine: The Kalyna Block Cipher" (http://eprint.iacr.org/2015/650.pdf). Second
+//              was Roman Oliynykov and Oleksandr Kazymyrov's GitHub with the reference implementation
+//              (http://github.com/Roman-Oliynykov/Kalyna-reference). The third and most utilized resource
+//              was Keru Kuro's public domain implementation of Kalyna in CppCrypto
+//              (http://sourceforge.net/projects/cppcrypto/). Kuro has an outstanding implementation that
+//              performed better than the reference implementation and our initial attempts. The only downside
+//              was the missing big endian port.
+
+#include "pch.h"
+#include "config.h"
+
+#include "kalyna.h"
+#include "argnames.h"
+#include "misc.h"
+#include "cpu.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(KalynaTab)
+
+// T can be shared between Kupyna and Kalyna; IT, S and IS are Kalyna specific
+extern const word64 T[8][256];  // Columns
+extern const word64 IT[8][256]; // Inverse
+extern const byte S[4][256];    // Substitution
+extern const byte IS[4][256];   // Inverse
+
+NAMESPACE_END
+NAMESPACE_END
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+// The typedef here is to sidestep problems with byte in the global namespace
+typedef unsigned char byte;
+
+using CryptoPP::word64;
+using CryptoPP::KalynaTab::T;
+using CryptoPP::KalynaTab::S;
+using CryptoPP::KalynaTab::IT;
+using CryptoPP::KalynaTab::IS;
+
+template <unsigned int NB>
+inline void MakeOddKey(const word64 evenkey[NB], word64 oddkey[NB])
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    if (NB == 2)
+    {
+        oddkey[0] = (evenkey[1] << 8) | (evenkey[0] >> 56);
+        oddkey[1] = (evenkey[0] << 8) | (evenkey[1] >> 56);
+    }
+    else if (NB == 4)
+    {
+        oddkey[0] = (evenkey[2] << 40) | (evenkey[1] >> 24);
+        oddkey[1] = (evenkey[3] << 40) | (evenkey[2] >> 24);
+        oddkey[2] = (evenkey[0] << 40) | (evenkey[3] >> 24);
+        oddkey[3] = (evenkey[1] << 40) | (evenkey[0] >> 24);
+    }
+    else if (NB == 8)
+    {
+        oddkey[0] = (evenkey[3] << 40) | (evenkey[2] >> 24);
+        oddkey[1] = (evenkey[4] << 40) | (evenkey[3] >> 24);
+        oddkey[2] = (evenkey[5] << 40) | (evenkey[4] >> 24);
+        oddkey[3] = (evenkey[6] << 40) | (evenkey[5] >> 24);
+
+        oddkey[4] = (evenkey[7] << 40) | (evenkey[6] >> 24);
+        oddkey[5] = (evenkey[0] << 40) | (evenkey[7] >> 24);
+        oddkey[6] = (evenkey[1] << 40) | (evenkey[0] >> 24);
+        oddkey[7] = (evenkey[2] << 40) | (evenkey[1] >> 24);
+    }
+    else
+    {
+        CRYPTOPP_ASSERT(0);
+    }
+#else
+    static const unsigned int U = (NB == 2) ? 16 : (NB == 4) ? 32 : (NB == 8) ? 64 : -1;
+    static const unsigned int V = (NB == 2) ?  7 : (NB == 4) ? 11 : (NB == 8) ? 19 : -1;
+
+    const byte* even = reinterpret_cast<const byte*>(evenkey);
+    byte* odd = reinterpret_cast<byte*>(oddkey);
+
+    std::memcpy(odd, even + V, U - V);
+    std::memcpy(odd + U - V, even, V);
+#endif
+}
+
+template <unsigned int NB>
+inline void SwapBlocks(word64 k[NB])
+{
+    const word64 t = k[0];
+    k[0] = k[1];
+
+    if (NB > 2)
+    {
+        k[1] = k[2];
+        k[2] = k[3];
+    }
+
+    if (NB > 4)
+    {
+        k[3] = k[4];
+        k[4] = k[5];
+        k[5] = k[6];
+        k[6] = k[7];
+    }
+
+    k[NB - 1] = t;
+}
+
+template <unsigned int NB>
+inline void AddKey(const word64 x[NB], word64 y[NB], const word64 k[NB])
+{
+    y[0] = x[0] + k[0];
+    y[1] = x[1] + k[1];
+
+    if (NB > 2)
+    {
+        y[2] = x[2] + k[2];
+        y[3] = x[3] + k[3];
+    }
+
+    if (NB > 4)
+    {
+        y[4] = x[4] + k[4];
+        y[5] = x[5] + k[5];
+        y[6] = x[6] + k[6];
+        y[7] = x[7] + k[7];
+    }
+}
+
+template <unsigned int NB>
+inline void SubKey(const word64 x[NB], word64 y[NB], const word64 k[NB])
+{
+    y[0] = x[0] - k[0];
+    y[1] = x[1] - k[1];
+
+    if (NB > 2)
+    {
+        y[2] = x[2] - k[2];
+        y[3] = x[3] - k[3];
+    }
+
+    if (NB > 4)
+    {
+        y[4] = x[4] - k[4];
+        y[5] = x[5] - k[5];
+        y[6] = x[6] - k[6];
+        y[7] = x[7] - k[7];
+    }
+}
+
+template <unsigned int NB>
+static inline void AddConstant(word64 src[NB], word64 dst[NB], word64 constant)
+{
+    dst[0] = src[0] + constant;
+    dst[1] = src[1] + constant;
+
+    if (NB > 2)
+    {
+        dst[2] = src[2] + constant;
+        dst[3] = src[3] + constant;
+    }
+
+    if (NB > 4)
+    {
+        dst[4] = src[4] + constant;
+        dst[5] = src[5] + constant;
+        dst[6] = src[6] + constant;
+        dst[7] = src[7] + constant;
+    }
+}
+
+inline void G0128(const word64 x[2], word64 y[2])
+{
+    y[0] = T[0][(byte)x[0]] ^ T[1][(byte)(x[0] >> 8)] ^ T[2][(byte)(x[0] >> 16)] ^ T[3][(byte)(x[0] >> 24)] ^
+        T[4][(byte)(x[1] >> 32)] ^ T[5][(byte)(x[1] >> 40)] ^ T[6][(byte)(x[1] >> 48)] ^ T[7][(byte)(x[1] >> 56)];
+    y[1] = T[0][(byte)x[1]] ^ T[1][(byte)(x[1] >> 8)] ^ T[2][(byte)(x[1] >> 16)] ^ T[3][(byte)(x[1] >> 24)] ^
+        T[4][(byte)(x[0] >> 32)] ^ T[5][(byte)(x[0] >> 40)] ^ T[6][(byte)(x[0] >> 48)] ^ T[7][(byte)(x[0] >> 56)];
+}
+
+inline void G0256(const word64 x[4], word64 y[4])
+{
+    y[0] = T[0][(byte)x[0]] ^ T[1][(byte)(x[0] >> 8)] ^ T[2][(byte)(x[3] >> 16)] ^ T[3][(byte)(x[3] >> 24)] ^
+        T[4][(byte)(x[2] >> 32)] ^ T[5][(byte)(x[2] >> 40)] ^ T[6][(byte)(x[1] >> 48)] ^ T[7][(byte)(x[1] >> 56)];
+    y[1] = T[0][(byte)x[1]] ^ T[1][(byte)(x[1] >> 8)] ^ T[2][(byte)(x[0] >> 16)] ^ T[3][(byte)(x[0] >> 24)] ^
+        T[4][(byte)(x[3] >> 32)] ^ T[5][(byte)(x[3] >> 40)] ^ T[6][(byte)(x[2] >> 48)] ^ T[7][(byte)(x[2] >> 56)];
+    y[2] = T[0][(byte)x[2]] ^ T[1][(byte)(x[2] >> 8)] ^ T[2][(byte)(x[1] >> 16)] ^ T[3][(byte)(x[1] >> 24)] ^
+        T[4][(byte)(x[0] >> 32)] ^ T[5][(byte)(x[0] >> 40)] ^ T[6][(byte)(x[3] >> 48)] ^ T[7][(byte)(x[3] >> 56)];
+    y[3] = T[0][(byte)x[3]] ^ T[1][(byte)(x[3] >> 8)] ^ T[2][(byte)(x[2] >> 16)] ^ T[3][(byte)(x[2] >> 24)] ^
+        T[4][(byte)(x[1] >> 32)] ^ T[5][(byte)(x[1] >> 40)] ^ T[6][(byte)(x[0] >> 48)] ^ T[7][(byte)(x[0] >> 56)];
+}
+
+inline void G0512(const word64 x[8], word64 y[8])
+{
+    y[0] = T[0][(byte)x[0]] ^ T[1][(byte)(x[7] >> 8)] ^ T[2][(byte)(x[6] >> 16)] ^ T[3][(byte)(x[5] >> 24)] ^
+        T[4][(byte)(x[4] >> 32)] ^ T[5][(byte)(x[3] >> 40)] ^ T[6][(byte)(x[2] >> 48)] ^ T[7][(byte)(x[1] >> 56)];
+    y[1] = T[0][(byte)x[1]] ^ T[1][(byte)(x[0] >> 8)] ^ T[2][(byte)(x[7] >> 16)] ^ T[3][(byte)(x[6] >> 24)] ^
+        T[4][(byte)(x[5] >> 32)] ^ T[5][(byte)(x[4] >> 40)] ^ T[6][(byte)(x[3] >> 48)] ^ T[7][(byte)(x[2] >> 56)];
+    y[2] = T[0][(byte)x[2]] ^ T[1][(byte)(x[1] >> 8)] ^ T[2][(byte)(x[0] >> 16)] ^ T[3][(byte)(x[7] >> 24)] ^
+        T[4][(byte)(x[6] >> 32)] ^ T[5][(byte)(x[5] >> 40)] ^ T[6][(byte)(x[4] >> 48)] ^ T[7][(byte)(x[3] >> 56)];
+    y[3] = T[0][(byte)x[3]] ^ T[1][(byte)(x[2] >> 8)] ^ T[2][(byte)(x[1] >> 16)] ^ T[3][(byte)(x[0] >> 24)] ^
+        T[4][(byte)(x[7] >> 32)] ^ T[5][(byte)(x[6] >> 40)] ^ T[6][(byte)(x[5] >> 48)] ^ T[7][(byte)(x[4] >> 56)];
+    y[4] = T[0][(byte)x[4]] ^ T[1][(byte)(x[3] >> 8)] ^ T[2][(byte)(x[2] >> 16)] ^ T[3][(byte)(x[1] >> 24)] ^
+        T[4][(byte)(x[0] >> 32)] ^ T[5][(byte)(x[7] >> 40)] ^ T[6][(byte)(x[6] >> 48)] ^ T[7][(byte)(x[5] >> 56)];
+    y[5] = T[0][(byte)x[5]] ^ T[1][(byte)(x[4] >> 8)] ^ T[2][(byte)(x[3] >> 16)] ^ T[3][(byte)(x[2] >> 24)] ^
+        T[4][(byte)(x[1] >> 32)] ^ T[5][(byte)(x[0] >> 40)] ^ T[6][(byte)(x[7] >> 48)] ^ T[7][(byte)(x[6] >> 56)];
+    y[6] = T[0][(byte)x[6]] ^ T[1][(byte)(x[5] >> 8)] ^ T[2][(byte)(x[4] >> 16)] ^ T[3][(byte)(x[3] >> 24)] ^
+        T[4][(byte)(x[2] >> 32)] ^ T[5][(byte)(x[1] >> 40)] ^ T[6][(byte)(x[0] >> 48)] ^ T[7][(byte)(x[7] >> 56)];
+    y[7] = T[0][(byte)x[7]] ^ T[1][(byte)(x[6] >> 8)] ^ T[2][(byte)(x[5] >> 16)] ^ T[3][(byte)(x[4] >> 24)] ^
+        T[4][(byte)(x[3] >> 32)] ^ T[5][(byte)(x[2] >> 40)] ^ T[6][(byte)(x[1] >> 48)] ^ T[7][(byte)(x[0] >> 56)];
+}
+
+inline void GL128(const word64 x[2], word64 y[2], const word64 k[2])
+{
+    y[0] = k[0] + (T[0][(byte)x[0]] ^ T[1][(byte)(x[0] >> 8)] ^ T[2][(byte)(x[0] >> 16)] ^ T[3][(byte)(x[0] >> 24)] ^
+        T[4][(byte)(x[1] >> 32)] ^ T[5][(byte)(x[1] >> 40)] ^ T[6][(byte)(x[1] >> 48)] ^ T[7][(byte)(x[1] >> 56)]);
+    y[1] = k[1] + (T[0][(byte)x[1]] ^ T[1][(byte)(x[1] >> 8)] ^ T[2][(byte)(x[1] >> 16)] ^ T[3][(byte)(x[1] >> 24)] ^
+        T[4][(byte)(x[0] >> 32)] ^ T[5][(byte)(x[0] >> 40)] ^ T[6][(byte)(x[0] >> 48)] ^ T[7][(byte)(x[0] >> 56)]);
+}
+
+inline void GL256(const word64 x[4], word64 y[4], const word64 k[4])
+{
+    y[0] = k[0] + (T[0][(byte)x[0]] ^ T[1][(byte)(x[0] >> 8)] ^ T[2][(byte)(x[3] >> 16)] ^ T[3][(byte)(x[3] >> 24)] ^
+        T[4][(byte)(x[2] >> 32)] ^ T[5][(byte)(x[2] >> 40)] ^ T[6][(byte)(x[1] >> 48)] ^ T[7][(byte)(x[1] >> 56)]);
+    y[1] = k[1] + (T[0][(byte)x[1]] ^ T[1][(byte)(x[1] >> 8)] ^ T[2][(byte)(x[0] >> 16)] ^ T[3][(byte)(x[0] >> 24)] ^
+        T[4][(byte)(x[3] >> 32)] ^ T[5][(byte)(x[3] >> 40)] ^ T[6][(byte)(x[2] >> 48)] ^ T[7][(byte)(x[2] >> 56)]);
+    y[2] = k[2] + (T[0][(byte)x[2]] ^ T[1][(byte)(x[2] >> 8)] ^ T[2][(byte)(x[1] >> 16)] ^ T[3][(byte)(x[1] >> 24)] ^
+        T[4][(byte)(x[0] >> 32)] ^ T[5][(byte)(x[0] >> 40)] ^ T[6][(byte)(x[3] >> 48)] ^ T[7][(byte)(x[3] >> 56)]);
+    y[3] = k[3] + (T[0][(byte)x[3]] ^ T[1][(byte)(x[3] >> 8)] ^ T[2][(byte)(x[2] >> 16)] ^ T[3][(byte)(x[2] >> 24)] ^
+        T[4][(byte)(x[1] >> 32)] ^ T[5][(byte)(x[1] >> 40)] ^ T[6][(byte)(x[0] >> 48)] ^ T[7][(byte)(x[0] >> 56)]);
+}
+
+inline void GL512(const word64 x[8], word64 y[8], const word64 k[8])
+{
+    y[0] = k[0] + (T[0][(byte)x[0]] ^ T[1][(byte)(x[7] >> 8)] ^ T[2][(byte)(x[6] >> 16)] ^ T[3][(byte)(x[5] >> 24)] ^
+        T[4][(byte)(x[4] >> 32)] ^ T[5][(byte)(x[3] >> 40)] ^ T[6][(byte)(x[2] >> 48)] ^ T[7][(byte)(x[1] >> 56)]);
+    y[1] = k[1] + (T[0][(byte)x[1]] ^ T[1][(byte)(x[0] >> 8)] ^ T[2][(byte)(x[7] >> 16)] ^ T[3][(byte)(x[6] >> 24)] ^
+        T[4][(byte)(x[5] >> 32)] ^ T[5][(byte)(x[4] >> 40)] ^ T[6][(byte)(x[3] >> 48)] ^ T[7][(byte)(x[2] >> 56)]);
+    y[2] = k[2] + (T[0][(byte)x[2]] ^ T[1][(byte)(x[1] >> 8)] ^ T[2][(byte)(x[0] >> 16)] ^ T[3][(byte)(x[7] >> 24)] ^
+        T[4][(byte)(x[6] >> 32)] ^ T[5][(byte)(x[5] >> 40)] ^ T[6][(byte)(x[4] >> 48)] ^ T[7][(byte)(x[3] >> 56)]);
+    y[3] = k[3] + (T[0][(byte)x[3]] ^ T[1][(byte)(x[2] >> 8)] ^ T[2][(byte)(x[1] >> 16)] ^ T[3][(byte)(x[0] >> 24)] ^
+        T[4][(byte)(x[7] >> 32)] ^ T[5][(byte)(x[6] >> 40)] ^ T[6][(byte)(x[5] >> 48)] ^ T[7][(byte)(x[4] >> 56)]);
+    y[4] = k[4] + (T[0][(byte)x[4]] ^ T[1][(byte)(x[3] >> 8)] ^ T[2][(byte)(x[2] >> 16)] ^ T[3][(byte)(x[1] >> 24)] ^
+        T[4][(byte)(x[0] >> 32)] ^ T[5][(byte)(x[7] >> 40)] ^ T[6][(byte)(x[6] >> 48)] ^ T[7][(byte)(x[5] >> 56)]);
+    y[5] = k[5] + (T[0][(byte)x[5]] ^ T[1][(byte)(x[4] >> 8)] ^ T[2][(byte)(x[3] >> 16)] ^ T[3][(byte)(x[2] >> 24)] ^
+        T[4][(byte)(x[1] >> 32)] ^ T[5][(byte)(x[0] >> 40)] ^ T[6][(byte)(x[7] >> 48)] ^ T[7][(byte)(x[6] >> 56)]);
+    y[6] = k[6] + (T[0][(byte)x[6]] ^ T[1][(byte)(x[5] >> 8)] ^ T[2][(byte)(x[4] >> 16)] ^ T[3][(byte)(x[3] >> 24)] ^
+        T[4][(byte)(x[2] >> 32)] ^ T[5][(byte)(x[1] >> 40)] ^ T[6][(byte)(x[0] >> 48)] ^ T[7][(byte)(x[7] >> 56)]);
+    y[7] = k[7] + (T[0][(byte)x[7]] ^ T[1][(byte)(x[6] >> 8)] ^ T[2][(byte)(x[5] >> 16)] ^ T[3][(byte)(x[4] >> 24)] ^
+        T[4][(byte)(x[3] >> 32)] ^ T[5][(byte)(x[2] >> 40)] ^ T[6][(byte)(x[1] >> 48)] ^ T[7][(byte)(x[0] >> 56)]);
+}
+
+inline void IMC128(word64 x[2])
+{
+    x[0] = IT[0][S[0][(byte)x[0]]] ^ IT[1][S[1][(byte)(x[0] >> 8)]] ^ IT[2][S[2][(byte)(x[0] >> 16)]] ^ IT[3][S[3][(byte)(x[0] >> 24)]] ^
+        IT[4][S[0][(byte)(x[0] >> 32)]] ^ IT[5][S[1][(byte)(x[0] >> 40)]] ^ IT[6][S[2][(byte)(x[0] >> 48)]] ^ IT[7][S[3][(byte)(x[0] >> 56)]];
+    x[1] = IT[0][S[0][(byte)x[1]]] ^ IT[1][S[1][(byte)(x[1] >> 8)]] ^ IT[2][S[2][(byte)(x[1] >> 16)]] ^ IT[3][S[3][(byte)(x[1] >> 24)]] ^
+        IT[4][S[0][(byte)(x[1] >> 32)]] ^ IT[5][S[1][(byte)(x[1] >> 40)]] ^ IT[6][S[2][(byte)(x[1] >> 48)]] ^ IT[7][S[3][(byte)(x[1] >> 56)]];
+}
+
+inline void IMC256(word64 x[4])
+{
+    x[0] = IT[0][S[0][(byte)x[0]]] ^ IT[1][S[1][(byte)(x[0] >> 8)]] ^ IT[2][S[2][(byte)(x[0] >> 16)]] ^ IT[3][S[3][(byte)(x[0] >> 24)]] ^
+        IT[4][S[0][(byte)(x[0] >> 32)]] ^ IT[5][S[1][(byte)(x[0] >> 40)]] ^ IT[6][S[2][(byte)(x[0] >> 48)]] ^ IT[7][S[3][(byte)(x[0] >> 56)]];
+    x[1] = IT[0][S[0][(byte)x[1]]] ^ IT[1][S[1][(byte)(x[1] >> 8)]] ^ IT[2][S[2][(byte)(x[1] >> 16)]] ^ IT[3][S[3][(byte)(x[1] >> 24)]] ^
+        IT[4][S[0][(byte)(x[1] >> 32)]] ^ IT[5][S[1][(byte)(x[1] >> 40)]] ^ IT[6][S[2][(byte)(x[1] >> 48)]] ^ IT[7][S[3][(byte)(x[1] >> 56)]];
+    x[2] = IT[0][S[0][(byte)x[2]]] ^ IT[1][S[1][(byte)(x[2] >> 8)]] ^ IT[2][S[2][(byte)(x[2] >> 16)]] ^ IT[3][S[3][(byte)(x[2] >> 24)]] ^
+        IT[4][S[0][(byte)(x[2] >> 32)]] ^ IT[5][S[1][(byte)(x[2] >> 40)]] ^ IT[6][S[2][(byte)(x[2] >> 48)]] ^ IT[7][S[3][(byte)(x[2] >> 56)]];
+    x[3] = IT[0][S[0][(byte)x[3]]] ^ IT[1][S[1][(byte)(x[3] >> 8)]] ^ IT[2][S[2][(byte)(x[3] >> 16)]] ^ IT[3][S[3][(byte)(x[3] >> 24)]] ^
+        IT[4][S[0][(byte)(x[3] >> 32)]] ^ IT[5][S[1][(byte)(x[3] >> 40)]] ^ IT[6][S[2][(byte)(x[3] >> 48)]] ^ IT[7][S[3][(byte)(x[3] >> 56)]];
+}
+
+inline void IMC512(word64 x[8])
+{
+    x[0] = IT[0][S[0][(byte)x[0]]] ^ IT[1][S[1][(byte)(x[0] >> 8)]] ^ IT[2][S[2][(byte)(x[0] >> 16)]] ^ IT[3][S[3][(byte)(x[0] >> 24)]] ^
+        IT[4][S[0][(byte)(x[0] >> 32)]] ^ IT[5][S[1][(byte)(x[0] >> 40)]] ^ IT[6][S[2][(byte)(x[0] >> 48)]] ^ IT[7][S[3][(byte)(x[0] >> 56)]];
+    x[1] = IT[0][S[0][(byte)x[1]]] ^ IT[1][S[1][(byte)(x[1] >> 8)]] ^ IT[2][S[2][(byte)(x[1] >> 16)]] ^ IT[3][S[3][(byte)(x[1] >> 24)]] ^
+        IT[4][S[0][(byte)(x[1] >> 32)]] ^ IT[5][S[1][(byte)(x[1] >> 40)]] ^ IT[6][S[2][(byte)(x[1] >> 48)]] ^ IT[7][S[3][(byte)(x[1] >> 56)]];
+    x[2] = IT[0][S[0][(byte)x[2]]] ^ IT[1][S[1][(byte)(x[2] >> 8)]] ^ IT[2][S[2][(byte)(x[2] >> 16)]] ^ IT[3][S[3][(byte)(x[2] >> 24)]] ^
+        IT[4][S[0][(byte)(x[2] >> 32)]] ^ IT[5][S[1][(byte)(x[2] >> 40)]] ^ IT[6][S[2][(byte)(x[2] >> 48)]] ^ IT[7][S[3][(byte)(x[2] >> 56)]];
+    x[3] = IT[0][S[0][(byte)x[3]]] ^ IT[1][S[1][(byte)(x[3] >> 8)]] ^ IT[2][S[2][(byte)(x[3] >> 16)]] ^ IT[3][S[3][(byte)(x[3] >> 24)]] ^
+        IT[4][S[0][(byte)(x[3] >> 32)]] ^ IT[5][S[1][(byte)(x[3] >> 40)]] ^ IT[6][S[2][(byte)(x[3] >> 48)]] ^ IT[7][S[3][(byte)(x[3] >> 56)]];
+    x[4] = IT[0][S[0][(byte)x[4]]] ^ IT[1][S[1][(byte)(x[4] >> 8)]] ^ IT[2][S[2][(byte)(x[4] >> 16)]] ^ IT[3][S[3][(byte)(x[4] >> 24)]] ^
+        IT[4][S[0][(byte)(x[4] >> 32)]] ^ IT[5][S[1][(byte)(x[4] >> 40)]] ^ IT[6][S[2][(byte)(x[4] >> 48)]] ^ IT[7][S[3][(byte)(x[4] >> 56)]];
+    x[5] = IT[0][S[0][(byte)x[5]]] ^ IT[1][S[1][(byte)(x[5] >> 8)]] ^ IT[2][S[2][(byte)(x[5] >> 16)]] ^ IT[3][S[3][(byte)(x[5] >> 24)]] ^
+        IT[4][S[0][(byte)(x[5] >> 32)]] ^ IT[5][S[1][(byte)(x[5] >> 40)]] ^ IT[6][S[2][(byte)(x[5] >> 48)]] ^ IT[7][S[3][(byte)(x[5] >> 56)]];
+    x[6] = IT[0][S[0][(byte)x[6]]] ^ IT[1][S[1][(byte)(x[6] >> 8)]] ^ IT[2][S[2][(byte)(x[6] >> 16)]] ^ IT[3][S[3][(byte)(x[6] >> 24)]] ^
+        IT[4][S[0][(byte)(x[6] >> 32)]] ^ IT[5][S[1][(byte)(x[6] >> 40)]] ^ IT[6][S[2][(byte)(x[6] >> 48)]] ^ IT[7][S[3][(byte)(x[6] >> 56)]];
+    x[7] = IT[0][S[0][(byte)x[7]]] ^ IT[1][S[1][(byte)(x[7] >> 8)]] ^ IT[2][S[2][(byte)(x[7] >> 16)]] ^ IT[3][S[3][(byte)(x[7] >> 24)]] ^
+        IT[4][S[0][(byte)(x[7] >> 32)]] ^ IT[5][S[1][(byte)(x[7] >> 40)]] ^ IT[6][S[2][(byte)(x[7] >> 48)]] ^ IT[7][S[3][(byte)(x[7] >> 56)]];
+}
+
+inline void IG128(const word64 x[2], word64 y[2], const word64 k[2])
+{
+    y[0] = k[0] ^ IT[0][(byte)x[0]] ^ IT[1][(byte)(x[0] >> 8)] ^ IT[2][(byte)(x[0] >> 16)] ^ IT[3][(byte)(x[0] >> 24)] ^
+        IT[4][(byte)(x[1] >> 32)] ^ IT[5][(byte)(x[1] >> 40)] ^ IT[6][(byte)(x[1] >> 48)] ^ IT[7][(byte)(x[1] >> 56)];
+    y[1] = k[1] ^ IT[0][(byte)x[1]] ^ IT[1][(byte)(x[1] >> 8)] ^ IT[2][(byte)(x[1] >> 16)] ^ IT[3][(byte)(x[1] >> 24)] ^
+        IT[4][(byte)(x[0] >> 32)] ^ IT[5][(byte)(x[0] >> 40)] ^ IT[6][(byte)(x[0] >> 48)] ^ IT[7][(byte)(x[0] >> 56)];
+}
+
+inline void IG256(const word64 x[4], word64 y[4], const word64 k[4])
+{
+    y[0] = k[0] ^ IT[0][(byte)x[0]] ^ IT[1][(byte)(x[0] >> 8)] ^ IT[2][(byte)(x[1] >> 16)] ^ IT[3][(byte)(x[1] >> 24)] ^
+        IT[4][(byte)(x[2] >> 32)] ^ IT[5][(byte)(x[2] >> 40)] ^ IT[6][(byte)(x[3] >> 48)] ^ IT[7][(byte)(x[3] >> 56)];
+    y[1] = k[1] ^ IT[0][(byte)x[1]] ^ IT[1][(byte)(x[1] >> 8)] ^ IT[2][(byte)(x[2] >> 16)] ^ IT[3][(byte)(x[2] >> 24)] ^
+        IT[4][(byte)(x[3] >> 32)] ^ IT[5][(byte)(x[3] >> 40)] ^ IT[6][(byte)(x[0] >> 48)] ^ IT[7][(byte)(x[0] >> 56)];
+    y[2] = k[2] ^ IT[0][(byte)x[2]] ^ IT[1][(byte)(x[2] >> 8)] ^ IT[2][(byte)(x[3] >> 16)] ^ IT[3][(byte)(x[3] >> 24)] ^
+        IT[4][(byte)(x[0] >> 32)] ^ IT[5][(byte)(x[0] >> 40)] ^ IT[6][(byte)(x[1] >> 48)] ^ IT[7][(byte)(x[1] >> 56)];
+    y[3] = k[3] ^ IT[0][(byte)x[3]] ^ IT[1][(byte)(x[3] >> 8)] ^ IT[2][(byte)(x[0] >> 16)] ^ IT[3][(byte)(x[0] >> 24)] ^
+        IT[4][(byte)(x[1] >> 32)] ^ IT[5][(byte)(x[1] >> 40)] ^ IT[6][(byte)(x[2] >> 48)] ^ IT[7][(byte)(x[2] >> 56)];
+}
+
+inline void IG512(const word64 x[8], word64 y[8], const word64 k[8])
+{
+    y[0] = k[0] ^ IT[0][(byte)x[0]] ^ IT[1][(byte)(x[1] >> 8)] ^ IT[2][(byte)(x[2] >> 16)] ^ IT[3][(byte)(x[3] >> 24)] ^
+        IT[4][(byte)(x[4] >> 32)] ^ IT[5][(byte)(x[5] >> 40)] ^ IT[6][(byte)(x[6] >> 48)] ^ IT[7][(byte)(x[7] >> 56)];
+    y[1] = k[1] ^ IT[0][(byte)x[1]] ^ IT[1][(byte)(x[2] >> 8)] ^ IT[2][(byte)(x[3] >> 16)] ^ IT[3][(byte)(x[4] >> 24)] ^
+        IT[4][(byte)(x[5] >> 32)] ^ IT[5][(byte)(x[6] >> 40)] ^ IT[6][(byte)(x[7] >> 48)] ^ IT[7][(byte)(x[0] >> 56)];
+    y[2] = k[2] ^ IT[0][(byte)x[2]] ^ IT[1][(byte)(x[3] >> 8)] ^ IT[2][(byte)(x[4] >> 16)] ^ IT[3][(byte)(x[5] >> 24)] ^
+        IT[4][(byte)(x[6] >> 32)] ^ IT[5][(byte)(x[7] >> 40)] ^ IT[6][(byte)(x[0] >> 48)] ^ IT[7][(byte)(x[1] >> 56)];
+    y[3] = k[3] ^ IT[0][(byte)x[3]] ^ IT[1][(byte)(x[4] >> 8)] ^ IT[2][(byte)(x[5] >> 16)] ^ IT[3][(byte)(x[6] >> 24)] ^
+        IT[4][(byte)(x[7] >> 32)] ^ IT[5][(byte)(x[0] >> 40)] ^ IT[6][(byte)(x[1] >> 48)] ^ IT[7][(byte)(x[2] >> 56)];
+    y[4] = k[4] ^ IT[0][(byte)x[4]] ^ IT[1][(byte)(x[5] >> 8)] ^ IT[2][(byte)(x[6] >> 16)] ^ IT[3][(byte)(x[7] >> 24)] ^
+        IT[4][(byte)(x[0] >> 32)] ^ IT[5][(byte)(x[1] >> 40)] ^ IT[6][(byte)(x[2] >> 48)] ^ IT[7][(byte)(x[3] >> 56)];
+    y[5] = k[5] ^ IT[0][(byte)x[5]] ^ IT[1][(byte)(x[6] >> 8)] ^ IT[2][(byte)(x[7] >> 16)] ^ IT[3][(byte)(x[0] >> 24)] ^
+        IT[4][(byte)(x[1] >> 32)] ^ IT[5][(byte)(x[2] >> 40)] ^ IT[6][(byte)(x[3] >> 48)] ^ IT[7][(byte)(x[4] >> 56)];
+    y[6] = k[6] ^ IT[0][(byte)x[6]] ^ IT[1][(byte)(x[7] >> 8)] ^ IT[2][(byte)(x[0] >> 16)] ^ IT[3][(byte)(x[1] >> 24)] ^
+        IT[4][(byte)(x[2] >> 32)] ^ IT[5][(byte)(x[3] >> 40)] ^ IT[6][(byte)(x[4] >> 48)] ^ IT[7][(byte)(x[5] >> 56)];
+    y[7] = k[7] ^ IT[0][(byte)x[7]] ^ IT[1][(byte)(x[0] >> 8)] ^ IT[2][(byte)(x[1] >> 16)] ^ IT[3][(byte)(x[2] >> 24)] ^
+        IT[4][(byte)(x[3] >> 32)] ^ IT[5][(byte)(x[4] >> 40)] ^ IT[6][(byte)(x[5] >> 48)] ^ IT[7][(byte)(x[6] >> 56)];
+}
+
+inline void IGL128(const word64 x[2], word64 y[2], const word64 k[2])
+{
+    y[0] = (word64(IS[0][(byte)x[0]]) ^ word64(IS[1][(byte)(x[0] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[0] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[0] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[1] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[1] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[1] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[1] >> 56)]) << 56) - k[0];
+    y[1] = (word64(IS[0][(byte)x[1]]) ^ word64(IS[1][(byte)(x[1] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[1] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[1] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[0] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[0] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[0] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[0] >> 56)]) << 56) - k[1];
+}
+
+inline void IGL256(const word64 x[4], word64 y[4], const word64 k[4])
+{
+    y[0] = (word64(IS[0][(byte)x[0]]) ^ word64(IS[1][(byte)(x[0] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[1] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[1] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[2] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[2] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[3] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[3] >> 56)]) << 56) - k[0];
+    y[1] = (word64(IS[0][(byte)x[1]]) ^ word64(IS[1][(byte)(x[1] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[2] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[2] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[3] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[3] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[0] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[0] >> 56)]) << 56) - k[1];
+    y[2] = (word64(IS[0][(byte)x[2]]) ^ word64(IS[1][(byte)(x[2] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[3] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[3] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[0] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[0] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[1] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[1] >> 56)]) << 56) - k[2];
+    y[3] = (word64(IS[0][(byte)x[3]]) ^ word64(IS[1][(byte)(x[3] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[0] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[0] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[1] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[1] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[2] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[2] >> 56)]) << 56) - k[3];
+}
+
+inline void IGL512(const word64 x[8], word64 y[8], const word64 k[8])
+{
+    y[0] = (word64(IS[0][(byte)x[0]]) ^ word64(IS[1][(byte)(x[1] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[2] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[3] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[4] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[5] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[6] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[7] >> 56)]) << 56) - k[0];
+    y[1] = (word64(IS[0][(byte)x[1]]) ^ word64(IS[1][(byte)(x[2] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[3] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[4] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[5] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[6] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[7] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[0] >> 56)]) << 56) - k[1];
+    y[2] = (word64(IS[0][(byte)x[2]]) ^ word64(IS[1][(byte)(x[3] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[4] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[5] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[6] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[7] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[0] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[1] >> 56)]) << 56) - k[2];
+    y[3] = (word64(IS[0][(byte)x[3]]) ^ word64(IS[1][(byte)(x[4] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[5] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[6] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[7] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[0] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[1] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[2] >> 56)]) << 56) - k[3];
+    y[4] = (word64(IS[0][(byte)x[4]]) ^ word64(IS[1][(byte)(x[5] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[6] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[7] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[0] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[1] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[2] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[3] >> 56)]) << 56) - k[4];
+    y[5] = (word64(IS[0][(byte)x[5]]) ^ word64(IS[1][(byte)(x[6] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[7] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[0] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[1] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[2] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[3] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[4] >> 56)]) << 56) - k[5];
+    y[6] = (word64(IS[0][(byte)x[6]]) ^ word64(IS[1][(byte)(x[7] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[0] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[1] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[2] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[3] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[4] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[5] >> 56)]) << 56) - k[6];
+    y[7] = (word64(IS[0][(byte)x[7]]) ^ word64(IS[1][(byte)(x[0] >> 8)]) << 8 ^ word64(IS[2][(byte)(x[1] >> 16)]) << 16 ^ word64(IS[3][(byte)(x[2] >> 24)]) << 24 ^
+        word64(IS[0][(byte)(x[3] >> 32)]) << 32 ^ word64(IS[1][(byte)(x[4] >> 40)]) << 40 ^ word64(IS[2][(byte)(x[5] >> 48)]) << 48 ^ word64(IS[3][(byte)(x[6] >> 56)]) << 56) - k[7];
+}
+
+inline void G128(const word64 x[2], word64 y[2], const word64 k[2])
+{
+    y[0] = k[0] ^ T[0][(byte)x[0]] ^ T[1][(byte)(x[0] >> 8)] ^ T[2][(byte)(x[0] >> 16)] ^ T[3][(byte)(x[0] >> 24)] ^
+        T[4][(byte)(x[1] >> 32)] ^ T[5][(byte)(x[1] >> 40)] ^ T[6][(byte)(x[1] >> 48)] ^ T[7][(byte)(x[1] >> 56)];
+    y[1] = k[1] ^ T[0][(byte)x[1]] ^ T[1][(byte)(x[1] >> 8)] ^ T[2][(byte)(x[1] >> 16)] ^ T[3][(byte)(x[1] >> 24)] ^
+        T[4][(byte)(x[0] >> 32)] ^ T[5][(byte)(x[0] >> 40)] ^ T[6][(byte)(x[0] >> 48)] ^ T[7][(byte)(x[0] >> 56)];
+}
+
+inline void G256(const word64 x[4], word64 y[4], const word64 k[4])
+{
+    y[0] = k[0] ^ T[0][(byte)x[0]] ^ T[1][(byte)(x[0] >> 8)] ^ T[2][(byte)(x[3] >> 16)] ^ T[3][(byte)(x[3] >> 24)] ^
+        T[4][(byte)(x[2] >> 32)] ^ T[5][(byte)(x[2] >> 40)] ^ T[6][(byte)(x[1] >> 48)] ^ T[7][(byte)(x[1] >> 56)];
+    y[1] = k[1] ^ T[0][(byte)x[1]] ^ T[1][(byte)(x[1] >> 8)] ^ T[2][(byte)(x[0] >> 16)] ^ T[3][(byte)(x[0] >> 24)] ^
+        T[4][(byte)(x[3] >> 32)] ^ T[5][(byte)(x[3] >> 40)] ^ T[6][(byte)(x[2] >> 48)] ^ T[7][(byte)(x[2] >> 56)];
+    y[2] = k[2] ^ T[0][(byte)x[2]] ^ T[1][(byte)(x[2] >> 8)] ^ T[2][(byte)(x[1] >> 16)] ^ T[3][(byte)(x[1] >> 24)] ^
+        T[4][(byte)(x[0] >> 32)] ^ T[5][(byte)(x[0] >> 40)] ^ T[6][(byte)(x[3] >> 48)] ^ T[7][(byte)(x[3] >> 56)];
+    y[3] = k[3] ^ T[0][(byte)x[3]] ^ T[1][(byte)(x[3] >> 8)] ^ T[2][(byte)(x[2] >> 16)] ^ T[3][(byte)(x[2] >> 24)] ^
+        T[4][(byte)(x[1] >> 32)] ^ T[5][(byte)(x[1] >> 40)] ^ T[6][(byte)(x[0] >> 48)] ^ T[7][(byte)(x[0] >> 56)];
+}
+
+inline void G512(const word64 x[8], word64 y[8], const word64 k[8])
+{
+    y[0] = k[0] ^ T[0][(byte)x[0]] ^ T[1][(byte)(x[7] >> 8)] ^ T[2][(byte)(x[6] >> 16)] ^ T[3][(byte)(x[5] >> 24)] ^
+        T[4][(byte)(x[4] >> 32)] ^ T[5][(byte)(x[3] >> 40)] ^ T[6][(byte)(x[2] >> 48)] ^ T[7][(byte)(x[1] >> 56)];
+    y[1] = k[1] ^ T[0][(byte)x[1]] ^ T[1][(byte)(x[0] >> 8)] ^ T[2][(byte)(x[7] >> 16)] ^ T[3][(byte)(x[6] >> 24)] ^
+        T[4][(byte)(x[5] >> 32)] ^ T[5][(byte)(x[4] >> 40)] ^ T[6][(byte)(x[3] >> 48)] ^ T[7][(byte)(x[2] >> 56)];
+    y[2] = k[2] ^ T[0][(byte)x[2]] ^ T[1][(byte)(x[1] >> 8)] ^ T[2][(byte)(x[0] >> 16)] ^ T[3][(byte)(x[7] >> 24)] ^
+        T[4][(byte)(x[6] >> 32)] ^ T[5][(byte)(x[5] >> 40)] ^ T[6][(byte)(x[4] >> 48)] ^ T[7][(byte)(x[3] >> 56)];
+    y[3] = k[3] ^ T[0][(byte)x[3]] ^ T[1][(byte)(x[2] >> 8)] ^ T[2][(byte)(x[1] >> 16)] ^ T[3][(byte)(x[0] >> 24)] ^
+        T[4][(byte)(x[7] >> 32)] ^ T[5][(byte)(x[6] >> 40)] ^ T[6][(byte)(x[5] >> 48)] ^ T[7][(byte)(x[4] >> 56)];
+    y[4] = k[4] ^ T[0][(byte)x[4]] ^ T[1][(byte)(x[3] >> 8)] ^ T[2][(byte)(x[2] >> 16)] ^ T[3][(byte)(x[1] >> 24)] ^
+        T[4][(byte)(x[0] >> 32)] ^ T[5][(byte)(x[7] >> 40)] ^ T[6][(byte)(x[6] >> 48)] ^ T[7][(byte)(x[5] >> 56)];
+    y[5] = k[5] ^ T[0][(byte)x[5]] ^ T[1][(byte)(x[4] >> 8)] ^ T[2][(byte)(x[3] >> 16)] ^ T[3][(byte)(x[2] >> 24)] ^
+        T[4][(byte)(x[1] >> 32)] ^ T[5][(byte)(x[0] >> 40)] ^ T[6][(byte)(x[7] >> 48)] ^ T[7][(byte)(x[6] >> 56)];
+    y[6] = k[6] ^ T[0][(byte)x[6]] ^ T[1][(byte)(x[5] >> 8)] ^ T[2][(byte)(x[4] >> 16)] ^ T[3][(byte)(x[3] >> 24)] ^
+        T[4][(byte)(x[2] >> 32)] ^ T[5][(byte)(x[1] >> 40)] ^ T[6][(byte)(x[0] >> 48)] ^ T[7][(byte)(x[7] >> 56)];
+    y[7] = k[7] ^ T[0][(byte)x[7]] ^ T[1][(byte)(x[6] >> 8)] ^ T[2][(byte)(x[5] >> 16)] ^ T[3][(byte)(x[4] >> 24)] ^
+        T[4][(byte)(x[3] >> 32)] ^ T[5][(byte)(x[2] >> 40)] ^ T[6][(byte)(x[1] >> 48)] ^ T[7][(byte)(x[0] >> 56)];
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// *********************** UncheckedSetKey specializations *********************** //
+
+void Kalyna128::Base::SetKey_22(const word64 key[2])
+{
+    word64 *ks = m_wspace+0, *ksc = m_wspace+2, *t1 = m_wspace+4;
+    word64 *t2 = m_wspace+6, *k = m_wspace+8, *kswapped = m_wspace+10;
+
+    std::memset(t1, 0, 2*8);
+    t1[0] = (128 + 128 + 64) / 64;
+
+    AddKey<2>(t1, t2, key);
+    G128(t2, t1, key);
+    GL128(t1, t2, key);
+    G0128(t2, ks);
+
+    word64 constant = W64LIT(0x0001000100010001);
+
+    // round 0
+    std::memcpy(k, key, 16);
+    kswapped[1] = k[0];
+    kswapped[0] = k[1];
+
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[0], ksc);
+    MakeOddKey<2>(&m_rkeys[0], &m_rkeys[2]);
+
+    // round 2
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(kswapped, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[4], ksc);
+    MakeOddKey<2>(&m_rkeys[4], &m_rkeys[6]);
+
+    // round 4
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[8], ksc);
+    MakeOddKey<2>(&m_rkeys[8], &m_rkeys[10]);
+
+    // round 6
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(kswapped, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[12], ksc);
+    MakeOddKey<2>(&m_rkeys[12], &m_rkeys[14]);
+
+    // round 8
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[16], ksc);
+    MakeOddKey<2>(&m_rkeys[16], &m_rkeys[18]);
+
+    // round 10
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(kswapped, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[20], ksc);
+
+    if (!IsForwardTransformation())
+    {
+        IMC128(&m_rkeys[18]); IMC128(&m_rkeys[16]);
+        IMC128(&m_rkeys[14]); IMC128(&m_rkeys[12]);
+        IMC128(&m_rkeys[10]); IMC128(&m_rkeys[ 8]);
+        IMC128(&m_rkeys[ 6]); IMC128(&m_rkeys[ 4]);
+        IMC128(&m_rkeys[ 2]);
+    }
+}
+
+void Kalyna128::Base::SetKey_24(const word64 key[4])
+{
+    word64 *ks = m_wspace+0, *ksc = m_wspace+2, *t1 = m_wspace+4, *t2 = m_wspace+6;
+    word64 *k = m_wspace+8, *ka = m_wspace+12, *ko = m_wspace+14;
+
+    std::memset(t1, 0, 2*8);
+    t1[0] = (128 + 256 + 64) / 64;
+    std::memcpy(ka, key, 16);
+    std::memcpy(ko, key + 2, 16);
+
+    AddKey<2>(t1, t2, ka);
+    G128(t2, t1, ko);
+    GL128(t1, t2, ka);
+    G0128(t2, ks);
+
+    word64 constant = W64LIT(0x0001000100010001);
+
+    // round 0
+    std::memcpy(k, key, 256 / 8);
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[0], ksc);
+    MakeOddKey<2>(&m_rkeys[0], &m_rkeys[2]);
+
+    // round 2
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k + 2, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[4], ksc);
+    MakeOddKey<2>(&m_rkeys[4], &m_rkeys[6]);
+
+    // round 4
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[8], ksc);
+    MakeOddKey<2>(&m_rkeys[8], &m_rkeys[10]);
+
+    // round 6
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k + 2, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[12], ksc);
+    MakeOddKey<2>(&m_rkeys[12], &m_rkeys[14]);
+
+    // round 8
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[16], ksc);
+    MakeOddKey<2>(&m_rkeys[16], &m_rkeys[18]);
+
+    // round 10
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k + 2, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[20], ksc);
+    MakeOddKey<2>(&m_rkeys[20], &m_rkeys[22]);
+
+    // round 12
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[24], ksc);
+    MakeOddKey<2>(&m_rkeys[24], &m_rkeys[26]);
+
+    // round 14
+    constant <<= 1;
+    AddConstant<2>(ks, ksc, constant);
+    AddKey<2>(k + 2, t2, ksc);
+    G128(t2, t1, ksc);
+    GL128(t1, &m_rkeys[28], ksc);
+
+    if (!IsForwardTransformation())
+    {
+        IMC128(&m_rkeys[26]);
+        IMC128(&m_rkeys[24]);
+        IMC128(&m_rkeys[22]);
+        IMC128(&m_rkeys[20]);
+        IMC128(&m_rkeys[18]);
+        IMC128(&m_rkeys[16]);
+        IMC128(&m_rkeys[14]);
+        IMC128(&m_rkeys[12]);
+        IMC128(&m_rkeys[10]);
+        IMC128(&m_rkeys[8]);
+        IMC128(&m_rkeys[6]);
+        IMC128(&m_rkeys[4]);
+        IMC128(&m_rkeys[2]);
+    }
+}
+
+void Kalyna256::Base::SetKey_44(const word64 key[4])
+{
+    word64 *ks = m_wspace+0, *ksc = m_wspace+4, *t1 = m_wspace+8;
+    word64 *t2 = m_wspace+12, *k = m_wspace+16;
+
+    std::memset(t1, 0, 32);
+    t1[0] = (256 + 256 + 64) / 64;
+
+    AddKey<4>(t1, t2, key);
+    G256(t2, t1, key);
+    GL256(t1, t2, key);
+    G0256(t2, ks);
+
+    word64 constant = W64LIT(0x0001000100010001);
+
+    // round 0
+    std::memcpy(k, key, 32);
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[0], ksc);
+    MakeOddKey<4>(&m_rkeys[0], &m_rkeys[4]);
+
+    // round 2
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[8], ksc);
+    MakeOddKey<4>(&m_rkeys[8], &m_rkeys[12]);
+
+    // round 4
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[16], ksc);
+    MakeOddKey<4>(&m_rkeys[16], &m_rkeys[20]);
+
+    // round 6
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[24], ksc);
+    MakeOddKey<4>(&m_rkeys[24], &m_rkeys[28]);
+
+    // round 8
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[32], ksc);
+    MakeOddKey<4>(&m_rkeys[32], &m_rkeys[36]);
+
+    // round 10
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[40], ksc);
+    MakeOddKey<4>(&m_rkeys[40], &m_rkeys[44]);
+
+    // round 12
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[48], ksc);
+    MakeOddKey<4>(&m_rkeys[48], &m_rkeys[52]);
+
+    // round 14
+    SwapBlocks<4>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[56], ksc);
+
+    if (!IsForwardTransformation())
+    {
+        IMC256(&m_rkeys[52]);
+        IMC256(&m_rkeys[48]);
+        IMC256(&m_rkeys[44]);
+        IMC256(&m_rkeys[40]);
+        IMC256(&m_rkeys[36]);
+        IMC256(&m_rkeys[32]);
+        IMC256(&m_rkeys[28]);
+        IMC256(&m_rkeys[24]);
+        IMC256(&m_rkeys[20]);
+        IMC256(&m_rkeys[16]);
+        IMC256(&m_rkeys[12]);
+        IMC256(&m_rkeys[8]);
+        IMC256(&m_rkeys[4]);
+    }
+}
+
+void Kalyna256::Base::SetKey_48(const word64 key[8])
+{
+    word64 *ks = m_wspace+0, *ksc = m_wspace+4, *t1 = m_wspace+8, *t2 = m_wspace+12;
+    word64 *k = m_wspace+16, *ka = m_wspace+24, *ko = m_wspace+28;
+
+    std::memset(t1, 0, 4*8);
+    t1[0] = (512 + 256 + 64) / 64;
+    std::memcpy(ka, key, 32);
+    std::memcpy(ko, key+4, 32);
+
+    AddKey<4>(t1, t2, ka);
+    G256(t2, t1, ko);
+    GL256(t1, t2, ka);
+    G0256(t2, ks);
+
+    word64 constant = W64LIT(0x0001000100010001);
+
+    // round 0
+    std::memcpy(k, key, 512 / 8);
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[0], ksc);
+    MakeOddKey<4>(&m_rkeys[0], &m_rkeys[4]);
+
+    // round 2
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k+4, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[8], ksc);
+    MakeOddKey<4>(&m_rkeys[8], &m_rkeys[12]);
+
+    // round 4
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[16], ksc);
+    MakeOddKey<4>(&m_rkeys[16], &m_rkeys[20]);
+
+    // round 6
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k+4, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[24], ksc);
+    MakeOddKey<4>(&m_rkeys[24], &m_rkeys[28]);
+
+    // round 8
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[32], ksc);
+    MakeOddKey<4>(&m_rkeys[32], &m_rkeys[36]);
+
+    // round 10
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k+4, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[40], ksc);
+    MakeOddKey<4>(&m_rkeys[40], &m_rkeys[44]);
+
+    // round 12
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[48], ksc);
+    MakeOddKey<4>(&m_rkeys[48], &m_rkeys[52]);
+
+    // round 14
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k+4, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[56], ksc);
+    MakeOddKey<4>(&m_rkeys[56], &m_rkeys[60]);
+
+    // round 16
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[64], ksc);
+    MakeOddKey<4>(&m_rkeys[64], &m_rkeys[68]);
+
+    // round 18
+    constant <<= 1;
+    AddConstant<4>(ks, ksc, constant);
+    AddKey<4>(k+4, t2, ksc);
+    G256(t2, t1, ksc);
+    GL256(t1, &m_rkeys[72], ksc);
+
+    if (!IsForwardTransformation())
+    {
+        IMC256(&m_rkeys[68]);
+        IMC256(&m_rkeys[64]);
+        IMC256(&m_rkeys[60]);
+        IMC256(&m_rkeys[56]);
+        IMC256(&m_rkeys[52]);
+        IMC256(&m_rkeys[48]);
+        IMC256(&m_rkeys[44]);
+        IMC256(&m_rkeys[40]);
+        IMC256(&m_rkeys[36]);
+        IMC256(&m_rkeys[32]);
+        IMC256(&m_rkeys[28]);
+        IMC256(&m_rkeys[24]);
+        IMC256(&m_rkeys[20]);
+        IMC256(&m_rkeys[16]);
+        IMC256(&m_rkeys[12]);
+        IMC256(&m_rkeys[8]);
+        IMC256(&m_rkeys[4]);
+    }
+}
+
+void Kalyna512::Base::SetKey_88(const word64 key[8])
+{
+    word64 *ks = m_wspace+0, *ksc = m_wspace+8, *t1 = m_wspace+16;
+    word64 *t2 = m_wspace+24, *k = m_wspace+32;
+
+    std::memset(t1, 0, 8*8);
+    t1[0] = (512 + 512 + 64) / 64;
+
+    AddKey<8>(t1, t2, key);
+    G512(t2, t1, key);
+    GL512(t1, t2, key);
+    G0512(t2, ks);
+
+    word64 constant = W64LIT(0x0001000100010001);
+
+    // round 0
+    std::memcpy(k, key, 512 / 8);
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[0], ksc);
+    MakeOddKey<8>(&m_rkeys[0], &m_rkeys[8]);
+
+    // round 2
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[16], ksc);
+    MakeOddKey<8>(&m_rkeys[16], &m_rkeys[24]);
+
+    // round 4
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[32], ksc);
+    MakeOddKey<8>(&m_rkeys[32], &m_rkeys[40]);
+
+    // round 6
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[48], ksc);
+    MakeOddKey<8>(&m_rkeys[48], &m_rkeys[56]);
+
+    // round 8
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[64], ksc);
+    MakeOddKey<8>(&m_rkeys[64], &m_rkeys[72]);
+
+    // round 10
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[80], ksc);
+    MakeOddKey<8>(&m_rkeys[80], &m_rkeys[88]);
+
+    // round 12
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[96], ksc);
+    MakeOddKey<8>(&m_rkeys[96], &m_rkeys[104]);
+
+    // round 14
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[112], ksc);
+    MakeOddKey<8>(&m_rkeys[112], &m_rkeys[120]);
+
+    // round 16
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[128], ksc);
+    MakeOddKey<8>(&m_rkeys[128], &m_rkeys[136]);
+
+    // round 18
+    SwapBlocks<8>(k);
+    constant <<= 1;
+    AddConstant<8>(ks, ksc, constant);
+    AddKey<8>(k, t2, ksc);
+    G512(t2, t1, ksc);
+    GL512(t1, &m_rkeys[144], ksc);
+
+    if (!IsForwardTransformation())
+    {
+        IMC512(&m_rkeys[136]); IMC512(&m_rkeys[128]); IMC512(&m_rkeys[120]); IMC512(&m_rkeys[112]);
+        IMC512(&m_rkeys[104]); IMC512(&m_rkeys[ 96]); IMC512(&m_rkeys[ 88]); IMC512(&m_rkeys[ 80]);
+        IMC512(&m_rkeys[ 72]); IMC512(&m_rkeys[ 64]); IMC512(&m_rkeys[ 56]); IMC512(&m_rkeys[ 48]);
+        IMC512(&m_rkeys[ 40]); IMC512(&m_rkeys[ 32]); IMC512(&m_rkeys[ 24]); IMC512(&m_rkeys[ 16]);
+        IMC512(&m_rkeys[  8]);
+    }
+}
+
+// *********************** ProcessAndXorBlock specializations *********************** //
+
+void Kalyna128::Base::ProcessBlock_22(const byte* inBlock, const byte* xorBlock, byte* outBlock) const
+{
+    word64 *t1 = m_wspace+0, *t2 = m_wspace+2, *msg = m_wspace+4;
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(msg[0])(msg[1]);
+
+    if (IsForwardTransformation())
+    {
+        AddKey<2>(msg, t1, m_rkeys);
+        G128(t1, t2, &m_rkeys[2]);   // 1
+        G128(t2, t1, &m_rkeys[4]);   // 2
+        G128(t1, t2, &m_rkeys[6]);   // 3
+        G128(t2, t1, &m_rkeys[8]);   // 4
+        G128(t1, t2, &m_rkeys[10]);  // 5
+        G128(t2, t1, &m_rkeys[12]);  // 6
+        G128(t1, t2, &m_rkeys[14]);  // 7
+        G128(t2, t1, &m_rkeys[16]);  // 8
+        G128(t1, t2, &m_rkeys[18]);  // 9
+        GL128(t2, t1, &m_rkeys[20]); // 10
+    }
+    else
+    {
+        SubKey<2>(msg, t1, &m_rkeys[20]);
+        IMC128(t1);
+        IG128(t1, t2, &m_rkeys[18]);
+        IG128(t2, t1, &m_rkeys[16]);
+        IG128(t1, t2, &m_rkeys[14]);
+        IG128(t2, t1, &m_rkeys[12]);
+        IG128(t1, t2, &m_rkeys[10]);
+        IG128(t2, t1, &m_rkeys[8]);
+        IG128(t1, t2, &m_rkeys[6]);
+        IG128(t2, t1, &m_rkeys[4]);
+        IG128(t1, t2, &m_rkeys[2]);
+        IGL128(t2, t1, &m_rkeys[0]);
+    }
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(t1[0])(t1[1]);
+}
+
+void Kalyna128::Base::ProcessBlock_24(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64 *t1 = m_wspace+0, *t2 = m_wspace+2, *msg = m_wspace+4;
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(msg[0])(msg[1]);
+
+    if (IsForwardTransformation())
+    {
+        AddKey<2>(msg, t1, m_rkeys);
+        G128(t1, t2, &m_rkeys[ 2]); // 1
+        G128(t2, t1, &m_rkeys[ 4]); // 2
+        G128(t1, t2, &m_rkeys[ 6]); // 3
+        G128(t2, t1, &m_rkeys[ 8]); // 4
+        G128(t1, t2, &m_rkeys[10]); // 5
+        G128(t2, t1, &m_rkeys[12]); // 6
+        G128(t1, t2, &m_rkeys[14]); // 7
+        G128(t2, t1, &m_rkeys[16]); // 8
+        G128(t1, t2, &m_rkeys[18]); // 9
+        G128(t2, t1, &m_rkeys[20]); // 10
+        G128(t1, t2, &m_rkeys[22]); // 11
+        G128(t2, t1, &m_rkeys[24]); // 12
+        G128(t1, t2, &m_rkeys[26]); // 13
+        GL128(t2, t1, &m_rkeys[28]); // 14
+    }
+    else
+    {
+        SubKey<2>(msg, t1, &m_rkeys[28]);
+        IMC128(t1);
+        IG128(t1, t2, &m_rkeys[26]);
+        IG128(t2, t1, &m_rkeys[24]);
+        IG128(t1, t2, &m_rkeys[22]);
+        IG128(t2, t1, &m_rkeys[20]);
+        IG128(t1, t2, &m_rkeys[18]);
+        IG128(t2, t1, &m_rkeys[16]);
+        IG128(t1, t2, &m_rkeys[14]);
+        IG128(t2, t1, &m_rkeys[12]);
+        IG128(t1, t2, &m_rkeys[10]);
+        IG128(t2, t1, &m_rkeys[8]);
+        IG128(t1, t2, &m_rkeys[6]);
+        IG128(t2, t1, &m_rkeys[4]);
+        IG128(t1, t2, &m_rkeys[2]);
+        IGL128(t2, t1, &m_rkeys[0]);
+    }
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(t1[0])(t1[1]);
+}
+
+void Kalyna256::Base::ProcessBlock_44(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64 *t1 = m_wspace+0, *t2 = m_wspace+4, *msg = m_wspace+8;
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(msg[0])(msg[1])(msg[2])(msg[3]);
+
+    if (IsForwardTransformation())
+    {
+        AddKey<4>(msg, t1, m_rkeys);
+        G256(t1, t2, &m_rkeys[4]); // 1
+        G256(t2, t1, &m_rkeys[8]); // 2
+        G256(t1, t2, &m_rkeys[12]); // 3
+        G256(t2, t1, &m_rkeys[16]); // 4
+        G256(t1, t2, &m_rkeys[20]); // 5
+        G256(t2, t1, &m_rkeys[24]); // 6
+        G256(t1, t2, &m_rkeys[28]); // 7
+        G256(t2, t1, &m_rkeys[32]); // 8
+        G256(t1, t2, &m_rkeys[36]); // 9
+        G256(t2, t1, &m_rkeys[40]); // 10
+        G256(t1, t2, &m_rkeys[44]); // 11
+        G256(t2, t1, &m_rkeys[48]); // 12
+        G256(t1, t2, &m_rkeys[52]); // 13
+        GL256(t2, t1, &m_rkeys[56]); // 14
+    }
+    else
+    {
+        SubKey<4>(msg, t1, &m_rkeys[56]);
+        IMC256(t1);
+        IG256(t1, t2, &m_rkeys[52]);
+        IG256(t2, t1, &m_rkeys[48]);
+        IG256(t1, t2, &m_rkeys[44]);
+        IG256(t2, t1, &m_rkeys[40]);
+        IG256(t1, t2, &m_rkeys[36]);
+        IG256(t2, t1, &m_rkeys[32]);
+        IG256(t1, t2, &m_rkeys[28]);
+        IG256(t2, t1, &m_rkeys[24]);
+        IG256(t1, t2, &m_rkeys[20]);
+        IG256(t2, t1, &m_rkeys[16]);
+        IG256(t1, t2, &m_rkeys[12]);
+        IG256(t2, t1, &m_rkeys[8]);
+        IG256(t1, t2, &m_rkeys[4]);
+        IGL256(t2, t1, &m_rkeys[0]);
+    }
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(t1[0])(t1[1])(t1[2])(t1[3]);
+}
+
+void Kalyna256::Base::ProcessBlock_48(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64 *t1 = m_wspace+0, *t2 = m_wspace+4, *msg = m_wspace+8;
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(msg[0])(msg[1])(msg[2])(msg[3]);
+
+    if (IsForwardTransformation())
+    {
+        AddKey<4>(msg, t1, m_rkeys);
+        G256(t1, t2, &m_rkeys[4]); // 1
+        G256(t2, t1, &m_rkeys[8]); // 2
+        G256(t1, t2, &m_rkeys[12]); // 3
+        G256(t2, t1, &m_rkeys[16]); // 4
+        G256(t1, t2, &m_rkeys[20]); // 5
+        G256(t2, t1, &m_rkeys[24]); // 6
+        G256(t1, t2, &m_rkeys[28]); // 7
+        G256(t2, t1, &m_rkeys[32]); // 8
+        G256(t1, t2, &m_rkeys[36]); // 9
+        G256(t2, t1, &m_rkeys[40]); // 10
+        G256(t1, t2, &m_rkeys[44]); // 11
+        G256(t2, t1, &m_rkeys[48]); // 12
+        G256(t1, t2, &m_rkeys[52]); // 13
+        G256(t2, t1, &m_rkeys[56]); // 14
+        G256(t1, t2, &m_rkeys[60]); // 15
+        G256(t2, t1, &m_rkeys[64]); // 16
+        G256(t1, t2, &m_rkeys[68]); // 17
+        GL256(t2, t1, &m_rkeys[72]); // 18
+    }
+    else
+    {
+        SubKey<4>(msg, t1, &m_rkeys[72]);
+        IMC256(t1);
+        IG256(t1, t2, &m_rkeys[68]);
+        IG256(t2, t1, &m_rkeys[64]);
+        IG256(t1, t2, &m_rkeys[60]);
+        IG256(t2, t1, &m_rkeys[56]);
+        IG256(t1, t2, &m_rkeys[52]);
+        IG256(t2, t1, &m_rkeys[48]);
+        IG256(t1, t2, &m_rkeys[44]);
+        IG256(t2, t1, &m_rkeys[40]);
+        IG256(t1, t2, &m_rkeys[36]);
+        IG256(t2, t1, &m_rkeys[32]);
+        IG256(t1, t2, &m_rkeys[28]);
+        IG256(t2, t1, &m_rkeys[24]);
+        IG256(t1, t2, &m_rkeys[20]);
+        IG256(t2, t1, &m_rkeys[16]);
+        IG256(t1, t2, &m_rkeys[12]);
+        IG256(t2, t1, &m_rkeys[8]);
+        IG256(t1, t2, &m_rkeys[4]);
+        IGL256(t2, t1, &m_rkeys[0]);
+    }
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(t1[0])(t1[1])(t1[2])(t1[3]);
+}
+
+void Kalyna512::Base::ProcessBlock_88(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64 *t1 = m_wspace+0, *t2 = m_wspace+8, *msg = m_wspace+16;
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(msg[0])(msg[1])(msg[2])(msg[3])(msg[4])(msg[5])(msg[6])(msg[7]);
+
+    if (IsForwardTransformation())
+    {
+        AddKey<8>(msg, t1, m_rkeys);
+        G512(t1, t2, &m_rkeys[8]); // 1
+        G512(t2, t1, &m_rkeys[16]); // 2
+        G512(t1, t2, &m_rkeys[24]); // 3
+        G512(t2, t1, &m_rkeys[32]); // 4
+        G512(t1, t2, &m_rkeys[40]); // 5
+        G512(t2, t1, &m_rkeys[48]); // 6
+        G512(t1, t2, &m_rkeys[56]); // 7
+        G512(t2, t1, &m_rkeys[64]); // 8
+        G512(t1, t2, &m_rkeys[72]); // 9
+        G512(t2, t1, &m_rkeys[80]); // 10
+        G512(t1, t2, &m_rkeys[88]); // 11
+        G512(t2, t1, &m_rkeys[96]); // 12
+        G512(t1, t2, &m_rkeys[104]); // 13
+        G512(t2, t1, &m_rkeys[112]); // 14
+        G512(t1, t2, &m_rkeys[120]); // 15
+        G512(t2, t1, &m_rkeys[128]); // 16
+        G512(t1, t2, &m_rkeys[136]); // 17
+        GL512(t2, t1, &m_rkeys[144]); // 18
+    }
+    else
+    {
+        SubKey<8>(msg, t1, &m_rkeys[144]);
+        IMC512(t1);
+        IG512(t1, t2, &m_rkeys[136]);
+        IG512(t2, t1, &m_rkeys[128]);
+        IG512(t1, t2, &m_rkeys[120]);
+        IG512(t2, t1, &m_rkeys[112]);
+        IG512(t1, t2, &m_rkeys[104]);
+        IG512(t2, t1, &m_rkeys[96]);
+        IG512(t1, t2, &m_rkeys[88]);
+        IG512(t2, t1, &m_rkeys[80]);
+        IG512(t1, t2, &m_rkeys[72]);
+        IG512(t2, t1, &m_rkeys[64]);
+        IG512(t1, t2, &m_rkeys[56]);
+        IG512(t2, t1, &m_rkeys[48]);
+        IG512(t1, t2, &m_rkeys[40]);
+        IG512(t2, t1, &m_rkeys[32]);
+        IG512(t1, t2, &m_rkeys[24]);
+        IG512(t2, t1, &m_rkeys[16]);
+        IG512(t1, t2, &m_rkeys[8]);
+        IGL512(t2, t1, &m_rkeys[0]);
+    }
+
+    // Reverse bytes on BigEndian; Align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(t1[0])(t1[1])(t1[2])(t1[3])(t1[4])(t1[5])(t1[6])(t1[7]);
+}
+
+// *********************** Library routines *********************** //
+
+void Kalyna128::Base::UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &params)
+{
+    CRYPTOPP_UNUSED(params);
+    m_nb = static_cast<unsigned int>(16U / sizeof(word64));
+    m_nk = static_cast<unsigned int>(keylen / sizeof(word64));
+
+    switch (keylen)
+    {
+    case 16:  // 128
+        m_kl = 16;
+        m_mkey.New(2);
+        m_rkeys.New(11*2);
+        m_wspace.New(2*6);
+
+        GetUserKey(LITTLE_ENDIAN_ORDER, m_mkey.begin(), 2, key, 16);
+        SetKey_22(m_mkey.begin());
+        break;
+    case 32:  // 256
+        m_kl = 32;
+        m_mkey.New(4);
+        m_rkeys.New(15*2);
+        m_wspace.New(6*2+4);
+
+        GetUserKey(LITTLE_ENDIAN_ORDER, m_mkey.begin(), 4, key, 32);
+        SetKey_24(m_mkey.begin());
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+}
+
+void Kalyna128::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Timing attack countermeasure. see comments in Rijndael for more details
+    const int cacheLineSize = GetCacheLineSize();
+    volatile word64 _u = 0;
+    word64 u = _u;
+
+    const byte* p = reinterpret_cast<const byte*>(KalynaTab::S);
+    for (unsigned int i=0; i<256; i+=cacheLineSize)
+        u ^= *reinterpret_cast<const word64*>(p+i);
+    m_wspace[0] = u;
+
+    switch ((m_nb << 8) | m_nk)
+    {
+    case (2 << 8) | 2:
+        ProcessBlock_22(inBlock, xorBlock, outBlock);
+        break;
+    case (2 << 8) | 4:
+        ProcessBlock_24(inBlock, xorBlock, outBlock);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+}
+
+void Kalyna256::Base::UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &params)
+{
+    CRYPTOPP_UNUSED(params);
+    m_nb = static_cast<unsigned int>(32U / sizeof(word64));
+    m_nk = static_cast<unsigned int>(keylen / sizeof(word64));
+
+    switch (keylen)
+    {
+    case 32:  // 256
+        m_kl = 32;
+        m_mkey.New(4);
+        m_rkeys.New(15*4);
+        m_wspace.New(5*4);
+
+        GetUserKey(LITTLE_ENDIAN_ORDER, m_mkey.begin(), 4, key, 32);
+        SetKey_44(m_mkey.begin());
+        break;
+    case 64:  // 512
+        m_kl = 64;
+        m_mkey.New(8);
+        m_rkeys.New(19*4);
+        m_wspace.New(6*4+8);
+
+        GetUserKey(LITTLE_ENDIAN_ORDER, m_mkey.begin(), 8, key, 64);
+        SetKey_48(m_mkey.begin());
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+}
+
+void Kalyna256::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Timing attack countermeasure. see comments in Rijndael for more details
+    const int cacheLineSize = GetCacheLineSize();
+    volatile word64 _u = 0;
+    word64 u = _u;
+
+    const byte* p = reinterpret_cast<const byte*>(KalynaTab::S);
+    for (unsigned int i=0; i<256; i+=cacheLineSize)
+        u ^= *reinterpret_cast<const word64*>(p+i);
+    m_wspace[0] = u;
+
+    switch ((m_nb << 8) | m_nk)
+    {
+    case (4 << 8) | 4:
+        ProcessBlock_44(inBlock, xorBlock, outBlock);
+        break;
+    case (4 << 8) | 8:
+        ProcessBlock_48(inBlock, xorBlock, outBlock);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+}
+
+void Kalyna512::Base::UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &params)
+{
+    CRYPTOPP_UNUSED(params);
+    m_nb = static_cast<unsigned int>(64U / sizeof(word64));
+    m_nk = static_cast<unsigned int>(keylen / sizeof(word64));
+
+    switch (keylen)
+    {
+    case 64:  // 512
+        m_kl = 64;
+        m_nb = static_cast<unsigned int>(64U / sizeof(word64));
+        m_nk = static_cast<unsigned int>(keylen / sizeof(word64));
+
+        m_mkey.New(8);
+        m_rkeys.New(19*8);
+        m_wspace.New(5*8);
+
+        GetUserKey(LITTLE_ENDIAN_ORDER, m_mkey.begin(), 8, key, 64);
+        SetKey_88(m_mkey.begin());
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+}
+
+void Kalyna512::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Timing attack countermeasure. see comments in Rijndael for more details
+    const int cacheLineSize = GetCacheLineSize();
+    volatile word64 _u = 0;
+    word64 u = _u;
+
+    const byte* p = reinterpret_cast<const byte*>(KalynaTab::S);
+    for (unsigned int i=0; i<256; i+=cacheLineSize)
+        u ^= *reinterpret_cast<const word64*>(p+i);
+    m_wspace[0] = u;
+
+    ProcessBlock_88(inBlock, xorBlock, outBlock);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/kalyna.h b/runtime/third_party/cryptopp/kalyna.h
new file mode 100644
index 0000000..0466ac1
--- /dev/null
+++ b/runtime/third_party/cryptopp/kalyna.h
@@ -0,0 +1,218 @@
+// kalyna.h - written and placed in the public domain by Jeffrey Walton
+//            Based on public domain code by Keru Kuro.
+
+/// \file kalyna.h
+/// \brief Classes for the Kalyna block cipher
+/// \details The Crypto++ implementation relied upon three sources. First was Oliynykov, Gorbenko, Kazymyrov,
+///   Ruzhentsev, Kuznetsov, Gorbenko, Dyrda, Dolgov, Pushkaryov, Mordvinov and Kaidalov's "A New Encryption
+///   Standard of Ukraine: The Kalyna Block Cipher" (http://eprint.iacr.org/2015/650.pdf). Second was Roman
+///   Oliynykov and Oleksandr Kazymyrov's GitHub with the reference implementation
+///   (http://github.com/Roman-Oliynykov/Kalyna-reference). The third resource was Keru Kuro's implementation
+///   of Kalyna in CppCrypto (http://sourceforge.net/projects/cppcrypto/). Kuro has an outstanding
+///   implementation that performed better than the reference implementation and our initial attempts.
+
+#ifndef CRYPTOPP_KALYNA_H
+#define CRYPTOPP_KALYNA_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Kalyna-128 block cipher information
+/// \since Crypto++ 6.0
+struct CRYPTOPP_NO_VTABLE Kalyna128_Info : public FixedBlockSize<16>, VariableKeyLength<16, 16, 32>
+{
+    static const char* StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize(Keylength)
+        return "Kalyna-128";
+    }
+};
+
+/// \brief Kalyna-256 block cipher information
+/// \since Crypto++ 6.0
+struct CRYPTOPP_NO_VTABLE Kalyna256_Info : public FixedBlockSize<32>, VariableKeyLength<32, 32, 64>
+{
+    static const char* StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize(Keylength)
+        return "Kalyna-256";
+    }
+};
+
+/// \brief Kalyna-512 block cipher information
+/// \since Crypto++ 6.0
+struct CRYPTOPP_NO_VTABLE Kalyna512_Info : public FixedBlockSize<64>, FixedKeyLength<64>
+{
+    static const char* StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize(Keylength)
+        return "Kalyna-512";
+    }
+};
+
+/// \brief Kalyna block cipher base class
+/// \since Crypto++ 6.0
+class CRYPTOPP_NO_VTABLE Kalyna_Base
+{
+public:
+    virtual ~Kalyna_Base() {}
+
+protected:
+    typedef SecBlock<word64, AllocatorWithCleanup<word64, true> > AlignedSecBlock64;
+    mutable AlignedSecBlock64 m_wspace;  // work space
+    AlignedSecBlock64         m_mkey;    // master key
+    AlignedSecBlock64         m_rkeys;   // round keys
+    unsigned int     m_kl, m_nb, m_nk;   // number 64-bit blocks and keys
+};
+
+/// \brief Kalyna 128-bit block cipher
+/// \details Kalyna128 provides 128-bit block size. The valid key sizes are 128-bit and 256-bit.
+/// \since Crypto++ 6.0
+class Kalyna128 : public Kalyna128_Info, public BlockCipherDocumentation
+{
+public:
+    class CRYPTOPP_NO_VTABLE Base : public Kalyna_Base, public BlockCipherImpl<Kalyna128_Info>
+    {
+    public:
+        /// \brief Provides the name of this algorithm
+        /// \return the standard algorithm name
+        /// \details If the object is unkeyed, then the generic name "Kalyna" is returned
+        ///   to the caller. If the algorithm is keyed, then a two or three part name is
+        ///   returned to the caller. The name follows DSTU 7624:2014, where block size is
+        ///   provided first and then key length. The library uses a dash to identify block size
+        ///   and parenthesis to identify key length. For example, Kalyna-128(256) is Kalyna
+        ///   with a 128-bit block size and a 256-bit key length. If a mode is associated
+        ///   with the object, then it follows as expected. For example, Kalyna-128(256)/ECB.
+        ///   DSTU is a little more complex with more parameters, dashes, underscores, but the
+        ///   library does not use the delimiters or full convention.
+        std::string AlgorithmName() const {
+            return std::string("Kalyna-128") + "(" + IntToString(m_kl*8) + ")";
+        }
+
+        /// \brief Provides input and output data alignment for optimal performance.
+        /// \return the input data alignment that provides optimal performance
+        /// \sa GetAlignment() and OptimalBlockSize()
+        unsigned int OptimalDataAlignment() const {
+            return GetAlignmentOf<word64>();
+        }
+
+    protected:
+        void UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &params);
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+    protected:
+        void SetKey_22(const word64 key[2]);
+        void SetKey_24(const word64 key[4]);
+        void ProcessBlock_22(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+        void ProcessBlock_24(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+/// \brief Kalyna 256-bit block cipher
+/// \details Kalyna256 provides 256-bit block size. The valid key sizes are 256-bit and 512-bit.
+/// \since Crypto++ 6.0
+class Kalyna256 : public Kalyna256_Info, public BlockCipherDocumentation
+{
+public:
+    class CRYPTOPP_NO_VTABLE Base : public Kalyna_Base, public BlockCipherImpl<Kalyna256_Info>
+    {
+    public:
+        /// \brief Provides the name of this algorithm
+        /// \return the standard algorithm name
+        /// \details If the object is unkeyed, then the generic name "Kalyna" is returned
+        ///   to the caller. If the algorithm is keyed, then a two or three part name is
+        ///   returned to the caller. The name follows DSTU 7624:2014, where block size is
+        ///   provided first and then key length. The library uses a dash to identify block size
+        ///   and parenthesis to identify key length. For example, Kalyna-128(256) is Kalyna
+        ///   with a 128-bit block size and a 256-bit key length. If a mode is associated
+        ///   with the object, then it follows as expected. For example, Kalyna-128(256)/ECB.
+        ///   DSTU is a little more complex with more parameters, dashes, underscores, but the
+        ///   library does not use the delimiters or full convention.
+        std::string AlgorithmName() const {
+            return std::string("Kalyna-256") + "(" + IntToString(m_kl*8) + ")";
+        }
+
+        /// \brief Provides input and output data alignment for optimal performance.
+        /// \return the input data alignment that provides optimal performance
+        /// \sa GetAlignment() and OptimalBlockSize()
+        unsigned int OptimalDataAlignment() const {
+            return GetAlignmentOf<word64>();
+        }
+
+    protected:
+        void UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &params);
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+    protected:
+        void SetKey_44(const word64 key[4]);
+        void SetKey_48(const word64 key[8]);
+        void ProcessBlock_44(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+        void ProcessBlock_48(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+/// \brief Kalyna 512-bit block cipher
+/// \details Kalyna512 provides 512-bit block size. The valid key size is 512-bit.
+/// \since Crypto++ 6.0
+class Kalyna512 : public Kalyna512_Info, public BlockCipherDocumentation
+{
+public:
+    class CRYPTOPP_NO_VTABLE Base : public Kalyna_Base, public BlockCipherImpl<Kalyna512_Info>
+    {
+    public:
+        /// \brief Provides the name of this algorithm
+        /// \return the standard algorithm name
+        /// \details If the object is unkeyed, then the generic name "Kalyna" is returned
+        ///   to the caller. If the algorithm is keyed, then a two or three part name is
+        ///   returned to the caller. The name follows DSTU 7624:2014, where block size is
+        ///   provided first and then key length. The library uses a dash to identify block size
+        ///   and parenthesis to identify key length. For example, Kalyna-128(256) is Kalyna
+        ///   with a 128-bit block size and a 256-bit key length. If a mode is associated
+        ///   with the object, then it follows as expected. For example, Kalyna-128(256)/ECB.
+        ///   DSTU is a little more complex with more parameters, dashes, underscores, but the
+        ///   library does not use the delimiters or full convention.
+        std::string AlgorithmName() const {
+            return std::string("Kalyna-512") + "(" + IntToString(m_kl*8) + ")";
+        }
+
+        /// \brief Provides input and output data alignment for optimal performance.
+        /// \return the input data alignment that provides optimal performance
+        /// \sa GetAlignment() and OptimalBlockSize()
+        unsigned int OptimalDataAlignment() const {
+            return GetAlignmentOf<word64>();
+        }
+
+    protected:
+        void UncheckedSetKey(const byte *key, unsigned int keylen, const NameValuePairs &params);
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+    protected:
+        void SetKey_88(const word64 key[8]);
+        void ProcessBlock_88(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+typedef Kalyna128::Encryption Kalyna128Encryption;
+typedef Kalyna128::Decryption Kalyna128Decryption;
+
+typedef Kalyna256::Encryption Kalyna256Encryption;
+typedef Kalyna256::Decryption Kalyna256Decryption;
+
+typedef Kalyna512::Encryption Kalyna512Encryption;
+typedef Kalyna512::Decryption Kalyna512Decryption;
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_KALYNA_H
diff --git a/runtime/third_party/cryptopp/kalynatab.cpp b/runtime/third_party/cryptopp/kalynatab.cpp
new file mode 100644
index 0000000..f1c7179
--- /dev/null
+++ b/runtime/third_party/cryptopp/kalynatab.cpp
@@ -0,0 +1,1232 @@
+// kalynatab.cpp - written and placed in the public domain by Jeffrey Walton
+
+#include "pch.h"
+#include "config.h"
+#include "kalyna.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(KalynaTab)
+
+extern const word64 T[8][256];  // Columns
+extern const word64 IT[8][256]; // Inverse
+extern const byte S[4][256];    // Substitution
+extern const byte IS[4][256];   // Inverse
+
+const word64 T[8][256] =
+{
+    {
+        W64LIT(0xa832a829d77f9aa8), W64LIT(0x4352432297d41143), W64LIT(0x5f3e5fc2df80615f), W64LIT(0x061e063014121806),
+        W64LIT(0x6bda6b7f670cb16b), W64LIT(0x75bc758f2356c975), W64LIT(0x6cc16c477519ad6c), W64LIT(0x592059f2cb927959),
+        W64LIT(0x71a871af3b4ad971), W64LIT(0xdf84dfb6f8275bdf), W64LIT(0x87a1874c35b22687), W64LIT(0x95fb95dc59cc6e95),
+        W64LIT(0x174b17b872655c17), W64LIT(0xf017f0d31aeae7f0), W64LIT(0xd89fd88eea3247d8), W64LIT(0x092d0948363f2409),
+        W64LIT(0x6dc46d4f731ea96d), W64LIT(0xf318f3cb10e3ebf3), W64LIT(0x1d691de84e53741d), W64LIT(0xcbc0cb16804b0bcb),
+        W64LIT(0xc9cac9068c4503c9), W64LIT(0x4d644d52b3fe294d), W64LIT(0x2c9c2c7de8c4b02c), W64LIT(0xaf29af11c56a86af),
+        W64LIT(0x798079ef0b72f979), W64LIT(0xe047e0537a9aa7e0), W64LIT(0x97f197cc55c26697), W64LIT(0xfd2efdbb34c9d3fd),
+        W64LIT(0x6fce6f5f7f10a16f), W64LIT(0x4b7a4b62a7ec314b), W64LIT(0x454c451283c60945), W64LIT(0x39dd39d596afe439),
+        W64LIT(0x3ec63eed84baf83e), W64LIT(0xdd8edda6f42953dd), W64LIT(0xa315a371ed4eb6a3), W64LIT(0x4f6e4f42bff0214f),
+        W64LIT(0xb45eb4c99f2beab4), W64LIT(0xb654b6d99325e2b6), W64LIT(0x9ac89aa47be1529a), W64LIT(0x0e360e70242a380e),
+        W64LIT(0x1f631ff8425d7c1f), W64LIT(0xbf79bf91a51ac6bf), W64LIT(0x154115a87e6b5415), W64LIT(0xe142e15b7c9da3e1),
+        W64LIT(0x49704972abe23949), W64LIT(0xd2bdd2ded6046fd2), W64LIT(0x93e593ec4dde7693), W64LIT(0xc6f9c67eae683fc6),
+        W64LIT(0x92e092e44bd97292), W64LIT(0x72a772b73143d572), W64LIT(0x9edc9e8463fd429e), W64LIT(0x61f8612f5b3a9961),
+        W64LIT(0xd1b2d1c6dc0d63d1), W64LIT(0x63f2633f57349163), W64LIT(0xfa35fa8326dccffa), W64LIT(0xee71ee235eb09fee),
+        W64LIT(0xf403f4f302f6f7f4), W64LIT(0x197d19c8564f6419), W64LIT(0xd5a6d5e6c41173d5), W64LIT(0xad23ad01c9648ead),
+        W64LIT(0x582558facd957d58), W64LIT(0xa40ea449ff5baaa4), W64LIT(0xbb6dbbb1bd06d6bb), W64LIT(0xa11fa161e140bea1),
+        W64LIT(0xdc8bdcaef22e57dc), W64LIT(0xf21df2c316e4eff2), W64LIT(0x83b5836c2dae3683), W64LIT(0x37eb37a5b285dc37),
+        W64LIT(0x4257422a91d31542), W64LIT(0xe453e4736286b7e4), W64LIT(0x7a8f7af7017bf57a), W64LIT(0x32fa328dac9ec832),
+        W64LIT(0x9cd69c946ff34a9c), W64LIT(0xccdbcc2e925e17cc), W64LIT(0xab3dab31dd7696ab), W64LIT(0x4a7f4a6aa1eb354a),
+        W64LIT(0x8f898f0c058a068f), W64LIT(0x6ecb6e577917a56e), W64LIT(0x04140420181c1004), W64LIT(0x27bb2725d2f59c27),
+        W64LIT(0x2e962e6de4cab82e), W64LIT(0xe75ce76b688fbbe7), W64LIT(0xe24de2437694afe2), W64LIT(0x5a2f5aeac19b755a),
+        W64LIT(0x96f496c453c56296), W64LIT(0x164e16b074625816), W64LIT(0x23af2305cae98c23), W64LIT(0x2b872b45fad1ac2b),
+        W64LIT(0xc2edc25eb6742fc2), W64LIT(0x65ec650f43268965), W64LIT(0x66e36617492f8566), W64LIT(0x0f330f78222d3c0f),
+        W64LIT(0xbc76bc89af13cabc), W64LIT(0xa937a921d1789ea9), W64LIT(0x474647028fc80147), W64LIT(0x415841329bda1941),
+        W64LIT(0x34e434bdb88cd034), W64LIT(0x4875487aade53d48), W64LIT(0xfc2bfcb332ced7fc), W64LIT(0xb751b7d19522e6b7),
+        W64LIT(0x6adf6a77610bb56a), W64LIT(0x88928834179f1a88), W64LIT(0xa50ba541f95caea5), W64LIT(0x530253a2f7a45153),
+        W64LIT(0x86a4864433b52286), W64LIT(0xf93af99b2cd5c3f9), W64LIT(0x5b2a5be2c79c715b), W64LIT(0xdb90db96e03b4bdb),
+        W64LIT(0x38d838dd90a8e038), W64LIT(0x7b8a7bff077cf17b), W64LIT(0xc3e8c356b0732bc3), W64LIT(0x1e661ef0445a781e),
+        W64LIT(0x22aa220dccee8822), W64LIT(0x33ff3385aa99cc33), W64LIT(0x24b4243dd8fc9024), W64LIT(0x2888285df0d8a028),
+        W64LIT(0x36ee36adb482d836), W64LIT(0xc7fcc776a86f3bc7), W64LIT(0xb240b2f98b39f2b2), W64LIT(0x3bd73bc59aa1ec3b),
+        W64LIT(0x8e8c8e04038d028e), W64LIT(0x77b6779f2f58c177), W64LIT(0xba68bab9bb01d2ba), W64LIT(0xf506f5fb04f1f3f5),
+        W64LIT(0x144414a0786c5014), W64LIT(0x9fd99f8c65fa469f), W64LIT(0x0828084030382008), W64LIT(0x551c5592e3b64955),
+        W64LIT(0x9bcd9bac7de6569b), W64LIT(0x4c614c5ab5f92d4c), W64LIT(0xfe21fea33ec0dffe), W64LIT(0x60fd60275d3d9d60),
+        W64LIT(0x5c315cdad5896d5c), W64LIT(0xda95da9ee63c4fda), W64LIT(0x187818c050486018), W64LIT(0x4643460a89cf0546),
+        W64LIT(0xcddecd26945913cd), W64LIT(0x7d947dcf136ee97d), W64LIT(0x21a52115c6e78421), W64LIT(0xb04ab0e98737fab0),
+        W64LIT(0x3fc33fe582bdfc3f), W64LIT(0x1b771bd85a416c1b), W64LIT(0x8997893c11981e89), W64LIT(0xff24ffab38c7dbff),
+        W64LIT(0xeb60eb0b40ab8beb), W64LIT(0x84ae84543fbb2a84), W64LIT(0x69d0696f6b02b969), W64LIT(0x3ad23acd9ca6e83a),
+        W64LIT(0x9dd39d9c69f44e9d), W64LIT(0xd7acd7f6c81f7bd7), W64LIT(0xd3b8d3d6d0036bd3), W64LIT(0x70ad70a73d4ddd70),
+        W64LIT(0x67e6671f4f288167), W64LIT(0x405d403a9ddd1d40), W64LIT(0xb55bb5c1992ceeb5), W64LIT(0xde81debefe205fde),
+        W64LIT(0x5d345dd2d38e695d), W64LIT(0x30f0309da090c030), W64LIT(0x91ef91fc41d07e91), W64LIT(0xb14fb1e18130feb1),
+        W64LIT(0x788578e70d75fd78), W64LIT(0x1155118866774411), W64LIT(0x0105010806070401), W64LIT(0xe556e57b6481b3e5),
+        W64LIT(0x0000000000000000), W64LIT(0x68d568676d05bd68), W64LIT(0x98c298b477ef5a98), W64LIT(0xa01aa069e747baa0),
+        W64LIT(0xc5f6c566a46133c5), W64LIT(0x020a02100c0e0802), W64LIT(0xa604a659f355a2a6), W64LIT(0x74b974872551cd74),
+        W64LIT(0x2d992d75eec3b42d), W64LIT(0x0b270b583a312c0b), W64LIT(0xa210a279eb49b2a2), W64LIT(0x76b37697295fc576),
+        W64LIT(0xb345b3f18d3ef6b3), W64LIT(0xbe7cbe99a31dc2be), W64LIT(0xced1ce3e9e501fce), W64LIT(0xbd73bd81a914cebd),
+        W64LIT(0xae2cae19c36d82ae), W64LIT(0xe96ae91b4ca583e9), W64LIT(0x8a988a241b91128a), W64LIT(0x31f53195a697c431),
+        W64LIT(0x1c6c1ce04854701c), W64LIT(0xec7bec3352be97ec), W64LIT(0xf112f1db1cede3f1), W64LIT(0x99c799bc71e85e99),
+        W64LIT(0x94fe94d45fcb6a94), W64LIT(0xaa38aa39db7192aa), W64LIT(0xf609f6e30ef8fff6), W64LIT(0x26be262dd4f29826),
+        W64LIT(0x2f932f65e2cdbc2f), W64LIT(0xef74ef2b58b79bef), W64LIT(0xe86fe8134aa287e8), W64LIT(0x8c868c140f830a8c),
+        W64LIT(0x35e135b5be8bd435), W64LIT(0x030f03180a090c03), W64LIT(0xd4a3d4eec21677d4), W64LIT(0x7f9e7fdf1f60e17f),
+        W64LIT(0xfb30fb8b20dbcbfb), W64LIT(0x051105281e1b1405), W64LIT(0xc1e2c146bc7d23c1), W64LIT(0x5e3b5ecad987655e),
+        W64LIT(0x90ea90f447d77a90), W64LIT(0x20a0201dc0e08020), W64LIT(0x3dc93df58eb3f43d), W64LIT(0x82b082642ba93282),
+        W64LIT(0xf70cf7eb08fffbf7), W64LIT(0xea65ea0346ac8fea), W64LIT(0x0a220a503c36280a), W64LIT(0x0d390d682e23340d),
+        W64LIT(0x7e9b7ed71967e57e), W64LIT(0xf83ff8932ad2c7f8), W64LIT(0x500d50bafdad5d50), W64LIT(0x1a721ad05c46681a),
+        W64LIT(0xc4f3c46ea26637c4), W64LIT(0x071b073812151c07), W64LIT(0x57165782efb84157), W64LIT(0xb862b8a9b70fdab8),
+        W64LIT(0x3ccc3cfd88b4f03c), W64LIT(0x62f7623751339562), W64LIT(0xe348e34b7093abe3), W64LIT(0xc8cfc80e8a4207c8),
+        W64LIT(0xac26ac09cf638aac), W64LIT(0x520752aaf1a35552), W64LIT(0x64e9640745218d64), W64LIT(0x1050108060704010),
+        W64LIT(0xd0b7d0ceda0a67d0), W64LIT(0xd99ad986ec3543d9), W64LIT(0x135f13986a794c13), W64LIT(0x0c3c0c602824300c),
+        W64LIT(0x125a12906c7e4812), W64LIT(0x298d2955f6dfa429), W64LIT(0x510851b2fbaa5951), W64LIT(0xb967b9a1b108deb9),
+        W64LIT(0xcfd4cf3698571bcf), W64LIT(0xd6a9d6fece187fd6), W64LIT(0x73a273bf3744d173), W64LIT(0x8d838d1c09840e8d),
+        W64LIT(0x81bf817c21a03e81), W64LIT(0x5419549ae5b14d54), W64LIT(0xc0e7c04eba7a27c0), W64LIT(0xed7eed3b54b993ed),
+        W64LIT(0x4e6b4e4ab9f7254e), W64LIT(0x4449441a85c10d44), W64LIT(0xa701a751f552a6a7), W64LIT(0x2a822a4dfcd6a82a),
+        W64LIT(0x85ab855c39bc2e85), W64LIT(0x25b12535defb9425), W64LIT(0xe659e6636e88bfe6), W64LIT(0xcac5ca1e864c0fca),
+        W64LIT(0x7c917cc71569ed7c), W64LIT(0x8b9d8b2c1d96168b), W64LIT(0x5613568ae9bf4556), W64LIT(0x80ba807427a73a80)
+    },
+    {
+        W64LIT(0xd1ce3e9e501fcece), W64LIT(0x6dbbb1bd06d6bbbb), W64LIT(0x60eb0b40ab8bebeb), W64LIT(0xe092e44bd9729292),
+        W64LIT(0x65ea0346ac8feaea), W64LIT(0xc0cb16804b0bcbcb), W64LIT(0x5f13986a794c1313), W64LIT(0xe2c146bc7d23c1c1),
+        W64LIT(0x6ae91b4ca583e9e9), W64LIT(0xd23acd9ca6e83a3a), W64LIT(0xa9d6fece187fd6d6), W64LIT(0x40b2f98b39f2b2b2),
+        W64LIT(0xbdd2ded6046fd2d2), W64LIT(0xea90f447d77a9090), W64LIT(0x4b17b872655c1717), W64LIT(0x3ff8932ad2c7f8f8),
+        W64LIT(0x57422a91d3154242), W64LIT(0x4115a87e6b541515), W64LIT(0x13568ae9bf455656), W64LIT(0x5eb4c99f2beab4b4),
+        W64LIT(0xec650f4326896565), W64LIT(0x6c1ce04854701c1c), W64LIT(0x928834179f1a8888), W64LIT(0x52432297d4114343),
+        W64LIT(0xf6c566a46133c5c5), W64LIT(0x315cdad5896d5c5c), W64LIT(0xee36adb482d83636), W64LIT(0x68bab9bb01d2baba),
+        W64LIT(0x06f5fb04f1f3f5f5), W64LIT(0x165782efb8415757), W64LIT(0xe6671f4f28816767), W64LIT(0x838d1c09840e8d8d),
+        W64LIT(0xf53195a697c43131), W64LIT(0x09f6e30ef8fff6f6), W64LIT(0xe9640745218d6464), W64LIT(0x2558facd957d5858),
+        W64LIT(0xdc9e8463fd429e9e), W64LIT(0x03f4f302f6f7f4f4), W64LIT(0xaa220dccee882222), W64LIT(0x38aa39db7192aaaa),
+        W64LIT(0xbc758f2356c97575), W64LIT(0x330f78222d3c0f0f), W64LIT(0x0a02100c0e080202), W64LIT(0x4fb1e18130feb1b1),
+        W64LIT(0x84dfb6f8275bdfdf), W64LIT(0xc46d4f731ea96d6d), W64LIT(0xa273bf3744d17373), W64LIT(0x644d52b3fe294d4d),
+        W64LIT(0x917cc71569ed7c7c), W64LIT(0xbe262dd4f2982626), W64LIT(0x962e6de4cab82e2e), W64LIT(0x0cf7eb08fffbf7f7),
+        W64LIT(0x2808403038200808), W64LIT(0x345dd2d38e695d5d), W64LIT(0x49441a85c10d4444), W64LIT(0xc63eed84baf83e3e),
+        W64LIT(0xd99f8c65fa469f9f), W64LIT(0x4414a0786c501414), W64LIT(0xcfc80e8a4207c8c8), W64LIT(0x2cae19c36d82aeae),
+        W64LIT(0x19549ae5b14d5454), W64LIT(0x5010806070401010), W64LIT(0x9fd88eea3247d8d8), W64LIT(0x76bc89af13cabcbc),
+        W64LIT(0x721ad05c46681a1a), W64LIT(0xda6b7f670cb16b6b), W64LIT(0xd0696f6b02b96969), W64LIT(0x18f3cb10e3ebf3f3),
+        W64LIT(0x73bd81a914cebdbd), W64LIT(0xff3385aa99cc3333), W64LIT(0x3dab31dd7696abab), W64LIT(0x35fa8326dccffafa),
+        W64LIT(0xb2d1c6dc0d63d1d1), W64LIT(0xcd9bac7de6569b9b), W64LIT(0xd568676d05bd6868), W64LIT(0x6b4e4ab9f7254e4e),
+        W64LIT(0x4e16b07462581616), W64LIT(0xfb95dc59cc6e9595), W64LIT(0xef91fc41d07e9191), W64LIT(0x71ee235eb09feeee),
+        W64LIT(0x614c5ab5f92d4c4c), W64LIT(0xf2633f5734916363), W64LIT(0x8c8e04038d028e8e), W64LIT(0x2a5be2c79c715b5b),
+        W64LIT(0xdbcc2e925e17cccc), W64LIT(0xcc3cfd88b4f03c3c), W64LIT(0x7d19c8564f641919), W64LIT(0x1fa161e140bea1a1),
+        W64LIT(0xbf817c21a03e8181), W64LIT(0x704972abe2394949), W64LIT(0x8a7bff077cf17b7b), W64LIT(0x9ad986ec3543d9d9),
+        W64LIT(0xce6f5f7f10a16f6f), W64LIT(0xeb37a5b285dc3737), W64LIT(0xfd60275d3d9d6060), W64LIT(0xc5ca1e864c0fcaca),
+        W64LIT(0x5ce76b688fbbe7e7), W64LIT(0x872b45fad1ac2b2b), W64LIT(0x75487aade53d4848), W64LIT(0x2efdbb34c9d3fdfd),
+        W64LIT(0xf496c453c5629696), W64LIT(0x4c451283c6094545), W64LIT(0x2bfcb332ced7fcfc), W64LIT(0x5841329bda194141),
+        W64LIT(0x5a12906c7e481212), W64LIT(0x390d682e23340d0d), W64LIT(0x8079ef0b72f97979), W64LIT(0x56e57b6481b3e5e5),
+        W64LIT(0x97893c11981e8989), W64LIT(0x868c140f830a8c8c), W64LIT(0x48e34b7093abe3e3), W64LIT(0xa0201dc0e0802020),
+        W64LIT(0xf0309da090c03030), W64LIT(0x8bdcaef22e57dcdc), W64LIT(0x51b7d19522e6b7b7), W64LIT(0xc16c477519ad6c6c),
+        W64LIT(0x7f4a6aa1eb354a4a), W64LIT(0x5bb5c1992ceeb5b5), W64LIT(0xc33fe582bdfc3f3f), W64LIT(0xf197cc55c2669797),
+        W64LIT(0xa3d4eec21677d4d4), W64LIT(0xf762375133956262), W64LIT(0x992d75eec3b42d2d), W64LIT(0x1e06301412180606),
+        W64LIT(0x0ea449ff5baaa4a4), W64LIT(0x0ba541f95caea5a5), W64LIT(0xb5836c2dae368383), W64LIT(0x3e5fc2df80615f5f),
+        W64LIT(0x822a4dfcd6a82a2a), W64LIT(0x95da9ee63c4fdada), W64LIT(0xcac9068c4503c9c9), W64LIT(0x0000000000000000),
+        W64LIT(0x9b7ed71967e57e7e), W64LIT(0x10a279eb49b2a2a2), W64LIT(0x1c5592e3b6495555), W64LIT(0x79bf91a51ac6bfbf),
+        W64LIT(0x5511886677441111), W64LIT(0xa6d5e6c41173d5d5), W64LIT(0xd69c946ff34a9c9c), W64LIT(0xd4cf3698571bcfcf),
+        W64LIT(0x360e70242a380e0e), W64LIT(0x220a503c36280a0a), W64LIT(0xc93df58eb3f43d3d), W64LIT(0x0851b2fbaa595151),
+        W64LIT(0x947dcf136ee97d7d), W64LIT(0xe593ec4dde769393), W64LIT(0x771bd85a416c1b1b), W64LIT(0x21fea33ec0dffefe),
+        W64LIT(0xf3c46ea26637c4c4), W64LIT(0x4647028fc8014747), W64LIT(0x2d0948363f240909), W64LIT(0xa4864433b5228686),
+        W64LIT(0x270b583a312c0b0b), W64LIT(0x898f0c058a068f8f), W64LIT(0xd39d9c69f44e9d9d), W64LIT(0xdf6a77610bb56a6a),
+        W64LIT(0x1b073812151c0707), W64LIT(0x67b9a1b108deb9b9), W64LIT(0x4ab0e98737fab0b0), W64LIT(0xc298b477ef5a9898),
+        W64LIT(0x7818c05048601818), W64LIT(0xfa328dac9ec83232), W64LIT(0xa871af3b4ad97171), W64LIT(0x7a4b62a7ec314b4b),
+        W64LIT(0x74ef2b58b79befef), W64LIT(0xd73bc59aa1ec3b3b), W64LIT(0xad70a73d4ddd7070), W64LIT(0x1aa069e747baa0a0),
+        W64LIT(0x53e4736286b7e4e4), W64LIT(0x5d403a9ddd1d4040), W64LIT(0x24ffab38c7dbffff), W64LIT(0xe8c356b0732bc3c3),
+        W64LIT(0x37a921d1789ea9a9), W64LIT(0x59e6636e88bfe6e6), W64LIT(0x8578e70d75fd7878), W64LIT(0x3af99b2cd5c3f9f9),
+        W64LIT(0x9d8b2c1d96168b8b), W64LIT(0x43460a89cf054646), W64LIT(0xba807427a73a8080), W64LIT(0x661ef0445a781e1e),
+        W64LIT(0xd838dd90a8e03838), W64LIT(0x42e15b7c9da3e1e1), W64LIT(0x62b8a9b70fdab8b8), W64LIT(0x32a829d77f9aa8a8),
+        W64LIT(0x47e0537a9aa7e0e0), W64LIT(0x3c0c602824300c0c), W64LIT(0xaf2305cae98c2323), W64LIT(0xb37697295fc57676),
+        W64LIT(0x691de84e53741d1d), W64LIT(0xb12535defb942525), W64LIT(0xb4243dd8fc902424), W64LIT(0x1105281e1b140505),
+        W64LIT(0x12f1db1cede3f1f1), W64LIT(0xcb6e577917a56e6e), W64LIT(0xfe94d45fcb6a9494), W64LIT(0x88285df0d8a02828),
+        W64LIT(0xc89aa47be1529a9a), W64LIT(0xae84543fbb2a8484), W64LIT(0x6fe8134aa287e8e8), W64LIT(0x15a371ed4eb6a3a3),
+        W64LIT(0x6e4f42bff0214f4f), W64LIT(0xb6779f2f58c17777), W64LIT(0xb8d3d6d0036bd3d3), W64LIT(0xab855c39bc2e8585),
+        W64LIT(0x4de2437694afe2e2), W64LIT(0x0752aaf1a3555252), W64LIT(0x1df2c316e4eff2f2), W64LIT(0xb082642ba9328282),
+        W64LIT(0x0d50bafdad5d5050), W64LIT(0x8f7af7017bf57a7a), W64LIT(0x932f65e2cdbc2f2f), W64LIT(0xb974872551cd7474),
+        W64LIT(0x0253a2f7a4515353), W64LIT(0x45b3f18d3ef6b3b3), W64LIT(0xf8612f5b3a996161), W64LIT(0x29af11c56a86afaf),
+        W64LIT(0xdd39d596afe43939), W64LIT(0xe135b5be8bd43535), W64LIT(0x81debefe205fdede), W64LIT(0xdecd26945913cdcd),
+        W64LIT(0x631ff8425d7c1f1f), W64LIT(0xc799bc71e85e9999), W64LIT(0x26ac09cf638aacac), W64LIT(0x23ad01c9648eadad),
+        W64LIT(0xa772b73143d57272), W64LIT(0x9c2c7de8c4b02c2c), W64LIT(0x8edda6f42953dddd), W64LIT(0xb7d0ceda0a67d0d0),
+        W64LIT(0xa1874c35b2268787), W64LIT(0x7cbe99a31dc2bebe), W64LIT(0x3b5ecad987655e5e), W64LIT(0x04a659f355a2a6a6),
+        W64LIT(0x7bec3352be97ecec), W64LIT(0x140420181c100404), W64LIT(0xf9c67eae683fc6c6), W64LIT(0x0f03180a090c0303),
+        W64LIT(0xe434bdb88cd03434), W64LIT(0x30fb8b20dbcbfbfb), W64LIT(0x90db96e03b4bdbdb), W64LIT(0x2059f2cb92795959),
+        W64LIT(0x54b6d99325e2b6b6), W64LIT(0xedc25eb6742fc2c2), W64LIT(0x0501080607040101), W64LIT(0x17f0d31aeae7f0f0),
+        W64LIT(0x2f5aeac19b755a5a), W64LIT(0x7eed3b54b993eded), W64LIT(0x01a751f552a6a7a7), W64LIT(0xe36617492f856666),
+        W64LIT(0xa52115c6e7842121), W64LIT(0x9e7fdf1f60e17f7f), W64LIT(0x988a241b91128a8a), W64LIT(0xbb2725d2f59c2727),
+        W64LIT(0xfcc776a86f3bc7c7), W64LIT(0xe7c04eba7a27c0c0), W64LIT(0x8d2955f6dfa42929), W64LIT(0xacd7f6c81f7bd7d7)
+    },
+    {
+        W64LIT(0x93ec4dde769393e5), W64LIT(0xd986ec3543d9d99a), W64LIT(0x9aa47be1529a9ac8), W64LIT(0xb5c1992ceeb5b55b),
+        W64LIT(0x98b477ef5a9898c2), W64LIT(0x220dccee882222aa), W64LIT(0x451283c60945454c), W64LIT(0xfcb332ced7fcfc2b),
+        W64LIT(0xbab9bb01d2baba68), W64LIT(0x6a77610bb56a6adf), W64LIT(0xdfb6f8275bdfdf84), W64LIT(0x02100c0e0802020a),
+        W64LIT(0x9f8c65fa469f9fd9), W64LIT(0xdcaef22e57dcdc8b), W64LIT(0x51b2fbaa59515108), W64LIT(0x59f2cb9279595920),
+        W64LIT(0x4a6aa1eb354a4a7f), W64LIT(0x17b872655c17174b), W64LIT(0x2b45fad1ac2b2b87), W64LIT(0xc25eb6742fc2c2ed),
+        W64LIT(0x94d45fcb6a9494fe), W64LIT(0xf4f302f6f7f4f403), W64LIT(0xbbb1bd06d6bbbb6d), W64LIT(0xa371ed4eb6a3a315),
+        W64LIT(0x62375133956262f7), W64LIT(0xe4736286b7e4e453), W64LIT(0x71af3b4ad97171a8), W64LIT(0xd4eec21677d4d4a3),
+        W64LIT(0xcd26945913cdcdde), W64LIT(0x70a73d4ddd7070ad), W64LIT(0x16b074625816164e), W64LIT(0xe15b7c9da3e1e142),
+        W64LIT(0x4972abe239494970), W64LIT(0x3cfd88b4f03c3ccc), W64LIT(0xc04eba7a27c0c0e7), W64LIT(0xd88eea3247d8d89f),
+        W64LIT(0x5cdad5896d5c5c31), W64LIT(0x9bac7de6569b9bcd), W64LIT(0xad01c9648eadad23), W64LIT(0x855c39bc2e8585ab),
+        W64LIT(0x53a2f7a451535302), W64LIT(0xa161e140bea1a11f), W64LIT(0x7af7017bf57a7a8f), W64LIT(0xc80e8a4207c8c8cf),
+        W64LIT(0x2d75eec3b42d2d99), W64LIT(0xe0537a9aa7e0e047), W64LIT(0xd1c6dc0d63d1d1b2), W64LIT(0x72b73143d57272a7),
+        W64LIT(0xa659f355a2a6a604), W64LIT(0x2c7de8c4b02c2c9c), W64LIT(0xc46ea26637c4c4f3), W64LIT(0xe34b7093abe3e348),
+        W64LIT(0x7697295fc57676b3), W64LIT(0x78e70d75fd787885), W64LIT(0xb7d19522e6b7b751), W64LIT(0xb4c99f2beab4b45e),
+        W64LIT(0x0948363f2409092d), W64LIT(0x3bc59aa1ec3b3bd7), W64LIT(0x0e70242a380e0e36), W64LIT(0x41329bda19414158),
+        W64LIT(0x4c5ab5f92d4c4c61), W64LIT(0xdebefe205fdede81), W64LIT(0xb2f98b39f2b2b240), W64LIT(0x90f447d77a9090ea),
+        W64LIT(0x2535defb942525b1), W64LIT(0xa541f95caea5a50b), W64LIT(0xd7f6c81f7bd7d7ac), W64LIT(0x03180a090c03030f),
+        W64LIT(0x1188667744111155), W64LIT(0x0000000000000000), W64LIT(0xc356b0732bc3c3e8), W64LIT(0x2e6de4cab82e2e96),
+        W64LIT(0x92e44bd9729292e0), W64LIT(0xef2b58b79befef74), W64LIT(0x4e4ab9f7254e4e6b), W64LIT(0x12906c7e4812125a),
+        W64LIT(0x9d9c69f44e9d9dd3), W64LIT(0x7dcf136ee97d7d94), W64LIT(0xcb16804b0bcbcbc0), W64LIT(0x35b5be8bd43535e1),
+        W64LIT(0x1080607040101050), W64LIT(0xd5e6c41173d5d5a6), W64LIT(0x4f42bff0214f4f6e), W64LIT(0x9e8463fd429e9edc),
+        W64LIT(0x4d52b3fe294d4d64), W64LIT(0xa921d1789ea9a937), W64LIT(0x5592e3b64955551c), W64LIT(0xc67eae683fc6c6f9),
+        W64LIT(0xd0ceda0a67d0d0b7), W64LIT(0x7bff077cf17b7b8a), W64LIT(0x18c0504860181878), W64LIT(0x97cc55c2669797f1),
+        W64LIT(0xd3d6d0036bd3d3b8), W64LIT(0x36adb482d83636ee), W64LIT(0xe6636e88bfe6e659), W64LIT(0x487aade53d484875),
+        W64LIT(0x568ae9bf45565613), W64LIT(0x817c21a03e8181bf), W64LIT(0x8f0c058a068f8f89), W64LIT(0x779f2f58c17777b6),
+        W64LIT(0xcc2e925e17ccccdb), W64LIT(0x9c946ff34a9c9cd6), W64LIT(0xb9a1b108deb9b967), W64LIT(0xe2437694afe2e24d),
+        W64LIT(0xac09cf638aacac26), W64LIT(0xb8a9b70fdab8b862), W64LIT(0x2f65e2cdbc2f2f93), W64LIT(0x15a87e6b54151541),
+        W64LIT(0xa449ff5baaa4a40e), W64LIT(0x7cc71569ed7c7c91), W64LIT(0xda9ee63c4fdada95), W64LIT(0x38dd90a8e03838d8),
+        W64LIT(0x1ef0445a781e1e66), W64LIT(0x0b583a312c0b0b27), W64LIT(0x05281e1b14050511), W64LIT(0xd6fece187fd6d6a9),
+        W64LIT(0x14a0786c50141444), W64LIT(0x6e577917a56e6ecb), W64LIT(0x6c477519ad6c6cc1), W64LIT(0x7ed71967e57e7e9b),
+        W64LIT(0x6617492f856666e3), W64LIT(0xfdbb34c9d3fdfd2e), W64LIT(0xb1e18130feb1b14f), W64LIT(0xe57b6481b3e5e556),
+        W64LIT(0x60275d3d9d6060fd), W64LIT(0xaf11c56a86afaf29), W64LIT(0x5ecad987655e5e3b), W64LIT(0x3385aa99cc3333ff),
+        W64LIT(0x874c35b2268787a1), W64LIT(0xc9068c4503c9c9ca), W64LIT(0xf0d31aeae7f0f017), W64LIT(0x5dd2d38e695d5d34),
+        W64LIT(0x6d4f731ea96d6dc4), W64LIT(0x3fe582bdfc3f3fc3), W64LIT(0x8834179f1a888892), W64LIT(0x8d1c09840e8d8d83),
+        W64LIT(0xc776a86f3bc7c7fc), W64LIT(0xf7eb08fffbf7f70c), W64LIT(0x1de84e53741d1d69), W64LIT(0xe91b4ca583e9e96a),
+        W64LIT(0xec3352be97ecec7b), W64LIT(0xed3b54b993eded7e), W64LIT(0x807427a73a8080ba), W64LIT(0x2955f6dfa429298d),
+        W64LIT(0x2725d2f59c2727bb), W64LIT(0xcf3698571bcfcfd4), W64LIT(0x99bc71e85e9999c7), W64LIT(0xa829d77f9aa8a832),
+        W64LIT(0x50bafdad5d50500d), W64LIT(0x0f78222d3c0f0f33), W64LIT(0x37a5b285dc3737eb), W64LIT(0x243dd8fc902424b4),
+        W64LIT(0x285df0d8a0282888), W64LIT(0x309da090c03030f0), W64LIT(0x95dc59cc6e9595fb), W64LIT(0xd2ded6046fd2d2bd),
+        W64LIT(0x3eed84baf83e3ec6), W64LIT(0x5be2c79c715b5b2a), W64LIT(0x403a9ddd1d40405d), W64LIT(0x836c2dae368383b5),
+        W64LIT(0xb3f18d3ef6b3b345), W64LIT(0x696f6b02b96969d0), W64LIT(0x5782efb841575716), W64LIT(0x1ff8425d7c1f1f63),
+        W64LIT(0x073812151c07071b), W64LIT(0x1ce04854701c1c6c), W64LIT(0x8a241b91128a8a98), W64LIT(0xbc89af13cabcbc76),
+        W64LIT(0x201dc0e0802020a0), W64LIT(0xeb0b40ab8bebeb60), W64LIT(0xce3e9e501fceced1), W64LIT(0x8e04038d028e8e8c),
+        W64LIT(0xab31dd7696abab3d), W64LIT(0xee235eb09feeee71), W64LIT(0x3195a697c43131f5), W64LIT(0xa279eb49b2a2a210),
+        W64LIT(0x73bf3744d17373a2), W64LIT(0xf99b2cd5c3f9f93a), W64LIT(0xca1e864c0fcacac5), W64LIT(0x3acd9ca6e83a3ad2),
+        W64LIT(0x1ad05c46681a1a72), W64LIT(0xfb8b20dbcbfbfb30), W64LIT(0x0d682e23340d0d39), W64LIT(0xc146bc7d23c1c1e2),
+        W64LIT(0xfea33ec0dffefe21), W64LIT(0xfa8326dccffafa35), W64LIT(0xf2c316e4eff2f21d), W64LIT(0x6f5f7f10a16f6fce),
+        W64LIT(0xbd81a914cebdbd73), W64LIT(0x96c453c5629696f4), W64LIT(0xdda6f42953dddd8e), W64LIT(0x432297d411434352),
+        W64LIT(0x52aaf1a355525207), W64LIT(0xb6d99325e2b6b654), W64LIT(0x0840303820080828), W64LIT(0xf3cb10e3ebf3f318),
+        W64LIT(0xae19c36d82aeae2c), W64LIT(0xbe99a31dc2bebe7c), W64LIT(0x19c8564f6419197d), W64LIT(0x893c11981e898997),
+        W64LIT(0x328dac9ec83232fa), W64LIT(0x262dd4f2982626be), W64LIT(0xb0e98737fab0b04a), W64LIT(0xea0346ac8feaea65),
+        W64LIT(0x4b62a7ec314b4b7a), W64LIT(0x640745218d6464e9), W64LIT(0x84543fbb2a8484ae), W64LIT(0x82642ba9328282b0),
+        W64LIT(0x6b7f670cb16b6bda), W64LIT(0xf5fb04f1f3f5f506), W64LIT(0x79ef0b72f9797980), W64LIT(0xbf91a51ac6bfbf79),
+        W64LIT(0x0108060704010105), W64LIT(0x5fc2df80615f5f3e), W64LIT(0x758f2356c97575bc), W64LIT(0x633f5734916363f2),
+        W64LIT(0x1bd85a416c1b1b77), W64LIT(0x2305cae98c2323af), W64LIT(0x3df58eb3f43d3dc9), W64LIT(0x68676d05bd6868d5),
+        W64LIT(0x2a4dfcd6a82a2a82), W64LIT(0x650f4326896565ec), W64LIT(0xe8134aa287e8e86f), W64LIT(0x91fc41d07e9191ef),
+        W64LIT(0xf6e30ef8fff6f609), W64LIT(0xffab38c7dbffff24), W64LIT(0x13986a794c13135f), W64LIT(0x58facd957d585825),
+        W64LIT(0xf1db1cede3f1f112), W64LIT(0x47028fc801474746), W64LIT(0x0a503c36280a0a22), W64LIT(0x7fdf1f60e17f7f9e),
+        W64LIT(0xc566a46133c5c5f6), W64LIT(0xa751f552a6a7a701), W64LIT(0xe76b688fbbe7e75c), W64LIT(0x612f5b3a996161f8),
+        W64LIT(0x5aeac19b755a5a2f), W64LIT(0x063014121806061e), W64LIT(0x460a89cf05464643), W64LIT(0x441a85c10d444449),
+        W64LIT(0x422a91d315424257), W64LIT(0x0420181c10040414), W64LIT(0xa069e747baa0a01a), W64LIT(0xdb96e03b4bdbdb90),
+        W64LIT(0x39d596afe43939dd), W64LIT(0x864433b5228686a4), W64LIT(0x549ae5b14d545419), W64LIT(0xaa39db7192aaaa38),
+        W64LIT(0x8c140f830a8c8c86), W64LIT(0x34bdb88cd03434e4), W64LIT(0x2115c6e7842121a5), W64LIT(0x8b2c1d96168b8b9d),
+        W64LIT(0xf8932ad2c7f8f83f), W64LIT(0x0c602824300c0c3c), W64LIT(0x74872551cd7474b9), W64LIT(0x671f4f28816767e6)
+    },
+    {
+        W64LIT(0x676d05bd6868d568), W64LIT(0x1c09840e8d8d838d), W64LIT(0x1e864c0fcacac5ca), W64LIT(0x52b3fe294d4d644d),
+        W64LIT(0xbf3744d17373a273), W64LIT(0x62a7ec314b4b7a4b), W64LIT(0x4ab9f7254e4e6b4e), W64LIT(0x4dfcd6a82a2a822a),
+        W64LIT(0xeec21677d4d4a3d4), W64LIT(0xaaf1a35552520752), W64LIT(0x2dd4f2982626be26), W64LIT(0xf18d3ef6b3b345b3),
+        W64LIT(0x9ae5b14d54541954), W64LIT(0xf0445a781e1e661e), W64LIT(0xc8564f6419197d19), W64LIT(0xf8425d7c1f1f631f),
+        W64LIT(0x0dccee882222aa22), W64LIT(0x180a090c03030f03), W64LIT(0x0a89cf0546464346), W64LIT(0xf58eb3f43d3dc93d),
+        W64LIT(0x75eec3b42d2d992d), W64LIT(0x6aa1eb354a4a7f4a), W64LIT(0xa2f7a45153530253), W64LIT(0x6c2dae368383b583),
+        W64LIT(0x986a794c13135f13), W64LIT(0x241b91128a8a988a), W64LIT(0xd19522e6b7b751b7), W64LIT(0xe6c41173d5d5a6d5),
+        W64LIT(0x35defb942525b125), W64LIT(0xef0b72f979798079), W64LIT(0xfb04f1f3f5f506f5), W64LIT(0x81a914cebdbd73bd),
+        W64LIT(0xfacd957d58582558), W64LIT(0x65e2cdbc2f2f932f), W64LIT(0x682e23340d0d390d), W64LIT(0x100c0e0802020a02),
+        W64LIT(0x3b54b993eded7eed), W64LIT(0xb2fbaa5951510851), W64LIT(0x8463fd429e9edc9e), W64LIT(0x8866774411115511),
+        W64LIT(0xc316e4eff2f21df2), W64LIT(0xed84baf83e3ec63e), W64LIT(0x92e3b64955551c55), W64LIT(0xcad987655e5e3b5e),
+        W64LIT(0xc6dc0d63d1d1b2d1), W64LIT(0xb074625816164e16), W64LIT(0xfd88b4f03c3ccc3c), W64LIT(0x17492f856666e366),
+        W64LIT(0xa73d4ddd7070ad70), W64LIT(0xd2d38e695d5d345d), W64LIT(0xcb10e3ebf3f318f3), W64LIT(0x1283c60945454c45),
+        W64LIT(0x3a9ddd1d40405d40), W64LIT(0x2e925e17ccccdbcc), W64LIT(0x134aa287e8e86fe8), W64LIT(0xd45fcb6a9494fe94),
+        W64LIT(0x8ae9bf4556561356), W64LIT(0x4030382008082808), W64LIT(0x3e9e501fceced1ce), W64LIT(0xd05c46681a1a721a),
+        W64LIT(0xcd9ca6e83a3ad23a), W64LIT(0xded6046fd2d2bdd2), W64LIT(0x5b7c9da3e1e142e1), W64LIT(0xb6f8275bdfdf84df),
+        W64LIT(0xc1992ceeb5b55bb5), W64LIT(0xdd90a8e03838d838), W64LIT(0x577917a56e6ecb6e), W64LIT(0x70242a380e0e360e),
+        W64LIT(0x7b6481b3e5e556e5), W64LIT(0xf302f6f7f4f403f4), W64LIT(0x9b2cd5c3f9f93af9), W64LIT(0x4433b5228686a486),
+        W64LIT(0x1b4ca583e9e96ae9), W64LIT(0x42bff0214f4f6e4f), W64LIT(0xfece187fd6d6a9d6), W64LIT(0x5c39bc2e8585ab85),
+        W64LIT(0x05cae98c2323af23), W64LIT(0x3698571bcfcfd4cf), W64LIT(0x8dac9ec83232fa32), W64LIT(0xbc71e85e9999c799),
+        W64LIT(0x95a697c43131f531), W64LIT(0xa0786c5014144414), W64LIT(0x19c36d82aeae2cae), W64LIT(0x235eb09feeee71ee),
+        W64LIT(0x0e8a4207c8c8cfc8), W64LIT(0x7aade53d48487548), W64LIT(0xd6d0036bd3d3b8d3), W64LIT(0x9da090c03030f030),
+        W64LIT(0x61e140bea1a11fa1), W64LIT(0xe44bd9729292e092), W64LIT(0x329bda1941415841), W64LIT(0xe18130feb1b14fb1),
+        W64LIT(0xc050486018187818), W64LIT(0x6ea26637c4c4f3c4), W64LIT(0x7de8c4b02c2c9c2c), W64LIT(0xaf3b4ad97171a871),
+        W64LIT(0xb73143d57272a772), W64LIT(0x1a85c10d44444944), W64LIT(0xa87e6b5415154115), W64LIT(0xbb34c9d3fdfd2efd),
+        W64LIT(0xa5b285dc3737eb37), W64LIT(0x99a31dc2bebe7cbe), W64LIT(0xc2df80615f5f3e5f), W64LIT(0x39db7192aaaa38aa),
+        W64LIT(0xac7de6569b9bcd9b), W64LIT(0x34179f1a88889288), W64LIT(0x8eea3247d8d89fd8), W64LIT(0x31dd7696abab3dab),
+        W64LIT(0x3c11981e89899789), W64LIT(0x946ff34a9c9cd69c), W64LIT(0x8326dccffafa35fa), W64LIT(0x275d3d9d6060fd60),
+        W64LIT(0x0346ac8feaea65ea), W64LIT(0x89af13cabcbc76bc), W64LIT(0x375133956262f762), W64LIT(0x602824300c0c3c0c),
+        W64LIT(0x3dd8fc902424b424), W64LIT(0x59f355a2a6a604a6), W64LIT(0x29d77f9aa8a832a8), W64LIT(0x3352be97ecec7bec),
+        W64LIT(0x1f4f28816767e667), W64LIT(0x1dc0e0802020a020), W64LIT(0x96e03b4bdbdb90db), W64LIT(0xc71569ed7c7c917c),
+        W64LIT(0x5df0d8a028288828), W64LIT(0xa6f42953dddd8edd), W64LIT(0x09cf638aacac26ac), W64LIT(0xe2c79c715b5b2a5b),
+        W64LIT(0xbdb88cd03434e434), W64LIT(0xd71967e57e7e9b7e), W64LIT(0x8060704010105010), W64LIT(0xdb1cede3f1f112f1),
+        W64LIT(0xff077cf17b7b8a7b), W64LIT(0x0c058a068f8f898f), W64LIT(0x3f5734916363f263), W64LIT(0x69e747baa0a01aa0),
+        W64LIT(0x281e1b1405051105), W64LIT(0xa47be1529a9ac89a), W64LIT(0x2297d41143435243), W64LIT(0x9f2f58c17777b677),
+        W64LIT(0x15c6e7842121a521), W64LIT(0x91a51ac6bfbf79bf), W64LIT(0x25d2f59c2727bb27), W64LIT(0x48363f2409092d09),
+        W64LIT(0x56b0732bc3c3e8c3), W64LIT(0x8c65fa469f9fd99f), W64LIT(0xd99325e2b6b654b6), W64LIT(0xf6c81f7bd7d7acd7),
+        W64LIT(0x55f6dfa429298d29), W64LIT(0x5eb6742fc2c2edc2), W64LIT(0x0b40ab8bebeb60eb), W64LIT(0x4eba7a27c0c0e7c0),
+        W64LIT(0x49ff5baaa4a40ea4), W64LIT(0x2c1d96168b8b9d8b), W64LIT(0x140f830a8c8c868c), W64LIT(0xe84e53741d1d691d),
+        W64LIT(0x8b20dbcbfbfb30fb), W64LIT(0xab38c7dbffff24ff), W64LIT(0x46bc7d23c1c1e2c1), W64LIT(0xf98b39f2b2b240b2),
+        W64LIT(0xcc55c2669797f197), W64LIT(0x6de4cab82e2e962e), W64LIT(0x932ad2c7f8f83ff8), W64LIT(0x0f4326896565ec65),
+        W64LIT(0xe30ef8fff6f609f6), W64LIT(0x8f2356c97575bc75), W64LIT(0x3812151c07071b07), W64LIT(0x20181c1004041404),
+        W64LIT(0x72abe23949497049), W64LIT(0x85aa99cc3333ff33), W64LIT(0x736286b7e4e453e4), W64LIT(0x86ec3543d9d99ad9),
+        W64LIT(0xa1b108deb9b967b9), W64LIT(0xceda0a67d0d0b7d0), W64LIT(0x2a91d31542425742), W64LIT(0x76a86f3bc7c7fcc7),
+        W64LIT(0x477519ad6c6cc16c), W64LIT(0xf447d77a9090ea90), W64LIT(0x0000000000000000), W64LIT(0x04038d028e8e8c8e),
+        W64LIT(0x5f7f10a16f6fce6f), W64LIT(0xbafdad5d50500d50), W64LIT(0x0806070401010501), W64LIT(0x66a46133c5c5f6c5),
+        W64LIT(0x9ee63c4fdada95da), W64LIT(0x028fc80147474647), W64LIT(0xe582bdfc3f3fc33f), W64LIT(0x26945913cdcddecd),
+        W64LIT(0x6f6b02b96969d069), W64LIT(0x79eb49b2a2a210a2), W64LIT(0x437694afe2e24de2), W64LIT(0xf7017bf57a7a8f7a),
+        W64LIT(0x51f552a6a7a701a7), W64LIT(0x7eae683fc6c6f9c6), W64LIT(0xec4dde769393e593), W64LIT(0x78222d3c0f0f330f),
+        W64LIT(0x503c36280a0a220a), W64LIT(0x3014121806061e06), W64LIT(0x636e88bfe6e659e6), W64LIT(0x45fad1ac2b2b872b),
+        W64LIT(0xc453c5629696f496), W64LIT(0x71ed4eb6a3a315a3), W64LIT(0xe04854701c1c6c1c), W64LIT(0x11c56a86afaf29af),
+        W64LIT(0x77610bb56a6adf6a), W64LIT(0x906c7e4812125a12), W64LIT(0x543fbb2a8484ae84), W64LIT(0xd596afe43939dd39),
+        W64LIT(0x6b688fbbe7e75ce7), W64LIT(0xe98737fab0b04ab0), W64LIT(0x642ba9328282b082), W64LIT(0xeb08fffbf7f70cf7),
+        W64LIT(0xa33ec0dffefe21fe), W64LIT(0x9c69f44e9d9dd39d), W64LIT(0x4c35b2268787a187), W64LIT(0xdad5896d5c5c315c),
+        W64LIT(0x7c21a03e8181bf81), W64LIT(0xb5be8bd43535e135), W64LIT(0xbefe205fdede81de), W64LIT(0xc99f2beab4b45eb4),
+        W64LIT(0x41f95caea5a50ba5), W64LIT(0xb332ced7fcfc2bfc), W64LIT(0x7427a73a8080ba80), W64LIT(0x2b58b79befef74ef),
+        W64LIT(0x16804b0bcbcbc0cb), W64LIT(0xb1bd06d6bbbb6dbb), W64LIT(0x7f670cb16b6bda6b), W64LIT(0x97295fc57676b376),
+        W64LIT(0xb9bb01d2baba68ba), W64LIT(0xeac19b755a5a2f5a), W64LIT(0xcf136ee97d7d947d), W64LIT(0xe70d75fd78788578),
+        W64LIT(0x583a312c0b0b270b), W64LIT(0xdc59cc6e9595fb95), W64LIT(0x4b7093abe3e348e3), W64LIT(0x01c9648eadad23ad),
+        W64LIT(0x872551cd7474b974), W64LIT(0xb477ef5a9898c298), W64LIT(0xc59aa1ec3b3bd73b), W64LIT(0xadb482d83636ee36),
+        W64LIT(0x0745218d6464e964), W64LIT(0x4f731ea96d6dc46d), W64LIT(0xaef22e57dcdc8bdc), W64LIT(0xd31aeae7f0f017f0),
+        W64LIT(0xf2cb927959592059), W64LIT(0x21d1789ea9a937a9), W64LIT(0x5ab5f92d4c4c614c), W64LIT(0xb872655c17174b17),
+        W64LIT(0xdf1f60e17f7f9e7f), W64LIT(0xfc41d07e9191ef91), W64LIT(0xa9b70fdab8b862b8), W64LIT(0x068c4503c9c9cac9),
+        W64LIT(0x82efb84157571657), W64LIT(0xd85a416c1b1b771b), W64LIT(0x537a9aa7e0e047e0), W64LIT(0x2f5b3a996161f861)
+    },
+    {
+        W64LIT(0xd77f9aa8a832a829), W64LIT(0x97d4114343524322), W64LIT(0xdf80615f5f3e5fc2), W64LIT(0x14121806061e0630),
+        W64LIT(0x670cb16b6bda6b7f), W64LIT(0x2356c97575bc758f), W64LIT(0x7519ad6c6cc16c47), W64LIT(0xcb927959592059f2),
+        W64LIT(0x3b4ad97171a871af), W64LIT(0xf8275bdfdf84dfb6), W64LIT(0x35b2268787a1874c), W64LIT(0x59cc6e9595fb95dc),
+        W64LIT(0x72655c17174b17b8), W64LIT(0x1aeae7f0f017f0d3), W64LIT(0xea3247d8d89fd88e), W64LIT(0x363f2409092d0948),
+        W64LIT(0x731ea96d6dc46d4f), W64LIT(0x10e3ebf3f318f3cb), W64LIT(0x4e53741d1d691de8), W64LIT(0x804b0bcbcbc0cb16),
+        W64LIT(0x8c4503c9c9cac906), W64LIT(0xb3fe294d4d644d52), W64LIT(0xe8c4b02c2c9c2c7d), W64LIT(0xc56a86afaf29af11),
+        W64LIT(0x0b72f979798079ef), W64LIT(0x7a9aa7e0e047e053), W64LIT(0x55c2669797f197cc), W64LIT(0x34c9d3fdfd2efdbb),
+        W64LIT(0x7f10a16f6fce6f5f), W64LIT(0xa7ec314b4b7a4b62), W64LIT(0x83c60945454c4512), W64LIT(0x96afe43939dd39d5),
+        W64LIT(0x84baf83e3ec63eed), W64LIT(0xf42953dddd8edda6), W64LIT(0xed4eb6a3a315a371), W64LIT(0xbff0214f4f6e4f42),
+        W64LIT(0x9f2beab4b45eb4c9), W64LIT(0x9325e2b6b654b6d9), W64LIT(0x7be1529a9ac89aa4), W64LIT(0x242a380e0e360e70),
+        W64LIT(0x425d7c1f1f631ff8), W64LIT(0xa51ac6bfbf79bf91), W64LIT(0x7e6b5415154115a8), W64LIT(0x7c9da3e1e142e15b),
+        W64LIT(0xabe2394949704972), W64LIT(0xd6046fd2d2bdd2de), W64LIT(0x4dde769393e593ec), W64LIT(0xae683fc6c6f9c67e),
+        W64LIT(0x4bd9729292e092e4), W64LIT(0x3143d57272a772b7), W64LIT(0x63fd429e9edc9e84), W64LIT(0x5b3a996161f8612f),
+        W64LIT(0xdc0d63d1d1b2d1c6), W64LIT(0x5734916363f2633f), W64LIT(0x26dccffafa35fa83), W64LIT(0x5eb09feeee71ee23),
+        W64LIT(0x02f6f7f4f403f4f3), W64LIT(0x564f6419197d19c8), W64LIT(0xc41173d5d5a6d5e6), W64LIT(0xc9648eadad23ad01),
+        W64LIT(0xcd957d58582558fa), W64LIT(0xff5baaa4a40ea449), W64LIT(0xbd06d6bbbb6dbbb1), W64LIT(0xe140bea1a11fa161),
+        W64LIT(0xf22e57dcdc8bdcae), W64LIT(0x16e4eff2f21df2c3), W64LIT(0x2dae368383b5836c), W64LIT(0xb285dc3737eb37a5),
+        W64LIT(0x91d315424257422a), W64LIT(0x6286b7e4e453e473), W64LIT(0x017bf57a7a8f7af7), W64LIT(0xac9ec83232fa328d),
+        W64LIT(0x6ff34a9c9cd69c94), W64LIT(0x925e17ccccdbcc2e), W64LIT(0xdd7696abab3dab31), W64LIT(0xa1eb354a4a7f4a6a),
+        W64LIT(0x058a068f8f898f0c), W64LIT(0x7917a56e6ecb6e57), W64LIT(0x181c100404140420), W64LIT(0xd2f59c2727bb2725),
+        W64LIT(0xe4cab82e2e962e6d), W64LIT(0x688fbbe7e75ce76b), W64LIT(0x7694afe2e24de243), W64LIT(0xc19b755a5a2f5aea),
+        W64LIT(0x53c5629696f496c4), W64LIT(0x74625816164e16b0), W64LIT(0xcae98c2323af2305), W64LIT(0xfad1ac2b2b872b45),
+        W64LIT(0xb6742fc2c2edc25e), W64LIT(0x4326896565ec650f), W64LIT(0x492f856666e36617), W64LIT(0x222d3c0f0f330f78),
+        W64LIT(0xaf13cabcbc76bc89), W64LIT(0xd1789ea9a937a921), W64LIT(0x8fc8014747464702), W64LIT(0x9bda194141584132),
+        W64LIT(0xb88cd03434e434bd), W64LIT(0xade53d484875487a), W64LIT(0x32ced7fcfc2bfcb3), W64LIT(0x9522e6b7b751b7d1),
+        W64LIT(0x610bb56a6adf6a77), W64LIT(0x179f1a8888928834), W64LIT(0xf95caea5a50ba541), W64LIT(0xf7a45153530253a2),
+        W64LIT(0x33b5228686a48644), W64LIT(0x2cd5c3f9f93af99b), W64LIT(0xc79c715b5b2a5be2), W64LIT(0xe03b4bdbdb90db96),
+        W64LIT(0x90a8e03838d838dd), W64LIT(0x077cf17b7b8a7bff), W64LIT(0xb0732bc3c3e8c356), W64LIT(0x445a781e1e661ef0),
+        W64LIT(0xccee882222aa220d), W64LIT(0xaa99cc3333ff3385), W64LIT(0xd8fc902424b4243d), W64LIT(0xf0d8a0282888285d),
+        W64LIT(0xb482d83636ee36ad), W64LIT(0xa86f3bc7c7fcc776), W64LIT(0x8b39f2b2b240b2f9), W64LIT(0x9aa1ec3b3bd73bc5),
+        W64LIT(0x038d028e8e8c8e04), W64LIT(0x2f58c17777b6779f), W64LIT(0xbb01d2baba68bab9), W64LIT(0x04f1f3f5f506f5fb),
+        W64LIT(0x786c5014144414a0), W64LIT(0x65fa469f9fd99f8c), W64LIT(0x3038200808280840), W64LIT(0xe3b64955551c5592),
+        W64LIT(0x7de6569b9bcd9bac), W64LIT(0xb5f92d4c4c614c5a), W64LIT(0x3ec0dffefe21fea3), W64LIT(0x5d3d9d6060fd6027),
+        W64LIT(0xd5896d5c5c315cda), W64LIT(0xe63c4fdada95da9e), W64LIT(0x50486018187818c0), W64LIT(0x89cf05464643460a),
+        W64LIT(0x945913cdcddecd26), W64LIT(0x136ee97d7d947dcf), W64LIT(0xc6e7842121a52115), W64LIT(0x8737fab0b04ab0e9),
+        W64LIT(0x82bdfc3f3fc33fe5), W64LIT(0x5a416c1b1b771bd8), W64LIT(0x11981e898997893c), W64LIT(0x38c7dbffff24ffab),
+        W64LIT(0x40ab8bebeb60eb0b), W64LIT(0x3fbb2a8484ae8454), W64LIT(0x6b02b96969d0696f), W64LIT(0x9ca6e83a3ad23acd),
+        W64LIT(0x69f44e9d9dd39d9c), W64LIT(0xc81f7bd7d7acd7f6), W64LIT(0xd0036bd3d3b8d3d6), W64LIT(0x3d4ddd7070ad70a7),
+        W64LIT(0x4f28816767e6671f), W64LIT(0x9ddd1d40405d403a), W64LIT(0x992ceeb5b55bb5c1), W64LIT(0xfe205fdede81debe),
+        W64LIT(0xd38e695d5d345dd2), W64LIT(0xa090c03030f0309d), W64LIT(0x41d07e9191ef91fc), W64LIT(0x8130feb1b14fb1e1),
+        W64LIT(0x0d75fd78788578e7), W64LIT(0x6677441111551188), W64LIT(0x0607040101050108), W64LIT(0x6481b3e5e556e57b),
+        W64LIT(0x0000000000000000), W64LIT(0x6d05bd6868d56867), W64LIT(0x77ef5a9898c298b4), W64LIT(0xe747baa0a01aa069),
+        W64LIT(0xa46133c5c5f6c566), W64LIT(0x0c0e0802020a0210), W64LIT(0xf355a2a6a604a659), W64LIT(0x2551cd7474b97487),
+        W64LIT(0xeec3b42d2d992d75), W64LIT(0x3a312c0b0b270b58), W64LIT(0xeb49b2a2a210a279), W64LIT(0x295fc57676b37697),
+        W64LIT(0x8d3ef6b3b345b3f1), W64LIT(0xa31dc2bebe7cbe99), W64LIT(0x9e501fceced1ce3e), W64LIT(0xa914cebdbd73bd81),
+        W64LIT(0xc36d82aeae2cae19), W64LIT(0x4ca583e9e96ae91b), W64LIT(0x1b91128a8a988a24), W64LIT(0xa697c43131f53195),
+        W64LIT(0x4854701c1c6c1ce0), W64LIT(0x52be97ecec7bec33), W64LIT(0x1cede3f1f112f1db), W64LIT(0x71e85e9999c799bc),
+        W64LIT(0x5fcb6a9494fe94d4), W64LIT(0xdb7192aaaa38aa39), W64LIT(0x0ef8fff6f609f6e3), W64LIT(0xd4f2982626be262d),
+        W64LIT(0xe2cdbc2f2f932f65), W64LIT(0x58b79befef74ef2b), W64LIT(0x4aa287e8e86fe813), W64LIT(0x0f830a8c8c868c14),
+        W64LIT(0xbe8bd43535e135b5), W64LIT(0x0a090c03030f0318), W64LIT(0xc21677d4d4a3d4ee), W64LIT(0x1f60e17f7f9e7fdf),
+        W64LIT(0x20dbcbfbfb30fb8b), W64LIT(0x1e1b140505110528), W64LIT(0xbc7d23c1c1e2c146), W64LIT(0xd987655e5e3b5eca),
+        W64LIT(0x47d77a9090ea90f4), W64LIT(0xc0e0802020a0201d), W64LIT(0x8eb3f43d3dc93df5), W64LIT(0x2ba9328282b08264),
+        W64LIT(0x08fffbf7f70cf7eb), W64LIT(0x46ac8feaea65ea03), W64LIT(0x3c36280a0a220a50), W64LIT(0x2e23340d0d390d68),
+        W64LIT(0x1967e57e7e9b7ed7), W64LIT(0x2ad2c7f8f83ff893), W64LIT(0xfdad5d50500d50ba), W64LIT(0x5c46681a1a721ad0),
+        W64LIT(0xa26637c4c4f3c46e), W64LIT(0x12151c07071b0738), W64LIT(0xefb8415757165782), W64LIT(0xb70fdab8b862b8a9),
+        W64LIT(0x88b4f03c3ccc3cfd), W64LIT(0x5133956262f76237), W64LIT(0x7093abe3e348e34b), W64LIT(0x8a4207c8c8cfc80e),
+        W64LIT(0xcf638aacac26ac09), W64LIT(0xf1a35552520752aa), W64LIT(0x45218d6464e96407), W64LIT(0x6070401010501080),
+        W64LIT(0xda0a67d0d0b7d0ce), W64LIT(0xec3543d9d99ad986), W64LIT(0x6a794c13135f1398), W64LIT(0x2824300c0c3c0c60),
+        W64LIT(0x6c7e4812125a1290), W64LIT(0xf6dfa429298d2955), W64LIT(0xfbaa5951510851b2), W64LIT(0xb108deb9b967b9a1),
+        W64LIT(0x98571bcfcfd4cf36), W64LIT(0xce187fd6d6a9d6fe), W64LIT(0x3744d17373a273bf), W64LIT(0x09840e8d8d838d1c),
+        W64LIT(0x21a03e8181bf817c), W64LIT(0xe5b14d545419549a), W64LIT(0xba7a27c0c0e7c04e), W64LIT(0x54b993eded7eed3b),
+        W64LIT(0xb9f7254e4e6b4e4a), W64LIT(0x85c10d444449441a), W64LIT(0xf552a6a7a701a751), W64LIT(0xfcd6a82a2a822a4d),
+        W64LIT(0x39bc2e8585ab855c), W64LIT(0xdefb942525b12535), W64LIT(0x6e88bfe6e659e663), W64LIT(0x864c0fcacac5ca1e),
+        W64LIT(0x1569ed7c7c917cc7), W64LIT(0x1d96168b8b9d8b2c), W64LIT(0xe9bf45565613568a), W64LIT(0x27a73a8080ba8074)
+    },
+    {
+        W64LIT(0x501fceced1ce3e9e), W64LIT(0x06d6bbbb6dbbb1bd), W64LIT(0xab8bebeb60eb0b40), W64LIT(0xd9729292e092e44b),
+        W64LIT(0xac8feaea65ea0346), W64LIT(0x4b0bcbcbc0cb1680), W64LIT(0x794c13135f13986a), W64LIT(0x7d23c1c1e2c146bc),
+        W64LIT(0xa583e9e96ae91b4c), W64LIT(0xa6e83a3ad23acd9c), W64LIT(0x187fd6d6a9d6fece), W64LIT(0x39f2b2b240b2f98b),
+        W64LIT(0x046fd2d2bdd2ded6), W64LIT(0xd77a9090ea90f447), W64LIT(0x655c17174b17b872), W64LIT(0xd2c7f8f83ff8932a),
+        W64LIT(0xd315424257422a91), W64LIT(0x6b5415154115a87e), W64LIT(0xbf45565613568ae9), W64LIT(0x2beab4b45eb4c99f),
+        W64LIT(0x26896565ec650f43), W64LIT(0x54701c1c6c1ce048), W64LIT(0x9f1a888892883417), W64LIT(0xd411434352432297),
+        W64LIT(0x6133c5c5f6c566a4), W64LIT(0x896d5c5c315cdad5), W64LIT(0x82d83636ee36adb4), W64LIT(0x01d2baba68bab9bb),
+        W64LIT(0xf1f3f5f506f5fb04), W64LIT(0xb8415757165782ef), W64LIT(0x28816767e6671f4f), W64LIT(0x840e8d8d838d1c09),
+        W64LIT(0x97c43131f53195a6), W64LIT(0xf8fff6f609f6e30e), W64LIT(0x218d6464e9640745), W64LIT(0x957d58582558facd),
+        W64LIT(0xfd429e9edc9e8463), W64LIT(0xf6f7f4f403f4f302), W64LIT(0xee882222aa220dcc), W64LIT(0x7192aaaa38aa39db),
+        W64LIT(0x56c97575bc758f23), W64LIT(0x2d3c0f0f330f7822), W64LIT(0x0e0802020a02100c), W64LIT(0x30feb1b14fb1e181),
+        W64LIT(0x275bdfdf84dfb6f8), W64LIT(0x1ea96d6dc46d4f73), W64LIT(0x44d17373a273bf37), W64LIT(0xfe294d4d644d52b3),
+        W64LIT(0x69ed7c7c917cc715), W64LIT(0xf2982626be262dd4), W64LIT(0xcab82e2e962e6de4), W64LIT(0xfffbf7f70cf7eb08),
+        W64LIT(0x3820080828084030), W64LIT(0x8e695d5d345dd2d3), W64LIT(0xc10d444449441a85), W64LIT(0xbaf83e3ec63eed84),
+        W64LIT(0xfa469f9fd99f8c65), W64LIT(0x6c5014144414a078), W64LIT(0x4207c8c8cfc80e8a), W64LIT(0x6d82aeae2cae19c3),
+        W64LIT(0xb14d545419549ae5), W64LIT(0x7040101050108060), W64LIT(0x3247d8d89fd88eea), W64LIT(0x13cabcbc76bc89af),
+        W64LIT(0x46681a1a721ad05c), W64LIT(0x0cb16b6bda6b7f67), W64LIT(0x02b96969d0696f6b), W64LIT(0xe3ebf3f318f3cb10),
+        W64LIT(0x14cebdbd73bd81a9), W64LIT(0x99cc3333ff3385aa), W64LIT(0x7696abab3dab31dd), W64LIT(0xdccffafa35fa8326),
+        W64LIT(0x0d63d1d1b2d1c6dc), W64LIT(0xe6569b9bcd9bac7d), W64LIT(0x05bd6868d568676d), W64LIT(0xf7254e4e6b4e4ab9),
+        W64LIT(0x625816164e16b074), W64LIT(0xcc6e9595fb95dc59), W64LIT(0xd07e9191ef91fc41), W64LIT(0xb09feeee71ee235e),
+        W64LIT(0xf92d4c4c614c5ab5), W64LIT(0x34916363f2633f57), W64LIT(0x8d028e8e8c8e0403), W64LIT(0x9c715b5b2a5be2c7),
+        W64LIT(0x5e17ccccdbcc2e92), W64LIT(0xb4f03c3ccc3cfd88), W64LIT(0x4f6419197d19c856), W64LIT(0x40bea1a11fa161e1),
+        W64LIT(0xa03e8181bf817c21), W64LIT(0xe2394949704972ab), W64LIT(0x7cf17b7b8a7bff07), W64LIT(0x3543d9d99ad986ec),
+        W64LIT(0x10a16f6fce6f5f7f), W64LIT(0x85dc3737eb37a5b2), W64LIT(0x3d9d6060fd60275d), W64LIT(0x4c0fcacac5ca1e86),
+        W64LIT(0x8fbbe7e75ce76b68), W64LIT(0xd1ac2b2b872b45fa), W64LIT(0xe53d484875487aad), W64LIT(0xc9d3fdfd2efdbb34),
+        W64LIT(0xc5629696f496c453), W64LIT(0xc60945454c451283), W64LIT(0xced7fcfc2bfcb332), W64LIT(0xda1941415841329b),
+        W64LIT(0x7e4812125a12906c), W64LIT(0x23340d0d390d682e), W64LIT(0x72f979798079ef0b), W64LIT(0x81b3e5e556e57b64),
+        W64LIT(0x981e898997893c11), W64LIT(0x830a8c8c868c140f), W64LIT(0x93abe3e348e34b70), W64LIT(0xe0802020a0201dc0),
+        W64LIT(0x90c03030f0309da0), W64LIT(0x2e57dcdc8bdcaef2), W64LIT(0x22e6b7b751b7d195), W64LIT(0x19ad6c6cc16c4775),
+        W64LIT(0xeb354a4a7f4a6aa1), W64LIT(0x2ceeb5b55bb5c199), W64LIT(0xbdfc3f3fc33fe582), W64LIT(0xc2669797f197cc55),
+        W64LIT(0x1677d4d4a3d4eec2), W64LIT(0x33956262f7623751), W64LIT(0xc3b42d2d992d75ee), W64LIT(0x121806061e063014),
+        W64LIT(0x5baaa4a40ea449ff), W64LIT(0x5caea5a50ba541f9), W64LIT(0xae368383b5836c2d), W64LIT(0x80615f5f3e5fc2df),
+        W64LIT(0xd6a82a2a822a4dfc), W64LIT(0x3c4fdada95da9ee6), W64LIT(0x4503c9c9cac9068c), W64LIT(0x0000000000000000),
+        W64LIT(0x67e57e7e9b7ed719), W64LIT(0x49b2a2a210a279eb), W64LIT(0xb64955551c5592e3), W64LIT(0x1ac6bfbf79bf91a5),
+        W64LIT(0x7744111155118866), W64LIT(0x1173d5d5a6d5e6c4), W64LIT(0xf34a9c9cd69c946f), W64LIT(0x571bcfcfd4cf3698),
+        W64LIT(0x2a380e0e360e7024), W64LIT(0x36280a0a220a503c), W64LIT(0xb3f43d3dc93df58e), W64LIT(0xaa5951510851b2fb),
+        W64LIT(0x6ee97d7d947dcf13), W64LIT(0xde769393e593ec4d), W64LIT(0x416c1b1b771bd85a), W64LIT(0xc0dffefe21fea33e),
+        W64LIT(0x6637c4c4f3c46ea2), W64LIT(0xc80147474647028f), W64LIT(0x3f2409092d094836), W64LIT(0xb5228686a4864433),
+        W64LIT(0x312c0b0b270b583a), W64LIT(0x8a068f8f898f0c05), W64LIT(0xf44e9d9dd39d9c69), W64LIT(0x0bb56a6adf6a7761),
+        W64LIT(0x151c07071b073812), W64LIT(0x08deb9b967b9a1b1), W64LIT(0x37fab0b04ab0e987), W64LIT(0xef5a9898c298b477),
+        W64LIT(0x486018187818c050), W64LIT(0x9ec83232fa328dac), W64LIT(0x4ad97171a871af3b), W64LIT(0xec314b4b7a4b62a7),
+        W64LIT(0xb79befef74ef2b58), W64LIT(0xa1ec3b3bd73bc59a), W64LIT(0x4ddd7070ad70a73d), W64LIT(0x47baa0a01aa069e7),
+        W64LIT(0x86b7e4e453e47362), W64LIT(0xdd1d40405d403a9d), W64LIT(0xc7dbffff24ffab38), W64LIT(0x732bc3c3e8c356b0),
+        W64LIT(0x789ea9a937a921d1), W64LIT(0x88bfe6e659e6636e), W64LIT(0x75fd78788578e70d), W64LIT(0xd5c3f9f93af99b2c),
+        W64LIT(0x96168b8b9d8b2c1d), W64LIT(0xcf05464643460a89), W64LIT(0xa73a8080ba807427), W64LIT(0x5a781e1e661ef044),
+        W64LIT(0xa8e03838d838dd90), W64LIT(0x9da3e1e142e15b7c), W64LIT(0x0fdab8b862b8a9b7), W64LIT(0x7f9aa8a832a829d7),
+        W64LIT(0x9aa7e0e047e0537a), W64LIT(0x24300c0c3c0c6028), W64LIT(0xe98c2323af2305ca), W64LIT(0x5fc57676b3769729),
+        W64LIT(0x53741d1d691de84e), W64LIT(0xfb942525b12535de), W64LIT(0xfc902424b4243dd8), W64LIT(0x1b1405051105281e),
+        W64LIT(0xede3f1f112f1db1c), W64LIT(0x17a56e6ecb6e5779), W64LIT(0xcb6a9494fe94d45f), W64LIT(0xd8a0282888285df0),
+        W64LIT(0xe1529a9ac89aa47b), W64LIT(0xbb2a8484ae84543f), W64LIT(0xa287e8e86fe8134a), W64LIT(0x4eb6a3a315a371ed),
+        W64LIT(0xf0214f4f6e4f42bf), W64LIT(0x58c17777b6779f2f), W64LIT(0x036bd3d3b8d3d6d0), W64LIT(0xbc2e8585ab855c39),
+        W64LIT(0x94afe2e24de24376), W64LIT(0xa35552520752aaf1), W64LIT(0xe4eff2f21df2c316), W64LIT(0xa9328282b082642b),
+        W64LIT(0xad5d50500d50bafd), W64LIT(0x7bf57a7a8f7af701), W64LIT(0xcdbc2f2f932f65e2), W64LIT(0x51cd7474b9748725),
+        W64LIT(0xa45153530253a2f7), W64LIT(0x3ef6b3b345b3f18d), W64LIT(0x3a996161f8612f5b), W64LIT(0x6a86afaf29af11c5),
+        W64LIT(0xafe43939dd39d596), W64LIT(0x8bd43535e135b5be), W64LIT(0x205fdede81debefe), W64LIT(0x5913cdcddecd2694),
+        W64LIT(0x5d7c1f1f631ff842), W64LIT(0xe85e9999c799bc71), W64LIT(0x638aacac26ac09cf), W64LIT(0x648eadad23ad01c9),
+        W64LIT(0x43d57272a772b731), W64LIT(0xc4b02c2c9c2c7de8), W64LIT(0x2953dddd8edda6f4), W64LIT(0x0a67d0d0b7d0ceda),
+        W64LIT(0xb2268787a1874c35), W64LIT(0x1dc2bebe7cbe99a3), W64LIT(0x87655e5e3b5ecad9), W64LIT(0x55a2a6a604a659f3),
+        W64LIT(0xbe97ecec7bec3352), W64LIT(0x1c10040414042018), W64LIT(0x683fc6c6f9c67eae), W64LIT(0x090c03030f03180a),
+        W64LIT(0x8cd03434e434bdb8), W64LIT(0xdbcbfbfb30fb8b20), W64LIT(0x3b4bdbdb90db96e0), W64LIT(0x927959592059f2cb),
+        W64LIT(0x25e2b6b654b6d993), W64LIT(0x742fc2c2edc25eb6), W64LIT(0x0704010105010806), W64LIT(0xeae7f0f017f0d31a),
+        W64LIT(0x9b755a5a2f5aeac1), W64LIT(0xb993eded7eed3b54), W64LIT(0x52a6a7a701a751f5), W64LIT(0x2f856666e3661749),
+        W64LIT(0xe7842121a52115c6), W64LIT(0x60e17f7f9e7fdf1f), W64LIT(0x91128a8a988a241b), W64LIT(0xf59c2727bb2725d2),
+        W64LIT(0x6f3bc7c7fcc776a8), W64LIT(0x7a27c0c0e7c04eba), W64LIT(0xdfa429298d2955f6), W64LIT(0x1f7bd7d7acd7f6c8)
+    },
+    {
+        W64LIT(0x769393e593ec4dde), W64LIT(0x43d9d99ad986ec35), W64LIT(0x529a9ac89aa47be1), W64LIT(0xeeb5b55bb5c1992c),
+        W64LIT(0x5a9898c298b477ef), W64LIT(0x882222aa220dccee), W64LIT(0x0945454c451283c6), W64LIT(0xd7fcfc2bfcb332ce),
+        W64LIT(0xd2baba68bab9bb01), W64LIT(0xb56a6adf6a77610b), W64LIT(0x5bdfdf84dfb6f827), W64LIT(0x0802020a02100c0e),
+        W64LIT(0x469f9fd99f8c65fa), W64LIT(0x57dcdc8bdcaef22e), W64LIT(0x5951510851b2fbaa), W64LIT(0x7959592059f2cb92),
+        W64LIT(0x354a4a7f4a6aa1eb), W64LIT(0x5c17174b17b87265), W64LIT(0xac2b2b872b45fad1), W64LIT(0x2fc2c2edc25eb674),
+        W64LIT(0x6a9494fe94d45fcb), W64LIT(0xf7f4f403f4f302f6), W64LIT(0xd6bbbb6dbbb1bd06), W64LIT(0xb6a3a315a371ed4e),
+        W64LIT(0x956262f762375133), W64LIT(0xb7e4e453e4736286), W64LIT(0xd97171a871af3b4a), W64LIT(0x77d4d4a3d4eec216),
+        W64LIT(0x13cdcddecd269459), W64LIT(0xdd7070ad70a73d4d), W64LIT(0x5816164e16b07462), W64LIT(0xa3e1e142e15b7c9d),
+        W64LIT(0x394949704972abe2), W64LIT(0xf03c3ccc3cfd88b4), W64LIT(0x27c0c0e7c04eba7a), W64LIT(0x47d8d89fd88eea32),
+        W64LIT(0x6d5c5c315cdad589), W64LIT(0x569b9bcd9bac7de6), W64LIT(0x8eadad23ad01c964), W64LIT(0x2e8585ab855c39bc),
+        W64LIT(0x5153530253a2f7a4), W64LIT(0xbea1a11fa161e140), W64LIT(0xf57a7a8f7af7017b), W64LIT(0x07c8c8cfc80e8a42),
+        W64LIT(0xb42d2d992d75eec3), W64LIT(0xa7e0e047e0537a9a), W64LIT(0x63d1d1b2d1c6dc0d), W64LIT(0xd57272a772b73143),
+        W64LIT(0xa2a6a604a659f355), W64LIT(0xb02c2c9c2c7de8c4), W64LIT(0x37c4c4f3c46ea266), W64LIT(0xabe3e348e34b7093),
+        W64LIT(0xc57676b37697295f), W64LIT(0xfd78788578e70d75), W64LIT(0xe6b7b751b7d19522), W64LIT(0xeab4b45eb4c99f2b),
+        W64LIT(0x2409092d0948363f), W64LIT(0xec3b3bd73bc59aa1), W64LIT(0x380e0e360e70242a), W64LIT(0x1941415841329bda),
+        W64LIT(0x2d4c4c614c5ab5f9), W64LIT(0x5fdede81debefe20), W64LIT(0xf2b2b240b2f98b39), W64LIT(0x7a9090ea90f447d7),
+        W64LIT(0x942525b12535defb), W64LIT(0xaea5a50ba541f95c), W64LIT(0x7bd7d7acd7f6c81f), W64LIT(0x0c03030f03180a09),
+        W64LIT(0x4411115511886677), W64LIT(0x0000000000000000), W64LIT(0x2bc3c3e8c356b073), W64LIT(0xb82e2e962e6de4ca),
+        W64LIT(0x729292e092e44bd9), W64LIT(0x9befef74ef2b58b7), W64LIT(0x254e4e6b4e4ab9f7), W64LIT(0x4812125a12906c7e),
+        W64LIT(0x4e9d9dd39d9c69f4), W64LIT(0xe97d7d947dcf136e), W64LIT(0x0bcbcbc0cb16804b), W64LIT(0xd43535e135b5be8b),
+        W64LIT(0x4010105010806070), W64LIT(0x73d5d5a6d5e6c411), W64LIT(0x214f4f6e4f42bff0), W64LIT(0x429e9edc9e8463fd),
+        W64LIT(0x294d4d644d52b3fe), W64LIT(0x9ea9a937a921d178), W64LIT(0x4955551c5592e3b6), W64LIT(0x3fc6c6f9c67eae68),
+        W64LIT(0x67d0d0b7d0ceda0a), W64LIT(0xf17b7b8a7bff077c), W64LIT(0x6018187818c05048), W64LIT(0x669797f197cc55c2),
+        W64LIT(0x6bd3d3b8d3d6d003), W64LIT(0xd83636ee36adb482), W64LIT(0xbfe6e659e6636e88), W64LIT(0x3d484875487aade5),
+        W64LIT(0x45565613568ae9bf), W64LIT(0x3e8181bf817c21a0), W64LIT(0x068f8f898f0c058a), W64LIT(0xc17777b6779f2f58),
+        W64LIT(0x17ccccdbcc2e925e), W64LIT(0x4a9c9cd69c946ff3), W64LIT(0xdeb9b967b9a1b108), W64LIT(0xafe2e24de2437694),
+        W64LIT(0x8aacac26ac09cf63), W64LIT(0xdab8b862b8a9b70f), W64LIT(0xbc2f2f932f65e2cd), W64LIT(0x5415154115a87e6b),
+        W64LIT(0xaaa4a40ea449ff5b), W64LIT(0xed7c7c917cc71569), W64LIT(0x4fdada95da9ee63c), W64LIT(0xe03838d838dd90a8),
+        W64LIT(0x781e1e661ef0445a), W64LIT(0x2c0b0b270b583a31), W64LIT(0x1405051105281e1b), W64LIT(0x7fd6d6a9d6fece18),
+        W64LIT(0x5014144414a0786c), W64LIT(0xa56e6ecb6e577917), W64LIT(0xad6c6cc16c477519), W64LIT(0xe57e7e9b7ed71967),
+        W64LIT(0x856666e36617492f), W64LIT(0xd3fdfd2efdbb34c9), W64LIT(0xfeb1b14fb1e18130), W64LIT(0xb3e5e556e57b6481),
+        W64LIT(0x9d6060fd60275d3d), W64LIT(0x86afaf29af11c56a), W64LIT(0x655e5e3b5ecad987), W64LIT(0xcc3333ff3385aa99),
+        W64LIT(0x268787a1874c35b2), W64LIT(0x03c9c9cac9068c45), W64LIT(0xe7f0f017f0d31aea), W64LIT(0x695d5d345dd2d38e),
+        W64LIT(0xa96d6dc46d4f731e), W64LIT(0xfc3f3fc33fe582bd), W64LIT(0x1a8888928834179f), W64LIT(0x0e8d8d838d1c0984),
+        W64LIT(0x3bc7c7fcc776a86f), W64LIT(0xfbf7f70cf7eb08ff), W64LIT(0x741d1d691de84e53), W64LIT(0x83e9e96ae91b4ca5),
+        W64LIT(0x97ecec7bec3352be), W64LIT(0x93eded7eed3b54b9), W64LIT(0x3a8080ba807427a7), W64LIT(0xa429298d2955f6df),
+        W64LIT(0x9c2727bb2725d2f5), W64LIT(0x1bcfcfd4cf369857), W64LIT(0x5e9999c799bc71e8), W64LIT(0x9aa8a832a829d77f),
+        W64LIT(0x5d50500d50bafdad), W64LIT(0x3c0f0f330f78222d), W64LIT(0xdc3737eb37a5b285), W64LIT(0x902424b4243dd8fc),
+        W64LIT(0xa0282888285df0d8), W64LIT(0xc03030f0309da090), W64LIT(0x6e9595fb95dc59cc), W64LIT(0x6fd2d2bdd2ded604),
+        W64LIT(0xf83e3ec63eed84ba), W64LIT(0x715b5b2a5be2c79c), W64LIT(0x1d40405d403a9ddd), W64LIT(0x368383b5836c2dae),
+        W64LIT(0xf6b3b345b3f18d3e), W64LIT(0xb96969d0696f6b02), W64LIT(0x415757165782efb8), W64LIT(0x7c1f1f631ff8425d),
+        W64LIT(0x1c07071b07381215), W64LIT(0x701c1c6c1ce04854), W64LIT(0x128a8a988a241b91), W64LIT(0xcabcbc76bc89af13),
+        W64LIT(0x802020a0201dc0e0), W64LIT(0x8bebeb60eb0b40ab), W64LIT(0x1fceced1ce3e9e50), W64LIT(0x028e8e8c8e04038d),
+        W64LIT(0x96abab3dab31dd76), W64LIT(0x9feeee71ee235eb0), W64LIT(0xc43131f53195a697), W64LIT(0xb2a2a210a279eb49),
+        W64LIT(0xd17373a273bf3744), W64LIT(0xc3f9f93af99b2cd5), W64LIT(0x0fcacac5ca1e864c), W64LIT(0xe83a3ad23acd9ca6),
+        W64LIT(0x681a1a721ad05c46), W64LIT(0xcbfbfb30fb8b20db), W64LIT(0x340d0d390d682e23), W64LIT(0x23c1c1e2c146bc7d),
+        W64LIT(0xdffefe21fea33ec0), W64LIT(0xcffafa35fa8326dc), W64LIT(0xeff2f21df2c316e4), W64LIT(0xa16f6fce6f5f7f10),
+        W64LIT(0xcebdbd73bd81a914), W64LIT(0x629696f496c453c5), W64LIT(0x53dddd8edda6f429), W64LIT(0x11434352432297d4),
+        W64LIT(0x5552520752aaf1a3), W64LIT(0xe2b6b654b6d99325), W64LIT(0x2008082808403038), W64LIT(0xebf3f318f3cb10e3),
+        W64LIT(0x82aeae2cae19c36d), W64LIT(0xc2bebe7cbe99a31d), W64LIT(0x6419197d19c8564f), W64LIT(0x1e898997893c1198),
+        W64LIT(0xc83232fa328dac9e), W64LIT(0x982626be262dd4f2), W64LIT(0xfab0b04ab0e98737), W64LIT(0x8feaea65ea0346ac),
+        W64LIT(0x314b4b7a4b62a7ec), W64LIT(0x8d6464e964074521), W64LIT(0x2a8484ae84543fbb), W64LIT(0x328282b082642ba9),
+        W64LIT(0xb16b6bda6b7f670c), W64LIT(0xf3f5f506f5fb04f1), W64LIT(0xf979798079ef0b72), W64LIT(0xc6bfbf79bf91a51a),
+        W64LIT(0x0401010501080607), W64LIT(0x615f5f3e5fc2df80), W64LIT(0xc97575bc758f2356), W64LIT(0x916363f2633f5734),
+        W64LIT(0x6c1b1b771bd85a41), W64LIT(0x8c2323af2305cae9), W64LIT(0xf43d3dc93df58eb3), W64LIT(0xbd6868d568676d05),
+        W64LIT(0xa82a2a822a4dfcd6), W64LIT(0x896565ec650f4326), W64LIT(0x87e8e86fe8134aa2), W64LIT(0x7e9191ef91fc41d0),
+        W64LIT(0xfff6f609f6e30ef8), W64LIT(0xdbffff24ffab38c7), W64LIT(0x4c13135f13986a79), W64LIT(0x7d58582558facd95),
+        W64LIT(0xe3f1f112f1db1ced), W64LIT(0x0147474647028fc8), W64LIT(0x280a0a220a503c36), W64LIT(0xe17f7f9e7fdf1f60),
+        W64LIT(0x33c5c5f6c566a461), W64LIT(0xa6a7a701a751f552), W64LIT(0xbbe7e75ce76b688f), W64LIT(0x996161f8612f5b3a),
+        W64LIT(0x755a5a2f5aeac19b), W64LIT(0x1806061e06301412), W64LIT(0x05464643460a89cf), W64LIT(0x0d444449441a85c1),
+        W64LIT(0x15424257422a91d3), W64LIT(0x100404140420181c), W64LIT(0xbaa0a01aa069e747), W64LIT(0x4bdbdb90db96e03b),
+        W64LIT(0xe43939dd39d596af), W64LIT(0x228686a4864433b5), W64LIT(0x4d545419549ae5b1), W64LIT(0x92aaaa38aa39db71),
+        W64LIT(0x0a8c8c868c140f83), W64LIT(0xd03434e434bdb88c), W64LIT(0x842121a52115c6e7), W64LIT(0x168b8b9d8b2c1d96),
+        W64LIT(0xc7f8f83ff8932ad2), W64LIT(0x300c0c3c0c602824), W64LIT(0xcd7474b974872551), W64LIT(0x816767e6671f4f28)
+    },
+    {
+        W64LIT(0x6868d568676d05bd), W64LIT(0x8d8d838d1c09840e), W64LIT(0xcacac5ca1e864c0f), W64LIT(0x4d4d644d52b3fe29),
+        W64LIT(0x7373a273bf3744d1), W64LIT(0x4b4b7a4b62a7ec31), W64LIT(0x4e4e6b4e4ab9f725), W64LIT(0x2a2a822a4dfcd6a8),
+        W64LIT(0xd4d4a3d4eec21677), W64LIT(0x52520752aaf1a355), W64LIT(0x2626be262dd4f298), W64LIT(0xb3b345b3f18d3ef6),
+        W64LIT(0x545419549ae5b14d), W64LIT(0x1e1e661ef0445a78), W64LIT(0x19197d19c8564f64), W64LIT(0x1f1f631ff8425d7c),
+        W64LIT(0x2222aa220dccee88), W64LIT(0x03030f03180a090c), W64LIT(0x464643460a89cf05), W64LIT(0x3d3dc93df58eb3f4),
+        W64LIT(0x2d2d992d75eec3b4), W64LIT(0x4a4a7f4a6aa1eb35), W64LIT(0x53530253a2f7a451), W64LIT(0x8383b5836c2dae36),
+        W64LIT(0x13135f13986a794c), W64LIT(0x8a8a988a241b9112), W64LIT(0xb7b751b7d19522e6), W64LIT(0xd5d5a6d5e6c41173),
+        W64LIT(0x2525b12535defb94), W64LIT(0x79798079ef0b72f9), W64LIT(0xf5f506f5fb04f1f3), W64LIT(0xbdbd73bd81a914ce),
+        W64LIT(0x58582558facd957d), W64LIT(0x2f2f932f65e2cdbc), W64LIT(0x0d0d390d682e2334), W64LIT(0x02020a02100c0e08),
+        W64LIT(0xeded7eed3b54b993), W64LIT(0x51510851b2fbaa59), W64LIT(0x9e9edc9e8463fd42), W64LIT(0x1111551188667744),
+        W64LIT(0xf2f21df2c316e4ef), W64LIT(0x3e3ec63eed84baf8), W64LIT(0x55551c5592e3b649), W64LIT(0x5e5e3b5ecad98765),
+        W64LIT(0xd1d1b2d1c6dc0d63), W64LIT(0x16164e16b0746258), W64LIT(0x3c3ccc3cfd88b4f0), W64LIT(0x6666e36617492f85),
+        W64LIT(0x7070ad70a73d4ddd), W64LIT(0x5d5d345dd2d38e69), W64LIT(0xf3f318f3cb10e3eb), W64LIT(0x45454c451283c609),
+        W64LIT(0x40405d403a9ddd1d), W64LIT(0xccccdbcc2e925e17), W64LIT(0xe8e86fe8134aa287), W64LIT(0x9494fe94d45fcb6a),
+        W64LIT(0x565613568ae9bf45), W64LIT(0x0808280840303820), W64LIT(0xceced1ce3e9e501f), W64LIT(0x1a1a721ad05c4668),
+        W64LIT(0x3a3ad23acd9ca6e8), W64LIT(0xd2d2bdd2ded6046f), W64LIT(0xe1e142e15b7c9da3), W64LIT(0xdfdf84dfb6f8275b),
+        W64LIT(0xb5b55bb5c1992cee), W64LIT(0x3838d838dd90a8e0), W64LIT(0x6e6ecb6e577917a5), W64LIT(0x0e0e360e70242a38),
+        W64LIT(0xe5e556e57b6481b3), W64LIT(0xf4f403f4f302f6f7), W64LIT(0xf9f93af99b2cd5c3), W64LIT(0x8686a4864433b522),
+        W64LIT(0xe9e96ae91b4ca583), W64LIT(0x4f4f6e4f42bff021), W64LIT(0xd6d6a9d6fece187f), W64LIT(0x8585ab855c39bc2e),
+        W64LIT(0x2323af2305cae98c), W64LIT(0xcfcfd4cf3698571b), W64LIT(0x3232fa328dac9ec8), W64LIT(0x9999c799bc71e85e),
+        W64LIT(0x3131f53195a697c4), W64LIT(0x14144414a0786c50), W64LIT(0xaeae2cae19c36d82), W64LIT(0xeeee71ee235eb09f),
+        W64LIT(0xc8c8cfc80e8a4207), W64LIT(0x484875487aade53d), W64LIT(0xd3d3b8d3d6d0036b), W64LIT(0x3030f0309da090c0),
+        W64LIT(0xa1a11fa161e140be), W64LIT(0x9292e092e44bd972), W64LIT(0x41415841329bda19), W64LIT(0xb1b14fb1e18130fe),
+        W64LIT(0x18187818c0504860), W64LIT(0xc4c4f3c46ea26637), W64LIT(0x2c2c9c2c7de8c4b0), W64LIT(0x7171a871af3b4ad9),
+        W64LIT(0x7272a772b73143d5), W64LIT(0x444449441a85c10d), W64LIT(0x15154115a87e6b54), W64LIT(0xfdfd2efdbb34c9d3),
+        W64LIT(0x3737eb37a5b285dc), W64LIT(0xbebe7cbe99a31dc2), W64LIT(0x5f5f3e5fc2df8061), W64LIT(0xaaaa38aa39db7192),
+        W64LIT(0x9b9bcd9bac7de656), W64LIT(0x8888928834179f1a), W64LIT(0xd8d89fd88eea3247), W64LIT(0xabab3dab31dd7696),
+        W64LIT(0x898997893c11981e), W64LIT(0x9c9cd69c946ff34a), W64LIT(0xfafa35fa8326dccf), W64LIT(0x6060fd60275d3d9d),
+        W64LIT(0xeaea65ea0346ac8f), W64LIT(0xbcbc76bc89af13ca), W64LIT(0x6262f76237513395), W64LIT(0x0c0c3c0c60282430),
+        W64LIT(0x2424b4243dd8fc90), W64LIT(0xa6a604a659f355a2), W64LIT(0xa8a832a829d77f9a), W64LIT(0xecec7bec3352be97),
+        W64LIT(0x6767e6671f4f2881), W64LIT(0x2020a0201dc0e080), W64LIT(0xdbdb90db96e03b4b), W64LIT(0x7c7c917cc71569ed),
+        W64LIT(0x282888285df0d8a0), W64LIT(0xdddd8edda6f42953), W64LIT(0xacac26ac09cf638a), W64LIT(0x5b5b2a5be2c79c71),
+        W64LIT(0x3434e434bdb88cd0), W64LIT(0x7e7e9b7ed71967e5), W64LIT(0x1010501080607040), W64LIT(0xf1f112f1db1cede3),
+        W64LIT(0x7b7b8a7bff077cf1), W64LIT(0x8f8f898f0c058a06), W64LIT(0x6363f2633f573491), W64LIT(0xa0a01aa069e747ba),
+        W64LIT(0x05051105281e1b14), W64LIT(0x9a9ac89aa47be152), W64LIT(0x434352432297d411), W64LIT(0x7777b6779f2f58c1),
+        W64LIT(0x2121a52115c6e784), W64LIT(0xbfbf79bf91a51ac6), W64LIT(0x2727bb2725d2f59c), W64LIT(0x09092d0948363f24),
+        W64LIT(0xc3c3e8c356b0732b), W64LIT(0x9f9fd99f8c65fa46), W64LIT(0xb6b654b6d99325e2), W64LIT(0xd7d7acd7f6c81f7b),
+        W64LIT(0x29298d2955f6dfa4), W64LIT(0xc2c2edc25eb6742f), W64LIT(0xebeb60eb0b40ab8b), W64LIT(0xc0c0e7c04eba7a27),
+        W64LIT(0xa4a40ea449ff5baa), W64LIT(0x8b8b9d8b2c1d9616), W64LIT(0x8c8c868c140f830a), W64LIT(0x1d1d691de84e5374),
+        W64LIT(0xfbfb30fb8b20dbcb), W64LIT(0xffff24ffab38c7db), W64LIT(0xc1c1e2c146bc7d23), W64LIT(0xb2b240b2f98b39f2),
+        W64LIT(0x9797f197cc55c266), W64LIT(0x2e2e962e6de4cab8), W64LIT(0xf8f83ff8932ad2c7), W64LIT(0x6565ec650f432689),
+        W64LIT(0xf6f609f6e30ef8ff), W64LIT(0x7575bc758f2356c9), W64LIT(0x07071b073812151c), W64LIT(0x0404140420181c10),
+        W64LIT(0x4949704972abe239), W64LIT(0x3333ff3385aa99cc), W64LIT(0xe4e453e4736286b7), W64LIT(0xd9d99ad986ec3543),
+        W64LIT(0xb9b967b9a1b108de), W64LIT(0xd0d0b7d0ceda0a67), W64LIT(0x424257422a91d315), W64LIT(0xc7c7fcc776a86f3b),
+        W64LIT(0x6c6cc16c477519ad), W64LIT(0x9090ea90f447d77a), W64LIT(0x0000000000000000), W64LIT(0x8e8e8c8e04038d02),
+        W64LIT(0x6f6fce6f5f7f10a1), W64LIT(0x50500d50bafdad5d), W64LIT(0x0101050108060704), W64LIT(0xc5c5f6c566a46133),
+        W64LIT(0xdada95da9ee63c4f), W64LIT(0x47474647028fc801), W64LIT(0x3f3fc33fe582bdfc), W64LIT(0xcdcddecd26945913),
+        W64LIT(0x6969d0696f6b02b9), W64LIT(0xa2a210a279eb49b2), W64LIT(0xe2e24de2437694af), W64LIT(0x7a7a8f7af7017bf5),
+        W64LIT(0xa7a701a751f552a6), W64LIT(0xc6c6f9c67eae683f), W64LIT(0x9393e593ec4dde76), W64LIT(0x0f0f330f78222d3c),
+        W64LIT(0x0a0a220a503c3628), W64LIT(0x06061e0630141218), W64LIT(0xe6e659e6636e88bf), W64LIT(0x2b2b872b45fad1ac),
+        W64LIT(0x9696f496c453c562), W64LIT(0xa3a315a371ed4eb6), W64LIT(0x1c1c6c1ce0485470), W64LIT(0xafaf29af11c56a86),
+        W64LIT(0x6a6adf6a77610bb5), W64LIT(0x12125a12906c7e48), W64LIT(0x8484ae84543fbb2a), W64LIT(0x3939dd39d596afe4),
+        W64LIT(0xe7e75ce76b688fbb), W64LIT(0xb0b04ab0e98737fa), W64LIT(0x8282b082642ba932), W64LIT(0xf7f70cf7eb08fffb),
+        W64LIT(0xfefe21fea33ec0df), W64LIT(0x9d9dd39d9c69f44e), W64LIT(0x8787a1874c35b226), W64LIT(0x5c5c315cdad5896d),
+        W64LIT(0x8181bf817c21a03e), W64LIT(0x3535e135b5be8bd4), W64LIT(0xdede81debefe205f), W64LIT(0xb4b45eb4c99f2bea),
+        W64LIT(0xa5a50ba541f95cae), W64LIT(0xfcfc2bfcb332ced7), W64LIT(0x8080ba807427a73a), W64LIT(0xefef74ef2b58b79b),
+        W64LIT(0xcbcbc0cb16804b0b), W64LIT(0xbbbb6dbbb1bd06d6), W64LIT(0x6b6bda6b7f670cb1), W64LIT(0x7676b37697295fc5),
+        W64LIT(0xbaba68bab9bb01d2), W64LIT(0x5a5a2f5aeac19b75), W64LIT(0x7d7d947dcf136ee9), W64LIT(0x78788578e70d75fd),
+        W64LIT(0x0b0b270b583a312c), W64LIT(0x9595fb95dc59cc6e), W64LIT(0xe3e348e34b7093ab), W64LIT(0xadad23ad01c9648e),
+        W64LIT(0x7474b974872551cd), W64LIT(0x9898c298b477ef5a), W64LIT(0x3b3bd73bc59aa1ec), W64LIT(0x3636ee36adb482d8),
+        W64LIT(0x6464e9640745218d), W64LIT(0x6d6dc46d4f731ea9), W64LIT(0xdcdc8bdcaef22e57), W64LIT(0xf0f017f0d31aeae7),
+        W64LIT(0x59592059f2cb9279), W64LIT(0xa9a937a921d1789e), W64LIT(0x4c4c614c5ab5f92d), W64LIT(0x17174b17b872655c),
+        W64LIT(0x7f7f9e7fdf1f60e1), W64LIT(0x9191ef91fc41d07e), W64LIT(0xb8b862b8a9b70fda), W64LIT(0xc9c9cac9068c4503),
+        W64LIT(0x5757165782efb841), W64LIT(0x1b1b771bd85a416c), W64LIT(0xe0e047e0537a9aa7), W64LIT(0x6161f8612f5b3a99)
+    }
+};
+
+const word64 IT[8][256] =
+{
+    {
+        W64LIT(0x7826942b9f5f8a9a), W64LIT(0x210f43c934970c53), W64LIT(0x5f028fdd9d0551b8), W64LIT(0x14facd82b494c83b),
+        W64LIT(0x2b72ab886edd68c0), W64LIT(0xa6a87e5bff19d9b4), W64LIT(0xa29ae571db6443ea), W64LIT(0x039b2c911be8e5b6),
+        W64LIT(0xd9275dcb5fd32cc6), W64LIT(0x10c856a890e95265), W64LIT(0x7d96e085b27ab85d), W64LIT(0x31c71561a47e5e36),
+        W64LIT(0x74702455f3d83978), W64LIT(0xe8e048aafbad72f0), W64LIT(0x9b39db4437e03460), W64LIT(0x75f2cbd1fa8091e1),
+        W64LIT(0x1ab5bee9caa336f6), W64LIT(0x8395a6b8eff34fb9), W64LIT(0x64b872fd63316b1d), W64LIT(0xe1068c7aba0ff3d5),
+        W64LIT(0xeecb1095cd60a581), W64LIT(0xbc1dc0b235baef42), W64LIT(0xf04c355623be0929), W64LIT(0xb252b3d94b8d118f),
+        W64LIT(0x18ac7dfcd8137bd9), W64LIT(0xbbb477090a2f90aa), W64LIT(0x8625d216c2d67d7e), W64LIT(0x66a1b1e871812632),
+        W64LIT(0x6f4775383023a717), W64LIT(0x92df1f947642b545), W64LIT(0xe962a72ef2f5da69), W64LIT(0x8bf18deca7096605),
+        W64LIT(0xc86de4e7c662d63a), W64LIT(0xaafece25939e6a56), W64LIT(0x5c99a34c86edb40e), W64LIT(0x52d6d027f8da4ac3),
+        W64LIT(0x6b75ee12145e3d49), W64LIT(0x54fd8818ce179db2), W64LIT(0xa3180af5d23ceb73), W64LIT(0xbe0403a7270aa26d),
+        W64LIT(0xfe03463d5d89f7e4), W64LIT(0xf1cedad22ae6a1b0), W64LIT(0xd143769f1729057a), W64LIT(0xc7a07808b10d806e),
+        W64LIT(0xfc1a85284f39bacb), W64LIT(0xa4b1bd4eeda9949b), W64LIT(0x0bff07c55312cc0a), W64LIT(0xef49ff11c4380d18),
+        W64LIT(0xc392e32295701a30), W64LIT(0x7f8f2390a0caf572), W64LIT(0x62932ac255fcbc6c), W64LIT(0xc9ef0b63cf3a7ea3),
+        W64LIT(0xf9aaf186621c880c), W64LIT(0x818c65adfd430296), W64LIT(0x325c39f0bf96bb80), W64LIT(0x0c56b07e6c87b3e2),
+        W64LIT(0x4bf8425f29919983), W64LIT(0xb5fb046274186e67), W64LIT(0x462c1da54c4e82f8), W64LIT(0x90c6dc8164f2f86a),
+        W64LIT(0xf8281e026b442095), W64LIT(0x6af701961d0695d0), W64LIT(0x5766a489d5ff7804), W64LIT(0xf3d719c73856ec9f),
+        W64LIT(0xad57799eac0b15be), W64LIT(0x1b37516dc3fb9e6f), W64LIT(0xc009cfb38e98ff86), W64LIT(0x9576a82f49d7caad),
+        W64LIT(0xe6af3bc1859a8c3d), W64LIT(0x208dac4d3dcfa4ca), W64LIT(0x8ddad5d391c4b174), W64LIT(0x8e41f9428a2c54c2),
+        W64LIT(0x6cdc59a92bcb42a1), W64LIT(0xe53417509e72698b), W64LIT(0xd0c1991b1e71ade3), W64LIT(0x8217493ce6abe720),
+        W64LIT(0xd4f302313a0c37bd), W64LIT(0x5e806059945df921), W64LIT(0x73d993eecc4d4690), W64LIT(0xf5fc41f80e9b3bee),
+        W64LIT(0x13537a398b01b7d3), W64LIT(0x53543fa3f182e25a), W64LIT(0x2d59f3b75810bfb1), W64LIT(0x35f58e4b8003c468),
+        W64LIT(0x886aa17dbce183b3), W64LIT(0x4c51f5e41604e66b), W64LIT(0x98a2f7d52c08d1d6), W64LIT(0xa101c9e0c08ca65c),
+        W64LIT(0x4007459a7a835589), W64LIT(0xcc5f7fcde21f4c64), W64LIT(0xa965e2b488768fe0), W64LIT(0x12d195bd82591f4a),
+        W64LIT(0x2f4030a24aa0f29e), W64LIT(0x56e44b0ddca7d09d), W64LIT(0x914433056daa50f3), W64LIT(0x37ec4d5e92b38947),
+        W64LIT(0xe31f4f6fa8bfbefa), W64LIT(0x50cf1332ea6a07ec), W64LIT(0x6d5eb62d2293ea38), W64LIT(0x09e6c4d041a28125),
+        W64LIT(0x8fc316c68374fc5b), W64LIT(0x421e868f683318a6), W64LIT(0xe08463feb3575b4c), W64LIT(0x3821d1b1e5dcdf13),
+        W64LIT(0xed503c04d6884037), W64LIT(0xd35ab58a05994855), W64LIT(0x976f6b3a5b678782), W64LIT(0x6ec59abc397b0f8e),
+        W64LIT(0x5929d7e2abc886c9), W64LIT(0xa53352cae4f13c02), W64LIT(0x89e84ef9b5b92b2a), W64LIT(0x1761e113af7c2d8d),
+        W64LIT(0x28e9871975358d76), W64LIT(0xdc97296572f61e01), W64LIT(0x67235e6c78d98eab), W64LIT(0x3d91a51fc8f9edd4),
+        W64LIT(0x68eec2830fb6d8ff), W64LIT(0xfbb3329370acc523), W64LIT(0x062b583f36cdd771), W64LIT(0x15782206bdcc60a2),
+        W64LIT(0x16e30e97a6248514), W64LIT(0x79a47baf96072203), W64LIT(0xf7e582ed1c2b76c1), W64LIT(0xde8eea706046532e),
+        W64LIT(0xaf4eba8bbebb5891), W64LIT(0x08642b5448fa29bc), W64LIT(0x24bf376719b23e94), W64LIT(0x231680dc2627417c),
+        W64LIT(0x0dd45ffa65df1b7b), W64LIT(0x1d1c0952f536491e), W64LIT(0xff81a9b954d15f7d), W64LIT(0x992018512550794f),
+        W64LIT(0x71c050fbdefd0bbf), W64LIT(0xc18b203787c0571f), W64LIT(0x253dd8e310ea960d), W64LIT(0xeb7b643be0459746),
+        W64LIT(0x0219c31512b04d2f), W64LIT(0xc43b5499aae565d8), W64LIT(0xeaf98bbfe91d3fdf), W64LIT(0x3a3812a4f76c923c),
+        W64LIT(0x4dd31a601f5c4ef2), W64LIT(0xa8e70d30812e2779), W64LIT(0x800e8a29f41baa0f), W64LIT(0x1c9ee6d6fc6ee187),
+        W64LIT(0x5d1b4cc88fb51c97), W64LIT(0x610806534e1459da), W64LIT(0xf255f643310e4406), W64LIT(0xd2d85a0e0cc1e0cc),
+        W64LIT(0x0182ef840958a899), W64LIT(0x7e0dcc14a9925deb), W64LIT(0x653a9d796a69c384), W64LIT(0x4e4836f104b4ab44),
+        W64LIT(0x4fcad9750dec03dd), W64LIT(0xcddd9049eb47e4fd), W64LIT(0x0e4f736b7e37fecd), W64LIT(0x4185aa1e73dbfd10),
+        W64LIT(0x725b7c6ac515ee09), W64LIT(0x8a736268ae51ce9c), W64LIT(0xc5b9bb1da3bdcd41), W64LIT(0x7bbdb8ba84b76f2c),
+        W64LIT(0xdabc715a443bc970), W64LIT(0xe29da0eba1e71663), W64LIT(0x935df0107f1a1ddc), W64LIT(0x608ae9d7474cf143),
+        W64LIT(0xd571edb533549f24), W64LIT(0xa0832664c9d40ec5), W64LIT(0xfd986aac46611252), W64LIT(0x4435deb05efecfd7),
+        W64LIT(0x0000000000000000), W64LIT(0x2cdb1c3351481728), W64LIT(0x94f447ab408f6234), W64LIT(0x45b7313457a6674e),
+        W64LIT(0xb82f5b9811c7751c), W64LIT(0x8c583a57989c19ed), W64LIT(0xdd15c6e17baeb698), W64LIT(0x696c2d0706ee7066),
+        W64LIT(0x3f88660ada49a0fb), W64LIT(0xf47eae7c07c39377), W64LIT(0x05b074ae2d2532c7), W64LIT(0xb3d05c5d42d5b916),
+        W64LIT(0x39a33e35ec84778a), W64LIT(0x0fcd9cef776f5654), W64LIT(0xacd5961aa553bd27), W64LIT(0x5b3014f7b978cbe6),
+        W64LIT(0x347761cf895b6cf1), W64LIT(0xc622978cb85528f7), W64LIT(0xb7e2c77766a82348), W64LIT(0x77eb08c4e830dcce),
+        W64LIT(0xb9adb41c189fdd85), W64LIT(0x114ab92c99b1fafc), W64LIT(0x26a6f4720b0273bb), W64LIT(0x1e8725c3eedeaca8),
+        W64LIT(0x2af0440c6785c059), W64LIT(0x04329b2a247d9a5e), W64LIT(0xd7682ea021e4d20b), W64LIT(0x7c140f01bb2210c4),
+        W64LIT(0x96ed84be523f2f1b), W64LIT(0xca7427f2d4d29b15), W64LIT(0x47aef22145162a61), W64LIT(0xa72a91dff641712d),
+        W64LIT(0x5ab2fb73b020637f), W64LIT(0xcbf6c876dd8a338c), W64LIT(0x6311c5465ca414f5), W64LIT(0x07a9b7bb3f957fe8),
+        W64LIT(0xe72dd4458cc224a4), W64LIT(0x9d12837b012de311), W64LIT(0x843c1103d0663051), W64LIT(0x0a7de8415a4a6493),
+        W64LIT(0xd6eac12428bc7a92), W64LIT(0x9c906cff08754b88), W64LIT(0x7042bf7fd7a5a326), W64LIT(0xbd9f2f363ce247db),
+        W64LIT(0xb66028f36ff08bd1), W64LIT(0x192e9278d14bd340), W64LIT(0x9f0b406e139dae3e), W64LIT(0x1f05ca47e7860431),
+        W64LIT(0x85befe87d93e98c8), W64LIT(0x439c690b616bb03f), W64LIT(0xba36988d03773833), W64LIT(0x87a73d92cb8ed5e7),
+        W64LIT(0xaecc550fb7e3f008), W64LIT(0xc2100ca69c28b2a9), W64LIT(0x9abb34c03eb89cf9), W64LIT(0x49e1814a3b21d4ac),
+        W64LIT(0xecd2d380dfd0e8ae), W64LIT(0x296b689d7c6d25ef), W64LIT(0x3c134a9bc1a1454d), W64LIT(0xcfc4535cf9f7a9d2),
+        W64LIT(0x557f679cc74f352b), W64LIT(0xb479ebe67d40c6fe), W64LIT(0xf6676d691573de58), W64LIT(0x9e89afea1ac506a7),
+        W64LIT(0xd8a5b24f568b845f), W64LIT(0x48636ece32797c35), W64LIT(0xdf0c05f4691efbb7), W64LIT(0xe4b6f8d4972ac112),
+        W64LIT(0xfa31dd1779f46dba), W64LIT(0xbf86ec232e520af4), W64LIT(0x3e0a898ed3110862), W64LIT(0x7a3f573e8defc7b5),
+        W64LIT(0x27241bf6025adb22), W64LIT(0x58ab3866a2902e50), W64LIT(0x3bbafd20fe343aa5), W64LIT(0x3045fae5ad26f6af),
+        W64LIT(0x2ec2df2643f85a07), W64LIT(0x22946f582f7fe9e5), W64LIT(0x366ea2da9beb21de), W64LIT(0x4a7aaddb20c9311a),
+        W64LIT(0xb1c99f485065f439), W64LIT(0xb04b70cc593d5ca0), W64LIT(0xab7c21a19ac6c2cf), W64LIT(0x33ded674b6ce1319),
+        W64LIT(0xce46bcd8f0af014b), W64LIT(0xdb3e9ede4d6361e9), W64LIT(0x7669e740e1687457), W64LIT(0x514dfcb6e332af75)
+    },
+    {
+        W64LIT(0x1f4f6fa8bfbefae3), W64LIT(0xf0440c6785c0592a), W64LIT(0x1dc0b235baef42bc), W64LIT(0x22978cb85528f7c6),
+        W64LIT(0xcedad22ae6a1b0f1), W64LIT(0x180af5d23ceb73a3), W64LIT(0x946f582f7fe9e522), W64LIT(0xe44b0ddca7d09d56),
+        W64LIT(0x906cff08754b889c), W64LIT(0x9f2f363ce247dbbd), W64LIT(0xa1b1e87181263266), W64LIT(0x21d1b1e5dcdf1338),
+        W64LIT(0x31dd1779f46dbafa), W64LIT(0x4b70cc593d5ca0b0), W64LIT(0xd719c73856ec9ff3), W64LIT(0x8725c3eedeaca81e),
+        W64LIT(0x71edb533549f24d5), W64LIT(0x12837b012de3119d), W64LIT(0x3dd8e310ea960d25), W64LIT(0x29d7e2abc886c959),
+        W64LIT(0xb477090a2f90aabb), W64LIT(0x45fae5ad26f6af30), W64LIT(0x9ee6d6fc6ee1871c), W64LIT(0xbefe87d93e98c885),
+        W64LIT(0xe30e97a624851416), W64LIT(0xd6d027f8da4ac352), W64LIT(0xcc550fb7e3f008ae), W64LIT(0x5ab58a05994855d3),
+        W64LIT(0x806059945df9215e), W64LIT(0x82ef840958a89901), W64LIT(0x4ab92c99b1fafc11), W64LIT(0x281e026b442095f8),
+        W64LIT(0x62a72ef2f5da69e9), W64LIT(0x8b203787c0571fc1), W64LIT(0x4f736b7e37fecd0e), W64LIT(0xab3866a2902e5058),
+        W64LIT(0x6ea2da9beb21de36), W64LIT(0xf447ab408f623494), W64LIT(0x235e6c78d98eab67), W64LIT(0x11c5465ca414f563),
+        W64LIT(0xd31a601f5c4ef24d), W64LIT(0xa2f7d52c08d1d698), W64LIT(0x85aa1e73dbfd1041), W64LIT(0xdc59a92bcb42a16c),
+        W64LIT(0x59f3b75810bfb12d), W64LIT(0xe2c77766a82348b7), W64LIT(0xb9bb1da3bdcd41c5), W64LIT(0x96e085b27ab85d7d),
+        W64LIT(0x99a34c86edb40e5c), W64LIT(0x66a489d5ff780457), W64LIT(0x95a6b8eff34fb983), W64LIT(0x7f679cc74f352b55),
+        W64LIT(0x7de8415a4a64930a), W64LIT(0x9b2c911be8e5b603), W64LIT(0x4836f104b4ab444e), W64LIT(0xdb1c33514817282c),
+        W64LIT(0x15c6e17baeb698dd), W64LIT(0xed84be523f2f1b96), W64LIT(0xe1814a3b21d4ac49), W64LIT(0x503c04d6884037ed),
+        W64LIT(0x4c355623be0929f0), W64LIT(0x3b5499aae565d8c4), W64LIT(0x0a898ed31108623e), W64LIT(0xb074ae2d2532c705),
+        W64LIT(0x028fdd9d0551b85f), W64LIT(0xf58e4b8003c46835), W64LIT(0x3352cae4f13c02a5), W64LIT(0x6c2d0706ee706669),
+        W64LIT(0x7c21a19ac6c2cfab), W64LIT(0x19c31512b04d2f02), W64LIT(0xa6f4720b0273bb26), W64LIT(0x05ca47e78604311f),
+        W64LIT(0x46bcd8f0af014bce), W64LIT(0x1e868f683318a642), W64LIT(0x5c39f0bf96bb8032), W64LIT(0x79ebe67d40c6feb4),
+        W64LIT(0xff07c55312cc0a0b), W64LIT(0xaef22145162a6147), W64LIT(0xc1991b1e71ade3d0), W64LIT(0xded674b6ce131933),
+        W64LIT(0x7aaddb20c9311a4a), W64LIT(0x4dfcb6e332af7551), W64LIT(0x6de4e7c662d63ac8), W64LIT(0xbf376719b23e9424),
+        W64LIT(0x07459a7a83558940), W64LIT(0xac7dfcd8137bd918), W64LIT(0xdf1f947642b54592), W64LIT(0x17493ce6abe72082),
+        W64LIT(0xfc41f80e9b3beef5), W64LIT(0xe70d30812e2779a8), W64LIT(0xd993eecc4d469073), W64LIT(0x65e2b488768fe0a9),
+        W64LIT(0xd2d380dfd0e8aeec), W64LIT(0xe6c4d041a2812509), W64LIT(0x068c7aba0ff3d5e1), W64LIT(0x51f5e41604e66b4c),
+        W64LIT(0x41f9428a2c54c28e), W64LIT(0x537a398b01b7d313), W64LIT(0x782206bdcc60a215), W64LIT(0x89afea1ac506a79e),
+        W64LIT(0x8ae9d7474cf14360), W64LIT(0xf6c876dd8a338ccb), W64LIT(0x43769f1729057ad1), W64LIT(0x8dac4d3dcfa4ca20),
+        W64LIT(0xb7313457a6674e45), W64LIT(0x2018512550794f99), W64LIT(0xbb34c03eb89cf99a), W64LIT(0xbafd20fe343aa53b),
+        W64LIT(0x03463d5d89f7e4fe), W64LIT(0x42bf7fd7a5a32670), W64LIT(0x3f573e8defc7b57a), W64LIT(0xadb41c189fdd85b9),
+        W64LIT(0xcad9750dec03dd4f), W64LIT(0x0f43c934970c5321), W64LIT(0x2f5b9811c7751cb8), W64LIT(0xd85a0e0cc1e0ccd2),
+        W64LIT(0xe048aafbad72f0e8), W64LIT(0xf18deca70966058b), W64LIT(0xdd9049eb47e4fdcd), W64LIT(0xa87e5bff19d9b4a6),
+        W64LIT(0x5df0107f1a1ddc93), W64LIT(0xd195bd82591f4a12), W64LIT(0x0c05f4691efbb7df), W64LIT(0x8463feb3575b4ce0),
+        W64LIT(0x55f643310e4406f2), W64LIT(0xb6f8d4972ac112e4), W64LIT(0x4030a24aa0f29e2f), W64LIT(0xfd8818ce179db254),
+        W64LIT(0x3c1103d066305184), W64LIT(0x682ea021e4d20bd7), W64LIT(0x81a9b954d15f7dff), W64LIT(0x275dcb5fd32cc6d9),
+        W64LIT(0xfacd82b494c83b14), W64LIT(0x4433056daa50f391), W64LIT(0xe9871975358d7628), W64LIT(0xeac12428bc7a92d6),
+        W64LIT(0x1a85284f39bacbfc), W64LIT(0xf8425f299199834b), W64LIT(0x676d691573de58f6), W64LIT(0xd05c5d42d5b916b3),
+        W64LIT(0x8eea706046532ede), W64LIT(0xfb046274186e67b5), W64LIT(0x134a9bc1a1454d3c), W64LIT(0x57799eac0b15bead),
+        W64LIT(0x241bf6025adb2227), W64LIT(0x72ab886edd68c02b), W64LIT(0x9ae571db6443eaa2), W64LIT(0xc050fbdefd0bbf71),
+        W64LIT(0xa5b24f568b845fd8), W64LIT(0xe84ef9b5b92b2a89), W64LIT(0x6f6b3a5b67878297), W64LIT(0xc6dc8164f2f86a90),
+        W64LIT(0x7eae7c07c39377f4), W64LIT(0x5eb62d2293ea386d), W64LIT(0x8c65adfd43029681), W64LIT(0x2dd4458cc224a4e7),
+        W64LIT(0xfece25939e6a56aa), W64LIT(0xcd9cef776f56540f), W64LIT(0xa33e35ec84778a39), W64LIT(0xc2df2643f85a072e),
+        W64LIT(0xbc715a443bc970da), W64LIT(0xa07808b10d806ec7), W64LIT(0x36988d03773833ba), W64LIT(0x1680dc2627417c23),
+        W64LIT(0xcb1095cd60a581ee), W64LIT(0xbdb8ba84b76f2c7b), W64LIT(0x702455f3d8397874), W64LIT(0x35deb05efecfd744),
+        W64LIT(0x8f2390a0caf5727f), W64LIT(0xb1bd4eeda9949ba4), W64LIT(0x39db4437e034609b), W64LIT(0xe582ed1c2b76c1f7),
+        W64LIT(0xc4535cf9f7a9d2cf), W64LIT(0xb2fb73b020637f5a), W64LIT(0x583a57989c19ed8c), W64LIT(0x25d216c2d67d7e86),
+        W64LIT(0x0806534e1459da61), W64LIT(0x6b689d7c6d25ef29), W64LIT(0x0dcc14a9925deb7e), W64LIT(0xc99f485065f439b1),
+        W64LIT(0xa9b7bb3f957fe807), W64LIT(0x2a91dff641712da7), W64LIT(0x1c0952f536491e1d), W64LIT(0x75ee12145e3d496b),
+        W64LIT(0xf98bbfe91d3fdfea), W64LIT(0x92e32295701a30c3), W64LIT(0x3e9ede4d6361e9db), W64LIT(0x76a82f49d7caad95),
+        W64LIT(0x9da0eba1e71663e2), W64LIT(0x09cfb38e98ff86c0), W64LIT(0x9c690b616bb03f43), W64LIT(0xdad5d391c4b1748d),
+        W64LIT(0x3812a4f76c923c3a), W64LIT(0x5f7fcde21f4c64cc), W64LIT(0x6aa17dbce183b388), W64LIT(0xeec2830fb6d8ff68),
+        W64LIT(0x736268ae51ce9c8a), W64LIT(0xa47baf9607220379), W64LIT(0x543fa3f182e25a53), W64LIT(0x4eba8bbebb5891af),
+        W64LIT(0x2e9278d14bd34019), W64LIT(0x69e740e168745776), W64LIT(0x37516dc3fb9e6f1b), W64LIT(0xb3329370acc523fb),
+        W64LIT(0x3a9d796a69c38465), W64LIT(0x7761cf895b6cf134), W64LIT(0x0000000000000000), W64LIT(0x88660ada49a0fb3f),
+        W64LIT(0xb5bee9caa336f61a), W64LIT(0x5b7c6ac515ee0972), W64LIT(0x52b3d94b8d118fb2), W64LIT(0x329b2a247d9a5e04),
+        W64LIT(0x0e8a29f41baa0f80), W64LIT(0x642b5448fa29bc08), W64LIT(0x7b643be0459746eb), W64LIT(0xd45ffa65df1b7b0d),
+        W64LIT(0xeb08c4e830dcce77), W64LIT(0xf2cbd1fa8091e175), W64LIT(0xf302313a0c37bdd4), W64LIT(0x91a51fc8f9edd43d),
+        W64LIT(0xef0b63cf3a7ea3c9), W64LIT(0xc316c68374fc5b8f), W64LIT(0x01c9e0c08ca65ca1), W64LIT(0x3417509e72698be5),
+        W64LIT(0x4775383023a7176f), W64LIT(0x636ece32797c3548), W64LIT(0x1b4cc88fb51c975d), W64LIT(0x140f01bb2210c47c),
+        W64LIT(0x7427f2d4d29b15ca), W64LIT(0xa73d92cb8ed5e787), W64LIT(0xc71561a47e5e3631), W64LIT(0xaaf186621c880cf9),
+        W64LIT(0x6028f36ff08bd1b6), W64LIT(0x97296572f61e01dc), W64LIT(0xc59abc397b0f8e6e), W64LIT(0xec4d5e92b3894737),
+        W64LIT(0xb872fd63316b1d64), W64LIT(0xaf3bc1859a8c3de6), W64LIT(0x0403a7270aa26dbe), W64LIT(0x26942b9f5f8a9a78),
+        W64LIT(0x86ec232e520af4bf), W64LIT(0x49ff11c4380d18ef), W64LIT(0xf701961d0695d06a), W64LIT(0x56b07e6c87b3e20c),
+        W64LIT(0xd5961aa553bd27ac), W64LIT(0x61e113af7c2d8d17), W64LIT(0x100ca69c28b2a9c2), W64LIT(0xcf1332ea6a07ec50),
+        W64LIT(0xc856a890e9526510), W64LIT(0x2b583f36cdd77106), W64LIT(0x932ac255fcbc6c62), W64LIT(0x0b406e139dae3e9f),
+        W64LIT(0x832664c9d40ec5a0), W64LIT(0x3014f7b978cbe65b), W64LIT(0x2c1da54c4e82f846), W64LIT(0x986aac46611252fd)
+    },
+    {
+        W64LIT(0x679cc74f352b557f), W64LIT(0x376719b23e9424bf), W64LIT(0xcc14a9925deb7e0d), W64LIT(0xb07e6c87b3e20c56),
+        W64LIT(0xa17dbce183b3886a), W64LIT(0xee12145e3d496b75), W64LIT(0x406e139dae3e9f0b), W64LIT(0x942b9f5f8a9a7826),
+        W64LIT(0xb24f568b845fd8a5), W64LIT(0xdf2643f85a072ec2), W64LIT(0x8c7aba0ff3d5e106), W64LIT(0x0b63cf3a7ea3c9ef),
+        W64LIT(0x12a4f76c923c3a38), W64LIT(0x8bbfe91d3fdfeaf9), W64LIT(0x9278d14bd340192e), W64LIT(0xca47e78604311f05),
+        W64LIT(0x07c55312cc0a0bff), W64LIT(0xcfb38e98ff86c009), W64LIT(0x991b1e71ade3d0c1), W64LIT(0x16c68374fc5b8fc3),
+        W64LIT(0x39f0bf96bb80325c), W64LIT(0x3d92cb8ed5e787a7), W64LIT(0xac4d3dcfa4ca208d), W64LIT(0xfae5ad26f6af3045),
+        W64LIT(0x63feb3575b4ce084), W64LIT(0x28f36ff08bd1b660), W64LIT(0xc6e17baeb698dd15), W64LIT(0x84be523f2f1b96ed),
+        W64LIT(0x3c04d6884037ed50), W64LIT(0xce25939e6a56aafe), W64LIT(0xa34c86edb40e5c99), W64LIT(0xebe67d40c6feb479),
+        W64LIT(0x27f2d4d29b15ca74), W64LIT(0x6d691573de58f667), W64LIT(0x329370acc523fbb3), W64LIT(0x2c911be8e5b6039b),
+        W64LIT(0x871975358d7628e9), W64LIT(0x550fb7e3f008aecc), W64LIT(0x7e5bff19d9b4a6a8), W64LIT(0xf8d4972ac112e4b6),
+        W64LIT(0xd1b1e5dcdf133821), W64LIT(0xfcb6e332af75514d), W64LIT(0x1e026b442095f828), W64LIT(0x1f947642b54592df),
+        W64LIT(0x5e6c78d98eab6723), W64LIT(0x17509e72698be534), W64LIT(0x2ac255fcbc6c6293), W64LIT(0x95bd82591f4a12d1),
+        W64LIT(0x799eac0b15bead57), W64LIT(0xf0107f1a1ddc935d), W64LIT(0xd674b6ce131933de), W64LIT(0xf5e41604e66b4c51),
+        W64LIT(0x8818ce179db254fd), W64LIT(0x03a7270aa26dbe04), W64LIT(0x1c33514817282cdb), W64LIT(0x2f363ce247dbbd9f),
+        W64LIT(0xa72ef2f5da69e962), W64LIT(0x93eecc4d469073d9), W64LIT(0xb92c99b1fafc114a), W64LIT(0x77090a2f90aabbb4),
+        W64LIT(0x0ca69c28b2a9c210), W64LIT(0xc9e0c08ca65ca101), W64LIT(0x4b0ddca7d09d56e4), W64LIT(0x988d03773833ba36),
+        W64LIT(0x06534e1459da6108), W64LIT(0x3a57989c19ed8c58), W64LIT(0x0952f536491e1d1c), W64LIT(0x0af5d23ceb73a318),
+        W64LIT(0x0d30812e2779a8e7), W64LIT(0xd7e2abc886c95929), W64LIT(0xa51fc8f9edd43d91), W64LIT(0x690b616bb03f439c),
+        W64LIT(0x516dc3fb9e6f1b37), W64LIT(0xa489d5ff78045766), W64LIT(0x52cae4f13c02a533), W64LIT(0x4cc88fb51c975d1b),
+        W64LIT(0x459a7a8355894007), W64LIT(0x9d796a69c384653a), W64LIT(0x313457a6674e45b7), W64LIT(0x4a9bc1a1454d3c13),
+        W64LIT(0x6268ae51ce9c8a73), W64LIT(0xfe87d93e98c885be), W64LIT(0xff11c4380d18ef49), W64LIT(0x8deca70966058bf1),
+        W64LIT(0xdeb05efecfd74435), W64LIT(0xd027f8da4ac352d6), W64LIT(0xf186621c880cf9aa), W64LIT(0x43c934970c53210f),
+        W64LIT(0xbee9caa336f61ab5), W64LIT(0x56a890e9526510c8), W64LIT(0xe8415a4a64930a7d), W64LIT(0xe32295701a30c392),
+        W64LIT(0x3e35ec84778a39a3), W64LIT(0x4f6fa8bfbefae31f), W64LIT(0x5dcb5fd32cc6d927), W64LIT(0x9f485065f439b1c9),
+        W64LIT(0x1095cd60a581eecb), W64LIT(0x978cb85528f7c622), W64LIT(0x7baf9607220379a4), W64LIT(0xd216c2d67d7e8625),
+        W64LIT(0xe4e7c662d63ac86d), W64LIT(0xb62d2293ea386d5e), W64LIT(0x8a29f41baa0f800e), W64LIT(0x5ffa65df1b7b0dd4),
+        W64LIT(0x61cf895b6cf13477), W64LIT(0xa6b8eff34fb98395), W64LIT(0x814a3b21d4ac49e1), W64LIT(0xaddb20c9311a4a7a),
+        W64LIT(0x74ae2d2532c705b0), W64LIT(0x30a24aa0f29e2f40), W64LIT(0x91dff641712da72a), W64LIT(0x9049eb47e4fdcddd),
+        W64LIT(0x493ce6abe7208217), W64LIT(0x36f104b4ab444e48), W64LIT(0xf22145162a6147ae), W64LIT(0x5c5d42d5b916b3d0),
+        W64LIT(0xf7d52c08d1d698a2), W64LIT(0x7a398b01b7d31353), W64LIT(0x6cff08754b889c90), W64LIT(0x14f7b978cbe65b30),
+        W64LIT(0xc4d041a2812509e6), W64LIT(0xe085b27ab85d7d96), W64LIT(0xc0b235baef42bc1d), W64LIT(0x868f683318a6421e),
+        W64LIT(0xea706046532ede8e), W64LIT(0x4ef9b5b92b2a89e8), W64LIT(0xdc8164f2f86a90c6), W64LIT(0x2455f3d839787470),
+        W64LIT(0x5499aae565d8c43b), W64LIT(0x59a92bcb42a16cdc), W64LIT(0xa9b954d15f7dff81), W64LIT(0xae7c07c39377f47e),
+        W64LIT(0x01961d0695d06af7), W64LIT(0xdb4437e034609b39), W64LIT(0x3bc1859a8c3de6af), W64LIT(0xaa1e73dbfd104185),
+        W64LIT(0x7dfcd8137bd918ac), W64LIT(0x80dc2627417c2316), W64LIT(0xd9750dec03dd4fca), W64LIT(0xc5465ca414f56311),
+        W64LIT(0x203787c0571fc18b), W64LIT(0xd5d391c4b1748dda), W64LIT(0xc2830fb6d8ff68ee), W64LIT(0xbcd8f0af014bce46),
+        W64LIT(0xa0eba1e71663e29d), W64LIT(0xfb73b020637f5ab2), W64LIT(0x7c6ac515ee09725b), W64LIT(0x0000000000000000),
+        W64LIT(0xc876dd8a338ccbf6), W64LIT(0x9cef776f56540fcd), W64LIT(0x47ab408f623494f4), W64LIT(0xcbd1fa8091e175f2),
+        W64LIT(0x9abc397b0f8e6ec5), W64LIT(0xb58a05994855d35a), W64LIT(0x4d5e92b3894737ec), W64LIT(0x961aa553bd27acd5),
+        W64LIT(0xc31512b04d2f0219), W64LIT(0xe6d6fc6ee1871c9e), W64LIT(0xe2b488768fe0a965), W64LIT(0xb3d94b8d118fb252),
+        W64LIT(0x440c6785c0592af0), W64LIT(0x25c3eedeaca81e87), W64LIT(0x583f36cdd771062b), W64LIT(0x2d0706ee7066696c),
+        W64LIT(0x425f299199834bf8), W64LIT(0xfd20fe343aa53bba), W64LIT(0xf643310e4406f255), W64LIT(0xdad22ae6a1b0f1ce),
+        W64LIT(0x1da54c4e82f8462c), W64LIT(0x355623be0929f04c), W64LIT(0x769f1729057ad143), W64LIT(0xbd4eeda9949ba4b1),
+        W64LIT(0xd8e310ea960d253d), W64LIT(0x736b7e37fecd0e4f), W64LIT(0x65adfd430296818c), W64LIT(0xb8ba84b76f2c7bbd),
+        W64LIT(0x9b2a247d9a5e0432), W64LIT(0xc77766a82348b7e2), W64LIT(0x08c4e830dcce77eb), W64LIT(0x0e97a624851416e3),
+        W64LIT(0x898ed31108623e0a), W64LIT(0xe571db6443eaa29a), W64LIT(0x573e8defc7b57a3f), W64LIT(0x21a19ac6c2cfab7c),
+        W64LIT(0x70cc593d5ca0b04b), W64LIT(0x2664c9d40ec5a083), W64LIT(0x296572f61e01dc97), W64LIT(0x85284f39bacbfc1a),
+        W64LIT(0x715a443bc970dabc), W64LIT(0xef840958a8990182), W64LIT(0xcd82b494c83b14fa), W64LIT(0x48aafbad72f0e8e0),
+        W64LIT(0xe9d7474cf143608a), W64LIT(0x2390a0caf5727f8f), W64LIT(0xb7bb3f957fe807a9), W64LIT(0x82ed1c2b76c1f7e5),
+        W64LIT(0xbb1da3bdcd41c5b9), W64LIT(0x72fd63316b1d64b8), W64LIT(0x7808b10d806ec7a0), W64LIT(0x837b012de3119d12),
+        W64LIT(0x689d7c6d25ef296b), W64LIT(0x02313a0c37bdd4f3), W64LIT(0x1103d0663051843c), W64LIT(0xab886edd68c02b72),
+        W64LIT(0x6b3a5b678782976f), W64LIT(0xe113af7c2d8d1761), W64LIT(0x6aac46611252fd98), W64LIT(0x50fbdefd0bbf71c0),
+        W64LIT(0x2ea021e4d20bd768), W64LIT(0x5a0e0cc1e0ccd2d8), W64LIT(0x34c03eb89cf99abb), W64LIT(0xb41c189fdd85b9ad),
+        W64LIT(0x9ede4d6361e9db3e), W64LIT(0xafea1ac506a79e89), W64LIT(0x463d5d89f7e4fe03), W64LIT(0x18512550794f9920),
+        W64LIT(0x41f80e9b3beef5fc), W64LIT(0xa82f49d7caad9576), W64LIT(0x0f01bb2210c47c14), W64LIT(0xec232e520af4bf86),
+        W64LIT(0x1bf6025adb222724), W64LIT(0xa2da9beb21de366e), W64LIT(0xedb533549f24d571), W64LIT(0x643be0459746eb7b),
+        W64LIT(0xbf7fd7a5a3267042), W64LIT(0x046274186e67b5fb), W64LIT(0x8e4b8003c46835f5), W64LIT(0x1332ea6a07ec50cf),
+        W64LIT(0xd380dfd0e8aeecd2), W64LIT(0x6f582f7fe9e52294), W64LIT(0xf9428a2c54c28e41), W64LIT(0x3fa3f182e25a5354),
+        W64LIT(0x535cf9f7a9d2cfc4), W64LIT(0x660ada49a0fb3f88), W64LIT(0x33056daa50f39144), W64LIT(0x8fdd9d0551b85f02),
+        W64LIT(0x19c73856ec9ff3d7), W64LIT(0xb1e87181263266a1), W64LIT(0x1561a47e5e3631c7), W64LIT(0xd4458cc224a4e72d),
+        W64LIT(0xe740e16874577669), W64LIT(0xc12428bc7a92d6ea), W64LIT(0x3866a2902e5058ab), W64LIT(0x1a601f5c4ef24dd3),
+        W64LIT(0x6059945df9215e80), W64LIT(0x05f4691efbb7df0c), W64LIT(0x5b9811c7751cb82f), W64LIT(0x2b5448fa29bc0864),
+        W64LIT(0xba8bbebb5891af4e), W64LIT(0xf4720b0273bb26a6), W64LIT(0xdd1779f46dbafa31), W64LIT(0x6ece32797c354863),
+        W64LIT(0x7fcde21f4c64cc5f), W64LIT(0x2206bdcc60a21578), W64LIT(0x75383023a7176f47), W64LIT(0xf3b75810bfb12d59)
+    },
+    {
+        W64LIT(0x03d0663051843c11), W64LIT(0xbfe91d3fdfeaf98b), W64LIT(0xf80e9b3beef5fc41), W64LIT(0xe5ad26f6af3045fa),
+        W64LIT(0x5a443bc970dabc71), W64LIT(0x7b012de3119d1283), W64LIT(0x82b494c83b14facd), W64LIT(0x750dec03dd4fcad9),
+        W64LIT(0x090a2f90aabbb477), W64LIT(0xb6e332af75514dfc), W64LIT(0xadfd430296818c65), W64LIT(0xfd63316b1d64b872),
+        W64LIT(0x3d5d89f7e4fe0346), W64LIT(0xd7474cf143608ae9), W64LIT(0x7e6c87b3e20c56b0), W64LIT(0x601f5c4ef24dd31a),
+        W64LIT(0x40e16874577669e7), W64LIT(0x4437e034609b39db), W64LIT(0xe7c662d63ac86de4), W64LIT(0xaf9607220379a47b),
+        W64LIT(0xea1ac506a79e89af), W64LIT(0xd8f0af014bce46bc), W64LIT(0x7fd7a5a3267042bf), W64LIT(0x9f1729057ad14376),
+        W64LIT(0x1c189fdd85b9adb4), W64LIT(0x87d93e98c885befe), W64LIT(0x57989c19ed8c583a), W64LIT(0xa4f76c923c3a3812),
+        W64LIT(0x2a247d9a5e04329b), W64LIT(0xc03eb89cf99abb34), W64LIT(0xf6025adb2227241b), W64LIT(0xa890e9526510c856),
+        W64LIT(0x06bdcc60a2157822), W64LIT(0xc73856ec9ff3d719), W64LIT(0xcae4f13c02a53352), W64LIT(0xd6fc6ee1871c9ee6),
+        W64LIT(0xf0bf96bb80325c39), W64LIT(0x13af7c2d8d1761e1), W64LIT(0x3be0459746eb7b64), W64LIT(0x99aae565d8c43b54),
+        W64LIT(0x95cd60a581eecb10), W64LIT(0x68ae51ce9c8a7362), W64LIT(0xcde21f4c64cc5f7f), W64LIT(0xdc2627417c231680),
+        W64LIT(0x428a2c54c28e41f9), W64LIT(0x76dd8a338ccbf6c8), W64LIT(0xb8eff34fb98395a6), W64LIT(0xa69c28b2a9c2100c),
+        W64LIT(0x08b10d806ec7a078), W64LIT(0xc55312cc0a0bff07), W64LIT(0x886edd68c02b72ab), W64LIT(0xdd9d0551b85f028f),
+        W64LIT(0x1e73dbfd104185aa), W64LIT(0x911be8e5b6039b2c), W64LIT(0x30812e2779a8e70d), W64LIT(0x3a5b678782976f6b),
+        W64LIT(0x20fe343aa53bbafd), W64LIT(0xb954d15f7dff81a9), W64LIT(0x9a7a835589400745), W64LIT(0x1fc8f9edd43d91a5),
+        W64LIT(0x0e0cc1e0ccd2d85a), W64LIT(0xbb3f957fe807a9b7), W64LIT(0xc3eedeaca81e8725), W64LIT(0x66a2902e5058ab38),
+        W64LIT(0xff08754b889c906c), W64LIT(0xfeb3575b4ce08463), W64LIT(0x107f1a1ddc935df0), W64LIT(0x25939e6a56aafece),
+        W64LIT(0xa92bcb42a16cdc59), W64LIT(0x32ea6a07ec50cf13), W64LIT(0x947642b54592df1f), W64LIT(0x1779f46dbafa31dd),
+        W64LIT(0x5623be0929f04c35), W64LIT(0xf2d4d29b15ca7427), W64LIT(0x59945df9215e8060), W64LIT(0x9370acc523fbb332),
+        W64LIT(0xb05efecfd74435de), W64LIT(0x71db6443eaa29ae5), W64LIT(0xe2abc886c95929d7), W64LIT(0x458cc224a4e72dd4),
+        W64LIT(0xce32797c3548636e), W64LIT(0x1aa553bd27acd596), W64LIT(0x4a3b21d4ac49e181), W64LIT(0x284f39bacbfc1a85),
+        W64LIT(0xd94b8d118fb252b3), W64LIT(0xb235baef42bc1dc0), W64LIT(0x2643f85a072ec2df), W64LIT(0x8bbebb5891af4eba),
+        W64LIT(0x89d5ff78045766a4), W64LIT(0xeecc4d469073d993), W64LIT(0x0b616bb03f439c69), W64LIT(0xe41604e66b4c51f5),
+        W64LIT(0x16c2d67d7e8625d2), W64LIT(0x6c78d98eab67235e), W64LIT(0x9d7c6d25ef296b68), W64LIT(0x64c9d40ec5a08326),
+        W64LIT(0x2ef2f5da69e962a7), W64LIT(0xfa65df1b7b0dd45f), W64LIT(0x12145e3d496b75ee), W64LIT(0xfcd8137bd918ac7d),
+        W64LIT(0x52f536491e1d1c09), W64LIT(0xe67d40c6feb479eb), W64LIT(0x2145162a6147aef2), W64LIT(0x29f41baa0f800e8a),
+        W64LIT(0x0000000000000000), W64LIT(0x840958a8990182ef), W64LIT(0xc88fb51c975d1b4c), W64LIT(0xc68374fc5b8fc316),
+        W64LIT(0x5d42d5b916b3d05c), W64LIT(0x7dbce183b3886aa1), W64LIT(0x512550794f992018), W64LIT(0xe17baeb698dd15c6),
+        W64LIT(0x43310e4406f255f6), W64LIT(0x6dc3fb9e6f1b3751), W64LIT(0x86621c880cf9aaf1), W64LIT(0xbc397b0f8e6ec59a),
+        W64LIT(0x415a4a64930a7de8), W64LIT(0x04d6884037ed503c), W64LIT(0xe9caa336f61ab5be), W64LIT(0x0ada49a0fb3f8866),
+        W64LIT(0x55f3d83978747024), W64LIT(0x3ce6abe720821749), W64LIT(0xf5d23ceb73a3180a), W64LIT(0xa24aa0f29e2f4030),
+        W64LIT(0x582f7fe9e522946f), W64LIT(0x7aba0ff3d5e1068c), W64LIT(0x313a0c37bdd4f302), W64LIT(0x3787c0571fc18b20),
+        W64LIT(0x5cf9f7a9d2cfc453), W64LIT(0xbe523f2f1b96ed84), W64LIT(0x85b27ab85d7d96e0), W64LIT(0x0706ee7066696c2d),
+        W64LIT(0x961d0695d06af701), W64LIT(0x1b1e71ade3d0c199), W64LIT(0xc255fcbc6c62932a), W64LIT(0x398b01b7d313537a),
+        W64LIT(0xcc593d5ca0b04b70), W64LIT(0x5f299199834bf842), W64LIT(0x80dfd0e8aeecd2d3), W64LIT(0x9eac0b15bead5779),
+        W64LIT(0xef776f56540fcd9c), W64LIT(0x2f49d7caad9576a8), W64LIT(0x2c99b1fafc114ab9), W64LIT(0x8d03773833ba3698),
+        W64LIT(0x720b0273bb26a6f4), W64LIT(0x18ce179db254fd88), W64LIT(0x8f683318a6421e86), W64LIT(0x4f568b845fd8a5b2),
+        W64LIT(0x8ed31108623e0a89), W64LIT(0xd22ae6a1b0f1ceda), W64LIT(0x74b6ce131933ded6), W64LIT(0x97a624851416e30e),
+        W64LIT(0x6e139dae3e9f0b40), W64LIT(0xa7270aa26dbe0403), W64LIT(0x5448fa29bc08642b), W64LIT(0xe310ea960d253dd8),
+        W64LIT(0x706046532ede8eea), W64LIT(0x485065f439b1c99f), W64LIT(0x6b7e37fecd0e4f73), W64LIT(0xfbdefd0bbf71c050),
+        W64LIT(0xd391c4b1748ddad5), W64LIT(0xa021e4d20bd7682e), W64LIT(0xab408f623494f447), W64LIT(0x5bff19d9b4a6a87e),
+        W64LIT(0xb1e5dcdf133821d1), W64LIT(0x026b442095f8281e), W64LIT(0xdff641712da72a91), W64LIT(0x11c4380d18ef49ff),
+        W64LIT(0xae2d2532c705b074), W64LIT(0xc1859a8c3de6af3b), W64LIT(0x4b8003c46835f58e), W64LIT(0x92cb8ed5e787a73d),
+        W64LIT(0xcb5fd32cc6d9275d), W64LIT(0x8cb85528f7c62297), W64LIT(0x9bc1a1454d3c134a), W64LIT(0x056daa50f3914433),
+        W64LIT(0xf4691efbb7df0c05), W64LIT(0xd1fa8091e175f2cb), W64LIT(0x7c07c39377f47eae), W64LIT(0x14a9925deb7e0dcc),
+        W64LIT(0xcf895b6cf1347761), W64LIT(0x0fb7e3f008aecc55), W64LIT(0x8a05994855d35ab5), W64LIT(0xf104b4ab444e4836),
+        W64LIT(0x691573de58f6676d), W64LIT(0x4eeda9949ba4b1bd), W64LIT(0x2428bc7a92d6eac1), W64LIT(0xb75810bfb12d59f3),
+        W64LIT(0x63cf3a7ea3c9ef0b), W64LIT(0x6274186e67b5fb04), W64LIT(0x1512b04d2f0219c3), W64LIT(0xe87181263266a1b1),
+        W64LIT(0x1975358d7628e987), W64LIT(0x534e1459da610806), W64LIT(0x47e78604311f05ca), W64LIT(0xd4972ac112e4b6f8),
+        W64LIT(0x33514817282cdb1c), W64LIT(0x90a0caf5727f8f23), W64LIT(0x3e8defc7b57a3f57), W64LIT(0x3f36cdd771062b58),
+        W64LIT(0x796a69c384653a9d), W64LIT(0x465ca414f56311c5), W64LIT(0x5e92b3894737ec4d), W64LIT(0x9811c7751cb82f5b),
+        W64LIT(0xd041a2812509e6c4), W64LIT(0x49eb47e4fdcddd90), W64LIT(0x78d14bd340192e92), W64LIT(0xf9b5b92b2a89e84e),
+        W64LIT(0x61a47e5e3631c715), W64LIT(0x509e72698be53417), W64LIT(0xb533549f24d571ed), W64LIT(0x27f8da4ac352d6d0),
+        W64LIT(0x6572f61e01dc9729), W64LIT(0xde4d6361e9db3e9e), W64LIT(0x3457a6674e45b731), W64LIT(0xa54c4e82f8462c1d),
+        W64LIT(0xbd82591f4a12d195), W64LIT(0x830fb6d8ff68eec2), W64LIT(0x383023a7176f4775), W64LIT(0x7766a82348b7e2c7),
+        W64LIT(0x0c6785c0592af044), W64LIT(0xba84b76f2c7bbdb8), W64LIT(0xe0c08ca65ca101c9), W64LIT(0xeba1e71663e29da0),
+        W64LIT(0xd52c08d1d698a2f7), W64LIT(0xc4e830dcce77eb08), W64LIT(0xda9beb21de366ea2), W64LIT(0xa3f182e25a53543f),
+        W64LIT(0xac46611252fd986a), W64LIT(0xb38e98ff86c009cf), W64LIT(0xf36ff08bd1b66028), W64LIT(0xdb20c9311a4a7aad),
+        W64LIT(0xa19ac6c2cfab7c21), W64LIT(0x6ac515ee09725b7c), W64LIT(0x4c86edb40e5c99a3), W64LIT(0x363ce247dbbd9f2f),
+        W64LIT(0x8164f2f86a90c6dc), W64LIT(0x35ec84778a39a33e), W64LIT(0xb488768fe0a965e2), W64LIT(0x73b020637f5ab2fb),
+        W64LIT(0x232e520af4bf86ec), W64LIT(0x6fa8bfbefae31f4f), W64LIT(0xeca70966058bf18d), W64LIT(0x1da3bdcd41c5b9bb),
+        W64LIT(0x9cc74f352b557f67), W64LIT(0x4d3dcfa4ca208dac), W64LIT(0x2b9f5f8a9a782694), W64LIT(0xaafbad72f0e8e048),
+        W64LIT(0xc934970c53210f43), W64LIT(0xed1c2b76c1f7e582), W64LIT(0x01bb2210c47c140f), W64LIT(0x0ddca7d09d56e44b),
+        W64LIT(0x2d2293ea386d5eb6), W64LIT(0xf7b978cbe65b3014), W64LIT(0x6719b23e9424bf37), W64LIT(0x2295701a30c392e3)
+    },
+    {
+        W64LIT(0x9f5f8a9a7826942b), W64LIT(0x34970c53210f43c9), W64LIT(0x9d0551b85f028fdd), W64LIT(0xb494c83b14facd82),
+        W64LIT(0x6edd68c02b72ab88), W64LIT(0xff19d9b4a6a87e5b), W64LIT(0xdb6443eaa29ae571), W64LIT(0x1be8e5b6039b2c91),
+        W64LIT(0x5fd32cc6d9275dcb), W64LIT(0x90e9526510c856a8), W64LIT(0xb27ab85d7d96e085), W64LIT(0xa47e5e3631c71561),
+        W64LIT(0xf3d8397874702455), W64LIT(0xfbad72f0e8e048aa), W64LIT(0x37e034609b39db44), W64LIT(0xfa8091e175f2cbd1),
+        W64LIT(0xcaa336f61ab5bee9), W64LIT(0xeff34fb98395a6b8), W64LIT(0x63316b1d64b872fd), W64LIT(0xba0ff3d5e1068c7a),
+        W64LIT(0xcd60a581eecb1095), W64LIT(0x35baef42bc1dc0b2), W64LIT(0x23be0929f04c3556), W64LIT(0x4b8d118fb252b3d9),
+        W64LIT(0xd8137bd918ac7dfc), W64LIT(0x0a2f90aabbb47709), W64LIT(0xc2d67d7e8625d216), W64LIT(0x7181263266a1b1e8),
+        W64LIT(0x3023a7176f477538), W64LIT(0x7642b54592df1f94), W64LIT(0xf2f5da69e962a72e), W64LIT(0xa70966058bf18dec),
+        W64LIT(0xc662d63ac86de4e7), W64LIT(0x939e6a56aafece25), W64LIT(0x86edb40e5c99a34c), W64LIT(0xf8da4ac352d6d027),
+        W64LIT(0x145e3d496b75ee12), W64LIT(0xce179db254fd8818), W64LIT(0xd23ceb73a3180af5), W64LIT(0x270aa26dbe0403a7),
+        W64LIT(0x5d89f7e4fe03463d), W64LIT(0x2ae6a1b0f1cedad2), W64LIT(0x1729057ad143769f), W64LIT(0xb10d806ec7a07808),
+        W64LIT(0x4f39bacbfc1a8528), W64LIT(0xeda9949ba4b1bd4e), W64LIT(0x5312cc0a0bff07c5), W64LIT(0xc4380d18ef49ff11),
+        W64LIT(0x95701a30c392e322), W64LIT(0xa0caf5727f8f2390), W64LIT(0x55fcbc6c62932ac2), W64LIT(0xcf3a7ea3c9ef0b63),
+        W64LIT(0x621c880cf9aaf186), W64LIT(0xfd430296818c65ad), W64LIT(0xbf96bb80325c39f0), W64LIT(0x6c87b3e20c56b07e),
+        W64LIT(0x299199834bf8425f), W64LIT(0x74186e67b5fb0462), W64LIT(0x4c4e82f8462c1da5), W64LIT(0x64f2f86a90c6dc81),
+        W64LIT(0x6b442095f8281e02), W64LIT(0x1d0695d06af70196), W64LIT(0xd5ff78045766a489), W64LIT(0x3856ec9ff3d719c7),
+        W64LIT(0xac0b15bead57799e), W64LIT(0xc3fb9e6f1b37516d), W64LIT(0x8e98ff86c009cfb3), W64LIT(0x49d7caad9576a82f),
+        W64LIT(0x859a8c3de6af3bc1), W64LIT(0x3dcfa4ca208dac4d), W64LIT(0x91c4b1748ddad5d3), W64LIT(0x8a2c54c28e41f942),
+        W64LIT(0x2bcb42a16cdc59a9), W64LIT(0x9e72698be5341750), W64LIT(0x1e71ade3d0c1991b), W64LIT(0xe6abe7208217493c),
+        W64LIT(0x3a0c37bdd4f30231), W64LIT(0x945df9215e806059), W64LIT(0xcc4d469073d993ee), W64LIT(0x0e9b3beef5fc41f8),
+        W64LIT(0x8b01b7d313537a39), W64LIT(0xf182e25a53543fa3), W64LIT(0x5810bfb12d59f3b7), W64LIT(0x8003c46835f58e4b),
+        W64LIT(0xbce183b3886aa17d), W64LIT(0x1604e66b4c51f5e4), W64LIT(0x2c08d1d698a2f7d5), W64LIT(0xc08ca65ca101c9e0),
+        W64LIT(0x7a8355894007459a), W64LIT(0xe21f4c64cc5f7fcd), W64LIT(0x88768fe0a965e2b4), W64LIT(0x82591f4a12d195bd),
+        W64LIT(0x4aa0f29e2f4030a2), W64LIT(0xdca7d09d56e44b0d), W64LIT(0x6daa50f391443305), W64LIT(0x92b3894737ec4d5e),
+        W64LIT(0xa8bfbefae31f4f6f), W64LIT(0xea6a07ec50cf1332), W64LIT(0x2293ea386d5eb62d), W64LIT(0x41a2812509e6c4d0),
+        W64LIT(0x8374fc5b8fc316c6), W64LIT(0x683318a6421e868f), W64LIT(0xb3575b4ce08463fe), W64LIT(0xe5dcdf133821d1b1),
+        W64LIT(0xd6884037ed503c04), W64LIT(0x05994855d35ab58a), W64LIT(0x5b678782976f6b3a), W64LIT(0x397b0f8e6ec59abc),
+        W64LIT(0xabc886c95929d7e2), W64LIT(0xe4f13c02a53352ca), W64LIT(0xb5b92b2a89e84ef9), W64LIT(0xaf7c2d8d1761e113),
+        W64LIT(0x75358d7628e98719), W64LIT(0x72f61e01dc972965), W64LIT(0x78d98eab67235e6c), W64LIT(0xc8f9edd43d91a51f),
+        W64LIT(0x0fb6d8ff68eec283), W64LIT(0x70acc523fbb33293), W64LIT(0x36cdd771062b583f), W64LIT(0xbdcc60a215782206),
+        W64LIT(0xa624851416e30e97), W64LIT(0x9607220379a47baf), W64LIT(0x1c2b76c1f7e582ed), W64LIT(0x6046532ede8eea70),
+        W64LIT(0xbebb5891af4eba8b), W64LIT(0x48fa29bc08642b54), W64LIT(0x19b23e9424bf3767), W64LIT(0x2627417c231680dc),
+        W64LIT(0x65df1b7b0dd45ffa), W64LIT(0xf536491e1d1c0952), W64LIT(0x54d15f7dff81a9b9), W64LIT(0x2550794f99201851),
+        W64LIT(0xdefd0bbf71c050fb), W64LIT(0x87c0571fc18b2037), W64LIT(0x10ea960d253dd8e3), W64LIT(0xe0459746eb7b643b),
+        W64LIT(0x12b04d2f0219c315), W64LIT(0xaae565d8c43b5499), W64LIT(0xe91d3fdfeaf98bbf), W64LIT(0xf76c923c3a3812a4),
+        W64LIT(0x1f5c4ef24dd31a60), W64LIT(0x812e2779a8e70d30), W64LIT(0xf41baa0f800e8a29), W64LIT(0xfc6ee1871c9ee6d6),
+        W64LIT(0x8fb51c975d1b4cc8), W64LIT(0x4e1459da61080653), W64LIT(0x310e4406f255f643), W64LIT(0x0cc1e0ccd2d85a0e),
+        W64LIT(0x0958a8990182ef84), W64LIT(0xa9925deb7e0dcc14), W64LIT(0x6a69c384653a9d79), W64LIT(0x04b4ab444e4836f1),
+        W64LIT(0x0dec03dd4fcad975), W64LIT(0xeb47e4fdcddd9049), W64LIT(0x7e37fecd0e4f736b), W64LIT(0x73dbfd104185aa1e),
+        W64LIT(0xc515ee09725b7c6a), W64LIT(0xae51ce9c8a736268), W64LIT(0xa3bdcd41c5b9bb1d), W64LIT(0x84b76f2c7bbdb8ba),
+        W64LIT(0x443bc970dabc715a), W64LIT(0xa1e71663e29da0eb), W64LIT(0x7f1a1ddc935df010), W64LIT(0x474cf143608ae9d7),
+        W64LIT(0x33549f24d571edb5), W64LIT(0xc9d40ec5a0832664), W64LIT(0x46611252fd986aac), W64LIT(0x5efecfd74435deb0),
+        W64LIT(0x0000000000000000), W64LIT(0x514817282cdb1c33), W64LIT(0x408f623494f447ab), W64LIT(0x57a6674e45b73134),
+        W64LIT(0x11c7751cb82f5b98), W64LIT(0x989c19ed8c583a57), W64LIT(0x7baeb698dd15c6e1), W64LIT(0x06ee7066696c2d07),
+        W64LIT(0xda49a0fb3f88660a), W64LIT(0x07c39377f47eae7c), W64LIT(0x2d2532c705b074ae), W64LIT(0x42d5b916b3d05c5d),
+        W64LIT(0xec84778a39a33e35), W64LIT(0x776f56540fcd9cef), W64LIT(0xa553bd27acd5961a), W64LIT(0xb978cbe65b3014f7),
+        W64LIT(0x895b6cf1347761cf), W64LIT(0xb85528f7c622978c), W64LIT(0x66a82348b7e2c777), W64LIT(0xe830dcce77eb08c4),
+        W64LIT(0x189fdd85b9adb41c), W64LIT(0x99b1fafc114ab92c), W64LIT(0x0b0273bb26a6f472), W64LIT(0xeedeaca81e8725c3),
+        W64LIT(0x6785c0592af0440c), W64LIT(0x247d9a5e04329b2a), W64LIT(0x21e4d20bd7682ea0), W64LIT(0xbb2210c47c140f01),
+        W64LIT(0x523f2f1b96ed84be), W64LIT(0xd4d29b15ca7427f2), W64LIT(0x45162a6147aef221), W64LIT(0xf641712da72a91df),
+        W64LIT(0xb020637f5ab2fb73), W64LIT(0xdd8a338ccbf6c876), W64LIT(0x5ca414f56311c546), W64LIT(0x3f957fe807a9b7bb),
+        W64LIT(0x8cc224a4e72dd445), W64LIT(0x012de3119d12837b), W64LIT(0xd0663051843c1103), W64LIT(0x5a4a64930a7de841),
+        W64LIT(0x28bc7a92d6eac124), W64LIT(0x08754b889c906cff), W64LIT(0xd7a5a3267042bf7f), W64LIT(0x3ce247dbbd9f2f36),
+        W64LIT(0x6ff08bd1b66028f3), W64LIT(0xd14bd340192e9278), W64LIT(0x139dae3e9f0b406e), W64LIT(0xe78604311f05ca47),
+        W64LIT(0xd93e98c885befe87), W64LIT(0x616bb03f439c690b), W64LIT(0x03773833ba36988d), W64LIT(0xcb8ed5e787a73d92),
+        W64LIT(0xb7e3f008aecc550f), W64LIT(0x9c28b2a9c2100ca6), W64LIT(0x3eb89cf99abb34c0), W64LIT(0x3b21d4ac49e1814a),
+        W64LIT(0xdfd0e8aeecd2d380), W64LIT(0x7c6d25ef296b689d), W64LIT(0xc1a1454d3c134a9b), W64LIT(0xf9f7a9d2cfc4535c),
+        W64LIT(0xc74f352b557f679c), W64LIT(0x7d40c6feb479ebe6), W64LIT(0x1573de58f6676d69), W64LIT(0x1ac506a79e89afea),
+        W64LIT(0x568b845fd8a5b24f), W64LIT(0x32797c3548636ece), W64LIT(0x691efbb7df0c05f4), W64LIT(0x972ac112e4b6f8d4),
+        W64LIT(0x79f46dbafa31dd17), W64LIT(0x2e520af4bf86ec23), W64LIT(0xd31108623e0a898e), W64LIT(0x8defc7b57a3f573e),
+        W64LIT(0x025adb2227241bf6), W64LIT(0xa2902e5058ab3866), W64LIT(0xfe343aa53bbafd20), W64LIT(0xad26f6af3045fae5),
+        W64LIT(0x43f85a072ec2df26), W64LIT(0x2f7fe9e522946f58), W64LIT(0x9beb21de366ea2da), W64LIT(0x20c9311a4a7aaddb),
+        W64LIT(0x5065f439b1c99f48), W64LIT(0x593d5ca0b04b70cc), W64LIT(0x9ac6c2cfab7c21a1), W64LIT(0xb6ce131933ded674),
+        W64LIT(0xf0af014bce46bcd8), W64LIT(0x4d6361e9db3e9ede), W64LIT(0xe16874577669e740), W64LIT(0xe332af75514dfcb6)
+    },
+    {
+        W64LIT(0xbfbefae31f4f6fa8), W64LIT(0x85c0592af0440c67), W64LIT(0xbaef42bc1dc0b235), W64LIT(0x5528f7c622978cb8),
+        W64LIT(0xe6a1b0f1cedad22a), W64LIT(0x3ceb73a3180af5d2), W64LIT(0x7fe9e522946f582f), W64LIT(0xa7d09d56e44b0ddc),
+        W64LIT(0x754b889c906cff08), W64LIT(0xe247dbbd9f2f363c), W64LIT(0x81263266a1b1e871), W64LIT(0xdcdf133821d1b1e5),
+        W64LIT(0xf46dbafa31dd1779), W64LIT(0x3d5ca0b04b70cc59), W64LIT(0x56ec9ff3d719c738), W64LIT(0xdeaca81e8725c3ee),
+        W64LIT(0x549f24d571edb533), W64LIT(0x2de3119d12837b01), W64LIT(0xea960d253dd8e310), W64LIT(0xc886c95929d7e2ab),
+        W64LIT(0x2f90aabbb477090a), W64LIT(0x26f6af3045fae5ad), W64LIT(0x6ee1871c9ee6d6fc), W64LIT(0x3e98c885befe87d9),
+        W64LIT(0x24851416e30e97a6), W64LIT(0xda4ac352d6d027f8), W64LIT(0xe3f008aecc550fb7), W64LIT(0x994855d35ab58a05),
+        W64LIT(0x5df9215e80605994), W64LIT(0x58a8990182ef8409), W64LIT(0xb1fafc114ab92c99), W64LIT(0x442095f8281e026b),
+        W64LIT(0xf5da69e962a72ef2), W64LIT(0xc0571fc18b203787), W64LIT(0x37fecd0e4f736b7e), W64LIT(0x902e5058ab3866a2),
+        W64LIT(0xeb21de366ea2da9b), W64LIT(0x8f623494f447ab40), W64LIT(0xd98eab67235e6c78), W64LIT(0xa414f56311c5465c),
+        W64LIT(0x5c4ef24dd31a601f), W64LIT(0x08d1d698a2f7d52c), W64LIT(0xdbfd104185aa1e73), W64LIT(0xcb42a16cdc59a92b),
+        W64LIT(0x10bfb12d59f3b758), W64LIT(0xa82348b7e2c77766), W64LIT(0xbdcd41c5b9bb1da3), W64LIT(0x7ab85d7d96e085b2),
+        W64LIT(0xedb40e5c99a34c86), W64LIT(0xff78045766a489d5), W64LIT(0xf34fb98395a6b8ef), W64LIT(0x4f352b557f679cc7),
+        W64LIT(0x4a64930a7de8415a), W64LIT(0xe8e5b6039b2c911b), W64LIT(0xb4ab444e4836f104), W64LIT(0x4817282cdb1c3351),
+        W64LIT(0xaeb698dd15c6e17b), W64LIT(0x3f2f1b96ed84be52), W64LIT(0x21d4ac49e1814a3b), W64LIT(0x884037ed503c04d6),
+        W64LIT(0xbe0929f04c355623), W64LIT(0xe565d8c43b5499aa), W64LIT(0x1108623e0a898ed3), W64LIT(0x2532c705b074ae2d),
+        W64LIT(0x0551b85f028fdd9d), W64LIT(0x03c46835f58e4b80), W64LIT(0xf13c02a53352cae4), W64LIT(0xee7066696c2d0706),
+        W64LIT(0xc6c2cfab7c21a19a), W64LIT(0xb04d2f0219c31512), W64LIT(0x0273bb26a6f4720b), W64LIT(0x8604311f05ca47e7),
+        W64LIT(0xaf014bce46bcd8f0), W64LIT(0x3318a6421e868f68), W64LIT(0x96bb80325c39f0bf), W64LIT(0x40c6feb479ebe67d),
+        W64LIT(0x12cc0a0bff07c553), W64LIT(0x162a6147aef22145), W64LIT(0x71ade3d0c1991b1e), W64LIT(0xce131933ded674b6),
+        W64LIT(0xc9311a4a7aaddb20), W64LIT(0x32af75514dfcb6e3), W64LIT(0x62d63ac86de4e7c6), W64LIT(0xb23e9424bf376719),
+        W64LIT(0x8355894007459a7a), W64LIT(0x137bd918ac7dfcd8), W64LIT(0x42b54592df1f9476), W64LIT(0xabe7208217493ce6),
+        W64LIT(0x9b3beef5fc41f80e), W64LIT(0x2e2779a8e70d3081), W64LIT(0x4d469073d993eecc), W64LIT(0x768fe0a965e2b488),
+        W64LIT(0xd0e8aeecd2d380df), W64LIT(0xa2812509e6c4d041), W64LIT(0x0ff3d5e1068c7aba), W64LIT(0x04e66b4c51f5e416),
+        W64LIT(0x2c54c28e41f9428a), W64LIT(0x01b7d313537a398b), W64LIT(0xcc60a215782206bd), W64LIT(0xc506a79e89afea1a),
+        W64LIT(0x4cf143608ae9d747), W64LIT(0x8a338ccbf6c876dd), W64LIT(0x29057ad143769f17), W64LIT(0xcfa4ca208dac4d3d),
+        W64LIT(0xa6674e45b7313457), W64LIT(0x50794f9920185125), W64LIT(0xb89cf99abb34c03e), W64LIT(0x343aa53bbafd20fe),
+        W64LIT(0x89f7e4fe03463d5d), W64LIT(0xa5a3267042bf7fd7), W64LIT(0xefc7b57a3f573e8d), W64LIT(0x9fdd85b9adb41c18),
+        W64LIT(0xec03dd4fcad9750d), W64LIT(0x970c53210f43c934), W64LIT(0xc7751cb82f5b9811), W64LIT(0xc1e0ccd2d85a0e0c),
+        W64LIT(0xad72f0e8e048aafb), W64LIT(0x0966058bf18deca7), W64LIT(0x47e4fdcddd9049eb), W64LIT(0x19d9b4a6a87e5bff),
+        W64LIT(0x1a1ddc935df0107f), W64LIT(0x591f4a12d195bd82), W64LIT(0x1efbb7df0c05f469), W64LIT(0x575b4ce08463feb3),
+        W64LIT(0x0e4406f255f64331), W64LIT(0x2ac112e4b6f8d497), W64LIT(0xa0f29e2f4030a24a), W64LIT(0x179db254fd8818ce),
+        W64LIT(0x663051843c1103d0), W64LIT(0xe4d20bd7682ea021), W64LIT(0xd15f7dff81a9b954), W64LIT(0xd32cc6d9275dcb5f),
+        W64LIT(0x94c83b14facd82b4), W64LIT(0xaa50f3914433056d), W64LIT(0x358d7628e9871975), W64LIT(0xbc7a92d6eac12428),
+        W64LIT(0x39bacbfc1a85284f), W64LIT(0x9199834bf8425f29), W64LIT(0x73de58f6676d6915), W64LIT(0xd5b916b3d05c5d42),
+        W64LIT(0x46532ede8eea7060), W64LIT(0x186e67b5fb046274), W64LIT(0xa1454d3c134a9bc1), W64LIT(0x0b15bead57799eac),
+        W64LIT(0x5adb2227241bf602), W64LIT(0xdd68c02b72ab886e), W64LIT(0x6443eaa29ae571db), W64LIT(0xfd0bbf71c050fbde),
+        W64LIT(0x8b845fd8a5b24f56), W64LIT(0xb92b2a89e84ef9b5), W64LIT(0x678782976f6b3a5b), W64LIT(0xf2f86a90c6dc8164),
+        W64LIT(0xc39377f47eae7c07), W64LIT(0x93ea386d5eb62d22), W64LIT(0x430296818c65adfd), W64LIT(0xc224a4e72dd4458c),
+        W64LIT(0x9e6a56aafece2593), W64LIT(0x6f56540fcd9cef77), W64LIT(0x84778a39a33e35ec), W64LIT(0xf85a072ec2df2643),
+        W64LIT(0x3bc970dabc715a44), W64LIT(0x0d806ec7a07808b1), W64LIT(0x773833ba36988d03), W64LIT(0x27417c231680dc26),
+        W64LIT(0x60a581eecb1095cd), W64LIT(0xb76f2c7bbdb8ba84), W64LIT(0xd8397874702455f3), W64LIT(0xfecfd74435deb05e),
+        W64LIT(0xcaf5727f8f2390a0), W64LIT(0xa9949ba4b1bd4eed), W64LIT(0xe034609b39db4437), W64LIT(0x2b76c1f7e582ed1c),
+        W64LIT(0xf7a9d2cfc4535cf9), W64LIT(0x20637f5ab2fb73b0), W64LIT(0x9c19ed8c583a5798), W64LIT(0xd67d7e8625d216c2),
+        W64LIT(0x1459da610806534e), W64LIT(0x6d25ef296b689d7c), W64LIT(0x925deb7e0dcc14a9), W64LIT(0x65f439b1c99f4850),
+        W64LIT(0x957fe807a9b7bb3f), W64LIT(0x41712da72a91dff6), W64LIT(0x36491e1d1c0952f5), W64LIT(0x5e3d496b75ee1214),
+        W64LIT(0x1d3fdfeaf98bbfe9), W64LIT(0x701a30c392e32295), W64LIT(0x6361e9db3e9ede4d), W64LIT(0xd7caad9576a82f49),
+        W64LIT(0xe71663e29da0eba1), W64LIT(0x98ff86c009cfb38e), W64LIT(0x6bb03f439c690b61), W64LIT(0xc4b1748ddad5d391),
+        W64LIT(0x6c923c3a3812a4f7), W64LIT(0x1f4c64cc5f7fcde2), W64LIT(0xe183b3886aa17dbc), W64LIT(0xb6d8ff68eec2830f),
+        W64LIT(0x51ce9c8a736268ae), W64LIT(0x07220379a47baf96), W64LIT(0x82e25a53543fa3f1), W64LIT(0xbb5891af4eba8bbe),
+        W64LIT(0x4bd340192e9278d1), W64LIT(0x6874577669e740e1), W64LIT(0xfb9e6f1b37516dc3), W64LIT(0xacc523fbb3329370),
+        W64LIT(0x69c384653a9d796a), W64LIT(0x5b6cf1347761cf89), W64LIT(0x0000000000000000), W64LIT(0x49a0fb3f88660ada),
+        W64LIT(0xa336f61ab5bee9ca), W64LIT(0x15ee09725b7c6ac5), W64LIT(0x8d118fb252b3d94b), W64LIT(0x7d9a5e04329b2a24),
+        W64LIT(0x1baa0f800e8a29f4), W64LIT(0xfa29bc08642b5448), W64LIT(0x459746eb7b643be0), W64LIT(0xdf1b7b0dd45ffa65),
+        W64LIT(0x30dcce77eb08c4e8), W64LIT(0x8091e175f2cbd1fa), W64LIT(0x0c37bdd4f302313a), W64LIT(0xf9edd43d91a51fc8),
+        W64LIT(0x3a7ea3c9ef0b63cf), W64LIT(0x74fc5b8fc316c683), W64LIT(0x8ca65ca101c9e0c0), W64LIT(0x72698be53417509e),
+        W64LIT(0x23a7176f47753830), W64LIT(0x797c3548636ece32), W64LIT(0xb51c975d1b4cc88f), W64LIT(0x2210c47c140f01bb),
+        W64LIT(0xd29b15ca7427f2d4), W64LIT(0x8ed5e787a73d92cb), W64LIT(0x7e5e3631c71561a4), W64LIT(0x1c880cf9aaf18662),
+        W64LIT(0xf08bd1b66028f36f), W64LIT(0xf61e01dc97296572), W64LIT(0x7b0f8e6ec59abc39), W64LIT(0xb3894737ec4d5e92),
+        W64LIT(0x316b1d64b872fd63), W64LIT(0x9a8c3de6af3bc185), W64LIT(0x0aa26dbe0403a727), W64LIT(0x5f8a9a7826942b9f),
+        W64LIT(0x520af4bf86ec232e), W64LIT(0x380d18ef49ff11c4), W64LIT(0x0695d06af701961d), W64LIT(0x87b3e20c56b07e6c),
+        W64LIT(0x53bd27acd5961aa5), W64LIT(0x7c2d8d1761e113af), W64LIT(0x28b2a9c2100ca69c), W64LIT(0x6a07ec50cf1332ea),
+        W64LIT(0xe9526510c856a890), W64LIT(0xcdd771062b583f36), W64LIT(0xfcbc6c62932ac255), W64LIT(0x9dae3e9f0b406e13),
+        W64LIT(0xd40ec5a0832664c9), W64LIT(0x78cbe65b3014f7b9), W64LIT(0x4e82f8462c1da54c), W64LIT(0x611252fd986aac46)
+    },
+    {
+        W64LIT(0x352b557f679cc74f), W64LIT(0x3e9424bf376719b2), W64LIT(0x5deb7e0dcc14a992), W64LIT(0xb3e20c56b07e6c87),
+        W64LIT(0x83b3886aa17dbce1), W64LIT(0x3d496b75ee12145e), W64LIT(0xae3e9f0b406e139d), W64LIT(0x8a9a7826942b9f5f),
+        W64LIT(0x845fd8a5b24f568b), W64LIT(0x5a072ec2df2643f8), W64LIT(0xf3d5e1068c7aba0f), W64LIT(0x7ea3c9ef0b63cf3a),
+        W64LIT(0x923c3a3812a4f76c), W64LIT(0x3fdfeaf98bbfe91d), W64LIT(0xd340192e9278d14b), W64LIT(0x04311f05ca47e786),
+        W64LIT(0xcc0a0bff07c55312), W64LIT(0xff86c009cfb38e98), W64LIT(0xade3d0c1991b1e71), W64LIT(0xfc5b8fc316c68374),
+        W64LIT(0xbb80325c39f0bf96), W64LIT(0xd5e787a73d92cb8e), W64LIT(0xa4ca208dac4d3dcf), W64LIT(0xf6af3045fae5ad26),
+        W64LIT(0x5b4ce08463feb357), W64LIT(0x8bd1b66028f36ff0), W64LIT(0xb698dd15c6e17bae), W64LIT(0x2f1b96ed84be523f),
+        W64LIT(0x4037ed503c04d688), W64LIT(0x6a56aafece25939e), W64LIT(0xb40e5c99a34c86ed), W64LIT(0xc6feb479ebe67d40),
+        W64LIT(0x9b15ca7427f2d4d2), W64LIT(0xde58f6676d691573), W64LIT(0xc523fbb3329370ac), W64LIT(0xe5b6039b2c911be8),
+        W64LIT(0x8d7628e987197535), W64LIT(0xf008aecc550fb7e3), W64LIT(0xd9b4a6a87e5bff19), W64LIT(0xc112e4b6f8d4972a),
+        W64LIT(0xdf133821d1b1e5dc), W64LIT(0xaf75514dfcb6e332), W64LIT(0x2095f8281e026b44), W64LIT(0xb54592df1f947642),
+        W64LIT(0x8eab67235e6c78d9), W64LIT(0x698be53417509e72), W64LIT(0xbc6c62932ac255fc), W64LIT(0x1f4a12d195bd8259),
+        W64LIT(0x15bead57799eac0b), W64LIT(0x1ddc935df0107f1a), W64LIT(0x131933ded674b6ce), W64LIT(0xe66b4c51f5e41604),
+        W64LIT(0x9db254fd8818ce17), W64LIT(0xa26dbe0403a7270a), W64LIT(0x17282cdb1c335148), W64LIT(0x47dbbd9f2f363ce2),
+        W64LIT(0xda69e962a72ef2f5), W64LIT(0x469073d993eecc4d), W64LIT(0xfafc114ab92c99b1), W64LIT(0x90aabbb477090a2f),
+        W64LIT(0xb2a9c2100ca69c28), W64LIT(0xa65ca101c9e0c08c), W64LIT(0xd09d56e44b0ddca7), W64LIT(0x3833ba36988d0377),
+        W64LIT(0x59da610806534e14), W64LIT(0x19ed8c583a57989c), W64LIT(0x491e1d1c0952f536), W64LIT(0xeb73a3180af5d23c),
+        W64LIT(0x2779a8e70d30812e), W64LIT(0x86c95929d7e2abc8), W64LIT(0xedd43d91a51fc8f9), W64LIT(0xb03f439c690b616b),
+        W64LIT(0x9e6f1b37516dc3fb), W64LIT(0x78045766a489d5ff), W64LIT(0x3c02a53352cae4f1), W64LIT(0x1c975d1b4cc88fb5),
+        W64LIT(0x55894007459a7a83), W64LIT(0xc384653a9d796a69), W64LIT(0x674e45b7313457a6), W64LIT(0x454d3c134a9bc1a1),
+        W64LIT(0xce9c8a736268ae51), W64LIT(0x98c885befe87d93e), W64LIT(0x0d18ef49ff11c438), W64LIT(0x66058bf18deca709),
+        W64LIT(0xcfd74435deb05efe), W64LIT(0x4ac352d6d027f8da), W64LIT(0x880cf9aaf186621c), W64LIT(0x0c53210f43c93497),
+        W64LIT(0x36f61ab5bee9caa3), W64LIT(0x526510c856a890e9), W64LIT(0x64930a7de8415a4a), W64LIT(0x1a30c392e3229570),
+        W64LIT(0x778a39a33e35ec84), W64LIT(0xbefae31f4f6fa8bf), W64LIT(0x2cc6d9275dcb5fd3), W64LIT(0xf439b1c99f485065),
+        W64LIT(0xa581eecb1095cd60), W64LIT(0x28f7c622978cb855), W64LIT(0x220379a47baf9607), W64LIT(0x7d7e8625d216c2d6),
+        W64LIT(0xd63ac86de4e7c662), W64LIT(0xea386d5eb62d2293), W64LIT(0xaa0f800e8a29f41b), W64LIT(0x1b7b0dd45ffa65df),
+        W64LIT(0x6cf1347761cf895b), W64LIT(0x4fb98395a6b8eff3), W64LIT(0xd4ac49e1814a3b21), W64LIT(0x311a4a7aaddb20c9),
+        W64LIT(0x32c705b074ae2d25), W64LIT(0xf29e2f4030a24aa0), W64LIT(0x712da72a91dff641), W64LIT(0xe4fdcddd9049eb47),
+        W64LIT(0xe7208217493ce6ab), W64LIT(0xab444e4836f104b4), W64LIT(0x2a6147aef2214516), W64LIT(0xb916b3d05c5d42d5),
+        W64LIT(0xd1d698a2f7d52c08), W64LIT(0xb7d313537a398b01), W64LIT(0x4b889c906cff0875), W64LIT(0xcbe65b3014f7b978),
+        W64LIT(0x812509e6c4d041a2), W64LIT(0xb85d7d96e085b27a), W64LIT(0xef42bc1dc0b235ba), W64LIT(0x18a6421e868f6833),
+        W64LIT(0x532ede8eea706046), W64LIT(0x2b2a89e84ef9b5b9), W64LIT(0xf86a90c6dc8164f2), W64LIT(0x397874702455f3d8),
+        W64LIT(0x65d8c43b5499aae5), W64LIT(0x42a16cdc59a92bcb), W64LIT(0x5f7dff81a9b954d1), W64LIT(0x9377f47eae7c07c3),
+        W64LIT(0x95d06af701961d06), W64LIT(0x34609b39db4437e0), W64LIT(0x8c3de6af3bc1859a), W64LIT(0xfd104185aa1e73db),
+        W64LIT(0x7bd918ac7dfcd813), W64LIT(0x417c231680dc2627), W64LIT(0x03dd4fcad9750dec), W64LIT(0x14f56311c5465ca4),
+        W64LIT(0x571fc18b203787c0), W64LIT(0xb1748ddad5d391c4), W64LIT(0xd8ff68eec2830fb6), W64LIT(0x014bce46bcd8f0af),
+        W64LIT(0x1663e29da0eba1e7), W64LIT(0x637f5ab2fb73b020), W64LIT(0xee09725b7c6ac515), W64LIT(0x0000000000000000),
+        W64LIT(0x338ccbf6c876dd8a), W64LIT(0x56540fcd9cef776f), W64LIT(0x623494f447ab408f), W64LIT(0x91e175f2cbd1fa80),
+        W64LIT(0x0f8e6ec59abc397b), W64LIT(0x4855d35ab58a0599), W64LIT(0x894737ec4d5e92b3), W64LIT(0xbd27acd5961aa553),
+        W64LIT(0x4d2f0219c31512b0), W64LIT(0xe1871c9ee6d6fc6e), W64LIT(0x8fe0a965e2b48876), W64LIT(0x118fb252b3d94b8d),
+        W64LIT(0xc0592af0440c6785), W64LIT(0xaca81e8725c3eede), W64LIT(0xd771062b583f36cd), W64LIT(0x7066696c2d0706ee),
+        W64LIT(0x99834bf8425f2991), W64LIT(0x3aa53bbafd20fe34), W64LIT(0x4406f255f643310e), W64LIT(0xa1b0f1cedad22ae6),
+        W64LIT(0x82f8462c1da54c4e), W64LIT(0x0929f04c355623be), W64LIT(0x057ad143769f1729), W64LIT(0x949ba4b1bd4eeda9),
+        W64LIT(0x960d253dd8e310ea), W64LIT(0xfecd0e4f736b7e37), W64LIT(0x0296818c65adfd43), W64LIT(0x6f2c7bbdb8ba84b7),
+        W64LIT(0x9a5e04329b2a247d), W64LIT(0x2348b7e2c77766a8), W64LIT(0xdcce77eb08c4e830), W64LIT(0x851416e30e97a624),
+        W64LIT(0x08623e0a898ed311), W64LIT(0x43eaa29ae571db64), W64LIT(0xc7b57a3f573e8def), W64LIT(0xc2cfab7c21a19ac6),
+        W64LIT(0x5ca0b04b70cc593d), W64LIT(0x0ec5a0832664c9d4), W64LIT(0x1e01dc97296572f6), W64LIT(0xbacbfc1a85284f39),
+        W64LIT(0xc970dabc715a443b), W64LIT(0xa8990182ef840958), W64LIT(0xc83b14facd82b494), W64LIT(0x72f0e8e048aafbad),
+        W64LIT(0xf143608ae9d7474c), W64LIT(0xf5727f8f2390a0ca), W64LIT(0x7fe807a9b7bb3f95), W64LIT(0x76c1f7e582ed1c2b),
+        W64LIT(0xcd41c5b9bb1da3bd), W64LIT(0x6b1d64b872fd6331), W64LIT(0x806ec7a07808b10d), W64LIT(0xe3119d12837b012d),
+        W64LIT(0x25ef296b689d7c6d), W64LIT(0x37bdd4f302313a0c), W64LIT(0x3051843c1103d066), W64LIT(0x68c02b72ab886edd),
+        W64LIT(0x8782976f6b3a5b67), W64LIT(0x2d8d1761e113af7c), W64LIT(0x1252fd986aac4661), W64LIT(0x0bbf71c050fbdefd),
+        W64LIT(0xd20bd7682ea021e4), W64LIT(0xe0ccd2d85a0e0cc1), W64LIT(0x9cf99abb34c03eb8), W64LIT(0xdd85b9adb41c189f),
+        W64LIT(0x61e9db3e9ede4d63), W64LIT(0x06a79e89afea1ac5), W64LIT(0xf7e4fe03463d5d89), W64LIT(0x794f992018512550),
+        W64LIT(0x3beef5fc41f80e9b), W64LIT(0xcaad9576a82f49d7), W64LIT(0x10c47c140f01bb22), W64LIT(0x0af4bf86ec232e52),
+        W64LIT(0xdb2227241bf6025a), W64LIT(0x21de366ea2da9beb), W64LIT(0x9f24d571edb53354), W64LIT(0x9746eb7b643be045),
+        W64LIT(0xa3267042bf7fd7a5), W64LIT(0x6e67b5fb04627418), W64LIT(0xc46835f58e4b8003), W64LIT(0x07ec50cf1332ea6a),
+        W64LIT(0xe8aeecd2d380dfd0), W64LIT(0xe9e522946f582f7f), W64LIT(0x54c28e41f9428a2c), W64LIT(0xe25a53543fa3f182),
+        W64LIT(0xa9d2cfc4535cf9f7), W64LIT(0xa0fb3f88660ada49), W64LIT(0x50f3914433056daa), W64LIT(0x51b85f028fdd9d05),
+        W64LIT(0xec9ff3d719c73856), W64LIT(0x263266a1b1e87181), W64LIT(0x5e3631c71561a47e), W64LIT(0x24a4e72dd4458cc2),
+        W64LIT(0x74577669e740e168), W64LIT(0x7a92d6eac12428bc), W64LIT(0x2e5058ab3866a290), W64LIT(0x4ef24dd31a601f5c),
+        W64LIT(0xf9215e806059945d), W64LIT(0xfbb7df0c05f4691e), W64LIT(0x751cb82f5b9811c7), W64LIT(0x29bc08642b5448fa),
+        W64LIT(0x5891af4eba8bbebb), W64LIT(0x73bb26a6f4720b02), W64LIT(0x6dbafa31dd1779f4), W64LIT(0x7c3548636ece3279),
+        W64LIT(0x4c64cc5f7fcde21f), W64LIT(0x60a215782206bdcc), W64LIT(0xa7176f4775383023), W64LIT(0xbfb12d59f3b75810)
+    },
+    {
+        W64LIT(0x51843c1103d06630), W64LIT(0xdfeaf98bbfe91d3f), W64LIT(0xeef5fc41f80e9b3b), W64LIT(0xaf3045fae5ad26f6),
+            W64LIT(0x70dabc715a443bc9), W64LIT(0x119d12837b012de3), W64LIT(0x3b14facd82b494c8), W64LIT(0xdd4fcad9750dec03),
+        W64LIT(0xaabbb477090a2f90), W64LIT(0x75514dfcb6e332af), W64LIT(0x96818c65adfd4302), W64LIT(0x1d64b872fd63316b),
+        W64LIT(0xe4fe03463d5d89f7), W64LIT(0x43608ae9d7474cf1), W64LIT(0xe20c56b07e6c87b3), W64LIT(0xf24dd31a601f5c4e),
+        W64LIT(0x577669e740e16874), W64LIT(0x609b39db4437e034), W64LIT(0x3ac86de4e7c662d6), W64LIT(0x0379a47baf960722),
+        W64LIT(0xa79e89afea1ac506), W64LIT(0x4bce46bcd8f0af01), W64LIT(0x267042bf7fd7a5a3), W64LIT(0x7ad143769f172905),
+        W64LIT(0x85b9adb41c189fdd), W64LIT(0xc885befe87d93e98), W64LIT(0xed8c583a57989c19), W64LIT(0x3c3a3812a4f76c92),
+        W64LIT(0x5e04329b2a247d9a), W64LIT(0xf99abb34c03eb89c), W64LIT(0x2227241bf6025adb), W64LIT(0x6510c856a890e952),
+        W64LIT(0xa215782206bdcc60), W64LIT(0x9ff3d719c73856ec), W64LIT(0x02a53352cae4f13c), W64LIT(0x871c9ee6d6fc6ee1),
+        W64LIT(0x80325c39f0bf96bb), W64LIT(0x8d1761e113af7c2d), W64LIT(0x46eb7b643be04597), W64LIT(0xd8c43b5499aae565),
+        W64LIT(0x81eecb1095cd60a5), W64LIT(0x9c8a736268ae51ce), W64LIT(0x64cc5f7fcde21f4c), W64LIT(0x7c231680dc262741),
+        W64LIT(0xc28e41f9428a2c54), W64LIT(0x8ccbf6c876dd8a33), W64LIT(0xb98395a6b8eff34f), W64LIT(0xa9c2100ca69c28b2),
+        W64LIT(0x6ec7a07808b10d80), W64LIT(0x0a0bff07c55312cc), W64LIT(0xc02b72ab886edd68), W64LIT(0xb85f028fdd9d0551),
+        W64LIT(0x104185aa1e73dbfd), W64LIT(0xb6039b2c911be8e5), W64LIT(0x79a8e70d30812e27), W64LIT(0x82976f6b3a5b6787),
+        W64LIT(0xa53bbafd20fe343a), W64LIT(0x7dff81a9b954d15f), W64LIT(0x894007459a7a8355), W64LIT(0xd43d91a51fc8f9ed),
+        W64LIT(0xccd2d85a0e0cc1e0), W64LIT(0xe807a9b7bb3f957f), W64LIT(0xa81e8725c3eedeac), W64LIT(0x5058ab3866a2902e),
+        W64LIT(0x889c906cff08754b), W64LIT(0x4ce08463feb3575b), W64LIT(0xdc935df0107f1a1d), W64LIT(0x56aafece25939e6a),
+        W64LIT(0xa16cdc59a92bcb42), W64LIT(0xec50cf1332ea6a07), W64LIT(0x4592df1f947642b5), W64LIT(0xbafa31dd1779f46d),
+        W64LIT(0x29f04c355623be09), W64LIT(0x15ca7427f2d4d29b), W64LIT(0x215e806059945df9), W64LIT(0x23fbb3329370acc5),
+        W64LIT(0xd74435deb05efecf), W64LIT(0xeaa29ae571db6443), W64LIT(0xc95929d7e2abc886), W64LIT(0xa4e72dd4458cc224),
+        W64LIT(0x3548636ece32797c), W64LIT(0x27acd5961aa553bd), W64LIT(0xac49e1814a3b21d4), W64LIT(0xcbfc1a85284f39ba),
+        W64LIT(0x8fb252b3d94b8d11), W64LIT(0x42bc1dc0b235baef), W64LIT(0x072ec2df2643f85a), W64LIT(0x91af4eba8bbebb58),
+        W64LIT(0x045766a489d5ff78), W64LIT(0x9073d993eecc4d46), W64LIT(0x3f439c690b616bb0), W64LIT(0x6b4c51f5e41604e6),
+        W64LIT(0x7e8625d216c2d67d), W64LIT(0xab67235e6c78d98e), W64LIT(0xef296b689d7c6d25), W64LIT(0xc5a0832664c9d40e),
+        W64LIT(0x69e962a72ef2f5da), W64LIT(0x7b0dd45ffa65df1b), W64LIT(0x496b75ee12145e3d), W64LIT(0xd918ac7dfcd8137b),
+        W64LIT(0x1e1d1c0952f53649), W64LIT(0xfeb479ebe67d40c6), W64LIT(0x6147aef22145162a), W64LIT(0x0f800e8a29f41baa),
+        W64LIT(0x0000000000000000), W64LIT(0x990182ef840958a8), W64LIT(0x975d1b4cc88fb51c), W64LIT(0x5b8fc316c68374fc),
+        W64LIT(0x16b3d05c5d42d5b9), W64LIT(0xb3886aa17dbce183), W64LIT(0x4f99201851255079), W64LIT(0x98dd15c6e17baeb6),
+        W64LIT(0x06f255f643310e44), W64LIT(0x6f1b37516dc3fb9e), W64LIT(0x0cf9aaf186621c88), W64LIT(0x8e6ec59abc397b0f),
+        W64LIT(0x930a7de8415a4a64), W64LIT(0x37ed503c04d68840), W64LIT(0xf61ab5bee9caa336), W64LIT(0xfb3f88660ada49a0),
+        W64LIT(0x7874702455f3d839), W64LIT(0x208217493ce6abe7), W64LIT(0x73a3180af5d23ceb), W64LIT(0x9e2f4030a24aa0f2),
+        W64LIT(0xe522946f582f7fe9), W64LIT(0xd5e1068c7aba0ff3), W64LIT(0xbdd4f302313a0c37), W64LIT(0x1fc18b203787c057),
+        W64LIT(0xd2cfc4535cf9f7a9), W64LIT(0x1b96ed84be523f2f), W64LIT(0x5d7d96e085b27ab8), W64LIT(0x66696c2d0706ee70),
+        W64LIT(0xd06af701961d0695), W64LIT(0xe3d0c1991b1e71ad), W64LIT(0x6c62932ac255fcbc), W64LIT(0xd313537a398b01b7),
+        W64LIT(0xa0b04b70cc593d5c), W64LIT(0x834bf8425f299199), W64LIT(0xaeecd2d380dfd0e8), W64LIT(0xbead57799eac0b15),
+        W64LIT(0x540fcd9cef776f56), W64LIT(0xad9576a82f49d7ca), W64LIT(0xfc114ab92c99b1fa), W64LIT(0x33ba36988d037738),
+        W64LIT(0xbb26a6f4720b0273), W64LIT(0xb254fd8818ce179d), W64LIT(0xa6421e868f683318), W64LIT(0x5fd8a5b24f568b84),
+        W64LIT(0x623e0a898ed31108), W64LIT(0xb0f1cedad22ae6a1), W64LIT(0x1933ded674b6ce13), W64LIT(0x1416e30e97a62485),
+        W64LIT(0x3e9f0b406e139dae), W64LIT(0x6dbe0403a7270aa2), W64LIT(0xbc08642b5448fa29), W64LIT(0x0d253dd8e310ea96),
+        W64LIT(0x2ede8eea70604653), W64LIT(0x39b1c99f485065f4), W64LIT(0xcd0e4f736b7e37fe), W64LIT(0xbf71c050fbdefd0b),
+        W64LIT(0x748ddad5d391c4b1), W64LIT(0x0bd7682ea021e4d2), W64LIT(0x3494f447ab408f62), W64LIT(0xb4a6a87e5bff19d9),
+        W64LIT(0x133821d1b1e5dcdf), W64LIT(0x95f8281e026b4420), W64LIT(0x2da72a91dff64171), W64LIT(0x18ef49ff11c4380d),
+        W64LIT(0xc705b074ae2d2532), W64LIT(0x3de6af3bc1859a8c), W64LIT(0x6835f58e4b8003c4), W64LIT(0xe787a73d92cb8ed5),
+        W64LIT(0xc6d9275dcb5fd32c), W64LIT(0xf7c622978cb85528), W64LIT(0x4d3c134a9bc1a145), W64LIT(0xf3914433056daa50),
+        W64LIT(0xb7df0c05f4691efb), W64LIT(0xe175f2cbd1fa8091), W64LIT(0x77f47eae7c07c393), W64LIT(0xeb7e0dcc14a9925d),
+        W64LIT(0xf1347761cf895b6c), W64LIT(0x08aecc550fb7e3f0), W64LIT(0x55d35ab58a059948), W64LIT(0x444e4836f104b4ab),
+        W64LIT(0x58f6676d691573de), W64LIT(0x9ba4b1bd4eeda994), W64LIT(0x92d6eac12428bc7a), W64LIT(0xb12d59f3b75810bf),
+        W64LIT(0xa3c9ef0b63cf3a7e), W64LIT(0x67b5fb046274186e), W64LIT(0x2f0219c31512b04d), W64LIT(0x3266a1b1e8718126),
+        W64LIT(0x7628e9871975358d), W64LIT(0xda610806534e1459), W64LIT(0x311f05ca47e78604), W64LIT(0x12e4b6f8d4972ac1),
+        W64LIT(0x282cdb1c33514817), W64LIT(0x727f8f2390a0caf5), W64LIT(0xb57a3f573e8defc7), W64LIT(0x71062b583f36cdd7),
+        W64LIT(0x84653a9d796a69c3), W64LIT(0xf56311c5465ca414), W64LIT(0x4737ec4d5e92b389), W64LIT(0x1cb82f5b9811c775),
+        W64LIT(0x2509e6c4d041a281), W64LIT(0xfdcddd9049eb47e4), W64LIT(0x40192e9278d14bd3), W64LIT(0x2a89e84ef9b5b92b),
+        W64LIT(0x3631c71561a47e5e), W64LIT(0x8be53417509e7269), W64LIT(0x24d571edb533549f), W64LIT(0xc352d6d027f8da4a),
+        W64LIT(0x01dc97296572f61e), W64LIT(0xe9db3e9ede4d6361), W64LIT(0x4e45b7313457a667), W64LIT(0xf8462c1da54c4e82),
+        W64LIT(0x4a12d195bd82591f), W64LIT(0xff68eec2830fb6d8), W64LIT(0x176f4775383023a7), W64LIT(0x48b7e2c77766a823),
+        W64LIT(0x592af0440c6785c0), W64LIT(0x2c7bbdb8ba84b76f), W64LIT(0x5ca101c9e0c08ca6), W64LIT(0x63e29da0eba1e716),
+        W64LIT(0xd698a2f7d52c08d1), W64LIT(0xce77eb08c4e830dc), W64LIT(0xde366ea2da9beb21), W64LIT(0x5a53543fa3f182e2),
+        W64LIT(0x52fd986aac466112), W64LIT(0x86c009cfb38e98ff), W64LIT(0xd1b66028f36ff08b), W64LIT(0x1a4a7aaddb20c931),
+        W64LIT(0xcfab7c21a19ac6c2), W64LIT(0x09725b7c6ac515ee), W64LIT(0x0e5c99a34c86edb4), W64LIT(0xdbbd9f2f363ce247),
+        W64LIT(0x6a90c6dc8164f2f8), W64LIT(0x8a39a33e35ec8477), W64LIT(0xe0a965e2b488768f), W64LIT(0x7f5ab2fb73b02063),
+        W64LIT(0xf4bf86ec232e520a), W64LIT(0xfae31f4f6fa8bfbe), W64LIT(0x058bf18deca70966), W64LIT(0x41c5b9bb1da3bdcd),
+        W64LIT(0x2b557f679cc74f35), W64LIT(0xca208dac4d3dcfa4), W64LIT(0x9a7826942b9f5f8a), W64LIT(0xf0e8e048aafbad72),
+        W64LIT(0x53210f43c934970c), W64LIT(0xc1f7e582ed1c2b76), W64LIT(0xc47c140f01bb2210), W64LIT(0x9d56e44b0ddca7d0),
+        W64LIT(0x386d5eb62d2293ea), W64LIT(0xe65b3014f7b978cb), W64LIT(0x9424bf376719b23e), W64LIT(0x30c392e32295701a)
+    }
+};
+
+const byte S[4][256] =
+{
+    {
+        0xA8, 0x43, 0x5F, 0x06, 0x6B, 0x75, 0x6C, 0x59, 0x71, 0xDF, 0x87, 0x95, 0x17, 0xF0, 0xD8, 0x09,
+        0x6D, 0xF3, 0x1D, 0xCB, 0xC9, 0x4D, 0x2C, 0xAF, 0x79, 0xE0, 0x97, 0xFD, 0x6F, 0x4B, 0x45, 0x39,
+        0x3E, 0xDD, 0xA3, 0x4F, 0xB4, 0xB6, 0x9A, 0x0E, 0x1F, 0xBF, 0x15, 0xE1, 0x49, 0xD2, 0x93, 0xC6,
+        0x92, 0x72, 0x9E, 0x61, 0xD1, 0x63, 0xFA, 0xEE, 0xF4, 0x19, 0xD5, 0xAD, 0x58, 0xA4, 0xBB, 0xA1,
+        0xDC, 0xF2, 0x83, 0x37, 0x42, 0xE4, 0x7A, 0x32, 0x9C, 0xCC, 0xAB, 0x4A, 0x8F, 0x6E, 0x04, 0x27,
+        0x2E, 0xE7, 0xE2, 0x5A, 0x96, 0x16, 0x23, 0x2B, 0xC2, 0x65, 0x66, 0x0F, 0xBC, 0xA9, 0x47, 0x41,
+        0x34, 0x48, 0xFC, 0xB7, 0x6A, 0x88, 0xA5, 0x53, 0x86, 0xF9, 0x5B, 0xDB, 0x38, 0x7B, 0xC3, 0x1E,
+        0x22, 0x33, 0x24, 0x28, 0x36, 0xC7, 0xB2, 0x3B, 0x8E, 0x77, 0xBA, 0xF5, 0x14, 0x9F, 0x08, 0x55,
+        0x9B, 0x4C, 0xFE, 0x60, 0x5C, 0xDA, 0x18, 0x46, 0xCD, 0x7D, 0x21, 0xB0, 0x3F, 0x1B, 0x89, 0xFF,
+        0xEB, 0x84, 0x69, 0x3A, 0x9D, 0xD7, 0xD3, 0x70, 0x67, 0x40, 0xB5, 0xDE, 0x5D, 0x30, 0x91, 0xB1,
+        0x78, 0x11, 0x01, 0xE5, 0x00, 0x68, 0x98, 0xA0, 0xC5, 0x02, 0xA6, 0x74, 0x2D, 0x0B, 0xA2, 0x76,
+        0xB3, 0xBE, 0xCE, 0xBD, 0xAE, 0xE9, 0x8A, 0x31, 0x1C, 0xEC, 0xF1, 0x99, 0x94, 0xAA, 0xF6, 0x26,
+        0x2F, 0xEF, 0xE8, 0x8C, 0x35, 0x03, 0xD4, 0x7F, 0xFB, 0x05, 0xC1, 0x5E, 0x90, 0x20, 0x3D, 0x82,
+        0xF7, 0xEA, 0x0A, 0x0D, 0x7E, 0xF8, 0x50, 0x1A, 0xC4, 0x07, 0x57, 0xB8, 0x3C, 0x62, 0xE3, 0xC8,
+        0xAC, 0x52, 0x64, 0x10, 0xD0, 0xD9, 0x13, 0x0C, 0x12, 0x29, 0x51, 0xB9, 0xCF, 0xD6, 0x73, 0x8D,
+        0x81, 0x54, 0xC0, 0xED, 0x4E, 0x44, 0xA7, 0x2A, 0x85, 0x25, 0xE6, 0xCA, 0x7C, 0x8B, 0x56, 0x80
+    },
+    {
+        0xCE, 0xBB, 0xEB, 0x92, 0xEA, 0xCB, 0x13, 0xC1, 0xE9, 0x3A, 0xD6, 0xB2, 0xD2, 0x90, 0x17, 0xF8,
+        0x42, 0x15, 0x56, 0xB4, 0x65, 0x1C, 0x88, 0x43, 0xC5, 0x5C, 0x36, 0xBA, 0xF5, 0x57, 0x67, 0x8D,
+        0x31, 0xF6, 0x64, 0x58, 0x9E, 0xF4, 0x22, 0xAA, 0x75, 0x0F, 0x02, 0xB1, 0xDF, 0x6D, 0x73, 0x4D,
+        0x7C, 0x26, 0x2E, 0xF7, 0x08, 0x5D, 0x44, 0x3E, 0x9F, 0x14, 0xC8, 0xAE, 0x54, 0x10, 0xD8, 0xBC,
+        0x1A, 0x6B, 0x69, 0xF3, 0xBD, 0x33, 0xAB, 0xFA, 0xD1, 0x9B, 0x68, 0x4E, 0x16, 0x95, 0x91, 0xEE,
+        0x4C, 0x63, 0x8E, 0x5B, 0xCC, 0x3C, 0x19, 0xA1, 0x81, 0x49, 0x7B, 0xD9, 0x6F, 0x37, 0x60, 0xCA,
+        0xE7, 0x2B, 0x48, 0xFD, 0x96, 0x45, 0xFC, 0x41, 0x12, 0x0D, 0x79, 0xE5, 0x89, 0x8C, 0xE3, 0x20,
+        0x30, 0xDC, 0xB7, 0x6C, 0x4A, 0xB5, 0x3F, 0x97, 0xD4, 0x62, 0x2D, 0x06, 0xA4, 0xA5, 0x83, 0x5F,
+        0x2A, 0xDA, 0xC9, 0x00, 0x7E, 0xA2, 0x55, 0xBF, 0x11, 0xD5, 0x9C, 0xCF, 0x0E, 0x0A, 0x3D, 0x51,
+        0x7D, 0x93, 0x1B, 0xFE, 0xC4, 0x47, 0x09, 0x86, 0x0B, 0x8F, 0x9D, 0x6A, 0x07, 0xB9, 0xB0, 0x98,
+        0x18, 0x32, 0x71, 0x4B, 0xEF, 0x3B, 0x70, 0xA0, 0xE4, 0x40, 0xFF, 0xC3, 0xA9, 0xE6, 0x78, 0xF9,
+        0x8B, 0x46, 0x80, 0x1E, 0x38, 0xE1, 0xB8, 0xA8, 0xE0, 0x0C, 0x23, 0x76, 0x1D, 0x25, 0x24, 0x05,
+        0xF1, 0x6E, 0x94, 0x28, 0x9A, 0x84, 0xE8, 0xA3, 0x4F, 0x77, 0xD3, 0x85, 0xE2, 0x52, 0xF2, 0x82,
+        0x50, 0x7A, 0x2F, 0x74, 0x53, 0xB3, 0x61, 0xAF, 0x39, 0x35, 0xDE, 0xCD, 0x1F, 0x99, 0xAC, 0xAD,
+        0x72, 0x2C, 0xDD, 0xD0, 0x87, 0xBE, 0x5E, 0xA6, 0xEC, 0x04, 0xC6, 0x03, 0x34, 0xFB, 0xDB, 0x59,
+        0xB6, 0xC2, 0x01, 0xF0, 0x5A, 0xED, 0xA7, 0x66, 0x21, 0x7F, 0x8A, 0x27, 0xC7, 0xC0, 0x29, 0xD7
+    },
+    {
+        0x93, 0xD9, 0x9A, 0xB5, 0x98, 0x22, 0x45, 0xFC, 0xBA, 0x6A, 0xDF, 0x02, 0x9F, 0xDC, 0x51, 0x59,
+        0x4A, 0x17, 0x2B, 0xC2, 0x94, 0xF4, 0xBB, 0xA3, 0x62, 0xE4, 0x71, 0xD4, 0xCD, 0x70, 0x16, 0xE1,
+        0x49, 0x3C, 0xC0, 0xD8, 0x5C, 0x9B, 0xAD, 0x85, 0x53, 0xA1, 0x7A, 0xC8, 0x2D, 0xE0, 0xD1, 0x72,
+        0xA6, 0x2C, 0xC4, 0xE3, 0x76, 0x78, 0xB7, 0xB4, 0x09, 0x3B, 0x0E, 0x41, 0x4C, 0xDE, 0xB2, 0x90,
+        0x25, 0xA5, 0xD7, 0x03, 0x11, 0x00, 0xC3, 0x2E, 0x92, 0xEF, 0x4E, 0x12, 0x9D, 0x7D, 0xCB, 0x35,
+        0x10, 0xD5, 0x4F, 0x9E, 0x4D, 0xA9, 0x55, 0xC6, 0xD0, 0x7B, 0x18, 0x97, 0xD3, 0x36, 0xE6, 0x48,
+        0x56, 0x81, 0x8F, 0x77, 0xCC, 0x9C, 0xB9, 0xE2, 0xAC, 0xB8, 0x2F, 0x15, 0xA4, 0x7C, 0xDA, 0x38,
+        0x1E, 0x0B, 0x05, 0xD6, 0x14, 0x6E, 0x6C, 0x7E, 0x66, 0xFD, 0xB1, 0xE5, 0x60, 0xAF, 0x5E, 0x33,
+        0x87, 0xC9, 0xF0, 0x5D, 0x6D, 0x3F, 0x88, 0x8D, 0xC7, 0xF7, 0x1D, 0xE9, 0xEC, 0xED, 0x80, 0x29,
+        0x27, 0xCF, 0x99, 0xA8, 0x50, 0x0F, 0x37, 0x24, 0x28, 0x30, 0x95, 0xD2, 0x3E, 0x5B, 0x40, 0x83,
+        0xB3, 0x69, 0x57, 0x1F, 0x07, 0x1C, 0x8A, 0xBC, 0x20, 0xEB, 0xCE, 0x8E, 0xAB, 0xEE, 0x31, 0xA2,
+        0x73, 0xF9, 0xCA, 0x3A, 0x1A, 0xFB, 0x0D, 0xC1, 0xFE, 0xFA, 0xF2, 0x6F, 0xBD, 0x96, 0xDD, 0x43,
+        0x52, 0xB6, 0x08, 0xF3, 0xAE, 0xBE, 0x19, 0x89, 0x32, 0x26, 0xB0, 0xEA, 0x4B, 0x64, 0x84, 0x82,
+        0x6B, 0xF5, 0x79, 0xBF, 0x01, 0x5F, 0x75, 0x63, 0x1B, 0x23, 0x3D, 0x68, 0x2A, 0x65, 0xE8, 0x91,
+        0xF6, 0xFF, 0x13, 0x58, 0xF1, 0x47, 0x0A, 0x7F, 0xC5, 0xA7, 0xE7, 0x61, 0x5A, 0x06, 0x46, 0x44,
+        0x42, 0x04, 0xA0, 0xDB, 0x39, 0x86, 0x54, 0xAA, 0x8C, 0x34, 0x21, 0x8B, 0xF8, 0x0C, 0x74, 0x67
+    },
+    {
+        0x68, 0x8D, 0xCA, 0x4D, 0x73, 0x4B, 0x4E, 0x2A, 0xD4, 0x52, 0x26, 0xB3, 0x54, 0x1E, 0x19, 0x1F,
+        0x22, 0x03, 0x46, 0x3D, 0x2D, 0x4A, 0x53, 0x83, 0x13, 0x8A, 0xB7, 0xD5, 0x25, 0x79, 0xF5, 0xBD,
+        0x58, 0x2F, 0x0D, 0x02, 0xED, 0x51, 0x9E, 0x11, 0xF2, 0x3E, 0x55, 0x5E, 0xD1, 0x16, 0x3C, 0x66,
+        0x70, 0x5D, 0xF3, 0x45, 0x40, 0xCC, 0xE8, 0x94, 0x56, 0x08, 0xCE, 0x1A, 0x3A, 0xD2, 0xE1, 0xDF,
+        0xB5, 0x38, 0x6E, 0x0E, 0xE5, 0xF4, 0xF9, 0x86, 0xE9, 0x4F, 0xD6, 0x85, 0x23, 0xCF, 0x32, 0x99,
+        0x31, 0x14, 0xAE, 0xEE, 0xC8, 0x48, 0xD3, 0x30, 0xA1, 0x92, 0x41, 0xB1, 0x18, 0xC4, 0x2C, 0x71,
+        0x72, 0x44, 0x15, 0xFD, 0x37, 0xBE, 0x5F, 0xAA, 0x9B, 0x88, 0xD8, 0xAB, 0x89, 0x9C, 0xFA, 0x60,
+        0xEA, 0xBC, 0x62, 0x0C, 0x24, 0xA6, 0xA8, 0xEC, 0x67, 0x20, 0xDB, 0x7C, 0x28, 0xDD, 0xAC, 0x5B,
+        0x34, 0x7E, 0x10, 0xF1, 0x7B, 0x8F, 0x63, 0xA0, 0x05, 0x9A, 0x43, 0x77, 0x21, 0xBF, 0x27, 0x09,
+        0xC3, 0x9F, 0xB6, 0xD7, 0x29, 0xC2, 0xEB, 0xC0, 0xA4, 0x8B, 0x8C, 0x1D, 0xFB, 0xFF, 0xC1, 0xB2,
+        0x97, 0x2E, 0xF8, 0x65, 0xF6, 0x75, 0x07, 0x04, 0x49, 0x33, 0xE4, 0xD9, 0xB9, 0xD0, 0x42, 0xC7,
+        0x6C, 0x90, 0x00, 0x8E, 0x6F, 0x50, 0x01, 0xC5, 0xDA, 0x47, 0x3F, 0xCD, 0x69, 0xA2, 0xE2, 0x7A,
+        0xA7, 0xC6, 0x93, 0x0F, 0x0A, 0x06, 0xE6, 0x2B, 0x96, 0xA3, 0x1C, 0xAF, 0x6A, 0x12, 0x84, 0x39,
+        0xE7, 0xB0, 0x82, 0xF7, 0xFE, 0x9D, 0x87, 0x5C, 0x81, 0x35, 0xDE, 0xB4, 0xA5, 0xFC, 0x80, 0xEF,
+        0xCB, 0xBB, 0x6B, 0x76, 0xBA, 0x5A, 0x7D, 0x78, 0x0B, 0x95, 0xE3, 0xAD, 0x74, 0x98, 0x3B, 0x36,
+        0x64, 0x6D, 0xDC, 0xF0, 0x59, 0xA9, 0x4C, 0x17, 0x7F, 0x91, 0xB8, 0xC9, 0x57, 0x1B, 0xE0, 0x61
+    }
+};
+
+const byte IS[4][256] =
+{
+    {
+        0xA4, 0xA2, 0xA9, 0xC5, 0x4E, 0xC9, 0x03, 0xD9, 0x7E, 0x0F, 0xD2, 0xAD, 0xE7, 0xD3, 0x27, 0x5B,
+        0xE3, 0xA1, 0xE8, 0xE6, 0x7C, 0x2A, 0x55, 0x0C, 0x86, 0x39, 0xD7, 0x8D, 0xB8, 0x12, 0x6F, 0x28,
+        0xCD, 0x8A, 0x70, 0x56, 0x72, 0xF9, 0xBF, 0x4F, 0x73, 0xE9, 0xF7, 0x57, 0x16, 0xAC, 0x50, 0xC0,
+        0x9D, 0xB7, 0x47, 0x71, 0x60, 0xC4, 0x74, 0x43, 0x6C, 0x1F, 0x93, 0x77, 0xDC, 0xCE, 0x20, 0x8C,
+        0x99, 0x5F, 0x44, 0x01, 0xF5, 0x1E, 0x87, 0x5E, 0x61, 0x2C, 0x4B, 0x1D, 0x81, 0x15, 0xF4, 0x23,
+        0xD6, 0xEA, 0xE1, 0x67, 0xF1, 0x7F, 0xFE, 0xDA, 0x3C, 0x07, 0x53, 0x6A, 0x84, 0x9C, 0xCB, 0x02,
+        0x83, 0x33, 0xDD, 0x35, 0xE2, 0x59, 0x5A, 0x98, 0xA5, 0x92, 0x64, 0x04, 0x06, 0x10, 0x4D, 0x1C,
+        0x97, 0x08, 0x31, 0xEE, 0xAB, 0x05, 0xAF, 0x79, 0xA0, 0x18, 0x46, 0x6D, 0xFC, 0x89, 0xD4, 0xC7,
+        0xFF, 0xF0, 0xCF, 0x42, 0x91, 0xF8, 0x68, 0x0A, 0x65, 0x8E, 0xB6, 0xFD, 0xC3, 0xEF, 0x78, 0x4C,
+        0xCC, 0x9E, 0x30, 0x2E, 0xBC, 0x0B, 0x54, 0x1A, 0xA6, 0xBB, 0x26, 0x80, 0x48, 0x94, 0x32, 0x7D,
+        0xA7, 0x3F, 0xAE, 0x22, 0x3D, 0x66, 0xAA, 0xF6, 0x00, 0x5D, 0xBD, 0x4A, 0xE0, 0x3B, 0xB4, 0x17,
+        0x8B, 0x9F, 0x76, 0xB0, 0x24, 0x9A, 0x25, 0x63, 0xDB, 0xEB, 0x7A, 0x3E, 0x5C, 0xB3, 0xB1, 0x29,
+        0xF2, 0xCA, 0x58, 0x6E, 0xD8, 0xA8, 0x2F, 0x75, 0xDF, 0x14, 0xFB, 0x13, 0x49, 0x88, 0xB2, 0xEC,
+        0xE4, 0x34, 0x2D, 0x96, 0xC6, 0x3A, 0xED, 0x95, 0x0E, 0xE5, 0x85, 0x6B, 0x40, 0x21, 0x9B, 0x09,
+        0x19, 0x2B, 0x52, 0xDE, 0x45, 0xA3, 0xFA, 0x51, 0xC2, 0xB5, 0xD1, 0x90, 0xB9, 0xF3, 0x37, 0xC1,
+        0x0D, 0xBA, 0x41, 0x11, 0x38, 0x7B, 0xBE, 0xD0, 0xD5, 0x69, 0x36, 0xC8, 0x62, 0x1B, 0x82, 0x8F
+    },
+    {
+        0x83, 0xF2, 0x2A, 0xEB, 0xE9, 0xBF, 0x7B, 0x9C, 0x34, 0x96, 0x8D, 0x98, 0xB9, 0x69, 0x8C, 0x29,
+        0x3D, 0x88, 0x68, 0x06, 0x39, 0x11, 0x4C, 0x0E, 0xA0, 0x56, 0x40, 0x92, 0x15, 0xBC, 0xB3, 0xDC,
+        0x6F, 0xF8, 0x26, 0xBA, 0xBE, 0xBD, 0x31, 0xFB, 0xC3, 0xFE, 0x80, 0x61, 0xE1, 0x7A, 0x32, 0xD2,
+        0x70, 0x20, 0xA1, 0x45, 0xEC, 0xD9, 0x1A, 0x5D, 0xB4, 0xD8, 0x09, 0xA5, 0x55, 0x8E, 0x37, 0x76,
+        0xA9, 0x67, 0x10, 0x17, 0x36, 0x65, 0xB1, 0x95, 0x62, 0x59, 0x74, 0xA3, 0x50, 0x2F, 0x4B, 0xC8,
+        0xD0, 0x8F, 0xCD, 0xD4, 0x3C, 0x86, 0x12, 0x1D, 0x23, 0xEF, 0xF4, 0x53, 0x19, 0x35, 0xE6, 0x7F,
+        0x5E, 0xD6, 0x79, 0x51, 0x22, 0x14, 0xF7, 0x1E, 0x4A, 0x42, 0x9B, 0x41, 0x73, 0x2D, 0xC1, 0x5C,
+        0xA6, 0xA2, 0xE0, 0x2E, 0xD3, 0x28, 0xBB, 0xC9, 0xAE, 0x6A, 0xD1, 0x5A, 0x30, 0x90, 0x84, 0xF9,
+        0xB2, 0x58, 0xCF, 0x7E, 0xC5, 0xCB, 0x97, 0xE4, 0x16, 0x6C, 0xFA, 0xB0, 0x6D, 0x1F, 0x52, 0x99,
+        0x0D, 0x4E, 0x03, 0x91, 0xC2, 0x4D, 0x64, 0x77, 0x9F, 0xDD, 0xC4, 0x49, 0x8A, 0x9A, 0x24, 0x38,
+        0xA7, 0x57, 0x85, 0xC7, 0x7C, 0x7D, 0xE7, 0xF6, 0xB7, 0xAC, 0x27, 0x46, 0xDE, 0xDF, 0x3B, 0xD7,
+        0x9E, 0x2B, 0x0B, 0xD5, 0x13, 0x75, 0xF0, 0x72, 0xB6, 0x9D, 0x1B, 0x01, 0x3F, 0x44, 0xE5, 0x87,
+        0xFD, 0x07, 0xF1, 0xAB, 0x94, 0x18, 0xEA, 0xFC, 0x3A, 0x82, 0x5F, 0x05, 0x54, 0xDB, 0x00, 0x8B,
+        0xE3, 0x48, 0x0C, 0xCA, 0x78, 0x89, 0x0A, 0xFF, 0x3E, 0x5B, 0x81, 0xEE, 0x71, 0xE2, 0xDA, 0x2C,
+        0xB8, 0xB5, 0xCC, 0x6E, 0xA8, 0x6B, 0xAD, 0x60, 0xC6, 0x08, 0x04, 0x02, 0xE8, 0xF5, 0x4F, 0xA4,
+        0xF3, 0xC0, 0xCE, 0x43, 0x25, 0x1C, 0x21, 0x33, 0x0F, 0xAF, 0x47, 0xED, 0x66, 0x63, 0x93, 0xAA
+    },
+    {
+        0x45, 0xD4, 0x0B, 0x43, 0xF1, 0x72, 0xED, 0xA4, 0xC2, 0x38, 0xE6, 0x71, 0xFD, 0xB6, 0x3A, 0x95,
+        0x50, 0x44, 0x4B, 0xE2, 0x74, 0x6B, 0x1E, 0x11, 0x5A, 0xC6, 0xB4, 0xD8, 0xA5, 0x8A, 0x70, 0xA3,
+        0xA8, 0xFA, 0x05, 0xD9, 0x97, 0x40, 0xC9, 0x90, 0x98, 0x8F, 0xDC, 0x12, 0x31, 0x2C, 0x47, 0x6A,
+        0x99, 0xAE, 0xC8, 0x7F, 0xF9, 0x4F, 0x5D, 0x96, 0x6F, 0xF4, 0xB3, 0x39, 0x21, 0xDA, 0x9C, 0x85,
+        0x9E, 0x3B, 0xF0, 0xBF, 0xEF, 0x06, 0xEE, 0xE5, 0x5F, 0x20, 0x10, 0xCC, 0x3C, 0x54, 0x4A, 0x52,
+        0x94, 0x0E, 0xC0, 0x28, 0xF6, 0x56, 0x60, 0xA2, 0xE3, 0x0F, 0xEC, 0x9D, 0x24, 0x83, 0x7E, 0xD5,
+        0x7C, 0xEB, 0x18, 0xD7, 0xCD, 0xDD, 0x78, 0xFF, 0xDB, 0xA1, 0x09, 0xD0, 0x76, 0x84, 0x75, 0xBB,
+        0x1D, 0x1A, 0x2F, 0xB0, 0xFE, 0xD6, 0x34, 0x63, 0x35, 0xD2, 0x2A, 0x59, 0x6D, 0x4D, 0x77, 0xE7,
+        0x8E, 0x61, 0xCF, 0x9F, 0xCE, 0x27, 0xF5, 0x80, 0x86, 0xC7, 0xA6, 0xFB, 0xF8, 0x87, 0xAB, 0x62,
+        0x3F, 0xDF, 0x48, 0x00, 0x14, 0x9A, 0xBD, 0x5B, 0x04, 0x92, 0x02, 0x25, 0x65, 0x4C, 0x53, 0x0C,
+        0xF2, 0x29, 0xAF, 0x17, 0x6C, 0x41, 0x30, 0xE9, 0x93, 0x55, 0xF7, 0xAC, 0x68, 0x26, 0xC4, 0x7D,
+        0xCA, 0x7A, 0x3E, 0xA0, 0x37, 0x03, 0xC1, 0x36, 0x69, 0x66, 0x08, 0x16, 0xA7, 0xBC, 0xC5, 0xD3,
+        0x22, 0xB7, 0x13, 0x46, 0x32, 0xE8, 0x57, 0x88, 0x2B, 0x81, 0xB2, 0x4E, 0x64, 0x1C, 0xAA, 0x91,
+        0x58, 0x2E, 0x9B, 0x5C, 0x1B, 0x51, 0x73, 0x42, 0x23, 0x01, 0x6E, 0xF3, 0x0D, 0xBE, 0x3D, 0x0A,
+        0x2D, 0x1F, 0x67, 0x33, 0x19, 0x7B, 0x5E, 0xEA, 0xDE, 0x8B, 0xCB, 0xA9, 0x8C, 0x8D, 0xAD, 0x49,
+        0x82, 0xE4, 0xBA, 0xC3, 0x15, 0xD1, 0xE0, 0x89, 0xFC, 0xB1, 0xB9, 0xB5, 0x07, 0x79, 0xB8, 0xE1
+    },
+    {
+        0xB2, 0xB6, 0x23, 0x11, 0xA7, 0x88, 0xC5, 0xA6, 0x39, 0x8F, 0xC4, 0xE8, 0x73, 0x22, 0x43, 0xC3,
+        0x82, 0x27, 0xCD, 0x18, 0x51, 0x62, 0x2D, 0xF7, 0x5C, 0x0E, 0x3B, 0xFD, 0xCA, 0x9B, 0x0D, 0x0F,
+        0x79, 0x8C, 0x10, 0x4C, 0x74, 0x1C, 0x0A, 0x8E, 0x7C, 0x94, 0x07, 0xC7, 0x5E, 0x14, 0xA1, 0x21,
+        0x57, 0x50, 0x4E, 0xA9, 0x80, 0xD9, 0xEF, 0x64, 0x41, 0xCF, 0x3C, 0xEE, 0x2E, 0x13, 0x29, 0xBA,
+        0x34, 0x5A, 0xAE, 0x8A, 0x61, 0x33, 0x12, 0xB9, 0x55, 0xA8, 0x15, 0x05, 0xF6, 0x03, 0x06, 0x49,
+        0xB5, 0x25, 0x09, 0x16, 0x0C, 0x2A, 0x38, 0xFC, 0x20, 0xF4, 0xE5, 0x7F, 0xD7, 0x31, 0x2B, 0x66,
+        0x6F, 0xFF, 0x72, 0x86, 0xF0, 0xA3, 0x2F, 0x78, 0x00, 0xBC, 0xCC, 0xE2, 0xB0, 0xF1, 0x42, 0xB4,
+        0x30, 0x5F, 0x60, 0x04, 0xEC, 0xA5, 0xE3, 0x8B, 0xE7, 0x1D, 0xBF, 0x84, 0x7B, 0xE6, 0x81, 0xF8,
+        0xDE, 0xD8, 0xD2, 0x17, 0xCE, 0x4B, 0x47, 0xD6, 0x69, 0x6C, 0x19, 0x99, 0x9A, 0x01, 0xB3, 0x85,
+        0xB1, 0xF9, 0x59, 0xC2, 0x37, 0xE9, 0xC8, 0xA0, 0xED, 0x4F, 0x89, 0x68, 0x6D, 0xD5, 0x26, 0x91,
+        0x87, 0x58, 0xBD, 0xC9, 0x98, 0xDC, 0x75, 0xC0, 0x76, 0xF5, 0x67, 0x6B, 0x7E, 0xEB, 0x52, 0xCB,
+        0xD1, 0x5B, 0x9F, 0x0B, 0xDB, 0x40, 0x92, 0x1A, 0xFA, 0xAC, 0xE4, 0xE1, 0x71, 0x1F, 0x65, 0x8D,
+        0x97, 0x9E, 0x95, 0x90, 0x5D, 0xB7, 0xC1, 0xAF, 0x54, 0xFB, 0x02, 0xE0, 0x35, 0xBB, 0x3A, 0x4D,
+        0xAD, 0x2C, 0x3D, 0x56, 0x08, 0x1B, 0x4A, 0x93, 0x6A, 0xAB, 0xB8, 0x7A, 0xF2, 0x7D, 0xDA, 0x3F,
+        0xFE, 0x3E, 0xBE, 0xEA, 0xAA, 0x44, 0xC6, 0xD0, 0x36, 0x48, 0x70, 0x96, 0x77, 0x24, 0x53, 0xDF,
+        0xF3, 0x83, 0x28, 0x32, 0x45, 0x1E, 0xA4, 0xD3, 0xA2, 0x46, 0x6E, 0x9C, 0xDD, 0x63, 0xD4, 0x9D
+    }
+};
+
+NAMESPACE_END
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/keccak.cpp b/runtime/third_party/cryptopp/keccak.cpp
new file mode 100644
index 0000000..1b83beb
--- /dev/null
+++ b/runtime/third_party/cryptopp/keccak.cpp
@@ -0,0 +1,67 @@
+// keccak.cpp - modified by Wei Dai from Ronny Van Keer's public domain
+//              sha3-simple.c. All modifications here are placed in the
+//              public domain by Wei Dai.
+//              Keccack core function moved to keccakc.cpp in AUG 2018
+//              by Jeffrey Walton. Separating the core file allows both
+//              SHA3 and Keccack to share the core implementation.
+
+/*
+The Keccak sponge function, designed by Guido Bertoni, Joan Daemen,
+Michael Peeters and Gilles Van Assche. For more information, feedback or
+questions, please refer to our website: http://keccak.noekeon.org/
+
+Implementation by Ronny Van Keer, hereby denoted as "the implementer".
+
+To the extent possible under law, the implementer has waived all copyright
+and related or neighboring rights to the source code in this file.
+http://creativecommons.org/publicdomain/zero/1.0/
+*/
+
+#include "pch.h"
+#include "keccak.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// The Keccak core function
+extern void KeccakF1600(word64 *state);
+
+void Keccak::Update(const byte *input, size_t length)
+{
+    CRYPTOPP_ASSERT(!(input == NULLPTR && length != 0));
+    if (length == 0) { return; }
+
+    size_t spaceLeft;
+    while (length >= (spaceLeft = r() - m_counter))
+    {
+        if (spaceLeft)
+            xorbuf(m_state.BytePtr() + m_counter, input, spaceLeft);
+        KeccakF1600(m_state);
+        input += spaceLeft;
+        length -= spaceLeft;
+        m_counter = 0;
+    }
+
+    if (length)
+        xorbuf(m_state.BytePtr() + m_counter, input, length);
+    m_counter += (unsigned int)length;
+}
+
+void Keccak::Restart()
+{
+    std::memset(m_state, 0, m_state.SizeInBytes());
+    m_counter = 0;
+}
+
+void Keccak::TruncatedFinal(byte *hash, size_t size)
+{
+    CRYPTOPP_ASSERT(hash != NULLPTR);
+    ThrowIfInvalidTruncatedSize(size);
+
+    m_state.BytePtr()[m_counter] ^= 0x01;
+    m_state.BytePtr()[r()-1] ^= 0x80;
+    KeccakF1600(m_state);
+    std::memcpy(hash, m_state, size);
+    Restart();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/keccak.h b/runtime/third_party/cryptopp/keccak.h
new file mode 100644
index 0000000..2d9e360
--- /dev/null
+++ b/runtime/third_party/cryptopp/keccak.h
@@ -0,0 +1,118 @@
+// keccak.h - originally written and placed in the public domain by Wei Dai
+
+/// \file keccak.h
+/// \brief Classes for Keccak message digests
+/// \details The Crypto++ Keccak implementation uses F1600 with XOF d=0x01.
+///   FIPS 202 conformance (XOF d=0x06) is available in SHA3 classes.
+/// \details Keccak will likely change in the future to accommodate extensibility of the
+///   round function and the XOF functions.
+/// \sa <a href="http://en.wikipedia.org/wiki/Keccak">Keccak</a>
+/// \since Crypto++ 5.6.4
+
+#ifndef CRYPTOPP_KECCAK_H
+#define CRYPTOPP_KECCAK_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Keccak message digest base class
+/// \details The Crypto++ Keccak implementation uses F1600 with XOF d=0x01.
+///   FIPS 202 conformance (XOF d=0x06) is available in SHA3 classes.
+/// \details Keccak is the base class for Keccak_224, Keccak_256, Keccak_384 and Keccak_512.
+///   Library users should instantiate a derived class, and only use Keccak
+///   as a base class reference or pointer.
+/// \details Keccak will likely change in the future to accommodate extensibility of the
+///   round function and the XOF functions.
+/// \details Perform the following to specify a different digest size. The class will use F1600,
+///   XOF d=0x01, and a new value for <tt>r()</tt> (which will be <tt>200-2*24 = 152</tt>).
+///   <pre>  Keccack_192 : public Keccack
+///   {
+///     public:
+///       CRYPTOPP_CONSTANT(DIGESTSIZE = 24);
+///       Keccack_192() : Keccack(DIGESTSIZE) {}
+///   };
+///   </pre>
+///
+/// \sa SHA3, Keccak_224, Keccak_256, Keccak_384 and Keccak_512.
+/// \since Crypto++ 5.6.4
+class Keccak : public HashTransformation
+{
+protected:
+    /// \brief Construct a Keccak
+    /// \param digestSize the digest size, in bytes
+    /// \details Keccak is the base class for Keccak_224, Keccak_256, Keccak_384 and Keccak_512.
+    ///   Library users should instantiate a derived class, and only use Keccak
+    ///   as a base class reference or pointer.
+    /// \details This constructor was moved to protected at Crypto++ 8.1
+    ///   because users were attempting to create Keccak objects with it.
+    /// \since Crypto++ 5.6.4
+    Keccak(unsigned int digestSize) : m_digestSize(digestSize) {Restart();}
+
+public:
+    unsigned int DigestSize() const {return m_digestSize;}
+    unsigned int OptimalDataAlignment() const {return GetAlignmentOf<word64>();}
+
+    void Update(const byte *input, size_t length);
+    void Restart();
+    void TruncatedFinal(byte *hash, size_t size);
+
+protected:
+    inline unsigned int r() const {return BlockSize();}
+
+    FixedSizeSecBlock<word64, 25> m_state;
+    unsigned int m_digestSize, m_counter;
+};
+
+/// \brief Keccak message digest template
+/// \tparam T_DigestSize the size of the digest, in bytes
+/// \since Crypto++ 6.0
+template<unsigned int T_DigestSize>
+class Keccak_Final : public Keccak
+{
+public:
+    CRYPTOPP_CONSTANT(DIGESTSIZE = T_DigestSize);
+    CRYPTOPP_CONSTANT(BLOCKSIZE = 200 - 2 * DIGESTSIZE);
+    static std::string StaticAlgorithmName()
+        { return "Keccak-" + IntToString(DIGESTSIZE * 8); }
+
+    /// \brief Construct a Keccak-X message digest
+    Keccak_Final() : Keccak(DIGESTSIZE) {}
+
+    /// \brief Provides the block size of the compression function
+    /// \return block size of the compression function, in bytes
+    /// \details BlockSize() will return 0 if the hash is not block based
+    ///   or does not have an equivalent block size. For example, Keccak
+    ///   and SHA-3 do not have a block size, but they do have an equivalent
+    ///   block size called rate expressed as <tt>r</tt>.
+    unsigned int BlockSize() const { return BLOCKSIZE; }
+
+    std::string AlgorithmName() const { return StaticAlgorithmName(); }
+
+private:
+#if !defined(__BORLANDC__)
+    // ensure there was no underflow in the math
+    CRYPTOPP_COMPILE_ASSERT(BLOCKSIZE < 200);
+#endif
+};
+
+/// \brief Keccak-224 message digest
+/// \since Crypto++ 5.6.4
+DOCUMENTED_TYPEDEF(Keccak_Final<28>, Keccak_224);
+
+/// \brief Keccak-256 message digest
+/// \since Crypto++ 5.6.4
+DOCUMENTED_TYPEDEF(Keccak_Final<32>, Keccak_256);
+
+/// \brief Keccak-384 message digest
+/// \since Crypto++ 5.6.4
+DOCUMENTED_TYPEDEF(Keccak_Final<48>, Keccak_384);
+
+/// \brief Keccak-512 message digest
+/// \since Crypto++ 5.6.4
+DOCUMENTED_TYPEDEF(Keccak_Final<64>, Keccak_512);
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/keccak_core.cpp b/runtime/third_party/cryptopp/keccak_core.cpp
new file mode 100644
index 0000000..e06547c
--- /dev/null
+++ b/runtime/third_party/cryptopp/keccak_core.cpp
@@ -0,0 +1,261 @@
+// keccakc.cpp - Keccak core functions shared between SHA3 and Keccak.
+//               written and placed in the public domain by JW.
+
+/*
+The Keccak sponge function, designed by Guido Bertoni, Joan Daemen,
+Michael Peeters and Gilles Van Assche. For more information, feedback or
+questions, please refer to our website: http://keccak.noekeon.org/
+
+Implementation by Ronny Van Keer, hereby denoted as "the implementer".
+
+To the extent possible under law, the implementer has waived all copyright
+and related or neighboring rights to the source code in this file.
+http://creativecommons.org/publicdomain/zero/1.0/
+*/
+
+#include "pch.h"
+#include "keccak.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// The Keccak core function
+extern void KeccakF1600(word64 *state);
+// The F1600 round constants
+extern const word64 KeccakF1600Constants[24];
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+CRYPTOPP_ALIGN_DATA(8)
+const word64 KeccakF1600Constants[24] =
+{
+    W64LIT(0x0000000000000001), W64LIT(0x0000000000008082),
+    W64LIT(0x800000000000808a), W64LIT(0x8000000080008000),
+    W64LIT(0x000000000000808b), W64LIT(0x0000000080000001),
+    W64LIT(0x8000000080008081), W64LIT(0x8000000000008009),
+    W64LIT(0x000000000000008a), W64LIT(0x0000000000000088),
+    W64LIT(0x0000000080008009), W64LIT(0x000000008000000a),
+    W64LIT(0x000000008000808b), W64LIT(0x800000000000008b),
+    W64LIT(0x8000000000008089), W64LIT(0x8000000000008003),
+    W64LIT(0x8000000000008002), W64LIT(0x8000000000000080),
+    W64LIT(0x000000000000800a), W64LIT(0x800000008000000a),
+    W64LIT(0x8000000080008081), W64LIT(0x8000000000008080),
+    W64LIT(0x0000000080000001), W64LIT(0x8000000080008008)
+};
+
+void KeccakF1600(word64 *state)
+{
+    word64 Aba, Abe, Abi, Abo, Abu;
+    word64 Aga, Age, Agi, Ago, Agu;
+    word64 Aka, Ake, Aki, Ako, Aku;
+    word64 Ama, Ame, Ami, Amo, Amu;
+    word64 Asa, Ase, Asi, Aso, Asu;
+    word64 BCa, BCe, BCi, BCo, BCu;
+    word64 Da, De, Di, Do, Du;
+    word64 Eba, Ebe, Ebi, Ebo, Ebu;
+    word64 Ega, Ege, Egi, Ego, Egu;
+    word64 Eka, Eke, Eki, Eko, Eku;
+    word64 Ema, Eme, Emi, Emo, Emu;
+    word64 Esa, Ese, Esi, Eso, Esu;
+
+    typedef BlockGetAndPut<word64, LittleEndian, true, true> Block;
+    Block::Get(state)(Aba)(Abe)(Abi)(Abo)(Abu)(Aga)(Age)(Agi)(Ago)(Agu)(Aka)(Ake)(Aki)(Ako)(Aku)(Ama)(Ame)(Ami)(Amo)(Amu)(Asa)(Ase)(Asi)(Aso)(Asu);
+
+    for( unsigned int round = 0; round < 24; round += 2 )
+    {
+        //    prepareTheta
+        BCa = Aba^Aga^Aka^Ama^Asa;
+        BCe = Abe^Age^Ake^Ame^Ase;
+        BCi = Abi^Agi^Aki^Ami^Asi;
+        BCo = Abo^Ago^Ako^Amo^Aso;
+        BCu = Abu^Agu^Aku^Amu^Asu;
+
+        //thetaRhoPiChiIotaPrepareTheta(round  , A, E)
+        Da = BCu^rotlConstant<1>(BCe);
+        De = BCa^rotlConstant<1>(BCi);
+        Di = BCe^rotlConstant<1>(BCo);
+        Do = BCi^rotlConstant<1>(BCu);
+        Du = BCo^rotlConstant<1>(BCa);
+
+        Aba ^= Da;
+        BCa = Aba;
+        Age ^= De;
+        BCe = rotlConstant<44>(Age);
+        Aki ^= Di;
+        BCi = rotlConstant<43>(Aki);
+        Amo ^= Do;
+        BCo = rotlConstant<21>(Amo);
+        Asu ^= Du;
+        BCu = rotlConstant<14>(Asu);
+        Eba = BCa ^((~BCe)&  BCi );
+        Eba ^= KeccakF1600Constants[round];
+        Ebe = BCe ^((~BCi)&  BCo );
+        Ebi = BCi ^((~BCo)&  BCu );
+        Ebo = BCo ^((~BCu)&  BCa );
+        Ebu = BCu ^((~BCa)&  BCe );
+
+        Abo ^= Do;
+        BCa = rotlConstant<28>(Abo);
+        Agu ^= Du;
+        BCe = rotlConstant<20>(Agu);
+        Aka ^= Da;
+        BCi = rotlConstant<3>(Aka);
+        Ame ^= De;
+        BCo = rotlConstant<45>(Ame);
+        Asi ^= Di;
+        BCu = rotlConstant<61>(Asi);
+        Ega = BCa ^((~BCe)&  BCi );
+        Ege = BCe ^((~BCi)&  BCo );
+        Egi = BCi ^((~BCo)&  BCu );
+        Ego = BCo ^((~BCu)&  BCa );
+        Egu = BCu ^((~BCa)&  BCe );
+
+        Abe ^= De;
+        BCa = rotlConstant<1>(Abe);
+        Agi ^= Di;
+        BCe = rotlConstant<6>(Agi);
+        Ako ^= Do;
+        BCi = rotlConstant<25>(Ako);
+        Amu ^= Du;
+        BCo = rotlConstant<8>(Amu);
+        Asa ^= Da;
+        BCu = rotlConstant<18>(Asa);
+        Eka = BCa ^((~BCe)&  BCi );
+        Eke = BCe ^((~BCi)&  BCo );
+        Eki = BCi ^((~BCo)&  BCu );
+        Eko = BCo ^((~BCu)&  BCa );
+        Eku = BCu ^((~BCa)&  BCe );
+
+        Abu ^= Du;
+        BCa = rotlConstant<27>(Abu);
+        Aga ^= Da;
+        BCe = rotlConstant<36>(Aga);
+        Ake ^= De;
+        BCi = rotlConstant<10>(Ake);
+        Ami ^= Di;
+        BCo = rotlConstant<15>(Ami);
+        Aso ^= Do;
+        BCu = rotlConstant<56>(Aso);
+        Ema = BCa ^((~BCe)&  BCi );
+        Eme = BCe ^((~BCi)&  BCo );
+        Emi = BCi ^((~BCo)&  BCu );
+        Emo = BCo ^((~BCu)&  BCa );
+        Emu = BCu ^((~BCa)&  BCe );
+
+        Abi ^= Di;
+        BCa = rotlConstant<62>(Abi);
+        Ago ^= Do;
+        BCe = rotlConstant<55>(Ago);
+        Aku ^= Du;
+        BCi = rotlConstant<39>(Aku);
+        Ama ^= Da;
+        BCo = rotlConstant<41>(Ama);
+        Ase ^= De;
+        BCu = rotlConstant<2>(Ase);
+        Esa = BCa ^((~BCe)&  BCi );
+        Ese = BCe ^((~BCi)&  BCo );
+        Esi = BCi ^((~BCo)&  BCu );
+        Eso = BCo ^((~BCu)&  BCa );
+        Esu = BCu ^((~BCa)&  BCe );
+
+        //    prepareTheta
+        BCa = Eba^Ega^Eka^Ema^Esa;
+        BCe = Ebe^Ege^Eke^Eme^Ese;
+        BCi = Ebi^Egi^Eki^Emi^Esi;
+        BCo = Ebo^Ego^Eko^Emo^Eso;
+        BCu = Ebu^Egu^Eku^Emu^Esu;
+
+        //thetaRhoPiChiIotaPrepareTheta(round+1, E, A)
+        Da = BCu^rotlConstant<1>(BCe);
+        De = BCa^rotlConstant<1>(BCi);
+        Di = BCe^rotlConstant<1>(BCo);
+        Do = BCi^rotlConstant<1>(BCu);
+        Du = BCo^rotlConstant<1>(BCa);
+
+        Eba ^= Da;
+        BCa = Eba;
+        Ege ^= De;
+        BCe = rotlConstant<44>(Ege);
+        Eki ^= Di;
+        BCi = rotlConstant<43>(Eki);
+        Emo ^= Do;
+        BCo = rotlConstant<21>(Emo);
+        Esu ^= Du;
+        BCu = rotlConstant<14>(Esu);
+        Aba = BCa ^((~BCe)&  BCi );
+        Aba ^= KeccakF1600Constants[round+1];
+        Abe = BCe ^((~BCi)&  BCo );
+        Abi = BCi ^((~BCo)&  BCu );
+        Abo = BCo ^((~BCu)&  BCa );
+        Abu = BCu ^((~BCa)&  BCe );
+
+        Ebo ^= Do;
+        BCa = rotlConstant<28>(Ebo);
+        Egu ^= Du;
+        BCe = rotlConstant<20>(Egu);
+        Eka ^= Da;
+        BCi = rotlConstant<3>(Eka);
+        Eme ^= De;
+        BCo = rotlConstant<45>(Eme);
+        Esi ^= Di;
+        BCu = rotlConstant<61>(Esi);
+        Aga = BCa ^((~BCe)&  BCi );
+        Age = BCe ^((~BCi)&  BCo );
+        Agi = BCi ^((~BCo)&  BCu );
+        Ago = BCo ^((~BCu)&  BCa );
+        Agu = BCu ^((~BCa)&  BCe );
+
+        Ebe ^= De;
+        BCa = rotlConstant<1>(Ebe);
+        Egi ^= Di;
+        BCe = rotlConstant<6>(Egi);
+        Eko ^= Do;
+        BCi = rotlConstant<25>(Eko);
+        Emu ^= Du;
+        BCo = rotlConstant<8>(Emu);
+        Esa ^= Da;
+        BCu = rotlConstant<18>(Esa);
+        Aka = BCa ^((~BCe)&  BCi );
+        Ake = BCe ^((~BCi)&  BCo );
+        Aki = BCi ^((~BCo)&  BCu );
+        Ako = BCo ^((~BCu)&  BCa );
+        Aku = BCu ^((~BCa)&  BCe );
+
+        Ebu ^= Du;
+        BCa = rotlConstant<27>(Ebu);
+        Ega ^= Da;
+        BCe = rotlConstant<36>(Ega);
+        Eke ^= De;
+        BCi = rotlConstant<10>(Eke);
+        Emi ^= Di;
+        BCo = rotlConstant<15>(Emi);
+        Eso ^= Do;
+        BCu = rotlConstant<56>(Eso);
+        Ama = BCa ^((~BCe)&  BCi );
+        Ame = BCe ^((~BCi)&  BCo );
+        Ami = BCi ^((~BCo)&  BCu );
+        Amo = BCo ^((~BCu)&  BCa );
+        Amu = BCu ^((~BCa)&  BCe );
+
+        Ebi ^= Di;
+        BCa = rotlConstant<62>(Ebi);
+        Ego ^= Do;
+        BCe = rotlConstant<55>(Ego);
+        Eku ^= Du;
+        BCi = rotlConstant<39>(Eku);
+        Ema ^= Da;
+        BCo = rotlConstant<41>(Ema);
+        Ese ^= De;
+        BCu = rotlConstant<2>(Ese);
+        Asa = BCa ^((~BCe)&  BCi );
+        Ase = BCe ^((~BCi)&  BCo );
+        Asi = BCi ^((~BCo)&  BCu );
+        Aso = BCo ^((~BCu)&  BCa );
+        Asu = BCu ^((~BCa)&  BCe );
+    }
+
+    Block::Put(NULLPTR, state)(Aba)(Abe)(Abi)(Abo)(Abu)(Aga)(Age)(Agi)(Ago)(Agu)(Aka)(Ake)(Aki)(Ako)(Aku)(Ama)(Ame)(Ami)(Amo)(Amu)(Asa)(Ase)(Asi)(Aso)(Asu);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/keccak_simd.cpp b/runtime/third_party/cryptopp/keccak_simd.cpp
new file mode 100644
index 0000000..3fff498
--- /dev/null
+++ b/runtime/third_party/cryptopp/keccak_simd.cpp
@@ -0,0 +1,2681 @@
+// keccak_simd.cpp - written and placed in the public domain by Jeffrey Walton.
+//
+//    This source file uses intrinsics to gain access to SSE and
+//    NEON instructions. A separate source file is needed because
+//    additional CXXFLAGS are required to enable the appropriate
+//    instructions sets in some build configurations.
+
+// The XKCP package is provided by Guido Bertoni, Joan Daemen, Seth Hoffert,
+// Michael Peeters, Gilles Van Assche, and Ronny Van Keer. The code was
+// placed public domain by the authors.
+
+// KeccakF1600x2_SSE is ParallelHash128. The SSE2 ParallelHash128
+// implementation was extracted from XKCP using the following command.
+//
+// gcc -I lib/common -I lib/low/KeccakP-1600/Optimized
+//   -I lib/low/KeccakP-1600-times2/SIMD128/SSE2ufull
+//   lib/low/KeccakP-1600-times2/SIMD128/KeccakP-1600-times2-SIMD128.c -E
+
+#include "pch.h"
+#include "config.h"
+#include "keccak.h"
+#include "misc.h"
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+# include <emmintrin.h>
+# include <tmmintrin.h>
+#endif
+
+#if defined(__XOP__)
+# if defined(CRYPTOPP_GCC_COMPATIBLE)
+#  include <x86intrin.h>
+# endif
+# include <ammintrin.h>
+#endif  // XOP
+
+// Squash MS LNK4221 and libtool warnings
+extern const char KECCAK_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+
+// The Keccak ParallelHash128 core function
+extern void KeccakF1600x2_SSE(word64 *state);
+
+// The F1600 round constants
+extern const word64 KeccakF1600Constants[24];
+
+CRYPTOPP_ALIGN_DATA(16)
+const word64
+rho8[2] = {W64LIT(0x0605040302010007), W64LIT(0x0E0D0C0B0A09080F)};
+
+CRYPTOPP_ALIGN_DATA(16)
+const word64
+rho56[2] = {W64LIT(0x0007060504030201), W64LIT(0x080F0E0D0C0B0A09)};
+
+#if defined(__XOP__)
+# define ROL64in128(a, o)    _mm_roti_epi64((a), (o))
+# define ROL64in128_8(a)     ROL64in128((a), 8)
+# define ROL64in128_56(a)    ROL64in128((a), 56)
+#else
+# define ROL64in128(a, o)    _mm_or_si128(_mm_slli_epi64((a), (o)), _mm_srli_epi64(a, 64-(o)))
+# define ROL64in128_8(a)     _mm_shuffle_epi8((a), _mm_load_si128(CONST_M128_CAST(rho8)))
+# define ROL64in128_56(a)    _mm_shuffle_epi8((a), _mm_load_si128(CONST_M128_CAST(rho56)))
+#endif
+
+// Damn Visual Studio is missing too many intrinsics...
+inline __m128i SPLAT64(const word64 a)
+{
+#if defined(CRYPTOPP_MSC_VERSION)
+    double x; std::memcpy(&x, &a, 8);
+    return _mm_castpd_si128(_mm_loaddup_pd(&x));
+#else
+    return _mm_set1_epi64x(a);
+#endif
+}
+
+// The Keccak ParallelHash128 core function
+void KeccakF1600x2_SSE(word64 *state)
+{
+    __m128i Aba, Abe, Abi, Abo, Abu;
+    __m128i Aga, Age, Agi, Ago, Agu;
+    __m128i Aka, Ake, Aki, Ako, Aku;
+    __m128i Ama, Ame, Ami, Amo, Amu;
+    __m128i Asa, Ase, Asi, Aso, Asu;
+    __m128i Bba, Bbe, Bbi, Bbo, Bbu;
+    __m128i Bga, Bge, Bgi, Bgo, Bgu;
+    __m128i Bka, Bke, Bki, Bko, Bku;
+    __m128i Bma, Bme, Bmi, Bmo, Bmu;
+    __m128i Bsa, Bse, Bsi, Bso, Bsu;
+    __m128i Ca, Ce, Ci, Co, Cu;
+    __m128i Da, De, Di, Do, Du;
+    __m128i Eba, Ebe, Ebi, Ebo, Ebu;
+    __m128i Ega, Ege, Egi, Ego, Egu;
+    __m128i Eka, Eke, Eki, Eko, Eku;
+    __m128i Ema, Eme, Emi, Emo, Emu;
+    __m128i Esa, Ese, Esi, Eso, Esu;
+
+    __m128i* lanes = reinterpret_cast<__m128i*>(state);
+    Aba = _mm_loadu_si128(CONST_M128_CAST(lanes+ 0));
+    Abe = _mm_loadu_si128(CONST_M128_CAST(lanes+ 1));
+    Abi = _mm_loadu_si128(CONST_M128_CAST(lanes+ 2));
+    Abo = _mm_loadu_si128(CONST_M128_CAST(lanes+ 3));
+    Abu = _mm_loadu_si128(CONST_M128_CAST(lanes+ 4));
+    Aga = _mm_loadu_si128(CONST_M128_CAST(lanes+ 5));
+    Age = _mm_loadu_si128(CONST_M128_CAST(lanes+ 6));
+    Agi = _mm_loadu_si128(CONST_M128_CAST(lanes+ 7));
+    Ago = _mm_loadu_si128(CONST_M128_CAST(lanes+ 8));
+    Agu = _mm_loadu_si128(CONST_M128_CAST(lanes+ 9));
+    Aka = _mm_loadu_si128(CONST_M128_CAST(lanes+10));
+    Ake = _mm_loadu_si128(CONST_M128_CAST(lanes+11));
+    Aki = _mm_loadu_si128(CONST_M128_CAST(lanes+12));
+    Ako = _mm_loadu_si128(CONST_M128_CAST(lanes+13));
+    Aku = _mm_loadu_si128(CONST_M128_CAST(lanes+14));
+    Ama = _mm_loadu_si128(CONST_M128_CAST(lanes+15));
+    Ame = _mm_loadu_si128(CONST_M128_CAST(lanes+16));
+    Ami = _mm_loadu_si128(CONST_M128_CAST(lanes+17));
+    Amo = _mm_loadu_si128(CONST_M128_CAST(lanes+18));
+    Amu = _mm_loadu_si128(CONST_M128_CAST(lanes+19));
+    Asa = _mm_loadu_si128(CONST_M128_CAST(lanes+20));
+    Ase = _mm_loadu_si128(CONST_M128_CAST(lanes+21));
+    Asi = _mm_loadu_si128(CONST_M128_CAST(lanes+22));
+    Aso = _mm_loadu_si128(CONST_M128_CAST(lanes+23));
+    Asu = _mm_loadu_si128(CONST_M128_CAST(lanes+24));
+
+    Ca = _mm_xor_si128(Aba, _mm_xor_si128(Aga, _mm_xor_si128(Aka, _mm_xor_si128(Ama, Asa))));
+    Ce = _mm_xor_si128(Abe, _mm_xor_si128(Age, _mm_xor_si128(Ake, _mm_xor_si128(Ame, Ase))));
+    Ci = _mm_xor_si128(Abi, _mm_xor_si128(Agi, _mm_xor_si128(Aki, _mm_xor_si128(Ami, Asi))));
+    Co = _mm_xor_si128(Abo, _mm_xor_si128(Ago, _mm_xor_si128(Ako, _mm_xor_si128(Amo, Aso))));
+    Cu = _mm_xor_si128(Abu, _mm_xor_si128(Agu, _mm_xor_si128(Aku, _mm_xor_si128(Amu, Asu))));
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[0]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[1]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[2]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[3]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[4]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[5]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[6]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[7]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[8]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[9]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[10]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[11]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[12]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[13]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[14]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[15]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[16]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[17]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[18]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[19]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[20]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[21]));
+    Ca = Aba;
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Abe;
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Abi;
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Abo;
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Abu;
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Aga);
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Age);
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Agi);
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ago);
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Agu);
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Aka);
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Ake);
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Aki);
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Ako);
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Aku);
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ama);
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Ame);
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Ami);
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Amo);
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Amu);
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Asa);
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ase);
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Asi);
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Aso);
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Asu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Aba = _mm_xor_si128(Aba, Da);
+    Bba = Aba;
+    Age = _mm_xor_si128(Age, De);
+    Bbe = ROL64in128(Age, 44);
+    Aki = _mm_xor_si128(Aki, Di);
+    Bbi = ROL64in128(Aki, 43);
+    Eba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Eba = _mm_xor_si128(Eba, SPLAT64(KeccakF1600Constants[22]));
+    Ca = Eba;
+    Amo = _mm_xor_si128(Amo, Do);
+    Bbo = ROL64in128(Amo, 21);
+    Ebe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Ce = Ebe;
+    Asu = _mm_xor_si128(Asu, Du);
+    Bbu = ROL64in128(Asu, 14);
+    Ebi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Ci = Ebi;
+    Ebo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Co = Ebo;
+    Ebu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Cu = Ebu;
+    Abo = _mm_xor_si128(Abo, Do);
+    Bga = ROL64in128(Abo, 28);
+    Agu = _mm_xor_si128(Agu, Du);
+    Bge = ROL64in128(Agu, 20);
+    Aka = _mm_xor_si128(Aka, Da);
+    Bgi = ROL64in128(Aka, 3);
+    Ega = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Ca = _mm_xor_si128(Ca, Ega);
+    Ame = _mm_xor_si128(Ame, De);
+    Bgo = ROL64in128(Ame, 45);
+    Ege = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Ce = _mm_xor_si128(Ce, Ege);
+    Asi = _mm_xor_si128(Asi, Di);
+    Bgu = ROL64in128(Asi, 61);
+    Egi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ci = _mm_xor_si128(Ci, Egi);
+    Ego = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Co = _mm_xor_si128(Co, Ego);
+    Egu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Cu = _mm_xor_si128(Cu, Egu);
+    Abe = _mm_xor_si128(Abe, De);
+    Bka = ROL64in128(Abe, 1);
+    Agi = _mm_xor_si128(Agi, Di);
+    Bke = ROL64in128(Agi, 6);
+    Ako = _mm_xor_si128(Ako, Do);
+    Bki = ROL64in128(Ako, 25);
+    Eka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Ca = _mm_xor_si128(Ca, Eka);
+    Amu = _mm_xor_si128(Amu, Du);
+    Bko = ROL64in128_8(Amu);
+    Eke = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Ce = _mm_xor_si128(Ce, Eke);
+    Asa = _mm_xor_si128(Asa, Da);
+    Bku = ROL64in128(Asa, 18);
+    Eki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ci = _mm_xor_si128(Ci, Eki);
+    Eko = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Co = _mm_xor_si128(Co, Eko);
+    Eku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Cu = _mm_xor_si128(Cu, Eku);
+    Abu = _mm_xor_si128(Abu, Du);
+    Bma = ROL64in128(Abu, 27);
+    Aga = _mm_xor_si128(Aga, Da);
+    Bme = ROL64in128(Aga, 36);
+    Ake = _mm_xor_si128(Ake, De);
+    Bmi = ROL64in128(Ake, 10);
+    Ema = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Ca = _mm_xor_si128(Ca, Ema);
+    Ami = _mm_xor_si128(Ami, Di);
+    Bmo = ROL64in128(Ami, 15);
+    Eme = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Ce = _mm_xor_si128(Ce, Eme);
+    Aso = _mm_xor_si128(Aso, Do);
+    Bmu = ROL64in128_56(Aso);
+    Emi = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Ci = _mm_xor_si128(Ci, Emi);
+    Emo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Co = _mm_xor_si128(Co, Emo);
+    Emu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Cu = _mm_xor_si128(Cu, Emu);
+    Abi = _mm_xor_si128(Abi, Di);
+    Bsa = ROL64in128(Abi, 62);
+    Ago = _mm_xor_si128(Ago, Do);
+    Bse = ROL64in128(Ago, 55);
+    Aku = _mm_xor_si128(Aku, Du);
+    Bsi = ROL64in128(Aku, 39);
+    Esa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ca = _mm_xor_si128(Ca, Esa);
+    Ama = _mm_xor_si128(Ama, Da);
+    Bso = ROL64in128(Ama, 41);
+    Ese = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ce = _mm_xor_si128(Ce, Ese);
+    Ase = _mm_xor_si128(Ase, De);
+    Bsu = ROL64in128(Ase, 2);
+    Esi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Ci = _mm_xor_si128(Ci, Esi);
+    Eso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Co = _mm_xor_si128(Co, Eso);
+    Esu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+    Cu = _mm_xor_si128(Cu, Esu);
+    Da = _mm_xor_si128(Cu, ROL64in128(Ce, 1));
+    De = _mm_xor_si128(Ca, ROL64in128(Ci, 1));
+    Di = _mm_xor_si128(Ce, ROL64in128(Co, 1));
+    Do = _mm_xor_si128(Ci, ROL64in128(Cu, 1));
+    Du = _mm_xor_si128(Co, ROL64in128(Ca, 1));
+    Eba = _mm_xor_si128(Eba, Da);
+    Bba = Eba;
+    Ege = _mm_xor_si128(Ege, De);
+    Bbe = ROL64in128(Ege, 44);
+    Eki = _mm_xor_si128(Eki, Di);
+    Bbi = ROL64in128(Eki, 43);
+    Aba = _mm_xor_si128(Bba, _mm_andnot_si128(Bbe, Bbi));
+    Aba = _mm_xor_si128(Aba, SPLAT64(KeccakF1600Constants[23]));
+    Emo = _mm_xor_si128(Emo, Do);
+    Bbo = ROL64in128(Emo, 21);
+    Abe = _mm_xor_si128(Bbe, _mm_andnot_si128(Bbi, Bbo));
+    Esu = _mm_xor_si128(Esu, Du);
+    Bbu = ROL64in128(Esu, 14);
+    Abi = _mm_xor_si128(Bbi, _mm_andnot_si128(Bbo, Bbu));
+    Abo = _mm_xor_si128(Bbo, _mm_andnot_si128(Bbu, Bba));
+    Abu = _mm_xor_si128(Bbu, _mm_andnot_si128(Bba, Bbe));
+    Ebo = _mm_xor_si128(Ebo, Do);
+    Bga = ROL64in128(Ebo, 28);
+    Egu = _mm_xor_si128(Egu, Du);
+    Bge = ROL64in128(Egu, 20);
+    Eka = _mm_xor_si128(Eka, Da);
+    Bgi = ROL64in128(Eka, 3);
+    Aga = _mm_xor_si128(Bga, _mm_andnot_si128(Bge, Bgi));
+    Eme = _mm_xor_si128(Eme, De);
+    Bgo = ROL64in128(Eme, 45);
+    Age = _mm_xor_si128(Bge, _mm_andnot_si128(Bgi, Bgo));
+    Esi = _mm_xor_si128(Esi, Di);
+    Bgu = ROL64in128(Esi, 61);
+    Agi = _mm_xor_si128(Bgi, _mm_andnot_si128(Bgo, Bgu));
+    Ago = _mm_xor_si128(Bgo, _mm_andnot_si128(Bgu, Bga));
+    Agu = _mm_xor_si128(Bgu, _mm_andnot_si128(Bga, Bge));
+    Ebe = _mm_xor_si128(Ebe, De);
+    Bka = ROL64in128(Ebe, 1);
+    Egi = _mm_xor_si128(Egi, Di);
+    Bke = ROL64in128(Egi, 6);
+    Eko = _mm_xor_si128(Eko, Do);
+    Bki = ROL64in128(Eko, 25);
+    Aka = _mm_xor_si128(Bka, _mm_andnot_si128(Bke, Bki));
+    Emu = _mm_xor_si128(Emu, Du);
+    Bko = ROL64in128_8(Emu);
+    Ake = _mm_xor_si128(Bke, _mm_andnot_si128(Bki, Bko));
+    Esa = _mm_xor_si128(Esa, Da);
+    Bku = ROL64in128(Esa, 18);
+    Aki = _mm_xor_si128(Bki, _mm_andnot_si128(Bko, Bku));
+    Ako = _mm_xor_si128(Bko, _mm_andnot_si128(Bku, Bka));
+    Aku = _mm_xor_si128(Bku, _mm_andnot_si128(Bka, Bke));
+    Ebu = _mm_xor_si128(Ebu, Du);
+    Bma = ROL64in128(Ebu, 27);
+    Ega = _mm_xor_si128(Ega, Da);
+    Bme = ROL64in128(Ega, 36);
+    Eke = _mm_xor_si128(Eke, De);
+    Bmi = ROL64in128(Eke, 10);
+    Ama = _mm_xor_si128(Bma, _mm_andnot_si128(Bme, Bmi));
+    Emi = _mm_xor_si128(Emi, Di);
+    Bmo = ROL64in128(Emi, 15);
+    Ame = _mm_xor_si128(Bme, _mm_andnot_si128(Bmi, Bmo));
+    Eso = _mm_xor_si128(Eso, Do);
+    Bmu = ROL64in128_56(Eso);
+    Ami = _mm_xor_si128(Bmi, _mm_andnot_si128(Bmo, Bmu));
+    Amo = _mm_xor_si128(Bmo, _mm_andnot_si128(Bmu, Bma));
+    Amu = _mm_xor_si128(Bmu, _mm_andnot_si128(Bma, Bme));
+    Ebi = _mm_xor_si128(Ebi, Di);
+    Bsa = ROL64in128(Ebi, 62);
+    Ego = _mm_xor_si128(Ego, Do);
+    Bse = ROL64in128(Ego, 55);
+    Eku = _mm_xor_si128(Eku, Du);
+    Bsi = ROL64in128(Eku, 39);
+    Asa = _mm_xor_si128(Bsa, _mm_andnot_si128(Bse, Bsi));
+    Ema = _mm_xor_si128(Ema, Da);
+    Bso = ROL64in128(Ema, 41);
+    Ase = _mm_xor_si128(Bse, _mm_andnot_si128(Bsi, Bso));
+    Ese = _mm_xor_si128(Ese, De);
+    Bsu = ROL64in128(Ese, 2);
+    Asi = _mm_xor_si128(Bsi, _mm_andnot_si128(Bso, Bsu));
+    Aso = _mm_xor_si128(Bso, _mm_andnot_si128(Bsu, Bsa));
+    Asu = _mm_xor_si128(Bsu, _mm_andnot_si128(Bsa, Bse));
+
+    _mm_storeu_si128(M128_CAST(lanes+ 0), Aba);
+    _mm_storeu_si128(M128_CAST(lanes+ 1), Abe);
+    _mm_storeu_si128(M128_CAST(lanes+ 2), Abi);
+    _mm_storeu_si128(M128_CAST(lanes+ 3), Abo);
+    _mm_storeu_si128(M128_CAST(lanes+ 4), Abu);
+    _mm_storeu_si128(M128_CAST(lanes+ 5), Aga);
+    _mm_storeu_si128(M128_CAST(lanes+ 6), Age);
+    _mm_storeu_si128(M128_CAST(lanes+ 7), Agi);
+    _mm_storeu_si128(M128_CAST(lanes+ 8), Ago);
+    _mm_storeu_si128(M128_CAST(lanes+ 9), Agu);
+    _mm_storeu_si128(M128_CAST(lanes+10), Aka);
+    _mm_storeu_si128(M128_CAST(lanes+11), Ake);
+    _mm_storeu_si128(M128_CAST(lanes+12), Aki);
+    _mm_storeu_si128(M128_CAST(lanes+13), Ako);
+    _mm_storeu_si128(M128_CAST(lanes+14), Aku);
+    _mm_storeu_si128(M128_CAST(lanes+15), Ama);
+    _mm_storeu_si128(M128_CAST(lanes+16), Ame);
+    _mm_storeu_si128(M128_CAST(lanes+17), Ami);
+    _mm_storeu_si128(M128_CAST(lanes+18), Amo);
+    _mm_storeu_si128(M128_CAST(lanes+19), Amu);
+    _mm_storeu_si128(M128_CAST(lanes+20), Asa);
+    _mm_storeu_si128(M128_CAST(lanes+21), Ase);
+    _mm_storeu_si128(M128_CAST(lanes+22), Asi);
+    _mm_storeu_si128(M128_CAST(lanes+23), Aso);
+    _mm_storeu_si128(M128_CAST(lanes+24), Asu);
+}
+
+#endif
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/lea.cpp b/runtime/third_party/cryptopp/lea.cpp
new file mode 100644
index 0000000..c318a5b
--- /dev/null
+++ b/runtime/third_party/cryptopp/lea.cpp
@@ -0,0 +1,899 @@
+// lea.cpp - written and placed in the public domain by Kim Sung Hee and Jeffrey Walton
+//           Based on "LEA: A 128-Bit Block Cipher for Fast Encryption on Common
+//           Processors" by Deukjo Hong, Jung-Keun Lee, Dong-Chan Kim, Daesung Kwon,
+//           Kwon Ho Ryu, and Dong-Geon Lee.
+//
+//           This implementation is based on source files found in a zip file at the
+//           Korea Internet and Security Agency (https://www.kisa.or.kr/eng/main.jsp).
+//           The zip files was downloaded from the Korean language area of the site so we
+//           don't have a url or english zip filename to cite. The source filename from
+//           the zip is lea_core.c.
+//
+//           The LEA team appears to have applied optimizations to functions in lea_core.c.
+//           The implementation does not exactly follow the aglorithmic description from
+//           the LEA paper.
+
+#include "pch.h"
+#include "config.h"
+
+#include "lea.h"
+#include "misc.h"
+#include "cpu.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+using CryptoPP::rotlConstant;
+
+ANONYMOUS_NAMESPACE_END
+
+const word32 delta[8][36] = {
+    {0xc3efe9db, 0x87dfd3b7, 0x0fbfa76f, 0x1f7f4ede, 0x3efe9dbc, 0x7dfd3b78, 0xfbfa76f0, 0xf7f4ede1,
+    0xefe9dbc3, 0xdfd3b787, 0xbfa76f0f, 0x7f4ede1f, 0xfe9dbc3e, 0xfd3b787d, 0xfa76f0fb, 0xf4ede1f7,
+    0xe9dbc3ef, 0xd3b787df, 0xa76f0fbf, 0x4ede1f7f, 0x9dbc3efe, 0x3b787dfd, 0x76f0fbfa, 0xede1f7f4,
+    0xdbc3efe9, 0xb787dfd3, 0x6f0fbfa7, 0xde1f7f4e, 0xbc3efe9d, 0x787dfd3b, 0xf0fbfa76, 0xe1f7f4eD,
+    0xc3efe9db,    0x87dfd3b7, 0x0fbfa76f, 0x1f7f4ede},
+    {0x44626b02, 0x88c4d604, 0x1189ac09, 0x23135812, 0x4626b024, 0x8c4d6048, 0x189ac091, 0x31358122,
+    0x626b0244, 0xc4d60488, 0x89ac0911, 0x13581223, 0x26b02446, 0x4d60488c, 0x9ac09118, 0x35812231,
+    0x6b024462, 0xd60488c4, 0xac091189, 0x58122313, 0xb0244626, 0x60488c4d, 0xc091189a, 0x81223135,
+    0x0244626b, 0x0488c4d6, 0x091189ac, 0x12231358, 0x244626b0, 0x488c4d60, 0x91189ac0, 0x22313581,
+    0x44626b02, 0x88c4d604, 0x1189ac09, 0x23135812},
+    {0x79e27c8a, 0xf3c4f914, 0xe789f229, 0xcf13e453, 0x9e27c8a7, 0x3c4f914f, 0x789f229e, 0xf13e453c,
+    0xe27c8a79, 0xc4f914f3, 0x89f229e7, 0x13e453cf, 0x27c8a79e, 0x4f914f3c, 0x9f229e78, 0x3e453cf1,
+    0x7c8a79e2, 0xf914f3c4, 0xf229e789, 0xe453cf13, 0xc8a79e27, 0x914f3c4f, 0x229e789f, 0x453cf13e,
+    0x8a79e27c, 0x14f3c4f9, 0x29e789f2, 0x53cf13e4, 0xa79e27c8, 0x4f3c4f91, 0x9e789f22, 0x3cf13e45,
+    0x79e27c8a, 0xf3c4f914, 0xe789f229, 0xcf13e453},
+    {0x78df30ec, 0xf1be61d8, 0xe37cc3b1, 0xc6f98763, 0x8df30ec7, 0x1be61d8f, 0x37cc3b1e, 0x6f98763c,
+    0xdf30ec78, 0xbe61d8f1, 0x7cc3b1e3, 0xf98763c6, 0xf30ec78d, 0xe61d8f1b, 0xcc3b1e37, 0x98763c6f,
+    0x30ec78df, 0x61d8f1be, 0xc3b1e37c, 0x8763c6f9, 0x0ec78df3, 0x1d8f1be6, 0x3b1e37cc, 0x763c6f98,
+    0xec78df30, 0xd8f1be61, 0xb1e37cc3, 0x63c6f987, 0xc78df30e, 0x8f1be61d, 0x1e37cc3b, 0x3c6f9876,
+    0x78df30ec,    0xf1be61d8, 0xe37cc3b1, 0xc6f98763},
+    {0x715ea49e, 0xe2bd493c, 0xc57a9279, 0x8af524f3, 0x15ea49e7, 0x2bd493ce, 0x57a9279c, 0xaf524f38,
+    0x5ea49e71, 0xbd493ce2, 0x7a9279c5, 0xf524f38a, 0xea49e715, 0xd493ce2b, 0xa9279c57, 0x524f38af,
+    0xa49e715e, 0x493ce2bd, 0x9279c57a, 0x24f38af5, 0x49e715ea, 0x93ce2bd4, 0x279c57a9, 0x4f38af52,
+    0x9e715ea4, 0x3ce2bd49, 0x79c57a92, 0xf38af524, 0xe715ea49, 0xce2bd493, 0x9c57a927, 0x38af524f,
+    0x715ea49e,    0xe2bd493c, 0xc57a9279, 0x8af524f3},
+    {0xc785da0a, 0x8f0bb415, 0x1e17682b, 0x3c2ed056, 0x785da0ac, 0xf0bb4158, 0xe17682b1, 0xc2ed0563,
+    0x85da0ac7, 0x0bb4158f, 0x17682b1e, 0x2ed0563c, 0x5da0ac78, 0xbb4158f0, 0x7682b1e1, 0xed0563c2,
+    0xda0ac785, 0xb4158f0b, 0x682b1e17, 0xd0563c2e, 0xa0ac785d, 0x4158f0bb, 0x82b1e176, 0x0563c2ed,
+    0x0ac785da, 0x158f0bb4, 0x2b1e1768, 0x563c2ed0, 0xac785da0, 0x58f0bb41, 0xb1e17682, 0x63c2ed05,
+    0xc785da0a, 0x8f0bb415, 0x1e17682b, 0x3c2ed056},
+    {0xe04ef22a, 0xc09de455, 0x813bc8ab, 0x02779157, 0x04ef22ae, 0x09de455c, 0x13bc8ab8, 0x27791570,
+    0x4ef22ae0, 0x9de455c0, 0x3bc8ab81, 0x77915702, 0xef22ae04, 0xde455c09, 0xbc8ab813, 0x79157027,
+    0xf22ae04e, 0xe455c09d, 0xc8ab813b, 0x91570277, 0x22ae04ef, 0x455c09de, 0x8ab813bc, 0x15702779,
+    0x2ae04ef2, 0x55c09de4, 0xab813bc8, 0x57027791, 0xae04ef22, 0x5c09de45, 0xb813bc8a, 0x70277915,
+    0xe04ef22a,    0xc09de455, 0x813bc8ab, 0x02779157},
+    {0xe5c40957, 0xcb8812af, 0x9710255f, 0x2e204abf, 0x5c40957e, 0xb8812afc, 0x710255f9, 0xe204abf2,
+    0xc40957e5, 0x8812afcb, 0x10255f97, 0x204abf2e, 0x40957e5c, 0x812afcb8, 0x0255f971, 0x04abf2e2,
+    0x0957e5c4, 0x12afcb88, 0x255f9710, 0x4abf2e20, 0x957e5c40, 0x2afcb881, 0x55f97102, 0xabf2e204,
+    0x57e5c409, 0xafcb8812, 0x5f971025, 0xbf2e204a, 0x7e5c4095, 0xfcb8812a, 0xf9710255, 0xf2e204ab,
+    0xe5c40957,    0xcb8812af, 0x9710255f, 0x2e204abf}
+};
+
+inline void SetKey128(word32 rkey[144], const word32 key[4])
+{
+    rkey[  0] = rotlConstant<1>( key[  0] + delta[0][ 0]);
+    rkey[  6] = rotlConstant<1>(rkey[  0] + delta[1][ 1]);
+    rkey[ 12] = rotlConstant<1>(rkey[  6] + delta[2][ 2]);
+    rkey[ 18] = rotlConstant<1>(rkey[ 12] + delta[3][ 3]);
+    rkey[ 24] = rotlConstant<1>(rkey[ 18] + delta[0][ 4]);
+    rkey[ 30] = rotlConstant<1>(rkey[ 24] + delta[1][ 5]);
+    rkey[ 36] = rotlConstant<1>(rkey[ 30] + delta[2][ 6]);
+    rkey[ 42] = rotlConstant<1>(rkey[ 36] + delta[3][ 7]);
+    rkey[ 48] = rotlConstant<1>(rkey[ 42] + delta[0][ 8]);
+    rkey[ 54] = rotlConstant<1>(rkey[ 48] + delta[1][ 9]);
+    rkey[ 60] = rotlConstant<1>(rkey[ 54] + delta[2][10]);
+    rkey[ 66] = rotlConstant<1>(rkey[ 60] + delta[3][11]);
+    rkey[ 72] = rotlConstant<1>(rkey[ 66] + delta[0][12]);
+    rkey[ 78] = rotlConstant<1>(rkey[ 72] + delta[1][13]);
+    rkey[ 84] = rotlConstant<1>(rkey[ 78] + delta[2][14]);
+    rkey[ 90] = rotlConstant<1>(rkey[ 84] + delta[3][15]);
+    rkey[ 96] = rotlConstant<1>(rkey[ 90] + delta[0][16]);
+    rkey[102] = rotlConstant<1>(rkey[ 96] + delta[1][17]);
+    rkey[108] = rotlConstant<1>(rkey[102] + delta[2][18]);
+    rkey[114] = rotlConstant<1>(rkey[108] + delta[3][19]);
+    rkey[120] = rotlConstant<1>(rkey[114] + delta[0][20]);
+    rkey[126] = rotlConstant<1>(rkey[120] + delta[1][21]);
+    rkey[132] = rotlConstant<1>(rkey[126] + delta[2][22]);
+    rkey[138] = rotlConstant<1>(rkey[132] + delta[3][23]);
+
+    rkey[  1] = rkey[  3] = rkey[  5] = rotlConstant<3>( key[  1] + delta[0][ 1]);
+    rkey[  7] = rkey[  9] = rkey[ 11] = rotlConstant<3>(rkey[  1] + delta[1][ 2]);
+    rkey[ 13] = rkey[ 15] = rkey[ 17] = rotlConstant<3>(rkey[  7] + delta[2][ 3]);
+    rkey[ 19] = rkey[ 21] = rkey[ 23] = rotlConstant<3>(rkey[ 13] + delta[3][ 4]);
+    rkey[ 25] = rkey[ 27] = rkey[ 29] = rotlConstant<3>(rkey[ 19] + delta[0][ 5]);
+    rkey[ 31] = rkey[ 33] = rkey[ 35] = rotlConstant<3>(rkey[ 25] + delta[1][ 6]);
+    rkey[ 37] = rkey[ 39] = rkey[ 41] = rotlConstant<3>(rkey[ 31] + delta[2][ 7]);
+    rkey[ 43] = rkey[ 45] = rkey[ 47] = rotlConstant<3>(rkey[ 37] + delta[3][ 8]);
+    rkey[ 49] = rkey[ 51] = rkey[ 53] = rotlConstant<3>(rkey[ 43] + delta[0][ 9]);
+    rkey[ 55] = rkey[ 57] = rkey[ 59] = rotlConstant<3>(rkey[ 49] + delta[1][10]);
+    rkey[ 61] = rkey[ 63] = rkey[ 65] = rotlConstant<3>(rkey[ 55] + delta[2][11]);
+    rkey[ 67] = rkey[ 69] = rkey[ 71] = rotlConstant<3>(rkey[ 61] + delta[3][12]);
+    rkey[ 73] = rkey[ 75] = rkey[ 77] = rotlConstant<3>(rkey[ 67] + delta[0][13]);
+    rkey[ 79] = rkey[ 81] = rkey[ 83] = rotlConstant<3>(rkey[ 73] + delta[1][14]);
+    rkey[ 85] = rkey[ 87] = rkey[ 89] = rotlConstant<3>(rkey[ 79] + delta[2][15]);
+    rkey[ 91] = rkey[ 93] = rkey[ 95] = rotlConstant<3>(rkey[ 85] + delta[3][16]);
+    rkey[ 97] = rkey[ 99] = rkey[101] = rotlConstant<3>(rkey[ 91] + delta[0][17]);
+    rkey[103] = rkey[105] = rkey[107] = rotlConstant<3>(rkey[ 97] + delta[1][18]);
+    rkey[109] = rkey[111] = rkey[113] = rotlConstant<3>(rkey[103] + delta[2][19]);
+    rkey[115] = rkey[117] = rkey[119] = rotlConstant<3>(rkey[109] + delta[3][20]);
+    rkey[121] = rkey[123] = rkey[125] = rotlConstant<3>(rkey[115] + delta[0][21]);
+    rkey[127] = rkey[129] = rkey[131] = rotlConstant<3>(rkey[121] + delta[1][22]);
+    rkey[133] = rkey[135] = rkey[137] = rotlConstant<3>(rkey[127] + delta[2][23]);
+    rkey[139] = rkey[141] = rkey[143] = rotlConstant<3>(rkey[133] + delta[3][24]);
+
+    rkey[  2] = rotlConstant<6>( key[  2] + delta[0][ 2]);
+    rkey[  8] = rotlConstant<6>(rkey[  2] + delta[1][ 3]);
+    rkey[ 14] = rotlConstant<6>(rkey[  8] + delta[2][ 4]);
+    rkey[ 20] = rotlConstant<6>(rkey[ 14] + delta[3][ 5]);
+    rkey[ 26] = rotlConstant<6>(rkey[ 20] + delta[0][ 6]);
+    rkey[ 32] = rotlConstant<6>(rkey[ 26] + delta[1][ 7]);
+    rkey[ 38] = rotlConstant<6>(rkey[ 32] + delta[2][ 8]);
+    rkey[ 44] = rotlConstant<6>(rkey[ 38] + delta[3][ 9]);
+    rkey[ 50] = rotlConstant<6>(rkey[ 44] + delta[0][10]);
+    rkey[ 56] = rotlConstant<6>(rkey[ 50] + delta[1][11]);
+    rkey[ 62] = rotlConstant<6>(rkey[ 56] + delta[2][12]);
+    rkey[ 68] = rotlConstant<6>(rkey[ 62] + delta[3][13]);
+    rkey[ 74] = rotlConstant<6>(rkey[ 68] + delta[0][14]);
+    rkey[ 80] = rotlConstant<6>(rkey[ 74] + delta[1][15]);
+    rkey[ 86] = rotlConstant<6>(rkey[ 80] + delta[2][16]);
+    rkey[ 92] = rotlConstant<6>(rkey[ 86] + delta[3][17]);
+    rkey[ 98] = rotlConstant<6>(rkey[ 92] + delta[0][18]);
+    rkey[104] = rotlConstant<6>(rkey[ 98] + delta[1][19]);
+    rkey[110] = rotlConstant<6>(rkey[104] + delta[2][20]);
+    rkey[116] = rotlConstant<6>(rkey[110] + delta[3][21]);
+    rkey[122] = rotlConstant<6>(rkey[116] + delta[0][22]);
+    rkey[128] = rotlConstant<6>(rkey[122] + delta[1][23]);
+    rkey[134] = rotlConstant<6>(rkey[128] + delta[2][24]);
+    rkey[140] = rotlConstant<6>(rkey[134] + delta[3][25]);
+
+    rkey[  4] = rotlConstant<11>( key[  3] + delta[0][ 3]);
+    rkey[ 10] = rotlConstant<11>(rkey[  4] + delta[1][ 4]);
+    rkey[ 16] = rotlConstant<11>(rkey[ 10] + delta[2][ 5]);
+    rkey[ 22] = rotlConstant<11>(rkey[ 16] + delta[3][ 6]);
+    rkey[ 28] = rotlConstant<11>(rkey[ 22] + delta[0][ 7]);
+    rkey[ 34] = rotlConstant<11>(rkey[ 28] + delta[1][ 8]);
+    rkey[ 40] = rotlConstant<11>(rkey[ 34] + delta[2][ 9]);
+    rkey[ 46] = rotlConstant<11>(rkey[ 40] + delta[3][10]);
+    rkey[ 52] = rotlConstant<11>(rkey[ 46] + delta[0][11]);
+    rkey[ 58] = rotlConstant<11>(rkey[ 52] + delta[1][12]);
+    rkey[ 64] = rotlConstant<11>(rkey[ 58] + delta[2][13]);
+    rkey[ 70] = rotlConstant<11>(rkey[ 64] + delta[3][14]);
+    rkey[ 76] = rotlConstant<11>(rkey[ 70] + delta[0][15]);
+    rkey[ 82] = rotlConstant<11>(rkey[ 76] + delta[1][16]);
+    rkey[ 88] = rotlConstant<11>(rkey[ 82] + delta[2][17]);
+    rkey[ 94] = rotlConstant<11>(rkey[ 88] + delta[3][18]);
+    rkey[100] = rotlConstant<11>(rkey[ 94] + delta[0][19]);
+    rkey[106] = rotlConstant<11>(rkey[100] + delta[1][20]);
+    rkey[112] = rotlConstant<11>(rkey[106] + delta[2][21]);
+    rkey[118] = rotlConstant<11>(rkey[112] + delta[3][22]);
+    rkey[124] = rotlConstant<11>(rkey[118] + delta[0][23]);
+    rkey[130] = rotlConstant<11>(rkey[124] + delta[1][24]);
+    rkey[136] = rotlConstant<11>(rkey[130] + delta[2][25]);
+    rkey[142] = rotlConstant<11>(rkey[136] + delta[3][26]);
+}
+
+inline void SetKey192(word32 rkey[168], const word32 key[6])
+{
+    rkey[  0] = rotlConstant<1>( key[  0] + delta[0][ 0]);
+    rkey[  6] = rotlConstant<1>(rkey[  0] + delta[1][ 1]);
+    rkey[ 12] = rotlConstant<1>(rkey[  6] + delta[2][ 2]);
+    rkey[ 18] = rotlConstant<1>(rkey[ 12] + delta[3][ 3]);
+    rkey[ 24] = rotlConstant<1>(rkey[ 18] + delta[4][ 4]);
+    rkey[ 30] = rotlConstant<1>(rkey[ 24] + delta[5][ 5]);
+    rkey[ 36] = rotlConstant<1>(rkey[ 30] + delta[0][ 6]);
+    rkey[ 42] = rotlConstant<1>(rkey[ 36] + delta[1][ 7]);
+    rkey[ 48] = rotlConstant<1>(rkey[ 42] + delta[2][ 8]);
+    rkey[ 54] = rotlConstant<1>(rkey[ 48] + delta[3][ 9]);
+    rkey[ 60] = rotlConstant<1>(rkey[ 54] + delta[4][10]);
+    rkey[ 66] = rotlConstant<1>(rkey[ 60] + delta[5][11]);
+    rkey[ 72] = rotlConstant<1>(rkey[ 66] + delta[0][12]);
+    rkey[ 78] = rotlConstant<1>(rkey[ 72] + delta[1][13]);
+    rkey[ 84] = rotlConstant<1>(rkey[ 78] + delta[2][14]);
+    rkey[ 90] = rotlConstant<1>(rkey[ 84] + delta[3][15]);
+    rkey[ 96] = rotlConstant<1>(rkey[ 90] + delta[4][16]);
+    rkey[102] = rotlConstant<1>(rkey[ 96] + delta[5][17]);
+    rkey[108] = rotlConstant<1>(rkey[102] + delta[0][18]);
+    rkey[114] = rotlConstant<1>(rkey[108] + delta[1][19]);
+    rkey[120] = rotlConstant<1>(rkey[114] + delta[2][20]);
+    rkey[126] = rotlConstant<1>(rkey[120] + delta[3][21]);
+    rkey[132] = rotlConstant<1>(rkey[126] + delta[4][22]);
+    rkey[138] = rotlConstant<1>(rkey[132] + delta[5][23]);
+    rkey[144] = rotlConstant<1>(rkey[138] + delta[0][24]);
+    rkey[150] = rotlConstant<1>(rkey[144] + delta[1][25]);
+    rkey[156] = rotlConstant<1>(rkey[150] + delta[2][26]);
+    rkey[162] = rotlConstant<1>(rkey[156] + delta[3][27]);
+
+    rkey[  1] = rotlConstant<3>( key[  1] + delta[0][ 1]);
+    rkey[  7] = rotlConstant<3>(rkey[  1] + delta[1][ 2]);
+    rkey[ 13] = rotlConstant<3>(rkey[  7] + delta[2][ 3]);
+    rkey[ 19] = rotlConstant<3>(rkey[ 13] + delta[3][ 4]);
+    rkey[ 25] = rotlConstant<3>(rkey[ 19] + delta[4][ 5]);
+    rkey[ 31] = rotlConstant<3>(rkey[ 25] + delta[5][ 6]);
+    rkey[ 37] = rotlConstant<3>(rkey[ 31] + delta[0][ 7]);
+    rkey[ 43] = rotlConstant<3>(rkey[ 37] + delta[1][ 8]);
+    rkey[ 49] = rotlConstant<3>(rkey[ 43] + delta[2][ 9]);
+    rkey[ 55] = rotlConstant<3>(rkey[ 49] + delta[3][10]);
+    rkey[ 61] = rotlConstant<3>(rkey[ 55] + delta[4][11]);
+    rkey[ 67] = rotlConstant<3>(rkey[ 61] + delta[5][12]);
+    rkey[ 73] = rotlConstant<3>(rkey[ 67] + delta[0][13]);
+    rkey[ 79] = rotlConstant<3>(rkey[ 73] + delta[1][14]);
+    rkey[ 85] = rotlConstant<3>(rkey[ 79] + delta[2][15]);
+    rkey[ 91] = rotlConstant<3>(rkey[ 85] + delta[3][16]);
+    rkey[ 97] = rotlConstant<3>(rkey[ 91] + delta[4][17]);
+    rkey[103] = rotlConstant<3>(rkey[ 97] + delta[5][18]);
+    rkey[109] = rotlConstant<3>(rkey[103] + delta[0][19]);
+    rkey[115] = rotlConstant<3>(rkey[109] + delta[1][20]);
+    rkey[121] = rotlConstant<3>(rkey[115] + delta[2][21]);
+    rkey[127] = rotlConstant<3>(rkey[121] + delta[3][22]);
+    rkey[133] = rotlConstant<3>(rkey[127] + delta[4][23]);
+    rkey[139] = rotlConstant<3>(rkey[133] + delta[5][24]);
+    rkey[145] = rotlConstant<3>(rkey[139] + delta[0][25]);
+    rkey[151] = rotlConstant<3>(rkey[145] + delta[1][26]);
+    rkey[157] = rotlConstant<3>(rkey[151] + delta[2][27]);
+    rkey[163] = rotlConstant<3>(rkey[157] + delta[3][28]);
+
+    rkey[  2] = rotlConstant<6>( key[  2] + delta[0][ 2]);
+    rkey[  8] = rotlConstant<6>(rkey[  2] + delta[1][ 3]);
+    rkey[ 14] = rotlConstant<6>(rkey[  8] + delta[2][ 4]);
+    rkey[ 20] = rotlConstant<6>(rkey[ 14] + delta[3][ 5]);
+    rkey[ 26] = rotlConstant<6>(rkey[ 20] + delta[4][ 6]);
+    rkey[ 32] = rotlConstant<6>(rkey[ 26] + delta[5][ 7]);
+    rkey[ 38] = rotlConstant<6>(rkey[ 32] + delta[0][ 8]);
+    rkey[ 44] = rotlConstant<6>(rkey[ 38] + delta[1][ 9]);
+    rkey[ 50] = rotlConstant<6>(rkey[ 44] + delta[2][10]);
+    rkey[ 56] = rotlConstant<6>(rkey[ 50] + delta[3][11]);
+    rkey[ 62] = rotlConstant<6>(rkey[ 56] + delta[4][12]);
+    rkey[ 68] = rotlConstant<6>(rkey[ 62] + delta[5][13]);
+    rkey[ 74] = rotlConstant<6>(rkey[ 68] + delta[0][14]);
+    rkey[ 80] = rotlConstant<6>(rkey[ 74] + delta[1][15]);
+    rkey[ 86] = rotlConstant<6>(rkey[ 80] + delta[2][16]);
+    rkey[ 92] = rotlConstant<6>(rkey[ 86] + delta[3][17]);
+    rkey[ 98] = rotlConstant<6>(rkey[ 92] + delta[4][18]);
+    rkey[104] = rotlConstant<6>(rkey[ 98] + delta[5][19]);
+    rkey[110] = rotlConstant<6>(rkey[104] + delta[0][20]);
+    rkey[116] = rotlConstant<6>(rkey[110] + delta[1][21]);
+    rkey[122] = rotlConstant<6>(rkey[116] + delta[2][22]);
+    rkey[128] = rotlConstant<6>(rkey[122] + delta[3][23]);
+    rkey[134] = rotlConstant<6>(rkey[128] + delta[4][24]);
+    rkey[140] = rotlConstant<6>(rkey[134] + delta[5][25]);
+    rkey[146] = rotlConstant<6>(rkey[140] + delta[0][26]);
+    rkey[152] = rotlConstant<6>(rkey[146] + delta[1][27]);
+    rkey[158] = rotlConstant<6>(rkey[152] + delta[2][28]);
+    rkey[164] = rotlConstant<6>(rkey[158] + delta[3][29]);
+
+    rkey[  3] = rotlConstant<11>( key[  3] + delta[0][ 3]);
+    rkey[  9] = rotlConstant<11>(rkey[  3] + delta[1][ 4]);
+    rkey[ 15] = rotlConstant<11>(rkey[  9] + delta[2][ 5]);
+    rkey[ 21] = rotlConstant<11>(rkey[ 15] + delta[3][ 6]);
+    rkey[ 27] = rotlConstant<11>(rkey[ 21] + delta[4][ 7]);
+    rkey[ 33] = rotlConstant<11>(rkey[ 27] + delta[5][ 8]);
+    rkey[ 39] = rotlConstant<11>(rkey[ 33] + delta[0][ 9]);
+    rkey[ 45] = rotlConstant<11>(rkey[ 39] + delta[1][10]);
+    rkey[ 51] = rotlConstant<11>(rkey[ 45] + delta[2][11]);
+    rkey[ 57] = rotlConstant<11>(rkey[ 51] + delta[3][12]);
+    rkey[ 63] = rotlConstant<11>(rkey[ 57] + delta[4][13]);
+    rkey[ 69] = rotlConstant<11>(rkey[ 63] + delta[5][14]);
+    rkey[ 75] = rotlConstant<11>(rkey[ 69] + delta[0][15]);
+    rkey[ 81] = rotlConstant<11>(rkey[ 75] + delta[1][16]);
+    rkey[ 87] = rotlConstant<11>(rkey[ 81] + delta[2][17]);
+    rkey[ 93] = rotlConstant<11>(rkey[ 87] + delta[3][18]);
+    rkey[ 99] = rotlConstant<11>(rkey[ 93] + delta[4][19]);
+    rkey[105] = rotlConstant<11>(rkey[ 99] + delta[5][20]);
+    rkey[111] = rotlConstant<11>(rkey[105] + delta[0][21]);
+    rkey[117] = rotlConstant<11>(rkey[111] + delta[1][22]);
+    rkey[123] = rotlConstant<11>(rkey[117] + delta[2][23]);
+    rkey[129] = rotlConstant<11>(rkey[123] + delta[3][24]);
+    rkey[135] = rotlConstant<11>(rkey[129] + delta[4][25]);
+    rkey[141] = rotlConstant<11>(rkey[135] + delta[5][26]);
+    rkey[147] = rotlConstant<11>(rkey[141] + delta[0][27]);
+    rkey[153] = rotlConstant<11>(rkey[147] + delta[1][28]);
+    rkey[159] = rotlConstant<11>(rkey[153] + delta[2][29]);
+    rkey[165] = rotlConstant<11>(rkey[159] + delta[3][30]);
+
+    rkey[  4] = rotlConstant<13>( key[  4] + delta[0][ 4]);
+    rkey[ 10] = rotlConstant<13>(rkey[  4] + delta[1][ 5]);
+    rkey[ 16] = rotlConstant<13>(rkey[ 10] + delta[2][ 6]);
+    rkey[ 22] = rotlConstant<13>(rkey[ 16] + delta[3][ 7]);
+    rkey[ 28] = rotlConstant<13>(rkey[ 22] + delta[4][ 8]);
+    rkey[ 34] = rotlConstant<13>(rkey[ 28] + delta[5][ 9]);
+    rkey[ 40] = rotlConstant<13>(rkey[ 34] + delta[0][10]);
+    rkey[ 46] = rotlConstant<13>(rkey[ 40] + delta[1][11]);
+    rkey[ 52] = rotlConstant<13>(rkey[ 46] + delta[2][12]);
+    rkey[ 58] = rotlConstant<13>(rkey[ 52] + delta[3][13]);
+    rkey[ 64] = rotlConstant<13>(rkey[ 58] + delta[4][14]);
+    rkey[ 70] = rotlConstant<13>(rkey[ 64] + delta[5][15]);
+    rkey[ 76] = rotlConstant<13>(rkey[ 70] + delta[0][16]);
+    rkey[ 82] = rotlConstant<13>(rkey[ 76] + delta[1][17]);
+    rkey[ 88] = rotlConstant<13>(rkey[ 82] + delta[2][18]);
+    rkey[ 94] = rotlConstant<13>(rkey[ 88] + delta[3][19]);
+    rkey[100] = rotlConstant<13>(rkey[ 94] + delta[4][20]);
+    rkey[106] = rotlConstant<13>(rkey[100] + delta[5][21]);
+    rkey[112] = rotlConstant<13>(rkey[106] + delta[0][22]);
+    rkey[118] = rotlConstant<13>(rkey[112] + delta[1][23]);
+    rkey[124] = rotlConstant<13>(rkey[118] + delta[2][24]);
+    rkey[130] = rotlConstant<13>(rkey[124] + delta[3][25]);
+    rkey[136] = rotlConstant<13>(rkey[130] + delta[4][26]);
+    rkey[142] = rotlConstant<13>(rkey[136] + delta[5][27]);
+    rkey[148] = rotlConstant<13>(rkey[142] + delta[0][28]);
+    rkey[154] = rotlConstant<13>(rkey[148] + delta[1][29]);
+    rkey[160] = rotlConstant<13>(rkey[154] + delta[2][30]);
+    rkey[166] = rotlConstant<13>(rkey[160] + delta[3][31]);
+
+    rkey[  5] = rotlConstant<17>( key[  5] + delta[0][ 5]);
+    rkey[ 11] = rotlConstant<17>(rkey[  5] + delta[1][ 6]);
+    rkey[ 17] = rotlConstant<17>(rkey[ 11] + delta[2][ 7]);
+    rkey[ 23] = rotlConstant<17>(rkey[ 17] + delta[3][ 8]);
+    rkey[ 29] = rotlConstant<17>(rkey[ 23] + delta[4][ 9]);
+    rkey[ 35] = rotlConstant<17>(rkey[ 29] + delta[5][10]);
+    rkey[ 41] = rotlConstant<17>(rkey[ 35] + delta[0][11]);
+    rkey[ 47] = rotlConstant<17>(rkey[ 41] + delta[1][12]);
+    rkey[ 53] = rotlConstant<17>(rkey[ 47] + delta[2][13]);
+    rkey[ 59] = rotlConstant<17>(rkey[ 53] + delta[3][14]);
+    rkey[ 65] = rotlConstant<17>(rkey[ 59] + delta[4][15]);
+    rkey[ 71] = rotlConstant<17>(rkey[ 65] + delta[5][16]);
+    rkey[ 77] = rotlConstant<17>(rkey[ 71] + delta[0][17]);
+    rkey[ 83] = rotlConstant<17>(rkey[ 77] + delta[1][18]);
+    rkey[ 89] = rotlConstant<17>(rkey[ 83] + delta[2][19]);
+    rkey[ 95] = rotlConstant<17>(rkey[ 89] + delta[3][20]);
+    rkey[101] = rotlConstant<17>(rkey[ 95] + delta[4][21]);
+    rkey[107] = rotlConstant<17>(rkey[101] + delta[5][22]);
+    rkey[113] = rotlConstant<17>(rkey[107] + delta[0][23]);
+    rkey[119] = rotlConstant<17>(rkey[113] + delta[1][24]);
+    rkey[125] = rotlConstant<17>(rkey[119] + delta[2][25]);
+    rkey[131] = rotlConstant<17>(rkey[125] + delta[3][26]);
+    rkey[137] = rotlConstant<17>(rkey[131] + delta[4][27]);
+    rkey[143] = rotlConstant<17>(rkey[137] + delta[5][28]);
+    rkey[149] = rotlConstant<17>(rkey[143] + delta[0][29]);
+    rkey[155] = rotlConstant<17>(rkey[149] + delta[1][30]);
+    rkey[161] = rotlConstant<17>(rkey[155] + delta[2][31]);
+    rkey[167] = rotlConstant<17>(rkey[161] + delta[3][ 0]);
+}
+
+inline void SetKey256(word32 rkey[192], const word32 key[8])
+{
+    rkey[  0] = rotlConstant< 1>( key[  0] + delta[0][ 0]);
+    rkey[  8] = rotlConstant< 6>(rkey[  0] + delta[1][ 3]);
+    rkey[ 16] = rotlConstant<13>(rkey[  8] + delta[2][ 6]);
+    rkey[ 24] = rotlConstant< 1>(rkey[ 16] + delta[4][ 4]);
+    rkey[ 32] = rotlConstant< 6>(rkey[ 24] + delta[5][ 7]);
+    rkey[ 40] = rotlConstant<13>(rkey[ 32] + delta[6][10]);
+    rkey[ 48] = rotlConstant< 1>(rkey[ 40] + delta[0][ 8]);
+    rkey[ 56] = rotlConstant< 6>(rkey[ 48] + delta[1][11]);
+    rkey[ 64] = rotlConstant<13>(rkey[ 56] + delta[2][14]);
+    rkey[ 72] = rotlConstant< 1>(rkey[ 64] + delta[4][12]);
+    rkey[ 80] = rotlConstant< 6>(rkey[ 72] + delta[5][15]);
+    rkey[ 88] = rotlConstant<13>(rkey[ 80] + delta[6][18]);
+    rkey[ 96] = rotlConstant< 1>(rkey[ 88] + delta[0][16]);
+    rkey[104] = rotlConstant< 6>(rkey[ 96] + delta[1][19]);
+    rkey[112] = rotlConstant<13>(rkey[104] + delta[2][22]);
+    rkey[120] = rotlConstant< 1>(rkey[112] + delta[4][20]);
+    rkey[128] = rotlConstant< 6>(rkey[120] + delta[5][23]);
+    rkey[136] = rotlConstant<13>(rkey[128] + delta[6][26]);
+    rkey[144] = rotlConstant< 1>(rkey[136] + delta[0][24]);
+    rkey[152] = rotlConstant< 6>(rkey[144] + delta[1][27]);
+    rkey[160] = rotlConstant<13>(rkey[152] + delta[2][30]);
+    rkey[168] = rotlConstant< 1>(rkey[160] + delta[4][28]);
+    rkey[176] = rotlConstant< 6>(rkey[168] + delta[5][31]);
+    rkey[184] = rotlConstant<13>(rkey[176] + delta[6][ 2]);
+
+    rkey[  1] = rotlConstant< 3>( key[  1] + delta[0][ 1]);
+    rkey[  9] = rotlConstant<11>(rkey[  1] + delta[1][ 4]);
+    rkey[ 17] = rotlConstant<17>(rkey[  9] + delta[2][ 7]);
+    rkey[ 25] = rotlConstant< 3>(rkey[ 17] + delta[4][ 5]);
+    rkey[ 33] = rotlConstant<11>(rkey[ 25] + delta[5][ 8]);
+    rkey[ 41] = rotlConstant<17>(rkey[ 33] + delta[6][11]);
+    rkey[ 49] = rotlConstant< 3>(rkey[ 41] + delta[0][ 9]);
+    rkey[ 57] = rotlConstant<11>(rkey[ 49] + delta[1][12]);
+    rkey[ 65] = rotlConstant<17>(rkey[ 57] + delta[2][15]);
+    rkey[ 73] = rotlConstant< 3>(rkey[ 65] + delta[4][13]);
+    rkey[ 81] = rotlConstant<11>(rkey[ 73] + delta[5][16]);
+    rkey[ 89] = rotlConstant<17>(rkey[ 81] + delta[6][19]);
+    rkey[ 97] = rotlConstant< 3>(rkey[ 89] + delta[0][17]);
+    rkey[105] = rotlConstant<11>(rkey[ 97] + delta[1][20]);
+    rkey[113] = rotlConstant<17>(rkey[105] + delta[2][23]);
+    rkey[121] = rotlConstant< 3>(rkey[113] + delta[4][21]);
+    rkey[129] = rotlConstant<11>(rkey[121] + delta[5][24]);
+    rkey[137] = rotlConstant<17>(rkey[129] + delta[6][27]);
+    rkey[145] = rotlConstant< 3>(rkey[137] + delta[0][25]);
+    rkey[153] = rotlConstant<11>(rkey[145] + delta[1][28]);
+    rkey[161] = rotlConstant<17>(rkey[153] + delta[2][31]);
+    rkey[169] = rotlConstant< 3>(rkey[161] + delta[4][29]);
+    rkey[177] = rotlConstant<11>(rkey[169] + delta[5][ 0]);
+    rkey[185] = rotlConstant<17>(rkey[177] + delta[6][ 3]);
+
+    rkey[  2] = rotlConstant< 6>( key[  2] + delta[0][ 2]);
+    rkey[ 10] = rotlConstant<13>(rkey[  2] + delta[1][ 5]);
+    rkey[ 18] = rotlConstant< 1>(rkey[ 10] + delta[3][ 3]);
+    rkey[ 26] = rotlConstant< 6>(rkey[ 18] + delta[4][ 6]);
+    rkey[ 34] = rotlConstant<13>(rkey[ 26] + delta[5][ 9]);
+    rkey[ 42] = rotlConstant< 1>(rkey[ 34] + delta[7][ 7]);
+    rkey[ 50] = rotlConstant< 6>(rkey[ 42] + delta[0][10]);
+    rkey[ 58] = rotlConstant<13>(rkey[ 50] + delta[1][13]);
+    rkey[ 66] = rotlConstant< 1>(rkey[ 58] + delta[3][11]);
+    rkey[ 74] = rotlConstant< 6>(rkey[ 66] + delta[4][14]);
+    rkey[ 82] = rotlConstant<13>(rkey[ 74] + delta[5][17]);
+    rkey[ 90] = rotlConstant< 1>(rkey[ 82] + delta[7][15]);
+    rkey[ 98] = rotlConstant< 6>(rkey[ 90] + delta[0][18]);
+    rkey[106] = rotlConstant<13>(rkey[ 98] + delta[1][21]);
+    rkey[114] = rotlConstant< 1>(rkey[106] + delta[3][19]);
+    rkey[122] = rotlConstant< 6>(rkey[114] + delta[4][22]);
+    rkey[130] = rotlConstant<13>(rkey[122] + delta[5][25]);
+    rkey[138] = rotlConstant< 1>(rkey[130] + delta[7][23]);
+    rkey[146] = rotlConstant< 6>(rkey[138] + delta[0][26]);
+    rkey[154] = rotlConstant<13>(rkey[146] + delta[1][29]);
+    rkey[162] = rotlConstant< 1>(rkey[154] + delta[3][27]);
+    rkey[170] = rotlConstant< 6>(rkey[162] + delta[4][30]);
+    rkey[178] = rotlConstant<13>(rkey[170] + delta[5][ 1]);
+    rkey[186] = rotlConstant< 1>(rkey[178] + delta[7][31]);
+
+    rkey[  3] = rotlConstant<11>( key[  3] + delta[0][ 3]);
+    rkey[ 11] = rotlConstant<17>(rkey[  3] + delta[1][ 6]);
+    rkey[ 19] = rotlConstant< 3>(rkey[ 11] + delta[3][ 4]);
+    rkey[ 27] = rotlConstant<11>(rkey[ 19] + delta[4][ 7]);
+    rkey[ 35] = rotlConstant<17>(rkey[ 27] + delta[5][10]);
+    rkey[ 43] = rotlConstant< 3>(rkey[ 35] + delta[7][ 8]);
+    rkey[ 51] = rotlConstant<11>(rkey[ 43] + delta[0][11]);
+    rkey[ 59] = rotlConstant<17>(rkey[ 51] + delta[1][14]);
+    rkey[ 67] = rotlConstant< 3>(rkey[ 59] + delta[3][12]);
+    rkey[ 75] = rotlConstant<11>(rkey[ 67] + delta[4][15]);
+    rkey[ 83] = rotlConstant<17>(rkey[ 75] + delta[5][18]);
+    rkey[ 91] = rotlConstant< 3>(rkey[ 83] + delta[7][16]);
+    rkey[ 99] = rotlConstant<11>(rkey[ 91] + delta[0][19]);
+    rkey[107] = rotlConstant<17>(rkey[ 99] + delta[1][22]);
+    rkey[115] = rotlConstant< 3>(rkey[107] + delta[3][20]);
+    rkey[123] = rotlConstant<11>(rkey[115] + delta[4][23]);
+    rkey[131] = rotlConstant<17>(rkey[123] + delta[5][26]);
+    rkey[139] = rotlConstant< 3>(rkey[131] + delta[7][24]);
+    rkey[147] = rotlConstant<11>(rkey[139] + delta[0][27]);
+    rkey[155] = rotlConstant<17>(rkey[147] + delta[1][30]);
+    rkey[163] = rotlConstant< 3>(rkey[155] + delta[3][28]);
+    rkey[171] = rotlConstant<11>(rkey[163] + delta[4][31]);
+    rkey[179] = rotlConstant<17>(rkey[171] + delta[5][ 2]);
+    rkey[187] = rotlConstant< 3>(rkey[179] + delta[7][ 0]);
+
+    rkey[  4] = rotlConstant<13>( key[  4] + delta[0][ 4]);
+    rkey[ 12] = rotlConstant< 1>(rkey[  4] + delta[2][ 2]);
+    rkey[ 20] = rotlConstant< 6>(rkey[ 12] + delta[3][ 5]);
+    rkey[ 28] = rotlConstant<13>(rkey[ 20] + delta[4][ 8]);
+    rkey[ 36] = rotlConstant< 1>(rkey[ 28] + delta[6][ 6]);
+    rkey[ 44] = rotlConstant< 6>(rkey[ 36] + delta[7][ 9]);
+    rkey[ 52] = rotlConstant<13>(rkey[ 44] + delta[0][12]);
+    rkey[ 60] = rotlConstant< 1>(rkey[ 52] + delta[2][10]);
+    rkey[ 68] = rotlConstant< 6>(rkey[ 60] + delta[3][13]);
+    rkey[ 76] = rotlConstant<13>(rkey[ 68] + delta[4][16]);
+    rkey[ 84] = rotlConstant< 1>(rkey[ 76] + delta[6][14]);
+    rkey[ 92] = rotlConstant< 6>(rkey[ 84] + delta[7][17]);
+    rkey[100] = rotlConstant<13>(rkey[ 92] + delta[0][20]);
+    rkey[108] = rotlConstant< 1>(rkey[100] + delta[2][18]);
+    rkey[116] = rotlConstant< 6>(rkey[108] + delta[3][21]);
+    rkey[124] = rotlConstant<13>(rkey[116] + delta[4][24]);
+    rkey[132] = rotlConstant< 1>(rkey[124] + delta[6][22]);
+    rkey[140] = rotlConstant< 6>(rkey[132] + delta[7][25]);
+    rkey[148] = rotlConstant<13>(rkey[140] + delta[0][28]);
+    rkey[156] = rotlConstant< 1>(rkey[148] + delta[2][26]);
+    rkey[164] = rotlConstant< 6>(rkey[156] + delta[3][29]);
+    rkey[172] = rotlConstant<13>(rkey[164] + delta[4][ 0]);
+    rkey[180] = rotlConstant< 1>(rkey[172] + delta[6][30]);
+    rkey[188] = rotlConstant< 6>(rkey[180] + delta[7][ 1]);
+
+    rkey[  5] = rotlConstant<17>( key[  5] + delta[0][ 5]);
+    rkey[ 13] = rotlConstant< 3>(rkey[  5] + delta[2][ 3]);
+    rkey[ 21] = rotlConstant<11>(rkey[ 13] + delta[3][ 6]);
+    rkey[ 29] = rotlConstant<17>(rkey[ 21] + delta[4][ 9]);
+    rkey[ 37] = rotlConstant< 3>(rkey[ 29] + delta[6][ 7]);
+    rkey[ 45] = rotlConstant<11>(rkey[ 37] + delta[7][10]);
+    rkey[ 53] = rotlConstant<17>(rkey[ 45] + delta[0][13]);
+    rkey[ 61] = rotlConstant< 3>(rkey[ 53] + delta[2][11]);
+    rkey[ 69] = rotlConstant<11>(rkey[ 61] + delta[3][14]);
+    rkey[ 77] = rotlConstant<17>(rkey[ 69] + delta[4][17]);
+    rkey[ 85] = rotlConstant< 3>(rkey[ 77] + delta[6][15]);
+    rkey[ 93] = rotlConstant<11>(rkey[ 85] + delta[7][18]);
+    rkey[101] = rotlConstant<17>(rkey[ 93] + delta[0][21]);
+    rkey[109] = rotlConstant< 3>(rkey[101] + delta[2][19]);
+    rkey[117] = rotlConstant<11>(rkey[109] + delta[3][22]);
+    rkey[125] = rotlConstant<17>(rkey[117] + delta[4][25]);
+    rkey[133] = rotlConstant< 3>(rkey[125] + delta[6][23]);
+    rkey[141] = rotlConstant<11>(rkey[133] + delta[7][26]);
+    rkey[149] = rotlConstant<17>(rkey[141] + delta[0][29]);
+    rkey[157] = rotlConstant< 3>(rkey[149] + delta[2][27]);
+    rkey[165] = rotlConstant<11>(rkey[157] + delta[3][30]);
+    rkey[173] = rotlConstant<17>(rkey[165] + delta[4][ 1]);
+    rkey[181] = rotlConstant< 3>(rkey[173] + delta[6][31]);
+    rkey[189] = rotlConstant<11>(rkey[181] + delta[7][ 2]);
+
+    rkey[  6] = rotlConstant< 1>( key[  6] + delta[1][ 1]);
+    rkey[ 14] = rotlConstant< 6>(rkey[  6] + delta[2][ 4]);
+    rkey[ 22] = rotlConstant<13>(rkey[ 14] + delta[3][ 7]);
+    rkey[ 30] = rotlConstant< 1>(rkey[ 22] + delta[5][ 5]);
+    rkey[ 38] = rotlConstant< 6>(rkey[ 30] + delta[6][ 8]);
+    rkey[ 46] = rotlConstant<13>(rkey[ 38] + delta[7][11]);
+    rkey[ 54] = rotlConstant< 1>(rkey[ 46] + delta[1][ 9]);
+    rkey[ 62] = rotlConstant< 6>(rkey[ 54] + delta[2][12]);
+    rkey[ 70] = rotlConstant<13>(rkey[ 62] + delta[3][15]);
+    rkey[ 78] = rotlConstant< 1>(rkey[ 70] + delta[5][13]);
+    rkey[ 86] = rotlConstant< 6>(rkey[ 78] + delta[6][16]);
+    rkey[ 94] = rotlConstant<13>(rkey[ 86] + delta[7][19]);
+    rkey[102] = rotlConstant< 1>(rkey[ 94] + delta[1][17]);
+    rkey[110] = rotlConstant< 6>(rkey[102] + delta[2][20]);
+    rkey[118] = rotlConstant<13>(rkey[110] + delta[3][23]);
+    rkey[126] = rotlConstant< 1>(rkey[118] + delta[5][21]);
+    rkey[134] = rotlConstant< 6>(rkey[126] + delta[6][24]);
+    rkey[142] = rotlConstant<13>(rkey[134] + delta[7][27]);
+    rkey[150] = rotlConstant< 1>(rkey[142] + delta[1][25]);
+    rkey[158] = rotlConstant< 6>(rkey[150] + delta[2][28]);
+    rkey[166] = rotlConstant<13>(rkey[158] + delta[3][31]);
+    rkey[174] = rotlConstant< 1>(rkey[166] + delta[5][29]);
+    rkey[182] = rotlConstant< 6>(rkey[174] + delta[6][ 0]);
+    rkey[190] = rotlConstant<13>(rkey[182] + delta[7][ 3]);
+
+    rkey[  7] = rotlConstant< 3>( key[  7] + delta[1][ 2]);
+    rkey[ 15] = rotlConstant<11>(rkey[  7] + delta[2][ 5]);
+    rkey[ 23] = rotlConstant<17>(rkey[ 15] + delta[3][ 8]);
+    rkey[ 31] = rotlConstant< 3>(rkey[ 23] + delta[5][ 6]);
+    rkey[ 39] = rotlConstant<11>(rkey[ 31] + delta[6][ 9]);
+    rkey[ 47] = rotlConstant<17>(rkey[ 39] + delta[7][12]);
+    rkey[ 55] = rotlConstant< 3>(rkey[ 47] + delta[1][10]);
+    rkey[ 63] = rotlConstant<11>(rkey[ 55] + delta[2][13]);
+    rkey[ 71] = rotlConstant<17>(rkey[ 63] + delta[3][16]);
+    rkey[ 79] = rotlConstant< 3>(rkey[ 71] + delta[5][14]);
+    rkey[ 87] = rotlConstant<11>(rkey[ 79] + delta[6][17]);
+    rkey[ 95] = rotlConstant<17>(rkey[ 87] + delta[7][20]);
+    rkey[103] = rotlConstant< 3>(rkey[ 95] + delta[1][18]);
+    rkey[111] = rotlConstant<11>(rkey[103] + delta[2][21]);
+    rkey[119] = rotlConstant<17>(rkey[111] + delta[3][24]);
+    rkey[127] = rotlConstant< 3>(rkey[119] + delta[5][22]);
+    rkey[135] = rotlConstant<11>(rkey[127] + delta[6][25]);
+    rkey[143] = rotlConstant<17>(rkey[135] + delta[7][28]);
+    rkey[151] = rotlConstant< 3>(rkey[143] + delta[1][26]);
+    rkey[159] = rotlConstant<11>(rkey[151] + delta[2][29]);
+    rkey[167] = rotlConstant<17>(rkey[159] + delta[3][ 0]);
+    rkey[175] = rotlConstant< 3>(rkey[167] + delta[5][30]);
+    rkey[183] = rotlConstant<11>(rkey[175] + delta[6][ 1]);
+    rkey[191] = rotlConstant<17>(rkey[183] + delta[7][ 4]);
+}
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if CRYPTOPP_LEA_ADVANCED_PROCESS_BLOCKS
+# if defined(CRYPTOPP_SSSE3_AVAILABLE)
+extern size_t LEA_Enc_AdvancedProcessBlocks_SSSE3(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t LEA_Dec_AdvancedProcessBlocks_SSSE3(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+# endif
+
+# if (CRYPTOPP_ARM_NEON_AVAILABLE)
+extern size_t LEA_Enc_AdvancedProcessBlocks_NEON(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t LEA_Dec_AdvancedProcessBlocks_NEON(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+# endif
+#endif
+
+std::string LEA::Base::AlgorithmProvider() const
+{
+#if (CRYPTOPP_LEA_ADVANCED_PROCESS_BLOCKS)
+# if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return "SSSE3";
+# endif
+# if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return "NEON";
+# endif
+#endif
+    return "C++";
+}
+
+void LEA::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_UNUSED(params);
+
+    switch(keyLength)
+    {
+    case 16:  // 128-bit key
+    {
+        m_rkey.New(144); m_temp.New(4); m_rounds = 24;
+        GetUserKey(LITTLE_ENDIAN_ORDER, m_temp.begin(), 4, userKey, 16);
+        SetKey128(m_rkey, m_temp);
+        break;
+    }
+    case 24:  // 192-bit key
+    {
+        m_rkey.New(168); m_temp.New(6); m_rounds = 28;
+        GetUserKey(LITTLE_ENDIAN_ORDER, m_temp.begin(), 6, userKey, 24);
+        SetKey192(m_rkey, m_temp);
+        break;
+    }
+    case 32:  // 256-bit key
+    {
+        m_rkey.New(192); m_temp.New(8); m_rounds = 32;
+        GetUserKey(LITTLE_ENDIAN_ORDER, m_temp.begin(), 8, userKey, 32);
+        SetKey256(m_rkey, m_temp);
+        break;
+    }
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+}
+
+void LEA::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word32, LittleEndian> iblock(inBlock);
+    iblock(m_temp[0])(m_temp[1])(m_temp[2])(m_temp[3]);
+
+    m_temp[3] = rotrConstant<3>((m_temp[2] ^ m_rkey[  4]) + (m_temp[3] ^ m_rkey[  5]));
+    m_temp[2] = rotrConstant<5>((m_temp[1] ^ m_rkey[  2]) + (m_temp[2] ^ m_rkey[  3]));
+    m_temp[1] = rotlConstant<9>((m_temp[0] ^ m_rkey[  0]) + (m_temp[1] ^ m_rkey[  1]));
+    m_temp[0] = rotrConstant<3>((m_temp[3] ^ m_rkey[ 10]) + (m_temp[0] ^ m_rkey[ 11]));
+    m_temp[3] = rotrConstant<5>((m_temp[2] ^ m_rkey[  8]) + (m_temp[3] ^ m_rkey[  9]));
+    m_temp[2] = rotlConstant<9>((m_temp[1] ^ m_rkey[  6]) + (m_temp[2] ^ m_rkey[  7]));
+    m_temp[1] = rotrConstant<3>((m_temp[0] ^ m_rkey[ 16]) + (m_temp[1] ^ m_rkey[ 17]));
+    m_temp[0] = rotrConstant<5>((m_temp[3] ^ m_rkey[ 14]) + (m_temp[0] ^ m_rkey[ 15]));
+    m_temp[3] = rotlConstant<9>((m_temp[2] ^ m_rkey[ 12]) + (m_temp[3] ^ m_rkey[ 13]));
+    m_temp[2] = rotrConstant<3>((m_temp[1] ^ m_rkey[ 22]) + (m_temp[2] ^ m_rkey[ 23]));
+    m_temp[1] = rotrConstant<5>((m_temp[0] ^ m_rkey[ 20]) + (m_temp[1] ^ m_rkey[ 21]));
+    m_temp[0] = rotlConstant<9>((m_temp[3] ^ m_rkey[ 18]) + (m_temp[0] ^ m_rkey[ 19]));
+
+    m_temp[3] = rotrConstant<3>((m_temp[2] ^ m_rkey[ 28]) + (m_temp[3] ^ m_rkey[ 29]));
+    m_temp[2] = rotrConstant<5>((m_temp[1] ^ m_rkey[ 26]) + (m_temp[2] ^ m_rkey[ 27]));
+    m_temp[1] = rotlConstant<9>((m_temp[0] ^ m_rkey[ 24]) + (m_temp[1] ^ m_rkey[ 25]));
+    m_temp[0] = rotrConstant<3>((m_temp[3] ^ m_rkey[ 34]) + (m_temp[0] ^ m_rkey[ 35]));
+    m_temp[3] = rotrConstant<5>((m_temp[2] ^ m_rkey[ 32]) + (m_temp[3] ^ m_rkey[ 33]));
+    m_temp[2] = rotlConstant<9>((m_temp[1] ^ m_rkey[ 30]) + (m_temp[2] ^ m_rkey[ 31]));
+    m_temp[1] = rotrConstant<3>((m_temp[0] ^ m_rkey[ 40]) + (m_temp[1] ^ m_rkey[ 41]));
+    m_temp[0] = rotrConstant<5>((m_temp[3] ^ m_rkey[ 38]) + (m_temp[0] ^ m_rkey[ 39]));
+    m_temp[3] = rotlConstant<9>((m_temp[2] ^ m_rkey[ 36]) + (m_temp[3] ^ m_rkey[ 37]));
+    m_temp[2] = rotrConstant<3>((m_temp[1] ^ m_rkey[ 46]) + (m_temp[2] ^ m_rkey[ 47]));
+    m_temp[1] = rotrConstant<5>((m_temp[0] ^ m_rkey[ 44]) + (m_temp[1] ^ m_rkey[ 45]));
+    m_temp[0] = rotlConstant<9>((m_temp[3] ^ m_rkey[ 42]) + (m_temp[0] ^ m_rkey[ 43]));
+
+    m_temp[3] = rotrConstant<3>((m_temp[2] ^ m_rkey[ 52]) + (m_temp[3] ^ m_rkey[ 53]));
+    m_temp[2] = rotrConstant<5>((m_temp[1] ^ m_rkey[ 50]) + (m_temp[2] ^ m_rkey[ 51]));
+    m_temp[1] = rotlConstant<9>((m_temp[0] ^ m_rkey[ 48]) + (m_temp[1] ^ m_rkey[ 49]));
+    m_temp[0] = rotrConstant<3>((m_temp[3] ^ m_rkey[ 58]) + (m_temp[0] ^ m_rkey[ 59]));
+    m_temp[3] = rotrConstant<5>((m_temp[2] ^ m_rkey[ 56]) + (m_temp[3] ^ m_rkey[ 57]));
+    m_temp[2] = rotlConstant<9>((m_temp[1] ^ m_rkey[ 54]) + (m_temp[2] ^ m_rkey[ 55]));
+    m_temp[1] = rotrConstant<3>((m_temp[0] ^ m_rkey[ 64]) + (m_temp[1] ^ m_rkey[ 65]));
+    m_temp[0] = rotrConstant<5>((m_temp[3] ^ m_rkey[ 62]) + (m_temp[0] ^ m_rkey[ 63]));
+    m_temp[3] = rotlConstant<9>((m_temp[2] ^ m_rkey[ 60]) + (m_temp[3] ^ m_rkey[ 61]));
+    m_temp[2] = rotrConstant<3>((m_temp[1] ^ m_rkey[ 70]) + (m_temp[2] ^ m_rkey[ 71]));
+    m_temp[1] = rotrConstant<5>((m_temp[0] ^ m_rkey[ 68]) + (m_temp[1] ^ m_rkey[ 69]));
+    m_temp[0] = rotlConstant<9>((m_temp[3] ^ m_rkey[ 66]) + (m_temp[0] ^ m_rkey[ 67]));
+
+    m_temp[3] = rotrConstant<3>((m_temp[2] ^ m_rkey[ 76]) + (m_temp[3] ^ m_rkey[ 77]));
+    m_temp[2] = rotrConstant<5>((m_temp[1] ^ m_rkey[ 74]) + (m_temp[2] ^ m_rkey[ 75]));
+    m_temp[1] = rotlConstant<9>((m_temp[0] ^ m_rkey[ 72]) + (m_temp[1] ^ m_rkey[ 73]));
+    m_temp[0] = rotrConstant<3>((m_temp[3] ^ m_rkey[ 82]) + (m_temp[0] ^ m_rkey[ 83]));
+    m_temp[3] = rotrConstant<5>((m_temp[2] ^ m_rkey[ 80]) + (m_temp[3] ^ m_rkey[ 81]));
+    m_temp[2] = rotlConstant<9>((m_temp[1] ^ m_rkey[ 78]) + (m_temp[2] ^ m_rkey[ 79]));
+    m_temp[1] = rotrConstant<3>((m_temp[0] ^ m_rkey[ 88]) + (m_temp[1] ^ m_rkey[ 89]));
+    m_temp[0] = rotrConstant<5>((m_temp[3] ^ m_rkey[ 86]) + (m_temp[0] ^ m_rkey[ 87]));
+    m_temp[3] = rotlConstant<9>((m_temp[2] ^ m_rkey[ 84]) + (m_temp[3] ^ m_rkey[ 85]));
+    m_temp[2] = rotrConstant<3>((m_temp[1] ^ m_rkey[ 94]) + (m_temp[2] ^ m_rkey[ 95]));
+    m_temp[1] = rotrConstant<5>((m_temp[0] ^ m_rkey[ 92]) + (m_temp[1] ^ m_rkey[ 93]));
+    m_temp[0] = rotlConstant<9>((m_temp[3] ^ m_rkey[ 90]) + (m_temp[0] ^ m_rkey[ 91]));
+
+    m_temp[3] = rotrConstant<3>((m_temp[2] ^ m_rkey[100]) + (m_temp[3] ^ m_rkey[101]));
+    m_temp[2] = rotrConstant<5>((m_temp[1] ^ m_rkey[ 98]) + (m_temp[2] ^ m_rkey[ 99]));
+    m_temp[1] = rotlConstant<9>((m_temp[0] ^ m_rkey[ 96]) + (m_temp[1] ^ m_rkey[ 97]));
+    m_temp[0] = rotrConstant<3>((m_temp[3] ^ m_rkey[106]) + (m_temp[0] ^ m_rkey[107]));
+    m_temp[3] = rotrConstant<5>((m_temp[2] ^ m_rkey[104]) + (m_temp[3] ^ m_rkey[105]));
+    m_temp[2] = rotlConstant<9>((m_temp[1] ^ m_rkey[102]) + (m_temp[2] ^ m_rkey[103]));
+    m_temp[1] = rotrConstant<3>((m_temp[0] ^ m_rkey[112]) + (m_temp[1] ^ m_rkey[113]));
+    m_temp[0] = rotrConstant<5>((m_temp[3] ^ m_rkey[110]) + (m_temp[0] ^ m_rkey[111]));
+    m_temp[3] = rotlConstant<9>((m_temp[2] ^ m_rkey[108]) + (m_temp[3] ^ m_rkey[109]));
+    m_temp[2] = rotrConstant<3>((m_temp[1] ^ m_rkey[118]) + (m_temp[2] ^ m_rkey[119]));
+    m_temp[1] = rotrConstant<5>((m_temp[0] ^ m_rkey[116]) + (m_temp[1] ^ m_rkey[117]));
+    m_temp[0] = rotlConstant<9>((m_temp[3] ^ m_rkey[114]) + (m_temp[0] ^ m_rkey[115]));
+
+    m_temp[3] = rotrConstant<3>((m_temp[2] ^ m_rkey[124]) + (m_temp[3] ^ m_rkey[125]));
+    m_temp[2] = rotrConstant<5>((m_temp[1] ^ m_rkey[122]) + (m_temp[2] ^ m_rkey[123]));
+    m_temp[1] = rotlConstant<9>((m_temp[0] ^ m_rkey[120]) + (m_temp[1] ^ m_rkey[121]));
+    m_temp[0] = rotrConstant<3>((m_temp[3] ^ m_rkey[130]) + (m_temp[0] ^ m_rkey[131]));
+    m_temp[3] = rotrConstant<5>((m_temp[2] ^ m_rkey[128]) + (m_temp[3] ^ m_rkey[129]));
+    m_temp[2] = rotlConstant<9>((m_temp[1] ^ m_rkey[126]) + (m_temp[2] ^ m_rkey[127]));
+    m_temp[1] = rotrConstant<3>((m_temp[0] ^ m_rkey[136]) + (m_temp[1] ^ m_rkey[137]));
+    m_temp[0] = rotrConstant<5>((m_temp[3] ^ m_rkey[134]) + (m_temp[0] ^ m_rkey[135]));
+    m_temp[3] = rotlConstant<9>((m_temp[2] ^ m_rkey[132]) + (m_temp[3] ^ m_rkey[133]));
+    m_temp[2] = rotrConstant<3>((m_temp[1] ^ m_rkey[142]) + (m_temp[2] ^ m_rkey[143]));
+    m_temp[1] = rotrConstant<5>((m_temp[0] ^ m_rkey[140]) + (m_temp[1] ^ m_rkey[141]));
+    m_temp[0] = rotlConstant<9>((m_temp[3] ^ m_rkey[138]) + (m_temp[0] ^ m_rkey[139]));
+
+    if(m_rounds > 24)
+    {
+        m_temp[3] = rotrConstant<3>((m_temp[2] ^ m_rkey[148]) + (m_temp[3] ^ m_rkey[149]));
+        m_temp[2] = rotrConstant<5>((m_temp[1] ^ m_rkey[146]) + (m_temp[2] ^ m_rkey[147]));
+        m_temp[1] = rotlConstant<9>((m_temp[0] ^ m_rkey[144]) + (m_temp[1] ^ m_rkey[145]));
+        m_temp[0] = rotrConstant<3>((m_temp[3] ^ m_rkey[154]) + (m_temp[0] ^ m_rkey[155]));
+        m_temp[3] = rotrConstant<5>((m_temp[2] ^ m_rkey[152]) + (m_temp[3] ^ m_rkey[153]));
+        m_temp[2] = rotlConstant<9>((m_temp[1] ^ m_rkey[150]) + (m_temp[2] ^ m_rkey[151]));
+        m_temp[1] = rotrConstant<3>((m_temp[0] ^ m_rkey[160]) + (m_temp[1] ^ m_rkey[161]));
+        m_temp[0] = rotrConstant<5>((m_temp[3] ^ m_rkey[158]) + (m_temp[0] ^ m_rkey[159]));
+        m_temp[3] = rotlConstant<9>((m_temp[2] ^ m_rkey[156]) + (m_temp[3] ^ m_rkey[157]));
+        m_temp[2] = rotrConstant<3>((m_temp[1] ^ m_rkey[166]) + (m_temp[2] ^ m_rkey[167]));
+        m_temp[1] = rotrConstant<5>((m_temp[0] ^ m_rkey[164]) + (m_temp[1] ^ m_rkey[165]));
+        m_temp[0] = rotlConstant<9>((m_temp[3] ^ m_rkey[162]) + (m_temp[0] ^ m_rkey[163]));
+    }
+
+    if(m_rounds > 28)
+    {
+        m_temp[3] = rotrConstant<3>((m_temp[2] ^ m_rkey[172]) + (m_temp[3] ^ m_rkey[173]));
+        m_temp[2] = rotrConstant<5>((m_temp[1] ^ m_rkey[170]) + (m_temp[2] ^ m_rkey[171]));
+        m_temp[1] = rotlConstant<9>((m_temp[0] ^ m_rkey[168]) + (m_temp[1] ^ m_rkey[169]));
+        m_temp[0] = rotrConstant<3>((m_temp[3] ^ m_rkey[178]) + (m_temp[0] ^ m_rkey[179]));
+        m_temp[3] = rotrConstant<5>((m_temp[2] ^ m_rkey[176]) + (m_temp[3] ^ m_rkey[177]));
+        m_temp[2] = rotlConstant<9>((m_temp[1] ^ m_rkey[174]) + (m_temp[2] ^ m_rkey[175]));
+        m_temp[1] = rotrConstant<3>((m_temp[0] ^ m_rkey[184]) + (m_temp[1] ^ m_rkey[185]));
+        m_temp[0] = rotrConstant<5>((m_temp[3] ^ m_rkey[182]) + (m_temp[0] ^ m_rkey[183]));
+        m_temp[3] = rotlConstant<9>((m_temp[2] ^ m_rkey[180]) + (m_temp[3] ^ m_rkey[181]));
+        m_temp[2] = rotrConstant<3>((m_temp[1] ^ m_rkey[190]) + (m_temp[2] ^ m_rkey[191]));
+        m_temp[1] = rotrConstant<5>((m_temp[0] ^ m_rkey[188]) + (m_temp[1] ^ m_rkey[189]));
+        m_temp[0] = rotlConstant<9>((m_temp[3] ^ m_rkey[186]) + (m_temp[0] ^ m_rkey[187]));
+    }
+
+    PutBlock<word32, LittleEndian> oblock(xorBlock, outBlock);
+    oblock(m_temp[0])(m_temp[1])(m_temp[2])(m_temp[3]);
+}
+
+void LEA::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word32, LittleEndian> iblock(inBlock);
+    iblock(m_temp[0])(m_temp[1])(m_temp[2])(m_temp[3]);
+
+    if(m_rounds > 28)
+    {
+        m_temp[0] = (rotrConstant<9>(m_temp[0]) - (m_temp[3] ^ m_rkey[186])) ^ m_rkey[187];
+        m_temp[1] = (rotlConstant<5>(m_temp[1]) - (m_temp[0] ^ m_rkey[188])) ^ m_rkey[189];
+        m_temp[2] = (rotlConstant<3>(m_temp[2]) - (m_temp[1] ^ m_rkey[190])) ^ m_rkey[191];
+        m_temp[3] = (rotrConstant<9>(m_temp[3]) - (m_temp[2] ^ m_rkey[180])) ^ m_rkey[181];
+        m_temp[0] = (rotlConstant<5>(m_temp[0]) - (m_temp[3] ^ m_rkey[182])) ^ m_rkey[183];
+        m_temp[1] = (rotlConstant<3>(m_temp[1]) - (m_temp[0] ^ m_rkey[184])) ^ m_rkey[185];
+        m_temp[2] = (rotrConstant<9>(m_temp[2]) - (m_temp[1] ^ m_rkey[174])) ^ m_rkey[175];
+        m_temp[3] = (rotlConstant<5>(m_temp[3]) - (m_temp[2] ^ m_rkey[176])) ^ m_rkey[177];
+        m_temp[0] = (rotlConstant<3>(m_temp[0]) - (m_temp[3] ^ m_rkey[178])) ^ m_rkey[179];
+        m_temp[1] = (rotrConstant<9>(m_temp[1]) - (m_temp[0] ^ m_rkey[168])) ^ m_rkey[169];
+        m_temp[2] = (rotlConstant<5>(m_temp[2]) - (m_temp[1] ^ m_rkey[170])) ^ m_rkey[171];
+        m_temp[3] = (rotlConstant<3>(m_temp[3]) - (m_temp[2] ^ m_rkey[172])) ^ m_rkey[173];
+    }
+
+    if(m_rounds > 24)
+    {
+        m_temp[0] = (rotrConstant<9>(m_temp[0]) - (m_temp[3] ^ m_rkey[162])) ^ m_rkey[163];
+        m_temp[1] = (rotlConstant<5>(m_temp[1]) - (m_temp[0] ^ m_rkey[164])) ^ m_rkey[165];
+        m_temp[2] = (rotlConstant<3>(m_temp[2]) - (m_temp[1] ^ m_rkey[166])) ^ m_rkey[167];
+        m_temp[3] = (rotrConstant<9>(m_temp[3]) - (m_temp[2] ^ m_rkey[156])) ^ m_rkey[157];
+        m_temp[0] = (rotlConstant<5>(m_temp[0]) - (m_temp[3] ^ m_rkey[158])) ^ m_rkey[159];
+        m_temp[1] = (rotlConstant<3>(m_temp[1]) - (m_temp[0] ^ m_rkey[160])) ^ m_rkey[161];
+        m_temp[2] = (rotrConstant<9>(m_temp[2]) - (m_temp[1] ^ m_rkey[150])) ^ m_rkey[151];
+        m_temp[3] = (rotlConstant<5>(m_temp[3]) - (m_temp[2] ^ m_rkey[152])) ^ m_rkey[153];
+        m_temp[0] = (rotlConstant<3>(m_temp[0]) - (m_temp[3] ^ m_rkey[154])) ^ m_rkey[155];
+        m_temp[1] = (rotrConstant<9>(m_temp[1]) - (m_temp[0] ^ m_rkey[144])) ^ m_rkey[145];
+        m_temp[2] = (rotlConstant<5>(m_temp[2]) - (m_temp[1] ^ m_rkey[146])) ^ m_rkey[147];
+        m_temp[3] = (rotlConstant<3>(m_temp[3]) - (m_temp[2] ^ m_rkey[148])) ^ m_rkey[149];
+    }
+
+    m_temp[0] = (rotrConstant<9>(m_temp[0]) - (m_temp[3] ^ m_rkey[138])) ^ m_rkey[139];
+    m_temp[1] = (rotlConstant<5>(m_temp[1]) - (m_temp[0] ^ m_rkey[140])) ^ m_rkey[141];
+    m_temp[2] = (rotlConstant<3>(m_temp[2]) - (m_temp[1] ^ m_rkey[142])) ^ m_rkey[143];
+    m_temp[3] = (rotrConstant<9>(m_temp[3]) - (m_temp[2] ^ m_rkey[132])) ^ m_rkey[133];
+    m_temp[0] = (rotlConstant<5>(m_temp[0]) - (m_temp[3] ^ m_rkey[134])) ^ m_rkey[135];
+    m_temp[1] = (rotlConstant<3>(m_temp[1]) - (m_temp[0] ^ m_rkey[136])) ^ m_rkey[137];
+    m_temp[2] = (rotrConstant<9>(m_temp[2]) - (m_temp[1] ^ m_rkey[126])) ^ m_rkey[127];
+    m_temp[3] = (rotlConstant<5>(m_temp[3]) - (m_temp[2] ^ m_rkey[128])) ^ m_rkey[129];
+    m_temp[0] = (rotlConstant<3>(m_temp[0]) - (m_temp[3] ^ m_rkey[130])) ^ m_rkey[131];
+    m_temp[1] = (rotrConstant<9>(m_temp[1]) - (m_temp[0] ^ m_rkey[120])) ^ m_rkey[121];
+    m_temp[2] = (rotlConstant<5>(m_temp[2]) - (m_temp[1] ^ m_rkey[122])) ^ m_rkey[123];
+    m_temp[3] = (rotlConstant<3>(m_temp[3]) - (m_temp[2] ^ m_rkey[124])) ^ m_rkey[125];
+
+    m_temp[0] = (rotrConstant<9>(m_temp[0]) - (m_temp[3] ^ m_rkey[114])) ^ m_rkey[115];
+    m_temp[1] = (rotlConstant<5>(m_temp[1]) - (m_temp[0] ^ m_rkey[116])) ^ m_rkey[117];
+    m_temp[2] = (rotlConstant<3>(m_temp[2]) - (m_temp[1] ^ m_rkey[118])) ^ m_rkey[119];
+    m_temp[3] = (rotrConstant<9>(m_temp[3]) - (m_temp[2] ^ m_rkey[108])) ^ m_rkey[109];
+    m_temp[0] = (rotlConstant<5>(m_temp[0]) - (m_temp[3] ^ m_rkey[110])) ^ m_rkey[111];
+    m_temp[1] = (rotlConstant<3>(m_temp[1]) - (m_temp[0] ^ m_rkey[112])) ^ m_rkey[113];
+    m_temp[2] = (rotrConstant<9>(m_temp[2]) - (m_temp[1] ^ m_rkey[102])) ^ m_rkey[103];
+    m_temp[3] = (rotlConstant<5>(m_temp[3]) - (m_temp[2] ^ m_rkey[104])) ^ m_rkey[105];
+    m_temp[0] = (rotlConstant<3>(m_temp[0]) - (m_temp[3] ^ m_rkey[106])) ^ m_rkey[107];
+    m_temp[1] = (rotrConstant<9>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 96])) ^ m_rkey[ 97];
+    m_temp[2] = (rotlConstant<5>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 98])) ^ m_rkey[ 99];
+    m_temp[3] = (rotlConstant<3>(m_temp[3]) - (m_temp[2] ^ m_rkey[100])) ^ m_rkey[101];
+
+    m_temp[0] = (rotrConstant<9>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 90])) ^ m_rkey[ 91];
+    m_temp[1] = (rotlConstant<5>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 92])) ^ m_rkey[ 93];
+    m_temp[2] = (rotlConstant<3>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 94])) ^ m_rkey[ 95];
+    m_temp[3] = (rotrConstant<9>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 84])) ^ m_rkey[ 85];
+    m_temp[0] = (rotlConstant<5>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 86])) ^ m_rkey[ 87];
+    m_temp[1] = (rotlConstant<3>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 88])) ^ m_rkey[ 89];
+    m_temp[2] = (rotrConstant<9>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 78])) ^ m_rkey[ 79];
+    m_temp[3] = (rotlConstant<5>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 80])) ^ m_rkey[ 81];
+    m_temp[0] = (rotlConstant<3>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 82])) ^ m_rkey[ 83];
+    m_temp[1] = (rotrConstant<9>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 72])) ^ m_rkey[ 73];
+    m_temp[2] = (rotlConstant<5>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 74])) ^ m_rkey[ 75];
+    m_temp[3] = (rotlConstant<3>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 76])) ^ m_rkey[ 77];
+
+    m_temp[0] = (rotrConstant<9>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 66])) ^ m_rkey[ 67];
+    m_temp[1] = (rotlConstant<5>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 68])) ^ m_rkey[ 69];
+    m_temp[2] = (rotlConstant<3>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 70])) ^ m_rkey[ 71];
+    m_temp[3] = (rotrConstant<9>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 60])) ^ m_rkey[ 61];
+    m_temp[0] = (rotlConstant<5>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 62])) ^ m_rkey[ 63];
+    m_temp[1] = (rotlConstant<3>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 64])) ^ m_rkey[ 65];
+    m_temp[2] = (rotrConstant<9>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 54])) ^ m_rkey[ 55];
+    m_temp[3] = (rotlConstant<5>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 56])) ^ m_rkey[ 57];
+    m_temp[0] = (rotlConstant<3>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 58])) ^ m_rkey[ 59];
+    m_temp[1] = (rotrConstant<9>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 48])) ^ m_rkey[ 49];
+    m_temp[2] = (rotlConstant<5>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 50])) ^ m_rkey[ 51];
+    m_temp[3] = (rotlConstant<3>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 52])) ^ m_rkey[ 53];
+
+    m_temp[0] = (rotrConstant<9>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 42])) ^ m_rkey[ 43];
+    m_temp[1] = (rotlConstant<5>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 44])) ^ m_rkey[ 45];
+    m_temp[2] = (rotlConstant<3>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 46])) ^ m_rkey[ 47];
+    m_temp[3] = (rotrConstant<9>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 36])) ^ m_rkey[ 37];
+    m_temp[0] = (rotlConstant<5>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 38])) ^ m_rkey[ 39];
+    m_temp[1] = (rotlConstant<3>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 40])) ^ m_rkey[ 41];
+    m_temp[2] = (rotrConstant<9>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 30])) ^ m_rkey[ 31];
+    m_temp[3] = (rotlConstant<5>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 32])) ^ m_rkey[ 33];
+    m_temp[0] = (rotlConstant<3>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 34])) ^ m_rkey[ 35];
+    m_temp[1] = (rotrConstant<9>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 24])) ^ m_rkey[ 25];
+    m_temp[2] = (rotlConstant<5>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 26])) ^ m_rkey[ 27];
+    m_temp[3] = (rotlConstant<3>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 28])) ^ m_rkey[ 29];
+
+    m_temp[0] = (rotrConstant<9>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 18])) ^ m_rkey[ 19];
+    m_temp[1] = (rotlConstant<5>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 20])) ^ m_rkey[ 21];
+    m_temp[2] = (rotlConstant<3>(m_temp[2]) - (m_temp[1] ^ m_rkey[ 22])) ^ m_rkey[ 23];
+    m_temp[3] = (rotrConstant<9>(m_temp[3]) - (m_temp[2] ^ m_rkey[ 12])) ^ m_rkey[ 13];
+    m_temp[0] = (rotlConstant<5>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 14])) ^ m_rkey[ 15];
+    m_temp[1] = (rotlConstant<3>(m_temp[1]) - (m_temp[0] ^ m_rkey[ 16])) ^ m_rkey[ 17];
+    m_temp[2] = (rotrConstant<9>(m_temp[2]) - (m_temp[1] ^ m_rkey[  6])) ^ m_rkey[  7];
+    m_temp[3] = (rotlConstant<5>(m_temp[3]) - (m_temp[2] ^ m_rkey[  8])) ^ m_rkey[  9];
+    m_temp[0] = (rotlConstant<3>(m_temp[0]) - (m_temp[3] ^ m_rkey[ 10])) ^ m_rkey[ 11];
+    m_temp[1] = (rotrConstant<9>(m_temp[1]) - (m_temp[0] ^ m_rkey[  0])) ^ m_rkey[  1];
+    m_temp[2] = (rotlConstant<5>(m_temp[2]) - (m_temp[1] ^ m_rkey[  2])) ^ m_rkey[  3];
+    m_temp[3] = (rotlConstant<3>(m_temp[3]) - (m_temp[2] ^ m_rkey[  4])) ^ m_rkey[  5];
+
+    PutBlock<word32, LittleEndian> oblock(xorBlock, outBlock);
+    oblock(m_temp[0])(m_temp[1])(m_temp[2])(m_temp[3]);
+}
+
+#if CRYPTOPP_LEA_ADVANCED_PROCESS_BLOCKS
+size_t LEA::Enc::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks,
+        byte *outBlocks, size_t length, word32 flags) const
+{
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3()) {
+        return LEA_Enc_AdvancedProcessBlocks_SSSE3(m_rkey, m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+    }
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return LEA_Enc_AdvancedProcessBlocks_NEON(m_rkey, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+    return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t LEA::Dec::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks,
+        byte *outBlocks, size_t length, word32 flags) const
+{
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3()) {
+        return LEA_Dec_AdvancedProcessBlocks_SSSE3(m_rkey, m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+    }
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return LEA_Dec_AdvancedProcessBlocks_NEON(m_rkey, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+    return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_LEA_ADVANCED_PROCESS_BLOCKS
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/lea.h b/runtime/third_party/cryptopp/lea.h
new file mode 100644
index 0000000..3ede381
--- /dev/null
+++ b/runtime/third_party/cryptopp/lea.h
@@ -0,0 +1,108 @@
+// lea.h - written and placed in the public domain by Kim Sung Hee and Jeffrey Walton
+//         Based on "LEA: A 128-Bit Block Cipher for Fast Encryption on Common
+//         Processors" by Deukjo Hong, Jung-Keun Lee, Dong-Chan Kim, Daesung Kwon,
+//         Kwon Ho Ryu, and Dong-Geon Lee.
+
+/// \file lea.h
+/// \brief Classes for the LEA block cipher
+/// \since Crypto++ 8.0
+
+#ifndef CRYPTOPP_LEA_H
+#define CRYPTOPP_LEA_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+#include "algparam.h"
+
+#if (CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8)
+# ifndef CRYPTOPP_DISABLE_LEA_SIMD
+#  define CRYPTOPP_LEA_ADVANCED_PROCESS_BLOCKS 1
+# endif
+#endif
+
+// Yet another SunStudio/SunCC workaround. Failed self tests
+// in SSE code paths on i386 for SunStudio 12.3 and below.
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x5120)
+# undef CRYPTOPP_LEA_ADVANCED_PROCESS_BLOCKS
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief LEA block cipher information
+/// \since Crypto++ 8.0
+struct LEA_Info : public FixedBlockSize<16>, public VariableKeyLength<16,16,32,8>
+{
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///   member function.
+    static const std::string StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize
+        return "LEA-128";
+    }
+};
+
+/// \brief LEA 128-bit block cipher
+/// \details LEA provides 128-bit block size. The valid key size is 128-bits, 192-bits and 256-bits.
+/// \note Crypto++ provides a byte oriented implementation
+/// \sa <a href="http://www.cryptopp.com/wiki/LEA">LEA</a>,
+///   <a href="https://seed.kisa.or.kr/html/egovframework/iwt/ds/ko/ref/LEA%20A%20128-Bit%20Block%20Cipher%20for%20Fast%20Encryption%20on%20Common%20Processors-English.pdf">
+///   LEA: A 128-Bit Block Cipher for Fast Encryption on Common Processors</a>
+/// \since Crypto++ 8.0
+class CRYPTOPP_NO_VTABLE LEA : public LEA_Info, public BlockCipherDocumentation
+{
+public:
+    /// \brief LEA block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<LEA_Info>
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+        std::string AlgorithmProvider() const;
+
+        SecBlock<word32> m_rkey;
+        mutable SecBlock<word32> m_temp;
+        unsigned int m_rounds;
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+#if CRYPTOPP_LEA_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    /// \brief Decryption transformation
+    /// \details Dec provides implementation for decryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+#if CRYPTOPP_LEA_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef LEA::Encryption LEAEncryption;
+typedef LEA::Decryption LEADecryption;
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_LEA_H
diff --git a/runtime/third_party/cryptopp/lea_simd.cpp b/runtime/third_party/cryptopp/lea_simd.cpp
new file mode 100644
index 0000000..7935b88
--- /dev/null
+++ b/runtime/third_party/cryptopp/lea_simd.cpp
@@ -0,0 +1,1072 @@
+// lea_simd.cpp - written and placed in the public domain by Jeffrey Walton
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    SSSE3, ARM NEON and ARMv8a, and Power8 Altivec instructions. A separate
+//    source file is needed because additional CXXFLAGS are required to enable
+//    the appropriate instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+
+#include "lea.h"
+#include "misc.h"
+
+// Uncomment for benchmarking C++ against SSE or NEON.
+// Do so in both simon.cpp and simon_simd.cpp.
+// #undef CRYPTOPP_SSSE3_AVAILABLE
+// #undef CRYPTOPP_ARM_NEON_AVAILABLE
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+# include "adv_simd.h"
+# include <pmmintrin.h>
+# include <tmmintrin.h>
+#endif
+
+#if defined(__XOP__)
+# if defined(CRYPTOPP_GCC_COMPATIBLE)
+#  include <x86intrin.h>
+# endif
+# include <ammintrin.h>
+#endif  // XOP
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include "adv_simd.h"
+# include <arm_neon.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#if defined(_M_ARM64)
+# include "adv_simd.h"
+#endif
+
+// Do not port this to POWER architecture. Naively we hoped
+// for a 2x to 3x speedup. The result was a 5x slow down.
+// The table below shows MiB/s and cpb.
+//
+// C++:
+// <TD>LEA-128(128)/CTR (128-bit key)<TD>C++<TD>207<TD>15.64
+// <TD>LEA-128(192)/CTR (192-bit key)<TD>C++<TD>186<TD>17.48
+// <TD>LEA-128(256)/CTR (256-bit key)<TD>C++<TD>124<TD>26.2
+//
+// Power8:
+// <TD>LEA-128(128)/CTR (128-bit key)<TD>Power8<TD>37<TD>88.7
+// <TD>LEA-128(192)/CTR (192-bit key)<TD>Power8<TD>40<TD>82.1
+// <TD>LEA-128(256)/CTR (256-bit key)<TD>Power8<TD>28<TD>116.0
+
+#undef CRYPTOPP_POWER8_AVAILABLE
+#if defined(CRYPTOPP_POWER8_AVAILABLE)
+# include "adv_simd.h"
+# include "ppc_simd.h"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char LEA_SIMD_FNAME[] = __FILE__;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+
+// *************************** ARM NEON ***************************//
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+
+inline uint32x4_t Xor(const uint32x4_t& a, const uint32x4_t& b)
+{
+    return veorq_u32(a, b);
+}
+
+inline uint32x4_t Add(const uint32x4_t& a, const uint32x4_t& b)
+{
+    return vaddq_u32(a, b);
+}
+
+inline uint32x4_t Sub(const uint32x4_t& a, const uint32x4_t& b)
+{
+    return vsubq_u32(a, b);
+}
+
+template <unsigned int R>
+inline uint32x4_t RotateLeft(const uint32x4_t& val)
+{
+    const uint32x4_t a(vshlq_n_u32(val, R));
+    const uint32x4_t b(vshrq_n_u32(val, 32 - R));
+    return vorrq_u32(a, b);
+}
+
+template <unsigned int R>
+inline uint32x4_t RotateRight(const uint32x4_t& val)
+{
+    const uint32x4_t a(vshlq_n_u32(val, 32 - R));
+    const uint32x4_t b(vshrq_n_u32(val, R));
+    return vorrq_u32(a, b);
+}
+
+#if defined(__aarch32__) || defined(__aarch64__)
+template <>
+inline uint32x4_t RotateLeft<8>(const uint32x4_t& val)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8_t maskb[16] = { 14,13,12,15, 10,9,8,11, 6,5,4,7, 2,1,0,3 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+#else
+    const uint8_t maskb[16] = { 3,0,1,2, 7,4,5,6, 11,8,9,10, 15,12,13,14 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+#endif
+
+    return vreinterpretq_u32_u8(
+        vqtbl1q_u8(vreinterpretq_u8_u32(val), mask));
+}
+
+template <>
+inline uint32x4_t RotateRight<8>(const uint32x4_t& val)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8_t maskb[16] = { 12,15,14,13, 8,11,10,9, 4,7,6,5, 0,3,2,1 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+#else
+    const uint8_t maskb[16] = { 1,2,3,0, 5,6,7,4, 9,10,11,8, 13,14,14,12 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+#endif
+
+    return vreinterpretq_u32_u8(
+        vqtbl1q_u8(vreinterpretq_u8_u32(val), mask));
+}
+#endif
+
+uint32x4_t UnpackLow32(uint32x4_t a, uint32x4_t b)
+{
+    uint32x2_t a1 = vget_low_u32(a);
+    uint32x2_t b1 = vget_low_u32(b);
+    uint32x2x2_t result = vzip_u32(a1, b1);
+    return vcombine_u32(result.val[0], result.val[1]);
+}
+
+uint32x4_t UnpackHigh32(uint32x4_t a, uint32x4_t b)
+{
+    uint32x2_t a1 = vget_high_u32(a);
+    uint32x2_t b1 = vget_high_u32(b);
+    uint32x2x2_t result = vzip_u32(a1, b1);
+    return vcombine_u32(result.val[0], result.val[1]);
+}
+
+uint32x4_t UnpackLow64(uint32x4_t a, uint32x4_t b)
+{
+    uint64x1_t a1 = vget_low_u64((uint64x2_t)a);
+    uint64x1_t b1 = vget_low_u64((uint64x2_t)b);
+    return (uint32x4_t)vcombine_u64(a1, b1);
+}
+
+uint32x4_t UnpackHigh64(uint32x4_t a, uint32x4_t b)
+{
+    uint64x1_t a1 = vget_high_u64((uint64x2_t)a);
+    uint64x1_t b1 = vget_high_u64((uint64x2_t)b);
+    return (uint32x4_t)vcombine_u64(a1, b1);
+}
+
+template <unsigned int IDX>
+inline uint32x4_t LoadKey(const word32 rkey[])
+{
+    return vdupq_n_u32(rkey[IDX]);
+}
+
+template <unsigned int IDX>
+inline uint32x4_t UnpackNEON(const uint32x4_t& a, const uint32x4_t& b, const uint32x4_t& c, const uint32x4_t& d)
+{
+    // Should not be instantiated
+    CRYPTOPP_ASSERT(0);
+
+    CRYPTOPP_UNUSED(a); CRYPTOPP_UNUSED(b);
+    CRYPTOPP_UNUSED(c); CRYPTOPP_UNUSED(d);
+    return vmovq_n_u32(0);
+}
+
+template <>
+inline uint32x4_t UnpackNEON<0>(const uint32x4_t& a, const uint32x4_t& b, const uint32x4_t& c, const uint32x4_t& d)
+{
+    const uint32x4_t r1 = UnpackLow32(a, b);
+    const uint32x4_t r2 = UnpackLow32(c, d);
+    return UnpackLow64(r1, r2);
+}
+
+template <>
+inline uint32x4_t UnpackNEON<1>(const uint32x4_t& a, const uint32x4_t& b, const uint32x4_t& c, const uint32x4_t& d)
+{
+    const uint32x4_t r1 = UnpackLow32(a, b);
+    const uint32x4_t r2 = UnpackLow32(c, d);
+    return UnpackHigh64(r1, r2);
+}
+
+template <>
+inline uint32x4_t UnpackNEON<2>(const uint32x4_t& a, const uint32x4_t& b, const uint32x4_t& c, const uint32x4_t& d)
+{
+    const uint32x4_t r1 = UnpackHigh32(a, b);
+    const uint32x4_t r2 = UnpackHigh32(c, d);
+    return UnpackLow64(r1, r2);
+}
+
+template <>
+inline uint32x4_t UnpackNEON<3>(const uint32x4_t& a, const uint32x4_t& b, const uint32x4_t& c, const uint32x4_t& d)
+{
+    const uint32x4_t r1 = UnpackHigh32(a, b);
+    const uint32x4_t r2 = UnpackHigh32(c, d);
+    return UnpackHigh64(r1, r2);
+}
+
+template <unsigned int IDX>
+inline uint32x4_t UnpackNEON(const uint32x4_t& v)
+{
+    // Should not be instantiated
+    CRYPTOPP_ASSERT(0);
+
+    CRYPTOPP_UNUSED(v);
+    return vmovq_n_u32(0);
+}
+
+template <>
+inline uint32x4_t UnpackNEON<0>(const uint32x4_t& v)
+{
+    // Splat to all lanes
+    return vdupq_n_u32(vgetq_lane_u32(v, 0));
+}
+
+template <>
+inline uint32x4_t UnpackNEON<1>(const uint32x4_t& v)
+{
+    // Splat to all lanes
+    return vdupq_n_u32(vgetq_lane_u32(v, 1));
+}
+
+template <>
+inline uint32x4_t UnpackNEON<2>(const uint32x4_t& v)
+{
+    // Splat to all lanes
+    return vdupq_n_u32(vgetq_lane_u32(v, 2));
+}
+
+template <>
+inline uint32x4_t UnpackNEON<3>(const uint32x4_t& v)
+{
+    // Splat to all lanes
+    return vdupq_n_u32(vgetq_lane_u32(v, 3));
+}
+
+template <unsigned int IDX>
+inline uint32x4_t RepackNEON(const uint32x4_t& a, const uint32x4_t& b, const uint32x4_t& c, const uint32x4_t& d)
+{
+    return UnpackNEON<IDX>(a, b, c, d);
+}
+
+template <unsigned int IDX>
+inline uint32x4_t RepackNEON(const uint32x4_t& v)
+{
+    return UnpackNEON<IDX>(v);
+}
+
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+// *************************** IA-32 ***************************//
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+
+inline __m128i Xor(const __m128i& a, const __m128i& b)
+{
+    return _mm_xor_si128(a, b);
+}
+
+inline __m128i Add(const __m128i& a, const __m128i& b)
+{
+    return _mm_add_epi32(a, b);
+}
+
+inline __m128i Sub(const __m128i& a, const __m128i& b)
+{
+    return _mm_sub_epi32(a, b);
+}
+
+template <unsigned int R>
+inline __m128i RotateLeft(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, R);
+#else
+    return _mm_or_si128(
+        _mm_slli_epi32(val, R), _mm_srli_epi32(val, 32-R));
+#endif
+}
+
+template <unsigned int R>
+inline __m128i RotateRight(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, 32-R);
+#else
+    return _mm_or_si128(
+        _mm_slli_epi32(val, 32-R), _mm_srli_epi32(val, R));
+#endif
+}
+
+// Faster than two Shifts and an Or.
+template <>
+inline __m128i RotateLeft<8>(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, 8);
+#else
+    const __m128i mask = _mm_set_epi8(14,13,12,15, 10,9,8,11, 6,5,4,7, 2,1,0,3);
+    return _mm_shuffle_epi8(val, mask);
+#endif
+}
+
+// Faster than two Shifts and an Or.
+template <>
+inline __m128i RotateRight<8>(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi32(val, 32-8);
+#else
+    const __m128i mask = _mm_set_epi8(12,15,14,13, 8,11,10,9, 4,7,6,5, 0,3,2,1);
+    return _mm_shuffle_epi8(val, mask);
+#endif
+}
+
+template <unsigned int IDX>
+inline __m128i LoadKey(const word32 rkey[])
+{
+    float rk; std::memcpy(&rk, rkey+IDX, sizeof(rk));
+    return _mm_castps_si128(_mm_load_ps1(&rk));
+}
+
+template <unsigned int IDX>
+inline __m128i UnpackXMM(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // Should not be instantiated
+    CRYPTOPP_UNUSED(a); CRYPTOPP_UNUSED(b);
+    CRYPTOPP_UNUSED(c); CRYPTOPP_UNUSED(d);
+    CRYPTOPP_ASSERT(0);
+    return _mm_setzero_si128();
+}
+
+template <>
+inline __m128i UnpackXMM<0>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // LEA is little-endian oriented, so there is no need for a separate shuffle.
+    const __m128i r1 = _mm_unpacklo_epi32(a, b);
+    const __m128i r2 = _mm_unpacklo_epi32(c, d);
+    return _mm_unpacklo_epi64(r1, r2);
+}
+
+template <>
+inline __m128i UnpackXMM<1>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // LEA is little-endian oriented, so there is no need for a separate shuffle.
+    const __m128i r1 = _mm_unpacklo_epi32(a, b);
+    const __m128i r2 = _mm_unpacklo_epi32(c, d);
+    return _mm_unpackhi_epi64(r1, r2);
+}
+
+template <>
+inline __m128i UnpackXMM<2>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // LEA is little-endian oriented, so there is no need for a separate shuffle.
+    const __m128i r1 = _mm_unpackhi_epi32(a, b);
+    const __m128i r2 = _mm_unpackhi_epi32(c, d);
+    return _mm_unpacklo_epi64(r1, r2);
+}
+
+template <>
+inline __m128i UnpackXMM<3>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // LEA is little-endian oriented, so there is no need for a separate shuffle.
+    const __m128i r1 = _mm_unpackhi_epi32(a, b);
+    const __m128i r2 = _mm_unpackhi_epi32(c, d);
+    return _mm_unpackhi_epi64(r1, r2);
+}
+
+template <unsigned int IDX>
+inline __m128i UnpackXMM(const __m128i& v)
+{
+    // Should not be instantiated
+    CRYPTOPP_UNUSED(v); CRYPTOPP_ASSERT(0);
+    return _mm_setzero_si128();
+}
+
+template <>
+inline __m128i UnpackXMM<0>(const __m128i& v)
+{
+    // Splat to all lanes
+    return _mm_shuffle_epi8(v, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+}
+
+template <>
+inline __m128i UnpackXMM<1>(const __m128i& v)
+{
+    // Splat to all lanes
+    return _mm_shuffle_epi8(v, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+}
+
+template <>
+inline __m128i UnpackXMM<2>(const __m128i& v)
+{
+    // Splat to all lanes
+    return _mm_shuffle_epi8(v, _mm_set_epi8(11,10,9,8, 11,10,9,8, 11,10,9,8, 11,10,9,8));
+}
+
+template <>
+inline __m128i UnpackXMM<3>(const __m128i& v)
+{
+    // Splat to all lanes
+    return _mm_shuffle_epi8(v, _mm_set_epi8(15,14,13,12, 15,14,13,12, 15,14,13,12, 15,14,13,12));
+}
+
+template <unsigned int IDX>
+inline __m128i RepackXMM(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    return UnpackXMM<IDX>(a, b, c, d);
+}
+
+template <unsigned int IDX>
+inline __m128i RepackXMM(const __m128i& v)
+{
+    return UnpackXMM<IDX>(v);
+}
+
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
+
+// *************************** Power8 ***************************//
+
+#if (CRYPTOPP_POWER8_AVAILABLE)
+
+using CryptoPP::uint8x16_p;
+using CryptoPP::uint32x4_p;
+using CryptoPP::uint64x2_p;
+
+inline uint32x4_p Xor(const uint32x4_p& a, const uint32x4_p& b)
+{
+    return VecXor(a, b);
+}
+
+inline uint32x4_p Add(const uint32x4_p& a, const uint32x4_p& b)
+{
+    return VecAdd(a, b);
+}
+
+inline uint32x4_p Sub(const uint32x4_p& a, const uint32x4_p& b)
+{
+    return VecSub(a, b);
+}
+
+template <unsigned int R>
+inline uint32x4_p RotateLeft(const uint32x4_p& val)
+{
+    const uint32x4_p m = {R, R, R, R};
+    return vec_rl(val, m);
+}
+
+template <unsigned int R>
+inline uint32x4_p RotateRight(const uint32x4_p& val)
+{
+    const uint32x4_p m = {32-R, 32-R, 32-R, 32-R};
+    return vec_rl(val, m);
+}
+
+template <unsigned int IDX>
+inline uint32x4_p LoadKey(const word32 rkey[])
+{
+    return vec_splats(rkey[IDX]);
+}
+
+template <unsigned int IDX>
+inline uint32x4_p UnpackSIMD(const uint32x4_p& a, const uint32x4_p& b, const uint32x4_p& c, const uint32x4_p& d)
+{
+    // Should not be instantiated
+    CRYPTOPP_UNUSED(a); CRYPTOPP_UNUSED(b);
+    CRYPTOPP_UNUSED(c); CRYPTOPP_UNUSED(d);
+    CRYPTOPP_ASSERT(0);
+    return VecXor(a, a);
+}
+
+template <>
+inline uint32x4_p UnpackSIMD<0>(const uint32x4_p& a, const uint32x4_p& b, const uint32x4_p& c, const uint32x4_p& d)
+{
+    const uint64x2_p r1 = (uint64x2_p)vec_mergel(a, b);
+    const uint64x2_p r2 = (uint64x2_p)vec_mergel(c, d);
+    return (uint32x4_p)vec_mergel(r1, r2);
+}
+
+template <>
+inline uint32x4_p UnpackSIMD<1>(const uint32x4_p& a, const uint32x4_p& b, const uint32x4_p& c, const uint32x4_p& d)
+{
+    const uint64x2_p r1 = (uint64x2_p)vec_mergel(a, b);
+    const uint64x2_p r2 = (uint64x2_p)vec_mergel(c, d);
+    return (uint32x4_p)vec_mergeh(r1, r2);
+}
+
+template <>
+inline uint32x4_p UnpackSIMD<2>(const uint32x4_p& a, const uint32x4_p& b, const uint32x4_p& c, const uint32x4_p& d)
+{
+    const uint64x2_p r1 = (uint64x2_p)vec_mergeh(a, b);
+    const uint64x2_p r2 = (uint64x2_p)vec_mergeh(c, d);
+    return (uint32x4_p)vec_mergel(r1, r2);
+}
+
+template <>
+inline uint32x4_p UnpackSIMD<3>(const uint32x4_p& a, const uint32x4_p& b, const uint32x4_p& c, const uint32x4_p& d)
+{
+    const uint64x2_p r1 = (uint64x2_p)vec_mergeh(a, b);
+    const uint64x2_p r2 = (uint64x2_p)vec_mergeh(c, d);
+    return (uint32x4_p)vec_mergeh(r1, r2);
+}
+
+template <unsigned int IDX>
+inline uint32x4_p UnpackSIMD(const uint32x4_p& v)
+{
+    // Should not be instantiated
+    CRYPTOPP_ASSERT(0);
+    return VecXor(v, v);
+}
+
+template <>
+inline uint32x4_p UnpackSIMD<0>(const uint32x4_p& v)
+{
+    // Splat to all lanes
+    const uint8x16_p m = {3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0};
+    return (uint32x4_p)VecPermute(v, v, m);
+}
+
+template <>
+inline uint32x4_p UnpackSIMD<1>(const uint32x4_p& v)
+{
+    // Splat to all lanes
+    const uint8x16_p m = {7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4};
+    return (uint32x4_p)VecPermute(v, v, m);
+}
+
+template <>
+inline uint32x4_p UnpackSIMD<2>(const uint32x4_p& v)
+{
+    // Splat to all lanes
+    const uint8x16_p m = {11,10,9,8, 11,10,9,8, 11,10,9,8, 11,10,9,8};
+    return (uint32x4_p)VecPermute(v, v, m);
+}
+
+template <>
+inline uint32x4_p UnpackSIMD<3>(const uint32x4_p& v)
+{
+    // Splat to all lanes
+    const uint8x16_p m = {15,14,13,12, 15,14,13,12, 15,14,13,12, 15,14,13,12};
+    return (uint32x4_p)VecPermute(v, v, m);
+}
+
+template <unsigned int IDX>
+inline uint32x4_p RepackSIMD(const uint32x4_p& a, const uint32x4_p& b, const uint32x4_p& c, const uint32x4_p& d)
+{
+    return UnpackSIMD<IDX>(a, b, c, d);
+}
+
+template <unsigned int IDX>
+inline uint32x4_p RepackSIMD(const uint32x4_p& v)
+{
+    return UnpackSIMD<IDX>(v);
+}
+
+#endif  // CRYPTOPP_POWER8_AVAILABLE
+
+// *************************** LEA Encryption ***************************//
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE || CRYPTOPP_SSSE3_AVAILABLE)
+
+template <class W>
+inline void LEA_Encryption(W temp[4], const word32 *subkeys, unsigned int rounds)
+{
+    temp[3] = RotateRight<3>(Add(Xor(temp[2], LoadKey<4>(subkeys)), Xor(temp[3], LoadKey<5>(subkeys))));
+    temp[2] = RotateRight<5>(Add(Xor(temp[1], LoadKey<2>(subkeys)), Xor(temp[2], LoadKey<3>(subkeys))));
+    temp[1] = RotateLeft<9>(Add(Xor(temp[0], LoadKey<0>(subkeys)), Xor(temp[1], LoadKey<1>(subkeys))));
+    temp[0] = RotateRight<3>(Add(Xor(temp[3], LoadKey<10>(subkeys)), Xor(temp[0], LoadKey<11>(subkeys))));
+    temp[3] = RotateRight<5>(Add(Xor(temp[2], LoadKey<8>(subkeys)), Xor(temp[3], LoadKey<9>(subkeys))));
+    temp[2] = RotateLeft<9>(Add(Xor(temp[1], LoadKey<6>(subkeys)), Xor(temp[2], LoadKey<7>(subkeys))));
+    temp[1] = RotateRight<3>(Add(Xor(temp[0], LoadKey<16>(subkeys)), Xor(temp[1], LoadKey<17>(subkeys))));
+    temp[0] = RotateRight<5>(Add(Xor(temp[3], LoadKey<14>(subkeys)), Xor(temp[0], LoadKey<15>(subkeys))));
+    temp[3] = RotateLeft<9>(Add(Xor(temp[2], LoadKey<12>(subkeys)), Xor(temp[3], LoadKey<13>(subkeys))));
+    temp[2] = RotateRight<3>(Add(Xor(temp[1], LoadKey<22>(subkeys)), Xor(temp[2], LoadKey<23>(subkeys))));
+    temp[1] = RotateRight<5>(Add(Xor(temp[0], LoadKey<20>(subkeys)), Xor(temp[1], LoadKey<21>(subkeys))));
+    temp[0] = RotateLeft<9>(Add(Xor(temp[3], LoadKey<18>(subkeys)), Xor(temp[0], LoadKey<19>(subkeys))));
+
+    temp[3] = RotateRight<3>(Add(Xor(temp[2], LoadKey<28>(subkeys)), Xor(temp[3], LoadKey<29>(subkeys))));
+    temp[2] = RotateRight<5>(Add(Xor(temp[1], LoadKey<26>(subkeys)), Xor(temp[2], LoadKey<27>(subkeys))));
+    temp[1] = RotateLeft<9>(Add(Xor(temp[0], LoadKey<24>(subkeys)), Xor(temp[1], LoadKey<25>(subkeys))));
+    temp[0] = RotateRight<3>(Add(Xor(temp[3], LoadKey<34>(subkeys)), Xor(temp[0], LoadKey<35>(subkeys))));
+    temp[3] = RotateRight<5>(Add(Xor(temp[2], LoadKey<32>(subkeys)), Xor(temp[3], LoadKey<33>(subkeys))));
+    temp[2] = RotateLeft<9>(Add(Xor(temp[1], LoadKey<30>(subkeys)), Xor(temp[2], LoadKey<31>(subkeys))));
+    temp[1] = RotateRight<3>(Add(Xor(temp[0], LoadKey<40>(subkeys)), Xor(temp[1], LoadKey<41>(subkeys))));
+    temp[0] = RotateRight<5>(Add(Xor(temp[3], LoadKey<38>(subkeys)), Xor(temp[0], LoadKey<39>(subkeys))));
+    temp[3] = RotateLeft<9>(Add(Xor(temp[2], LoadKey<36>(subkeys)), Xor(temp[3], LoadKey<37>(subkeys))));
+    temp[2] = RotateRight<3>(Add(Xor(temp[1], LoadKey<46>(subkeys)), Xor(temp[2], LoadKey<47>(subkeys))));
+    temp[1] = RotateRight<5>(Add(Xor(temp[0], LoadKey<44>(subkeys)), Xor(temp[1], LoadKey<45>(subkeys))));
+    temp[0] = RotateLeft<9>(Add(Xor(temp[3], LoadKey<42>(subkeys)), Xor(temp[0], LoadKey<43>(subkeys))));
+
+    temp[3] = RotateRight<3>(Add(Xor(temp[2], LoadKey<52>(subkeys)), Xor(temp[3], LoadKey<53>(subkeys))));
+    temp[2] = RotateRight<5>(Add(Xor(temp[1], LoadKey<50>(subkeys)), Xor(temp[2], LoadKey<51>(subkeys))));
+    temp[1] = RotateLeft<9>(Add(Xor(temp[0], LoadKey<48>(subkeys)), Xor(temp[1], LoadKey<49>(subkeys))));
+    temp[0] = RotateRight<3>(Add(Xor(temp[3], LoadKey<58>(subkeys)), Xor(temp[0], LoadKey<59>(subkeys))));
+    temp[3] = RotateRight<5>(Add(Xor(temp[2], LoadKey<56>(subkeys)), Xor(temp[3], LoadKey<57>(subkeys))));
+    temp[2] = RotateLeft<9>(Add(Xor(temp[1], LoadKey<54>(subkeys)), Xor(temp[2], LoadKey<55>(subkeys))));
+    temp[1] = RotateRight<3>(Add(Xor(temp[0], LoadKey<64>(subkeys)), Xor(temp[1], LoadKey<65>(subkeys))));
+    temp[0] = RotateRight<5>(Add(Xor(temp[3], LoadKey<62>(subkeys)), Xor(temp[0], LoadKey<63>(subkeys))));
+    temp[3] = RotateLeft<9>(Add(Xor(temp[2], LoadKey<60>(subkeys)), Xor(temp[3], LoadKey<61>(subkeys))));
+    temp[2] = RotateRight<3>(Add(Xor(temp[1], LoadKey<70>(subkeys)), Xor(temp[2], LoadKey<71>(subkeys))));
+    temp[1] = RotateRight<5>(Add(Xor(temp[0], LoadKey<68>(subkeys)), Xor(temp[1], LoadKey<69>(subkeys))));
+    temp[0] = RotateLeft<9>(Add(Xor(temp[3], LoadKey<66>(subkeys)), Xor(temp[0], LoadKey<67>(subkeys))));
+
+    temp[3] = RotateRight<3>(Add(Xor(temp[2], LoadKey<76>(subkeys)), Xor(temp[3], LoadKey<77>(subkeys))));
+    temp[2] = RotateRight<5>(Add(Xor(temp[1], LoadKey<74>(subkeys)), Xor(temp[2], LoadKey<75>(subkeys))));
+    temp[1] = RotateLeft<9>(Add(Xor(temp[0], LoadKey<72>(subkeys)), Xor(temp[1], LoadKey<73>(subkeys))));
+    temp[0] = RotateRight<3>(Add(Xor(temp[3], LoadKey<82>(subkeys)), Xor(temp[0], LoadKey<83>(subkeys))));
+    temp[3] = RotateRight<5>(Add(Xor(temp[2], LoadKey<80>(subkeys)), Xor(temp[3], LoadKey<81>(subkeys))));
+    temp[2] = RotateLeft<9>(Add(Xor(temp[1], LoadKey<78>(subkeys)), Xor(temp[2], LoadKey<79>(subkeys))));
+    temp[1] = RotateRight<3>(Add(Xor(temp[0], LoadKey<88>(subkeys)), Xor(temp[1], LoadKey<89>(subkeys))));
+    temp[0] = RotateRight<5>(Add(Xor(temp[3], LoadKey<86>(subkeys)), Xor(temp[0], LoadKey<87>(subkeys))));
+    temp[3] = RotateLeft<9>(Add(Xor(temp[2], LoadKey<84>(subkeys)), Xor(temp[3], LoadKey<85>(subkeys))));
+    temp[2] = RotateRight<3>(Add(Xor(temp[1], LoadKey<94>(subkeys)), Xor(temp[2], LoadKey<95>(subkeys))));
+    temp[1] = RotateRight<5>(Add(Xor(temp[0], LoadKey<92>(subkeys)), Xor(temp[1], LoadKey<93>(subkeys))));
+    temp[0] = RotateLeft<9>(Add(Xor(temp[3], LoadKey<90>(subkeys)), Xor(temp[0], LoadKey<91>(subkeys))));
+
+    temp[3] = RotateRight<3>(Add(Xor(temp[2], LoadKey<100>(subkeys)), Xor(temp[3], LoadKey<101>(subkeys))));
+    temp[2] = RotateRight<5>(Add(Xor(temp[1], LoadKey<98>(subkeys)), Xor(temp[2], LoadKey<99>(subkeys))));
+    temp[1] = RotateLeft<9>(Add(Xor(temp[0], LoadKey<96>(subkeys)), Xor(temp[1], LoadKey<97>(subkeys))));
+    temp[0] = RotateRight<3>(Add(Xor(temp[3], LoadKey<106>(subkeys)), Xor(temp[0], LoadKey<107>(subkeys))));
+    temp[3] = RotateRight<5>(Add(Xor(temp[2], LoadKey<104>(subkeys)), Xor(temp[3], LoadKey<105>(subkeys))));
+    temp[2] = RotateLeft<9>(Add(Xor(temp[1], LoadKey<102>(subkeys)), Xor(temp[2], LoadKey<103>(subkeys))));
+    temp[1] = RotateRight<3>(Add(Xor(temp[0], LoadKey<112>(subkeys)), Xor(temp[1], LoadKey<113>(subkeys))));
+    temp[0] = RotateRight<5>(Add(Xor(temp[3], LoadKey<110>(subkeys)), Xor(temp[0], LoadKey<111>(subkeys))));
+    temp[3] = RotateLeft<9>(Add(Xor(temp[2], LoadKey<108>(subkeys)), Xor(temp[3], LoadKey<109>(subkeys))));
+    temp[2] = RotateRight<3>(Add(Xor(temp[1], LoadKey<118>(subkeys)), Xor(temp[2], LoadKey<119>(subkeys))));
+    temp[1] = RotateRight<5>(Add(Xor(temp[0], LoadKey<116>(subkeys)), Xor(temp[1], LoadKey<117>(subkeys))));
+    temp[0] = RotateLeft<9>(Add(Xor(temp[3], LoadKey<114>(subkeys)), Xor(temp[0], LoadKey<115>(subkeys))));
+
+    temp[3] = RotateRight<3>(Add(Xor(temp[2], LoadKey<124>(subkeys)), Xor(temp[3], LoadKey<125>(subkeys))));
+    temp[2] = RotateRight<5>(Add(Xor(temp[1], LoadKey<122>(subkeys)), Xor(temp[2], LoadKey<123>(subkeys))));
+    temp[1] = RotateLeft<9>(Add(Xor(temp[0], LoadKey<120>(subkeys)), Xor(temp[1], LoadKey<121>(subkeys))));
+    temp[0] = RotateRight<3>(Add(Xor(temp[3], LoadKey<130>(subkeys)), Xor(temp[0], LoadKey<131>(subkeys))));
+    temp[3] = RotateRight<5>(Add(Xor(temp[2], LoadKey<128>(subkeys)), Xor(temp[3], LoadKey<129>(subkeys))));
+    temp[2] = RotateLeft<9>(Add(Xor(temp[1], LoadKey<126>(subkeys)), Xor(temp[2], LoadKey<127>(subkeys))));
+    temp[1] = RotateRight<3>(Add(Xor(temp[0], LoadKey<136>(subkeys)), Xor(temp[1], LoadKey<137>(subkeys))));
+    temp[0] = RotateRight<5>(Add(Xor(temp[3], LoadKey<134>(subkeys)), Xor(temp[0], LoadKey<135>(subkeys))));
+    temp[3] = RotateLeft<9>(Add(Xor(temp[2], LoadKey<132>(subkeys)), Xor(temp[3], LoadKey<133>(subkeys))));
+    temp[2] = RotateRight<3>(Add(Xor(temp[1], LoadKey<142>(subkeys)), Xor(temp[2], LoadKey<143>(subkeys))));
+    temp[1] = RotateRight<5>(Add(Xor(temp[0], LoadKey<140>(subkeys)), Xor(temp[1], LoadKey<141>(subkeys))));
+    temp[0] = RotateLeft<9>(Add(Xor(temp[3], LoadKey<138>(subkeys)), Xor(temp[0], LoadKey<139>(subkeys))));
+
+    if(rounds > 24)
+    {
+        temp[3] = RotateRight<3>(Add(Xor(temp[2], LoadKey<148>(subkeys)), Xor(temp[3], LoadKey<149>(subkeys))));
+        temp[2] = RotateRight<5>(Add(Xor(temp[1], LoadKey<146>(subkeys)), Xor(temp[2], LoadKey<147>(subkeys))));
+        temp[1] = RotateLeft<9>(Add(Xor(temp[0], LoadKey<144>(subkeys)), Xor(temp[1], LoadKey<145>(subkeys))));
+        temp[0] = RotateRight<3>(Add(Xor(temp[3], LoadKey<154>(subkeys)), Xor(temp[0], LoadKey<155>(subkeys))));
+        temp[3] = RotateRight<5>(Add(Xor(temp[2], LoadKey<152>(subkeys)), Xor(temp[3], LoadKey<153>(subkeys))));
+        temp[2] = RotateLeft<9>(Add(Xor(temp[1], LoadKey<150>(subkeys)), Xor(temp[2], LoadKey<151>(subkeys))));
+        temp[1] = RotateRight<3>(Add(Xor(temp[0], LoadKey<160>(subkeys)), Xor(temp[1], LoadKey<161>(subkeys))));
+        temp[0] = RotateRight<5>(Add(Xor(temp[3], LoadKey<158>(subkeys)), Xor(temp[0], LoadKey<159>(subkeys))));
+        temp[3] = RotateLeft<9>(Add(Xor(temp[2], LoadKey<156>(subkeys)), Xor(temp[3], LoadKey<157>(subkeys))));
+        temp[2] = RotateRight<3>(Add(Xor(temp[1], LoadKey<166>(subkeys)), Xor(temp[2], LoadKey<167>(subkeys))));
+        temp[1] = RotateRight<5>(Add(Xor(temp[0], LoadKey<164>(subkeys)), Xor(temp[1], LoadKey<165>(subkeys))));
+        temp[0] = RotateLeft<9>(Add(Xor(temp[3], LoadKey<162>(subkeys)), Xor(temp[0], LoadKey<163>(subkeys))));
+    }
+
+    if(rounds > 28)
+    {
+        temp[3] = RotateRight<3>(Add(Xor(temp[2], LoadKey<172>(subkeys)), Xor(temp[3], LoadKey<173>(subkeys))));
+        temp[2] = RotateRight<5>(Add(Xor(temp[1], LoadKey<170>(subkeys)), Xor(temp[2], LoadKey<171>(subkeys))));
+        temp[1] = RotateLeft<9>(Add(Xor(temp[0], LoadKey<168>(subkeys)), Xor(temp[1], LoadKey<169>(subkeys))));
+        temp[0] = RotateRight<3>(Add(Xor(temp[3], LoadKey<178>(subkeys)), Xor(temp[0], LoadKey<179>(subkeys))));
+        temp[3] = RotateRight<5>(Add(Xor(temp[2], LoadKey<176>(subkeys)), Xor(temp[3], LoadKey<177>(subkeys))));
+        temp[2] = RotateLeft<9>(Add(Xor(temp[1], LoadKey<174>(subkeys)), Xor(temp[2], LoadKey<175>(subkeys))));
+        temp[1] = RotateRight<3>(Add(Xor(temp[0], LoadKey<184>(subkeys)), Xor(temp[1], LoadKey<185>(subkeys))));
+        temp[0] = RotateRight<5>(Add(Xor(temp[3], LoadKey<182>(subkeys)), Xor(temp[0], LoadKey<183>(subkeys))));
+        temp[3] = RotateLeft<9>(Add(Xor(temp[2], LoadKey<180>(subkeys)), Xor(temp[3], LoadKey<181>(subkeys))));
+        temp[2] = RotateRight<3>(Add(Xor(temp[1], LoadKey<190>(subkeys)), Xor(temp[2], LoadKey<191>(subkeys))));
+        temp[1] = RotateRight<5>(Add(Xor(temp[0], LoadKey<188>(subkeys)), Xor(temp[1], LoadKey<189>(subkeys))));
+        temp[0] = RotateLeft<9>(Add(Xor(temp[3], LoadKey<186>(subkeys)), Xor(temp[0], LoadKey<187>(subkeys))));
+    }
+}
+
+// *************************** LEA Decryption ***************************//
+
+template <class W>
+inline void LEA_Decryption(W temp[4], const word32 *subkeys, unsigned int rounds)
+{
+    if(rounds > 28)
+    {
+        temp[0] = Xor(Sub(RotateRight<9>(temp[0]), Xor(temp[3], LoadKey<186>(subkeys))), LoadKey<187>(subkeys));
+        temp[1] = Xor(Sub(RotateLeft<5>(temp[1]), Xor(temp[0], LoadKey<188>(subkeys))), LoadKey<189>(subkeys));
+        temp[2] = Xor(Sub(RotateLeft<3>(temp[2]), Xor(temp[1], LoadKey<190>(subkeys))), LoadKey<191>(subkeys));
+        temp[3] = Xor(Sub(RotateRight<9>(temp[3]), Xor(temp[2], LoadKey<180>(subkeys))), LoadKey<181>(subkeys));
+        temp[0] = Xor(Sub(RotateLeft<5>(temp[0]), Xor(temp[3], LoadKey<182>(subkeys))), LoadKey<183>(subkeys));
+        temp[1] = Xor(Sub(RotateLeft<3>(temp[1]), Xor(temp[0], LoadKey<184>(subkeys))), LoadKey<185>(subkeys));
+        temp[2] = Xor(Sub(RotateRight<9>(temp[2]), Xor(temp[1], LoadKey<174>(subkeys))), LoadKey<175>(subkeys));
+        temp[3] = Xor(Sub(RotateLeft<5>(temp[3]), Xor(temp[2], LoadKey<176>(subkeys))), LoadKey<177>(subkeys));
+        temp[0] = Xor(Sub(RotateLeft<3>(temp[0]), Xor(temp[3], LoadKey<178>(subkeys))), LoadKey<179>(subkeys));
+        temp[1] = Xor(Sub(RotateRight<9>(temp[1]), Xor(temp[0], LoadKey<168>(subkeys))), LoadKey<169>(subkeys));
+        temp[2] = Xor(Sub(RotateLeft<5>(temp[2]), Xor(temp[1], LoadKey<170>(subkeys))), LoadKey<171>(subkeys));
+        temp[3] = Xor(Sub(RotateLeft<3>(temp[3]), Xor(temp[2], LoadKey<172>(subkeys))), LoadKey<173>(subkeys));
+    }
+
+    if(rounds > 24)
+    {
+        temp[0] = Xor(Sub(RotateRight<9>(temp[0]), Xor(temp[3], LoadKey<162>(subkeys))), LoadKey<163>(subkeys));
+        temp[1] = Xor(Sub(RotateLeft<5>(temp[1]), Xor(temp[0], LoadKey<164>(subkeys))), LoadKey<165>(subkeys));
+        temp[2] = Xor(Sub(RotateLeft<3>(temp[2]), Xor(temp[1], LoadKey<166>(subkeys))), LoadKey<167>(subkeys));
+        temp[3] = Xor(Sub(RotateRight<9>(temp[3]), Xor(temp[2], LoadKey<156>(subkeys))), LoadKey<157>(subkeys));
+        temp[0] = Xor(Sub(RotateLeft<5>(temp[0]), Xor(temp[3], LoadKey<158>(subkeys))), LoadKey<159>(subkeys));
+        temp[1] = Xor(Sub(RotateLeft<3>(temp[1]), Xor(temp[0], LoadKey<160>(subkeys))), LoadKey<161>(subkeys));
+        temp[2] = Xor(Sub(RotateRight<9>(temp[2]), Xor(temp[1], LoadKey<150>(subkeys))), LoadKey<151>(subkeys));
+        temp[3] = Xor(Sub(RotateLeft<5>(temp[3]), Xor(temp[2], LoadKey<152>(subkeys))), LoadKey<153>(subkeys));
+        temp[0] = Xor(Sub(RotateLeft<3>(temp[0]), Xor(temp[3], LoadKey<154>(subkeys))), LoadKey<155>(subkeys));
+        temp[1] = Xor(Sub(RotateRight<9>(temp[1]), Xor(temp[0], LoadKey<144>(subkeys))), LoadKey<145>(subkeys));
+        temp[2] = Xor(Sub(RotateLeft<5>(temp[2]), Xor(temp[1], LoadKey<146>(subkeys))), LoadKey<147>(subkeys));
+        temp[3] = Xor(Sub(RotateLeft<3>(temp[3]), Xor(temp[2], LoadKey<148>(subkeys))), LoadKey<149>(subkeys));
+    }
+
+    temp[0] = Xor(Sub(RotateRight<9>(temp[0]), Xor(temp[3], LoadKey<138>(subkeys))), LoadKey<139>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<5>(temp[1]), Xor(temp[0], LoadKey<140>(subkeys))), LoadKey<141>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<3>(temp[2]), Xor(temp[1], LoadKey<142>(subkeys))), LoadKey<143>(subkeys));
+    temp[3] = Xor(Sub(RotateRight<9>(temp[3]), Xor(temp[2], LoadKey<132>(subkeys))), LoadKey<133>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<5>(temp[0]), Xor(temp[3], LoadKey<134>(subkeys))), LoadKey<135>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<3>(temp[1]), Xor(temp[0], LoadKey<136>(subkeys))), LoadKey<137>(subkeys));
+    temp[2] = Xor(Sub(RotateRight<9>(temp[2]), Xor(temp[1], LoadKey<126>(subkeys))), LoadKey<127>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<5>(temp[3]), Xor(temp[2], LoadKey<128>(subkeys))), LoadKey<129>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<3>(temp[0]), Xor(temp[3], LoadKey<130>(subkeys))), LoadKey<131>(subkeys));
+    temp[1] = Xor(Sub(RotateRight<9>(temp[1]), Xor(temp[0], LoadKey<120>(subkeys))), LoadKey<121>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<5>(temp[2]), Xor(temp[1], LoadKey<122>(subkeys))), LoadKey<123>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<3>(temp[3]), Xor(temp[2], LoadKey<124>(subkeys))), LoadKey<125>(subkeys));
+
+    temp[0] = Xor(Sub(RotateRight<9>(temp[0]), Xor(temp[3], LoadKey<114>(subkeys))), LoadKey<115>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<5>(temp[1]), Xor(temp[0], LoadKey<116>(subkeys))), LoadKey<117>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<3>(temp[2]), Xor(temp[1], LoadKey<118>(subkeys))), LoadKey<119>(subkeys));
+    temp[3] = Xor(Sub(RotateRight<9>(temp[3]), Xor(temp[2], LoadKey<108>(subkeys))), LoadKey<109>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<5>(temp[0]), Xor(temp[3], LoadKey<110>(subkeys))), LoadKey<111>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<3>(temp[1]), Xor(temp[0], LoadKey<112>(subkeys))), LoadKey<113>(subkeys));
+    temp[2] = Xor(Sub(RotateRight<9>(temp[2]), Xor(temp[1], LoadKey<102>(subkeys))), LoadKey<103>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<5>(temp[3]), Xor(temp[2], LoadKey<104>(subkeys))), LoadKey<105>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<3>(temp[0]), Xor(temp[3], LoadKey<106>(subkeys))), LoadKey<107>(subkeys));
+    temp[1] = Xor(Sub(RotateRight<9>(temp[1]), Xor(temp[0], LoadKey<96>(subkeys))), LoadKey<97>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<5>(temp[2]), Xor(temp[1], LoadKey<98>(subkeys))), LoadKey<99>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<3>(temp[3]), Xor(temp[2], LoadKey<100>(subkeys))), LoadKey<101>(subkeys));
+
+    temp[0] = Xor(Sub(RotateRight<9>(temp[0]), Xor(temp[3], LoadKey<90>(subkeys))), LoadKey<91>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<5>(temp[1]), Xor(temp[0], LoadKey<92>(subkeys))), LoadKey<93>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<3>(temp[2]), Xor(temp[1], LoadKey<94>(subkeys))), LoadKey<95>(subkeys));
+    temp[3] = Xor(Sub(RotateRight<9>(temp[3]), Xor(temp[2], LoadKey<84>(subkeys))), LoadKey<85>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<5>(temp[0]), Xor(temp[3], LoadKey<86>(subkeys))), LoadKey<87>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<3>(temp[1]), Xor(temp[0], LoadKey<88>(subkeys))), LoadKey<89>(subkeys));
+    temp[2] = Xor(Sub(RotateRight<9>(temp[2]), Xor(temp[1], LoadKey<78>(subkeys))), LoadKey<79>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<5>(temp[3]), Xor(temp[2], LoadKey<80>(subkeys))), LoadKey<81>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<3>(temp[0]), Xor(temp[3], LoadKey<82>(subkeys))), LoadKey<83>(subkeys));
+    temp[1] = Xor(Sub(RotateRight<9>(temp[1]), Xor(temp[0], LoadKey<72>(subkeys))), LoadKey<73>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<5>(temp[2]), Xor(temp[1], LoadKey<74>(subkeys))), LoadKey<75>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<3>(temp[3]), Xor(temp[2], LoadKey<76>(subkeys))), LoadKey<77>(subkeys));
+
+    temp[0] = Xor(Sub(RotateRight<9>(temp[0]), Xor(temp[3], LoadKey<66>(subkeys))), LoadKey<67>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<5>(temp[1]), Xor(temp[0], LoadKey<68>(subkeys))), LoadKey<69>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<3>(temp[2]), Xor(temp[1], LoadKey<70>(subkeys))), LoadKey<71>(subkeys));
+    temp[3] = Xor(Sub(RotateRight<9>(temp[3]), Xor(temp[2], LoadKey<60>(subkeys))), LoadKey<61>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<5>(temp[0]), Xor(temp[3], LoadKey<62>(subkeys))), LoadKey<63>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<3>(temp[1]), Xor(temp[0], LoadKey<64>(subkeys))), LoadKey<65>(subkeys));
+    temp[2] = Xor(Sub(RotateRight<9>(temp[2]), Xor(temp[1], LoadKey<54>(subkeys))), LoadKey<55>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<5>(temp[3]), Xor(temp[2], LoadKey<56>(subkeys))), LoadKey<57>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<3>(temp[0]), Xor(temp[3], LoadKey<58>(subkeys))), LoadKey<59>(subkeys));
+    temp[1] = Xor(Sub(RotateRight<9>(temp[1]), Xor(temp[0], LoadKey<48>(subkeys))), LoadKey<49>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<5>(temp[2]), Xor(temp[1], LoadKey<50>(subkeys))), LoadKey<51>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<3>(temp[3]), Xor(temp[2], LoadKey<52>(subkeys))), LoadKey<53>(subkeys));
+
+    temp[0] = Xor(Sub(RotateRight<9>(temp[0]), Xor(temp[3], LoadKey<42>(subkeys))), LoadKey<43>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<5>(temp[1]), Xor(temp[0], LoadKey<44>(subkeys))), LoadKey<45>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<3>(temp[2]), Xor(temp[1], LoadKey<46>(subkeys))), LoadKey<47>(subkeys));
+    temp[3] = Xor(Sub(RotateRight<9>(temp[3]), Xor(temp[2], LoadKey<36>(subkeys))), LoadKey<37>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<5>(temp[0]), Xor(temp[3], LoadKey<38>(subkeys))), LoadKey<39>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<3>(temp[1]), Xor(temp[0], LoadKey<40>(subkeys))), LoadKey<41>(subkeys));
+    temp[2] = Xor(Sub(RotateRight<9>(temp[2]), Xor(temp[1], LoadKey<30>(subkeys))), LoadKey<31>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<5>(temp[3]), Xor(temp[2], LoadKey<32>(subkeys))), LoadKey<33>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<3>(temp[0]), Xor(temp[3], LoadKey<34>(subkeys))), LoadKey<35>(subkeys));
+    temp[1] = Xor(Sub(RotateRight<9>(temp[1]), Xor(temp[0], LoadKey<24>(subkeys))), LoadKey<25>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<5>(temp[2]), Xor(temp[1], LoadKey<26>(subkeys))), LoadKey<27>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<3>(temp[3]), Xor(temp[2], LoadKey<28>(subkeys))), LoadKey<29>(subkeys));
+
+    temp[0] = Xor(Sub(RotateRight<9>(temp[0]), Xor(temp[3], LoadKey<18>(subkeys))), LoadKey<19>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<5>(temp[1]), Xor(temp[0], LoadKey<20>(subkeys))), LoadKey<21>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<3>(temp[2]), Xor(temp[1], LoadKey<22>(subkeys))), LoadKey<23>(subkeys));
+    temp[3] = Xor(Sub(RotateRight<9>(temp[3]), Xor(temp[2], LoadKey<12>(subkeys))), LoadKey<13>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<5>(temp[0]), Xor(temp[3], LoadKey<14>(subkeys))), LoadKey<15>(subkeys));
+    temp[1] = Xor(Sub(RotateLeft<3>(temp[1]), Xor(temp[0], LoadKey<16>(subkeys))), LoadKey<17>(subkeys));
+    temp[2] = Xor(Sub(RotateRight<9>(temp[2]), Xor(temp[1], LoadKey<6>(subkeys))), LoadKey<7>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<5>(temp[3]), Xor(temp[2], LoadKey<8>(subkeys))), LoadKey<9>(subkeys));
+    temp[0] = Xor(Sub(RotateLeft<3>(temp[0]), Xor(temp[3], LoadKey<10>(subkeys))), LoadKey<11>(subkeys));
+    temp[1] = Xor(Sub(RotateRight<9>(temp[1]), Xor(temp[0], LoadKey<0>(subkeys))), LoadKey<1>(subkeys));
+    temp[2] = Xor(Sub(RotateLeft<5>(temp[2]), Xor(temp[1], LoadKey<2>(subkeys))), LoadKey<3>(subkeys));
+    temp[3] = Xor(Sub(RotateLeft<3>(temp[3]), Xor(temp[2], LoadKey<4>(subkeys))), LoadKey<5>(subkeys));
+}
+
+#endif  // LEA Encryption and Decryption
+
+// *************************** ARM NEON ***************************//
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+
+inline void LEA_Enc_Block(uint32x4_t &block0,
+    const word32 *subkeys, unsigned int rounds)
+{
+    uint32x4_t temp[4];
+    temp[0] = UnpackNEON<0>(block0);
+    temp[1] = UnpackNEON<1>(block0);
+    temp[2] = UnpackNEON<2>(block0);
+    temp[3] = UnpackNEON<3>(block0);
+
+    LEA_Encryption(temp, subkeys, rounds);
+
+    block0 = RepackNEON<0>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+inline void LEA_Dec_Block(uint32x4_t &block0,
+    const word32 *subkeys, unsigned int rounds)
+{
+    uint32x4_t temp[4];
+    temp[0] = UnpackNEON<0>(block0);
+    temp[1] = UnpackNEON<1>(block0);
+    temp[2] = UnpackNEON<2>(block0);
+    temp[3] = UnpackNEON<3>(block0);
+
+    LEA_Decryption(temp, subkeys, rounds);
+
+    block0 = RepackNEON<0>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+inline void LEA_Enc_4_Blocks(uint32x4_t &block0, uint32x4_t &block1,
+    uint32x4_t &block2, uint32x4_t &block3, const word32 *subkeys, unsigned int rounds)
+{
+    uint32x4_t temp[4];
+    temp[0] = UnpackNEON<0>(block0, block1, block2, block3);
+    temp[1] = UnpackNEON<1>(block0, block1, block2, block3);
+    temp[2] = UnpackNEON<2>(block0, block1, block2, block3);
+    temp[3] = UnpackNEON<3>(block0, block1, block2, block3);
+
+    LEA_Encryption(temp, subkeys, rounds);
+
+    block0 = RepackNEON<0>(temp[0], temp[1], temp[2], temp[3]);
+    block1 = RepackNEON<1>(temp[0], temp[1], temp[2], temp[3]);
+    block2 = RepackNEON<2>(temp[0], temp[1], temp[2], temp[3]);
+    block3 = RepackNEON<3>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+inline void LEA_Dec_4_Blocks(uint32x4_t &block0, uint32x4_t &block1,
+    uint32x4_t &block2, uint32x4_t &block3, const word32 *subkeys, unsigned int rounds)
+{
+    uint32x4_t temp[4];
+    temp[0] = UnpackNEON<0>(block0, block1, block2, block3);
+    temp[1] = UnpackNEON<1>(block0, block1, block2, block3);
+    temp[2] = UnpackNEON<2>(block0, block1, block2, block3);
+    temp[3] = UnpackNEON<3>(block0, block1, block2, block3);
+
+    LEA_Decryption(temp, subkeys, rounds);
+
+    block0 = RepackNEON<0>(temp[0], temp[1], temp[2], temp[3]);
+    block1 = RepackNEON<1>(temp[0], temp[1], temp[2], temp[3]);
+    block2 = RepackNEON<2>(temp[0], temp[1], temp[2], temp[3]);
+    block3 = RepackNEON<3>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+// *************************** IA-32 ***************************//
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+
+inline void LEA_Enc_Block(__m128i &block0,
+    const word32 *subkeys, unsigned int rounds)
+{
+    __m128i temp[4];
+    temp[0] = UnpackXMM<0>(block0);
+    temp[1] = UnpackXMM<1>(block0);
+    temp[2] = UnpackXMM<2>(block0);
+    temp[3] = UnpackXMM<3>(block0);
+
+    LEA_Encryption(temp, subkeys, rounds);
+
+    block0 = RepackXMM<0>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+inline void LEA_Dec_Block(__m128i &block0,
+    const word32 *subkeys, unsigned int rounds)
+{
+    __m128i temp[4];
+    temp[0] = UnpackXMM<0>(block0);
+    temp[1] = UnpackXMM<1>(block0);
+    temp[2] = UnpackXMM<2>(block0);
+    temp[3] = UnpackXMM<3>(block0);
+
+    LEA_Decryption(temp, subkeys, rounds);
+
+    block0 = RepackXMM<0>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+inline void LEA_Enc_4_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, const word32 *subkeys, unsigned int rounds)
+{
+    __m128i temp[4];
+    temp[0] = UnpackXMM<0>(block0, block1, block2, block3);
+    temp[1] = UnpackXMM<1>(block0, block1, block2, block3);
+    temp[2] = UnpackXMM<2>(block0, block1, block2, block3);
+    temp[3] = UnpackXMM<3>(block0, block1, block2, block3);
+
+    LEA_Encryption(temp, subkeys, rounds);
+
+    block0 = RepackXMM<0>(temp[0], temp[1], temp[2], temp[3]);
+    block1 = RepackXMM<1>(temp[0], temp[1], temp[2], temp[3]);
+    block2 = RepackXMM<2>(temp[0], temp[1], temp[2], temp[3]);
+    block3 = RepackXMM<3>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+inline void LEA_Dec_4_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, const word32 *subkeys, unsigned int rounds)
+{
+    __m128i temp[4];
+    temp[0] = UnpackXMM<0>(block0, block1, block2, block3);
+    temp[1] = UnpackXMM<1>(block0, block1, block2, block3);
+    temp[2] = UnpackXMM<2>(block0, block1, block2, block3);
+    temp[3] = UnpackXMM<3>(block0, block1, block2, block3);
+
+    LEA_Decryption(temp, subkeys, rounds);
+
+    block0 = RepackXMM<0>(temp[0], temp[1], temp[2], temp[3]);
+    block1 = RepackXMM<1>(temp[0], temp[1], temp[2], temp[3]);
+    block2 = RepackXMM<2>(temp[0], temp[1], temp[2], temp[3]);
+    block3 = RepackXMM<3>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
+
+// *************************** Power8 ***************************//
+
+#if (CRYPTOPP_POWER8_AVAILABLE)
+
+inline void LEA_Enc_Block(uint32x4_p &block0,
+    const word32 *subkeys, unsigned int rounds)
+{
+    uint32x4_p temp[4];
+    temp[0] = UnpackSIMD<0>(block0);
+    temp[1] = UnpackSIMD<1>(block0);
+    temp[2] = UnpackSIMD<2>(block0);
+    temp[3] = UnpackSIMD<3>(block0);
+
+    LEA_Encryption(temp, subkeys, rounds);
+
+    block0 = RepackSIMD<0>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+inline void LEA_Dec_Block(uint32x4_p &block0,
+    const word32 *subkeys, unsigned int rounds)
+{
+    uint32x4_p temp[4];
+    temp[0] = UnpackSIMD<0>(block0);
+    temp[1] = UnpackSIMD<1>(block0);
+    temp[2] = UnpackSIMD<2>(block0);
+    temp[3] = UnpackSIMD<3>(block0);
+
+    LEA_Decryption(temp, subkeys, rounds);
+
+    block0 = RepackSIMD<0>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+inline void LEA_Enc_4_Blocks(uint32x4_p &block0, uint32x4_p &block1,
+    uint32x4_p &block2, uint32x4_p &block3, const word32 *subkeys, unsigned int rounds)
+{
+    uint32x4_p temp[4];
+    temp[0] = UnpackSIMD<0>(block0, block1, block2, block3);
+    temp[1] = UnpackSIMD<1>(block0, block1, block2, block3);
+    temp[2] = UnpackSIMD<2>(block0, block1, block2, block3);
+    temp[3] = UnpackSIMD<3>(block0, block1, block2, block3);
+
+    LEA_Encryption(temp, subkeys, rounds);
+
+    block0 = RepackSIMD<0>(temp[0], temp[1], temp[2], temp[3]);
+    block1 = RepackSIMD<1>(temp[0], temp[1], temp[2], temp[3]);
+    block2 = RepackSIMD<2>(temp[0], temp[1], temp[2], temp[3]);
+    block3 = RepackSIMD<3>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+inline void LEA_Dec_4_Blocks(uint32x4_p &block0, uint32x4_p &block1,
+    uint32x4_p &block2, uint32x4_p &block3, const word32 *subkeys, unsigned int rounds)
+{
+    uint32x4_p temp[4];
+    temp[0] = UnpackSIMD<0>(block0, block1, block2, block3);
+    temp[1] = UnpackSIMD<1>(block0, block1, block2, block3);
+    temp[2] = UnpackSIMD<2>(block0, block1, block2, block3);
+    temp[3] = UnpackSIMD<3>(block0, block1, block2, block3);
+
+    LEA_Decryption(temp, subkeys, rounds);
+
+    block0 = RepackSIMD<0>(temp[0], temp[1], temp[2], temp[3]);
+    block1 = RepackSIMD<1>(temp[0], temp[1], temp[2], temp[3]);
+    block2 = RepackSIMD<2>(temp[0], temp[1], temp[2], temp[3]);
+    block3 = RepackSIMD<3>(temp[0], temp[1], temp[2], temp[3]);
+}
+
+#endif  // CRYPTOPP_POWER8_AVAILABLE
+
+ANONYMOUS_NAMESPACE_END
+
+// *************************** SIMD Templates ***************************//
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+size_t LEA_Enc_AdvancedProcessBlocks_SSSE3(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_4x1_SSE(LEA_Enc_Block, LEA_Enc_4_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t LEA_Dec_AdvancedProcessBlocks_SSSE3(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_4x1_SSE(LEA_Dec_Block, LEA_Dec_4_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif // CRYPTOPP_SSSE3_AVAILABLE
+
+#if defined(CRYPTOPP_ARM_NEON_AVAILABLE)
+size_t LEA_Enc_AdvancedProcessBlocks_NEON(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_4x1_NEON(LEA_Enc_Block, LEA_Enc_4_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t LEA_Dec_AdvancedProcessBlocks_NEON(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_4x1_NEON(LEA_Dec_Block, LEA_Dec_4_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif // CRYPTOPP_ARM_NEON_AVAILABLE
+
+#if defined(CRYPTOPP_POWER8_AVAILABLE)
+size_t LEA_Enc_AdvancedProcessBlocks_POWER8(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_4x1_ALTIVEC(LEA_Enc_Block, LEA_Enc_4_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t LEA_Dec_AdvancedProcessBlocks_POWER8(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_4x1_ALTIVEC(LEA_Dec_Block, LEA_Dec_4_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif // CRYPTOPP_POWER8_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/lsh.h b/runtime/third_party/cryptopp/lsh.h
new file mode 100644
index 0000000..f89630a
--- /dev/null
+++ b/runtime/third_party/cryptopp/lsh.h
@@ -0,0 +1,262 @@
+// lsh.h - written and placed in the public domain by Jeffrey Walton
+//         Based on the specification and source code provided by
+//         Korea Internet & Security Agency (KISA) website. Also
+//         see https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do
+//         and https://seed.kisa.or.kr/kisa/Board/22/detailView.do.
+
+// We are hitting some sort of GCC bug in the LSH AVX2 code path.
+// Clang is OK on the AVX2 code path. We believe it is GCC Issue
+// 82735, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735. It
+// makes using zeroupper a little tricky.
+
+/// \file lsh.h
+/// \brief Classes for the LSH hash functions
+/// \since Crypto++ 8.6
+/// \sa <A HREF="https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do">LSH</A>
+///  on the Korea Internet & Security Agency (KISA) website.
+#ifndef CRYPTOPP_LSH_H
+#define CRYPTOPP_LSH_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+
+// Enable SSE2 and AVX2 for 64-bit machines.
+// 32-bit machines slow down with SSE2.
+#if (CRYPTOPP_BOOL_X32) || (CRYPTOPP_BOOL_X64)
+# define CRYPTOPP_ENABLE_64BIT_SSE 1
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief LSH-224 and LSH-256 hash base class
+/// \details LSH256_Base is the base class for both LSH-224 and LSH-256
+/// \since Crypto++ 8.6
+class LSH256_Base : public HashTransformation
+{
+public:
+	/// \brief Block size, in bytes
+	/// \details LSH_256 uses LSH256_MSG_BLK_BYTE_LEN for block size, which is 128
+	CRYPTOPP_CONSTANT(BLOCKSIZE = 128);
+
+	virtual ~LSH256_Base() {}
+
+	unsigned int BlockSize() const { return BLOCKSIZE; }
+	unsigned int DigestSize() const { return m_digestSize; }
+	unsigned int OptimalDataAlignment() const { return GetAlignmentOf<word32>(); }
+
+	void Restart();
+	void Update(const byte *input, size_t size);
+	void TruncatedFinal(byte *hash, size_t size);
+
+	std::string AlgorithmProvider() const;
+
+protected:
+	LSH256_Base(unsigned int algType, unsigned int digestSize)
+		: m_digestSize(digestSize) { m_state[80] = algType; }
+
+protected:
+	// Working state is:
+	//   * cv_l = 8 32-bit words
+	//   * cv_r = 8 32-bit words
+	//   * submsg_e_l = 8 32-bit words
+	//   * submsg_e_r = 8 32-bit words
+	//   * submsg_o_l = 8 32-bit words
+	//   * submsg_o_r = 8 32-bit words
+	//   * last_block = 32 32-bit words (128 bytes)
+	//   * algType
+	//   * remainingBitLength
+	FixedSizeSecBlock<word32, 80+2> m_state;
+	// word32 m_algType, m_remainingBitLength;
+	word32 m_digestSize;
+};
+
+/// \brief LSH-224 hash function
+/// \sa <A HREF="https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do">LSH</A>
+///  on the Korea Internet & Security Agency (KISA) website.
+/// \since Crypto++ 8.6
+class LSH224 : public LSH256_Base
+{
+public:
+	/// \brief Digest size, in bytes
+	/// \details LSH_256 uses LSH_GET_HASHBYTE(algType) for digest size, which is 28
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 28);
+	/// \brief Block size, in bytes
+	/// \details LSH_256 uses LSH256_MSG_BLK_BYTE_LEN for block size, which is 128
+	CRYPTOPP_CONSTANT(BLOCKSIZE = LSH256_Base::BLOCKSIZE);
+
+	/// \brief The algorithm's name
+	/// \return the standard algorithm name
+	/// \details The standard algorithm name can be a name like <tt>AES</tt> or <tt>AES/GCM</tt>.
+	///  Some algorithms do not have standard names yet. For example, there is no standard
+	///  algorithm name for Shoup's ECIES.
+	/// \note StaticAlgorithmName is not universally implemented yet.
+	static std::string StaticAlgorithmName() { return "LSH-224"; }
+
+	/// \brief Construct a LSH-224
+	/// \details LSH_TYPE_224 is the magic value 0x000001C defined in lsh.cpp.
+	LSH224() : LSH256_Base(0x000001C, DIGESTSIZE) { Restart(); }
+
+	std::string AlgorithmName() const { return StaticAlgorithmName(); }
+};
+
+/// \brief LSH-256 hash function
+/// \sa <A HREF="https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do">LSH</A>
+///  on the Korea Internet & Security Agency (KISA) website.
+/// \since Crypto++ 8.6
+class LSH256 : public LSH256_Base
+{
+public:
+	/// \brief Digest size, in bytes
+	/// \details LSH_256 uses LSH_GET_HASHBYTE(algType) for digest size, which is 32
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 32);
+	/// \brief Block size, in bytes
+	/// \details LSH_256 uses LSH256_MSG_BLK_BYTE_LEN for block size, which is 128
+	CRYPTOPP_CONSTANT(BLOCKSIZE = LSH256_Base::BLOCKSIZE);
+
+	/// \brief The algorithm's name
+	/// \return the standard algorithm name
+	/// \details The standard algorithm name can be a name like <tt>AES</tt> or <tt>AES/GCM</tt>.
+	///  Some algorithms do not have standard names yet. For example, there is no standard
+	///  algorithm name for Shoup's ECIES.
+	/// \note StaticAlgorithmName is not universally implemented yet.
+	static std::string StaticAlgorithmName() { return "LSH-256"; }
+
+	/// \brief Construct a LSH-256
+	/// \details LSH_TYPE_256 is the magic value 0x0000020 defined in lsh.cpp.
+	LSH256() : LSH256_Base(0x0000020, DIGESTSIZE) { Restart(); }
+
+	std::string AlgorithmName() const { return StaticAlgorithmName(); }
+};
+
+/// \brief LSH-384 and LSH-512 hash base class
+/// \details LSH512_Base is the base class for both LSH-384 and LSH-512
+/// \since Crypto++ 8.6
+class LSH512_Base : public HashTransformation
+{
+public:
+	/// \brief Block size, in bytes
+	/// \details LSH_512 uses LSH512_MSG_BLK_BYTE_LEN for block size, which is 256
+	CRYPTOPP_CONSTANT(BLOCKSIZE = 256);
+
+	virtual ~LSH512_Base() {}
+
+	unsigned int BlockSize() const { return BLOCKSIZE; }
+	unsigned int DigestSize() const { return m_digestSize; }
+	unsigned int OptimalDataAlignment() const { return GetAlignmentOf<word64>(); }
+
+	void Restart();
+	void Update(const byte *input, size_t size);
+	void TruncatedFinal(byte *hash, size_t size);
+
+	std::string AlgorithmProvider() const;
+
+protected:
+	LSH512_Base(unsigned int algType, unsigned int digestSize)
+		: m_digestSize(digestSize) { m_state[80] = algType; }
+
+protected:
+	// Working state is:
+	//   * cv_l = 8 64-bit words
+	//   * cv_r = 8 64-bit words
+	//   * submsg_e_l = 8 64-bit words
+	//   * submsg_e_r = 8 64-bit words
+	//   * submsg_o_l = 8 64-bit words
+	//   * submsg_o_r = 8 64-bit words
+	//   * last_block = 32 64-bit words (256 bytes)
+	//   * algType
+	//   * remainingBitLength
+	FixedSizeSecBlock<word64, 80+2> m_state;
+	// word32 m_algType, m_remainingBitLength;
+	word32 m_digestSize;
+};
+
+/// \brief LSH-384 hash function
+/// \sa <A HREF="https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do">LSH</A>
+///  on the Korea Internet & Security Agency (KISA) website.
+/// \since Crypto++ 8.6
+class LSH384 : public LSH512_Base
+{
+public:
+	/// \brief Digest size, in bytes
+	/// \details LSH_512 uses LSH_GET_HASHBYTE(algType) for digest size, which is 48
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 48);
+	/// \brief Block size, in bytes
+	/// \details LSH_512 uses LSH512_MSG_BLK_BYTE_LEN for block size, which is 256
+	CRYPTOPP_CONSTANT(BLOCKSIZE = LSH512_Base::BLOCKSIZE);
+
+	/// \brief The algorithm's name
+	/// \return the standard algorithm name
+	/// \details The standard algorithm name can be a name like <tt>AES</tt> or <tt>AES/GCM</tt>.
+	///  Some algorithms do not have standard names yet. For example, there is no standard
+	///  algorithm name for Shoup's ECIES.
+	/// \note StaticAlgorithmName is not universally implemented yet.
+	static std::string StaticAlgorithmName() { return "LSH-384"; }
+
+	/// \brief Construct a LSH-384
+	/// \details LSH_TYPE_384 is the magic value 0x0010030 defined in lsh.cpp.
+	LSH384() : LSH512_Base(0x0010030, DIGESTSIZE) { Restart(); }
+
+	std::string AlgorithmName() const { return StaticAlgorithmName(); }
+};
+
+/// \brief LSH-512 hash function
+/// \sa <A HREF="https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do">LSH</A>
+///  on the Korea Internet & Security Agency (KISA) website.
+/// \since Crypto++ 8.6
+class LSH512 : public LSH512_Base
+{
+public:
+	/// \brief Digest size, in bytes
+	/// \details LSH_512 uses LSH_GET_HASHBYTE(algType) for digest size, which is 64
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 64);
+	/// \brief Block size, in bytes
+	/// \details LSH_512 uses LSH512_MSG_BLK_BYTE_LEN for block size, which is 256
+	CRYPTOPP_CONSTANT(BLOCKSIZE = LSH512_Base::BLOCKSIZE);
+
+	/// \brief The algorithm's name
+	/// \return the standard algorithm name
+	/// \details The standard algorithm name can be a name like <tt>AES</tt> or <tt>AES/GCM</tt>.
+	///  Some algorithms do not have standard names yet. For example, there is no standard
+	///  algorithm name for Shoup's ECIES.
+	/// \note StaticAlgorithmName is not universally implemented yet.
+	static std::string StaticAlgorithmName() { return "LSH-512"; }
+
+	/// \brief Construct a LSH-512
+	/// \details LSH_TYPE_512 is the magic value 0x0010040 defined in lsh.cpp.
+	LSH512() : LSH512_Base(0x0010040, DIGESTSIZE) { Restart(); }
+
+	std::string AlgorithmName() const { return StaticAlgorithmName(); }
+};
+
+/// \brief LSH-512-256 hash function
+/// \sa <A HREF="https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do">LSH</A>
+///  on the Korea Internet & Security Agency (KISA) website.
+/// \since Crypto++ 8.6
+class LSH512_256 : public LSH512_Base
+{
+public:
+	/// \brief Digest size, in bytes
+	/// \details LSH_512 uses LSH_GET_HASHBYTE(algType) for digest size, which is 32
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 32);
+	/// \brief Block size, in bytes
+	/// \details LSH_512 uses LSH512_MSG_BLK_BYTE_LEN for block size, which is 256
+	CRYPTOPP_CONSTANT(BLOCKSIZE = LSH512_Base::BLOCKSIZE);
+
+	/// \brief The algorithm's name
+	/// \return the standard algorithm name
+	/// \details The standard algorithm name can be a name like <tt>AES</tt> or <tt>AES/GCM</tt>.
+	///  Some algorithms do not have standard names yet. For example, there is no standard
+	///  algorithm name for Shoup's ECIES.
+	/// \note StaticAlgorithmName is not universally implemented yet.
+	static std::string StaticAlgorithmName() { return "LSH-512-256"; }
+
+	/// \brief Construct a LSH-512-256
+	/// \details LSH_TYPE_512_256 is the magic value 0x0010020 defined in lsh.cpp.
+	LSH512_256() : LSH512_Base(0x0010020, DIGESTSIZE) { Restart(); }
+
+	std::string AlgorithmName() const { return StaticAlgorithmName(); }
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_LSH_H
diff --git a/runtime/third_party/cryptopp/lsh256.cpp b/runtime/third_party/cryptopp/lsh256.cpp
new file mode 100644
index 0000000..010755d
--- /dev/null
+++ b/runtime/third_party/cryptopp/lsh256.cpp
@@ -0,0 +1,817 @@
+// lsh.cpp - written and placed in the public domain by Jeffrey Walton
+//           Based on the specification and source code provided by
+//           Korea Internet & Security Agency (KISA) website. Also
+//           see https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do
+//           and https://seed.kisa.or.kr/kisa/Board/22/detailView.do.
+
+// We are hitting some sort of GCC bug in the LSH AVX2 code path.
+// Clang is OK on the AVX2 code path. We believe it is GCC Issue
+// 82735, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735. It
+// makes using zeroupper a little tricky.
+
+#include "pch.h"
+#include "config.h"
+
+#include "lsh.h"
+#include "cpu.h"
+#include "misc.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+/* LSH Constants */
+
+const unsigned int LSH256_MSG_BLK_BYTE_LEN = 128;
+// const unsigned int LSH256_MSG_BLK_BIT_LEN = 1024;
+// const unsigned int LSH256_CV_BYTE_LEN = 64;
+const unsigned int LSH256_HASH_VAL_MAX_BYTE_LEN = 32;
+
+// const unsigned int MSG_BLK_WORD_LEN = 32;
+const unsigned int CV_WORD_LEN = 16;
+const unsigned int CONST_WORD_LEN = 8;
+const unsigned int HASH_VAL_MAX_WORD_LEN = 8;
+// const unsigned int WORD_BIT_LEN = 32;
+const unsigned int NUM_STEPS = 26;
+
+const unsigned int ROT_EVEN_ALPHA = 29;
+const unsigned int ROT_EVEN_BETA = 1;
+const unsigned int ROT_ODD_ALPHA = 5;
+const unsigned int ROT_ODD_BETA = 17;
+
+const unsigned int LSH_TYPE_256_256 = 0x0000020;
+const unsigned int LSH_TYPE_256_224 = 0x000001C;
+
+// const unsigned int LSH_TYPE_224 = LSH_TYPE_256_224;
+// const unsigned int LSH_TYPE_256 = LSH_TYPE_256_256;
+
+/* Error Code */
+
+const unsigned int LSH_SUCCESS = 0x0;
+// const unsigned int LSH_ERR_NULL_PTR = 0x2401;
+// const unsigned int LSH_ERR_INVALID_ALGTYPE = 0x2402;
+const unsigned int LSH_ERR_INVALID_DATABITLEN = 0x2403;
+const unsigned int LSH_ERR_INVALID_STATE = 0x2404;
+
+/* Index into our state array */
+
+const unsigned int AlgorithmType = 80;
+const unsigned int RemainingBits = 81;
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(LSH)
+
+/* -------------------------------------------------------- *
+* LSH: iv
+* -------------------------------------------------------- */
+
+//extern const word32 LSH256_IV224[CV_WORD_LEN];
+//extern const word32 LSH256_IV256[CV_WORD_LEN];
+//extern const word32 LSH256_StepConstants[CONST_WORD_LEN * NUM_STEPS];
+
+CRYPTOPP_ALIGN_DATA(32)
+extern
+const word32 LSH256_IV224[CV_WORD_LEN] = {
+	0x068608D3, 0x62D8F7A7, 0xD76652AB, 0x4C600A43, 0xBDC40AA8, 0x1ECA0B68, 0xDA1A89BE, 0x3147D354,
+	0x707EB4F9, 0xF65B3862, 0x6B0B2ABE, 0x56B8EC0A, 0xCF237286, 0xEE0D1727, 0x33636595, 0x8BB8D05F
+};
+
+CRYPTOPP_ALIGN_DATA(32)
+extern
+const word32 LSH256_IV256[CV_WORD_LEN] = {
+	0x46a10f1f, 0xfddce486, 0xb41443a8, 0x198e6b9d, 0x3304388d, 0xb0f5a3c7, 0xb36061c4, 0x7adbd553,
+	0x105d5378, 0x2f74de54, 0x5c2f2d95, 0xf2553fbe, 0x8051357a, 0x138668c8, 0x47aa4484, 0xe01afb41
+};
+
+/* -------------------------------------------------------- *
+* LSH: step constants
+* -------------------------------------------------------- */
+
+extern
+const word32 LSH256_StepConstants[CONST_WORD_LEN * NUM_STEPS] = {
+	0x917caf90, 0x6c1b10a2, 0x6f352943, 0xcf778243, 0x2ceb7472, 0x29e96ff2, 0x8a9ba428, 0x2eeb2642,
+	0x0e2c4021, 0x872bb30e, 0xa45e6cb2, 0x46f9c612, 0x185fe69e, 0x1359621b, 0x263fccb2, 0x1a116870,
+	0x3a6c612f, 0xb2dec195, 0x02cb1f56, 0x40bfd858, 0x784684b6, 0x6cbb7d2e, 0x660c7ed8, 0x2b79d88a,
+	0xa6cd9069, 0x91a05747, 0xcdea7558, 0x00983098, 0xbecb3b2e, 0x2838ab9a, 0x728b573e, 0xa55262b5,
+	0x745dfa0f, 0x31f79ed8, 0xb85fce25, 0x98c8c898, 0x8a0669ec, 0x60e445c2, 0xfde295b0, 0xf7b5185a,
+	0xd2580983, 0x29967709, 0x182df3dd, 0x61916130, 0x90705676, 0x452a0822, 0xe07846ad, 0xaccd7351,
+	0x2a618d55, 0xc00d8032, 0x4621d0f5, 0xf2f29191, 0x00c6cd06, 0x6f322a67, 0x58bef48d, 0x7a40c4fd,
+	0x8beee27f, 0xcd8db2f2, 0x67f2c63b, 0xe5842383, 0xc793d306, 0xa15c91d6, 0x17b381e5, 0xbb05c277,
+	0x7ad1620a, 0x5b40a5bf, 0x5ab901a2, 0x69a7a768, 0x5b66d9cd, 0xfdee6877, 0xcb3566fc, 0xc0c83a32,
+	0x4c336c84, 0x9be6651a, 0x13baa3fc, 0x114f0fd1, 0xc240a728, 0xec56e074, 0x009c63c7, 0x89026cf2,
+	0x7f9ff0d0, 0x824b7fb5, 0xce5ea00f, 0x605ee0e2, 0x02e7cfea, 0x43375560, 0x9d002ac7, 0x8b6f5f7b,
+	0x1f90c14f, 0xcdcb3537, 0x2cfeafdd, 0xbf3fc342, 0xeab7b9ec, 0x7a8cb5a3, 0x9d2af264, 0xfacedb06,
+	0xb052106e, 0x99006d04, 0x2bae8d09, 0xff030601, 0xa271a6d6, 0x0742591d, 0xc81d5701, 0xc9a9e200,
+	0x02627f1e, 0x996d719d, 0xda3b9634, 0x02090800, 0x14187d78, 0x499b7624, 0xe57458c9, 0x738be2c9,
+	0x64e19d20, 0x06df0f36, 0x15d1cb0e, 0x0b110802, 0x2c95f58c, 0xe5119a6d, 0x59cd22ae, 0xff6eac3c,
+	0x467ebd84, 0xe5ee453c, 0xe79cd923, 0x1c190a0d, 0xc28b81b8, 0xf6ac0852, 0x26efd107, 0x6e1ae93b,
+	0xc53c41ca, 0xd4338221, 0x8475fd0a, 0x35231729, 0x4e0d3a7a, 0xa2b45b48, 0x16c0d82d, 0x890424a9,
+	0x017e0c8f, 0x07b5a3f5, 0xfa73078e, 0x583a405e, 0x5b47b4c8, 0x570fa3ea, 0xd7990543, 0x8d28ce32,
+	0x7f8a9b90, 0xbd5998fc, 0x6d7a9688, 0x927a9eb6, 0xa2fc7d23, 0x66b38e41, 0x709e491a, 0xb5f700bf,
+	0x0a262c0f, 0x16f295b9, 0xe8111ef5, 0x0d195548, 0x9f79a0c5, 0x1a41cfa7, 0x0ee7638a, 0xacf7c074,
+	0x30523b19, 0x09884ecf, 0xf93014dd, 0x266e9d55, 0x191a6664, 0x5c1176c1, 0xf64aed98, 0xa4b83520,
+	0x828d5449, 0x91d71dd8, 0x2944f2d6, 0x950bf27b, 0x3380ca7d, 0x6d88381d, 0x4138868e, 0x5ced55c4,
+	0x0fe19dcb, 0x68f4f669, 0x6e37c8ff, 0xa0fe6e10, 0xb44b47b0, 0xf5c0558a, 0x79bf14cf, 0x4a431a20,
+	0xf17f68da, 0x5deb5fd1, 0xa600c86d, 0x9f6c7eb0, 0xff92f864, 0xb615e07f, 0x38d3e448, 0x8d5d3a6a,
+	0x70e843cb, 0x494b312e, 0xa6c93613, 0x0beb2f4f, 0x928b5d63, 0xcbf66035, 0x0cb82c80, 0xea97a4f7,
+	0x592c0f3b, 0x947c5f77, 0x6fff49b9, 0xf71a7e5a, 0x1de8c0f5, 0xc2569600, 0xc4e4ac8c, 0x823c9ce1
+};
+
+NAMESPACE_END  // LSH
+NAMESPACE_END  // Crypto++
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::rotlFixed;
+using CryptoPP::rotlConstant;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+using CryptoPP::ConditionalByteReverse;
+using CryptoPP::LITTLE_ENDIAN_ORDER;
+
+using CryptoPP::LSH::LSH256_IV224;
+using CryptoPP::LSH::LSH256_IV256;
+using CryptoPP::LSH::LSH256_StepConstants;
+
+typedef byte lsh_u8;
+typedef word32 lsh_u32;
+typedef word32 lsh_uint;
+typedef word32 lsh_err;
+typedef word32 lsh_type;
+
+struct LSH256_Context
+{
+	LSH256_Context(word32* state, word32 algType, word32& remainingBitLength) :
+		cv_l(state+0), cv_r(state+8), sub_msgs(state+16),
+		last_block(reinterpret_cast<byte*>(state+48)),
+		remain_databitlen(remainingBitLength),
+		alg_type(static_cast<lsh_type>(algType)) {}
+
+	lsh_u32* cv_l;  // start of our state block
+	lsh_u32* cv_r;
+	lsh_u32* sub_msgs;
+	lsh_u8*  last_block;
+	lsh_u32& remain_databitlen;
+	lsh_type alg_type;
+};
+
+struct LSH256_Internal
+{
+	LSH256_Internal(word32* state) :
+		submsg_e_l(state+16), submsg_e_r(state+24),
+		submsg_o_l(state+32), submsg_o_r(state+40) { }
+
+	lsh_u32* submsg_e_l; /* even left sub-message  */
+	lsh_u32* submsg_e_r; /* even right sub-message */
+	lsh_u32* submsg_o_l; /* odd left sub-message   */
+	lsh_u32* submsg_o_r; /* odd right sub-message  */
+};
+
+const word32 g_gamma256[8] = { 0, 8, 16, 24, 24, 16, 8, 0 };
+
+/* LSH AlgType Macro */
+
+inline bool LSH_IS_LSH512(lsh_uint val) {
+	return (val & 0xf0000) == 0;
+}
+
+inline lsh_uint LSH_GET_SMALL_HASHBIT(lsh_uint val) {
+	return val >> 24;
+}
+
+inline lsh_uint LSH_GET_HASHBYTE(lsh_uint val) {
+	return val & 0xffff;
+}
+
+inline lsh_uint LSH_GET_HASHBIT(lsh_uint val) {
+	return (LSH_GET_HASHBYTE(val) << 3) - LSH_GET_SMALL_HASHBIT(val);
+}
+
+inline lsh_u32 loadLE32(lsh_u32 v) {
+	return ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v);
+}
+
+lsh_u32 ROTL(lsh_u32 x, lsh_u32 r) {
+	return rotlFixed(x, r);
+}
+
+// Original code relied upon unaligned lsh_u32 buffer
+inline void load_msg_blk(LSH256_Internal* i_state, const lsh_u8 msgblk[LSH256_MSG_BLK_BYTE_LEN])
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	typedef GetBlock<word32, LittleEndian, false> InBlock;
+
+	InBlock input(msgblk);
+	input(submsg_e_l[0])(submsg_e_l[1])(submsg_e_l[2])(submsg_e_l[3])
+		(submsg_e_l[4])(submsg_e_l[5])(submsg_e_l[6])(submsg_e_l[7])
+		(submsg_e_r[0])(submsg_e_r[1])(submsg_e_r[2])(submsg_e_r[3])
+		(submsg_e_r[4])(submsg_e_r[5])(submsg_e_r[6])(submsg_e_r[7])
+		(submsg_o_l[0])(submsg_o_l[1])(submsg_o_l[2])(submsg_o_l[3])
+		(submsg_o_l[4])(submsg_o_l[5])(submsg_o_l[6])(submsg_o_l[7])
+		(submsg_o_r[0])(submsg_o_r[1])(submsg_o_r[2])(submsg_o_r[3])
+		(submsg_o_r[4])(submsg_o_r[5])(submsg_o_r[6])(submsg_o_r[7]);
+}
+
+inline void msg_exp_even(LSH256_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	lsh_u32 temp;
+	temp = submsg_e_l[0];
+	submsg_e_l[0] = submsg_o_l[0] + submsg_e_l[3];
+	submsg_e_l[3] = submsg_o_l[3] + submsg_e_l[1];
+	submsg_e_l[1] = submsg_o_l[1] + submsg_e_l[2];
+	submsg_e_l[2] = submsg_o_l[2] + temp;
+	temp = submsg_e_l[4];
+	submsg_e_l[4] = submsg_o_l[4] + submsg_e_l[7];
+	submsg_e_l[7] = submsg_o_l[7] + submsg_e_l[6];
+	submsg_e_l[6] = submsg_o_l[6] + submsg_e_l[5];
+	submsg_e_l[5] = submsg_o_l[5] + temp;
+	temp = submsg_e_r[0];
+	submsg_e_r[0] = submsg_o_r[0] + submsg_e_r[3];
+	submsg_e_r[3] = submsg_o_r[3] + submsg_e_r[1];
+	submsg_e_r[1] = submsg_o_r[1] + submsg_e_r[2];
+	submsg_e_r[2] = submsg_o_r[2] + temp;
+	temp = submsg_e_r[4];
+	submsg_e_r[4] = submsg_o_r[4] + submsg_e_r[7];
+	submsg_e_r[7] = submsg_o_r[7] + submsg_e_r[6];
+	submsg_e_r[6] = submsg_o_r[6] + submsg_e_r[5];
+	submsg_e_r[5] = submsg_o_r[5] + temp;
+}
+
+inline void msg_exp_odd(LSH256_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	lsh_u32 temp;
+	temp = submsg_o_l[0];
+	submsg_o_l[0] = submsg_e_l[0] + submsg_o_l[3];
+	submsg_o_l[3] = submsg_e_l[3] + submsg_o_l[1];
+	submsg_o_l[1] = submsg_e_l[1] + submsg_o_l[2];
+	submsg_o_l[2] = submsg_e_l[2] + temp;
+	temp = submsg_o_l[4];
+	submsg_o_l[4] = submsg_e_l[4] + submsg_o_l[7];
+	submsg_o_l[7] = submsg_e_l[7] + submsg_o_l[6];
+	submsg_o_l[6] = submsg_e_l[6] + submsg_o_l[5];
+	submsg_o_l[5] = submsg_e_l[5] + temp;
+	temp = submsg_o_r[0];
+	submsg_o_r[0] = submsg_e_r[0] + submsg_o_r[3];
+	submsg_o_r[3] = submsg_e_r[3] + submsg_o_r[1];
+	submsg_o_r[1] = submsg_e_r[1] + submsg_o_r[2];
+	submsg_o_r[2] = submsg_e_r[2] + temp;
+	temp = submsg_o_r[4];
+	submsg_o_r[4] = submsg_e_r[4] + submsg_o_r[7];
+	submsg_o_r[7] = submsg_e_r[7] + submsg_o_r[6];
+	submsg_o_r[6] = submsg_e_r[6] + submsg_o_r[5];
+	submsg_o_r[5] = submsg_e_r[5] + temp;
+}
+
+inline void load_sc(const lsh_u32** p_const_v, size_t i)
+{
+	CRYPTOPP_ASSERT(p_const_v != NULLPTR);
+
+	*p_const_v = &LSH256_StepConstants[i];
+}
+
+inline void msg_add_even(lsh_u32 cv_l[8], lsh_u32 cv_r[8], LSH256_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+
+	cv_l[0] ^= submsg_e_l[0];  cv_l[1] ^= submsg_e_l[1];
+	cv_l[2] ^= submsg_e_l[2];  cv_l[3] ^= submsg_e_l[3];
+	cv_l[4] ^= submsg_e_l[4];  cv_l[5] ^= submsg_e_l[5];
+	cv_l[6] ^= submsg_e_l[6];  cv_l[7] ^= submsg_e_l[7];
+	cv_r[0] ^= submsg_e_r[0];  cv_r[1] ^= submsg_e_r[1];
+	cv_r[2] ^= submsg_e_r[2];  cv_r[3] ^= submsg_e_r[3];
+	cv_r[4] ^= submsg_e_r[4];  cv_r[5] ^= submsg_e_r[5];
+	cv_r[6] ^= submsg_e_r[6];  cv_r[7] ^= submsg_e_r[7];
+}
+
+inline void msg_add_odd(lsh_u32 cv_l[8], lsh_u32 cv_r[8], LSH256_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	cv_l[0] ^= submsg_o_l[0];  cv_l[1] ^= submsg_o_l[1];
+	cv_l[2] ^= submsg_o_l[2];  cv_l[3] ^= submsg_o_l[3];
+	cv_l[4] ^= submsg_o_l[4];  cv_l[5] ^= submsg_o_l[5];
+	cv_l[6] ^= submsg_o_l[6];  cv_l[7] ^= submsg_o_l[7];
+	cv_r[0] ^= submsg_o_r[0];  cv_r[1] ^= submsg_o_r[1];
+	cv_r[2] ^= submsg_o_r[2];  cv_r[3] ^= submsg_o_r[3];
+	cv_r[4] ^= submsg_o_r[4];  cv_r[5] ^= submsg_o_r[5];
+	cv_r[6] ^= submsg_o_r[6];  cv_r[7] ^= submsg_o_r[7];
+}
+
+inline void add_blk(lsh_u32 cv_l[8], lsh_u32 cv_r[8])
+{
+	cv_l[0] += cv_r[0];
+	cv_l[1] += cv_r[1];
+	cv_l[2] += cv_r[2];
+	cv_l[3] += cv_r[3];
+	cv_l[4] += cv_r[4];
+	cv_l[5] += cv_r[5];
+	cv_l[6] += cv_r[6];
+	cv_l[7] += cv_r[7];
+}
+
+template <unsigned int R>
+inline void rotate_blk(lsh_u32 cv[8])
+{
+	cv[0] = rotlConstant<R>(cv[0]);
+	cv[1] = rotlConstant<R>(cv[1]);
+	cv[2] = rotlConstant<R>(cv[2]);
+	cv[3] = rotlConstant<R>(cv[3]);
+	cv[4] = rotlConstant<R>(cv[4]);
+	cv[5] = rotlConstant<R>(cv[5]);
+	cv[6] = rotlConstant<R>(cv[6]);
+	cv[7] = rotlConstant<R>(cv[7]);
+}
+
+inline void xor_with_const(lsh_u32 cv_l[8], const lsh_u32 const_v[8])
+{
+	cv_l[0] ^= const_v[0];
+	cv_l[1] ^= const_v[1];
+	cv_l[2] ^= const_v[2];
+	cv_l[3] ^= const_v[3];
+	cv_l[4] ^= const_v[4];
+	cv_l[5] ^= const_v[5];
+	cv_l[6] ^= const_v[6];
+	cv_l[7] ^= const_v[7];
+}
+
+inline void rotate_msg_gamma(lsh_u32 cv_r[8])
+{
+	cv_r[1] = rotlFixed(cv_r[1], g_gamma256[1]);
+	cv_r[2] = rotlFixed(cv_r[2], g_gamma256[2]);
+	cv_r[3] = rotlFixed(cv_r[3], g_gamma256[3]);
+	cv_r[4] = rotlFixed(cv_r[4], g_gamma256[4]);
+	cv_r[5] = rotlFixed(cv_r[5], g_gamma256[5]);
+	cv_r[6] = rotlFixed(cv_r[6], g_gamma256[6]);
+}
+
+inline void word_perm(lsh_u32 cv_l[8], lsh_u32 cv_r[8])
+{
+	lsh_u32 temp;
+	temp = cv_l[0];
+	cv_l[0] = cv_l[6];
+	cv_l[6] = cv_r[6];
+	cv_r[6] = cv_r[2];
+	cv_r[2] = cv_l[1];
+	cv_l[1] = cv_l[4];
+	cv_l[4] = cv_r[4];
+	cv_r[4] = cv_r[0];
+	cv_r[0] = cv_l[2];
+	cv_l[2] = cv_l[5];
+	cv_l[5] = cv_r[7];
+	cv_r[7] = cv_r[1];
+	cv_r[1] = temp;
+	temp = cv_l[3];
+	cv_l[3] = cv_l[7];
+	cv_l[7] = cv_r[5];
+	cv_r[5] = cv_r[3];
+	cv_r[3] = temp;
+}
+
+/* -------------------------------------------------------- *
+* step function
+* -------------------------------------------------------- */
+
+template <unsigned int Alpha, unsigned int Beta>
+inline void mix(lsh_u32 cv_l[8], lsh_u32 cv_r[8], const lsh_u32 const_v[8])
+{
+	add_blk(cv_l, cv_r);
+	rotate_blk<Alpha>(cv_l);
+	xor_with_const(cv_l, const_v);
+	add_blk(cv_r, cv_l);
+	rotate_blk<Beta>(cv_r);
+	add_blk(cv_l, cv_r);
+	rotate_msg_gamma(cv_r);
+}
+
+/* -------------------------------------------------------- *
+* compression function
+* -------------------------------------------------------- */
+
+inline void compress(LSH256_Context* ctx, const lsh_u8 pdMsgBlk[LSH256_MSG_BLK_BYTE_LEN])
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	LSH256_Internal  s_state(ctx->cv_l);
+	LSH256_Internal* i_state = &s_state;
+
+	const lsh_u32* const_v = NULL;
+	lsh_u32* cv_l = ctx->cv_l;
+	lsh_u32* cv_r = ctx->cv_r;
+
+	load_msg_blk(i_state, pdMsgBlk);
+
+	msg_add_even(cv_l, cv_r, i_state);
+	load_sc(&const_v, 0);
+	mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	msg_add_odd(cv_l, cv_r, i_state);
+	load_sc(&const_v, 8);
+	mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	for (size_t i = 1; i < NUM_STEPS / 2; i++)
+	{
+		msg_exp_even(i_state);
+		msg_add_even(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		msg_exp_odd(i_state);
+		msg_add_odd(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	msg_exp_even(i_state);
+	msg_add_even(cv_l, cv_r, i_state);
+}
+
+/* -------------------------------------------------------- */
+
+inline void load_iv(lsh_u32 cv_l[8], lsh_u32 cv_r[8], const lsh_u32 iv[16])
+{
+	cv_l[0] = iv[0];
+	cv_l[1] = iv[1];
+	cv_l[2] = iv[2];
+	cv_l[3] = iv[3];
+	cv_l[4] = iv[4];
+	cv_l[5] = iv[5];
+	cv_l[6] = iv[6];
+	cv_l[7] = iv[7];
+	cv_r[0] = iv[8];
+	cv_r[1] = iv[9];
+	cv_r[2] = iv[10];
+	cv_r[3] = iv[11];
+	cv_r[4] = iv[12];
+	cv_r[5] = iv[13];
+	cv_r[6] = iv[14];
+	cv_r[7] = iv[15];
+}
+
+inline void zero_iv(lsh_u32 cv_l[8], lsh_u32 cv_r[8])
+{
+	std::memset(cv_l, 0x00, 8*sizeof(lsh_u32));
+	std::memset(cv_r, 0x00, 8*sizeof(lsh_u32));
+}
+
+inline void zero_submsgs(LSH256_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	lsh_u32* sub_msgs = ctx->sub_msgs;
+	std::memset(sub_msgs, 0x00, 32*sizeof(lsh_u32));
+}
+
+inline void init224(LSH256_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH256_IV224);
+}
+
+inline void init256(LSH256_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH256_IV256);
+}
+
+/* -------------------------------------------------------- */
+
+inline void fin(LSH256_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	for (size_t i = 0; i < HASH_VAL_MAX_WORD_LEN; i++){
+		ctx->cv_l[i] = loadLE32(ctx->cv_l[i] ^ ctx->cv_r[i]);
+	}
+}
+
+/* -------------------------------------------------------- */
+
+inline void get_hash(LSH256_Context* ctx, lsh_u8* pbHashVal)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+	CRYPTOPP_ASSERT(pbHashVal != NULLPTR);
+
+	lsh_uint alg_type = ctx->alg_type;
+	lsh_uint hash_val_byte_len = LSH_GET_HASHBYTE(alg_type);
+	lsh_uint hash_val_bit_len = LSH_GET_SMALL_HASHBIT(alg_type);
+
+	// Multiplying by looks odd...
+	std::memcpy(pbHashVal, ctx->cv_l, hash_val_byte_len);
+	if (hash_val_bit_len){
+		pbHashVal[hash_val_byte_len-1] &= (((lsh_u8)0xff) << hash_val_bit_len);
+	}
+}
+
+/* -------------------------------------------------------- */
+
+lsh_err lsh256_init(LSH256_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	lsh_u32 alg_type = ctx->alg_type;
+	const lsh_u32* const_v = NULL;
+	ctx->remain_databitlen = 0;
+
+	switch (alg_type)
+	{
+	case LSH_TYPE_256_256:
+		init256(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_256_224:
+		init224(ctx);
+		return LSH_SUCCESS;
+	default:
+		break;
+	}
+
+	lsh_u32* cv_l = ctx->cv_l;
+	lsh_u32* cv_r = ctx->cv_r;
+
+	zero_iv(cv_l, cv_r);
+	cv_l[0] = LSH256_HASH_VAL_MAX_BYTE_LEN;
+	cv_l[1] = LSH_GET_HASHBIT(alg_type);
+
+	for (size_t i = 0; i < NUM_STEPS / 2; i++)
+	{
+		//Mix
+		load_sc(&const_v, i * 16);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		load_sc(&const_v, i * 16 + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh256_update(LSH256_Context* ctx, const lsh_u8* data, size_t databitlen)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(data != NULLPTR);
+	CRYPTOPP_ASSERT(databitlen % 8 == 0);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	if (databitlen == 0){
+		return LSH_SUCCESS;
+	}
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t databytelen = databitlen >> 3;
+	// lsh_uint pos2 = databitlen & 0x7;
+	const size_t pos2 = 0;
+
+	size_t remain_msg_byte = ctx->remain_databitlen >> 3;
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH256_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+	if (remain_msg_bit > 0){
+		return LSH_ERR_INVALID_DATABITLEN;
+	}
+
+	if (databytelen + remain_msg_byte < LSH256_MSG_BLK_BYTE_LEN)
+	{
+		std::memcpy(ctx->last_block + remain_msg_byte, data, databytelen);
+		ctx->remain_databitlen += (lsh_uint)databitlen;
+		remain_msg_byte += (lsh_uint)databytelen;
+		if (pos2){
+			ctx->last_block[remain_msg_byte] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		}
+		return LSH_SUCCESS;
+	}
+
+	if (remain_msg_byte > 0){
+		size_t more_byte = LSH256_MSG_BLK_BYTE_LEN - remain_msg_byte;
+		std::memcpy(ctx->last_block + remain_msg_byte, data, more_byte);
+		compress(ctx, ctx->last_block);
+		data += more_byte;
+		databytelen -= more_byte;
+		remain_msg_byte = 0;
+		ctx->remain_databitlen = 0;
+	}
+
+	while (databytelen >= LSH256_MSG_BLK_BYTE_LEN)
+	{
+		// This call to compress caused some trouble.
+		// The data pointer can become unaligned in the
+		// previous block.
+		compress(ctx, data);
+		data += LSH256_MSG_BLK_BYTE_LEN;
+		databytelen -= LSH256_MSG_BLK_BYTE_LEN;
+	}
+
+	if (databytelen > 0){
+		std::memcpy(ctx->last_block, data, databytelen);
+		ctx->remain_databitlen = (lsh_uint)(databytelen << 3);
+	}
+
+	if (pos2){
+		ctx->last_block[databytelen] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		ctx->remain_databitlen += pos2;
+	}
+
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh256_final(LSH256_Context* ctx, lsh_u8* hashval)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(hashval != NULLPTR);
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t remain_msg_byte = ctx->remain_databitlen >> 3;
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH256_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+
+	if (remain_msg_bit){
+		ctx->last_block[remain_msg_byte] |= (0x1 << (7 - remain_msg_bit));
+	}
+	else{
+		ctx->last_block[remain_msg_byte] = 0x80;
+	}
+	std::memset(ctx->last_block + remain_msg_byte + 1, 0, LSH256_MSG_BLK_BYTE_LEN - remain_msg_byte - 1);
+
+	compress(ctx, ctx->last_block);
+
+	fin(ctx);
+	get_hash(ctx, hashval);
+
+	return LSH_SUCCESS;
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_ENABLE_64BIT_SSE)
+# if defined(CRYPTOPP_AVX2_AVAILABLE)
+	extern void LSH256_Base_Restart_AVX2(word32* state);
+	extern void LSH256_Base_Update_AVX2(word32* state, const byte *input, size_t size);
+	extern void LSH256_Base_TruncatedFinal_AVX2(word32* state, byte *hash, size_t size);
+# endif
+# if defined(CRYPTOPP_SSSE3_AVAILABLE)
+	extern void LSH256_Base_Restart_SSSE3(word32* state);
+	extern void LSH256_Base_Update_SSSE3(word32* state, const byte *input, size_t size);
+	extern void LSH256_Base_TruncatedFinal_SSSE3(word32* state, byte *hash, size_t size);
+# endif
+#endif
+
+void LSH256_Base_Restart_CXX(word32* state)
+{
+	state[RemainingBits] = 0;
+	LSH256_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh256_init(&ctx);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH256_Base: lsh256_init failed");
+}
+
+void LSH256_Base_Update_CXX(word32* state, const byte *input, size_t size)
+{
+	LSH256_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh256_update(&ctx, input, 8*size);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH256_Base: lsh256_update failed");
+}
+
+void LSH256_Base_TruncatedFinal_CXX(word32* state, byte *hash, size_t)
+{
+	LSH256_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh256_final(&ctx, hash);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH256_Base: lsh256_final failed");
+}
+
+std::string LSH256_Base::AlgorithmProvider() const
+{
+#if defined(CRYPTOPP_ENABLE_64BIT_SSE)
+#if defined(CRYPTOPP_AVX2_AVAILABLE)
+	if (HasAVX2())
+		return "AVX2";
+	else
+#endif
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+	if (HasSSSE3())
+		return "SSSE3";
+	else
+#endif
+#endif  // CRYPTOPP_ENABLE_64BIT_SSE
+
+	return "C++";
+}
+
+void LSH256_Base::Restart()
+{
+#if defined(CRYPTOPP_AVX2_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasAVX2())
+		LSH256_Base_Restart_AVX2(m_state);
+	else
+#endif
+#if defined(CRYPTOPP_SSSE3_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasSSSE3())
+		LSH256_Base_Restart_SSSE3(m_state);
+	else
+#endif
+
+	LSH256_Base_Restart_CXX(m_state);
+}
+
+void LSH256_Base::Update(const byte *input, size_t size)
+{
+	CRYPTOPP_ASSERT(input != NULLPTR);
+	CRYPTOPP_ASSERT(size);
+
+#if defined(CRYPTOPP_AVX2_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasAVX2())
+		LSH256_Base_Update_AVX2(m_state, input, size);
+	else
+#endif
+#if defined(CRYPTOPP_SSSE3_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasSSSE3())
+		LSH256_Base_Update_SSSE3(m_state, input, size);
+	else
+#endif
+
+	LSH256_Base_Update_CXX(m_state, input, size);
+}
+
+void LSH256_Base::TruncatedFinal(byte *hash, size_t size)
+{
+	CRYPTOPP_ASSERT(hash != NULLPTR);
+	ThrowIfInvalidTruncatedSize(size);
+
+	// TODO: determine if LSH256 supports truncated hashes. See the code
+	// in get_hash(), where a bit-length is added to the last output
+	// byte of the hash function.
+	byte fullHash[LSH256_HASH_VAL_MAX_BYTE_LEN];
+	bool copyOut = (size < DigestSize());
+
+#if defined(CRYPTOPP_AVX2_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasAVX2())
+		LSH256_Base_TruncatedFinal_AVX2(m_state, copyOut ? fullHash : hash, size);
+	else
+#endif
+#if defined(CRYPTOPP_SSSE3_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasSSSE3())
+		LSH256_Base_TruncatedFinal_SSSE3(m_state, copyOut ? fullHash : hash, size);
+	else
+#endif
+
+	LSH256_Base_TruncatedFinal_CXX(m_state, copyOut ? fullHash : hash, size);
+
+	if (copyOut)
+		std::memcpy(hash, fullHash, size);
+
+    Restart();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/lsh256_avx.cpp b/runtime/third_party/cryptopp/lsh256_avx.cpp
new file mode 100644
index 0000000..b25fc9b
--- /dev/null
+++ b/runtime/third_party/cryptopp/lsh256_avx.cpp
@@ -0,0 +1,650 @@
+// lsh.cpp - written and placed in the public domain by Jeffrey Walton
+//           Based on the specification and source code provided by
+//           Korea Internet & Security Agency (KISA) website. Also
+//           see https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do
+//           and https://seed.kisa.or.kr/kisa/Board/22/detailView.do.
+
+// We are hitting some sort of GCC bug in the LSH AVX2 code path.
+// Clang is OK on the AVX2 code path. We believe it is GCC Issue
+// 82735, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735. It
+// makes using zeroupper a little tricky.
+
+#include "pch.h"
+#include "config.h"
+
+#include "lsh.h"
+#include "misc.h"
+
+// Squash MS LNK4221 and libtool warnings
+extern const char LSH256_AVX_FNAME[] = __FILE__;
+
+#if defined(CRYPTOPP_AVX2_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+
+#if defined(CRYPTOPP_AVX2_AVAILABLE)
+# include <emmintrin.h>
+# include <immintrin.h>
+#endif
+
+#if defined(CRYPTOPP_GCC_COMPATIBLE)
+# include <x86intrin.h>
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+/* LSH Constants */
+
+const unsigned int LSH256_MSG_BLK_BYTE_LEN = 128;
+// const unsigned int LSH256_MSG_BLK_BIT_LEN = 1024;
+// const unsigned int LSH256_CV_BYTE_LEN = 64;
+const unsigned int LSH256_HASH_VAL_MAX_BYTE_LEN = 32;
+
+// const unsigned int MSG_BLK_WORD_LEN = 32;
+const unsigned int CV_WORD_LEN = 16;
+const unsigned int CONST_WORD_LEN = 8;
+// const unsigned int HASH_VAL_MAX_WORD_LEN = 8;
+// const unsigned int WORD_BIT_LEN = 32;
+const unsigned int NUM_STEPS = 26;
+
+const unsigned int ROT_EVEN_ALPHA = 29;
+const unsigned int ROT_EVEN_BETA = 1;
+const unsigned int ROT_ODD_ALPHA = 5;
+const unsigned int ROT_ODD_BETA = 17;
+
+const unsigned int LSH_TYPE_256_256 = 0x0000020;
+const unsigned int LSH_TYPE_256_224 = 0x000001C;
+
+// const unsigned int LSH_TYPE_224 = LSH_TYPE_256_224;
+// const unsigned int LSH_TYPE_256 = LSH_TYPE_256_256;
+
+/* Error Code */
+
+const unsigned int LSH_SUCCESS = 0x0;
+// const unsigned int LSH_ERR_NULL_PTR = 0x2401;
+// const unsigned int LSH_ERR_INVALID_ALGTYPE = 0x2402;
+const unsigned int LSH_ERR_INVALID_DATABITLEN = 0x2403;
+const unsigned int LSH_ERR_INVALID_STATE = 0x2404;
+
+/* Index into our state array */
+
+const unsigned int AlgorithmType = 80;
+const unsigned int RemainingBits = 81;
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(LSH)
+
+// lsh256.cpp
+extern const word32 LSH256_IV224[CV_WORD_LEN];
+extern const word32 LSH256_IV256[CV_WORD_LEN];
+extern const word32 LSH256_StepConstants[CONST_WORD_LEN * NUM_STEPS];
+
+NAMESPACE_END  // LSH
+NAMESPACE_END  // Crypto++
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::rotlFixed;
+using CryptoPP::rotlConstant;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+using CryptoPP::ConditionalByteReverse;
+using CryptoPP::LITTLE_ENDIAN_ORDER;
+
+typedef byte lsh_u8;
+typedef word32 lsh_u32;
+typedef word32 lsh_uint;
+typedef word32 lsh_err;
+typedef word32 lsh_type;
+
+using CryptoPP::LSH::LSH256_IV224;
+using CryptoPP::LSH::LSH256_IV256;
+using CryptoPP::LSH::LSH256_StepConstants;
+
+struct LSH256_AVX2_Context
+{
+	LSH256_AVX2_Context(word32* state, word32 algType, word32& remainingBitLength) :
+		cv_l(state+0), cv_r(state+8), sub_msgs(state+16),
+		last_block(reinterpret_cast<byte*>(state+48)),
+		remain_databitlen(remainingBitLength),
+		alg_type(static_cast<lsh_type>(algType)) {}
+
+	lsh_u32* cv_l;  // start of our state block
+	lsh_u32* cv_r;
+	lsh_u32* sub_msgs;
+	lsh_u8*  last_block;
+	lsh_u32& remain_databitlen;
+	lsh_type alg_type;
+};
+
+struct LSH256_AVX2_Internal
+{
+	LSH256_AVX2_Internal(word32* state) :
+		submsg_e_l(state+16), submsg_e_r(state+24),
+		submsg_o_l(state+32), submsg_o_r(state+40) { }
+
+	lsh_u32* submsg_e_l; /* even left sub-message  */
+	lsh_u32* submsg_e_r; /* even right sub-message */
+	lsh_u32* submsg_o_l; /* odd left sub-message   */
+	lsh_u32* submsg_o_r; /* odd right sub-message  */
+};
+
+// Zero the upper 128 bits of all YMM registers on exit.
+// It avoids AVX state transition penalties when saving state.
+// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735
+// makes using zeroupper a little tricky.
+
+struct AVX_Cleanup
+{
+	~AVX_Cleanup() {
+		_mm256_zeroupper();
+	}
+};
+
+// const word32 g_gamma256[8] = { 0, 8, 16, 24, 24, 16, 8, 0 };
+
+/* LSH AlgType Macro */
+
+inline bool LSH_IS_LSH512(lsh_uint val) {
+	return (val & 0xf0000) == 0;
+}
+
+inline lsh_uint LSH_GET_SMALL_HASHBIT(lsh_uint val) {
+	return val >> 24;
+}
+
+inline lsh_uint LSH_GET_HASHBYTE(lsh_uint val) {
+	return val & 0xffff;
+}
+
+inline lsh_uint LSH_GET_HASHBIT(lsh_uint val) {
+	return (LSH_GET_HASHBYTE(val) << 3) - LSH_GET_SMALL_HASHBIT(val);
+}
+
+inline lsh_u32 loadLE32(lsh_u32 v) {
+	return ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v);
+}
+
+lsh_u32 ROTL(lsh_u32 x, lsh_u32 r) {
+	return rotlFixed(x, r);
+}
+
+// Original code relied upon unaligned lsh_u32 buffer
+inline void load_msg_blk(LSH256_AVX2_Internal* i_state, const lsh_u8 msgblk[LSH256_MSG_BLK_BYTE_LEN])
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	_mm256_storeu_si256(M256_CAST(submsg_e_l+0),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+0)));
+	_mm256_storeu_si256(M256_CAST(submsg_e_r+0),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+32)));
+	_mm256_storeu_si256(M256_CAST(submsg_o_l+0),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+64)));
+	_mm256_storeu_si256(M256_CAST(submsg_o_r+0),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+96)));
+}
+
+inline void msg_exp_even(LSH256_AVX2_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	const __m256i mask = _mm256_set_epi32(0x1b1a1918, 0x17161514,
+		0x13121110, 0x1f1e1d1c, 0x07060504, 0x03020100, 0x0b0a0908, 0x0f0e0d0c);
+
+	_mm256_storeu_si256(M256_CAST(submsg_e_l+0), _mm256_add_epi32(
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_l+0)),
+		_mm256_shuffle_epi8(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_l+0)), mask)));
+	_mm256_storeu_si256(M256_CAST(submsg_e_r+0), _mm256_add_epi32(
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_r+0)),
+		_mm256_shuffle_epi8(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_r+0)), mask)));
+}
+
+inline void msg_exp_odd(LSH256_AVX2_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	const __m256i mask = _mm256_set_epi32(0x1b1a1918, 0x17161514,
+		0x13121110, 0x1f1e1d1c, 0x07060504, 0x03020100, 0x0b0a0908, 0x0f0e0d0c);
+
+	_mm256_storeu_si256(M256_CAST(submsg_o_l+0), _mm256_add_epi32(
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_e_l+0)),
+		_mm256_shuffle_epi8(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_o_l+0)), mask)));
+	_mm256_storeu_si256(M256_CAST(submsg_o_r+0), _mm256_add_epi32(
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_e_r+0)),
+		_mm256_shuffle_epi8(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_o_r+0)), mask)));
+}
+
+inline void load_sc(const lsh_u32** p_const_v, size_t i)
+{
+	CRYPTOPP_ASSERT(p_const_v != NULLPTR);
+
+	*p_const_v = &LSH256_StepConstants[i];
+}
+
+inline void msg_add_even(lsh_u32 cv_l[8], lsh_u32 cv_r[8], LSH256_AVX2_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+
+	_mm256_storeu_si256(M256_CAST(cv_l+0), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l+0)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_e_l+0))));
+	_mm256_storeu_si256(M256_CAST(cv_r+0), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r+0)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_e_r+0))));
+}
+
+inline void msg_add_odd(lsh_u32 cv_l[8], lsh_u32 cv_r[8], LSH256_AVX2_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	_mm256_storeu_si256(M256_CAST(cv_l), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_l))));
+	_mm256_storeu_si256(M256_CAST(cv_r), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_r))));
+}
+
+inline void add_blk(lsh_u32 cv_l[8], lsh_u32 cv_r[8])
+{
+	_mm256_storeu_si256(M256_CAST(cv_l), _mm256_add_epi32(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l)),
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r))));
+}
+
+template <unsigned int R>
+inline void rotate_blk(lsh_u32 cv[8])
+{
+	_mm256_storeu_si256(M256_CAST(cv), _mm256_or_si256(
+		_mm256_slli_epi32(_mm256_loadu_si256(CONST_M256_CAST(cv)), R),
+		_mm256_srli_epi32(_mm256_loadu_si256(CONST_M256_CAST(cv)), 32-R)));
+}
+
+inline void xor_with_const(lsh_u32 cv_l[8], const lsh_u32 const_v[8])
+{
+	_mm256_storeu_si256(M256_CAST(cv_l), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l)),
+		_mm256_loadu_si256(CONST_M256_CAST(const_v))));
+}
+
+inline void rotate_msg_gamma(lsh_u32 cv_r[8])
+{
+	// g_gamma256[8] = { 0, 8, 16, 24, 24, 16, 8, 0 };
+	_mm256_storeu_si256(M256_CAST(cv_r+0),
+		_mm256_shuffle_epi8(_mm256_loadu_si256(CONST_M256_CAST(cv_r+0)),
+			_mm256_set_epi8(
+				/* hi lane */ 15,14,13,12, 10,9,8,11, 5,4,7,6, 0,3,2,1,
+				/* lo lane */ 12,15,14,13, 9,8,11,10, 6,5,4,7, 3,2,1,0)));
+}
+
+inline void word_perm(lsh_u32 cv_l[8], lsh_u32 cv_r[8])
+{
+	__m256i temp = _mm256_shuffle_epi32(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l)), _MM_SHUFFLE(3,1,0,2));
+	_mm256_storeu_si256(M256_CAST(cv_r),
+		_mm256_shuffle_epi32(
+			_mm256_loadu_si256(CONST_M256_CAST(cv_r)), _MM_SHUFFLE(1,2,3,0)));
+	_mm256_storeu_si256(M256_CAST(cv_l),
+		_mm256_permute2x128_si256(temp,
+			_mm256_loadu_si256(CONST_M256_CAST(cv_r)), _MM_SHUFFLE(0,3,0,1)));
+	_mm256_storeu_si256(M256_CAST(cv_r),
+		_mm256_permute2x128_si256(temp,
+			_mm256_loadu_si256(CONST_M256_CAST(cv_r)), _MM_SHUFFLE(0,2,0,0)));
+}
+
+/* -------------------------------------------------------- *
+* step function
+* -------------------------------------------------------- */
+
+template <unsigned int Alpha, unsigned int Beta>
+inline void mix(lsh_u32 cv_l[8], lsh_u32 cv_r[8], const lsh_u32 const_v[8])
+{
+	add_blk(cv_l, cv_r);
+	rotate_blk<Alpha>(cv_l);
+	xor_with_const(cv_l, const_v);
+	add_blk(cv_r, cv_l);
+	rotate_blk<Beta>(cv_r);
+	add_blk(cv_l, cv_r);
+	rotate_msg_gamma(cv_r);
+}
+
+/* -------------------------------------------------------- *
+* compression function
+* -------------------------------------------------------- */
+
+inline void compress(LSH256_AVX2_Context* ctx, const lsh_u8 pdMsgBlk[LSH256_MSG_BLK_BYTE_LEN])
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	LSH256_AVX2_Internal  s_state(ctx->cv_l);
+	LSH256_AVX2_Internal* i_state = &s_state;
+
+	const lsh_u32* const_v = NULL;
+	lsh_u32* cv_l = ctx->cv_l;
+	lsh_u32* cv_r = ctx->cv_r;
+
+	load_msg_blk(i_state, pdMsgBlk);
+
+	msg_add_even(cv_l, cv_r, i_state);
+	load_sc(&const_v, 0);
+	mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	msg_add_odd(cv_l, cv_r, i_state);
+	load_sc(&const_v, 8);
+	mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	for (size_t i = 1; i < NUM_STEPS / 2; i++)
+	{
+		msg_exp_even(i_state);
+		msg_add_even(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		msg_exp_odd(i_state);
+		msg_add_odd(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	msg_exp_even(i_state);
+	msg_add_even(cv_l, cv_r, i_state);
+}
+
+/* -------------------------------------------------------- */
+
+inline void load_iv(word32 cv_l[8], word32 cv_r[8], const word32 iv[16])
+{
+	// The IV's are 32-byte aligned so we can use aligned loads.
+	_mm256_storeu_si256(M256_CAST(cv_l+0),
+		_mm256_load_si256(CONST_M256_CAST(iv+0)));
+	_mm256_storeu_si256(M256_CAST(cv_r+0),
+		_mm256_load_si256(CONST_M256_CAST(iv+8)));
+}
+
+inline void zero_iv(lsh_u32 cv_l[8], lsh_u32 cv_r[8])
+{
+	_mm256_storeu_si256(M256_CAST(cv_l+0), _mm256_setzero_si256());
+	_mm256_storeu_si256(M256_CAST(cv_r+0), _mm256_setzero_si256());
+}
+
+inline void zero_submsgs(LSH256_AVX2_Context* ctx)
+{
+	lsh_u32* sub_msgs = ctx->sub_msgs;
+
+	_mm256_storeu_si256(M256_CAST(sub_msgs+ 0), _mm256_setzero_si256());
+	_mm256_storeu_si256(M256_CAST(sub_msgs+ 8), _mm256_setzero_si256());
+	_mm256_storeu_si256(M256_CAST(sub_msgs+16), _mm256_setzero_si256());
+	_mm256_storeu_si256(M256_CAST(sub_msgs+24), _mm256_setzero_si256());
+}
+
+inline void init224(LSH256_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH256_IV224);
+}
+
+inline void init256(LSH256_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH256_IV256);
+}
+
+/* -------------------------------------------------------- */
+
+inline void fin(LSH256_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	_mm256_storeu_si256(M256_CAST(ctx->cv_l+0), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(ctx->cv_l+0)),
+		_mm256_loadu_si256(CONST_M256_CAST(ctx->cv_r+0))));
+}
+
+/* -------------------------------------------------------- */
+
+inline void get_hash(LSH256_AVX2_Context* ctx, lsh_u8* pbHashVal)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+	CRYPTOPP_ASSERT(pbHashVal != NULLPTR);
+
+	lsh_uint alg_type = ctx->alg_type;
+	lsh_uint hash_val_byte_len = LSH_GET_HASHBYTE(alg_type);
+	lsh_uint hash_val_bit_len = LSH_GET_SMALL_HASHBIT(alg_type);
+
+	// Multiplying by looks odd...
+	std::memcpy(pbHashVal, ctx->cv_l, hash_val_byte_len);
+	if (hash_val_bit_len){
+		pbHashVal[hash_val_byte_len-1] &= (((lsh_u8)0xff) << hash_val_bit_len);
+	}
+}
+
+/* -------------------------------------------------------- */
+
+lsh_err lsh256_init_avx2(LSH256_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	lsh_u32 alg_type = ctx->alg_type;
+	const lsh_u32* const_v = NULL;
+	ctx->remain_databitlen = 0;
+
+	// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735.
+	AVX_Cleanup cleanup;
+
+	switch (alg_type)
+	{
+	case LSH_TYPE_256_256:
+		init256(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_256_224:
+		init224(ctx);
+		return LSH_SUCCESS;
+	default:
+		break;
+	}
+
+	lsh_u32* cv_l = ctx->cv_l;
+	lsh_u32* cv_r = ctx->cv_r;
+
+	zero_iv(cv_l, cv_r);
+	cv_l[0] = LSH256_HASH_VAL_MAX_BYTE_LEN;
+	cv_l[1] = LSH_GET_HASHBIT(alg_type);
+
+	for (size_t i = 0; i < NUM_STEPS / 2; i++)
+	{
+		//Mix
+		load_sc(&const_v, i * 16);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		load_sc(&const_v, i * 16 + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh256_update_avx2(LSH256_AVX2_Context* ctx, const lsh_u8* data, size_t databitlen)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(data != NULLPTR);
+	CRYPTOPP_ASSERT(databitlen % 8 == 0);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735.
+	AVX_Cleanup cleanup;
+
+	if (databitlen == 0){
+		return LSH_SUCCESS;
+	}
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t databytelen = databitlen >> 3;
+	// lsh_uint pos2 = databitlen & 0x7;
+	const size_t pos2 = 0;
+
+	size_t remain_msg_byte = ctx->remain_databitlen >> 3;
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH256_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+	if (remain_msg_bit > 0){
+		return LSH_ERR_INVALID_DATABITLEN;
+	}
+
+	if (databytelen + remain_msg_byte < LSH256_MSG_BLK_BYTE_LEN)
+	{
+		std::memcpy(ctx->last_block + remain_msg_byte, data, databytelen);
+		ctx->remain_databitlen += (lsh_uint)databitlen;
+		remain_msg_byte += (lsh_uint)databytelen;
+		if (pos2){
+			ctx->last_block[remain_msg_byte] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		}
+		return LSH_SUCCESS;
+	}
+
+	if (remain_msg_byte > 0){
+		size_t more_byte = LSH256_MSG_BLK_BYTE_LEN - remain_msg_byte;
+		std::memcpy(ctx->last_block + remain_msg_byte, data, more_byte);
+		compress(ctx, ctx->last_block);
+		data += more_byte;
+		databytelen -= more_byte;
+		remain_msg_byte = 0;
+		ctx->remain_databitlen = 0;
+	}
+
+	while (databytelen >= LSH256_MSG_BLK_BYTE_LEN)
+	{
+		// This call to compress caused some trouble.
+		// The data pointer can become unaligned in the
+		// previous block.
+		compress(ctx, data);
+		data += LSH256_MSG_BLK_BYTE_LEN;
+		databytelen -= LSH256_MSG_BLK_BYTE_LEN;
+	}
+
+	if (databytelen > 0){
+		std::memcpy(ctx->last_block, data, databytelen);
+		ctx->remain_databitlen = (lsh_uint)(databytelen << 3);
+	}
+
+	if (pos2){
+		ctx->last_block[databytelen] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		ctx->remain_databitlen += pos2;
+	}
+
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh256_final_avx2(LSH256_AVX2_Context* ctx, lsh_u8* hashval)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(hashval != NULLPTR);
+
+	// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735.
+	AVX_Cleanup cleanup;
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t remain_msg_byte = ctx->remain_databitlen >> 3;
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH256_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+
+	if (remain_msg_bit){
+		ctx->last_block[remain_msg_byte] |= (0x1 << (7 - remain_msg_bit));
+	}
+	else{
+		ctx->last_block[remain_msg_byte] = 0x80;
+	}
+	std::memset(ctx->last_block + remain_msg_byte + 1, 0, LSH256_MSG_BLK_BYTE_LEN - remain_msg_byte - 1);
+
+	compress(ctx, ctx->last_block);
+
+	fin(ctx);
+	get_hash(ctx, hashval);
+
+	return LSH_SUCCESS;
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+extern
+void LSH256_Base_Restart_AVX2(word32* state)
+{
+	state[RemainingBits] = 0;
+	LSH256_AVX2_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh256_init_avx2(&ctx);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH256_Base: lsh256_init_avx2 failed");
+}
+
+extern
+void LSH256_Base_Update_AVX2(word32* state, const byte *input, size_t size)
+{
+	LSH256_AVX2_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh256_update_avx2(&ctx, input, 8*size);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH256_Base: lsh256_update_avx2 failed");
+}
+
+extern
+void LSH256_Base_TruncatedFinal_AVX2(word32* state, byte *hash, size_t)
+{
+	LSH256_AVX2_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh256_final_avx2(&ctx, hash);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH256_Base: lsh256_final_avx2 failed");
+}
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_AVX2_AVAILABLE
diff --git a/runtime/third_party/cryptopp/lsh256_sse.cpp b/runtime/third_party/cryptopp/lsh256_sse.cpp
new file mode 100644
index 0000000..cbc7792
--- /dev/null
+++ b/runtime/third_party/cryptopp/lsh256_sse.cpp
@@ -0,0 +1,712 @@
+// lsh.cpp - written and placed in the public domain by Jeffrey Walton
+//           Based on the specification and source code provided by
+//           Korea Internet & Security Agency (KISA) website. Also
+//           see https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do
+//           and https://seed.kisa.or.kr/kisa/Board/22/detailView.do.
+
+// We are hitting some sort of GCC bug in the LSH AVX2 code path.
+// Clang is OK on the AVX2 code path. We believe it is GCC Issue
+// 82735, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735. It
+// makes using zeroupper a little tricky.
+
+#include "pch.h"
+#include "config.h"
+
+#include "lsh.h"
+#include "cpu.h"
+#include "misc.h"
+
+// Squash MS LNK4221 and libtool warnings
+extern const char LSH256_SSE_FNAME[] = __FILE__;
+
+#if defined(CRYPTOPP_SSSE3_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+# include <emmintrin.h>
+# include <tmmintrin.h>
+#endif
+
+#if defined(CRYPTOPP_XOP_AVAILABLE)
+# include <ammintrin.h>
+#endif
+
+#if defined(CRYPTOPP_GCC_COMPATIBLE)
+# include <x86intrin.h>
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+/* LSH Constants */
+
+const unsigned int LSH256_MSG_BLK_BYTE_LEN = 128;
+// const unsigned int LSH256_MSG_BLK_BIT_LEN = 1024;
+// const unsigned int LSH256_CV_BYTE_LEN = 64;
+const unsigned int LSH256_HASH_VAL_MAX_BYTE_LEN = 32;
+
+// const unsigned int MSG_BLK_WORD_LEN = 32;
+const unsigned int CV_WORD_LEN = 16;
+const unsigned int CONST_WORD_LEN = 8;
+// const unsigned int HASH_VAL_MAX_WORD_LEN = 8;
+// const unsigned int WORD_BIT_LEN = 32;
+const unsigned int NUM_STEPS = 26;
+
+const unsigned int ROT_EVEN_ALPHA = 29;
+const unsigned int ROT_EVEN_BETA = 1;
+const unsigned int ROT_ODD_ALPHA = 5;
+const unsigned int ROT_ODD_BETA = 17;
+
+const unsigned int LSH_TYPE_256_256 = 0x0000020;
+const unsigned int LSH_TYPE_256_224 = 0x000001C;
+
+// const unsigned int LSH_TYPE_224 = LSH_TYPE_256_224;
+// const unsigned int LSH_TYPE_256 = LSH_TYPE_256_256;
+
+/* Error Code */
+
+const unsigned int LSH_SUCCESS = 0x0;
+// const unsigned int LSH_ERR_NULL_PTR = 0x2401;
+// const unsigned int LSH_ERR_INVALID_ALGTYPE = 0x2402;
+const unsigned int LSH_ERR_INVALID_DATABITLEN = 0x2403;
+const unsigned int LSH_ERR_INVALID_STATE = 0x2404;
+
+/* Index into our state array */
+
+const unsigned int AlgorithmType = 80;
+const unsigned int RemainingBits = 81;
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(LSH)
+
+// lsh256.cpp
+extern const word32 LSH256_IV224[CV_WORD_LEN];
+extern const word32 LSH256_IV256[CV_WORD_LEN];
+extern const word32 LSH256_StepConstants[CONST_WORD_LEN * NUM_STEPS];
+
+NAMESPACE_END  // LSH
+NAMESPACE_END  // Crypto++
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::rotlFixed;
+using CryptoPP::rotlConstant;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+using CryptoPP::ConditionalByteReverse;
+using CryptoPP::LITTLE_ENDIAN_ORDER;
+
+typedef byte lsh_u8;
+typedef word32 lsh_u32;
+typedef word32 lsh_uint;
+typedef word32 lsh_err;
+typedef word32 lsh_type;
+
+using CryptoPP::LSH::LSH256_IV224;
+using CryptoPP::LSH::LSH256_IV256;
+using CryptoPP::LSH::LSH256_StepConstants;
+
+struct LSH256_SSSE3_Context
+{
+	LSH256_SSSE3_Context(word32* state, word32 algType, word32& remainingBitLength) :
+		cv_l(state+0), cv_r(state+8), sub_msgs(state+16),
+		last_block(reinterpret_cast<byte*>(state+48)),
+		remain_databitlen(remainingBitLength),
+		alg_type(static_cast<lsh_type>(algType)) {}
+
+	lsh_u32* cv_l;  // start of our state block
+	lsh_u32* cv_r;
+	lsh_u32* sub_msgs;
+	lsh_u8*  last_block;
+	lsh_u32& remain_databitlen;
+	lsh_type alg_type;
+};
+
+struct LSH256_SSSE3_Internal
+{
+	LSH256_SSSE3_Internal(word32* state) :
+		submsg_e_l(state+16), submsg_e_r(state+24),
+		submsg_o_l(state+32), submsg_o_r(state+40) { }
+
+	lsh_u32* submsg_e_l; /* even left sub-message  */
+	lsh_u32* submsg_e_r; /* even right sub-message */
+	lsh_u32* submsg_o_l; /* odd left sub-message   */
+	lsh_u32* submsg_o_r; /* odd right sub-message  */
+};
+
+// const word32 g_gamma256[8] = { 0, 8, 16, 24, 24, 16, 8, 0 };
+
+/* LSH AlgType Macro */
+
+inline bool LSH_IS_LSH512(lsh_uint val) {
+	return (val & 0xf0000) == 0;
+}
+
+inline lsh_uint LSH_GET_SMALL_HASHBIT(lsh_uint val) {
+	return val >> 24;
+}
+
+inline lsh_uint LSH_GET_HASHBYTE(lsh_uint val) {
+	return val & 0xffff;
+}
+
+inline lsh_uint LSH_GET_HASHBIT(lsh_uint val) {
+	return (LSH_GET_HASHBYTE(val) << 3) - LSH_GET_SMALL_HASHBIT(val);
+}
+
+inline lsh_u32 loadLE32(lsh_u32 v) {
+	return ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v);
+}
+
+lsh_u32 ROTL(lsh_u32 x, lsh_u32 r) {
+	return rotlFixed(x, r);
+}
+
+// Original code relied upon unaligned lsh_u32 buffer
+inline void load_msg_blk(LSH256_SSSE3_Internal* i_state, const lsh_u8 msgblk[LSH256_MSG_BLK_BYTE_LEN])
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	_mm_storeu_si128(M128_CAST(submsg_e_l+0),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+0)));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+4),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+16)));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+0),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+32)));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+4),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+48)));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+0),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+64)));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+4),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+80)));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+0),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+96)));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+4),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+112)));
+}
+
+inline void msg_exp_even(LSH256_SSSE3_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	_mm_storeu_si128(M128_CAST(submsg_e_l+0), _mm_add_epi32(
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+0)), _MM_SHUFFLE(3,2,1,0)),
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+0)), _MM_SHUFFLE(1,0,2,3))));
+
+	_mm_storeu_si128(M128_CAST(submsg_e_l+4), _mm_add_epi32(
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+4)), _MM_SHUFFLE(3,2,1,0)),
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+4)), _MM_SHUFFLE(2,1,0,3))));
+
+	_mm_storeu_si128(M128_CAST(submsg_e_r+0), _mm_add_epi32(
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+0)), _MM_SHUFFLE(3,2,1,0)),
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+0)), _MM_SHUFFLE(1,0,2,3))));
+
+	_mm_storeu_si128(M128_CAST(submsg_e_r+4), _mm_add_epi32(
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+4)), _MM_SHUFFLE(3,2,1,0)),
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+4)), _MM_SHUFFLE(2,1,0,3))));
+}
+
+inline void msg_exp_odd(LSH256_SSSE3_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	_mm_storeu_si128(M128_CAST(submsg_o_l+0), _mm_add_epi32(
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+0)), _MM_SHUFFLE(3,2,1,0)),
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+0)), _MM_SHUFFLE(1,0,2,3))));
+
+	_mm_storeu_si128(M128_CAST(submsg_o_l+4), _mm_add_epi32(
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+4)), _MM_SHUFFLE(3,2,1,0)),
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+4)), _MM_SHUFFLE(2,1,0,3))));
+
+	_mm_storeu_si128(M128_CAST(submsg_o_r+0), _mm_add_epi32(
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+0)), _MM_SHUFFLE(3,2,1,0)),
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+0)), _MM_SHUFFLE(1,0,2,3))));
+
+	_mm_storeu_si128(M128_CAST(submsg_o_r+4), _mm_add_epi32(
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+4)), _MM_SHUFFLE(3,2,1,0)),
+		_mm_shuffle_epi32(
+			_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+4)), _MM_SHUFFLE(2,1,0,3))));
+}
+
+inline void load_sc(const lsh_u32** p_const_v, size_t i)
+{
+	CRYPTOPP_ASSERT(p_const_v != NULLPTR);
+
+	*p_const_v = &LSH256_StepConstants[i];
+}
+
+inline void msg_add_even(lsh_u32 cv_l[8], lsh_u32 cv_r[8], LSH256_SSSE3_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_e_l = i_state->submsg_e_l;
+	lsh_u32* submsg_e_r = i_state->submsg_e_r;
+
+	_mm_storeu_si128(M128_CAST(cv_l+0), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+0)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+0))));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+4))));
+	_mm_storeu_si128(M128_CAST(cv_r+0), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+0)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+0))));
+	_mm_storeu_si128(M128_CAST(cv_r+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+4))));
+}
+
+inline void msg_add_odd(lsh_u32 cv_l[8], lsh_u32 cv_r[8], LSH256_SSSE3_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u32* submsg_o_l = i_state->submsg_o_l;
+	lsh_u32* submsg_o_r = i_state->submsg_o_r;
+
+	_mm_storeu_si128(M128_CAST(cv_l), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l))));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+4))));
+	_mm_storeu_si128(M128_CAST(cv_r), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r))));
+	_mm_storeu_si128(M128_CAST(cv_r+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+4))));
+}
+
+inline void add_blk(lsh_u32 cv_l[8], const lsh_u32 cv_r[8])
+{
+	_mm_storeu_si128(M128_CAST(cv_l), _mm_add_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r))));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_add_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4))));
+}
+
+template <unsigned int R>
+inline void rotate_blk(lsh_u32 cv[8])
+{
+#if defined(CRYPTOPP_XOP_AVAILABLE)
+	_mm_storeu_si128(M128_CAST(cv),
+		_mm_roti_epi32(_mm_loadu_si128(CONST_M128_CAST(cv)), R));
+	_mm_storeu_si128(M128_CAST(cv+4),
+		_mm_roti_epi32(_mm_loadu_si128(CONST_M128_CAST(cv+4)), R));
+#else
+	_mm_storeu_si128(M128_CAST(cv), _mm_or_si128(
+		_mm_slli_epi32(_mm_loadu_si128(CONST_M128_CAST(cv)), R),
+		_mm_srli_epi32(_mm_loadu_si128(CONST_M128_CAST(cv)), 32-R)));
+	_mm_storeu_si128(M128_CAST(cv+4), _mm_or_si128(
+		_mm_slli_epi32(_mm_loadu_si128(CONST_M128_CAST(cv+4)), R),
+		_mm_srli_epi32(_mm_loadu_si128(CONST_M128_CAST(cv+4)), 32-R)));
+#endif
+}
+
+inline void xor_with_const(lsh_u32* cv_l, const lsh_u32* const_v)
+{
+	_mm_storeu_si128(M128_CAST(cv_l), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l)),
+		_mm_loadu_si128(CONST_M128_CAST(const_v))));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(const_v+4))));
+}
+
+inline void rotate_msg_gamma(lsh_u32 cv_r[8])
+{
+	// g_gamma256[8] = { 0, 8, 16, 24, 24, 16, 8, 0 };
+	_mm_storeu_si128(M128_CAST(cv_r+0),
+		_mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(cv_r+0)),
+			_mm_set_epi8(12,15,14,13, 9,8,11,10, 6,5,4,7, 3,2,1,0)));
+	_mm_storeu_si128(M128_CAST(cv_r+4),
+		_mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(cv_r+4)),
+			_mm_set_epi8(15,14,13,12, 10,9,8,11, 5,4,7,6, 0,3,2,1)));
+}
+
+inline void word_perm(lsh_u32 cv_l[8], lsh_u32 cv_r[8])
+{
+	_mm_storeu_si128(M128_CAST(cv_l+0), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+0)), _MM_SHUFFLE(3,1,0,2)));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)), _MM_SHUFFLE(3,1,0,2)));
+	_mm_storeu_si128(M128_CAST(cv_r+0), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+0)), _MM_SHUFFLE(1,2,3,0)));
+	_mm_storeu_si128(M128_CAST(cv_r+4), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4)), _MM_SHUFFLE(1,2,3,0)));
+
+	__m128i temp = _mm_loadu_si128(CONST_M128_CAST(cv_l+0));
+	_mm_storeu_si128(M128_CAST(cv_l+0),
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)));
+	_mm_storeu_si128(M128_CAST(cv_l+4),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4)));
+	_mm_storeu_si128(M128_CAST(cv_r+4),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+0)));
+	_mm_storeu_si128(M128_CAST(cv_r+0), temp);
+}
+
+/* -------------------------------------------------------- *
+* step function
+* -------------------------------------------------------- */
+
+template <unsigned int Alpha, unsigned int Beta>
+inline void mix(lsh_u32 cv_l[8], lsh_u32 cv_r[8], const lsh_u32 const_v[8])
+{
+	add_blk(cv_l, cv_r);
+	rotate_blk<Alpha>(cv_l);
+	xor_with_const(cv_l, const_v);
+	add_blk(cv_r, cv_l);
+	rotate_blk<Beta>(cv_r);
+	add_blk(cv_l, cv_r);
+	rotate_msg_gamma(cv_r);
+}
+
+/* -------------------------------------------------------- *
+* compression function
+* -------------------------------------------------------- */
+
+inline void compress(LSH256_SSSE3_Context* ctx, const lsh_u8 pdMsgBlk[LSH256_MSG_BLK_BYTE_LEN])
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	LSH256_SSSE3_Internal  s_state(ctx->cv_l);
+	LSH256_SSSE3_Internal* i_state = &s_state;
+
+	const lsh_u32* const_v = NULL;
+	lsh_u32* cv_l = ctx->cv_l;
+	lsh_u32* cv_r = ctx->cv_r;
+
+	load_msg_blk(i_state, pdMsgBlk);
+
+	msg_add_even(cv_l, cv_r, i_state);
+	load_sc(&const_v, 0);
+	mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	msg_add_odd(cv_l, cv_r, i_state);
+	load_sc(&const_v, 8);
+	mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	for (size_t i = 1; i < NUM_STEPS / 2; i++)
+	{
+		msg_exp_even(i_state);
+		msg_add_even(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		msg_exp_odd(i_state);
+		msg_add_odd(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	msg_exp_even(i_state);
+	msg_add_even(cv_l, cv_r, i_state);
+}
+
+/* -------------------------------------------------------- */
+
+inline void load_iv(lsh_u32 cv_l[8], lsh_u32 cv_r[8], const lsh_u32 iv[16])
+{
+	_mm_storeu_si128(M128_CAST(cv_l+ 0),
+		_mm_load_si128(CONST_M128_CAST(iv+ 0)));
+	_mm_storeu_si128(M128_CAST(cv_l+ 4),
+		_mm_load_si128(CONST_M128_CAST(iv+ 4)));
+	_mm_storeu_si128(M128_CAST(cv_r+ 0),
+		_mm_load_si128(CONST_M128_CAST(iv+ 8)));
+	_mm_storeu_si128(M128_CAST(cv_r+ 4),
+		_mm_load_si128(CONST_M128_CAST(iv+12)));
+}
+
+inline void zero_iv(lsh_u32 cv_l[8], lsh_u32 cv_r[8])
+{
+	_mm_storeu_si128(M128_CAST(cv_l+0), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_r+0), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_r+4), _mm_setzero_si128());
+}
+
+inline void zero_submsgs(LSH256_SSSE3_Context* ctx)
+{
+	lsh_u32* sub_msgs = ctx->sub_msgs;
+
+	_mm_storeu_si128(M128_CAST(sub_msgs+ 0), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+ 4), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+ 8), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+12), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+16), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+20), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+24), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+28), _mm_setzero_si128());
+}
+
+inline void init224(LSH256_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH256_IV224);
+}
+
+inline void init256(LSH256_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH256_IV256);
+}
+
+/* -------------------------------------------------------- */
+
+inline void fin(LSH256_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	_mm_storeu_si128(M128_CAST(ctx->cv_l+0), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_l+0)),
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_r+0))));
+	_mm_storeu_si128(M128_CAST(ctx->cv_l+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_r+4))));
+}
+
+/* -------------------------------------------------------- */
+
+inline void get_hash(LSH256_SSSE3_Context* ctx, lsh_u8* pbHashVal)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+	CRYPTOPP_ASSERT(pbHashVal != NULLPTR);
+
+	lsh_uint alg_type = ctx->alg_type;
+	lsh_uint hash_val_byte_len = LSH_GET_HASHBYTE(alg_type);
+	lsh_uint hash_val_bit_len = LSH_GET_SMALL_HASHBIT(alg_type);
+
+	// Multiplying by sizeof(lsh_u8) looks odd...
+	std::memcpy(pbHashVal, ctx->cv_l, hash_val_byte_len);
+	if (hash_val_bit_len){
+		pbHashVal[hash_val_byte_len-1] &= (((lsh_u8)0xff) << hash_val_bit_len);
+	}
+}
+
+/* -------------------------------------------------------- */
+
+lsh_err lsh256_ssse3_init(LSH256_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	lsh_u32 alg_type = ctx->alg_type;
+	const lsh_u32* const_v = NULL;
+	ctx->remain_databitlen = 0;
+
+	switch (alg_type)
+	{
+	case LSH_TYPE_256_256:
+		init256(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_256_224:
+		init224(ctx);
+		return LSH_SUCCESS;
+	default:
+		break;
+	}
+
+	lsh_u32* cv_l = ctx->cv_l;
+	lsh_u32* cv_r = ctx->cv_r;
+
+	zero_iv(cv_l, cv_r);
+	cv_l[0] = LSH256_HASH_VAL_MAX_BYTE_LEN;
+	cv_l[1] = LSH_GET_HASHBIT(alg_type);
+
+	for (size_t i = 0; i < NUM_STEPS / 2; i++)
+	{
+		//Mix
+		load_sc(&const_v, i * 16);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		load_sc(&const_v, i * 16 + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh256_ssse3_update(LSH256_SSSE3_Context* ctx, const lsh_u8* data, size_t databitlen)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(data != NULLPTR);
+	CRYPTOPP_ASSERT(databitlen % 8 == 0);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	if (databitlen == 0){
+		return LSH_SUCCESS;
+	}
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t databytelen = databitlen >> 3;
+	// lsh_uint pos2 = databitlen & 0x7;
+	const size_t pos2 = 0;
+
+	size_t remain_msg_byte = ctx->remain_databitlen >> 3;
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH256_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+	if (remain_msg_bit > 0){
+		return LSH_ERR_INVALID_DATABITLEN;
+	}
+
+	if (databytelen + remain_msg_byte < LSH256_MSG_BLK_BYTE_LEN)
+	{
+		std::memcpy(ctx->last_block + remain_msg_byte, data, databytelen);
+		ctx->remain_databitlen += (lsh_uint)databitlen;
+		remain_msg_byte += (lsh_uint)databytelen;
+		if (pos2){
+			ctx->last_block[remain_msg_byte] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		}
+		return LSH_SUCCESS;
+	}
+
+	if (remain_msg_byte > 0){
+		size_t more_byte = LSH256_MSG_BLK_BYTE_LEN - remain_msg_byte;
+		std::memcpy(ctx->last_block + remain_msg_byte, data, more_byte);
+		compress(ctx, ctx->last_block);
+		data += more_byte;
+		databytelen -= more_byte;
+		remain_msg_byte = 0;
+		ctx->remain_databitlen = 0;
+	}
+
+	while (databytelen >= LSH256_MSG_BLK_BYTE_LEN)
+	{
+		// This call to compress caused some trouble.
+		// The data pointer can become unaligned in the
+		// previous block.
+		compress(ctx, data);
+		data += LSH256_MSG_BLK_BYTE_LEN;
+		databytelen -= LSH256_MSG_BLK_BYTE_LEN;
+	}
+
+	if (databytelen > 0){
+		std::memcpy(ctx->last_block, data, databytelen);
+		ctx->remain_databitlen = (lsh_uint)(databytelen << 3);
+	}
+
+	if (pos2){
+		ctx->last_block[databytelen] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		ctx->remain_databitlen += pos2;
+	}
+
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh256_ssse3_final(LSH256_SSSE3_Context* ctx, lsh_u8* hashval)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(hashval != NULLPTR);
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t remain_msg_byte = ctx->remain_databitlen >> 3;
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH256_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+
+	if (remain_msg_bit){
+		ctx->last_block[remain_msg_byte] |= (0x1 << (7 - remain_msg_bit));
+	}
+	else{
+		ctx->last_block[remain_msg_byte] = 0x80;
+	}
+	std::memset(ctx->last_block + remain_msg_byte + 1, 0, LSH256_MSG_BLK_BYTE_LEN - remain_msg_byte - 1);
+
+	compress(ctx, ctx->last_block);
+
+	fin(ctx);
+	get_hash(ctx, hashval);
+
+	return LSH_SUCCESS;
+}
+
+ANONYMOUS_NAMESPACE_END  // Anonymous
+
+NAMESPACE_BEGIN(CryptoPP)
+
+extern
+void LSH256_Base_Restart_SSSE3(word32* state)
+{
+	state[RemainingBits] = 0;
+	LSH256_SSSE3_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh256_ssse3_init(&ctx);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH256_Base: lsh256_ssse3_init failed");
+}
+
+extern
+void LSH256_Base_Update_SSSE3(word32* state, const byte *input, size_t size)
+{
+	LSH256_SSSE3_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh256_ssse3_update(&ctx, input, 8*size);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH256_Base: lsh256_ssse3_update failed");
+}
+
+extern
+void LSH256_Base_TruncatedFinal_SSSE3(word32* state, byte *hash, size_t)
+{
+	LSH256_SSSE3_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh256_ssse3_final(&ctx, hash);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH256_Base: lsh256_ssse3_final failed");
+}
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
diff --git a/runtime/third_party/cryptopp/lsh512.cpp b/runtime/third_party/cryptopp/lsh512.cpp
new file mode 100644
index 0000000..7005bbf
--- /dev/null
+++ b/runtime/third_party/cryptopp/lsh512.cpp
@@ -0,0 +1,893 @@
+// lsh.cpp - written and placed in the public domain by Jeffrey Walton
+//           Based on the specification and source code provided by
+//           Korea Internet & Security Agency (KISA) website. Also
+//           see https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do
+//           and https://seed.kisa.or.kr/kisa/Board/22/detailView.do.
+
+// We are hitting some sort of GCC bug in the LSH AVX2 code path.
+// Clang is OK on the AVX2 code path. We believe it is GCC Issue
+// 82735, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735. It
+// makes using zeroupper a little tricky.
+
+
+#include "pch.h"
+#include "config.h"
+
+#include "lsh.h"
+#include "cpu.h"
+#include "misc.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+/* LSH Constants */
+
+const unsigned int LSH512_MSG_BLK_BYTE_LEN = 256;
+// const unsigned int LSH512_MSG_BLK_BIT_LEN = 2048;
+// const unsigned int LSH512_CV_BYTE_LEN = 128;
+const unsigned int LSH512_HASH_VAL_MAX_BYTE_LEN = 64;
+
+// const unsigned int MSG_BLK_WORD_LEN = 32;
+const unsigned int CV_WORD_LEN = 16;
+const unsigned int CONST_WORD_LEN = 8;
+const unsigned int HASH_VAL_MAX_WORD_LEN = 8;
+const unsigned int NUM_STEPS = 28;
+
+const unsigned int ROT_EVEN_ALPHA = 23;
+const unsigned int ROT_EVEN_BETA = 59;
+const unsigned int ROT_ODD_ALPHA = 7;
+const unsigned int ROT_ODD_BETA = 3;
+
+const unsigned int LSH_TYPE_512_512 = 0x0010040;
+const unsigned int LSH_TYPE_512_384 = 0x0010030;
+const unsigned int LSH_TYPE_512_256 = 0x0010020;
+const unsigned int LSH_TYPE_512_224 = 0x001001C;
+
+// const unsigned int LSH_TYPE_384 = LSH_TYPE_512_384;
+// const unsigned int LSH_TYPE_512 = LSH_TYPE_512_512;
+
+/* Error Code */
+
+const unsigned int LSH_SUCCESS = 0x0;
+// const unsigned int LSH_ERR_NULL_PTR = 0x2401;
+// const unsigned int LSH_ERR_INVALID_ALGTYPE = 0x2402;
+const unsigned int LSH_ERR_INVALID_DATABITLEN = 0x2403;
+const unsigned int LSH_ERR_INVALID_STATE = 0x2404;
+
+/* Index into our state array */
+
+const unsigned int AlgorithmType = 80;
+const unsigned int RemainingBits = 81;
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(LSH)
+
+/* -------------------------------------------------------- *
+* LSH: iv
+* -------------------------------------------------------- */
+
+//extern const word64 LSH512_IV224[CV_WORD_LEN];
+//extern const word64 LSH512_IV256[CV_WORD_LEN];
+//extern const word64 LSH512_IV384[CV_WORD_LEN];
+//extern const word64 LSH512_IV512[CV_WORD_LEN];
+//extern const word64 LSH512_StepConstants[CONST_WORD_LEN * NUM_STEPS];
+
+CRYPTOPP_ALIGN_DATA(32)
+extern
+const word64 LSH512_IV224[CV_WORD_LEN] = {
+	W64LIT(0x0C401E9FE8813A55), W64LIT(0x4A5F446268FD3D35), W64LIT(0xFF13E452334F612A), W64LIT(0xF8227661037E354A),
+	W64LIT(0xA5F223723C9CA29D), W64LIT(0x95D965A11AED3979), W64LIT(0x01E23835B9AB02CC), W64LIT(0x52D49CBAD5B30616),
+	W64LIT(0x9E5C2027773F4ED3), W64LIT(0x66A5C8801925B701), W64LIT(0x22BBC85B4C6779D9), W64LIT(0xC13171A42C559C23),
+	W64LIT(0x31E2B67D25BE3813), W64LIT(0xD522C4DEED8E4D83), W64LIT(0xA79F5509B43FBAFE), W64LIT(0xE00D2CD88B4B6C6A),
+};
+
+CRYPTOPP_ALIGN_DATA(32)
+extern
+const word64 LSH512_IV256[CV_WORD_LEN] = {
+	W64LIT(0x6DC57C33DF989423), W64LIT(0xD8EA7F6E8342C199), W64LIT(0x76DF8356F8603AC4), W64LIT(0x40F1B44DE838223A),
+	W64LIT(0x39FFE7CFC31484CD), W64LIT(0x39C4326CC5281548), W64LIT(0x8A2FF85A346045D8), W64LIT(0xFF202AA46DBDD61E),
+	W64LIT(0xCF785B3CD5FCDB8B), W64LIT(0x1F0323B64A8150BF), W64LIT(0xFF75D972F29EA355), W64LIT(0x2E567F30BF1CA9E1),
+	W64LIT(0xB596875BF8FF6DBA), W64LIT(0xFCCA39B089EF4615), W64LIT(0xECFF4017D020B4B6), W64LIT(0x7E77384C772ED802),
+};
+
+CRYPTOPP_ALIGN_DATA(32)
+extern
+const word64 LSH512_IV384[CV_WORD_LEN] = {
+	W64LIT(0x53156A66292808F6), W64LIT(0xB2C4F362B204C2BC), W64LIT(0xB84B7213BFA05C4E), W64LIT(0x976CEB7C1B299F73),
+	W64LIT(0xDF0CC63C0570AE97), W64LIT(0xDA4441BAA486CE3F), W64LIT(0x6559F5D9B5F2ACC2), W64LIT(0x22DACF19B4B52A16),
+	W64LIT(0xBBCDACEFDE80953A), W64LIT(0xC9891A2879725B3E), W64LIT(0x7C9FE6330237E440), W64LIT(0xA30BA550553F7431),
+	W64LIT(0xBB08043FB34E3E30), W64LIT(0xA0DEC48D54618EAD), W64LIT(0x150317267464BC57), W64LIT(0x32D1501FDE63DC93)
+};
+
+CRYPTOPP_ALIGN_DATA(32)
+extern
+const word64 LSH512_IV512[CV_WORD_LEN] = {
+	W64LIT(0xadd50f3c7f07094e), W64LIT(0xe3f3cee8f9418a4f), W64LIT(0xb527ecde5b3d0ae9), W64LIT(0x2ef6dec68076f501),
+	W64LIT(0x8cb994cae5aca216), W64LIT(0xfbb9eae4bba48cc7), W64LIT(0x650a526174725fea), W64LIT(0x1f9a61a73f8d8085),
+	W64LIT(0xb6607378173b539b), W64LIT(0x1bc99853b0c0b9ed), W64LIT(0xdf727fc19b182d47), W64LIT(0xdbef360cf893a457),
+	W64LIT(0x4981f5e570147e80), W64LIT(0xd00c4490ca7d3e30), W64LIT(0x5d73940c0e4ae1ec), W64LIT(0x894085e2edb2d819)
+};
+
+/* -------------------------------------------------------- *
+* LSH: step constants
+* -------------------------------------------------------- */
+
+extern
+const word64 LSH512_StepConstants[CONST_WORD_LEN * NUM_STEPS] = {
+	W64LIT(0x97884283c938982a), W64LIT(0xba1fca93533e2355), W64LIT(0xc519a2e87aeb1c03), W64LIT(0x9a0fc95462af17b1),
+	W64LIT(0xfc3dda8ab019a82b), W64LIT(0x02825d079a895407), W64LIT(0x79f2d0a7ee06a6f7), W64LIT(0xd76d15eed9fdf5fe),
+	W64LIT(0x1fcac64d01d0c2c1), W64LIT(0xd9ea5de69161790f), W64LIT(0xdebc8b6366071fc8), W64LIT(0xa9d91db711c6c94b),
+	W64LIT(0x3a18653ac9c1d427), W64LIT(0x84df64a223dd5b09), W64LIT(0x6cc37895f4ad9e70), W64LIT(0x448304c8d7f3f4d5),
+	W64LIT(0xea91134ed29383e0), W64LIT(0xc4484477f2da88e8), W64LIT(0x9b47eec96d26e8a6), W64LIT(0x82f6d4c8d89014f4),
+	W64LIT(0x527da0048b95fb61), W64LIT(0x644406c60138648d), W64LIT(0x303c0e8aa24c0edc), W64LIT(0xc787cda0cbe8ca19),
+	W64LIT(0x7ba46221661764ca), W64LIT(0x0c8cbc6acd6371ac), W64LIT(0xe336b836940f8f41), W64LIT(0x79cb9da168a50976),
+	W64LIT(0xd01da49021915cb3), W64LIT(0xa84accc7399cf1f1), W64LIT(0x6c4a992cee5aeb0c), W64LIT(0x4f556e6cb4b2e3e0),
+	W64LIT(0x200683877d7c2f45), W64LIT(0x9949273830d51db8), W64LIT(0x19eeeecaa39ed124), W64LIT(0x45693f0a0dae7fef),
+	W64LIT(0xedc234b1b2ee1083), W64LIT(0xf3179400d68ee399), W64LIT(0xb6e3c61b4945f778), W64LIT(0xa4c3db216796c42f),
+	W64LIT(0x268a0b04f9ab7465), W64LIT(0xe2705f6905f2d651), W64LIT(0x08ddb96e426ff53d), W64LIT(0xaea84917bc2e6f34),
+	W64LIT(0xaff6e664a0fe9470), W64LIT(0x0aab94d765727d8c), W64LIT(0x9aa9e1648f3d702e), W64LIT(0x689efc88fe5af3d3),
+	W64LIT(0xb0950ffea51fd98b), W64LIT(0x52cfc86ef8c92833), W64LIT(0xe69727b0b2653245), W64LIT(0x56f160d3ea9da3e2),
+	W64LIT(0xa6dd4b059f93051f), W64LIT(0xb6406c3cd7f00996), W64LIT(0x448b45f3ccad9ec8), W64LIT(0x079b8587594ec73b),
+	W64LIT(0x45a50ea3c4f9653b), W64LIT(0x22983767c1f15b85), W64LIT(0x7dbed8631797782b), W64LIT(0x485234be88418638),
+	W64LIT(0x842850a5329824c5), W64LIT(0xf6aca914c7f9a04c), W64LIT(0xcfd139c07a4c670c), W64LIT(0xa3210ce0a8160242),
+	W64LIT(0xeab3b268be5ea080), W64LIT(0xbacf9f29b34ce0a7), W64LIT(0x3c973b7aaf0fa3a8), W64LIT(0x9a86f346c9c7be80),
+	W64LIT(0xac78f5d7cabcea49), W64LIT(0xa355bddcc199ed42), W64LIT(0xa10afa3ac6b373db), W64LIT(0xc42ded88be1844e5),
+	W64LIT(0x9e661b271cff216a), W64LIT(0x8a6ec8dd002d8861), W64LIT(0xd3d2b629beb34be4), W64LIT(0x217a3a1091863f1a),
+	W64LIT(0x256ecda287a733f5), W64LIT(0xf9139a9e5b872fe5), W64LIT(0xac0535017a274f7c), W64LIT(0xf21b7646d65d2aa9),
+	W64LIT(0x048142441c208c08), W64LIT(0xf937a5dd2db5e9eb), W64LIT(0xa688dfe871ff30b7), W64LIT(0x9bb44aa217c5593b),
+	W64LIT(0x943c702a2edb291a), W64LIT(0x0cae38f9e2b715de), W64LIT(0xb13a367ba176cc28), W64LIT(0x0d91bd1d3387d49b),
+	W64LIT(0x85c386603cac940c), W64LIT(0x30dd830ae39fd5e4), W64LIT(0x2f68c85a712fe85d), W64LIT(0x4ffeecb9dd1e94d6),
+	W64LIT(0xd0ac9a590a0443ae), W64LIT(0xbae732dc99ccf3ea), W64LIT(0xeb70b21d1842f4d9), W64LIT(0x9f4eda50bb5c6fa8),
+	W64LIT(0x4949e69ce940a091), W64LIT(0x0e608dee8375ba14), W64LIT(0x983122cba118458c), W64LIT(0x4eeba696fbb36b25),
+	W64LIT(0x7d46f3630e47f27e), W64LIT(0xa21a0f7666c0dea4), W64LIT(0x5c22cf355b37cec4), W64LIT(0xee292b0c17cc1847),
+	W64LIT(0x9330838629e131da), W64LIT(0x6eee7c71f92fce22), W64LIT(0xc953ee6cb95dd224), W64LIT(0x3a923d92af1e9073),
+	W64LIT(0xc43a5671563a70fb), W64LIT(0xbc2985dd279f8346), W64LIT(0x7ef2049093069320), W64LIT(0x17543723e3e46035),
+	W64LIT(0xc3b409b00b130c6d), W64LIT(0x5d6aee6b28fdf090), W64LIT(0x1d425b26172ff6ed), W64LIT(0xcccfd041cdaf03ad),
+	W64LIT(0xfe90c7c790ab6cbf), W64LIT(0xe5af6304c722ca02), W64LIT(0x70f695239999b39e), W64LIT(0x6b8b5b07c844954c),
+	W64LIT(0x77bdb9bb1e1f7a30), W64LIT(0xc859599426ee80ed), W64LIT(0x5f9d813d4726e40a), W64LIT(0x9ca0120f7cb2b179),
+	W64LIT(0x8f588f583c182cbd), W64LIT(0x951267cbe9eccce7), W64LIT(0x678bb8bd334d520e), W64LIT(0xf6e662d00cd9e1b7),
+	W64LIT(0x357774d93d99aaa7), W64LIT(0x21b2edbb156f6eb5), W64LIT(0xfd1ebe846e0aee69), W64LIT(0x3cb2218c2f642b15),
+	W64LIT(0xe7e7e7945444ea4c), W64LIT(0xa77a33b5d6b9b47c), W64LIT(0xf34475f0809f6075), W64LIT(0xdd4932dce6bb99ad),
+	W64LIT(0xacec4e16d74451dc), W64LIT(0xd4a0a8d084de23d6), W64LIT(0x1bdd42f278f95866), W64LIT(0xeed3adbb938f4051),
+	W64LIT(0xcfcf7be8992f3733), W64LIT(0x21ade98c906e3123), W64LIT(0x37ba66711fffd668), W64LIT(0x267c0fc3a255478a),
+	W64LIT(0x993a64ee1b962e88), W64LIT(0x754979556301faaa), W64LIT(0xf920356b7251be81), W64LIT(0xc281694f22cf923f),
+	W64LIT(0x9f4b6481c8666b02), W64LIT(0xcf97761cfe9f5444), W64LIT(0xf220d7911fd63e9f), W64LIT(0xa28bd365f79cd1b0),
+	W64LIT(0xd39f5309b1c4b721), W64LIT(0xbec2ceb864fca51f), W64LIT(0x1955a0ddc410407a), W64LIT(0x43eab871f261d201),
+	W64LIT(0xeaafe64a2ed16da1), W64LIT(0x670d931b9df39913), W64LIT(0x12f868b0f614de91), W64LIT(0x2e5f395d946e8252),
+	W64LIT(0x72f25cbb767bd8f4), W64LIT(0x8191871d61a1c4dd), W64LIT(0x6ef67ea1d450ba93), W64LIT(0x2ea32a645433d344),
+	W64LIT(0x9a963079003f0f8b), W64LIT(0x74a0aeb9918cac7a), W64LIT(0x0b6119a70af36fa3), W64LIT(0x8d9896f202f0d480),
+	W64LIT(0x654f1831f254cd66), W64LIT(0x1318a47f0366a25e), W64LIT(0x65752076250b4e01), W64LIT(0xd1cd8eb888071772),
+	W64LIT(0x30c6a9793f4e9b25), W64LIT(0x154f684b1e3926ee), W64LIT(0x6c7ac0b1fe6312ae), W64LIT(0x262f88f4f3c5550d),
+	W64LIT(0xb4674a24472233cb), W64LIT(0x2bbd23826a090071), W64LIT(0xda95969b30594f66), W64LIT(0x9f5c47408f1e8a43),
+	W64LIT(0xf77022b88de9c055), W64LIT(0x64b7b36957601503), W64LIT(0xe73b72b06175c11a), W64LIT(0x55b87de8b91a6233),
+	W64LIT(0x1bb16e6b6955ff7f), W64LIT(0xe8e0a5ec7309719c), W64LIT(0x702c31cb89a8b640), W64LIT(0xfba387cfada8cde2),
+	W64LIT(0x6792db4677aa164c), W64LIT(0x1c6b1cc0b7751867), W64LIT(0x22ae2311d736dc01), W64LIT(0x0e3666a1d37c9588),
+	W64LIT(0xcd1fd9d4bf557e9a), W64LIT(0xc986925f7c7b0e84), W64LIT(0x9c5dfd55325ef6b0), W64LIT(0x9f2b577d5676b0dd),
+	W64LIT(0xfa6e21be21c062b3), W64LIT(0x8787dd782c8d7f83), W64LIT(0xd0d134e90e12dd23), W64LIT(0x449d087550121d96),
+	W64LIT(0xecf9ae9414d41967), W64LIT(0x5018f1dbf789934d), W64LIT(0xfa5b52879155a74c), W64LIT(0xca82d4d3cd278e7c),
+	W64LIT(0x688fdfdfe22316ad), W64LIT(0x0f6555a4ba0d030a), W64LIT(0xa2061df720f000f3), W64LIT(0xe1a57dc5622fb3da),
+	W64LIT(0xe6a842a8e8ed8153), W64LIT(0x690acdd3811ce09d), W64LIT(0x55adda18e6fcf446), W64LIT(0x4d57a8a0f4b60b46),
+	W64LIT(0xf86fbfc20539c415), W64LIT(0x74bafa5ec7100d19), W64LIT(0xa824151810f0f495), W64LIT(0x8723432791e38ebb),
+	W64LIT(0x8eeaeb91d66ed539), W64LIT(0x73d8a1549dfd7e06), W64LIT(0x0387f2ffe3f13a9b), W64LIT(0xa5004995aac15193),
+	W64LIT(0x682f81c73efdda0d), W64LIT(0x2fb55925d71d268d), W64LIT(0xcc392d2901e58a3d), W64LIT(0xaa666ab975724a42)
+};
+
+NAMESPACE_END  // LSH
+NAMESPACE_END  // Crypto++
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::rotlFixed;
+using CryptoPP::rotlConstant;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+using CryptoPP::ConditionalByteReverse;
+using CryptoPP::LITTLE_ENDIAN_ORDER;
+
+using CryptoPP::LSH::LSH512_IV224;
+using CryptoPP::LSH::LSH512_IV256;
+using CryptoPP::LSH::LSH512_IV384;
+using CryptoPP::LSH::LSH512_IV512;
+using CryptoPP::LSH::LSH512_StepConstants;
+
+typedef byte lsh_u8;
+typedef word32 lsh_u32;
+typedef word64 lsh_u64;
+typedef word32 lsh_uint;
+typedef word32 lsh_err;
+typedef word32 lsh_type;
+
+struct LSH512_Context
+{
+	LSH512_Context(word64* state, word64 algType, word64& remainingBitLength) :
+		cv_l(state+0), cv_r(state+8), sub_msgs(state+16),
+		last_block(reinterpret_cast<byte*>(state+48)),
+		remain_databitlen(remainingBitLength),
+		alg_type(static_cast<lsh_type>(algType)) {}
+
+	lsh_u64* cv_l;  // start of our state block
+	lsh_u64* cv_r;
+	lsh_u64* sub_msgs;
+	lsh_u8*  last_block;
+	lsh_u64& remain_databitlen;
+	lsh_type alg_type;
+};
+
+struct LSH512_Internal
+{
+	LSH512_Internal(word64* state) :
+		submsg_e_l(state+16), submsg_e_r(state+24),
+		submsg_o_l(state+32), submsg_o_r(state+40) { }
+
+	lsh_u64* submsg_e_l; /* even left sub-message  */
+	lsh_u64* submsg_e_r; /* even right sub-message */
+	lsh_u64* submsg_o_l; /* odd left sub-message   */
+	lsh_u64* submsg_o_r; /* odd right sub-message  */
+};
+
+const lsh_u32 g_gamma512[8] = { 0, 16, 32, 48, 8, 24, 40, 56 };
+
+/* LSH AlgType Macro */
+
+inline bool LSH_IS_LSH512(lsh_uint val) {
+	return (val & 0xf0000) == 0x10000;
+}
+
+inline lsh_uint LSH_GET_SMALL_HASHBIT(lsh_uint val) {
+	return val >> 24;
+}
+
+inline lsh_uint LSH_GET_HASHBYTE(lsh_uint val) {
+	return val & 0xffff;
+}
+
+inline lsh_uint LSH_GET_HASHBIT(lsh_uint val) {
+	return (LSH_GET_HASHBYTE(val) << 3) - LSH_GET_SMALL_HASHBIT(val);
+}
+
+inline lsh_u64 loadLE64(lsh_u64 v) {
+	return ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v);
+}
+
+lsh_u64 ROTL64(lsh_u64 x, lsh_u32 r) {
+	return rotlFixed(x, r);
+}
+
+// Original code relied upon unaligned lsh_u64 buffer
+inline void load_msg_blk(LSH512_Internal* i_state, const lsh_u8* msgblk)
+{
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	typedef GetBlock<word64, LittleEndian, false> InBlock;
+
+	InBlock input(msgblk);
+	input(submsg_e_l[0])(submsg_e_l[1])(submsg_e_l[2])(submsg_e_l[3])
+		(submsg_e_l[4])(submsg_e_l[5])(submsg_e_l[6])(submsg_e_l[7])
+		(submsg_e_r[0])(submsg_e_r[1])(submsg_e_r[2])(submsg_e_r[3])
+		(submsg_e_r[4])(submsg_e_r[5])(submsg_e_r[6])(submsg_e_r[7])
+		(submsg_o_l[0])(submsg_o_l[1])(submsg_o_l[2])(submsg_o_l[3])
+		(submsg_o_l[4])(submsg_o_l[5])(submsg_o_l[6])(submsg_o_l[7])
+		(submsg_o_r[0])(submsg_o_r[1])(submsg_o_r[2])(submsg_o_r[3])
+		(submsg_o_r[4])(submsg_o_r[5])(submsg_o_r[6])(submsg_o_r[7]);
+}
+
+inline void msg_exp_even(LSH512_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	lsh_u64 temp;
+	temp = submsg_e_l[0];
+	submsg_e_l[0] = submsg_o_l[0] + submsg_e_l[3];
+	submsg_e_l[3] = submsg_o_l[3] + submsg_e_l[1];
+	submsg_e_l[1] = submsg_o_l[1] + submsg_e_l[2];
+	submsg_e_l[2] = submsg_o_l[2] + temp;
+	temp = submsg_e_l[4];
+	submsg_e_l[4] = submsg_o_l[4] + submsg_e_l[7];
+	submsg_e_l[7] = submsg_o_l[7] + submsg_e_l[6];
+	submsg_e_l[6] = submsg_o_l[6] + submsg_e_l[5];
+	submsg_e_l[5] = submsg_o_l[5] + temp;
+	temp = submsg_e_r[0];
+	submsg_e_r[0] = submsg_o_r[0] + submsg_e_r[3];
+	submsg_e_r[3] = submsg_o_r[3] + submsg_e_r[1];
+	submsg_e_r[1] = submsg_o_r[1] + submsg_e_r[2];
+	submsg_e_r[2] = submsg_o_r[2] + temp;
+	temp = submsg_e_r[4];
+	submsg_e_r[4] = submsg_o_r[4] + submsg_e_r[7];
+	submsg_e_r[7] = submsg_o_r[7] + submsg_e_r[6];
+	submsg_e_r[6] = submsg_o_r[6] + submsg_e_r[5];
+	submsg_e_r[5] = submsg_o_r[5] + temp;
+}
+
+inline void msg_exp_odd(LSH512_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	lsh_u64 temp;
+	temp = submsg_o_l[0];
+	submsg_o_l[0] = submsg_e_l[0] + submsg_o_l[3];
+	submsg_o_l[3] = submsg_e_l[3] + submsg_o_l[1];
+	submsg_o_l[1] = submsg_e_l[1] + submsg_o_l[2];
+	submsg_o_l[2] = submsg_e_l[2] + temp;
+	temp = submsg_o_l[4];
+	submsg_o_l[4] = submsg_e_l[4] + submsg_o_l[7];
+	submsg_o_l[7] = submsg_e_l[7] + submsg_o_l[6];
+	submsg_o_l[6] = submsg_e_l[6] + submsg_o_l[5];
+	submsg_o_l[5] = submsg_e_l[5] + temp;
+	temp = submsg_o_r[0];
+	submsg_o_r[0] = submsg_e_r[0] + submsg_o_r[3];
+	submsg_o_r[3] = submsg_e_r[3] + submsg_o_r[1];
+	submsg_o_r[1] = submsg_e_r[1] + submsg_o_r[2];
+	submsg_o_r[2] = submsg_e_r[2] + temp;
+	temp = submsg_o_r[4];
+	submsg_o_r[4] = submsg_e_r[4] + submsg_o_r[7];
+	submsg_o_r[7] = submsg_e_r[7] + submsg_o_r[6];
+	submsg_o_r[6] = submsg_e_r[6] + submsg_o_r[5];
+	submsg_o_r[5] = submsg_e_r[5] + temp;
+}
+
+inline void load_sc(const lsh_u64** p_const_v, size_t i)
+{
+	*p_const_v = &LSH512_StepConstants[i];
+}
+
+inline void msg_add_even(lsh_u64 cv_l[8], lsh_u64 cv_r[8], LSH512_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+
+	cv_l[0] ^= submsg_e_l[0];  cv_l[1] ^= submsg_e_l[1];
+	cv_l[2] ^= submsg_e_l[2];  cv_l[3] ^= submsg_e_l[3];
+	cv_l[4] ^= submsg_e_l[4];  cv_l[5] ^= submsg_e_l[5];
+	cv_l[6] ^= submsg_e_l[6];  cv_l[7] ^= submsg_e_l[7];
+	cv_r[0] ^= submsg_e_r[0];  cv_r[1] ^= submsg_e_r[1];
+	cv_r[2] ^= submsg_e_r[2];  cv_r[3] ^= submsg_e_r[3];
+	cv_r[4] ^= submsg_e_r[4];  cv_r[5] ^= submsg_e_r[5];
+	cv_r[6] ^= submsg_e_r[6];  cv_r[7] ^= submsg_e_r[7];
+}
+
+inline void msg_add_odd(lsh_u64 cv_l[8], lsh_u64 cv_r[8], LSH512_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	cv_l[0] ^= submsg_o_l[0];  cv_l[1] ^= submsg_o_l[1];
+	cv_l[2] ^= submsg_o_l[2];  cv_l[3] ^= submsg_o_l[3];
+	cv_l[4] ^= submsg_o_l[4];  cv_l[5] ^= submsg_o_l[5];
+	cv_l[6] ^= submsg_o_l[6];  cv_l[7] ^= submsg_o_l[7];
+	cv_r[0] ^= submsg_o_r[0];  cv_r[1] ^= submsg_o_r[1];
+	cv_r[2] ^= submsg_o_r[2];  cv_r[3] ^= submsg_o_r[3];
+	cv_r[4] ^= submsg_o_r[4];  cv_r[5] ^= submsg_o_r[5];
+	cv_r[6] ^= submsg_o_r[6];  cv_r[7] ^= submsg_o_r[7];
+}
+
+inline void add_blk(lsh_u64 cv_l[8], lsh_u64 cv_r[8])
+{
+	cv_l[0] += cv_r[0];
+	cv_l[1] += cv_r[1];
+	cv_l[2] += cv_r[2];
+	cv_l[3] += cv_r[3];
+	cv_l[4] += cv_r[4];
+	cv_l[5] += cv_r[5];
+	cv_l[6] += cv_r[6];
+	cv_l[7] += cv_r[7];
+}
+
+template <unsigned int R>
+inline void rotate_blk(lsh_u64 cv[8])
+{
+	cv[0] = rotlConstant<R>(cv[0]);
+	cv[1] = rotlConstant<R>(cv[1]);
+	cv[2] = rotlConstant<R>(cv[2]);
+	cv[3] = rotlConstant<R>(cv[3]);
+	cv[4] = rotlConstant<R>(cv[4]);
+	cv[5] = rotlConstant<R>(cv[5]);
+	cv[6] = rotlConstant<R>(cv[6]);
+	cv[7] = rotlConstant<R>(cv[7]);
+}
+
+inline void xor_with_const(lsh_u64 cv_l[8], const lsh_u64* const_v)
+{
+	cv_l[0] ^= const_v[0];
+	cv_l[1] ^= const_v[1];
+	cv_l[2] ^= const_v[2];
+	cv_l[3] ^= const_v[3];
+	cv_l[4] ^= const_v[4];
+	cv_l[5] ^= const_v[5];
+	cv_l[6] ^= const_v[6];
+	cv_l[7] ^= const_v[7];
+}
+
+inline void rotate_msg_gamma(lsh_u64 cv_r[8])
+{
+	cv_r[1] = ROTL64(cv_r[1], g_gamma512[1]);
+	cv_r[2] = ROTL64(cv_r[2], g_gamma512[2]);
+	cv_r[3] = ROTL64(cv_r[3], g_gamma512[3]);
+	cv_r[4] = ROTL64(cv_r[4], g_gamma512[4]);
+	cv_r[5] = ROTL64(cv_r[5], g_gamma512[5]);
+	cv_r[6] = ROTL64(cv_r[6], g_gamma512[6]);
+	cv_r[7] = ROTL64(cv_r[7], g_gamma512[7]);
+}
+
+inline void word_perm(lsh_u64 cv_l[8], lsh_u64 cv_r[8])
+{
+	lsh_u64 temp;
+	temp = cv_l[0];
+	cv_l[0] = cv_l[6];
+	cv_l[6] = cv_r[6];
+	cv_r[6] = cv_r[2];
+	cv_r[2] = cv_l[1];
+	cv_l[1] = cv_l[4];
+	cv_l[4] = cv_r[4];
+	cv_r[4] = cv_r[0];
+	cv_r[0] = cv_l[2];
+	cv_l[2] = cv_l[5];
+	cv_l[5] = cv_r[7];
+	cv_r[7] = cv_r[1];
+	cv_r[1] = temp;
+	temp = cv_l[3];
+	cv_l[3] = cv_l[7];
+	cv_l[7] = cv_r[5];
+	cv_r[5] = cv_r[3];
+	cv_r[3] = temp;
+}
+
+/* -------------------------------------------------------- *
+* step function
+* -------------------------------------------------------- */
+
+template <unsigned int Alpha, unsigned int Beta>
+inline void mix(lsh_u64 cv_l[8], lsh_u64 cv_r[8], const lsh_u64 const_v[8])
+{
+	add_blk(cv_l, cv_r);
+	rotate_blk<Alpha>(cv_l);
+	xor_with_const(cv_l, const_v);
+	add_blk(cv_r, cv_l);
+	rotate_blk<Beta>(cv_r);
+	add_blk(cv_l, cv_r);
+	rotate_msg_gamma(cv_r);
+}
+
+/* -------------------------------------------------------- *
+* compression function
+* -------------------------------------------------------- */
+
+inline void compress(LSH512_Context* ctx, const lsh_u8 pdMsgBlk[LSH512_MSG_BLK_BYTE_LEN])
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	LSH512_Internal  s_state(ctx->cv_l);
+	LSH512_Internal* i_state = &s_state;
+
+	const lsh_u64* const_v = NULL;
+	lsh_u64 *cv_l = ctx->cv_l;
+	lsh_u64 *cv_r = ctx->cv_r;
+
+	load_msg_blk(i_state, pdMsgBlk);
+
+	msg_add_even(cv_l, cv_r, i_state);
+	load_sc(&const_v, 0);
+	mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	msg_add_odd(cv_l, cv_r, i_state);
+	load_sc(&const_v, 8);
+	mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	for (size_t i = 1; i < NUM_STEPS / 2; i++)
+	{
+		msg_exp_even(i_state);
+		msg_add_even(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		msg_exp_odd(i_state);
+		msg_add_odd(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	msg_exp_even(i_state);
+	msg_add_even(cv_l, cv_r, i_state);
+}
+
+/* -------------------------------------------------------- */
+
+inline void load_iv(lsh_u64 cv_l[8], lsh_u64 cv_r[8], const lsh_u64 iv[16])
+{
+	cv_l[0] = iv[0];
+	cv_l[1] = iv[1];
+	cv_l[2] = iv[2];
+	cv_l[3] = iv[3];
+	cv_l[4] = iv[4];
+	cv_l[5] = iv[5];
+	cv_l[6] = iv[6];
+	cv_l[7] = iv[7];
+	cv_r[0] = iv[8];
+	cv_r[1] = iv[9];
+	cv_r[2] = iv[10];
+	cv_r[3] = iv[11];
+	cv_r[4] = iv[12];
+	cv_r[5] = iv[13];
+	cv_r[6] = iv[14];
+	cv_r[7] = iv[15];
+}
+
+inline void zero_iv(lsh_u64 cv_l[8], lsh_u64 cv_r[8])
+{
+	std::memset(cv_l, 0, 8*sizeof(lsh_u64));
+	std::memset(cv_r, 0, 8*sizeof(lsh_u64));
+}
+
+inline void zero_submsgs(LSH512_Context* ctx)
+{
+	lsh_u64* sub_msgs = ctx->sub_msgs;
+
+	std::memset(sub_msgs, 0x00, 32*sizeof(lsh_u64));
+}
+
+inline void init224(LSH512_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV224);
+}
+
+inline void init256(LSH512_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV256);
+}
+
+inline void init384(LSH512_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV384);
+}
+
+inline void init512(LSH512_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV512);
+}
+
+/* -------------------------------------------------------- */
+
+inline void fin(LSH512_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	for (size_t i = 0; i < HASH_VAL_MAX_WORD_LEN; i++){
+		ctx->cv_l[i] = loadLE64(ctx->cv_l[i] ^ ctx->cv_r[i]);
+	}
+}
+
+/* -------------------------------------------------------- */
+
+inline void get_hash(LSH512_Context* ctx, lsh_u8* pbHashVal)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+	CRYPTOPP_ASSERT(pbHashVal != NULLPTR);
+
+	lsh_uint alg_type = ctx->alg_type;
+	lsh_uint hash_val_byte_len = LSH_GET_HASHBYTE(alg_type);
+	lsh_uint hash_val_bit_len = LSH_GET_SMALL_HASHBIT(alg_type);
+
+	// Multiplying by looks odd...
+	std::memcpy(pbHashVal, ctx->cv_l, hash_val_byte_len);
+	if (hash_val_bit_len){
+		pbHashVal[hash_val_byte_len-1] &= (((lsh_u8)0xff) << hash_val_bit_len);
+	}
+}
+
+/* -------------------------------------------------------- */
+
+lsh_err lsh512_init(LSH512_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	lsh_u32 alg_type = ctx->alg_type;
+	const lsh_u64* const_v = NULL;
+	ctx->remain_databitlen = 0;
+
+	switch (alg_type){
+	case LSH_TYPE_512_512:
+		init512(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_512_384:
+		init384(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_512_256:
+		init256(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_512_224:
+		init224(ctx);
+		return LSH_SUCCESS;
+	default:
+		break;
+	}
+
+	lsh_u64* cv_l = ctx->cv_l;
+	lsh_u64* cv_r = ctx->cv_r;
+
+	zero_iv(cv_l, cv_r);
+	cv_l[0] = LSH512_HASH_VAL_MAX_BYTE_LEN;
+	cv_l[1] = LSH_GET_HASHBIT(alg_type);
+
+	for (size_t i = 0; i < NUM_STEPS / 2; i++)
+	{
+		//Mix
+		load_sc(&const_v, i * 16);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		load_sc(&const_v, i * 16 + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh512_update(LSH512_Context* ctx, const lsh_u8* data, size_t databitlen)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(data != NULLPTR);
+	CRYPTOPP_ASSERT(databitlen % 8 == 0);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	if (databitlen == 0){
+		return LSH_SUCCESS;
+	}
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t databytelen = databitlen >> 3;
+	// lsh_uint pos2 = databitlen & 0x7;
+	const size_t pos2 = 0;
+
+	size_t remain_msg_byte = static_cast<size_t>(ctx->remain_databitlen >> 3);
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH512_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+	if (remain_msg_bit > 0){
+		return LSH_ERR_INVALID_DATABITLEN;
+	}
+
+	if (databytelen + remain_msg_byte < LSH512_MSG_BLK_BYTE_LEN){
+		std::memcpy(ctx->last_block + remain_msg_byte, data, databytelen);
+		ctx->remain_databitlen += (lsh_uint)databitlen;
+		remain_msg_byte += (lsh_uint)databytelen;
+		if (pos2){
+			ctx->last_block[remain_msg_byte] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		}
+		return LSH_SUCCESS;
+	}
+
+	if (remain_msg_byte > 0){
+		size_t more_byte = LSH512_MSG_BLK_BYTE_LEN - remain_msg_byte;
+		std::memcpy(ctx->last_block + remain_msg_byte, data, more_byte);
+		compress(ctx, ctx->last_block);
+		data += more_byte;
+		databytelen -= more_byte;
+		remain_msg_byte = 0;
+		ctx->remain_databitlen = 0;
+	}
+
+	while (databytelen >= LSH512_MSG_BLK_BYTE_LEN)
+	{
+		// This call to compress caused some trouble.
+		// The data pointer can become unaligned in the
+		// previous block.
+		compress(ctx, data);
+		data += LSH512_MSG_BLK_BYTE_LEN;
+		databytelen -= LSH512_MSG_BLK_BYTE_LEN;
+	}
+
+	if (databytelen > 0){
+		std::memcpy(ctx->last_block, data, databytelen);
+		ctx->remain_databitlen = (lsh_uint)(databytelen << 3);
+	}
+
+	if (pos2){
+		ctx->last_block[databytelen] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		ctx->remain_databitlen += pos2;
+	}
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh512_final(LSH512_Context* ctx, lsh_u8* hashval)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(hashval != NULLPTR);
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t remain_msg_byte = static_cast<size_t>(ctx->remain_databitlen >> 3);
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH512_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+
+	if (remain_msg_bit){
+		ctx->last_block[remain_msg_byte] |= (0x1 << (7 - remain_msg_bit));
+	}
+	else{
+		ctx->last_block[remain_msg_byte] = 0x80;
+	}
+	std::memset(ctx->last_block + remain_msg_byte + 1, 0, LSH512_MSG_BLK_BYTE_LEN - remain_msg_byte - 1);
+
+	compress(ctx, ctx->last_block);
+
+	fin(ctx);
+	get_hash(ctx, hashval);
+
+	return LSH_SUCCESS;
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_ENABLE_64BIT_SSE)
+# if defined(CRYPTOPP_AVX2_AVAILABLE)
+	extern void LSH512_Base_Restart_AVX2(word64* state);
+	extern void LSH512_Base_Update_AVX2(word64* state, const byte *input, size_t size);
+	extern void LSH512_Base_TruncatedFinal_AVX2(word64* state, byte *hash, size_t size);
+# endif
+# if defined(CRYPTOPP_SSSE3_AVAILABLE)
+	extern void LSH512_Base_Restart_SSSE3(word64* state);
+	extern void LSH512_Base_Update_SSSE3(word64* state, const byte *input, size_t size);
+	extern void LSH512_Base_TruncatedFinal_SSSE3(word64* state, byte *hash, size_t size);
+# endif
+#endif
+
+std::string LSH512_Base::AlgorithmProvider() const
+{
+#if defined(CRYPTOPP_ENABLE_64BIT_SSE)
+#if defined(CRYPTOPP_AVX2_AVAILABLE)
+	if (HasAVX2())
+		return "AVX2";
+	else
+#endif
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+	if (HasSSSE3())
+		return "SSSE3";
+	else
+#endif
+#endif  // CRYPTOPP_ENABLE_64BIT_SSE
+
+	return "C++";
+}
+
+void LSH512_Base_Restart_CXX(word64* state)
+{
+	state[RemainingBits] = 0;
+	LSH512_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh512_init(&ctx);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH512_Base: lsh512_init failed");
+}
+
+void LSH512_Base_Update_CXX(word64* state, const byte *input, size_t size)
+{
+	LSH512_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh512_update(&ctx, input, 8*size);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH512_Base: lsh512_update failed");
+}
+
+void LSH512_Base_TruncatedFinal_CXX(word64* state, byte *hash, size_t)
+{
+	LSH512_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh512_final(&ctx, hash);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH512_Base: lsh512_final failed");
+}
+
+
+void LSH512_Base::Restart()
+{
+#if defined(CRYPTOPP_AVX2_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasAVX2())
+		LSH512_Base_Restart_AVX2(m_state);
+	else
+#endif
+#if defined(CRYPTOPP_SSSE3_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasSSSE3())
+		LSH512_Base_Restart_SSSE3(m_state);
+	else
+#endif
+
+	LSH512_Base_Restart_CXX(m_state);
+}
+
+void LSH512_Base::Update(const byte *input, size_t size)
+{
+	CRYPTOPP_ASSERT(input != NULLPTR);
+	CRYPTOPP_ASSERT(size);
+
+#if defined(CRYPTOPP_AVX2_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasAVX2())
+		LSH512_Base_Update_AVX2(m_state, input, size);
+	else
+#endif
+#if defined(CRYPTOPP_SSSE3_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasSSSE3())
+		LSH512_Base_Update_SSSE3(m_state, input, size);
+	else
+#endif
+
+	LSH512_Base_Update_CXX(m_state, input, size);
+}
+
+void LSH512_Base::TruncatedFinal(byte *hash, size_t size)
+{
+	CRYPTOPP_ASSERT(hash != NULLPTR);
+	ThrowIfInvalidTruncatedSize(size);
+
+	// TODO: determine if LSH512 supports truncated hashes. See the code
+	// in get_hash(), where a bit-length is added to the last output
+	// byte of the hash function.
+	byte fullHash[LSH512_HASH_VAL_MAX_BYTE_LEN];
+	bool copyOut = (size < DigestSize());
+
+#if defined(CRYPTOPP_AVX2_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasAVX2())
+		LSH512_Base_TruncatedFinal_AVX2(m_state, copyOut ? fullHash : hash, size);
+	else
+#endif
+#if defined(CRYPTOPP_SSSE3_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+	if (HasSSSE3())
+		LSH512_Base_TruncatedFinal_SSSE3(m_state, copyOut ? fullHash : hash, size);
+	else
+#endif
+
+	LSH512_Base_TruncatedFinal_CXX(m_state, copyOut ? fullHash : hash, size);
+
+	if (copyOut)
+		std::memcpy(hash, fullHash, size);
+
+    Restart();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/lsh512_avx.cpp b/runtime/third_party/cryptopp/lsh512_avx.cpp
new file mode 100644
index 0000000..8f79d3f
--- /dev/null
+++ b/runtime/third_party/cryptopp/lsh512_avx.cpp
@@ -0,0 +1,762 @@
+// lsh.cpp - written and placed in the public domain by Jeffrey Walton
+//           Based on the specification and source code provided by
+//           Korea Internet & Security Agency (KISA) website. Also
+//           see https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do
+//           and https://seed.kisa.or.kr/kisa/Board/22/detailView.do.
+
+// We are hitting some sort of GCC bug in the LSH AVX2 code path.
+// Clang is OK on the AVX2 code path. We believe it is GCC Issue
+// 82735, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735. It
+// makes using zeroupper a little tricky.
+
+#include "pch.h"
+#include "config.h"
+
+#include "lsh.h"
+#include "misc.h"
+
+// Squash MS LNK4221 and libtool warnings
+extern const char LSH512_AVX_FNAME[] = __FILE__;
+
+#if defined(CRYPTOPP_AVX2_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+
+#if defined(CRYPTOPP_AVX2_AVAILABLE)
+# include <emmintrin.h>
+# include <immintrin.h>
+#endif
+
+#if defined(CRYPTOPP_GCC_COMPATIBLE)
+# include <x86intrin.h>
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+/* LSH Constants */
+
+const unsigned int LSH512_MSG_BLK_BYTE_LEN = 256;
+// const unsigned int LSH512_MSG_BLK_BIT_LEN = 2048;
+// const unsigned int LSH512_CV_BYTE_LEN = 128;
+const unsigned int LSH512_HASH_VAL_MAX_BYTE_LEN = 64;
+
+// const unsigned int MSG_BLK_WORD_LEN = 32;
+const unsigned int CV_WORD_LEN = 16;
+const unsigned int CONST_WORD_LEN = 8;
+// const unsigned int HASH_VAL_MAX_WORD_LEN = 8;
+const unsigned int NUM_STEPS = 28;
+
+const unsigned int ROT_EVEN_ALPHA = 23;
+const unsigned int ROT_EVEN_BETA = 59;
+const unsigned int ROT_ODD_ALPHA = 7;
+const unsigned int ROT_ODD_BETA = 3;
+
+const unsigned int LSH_TYPE_512_512 = 0x0010040;
+const unsigned int LSH_TYPE_512_384 = 0x0010030;
+const unsigned int LSH_TYPE_512_256 = 0x0010020;
+const unsigned int LSH_TYPE_512_224 = 0x001001C;
+
+// const unsigned int LSH_TYPE_384 = LSH_TYPE_512_384;
+// const unsigned int LSH_TYPE_512 = LSH_TYPE_512_512;
+
+/* Error Code */
+
+const unsigned int LSH_SUCCESS = 0x0;
+// const unsigned int LSH_ERR_NULL_PTR = 0x2401;
+// const unsigned int LSH_ERR_INVALID_ALGTYPE = 0x2402;
+const unsigned int LSH_ERR_INVALID_DATABITLEN = 0x2403;
+const unsigned int LSH_ERR_INVALID_STATE = 0x2404;
+
+/* Index into our state array */
+
+const unsigned int AlgorithmType = 80;
+const unsigned int RemainingBits = 81;
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(LSH)
+
+// lsh512.cpp
+extern const word64 LSH512_IV224[CV_WORD_LEN];
+extern const word64 LSH512_IV256[CV_WORD_LEN];
+extern const word64 LSH512_IV384[CV_WORD_LEN];
+extern const word64 LSH512_IV512[CV_WORD_LEN];
+extern const word64 LSH512_StepConstants[CONST_WORD_LEN * NUM_STEPS];
+
+NAMESPACE_END  // LSH
+NAMESPACE_END  // Crypto++
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::rotlFixed;
+using CryptoPP::rotlConstant;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+using CryptoPP::ConditionalByteReverse;
+using CryptoPP::LITTLE_ENDIAN_ORDER;
+
+using CryptoPP::LSH::LSH512_IV224;
+using CryptoPP::LSH::LSH512_IV256;
+using CryptoPP::LSH::LSH512_IV384;
+using CryptoPP::LSH::LSH512_IV512;
+using CryptoPP::LSH::LSH512_StepConstants;
+
+typedef byte lsh_u8;
+typedef word32 lsh_u32;
+typedef word64 lsh_u64;
+typedef word32 lsh_uint;
+typedef word32 lsh_err;
+typedef word32 lsh_type;
+
+struct LSH512_AVX2_Context
+{
+	LSH512_AVX2_Context(word64* state, word64 algType, word64& remainingBitLength) :
+		cv_l(state+0), cv_r(state+8), sub_msgs(state+16),
+		last_block(reinterpret_cast<byte*>(state+48)),
+		remain_databitlen(remainingBitLength),
+		alg_type(static_cast<lsh_type>(algType)) {}
+
+	lsh_u64* cv_l;  // start of our state block
+	lsh_u64* cv_r;
+	lsh_u64* sub_msgs;
+	lsh_u8*  last_block;
+	lsh_u64& remain_databitlen;
+	lsh_type alg_type;
+};
+
+struct LSH512_AVX2_Internal
+{
+	LSH512_AVX2_Internal(word64* state) :
+		submsg_e_l(state+16), submsg_e_r(state+24),
+		submsg_o_l(state+32), submsg_o_r(state+40) { }
+
+	lsh_u64* submsg_e_l; /* even left sub-message  */
+	lsh_u64* submsg_e_r; /* even right sub-message */
+	lsh_u64* submsg_o_l; /* odd left sub-message   */
+	lsh_u64* submsg_o_r; /* odd right sub-message  */
+};
+
+// Zero the upper 128 bits of all YMM registers on exit.
+// It avoids AVX state transition penalties when saving state.
+// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735
+// makes using zeroupper a little tricky.
+
+struct AVX_Cleanup
+{
+	~AVX_Cleanup() {
+		_mm256_zeroupper();
+	}
+};
+
+// const lsh_u32 g_gamma512[8] = { 0, 16, 32, 48, 8, 24, 40, 56 };
+
+/* LSH AlgType Macro */
+
+inline bool LSH_IS_LSH512(lsh_uint val) {
+	return (val & 0xf0000) == 0x10000;
+}
+
+inline lsh_uint LSH_GET_SMALL_HASHBIT(lsh_uint val) {
+	return val >> 24;
+}
+
+inline lsh_uint LSH_GET_HASHBYTE(lsh_uint val) {
+	return val & 0xffff;
+}
+
+inline lsh_uint LSH_GET_HASHBIT(lsh_uint val) {
+	return (LSH_GET_HASHBYTE(val) << 3) - LSH_GET_SMALL_HASHBIT(val);
+}
+
+inline lsh_u64 loadLE64(lsh_u64 v) {
+	return ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v);
+}
+
+lsh_u64 ROTL64(lsh_u64 x, lsh_u32 r) {
+	return rotlFixed(x, r);
+}
+
+// Original code relied upon unaligned lsh_u64 buffer
+inline void load_msg_blk(LSH512_AVX2_Internal* i_state, const lsh_u8 msgblk[LSH512_MSG_BLK_BYTE_LEN])
+{
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	_mm256_storeu_si256(M256_CAST(submsg_e_l+0),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+0)));
+	_mm256_storeu_si256(M256_CAST(submsg_e_l+4),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+32)));
+
+	_mm256_storeu_si256(M256_CAST(submsg_e_r+0),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+64)));
+	_mm256_storeu_si256(M256_CAST(submsg_e_r+4),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+96)));
+
+	_mm256_storeu_si256(M256_CAST(submsg_o_l+0),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+128)));
+	_mm256_storeu_si256(M256_CAST(submsg_o_l+4),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+160)));
+
+	_mm256_storeu_si256(M256_CAST(submsg_o_r+0),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+192)));
+	_mm256_storeu_si256(M256_CAST(submsg_o_r+4),
+		_mm256_loadu_si256(CONST_M256_CAST(msgblk+224)));
+}
+
+inline void msg_exp_even(LSH512_AVX2_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	_mm256_storeu_si256(M256_CAST(submsg_e_l+0), _mm256_add_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_l+0)),
+		_mm256_permute4x64_epi64(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_l+0)),
+			_MM_SHUFFLE(1,0,2,3))));
+	_mm256_storeu_si256(M256_CAST(submsg_e_l+4), _mm256_add_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_l+4)),
+		_mm256_permute4x64_epi64(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_l+4)),
+			_MM_SHUFFLE(2,1,0,3))));
+
+	_mm256_storeu_si256(M256_CAST(submsg_e_r+0), _mm256_add_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_r+0)),
+		_mm256_permute4x64_epi64(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_r+0)),
+			_MM_SHUFFLE(1,0,2,3))));
+	_mm256_storeu_si256(M256_CAST(submsg_e_r+4), _mm256_add_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_r+4)),
+		_mm256_permute4x64_epi64(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_r+4)),
+			_MM_SHUFFLE(2,1,0,3))));
+}
+
+inline void msg_exp_odd(LSH512_AVX2_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	_mm256_storeu_si256(M256_CAST(submsg_o_l+0),
+		_mm256_add_epi64(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_l+0)),
+			_mm256_permute4x64_epi64(
+				_mm256_loadu_si256(CONST_M256_CAST(submsg_o_l+0)),
+				_MM_SHUFFLE(1,0,2,3))));
+	_mm256_storeu_si256(M256_CAST(submsg_o_l+4),
+		_mm256_add_epi64(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_l+4)),
+			_mm256_permute4x64_epi64(
+				_mm256_loadu_si256(CONST_M256_CAST(submsg_o_l+4)),
+				_MM_SHUFFLE(2,1,0,3))));
+
+	_mm256_storeu_si256(M256_CAST(submsg_o_r+0),
+		_mm256_add_epi64(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_r+0)),
+			_mm256_permute4x64_epi64(
+				_mm256_loadu_si256(CONST_M256_CAST(submsg_o_r+0)),
+				_MM_SHUFFLE(1,0,2,3))));
+	_mm256_storeu_si256(M256_CAST(submsg_o_r+4),
+		_mm256_add_epi64(
+			_mm256_loadu_si256(CONST_M256_CAST(submsg_e_r+4)),
+			_mm256_permute4x64_epi64(
+				_mm256_loadu_si256(CONST_M256_CAST(submsg_o_r+4)),
+				_MM_SHUFFLE(2,1,0,3))));
+}
+
+inline void load_sc(const lsh_u64** p_const_v, size_t i)
+{
+	*p_const_v = &LSH512_StepConstants[i];
+}
+
+inline void msg_add_even(lsh_u64 cv_l[8], lsh_u64 cv_r[8], LSH512_AVX2_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+
+	_mm256_storeu_si256(M256_CAST(cv_l), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_e_l))));
+	_mm256_storeu_si256(M256_CAST(cv_r), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_e_r))));
+
+	_mm256_storeu_si256(M256_CAST(cv_l+4), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l+4)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_e_l+4))));
+	_mm256_storeu_si256(M256_CAST(cv_r+4), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r+4)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_e_r+4))));
+}
+
+inline void msg_add_odd(lsh_u64 cv_l[8], lsh_u64 cv_r[8], LSH512_AVX2_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	_mm256_storeu_si256(M256_CAST(cv_l), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_l))));
+	_mm256_storeu_si256(M256_CAST(cv_r), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_r))));
+
+	_mm256_storeu_si256(M256_CAST(cv_l+4), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l+4)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_l+4))));
+	_mm256_storeu_si256(M256_CAST(cv_r+4), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r+4)),
+		_mm256_loadu_si256(CONST_M256_CAST(submsg_o_r+4))));
+}
+
+inline void add_blk(lsh_u64 cv_l[8], lsh_u64 cv_r[8])
+{
+	_mm256_storeu_si256(M256_CAST(cv_l), _mm256_add_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l)),
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r))));
+	_mm256_storeu_si256(M256_CAST(cv_l+4), _mm256_add_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l+4)),
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r+4))));
+}
+
+template <unsigned int R>
+inline void rotate_blk(lsh_u64 cv[8])
+{
+	_mm256_storeu_si256(M256_CAST(cv), _mm256_or_si256(
+		_mm256_slli_epi64(_mm256_loadu_si256(CONST_M256_CAST(cv)), R),
+		_mm256_srli_epi64(_mm256_loadu_si256(CONST_M256_CAST(cv)), 64-R)));
+	_mm256_storeu_si256(M256_CAST(cv+4), _mm256_or_si256(
+		_mm256_slli_epi64(_mm256_loadu_si256(CONST_M256_CAST(cv+4)), R),
+		_mm256_srli_epi64(_mm256_loadu_si256(CONST_M256_CAST(cv+4)), 64-R)));
+}
+
+inline void xor_with_const(lsh_u64 cv_l[8], const lsh_u64 const_v[8])
+{
+	_mm256_storeu_si256(M256_CAST(cv_l), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l)),
+		_mm256_loadu_si256(CONST_M256_CAST(const_v))));
+	_mm256_storeu_si256(M256_CAST(cv_l+4), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l+4)),
+		_mm256_loadu_si256(CONST_M256_CAST(const_v+4))));
+}
+
+inline void rotate_msg_gamma(lsh_u64 cv_r[8])
+{
+	// g_gamma512[8] = { 0, 16, 32, 48, 8, 24, 40, 56 };
+	_mm256_storeu_si256(M256_CAST(cv_r+0),
+		_mm256_shuffle_epi8(
+			_mm256_loadu_si256(CONST_M256_CAST(cv_r+0)),
+			_mm256_set_epi8(
+				/* hi lane */ 9,8,15,14, 13,12,11,10, 3,2,1,0, 7,6,5,4,
+				/* lo lane */ 13,12,11,10, 9,8,15,14, 7,6,5,4, 3,2,1,0)));
+	_mm256_storeu_si256(M256_CAST(cv_r+4),
+		_mm256_shuffle_epi8(
+			_mm256_loadu_si256(CONST_M256_CAST(cv_r+4)),
+			_mm256_set_epi8(
+				/* hi lane */ 8,15,14,13, 12,11,10,9, 2,1,0,7, 6,5,4,3,
+				/* lo lane */ 12,11,10,9, 8,15,14,13, 6,5,4,3, 2,1,0,7)));
+}
+
+inline void word_perm(lsh_u64 cv_l[8], lsh_u64 cv_r[8])
+{
+	__m256i temp[2];
+	_mm256_storeu_si256(M256_CAST(cv_l+0), _mm256_permute4x64_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l+0)), _MM_SHUFFLE(3,1,0,2)));
+	_mm256_storeu_si256(M256_CAST(cv_l+4), _mm256_permute4x64_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l+4)), _MM_SHUFFLE(3,1,0,2)));
+	_mm256_storeu_si256(M256_CAST(cv_r+0), _mm256_permute4x64_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r+0)), _MM_SHUFFLE(1,2,3,0)));
+	_mm256_storeu_si256(M256_CAST(cv_r+4), _mm256_permute4x64_epi64(
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r+4)), _MM_SHUFFLE(1,2,3,0)));
+
+	temp[0] = _mm256_loadu_si256(CONST_M256_CAST(cv_l+0));
+	temp[1] = _mm256_loadu_si256(CONST_M256_CAST(cv_r+0));
+
+	_mm256_storeu_si256(M256_CAST(cv_l+0),
+		_mm256_loadu_si256(CONST_M256_CAST(cv_l+4)));
+	_mm256_storeu_si256(M256_CAST(cv_l+4),
+		_mm256_loadu_si256(CONST_M256_CAST(cv_r+4)));
+
+	_mm256_storeu_si256(M256_CAST(cv_r+0), temp[0]);
+	_mm256_storeu_si256(M256_CAST(cv_r+4), temp[1]);
+}
+
+/* -------------------------------------------------------- *
+* step function
+* -------------------------------------------------------- */
+
+template <unsigned int Alpha, unsigned int Beta>
+inline void mix(lsh_u64 cv_l[8], lsh_u64 cv_r[8], const lsh_u64 const_v[8])
+{
+	add_blk(cv_l, cv_r);
+	rotate_blk<Alpha>(cv_l);
+	xor_with_const(cv_l, const_v);
+	add_blk(cv_r, cv_l);
+	rotate_blk<Beta>(cv_r);
+	add_blk(cv_l, cv_r);
+	rotate_msg_gamma(cv_r);
+}
+
+/* -------------------------------------------------------- *
+* compression function
+* -------------------------------------------------------- */
+
+inline void compress(LSH512_AVX2_Context* ctx, const lsh_u8 pdMsgBlk[LSH512_MSG_BLK_BYTE_LEN])
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	LSH512_AVX2_Internal  s_state(ctx->cv_l);
+	LSH512_AVX2_Internal* i_state = &s_state;
+
+	const lsh_u64* const_v = NULL;
+	lsh_u64 *cv_l = ctx->cv_l;
+	lsh_u64 *cv_r = ctx->cv_r;
+
+	load_msg_blk(i_state, pdMsgBlk);
+
+	msg_add_even(cv_l, cv_r, i_state);
+	load_sc(&const_v, 0);
+	mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	msg_add_odd(cv_l, cv_r, i_state);
+	load_sc(&const_v, 8);
+	mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	for (size_t i = 1; i < NUM_STEPS / 2; i++)
+	{
+		msg_exp_even(i_state);
+		msg_add_even(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		msg_exp_odd(i_state);
+		msg_add_odd(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	msg_exp_even(i_state);
+	msg_add_even(cv_l, cv_r, i_state);
+}
+
+/* -------------------------------------------------------- */
+
+inline void load_iv(word64 cv_l[8], word64 cv_r[8], const word64 iv[16])
+{
+	// The IV's are 32-byte aligned so we can use aligned loads.
+	_mm256_storeu_si256(M256_CAST(cv_l+0),
+		_mm256_load_si256(CONST_M256_CAST(iv+0)));
+	_mm256_storeu_si256(M256_CAST(cv_l+4),
+		_mm256_load_si256(CONST_M256_CAST(iv+4)));
+
+	_mm256_storeu_si256(M256_CAST(cv_r+0),
+		_mm256_load_si256(CONST_M256_CAST(iv+8)));
+	_mm256_storeu_si256(M256_CAST(cv_r+4),
+		_mm256_load_si256(CONST_M256_CAST(iv+12)));
+}
+
+inline void zero_iv(lsh_u64 cv_l[8], lsh_u64 cv_r[8])
+{
+	_mm256_storeu_si256(M256_CAST(cv_l+0), _mm256_setzero_si256());
+	_mm256_storeu_si256(M256_CAST(cv_l+4), _mm256_setzero_si256());
+	_mm256_storeu_si256(M256_CAST(cv_r+0), _mm256_setzero_si256());
+	_mm256_storeu_si256(M256_CAST(cv_r+4), _mm256_setzero_si256());
+}
+
+inline void zero_submsgs(LSH512_AVX2_Context* ctx)
+{
+	lsh_u64* sub_msgs = ctx->sub_msgs;
+
+	_mm256_storeu_si256(M256_CAST(sub_msgs+ 0),
+		_mm256_setzero_si256());
+	_mm256_storeu_si256(M256_CAST(sub_msgs+ 4),
+		_mm256_setzero_si256());
+
+	_mm256_storeu_si256(M256_CAST(sub_msgs+ 8),
+		_mm256_setzero_si256());
+	_mm256_storeu_si256(M256_CAST(sub_msgs+12),
+		_mm256_setzero_si256());
+}
+
+inline void init224(LSH512_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV224);
+}
+
+inline void init256(LSH512_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV256);
+}
+
+inline void init384(LSH512_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV384);
+}
+
+inline void init512(LSH512_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV512);
+}
+
+/* -------------------------------------------------------- */
+
+inline void fin(LSH512_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	_mm256_storeu_si256(M256_CAST(ctx->cv_l+0), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(ctx->cv_l+0)),
+		_mm256_loadu_si256(CONST_M256_CAST(ctx->cv_r+0))));
+
+	_mm256_storeu_si256(M256_CAST(ctx->cv_l+4), _mm256_xor_si256(
+		_mm256_loadu_si256(CONST_M256_CAST(ctx->cv_l+4)),
+		_mm256_loadu_si256(CONST_M256_CAST(ctx->cv_r+4))));
+}
+
+/* -------------------------------------------------------- */
+
+inline void get_hash(LSH512_AVX2_Context* ctx, lsh_u8* pbHashVal)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+	CRYPTOPP_ASSERT(pbHashVal != NULLPTR);
+
+	lsh_uint alg_type = ctx->alg_type;
+	lsh_uint hash_val_byte_len = LSH_GET_HASHBYTE(alg_type);
+	lsh_uint hash_val_bit_len = LSH_GET_SMALL_HASHBIT(alg_type);
+
+	// Multiplying by sizeof(lsh_u8) looks odd...
+	std::memcpy(pbHashVal, ctx->cv_l, hash_val_byte_len);
+	if (hash_val_bit_len){
+		pbHashVal[hash_val_byte_len-1] &= (((lsh_u8)0xff) << hash_val_bit_len);
+	}
+}
+
+/* -------------------------------------------------------- */
+
+lsh_err lsh512_init_avx2(LSH512_AVX2_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	lsh_u32 alg_type = ctx->alg_type;
+	const lsh_u64* const_v = NULL;
+	ctx->remain_databitlen = 0;
+
+	// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735.
+	AVX_Cleanup cleanup;
+
+	switch (alg_type){
+	case LSH_TYPE_512_512:
+		init512(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_512_384:
+		init384(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_512_256:
+		init256(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_512_224:
+		init224(ctx);
+		return LSH_SUCCESS;
+	default:
+		break;
+	}
+
+	lsh_u64* cv_l = ctx->cv_l;
+	lsh_u64* cv_r = ctx->cv_r;
+
+	zero_iv(cv_l, cv_r);
+	cv_l[0] = LSH512_HASH_VAL_MAX_BYTE_LEN;
+	cv_l[1] = LSH_GET_HASHBIT(alg_type);
+
+	for (size_t i = 0; i < NUM_STEPS / 2; i++)
+	{
+		//Mix
+		load_sc(&const_v, i * 16);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		load_sc(&const_v, i * 16 + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh512_update_avx2(LSH512_AVX2_Context* ctx, const lsh_u8* data, size_t databitlen)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(data != NULLPTR);
+	CRYPTOPP_ASSERT(databitlen % 8 == 0);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735.
+	AVX_Cleanup cleanup;
+
+	if (databitlen == 0){
+		return LSH_SUCCESS;
+	}
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t databytelen = databitlen >> 3;
+	// lsh_uint pos2 = databitlen & 0x7;
+	const size_t pos2 = 0;
+
+	size_t remain_msg_byte = static_cast<size_t>(ctx->remain_databitlen >> 3);
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH512_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+	if (remain_msg_bit > 0){
+		return LSH_ERR_INVALID_DATABITLEN;
+	}
+
+	if (databytelen + remain_msg_byte < LSH512_MSG_BLK_BYTE_LEN){
+		std::memcpy(ctx->last_block + remain_msg_byte, data, databytelen);
+		ctx->remain_databitlen += (lsh_uint)databitlen;
+		remain_msg_byte += (lsh_uint)databytelen;
+		if (pos2){
+			ctx->last_block[remain_msg_byte] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		}
+		return LSH_SUCCESS;
+	}
+
+	if (remain_msg_byte > 0){
+		size_t more_byte = LSH512_MSG_BLK_BYTE_LEN - remain_msg_byte;
+		std::memcpy(ctx->last_block + remain_msg_byte, data, more_byte);
+		compress(ctx, ctx->last_block);
+		data += more_byte;
+		databytelen -= more_byte;
+		remain_msg_byte = 0;
+		ctx->remain_databitlen = 0;
+	}
+
+	while (databytelen >= LSH512_MSG_BLK_BYTE_LEN)
+	{
+		// This call to compress caused some trouble.
+		// The data pointer can become unaligned in the
+		// previous block.
+		compress(ctx, data);
+		data += LSH512_MSG_BLK_BYTE_LEN;
+		databytelen -= LSH512_MSG_BLK_BYTE_LEN;
+	}
+
+	if (databytelen > 0){
+		std::memcpy(ctx->last_block, data, databytelen);
+		ctx->remain_databitlen = (lsh_uint)(databytelen << 3);
+	}
+
+	if (pos2){
+		ctx->last_block[databytelen] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		ctx->remain_databitlen += pos2;
+	}
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh512_final_avx2(LSH512_AVX2_Context* ctx, lsh_u8* hashval)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(hashval != NULLPTR);
+
+	// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735.
+	AVX_Cleanup cleanup;
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t remain_msg_byte = static_cast<size_t>(ctx->remain_databitlen >> 3);
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH512_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+
+	if (remain_msg_bit){
+		ctx->last_block[remain_msg_byte] |= (0x1 << (7 - remain_msg_bit));
+	}
+	else{
+		ctx->last_block[remain_msg_byte] = 0x80;
+	}
+	std::memset(ctx->last_block + remain_msg_byte + 1, 0, LSH512_MSG_BLK_BYTE_LEN - remain_msg_byte - 1);
+
+	compress(ctx, ctx->last_block);
+
+	fin(ctx);
+	get_hash(ctx, hashval);
+
+	return LSH_SUCCESS;
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+extern
+void LSH512_Base_Restart_AVX2(word64* state)
+{
+	state[RemainingBits] = 0;
+	LSH512_AVX2_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh512_init_avx2(&ctx);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH512_Base: lsh512_init_avx2 failed");
+}
+
+extern
+void LSH512_Base_Update_AVX2(word64* state, const byte *input, size_t size)
+{
+	LSH512_AVX2_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh512_update_avx2(&ctx, input, 8*size);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH512_Base: lsh512_update_avx2 failed");
+}
+
+extern
+void LSH512_Base_TruncatedFinal_AVX2(word64* state, byte *hash, size_t)
+{
+	LSH512_AVX2_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh512_final_avx2(&ctx, hash);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH512_Base: lsh512_final_avx2 failed");
+}
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_AVX2_AVAILABLE
diff --git a/runtime/third_party/cryptopp/lsh512_sse.cpp b/runtime/third_party/cryptopp/lsh512_sse.cpp
new file mode 100644
index 0000000..0c21b2d
--- /dev/null
+++ b/runtime/third_party/cryptopp/lsh512_sse.cpp
@@ -0,0 +1,940 @@
+// lsh.cpp - written and placed in the public domain by Jeffrey Walton
+//           Based on the specification and source code provided by
+//           Korea Internet & Security Agency (KISA) website. Also
+//           see https://seed.kisa.or.kr/kisa/algorithm/EgovLSHInfo.do
+//           and https://seed.kisa.or.kr/kisa/Board/22/detailView.do.
+
+// We are hitting some sort of GCC bug in the LSH AVX2 code path.
+// Clang is OK on the AVX2 code path. We believe it is GCC Issue
+// 82735, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82735. It
+// makes using zeroupper a little tricky.
+
+#include "pch.h"
+#include "config.h"
+
+#include "lsh.h"
+#include "misc.h"
+
+// Squash MS LNK4221 and libtool warnings
+extern const char LSH512_SSE_FNAME[] = __FILE__;
+
+#if defined(CRYPTOPP_SSSE3_AVAILABLE) && defined(CRYPTOPP_ENABLE_64BIT_SSE)
+
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+# include <emmintrin.h>
+# include <tmmintrin.h>
+#endif
+
+#if defined(CRYPTOPP_XOP_AVAILABLE)
+# include <ammintrin.h>
+#endif
+
+#if defined(CRYPTOPP_GCC_COMPATIBLE)
+# include <x86intrin.h>
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+/* LSH Constants */
+
+const unsigned int LSH512_MSG_BLK_BYTE_LEN = 256;
+// const unsigned int LSH512_MSG_BLK_BIT_LEN = 2048;
+// const unsigned int LSH512_CV_BYTE_LEN = 128;
+const unsigned int LSH512_HASH_VAL_MAX_BYTE_LEN = 64;
+
+// const unsigned int MSG_BLK_WORD_LEN = 32;
+const unsigned int CV_WORD_LEN = 16;
+const unsigned int CONST_WORD_LEN = 8;
+// const unsigned int HASH_VAL_MAX_WORD_LEN = 8;
+const unsigned int NUM_STEPS = 28;
+
+const unsigned int ROT_EVEN_ALPHA = 23;
+const unsigned int ROT_EVEN_BETA = 59;
+const unsigned int ROT_ODD_ALPHA = 7;
+const unsigned int ROT_ODD_BETA = 3;
+
+const unsigned int LSH_TYPE_512_512 = 0x0010040;
+const unsigned int LSH_TYPE_512_384 = 0x0010030;
+const unsigned int LSH_TYPE_512_256 = 0x0010020;
+const unsigned int LSH_TYPE_512_224 = 0x001001C;
+
+// const unsigned int LSH_TYPE_384 = LSH_TYPE_512_384;
+// const unsigned int LSH_TYPE_512 = LSH_TYPE_512_512;
+
+/* Error Code */
+
+const unsigned int LSH_SUCCESS = 0x0;
+// const unsigned int LSH_ERR_NULL_PTR = 0x2401;
+// const unsigned int LSH_ERR_INVALID_ALGTYPE = 0x2402;
+const unsigned int LSH_ERR_INVALID_DATABITLEN = 0x2403;
+const unsigned int LSH_ERR_INVALID_STATE = 0x2404;
+
+/* Index into our state array */
+
+const unsigned int AlgorithmType = 80;
+const unsigned int RemainingBits = 81;
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(LSH)
+
+// lsh512.cpp
+extern const word64 LSH512_IV224[CV_WORD_LEN];
+extern const word64 LSH512_IV256[CV_WORD_LEN];
+extern const word64 LSH512_IV384[CV_WORD_LEN];
+extern const word64 LSH512_IV512[CV_WORD_LEN];
+extern const word64 LSH512_StepConstants[CONST_WORD_LEN * NUM_STEPS];
+
+NAMESPACE_END  // LSH
+NAMESPACE_END  // Crypto++
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::rotlFixed;
+using CryptoPP::rotlConstant;
+
+using CryptoPP::GetBlock;
+using CryptoPP::LittleEndian;
+using CryptoPP::ConditionalByteReverse;
+using CryptoPP::LITTLE_ENDIAN_ORDER;
+
+using CryptoPP::LSH::LSH512_IV224;
+using CryptoPP::LSH::LSH512_IV256;
+using CryptoPP::LSH::LSH512_IV384;
+using CryptoPP::LSH::LSH512_IV512;
+using CryptoPP::LSH::LSH512_StepConstants;
+
+typedef byte lsh_u8;
+typedef word32 lsh_u32;
+typedef word64 lsh_u64;
+typedef word32 lsh_uint;
+typedef word32 lsh_err;
+typedef word32 lsh_type;
+
+struct LSH512_SSSE3_Context
+{
+	LSH512_SSSE3_Context(word64* state, word64 algType, word64& remainingBitLength) :
+		cv_l(state+0), cv_r(state+8), sub_msgs(state+16),
+		last_block(reinterpret_cast<byte*>(state+48)),
+		remain_databitlen(remainingBitLength),
+		alg_type(static_cast<lsh_type>(algType)) {}
+
+	lsh_u64* cv_l;  // start of our state block
+	lsh_u64* cv_r;
+	lsh_u64* sub_msgs;
+	lsh_u8*  last_block;
+	lsh_u64& remain_databitlen;
+	lsh_type alg_type;
+};
+
+struct LSH512_SSSE3_Internal
+{
+	LSH512_SSSE3_Internal(word64* state) :
+		submsg_e_l(state+16), submsg_e_r(state+24),
+		submsg_o_l(state+32), submsg_o_r(state+40) { }
+
+	lsh_u64* submsg_e_l; /* even left sub-message  */
+	lsh_u64* submsg_e_r; /* even right sub-message */
+	lsh_u64* submsg_o_l; /* odd left sub-message   */
+	lsh_u64* submsg_o_r; /* odd right sub-message  */
+};
+
+// const lsh_u32 g_gamma512[8] = { 0, 16, 32, 48, 8, 24, 40, 56 };
+
+/* LSH AlgType Macro */
+
+inline bool LSH_IS_LSH512(lsh_uint val) {
+	return (val & 0xf0000) == 0x10000;
+}
+
+inline lsh_uint LSH_GET_SMALL_HASHBIT(lsh_uint val) {
+	return val >> 24;
+}
+
+inline lsh_uint LSH_GET_HASHBYTE(lsh_uint val) {
+	return val & 0xffff;
+}
+
+inline lsh_uint LSH_GET_HASHBIT(lsh_uint val) {
+	return (LSH_GET_HASHBYTE(val) << 3) - LSH_GET_SMALL_HASHBIT(val);
+}
+
+inline lsh_u64 loadLE64(lsh_u64 v) {
+	return ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v);
+}
+
+lsh_u64 ROTL64(lsh_u64 x, lsh_u32 r) {
+	return rotlFixed(x, r);
+}
+
+// Original code relied upon unaligned lsh_u64 buffer
+inline void load_msg_blk(LSH512_SSSE3_Internal* i_state, const lsh_u8 msgblk[LSH512_MSG_BLK_BYTE_LEN])
+{
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	_mm_storeu_si128(M128_CAST(submsg_e_l+0),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+0)));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+2),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+16)));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+4),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+32)));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+6),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+48)));
+
+	_mm_storeu_si128(M128_CAST(submsg_e_r+0),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+64)));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+2),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+80)));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+4),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+96)));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+6),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+112)));
+
+	_mm_storeu_si128(M128_CAST(submsg_o_l+0),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+128)));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+2),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+144)));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+4),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+160)));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+6),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+176)));
+
+	_mm_storeu_si128(M128_CAST(submsg_o_r+0),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+192)));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+2),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+208)));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+4),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+224)));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+6),
+		_mm_loadu_si128(CONST_M128_CAST(msgblk+240)));
+}
+
+inline void msg_exp_even(LSH512_SSSE3_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	__m128i temp;
+	_mm_storeu_si128(M128_CAST(submsg_e_l+2), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+2)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp = _mm_loadu_si128(CONST_M128_CAST(submsg_e_l+0));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+0),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+2)));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+2), temp);
+	_mm_storeu_si128(M128_CAST(submsg_e_l+6), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+6)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp = _mm_loadu_si128(CONST_M128_CAST(submsg_e_l+4));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+4), _mm_unpacklo_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+4))));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+6), _mm_unpackhi_epi64(
+		temp, _mm_loadu_si128(CONST_M128_CAST(submsg_e_l+6))));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+2), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+2)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp = _mm_loadu_si128(CONST_M128_CAST(submsg_e_r+0));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+0),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+2)));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+2), temp);
+	_mm_storeu_si128(M128_CAST(submsg_e_r+6), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+6)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp = _mm_loadu_si128(CONST_M128_CAST(submsg_e_r+4));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+4), _mm_unpacklo_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+4))));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+6), _mm_unpackhi_epi64(
+		temp, _mm_loadu_si128(CONST_M128_CAST(submsg_e_r+6))));
+
+	_mm_storeu_si128(M128_CAST(submsg_e_l+0), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+0)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+0))));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+2), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+2)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+2))));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+4), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+4))));
+	_mm_storeu_si128(M128_CAST(submsg_e_l+6), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+6))));
+
+	_mm_storeu_si128(M128_CAST(submsg_e_r+0), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+0)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+0))));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+2), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+2)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+2))));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+4), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+4))));
+	_mm_storeu_si128(M128_CAST(submsg_e_r+6), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+6))));
+}
+
+inline void msg_exp_odd(LSH512_SSSE3_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	__m128i temp;
+	_mm_storeu_si128(M128_CAST(submsg_o_l+2), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+2)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp = _mm_loadu_si128(CONST_M128_CAST(submsg_o_l+0));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+0),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+2)));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+2), temp);
+	_mm_storeu_si128(M128_CAST(submsg_o_l+6), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+6)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp = _mm_loadu_si128(CONST_M128_CAST(submsg_o_l+4));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+4), _mm_unpacklo_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+4))));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+6), _mm_unpackhi_epi64(
+		temp, _mm_loadu_si128(CONST_M128_CAST(submsg_o_l+6))));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+2), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+2)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp = _mm_loadu_si128(CONST_M128_CAST(submsg_o_r+0));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+0),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+2)));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+2), temp);
+	_mm_storeu_si128(M128_CAST(submsg_o_r+6), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+6)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp = _mm_loadu_si128(CONST_M128_CAST(submsg_o_r+4));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+4), _mm_unpacklo_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+4))));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+6), _mm_unpackhi_epi64(
+		temp, _mm_loadu_si128(CONST_M128_CAST(submsg_o_r+6))));
+
+	_mm_storeu_si128(M128_CAST(submsg_o_l+0), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+0)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+0))));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+2), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+2)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+2))));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+4), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+4))));
+	_mm_storeu_si128(M128_CAST(submsg_o_l+6), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+6))));
+
+	_mm_storeu_si128(M128_CAST(submsg_o_r+0), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+0)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+0))));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+2), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+2)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+2))));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+4), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+4))));
+	_mm_storeu_si128(M128_CAST(submsg_o_r+6), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+6))));
+}
+
+inline void load_sc(const lsh_u64** p_const_v, size_t i)
+{
+	*p_const_v = &LSH512_StepConstants[i];
+}
+
+inline void msg_add_even(lsh_u64 cv_l[8], lsh_u64 cv_r[8], LSH512_SSSE3_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_e_l = i_state->submsg_e_l;
+	lsh_u64* submsg_e_r = i_state->submsg_e_r;
+
+	_mm_storeu_si128(M128_CAST(cv_l), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l))));
+	_mm_storeu_si128(M128_CAST(cv_r), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r))));
+	_mm_storeu_si128(M128_CAST(cv_l+2), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+2)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+2))));
+	_mm_storeu_si128(M128_CAST(cv_r+2), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+2)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+2))));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+4))));
+	_mm_storeu_si128(M128_CAST(cv_r+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+4))));
+	_mm_storeu_si128(M128_CAST(cv_l+6), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_l+6))));
+	_mm_storeu_si128(M128_CAST(cv_r+6), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_e_r+6))));
+}
+
+inline void msg_add_odd(lsh_u64 cv_l[8], lsh_u64 cv_r[8], LSH512_SSSE3_Internal* i_state)
+{
+	CRYPTOPP_ASSERT(i_state != NULLPTR);
+
+	lsh_u64* submsg_o_l = i_state->submsg_o_l;
+	lsh_u64* submsg_o_r = i_state->submsg_o_r;
+
+	_mm_storeu_si128(M128_CAST(cv_l), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l))));
+	_mm_storeu_si128(M128_CAST(cv_r), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r))));
+	_mm_storeu_si128(M128_CAST(cv_l+2), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+2)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+2))));
+	_mm_storeu_si128(M128_CAST(cv_r+2), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+2)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+2))));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+4))));
+	_mm_storeu_si128(M128_CAST(cv_r+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+4))));
+	_mm_storeu_si128(M128_CAST(cv_l+6), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_l+6))));
+	_mm_storeu_si128(M128_CAST(cv_r+6), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+6)),
+		_mm_loadu_si128(CONST_M128_CAST(submsg_o_r+6))));
+}
+
+inline void add_blk(lsh_u64 cv_l[8], lsh_u64 cv_r[8])
+{
+	_mm_storeu_si128(M128_CAST(cv_l), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r))));
+	_mm_storeu_si128(M128_CAST(cv_l+2), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+2)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+2))));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4))));
+	_mm_storeu_si128(M128_CAST(cv_l+6), _mm_add_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+6))));
+}
+
+template <unsigned int R>
+inline void rotate_blk(lsh_u64 cv[8])
+{
+#if defined(CRYPTOPP_XOP_AVAILABLE)
+	_mm_storeu_si128(M128_CAST(cv),
+		_mm_roti_epi64(_mm_loadu_si128(CONST_M128_CAST(cv)), R));
+	_mm_storeu_si128(M128_CAST(cv+2),
+		_mm_roti_epi64(_mm_loadu_si128(CONST_M128_CAST(cv+2)), R));
+	_mm_storeu_si128(M128_CAST(cv+4),
+		_mm_roti_epi64(_mm_loadu_si128(CONST_M128_CAST(cv+4)), R));
+	_mm_storeu_si128(M128_CAST(cv+6),
+		_mm_roti_epi64(_mm_loadu_si128(CONST_M128_CAST(cv+6)), R));
+
+#else
+	_mm_storeu_si128(M128_CAST(cv), _mm_or_si128(
+		_mm_slli_epi64(_mm_loadu_si128(CONST_M128_CAST(cv)), R),
+		_mm_srli_epi64(_mm_loadu_si128(CONST_M128_CAST(cv)), 64-R)));
+	_mm_storeu_si128(M128_CAST(cv+2), _mm_or_si128(
+		_mm_slli_epi64(_mm_loadu_si128(CONST_M128_CAST(cv+2)), R),
+		_mm_srli_epi64(_mm_loadu_si128(CONST_M128_CAST(cv+2)), 64-R)));
+	_mm_storeu_si128(M128_CAST(cv+4), _mm_or_si128(
+		_mm_slli_epi64(_mm_loadu_si128(CONST_M128_CAST(cv+4)), R),
+		_mm_srli_epi64(_mm_loadu_si128(CONST_M128_CAST(cv+4)), 64-R)));
+	_mm_storeu_si128(M128_CAST(cv+6), _mm_or_si128(
+		_mm_slli_epi64(_mm_loadu_si128(CONST_M128_CAST(cv+6)), R),
+		_mm_srli_epi64(_mm_loadu_si128(CONST_M128_CAST(cv+6)), 64-R)));
+#endif
+}
+
+inline void xor_with_const(lsh_u64 cv_l[8], const lsh_u64 const_v[8])
+{
+	_mm_storeu_si128(M128_CAST(cv_l), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l)),
+		_mm_loadu_si128(CONST_M128_CAST(const_v))));
+	_mm_storeu_si128(M128_CAST(cv_l+2), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+2)),
+		_mm_loadu_si128(CONST_M128_CAST(const_v+2))));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(const_v+4))));
+	_mm_storeu_si128(M128_CAST(cv_l+6), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(const_v+6))));
+}
+
+inline void rotate_msg_gamma(lsh_u64 cv_r[8])
+{
+	// g_gamma512[8] = { 0, 16, 32, 48, 8, 24, 40, 56 };
+	_mm_storeu_si128(M128_CAST(cv_r+0),
+		_mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(cv_r+0)),
+			_mm_set_epi8(13,12,11,10, 9,8,15,14, 7,6,5,4, 3,2,1,0)));
+	_mm_storeu_si128(M128_CAST(cv_r+2),
+		_mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(cv_r+2)),
+			_mm_set_epi8(9,8,15,14, 13,12,11,10, 3,2,1,0, 7,6,5,4)));
+
+	_mm_storeu_si128(M128_CAST(cv_r+4),
+		_mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(cv_r+4)),
+			_mm_set_epi8(12,11,10,9, 8,15,14,13, 6,5,4,3, 2,1,0,7)));
+	_mm_storeu_si128(M128_CAST(cv_r+6),
+		_mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(cv_r+6)),
+			_mm_set_epi8(8,15,14,13, 12,11,10,9, 2,1,0,7, 6,5,4,3)));
+}
+
+inline void word_perm(lsh_u64 cv_l[8], lsh_u64 cv_r[8])
+{
+	__m128i temp[2];
+	temp[0] = _mm_loadu_si128(CONST_M128_CAST(cv_l+0));
+	_mm_storeu_si128(M128_CAST(cv_l+0), _mm_unpacklo_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+2)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+0))));
+	_mm_storeu_si128(M128_CAST(cv_l+2), _mm_unpackhi_epi64(
+		temp[0], _mm_loadu_si128(CONST_M128_CAST(cv_l+2))));
+
+	temp[0] = _mm_loadu_si128(CONST_M128_CAST(cv_l+4));
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_unpacklo_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4))));
+	_mm_storeu_si128(M128_CAST(cv_l+6), _mm_unpackhi_epi64(
+		temp[0], _mm_loadu_si128(CONST_M128_CAST(cv_l+6))));
+	_mm_storeu_si128(M128_CAST(cv_r+2), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+2)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp[0] = _mm_loadu_si128(CONST_M128_CAST(cv_r+0));
+	_mm_storeu_si128(M128_CAST(cv_r+0), _mm_unpacklo_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+0)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+2))));
+	_mm_storeu_si128(M128_CAST(cv_r+2), _mm_unpackhi_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+2)), temp[0]));
+	_mm_storeu_si128(M128_CAST(cv_r+6), _mm_shuffle_epi32(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+6)), _MM_SHUFFLE(1,0,3,2)));
+
+	temp[0] = _mm_loadu_si128(CONST_M128_CAST(cv_r+4));
+	_mm_storeu_si128(M128_CAST(cv_r+4), _mm_unpacklo_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4)),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+6))));
+	_mm_storeu_si128(M128_CAST(cv_r+6), _mm_unpackhi_epi64(
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+6)), temp[0]));
+
+	temp[0] = _mm_loadu_si128(CONST_M128_CAST(cv_l+0));
+	temp[1] = _mm_loadu_si128(CONST_M128_CAST(cv_l+2));
+
+	_mm_storeu_si128(M128_CAST(cv_l+0),
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+4)));
+	_mm_storeu_si128(M128_CAST(cv_l+2),
+		_mm_loadu_si128(CONST_M128_CAST(cv_l+6)));
+	_mm_storeu_si128(M128_CAST(cv_l+4),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+4)));
+	_mm_storeu_si128(M128_CAST(cv_l+6),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+6)));
+	_mm_storeu_si128(M128_CAST(cv_r+4),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+0)));
+	_mm_storeu_si128(M128_CAST(cv_r+6),
+		_mm_loadu_si128(CONST_M128_CAST(cv_r+2)));
+
+	_mm_storeu_si128(M128_CAST(cv_r+0), temp[0]);
+	_mm_storeu_si128(M128_CAST(cv_r+2), temp[1]);
+}
+
+/* -------------------------------------------------------- *
+* step function
+* -------------------------------------------------------- */
+
+template <unsigned int Alpha, unsigned int Beta>
+inline void mix(lsh_u64 cv_l[8], lsh_u64 cv_r[8], const lsh_u64 const_v[8])
+{
+	add_blk(cv_l, cv_r);
+	rotate_blk<Alpha>(cv_l);
+	xor_with_const(cv_l, const_v);
+	add_blk(cv_r, cv_l);
+	rotate_blk<Beta>(cv_r);
+	add_blk(cv_l, cv_r);
+	rotate_msg_gamma(cv_r);
+}
+
+/* -------------------------------------------------------- *
+* compression function
+* -------------------------------------------------------- */
+
+inline void compress(LSH512_SSSE3_Context* ctx, const lsh_u8 pdMsgBlk[LSH512_MSG_BLK_BYTE_LEN])
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	LSH512_SSSE3_Internal  s_state(ctx->cv_l);
+	LSH512_SSSE3_Internal* i_state = &s_state;
+
+	const lsh_u64* const_v = NULL;
+	lsh_u64 *cv_l = ctx->cv_l;
+	lsh_u64 *cv_r = ctx->cv_r;
+
+	load_msg_blk(i_state, pdMsgBlk);
+
+	msg_add_even(cv_l, cv_r, i_state);
+	load_sc(&const_v, 0);
+	mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	msg_add_odd(cv_l, cv_r, i_state);
+	load_sc(&const_v, 8);
+	mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+	word_perm(cv_l, cv_r);
+
+	for (size_t i = 1; i < NUM_STEPS / 2; i++)
+	{
+		msg_exp_even(i_state);
+		msg_add_even(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		msg_exp_odd(i_state);
+		msg_add_odd(cv_l, cv_r, i_state);
+		load_sc(&const_v, 16 * i + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	msg_exp_even(i_state);
+	msg_add_even(cv_l, cv_r, i_state);
+}
+
+/* -------------------------------------------------------- */
+
+inline void load_iv(word64 cv_l[8], word64 cv_r[8], const word64 iv[16])
+{
+	// The IV's are 32-byte aligned so we can use aligned loads.
+	_mm_storeu_si128(M128_CAST(cv_l+0),
+		_mm_load_si128(CONST_M128_CAST(iv+0)));
+	_mm_storeu_si128(M128_CAST(cv_l+2),
+		_mm_load_si128(CONST_M128_CAST(iv+2)));
+	_mm_storeu_si128(M128_CAST(cv_l+4),
+		_mm_load_si128(CONST_M128_CAST(iv+4)));
+	_mm_storeu_si128(M128_CAST(cv_l+6),
+		_mm_load_si128(CONST_M128_CAST(iv+6)));
+	_mm_storeu_si128(M128_CAST(cv_r+0),
+		_mm_load_si128(CONST_M128_CAST(iv+8)));
+	_mm_storeu_si128(M128_CAST(cv_r+2),
+		_mm_load_si128(CONST_M128_CAST(iv+10)));
+	_mm_storeu_si128(M128_CAST(cv_r+4),
+		_mm_load_si128(CONST_M128_CAST(iv+12)));
+	_mm_storeu_si128(M128_CAST(cv_r+6),
+		_mm_load_si128(CONST_M128_CAST(iv+14)));
+}
+
+inline void zero_iv(lsh_u64 cv_l[8], lsh_u64 cv_r[8])
+{
+	_mm_storeu_si128(M128_CAST(cv_l+0), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_l+2), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_l+4), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_l+6), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_r+0), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_r+2), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_r+4), _mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(cv_r+6), _mm_setzero_si128());
+}
+
+inline void zero_submsgs(LSH512_SSSE3_Context* ctx)
+{
+	lsh_u64* sub_msgs = ctx->sub_msgs;
+
+	_mm_storeu_si128(M128_CAST(sub_msgs+ 0),
+		_mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+ 2),
+		_mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+ 4),
+		_mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+ 6),
+		_mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+ 8),
+		_mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+10),
+		_mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+12),
+		_mm_setzero_si128());
+	_mm_storeu_si128(M128_CAST(sub_msgs+14),
+		_mm_setzero_si128());
+}
+
+inline void init224(LSH512_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV224);
+}
+
+inline void init256(LSH512_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV256);
+}
+
+inline void init384(LSH512_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV384);
+}
+
+inline void init512(LSH512_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	zero_submsgs(ctx);
+	load_iv(ctx->cv_l, ctx->cv_r, LSH512_IV512);
+}
+
+/* -------------------------------------------------------- */
+
+inline void fin(LSH512_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+
+	_mm_storeu_si128(M128_CAST(ctx->cv_l+0), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_l+0)),
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_r+0))));
+	_mm_storeu_si128(M128_CAST(ctx->cv_l+2), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_l+2)),
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_r+2))));
+	_mm_storeu_si128(M128_CAST(ctx->cv_l+4), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_l+4)),
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_r+4))));
+	_mm_storeu_si128(M128_CAST(ctx->cv_l+6), _mm_xor_si128(
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_l+6)),
+		_mm_loadu_si128(CONST_M128_CAST(ctx->cv_r+6))));
+}
+
+/* -------------------------------------------------------- */
+
+inline void get_hash(LSH512_SSSE3_Context* ctx, lsh_u8* pbHashVal)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+	CRYPTOPP_ASSERT(pbHashVal != NULLPTR);
+
+	lsh_uint alg_type = ctx->alg_type;
+	lsh_uint hash_val_byte_len = LSH_GET_HASHBYTE(alg_type);
+	lsh_uint hash_val_bit_len = LSH_GET_SMALL_HASHBIT(alg_type);
+
+	// Multiplying by sizeof(lsh_u8) looks odd...
+	std::memcpy(pbHashVal, ctx->cv_l, hash_val_byte_len);
+	if (hash_val_bit_len){
+		pbHashVal[hash_val_byte_len-1] &= (((lsh_u8)0xff) << hash_val_bit_len);
+	}
+}
+
+/* -------------------------------------------------------- */
+
+lsh_err lsh512_init_ssse3(LSH512_SSSE3_Context* ctx)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	lsh_u32 alg_type = ctx->alg_type;
+	const lsh_u64* const_v = NULL;
+	ctx->remain_databitlen = 0;
+
+	switch (alg_type){
+	case LSH_TYPE_512_512:
+		init512(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_512_384:
+		init384(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_512_256:
+		init256(ctx);
+		return LSH_SUCCESS;
+	case LSH_TYPE_512_224:
+		init224(ctx);
+		return LSH_SUCCESS;
+	default:
+		break;
+	}
+
+	lsh_u64* cv_l = ctx->cv_l;
+	lsh_u64* cv_r = ctx->cv_r;
+
+	zero_iv(cv_l, cv_r);
+	cv_l[0] = LSH512_HASH_VAL_MAX_BYTE_LEN;
+	cv_l[1] = LSH_GET_HASHBIT(alg_type);
+
+	for (size_t i = 0; i < NUM_STEPS / 2; i++)
+	{
+		//Mix
+		load_sc(&const_v, i * 16);
+		mix<ROT_EVEN_ALPHA, ROT_EVEN_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+
+		load_sc(&const_v, i * 16 + 8);
+		mix<ROT_ODD_ALPHA, ROT_ODD_BETA>(cv_l, cv_r, const_v);
+		word_perm(cv_l, cv_r);
+	}
+
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh512_update_ssse3(LSH512_SSSE3_Context* ctx, const lsh_u8* data, size_t databitlen)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(data != NULLPTR);
+	CRYPTOPP_ASSERT(databitlen % 8 == 0);
+	CRYPTOPP_ASSERT(ctx->alg_type != 0);
+
+	if (databitlen == 0){
+		return LSH_SUCCESS;
+	}
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t databytelen = databitlen >> 3;
+	// lsh_uint pos2 = databitlen & 0x7;
+	const size_t pos2 = 0;
+
+	size_t remain_msg_byte = static_cast<size_t>(ctx->remain_databitlen >> 3);
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH512_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+	if (remain_msg_bit > 0){
+		return LSH_ERR_INVALID_DATABITLEN;
+	}
+
+	if (databytelen + remain_msg_byte < LSH512_MSG_BLK_BYTE_LEN){
+		std::memcpy(ctx->last_block + remain_msg_byte, data, databytelen);
+		ctx->remain_databitlen += (lsh_uint)databitlen;
+		remain_msg_byte += (lsh_uint)databytelen;
+		if (pos2){
+			ctx->last_block[remain_msg_byte] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		}
+		return LSH_SUCCESS;
+	}
+
+	if (remain_msg_byte > 0){
+		size_t more_byte = LSH512_MSG_BLK_BYTE_LEN - remain_msg_byte;
+		std::memcpy(ctx->last_block + remain_msg_byte, data, more_byte);
+		compress(ctx, ctx->last_block);
+		data += more_byte;
+		databytelen -= more_byte;
+		remain_msg_byte = 0;
+		ctx->remain_databitlen = 0;
+	}
+
+	while (databytelen >= LSH512_MSG_BLK_BYTE_LEN)
+	{
+		// This call to compress caused some trouble.
+		// The data pointer can become unaligned in the
+		// previous block.
+		compress(ctx, data);
+		data += LSH512_MSG_BLK_BYTE_LEN;
+		databytelen -= LSH512_MSG_BLK_BYTE_LEN;
+	}
+
+	if (databytelen > 0){
+		std::memcpy(ctx->last_block, data, databytelen);
+		ctx->remain_databitlen = (lsh_uint)(databytelen << 3);
+	}
+
+	if (pos2){
+		ctx->last_block[databytelen] = data[databytelen] & ((0xff >> pos2) ^ 0xff);
+		ctx->remain_databitlen += pos2;
+	}
+	return LSH_SUCCESS;
+}
+
+lsh_err lsh512_final_ssse3(LSH512_SSSE3_Context* ctx, lsh_u8* hashval)
+{
+	CRYPTOPP_ASSERT(ctx != NULLPTR);
+	CRYPTOPP_ASSERT(hashval != NULLPTR);
+
+	// We are byte oriented. tail bits will always be 0.
+	size_t remain_msg_byte = static_cast<size_t>(ctx->remain_databitlen >> 3);
+	// lsh_uint remain_msg_bit = ctx->remain_databitlen & 7;
+	const size_t remain_msg_bit = 0;
+
+	if (remain_msg_byte >= LSH512_MSG_BLK_BYTE_LEN){
+		return LSH_ERR_INVALID_STATE;
+	}
+
+	if (remain_msg_bit){
+		ctx->last_block[remain_msg_byte] |= (0x1 << (7 - remain_msg_bit));
+	}
+	else{
+		ctx->last_block[remain_msg_byte] = 0x80;
+	}
+	std::memset(ctx->last_block + remain_msg_byte + 1, 0, LSH512_MSG_BLK_BYTE_LEN - remain_msg_byte - 1);
+
+	compress(ctx, ctx->last_block);
+
+	fin(ctx);
+	get_hash(ctx, hashval);
+
+	return LSH_SUCCESS;
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+extern
+void LSH512_Base_Restart_SSSE3(word64* state)
+{
+	state[RemainingBits] = 0;
+	LSH512_SSSE3_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh512_init_ssse3(&ctx);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH512_Base: lsh512_init_ssse3 failed");
+}
+
+extern
+void LSH512_Base_Update_SSSE3(word64* state, const byte *input, size_t size)
+{
+	LSH512_SSSE3_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh512_update_ssse3(&ctx, input, 8*size);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH512_Base: lsh512_update_ssse3 failed");
+}
+
+extern
+void LSH512_Base_TruncatedFinal_SSSE3(word64* state, byte *hash, size_t)
+{
+	LSH512_SSSE3_Context ctx(state, state[AlgorithmType], state[RemainingBits]);
+	lsh_err err = lsh512_final_ssse3(&ctx, hash);
+
+	if (err != LSH_SUCCESS)
+		throw Exception(Exception::OTHER_ERROR, "LSH512_Base: lsh512_final_ssse3 failed");
+}
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
diff --git a/runtime/third_party/cryptopp/lubyrack.h b/runtime/third_party/cryptopp/lubyrack.h
new file mode 100644
index 0000000..e671303
--- /dev/null
+++ b/runtime/third_party/cryptopp/lubyrack.h
@@ -0,0 +1,137 @@
+// lubyrack.h - originally written and placed in the public domain by Wei Dai
+
+/// \file lubyrack.h
+/// \brief Classes for the Luby-Rackoff block cipher
+
+#ifndef CRYPTOPP_LUBYRACK_H
+#define CRYPTOPP_LUBYRACK_H
+
+#include "simple.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Luby-Rackoff block cipher information
+template <class T>
+struct LR_Info : public VariableKeyLength<16, 0, 2*(INT_MAX/2), 2>, public FixedBlockSize<2*T::DIGESTSIZE>
+{
+	static std::string StaticAlgorithmName() {return std::string("LR/")+T::StaticAlgorithmName();}
+};
+
+/// \brief Luby-Rackoff block cipher
+template <class T>
+class LR : public LR_Info<T>, public BlockCipherDocumentation
+{
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<LR_Info<T> >
+	{
+	public:
+		// VC60 workaround: have to define these functions within class definition
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params)
+		{
+			this->AssertValidKeyLength(length);
+
+			L = length/2;
+			buffer.New(2*S);
+			digest.New(S);
+			key.Assign(userKey, 2*L);
+		}
+
+	protected:
+		CRYPTOPP_CONSTANT(S=T::DIGESTSIZE);
+		unsigned int L;	// key length / 2
+		SecByteBlock key;
+
+		mutable T hm;
+		mutable SecByteBlock buffer, digest;
+	};
+
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+
+#define KL this->key
+#define KR this->key+this->L
+#define BL this->buffer
+#define BR this->buffer+this->S
+#define IL inBlock
+#define IR inBlock+this->S
+#define OL outBlock
+#define OR outBlock+this->S
+
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+		{
+			this->hm.Update(KL, this->L);
+			this->hm.Update(IL, this->S);
+			this->hm.Final(BR);
+			xorbuf(BR, IR, this->S);
+
+			this->hm.Update(KR, this->L);
+			this->hm.Update(BR, this->S);
+			this->hm.Final(BL);
+			xorbuf(BL, IL, this->S);
+
+			this->hm.Update(KL, this->L);
+			this->hm.Update(BL, this->S);
+			this->hm.Final(this->digest);
+			xorbuf(BR, this->digest, this->S);
+
+			this->hm.Update(KR, this->L);
+			this->hm.Update(OR, this->S);
+			this->hm.Final(this->digest);
+			xorbuf(BL, this->digest, this->S);
+
+			if (xorBlock)
+				xorbuf(outBlock, xorBlock, this->buffer, 2*this->S);
+			else
+				memcpy_s(outBlock, 2*this->S, this->buffer, 2*this->S);
+		}
+	};
+
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+		{
+			this->hm.Update(KR, this->L);
+			this->hm.Update(IR, this->S);
+			this->hm.Final(BL);
+			xorbuf(BL, IL, this->S);
+
+			this->hm.Update(KL, this->L);
+			this->hm.Update(BL, this->S);
+			this->hm.Final(BR);
+			xorbuf(BR, IR, this->S);
+
+			this->hm.Update(KR, this->L);
+			this->hm.Update(BR, this->S);
+			this->hm.Final(this->digest);
+			xorbuf(BL, this->digest, this->S);
+
+			this->hm.Update(KL, this->L);
+			this->hm.Update(OL, this->S);
+			this->hm.Final(this->digest);
+			xorbuf(BR, this->digest, this->S);
+
+			if (xorBlock)
+				xorbuf(outBlock, xorBlock, this->buffer, 2*this->S);
+			else
+				std::memcpy(outBlock, this->buffer, 2*this->S);
+		}
+#undef KL
+#undef KR
+#undef BL
+#undef BR
+#undef IL
+#undef IR
+#undef OL
+#undef OR
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/luc.cpp b/runtime/third_party/cryptopp/luc.cpp
new file mode 100644
index 0000000..73841d4
--- /dev/null
+++ b/runtime/third_party/cryptopp/luc.cpp
@@ -0,0 +1,231 @@
+// luc.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "luc.h"
+#include "asn.h"
+#include "sha.h"
+#include "integer.h"
+#include "nbtheory.h"
+#include "algparam.h"
+#include "pkcspad.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void LUC_TestInstantiations()
+{
+	LUC_HMP<SHA1>::Signer t1;
+	LUCFunction t2;
+	InvertibleLUCFunction t3;
+}
+#endif
+
+void DL_Algorithm_LUC_HMP::Sign(const DL_GroupParameters<Integer> &params, const Integer &x, const Integer &k, const Integer &e, Integer &r, Integer &s) const
+{
+	const Integer &q = params.GetSubgroupOrder();
+	r = params.ExponentiateBase(k);
+	s = (k + x*(r+e)) % q;
+}
+
+bool DL_Algorithm_LUC_HMP::Verify(const DL_GroupParameters<Integer> &params, const DL_PublicKey<Integer> &publicKey, const Integer &e, const Integer &r, const Integer &s) const
+{
+	const Integer p = params.GetGroupOrder()-1;
+	const Integer &q = params.GetSubgroupOrder();
+
+	Integer Vsg = params.ExponentiateBase(s);
+	Integer Vry = publicKey.ExponentiatePublicElement((r+e)%q);
+	return (Vsg*Vsg + Vry*Vry + r*r) % p == (Vsg * Vry * r + 4) % p;
+}
+
+Integer DL_BasePrecomputation_LUC::Exponentiate(const DL_GroupPrecomputation<Element> &group, const Integer &exponent) const
+{
+	return Lucas(exponent, m_g, static_cast<const DL_GroupPrecomputation_LUC &>(group).GetModulus());
+}
+
+void DL_GroupParameters_LUC::SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const
+{
+	for (unsigned int i=0; i<exponentsCount; i++)
+		results[i] = Lucas(exponents[i], base, GetModulus());
+}
+
+void LUCFunction::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	m_n.BERDecode(seq);
+	m_e.BERDecode(seq);
+	seq.MessageEnd();
+}
+
+void LUCFunction::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+	m_n.DEREncode(seq);
+	m_e.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+Integer LUCFunction::ApplyFunction(const Integer &x) const
+{
+	DoQuickSanityCheck();
+	return Lucas(m_e, x, m_n);
+}
+
+bool LUCFunction::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+	CRYPTOPP_UNUSED(rng), CRYPTOPP_UNUSED(level);
+	bool pass = true;
+	pass = pass && m_n > Integer::One() && m_n.IsOdd();
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_e > Integer::One() && m_e.IsOdd() && m_e < m_n;
+	CRYPTOPP_ASSERT(pass);
+	return pass;
+}
+
+bool LUCFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_GET_FUNCTION_ENTRY(PublicExponent)
+		;
+}
+
+void LUCFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_SET_FUNCTION_ENTRY(PublicExponent)
+		;
+}
+
+// *****************************************************************************
+// private key operations:
+
+class LUCPrimeSelector : public PrimeSelector
+{
+public:
+	LUCPrimeSelector(const Integer &e) : m_e(e) {}
+	bool IsAcceptable(const Integer &candidate) const
+	{
+		return RelativelyPrime(m_e, candidate+1) && RelativelyPrime(m_e, candidate-1);
+	}
+	Integer m_e;
+};
+
+void InvertibleLUCFunction::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg)
+{
+	int modulusSize = 2048;
+	alg.GetIntValue("ModulusSize", modulusSize) || alg.GetIntValue("KeySize", modulusSize);
+
+	if (modulusSize < 16)
+		throw InvalidArgument("InvertibleLUCFunction: specified modulus size is too small");
+
+	m_e = alg.GetValueWithDefault("PublicExponent", Integer(17));
+
+	if (m_e < 5 || m_e.IsEven())
+		throw InvalidArgument("InvertibleLUCFunction: invalid public exponent");
+
+	LUCPrimeSelector selector(m_e);
+	AlgorithmParameters primeParam = MakeParametersForTwoPrimesOfEqualSize(modulusSize)
+		("PointerToPrimeSelector", selector.GetSelectorPointer());
+	m_p.GenerateRandom(rng, primeParam);
+	m_q.GenerateRandom(rng, primeParam);
+
+	m_n = m_p * m_q;
+	m_u = m_q.InverseMod(m_p);
+}
+
+void InvertibleLUCFunction::Initialize(RandomNumberGenerator &rng, unsigned int keybits, const Integer &e)
+{
+	GenerateRandom(rng, MakeParameters("ModulusSize", (int)keybits)("PublicExponent", e));
+}
+
+void InvertibleLUCFunction::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+
+	Integer version(seq);
+	if (!!version)  // make sure version is 0
+		BERDecodeError();
+
+	m_n.BERDecode(seq);
+	m_e.BERDecode(seq);
+	m_p.BERDecode(seq);
+	m_q.BERDecode(seq);
+	m_u.BERDecode(seq);
+	seq.MessageEnd();
+}
+
+void InvertibleLUCFunction::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+
+	const byte version[] = {INTEGER, 1, 0};
+	seq.Put(version, sizeof(version));
+	m_n.DEREncode(seq);
+	m_e.DEREncode(seq);
+	m_p.DEREncode(seq);
+	m_q.DEREncode(seq);
+	m_u.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+Integer InvertibleLUCFunction::CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const
+{
+	// not clear how to do blinding with LUC
+	CRYPTOPP_UNUSED(rng);
+	DoQuickSanityCheck();
+	return InverseLucas(m_e, x, m_q, m_p, m_u);
+}
+
+bool InvertibleLUCFunction::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+	bool pass = LUCFunction::Validate(rng, level);
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_p > Integer::One() && m_p.IsOdd() && m_p < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_q > Integer::One() && m_q.IsOdd() && m_q < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_u.IsPositive() && m_u < m_p;
+	CRYPTOPP_ASSERT(pass);
+	if (level >= 1)
+	{
+		pass = pass && m_p * m_q == m_n;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && RelativelyPrime(m_e, m_p+1);
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && RelativelyPrime(m_e, m_p-1);
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && RelativelyPrime(m_e, m_q+1);
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && RelativelyPrime(m_e, m_q-1);
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && m_u * m_q % m_p == 1;
+		CRYPTOPP_ASSERT(pass);
+	}
+	if (level >= 2)
+	{
+		pass = pass && VerifyPrime(rng, m_p, level-2) && VerifyPrime(rng, m_q, level-2);
+		CRYPTOPP_ASSERT(pass);
+	}
+	return pass;
+}
+
+bool InvertibleLUCFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper<LUCFunction>(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime2)
+		CRYPTOPP_GET_FUNCTION_ENTRY(MultiplicativeInverseOfPrime2ModPrime1)
+		;
+}
+
+void InvertibleLUCFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper<LUCFunction>(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime2)
+		CRYPTOPP_SET_FUNCTION_ENTRY(MultiplicativeInverseOfPrime2ModPrime1)
+		;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/luc.h b/runtime/third_party/cryptopp/luc.h
new file mode 100644
index 0000000..7c0c1b7
--- /dev/null
+++ b/runtime/third_party/cryptopp/luc.h
@@ -0,0 +1,338 @@
+// luc.h - originally written and placed in the public domain by Wei Dai
+
+/// \file luc.h
+/// \brief Classes for the LUC cryptosystem
+/// \details This class is here for historical and pedagogical interest. It has no practical advantages over other
+///   trapdoor functions and probably shouldn't	be used in production software. The discrete log based LUC schemes
+///   defined later in this .h file may be of more practical interest.
+/// \since Crypto++ 2.1
+
+#ifndef CRYPTOPP_LUC_H
+#define CRYPTOPP_LUC_H
+
+#include "cryptlib.h"
+#include "gfpcrypt.h"
+#include "integer.h"
+#include "algebra.h"
+#include "secblock.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4127 4189)
+#endif
+
+#include "pkcspad.h"
+#include "integer.h"
+#include "oaep.h"
+#include "dh.h"
+
+#include <limits.h>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief The LUC function.
+/// \details This class is here for historical and pedagogical interest. It has no practical advantages over other
+///   trapdoor functions and probably shouldn't	be used in production software. The discrete log based LUC schemes
+///   defined later in this .h file may be of more practical interest.
+/// \since Crypto++ 2.1
+class LUCFunction : public TrapdoorFunction, public PublicKey
+{
+	typedef LUCFunction ThisClass;
+
+public:
+	virtual ~LUCFunction() {}
+
+	/// \brief Initialize a LUC public key with {n,e}
+	/// \param n the modulus
+	/// \param e the public exponent
+	void Initialize(const Integer &n, const Integer &e)
+		{m_n = n; m_e = e;}
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	Integer ApplyFunction(const Integer &x) const;
+	Integer PreimageBound() const {return m_n;}
+	Integer ImageBound() const {return m_n;}
+
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+
+	// non-derived interface
+	const Integer & GetModulus() const {return m_n;}
+	const Integer & GetPublicExponent() const {return m_e;}
+
+	void SetModulus(const Integer &n) {m_n = n;}
+	void SetPublicExponent(const Integer &e) {m_e = e;}
+
+protected:
+	Integer m_n, m_e;
+};
+
+/// \brief The LUC inverse function.
+/// \details This class is here for historical and pedagogical interest. It has no practical advantages over other
+///   trapdoor functions and probably shouldn't	be used in production software. The discrete log based LUC schemes
+///   defined later in this .h file may be of more practical interest.
+/// \since Crypto++ 2.1
+class InvertibleLUCFunction : public LUCFunction, public TrapdoorFunctionInverse, public PrivateKey
+{
+	typedef InvertibleLUCFunction ThisClass;
+
+public:
+	virtual ~InvertibleLUCFunction() {}
+
+	/// \brief Create a LUC private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param modulusBits the size of the modulus, in bits
+	/// \param eStart the desired starting public exponent
+	/// \details Initialize() creates a new keypair using a starting public exponent of 17.
+	/// \details This function overload of Initialize() creates a new keypair because it
+	///   takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+	///   then use one of the other Initialize() overloads.
+	void Initialize(RandomNumberGenerator &rng, unsigned int modulusBits, const Integer &eStart=17);
+
+	/// \brief Initialize a LUC private key with {n,e,p,q,dp,dq,u}
+	/// \param n modulus
+	/// \param e public exponent
+	/// \param p first prime factor
+	/// \param q second prime factor
+	/// \param u q<sup>-1</sup> mod p
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	void Initialize(const Integer &n, const Integer &e, const Integer &p, const Integer &q, const Integer &u)
+		{m_n = n; m_e = e; m_p = p; m_q = q; m_u = u;}
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	Integer CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const;
+
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+	/*! parameters: (ModulusSize, PublicExponent (default 17)) */
+	void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
+
+	// non-derived interface
+	const Integer& GetPrime1() const {return m_p;}
+	const Integer& GetPrime2() const {return m_q;}
+	const Integer& GetMultiplicativeInverseOfPrime2ModPrime1() const {return m_u;}
+
+	void SetPrime1(const Integer &p) {m_p = p;}
+	void SetPrime2(const Integer &q) {m_q = q;}
+	void SetMultiplicativeInverseOfPrime2ModPrime1(const Integer &u) {m_u = u;}
+
+protected:
+	Integer m_p, m_q, m_u;
+};
+
+/// \brief LUC cryptosystem
+/// \since Crypto++ 2.1
+struct LUC
+{
+	static std::string StaticAlgorithmName() {return "LUC";}
+	typedef LUCFunction PublicKey;
+	typedef InvertibleLUCFunction PrivateKey;
+};
+
+/// \brief LUC encryption scheme
+/// \tparam STANDARD signature standard
+/// \details This class is here for historical and pedagogical interest. It has no practical advantages over other
+///   trapdoor functions and probably shouldn't	be used in production software. The discrete log based LUC schemes
+///   defined later in this .h file may be of more practical interest.
+/// \since Crypto++ 2.1
+template <class STANDARD>
+struct LUCES : public TF_ES<LUC, STANDARD>
+{
+};
+
+/// \brief LUC signature scheme with appendix
+/// \tparam STANDARD signature standard
+/// \tparam H hash transformation
+/// \details This class is here for historical and pedagogical interest. It has no practical advantages over other
+///   trapdoor functions and probably shouldn't	be used in production software. The discrete log based LUC schemes
+///   defined later in this .h file may be of more practical interest.
+/// \since Crypto++ 2.1
+template <class STANDARD, class H>
+struct LUCSS : public TF_SS<LUC, STANDARD, H>
+{
+};
+
+// analogous to the RSA schemes defined in PKCS #1 v2.0
+typedef LUCES<OAEP<SHA1> >::Decryptor LUCES_OAEP_SHA_Decryptor;
+typedef LUCES<OAEP<SHA1> >::Encryptor LUCES_OAEP_SHA_Encryptor;
+
+typedef LUCSS<PKCS1v15, SHA1>::Signer LUCSSA_PKCS1v15_SHA_Signer;
+typedef LUCSS<PKCS1v15, SHA1>::Verifier LUCSSA_PKCS1v15_SHA_Verifier;
+
+// ********************************************************
+
+/// \brief LUC GroupParameters precomputation
+/// \details No actual precomputation is performed
+/// \since Crypto++ 2.1
+class DL_GroupPrecomputation_LUC : public DL_GroupPrecomputation<Integer>
+{
+public:
+	virtual ~DL_GroupPrecomputation_LUC() {}
+
+	const AbstractGroup<Element> & GetGroup() const {CRYPTOPP_ASSERT(false); throw 0;}
+	Element BERDecodeElement(BufferedTransformation &bt) const {return Integer(bt);}
+	void DEREncodeElement(BufferedTransformation &bt, const Element &v) const {v.DEREncode(bt);}
+
+	// non-inherited
+	void SetModulus(const Integer &v) {m_p = v;}
+	const Integer & GetModulus() const {return m_p;}
+
+private:
+	Integer m_p;
+};
+
+/// \brief LUC Precomputation
+/// \since Crypto++ 2.1
+class DL_BasePrecomputation_LUC : public DL_FixedBasePrecomputation<Integer>
+{
+public:
+	virtual ~DL_BasePrecomputation_LUC() {}
+
+	// DL_FixedBasePrecomputation
+	bool IsInitialized() const {return m_g.NotZero();}
+	void SetBase(const DL_GroupPrecomputation<Element> &group, const Integer &base)
+		{CRYPTOPP_UNUSED(group); m_g = base;}
+	const Integer & GetBase(const DL_GroupPrecomputation<Element> &group) const
+		{CRYPTOPP_UNUSED(group); return m_g;}
+	void Precompute(const DL_GroupPrecomputation<Element> &group, unsigned int maxExpBits, unsigned int storage)
+		{CRYPTOPP_UNUSED(group); CRYPTOPP_UNUSED(maxExpBits); CRYPTOPP_UNUSED(storage);}
+	void Load(const DL_GroupPrecomputation<Element> &group, BufferedTransformation &storedPrecomputation)
+		{CRYPTOPP_UNUSED(group); CRYPTOPP_UNUSED(storedPrecomputation);}
+	void Save(const DL_GroupPrecomputation<Element> &group, BufferedTransformation &storedPrecomputation) const
+		{CRYPTOPP_UNUSED(group); CRYPTOPP_UNUSED(storedPrecomputation);}
+	Integer Exponentiate(const DL_GroupPrecomputation<Element> &group, const Integer &exponent) const;
+	Integer CascadeExponentiate(const DL_GroupPrecomputation<Element> &group, const Integer &exponent, const DL_FixedBasePrecomputation<Integer> &pc2, const Integer &exponent2) const
+		{
+			CRYPTOPP_UNUSED(group); CRYPTOPP_UNUSED(exponent); CRYPTOPP_UNUSED(pc2); CRYPTOPP_UNUSED(exponent2);
+			// shouldn't be called
+			throw NotImplemented("DL_BasePrecomputation_LUC: CascadeExponentiate not implemented");
+		}
+
+private:
+	Integer m_g;
+};
+
+/// \brief LUC GroupParameters specialization
+/// \since Crypto++ 2.1
+class DL_GroupParameters_LUC : public DL_GroupParameters_IntegerBasedImpl<DL_GroupPrecomputation_LUC, DL_BasePrecomputation_LUC>
+{
+public:
+	virtual ~DL_GroupParameters_LUC() {}
+
+	// DL_GroupParameters
+	bool IsIdentity(const Integer &element) const {return element == Integer::Two();}
+	void SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const;
+	Element MultiplyElements(const Element &a, const Element &b) const
+	{
+		CRYPTOPP_UNUSED(a); CRYPTOPP_UNUSED(b);
+		throw NotImplemented("LUC_GroupParameters: MultiplyElements can not be implemented");
+	}
+	Element CascadeExponentiate(const Element &element1, const Integer &exponent1, const Element &element2, const Integer &exponent2) const
+	{
+		CRYPTOPP_UNUSED(element1); CRYPTOPP_UNUSED(exponent1); CRYPTOPP_UNUSED(element2); CRYPTOPP_UNUSED(exponent2);
+		throw NotImplemented("LUC_GroupParameters: MultiplyElements can not be implemented");
+	}
+
+	// NameValuePairs interface
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+	{
+		return GetValueHelper<DL_GroupParameters_IntegerBased>(this, name, valueType, pValue).Assignable();
+	}
+
+private:
+	int GetFieldType() const {return 2;}
+};
+
+/// \brief GF(p) group parameters that default to safe primes
+/// \since Crypto++ 2.1
+class DL_GroupParameters_LUC_DefaultSafePrime : public DL_GroupParameters_LUC
+{
+public:
+	typedef NoCofactorMultiplication DefaultCofactorOption;
+
+protected:
+	unsigned int GetDefaultSubgroupOrderSize(unsigned int modulusSize) const {return modulusSize-1;}
+};
+
+/// \brief LUC HMP signature algorithm
+/// \since Crypto++ 2.1
+class DL_Algorithm_LUC_HMP : public DL_ElgamalLikeSignatureAlgorithm<Integer>
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "LUC-HMP";}
+
+	virtual ~DL_Algorithm_LUC_HMP() {}
+
+	void Sign(const DL_GroupParameters<Integer> &params, const Integer &x, const Integer &k, const Integer &e, Integer &r, Integer &s) const;
+	bool Verify(const DL_GroupParameters<Integer> &params, const DL_PublicKey<Integer> &publicKey, const Integer &e, const Integer &r, const Integer &s) const;
+
+	size_t RLen(const DL_GroupParameters<Integer> &params) const
+		{return params.GetGroupOrder().ByteCount();}
+};
+
+/// \brief LUC signature keys
+/// \since Crypto++ 2.1
+struct DL_SignatureKeys_LUC
+{
+	typedef DL_GroupParameters_LUC GroupParameters;
+	typedef DL_PublicKey_GFP<GroupParameters> PublicKey;
+	typedef DL_PrivateKey_GFP<GroupParameters> PrivateKey;
+};
+
+/// \brief LUC-HMP, based on "Digital signature schemes based on Lucas functions" by Patrick Horster, Markus Michels, Holger Petersen
+/// \tparam H hash transformation
+/// \details This class is here for historical and pedagogical interest. It has no practical advantages over other
+///   trapdoor functions and probably shouldn't	be used in production software. The discrete log based LUC schemes
+///   defined later in this .h file may be of more practical interest.
+/// \since Crypto++ 2.1
+template <class H>
+struct LUC_HMP : public DL_SS<DL_SignatureKeys_LUC, DL_Algorithm_LUC_HMP, DL_SignatureMessageEncodingMethod_DSA, H>
+{
+};
+
+/// \brief LUC encryption keys
+/// \since Crypto++ 2.1
+struct DL_CryptoKeys_LUC
+{
+	typedef DL_GroupParameters_LUC_DefaultSafePrime GroupParameters;
+	typedef DL_PublicKey_GFP<GroupParameters> PublicKey;
+	typedef DL_PrivateKey_GFP<GroupParameters> PrivateKey;
+};
+
+/// \brief LUC Integrated Encryption Scheme
+/// \tparam COFACTOR_OPTION cofactor multiplication option
+/// \tparam HASH HashTransformation derived class used for key drivation and MAC computation
+/// \tparam DHAES_MODE flag indicating if the MAC includes additional context parameters such as <em>u·V</em>, <em>v·U</em> and label
+/// \tparam LABEL_OCTETS flag indicating if the label size is specified in octets or bits
+/// \sa CofactorMultiplicationOption
+/// \since Crypto++ 2.1, Crypto++ 5.7 for Bouncy Castle and Botan compatibility
+template <class HASH = SHA1, class COFACTOR_OPTION = NoCofactorMultiplication, bool DHAES_MODE = true, bool LABEL_OCTETS = false>
+struct LUC_IES
+	: public DL_ES<
+		DL_CryptoKeys_LUC,
+		DL_KeyAgreementAlgorithm_DH<Integer, COFACTOR_OPTION>,
+		DL_KeyDerivationAlgorithm_P1363<Integer, DHAES_MODE, P1363_KDF2<HASH> >,
+		DL_EncryptionAlgorithm_Xor<HMAC<HASH>, DHAES_MODE, LABEL_OCTETS>,
+		LUC_IES<> >
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "LUC-IES";}	// non-standard name
+};
+
+// ********************************************************
+
+/// \brief LUC-DH
+typedef DH_Domain<DL_GroupParameters_LUC_DefaultSafePrime> LUC_DH;
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/mars.cpp b/runtime/third_party/cryptopp/mars.cpp
new file mode 100644
index 0000000..cd209c5
--- /dev/null
+++ b/runtime/third_party/cryptopp/mars.cpp
@@ -0,0 +1,154 @@
+// mars.cpp - originally written and placed in the public domain by Wei Dai
+
+// includes IBM's key setup "tweak" proposed in August 1999 (http://www.research.ibm.com/security/key-setup.txt)
+
+#include "pch.h"
+#include "mars.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void MARS::Base::UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &)
+{
+	AssertValidKeyLength(length);
+
+	// Initialize T[] with the key data
+	FixedSizeSecBlock<word32, 15> T;
+	GetUserKey(LITTLE_ENDIAN_ORDER, T.begin(), 15, userKey, length);
+	T[length/4] = length/4;
+
+	for (unsigned int j=0; j<4; j++)	// compute 10 words of K[] in each iteration
+	{
+		unsigned int i;
+		// Do linear transformation
+		for (i=0; i<15; i++)
+			T[i] = T[i] ^ rotlConstant<3>(T[(i + 8) % 15] ^ T[(i + 13) % 15]) ^ (4 * i + j);
+
+		// Do four rounds of stirring
+		for (unsigned int k=0; k<4; k++)
+			for (i=0; i<15; i++)
+				T[i] = rotlConstant<9>(T[i] + Sbox[T[(i + 14) % 15] % 512]);
+
+		// Store next 10 key words into K[]
+		for (i=0; i<10; i++)
+			m_k[10*j+i] = T[4*i%15];
+	}
+
+	// Modify multiplication key-words
+	for(unsigned int i = 5; i < 37; i += 2)
+	{
+		word32 m, w = m_k[i] | 3;
+		m = (~w ^ (w<<1)) & (~w ^ (w>>1)) & 0x7ffffffe;
+		m &= m>>1; m &= m>>2; m &= m>>4;
+		m |= m<<1; m |= m<<2; m |= m<<4;
+		m &= 0x7ffffffc;
+		w ^= rotlMod(Sbox[265 + (m_k[i] & 3)], m_k[i-1]) & m;
+		m_k[i] = w;
+	}
+}
+
+#define S(a)	Sbox[(a)&0x1ff]
+#define S0(a)	Sbox[(a)&0xff]
+#define S1(a)	Sbox[((a)&0xff) + 256]
+
+typedef BlockGetAndPut<word32, LittleEndian> Block;
+
+void MARS::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	unsigned int i;
+	word32 a, b, c, d, l, m, r, t;
+	const word32 *k = m_k;
+
+	Block::Get(inBlock)(a)(b)(c)(d);
+
+	a += k[0];	b += k[1];	c += k[2];	d += k[3];
+
+	for (i=0; i<8; i++)
+	{
+		b = (b ^ S0(a)) + S1(a>>8);
+		c += S0(a>>16);
+		a = rotrConstant<24>(a);
+		d ^= S1(a);
+		a += (i%4==0) ? d : 0;
+		a += (i%4==1) ? b : 0;
+		t = a;	a = b;	b = c;	c = d;	d = t;
+	}
+
+	for (i=0; i<16; i++)
+	{
+		t = rotlConstant<13>(a);
+		r = rotlConstant<10>(t * k[2 * i + 5]);
+		m = a + k[2*i+4];
+		l = rotlMod((S(m) ^ rotrConstant<5>(r) ^ r), r);
+		c += rotlMod(m, rotrConstant<5>(r));
+		(i<8 ? b : d) += l;
+		(i<8 ? d : b) ^= r;
+		a = b;	b = c;	c = d;	d = t;
+	}
+
+	for (i=0; i<8; i++)
+	{
+		a -= (i%4==2) ? d : 0;
+		a -= (i%4==3) ? b : 0;
+		b ^= S1(a);
+		c -= S0(a>>24);
+		t = rotlConstant<24>(a);
+		d = (d - S1(a>>16)) ^ S0(t);
+		a = b;	b = c;	c = d;	d = t;
+	}
+
+	a -= k[36];	b -= k[37];	c -= k[38];	d -= k[39];
+
+	Block::Put(xorBlock, outBlock)(a)(b)(c)(d);
+}
+
+void MARS::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	unsigned int i;
+	word32 a, b, c, d, l, m, r, t;
+	const word32 *k = m_k;
+
+	Block::Get(inBlock)(d)(c)(b)(a);
+
+	d += k[36];	c += k[37];	b += k[38];	a += k[39];
+
+	for (i=0; i<8; i++)
+	{
+		b = (b ^ S0(a)) + S1(a>>8);
+		c += S0(a>>16);
+		a = rotrConstant<24>(a);
+		d ^= S1(a);
+		a += (i%4==0) ? d : 0;
+		a += (i%4==1) ? b : 0;
+		t = a;	a = b;	b = c;	c = d;	d = t;
+	}
+
+	for (i=0; i<16; i++)
+	{
+		t = rotrConstant<13>(a);
+		r = rotlConstant<10>(a * k[35 - 2 * i]);
+		m = t + k[34-2*i];
+		l = rotlMod((S(m) ^ rotrConstant<5>(r) ^ r), r);
+		c -= rotlMod(m, rotrConstant<5>(r));
+		(i<8 ? b : d) -= l;
+		(i<8 ? d : b) ^= r;
+		a = b;	b = c;	c = d;	d = t;
+	}
+
+	for (i=0; i<8; i++)
+	{
+		a -= (i%4==2) ? d : 0;
+		a -= (i%4==3) ? b : 0;
+		b ^= S1(a);
+		c -= S0(a>>24);
+		t = rotlConstant<24>(a);
+		d = (d - S1(a>>16)) ^ S0(t);
+		a = b;	b = c;	c = d;	d = t;
+	}
+
+	d -= k[0];	c -= k[1];	b -= k[2];	a -= k[3];
+
+	Block::Put(xorBlock, outBlock)(d)(c)(b)(a);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/mars.h b/runtime/third_party/cryptopp/mars.h
new file mode 100644
index 0000000..53c093c
--- /dev/null
+++ b/runtime/third_party/cryptopp/mars.h
@@ -0,0 +1,60 @@
+// mars.h - originally written and placed in the public domain by Wei Dai
+
+/// \file mars.h
+/// \brief Classes for the MARS block cipher (IBM AES submission)
+/// \since Crypto++ 3.0
+
+#ifndef CRYPTOPP_MARS_H
+#define CRYPTOPP_MARS_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief MARS block cipher information
+/// \since Crypto++ 3.0
+struct MARS_Info : public FixedBlockSize<16>, public VariableKeyLength<16, 16, 56, 8>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "MARS";}
+};
+
+/// \brief MARS block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/MARS">MARS</a>
+/// \since Crypto++ 3.0
+class MARS : public MARS_Info, public BlockCipherDocumentation
+{
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<MARS_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		static const word32 Sbox[512];
+
+		FixedSizeSecBlock<word32, 40> m_k;
+	};
+
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef MARS::Encryption MARSEncryption;
+typedef MARS::Decryption MARSDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/marss.cpp b/runtime/third_party/cryptopp/marss.cpp
new file mode 100644
index 0000000..b4b17a9
--- /dev/null
+++ b/runtime/third_party/cryptopp/marss.cpp
@@ -0,0 +1,140 @@
+// MARS S-Box
+
+#include "pch.h"
+#include "mars.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const word32 MARS::Base::Sbox[512] = {
+  0x09d0c479, 0x28c8ffe0, 0x84aa6c39, 0x9dad7287,
+  0x7dff9be3, 0xd4268361, 0xc96da1d4, 0x7974cc93,
+  0x85d0582e, 0x2a4b5705, 0x1ca16a62, 0xc3bd279d,
+  0x0f1f25e5, 0x5160372f, 0xc695c1fb, 0x4d7ff1e4,
+  0xae5f6bf4, 0x0d72ee46, 0xff23de8a, 0xb1cf8e83,
+  0xf14902e2, 0x3e981e42, 0x8bf53eb6, 0x7f4bf8ac,
+  0x83631f83, 0x25970205, 0x76afe784, 0x3a7931d4,
+  0x4f846450, 0x5c64c3f6, 0x210a5f18, 0xc6986a26,
+  0x28f4e826, 0x3a60a81c, 0xd340a664, 0x7ea820c4,
+  0x526687c5, 0x7eddd12b, 0x32a11d1d, 0x9c9ef086,
+  0x80f6e831, 0xab6f04ad, 0x56fb9b53, 0x8b2e095c,
+  0xb68556ae, 0xd2250b0d, 0x294a7721, 0xe21fb253,
+  0xae136749, 0xe82aae86, 0x93365104, 0x99404a66,
+  0x78a784dc, 0xb69ba84b, 0x04046793, 0x23db5c1e,
+  0x46cae1d6, 0x2fe28134, 0x5a223942, 0x1863cd5b,
+  0xc190c6e3, 0x07dfb846, 0x6eb88816, 0x2d0dcc4a,
+  0xa4ccae59, 0x3798670d, 0xcbfa9493, 0x4f481d45,
+  0xeafc8ca8, 0xdb1129d6, 0xb0449e20, 0x0f5407fb,
+  0x6167d9a8, 0xd1f45763, 0x4daa96c3, 0x3bec5958,
+  0xababa014, 0xb6ccd201, 0x38d6279f, 0x02682215,
+  0x8f376cd5, 0x092c237e, 0xbfc56593, 0x32889d2c,
+  0x854b3e95, 0x05bb9b43, 0x7dcd5dcd, 0xa02e926c,
+  0xfae527e5, 0x36a1c330, 0x3412e1ae, 0xf257f462,
+  0x3c4f1d71, 0x30a2e809, 0x68e5f551, 0x9c61ba44,
+  0x5ded0ab8, 0x75ce09c8, 0x9654f93e, 0x698c0cca,
+  0x243cb3e4, 0x2b062b97, 0x0f3b8d9e, 0x00e050df,
+  0xfc5d6166, 0xe35f9288, 0xc079550d, 0x0591aee8,
+  0x8e531e74, 0x75fe3578, 0x2f6d829a, 0xf60b21ae,
+  0x95e8eb8d, 0x6699486b, 0x901d7d9b, 0xfd6d6e31,
+  0x1090acef, 0xe0670dd8, 0xdab2e692, 0xcd6d4365,
+  0xe5393514, 0x3af345f0, 0x6241fc4d, 0x460da3a3,
+  0x7bcf3729, 0x8bf1d1e0, 0x14aac070, 0x1587ed55,
+  0x3afd7d3e, 0xd2f29e01, 0x29a9d1f6, 0xefb10c53,
+  0xcf3b870f, 0xb414935c, 0x664465ed, 0x024acac7,
+  0x59a744c1, 0x1d2936a7, 0xdc580aa6, 0xcf574ca8,
+  0x040a7a10, 0x6cd81807, 0x8a98be4c, 0xaccea063,
+  0xc33e92b5, 0xd1e0e03d, 0xb322517e, 0x2092bd13,
+  0x386b2c4a, 0x52e8dd58, 0x58656dfb, 0x50820371,
+  0x41811896, 0xe337ef7e, 0xd39fb119, 0xc97f0df6,
+  0x68fea01b, 0xa150a6e5, 0x55258962, 0xeb6ff41b,
+  0xd7c9cd7a, 0xa619cd9e, 0xbcf09576, 0x2672c073,
+  0xf003fb3c, 0x4ab7a50b, 0x1484126a, 0x487ba9b1,
+  0xa64fc9c6, 0xf6957d49, 0x38b06a75, 0xdd805fcd,
+  0x63d094cf, 0xf51c999e, 0x1aa4d343, 0xb8495294,
+  0xce9f8e99, 0xbffcd770, 0xc7c275cc, 0x378453a7,
+  0x7b21be33, 0x397f41bd, 0x4e94d131, 0x92cc1f98,
+  0x5915ea51, 0x99f861b7, 0xc9980a88, 0x1d74fd5f,
+  0xb0a495f8, 0x614deed0, 0xb5778eea, 0x5941792d,
+  0xfa90c1f8, 0x33f824b4, 0xc4965372, 0x3ff6d550,
+  0x4ca5fec0, 0x8630e964, 0x5b3fbbd6, 0x7da26a48,
+  0xb203231a, 0x04297514, 0x2d639306, 0x2eb13149,
+  0x16a45272, 0x532459a0, 0x8e5f4872, 0xf966c7d9,
+  0x07128dc0, 0x0d44db62, 0xafc8d52d, 0x06316131,
+  0xd838e7ce, 0x1bc41d00, 0x3a2e8c0f, 0xea83837e,
+  0xb984737d, 0x13ba4891, 0xc4f8b949, 0xa6d6acb3,
+  0xa215cdce, 0x8359838b, 0x6bd1aa31, 0xf579dd52,
+  0x21b93f93, 0xf5176781, 0x187dfdde, 0xe94aeb76,
+  0x2b38fd54, 0x431de1da, 0xab394825, 0x9ad3048f,
+  0xdfea32aa, 0x659473e3, 0x623f7863, 0xf3346c59,
+  0xab3ab685, 0x3346a90b, 0x6b56443e, 0xc6de01f8,
+  0x8d421fc0, 0x9b0ed10c, 0x88f1a1e9, 0x54c1f029,
+  0x7dead57b, 0x8d7ba426, 0x4cf5178a, 0x551a7cca,
+  0x1a9a5f08, 0xfcd651b9, 0x25605182, 0xe11fc6c3,
+  0xb6fd9676, 0x337b3027, 0xb7c8eb14, 0x9e5fd030,
+  0x6b57e354, 0xad913cf7, 0x7e16688d, 0x58872a69,
+  0x2c2fc7df, 0xe389ccc6, 0x30738df1, 0x0824a734,
+  0xe1797a8b, 0xa4a8d57b, 0x5b5d193b, 0xc8a8309b,
+  0x73f9a978, 0x73398d32, 0x0f59573e, 0xe9df2b03,
+  0xe8a5b6c8, 0x848d0704, 0x98df93c2, 0x720a1dc3,
+  0x684f259a, 0x943ba848, 0xa6370152, 0x863b5ea3,
+  0xd17b978b, 0x6d9b58ef, 0x0a700dd4, 0xa73d36bf,
+  0x8e6a0829, 0x8695bc14, 0xe35b3447, 0x933ac568,
+  0x8894b022, 0x2f511c27, 0xddfbcc3c, 0x006662b6,
+  0x117c83fe, 0x4e12b414, 0xc2bca766, 0x3a2fec10,
+  0xf4562420, 0x55792e2a, 0x46f5d857, 0xceda25ce,
+  0xc3601d3b, 0x6c00ab46, 0xefac9c28, 0xb3c35047,
+  0x611dfee3, 0x257c3207, 0xfdd58482, 0x3b14d84f,
+  0x23becb64, 0xa075f3a3, 0x088f8ead, 0x07adf158,
+  0x7796943c, 0xfacabf3d, 0xc09730cd, 0xf7679969,
+  0xda44e9ed, 0x2c854c12, 0x35935fa3, 0x2f057d9f,
+  0x690624f8, 0x1cb0bafd, 0x7b0dbdc6, 0x810f23bb,
+  0xfa929a1a, 0x6d969a17, 0x6742979b, 0x74ac7d05,
+  0x010e65c4, 0x86a3d963, 0xf907b5a0, 0xd0042bd3,
+  0x158d7d03, 0x287a8255, 0xbba8366f, 0x096edc33,
+  0x21916a7b, 0x77b56b86, 0x951622f9, 0xa6c5e650,
+  0x8cea17d1, 0xcd8c62bc, 0xa3d63433, 0x358a68fd,
+  0x0f9b9d3c, 0xd6aa295b, 0xfe33384a, 0xc000738e,
+  0xcd67eb2f, 0xe2eb6dc2, 0x97338b02, 0x06c9f246,
+  0x419cf1ad, 0x2b83c045, 0x3723f18a, 0xcb5b3089,
+  0x160bead7, 0x5d494656, 0x35f8a74b, 0x1e4e6c9e,
+  0x000399bd, 0x67466880, 0xb4174831, 0xacf423b2,
+  0xca815ab3, 0x5a6395e7, 0x302a67c5, 0x8bdb446b,
+  0x108f8fa4, 0x10223eda, 0x92b8b48b, 0x7f38d0ee,
+  0xab2701d4, 0x0262d415, 0xaf224a30, 0xb3d88aba,
+  0xf8b2c3af, 0xdaf7ef70, 0xcc97d3b7, 0xe9614b6c,
+  0x2baebff4, 0x70f687cf, 0x386c9156, 0xce092ee5,
+  0x01e87da6, 0x6ce91e6a, 0xbb7bcc84, 0xc7922c20,
+  0x9d3b71fd, 0x060e41c6, 0xd7590f15, 0x4e03bb47,
+  0x183c198e, 0x63eeb240, 0x2ddbf49a, 0x6d5cba54,
+  0x923750af, 0xf9e14236, 0x7838162b, 0x59726c72,
+  0x81b66760, 0xbb2926c1, 0x48a0ce0d, 0xa6c0496d,
+  0xad43507b, 0x718d496a, 0x9df057af, 0x44b1bde6,
+  0x054356dc, 0xde7ced35, 0xd51a138b, 0x62088cc9,
+  0x35830311, 0xc96efca2, 0x686f86ec, 0x8e77cb68,
+  0x63e1d6b8, 0xc80f9778, 0x79c491fd, 0x1b4c67f2,
+  0x72698d7d, 0x5e368c31, 0xf7d95e2e, 0xa1d3493f,
+  0xdcd9433e, 0x896f1552, 0x4bc4ca7a, 0xa6d1baf4,
+  0xa5a96dcc, 0x0bef8b46, 0xa169fda7, 0x74df40b7,
+  0x4e208804, 0x9a756607, 0x038e87c8, 0x20211e44,
+  0x8b7ad4bf, 0xc6403f35, 0x1848e36d, 0x80bdb038,
+  0x1e62891c, 0x643d2107, 0xbf04d6f8, 0x21092c8c,
+  0xf644f389, 0x0778404e, 0x7b78adb8, 0xa2c52d53,
+  0x42157abe, 0xa2253e2e, 0x7bf3f4ae, 0x80f594f9,
+  0x953194e7, 0x77eb92ed, 0xb3816930, 0xda8d9336,
+  0xbf447469, 0xf26d9483, 0xee6faed5, 0x71371235,
+  0xde425f73, 0xb4e59f43, 0x7dbe2d4e, 0x2d37b185,
+  0x49dc9a63, 0x98c39d98, 0x1301c9a2, 0x389b1bbf,
+  0x0c18588d, 0xa421c1ba, 0x7aa3865c, 0x71e08558,
+  0x3c5cfcaa, 0x7d239ca4, 0x0297d9dd, 0xd7dc2830,
+  0x4b37802b, 0x7428ab54, 0xaeee0347, 0x4b3fbb85,
+  0x692f2f08, 0x134e578e, 0x36d9e0bf, 0xae8b5fcf,
+  0xedb93ecf, 0x2b27248e, 0x170eb1ef, 0x7dc57fd6,
+  0x1e760f16, 0xb1136601, 0x864e1b9b, 0xd7ea7319,
+  0x3ab871bd, 0xcfa4d76f, 0xe31bd782, 0x0dbeb469,
+  0xabb96061, 0x5370f85d, 0xffb07e37, 0xda30d0fb,
+  0xebc977b6, 0x0b98b40f, 0x3a4d0fe6, 0xdf4fc26b,
+  0x159cf22a, 0xc298d6e2, 0x2b78ef6a, 0x61a94ac0,
+  0xab561187, 0x14eea0f0, 0xdf0d4164, 0x19af70ee
+};
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/md2.cpp b/runtime/third_party/cryptopp/md2.cpp
new file mode 100644
index 0000000..01ff1b6
--- /dev/null
+++ b/runtime/third_party/cryptopp/md2.cpp
@@ -0,0 +1,120 @@
+// md2.cpp - modified by Wei Dai from Andrew M. Kuchling's md2.c
+// The original code and all modifications are in the public domain.
+
+// This is the original introductory comment:
+
+/*
+ *  md2.c : MD2 hash algorithm.
+ *
+ * Part of the Python Cryptography Toolkit, version 1.1
+ *
+ * Distribute and use freely; there are no restrictions on further
+ * dissemination and usage except those imposed by the laws of your
+ * country of residence.
+ *
+ */
+
+#include "pch.h"
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+#include "md2.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+namespace Weak1 {
+
+MD2::MD2()
+	: m_X(48), m_C(16), m_buf(16)
+{
+	Init();
+}
+
+void MD2::Init()
+{
+	std::memset(m_X, 0, 48);
+	std::memset(m_C, 0, 16);
+	std::memset(m_buf, 0, 16);
+	m_count = 0;
+}
+
+void MD2::Update(const byte *buf, size_t len)
+{
+	static const byte S[256] = {
+		41, 46, 67, 201, 162, 216, 124, 1, 61, 54, 84, 161, 236, 240, 6,
+		19, 98, 167, 5, 243, 192, 199, 115, 140, 152, 147, 43, 217, 188,
+		76, 130, 202, 30, 155, 87, 60, 253, 212, 224, 22, 103, 66, 111, 24,
+		138, 23, 229, 18, 190, 78, 196, 214, 218, 158, 222, 73, 160, 251,
+		245, 142, 187, 47, 238, 122, 169, 104, 121, 145, 21, 178, 7, 63,
+		148, 194, 16, 137, 11, 34, 95, 33, 128, 127, 93, 154, 90, 144, 50,
+		39, 53, 62, 204, 231, 191, 247, 151, 3, 255, 25, 48, 179, 72, 165,
+		181, 209, 215, 94, 146, 42, 172, 86, 170, 198, 79, 184, 56, 210,
+		150, 164, 125, 182, 118, 252, 107, 226, 156, 116, 4, 241, 69, 157,
+		112, 89, 100, 113, 135, 32, 134, 91, 207, 101, 230, 45, 168, 2, 27,
+		96, 37, 173, 174, 176, 185, 246, 28, 70, 97, 105, 52, 64, 126, 15,
+		85, 71, 163, 35, 221, 81, 175, 58, 195, 92, 249, 206, 186, 197,
+		234, 38, 44, 83, 13, 110, 133, 40, 132, 9, 211, 223, 205, 244, 65,
+		129, 77, 82, 106, 220, 55, 200, 108, 193, 171, 250, 36, 225, 123,
+		8, 12, 189, 177, 74, 120, 136, 149, 139, 227, 99, 232, 109, 233,
+		203, 213, 254, 59, 0, 29, 57, 242, 239, 183, 14, 102, 88, 208, 228,
+		166, 119, 114, 248, 235, 117, 75, 10, 49, 68, 80, 180, 143, 237,
+		31, 26, 219, 153, 141, 51, 159, 17, 131, 20
+	};
+
+	while (len)
+    {
+		unsigned int L = UnsignedMin(16U-m_count, len);
+		std::memcpy(m_buf+m_count, buf, L);
+		m_count+=L;
+		buf+=L;
+		len-=L;
+		if (m_count==16)
+		{
+			byte t;
+			int i,j;
+
+			m_count=0;
+			std::memcpy(m_X+16, m_buf, 16);
+			t=m_C[15];
+			for(i=0; i<16; i++)
+			{
+				m_X[32+i]=m_X[16+i]^m_X[i];
+				t=m_C[i]^=S[m_buf[i]^t];
+			}
+
+			t=0;
+			for(i=0; i<18; i++)
+			{
+				for(j=0; j<48; j+=8)
+				{
+					t=m_X[j+0]^=S[t];
+					t=m_X[j+1]^=S[t];
+					t=m_X[j+2]^=S[t];
+					t=m_X[j+3]^=S[t];
+					t=m_X[j+4]^=S[t];
+					t=m_X[j+5]^=S[t];
+					t=m_X[j+6]^=S[t];
+					t=m_X[j+7]^=S[t];
+				}
+				t = byte((t+i) & 0xFF);
+			}
+		}
+    }
+}
+
+void MD2::TruncatedFinal(byte *hash, size_t size)
+{
+	ThrowIfInvalidTruncatedSize(size);
+
+	byte padding[16];
+	word32 padlen;
+	unsigned int i;
+
+	padlen= 16-m_count;
+	for(i=0; i<padlen; i++) padding[i]=(byte)padlen;
+	Update(padding, padlen);
+	Update(m_C, 16);
+	std::memcpy(hash, m_X, size);
+
+	Init();
+}
+
+}
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/md2.h b/runtime/third_party/cryptopp/md2.h
new file mode 100644
index 0000000..83335d3
--- /dev/null
+++ b/runtime/third_party/cryptopp/md2.h
@@ -0,0 +1,56 @@
+// md2.h - originally written and placed in the public domain by Wei Dai
+
+/// \file md2.h
+/// \brief Classes for the MD2 message digest
+/// \since Crypto++ 3.0
+
+#ifndef CRYPTOPP_MD2_H
+#define CRYPTOPP_MD2_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+namespace Weak1 {
+
+/// \brief MD2 message digest
+/// \sa <a href="http://www.cryptolounge.org/wiki/MD2">MD2</a>
+/// \since Crypto++ 3.0
+class MD2 : public HashTransformation
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "MD2";}
+
+	MD2();
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *hash, size_t size);
+	unsigned int DigestSize() const {return DIGESTSIZE;}
+	unsigned int BlockSize() const {return BLOCKSIZE;}
+	std::string AlgorithmName() const {return StaticAlgorithmName();}
+
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 16);
+	CRYPTOPP_CONSTANT(BLOCKSIZE = 16);
+
+private:
+	void Transform();
+	void Init();
+	SecByteBlock m_X, m_C, m_buf;
+	unsigned int m_count;
+};
+
+}
+#if CRYPTOPP_ENABLE_NAMESPACE_WEAK >= 1
+namespace Weak {using namespace Weak1;}		// import Weak1 into CryptoPP::Weak
+#else
+using namespace Weak1;	// import Weak1 into CryptoPP with warning
+#ifdef __GNUC__
+#warning "You may be using a weak algorithm that has been retained for backwards compatibility. Please '#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1' before including this .h file and prepend the class name with 'Weak::' to remove this warning."
+#else
+#pragma message("You may be using a weak algorithm that has been retained for backwards compatibility. Please '#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1' before including this .h file and prepend the class name with 'Weak::' to remove this warning.")
+#endif
+#endif
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/md4.cpp b/runtime/third_party/cryptopp/md4.cpp
new file mode 100644
index 0000000..459ed7b
--- /dev/null
+++ b/runtime/third_party/cryptopp/md4.cpp
@@ -0,0 +1,110 @@
+// md4.cpp - modified by Wei Dai from Andrew M. Kuchling's md4.c
+// The original code and all modifications are in the public domain.
+
+// This is the original introductory comment:
+
+/*
+ *  md4.c : MD4 hash algorithm.
+ *
+ * Part of the Python Cryptography Toolkit, version 1.1
+ *
+ * Distribute and use freely; there are no restrictions on further
+ * dissemination and usage except those imposed by the laws of your
+ * country of residence.
+ *
+ */
+
+#include "pch.h"
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+#include "md4.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+namespace Weak1 {
+
+void MD4::InitState(HashWordType *state)
+{
+	state[0] = 0x67452301L;
+	state[1] = 0xefcdab89L;
+	state[2] = 0x98badcfeL;
+	state[3] = 0x10325476L;
+}
+
+void MD4::Transform (word32 *digest, const word32 *in)
+{
+// #define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
+#define F(x, y, z) ((z) ^ ((x) & ((y) ^ (z))))
+#define G(x, y, z) (((x) & (y)) | ((x) & (z)) | ((y) & (z)))
+#define H(x, y, z) ((x) ^ (y) ^ (z))
+
+    word32 A, B, C, D;
+
+	A=digest[0];
+	B=digest[1];
+	C=digest[2];
+	D=digest[3];
+
+#define function(a,b,c,d,k,s) a=rotlVariable(a+F(b,c,d)+in[k],s);
+	  function(A,B,C,D, 0, 3);
+	  function(D,A,B,C, 1, 7);
+	  function(C,D,A,B, 2,11);
+	  function(B,C,D,A, 3,19);
+	  function(A,B,C,D, 4, 3);
+	  function(D,A,B,C, 5, 7);
+	  function(C,D,A,B, 6,11);
+	  function(B,C,D,A, 7,19);
+	  function(A,B,C,D, 8, 3);
+	  function(D,A,B,C, 9, 7);
+	  function(C,D,A,B,10,11);
+	  function(B,C,D,A,11,19);
+	  function(A,B,C,D,12, 3);
+	  function(D,A,B,C,13, 7);
+	  function(C,D,A,B,14,11);
+	  function(B,C,D,A,15,19);
+
+#undef function
+#define function(a,b,c,d,k,s) a=rotlVariable(a+G(b,c,d)+in[k]+0x5a827999,s);
+	  function(A,B,C,D, 0, 3);
+	  function(D,A,B,C, 4, 5);
+	  function(C,D,A,B, 8, 9);
+	  function(B,C,D,A,12,13);
+	  function(A,B,C,D, 1, 3);
+	  function(D,A,B,C, 5, 5);
+	  function(C,D,A,B, 9, 9);
+	  function(B,C,D,A,13,13);
+	  function(A,B,C,D, 2, 3);
+	  function(D,A,B,C, 6, 5);
+	  function(C,D,A,B,10, 9);
+	  function(B,C,D,A,14,13);
+	  function(A,B,C,D, 3, 3);
+	  function(D,A,B,C, 7, 5);
+	  function(C,D,A,B,11, 9);
+	  function(B,C,D,A,15,13);
+
+#undef function
+#define function(a,b,c,d,k,s) a=rotlVariable(a+H(b,c,d)+in[k]+0x6ed9eba1,s);
+	  function(A,B,C,D, 0, 3);
+	  function(D,A,B,C, 8, 9);
+	  function(C,D,A,B, 4,11);
+	  function(B,C,D,A,12,15);
+	  function(A,B,C,D, 2, 3);
+	  function(D,A,B,C,10, 9);
+	  function(C,D,A,B, 6,11);
+	  function(B,C,D,A,14,15);
+	  function(A,B,C,D, 1, 3);
+	  function(D,A,B,C, 9, 9);
+	  function(C,D,A,B, 5,11);
+	  function(B,C,D,A,13,15);
+	  function(A,B,C,D, 3, 3);
+	  function(D,A,B,C,11, 9);
+	  function(C,D,A,B, 7,11);
+	  function(B,C,D,A,15,15);
+
+	digest[0]+=A;
+	digest[1]+=B;
+	digest[2]+=C;
+	digest[3]+=D;
+}
+
+}
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/md4.h b/runtime/third_party/cryptopp/md4.h
new file mode 100644
index 0000000..8984b5e
--- /dev/null
+++ b/runtime/third_party/cryptopp/md4.h
@@ -0,0 +1,35 @@
+#ifndef CRYPTOPP_MD4_H
+#define CRYPTOPP_MD4_H
+
+#include "iterhash.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+namespace Weak1 {
+
+/// <a href="http://www.weidai.com/scan-mirror/md.html#MD4">MD4</a>
+/*! \warning MD4 is considered insecure, and should not be used
+	unless you absolutely need it for compatibility. */
+class MD4 : public IteratedHashWithStaticTransform<word32, LittleEndian, 64, 16, MD4>
+{
+public:
+	static void InitState(HashWordType *state);
+	static void Transform(word32 *digest, const word32 *data);
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "MD4";}
+};
+
+}
+#if CRYPTOPP_ENABLE_NAMESPACE_WEAK >= 1
+namespace Weak {using namespace Weak1;}		// import Weak1 into CryptoPP::Weak
+#else
+using namespace Weak1;	// import Weak1 into CryptoPP with warning
+#ifdef __GNUC__
+#warning "You may be using a weak algorithm that has been retained for backwards compatibility. Please '#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1' before including this .h file and prepend the class name with 'Weak::' to remove this warning."
+#else
+#pragma message("You may be using a weak algorithm that has been retained for backwards compatibility. Please '#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1' before including this .h file and prepend the class name with 'Weak::' to remove this warning.")
+#endif
+#endif
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/md5.cpp b/runtime/third_party/cryptopp/md5.cpp
new file mode 100644
index 0000000..d54dec7
--- /dev/null
+++ b/runtime/third_party/cryptopp/md5.cpp
@@ -0,0 +1,124 @@
+// md5.cpp - modified by Wei Dai from Colin Plumb's public domain md5.c
+// any modifications are placed in the public domain
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+#include "md5.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Weak1)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void MD5_TestInstantiations()
+{
+	MD5 x;
+}
+#endif
+
+void MD5::InitState(HashWordType *state)
+{
+	state[0] = 0x67452301L;
+	state[1] = 0xefcdab89L;
+	state[2] = 0x98badcfeL;
+	state[3] = 0x10325476L;
+}
+
+void MD5::Transform (word32 *digest, const word32 *data)
+{
+    CRYPTOPP_ASSERT(digest);
+    CRYPTOPP_ASSERT(data);
+
+// #define F1(x, y, z) (x & y | ~x & z)
+#define F1(x, y, z) (z ^ (x & (y ^ z)))
+#define F2(x, y, z) F1(z, x, y)
+#define F3(x, y, z) (x ^ y ^ z)
+#define F4(x, y, z) (y ^ (x | ~z))
+
+#define MD5STEP(f, w, x, y, z, data, s) \
+	w = rotlFixed(w + f(x, y, z) + data, s) + x
+
+    word32 a, b, c, d;
+
+	a=digest[0];
+	b=digest[1];
+	c=digest[2];
+	d=digest[3];
+
+    MD5STEP(F1, a, b, c, d, data[0] + 0xd76aa478, 7);
+    MD5STEP(F1, d, a, b, c, data[1] + 0xe8c7b756, 12);
+    MD5STEP(F1, c, d, a, b, data[2] + 0x242070db, 17);
+    MD5STEP(F1, b, c, d, a, data[3] + 0xc1bdceee, 22);
+    MD5STEP(F1, a, b, c, d, data[4] + 0xf57c0faf, 7);
+    MD5STEP(F1, d, a, b, c, data[5] + 0x4787c62a, 12);
+    MD5STEP(F1, c, d, a, b, data[6] + 0xa8304613, 17);
+    MD5STEP(F1, b, c, d, a, data[7] + 0xfd469501, 22);
+    MD5STEP(F1, a, b, c, d, data[8] + 0x698098d8, 7);
+    MD5STEP(F1, d, a, b, c, data[9] + 0x8b44f7af, 12);
+    MD5STEP(F1, c, d, a, b, data[10] + 0xffff5bb1, 17);
+    MD5STEP(F1, b, c, d, a, data[11] + 0x895cd7be, 22);
+    MD5STEP(F1, a, b, c, d, data[12] + 0x6b901122, 7);
+    MD5STEP(F1, d, a, b, c, data[13] + 0xfd987193, 12);
+    MD5STEP(F1, c, d, a, b, data[14] + 0xa679438e, 17);
+    MD5STEP(F1, b, c, d, a, data[15] + 0x49b40821, 22);
+
+    MD5STEP(F2, a, b, c, d, data[1] + 0xf61e2562, 5);
+    MD5STEP(F2, d, a, b, c, data[6] + 0xc040b340, 9);
+    MD5STEP(F2, c, d, a, b, data[11] + 0x265e5a51, 14);
+    MD5STEP(F2, b, c, d, a, data[0] + 0xe9b6c7aa, 20);
+    MD5STEP(F2, a, b, c, d, data[5] + 0xd62f105d, 5);
+    MD5STEP(F2, d, a, b, c, data[10] + 0x02441453, 9);
+    MD5STEP(F2, c, d, a, b, data[15] + 0xd8a1e681, 14);
+    MD5STEP(F2, b, c, d, a, data[4] + 0xe7d3fbc8, 20);
+    MD5STEP(F2, a, b, c, d, data[9] + 0x21e1cde6, 5);
+    MD5STEP(F2, d, a, b, c, data[14] + 0xc33707d6, 9);
+    MD5STEP(F2, c, d, a, b, data[3] + 0xf4d50d87, 14);
+    MD5STEP(F2, b, c, d, a, data[8] + 0x455a14ed, 20);
+    MD5STEP(F2, a, b, c, d, data[13] + 0xa9e3e905, 5);
+    MD5STEP(F2, d, a, b, c, data[2] + 0xfcefa3f8, 9);
+    MD5STEP(F2, c, d, a, b, data[7] + 0x676f02d9, 14);
+    MD5STEP(F2, b, c, d, a, data[12] + 0x8d2a4c8a, 20);
+
+    MD5STEP(F3, a, b, c, d, data[5] + 0xfffa3942, 4);
+    MD5STEP(F3, d, a, b, c, data[8] + 0x8771f681, 11);
+    MD5STEP(F3, c, d, a, b, data[11] + 0x6d9d6122, 16);
+    MD5STEP(F3, b, c, d, a, data[14] + 0xfde5380c, 23);
+    MD5STEP(F3, a, b, c, d, data[1] + 0xa4beea44, 4);
+    MD5STEP(F3, d, a, b, c, data[4] + 0x4bdecfa9, 11);
+    MD5STEP(F3, c, d, a, b, data[7] + 0xf6bb4b60, 16);
+    MD5STEP(F3, b, c, d, a, data[10] + 0xbebfbc70, 23);
+    MD5STEP(F3, a, b, c, d, data[13] + 0x289b7ec6, 4);
+    MD5STEP(F3, d, a, b, c, data[0] + 0xeaa127fa, 11);
+    MD5STEP(F3, c, d, a, b, data[3] + 0xd4ef3085, 16);
+    MD5STEP(F3, b, c, d, a, data[6] + 0x04881d05, 23);
+    MD5STEP(F3, a, b, c, d, data[9] + 0xd9d4d039, 4);
+    MD5STEP(F3, d, a, b, c, data[12] + 0xe6db99e5, 11);
+    MD5STEP(F3, c, d, a, b, data[15] + 0x1fa27cf8, 16);
+    MD5STEP(F3, b, c, d, a, data[2] + 0xc4ac5665, 23);
+
+    MD5STEP(F4, a, b, c, d, data[0] + 0xf4292244, 6);
+    MD5STEP(F4, d, a, b, c, data[7] + 0x432aff97, 10);
+    MD5STEP(F4, c, d, a, b, data[14] + 0xab9423a7, 15);
+    MD5STEP(F4, b, c, d, a, data[5] + 0xfc93a039, 21);
+    MD5STEP(F4, a, b, c, d, data[12] + 0x655b59c3, 6);
+    MD5STEP(F4, d, a, b, c, data[3] + 0x8f0ccc92, 10);
+    MD5STEP(F4, c, d, a, b, data[10] + 0xffeff47d, 15);
+    MD5STEP(F4, b, c, d, a, data[1] + 0x85845dd1, 21);
+    MD5STEP(F4, a, b, c, d, data[8] + 0x6fa87e4f, 6);
+    MD5STEP(F4, d, a, b, c, data[15] + 0xfe2ce6e0, 10);
+    MD5STEP(F4, c, d, a, b, data[6] + 0xa3014314, 15);
+    MD5STEP(F4, b, c, d, a, data[13] + 0x4e0811a1, 21);
+    MD5STEP(F4, a, b, c, d, data[4] + 0xf7537e82, 6);
+    MD5STEP(F4, d, a, b, c, data[11] + 0xbd3af235, 10);
+    MD5STEP(F4, c, d, a, b, data[2] + 0x2ad7d2bb, 15);
+    MD5STEP(F4, b, c, d, a, data[9] + 0xeb86d391, 21);
+
+	digest[0]+=a;
+	digest[1]+=b;
+	digest[2]+=c;
+	digest[3]+=d;
+}
+
+NAMESPACE_END  // Weak
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/md5.h b/runtime/third_party/cryptopp/md5.h
new file mode 100644
index 0000000..2b3e2c3
--- /dev/null
+++ b/runtime/third_party/cryptopp/md5.h
@@ -0,0 +1,35 @@
+#ifndef CRYPTOPP_MD5_H
+#define CRYPTOPP_MD5_H
+
+#include "iterhash.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+namespace Weak1 {
+
+/// \brief MD5 message digest
+/// \sa <a href="http://www.cryptolounge.org/wiki/MD5">MD5</a>
+/// \since Crypto++ 1.0
+class MD5 : public IteratedHashWithStaticTransform<word32, LittleEndian, 64, 16, MD5>
+{
+public:
+	static void InitState(HashWordType *state);
+	static void Transform(word32 *digest, const word32 *data);
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "MD5";}
+};
+
+}
+#if CRYPTOPP_ENABLE_NAMESPACE_WEAK >= 1
+namespace Weak {using namespace Weak1;}		// import Weak1 into CryptoPP::Weak
+#else
+using namespace Weak1;	// import Weak1 into CryptoPP with warning
+#ifdef __GNUC__
+#warning "You may be using a weak algorithm that has been retained for backwards compatibility. Please '#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1' before including this .h file and prepend the class name with 'Weak::' to remove this warning."
+#else
+#pragma message("You may be using a weak algorithm that has been retained for backwards compatibility. Please '#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1' before including this .h file and prepend the class name with 'Weak::' to remove this warning.")
+#endif
+#endif
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/mdc.h b/runtime/third_party/cryptopp/mdc.h
new file mode 100644
index 0000000..68d5ab8
--- /dev/null
+++ b/runtime/third_party/cryptopp/mdc.h
@@ -0,0 +1,84 @@
+// mdc.h - originally written and placed in the public domain by Wei Dai
+
+/// \file mdc.h
+/// \brief Classes for the MDC message digest
+
+#ifndef CRYPTOPP_MDC_H
+#define CRYPTOPP_MDC_H
+
+#include "seckey.h"
+#include "secblock.h"
+#include "misc.h"
+
+// GCC cast warning
+#define HashWordPtr(x) ((HashWordType*)(void*)(x))
+#define ConstHashWordPtr(x) ((const HashWordType*)(const void*)(x))
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \tparam B BlockCipher derived class
+/// \brief MDC_Info cipher information
+template <class B>
+struct MDC_Info : public FixedBlockSize<B::DIGESTSIZE>, public FixedKeyLength<B::BLOCKSIZE>
+{
+	static std::string StaticAlgorithmName() {return std::string("MDC/")+B::StaticAlgorithmName();}
+};
+
+/// \brief MDC cipher
+/// \tparam H HashTransformation derived class
+/// \details MDC() is a construction by Peter Gutmann to turn an iterated hash function into a PRF
+/// \sa <a href="http://www.cryptopp.com/wiki/MDC">MDC</a>
+template <class H>
+class MDC : public MDC_Info<H>
+{
+	/// \brief MDC cipher encryption operation
+	class CRYPTOPP_NO_VTABLE Enc : public BlockCipherImpl<MDC_Info<H> >
+	{
+		typedef typename H::HashWordType HashWordType;
+
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params)
+		{
+			CRYPTOPP_UNUSED(params);
+			this->AssertValidKeyLength(length);
+			ConditionalByteReverse(BIG_ENDIAN_ORDER, Key(), ConstHashWordPtr(userKey), this->KEYLENGTH);
+		}
+
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+		{
+			ConditionalByteReverse(BIG_ENDIAN_ORDER, Buffer(), ConstHashWordPtr(inBlock), this->BLOCKSIZE);
+			H::Transform(Buffer(), Key());
+
+			if (xorBlock)
+			{
+				ConditionalByteReverse(BIG_ENDIAN_ORDER, Buffer(), Buffer(), this->BLOCKSIZE);
+				xorbuf(outBlock, xorBlock, m_buffer, this->BLOCKSIZE);
+			}
+			else
+			{
+				ConditionalByteReverse(BIG_ENDIAN_ORDER, HashWordPtr(outBlock), Buffer(), this->BLOCKSIZE);
+			}
+		}
+
+		bool IsPermutation() const {return false;}
+
+		unsigned int OptimalDataAlignment() const {return sizeof(HashWordType);}
+
+	private:
+		HashWordType *Key() {return HashWordPtr(m_key.data());}
+		const HashWordType *Key() const {return ConstHashWordPtr(m_key.data());}
+		HashWordType *Buffer() const {return HashWordPtr(m_buffer.data());}
+
+		// VC60 workaround: bug triggered if using FixedSizeAllocatorWithCleanup
+		FixedSizeSecBlock<byte, MDC_Info<H>::KEYLENGTH, AllocatorWithCleanup<byte> > m_key;
+		mutable FixedSizeSecBlock<byte, MDC_Info<H>::BLOCKSIZE, AllocatorWithCleanup<byte> > m_buffer;
+	};
+
+public:
+	// use BlockCipher interface
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/mersenne.h b/runtime/third_party/cryptopp/mersenne.h
new file mode 100644
index 0000000..326d911
--- /dev/null
+++ b/runtime/third_party/cryptopp/mersenne.h
@@ -0,0 +1,231 @@
+// mersenne.h - written and placed in public domain by Jeffrey Walton.
+
+/// \file mersenne.h
+/// \brief Class file for Mersenne Twister
+/// \warning MersenneTwister is suitable for Monte-Carlo simulations, where uniformaly distributed
+///  numbers are required quickly. It should not be used for cryptographic purposes.
+/// \since Crypto++ 5.6.3
+#ifndef CRYPTOPP_MERSENNE_TWISTER_H
+#define CRYPTOPP_MERSENNE_TWISTER_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Mersenne Twister class for Monte-Carlo simulations
+/// \tparam K Magic constant
+/// \tparam M Period parameter
+/// \tparam N Size of the state vector
+/// \tparam F Multiplier constant
+/// \tparam S Initial seed
+/// \details Provides the MersenneTwister implementation. The class is a header-only implementation.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \warning MersenneTwister is suitable for simulations, where uniformaly distributed numbers are
+///  required quickly. It should not be used for cryptographic purposes.
+/// \sa MT19937, MT19937ar
+/// \since Crypto++ 5.6.3
+template <unsigned int K, unsigned int M, unsigned int N, unsigned int F, word32 S>
+class MersenneTwister : public RandomNumberGenerator
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return (S==5489 ? "MT19937ar" : (S==4537 ? "MT19937" : "MT19937x")); }
+
+	~MersenneTwister() {}
+
+	/// \brief Construct a Mersenne Twister
+	/// \param seed 32-bit seed
+	/// \details Defaults to template parameter S due to changing algorithm
+	///  parameters over time
+	MersenneTwister(word32 seed = S) : m_idx(N)
+	{
+		Reset(seed);
+	}
+
+	bool CanIncorporateEntropy() const {return true;}
+
+	/// \brief Update RNG state with additional unpredictable values
+	/// \param input the entropy to add to the generator
+	/// \param length the size of the input buffer
+	/// \details MersenneTwister uses the first 32-bits of <tt>input</tt> to reseed the
+	///  generator. If fewer bytes are provided, then the seed is padded with 0's.
+	void IncorporateEntropy(const byte *input, size_t length)
+	{
+		// Handle word32 size blocks
+		FixedSizeSecBlock<word32, 1> temp;
+		temp[0] = 0;
+
+		if (length > 4)
+			length = 4;
+
+		for (size_t i=0; i<length; ++i)
+		{
+			temp[0] <<= 8;
+			temp[0] = temp[0] | input[i];
+		}
+
+		Reset(temp[0]);
+	}
+
+	/// \brief Generate random array of bytes
+	/// \param output byte buffer
+	/// \param size length of the buffer, in bytes
+	/// \details Bytes are written to output in big endian order. If output length
+	///  is not a multiple of word32, then unused bytes are not accumulated for subsequent
+	///  calls to GenerateBlock. Rather, the unused tail bytes are discarded, and the
+	///  stream is continued at the next word32 boundary from the state array.
+	void GenerateBlock(byte *output, size_t size)
+	{
+		// Handle word32 size blocks
+		FixedSizeSecBlock<word32, 1> temp;
+		for (size_t i=0; i < size/4; i++, output += 4)
+		{
+			temp[0] = NextMersenneWord();
+			std::memcpy(output, temp+0, 4);
+		}
+
+		// No tail bytes
+		if (size%4 == 0)
+			return;
+
+		// Handle tail bytes
+		temp[0] = NextMersenneWord();
+		switch (size%4)
+		{
+			case 3: output[2] = CRYPTOPP_GET_BYTE_AS_BYTE(temp[0], 1); /* fall through */
+			case 2: output[1] = CRYPTOPP_GET_BYTE_AS_BYTE(temp[0], 2); /* fall through */
+			case 1: output[0] = CRYPTOPP_GET_BYTE_AS_BYTE(temp[0], 3); break;
+
+			default: CRYPTOPP_ASSERT(0);;
+		}
+	}
+
+	/// \brief Generate a random 32-bit word in the range min to max, inclusive
+	/// \return random 32-bit word in the range min to max, inclusive
+	/// \details If the 32-bit candidate is not within the range, then it is discarded
+	///  and a new candidate is used.
+	word32 GenerateWord32(word32 min=0, word32 max=0xffffffffL)
+	{
+		const word32 range = max-min;
+		if (range == 0xffffffffL)
+			return NextMersenneWord();
+
+		const int maxBits = BitPrecision(range);
+		word32 value;
+
+		do{
+			value = Crop(NextMersenneWord(), maxBits);
+		} while (value > range);
+
+		return value+min;
+	}
+
+	/// \brief Generate and discard n bytes
+	/// \param n the number of bytes to discard, rounded up to a <tt>word32</tt> size
+	/// \details If n is not a multiple of <tt>word32</tt>, then unused bytes are
+	///  not accumulated for subsequent calls to GenerateBlock. Rather, the unused
+	///  tail bytes are discarded, and the stream is continued at the next
+	///  <tt>word32</tt> boundary from the state array.
+	void DiscardBytes(size_t n)
+	{
+		for(size_t i=0; i < RoundUpToMultipleOf(n, 4U); i++)
+			NextMersenneWord();
+	}
+
+protected:
+
+	void Reset(word32 seed)
+	{
+		m_idx = N;
+
+		m_state[0] = seed;
+		for (unsigned int i = 1; i < N+1; i++)
+			m_state[i] = word32(F * (m_state[i-1] ^ (m_state[i-1] >> 30)) + i);
+	}
+
+	/// \brief Returns the next 32-bit word from the state array
+	/// \return the next 32-bit word from the state array
+	/// \details fetches the next word frm the state array, performs bit operations on
+	///  it, and then returns the value to the caller.
+	word32 NextMersenneWord()
+	{
+		if (m_idx >= N) { Twist(); }
+
+		word32 temp = m_state[m_idx++];
+
+		temp ^= (temp >> 11);
+		temp ^= (temp << 7)  & 0x9D2C5680; // 0x9D2C5680 (2636928640)
+		temp ^= (temp << 15) & 0xEFC60000; // 0xEFC60000 (4022730752)
+
+		return temp ^ (temp >> 18);
+	}
+
+	/// \brief Performs the twist operation on the state array
+	void Twist()
+	{
+		static const word32 magic[2]={0x0UL, K};
+		word32 kk, temp;
+
+		CRYPTOPP_ASSERT(N >= M);
+		for (kk=0;kk<N-M;kk++)
+		{
+			temp = (m_state[kk] & 0x80000000)|(m_state[kk+1] & 0x7FFFFFFF);
+			m_state[kk] = m_state[kk+M] ^ (temp >> 1) ^ magic[temp & 0x1UL];
+		}
+
+		for (;kk<N-1;kk++)
+		{
+			temp = (m_state[kk] & 0x80000000)|(m_state[kk+1] & 0x7FFFFFFF);
+			m_state[kk] = m_state[kk+(M-N)] ^ (temp >> 1) ^ magic[temp & 0x1UL];
+		}
+
+		temp = (m_state[N-1] & 0x80000000)|(m_state[0] & 0x7FFFFFFF);
+		m_state[N-1] = m_state[M-1] ^ (temp >> 1) ^ magic[temp & 0x1UL];
+
+		// Reset index
+		m_idx = 0;
+
+		// Wipe temp
+		SecureWipeArray(&temp, 1);
+	}
+
+private:
+
+	/// \brief 32-bit word state array of size N
+	FixedSizeSecBlock<word32, N+1> m_state;
+	/// \brief the current index into the state array
+	word32 m_idx;
+};
+
+/// \brief Original MT19937 generator provided in the ACM paper.
+/// \details MT19937 uses 4537 as default initial seed.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \sa MT19937ar, <A HREF="http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/ARTICLES/mt.pdf">Mersenne twister:
+///  a 623-dimensionally equidistributed uniform pseudo-random number generator</A>
+/// \since Crypto++ 5.6.3
+#if CRYPTOPP_DOXYGEN_PROCESSING
+class MT19937 : public MersenneTwister<0x9908B0DF /*2567483615*/, 397, 624, 0x10DCD /*69069*/, 4537> {};
+#else
+typedef MersenneTwister<0x9908B0DF /*2567483615*/, 397, 624, 0x10DCD /*69069*/, 4537> MT19937;
+#endif
+
+/// \brief Updated MT19937 generator adapted to provide an array for initialization.
+/// \details MT19937 uses 5489 as default initial seed. Use this generator when interoperating with C++11's
+///  mt19937 class.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \sa MT19937, <A HREF="http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/MT2002/emt19937ar.html">Mersenne Twister
+///  with improved initialization</A>
+/// \since Crypto++ 5.6.3
+#if CRYPTOPP_DOXYGEN_PROCESSING
+class MT19937ar : public MersenneTwister<0x9908B0DF /*2567483615*/, 397, 624, 0x6C078965 /*1812433253*/, 5489> {};
+#else
+typedef MersenneTwister<0x9908B0DF /*2567483615*/, 397, 624, 0x6C078965 /*1812433253*/, 5489> MT19937ar;
+#endif
+
+NAMESPACE_END
+
+#endif // CRYPTOPP_MERSENNE_TWISTER_H
diff --git a/runtime/third_party/cryptopp/misc.cpp b/runtime/third_party/cryptopp/misc.cpp
new file mode 100644
index 0000000..25e7f20
--- /dev/null
+++ b/runtime/third_party/cryptopp/misc.cpp
@@ -0,0 +1,394 @@
+// misc.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4189)
+# if (CRYPTOPP_MSC_VERSION >= 1400)
+#  pragma warning(disable: 6237)
+# endif
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "misc.h"
+#include "trap.h"
+#include "words.h"
+#include "stdcpp.h"
+#include "integer.h"
+#include "secblock.h"
+
+// Hack for OpenBSD and GCC 4.2.1. I believe they are stuck at 4.2.1 due to GPLv3.
+#if defined(__OpenBSD__)
+# if defined (CRYPTOPP_GCC_VERSION) && (CRYPTOPP_GCC_VERSION < 43000)
+#  undef  CRYPTOPP_DISABLE_ASM
+#  define CRYPTOPP_DISABLE_ASM 1
+# endif
+#endif
+
+#ifndef CRYPTOPP_DISABLE_ASM
+# if defined(__SSE2__)
+#  include <emmintrin.h>
+# endif
+# if defined(__AVX__)
+#  include <immintrin.h>
+# endif
+
+# if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+#  if (CRYPTOPP_ARM_NEON_HEADER) || (CRYPTOPP_ARM_ASIMD_AVAILABLE)
+#   include <arm_neon.h>
+#  endif
+# endif
+#endif  // CRYPTOPP_DISABLE_ASM
+
+NAMESPACE_BEGIN(CryptoPP)
+
+byte* BytePtr(SecByteBlock& str)
+{
+	// Caller wants a writeable pointer
+	CRYPTOPP_ASSERT(str.empty() == false);
+
+	if (str.empty())
+		return NULLPTR;
+	return reinterpret_cast<byte*>(str.data());
+}
+
+const byte* ConstBytePtr(const SecByteBlock& str)
+{
+	if (str.empty())
+		return NULLPTR;
+	return reinterpret_cast<const byte*>(str.data());
+}
+
+size_t BytePtrSize(const SecByteBlock& str)
+{
+	return str.size();
+}
+
+// xorbuf simplified at https://github.com/weidai11/cryptopp/issues/1020
+void xorbuf(byte *buf, const byte *mask, size_t count)
+{
+	CRYPTOPP_ASSERT(buf != NULLPTR);
+	CRYPTOPP_ASSERT(mask != NULLPTR);
+	CRYPTOPP_ASSERT(count > 0);
+
+#ifndef CRYPTOPP_DISABLE_ASM
+# if defined(__AVX__)
+	while (count >= 32)
+	{
+		__m256i b = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(buf));
+		__m256i m = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(mask));
+		_mm256_storeu_si256(reinterpret_cast<__m256i*>(buf), _mm256_castps_si256(
+			_mm256_xor_ps(_mm256_castsi256_ps(b), _mm256_castsi256_ps(m))));
+		buf += 32; mask += 32; count -= 32;
+	}
+	// https://software.intel.com/en-us/articles/avoiding-avx-sse-transition-penalties
+	_mm256_zeroupper();
+# endif
+# if defined(__SSE2__)
+	while (count >= 16)
+	{
+		__m128i b = _mm_loadu_si128(reinterpret_cast<const __m128i*>(buf));
+		__m128i m = _mm_loadu_si128(reinterpret_cast<const __m128i*>(mask));
+		_mm_storeu_si128(reinterpret_cast<__m128i*>(buf), _mm_castps_si128(
+			_mm_xor_ps(_mm_castsi128_ps(b), _mm_castsi128_ps(m))));
+		buf += 16; mask += 16; count -= 16;
+	}
+# endif
+# if defined(__aarch64__) || defined(__aarch32__) || defined(_M_ARM64)
+	while (count >= 16)
+	{
+		vst1q_u8(buf, veorq_u8(vld1q_u8(buf), vld1q_u8(mask)));
+		buf += 16; mask += 16; count -= 16;
+	}
+# endif
+#endif  // CRYPTOPP_DISABLE_ASM
+
+#if CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64
+	// word64 and stride of 8 slows things down on x86_64.
+	// word64 and stride of 8 makes no difference on ARM.
+	// word64 and stride of 16 benefits PowerPC.
+	while (count >= 16)
+	{
+		word64 r[2], b[2], m[2];
+		std::memcpy(&b, buf, 16); std::memcpy(&m, mask, 16);
+
+		r[0] = b[0] ^ m[0];
+		r[1] = b[1] ^ m[1];
+		std::memcpy(buf, &r, 16);
+
+		buf += 16; mask += 16; count -= 16;
+	}
+#endif
+
+	// One of the arch specific xor's may have cleared the request
+	if (count == 0) return;
+
+	while (count >= 4)
+	{
+		word32 r, b, m;
+		std::memcpy(&b, buf, 4); std::memcpy(&m, mask, 4);
+
+		r = b ^ m;
+		std::memcpy(buf, &r, 4);
+
+		buf += 4; mask += 4; count -= 4;
+	}
+
+	for (size_t i=0; i<count; i++)
+		buf[i] ^= mask[i];
+}
+
+// xorbuf simplified at https://github.com/weidai11/cryptopp/issues/1020
+void xorbuf(byte *output, const byte *input, const byte *mask, size_t count)
+{
+	CRYPTOPP_ASSERT(output != NULLPTR);
+	CRYPTOPP_ASSERT(input != NULLPTR);
+	CRYPTOPP_ASSERT(count > 0);
+
+#ifndef CRYPTOPP_DISABLE_ASM
+# if defined(__AVX__)
+	while (count >= 32)
+	{
+		__m256i b = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(input));
+		__m256i m = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(mask));
+		_mm256_storeu_si256(reinterpret_cast<__m256i*>(output), _mm256_castps_si256(
+			_mm256_xor_ps(_mm256_castsi256_ps(b), _mm256_castsi256_ps(m))));
+		output += 32; input += 32; mask += 32; count -= 32;
+	}
+	// https://software.intel.com/en-us/articles/avoiding-avx-sse-transition-penalties
+	_mm256_zeroupper();
+# endif
+# if defined(__SSE2__)
+	while (count >= 16)
+	{
+		__m128i b = _mm_loadu_si128(reinterpret_cast<const __m128i*>(input));
+		__m128i m = _mm_loadu_si128(reinterpret_cast<const __m128i*>(mask));
+		_mm_storeu_si128(reinterpret_cast<__m128i*>(output), _mm_castps_si128(
+			_mm_xor_ps(_mm_castsi128_ps(b), _mm_castsi128_ps(m))));
+		output += 16; input += 16; mask += 16; count -= 16;
+	}
+# endif
+# if defined(__aarch64__) || defined(__aarch32__) || defined(_M_ARM64)
+	while (count >= 16)
+	{
+		vst1q_u8(output, veorq_u8(vld1q_u8(input), vld1q_u8(mask)));
+		output += 16; input += 16; mask += 16; count -= 16;
+	}
+# endif
+#endif  // CRYPTOPP_DISABLE_ASM
+
+#if CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64
+	// word64 and stride of 8 slows things down on x86_64.
+	// word64 and stride of 8 makes no difference on ARM.
+	// word64 and stride of 16 benefits PowerPC.
+	while (count >= 16)
+	{
+		word64 b[2], m[2], r[2];
+		std::memcpy(&b, input, 16); std::memcpy(&m, mask, 16);
+
+		r[0] = b[0] ^ m[0];
+		r[1] = b[1] ^ m[1];
+		std::memcpy(output, &r, 16);
+
+		output += 16; input += 16; mask += 16; count -= 16;
+	}
+#endif
+
+	// One of the arch specific xor's may have cleared the request
+	if (count == 0) return;
+
+	while (count >= 4)
+	{
+		word32 b, m, r;
+		std::memcpy(&b, input, 4); std::memcpy(&m, mask, 4);
+
+		r = b ^ m;
+		std::memcpy(output, &r, 4);
+
+		output += 4; input += 4; mask += 4; count -= 4;
+	}
+
+	for (size_t i=0; i<count; i++)
+		output[i] = input[i] ^ mask[i];
+}
+
+// VerifyBufsEqual simplified at https://github.com/weidai11/cryptopp/issues/1020
+bool VerifyBufsEqual(const byte *buf, const byte *mask, size_t count)
+{
+	CRYPTOPP_ASSERT(buf != NULLPTR);
+	CRYPTOPP_ASSERT(mask != NULLPTR);
+	// CRYPTOPP_ASSERT(count > 0);
+
+#if CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_ARM64 || CRYPTOPP_BOOL_PPC64 || CRYPTOPP_BOOL_MIPS64 || CRYPTOPP_BOOL_SPARC64
+	word64 acc64 = 0;
+	while (count >= 8)
+	{
+		word64 b, m;
+		std::memcpy(&b, buf, 8); std::memcpy(&m, mask, 8);
+		acc64 |= b ^ m;
+
+		buf += 8; mask += 8; count -= 8;
+	}
+
+	word32 acc8 = (acc64 >> 32) | (acc64 & 0xffffffff);
+	acc8 = static_cast<byte>(acc8) | static_cast<byte>(acc8 >> 8) |
+		static_cast<byte>(acc8 >> 16) | static_cast<byte>(acc8 >> 24);
+#else
+	word32 acc32 = 0;
+	while (count >= 4)
+	{
+		word32 b, m;
+		std::memcpy(&b, buf, 4); std::memcpy(&m, mask, 4);
+		acc32 |= b ^ m;
+
+		buf += 4; mask += 4; count -= 4;
+	}
+
+	word32 acc8 = acc32;
+	acc8 = static_cast<byte>(acc8) | static_cast<byte>(acc8 >> 8) |
+		static_cast<byte>(acc8 >> 16) | static_cast<byte>(acc8 >> 24);
+#endif
+
+	for (size_t i=0; i<count; i++)
+		acc8 |= buf[i] ^ mask[i];
+
+	// word32 results in this tail code on x86:
+	//   33a:  85 c0     test  %eax, %eax
+	//   33c:  0f 94 c0  sete  %al
+	//   33f:  c3        ret
+	return acc8 == 0;
+}
+
+std::string StringNarrow(const wchar_t *str, bool throwOnError)
+{
+	CRYPTOPP_ASSERT(str);
+	std::string result;
+
+	// Safer functions on Windows for C&A, https://github.com/weidai11/cryptopp/issues/55
+#if (CRYPTOPP_MSC_VERSION >= 1400)
+	size_t len=0, size=0;
+	errno_t err = 0;
+
+	//const wchar_t* ptr = str;
+	//while (*ptr++) len++;
+	len = wcslen(str)+1;
+
+	err = wcstombs_s(&size, NULLPTR, 0, str, len*sizeof(wchar_t));
+	CRYPTOPP_ASSERT(err == 0);
+	if (err != 0)
+	{
+		if (throwOnError)
+			throw InvalidArgument("StringNarrow: wcstombs_s() failed with error " + IntToString(err));
+		else
+			return std::string();
+	}
+
+	result.resize(size);
+	err = wcstombs_s(&size, &result[0], size, str, len*sizeof(wchar_t));
+	CRYPTOPP_ASSERT(err == 0);
+	if (err != 0)
+	{
+		if (throwOnError)
+			throw InvalidArgument("StringNarrow: wcstombs_s() failed with error " + IntToString(err));
+		else
+			return std::string();
+	}
+
+	// The safe routine's size includes the NULL.
+	if (!result.empty() && result[size - 1] == '\0')
+		result.erase(size - 1);
+#else
+	size_t size = wcstombs(NULLPTR, str, 0);
+	CRYPTOPP_ASSERT(size != (size_t)-1);
+	if (size == (size_t)-1)
+	{
+		if (throwOnError)
+			throw InvalidArgument("StringNarrow: wcstombs() failed");
+		else
+			return std::string();
+	}
+
+	result.resize(size);
+	size = wcstombs(&result[0], str, size);
+	CRYPTOPP_ASSERT(size != (size_t)-1);
+	if (size == (size_t)-1)
+	{
+		if (throwOnError)
+			throw InvalidArgument("StringNarrow: wcstombs() failed");
+		else
+			return std::string();
+	}
+#endif
+
+	return result;
+}
+
+std::wstring StringWiden(const char *str, bool throwOnError)
+{
+	CRYPTOPP_ASSERT(str);
+	std::wstring result;
+
+	// Safer functions on Windows for C&A, https://github.com/weidai11/cryptopp/issues/55
+#if (CRYPTOPP_MSC_VERSION >= 1400)
+	size_t len=0, size=0;
+	errno_t err = 0;
+
+	//const char* ptr = str;
+	//while (*ptr++) len++;
+	len = std::strlen(str)+1;
+
+	err = mbstowcs_s(&size, NULLPTR, 0, str, len);
+	CRYPTOPP_ASSERT(err == 0);
+	if (err != 0)
+	{
+		if (throwOnError)
+			throw InvalidArgument("StringWiden: wcstombs_s() failed with error " + IntToString(err));
+		else
+			return std::wstring();
+	}
+
+	result.resize(size);
+	err = mbstowcs_s(&size, &result[0], size, str, len);
+	CRYPTOPP_ASSERT(err == 0);
+	if (err != 0)
+	{
+		if (throwOnError)
+			throw InvalidArgument("StringWiden: wcstombs_s() failed with error " + IntToString(err));
+		else
+			return std::wstring();
+	}
+
+	// The safe routine's size includes the NULL.
+	if (!result.empty() && result[size - 1] == '\0')
+		result.erase(size - 1);
+#else
+	size_t size = mbstowcs(NULLPTR, str, 0);
+	CRYPTOPP_ASSERT(size != (size_t)-1);
+	if (size == (size_t)-1)
+	{
+		if (throwOnError)
+			throw InvalidArgument("StringWiden: mbstowcs() failed");
+		else
+			return std::wstring();
+	}
+
+	result.resize(size);
+	size = mbstowcs(&result[0], str, size);
+	CRYPTOPP_ASSERT(size != (size_t)-1);
+	if (size == (size_t)-1)
+	{
+		if (throwOnError)
+			throw InvalidArgument("StringWiden: mbstowcs() failed");
+		else
+			return std::wstring();
+	}
+#endif
+
+	return result;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/misc.h b/runtime/third_party/cryptopp/misc.h
new file mode 100644
index 0000000..2e2bd5a
--- /dev/null
+++ b/runtime/third_party/cryptopp/misc.h
@@ -0,0 +1,3222 @@
+// misc.h - originally written and placed in the public domain by Wei Dai
+
+/// \file misc.h
+/// \brief Utility functions for the Crypto++ library.
+
+#ifndef CRYPTOPP_MISC_H
+#define CRYPTOPP_MISC_H
+
+#include "config.h"
+
+#include "cryptlib.h"
+#include "secblockfwd.h"
+#include "smartptr.h"
+#include "stdcpp.h"
+#include "trap.h"
+
+#if !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+#if (CRYPTOPP_MSC_VERSION)
+# pragma warning(push)
+# pragma warning(disable: 4146 4514)
+# if (CRYPTOPP_MSC_VERSION >= 1400)
+#  pragma warning(disable: 6326)
+# endif
+#endif
+
+// Issue 340 and Issue 793
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wconversion"
+# pragma GCC diagnostic ignored "-Wsign-conversion"
+# pragma GCC diagnostic ignored "-Wunused-function"
+#endif
+
+#ifdef CRYPTOPP_MSC_VERSION
+	#if CRYPTOPP_MSC_VERSION >= 1400
+		// VC2005 workaround: disable declarations that conflict with winnt.h
+		#define _interlockedbittestandset CRYPTOPP_DISABLED_INTRINSIC_1
+		#define _interlockedbittestandreset CRYPTOPP_DISABLED_INTRINSIC_2
+		#define _interlockedbittestandset64 CRYPTOPP_DISABLED_INTRINSIC_3
+		#define _interlockedbittestandreset64 CRYPTOPP_DISABLED_INTRINSIC_4
+		#include <intrin.h>
+		#undef _interlockedbittestandset
+		#undef _interlockedbittestandreset
+		#undef _interlockedbittestandset64
+		#undef _interlockedbittestandreset64
+		#define CRYPTOPP_FAST_ROTATE(x) 1
+	#elif CRYPTOPP_MSC_VERSION >= 1300
+		#define CRYPTOPP_FAST_ROTATE(x) ((x) == 32 | (x) == 64)
+	#else
+		#define CRYPTOPP_FAST_ROTATE(x) ((x) == 32)
+	#endif
+#elif (defined(__MWERKS__) && TARGET_CPU_PPC) || \
+	(defined(__GNUC__) && (defined(_ARCH_PWR2) || defined(_ARCH_PWR) || defined(_ARCH_PPC) || defined(_ARCH_PPC64) || defined(_ARCH_COM)))
+	#define CRYPTOPP_FAST_ROTATE(x) ((x) == 32)
+#elif defined(__GNUC__) && (CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86)	// depend on GCC's peephole optimization to generate rotate instructions
+	#define CRYPTOPP_FAST_ROTATE(x) 1
+#else
+	#define CRYPTOPP_FAST_ROTATE(x) 0
+#endif
+
+#ifdef __BORLANDC__
+#include <mem.h>
+#include <stdlib.h>
+#endif
+
+#if (defined(__GNUC__) || defined(__clang__)) && defined(__linux__)
+#define CRYPTOPP_BYTESWAP_AVAILABLE 1
+#include <byteswap.h>
+#endif
+
+// Limit to ARM A-32. Aarch64 is failing self tests.
+#if defined(__arm__) && (defined(__GNUC__) || defined(__clang__)) && (__ARM_ARCH >= 6)
+#define CRYPTOPP_ARM_BYTEREV_AVAILABLE 1
+#endif
+
+// Limit to ARM A-32. Aarch64 is failing self tests.
+#if defined(__arm__) && (defined(__GNUC__) || defined(__clang__)) && (__ARM_ARCH >= 7)
+#define CRYPTOPP_ARM_BITREV_AVAILABLE 1
+#endif
+
+#if defined(__BMI__)
+# if defined(CRYPTOPP_GCC_COMPATIBLE)
+#  include <x86intrin.h>
+# endif
+# include <immintrin.h>
+#endif  // BMI
+
+// More LLVM bullshit. Apple Clang 6.0 does not define them.
+// Later version of Clang defines them and results in warnings.
+#if defined(__clang__)
+# ifndef _blsr_u32
+#  define _blsr_u32 __blsr_u32
+# endif
+# ifndef _blsr_u64
+#  define _blsr_u64 __blsr_u64
+# endif
+# ifndef _tzcnt_u32
+#  define _tzcnt_u32 __tzcnt_u32
+# endif
+# ifndef _tzcnt_u64
+#  define _tzcnt_u64 __tzcnt_u64
+# endif
+#endif
+
+#endif  // CRYPTOPP_DOXYGEN_PROCESSING
+
+#if CRYPTOPP_DOXYGEN_PROCESSING
+/// \brief The maximum value of a machine word
+/// \details <tt>SIZE_MAX</tt> provides the maximum value of a machine word. The value
+///  is <tt>0xffffffff</tt> on 32-bit targets, and <tt>0xffffffffffffffff</tt> on 64-bit
+///  targets.
+/// \details If <tt>SIZE_MAX</tt> is not defined, then <tt>__SIZE_MAX__</tt> is used if
+///  defined. If not defined, then <tt>SIZE_T_MAX</tt> is used if defined. If not defined,
+///  then the library uses <tt>std::numeric_limits<size_t>::max()</tt>.
+/// \details The library prefers <tt>__SIZE_MAX__</tt> or <tt>__SIZE_T_MAX__</tt> because
+///  they are effectively <tt>constexpr</tt> that is optimized well by all compilers.
+///  <tt>std::numeric_limits<size_t>::max()</tt> is not always a <tt>constexpr</tt>, and
+///  it is not always optimized well.
+#  define SIZE_MAX ...
+#else
+// Its amazing portability problems still plague this simple concept in 2015.
+// http://stackoverflow.com/questions/30472731/which-c-standard-header-defines-size-max
+// Avoid NOMINMAX macro on Windows. http://support.microsoft.com/en-us/kb/143208
+#ifndef SIZE_MAX
+# if defined(__SIZE_MAX__)
+#  define SIZE_MAX __SIZE_MAX__
+# elif defined(SIZE_T_MAX)
+#  define SIZE_MAX SIZE_T_MAX
+# elif defined(__SIZE_TYPE__)
+#  define SIZE_MAX (~(__SIZE_TYPE__)0)
+# else
+#  define SIZE_MAX ((std::numeric_limits<size_t>::max)())
+# endif
+#endif
+
+#endif // CRYPTOPP_DOXYGEN_PROCESSING
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Forward declaration for IntToString specialization
+class Integer;
+
+// ************** compile-time assertion ***************
+
+#if CRYPTOPP_DOXYGEN_PROCESSING
+/// \brief Compile time assertion
+/// \param expr the expression to evaluate
+/// \details Asserts the expression <tt>expr</tt> during compile. If C++14 and
+///  N3928 are available, then C++14 <tt>static_assert</tt> is used. Otherwise,
+///  a <tt>CompileAssert</tt> structure is used. When the structure is used
+///  a negative-sized array triggers the assert at compile time.
+# define CRYPTOPP_COMPILE_ASSERT(expr) { ... }
+#elif defined(CRYPTOPP_CXX17_STATIC_ASSERT)
+# define CRYPTOPP_COMPILE_ASSERT(expr) static_assert(expr)
+#else // CRYPTOPP_DOXYGEN_PROCESSING
+template <bool b>
+struct CompileAssert
+{
+	static char dummy[2*b-1];
+};
+
+#define CRYPTOPP_COMPILE_ASSERT(assertion) CRYPTOPP_COMPILE_ASSERT_INSTANCE(assertion, __LINE__)
+#define CRYPTOPP_ASSERT_JOIN(X, Y) CRYPTOPP_DO_ASSERT_JOIN(X, Y)
+#define CRYPTOPP_DO_ASSERT_JOIN(X, Y) X##Y
+
+#if defined(CRYPTOPP_EXPORTS) || defined(CRYPTOPP_IMPORTS)
+# define CRYPTOPP_COMPILE_ASSERT_INSTANCE(assertion, instance)
+#else
+# if defined(__GNUC__) || defined(__clang__)
+#  define CRYPTOPP_COMPILE_ASSERT_INSTANCE(assertion, instance) \
+       static CompileAssert<(assertion)> \
+       CRYPTOPP_ASSERT_JOIN(cryptopp_CRYPTOPP_ASSERT_, instance) __attribute__ ((unused))
+# else
+#  define CRYPTOPP_COMPILE_ASSERT_INSTANCE(assertion, instance) \
+       static CompileAssert<(assertion)> \
+       CRYPTOPP_ASSERT_JOIN(cryptopp_CRYPTOPP_ASSERT_, instance)
+# endif // GCC or Clang
+#endif
+
+#endif // CRYPTOPP_DOXYGEN_PROCESSING
+
+// ************** count elements in an array ***************
+
+#if CRYPTOPP_DOXYGEN_PROCESSING
+/// \brief Counts elements in an array
+/// \param arr an array of elements
+/// \details COUNTOF counts elements in an array. On Windows COUNTOF(x) is defined
+///  to <tt>_countof(x)</tt> to ensure correct results for pointers.
+/// \note COUNTOF does not produce correct results with pointers, and an array must be used.
+///  <tt>sizeof(x)/sizeof(x[0])</tt> suffers the same problem. The risk is eliminated by using
+///  <tt>_countof(x)</tt> on Windows. Windows will provide the immunity for other platforms.
+# define COUNTOF(arr)
+#else
+// VS2005 added _countof
+#ifndef COUNTOF
+# if defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION >= 1400)
+#  define COUNTOF(x) _countof(x)
+# else
+#  define COUNTOF(x) (sizeof(x)/sizeof(x[0]))
+# endif
+#endif // COUNTOF
+#endif // CRYPTOPP_DOXYGEN_PROCESSING
+
+// ************** misc classes ***************
+
+/// \brief An Empty class
+/// \details The Empty class can be used as a template parameter <tt>BASE</tt> when no base class exists.
+class CRYPTOPP_DLL Empty
+{
+};
+
+#if !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+template <class BASE1, class BASE2>
+class CRYPTOPP_NO_VTABLE TwoBases : public BASE1, public BASE2
+{
+};
+
+template <class BASE1, class BASE2, class BASE3>
+class CRYPTOPP_NO_VTABLE ThreeBases : public BASE1, public BASE2, public BASE3
+{
+};
+#endif // CRYPTOPP_DOXYGEN_PROCESSING
+
+/// \tparam T class or type
+/// \brief Uses encapsulation to hide an object in derived classes
+/// \details The object T is declared as protected.
+template <class T>
+class ObjectHolder
+{
+protected:
+	T m_object;
+};
+
+/// \brief Ensures an object is not copyable
+/// \details NotCopyable ensures an object is not copyable by making the
+///  copy constructor and assignment operator private. Deleters are used
+///  under C++11.
+/// \sa Clonable class
+class NotCopyable
+{
+public:
+	NotCopyable() {}
+#if CRYPTOPP_CXX11_DELETED_FUNCTIONS
+	NotCopyable(const NotCopyable &) = delete;
+	void operator=(const NotCopyable &) = delete;
+#else
+private:
+	NotCopyable(const NotCopyable &);
+	void operator=(const NotCopyable &);
+#endif
+};
+
+/// \brief An object factory function
+/// \tparam T class or type
+/// \details NewObject overloads operator()().
+template <class T>
+struct NewObject
+{
+	T* operator()() const {return new T;}
+};
+
+#if CRYPTOPP_DOXYGEN_PROCESSING
+/// \brief A memory barrier
+/// \details MEMORY_BARRIER attempts to ensure reads and writes are completed
+///  in the absence of a language synchronization point. It is used by the
+///  Singleton class if the compiler supports it. The barrier is provided at the
+///  customary places in a double-checked initialization.
+/// \details Internally, MEMORY_BARRIER uses <tt>std::atomic_thread_fence</tt> if
+///  C++11 atomics are available. Otherwise, <tt>intrinsic(_ReadWriteBarrier)</tt>,
+///  <tt>_ReadWriteBarrier()</tt> or <tt>__asm__("" ::: "memory")</tt> is used.
+#define MEMORY_BARRIER ...
+#else
+#if defined(CRYPTOPP_CXX11_ATOMIC)
+# define MEMORY_BARRIER() std::atomic_thread_fence(std::memory_order_acq_rel)
+#elif (CRYPTOPP_MSC_VERSION >= 1400)
+# pragma intrinsic(_ReadWriteBarrier)
+# define MEMORY_BARRIER() _ReadWriteBarrier()
+#elif defined(__INTEL_COMPILER)
+# define MEMORY_BARRIER() __memory_barrier()
+#elif defined(__GNUC__) || defined(__clang__)
+# define MEMORY_BARRIER() __asm__ __volatile__ ("" ::: "memory")
+#else
+# define MEMORY_BARRIER()
+#endif
+#endif // CRYPTOPP_DOXYGEN_PROCESSING
+
+/// \brief Restricts the instantiation of a class to one static object without locks
+/// \tparam T the class or type
+/// \tparam F the object factory for T
+/// \tparam instance an instance counter for the class object
+/// \details This class safely initializes a static object in a multi-threaded environment. For C++03
+///  and below it will do so without using locks for portability. If two threads call Ref() at the same
+///  time, they may get back different references, and one object may end up being memory leaked. This
+///  is by design and it avoids a subtle initialization problem in a multi-threaded environment with thread
+///  local storage on early Windows platforms, like Windows XP and Windows 2003.
+/// \details For C++11 and above, a standard double-checked locking pattern with thread fences
+///  are used. The locks and fences are standard and do not hinder portability.
+/// \details Microsoft's C++11 implementation provides the necessary primitive support on Windows Vista and
+///  above when using Visual Studio 2015 (<tt>cl.exe</tt> version 19.00). If C++11 is desired, you should
+///  set <tt>WINVER</tt> or <tt>_WIN32_WINNT</tt> to 0x600 (or above), and compile with Visual Studio 2015.
+/// \sa <A HREF="http://preshing.com/20130930/double-checked-locking-is-fixed-in-cpp11/">Double-Checked Locking
+///  is Fixed In C++11</A>, <A HREF="http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2008/n2660.htm">Dynamic
+///  Initialization and Destruction with Concurrency</A> and
+///  <A HREF="http://msdn.microsoft.com/en-us/library/6yh4a9k1.aspx">Thread Local Storage (TLS)</A> on MSDN.
+/// \since Crypto++ 5.2
+template <class T, class F = NewObject<T>, int instance=0>
+class Singleton
+{
+public:
+	Singleton(F objectFactory = F()) : m_objectFactory(objectFactory) {}
+
+	// prevent this function from being inlined
+	CRYPTOPP_NOINLINE const T & Ref(CRYPTOPP_NOINLINE_DOTDOTDOT) const;
+
+private:
+	F m_objectFactory;
+};
+
+/// \brief Return a reference to the inner Singleton object
+/// \tparam T the class or type
+/// \tparam F the object factory for T
+/// \tparam instance an instance counter for the class object
+/// \details Ref() is used to create the object using the object factory. The
+///  object is only created once with the limitations discussed in the class documentation.
+/// \sa <A HREF="http://preshing.com/20130930/double-checked-locking-is-fixed-in-cpp11/">Double-Checked Locking is Fixed In C++11</A>
+/// \since Crypto++ 5.2
+template <class T, class F, int instance>
+  const T & Singleton<T, F, instance>::Ref(CRYPTOPP_NOINLINE_DOTDOTDOT) const
+{
+#if defined(CRYPTOPP_CXX11_ATOMIC) && defined(CRYPTOPP_CXX11_SYNCHRONIZATION) && defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static std::mutex s_mutex;
+	static std::atomic<T*> s_pObject;
+
+	T *p = s_pObject.load(std::memory_order_relaxed);
+	std::atomic_thread_fence(std::memory_order_acquire);
+
+	if (p)
+		return *p;
+
+	std::lock_guard<std::mutex> lock(s_mutex);
+	p = s_pObject.load(std::memory_order_relaxed);
+	std::atomic_thread_fence(std::memory_order_acquire);
+
+	if (p)
+		return *p;
+
+	T *newObject = m_objectFactory();
+	std::atomic_thread_fence(std::memory_order_release);
+	s_pObject.store(newObject, std::memory_order_relaxed);
+
+	return *newObject;
+#else
+	static volatile simple_ptr<T> s_pObject;
+	T *p = s_pObject.m_p;
+	MEMORY_BARRIER();
+
+	if (p)
+		return *p;
+
+	T *newObject = m_objectFactory();
+	p = s_pObject.m_p;
+	MEMORY_BARRIER();
+
+	if (p)
+	{
+		delete newObject;
+		return *p;
+	}
+
+	s_pObject.m_p = newObject;
+	MEMORY_BARRIER();
+
+	return *newObject;
+#endif
+}
+
+// ************** misc functions ***************
+
+/// \brief Create a pointer with an offset
+/// \tparam PTR a pointer type
+/// \tparam OFF a size type
+/// \param pointer a pointer
+/// \param offset a offset into the pointer
+/// \details PtrAdd can be used to squash Clang and GCC
+///  UBsan findings for pointer addition and subtraction.
+template <typename PTR, typename OFF>
+inline PTR PtrAdd(PTR pointer, OFF offset)
+{
+	return pointer+static_cast<ptrdiff_t>(offset);
+}
+
+/// \brief Create a pointer with an offset
+/// \tparam PTR a pointer type
+/// \tparam OFF a size type
+/// \param pointer a pointer
+/// \param offset a offset into the pointer
+/// \details PtrSub can be used to squash Clang and GCC
+///  UBsan findings for pointer addition and subtraction.
+template <typename PTR, typename OFF>
+inline PTR PtrSub(PTR pointer, OFF offset)
+{
+	return pointer-static_cast<ptrdiff_t>(offset);
+}
+
+/// \brief Determine pointer difference
+/// \tparam PTR a pointer type
+/// \param pointer1 the first pointer
+/// \param pointer2 the second pointer
+/// \details PtrDiff can be used to squash Clang and GCC
+///  UBsan findings for pointer addition and subtraction.
+///  pointer1 and pointer2 must point to the same object or
+///  array (or one past the end), and yields the number of
+///  elements (not bytes) difference.
+template <typename PTR>
+inline ptrdiff_t PtrDiff(const PTR pointer1, const PTR pointer2)
+{
+	return pointer1 - pointer2;
+}
+
+/// \brief Determine pointer difference
+/// \tparam PTR a pointer type
+/// \param pointer1 the first pointer
+/// \param pointer2 the second pointer
+/// \details PtrByteDiff can be used to squash Clang and GCC
+///  UBsan findings for pointer addition and subtraction.
+///  pointer1 and pointer2 must point to the same object or
+///  array (or one past the end), and yields the number of
+///  bytes (not elements) difference.
+template <typename PTR>
+inline size_t PtrByteDiff(const PTR pointer1, const PTR pointer2)
+{
+	return (size_t)(reinterpret_cast<uintptr_t>(pointer1) - reinterpret_cast<uintptr_t>(pointer2));
+}
+
+/// \brief Pointer to the first element of a string
+/// \param str string
+/// \details BytePtr returns NULL pointer for an empty string.
+/// \return Pointer to the first element of a string
+/// \since Crypto++ 8.0
+inline byte* BytePtr(std::string& str)
+{
+	// Caller wants a writable pointer
+	CRYPTOPP_ASSERT(str.empty() == false);
+
+	if (str.empty())
+		return NULLPTR;
+	return reinterpret_cast<byte*>(&str[0]);
+}
+
+/// \brief Pointer to the first element of a string
+/// \param str SecByteBlock
+/// \details BytePtr returns NULL pointer for an empty string.
+/// \return Pointer to the first element of a string
+/// \since Crypto++ 8.3
+byte* BytePtr(SecByteBlock& str);
+
+/// \brief Const pointer to the first element of a string
+/// \param str string
+/// \details ConstBytePtr returns non-NULL pointer for an empty string.
+/// \return Pointer to the first element of a string
+/// \since Crypto++ 8.0
+inline const byte* ConstBytePtr(const std::string& str)
+{
+	if (str.empty())
+		return NULLPTR;
+	return reinterpret_cast<const byte*>(&str[0]);
+}
+
+/// \brief Const pointer to the first element of a string
+/// \param str SecByteBlock
+/// \details ConstBytePtr returns non-NULL pointer for an empty string.
+/// \return Pointer to the first element of a string
+/// \since Crypto++ 8.3
+const byte* ConstBytePtr(const SecByteBlock& str);
+
+/// \brief Size of a string
+/// \param str string
+/// \return size of a string
+/// \since Crypto++ 8.3
+inline size_t BytePtrSize(const std::string& str)
+{
+	return str.size();
+}
+
+/// \brief Size of a string
+/// \param str SecByteBlock
+/// \return size of a string
+/// \since Crypto++ 8.3
+size_t BytePtrSize(const SecByteBlock& str);
+
+/// \brief Integer value
+/// \details EnumToInt avoids C++20 enum-enum conversion
+///  warnings under GCC and Clang. C++11 and above use a
+///  constexpr function. C++03 and below use a macro due
+///  to [lack of] constexpr-ness in early versions of C++.
+/// \since Crypto++ 8.6
+#if (CRYPTOPP_CXX11_CONSTEXPR)
+template <typename T>
+constexpr int EnumToInt(T v) {
+	return static_cast<int>(v);
+}
+#else
+#  define EnumToInt(v) static_cast<int>(v)
+#endif
+
+#if (!__STDC_WANT_SECURE_LIB__ && !defined(_MEMORY_S_DEFINED)) || defined(CRYPTOPP_WANT_SECURE_LIB)
+
+/// \brief Bounds checking replacement for memcpy()
+/// \param dest pointer to the destination memory block
+/// \param sizeInBytes size of the destination memory block, in bytes
+/// \param src pointer to the source memory block
+/// \param count the number of bytes to copy
+/// \throw InvalidArgument
+/// \details ISO/IEC TR-24772 provides bounds checking interfaces for potentially
+///  unsafe functions like memcpy(), strcpy() and memmove(). However,
+///  not all standard libraries provides them, like Glibc. The library's
+///  memcpy_s() is a near-drop in replacement. Its only a near-replacement
+///  because the library's version throws an InvalidArgument on a bounds violation.
+/// \details memcpy_s() and memmove_s() are guarded by __STDC_WANT_SECURE_LIB__.
+///  If __STDC_WANT_SECURE_LIB__ is not defined or defined to 0, then the library
+///  makes memcpy_s() and memmove_s() available. The library will also optionally
+///  make the symbols available if <tt>CRYPTOPP_WANT_SECURE_LIB</tt> is defined.
+///  <tt>CRYPTOPP_WANT_SECURE_LIB</tt> is in config.h, but it is disabled by default.
+/// \details memcpy_s() will assert the pointers src and dest are not NULL
+///  in debug builds. Passing NULL for either pointer is undefined behavior.
+inline void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t count)
+{
+	// Safer functions on Windows for C&A, http://github.com/weidai11/cryptopp/issues/55
+
+	// Pointers must be valid; otherwise undefined behavior
+	CRYPTOPP_ASSERT(dest != NULLPTR); CRYPTOPP_ASSERT(src != NULLPTR);
+	// Restricted pointers. We want to check ranges, but it is not clear how to do it.
+	CRYPTOPP_ASSERT(src != dest);
+	// Destination buffer must be large enough to satisfy request
+	CRYPTOPP_ASSERT(sizeInBytes >= count);
+
+	if (count > sizeInBytes)
+		throw InvalidArgument("memcpy_s: buffer overflow");
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4996)
+# if (CRYPTOPP_MSC_VERSION >= 1400)
+#  pragma warning(disable: 6386)
+# endif
+#endif
+	if (src != NULLPTR && dest != NULLPTR)
+		std::memcpy(dest, src, count);
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+}
+
+/// \brief Bounds checking replacement for memmove()
+/// \param dest pointer to the destination memory block
+/// \param sizeInBytes size of the destination memory block, in bytes
+/// \param src pointer to the source memory block
+/// \param count the number of bytes to copy
+/// \throw InvalidArgument
+/// \details ISO/IEC TR-24772 provides bounds checking interfaces for potentially
+///  unsafe functions like memcpy(), strcpy() and memmove(). However,
+///  not all standard libraries provides them, like Glibc. The library's
+///  memmove_s() is a near-drop in replacement. Its only a near-replacement
+///  because the library's version throws an InvalidArgument on a bounds violation.
+/// \details memcpy_s() and memmove_s() are guarded by __STDC_WANT_SECURE_LIB__.
+///  If __STDC_WANT_SECURE_LIB__ is not defined or defined to 0, then the library
+///  makes memcpy_s() and memmove_s() available. The library will also optionally
+///  make the symbols available if <tt>CRYPTOPP_WANT_SECURE_LIB</tt> is defined.
+///  <tt>CRYPTOPP_WANT_SECURE_LIB</tt> is in config.h, but it is disabled by default.
+/// \details memmove_s() will assert the pointers src and dest are not NULL
+///  in debug builds. Passing NULL for either pointer is undefined behavior.
+inline void memmove_s(void *dest, size_t sizeInBytes, const void *src, size_t count)
+{
+	// Safer functions on Windows for C&A, http://github.com/weidai11/cryptopp/issues/55
+
+	// Pointers must be valid; otherwise undefined behavior
+	CRYPTOPP_ASSERT(dest != NULLPTR); CRYPTOPP_ASSERT(src != NULLPTR);
+	// Destination buffer must be large enough to satisfy request
+	CRYPTOPP_ASSERT(sizeInBytes >= count);
+
+	if (count > sizeInBytes)
+		throw InvalidArgument("memmove_s: buffer overflow");
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4996)
+# if (CRYPTOPP_MSC_VERSION >= 1400)
+#  pragma warning(disable: 6386)
+# endif
+#endif
+	if (src != NULLPTR && dest != NULLPTR)
+		std::memmove(dest, src, count);
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+}
+
+#if __BORLANDC__ >= 0x620
+// C++Builder 2010 workaround: can't use memcpy_s
+// because it doesn't allow 0 lengths
+# define memcpy_s CryptoPP::memcpy_s
+# define memmove_s CryptoPP::memmove_s
+#endif
+
+#endif // __STDC_WANT_SECURE_LIB__
+
+/// \brief Swaps two variables which are arrays
+/// \tparam T class or type
+/// \param a the first value
+/// \param b the second value
+/// \details C++03 does not provide support for <tt>std::swap(__m128i a, __m128i b)</tt>
+///  because <tt>__m128i</tt> is an <tt>unsigned long long[2]</tt>. Most compilers
+///  support it out of the box, but Sun Studio C++ compilers 12.2 and 12.3 do not.
+/// \sa <A HREF="http://stackoverflow.com/q/38417413">How to swap two __m128i variables
+///  in C++03 given its an opaque type and an array?</A> on Stack Overflow.
+template <class T>
+inline void vec_swap(T& a, T& b)
+{
+	// __m128i is an unsigned long long[2], and support for swapping it was
+	// not added until C++11. SunCC 12.1 - 12.3 fail to consume the swap; while
+	// SunCC 12.4 consumes it without -std=c++11.
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x5120)
+	T t;
+	t=a, a=b, b=t;
+#else
+	std::swap(a, b);
+#endif
+}
+
+/// \brief Memory block initializer
+/// \param ptr pointer to the memory block being written
+/// \param val the integer value to write for each byte
+/// \param num the size of the source memory block, in bytes
+/// \details Internally the function calls memset with the value <tt>val</tt>.
+///  memset_z can be used to initialize a freshly allocated memory block.
+///  To zeroize a memory block on destruction use <tt>SecureWipeBuffer</tt>.
+/// \return the pointer to the memory block
+/// \sa SecureWipeBuffer
+inline void * memset_z(void *ptr, int val, size_t num)
+{
+// avoid extraneous warning on GCC 4.3.2 Ubuntu 8.10
+#if CRYPTOPP_GCC_VERSION >= 30001 || CRYPTOPP_LLVM_CLANG_VERSION >= 20800 || \
+    CRYPTOPP_APPLE_CLANG_VERSION >= 30000
+	if (__builtin_constant_p(num) && num==0)
+		return ptr;
+#endif
+	return std::memset(ptr, val, num);
+}
+
+/// \brief Replacement function for std::min
+/// \tparam T class or type
+/// \param a the first value
+/// \param b the second value
+/// \return the minimum value based on a comparison of <tt>b \< a</tt> using <tt>operator\<</tt>
+/// \details STDMIN was provided because the library could not easily use std::min or std::max in Windows or Cygwin 1.1.0
+template <class T> inline const T& STDMIN(const T& a, const T& b)
+{
+	return b < a ? b : a;
+}
+
+/// \brief Replacement function for std::max
+/// \tparam T class or type
+/// \param a the first value
+/// \param b the second value
+/// \return the minimum value based on a comparison of <tt>a \< b</tt> using <tt>operator\<</tt>
+/// \details STDMAX was provided because the library could not easily use std::min or std::max in Windows or Cygwin 1.1.0
+template <class T> inline const T& STDMAX(const T& a, const T& b)
+{
+	return a < b ? b : a;
+}
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4389)
+#endif
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wstrict-overflow"
+# if (CRYPTOPP_LLVM_CLANG_VERSION >= 20800) || (CRYPTOPP_APPLE_CLANG_VERSION >= 30000)
+#  pragma GCC diagnostic ignored "-Wtautological-compare"
+# elif (CRYPTOPP_GCC_VERSION >= 40300)
+#  pragma GCC diagnostic ignored "-Wtype-limits"
+# endif
+#endif
+
+/// \brief Safe comparison of values that could be negative and incorrectly promoted
+/// \tparam T1 class or type
+/// \tparam T2 class or type
+/// \param a the first value
+/// \param b the second value
+/// \return the minimum value based on a comparison a and b using <tt>operator&lt;</tt>.
+/// \details The comparison <tt>b \< a</tt> is performed and the value returned is type T1.
+template <class T1, class T2> inline const T1 UnsignedMin(const T1& a, const T2& b)
+{
+	CRYPTOPP_COMPILE_ASSERT((sizeof(T1)<=sizeof(T2) && T2(-1)>0) || (sizeof(T1)>sizeof(T2) && T1(-1)>0));
+	CRYPTOPP_COMPILE_ASSERT(std::numeric_limits<T1>::is_signed == false);
+	CRYPTOPP_COMPILE_ASSERT(std::numeric_limits<T2>::is_signed == false);
+
+	if (sizeof(T1)<=sizeof(T2))
+		return b < (T2)a ? (T1)b : a;
+	else
+		return (T1)b < a ? (T1)b : a;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \tparam T1 class or type
+/// \tparam T2 class or type
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function returns false,
+///  then \p to is undefined and should not be used.
+/// \note for integral conversions, a template specialization should be provided. The specialization
+///  will perform more efficiently, and avoid warnings for truncation and sign compares.
+template <class T1, class T2>
+inline bool SafeConvert(T1 from, T2 &to)
+{
+	to = static_cast<T2>(from);
+	if (from != to || (from > 0) != (to > 0))
+		return false;
+	return true;
+}
+
+// The following specializations are the product of {word32, sword32, word64, sword64} ->
+// {word32, sword32, word64, sword64}. There are 16 of them, but we can omit specializations
+// of {word64} -> {word64}, {word32} -> {word32}, etc.
+//
+// The list below proceeds to list the conversion to word64 (3 each), followed by
+// sword64 (3 each), followed by word32 (3 each), and finally follwed by sword32 (3 each).
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(sword64 from, word64 &to)
+{
+	if (from < 0)
+		return false;
+	to = static_cast<word64>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(word32 from, word64 &to)
+{
+	to = static_cast<word64>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(sword32 from, word64 &to)
+{
+	if (from < 0)
+		return false;
+	to = static_cast<word64>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(word64 from, sword64 &to)
+{
+	if (from > static_cast<word64>((std::numeric_limits<sword64>::max)()))
+		return false;
+	to = static_cast<sword64>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(word32 from, sword64 &to)
+{
+	to = static_cast<sword64>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(sword32 from, sword64 &to)
+{
+	to = static_cast<sword64>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(word64 from, word32 &to)
+{
+	if (from > static_cast<word64>((std::numeric_limits<word32>::max)()))
+		return false;
+	to = static_cast<word32>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(sword64 from, word32 &to)
+{
+	if (from < 0)
+		return false;
+	else if (from > static_cast<sword64>((std::numeric_limits<word32>::max)()))
+		return false;
+	to = static_cast<word32>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(sword32 from, word32 &to)
+{
+	if (from < 0)
+		return false;
+	to = static_cast<word32>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(word64 from, sword32 &to)
+{
+	if (from > static_cast<word64>((std::numeric_limits<sword32>::max)()))
+		return false;
+	to = static_cast<sword32>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(sword64 from, sword32 &to)
+{
+	if (from > static_cast<sword64>((std::numeric_limits<sword32>::max)()))
+		return false;
+	else if (from < static_cast<sword64>((std::numeric_limits<sword32>::min)()))
+		return false;
+	to = static_cast<sword32>(from);
+	return true;
+}
+
+/// \brief Perform a conversion from \p from to \p to
+/// \param from the first value
+/// \param to the second value
+/// \return true if its safe to convert from \p from to \p to, false otherwise.
+/// \details if the function returns true, then it is safe to use \p to. If the function
+///  returns false, then \p to is undefined and should not be used.
+/// \since Crypto++ 8.8
+template<>
+inline bool SafeConvert(word32 from, sword32 &to)
+{
+	if (from > static_cast<word32>((std::numeric_limits<sword32>::max)()))
+		return false;
+	to = static_cast<sword32>(from);
+	return true;
+}
+
+/// \brief Converts a value to a string
+/// \tparam T class or type
+/// \param value the value to convert
+/// \param base the base to use during the conversion
+/// \return the string representation of value in base.
+template <class T>
+std::string IntToString(T value, unsigned int base = 10)
+{
+	// Hack... set the high bit for uppercase.
+	const unsigned int HIGH_BIT = (1U << 31);
+	const char CH = !!(base & HIGH_BIT) ? 'A' : 'a';
+	base &= ~HIGH_BIT;
+
+	CRYPTOPP_ASSERT(base >= 2);
+	if (value == 0)
+		return "0";
+
+	bool negate = false;
+	if (value < 0)
+	{
+		negate = true;
+		value = 0-value;	// VC .NET does not like -a
+	}
+	std::string result;
+	while (value > 0)
+	{
+		T digit = value % base;
+		result = char((digit < 10 ? '0' : (CH - 10)) + digit) + result;
+		value /= base;
+	}
+	if (negate)
+		result = "-" + result;
+	return result;
+}
+
+/// \brief Converts an unsigned value to a string
+/// \param value the value to convert
+/// \param base the base to use during the conversion
+/// \return the string representation of value in base.
+/// \details this template function specialization was added to suppress
+///  Coverity findings on IntToString() with unsigned types.
+template <> CRYPTOPP_DLL
+std::string IntToString<word64>(word64 value, unsigned int base);
+
+/// \brief Converts an Integer to a string
+/// \param value the Integer to convert
+/// \param base the base to use during the conversion
+/// \return the string representation of value in base.
+/// \details This is a template specialization of IntToString(). Use it
+///  like IntToString():
+/// <pre>
+///  // Print integer in base 10
+///  Integer n...
+///  std::string s = IntToString(n, 10);
+/// </pre>
+/// \details The string is presented with lowercase letters by default. A
+///  hack is available to switch to uppercase letters without modifying
+///  the function signature.
+/// <pre>
+///  // Print integer in base 16, uppercase letters
+///  Integer n...
+///  const unsigned int UPPER = (1 << 31);
+///  std::string s = IntToString(n, (UPPER | 16));</pre>
+template <> CRYPTOPP_DLL
+std::string IntToString<Integer>(Integer value, unsigned int base);
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic pop
+#endif
+
+#define RETURN_IF_NONZERO(x) size_t returnedValue = x; if (returnedValue) return returnedValue
+
+// this version of the macro is fastest on Pentium 3 and Pentium 4 with MSVC 6 SP5 w/ Processor Pack
+#define GETBYTE(x, y) (unsigned int)byte((x)>>(8*(y)))
+// these may be faster on other CPUs/compilers
+// #define GETBYTE(x, y) (unsigned int)(((x)>>(8*(y)))&255)
+// #define GETBYTE(x, y) (((byte *)&(x))[y])
+
+#define CRYPTOPP_GET_BYTE_AS_BYTE(x, y) byte((x)>>(8*(y)))
+
+/// \brief Returns the parity of a value
+/// \tparam T class or type
+/// \param value the value to provide the parity
+/// \return 1 if the number 1-bits in the value is odd, 0 otherwise
+template <class T>
+unsigned int Parity(T value)
+{
+	for (unsigned int i=8*sizeof(value)/2; i>0; i/=2)
+		value ^= value >> i;
+	return (unsigned int)value&1;
+}
+
+/// \brief Returns the number of 8-bit bytes or octets required for a value
+/// \tparam T class or type
+/// \param value the value to test
+/// \return the minimum number of 8-bit bytes or octets required to represent a value
+template <class T>
+unsigned int BytePrecision(const T &value)
+{
+	if (!value)
+		return 0;
+
+	unsigned int l=0, h=8*sizeof(value);
+	while (h-l > 8)
+	{
+		unsigned int t = (l+h)/2;
+		if (value >> t)
+			l = t;
+		else
+			h = t;
+	}
+
+	return h/8;
+}
+
+/// \brief Returns the number of bits required for a value
+/// \tparam T class or type
+/// \param value the value to test
+/// \return the maximum number of bits required to represent a value.
+template <class T>
+unsigned int BitPrecision(const T &value)
+{
+	if (!value)
+		return 0;
+
+	unsigned int l=0, h=8*sizeof(value);
+
+	while (h-l > 1)
+	{
+		unsigned int t = (l+h)/2;
+		if (value >> t)
+			l = t;
+		else
+			h = t;
+	}
+
+	return h;
+}
+
+/// Determines the number of trailing 0-bits in a value
+/// \param v the 32-bit value to test
+/// \return the number of trailing 0-bits in v, starting at the least significant bit position
+/// \details TrailingZeros returns the number of trailing 0-bits in v, starting at the least
+///  significant bit position. The return value is undefined if there are no 1-bits set in the value v.
+/// \note The function does not return 0 if no 1-bits are set because 0 collides with a 1-bit at the 0-th position.
+inline unsigned int TrailingZeros(word32 v)
+{
+	// GCC 4.7 and VS2012 provides tzcnt on AVX2/BMI enabled processors
+	// We don't enable for Microsoft because it requires a runtime check.
+	// http://msdn.microsoft.com/en-us/library/hh977023%28v=vs.110%29.aspx
+	CRYPTOPP_ASSERT(v != 0);
+#if defined(__BMI__)
+	return (unsigned int)_tzcnt_u32(v);
+#elif defined(__GNUC__) && (CRYPTOPP_GCC_VERSION >= 30400)
+	return (unsigned int)__builtin_ctz(v);
+#elif defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION >= 1400)
+	unsigned long result;
+	_BitScanForward(&result, v);
+	return static_cast<unsigned int>(result);
+#else
+	// from http://graphics.stanford.edu/~seander/bithacks.html#ZerosOnRightMultLookup
+	static const int MultiplyDeBruijnBitPosition[32] =
+	{
+	  0, 1, 28, 2, 29, 14, 24, 3, 30, 22, 20, 15, 25, 17, 4, 8,
+	  31, 27, 13, 23, 21, 19, 16, 7, 26, 12, 18, 6, 11, 5, 10, 9
+	};
+	return MultiplyDeBruijnBitPosition[((word32)((v & -v) * 0x077CB531U)) >> 27];
+#endif
+}
+
+/// Determines the number of trailing 0-bits in a value
+/// \param v the 64-bit value to test
+/// \return the number of trailing 0-bits in v, starting at the least significant bit position
+/// \details TrailingZeros returns the number of trailing 0-bits in v, starting at the least
+///  significant bit position. The return value is undefined if there are no 1-bits set in the value v.
+/// \note The function does not return 0 if no 1-bits are set because 0 collides with a 1-bit at the 0-th position.
+inline unsigned int TrailingZeros(word64 v)
+{
+	// GCC 4.7 and VS2012 provides tzcnt on AVX2/BMI enabled processors
+	// We don't enable for Microsoft because it requires a runtime check.
+	// http://msdn.microsoft.com/en-us/library/hh977023%28v=vs.110%29.aspx
+	CRYPTOPP_ASSERT(v != 0);
+#if defined(__BMI__) && defined(__x86_64__)
+	return (unsigned int)_tzcnt_u64(v);
+#elif defined(__GNUC__) && (CRYPTOPP_GCC_VERSION >= 30400)
+	return (unsigned int)__builtin_ctzll(v);
+#elif defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION >= 1400) && (defined(_M_X64) || defined(_M_IA64))
+	unsigned long result;
+	_BitScanForward64(&result, v);
+	return static_cast<unsigned int>(result);
+#else
+	return word32(v) ? TrailingZeros(word32(v)) : 32 + TrailingZeros(word32(v>>32));
+#endif
+}
+
+/// \brief Truncates the value to the specified number of bits.
+/// \tparam T class or type
+/// \param value the value to truncate or mask
+/// \param bits the number of bits to truncate or mask
+/// \return the value truncated to the specified number of bits, starting at the least
+///  significant bit position
+/// \details This function masks the low-order bits of value and returns the result. The
+///  mask is created with <tt>(1 << bits) - 1</tt>.
+template <class T>
+inline T Crop(T value, size_t bits)
+{
+	if (bits < 8*sizeof(value))
+    	return T(value & ((T(1) << bits) - 1));
+	else
+		return value;
+}
+
+/// \brief Returns the number of 8-bit bytes or octets required for the specified number of bits
+/// \param bitCount the number of bits
+/// \return the minimum number of 8-bit bytes or octets required by bitCount
+/// \details BitsToBytes is effectively a ceiling function based on 8-bit bytes.
+inline size_t BitsToBytes(size_t bitCount)
+{
+	return ((bitCount+7)/(8));
+}
+
+/// \brief Returns the number of words required for the specified number of bytes
+/// \param byteCount the number of bytes
+/// \return the minimum number of words required by byteCount
+/// \details BytesToWords is effectively a ceiling function based on <tt>WORD_SIZE</tt>.
+///  <tt>WORD_SIZE</tt> is defined in config.h
+inline size_t BytesToWords(size_t byteCount)
+{
+	return ((byteCount+WORD_SIZE-1)/WORD_SIZE);
+}
+
+/// \brief Returns the number of words required for the specified number of bits
+/// \param bitCount the number of bits
+/// \return the minimum number of words required by bitCount
+/// \details BitsToWords is effectively a ceiling function based on <tt>WORD_BITS</tt>.
+///  <tt>WORD_BITS</tt> is defined in config.h
+inline size_t BitsToWords(size_t bitCount)
+{
+	return ((bitCount+WORD_BITS-1)/(WORD_BITS));
+}
+
+/// \brief Returns the number of double words required for the specified number of bits
+/// \param bitCount the number of bits
+/// \return the minimum number of double words required by bitCount
+/// \details BitsToDwords is effectively a ceiling function based on <tt>2*WORD_BITS</tt>.
+///  <tt>WORD_BITS</tt> is defined in config.h
+inline size_t BitsToDwords(size_t bitCount)
+{
+	return ((bitCount+2*WORD_BITS-1)/(2*WORD_BITS));
+}
+
+/// Performs an XOR of a buffer with a mask
+/// \param buf the buffer to XOR with the mask
+/// \param mask the mask to XOR with the buffer
+/// \param count the size of the buffers, in bytes
+/// \details The function effectively visits each element in the buffers and performs
+///  <tt>buf[i] ^= mask[i]</tt>. buf and mask must be of equal size.
+CRYPTOPP_DLL void CRYPTOPP_API xorbuf(byte *buf, const byte *mask, size_t count);
+
+/// Performs an XOR of an input buffer with a mask and stores the result in an output buffer
+/// \param output the destination buffer
+/// \param input the source buffer to XOR with the mask
+/// \param mask the mask buffer to XOR with the input buffer
+/// \param count the size of the buffers, in bytes
+/// \details The function effectively visits each element in the buffers and performs
+///  <tt>output[i] = input[i] ^ mask[i]</tt>. output, input and mask must be of equal size.
+CRYPTOPP_DLL void CRYPTOPP_API xorbuf(byte *output, const byte *input, const byte *mask, size_t count);
+
+/// \brief Performs a near constant-time comparison of two equally sized buffers
+/// \param buf1 the first buffer
+/// \param buf2 the second buffer
+/// \param count the size of the buffers, in bytes
+/// \details VerifyBufsEqual performs an XOR of the elements in two equally sized
+///  buffers and returns a result based on the XOR operation. A count of 0 returns
+///  true because two empty buffers are considered equal.
+/// \details The function is near constant-time because CPU micro-code timings could
+///  affect the "constant-ness". Calling code is responsible for mitigating timing
+///  attacks if the buffers are not equally sized.
+/// \sa ModPowerOf2
+CRYPTOPP_DLL bool CRYPTOPP_API VerifyBufsEqual(const byte *buf1, const byte *buf2, size_t count);
+
+/// \brief Tests whether a value is a power of 2
+/// \param value the value to test
+/// \return true if value is a power of 2, false otherwise
+/// \details The function creates a mask of <tt>value - 1</tt> and returns the result
+///  of an AND operation compared to 0. If value is 0 or less than 0, then the function
+///  returns false.
+template <class T>
+inline bool IsPowerOf2(const T &value)
+{
+	return value > 0 && (value & (value-1)) == 0;
+}
+
+#if defined(__BMI__)
+template <>
+inline bool IsPowerOf2<word32>(const word32 &value)
+{
+	return value > 0 && _blsr_u32(value) == 0;
+}
+
+# if defined(__x86_64__)
+template <>
+inline bool IsPowerOf2<word64>(const word64 &value)
+{
+	return value > 0 && _blsr_u64(value) == 0;
+}
+# endif  // __x86_64__
+#endif   // __BMI__
+
+/// \brief Provide the minimum value for a type
+/// \tparam T type of class
+/// \return the minimum value of the type or class
+/// \details NumericLimitsMin() was introduced for Clang at <A
+///  HREF="http://github.com/weidai11/cryptopp/issues/364">Issue 364,
+///  Apple Clang 6.0 and numeric_limits<word128>::max() returns 0</A>.
+/// \details NumericLimitsMin() requires a specialization for <tt>T</tt>,
+///  meaning <tt>std::numeric_limits<T>::is_specialized</tt> must return
+///  <tt>true</tt>. In the case of <tt>word128</tt> Clang did not specialize
+///  <tt>numeric_limits</tt> for the type.
+/// \since Crypto++ 8.1
+template<class T>
+inline T NumericLimitsMin()
+{
+	CRYPTOPP_ASSERT(std::numeric_limits<T>::is_specialized);
+	return (std::numeric_limits<T>::min)();
+}
+
+/// \brief Provide the maximum value for a type
+/// \tparam T type of class
+/// \return the maximum value of the type or class
+/// \details NumericLimitsMax() was introduced for Clang at <A
+///  HREF="http://github.com/weidai11/cryptopp/issues/364">Issue 364,
+///  Apple Clang 6.0 and numeric_limits<word128>::max() returns 0</A>.
+/// \details NumericLimitsMax() requires a specialization for <tt>T</tt>,
+///  meaning <tt>std::numeric_limits<T>::is_specialized</tt> must return
+///  <tt>true</tt>. In the case of <tt>word128</tt> Clang did not specialize
+///  <tt>numeric_limits</tt> for the type.
+/// \since Crypto++ 8.1
+template<class T>
+inline T NumericLimitsMax()
+{
+	CRYPTOPP_ASSERT(std::numeric_limits<T>::is_specialized);
+	return (std::numeric_limits<T>::max)();
+}
+
+// NumericLimitsMin and NumericLimitsMax added for word128 types,
+//   see http://github.com/weidai11/cryptopp/issues/364
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+template<>
+inline word128 NumericLimitsMin()
+{
+	return 0;
+}
+template<>
+inline word128 NumericLimitsMax()
+{
+#if defined(CRYPTOPP_APPLE_CLANG_VERSION)
+	return (static_cast<word128>(LWORD_MAX) << 64U) | LWORD_MAX;
+#else
+	return (std::numeric_limits<word128>::max)();
+#endif
+}
+#endif
+
+/// \brief Performs a saturating subtract clamped at 0
+/// \tparam T1 class or type
+/// \tparam T2 class or type
+/// \param a the minuend
+/// \param b the subtrahend
+/// \return the difference produced by the saturating subtract
+/// \details Saturating arithmetic restricts results to a fixed range. Results that are
+///  less than 0 are clamped at 0.
+/// \details Use of saturating arithmetic in places can be advantageous because it can
+///  avoid a branch by using an instruction like a conditional move (<tt>CMOVE</tt>).
+template <class T1, class T2>
+inline T1 SaturatingSubtract(const T1 &a, const T2 &b)
+{
+	// Generated ASM of a typical clamp, http://gcc.gnu.org/ml/gcc-help/2014-10/msg00112.html
+	return T1((a > b) ? (a - b) : 0);
+}
+
+/// \brief Performs a saturating subtract clamped at 1
+/// \tparam T1 class or type
+/// \tparam T2 class or type
+/// \param a the minuend
+/// \param b the subtrahend
+/// \return the difference produced by the saturating subtract
+/// \details Saturating arithmetic restricts results to a fixed range. Results that are
+///  less than 1 are clamped at 1.
+/// \details Use of saturating arithmetic in places can be advantageous because it can
+///  avoid a branch by using an instruction like a conditional move (<tt>CMOVE</tt>).
+template <class T1, class T2>
+inline T1 SaturatingSubtract1(const T1 &a, const T2 &b)
+{
+	// Generated ASM of a typical clamp, http://gcc.gnu.org/ml/gcc-help/2014-10/msg00112.html
+	return T1((a > b) ? (a - b) : 1);
+}
+
+/// \brief Reduces a value to a power of 2
+/// \tparam T1 class or type
+/// \tparam T2 class or type
+/// \param a the first value
+/// \param b the second value
+/// \return ModPowerOf2() returns <tt>a & (b-1)</tt>. <tt>b</tt> must be a power of 2.
+///  Use IsPowerOf2() to determine if <tt>b</tt> is a suitable candidate.
+/// \sa IsPowerOf2
+template <class T1, class T2>
+inline T2 ModPowerOf2(const T1 &a, const T2 &b)
+{
+	CRYPTOPP_ASSERT(IsPowerOf2(b));
+    // Coverity finding CID 170383 Overflowed return value (INTEGER_OVERFLOW)
+    // Visual Studio and /RTCc warning, https://docs.microsoft.com/en-us/cpp/build/reference/rtc-run-time-error-checks
+	return T2(a & SaturatingSubtract(b,1U));
+}
+
+/// \brief Rounds a value down to a multiple of a second value
+/// \tparam T1 class or type
+/// \tparam T2 class or type
+/// \param n the value to reduce
+/// \param m the value to reduce <tt>n</tt> to a multiple
+/// \return the possibly unmodified value \n
+/// \details RoundDownToMultipleOf is effectively a floor function based on m. The function returns
+///  the value <tt>n - n\%m</tt>. If n is a multiple of m, then the original value is returned.
+/// \note <tt>T1</tt> and <tt>T2</tt> should be unsigned arithmetic types. If <tt>T1</tt> or
+///  <tt>T2</tt> is signed, then the value should be non-negative. The library asserts in
+///  debug builds when practical, but allows you to perform the operation in release builds.
+template <class T1, class T2>
+inline T1 RoundDownToMultipleOf(const T1 &n, const T2 &m)
+{
+	// http://github.com/weidai11/cryptopp/issues/364
+#if !defined(CRYPTOPP_APPLE_CLANG_VERSION) || (CRYPTOPP_APPLE_CLANG_VERSION >= 80000)
+	CRYPTOPP_ASSERT(std::numeric_limits<T1>::is_integer);
+	CRYPTOPP_ASSERT(std::numeric_limits<T2>::is_integer);
+#endif
+
+	CRYPTOPP_ASSERT(!std::numeric_limits<T1>::is_signed || n > 0);
+	CRYPTOPP_ASSERT(!std::numeric_limits<T2>::is_signed || m > 0);
+
+	if (IsPowerOf2(m))
+		return n - ModPowerOf2(n, m);
+	else
+		return n - n%m;
+}
+
+/// \brief Rounds a value up to a multiple of a second value
+/// \tparam T1 class or type
+/// \tparam T2 class or type
+/// \param n the value to reduce
+/// \param m the value to reduce <tt>n</tt> to a multiple
+/// \return the possibly unmodified value \n
+/// \details RoundUpToMultipleOf is effectively a ceiling function based on m. The function
+///  returns the value <tt>n + n\%m</tt>. If n is a multiple of m, then the original value is
+///  returned. If the value n would overflow, then an InvalidArgument exception is thrown.
+/// \note <tt>T1</tt> and <tt>T2</tt> should be unsigned arithmetic types. If <tt>T1</tt> or
+///  <tt>T2</tt> is signed, then the value should be non-negative. The library asserts in
+///  debug builds when practical, but allows you to perform the operation in release builds.
+template <class T1, class T2>
+inline T1 RoundUpToMultipleOf(const T1 &n, const T2 &m)
+{
+	// http://github.com/weidai11/cryptopp/issues/364
+#if !defined(CRYPTOPP_APPLE_CLANG_VERSION) || (CRYPTOPP_APPLE_CLANG_VERSION >= 80000)
+	CRYPTOPP_ASSERT(std::numeric_limits<T1>::is_integer);
+	CRYPTOPP_ASSERT(std::numeric_limits<T2>::is_integer);
+#endif
+
+	CRYPTOPP_ASSERT(!std::numeric_limits<T1>::is_signed || n > 0);
+	CRYPTOPP_ASSERT(!std::numeric_limits<T2>::is_signed || m > 0);
+
+	if (NumericLimitsMax<T1>() - m + 1 < n)
+		throw InvalidArgument("RoundUpToMultipleOf: integer overflow");
+	return RoundDownToMultipleOf(T1(n+m-1), m);
+}
+
+/// \brief Returns the minimum alignment requirements of a type
+/// \tparam T class or type
+/// \return the minimum alignment requirements of <tt>T</tt>, in bytes
+/// \details Internally the function calls C++11's <tt>alignof</tt> if
+///  available. If not available, then the function uses compiler
+///  specific extensions such as <tt>__alignof</tt> and <tt>_alignof_</tt>.
+///  If an extension is not available, then the function uses
+///  <tt>sizeof(T)</tt>.
+template <class T>
+inline unsigned int GetAlignmentOf()
+{
+#if defined(CRYPTOPP_CXX11_ALIGNOF)
+	return alignof(T);
+#elif (CRYPTOPP_MSC_VERSION >= 1300)
+	return __alignof(T);
+#elif defined(__GNUC__)
+	return __alignof__(T);
+#elif defined(__SUNPRO_CC)
+	return __alignof__(T);
+#elif defined(__IBM_ALIGNOF__)
+	return __alignof__(T);
+#elif CRYPTOPP_BOOL_SLOW_WORD64
+	return UnsignedMin(4U, sizeof(T));
+#else
+	return sizeof(T);
+#endif
+}
+
+/// \brief Determines whether ptr is aligned to a minimum value
+/// \param ptr the pointer being checked for alignment
+/// \param alignment the alignment value to test the pointer against
+/// \return true if <tt>ptr</tt> is aligned on at least <tt>alignment</tt>
+///  boundary, false otherwise
+/// \details Internally the function tests whether alignment is 1. If so,
+///  the function returns true. If not, then the function effectively
+///  performs a modular reduction and returns true if the residue is 0.
+inline bool IsAlignedOn(const void *ptr, unsigned int alignment)
+{
+	const uintptr_t x = reinterpret_cast<uintptr_t>(ptr);
+	return alignment==1 || (IsPowerOf2(alignment) ? ModPowerOf2(x, alignment) == 0 : x % alignment == 0);
+}
+
+/// \brief Determines whether ptr is minimally aligned
+/// \tparam T class or type
+/// \param ptr the pointer to check for alignment
+/// \return true if <tt>ptr</tt> is aligned to at least <tt>T</tt>
+///  boundary, false otherwise
+/// \details Internally the function calls IsAlignedOn with a second
+///  parameter of GetAlignmentOf<T>.
+template <class T>
+inline bool IsAligned(const void *ptr)
+{
+	return IsAlignedOn(ptr, GetAlignmentOf<T>());
+}
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+typedef LittleEndian NativeByteOrder;
+#elif (CRYPTOPP_BIG_ENDIAN)
+typedef BigEndian NativeByteOrder;
+#else
+# error "Unable to determine endianness"
+#endif
+
+/// \brief Returns NativeByteOrder as an enumerated ByteOrder value
+/// \return LittleEndian if the native byte order is little-endian,
+///  and BigEndian if the native byte order is big-endian
+/// \details NativeByteOrder is a typedef depending on the platform.
+///  If CRYPTOPP_LITTLE_ENDIAN is set in config.h, then
+///  GetNativeByteOrder returns LittleEndian. If CRYPTOPP_BIG_ENDIAN
+///  is set, then GetNativeByteOrder returns BigEndian.
+/// \note There are other byte orders besides little- and big-endian,
+///  and they include bi-endian and PDP-endian. If a system is neither
+///  little-endian nor big-endian, then a compile time error occurs.
+inline ByteOrder GetNativeByteOrder()
+{
+	return NativeByteOrder::ToEnum();
+}
+
+/// \brief Determines whether order follows native byte ordering
+/// \param order the ordering being tested against native byte ordering
+/// \return true if order follows native byte ordering, false otherwise
+inline bool NativeByteOrderIs(ByteOrder order)
+{
+	return order == GetNativeByteOrder();
+}
+
+/// \brief Returns the direction the cipher is being operated
+/// \tparam T class or type
+/// \param obj the cipher object being queried
+/// \return ENCRYPTION if the cipher obj is being operated in its forward direction,
+///  DECRYPTION otherwise
+/// \details A cipher can be operated in a "forward" direction (encryption) or a "reverse"
+///  direction (decryption). The operations do not have to be symmetric, meaning a second
+///  application of the transformation does not necessarily return the original message.
+///  That is, <tt>E(D(m))</tt> may not equal <tt>E(E(m))</tt>; and <tt>D(E(m))</tt> may not
+///  equal <tt>D(D(m))</tt>.
+template <class T>
+inline CipherDir GetCipherDir(const T &obj)
+{
+	return obj.IsForwardTransformation() ? ENCRYPTION : DECRYPTION;
+}
+
+/// \brief Performs an addition with carry on a block of bytes
+/// \param inout the byte block
+/// \param size the size of the block, in bytes
+/// \details Performs an addition with carry by adding 1 on a block of bytes starting at the least
+///  significant byte. Once carry is 0, the function terminates and returns to the caller.
+/// \note The function is not constant time because it stops processing when the carry is 0.
+inline void IncrementCounterByOne(byte *inout, unsigned int size)
+{
+	CRYPTOPP_ASSERT(inout != NULLPTR);
+
+	unsigned int carry=1;
+	while (carry && size != 0)
+	{
+		// On carry inout[n] equals 0
+		carry = ! ++inout[size-1];
+		size--;
+	}
+}
+
+/// \brief Performs an addition with carry on a block of bytes
+/// \param output the destination block of bytes
+/// \param input the source block of bytes
+/// \param size the size of the block
+/// \details Performs an addition with carry on a block of bytes starting at the least significant
+///  byte. Once carry is 0, the remaining bytes from input are copied to output using memcpy.
+/// \details The function is close to near-constant time because it operates on all the bytes in the blocks.
+inline void IncrementCounterByOne(byte *output, const byte *input, unsigned int size)
+{
+	CRYPTOPP_ASSERT(output != NULLPTR);
+	CRYPTOPP_ASSERT(input != NULLPTR);
+
+	unsigned int carry=1;
+	while (carry && size != 0)
+	{
+		// On carry output[n] equals 0
+		carry = ! (output[size-1] = input[size-1] + 1);
+		size--;
+	}
+
+	while (size != 0)
+	{
+		output[size-1] = input[size-1];
+		size--;
+	}
+}
+
+/// \brief Performs a branch-less swap of values a and b if condition c is true
+/// \tparam T class or type
+/// \param c the condition to perform the swap
+/// \param a the first value
+/// \param b the second value
+template <class T>
+inline void ConditionalSwap(bool c, T &a, T &b)
+{
+	T t = c * (a ^ b);
+	a ^= t;
+	b ^= t;
+}
+
+/// \brief Performs a branch-less swap of pointers a and b if condition c is true
+/// \tparam T class or type
+/// \param c the condition to perform the swap
+/// \param a the first pointer
+/// \param b the second pointer
+template <class T>
+inline void ConditionalSwapPointers(bool c, T &a, T &b)
+{
+	ptrdiff_t t = size_t(c) * (a - b);
+	a -= t;
+	b += t;
+}
+
+// see http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/protect-secrets.html
+// and http://www.securecoding.cert.org/confluence/display/cplusplus/MSC06-CPP.+Be+aware+of+compiler+optimization+when+dealing+with+sensitive+data
+
+/// \brief Sets each element of an array to 0
+/// \tparam T class or type
+/// \param buf an array of elements
+/// \param n the number of elements in the array
+/// \details The operation performs a wipe or zeroization. The function
+///  attempts to survive optimizations and dead code removal.
+template <class T>
+void SecureWipeBuffer(T *buf, size_t n)
+{
+	// GCC 4.3.2 on Cygwin optimizes away the first store if this
+	// loop is done in the forward direction
+	volatile T *p = buf+n;
+	while (n--)
+		*(--p) = 0;
+}
+
+#if !defined(CRYPTOPP_DISABLE_ASM) && \
+    (CRYPTOPP_MSC_VERSION >= 1400 || defined(__GNUC__)) && \
+    (CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X86)
+
+/// \brief Sets each byte of an array to 0
+/// \param buf an array of bytes
+/// \param n the number of elements in the array
+/// \details The operation performs a wipe or zeroization. The function
+///  attempts to survive optimizations and dead code removal.
+template<> inline void SecureWipeBuffer(byte *buf, size_t n)
+{
+	volatile byte *p = buf;
+#ifdef __GNUC__
+	asm volatile("rep stosb" : "+c"(n), "+D"(p) : "a"(0) : "memory");
+#else
+	__stosb(reinterpret_cast<byte *>(reinterpret_cast<size_t>(p)), 0, n);
+#endif
+}
+
+/// \brief Sets each 16-bit element of an array to 0
+/// \param buf an array of 16-bit words
+/// \param n the number of elements in the array
+/// \details The operation performs a wipe or zeroization. The function
+///  attempts to survive optimizations and dead code removal.
+template<> inline void SecureWipeBuffer(word16 *buf, size_t n)
+{
+	volatile word16 *p = buf;
+#ifdef __GNUC__
+	asm volatile("rep stosw" : "+c"(n), "+D"(p) : "a"(0) : "memory");
+#else
+	__stosw(reinterpret_cast<word16 *>(reinterpret_cast<size_t>(p)), 0, n);
+#endif
+}
+
+/// \brief Sets each 32-bit element of an array to 0
+/// \param buf an array of 32-bit words
+/// \param n the number of elements in the array
+/// \details The operation performs a wipe or zeroization. The function
+///  attempts to survive optimizations and dead code removal.
+template<> inline void SecureWipeBuffer(word32 *buf, size_t n)
+{
+	volatile word32 *p = buf;
+#ifdef __GNUC__
+	asm volatile("rep stosl" : "+c"(n), "+D"(p) : "a"(0) : "memory");
+#else
+	__stosd(reinterpret_cast<unsigned long *>(reinterpret_cast<size_t>(p)), 0, n);
+#endif
+}
+
+/// \brief Sets each 64-bit element of an array to 0
+/// \param buf an array of 64-bit words
+/// \param n the number of elements in the array
+/// \details The operation performs a wipe or zeroization. The function
+///  attempts to survive optimizations and dead code removal.
+template<> inline void SecureWipeBuffer(word64 *buf, size_t n)
+{
+#if CRYPTOPP_BOOL_X64
+	volatile word64 *p = buf;
+# ifdef __GNUC__
+	asm volatile("rep stosq" : "+c"(n), "+D"(p) : "a"(0) : "memory");
+# else
+	__stosq(const_cast<word64 *>(p), 0, n);
+# endif
+#else
+	SecureWipeBuffer(reinterpret_cast<word32 *>(buf), 2*n);
+#endif
+}
+
+#endif	// CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X86
+
+#if !defined(CRYPTOPP_DISABLE_ASM) && (CRYPTOPP_MSC_VERSION >= 1700) && defined(_M_ARM)
+template<> inline void SecureWipeBuffer(byte *buf, size_t n)
+{
+	char *p = reinterpret_cast<char*>(buf+n);
+	while (n--)
+		__iso_volatile_store8(--p, 0);
+}
+
+template<> inline void SecureWipeBuffer(word16 *buf, size_t n)
+{
+	short *p = reinterpret_cast<short*>(buf+n);
+	while (n--)
+		__iso_volatile_store16(--p, 0);
+}
+
+template<> inline void SecureWipeBuffer(word32 *buf, size_t n)
+{
+	int *p = reinterpret_cast<int*>(buf+n);
+	while (n--)
+		__iso_volatile_store32(--p, 0);
+}
+
+template<> inline void SecureWipeBuffer(word64 *buf, size_t n)
+{
+	__int64 *p = reinterpret_cast<__int64*>(buf+n);
+	while (n--)
+		__iso_volatile_store64(--p, 0);
+}
+#endif
+
+/// \brief Sets each element of an array to 0
+/// \tparam T class or type
+/// \param buf an array of elements
+/// \param n the number of elements in the array
+/// \details The operation performs a wipe or zeroization. The function
+///  attempts to survive optimizations and dead code removal.
+template <class T>
+inline void SecureWipeArray(T *buf, size_t n)
+{
+	if (sizeof(T) % 8 == 0 && GetAlignmentOf<T>() % GetAlignmentOf<word64>() == 0)
+		SecureWipeBuffer(reinterpret_cast<word64 *>(static_cast<void *>(buf)), n * (sizeof(T)/8));
+	else if (sizeof(T) % 4 == 0 && GetAlignmentOf<T>() % GetAlignmentOf<word32>() == 0)
+		SecureWipeBuffer(reinterpret_cast<word32 *>(static_cast<void *>(buf)), n * (sizeof(T)/4));
+	else if (sizeof(T) % 2 == 0 && GetAlignmentOf<T>() % GetAlignmentOf<word16>() == 0)
+		SecureWipeBuffer(reinterpret_cast<word16 *>(static_cast<void *>(buf)), n * (sizeof(T)/2));
+	else
+		SecureWipeBuffer(reinterpret_cast<byte *>(static_cast<void *>(buf)), n * sizeof(T));
+}
+
+/// \brief Converts a wide character C-string to a multibyte string
+/// \param str C-string consisting of wide characters
+/// \param throwOnError flag indicating the function should throw on error
+/// \return str converted to a multibyte string or an empty string.
+/// \details StringNarrow() converts a wide string to a narrow string using C++ std::wcstombs() under
+///  the executing thread's locale. A locale must be set before using this function, and it can be
+///  set with std::setlocale() if needed. Upon success, the converted string is returned.
+/// \details Upon failure with throwOnError as false, the function returns an empty string. If
+///  throwOnError as true, the function throws an InvalidArgument() exception.
+/// \note If you try to convert, say, the Chinese character for "bone" from UTF-16 (0x9AA8) to UTF-8
+///  (0xE9 0xAA 0xA8), then you must ensure the locale is available. If the locale is not available,
+///  then a 0x21 error is returned on Windows which eventually results in an InvalidArgument() exception.
+std::string StringNarrow(const wchar_t *str, bool throwOnError = true);
+
+/// \brief Converts a multibyte C-string to a wide character string
+/// \param str C-string consisting of wide characters
+/// \param throwOnError flag indicating the function should throw on error
+/// \return str converted to a multibyte string or an empty string.
+/// \details StringWiden() converts a narrow string to a wide string using C++ std::mbstowcs() under
+///  the executing thread's locale. A locale must be set before using this function, and it can be
+///  set with std::setlocale() if needed. Upon success, the converted string is returned.
+/// \details Upon failure with throwOnError as false, the function returns an empty string. If
+///  throwOnError as true, the function throws an InvalidArgument() exception.
+/// \note If you try to convert, say, the Chinese character for "bone" from UTF-8 (0xE9 0xAA 0xA8)
+///  to UTF-16 (0x9AA8), then you must ensure the locale is available. If the locale is not available,
+///  then a 0x21 error is returned on Windows which eventually results in an InvalidArgument() exception.
+std::wstring StringWiden(const char *str, bool throwOnError = true);
+
+// ************** rotate functions ***************
+
+/// \brief Performs a left rotate
+/// \tparam R the number of bit positions to rotate the value
+/// \tparam T the word type
+/// \param x the value to rotate
+/// \details This is a portable C/C++ implementation. The value x to be rotated can be 8 to 64-bits wide.
+/// \details R must be in the range <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+///  Use rotlMod if the rotate amount R is outside the range.
+/// \details Use rotlConstant when the rotate amount is constant. The template function was added
+///  because Clang did not propagate the constant when passed as a function parameter. Clang's
+///  need for a constexpr meant rotlFixed failed to compile on occasion.
+/// \note rotlConstant attempts to enlist a <tt>rotate IMM</tt> instruction because its often faster
+///  than a <tt>rotate REG</tt>. Immediate rotates can be up to three times faster than their register
+///  counterparts.
+/// \sa rotlConstant, rotrConstant, rotlFixed, rotrFixed, rotlVariable, rotrVariable
+/// \since Crypto++ 6.0
+template <unsigned int R, class T> inline T rotlConstant(T x)
+{
+	// Portable rotate that reduces to single instruction...
+	// http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157,
+	// http://software.intel.com/en-us/forums/topic/580884
+	// and http://llvm.org/bugs/show_bug.cgi?id=24226
+	CRYPTOPP_CONSTANT(THIS_SIZE = sizeof(T)*8);
+	CRYPTOPP_CONSTANT(MASK = THIS_SIZE-1);
+	CRYPTOPP_ASSERT(static_cast<int>(R) < THIS_SIZE);
+	return T((x<<R)|(x>>(-R&MASK)));
+}
+
+/// \brief Performs a right rotate
+/// \tparam R the number of bit positions to rotate the value
+/// \tparam T the word type
+/// \param x the value to rotate
+/// \details This is a portable C/C++ implementation. The value x to be rotated can be 8 to 64-bits wide.
+/// \details R must be in the range <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+///  Use rotrMod if the rotate amount R is outside the range.
+/// \details Use rotrConstant when the rotate amount is constant. The template function was added
+///  because Clang did not propagate the constant when passed as a function parameter. Clang's
+///  need for a constexpr meant rotrFixed failed to compile on occasion.
+/// \note rotrConstant attempts to enlist a <tt>rotate IMM</tt> instruction because its often faster
+///  than a <tt>rotate REG</tt>. Immediate rotates can be up to three times faster than their register
+///  counterparts.
+/// \sa rotlConstant, rotrConstant, rotlFixed, rotrFixed, rotlVariable, rotrVariable
+template <unsigned int R, class T> inline T rotrConstant(T x)
+{
+	// Portable rotate that reduces to single instruction...
+	// http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157,
+	// http://software.intel.com/en-us/forums/topic/580884
+	// and http://llvm.org/bugs/show_bug.cgi?id=24226
+	CRYPTOPP_CONSTANT(THIS_SIZE = sizeof(T)*8);
+	CRYPTOPP_CONSTANT(MASK = THIS_SIZE-1);
+	CRYPTOPP_ASSERT(static_cast<int>(R) < THIS_SIZE);
+	return T((x >> R)|(x<<(-R&MASK)));
+}
+
+/// \brief Performs a left rotate
+/// \tparam T the word type
+/// \param x the value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a portable C/C++ implementation. The value x to be rotated can be 8 to 64-bits wide.
+/// \details y must be in the range <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+///  Use rotlMod if the rotate amount y is outside the range.
+/// \note rotlFixed attempts to enlist a <tt>rotate IMM</tt> instruction because its often faster
+///  than a <tt>rotate REG</tt>. Immediate rotates can be up to three times faster than their register
+///  counterparts. New code should use <tt>rotlConstant</tt>, which accepts the rotate amount as a
+///  template parameter.
+/// \sa rotlConstant, rotrConstant, rotlFixed, rotrFixed, rotlVariable, rotrVariable
+/// \since Crypto++ 6.0
+template <class T> inline T rotlFixed(T x, unsigned int y)
+{
+	// Portable rotate that reduces to single instruction...
+	// http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157,
+	// http://software.intel.com/en-us/forums/topic/580884
+	// and http://llvm.org/bugs/show_bug.cgi?id=24226
+	CRYPTOPP_CONSTANT(THIS_SIZE = sizeof(T)*8);
+	CRYPTOPP_CONSTANT(MASK = THIS_SIZE-1);
+	CRYPTOPP_ASSERT(static_cast<int>(y) < THIS_SIZE);
+	return T((x<<y)|(x>>(-y&MASK)));
+}
+
+/// \brief Performs a right rotate
+/// \tparam T the word type
+/// \param x the value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a portable C/C++ implementation. The value x to be rotated can be 8 to 64-bits wide.
+/// \details y must be in the range <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+///  Use rotrMod if the rotate amount y is outside the range.
+/// \note rotrFixed attempts to enlist a <tt>rotate IMM</tt> instruction because its often faster
+///  than a <tt>rotate REG</tt>. Immediate rotates can be up to three times faster than their register
+///  counterparts. New code should use <tt>rotrConstant</tt>, which accepts the rotate amount as a
+///  template parameter.
+/// \sa rotlConstant, rotrConstant, rotlFixed, rotrFixed, rotlVariable, rotrVariable
+/// \since Crypto++ 3.0
+template <class T> inline T rotrFixed(T x, unsigned int y)
+{
+	// Portable rotate that reduces to single instruction...
+	// http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157,
+	// http://software.intel.com/en-us/forums/topic/580884
+	// and http://llvm.org/bugs/show_bug.cgi?id=24226
+	CRYPTOPP_CONSTANT(THIS_SIZE = sizeof(T)*8);
+	CRYPTOPP_CONSTANT(MASK = THIS_SIZE-1);
+	CRYPTOPP_ASSERT(static_cast<int>(y) < THIS_SIZE);
+	return T((x >> y)|(x<<(-y&MASK)));
+}
+
+/// \brief Performs a left rotate
+/// \tparam T the word type
+/// \param x the value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a portable C/C++ implementation. The value x to be rotated can be 8 to 64-bits wide.
+/// \details y must be in the range <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+///  Use rotlMod if the rotate amount y is outside the range.
+/// \note rotlVariable attempts to enlist a <tt>rotate IMM</tt> instruction because its often faster
+///  than a <tt>rotate REG</tt>. Immediate rotates can be up to three times faster than their register
+///  counterparts.
+/// \sa rotlConstant, rotrConstant, rotlFixed, rotrFixed, rotlVariable, rotrVariable
+/// \since Crypto++ 3.0
+template <class T> inline T rotlVariable(T x, unsigned int y)
+{
+	CRYPTOPP_CONSTANT(THIS_SIZE = sizeof(T)*8);
+	CRYPTOPP_CONSTANT(MASK = THIS_SIZE-1);
+	CRYPTOPP_ASSERT(static_cast<int>(y) < THIS_SIZE);
+	return T((x<<y)|(x>>(-y&MASK)));
+}
+
+/// \brief Performs a right rotate
+/// \tparam T the word type
+/// \param x the value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a portable C/C++ implementation. The value x to be rotated can be 8 to 64-bits wide.
+/// \details y must be in the range <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+///  Use rotrMod if the rotate amount y is outside the range.
+/// \note rotrVariable attempts to enlist a <tt>rotate IMM</tt> instruction because its often faster
+///  than a <tt>rotate REG</tt>. Immediate rotates can be up to three times faster than their register
+///  counterparts.
+/// \sa rotlConstant, rotrConstant, rotlFixed, rotrFixed, rotlVariable, rotrVariable
+/// \since Crypto++ 3.0
+template <class T> inline T rotrVariable(T x, unsigned int y)
+{
+	CRYPTOPP_CONSTANT(THIS_SIZE = sizeof(T)*8);
+	CRYPTOPP_CONSTANT(MASK = THIS_SIZE-1);
+	CRYPTOPP_ASSERT(static_cast<int>(y) < THIS_SIZE);
+	return T((x>>y)|(x<<(-y&MASK)));
+}
+
+/// \brief Performs a left rotate
+/// \tparam T the word type
+/// \param x the value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a portable C/C++ implementation. The value x to be rotated can be 8 to 64-bits wide.
+/// \details y is reduced to the range <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotrVariable will use either <tt>rotate IMM</tt> or <tt>rotate REG</tt>.
+/// \sa rotlConstant, rotrConstant, rotlFixed, rotrFixed, rotlVariable, rotrVariable
+/// \since Crypto++ 3.0
+template <class T> inline T rotlMod(T x, unsigned int y)
+{
+	CRYPTOPP_CONSTANT(THIS_SIZE = sizeof(T)*8);
+	CRYPTOPP_CONSTANT(MASK = THIS_SIZE-1);
+	return T((x<<(y&MASK))|(x>>(-y&MASK)));
+}
+
+/// \brief Performs a right rotate
+/// \tparam T the word type
+/// \param x the value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a portable C/C++ implementation. The value x to be rotated can be 8 to 64-bits wide.
+/// \details y is reduced to the range <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotrVariable will use either <tt>rotate IMM</tt> or <tt>rotate REG</tt>.
+/// \sa rotlConstant, rotrConstant, rotlFixed, rotrFixed, rotlVariable, rotrVariable
+/// \since Crypto++ 3.0
+template <class T> inline T rotrMod(T x, unsigned int y)
+{
+	CRYPTOPP_CONSTANT(THIS_SIZE = sizeof(T)*8);
+	CRYPTOPP_CONSTANT(MASK = THIS_SIZE-1);
+	return T((x>>(y&MASK))|(x<<(-y&MASK)));
+}
+
+#ifdef CRYPTOPP_MSC_VERSION
+
+/// \brief Performs a left rotate
+/// \tparam T the word type
+/// \param x the 32-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotl</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 32-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotlFixed will assert in Debug builds if is outside the allowed range.
+/// \since Crypto++ 3.0
+template<> inline word32 rotlFixed<word32>(word32 x, unsigned int y)
+{
+	// Uses Microsoft <stdlib.h> call, bound to C/C++ language rules.
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return y ? _lrotl(x, static_cast<byte>(y)) : x;
+}
+
+/// \brief Performs a right rotate
+/// \tparam T the word type
+/// \param x the 32-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotr</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 32-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotrFixed will assert in Debug builds if is outside the allowed range.
+/// \since Crypto++ 3.0
+template<> inline word32 rotrFixed<word32>(word32 x, unsigned int y)
+{
+	// Uses Microsoft <stdlib.h> call, bound to C/C++ language rules.
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return y ? _lrotr(x, static_cast<byte>(y)) : x;
+}
+
+/// \brief Performs a left rotate
+/// \tparam T the word type
+/// \param x the 32-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotl</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 32-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotlVariable will assert in Debug builds if is outside the allowed range.
+/// \since Crypto++ 3.0
+template<> inline word32 rotlVariable<word32>(word32 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return _lrotl(x, static_cast<byte>(y));
+}
+
+/// \brief Performs a right rotate
+/// \tparam T the word type
+/// \param x the 32-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotr</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 32-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotrVariable will assert in Debug builds if is outside the allowed range.
+/// \since Crypto++ 3.0
+template<> inline word32 rotrVariable<word32>(word32 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return _lrotr(x, static_cast<byte>(y));
+}
+
+/// \brief Performs a left rotate
+/// \tparam T the word type
+/// \param x the 32-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotl</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 32-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \since Crypto++ 3.0
+template<> inline word32 rotlMod<word32>(word32 x, unsigned int y)
+{
+	y %= 8*sizeof(x);
+	return _lrotl(x, static_cast<byte>(y));
+}
+
+/// \brief Performs a right rotate
+/// \tparam T the word type
+/// \param x the 32-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotr</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 32-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \since Crypto++ 3.0
+template<> inline word32 rotrMod<word32>(word32 x, unsigned int y)
+{
+	y %= 8*sizeof(x);
+	return _lrotr(x, static_cast<byte>(y));
+}
+
+#endif // #ifdef CRYPTOPP_MSC_VERSION
+
+#if (CRYPTOPP_MSC_VERSION >= 1400) || (defined(CRYPTOPP_MSC_VERSION) && !defined(_DLL))
+// Intel C++ Compiler 10.0 calls a function instead of using the rotate instruction when using these instructions
+
+/// \brief Performs a left rotate
+/// \tparam T the word type
+/// \param x the 64-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotl</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 64-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotrFixed will assert in Debug builds if is outside the allowed range.
+/// \since Crypto++ 3.0
+template<> inline word64 rotlFixed<word64>(word64 x, unsigned int y)
+{
+	// Uses Microsoft <stdlib.h> call, bound to C/C++ language rules.
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return y ? _rotl64(x, static_cast<byte>(y)) : x;
+}
+
+/// \brief Performs a right rotate
+/// \tparam T the word type
+/// \param x the 64-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotr</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 64-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotrFixed will assert in Debug builds if is outside the allowed range.
+/// \since Crypto++ 3.0
+template<> inline word64 rotrFixed<word64>(word64 x, unsigned int y)
+{
+	// Uses Microsoft <stdlib.h> call, bound to C/C++ language rules.
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return y ? _rotr64(x, static_cast<byte>(y)) : x;
+}
+
+/// \brief Performs a left rotate
+/// \tparam T the word type
+/// \param x the 64-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotl</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 64-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotlVariable will assert in Debug builds if is outside the allowed range.
+/// \since Crypto++ 3.0
+template<> inline word64 rotlVariable<word64>(word64 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return _rotl64(x, static_cast<byte>(y));
+}
+
+/// \brief Performs a right rotate
+/// \tparam T the word type
+/// \param x the 64-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotr</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 64-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \note rotrVariable will assert in Debug builds if is outside the allowed range.
+/// \since Crypto++ 3.0
+template<> inline word64 rotrVariable<word64>(word64 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return y ? _rotr64(x, static_cast<byte>(y)) : x;
+}
+
+/// \brief Performs a left rotate
+/// \tparam T the word type
+/// \param x the 64-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotl</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 64-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \since Crypto++ 3.0
+template<> inline word64 rotlMod<word64>(word64 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return y ? _rotl64(x, static_cast<byte>(y)) : x;
+}
+
+/// \brief Performs a right rotate
+/// \tparam T the word type
+/// \param x the 64-bit value to rotate
+/// \param y the number of bit positions to rotate the value
+/// \details This is a Microsoft specific implementation using <tt>_lrotr</tt> provided by
+///  <stdlib.h>. The value x to be rotated is 64-bits. y must be in the range
+///  <tt>[0, sizeof(T)*8 - 1]</tt> to avoid undefined behavior.
+/// \since Crypto++ 3.0
+template<> inline word64 rotrMod<word64>(word64 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 8*sizeof(x));
+	return y ? _rotr64(x, static_cast<byte>(y)) : x;
+}
+
+#endif // #if CRYPTOPP_MSC_VERSION >= 1310
+
+#if CRYPTOPP_MSC_VERSION >= 1400 && !defined(__INTEL_COMPILER)
+// Intel C++ Compiler 10.0 gives undefined externals with these
+template<> inline word16 rotlFixed<word16>(word16 x, unsigned int y)
+{
+	// Intrinsic, not bound to C/C++ language rules.
+	return _rotl16(x, static_cast<byte>(y));
+}
+
+template<> inline word16 rotrFixed<word16>(word16 x, unsigned int y)
+{
+	// Intrinsic, not bound to C/C++ language rules.
+	return _rotr16(x, static_cast<byte>(y));
+}
+
+template<> inline word16 rotlVariable<word16>(word16 x, unsigned int y)
+{
+	return _rotl16(x, static_cast<byte>(y));
+}
+
+template<> inline word16 rotrVariable<word16>(word16 x, unsigned int y)
+{
+	return _rotr16(x, static_cast<byte>(y));
+}
+
+template<> inline word16 rotlMod<word16>(word16 x, unsigned int y)
+{
+	return _rotl16(x, static_cast<byte>(y));
+}
+
+template<> inline word16 rotrMod<word16>(word16 x, unsigned int y)
+{
+	return _rotr16(x, static_cast<byte>(y));
+}
+
+template<> inline byte rotlFixed<byte>(byte x, unsigned int y)
+{
+	// Intrinsic, not bound to C/C++ language rules.
+	return _rotl8(x, static_cast<byte>(y));
+}
+
+template<> inline byte rotrFixed<byte>(byte x, unsigned int y)
+{
+	// Intrinsic, not bound to C/C++ language rules.
+	return _rotr8(x, static_cast<byte>(y));
+}
+
+template<> inline byte rotlVariable<byte>(byte x, unsigned int y)
+{
+	return _rotl8(x, static_cast<byte>(y));
+}
+
+template<> inline byte rotrVariable<byte>(byte x, unsigned int y)
+{
+	return _rotr8(x, static_cast<byte>(y));
+}
+
+template<> inline byte rotlMod<byte>(byte x, unsigned int y)
+{
+	return _rotl8(x, static_cast<byte>(y));
+}
+
+template<> inline byte rotrMod<byte>(byte x, unsigned int y)
+{
+	return _rotr8(x, static_cast<byte>(y));
+}
+
+#endif // #if CRYPTOPP_MSC_VERSION >= 1400
+
+#if (defined(__MWERKS__) && TARGET_CPU_PPC)
+
+template<> inline word32 rotlFixed<word32>(word32 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 32);
+	return y ? __rlwinm(x,y,0,31) : x;
+}
+
+template<> inline word32 rotrFixed<word32>(word32 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 32);
+	return y ? __rlwinm(x,32-y,0,31) : x;
+}
+
+template<> inline word32 rotlVariable<word32>(word32 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 32);
+	return (__rlwnm(x,y,0,31));
+}
+
+template<> inline word32 rotrVariable<word32>(word32 x, unsigned int y)
+{
+	CRYPTOPP_ASSERT(y < 32);
+	return (__rlwnm(x,32-y,0,31));
+}
+
+template<> inline word32 rotlMod<word32>(word32 x, unsigned int y)
+{
+	return (__rlwnm(x,y,0,31));
+}
+
+template<> inline word32 rotrMod<word32>(word32 x, unsigned int y)
+{
+	return (__rlwnm(x,32-y,0,31));
+}
+
+#endif // __MWERKS__ && TARGET_CPU_PPC
+
+// ************** endian reversal ***************
+
+/// \brief Gets a byte from a value
+/// \param order the ByteOrder of the value
+/// \param value the value to retrieve the byte
+/// \param index the location of the byte to retrieve
+template <class T>
+inline unsigned int GetByte(ByteOrder order, T value, unsigned int index)
+{
+	if (order == LITTLE_ENDIAN_ORDER)
+		return GETBYTE(value, index);
+	else
+		return GETBYTE(value, sizeof(T)-index-1);
+}
+
+/// \brief Reverses bytes in a 8-bit value
+/// \param value the 8-bit value to reverse
+/// \note ByteReverse returns the value passed to it since there is nothing to
+///  reverse.
+inline byte ByteReverse(byte value)
+{
+	return value;
+}
+
+/// \brief Reverses bytes in a 16-bit value
+/// \param value the 16-bit value to reverse
+/// \details ByteReverse calls bswap if available. Otherwise the function
+///  performs a 8-bit rotate on the word16.
+inline word16 ByteReverse(word16 value)
+{
+#if defined(CRYPTOPP_BYTESWAP_AVAILABLE)
+	return bswap_16(value);
+#elif (CRYPTOPP_MSC_VERSION >= 1400) || (defined(CRYPTOPP_MSC_VERSION) && !defined(_DLL))
+	return _byteswap_ushort(value);
+#else
+	return rotlFixed(value, 8U);
+#endif
+}
+
+/// \brief Reverses bytes in a 32-bit value
+/// \param value the 32-bit value to reverse
+/// \details ByteReverse calls bswap if available. Otherwise the function uses
+///  a combination of rotates on the word32.
+inline word32 ByteReverse(word32 value)
+{
+#if defined(CRYPTOPP_BYTESWAP_AVAILABLE)
+	return bswap_32(value);
+#elif defined(CRYPTOPP_ARM_BYTEREV_AVAILABLE)
+	word32 rvalue;
+	__asm__ ("rev %0, %1" : "=r" (rvalue) : "r" (value));
+	return rvalue;
+#elif defined(__GNUC__) && defined(CRYPTOPP_X86_ASM_AVAILABLE)
+	__asm__ ("bswap %0" : "=r" (value) : "0" (value));
+	return value;
+#elif defined(__MWERKS__) && TARGET_CPU_PPC
+	return (word32)__lwbrx(&value,0);
+#elif (CRYPTOPP_MSC_VERSION >= 1400) || (defined(CRYPTOPP_MSC_VERSION) && !defined(_DLL))
+	return _byteswap_ulong(value);
+#elif CRYPTOPP_FAST_ROTATE(32) && !defined(__xlC__)
+	// 5 instructions with rotate instruction, 9 without
+	return (rotrFixed(value, 8U) & 0xff00ff00) | (rotlFixed(value, 8U) & 0x00ff00ff);
+#else
+	// 6 instructions with rotate instruction, 8 without
+	value = ((value & 0xFF00FF00) >> 8) | ((value & 0x00FF00FF) << 8);
+	return rotlFixed(value, 16U);
+#endif
+}
+
+/// \brief Reverses bytes in a 64-bit value
+/// \param value the 64-bit value to reverse
+/// \details ByteReverse calls bswap if available. Otherwise the function uses
+///  a combination of rotates on the word64.
+inline word64 ByteReverse(word64 value)
+{
+#if defined(CRYPTOPP_BYTESWAP_AVAILABLE)
+	return bswap_64(value);
+#elif defined(__GNUC__) && defined(CRYPTOPP_X86_ASM_AVAILABLE) && defined(__x86_64__)
+	__asm__ ("bswap %0" : "=r" (value) : "0" (value));
+	return value;
+#elif (CRYPTOPP_MSC_VERSION >= 1400) || (defined(CRYPTOPP_MSC_VERSION) && !defined(_DLL))
+	return _byteswap_uint64(value);
+#elif CRYPTOPP_BOOL_SLOW_WORD64
+	return (word64(ByteReverse(word32(value))) << 32) | ByteReverse(word32(value>>32));
+#else
+	value = ((value & W64LIT(0xFF00FF00FF00FF00)) >> 8) | ((value & W64LIT(0x00FF00FF00FF00FF)) << 8);
+	value = ((value & W64LIT(0xFFFF0000FFFF0000)) >> 16) | ((value & W64LIT(0x0000FFFF0000FFFF)) << 16);
+	return rotlFixed(value, 32U);
+#endif
+}
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+/// \brief Reverses bytes in a 128-bit value
+/// \param value the 128-bit value to reverse
+/// \details ByteReverse calls bswap if available. Otherwise the function uses
+///  a combination of rotates on the word128.
+/// \note word128 is available on some 64-bit platforms when the compiler supports it.
+/// \since Crypto++ 8.7
+inline word128 ByteReverse(word128 value)
+{
+	// TODO: speed this up
+	return (word128(ByteReverse(word64(value))) << 64) | ByteReverse(word64(value>>64));
+}
+#endif
+
+/// \brief Reverses bits in a 8-bit value
+/// \param value the 8-bit value to reverse
+/// \details BitReverse performs a combination of shifts on the byte.
+inline byte BitReverse(byte value)
+{
+	value = byte((value & 0xAA) >> 1) | byte((value & 0x55) << 1);
+	value = byte((value & 0xCC) >> 2) | byte((value & 0x33) << 2);
+	return rotlFixed(value, 4U);
+}
+
+/// \brief Reverses bits in a 16-bit value
+/// \param value the 16-bit value to reverse
+/// \details BitReverse performs a combination of shifts on the word16.
+inline word16 BitReverse(word16 value)
+{
+#if defined(CRYPTOPP_ARM_BITREV_AVAILABLE)
+	// 4 instructions on ARM.
+	word32 rvalue;
+	__asm__ ("rbit %0, %1" : "=r" (rvalue) : "r" (value));
+	return word16(rvalue >> 16);
+#else
+	// 15 instructions on ARM.
+	value = word16((value & 0xAAAA) >> 1) | word16((value & 0x5555) << 1);
+	value = word16((value & 0xCCCC) >> 2) | word16((value & 0x3333) << 2);
+	value = word16((value & 0xF0F0) >> 4) | word16((value & 0x0F0F) << 4);
+	return ByteReverse(value);
+#endif
+}
+
+/// \brief Reverses bits in a 32-bit value
+/// \param value the 32-bit value to reverse
+/// \details BitReverse performs a combination of shifts on the word32.
+inline word32 BitReverse(word32 value)
+{
+#if defined(CRYPTOPP_ARM_BITREV_AVAILABLE)
+	// 2 instructions on ARM.
+	word32 rvalue;
+	__asm__ ("rbit %0, %1" : "=r" (rvalue) : "r" (value));
+	return rvalue;
+#else
+	// 19 instructions on ARM.
+	value = word32((value & 0xAAAAAAAA) >> 1) | word32((value & 0x55555555) << 1);
+	value = word32((value & 0xCCCCCCCC) >> 2) | word32((value & 0x33333333) << 2);
+	value = word32((value & 0xF0F0F0F0) >> 4) | word32((value & 0x0F0F0F0F) << 4);
+	return ByteReverse(value);
+#endif
+}
+
+/// \brief Reverses bits in a 64-bit value
+/// \param value the 64-bit value to reverse
+/// \details BitReverse performs a combination of shifts on the word64.
+inline word64 BitReverse(word64 value)
+{
+#if CRYPTOPP_BOOL_SLOW_WORD64
+	return (word64(BitReverse(word32(value))) << 32) | BitReverse(word32(value>>32));
+#else
+	value = word64((value & W64LIT(0xAAAAAAAAAAAAAAAA)) >> 1) | word64((value & W64LIT(0x5555555555555555)) << 1);
+	value = word64((value & W64LIT(0xCCCCCCCCCCCCCCCC)) >> 2) | word64((value & W64LIT(0x3333333333333333)) << 2);
+	value = word64((value & W64LIT(0xF0F0F0F0F0F0F0F0)) >> 4) | word64((value & W64LIT(0x0F0F0F0F0F0F0F0F)) << 4);
+	return ByteReverse(value);
+#endif
+}
+
+/// \brief Reverses bits in a value
+/// \param value the value to reverse
+/// \details The template overload of BitReverse operates on signed and unsigned values.
+///  Internally the size of T is checked, and then value is cast to a byte,
+///  word16, word32 or word64. After the cast, the appropriate BitReverse
+///  overload is called.
+/// \note word128 is available on some 64-bit platforms when the compiler supports it.
+/// \since Crypto++ 1.0, word128 since Crypto++ 8.7
+template <class T>
+inline T BitReverse(T value)
+{
+	if (sizeof(T) == 1)
+		return (T)BitReverse((byte)value);
+	else if (sizeof(T) == 2)
+		return (T)BitReverse((word16)value);
+	else if (sizeof(T) == 4)
+		return (T)BitReverse((word32)value);
+	else if (sizeof(T) == 8)
+		return (T)BitReverse((word64)value);
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+	else if (sizeof(T) == 16)
+		return (T)BitReverse((word128)value);
+#endif
+	else
+	{
+		CRYPTOPP_ASSERT(0);
+		return (T)BitReverse((word64)value);
+	}
+}
+
+/// \brief Reverses bytes in a value depending upon endianness
+/// \tparam T the class or type
+/// \param order the ByteOrder of the data
+/// \param value the value to conditionally reverse
+/// \details Internally, the ConditionalByteReverse calls NativeByteOrderIs.
+///  If order matches native byte order, then the original value is returned.
+///  If not, then ByteReverse is called on the value before returning to the caller.
+template <class T>
+inline T ConditionalByteReverse(ByteOrder order, T value)
+{
+	return NativeByteOrderIs(order) ? value : ByteReverse(value);
+}
+
+/// \brief Reverses bytes in an element from an array of elements
+/// \tparam T the class or type
+/// \param out the output array of elements
+/// \param in the input array of elements
+/// \param byteCount the total number of bytes in the array
+/// \details Internally, ByteReverse visits each element in the in array
+///  calls ByteReverse on it, and writes the result to out.
+/// \details ByteReverse does not process tail byes, or bytes that are
+///  not part of a full element. If T is int (and int is 4 bytes), then
+///  <tt>byteCount = 10</tt> means only the first 2 elements or 8 bytes are
+///  reversed.
+/// \details The following program should help illustrate the behavior.
+/// <pre>vector<word32> v1, v2;
+///
+/// v1.push_back(1);
+/// v1.push_back(2);
+/// v1.push_back(3);
+/// v1.push_back(4);
+///
+/// v2.resize(v1.size());
+/// ByteReverse<word32>(&v2[0], &v1[0], 16);
+///
+/// cout << "V1: ";
+/// for(unsigned int i = 0; i < v1.size(); i++)
+///   cout << std::hex << v1[i] << " ";
+/// cout << endl;
+///
+/// cout << "V2: ";
+/// for(unsigned int i = 0; i < v2.size(); i++)
+///   cout << std::hex << v2[i] << " ";
+/// cout << endl;</pre>
+/// The program above results in the following output.
+/// <pre>V1: 00000001 00000002 00000003 00000004
+/// V2: 01000000 02000000 03000000 04000000</pre>
+/// \sa ConditionalByteReverse
+template <class T>
+void ByteReverse(T *out, const T *in, size_t byteCount)
+{
+	// Alignment check due to Issues 690
+	CRYPTOPP_ASSERT(byteCount % sizeof(T) == 0);
+	CRYPTOPP_ASSERT(IsAligned<T>(in));
+	CRYPTOPP_ASSERT(IsAligned<T>(out));
+
+	size_t count = byteCount/sizeof(T);
+	for (size_t i=0; i<count; i++)
+		out[i] = ByteReverse(in[i]);
+}
+
+/// \brief Conditionally reverses bytes in an element from an array of elements
+/// \tparam T the class or type
+/// \param order the ByteOrder of the data
+/// \param out the output array of elements
+/// \param in the input array of elements
+/// \param byteCount the byte count of the arrays
+/// \details ConditionalByteReverse visits each element in the in array
+///  calls ByteReverse on it depending on the desired endianness, and writes the result to out.
+/// \details ByteReverse does not process tail byes, or bytes that are
+///  not part of a full element. If T is int (and int is 4 bytes), then
+///  <tt>byteCount = 10</tt> means only the first 2 elements or 8 bytes are
+///  reversed.
+/// \sa ByteReverse
+template <class T>
+inline void ConditionalByteReverse(ByteOrder order, T *out, const T *in, size_t byteCount)
+{
+	if (!NativeByteOrderIs(order))
+		ByteReverse(out, in, byteCount);
+	else if (in != out)
+		memcpy_s(out, byteCount, in, byteCount);
+}
+
+/// \brief Copy bytes in a buffer to an array of elements in big-endian order
+/// \tparam T the class or type
+/// \param order the ByteOrder of the data
+/// \param out the output array of elements
+/// \param outlen the byte count of the array
+/// \param in the input array of elements
+/// \param inlen the byte count of the array
+template <class T>
+inline void GetUserKey(ByteOrder order, T *out, size_t outlen, const byte *in, size_t inlen)
+{
+	const size_t U = sizeof(T);
+	CRYPTOPP_ASSERT(inlen <= outlen*U);
+	memcpy_s(out, outlen*U, in, inlen);
+	memset_z((byte *)out+inlen, 0, outlen*U-inlen);
+	ConditionalByteReverse(order, out, out, RoundUpToMultipleOf(inlen, U));
+}
+
+/// \brief Retrieve a byte from an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned buffer
+/// \param unused dummy parameter
+/// \return byte value
+/// \details UnalignedGetWordNonTemplate accesses an unaligned buffer and returns a byte value.
+/// \since Crypto++ 1.0
+inline byte UnalignedGetWordNonTemplate(ByteOrder order, const byte *block, const byte *unused)
+{
+	CRYPTOPP_UNUSED(order); CRYPTOPP_UNUSED(unused);
+	return block[0];
+}
+
+/// \brief Retrieve a word16 from an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned buffer
+/// \param unused dummy parameter
+/// \return byte value
+/// \details UnalignedGetWordNonTemplate accesses an unaligned buffer and returns a word16 value.
+/// \since Crypto++ 1.0
+inline word16 UnalignedGetWordNonTemplate(ByteOrder order, const byte *block, const word16 *unused)
+{
+	CRYPTOPP_UNUSED(unused);
+	return (order == BIG_ENDIAN_ORDER)
+		? block[1] | (block[0] << 8)
+		: block[0] | (block[1] << 8);
+}
+
+/// \brief Retrieve a word32 from an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned buffer
+/// \param unused dummy parameter
+/// \return byte value
+/// \details UnalignedGetWordNonTemplate accesses an unaligned buffer and returns a word32 value.
+/// \since Crypto++ 1.0
+inline word32 UnalignedGetWordNonTemplate(ByteOrder order, const byte *block, const word32 *unused)
+{
+	CRYPTOPP_UNUSED(unused);
+	return (order == BIG_ENDIAN_ORDER)
+		? word32(block[3]) | (word32(block[2]) << 8) | (word32(block[1]) << 16) | (word32(block[0]) << 24)
+		: word32(block[0]) | (word32(block[1]) << 8) | (word32(block[2]) << 16) | (word32(block[3]) << 24);
+}
+
+/// \brief Retrieve a word64 from an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned buffer
+/// \param unused dummy parameter
+/// \return byte value
+/// \details UnalignedGetWordNonTemplate accesses an unaligned buffer and returns a word64 value.
+/// \since Crypto++ 1.0
+inline word64 UnalignedGetWordNonTemplate(ByteOrder order, const byte *block, const word64 *unused)
+{
+	CRYPTOPP_UNUSED(unused);
+	return (order == BIG_ENDIAN_ORDER)
+		?
+		(word64(block[7]) |
+		(word64(block[6]) <<  8) |
+		(word64(block[5]) << 16) |
+		(word64(block[4]) << 24) |
+		(word64(block[3]) << 32) |
+		(word64(block[2]) << 40) |
+		(word64(block[1]) << 48) |
+		(word64(block[0]) << 56))
+		:
+		(word64(block[0]) |
+		(word64(block[1]) <<  8) |
+		(word64(block[2]) << 16) |
+		(word64(block[3]) << 24) |
+		(word64(block[4]) << 32) |
+		(word64(block[5]) << 40) |
+		(word64(block[6]) << 48) |
+		(word64(block[7]) << 56));
+}
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+/// \brief Retrieve a word128 from an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned buffer
+/// \param unused dummy parameter
+/// \return byte value
+/// \details UnalignedGetWordNonTemplate accesses an unaligned buffer and returns a word128 value.
+/// \note word128 is available on some 64-bit platforms when the compiler supports it.
+/// \since Crypto++ 8.7
+inline word128 UnalignedGetWordNonTemplate(ByteOrder order, const byte *block, const word128 *unused)
+{
+	CRYPTOPP_UNUSED(unused);
+	return (order == BIG_ENDIAN_ORDER)
+		?
+		(word128(block[15]) |
+		(word128(block[14]) <<   8) |
+		(word128(block[13]) <<  16) |
+		(word128(block[12]) <<  24) |
+		(word128(block[11]) <<  32) |
+		(word128(block[10]) <<  40) |
+		(word128(block[ 9]) <<  48) |
+		(word128(block[ 8]) <<  56) |
+		(word128(block[ 7]) <<  64) |
+		(word128(block[ 6]) <<  72) |
+		(word128(block[ 5]) <<  80) |
+		(word128(block[ 4]) <<  88) |
+		(word128(block[ 3]) <<  96) |
+		(word128(block[ 2]) << 104) |
+		(word128(block[ 1]) << 112) |
+		(word128(block[ 0]) << 120))
+		:
+		(word128(block[ 0]) |
+		(word128(block[ 1]) <<   8) |
+		(word128(block[ 2]) <<  16) |
+		(word128(block[ 3]) <<  24) |
+		(word128(block[ 4]) <<  32) |
+		(word128(block[ 5]) <<  40) |
+		(word128(block[ 6]) <<  48) |
+		(word128(block[ 7]) <<  56) |
+		(word128(block[ 8]) <<  64) |
+		(word128(block[ 9]) <<  72) |
+		(word128(block[10]) <<  80) |
+		(word128(block[11]) <<  88) |
+		(word128(block[12]) <<  96) |
+		(word128(block[13]) << 104) |
+		(word128(block[14]) << 112) |
+		(word128(block[15]) << 120));
+}
+#endif
+
+/// \brief Write a byte to an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned output buffer
+/// \param value byte value
+/// \param xorBlock optional unaligned xor buffer
+/// \details UnalignedbyteNonTemplate writes a byte value to an unaligned buffer.
+/// \since Crypto++ 1.0
+inline void UnalignedbyteNonTemplate(ByteOrder order, byte *block, byte value, const byte *xorBlock)
+{
+	CRYPTOPP_UNUSED(order);
+	block[0] = static_cast<byte>(xorBlock ? (value ^ xorBlock[0]) : value);
+}
+
+/// \brief Write a word16 to an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned output buffer
+/// \param value word16 value
+/// \param xorBlock optional unaligned xor buffer
+/// \details UnalignedbyteNonTemplate writes a word16 value to an unaligned buffer.
+/// \since Crypto++ 1.0
+inline void UnalignedbyteNonTemplate(ByteOrder order, byte *block, word16 value, const byte *xorBlock)
+{
+	if (order == BIG_ENDIAN_ORDER)
+	{
+		if (xorBlock)
+		{
+			block[0] = xorBlock[0] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[1] = xorBlock[1] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+		}
+		else
+		{
+			block[0] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[1] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+		}
+	}
+	else
+	{
+		if (xorBlock)
+		{
+			block[0] = xorBlock[0] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+			block[1] = xorBlock[1] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+		}
+		else
+		{
+			block[0] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+			block[1] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+		}
+	}
+}
+
+/// \brief Write a word32 to an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned output buffer
+/// \param value word32 value
+/// \param xorBlock optional unaligned xor buffer
+/// \details UnalignedbyteNonTemplate writes a word32 value to an unaligned buffer.
+/// \since Crypto++ 1.0
+inline void UnalignedbyteNonTemplate(ByteOrder order, byte *block, word32 value, const byte *xorBlock)
+{
+	if (order == BIG_ENDIAN_ORDER)
+	{
+		if (xorBlock)
+		{
+			block[0] = xorBlock[0] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[1] = xorBlock[1] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[2] = xorBlock[2] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[3] = xorBlock[3] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+		}
+		else
+		{
+			block[0] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[1] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[2] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[3] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+		}
+	}
+	else
+	{
+		if (xorBlock)
+		{
+			block[0] = xorBlock[0] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+			block[1] = xorBlock[1] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[2] = xorBlock[2] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[3] = xorBlock[3] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+		}
+		else
+		{
+			block[0] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+			block[1] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[2] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[3] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+		}
+	}
+}
+
+/// \brief Write a word64 to an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned output buffer
+/// \param value word64 value
+/// \param xorBlock optional unaligned xor buffer
+/// \details UnalignedbyteNonTemplate writes a word64 value to an unaligned buffer.
+/// \since Crypto++ 1.0
+inline void UnalignedbyteNonTemplate(ByteOrder order, byte *block, word64 value, const byte *xorBlock)
+{
+	if (order == BIG_ENDIAN_ORDER)
+	{
+		if (xorBlock)
+		{
+			block[0] = xorBlock[0] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 7);
+			block[1] = xorBlock[1] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 6);
+			block[2] = xorBlock[2] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 5);
+			block[3] = xorBlock[3] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 4);
+			block[4] = xorBlock[4] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[5] = xorBlock[5] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[6] = xorBlock[6] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[7] = xorBlock[7] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+		}
+		else
+		{
+			block[0] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 7);
+			block[1] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 6);
+			block[2] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 5);
+			block[3] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 4);
+			block[4] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[5] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[6] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[7] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+		}
+	}
+	else
+	{
+		if (xorBlock)
+		{
+			block[0] = xorBlock[0] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+			block[1] = xorBlock[1] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[2] = xorBlock[2] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[3] = xorBlock[3] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[4] = xorBlock[4] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 4);
+			block[5] = xorBlock[5] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 5);
+			block[6] = xorBlock[6] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 6);
+			block[7] = xorBlock[7] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 7);
+		}
+		else
+		{
+			block[0] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+			block[1] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[2] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[3] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[4] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 4);
+			block[5] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 5);
+			block[6] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 6);
+			block[7] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 7);
+		}
+	}
+}
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+/// \brief Write a word128 to an unaligned buffer
+/// \param order the ByteOrder of the data
+/// \param block an unaligned output buffer
+/// \param value word128 value
+/// \param xorBlock optional unaligned xor buffer
+/// \details UnalignedbyteNonTemplate writes a word128 value to an unaligned buffer.
+/// \note word128 is available on some 64-bit platforms when the compiler supports it.
+/// \since Crypto++ 8.7
+inline void UnalignedbyteNonTemplate(ByteOrder order, byte *block, word128 value, const byte *xorBlock)
+{
+	if (order == BIG_ENDIAN_ORDER)
+	{
+		if (xorBlock)
+		{
+			block[0] = xorBlock[0] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 15);
+			block[1] = xorBlock[1] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 14);
+			block[2] = xorBlock[2] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 13);
+			block[3] = xorBlock[3] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 12);
+			block[4] = xorBlock[4] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 11);
+			block[5] = xorBlock[5] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 10);
+			block[6] = xorBlock[6] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value,  9);
+			block[7] = xorBlock[7] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value,  8);
+
+			block[ 8] = xorBlock[ 8] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 7);
+			block[ 9] = xorBlock[ 9] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 6);
+			block[10] = xorBlock[10] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 5);
+			block[11] = xorBlock[11] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 4);
+			block[12] = xorBlock[12] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[13] = xorBlock[13] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[14] = xorBlock[14] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[15] = xorBlock[15] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+		}
+		else
+		{
+			block[0] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 15);
+			block[1] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 14);
+			block[2] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 13);
+			block[3] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 12);
+			block[4] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 11);
+			block[5] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 10);
+			block[6] = CRYPTOPP_GET_BYTE_AS_BYTE(value,  9);
+			block[7] = CRYPTOPP_GET_BYTE_AS_BYTE(value,  8);
+
+			block[ 8] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 7);
+			block[ 9] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 6);
+			block[10] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 5);
+			block[11] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 4);
+			block[12] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[13] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[14] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[15] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+		}
+	}
+	else
+	{
+		if (xorBlock)
+		{
+			block[0] = xorBlock[0] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+			block[1] = xorBlock[1] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[2] = xorBlock[2] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[3] = xorBlock[3] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[4] = xorBlock[4] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 4);
+			block[5] = xorBlock[5] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 5);
+			block[6] = xorBlock[6] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 6);
+			block[7] = xorBlock[7] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 7);
+
+			block[ 8] = xorBlock[ 8] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value,  8);
+			block[ 9] = xorBlock[ 9] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value,  9);
+			block[10] = xorBlock[10] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 10);
+			block[11] = xorBlock[11] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 11);
+			block[12] = xorBlock[12] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 12);
+			block[13] = xorBlock[13] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 13);
+			block[14] = xorBlock[14] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 14);
+			block[15] = xorBlock[15] ^ CRYPTOPP_GET_BYTE_AS_BYTE(value, 15);
+		}
+		else
+		{
+			block[0] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 0);
+			block[1] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 1);
+			block[2] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 2);
+			block[3] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 3);
+			block[4] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 4);
+			block[5] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 5);
+			block[6] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 6);
+			block[7] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 7);
+
+			block[ 8] = CRYPTOPP_GET_BYTE_AS_BYTE(value,  8);
+			block[ 9] = CRYPTOPP_GET_BYTE_AS_BYTE(value,  9);
+			block[10] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 10);
+			block[11] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 11);
+			block[12] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 12);
+			block[13] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 13);
+			block[14] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 14);
+			block[15] = CRYPTOPP_GET_BYTE_AS_BYTE(value, 15);
+		}
+	}
+}
+#endif
+
+/// \brief Access a block of memory
+/// \tparam T class or type
+/// \param assumeAligned flag indicating alignment
+/// \param order the ByteOrder of the data
+/// \param block the byte buffer to be processed
+/// \return the word in the specified byte order
+/// \details GetWord() provides alternate read access to a block of memory. The flag assumeAligned indicates
+///  if the memory block is aligned for class or type T. The enumeration ByteOrder is BIG_ENDIAN_ORDER or
+///  LITTLE_ENDIAN_ORDER.
+/// \details An example of reading two word32 values from a block of memory is shown below. <tt>w</tt>
+///  will be <tt>0x03020100</tt>.
+/// <pre>
+///   word32 w;
+///   byte buffer[4] = {0,1,2,3};
+///   w = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, buffer);
+/// </pre>
+template <class T>
+inline T GetWord(bool assumeAligned, ByteOrder order, const byte *block)
+{
+	CRYPTOPP_UNUSED(assumeAligned);
+
+	T temp = 0;
+	if (block != NULLPTR) {std::memcpy(&temp, block, sizeof(T));}
+	return ConditionalByteReverse(order, temp);
+}
+
+/// \brief Access a block of memory
+/// \tparam T class or type
+/// \param assumeAligned flag indicating alignment
+/// \param order the ByteOrder of the data
+/// \param result the word in the specified byte order
+/// \param block the byte buffer to be processed
+/// \details GetWord() provides alternate read access to a block of memory. The flag assumeAligned indicates
+///  if the memory block is aligned for class or type T. The enumeration ByteOrder is BIG_ENDIAN_ORDER or
+///  LITTLE_ENDIAN_ORDER.
+/// \details An example of reading two word32 values from a block of memory is shown below. <tt>w</tt>
+///  will be <tt>0x03020100</tt>.
+/// <pre>
+///   word32 w;
+///   byte buffer[4] = {0,1,2,3};
+///   w = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, buffer);
+/// </pre>
+template <class T>
+inline void GetWord(bool assumeAligned, ByteOrder order, T &result, const byte *block)
+{
+	result = GetWord<T>(assumeAligned, order, block);
+}
+
+/// \brief Access a block of memory
+/// \tparam T class or type
+/// \param assumeAligned flag indicating alignment
+/// \param order the ByteOrder of the data
+/// \param block the destination byte buffer
+/// \param value the word in the specified byte order
+/// \param xorBlock an optional byte buffer to xor
+/// \details PutWord() provides alternate write access to a block of memory. The flag assumeAligned indicates
+///  if the memory block is aligned for class or type T. The enumeration ByteOrder is BIG_ENDIAN_ORDER or
+///  LITTLE_ENDIAN_ORDER.
+template <class T>
+inline void PutWord(bool assumeAligned, ByteOrder order, byte *block, T value, const byte *xorBlock = NULLPTR)
+{
+	CRYPTOPP_UNUSED(assumeAligned);
+
+	T t1, t2;
+	t1 = ConditionalByteReverse(order, value);
+	if (xorBlock != NULLPTR) {std::memcpy(&t2, xorBlock, sizeof(T)); t1 ^= t2;}
+	if (block != NULLPTR) {std::memcpy(block, &t1, sizeof(T));}
+}
+
+/// \brief Access a block of memory
+/// \tparam T class or type
+/// \tparam B enumeration indicating endianness
+/// \tparam A flag indicating alignment
+/// \details GetBlock() provides alternate read access to a block of memory. The enumeration B is
+///  BigEndian or LittleEndian. The flag A indicates if the memory block is aligned for class or type T.
+///  Repeatedly applying operator() results in advancing in the block of memory.
+/// \details An example of reading two word32 values from a block of memory is shown below. <tt>w1</tt>
+///  will be <tt>0x03020100</tt> and <tt>w1</tt> will be <tt>0x07060504</tt>.
+/// <pre>
+///   word32 w1, w2;
+///   byte buffer[8] = {0,1,2,3,4,5,6,7};
+///   GetBlock<word32, LittleEndian> block(buffer);
+///   block(w1)(w2);
+/// </pre>
+template <class T, class B, bool A=false>
+class GetBlock
+{
+public:
+	/// \brief Construct a GetBlock
+	/// \param block the memory block
+	GetBlock(const void *block)
+		: m_block((const byte *)block) {}
+
+	/// \brief Access a block of memory
+	/// \tparam U class or type
+	/// \param x the value to read
+	/// \return pointer to the remainder of the block after reading x
+	template <class U>
+	inline GetBlock<T, B, A> & operator()(U &x)
+	{
+		CRYPTOPP_COMPILE_ASSERT(sizeof(U) >= sizeof(T));
+		x = GetWord<T>(A, B::ToEnum(), m_block);
+		m_block += sizeof(T);
+		return *this;
+	}
+
+private:
+	const byte *m_block;
+};
+
+/// \brief Access a block of memory
+/// \tparam T class or type
+/// \tparam B enumeration indicating endianness
+/// \tparam A flag indicating alignment
+/// \details PutBlock() provides alternate write access to a block of memory. The enumeration B is
+///  BigEndian or LittleEndian. The flag A indicates if the memory block is aligned for class or type T.
+///  Repeatedly applying operator() results in advancing in the block of memory.
+/// \details An example of writing two word32 values from a block of memory is shown below. After the code
+///  executes, the byte buffer will be <tt>{0,1,2,3,4,5,6,7}</tt>.
+/// <pre>
+///   word32 w1=0x03020100, w2=0x07060504;
+///   byte buffer[8];
+///   PutBlock<word32, LittleEndian> block(NULLPTR, buffer);
+///   block(w1)(w2);
+/// </pre>
+template <class T, class B, bool A=false>
+class PutBlock
+{
+public:
+	/// \brief Construct a PutBlock
+	/// \param block the memory block
+	/// \param xorBlock optional mask
+	PutBlock(const void *xorBlock, void *block)
+		: m_xorBlock((const byte *)xorBlock), m_block((byte *)block) {}
+
+	/// \brief Access a block of memory
+	/// \tparam U class or type
+	/// \param x the value to write
+	/// \return pointer to the remainder of the block after writing x
+	template <class U>
+	inline PutBlock<T, B, A> & operator()(U x)
+	{
+		PutWord(A, B::ToEnum(), m_block, (T)x, m_xorBlock);
+		m_block += sizeof(T);
+		if (m_xorBlock)
+			m_xorBlock += sizeof(T);
+		return *this;
+	}
+
+private:
+	const byte *m_xorBlock;
+	byte *m_block;
+};
+
+/// \brief Access a block of memory
+/// \tparam T class or type
+/// \tparam B enumeration indicating endianness
+/// \tparam GA flag indicating alignment for the Get operation
+/// \tparam PA flag indicating alignment for the Put operation
+/// \details GetBlock() provides alternate write access to a block of memory. The enumeration B is
+///  BigEndian or LittleEndian. The flag A indicates if the memory block is aligned for class or type T.
+/// \sa GetBlock() and PutBlock().
+template <class T, class B, bool GA=false, bool PA=false>
+struct BlockGetAndPut
+{
+	// function needed because of C++ grammatical ambiguity between expression-statements and declarations
+	static inline GetBlock<T, B, GA> Get(const void *block) {return GetBlock<T, B, GA>(block);}
+	typedef PutBlock<T, B, PA> Put;
+};
+
+/// \brief Convert a word to a string
+/// \tparam T class or type
+/// \param value the word to convert
+/// \param order byte order
+/// \return a string representing the value of the word
+template <class T>
+std::string WordToString(T value, ByteOrder order = BIG_ENDIAN_ORDER)
+{
+	if (!NativeByteOrderIs(order))
+		value = ByteReverse(value);
+
+	return std::string((char *)&value, sizeof(value));
+}
+
+/// \brief Convert a string to a word
+/// \tparam T class or type
+/// \param str the string to convert
+/// \param order byte order
+/// \return a word representing the value of the string
+template <class T>
+T StringToWord(const std::string &str, ByteOrder order = BIG_ENDIAN_ORDER)
+{
+	T value = 0;
+	memcpy_s(&value, sizeof(value), str.data(), UnsignedMin(str.size(), sizeof(value)));
+	return NativeByteOrderIs(order) ? value : ByteReverse(value);
+}
+
+// ************** help remove warning on g++ ***************
+
+/// \brief Safely shift values when undefined behavior could occur
+/// \tparam overflow boolean flag indicating if overflow is present
+/// \details SafeShifter safely shifts values when undefined behavior could occur under C/C++ rules.
+///  The class behaves much like a saturating arithmetic class, clamping values rather than allowing
+///  the compiler to remove undefined behavior.
+/// \sa SafeShifter<true>, SafeShifter<false>
+template <bool overflow> struct SafeShifter;
+
+/// \brief Shifts a value in the presence of overflow
+/// \details the true template parameter indicates overflow would occur.
+///  In this case, SafeShifter clamps the value and returns 0.
+template<> struct SafeShifter<true>
+{
+	/// \brief Right shifts a value that overflows
+	/// \tparam T class or type
+	/// \return 0
+	/// \details Since <tt>overflow == true</tt>, the value 0 is always returned.
+	/// \sa SafeLeftShift
+	template <class T>
+	static inline T RightShift(T value, unsigned int bits)
+	{
+		CRYPTOPP_UNUSED(value); CRYPTOPP_UNUSED(bits);
+		return 0;
+	}
+
+	/// \brief Left shifts a value that overflows
+	/// \tparam T class or type
+	/// \return 0
+	/// \details Since <tt>overflow == true</tt>, the value 0 is always returned.
+	/// \sa SafeRightShift
+	template <class T>
+	static inline T LeftShift(T value, unsigned int bits)
+	{
+		CRYPTOPP_UNUSED(value); CRYPTOPP_UNUSED(bits);
+		return 0;
+	}
+};
+
+/// \brief Shifts a value in the absence of overflow
+/// \details the false template parameter indicates overflow would not occur.
+///  In this case, SafeShifter returns the shfted value.
+template<> struct SafeShifter<false>
+{
+	/// \brief Right shifts a value that does not overflow
+	/// \tparam T class or type
+	/// \return the shifted value
+	/// \details Since <tt>overflow == false</tt>, the shifted value is returned.
+	/// \sa SafeLeftShift
+	template <class T>
+	static inline T RightShift(T value, unsigned int bits)
+	{
+		return value >> bits;
+	}
+
+	/// \brief Left shifts a value that does not overflow
+	/// \tparam T class or type
+	/// \return the shifted value
+	/// \details Since <tt>overflow == false</tt>, the shifted value is returned.
+	/// \sa SafeRightShift
+	template <class T>
+	static inline T LeftShift(T value, unsigned int bits)
+	{
+		return value << bits;
+	}
+};
+
+/// \brief Safely right shift values when undefined behavior could occur
+/// \tparam bits the number of bit positions to shift the value
+/// \tparam T class or type
+/// \param value the value to right shift
+/// \result the shifted value or 0
+/// \details SafeRightShift safely shifts the value to the right when undefined behavior
+///  could occur under C/C++ rules. SafeRightShift will return the shifted value or 0
+///  if undefined behavior would occur.
+template <unsigned int bits, class T>
+inline T SafeRightShift(T value)
+{
+	return SafeShifter<(bits>=(8*sizeof(T)))>::RightShift(value, bits);
+}
+
+/// \brief Safely left shift values when undefined behavior could occur
+/// \tparam bits the number of bit positions to shift the value
+/// \tparam T class or type
+/// \param value the value to left shift
+/// \result the shifted value or 0
+/// \details SafeLeftShift safely shifts the value to the left when undefined behavior
+///  could occur under C/C++ rules. SafeLeftShift will return the shifted value or 0
+///  if undefined behavior would occur.
+template <unsigned int bits, class T>
+inline T SafeLeftShift(T value)
+{
+	return SafeShifter<(bits>=(8*sizeof(T)))>::LeftShift(value, bits);
+}
+
+/// \brief Finds first element not in a range
+/// \tparam InputIt Input iterator type
+/// \tparam T class or type
+/// \param first iterator to first element
+/// \param last iterator to last element
+/// \param value the value used as a predicate
+/// \return iterator to the first element in the range that is not value
+template<typename InputIt, typename T>
+inline InputIt FindIfNot(InputIt first, InputIt last, const T &value) {
+#ifdef CRYPTOPP_CXX11_LAMBDA
+    return std::find_if(first, last, [&value](const T &o) {
+        return value!=o;
+    });
+#else
+    return std::find_if(first, last, std::bind2nd(std::not_equal_to<T>(), value));
+#endif
+}
+
+// ************** use one buffer for multiple data members ***************
+
+#define CRYPTOPP_BLOCK_1(n, t, s) t* m_##n() {return (t *)(void *)(m_aggregate+0);}     size_t SS1() {return       sizeof(t)*(s);} size_t m_##n##Size() {return (s);}
+#define CRYPTOPP_BLOCK_2(n, t, s) t* m_##n() {return (t *)(void *)(m_aggregate+SS1());} size_t SS2() {return SS1()+sizeof(t)*(s);} size_t m_##n##Size() {return (s);}
+#define CRYPTOPP_BLOCK_3(n, t, s) t* m_##n() {return (t *)(void *)(m_aggregate+SS2());} size_t SS3() {return SS2()+sizeof(t)*(s);} size_t m_##n##Size() {return (s);}
+#define CRYPTOPP_BLOCK_4(n, t, s) t* m_##n() {return (t *)(void *)(m_aggregate+SS3());} size_t SS4() {return SS3()+sizeof(t)*(s);} size_t m_##n##Size() {return (s);}
+#define CRYPTOPP_BLOCK_5(n, t, s) t* m_##n() {return (t *)(void *)(m_aggregate+SS4());} size_t SS5() {return SS4()+sizeof(t)*(s);} size_t m_##n##Size() {return (s);}
+#define CRYPTOPP_BLOCK_6(n, t, s) t* m_##n() {return (t *)(void *)(m_aggregate+SS5());} size_t SS6() {return SS5()+sizeof(t)*(s);} size_t m_##n##Size() {return (s);}
+#define CRYPTOPP_BLOCK_7(n, t, s) t* m_##n() {return (t *)(void *)(m_aggregate+SS6());} size_t SS7() {return SS6()+sizeof(t)*(s);} size_t m_##n##Size() {return (s);}
+#define CRYPTOPP_BLOCK_8(n, t, s) t* m_##n() {return (t *)(void *)(m_aggregate+SS7());} size_t SS8() {return SS7()+sizeof(t)*(s);} size_t m_##n##Size() {return (s);}
+#define CRYPTOPP_BLOCKS_END(i) size_t SST() {return SS##i();} void AllocateBlocks() {m_aggregate.New(SST());} AlignedSecByteBlock m_aggregate;
+
+NAMESPACE_END
+
+#if (CRYPTOPP_MSC_VERSION)
+# pragma warning(pop)
+#endif
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic pop
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/modarith.h b/runtime/third_party/cryptopp/modarith.h
new file mode 100644
index 0000000..408f4ca
--- /dev/null
+++ b/runtime/third_party/cryptopp/modarith.h
@@ -0,0 +1,344 @@
+// modarith.h - originally written and placed in the public domain by Wei Dai
+
+/// \file modarith.h
+/// \brief Class file for performing modular arithmetic.
+
+#ifndef CRYPTOPP_MODARITH_H
+#define CRYPTOPP_MODARITH_H
+
+// implementations are in integer.cpp
+
+#include "cryptlib.h"
+#include "integer.h"
+#include "algebra.h"
+#include "secblock.h"
+#include "misc.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4231 4275)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+CRYPTOPP_DLL_TEMPLATE_CLASS AbstractGroup<Integer>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AbstractRing<Integer>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AbstractEuclideanDomain<Integer>;
+
+/// \brief Ring of congruence classes modulo n
+/// \details This implementation represents each congruence class as
+///  the smallest non-negative integer in that class.
+/// \details <tt>const Element&</tt> returned by member functions are
+///  references to internal data members. Since each object may have
+///  only one such data member for holding results, you should use the
+///  class like this:
+///  <pre>    abcd = group.Add(a, group.Add(b, group.Add(c,d));</pre>
+///  The following code will produce <i>incorrect</i> results:
+///  <pre>    abcd = group.Add(group.Add(a,b), group.Add(c,d));</pre>
+/// \details If a ModularArithmetic() is copied or assigned the modulus
+///  is copied, but not the internal data members. The internal data
+///  members are undefined after copy or assignment.
+/// \sa <A HREF="https://cryptopp.com/wiki/Integer">Integer</A> on the
+///  Crypto++ wiki.
+class CRYPTOPP_DLL ModularArithmetic : public AbstractRing<Integer>
+{
+public:
+
+	typedef int RandomizationParameter;
+	typedef Integer Element;
+
+	virtual ~ModularArithmetic() {}
+
+	/// \brief Construct a ModularArithmetic
+	/// \param modulus congruence class modulus
+	ModularArithmetic(const Integer &modulus = Integer::One())
+		: m_modulus(modulus), m_result(static_cast<word>(0), modulus.reg.size()) {}
+
+	/// \brief Copy construct a ModularArithmetic
+	/// \param ma other ModularArithmetic
+	ModularArithmetic(const ModularArithmetic &ma)
+		: AbstractRing<Integer>(ma), m_modulus(ma.m_modulus), m_result(static_cast<word>(0), m_modulus.reg.size()) {}
+
+	/// \brief Assign a ModularArithmetic
+	/// \param ma other ModularArithmetic
+	ModularArithmetic& operator=(const ModularArithmetic &ma) {
+		if (this != &ma)
+		{
+			m_modulus = ma.m_modulus;
+			m_result = Integer(static_cast<word>(0), m_modulus.reg.size());
+		}
+		return *this;
+	}
+
+	/// \brief Construct a ModularArithmetic
+	/// \param bt BER encoded ModularArithmetic
+	ModularArithmetic(BufferedTransformation &bt);	// construct from BER encoded parameters
+
+	/// \brief Clone a ModularArithmetic
+	/// \return pointer to a new ModularArithmetic
+	/// \details Clone effectively copy constructs a new ModularArithmetic. The caller is
+	///   responsible for deleting the pointer returned from this method.
+	virtual ModularArithmetic * Clone() const {return new ModularArithmetic(*this);}
+
+	/// \brief Encodes in DER format
+	/// \param bt BufferedTransformation object
+	void DEREncode(BufferedTransformation &bt) const;
+
+	/// \brief Encodes element in DER format
+	/// \param out BufferedTransformation object
+	/// \param a Element to encode
+	void DEREncodeElement(BufferedTransformation &out, const Element &a) const;
+
+	/// \brief Decodes element in DER format
+	/// \param in BufferedTransformation object
+	/// \param a Element to decode
+	void BERDecodeElement(BufferedTransformation &in, Element &a) const;
+
+	/// \brief Retrieves the modulus
+	/// \return the modulus
+	const Integer& GetModulus() const {return m_modulus;}
+
+	/// \brief Sets the modulus
+	/// \param newModulus the new modulus
+	void SetModulus(const Integer &newModulus)
+		{m_modulus = newModulus; m_result.reg.resize(m_modulus.reg.size());}
+
+	/// \brief Retrieves the representation
+	/// \return true if the if the modulus is in Montgomery form for multiplication, false otherwise
+	virtual bool IsMontgomeryRepresentation() const {return false;}
+
+	/// \brief Reduces an element in the congruence class
+	/// \param a element to convert
+	/// \return the reduced element
+	/// \details ConvertIn is useful for derived classes, like MontgomeryRepresentation, which
+	///   must convert between representations.
+	virtual Integer ConvertIn(const Integer &a) const
+		{return a%m_modulus;}
+
+	/// \brief Reduces an element in the congruence class
+	/// \param a element to convert
+	/// \return the reduced element
+	/// \details ConvertOut is useful for derived classes, like MontgomeryRepresentation, which
+	///   must convert between representations.
+	virtual Integer ConvertOut(const Integer &a) const
+		{return a;}
+
+	/// \brief Divides an element by 2
+	/// \param a element to convert
+	const Integer& Half(const Integer &a) const;
+
+	/// \brief Compare two elements for equality
+	/// \param a first element
+	/// \param b second element
+	/// \return true if the elements are equal, false otherwise
+	/// \details Equal() tests the elements for equality using <tt>a==b</tt>
+	bool Equal(const Integer &a, const Integer &b) const
+		{return a==b;}
+
+	/// \brief Provides the Identity element
+	/// \return the Identity element
+	const Integer& Identity() const
+		{return Integer::Zero();}
+
+	/// \brief Adds elements in the ring
+	/// \param a first element
+	/// \param b second element
+	/// \return the sum of <tt>a</tt> and <tt>b</tt>
+	const Integer& Add(const Integer &a, const Integer &b) const;
+
+	/// \brief TODO
+	/// \param a first element
+	/// \param b second element
+	/// \return TODO
+	Integer& Accumulate(Integer &a, const Integer &b) const;
+
+	/// \brief Inverts the element in the ring
+	/// \param a first element
+	/// \return the inverse of the element
+	const Integer& Inverse(const Integer &a) const;
+
+	/// \brief Subtracts elements in the ring
+	/// \param a first element
+	/// \param b second element
+	/// \return the difference of <tt>a</tt> and <tt>b</tt>. The element <tt>a</tt> must provide a Subtract member function.
+	const Integer& Subtract(const Integer &a, const Integer &b) const;
+
+	/// \brief TODO
+	/// \param a first element
+	/// \param b second element
+	/// \return TODO
+	Integer& Reduce(Integer &a, const Integer &b) const;
+
+	/// \brief Doubles an element in the ring
+	/// \param a the element
+	/// \return the element doubled
+	/// \details Double returns <tt>Add(a, a)</tt>. The element <tt>a</tt> must provide an Add member function.
+	const Integer& Double(const Integer &a) const
+		{return Add(a, a);}
+
+	/// \brief Retrieves the multiplicative identity
+	/// \return the multiplicative identity
+	/// \details the base class implementations returns 1.
+	const Integer& MultiplicativeIdentity() const
+		{return Integer::One();}
+
+	/// \brief Multiplies elements in the ring
+	/// \param a the multiplicand
+	/// \param b the multiplier
+	/// \return the product of a and b
+	/// \details Multiply returns <tt>a*b\%n</tt>.
+	const Integer& Multiply(const Integer &a, const Integer &b) const
+		{return m_result1 = a*b%m_modulus;}
+
+	/// \brief Square an element in the ring
+	/// \param a the element
+	/// \return the element squared
+	/// \details Square returns <tt>a*a\%n</tt>. The element <tt>a</tt> must provide a Square member function.
+	const Integer& Square(const Integer &a) const
+		{return m_result1 = a.Squared()%m_modulus;}
+
+	/// \brief Determines whether an element is a unit in the ring
+	/// \param a the element
+	/// \return true if the element is a unit after reduction, false otherwise.
+	bool IsUnit(const Integer &a) const
+		{return Integer::Gcd(a, m_modulus).IsUnit();}
+
+	/// \brief Calculate the multiplicative inverse of an element in the ring
+	/// \param a the element
+	/// \details MultiplicativeInverse returns <tt>a<sup>-1</sup>\%n</tt>. The element <tt>a</tt> must
+	///   provide a InverseMod member function.
+	const Integer& MultiplicativeInverse(const Integer &a) const
+		{return m_result1 = a.InverseMod(m_modulus);}
+
+	/// \brief Divides elements in the ring
+	/// \param a the dividend
+	/// \param b the divisor
+	/// \return the quotient
+	/// \details Divide returns <tt>a*b<sup>-1</sup>\%n</tt>.
+	const Integer& Divide(const Integer &a, const Integer &b) const
+		{return Multiply(a, MultiplicativeInverse(b));}
+
+	/// \brief TODO
+	/// \param x first element
+	/// \param e1 first exponent
+	/// \param y second element
+	/// \param e2 second exponent
+	/// \return TODO
+	Integer CascadeExponentiate(const Integer &x, const Integer &e1, const Integer &y, const Integer &e2) const;
+
+	/// \brief Exponentiates a base to multiple exponents in the ring
+	/// \param results an array of Elements
+	/// \param base the base to raise to the exponents
+	/// \param exponents an array of exponents
+	/// \param exponentsCount the number of exponents in the array
+	/// \details SimultaneousExponentiate() raises the base to each exponent in the exponents array and stores the
+	///   result at the respective position in the results array.
+	/// \details SimultaneousExponentiate() must be implemented in a derived class.
+	/// \pre <tt>COUNTOF(results) == exponentsCount</tt>
+	/// \pre <tt>COUNTOF(exponents) == exponentsCount</tt>
+	void SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const;
+
+	/// \brief Provides the maximum bit size of an element in the ring
+	/// \return maximum bit size of an element
+	unsigned int MaxElementBitLength() const
+		{return (m_modulus-1).BitCount();}
+
+	/// \brief Provides the maximum byte size of an element in the ring
+	/// \return maximum byte size of an element
+	unsigned int MaxElementByteLength() const
+		{return (m_modulus-1).ByteCount();}
+
+	/// \brief Provides a random element in the ring
+	/// \param rng RandomNumberGenerator used to generate material
+	/// \param ignore_for_now unused
+	/// \return a random element that is uniformly distributed
+	/// \details RandomElement constructs a new element in the range <tt>[0,n-1]</tt>, inclusive.
+	///   The element's class must provide a constructor with the signature <tt>Element(RandomNumberGenerator rng,
+	///   Element min, Element max)</tt>.
+	Element RandomElement(RandomNumberGenerator &rng, const RandomizationParameter &ignore_for_now = 0) const
+		// left RandomizationParameter arg as ref in case RandomizationParameter becomes a more complicated struct
+	{
+		CRYPTOPP_UNUSED(ignore_for_now);
+		return Element(rng, Integer::Zero(), m_modulus - Integer::One()) ;
+	}
+
+	/// \brief Compares two ModularArithmetic for equality
+	/// \param rhs other ModularArithmetic
+	/// \return true if this is equal to the other, false otherwise
+	/// \details The operator tests for equality using <tt>this.m_modulus == rhs.m_modulus</tt>.
+	bool operator==(const ModularArithmetic &rhs) const
+		{return m_modulus == rhs.m_modulus;}
+
+	static const RandomizationParameter DefaultRandomizationParameter;
+
+private:
+	// TODO: Clang on OS X needs a real operator=.
+	// Squash warning on missing assignment operator.
+	// ModularArithmetic& operator=(const ModularArithmetic &ma);
+
+protected:
+	Integer m_modulus;
+	mutable Integer m_result, m_result1;
+};
+
+// const ModularArithmetic::RandomizationParameter ModularArithmetic::DefaultRandomizationParameter = 0 ;
+
+/// \brief Performs modular arithmetic in Montgomery representation for increased speed
+/// \details The Montgomery representation represents each congruence class <tt>[a]</tt> as
+///   <tt>a*r\%n</tt>, where <tt>r</tt> is a convenient power of 2.
+/// \details <tt>const Element&</tt> returned by member functions are references to
+///   internal data members. Since each object may have only one such data member for holding
+///   results, the following code will produce incorrect results:
+///   <pre>    abcd = group.Add(group.Add(a,b), group.Add(c,d));</pre>
+///   But this should be fine:
+///   <pre>    abcd = group.Add(a, group.Add(b, group.Add(c,d));</pre>
+class CRYPTOPP_DLL MontgomeryRepresentation : public ModularArithmetic
+{
+public:
+	virtual ~MontgomeryRepresentation() {}
+
+	/// \brief Construct a MontgomeryRepresentation
+	/// \param modulus congruence class modulus
+	/// \note The modulus must be odd.
+	MontgomeryRepresentation(const Integer &modulus);
+
+	/// \brief Clone a MontgomeryRepresentation
+	/// \return pointer to a new MontgomeryRepresentation
+	/// \details Clone effectively copy constructs a new MontgomeryRepresentation. The caller is
+	///   responsible for deleting the pointer returned from this method.
+	virtual ModularArithmetic * Clone() const {return new MontgomeryRepresentation(*this);}
+
+	bool IsMontgomeryRepresentation() const {return true;}
+
+	Integer ConvertIn(const Integer &a) const
+		{return (a<<(WORD_BITS*m_modulus.reg.size()))%m_modulus;}
+
+	Integer ConvertOut(const Integer &a) const;
+
+	const Integer& MultiplicativeIdentity() const
+		{return m_result1 = Integer::Power2(WORD_BITS*m_modulus.reg.size())%m_modulus;}
+
+	const Integer& Multiply(const Integer &a, const Integer &b) const;
+
+	const Integer& Square(const Integer &a) const;
+
+	const Integer& MultiplicativeInverse(const Integer &a) const;
+
+	Integer CascadeExponentiate(const Integer &x, const Integer &e1, const Integer &y, const Integer &e2) const
+		{return AbstractRing<Integer>::CascadeExponentiate(x, e1, y, e2);}
+
+	void SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const
+		{AbstractRing<Integer>::SimultaneousExponentiate(results, base, exponents, exponentsCount);}
+
+private:
+	Integer m_u;
+	mutable IntegerSecBlock m_workspace;
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/modes.cpp b/runtime/third_party/cryptopp/modes.cpp
new file mode 100644
index 0000000..663ccb6
--- /dev/null
+++ b/runtime/third_party/cryptopp/modes.cpp
@@ -0,0 +1,312 @@
+// modes.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "modes.h"
+#include "strciphr.h"
+#include "misc.h"
+
+#if defined(CRYPTOPP_DEBUG)
+#include "des.h"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void Modes_TestInstantiations()
+{
+	CFB_Mode<DES>::Encryption m0;
+	CFB_Mode<DES>::Decryption m1;
+	OFB_Mode<DES>::Encryption m2;
+	CTR_Mode<DES>::Encryption m3;
+	ECB_Mode<DES>::Encryption m4;
+	CBC_Mode<DES>::Encryption m5;
+}
+#endif
+
+void CipherModeBase::ResizeBuffers()
+{
+	m_register.New(m_cipher->BlockSize());
+}
+
+void CFB_ModePolicy::Iterate(byte *output, const byte *input, CipherDir dir, size_t iterationCount)
+{
+	CRYPTOPP_ASSERT(input);	CRYPTOPP_ASSERT(output);
+	CRYPTOPP_ASSERT(m_cipher->IsForwardTransformation());
+	CRYPTOPP_ASSERT(m_register.size() == BlockSize());
+	CRYPTOPP_ASSERT(m_temp.size() == BlockSize());
+	CRYPTOPP_ASSERT(iterationCount > 0);
+
+	const unsigned int s = BlockSize();
+	if (dir == ENCRYPTION)
+	{
+		m_cipher->ProcessAndXorBlock(m_register, input, output);
+		if (iterationCount > 1)
+			m_cipher->AdvancedProcessBlocks(output, PtrAdd(input,s), PtrAdd(output,s), (iterationCount-1)*s, 0);
+		std::memcpy(m_register, PtrAdd(output,(iterationCount-1)*s), s);
+	}
+	else
+	{
+		// make copy first in case of in-place decryption
+		std::memcpy(m_temp, PtrAdd(input,(iterationCount-1)*s), s);
+		if (iterationCount > 1)
+			m_cipher->AdvancedProcessBlocks(input, PtrAdd(input,s), PtrAdd(output,s), (iterationCount-1)*s, BlockTransformation::BT_ReverseDirection);
+		m_cipher->ProcessAndXorBlock(m_register, input, output);
+		std::memcpy(m_register, m_temp, s);
+	}
+}
+
+void CFB_ModePolicy::TransformRegister()
+{
+	CRYPTOPP_ASSERT(m_cipher->IsForwardTransformation());
+	CRYPTOPP_ASSERT(m_register.size() == BlockSize());
+	CRYPTOPP_ASSERT(m_temp.size() == BlockSize());
+
+	const ptrdiff_t updateSize = BlockSize()-m_feedbackSize;
+	m_cipher->ProcessBlock(m_register, m_temp);
+	memmove_s(m_register, m_register.size(), PtrAdd(m_register.begin(),m_feedbackSize), updateSize);
+	memcpy_s(PtrAdd(m_register.begin(),updateSize), m_register.size()-updateSize, m_temp, m_feedbackSize);
+}
+
+void CFB_ModePolicy::CipherResynchronize(const byte *iv, size_t length)
+{
+	CRYPTOPP_ASSERT(length == BlockSize());
+	CRYPTOPP_ASSERT(m_register.size() == BlockSize());
+
+	CopyOrZero(m_register, m_register.size(), iv, length);
+	TransformRegister();
+}
+
+void CFB_ModePolicy::SetFeedbackSize(unsigned int feedbackSize)
+{
+	CRYPTOPP_ASSERT(feedbackSize <= BlockSize());
+	if (feedbackSize > BlockSize())
+		throw InvalidArgument("CFB_Mode: invalid feedback size");
+	m_feedbackSize = feedbackSize ? feedbackSize : BlockSize();
+}
+
+void CFB_ModePolicy::ResizeBuffers()
+{
+	CipherModeBase::ResizeBuffers();
+	m_temp.New(BlockSize());
+}
+
+byte* CFB_ModePolicy::GetRegisterBegin()
+{
+	CRYPTOPP_ASSERT(!m_register.empty());
+	CRYPTOPP_ASSERT(BlockSize() >= m_feedbackSize);
+	return PtrAdd(m_register.begin(), BlockSize() - m_feedbackSize);
+}
+
+void OFB_ModePolicy::WriteKeystream(byte *keystreamBuffer, size_t iterationCount)
+{
+	CRYPTOPP_ASSERT(m_cipher->IsForwardTransformation());
+	CRYPTOPP_ASSERT(m_register.size() == BlockSize());
+	CRYPTOPP_ASSERT(iterationCount > 0);
+
+	const unsigned int s = BlockSize();
+	m_cipher->ProcessBlock(m_register, keystreamBuffer);
+	if (iterationCount > 1)
+		m_cipher->AdvancedProcessBlocks(keystreamBuffer, NULLPTR, PtrAdd(keystreamBuffer, s), s*(iterationCount-1), 0);
+	std::memcpy(m_register, PtrAdd(keystreamBuffer, (iterationCount-1)*s), s);
+}
+
+void OFB_ModePolicy::CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(m_register.size() == BlockSize());
+	CRYPTOPP_ASSERT(length == BlockSize());
+
+	CopyOrZero(m_register, m_register.size(), iv, length);
+}
+
+void CTR_ModePolicy::SeekToIteration(lword iterationCount)
+{
+	int carry=0;
+	for (int i=BlockSize()-1; i>=0; i--)
+	{
+		unsigned int sum = m_register[i] + (byte)iterationCount + carry;
+		m_counterArray[i] = byte(sum & 0xff);
+		carry = sum >> 8;
+		iterationCount >>= 8;
+	}
+}
+
+void CTR_ModePolicy::IncrementCounterBy256()
+{
+	IncrementCounterByOne(m_counterArray, BlockSize()-1);
+}
+
+void CTR_ModePolicy::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+	CRYPTOPP_ASSERT(output);
+	// CRYPTOPP_ASSERT(input);  // input is sometimes NULL
+	CRYPTOPP_ASSERT(m_cipher->IsForwardTransformation());
+	CRYPTOPP_ASSERT(m_counterArray.size() == BlockSize());
+	CRYPTOPP_UNUSED(operation);
+
+	const size_t s = BlockSize();
+
+	while (iterationCount)
+	{
+		const byte lsb = m_counterArray[s-1];
+		const size_t blocks = UnsignedMin(iterationCount, 256u-lsb);
+		const size_t outIncrement = output ? blocks*s : 0;
+		const size_t inIncrement = input ? blocks*s : 0;
+
+		m_cipher->AdvancedProcessBlocks(m_counterArray, input, output, blocks*s, BlockTransformation::BT_InBlockIsCounter|BlockTransformation::BT_AllowParallel);
+		if ((m_counterArray[s-1] = static_cast<byte>(lsb + blocks)) == 0)
+			IncrementCounterBy256();
+
+		output = PtrAdd(output, outIncrement);
+		input = PtrAdd(input, inIncrement);
+		iterationCount -= blocks;
+	}
+}
+
+void CTR_ModePolicy::CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(m_register.size() == BlockSize());
+	CRYPTOPP_ASSERT(length == BlockSize());
+
+	CopyOrZero(m_register, m_register.size(), iv, length);
+	m_counterArray.Assign(m_register.begin(), m_register.size());
+}
+
+void BlockOrientedCipherModeBase::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	m_cipher->SetKey(key, length, params);
+	ResizeBuffers();
+	if (IsResynchronizable())
+	{
+		size_t ivLength;
+		const byte *iv = GetIVAndThrowIfInvalid(params, ivLength);
+		Resynchronize(iv, (int)ivLength);
+	}
+}
+
+void BlockOrientedCipherModeBase::ResizeBuffers()
+{
+	CipherModeBase::ResizeBuffers();
+	m_buffer.New(BlockSize());
+}
+
+void ECB_OneWay::ProcessData(byte *outString, const byte *inString, size_t length)
+{
+	CRYPTOPP_ASSERT(length%BlockSize()==0);
+	m_cipher->AdvancedProcessBlocks(inString, NULLPTR, outString, length, BlockTransformation::BT_AllowParallel);
+}
+
+void CBC_Encryption::ProcessData(byte *outString, const byte *inString, size_t length)
+{
+	CRYPTOPP_ASSERT(length%BlockSize()==0);
+	CRYPTOPP_ASSERT(m_register.size() == BlockSize());
+	if (!length) return;
+
+	const unsigned int blockSize = BlockSize();
+	m_cipher->AdvancedProcessBlocks(inString, m_register, outString, blockSize, BlockTransformation::BT_XorInput);
+	if (length > blockSize)
+		m_cipher->AdvancedProcessBlocks(PtrAdd(inString,blockSize), outString, PtrAdd(outString,blockSize), length-blockSize, BlockTransformation::BT_XorInput);
+	std::memcpy(m_register, PtrAdd(outString, length - blockSize), blockSize);
+}
+
+size_t CBC_CTS_Encryption::ProcessLastBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength)
+{
+	CRYPTOPP_UNUSED(outLength);
+	const size_t used = inLength;
+	const unsigned int blockSize = BlockSize();
+
+	if (inLength <= blockSize)
+	{
+		if (!m_stolenIV)
+			throw InvalidArgument("CBC_Encryption: message is too short for ciphertext stealing");
+
+		// steal from IV
+		std::memcpy(outString, m_register, inLength);
+		outString = m_stolenIV;
+	}
+	else
+	{
+		// steal from next to last block
+		xorbuf(m_register, inString, blockSize);
+		m_cipher->ProcessBlock(m_register);
+		inString = PtrAdd(inString, blockSize);
+		inLength -= blockSize;
+		std::memcpy(PtrAdd(outString, blockSize), m_register, inLength);
+	}
+
+	// output last full ciphertext block
+	xorbuf(m_register, inString, inLength);
+	m_cipher->ProcessBlock(m_register);
+	std::memcpy(outString, m_register, blockSize);
+
+	return used;
+}
+
+void CBC_Decryption::ResizeBuffers()
+{
+	BlockOrientedCipherModeBase::ResizeBuffers();
+	m_temp.New(BlockSize());
+}
+
+void CBC_Decryption::ProcessData(byte *outString, const byte *inString, size_t length)
+{
+	CRYPTOPP_ASSERT(length%BlockSize()==0);
+	if (!length) {return;}
+
+	// save copy now in case of in-place decryption
+	const unsigned int blockSize = BlockSize();
+	std::memcpy(m_temp, PtrAdd(inString, length-blockSize), blockSize);
+	if (length > blockSize)
+		m_cipher->AdvancedProcessBlocks(PtrAdd(inString,blockSize), inString, PtrAdd(outString,blockSize), length-blockSize, BlockTransformation::BT_ReverseDirection|BlockTransformation::BT_AllowParallel);
+	m_cipher->ProcessAndXorBlock(inString, m_register, outString);
+	m_register.swap(m_temp);
+}
+
+size_t CBC_CTS_Decryption::ProcessLastBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength)
+{
+	CRYPTOPP_UNUSED(outLength);
+	const byte *pn1, *pn2;
+	const size_t used = inLength;
+	const bool stealIV = inLength <= BlockSize();
+	const unsigned int blockSize = BlockSize();
+
+	if (stealIV)
+	{
+		pn1 = inString;
+		pn2 = m_register;
+	}
+	else
+	{
+		pn1 = PtrAdd(inString, blockSize);
+		pn2 = inString;
+		inLength -= blockSize;
+	}
+
+	// decrypt last partial plaintext block
+	std::memcpy(m_temp, pn2, blockSize);
+	m_cipher->ProcessBlock(m_temp);
+	xorbuf(m_temp, pn1, inLength);
+
+	if (stealIV)
+	{
+		std::memcpy(outString, m_temp, inLength);
+	}
+	else
+	{
+		std::memcpy(PtrAdd(outString, blockSize), m_temp, inLength);
+		// decrypt next to last plaintext block
+		std::memcpy(m_temp, pn1, inLength);
+		m_cipher->ProcessBlock(m_temp);
+		xorbuf(outString, m_temp, m_register, blockSize);
+	}
+
+	return used;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/modes.h b/runtime/third_party/cryptopp/modes.h
new file mode 100644
index 0000000..2412698
--- /dev/null
+++ b/runtime/third_party/cryptopp/modes.h
@@ -0,0 +1,609 @@
+// modes.h - originally written and placed in the public domain by Wei Dai
+
+/// \file modes.h
+/// \brief Classes for block cipher modes of operation
+
+#ifndef CRYPTOPP_MODES_H
+#define CRYPTOPP_MODES_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "misc.h"
+#include "strciphr.h"
+#include "argnames.h"
+#include "algparam.h"
+
+// Issue 340
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wconversion"
+# pragma GCC diagnostic ignored "-Wsign-conversion"
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4231 4275)
+# if (CRYPTOPP_MSC_VERSION >= 1400)
+#  pragma warning(disable: 6011 6386 28193)
+# endif
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Block cipher mode of operation information
+/// \details Each class derived from this one defines two types, Encryption and Decryption,
+///   both of which implement the SymmetricCipher interface.
+///   For each mode there are two classes, one of which is a template class,
+///   and the other one has a name that ends in "_ExternalCipher".
+///   The "external cipher" mode objects hold a reference to the underlying block cipher,
+///   instead of holding an instance of it. The reference must be passed in to the constructor.
+///   For the "cipher holder" classes, the CIPHER template parameter should be a class
+///   derived from BlockCipherDocumentation, for example DES or AES.
+/// \details See NIST SP 800-38A for definitions of these modes. See
+///   AuthenticatedSymmetricCipherDocumentation for authenticated encryption modes.
+struct CipherModeDocumentation : public SymmetricCipherDocumentation
+{
+};
+
+/// \brief Block cipher mode of operation information
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CipherModeBase : public SymmetricCipher
+{
+public:
+	virtual ~CipherModeBase() {}
+
+	// Algorithm class
+	std::string AlgorithmProvider() const {
+		return m_cipher != NULLPTR ? m_cipher->AlgorithmProvider() : "C++";
+	}
+
+	/// \brief Returns smallest valid key length
+	/// \return the minimum key length, in bytes
+	size_t MinKeyLength() const {return m_cipher->MinKeyLength();}
+
+	/// \brief Returns largest valid key length
+	/// \return the maximum key length, in bytes
+	size_t MaxKeyLength() const {return m_cipher->MaxKeyLength();}
+
+	/// \brief Returns default key length
+	/// \return the default key length, in bytes
+	size_t DefaultKeyLength() const {return m_cipher->DefaultKeyLength();}
+
+	/// \brief Returns a valid key length for the algorithm
+	/// \param keylength the size of the key, in bytes
+	/// \return the valid key length, in bytes
+	/// \details keylength is provided in bytes, not bits. If keylength is less than MIN_KEYLENGTH,
+	///   then the function returns MIN_KEYLENGTH. If keylength is greater than MAX_KEYLENGTH,
+	///   then the function returns MAX_KEYLENGTH. if If keylength is a multiple of KEYLENGTH_MULTIPLE,
+	///   then keylength is returned. Otherwise, the function returns a \a lower multiple of
+	///   KEYLENGTH_MULTIPLE.
+	size_t GetValidKeyLength(size_t keylength) const {return m_cipher->GetValidKeyLength(keylength);}
+
+	/// \brief Returns whether keylength is a valid key length
+	/// \param keylength the requested keylength
+	/// \return true if keylength is valid, false otherwise
+	/// \details Internally the function calls GetValidKeyLength()
+	bool IsValidKeyLength(size_t keylength) const {return m_cipher->IsValidKeyLength(keylength);}
+
+	/// \brief Provides input and output data alignment for optimal performance.
+	/// \return the input data alignment that provides optimal performance
+	/// \sa GetAlignment() and OptimalBlockSize()
+	unsigned int OptimalDataAlignment() const {return m_cipher->OptimalDataAlignment();}
+
+	/// \brief Returns length of the IV accepted by this object
+	/// \return the size of an IV, in bytes
+	/// \throw NotImplemented() if the object does not support resynchronization
+	/// \details The default implementation throws NotImplemented
+	unsigned int IVSize() const {return BlockSize();}
+
+	/// \brief Minimal requirement for secure IVs
+	/// \return the secure IV requirement of the algorithm
+	virtual IV_Requirement IVRequirement() const =0;
+
+	/// \brief Set external block cipher
+	/// \param cipher An external block cipher
+	/// \details The cipher should be keyed.
+	void SetCipher(BlockCipher &cipher)
+	{
+		this->ThrowIfResynchronizable();
+		this->m_cipher = &cipher;
+		this->ResizeBuffers();
+	}
+
+	/// \brief Set external block cipher and IV
+	/// \param cipher An external block cipher
+	/// \param iv a byte array used to resynchronize the cipher
+	/// \param feedbackSize the feedback size, in bytes
+	/// \details The cipher should be keyed.
+	void SetCipherWithIV(BlockCipher &cipher, const byte *iv, int feedbackSize = 0)
+	{
+		this->ThrowIfInvalidIV(iv);
+		this->m_cipher = &cipher;
+		this->ResizeBuffers();
+		this->SetFeedbackSize(feedbackSize);
+		if (this->IsResynchronizable())
+			this->Resynchronize(iv);
+	}
+
+protected:
+	CipherModeBase() : m_cipher(NULLPTR) {}
+	inline unsigned int BlockSize() const
+	{
+		CRYPTOPP_ASSERT(m_register.size() > 0);
+		return static_cast<unsigned int>(m_register.size());
+	}
+	virtual void SetFeedbackSize(unsigned int feedbackSize)
+	{
+		if (!(feedbackSize == 0 || feedbackSize == BlockSize()))
+			throw InvalidArgument("CipherModeBase: feedback size cannot be specified for this cipher mode");
+	}
+
+	virtual void ResizeBuffers();
+
+	BlockCipher *m_cipher;
+	SecByteBlock m_register;
+};
+
+/// \brief Block cipher mode of operation common operations
+/// \tparam POLICY_INTERFACE common operations
+template <class POLICY_INTERFACE>
+class CRYPTOPP_NO_VTABLE ModePolicyCommonTemplate : public CipherModeBase, public POLICY_INTERFACE
+{
+	unsigned int GetAlignment() const {return m_cipher->OptimalDataAlignment();}
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+};
+
+template <class POLICY_INTERFACE>
+void ModePolicyCommonTemplate<POLICY_INTERFACE>::CipherSetKey(const NameValuePairs &params, const byte *key, size_t length)
+{
+	m_cipher->SetKey(key, length, params);
+	ResizeBuffers();
+	int feedbackSize = params.GetIntValueWithDefault(Name::FeedbackSize(), 0);
+	SetFeedbackSize(feedbackSize);
+}
+
+/// \brief CFB block cipher mode of operation
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CFB_ModePolicy : public ModePolicyCommonTemplate<CFB_CipherAbstractPolicy>
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "CFB";}
+
+	virtual ~CFB_ModePolicy() {}
+	CFB_ModePolicy() : m_feedbackSize(0) {}
+	IV_Requirement IVRequirement() const {return RANDOM_IV;}
+
+protected:
+	unsigned int GetBytesPerIteration() const {return m_feedbackSize;}
+	bool CanIterate() const {return m_feedbackSize == BlockSize();}
+	void Iterate(byte *output, const byte *input, CipherDir dir, size_t iterationCount);
+	void TransformRegister();
+	void CipherResynchronize(const byte *iv, size_t length);
+	void SetFeedbackSize(unsigned int feedbackSize);
+	void ResizeBuffers();
+	byte * GetRegisterBegin();
+
+	SecByteBlock m_temp;
+	unsigned int m_feedbackSize;
+};
+
+/// \brief Initialize a block of memory
+/// \param dest the destination block of memory
+/// \param dsize the size of the destination block, in bytes
+/// \param src the source block of memory
+/// \param ssize the size of the source block, in bytes
+/// \details CopyOrZero copies ssize bytes from source to destination if
+///   src is not NULL. If src is NULL then dest is zero'd. Bounds are not
+///   checked at runtime. Debug builds assert if ssize exceeds dsize.
+inline void CopyOrZero(void *dest, size_t dsize, const void *src, size_t ssize)
+{
+	CRYPTOPP_ASSERT(dest);
+	CRYPTOPP_ASSERT(dsize >= ssize);
+
+	if (src != NULLPTR)
+		memcpy_s(dest, dsize, src, ssize);
+	else
+		std::memset(dest, 0, dsize);
+}
+
+/// \brief OFB block cipher mode of operation
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE OFB_ModePolicy : public ModePolicyCommonTemplate<AdditiveCipherAbstractPolicy>
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "OFB";}
+
+	bool CipherIsRandomAccess() const {return false;}
+	IV_Requirement IVRequirement() const {return UNIQUE_IV;}
+
+protected:
+	unsigned int GetBytesPerIteration() const {return BlockSize();}
+	unsigned int GetIterationsToBuffer() const {return m_cipher->OptimalNumberOfParallelBlocks();}
+	void WriteKeystream(byte *keystreamBuffer, size_t iterationCount);
+	void CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length);
+};
+
+/// \brief CTR block cipher mode of operation
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CTR_ModePolicy : public ModePolicyCommonTemplate<AdditiveCipherAbstractPolicy>
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "CTR";}
+
+	virtual ~CTR_ModePolicy() {}
+	bool CipherIsRandomAccess() const {return true;}
+	IV_Requirement IVRequirement() const {return RANDOM_IV;}
+
+protected:
+	virtual void IncrementCounterBy256();
+	unsigned int GetAlignment() const {return m_cipher->OptimalDataAlignment();}
+	unsigned int GetBytesPerIteration() const {return BlockSize();}
+	unsigned int GetIterationsToBuffer() const {return m_cipher->OptimalNumberOfParallelBlocks();}
+	void WriteKeystream(byte *buffer, size_t iterationCount)
+		{OperateKeystream(WRITE_KEYSTREAM, buffer, NULLPTR, iterationCount);}
+	bool CanOperateKeystream() const {return true;}
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	void CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length);
+	void SeekToIteration(lword iterationCount);
+
+	// adv_simd.h increments the counter
+	mutable SecByteBlock m_counterArray;
+};
+
+/// \brief Block cipher mode of operation default implementation
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE BlockOrientedCipherModeBase : public CipherModeBase
+{
+public:
+	virtual ~BlockOrientedCipherModeBase() {}
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+	unsigned int MandatoryBlockSize() const {return BlockSize();}
+	bool IsRandomAccess() const {return false;}
+	bool IsSelfInverting() const {return false;}
+	bool IsForwardTransformation() const
+		{return m_cipher->IsForwardTransformation();}
+	void Resynchronize(const byte *iv, int length=-1)
+		{memcpy_s(m_register, m_register.size(), iv, ThrowIfInvalidIVLength(length));}
+
+protected:
+	bool RequireAlignedInput() const {return true;}
+	virtual void ResizeBuffers();
+
+	SecByteBlock m_buffer;
+};
+
+/// \brief ECB block cipher mode of operation default implementation
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE ECB_OneWay : public BlockOrientedCipherModeBase
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "ECB";}
+
+	void SetKey(const byte *key, size_t length, const NameValuePairs &params = g_nullNameValuePairs)
+		{m_cipher->SetKey(key, length, params); BlockOrientedCipherModeBase::ResizeBuffers();}
+	IV_Requirement IVRequirement() const {return NOT_RESYNCHRONIZABLE;}
+	unsigned int OptimalBlockSize() const {return static_cast<unsigned int>(BlockSize() * m_cipher->OptimalNumberOfParallelBlocks());}
+	void ProcessData(byte *outString, const byte *inString, size_t length);
+};
+
+/// \brief CBC block cipher mode of operation default implementation
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CBC_ModeBase : public BlockOrientedCipherModeBase
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "CBC";}
+
+	IV_Requirement IVRequirement() const {return UNPREDICTABLE_RANDOM_IV;}
+	bool RequireAlignedInput() const {return false;}
+	unsigned int MinLastBlockSize() const {return 0;}
+};
+
+/// \brief CBC block cipher mode of operation encryption operation
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CBC_Encryption : public CBC_ModeBase
+{
+public:
+	void ProcessData(byte *outString, const byte *inString, size_t length);
+};
+
+/// \brief CBC-CTS block cipher mode of operation encryption operation
+/// \since Crypto++ 3.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CBC_CTS_Encryption : public CBC_Encryption
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "CBC/CTS";}
+
+	void SetStolenIV(byte *iv) {m_stolenIV = iv;}
+	unsigned int MinLastBlockSize() const {return BlockSize()+1;}
+	size_t ProcessLastBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength);
+
+protected:
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+	{
+		CBC_Encryption::UncheckedSetKey(key, length, params);
+		m_stolenIV = params.GetValueWithDefault(Name::StolenIV(), static_cast<byte *>(NULLPTR));
+	}
+
+	byte *m_stolenIV;
+};
+
+/// \brief CBC block cipher mode of operation decryption operation
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CBC_Decryption : public CBC_ModeBase
+{
+public:
+	virtual ~CBC_Decryption() {}
+	void ProcessData(byte *outString, const byte *inString, size_t length);
+
+protected:
+	virtual void ResizeBuffers();
+
+	SecByteBlock m_temp;
+};
+
+/// \brief CBC-CTS block cipher mode of operation decryption operation
+/// \since Crypto++ 3.0
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CBC_CTS_Decryption : public CBC_Decryption
+{
+public:
+	unsigned int MinLastBlockSize() const {return BlockSize()+1;}
+	size_t ProcessLastBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength);
+};
+
+/// \brief Block cipher mode of operation aggregate
+template <class CIPHER, class BASE>
+class CipherModeFinalTemplate_CipherHolder : protected ObjectHolder<CIPHER>, public AlgorithmImpl<BASE, CipherModeFinalTemplate_CipherHolder<CIPHER, BASE> >
+{
+public:
+	/// \brief Provides the name of this algorithm
+	/// \return the standard algorithm name
+	/// \details The standard algorithm name can be a name like \a AES or \a AES/GCM. Some algorithms
+	///   do not have standard names yet. For example, there is no standard algorithm name for
+	///   Shoup's ECIES.
+	static std::string CRYPTOPP_API StaticAlgorithmName()
+		{return CIPHER::StaticAlgorithmName() + "/" + BASE::StaticAlgorithmName();}
+
+	/// \brief Construct a CipherModeFinalTemplate
+	CipherModeFinalTemplate_CipherHolder()
+	{
+		this->m_cipher = &this->m_object;
+		this->ResizeBuffers();
+	}
+
+	/// \brief Construct a CipherModeFinalTemplate
+	/// \param key a byte array used to key the cipher
+	/// \param length size of the key in bytes
+	/// \details key must be at least DEFAULT_KEYLENGTH in length. Internally, the function calls
+	///    SimpleKeyingInterface::SetKey.
+	CipherModeFinalTemplate_CipherHolder(const byte *key, size_t length)
+	{
+		this->m_cipher = &this->m_object;
+		this->SetKey(key, length);
+	}
+
+	/// \brief Construct a CipherModeFinalTemplate
+	/// \param key a byte array used to key the cipher
+	/// \param length size of the key in bytes
+	/// \param iv a byte array used to resynchronize the cipher
+	/// \details key must be at least DEFAULT_KEYLENGTH in length. iv must be IVSize() or
+	///    BLOCKSIZE in length. Internally, the function calls SimpleKeyingInterface::SetKey.
+	CipherModeFinalTemplate_CipherHolder(const byte *key, size_t length, const byte *iv)
+	{
+		this->m_cipher = &this->m_object;
+		this->SetKey(key, length, MakeParameters(Name::IV(), ConstByteArrayParameter(iv, this->m_cipher->BlockSize())));
+	}
+
+	/// \brief Construct a CipherModeFinalTemplate
+	/// \param key a byte array used to key the cipher
+	/// \param length size of the key in bytes
+	/// \param iv a byte array used to resynchronize the cipher
+	/// \param feedbackSize the feedback size, in bytes
+	/// \details key must be at least DEFAULT_KEYLENGTH in length. iv must be IVSize() or
+	///    BLOCKSIZE in length. Internally, the function calls SimpleKeyingInterface::SetKey.
+	CipherModeFinalTemplate_CipherHolder(const byte *key, size_t length, const byte *iv, int feedbackSize)
+	{
+		this->m_cipher = &this->m_object;
+		this->SetKey(key, length, MakeParameters(Name::IV(), ConstByteArrayParameter(iv, this->m_cipher->BlockSize()))(Name::FeedbackSize(), feedbackSize));
+	}
+
+	// Algorithm class
+	std::string AlgorithmProvider() const {
+		return this->m_cipher->AlgorithmProvider();
+	}
+};
+
+/// \tparam BASE CipherModeFinalTemplate_CipherHolder base class
+/// \details Base class for external mode cipher combinations
+template <class BASE>
+class CipherModeFinalTemplate_ExternalCipher : public BASE
+{
+public:
+	/// \brief Construct a default CipherModeFinalTemplate
+	/// \details The cipher is not keyed.
+	CipherModeFinalTemplate_ExternalCipher() {}
+
+	/// \brief Construct a CipherModeFinalTemplate
+	/// \param cipher An external block cipher
+	/// \details The cipher should be keyed.
+	CipherModeFinalTemplate_ExternalCipher(BlockCipher &cipher)
+		{this->SetCipher(cipher);}
+
+	/// \brief Construct a CipherModeFinalTemplate
+	/// \param cipher An external block cipher
+	/// \param iv a byte array used to resynchronize the cipher
+	/// \param feedbackSize the feedback size, in bytes
+	/// \details The cipher should be keyed.
+	CipherModeFinalTemplate_ExternalCipher(BlockCipher &cipher, const byte *iv, int feedbackSize = 0)
+		{this->SetCipherWithIV(cipher, iv, feedbackSize);}
+
+	/// \brief Provides the name of this algorithm
+	/// \return the standard algorithm name
+	/// \details The standard algorithm name can be a name like \a AES or \a AES/GCM. Some algorithms
+	///   do not have standard names yet. For example, there is no standard algorithm name for
+	///   Shoup's ECIES.
+	/// \note  AlgorithmName is not universally implemented yet
+	std::string AlgorithmName() const
+		{return (this->m_cipher ? this->m_cipher->AlgorithmName() + "/" : std::string("")) + BASE::StaticAlgorithmName();}
+
+	// Algorithm class
+	std::string AlgorithmProvider() const
+		{return this->m_cipher->AlgorithmProvider();}
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS CFB_CipherTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS CFB_EncryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS CFB_DecryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> >;
+
+/// \brief CFB block cipher mode of operation
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+template <class CIPHER>
+struct CFB_Mode : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, ConcretePolicyHolder<Empty, CFB_EncryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> > > > Encryption;
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, ConcretePolicyHolder<Empty, CFB_DecryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> > > > Decryption;
+};
+
+/// \brief CFB mode, external cipher.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+struct CFB_Mode_ExternalCipher : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_ExternalCipher<ConcretePolicyHolder<Empty, CFB_EncryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> > > > Encryption;
+	typedef CipherModeFinalTemplate_ExternalCipher<ConcretePolicyHolder<Empty, CFB_DecryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> > > > Decryption;
+};
+
+/// \brief CFB block cipher mode of operation providing FIPS validated cryptography.
+/// \details Requires full block plaintext according to FIPS 800-38A
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+template <class CIPHER>
+struct CFB_FIPS_Mode : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, ConcretePolicyHolder<Empty, CFB_RequireFullDataBlocks<CFB_EncryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> > > > > Encryption;
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, ConcretePolicyHolder<Empty, CFB_RequireFullDataBlocks<CFB_DecryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> > > > > Decryption;
+};
+
+/// \brief CFB mode, external cipher, providing FIPS validated cryptography.
+/// \details Requires full block plaintext according to FIPS 800-38A
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+struct CFB_FIPS_Mode_ExternalCipher : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_ExternalCipher<ConcretePolicyHolder<Empty, CFB_RequireFullDataBlocks<CFB_EncryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> > > > > Encryption;
+	typedef CipherModeFinalTemplate_ExternalCipher<ConcretePolicyHolder<Empty, CFB_RequireFullDataBlocks<CFB_DecryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, CFB_ModePolicy> > > > > Decryption;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS AdditiveCipherTemplate<AbstractPolicyHolder<AdditiveCipherAbstractPolicy, OFB_ModePolicy> >;
+
+/// \brief OFB block cipher mode of operation
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+template <class CIPHER>
+struct OFB_Mode : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, ConcretePolicyHolder<Empty, AdditiveCipherTemplate<AbstractPolicyHolder<AdditiveCipherAbstractPolicy, OFB_ModePolicy> > > > Encryption;
+	typedef Encryption Decryption;
+};
+
+/// \brief OFB mode, external cipher.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+struct OFB_Mode_ExternalCipher : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_ExternalCipher<ConcretePolicyHolder<Empty, AdditiveCipherTemplate<AbstractPolicyHolder<AdditiveCipherAbstractPolicy, OFB_ModePolicy> > > > Encryption;
+	typedef Encryption Decryption;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS AdditiveCipherTemplate<AbstractPolicyHolder<AdditiveCipherAbstractPolicy, CTR_ModePolicy> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS CipherModeFinalTemplate_ExternalCipher<ConcretePolicyHolder<Empty, AdditiveCipherTemplate<AbstractPolicyHolder<AdditiveCipherAbstractPolicy, CTR_ModePolicy> > > >;
+
+/// \brief CTR block cipher mode of operation
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+template <class CIPHER>
+struct CTR_Mode : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, ConcretePolicyHolder<Empty, AdditiveCipherTemplate<AbstractPolicyHolder<AdditiveCipherAbstractPolicy, CTR_ModePolicy> > > > Encryption;
+	typedef Encryption Decryption;
+};
+
+/// \brief CTR mode, external cipher.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+struct CTR_Mode_ExternalCipher : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_ExternalCipher<ConcretePolicyHolder<Empty, AdditiveCipherTemplate<AbstractPolicyHolder<AdditiveCipherAbstractPolicy, CTR_ModePolicy> > > > Encryption;
+	typedef Encryption Decryption;
+};
+
+/// \brief ECB block cipher mode of operation
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+template <class CIPHER>
+struct ECB_Mode : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, ECB_OneWay> Encryption;
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Decryption, ECB_OneWay> Decryption;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS CipherModeFinalTemplate_ExternalCipher<ECB_OneWay>;
+
+/// \brief ECB mode, external cipher.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+struct ECB_Mode_ExternalCipher : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_ExternalCipher<ECB_OneWay> Encryption;
+	typedef Encryption Decryption;
+};
+
+/// \brief CBC block cipher mode of operation
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+template <class CIPHER>
+struct CBC_Mode : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, CBC_Encryption> Encryption;
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Decryption, CBC_Decryption> Decryption;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS CipherModeFinalTemplate_ExternalCipher<CBC_Encryption>;
+CRYPTOPP_DLL_TEMPLATE_CLASS CipherModeFinalTemplate_ExternalCipher<CBC_Decryption>;
+
+/// \brief CBC mode, external cipher
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+struct CBC_Mode_ExternalCipher : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_ExternalCipher<CBC_Encryption> Encryption;
+	typedef CipherModeFinalTemplate_ExternalCipher<CBC_Decryption> Decryption;
+};
+
+/// \brief CBC-CTS block cipher mode of operation
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+/// \since Crypto++ 3.0
+template <class CIPHER>
+struct CBC_CTS_Mode : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, CBC_CTS_Encryption> Encryption;
+	typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Decryption, CBC_CTS_Decryption> Decryption;
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS CipherModeFinalTemplate_ExternalCipher<CBC_CTS_Encryption>;
+CRYPTOPP_DLL_TEMPLATE_CLASS CipherModeFinalTemplate_ExternalCipher<CBC_CTS_Decryption>;
+
+/// \brief CBC mode with ciphertext stealing, external cipher
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of Operation</A>
+///   on the Crypto++ wiki.
+/// \since Crypto++ 3.0
+struct CBC_CTS_Mode_ExternalCipher : public CipherModeDocumentation
+{
+	typedef CipherModeFinalTemplate_ExternalCipher<CBC_CTS_Encryption> Encryption;
+	typedef CipherModeFinalTemplate_ExternalCipher<CBC_CTS_Decryption> Decryption;
+};
+
+NAMESPACE_END
+
+// Issue 340
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic pop
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/modexppc.h b/runtime/third_party/cryptopp/modexppc.h
new file mode 100644
index 0000000..cacb0aa
--- /dev/null
+++ b/runtime/third_party/cryptopp/modexppc.h
@@ -0,0 +1,48 @@
+#ifndef CRYPTOPP_MODEXPPC_H
+#define CRYPTOPP_MODEXPPC_H
+
+#include "cryptlib.h"
+#include "modarith.h"
+#include "integer.h"
+#include "algebra.h"
+#include "eprecomp.h"
+#include "smartptr.h"
+#include "pubkey.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4231 4275)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+CRYPTOPP_DLL_TEMPLATE_CLASS DL_FixedBasePrecomputationImpl<Integer>;
+
+class ModExpPrecomputation : public DL_GroupPrecomputation<Integer>
+{
+public:
+	virtual ~ModExpPrecomputation() {}
+
+	// DL_GroupPrecomputation
+	bool NeedConversions() const {return true;}
+	Element ConvertIn(const Element &v) const {return m_mr->ConvertIn(v);}
+	virtual Element ConvertOut(const Element &v) const {return m_mr->ConvertOut(v);}
+	const AbstractGroup<Element> & GetGroup() const {return m_mr->MultiplicativeGroup();}
+	Element BERDecodeElement(BufferedTransformation &bt) const {return Integer(bt);}
+	void DEREncodeElement(BufferedTransformation &bt, const Element &v) const {v.DEREncode(bt);}
+
+	// non-inherited
+	void SetModulus(const Integer &v) {m_mr.reset(new MontgomeryRepresentation(v));}
+	const Integer & GetModulus() const {return m_mr->GetModulus();}
+
+private:
+	value_ptr<MontgomeryRepresentation> m_mr;
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/mqueue.cpp b/runtime/third_party/cryptopp/mqueue.cpp
new file mode 100644
index 0000000..2e9a9ae
--- /dev/null
+++ b/runtime/third_party/cryptopp/mqueue.cpp
@@ -0,0 +1,175 @@
+// mqueue.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "mqueue.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+MessageQueue::MessageQueue(unsigned int nodeSize)
+	: m_queue(nodeSize), m_lengths(1, 0U), m_messageCounts(1, 0U)
+{
+}
+
+size_t MessageQueue::CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end, const std::string &channel, bool blocking) const
+{
+	if (begin >= MaxRetrievable())
+		return 0;
+
+	return m_queue.CopyRangeTo2(target, begin, STDMIN(MaxRetrievable(), end), channel, blocking);
+}
+
+size_t MessageQueue::TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel, bool blocking)
+{
+	transferBytes = STDMIN(MaxRetrievable(), transferBytes);
+	size_t blockedBytes = m_queue.TransferTo2(target, transferBytes, channel, blocking);
+	m_lengths.front() -= transferBytes;
+	return blockedBytes;
+}
+
+bool MessageQueue::GetNextMessage()
+{
+	if (NumberOfMessages() > 0 && !AnyRetrievable())
+	{
+		m_lengths.pop_front();
+		if (m_messageCounts[0] == 0 && m_messageCounts.size() > 1)
+			m_messageCounts.pop_front();
+		return true;
+	}
+	else
+		return false;
+}
+
+unsigned int MessageQueue::CopyMessagesTo(BufferedTransformation &target, unsigned int count, const std::string &channel) const
+{
+	ByteQueue::Walker walker(m_queue);
+	std::deque<lword>::const_iterator it = m_lengths.begin();
+	unsigned int i;
+	for (i=0; i<count && it != --m_lengths.end(); ++i, ++it)
+	{
+		walker.TransferTo(target, *it, channel);
+		if (GetAutoSignalPropagation())
+			target.ChannelMessageEnd(channel, GetAutoSignalPropagation()-1);
+	}
+	return i;
+}
+
+void MessageQueue::swap(MessageQueue &rhs)
+{
+	m_queue.swap(rhs.m_queue);
+	m_lengths.swap(rhs.m_lengths);
+}
+
+const byte * MessageQueue::Spy(size_t &contiguousSize) const
+{
+	const byte *result = m_queue.Spy(contiguousSize);
+	contiguousSize = UnsignedMin(contiguousSize, MaxRetrievable());
+	return result;
+}
+
+// *************************************************************
+
+unsigned int EqualityComparisonFilter::MapChannel(const std::string &channel) const
+{
+	if (channel == m_firstChannel)
+		return 0;
+	else if (channel == m_secondChannel)
+		return 1;
+	else
+		return 2;
+}
+
+size_t EqualityComparisonFilter::ChannelPut2(const std::string &channel, const byte *inString, size_t length, int messageEnd, bool blocking)
+{
+	if (!blocking)
+		throw BlockingInputOnly("EqualityComparisonFilter");
+
+	unsigned int i = MapChannel(channel);
+
+	if (i == 2)
+		return Output(3, inString, length, messageEnd, blocking, channel);
+	else if (m_mismatchDetected)
+		return 0;
+	else
+	{
+		MessageQueue &q1 = m_q[i], &q2 = m_q[1-i];
+
+		if (q2.AnyMessages() && q2.MaxRetrievable() < length)
+			goto mismatch;
+
+		while (length > 0 && q2.AnyRetrievable())
+		{
+			size_t len = length;
+			const byte *data = q2.Spy(len);
+			len = STDMIN(len, length);
+			if (std::memcmp(inString, data, len) != 0)
+				goto mismatch;
+			inString += len;
+			length -= len;
+			q2.Skip(len);
+		}
+
+		q1.Put(inString, length);
+
+		if (messageEnd)
+		{
+			if (q2.AnyRetrievable())
+				goto mismatch;
+			else if (q2.AnyMessages())
+				q2.GetNextMessage();
+			else if (q2.NumberOfMessageSeries() > 0)
+				goto mismatch;
+			else
+				q1.MessageEnd();
+		}
+
+		return 0;
+
+mismatch:
+		return HandleMismatchDetected(blocking);
+	}
+}
+
+bool EqualityComparisonFilter::ChannelMessageSeriesEnd(const std::string &channel, int propagation, bool blocking)
+{
+	unsigned int i = MapChannel(channel);
+
+	if (i == 2)
+	{
+		OutputMessageSeriesEnd(4, propagation, blocking, channel);
+		return false;
+	}
+	else if (m_mismatchDetected)
+		return false;
+	else
+	{
+		MessageQueue &q1 = m_q[i], &q2 = m_q[1-i];
+
+		if (q2.AnyRetrievable() || q2.AnyMessages())
+			goto mismatch;
+		else if (q2.NumberOfMessageSeries() > 0)
+			return Output(2, (const byte *)"\1", 1, 0, blocking) != 0;
+		else
+			q1.MessageSeriesEnd();
+
+		return false;
+
+mismatch:
+		return HandleMismatchDetected(blocking);
+	}
+}
+
+bool EqualityComparisonFilter::HandleMismatchDetected(bool blocking)
+{
+	m_mismatchDetected = true;
+	if (m_throwIfNotEqual)
+		throw MismatchDetected();
+	const byte b[1] = {0};
+	return Output(1, b, 1, 0, blocking) != 0;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/mqueue.h b/runtime/third_party/cryptopp/mqueue.h
new file mode 100644
index 0000000..632ae29
--- /dev/null
+++ b/runtime/third_party/cryptopp/mqueue.h
@@ -0,0 +1,145 @@
+// mqueue.h - originally written and placed in the public domain by Wei Dai
+
+/// \file
+/// \brief Classes for an unlimited queue to store messages
+
+#ifndef CRYPTOPP_MQUEUE_H
+#define CRYPTOPP_MQUEUE_H
+
+#include "cryptlib.h"
+#include "queue.h"
+#include "filters.h"
+#include "misc.h"
+
+#include <deque>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Data structure used to store messages
+/// \details The queue is implemented with a ByteQueue.
+/// \sa <A HREF="https://www.cryptopp.com/wiki/MessageQueue">MessageQueue</A>
+///  on the Crypto++ wiki.
+/// \since Crypto++ 2.0
+class CRYPTOPP_DLL MessageQueue : public AutoSignaling<BufferedTransformation>
+{
+public:
+	virtual ~MessageQueue() {}
+
+	/// \brief Construct a MessageQueue
+	/// \param nodeSize the initial node size
+	MessageQueue(unsigned int nodeSize=256);
+
+	// BufferedTransformation
+	void IsolatedInitialize(const NameValuePairs &parameters)
+		{m_queue.IsolatedInitialize(parameters); m_lengths.assign(1, 0U); m_messageCounts.assign(1, 0U);}
+	size_t Put2(const byte *begin, size_t length, int messageEnd, bool blocking)
+	{
+		CRYPTOPP_UNUSED(blocking);
+		m_queue.Put(begin, length);
+		m_lengths.back() += length;
+		if (messageEnd)
+		{
+			m_lengths.push_back(0);
+			m_messageCounts.back()++;
+		}
+		return 0;
+	}
+	bool IsolatedFlush(bool hardFlush, bool blocking)
+		{CRYPTOPP_UNUSED(hardFlush), CRYPTOPP_UNUSED(blocking); return false;}
+	bool IsolatedMessageSeriesEnd(bool blocking)
+		{CRYPTOPP_UNUSED(blocking); m_messageCounts.push_back(0); return false;}
+
+	lword MaxRetrievable() const
+		{return m_lengths.front();}
+	bool AnyRetrievable() const
+		{return m_lengths.front() > 0;}
+
+	size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+	size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const;
+
+	lword TotalBytesRetrievable() const
+		{return m_queue.MaxRetrievable();}
+	unsigned int NumberOfMessages() const
+		{return (unsigned int)m_lengths.size()-1;}
+	bool GetNextMessage();
+
+	unsigned int NumberOfMessagesInThisSeries() const
+		{return m_messageCounts[0];}
+	unsigned int NumberOfMessageSeries() const
+		{return (unsigned int)m_messageCounts.size()-1;}
+
+	/// \brief Copy messages from this object to another BufferedTransformation.
+	/// \param target the destination BufferedTransformation
+	/// \param count the number of messages to copy
+	/// \param channel the channel on which the transfer should occur
+	/// \return the number of messages that remain in the copy (i.e., messages not copied)
+	unsigned int CopyMessagesTo(BufferedTransformation &target, unsigned int count=UINT_MAX, const std::string &channel=DEFAULT_CHANNEL) const;
+
+	/// \brief Peek data in the queue
+	/// \param contiguousSize the size of the data
+	/// \details Spy() peeks at data at the head of the queue. Spy() does
+	///  not remove data from the queue.
+	/// \details The data's size is returned in <tt>contiguousSize</tt>.
+	///  Spy() returns the size of the first message in the list.
+	const byte * Spy(size_t &contiguousSize) const;
+
+	/// \brief Swap contents with another MessageQueue
+	/// \param rhs the other MessageQueue
+	void swap(MessageQueue &rhs);
+
+private:
+	ByteQueue m_queue;
+	std::deque<lword> m_lengths;
+	std::deque<unsigned int> m_messageCounts;
+};
+
+/// \brief Filter that checks messages on two channels for equality
+class CRYPTOPP_DLL EqualityComparisonFilter : public Unflushable<Multichannel<Filter> >
+{
+public:
+	/// \brief Different messages were detected
+	struct MismatchDetected : public Exception
+	{
+		/// \brief Construct a MismatchDetected exception
+		MismatchDetected() : Exception(DATA_INTEGRITY_CHECK_FAILED, "EqualityComparisonFilter: did not receive the same data on two channels") {}
+	};
+
+	/// \brief Construct an EqualityComparisonFilter
+	/// \param attachment an attached transformation
+	/// \param throwIfNotEqual flag indicating whether the objects throws
+	/// \param firstChannel string naming the first channel
+	/// \param secondChannel string naming the second channel
+	/// \throw MismatchDetected if throwIfNotEqual is true and not equal
+	/// \details If throwIfNotEqual is false, this filter will output a '\\0'
+	///  byte when it detects a mismatch, '\\1' otherwise.
+	EqualityComparisonFilter(BufferedTransformation *attachment=NULLPTR, bool throwIfNotEqual=true, const std::string &firstChannel="0", const std::string &secondChannel="1")
+		: m_throwIfNotEqual(throwIfNotEqual), m_mismatchDetected(false)
+		, m_firstChannel(firstChannel), m_secondChannel(secondChannel)
+		{Detach(attachment);}
+
+	// BufferedTransformation
+	size_t ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking);
+	bool ChannelMessageSeriesEnd(const std::string &channel, int propagation=-1, bool blocking=true);
+
+protected:
+	unsigned int MapChannel(const std::string &channel) const;
+	bool HandleMismatchDetected(bool blocking);
+
+private:
+	bool m_throwIfNotEqual, m_mismatchDetected;
+	std::string m_firstChannel, m_secondChannel;
+	MessageQueue m_q[2];
+};
+
+NAMESPACE_END
+
+#ifndef __BORLANDC__
+NAMESPACE_BEGIN(std)
+template<> inline void swap(CryptoPP::MessageQueue &a, CryptoPP::MessageQueue &b)
+{
+	a.swap(b);
+}
+NAMESPACE_END
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/mqv.cpp b/runtime/third_party/cryptopp/mqv.cpp
new file mode 100644
index 0000000..c19a012
--- /dev/null
+++ b/runtime/third_party/cryptopp/mqv.cpp
@@ -0,0 +1,46 @@
+// mqv.cpp - originally written and placed in the public domain by Wei Dai
+//           HMQV provided by Jeffrey Walton, Ray Clayton and Uri Blumenthal.
+//           FHMQV provided by Uri Blumenthal.
+
+#include "pch.h"
+#include "config.h"
+#include "mqv.h"
+#include "hmqv.h"
+#include "fhmqv.h"
+#include "eccrypto.h"
+
+// Squash MS LNK4221 and libtool warnings
+extern const char MQV_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void TestInstantiations_MQV()
+{
+    MQV mqv;
+    ECMQV<ECP> ecmqv;
+
+    CRYPTOPP_UNUSED(mqv);
+    CRYPTOPP_UNUSED(ecmqv);
+}
+
+void TestInstantiations_HMQV()
+{
+    HMQV hmqv;
+    ECHMQV<ECP> echmqv;
+
+    CRYPTOPP_UNUSED(hmqv);
+    CRYPTOPP_UNUSED(echmqv);
+}
+
+void TestInstantiations_FHMQV()
+{
+    FHMQV fhmqv;
+    ECFHMQV<ECP> ecfhmqv;
+
+    CRYPTOPP_UNUSED(fhmqv);
+    CRYPTOPP_UNUSED(ecfhmqv);
+}
+#endif
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/mqv.h b/runtime/third_party/cryptopp/mqv.h
new file mode 100644
index 0000000..8e25b9c
--- /dev/null
+++ b/runtime/third_party/cryptopp/mqv.h
@@ -0,0 +1,268 @@
+// mqv.h - originally written and placed in the public domain by Wei Dai
+
+/// \file mqv.h
+/// \brief Classes for Menezes–Qu–Vanstone (MQV) key agreement
+/// \since Crypto++ 3.0
+
+#ifndef CRYPTOPP_MQV_H
+#define CRYPTOPP_MQV_H
+
+#include "cryptlib.h"
+#include "gfpcrypt.h"
+#include "modarith.h"
+#include "integer.h"
+#include "algebra.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief MQV domain for performing authenticated key agreement
+/// \tparam GROUP_PARAMETERS doamin parameters
+/// \tparam COFACTOR_OPTION cofactor option
+/// \details GROUP_PARAMETERS parameters include the curve coefcients and the base point.
+///   Binary curves use a polynomial to represent its characteristic, while prime curves
+///   use a prime number.
+/// \sa MQV, HMQV, FHMQV, and AuthenticatedKeyAgreementDomain
+/// \since Crypto++ 3.0
+template <class GROUP_PARAMETERS, class COFACTOR_OPTION = typename GROUP_PARAMETERS::DefaultCofactorOption>
+class MQV_Domain : public AuthenticatedKeyAgreementDomain
+{
+public:
+	typedef GROUP_PARAMETERS GroupParameters;
+	typedef typename GroupParameters::Element Element;
+	typedef MQV_Domain<GROUP_PARAMETERS, COFACTOR_OPTION> Domain;
+
+	/// \brief Construct a MQV domain
+	MQV_Domain() {}
+
+	/// \brief Construct a MQV domain
+	/// \param params group parameters and options
+	MQV_Domain(const GroupParameters &params)
+		: m_groupParameters(params) {}
+
+	/// \brief Construct a MQV domain
+	/// \param bt BufferedTransformation with group parameters and options
+	MQV_Domain(BufferedTransformation &bt)
+		{m_groupParameters.BERDecode(bt);}
+
+	/// \brief Construct a MQV domain
+	/// \tparam T1 template parameter used as a constructor parameter
+	/// \tparam T2 template parameter used as a constructor parameter
+	/// \param v1 first parameter
+	/// \param v2 second parameter
+	/// \details v1 and v2 are passed directly to the GROUP_PARAMETERS object.
+	template <class T1, class T2>
+	MQV_Domain(T1 v1, T2 v2)
+		{m_groupParameters.Initialize(v1, v2);}
+
+	/// \brief Construct a MQV domain
+	/// \tparam T1 template parameter used as a constructor parameter
+	/// \tparam T2 template parameter used as a constructor parameter
+	/// \tparam T3 template parameter used as a constructor parameter
+	/// \param v1 first parameter
+	/// \param v2 second parameter
+	/// \param v3 third parameter
+	/// \details v1, v2 and v3 are passed directly to the GROUP_PARAMETERS object.
+	template <class T1, class T2, class T3>
+	MQV_Domain(T1 v1, T2 v2, T3 v3)
+		{m_groupParameters.Initialize(v1, v2, v3);}
+
+	/// \brief Construct a MQV domain
+	/// \tparam T1 template parameter used as a constructor parameter
+	/// \tparam T2 template parameter used as a constructor parameter
+	/// \tparam T3 template parameter used as a constructor parameter
+	/// \tparam T4 template parameter used as a constructor parameter
+	/// \param v1 first parameter
+	/// \param v2 second parameter
+	/// \param v3 third parameter
+	/// \param v4 third parameter
+	/// \details v1, v2, v3 and v4 are passed directly to the GROUP_PARAMETERS object.
+	template <class T1, class T2, class T3, class T4>
+	MQV_Domain(T1 v1, T2 v2, T3 v3, T4 v4)
+		{m_groupParameters.Initialize(v1, v2, v3, v4);}
+
+	/// \brief Retrieves the group parameters for this domain
+	/// \return the group parameters for this domain as a const reference
+	const GroupParameters & GetGroupParameters() const {return m_groupParameters;}
+
+	/// \brief Retrieves the group parameters for this domain
+	/// \return the group parameters for this domain as a non-const reference
+	GroupParameters & AccessGroupParameters() {return m_groupParameters;}
+
+	/// \brief Retrieves the crypto parameters for this domain
+	/// \return the crypto parameters for this domain as a non-const reference
+	CryptoParameters & AccessCryptoParameters() {return AccessAbstractGroupParameters();}
+
+	/// \brief Provides the size of the agreed value
+	/// \return size of agreed value produced in this domain
+	/// \details The length is calculated using <tt>GetEncodedElementSize(false)</tt>,
+	///  which means the element is encoded in a non-reversible format. A
+	///  non-reversible format means its a raw byte array, and it lacks presentation
+	///  format like an ASN.1 BIT_STRING or OCTET_STRING.
+	unsigned int AgreedValueLength() const {return GetAbstractGroupParameters().GetEncodedElementSize(false);}
+
+	/// \brief Provides the size of the static private key
+	/// \return size of static private keys in this domain
+	/// \details The length is calculated using the byte count of the subgroup order.
+	unsigned int StaticPrivateKeyLength() const {return GetAbstractGroupParameters().GetSubgroupOrder().ByteCount();}
+
+	/// \brief Provides the size of the static public key
+	/// \return size of static public keys in this domain
+	/// \details The length is calculated using <tt>GetEncodedElementSize(true)</tt>,
+	///  which means the element is encoded in a reversible format. A reversible
+	///  format means it has a presentation format, and its an ANS.1 encoded element
+	///  or point.
+	unsigned int StaticPublicKeyLength() const {return GetAbstractGroupParameters().GetEncodedElementSize(true);}
+
+	/// \brief Generate static private key in this domain
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer for the generated private key in this domain
+	/// \details The private key is a random scalar used as an exponent in the range
+	///  <tt>[1,MaxExponent()]</tt>.
+	/// \pre <tt>COUNTOF(privateKey) == PrivateStaticKeyLength()</tt>
+	void GenerateStaticPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+	{
+		Integer x(rng, Integer::One(), GetAbstractGroupParameters().GetMaxExponent());
+		x.Encode(privateKey, StaticPrivateKeyLength());
+	}
+
+	/// \brief Generate a static public key from a private key in this domain
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer with the previously generated private key
+	/// \param publicKey a byte buffer for the generated public key in this domain
+	/// \details The public key is an element or point on the curve, and its stored
+	///  in a revrsible format. A reversible format means it has a presentation
+	///  format, and its an ANS.1 encoded element or point.
+	/// \pre <tt>COUNTOF(publicKey) == PublicStaticKeyLength()</tt>
+	void GenerateStaticPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+	{
+		CRYPTOPP_UNUSED(rng);
+		const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
+		Integer x(privateKey, StaticPrivateKeyLength());
+		Element y = params.ExponentiateBase(x);
+		params.EncodeElement(true, y, publicKey);
+	}
+
+	/// \brief Provides the size of the ephemeral private key
+	/// \return size of ephemeral private keys in this domain
+	/// \details An ephemeral private key is a private key and public key.
+	///  The serialized size is different than a static private key.
+	unsigned int EphemeralPrivateKeyLength() const {return StaticPrivateKeyLength() + StaticPublicKeyLength();}
+
+	/// \brief Provides the size of the ephemeral public key
+	/// \return size of ephemeral public keys in this domain
+	/// \details An ephemeral public key is a public key.
+	///  The serialized size is the same as a static public key.
+	unsigned int EphemeralPublicKeyLength() const {return StaticPublicKeyLength();}
+
+	/// \brief Generate ephemeral private key in this domain
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer for the generated private key in this domain
+	/// \pre <tt>COUNTOF(privateKey) == EphemeralPrivateKeyLength()</tt>
+	void GenerateEphemeralPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+	{
+		const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
+		Integer x(rng, Integer::One(), params.GetMaxExponent());
+		x.Encode(privateKey, StaticPrivateKeyLength());
+		Element y = params.ExponentiateBase(x);
+		params.EncodeElement(true, y, privateKey+StaticPrivateKeyLength());
+	}
+
+	/// \brief Generate ephemeral public key from a private key in this domain
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param privateKey a byte buffer with the previously generated private key
+	/// \param publicKey a byte buffer for the generated public key in this domain
+	/// \pre <tt>COUNTOF(publicKey) == EphemeralPublicKeyLength()</tt>
+	void GenerateEphemeralPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+	{
+		CRYPTOPP_UNUSED(rng);
+		std::memcpy(publicKey, privateKey+StaticPrivateKeyLength(), EphemeralPublicKeyLength());
+	}
+
+	/// \brief Derive agreed value or shared secret
+	/// \param agreedValue the shared secret
+	/// \param staticPrivateKey your long term private key
+	/// \param ephemeralPrivateKey your ephemeral private key
+	/// \param staticOtherPublicKey couterparty's long term public key
+	/// \param ephemeralOtherPublicKey couterparty's ephemeral public key
+	/// \param validateStaticOtherPublicKey flag indicating validation
+	/// \return true upon success, false in case of failure
+	/// \details Agree() performs the authenticated key agreement. Agree()
+	///  derives a shared secret from your private keys and couterparty's
+	///  public keys. Each instance or run of the protocol should use a new
+	///  ephemeral key pair.
+	/// \details The other's ephemeral public key will always be validated at
+	///  Level 1 to ensure it is a point on the curve.
+	///  <tt>validateStaticOtherPublicKey</tt> determines how thoroughly other's
+	///  static public key is validated. If you have previously validated the
+	///  couterparty's static public key, then use
+	///  <tt>validateStaticOtherPublicKey=false</tt> to save time.
+	/// \pre <tt>COUNTOF(agreedValue) == AgreedValueLength()</tt>
+	/// \pre <tt>COUNTOF(staticPrivateKey) == StaticPrivateKeyLength()</tt>
+	/// \pre <tt>COUNTOF(ephemeralPrivateKey) == EphemeralPrivateKeyLength()</tt>
+	/// \pre <tt>COUNTOF(staticOtherPublicKey) == StaticPublicKeyLength()</tt>
+	/// \pre <tt>COUNTOF(ephemeralOtherPublicKey) == EphemeralPublicKeyLength()</tt>
+	bool Agree(byte *agreedValue,
+		const byte *staticPrivateKey, const byte *ephemeralPrivateKey,
+		const byte *staticOtherPublicKey, const byte *ephemeralOtherPublicKey,
+		bool validateStaticOtherPublicKey=true) const
+	{
+		try
+		{
+			const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
+			Element WW = params.DecodeElement(staticOtherPublicKey, validateStaticOtherPublicKey);
+			Element VV = params.DecodeElement(ephemeralOtherPublicKey, true);
+
+			Integer s(staticPrivateKey, StaticPrivateKeyLength());
+			Integer u(ephemeralPrivateKey, StaticPrivateKeyLength());
+			Element V = params.DecodeElement(ephemeralPrivateKey+StaticPrivateKeyLength(), false);
+
+			const Integer &r = params.GetSubgroupOrder();
+			Integer h2 = Integer::Power2((r.BitCount()+1)/2);
+			Integer e = ((h2+params.ConvertElementToInteger(V)%h2)*s+u) % r;
+			Integer tt = h2 + params.ConvertElementToInteger(VV) % h2;
+
+			if (COFACTOR_OPTION::ToEnum() == NO_COFACTOR_MULTIPLICTION)
+			{
+				Element P = params.ExponentiateElement(WW, tt);
+				P = m_groupParameters.MultiplyElements(P, VV);
+				Element R[2];
+				const Integer e2[2] = {r, e};
+				params.SimultaneousExponentiate(R, P, e2, 2);
+				if (!params.IsIdentity(R[0]) || params.IsIdentity(R[1]))
+					return false;
+				params.EncodeElement(false, R[1], agreedValue);
+			}
+			else
+			{
+				const Integer &k = params.GetCofactor();
+				if (COFACTOR_OPTION::ToEnum() == COMPATIBLE_COFACTOR_MULTIPLICTION)
+					e = ModularArithmetic(r).Divide(e, k);
+				Element P = m_groupParameters.CascadeExponentiate(VV, k*e, WW, k*(e*tt%r));
+				if (params.IsIdentity(P))
+					return false;
+				params.EncodeElement(false, P, agreedValue);
+			}
+		}
+		catch (DL_BadElement &)
+		{
+			return false;
+		}
+		return true;
+	}
+
+private:
+	DL_GroupParameters<Element> & AccessAbstractGroupParameters() {return m_groupParameters;}
+	const DL_GroupParameters<Element> & GetAbstractGroupParameters() const {return m_groupParameters;}
+
+	GroupParameters m_groupParameters;
+};
+
+/// Menezes-Qu-Vanstone in GF(p) with key validation, AKA <a href="http://www.weidai.com/scan-mirror/ka.html#MQV">MQV</a>
+/// \sa MQV, HMQV_Domain, FHMQV_Domain, AuthenticatedKeyAgreementDomain
+/// \since Crypto++ 3.0
+typedef MQV_Domain<DL_GroupParameters_GFP_DefaultSafePrime> MQV;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/naclite.h b/runtime/third_party/cryptopp/naclite.h
new file mode 100644
index 0000000..efb542c
--- /dev/null
+++ b/runtime/third_party/cryptopp/naclite.h
@@ -0,0 +1,438 @@
+// naclite.h - written and placed in the public domain by Jeffrey Walton
+//          based on public domain NaCl source code written by
+//          Daniel J. Bernstein, Bernard van Gastel, Wesley Janssen,
+//          Tanja Lange, Peter Schwabe and Sjaak Smetsers.
+
+// The Tweet API was added to the Crypto++ library to cross-validate results.
+// We debated over putting it in the Test namespace, but settled for the NaCl
+// namespace to segregate it from other parts of the library.
+
+/// \file naclite.h
+/// \brief Crypto++ interface to TweetNaCl library (20140917)
+/// \details TweetNaCl is a compact reimplementation of the NaCl library
+///   by Daniel J. Bernstein, Bernard van Gastel, Wesley Janssen, Tanja
+///   Lange, Peter Schwabe and Sjaak Smetsers. The library is less than
+///   20 KB in size and provides 25 of the NaCl library functions.
+/// \details The compact library uses curve25519, XSalsa20, Poly1305 and
+///   SHA-512 as default primitives, and includes both x25519 key exchange
+///   and ed25519 signatures. The complete list of functions can be found
+///   in <A
+///   HREF="https://tweetnacl.cr.yp.to/tweetnacl-20140917.pdf">TweetNaCl:
+///   A crypto library in 100 tweets</A> (20140917), Table 1, page 5.
+/// \details Crypto++ rejects small order elements using libsodium's
+///   blacklist. The TweetNaCl library allowed them but the library predated
+///   the attack. If you wish to allow small elements then use the "unchecked"
+///   versions of crypto_box_unchecked, crypto_box_open_unchecked and
+///   crypto_box_beforenm_unchecked.
+/// \details TweetNaCl is well written but not well optimzed. It runs about
+///   10x slower than optimized routines from libsodium. However, the library
+///   is still 2x to 4x faster than the algorithms NaCl was designed to replace
+///   and allows cross-checking results from an independent implementation.
+/// \details The Crypto++ wrapper for TweetNaCl requires OS features. That is,
+///   <tt>NO_OS_DEPENDENCE</tt> cannot be defined. It is due to TweetNaCl's
+///   internal function <tt>randombytes</tt>. Crypto++ used
+///   <tt>DefaultAutoSeededRNG</tt> within <tt>randombytes</tt>, so OS
+///   integration must be enabled. You can use another generator like
+///   <tt>RDRAND</tt> to avoid the restriction.
+/// \sa <A HREF="https://cr.yp.to/highspeed/coolnacl-20120725.pdf">The security
+///   impact of a new cryptographic library</A>, <A
+///   HREF="https://tweetnacl.cr.yp.to/tweetnacl-20140917.pdf">TweetNaCl:
+///   A crypto library in 100 tweets</A> (20140917), <A
+///   HREF="https://eprint.iacr.org/2017/806.pdf">May the Fourth Be With You:
+///   A Microarchitectural Side Channel Attack on Several Real-World
+///   Applications of Curve25519</A>, <A
+///   HREF="https://github.com/jedisct1/libsodium/commit/afabd7e7386e1194">libsodium
+///   commit afabd7e7386e1194</A> and <A
+///   HREF="https://tools.ietf.org/html/rfc7748">RFC 7748, Elliptic Curves for
+///   Security</A>, Section 6.
+/// \since Crypto++ 6.0
+
+#ifndef CRYPTOPP_NACL_H
+#define CRYPTOPP_NACL_H
+
+#include "config.h"
+#include "stdcpp.h"
+
+#if defined(NO_OS_DEPENDENCE) || !defined(OS_RNG_AVAILABLE)
+# define CRYPTOPP_DISABLE_NACL 1
+#endif
+
+#ifndef CRYPTOPP_DISABLE_NACL
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(NaCl)
+
+/// \brief Hash size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/hash.html">NaCl crypto_hash documentation</A>
+CRYPTOPP_CONSTANT(crypto_hash_BYTES = 64);
+
+/// \brief Key size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/stream.html">NaCl crypto_stream documentation</A>
+CRYPTOPP_CONSTANT(crypto_stream_KEYBYTES = 32);
+/// \brief Nonce size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/stream.html">NaCl crypto_stream documentation</A>
+CRYPTOPP_CONSTANT(crypto_stream_NONCEBYTES = 24);
+
+/// \brief Key size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/auth.html">NaCl crypto_auth documentation</A>
+CRYPTOPP_CONSTANT(crypto_auth_KEYBYTES = 32);
+/// \brief Tag size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/auth.html">NaCl crypto_auth documentation</A>
+CRYPTOPP_CONSTANT(crypto_auth_BYTES = 16);
+
+/// \brief Key size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/onetimeauth.html">NaCl crypto_onetimeauth documentation</A>
+CRYPTOPP_CONSTANT(crypto_onetimeauth_KEYBYTES = 32);
+/// \brief Tag size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/onetimeauth.html">NaCl crypto_onetimeauth documentation</A>
+CRYPTOPP_CONSTANT(crypto_onetimeauth_BYTES = 16);
+
+/// \brief Key size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/secretbox.html">NaCl crypto_secretbox documentation</A>
+CRYPTOPP_CONSTANT(crypto_secretbox_KEYBYTES = 32);
+/// \brief Nonce size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/secretbox.html">NaCl crypto_secretbox documentation</A>
+CRYPTOPP_CONSTANT(crypto_secretbox_NONCEBYTES = 24);
+/// \brief Zero-padded message prefix in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/secretbox.html">NaCl crypto_secretbox documentation</A>
+CRYPTOPP_CONSTANT(crypto_secretbox_ZEROBYTES = 32);
+/// \brief Zero-padded message prefix in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/secretbox.html">NaCl crypto_secretbox documentation</A>
+CRYPTOPP_CONSTANT(crypto_secretbox_BOXZEROBYTES = 16);
+
+/// \brief Private key size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+CRYPTOPP_CONSTANT(crypto_box_SECRETKEYBYTES = 32);
+/// \brief Public key size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+CRYPTOPP_CONSTANT(crypto_box_PUBLICKEYBYTES = 32);
+/// \brief Nonce size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+CRYPTOPP_CONSTANT(crypto_box_NONCEBYTES = 24);
+/// \brief Message 0-byte prefix in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+CRYPTOPP_CONSTANT(crypto_box_ZEROBYTES = 32);
+/// \brief Open box 0-byte prefix in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+CRYPTOPP_CONSTANT(crypto_box_BOXZEROBYTES = 16);
+/// \brief Precomputation 0-byte prefix in bytes in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+CRYPTOPP_CONSTANT(crypto_box_BEFORENMBYTES = 32);
+/// \brief MAC size in bytes
+/// \details crypto_box_MACBYTES was missing from tweetnacl.h. Its is defined as
+///   crypto_box_curve25519xsalsa20poly1305_MACBYTES, which is defined as 16U.
+/// \sa <A HREF="https://nacl.cr.yp.to/hash.html">NaCl crypto_box documentation</A>
+CRYPTOPP_CONSTANT(crypto_box_MACBYTES = 16);
+
+/// \brief Private key size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/sign.html">NaCl crypto_sign documentation</A>
+CRYPTOPP_CONSTANT(crypto_sign_SECRETKEYBYTES = 64);
+/// \brief Public key size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/sign.html">NaCl crypto_sign documentation</A>
+CRYPTOPP_CONSTANT(crypto_sign_PUBLICKEYBYTES = 32);
+/// \brief Seed size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/sign.html">NaCl crypto_sign documentation</A>
+CRYPTOPP_CONSTANT(crypto_sign_SEEDBYTES = 32);
+/// \brief Signature size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/sign.html">NaCl crypto_sign documentation</A>
+CRYPTOPP_CONSTANT(crypto_sign_BYTES = 64);
+
+/// \brief Group element size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/scalarmult.html">NaCl crypto_scalarmult documentation</A>
+CRYPTOPP_CONSTANT(crypto_scalarmult_BYTES = 32);
+/// \brief Integer size in bytes
+/// \sa <A HREF="https://nacl.cr.yp.to/scalarmult.html">NaCl crypto_scalarmult documentation</A>
+CRYPTOPP_CONSTANT(crypto_scalarmult_SCALARBYTES = 32);
+
+/// \brief Encrypt and authenticate a message
+/// \param c output byte buffer
+/// \param m input byte buffer
+/// \param d size of the input byte buffer
+/// \param n nonce byte buffer
+/// \param y other's public key
+/// \param x private key
+/// \details crypto_box() uses crypto_box_curve25519xsalsa20poly1305
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+/// \since Crypto++ 6.0
+int crypto_box(byte *c,const byte *m,word64 d,const byte *n,const byte *y,const byte *x);
+
+/// \brief Verify and decrypt a message
+/// \param m output byte buffer
+/// \param c input byte buffer
+/// \param d size of the input byte buffer
+/// \param n nonce byte buffer
+/// \param y other's public key
+/// \param x private key
+/// \details crypto_box_open() uses crypto_box_curve25519xsalsa20poly1305
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+/// \since Crypto++ 6.0
+int crypto_box_open(byte *m,const byte *c,word64 d,const byte *n,const byte *y,const byte *x);
+
+/// \brief Generate a keypair for encryption
+/// \param y public key byte buffer
+/// \param x private key byte buffer
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+/// \since Crypto++ 6.0
+int crypto_box_keypair(byte *y,byte *x);
+
+/// \brief Encrypt and authenticate a message
+/// \param k shared secret byte buffer
+/// \param y other's public key
+/// \param x private key
+/// \details crypto_box_beforenm() performs message-independent precomputation to derive the key.
+///   Once the key is derived multiple calls to crypto_box_afternm() can be made to process the message.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+/// \since Crypto++ 6.0
+int crypto_box_beforenm(byte *k,const byte *y,const byte *x);
+
+/// \brief Encrypt and authenticate a message
+/// \param m output byte buffer
+/// \param c input byte buffer
+/// \param d size of the input byte buffer
+/// \param n nonce byte buffer
+/// \param k shared secret byte buffer
+/// \details crypto_box_afternm() performs message-dependent computation using the derived the key.
+///   Once the key is derived using crypto_box_beforenm() multiple calls to crypto_box_afternm()
+///   can be made to process the message.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+/// \since Crypto++ 6.0
+int crypto_box_afternm(byte *c,const byte *m,word64 d,const byte *n,const byte *k);
+
+/// \brief Verify and decrypt a message
+/// \param m output byte buffer
+/// \param c input byte buffer
+/// \param d size of the input byte buffer
+/// \param n nonce byte buffer
+/// \param k shared secret byte buffer
+/// \details crypto_box_afternm() performs message-dependent computation using the derived the key.
+///   Once the key is derived using crypto_box_beforenm() multiple calls to crypto_box_open_afternm()
+///   can be made to process the message.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>
+/// \since Crypto++ 6.0
+int crypto_box_open_afternm(byte *m,const byte *c,word64 d,const byte *n,const byte *k);
+
+/// \brief Encrypt and authenticate a message
+/// \param c output byte buffer
+/// \param m input byte buffer
+/// \param d size of the input byte buffer
+/// \param n nonce byte buffer
+/// \param y other's public key
+/// \param x private key
+/// \details crypto_box() uses crypto_box_curve25519xsalsa20poly1305.
+/// \details This version of crypto_box() does not check for small order elements. It can be unsafe
+///   but it exists for backwards compatibility with downlevel clients. Without the compatibility
+///   interop with early versions of NaCl, libsodium and other libraries does not exist. The
+///   downlevel interop may also be needed of cryptocurrencies like Bitcoin, Ethereum, Monero
+///   and Zcash.
+/// \return 0 on success, non-0 otherwise
+/// \warning This version of crypto_box() does not check for small order elements. It should not
+///   be used in new software.
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>,
+///   <A HREF="https://eprint.iacr.org/2017/806.pdf">May the Fourth Be With You: A Microarchitectural
+///   Side Channel Attack on Several Real-World Applications of Curve25519</A>,
+///   <A HREF="https://github.com/jedisct1/libsodium/commit/afabd7e7386e1194">libsodium commit
+///   afabd7e7386e1194</A>.
+/// \since Crypto++ 6.0
+int crypto_box_unchecked(byte *c,const byte *m,word64 d,const byte *n,const byte *y,const byte *x);
+
+/// \brief Verify and decrypt a message
+/// \param m output byte buffer
+/// \param c input byte buffer
+/// \param d size of the input byte buffer
+/// \param n nonce byte buffer
+/// \param y other's public key
+/// \param x private key
+/// \details crypto_box_open() uses crypto_box_curve25519xsalsa20poly1305.
+/// \details This version of crypto_box_open() does not check for small order elements. It can be unsafe
+///   but it exists for backwards compatibility with downlevel clients. Without the compatibility
+///   interop with early versions of NaCl, libsodium and other libraries does not exist. The
+///   downlevel interop may also be needed of cryptocurrencies like Bitcoin, Ethereum, Monero
+///   and Zcash.
+/// \return 0 on success, non-0 otherwise
+/// \warning This version of crypto_box_open() does not check for small order elements. It should not
+///   be used in new software.
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>,
+///   <A HREF="https://eprint.iacr.org/2017/806.pdf">May the Fourth Be With You: A Microarchitectural
+///   Side Channel Attack on Several Real-World Applications of Curve25519</A>,
+///   <A HREF="https://github.com/jedisct1/libsodium/commit/afabd7e7386e1194">libsodium commit
+///   afabd7e7386e1194</A>.
+/// \since Crypto++ 6.0
+int crypto_box_open_unchecked(byte *m,const byte *c,word64 d,const byte *n,const byte *y,const byte *x);
+
+/// \brief Encrypt and authenticate a message
+/// \param k shared secret byte buffer
+/// \param y other's public key
+/// \param x private key
+/// \details crypto_box_beforenm() performs message-independent precomputation to derive the key.
+///   Once the key is derived multiple calls to crypto_box_afternm() can be made to process the message.
+/// \details This version of crypto_box_beforenm() does not check for small order elements. It can be unsafe
+///   but it exists for backwards compatibility with downlevel clients. Without the compatibility
+///   interop with early versions of NaCl, libsodium and other libraries does not exist. The
+///   downlevel interop may also be needed of cryptocurrencies like Bitcoin, Ethereum, Monero
+///   and Zcash.
+/// \return 0 on success, non-0 otherwise
+/// \warning This version of crypto_box_beforenm() does not check for small order elements. It should not
+///   be used in new software.
+/// \sa <A HREF="https://nacl.cr.yp.to/box.html">NaCl crypto_box documentation</A>,
+///   <A HREF="https://eprint.iacr.org/2017/806.pdf">May the Fourth Be With You: A Microarchitectural
+///   Side Channel Attack on Several Real-World Applications of Curve25519</A>,
+///   <A HREF="https://github.com/jedisct1/libsodium/commit/afabd7e7386e1194">libsodium commit
+///   afabd7e7386e1194</A>.
+/// \since Crypto++ 6.0
+int crypto_box_beforenm_unchecked(byte *k,const byte *y,const byte *x);
+
+/// \brief TODO
+int crypto_core_salsa20(byte *out,const byte *in,const byte *k,const byte *c);
+
+/// \brief TODO
+/// \return 0 on success, non-0 otherwise
+/// \since Crypto++ 6.0
+int crypto_core_hsalsa20(byte *out,const byte *in,const byte *k,const byte *c);
+
+/// \brief Hash multiple blocks
+/// \details crypto_hashblocks() uses crypto_hashblocks_sha512.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/hash.html">NaCl crypto_hash documentation</A>
+/// \since Crypto++ 6.0
+int crypto_hashblocks(byte *x,const byte *m,word64 n);
+
+/// \brief Hash a message
+/// \details crypto_hash() uses crypto_hash_sha512.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/hash.html">NaCl crypto_hash documentation</A>
+/// \since Crypto++ 6.0
+int crypto_hash(byte *out,const byte *m,word64 n);
+
+/// \brief Create an authentication tag for a message
+/// \details crypto_onetimeauth() uses crypto_onetimeauth_poly1305.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/onetimeauth.html">NaCl crypto_onetimeauth documentation</A>
+/// \since Crypto++ 6.0
+int crypto_onetimeauth(byte *out,const byte *m,word64 n,const byte *k);
+
+/// \brief Verify an authentication tag on a message
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/onetimeauth.html">NaCl crypto_onetimeauth documentation</A>
+/// \since Crypto++ 6.0
+int crypto_onetimeauth_verify(const byte *h,const byte *m,word64 n,const byte *k);
+
+/// \brief Scalar multiplication of a point
+/// \details crypto_scalarmult() uses crypto_scalarmult_curve25519
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/scalarmult.html">NaCl crypto_scalarmult documentation</A>
+/// \since Crypto++ 6.0
+int crypto_scalarmult(byte *q,const byte *n,const byte *p);
+
+/// \brief Scalar multiplication of base point
+/// \details crypto_scalarmult_base() uses crypto_scalarmult_curve25519
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/scalarmult.html">NaCl crypto_scalarmult documentation</A>
+/// \since Crypto++ 6.0
+int crypto_scalarmult_base(byte *q,const byte *n);
+
+/// \brief Encrypt and authenticate a message
+/// \details crypto_secretbox() uses a symmetric key to encrypt and authenticate a message.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/secretbox.html">NaCl crypto_secretbox documentation</A>
+/// \since Crypto++ 6.0
+int crypto_secretbox(byte *c,const byte *m,word64 d,const byte *n,const byte *k);
+
+/// \brief Verify and decrypt a message
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/secretbox.html">NaCl crypto_secretbox documentation</A>
+/// \since Crypto++ 6.0
+int crypto_secretbox_open(byte *m,const byte *c,word64 d,const byte *n,const byte *k);
+
+/// \brief Sign a message
+/// \param sm output byte buffer
+/// \param smlen size of the output byte buffer
+/// \param m input byte buffer
+/// \param n size of the input byte buffer
+/// \param sk private key
+/// \details crypto_sign() uses crypto_sign_ed25519.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/sign.html">NaCl crypto_sign documentation</A>
+/// \since Crypto++ 6.0
+int crypto_sign(byte *sm,word64 *smlen,const byte *m,word64 n,const byte *sk);
+
+/// \brief Verify a message
+/// \param m output byte buffer
+/// \param mlen size of the output byte buffer
+/// \param sm input byte buffer
+/// \param n size of the input byte buffer
+/// \param pk public key
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/sign.html">NaCl crypto_sign documentation</A>
+/// \since Crypto++ 6.0
+int crypto_sign_open(byte *m,word64 *mlen,const byte *sm,word64 n,const byte *pk);
+
+/// \brief Generate a keypair for signing
+/// \param pk public key byte buffer
+/// \param sk private key byte buffer
+/// \details crypto_sign_keypair() creates an ed25519 keypair.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/sign.html">NaCl crypto_sign documentation</A>
+/// \since Crypto++ 6.0
+int crypto_sign_keypair(byte *pk, byte *sk);
+
+/// \brief Calculate a public key from a secret key
+/// \param pk public key byte buffer
+/// \param sk private key byte buffer
+/// \details crypto_sign_sk2pk() creates an ed25519 public key from an existing
+///   32-byte secret key. The function does not backfill the tail bytes of the
+///   secret key with the calculated public key.
+/// \details crypto_sign_sk2pk() is not part of libsodium or Tweet API. It was
+///   added for interop with some anonymous routing protocols.
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/sign.html">NaCl crypto_sign documentation</A>
+/// \since Crypto++ 8.0
+int crypto_sign_sk2pk(byte *pk, const byte *sk);
+
+/// \brief Produce a keystream using XSalsa20
+/// \details crypto_stream() uses crypto_stream_xsalsa20
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/stream.html">NaCl crypto_stream documentation</A>
+/// \since Crypto++ 6.0
+int crypto_stream(byte *c,word64 d,const byte *n,const byte *k);
+
+/// \brief Encrypt a message using XSalsa20
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/stream.html">NaCl crypto_stream documentation</A>
+/// \since Crypto++ 6.0
+int crypto_stream_xor(byte *c,const byte *m,word64 d,const byte *n,const byte *k);
+
+/// \brief Produce a keystream using Salsa20
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/stream.html">NaCl crypto_stream documentation</A>
+/// \since Crypto++ 6.0
+int crypto_stream_salsa20(byte *c,word64 d,const byte *n,const byte *k);
+
+/// \brief Encrypt a message using Salsa20
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/stream.html">NaCl crypto_stream documentation</A>
+/// \since Crypto++ 6.0
+int crypto_stream_salsa20_xor(byte *c,const byte *m,word64 b,const byte *n,const byte *k);
+
+/// \brief Compare 16-byte buffers
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/verify.html">NaCl crypto_verify documentation</A>
+/// \since Crypto++ 6.0
+int crypto_verify_16(const byte *x,const byte *y);
+
+/// \brief Compare 32-byte buffers
+/// \return 0 on success, non-0 otherwise
+/// \sa <A HREF="https://nacl.cr.yp.to/verify.html">NaCl crypto_verify documentation</A>
+/// \since Crypto++ 6.0
+int crypto_verify_32(const byte *x,const byte *y);
+
+NAMESPACE_END  // CryptoPP
+NAMESPACE_END  // NaCl
+
+#endif  // CRYPTOPP_DISABLE_NACL
+#endif  // CRYPTOPP_NACL_H
diff --git a/runtime/third_party/cryptopp/nbtheory.cpp b/runtime/third_party/cryptopp/nbtheory.cpp
new file mode 100644
index 0000000..da6f1b9
--- /dev/null
+++ b/runtime/third_party/cryptopp/nbtheory.cpp
@@ -0,0 +1,1113 @@
+// nbtheory.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "nbtheory.h"
+#include "integer.h"
+#include "modarith.h"
+#include "algparam.h"
+#include "smartptr.h"
+#include "misc.h"
+#include "stdcpp.h"
+
+#ifdef _OPENMP
+# include <omp.h>
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Keep sync'd with primetab.cpp
+const unsigned int maxPrimeTableSize = 3511;
+const word s_lastSmallPrime = 32719;
+
+const word16 * GetPrimeTable(unsigned int &size)
+{
+	extern const word16 precomputedPrimeTable[maxPrimeTableSize];
+	size = maxPrimeTableSize;
+	return precomputedPrimeTable;
+}
+
+bool IsSmallPrime(const Integer &p)
+{
+	unsigned int primeTableSize;
+	const word16 * primeTable = GetPrimeTable(primeTableSize);
+
+	if (p.IsPositive() && p <= primeTable[primeTableSize-1])
+		return std::binary_search(primeTable, primeTable+primeTableSize, (word16)p.ConvertToLong());
+	else
+		return false;
+}
+
+bool TrialDivision(const Integer &p, unsigned bound)
+{
+	unsigned int primeTableSize;
+	const word16 * primeTable = GetPrimeTable(primeTableSize);
+
+	CRYPTOPP_ASSERT(primeTable[primeTableSize-1] >= bound);
+
+	unsigned int i;
+	for (i = 0; primeTable[i]<bound; i++)
+		if ((p % primeTable[i]) == 0)
+			return true;
+
+	if (bound == primeTable[i])
+		return (p % bound == 0);
+	else
+		return false;
+}
+
+bool SmallDivisorsTest(const Integer &p)
+{
+	unsigned int primeTableSize;
+	const word16 * primeTable = GetPrimeTable(primeTableSize);
+	return !TrialDivision(p, primeTable[primeTableSize-1]);
+}
+
+bool IsFermatProbablePrime(const Integer &n, const Integer &b)
+{
+	if (n <= 3)
+		return n==2 || n==3;
+
+	CRYPTOPP_ASSERT(n>3 && b>1 && b<n-1);
+	return a_exp_b_mod_c(b, n-1, n)==1;
+}
+
+bool IsStrongProbablePrime(const Integer &n, const Integer &b)
+{
+	if (n <= 3)
+		return n==2 || n==3;
+
+	CRYPTOPP_ASSERT(n>3 && b>1 && b<n-1);
+
+	if ((n.IsEven() && n!=2) || GCD(b, n) != 1)
+		return false;
+
+	Integer nminus1 = (n-1);
+	unsigned int a;
+
+	// calculate a = largest power of 2 that divides (n-1)
+	for (a=0; ; a++)
+		if (nminus1.GetBit(a))
+			break;
+	Integer m = nminus1>>a;
+
+	Integer z = a_exp_b_mod_c(b, m, n);
+	if (z==1 || z==nminus1)
+		return true;
+	for (unsigned j=1; j<a; j++)
+	{
+		z = z.Squared()%n;
+		if (z==nminus1)
+			return true;
+		if (z==1)
+			return false;
+	}
+	return false;
+}
+
+bool RabinMillerTest(RandomNumberGenerator &rng, const Integer &n, unsigned int rounds)
+{
+	if (n <= 3)
+		return n==2 || n==3;
+
+	CRYPTOPP_ASSERT(n>3);
+
+	Integer b;
+	for (unsigned int i=0; i<rounds; i++)
+	{
+		b.Randomize(rng, 2, n-2);
+		if (!IsStrongProbablePrime(n, b))
+			return false;
+	}
+	return true;
+}
+
+bool IsLucasProbablePrime(const Integer &n)
+{
+	if (n <= 1)
+		return false;
+
+	if (n.IsEven())
+		return n==2;
+
+	CRYPTOPP_ASSERT(n>2);
+
+	Integer b=3;
+	unsigned int i=0;
+	int j;
+
+	while ((j=Jacobi(b.Squared()-4, n)) == 1)
+	{
+		if (++i==64 && n.IsSquare())	// avoid infinite loop if n is a square
+			return false;
+		++b; ++b;
+	}
+
+	if (j==0)
+		return false;
+	else
+		return Lucas(n+1, b, n)==2;
+}
+
+bool IsStrongLucasProbablePrime(const Integer &n)
+{
+	if (n <= 1)
+		return false;
+
+	if (n.IsEven())
+		return n==2;
+
+	CRYPTOPP_ASSERT(n>2);
+
+	Integer b=3;
+	unsigned int i=0;
+	int j;
+
+	while ((j=Jacobi(b.Squared()-4, n)) == 1)
+	{
+		if (++i==64 && n.IsSquare())	// avoid infinite loop if n is a square
+			return false;
+		++b; ++b;
+	}
+
+	if (j==0)
+		return false;
+
+	Integer n1 = n+1;
+	unsigned int a;
+
+	// calculate a = largest power of 2 that divides n1
+	for (a=0; ; a++)
+		if (n1.GetBit(a))
+			break;
+	Integer m = n1>>a;
+
+	Integer z = Lucas(m, b, n);
+	if (z==2 || z==n-2)
+		return true;
+	for (i=1; i<a; i++)
+	{
+		z = (z.Squared()-2)%n;
+		if (z==n-2)
+			return true;
+		if (z==2)
+			return false;
+	}
+	return false;
+}
+
+struct NewLastSmallPrimeSquared
+{
+	Integer * operator()() const
+	{
+		return new Integer(Integer(s_lastSmallPrime).Squared());
+	}
+};
+
+bool IsPrime(const Integer &p)
+{
+	if (p <= s_lastSmallPrime)
+		return IsSmallPrime(p);
+	else if (p <= Singleton<Integer, NewLastSmallPrimeSquared>().Ref())
+		return SmallDivisorsTest(p);
+	else
+		return SmallDivisorsTest(p) && IsStrongProbablePrime(p, 3) && IsStrongLucasProbablePrime(p);
+}
+
+bool VerifyPrime(RandomNumberGenerator &rng, const Integer &p, unsigned int level)
+{
+	bool pass = IsPrime(p) && RabinMillerTest(rng, p, 1);
+	if (level >= 1)
+		pass = pass && RabinMillerTest(rng, p, 10);
+	return pass;
+}
+
+unsigned int PrimeSearchInterval(const Integer &max)
+{
+	return max.BitCount();
+}
+
+static inline bool FastProbablePrimeTest(const Integer &n)
+{
+	return IsStrongProbablePrime(n,2);
+}
+
+AlgorithmParameters MakeParametersForTwoPrimesOfEqualSize(unsigned int productBitLength)
+{
+	if (productBitLength < 16)
+		throw InvalidArgument("invalid bit length");
+
+	Integer minP, maxP;
+
+	if (productBitLength%2==0)
+	{
+		minP = Integer(182) << (productBitLength/2-8);
+		maxP = Integer::Power2(productBitLength/2)-1;
+	}
+	else
+	{
+		minP = Integer::Power2((productBitLength-1)/2);
+		maxP = Integer(181) << ((productBitLength+1)/2-8);
+	}
+
+	return MakeParameters("RandomNumberType", Integer::PRIME)("Min", minP)("Max", maxP);
+}
+
+class PrimeSieve
+{
+public:
+	// delta == 1 or -1 means double sieve with p = 2*q + delta
+	PrimeSieve(const Integer &first, const Integer &last, const Integer &step, signed int delta=0);
+	bool NextCandidate(Integer &c);
+
+	void DoSieve();
+	static void SieveSingle(std::vector<bool> &sieve, word16 p, const Integer &first, const Integer &step, word16 stepInv);
+
+	Integer m_first, m_last, m_step;
+	signed int m_delta;
+	word m_next;
+	std::vector<bool> m_sieve;
+};
+
+PrimeSieve::PrimeSieve(const Integer &first, const Integer &last, const Integer &step, signed int delta)
+	: m_first(first), m_last(last), m_step(step), m_delta(delta), m_next(0)
+{
+	DoSieve();
+}
+
+bool PrimeSieve::NextCandidate(Integer &c)
+{
+	bool safe = SafeConvert(std::find(m_sieve.begin()+m_next, m_sieve.end(), false) - m_sieve.begin(), m_next);
+	CRYPTOPP_UNUSED(safe); CRYPTOPP_ASSERT(safe);
+	if (m_next == m_sieve.size())
+	{
+		m_first += long(m_sieve.size())*m_step;
+		if (m_first > m_last)
+			return false;
+		else
+		{
+			m_next = 0;
+			DoSieve();
+			return NextCandidate(c);
+		}
+	}
+	else
+	{
+		c = m_first + long(m_next)*m_step;
+		++m_next;
+		return true;
+	}
+}
+
+void PrimeSieve::SieveSingle(std::vector<bool> &sieve, word16 p, const Integer &first, const Integer &step, word16 stepInv)
+{
+	if (stepInv)
+	{
+		size_t sieveSize = sieve.size();
+		size_t j = (word32(p-(first%p))*stepInv) % p;
+		// if the first multiple of p is p, skip it
+		if (first.WordCount() <= 1 && first + step*long(j) == p)
+			j += p;
+		for (; j < sieveSize; j += p)
+			sieve[j] = true;
+	}
+}
+
+void PrimeSieve::DoSieve()
+{
+	unsigned int primeTableSize;
+	const word16 * primeTable = GetPrimeTable(primeTableSize);
+
+	const unsigned int maxSieveSize = 32768;
+	unsigned int sieveSize = STDMIN(Integer(maxSieveSize), (m_last-m_first)/m_step+1).ConvertToLong();
+
+	m_sieve.clear();
+	m_sieve.resize(sieveSize, false);
+
+	if (m_delta == 0)
+	{
+		for (unsigned int i = 0; i < primeTableSize; ++i)
+			SieveSingle(m_sieve, primeTable[i], m_first, m_step, (word16)m_step.InverseMod(primeTable[i]));
+	}
+	else
+	{
+		CRYPTOPP_ASSERT(m_step%2==0);
+		Integer qFirst = (m_first-m_delta) >> 1;
+		Integer halfStep = m_step >> 1;
+		for (unsigned int i = 0; i < primeTableSize; ++i)
+		{
+			word16 p = primeTable[i];
+			word16 stepInv = (word16)m_step.InverseMod(p);
+			SieveSingle(m_sieve, p, m_first, m_step, stepInv);
+
+			word16 halfStepInv = 2*stepInv < p ? 2*stepInv : 2*stepInv-p;
+			SieveSingle(m_sieve, p, qFirst, halfStep, halfStepInv);
+		}
+	}
+}
+
+bool FirstPrime(Integer &p, const Integer &max, const Integer &equiv, const Integer &mod, const PrimeSelector *pSelector)
+{
+	CRYPTOPP_ASSERT(!equiv.IsNegative() && equiv < mod);
+
+	Integer gcd = GCD(equiv, mod);
+	if (gcd != Integer::One())
+	{
+		// the only possible prime p such that p%mod==equiv where GCD(mod,equiv)!=1 is GCD(mod,equiv)
+		if (p <= gcd && gcd <= max && IsPrime(gcd) && (!pSelector || pSelector->IsAcceptable(gcd)))
+		{
+			p = gcd;
+			return true;
+		}
+		else
+			return false;
+	}
+
+	unsigned int primeTableSize;
+	const word16 * primeTable = GetPrimeTable(primeTableSize);
+
+	if (p <= primeTable[primeTableSize-1])
+	{
+		const word16 *pItr;
+
+		--p;
+		if (p.IsPositive())
+			pItr = std::upper_bound(primeTable, primeTable+primeTableSize, (word)p.ConvertToLong());
+		else
+			pItr = primeTable;
+
+		while (pItr < primeTable+primeTableSize && !(*pItr%mod == equiv && (!pSelector || pSelector->IsAcceptable(*pItr))))
+			++pItr;
+
+		if (pItr < primeTable+primeTableSize)
+		{
+			p = *pItr;
+			return p <= max;
+		}
+
+		p = primeTable[primeTableSize-1]+1;
+	}
+
+	CRYPTOPP_ASSERT(p > primeTable[primeTableSize-1]);
+
+	if (mod.IsOdd())
+		return FirstPrime(p, max, CRT(equiv, mod, 1, 2, 1), mod<<1, pSelector);
+
+	p += (equiv-p)%mod;
+
+	if (p>max)
+		return false;
+
+	PrimeSieve sieve(p, max, mod);
+
+	while (sieve.NextCandidate(p))
+	{
+		if ((!pSelector || pSelector->IsAcceptable(p)) && FastProbablePrimeTest(p) && IsPrime(p))
+			return true;
+	}
+
+	return false;
+}
+
+// the following two functions are based on code and comments provided by Preda Mihailescu
+static bool ProvePrime(const Integer &p, const Integer &q)
+{
+	CRYPTOPP_ASSERT(p < q*q*q);
+	CRYPTOPP_ASSERT(p % q == 1);
+
+// this is the Quisquater test. Numbers p having passed the Lucas - Lehmer test
+// for q and verifying p < q^3 can only be built up of two factors, both = 1 mod q,
+// or be prime. The next two lines build the discriminant of a quadratic equation
+// which holds iff p is built up of two factors (exercise ... )
+
+	Integer r = (p-1)/q;
+	if (((r%q).Squared()-4*(r/q)).IsSquare())
+		return false;
+
+	unsigned int primeTableSize;
+	const word16 * primeTable = GetPrimeTable(primeTableSize);
+
+	CRYPTOPP_ASSERT(primeTableSize >= 50);
+	for (int i=0; i<50; i++)
+	{
+		Integer b = a_exp_b_mod_c(primeTable[i], r, p);
+		if (b != 1)
+			return a_exp_b_mod_c(b, q, p) == 1;
+	}
+	return false;
+}
+
+Integer MihailescuProvablePrime(RandomNumberGenerator &rng, unsigned int pbits)
+{
+	Integer p;
+	Integer minP = Integer::Power2(pbits-1);
+	Integer maxP = Integer::Power2(pbits) - 1;
+
+	if (maxP <= Integer(s_lastSmallPrime).Squared())
+	{
+		// Randomize() will generate a prime provable by trial division
+		p.Randomize(rng, minP, maxP, Integer::PRIME);
+		return p;
+	}
+
+	unsigned int qbits = (pbits+2)/3 + 1 + rng.GenerateWord32(0, pbits/36);
+	Integer q = MihailescuProvablePrime(rng, qbits);
+	Integer q2 = q<<1;
+
+	while (true)
+	{
+		// this initializes the sieve to search in the arithmetic
+		// progression p = p_0 + \lambda * q2 = p_0 + 2 * \lambda * q,
+		// with q the recursively generated prime above. We will be able
+		// to use Lucas tets for proving primality. A trick of Quisquater
+		// allows taking q > cubic_root(p) rather than square_root: this
+		// decreases the recursion.
+
+		p.Randomize(rng, minP, maxP, Integer::ANY, 1, q2);
+		PrimeSieve sieve(p, STDMIN(p+PrimeSearchInterval(maxP)*q2, maxP), q2);
+
+		while (sieve.NextCandidate(p))
+		{
+			if (FastProbablePrimeTest(p) && ProvePrime(p, q))
+				return p;
+		}
+	}
+
+	// not reached
+	return p;
+}
+
+Integer MaurerProvablePrime(RandomNumberGenerator &rng, unsigned int bits)
+{
+	const unsigned smallPrimeBound = 29, c_opt=10;
+	Integer p;
+
+	unsigned int primeTableSize;
+	const word16 * primeTable = GetPrimeTable(primeTableSize);
+
+	if (bits < smallPrimeBound)
+	{
+		do
+			p.Randomize(rng, Integer::Power2(bits-1), Integer::Power2(bits)-1, Integer::ANY, 1, 2);
+		while (TrialDivision(p, 1 << ((bits+1)/2)));
+	}
+	else
+	{
+		const unsigned margin = bits > 50 ? 20 : (bits-10)/2;
+		double relativeSize;
+		do
+			relativeSize = std::pow(2.0, double(rng.GenerateWord32())/0xffffffff - 1);
+		while (bits * relativeSize >= bits - margin);
+
+		Integer a,b;
+		Integer q = MaurerProvablePrime(rng, unsigned(bits*relativeSize));
+		Integer I = Integer::Power2(bits-2)/q;
+		Integer I2 = I << 1;
+		unsigned int trialDivisorBound = (unsigned int)STDMIN((unsigned long)primeTable[primeTableSize-1], (unsigned long)bits*bits/c_opt);
+		bool success = false;
+		while (!success)
+		{
+			p.Randomize(rng, I, I2, Integer::ANY);
+			p *= q; p <<= 1; ++p;
+			if (!TrialDivision(p, trialDivisorBound))
+			{
+				a.Randomize(rng, 2, p-1, Integer::ANY);
+				b = a_exp_b_mod_c(a, (p-1)/q, p);
+				success = (GCD(b-1, p) == 1) && (a_exp_b_mod_c(b, q, p) == 1);
+			}
+		}
+	}
+	return p;
+}
+
+Integer CRT(const Integer &xp, const Integer &p, const Integer &xq, const Integer &q, const Integer &u)
+{
+	// isn't operator overloading great?
+	return p * (u * (xq-xp) % q) + xp;
+/*
+	Integer t1 = xq-xp;
+	cout << hex << t1 << endl;
+	Integer t2 = u * t1;
+	cout << hex << t2 << endl;
+	Integer t3 = t2 % q;
+	cout << hex << t3 << endl;
+	Integer t4 = p * t3;
+	cout << hex << t4 << endl;
+	Integer t5 = t4 + xp;
+	cout << hex << t5 << endl;
+	return t5;
+*/
+}
+
+Integer ModularSquareRoot(const Integer &a, const Integer &p)
+{
+	if (p%4 == 3)
+		return a_exp_b_mod_c(a, (p+1)/4, p);
+
+	Integer q=p-1;
+	unsigned int r=0;
+	while (q.IsEven())
+	{
+		r++;
+		q >>= 1;
+	}
+
+	Integer n=2;
+	while (Jacobi(n, p) != -1)
+		++n;
+
+	Integer y = a_exp_b_mod_c(n, q, p);
+	Integer x = a_exp_b_mod_c(a, (q-1)/2, p);
+	Integer b = (x.Squared()%p)*a%p;
+	x = a*x%p;
+	Integer tempb, t;
+
+	while (b != 1)
+	{
+		unsigned m=0;
+		tempb = b;
+		do
+		{
+			m++;
+			b = b.Squared()%p;
+			if (m==r)
+				return Integer::Zero();
+		}
+		while (b != 1);
+
+		t = y;
+		for (unsigned i=0; i<r-m-1; i++)
+			t = t.Squared()%p;
+		y = t.Squared()%p;
+		r = m;
+		x = x*t%p;
+		b = tempb*y%p;
+	}
+
+	CRYPTOPP_ASSERT(x.Squared()%p == a);
+	return x;
+}
+
+bool SolveModularQuadraticEquation(Integer &r1, Integer &r2, const Integer &a, const Integer &b, const Integer &c, const Integer &p)
+{
+	Integer D = (b.Squared() - 4*a*c) % p;
+	switch (Jacobi(D, p))
+	{
+	default:
+		CRYPTOPP_ASSERT(false);	// not reached
+		return false;
+	case -1:
+		return false;
+	case 0:
+		r1 = r2 = (-b*(a+a).InverseMod(p)) % p;
+		CRYPTOPP_ASSERT(((r1.Squared()*a + r1*b + c) % p).IsZero());
+		return true;
+	case 1:
+		Integer s = ModularSquareRoot(D, p);
+		Integer t = (a+a).InverseMod(p);
+		r1 = (s-b)*t % p;
+		r2 = (-s-b)*t % p;
+		CRYPTOPP_ASSERT(((r1.Squared()*a + r1*b + c) % p).IsZero());
+		CRYPTOPP_ASSERT(((r2.Squared()*a + r2*b + c) % p).IsZero());
+		return true;
+	}
+}
+
+Integer ModularRoot(const Integer &a, const Integer &dp, const Integer &dq,
+					const Integer &p, const Integer &q, const Integer &u)
+{
+	// GCC warning bug, https://stackoverflow.com/q/12842306/608639
+#ifdef _OPENMP
+	Integer p2, q2;
+	#pragma omp parallel
+		#pragma omp sections
+		{
+			#pragma omp section
+				p2 = ModularExponentiation((a % p), dp, p);
+			#pragma omp section
+				q2 = ModularExponentiation((a % q), dq, q);
+		}
+#else
+	const Integer p2 = ModularExponentiation((a % p), dp, p);
+	const Integer q2 = ModularExponentiation((a % q), dq, q);
+#endif
+
+	return CRT(p2, p, q2, q, u);
+}
+
+Integer ModularRoot(const Integer &a, const Integer &e,
+					const Integer &p, const Integer &q)
+{
+	Integer dp = EuclideanMultiplicativeInverse(e, p-1);
+	Integer dq = EuclideanMultiplicativeInverse(e, q-1);
+	Integer u = EuclideanMultiplicativeInverse(p, q);
+	CRYPTOPP_ASSERT(!!dp && !!dq && !!u);
+	return ModularRoot(a, dp, dq, p, q, u);
+}
+
+/*
+Integer GCDI(const Integer &x, const Integer &y)
+{
+	Integer a=x, b=y;
+	unsigned k=0;
+
+	CRYPTOPP_ASSERT(!!a && !!b);
+
+	while (a[0]==0 && b[0]==0)
+	{
+		a >>= 1;
+		b >>= 1;
+		k++;
+	}
+
+	while (a[0]==0)
+		a >>= 1;
+
+	while (b[0]==0)
+		b >>= 1;
+
+	while (1)
+	{
+		switch (a.Compare(b))
+		{
+			case -1:
+				b -= a;
+				while (b[0]==0)
+					b >>= 1;
+				break;
+
+			case 0:
+				return (a <<= k);
+
+			case 1:
+				a -= b;
+				while (a[0]==0)
+					a >>= 1;
+				break;
+
+			default:
+				CRYPTOPP_ASSERT(false);
+		}
+	}
+}
+
+Integer EuclideanMultiplicativeInverse(const Integer &a, const Integer &b)
+{
+	CRYPTOPP_ASSERT(b.Positive());
+
+	if (a.Negative())
+		return EuclideanMultiplicativeInverse(a%b, b);
+
+	if (b[0]==0)
+	{
+		if (!b || a[0]==0)
+			return Integer::Zero();       // no inverse
+		if (a==1)
+			return 1;
+		Integer u = EuclideanMultiplicativeInverse(b, a);
+		if (!u)
+			return Integer::Zero();       // no inverse
+		else
+			return (b*(a-u)+1)/a;
+	}
+
+	Integer u=1, d=a, v1=b, v3=b, t1, t3, b2=(b+1)>>1;
+
+	if (a[0])
+	{
+		t1 = Integer::Zero();
+		t3 = -b;
+	}
+	else
+	{
+		t1 = b2;
+		t3 = a>>1;
+	}
+
+	while (!!t3)
+	{
+		while (t3[0]==0)
+		{
+			t3 >>= 1;
+			if (t1[0]==0)
+				t1 >>= 1;
+			else
+			{
+				t1 >>= 1;
+				t1 += b2;
+			}
+		}
+		if (t3.Positive())
+		{
+			u = t1;
+			d = t3;
+		}
+		else
+		{
+			v1 = b-t1;
+			v3 = -t3;
+		}
+		t1 = u-v1;
+		t3 = d-v3;
+		if (t1.Negative())
+			t1 += b;
+	}
+	if (d==1)
+		return u;
+	else
+		return Integer::Zero();   // no inverse
+}
+*/
+
+int Jacobi(const Integer &aIn, const Integer &bIn)
+{
+	CRYPTOPP_ASSERT(bIn.IsOdd());
+
+	Integer b = bIn, a = aIn%bIn;
+	int result = 1;
+
+	while (!!a)
+	{
+		unsigned i=0;
+		while (a.GetBit(i)==0)
+			i++;
+		a>>=i;
+
+		if (i%2==1 && (b%8==3 || b%8==5))
+			result = -result;
+
+		if (a%4==3 && b%4==3)
+			result = -result;
+
+		std::swap(a, b);
+		a %= b;
+	}
+
+	return (b==1) ? result : 0;
+}
+
+Integer Lucas(const Integer &e, const Integer &pIn, const Integer &n)
+{
+	unsigned i = e.BitCount();
+	if (i==0)
+		return Integer::Two();
+
+	MontgomeryRepresentation m(n);
+	Integer p=m.ConvertIn(pIn%n), two=m.ConvertIn(Integer::Two());
+	Integer v=p, v1=m.Subtract(m.Square(p), two);
+
+	i--;
+	while (i--)
+	{
+		if (e.GetBit(i))
+		{
+			// v = (v*v1 - p) % m;
+			v = m.Subtract(m.Multiply(v,v1), p);
+			// v1 = (v1*v1 - 2) % m;
+			v1 = m.Subtract(m.Square(v1), two);
+		}
+		else
+		{
+			// v1 = (v*v1 - p) % m;
+			v1 = m.Subtract(m.Multiply(v,v1), p);
+			// v = (v*v - 2) % m;
+			v = m.Subtract(m.Square(v), two);
+		}
+	}
+	return m.ConvertOut(v);
+}
+
+// This is Peter Montgomery's unpublished Lucas sequence evaluation algorithm.
+// The total number of multiplies and squares used is less than the binary
+// algorithm (see above).  Unfortunately I can't get it to run as fast as
+// the binary algorithm because of the extra overhead.
+/*
+Integer Lucas(const Integer &n, const Integer &P, const Integer &modulus)
+{
+	if (!n)
+		return 2;
+
+#define f(A, B, C)	m.Subtract(m.Multiply(A, B), C)
+#define X2(A) m.Subtract(m.Square(A), two)
+#define X3(A) m.Multiply(A, m.Subtract(m.Square(A), three))
+
+	MontgomeryRepresentation m(modulus);
+	Integer two=m.ConvertIn(2), three=m.ConvertIn(3);
+	Integer A=m.ConvertIn(P), B, C, p, d=n, e, r, t, T, U;
+
+	while (d!=1)
+	{
+		p = d;
+		unsigned int b = WORD_BITS * p.WordCount();
+		Integer alpha = (Integer(5)<<(2*b-2)).SquareRoot() - Integer::Power2(b-1);
+		r = (p*alpha)>>b;
+		e = d-r;
+		B = A;
+		C = two;
+		d = r;
+
+		while (d!=e)
+		{
+			if (d<e)
+			{
+				swap(d, e);
+				swap(A, B);
+			}
+
+			unsigned int dm2 = d[0], em2 = e[0];
+			unsigned int dm3 = d%3, em3 = e%3;
+
+//			if ((dm6+em6)%3 == 0 && d <= e + (e>>2))
+			if ((dm3+em3==0 || dm3+em3==3) && (t = e, t >>= 2, t += e, d <= t))
+			{
+				// #1
+//				t = (d+d-e)/3;
+//				t = d; t += d; t -= e; t /= 3;
+//				e = (e+e-d)/3;
+//				e += e; e -= d; e /= 3;
+//				d = t;
+
+//				t = (d+e)/3
+				t = d; t += e; t /= 3;
+				e -= t;
+				d -= t;
+
+				T = f(A, B, C);
+				U = f(T, A, B);
+				B = f(T, B, A);
+				A = U;
+				continue;
+			}
+
+//			if (dm6 == em6 && d <= e + (e>>2))
+			if (dm3 == em3 && dm2 == em2 && (t = e, t >>= 2, t += e, d <= t))
+			{
+				// #2
+//				d = (d-e)>>1;
+				d -= e; d >>= 1;
+				B = f(A, B, C);
+				A = X2(A);
+				continue;
+			}
+
+//			if (d <= (e<<2))
+			if (d <= (t = e, t <<= 2))
+			{
+				// #3
+				d -= e;
+				C = f(A, B, C);
+				swap(B, C);
+				continue;
+			}
+
+			if (dm2 == em2)
+			{
+				// #4
+//				d = (d-e)>>1;
+				d -= e; d >>= 1;
+				B = f(A, B, C);
+				A = X2(A);
+				continue;
+			}
+
+			if (dm2 == 0)
+			{
+				// #5
+				d >>= 1;
+				C = f(A, C, B);
+				A = X2(A);
+				continue;
+			}
+
+			if (dm3 == 0)
+			{
+				// #6
+//				d = d/3 - e;
+				d /= 3; d -= e;
+				T = X2(A);
+				C = f(T, f(A, B, C), C);
+				swap(B, C);
+				A = f(T, A, A);
+				continue;
+			}
+
+			if (dm3+em3==0 || dm3+em3==3)
+			{
+				// #7
+//				d = (d-e-e)/3;
+				d -= e; d -= e; d /= 3;
+				T = f(A, B, C);
+				B = f(T, A, B);
+				A = X3(A);
+				continue;
+			}
+
+			if (dm3 == em3)
+			{
+				// #8
+//				d = (d-e)/3;
+				d -= e; d /= 3;
+				T = f(A, B, C);
+				C = f(A, C, B);
+				B = T;
+				A = X3(A);
+				continue;
+			}
+
+			CRYPTOPP_ASSERT(em2 == 0);
+			// #9
+			e >>= 1;
+			C = f(C, B, A);
+			B = X2(B);
+		}
+
+		A = f(A, B, C);
+	}
+
+#undef f
+#undef X2
+#undef X3
+
+	return m.ConvertOut(A);
+}
+*/
+
+Integer InverseLucas(const Integer &e, const Integer &m, const Integer &p, const Integer &q, const Integer &u)
+{
+
+	// GCC warning bug, https://stackoverflow.com/q/12842306/608639
+#ifdef _OPENMP
+	Integer d = (m*m-4), p2, q2;
+	#pragma omp parallel
+		#pragma omp sections
+		{
+			#pragma omp section
+			{
+				p2 = p-Jacobi(d,p);
+				p2 = Lucas(EuclideanMultiplicativeInverse(e,p2), m, p);
+			}
+			#pragma omp section
+			{
+				q2 = q-Jacobi(d,q);
+				q2 = Lucas(EuclideanMultiplicativeInverse(e,q2), m, q);
+			}
+		}
+#else
+	const Integer d = (m*m-4);
+	const Integer t1 = p-Jacobi(d,p);
+	const Integer p2 = Lucas(EuclideanMultiplicativeInverse(e,t1), m, p);
+
+	const Integer t2 = q-Jacobi(d,q);
+	const Integer q2 = Lucas(EuclideanMultiplicativeInverse(e,t2), m, q);
+#endif
+
+	return CRT(p2, p, q2, q, u);
+}
+
+unsigned int FactoringWorkFactor(unsigned int n)
+{
+	// extrapolated from the table in Odlyzko's "The Future of Integer Factorization"
+	// updated to reflect the factoring of RSA-130
+	if (n<5) return 0;
+	else return (unsigned int)(2.4 * std::pow((double)n, 1.0/3.0) * std::pow(log(double(n)), 2.0/3.0) - 5);
+}
+
+unsigned int DiscreteLogWorkFactor(unsigned int n)
+{
+	// assuming discrete log takes about the same time as factoring
+	if (n<5) return 0;
+	else return (unsigned int)(2.4 * std::pow((double)n, 1.0/3.0) * std::pow(log(double(n)), 2.0/3.0) - 5);
+}
+
+// ********************************************************
+
+void PrimeAndGenerator::Generate(signed int delta, RandomNumberGenerator &rng, unsigned int pbits, unsigned int qbits)
+{
+	// no prime exists for delta = -1, qbits = 4, and pbits = 5
+	CRYPTOPP_ASSERT(qbits > 4);
+	CRYPTOPP_ASSERT(pbits > qbits);
+
+	if (qbits+1 == pbits)
+	{
+		Integer minP = Integer::Power2(pbits-1);
+		Integer maxP = Integer::Power2(pbits) - 1;
+		bool success = false;
+
+		while (!success)
+		{
+			p.Randomize(rng, minP, maxP, Integer::ANY, 6+5*delta, 12);
+			PrimeSieve sieve(p, STDMIN(p+PrimeSearchInterval(maxP)*12, maxP), 12, delta);
+
+			while (sieve.NextCandidate(p))
+			{
+				CRYPTOPP_ASSERT(IsSmallPrime(p) || SmallDivisorsTest(p));
+				q = (p-delta) >> 1;
+				CRYPTOPP_ASSERT(IsSmallPrime(q) || SmallDivisorsTest(q));
+				if (FastProbablePrimeTest(q) && FastProbablePrimeTest(p) && IsPrime(q) && IsPrime(p))
+				{
+					success = true;
+					break;
+				}
+			}
+		}
+
+		if (delta == 1)
+		{
+			// find g such that g is a quadratic residue mod p, then g has order q
+			// g=4 always works, but this way we get the smallest quadratic residue (other than 1)
+			for (g=2; Jacobi(g, p) != 1; ++g) {}
+			// contributed by Walt Tuvell: g should be the following according to the Law of Quadratic Reciprocity
+			CRYPTOPP_ASSERT((p%8==1 || p%8==7) ? g==2 : (p%12==1 || p%12==11) ? g==3 : g==4);
+		}
+		else
+		{
+			CRYPTOPP_ASSERT(delta == -1);
+			// find g such that g*g-4 is a quadratic non-residue,
+			// and such that g has order q
+			for (g=3; ; ++g)
+				if (Jacobi(g*g-4, p)==-1 && Lucas(q, g, p)==2)
+					break;
+		}
+	}
+	else
+	{
+		Integer minQ = Integer::Power2(qbits-1);
+		Integer maxQ = Integer::Power2(qbits) - 1;
+		Integer minP = Integer::Power2(pbits-1);
+		Integer maxP = Integer::Power2(pbits) - 1;
+
+		do
+		{
+			q.Randomize(rng, minQ, maxQ, Integer::PRIME);
+		} while (!p.Randomize(rng, minP, maxP, Integer::PRIME, delta%q, q));
+
+		// find a random g of order q
+		if (delta==1)
+		{
+			do
+			{
+				Integer h(rng, 2, p-2, Integer::ANY);
+				g = a_exp_b_mod_c(h, (p-1)/q, p);
+			} while (g <= 1);
+			CRYPTOPP_ASSERT(a_exp_b_mod_c(g, q, p)==1);
+		}
+		else
+		{
+			CRYPTOPP_ASSERT(delta==-1);
+			do
+			{
+				Integer h(rng, 3, p-1, Integer::ANY);
+				if (Jacobi(h*h-4, p)==1)
+					continue;
+				g = Lucas((p+1)/q, h, p);
+			} while (g <= 2);
+			CRYPTOPP_ASSERT(Lucas(q, g, p) == 2);
+		}
+	}
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/nbtheory.h b/runtime/third_party/cryptopp/nbtheory.h
new file mode 100644
index 0000000..a494110
--- /dev/null
+++ b/runtime/third_party/cryptopp/nbtheory.h
@@ -0,0 +1,320 @@
+// nbtheory.h - originally written and placed in the public domain by Wei Dai
+
+/// \file nbtheory.h
+/// \brief Classes and functions  for number theoretic operations
+
+#ifndef CRYPTOPP_NBTHEORY_H
+#define CRYPTOPP_NBTHEORY_H
+
+#include "cryptlib.h"
+#include "integer.h"
+#include "algparam.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief The Small Prime table
+/// \param size number of elements in the table
+/// \return prime table with /p size elements
+/// \details GetPrimeTable() obtains pointer to small prime table and provides the size of the table.
+///  /p size is an out parameter.
+CRYPTOPP_DLL const word16 * CRYPTOPP_API GetPrimeTable(unsigned int &size);
+
+// ************ primality testing ****************
+
+/// \brief Generates a provable prime
+/// \param rng a RandomNumberGenerator to produce random material
+/// \param bits the number of bits in the prime number
+/// \return Integer() meeting Maurer's tests for primality
+CRYPTOPP_DLL Integer CRYPTOPP_API MaurerProvablePrime(RandomNumberGenerator &rng, unsigned int bits);
+
+/// \brief Generates a provable prime
+/// \param rng a RandomNumberGenerator to produce random material
+/// \param bits the number of bits in the prime number
+/// \return Integer() meeting Mihailescu's tests for primality
+/// \details Mihailescu's methods performs a search using algorithmic progressions.
+CRYPTOPP_DLL Integer CRYPTOPP_API MihailescuProvablePrime(RandomNumberGenerator &rng, unsigned int bits);
+
+/// \brief Tests whether a number is a small prime
+/// \param p a candidate prime to test
+/// \return true if p is a small prime, false otherwise
+/// \details Internally, the library maintains a table of the first 32719 prime numbers
+///   in sorted order. IsSmallPrime searches the table and returns true if p is
+///   in the table.
+CRYPTOPP_DLL bool CRYPTOPP_API IsSmallPrime(const Integer &p);
+
+/// \brief Tests whether a number is divisible by a small prime
+/// \return true if p is divisible by some prime less than bound.
+/// \details TrialDivision() returns <tt>true</tt> if <tt>p</tt> is divisible by some prime less
+///   than <tt>bound</tt>. <tt>bound</tt> should not be greater than the largest entry in the
+///   prime table, which is 32719.
+CRYPTOPP_DLL bool CRYPTOPP_API TrialDivision(const Integer &p, unsigned bound);
+
+/// \brief Tests whether a number is divisible by a small prime
+/// \return true if p is NOT divisible by small primes.
+/// \details SmallDivisorsTest() returns <tt>true</tt> if <tt>p</tt> is NOT divisible by some
+///   prime less than 32719.
+CRYPTOPP_DLL bool CRYPTOPP_API SmallDivisorsTest(const Integer &p);
+
+/// \brief Determine if a number is probably prime
+/// \param n the number to test
+/// \param b the base to exponentiate
+/// \return true if the number n is probably prime, false otherwise.
+/// \details IsFermatProbablePrime raises <tt>b</tt> to the <tt>n-1</tt> power and checks if
+///   the result is congruent to 1 modulo <tt>n</tt>.
+/// \details These is no reason to use IsFermatProbablePrime, use IsStrongProbablePrime or
+///   IsStrongLucasProbablePrime instead.
+/// \sa IsStrongProbablePrime, IsStrongLucasProbablePrime
+CRYPTOPP_DLL bool CRYPTOPP_API IsFermatProbablePrime(const Integer &n, const Integer &b);
+
+/// \brief Determine if a number is probably prime
+/// \param n the number to test
+/// \return true if the number n is probably prime, false otherwise.
+/// \details These is no reason to use IsLucasProbablePrime, use IsStrongProbablePrime or
+///   IsStrongLucasProbablePrime instead.
+/// \sa IsStrongProbablePrime, IsStrongLucasProbablePrime
+CRYPTOPP_DLL bool CRYPTOPP_API IsLucasProbablePrime(const Integer &n);
+
+/// \brief Determine if a number is probably prime
+/// \param n the number to test
+/// \param b the base to exponentiate
+/// \return true if the number n is probably prime, false otherwise.
+CRYPTOPP_DLL bool CRYPTOPP_API IsStrongProbablePrime(const Integer &n, const Integer &b);
+
+/// \brief Determine if a number is probably prime
+/// \param n the number to test
+/// \return true if the number n is probably prime, false otherwise.
+CRYPTOPP_DLL bool CRYPTOPP_API IsStrongLucasProbablePrime(const Integer &n);
+
+/// \brief Determine if a number is probably prime
+/// \param rng a RandomNumberGenerator to produce random material
+/// \param n the number to test
+/// \param rounds the number of tests to perform
+/// \details This is the Rabin-Miller primality test, i.e. repeating the strong probable prime
+///   test for several rounds with random bases
+/// \sa <A HREF="https://crypto.stackexchange.com/q/17707/10496">Trial divisions before
+///   Miller-Rabin checks?</A> on Crypto Stack Exchange
+CRYPTOPP_DLL bool CRYPTOPP_API RabinMillerTest(RandomNumberGenerator &rng, const Integer &n, unsigned int rounds);
+
+/// \brief Verifies a number is probably prime
+/// \param p a candidate prime to test
+/// \return true if p is a probable prime, false otherwise
+/// \details IsPrime() is suitable for testing candidate primes when creating them. Internally,
+///   IsPrime() utilizes SmallDivisorsTest(), IsStrongProbablePrime() and IsStrongLucasProbablePrime().
+CRYPTOPP_DLL bool CRYPTOPP_API IsPrime(const Integer &p);
+
+/// \brief Verifies a number is probably prime
+/// \param rng a RandomNumberGenerator for randomized testing
+/// \param p a candidate prime to test
+/// \param level the level of thoroughness of testing
+/// \return true if p is a strong probable prime, false otherwise
+/// \details VerifyPrime() is suitable for testing candidate primes created by others. Internally,
+///   VerifyPrime() utilizes IsPrime() and one-round RabinMillerTest(). If the candidate passes and
+///   level is greater than 1, then 10 round RabinMillerTest() primality testing is performed.
+CRYPTOPP_DLL bool CRYPTOPP_API VerifyPrime(RandomNumberGenerator &rng, const Integer &p, unsigned int level = 1);
+
+/// \brief Application callback to signal suitability of a cabdidate prime
+class CRYPTOPP_DLL PrimeSelector
+{
+public:
+	virtual ~PrimeSelector() {}
+	const PrimeSelector *GetSelectorPointer() const {return this;}
+	virtual bool IsAcceptable(const Integer &candidate) const =0;
+};
+
+/// \brief Finds a random prime of special form
+/// \param p an Integer reference to receive the prime
+/// \param max the maximum value
+/// \param equiv the equivalence class based on the parameter mod
+/// \param mod the modulus used to reduce the equivalence class
+/// \param pSelector pointer to a PrimeSelector function for the application to signal suitability
+/// \return true if and only if FirstPrime() finds a prime and returns the prime through p. If FirstPrime()
+///   returns false, then no such prime exists and the value of p is undefined
+/// \details FirstPrime() uses a fast sieve to find the first probable prime
+///   in <tt>{x | p<=x<=max and x%mod==equiv}</tt>
+CRYPTOPP_DLL bool CRYPTOPP_API FirstPrime(Integer &p, const Integer &max, const Integer &equiv, const Integer &mod, const PrimeSelector *pSelector);
+
+CRYPTOPP_DLL unsigned int CRYPTOPP_API PrimeSearchInterval(const Integer &max);
+
+CRYPTOPP_DLL AlgorithmParameters CRYPTOPP_API MakeParametersForTwoPrimesOfEqualSize(unsigned int productBitLength);
+
+// ********** other number theoretic functions ************
+
+/// \brief Calculate the greatest common divisor
+/// \param a the first term
+/// \param b the second term
+/// \return the greatest common divisor if one exists, 0 otherwise.
+inline Integer GCD(const Integer &a, const Integer &b)
+	{return Integer::Gcd(a,b);}
+
+/// \brief Determine relative primality
+/// \param a the first term
+/// \param b the second term
+/// \return true if <tt>a</tt> and <tt>b</tt> are relatively prime, false otherwise.
+inline bool RelativelyPrime(const Integer &a, const Integer &b)
+	{return Integer::Gcd(a,b) == Integer::One();}
+
+/// \brief Calculate the least common multiple
+/// \param a the first term
+/// \param b the second term
+/// \return the least common multiple of <tt>a</tt> and <tt>b</tt>.
+inline Integer LCM(const Integer &a, const Integer &b)
+	{return a/Integer::Gcd(a,b)*b;}
+
+/// \brief Calculate multiplicative inverse
+/// \param a the number to test
+/// \param b the modulus
+/// \return an Integer <tt>(a ^ -1) % n</tt> or 0 if none exists.
+/// \details EuclideanMultiplicativeInverse returns the multiplicative inverse of the Integer
+///   <tt>*a</tt> modulo the Integer <tt>b</tt>. If no Integer exists then Integer 0 is returned.
+inline Integer EuclideanMultiplicativeInverse(const Integer &a, const Integer &b)
+	{return a.InverseMod(b);}
+
+
+/// \brief Chinese Remainder Theorem
+/// \param xp the first number, mod p
+/// \param p the first prime modulus
+/// \param xq the second number, mod q
+/// \param q the second prime modulus
+/// \param u inverse of p mod q
+/// \return the CRT value of the parameters
+/// \details CRT uses the Chinese Remainder Theorem to calculate <tt>x</tt> given
+///   <tt>x mod p</tt> and <tt>x mod q</tt>, and <tt>u</tt> the inverse of <tt>p mod q</tt>.
+CRYPTOPP_DLL Integer CRYPTOPP_API CRT(const Integer &xp, const Integer &p, const Integer &xq, const Integer &q, const Integer &u);
+
+/// \brief Calculate the Jacobi symbol
+/// \param a the first term
+/// \param b the second term
+/// \return the Jacobi symbol.
+/// \details Jacobi symbols are calculated using the following rules:
+///  -# if <tt>b</tt> is prime, then <tt>Jacobi(a, b)</tt>, then return 0
+///  -# if <tt>a%b</tt>==0 AND <tt>a</tt> is quadratic residue <tt>mod b</tt>, then return 1
+///  -# return -1 otherwise
+/// \details Refer to a number theory book for what Jacobi symbol means when <tt>b</tt> is not prime.
+CRYPTOPP_DLL int CRYPTOPP_API Jacobi(const Integer &a, const Integer &b);
+
+/// \brief Calculate the Lucas value
+/// \return the Lucas value
+/// \details Lucas() calculates the Lucas function <tt>V_e(p, 1) mod n</tt>.
+CRYPTOPP_DLL Integer CRYPTOPP_API Lucas(const Integer &e, const Integer &p, const Integer &n);
+
+/// \brief Calculate the inverse Lucas value
+/// \return the inverse Lucas value
+/// \details InverseLucas() calculates <tt>x</tt> such that <tt>m==Lucas(e, x, p*q)</tt>,
+///   <tt>p q</tt> primes, <tt>u</tt> is inverse of <tt>p mod q</tt>.
+CRYPTOPP_DLL Integer CRYPTOPP_API InverseLucas(const Integer &e, const Integer &m, const Integer &p, const Integer &q, const Integer &u);
+
+/// \brief Modular multiplication
+/// \param x the first term
+/// \param y the second term
+/// \param m the modulus
+/// \return an Integer <tt>(x * y) % m</tt>.
+inline Integer ModularMultiplication(const Integer &x, const Integer &y, const Integer &m)
+	{return a_times_b_mod_c(x, y, m);}
+
+/// \brief Modular exponentiation
+/// \param x the base
+/// \param e the exponent
+/// \param m the modulus
+/// \return an Integer <tt>(a ^ b) % m</tt>.
+inline Integer ModularExponentiation(const Integer &x, const Integer &e, const Integer &m)
+	{return a_exp_b_mod_c(x, e, m);}
+
+/// \brief Extract a modular square root
+/// \param a the number to extract square root
+/// \param p the prime modulus
+/// \return the modular square root if it exists
+/// \details ModularSquareRoot returns <tt>x</tt> such that <tt>x*x%p == a</tt>, <tt>p</tt> prime
+CRYPTOPP_DLL Integer CRYPTOPP_API ModularSquareRoot(const Integer &a, const Integer &p);
+
+/// \brief Extract a modular root
+/// \return a modular root if it exists
+/// \details ModularRoot returns <tt>x</tt> such that <tt>a==ModularExponentiation(x, e, p*q)</tt>,
+///   <tt>p</tt> <tt>q</tt> primes, and <tt>e</tt> relatively prime to <tt>(p-1)*(q-1)</tt>,
+///   <tt>dp=d%(p-1)</tt>, <tt>dq=d%(q-1)</tt>, (d is inverse of <tt>e mod (p-1)*(q-1)</tt>)
+///   and <tt>u=inverse of p mod q</tt>.
+CRYPTOPP_DLL Integer CRYPTOPP_API ModularRoot(const Integer &a, const Integer &dp, const Integer &dq, const Integer &p, const Integer &q, const Integer &u);
+
+/// \brief Solve a Modular Quadratic Equation
+/// \param r1 the first residue
+/// \param r2 the second residue
+/// \param a the first coefficient
+/// \param b the second coefficient
+/// \param c the third constant
+/// \param p the prime modulus
+/// \return true if solutions exist
+/// \details SolveModularQuadraticEquation() finds <tt>r1</tt> and <tt>r2</tt> such that <tt>ax^2 +
+///   bx + c == 0 (mod p)</tt> for x in <tt>{r1, r2}</tt>, <tt>p</tt> prime.
+CRYPTOPP_DLL bool CRYPTOPP_API SolveModularQuadraticEquation(Integer &r1, Integer &r2, const Integer &a, const Integer &b, const Integer &c, const Integer &p);
+
+/// \brief Estimate work factor
+/// \param bitlength the size of the number, in bits
+/// \return the estimated work factor, in operations
+/// \details DiscreteLogWorkFactor returns log base 2 of estimated number of operations to
+///   calculate discrete log or factor a number.
+CRYPTOPP_DLL unsigned int CRYPTOPP_API DiscreteLogWorkFactor(unsigned int bitlength);
+
+/// \brief Estimate work factor
+/// \param bitlength the size of the number, in bits
+/// \return the estimated work factor, in operations
+/// \details FactoringWorkFactor returns log base 2 of estimated number of operations to
+///   calculate discrete log or factor a number.
+CRYPTOPP_DLL unsigned int CRYPTOPP_API FactoringWorkFactor(unsigned int bitlength);
+
+// ********************************************************
+
+/// \brief Generator of prime numbers of special forms
+class CRYPTOPP_DLL PrimeAndGenerator
+{
+public:
+	/// \brief Construct a PrimeAndGenerator
+	PrimeAndGenerator() {}
+
+	/// \brief Construct a PrimeAndGenerator
+	/// \param delta +1 or -1
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param pbits the number of bits in the prime p
+	/// \details PrimeAndGenerator() generates a random prime p of the form <tt>2*q+delta</tt>, where delta is 1 or -1 and q is
+	///   also prime. Internally the constructor calls <tt>Generate(delta, rng, pbits, pbits-1)</tt>.
+	/// \pre <tt>pbits > 5</tt>
+	/// \warning This PrimeAndGenerator() is slow because primes of this form are harder to find.
+	PrimeAndGenerator(signed int delta, RandomNumberGenerator &rng, unsigned int pbits)
+		{Generate(delta, rng, pbits, pbits-1);}
+
+	/// \brief Construct a PrimeAndGenerator
+	/// \param delta +1 or -1
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param pbits the number of bits in the prime p
+	/// \param qbits the number of bits in the prime q
+	/// \details PrimeAndGenerator() generates a random prime p of the form <tt>2*r*q+delta</tt>, where q is also prime.
+	///    Internally the constructor calls <tt>Generate(delta, rng, pbits, qbits)</tt>.
+	/// \pre <tt>qbits > 4 && pbits > qbits</tt>
+	PrimeAndGenerator(signed int delta, RandomNumberGenerator &rng, unsigned int pbits, unsigned qbits)
+		{Generate(delta, rng, pbits, qbits);}
+
+	/// \brief Generate a Prime and Generator
+	/// \param delta +1 or -1
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param pbits the number of bits in the prime p
+	/// \param qbits the number of bits in the prime q
+	/// \details Generate() generates a random prime p of the form <tt>2*r*q+delta</tt>, where q is also prime.
+	void Generate(signed int delta, RandomNumberGenerator &rng, unsigned int pbits, unsigned qbits);
+
+	/// \brief Retrieve first prime
+	/// \return Prime() returns the prime p.
+	const Integer& Prime() const {return p;}
+
+	/// \brief Retrieve second prime
+	/// \return SubPrime() returns the prime q.
+	const Integer& SubPrime() const {return q;}
+
+	/// \brief Retrieve the generator
+	/// \return Generator() returns the generator g.
+	const Integer& Generator() const {return g;}
+
+private:
+	Integer p, q, g;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/neon_simd.cpp b/runtime/third_party/cryptopp/neon_simd.cpp
new file mode 100644
index 0000000..e2d3321
--- /dev/null
+++ b/runtime/third_party/cryptopp/neon_simd.cpp
@@ -0,0 +1,197 @@
+
+// crc_simd.cpp - written and placed in the public domain by
+//                Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//
+//    This source file uses intrinsics to gain access to ARMv7a and
+//    ARMv8a NEON instructions. A separate source file is needed
+//    because additional CXXFLAGS are required to enable the
+//    appropriate instructions sets in some build configurations.
+//    For Linux and Unix additional flags are not required.
+
+#include "pch.h"
+#include "config.h"
+#include "stdcpp.h"
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include <arm_neon.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#ifndef EXCEPTION_EXECUTE_HANDLER
+# define EXCEPTION_EXECUTE_HANDLER 1
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char NEON_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+
+    static jmp_buf s_jmpSIGILL;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpSIGILL, 1);
+    }
+}
+#endif  // Not CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
+
+bool CPU_ProbeARMv7()
+{
+#if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+    return false;
+#elif defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif CRYPTOPP_ARM_NEON_AVAILABLE
+# if defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+    volatile bool result = true;
+    __try
+    {
+        // Modern MS hardware is ARMv7
+        result = true;
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        return false;
+    }
+    return result;
+# else
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile bool result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+
+#if 0
+        // ARMv7 added movt and movw
+        int a;
+        asm volatile("movw %0,%1 \n"
+                     "movt %0,%1 \n"
+                     : "=r"(a) : "i"(0x1234));
+
+00000010 <_Z5test2v>:  // ARM
+  10:   e3010234        movw    r0, #4660       ; 0x1234
+  14:   e3410234        movt    r0, #4660       ; 0x1234
+  18:   e12fff1e        bx      lr
+
+0000001c <_Z5test3v>:  // Thumb
+  1c:   f241 2034       movw    r0, #4660       ; 0x1234
+  20:   f2c1 2034       movt    r0, #4660       ; 0x1234
+  24:   e12fff1e        bx      lr
+#endif
+
+        unsigned int a;
+        asm volatile (
+#if defined(__thumb__)
+            ".inst.n 0xf241, 0x2034  \n\t"   // movw r0, 0x1234
+            ".inst.n 0xf2c1, 0x2034  \n\t"   // movt r0, 0x1234
+            "mov %0, r0              \n\t"   // mov [a], r0
+#else
+            ".inst 0xe3010234  \n\t"   // movw r0, 0x1234
+            ".inst 0xe3410234  \n\t"   // movt r0, 0x1234
+            "mov %0, r0        \n\t"   // mov [a], r0
+#endif
+            : "=r" (a) : : "r0");
+
+        result = (a == 0x12341234);
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+}
+
+bool CPU_ProbeNEON()
+{
+#if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+    return true;
+#elif defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif CRYPTOPP_ARM_NEON_AVAILABLE
+# if defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+    volatile bool result = true;
+    __try
+    {
+        uint32x4_t x = vdupq_n_u32(1);
+        uint32x4_t y = vshlq_n_u32(x, 4);
+
+        word32 z[4]; vst1q_u32(z, y);
+        return (z[0] & z[1] & z[2] & z[3]) == 16;
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        return false;
+    }
+    return result;
+# else
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile bool result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // This is risky... When we hand encode the instructions
+        // for vmov.u32 and vshl.u32 we get a SIGILL. Apparently
+        // we need more than just the instructions. Using
+        // intrinsics introduces the risk because the whole
+        // file gets built with ISA options, and the higher ISA
+        // may escape the try block with the SIGILL guard.
+        uint32x4_t x = vdupq_n_u32(1);
+        uint32x4_t y = vshlq_n_u32(x, 4);
+
+        word32 z[4]; vst1q_u32(z, y);
+        result = (z[0] & z[1] & z[2] & z[3]) == 16;
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/nr.h b/runtime/third_party/cryptopp/nr.h
new file mode 100644
index 0000000..21558be
--- /dev/null
+++ b/runtime/third_party/cryptopp/nr.h
@@ -0,0 +1,11 @@
+// nr.h - originally written and placed in the public domain by Wei Dai
+
+/// \file nr.h
+/// \brief Classes for Nyberg-Rueppel signature scheme
+
+#ifndef CRYPTOPP_NR_H
+#define CRYPTOPP_NR_H
+
+#include "gfpcrypt.h"
+
+#endif
diff --git a/runtime/third_party/cryptopp/oaep.cpp b/runtime/third_party/cryptopp/oaep.cpp
new file mode 100644
index 0000000..f491cc2
--- /dev/null
+++ b/runtime/third_party/cryptopp/oaep.cpp
@@ -0,0 +1,98 @@
+// oaep.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "oaep.h"
+#include "stdcpp.h"
+#include "smartptr.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ********************************************************
+
+size_t OAEP_Base::MaxUnpaddedLength(size_t paddedLength) const
+{
+	return SaturatingSubtract(paddedLength/8, 1+2*DigestSize());
+}
+
+void OAEP_Base::Pad(RandomNumberGenerator &rng, const byte *input, size_t inputLength, byte *oaepBlock, size_t oaepBlockLen, const NameValuePairs &parameters) const
+{
+	CRYPTOPP_ASSERT (inputLength <= MaxUnpaddedLength(oaepBlockLen));
+
+	// convert from bit length to byte length
+	if (oaepBlockLen % 8 != 0)
+	{
+		oaepBlock[0] = 0;
+		oaepBlock++;
+	}
+	oaepBlockLen /= 8;
+
+	member_ptr<HashTransformation> pHash(NewHash());
+	const size_t hLen = pHash->DigestSize();
+	const size_t seedLen = hLen, dbLen = oaepBlockLen-seedLen;
+	byte *const maskedSeed = oaepBlock;
+	byte *const maskedDB = oaepBlock+seedLen;
+
+	ConstByteArrayParameter encodingParameters;
+	parameters.GetValue(Name::EncodingParameters(), encodingParameters);
+
+	// DB = pHash || 00 ... || 01 || M
+	pHash->CalculateDigest(maskedDB, encodingParameters.begin(), encodingParameters.size());
+	std::memset(maskedDB+hLen, 0, dbLen-hLen-inputLength-1);
+	maskedDB[dbLen-inputLength-1] = 0x01;
+	std::memcpy(maskedDB+dbLen-inputLength, input, inputLength);
+
+	rng.GenerateBlock(maskedSeed, seedLen);
+	member_ptr<MaskGeneratingFunction> pMGF(NewMGF());
+	pMGF->GenerateAndMask(*pHash, maskedDB, dbLen, maskedSeed, seedLen);
+	pMGF->GenerateAndMask(*pHash, maskedSeed, seedLen, maskedDB, dbLen);
+}
+
+DecodingResult OAEP_Base::Unpad(const byte *oaepBlock, size_t oaepBlockLen, byte *output, const NameValuePairs &parameters) const
+{
+	bool invalid = false;
+
+	// convert from bit length to byte length
+	if (oaepBlockLen % 8 != 0)
+	{
+		invalid = (oaepBlock[0] != 0) || invalid;
+		oaepBlock++;
+	}
+	oaepBlockLen /= 8;
+
+	member_ptr<HashTransformation> pHash(NewHash());
+	const size_t hLen = pHash->DigestSize();
+	const size_t seedLen = hLen, dbLen = oaepBlockLen-seedLen;
+
+	invalid = (oaepBlockLen < 2*hLen+1) || invalid;
+
+	SecByteBlock t(oaepBlock, oaepBlockLen);
+	byte *const maskedSeed = t;
+	byte *const maskedDB = t+seedLen;
+
+	member_ptr<MaskGeneratingFunction> pMGF(NewMGF());
+	pMGF->GenerateAndMask(*pHash, maskedSeed, seedLen, maskedDB, dbLen);
+	pMGF->GenerateAndMask(*pHash, maskedDB, dbLen, maskedSeed, seedLen);
+
+	ConstByteArrayParameter encodingParameters;
+	parameters.GetValue(Name::EncodingParameters(), encodingParameters);
+
+	// DB = pHash' || 00 ... || 01 || M
+	byte *M = std::find(maskedDB+hLen, maskedDB+dbLen, 0x01);
+	invalid = (M == maskedDB+dbLen) || invalid;
+	invalid = (FindIfNot(maskedDB+hLen, M, byte(0)) != M) || invalid;
+	invalid = !pHash->VerifyDigest(maskedDB, encodingParameters.begin(), encodingParameters.size()) || invalid;
+
+	if (invalid)
+		return DecodingResult();
+
+	M++;
+	std::memcpy(output, M, maskedDB+dbLen-M);
+	return DecodingResult(maskedDB+dbLen-M);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/oaep.h b/runtime/third_party/cryptopp/oaep.h
new file mode 100644
index 0000000..a709e2a
--- /dev/null
+++ b/runtime/third_party/cryptopp/oaep.h
@@ -0,0 +1,54 @@
+// oaep.h - originally written and placed in the public domain by Wei Dai
+
+/// \file oaep.h
+/// \brief Classes for optimal asymmetric encryption padding
+/// \since Crypto++ 2.1
+
+#ifndef CRYPTOPP_OAEP_H
+#define CRYPTOPP_OAEP_H
+
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "sha.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief OAEP padding base class
+/// \since Crypto++ 2.1
+class CRYPTOPP_DLL OAEP_Base : public PK_EncryptionMessageEncodingMethod
+{
+public:
+	bool ParameterSupported(const char *name) const {return strcmp(name, Name::EncodingParameters()) == 0;}
+	size_t MaxUnpaddedLength(size_t paddedLength) const;
+	void Pad(RandomNumberGenerator &rng, const byte *raw, size_t inputLength, byte *padded, size_t paddedLength, const NameValuePairs &parameters) const;
+	DecodingResult Unpad(const byte *padded, size_t paddedLength, byte *raw, const NameValuePairs &parameters) const;
+
+protected:
+	virtual unsigned int DigestSize() const =0;
+	virtual HashTransformation * NewHash() const =0;
+	virtual MaskGeneratingFunction * NewMGF() const =0;
+};
+
+/// \brief OAEP padding
+/// \tparam H HashTransformation derived class
+/// \tparam MGF MaskGeneratingFunction derived class
+/// \sa <a href="http://www.weidai.com/scan-mirror/ca.html#cem_OAEP-MGF1">EME-OAEP</a>, for use with classes derived from TF_ES
+/// \since Crypto++ 2.1
+template <class H, class MGF=P1363_MGF1>
+class OAEP : public OAEP_Base, public EncryptionStandard
+{
+public:
+	static std::string CRYPTOPP_API StaticAlgorithmName() {return std::string("OAEP-") + MGF::StaticAlgorithmName() + "(" + H::StaticAlgorithmName() + ")";}
+	typedef OAEP<H, MGF> EncryptionMessageEncodingMethod;
+
+protected:
+	unsigned int DigestSize() const {return H::DIGESTSIZE;}
+	HashTransformation * NewHash() const {return new H;}
+	MaskGeneratingFunction * NewMGF() const {return new MGF;}
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS OAEP<SHA1>;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/oids.h b/runtime/third_party/cryptopp/oids.h
new file mode 100644
index 0000000..936f68b
--- /dev/null
+++ b/runtime/third_party/cryptopp/oids.h
@@ -0,0 +1,197 @@
+// oids.h - originally written and placed in the public domain by Wei Dai
+
+/// \file oids.h
+/// \brief ASN.1 object identifiers for algorithms and schemes
+/// \details Most OIDs can be found at http://www.oid-info.com/. The Chinese OIDs
+///   are assigned in GM/T 0006-2012, Cryptographic Application Identifier Criterion
+///   Specification. A reproduction can be found at http://gmssl.org/docs/oid.html.
+///   There seems to be some confusion between the text of GmSSL's oid.html web page
+///   and the actual OID used in the code. We used the same OIDs that were detailed in
+///   http://github.com/guanzhi/GmSSL/blob/master/crypto/objects/objects.txt.
+
+#ifndef CRYPTOPP_OIDS_H
+#define CRYPTOPP_OIDS_H
+
+#include "asn.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+NAMESPACE_BEGIN(ASN1)
+
+#define DEFINE_OID(value, name)	inline OID name() {return value;}
+
+DEFINE_OID(1, iso)
+	DEFINE_OID(iso()+2, member_body)
+		DEFINE_OID(member_body()+156, iso_cn)
+			DEFINE_OID(iso_cn()+10197, oscca)
+				DEFINE_OID(oscca()+1, sm_scheme)
+					DEFINE_OID(sm_scheme()+104, sms4)
+					DEFINE_OID(sm_scheme()+301, sm2p256v1)
+						DEFINE_OID(sm2p256v1()+1, sm2sign)
+						DEFINE_OID(sm2p256v1()+2, sm2exchange)
+						DEFINE_OID(sm2p256v1()+3, sm2encrypt)
+							DEFINE_OID(sm2encrypt()+1, sm2encrypt_recommendedParameters)
+							DEFINE_OID(sm2encrypt()+2, sm2encrypt_specifiedParameters)
+		DEFINE_OID(member_body()+840, iso_us)
+			DEFINE_OID(iso_us()+10040, ansi_x9_57)
+				DEFINE_OID(ansi_x9_57()+4, ansi_x9cm)
+					DEFINE_OID(ansi_x9cm()+1, id_dsa)
+			DEFINE_OID(iso_us()+10045, ansi_x9_62)
+				DEFINE_OID(ansi_x9_62()+1, id_fieldType)
+					DEFINE_OID(id_fieldType()+1, prime_field)
+					DEFINE_OID(id_fieldType()+2, characteristic_two_field)
+						DEFINE_OID(characteristic_two_field()+3, id_characteristic_two_basis)
+							DEFINE_OID(id_characteristic_two_basis()+1, gnBasis)
+							DEFINE_OID(id_characteristic_two_basis()+2, tpBasis)
+							DEFINE_OID(id_characteristic_two_basis()+3, ppBasis)
+				DEFINE_OID(ansi_x9_62()+2, id_publicKeyType)
+					DEFINE_OID(id_publicKeyType()+1, id_ecPublicKey)
+				DEFINE_OID(ansi_x9_62()+3, ansi_x9_62_curves)
+					DEFINE_OID(ansi_x9_62_curves()+1, ansi_x9_62_curves_prime)
+						// ANSI X9.62
+						DEFINE_OID(ansi_x9_62_curves_prime()+1, secp192r1)  // secp192v1
+						//DEFINE_OID(ansi_x9_62_curves_prime()+2, secp192v2)
+						//DEFINE_OID(ansi_x9_62_curves_prime()+3, secp192v3)
+						//DEFINE_OID(ansi_x9_62_curves_prime()+4, secp239v1)
+						//DEFINE_OID(ansi_x9_62_curves_prime()+5, secp239v2)
+						//DEFINE_OID(ansi_x9_62_curves_prime()+6, secp239v3)
+						DEFINE_OID(ansi_x9_62_curves_prime()+7, secp256r1)  // secp256v1
+				DEFINE_OID(ansi_x9_62()+4, ansi_signatures)
+						DEFINE_OID(ansi_signatures()+3, ecdsa_with_sha2)
+							DEFINE_OID(ecdsa_with_sha2()+1, ecdsa_with_sha224)
+							DEFINE_OID(ecdsa_with_sha2()+2, ecdsa_with_sha256)
+							DEFINE_OID(ecdsa_with_sha2()+3, ecdsa_with_sha384)
+							DEFINE_OID(ecdsa_with_sha2()+4, ecdsa_with_sha512)
+			DEFINE_OID(iso_us()+113549, rsadsi)
+				DEFINE_OID(rsadsi()+1, pkcs)
+					DEFINE_OID(pkcs()+1, pkcs_1)
+						// Arc from PKCS #1 and RFC 2459
+						DEFINE_OID(pkcs_1()+1, rsaEncryption)
+						DEFINE_OID(pkcs_1()+2, md2WithRSAEncryption)
+						DEFINE_OID(pkcs_1()+3, md4withRSAEncryption)
+						DEFINE_OID(pkcs_1()+4, md5WithRSAEncryption)
+						DEFINE_OID(pkcs_1()+5, sha1WithRSAEncryption)
+						DEFINE_OID(pkcs_1()+10, rsassa_pss)
+						DEFINE_OID(pkcs_1()+11, sha256WithRSAEncryption)
+						DEFINE_OID(pkcs_1()+12, sha384WithRSAEncryption)
+						DEFINE_OID(pkcs_1()+13, sha512WithRSAEncryption)
+						DEFINE_OID(pkcs_1()+14, sha224WithRSAEncryption)
+						DEFINE_OID(pkcs_1()+15, sha512_224WithRSAEncryption)
+						DEFINE_OID(pkcs_1()+16, sha512_256WithRSAEncryption)
+				DEFINE_OID(rsadsi()+2, rsadsi_digestAlgorithm)
+					DEFINE_OID(rsadsi_digestAlgorithm()+2, id_md2)
+					DEFINE_OID(rsadsi_digestAlgorithm()+5, id_md5)
+	DEFINE_OID(iso()+3, identified_organization)
+		// Arc from http://tools.ietf.org/html/draft-josefsson-pkix-newcurves
+		// GNU and OpenPGP uses 1.3.6.1.4.1.11591.15.1 for Ed25519. See
+		// https://www.gnu.org/prep/standards/html_node/OID-Allocations.html,
+		// https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-rfc4880bis
+		DEFINE_OID(identified_organization()+6, dod)
+			DEFINE_OID(dod()+1, internet)
+				DEFINE_OID(internet()+4, internet_private)
+					DEFINE_OID(internet_private()+1, enterprise)
+						DEFINE_OID(enterprise()+11591,gnu)
+							DEFINE_OID(gnu()+15,ellipticCurve)
+								DEFINE_OID(ellipticCurve()+1,curve25519)
+								DEFINE_OID(ellipticCurve()+2,curve448)
+								DEFINE_OID(ellipticCurve()+3,curve25519ph)
+								DEFINE_OID(ellipticCurve()+4,curve448ph)
+		DEFINE_OID(identified_organization()+14, oiw)
+			DEFINE_OID(oiw()+3, oiw_secsig)
+				DEFINE_OID(oiw_secsig()+2, oiw_secsig_algorithms)
+					DEFINE_OID(oiw_secsig_algorithms()+26, id_sha1)
+			DEFINE_OID(oiw()+7, dssig)
+				DEFINE_OID(dssig()+2, algorithm)
+					DEFINE_OID(algorithm()+1, encryptionAlgorithm)
+						DEFINE_OID(encryptionAlgorithm()+1, elGamal)
+		DEFINE_OID(identified_organization()+36, teletrust)
+			DEFINE_OID(teletrust()+3, teletrust_algorithm)
+				DEFINE_OID(teletrust_algorithm()+2+1, id_ripemd160)
+				DEFINE_OID(teletrust_algorithm()+3+2+8+1, teletrust_ellipticCurve)
+					DEFINE_OID(teletrust_ellipticCurve()+1+1, brainpoolP160r1)
+					DEFINE_OID(teletrust_ellipticCurve()+1+3, brainpoolP192r1)
+					DEFINE_OID(teletrust_ellipticCurve()+1+5, brainpoolP224r1)
+					DEFINE_OID(teletrust_ellipticCurve()+1+7, brainpoolP256r1)
+					DEFINE_OID(teletrust_ellipticCurve()+1+9, brainpoolP320r1)
+					DEFINE_OID(teletrust_ellipticCurve()+1+11, brainpoolP384r1)
+					DEFINE_OID(teletrust_ellipticCurve()+1+13, brainpoolP512r1)
+		// https://tools.ietf.org/html/draft-ietf-curdle-pkix-07
+		DEFINE_OID(identified_organization()+101, thawte)
+			DEFINE_OID(thawte()+110, X25519)
+			DEFINE_OID(thawte()+111, X448)
+			DEFINE_OID(thawte()+112, Ed25519)
+			DEFINE_OID(thawte()+113, Ed448)
+		DEFINE_OID(identified_organization()+132, certicom)
+			DEFINE_OID(certicom()+0, certicom_ellipticCurve)
+				// these are sorted by curve type and then by OID
+				// first curves based on GF(p)
+				DEFINE_OID(certicom_ellipticCurve()+6, secp112r1)
+				DEFINE_OID(certicom_ellipticCurve()+7, secp112r2)
+				DEFINE_OID(certicom_ellipticCurve()+8, secp160r1)
+				DEFINE_OID(certicom_ellipticCurve()+9, secp160k1)
+				DEFINE_OID(certicom_ellipticCurve()+10, secp256k1)
+				DEFINE_OID(certicom_ellipticCurve()+28, secp128r1)
+				DEFINE_OID(certicom_ellipticCurve()+29, secp128r2)
+				DEFINE_OID(certicom_ellipticCurve()+30, secp160r2)
+				DEFINE_OID(certicom_ellipticCurve()+31, secp192k1)
+				DEFINE_OID(certicom_ellipticCurve()+32, secp224k1)
+				DEFINE_OID(certicom_ellipticCurve()+33, secp224r1)
+				DEFINE_OID(certicom_ellipticCurve()+34, secp384r1)
+				DEFINE_OID(certicom_ellipticCurve()+35, secp521r1)
+				// then curves based on GF(2^n)
+				DEFINE_OID(certicom_ellipticCurve()+1, sect163k1)
+				DEFINE_OID(certicom_ellipticCurve()+2, sect163r1)
+				DEFINE_OID(certicom_ellipticCurve()+3, sect239k1)
+				DEFINE_OID(certicom_ellipticCurve()+4, sect113r1)
+				DEFINE_OID(certicom_ellipticCurve()+5, sect113r2)
+				DEFINE_OID(certicom_ellipticCurve()+15, sect163r2)
+				DEFINE_OID(certicom_ellipticCurve()+16, sect283k1)
+				DEFINE_OID(certicom_ellipticCurve()+17, sect283r1)
+				DEFINE_OID(certicom_ellipticCurve()+22, sect131r1)
+				DEFINE_OID(certicom_ellipticCurve()+23, sect131r2)
+				DEFINE_OID(certicom_ellipticCurve()+24, sect193r1)
+				DEFINE_OID(certicom_ellipticCurve()+25, sect193r2)
+				DEFINE_OID(certicom_ellipticCurve()+26, sect233k1)
+				DEFINE_OID(certicom_ellipticCurve()+27, sect233r1)
+				DEFINE_OID(certicom_ellipticCurve()+36, sect409k1)
+				DEFINE_OID(certicom_ellipticCurve()+37, sect409r1)
+				DEFINE_OID(certicom_ellipticCurve()+38, sect571k1)
+				DEFINE_OID(certicom_ellipticCurve()+39, sect571r1)
+DEFINE_OID(2, joint_iso_ccitt)
+	DEFINE_OID(joint_iso_ccitt()+16, country)
+		DEFINE_OID(country()+840, joint_iso_ccitt_us)
+			DEFINE_OID(joint_iso_ccitt_us()+1, us_organization)
+				DEFINE_OID(us_organization()+101, us_gov)
+					DEFINE_OID(us_gov()+3, csor)
+						DEFINE_OID(csor()+4, nistalgorithms)
+							DEFINE_OID(nistalgorithms()+1, aes)
+								DEFINE_OID(aes()+1, id_aes128_ECB)
+								DEFINE_OID(aes()+2, id_aes128_cbc)
+								DEFINE_OID(aes()+3, id_aes128_ofb)
+								DEFINE_OID(aes()+4, id_aes128_cfb)
+								DEFINE_OID(aes()+21, id_aes192_ECB)
+								DEFINE_OID(aes()+22, id_aes192_cbc)
+								DEFINE_OID(aes()+23, id_aes192_ofb)
+								DEFINE_OID(aes()+24, id_aes192_cfb)
+								DEFINE_OID(aes()+41, id_aes256_ECB)
+								DEFINE_OID(aes()+42, id_aes256_cbc)
+								DEFINE_OID(aes()+43, id_aes256_ofb)
+								DEFINE_OID(aes()+44, id_aes256_cfb)
+							DEFINE_OID(nistalgorithms()+2, nist_hashalgs)
+								DEFINE_OID(nist_hashalgs()+1, id_sha256)
+								DEFINE_OID(nist_hashalgs()+2, id_sha384)
+								DEFINE_OID(nist_hashalgs()+3, id_sha512)
+								DEFINE_OID(nist_hashalgs()+4, id_sha224)
+								DEFINE_OID(nist_hashalgs()+7, id_sha3_224)
+								DEFINE_OID(nist_hashalgs()+8, id_sha3_256)
+								DEFINE_OID(nist_hashalgs()+9, id_sha3_384)
+								DEFINE_OID(nist_hashalgs()+10, id_sha3_512)
+			DEFINE_OID(joint_iso_ccitt_us()+10046, ansi_x942)
+				DEFINE_OID(ansi_x942()+2, number_type)
+					DEFINE_OID(number_type()+1, dhpublicnumber)
+
+NAMESPACE_END
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/osrng.cpp b/runtime/third_party/cryptopp/osrng.cpp
new file mode 100644
index 0000000..6c72dca
--- /dev/null
+++ b/runtime/third_party/cryptopp/osrng.cpp
@@ -0,0 +1,337 @@
+// osrng.cpp - originally written and placed in the public domain by Wei Dai
+
+// Thanks to Leonard Janke for the suggestion for AutoSeededRandomPool.
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+// Win32 has CryptoAPI and <wincrypt.h>. Windows 10 and Windows Store 10 have CNG and <bcrypt.h>.
+//  There's a hole for Windows Phone 8 and Windows Store 8. There is no userland RNG available.
+//  Also see http://www.drdobbs.com/windows/using-c-and-com-with-winrt/240168150 and
+//  http://stackoverflow.com/questions/36974545/random-numbers-for-windows-phone-8-and-windows-store-8 and
+//  https://social.msdn.microsoft.com/Forums/vstudio/en-US/25b83e13-c85f-4aa1-a057-88a279ea3fd6/what-crypto-random-generator-c-code-could-use-on-wp81
+#if defined(CRYPTOPP_WIN32_AVAILABLE) && !defined(OS_RNG_AVAILABLE)
+# pragma message("WARNING: Compiling for Windows but an OS RNG is not available. This is likely a Windows Phone 8 or Windows Store 8 app.")
+#endif
+
+#if !defined(NO_OS_DEPENDENCE) && defined(OS_RNG_AVAILABLE)
+
+#include "osrng.h"
+#include "rng.h"
+
+// FreeBSD links /dev/urandom -> /dev/random. It showed up when we added
+// O_NOFOLLOW to harden the non-blocking generator. Use Arc4Random instead
+// for a non-blocking generator. Arc4Random is cryptograhic quality prng
+// based on ChaCha20. The ChaCha20 generator is seeded from /dev/random,
+// so we can't completely avoid the blocking.
+// https://www.freebsd.org/cgi/man.cgi?query=arc4random_buf.
+#ifdef __FreeBSD__
+# define DONT_USE_O_NOFOLLOW 1
+# define USE_FREEBSD_ARC4RANDOM 1
+# include <stdlib.h>
+#endif
+
+// Solaris links /dev/urandom -> ../devices/pseudo/random@0:urandom
+// We can't access the device. Avoid O_NOFOLLOW for the platform.
+#ifdef __sun
+# define DONT_USE_O_NOFOLLOW 1
+#endif
+
+// And other OSes that don't define it
+#ifndef O_NOFOLLOW
+# define DONT_USE_O_NOFOLLOW 1
+#endif
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#ifndef ERROR_INCORRECT_SIZE
+# define ERROR_INCORRECT_SIZE 0x000005B6
+#endif
+#if defined(USE_MS_CRYPTOAPI)
+#include <wincrypt.h>
+#ifndef CRYPT_NEWKEYSET
+# define CRYPT_NEWKEYSET 0x00000008
+#endif
+#ifndef CRYPT_MACHINE_KEYSET
+# define CRYPT_MACHINE_KEYSET 0x00000020
+#endif
+#elif defined(USE_MS_CNGAPI)
+#include <bcrypt.h>
+#ifndef BCRYPT_SUCCESS
+# define BCRYPT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
+#endif
+#ifndef STATUS_INVALID_PARAMETER
+# define STATUS_INVALID_PARAMETER 0xC000000D
+#endif
+#ifndef STATUS_INVALID_HANDLE
+# define STATUS_INVALID_HANDLE 0xC0000008
+#endif
+#endif
+#endif  // Win32
+
+#ifdef CRYPTOPP_UNIX_AVAILABLE
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(NONBLOCKING_RNG_AVAILABLE) || defined(BLOCKING_RNG_AVAILABLE)
+OS_RNG_Err::OS_RNG_Err(const std::string &operation)
+	: Exception(OTHER_ERROR, "OS_Rng: " + operation + " operation failed with error " +
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+		"0x" + IntToString(GetLastError(), 16)
+#else
+		IntToString(errno)
+#endif
+		)
+{
+}
+#endif
+
+#ifdef NONBLOCKING_RNG_AVAILABLE
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+
+#if defined(USE_MS_CNGAPI)
+inline DWORD NtStatusToErrorCode(NTSTATUS status)
+{
+	if (status == static_cast<NTSTATUS>(STATUS_INVALID_PARAMETER))
+		return ERROR_INVALID_PARAMETER;
+	else if (status == static_cast<NTSTATUS>(STATUS_INVALID_HANDLE))
+		return ERROR_INVALID_HANDLE;
+	else
+		return static_cast<DWORD>(status);
+}
+#endif
+
+#if defined(UNICODE) || defined(_UNICODE)
+# define CRYPTOPP_CONTAINER L"Crypto++ RNG"
+#else
+# define CRYPTOPP_CONTAINER "Crypto++ RNG"
+#endif
+
+MicrosoftCryptoProvider::MicrosoftCryptoProvider() : m_hProvider(0)
+{
+#if defined(USE_MS_CRYPTOAPI)
+	// See http://support.microsoft.com/en-us/kb/238187 for CRYPT_NEWKEYSET fallback strategy
+	if (!CryptAcquireContext(&m_hProvider, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
+	{
+		const DWORD firstErr = GetLastError();
+		if (!CryptAcquireContext(&m_hProvider, CRYPTOPP_CONTAINER, 0, PROV_RSA_FULL, CRYPT_NEWKEYSET /*user*/) &&
+		    !CryptAcquireContext(&m_hProvider, CRYPTOPP_CONTAINER, 0, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET|CRYPT_NEWKEYSET))
+		{
+			// Set original error with original code
+			SetLastError(firstErr);
+			throw OS_RNG_Err("CryptAcquireContext");
+		}
+	}
+#elif defined(USE_MS_CNGAPI)
+	NTSTATUS ret = BCryptOpenAlgorithmProvider(&m_hProvider, BCRYPT_RNG_ALGORITHM, MS_PRIMITIVE_PROVIDER, 0);
+	if (!(BCRYPT_SUCCESS(ret)))
+	{
+		// Hack... OS_RNG_Err calls GetLastError()
+		SetLastError(NtStatusToErrorCode(ret));
+		throw OS_RNG_Err("BCryptOpenAlgorithmProvider");
+	}
+#endif
+}
+
+MicrosoftCryptoProvider::~MicrosoftCryptoProvider()
+{
+#if defined(USE_MS_CRYPTOAPI)
+	if (m_hProvider)
+		CryptReleaseContext(m_hProvider, 0);
+#elif defined(USE_MS_CNGAPI)
+	if (m_hProvider)
+		BCryptCloseAlgorithmProvider(m_hProvider, 0);
+#endif
+}
+
+#endif  // CRYPTOPP_WIN32_AVAILABLE
+
+NonblockingRng::NonblockingRng()
+{
+#if !defined(CRYPTOPP_WIN32_AVAILABLE) && !defined(USE_FREEBSD_ARC4RANDOM)
+# ifndef DONT_USE_O_NOFOLLOW
+	const int flags = O_RDONLY|O_NOFOLLOW;
+# else
+	const int flags = O_RDONLY;
+# endif
+
+	m_fd = open("/dev/urandom", flags);
+	if (m_fd == -1)
+		throw OS_RNG_Err("open /dev/urandom");
+
+#endif
+}
+
+NonblockingRng::~NonblockingRng()
+{
+#if !defined(CRYPTOPP_WIN32_AVAILABLE) && !defined(USE_FREEBSD_ARC4RANDOM)
+	close(m_fd);
+#endif
+}
+
+void NonblockingRng::GenerateBlock(byte *output, size_t size)
+{
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+	// Acquiring a provider is expensive. Do it once and retain the reference.
+# if defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static const MicrosoftCryptoProvider hProvider = MicrosoftCryptoProvider();
+# else
+	const MicrosoftCryptoProvider &hProvider = Singleton<MicrosoftCryptoProvider>().Ref();
+# endif
+# if defined(USE_MS_CRYPTOAPI)
+	DWORD dwSize;
+	CRYPTOPP_ASSERT(SafeConvert(size, dwSize));
+	if (!SafeConvert(size, dwSize))
+	{
+		SetLastError(ERROR_INCORRECT_SIZE);
+		throw OS_RNG_Err("GenerateBlock size");
+	}
+	BOOL ret = CryptGenRandom(hProvider.GetProviderHandle(), dwSize, output);
+	CRYPTOPP_ASSERT(ret != FALSE);
+	if (ret == FALSE)
+		throw OS_RNG_Err("CryptGenRandom");
+# elif defined(USE_MS_CNGAPI)
+	ULONG ulSize;
+	CRYPTOPP_ASSERT(SafeConvert(size, ulSize));
+	if (!SafeConvert(size, ulSize))
+	{
+		SetLastError(ERROR_INCORRECT_SIZE);
+		throw OS_RNG_Err("GenerateBlock size");
+	}
+	NTSTATUS ret = BCryptGenRandom(hProvider.GetProviderHandle(), output, ulSize, 0);
+	CRYPTOPP_ASSERT(BCRYPT_SUCCESS(ret));
+	if (!(BCRYPT_SUCCESS(ret)))
+	{
+		// Hack... OS_RNG_Err calls GetLastError()
+		SetLastError(NtStatusToErrorCode(ret));
+		throw OS_RNG_Err("BCryptGenRandom");
+	}
+# endif
+#else
+
+# if defined(USE_FREEBSD_ARC4RANDOM)
+	// Cryptographic quality prng based on ChaCha20,
+	// https://www.freebsd.org/cgi/man.cgi?query=arc4random_buf
+	arc4random_buf(output, size);
+# else
+	while (size)
+	{
+		ssize_t len = read(m_fd, output, size);
+		if (len < 0)
+		{
+			// /dev/urandom reads CAN give EAGAIN errors! (maybe EINTR as well)
+			if (errno != EINTR && errno != EAGAIN)
+				throw OS_RNG_Err("read /dev/urandom");
+
+			continue;
+		}
+		output += len;
+		size -= len;
+	}
+# endif  // USE_FREEBSD_ARC4RANDOM
+
+#endif  // CRYPTOPP_WIN32_AVAILABLE
+}
+
+#endif  // NONBLOCKING_RNG_AVAILABLE
+
+// *************************************************************
+
+#ifdef BLOCKING_RNG_AVAILABLE
+
+#ifndef CRYPTOPP_BLOCKING_RNG_FILENAME
+# ifdef __OpenBSD__
+#  define CRYPTOPP_BLOCKING_RNG_FILENAME "/dev/srandom"
+# else
+#  define CRYPTOPP_BLOCKING_RNG_FILENAME "/dev/random"
+# endif
+#endif
+
+BlockingRng::BlockingRng()
+{
+#ifndef DONT_USE_O_NOFOLLOW
+	const int flags = O_RDONLY|O_NOFOLLOW;
+#else
+	const int flags = O_RDONLY;
+#endif
+
+	m_fd = open(CRYPTOPP_BLOCKING_RNG_FILENAME, flags);
+	if (m_fd == -1)
+		throw OS_RNG_Err("open " CRYPTOPP_BLOCKING_RNG_FILENAME);
+}
+
+BlockingRng::~BlockingRng()
+{
+	close(m_fd);
+}
+
+void BlockingRng::GenerateBlock(byte *output, size_t size)
+{
+	while (size)
+	{
+		// on some systems /dev/random will block until all bytes
+		// are available, on others it returns immediately
+		ssize_t len = read(m_fd, output, size);
+		if (len < 0)
+		{
+			// /dev/random reads CAN give EAGAIN errors! (maybe EINTR as well)
+			if (errno != EINTR && errno != EAGAIN)
+				throw OS_RNG_Err("read " CRYPTOPP_BLOCKING_RNG_FILENAME);
+
+			continue;
+		}
+
+		size -= len;
+		output += len;
+		if (size)
+			sleep(1);
+	}
+}
+
+#endif  // BLOCKING_RNG_AVAILABLE
+
+// *************************************************************
+
+void OS_GenerateRandomBlock(bool blocking, byte *output, size_t size)
+{
+#ifdef NONBLOCKING_RNG_AVAILABLE
+	if (blocking)
+#endif
+	{
+#ifdef BLOCKING_RNG_AVAILABLE
+		BlockingRng rng;
+		rng.GenerateBlock(output, size);
+#endif
+	}
+
+#ifdef BLOCKING_RNG_AVAILABLE
+	if (!blocking)
+#endif
+	{
+#ifdef NONBLOCKING_RNG_AVAILABLE
+		NonblockingRng rng;
+		rng.GenerateBlock(output, size);
+#endif
+	}
+}
+
+void AutoSeededRandomPool::Reseed(bool blocking, unsigned int seedSize)
+{
+	SecByteBlock seed(seedSize);
+	OS_GenerateRandomBlock(blocking, seed, seedSize);
+	IncorporateEntropy(seed, seedSize);
+}
+
+NAMESPACE_END
+
+#endif  // OS_RNG_AVAILABLE
+
+#endif  // CRYPTOPP_IMPORTS
diff --git a/runtime/third_party/cryptopp/osrng.h b/runtime/third_party/cryptopp/osrng.h
new file mode 100644
index 0000000..31c3295
--- /dev/null
+++ b/runtime/third_party/cryptopp/osrng.h
@@ -0,0 +1,304 @@
+// osrng.h - originally written and placed in the public domain by Wei Dai
+
+/// \file osrng.h
+/// \brief Classes for access to the operating system's random number generators
+
+#ifndef CRYPTOPP_OSRNG_H
+#define CRYPTOPP_OSRNG_H
+
+#include "config.h"
+
+#if !defined(NO_OS_DEPENDENCE) && defined(OS_RNG_AVAILABLE)
+
+#include "cryptlib.h"
+#include "randpool.h"
+#include "smartptr.h"
+#include "fips140.h"
+#include "hkdf.h"
+#include "rng.h"
+#include "aes.h"
+#include "sha.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Exception thrown when an operating system error is encountered
+class CRYPTOPP_DLL OS_RNG_Err : public Exception
+{
+public:
+	/// \brief Constructs an OS_RNG_Err
+	/// \param operation the operation or API call when the error occurs
+	OS_RNG_Err(const std::string &operation);
+};
+
+#ifdef NONBLOCKING_RNG_AVAILABLE
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+/// \brief Wrapper for Microsoft crypto service provider
+/// \sa \def USE_MS_CRYPTOAPI, \def USE_MS_CNGAPI
+class CRYPTOPP_DLL MicrosoftCryptoProvider
+{
+public:
+	/// \brief Construct a MicrosoftCryptoProvider
+	MicrosoftCryptoProvider();
+	~MicrosoftCryptoProvider();
+
+// type HCRYPTPROV and BCRYPT_ALG_HANDLE, avoid #include <windows.h>
+#if defined(USE_MS_CRYPTOAPI)
+# if defined(__CYGWIN__) && defined(__x86_64__)
+	typedef unsigned long long ProviderHandle;
+# elif defined(WIN64) || defined(_WIN64)
+	typedef unsigned __int64 ProviderHandle;
+# else
+	typedef unsigned long ProviderHandle;
+# endif
+#elif defined(USE_MS_CNGAPI)
+	typedef void *PVOID;
+	typedef PVOID ProviderHandle;
+#endif // USE_MS_CRYPTOAPI or USE_MS_CNGAPI
+
+	/// \brief Retrieves the provider handle
+	/// \return CryptoAPI provider handle
+	/// \details If USE_MS_CRYPTOAPI is in effect, then CryptAcquireContext()
+	///  acquires then handle and CryptReleaseContext() releases the handle
+	///  upon destruction. If USE_MS_CNGAPI is in effect, then
+	///  BCryptOpenAlgorithmProvider() acquires then handle and
+	///  BCryptCloseAlgorithmProvider() releases the handle upon destruction.
+	ProviderHandle GetProviderHandle() const {return m_hProvider;}
+
+private:
+	ProviderHandle m_hProvider;
+};
+
+#if defined(CRYPTOPP_MSC_VERSION) && defined(USE_MS_CRYPTOAPI)
+# pragma comment(lib, "advapi32.lib")
+#endif
+
+#if defined(CRYPTOPP_MSC_VERSION) && defined(USE_MS_CNGAPI)
+# pragma comment(lib, "bcrypt.lib")
+#endif
+
+#endif // CRYPTOPP_WIN32_AVAILABLE
+
+/// \brief Wrapper class for /dev/random and /dev/srandom
+/// \details Encapsulates CryptoAPI's CryptGenRandom() or CryptoNG's BCryptGenRandom()
+///  on Windows, or /dev/urandom on Unix and compatibles.
+class CRYPTOPP_DLL NonblockingRng : public RandomNumberGenerator
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "NonblockingRng"; }
+
+	~NonblockingRng();
+
+	/// \brief Construct a NonblockingRng
+	NonblockingRng();
+
+	/// \brief Generate random array of bytes
+	/// \param output the byte buffer
+	/// \param size the length of the buffer, in bytes
+	/// \details GenerateIntoBufferedTransformation() calls are routed to GenerateBlock().
+	void GenerateBlock(byte *output, size_t size);
+
+protected:
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+	MicrosoftCryptoProvider m_Provider;
+#else
+	int m_fd;
+#endif
+};
+
+#endif
+
+#if defined(BLOCKING_RNG_AVAILABLE) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+/// \brief Wrapper class for /dev/random and /dev/srandom
+/// \details Encapsulates /dev/random on Linux, OS X and Unix; and /dev/srandom on the BSDs.
+/// \note On Linux the /dev/random interface is effectively deprecated. According to the
+///  Kernel Crypto developers, /dev/urandom or getrandom(2) should be used instead. Also
+///  see <A HREF="https://lkml.org/lkml/2017/7/20/993">[RFC PATCH v12 3/4] Linux Random
+///  Number Generator</A> on the kernel-crypto mailing list.
+class CRYPTOPP_DLL BlockingRng : public RandomNumberGenerator
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "BlockingRng"; }
+
+	~BlockingRng();
+
+	/// \brief Construct a BlockingRng
+	BlockingRng();
+
+	/// \brief Generate random array of bytes
+	/// \param output the byte buffer
+	/// \param size the length of the buffer, in bytes
+	/// \details GenerateIntoBufferedTransformation() calls are routed to GenerateBlock().
+	void GenerateBlock(byte *output, size_t size);
+
+protected:
+	int m_fd;
+};
+
+#endif
+
+/// OS_GenerateRandomBlock
+/// \brief Generate random array of bytes
+/// \param blocking specifies whether a blocking or non-blocking generator should be used
+/// \param output the byte buffer
+/// \param size the length of the buffer, in bytes
+/// \details OS_GenerateRandomBlock() uses the underlying operating system's
+///  random number generator. On Windows, CryptGenRandom() is called using NonblockingRng.
+/// \details On Unix and compatibles, /dev/urandom is called if blocking is false using
+///  NonblockingRng. If blocking is true, then either /dev/randomd or /dev/srandom is used
+///  by way of BlockingRng, if available.
+CRYPTOPP_DLL void CRYPTOPP_API OS_GenerateRandomBlock(bool blocking, byte *output, size_t size);
+
+/// \brief Automatically Seeded Randomness Pool
+/// \details This class seeds itself using an operating system provided RNG.
+///  AutoSeededRandomPool was suggested by Leonard Janke.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+class CRYPTOPP_DLL AutoSeededRandomPool : public RandomPool
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "AutoSeededRandomPool"; }
+
+	~AutoSeededRandomPool() {}
+
+	/// \brief Construct an AutoSeededRandomPool
+	/// \param blocking controls seeding with BlockingRng or NonblockingRng
+	/// \param seedSize the size of the seed, in bytes
+	/// \details Use blocking to choose seeding with BlockingRng or NonblockingRng.
+	///  The parameter is ignored if only one of these is available.
+	explicit AutoSeededRandomPool(bool blocking = false, unsigned int seedSize = 32)
+		{Reseed(blocking, seedSize);}
+
+	/// \brief Reseed an AutoSeededRandomPool
+	/// \param blocking controls seeding with BlockingRng or NonblockingRng
+	/// \param seedSize the size of the seed, in bytes
+	void Reseed(bool blocking = false, unsigned int seedSize = 32);
+};
+
+/// \tparam BLOCK_CIPHER a block cipher
+/// \brief Automatically Seeded X9.17 RNG
+/// \details AutoSeededX917RNG is from ANSI X9.17 Appendix C, seeded using an OS provided RNG.
+///  If 3-key TripleDES (DES_EDE3) is used, then its a X9.17 conforming generator. If AES is
+///  used, then its a X9.31 conforming generator.
+/// \details Though ANSI X9 prescribes 3-key TripleDES, the template parameter BLOCK_CIPHER
+///  can be any BlockTransformation derived class.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \sa X917RNG, DefaultAutoSeededRNG
+template <class BLOCK_CIPHER>
+class AutoSeededX917RNG : public RandomNumberGenerator, public NotCopyable
+{
+public:
+	static std::string StaticAlgorithmName() {
+		return std::string("AutoSeededX917RNG(") + BLOCK_CIPHER::StaticAlgorithmName() + std::string(")");
+	}
+
+	~AutoSeededX917RNG() {}
+
+	/// \brief Construct an AutoSeededX917RNG
+	/// \param blocking controls seeding with BlockingRng or NonblockingRng
+	/// \param autoSeed controls auto seeding of the generator
+	/// \details Use blocking to choose seeding with BlockingRng or NonblockingRng.
+	///  The parameter is ignored if only one of these is available.
+	/// \sa X917RNG
+	explicit AutoSeededX917RNG(bool blocking = false, bool autoSeed = true)
+		{if (autoSeed) Reseed(blocking);}
+
+	/// \brief Reseed an AutoSeededX917RNG
+	/// \param blocking controls seeding with BlockingRng or NonblockingRng
+	/// \param input additional entropy to add to the generator
+	/// \param length the size of the additional entropy, in bytes
+	/// \details Internally, the generator uses SHA256 to extract the entropy from
+	///  from the seed and then stretch the material for the block cipher's key
+	///  and initialization vector.
+	void Reseed(bool blocking = false, const byte *input = NULLPTR, size_t length = 0);
+
+	/// \brief Deterministically reseed an AutoSeededX917RNG for testing
+	/// \param key the key to use for the deterministic reseeding
+	/// \param keylength the size of the key, in bytes
+	/// \param seed the seed to use for the deterministic reseeding
+	/// \param timeVector a time vector to use for deterministic reseeding
+	/// \details This is a testing interface for testing purposes, and should \a NOT
+	///  be used in production.
+	void Reseed(const byte *key, size_t keylength, const byte *seed, const byte *timeVector);
+
+	bool CanIncorporateEntropy() const {return true;}
+	void IncorporateEntropy(const byte *input, size_t length) {Reseed(false, input, length);}
+	void GenerateIntoBufferedTransformation(BufferedTransformation &target, const std::string &channel, lword length)
+		{m_rng->GenerateIntoBufferedTransformation(target, channel, length);}
+
+	std::string AlgorithmProvider() const;
+
+private:
+	member_ptr<RandomNumberGenerator> m_rng;
+};
+
+template <class BLOCK_CIPHER>
+void AutoSeededX917RNG<BLOCK_CIPHER>::Reseed(const byte *key, size_t keylength, const byte *seed, const byte *timeVector)
+{
+	m_rng.reset(new X917RNG(new typename BLOCK_CIPHER::Encryption(key, keylength), seed, timeVector));
+}
+
+template <class BLOCK_CIPHER>
+void AutoSeededX917RNG<BLOCK_CIPHER>::Reseed(bool blocking, const byte *input, size_t length)
+{
+	enum {BlockSize=BLOCK_CIPHER::BLOCKSIZE};
+	enum {KeyLength=BLOCK_CIPHER::DEFAULT_KEYLENGTH};
+	enum {SeedSize=EnumToInt(BlockSize)+EnumToInt(KeyLength)};
+
+	SecByteBlock seed(SeedSize), temp(SeedSize);
+	const byte label[] = "X9.17 key generation";
+	const byte *key=NULLPTR;
+
+	do
+	{
+		OS_GenerateRandomBlock(blocking, temp, temp.size());
+
+		HKDF<SHA256> hkdf;
+		hkdf.DeriveKey(
+			seed, seed.size(),  // derived secret
+			temp, temp.size(),  // instance secret
+			input, length,      // user secret
+			label, 20           // unique label
+		);
+
+		key = seed + BlockSize;
+	}	// check that seed and key don't have same value
+	while (std::memcmp(key, seed, STDMIN((size_t)BlockSize, (size_t)KeyLength)) == 0);
+
+	Reseed(key, KeyLength, seed, NULLPTR);
+}
+
+template <class BLOCK_CIPHER>
+std::string AutoSeededX917RNG<BLOCK_CIPHER>::AlgorithmProvider() const
+{
+	// Hack for now... We need to instantiate one
+	typename BLOCK_CIPHER::Encryption bc;
+	return bc.AlgorithmProvider();
+}
+
+CRYPTOPP_DLL_TEMPLATE_CLASS AutoSeededX917RNG<AES>;
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief A typedef providing a default generator
+/// \details DefaultAutoSeededRNG is a typedef of either AutoSeededX917RNG<AES> or AutoSeededRandomPool.
+///  If CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2 is defined, then DefaultAutoSeededRNG is
+///  AutoSeededX917RNG<AES>. Otherwise, DefaultAutoSeededRNG is AutoSeededRandomPool.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+class DefaultAutoSeededRNG {}
+#else
+// AutoSeededX917RNG<AES> in FIPS mode, otherwise it's AutoSeededRandomPool
+#if CRYPTOPP_ENABLE_COMPLIANCE_WITH_FIPS_140_2
+typedef AutoSeededX917RNG<AES> DefaultAutoSeededRNG;
+#else
+typedef AutoSeededRandomPool DefaultAutoSeededRNG;
+#endif
+#endif // CRYPTOPP_DOXYGEN_PROCESSING
+
+NAMESPACE_END
+
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/ossig.h b/runtime/third_party/cryptopp/ossig.h
new file mode 100644
index 0000000..ce23b73
--- /dev/null
+++ b/runtime/third_party/cryptopp/ossig.h
@@ -0,0 +1,128 @@
+// ossig.h - written and placed in the public domain by Jeffrey Walton
+//
+/// \file ossig.h
+/// \brief Utility class for trapping OS signals.
+/// \since Crypto++ 5.6.5
+
+#ifndef CRYPTOPP_OS_SIGNAL_H
+#define CRYPTOPP_OS_SIGNAL_H
+
+#include "config.h"
+
+#if defined(UNIX_SIGNALS_AVAILABLE)
+# include <signal.h>
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ************** Unix and Linux compatibles ***************
+
+#if defined(UNIX_SIGNALS_AVAILABLE) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+/// \brief Signal handler function pointer
+/// \details SignalHandlerFn is provided as a stand alone function pointer with external "C" linkage
+/// \sa SignalHandler, NullSignalHandler
+extern "C" {
+    typedef void (*SignalHandlerFn) (int);
+}
+
+/// \brief Null signal handler function
+/// \param unused the signal number
+/// \details NullSignalHandler is provided as a stand alone function with external "C" linkage
+///  and not a static member function due to the member function's implicit
+///  external "C++" linkage.
+/// \sa SignalHandler, SignalHandlerFn
+extern "C" {
+    inline void NullSignalHandler(int unused) {CRYPTOPP_UNUSED(unused);}
+}
+
+/// Signal handler for Linux and Unix compatibles
+/// \tparam S Signal number
+/// \tparam O Flag indicating if an existing handler should be overwritten
+/// \details SignalHandler() can be used to install a signal handler with the signature
+///  <tt>void handler_fn(int)</tt>. If <tt>SignalHandlerFn</tt> is not <tt>NULL</tt>, then
+///  the sigaction is set to the function and the sigaction flags is set to the flags.
+///  If <tt>SignalHandlerFn</tt> is <tt>NULL</tt>, then a default handler is installed
+///  using sigaction flags set to 0. The default handler only returns from the call.
+/// \details Upon destruction the previous signal handler is restored if the former signal handler
+///  was replaced.
+/// \details On Cygwin systems using Newlib, you should define <tt>_XOPEN_SOURCE=700</tt> or
+///  <tt>_GNU_SOURCE</tt>; or use <tt>-std=gnu++03</tt>, <tt>-std=gnu++11</tt>, or similar. If
+///  you compile with <tt>-std=c++03</tt>, <tt>-std=c++11</tt> or similar, then define
+///  <tt>_XOPEN_SOURCE=700</tt>.
+/// \warning Do not use SignalHandler in a code block that uses <tt>setjmp</tt> or <tt>longjmp</tt>
+///  because the destructor may not run.
+/// \since Crypto++ 5.6.5
+/// \sa NullSignalHandler, SignalHandlerFn, \ref CRYPTOPP_ASSERT "CRYPTOPP_ASSERT", DebugTrapHandler
+template <int S, bool O=false>
+struct SignalHandler
+{
+    /// \brief Construct a signal handler
+    /// \param pfn Pointer to a signal handler function
+    /// \param flags Flags to use with the signal handler
+    /// \details SignalHandler() installs a signal handler with the signature
+    ///  <tt>void handler_fn(int)</tt>. If <tt>SignalHandlerFn</tt> is not <tt>NULL</tt>, then
+    ///  the sigaction is set to the function and the sigaction flags is set to the flags.
+    ///  If <tt>SignalHandlerFn</tt> is <tt>NULL</tt>, then a default handler is installed
+    ///  using sigaction flags set to 0. The default handler only returns from the call.
+    /// \details Upon destruction the previous signal handler is restored if the former signal handler
+    ///  was overwritten.
+    /// \details On Cygwin systems using Newlib, you should define <tt>_XOPEN_SOURCE=700</tt> or
+    ///  <tt>_GNU_SOURCE</tt>; or use <tt>-std=gnu++03</tt>, <tt>-std=gnu++11</tt>, or similar. If
+    ///  you compile with <tt>-std=c++03</tt>, <tt>-std=c++11</tt> or similar, then define
+    ///  <tt>_XOPEN_SOURCE=700</tt>.
+    /// \warning Do not use SignalHandler in a code block that uses <tt>setjmp</tt> or <tt>longjmp</tt>
+    ///  because the destructor may not run. <tt>setjmp</tt> is why cpu.cpp does not use SignalHandler
+    ///  during CPU feature testing.
+    /// \since Crypto++ 5.6.5
+    SignalHandler(SignalHandlerFn pfn = NULLPTR, int flags = 0) : m_installed(false)
+    {
+        // http://pubs.opengroup.org/onlinepubs/007908799/xsh/sigaction.html
+        struct sigaction new_handler;
+
+        do
+        {
+            int ret = 0;
+
+            ret = sigaction (S, 0, &m_old);
+            if (ret != 0) break; // Failed
+
+            // Don't step on another's handler if Overwrite=false
+            if (m_old.sa_handler != 0 && !O) break;
+
+            // Cygwin/Newlib requires -D_XOPEN_SOURCE=700
+            ret = sigemptyset (&new_handler.sa_mask);
+            if (ret != 0) break; // Failed
+
+            new_handler.sa_handler = (pfn ? pfn : &NullSignalHandler);
+            new_handler.sa_flags = (pfn ? flags : 0);
+
+            // Install it
+            ret = sigaction (S, &new_handler, 0);
+            if (ret != 0) break; // Failed
+
+            m_installed = true;
+
+        } while(0);
+    }
+
+    ~SignalHandler()
+    {
+        if (m_installed)
+            sigaction (S, &m_old, 0);
+    }
+
+private:
+    struct sigaction m_old;
+    bool m_installed;
+
+private:
+    // Not copyable
+    SignalHandler(const SignalHandler &);
+    void operator=(const SignalHandler &);
+};
+#endif
+
+NAMESPACE_END
+
+#endif // CRYPTOPP_OS_SIGNAL_H
diff --git a/runtime/third_party/cryptopp/padlkrng.cpp b/runtime/third_party/cryptopp/padlkrng.cpp
new file mode 100644
index 0000000..821e9c0
--- /dev/null
+++ b/runtime/third_party/cryptopp/padlkrng.cpp
@@ -0,0 +1,105 @@
+// via-rng.cpp - written and placed in public domain by Jeffrey Walton and Uri Blumenthal.
+
+#include "pch.h"
+#include "config.h"
+#include "cryptlib.h"
+#include "secblock.h"
+#include "padlkrng.h"
+#include "cpu.h"
+
+// The Padlock Security Engine RNG has a few items to be aware of. You can
+// find copies  of the Programmer's manual, Cryptography Research Inc audit
+// report, and other goodies at http://www.cryptopp.com/wiki/VIA_Padlock.
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4702)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+std::string PadlockRNG::AlgorithmProvider() const
+{
+    return "Padlock";
+}
+
+PadlockRNG::PadlockRNG(word32 divisor)
+	: m_divisor(DivisorHelper(divisor)), m_msr(0)
+{
+#if defined(CRYPTOPP_X86_ASM_AVAILABLE)
+	if (!HasPadlockRNG())
+#endif
+		throw PadlockRNG_Err("PadlockRNG", "PadlockRNG generator not available");
+}
+
+void PadlockRNG::GenerateBlock(byte *output, size_t size)
+{
+	CRYPTOPP_UNUSED(output); CRYPTOPP_UNUSED(size);
+#if defined(CRYPTOPP_X86_ASM_AVAILABLE) && defined(__GNUC__)
+	while (size)
+	{
+		__asm__ __volatile__
+		(
+#if (CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+			"mov  %1, %%rdi          ;\n"
+			"movl %2, %%edx          ;\n"
+#else
+			"mov  %1, %%edi          ;\n"
+			"movl %2, %%edx          ;\n"
+#endif
+
+			// xstore-rng
+			".byte 0x0f, 0xa7, 0xc0  ;\n"
+			"movl %%eax, %0          ;\n"
+
+			: "=g" (m_msr) : "g" (m_buffer.data()), "g" (m_divisor)
+#if (CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+			: "rax", "rdx", "rdi", "cc"
+#else
+			: "eax", "edx", "edi", "cc"
+#endif
+		);
+
+		const size_t ret = m_msr & 0x1f;
+		const size_t rem = STDMIN<size_t>(ret, STDMIN<size_t>(size, 16U /*buffer size*/));
+		std::memcpy(output, m_buffer, rem);
+		size -= rem; output += rem;
+	}
+#elif defined(CRYPTOPP_X86_ASM_AVAILABLE) && defined(CRYPTOPP_MSC_VERSION) && defined(_M_IX86)
+	while (size)
+	{
+		word32 result, divisor = m_divisor;
+		byte *buffer = reinterpret_cast<byte*>(m_buffer.data());
+		__asm {
+			mov edi, buffer
+			mov edx, divisor
+			_emit 0x0f
+			_emit 0xa7
+			_emit 0xc0
+			mov result, eax
+		}
+
+		const size_t ret = (m_msr = result) & 0x1f;
+		const size_t rem = STDMIN<size_t>(ret, STDMIN<size_t>(size, 16U /*buffer size*/));
+		std::memcpy(output, buffer, rem);
+		size -= rem; output += rem;
+	}
+#else
+	throw PadlockRNG_Err("GenerateBlock", "PadlockRNG generator not available");
+#endif  // CRYPTOPP_X86_ASM_AVAILABLE
+}
+
+void PadlockRNG::DiscardBytes(size_t n)
+{
+	FixedSizeSecBlock<word32, 4> discard;
+	n = RoundUpToMultipleOf(n, sizeof(word32));
+
+	size_t count = STDMIN(n, discard.SizeInBytes());
+	while (count)
+	{
+		GenerateBlock(discard.BytePtr(), count);
+		n -= count;
+		count = STDMIN(n, discard.SizeInBytes());
+	}
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/padlkrng.h b/runtime/third_party/cryptopp/padlkrng.h
new file mode 100644
index 0000000..7c6b0b3
--- /dev/null
+++ b/runtime/third_party/cryptopp/padlkrng.h
@@ -0,0 +1,138 @@
+// via-rng.h - written and placed in public domain by Jeffrey Walton
+
+/// \file padlkrng.h
+/// \brief Classes for VIA Padlock RNG
+/// \since Crypto++ 6.0
+/// \sa <A HREF="http://www.cryptopp.com/wiki/VIA_Padlock">VIA
+///   Padlock</A> on the Crypto++ wiki
+
+#ifndef CRYPTOPP_PADLOCK_RNG_H
+#define CRYPTOPP_PADLOCK_RNG_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Exception thrown when a PadlockRNG generator encounters
+///	a generator related error.
+/// \since Crypto++ 6.0
+class PadlockRNG_Err : public Exception
+{
+public:
+	PadlockRNG_Err(const std::string &operation)
+		: Exception(OTHER_ERROR, "PadlockRNG: " + operation + " operation failed") {}
+	PadlockRNG_Err(const std::string &component, const std::string &message)
+		: Exception(OTHER_ERROR, component + ": " + message) {}
+};
+
+/// \brief Hardware generated random numbers using VIA XSTORE
+/// \details Some VIA processors provide a Security Engine called Padlock. The Padlock
+///   Security Engine provides AES, SHA and a RNG. The PadlockRNG class provides access
+///   to the RNG.
+/// \details The VIA generator uses an 8 byte FIFO buffer for random numbers. The
+///   generator can be configured to discard bits from the buffer to resist analysis.
+///   The <tt>divisor</tt> controls the number of bytes discarded. The formula for
+///   the discard amount is <tt>2**divisor - 1</tt>. When <tt>divisor=0</tt> no bits
+///   are discarded and the entire 8 byte buffer is read. If <tt>divisor=3</tt> then
+///   7 bytes are discarded and 1 byte is read. TheVIA SDK samples use <tt>divisor=1</tt>.
+/// \details Cryptography Research, Inc (CRI) audited the Padlock Security Engine
+///   in 2003. CRI provided recommendations to operate the generator for secure and
+///   non-secure applications. Additionally, the Programmers Guide and SDK provided a
+///   different configuration in the sample code.
+/// \details You can operate the generator according to CRI recommendations by setting
+///   <tt>divisor</tt>, reading one word (or partial word) at a time from the FIFO, and
+///   then inspecting the MSR after each read.
+/// \details The audit report with recommendations is available on the Crypto++ wiki
+///   at <A HREF="http://www.cryptopp.com/wiki/VIA_Padlock">VIA Padlock</A>.
+/// \sa MaurerRandomnessTest() for random bit generators
+/// \since Crypto++ 6.0
+class PadlockRNG : public RandomNumberGenerator
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "PadlockRNG"; }
+
+	virtual ~PadlockRNG() {}
+
+	/// \brief Construct a PadlockRNG generator
+	/// \param divisor the XSTORE divisor
+	/// \details Some VIA processors provide a Security Engine called Padlock. The Padlock
+	///   Security Engine provides AES, SHA and a RNG. The PadlockRNG class provides access
+	///   to the RNG.
+	/// \details The VIA generator uses an 8 byte FIFO buffer for random numbers. The
+	///   generator can be configured to discard bits from the buffer to resist analysis.
+	///   The <tt>divisor</tt> controls the number of bytes discarded. The formula for
+	///   the discard amount is <tt>2**divisor - 1</tt>. When <tt>divisor=0</tt> no bits
+	///   are discarded and the entire 8 byte buffer is read. If <tt>divisor=3</tt> then
+	///   7 bytes are discarded and 1 byte is read. VIA SDK samples use <tt>divisor=1</tt>.
+	/// \details Cryptography Research, Inc (CRI) audited the Padlock Security Engine
+	///   in 2003. CRI provided recommendations to operate the generator for secure and
+	///   non-secure applications. Additionally, the Programmers SDK provided a different
+	///   configuration in the sample code.
+	/// \details The audit report with recommendations is available on the Crypto++ wiki
+	///   at <A HREF="http://www.cryptopp.com/wiki/VIA_Padlock">VIA Padlock</A>.
+	/// \sa SetDivisor, GetDivisor
+	PadlockRNG(word32 divisor=1);
+
+	/// \brief Generate random array of bytes
+	/// \param output the byte buffer
+	/// \param size the length of the buffer, in bytes
+	virtual void GenerateBlock(byte *output, size_t size);
+
+	/// \brief Generate and discard n bytes
+	/// \param n the number of bytes to generate and discard
+	/// \details the Padlock generator discards words, not bytes. If n is
+	///   not a multiple of a 32-bit word, then it is rounded up to
+	///   that size.
+	virtual void DiscardBytes(size_t n);
+
+	/// \brief Update RNG state with additional unpredictable values
+	/// \param input unused
+	/// \param length unused
+	/// \details The operation is a nop for this generator.
+	virtual void IncorporateEntropy(const byte *input, size_t length)
+	{
+		// Override to avoid the base class' throw.
+		CRYPTOPP_UNUSED(input); CRYPTOPP_UNUSED(length);
+	}
+
+    std::string AlgorithmProvider() const;
+
+	/// \brief Set the XSTORE divisor
+	/// \param divisor the XSTORE divisor
+	/// \return the old XSTORE divisor
+	word32 SetDivisor(word32 divisor)
+	{
+		word32 old = m_divisor;
+		m_divisor = DivisorHelper(divisor);
+		return old;
+	}
+
+	/// \brief Get the XSTORE divisor
+	/// \return the current XSTORE divisor
+	word32 GetDivisor() const
+	{
+		return m_divisor;
+	}
+
+	/// \brief Get the MSR for the last operation
+	/// \return the MSR for the last read operation
+	word32 GetMSR() const
+	{
+		return m_msr;
+	}
+
+protected:
+	inline word32 DivisorHelper(word32 divisor)
+	{
+		return divisor > 3 ? 3 : divisor;
+	}
+
+private:
+	FixedSizeAlignedSecBlock<word32, 4, true> m_buffer;
+	word32 m_divisor, m_msr;
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_PADLOCK_RNG_H
diff --git a/runtime/third_party/cryptopp/panama.cpp b/runtime/third_party/cryptopp/panama.cpp
new file mode 100644
index 0000000..b85fd9c
--- /dev/null
+++ b/runtime/third_party/cryptopp/panama.cpp
@@ -0,0 +1,533 @@
+// panama.cpp - originally written and placed in the public domain by Wei Dai
+
+// use "cl /EP /P /DCRYPTOPP_GENERATE_X64_MASM panama.cpp" to generate MASM code
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#include "panama.h"
+#include "secblock.h"
+#include "misc.h"
+#include "cpu.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4731)
+#endif
+
+template <class B>
+std::string Panama<B>::AlgorithmProvider() const
+{
+#ifndef CRYPTOPP_DISABLE_PANAMA_ASM
+# if CRYPTOPP_SSSE3_ASM_AVAILABLE
+	if(HasSSSE3())
+		return "SSSE3";
+# elif CRYPTOPP_SSE2_ASM_AVAILABLE
+	if(HasSSE2())
+		return "SSE2";
+# endif
+#endif
+	return "C++";
+}
+
+template <class B>
+void Panama<B>::Reset()
+{
+	std::memset(m_state, 0, m_state.SizeInBytes());
+#if CRYPTOPP_SSSE3_ASM_AVAILABLE && !defined(CRYPTOPP_DISABLE_PANAMA_ASM)
+	m_state[17] = HasSSSE3();
+#endif
+}
+
+#endif	// #ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+extern "C" {
+void Panama_SSE2_Pull(size_t count, word32 *state, word32 *z, const word32 *y);
+}
+#elif CRYPTOPP_SSE2_ASM_AVAILABLE && !defined(CRYPTOPP_DISABLE_PANAMA_ASM)
+
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+	Panama_SSE2_Pull	PROC FRAME
+	rex_push_reg rdi
+	alloc_stack(2*16)
+	save_xmm128 xmm6, 0h
+	save_xmm128 xmm7, 10h
+	.endprolog
+#else
+void CRYPTOPP_NOINLINE Panama_SSE2_Pull(size_t count, word32 *state, word32 *z, const word32 *y)
+{
+#if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+	asm __volatile__
+	(
+	INTEL_NOPREFIX
+	AS_PUSH_IF86(	bx)
+#else
+	AS2(	mov		AS_REG_1, count)
+	AS2(	mov		AS_REG_2, state)
+	AS2(	mov		AS_REG_3, z)
+	AS2(	mov		AS_REG_4, y)
+#endif
+#endif	// #ifdef CRYPTOPP_GENERATE_X64_MASM
+
+#if CRYPTOPP_BOOL_X86
+	#define REG_loopEnd			[esp]
+#elif defined(CRYPTOPP_GENERATE_X64_MASM)
+	#define REG_loopEnd			rdi
+#else
+	#define REG_loopEnd			r8
+#endif
+
+	AS2(	shl		AS_REG_1, 5)
+	ASJ(	jz,		5, f)
+	AS2(	mov		AS_REG_6d, [AS_REG_2+4*17])
+	AS2(	add		AS_REG_1, AS_REG_6)
+
+	#if CRYPTOPP_BOOL_X64
+		AS2(	mov		REG_loopEnd, AS_REG_1)
+	#else
+		AS_PUSH_IF86(	bp)
+		AS1(	push	AS_REG_1)
+	#endif
+
+	AS2(	movdqa	xmm0, XMMWORD_PTR [AS_REG_2+0*16])
+	AS2(	movdqa	xmm1, XMMWORD_PTR [AS_REG_2+1*16])
+	AS2(	movdqa	xmm2, XMMWORD_PTR [AS_REG_2+2*16])
+	AS2(	movdqa	xmm3, XMMWORD_PTR [AS_REG_2+3*16])
+	AS2(	mov		eax, dword ptr [AS_REG_2+4*16])
+
+	ASL(4)
+	// gamma and pi
+#if CRYPTOPP_SSSE3_ASM_AVAILABLE
+	AS2(	test	AS_REG_6, 1)
+	ASJ(	jnz,	6, f)
+#endif
+	AS2(	movdqa	xmm6, xmm2)
+	AS2(	movss	xmm6, xmm3)
+	ASS(	pshufd	xmm5, xmm6, 0, 3, 2, 1)
+	AS2(	movd	xmm6, eax)
+	AS2(	movdqa	xmm7, xmm3)
+	AS2(	movss	xmm7, xmm6)
+	ASS(	pshufd	xmm6, xmm7, 0, 3, 2, 1)
+#if CRYPTOPP_SSSE3_ASM_AVAILABLE
+	ASJ(	jmp,	7, f)
+	ASL(6)
+	AS2(	movdqa	xmm5, xmm3)
+	AS3(	palignr	xmm5, xmm2, 4)
+	AS2(	movd	xmm6, eax)
+	AS3(	palignr	xmm6, xmm3, 4)
+	ASL(7)
+#endif
+
+	AS2(	movd	AS_REG_1d, xmm2)
+	AS1(	not		AS_REG_1d)
+	AS2(	movd	AS_REG_7d, xmm3)
+	AS2(	or		AS_REG_1d, AS_REG_7d)
+	AS2(	xor		eax, AS_REG_1d)
+
+#define SSE2_Index(i) ASM_MOD(((i)*13+16), 17)
+
+#define pi(i)	\
+	AS2(	movd	AS_REG_1d, xmm7)\
+	AS2(	rol		AS_REG_1d, ASM_MOD((ASM_MOD(5*i,17)*(ASM_MOD(5*i,17)+1)/2), 32))\
+	AS2(	mov		[AS_REG_2+SSE2_Index(ASM_MOD(5*(i), 17))*4], AS_REG_1d)
+
+#define pi4(x, y, z, a, b, c, d)	\
+	AS2(	pcmpeqb	xmm7, xmm7)\
+	AS2(	pxor	xmm7, x)\
+	AS2(	por		xmm7, y)\
+	AS2(	pxor	xmm7, z)\
+	pi(a)\
+	ASS(	pshuflw	xmm7, xmm7, 1, 0, 3, 2)\
+	pi(b)\
+	AS2(	punpckhqdq	xmm7, xmm7)\
+	pi(c)\
+	ASS(	pshuflw	xmm7, xmm7, 1, 0, 3, 2)\
+	pi(d)
+
+	pi4(xmm1, xmm2, xmm3, 1, 5, 9, 13)
+	pi4(xmm0, xmm1, xmm2, 2, 6, 10, 14)
+	pi4(xmm6, xmm0, xmm1, 3, 7, 11, 15)
+	pi4(xmm5, xmm6, xmm0, 4, 8, 12, 16)
+
+	// output keystream and update buffer here to hide partial memory stalls between pi and theta
+	AS2(	movdqa	xmm4, xmm3)
+	AS2(	punpcklqdq	xmm3, xmm2)		// 1 5 2 6
+	AS2(	punpckhdq	xmm4, xmm2)		// 9 10 13 14
+	AS2(	movdqa	xmm2, xmm1)
+	AS2(	punpcklqdq	xmm1, xmm0)		// 3 7 4 8
+	AS2(	punpckhdq	xmm2, xmm0)		// 11 12 15 16
+
+	// keystream
+	AS2(	test	AS_REG_3, AS_REG_3)
+	ASJ(	jz,		0, f)
+	AS2(	movdqa	xmm6, xmm4)
+	AS2(	punpcklqdq	xmm4, xmm2)
+	AS2(	punpckhqdq	xmm6, xmm2)
+	AS2(	test	AS_REG_4, 15)
+	ASJ(	jnz,	2, f)
+	AS2(	test	AS_REG_4, AS_REG_4)
+	ASJ(	jz,		1, f)
+	AS2(	pxor	xmm4, [AS_REG_4])
+	AS2(	pxor	xmm6, [AS_REG_4+16])
+	AS2(	add		AS_REG_4, 32)
+	ASJ(	jmp,	1, f)
+	ASL(2)
+	AS2(	movdqu	xmm0, [AS_REG_4])
+	AS2(	movdqu	xmm2, [AS_REG_4+16])
+	AS2(	pxor	xmm4, xmm0)
+	AS2(	pxor	xmm6, xmm2)
+	AS2(	add		AS_REG_4, 32)
+	ASL(1)
+	AS2(	test	AS_REG_3, 15)
+	ASJ(	jnz,	3, f)
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_3], xmm4)
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_3+16], xmm6)
+	AS2(	add		AS_REG_3, 32)
+	ASJ(	jmp,	0, f)
+	ASL(3)
+	AS2(	movdqu	XMMWORD_PTR [AS_REG_3], xmm4)
+	AS2(	movdqu	XMMWORD_PTR [AS_REG_3+16], xmm6)
+	AS2(	add		AS_REG_3, 32)
+	ASL(0)
+
+	// buffer update
+	AS2(	lea		AS_REG_1, [AS_REG_6 + 32])
+	AS2(	and		AS_REG_1, 31*32)
+	AS2(	lea		AS_REG_7, [AS_REG_6 + (32-24)*32])
+	AS2(	and		AS_REG_7, 31*32)
+
+	AS2(	movdqa	xmm0, XMMWORD_PTR [AS_REG_2+20*4+AS_REG_1+0*8])
+	AS2(	pxor	xmm3, xmm0)
+	ASS(	pshufd	xmm0, xmm0, 2, 3, 0, 1)
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_2+20*4+AS_REG_1+0*8], xmm3)
+	AS2(	pxor	xmm0, XMMWORD_PTR [AS_REG_2+20*4+AS_REG_7+2*8])
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_2+20*4+AS_REG_7+2*8], xmm0)
+
+	AS2(	movdqa	xmm4, XMMWORD_PTR [AS_REG_2+20*4+AS_REG_1+2*8])
+	AS2(	pxor	xmm1, xmm4)
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_2+20*4+AS_REG_1+2*8], xmm1)
+	AS2(	pxor	xmm4, XMMWORD_PTR [AS_REG_2+20*4+AS_REG_7+0*8])
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_2+20*4+AS_REG_7+0*8], xmm4)
+
+	// theta
+	AS2(	movdqa	xmm3, XMMWORD_PTR [AS_REG_2+3*16])
+	AS2(	movdqa	xmm2, XMMWORD_PTR [AS_REG_2+2*16])
+	AS2(	movdqa	xmm1, XMMWORD_PTR [AS_REG_2+1*16])
+	AS2(	movdqa	xmm0, XMMWORD_PTR [AS_REG_2+0*16])
+
+#if CRYPTOPP_SSSE3_ASM_AVAILABLE
+	AS2(	test	AS_REG_6, 1)
+	ASJ(	jnz,	8, f)
+#endif
+	AS2(	movd	xmm6, eax)
+	AS2(	movdqa	xmm7, xmm3)
+	AS2(	movss	xmm7, xmm6)
+	AS2(	movdqa	xmm6, xmm2)
+	AS2(	movss	xmm6, xmm3)
+	AS2(	movdqa	xmm5, xmm1)
+	AS2(	movss	xmm5, xmm2)
+	AS2(	movdqa	xmm4, xmm0)
+	AS2(	movss	xmm4, xmm1)
+	ASS(	pshufd	xmm7, xmm7, 0, 3, 2, 1)
+	ASS(	pshufd	xmm6, xmm6, 0, 3, 2, 1)
+	ASS(	pshufd	xmm5, xmm5, 0, 3, 2, 1)
+	ASS(	pshufd	xmm4, xmm4, 0, 3, 2, 1)
+#if CRYPTOPP_SSSE3_ASM_AVAILABLE
+	ASJ(	jmp,	9, f)
+	ASL(8)
+	AS2(	movd	xmm7, eax)
+	AS3(	palignr	xmm7, xmm3, 4)
+	AS2(	movq	xmm6, xmm3)
+	AS3(	palignr	xmm6, xmm2, 4)
+	AS2(	movq	xmm5, xmm2)
+	AS3(	palignr	xmm5, xmm1, 4)
+	AS2(	movq	xmm4, xmm1)
+	AS3(	palignr	xmm4, xmm0, 4)
+	ASL(9)
+#endif
+
+	AS2(	xor		eax, 1)
+	AS2(	movd	AS_REG_1d, xmm0)
+	AS2(	xor		eax, AS_REG_1d)
+	AS2(	movd	AS_REG_1d, xmm3)
+	AS2(	xor		eax, AS_REG_1d)
+
+	AS2(	pxor	xmm3, xmm2)
+	AS2(	pxor	xmm2, xmm1)
+	AS2(	pxor	xmm1, xmm0)
+	AS2(	pxor	xmm0, xmm7)
+	AS2(	pxor	xmm3, xmm7)
+	AS2(	pxor	xmm2, xmm6)
+	AS2(	pxor	xmm1, xmm5)
+	AS2(	pxor	xmm0, xmm4)
+
+	// sigma
+	AS2(	lea		AS_REG_1, [AS_REG_6 + (32-4)*32])
+	AS2(	and		AS_REG_1, 31*32)
+	AS2(	lea		AS_REG_7, [AS_REG_6 + 16*32])
+	AS2(	and		AS_REG_7, 31*32)
+
+	AS2(	movdqa	xmm4, XMMWORD_PTR [AS_REG_2+20*4+AS_REG_1+0*16])
+	AS2(	movdqa	xmm5, XMMWORD_PTR [AS_REG_2+20*4+AS_REG_7+0*16])
+	AS2(	movdqa	xmm6, xmm4)
+	AS2(	punpcklqdq	xmm4, xmm5)
+	AS2(	punpckhqdq	xmm6, xmm5)
+	AS2(	pxor	xmm3, xmm4)
+	AS2(	pxor	xmm2, xmm6)
+
+	AS2(	movdqa	xmm4, XMMWORD_PTR [AS_REG_2+20*4+AS_REG_1+1*16])
+	AS2(	movdqa	xmm5, XMMWORD_PTR [AS_REG_2+20*4+AS_REG_7+1*16])
+	AS2(	movdqa	xmm6, xmm4)
+	AS2(	punpcklqdq	xmm4, xmm5)
+	AS2(	punpckhqdq	xmm6, xmm5)
+	AS2(	pxor	xmm1, xmm4)
+	AS2(	pxor	xmm0, xmm6)
+
+	// loop
+	AS2(	add		AS_REG_6, 32)
+	AS2(	cmp		AS_REG_6, REG_loopEnd)
+	ASJ(	jne,	4, b)
+
+	// save state
+	AS2(	mov		[AS_REG_2+4*16], eax)
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_2+3*16], xmm3)
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_2+2*16], xmm2)
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_2+1*16], xmm1)
+	AS2(	movdqa	XMMWORD_PTR [AS_REG_2+0*16], xmm0)
+
+	#if CRYPTOPP_BOOL_X86
+		AS2(	add		esp, 4)
+		AS_POP_IF86(	bp)
+	#endif
+	ASL(5)
+
+#if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+		AS_POP_IF86(	bx)
+		ATT_PREFIX
+			:
+	#if CRYPTOPP_BOOL_X64
+			: "D" (count), "S" (state), "d" (z), "c" (y)
+			: "%r8", "%r9", "r10", "%eax", "memory", "cc", "%xmm0", "%xmm1", "%xmm2", "%xmm3", "%xmm4", "%xmm5", "%xmm6", "%xmm7"
+	#else
+			: "c" (count), "d" (state), "S" (z), "D" (y)
+			: "%eax", "memory", "cc"
+	#endif
+	);
+#endif
+
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+	movdqa	xmm6, [rsp + 0h]
+	movdqa	xmm7, [rsp + 10h]
+	add rsp, 2*16
+	pop	rdi
+	ret
+	Panama_SSE2_Pull ENDP
+#else
+}
+#endif
+#endif	// CRYPTOPP_SSE2_ASM_AVAILABLE
+
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+template <class B>
+void Panama<B>::Iterate(size_t count, const word32 *p, byte *output, const byte *input, KeystreamOperation operation)
+{
+	word32 bstart = m_state[17];
+	word32 *const aPtr = m_state;
+	word32 cPtr[17];
+
+#define bPtr ((byte *)(aPtr+20))
+
+// reorder the state for SSE2
+// a and c: 4 8 12 16 | 3 7 11 15 | 2 6 10 14 | 1 5 9 13 |  0  |
+//            xmm0        xmm1        xmm2        xmm3     eax
+#define a(i) aPtr[((i)*13+16) % 17]		// 13 is inverse of 4 mod 17
+#define c(i) cPtr[((i)*13+16) % 17]
+// b: 0 4 | 1 5 | 2 6 | 3 7
+#define b(i, j) b##i[(j)*2%8 + (j)/4]
+
+// buffer update
+#define US(i) {word32 t=b(0,i); b(0,i)=ConditionalByteReverse(B::ToEnum(), p[i])^t; b(25,(i+6)%8)^=t;}
+#define UL(i) {word32 t=b(0,i); b(0,i)=a(i+1)^t; b(25,(i+6)%8)^=t;}
+// gamma and pi
+#define GP(i) c(5*i%17) = rotlFixed(a(i) ^ (a((i+1)%17) | ~a((i+2)%17)), ((5*i%17)*((5*i%17)+1)/2)%32)
+// theta and sigma
+#define T(i,x) a(i) = c(i) ^ c((i+1)%17) ^ c((i+4)%17) ^ x
+#define TS1S(i) T(i+1, ConditionalByteReverse(B::ToEnum(), p[i]))
+#define TS1L(i) T(i+1, b(4,i))
+#define TS2(i) T(i+9, b(16,i))
+
+	while (count--)
+	{
+		if (output)
+		{
+#define PANAMA_OUTPUT(x)	\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 0, a(0+9));\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 1, a(1+9));\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 2, a(2+9));\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 3, a(3+9));\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 4, a(4+9));\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 5, a(5+9));\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 6, a(6+9));\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 7, a(7+9));
+
+			typedef word32 WordType;
+			CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(PANAMA_OUTPUT, 4*8);
+		}
+
+		word32 *const b16 = (word32 *)(void *)(bPtr+((bstart+16*32) & 31*32));
+		word32 *const b4 = (word32 *)(void *)(bPtr+((bstart+(32-4)*32) & 31*32));
+       	bstart += 32;
+		word32 *const b0 = (word32 *)(void *)(bPtr+((bstart) & 31*32));
+		word32 *const b25 = (word32 *)(void *)(bPtr+((bstart+(32-25)*32) & 31*32));
+
+		if (p)
+		{
+			US(0); US(1); US(2); US(3); US(4); US(5); US(6); US(7);
+		}
+		else
+		{
+			UL(0); UL(1); UL(2); UL(3); UL(4); UL(5); UL(6); UL(7);
+		}
+
+		GP(0);
+		GP(1);
+		GP(2);
+		GP(3);
+		GP(4);
+		GP(5);
+		GP(6);
+		GP(7);
+		GP(8);
+		GP(9);
+		GP(10);
+		GP(11);
+		GP(12);
+		GP(13);
+		GP(14);
+		GP(15);
+		GP(16);
+
+		T(0,1);
+
+		if (p)
+		{
+			TS1S(0); TS1S(1); TS1S(2); TS1S(3); TS1S(4); TS1S(5); TS1S(6); TS1S(7);
+			p += 8;
+		}
+		else
+		{
+			TS1L(0); TS1L(1); TS1L(2); TS1L(3); TS1L(4); TS1L(5); TS1L(6); TS1L(7);
+		}
+
+		TS2(0); TS2(1); TS2(2); TS2(3); TS2(4); TS2(5); TS2(6); TS2(7);
+	}
+	m_state[17] = bstart;
+}
+
+NAMESPACE_BEGIN(Weak)
+template <class B>
+size_t PanamaHash<B>::HashMultipleBlocks(const word32 *input, size_t length)
+{
+	this->Iterate(length / this->BLOCKSIZE, input);
+	return length % this->BLOCKSIZE;
+}
+
+template <class B>
+void PanamaHash<B>::TruncatedFinal(byte *hash, size_t size)
+{
+	this->ThrowIfInvalidTruncatedSize(size);
+
+	this->PadLastBlock(this->BLOCKSIZE, 0x01);
+
+	this->HashEndianCorrectedBlock(this->m_data);
+
+	this->Iterate(32);	// pull
+
+	this->Iterate(1, NULLPTR, m_buf.BytePtr(), NULLPTR);
+
+	std::memcpy(hash, m_buf, size);
+
+	this->Restart();		// reinit for next use
+}
+NAMESPACE_END
+
+template <class B>
+void PanamaCipherPolicy<B>::CipherSetKey(const NameValuePairs &params, const byte *key, size_t length)
+{
+	CRYPTOPP_UNUSED(params); CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(length==32);
+	std::memcpy(m_key, key, 32);
+}
+
+template <class B>
+void PanamaCipherPolicy<B>::CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer); CRYPTOPP_UNUSED(iv);
+	CRYPTOPP_UNUSED(length); CRYPTOPP_ASSERT(length==32);
+
+	this->Reset();
+	this->Iterate(1, m_key);
+	if (iv && IsAligned<word32>(iv))
+		this->Iterate(1, reinterpret_cast<const word32*>(iv));
+	else
+	{
+		if (iv)
+			std::memcpy(m_buf, iv, 32);
+		else
+			std::memset(m_buf, 0, 32);
+		this->Iterate(1, m_buf);
+	}
+
+#if (CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)) && !defined(CRYPTOPP_DISABLE_PANAMA_ASM)
+	if (B::ToEnum() == LITTLE_ENDIAN_ORDER && HasSSE2() && !IsP4())		// SSE2 code is slower on P4 Prescott
+		Panama_SSE2_Pull(32, this->m_state, NULLPTR, NULLPTR);
+	else
+#endif
+		this->Iterate(32);
+}
+
+template <class B>
+std::string PanamaCipherPolicy<B>::AlgorithmProvider() const
+{
+	return Panama<B>::AlgorithmProvider();
+}
+
+template <class B>
+unsigned int PanamaCipherPolicy<B>::GetAlignment() const
+{
+#if (CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)) && !defined(CRYPTOPP_DISABLE_PANAMA_ASM)
+	if (B::ToEnum() == LITTLE_ENDIAN_ORDER && HasSSE2())
+		return 16;
+	else
+#endif
+		return 1;
+}
+
+template <class B>
+void PanamaCipherPolicy<B>::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+#if (CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)) && !defined(CRYPTOPP_DISABLE_PANAMA_ASM)
+	if (B::ToEnum() == LITTLE_ENDIAN_ORDER && HasSSE2())
+		Panama_SSE2_Pull(iterationCount, this->m_state,
+			reinterpret_cast<word32*>(output), reinterpret_cast<const word32*>(input));
+	else
+#endif
+		this->Iterate(iterationCount, NULLPTR, output, input, operation);
+}
+
+template class Panama<BigEndian>;
+template class Panama<LittleEndian>;
+
+template class Weak::PanamaHash<BigEndian>;
+template class Weak::PanamaHash<LittleEndian>;
+
+template class PanamaCipherPolicy<BigEndian>;
+template class PanamaCipherPolicy<LittleEndian>;
+
+NAMESPACE_END
+
+#endif	// #ifndef CRYPTOPP_GENERATE_X64_MASM
diff --git a/runtime/third_party/cryptopp/panama.h b/runtime/third_party/cryptopp/panama.h
new file mode 100644
index 0000000..9c10f82
--- /dev/null
+++ b/runtime/third_party/cryptopp/panama.h
@@ -0,0 +1,169 @@
+// panama.h - originally written and placed in the public domain by Wei Dai
+
+/// \file panama.h
+/// \brief Classes for Panama hash and stream cipher
+
+#ifndef CRYPTOPP_PANAMA_H
+#define CRYPTOPP_PANAMA_H
+
+#include "strciphr.h"
+#include "iterhash.h"
+#include "secblock.h"
+
+// Clang 3.3 integrated assembler crash on Linux. Clang 3.4 due to compiler error with .intel_syntax
+//#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+//# define CRYPTOPP_DISABLE_PANAMA_ASM
+//#endif
+
+// https://github.com/weidai11/cryptopp/issues/758
+#define CRYPTOPP_DISABLE_PANAMA_ASM 1
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Base class, do not use directly
+template <class B>
+class CRYPTOPP_NO_VTABLE Panama
+{
+public:
+	virtual ~Panama() {}
+	std::string AlgorithmProvider() const;
+	void Reset();
+	void Iterate(size_t count, const word32 *p=NULLPTR, byte *output=NULLPTR, const byte *input=NULLPTR, KeystreamOperation operation=WRITE_KEYSTREAM);
+
+protected:
+	typedef word32 Stage[8];
+	CRYPTOPP_CONSTANT(STAGES = 32);
+
+	FixedSizeAlignedSecBlock<word32, 20 + 8*32> m_state;
+};
+
+namespace Weak {
+/// \brief Panama hash
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#Panama">Panama Hash</a>
+template <class B = LittleEndian>
+class PanamaHash : protected Panama<B>, public AlgorithmImpl<IteratedHash<word32, NativeByteOrder, 32>, PanamaHash<B> >
+{
+public:
+	CRYPTOPP_CONSTANT(DIGESTSIZE = 32);
+	virtual ~PanamaHash() {}
+	PanamaHash() {Panama<B>::Reset();}
+	unsigned int DigestSize() const {return DIGESTSIZE;}
+	void TruncatedFinal(byte *hash, size_t size);
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return B::ToEnum() == BIG_ENDIAN_ORDER ? "Panama-BE" : "Panama-LE";}
+	std::string AlgorithmProvider() const {return Panama<B>::AlgorithmProvider();} // Fix https://github.com/weidai11/cryptopp/issues/801
+
+protected:
+	void Init() {Panama<B>::Reset();}
+	void HashEndianCorrectedBlock(const word32 *data) {this->Iterate(1, data);}	// push
+	size_t HashMultipleBlocks(const word32 *input, size_t length);
+	word32* StateBuf() {return NULLPTR;}
+
+	FixedSizeSecBlock<word32, 8> m_buf;
+};
+}
+
+/// \brief MAC construction using a hermetic hash function
+template <class T_Hash, class T_Info = T_Hash>
+class HermeticHashFunctionMAC : public AlgorithmImpl<SimpleKeyingInterfaceImpl<TwoBases<MessageAuthenticationCode, VariableKeyLength<32, 0, INT_MAX> > >, T_Info>
+{
+public:
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+	{
+		CRYPTOPP_UNUSED(params);
+
+		m_key.Assign(key, length);
+		Restart();
+	}
+
+	void Restart()
+	{
+		m_hash.Restart();
+		m_keyed = false;
+	}
+
+	void Update(const byte *input, size_t length)
+	{
+		if (!m_keyed)
+			KeyHash();
+		m_hash.Update(input, length);
+	}
+
+	void TruncatedFinal(byte *digest, size_t digestSize)
+	{
+		if (!m_keyed)
+			KeyHash();
+		m_hash.TruncatedFinal(digest, digestSize);
+		m_keyed = false;
+	}
+
+	unsigned int DigestSize() const
+		{return m_hash.DigestSize();}
+	unsigned int BlockSize() const
+		{return m_hash.BlockSize();}
+	unsigned int OptimalBlockSize() const
+		{return m_hash.OptimalBlockSize();}
+	unsigned int OptimalDataAlignment() const
+		{return m_hash.OptimalDataAlignment();}
+
+protected:
+	void KeyHash()
+	{
+		m_hash.Update(m_key, m_key.size());
+		m_keyed = true;
+	}
+
+	T_Hash m_hash;
+	bool m_keyed;
+	SecByteBlock m_key;
+};
+
+namespace Weak {
+/// \brief Panama message authentication code
+template <class B = LittleEndian>
+class PanamaMAC : public HermeticHashFunctionMAC<PanamaHash<B> >
+{
+public:
+ 	PanamaMAC() {}
+	PanamaMAC(const byte *key, unsigned int length)
+		{this->SetKey(key, length);}
+};
+}
+
+/// \brief Panama stream cipher information
+template <class B>
+struct PanamaCipherInfo : public FixedKeyLength<32, SimpleKeyingInterface::UNIQUE_IV, 32>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return B::ToEnum() == BIG_ENDIAN_ORDER ? "Panama-BE" : "Panama-LE";}
+};
+
+/// \brief Panama stream cipher operation
+template <class B>
+class PanamaCipherPolicy : public AdditiveCipherConcretePolicy<word32, 8>,
+							public PanamaCipherInfo<B>,
+							protected Panama<B>
+{
+protected:
+	virtual ~PanamaCipherPolicy() {}
+	std::string AlgorithmProvider() const;
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	bool CipherIsRandomAccess() const {return false;}
+	void CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length);
+	unsigned int GetAlignment() const;
+
+	FixedSizeSecBlock<word32, 8> m_key;
+	FixedSizeSecBlock<word32, 8> m_buf;
+};
+
+/// \brief Panama stream cipher
+/// \sa <a href="http://www.cryptolounge.org/wiki/PANAMA">Panama Stream Cipher</a>
+template <class B = LittleEndian>
+struct PanamaCipher : public PanamaCipherInfo<B>, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<PanamaCipherPolicy<B>, AdditiveCipherTemplate<> >, PanamaCipherInfo<B> > Encryption;
+	typedef Encryption Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/pch.cpp b/runtime/third_party/cryptopp/pch.cpp
new file mode 100644
index 0000000..1d9f38c
--- /dev/null
+++ b/runtime/third_party/cryptopp/pch.cpp
@@ -0,0 +1 @@
+#include "pch.h"
diff --git a/runtime/third_party/cryptopp/pch.h b/runtime/third_party/cryptopp/pch.h
new file mode 100644
index 0000000..2cd163e
--- /dev/null
+++ b/runtime/third_party/cryptopp/pch.h
@@ -0,0 +1,31 @@
+// pch.h - originally written and placed in the public domain by Wei Dai
+
+/// \file pch.h
+/// \brief Precompiled header file
+/// \details The precompiled header files are used Windows.
+
+#ifndef CRYPTOPP_PCH_H
+#define CRYPTOPP_PCH_H
+
+# ifdef CRYPTOPP_GENERATE_X64_MASM
+	#include "cpu.h"
+
+# else
+	#include "config.h"
+
+	#ifdef USE_PRECOMPILED_HEADERS
+		#include "simple.h"
+		#include "secblock.h"
+		#include "misc.h"
+		#include "smartptr.h"
+		#include "stdcpp.h"
+	#endif
+# endif
+
+// Enable file and line numbers, if available.
+// #if defined(_MSC_VER) && defined(_DEBUG) && defined(USE_PRECOMPILED_HEADERS)
+// # define DEBUG_NEW new(_NORMAL_BLOCK, __FILE__, __LINE__)
+// # define new DEBUG_NEW
+// #endif
+
+#endif	// CRYPTOPP_PCH_H
diff --git a/runtime/third_party/cryptopp/pkcspad.cpp b/runtime/third_party/cryptopp/pkcspad.cpp
new file mode 100644
index 0000000..0e70c58
--- /dev/null
+++ b/runtime/third_party/cryptopp/pkcspad.cpp
@@ -0,0 +1,160 @@
+// pkcspad.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_PKCSPAD_CPP	// SunCC workaround: compiler could cause this file to be included twice
+#define CRYPTOPP_PKCSPAD_CPP
+
+#include "pkcspad.h"
+#include "emsa2.h"
+#include "hashfwd.h"
+#include "misc.h"
+#include "trap.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Typedef/cast change due to Clang, http://github.com/weidai11/cryptopp/issues/300
+template<> const byte PKCS_DigestDecoration<Weak1::MD2>::decoration[] = {0x30,0x20,0x30,0x0c,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x02,0x05,0x00,0x04,0x10};
+template<> const unsigned int PKCS_DigestDecoration<Weak1::MD2>::length = (unsigned int)sizeof(PKCS_DigestDecoration<Weak1::MD2>::decoration);
+
+template<> const byte PKCS_DigestDecoration<Weak1::MD5>::decoration[] = {0x30,0x20,0x30,0x0c,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x05,0x05,0x00,0x04,0x10};
+template<> const unsigned int PKCS_DigestDecoration<Weak1::MD5>::length = (unsigned int)sizeof(PKCS_DigestDecoration<Weak1::MD5>::decoration);
+
+template<> const byte PKCS_DigestDecoration<RIPEMD160>::decoration[] = {0x30,0x21,0x30,0x09,0x06,0x05,0x2b,0x24,0x03,0x02,0x01,0x05,0x00,0x04,0x14};
+template<> const unsigned int PKCS_DigestDecoration<RIPEMD160>::length = (unsigned int)sizeof(PKCS_DigestDecoration<RIPEMD160>::decoration);
+
+template<> const byte PKCS_DigestDecoration<Tiger>::decoration[] = {0x30,0x29,0x30,0x0D,0x06,0x09,0x2B,0x06,0x01,0x04,0x01,0xDA,0x47,0x0C,0x02,0x05,0x00,0x04,0x18};
+template<> const unsigned int PKCS_DigestDecoration<Tiger>::length = (unsigned int)sizeof(PKCS_DigestDecoration<Tiger>::decoration);
+
+// Inclusion based on DLL due to Clang, http://github.com/weidai11/cryptopp/issues/300
+#ifndef CRYPTOPP_IS_DLL
+template<> const byte PKCS_DigestDecoration<SHA1>::decoration[] = {0x30,0x21,0x30,0x09,0x06,0x05,0x2B,0x0E,0x03,0x02,0x1A,0x05,0x00,0x04,0x14};
+template<> const unsigned int PKCS_DigestDecoration<SHA1>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA1>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA224>::decoration[] = {0x30,0x2d,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x04,0x05,0x00,0x04,0x1c};
+template<> const unsigned int PKCS_DigestDecoration<SHA224>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA224>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA256>::decoration[] = {0x30,0x31,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x01,0x05,0x00,0x04,0x20};
+template<> const unsigned int PKCS_DigestDecoration<SHA256>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA256>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA384>::decoration[] = {0x30,0x41,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x02,0x05,0x00,0x04,0x30};
+template<> const unsigned int PKCS_DigestDecoration<SHA384>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA384>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA512>::decoration[] = {0x30,0x51,0x30,0x0d, 0x06,0x09,0x60,0x86, 0x48,0x01,0x65,0x03, 0x04,0x02,0x03,0x05, 0x00,0x04,0x40};
+template<> const unsigned int PKCS_DigestDecoration<SHA512>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA512>::decoration);
+
+// http://github.com/weidai11/cryptopp/issues/517. OIDs and encoded prefixes found at
+// http://www.ietf.org/archive/id/draft-jivsov-openpgp-sha3-01.txt
+template<> const byte PKCS_DigestDecoration<SHA3_256>::decoration[] = {0x30,0x31,0x30,0x0d, 0x06,0x09,0x60,0x86, 0x48,0x01,0x65,0x03, 0x04,0x02,0x08,0x05, 0x00,0x04,0x20};
+template<> const unsigned int PKCS_DigestDecoration<SHA3_256>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA3_256>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA3_384>::decoration[] = {0x30,0x41,0x30,0x0d, 0x06,0x09,0x60,0x86, 0x48,0x01,0x65,0x03, 0x04,0x02,0x09,0x05, 0x00,0x04,0x30};
+template<> const unsigned int PKCS_DigestDecoration<SHA3_384>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA3_384>::decoration);
+
+template<> const byte PKCS_DigestDecoration<SHA3_512>::decoration[] = {0x30,0x51,0x30,0x0d, 0x06,0x09,0x60,0x86, 0x48,0x01,0x65,0x03, 0x04,0x02,0x0a,0x05, 0x00,0x04,0x40};
+template<> const unsigned int PKCS_DigestDecoration<SHA3_512>::length = (unsigned int)sizeof(PKCS_DigestDecoration<SHA3_512>::decoration);
+#endif
+
+size_t PKCS_EncryptionPaddingScheme::MaxUnpaddedLength(size_t paddedLength) const
+{
+	return SaturatingSubtract(paddedLength/8, 10U);
+}
+
+void PKCS_EncryptionPaddingScheme::Pad(RandomNumberGenerator& rng, const byte *input, size_t inputLen, byte *pkcsBlock, size_t pkcsBlockLen, const NameValuePairs& parameters) const
+{
+	CRYPTOPP_UNUSED(parameters);
+	CRYPTOPP_ASSERT (inputLen <= MaxUnpaddedLength(pkcsBlockLen));	// this should be checked by caller
+
+	// convert from bit length to byte length
+	if (pkcsBlockLen % 8 != 0)
+	{
+		pkcsBlock[0] = 0;
+		pkcsBlock++;
+	}
+	pkcsBlockLen /= 8;
+
+	pkcsBlock[0] = 2;  // block type 2
+
+	// pad with non-zero random bytes
+	for (unsigned i = 1; i < pkcsBlockLen-inputLen-1; i++)
+		pkcsBlock[i] = (byte)rng.GenerateWord32(1, 0xff);
+
+	pkcsBlock[pkcsBlockLen-inputLen-1] = 0;     // separator
+	std::memcpy(pkcsBlock+pkcsBlockLen-inputLen, input, inputLen);
+}
+
+DecodingResult PKCS_EncryptionPaddingScheme::Unpad(const byte *pkcsBlock, size_t pkcsBlockLen, byte *output, const NameValuePairs& parameters) const
+{
+	CRYPTOPP_UNUSED(parameters);
+	bool invalid = false;
+	size_t maxOutputLen = MaxUnpaddedLength(pkcsBlockLen);
+
+	// convert from bit length to byte length
+	if (pkcsBlockLen % 8 != 0)
+	{
+		invalid = (pkcsBlock[0] != 0) || invalid;
+		pkcsBlock++;
+	}
+	pkcsBlockLen /= 8;
+
+	// Require block type 2.
+	invalid = (pkcsBlock[0] != 2) || invalid;
+
+	// skip past the padding until we find the separator
+	size_t i=1;
+	while (i<pkcsBlockLen && pkcsBlock[i++]) { // null body
+		}
+	CRYPTOPP_ASSERT(i==pkcsBlockLen || pkcsBlock[i-1]==0);
+
+	size_t outputLen = pkcsBlockLen - i;
+	invalid = (outputLen > maxOutputLen) || invalid;
+
+	if (invalid)
+		return DecodingResult();
+
+	std::memcpy (output, pkcsBlock+i, outputLen);
+	return DecodingResult(outputLen);
+}
+
+// ********************************************************
+
+#ifndef CRYPTOPP_IMPORTS
+
+void PKCS1v15_SignatureMessageEncodingMethod::ComputeMessageRepresentative(RandomNumberGenerator &rng,
+	const byte *recoverableMessage, size_t recoverableMessageLength,
+	HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+	byte *representative, size_t representativeBitLength) const
+{
+	CRYPTOPP_UNUSED(rng), CRYPTOPP_UNUSED(recoverableMessage), CRYPTOPP_UNUSED(recoverableMessageLength);
+	CRYPTOPP_UNUSED(messageEmpty), CRYPTOPP_UNUSED(hashIdentifier);
+	CRYPTOPP_ASSERT(representativeBitLength >= MinRepresentativeBitLength(hashIdentifier.second, hash.DigestSize()));
+
+	size_t pkcsBlockLen = representativeBitLength;
+	// convert from bit length to byte length
+	if (pkcsBlockLen % 8 != 0)
+	{
+		representative[0] = 0;
+		representative++;
+	}
+	pkcsBlockLen /= 8;
+
+	representative[0] = 1;   // block type 1
+
+	unsigned int digestSize = hash.DigestSize();
+	byte *pPadding = representative + 1;
+	byte *pDigest = representative + pkcsBlockLen - digestSize;
+	byte *pHashId = pDigest - hashIdentifier.second;
+	byte *pSeparator = pHashId - 1;
+
+	// pad with 0xff
+	std::memset(pPadding, 0xff, pSeparator-pPadding);
+	*pSeparator = 0;
+	std::memcpy(pHashId, hashIdentifier.first, hashIdentifier.second);
+	hash.Final(pDigest);
+}
+
+#endif
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/pkcspad.h b/runtime/third_party/cryptopp/pkcspad.h
new file mode 100644
index 0000000..f112c52
--- /dev/null
+++ b/runtime/third_party/cryptopp/pkcspad.h
@@ -0,0 +1,123 @@
+// pkcspad.h - originally written and placed in the public domain by Wei Dai
+
+/// \file pkcspad.h
+/// \brief Classes for PKCS padding schemes
+/// \details PKCS #1 v1.5, v2.0 and P1363a allow MD2, MD5, SHA1, SHA224, SHA256, SHA384,
+///   SHA512, Tiger and RipeMd-160 to be instantiated.
+
+#ifndef CRYPTOPP_PKCSPAD_H
+#define CRYPTOPP_PKCSPAD_H
+
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "hashfwd.h"
+
+#ifdef CRYPTOPP_IS_DLL
+#include "sha.h"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief PKCS #1 v1.5 Encryption Padding Scheme
+/// \sa <a href="http://www.weidai.com/scan-mirror/ca.html#cem_PKCS1-1.5">EME-PKCS1-v1_5</a>
+class PKCS_EncryptionPaddingScheme : public PK_EncryptionMessageEncodingMethod
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "EME-PKCS1-v1_5";}
+
+	size_t MaxUnpaddedLength(size_t paddedLength) const;
+	void Pad(RandomNumberGenerator &rng, const byte *raw, size_t inputLength, byte *padded, size_t paddedLength, const NameValuePairs &parameters) const;
+	DecodingResult Unpad(const byte *padded, size_t paddedLength, byte *raw, const NameValuePairs &parameters) const;
+};
+
+/// \brief PKCS #1 decoration data structure
+template <class H> class PKCS_DigestDecoration
+{
+public:
+	static const byte decoration[];
+	static const unsigned int length;
+};
+
+// PKCS_DigestDecoration can be instantiated with the following
+// classes as specified in PKCS #1 v2.0 and P1363a
+// SHA1, SHA224, SHA256, SHA384, SHA512, Tiger, RIPEMD160, MD2, MD5
+
+#if defined(CRYPTOPP_IS_DLL)
+CRYPTOPP_DLL_TEMPLATE_CLASS PKCS_DigestDecoration<SHA1>;
+CRYPTOPP_DLL_TEMPLATE_CLASS PKCS_DigestDecoration<SHA224>;
+CRYPTOPP_DLL_TEMPLATE_CLASS PKCS_DigestDecoration<SHA256>;
+CRYPTOPP_DLL_TEMPLATE_CLASS PKCS_DigestDecoration<SHA384>;
+CRYPTOPP_DLL_TEMPLATE_CLASS PKCS_DigestDecoration<SHA512>;
+// http://github.com/weidai11/cryptopp/issues/517
+CRYPTOPP_DLL_TEMPLATE_CLASS PKCS_DigestDecoration<SHA3_256>;
+CRYPTOPP_DLL_TEMPLATE_CLASS PKCS_DigestDecoration<SHA3_384>;
+CRYPTOPP_DLL_TEMPLATE_CLASS PKCS_DigestDecoration<SHA3_512>;
+#endif
+
+// https://github.com/weidai11/cryptopp/issues/300 and
+// https://github.com/weidai11/cryptopp/issues/533
+#if defined(__clang__)
+template<> const byte PKCS_DigestDecoration<SHA1>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<SHA1>::length;
+template<> const byte PKCS_DigestDecoration<SHA224>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<SHA224>::length;
+template<> const byte PKCS_DigestDecoration<SHA256>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<SHA256>::length;
+template<> const byte PKCS_DigestDecoration<SHA384>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<SHA384>::length;
+template<> const byte PKCS_DigestDecoration<SHA512>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<SHA512>::length;
+
+// http://github.com/weidai11/cryptopp/issues/517
+template<> const byte PKCS_DigestDecoration<SHA3_256>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<SHA3_256>::length;
+template<> const byte PKCS_DigestDecoration<SHA3_384>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<SHA3_384>::length;
+template<> const byte PKCS_DigestDecoration<SHA3_512>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<SHA3_512>::length;
+
+template<> const byte PKCS_DigestDecoration<Weak1::MD2>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<Weak1::MD2>::length;
+template<> const byte PKCS_DigestDecoration<Weak1::MD5>::decoration[];
+template<> const unsigned int PKCS_DigestDecoration<Weak1::MD5>::length;
+#endif
+
+/// \brief PKCS #1 v1.5 Signature Encoding Scheme
+/// \sa <a href="http://www.weidai.com/scan-mirror/sig.html#sem_PKCS1-1.5">EMSA-PKCS1-v1_5</a>
+class CRYPTOPP_DLL PKCS1v15_SignatureMessageEncodingMethod : public PK_DeterministicSignatureMessageEncodingMethod
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "EMSA-PKCS1-v1_5";}
+
+	size_t MinRepresentativeBitLength(size_t hashIdentifierSize, size_t digestSize) const
+		{return 8 * (digestSize + hashIdentifierSize + 10);}
+
+	void ComputeMessageRepresentative(RandomNumberGenerator &rng,
+		const byte *recoverableMessage, size_t recoverableMessageLength,
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const;
+
+	struct HashIdentifierLookup
+	{
+		template <class H> struct HashIdentifierLookup2
+		{
+			static HashIdentifier Lookup()
+			{
+				return HashIdentifier(PKCS_DigestDecoration<H>::decoration, PKCS_DigestDecoration<H>::length);
+			}
+		};
+	};
+};
+
+/// \brief PKCS #1 version 1.5, for use with RSAES and RSASS
+/// \dontinclude pkcspad.h
+
+struct PKCS1v15 : public SignatureStandard, public EncryptionStandard
+{
+	typedef PKCS_EncryptionPaddingScheme EncryptionMessageEncodingMethod;
+	typedef PKCS1v15_SignatureMessageEncodingMethod SignatureMessageEncodingMethod;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/poly1305.cpp b/runtime/third_party/cryptopp/poly1305.cpp
new file mode 100644
index 0000000..d6ac423
--- /dev/null
+++ b/runtime/third_party/cryptopp/poly1305.cpp
@@ -0,0 +1,403 @@
+// poly1305.cpp - written and placed in the public domain by Jeffrey Walton and Jean-Pierre Munch
+//                Based on Andy Polyakov's Base-2^26 scalar multiplication implementation.
+//                For more information, see https://www.openssl.org/~appro/cryptogams/.
+
+// Copyright (c) 2006-2017, CRYPTOGAMS by <appro@openssl.org>
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+//
+// * Redistributions of source code must retain copyright notices,
+//   this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+//   copyright notice, this list of conditions and the following
+//   disclaimer in the documentation and/or other materials
+//   provided with the distribution.
+// * Neither the name of the CRYPTOGAMS nor the names of its copyright
+//   holder and contributors may be used to endorse or promote products
+//   derived from this software without specific prior written permission.
+
+#include "pch.h"
+#include "cryptlib.h"
+#include "poly1305.h"
+#include "aes.h"
+#include "cpu.h"
+
+////////////////////////////// Common Poly1305 //////////////////////////////
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using namespace CryptoPP;
+
+inline word32 CONSTANT_TIME_CARRY(word32 a, word32 b)
+{
+	return ((a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1));
+}
+
+void Poly1305_HashBlocks(word32 h[5], word32 r[4], const byte *input, size_t length, word32 padbit)
+{
+	word32 r0, r1, r2, r3;
+	word32 s1, s2, s3;
+	word32 h0, h1, h2, h3, h4, c;
+	word64 d0, d1, d2, d3;
+
+	r0 = r[0]; r1 = r[1];
+	r2 = r[2]; r3 = r[3];
+
+	s1 = r1 + (r1 >> 2);
+	s2 = r2 + (r2 >> 2);
+	s3 = r3 + (r3 >> 2);
+
+	h0 = h[0]; h1 = h[1]; h2 = h[2];
+	h3 = h[3]; h4 = h[4];
+
+	while (length >= 16)
+	{
+		// h += m[i]
+		h0 = (word32)(d0 = (word64)h0 +	             GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input +  0));
+		h1 = (word32)(d1 = (word64)h1 + (d0 >> 32) + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input +  4));
+		h2 = (word32)(d2 = (word64)h2 + (d1 >> 32) + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input +  8));
+		h3 = (word32)(d3 = (word64)h3 + (d2 >> 32) + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input + 12));
+		h4 += (word32)(d3 >> 32) + padbit;
+
+		// h *= r "%" p
+		d0 = ((word64)h0 * r0) +
+			 ((word64)h1 * s3) +
+			 ((word64)h2 * s2) +
+			 ((word64)h3 * s1);
+		d1 = ((word64)h0 * r1) +
+			 ((word64)h1 * r0) +
+			 ((word64)h2 * s3) +
+			 ((word64)h3 * s2) +
+			 (h4 * s1);
+		d2 = ((word64)h0 * r2) +
+			 ((word64)h1 * r1) +
+			 ((word64)h2 * r0) +
+			 ((word64)h3 * s3) +
+			 (h4 * s2);
+		d3 = ((word64)h0 * r3) +
+			 ((word64)h1 * r2) +
+			 ((word64)h2 * r1) +
+			 ((word64)h3 * r0) +
+			 (h4 * s3);
+		h4 = (h4 * r0);
+
+		// a) h4:h0 = h4<<128 + d3<<96 + d2<<64 + d1<<32 + d0
+		h0 = (word32)d0;
+		h1 = (word32)(d1 += d0 >> 32);
+		h2 = (word32)(d2 += d1 >> 32);
+		h3 = (word32)(d3 += d2 >> 32);
+		h4 += (word32)(d3 >> 32);
+
+		// b) (h4:h0 += (h4:h0>>130) * 5) %= 2^130
+		c = (h4 >> 2) + (h4 & ~3U);
+		h4 &= 3;
+		h0 += c;
+		h1 += (c = CONSTANT_TIME_CARRY(h0,c));
+		h2 += (c = CONSTANT_TIME_CARRY(h1,c));
+		h3 += (c = CONSTANT_TIME_CARRY(h2,c));
+		h4 +=      CONSTANT_TIME_CARRY(h3,c);
+
+		input += 16;
+		length -= 16;
+	}
+
+	h[0] = h0; h[1] = h1; h[2] = h2;
+	h[3] = h3; h[4] = h4;
+}
+
+void Poly1305_HashFinal(word32 h[5], word32 n[4], byte *mac, size_t size)
+{
+	word32 h0, h1, h2, h3, h4;
+	word32 g0, g1, g2, g3, g4;
+	word32 mask;
+	word64 t;
+
+	h0 = h[0];
+	h1 = h[1];
+	h2 = h[2];
+	h3 = h[3];
+	h4 = h[4];
+
+	// compare to modulus by computing h + -p
+	g0 = (word32)(t = (word64)h0 + 5);
+	g1 = (word32)(t = (word64)h1 + (t >> 32));
+	g2 = (word32)(t = (word64)h2 + (t >> 32));
+	g3 = (word32)(t = (word64)h3 + (t >> 32));
+	g4 = h4 + (word32)(t >> 32);
+
+	// if there was carry into 131st bit, h3:h0 = g3:g0
+	mask = 0 - (g4 >> 2);
+	g0 &= mask; g1 &= mask;
+	g2 &= mask; g3 &= mask;
+	mask = ~mask;
+	h0 = (h0 & mask) | g0; h1 = (h1 & mask) | g1;
+	h2 = (h2 & mask) | g2; h3 = (h3 & mask) | g3;
+
+	// mac = (h + nonce) % (2^128)
+	h0 = (word32)(t = (word64)h0 + n[0]);
+	h1 = (word32)(t = (word64)h1 + (t >> 32) + n[1]);
+	h2 = (word32)(t = (word64)h2 + (t >> 32) + n[2]);
+	h3 = (word32)(t = (word64)h3 + (t >> 32) + n[3]);
+
+	if (size >= 16)
+	{
+		PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac +  0, h0);
+		PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac +  4, h1);
+		PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac +  8, h2);
+		PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac + 12, h3);
+	}
+	else
+	{
+		FixedSizeAlignedSecBlock<byte, 16> m;
+		PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m +  0, h0);
+		PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m +  4, h1);
+		PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m +  8, h2);
+		PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m + 12, h3);
+		std::memcpy(mac, m, size);
+	}
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+////////////////////////////// Bernstein Poly1305 //////////////////////////////
+
+// TODO: No longer needed. Remove at next major version bump
+template <class T>
+void Poly1305_Base<T>::HashBlocks(const byte *input, size_t length, word32 padbit) {
+	CRYPTOPP_UNUSED(input); CRYPTOPP_UNUSED(length); CRYPTOPP_UNUSED(padbit);
+	CRYPTOPP_ASSERT(0);
+}
+
+// TODO: No longer needed. Remove at next major version bump
+template <class T>
+void Poly1305_Base<T>::HashFinal(byte *mac, size_t length) {
+	CRYPTOPP_UNUSED(mac); CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(0);
+}
+
+template <class T>
+std::string Poly1305_Base<T>::AlgorithmProvider() const
+{
+	return m_cipher.AlgorithmProvider();
+}
+
+template <class T>
+void Poly1305_Base<T>::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	CRYPTOPP_ASSERT(key && length >= 32);
+
+	// key is {k,r} pair. k is AES key, r is the additional key that gets clamped
+	length = SaturatingSubtract(length, (unsigned)BLOCKSIZE);
+	m_cipher.SetKey(key, length);
+	key += length;
+
+	// Rbar is clamped and little endian
+	m_r[0] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key +  0) & 0x0fffffff;
+	m_r[1] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key +  4) & 0x0ffffffc;
+	m_r[2] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key +  8) & 0x0ffffffc;
+	m_r[3] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 12) & 0x0ffffffc;
+
+	// Mark the nonce as dirty, meaning we need a new one
+	m_used = true;
+
+	ConstByteArrayParameter t;
+	if (params.GetValue(Name::IV(), t) && t.begin() && t.size())
+	{
+		CRYPTOPP_ASSERT(t.size() == m_nk.size());
+		Resynchronize(t.begin(), (int)t.size());
+	}
+
+	Restart();
+}
+
+template <class T>
+void Poly1305_Base<T>::Update(const byte *input, size_t length)
+{
+	CRYPTOPP_ASSERT((input && length) || !length);
+	if (!length) return;
+
+	size_t rem, num = m_idx;
+	if (num)
+	{
+		rem = BLOCKSIZE - num;
+		if (length >= rem)
+		{
+			// Process
+			memcpy_s(m_acc + num, BLOCKSIZE - num, input, rem);
+			Poly1305_HashBlocks(m_h, m_r, m_acc, BLOCKSIZE, 1);
+			input += rem; length -= rem;
+		}
+		else
+		{
+			// Accumulate
+			memcpy_s(m_acc + num, BLOCKSIZE - num, input, length);
+			m_idx = num + length;
+			return;
+		}
+	}
+
+	rem = length % BLOCKSIZE;
+	length -= rem;
+
+	if (length >= BLOCKSIZE) {
+		Poly1305_HashBlocks(m_h, m_r, input, length, 1);
+		input += length;
+	}
+
+	if (rem)
+		std::memcpy(m_acc, input, rem);
+
+	m_idx = rem;
+}
+
+template <class T>
+void Poly1305_Base<T>::TruncatedFinal(byte *mac, size_t size)
+{
+	CRYPTOPP_ASSERT(mac);      // Pointer is valid
+	CRYPTOPP_ASSERT(!m_used);  // Nonce is fresh
+
+	ThrowIfInvalidTruncatedSize(size);
+
+	size_t num = m_idx;
+	if (num)
+	{
+		m_acc[num++] = 1;   /* pad bit */
+		while (num < BLOCKSIZE)
+			m_acc[num++] = 0;
+		Poly1305_HashBlocks(m_h, m_r, m_acc, BLOCKSIZE, 0);
+	}
+
+	Poly1305_HashFinal(m_h, m_n, mac, size);
+
+	// Restart
+	m_used = true;
+	Restart();
+}
+
+template <class T>
+void Poly1305_Base<T>::Resynchronize(const byte *nonce, int nonceLength)
+{
+	CRYPTOPP_ASSERT(nonceLength == -1 || nonceLength == (int)BLOCKSIZE);
+	if (nonceLength == -1) { nonceLength = BLOCKSIZE; }
+
+	// Encrypt the nonce, stash in m_nk
+	m_cipher.ProcessBlock(nonce, m_nk.begin());
+
+	m_n[0] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, m_nk +  0);
+	m_n[1] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, m_nk +  4);
+	m_n[2] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, m_nk +  8);
+	m_n[3] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, m_nk + 12);
+
+	// Mark nonce as unused, meaning it is fresh
+	m_used = false;
+}
+
+template <class T>
+void Poly1305_Base<T>::GetNextIV(RandomNumberGenerator &rng, byte *iv)
+{
+	rng.GenerateBlock(iv, BLOCKSIZE);
+}
+
+template <class T>
+void Poly1305_Base<T>::Restart()
+{
+	m_h[0] = m_h[1] = m_h[2] = m_h[3] = m_h[4] = 0;
+	m_idx = 0;
+}
+
+////////////////////////////// IETF Poly1305 //////////////////////////////
+
+void Poly1305TLS_Base::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	CRYPTOPP_UNUSED(params); CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(key && length >= 32);
+
+	// key is {r,s} pair. r is the additional key that gets clamped, s is the nonce.
+	m_r[0] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key +  0) & 0x0fffffff;
+	m_r[1] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key +  4) & 0x0ffffffc;
+	m_r[2] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key +  8) & 0x0ffffffc;
+	m_r[3] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 12) & 0x0ffffffc;
+
+	key += 16;
+	m_n[0] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key +  0);
+	m_n[1] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key +  4);
+	m_n[2] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key +  8);
+	m_n[3] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 12);
+
+	Restart();
+}
+
+void Poly1305TLS_Base::Update(const byte *input, size_t length)
+{
+	CRYPTOPP_ASSERT((input && length) || !length);
+	if (!length) return;
+
+	size_t rem, num = m_idx;
+	if (num)
+	{
+		rem = BLOCKSIZE - num;
+		if (length >= rem)
+		{
+			// Process
+			memcpy_s(m_acc + num, BLOCKSIZE - num, input, rem);
+			Poly1305_HashBlocks(m_h, m_r, m_acc, BLOCKSIZE, 1);
+			input += rem; length -= rem;
+		}
+		else
+		{
+			// Accumulate
+			memcpy_s(m_acc + num, BLOCKSIZE - num, input, length);
+			m_idx = num + length;
+			return;
+		}
+	}
+
+	rem = length % BLOCKSIZE;
+	length -= rem;
+
+	if (length >= BLOCKSIZE) {
+		Poly1305_HashBlocks(m_h, m_r, input, length, 1);
+		input += length;
+	}
+
+	if (rem)
+		std::memcpy(m_acc, input, rem);
+
+	m_idx = rem;
+}
+
+void Poly1305TLS_Base::TruncatedFinal(byte *mac, size_t size)
+{
+	CRYPTOPP_ASSERT(mac);      // Pointer is valid
+
+	ThrowIfInvalidTruncatedSize(size);
+
+	size_t num = m_idx;
+	if (num)
+	{
+		m_acc[num++] = 1;   /* pad bit */
+		while (num < BLOCKSIZE)
+			m_acc[num++] = 0;
+		Poly1305_HashBlocks(m_h, m_r, m_acc, BLOCKSIZE, 0);
+	}
+
+	Poly1305_HashFinal(m_h, m_n, mac, size);
+
+	Restart();
+}
+
+void Poly1305TLS_Base::Restart()
+{
+	m_h[0] = m_h[1] = m_h[2] = m_h[3] = m_h[4] = 0;
+	m_idx = 0;
+}
+
+template class Poly1305_Base<AES>;
+template class Poly1305<AES>;
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/poly1305.h b/runtime/third_party/cryptopp/poly1305.h
new file mode 100644
index 0000000..19e712b
--- /dev/null
+++ b/runtime/third_party/cryptopp/poly1305.h
@@ -0,0 +1,241 @@
+// poly1305.h - written and placed in the public domain by Jeffrey Walton and Jean-Pierre Munch
+//              Based on Andy Polyakov's Base-2^26 scalar multiplication implementation.
+//              For more information, see https://www.openssl.org/~appro/cryptogams/.
+
+// The library added Bernstein's Poly1305 classes at Crypto++ 6.0. The IETF
+// uses a slightly different implementation than Bernstein, and the IETF
+// classes were added at Crypto++ 8.1. We wanted to maintain ABI compatibility
+// at the 8.1 release so the original Poly1305 classes were not disturbed.
+// Instead new classes were added for IETF Poly1305. The back-end implementation
+// shares code as expected, however.
+
+/// \file poly1305.h
+/// \brief Classes for Poly1305 message authentication code
+/// \details Poly1305-AES is a state-of-the-art message-authentication code suitable for a wide
+///   variety of applications. Poly1305-AES computes a 16-byte authenticator of a variable-length
+///   message, using a 16-byte AES key, a 16-byte additional key, and a 16-byte nonce.
+/// \details Crypto++ also supplies the IETF's version of Poly1305. It is a slightly different
+///   algorithm than Bernstein's version.
+/// \sa Daniel J. Bernstein <A HREF="http://cr.yp.to/mac/poly1305-20050329.pdf">The Poly1305-AES
+///   Message-Authentication Code (20050329)</A>, <a href="http://tools.ietf.org/html/rfc8439">RFC
+///   8439, ChaCha20 and Poly1305 for IETF Protocols</a> and Andy Polyakov <A
+///   HREF="http://www.openssl.org/blog/blog/2016/02/15/poly1305-revised/">Poly1305 Revised</A>
+/// \since Poly1305 since Crypto++ 6.0, Poly1305TLS since Crypto++ 8.1
+
+#ifndef CRYPTOPP_POLY1305_H
+#define CRYPTOPP_POLY1305_H
+
+#include "cryptlib.h"
+#include "seckey.h"
+#include "secblock.h"
+#include "argnames.h"
+#include "algparam.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+////////////////////////////// Bernstein Poly1305 //////////////////////////////
+
+/// \brief Poly1305 message authentication code base class
+/// \tparam T BlockCipherDocumentation derived class with 16-byte key and 16-byte blocksize
+/// \details Poly1305_Base is the base class of Bernstein's Poly1305 algorithm.
+/// \since Crypto++ 6.0
+template <class T>
+class CRYPTOPP_NO_VTABLE Poly1305_Base : public FixedKeyLength<32, SimpleKeyingInterface::UNIQUE_IV, 16>, public MessageAuthenticationCode
+{
+	CRYPTOPP_COMPILE_ASSERT(T::DEFAULT_KEYLENGTH == 16);
+	CRYPTOPP_COMPILE_ASSERT(T::BLOCKSIZE == 16);
+
+public:
+	static std::string StaticAlgorithmName() {return std::string("Poly1305(") + T::StaticAlgorithmName() + ")";}
+
+	CRYPTOPP_CONSTANT(DIGESTSIZE=T::BLOCKSIZE);
+	CRYPTOPP_CONSTANT(BLOCKSIZE=T::BLOCKSIZE);
+
+	virtual ~Poly1305_Base() {}
+	Poly1305_Base() : m_idx(0), m_used(true) {}
+
+	void Resynchronize (const byte *iv, int ivLength=-1);
+	void GetNextIV (RandomNumberGenerator &rng, byte *iv);
+
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *mac, size_t size);
+	void Restart();
+
+	unsigned int BlockSize() const {return BLOCKSIZE;}
+	unsigned int DigestSize() const {return DIGESTSIZE;}
+
+	std::string AlgorithmProvider() const;
+
+protected:
+	// TODO: No longer needed. Remove at next major version bump
+	void HashBlocks(const byte *input, size_t length, word32 padbit);
+	void HashFinal(byte *mac, size_t length);
+
+	typename T::Encryption m_cipher;
+
+	// Accumulated hash, clamped r-key, and encrypted nonce
+	FixedSizeAlignedSecBlock<word32, 5> m_h;
+	FixedSizeAlignedSecBlock<word32, 4> m_r;
+	FixedSizeAlignedSecBlock<word32, 4> m_n;
+
+	// Accumulated message bytes and index
+	FixedSizeAlignedSecBlock<byte, BLOCKSIZE> m_acc, m_nk;
+	size_t m_idx;
+
+	// Track nonce reuse; assert in debug but continue
+	bool m_used;
+};
+
+/// \brief Poly1305 message authentication code
+/// \tparam T class derived from BlockCipherDocumentation with 16-byte key and 16-byte blocksize
+/// \details Poly1305-AES is a state-of-the-art message-authentication code suitable for a wide
+///   variety of applications. Poly1305-AES computes a 16-byte authenticator of a variable-length
+///   message, using a 16-byte AES key, a 16-byte additional key, and a 16-byte nonce.
+/// \details The key is 32 bytes and a concatenation <tt>key = {k,s}</tt>, where
+///   <tt>k</tt> is the AES key and <tt>r</tt> is additional key that gets clamped.
+///   The key is clamped internally so there is no need to perform the operation
+///   before setting the key.
+/// \details Each message must have a unique security context, which means either the key or nonce
+///   must be changed after each message. It can be accomplished in one of two ways. First, you
+///   can create a new Poly1305 object each time its needed.
+///   <pre>  SecByteBlock key(32), nonce(16);
+///   prng.GenerateBlock(key, key.size());
+///   prng.GenerateBlock(nonce, nonce.size());
+///
+///   Poly1305<AES> poly1305(key, key.size(), nonce, nonce.size());
+///   poly1305.Update(...);
+///   poly1305.Final(...);</pre>
+///
+/// \details Second, you can create a Poly1305 object, reuse the key, and set a fresh nonce
+///   for each message. The second and subsequent nonces can be generated using GetNextIV().
+///   <pre>  SecByteBlock key(32), nonce(16);
+///   prng.GenerateBlock(key, key.size());
+///   prng.GenerateBlock(nonce, nonce.size());
+///
+///   // First message
+///   Poly1305<AES> poly1305(key, key.size());
+///   poly1305.Resynchronize(nonce);
+///   poly1305.Update(...);
+///   poly1305.Final(...);
+///
+///   // Second message
+///   poly1305.GetNextIV(prng, nonce);
+///   poly1305.Resynchronize(nonce);
+///   poly1305.Update(...);
+///   poly1305.Final(...);
+///   ...</pre>
+/// \warning Each message must have a unique security context. The Poly1305 class does not
+///   enforce a fresh key or nonce for each message. The source code will assert in debug
+///   builds to alert of nonce reuse. No action is taken in release builds.
+/// \sa Daniel J. Bernstein <A HREF="http://cr.yp.to/mac/poly1305-20050329.pdf">The Poly1305-AES
+///   Message-Authentication Code (20050329)</A> and Andy Polyakov <A
+///   HREF="http://www.openssl.org/blog/blog/2016/02/15/poly1305-revised/">Poly1305 Revised</A>
+/// \since Crypto++ 6.0
+template <class T>
+class Poly1305 : public MessageAuthenticationCodeFinal<Poly1305_Base<T> >
+{
+public:
+	CRYPTOPP_CONSTANT(DEFAULT_KEYLENGTH=Poly1305_Base<T>::DEFAULT_KEYLENGTH);
+
+	/// \brief Construct a Poly1305
+	Poly1305() {}
+
+	/// \brief Construct a Poly1305
+	/// \param key a byte array used to key the cipher
+	/// \param keyLength the size of the byte array, in bytes
+	/// \param nonce a byte array used to key the cipher
+	/// \param nonceLength the size of the byte array, in bytes
+	/// \details The key is 32 bytes and a concatenation <tt>key = {k,s}</tt>, where
+	///   <tt>k</tt> is the AES key and <tt>r</tt> is additional key that gets clamped.
+	///   The key is clamped internally so there is no need to perform the operation
+	///   before setting the key.
+	/// \details Each message requires a unique security context. You can use GetNextIV()
+	///   and Resynchronize() to set a new nonce under a key for a message.
+	Poly1305(const byte *key, size_t keyLength=DEFAULT_KEYLENGTH, const byte *nonce=NULLPTR, size_t nonceLength=0)
+		{this->SetKey(key, keyLength, MakeParameters(Name::IV(), ConstByteArrayParameter(nonce, nonceLength)));}
+};
+
+////////////////////////////// IETF Poly1305 //////////////////////////////
+
+/// \brief Poly1305-TLS message authentication code base class
+/// \details Poly1305TLS_Base is the base class of the IETF's Poly1305 algorithm.
+/// \since Crypto++ 8.1
+class Poly1305TLS_Base : public FixedKeyLength<32>, public MessageAuthenticationCode
+{
+public:
+	static std::string StaticAlgorithmName() {return std::string("Poly1305TLS");}
+	CRYPTOPP_CONSTANT(DIGESTSIZE=16);
+	CRYPTOPP_CONSTANT(BLOCKSIZE=16);
+
+	virtual ~Poly1305TLS_Base() {}
+	Poly1305TLS_Base() {}
+
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+	void Update(const byte *input, size_t length);
+	void TruncatedFinal(byte *mac, size_t size);
+	void Restart();
+
+	unsigned int BlockSize() const {return BLOCKSIZE;}
+	unsigned int DigestSize() const {return DIGESTSIZE;}
+
+protected:
+	// Accumulated hash, clamped r-key, and encrypted nonce
+	FixedSizeAlignedSecBlock<word32, 5> m_h;
+	FixedSizeAlignedSecBlock<word32, 4> m_r;
+	FixedSizeAlignedSecBlock<word32, 4> m_n;
+
+	// Accumulated message bytes and index
+	FixedSizeAlignedSecBlock<byte, BLOCKSIZE> m_acc;
+	size_t m_idx;
+};
+
+/// \brief Poly1305-TLS message authentication code
+/// \details This is the IETF's variant of Bernstein's Poly1305 from RFC 8439.
+///   IETF Poly1305 is called Poly1305TLS in the Crypto++ library. It is
+///   _slightly_ different from the Bernstein implementation. Poly1305-TLS
+///   can be used for cipher suites
+///   <tt>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256</tt>,
+///   <tt>TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256</tt>, and
+///   <tt>TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256</tt>.
+/// \details The key is 32 bytes and a concatenation <tt>key = {r,s}</tt>, where
+///   <tt>r</tt> is additional key that gets clamped and <tt>s</tt> is the nonce.
+///   The key is clamped internally so there is no need to perform the operation
+///   before setting the key.
+/// \details Each message must have a unique security context, which means the key
+///   must be changed after each message. It can be accomplished in one of two ways.
+///   First, you can create a new Poly1305 object with a new key each time its needed.
+///   <pre>  SecByteBlock key(32);
+///   prng.GenerateBlock(key, key.size());
+///
+///   Poly1305TLS poly1305(key, key.size());
+///   poly1305.Update(...);
+///   poly1305.Final(...);</pre>
+///
+/// \details Second, you can create a Poly1305 object, and use a new key for each
+///   message. The keys can be generated directly using a RandomNumberGenerator()
+///   derived class.
+///   <pre>  SecByteBlock key(32);
+///   prng.GenerateBlock(key, key.size());
+///
+///   // First message
+///   Poly1305TLS poly1305(key, key.size());
+///   poly1305.Update(...);
+///   poly1305.Final(...);
+///
+///   // Second message
+///   prng.GenerateBlock(key, key.size());
+///   poly1305.SetKey(key, key.size());
+///   poly1305.Update(...);
+///   poly1305.Final(...);
+///   ...</pre>
+/// \warning Each message must have a unique security context. The Poly1305-TLS class
+///   does not enforce a fresh key or nonce for each message.
+/// \since Crypto++ 8.1
+/// \sa MessageAuthenticationCode(), <a href="http://tools.ietf.org/html/rfc8439">RFC
+///   8439, ChaCha20 and Poly1305 for IETF Protocols</a>
+DOCUMENTED_TYPEDEF(MessageAuthenticationCodeFinal<Poly1305TLS_Base>, Poly1305TLS);
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_POLY1305_H
diff --git a/runtime/third_party/cryptopp/polynomi.cpp b/runtime/third_party/cryptopp/polynomi.cpp
new file mode 100644
index 0000000..35bd676
--- /dev/null
+++ b/runtime/third_party/cryptopp/polynomi.cpp
@@ -0,0 +1,577 @@
+// polynomi.cpp - originally written and placed in the public domain by Wei Dai
+
+// Part of the code for polynomial evaluation and interpolation
+// originally came from Hal Finney's public domain secsplit.c.
+
+#include "pch.h"
+#include "polynomi.h"
+#include "secblock.h"
+
+#include <sstream>
+#include <iostream>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+template <class T>
+void PolynomialOver<T>::Randomize(RandomNumberGenerator &rng, const RandomizationParameter &parameter, const Ring &ring)
+{
+	m_coefficients.resize(parameter.m_coefficientCount);
+	for (unsigned int i=0; i<m_coefficients.size(); ++i)
+		m_coefficients[i] = ring.RandomElement(rng, parameter.m_coefficientParameter);
+}
+
+template <class T>
+void PolynomialOver<T>::FromStr(const char *str, const Ring &ring)
+{
+	std::istringstream in((char *)str);
+	bool positive = true;
+	CoefficientType coef;
+	unsigned int power;
+
+	while (in)
+	{
+		std::ws(in);
+		if (in.peek() == 'x')
+			coef = ring.MultiplicativeIdentity();
+		else
+			in >> coef;
+
+		std::ws(in);
+		if (in.peek() == 'x')
+		{
+			in.get();
+			std::ws(in);
+			if (in.peek() == '^')
+			{
+				in.get();
+				in >> power;
+			}
+			else
+				power = 1;
+		}
+		else
+			power = 0;
+
+		if (!positive)
+			coef = ring.Inverse(coef);
+
+		SetCoefficient(power, coef, ring);
+
+		std::ws(in);
+		switch (in.get())
+		{
+		case '+':
+			positive = true;
+			break;
+		case '-':
+			positive = false;
+			break;
+		default:
+			return;		// something's wrong with the input string
+		}
+	}
+}
+
+template <class T>
+unsigned int PolynomialOver<T>::CoefficientCount(const Ring &ring) const
+{
+	unsigned count = m_coefficients.size();
+	while (count && ring.Equal(m_coefficients[count-1], ring.Identity()))
+		count--;
+	const_cast<std::vector<CoefficientType> &>(m_coefficients).resize(count);
+	return count;
+}
+
+template <class T>
+typename PolynomialOver<T>::CoefficientType PolynomialOver<T>::GetCoefficient(unsigned int i, const Ring &ring) const
+{
+	return (i < m_coefficients.size()) ? m_coefficients[i] : ring.Identity();
+}
+
+template <class T>
+PolynomialOver<T>&  PolynomialOver<T>::operator=(const PolynomialOver<T>& t)
+{
+	if (this != &t)
+	{
+		m_coefficients.resize(t.m_coefficients.size());
+		for (unsigned int i=0; i<m_coefficients.size(); i++)
+			m_coefficients[i] = t.m_coefficients[i];
+	}
+	return *this;
+}
+
+template <class T>
+PolynomialOver<T>& PolynomialOver<T>::Accumulate(const PolynomialOver<T>& t, const Ring &ring)
+{
+	unsigned int count = t.CoefficientCount(ring);
+
+	if (count > CoefficientCount(ring))
+		m_coefficients.resize(count, ring.Identity());
+
+	for (unsigned int i=0; i<count; i++)
+		ring.Accumulate(m_coefficients[i], t.GetCoefficient(i, ring));
+
+	return *this;
+}
+
+template <class T>
+PolynomialOver<T>& PolynomialOver<T>::Reduce(const PolynomialOver<T>& t, const Ring &ring)
+{
+	unsigned int count = t.CoefficientCount(ring);
+
+	if (count > CoefficientCount(ring))
+		m_coefficients.resize(count, ring.Identity());
+
+	for (unsigned int i=0; i<count; i++)
+		ring.Reduce(m_coefficients[i], t.GetCoefficient(i, ring));
+
+	return *this;
+}
+
+template <class T>
+typename PolynomialOver<T>::CoefficientType PolynomialOver<T>::EvaluateAt(const CoefficientType &x, const Ring &ring) const
+{
+	int degree = Degree(ring);
+
+	if (degree < 0)
+		return ring.Identity();
+
+	CoefficientType result = m_coefficients[degree];
+	for (int j=degree-1; j>=0; j--)
+	{
+		result = ring.Multiply(result, x);
+		ring.Accumulate(result, m_coefficients[j]);
+	}
+	return result;
+}
+
+template <class T>
+PolynomialOver<T>& PolynomialOver<T>::ShiftLeft(unsigned int n, const Ring &ring)
+{
+	unsigned int i = CoefficientCount(ring) + n;
+	m_coefficients.resize(i, ring.Identity());
+	while (i > n)
+	{
+		i--;
+		m_coefficients[i] = m_coefficients[i-n];
+	}
+	while (i)
+	{
+		i--;
+		m_coefficients[i] = ring.Identity();
+	}
+	return *this;
+}
+
+template <class T>
+PolynomialOver<T>& PolynomialOver<T>::ShiftRight(unsigned int n, const Ring &ring)
+{
+	unsigned int count = CoefficientCount(ring);
+	if (count > n)
+	{
+		for (unsigned int i=0; i<count-n; i++)
+			m_coefficients[i] = m_coefficients[i+n];
+		m_coefficients.resize(count-n, ring.Identity());
+	}
+	else
+		m_coefficients.resize(0, ring.Identity());
+	return *this;
+}
+
+template <class T>
+void PolynomialOver<T>::SetCoefficient(unsigned int i, const CoefficientType &value, const Ring &ring)
+{
+	if (i >= m_coefficients.size())
+		m_coefficients.resize(i+1, ring.Identity());
+	m_coefficients[i] = value;
+}
+
+template <class T>
+void PolynomialOver<T>::Negate(const Ring &ring)
+{
+	unsigned int count = CoefficientCount(ring);
+	for (unsigned int i=0; i<count; i++)
+		m_coefficients[i] = ring.Inverse(m_coefficients[i]);
+}
+
+template <class T>
+void PolynomialOver<T>::swap(PolynomialOver<T> &t)
+{
+	m_coefficients.swap(t.m_coefficients);
+}
+
+template <class T>
+bool PolynomialOver<T>::Equals(const PolynomialOver<T>& t, const Ring &ring) const
+{
+	unsigned int count = CoefficientCount(ring);
+
+	if (count != t.CoefficientCount(ring))
+		return false;
+
+	for (unsigned int i=0; i<count; i++)
+		if (!ring.Equal(m_coefficients[i], t.m_coefficients[i]))
+			return false;
+
+	return true;
+}
+
+template <class T>
+PolynomialOver<T> PolynomialOver<T>::Plus(const PolynomialOver<T>& t, const Ring &ring) const
+{
+	unsigned int i;
+	unsigned int count = CoefficientCount(ring);
+	unsigned int tCount = t.CoefficientCount(ring);
+
+	if (count > tCount)
+	{
+		PolynomialOver<T> result(ring, count);
+
+		for (i=0; i<tCount; i++)
+			result.m_coefficients[i] = ring.Add(m_coefficients[i], t.m_coefficients[i]);
+		for (; i<count; i++)
+			result.m_coefficients[i] = m_coefficients[i];
+
+		return result;
+	}
+	else
+	{
+		PolynomialOver<T> result(ring, tCount);
+
+		for (i=0; i<count; i++)
+			result.m_coefficients[i] = ring.Add(m_coefficients[i], t.m_coefficients[i]);
+		for (; i<tCount; i++)
+			result.m_coefficients[i] = t.m_coefficients[i];
+
+		return result;
+	}
+}
+
+template <class T>
+PolynomialOver<T> PolynomialOver<T>::Minus(const PolynomialOver<T>& t, const Ring &ring) const
+{
+	unsigned int i;
+	unsigned int count = CoefficientCount(ring);
+	unsigned int tCount = t.CoefficientCount(ring);
+
+	if (count > tCount)
+	{
+		PolynomialOver<T> result(ring, count);
+
+		for (i=0; i<tCount; i++)
+			result.m_coefficients[i] = ring.Subtract(m_coefficients[i], t.m_coefficients[i]);
+		for (; i<count; i++)
+			result.m_coefficients[i] = m_coefficients[i];
+
+		return result;
+	}
+	else
+	{
+		PolynomialOver<T> result(ring, tCount);
+
+		for (i=0; i<count; i++)
+			result.m_coefficients[i] = ring.Subtract(m_coefficients[i], t.m_coefficients[i]);
+		for (; i<tCount; i++)
+			result.m_coefficients[i] = ring.Inverse(t.m_coefficients[i]);
+
+		return result;
+	}
+}
+
+template <class T>
+PolynomialOver<T> PolynomialOver<T>::Inverse(const Ring &ring) const
+{
+	unsigned int count = CoefficientCount(ring);
+	PolynomialOver<T> result(ring, count);
+
+	for (unsigned int i=0; i<count; i++)
+		result.m_coefficients[i] = ring.Inverse(m_coefficients[i]);
+
+	return result;
+}
+
+template <class T>
+PolynomialOver<T> PolynomialOver<T>::Times(const PolynomialOver<T>& t, const Ring &ring) const
+{
+	if (IsZero(ring) || t.IsZero(ring))
+		return PolynomialOver<T>();
+
+	unsigned int count1 = CoefficientCount(ring), count2 = t.CoefficientCount(ring);
+	PolynomialOver<T> result(ring, count1 + count2 - 1);
+
+	for (unsigned int i=0; i<count1; i++)
+		for (unsigned int j=0; j<count2; j++)
+			ring.Accumulate(result.m_coefficients[i+j], ring.Multiply(m_coefficients[i], t.m_coefficients[j]));
+
+	return result;
+}
+
+template <class T>
+PolynomialOver<T> PolynomialOver<T>::DividedBy(const PolynomialOver<T>& t, const Ring &ring) const
+{
+	PolynomialOver<T> remainder, quotient;
+	Divide(remainder, quotient, *this, t, ring);
+	return quotient;
+}
+
+template <class T>
+PolynomialOver<T> PolynomialOver<T>::Modulo(const PolynomialOver<T>& t, const Ring &ring) const
+{
+	PolynomialOver<T> remainder, quotient;
+	Divide(remainder, quotient, *this, t, ring);
+	return remainder;
+}
+
+template <class T>
+PolynomialOver<T> PolynomialOver<T>::MultiplicativeInverse(const Ring &ring) const
+{
+	return Degree(ring)==0 ? ring.MultiplicativeInverse(m_coefficients[0]) : ring.Identity();
+}
+
+template <class T>
+bool PolynomialOver<T>::IsUnit(const Ring &ring) const
+{
+	return Degree(ring)==0 && ring.IsUnit(m_coefficients[0]);
+}
+
+template <class T>
+std::istream& PolynomialOver<T>::Input(std::istream &in, const Ring &ring)
+{
+	char c;
+	unsigned int length = 0;
+	SecBlock<char> str(length + 16);
+	bool paren = false;
+
+	std::ws(in);
+
+	if (in.peek() == '(')
+	{
+		paren = true;
+		in.get();
+	}
+
+	do
+	{
+		in.read(&c, 1);
+		str[length++] = c;
+		if (length >= str.size())
+			str.Grow(length + 16);
+	}
+	// if we started with a left paren, then read until we find a right paren,
+	// otherwise read until the end of the line
+	while (in && ((paren && c != ')') || (!paren && c != '\n')));
+
+	str[length-1] = '\0';
+	*this = PolynomialOver<T>(str, ring);
+
+	return in;
+}
+
+template <class T>
+std::ostream& PolynomialOver<T>::Output(std::ostream &out, const Ring &ring) const
+{
+	unsigned int i = CoefficientCount(ring);
+	if (i)
+	{
+		bool firstTerm = true;
+
+		while (i--)
+		{
+			if (m_coefficients[i] != ring.Identity())
+			{
+				if (firstTerm)
+				{
+					firstTerm = false;
+					if (!i || !ring.Equal(m_coefficients[i], ring.MultiplicativeIdentity()))
+						out << m_coefficients[i];
+				}
+				else
+				{
+					CoefficientType inverse = ring.Inverse(m_coefficients[i]);
+					std::ostringstream pstr, nstr;
+
+					pstr << m_coefficients[i];
+					nstr << inverse;
+
+					if (pstr.str().size() <= nstr.str().size())
+					{
+						out << " + ";
+						if (!i || !ring.Equal(m_coefficients[i], ring.MultiplicativeIdentity()))
+							out << m_coefficients[i];
+					}
+					else
+					{
+						out << " - ";
+						if (!i || !ring.Equal(inverse, ring.MultiplicativeIdentity()))
+							out << inverse;
+					}
+				}
+
+				switch (i)
+				{
+				case 0:
+					break;
+				case 1:
+					out << "x";
+					break;
+				default:
+					out << "x^" << i;
+				}
+			}
+		}
+	}
+	else
+	{
+		out << ring.Identity();
+	}
+	return out;
+}
+
+template <class T>
+void PolynomialOver<T>::Divide(PolynomialOver<T> &r, PolynomialOver<T> &q, const PolynomialOver<T> &a, const PolynomialOver<T> &d, const Ring &ring)
+{
+	unsigned int i = a.CoefficientCount(ring);
+	const int dDegree = d.Degree(ring);
+
+	if (dDegree < 0)
+		throw DivideByZero();
+
+	r = a;
+	q.m_coefficients.resize(STDMAX(0, int(i - dDegree)));
+
+	while (i > (unsigned int)dDegree)
+	{
+		--i;
+		q.m_coefficients[i-dDegree] = ring.Divide(r.m_coefficients[i], d.m_coefficients[dDegree]);
+		for (int j=0; j<=dDegree; j++)
+			ring.Reduce(r.m_coefficients[i-dDegree+j], ring.Multiply(q.m_coefficients[i-dDegree], d.m_coefficients[j]));
+	}
+
+	r.CoefficientCount(ring);	// resize r.m_coefficients
+}
+
+// ********************************************************
+
+// helper function for Interpolate() and InterpolateAt()
+template <class T>
+void RingOfPolynomialsOver<T>::CalculateAlpha(std::vector<CoefficientType> &alpha, const CoefficientType x[], const CoefficientType y[], unsigned int n) const
+{
+	for (unsigned int j=0; j<n; ++j)
+		alpha[j] = y[j];
+
+	for (unsigned int k=1; k<n; ++k)
+	{
+		for (unsigned int j=n-1; j>=k; --j)
+		{
+			m_ring.Reduce(alpha[j], alpha[j-1]);
+
+			CoefficientType d = m_ring.Subtract(x[j], x[j-k]);
+			if (!m_ring.IsUnit(d))
+				throw InterpolationFailed();
+			alpha[j] = m_ring.Divide(alpha[j], d);
+		}
+	}
+}
+
+template <class T>
+typename RingOfPolynomialsOver<T>::Element RingOfPolynomialsOver<T>::Interpolate(const CoefficientType x[], const CoefficientType y[], unsigned int n) const
+{
+	CRYPTOPP_ASSERT(n > 0);
+
+	std::vector<CoefficientType> alpha(n);
+	CalculateAlpha(alpha, x, y, n);
+
+	std::vector<CoefficientType> coefficients((size_t)n, m_ring.Identity());
+	coefficients[0] = alpha[n-1];
+
+	for (int j=n-2; j>=0; --j)
+	{
+		for (unsigned int i=n-j-1; i>0; i--)
+			coefficients[i] = m_ring.Subtract(coefficients[i-1], m_ring.Multiply(coefficients[i], x[j]));
+
+		coefficients[0] = m_ring.Subtract(alpha[j], m_ring.Multiply(coefficients[0], x[j]));
+	}
+
+	return PolynomialOver<T>(coefficients.begin(), coefficients.end());
+}
+
+template <class T>
+typename RingOfPolynomialsOver<T>::CoefficientType RingOfPolynomialsOver<T>::InterpolateAt(const CoefficientType &position, const CoefficientType x[], const CoefficientType y[], unsigned int n) const
+{
+	CRYPTOPP_ASSERT(n > 0);
+
+	std::vector<CoefficientType> alpha(n);
+	CalculateAlpha(alpha, x, y, n);
+
+	CoefficientType result = alpha[n-1];
+	for (int j=n-2; j>=0; --j)
+	{
+		result = m_ring.Multiply(result, m_ring.Subtract(position, x[j]));
+		m_ring.Accumulate(result, alpha[j]);
+	}
+	return result;
+}
+
+template <class Ring, class Element>
+void PrepareBulkPolynomialInterpolation(const Ring &ring, Element *w, const Element x[], unsigned int n)
+{
+	for (unsigned int i=0; i<n; i++)
+	{
+		Element t = ring.MultiplicativeIdentity();
+		for (unsigned int j=0; j<n; j++)
+			if (i != j)
+				t = ring.Multiply(t, ring.Subtract(x[i], x[j]));
+		w[i] = ring.MultiplicativeInverse(t);
+	}
+}
+
+template <class Ring, class Element>
+void PrepareBulkPolynomialInterpolationAt(const Ring &ring, Element *v, const Element &position, const Element x[], const Element w[], unsigned int n)
+{
+	CRYPTOPP_ASSERT(n > 0);
+
+	std::vector<Element> a(2*n-1);
+	unsigned int i;
+
+	for (i=0; i<n; i++)
+		a[n-1+i] = ring.Subtract(position, x[i]);
+
+	for (i=n-1; i>1; i--)
+		a[i-1] = ring.Multiply(a[2*i], a[2*i-1]);
+
+	a[0] = ring.MultiplicativeIdentity();
+
+	for (i=0; i<n-1; i++)
+	{
+		std::swap(a[2*i+1], a[2*i+2]);
+		a[2*i+1] = ring.Multiply(a[i], a[2*i+1]);
+		a[2*i+2] = ring.Multiply(a[i], a[2*i+2]);
+	}
+
+	for (i=0; i<n; i++)
+		v[i] = ring.Multiply(a[n-1+i], w[i]);
+}
+
+template <class Ring, class Element>
+Element BulkPolynomialInterpolateAt(const Ring &ring, const Element y[], const Element v[], unsigned int n)
+{
+	Element result = ring.Identity();
+	for (unsigned int i=0; i<n; i++)
+		ring.Accumulate(result, ring.Multiply(y[i], v[i]));
+	return result;
+}
+
+// ********************************************************
+
+template <class T, int instance>
+const PolynomialOverFixedRing<T, instance> &PolynomialOverFixedRing<T, instance>::Zero()
+{
+	return Singleton<ThisType>().Ref();
+}
+
+template <class T, int instance>
+const PolynomialOverFixedRing<T, instance> &PolynomialOverFixedRing<T, instance>::One()
+{
+	return Singleton<ThisType, NewOnePolynomial>().Ref();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/polynomi.h b/runtime/third_party/cryptopp/polynomi.h
new file mode 100644
index 0000000..9a754ef
--- /dev/null
+++ b/runtime/third_party/cryptopp/polynomi.h
@@ -0,0 +1,463 @@
+// polynomi.h - originally written and placed in the public domain by Wei Dai
+
+/// \file polynomi.h
+/// \brief Classes for polynomial basis and operations
+
+#ifndef CRYPTOPP_POLYNOMI_H
+#define CRYPTOPP_POLYNOMI_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "algebra.h"
+#include "misc.h"
+
+#include <iosfwd>
+#include <vector>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// represents single-variable polynomials over arbitrary rings
+/*!	\nosubgrouping */
+template <class T> class PolynomialOver
+{
+public:
+	/// \name ENUMS, EXCEPTIONS, and TYPEDEFS
+	//@{
+		/// division by zero exception
+		class DivideByZero : public Exception
+		{
+		public:
+			DivideByZero() : Exception(OTHER_ERROR, "PolynomialOver<T>: division by zero") {}
+		};
+
+		/// specify the distribution for randomization functions
+		class RandomizationParameter
+		{
+		public:
+			RandomizationParameter(unsigned int coefficientCount, const typename T::RandomizationParameter &coefficientParameter )
+				: m_coefficientCount(coefficientCount), m_coefficientParameter(coefficientParameter) {}
+
+		private:
+			unsigned int m_coefficientCount;
+			typename T::RandomizationParameter m_coefficientParameter;
+			friend class PolynomialOver<T>;
+		};
+
+		typedef T Ring;
+		typedef typename T::Element CoefficientType;
+	//@}
+
+	/// \name CREATORS
+	//@{
+		/// creates the zero polynomial
+		PolynomialOver() {}
+
+		///
+		PolynomialOver(const Ring &ring, unsigned int count)
+			: m_coefficients((size_t)count, ring.Identity()) {}
+
+		/// copy constructor
+		PolynomialOver(const PolynomialOver<Ring> &t)
+			: m_coefficients(t.m_coefficients.size()) {*this = t;}
+
+		/// construct constant polynomial
+		PolynomialOver(const CoefficientType &element)
+			: m_coefficients(1, element) {}
+
+		/// construct polynomial with specified coefficients, starting from coefficient of x^0
+		template <typename Iterator> PolynomialOver(Iterator begin, Iterator end)
+			: m_coefficients(begin, end) {}
+
+		/// convert from string
+		PolynomialOver(const char *str, const Ring &ring) {FromStr(str, ring);}
+
+		/// convert from big-endian byte array
+		PolynomialOver(const byte *encodedPolynomialOver, unsigned int byteCount);
+
+		/// convert from Basic Encoding Rules encoded byte array
+		explicit PolynomialOver(const byte *BEREncodedPolynomialOver);
+
+		/// convert from BER encoded byte array stored in a BufferedTransformation object
+		explicit PolynomialOver(BufferedTransformation &bt);
+
+		/// create a random PolynomialOver<T>
+		PolynomialOver(RandomNumberGenerator &rng, const RandomizationParameter &parameter, const Ring &ring)
+			{Randomize(rng, parameter, ring);}
+	//@}
+
+	/// \name ACCESSORS
+	//@{
+		/// the zero polynomial will return a degree of -1
+		int Degree(const Ring &ring) const {return int(CoefficientCount(ring))-1;}
+		///
+		unsigned int CoefficientCount(const Ring &ring) const;
+		/// return coefficient for x^i
+		CoefficientType GetCoefficient(unsigned int i, const Ring &ring) const;
+	//@}
+
+	/// \name MANIPULATORS
+	//@{
+		///
+		PolynomialOver<Ring>&  operator=(const PolynomialOver<Ring>& t);
+
+		///
+		void Randomize(RandomNumberGenerator &rng, const RandomizationParameter &parameter, const Ring &ring);
+
+		/// set the coefficient for x^i to value
+		void SetCoefficient(unsigned int i, const CoefficientType &value, const Ring &ring);
+
+		///
+		void Negate(const Ring &ring);
+
+		///
+		void swap(PolynomialOver<Ring> &t);
+	//@}
+
+
+	/// \name BASIC ARITHMETIC ON POLYNOMIALS
+	//@{
+		bool Equals(const PolynomialOver<Ring> &t, const Ring &ring) const;
+		bool IsZero(const Ring &ring) const {return CoefficientCount(ring)==0;}
+
+		PolynomialOver<Ring> Plus(const PolynomialOver<Ring>& t, const Ring &ring) const;
+		PolynomialOver<Ring> Minus(const PolynomialOver<Ring>& t, const Ring &ring) const;
+		PolynomialOver<Ring> Inverse(const Ring &ring) const;
+
+		PolynomialOver<Ring> Times(const PolynomialOver<Ring>& t, const Ring &ring) const;
+		PolynomialOver<Ring> DividedBy(const PolynomialOver<Ring>& t, const Ring &ring) const;
+		PolynomialOver<Ring> Modulo(const PolynomialOver<Ring>& t, const Ring &ring) const;
+		PolynomialOver<Ring> MultiplicativeInverse(const Ring &ring) const;
+		bool IsUnit(const Ring &ring) const;
+
+		PolynomialOver<Ring>& Accumulate(const PolynomialOver<Ring>& t, const Ring &ring);
+		PolynomialOver<Ring>& Reduce(const PolynomialOver<Ring>& t, const Ring &ring);
+
+		///
+		PolynomialOver<Ring> Doubled(const Ring &ring) const {return Plus(*this, ring);}
+		///
+		PolynomialOver<Ring> Squared(const Ring &ring) const {return Times(*this, ring);}
+
+		CoefficientType EvaluateAt(const CoefficientType &x, const Ring &ring) const;
+
+		PolynomialOver<Ring>& ShiftLeft(unsigned int n, const Ring &ring);
+		PolynomialOver<Ring>& ShiftRight(unsigned int n, const Ring &ring);
+
+		/// calculate r and q such that (a == d*q + r) && (0 <= degree of r < degree of d)
+		static void Divide(PolynomialOver<Ring> &r, PolynomialOver<Ring> &q, const PolynomialOver<Ring> &a, const PolynomialOver<Ring> &d, const Ring &ring);
+	//@}
+
+	/// \name INPUT/OUTPUT
+	//@{
+		std::istream& Input(std::istream &in, const Ring &ring);
+		std::ostream& Output(std::ostream &out, const Ring &ring) const;
+	//@}
+
+private:
+	void FromStr(const char *str, const Ring &ring);
+
+	std::vector<CoefficientType> m_coefficients;
+};
+
+/// Polynomials over a fixed ring
+/*! Having a fixed ring allows overloaded operators */
+template <class T, int instance> class PolynomialOverFixedRing : private PolynomialOver<T>
+{
+	typedef PolynomialOver<T> B;
+	typedef PolynomialOverFixedRing<T, instance> ThisType;
+
+public:
+	typedef T Ring;
+	typedef typename T::Element CoefficientType;
+	typedef typename B::DivideByZero DivideByZero;
+	typedef typename B::RandomizationParameter RandomizationParameter;
+
+	/// \name CREATORS
+	//@{
+		/// creates the zero polynomial
+		PolynomialOverFixedRing(unsigned int count = 0) : B(ms_fixedRing, count) {}
+
+		/// copy constructor
+		PolynomialOverFixedRing(const ThisType &t) : B(t) {}
+
+		explicit PolynomialOverFixedRing(const B &t) : B(t) {}
+
+		/// construct constant polynomial
+		PolynomialOverFixedRing(const CoefficientType &element) : B(element) {}
+
+		/// construct polynomial with specified coefficients, starting from coefficient of x^0
+		template <typename Iterator> PolynomialOverFixedRing(Iterator first, Iterator last)
+			: B(first, last) {}
+
+		/// convert from string
+		explicit PolynomialOverFixedRing(const char *str) : B(str, ms_fixedRing) {}
+
+		/// convert from big-endian byte array
+		PolynomialOverFixedRing(const byte *encodedPoly, unsigned int byteCount) : B(encodedPoly, byteCount) {}
+
+		/// convert from Basic Encoding Rules encoded byte array
+		explicit PolynomialOverFixedRing(const byte *BEREncodedPoly) : B(BEREncodedPoly) {}
+
+		/// convert from BER encoded byte array stored in a BufferedTransformation object
+		explicit PolynomialOverFixedRing(BufferedTransformation &bt) : B(bt) {}
+
+		/// create a random PolynomialOverFixedRing
+		PolynomialOverFixedRing(RandomNumberGenerator &rng, const RandomizationParameter &parameter) : B(rng, parameter, ms_fixedRing) {}
+
+		static const ThisType &Zero();
+		static const ThisType &One();
+	//@}
+
+	/// \name ACCESSORS
+	//@{
+		/// the zero polynomial will return a degree of -1
+		int Degree() const {return B::Degree(ms_fixedRing);}
+		/// degree + 1
+		unsigned int CoefficientCount() const {return B::CoefficientCount(ms_fixedRing);}
+		/// return coefficient for x^i
+		CoefficientType GetCoefficient(unsigned int i) const {return B::GetCoefficient(i, ms_fixedRing);}
+		/// return coefficient for x^i
+		CoefficientType operator[](unsigned int i) const {return B::GetCoefficient(i, ms_fixedRing);}
+	//@}
+
+	/// \name MANIPULATORS
+	//@{
+		///
+		ThisType&  operator=(const ThisType& t) {B::operator=(t); return *this;}
+		///
+		ThisType&  operator+=(const ThisType& t) {Accumulate(t, ms_fixedRing); return *this;}
+		///
+		ThisType&  operator-=(const ThisType& t) {Reduce(t, ms_fixedRing); return *this;}
+		///
+		ThisType&  operator*=(const ThisType& t) {return *this = *this*t;}
+		///
+		ThisType&  operator/=(const ThisType& t) {return *this = *this/t;}
+		///
+		ThisType&  operator%=(const ThisType& t) {return *this = *this%t;}
+
+		///
+		ThisType&  operator<<=(unsigned int n) {ShiftLeft(n, ms_fixedRing); return *this;}
+		///
+		ThisType&  operator>>=(unsigned int n) {ShiftRight(n, ms_fixedRing); return *this;}
+
+		/// set the coefficient for x^i to value
+		void SetCoefficient(unsigned int i, const CoefficientType &value) {B::SetCoefficient(i, value, ms_fixedRing);}
+
+		///
+		void Randomize(RandomNumberGenerator &rng, const RandomizationParameter &parameter) {B::Randomize(rng, parameter, ms_fixedRing);}
+
+		///
+		void Negate() {B::Negate(ms_fixedRing);}
+
+		void swap(ThisType &t) {B::swap(t);}
+	//@}
+
+	/// \name UNARY OPERATORS
+	//@{
+		///
+		bool operator!() const {return CoefficientCount()==0;}
+		///
+		ThisType operator+() const {return *this;}
+		///
+		ThisType operator-() const {return ThisType(Inverse(ms_fixedRing));}
+	//@}
+
+	/// \name BINARY OPERATORS
+	//@{
+		///
+		friend ThisType operator>>(ThisType a, unsigned int n)	{return ThisType(a>>=n);}
+		///
+		friend ThisType operator<<(ThisType a, unsigned int n)	{return ThisType(a<<=n);}
+	//@}
+
+	/// \name OTHER ARITHMETIC FUNCTIONS
+	//@{
+		///
+		ThisType MultiplicativeInverse() const {return ThisType(B::MultiplicativeInverse(ms_fixedRing));}
+		///
+		bool IsUnit() const {return B::IsUnit(ms_fixedRing);}
+
+		///
+		ThisType Doubled() const {return ThisType(B::Doubled(ms_fixedRing));}
+		///
+		ThisType Squared() const {return ThisType(B::Squared(ms_fixedRing));}
+
+		CoefficientType EvaluateAt(const CoefficientType &x) const {return B::EvaluateAt(x, ms_fixedRing);}
+
+		/// calculate r and q such that (a == d*q + r) && (0 <= r < abs(d))
+		static void Divide(ThisType &r, ThisType &q, const ThisType &a, const ThisType &d)
+			{B::Divide(r, q, a, d, ms_fixedRing);}
+	//@}
+
+	/// \name INPUT/OUTPUT
+	//@{
+		///
+		friend std::istream& operator>>(std::istream& in, ThisType &a)
+			{return a.Input(in, ms_fixedRing);}
+		///
+		friend std::ostream& operator<<(std::ostream& out, const ThisType &a)
+			{return a.Output(out, ms_fixedRing);}
+	//@}
+
+private:
+	struct NewOnePolynomial
+	{
+		ThisType * operator()() const
+		{
+			return new ThisType(ms_fixedRing.MultiplicativeIdentity());
+		}
+	};
+
+	static const Ring ms_fixedRing;
+};
+
+/// Ring of polynomials over another ring
+template <class T> class RingOfPolynomialsOver : public AbstractEuclideanDomain<PolynomialOver<T> >
+{
+public:
+	typedef T CoefficientRing;
+	typedef PolynomialOver<T> Element;
+	typedef typename Element::CoefficientType CoefficientType;
+	typedef typename Element::RandomizationParameter RandomizationParameter;
+
+	RingOfPolynomialsOver(const CoefficientRing &ring) : m_ring(ring) {}
+
+	Element RandomElement(RandomNumberGenerator &rng, const RandomizationParameter &parameter)
+		{return Element(rng, parameter, m_ring);}
+
+	bool Equal(const Element &a, const Element &b) const
+		{return a.Equals(b, m_ring);}
+
+	const Element& Identity() const
+		{return this->result = m_ring.Identity();}
+
+	const Element& Add(const Element &a, const Element &b) const
+		{return this->result = a.Plus(b, m_ring);}
+
+	Element& Accumulate(Element &a, const Element &b) const
+		{a.Accumulate(b, m_ring); return a;}
+
+	const Element& Inverse(const Element &a) const
+		{return this->result = a.Inverse(m_ring);}
+
+	const Element& Subtract(const Element &a, const Element &b) const
+		{return this->result = a.Minus(b, m_ring);}
+
+	Element& Reduce(Element &a, const Element &b) const
+		{return a.Reduce(b, m_ring);}
+
+	const Element& Double(const Element &a) const
+		{return this->result = a.Doubled(m_ring);}
+
+	const Element& MultiplicativeIdentity() const
+		{return this->result = m_ring.MultiplicativeIdentity();}
+
+	const Element& Multiply(const Element &a, const Element &b) const
+		{return this->result = a.Times(b, m_ring);}
+
+	const Element& Square(const Element &a) const
+		{return this->result = a.Squared(m_ring);}
+
+	bool IsUnit(const Element &a) const
+		{return a.IsUnit(m_ring);}
+
+	const Element& MultiplicativeInverse(const Element &a) const
+		{return this->result = a.MultiplicativeInverse(m_ring);}
+
+	const Element& Divide(const Element &a, const Element &b) const
+		{return this->result = a.DividedBy(b, m_ring);}
+
+	const Element& Mod(const Element &a, const Element &b) const
+		{return this->result = a.Modulo(b, m_ring);}
+
+	void DivisionAlgorithm(Element &r, Element &q, const Element &a, const Element &d) const
+		{Element::Divide(r, q, a, d, m_ring);}
+
+	class InterpolationFailed : public Exception
+	{
+	public:
+		InterpolationFailed() : Exception(OTHER_ERROR, "RingOfPolynomialsOver<T>: interpolation failed") {}
+	};
+
+	Element Interpolate(const CoefficientType x[], const CoefficientType y[], unsigned int n) const;
+
+	// a faster version of Interpolate(x, y, n).EvaluateAt(position)
+	CoefficientType InterpolateAt(const CoefficientType &position, const CoefficientType x[], const CoefficientType y[], unsigned int n) const;
+/*
+	void PrepareBulkInterpolation(CoefficientType *w, const CoefficientType x[], unsigned int n) const;
+	void PrepareBulkInterpolationAt(CoefficientType *v, const CoefficientType &position, const CoefficientType x[], const CoefficientType w[], unsigned int n) const;
+	CoefficientType BulkInterpolateAt(const CoefficientType y[], const CoefficientType v[], unsigned int n) const;
+*/
+protected:
+	void CalculateAlpha(std::vector<CoefficientType> &alpha, const CoefficientType x[], const CoefficientType y[], unsigned int n) const;
+
+	CoefficientRing m_ring;
+};
+
+template <class Ring, class Element>
+void PrepareBulkPolynomialInterpolation(const Ring &ring, Element *w, const Element x[], unsigned int n);
+template <class Ring, class Element>
+void PrepareBulkPolynomialInterpolationAt(const Ring &ring, Element *v, const Element &position, const Element x[], const Element w[], unsigned int n);
+template <class Ring, class Element>
+Element BulkPolynomialInterpolateAt(const Ring &ring, const Element y[], const Element v[], unsigned int n);
+
+///
+template <class T, int instance>
+inline bool operator==(const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return a.Equals(b, a.ms_fixedRing);}
+///
+template <class T, int instance>
+inline bool operator!=(const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return !(a==b);}
+
+///
+template <class T, int instance>
+inline bool operator> (const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return a.Degree() > b.Degree();}
+///
+template <class T, int instance>
+inline bool operator>=(const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return a.Degree() >= b.Degree();}
+///
+template <class T, int instance>
+inline bool operator< (const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return a.Degree() < b.Degree();}
+///
+template <class T, int instance>
+inline bool operator<=(const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return a.Degree() <= b.Degree();}
+
+///
+template <class T, int instance>
+inline CryptoPP::PolynomialOverFixedRing<T, instance> operator+(const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return CryptoPP::PolynomialOverFixedRing<T, instance>(a.Plus(b, a.ms_fixedRing));}
+///
+template <class T, int instance>
+inline CryptoPP::PolynomialOverFixedRing<T, instance> operator-(const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return CryptoPP::PolynomialOverFixedRing<T, instance>(a.Minus(b, a.ms_fixedRing));}
+///
+template <class T, int instance>
+inline CryptoPP::PolynomialOverFixedRing<T, instance> operator*(const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return CryptoPP::PolynomialOverFixedRing<T, instance>(a.Times(b, a.ms_fixedRing));}
+///
+template <class T, int instance>
+inline CryptoPP::PolynomialOverFixedRing<T, instance> operator/(const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return CryptoPP::PolynomialOverFixedRing<T, instance>(a.DividedBy(b, a.ms_fixedRing));}
+///
+template <class T, int instance>
+inline CryptoPP::PolynomialOverFixedRing<T, instance> operator%(const CryptoPP::PolynomialOverFixedRing<T, instance> &a, const CryptoPP::PolynomialOverFixedRing<T, instance> &b)
+	{return CryptoPP::PolynomialOverFixedRing<T, instance>(a.Modulo(b, a.ms_fixedRing));}
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(std)
+template<class T> inline void swap(CryptoPP::PolynomialOver<T> &a, CryptoPP::PolynomialOver<T> &b)
+{
+	a.swap(b);
+}
+template<class T, int i> inline void swap(CryptoPP::PolynomialOverFixedRing<T,i> &a, CryptoPP::PolynomialOverFixedRing<T,i> &b)
+{
+	a.swap(b);
+}
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/power7_ppc.cpp b/runtime/third_party/cryptopp/power7_ppc.cpp
new file mode 100644
index 0000000..c8f20ee
--- /dev/null
+++ b/runtime/third_party/cryptopp/power7_ppc.cpp
@@ -0,0 +1,93 @@
+// ppc_power7.cpp - written and placed in the public domain by
+//                  Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    Power7 instructions. A separate source file is needed because
+//    additional CXXFLAGS are required to enable the appropriate
+//    instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#if defined(__ALTIVEC__) || defined(_ARCH_PWR7)
+# include "ppc_simd.h"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char PPC_POWER7_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ************************* Feature Probes ************************* //
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+
+    static jmp_buf s_jmpSIGILL;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpSIGILL, 1);
+    }
+}
+#endif  // CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
+
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+bool CPU_ProbePower7()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif defined(CRYPTOPP_POWER7_AVAILABLE)
+# if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile int result = false;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // POWER7 added unaligned loads and store operations
+        byte b1[19] = {255, 255, 255, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1}, b2[17];
+
+        // See comments in ppc_simd.h for some of these defines.
+        #if defined(_AIX) && defined(_ARCH_PWR7) && ((__xlC__ & 0xff00) == 0x0c00)
+            vec_xstw4(vec_xlw4(0, (unsigned int*)(b1+3)), 0, (unsigned int*)(b2+1));
+            result = (0 == std::memcmp(b1+3, b2+1, 16));
+        #elif defined(_ARCH_PWR7) && defined(__VSX__)
+            vec_xst(vec_xl(0, (unsigned int*)(b1+3)), 0, (unsigned int*)(b2+1));
+            result = (0 == std::memcmp(b1+3, b2+1, 16));
+        #else
+            result = false;
+        #endif
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // _ARCH_PWR7
+}
+
+#endif  // PPC32 or PPC64
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/power8_ppc.cpp b/runtime/third_party/cryptopp/power8_ppc.cpp
new file mode 100644
index 0000000..68ad531
--- /dev/null
+++ b/runtime/third_party/cryptopp/power8_ppc.cpp
@@ -0,0 +1,267 @@
+// ppc_power8.cpp - written and placed in the public domain by
+//                  Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    Power8 instructions. A separate source file is needed because
+//    additional CXXFLAGS are required to enable the appropriate
+//    instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#if defined(_ARCH_PWR8) || defined(__CRYPTO__)
+# include "ppc_simd.h"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char PPC_POWER8_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ************************* Feature Probes ************************* //
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+
+    static jmp_buf s_jmpSIGILL;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpSIGILL, 1);
+    }
+}
+#endif  // CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
+
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+
+bool CPU_ProbePower8()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif defined(CRYPTOPP_POWER8_AVAILABLE)
+# if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile int result = false;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // This is 64-bit add "vaddudm v0, v1, v0" from POWER8. We cannot use
+        // vec_add because GCC uses POWER8 instructions outside this SIGILL block.
+        // https://github.com/weidai11/cryptopp/issues/1112 and
+        // https://github.com/weidai11/cryptopp/issues/1115.
+#if CRYPTOPP_BIG_ENDIAN
+        __asm__ __volatile__ (".byte 0x10, 0x01, 0x00, 0xc0  \n\t" : : : "v0");
+#else
+        __asm__ __volatile__ (".byte 0xc0, 0x00, 0x01, 0x10  \n\t" : : : "v0");
+#endif
+        result = true;
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // _ARCH_PWR8
+}
+
+///////////
+bool CPU_ProbePMULL()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif (CRYPTOPP_POWER8_VMULL_AVAILABLE)
+    // longjmp and clobber warnings. Volatile is required.
+    volatile bool result = false;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // This is VMULL 'vpmsumd v0,v0,v1'
+#if CRYPTOPP_BIG_ENDIAN
+        __asm__ __volatile__ (".byte 0x10, 0x00, 0x0c, 0xc8  \n\t" : : : "v0");
+#else
+        __asm__ __volatile__ (".byte 0xc8, 0x0c, 0x00, 0x10  \n\t" : : : "v0");
+#endif
+        result = true;
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+#else
+    return false;
+#endif  // CRYPTOPP_POWER8_VMULL_AVAILABLE
+}
+///////////
+
+bool CPU_ProbeAES()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif defined(CRYPTOPP_POWER8_AES_AVAILABLE)
+# if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile int result = false;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // This is AES 'vcipher v0,v0,v1' followed by 'vcipherlast v0,v0,v1'
+#if CRYPTOPP_BIG_ENDIAN
+        __asm__ __volatile__ (".byte 0x10, 0x00, 0x0d, 0x08  \n\t"
+                              ".byte 0x10, 0x00, 0x0d, 0x09  \n\t" : : : "v0");
+#else
+        __asm__ __volatile__ (".byte 0x08, 0x0d, 0x00, 0x10  \n\t"
+                              ".byte 0x09, 0x0d, 0x00, 0x10  \n\t" : : : "v0");
+#endif
+        result = true;
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // __CRYPTO__
+}
+
+bool CPU_ProbeSHA256()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif defined(CRYPTOPP_POWER8_SHA_AVAILABLE)
+# if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile int result = false;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // This is SHA-256 'vshasigmaw v0,v0,1,15'.
+#if CRYPTOPP_BIG_ENDIAN
+        __asm__ __volatile__ (".byte 0x10, 0x00, 0xfe, 0x82  \n\t" : : : "v0");
+#else
+        __asm__ __volatile__ (".byte 0x82, 0xfe, 0x00, 0x10  \n\t" : : : "v0");
+#endif
+        result = true;
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+}
+
+bool CPU_ProbeSHA512()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif defined(CRYPTOPP_POWER8_SHA_AVAILABLE)
+# if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile int result = false;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // This is SHA-512 'vshasigmad v0,v0,1,15'.
+#if CRYPTOPP_BIG_ENDIAN
+        __asm__ __volatile__ (".byte 0x10, 0x00, 0xfe, 0xc2  \n\t" : : : "v0");
+#else
+        __asm__ __volatile__ (".byte 0xc2, 0xfe, 0x00, 0x10  \n\t" : : : "v0");
+#endif
+        result = true;
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_POWER8_AVAILABLE
+}
+
+#endif  // PPC32 or PPC64
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/power9_ppc.cpp b/runtime/third_party/cryptopp/power9_ppc.cpp
new file mode 100644
index 0000000..16b8d67
--- /dev/null
+++ b/runtime/third_party/cryptopp/power9_ppc.cpp
@@ -0,0 +1,136 @@
+// ppc_power9.cpp - written and placed in the public domain by
+//                  Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    Power9 instructions. A separate source file is needed because
+//    additional CXXFLAGS are required to enable the appropriate
+//    instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#if defined(_ARCH_PWR9)
+# include "ppc_simd.h"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char PPC_POWER9_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ************************* Feature Probes ************************* //
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+
+    static jmp_buf s_jmpSIGILL;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpSIGILL, 1);
+    }
+}
+#endif  // CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
+
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+
+bool CPU_ProbePower9()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif defined(CRYPTOPP_POWER9_AVAILABLE)
+# if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721954
+    volatile int result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // This is "darn r3, 0" from POWER9. We cannot use __builtin_darn
+        // and friends because Clang and IBM XL C/C++ does not offer them.
+#if CRYPTOPP_BIG_ENDIAN
+        __asm__ __volatile__ (".byte 0x7c, 0x60, 0x05, 0xe6  \n" : : : "r3");
+#else
+        __asm__ __volatile__ (".byte 0xe6, 0x05, 0x60, 0x7c  \n" : : : "r3");
+#endif
+        result = true;
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // _ARCH_PWR9
+}
+
+// The DARN probe is not guarded with a preprocessor macro at the moment. We
+// don't use CRYPTOPP_POWER9_AVAILABLE because old compilers, like GCC 4.8 on
+// CentOS 7, will report NO even though we can produce the random numbers.
+// Other Power9 implementations which use builtins will use the preprocessor
+// macro guard. This strategy also gets into a situation where Power9 is not
+// available but DARN is.
+bool CPU_ProbeDARN()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#else
+# if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721954
+    volatile int result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        // This is "darn r3, 0" from POWER9. We cannot use __builtin_darn
+        // and friends because Clang and IBM XL C/C++ does not offer them.
+#if CRYPTOPP_BIG_ENDIAN
+        __asm__ __volatile__ (".byte 0x7c, 0x60, 0x05, 0xe6  \n" : : : "r3");
+#else
+        __asm__ __volatile__ (".byte 0xe6, 0x05, 0x60, 0x7c  \n" : : : "r3");
+#endif
+        result = true;
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#endif  // DARN
+}
+
+#endif  // PPC32 or PPC64
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/ppc_simd.cpp b/runtime/third_party/cryptopp/ppc_simd.cpp
new file mode 100644
index 0000000..d86699d
--- /dev/null
+++ b/runtime/third_party/cryptopp/ppc_simd.cpp
@@ -0,0 +1,96 @@
+// ppc_simd.cpp - written and placed in the public domain by
+//                Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//
+//    This source file uses intrinsics to gain access to AltiVec,
+//    Power8 and in-core crypto instructions. A separate source file
+//    is needed because additional CXXFLAGS are required to enable the
+//    appropriate instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+#include "stdcpp.h"
+
+#if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+# include "ppc_simd.h"
+#endif
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#ifndef EXCEPTION_EXECUTE_HANDLER
+# define EXCEPTION_EXECUTE_HANDLER 1
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char PPC_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+
+    static jmp_buf s_jmpSIGILL;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpSIGILL, 1);
+    }
+}
+#endif  // Not CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
+
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+bool CPU_ProbeAltivec()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif (_ARCH_PWR3) && (CRYPTOPP_ALTIVEC_AVAILABLE)
+# if defined(CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY)
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile int result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        CRYPTOPP_ALIGN_DATA(16)
+        const byte b1[16] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
+        CRYPTOPP_ALIGN_DATA(16)
+        const byte b2[16] = {1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1};
+        CRYPTOPP_ALIGN_DATA(16) byte b3[16];
+
+        // Specifically call the Altivec loads and stores
+        const uint8x16_p v1 = (uint8x16_p)vec_ld(0, (byte*)b1);
+        const uint8x16_p v2 = (uint8x16_p)vec_ld(0, (byte*)b2);
+        const uint8x16_p v3 = (uint8x16_p)VecXor(v1, v2);
+        vec_st(v3, 0, b3);
+
+        result = (0 == std::memcmp(b2, b3, 16));
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+}
+
+# endif  // CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/ppc_simd.h b/runtime/third_party/cryptopp/ppc_simd.h
new file mode 100644
index 0000000..a5297cf
--- /dev/null
+++ b/runtime/third_party/cryptopp/ppc_simd.h
@@ -0,0 +1,2764 @@
+// ppc_simd.h - written and placed in public domain by Jeffrey Walton
+
+/// \file ppc_simd.h
+/// \brief Support functions for PowerPC and vector operations
+/// \details This header provides an agnostic interface into Clang, GCC
+///  and IBM XL C/C++ compilers modulo their different built-in functions
+///  for accessing vector instructions.
+/// \details The abstractions are necessary to support back to GCC 4.8 and
+///  XLC 11 and 12. GCC 4.8 and 4.9 are still popular, and they are the
+///  default compiler for GCC112, GCC119 and others on the compile farm.
+///  Older IBM XL C/C++ compilers also have the need due to lack of
+///  <tt>vec_xl</tt> and <tt>vec_xst</tt> support on some platforms. Modern
+///  compilers provide best support and don't need many of the hacks
+///  below.
+/// \details The library is tested with the following PowerPC machines and
+///  compilers. GCC110, GCC111, GCC112, GCC119 and GCC135 are provided by
+///  the <A HREF="https://cfarm.tetaneutral.net/">GCC Compile Farm</A>
+///  - PowerMac G5, OSX 10.5, POWER4, Apple GCC 4.0
+///  - PowerMac G5, OSX 10.5, POWER4, Macports GCC 5.0
+///  - GCC110, Linux, POWER7, GCC 4.8.5
+///  - GCC110, Linux, POWER7, XLC 12.01
+///  - GCC111, AIX, POWER7, GCC 4.8.1
+///  - GCC111, AIX, POWER7, XLC 12.01
+///  - GCC112, Linux, POWER8, GCC 4.8.5
+///  - GCC112, Linux, POWER8, XLC 13.01
+///  - GCC112, Linux, POWER8, Clang 7.0
+///  - GCC119, AIX, POWER8, GCC 7.2.0
+///  - GCC119, AIX, POWER8, XLC 13.01
+///  - GCC135, Linux, POWER9, GCC 7.0
+/// \details 12 machines are used for testing because the three compilers form
+///  five or six profiles. The profiles are listed below.
+///  - GCC (Linux GCC, Macports GCC, etc. Consistent across machines)
+///  - XLC 13.0 and earlier (all IBM components)
+///  - XLC 13.1 and later on Linux (LLVM front-end, no compatibility macros)
+///  - XLC 13.1 and later on Linux (LLVM front-end, -qxlcompatmacros option)
+///  - early LLVM Clang (traditional Clang compiler)
+///  - late LLVM Clang (traditional Clang compiler)
+/// \details The LLVM front-end makes it tricky to write portable code because
+///  LLVM pretends to be other compilers but cannot consume other compiler's
+///  builtins. When using XLC with -qxlcompatmacros the compiler pretends to
+///  be GCC, Clang and XLC all at once but it can only consume it's variety
+///  of builtins.
+/// \details At Crypto++ 8.0 the various <tt>Vector{FuncName}</tt> were
+///  renamed to <tt>Vec{FuncName}</tt>. For example, <tt>VectorAnd</tt> was
+///  changed to <tt>VecAnd</tt>. The name change helped consolidate two
+///  slightly different implementations.
+/// \details At Crypto++ 8.3 the library added select 64-bit functions for
+///  32-bit Altivec. For example, <tt>VecAdd64</tt> and <tt>VecSub64</tt>
+///  take 32-bit vectors and adds or subtracts them as if there were vectors
+///  with two 64-bit elements. The functions dramtically improve performance
+///  for some algorithms on some platforms, like SIMON128 and SPECK128 on
+///  Power6 and earlier. For example, SPECK128 improved from 70 cpb to
+///  10 cpb on an old PowerMac. Use the functions like shown below.
+///  <pre>
+///    \#if defined(_ARCH_PWR8)
+///    \#  define speck128_t uint64x2_p
+///    \#else
+///    \#  define speck128_t uint32x4_p
+///    \#endif
+///
+///    speck128_t rk, x1, x2, y1, y2;
+///    rk = (speck128_t)VecLoadAligned(ptr);
+///    x1 = VecRotateRight64<8>(x1);
+///    x1 = VecAdd64(x1, y1);
+///    ...</pre>
+/// \since Crypto++ 6.0, LLVM Clang compiler support since Crypto++ 8.0
+
+// Use __ALTIVEC__, _ARCH_PWR7, __VSX__, and _ARCH_PWR8 when detecting
+// actual availaibility of the feature for the source file being compiled.
+// The preprocessor macros depend on compiler options like -maltivec; and
+// not compiler versions.
+
+// For GCC see https://gcc.gnu.org/onlinedocs/gcc/Basic-PowerPC-Built-in-Functions.html
+// For XLC see the Compiler Reference manual. For Clang you have to experiment.
+// Clang does not document the compiler options, does not reject options it does
+// not understand, and pretends to be other compilers even though it cannot
+// process the builtins and intrinsics. Clang will waste hours of your time.
+
+// DO NOT USE this pattern in VecLoad and VecStore. We have to use the
+// code paths guarded by preprocessor macros because XLC 12 generates
+// bad code in some places. To verify the bad code generation test on
+// GCC111 with XLC 12.01 installed. XLC 13.01 on GCC112 and GCC119 are OK.
+//
+//   inline uint32x4_p VecLoad(const byte src[16])
+//   {
+//   #if defined(__VSX__) || defined(_ARCH_PWR8)
+//       return (uint32x4_p) *(uint8x16_p*)((byte*)src);
+//   #else
+//       return VecLoad_ALTIVEC(src);
+//   #endif
+//   }
+
+// We should be able to perform the load using inline asm on Power7 with
+// VSX or Power8. The inline asm will avoid C undefined behavior due to
+// casting from byte* to word32*. We are safe because our byte* are
+// 16-byte aligned for Altivec. Below is the big endian load. Little
+// endian would need to follow with xxpermdi for the reversal.
+//
+//   __asm__ ("lxvw4x %x0, %1, %2" : "=wa"(v) : "r"(0), "r"(src) : );
+
+// GCC and XLC use integer math for the address (D-form or byte-offset
+// in the ISA manual). LLVM uses pointer math for the address (DS-form
+// or indexed in the ISA manual). To keep them consistent we calculate
+// the address from the offset and pass to a load or store function
+// using a 0 offset.
+
+#ifndef CRYPTOPP_PPC_CRYPTO_H
+#define CRYPTOPP_PPC_CRYPTO_H
+
+#include "config.h"
+#include "misc.h"
+
+#if defined(__ALTIVEC__)
+# include <altivec.h>
+# undef vector
+# undef pixel
+# undef bool
+#endif
+
+// XL C++ on AIX does not define VSX and does not
+// provide an option to set it. We have to set it
+// for the code below. This define must stay in
+// sync with the define in test_ppc_power7.cpp.
+#ifndef CRYPTOPP_DISABLE_POWER7
+# if defined(_AIX) && defined(_ARCH_PWR7) && defined(__xlC__)
+#  define __VSX__ 1
+# endif
+#endif
+
+// XL C++ on AIX does not define CRYPTO and does not
+// provide an option to set it. We have to set it
+// for the code below. This define must stay in
+// sync with the define in test_ppc_power8.cpp
+#ifndef CRYPTOPP_DISABLE_POWER8
+# if defined(_AIX) && defined(_ARCH_PWR8) && defined(__xlC__)
+#  define __CRYPTO__ 1
+# endif
+#endif
+
+/// \brief Cast array to vector pointer
+/// \details CONST_V8_CAST casts a const array to a vector
+///  pointer for a byte array. The Power ABI says source arrays
+///  are non-const, so this define removes the const. XLC++ will
+///  fail the compile if the source array is const.
+#define CONST_V8_CAST(x)  ((unsigned char*)(x))
+/// \brief Cast array to vector pointer
+/// \details CONST_V32_CAST casts a const array to a vector
+///  pointer for a word array. The Power ABI says source arrays
+///  are non-const, so this define removes the const. XLC++ will
+///  fail the compile if the source array is const.
+#define CONST_V32_CAST(x) ((unsigned int*)(x))
+/// \brief Cast array to vector pointer
+/// \details CONST_V64_CAST casts a const array to a vector
+///  pointer for a double word array. The Power ABI says source arrays
+///  are non-const, so this define removes the const. XLC++ will
+///  fail the compile if the source array is const.
+#define CONST_V64_CAST(x) ((unsigned long long*)(x))
+/// \brief Cast array to vector pointer
+/// \details NCONST_V8_CAST casts an array to a vector
+///  pointer for a byte array. The Power ABI says source arrays
+///  are non-const, so this define removes the const. XLC++ will
+///  fail the compile if the source array is const.
+#define NCONST_V8_CAST(x)  ((unsigned char*)(x))
+/// \brief Cast array to vector pointer
+/// \details NCONST_V32_CAST casts an array to a vector
+///  pointer for a word array. The Power ABI says source arrays
+///  are non-const, so this define removes the const. XLC++ will
+///  fail the compile if the source array is const.
+#define NCONST_V32_CAST(x) ((unsigned int*)(x))
+/// \brief Cast array to vector pointer
+/// \details NCONST_V64_CAST casts an array to a vector
+///  pointer for a double word array. The Power ABI says source arrays
+///  are non-const, so this define removes the const. XLC++ will
+///  fail the compile if the source array is const.
+#define NCONST_V64_CAST(x) ((unsigned long long*)(x))
+
+// VecLoad_ALTIVEC and VecStore_ALTIVEC are
+// too noisy on modern compilers
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wdeprecated"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(__ALTIVEC__) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+/// \brief Vector of 8-bit elements
+/// \par Wraps
+///  __vector unsigned char
+/// \since Crypto++ 6.0
+typedef __vector unsigned char   uint8x16_p;
+/// \brief Vector of 16-bit elements
+/// \par Wraps
+///  __vector unsigned short
+/// \since Crypto++ 6.0
+typedef __vector unsigned short  uint16x8_p;
+/// \brief Vector of 32-bit elements
+/// \par Wraps
+///  __vector unsigned int
+/// \since Crypto++ 6.0
+typedef __vector unsigned int    uint32x4_p;
+
+#if defined(__VSX__) || defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Vector of 64-bit elements
+/// \details uint64x2_p is available on POWER7 with VSX and above. Most
+///  supporting functions, like 64-bit <tt>vec_add</tt> (<tt>vaddudm</tt>)
+///  and <tt>vec_sub</tt> (<tt>vsubudm</tt>), did not arrive until POWER8.
+/// \par Wraps
+///  __vector unsigned long long
+/// \since Crypto++ 6.0
+typedef __vector unsigned long long uint64x2_p;
+#endif  // VSX or ARCH_PWR8
+
+/// \brief The 0 vector
+/// \return a 32-bit vector of 0's
+/// \since Crypto++ 8.0
+inline uint32x4_p VecZero()
+{
+    const uint32x4_p v = {0,0,0,0};
+    return v;
+}
+
+/// \brief The 1 vector
+/// \return a 32-bit vector of 1's
+/// \since Crypto++ 8.0
+inline uint32x4_p VecOne()
+{
+    const uint32x4_p v = {1,1,1,1};
+    return v;
+}
+
+/// \brief Reverse bytes in a vector
+/// \tparam T vector type
+/// \param data the vector
+/// \return vector
+/// \details VecReverse() reverses the bytes in a vector
+/// \par Wraps
+///  vec_perm
+/// \since Crypto++ 6.0
+template <class T>
+inline T VecReverse(const T data)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p mask = {15,14,13,12, 11,10,9,8, 7,6,5,4, 3,2,1,0};
+    return (T)vec_perm(data, data, mask);
+#else
+    const uint8x16_p mask = {0,1,2,3, 4,5,6,7, 8,9,10,11, 12,13,14,15};
+    return (T)vec_perm(data, data, mask);
+#endif
+}
+
+/// \brief Reverse bytes in a vector
+/// \tparam T vector type
+/// \param data the vector
+/// \return vector
+/// \details VecReverseLE() reverses the bytes in a vector on
+///  little-endian systems.
+/// \par Wraps
+///  vec_perm
+/// \since Crypto++ 6.0
+template <class T>
+inline T VecReverseLE(const T data)
+{
+#if defined(CRYPTOPP_LITTLE_ENDIAN)
+    const uint8x16_p mask = {15,14,13,12, 11,10,9,8, 7,6,5,4, 3,2,1,0};
+    return (T)vec_perm(data, data, mask);
+#else
+    return data;
+#endif
+}
+
+/// \brief Reverse bytes in a vector
+/// \tparam T vector type
+/// \param data the vector
+/// \return vector
+/// \details VecReverseBE() reverses the bytes in a vector on
+///  big-endian systems.
+/// \par Wraps
+///  vec_perm
+/// \since Crypto++ 6.0
+template <class T>
+inline T VecReverseBE(const T data)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p mask = {15,14,13,12, 11,10,9,8, 7,6,5,4, 3,2,1,0};
+    return (T)vec_perm(data, data, mask);
+#else
+    return data;
+#endif
+}
+
+/// \name LOAD OPERATIONS
+//@{
+
+/// \brief Loads a vector from a byte array
+/// \param src the byte array
+/// \details Loads a vector in native endian format from a byte array.
+/// \details VecLoad_ALTIVEC() uses <tt>vec_ld</tt> if the effective address
+///  of <tt>src</tt> is aligned. If unaligned it uses <tt>vec_lvsl</tt>,
+///  <tt>vec_ld</tt>, <tt>vec_perm</tt> and <tt>src</tt>. The fixups using
+///  <tt>vec_lvsl</tt> and <tt>vec_perm</tt> are relatively expensive so
+///  you should provide aligned memory addresses.
+/// \par Wraps
+///  vec_ld, vec_lvsl, vec_perm
+/// \sa VecLoad, VecLoadAligned
+/// \since Crypto++ 6.0
+inline uint32x4_p VecLoad_ALTIVEC(const byte src[16])
+{
+    // Avoid IsAlignedOn for convenience.
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src);
+    if (addr % 16 == 0)
+    {
+        return (uint32x4_p)vec_ld(0, CONST_V8_CAST(addr));
+    }
+    else
+    {
+        // http://www.nxp.com/docs/en/reference-manual/ALTIVECPEM.pdf
+        const uint8x16_p perm = vec_lvsl(0, CONST_V8_CAST(addr));
+        const uint8x16_p low = vec_ld(0, CONST_V8_CAST(addr));
+        const uint8x16_p high = vec_ld(15, CONST_V8_CAST(addr));
+        return (uint32x4_p)vec_perm(low, high, perm);
+    }
+}
+
+/// \brief Loads a vector from a byte array
+/// \param src the byte array
+/// \param off offset into the src byte array
+/// \details Loads a vector in native endian format from a byte array.
+/// \details VecLoad_ALTIVEC() uses <tt>vec_ld</tt> if the effective address
+///  of <tt>src</tt> is aligned. If unaligned it uses <tt>vec_lvsl</tt>,
+///  <tt>vec_ld</tt>, <tt>vec_perm</tt> and <tt>src</tt>.
+/// \details The fixups using <tt>vec_lvsl</tt> and <tt>vec_perm</tt> are
+///  relatively expensive so you should provide aligned memory addresses.
+/// \par Wraps
+///  vec_ld, vec_lvsl, vec_perm
+/// \sa VecLoad, VecLoadAligned
+/// \since Crypto++ 6.0
+inline uint32x4_p VecLoad_ALTIVEC(int off, const byte src[16])
+{
+    // Avoid IsAlignedOn for convenience.
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src)+off;
+    if (addr % 16 == 0)
+    {
+        return (uint32x4_p)vec_ld(0, CONST_V8_CAST(addr));
+    }
+    else
+    {
+        // http://www.nxp.com/docs/en/reference-manual/ALTIVECPEM.pdf
+        const uint8x16_p perm = vec_lvsl(0, CONST_V8_CAST(addr));
+        const uint8x16_p low = vec_ld(0, CONST_V8_CAST(addr));
+        const uint8x16_p high = vec_ld(15, CONST_V8_CAST(addr));
+        return (uint32x4_p)vec_perm(low, high, perm);
+    }
+}
+
+/// \brief Loads a vector from a byte array
+/// \param src the byte array
+/// \details VecLoad() loads a vector from a byte array.
+/// \details VecLoad() uses POWER9's <tt>vec_xl</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecLoad_ALTIVEC() is used if POWER9 is not available.
+///  VecLoad_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xl on POWER9 and above, Altivec load on POWER8 and below
+/// \sa VecLoad_ALTIVEC, VecLoadAligned
+/// \since Crypto++ 6.0
+inline uint32x4_p VecLoad(const byte src[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint32x4_p)vec_xl(0, CONST_V8_CAST(src));
+#else
+    return (uint32x4_p)VecLoad_ALTIVEC(CONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Loads a vector from a byte array
+/// \param src the byte array
+/// \param off offset into the src byte array
+/// \details VecLoad() loads a vector from a byte array.
+/// \details VecLoad() uses POWER9's <tt>vec_xl</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecLoad_ALTIVEC() is used if POWER9 is not available.
+///  VecLoad_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xl on POWER9 and above, Altivec load on POWER8 and below
+/// \sa VecLoad_ALTIVEC, VecLoadAligned
+/// \since Crypto++ 6.0
+inline uint32x4_p VecLoad(int off, const byte src[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint32x4_p)vec_xl(off, CONST_V8_CAST(src));
+#else
+    return (uint32x4_p)VecLoad_ALTIVEC(CONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Loads a vector from a word array
+/// \param src the word array
+/// \details VecLoad() loads a vector from a word array.
+/// \details VecLoad() uses POWER7's and VSX's <tt>vec_xl</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecLoad_ALTIVEC() is used if POWER7 is not available.
+///  VecLoad_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xl on VSX or POWER8 and above, Altivec load on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoadAligned
+/// \since Crypto++ 8.0
+inline uint32x4_p VecLoad(const word32 src[4])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word32>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint32x4_p)vec_xl(0, CONST_V8_CAST(src));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    return (uint32x4_p)vec_xl(0, CONST_V32_CAST(addr));
+#else
+    return (uint32x4_p)VecLoad_ALTIVEC(CONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Loads a vector from a word array
+/// \param src the word array
+/// \param off offset into the word array
+/// \details VecLoad() loads a vector from a word array.
+/// \details VecLoad() uses POWER7's and VSX's <tt>vec_xl</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecLoad_ALTIVEC() is used if POWER7 is not available.
+///  VecLoad_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xl on VSX or POWER8 and above, Altivec load on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoadAligned
+/// \since Crypto++ 8.0
+inline uint32x4_p VecLoad(int off, const word32 src[4])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word32>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint32x4_p)vec_xl(off, CONST_V8_CAST(src));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    return (uint32x4_p)vec_xl(0, CONST_V32_CAST(addr));
+#else
+    return (uint32x4_p)VecLoad_ALTIVEC(CONST_V8_CAST(addr));
+#endif
+}
+
+#if defined(__VSX__) || defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+/// \brief Loads a vector from a double word array
+/// \param src the double word array
+/// \details VecLoad() loads a vector from a double word array.
+/// \details VecLoad() uses POWER7's and VSX's <tt>vec_xl</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecLoad_ALTIVEC() is used if POWER7 and VSX are not available.
+///  VecLoad_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \details VecLoad() with 64-bit elements is available on POWER7 and above.
+/// \par Wraps
+///  vec_xl on VSX or POWER8 and above, Altivec load on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoadAligned
+/// \since Crypto++ 8.0
+inline uint64x2_p VecLoad(const word64 src[2])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word64>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint64x2_p)vec_xl(0, CONST_V8_CAST(src));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    // The 32-bit cast is not a typo. Compiler workaround.
+    return (uint64x2_p)vec_xl(0, CONST_V32_CAST(addr));
+#else
+    return (uint64x2_p)VecLoad_ALTIVEC(CONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Loads a vector from a double word array
+/// \param src the double word array
+/// \param off offset into the double word array
+/// \details VecLoad() loads a vector from a double word array.
+/// \details VecLoad() uses POWER7's and VSX's <tt>vec_xl</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecLoad_ALTIVEC() is used if POWER7 and VSX are not available.
+///  VecLoad_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \details VecLoad() with 64-bit elements is available on POWER8 and above.
+/// \par Wraps
+///  vec_xl on VSX or POWER8 and above, Altivec load on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoadAligned
+/// \since Crypto++ 8.0
+inline uint64x2_p VecLoad(int off, const word64 src[2])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word64>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint64x2_p)vec_xl(off, CONST_V8_CAST(src));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    // The 32-bit cast is not a typo. Compiler workaround.
+    return (uint64x2_p)vec_xl(0, CONST_V32_CAST(addr));
+#else
+    return (uint64x2_p)VecLoad_ALTIVEC(CONST_V8_CAST(addr));
+#endif
+}
+
+#endif  // VSX or ARCH_PWR8
+
+/// \brief Loads a vector from an aligned byte array
+/// \param src the byte array
+/// \details VecLoadAligned() loads a vector from an aligned byte array.
+/// \details VecLoadAligned() uses POWER9's <tt>vec_xl</tt> if available.
+///  <tt>vec_ld</tt> is used if POWER9 is not available. The effective
+///  address of <tt>src</tt> must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xl on POWER9, vec_ld on POWER8 and below
+/// \sa VecLoad_ALTIVEC, VecLoad
+/// \since Crypto++ 8.0
+inline uint32x4_p VecLoadAligned(const byte src[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src);
+    CRYPTOPP_ASSERT(addr % 16 == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint32x4_p)vec_xl(0, CONST_V8_CAST(src));
+#else
+    return (uint32x4_p)vec_ld(0, CONST_V8_CAST(src));
+#endif
+}
+
+/// \brief Loads a vector from an aligned byte array
+/// \param src the byte array
+/// \param off offset into the src byte array
+/// \details VecLoadAligned() loads a vector from an aligned byte array.
+/// \details VecLoadAligned() uses POWER9's <tt>vec_xl</tt> if available.
+///  <tt>vec_ld</tt> is used if POWER9 is not available. The effective
+///  address of <tt>src</tt> must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xl on POWER9, vec_ld on POWER8 and below
+/// \sa VecLoad_ALTIVEC, VecLoad
+/// \since Crypto++ 8.0
+inline uint32x4_p VecLoadAligned(int off, const byte src[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src)+off;
+    CRYPTOPP_ASSERT(addr % 16 == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint32x4_p)vec_xl(off, CONST_V8_CAST(src));
+#else
+    return (uint32x4_p)vec_ld(off, CONST_V8_CAST(src));
+#endif
+}
+
+/// \brief Loads a vector from an aligned word array
+/// \param src the word array
+/// \details VecLoadAligned() loads a vector from an aligned word array.
+/// \details VecLoadAligned() uses POWER7's and VSX's <tt>vec_xl</tt> if
+///  available. <tt>vec_ld</tt> is used if POWER7 or VSX are not available.
+///  The effective address of <tt>src</tt> must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xl on VSX or POWER8 and above, vec_ld on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoad
+/// \since Crypto++ 8.0
+inline uint32x4_p VecLoadAligned(const word32 src[4])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src);
+    CRYPTOPP_ASSERT(addr % 16 == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint32x4_p)vec_xl(0, CONST_V8_CAST(src));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    return (uint32x4_p)vec_xl(0, CONST_V32_CAST(src));
+#else
+    return (uint32x4_p)vec_ld(0, CONST_V8_CAST(src));
+#endif
+}
+
+/// \brief Loads a vector from an aligned word array
+/// \param src the word array
+/// \param off offset into the src word array
+/// \details VecLoadAligned() loads a vector from an aligned word array.
+/// \details VecLoadAligned() uses POWER7's and VSX's <tt>vec_xl</tt> if
+///  available. <tt>vec_ld</tt> is used if POWER7 or VSX are not available.
+///  The effective address of <tt>src</tt> must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xl on VSX or POWER8 and above, vec_ld on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoad
+/// \since Crypto++ 8.0
+inline uint32x4_p VecLoadAligned(int off, const word32 src[4])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src)+off;
+    CRYPTOPP_ASSERT(addr % 16 == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint32x4_p)vec_xl(off, CONST_V8_CAST(src));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    return (uint32x4_p)vec_xl(0, CONST_V32_CAST(addr));
+#else
+    return (uint32x4_p)vec_ld(off, CONST_V8_CAST(src));
+#endif
+}
+
+#if defined(__VSX__) || defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+/// \brief Loads a vector from an aligned double word array
+/// \param src the double word array
+/// \details VecLoadAligned() loads a vector from an aligned double word array.
+/// \details VecLoadAligned() uses POWER7's and VSX's <tt>vec_xl</tt> if
+///  available. <tt>vec_ld</tt> is used if POWER7 or VSX are not available.
+///  The effective address of <tt>src</tt> must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xl on VSX or POWER8 and above, vec_ld on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoad
+/// \since Crypto++ 8.0
+inline uint64x2_p VecLoadAligned(const word64 src[4])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src);
+    CRYPTOPP_ASSERT(addr % 16 == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint64x2_p)vec_xl(0, CONST_V8_CAST(src));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    // The 32-bit cast is not a typo. Compiler workaround.
+    return (uint64x2_p)vec_xl(0, CONST_V32_CAST(src));
+#else
+    return (uint64x2_p)vec_ld(0, CONST_V8_CAST(src));
+#endif
+}
+
+/// \brief Loads a vector from an aligned double word array
+/// \param src the double word array
+/// \param off offset into the src double word array
+/// \details VecLoadAligned() loads a vector from an aligned double word array.
+/// \details VecLoadAligned() uses POWER7's and VSX's <tt>vec_xl</tt> if
+///  available. <tt>vec_ld</tt> is used if POWER7 or VSX are not available.
+///  The effective address of <tt>src</tt> must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xl on VSX or POWER8 and above, vec_ld on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoad
+/// \since Crypto++ 8.0
+inline uint64x2_p VecLoadAligned(int off, const word64 src[4])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src)+off;
+    CRYPTOPP_ASSERT(addr % 16 == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    return (uint64x2_p)vec_xl(off, CONST_V8_CAST(src));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    // The 32-bit cast is not a typo. Compiler workaround.
+    return (uint64x2_p)vec_xl(0, CONST_V32_CAST(addr));
+#else
+    return (uint64x2_p)vec_ld(off, CONST_V8_CAST(src));
+#endif
+}
+
+#endif
+
+/// \brief Loads a vector from a byte array
+/// \param src the byte array
+/// \details VecLoadBE() loads a vector from a byte array. VecLoadBE
+///  will reverse all bytes in the array on a little endian system.
+/// \details VecLoadBE() uses POWER7's and VSX's <tt>vec_xl</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecLoad_ALTIVEC() is used if POWER7 or VSX are not available.
+///  VecLoad_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xl on POWER8, Altivec load on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoad, VecLoadAligned
+/// \since Crypto++ 6.0
+inline uint32x4_p VecLoadBE(const byte src[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src);
+    // CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    return (uint32x4_p)vec_xl_be(0, CONST_V8_CAST(src));
+#elif defined(CRYPTOPP_BIG_ENDIAN)
+    return (uint32x4_p)VecLoad_ALTIVEC(0, CONST_V8_CAST(src));
+#else
+    return (uint32x4_p)VecReverseLE(VecLoad_ALTIVEC(CONST_V8_CAST(src)));
+#endif
+}
+
+/// \brief Loads a vector from a byte array
+/// \param src the byte array
+/// \param off offset into the src byte array
+/// \details VecLoadBE() loads a vector from a byte array. VecLoadBE
+///  will reverse all bytes in the array on a little endian system.
+/// \details VecLoadBE() uses POWER7's and VSX's <tt>vec_xl</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecLoad_ALTIVEC() is used if POWER7 is not available.
+///  VecLoad_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xl on POWER8, Altivec load on POWER7 and below
+/// \sa VecLoad_ALTIVEC, VecLoad, VecLoadAligned
+/// \since Crypto++ 6.0
+inline uint32x4_p VecLoadBE(int off, const byte src[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(src)+off;
+    // CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    return (uint32x4_p)vec_xl_be(off, CONST_V8_CAST(src));
+#elif defined(CRYPTOPP_BIG_ENDIAN)
+    return (uint32x4_p)VecLoad_ALTIVEC(CONST_V8_CAST(addr));
+#else
+    return (uint32x4_p)VecReverseLE(VecLoad_ALTIVEC(CONST_V8_CAST(addr)));
+#endif
+}
+
+//@}
+
+/// \name STORE OPERATIONS
+//@{
+
+/// \brief Stores a vector to a byte array
+/// \tparam T vector type
+/// \param data the vector
+/// \param dest the byte array
+/// \details VecStore_ALTIVEC() stores a vector to a byte array.
+/// \details VecStore_ALTIVEC() uses <tt>vec_st</tt> if the effective address
+///  of <tt>dest</tt> is aligned, and uses <tt>vec_ste</tt> otherwise.
+///  <tt>vec_ste</tt> is relatively expensive so you should provide aligned
+///  memory addresses.
+/// \details VecStore_ALTIVEC() is used when POWER7 or above
+///  and unaligned loads is not available.
+/// \par Wraps
+///  vec_st, vec_ste, vec_lvsr, vec_perm
+/// \sa VecStore, VecStoreAligned
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStore_ALTIVEC(const T data, byte dest[16])
+{
+    // Avoid IsAlignedOn for convenience.
+    uintptr_t addr = reinterpret_cast<uintptr_t>(dest);
+    if (addr % 16 == 0)
+    {
+        vec_st((uint8x16_p)data, 0, NCONST_V8_CAST(addr));
+    }
+    else
+    {
+        // http://www.nxp.com/docs/en/reference-manual/ALTIVECPEM.pdf
+        uint8x16_p perm = (uint8x16_p)vec_perm(data, data, vec_lvsr(0, NCONST_V8_CAST(addr)));
+        vec_ste((uint8x16_p) perm,  0, (unsigned char*) NCONST_V8_CAST(addr));
+        vec_ste((uint16x8_p) perm,  1, (unsigned short*)NCONST_V8_CAST(addr));
+        vec_ste((uint32x4_p) perm,  3, (unsigned int*)  NCONST_V8_CAST(addr));
+        vec_ste((uint32x4_p) perm,  4, (unsigned int*)  NCONST_V8_CAST(addr));
+        vec_ste((uint32x4_p) perm,  8, (unsigned int*)  NCONST_V8_CAST(addr));
+        vec_ste((uint32x4_p) perm, 12, (unsigned int*)  NCONST_V8_CAST(addr));
+        vec_ste((uint16x8_p) perm, 14, (unsigned short*)NCONST_V8_CAST(addr));
+        vec_ste((uint8x16_p) perm, 15, (unsigned char*) NCONST_V8_CAST(addr));
+    }
+}
+
+/// \brief Stores a vector to a byte array
+/// \tparam T vector type
+/// \param data the vector
+/// \param off offset into the dest byte array
+/// \param dest the byte array
+/// \details VecStore_ALTIVEC() stores a vector to a byte array.
+/// \details VecStore_ALTIVEC() uses <tt>vec_st</tt> if the effective address
+///  of <tt>dest</tt> is aligned, and uses <tt>vec_ste</tt> otherwise.
+///  <tt>vec_ste</tt> is relatively expensive so you should provide aligned
+///  memory addresses.
+/// \details VecStore_ALTIVEC() is used when POWER7 or above
+///  and unaligned loads is not available.
+/// \par Wraps
+///  vec_st, vec_ste, vec_lvsr, vec_perm
+/// \sa VecStore, VecStoreAligned
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStore_ALTIVEC(const T data, int off, byte dest[16])
+{
+    // Avoid IsAlignedOn for convenience.
+    uintptr_t addr = reinterpret_cast<uintptr_t>(dest)+off;
+    if (addr % 16 == 0)
+    {
+        vec_st((uint8x16_p)data, 0, NCONST_V8_CAST(addr));
+    }
+    else
+    {
+        // http://www.nxp.com/docs/en/reference-manual/ALTIVECPEM.pdf
+        uint8x16_p perm = (uint8x16_p)vec_perm(data, data, vec_lvsr(0, NCONST_V8_CAST(addr)));
+        vec_ste((uint8x16_p) perm,  0, (unsigned char*) NCONST_V8_CAST(addr));
+        vec_ste((uint16x8_p) perm,  1, (unsigned short*)NCONST_V8_CAST(addr));
+        vec_ste((uint32x4_p) perm,  3, (unsigned int*)  NCONST_V8_CAST(addr));
+        vec_ste((uint32x4_p) perm,  4, (unsigned int*)  NCONST_V8_CAST(addr));
+        vec_ste((uint32x4_p) perm,  8, (unsigned int*)  NCONST_V8_CAST(addr));
+        vec_ste((uint32x4_p) perm, 12, (unsigned int*)  NCONST_V8_CAST(addr));
+        vec_ste((uint16x8_p) perm, 14, (unsigned short*)NCONST_V8_CAST(addr));
+        vec_ste((uint8x16_p) perm, 15, (unsigned char*) NCONST_V8_CAST(addr));
+    }
+}
+
+/// \brief Stores a vector to a byte array
+/// \tparam T vector type
+/// \param data the vector
+/// \param dest the byte array
+/// \details VecStore() stores a vector to a byte array.
+/// \details VecStore() uses POWER9's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER9 is not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xst on POWER9 and above, Altivec store on POWER8 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 6.0
+template<class T>
+inline void VecStore(const T data, byte dest[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, 0, NCONST_V8_CAST(dest));
+#else
+    VecStore_ALTIVEC((uint8x16_p)data, NCONST_V8_CAST(dest));
+#endif
+}
+
+/// \brief Stores a vector to a byte array
+/// \tparam T vector type
+/// \param data the vector
+/// \param off offset into the dest byte array
+/// \param dest the byte array
+/// \details VecStore() stores a vector to a byte array.
+/// \details VecStore() uses POWER9's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER9 is not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xst on POWER9 and above, Altivec store on POWER8 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 6.0
+template<class T>
+inline void VecStore(const T data, int off, byte dest[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, off, NCONST_V8_CAST(dest));
+#else
+    VecStore_ALTIVEC((uint8x16_p)data, NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a word array
+/// \tparam T vector type
+/// \param data the vector
+/// \param dest the word array
+/// \details VecStore() stores a vector to a word array.
+/// \details VecStore() uses POWER7's and VSX's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER7 or VSX are not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, Altivec store on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStore(const T data, word32 dest[4])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word32>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, 0, NCONST_V8_CAST(dest));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    vec_xst((uint32x4_p)data, 0, NCONST_V32_CAST(addr));
+#else
+    VecStore_ALTIVEC((uint8x16_p)data, NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a word array
+/// \tparam T vector type
+/// \param data the vector
+/// \param off offset into the dest word array
+/// \param dest the word array
+/// \details VecStore() stores a vector to a word array.
+/// \details VecStore() uses POWER7's and VSX's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER7 or VSX are not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, Altivec store on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStore(const T data, int off, word32 dest[4])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word32>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, off, NCONST_V8_CAST(dest));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    vec_xst((uint32x4_p)data, 0, NCONST_V32_CAST(addr));
+#else
+    VecStore_ALTIVEC((uint8x16_p)data, NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a word array
+/// \tparam T vector type
+/// \param data the vector
+/// \param dest the word array
+/// \details VecStore() stores a vector to a word array.
+/// \details VecStore() uses POWER7's and VSX's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER7 or VSX are not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \details VecStore() with 64-bit elements is available on POWER8 and above.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, Altivec store on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStore(const T data, word64 dest[2])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word64>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, 0, NCONST_V8_CAST(dest));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    // 32-bit cast is not a typo. Compiler workaround.
+    vec_xst((uint32x4_p)data, 0, NCONST_V32_CAST(addr));
+#else
+    VecStore_ALTIVEC((uint8x16_p)data, NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a word array
+/// \tparam T vector type
+/// \param data the vector
+/// \param off offset into the dest word array
+/// \param dest the word array
+/// \details VecStore() stores a vector to a word array.
+/// \details VecStore() uses POWER7's and VSX's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER7 or VSX are not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \details VecStore() with 64-bit elements is available on POWER8 and above.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, Altivec store on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStore(const T data, int off, word64 dest[2])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word64>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, off, NCONST_V8_CAST(dest));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    // 32-bit cast is not a typo. Compiler workaround.
+    vec_xst((uint32x4_p)data, 0, NCONST_V32_CAST(addr));
+#else
+    VecStore_ALTIVEC((uint8x16_p)data, NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a byte array
+/// \tparam T vector type
+/// \param data the vector
+/// \param dest the byte array
+/// \details VecStoreAligned() stores a vector from an aligned byte array.
+/// \details VecStoreAligned() uses POWER9's <tt>vec_xl</tt> if available.
+///  <tt>vec_st</tt> is used if POWER9 is not available. The effective
+///  address of <tt>dest</tt> must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xst on POWER9 or above, vec_st on POWER8 and below
+/// \sa VecStore_ALTIVEC, VecStore
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStoreAligned(const T data, byte dest[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, 0, NCONST_V8_CAST(dest));
+#else
+    vec_st((uint8x16_p)data, 0, NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a byte array
+/// \tparam T vector type
+/// \param data the vector
+/// \param off offset into the dest byte array
+/// \param dest the byte array
+/// \details VecStoreAligned() stores a vector from an aligned byte array.
+/// \details VecStoreAligned() uses POWER9's <tt>vec_xl</tt> if available.
+///  <tt>vec_st</tt> is used if POWER9 is not available. The effective
+///  address of <tt>dest</tt> must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xst on POWER9 or above, vec_st on POWER8 and below
+/// \sa VecStore_ALTIVEC, VecStore
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStoreAligned(const T data, int off, byte dest[16])
+{
+    // Power7/ISA 2.06 provides vec_xl, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks loads for short* and char*.
+    // Power9/ISA 3.0 provides vec_xl for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, off, NCONST_V8_CAST(dest));
+#else
+    vec_st((uint8x16_p)data, 0, NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a word array
+/// \tparam T vector type
+/// \param data the vector
+/// \param dest the word array
+/// \details VecStoreAligned() stores a vector from an aligned word array.
+/// \details VecStoreAligned() uses POWER9's <tt>vec_xl</tt> if available.
+///  POWER7 <tt>vec_xst</tt> is used if POWER9 is not available. <tt>vec_st</tt>
+///  is used if POWER7 is not available. The effective address of <tt>dest</tt>
+///  must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, vec_st on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStore
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStoreAligned(const T data, word32 dest[4])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word32>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, 0, NCONST_V8_CAST(dest));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    vec_xst((uint32x4_p)data, 0, NCONST_V32_CAST(addr));
+#else
+    vec_st((uint8x16_p)data, 0, NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a word array
+/// \tparam T vector type
+/// \param data the vector
+/// \param off offset into the dest word array
+/// \param dest the word array
+/// \details VecStoreAligned() stores a vector from an aligned word array.
+/// \details VecStoreAligned() uses POWER9's <tt>vec_xl</tt> if available.
+///  POWER7 <tt>vec_xst</tt> is used if POWER9 is not available. <tt>vec_st</tt>
+///  is used if POWER7 is not available. The effective address of <tt>dest</tt>
+///  must be 16-byte aligned for Altivec.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, vec_st on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStore
+/// \since Crypto++ 8.0
+template<class T>
+inline void VecStoreAligned(const T data, int off, word32 dest[4])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word32>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst((uint8x16_p)data, off, NCONST_V8_CAST(dest));
+#elif defined(__VSX__) || defined(_ARCH_PWR8)
+    vec_xst((uint32x4_p)data, 0, NCONST_V32_CAST(addr));
+#else
+    vec_st((uint8x16_p)data, 0, NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a byte array
+/// \tparam T vector type
+/// \param data the vector
+/// \param dest the byte array
+/// \details VecStoreBE() stores a vector to a byte array. VecStoreBE
+///  will reverse all bytes in the array on a little endian system.
+/// \details VecStoreBE() uses POWER7's and VSX's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER7 is not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, vec_st on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 6.0
+template <class T>
+inline void VecStoreBE(const T data, byte dest[16])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst_be((uint8x16_p)data, 0, NCONST_V8_CAST(dest));
+#elif defined(CRYPTOPP_BIG_ENDIAN)
+    VecStore((uint8x16_p)data, NCONST_V8_CAST(addr));
+#else
+    VecStore((uint8x16_p)VecReverseLE(data), NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a byte array
+/// \tparam T vector type
+/// \param data the vector
+/// \param off offset into the dest byte array
+/// \param dest the byte array
+/// \details VecStoreBE() stores a vector to a byte array. VecStoreBE
+///  will reverse all bytes in the array on a little endian system.
+/// \details VecStoreBE() uses POWER7's and VSX's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER7 is not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, vec_st on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 6.0
+template <class T>
+inline void VecStoreBE(const T data, int off, byte dest[16])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<byte>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst_be((uint8x16_p)data, off, NCONST_V8_CAST(dest));
+#elif defined(CRYPTOPP_BIG_ENDIAN)
+    VecStore((uint8x16_p)data, NCONST_V8_CAST(addr));
+#else
+    VecStore((uint8x16_p)VecReverseLE(data), NCONST_V8_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a word array
+/// \tparam T vector type
+/// \param data the vector
+/// \param dest the word array
+/// \details VecStoreBE() stores a vector to a word array. VecStoreBE
+///  will reverse all bytes in the array on a little endian system.
+/// \details VecStoreBE() uses POWER7's and VSX's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER7 is not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, vec_st on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 8.0
+template <class T>
+inline void VecStoreBE(const T data, word32 dest[4])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest);
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word32>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst_be((uint8x16_p)data, 0, NCONST_V8_CAST(dest));
+#elif defined(CRYPTOPP_BIG_ENDIAN)
+    VecStore((uint32x4_p)data, NCONST_V32_CAST(addr));
+#else
+    VecStore((uint32x4_p)VecReverseLE(data), NCONST_V32_CAST(addr));
+#endif
+}
+
+/// \brief Stores a vector to a word array
+/// \tparam T vector type
+/// \param data the vector
+/// \param off offset into the dest word array
+/// \param dest the word array
+/// \details VecStoreBE() stores a vector to a word array. VecStoreBE
+///  will reverse all words in the array on a little endian system.
+/// \details VecStoreBE() uses POWER7's and VSX's <tt>vec_xst</tt> if available.
+///  The instruction does not require aligned effective memory addresses.
+///  VecStore_ALTIVEC() is used if POWER7 is not available.
+///  VecStore_ALTIVEC() can be relatively expensive if extra instructions
+///  are required to fix up unaligned memory addresses.
+/// \par Wraps
+///  vec_xst on VSX or POWER8 and above, vec_st on POWER7 and below
+/// \sa VecStore_ALTIVEC, VecStoreAligned
+/// \since Crypto++ 8.0
+template <class T>
+inline void VecStoreBE(const T data, int off, word32 dest[4])
+{
+    // Power7/ISA 2.06 provides vec_xst, but only for 32-bit and 64-bit
+    // word pointers. The ISA lacks stores for short* and char*.
+    // Power9/ISA 3.0 provides vec_xst for all datatypes.
+
+    const uintptr_t addr = reinterpret_cast<uintptr_t>(dest)+off;
+    CRYPTOPP_ASSERT(addr % GetAlignmentOf<word32>() == 0);
+    CRYPTOPP_UNUSED(addr);
+
+#if defined(_ARCH_PWR9)
+    vec_xst_be((uint8x16_p)data, off, NCONST_V8_CAST(dest));
+#elif defined(CRYPTOPP_BIG_ENDIAN)
+    VecStore((uint32x4_p)data, NCONST_V32_CAST(addr));
+#else
+    VecStore((uint32x4_p)VecReverseLE(data), NCONST_V32_CAST(addr));
+#endif
+}
+
+//@}
+
+/// \name LOGICAL OPERATIONS
+//@{
+
+/// \brief AND two vectors
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \details VecAnd() performs <tt>vec1 & vec2</tt>.
+///  vec2 is cast to the same type as vec1. The return vector
+///  is the same type as vec1.
+/// \par Wraps
+///  vec_and
+/// \sa VecAnd64
+/// \since Crypto++ 6.0
+template <class T1, class T2>
+inline T1 VecAnd(const T1 vec1, const T2 vec2)
+{
+    return (T1)vec_and(vec1, (T1)vec2);
+}
+
+/// \brief OR two vectors
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \details VecOr() performs <tt>vec1 | vec2</tt>.
+///  vec2 is cast to the same type as vec1. The return vector
+///  is the same type as vec1.
+/// \par Wraps
+///  vec_or
+/// \sa VecOr64
+/// \since Crypto++ 6.0
+template <class T1, class T2>
+inline T1 VecOr(const T1 vec1, const T2 vec2)
+{
+    return (T1)vec_or(vec1, (T1)vec2);
+}
+
+/// \brief XOR two vectors
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \details VecXor() performs <tt>vec1 ^ vec2</tt>.
+///  vec2 is cast to the same type as vec1. The return vector
+///  is the same type as vec1.
+/// \par Wraps
+///  vec_xor
+/// \sa VecXor64
+/// \since Crypto++ 6.0
+template <class T1, class T2>
+inline T1 VecXor(const T1 vec1, const T2 vec2)
+{
+    return (T1)vec_xor(vec1, (T1)vec2);
+}
+
+//@}
+
+/// \name ARITHMETIC OPERATIONS
+//@{
+
+/// \brief Add two vectors
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \details VecAdd() performs <tt>vec1 + vec2</tt>.
+///  vec2 is cast to the same type as vec1. The return vector
+///  is the same type as vec1.
+/// \par Wraps
+///  vec_add
+/// \sa VecAdd64
+/// \since Crypto++ 6.0
+template <class T1, class T2>
+inline T1 VecAdd(const T1 vec1, const T2 vec2)
+{
+    return (T1)vec_add(vec1, (T1)vec2);
+}
+
+/// \brief Subtract two vectors
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \details VecSub() performs <tt>vec1 - vec2</tt>.
+///  vec2 is cast to the same type as vec1. The return vector
+///  is the same type as vec1.
+/// \par Wraps
+///  vec_sub
+/// \sa VecSub64
+/// \since Crypto++ 6.0
+template <class T1, class T2>
+inline T1 VecSub(const T1 vec1, const T2 vec2)
+{
+    return (T1)vec_sub(vec1, (T1)vec2);
+}
+
+//@}
+
+/// \name PERMUTE OPERATIONS
+//@{
+
+/// \brief Permutes a vector
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec the vector
+/// \param mask vector mask
+/// \return vector
+/// \details VecPermute() creates a new vector from vec according to mask.
+///  mask is an uint8x16_p vector. The return vector is the same type as vec.
+/// \par Wraps
+///  vec_perm
+/// \since Crypto++ 6.0
+template <class T1, class T2>
+inline T1 VecPermute(const T1 vec, const T2 mask)
+{
+    return (T1)vec_perm(vec, vec, (uint8x16_p)mask);
+}
+
+/// \brief Permutes two vectors
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \param mask vector mask
+/// \return vector
+/// \details VecPermute() creates a new vector from vec1 and vec2 according to mask.
+///  mask is an uint8x16_p vector. The return vector is the same type as vec.
+/// \par Wraps
+///  vec_perm
+/// \since Crypto++ 6.0
+template <class T1, class T2>
+inline T1 VecPermute(const T1 vec1, const T1 vec2, const T2 mask)
+{
+    return (T1)vec_perm(vec1, (T1)vec2, (uint8x16_p)mask);
+}
+
+//@}
+
+/// \name SHIFT AND ROTATE OPERATIONS
+//@{
+
+/// \brief Shift a vector left
+/// \tparam C shift byte count
+/// \tparam T vector type
+/// \param vec the vector
+/// \return vector
+/// \details VecShiftLeftOctet() returns a new vector after shifting the
+///  concatenation of the zero vector and the source vector by the specified
+///  number of bytes. The return vector is the same type as vec.
+/// \details On big endian machines VecShiftLeftOctet() is <tt>vec_sld(a, z,
+///  c)</tt>. On little endian machines VecShiftLeftOctet() is translated to
+///  <tt>vec_sld(z, a, 16-c)</tt>. You should always call the function as
+///  if on a big endian machine as shown below.
+/// <pre>
+///   uint8x16_p x = VecLoad(ptr);
+///   uint8x16_p y = VecShiftLeftOctet<12>(x);
+/// </pre>
+/// \par Wraps
+///  vec_sld
+/// \sa <A HREF="https://stackoverflow.com/q/46341923/608639">Is vec_sld
+///  endian sensitive?</A> on Stack Overflow
+/// \since Crypto++ 6.0
+template <unsigned int C, class T>
+inline T VecShiftLeftOctet(const T vec)
+{
+    const T zero = {0};
+    if (C >= 16)
+    {
+        // Out of range
+        return zero;
+    }
+    else if (C == 0)
+    {
+        // Noop
+        return vec;
+    }
+    else
+    {
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    enum { R=C&0xf };
+    return (T)vec_sld((uint8x16_p)vec, (uint8x16_p)zero, R);
+#else
+    enum { R=(16-C)&0xf };  // Linux xlC 13.1 workaround in Debug builds
+    return (T)vec_sld((uint8x16_p)zero, (uint8x16_p)vec, R);
+#endif
+    }
+}
+
+/// \brief Shift a vector right
+/// \tparam C shift byte count
+/// \tparam T vector type
+/// \param vec the vector
+/// \return vector
+/// \details VecShiftRightOctet() returns a new vector after shifting the
+///  concatenation of the zero vector and the source vector by the specified
+///  number of bytes. The return vector is the same type as vec.
+/// \details On big endian machines VecShiftRightOctet() is <tt>vec_sld(a, z,
+///  c)</tt>. On little endian machines VecShiftRightOctet() is translated to
+///  <tt>vec_sld(z, a, 16-c)</tt>. You should always call the function as
+///  if on a big endian machine as shown below.
+/// <pre>
+///   uint8x16_p x = VecLoad(ptr);
+///   uint8x16_p y = VecShiftRightOctet<12>(y);
+/// </pre>
+/// \par Wraps
+///  vec_sld
+/// \sa <A HREF="https://stackoverflow.com/q/46341923/608639">Is vec_sld
+///  endian sensitive?</A> on Stack Overflow
+/// \since Crypto++ 6.0
+template <unsigned int C, class T>
+inline T VecShiftRightOctet(const T vec)
+{
+    const T zero = {0};
+    if (C >= 16)
+    {
+        // Out of range
+        return zero;
+    }
+    else if (C == 0)
+    {
+        // Noop
+        return vec;
+    }
+    else
+    {
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    enum { R=(16-C)&0xf };  // Linux xlC 13.1 workaround in Debug builds
+    return (T)vec_sld((uint8x16_p)zero, (uint8x16_p)vec, R);
+#else
+    enum { R=C&0xf };
+    return (T)vec_sld((uint8x16_p)vec, (uint8x16_p)zero, R);
+#endif
+    }
+}
+
+/// \brief Rotate a vector left
+/// \tparam C shift byte count
+/// \tparam T vector type
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateLeftOctet() returns a new vector after rotating the
+///  concatenation of the source vector with itself by the specified
+///  number of bytes. The return vector is the same type as vec.
+/// \par Wraps
+///  vec_sld
+/// \sa <A HREF="https://stackoverflow.com/q/46341923/608639">Is vec_sld
+///  endian sensitive?</A> on Stack Overflow
+/// \since Crypto++ 6.0
+template <unsigned int C, class T>
+inline T VecRotateLeftOctet(const T vec)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    enum { R = C&0xf };
+    return (T)vec_sld((uint8x16_p)vec, (uint8x16_p)vec, R);
+#else
+    enum { R=(16-C)&0xf };  // Linux xlC 13.1 workaround in Debug builds
+    return (T)vec_sld((uint8x16_p)vec, (uint8x16_p)vec, R);
+#endif
+}
+
+/// \brief Rotate a vector right
+/// \tparam C shift byte count
+/// \tparam T vector type
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateRightOctet() returns a new vector after rotating the
+///  concatenation of the source vector with itself by the specified
+///  number of bytes. The return vector is the same type as vec.
+/// \par Wraps
+///  vec_sld
+/// \sa <A HREF="https://stackoverflow.com/q/46341923/608639">Is vec_sld
+///  endian sensitive?</A> on Stack Overflow
+/// \since Crypto++ 6.0
+template <unsigned int C, class T>
+inline T VecRotateRightOctet(const T vec)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    enum { R=(16-C)&0xf };  // Linux xlC 13.1 workaround in Debug builds
+    return (T)vec_sld((uint8x16_p)vec, (uint8x16_p)vec, R);
+#else
+    enum { R = C&0xf };
+    return (T)vec_sld((uint8x16_p)vec, (uint8x16_p)vec, R);
+#endif
+}
+
+/// \brief Rotate a vector left
+/// \tparam C rotate bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateLeft() rotates each element in a vector by
+///  bit count. The return vector is the same type as vec.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 7.0
+template<unsigned int C>
+inline uint32x4_p VecRotateLeft(const uint32x4_p vec)
+{
+    const uint32x4_p m = {C, C, C, C};
+    return vec_rl(vec, m);
+}
+
+/// \brief Rotate a vector right
+/// \tparam C rotate bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateRight() rotates each element in a vector
+///  by bit count. The return vector is the same type as vec.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 7.0
+template<unsigned int C>
+inline uint32x4_p VecRotateRight(const uint32x4_p vec)
+{
+    const uint32x4_p m = {32-C, 32-C, 32-C, 32-C};
+    return vec_rl(vec, m);
+}
+
+/// \brief Shift a vector left
+/// \tparam C shift bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecShiftLeft() rotates each element in a vector
+///  by bit count. The return vector is the same type as vec.
+/// \par Wraps
+///  vec_sl
+/// \since Crypto++ 8.1
+template<unsigned int C>
+inline uint32x4_p VecShiftLeft(const uint32x4_p vec)
+{
+    const uint32x4_p m = {C, C, C, C};
+    return vec_sl(vec, m);
+}
+
+/// \brief Shift a vector right
+/// \tparam C shift bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecShiftRight() rotates each element in a vector
+///  by bit count. The return vector is the same type as vec.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 8.1
+template<unsigned int C>
+inline uint32x4_p VecShiftRight(const uint32x4_p vec)
+{
+    const uint32x4_p m = {C, C, C, C};
+    return vec_sr(vec, m);
+}
+
+// 64-bit elements available at POWER7 with VSX, but vec_rl and vec_sl require POWER8
+#if defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+/// \brief Rotate a vector left
+/// \tparam C rotate bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateLeft() rotates each element in a vector
+///  by bit count. The return vector is the same type as vec.
+/// \details VecRotateLeft() with 64-bit elements is available on
+///  POWER8 and above.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 8.0
+template<unsigned int C>
+inline uint64x2_p VecRotateLeft(const uint64x2_p vec)
+{
+    const uint64x2_p m = {C, C};
+    return vec_rl(vec, m);
+}
+
+/// \brief Shift a vector left
+/// \tparam C shift bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecShiftLeft() rotates each element in a vector
+///  by bit count. The return vector is the same type as vec.
+/// \details VecShiftLeft() with 64-bit elements is available on
+///  POWER8 and above.
+/// \par Wraps
+///  vec_sl
+/// \since Crypto++ 8.1
+template<unsigned int C>
+inline uint64x2_p VecShiftLeft(const uint64x2_p vec)
+{
+    const uint64x2_p m = {C, C};
+    return vec_sl(vec, m);
+}
+
+/// \brief Rotate a vector right
+/// \tparam C rotate bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateRight() rotates each element in a vector
+///  by bit count. The return vector is the same type as vec.
+/// \details VecRotateRight() with 64-bit elements is available on
+///  POWER8 and above.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 8.0
+template<unsigned int C>
+inline uint64x2_p VecRotateRight(const uint64x2_p vec)
+{
+    const uint64x2_p m = {64-C, 64-C};
+    return vec_rl(vec, m);
+}
+
+/// \brief Shift a vector right
+/// \tparam C shift bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecShiftRight() rotates each element in a vector
+///  by bit count. The return vector is the same type as vec.
+/// \details VecShiftRight() with 64-bit elements is available on
+///  POWER8 and above.
+/// \par Wraps
+///  vec_sr
+/// \since Crypto++ 8.1
+template<unsigned int C>
+inline uint64x2_p VecShiftRight(const uint64x2_p vec)
+{
+    const uint64x2_p m = {C, C};
+    return vec_sr(vec, m);
+}
+
+#endif  // ARCH_PWR8
+
+//@}
+
+/// \name OTHER OPERATIONS
+//@{
+
+/// \brief Merge two vectors
+/// \tparam T vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \par Wraps
+///  vec_mergel
+/// \since Crypto++ 8.1
+template <class T>
+inline T VecMergeLow(const T vec1, const T vec2)
+{
+    return vec_mergel(vec1, vec2);
+}
+
+/// \brief Merge two vectors
+/// \tparam T vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \par Wraps
+///  vec_mergeh
+/// \since Crypto++ 8.1
+template <class T>
+inline T VecMergeHigh(const T vec1, const T vec2)
+{
+    return vec_mergeh(vec1, vec2);
+}
+
+/// \brief Broadcast 32-bit word to a vector
+/// \param val the 32-bit value
+/// \return vector
+/// \par Wraps
+///  vec_splats
+/// \since Crypto++ 8.3
+inline uint32x4_p VecSplatWord(word32 val)
+{
+    // Fix spurious GCC warning???
+    CRYPTOPP_UNUSED(val);
+
+    // Apple Altivec and XL C++ do not offer vec_splats.
+    // GCC offers vec_splats back to -mcpu=power4.
+#if defined(_ARCH_PWR4) && defined(__GNUC__)
+    return vec_splats(val);
+#else
+    //const word32 x[4] = {val,val,val,val};
+    //return VecLoad(x);
+    const word32 x[4] = {val};
+    return vec_splat(VecLoad(x),0);
+#endif
+}
+
+/// \brief Broadcast 32-bit element to a vector
+/// \tparam the element number
+/// \param val the 32-bit value
+/// \return vector
+/// \par Wraps
+///  vec_splat
+/// \since Crypto++ 8.3
+template <unsigned int N>
+inline uint32x4_p VecSplatElement(const uint32x4_p val)
+{
+    return vec_splat(val, N);
+}
+
+#if defined(__VSX__) || defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Broadcast 64-bit double word to a vector
+/// \param val the 64-bit value
+/// \return vector
+/// \par Wraps
+///  vec_splats
+/// \since Crypto++ 8.3
+inline uint64x2_p VecSplatWord(word64 val)
+{
+    // The PPC64 ABI says so.
+    return vec_splats((unsigned long long)val);
+}
+
+/// \brief Broadcast 64-bit element to a vector
+/// \tparam the element number
+/// \param val the 64-bit value
+/// \return vector
+/// \par Wraps
+///  vec_splat
+/// \since Crypto++ 8.3
+template <unsigned int N>
+inline uint64x2_p VecSplatElement(const uint64x2_p val)
+{
+#if defined(__VSX__) || defined(_ARCH_PWR8)
+    return vec_splat(val, N);
+#else
+    enum {E=N&1};
+    if (E == 0)
+    {
+        const uint8x16_p m = {0,1,2,3, 4,5,6,7, 0,1,2,3, 4,5,6,7};
+        return vec_perm(val, val, m);
+    }
+    else // (E == 1)
+    {
+        const uint8x16_p m = {8,9,10,11, 12,13,14,15, 8,9,10,11, 12,13,14,15};
+        return vec_perm(val, val, m);
+    }
+#endif
+}
+#endif
+
+/// \brief Extract a dword from a vector
+/// \tparam T vector type
+/// \param val the vector
+/// \return vector created from low dword
+/// \details VecGetLow() extracts the low dword from a vector. The low dword
+///  is composed of the least significant bits and occupies bytes 8 through 15
+///  when viewed as a big endian array. The return vector is the same type as
+///  the original vector and padded with 0's in the most significant bit positions.
+/// \par Wraps
+///  vec_sld
+/// \since Crypto++ 7.0
+template <class T>
+inline T VecGetLow(const T val)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN) && (defined(__VSX__) || defined(_ARCH_PWR8))
+    const T zero = {0};
+    return (T)VecMergeLow((uint64x2_p)zero, (uint64x2_p)val);
+#else
+    return VecShiftRightOctet<8>(VecShiftLeftOctet<8>(val));
+#endif
+}
+
+/// \brief Extract a dword from a vector
+/// \tparam T vector type
+/// \param val the vector
+/// \return vector created from high dword
+/// \details VecGetHigh() extracts the high dword from a vector. The high dword
+///  is composed of the most significant bits and occupies bytes 0 through 7
+///  when viewed as a big endian array. The return vector is the same type as
+///  the original vector and padded with 0's in the most significant bit positions.
+/// \par Wraps
+///  vec_sld
+/// \since Crypto++ 7.0
+template <class T>
+inline T VecGetHigh(const T val)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN) && (defined(__VSX__) || defined(_ARCH_PWR8))
+    const T zero = {0};
+    return (T)VecMergeHigh((uint64x2_p)zero, (uint64x2_p)val);
+#else
+    return VecShiftRightOctet<8>(val);
+#endif
+}
+
+/// \brief Exchange high and low double words
+/// \tparam T vector type
+/// \param vec the vector
+/// \return vector
+/// \par Wraps
+///  vec_sld
+/// \since Crypto++ 7.0
+template <class T>
+inline T VecSwapWords(const T vec)
+{
+    return (T)vec_sld((uint8x16_p)vec, (uint8x16_p)vec, 8);
+}
+
+//@}
+
+/// \name COMPARISON
+//@{
+
+/// \brief Compare two vectors
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return true if vec1 equals vec2, false otherwise
+/// \details VecEqual() performs a bitwise compare. The vector element types do
+///  not matter.
+/// \par Wraps
+///  vec_all_eq
+/// \since Crypto++ 8.0
+template <class T1, class T2>
+inline bool VecEqual(const T1 vec1, const T2 vec2)
+{
+    return 1 == vec_all_eq((uint32x4_p)vec1, (uint32x4_p)vec2);
+}
+
+/// \brief Compare two vectors
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return true if vec1 does not equal vec2, false otherwise
+/// \details VecNotEqual() performs a bitwise compare. The vector element types do
+///  not matter.
+/// \par Wraps
+///  vec_all_eq
+/// \since Crypto++ 8.0
+template <class T1, class T2>
+inline bool VecNotEqual(const T1 vec1, const T2 vec2)
+{
+    return 0 == vec_all_eq((uint32x4_p)vec1, (uint32x4_p)vec2);
+}
+
+//@}
+
+////////////////// 32-bit Altivec /////////////////
+
+/// \name 32-BIT ALTIVEC
+//@{
+
+/// \brief Add two vectors as if uint64x2_p
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \details VecAdd64() performs <tt>vec1 + vec2</tt>. VecAdd64() performs as
+///  if adding two uint64x2_p vectors. On POWER7 and below VecAdd64() manages
+///  the carries from the elements.
+/// \par Wraps
+///  vec_add for POWER8, vec_addc, vec_perm, vec_add for Altivec
+/// \since Crypto++ 8.3
+inline uint32x4_p VecAdd64(const uint32x4_p& vec1, const uint32x4_p& vec2)
+{
+    // 64-bit elements available at POWER7 with VSX, but addudm requires POWER8
+#if defined(_ARCH_PWR8) && !defined(CRYPTOPP_DEBUG)
+    return (uint32x4_p)vec_add((uint64x2_p)vec1, (uint64x2_p)vec2);
+#else
+    // The carry mask selects carrys for elements 1 and 3 and sets
+    // remaining elements to 0. The results is then shifted so the
+    // carried values are added to elements 0 and 2.
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    const uint32x4_p zero = {0, 0, 0, 0};
+    const uint32x4_p mask = {0, 1, 0, 1};
+#else
+    const uint32x4_p zero = {0, 0, 0, 0};
+    const uint32x4_p mask = {1, 0, 1, 0};
+#endif
+
+    uint32x4_p cy = vec_addc(vec1, vec2);
+    uint32x4_p res = vec_add(vec1, vec2);
+    cy = vec_and(mask, cy);
+    cy = vec_sld (cy, zero, 4);
+    return vec_add(res, cy);
+#endif
+}
+
+#if defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Add two vectors as if uint64x2_p
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \details VecAdd64() performs <tt>vec1 + vec2</tt>. VecAdd64() performs as
+///  if adding two uint64x2_p vectors. On POWER7 and below VecAdd64() manages
+///  the carries from the elements.
+/// \par Wraps
+///  vec_add for POWER8
+/// \since Crypto++ 8.3
+inline uint64x2_p VecAdd64(const uint64x2_p& vec1, const uint64x2_p& vec2)
+{
+    // 64-bit elements available at POWER7 with VSX, but addudm requires POWER8
+    const uint64x2_p res = vec_add(vec1, vec2);
+
+#if defined(CRYPTOPP_DEBUG)
+    // Test 32-bit add in debug builds while we are here.
+    const uint32x4_p x = (uint32x4_p)vec1;
+    const uint32x4_p y = (uint32x4_p)vec2;
+    const uint32x4_p r = VecAdd64(x, y);
+
+    CRYPTOPP_ASSERT(vec_all_eq((uint32x4_p)res, r) == 1);
+#endif
+
+    return res;
+}
+#endif
+
+/// \brief Subtract two vectors as if uint64x2_p
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \details VecSub64() performs <tt>vec1 - vec2</tt>. VecSub64() performs as
+///  if subtracting two uint64x2_p vectors. On POWER7 and below VecSub64()
+///  manages the borrows from the elements.
+/// \par Wraps
+///  vec_sub for POWER8, vec_subc, vec_andc, vec_perm, vec_sub for Altivec
+/// \since Crypto++ 8.3
+inline uint32x4_p VecSub64(const uint32x4_p& vec1, const uint32x4_p& vec2)
+{
+#if defined(_ARCH_PWR8) && !defined(CRYPTOPP_DEBUG)
+    // 64-bit elements available at POWER7 with VSX, but subudm requires POWER8
+    return (uint32x4_p)vec_sub((uint64x2_p)vec1, (uint64x2_p)vec2);
+#else
+    // The borrow mask selects borrows for elements 1 and 3 and sets
+    // remaining elements to 0. The results is then shifted so the
+    // borrowed values are subtracted from elements 0 and 2.
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    const uint32x4_p zero = {0, 0, 0, 0};
+    const uint32x4_p mask = {0, 1, 0, 1};
+#else
+    const uint32x4_p zero = {0, 0, 0, 0};
+    const uint32x4_p mask = {1, 0, 1, 0};
+#endif
+
+    // subc sets the complement of borrow, so we have to
+    // un-complement it using andc.
+    uint32x4_p bw = vec_subc(vec1, vec2);
+    uint32x4_p res = vec_sub(vec1, vec2);
+    bw = vec_andc(mask, bw);
+    bw = vec_sld (bw, zero, 4);
+    return vec_sub(res, bw);
+#endif
+}
+
+#if defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Subtract two vectors as if uint64x2_p
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \details VecSub64() performs <tt>vec1 - vec2</tt>. VecSub64() performs as
+///  if subtracting two uint64x2_p vectors. On POWER7 and below VecSub64()
+///  manages the borrows from the elements.
+/// \par Wraps
+///  vec_sub for POWER8
+/// \since Crypto++ 8.3
+inline uint64x2_p VecSub64(const uint64x2_p& vec1, const uint64x2_p& vec2)
+{
+    // 64-bit elements available at POWER7 with VSX, but subudm requires POWER8
+    const uint64x2_p res = vec_sub(vec1, vec2);
+
+#if defined(CRYPTOPP_DEBUG)
+    // Test 32-bit sub in debug builds while we are here.
+    const uint32x4_p x = (uint32x4_p)vec1;
+    const uint32x4_p y = (uint32x4_p)vec2;
+    const uint32x4_p r = VecSub64(x, y);
+
+    CRYPTOPP_ASSERT(vec_all_eq((uint32x4_p)res, r) == 1);
+#endif
+
+    return res;
+}
+#endif
+
+/// \brief Rotate a vector left as if uint64x2_p
+/// \tparam C rotate bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateLeft() rotates each element in a vector by bit count.
+///  vec is rotated as if uint64x2_p.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 8.3
+template<unsigned int C>
+inline uint32x4_p VecRotateLeft64(const uint32x4_p vec)
+{
+#if defined(_ARCH_PWR8) && !defined(CRYPTOPP_DEBUG)
+    // 64-bit elements available at POWER7 with VSX, but vec_rl and vec_sl require POWER8
+    return (uint32x4_p)VecRotateLeft<C>((uint64x2_p)vec);
+#else
+    // C=0, 32, or 64 needs special handling. That is S32 and S64 below.
+    enum {S64=C&63, S32=C&31, BR=(S64>=32)};
+
+    // Get the low bits, shift them to high bits
+    uint32x4_p t1 = VecShiftLeft<S32>(vec);
+    // Get the high bits, shift them to low bits
+    uint32x4_p t2 = VecShiftRight<32-S32>(vec);
+
+    if (S64 == 0)
+    {
+        const uint8x16_p m = {0,1,2,3, 4,5,6,7, 8,9,10,11, 12,13,14,15};
+        return VecPermute(vec, m);
+    }
+    else if (S64 == 32)
+    {
+        const uint8x16_p m = {4,5,6,7, 0,1,2,3, 12,13,14,15, 8,9,10,11};
+        return VecPermute(vec, m);
+    }
+    else if (BR)  // Big rotate amount?
+    {
+        const uint8x16_p m = {4,5,6,7, 0,1,2,3, 12,13,14,15, 8,9,10,11};
+        t1 = VecPermute(t1, m);
+    }
+    else
+    {
+        const uint8x16_p m = {4,5,6,7, 0,1,2,3, 12,13,14,15, 8,9,10,11};
+        t2 = VecPermute(t2, m);
+    }
+
+    return vec_or(t1, t2);
+#endif
+}
+
+/// \brief Rotate a vector left as if uint64x2_p
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateLeft<8>() rotates each element in a vector
+///  by 8-bits. vec is rotated as if uint64x2_p. This specialization
+///  is used by algorithms like Speck128.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 8.3
+template<>
+inline uint32x4_p VecRotateLeft64<8>(const uint32x4_p vec)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m = { 1,2,3,4, 5,6,7,0, 9,10,11,12, 13,14,15,8 };
+    return VecPermute(vec, m);
+#else
+    const uint8x16_p m = { 7,0,1,2, 3,4,5,6, 15,8,9,10, 11,12,13,14 };
+    return VecPermute(vec, m);
+#endif
+}
+
+#if defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Rotate a vector left as if uint64x2_p
+/// \tparam C rotate bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateLeft64() rotates each element in a vector by
+///  bit count. vec is rotated as if uint64x2_p.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 8.3
+template<unsigned int C>
+inline uint64x2_p VecRotateLeft64(const uint64x2_p vec)
+{
+    // 64-bit elements available at POWER7 with VSX, but vec_rl and vec_sl require POWER8
+    const uint64x2_p res = VecRotateLeft<C>(vec);
+
+#if defined(CRYPTOPP_DEBUG)
+    // Test 32-bit rotate in debug builds while we are here.
+    const uint32x4_p x = (uint32x4_p)vec;
+    const uint32x4_p r = VecRotateLeft64<C>(x);
+
+    CRYPTOPP_ASSERT(vec_all_eq((uint32x4_p)res, r) == 1);
+#endif
+
+    return res;
+}
+#endif
+
+/// \brief Rotate a vector right as if uint64x2_p
+/// \tparam C rotate bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateRight64() rotates each element in a vector by
+///  bit count. vec is rotated as if uint64x2_p.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 8.3
+template<unsigned int C>
+inline uint32x4_p VecRotateRight64(const uint32x4_p vec)
+{
+#if defined(_ARCH_PWR8) && !defined(CRYPTOPP_DEBUG)
+    // 64-bit elements available at POWER7 with VSX, but vec_rl and vec_sl require POWER8
+    return (uint32x4_p)VecRotateRight<C>((uint64x2_p)vec);
+#else
+    // C=0, 32, or 64 needs special handling. That is S32 and S64 below.
+    enum {S64=C&63, S32=C&31, BR=(S64>=32)};
+
+    // Get the low bits, shift them to high bits
+    uint32x4_p t1 = VecShiftRight<S32>(vec);
+    // Get the high bits, shift them to low bits
+    uint32x4_p t2 = VecShiftLeft<32-S32>(vec);
+
+    if (S64 == 0)
+    {
+        const uint8x16_p m = {0,1,2,3, 4,5,6,7, 8,9,10,11, 12,13,14,15};
+        return VecPermute(vec, m);
+    }
+    else if (S64 == 32)
+    {
+        const uint8x16_p m = {4,5,6,7, 0,1,2,3, 12,13,14,15, 8,9,10,11};
+        return VecPermute(vec, m);
+    }
+    else if (BR)  // Big rotate amount?
+    {
+        const uint8x16_p m = {4,5,6,7, 0,1,2,3, 12,13,14,15, 8,9,10,11};
+        t1 = VecPermute(t1, m);
+    }
+    else
+    {
+        const uint8x16_p m = {4,5,6,7, 0,1,2,3, 12,13,14,15, 8,9,10,11};
+        t2 = VecPermute(t2, m);
+    }
+
+    return vec_or(t1, t2);
+#endif
+}
+
+/// \brief Rotate a vector right as if uint64x2_p
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateRight64<8>() rotates each element in a vector
+///  by 8-bits. vec is rotated as if uint64x2_p. This specialization
+///  is used by algorithms like Speck128.
+/// \details vec is rotated as if uint64x2_p.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 8.3
+template<>
+inline uint32x4_p VecRotateRight64<8>(const uint32x4_p vec)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m = { 7,0,1,2, 3,4,5,6, 15,8,9,10, 11,12,13,14 };
+    return VecPermute(vec, m);
+#else
+    const uint8x16_p m = { 1,2,3,4, 5,6,7,0, 9,10,11,12, 13,14,15,8 };
+    return VecPermute(vec, m);
+#endif
+}
+
+#if defined(__VSX__) || defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Rotate a vector right as if uint64x2_p
+/// \tparam C rotate bit count
+/// \param vec the vector
+/// \return vector
+/// \details VecRotateRight64() rotates each element in a vector by
+///  bit count. vec is rotated as if uint64x2_p.
+/// \par Wraps
+///  vec_rl
+/// \since Crypto++ 8.3
+template<unsigned int C>
+inline uint64x2_p VecRotateRight64(const uint64x2_p vec)
+{
+    // 64-bit elements available at POWER7 with VSX, but vec_rl and vec_sl require POWER8
+    const uint64x2_p res = VecRotateRight<C>(vec);
+
+#if defined(CRYPTOPP_DEBUG)
+    // Test 32-bit rotate in debug builds while we are here.
+    const uint32x4_p x = (uint32x4_p)vec;
+    const uint32x4_p r = VecRotateRight64<C>(x);
+
+    CRYPTOPP_ASSERT(vec_all_eq((uint32x4_p)res, r) == 1);
+#endif
+
+    return res;
+}
+#endif
+
+/// \brief AND two vectors as if uint64x2_p
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \details VecAnd64() performs <tt>vec1 & vec2</tt>.
+///  vec2 is cast to the same type as vec1. The return vector
+///  is the same type as vec1.
+/// \details VecAnd64() is a convenience function that simply performs a VecAnd().
+/// \par Wraps
+///  vec_and
+/// \since Crypto++ 8.3
+template <class T1, class T2>
+inline T1 VecAnd64(const T1 vec1, const T2 vec2)
+{
+    return (T1)vec_and(vec1, (T1)vec2);
+}
+
+/// \brief OR two vectors as if uint64x2_p
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \details VecOr64() performs <tt>vec1 | vec2</tt>.
+///  vec2 is cast to the same type as vec1. The return vector
+///  is the same type as vec1.
+/// \details VecOr64() is a convenience function that simply performs a VecOr().
+/// \par Wraps
+///  vec_or
+/// \since Crypto++ 8.3
+template <class T1, class T2>
+inline T1 VecOr64(const T1 vec1, const T2 vec2)
+{
+    return (T1)vec_or(vec1, (T1)vec2);
+}
+
+/// \brief XOR two vectors as if uint64x2_p
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param vec1 the first vector
+/// \param vec2 the second vector
+/// \return vector
+/// \details VecXor64() performs <tt>vec1 ^ vec2</tt>.
+///  vec2 is cast to the same type as vec1. The return vector
+///  is the same type as vec1.
+/// \details VecXor64() is a convenience function that simply performs a VecXor().
+/// \par Wraps
+///  vec_xor
+/// \since Crypto++ 8.3
+template <class T1, class T2>
+inline T1 VecXor64(const T1 vec1, const T2 vec2)
+{
+    return (T1)vec_xor(vec1, (T1)vec2);
+}
+
+/// \brief Broadcast 64-bit double word to a vector
+/// \param val the 64-bit value
+/// \return vector
+/// \par Wraps
+///  vec_splats
+/// \since Crypto++ 8.3
+inline uint32x4_p VecSplatWord64(word64 val)
+{
+#if defined(_ARCH_PWR8)
+    // The PPC64 ABI says so.
+    return (uint32x4_p)vec_splats((unsigned long long)val);
+#else
+    const word64 x[2] = {val,val};
+    return (uint32x4_p)VecLoad((const word32*)x);
+#endif
+}
+
+/// \brief Broadcast 64-bit element to a vector as if uint64x2_p
+/// \tparam the element number
+/// \param val the 64-bit value
+/// \return vector
+/// \par Wraps
+///  vec_splat
+/// \since Crypto++ 8.3
+template <unsigned int N>
+inline uint32x4_p VecSplatElement64(const uint32x4_p val)
+{
+#if defined(__VSX__) || defined(_ARCH_PWR8)
+    return (uint32x4_p)vec_splat((uint64x2_p)val, N);
+#else
+    enum {E=N&1};
+    if (E == 0)
+    {
+        const uint8x16_p m = {0,1,2,3, 4,5,6,7, 0,1,2,3, 4,5,6,7};
+        return (uint32x4_p)vec_perm(val, val, m);
+    }
+    else // (E == 1)
+    {
+        const uint8x16_p m = {8,9,10,11, 12,13,14,15, 8,9,10,11, 12,13,14,15};
+        return (uint32x4_p)vec_perm(val, val, m);
+    }
+#endif
+}
+
+#if defined(__VSX__) || defined(_ARCH_PWR8) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Broadcast 64-bit element to a vector
+/// \tparam the element number
+/// \param val the 64-bit value
+/// \return vector
+/// \since Crypto++ 8.3
+template <unsigned int N>
+inline uint64x2_p VecSplatElement64(const uint64x2_p val)
+{
+    return vec_splat(val, N);
+}
+#endif
+
+//@}
+
+//////////////////////// Power8 Crypto ////////////////////////
+
+// __CRYPTO__ alone is not enough. Clang will define __CRYPTO__
+// when it is not available, like with Power7. Sigh...
+#if (defined(_ARCH_PWR8) && defined(__CRYPTO__)) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+/// \name POLYNOMIAL MULTIPLICATION
+//@{
+
+/// \brief Polynomial multiplication
+/// \param a the first term
+/// \param b the second term
+/// \return vector product
+/// \details VecPolyMultiply() performs polynomial multiplication. POWER8
+///  polynomial multiplication multiplies the high and low terms, and then
+///  XOR's the high and low products. That is, the result is <tt>ah*bh XOR
+///  al*bl</tt>. It is different behavior than Intel polynomial
+///  multiplication. To obtain a single product without the XOR, then set
+///  one of the high or low terms to 0. For example, setting <tt>ah=0</tt>
+///  results in <tt>0*bh XOR al*bl = al*bl</tt>.
+/// \par Wraps
+///  __vpmsumw, __builtin_altivec_crypto_vpmsumw and __builtin_crypto_vpmsumw.
+/// \since Crypto++ 8.1
+inline uint32x4_p VecPolyMultiply(const uint32x4_p& a, const uint32x4_p& b)
+{
+#if defined(__ibmxl__) || (defined(_AIX) && defined(__xlC__))
+    return __vpmsumw (a, b);
+#elif defined(__clang__)
+    return __builtin_altivec_crypto_vpmsumw (a, b);
+#else
+    return __builtin_crypto_vpmsumw (a, b);
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first term
+/// \param b the second term
+/// \return vector product
+/// \details VecPolyMultiply() performs polynomial multiplication. POWER8
+///  polynomial multiplication multiplies the high and low terms, and then
+///  XOR's the high and low products. That is, the result is <tt>ah*bh XOR
+///  al*bl</tt>. It is different behavior than Intel polynomial
+///  multiplication. To obtain a single product without the XOR, then set
+///  one of the high or low terms to 0. For example, setting <tt>ah=0</tt>
+///  results in <tt>0*bh XOR al*bl = al*bl</tt>.
+/// \par Wraps
+///  __vpmsumd, __builtin_altivec_crypto_vpmsumd and __builtin_crypto_vpmsumd.
+/// \since Crypto++ 8.1
+inline uint64x2_p VecPolyMultiply(const uint64x2_p& a, const uint64x2_p& b)
+{
+#if defined(__ibmxl__) || (defined(_AIX) && defined(__xlC__))
+    return __vpmsumd (a, b);
+#elif defined(__clang__)
+    return __builtin_altivec_crypto_vpmsumd (a, b);
+#else
+    return __builtin_crypto_vpmsumd (a, b);
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first term
+/// \param b the second term
+/// \return vector product
+/// \details VecIntelMultiply00() performs polynomial multiplication and presents
+///  the result like Intel's <tt>c = _mm_clmulepi64_si128(a, b, 0x00)</tt>.
+///  The <tt>0x00</tt> indicates the low 64-bits of <tt>a</tt> and <tt>b</tt>
+///  are multiplied.
+/// \note An Intel XMM register is composed of 128-bits. The leftmost bit
+///  is MSB and numbered 127, while the rightmost bit is LSB and numbered 0.
+/// \par Wraps
+///  __vpmsumd, __builtin_altivec_crypto_vpmsumd and __builtin_crypto_vpmsumd.
+/// \since Crypto++ 8.0
+inline uint64x2_p VecIntelMultiply00(const uint64x2_p& a, const uint64x2_p& b)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    return VecSwapWords(VecPolyMultiply(VecGetHigh(a), VecGetHigh(b)));
+#else
+    return VecPolyMultiply(VecGetHigh(a), VecGetHigh(b));
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first term
+/// \param b the second term
+/// \return vector product
+/// \details VecIntelMultiply01 performs() polynomial multiplication and presents
+///  the result like Intel's <tt>c = _mm_clmulepi64_si128(a, b, 0x01)</tt>.
+///  The <tt>0x01</tt> indicates the low 64-bits of <tt>a</tt> and high
+///  64-bits of <tt>b</tt> are multiplied.
+/// \note An Intel XMM register is composed of 128-bits. The leftmost bit
+///  is MSB and numbered 127, while the rightmost bit is LSB and numbered 0.
+/// \par Wraps
+///  __vpmsumd, __builtin_altivec_crypto_vpmsumd and __builtin_crypto_vpmsumd.
+/// \since Crypto++ 8.0
+inline uint64x2_p VecIntelMultiply01(const uint64x2_p& a, const uint64x2_p& b)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    return VecSwapWords(VecPolyMultiply(a, VecGetHigh(b)));
+#else
+    return VecPolyMultiply(a, VecGetHigh(b));
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first term
+/// \param b the second term
+/// \return vector product
+/// \details VecIntelMultiply10() performs polynomial multiplication and presents
+///  the result like Intel's <tt>c = _mm_clmulepi64_si128(a, b, 0x10)</tt>.
+///  The <tt>0x10</tt> indicates the high 64-bits of <tt>a</tt> and low
+///  64-bits of <tt>b</tt> are multiplied.
+/// \note An Intel XMM register is composed of 128-bits. The leftmost bit
+///  is MSB and numbered 127, while the rightmost bit is LSB and numbered 0.
+/// \par Wraps
+///  __vpmsumd, __builtin_altivec_crypto_vpmsumd and __builtin_crypto_vpmsumd.
+/// \since Crypto++ 8.0
+inline uint64x2_p VecIntelMultiply10(const uint64x2_p& a, const uint64x2_p& b)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    return VecSwapWords(VecPolyMultiply(VecGetHigh(a), b));
+#else
+    return VecPolyMultiply(VecGetHigh(a), b);
+#endif
+}
+
+/// \brief Polynomial multiplication
+/// \param a the first term
+/// \param b the second term
+/// \return vector product
+/// \details VecIntelMultiply11() performs polynomial multiplication and presents
+///  the result like Intel's <tt>c = _mm_clmulepi64_si128(a, b, 0x11)</tt>.
+///  The <tt>0x11</tt> indicates the high 64-bits of <tt>a</tt> and <tt>b</tt>
+///  are multiplied.
+/// \note An Intel XMM register is composed of 128-bits. The leftmost bit
+///  is MSB and numbered 127, while the rightmost bit is LSB and numbered 0.
+/// \par Wraps
+///  __vpmsumd, __builtin_altivec_crypto_vpmsumd and __builtin_crypto_vpmsumd.
+/// \since Crypto++ 8.0
+inline uint64x2_p VecIntelMultiply11(const uint64x2_p& a, const uint64x2_p& b)
+{
+#if defined(CRYPTOPP_BIG_ENDIAN)
+    return VecSwapWords(VecPolyMultiply(VecGetLow(a), b));
+#else
+    return VecPolyMultiply(VecGetLow(a), b);
+#endif
+}
+
+//@}
+
+/// \name AES ENCRYPTION
+//@{
+
+/// \brief One round of AES encryption
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param state the state vector
+/// \param key the subkey vector
+/// \details VecEncrypt() performs one round of AES encryption of state
+///  using subkey key. The return vector is the same type as state.
+/// \details VecEncrypt() is available on POWER8 and above.
+/// \par Wraps
+///  __vcipher, __builtin_altivec_crypto_vcipher, __builtin_crypto_vcipher
+/// \since GCC and XLC since Crypto++ 6.0, LLVM Clang since Crypto++ 8.0
+template <class T1, class T2>
+inline T1 VecEncrypt(const T1 state, const T2 key)
+{
+#if defined(__ibmxl__) || (defined(_AIX) && defined(__xlC__))
+    return (T1)__vcipher((uint8x16_p)state, (uint8x16_p)key);
+#elif defined(__clang__)
+    return (T1)__builtin_altivec_crypto_vcipher((uint64x2_p)state, (uint64x2_p)key);
+#elif defined(__GNUC__)
+    return (T1)__builtin_crypto_vcipher((uint64x2_p)state, (uint64x2_p)key);
+#else
+    CRYPTOPP_ASSERT(0);
+#endif
+}
+
+/// \brief Final round of AES encryption
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param state the state vector
+/// \param key the subkey vector
+/// \details VecEncryptLast() performs the final round of AES encryption
+///  of state using subkey key. The return vector is the same type as state.
+/// \details VecEncryptLast() is available on POWER8 and above.
+/// \par Wraps
+///  __vcipherlast, __builtin_altivec_crypto_vcipherlast, __builtin_crypto_vcipherlast
+/// \since GCC and XLC since Crypto++ 6.0, LLVM Clang since Crypto++ 8.0
+template <class T1, class T2>
+inline T1 VecEncryptLast(const T1 state, const T2 key)
+{
+#if defined(__ibmxl__) || (defined(_AIX) && defined(__xlC__))
+    return (T1)__vcipherlast((uint8x16_p)state, (uint8x16_p)key);
+#elif defined(__clang__)
+    return (T1)__builtin_altivec_crypto_vcipherlast((uint64x2_p)state, (uint64x2_p)key);
+#elif defined(__GNUC__)
+    return (T1)__builtin_crypto_vcipherlast((uint64x2_p)state, (uint64x2_p)key);
+#else
+    CRYPTOPP_ASSERT(0);
+#endif
+}
+
+/// \brief One round of AES decryption
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param state the state vector
+/// \param key the subkey vector
+/// \details VecDecrypt() performs one round of AES decryption of state
+///  using subkey key. The return vector is the same type as state.
+/// \details VecDecrypt() is available on POWER8 and above.
+/// \par Wraps
+///  __vncipher, __builtin_altivec_crypto_vncipher, __builtin_crypto_vncipher
+/// \since GCC and XLC since Crypto++ 6.0, LLVM Clang since Crypto++ 8.0
+template <class T1, class T2>
+inline T1 VecDecrypt(const T1 state, const T2 key)
+{
+#if defined(__ibmxl__) || (defined(_AIX) && defined(__xlC__))
+    return (T1)__vncipher((uint8x16_p)state, (uint8x16_p)key);
+#elif defined(__clang__)
+    return (T1)__builtin_altivec_crypto_vncipher((uint64x2_p)state, (uint64x2_p)key);
+#elif defined(__GNUC__)
+    return (T1)__builtin_crypto_vncipher((uint64x2_p)state, (uint64x2_p)key);
+#else
+    CRYPTOPP_ASSERT(0);
+#endif
+}
+
+/// \brief Final round of AES decryption
+/// \tparam T1 vector type
+/// \tparam T2 vector type
+/// \param state the state vector
+/// \param key the subkey vector
+/// \details VecDecryptLast() performs the final round of AES decryption
+///  of state using subkey key. The return vector is the same type as state.
+/// \details VecDecryptLast() is available on POWER8 and above.
+/// \par Wraps
+///  __vncipherlast, __builtin_altivec_crypto_vncipherlast, __builtin_crypto_vncipherlast
+/// \since GCC and XLC since Crypto++ 6.0, LLVM Clang since Crypto++ 8.0
+template <class T1, class T2>
+inline T1 VecDecryptLast(const T1 state, const T2 key)
+{
+#if defined(__ibmxl__) || (defined(_AIX) && defined(__xlC__))
+    return (T1)__vncipherlast((uint8x16_p)state, (uint8x16_p)key);
+#elif defined(__clang__)
+    return (T1)__builtin_altivec_crypto_vncipherlast((uint64x2_p)state, (uint64x2_p)key);
+#elif defined(__GNUC__)
+    return (T1)__builtin_crypto_vncipherlast((uint64x2_p)state, (uint64x2_p)key);
+#else
+    CRYPTOPP_ASSERT(0);
+#endif
+}
+
+//@}
+
+/// \name SHA DIGESTS
+//@{
+
+/// \brief SHA256 Sigma functions
+/// \tparam func function
+/// \tparam fmask function mask
+/// \tparam T vector type
+/// \param data the block to transform
+/// \details VecSHA256() selects sigma0, sigma1, Sigma0, Sigma1 based on
+///  func and fmask. The return vector is the same type as data.
+/// \details VecSHA256() is available on POWER8 and above.
+/// \par Wraps
+///  __vshasigmaw, __builtin_altivec_crypto_vshasigmaw, __builtin_crypto_vshasigmaw
+/// \since GCC and XLC since Crypto++ 6.0, LLVM Clang since Crypto++ 8.0
+template <int func, int fmask, class T>
+inline T VecSHA256(const T data)
+{
+#if defined(__ibmxl__) || (defined(_AIX) && defined(__xlC__))
+    return (T)__vshasigmaw((uint32x4_p)data, func, fmask);
+#elif defined(__clang__)
+    return (T)__builtin_altivec_crypto_vshasigmaw((uint32x4_p)data, func, fmask);
+#elif defined(__GNUC__)
+    return (T)__builtin_crypto_vshasigmaw((uint32x4_p)data, func, fmask);
+#else
+    CRYPTOPP_ASSERT(0);
+#endif
+}
+
+/// \brief SHA512 Sigma functions
+/// \tparam func function
+/// \tparam fmask function mask
+/// \tparam T vector type
+/// \param data the block to transform
+/// \details VecSHA512() selects sigma0, sigma1, Sigma0, Sigma1 based on
+///  func and fmask. The return vector is the same type as data.
+/// \details VecSHA512() is available on POWER8 and above.
+/// \par Wraps
+///  __vshasigmad, __builtin_altivec_crypto_vshasigmad, __builtin_crypto_vshasigmad
+/// \since GCC and XLC since Crypto++ 6.0, LLVM Clang since Crypto++ 8.0
+template <int func, int fmask, class T>
+inline T VecSHA512(const T data)
+{
+#if defined(__ibmxl__) || (defined(_AIX) && defined(__xlC__))
+    return (T)__vshasigmad((uint64x2_p)data, func, fmask);
+#elif defined(__clang__)
+    return (T)__builtin_altivec_crypto_vshasigmad((uint64x2_p)data, func, fmask);
+#elif defined(__GNUC__)
+    return (T)__builtin_crypto_vshasigmad((uint64x2_p)data, func, fmask);
+#else
+    CRYPTOPP_ASSERT(0);
+#endif
+}
+
+//@}
+
+#endif  // __CRYPTO__
+
+#endif  // _ALTIVEC_
+
+NAMESPACE_END
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic pop
+#endif
+
+#endif  // CRYPTOPP_PPC_CRYPTO_H
diff --git a/runtime/third_party/cryptopp/primetab.cpp b/runtime/third_party/cryptopp/primetab.cpp
new file mode 100644
index 0000000..0fc3989
--- /dev/null
+++ b/runtime/third_party/cryptopp/primetab.cpp
@@ -0,0 +1,386 @@
+// primetab.cpp - written and placed in the public domain by Jeffrey Walton
+//
+// nbtheory.cpp originally built the prime table on the fly, and then
+// returned a reference to it in a Singleton. This was useful to
+// save memory in the old days. Nowadays we can precompute the table
+// and place it in the read-only data segment. Also see
+// https://github.com/weidai11/cryptopp/issues/1210.
+
+// The table below was generated from the original Crypto++ table:
+//
+// $ cat test.cxx
+// #include <iostream>
+// #include <iomanip>
+// #include <sstream>
+// #include "config.h"
+// #include "nbtheory.h"
+//
+// int main(int argc, char* argv[])
+// {
+//     using namespace CryptoPP;
+//
+//     unsigned int  primeTableSize = 0;
+//     const word16* primeTable = NULLPTR;
+//     primeTable = GetPrimeTable(primeTableSize);
+//
+//     for (size_t i=0; i<primeTableSize; ++i)
+//     {
+//         std::cout << primeTable[i];
+//         if (i != primeTableSize - 1)
+//             std::cout << ", ";
+//     }
+//     std::cout << std::endl;
+//
+//     return 0;
+// }
+//
+// And then `./test.exe | fold -s -w 75
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "config_int.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// From nbtheory.cpp:
+// const unsigned int maxPrimeTableSize = 3511;
+// const word s_lastSmallPrime = 32719;
+
+extern const word16 precomputedPrimeTable[3511];
+
+const word16 precomputedPrimeTable[3511] = {
+    2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67,
+    71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137, 139, 149,
+    151, 157, 163, 167, 173, 179, 181, 191, 193, 197, 199, 211, 223, 227, 229,
+    233, 239, 241, 251, 257, 263, 269, 271, 277, 281, 283, 293, 307, 311, 313,
+    317, 331, 337, 347, 349, 353, 359, 367, 373, 379, 383, 389, 397, 401, 409,
+    419, 421, 431, 433, 439, 443, 449, 457, 461, 463, 467, 479, 487, 491, 499,
+    503, 509, 521, 523, 541, 547, 557, 563, 569, 571, 577, 587, 593, 599, 601,
+    607, 613, 617, 619, 631, 641, 643, 647, 653, 659, 661, 673, 677, 683, 691,
+    701, 709, 719, 727, 733, 739, 743, 751, 757, 761, 769, 773, 787, 797, 809,
+    811, 821, 823, 827, 829, 839, 853, 857, 859, 863, 877, 881, 883, 887, 907,
+    911, 919, 929, 937, 941, 947, 953, 967, 971, 977, 983, 991, 997, 1009,
+    1013, 1019, 1021, 1031, 1033, 1039, 1049, 1051, 1061, 1063, 1069, 1087,
+    1091, 1093, 1097, 1103, 1109, 1117, 1123, 1129, 1151, 1153, 1163, 1171,
+    1181, 1187, 1193, 1201, 1213, 1217, 1223, 1229, 1231, 1237, 1249, 1259,
+    1277, 1279, 1283, 1289, 1291, 1297, 1301, 1303, 1307, 1319, 1321, 1327,
+    1361, 1367, 1373, 1381, 1399, 1409, 1423, 1427, 1429, 1433, 1439, 1447,
+    1451, 1453, 1459, 1471, 1481, 1483, 1487, 1489, 1493, 1499, 1511, 1523,
+    1531, 1543, 1549, 1553, 1559, 1567, 1571, 1579, 1583, 1597, 1601, 1607,
+    1609, 1613, 1619, 1621, 1627, 1637, 1657, 1663, 1667, 1669, 1693, 1697,
+    1699, 1709, 1721, 1723, 1733, 1741, 1747, 1753, 1759, 1777, 1783, 1787,
+    1789, 1801, 1811, 1823, 1831, 1847, 1861, 1867, 1871, 1873, 1877, 1879,
+    1889, 1901, 1907, 1913, 1931, 1933, 1949, 1951, 1973, 1979, 1987, 1993,
+    1997, 1999, 2003, 2011, 2017, 2027, 2029, 2039, 2053, 2063, 2069, 2081,
+    2083, 2087, 2089, 2099, 2111, 2113, 2129, 2131, 2137, 2141, 2143, 2153,
+    2161, 2179, 2203, 2207, 2213, 2221, 2237, 2239, 2243, 2251, 2267, 2269,
+    2273, 2281, 2287, 2293, 2297, 2309, 2311, 2333, 2339, 2341, 2347, 2351,
+    2357, 2371, 2377, 2381, 2383, 2389, 2393, 2399, 2411, 2417, 2423, 2437,
+    2441, 2447, 2459, 2467, 2473, 2477, 2503, 2521, 2531, 2539, 2543, 2549,
+    2551, 2557, 2579, 2591, 2593, 2609, 2617, 2621, 2633, 2647, 2657, 2659,
+    2663, 2671, 2677, 2683, 2687, 2689, 2693, 2699, 2707, 2711, 2713, 2719,
+    2729, 2731, 2741, 2749, 2753, 2767, 2777, 2789, 2791, 2797, 2801, 2803,
+    2819, 2833, 2837, 2843, 2851, 2857, 2861, 2879, 2887, 2897, 2903, 2909,
+    2917, 2927, 2939, 2953, 2957, 2963, 2969, 2971, 2999, 3001, 3011, 3019,
+    3023, 3037, 3041, 3049, 3061, 3067, 3079, 3083, 3089, 3109, 3119, 3121,
+    3137, 3163, 3167, 3169, 3181, 3187, 3191, 3203, 3209, 3217, 3221, 3229,
+    3251, 3253, 3257, 3259, 3271, 3299, 3301, 3307, 3313, 3319, 3323, 3329,
+    3331, 3343, 3347, 3359, 3361, 3371, 3373, 3389, 3391, 3407, 3413, 3433,
+    3449, 3457, 3461, 3463, 3467, 3469, 3491, 3499, 3511, 3517, 3527, 3529,
+    3533, 3539, 3541, 3547, 3557, 3559, 3571, 3581, 3583, 3593, 3607, 3613,
+    3617, 3623, 3631, 3637, 3643, 3659, 3671, 3673, 3677, 3691, 3697, 3701,
+    3709, 3719, 3727, 3733, 3739, 3761, 3767, 3769, 3779, 3793, 3797, 3803,
+    3821, 3823, 3833, 3847, 3851, 3853, 3863, 3877, 3881, 3889, 3907, 3911,
+    3917, 3919, 3923, 3929, 3931, 3943, 3947, 3967, 3989, 4001, 4003, 4007,
+    4013, 4019, 4021, 4027, 4049, 4051, 4057, 4073, 4079, 4091, 4093, 4099,
+    4111, 4127, 4129, 4133, 4139, 4153, 4157, 4159, 4177, 4201, 4211, 4217,
+    4219, 4229, 4231, 4241, 4243, 4253, 4259, 4261, 4271, 4273, 4283, 4289,
+    4297, 4327, 4337, 4339, 4349, 4357, 4363, 4373, 4391, 4397, 4409, 4421,
+    4423, 4441, 4447, 4451, 4457, 4463, 4481, 4483, 4493, 4507, 4513, 4517,
+    4519, 4523, 4547, 4549, 4561, 4567, 4583, 4591, 4597, 4603, 4621, 4637,
+    4639, 4643, 4649, 4651, 4657, 4663, 4673, 4679, 4691, 4703, 4721, 4723,
+    4729, 4733, 4751, 4759, 4783, 4787, 4789, 4793, 4799, 4801, 4813, 4817,
+    4831, 4861, 4871, 4877, 4889, 4903, 4909, 4919, 4931, 4933, 4937, 4943,
+    4951, 4957, 4967, 4969, 4973, 4987, 4993, 4999, 5003, 5009, 5011, 5021,
+    5023, 5039, 5051, 5059, 5077, 5081, 5087, 5099, 5101, 5107, 5113, 5119,
+    5147, 5153, 5167, 5171, 5179, 5189, 5197, 5209, 5227, 5231, 5233, 5237,
+    5261, 5273, 5279, 5281, 5297, 5303, 5309, 5323, 5333, 5347, 5351, 5381,
+    5387, 5393, 5399, 5407, 5413, 5417, 5419, 5431, 5437, 5441, 5443, 5449,
+    5471, 5477, 5479, 5483, 5501, 5503, 5507, 5519, 5521, 5527, 5531, 5557,
+    5563, 5569, 5573, 5581, 5591, 5623, 5639, 5641, 5647, 5651, 5653, 5657,
+    5659, 5669, 5683, 5689, 5693, 5701, 5711, 5717, 5737, 5741, 5743, 5749,
+    5779, 5783, 5791, 5801, 5807, 5813, 5821, 5827, 5839, 5843, 5849, 5851,
+    5857, 5861, 5867, 5869, 5879, 5881, 5897, 5903, 5923, 5927, 5939, 5953,
+    5981, 5987, 6007, 6011, 6029, 6037, 6043, 6047, 6053, 6067, 6073, 6079,
+    6089, 6091, 6101, 6113, 6121, 6131, 6133, 6143, 6151, 6163, 6173, 6197,
+    6199, 6203, 6211, 6217, 6221, 6229, 6247, 6257, 6263, 6269, 6271, 6277,
+    6287, 6299, 6301, 6311, 6317, 6323, 6329, 6337, 6343, 6353, 6359, 6361,
+    6367, 6373, 6379, 6389, 6397, 6421, 6427, 6449, 6451, 6469, 6473, 6481,
+    6491, 6521, 6529, 6547, 6551, 6553, 6563, 6569, 6571, 6577, 6581, 6599,
+    6607, 6619, 6637, 6653, 6659, 6661, 6673, 6679, 6689, 6691, 6701, 6703,
+    6709, 6719, 6733, 6737, 6761, 6763, 6779, 6781, 6791, 6793, 6803, 6823,
+    6827, 6829, 6833, 6841, 6857, 6863, 6869, 6871, 6883, 6899, 6907, 6911,
+    6917, 6947, 6949, 6959, 6961, 6967, 6971, 6977, 6983, 6991, 6997, 7001,
+    7013, 7019, 7027, 7039, 7043, 7057, 7069, 7079, 7103, 7109, 7121, 7127,
+    7129, 7151, 7159, 7177, 7187, 7193, 7207, 7211, 7213, 7219, 7229, 7237,
+    7243, 7247, 7253, 7283, 7297, 7307, 7309, 7321, 7331, 7333, 7349, 7351,
+    7369, 7393, 7411, 7417, 7433, 7451, 7457, 7459, 7477, 7481, 7487, 7489,
+    7499, 7507, 7517, 7523, 7529, 7537, 7541, 7547, 7549, 7559, 7561, 7573,
+    7577, 7583, 7589, 7591, 7603, 7607, 7621, 7639, 7643, 7649, 7669, 7673,
+    7681, 7687, 7691, 7699, 7703, 7717, 7723, 7727, 7741, 7753, 7757, 7759,
+    7789, 7793, 7817, 7823, 7829, 7841, 7853, 7867, 7873, 7877, 7879, 7883,
+    7901, 7907, 7919, 7927, 7933, 7937, 7949, 7951, 7963, 7993, 8009, 8011,
+    8017, 8039, 8053, 8059, 8069, 8081, 8087, 8089, 8093, 8101, 8111, 8117,
+    8123, 8147, 8161, 8167, 8171, 8179, 8191, 8209, 8219, 8221, 8231, 8233,
+    8237, 8243, 8263, 8269, 8273, 8287, 8291, 8293, 8297, 8311, 8317, 8329,
+    8353, 8363, 8369, 8377, 8387, 8389, 8419, 8423, 8429, 8431, 8443, 8447,
+    8461, 8467, 8501, 8513, 8521, 8527, 8537, 8539, 8543, 8563, 8573, 8581,
+    8597, 8599, 8609, 8623, 8627, 8629, 8641, 8647, 8663, 8669, 8677, 8681,
+    8689, 8693, 8699, 8707, 8713, 8719, 8731, 8737, 8741, 8747, 8753, 8761,
+    8779, 8783, 8803, 8807, 8819, 8821, 8831, 8837, 8839, 8849, 8861, 8863,
+    8867, 8887, 8893, 8923, 8929, 8933, 8941, 8951, 8963, 8969, 8971, 8999,
+    9001, 9007, 9011, 9013, 9029, 9041, 9043, 9049, 9059, 9067, 9091, 9103,
+    9109, 9127, 9133, 9137, 9151, 9157, 9161, 9173, 9181, 9187, 9199, 9203,
+    9209, 9221, 9227, 9239, 9241, 9257, 9277, 9281, 9283, 9293, 9311, 9319,
+    9323, 9337, 9341, 9343, 9349, 9371, 9377, 9391, 9397, 9403, 9413, 9419,
+    9421, 9431, 9433, 9437, 9439, 9461, 9463, 9467, 9473, 9479, 9491, 9497,
+    9511, 9521, 9533, 9539, 9547, 9551, 9587, 9601, 9613, 9619, 9623, 9629,
+    9631, 9643, 9649, 9661, 9677, 9679, 9689, 9697, 9719, 9721, 9733, 9739,
+    9743, 9749, 9767, 9769, 9781, 9787, 9791, 9803, 9811, 9817, 9829, 9833,
+    9839, 9851, 9857, 9859, 9871, 9883, 9887, 9901, 9907, 9923, 9929, 9931,
+    9941, 9949, 9967, 9973, 10007, 10009, 10037, 10039, 10061, 10067, 10069,
+    10079, 10091, 10093, 10099, 10103, 10111, 10133, 10139, 10141, 10151,
+    10159, 10163, 10169, 10177, 10181, 10193, 10211, 10223, 10243, 10247,
+    10253, 10259, 10267, 10271, 10273, 10289, 10301, 10303, 10313, 10321,
+    10331, 10333, 10337, 10343, 10357, 10369, 10391, 10399, 10427, 10429,
+    10433, 10453, 10457, 10459, 10463, 10477, 10487, 10499, 10501, 10513,
+    10529, 10531, 10559, 10567, 10589, 10597, 10601, 10607, 10613, 10627,
+    10631, 10639, 10651, 10657, 10663, 10667, 10687, 10691, 10709, 10711,
+    10723, 10729, 10733, 10739, 10753, 10771, 10781, 10789, 10799, 10831,
+    10837, 10847, 10853, 10859, 10861, 10867, 10883, 10889, 10891, 10903,
+    10909, 10937, 10939, 10949, 10957, 10973, 10979, 10987, 10993, 11003,
+    11027, 11047, 11057, 11059, 11069, 11071, 11083, 11087, 11093, 11113,
+    11117, 11119, 11131, 11149, 11159, 11161, 11171, 11173, 11177, 11197,
+    11213, 11239, 11243, 11251, 11257, 11261, 11273, 11279, 11287, 11299,
+    11311, 11317, 11321, 11329, 11351, 11353, 11369, 11383, 11393, 11399,
+    11411, 11423, 11437, 11443, 11447, 11467, 11471, 11483, 11489, 11491,
+    11497, 11503, 11519, 11527, 11549, 11551, 11579, 11587, 11593, 11597,
+    11617, 11621, 11633, 11657, 11677, 11681, 11689, 11699, 11701, 11717,
+    11719, 11731, 11743, 11777, 11779, 11783, 11789, 11801, 11807, 11813,
+    11821, 11827, 11831, 11833, 11839, 11863, 11867, 11887, 11897, 11903,
+    11909, 11923, 11927, 11933, 11939, 11941, 11953, 11959, 11969, 11971,
+    11981, 11987, 12007, 12011, 12037, 12041, 12043, 12049, 12071, 12073,
+    12097, 12101, 12107, 12109, 12113, 12119, 12143, 12149, 12157, 12161,
+    12163, 12197, 12203, 12211, 12227, 12239, 12241, 12251, 12253, 12263,
+    12269, 12277, 12281, 12289, 12301, 12323, 12329, 12343, 12347, 12373,
+    12377, 12379, 12391, 12401, 12409, 12413, 12421, 12433, 12437, 12451,
+    12457, 12473, 12479, 12487, 12491, 12497, 12503, 12511, 12517, 12527,
+    12539, 12541, 12547, 12553, 12569, 12577, 12583, 12589, 12601, 12611,
+    12613, 12619, 12637, 12641, 12647, 12653, 12659, 12671, 12689, 12697,
+    12703, 12713, 12721, 12739, 12743, 12757, 12763, 12781, 12791, 12799,
+    12809, 12821, 12823, 12829, 12841, 12853, 12889, 12893, 12899, 12907,
+    12911, 12917, 12919, 12923, 12941, 12953, 12959, 12967, 12973, 12979,
+    12983, 13001, 13003, 13007, 13009, 13033, 13037, 13043, 13049, 13063,
+    13093, 13099, 13103, 13109, 13121, 13127, 13147, 13151, 13159, 13163,
+    13171, 13177, 13183, 13187, 13217, 13219, 13229, 13241, 13249, 13259,
+    13267, 13291, 13297, 13309, 13313, 13327, 13331, 13337, 13339, 13367,
+    13381, 13397, 13399, 13411, 13417, 13421, 13441, 13451, 13457, 13463,
+    13469, 13477, 13487, 13499, 13513, 13523, 13537, 13553, 13567, 13577,
+    13591, 13597, 13613, 13619, 13627, 13633, 13649, 13669, 13679, 13681,
+    13687, 13691, 13693, 13697, 13709, 13711, 13721, 13723, 13729, 13751,
+    13757, 13759, 13763, 13781, 13789, 13799, 13807, 13829, 13831, 13841,
+    13859, 13873, 13877, 13879, 13883, 13901, 13903, 13907, 13913, 13921,
+    13931, 13933, 13963, 13967, 13997, 13999, 14009, 14011, 14029, 14033,
+    14051, 14057, 14071, 14081, 14083, 14087, 14107, 14143, 14149, 14153,
+    14159, 14173, 14177, 14197, 14207, 14221, 14243, 14249, 14251, 14281,
+    14293, 14303, 14321, 14323, 14327, 14341, 14347, 14369, 14387, 14389,
+    14401, 14407, 14411, 14419, 14423, 14431, 14437, 14447, 14449, 14461,
+    14479, 14489, 14503, 14519, 14533, 14537, 14543, 14549, 14551, 14557,
+    14561, 14563, 14591, 14593, 14621, 14627, 14629, 14633, 14639, 14653,
+    14657, 14669, 14683, 14699, 14713, 14717, 14723, 14731, 14737, 14741,
+    14747, 14753, 14759, 14767, 14771, 14779, 14783, 14797, 14813, 14821,
+    14827, 14831, 14843, 14851, 14867, 14869, 14879, 14887, 14891, 14897,
+    14923, 14929, 14939, 14947, 14951, 14957, 14969, 14983, 15013, 15017,
+    15031, 15053, 15061, 15073, 15077, 15083, 15091, 15101, 15107, 15121,
+    15131, 15137, 15139, 15149, 15161, 15173, 15187, 15193, 15199, 15217,
+    15227, 15233, 15241, 15259, 15263, 15269, 15271, 15277, 15287, 15289,
+    15299, 15307, 15313, 15319, 15329, 15331, 15349, 15359, 15361, 15373,
+    15377, 15383, 15391, 15401, 15413, 15427, 15439, 15443, 15451, 15461,
+    15467, 15473, 15493, 15497, 15511, 15527, 15541, 15551, 15559, 15569,
+    15581, 15583, 15601, 15607, 15619, 15629, 15641, 15643, 15647, 15649,
+    15661, 15667, 15671, 15679, 15683, 15727, 15731, 15733, 15737, 15739,
+    15749, 15761, 15767, 15773, 15787, 15791, 15797, 15803, 15809, 15817,
+    15823, 15859, 15877, 15881, 15887, 15889, 15901, 15907, 15913, 15919,
+    15923, 15937, 15959, 15971, 15973, 15991, 16001, 16007, 16033, 16057,
+    16061, 16063, 16067, 16069, 16073, 16087, 16091, 16097, 16103, 16111,
+    16127, 16139, 16141, 16183, 16187, 16189, 16193, 16217, 16223, 16229,
+    16231, 16249, 16253, 16267, 16273, 16301, 16319, 16333, 16339, 16349,
+    16361, 16363, 16369, 16381, 16411, 16417, 16421, 16427, 16433, 16447,
+    16451, 16453, 16477, 16481, 16487, 16493, 16519, 16529, 16547, 16553,
+    16561, 16567, 16573, 16603, 16607, 16619, 16631, 16633, 16649, 16651,
+    16657, 16661, 16673, 16691, 16693, 16699, 16703, 16729, 16741, 16747,
+    16759, 16763, 16787, 16811, 16823, 16829, 16831, 16843, 16871, 16879,
+    16883, 16889, 16901, 16903, 16921, 16927, 16931, 16937, 16943, 16963,
+    16979, 16981, 16987, 16993, 17011, 17021, 17027, 17029, 17033, 17041,
+    17047, 17053, 17077, 17093, 17099, 17107, 17117, 17123, 17137, 17159,
+    17167, 17183, 17189, 17191, 17203, 17207, 17209, 17231, 17239, 17257,
+    17291, 17293, 17299, 17317, 17321, 17327, 17333, 17341, 17351, 17359,
+    17377, 17383, 17387, 17389, 17393, 17401, 17417, 17419, 17431, 17443,
+    17449, 17467, 17471, 17477, 17483, 17489, 17491, 17497, 17509, 17519,
+    17539, 17551, 17569, 17573, 17579, 17581, 17597, 17599, 17609, 17623,
+    17627, 17657, 17659, 17669, 17681, 17683, 17707, 17713, 17729, 17737,
+    17747, 17749, 17761, 17783, 17789, 17791, 17807, 17827, 17837, 17839,
+    17851, 17863, 17881, 17891, 17903, 17909, 17911, 17921, 17923, 17929,
+    17939, 17957, 17959, 17971, 17977, 17981, 17987, 17989, 18013, 18041,
+    18043, 18047, 18049, 18059, 18061, 18077, 18089, 18097, 18119, 18121,
+    18127, 18131, 18133, 18143, 18149, 18169, 18181, 18191, 18199, 18211,
+    18217, 18223, 18229, 18233, 18251, 18253, 18257, 18269, 18287, 18289,
+    18301, 18307, 18311, 18313, 18329, 18341, 18353, 18367, 18371, 18379,
+    18397, 18401, 18413, 18427, 18433, 18439, 18443, 18451, 18457, 18461,
+    18481, 18493, 18503, 18517, 18521, 18523, 18539, 18541, 18553, 18583,
+    18587, 18593, 18617, 18637, 18661, 18671, 18679, 18691, 18701, 18713,
+    18719, 18731, 18743, 18749, 18757, 18773, 18787, 18793, 18797, 18803,
+    18839, 18859, 18869, 18899, 18911, 18913, 18917, 18919, 18947, 18959,
+    18973, 18979, 19001, 19009, 19013, 19031, 19037, 19051, 19069, 19073,
+    19079, 19081, 19087, 19121, 19139, 19141, 19157, 19163, 19181, 19183,
+    19207, 19211, 19213, 19219, 19231, 19237, 19249, 19259, 19267, 19273,
+    19289, 19301, 19309, 19319, 19333, 19373, 19379, 19381, 19387, 19391,
+    19403, 19417, 19421, 19423, 19427, 19429, 19433, 19441, 19447, 19457,
+    19463, 19469, 19471, 19477, 19483, 19489, 19501, 19507, 19531, 19541,
+    19543, 19553, 19559, 19571, 19577, 19583, 19597, 19603, 19609, 19661,
+    19681, 19687, 19697, 19699, 19709, 19717, 19727, 19739, 19751, 19753,
+    19759, 19763, 19777, 19793, 19801, 19813, 19819, 19841, 19843, 19853,
+    19861, 19867, 19889, 19891, 19913, 19919, 19927, 19937, 19949, 19961,
+    19963, 19973, 19979, 19991, 19993, 19997, 20011, 20021, 20023, 20029,
+    20047, 20051, 20063, 20071, 20089, 20101, 20107, 20113, 20117, 20123,
+    20129, 20143, 20147, 20149, 20161, 20173, 20177, 20183, 20201, 20219,
+    20231, 20233, 20249, 20261, 20269, 20287, 20297, 20323, 20327, 20333,
+    20341, 20347, 20353, 20357, 20359, 20369, 20389, 20393, 20399, 20407,
+    20411, 20431, 20441, 20443, 20477, 20479, 20483, 20507, 20509, 20521,
+    20533, 20543, 20549, 20551, 20563, 20593, 20599, 20611, 20627, 20639,
+    20641, 20663, 20681, 20693, 20707, 20717, 20719, 20731, 20743, 20747,
+    20749, 20753, 20759, 20771, 20773, 20789, 20807, 20809, 20849, 20857,
+    20873, 20879, 20887, 20897, 20899, 20903, 20921, 20929, 20939, 20947,
+    20959, 20963, 20981, 20983, 21001, 21011, 21013, 21017, 21019, 21023,
+    21031, 21059, 21061, 21067, 21089, 21101, 21107, 21121, 21139, 21143,
+    21149, 21157, 21163, 21169, 21179, 21187, 21191, 21193, 21211, 21221,
+    21227, 21247, 21269, 21277, 21283, 21313, 21317, 21319, 21323, 21341,
+    21347, 21377, 21379, 21383, 21391, 21397, 21401, 21407, 21419, 21433,
+    21467, 21481, 21487, 21491, 21493, 21499, 21503, 21517, 21521, 21523,
+    21529, 21557, 21559, 21563, 21569, 21577, 21587, 21589, 21599, 21601,
+    21611, 21613, 21617, 21647, 21649, 21661, 21673, 21683, 21701, 21713,
+    21727, 21737, 21739, 21751, 21757, 21767, 21773, 21787, 21799, 21803,
+    21817, 21821, 21839, 21841, 21851, 21859, 21863, 21871, 21881, 21893,
+    21911, 21929, 21937, 21943, 21961, 21977, 21991, 21997, 22003, 22013,
+    22027, 22031, 22037, 22039, 22051, 22063, 22067, 22073, 22079, 22091,
+    22093, 22109, 22111, 22123, 22129, 22133, 22147, 22153, 22157, 22159,
+    22171, 22189, 22193, 22229, 22247, 22259, 22271, 22273, 22277, 22279,
+    22283, 22291, 22303, 22307, 22343, 22349, 22367, 22369, 22381, 22391,
+    22397, 22409, 22433, 22441, 22447, 22453, 22469, 22481, 22483, 22501,
+    22511, 22531, 22541, 22543, 22549, 22567, 22571, 22573, 22613, 22619,
+    22621, 22637, 22639, 22643, 22651, 22669, 22679, 22691, 22697, 22699,
+    22709, 22717, 22721, 22727, 22739, 22741, 22751, 22769, 22777, 22783,
+    22787, 22807, 22811, 22817, 22853, 22859, 22861, 22871, 22877, 22901,
+    22907, 22921, 22937, 22943, 22961, 22963, 22973, 22993, 23003, 23011,
+    23017, 23021, 23027, 23029, 23039, 23041, 23053, 23057, 23059, 23063,
+    23071, 23081, 23087, 23099, 23117, 23131, 23143, 23159, 23167, 23173,
+    23189, 23197, 23201, 23203, 23209, 23227, 23251, 23269, 23279, 23291,
+    23293, 23297, 23311, 23321, 23327, 23333, 23339, 23357, 23369, 23371,
+    23399, 23417, 23431, 23447, 23459, 23473, 23497, 23509, 23531, 23537,
+    23539, 23549, 23557, 23561, 23563, 23567, 23581, 23593, 23599, 23603,
+    23609, 23623, 23627, 23629, 23633, 23663, 23669, 23671, 23677, 23687,
+    23689, 23719, 23741, 23743, 23747, 23753, 23761, 23767, 23773, 23789,
+    23801, 23813, 23819, 23827, 23831, 23833, 23857, 23869, 23873, 23879,
+    23887, 23893, 23899, 23909, 23911, 23917, 23929, 23957, 23971, 23977,
+    23981, 23993, 24001, 24007, 24019, 24023, 24029, 24043, 24049, 24061,
+    24071, 24077, 24083, 24091, 24097, 24103, 24107, 24109, 24113, 24121,
+    24133, 24137, 24151, 24169, 24179, 24181, 24197, 24203, 24223, 24229,
+    24239, 24247, 24251, 24281, 24317, 24329, 24337, 24359, 24371, 24373,
+    24379, 24391, 24407, 24413, 24419, 24421, 24439, 24443, 24469, 24473,
+    24481, 24499, 24509, 24517, 24527, 24533, 24547, 24551, 24571, 24593,
+    24611, 24623, 24631, 24659, 24671, 24677, 24683, 24691, 24697, 24709,
+    24733, 24749, 24763, 24767, 24781, 24793, 24799, 24809, 24821, 24841,
+    24847, 24851, 24859, 24877, 24889, 24907, 24917, 24919, 24923, 24943,
+    24953, 24967, 24971, 24977, 24979, 24989, 25013, 25031, 25033, 25037,
+    25057, 25073, 25087, 25097, 25111, 25117, 25121, 25127, 25147, 25153,
+    25163, 25169, 25171, 25183, 25189, 25219, 25229, 25237, 25243, 25247,
+    25253, 25261, 25301, 25303, 25307, 25309, 25321, 25339, 25343, 25349,
+    25357, 25367, 25373, 25391, 25409, 25411, 25423, 25439, 25447, 25453,
+    25457, 25463, 25469, 25471, 25523, 25537, 25541, 25561, 25577, 25579,
+    25583, 25589, 25601, 25603, 25609, 25621, 25633, 25639, 25643, 25657,
+    25667, 25673, 25679, 25693, 25703, 25717, 25733, 25741, 25747, 25759,
+    25763, 25771, 25793, 25799, 25801, 25819, 25841, 25847, 25849, 25867,
+    25873, 25889, 25903, 25913, 25919, 25931, 25933, 25939, 25943, 25951,
+    25969, 25981, 25997, 25999, 26003, 26017, 26021, 26029, 26041, 26053,
+    26083, 26099, 26107, 26111, 26113, 26119, 26141, 26153, 26161, 26171,
+    26177, 26183, 26189, 26203, 26209, 26227, 26237, 26249, 26251, 26261,
+    26263, 26267, 26293, 26297, 26309, 26317, 26321, 26339, 26347, 26357,
+    26371, 26387, 26393, 26399, 26407, 26417, 26423, 26431, 26437, 26449,
+    26459, 26479, 26489, 26497, 26501, 26513, 26539, 26557, 26561, 26573,
+    26591, 26597, 26627, 26633, 26641, 26647, 26669, 26681, 26683, 26687,
+    26693, 26699, 26701, 26711, 26713, 26717, 26723, 26729, 26731, 26737,
+    26759, 26777, 26783, 26801, 26813, 26821, 26833, 26839, 26849, 26861,
+    26863, 26879, 26881, 26891, 26893, 26903, 26921, 26927, 26947, 26951,
+    26953, 26959, 26981, 26987, 26993, 27011, 27017, 27031, 27043, 27059,
+    27061, 27067, 27073, 27077, 27091, 27103, 27107, 27109, 27127, 27143,
+    27179, 27191, 27197, 27211, 27239, 27241, 27253, 27259, 27271, 27277,
+    27281, 27283, 27299, 27329, 27337, 27361, 27367, 27397, 27407, 27409,
+    27427, 27431, 27437, 27449, 27457, 27479, 27481, 27487, 27509, 27527,
+    27529, 27539, 27541, 27551, 27581, 27583, 27611, 27617, 27631, 27647,
+    27653, 27673, 27689, 27691, 27697, 27701, 27733, 27737, 27739, 27743,
+    27749, 27751, 27763, 27767, 27773, 27779, 27791, 27793, 27799, 27803,
+    27809, 27817, 27823, 27827, 27847, 27851, 27883, 27893, 27901, 27917,
+    27919, 27941, 27943, 27947, 27953, 27961, 27967, 27983, 27997, 28001,
+    28019, 28027, 28031, 28051, 28057, 28069, 28081, 28087, 28097, 28099,
+    28109, 28111, 28123, 28151, 28163, 28181, 28183, 28201, 28211, 28219,
+    28229, 28277, 28279, 28283, 28289, 28297, 28307, 28309, 28319, 28349,
+    28351, 28387, 28393, 28403, 28409, 28411, 28429, 28433, 28439, 28447,
+    28463, 28477, 28493, 28499, 28513, 28517, 28537, 28541, 28547, 28549,
+    28559, 28571, 28573, 28579, 28591, 28597, 28603, 28607, 28619, 28621,
+    28627, 28631, 28643, 28649, 28657, 28661, 28663, 28669, 28687, 28697,
+    28703, 28711, 28723, 28729, 28751, 28753, 28759, 28771, 28789, 28793,
+    28807, 28813, 28817, 28837, 28843, 28859, 28867, 28871, 28879, 28901,
+    28909, 28921, 28927, 28933, 28949, 28961, 28979, 29009, 29017, 29021,
+    29023, 29027, 29033, 29059, 29063, 29077, 29101, 29123, 29129, 29131,
+    29137, 29147, 29153, 29167, 29173, 29179, 29191, 29201, 29207, 29209,
+    29221, 29231, 29243, 29251, 29269, 29287, 29297, 29303, 29311, 29327,
+    29333, 29339, 29347, 29363, 29383, 29387, 29389, 29399, 29401, 29411,
+    29423, 29429, 29437, 29443, 29453, 29473, 29483, 29501, 29527, 29531,
+    29537, 29567, 29569, 29573, 29581, 29587, 29599, 29611, 29629, 29633,
+    29641, 29663, 29669, 29671, 29683, 29717, 29723, 29741, 29753, 29759,
+    29761, 29789, 29803, 29819, 29833, 29837, 29851, 29863, 29867, 29873,
+    29879, 29881, 29917, 29921, 29927, 29947, 29959, 29983, 29989, 30011,
+    30013, 30029, 30047, 30059, 30071, 30089, 30091, 30097, 30103, 30109,
+    30113, 30119, 30133, 30137, 30139, 30161, 30169, 30181, 30187, 30197,
+    30203, 30211, 30223, 30241, 30253, 30259, 30269, 30271, 30293, 30307,
+    30313, 30319, 30323, 30341, 30347, 30367, 30389, 30391, 30403, 30427,
+    30431, 30449, 30467, 30469, 30491, 30493, 30497, 30509, 30517, 30529,
+    30539, 30553, 30557, 30559, 30577, 30593, 30631, 30637, 30643, 30649,
+    30661, 30671, 30677, 30689, 30697, 30703, 30707, 30713, 30727, 30757,
+    30763, 30773, 30781, 30803, 30809, 30817, 30829, 30839, 30841, 30851,
+    30853, 30859, 30869, 30871, 30881, 30893, 30911, 30931, 30937, 30941,
+    30949, 30971, 30977, 30983, 31013, 31019, 31033, 31039, 31051, 31063,
+    31069, 31079, 31081, 31091, 31121, 31123, 31139, 31147, 31151, 31153,
+    31159, 31177, 31181, 31183, 31189, 31193, 31219, 31223, 31231, 31237,
+    31247, 31249, 31253, 31259, 31267, 31271, 31277, 31307, 31319, 31321,
+    31327, 31333, 31337, 31357, 31379, 31387, 31391, 31393, 31397, 31469,
+    31477, 31481, 31489, 31511, 31513, 31517, 31531, 31541, 31543, 31547,
+    31567, 31573, 31583, 31601, 31607, 31627, 31643, 31649, 31657, 31663,
+    31667, 31687, 31699, 31721, 31723, 31727, 31729, 31741, 31751, 31769,
+    31771, 31793, 31799, 31817, 31847, 31849, 31859, 31873, 31883, 31891,
+    31907, 31957, 31963, 31973, 31981, 31991, 32003, 32009, 32027, 32029,
+    32051, 32057, 32059, 32063, 32069, 32077, 32083, 32089, 32099, 32117,
+    32119, 32141, 32143, 32159, 32173, 32183, 32189, 32191, 32203, 32213,
+    32233, 32237, 32251, 32257, 32261, 32297, 32299, 32303, 32309, 32321,
+    32323, 32327, 32341, 32353, 32359, 32363, 32369, 32371, 32377, 32381,
+    32401, 32411, 32413, 32423, 32429, 32441, 32443, 32467, 32479, 32491,
+    32497, 32503, 32507, 32531, 32533, 32537, 32561, 32563, 32569, 32573,
+    32579, 32587, 32603, 32609, 32611, 32621, 32633, 32647, 32653, 32687,
+    32693, 32707, 32713, 32717, 32719
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/pssr.cpp b/runtime/third_party/cryptopp/pssr.cpp
new file mode 100644
index 0000000..47a3ed1
--- /dev/null
+++ b/runtime/third_party/cryptopp/pssr.cpp
@@ -0,0 +1,163 @@
+// pssr.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "pssr.h"
+#include "emsa2.h"
+#include "ripemd.h"
+#include "whrlpool.h"
+#include "misc.h"
+
+#include <functional>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+template<> const byte EMSA2HashId<RIPEMD160>::id = 0x31;
+template<> const byte EMSA2HashId<RIPEMD128>::id = 0x32;
+template<> const byte EMSA2HashId<Whirlpool>::id = 0x37;
+
+#ifndef CRYPTOPP_IMPORTS
+
+size_t PSSR_MEM_Base::MinRepresentativeBitLength(size_t hashIdentifierLength, size_t digestLength) const
+{
+	size_t saltLen = SaltLen(digestLength);
+	size_t minPadLen = MinPadLen(digestLength);
+	return 9 + 8*(minPadLen + saltLen + digestLength + hashIdentifierLength);
+}
+
+size_t PSSR_MEM_Base::MaxRecoverableLength(size_t representativeBitLength, size_t hashIdentifierLength, size_t digestLength) const
+{
+	if (AllowRecovery())
+		return SaturatingSubtract(representativeBitLength, MinRepresentativeBitLength(hashIdentifierLength, digestLength)) / 8;
+	return 0;
+}
+
+bool PSSR_MEM_Base::IsProbabilistic() const
+{
+	return SaltLen(1) > 0;
+}
+
+bool PSSR_MEM_Base::AllowNonrecoverablePart() const
+{
+	return true;
+}
+
+bool PSSR_MEM_Base::RecoverablePartFirst() const
+{
+	return false;
+}
+
+void PSSR_MEM_Base::ComputeMessageRepresentative(RandomNumberGenerator &rng,
+	const byte *recoverableMessage, size_t recoverableMessageLength,
+	HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+	byte *representative, size_t representativeBitLength) const
+{
+	CRYPTOPP_UNUSED(rng), CRYPTOPP_UNUSED(recoverableMessage), CRYPTOPP_UNUSED(recoverableMessageLength);
+	CRYPTOPP_UNUSED(messageEmpty), CRYPTOPP_UNUSED(hashIdentifier);
+	CRYPTOPP_ASSERT(representativeBitLength >= MinRepresentativeBitLength(hashIdentifier.second, hash.DigestSize()));
+
+	const size_t u = hashIdentifier.second + 1;
+	const size_t representativeByteLength = BitsToBytes(representativeBitLength);
+	const size_t digestSize = hash.DigestSize();
+	const size_t saltSize = SaltLen(digestSize);
+	byte *const h = representative + representativeByteLength - u - digestSize;
+
+	SecByteBlock digest(digestSize), salt(saltSize);
+	hash.Final(digest);
+	rng.GenerateBlock(salt, saltSize);
+
+	// compute H = hash of M'
+	byte c[8];
+	PutWord(false, BIG_ENDIAN_ORDER, c, (word32)SafeRightShift<29>(recoverableMessageLength));
+	PutWord(false, BIG_ENDIAN_ORDER, c+4, word32(recoverableMessageLength << 3));
+	hash.Update(c, 8);
+	hash.Update(recoverableMessage, recoverableMessageLength);
+	hash.Update(digest, digestSize);
+	hash.Update(salt, saltSize);
+	hash.Final(h);
+
+	// compute representative
+	GetMGF().GenerateAndMask(hash, representative, representativeByteLength - u - digestSize, h, digestSize, false);
+	byte *xorStart = representative + representativeByteLength - u - digestSize - salt.size() - recoverableMessageLength - 1;
+	xorStart[0] ^= 1;
+	if (recoverableMessage && recoverableMessageLength)
+		xorbuf(xorStart + 1, recoverableMessage, recoverableMessageLength);
+	xorbuf(xorStart + 1 + recoverableMessageLength, salt, salt.size());
+	if (hashIdentifier.first && hashIdentifier.second)
+	{
+		std::memcpy(representative + representativeByteLength - u, hashIdentifier.first, hashIdentifier.second);
+		representative[representativeByteLength - 1] = 0xcc;
+	}
+	else
+	{
+		representative[representativeByteLength - 1] = 0xbc;
+	}
+	if (representativeBitLength % 8 != 0)
+		representative[0] = (byte)Crop(representative[0], representativeBitLength % 8);
+}
+
+DecodingResult PSSR_MEM_Base::RecoverMessageFromRepresentative(
+	HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+	byte *representative, size_t representativeBitLength,
+	byte *recoverableMessage) const
+{
+	CRYPTOPP_UNUSED(recoverableMessage), CRYPTOPP_UNUSED(messageEmpty), CRYPTOPP_UNUSED(hashIdentifier);
+	CRYPTOPP_ASSERT(representativeBitLength >= MinRepresentativeBitLength(hashIdentifier.second, hash.DigestSize()));
+
+	const size_t u = hashIdentifier.second + 1;
+	const size_t representativeByteLength = BitsToBytes(representativeBitLength);
+	const size_t digestSize = hash.DigestSize();
+	const size_t saltSize = SaltLen(digestSize);
+	const byte *const h = representative + representativeByteLength - u - digestSize;
+
+	SecByteBlock digest(digestSize);
+	hash.Final(digest);
+
+	DecodingResult result(0);
+	bool &valid = result.isValidCoding;
+	size_t &recoverableMessageLength = result.messageLength;
+
+	valid = (representative[representativeByteLength - 1] == (hashIdentifier.second ? 0xcc : 0xbc)) && valid;
+
+	if (hashIdentifier.first && hashIdentifier.second)
+		valid = VerifyBufsEqual(representative + representativeByteLength - u, hashIdentifier.first, hashIdentifier.second) && valid;
+
+	GetMGF().GenerateAndMask(hash, representative, representativeByteLength - u - digestSize, h, digestSize);
+	if (representativeBitLength % 8 != 0)
+		representative[0] = (byte)Crop(representative[0], representativeBitLength % 8);
+
+	// extract salt and recoverableMessage from DB = 00 ... || 01 || M || salt
+	byte *salt = representative + representativeByteLength - u - digestSize - saltSize;
+	byte *M = FindIfNot(representative, salt-1, byte(0));
+	recoverableMessageLength = salt-M-1;
+	if (*M == 0x01 &&
+	   (size_t)(M - representative - (representativeBitLength % 8 != 0)) >= MinPadLen(digestSize) &&
+	   recoverableMessageLength <= MaxRecoverableLength(representativeBitLength, hashIdentifier.second, digestSize))
+	{
+		if (recoverableMessage)
+			std::memcpy(recoverableMessage, M+1, recoverableMessageLength);
+	}
+	else
+	{
+		recoverableMessageLength = 0;
+		valid = false;
+	}
+
+	// verify H = hash of M'
+	byte c[8];
+	PutWord(false, BIG_ENDIAN_ORDER, c, (word32)SafeRightShift<29>(recoverableMessageLength));
+	PutWord(false, BIG_ENDIAN_ORDER, c+4, word32(recoverableMessageLength << 3));
+	hash.Update(c, 8);
+	hash.Update(recoverableMessage, recoverableMessageLength);
+	hash.Update(digest, digestSize);
+	hash.Update(salt, saltSize);
+	valid = hash.Verify(h) && valid;
+
+	if (!AllowRecovery() && valid && recoverableMessageLength != 0)
+		{throw NotImplemented("PSSR_MEM: message recovery disabled");}
+
+	return result;
+}
+
+#endif
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/pssr.h b/runtime/third_party/cryptopp/pssr.h
new file mode 100644
index 0000000..4638622
--- /dev/null
+++ b/runtime/third_party/cryptopp/pssr.h
@@ -0,0 +1,105 @@
+// pssr.h - originally written and placed in the public domain by Wei Dai
+
+/// \file pssr.h
+/// \brief Classes for probabilistic signature schemes
+/// \since Crypto++ 2.1
+
+#ifndef CRYPTOPP_PSSR_H
+#define CRYPTOPP_PSSR_H
+
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "emsa2.h"
+
+#ifdef CRYPTOPP_IS_DLL
+#include "sha.h"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief PSSR Message Encoding Method interface
+/// \since Crypto++ 2.1
+class CRYPTOPP_DLL PSSR_MEM_Base : public PK_RecoverableSignatureMessageEncodingMethod
+{
+public:
+	virtual ~PSSR_MEM_Base() {}
+
+protected:
+	virtual bool AllowRecovery() const =0;
+	virtual size_t SaltLen(size_t hashLen) const =0;
+	virtual size_t MinPadLen(size_t hashLen) const =0;
+	virtual const MaskGeneratingFunction & GetMGF() const =0;
+
+private:
+	size_t MinRepresentativeBitLength(size_t hashIdentifierLength, size_t digestLength) const;
+	size_t MaxRecoverableLength(size_t representativeBitLength, size_t hashIdentifierLength, size_t digestLength) const;
+	bool IsProbabilistic() const;
+	bool AllowNonrecoverablePart() const;
+	bool RecoverablePartFirst() const;
+	void ComputeMessageRepresentative(RandomNumberGenerator &rng,
+		const byte *recoverableMessage, size_t recoverableMessageLength,
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const;
+	DecodingResult RecoverMessageFromRepresentative(
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength,
+		byte *recoverableMessage) const;
+};
+
+/// \brief PSSR Message Encoding Method with Hash Identifier
+/// \tparam USE_HASH_ID flag indicating whether the HashId is used
+/// \since Crypto++ 2.1
+template <bool USE_HASH_ID> class PSSR_MEM_BaseWithHashId;
+
+/// \brief PSSR Message Encoding Method with Hash Identifier
+/// \details If USE_HASH_ID is true, then EMSA2HashIdLookup<PSSR_MEM_Base> is used for the base class
+template<> class PSSR_MEM_BaseWithHashId<true> : public EMSA2HashIdLookup<PSSR_MEM_Base> {};
+
+/// \brief PSSR Message Encoding Method without Hash Identifier
+/// \details If USE_HASH_ID is false, then PSSR_MEM_Base is used for the base class
+/// \since Crypto++ 2.1
+template<> class PSSR_MEM_BaseWithHashId<false> : public PSSR_MEM_Base {};
+
+/// \brief PSSR Message Encoding Method
+/// \tparam ALLOW_RECOVERY flag indicating whether the scheme provides message recovery
+/// \tparam MGF mask generation function
+/// \tparam SALT_LEN length of the salt
+/// \tparam MIN_PAD_LEN minimum length of the pad
+/// \tparam USE_HASH_ID flag indicating whether the HashId is used
+/// \details If ALLOW_RECOVERY is true, the signature scheme provides message recovery. If
+///  ALLOW_RECOVERY is false, the signature scheme is appendix, and the message must be
+///  provided during verification.
+/// \since Crypto++ 2.1
+template <bool ALLOW_RECOVERY, class MGF=P1363_MGF1, int SALT_LEN=-1, int MIN_PAD_LEN=0, bool USE_HASH_ID=false>
+class PSSR_MEM : public PSSR_MEM_BaseWithHashId<USE_HASH_ID>
+{
+	virtual bool AllowRecovery() const {return ALLOW_RECOVERY;}
+	virtual size_t SaltLen(size_t hashLen) const {return SALT_LEN < 0 ? hashLen : SALT_LEN;}
+	virtual size_t MinPadLen(size_t hashLen) const {return MIN_PAD_LEN < 0 ? hashLen : MIN_PAD_LEN;}
+	virtual const MaskGeneratingFunction & GetMGF() const {static MGF mgf; return mgf;}
+
+public:
+	static std::string CRYPTOPP_API StaticAlgorithmName() {return std::string(ALLOW_RECOVERY ? "PSSR-" : "PSS-") + MGF::StaticAlgorithmName();}
+};
+
+/// \brief Probabilistic Signature Scheme with Recovery
+/// \details Signature Schemes with Recovery encode the message with the signature.
+/// \sa <a href="http://www.weidai.com/scan-mirror/sig.html#sem_PSSR-MGF1">PSSR-MGF1</a>
+/// \since Crypto++ 2.1
+struct PSSR : public SignatureStandard
+{
+	typedef PSSR_MEM<true> SignatureMessageEncodingMethod;
+};
+
+/// \brief Probabilistic Signature Scheme with Appendix
+/// \details Signature Schemes with Appendix require the message to be provided during verification.
+/// \sa <a href="http://www.weidai.com/scan-mirror/sig.html#sem_PSS-MGF1">PSS-MGF1</a>
+/// \since Crypto++ 2.1
+struct PSS : public SignatureStandard
+{
+	typedef PSSR_MEM<false> SignatureMessageEncodingMethod;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/pubkey.cpp b/runtime/third_party/cryptopp/pubkey.cpp
new file mode 100644
index 0000000..c5bdb9d
--- /dev/null
+++ b/runtime/third_party/cryptopp/pubkey.cpp
@@ -0,0 +1,170 @@
+// pubkey.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "pubkey.h"
+#include "integer.h"
+#include "filters.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void P1363_MGF1KDF2_Common(HashTransformation &hash, byte *output, size_t outputLength, const byte *input, size_t inputLength, const byte *derivationParams, size_t derivationParamsLength, bool mask, unsigned int counterStart)
+{
+	ArraySink *sink;
+	HashFilter filter(hash, sink = mask ? new ArrayXorSink(output, outputLength) : new ArraySink(output, outputLength));
+	word32 counter = counterStart;
+	while (sink->AvailableSize() > 0)
+	{
+		filter.Put(input, inputLength);
+		filter.PutWord32(counter++);
+		filter.Put(derivationParams, derivationParamsLength);
+		filter.MessageEnd();
+	}
+}
+
+bool PK_DeterministicSignatureMessageEncodingMethod::VerifyMessageRepresentative(
+	HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+	byte *representative, size_t representativeBitLength) const
+{
+	SecByteBlock computedRepresentative(BitsToBytes(representativeBitLength));
+	ComputeMessageRepresentative(NullRNG(), NULLPTR, 0, hash, hashIdentifier, messageEmpty, computedRepresentative, representativeBitLength);
+	return VerifyBufsEqual(representative, computedRepresentative, computedRepresentative.size());
+}
+
+bool PK_RecoverableSignatureMessageEncodingMethod::VerifyMessageRepresentative(
+	HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+	byte *representative, size_t representativeBitLength) const
+{
+	SecByteBlock recoveredMessage(MaxRecoverableLength(representativeBitLength, hashIdentifier.second, hash.DigestSize()));
+	DecodingResult result = RecoverMessageFromRepresentative(
+		hash, hashIdentifier, messageEmpty, representative, representativeBitLength, recoveredMessage);
+	return result.isValidCoding && result.messageLength == 0;
+}
+
+void TF_SignerBase::InputRecoverableMessage(PK_MessageAccumulator &messageAccumulator, const byte *recoverableMessage, size_t recoverableMessageLength) const
+{
+	PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+	HashIdentifier id = GetHashIdentifier();
+	const MessageEncodingInterface &encoding = GetMessageEncodingInterface();
+
+	if (MessageRepresentativeBitLength() < encoding.MinRepresentativeBitLength(id.second, ma.AccessHash().DigestSize()))
+		throw PK_SignatureScheme::KeyTooShort();
+
+	size_t maxRecoverableLength = encoding.MaxRecoverableLength(MessageRepresentativeBitLength(), GetHashIdentifier().second, ma.AccessHash().DigestSize());
+
+	if (maxRecoverableLength == 0)
+		{throw NotImplemented("TF_SignerBase: this algorithm does not support message recovery or the key is too short");}
+	if (recoverableMessageLength > maxRecoverableLength)
+		throw InvalidArgument("TF_SignerBase: the recoverable message part is too long for the given key and algorithm");
+
+	ma.m_recoverableMessage.Assign(recoverableMessage, recoverableMessageLength);
+	encoding.ProcessRecoverableMessage(
+		ma.AccessHash(),
+		recoverableMessage, recoverableMessageLength,
+		NULLPTR, 0, ma.m_semisignature);
+}
+
+size_t TF_SignerBase::SignAndRestart(RandomNumberGenerator &rng, PK_MessageAccumulator &messageAccumulator, byte *signature, bool restart) const
+{
+	CRYPTOPP_UNUSED(restart);
+
+	PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+	HashIdentifier id = GetHashIdentifier();
+	const MessageEncodingInterface &encoding = GetMessageEncodingInterface();
+
+	if (MessageRepresentativeBitLength() < encoding.MinRepresentativeBitLength(id.second, ma.AccessHash().DigestSize()))
+		throw PK_SignatureScheme::KeyTooShort();
+
+	SecByteBlock representative(MessageRepresentativeLength());
+	encoding.ComputeMessageRepresentative(rng,
+		ma.m_recoverableMessage, ma.m_recoverableMessage.size(),
+		ma.AccessHash(), id, ma.m_empty,
+		representative, MessageRepresentativeBitLength());
+	ma.m_empty = true;
+
+	Integer r(representative, representative.size());
+	size_t signatureLength = SignatureLength();
+	GetTrapdoorFunctionInterface().CalculateRandomizedInverse(rng, r).Encode(signature, signatureLength);
+	return signatureLength;
+}
+
+void TF_VerifierBase::InputSignature(PK_MessageAccumulator &messageAccumulator, const byte *signature, size_t signatureLength) const
+{
+	PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+	HashIdentifier id = GetHashIdentifier();
+	const MessageEncodingInterface &encoding = GetMessageEncodingInterface();
+
+	if (MessageRepresentativeBitLength() < encoding.MinRepresentativeBitLength(id.second, ma.AccessHash().DigestSize()))
+		throw PK_SignatureScheme::KeyTooShort();
+
+	ma.m_representative.New(MessageRepresentativeLength());
+	Integer x = GetTrapdoorFunctionInterface().ApplyFunction(Integer(signature, signatureLength));
+	if (x.BitCount() > MessageRepresentativeBitLength())
+		x = Integer::Zero();	// don't return false here to prevent timing attack
+	x.Encode(ma.m_representative, ma.m_representative.size());
+}
+
+bool TF_VerifierBase::VerifyAndRestart(PK_MessageAccumulator &messageAccumulator) const
+{
+	PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+	HashIdentifier id = GetHashIdentifier();
+	const MessageEncodingInterface &encoding = GetMessageEncodingInterface();
+
+	if (MessageRepresentativeBitLength() < encoding.MinRepresentativeBitLength(id.second, ma.AccessHash().DigestSize()))
+		throw PK_SignatureScheme::KeyTooShort();
+
+	bool result = encoding.VerifyMessageRepresentative(
+		ma.AccessHash(), id, ma.m_empty, ma.m_representative, MessageRepresentativeBitLength());
+	ma.m_empty = true;
+	return result;
+}
+
+DecodingResult TF_VerifierBase::RecoverAndRestart(byte *recoveredMessage, PK_MessageAccumulator &messageAccumulator) const
+{
+	PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+	HashIdentifier id = GetHashIdentifier();
+	const MessageEncodingInterface &encoding = GetMessageEncodingInterface();
+
+	if (MessageRepresentativeBitLength() < encoding.MinRepresentativeBitLength(id.second, ma.AccessHash().DigestSize()))
+		throw PK_SignatureScheme::KeyTooShort();
+
+	DecodingResult result = encoding.RecoverMessageFromRepresentative(
+		ma.AccessHash(), id, ma.m_empty, ma.m_representative, MessageRepresentativeBitLength(), recoveredMessage);
+	ma.m_empty = true;
+	return result;
+}
+
+DecodingResult TF_DecryptorBase::Decrypt(RandomNumberGenerator &rng, const byte *ciphertext, size_t ciphertextLength, byte *plaintext, const NameValuePairs &parameters) const
+{
+	if (ciphertextLength != FixedCiphertextLength())
+			throw InvalidArgument(AlgorithmName() + ": ciphertext length of " + IntToString(ciphertextLength) + " doesn't match the required length of " + IntToString(FixedCiphertextLength()) + " for this key");
+
+	SecByteBlock paddedBlock(PaddedBlockByteLength());
+	Integer x = GetTrapdoorFunctionInterface().CalculateInverse(rng, Integer(ciphertext, ciphertextLength));
+	if (x.ByteCount() > paddedBlock.size())
+		x = Integer::Zero();	// don't return false here to prevent timing attack
+	x.Encode(paddedBlock, paddedBlock.size());
+	return GetMessageEncodingInterface().Unpad(paddedBlock, PaddedBlockBitLength(), plaintext, parameters);
+}
+
+void TF_EncryptorBase::Encrypt(RandomNumberGenerator &rng, const byte *plaintext, size_t plaintextLength, byte *ciphertext, const NameValuePairs &parameters) const
+{
+	if (plaintextLength > FixedMaxPlaintextLength())
+	{
+		if (FixedMaxPlaintextLength() < 1)
+			throw InvalidArgument(AlgorithmName() + ": this key is too short to encrypt any messages");
+		else
+			throw InvalidArgument(AlgorithmName() + ": message length of " + IntToString(plaintextLength) + " exceeds the maximum of " + IntToString(FixedMaxPlaintextLength()) + " for this public key");
+	}
+
+	SecByteBlock paddedBlock(PaddedBlockByteLength());
+	GetMessageEncodingInterface().Pad(rng, plaintext, plaintextLength, paddedBlock, PaddedBlockBitLength(), parameters);
+	GetTrapdoorFunctionInterface().ApplyRandomizedFunction(rng, Integer(paddedBlock, paddedBlock.size())).Encode(ciphertext, FixedCiphertextLength());
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/pubkey.h b/runtime/third_party/cryptopp/pubkey.h
new file mode 100644
index 0000000..bdfeef4
--- /dev/null
+++ b/runtime/third_party/cryptopp/pubkey.h
@@ -0,0 +1,2378 @@
+// pubkey.h - originally written and placed in the public domain by Wei Dai
+
+/// \file pubkey.h
+/// \brief This file contains helper classes/functions for implementing public key algorithms.
+/// \details The class hierarchies in this header file tend to look like this:
+///
+/// <pre>
+///                   x1
+///                  +--+
+///                  |  |
+///                 y1  z1
+///                  |  |
+///             x2<y1>  x2<z1>
+///                  |  |
+///                 y2  z2
+///                  |  |
+///             x3<y2>  x3<z2>
+///                  |  |
+///                 y3  z3
+/// </pre>
+///
+/// <ul>
+///  <li>x1, y1, z1 are abstract interface classes defined in cryptlib.h
+///  <li>x2, y2, z2 are implementations of the interfaces using "abstract policies", which
+///      are pure virtual functions that should return interfaces to interchangeable algorithms.
+///      These classes have Base suffixes.
+///  <li>x3, y3, z3 hold actual algorithms and implement those virtual functions.
+///      These classes have Impl suffixes.
+/// </ul>
+///
+/// \details The TF_ prefix means an implementation using trapdoor functions on integers.
+/// \details The DL_ prefix means an implementation using group operations in groups where discrete log is hard.
+
+#ifndef CRYPTOPP_PUBKEY_H
+#define CRYPTOPP_PUBKEY_H
+
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4702)
+#endif
+
+#include "cryptlib.h"
+#include "integer.h"
+#include "algebra.h"
+#include "modarith.h"
+#include "filters.h"
+#include "eprecomp.h"
+#include "fips140.h"
+#include "argnames.h"
+#include "smartptr.h"
+#include "stdcpp.h"
+
+#if defined(__SUNPRO_CC)
+# define MAYBE_RETURN(x) return x
+#else
+# define MAYBE_RETURN(x) CRYPTOPP_UNUSED(x)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Provides range for plaintext and ciphertext lengths
+/// \details A trapdoor function is a function that is easy to compute in one direction,
+///  but difficult to compute in the opposite direction without special knowledge.
+///  The special knowledge is usually the private key.
+/// \details Trapdoor functions only handle messages of a limited length or size.
+///  MaxPreimage is the plaintext's maximum length, and MaxImage is the
+///  ciphertext's maximum length.
+/// \sa TrapdoorFunctionBounds(), RandomizedTrapdoorFunction(), TrapdoorFunction(),
+///  RandomizedTrapdoorFunctionInverse() and TrapdoorFunctionInverse()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE TrapdoorFunctionBounds
+{
+public:
+	virtual ~TrapdoorFunctionBounds() {}
+
+	/// \brief Returns the maximum size of a message before the trapdoor function is applied
+	/// \return the maximum size of a message before the trapdoor function is applied
+	/// \details Derived classes must implement PreimageBound().
+	virtual Integer PreimageBound() const =0;
+	/// \brief Returns the maximum size of a representation after the trapdoor function is applied
+	/// \return the maximum size of a representation after the trapdoor function is applied
+	/// \details Derived classes must implement ImageBound().
+	virtual Integer ImageBound() const =0;
+	/// \brief Returns the maximum size of a message before the trapdoor function is applied bound to a public key
+	/// \return the maximum size of a message before the trapdoor function is applied bound to a public key
+	/// \details The default implementation returns <tt>PreimageBound() - 1</tt>.
+	virtual Integer MaxPreimage() const {return --PreimageBound();}
+	/// \brief Returns the maximum size of a representation after the trapdoor function is applied bound to a public key
+	/// \return the maximum size of a representation after the trapdoor function is applied bound to a public key
+	/// \details The default implementation returns <tt>ImageBound() - 1</tt>.
+	virtual Integer MaxImage() const {return --ImageBound();}
+};
+
+/// \brief Applies the trapdoor function, using random data if required
+/// \details ApplyFunction() is the foundation for encrypting a message under a public key.
+///  Derived classes will override it at some point.
+/// \sa TrapdoorFunctionBounds(), RandomizedTrapdoorFunction(), TrapdoorFunction(),
+///  RandomizedTrapdoorFunctionInverse() and TrapdoorFunctionInverse()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE RandomizedTrapdoorFunction : public TrapdoorFunctionBounds
+{
+public:
+	virtual ~RandomizedTrapdoorFunction() {}
+
+	/// \brief Applies the trapdoor function, using random data if required
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param x the message on which the encryption function is applied
+	/// \return the message x encrypted under the public key
+	/// \details ApplyRandomizedFunction is a generalization of encryption under a public key
+	///  cryptosystem. The RandomNumberGenerator may (or may not) be required.
+	///  Derived classes must implement it.
+	virtual Integer ApplyRandomizedFunction(RandomNumberGenerator &rng, const Integer &x) const =0;
+
+	/// \brief Determines if the encryption algorithm is randomized
+	/// \return true if the encryption algorithm is randomized, false otherwise
+	/// \details If IsRandomized() returns false, then NullRNG() can be used.
+	virtual bool IsRandomized() const {return true;}
+};
+
+/// \brief Applies the trapdoor function
+/// \details ApplyFunction() is the foundation for encrypting a message under a public key.
+///  Derived classes will override it at some point.
+/// \sa TrapdoorFunctionBounds(), RandomizedTrapdoorFunction(), TrapdoorFunction(),
+///  RandomizedTrapdoorFunctionInverse() and TrapdoorFunctionInverse()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE TrapdoorFunction : public RandomizedTrapdoorFunction
+{
+public:
+	virtual ~TrapdoorFunction() {}
+
+	/// \brief Applies the trapdoor function
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param x the message on which the encryption function is applied
+	/// \details ApplyRandomizedFunction is a generalization of encryption under a public key
+	///  cryptosystem. The RandomNumberGenerator may (or may not) be required.
+	/// \details Internally, ApplyRandomizedFunction() calls ApplyFunction()
+	///  without the RandomNumberGenerator.
+	Integer ApplyRandomizedFunction(RandomNumberGenerator &rng, const Integer &x) const
+		{CRYPTOPP_UNUSED(rng); return ApplyFunction(x);}
+	bool IsRandomized() const {return false;}
+
+	/// \brief Applies the trapdoor
+	/// \param x the message on which the encryption function is applied
+	/// \return the message x encrypted under the public key
+	/// \details ApplyFunction is a generalization of encryption under a public key
+	///  cryptosystem. Derived classes must implement it.
+	virtual Integer ApplyFunction(const Integer &x) const =0;
+};
+
+/// \brief Applies the inverse of the trapdoor function, using random data if required
+/// \details CalculateInverse() is the foundation for decrypting a message under a private key
+///  in a public key cryptosystem. Derived classes will override it at some point.
+/// \sa TrapdoorFunctionBounds(), RandomizedTrapdoorFunction(), TrapdoorFunction(),
+///  RandomizedTrapdoorFunctionInverse() and TrapdoorFunctionInverse()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE RandomizedTrapdoorFunctionInverse
+{
+public:
+	virtual ~RandomizedTrapdoorFunctionInverse() {}
+
+	/// \brief Applies the inverse of the trapdoor function, using random data if required
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param x the message on which the decryption function is applied
+	/// \return the message x decrypted under the private key
+	/// \details CalculateRandomizedInverse is a generalization of decryption using the private key
+	///  The RandomNumberGenerator may (or may not) be required. Derived classes must implement it.
+	virtual Integer CalculateRandomizedInverse(RandomNumberGenerator &rng, const Integer &x) const =0;
+
+	/// \brief Determines if the decryption algorithm is randomized
+	/// \return true if the decryption algorithm is randomized, false otherwise
+	/// \details If IsRandomized() returns false, then NullRNG() can be used.
+	virtual bool IsRandomized() const {return true;}
+};
+
+/// \brief Applies the inverse of the trapdoor function
+/// \details CalculateInverse() is the foundation for decrypting a message under a private key
+///  in a public key cryptosystem. Derived classes will override it at some point.
+/// \sa TrapdoorFunctionBounds(), RandomizedTrapdoorFunction(), TrapdoorFunction(),
+///  RandomizedTrapdoorFunctionInverse() and TrapdoorFunctionInverse()
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE TrapdoorFunctionInverse : public RandomizedTrapdoorFunctionInverse
+{
+public:
+	virtual ~TrapdoorFunctionInverse() {}
+
+	/// \brief Applies the inverse of the trapdoor function
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param x the message on which the decryption function is applied
+	/// \return the message x decrypted under the private key
+	/// \details CalculateRandomizedInverse is a generalization of decryption using the private key
+	/// \details Internally, CalculateRandomizedInverse() calls CalculateInverse()
+	///  without the RandomNumberGenerator.
+	Integer CalculateRandomizedInverse(RandomNumberGenerator &rng, const Integer &x) const
+		{return CalculateInverse(rng, x);}
+
+	/// \brief Determines if the decryption algorithm is randomized
+	/// \return true if the decryption algorithm is randomized, false otherwise
+	/// \details If IsRandomized() returns false, then NullRNG() can be used.
+	bool IsRandomized() const {return false;}
+
+	/// \brief Calculates the inverse of an element
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param x the element
+	/// \return the inverse of the element in the group
+	virtual Integer CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const =0;
+};
+
+// ********************************************************
+
+/// \brief Message encoding method for public key encryption
+class CRYPTOPP_NO_VTABLE PK_EncryptionMessageEncodingMethod
+{
+public:
+	virtual ~PK_EncryptionMessageEncodingMethod() {}
+
+	virtual bool ParameterSupported(const char *name) const
+		{CRYPTOPP_UNUSED(name); return false;}
+
+	/// max size of unpadded message in bytes, given max size of padded message in bits (1 less than size of modulus)
+	virtual size_t MaxUnpaddedLength(size_t paddedLength) const =0;
+
+	virtual void Pad(RandomNumberGenerator &rng, const byte *raw, size_t inputLength, byte *padded, size_t paddedBitLength, const NameValuePairs &parameters) const =0;
+
+	virtual DecodingResult Unpad(const byte *padded, size_t paddedBitLength, byte *raw, const NameValuePairs &parameters) const =0;
+};
+
+// ********************************************************
+
+/// \brief The base for trapdoor based cryptosystems
+/// \tparam TFI trapdoor function interface derived class
+/// \tparam MEI message encoding interface derived class
+template <class TFI, class MEI>
+class CRYPTOPP_NO_VTABLE TF_Base
+{
+protected:
+	virtual ~TF_Base() {}
+
+	virtual const TrapdoorFunctionBounds & GetTrapdoorFunctionBounds() const =0;
+
+	typedef TFI TrapdoorFunctionInterface;
+	virtual const TrapdoorFunctionInterface & GetTrapdoorFunctionInterface() const =0;
+
+	typedef MEI MessageEncodingInterface;
+	virtual const MessageEncodingInterface & GetMessageEncodingInterface() const =0;
+};
+
+// ********************************************************
+
+/// \brief Public key trapdoor function default implementation
+/// \tparam BASE public key cryptosystem with a fixed length
+template <class BASE>
+class CRYPTOPP_NO_VTABLE PK_FixedLengthCryptoSystemImpl : public BASE
+{
+public:
+	virtual ~PK_FixedLengthCryptoSystemImpl() {}
+
+	size_t MaxPlaintextLength(size_t ciphertextLength) const
+		{return ciphertextLength == FixedCiphertextLength() ? FixedMaxPlaintextLength() : 0;}
+	size_t CiphertextLength(size_t plaintextLength) const
+		{return plaintextLength <= FixedMaxPlaintextLength() ? FixedCiphertextLength() : 0;}
+
+	virtual size_t FixedMaxPlaintextLength() const =0;
+	virtual size_t FixedCiphertextLength() const =0;
+};
+
+/// \brief Trapdoor function cryptosystem base class
+/// \tparam INTFACE public key cryptosystem base interface
+/// \tparam BASE public key cryptosystem implementation base
+template <class INTFACE, class BASE>
+class CRYPTOPP_NO_VTABLE TF_CryptoSystemBase : public PK_FixedLengthCryptoSystemImpl<INTFACE>, protected BASE
+{
+public:
+	virtual ~TF_CryptoSystemBase() {}
+
+	bool ParameterSupported(const char *name) const {return this->GetMessageEncodingInterface().ParameterSupported(name);}
+	size_t FixedMaxPlaintextLength() const {return this->GetMessageEncodingInterface().MaxUnpaddedLength(PaddedBlockBitLength());}
+	size_t FixedCiphertextLength() const {return this->GetTrapdoorFunctionBounds().MaxImage().ByteCount();}
+
+protected:
+	size_t PaddedBlockByteLength() const {return BitsToBytes(PaddedBlockBitLength());}
+	// Coverity finding on potential overflow/underflow.
+	size_t PaddedBlockBitLength() const {return SaturatingSubtract(this->GetTrapdoorFunctionBounds().PreimageBound().BitCount(),1U);}
+};
+
+/// \brief Trapdoor function cryptosystems decryption base class
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE TF_DecryptorBase : public TF_CryptoSystemBase<PK_Decryptor, TF_Base<TrapdoorFunctionInverse, PK_EncryptionMessageEncodingMethod> >
+{
+public:
+	virtual ~TF_DecryptorBase() {}
+
+	DecodingResult Decrypt(RandomNumberGenerator &rng, const byte *ciphertext, size_t ciphertextLength, byte *plaintext, const NameValuePairs &parameters = g_nullNameValuePairs) const;
+};
+
+/// \brief Trapdoor function cryptosystems encryption base class
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE TF_EncryptorBase : public TF_CryptoSystemBase<PK_Encryptor, TF_Base<RandomizedTrapdoorFunction, PK_EncryptionMessageEncodingMethod> >
+{
+public:
+	virtual ~TF_EncryptorBase() {}
+
+	void Encrypt(RandomNumberGenerator &rng, const byte *plaintext, size_t plaintextLength, byte *ciphertext, const NameValuePairs &parameters = g_nullNameValuePairs) const;
+};
+
+// ********************************************************
+
+// Typedef change due to Clang, http://github.com/weidai11/cryptopp/issues/300
+typedef std::pair<const byte *, unsigned int> HashIdentifier;
+
+/// \brief Interface for message encoding method for public key signature schemes.
+/// \details PK_SignatureMessageEncodingMethod provides interfaces for message
+///  encoding method for public key signature schemes. The methods support both
+///  trapdoor functions (<tt>TF_*</tt>) and discrete logarithm (<tt>DL_*</tt>)
+///  based schemes.
+class CRYPTOPP_NO_VTABLE PK_SignatureMessageEncodingMethod
+{
+public:
+	virtual ~PK_SignatureMessageEncodingMethod() {}
+
+	virtual size_t MinRepresentativeBitLength(size_t hashIdentifierLength, size_t digestLength) const
+		{CRYPTOPP_UNUSED(hashIdentifierLength); CRYPTOPP_UNUSED(digestLength); return 0;}
+	virtual size_t MaxRecoverableLength(size_t representativeBitLength, size_t hashIdentifierLength, size_t digestLength) const
+		{CRYPTOPP_UNUSED(representativeBitLength); CRYPTOPP_UNUSED(representativeBitLength); CRYPTOPP_UNUSED(hashIdentifierLength); CRYPTOPP_UNUSED(digestLength); return 0;}
+
+	/// \brief Determines whether an encoding method requires a random number generator
+	/// \return true if the encoding method requires a RandomNumberGenerator()
+	/// \details if IsProbabilistic() returns false, then NullRNG() can be passed to functions that take
+	///  RandomNumberGenerator().
+	/// \sa Bellare and Rogaway<a href="http://grouper.ieee.org/groups/1363/P1363a/contributions/pss-submission.pdf">PSS:
+	///  Provably Secure Encoding Method for Digital Signatures</a>
+	bool IsProbabilistic() const
+		{return true;}
+	bool AllowNonrecoverablePart() const
+		{throw NotImplemented("PK_MessageEncodingMethod: this signature scheme does not support message recovery");}
+	virtual bool RecoverablePartFirst() const
+		{throw NotImplemented("PK_MessageEncodingMethod: this signature scheme does not support message recovery");}
+
+	// for verification, DL
+	virtual void ProcessSemisignature(HashTransformation &hash, const byte *semisignature, size_t semisignatureLength) const
+		{CRYPTOPP_UNUSED(hash); CRYPTOPP_UNUSED(semisignature); CRYPTOPP_UNUSED(semisignatureLength);}
+
+	// for signature
+	virtual void ProcessRecoverableMessage(HashTransformation &hash,
+		const byte *recoverableMessage, size_t recoverableMessageLength,
+		const byte *presignature, size_t presignatureLength,
+		SecByteBlock &semisignature) const
+	{
+		CRYPTOPP_UNUSED(hash);CRYPTOPP_UNUSED(recoverableMessage); CRYPTOPP_UNUSED(recoverableMessageLength);
+		CRYPTOPP_UNUSED(presignature); CRYPTOPP_UNUSED(presignatureLength); CRYPTOPP_UNUSED(semisignature);
+		if (RecoverablePartFirst())
+			CRYPTOPP_ASSERT(!"ProcessRecoverableMessage() not implemented");
+	}
+
+	virtual void ComputeMessageRepresentative(RandomNumberGenerator &rng,
+		const byte *recoverableMessage, size_t recoverableMessageLength,
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const =0;
+
+	virtual bool VerifyMessageRepresentative(
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const =0;
+
+	virtual DecodingResult RecoverMessageFromRepresentative(	// for TF
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength,
+		byte *recoveredMessage) const
+		{CRYPTOPP_UNUSED(hash);CRYPTOPP_UNUSED(hashIdentifier); CRYPTOPP_UNUSED(messageEmpty);
+		CRYPTOPP_UNUSED(representative); CRYPTOPP_UNUSED(representativeBitLength); CRYPTOPP_UNUSED(recoveredMessage);
+		throw NotImplemented("PK_MessageEncodingMethod: this signature scheme does not support message recovery");}
+
+	virtual DecodingResult RecoverMessageFromSemisignature(		// for DL
+		HashTransformation &hash, HashIdentifier hashIdentifier,
+		const byte *presignature, size_t presignatureLength,
+		const byte *semisignature, size_t semisignatureLength,
+		byte *recoveredMessage) const
+		{CRYPTOPP_UNUSED(hash);CRYPTOPP_UNUSED(hashIdentifier); CRYPTOPP_UNUSED(presignature); CRYPTOPP_UNUSED(presignatureLength);
+		CRYPTOPP_UNUSED(semisignature); CRYPTOPP_UNUSED(semisignatureLength); CRYPTOPP_UNUSED(recoveredMessage);
+		throw NotImplemented("PK_MessageEncodingMethod: this signature scheme does not support message recovery");}
+
+	// VC60 workaround
+	struct HashIdentifierLookup
+	{
+		template <class H> struct HashIdentifierLookup2
+		{
+			static HashIdentifier CRYPTOPP_API Lookup()
+			{
+				return HashIdentifier(static_cast<const byte *>(NULLPTR), 0);
+			}
+		};
+	};
+};
+
+/// \brief Interface for message encoding method for public key signature schemes.
+/// \details PK_DeterministicSignatureMessageEncodingMethod provides interfaces
+///  for message encoding method for public key signature schemes.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_DeterministicSignatureMessageEncodingMethod : public PK_SignatureMessageEncodingMethod
+{
+public:
+	bool VerifyMessageRepresentative(
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const;
+};
+
+/// \brief Interface for message encoding method for public key signature schemes.
+/// \details PK_RecoverableSignatureMessageEncodingMethod provides interfaces
+///  for message encoding method for public key signature schemes.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_RecoverableSignatureMessageEncodingMethod : public PK_SignatureMessageEncodingMethod
+{
+public:
+	bool VerifyMessageRepresentative(
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const;
+};
+
+/// \brief Interface for message encoding method for public key signature schemes.
+/// \details DL_SignatureMessageEncodingMethod_DSA provides interfaces
+///  for message encoding method for DSA.
+class CRYPTOPP_DLL DL_SignatureMessageEncodingMethod_DSA : public PK_DeterministicSignatureMessageEncodingMethod
+{
+public:
+	void ComputeMessageRepresentative(RandomNumberGenerator &rng,
+		const byte *recoverableMessage, size_t recoverableMessageLength,
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const;
+};
+
+/// \brief Interface for message encoding method for public key signature schemes.
+/// \details DL_SignatureMessageEncodingMethod_NR provides interfaces
+///  for message encoding method for Nyberg-Rueppel.
+class CRYPTOPP_DLL DL_SignatureMessageEncodingMethod_NR : public PK_DeterministicSignatureMessageEncodingMethod
+{
+public:
+	void ComputeMessageRepresentative(RandomNumberGenerator &rng,
+		const byte *recoverableMessage, size_t recoverableMessageLength,
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const;
+};
+
+#if 0
+/// \brief Interface for message encoding method for public key signature schemes.
+/// \details DL_SignatureMessageEncodingMethod_SM2 provides interfaces
+///  for message encoding method for SM2.
+class CRYPTOPP_DLL DL_SignatureMessageEncodingMethod_SM2 : public PK_DeterministicSignatureMessageEncodingMethod
+{
+public:
+	void ComputeMessageRepresentative(RandomNumberGenerator &rng,
+		const byte *recoverableMessage, size_t recoverableMessageLength,
+		HashTransformation &hash, HashIdentifier hashIdentifier, bool messageEmpty,
+		byte *representative, size_t representativeBitLength) const;
+};
+#endif
+
+/// \brief Interface for message encoding method for public key signature schemes.
+/// \details PK_MessageAccumulatorBase provides interfaces
+///  for message encoding method.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE PK_MessageAccumulatorBase : public PK_MessageAccumulator
+{
+public:
+	PK_MessageAccumulatorBase() : m_empty(true) {}
+
+	virtual HashTransformation & AccessHash() =0;
+
+	void Update(const byte *input, size_t length)
+	{
+		AccessHash().Update(input, length);
+		m_empty = m_empty && length == 0;
+	}
+
+	SecByteBlock m_recoverableMessage, m_representative, m_presignature, m_semisignature;
+	Integer m_k, m_s;
+	bool m_empty;
+};
+
+/// \brief Interface for message encoding method for public key signature schemes.
+/// \details PK_MessageAccumulatorBase provides interfaces
+///  for message encoding method.
+template <class HASH_ALGORITHM>
+class PK_MessageAccumulatorImpl : public PK_MessageAccumulatorBase, protected ObjectHolder<HASH_ALGORITHM>
+{
+public:
+	HashTransformation & AccessHash() {return this->m_object;}
+};
+
+/// \brief Trapdoor Function (TF) Signature Scheme base class
+/// \tparam INTFACE interface
+/// \tparam BASE base class
+template <class INTFACE, class BASE>
+class CRYPTOPP_NO_VTABLE TF_SignatureSchemeBase : public INTFACE, protected BASE
+{
+public:
+	virtual ~TF_SignatureSchemeBase() {}
+
+	size_t SignatureLength() const
+		{return this->GetTrapdoorFunctionBounds().MaxPreimage().ByteCount();}
+	size_t MaxRecoverableLength() const
+		{return this->GetMessageEncodingInterface().MaxRecoverableLength(MessageRepresentativeBitLength(), GetHashIdentifier().second, GetDigestSize());}
+	size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const
+		{CRYPTOPP_UNUSED(signatureLength); return this->MaxRecoverableLength();}
+
+	bool IsProbabilistic() const
+		{return this->GetTrapdoorFunctionInterface().IsRandomized() || this->GetMessageEncodingInterface().IsProbabilistic();}
+	bool AllowNonrecoverablePart() const
+		{return this->GetMessageEncodingInterface().AllowNonrecoverablePart();}
+	bool RecoverablePartFirst() const
+		{return this->GetMessageEncodingInterface().RecoverablePartFirst();}
+
+protected:
+	size_t MessageRepresentativeLength() const {return BitsToBytes(MessageRepresentativeBitLength());}
+	// Coverity finding on potential overflow/underflow.
+	size_t MessageRepresentativeBitLength() const {return SaturatingSubtract(this->GetTrapdoorFunctionBounds().ImageBound().BitCount(),1U);}
+	virtual HashIdentifier GetHashIdentifier() const =0;
+	virtual size_t GetDigestSize() const =0;
+};
+
+/// \brief Trapdoor Function (TF) Signer base class
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE TF_SignerBase : public TF_SignatureSchemeBase<PK_Signer, TF_Base<RandomizedTrapdoorFunctionInverse, PK_SignatureMessageEncodingMethod> >
+{
+public:
+	virtual ~TF_SignerBase() {}
+
+	void InputRecoverableMessage(PK_MessageAccumulator &messageAccumulator, const byte *recoverableMessage, size_t recoverableMessageLength) const;
+	size_t SignAndRestart(RandomNumberGenerator &rng, PK_MessageAccumulator &messageAccumulator, byte *signature, bool restart=true) const;
+};
+
+/// \brief Trapdoor Function (TF) Verifier base class
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE TF_VerifierBase : public TF_SignatureSchemeBase<PK_Verifier, TF_Base<TrapdoorFunction, PK_SignatureMessageEncodingMethod> >
+{
+public:
+	virtual ~TF_VerifierBase() {}
+
+	void InputSignature(PK_MessageAccumulator &messageAccumulator, const byte *signature, size_t signatureLength) const;
+	bool VerifyAndRestart(PK_MessageAccumulator &messageAccumulator) const;
+	DecodingResult RecoverAndRestart(byte *recoveredMessage, PK_MessageAccumulator &recoveryAccumulator) const;
+};
+
+// ********************************************************
+
+/// \brief Trapdoor Function (TF) scheme options
+/// \tparam T1 algorithm info class
+/// \tparam T2 keys class with public and private key
+/// \tparam T3 message encoding class
+template <class T1, class T2, class T3>
+struct TF_CryptoSchemeOptions
+{
+	typedef T1 AlgorithmInfo;
+	typedef T2 Keys;
+	typedef typename Keys::PrivateKey PrivateKey;
+	typedef typename Keys::PublicKey PublicKey;
+	typedef T3 MessageEncodingMethod;
+};
+
+/// \brief Trapdoor Function (TF) signature scheme options
+/// \tparam T1 algorithm info class
+/// \tparam T2 keys class with public and private key
+/// \tparam T3 message encoding class
+/// \tparam T4 HashTransformation class
+template <class T1, class T2, class T3, class T4>
+struct TF_SignatureSchemeOptions : public TF_CryptoSchemeOptions<T1, T2, T3>
+{
+	typedef T4 HashFunction;
+};
+
+/// \brief Trapdoor Function (TF) base implementation
+/// \tparam BASE base class
+/// \tparam SCHEME_OPTIONS scheme options class
+/// \tparam KEY_CLASS key class
+template <class BASE, class SCHEME_OPTIONS, class KEY_CLASS>
+class CRYPTOPP_NO_VTABLE TF_ObjectImplBase : public AlgorithmImpl<BASE, typename SCHEME_OPTIONS::AlgorithmInfo>
+{
+public:
+	typedef SCHEME_OPTIONS SchemeOptions;
+	typedef KEY_CLASS KeyClass;
+
+	virtual ~TF_ObjectImplBase() {}
+
+	PublicKey & AccessPublicKey() {return AccessKey();}
+	const PublicKey & GetPublicKey() const {return GetKey();}
+
+	PrivateKey & AccessPrivateKey() {return AccessKey();}
+	const PrivateKey & GetPrivateKey() const {return GetKey();}
+
+	virtual const KeyClass & GetKey() const =0;
+	virtual KeyClass & AccessKey() =0;
+
+	const KeyClass & GetTrapdoorFunction() const {return GetKey();}
+
+	PK_MessageAccumulator * NewSignatureAccumulator(RandomNumberGenerator &rng) const
+	{
+		CRYPTOPP_UNUSED(rng);
+		return new PK_MessageAccumulatorImpl<typename SCHEME_OPTIONS::HashFunction>;
+	}
+	PK_MessageAccumulator * NewVerificationAccumulator() const
+	{
+		return new PK_MessageAccumulatorImpl<typename SCHEME_OPTIONS::HashFunction>;
+	}
+
+protected:
+	const typename BASE::MessageEncodingInterface & GetMessageEncodingInterface() const
+		{return Singleton<typename SCHEME_OPTIONS::MessageEncodingMethod>().Ref();}
+	const TrapdoorFunctionBounds & GetTrapdoorFunctionBounds() const
+		{return GetKey();}
+	const typename BASE::TrapdoorFunctionInterface & GetTrapdoorFunctionInterface() const
+		{return GetKey();}
+
+	// for signature scheme
+	HashIdentifier GetHashIdentifier() const
+	{
+        typedef typename SchemeOptions::MessageEncodingMethod::HashIdentifierLookup::template HashIdentifierLookup2<typename SchemeOptions::HashFunction> L;
+        return L::Lookup();
+	}
+	size_t GetDigestSize() const
+	{
+		typedef typename SchemeOptions::HashFunction H;
+		return H::DIGESTSIZE;
+	}
+};
+
+/// \brief Trapdoor Function (TF) signature with external reference
+/// \tparam BASE base class
+/// \tparam SCHEME_OPTIONS scheme options class
+/// \tparam KEY key class
+/// \details TF_ObjectImplExtRef() holds a pointer to an external key structure
+template <class BASE, class SCHEME_OPTIONS, class KEY>
+class TF_ObjectImplExtRef : public TF_ObjectImplBase<BASE, SCHEME_OPTIONS, KEY>
+{
+public:
+	virtual ~TF_ObjectImplExtRef() {}
+
+	TF_ObjectImplExtRef(const KEY *pKey = NULLPTR) : m_pKey(pKey) {}
+	void SetKeyPtr(const KEY *pKey) {m_pKey = pKey;}
+
+	const KEY & GetKey() const {return *m_pKey;}
+	KEY & AccessKey() {throw NotImplemented("TF_ObjectImplExtRef: cannot modify refererenced key");}
+
+private:
+	const KEY * m_pKey;
+};
+
+/// \brief Trapdoor Function (TF) signature scheme options
+/// \tparam BASE base class
+/// \tparam SCHEME_OPTIONS scheme options class
+/// \tparam KEY_CLASS key class
+/// \details TF_ObjectImpl() holds a reference to a trapdoor function
+template <class BASE, class SCHEME_OPTIONS, class KEY_CLASS>
+class CRYPTOPP_NO_VTABLE TF_ObjectImpl : public TF_ObjectImplBase<BASE, SCHEME_OPTIONS, KEY_CLASS>
+{
+public:
+	typedef KEY_CLASS KeyClass;
+
+	virtual ~TF_ObjectImpl() {}
+
+	const KeyClass & GetKey() const {return m_trapdoorFunction;}
+	KeyClass & AccessKey() {return m_trapdoorFunction;}
+
+private:
+	KeyClass m_trapdoorFunction;
+};
+
+/// \brief Trapdoor Function (TF) decryptor options
+/// \tparam SCHEME_OPTIONS scheme options class
+template <class SCHEME_OPTIONS>
+class TF_DecryptorImpl : public TF_ObjectImpl<TF_DecryptorBase, SCHEME_OPTIONS, typename SCHEME_OPTIONS::PrivateKey>
+{
+};
+
+/// \brief Trapdoor Function (TF) encryptor options
+/// \tparam SCHEME_OPTIONS scheme options class
+template <class SCHEME_OPTIONS>
+class TF_EncryptorImpl : public TF_ObjectImpl<TF_EncryptorBase, SCHEME_OPTIONS, typename SCHEME_OPTIONS::PublicKey>
+{
+};
+
+/// \brief Trapdoor Function (TF) encryptor options
+/// \tparam SCHEME_OPTIONS scheme options class
+template <class SCHEME_OPTIONS>
+class TF_SignerImpl : public TF_ObjectImpl<TF_SignerBase, SCHEME_OPTIONS, typename SCHEME_OPTIONS::PrivateKey>
+{
+};
+
+/// \brief Trapdoor Function (TF) encryptor options
+/// \tparam SCHEME_OPTIONS scheme options class
+template <class SCHEME_OPTIONS>
+class TF_VerifierImpl : public TF_ObjectImpl<TF_VerifierBase, SCHEME_OPTIONS, typename SCHEME_OPTIONS::PublicKey>
+{
+};
+
+// ********************************************************
+
+/// \brief Mask generation function interface
+/// \sa P1363_KDF2, P1363_MGF1
+/// \since Crypto++ 2.0
+class CRYPTOPP_NO_VTABLE MaskGeneratingFunction
+{
+public:
+	virtual ~MaskGeneratingFunction() {}
+
+	/// \brief Generate and apply mask
+	/// \param hash HashTransformation derived class
+	/// \param output the destination byte array
+	/// \param outputLength the size of the destination byte array
+	/// \param input the message to hash
+	/// \param inputLength the size of the message
+	/// \param mask flag indicating whether to apply the mask
+	virtual void GenerateAndMask(HashTransformation &hash, byte *output, size_t outputLength, const byte *input, size_t inputLength, bool mask = true) const =0;
+};
+
+/// \fn P1363_MGF1KDF2_Common
+/// \brief P1363 mask generation function
+/// \param hash HashTransformation derived class
+/// \param output the destination byte array
+/// \param outputLength the size of the destination byte array
+/// \param input the message to hash
+/// \param inputLength the size of the message
+/// \param derivationParams additional derivation parameters
+/// \param derivationParamsLength the size of the additional derivation parameters
+/// \param mask flag indicating whether to apply the mask
+/// \param counterStart starting counter value used in generation function
+CRYPTOPP_DLL void CRYPTOPP_API P1363_MGF1KDF2_Common(HashTransformation &hash, byte *output, size_t outputLength, const byte *input, size_t inputLength, const byte *derivationParams, size_t derivationParamsLength, bool mask, unsigned int counterStart);
+
+/// \brief P1363 mask generation function
+/// \sa P1363_KDF2, MaskGeneratingFunction
+/// \since Crypto++ 2.0
+class P1363_MGF1 : public MaskGeneratingFunction
+{
+public:
+	/// \brief The algorithm name
+	/// \return the algorithm name
+	/// \details StaticAlgorithmName returns the algorithm's name as a static
+	///  member function.
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "MGF1";}
+
+	/// \brief P1363 mask generation function
+	/// \param hash HashTransformation derived class
+	/// \param output the destination byte array
+	/// \param outputLength the size of the destination byte array
+	/// \param input the message to hash
+	/// \param inputLength the size of the message
+	/// \param mask flag indicating whether to apply the mask
+	void GenerateAndMask(HashTransformation &hash, byte *output, size_t outputLength, const byte *input, size_t inputLength, bool mask = true) const
+	{
+		P1363_MGF1KDF2_Common(hash, output, outputLength, input, inputLength, NULLPTR, 0, mask, 0);
+	}
+};
+
+// ********************************************************
+
+/// \brief P1363 key derivation function
+/// \tparam H hash function used in the derivation
+/// \sa P1363_MGF1, KeyDerivationFunction, <A
+///  HREF="https://www.cryptopp.com/wiki/P1363_KDF2">P1363_KDF2</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 2.0
+template <class H>
+class P1363_KDF2
+{
+public:
+	/// \brief P1363 key derivation function
+	/// \param output the destination byte array
+	/// \param outputLength the size of the destination byte array
+	/// \param input the message to hash
+	/// \param inputLength the size of the message
+	/// \param derivationParams additional derivation parameters
+	/// \param derivationParamsLength the size of the additional derivation parameters
+	/// \details DeriveKey calls P1363_MGF1KDF2_Common
+	static void CRYPTOPP_API DeriveKey(byte *output, size_t outputLength, const byte *input, size_t inputLength, const byte *derivationParams, size_t derivationParamsLength)
+	{
+		H h;
+		P1363_MGF1KDF2_Common(h, output, outputLength, input, inputLength, derivationParams, derivationParamsLength, false, 1);
+	}
+};
+
+// ********************************************************
+
+/// \brief Exception thrown when an invalid group element is encountered
+/// \details Thrown by DecodeElement and AgreeWithStaticPrivateKey
+class DL_BadElement : public InvalidDataFormat
+{
+public:
+	DL_BadElement() : InvalidDataFormat("CryptoPP: invalid group element") {}
+};
+
+/// \brief Interface for Discrete Log (DL) group parameters
+/// \tparam T element in the group
+/// \details The element is usually an Integer, \ref ECP "ECP::Point" or \ref EC2N "EC2N::Point"
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_GroupParameters : public CryptoParameters
+{
+	typedef DL_GroupParameters<T> ThisClass;
+
+public:
+	typedef T Element;
+
+	virtual ~DL_GroupParameters() {}
+
+	DL_GroupParameters() : m_validationLevel(0) {}
+
+	// CryptoMaterial
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const
+	{
+		if (!GetBasePrecomputation().IsInitialized())
+			return false;
+
+		if (m_validationLevel > level)
+			return true;
+
+		CRYPTOPP_ASSERT(ValidateGroup(rng, level));
+		bool pass = ValidateGroup(rng, level);
+		CRYPTOPP_ASSERT(ValidateElement(level, GetSubgroupGenerator(), &GetBasePrecomputation()));
+		pass = pass && ValidateElement(level, GetSubgroupGenerator(), &GetBasePrecomputation());
+
+		m_validationLevel = pass ? level+1 : 0;
+
+		return pass;
+	}
+
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+	{
+		return GetValueHelper(this, name, valueType, pValue)
+			CRYPTOPP_GET_FUNCTION_ENTRY(SubgroupOrder)
+			CRYPTOPP_GET_FUNCTION_ENTRY(SubgroupGenerator)
+			;
+	}
+
+	/// \brief Determines whether the object supports precomputation
+	/// \return true if the object supports precomputation, false otherwise
+	/// \sa Precompute()
+	bool SupportsPrecomputation() const {return true;}
+
+	/// \brief Perform precomputation
+	/// \param precomputationStorage the suggested number of objects for the precompute table
+	/// \throw NotImplemented
+	/// \details The exact semantics of Precompute() varies, but it typically means calculate
+	///  a table of n objects that can be used later to speed up computation.
+	/// \details If a derived class does not override Precompute(), then the base class throws
+	///  NotImplemented.
+	/// \sa SupportsPrecomputation(), LoadPrecomputation(), SavePrecomputation()
+	void Precompute(unsigned int precomputationStorage=16)
+	{
+		AccessBasePrecomputation().Precompute(GetGroupPrecomputation(), GetSubgroupOrder().BitCount(), precomputationStorage);
+	}
+
+	/// \brief Retrieve previously saved precomputation
+	/// \param storedPrecomputation BufferedTransformation with the saved precomputation
+	/// \throw NotImplemented
+	/// \sa SupportsPrecomputation(), Precompute()
+	void LoadPrecomputation(BufferedTransformation &storedPrecomputation)
+	{
+		AccessBasePrecomputation().Load(GetGroupPrecomputation(), storedPrecomputation);
+		m_validationLevel = 0;
+	}
+
+	/// \brief Save precomputation for later use
+	/// \param storedPrecomputation BufferedTransformation to write the precomputation
+	/// \throw NotImplemented
+	/// \sa SupportsPrecomputation(), Precompute()
+	void SavePrecomputation(BufferedTransformation &storedPrecomputation) const
+	{
+		GetBasePrecomputation().Save(GetGroupPrecomputation(), storedPrecomputation);
+	}
+
+	/// \brief Retrieves the subgroup generator
+	/// \return the subgroup generator
+	/// \details The subgroup generator is retrieved from the base precomputation
+	virtual const Element & GetSubgroupGenerator() const {return GetBasePrecomputation().GetBase(GetGroupPrecomputation());}
+
+	/// \brief Sets the subgroup generator
+	/// \param base the new subgroup generator
+	/// \details The subgroup generator is set in the base precomputation
+	virtual void SetSubgroupGenerator(const Element &base) {AccessBasePrecomputation().SetBase(GetGroupPrecomputation(), base);}
+
+	/// \brief Exponentiates the base
+	/// \return the element after exponentiation
+	/// \details ExponentiateBase() calls GetBasePrecomputation() and then exponentiates.
+	virtual Element ExponentiateBase(const Integer &exponent) const
+	{
+		return GetBasePrecomputation().Exponentiate(GetGroupPrecomputation(), exponent);
+	}
+
+	/// \brief Exponentiates an element
+	/// \param base the base element
+	/// \param exponent the exponent to raise the base
+	/// \return the result of the exponentiation
+	/// \details Internally, ExponentiateElement() calls SimultaneousExponentiate().
+	virtual Element ExponentiateElement(const Element &base, const Integer &exponent) const
+	{
+		Element result;
+		SimultaneousExponentiate(&result, base, &exponent, 1);
+		return result;
+	}
+
+	/// \brief Retrieves the group precomputation
+	/// \return a const reference to the group precomputation
+	virtual const DL_GroupPrecomputation<Element> & GetGroupPrecomputation() const =0;
+
+	/// \brief Retrieves the group precomputation
+	/// \return a const reference to the group precomputation using a fixed base
+	virtual const DL_FixedBasePrecomputation<Element> & GetBasePrecomputation() const =0;
+
+	/// \brief Retrieves the group precomputation
+	/// \return a non-const reference to the group precomputation using a fixed base
+	virtual DL_FixedBasePrecomputation<Element> & AccessBasePrecomputation() =0;
+
+	/// \brief Retrieves the subgroup order
+	/// \return the order of subgroup generated by the base element
+	virtual const Integer & GetSubgroupOrder() const =0;
+
+	/// \brief Retrieves the maximum exponent for the group
+	/// \return the maximum exponent for the group
+	virtual Integer GetMaxExponent() const =0;
+
+	/// \brief Retrieves the order of the group
+	/// \return the order of the group
+	/// \details Either GetGroupOrder() or GetCofactor() must be overridden in a derived class.
+	virtual Integer GetGroupOrder() const {return GetSubgroupOrder()*GetCofactor();}
+
+	/// \brief Retrieves the cofactor
+	/// \return the cofactor
+	/// \details Either GetGroupOrder() or GetCofactor() must be overridden in a derived class.
+	virtual Integer GetCofactor() const {return GetGroupOrder()/GetSubgroupOrder();}
+
+	/// \brief Retrieves the encoded element's size
+	/// \param reversible flag indicating the encoding format
+	/// \return encoded element's size, in bytes
+	/// \details The format of the encoded element varies by the underlying type of the element and the
+	///  reversible flag. GetEncodedElementSize() must be implemented in a derived class.
+	/// \sa GetEncodedElementSize(), EncodeElement(), DecodeElement()
+	virtual unsigned int GetEncodedElementSize(bool reversible) const =0;
+
+	/// \brief Encodes the element
+	/// \param reversible flag indicating the encoding format
+	/// \param element reference to the element to encode
+	/// \param encoded destination byte array for the encoded element
+	/// \details EncodeElement() must be implemented in a derived class.
+	/// \pre <tt>COUNTOF(encoded) == GetEncodedElementSize()</tt>
+	virtual void EncodeElement(bool reversible, const Element &element, byte *encoded) const =0;
+
+	/// \brief Decodes the element
+	/// \param encoded byte array with the encoded element
+	/// \param checkForGroupMembership flag indicating if the element should be validated
+	/// \return Element after decoding
+	/// \details DecodeElement() must be implemented in a derived class.
+	/// \pre <tt>COUNTOF(encoded) == GetEncodedElementSize()</tt>
+	virtual Element DecodeElement(const byte *encoded, bool checkForGroupMembership) const =0;
+
+	/// \brief Converts an element to an Integer
+	/// \param element the element to convert to an Integer
+	/// \return Element after converting to an Integer
+	/// \details ConvertElementToInteger() must be implemented in a derived class.
+	virtual Integer ConvertElementToInteger(const Element &element) const =0;
+
+	/// \brief Check the group for errors
+	/// \param rng RandomNumberGenerator for objects which use randomized testing
+	/// \param level level of thoroughness
+	/// \return true if the tests succeed, false otherwise
+	/// \details There are four levels of thoroughness:
+	///  <ul>
+	///  <li>0 - using this object won't cause a crash or exception
+	///  <li>1 - this object will probably function, and encrypt, sign, other operations correctly
+	///  <li>2 - ensure this object will function correctly, and perform reasonable security checks
+	///  <li>3 - perform reasonable security checks, and do checks that may take a long time
+	///  </ul>
+	/// \details Level 0 does not require a RandomNumberGenerator. A NullRNG() can be used for level 0.
+	///  Level 1 may not check for weak keys and such. Levels 2 and 3 are recommended.
+	/// \details ValidateGroup() must be implemented in a derived class.
+	virtual bool ValidateGroup(RandomNumberGenerator &rng, unsigned int level) const =0;
+
+	/// \brief Check the element for errors
+	/// \param level level of thoroughness
+	/// \param element element to check
+	/// \param precomp optional pointer to DL_FixedBasePrecomputation
+	/// \return true if the tests succeed, false otherwise
+	/// \details There are four levels of thoroughness:
+	///  <ul>
+	///  <li>0 - using this object won't cause a crash or exception
+	///  <li>1 - this object will probably function, and encrypt, sign, other operations correctly
+	///  <li>2 - ensure this object will function correctly, and perform reasonable security checks
+	///  <li>3 - perform reasonable security checks, and do checks that may take a long time
+	///  </ul>
+	/// \details Level 0 performs group membership checks. Level 1 may not check for weak keys and such.
+	///  Levels 2 and 3 are recommended.
+	/// \details ValidateElement() must be implemented in a derived class.
+	virtual bool ValidateElement(unsigned int level, const Element &element, const DL_FixedBasePrecomputation<Element> *precomp) const =0;
+
+	virtual bool FastSubgroupCheckAvailable() const =0;
+
+	/// \brief Determines if an element is an identity
+	/// \param element element to check
+	/// \return true if the element is an identity, false otherwise
+	/// \details The identity element or or neutral element is a special element in a group that leaves
+	///  other elements unchanged when combined with it.
+	/// \details IsIdentity() must be implemented in a derived class.
+	virtual bool IsIdentity(const Element &element) const =0;
+
+	/// \brief Exponentiates a base to multiple exponents
+	/// \param results an array of Elements
+	/// \param base the base to raise to the exponents
+	/// \param exponents an array of exponents
+	/// \param exponentsCount the number of exponents in the array
+	/// \details SimultaneousExponentiate() raises the base to each exponent in the exponents array and stores the
+	///  result at the respective position in the results array.
+	/// \details SimultaneousExponentiate() must be implemented in a derived class.
+	/// \pre <tt>COUNTOF(results) == exponentsCount</tt>
+	/// \pre <tt>COUNTOF(exponents) == exponentsCount</tt>
+	virtual void SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const =0;
+
+protected:
+	void ParametersChanged() {m_validationLevel = 0;}
+
+private:
+	mutable unsigned int m_validationLevel;
+};
+
+/// \brief Base implementation of Discrete Log (DL) group parameters
+/// \tparam GROUP_PRECOMP group precomputation class
+/// \tparam BASE_PRECOMP fixed base precomputation class
+/// \tparam BASE class or type of an element
+template <class GROUP_PRECOMP, class BASE_PRECOMP = DL_FixedBasePrecomputationImpl<typename GROUP_PRECOMP::Element>, class BASE = DL_GroupParameters<typename GROUP_PRECOMP::Element> >
+class DL_GroupParametersImpl : public BASE
+{
+public:
+	typedef GROUP_PRECOMP GroupPrecomputation;
+	typedef typename GROUP_PRECOMP::Element Element;
+	typedef BASE_PRECOMP BasePrecomputation;
+
+	virtual ~DL_GroupParametersImpl() {}
+
+	/// \brief Retrieves the group precomputation
+	/// \return a const reference to the group precomputation
+	const DL_GroupPrecomputation<Element> & GetGroupPrecomputation() const {return m_groupPrecomputation;}
+
+	/// \brief Retrieves the group precomputation
+	/// \return a const reference to the group precomputation using a fixed base
+	const DL_FixedBasePrecomputation<Element> & GetBasePrecomputation() const {return m_gpc;}
+
+	/// \brief Retrieves the group precomputation
+	/// \return a non-const reference to the group precomputation using a fixed base
+	DL_FixedBasePrecomputation<Element> & AccessBasePrecomputation() {return m_gpc;}
+
+protected:
+	GROUP_PRECOMP m_groupPrecomputation;
+	BASE_PRECOMP m_gpc;
+};
+
+/// \brief Base class for a Discrete Log (DL) key
+/// \tparam T class or type of an element
+/// \details The element is usually an Integer, \ref ECP "ECP::Point" or \ref EC2N "EC2N::Point"
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_Key
+{
+public:
+	virtual ~DL_Key() {}
+
+	/// \brief Retrieves abstract group parameters
+	/// \return a const reference to the group parameters
+	virtual const DL_GroupParameters<T> & GetAbstractGroupParameters() const =0;
+	/// \brief Retrieves abstract group parameters
+	/// \return a non-const reference to the group parameters
+	virtual DL_GroupParameters<T> & AccessAbstractGroupParameters() =0;
+};
+
+/// \brief Interface for Discrete Log (DL) public keys
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_PublicKey : public DL_Key<T>
+{
+	typedef DL_PublicKey<T> ThisClass;
+
+public:
+	typedef T Element;
+
+	virtual ~DL_PublicKey();
+
+	/// \brief Get a named value
+	/// \param name the name of the object or value to retrieve
+	/// \param valueType reference to a variable that receives the value
+	/// \param pValue void pointer to a variable that receives the value
+	/// \return true if the value was retrieved, false otherwise
+	/// \details GetVoidValue() retrieves the value of name if it exists.
+	/// \note GetVoidValue() is an internal function and should be implemented
+	///  by derived classes. Users should use one of the other functions instead.
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+	{
+		return GetValueHelper(this, name, valueType, pValue, &this->GetAbstractGroupParameters())
+				CRYPTOPP_GET_FUNCTION_ENTRY(PublicElement);
+	}
+
+	/// \brief Initialize or reinitialize this key
+	/// \param source NameValuePairs to assign
+	void AssignFrom(const NameValuePairs &source);
+
+	/// \brief Retrieves the public element
+	/// \return the public element
+	virtual const Element & GetPublicElement() const {return GetPublicPrecomputation().GetBase(this->GetAbstractGroupParameters().GetGroupPrecomputation());}
+
+	/// \brief Sets the public element
+	/// \param y the public element
+	virtual void SetPublicElement(const Element &y) {AccessPublicPrecomputation().SetBase(this->GetAbstractGroupParameters().GetGroupPrecomputation(), y);}
+
+	/// \brief Exponentiates this element
+	/// \param exponent the exponent to raise the base
+	/// \return the public element raised to the exponent
+	virtual Element ExponentiatePublicElement(const Integer &exponent) const
+	{
+		const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+		return GetPublicPrecomputation().Exponentiate(params.GetGroupPrecomputation(), exponent);
+	}
+
+	/// \brief Exponentiates an element
+	/// \param baseExp the first exponent
+	/// \param publicExp the second exponent
+	/// \return the public element raised to the exponent
+	/// \details CascadeExponentiateBaseAndPublicElement raises the public element to
+	///  the base element and precomputation.
+	virtual Element CascadeExponentiateBaseAndPublicElement(const Integer &baseExp, const Integer &publicExp) const
+	{
+		const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+		return params.GetBasePrecomputation().CascadeExponentiate(params.GetGroupPrecomputation(), baseExp, GetPublicPrecomputation(), publicExp);
+	}
+
+	/// \brief Accesses the public precomputation
+	/// \details GetPublicPrecomputation returns a const reference, while
+	///  AccessPublicPrecomputation returns a non-const reference. Must be
+	///  overridden in derived classes.
+	virtual const DL_FixedBasePrecomputation<T> & GetPublicPrecomputation() const =0;
+
+	/// \brief Accesses the public precomputation
+	/// \details GetPublicPrecomputation returns a const reference, while
+	///  AccessPublicPrecomputation returns a non-const reference. Must be
+	///  overridden in derived classes.
+	virtual DL_FixedBasePrecomputation<T> & AccessPublicPrecomputation() =0;
+};
+
+// Out-of-line dtor due to AIX and GCC, http://github.com/weidai11/cryptopp/issues/499
+template<class T>
+DL_PublicKey<T>::~DL_PublicKey() {}
+
+/// \brief Interface for Discrete Log (DL) private keys
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_PrivateKey : public DL_Key<T>
+{
+	typedef DL_PrivateKey<T> ThisClass;
+
+public:
+	typedef T Element;
+
+	virtual ~DL_PrivateKey();
+
+	/// \brief Initializes a public key from this key
+	/// \param pub reference to a public key
+	void MakePublicKey(DL_PublicKey<T> &pub) const
+	{
+		pub.AccessAbstractGroupParameters().AssignFrom(this->GetAbstractGroupParameters());
+		pub.SetPublicElement(this->GetAbstractGroupParameters().ExponentiateBase(GetPrivateExponent()));
+	}
+
+	/// \brief Get a named value
+	/// \param name the name of the object or value to retrieve
+	/// \param valueType reference to a variable that receives the value
+	/// \param pValue void pointer to a variable that receives the value
+	/// \return true if the value was retrieved, false otherwise
+	/// \details GetVoidValue() retrieves the value of name if it exists.
+	/// \note GetVoidValue() is an internal function and should be implemented
+	///  by derived classes. Users should use one of the other functions instead.
+	/// \sa GetValue(), GetValueWithDefault(), GetIntValue(), GetIntValueWithDefault(),
+	///  GetRequiredParameter() and GetRequiredIntParameter()
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+	{
+		return GetValueHelper(this, name, valueType, pValue, &this->GetAbstractGroupParameters())
+				CRYPTOPP_GET_FUNCTION_ENTRY(PrivateExponent);
+	}
+
+	/// \brief Initialize or reinitialize this key
+	/// \param source NameValuePairs to assign
+	void AssignFrom(const NameValuePairs &source)
+	{
+		this->AccessAbstractGroupParameters().AssignFrom(source);
+		AssignFromHelper(this, source)
+			CRYPTOPP_SET_FUNCTION_ENTRY(PrivateExponent);
+	}
+
+	/// \brief Retrieves the private exponent
+	/// \return the private exponent
+	/// \details Must be overridden in derived classes.
+	virtual const Integer & GetPrivateExponent() const =0;
+	/// \brief Sets the private exponent
+	/// \param x the private exponent
+	/// \details Must be overridden in derived classes.
+	virtual void SetPrivateExponent(const Integer &x) =0;
+};
+
+// Out-of-line dtor due to AIX and GCC, http://github.com/weidai11/cryptopp/issues/499
+template<class T>
+DL_PrivateKey<T>::~DL_PrivateKey() {}
+
+template <class T>
+void DL_PublicKey<T>::AssignFrom(const NameValuePairs &source)
+{
+	DL_PrivateKey<T> *pPrivateKey = NULLPTR;
+	if (source.GetThisPointer(pPrivateKey))
+		pPrivateKey->MakePublicKey(*this);
+	else
+	{
+		this->AccessAbstractGroupParameters().AssignFrom(source);
+		AssignFromHelper(this, source)
+			CRYPTOPP_SET_FUNCTION_ENTRY(PublicElement);
+	}
+}
+
+class OID;
+
+/// \brief Discrete Log (DL) key base implementation
+/// \tparam PK Key class
+/// \tparam GP GroupParameters class
+/// \tparam O OID class
+template <class PK, class GP, class O = OID>
+class DL_KeyImpl : public PK
+{
+public:
+	typedef GP GroupParameters;
+
+	virtual ~DL_KeyImpl() {}
+
+	O GetAlgorithmID() const {return GetGroupParameters().GetAlgorithmID();}
+	bool BERDecodeAlgorithmParameters(BufferedTransformation &bt)
+		{AccessGroupParameters().BERDecode(bt); return true;}
+	bool DEREncodeAlgorithmParameters(BufferedTransformation &bt) const
+		{GetGroupParameters().DEREncode(bt); return true;}
+
+	const GP & GetGroupParameters() const {return m_groupParameters;}
+	GP & AccessGroupParameters() {return m_groupParameters;}
+
+private:
+	GP m_groupParameters;
+};
+
+class X509PublicKey;
+class PKCS8PrivateKey;
+
+/// \brief Discrete Log (DL) private key base implementation
+/// \tparam GP GroupParameters class
+template <class GP>
+class DL_PrivateKeyImpl : public DL_PrivateKey<typename GP::Element>, public DL_KeyImpl<PKCS8PrivateKey, GP>
+{
+public:
+	typedef typename GP::Element Element;
+
+	virtual ~DL_PrivateKeyImpl() {}
+
+	// GeneratableCryptoMaterial
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const
+	{
+		CRYPTOPP_ASSERT(GetAbstractGroupParameters().Validate(rng, level));
+		bool pass = GetAbstractGroupParameters().Validate(rng, level);
+
+		const Integer &q = GetAbstractGroupParameters().GetSubgroupOrder();
+		const Integer &x = GetPrivateExponent();
+
+		CRYPTOPP_ASSERT(x.IsPositive());
+		CRYPTOPP_ASSERT(x < q);
+		pass = pass && x.IsPositive() && x < q;
+
+		if (level >= 1)
+		{
+			CRYPTOPP_ASSERT(Integer::Gcd(x, q) == Integer::One());
+			pass = pass && Integer::Gcd(x, q) == Integer::One();
+		}
+		return pass;
+	}
+
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+	{
+		return GetValueHelper<DL_PrivateKey<Element> >(this, name, valueType, pValue).Assignable();
+	}
+
+	void AssignFrom(const NameValuePairs &source)
+	{
+		AssignFromHelper<DL_PrivateKey<Element> >(this, source);
+	}
+
+	void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params)
+	{
+		if (!params.GetThisObject(this->AccessGroupParameters()))
+			this->AccessGroupParameters().GenerateRandom(rng, params);
+		Integer x(rng, Integer::One(), GetAbstractGroupParameters().GetMaxExponent());
+		SetPrivateExponent(x);
+	}
+
+	bool SupportsPrecomputation() const {return true;}
+
+	void Precompute(unsigned int precomputationStorage=16)
+		{AccessAbstractGroupParameters().Precompute(precomputationStorage);}
+
+	void LoadPrecomputation(BufferedTransformation &storedPrecomputation)
+		{AccessAbstractGroupParameters().LoadPrecomputation(storedPrecomputation);}
+
+	void SavePrecomputation(BufferedTransformation &storedPrecomputation) const
+		{GetAbstractGroupParameters().SavePrecomputation(storedPrecomputation);}
+
+	// DL_Key
+	const DL_GroupParameters<Element> & GetAbstractGroupParameters() const {return this->GetGroupParameters();}
+	DL_GroupParameters<Element> & AccessAbstractGroupParameters() {return this->AccessGroupParameters();}
+
+	// DL_PrivateKey
+	const Integer & GetPrivateExponent() const {return m_x;}
+	void SetPrivateExponent(const Integer &x) {m_x = x;}
+
+	// PKCS8PrivateKey
+	void BERDecodePrivateKey(BufferedTransformation &bt, bool, size_t)
+		{m_x.BERDecode(bt);}
+	void DEREncodePrivateKey(BufferedTransformation &bt) const
+		{m_x.DEREncode(bt);}
+
+private:
+	Integer m_x;
+};
+
+template <class BASE, class SIGNATURE_SCHEME>
+class DL_PrivateKey_WithSignaturePairwiseConsistencyTest : public BASE
+{
+public:
+	virtual ~DL_PrivateKey_WithSignaturePairwiseConsistencyTest() {}
+
+	void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params)
+	{
+		BASE::GenerateRandom(rng, params);
+
+		if (FIPS_140_2_ComplianceEnabled())
+		{
+			typename SIGNATURE_SCHEME::Signer signer(*this);
+			typename SIGNATURE_SCHEME::Verifier verifier(signer);
+			SignaturePairwiseConsistencyTest_FIPS_140_Only(signer, verifier);
+		}
+	}
+};
+
+/// \brief Discrete Log (DL) public key base implementation
+/// \tparam GP GroupParameters class
+template <class GP>
+class DL_PublicKeyImpl : public DL_PublicKey<typename GP::Element>, public DL_KeyImpl<X509PublicKey, GP>
+{
+public:
+	typedef typename GP::Element Element;
+
+	virtual ~DL_PublicKeyImpl();
+
+	// CryptoMaterial
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const
+	{
+		CRYPTOPP_ASSERT(GetAbstractGroupParameters().Validate(rng, level));
+		bool pass = GetAbstractGroupParameters().Validate(rng, level);
+		CRYPTOPP_ASSERT(GetAbstractGroupParameters().ValidateElement(level, this->GetPublicElement(), &GetPublicPrecomputation()));
+		pass = pass && GetAbstractGroupParameters().ValidateElement(level, this->GetPublicElement(), &GetPublicPrecomputation());
+		return pass;
+	}
+
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+	{
+		return GetValueHelper<DL_PublicKey<Element> >(this, name, valueType, pValue).Assignable();
+	}
+
+	void AssignFrom(const NameValuePairs &source)
+	{
+		AssignFromHelper<DL_PublicKey<Element> >(this, source);
+	}
+
+	bool SupportsPrecomputation() const {return true;}
+
+	void Precompute(unsigned int precomputationStorage=16)
+	{
+		AccessAbstractGroupParameters().Precompute(precomputationStorage);
+		AccessPublicPrecomputation().Precompute(GetAbstractGroupParameters().GetGroupPrecomputation(), GetAbstractGroupParameters().GetSubgroupOrder().BitCount(), precomputationStorage);
+	}
+
+	void LoadPrecomputation(BufferedTransformation &storedPrecomputation)
+	{
+		AccessAbstractGroupParameters().LoadPrecomputation(storedPrecomputation);
+		AccessPublicPrecomputation().Load(GetAbstractGroupParameters().GetGroupPrecomputation(), storedPrecomputation);
+	}
+
+	void SavePrecomputation(BufferedTransformation &storedPrecomputation) const
+	{
+		GetAbstractGroupParameters().SavePrecomputation(storedPrecomputation);
+		GetPublicPrecomputation().Save(GetAbstractGroupParameters().GetGroupPrecomputation(), storedPrecomputation);
+	}
+
+	// DL_Key
+	const DL_GroupParameters<Element> & GetAbstractGroupParameters() const {return this->GetGroupParameters();}
+	DL_GroupParameters<Element> & AccessAbstractGroupParameters() {return this->AccessGroupParameters();}
+
+	// DL_PublicKey
+	const DL_FixedBasePrecomputation<Element> & GetPublicPrecomputation() const {return m_ypc;}
+	DL_FixedBasePrecomputation<Element> & AccessPublicPrecomputation() {return m_ypc;}
+
+	// non-inherited
+	bool operator==(const DL_PublicKeyImpl<GP> &rhs) const
+		{return this->GetGroupParameters() == rhs.GetGroupParameters() && this->GetPublicElement() == rhs.GetPublicElement();}
+
+private:
+	typename GP::BasePrecomputation m_ypc;
+};
+
+// Out-of-line dtor due to AIX and GCC, http://github.com/weidai11/cryptopp/issues/499
+template<class GP>
+DL_PublicKeyImpl<GP>::~DL_PublicKeyImpl() {}
+
+/// \brief Interface for Elgamal-like signature algorithms
+/// \tparam T Field element type or class
+/// \details Field element <tt>T</tt> can be Integer, ECP or EC2N.
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_ElgamalLikeSignatureAlgorithm
+{
+public:
+	virtual ~DL_ElgamalLikeSignatureAlgorithm() {}
+
+	/// \brief Sign a message using a private key
+	/// \param params GroupParameters
+	/// \param privateKey private key
+	/// \param k signing exponent
+	/// \param e encoded message
+	/// \param r r part of signature
+	/// \param s s part of signature
+	virtual void Sign(const DL_GroupParameters<T> &params, const Integer &privateKey, const Integer &k, const Integer &e, Integer &r, Integer &s) const =0;
+
+	/// \brief Verify a message using a public key
+	/// \param params GroupParameters
+	/// \param publicKey public key
+	/// \param e encoded message
+	/// \param r r part of signature
+	/// \param s s part of signature
+	virtual bool Verify(const DL_GroupParameters<T> &params, const DL_PublicKey<T> &publicKey, const Integer &e, const Integer &r, const Integer &s) const =0;
+
+	/// \brief Recover a Presignature
+	/// \param params GroupParameters
+	/// \param publicKey public key
+	/// \param r r part of signature
+	/// \param s s part of signature
+	virtual Integer RecoverPresignature(const DL_GroupParameters<T> &params, const DL_PublicKey<T> &publicKey, const Integer &r, const Integer &s) const
+	{
+		CRYPTOPP_UNUSED(params); CRYPTOPP_UNUSED(publicKey); CRYPTOPP_UNUSED(r); CRYPTOPP_UNUSED(s);
+		throw NotImplemented("DL_ElgamalLikeSignatureAlgorithm: this signature scheme does not support message recovery");
+		MAYBE_RETURN(Integer::Zero());
+	}
+
+	/// \brief Retrieve R length
+	/// \param params GroupParameters
+	virtual size_t RLen(const DL_GroupParameters<T> &params) const
+		{return params.GetSubgroupOrder().ByteCount();}
+
+	/// \brief Retrieve S length
+	/// \param params GroupParameters
+	virtual size_t SLen(const DL_GroupParameters<T> &params) const
+		{return params.GetSubgroupOrder().ByteCount();}
+
+	/// \brief Signature scheme flag
+	/// \return true if the signature scheme is deterministic, false otherwise
+	/// \details IsDeterministic() is provided for DL signers. It is used by RFC 6979 signature schemes.
+	virtual bool IsDeterministic() const
+		{return false;}
+};
+
+/// \brief Interface for deterministic signers
+/// \details RFC 6979 signers which generate k based on the encoded message and private key
+class CRYPTOPP_NO_VTABLE DeterministicSignatureAlgorithm
+{
+public:
+	virtual ~DeterministicSignatureAlgorithm() {}
+
+	/// \brief Generate k
+	/// \param x private key
+	/// \param q subgroup generator
+	/// \param e encoded message
+	virtual Integer GenerateRandom(const Integer &x, const Integer &q, const Integer &e) const =0;
+};
+
+/// \brief Interface for DL key agreement algorithms
+/// \tparam T Field element type or class
+/// \details Field element <tt>T</tt> can be Integer, ECP or EC2N.
+/// \sa DLIES, ECIES, ECIES_P1363
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_KeyAgreementAlgorithm
+{
+public:
+	typedef T Element;
+
+	virtual ~DL_KeyAgreementAlgorithm() {}
+
+	virtual Element AgreeWithEphemeralPrivateKey(const DL_GroupParameters<Element> &params, const DL_FixedBasePrecomputation<Element> &publicPrecomputation, const Integer &privateExponent) const =0;
+	virtual Element AgreeWithStaticPrivateKey(const DL_GroupParameters<Element> &params, const Element &publicElement, bool validateOtherPublicKey, const Integer &privateExponent) const =0;
+};
+
+/// \brief Interface for key derivation algorithms used in DL cryptosystems
+/// \tparam T Field element type or class
+/// \details Field element <tt>T</tt> can be Integer, ECP or EC2N.
+/// \sa DLIES, ECIES, ECIES_P1363
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_KeyDerivationAlgorithm
+{
+public:
+	virtual ~DL_KeyDerivationAlgorithm() {}
+
+	virtual bool ParameterSupported(const char *name) const
+		{CRYPTOPP_UNUSED(name); return false;}
+	virtual void Derive(const DL_GroupParameters<T> &groupParams, byte *derivedKey, size_t derivedLength, const T &agreedElement, const T &ephemeralPublicKey, const NameValuePairs &derivationParams) const =0;
+};
+
+/// \brief Interface for symmetric encryption algorithms used in DL cryptosystems
+/// \sa DLIES, ECIES, ECIES_P1363
+class CRYPTOPP_NO_VTABLE DL_SymmetricEncryptionAlgorithm
+{
+public:
+	virtual ~DL_SymmetricEncryptionAlgorithm() {}
+
+	virtual bool ParameterSupported(const char *name) const
+		{CRYPTOPP_UNUSED(name); return false;}
+	virtual size_t GetSymmetricKeyLength(size_t plaintextLength) const =0;
+	virtual size_t GetSymmetricCiphertextLength(size_t plaintextLength) const =0;
+	virtual size_t GetMaxSymmetricPlaintextLength(size_t ciphertextLength) const =0;
+	virtual void SymmetricEncrypt(RandomNumberGenerator &rng, const byte *key, const byte *plaintext, size_t plaintextLength, byte *ciphertext, const NameValuePairs &parameters) const =0;
+	virtual DecodingResult SymmetricDecrypt(const byte *key, const byte *ciphertext, size_t ciphertextLength, byte *plaintext, const NameValuePairs &parameters) const =0;
+};
+
+/// \brief Discrete Log (DL) base interface
+/// \tparam KI public or private key interface
+template <class KI>
+class CRYPTOPP_NO_VTABLE DL_Base
+{
+protected:
+	typedef KI KeyInterface;
+	typedef typename KI::Element Element;
+
+	virtual ~DL_Base() {}
+
+	const DL_GroupParameters<Element> & GetAbstractGroupParameters() const {return GetKeyInterface().GetAbstractGroupParameters();}
+	DL_GroupParameters<Element> & AccessAbstractGroupParameters() {return AccessKeyInterface().AccessAbstractGroupParameters();}
+
+	virtual KeyInterface & AccessKeyInterface() =0;
+	virtual const KeyInterface & GetKeyInterface() const =0;
+};
+
+/// \brief Discrete Log (DL) signature scheme base implementation
+/// \tparam INTFACE PK_Signer or PK_Verifier derived class
+/// \tparam KEY_INTFACE DL_Base key base used in the scheme
+/// \details DL_SignatureSchemeBase provides common functions for signers and verifiers.
+///  DL_Base<DL_PrivateKey> is used for signers, and DL_Base<DL_PublicKey> is used for verifiers.
+template <class INTFACE, class KEY_INTFACE>
+class CRYPTOPP_NO_VTABLE DL_SignatureSchemeBase : public INTFACE, public DL_Base<KEY_INTFACE>
+{
+public:
+	virtual ~DL_SignatureSchemeBase() {}
+
+	/// \brief Provides the signature length
+	/// \return signature length, in bytes
+	/// \details SignatureLength returns the size required for <tt>r+s</tt>.
+	size_t SignatureLength() const
+	{
+		return GetSignatureAlgorithm().RLen(this->GetAbstractGroupParameters())
+			+ GetSignatureAlgorithm().SLen(this->GetAbstractGroupParameters());
+	}
+
+	/// \brief Provides the maximum recoverable length
+	/// \return maximum recoverable length, in bytes
+	size_t MaxRecoverableLength() const
+		{return GetMessageEncodingInterface().MaxRecoverableLength(0, GetHashIdentifier().second, GetDigestSize());}
+
+	/// \brief Provides the maximum recoverable length
+	/// \param signatureLength the size of the signature
+	/// \return maximum recoverable length based on signature length, in bytes
+	/// \details this function is not implemented and always returns 0.
+	size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const
+		{CRYPTOPP_UNUSED(signatureLength); CRYPTOPP_ASSERT(false); return 0;}	// TODO
+
+	/// \brief Determines if the scheme is probabilistic
+	/// \return true if the scheme is probabilistic, false otherwise
+	bool IsProbabilistic() const
+		{return true;}
+
+	/// \brief Determines if the scheme has non-recoverable part
+	/// \return true if the message encoding has a non-recoverable part, false otherwise.
+	bool AllowNonrecoverablePart() const
+		{return GetMessageEncodingInterface().AllowNonrecoverablePart();}
+
+	/// \brief Determines if the scheme allows recoverable part first
+	/// \return true if the message encoding allows the recoverable part, false otherwise.
+	bool RecoverablePartFirst() const
+		{return GetMessageEncodingInterface().RecoverablePartFirst();}
+
+protected:
+	size_t MessageRepresentativeLength() const {return BitsToBytes(MessageRepresentativeBitLength());}
+	size_t MessageRepresentativeBitLength() const {return this->GetAbstractGroupParameters().GetSubgroupOrder().BitCount();}
+
+	// true if the scheme conforms to RFC 6979
+	virtual bool IsDeterministic() const {return false;}
+
+	virtual const DL_ElgamalLikeSignatureAlgorithm<typename KEY_INTFACE::Element> & GetSignatureAlgorithm() const =0;
+	virtual const PK_SignatureMessageEncodingMethod & GetMessageEncodingInterface() const =0;
+	virtual HashIdentifier GetHashIdentifier() const =0;
+	virtual size_t GetDigestSize() const =0;
+};
+
+/// \brief Discrete Log (DL) signature scheme signer base implementation
+/// \tparam T Field element type or class
+/// \details Field element <tt>T</tt> can be Integer, ECP or EC2N.
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_SignerBase : public DL_SignatureSchemeBase<PK_Signer, DL_PrivateKey<T> >
+{
+public:
+	virtual ~DL_SignerBase() {}
+
+	/// \brief Testing interface
+	/// \param k Integer
+	/// \param e Integer
+	/// \param r Integer
+	/// \param s Integer
+	void RawSign(const Integer &k, const Integer &e, Integer &r, Integer &s) const
+	{
+		const DL_ElgamalLikeSignatureAlgorithm<T> &alg = this->GetSignatureAlgorithm();
+		const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+		const DL_PrivateKey<T> &key = this->GetKeyInterface();
+
+		r = params.ConvertElementToInteger(params.ExponentiateBase(k));
+		alg.Sign(params, key.GetPrivateExponent(), k, e, r, s);
+	}
+
+	void InputRecoverableMessage(PK_MessageAccumulator &messageAccumulator, const byte *recoverableMessage, size_t recoverableMessageLength) const
+	{
+		PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+		ma.m_recoverableMessage.Assign(recoverableMessage, recoverableMessageLength);
+		this->GetMessageEncodingInterface().ProcessRecoverableMessage(ma.AccessHash(),
+			recoverableMessage, recoverableMessageLength,
+			ma.m_presignature, ma.m_presignature.size(),
+			ma.m_semisignature);
+	}
+
+	size_t SignAndRestart(RandomNumberGenerator &rng, PK_MessageAccumulator &messageAccumulator, byte *signature, bool restart) const
+	{
+		this->GetMaterial().DoQuickSanityCheck();
+
+		PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+		const DL_ElgamalLikeSignatureAlgorithm<T> &alg = this->GetSignatureAlgorithm();
+		const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+		const DL_PrivateKey<T> &key = this->GetKeyInterface();
+
+		SecByteBlock representative(this->MessageRepresentativeLength());
+		this->GetMessageEncodingInterface().ComputeMessageRepresentative(
+			rng,
+			ma.m_recoverableMessage, ma.m_recoverableMessage.size(),
+			ma.AccessHash(), this->GetHashIdentifier(), ma.m_empty,
+			representative, this->MessageRepresentativeBitLength());
+		ma.m_empty = true;
+		Integer e(representative, representative.size());
+
+		// hash message digest into random number k to prevent reusing the same k on
+		// different messages after virtual machine rollback
+		if (rng.CanIncorporateEntropy())
+			rng.IncorporateEntropy(representative, representative.size());
+
+		Integer k, ks;
+		const Integer& q = params.GetSubgroupOrder();
+		if (alg.IsDeterministic())
+		{
+			const Integer& x = key.GetPrivateExponent();
+			const DeterministicSignatureAlgorithm& det = dynamic_cast<const DeterministicSignatureAlgorithm&>(alg);
+			k = det.GenerateRandom(x, q, e);
+		}
+		else
+		{
+			k.Randomize(rng, 1, params.GetSubgroupOrder()-1);
+		}
+
+		// Due to timing attack on nonce length by Jancar
+		// https://github.com/weidai11/cryptopp/issues/869
+		ks = k + q;
+		if (ks.BitCount() == q.BitCount()) {
+			ks += q;
+		}
+
+		Integer r, s;
+		r = params.ConvertElementToInteger(params.ExponentiateBase(ks));
+		alg.Sign(params, key.GetPrivateExponent(), k, e, r, s);
+
+		/*
+		Integer r, s;
+		if (this->MaxRecoverableLength() > 0)
+			r.Decode(ma.m_semisignature, ma.m_semisignature.size());
+		else
+			r.Decode(ma.m_presignature, ma.m_presignature.size());
+		alg.Sign(params, key.GetPrivateExponent(), ma.m_k, e, r, s);
+		*/
+
+		const size_t rLen = alg.RLen(params);
+		r.Encode(signature, rLen);
+		s.Encode(signature+rLen, alg.SLen(params));
+
+		if (restart)
+			RestartMessageAccumulator(rng, ma);
+
+		return this->SignatureLength();
+	}
+
+protected:
+	void RestartMessageAccumulator(RandomNumberGenerator &rng, PK_MessageAccumulatorBase &ma) const
+	{
+		// k needs to be generated before hashing for signature schemes with recovery
+		// but to defend against VM rollbacks we need to generate k after hashing.
+		// so this code is commented out, since no DL-based signature scheme with recovery
+		// has been implemented in Crypto++ anyway
+		/*
+		const DL_ElgamalLikeSignatureAlgorithm<T> &alg = this->GetSignatureAlgorithm();
+		const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+		ma.m_k.Randomize(rng, 1, params.GetSubgroupOrder()-1);
+		ma.m_presignature.New(params.GetEncodedElementSize(false));
+		params.ConvertElementToInteger(params.ExponentiateBase(ma.m_k)).Encode(ma.m_presignature, ma.m_presignature.size());
+		*/
+		CRYPTOPP_UNUSED(rng); CRYPTOPP_UNUSED(ma);
+	}
+};
+
+/// \brief Discret Log (DL) Verifier base class
+/// \tparam T Field element type or class
+/// \details Field element <tt>T</tt> can be Integer, ECP or EC2N.
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_VerifierBase : public DL_SignatureSchemeBase<PK_Verifier, DL_PublicKey<T> >
+{
+public:
+	virtual ~DL_VerifierBase() {}
+
+	void InputSignature(PK_MessageAccumulator &messageAccumulator, const byte *signature, size_t signatureLength) const
+	{
+		PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+		const DL_ElgamalLikeSignatureAlgorithm<T> &alg = this->GetSignatureAlgorithm();
+		const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+
+		// Validation due to https://github.com/weidai11/cryptopp/issues/981
+		// We allow a caller to provide R and S in oversized buffer. R and S
+		// are read based on the field element size, and not the buffer size.
+		const size_t rLen = alg.RLen(params);
+		const size_t sLen = alg.SLen(params);
+		CRYPTOPP_ASSERT(signatureLength >= rLen + sLen);
+		if (signatureLength < rLen + sLen)
+			throw InvalidDataFormat("DL_VerifierBase: signature length is not valid.");
+
+		ma.m_semisignature.Assign(signature, rLen);
+		ma.m_s.Decode(signature+rLen, sLen);
+
+		this->GetMessageEncodingInterface().ProcessSemisignature(ma.AccessHash(), ma.m_semisignature, ma.m_semisignature.size());
+	}
+
+	bool VerifyAndRestart(PK_MessageAccumulator &messageAccumulator) const
+	{
+		this->GetMaterial().DoQuickSanityCheck();
+
+		PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+		const DL_ElgamalLikeSignatureAlgorithm<T> &alg = this->GetSignatureAlgorithm();
+		const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+		const DL_PublicKey<T> &key = this->GetKeyInterface();
+
+		SecByteBlock representative(this->MessageRepresentativeLength());
+		this->GetMessageEncodingInterface().ComputeMessageRepresentative(NullRNG(), ma.m_recoverableMessage, ma.m_recoverableMessage.size(),
+			ma.AccessHash(), this->GetHashIdentifier(), ma.m_empty,
+			representative, this->MessageRepresentativeBitLength());
+		ma.m_empty = true;
+		Integer e(representative, representative.size());
+
+		Integer r(ma.m_semisignature, ma.m_semisignature.size());
+		return alg.Verify(params, key, e, r, ma.m_s);
+	}
+
+	DecodingResult RecoverAndRestart(byte *recoveredMessage, PK_MessageAccumulator &messageAccumulator) const
+	{
+		this->GetMaterial().DoQuickSanityCheck();
+
+		PK_MessageAccumulatorBase &ma = static_cast<PK_MessageAccumulatorBase &>(messageAccumulator);
+		const DL_ElgamalLikeSignatureAlgorithm<T> &alg = this->GetSignatureAlgorithm();
+		const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+		const DL_PublicKey<T> &key = this->GetKeyInterface();
+
+		SecByteBlock representative(this->MessageRepresentativeLength());
+		this->GetMessageEncodingInterface().ComputeMessageRepresentative(
+			NullRNG(),
+			ma.m_recoverableMessage, ma.m_recoverableMessage.size(),
+			ma.AccessHash(), this->GetHashIdentifier(), ma.m_empty,
+			representative, this->MessageRepresentativeBitLength());
+		ma.m_empty = true;
+		Integer e(representative, representative.size());
+
+		ma.m_presignature.New(params.GetEncodedElementSize(false));
+		Integer r(ma.m_semisignature, ma.m_semisignature.size());
+		alg.RecoverPresignature(params, key, r, ma.m_s).Encode(ma.m_presignature, ma.m_presignature.size());
+
+		return this->GetMessageEncodingInterface().RecoverMessageFromSemisignature(
+			ma.AccessHash(), this->GetHashIdentifier(),
+			ma.m_presignature, ma.m_presignature.size(),
+			ma.m_semisignature, ma.m_semisignature.size(),
+			recoveredMessage);
+	}
+};
+
+/// \brief Discrete Log (DL) cryptosystem base implementation
+/// \tparam PK field element type
+/// \tparam KI public or private key interface
+template <class PK, class KI>
+class CRYPTOPP_NO_VTABLE DL_CryptoSystemBase : public PK, public DL_Base<KI>
+{
+public:
+	typedef typename DL_Base<KI>::Element Element;
+
+	virtual ~DL_CryptoSystemBase() {}
+
+	size_t MaxPlaintextLength(size_t ciphertextLength) const
+	{
+		unsigned int minLen = this->GetAbstractGroupParameters().GetEncodedElementSize(true);
+		return ciphertextLength < minLen ? 0 : GetSymmetricEncryptionAlgorithm().GetMaxSymmetricPlaintextLength(ciphertextLength - minLen);
+	}
+
+	size_t CiphertextLength(size_t plaintextLength) const
+	{
+		size_t len = GetSymmetricEncryptionAlgorithm().GetSymmetricCiphertextLength(plaintextLength);
+		return len == 0 ? 0 : this->GetAbstractGroupParameters().GetEncodedElementSize(true) + len;
+	}
+
+	bool ParameterSupported(const char *name) const
+		{return GetKeyDerivationAlgorithm().ParameterSupported(name) || GetSymmetricEncryptionAlgorithm().ParameterSupported(name);}
+
+protected:
+	virtual const DL_KeyAgreementAlgorithm<Element> & GetKeyAgreementAlgorithm() const =0;
+	virtual const DL_KeyDerivationAlgorithm<Element> & GetKeyDerivationAlgorithm() const =0;
+	virtual const DL_SymmetricEncryptionAlgorithm & GetSymmetricEncryptionAlgorithm() const =0;
+};
+
+/// \brief Discrete Log (DL) decryptor base implementation
+/// \tparam T Field element type or class
+/// \details Field element <tt>T</tt> can be Integer, ECP or EC2N.
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_DecryptorBase : public DL_CryptoSystemBase<PK_Decryptor, DL_PrivateKey<T> >
+{
+public:
+	typedef T Element;
+
+	virtual ~DL_DecryptorBase() {}
+
+	DecodingResult Decrypt(RandomNumberGenerator &rng, const byte *ciphertext, size_t ciphertextLength, byte *plaintext, const NameValuePairs &parameters = g_nullNameValuePairs) const
+	{
+		try
+		{
+			CRYPTOPP_UNUSED(rng);
+			const DL_KeyAgreementAlgorithm<T> &agreeAlg = this->GetKeyAgreementAlgorithm();
+			const DL_KeyDerivationAlgorithm<T> &derivAlg = this->GetKeyDerivationAlgorithm();
+			const DL_SymmetricEncryptionAlgorithm &encAlg = this->GetSymmetricEncryptionAlgorithm();
+			const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+			const DL_PrivateKey<T> &key = this->GetKeyInterface();
+
+			Element q = params.DecodeElement(ciphertext, true);
+			size_t elementSize = params.GetEncodedElementSize(true);
+			ciphertext += elementSize;
+			ciphertextLength -= elementSize;
+
+			Element z = agreeAlg.AgreeWithStaticPrivateKey(params, q, true, key.GetPrivateExponent());
+
+			SecByteBlock derivedKey(encAlg.GetSymmetricKeyLength(encAlg.GetMaxSymmetricPlaintextLength(ciphertextLength)));
+			derivAlg.Derive(params, derivedKey, derivedKey.size(), z, q, parameters);
+
+			return encAlg.SymmetricDecrypt(derivedKey, ciphertext, ciphertextLength, plaintext, parameters);
+		}
+		catch (DL_BadElement &)
+		{
+			return DecodingResult();
+		}
+	}
+};
+
+/// \brief Discrete Log (DL) encryptor base implementation
+/// \tparam T Field element type or class
+/// \details Field element <tt>T</tt> can be Integer, ECP or EC2N.
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_EncryptorBase : public DL_CryptoSystemBase<PK_Encryptor, DL_PublicKey<T> >
+{
+public:
+	typedef T Element;
+
+	virtual ~DL_EncryptorBase() {}
+
+	void Encrypt(RandomNumberGenerator &rng, const byte *plaintext, size_t plaintextLength, byte *ciphertext, const NameValuePairs &parameters = g_nullNameValuePairs) const
+	{
+		const DL_KeyAgreementAlgorithm<T> &agreeAlg = this->GetKeyAgreementAlgorithm();
+		const DL_KeyDerivationAlgorithm<T> &derivAlg = this->GetKeyDerivationAlgorithm();
+		const DL_SymmetricEncryptionAlgorithm &encAlg = this->GetSymmetricEncryptionAlgorithm();
+		const DL_GroupParameters<T> &params = this->GetAbstractGroupParameters();
+		const DL_PublicKey<T> &key = this->GetKeyInterface();
+
+		Integer x(rng, Integer::One(), params.GetMaxExponent());
+		Element q = params.ExponentiateBase(x);
+		params.EncodeElement(true, q, ciphertext);
+		unsigned int elementSize = params.GetEncodedElementSize(true);
+		ciphertext += elementSize;
+
+		Element z = agreeAlg.AgreeWithEphemeralPrivateKey(params, key.GetPublicPrecomputation(), x);
+
+		SecByteBlock derivedKey(encAlg.GetSymmetricKeyLength(plaintextLength));
+		derivAlg.Derive(params, derivedKey, derivedKey.size(), z, q, parameters);
+
+		encAlg.SymmetricEncrypt(rng, derivedKey, plaintext, plaintextLength, ciphertext, parameters);
+	}
+};
+
+/// \brief Discrete Log (DL) scheme options
+/// \tparam T1 algorithm information
+/// \tparam T2 group parameters for the scheme
+template <class T1, class T2>
+struct DL_SchemeOptionsBase
+{
+	typedef T1 AlgorithmInfo;
+	typedef T2 GroupParameters;
+	typedef typename GroupParameters::Element Element;
+};
+
+/// \brief Discrete Log (DL) key options
+/// \tparam T1 algorithm information
+/// \tparam T2 keys used in the scheme
+template <class T1, class T2>
+struct DL_KeyedSchemeOptions : public DL_SchemeOptionsBase<T1, typename T2::PublicKey::GroupParameters>
+{
+	typedef T2 Keys;
+	typedef typename Keys::PrivateKey PrivateKey;
+	typedef typename Keys::PublicKey PublicKey;
+};
+
+/// \brief Discrete Log (DL) signature scheme options
+/// \tparam T1 algorithm information
+/// \tparam T2 keys used in the scheme
+/// \tparam T3 signature algorithm
+/// \tparam T4 message encoding method
+/// \tparam T5 hash function
+template <class T1, class T2, class T3, class T4, class T5>
+struct DL_SignatureSchemeOptions : public DL_KeyedSchemeOptions<T1, T2>
+{
+	typedef T3 SignatureAlgorithm;
+	typedef T4 MessageEncodingMethod;
+	typedef T5 HashFunction;
+};
+
+/// \brief Discrete Log (DL) crypto scheme options
+/// \tparam T1 algorithm information
+/// \tparam T2 keys used in the scheme
+/// \tparam T3 key agreement algorithm
+/// \tparam T4 key derivation algorithm
+/// \tparam T5 symmetric encryption algorithm
+template <class T1, class T2, class T3, class T4, class T5>
+struct DL_CryptoSchemeOptions : public DL_KeyedSchemeOptions<T1, T2>
+{
+	typedef T3 KeyAgreementAlgorithm;
+	typedef T4 KeyDerivationAlgorithm;
+	typedef T5 SymmetricEncryptionAlgorithm;
+};
+
+/// \brief Discrete Log (DL) base object implementation
+/// \tparam BASE TODO
+/// \tparam SCHEME_OPTIONS options for the scheme
+/// \tparam KEY key used in the scheme
+template <class BASE, class SCHEME_OPTIONS, class KEY>
+class CRYPTOPP_NO_VTABLE DL_ObjectImplBase : public AlgorithmImpl<BASE, typename SCHEME_OPTIONS::AlgorithmInfo>
+{
+public:
+	typedef SCHEME_OPTIONS SchemeOptions;
+	typedef typename KEY::Element Element;
+
+	virtual ~DL_ObjectImplBase() {}
+
+	PrivateKey & AccessPrivateKey() {return m_key;}
+	PublicKey & AccessPublicKey() {return m_key;}
+
+	// KeyAccessor
+	const KEY & GetKey() const {return m_key;}
+	KEY & AccessKey() {return m_key;}
+
+protected:
+	typename BASE::KeyInterface & AccessKeyInterface() {return m_key;}
+	const typename BASE::KeyInterface & GetKeyInterface() const {return m_key;}
+
+	// for signature scheme
+	HashIdentifier GetHashIdentifier() const
+	{
+		typedef typename SchemeOptions::MessageEncodingMethod::HashIdentifierLookup HashLookup;
+		return HashLookup::template HashIdentifierLookup2<typename SchemeOptions::HashFunction>::Lookup();
+	}
+	size_t GetDigestSize() const
+	{
+		typedef typename SchemeOptions::HashFunction H;
+		return H::DIGESTSIZE;
+	}
+
+private:
+	KEY m_key;
+};
+
+/// \brief Discrete Log (DL) object implementation
+/// \tparam BASE TODO
+/// \tparam SCHEME_OPTIONS options for the scheme
+/// \tparam KEY key used in the scheme
+template <class BASE, class SCHEME_OPTIONS, class KEY>
+class CRYPTOPP_NO_VTABLE DL_ObjectImpl : public DL_ObjectImplBase<BASE, SCHEME_OPTIONS, KEY>
+{
+public:
+	typedef typename KEY::Element Element;
+
+	virtual ~DL_ObjectImpl() {}
+
+protected:
+	const DL_ElgamalLikeSignatureAlgorithm<Element> & GetSignatureAlgorithm() const
+		{return Singleton<typename SCHEME_OPTIONS::SignatureAlgorithm>().Ref();}
+	const DL_KeyAgreementAlgorithm<Element> & GetKeyAgreementAlgorithm() const
+		{return Singleton<typename SCHEME_OPTIONS::KeyAgreementAlgorithm>().Ref();}
+	const DL_KeyDerivationAlgorithm<Element> & GetKeyDerivationAlgorithm() const
+		{return Singleton<typename SCHEME_OPTIONS::KeyDerivationAlgorithm>().Ref();}
+	const DL_SymmetricEncryptionAlgorithm & GetSymmetricEncryptionAlgorithm() const
+		{return Singleton<typename SCHEME_OPTIONS::SymmetricEncryptionAlgorithm>().Ref();}
+	HashIdentifier GetHashIdentifier() const
+		{return HashIdentifier();}
+	const PK_SignatureMessageEncodingMethod & GetMessageEncodingInterface() const
+		{return Singleton<typename SCHEME_OPTIONS::MessageEncodingMethod>().Ref();}
+};
+
+/// \brief Discrete Log (DL) signer implementation
+/// \tparam SCHEME_OPTIONS options for the scheme
+template <class SCHEME_OPTIONS>
+class DL_SignerImpl : public DL_ObjectImpl<DL_SignerBase<typename SCHEME_OPTIONS::Element>, SCHEME_OPTIONS, typename SCHEME_OPTIONS::PrivateKey>
+{
+public:
+	PK_MessageAccumulator * NewSignatureAccumulator(RandomNumberGenerator &rng) const
+	{
+		member_ptr<PK_MessageAccumulatorBase> p(new PK_MessageAccumulatorImpl<typename SCHEME_OPTIONS::HashFunction>);
+		this->RestartMessageAccumulator(rng, *p);
+		return p.release();
+	}
+};
+
+/// \brief Discrete Log (DL) verifier implementation
+/// \tparam SCHEME_OPTIONS options for the scheme
+template <class SCHEME_OPTIONS>
+class DL_VerifierImpl : public DL_ObjectImpl<DL_VerifierBase<typename SCHEME_OPTIONS::Element>, SCHEME_OPTIONS, typename SCHEME_OPTIONS::PublicKey>
+{
+public:
+	PK_MessageAccumulator * NewVerificationAccumulator() const
+	{
+		return new PK_MessageAccumulatorImpl<typename SCHEME_OPTIONS::HashFunction>;
+	}
+};
+
+/// \brief Discrete Log (DL) encryptor implementation
+/// \tparam SCHEME_OPTIONS options for the scheme
+template <class SCHEME_OPTIONS>
+class DL_EncryptorImpl : public DL_ObjectImpl<DL_EncryptorBase<typename SCHEME_OPTIONS::Element>, SCHEME_OPTIONS, typename SCHEME_OPTIONS::PublicKey>
+{
+};
+
+/// \brief Discrete Log (DL) decryptor implementation
+/// \tparam SCHEME_OPTIONS options for the scheme
+template <class SCHEME_OPTIONS>
+class DL_DecryptorImpl : public DL_ObjectImpl<DL_DecryptorBase<typename SCHEME_OPTIONS::Element>, SCHEME_OPTIONS, typename SCHEME_OPTIONS::PrivateKey>
+{
+};
+
+// ********************************************************
+
+/// \brief Discrete Log (DL) simple key agreement base implementation
+/// \tparam T class or type
+template <class T>
+class CRYPTOPP_NO_VTABLE DL_SimpleKeyAgreementDomainBase : public SimpleKeyAgreementDomain
+{
+public:
+	typedef T Element;
+
+	virtual ~DL_SimpleKeyAgreementDomainBase() {}
+
+	CryptoParameters & AccessCryptoParameters() {return AccessAbstractGroupParameters();}
+	unsigned int AgreedValueLength() const {return GetAbstractGroupParameters().GetEncodedElementSize(false);}
+	unsigned int PrivateKeyLength() const {return GetAbstractGroupParameters().GetSubgroupOrder().ByteCount();}
+	unsigned int PublicKeyLength() const {return GetAbstractGroupParameters().GetEncodedElementSize(true);}
+
+	void GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+	{
+		Integer x(rng, Integer::One(), GetAbstractGroupParameters().GetMaxExponent());
+		x.Encode(privateKey, PrivateKeyLength());
+	}
+
+	void GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+	{
+		CRYPTOPP_UNUSED(rng);
+		const DL_GroupParameters<T> &params = GetAbstractGroupParameters();
+		Integer x(privateKey, PrivateKeyLength());
+		Element y = params.ExponentiateBase(x);
+		params.EncodeElement(true, y, publicKey);
+	}
+
+	bool Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey=true) const
+	{
+		try
+		{
+			const DL_GroupParameters<T> &params = GetAbstractGroupParameters();
+			Integer x(privateKey, PrivateKeyLength());
+			Element w = params.DecodeElement(otherPublicKey, validateOtherPublicKey);
+
+			Element z = GetKeyAgreementAlgorithm().AgreeWithStaticPrivateKey(
+				GetAbstractGroupParameters(), w, validateOtherPublicKey, x);
+			params.EncodeElement(false, z, agreedValue);
+		}
+		catch (DL_BadElement &)
+		{
+			return false;
+		}
+		return true;
+	}
+
+	/// \brief Retrieves a reference to the group generator
+	/// \return const reference to the group generator
+	const Element &GetGenerator() const {return GetAbstractGroupParameters().GetSubgroupGenerator();}
+
+protected:
+	virtual const DL_KeyAgreementAlgorithm<Element> & GetKeyAgreementAlgorithm() const =0;
+	virtual DL_GroupParameters<Element> & AccessAbstractGroupParameters() =0;
+	const DL_GroupParameters<Element> & GetAbstractGroupParameters() const {return const_cast<DL_SimpleKeyAgreementDomainBase<Element> *>(this)->AccessAbstractGroupParameters();}
+};
+
+/// \brief Methods for avoiding "Small-Subgroup" attacks on Diffie-Hellman Key Agreement
+/// \details Additional methods exist and include public key validation and choice of prime p.
+/// \sa <A HREF="http://tools.ietf.org/html/rfc2785">Methods for Avoiding the "Small-Subgroup" Attacks on the
+///  Diffie-Hellman Key Agreement Method for S/MIME</A>
+enum CofactorMultiplicationOption {
+	/// \brief No cofactor multiplication applied
+	NO_COFACTOR_MULTIPLICTION,
+	/// \brief Cofactor multiplication compatible with ordinary Diffie-Hellman
+	/// \details Modifies the computation of ZZ by including j (the cofactor) in the computations and is
+	///  compatible with ordinary Diffie-Hellman.
+	COMPATIBLE_COFACTOR_MULTIPLICTION,
+	/// \brief Cofactor multiplication incompatible with ordinary Diffie-Hellman
+	/// \details Modifies the computation of ZZ by including j (the cofactor) in the computations but is
+	///  not compatible with ordinary Diffie-Hellman.
+	INCOMPATIBLE_COFACTOR_MULTIPLICTION};
+
+typedef EnumToType<CofactorMultiplicationOption, NO_COFACTOR_MULTIPLICTION> NoCofactorMultiplication;
+typedef EnumToType<CofactorMultiplicationOption, COMPATIBLE_COFACTOR_MULTIPLICTION> CompatibleCofactorMultiplication;
+typedef EnumToType<CofactorMultiplicationOption, INCOMPATIBLE_COFACTOR_MULTIPLICTION> IncompatibleCofactorMultiplication;
+
+/// \brief Diffie-Hellman key agreement algorithm
+template <class ELEMENT, class COFACTOR_OPTION>
+class DL_KeyAgreementAlgorithm_DH : public DL_KeyAgreementAlgorithm<ELEMENT>
+{
+public:
+	typedef ELEMENT Element;
+
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName()
+		{return COFACTOR_OPTION::ToEnum() == INCOMPATIBLE_COFACTOR_MULTIPLICTION ? "DHC" : "DH";}
+
+	virtual ~DL_KeyAgreementAlgorithm_DH() {}
+
+	Element AgreeWithEphemeralPrivateKey(const DL_GroupParameters<Element> &params, const DL_FixedBasePrecomputation<Element> &publicPrecomputation, const Integer &privateExponent) const
+	{
+		return publicPrecomputation.Exponentiate(params.GetGroupPrecomputation(),
+			COFACTOR_OPTION::ToEnum() == INCOMPATIBLE_COFACTOR_MULTIPLICTION ? privateExponent*params.GetCofactor() : privateExponent);
+	}
+
+	Element AgreeWithStaticPrivateKey(const DL_GroupParameters<Element> &params, const Element &publicElement, bool validateOtherPublicKey, const Integer &privateExponent) const
+	{
+		if (COFACTOR_OPTION::ToEnum() == COMPATIBLE_COFACTOR_MULTIPLICTION)
+		{
+			const Integer &k = params.GetCofactor();
+			return params.ExponentiateElement(publicElement,
+				ModularArithmetic(params.GetSubgroupOrder()).Divide(privateExponent, k)*k);
+		}
+		else if (COFACTOR_OPTION::ToEnum() == INCOMPATIBLE_COFACTOR_MULTIPLICTION)
+			return params.ExponentiateElement(publicElement, privateExponent*params.GetCofactor());
+		else
+		{
+			CRYPTOPP_ASSERT(COFACTOR_OPTION::ToEnum() == NO_COFACTOR_MULTIPLICTION);
+
+			if (!validateOtherPublicKey)
+				return params.ExponentiateElement(publicElement, privateExponent);
+
+			if (params.FastSubgroupCheckAvailable())
+			{
+				if (!params.ValidateElement(2, publicElement, NULLPTR))
+					throw DL_BadElement();
+				return params.ExponentiateElement(publicElement, privateExponent);
+			}
+			else
+			{
+				const Integer e[2] = {params.GetSubgroupOrder(), privateExponent};
+				Element r[2];
+				params.SimultaneousExponentiate(r, publicElement, e, 2);
+				if (!params.IsIdentity(r[0]))
+					throw DL_BadElement();
+				return r[1];
+			}
+		}
+	}
+};
+
+// ********************************************************
+
+/// \brief Template implementing constructors for public key algorithm classes
+template <class BASE>
+class CRYPTOPP_NO_VTABLE PK_FinalTemplate : public BASE
+{
+public:
+	PK_FinalTemplate() {}
+
+	PK_FinalTemplate(const CryptoMaterial &key)
+		{this->AccessKey().AssignFrom(key);}
+
+	PK_FinalTemplate(BufferedTransformation &bt)
+		{this->AccessKey().BERDecode(bt);}
+
+	PK_FinalTemplate(const AsymmetricAlgorithm &algorithm)
+		{this->AccessKey().AssignFrom(algorithm.GetMaterial());}
+
+	PK_FinalTemplate(const Integer &v1)
+		{this->AccessKey().Initialize(v1);}
+
+	template <class T1, class T2>
+	PK_FinalTemplate(const T1 &v1, const T2 &v2)
+		{this->AccessKey().Initialize(v1, v2);}
+
+	template <class T1, class T2, class T3>
+	PK_FinalTemplate(const T1 &v1, const T2 &v2, const T3 &v3)
+		{this->AccessKey().Initialize(v1, v2, v3);}
+
+	template <class T1, class T2, class T3, class T4>
+	PK_FinalTemplate(const T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4)
+		{this->AccessKey().Initialize(v1, v2, v3, v4);}
+
+	template <class T1, class T2, class T3, class T4, class T5>
+	PK_FinalTemplate(const T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4, const T5 &v5)
+		{this->AccessKey().Initialize(v1, v2, v3, v4, v5);}
+
+	template <class T1, class T2, class T3, class T4, class T5, class T6>
+	PK_FinalTemplate(const T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4, const T5 &v5, const T6 &v6)
+		{this->AccessKey().Initialize(v1, v2, v3, v4, v5, v6);}
+
+	template <class T1, class T2, class T3, class T4, class T5, class T6, class T7>
+	PK_FinalTemplate(const T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4, const T5 &v5, const T6 &v6, const T7 &v7)
+		{this->AccessKey().Initialize(v1, v2, v3, v4, v5, v6, v7);}
+
+	template <class T1, class T2, class T3, class T4, class T5, class T6, class T7, class T8>
+	PK_FinalTemplate(const T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4, const T5 &v5, const T6 &v6, const T7 &v7, const T8 &v8)
+		{this->AccessKey().Initialize(v1, v2, v3, v4, v5, v6, v7, v8);}
+
+	template <class T1, class T2>
+	PK_FinalTemplate(T1 &v1, const T2 &v2)
+		{this->AccessKey().Initialize(v1, v2);}
+
+	template <class T1, class T2, class T3>
+	PK_FinalTemplate(T1 &v1, const T2 &v2, const T3 &v3)
+		{this->AccessKey().Initialize(v1, v2, v3);}
+
+	template <class T1, class T2, class T3, class T4>
+	PK_FinalTemplate(T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4)
+		{this->AccessKey().Initialize(v1, v2, v3, v4);}
+
+	template <class T1, class T2, class T3, class T4, class T5>
+	PK_FinalTemplate(T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4, const T5 &v5)
+		{this->AccessKey().Initialize(v1, v2, v3, v4, v5);}
+
+	template <class T1, class T2, class T3, class T4, class T5, class T6>
+	PK_FinalTemplate(T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4, const T5 &v5, const T6 &v6)
+		{this->AccessKey().Initialize(v1, v2, v3, v4, v5, v6);}
+
+	template <class T1, class T2, class T3, class T4, class T5, class T6, class T7>
+	PK_FinalTemplate(T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4, const T5 &v5, const T6 &v6, const T7 &v7)
+		{this->AccessKey().Initialize(v1, v2, v3, v4, v5, v6, v7);}
+
+	template <class T1, class T2, class T3, class T4, class T5, class T6, class T7, class T8>
+	PK_FinalTemplate(T1 &v1, const T2 &v2, const T3 &v3, const T4 &v4, const T5 &v5, const T6 &v6, const T7 &v7, const T8 &v8)
+		{this->AccessKey().Initialize(v1, v2, v3, v4, v5, v6, v7, v8);}
+};
+
+/// \brief Base class for public key encryption standard classes.
+/// \details These classes are used to select from variants of algorithms.
+///  Not all standards apply to all algorithms.
+struct EncryptionStandard {};
+
+/// \brief Base class for public key signature standard classes.
+/// \details These classes are used to select from variants of algorithms.
+///  Not all standards apply to all algorithms.
+struct SignatureStandard {};
+
+/// \brief Trapdoor Function (TF) encryption scheme
+/// \tparam STANDARD standard
+/// \tparam KEYS keys used in the encryption scheme
+/// \tparam ALG_INFO algorithm information
+template <class KEYS, class STANDARD, class ALG_INFO>
+class TF_ES;
+
+template <class KEYS, class STANDARD, class ALG_INFO = TF_ES<KEYS, STANDARD, int> >
+class TF_ES : public KEYS
+{
+	typedef typename STANDARD::EncryptionMessageEncodingMethod MessageEncodingMethod;
+
+public:
+	/// see EncryptionStandard for a list of standards
+	typedef STANDARD Standard;
+	typedef TF_CryptoSchemeOptions<ALG_INFO, KEYS, MessageEncodingMethod> SchemeOptions;
+
+	static std::string CRYPTOPP_API StaticAlgorithmName() {return std::string(KEYS::StaticAlgorithmName()) + "/" + MessageEncodingMethod::StaticAlgorithmName();}
+
+	/// implements PK_Decryptor interface
+	typedef PK_FinalTemplate<TF_DecryptorImpl<SchemeOptions> > Decryptor;
+	/// implements PK_Encryptor interface
+	typedef PK_FinalTemplate<TF_EncryptorImpl<SchemeOptions> > Encryptor;
+};
+
+/// \brief Trapdoor Function (TF) Signature Scheme
+/// \tparam STANDARD standard
+/// \tparam H hash function
+/// \tparam KEYS keys used in the signature scheme
+/// \tparam ALG_INFO algorithm information
+template <class KEYS, class STANDARD, class H, class ALG_INFO>
+class TF_SS;
+
+template <class KEYS, class STANDARD, class H, class ALG_INFO = TF_SS<KEYS, STANDARD, H, int> >
+class TF_SS : public KEYS
+{
+public:
+	/// see SignatureStandard for a list of standards
+	typedef STANDARD Standard;
+	typedef typename Standard::SignatureMessageEncodingMethod MessageEncodingMethod;
+	typedef TF_SignatureSchemeOptions<ALG_INFO, KEYS, MessageEncodingMethod, H> SchemeOptions;
+
+	static std::string CRYPTOPP_API StaticAlgorithmName() {return std::string(KEYS::StaticAlgorithmName()) + "/" + MessageEncodingMethod::StaticAlgorithmName() + "(" + H::StaticAlgorithmName() + ")";}
+
+	/// implements PK_Signer interface
+	typedef PK_FinalTemplate<TF_SignerImpl<SchemeOptions> > Signer;
+	/// implements PK_Verifier interface
+	typedef PK_FinalTemplate<TF_VerifierImpl<SchemeOptions> > Verifier;
+};
+
+/// \brief Discrete Log (DL) signature scheme
+/// \tparam KEYS keys used in the signature scheme
+/// \tparam SA signature algorithm
+/// \tparam MEM message encoding method
+/// \tparam H hash function
+/// \tparam ALG_INFO algorithm information
+template <class KEYS, class SA, class MEM, class H, class ALG_INFO>
+class DL_SS;
+
+template <class KEYS, class SA, class MEM, class H, class ALG_INFO = DL_SS<KEYS, SA, MEM, H, int> >
+class DL_SS : public KEYS
+{
+	typedef DL_SignatureSchemeOptions<ALG_INFO, KEYS, SA, MEM, H> SchemeOptions;
+
+public:
+	static std::string StaticAlgorithmName() {return SA::StaticAlgorithmName() + std::string("/EMSA1(") + H::StaticAlgorithmName() + ")";}
+
+	/// implements PK_Signer interface
+	typedef PK_FinalTemplate<DL_SignerImpl<SchemeOptions> > Signer;
+	/// implements PK_Verifier interface
+	typedef PK_FinalTemplate<DL_VerifierImpl<SchemeOptions> > Verifier;
+};
+
+/// \brief Discrete Log (DL) encryption scheme
+/// \tparam KEYS keys used in the encryption scheme
+/// \tparam AA key agreement algorithm
+/// \tparam DA key derivation algorithm
+/// \tparam EA encryption algorithm
+/// \tparam ALG_INFO algorithm information
+template <class KEYS, class AA, class DA, class EA, class ALG_INFO>
+class DL_ES : public KEYS
+{
+	typedef DL_CryptoSchemeOptions<ALG_INFO, KEYS, AA, DA, EA> SchemeOptions;
+
+public:
+	/// implements PK_Decryptor interface
+	typedef PK_FinalTemplate<DL_DecryptorImpl<SchemeOptions> > Decryptor;
+	/// implements PK_Encryptor interface
+	typedef PK_FinalTemplate<DL_EncryptorImpl<SchemeOptions> > Encryptor;
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/pwdbased.h b/runtime/third_party/cryptopp/pwdbased.h
new file mode 100644
index 0000000..49cf53c
--- /dev/null
+++ b/runtime/third_party/cryptopp/pwdbased.h
@@ -0,0 +1,481 @@
+// pwdbased.h - originally written and placed in the public domain by Wei Dai
+//              Cutover to KeyDerivationFunction interface by Uri Blumenthal
+//              Marcel Raad and Jeffrey Walton in March 2018.
+
+/// \file pwdbased.h
+/// \brief Password based key derivation functions
+
+#ifndef CRYPTOPP_PWDBASED_H
+#define CRYPTOPP_PWDBASED_H
+
+#include "cryptlib.h"
+#include "hrtimer.h"
+#include "integer.h"
+#include "argnames.h"
+#include "algparam.h"
+#include "hmac.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ******************** PBKDF1 ********************
+
+/// \brief PBKDF1 from PKCS #5
+/// \tparam T a HashTransformation class
+/// \sa PasswordBasedKeyDerivationFunction, <A
+///  HREF="https://www.cryptopp.com/wiki/PKCS5_PBKDF1">PKCS5_PBKDF1</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 2.0
+template <class T>
+class PKCS5_PBKDF1 : public PasswordBasedKeyDerivationFunction
+{
+public:
+	virtual ~PKCS5_PBKDF1() {}
+
+	static std::string StaticAlgorithmName () {
+		const std::string name(std::string("PBKDF1(") +
+			std::string(T::StaticAlgorithmName()) + std::string(")"));
+		return name;
+	}
+
+	// KeyDerivationFunction interface
+	std::string AlgorithmName() const {
+		return StaticAlgorithmName();
+	}
+
+	// KeyDerivationFunction interface
+	size_t MaxDerivedKeyLength() const {
+		return static_cast<size_t>(T::DIGESTSIZE);
+	}
+
+	// KeyDerivationFunction interface
+	size_t GetValidDerivedLength(size_t keylength) const;
+
+	// KeyDerivationFunction interface
+	virtual size_t DeriveKey(byte *derived, size_t derivedLen, const byte *secret, size_t secretLen,
+		const NameValuePairs& params = g_nullNameValuePairs) const;
+
+	/// \brief Derive a key from a secret seed
+	/// \param derived the derived output buffer
+	/// \param derivedLen the size of the derived buffer, in bytes
+	/// \param purpose a purpose byte
+	/// \param secret the seed input buffer
+	/// \param secretLen the size of the secret buffer, in bytes
+	/// \param salt the salt input buffer
+	/// \param saltLen the size of the salt buffer, in bytes
+	/// \param iterations the number of iterations
+	/// \param timeInSeconds the in seconds
+	/// \return the number of iterations performed
+	/// \throw InvalidDerivedKeyLength if <tt>derivedLen</tt> is invalid for the scheme
+	/// \details DeriveKey() provides a standard interface to derive a key from
+	///   a seed and other parameters. Each class that derives from KeyDerivationFunction
+	///   provides an overload that accepts most parameters used by the derivation function.
+	/// \details If <tt>timeInSeconds</tt> is <tt>&gt; 0.0</tt> then DeriveKey will run for
+	///   the specified amount of time. If <tt>timeInSeconds</tt> is <tt>0.0</tt> then DeriveKey
+	///   will run for the specified number of iterations.
+	/// \details PKCS #5 says PBKDF1 should only take 8-byte salts. This implementation
+	///   allows salts of any length.
+	size_t DeriveKey(byte *derived, size_t derivedLen, byte purpose, const byte *secret, size_t secretLen, const byte *salt, size_t saltLen, unsigned int iterations, double timeInSeconds=0) const;
+
+protected:
+	// KeyDerivationFunction interface
+	const Algorithm & GetAlgorithm() const {
+		return *this;
+	}
+};
+
+template <class T>
+size_t PKCS5_PBKDF1<T>::GetValidDerivedLength(size_t keylength) const
+{
+	if (keylength > MaxDerivedKeyLength())
+		return MaxDerivedKeyLength();
+	return keylength;
+}
+
+template <class T>
+size_t PKCS5_PBKDF1<T>::DeriveKey(byte *derived, size_t derivedLen,
+    const byte *secret, size_t secretLen, const NameValuePairs& params) const
+{
+	CRYPTOPP_ASSERT(secret /*&& secretLen*/);
+	CRYPTOPP_ASSERT(derived && derivedLen);
+	CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+
+	byte purpose = (byte)params.GetIntValueWithDefault("Purpose", 0);
+	unsigned int iterations = (unsigned int)params.GetIntValueWithDefault("Iterations", 1);
+
+	double timeInSeconds = 0.0f;
+	(void)params.GetValue("TimeInSeconds", timeInSeconds);
+
+	ConstByteArrayParameter salt;
+	(void)params.GetValue(Name::Salt(), salt);
+
+	return DeriveKey(derived, derivedLen, purpose, secret, secretLen, salt.begin(), salt.size(), iterations, timeInSeconds);
+}
+
+template <class T>
+size_t PKCS5_PBKDF1<T>::DeriveKey(byte *derived, size_t derivedLen, byte purpose, const byte *secret, size_t secretLen, const byte *salt, size_t saltLen, unsigned int iterations, double timeInSeconds) const
+{
+	CRYPTOPP_ASSERT(secret /*&& secretLen*/);
+	CRYPTOPP_ASSERT(derived && derivedLen);
+	CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+	CRYPTOPP_ASSERT(iterations > 0 || timeInSeconds > 0);
+	CRYPTOPP_UNUSED(purpose);
+
+	ThrowIfInvalidDerivedKeyLength(derivedLen);
+
+	// Business logic
+	if (!iterations) { iterations = 1; }
+
+	T hash;
+	hash.Update(secret, secretLen);
+	hash.Update(salt, saltLen);
+
+	SecByteBlock buffer(hash.DigestSize());
+	hash.Final(buffer);
+
+	unsigned int i;
+	ThreadUserTimer timer;
+
+	if (timeInSeconds)
+		timer.StartTimer();
+
+	for (i=1; i<iterations || (timeInSeconds && (i%128!=0 || timer.ElapsedTimeAsDouble() < timeInSeconds)); i++)
+		hash.CalculateDigest(buffer, buffer, buffer.size());
+
+	if (derived)
+		std::memcpy(derived, buffer, derivedLen);
+	return i;
+}
+
+// ******************** PKCS5_PBKDF2_HMAC ********************
+
+/// \brief PBKDF2 from PKCS #5
+/// \tparam T a HashTransformation class
+/// \sa PasswordBasedKeyDerivationFunction, <A
+///  HREF="https://www.cryptopp.com/wiki/PKCS5_PBKDF2_HMAC">PKCS5_PBKDF2_HMAC</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 2.0
+template <class T>
+class PKCS5_PBKDF2_HMAC : public PasswordBasedKeyDerivationFunction
+{
+public:
+	virtual ~PKCS5_PBKDF2_HMAC() {}
+
+	static std::string StaticAlgorithmName () {
+		const std::string name(std::string("PBKDF2_HMAC(") +
+			std::string(T::StaticAlgorithmName()) + std::string(")"));
+		return name;
+	}
+
+	// KeyDerivationFunction interface
+	std::string AlgorithmName() const {
+		return StaticAlgorithmName();
+	}
+
+	// KeyDerivationFunction interface
+	// should multiply by T::DIGESTSIZE, but gets overflow that way
+	size_t MaxDerivedKeyLength() const {
+		return 0xffffffffU;
+	}
+
+	// KeyDerivationFunction interface
+	size_t GetValidDerivedLength(size_t keylength) const;
+
+	// KeyDerivationFunction interface
+	size_t DeriveKey(byte *derived, size_t derivedLen, const byte *secret, size_t secretLen,
+		const NameValuePairs& params = g_nullNameValuePairs) const;
+
+	/// \brief Derive a key from a secret seed
+	/// \param derived the derived output buffer
+	/// \param derivedLen the size of the derived buffer, in bytes
+	/// \param purpose a purpose byte
+	/// \param secret the seed input buffer
+	/// \param secretLen the size of the secret buffer, in bytes
+	/// \param salt the salt input buffer
+	/// \param saltLen the size of the salt buffer, in bytes
+	/// \param iterations the number of iterations
+	/// \param timeInSeconds the in seconds
+	/// \return the number of iterations performed
+	/// \throw InvalidDerivedKeyLength if <tt>derivedLen</tt> is invalid for the scheme
+	/// \details DeriveKey() provides a standard interface to derive a key from
+	///   a seed and other parameters. Each class that derives from KeyDerivationFunction
+	///   provides an overload that accepts most parameters used by the derivation function.
+	/// \details If <tt>timeInSeconds</tt> is <tt>&gt; 0.0</tt> then DeriveKey will run for
+	///   the specified amount of time. If <tt>timeInSeconds</tt> is <tt>0.0</tt> then DeriveKey
+	///   will run for the specified number of iterations.
+	size_t DeriveKey(byte *derived, size_t derivedLen, byte purpose, const byte *secret, size_t secretLen,
+	    const byte *salt, size_t saltLen, unsigned int iterations, double timeInSeconds=0) const;
+
+protected:
+	// KeyDerivationFunction interface
+	const Algorithm & GetAlgorithm() const {
+		return *this;
+	}
+};
+
+template <class T>
+size_t PKCS5_PBKDF2_HMAC<T>::GetValidDerivedLength(size_t keylength) const
+{
+	if (keylength > MaxDerivedKeyLength())
+		return MaxDerivedKeyLength();
+	return keylength;
+}
+
+template <class T>
+size_t PKCS5_PBKDF2_HMAC<T>::DeriveKey(byte *derived, size_t derivedLen,
+    const byte *secret, size_t secretLen, const NameValuePairs& params) const
+{
+	CRYPTOPP_ASSERT(secret /*&& secretLen*/);
+	CRYPTOPP_ASSERT(derived && derivedLen);
+	CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+
+	byte purpose = (byte)params.GetIntValueWithDefault("Purpose", 0);
+	unsigned int iterations = (unsigned int)params.GetIntValueWithDefault("Iterations", 1);
+
+	double timeInSeconds = 0.0f;
+	(void)params.GetValue("TimeInSeconds", timeInSeconds);
+
+	ConstByteArrayParameter salt;
+	(void)params.GetValue(Name::Salt(), salt);
+
+	return DeriveKey(derived, derivedLen, purpose, secret, secretLen, salt.begin(), salt.size(), iterations, timeInSeconds);
+}
+
+template <class T>
+size_t PKCS5_PBKDF2_HMAC<T>::DeriveKey(byte *derived, size_t derivedLen, byte purpose, const byte *secret, size_t secretLen, const byte *salt, size_t saltLen, unsigned int iterations, double timeInSeconds) const
+{
+	CRYPTOPP_ASSERT(secret /*&& secretLen*/);
+	CRYPTOPP_ASSERT(derived && derivedLen);
+	CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+	CRYPTOPP_ASSERT(iterations > 0 || timeInSeconds > 0);
+	CRYPTOPP_UNUSED(purpose);
+
+	ThrowIfInvalidDerivedKeyLength(derivedLen);
+
+	// Business logic
+	if (!iterations) { iterations = 1; }
+
+	// DigestSize check due to https://github.com/weidai11/cryptopp/issues/855
+	HMAC<T> hmac(secret, secretLen);
+	if (hmac.DigestSize() == 0)
+		throw InvalidArgument("PKCS5_PBKDF2_HMAC: DigestSize cannot be 0");
+
+	SecByteBlock buffer(hmac.DigestSize());
+	ThreadUserTimer timer;
+
+	unsigned int i=1;
+	while (derivedLen > 0)
+	{
+		hmac.Update(salt, saltLen);
+		unsigned int j;
+		for (j=0; j<4; j++)
+		{
+			byte b = byte(i >> ((3-j)*8));
+			hmac.Update(&b, 1);
+		}
+		hmac.Final(buffer);
+
+#if CRYPTOPP_MSC_VERSION
+		const size_t segmentLen = STDMIN(derivedLen, buffer.size());
+		memcpy_s(derived, segmentLen, buffer, segmentLen);
+#else
+		const size_t segmentLen = STDMIN(derivedLen, buffer.size());
+		std::memcpy(derived, buffer, segmentLen);
+#endif
+
+		if (timeInSeconds)
+		{
+			timeInSeconds = timeInSeconds / ((derivedLen + buffer.size() - 1) / buffer.size());
+			timer.StartTimer();
+		}
+
+		for (j=1; j<iterations || (timeInSeconds && (j%128!=0 || timer.ElapsedTimeAsDouble() < timeInSeconds)); j++)
+		{
+			hmac.CalculateDigest(buffer, buffer, buffer.size());
+			xorbuf(derived, buffer, segmentLen);
+		}
+
+		if (timeInSeconds)
+		{
+			iterations = j;
+			timeInSeconds = 0;
+		}
+
+		derived += segmentLen;
+		derivedLen -= segmentLen;
+		i++;
+	}
+
+	return iterations;
+}
+
+// ******************** PKCS12_PBKDF ********************
+
+/// \brief PBKDF from PKCS #12, appendix B
+/// \tparam T a HashTransformation class
+/// \sa PasswordBasedKeyDerivationFunction, <A
+///  HREF="https://www.cryptopp.com/wiki/PKCS12_PBKDF">PKCS12_PBKDF</A>
+///  on the Crypto++ wiki
+/// \since Crypto++ 2.0
+template <class T>
+class PKCS12_PBKDF : public PasswordBasedKeyDerivationFunction
+{
+public:
+	virtual ~PKCS12_PBKDF() {}
+
+	static std::string StaticAlgorithmName () {
+		const std::string name(std::string("PBKDF_PKCS12(") +
+			std::string(T::StaticAlgorithmName()) + std::string(")"));
+		return name;
+	}
+
+	// KeyDerivationFunction interface
+	std::string AlgorithmName() const {
+		return StaticAlgorithmName();
+	}
+
+	// TODO - check this
+	size_t MaxDerivedKeyLength() const {
+		return static_cast<size_t>(-1);
+	}
+
+	// KeyDerivationFunction interface
+	size_t GetValidDerivedLength(size_t keylength) const;
+
+	// KeyDerivationFunction interface
+	size_t DeriveKey(byte *derived, size_t derivedLen, const byte *secret, size_t secretLen,
+		const NameValuePairs& params = g_nullNameValuePairs) const;
+
+	/// \brief Derive a key from a secret seed
+	/// \param derived the derived output buffer
+	/// \param derivedLen the size of the derived buffer, in bytes
+	/// \param purpose a purpose byte
+	/// \param secret the seed input buffer
+	/// \param secretLen the size of the secret buffer, in bytes
+	/// \param salt the salt input buffer
+	/// \param saltLen the size of the salt buffer, in bytes
+	/// \param iterations the number of iterations
+	/// \param timeInSeconds the in seconds
+	/// \return the number of iterations performed
+	/// \throw InvalidDerivedKeyLength if <tt>derivedLen</tt> is invalid for the scheme
+	/// \details DeriveKey() provides a standard interface to derive a key from
+	///   a seed and other parameters. Each class that derives from KeyDerivationFunction
+	///   provides an overload that accepts most parameters used by the derivation function.
+	/// \details If <tt>timeInSeconds</tt> is <tt>&gt; 0.0</tt> then DeriveKey will run for
+	///   the specified amount of time. If <tt>timeInSeconds</tt> is <tt>0.0</tt> then DeriveKey
+	///   will run for the specified number of iterations.
+	size_t DeriveKey(byte *derived, size_t derivedLen, byte purpose, const byte *secret, size_t secretLen,
+	    const byte *salt, size_t saltLen, unsigned int iterations, double timeInSeconds) const;
+
+protected:
+	// KeyDerivationFunction interface
+	const Algorithm & GetAlgorithm() const {
+		return *this;
+	}
+};
+
+template <class T>
+size_t PKCS12_PBKDF<T>::GetValidDerivedLength(size_t keylength) const
+{
+	if (keylength > MaxDerivedKeyLength())
+		return MaxDerivedKeyLength();
+	return keylength;
+}
+
+template <class T>
+size_t PKCS12_PBKDF<T>::DeriveKey(byte *derived, size_t derivedLen,
+    const byte *secret, size_t secretLen, const NameValuePairs& params) const
+{
+	CRYPTOPP_ASSERT(secret /*&& secretLen*/);
+	CRYPTOPP_ASSERT(derived && derivedLen);
+	CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+
+	byte purpose = (byte)params.GetIntValueWithDefault("Purpose", 0);
+	unsigned int iterations = (unsigned int)params.GetIntValueWithDefault("Iterations", 1);
+
+	double timeInSeconds = 0.0f;
+	(void)params.GetValue("TimeInSeconds", timeInSeconds);
+
+	// NULL or 0 length salt OK
+	ConstByteArrayParameter salt;
+	(void)params.GetValue(Name::Salt(), salt);
+
+	return DeriveKey(derived, derivedLen, purpose, secret, secretLen, salt.begin(), salt.size(), iterations, timeInSeconds);
+}
+
+template <class T>
+size_t PKCS12_PBKDF<T>::DeriveKey(byte *derived, size_t derivedLen, byte purpose, const byte *secret, size_t secretLen, const byte *salt, size_t saltLen, unsigned int iterations, double timeInSeconds) const
+{
+	CRYPTOPP_ASSERT(secret /*&& secretLen*/);
+	CRYPTOPP_ASSERT(derived && derivedLen);
+	CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+	CRYPTOPP_ASSERT(iterations > 0 || timeInSeconds > 0);
+
+	ThrowIfInvalidDerivedKeyLength(derivedLen);
+
+	// Business logic
+	if (!iterations) { iterations = 1; }
+
+	const size_t v = T::BLOCKSIZE;	// v is in bytes rather than bits as in PKCS #12
+	const size_t DLen = v, SLen = RoundUpToMultipleOf(saltLen, v);
+	const size_t PLen = RoundUpToMultipleOf(secretLen, v), ILen = SLen + PLen;
+	SecByteBlock buffer(DLen + SLen + PLen);
+	byte *D = buffer, *S = buffer+DLen, *P = buffer+DLen+SLen, *I = S;
+
+	if (D)  // GCC analyzer
+		std::memset(D, purpose, DLen);
+
+	size_t i;
+	for (i=0; i<SLen; i++)
+		S[i] = salt[i % saltLen];
+	for (i=0; i<PLen; i++)
+		P[i] = secret[i % secretLen];
+
+	T hash;
+	SecByteBlock Ai(T::DIGESTSIZE), B(v);
+	ThreadUserTimer timer;
+
+	while (derivedLen > 0)
+	{
+		hash.CalculateDigest(Ai, buffer, buffer.size());
+
+		if (timeInSeconds)
+		{
+			timeInSeconds = timeInSeconds / ((derivedLen + Ai.size() - 1) / Ai.size());
+			timer.StartTimer();
+		}
+
+		for (i=1; i<iterations || (timeInSeconds && (i%128!=0 || timer.ElapsedTimeAsDouble() < timeInSeconds)); i++)
+			hash.CalculateDigest(Ai, Ai, Ai.size());
+
+		if (timeInSeconds)
+		{
+			iterations = (unsigned int)i;
+			timeInSeconds = 0;
+		}
+
+		for (i=0; i<B.size(); i++)
+			B[i] = Ai[i % Ai.size()];
+
+		Integer B1(B, B.size());
+		++B1;
+		for (i=0; i<ILen; i+=v)
+			(Integer(I+i, v) + B1).Encode(I+i, v);
+
+#if CRYPTOPP_MSC_VERSION
+		const size_t segmentLen = STDMIN(derivedLen, Ai.size());
+		memcpy_s(derived, segmentLen, Ai, segmentLen);
+#else
+		const size_t segmentLen = STDMIN(derivedLen, Ai.size());
+		std::memcpy(derived, Ai, segmentLen);
+#endif
+
+		derived += segmentLen;
+		derivedLen -= segmentLen;
+	}
+
+	return iterations;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/queue.cpp b/runtime/third_party/cryptopp/queue.cpp
new file mode 100644
index 0000000..bbedcf0
--- /dev/null
+++ b/runtime/third_party/cryptopp/queue.cpp
@@ -0,0 +1,601 @@
+// queue.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "queue.h"
+#include "filters.h"
+#include "misc.h"
+#include "trap.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+static const unsigned int s_maxAutoNodeSize = 16*1024u;
+
+// this class for use by ByteQueue only
+class ByteQueueNode
+{
+public:
+	ByteQueueNode(size_t maxSize)
+		: m_buf(maxSize)
+	{
+		// See GH #962 for the reason for this assert.
+		CRYPTOPP_ASSERT(maxSize != SIZE_MAX);
+
+		m_head = m_tail = 0;
+		m_next = NULLPTR;
+	}
+
+	inline size_t MaxSize() const {return m_buf.size();}
+
+	inline size_t CurrentSize() const
+	{
+		return m_tail-m_head;
+	}
+
+	inline bool UsedUp() const
+	{
+		return (m_head==MaxSize());
+	}
+
+	inline void Clear()
+	{
+		m_head = m_tail = 0;
+	}
+
+	inline size_t Put(const byte *begin, size_t length)
+	{
+		// Avoid passing NULL to memcpy
+		if (!begin || !length) return length;
+		size_t l = STDMIN(length, MaxSize()-m_tail);
+		if (m_buf+m_tail != begin)
+			std::memcpy(m_buf+m_tail, begin, l);
+		m_tail += l;
+		return l;
+	}
+
+	inline size_t Peek(byte &outByte) const
+	{
+		if (m_tail==m_head)
+			return 0;
+
+		outByte=m_buf[m_head];
+		return 1;
+	}
+
+	inline size_t Peek(byte *target, size_t copyMax) const
+	{
+		size_t len = STDMIN(copyMax, m_tail-m_head);
+		std::memcpy(target, m_buf+m_head, len);
+		return len;
+	}
+
+	inline size_t CopyTo(BufferedTransformation &target, const std::string &channel=DEFAULT_CHANNEL) const
+	{
+		size_t len = m_tail-m_head;
+		target.ChannelPut(channel, m_buf+m_head, len);
+		return len;
+	}
+
+	inline size_t CopyTo(BufferedTransformation &target, size_t copyMax, const std::string &channel=DEFAULT_CHANNEL) const
+	{
+		size_t len = STDMIN(copyMax, m_tail-m_head);
+		target.ChannelPut(channel, m_buf+m_head, len);
+		return len;
+	}
+
+	inline size_t Get(byte &outByte)
+	{
+		size_t len = Peek(outByte);
+		m_head += len;
+		return len;
+	}
+
+	inline size_t Get(byte *outString, size_t getMax)
+	{
+		size_t len = Peek(outString, getMax);
+		m_head += len;
+		return len;
+	}
+
+	inline size_t TransferTo(BufferedTransformation &target, const std::string &channel=DEFAULT_CHANNEL)
+	{
+		size_t len = m_tail-m_head;
+		target.ChannelPutModifiable(channel, m_buf+m_head, len);
+		m_head = m_tail;
+		return len;
+	}
+
+	inline size_t TransferTo(BufferedTransformation &target, lword transferMax, const std::string &channel=DEFAULT_CHANNEL)
+	{
+		size_t len = UnsignedMin(m_tail-m_head, transferMax);
+		target.ChannelPutModifiable(channel, m_buf+m_head, len);
+		m_head += len;
+		return len;
+	}
+
+	inline size_t Skip(size_t skipMax)
+	{
+		size_t len = STDMIN(skipMax, m_tail-m_head);
+		m_head += len;
+		return len;
+	}
+
+	inline byte operator[](size_t i) const
+	{
+		return m_buf[m_head+i];
+	}
+
+	ByteQueueNode* m_next;
+
+	SecByteBlock m_buf;
+	size_t m_head, m_tail;
+};
+
+// ********************************************************
+
+ByteQueue::ByteQueue(size_t nodeSize)
+	: Bufferless<BufferedTransformation>()
+	, m_head(NULLPTR), m_tail(NULLPTR), m_lazyString(NULLPTR), m_lazyLength(0)
+	, m_nodeSize(nodeSize), m_lazyStringModifiable(false), m_autoNodeSize(!nodeSize)
+{
+	// See GH #962 for the reason for this assert.
+	CRYPTOPP_ASSERT(nodeSize != SIZE_MAX);
+
+	SetNodeSize(nodeSize);
+	m_head = m_tail = new ByteQueueNode(m_nodeSize);
+}
+
+void ByteQueue::SetNodeSize(size_t nodeSize)
+{
+	m_autoNodeSize = !nodeSize;
+	m_nodeSize = m_autoNodeSize ? 256 : nodeSize;
+}
+
+ByteQueue::ByteQueue(const ByteQueue &copy)
+	: Bufferless<BufferedTransformation>(copy), m_lazyString(NULLPTR), m_lazyLength(0)
+{
+	CopyFrom(copy);
+}
+
+void ByteQueue::CopyFrom(const ByteQueue &copy)
+{
+	m_lazyLength = 0;
+	m_autoNodeSize = copy.m_autoNodeSize;
+	m_nodeSize = copy.m_nodeSize;
+	m_head = m_tail = new ByteQueueNode(*copy.m_head);
+
+	for (ByteQueueNode *current=copy.m_head->m_next; current; current=current->m_next)
+	{
+		m_tail->m_next = new ByteQueueNode(*current);
+		m_tail = m_tail->m_next;
+	}
+
+	m_tail->m_next = NULLPTR;
+
+	Put(copy.m_lazyString, copy.m_lazyLength);
+}
+
+ByteQueue::~ByteQueue()
+{
+	Destroy();
+}
+
+void ByteQueue::Destroy()
+{
+	for (ByteQueueNode *next, *current=m_head; current; current=next)
+	{
+		next=current->m_next;
+		delete current;
+	}
+}
+
+void ByteQueue::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_nodeSize = parameters.GetIntValueWithDefault("NodeSize", 256);
+	Clear();
+}
+
+lword ByteQueue::CurrentSize() const
+{
+	lword size=0;
+
+	for (ByteQueueNode *current=m_head; current; current=current->m_next)
+		size += current->CurrentSize();
+
+	return size + m_lazyLength;
+}
+
+bool ByteQueue::IsEmpty() const
+{
+	return m_head==m_tail && m_head->CurrentSize()==0 && m_lazyLength==0;
+}
+
+void ByteQueue::Clear()
+{
+	for (ByteQueueNode *next, *current=m_head->m_next; current; current=next)
+	{
+		next=current->m_next;
+		delete current;
+	}
+
+	m_tail = m_head;
+	m_head->Clear();
+	m_head->m_next = NULLPTR;
+	m_lazyLength = 0;
+}
+
+size_t ByteQueue::Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+{
+	CRYPTOPP_UNUSED(messageEnd), CRYPTOPP_UNUSED(blocking);
+
+	if (m_lazyLength > 0)
+		FinalizeLazyPut();
+
+	size_t len;
+	while ((len=m_tail->Put(inString, length)) < length)
+	{
+		inString = PtrAdd(inString, len);
+		length -= len;
+		if (m_autoNodeSize && m_nodeSize < s_maxAutoNodeSize)
+		{
+			do
+			{
+				m_nodeSize *= 2;
+			}
+			while (m_nodeSize < length && m_nodeSize < s_maxAutoNodeSize);
+		}
+		m_tail->m_next = new ByteQueueNode(STDMAX(m_nodeSize, length));
+		m_tail = m_tail->m_next;
+	}
+
+	return 0;
+}
+
+void ByteQueue::CleanupUsedNodes()
+{
+	// Test for m_head due to Enterprise Analysis finding
+	while (m_head && m_head != m_tail && m_head->UsedUp())
+	{
+		ByteQueueNode *temp=m_head;
+		m_head=m_head->m_next;
+		delete temp;
+	}
+
+	// Test for m_head due to Enterprise Analysis finding
+	if (m_head && m_head->CurrentSize() == 0)
+		m_head->Clear();
+}
+
+void ByteQueue::LazyPut(const byte *inString, size_t size)
+{
+	if (m_lazyLength > 0)
+		FinalizeLazyPut();
+
+	if (inString == m_tail->m_buf+m_tail->m_tail)
+		Put(inString, size);
+	else
+	{
+		m_lazyString = const_cast<byte *>(inString);
+		m_lazyLength = size;
+		m_lazyStringModifiable = false;
+	}
+}
+
+void ByteQueue::LazyPutModifiable(byte *inString, size_t size)
+{
+	if (m_lazyLength > 0)
+		FinalizeLazyPut();
+	m_lazyString = inString;
+	m_lazyLength = size;
+	m_lazyStringModifiable = true;
+}
+
+void ByteQueue::UndoLazyPut(size_t size)
+{
+	if (m_lazyLength < size)
+		throw InvalidArgument("ByteQueue: size specified for UndoLazyPut is too large");
+
+	m_lazyLength -= size;
+}
+
+void ByteQueue::FinalizeLazyPut()
+{
+	size_t len = m_lazyLength;
+	m_lazyLength = 0;
+	if (len)
+		Put(m_lazyString, len);
+}
+
+size_t ByteQueue::Get(byte &outByte)
+{
+	if (m_head->Get(outByte))
+	{
+		if (m_head->UsedUp())
+			CleanupUsedNodes();
+		return 1;
+	}
+	else if (m_lazyLength > 0)
+	{
+		outByte = *m_lazyString++;
+		m_lazyLength--;
+		return 1;
+	}
+	else
+		return 0;
+}
+
+size_t ByteQueue::Get(byte *outString, size_t getMax)
+{
+	ArraySink sink(outString, getMax);
+	return (size_t)TransferTo(sink, getMax);
+}
+
+size_t ByteQueue::Peek(byte &outByte) const
+{
+	if (m_head->Peek(outByte))
+		return 1;
+	else if (m_lazyLength > 0)
+	{
+		outByte = *m_lazyString;
+		return 1;
+	}
+	else
+		return 0;
+}
+
+size_t ByteQueue::Peek(byte *outString, size_t peekMax) const
+{
+	ArraySink sink(outString, peekMax);
+	return (size_t)CopyTo(sink, peekMax);
+}
+
+size_t ByteQueue::TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel, bool blocking)
+{
+	// No need for CRYPTOPP_ASSERT on transferBytes here.
+	// TransferTo2 handles LWORD_MAX as expected.
+
+	if (blocking)
+	{
+		lword bytesLeft = transferBytes;
+		for (ByteQueueNode *current=m_head; bytesLeft && current; current=current->m_next)
+			bytesLeft -= current->TransferTo(target, bytesLeft, channel);
+		CleanupUsedNodes();
+
+		size_t len = (size_t)STDMIN(bytesLeft, (lword)m_lazyLength);
+		if (len)
+		{
+			if (m_lazyStringModifiable)
+				target.ChannelPutModifiable(channel, m_lazyString, len);
+			else
+				target.ChannelPut(channel, m_lazyString, len);
+			m_lazyString = PtrAdd(m_lazyString, len);
+			m_lazyLength -= len;
+			bytesLeft -= len;
+		}
+		transferBytes -= bytesLeft;
+		return 0;
+	}
+	else
+	{
+		Walker walker(*this);
+		size_t blockedBytes = walker.TransferTo2(target, transferBytes, channel, blocking);
+		Skip(transferBytes);
+		return blockedBytes;
+	}
+}
+
+size_t ByteQueue::CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end, const std::string &channel, bool blocking) const
+{
+	Walker walker(*this);
+	walker.Skip(begin);
+	lword transferBytes = end-begin;
+
+	size_t blockedBytes = walker.TransferTo2(target, transferBytes, channel, blocking);
+	begin += transferBytes;
+	return blockedBytes;
+}
+
+void ByteQueue::Unget(byte inByte)
+{
+	Unget(&inByte, 1);
+}
+
+void ByteQueue::Unget(const byte *inString, size_t length)
+{
+	// See GH #962 for the reason for this assert.
+	CRYPTOPP_ASSERT(length != SIZE_MAX);
+
+	size_t len = STDMIN(length, m_head->m_head);
+	length -= len;
+	m_head->m_head = m_head->m_head - len;
+	std::memcpy(m_head->m_buf + m_head->m_head, inString + length, len);
+
+	if (length > 0)
+	{
+		ByteQueueNode *newHead = new ByteQueueNode(length);
+		newHead->m_next = m_head;
+		m_head = newHead;
+		m_head->Put(inString, length);
+	}
+}
+
+const byte * ByteQueue::Spy(size_t &contiguousSize) const
+{
+	contiguousSize = m_head->m_tail - m_head->m_head;
+	if (contiguousSize == 0 && m_lazyLength > 0)
+	{
+		contiguousSize = m_lazyLength;
+		return m_lazyString;
+	}
+	else
+		return m_head->m_buf + m_head->m_head;
+}
+
+byte * ByteQueue::CreatePutSpace(size_t &size)
+{
+	// See GH #962 for the reason for this assert.
+	CRYPTOPP_ASSERT(size != SIZE_MAX);
+	// Sanity check for a reasonable size
+	CRYPTOPP_ASSERT(size <= 16U*1024*1024);
+
+	if (m_lazyLength > 0)
+		FinalizeLazyPut();
+
+	if (m_tail->m_tail == m_tail->MaxSize())
+	{
+		m_tail->m_next = new ByteQueueNode(STDMAX(m_nodeSize, size));
+		m_tail = m_tail->m_next;
+	}
+
+	size = m_tail->MaxSize() - m_tail->m_tail;
+	return PtrAdd(m_tail->m_buf.begin(), m_tail->m_tail);
+}
+
+ByteQueue & ByteQueue::operator=(const ByteQueue &rhs)
+{
+	Destroy();
+	CopyFrom(rhs);
+	return *this;
+}
+
+bool ByteQueue::operator==(const ByteQueue &rhs) const
+{
+	const lword currentSize = CurrentSize();
+
+	if (currentSize != rhs.CurrentSize())
+		return false;
+
+	Walker walker1(*this), walker2(rhs);
+	byte b1, b2;
+
+	while (walker1.Get(b1) && walker2.Get(b2))
+		if (b1 != b2)
+			return false;
+
+	return true;
+}
+
+byte ByteQueue::operator[](lword index) const
+{
+	for (ByteQueueNode *current=m_head; current; current=current->m_next)
+	{
+		if (index < current->CurrentSize())
+			return (*current)[(size_t)index];
+
+		index -= current->CurrentSize();
+	}
+
+	CRYPTOPP_ASSERT(index < m_lazyLength);
+	return m_lazyString[index];
+}
+
+void ByteQueue::swap(ByteQueue &rhs)
+{
+	std::swap(m_autoNodeSize, rhs.m_autoNodeSize);
+	std::swap(m_nodeSize, rhs.m_nodeSize);
+	std::swap(m_head, rhs.m_head);
+	std::swap(m_tail, rhs.m_tail);
+	std::swap(m_lazyString, rhs.m_lazyString);
+	std::swap(m_lazyLength, rhs.m_lazyLength);
+	std::swap(m_lazyStringModifiable, rhs.m_lazyStringModifiable);
+}
+
+// ********************************************************
+
+void ByteQueue::Walker::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	CRYPTOPP_UNUSED(parameters);
+
+	m_node = m_queue.m_head;
+	m_position = 0;
+	m_offset = 0;
+	m_lazyString = m_queue.m_lazyString;
+	m_lazyLength = m_queue.m_lazyLength;
+}
+
+size_t ByteQueue::Walker::Get(byte &outByte)
+{
+	ArraySink sink(&outByte, 1);
+	return (size_t)TransferTo(sink, 1);
+}
+
+size_t ByteQueue::Walker::Get(byte *outString, size_t getMax)
+{
+	ArraySink sink(outString, getMax);
+	return (size_t)TransferTo(sink, getMax);
+}
+
+size_t ByteQueue::Walker::Peek(byte &outByte) const
+{
+	ArraySink sink(&outByte, 1);
+	return (size_t)CopyTo(sink, 1);
+}
+
+size_t ByteQueue::Walker::Peek(byte *outString, size_t peekMax) const
+{
+	ArraySink sink(outString, peekMax);
+	return (size_t)CopyTo(sink, peekMax);
+}
+
+size_t ByteQueue::Walker::TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel, bool blocking)
+{
+	// No need for CRYPTOPP_ASSERT on transferBytes here.
+	// TransferTo2 handles LWORD_MAX as expected.
+
+	lword bytesLeft = transferBytes;
+	size_t blockedBytes = 0;
+
+	while (m_node)
+	{
+		size_t len = (size_t)STDMIN(bytesLeft, (lword)m_node->CurrentSize()-m_offset);
+		blockedBytes = target.ChannelPut2(channel, m_node->m_buf+m_node->m_head+m_offset, len, 0, blocking);
+
+		if (blockedBytes)
+			goto done;
+
+		m_position += len;
+		bytesLeft -= len;
+
+		if (!bytesLeft)
+		{
+			m_offset += len;
+			goto done;
+		}
+
+		m_node = m_node->m_next;
+		m_offset = 0;
+	}
+
+	if (bytesLeft && m_lazyLength)
+	{
+		size_t len = (size_t)STDMIN(bytesLeft, (lword)m_lazyLength);
+		blockedBytes = target.ChannelPut2(channel, m_lazyString, len, 0, blocking);
+		if (blockedBytes)
+			goto done;
+
+		m_lazyString = PtrAdd(m_lazyString, len);
+		m_lazyLength -= len;
+		bytesLeft -= len;
+	}
+
+done:
+	transferBytes -= bytesLeft;
+	return blockedBytes;
+}
+
+size_t ByteQueue::Walker::CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end, const std::string &channel, bool blocking) const
+{
+	Walker walker(*this);
+	walker.Skip(begin);
+	lword transferBytes = end-begin;
+
+	size_t blockedBytes = walker.TransferTo2(target, transferBytes, channel, blocking);
+	begin += transferBytes;
+	return blockedBytes;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/queue.h b/runtime/third_party/cryptopp/queue.h
new file mode 100644
index 0000000..eff5de9
--- /dev/null
+++ b/runtime/third_party/cryptopp/queue.h
@@ -0,0 +1,272 @@
+// queue.h - originally written and placed in the public domain by Wei Dai
+
+/// \file
+/// \brief Classes for an unlimited queue to store bytes
+
+#ifndef CRYPTOPP_QUEUE_H
+#define CRYPTOPP_QUEUE_H
+
+#include "cryptlib.h"
+#include "simple.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+class ByteQueueNode;
+
+/// \brief Data structure used to store byte strings
+/// \details The queue is implemented as a linked list of byte arrays.
+///  Each byte array is stored in a ByteQueueNode.
+/// \sa <A HREF="https://www.cryptopp.com/wiki/ByteQueue">ByteQueue</A>
+///  on the Crypto++ wiki.
+/// \since Crypto++ 2.0
+class CRYPTOPP_DLL ByteQueue : public Bufferless<BufferedTransformation>
+{
+public:
+	virtual ~ByteQueue();
+
+	/// \brief Construct a ByteQueue
+	/// \param nodeSize the initial node size
+	/// \details Internally, ByteQueue uses a ByteQueueNode to store bytes,
+	///  and <tt>nodeSize</tt> determines the size of the ByteQueueNode. A value
+	///  of 0 indicates the ByteQueueNode should be automatically sized,
+	///  which means a value of 256 is used.
+	ByteQueue(size_t nodeSize=0);
+
+	/// \brief Copy construct a ByteQueue
+	/// \param copy the other ByteQueue
+	ByteQueue(const ByteQueue &copy);
+
+	// BufferedTransformation
+	lword MaxRetrievable() const
+		{return CurrentSize();}
+	bool AnyRetrievable() const
+		{return !IsEmpty();}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	byte * CreatePutSpace(size_t &size);
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+
+	size_t Get(byte &outByte);
+	size_t Get(byte *outString, size_t getMax);
+
+	size_t Peek(byte &outByte) const;
+	size_t Peek(byte *outString, size_t peekMax) const;
+
+	size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+	size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const;
+
+	/// \brief Set node size
+	/// \param nodeSize the new node size, in bytes
+	/// \details The default node size is 256.
+	void SetNodeSize(size_t nodeSize);
+
+	/// \brief Determine data size
+	/// \return the data size, in bytes
+	lword CurrentSize() const;
+
+	/// \brief Determine data availability
+	/// \return true if the ByteQueue has data, false otherwise
+	bool IsEmpty() const;
+
+	/// \brief Empty the queue
+	void Clear();
+
+	/// \brief Insert data in the queue
+	/// \param inByte a byte to insert
+	/// \details Unget() inserts a byte at the head of the queue
+	void Unget(byte inByte);
+
+	/// \brief Insert data in the queue
+	/// \param inString a byte array to insert
+	/// \param length the size of the byte array
+	/// \details Unget() inserts a byte array at the head of the queue
+	void Unget(const byte *inString, size_t length);
+
+	/// \brief Peek data in the queue
+	/// \param contiguousSize the size of the data
+	/// \details Spy() peeks at data at the head of the queue. Spy() does
+	///  not remove data from the queue.
+	/// \details The data's size is returned in <tt>contiguousSize</tt>.
+	///  Spy() returns the size of the first byte array in the list. The
+	///  entire data may be larger since the queue is a linked list of
+	///  byte arrays.
+	const byte * Spy(size_t &contiguousSize) const;
+
+	/// \brief Insert data in the queue
+	/// \param inString a byte array to insert
+	/// \param size the length of the byte array
+	/// \details LazyPut() inserts a byte array at the tail of the queue.
+	///  The data may not be copied at this point. Rather, the pointer
+	///  and size to external data are recorded.
+	/// \details Another call to Put() or LazyPut() will force the data to
+	///  be copied. When lazy puts are used, the data is copied when
+	///  FinalizeLazyPut() is called.
+	/// \sa LazyPutter
+	void LazyPut(const byte *inString, size_t size);
+
+	/// \brief Insert data in the queue
+	/// \param inString a byte array to insert
+	/// \param size the length of the byte array
+	/// \details LazyPut() inserts a byte array at the tail of the queue.
+	///  The data may not be copied at this point. Rather, the pointer
+	///  and size to external data are recorded.
+	/// \details Another call to Put() or LazyPut() will force the data to
+	///  be copied. When lazy puts are used, the data is copied when
+	///  FinalizeLazyPut() is called.
+	/// \sa LazyPutter
+	void LazyPutModifiable(byte *inString, size_t size);
+
+	/// \brief Remove data from the queue
+	/// \param size the length of the data
+	/// \throw InvalidArgument if there is no lazy data in the queue or if
+	///  size is larger than the lazy string
+	/// \details UndoLazyPut() truncates data inserted using LazyPut() by
+	///  modifying size.
+	/// \sa LazyPutter
+	void UndoLazyPut(size_t size);
+
+	/// \brief Insert data in the queue
+	/// \details FinalizeLazyPut() copies external data inserted using
+	///  LazyPut() or LazyPutModifiable() into the tail of the queue.
+	/// \sa LazyPutter
+	void FinalizeLazyPut();
+
+	/// \brief Assign contents from another ByteQueue
+	/// \param rhs the other ByteQueue
+	/// \return reference to this ByteQueue
+	ByteQueue & operator=(const ByteQueue &rhs);
+
+	/// \brief Bitwise compare two ByteQueue
+	/// \param rhs the other ByteQueue
+	/// \return true if the size and bits are equal, false otherwise
+	/// \details operator==() walks each ByteQueue comparing bytes in
+	///  each queue. operator==() is not constant time.
+	bool operator==(const ByteQueue &rhs) const;
+
+	/// \brief Bitwise compare two ByteQueue
+	/// \param rhs the other ByteQueue
+	/// \return true if the size and bits are not equal, false otherwise
+	/// \details operator!=() is implemented in terms of operator==().
+	///  operator==() is not constant time.
+	bool operator!=(const ByteQueue &rhs) const {return !operator==(rhs);}
+
+	/// \brief Retrieve data from the queue
+	/// \param index of byte to retrieve
+	/// \return byte at the specified index
+	/// \details operator[]() does not perform bounds checking.
+	byte operator[](lword index) const;
+
+	/// \brief Swap contents with another ByteQueue
+	/// \param rhs the other ByteQueue
+	void swap(ByteQueue &rhs);
+
+	/// \brief A ByteQueue iterator
+	class Walker : public InputRejecting<BufferedTransformation>
+	{
+	public:
+		/// \brief Construct a ByteQueue Walker
+		/// \param queue a ByteQueue
+		Walker(const ByteQueue &queue)
+			: m_queue(queue), m_node(NULLPTR), m_position(0), m_offset(0), m_lazyString(NULLPTR), m_lazyLength(0)
+				{Initialize();}
+
+		lword GetCurrentPosition() {return m_position;}
+
+		lword MaxRetrievable() const
+			{return m_queue.CurrentSize() - m_position;}
+
+		void IsolatedInitialize(const NameValuePairs &parameters);
+
+		size_t Get(byte &outByte);
+		size_t Get(byte *outString, size_t getMax);
+
+		size_t Peek(byte &outByte) const;
+		size_t Peek(byte *outString, size_t peekMax) const;
+
+		size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true);
+		size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const;
+
+	private:
+		const ByteQueue &m_queue;
+		const ByteQueueNode *m_node;
+		lword m_position;
+		size_t m_offset;
+		const byte *m_lazyString;
+		size_t m_lazyLength;
+	};
+
+	friend class Walker;
+
+protected:
+	void CleanupUsedNodes();
+	void CopyFrom(const ByteQueue &copy);
+	void Destroy();
+
+private:
+	ByteQueueNode *m_head, *m_tail;
+	byte *m_lazyString;
+	size_t m_lazyLength;
+	size_t m_nodeSize;
+	bool m_lazyStringModifiable;
+	bool m_autoNodeSize;
+};
+
+/// \brief Helper class to finalize Puts on ByteQueue
+/// \details LazyPutter ensures LazyPut is committed to the ByteQueue
+///  in event of exception. During destruction, the LazyPutter class
+///  calls FinalizeLazyPut.
+class CRYPTOPP_DLL LazyPutter
+{
+public:
+	virtual ~LazyPutter() {
+		try {m_bq.FinalizeLazyPut();}
+		catch(const Exception&) {CRYPTOPP_ASSERT(0);}
+	}
+
+	/// \brief Construct a LazyPutter
+	/// \param bq the ByteQueue
+	/// \param inString a byte array to insert
+	/// \param size the length of the byte array
+	/// \details LazyPutter ensures LazyPut is committed to the ByteQueue
+	///  in event of exception. During destruction, the LazyPutter class
+	///  calls FinalizeLazyPut.
+	LazyPutter(ByteQueue &bq, const byte *inString, size_t size)
+		: m_bq(bq) {bq.LazyPut(inString, size);}
+
+protected:
+	LazyPutter(ByteQueue &bq) : m_bq(bq) {}
+
+private:
+	ByteQueue &m_bq;
+};
+
+/// \brief Helper class to finalize Puts on ByteQueue
+/// \details LazyPutterModifiable ensures LazyPut is committed to the
+///  ByteQueue in event of exception. During destruction, the
+///  LazyPutterModifiable class calls FinalizeLazyPut.
+class LazyPutterModifiable : public LazyPutter
+{
+public:
+	/// \brief Construct a LazyPutterModifiable
+	/// \param bq the ByteQueue
+	/// \param inString a byte array to insert
+	/// \param size the length of the byte array
+	/// \details LazyPutterModifiable ensures LazyPut is committed to the
+	///  ByteQueue in event of exception. During destruction, the
+	///  LazyPutterModifiable class calls FinalizeLazyPut.
+	LazyPutterModifiable(ByteQueue &bq, byte *inString, size_t size)
+		: LazyPutter(bq) {bq.LazyPutModifiable(inString, size);}
+};
+
+NAMESPACE_END
+
+#ifndef __BORLANDC__
+NAMESPACE_BEGIN(std)
+template<> inline void swap(CryptoPP::ByteQueue &a, CryptoPP::ByteQueue &b)
+{
+	a.swap(b);
+}
+NAMESPACE_END
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/rabbit.cpp b/runtime/third_party/cryptopp/rabbit.cpp
new file mode 100644
index 0000000..4b10529
--- /dev/null
+++ b/runtime/third_party/cryptopp/rabbit.cpp
@@ -0,0 +1,244 @@
+// rabbit.cpp - written and placed in the public domain by Jeffrey Walton
+//              based on public domain code by Martin Boesgaard, Mette Vesterager,
+//              Thomas Pedersen, Jesper Christiansen and Ove Scavenius.
+//
+//              The reference materials and source files are available at
+//              The eSTREAM Project, http://www.ecrypt.eu.org/stream/e2-rabbit.html.
+
+#include "pch.h"
+#include "config.h"
+
+#include "rabbit.h"
+#include "secblock.h"
+#include "strciphr.h"
+#include "misc.h"
+
+#define WordType word32
+
+#define BYTES_PER_ITERATION 16
+
+#define RABBIT_OUTPUT(x){\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 0, (m_wx[0] ^ (m_wx[5] >> 16) ^ (m_wx[3] << 16)));\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 1, (m_wx[2] ^ (m_wx[7] >> 16) ^ (m_wx[5] << 16)));\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 2, (m_wx[4] ^ (m_wx[1] >> 16) ^ (m_wx[7] << 16)));\
+    CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 3, (m_wx[6] ^ (m_wx[3] >> 16) ^ (m_wx[1] << 16)));}
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::rotlConstant;
+
+word32 G_func(word32 x)
+{
+#if 0
+	/* Temporary variables */
+	word32 a, b, h, l;
+
+	/* Construct high and low argument for squaring */
+	a = x & 0xFFFF;
+	b = x >> 16;
+
+	/* Calculate high and low result of squaring */
+	h = (((static_cast<word32>(a*a) >> 17U) + static_cast<word32>(a*b)) >> 15U) + b*b;
+	l = x*x;
+
+	/* Return high XOR low */
+	return static_cast<word32>(h^l);
+#endif
+
+	// Thanks to Jack Lloyd for suggesting the 64-bit multiply.
+	word64 z = x;
+	z *= x;
+	return static_cast<word32>((z >> 32) ^ z);
+}
+
+word32 NextState(word32 c[8], word32 x[8], word32 carry)
+{
+	/* Temporary variables */
+	word32 g[8], c_old[8], i;
+
+	/* Save old counter values */
+	for (i = 0; i<8; i++)
+		c_old[i] = c[i];
+
+	/* Calculate new counter values */
+	c[0] = static_cast<word32>(c[0] + 0x4D34D34D + carry);
+	c[1] = static_cast<word32>(c[1] + 0xD34D34D3 + (c[0] < c_old[0]));
+	c[2] = static_cast<word32>(c[2] + 0x34D34D34 + (c[1] < c_old[1]));
+	c[3] = static_cast<word32>(c[3] + 0x4D34D34D + (c[2] < c_old[2]));
+	c[4] = static_cast<word32>(c[4] + 0xD34D34D3 + (c[3] < c_old[3]));
+	c[5] = static_cast<word32>(c[5] + 0x34D34D34 + (c[4] < c_old[4]));
+	c[6] = static_cast<word32>(c[6] + 0x4D34D34D + (c[5] < c_old[5]));
+	c[7] = static_cast<word32>(c[7] + 0xD34D34D3 + (c[6] < c_old[6]));
+	carry = (c[7] < c_old[7]);
+
+	/* Calculate the g-values */
+	for (i = 0; i<8; i++)
+		g[i] = G_func(static_cast<word32>(x[i] + c[i]));
+
+	/* Calculate new state values */
+	x[0] = static_cast<word32>(g[0] + rotlConstant<16>(g[7]) + rotlConstant<16>(g[6]));
+	x[1] = static_cast<word32>(g[1] + rotlConstant<8>(g[0]) + g[7]);
+	x[2] = static_cast<word32>(g[2] + rotlConstant<16>(g[1]) + rotlConstant<16>(g[0]));
+	x[3] = static_cast<word32>(g[3] + rotlConstant<8>(g[2]) + g[1]);
+	x[4] = static_cast<word32>(g[4] + rotlConstant<16>(g[3]) + rotlConstant<16>(g[2]));
+	x[5] = static_cast<word32>(g[5] + rotlConstant<8>(g[4]) + g[3]);
+	x[6] = static_cast<word32>(g[6] + rotlConstant<16>(g[5]) + rotlConstant<16>(g[4]));
+	x[7] = static_cast<word32>(g[7] + rotlConstant<8>(g[6]) + g[5]);
+
+	return carry;
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void RabbitPolicy::CipherSetKey(const NameValuePairs &params, const byte *userKey, size_t keylen)
+{
+	/* Generate four subkeys */
+	CRYPTOPP_UNUSED(params);
+	GetUserKey(LITTLE_ENDIAN_ORDER, m_t.begin(), 4, userKey, keylen);
+
+	/* Generate initial state variables */
+	m_mx[0] = m_t[0];
+	m_mx[2] = m_t[1];
+	m_mx[4] = m_t[2];
+	m_mx[6] = m_t[3];
+	m_mx[1] = static_cast<word32>(m_t[3] << 16) | (m_t[2] >> 16);
+	m_mx[3] = static_cast<word32>(m_t[0] << 16) | (m_t[3] >> 16);
+	m_mx[5] = static_cast<word32>(m_t[1] << 16) | (m_t[0] >> 16);
+	m_mx[7] = static_cast<word32>(m_t[2] << 16) | (m_t[1] >> 16);
+
+	/* Generate initial counter values */
+	m_mc[0] = rotlConstant<16>(m_t[2]);
+	m_mc[2] = rotlConstant<16>(m_t[3]);
+	m_mc[4] = rotlConstant<16>(m_t[0]);
+	m_mc[6] = rotlConstant<16>(m_t[1]);
+	m_mc[1] = (m_t[0] & 0xFFFF0000) | (m_t[1] & 0xFFFF);
+	m_mc[3] = (m_t[1] & 0xFFFF0000) | (m_t[2] & 0xFFFF);
+	m_mc[5] = (m_t[2] & 0xFFFF0000) | (m_t[3] & 0xFFFF);
+	m_mc[7] = (m_t[3] & 0xFFFF0000) | (m_t[0] & 0xFFFF);
+
+	/* Clear carry bit */
+	m_mcy = 0;
+
+	/* Iterate the system four times */
+	for (size_t i = 0; i<4; i++)
+		m_mcy = NextState(m_mc, m_mx, m_mcy);
+
+	/* Modify the counters */
+	for (size_t i = 0; i<8; i++)
+		m_mc[i] ^= m_mx[(i + 4) & 0x7];
+
+	/* Copy master instance to work instance */
+	for (size_t i = 0; i<8; i++)
+	{
+		m_wx[i] = m_mx[i];
+		m_wc[i] = m_mc[i];
+	}
+	m_wcy = m_mcy;
+}
+
+void RabbitPolicy::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+	do
+	{
+		/* Iterate the system */
+		m_wcy = NextState(m_wc, m_wx, m_wcy);
+
+		CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(RABBIT_OUTPUT, BYTES_PER_ITERATION);
+
+	} while (--iterationCount);
+}
+
+void RabbitWithIVPolicy::CipherSetKey(const NameValuePairs &params, const byte *userKey, size_t keylen)
+{
+	/* Generate four subkeys */
+	CRYPTOPP_UNUSED(params);
+	GetUserKey(LITTLE_ENDIAN_ORDER, m_t.begin(), 4, userKey, keylen);
+
+	/* Generate initial state variables */
+	m_mx[0] = m_t[0];
+	m_mx[2] = m_t[1];
+	m_mx[4] = m_t[2];
+	m_mx[6] = m_t[3];
+	m_mx[1] = static_cast<word32>(m_t[3] << 16) | (m_t[2] >> 16);
+	m_mx[3] = static_cast<word32>(m_t[0] << 16) | (m_t[3] >> 16);
+	m_mx[5] = static_cast<word32>(m_t[1] << 16) | (m_t[0] >> 16);
+	m_mx[7] = static_cast<word32>(m_t[2] << 16) | (m_t[1] >> 16);
+
+	/* Generate initial counter values */
+	m_mc[0] = rotlConstant<16>(m_t[2]);
+	m_mc[2] = rotlConstant<16>(m_t[3]);
+	m_mc[4] = rotlConstant<16>(m_t[0]);
+	m_mc[6] = rotlConstant<16>(m_t[1]);
+	m_mc[1] = (m_t[0] & 0xFFFF0000) | (m_t[1] & 0xFFFF);
+	m_mc[3] = (m_t[1] & 0xFFFF0000) | (m_t[2] & 0xFFFF);
+	m_mc[5] = (m_t[2] & 0xFFFF0000) | (m_t[3] & 0xFFFF);
+	m_mc[7] = (m_t[3] & 0xFFFF0000) | (m_t[0] & 0xFFFF);
+
+	/* Clear carry bit */
+	m_mcy = 0;
+
+	/* Iterate the system four times */
+	for (size_t i = 0; i<4; i++)
+		m_mcy = NextState(m_mc, m_mx, m_mcy);
+
+	/* Modify the counters */
+	for (size_t i = 0; i<8; i++)
+		m_mc[i] ^= m_mx[(i + 4) & 0x7];
+
+	/* Copy master instance to work instance */
+	for (size_t i = 0; i<8; i++)
+	{
+		m_wx[i] = m_mx[i];
+		m_wc[i] = m_mc[i];
+	}
+	m_wcy = m_mcy;
+}
+
+void RabbitWithIVPolicy::CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer);
+	CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(length == 8);
+
+	/* Generate four subvectors */
+	GetBlock<word32, LittleEndian> v(iv); v(m_t[0])(m_t[2]);
+	m_t[1] = (m_t[0] >> 16) | (m_t[2] & 0xFFFF0000);
+	m_t[3] = (m_t[2] << 16) | (m_t[0] & 0x0000FFFF);
+
+	/* Modify counter values */
+	m_wc[0] = m_mc[0] ^ m_t[0];
+	m_wc[1] = m_mc[1] ^ m_t[1];
+	m_wc[2] = m_mc[2] ^ m_t[2];
+	m_wc[3] = m_mc[3] ^ m_t[3];
+	m_wc[4] = m_mc[4] ^ m_t[0];
+	m_wc[5] = m_mc[5] ^ m_t[1];
+	m_wc[6] = m_mc[6] ^ m_t[2];
+	m_wc[7] = m_mc[7] ^ m_t[3];
+
+	/* Copy state variables */
+	for (size_t i = 0; i<8; i++)
+		m_wx[i] = m_mx[i];
+	m_wcy = m_mcy;
+
+	/* Iterate the system four times */
+	for (size_t i = 0; i<4; i++)
+		m_wcy = NextState(m_wc, m_wx, m_wcy);
+}
+
+void RabbitWithIVPolicy::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+	do
+	{
+		/* Iterate the system */
+		m_wcy = NextState(m_wc, m_wx, m_wcy);
+
+		CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(RABBIT_OUTPUT, BYTES_PER_ITERATION);
+
+	} while (--iterationCount);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/rabbit.h b/runtime/third_party/cryptopp/rabbit.h
new file mode 100644
index 0000000..0103091
--- /dev/null
+++ b/runtime/third_party/cryptopp/rabbit.h
@@ -0,0 +1,112 @@
+// rabbit.h - written and placed in the public domain by Jeffrey Walton
+//            based on public domain code by Martin Boesgaard, Mette Vesterager,
+//            Thomas Pedersen, Jesper Christiansen and Ove Scavenius.
+//
+//            The reference materials and source files are available at
+//            The eSTREAM Project, http://www.ecrypt.eu.org/stream/e2-rabbit.html.
+
+/// \file rabbit.h
+/// \brief Classes for Rabbit stream cipher
+/// \sa <A HREF="http://www.ecrypt.eu.org/stream/e2-rabbit.html">The
+///   eSTREAM Project | Rabbit</A> and
+///   <A HREF="https://www.cryptopp.com/wiki/Rabbit">Crypto++ Wiki | Rabbit</A>.
+/// \since Crypto++ 8.0
+
+#ifndef CRYPTOPP_RABBIT_H
+#define CRYPTOPP_RABBIT_H
+
+#include "strciphr.h"
+#include "secblock.h"
+
+// The library does not have a way to describe an optional IV. Rabbit takes
+// an optional IV so two classes are offered to bridge the gap. One provides
+// Rabbit without an IV and the second provides Rabbit with an IV.
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Rabbit stream cipher information
+/// \since Crypto++ 8.0
+struct RabbitInfo : public FixedKeyLength<16, SimpleKeyingInterface::NOT_RESYNCHRONIZABLE>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "Rabbit"; }
+};
+
+/// \brief Rabbit stream cipher information
+/// \since Crypto++ 8.0
+struct RabbitWithIVInfo : public FixedKeyLength<16, SimpleKeyingInterface::UNIQUE_IV, 8>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "RabbitWithIV"; }
+};
+
+/// \brief Rabbit stream cipher implementation
+/// \since Crypto++ 8.0
+class RabbitPolicy : public AdditiveCipherConcretePolicy<word32, 4>, public RabbitInfo
+{
+protected:
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	bool CanOperateKeystream() const { return true; }
+	bool CipherIsRandomAccess() const { return false; }
+
+private:
+	// Master and working states
+	FixedSizeSecBlock<word32, 8> m_mx, m_mc, m_wx, m_wc;
+	// Workspace
+	FixedSizeSecBlock<word32, 12> m_t;
+	word32 m_mcy, m_wcy;  // carry
+};
+
+/// \brief Rabbit stream cipher implementation
+/// \since Crypto++ 8.0
+class RabbitWithIVPolicy : public AdditiveCipherConcretePolicy<word32, 4>, public RabbitWithIVInfo
+{
+protected:
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	void CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length);
+	bool CanOperateKeystream() const { return true; }
+	bool CipherIsRandomAccess() const { return false; }
+
+private:
+	// Master and working states
+	FixedSizeSecBlock<word32, 8> m_mx, m_mc, m_wx, m_wc;
+	// Workspace
+	FixedSizeSecBlock<word32, 12> m_t;
+	word32 m_mcy, m_wcy;  // carry
+};
+
+/// \brief Rabbit stream cipher
+/// \details Rabbit is a stream cipher developed by Martin Boesgaard, Mette Vesterager,
+///   Thomas Pedersen, Jesper Christiansen and Ove Scavenius. Rabbit is one of the final four
+///   Profile 1 (software) ciphers selected for the eSTREAM portfolio.
+/// \details Crypto++ provides Rabbit and RabbitWithIV classes. Two classes are necessary
+///   because the library lacks the means to describe and manage optional IVs.
+/// \sa RabbitWithIV, <A HREF="http://www.ecrypt.eu.org/stream/e2-rabbit.html">The
+///   eSTREAM Project | Rabbit</A> and
+///   <A HREF="https://www.cryptopp.com/wiki/Rabbit">Crypto++ Wiki | Rabbit</A>.
+/// \since Crypto++ 8.0
+struct Rabbit : public RabbitInfo, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<RabbitPolicy, AdditiveCipherTemplate<> >, RabbitInfo> Encryption;
+	typedef Encryption Decryption;
+};
+
+/// \brief Rabbit stream cipher
+/// \details Rabbit is a stream cipher developed by Martin Boesgaard, Mette Vesterager,
+///   Thomas Pedersen, Jesper Christiansen and Ove Scavenius. Rabbit is one of the final four
+///   Profile 1 (software) ciphers selected for the eSTREAM portfolio.
+/// \details Crypto++ provides Rabbit and RabbitWithIV classes. Two classes are necessary
+///   because the library lacks the means to describe and manage optional IVs.
+/// \sa Rabbit, <A HREF="http://www.ecrypt.eu.org/stream/e2-rabbit.html">The
+///   eSTREAM Project | Rabbit</A> and
+///   <A HREF="https://www.cryptopp.com/wiki/Rabbit">Crypto++ Wiki | Rabbit</A>.
+/// \since Crypto++ 8.0
+struct RabbitWithIV : public RabbitWithIVInfo, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<RabbitWithIVPolicy, AdditiveCipherTemplate<> >, RabbitWithIVInfo> Encryption;
+	typedef Encryption Decryption;
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_RABBIT_H
diff --git a/runtime/third_party/cryptopp/rabin.cpp b/runtime/third_party/cryptopp/rabin.cpp
new file mode 100644
index 0000000..b942dee
--- /dev/null
+++ b/runtime/third_party/cryptopp/rabin.cpp
@@ -0,0 +1,241 @@
+// rabin.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "rabin.h"
+#include "integer.h"
+#include "nbtheory.h"
+#include "modarith.h"
+#include "asn.h"
+#include "sha.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void RabinFunction::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	m_n.BERDecode(seq);
+	m_r.BERDecode(seq);
+	m_s.BERDecode(seq);
+	seq.MessageEnd();
+}
+
+void RabinFunction::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+	m_n.DEREncode(seq);
+	m_r.DEREncode(seq);
+	m_s.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+Integer RabinFunction::ApplyFunction(const Integer &in) const
+{
+	DoQuickSanityCheck();
+
+	Integer out = in.Squared()%m_n;
+	if (in.IsOdd())
+		out = out*m_r%m_n;
+	if (Jacobi(in, m_n)==-1)
+		out = out*m_s%m_n;
+	return out;
+}
+
+bool RabinFunction::Validate(RandomNumberGenerator& /*rng*/, unsigned int level) const
+{
+	bool pass = true;
+	pass = pass && m_n > Integer::One() && m_n%4 == 1;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_r > Integer::One() && m_r < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_s > Integer::One() && m_s < m_n;
+	CRYPTOPP_ASSERT(pass);
+	if (level >= 1)
+	{
+		pass = pass && Jacobi(m_r, m_n) == -1 && Jacobi(m_s, m_n) == -1;
+		CRYPTOPP_ASSERT(pass);
+	}
+	return pass;
+}
+
+bool RabinFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_GET_FUNCTION_ENTRY(QuadraticResidueModPrime1)
+		CRYPTOPP_GET_FUNCTION_ENTRY(QuadraticResidueModPrime2)
+		;
+}
+
+void RabinFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_SET_FUNCTION_ENTRY(QuadraticResidueModPrime1)
+		CRYPTOPP_SET_FUNCTION_ENTRY(QuadraticResidueModPrime2)
+		;
+}
+
+// *****************************************************************************
+// private key operations:
+
+// generate a random private key
+void InvertibleRabinFunction::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg)
+{
+	int modulusSize = 2048;
+	alg.GetIntValue("ModulusSize", modulusSize) || alg.GetIntValue("KeySize", modulusSize);
+
+	if (modulusSize < 16)
+		throw InvalidArgument("InvertibleRabinFunction: specified modulus size is too small");
+
+	// VC70 workaround: putting these after primeParam causes overlapped stack allocation
+	bool rFound=false, sFound=false;
+	Integer t=2;
+
+	AlgorithmParameters primeParam = MakeParametersForTwoPrimesOfEqualSize(modulusSize)
+		("EquivalentTo", 3)("Mod", 4);
+	m_p.GenerateRandom(rng, primeParam);
+	m_q.GenerateRandom(rng, primeParam);
+
+	while (!(rFound && sFound))
+	{
+		int jp = Jacobi(t, m_p);
+		int jq = Jacobi(t, m_q);
+
+		if (!rFound && jp==1 && jq==-1)
+		{
+			m_r = t;
+			rFound = true;
+		}
+
+		if (!sFound && jp==-1 && jq==1)
+		{
+			m_s = t;
+			sFound = true;
+		}
+
+		++t;
+	}
+
+	m_n = m_p * m_q;
+	m_u = m_q.InverseMod(m_p);
+}
+
+void InvertibleRabinFunction::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	m_n.BERDecode(seq);
+	m_r.BERDecode(seq);
+	m_s.BERDecode(seq);
+	m_p.BERDecode(seq);
+	m_q.BERDecode(seq);
+	m_u.BERDecode(seq);
+	seq.MessageEnd();
+}
+
+void InvertibleRabinFunction::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+	m_n.DEREncode(seq);
+	m_r.DEREncode(seq);
+	m_s.DEREncode(seq);
+	m_p.DEREncode(seq);
+	m_q.DEREncode(seq);
+	m_u.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+Integer InvertibleRabinFunction::CalculateInverse(RandomNumberGenerator &rng, const Integer &in) const
+{
+	DoQuickSanityCheck();
+
+	ModularArithmetic modn(m_n);
+	Integer r(rng, Integer::One(), m_n - Integer::One());
+	r = modn.Square(r);
+	Integer r2 = modn.Square(r);
+	Integer c = modn.Multiply(in, r2);		// blind
+
+	Integer cp=c%m_p, cq=c%m_q;
+
+	int jp = Jacobi(cp, m_p);
+	int jq = Jacobi(cq, m_q);
+
+	if (jq==-1)
+	{
+		cp = cp*EuclideanMultiplicativeInverse(m_r, m_p)%m_p;
+		cq = cq*EuclideanMultiplicativeInverse(m_r, m_q)%m_q;
+	}
+
+	if (jp==-1)
+	{
+		cp = cp*EuclideanMultiplicativeInverse(m_s, m_p)%m_p;
+		cq = cq*EuclideanMultiplicativeInverse(m_s, m_q)%m_q;
+	}
+
+	cp = ModularSquareRoot(cp, m_p);
+	cq = ModularSquareRoot(cq, m_q);
+
+	if (jp==-1)
+		cp = m_p-cp;
+
+	Integer out = CRT(cq, m_q, cp, m_p, m_u);
+
+	out = modn.Divide(out, r);	// unblind
+
+	if ((jq==-1 && out.IsEven()) || (jq==1 && out.IsOdd()))
+		out = m_n-out;
+
+	return out;
+}
+
+bool InvertibleRabinFunction::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+	bool pass = RabinFunction::Validate(rng, level);
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_p > Integer::One() && m_p%4 == 3 && m_p < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_q > Integer::One() && m_q%4 == 3 && m_q < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_u.IsPositive() && m_u < m_p;
+	CRYPTOPP_ASSERT(pass);
+	if (level >= 1)
+	{
+		pass = pass && m_p * m_q == m_n;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && m_u * m_q % m_p == 1;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && Jacobi(m_r, m_p) == 1;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && Jacobi(m_r, m_q) == -1;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && Jacobi(m_s, m_p) == -1;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && Jacobi(m_s, m_q) == 1;
+		CRYPTOPP_ASSERT(pass);
+	}
+	if (level >= 2)
+	{
+		pass = pass && VerifyPrime(rng, m_p, level-2) && VerifyPrime(rng, m_q, level-2);
+		CRYPTOPP_ASSERT(pass);
+	}
+	return pass;
+}
+
+bool InvertibleRabinFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper<RabinFunction>(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime2)
+		CRYPTOPP_GET_FUNCTION_ENTRY(MultiplicativeInverseOfPrime2ModPrime1)
+		;
+}
+
+void InvertibleRabinFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper<RabinFunction>(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime2)
+		CRYPTOPP_SET_FUNCTION_ENTRY(MultiplicativeInverseOfPrime2ModPrime1)
+		;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/rabin.h b/runtime/third_party/cryptopp/rabin.h
new file mode 100644
index 0000000..f127157
--- /dev/null
+++ b/runtime/third_party/cryptopp/rabin.h
@@ -0,0 +1,135 @@
+// rabin.h - originally written and placed in the public domain by Wei Dai
+
+/// \file rabin.h
+/// \brief Classes for Rabin encryption and signature schemes
+
+#ifndef CRYPTOPP_RABIN_H
+#define CRYPTOPP_RABIN_H
+
+#include "cryptlib.h"
+#include "oaep.h"
+#include "pssr.h"
+#include "integer.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Rabin trapdoor function using the public key
+/// \since Crypto++ 2.0
+class RabinFunction : public TrapdoorFunction, public PublicKey
+{
+	typedef RabinFunction ThisClass;
+
+public:
+
+	/// \brief Initialize a Rabin public key
+	/// \param n the modulus
+	/// \param r element r
+	/// \param s element s
+	void Initialize(const Integer &n, const Integer &r, const Integer &s)
+		{m_n = n; m_r = r; m_s = s;}
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	Integer ApplyFunction(const Integer &x) const;
+	Integer PreimageBound() const {return m_n;}
+	Integer ImageBound() const {return m_n;}
+
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+
+	const Integer& GetModulus() const {return m_n;}
+	const Integer& GetQuadraticResidueModPrime1() const {return m_r;}
+	const Integer& GetQuadraticResidueModPrime2() const {return m_s;}
+
+	void SetModulus(const Integer &n) {m_n = n;}
+	void SetQuadraticResidueModPrime1(const Integer &r) {m_r = r;}
+	void SetQuadraticResidueModPrime2(const Integer &s) {m_s = s;}
+
+protected:
+	Integer m_n, m_r, m_s;
+};
+
+/// \brief Rabin trapdoor function using the private key
+/// \since Crypto++ 2.0
+class InvertibleRabinFunction : public RabinFunction, public TrapdoorFunctionInverse, public PrivateKey
+{
+	typedef InvertibleRabinFunction ThisClass;
+
+public:
+
+	/// \brief Initialize a Rabin private key
+	/// \param n modulus
+	/// \param r element r
+	/// \param s element s
+	/// \param p first prime factor
+	/// \param q second prime factor
+	/// \param u q<sup>-1</sup> mod p
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	void Initialize(const Integer &n, const Integer &r, const Integer &s, const Integer &p, const Integer &q, const Integer &u)
+		{m_n = n; m_r = r; m_s = s; m_p = p; m_q = q; m_u = u;}
+
+	/// \brief Create a Rabin private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param keybits the size of the key, in bits
+	/// \details This function overload of Initialize() creates a new private key because it
+	///   takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+	///   then use one of the other Initialize() overloads.
+	void Initialize(RandomNumberGenerator &rng, unsigned int keybits)
+		{GenerateRandomWithKeySize(rng, keybits);}
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	Integer CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const;
+
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+	/*! parameters: (ModulusSize) */
+	void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
+
+	const Integer& GetPrime1() const {return m_p;}
+	const Integer& GetPrime2() const {return m_q;}
+	const Integer& GetMultiplicativeInverseOfPrime2ModPrime1() const {return m_u;}
+
+	void SetPrime1(const Integer &p) {m_p = p;}
+	void SetPrime2(const Integer &q) {m_q = q;}
+	void SetMultiplicativeInverseOfPrime2ModPrime1(const Integer &u) {m_u = u;}
+
+protected:
+	Integer m_p, m_q, m_u;
+};
+
+/// \brief Rabin keys
+struct Rabin
+{
+	static std::string StaticAlgorithmName() {return "Rabin-Crypto++Variant";}
+	typedef RabinFunction PublicKey;
+	typedef InvertibleRabinFunction PrivateKey;
+};
+
+/// \brief Rabin encryption scheme
+/// \tparam STANDARD encryption standard
+template <class STANDARD>
+struct RabinES : public TF_ES<Rabin, STANDARD>
+{
+};
+
+/// \brief Rabin signature scheme
+/// \tparam STANDARD signature standard
+/// \tparam H hash transformation
+template <class STANDARD, class H>
+struct RabinSS : public TF_SS<Rabin, STANDARD, H>
+{
+};
+
+// More typedefs for backwards compatibility
+class SHA1;
+typedef RabinES<OAEP<SHA1> >::Decryptor RabinDecryptor;
+typedef RabinES<OAEP<SHA1> >::Encryptor RabinEncryptor;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/randpool.cpp b/runtime/third_party/cryptopp/randpool.cpp
new file mode 100644
index 0000000..a60a680
--- /dev/null
+++ b/runtime/third_party/cryptopp/randpool.cpp
@@ -0,0 +1,174 @@
+// randpool.cpp - originally written and placed in the public domain by Wei Dai
+// RandomPool used to follow the design of randpool in PGP 2.6.x,
+// but as of version 5.5 it has been redesigned to reduce the risk
+// of reusing random numbers after state rollback (which may occur
+// when running in a virtual machine like VMware).
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "randpool.h"
+#include "aes.h"
+#include "sha.h"
+#include "hrtimer.h"
+#include "trap.h"
+
+// OldRandomPool
+#include "mdc.h"
+#include "modes.h"
+
+#include <time.h>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+RandomPool::RandomPool()
+	: m_pCipher(new AES::Encryption), m_keySet(false)
+{
+	std::memset(m_key, 0, m_key.SizeInBytes());
+	std::memset(m_seed, 0, m_seed.SizeInBytes());
+}
+
+void RandomPool::IncorporateEntropy(const byte *input, size_t length)
+{
+	SHA256 hash;
+	hash.Update(m_key, 32);
+	hash.Update(input, length);
+	hash.Final(m_key);
+	m_keySet = false;
+}
+
+void RandomPool::GenerateIntoBufferedTransformation(BufferedTransformation &target, const std::string &channel, lword size)
+{
+	if (size > 0)
+	{
+		if (!m_keySet)
+			m_pCipher->SetKey(m_key, 32);
+
+		CRYPTOPP_COMPILE_ASSERT(sizeof(TimerWord) <= 16);
+		CRYPTOPP_COMPILE_ASSERT(sizeof(time_t) <= 8);
+
+		Timer timer;
+		TimerWord tw = timer.GetCurrentTimerValue();
+
+		*(TimerWord *)(void*)m_seed.data() += tw;
+		time_t t = time(NULLPTR);
+
+		// UBsan finding: signed integer overflow: 1876017710 + 1446085457 cannot be represented in type 'long int'
+		// *(time_t *)(m_seed.data()+8) += t;
+		word64 tt1 = 0, tt2 = (word64)t;
+		std::memcpy(&tt1, m_seed.data()+8, 8);
+		std::memcpy(m_seed.data()+8, &(tt2 += tt1), 8);
+
+		// Wipe the intermediates
+		*((volatile TimerWord*)&tw) = 0;
+		*((volatile word64*)&tt1) = 0;
+		*((volatile word64*)&tt2) = 0;
+
+		do
+		{
+			m_pCipher->ProcessBlock(m_seed);
+			size_t len = UnsignedMin(16u, size);
+			target.ChannelPut(channel, m_seed, len);
+			size -= len;
+		} while (size > 0);
+	}
+}
+
+// OldRandomPool is provided for backwards compatibility for a migration path
+typedef MDC<SHA1> OldRandomPoolCipher;
+
+OldRandomPool::OldRandomPool(unsigned int poolSize)
+        : pool(poolSize), key(OldRandomPoolCipher::DEFAULT_KEYLENGTH), addPos(0), getPos(poolSize)
+{
+	CRYPTOPP_ASSERT(poolSize > key.size());
+	std::memset(pool, 0, poolSize);
+	std::memset(key, 0, key.size());
+}
+
+void OldRandomPool::IncorporateEntropy(const byte *input, size_t length)
+{
+	size_t t;
+	while (length > (t = pool.size() - addPos))
+	{
+		xorbuf(pool+addPos, input, t);
+		input += t;
+		length -= t;
+		Stir();
+	}
+
+	if (length)
+	{
+		xorbuf(pool+addPos, input, length);
+		addPos += length;
+		getPos = pool.size(); // Force stir on get
+	}
+}
+
+// GenerateWord32 is overridden and provides Crypto++ 5.4 behavior.
+// Taken from RandomNumberGenerator::GenerateWord32 in cryptlib.cpp.
+word32 OldRandomPool::GenerateWord32 (word32 min, word32 max)
+{
+	const word32 range = max-min;
+	const unsigned int maxBytes = BytePrecision(range);
+	const unsigned int maxBits = BitPrecision(range);
+
+	word32 value;
+
+	do
+	{
+		value = 0;
+		for (unsigned int i=0; i<maxBytes; i++)
+			value = (value << 8) | GenerateByte();
+
+		value = Crop(value, maxBits);
+	} while (value > range);
+
+	return value+min;
+}
+
+void OldRandomPool::Stir()
+{
+	CFB_Mode<OldRandomPoolCipher>::Encryption cipher;
+
+	for (int i=0; i<2; i++)
+	{
+		cipher.SetKeyWithIV(key, key.size(), pool.end()-cipher.IVSize());
+		cipher.ProcessString(pool, pool.size());
+		std::memcpy(key, pool, key.size());
+	}
+
+	addPos = 0;
+	getPos = key.size();
+}
+
+void OldRandomPool::GenerateIntoBufferedTransformation(BufferedTransformation &target, const std::string &channel, lword size)
+{
+	while (size > 0)
+	{
+		if (getPos == pool.size())
+				Stir();
+		size_t t = UnsignedMin(pool.size() - getPos, size);
+		target.ChannelPut(channel, pool+getPos, t);
+		size -= t;
+		getPos += t;
+	}
+}
+
+byte OldRandomPool::GenerateByte()
+{
+	if (getPos == pool.size())
+		Stir();
+
+	return pool[getPos++];
+}
+
+void OldRandomPool::GenerateBlock(byte *outString, size_t size)
+{
+	ArraySink sink(outString, size);
+	GenerateIntoBufferedTransformation(sink, DEFAULT_CHANNEL, size);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/randpool.h b/runtime/third_party/cryptopp/randpool.h
new file mode 100644
index 0000000..51227c3
--- /dev/null
+++ b/runtime/third_party/cryptopp/randpool.h
@@ -0,0 +1,104 @@
+// randpool.h - originally written and placed in the public domain by Wei Dai
+//              OldRandPool added by JW in August, 2017.
+
+/// \file randpool.h
+/// \brief Class file for Randomness Pool
+/// \details RandomPool can be used to generate cryptographic quality pseudorandom bytes
+///  after seeding the pool with IncorporateEntropy(). Internally, the generator uses
+///  AES-256 to produce the stream. Entropy is stirred in using SHA-256.
+/// \details RandomPool used to follow the design of randpool in PGP 2.6.x. At version 5.5
+///  RandomPool was redesigned to reduce the risk of reusing random numbers after state
+///  rollback (which may occur when running in a virtual machine like VMware or a hosted
+///  environment).
+/// \details If you need the pre-Crypto++ 5.5 generator then use OldRandomPool class. You
+///  should migrate away from OldRandomPool at the earliest opportunity. Use RandomPool
+///  or AutoSeededRandomPool instead.
+/// \since Crypto++ 4.0 (PGP 2.6.x style), Crypto++ 5.5 (AES-256 based)
+
+#ifndef CRYPTOPP_RANDPOOL_H
+#define CRYPTOPP_RANDPOOL_H
+
+#include "cryptlib.h"
+#include "filters.h"
+#include "secblock.h"
+#include "smartptr.h"
+#include "aes.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Randomness Pool based on AES-256
+/// \details RandomPool can be used to generate cryptographic quality pseudorandom bytes
+///  after seeding the pool with IncorporateEntropy(). Internally, the generator uses
+///  AES-256 to produce the stream. Entropy is stirred in using SHA-256.
+/// \details RandomPool used to follow the design of randpool in PGP 2.6.x. At version 5.5
+///  RandomPool was redesigned to reduce the risk of reusing random numbers after state
+///  rollback, which may occur when running in a virtual machine like VMware or a hosted
+///  environment.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \details If you need the pre-Crypto++ 5.5 generator then use OldRandomPool class. You
+///  should migrate away from OldRandomPool at the earliest opportunity.
+/// \sa OldRandomPool
+/// \since Crypto++ 4.0 (PGP 2.6.x style), Crypto++ 5.5 (AES-256 based)
+class CRYPTOPP_DLL RandomPool : public RandomNumberGenerator, public NotCopyable
+{
+public:
+	/// \brief Construct a RandomPool
+	RandomPool();
+
+	bool CanIncorporateEntropy() const {return true;}
+	void IncorporateEntropy(const byte *input, size_t length);
+	void GenerateIntoBufferedTransformation(BufferedTransformation &target, const std::string &channel, lword size);
+
+private:
+	FixedSizeAlignedSecBlock<byte, 16, true> m_seed;
+	FixedSizeAlignedSecBlock<byte, 32> m_key;
+	member_ptr<BlockCipher> m_pCipher;
+	bool m_keySet;
+};
+
+/// \brief Randomness Pool based on PGP 2.6.x with MDC
+/// \details If you need the pre-Crypto++ 5.5 generator then use OldRandomPool class. The
+///  OldRandomPool also provides the modern interface, including <tt>CanIncorporateEntropy</tt>,
+///  <tt>IncorporateEntropy</tt> and <tt>GenerateIntoBufferedTransformation</tt>.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \details You should migrate away from OldRandomPool at the earliest opportunity. Use a
+///  modern random number generator or key derivation function, like AutoSeededRandomPool or
+///  HKDF.
+/// \warning This class uses an old style PGP 2.6.x with MDC. The generator risks reusing
+///  random numbers after state rollback. You should migrate away from OldRandomPool at
+///  the earliest opportunity.
+/// \sa RandomPool, AutoSeededRandomPool, HKDF, P1363_KDF2, PKCS12_PBKDF, PKCS5_PBKDF2_HMAC
+/// \since Crypto++ 6.0
+class CRYPTOPP_DLL OldRandomPool : public RandomNumberGenerator
+{
+public:
+	/// \brief Construct an OldRandomPool
+	/// \param poolSize internal pool size of the generator
+	/// \details poolSize must be greater than 16
+	OldRandomPool(unsigned int poolSize=384);
+
+	// RandomNumberGenerator interface (Crypto++ 5.5 and above)
+	bool CanIncorporateEntropy() const {return true;}
+	void IncorporateEntropy(const byte *input, size_t length);
+	void GenerateIntoBufferedTransformation(BufferedTransformation &target, const std::string &channel, lword size);
+
+	byte GenerateByte();
+	void GenerateBlock(byte *output, size_t size);
+
+	// GenerateWord32 is overridden and provides Crypto++ 5.4 behavior.
+	// Taken from RandomNumberSource::GenerateWord32 in cryptlib.cpp.
+	word32 GenerateWord32 (word32 min=0, word32 max=0xffffffffUL);
+
+protected:
+	void Stir();
+
+private:
+	SecByteBlock pool, key;
+	size_t addPos, getPos;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rc2.cpp b/runtime/third_party/cryptopp/rc2.cpp
new file mode 100644
index 0000000..8abdb7a
--- /dev/null
+++ b/runtime/third_party/cryptopp/rc2.cpp
@@ -0,0 +1,118 @@
+// rc2.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "rc2.h"
+#include "misc.h"
+#include "argnames.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void RC2::Base::UncheckedSetKey(const byte *key, unsigned int keyLen, const NameValuePairs &params)
+{
+	AssertValidKeyLength(keyLen);
+
+	int effectiveLen = params.GetIntValueWithDefault(Name::EffectiveKeyLength(), DEFAULT_EFFECTIVE_KEYLENGTH);
+	if (effectiveLen > MAX_EFFECTIVE_KEYLENGTH)
+		throw InvalidArgument("RC2: effective key length parameter exceeds maximum");
+
+	static const unsigned char PITABLE[256] = {
+		217,120,249,196, 25,221,181,237, 40,233,253,121, 74,160,216,157,
+		198,126, 55,131, 43,118, 83,142, 98, 76,100,136, 68,139,251,162,
+		 23,154, 89,245,135,179, 79, 19, 97, 69,109,141,  9,129,125, 50,
+		189,143, 64,235,134,183,123, 11,240,149, 33, 34, 92,107, 78,130,
+		 84,214,101,147,206, 96,178, 28,115, 86,192, 20,167,140,241,220,
+		 18,117,202, 31, 59,190,228,209, 66, 61,212, 48,163, 60,182, 38,
+		111,191, 14,218, 70,105,  7, 87, 39,242, 29,155,188,148, 67,  3,
+		248, 17,199,246,144,239, 62,231,  6,195,213, 47,200,102, 30,215,
+		  8,232,234,222,128, 82,238,247,132,170,114,172, 53, 77,106, 42,
+		150, 26,210,113, 90, 21, 73,116, 75,159,208, 94,  4, 24,164,236,
+		194,224, 65,110, 15, 81,203,204, 36,145,175, 80,161,244,112, 57,
+		153,124, 58,133, 35,184,180,122,252,  2, 54, 91, 37, 85,151, 49,
+		 45, 93,250,152,227,138,146,174,  5,223, 41, 16,103,108,186,201,
+		211,  0,230,207,225,158,168, 44, 99, 22,  1, 63, 88,226,137,169,
+		 13, 56, 52, 27,171, 51,255,176,187, 72, 12, 95,185,177,205, 46,
+		197,243,219, 71,229,165,156,119, 10,166, 32,104,254,127,193,173};
+
+	SecByteBlock L(128);
+	std::memcpy(L, key, keyLen);
+
+	int i;
+	for (i=keyLen; i<128; i++)
+		L[i] = PITABLE[(L[i-1] + L[i-keyLen]) & 255];
+
+	unsigned int T8 = (effectiveLen+7) / 8;
+	byte TM = byte((int)255 >> ((8-(effectiveLen%8))%8));
+	L[128-T8] = PITABLE[L[128-T8] & TM];
+
+	for (i=127-T8; i>=0; i--)
+		L[i] = PITABLE[L[i+1] ^ L[i+T8]];
+
+	for (i=0; i<64; i++)
+		K[i] = L[2*i] + (L[2*i+1] << 8);
+}
+
+typedef BlockGetAndPut<word16, LittleEndian> Block;
+
+void RC2::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word16 R0, R1, R2, R3;
+	Block::Get(inBlock)(R0)(R1)(R2)(R3);
+
+	for (int i = 0; i < 16; i++)
+	{
+		R0 += (R1 & ~R3) + (R2 & R3) + K[4*i+0];
+		R0 = rotlConstant<1>(R0);
+
+		R1 += (R2 & ~R0) + (R3 & R0) + K[4*i+1];
+		R1 = rotlConstant<2>(R1);
+
+		R2 += (R3 & ~R1) + (R0 & R1) + K[4*i+2];
+		R2 = rotlConstant<3>(R2);
+
+		R3 += (R0 & ~R2) + (R1 & R2) + K[4*i+3];
+		R3 = rotlConstant<5>(R3);
+
+		if (i == 4 || i == 10)
+		{
+			R0 = word16(R0 + K[R3 & 63]);
+			R1 = word16(R1 + K[R0 & 63]);
+			R2 = word16(R2 + K[R1 & 63]);
+			R3 = word16(R3 + K[R2 & 63]);
+		}
+	}
+
+	Block::Put(xorBlock, outBlock)(R0)(R1)(R2)(R3);
+}
+
+void RC2::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word16 R0, R1, R2, R3;
+	Block::Get(inBlock)(R0)(R1)(R2)(R3);
+
+	for (int i = 15; i >= 0; i--)
+	{
+		if (i == 4 || i == 10)
+		{
+			R3 = word16(R3 - K[R2 & 63]);
+			R2 = word16(R2 - K[R1 & 63]);
+			R1 = word16(R1 - K[R0 & 63]);
+			R0 = word16(R0 - K[R3 & 63]);
+		}
+
+		R3 = rotrConstant<5>(R3);
+		R3 = word16(R3 - ((R0 & ~R2) + (R1 & R2) + K[4*i+3]));
+
+		R2 = rotrConstant<3>(R2);
+		R2 = word16(R2 - ((R3 & ~R1) + (R0 & R1) + K[4*i+2]));
+
+		R1 = rotrConstant<2>(R1);
+		R1 = word16(R1 - ((R2 & ~R0) + (R3 & R0) + K[4*i+1]));
+
+		R0 = rotrConstant<1>(R0);
+		R0 = word16(R0 - ((R1 & ~R3) + (R2 & R3) + K[4*i+0]));
+	}
+
+	Block::Put(xorBlock, outBlock)(R0)(R1)(R2)(R3);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/rc2.h b/runtime/third_party/cryptopp/rc2.h
new file mode 100644
index 0000000..1b296d2
--- /dev/null
+++ b/runtime/third_party/cryptopp/rc2.h
@@ -0,0 +1,90 @@
+// rc2.h - originally written and placed in the public domain by Wei Dai
+
+/// \file rc2.h
+/// \brief Classes for the RC2 block cipher
+/// \since Crypto++ 3.0
+
+#ifndef CRYPTOPP_RC2_H
+#define CRYPTOPP_RC2_H
+
+#include "seckey.h"
+#include "secblock.h"
+#include "algparam.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief RC2 block cipher information
+/// \since Crypto++ 3.0
+struct RC2_Info : public FixedBlockSize<8>, public VariableKeyLength<16, 1, 128>
+{
+	CRYPTOPP_CONSTANT(DEFAULT_EFFECTIVE_KEYLENGTH = 1024);
+	CRYPTOPP_CONSTANT(MAX_EFFECTIVE_KEYLENGTH = 1024);
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "RC2";}
+};
+
+/// \brief RC2 block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/RC2">RC2</a> on the Crypto Lounge.
+/// \since Crypto++ 3.0
+class RC2 : public RC2_Info, public BlockCipherDocumentation
+{
+	/// \brief Class specific methods used to operate the cipher.
+	/// \details Implementations and overrides in \p Base apply to both \p ENCRYPTION and \p DECRYPTION directions
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<RC2_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+		unsigned int OptimalDataAlignment() const {return GetAlignmentOf<word16>();}
+
+	protected:
+		FixedSizeSecBlock<word16, 64> K;  // expanded key table
+	};
+
+	/// \brief Class specific methods used to operate the cipher in the forward direction.
+	/// \details Implementations and overrides in \p Enc apply to \p ENCRYPTION.
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief Class specific methods used to operate the cipher in the reverse direction.
+	/// \details Implementations and overrides in \p Dec apply to \p DECRYPTION.
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+
+	/// \brief Class specific methods used to operate the cipher in the forward direction.
+	/// \details Implementations and overrides in \p Encryption apply to \p ENCRYPTION.
+	class Encryption : public BlockCipherFinal<ENCRYPTION, Enc>
+	{
+	public:
+		Encryption() {}
+		Encryption(const byte *key, size_t keyLen=DEFAULT_KEYLENGTH)
+			{SetKey(key, keyLen);}
+		Encryption(const byte *key, size_t keyLen, int effectiveKeyLen)
+			{SetKey(key, keyLen, MakeParameters("EffectiveKeyLength", effectiveKeyLen));}
+	};
+
+	/// \brief Class specific methods used to operate the cipher in the reverse direction.
+	/// \details Implementations and overrides in \p Decryption apply to \p DECRYPTION.
+	class Decryption : public BlockCipherFinal<DECRYPTION, Dec>
+	{
+	public:
+		Decryption() {}
+		Decryption(const byte *key, size_t keyLen=DEFAULT_KEYLENGTH)
+			{SetKey(key, keyLen);}
+		Decryption(const byte *key, size_t keyLen, int effectiveKeyLen)
+			{SetKey(key, keyLen, MakeParameters("EffectiveKeyLength", effectiveKeyLen));}
+	};
+};
+
+typedef RC2::Encryption RC2Encryption;
+typedef RC2::Decryption RC2Decryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rc5.cpp b/runtime/third_party/cryptopp/rc5.cpp
new file mode 100644
index 0000000..c69c211
--- /dev/null
+++ b/runtime/third_party/cryptopp/rc5.cpp
@@ -0,0 +1,80 @@
+// rc5.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "rc5.h"
+#include "misc.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void RC5::Base::UncheckedSetKey(const byte *k, unsigned int keylen, const NameValuePairs &params)
+{
+	AssertValidKeyLength(keylen);
+
+	r = GetRoundsAndThrowIfInvalid(params, this);
+	sTable.New(2*(r+1));
+
+	static const RC5_WORD MAGIC_P = 0xb7e15163L;    // magic constant P for wordsize
+	static const RC5_WORD MAGIC_Q = 0x9e3779b9L;    // magic constant Q for wordsize
+	static const int U=sizeof(RC5_WORD);
+
+	const unsigned int c = STDMAX((keylen+U-1)/U, 1U);	// RC6 paper says c=1 if keylen==0
+	SecBlock<RC5_WORD> l(c);
+
+	GetUserKey(LITTLE_ENDIAN_ORDER, l.begin(), c, k, keylen);
+
+	sTable[0] = MAGIC_P;
+	for (unsigned j=1; j<sTable.size();j++)
+		sTable[j] = sTable[j-1] + MAGIC_Q;
+
+	RC5_WORD a=0, b=0;
+	const unsigned n = 3*STDMAX((unsigned int)sTable.size(), c);
+
+	for (unsigned h=0; h < n; h++)
+	{
+		a = sTable[h % sTable.size()] = rotlConstant<3>((sTable[h % sTable.size()] + a + b));
+		b = l[h % c] = rotlMod((l[h % c] + a + b), (a+b));
+	}
+}
+
+typedef BlockGetAndPut<RC5::RC5_WORD, LittleEndian> Block;
+
+void RC5::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	const RC5_WORD *sptr = sTable;
+	RC5_WORD a, b;
+
+	Block::Get(inBlock)(a)(b);
+	a += sptr[0];
+	b += sptr[1];
+	sptr += 2;
+
+	for(unsigned i=0; i<r; i++)
+	{
+		a = rotlMod(a^b,b) + sptr[2*i+0];
+		b = rotlMod(a^b,a) + sptr[2*i+1];
+	}
+
+	Block::Put(xorBlock, outBlock)(a)(b);
+}
+
+void RC5::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	const RC5_WORD *sptr = sTable.end();
+	RC5_WORD a, b;
+
+	Block::Get(inBlock)(a)(b);
+
+	for (unsigned i=0; i<r; i++)
+	{
+		sptr-=2;
+		b = rotrMod(b-sptr[1], a) ^ a;
+		a = rotrMod(a-sptr[0], b) ^ b;
+	}
+	b -= sTable[1];
+	a -= sTable[0];
+
+	Block::Put(xorBlock, outBlock)(a)(b);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/rc5.h b/runtime/third_party/cryptopp/rc5.h
new file mode 100644
index 0000000..541ffbc
--- /dev/null
+++ b/runtime/third_party/cryptopp/rc5.h
@@ -0,0 +1,59 @@
+// rc5.h - originally written and placed in the public domain by Wei Dai
+
+/// \file rc5.h
+/// \brief Classes for the RC5 block cipher
+
+#ifndef CRYPTOPP_RC5_H
+#define CRYPTOPP_RC5_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief RC5 block cipher information
+/// \since Crypto++ 1.0
+struct RC5_Info : public FixedBlockSize<8>, public VariableKeyLength<16, 0, 255>, public VariableRounds<16>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "RC5";}
+	typedef word32 RC5_WORD;
+};
+
+/// \brief RC5 block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/RC5">RC5</a>
+/// \since Crypto++ 1.0
+class RC5 : public RC5_Info, public BlockCipherDocumentation
+{
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<RC5_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		unsigned int r;       // number of rounds
+		SecBlock<RC5_WORD> sTable;  // expanded key table
+	};
+
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef RC5::Encryption RC5Encryption;
+typedef RC5::Decryption RC5Decryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rc6.cpp b/runtime/third_party/cryptopp/rc6.cpp
new file mode 100644
index 0000000..11ad291
--- /dev/null
+++ b/runtime/third_party/cryptopp/rc6.cpp
@@ -0,0 +1,96 @@
+// rc6.cpp - written and placed in the public domain by Sean Woods
+// based on Wei Dai's RC5 code.
+
+#include "pch.h"
+#include "rc6.h"
+#include "misc.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void RC6::Base::UncheckedSetKey(const byte *k, unsigned int keylen, const NameValuePairs &params)
+{
+	AssertValidKeyLength(keylen);
+
+	r = GetRoundsAndThrowIfInvalid(params, this);
+	sTable.New(2*(r+2));
+
+	static const RC6_WORD MAGIC_P = 0xb7e15163L;    // magic constant P for wordsize
+	static const RC6_WORD MAGIC_Q = 0x9e3779b9L;    // magic constant Q for wordsize
+	static const int U=sizeof(RC6_WORD);
+
+	const unsigned int c = STDMAX((keylen+U-1)/U, 1U);	// RC6 paper says c=1 if keylen==0
+	SecBlock<RC6_WORD> l(c);
+
+	GetUserKey(LITTLE_ENDIAN_ORDER, l.begin(), c, k, keylen);
+
+	sTable[0] = MAGIC_P;
+	for (unsigned j=1; j<sTable.size();j++)
+		sTable[j] = sTable[j-1] + MAGIC_Q;
+
+	RC6_WORD a=0, b=0;
+	const unsigned n = 3*STDMAX((unsigned int)sTable.size(), c);
+
+	for (unsigned h=0; h < n; h++)
+	{
+		a = sTable[h % sTable.size()] = rotlConstant<3>((sTable[h % sTable.size()] + a + b));
+		b = l[h % c] = rotlMod((l[h % c] + a + b), (a+b));
+	}
+}
+
+typedef BlockGetAndPut<RC6::RC6_WORD, LittleEndian> Block;
+
+void RC6::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	const RC6_WORD *sptr = sTable;
+	RC6_WORD a, b, c, d, t, u;
+
+	Block::Get(inBlock)(a)(b)(c)(d);
+	b += sptr[0];
+	d += sptr[1];
+	sptr += 2;
+
+	for(unsigned i=0; i<r; i++)
+	{
+		t = rotlConstant<5>(b*(2*b+1));
+		u = rotlConstant<5>(d*(2*d+1));
+		a = rotlMod(a^t,u) + sptr[0];
+		c = rotlMod(c^u,t) + sptr[1];
+		t = a; a = b; b = c; c = d; d = t;
+		sptr += 2;
+	}
+
+	a += sptr[0];
+	c += sptr[1];
+
+	Block::Put(xorBlock, outBlock)(a)(b)(c)(d);
+}
+
+void RC6::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	const RC6_WORD *sptr = sTable.end();
+	RC6_WORD a, b, c, d, t, u;
+
+	Block::Get(inBlock)(a)(b)(c)(d);
+
+	sptr -= 2;
+	c -= sptr[1];
+	a -= sptr[0];
+
+	for (unsigned i=0; i < r; i++)
+	{
+		sptr -= 2;
+		t = a; a = d; d = c; c = b; b = t;
+		u = rotlConstant<5>(d*(2 * d + 1));
+		t = rotlConstant<5>(b*(2 * b + 1));
+		c = rotrMod(c-sptr[1], t) ^ u;
+		a = rotrMod(a-sptr[0], u) ^ t;
+	}
+
+	d -= sTable[1];
+	b -= sTable[0];
+
+	Block::Put(xorBlock, outBlock)(a)(b)(c)(d);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/rc6.h b/runtime/third_party/cryptopp/rc6.h
new file mode 100644
index 0000000..7b80d35
--- /dev/null
+++ b/runtime/third_party/cryptopp/rc6.h
@@ -0,0 +1,60 @@
+// rc6.h - originally written and placed in the public domain by Wei Dai
+
+/// \file rc6.h
+/// \brief Classes for the RC6 block cipher
+/// \since Crypto++ 3.0
+
+#ifndef CRYPTOPP_RC6_H
+#define CRYPTOPP_RC6_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief RC6 block cipher information
+/// \since Crypto++ 3.0
+struct RC6_Info : public FixedBlockSize<16>, public VariableKeyLength<16, 16, 32, 8>, public VariableRounds<20>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "RC6";}
+	typedef word32 RC6_WORD;
+};
+
+/// \brief RC6 block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/RC6">RC6</a>
+/// \since Crypto++ 3.0
+class RC6 : public RC6_Info, public BlockCipherDocumentation
+{
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<RC6_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		unsigned int r;       // number of rounds
+		SecBlock<RC6_WORD> sTable;  // expanded key table
+	};
+
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef RC6::Encryption RC6Encryption;
+typedef RC6::Decryption RC6Decryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rdrand.asm b/runtime/third_party/cryptopp/rdrand.asm
new file mode 100644
index 0000000..25a3e89
--- /dev/null
+++ b/runtime/third_party/cryptopp/rdrand.asm
@@ -0,0 +1,232 @@
+;; rdrand.asm - written and placed in public domain by Jeffrey Walton and Uri Blumenthal.
+;;              Copyright assigned to the Crypto++ project.
+
+;; This ASM file provides RDRAND to downlevel Microsoft tool chains.
+;; Everything "just works" under Visual Studio. Other platforms will
+;; have to run MASM/MASM-64 and then link to the object files.
+
+;; set ASFLAGS=/nologo /D_M_X86 /W3 /Cx /Zi /safeseh
+;; set ASFLAGS64=/nologo /D_M_X64 /W3 /Cx /Zi
+;; "C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\bin\ml.exe" %ASFLAGS% /Fo rdrand-x86.obj /c rdrand.asm
+;; "C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\bin\amd64\ml64.exe" %ASFLAGS64% /Fo rdrand-x64.obj /c rdrand.asm
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+TITLE    MASM_RDRAND_GenerateBlock source file
+SUBTITLE Microsoft specific ASM code to utilize RDRAND for down level Microsoft toolchains
+
+PUBLIC MASM_RDRAND_GenerateBlock
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+;; C/C++ Function prototypes (both are fastcall)
+;;   X86:
+;;      extern "C" void __fastcall MASM_RDRAND_GenerateBlock(byte* ptr, size_t size);
+;;   X64:
+;;      extern "C" void __fastcall MASM_RDRAND_GenerateBlock(byte* ptr, size_t size);
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+IFDEF _M_X86    ;; Set via the command line
+
+.486
+.MODEL FLAT
+
+;; Fastcall calling conventions exports
+ALIAS <@MASM_RDRAND_GenerateBlock@8> = <MASM_RDRAND_GenerateBlock>
+
+ENDIF
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+IFDEF _M_X86    ;; Set via the command line
+
+.CODE
+ALIGN   8
+OPTION PROLOGUE:NONE
+OPTION EPILOGUE:NONE
+
+;; No need for Load_Arguments due to fastcall
+;;   ECX (in): arg1, byte* buffer
+;;   EDX (in): arg2, size_t bsize
+
+MASM_RDRAND_GenerateBlock PROC   ;; arg1:DWORD, arg2:DWORD
+
+    MWSIZE EQU 04h    ;; machine word size
+    buffer EQU ecx
+    bsize  EQU edx
+
+            ;; Top of While loop
+RDRAND_GenerateBlock_Top:
+
+            ;; Check remaining size
+    cmp     bsize, 0
+    je      RDRAND_GenerateBlock_Return
+
+RDRAND_Call_EAX:
+            ;; RDRAND is not available prior to VS2012. Just emit
+            ;;   the byte codes using DB. This is `rdrand eax`.
+    DB      0Fh, 0C7h, 0F0h
+
+            ;; If CF=1, the number returned by RDRAND is valid.
+            ;; If CF=0, a random number was not available.
+
+            ;; Retry immediately
+    jnc     RDRAND_Call_EAX
+
+RDRAND_succeeded:
+
+    cmp     bsize, MWSIZE
+    jb      RDRAND_Partial_Machine_Word
+
+RDRAND_Full_Machine_Word:
+
+    mov     DWORD PTR [buffer], eax
+    add     buffer, MWSIZE        ;; No need for Intel Core 2 slow workarounds, like
+    sub     bsize, MWSIZE         ;;   `lea buffer,[buffer+MWSIZE]` for faster adds
+
+            ;; Continue
+    jmp     RDRAND_GenerateBlock_Top
+
+            ;; 1,2,3 bytes remain
+RDRAND_Partial_Machine_Word:
+
+            ;; Test bit 1 to see if size is at least 2
+    test    bsize, 2
+    jz      RDRAND_Bit_1_Not_Set
+
+    mov     WORD PTR [buffer], ax
+    shr     eax, 16
+    add     buffer, 2
+
+RDRAND_Bit_1_Not_Set:
+
+            ;; Test bit 0 to see if size is at least 1
+    test    bsize, 1
+    jz      RDRAND_Bit_0_Not_Set
+
+    mov     BYTE PTR [buffer], al
+    ;; shr     ax, 8
+    ;; add     buffer, 1
+
+RDRAND_Bit_0_Not_Set:
+
+            ;; We've hit all the bits
+
+RDRAND_GenerateBlock_Return:
+
+            ;; Clear artifacts
+    xor     eax, eax
+    ret
+
+MASM_RDRAND_GenerateBlock ENDP
+
+ENDIF    ;; _M_X86
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+IFDEF _M_X64    ;; Set via the command line
+
+.CODE
+ALIGN   16
+OPTION PROLOGUE:NONE
+OPTION EPILOGUE:NONE
+
+;; No need for Load_Arguments due to fastcall
+;;   RCX (in): arg1, byte* buffer
+;;   RDX (in): arg2, size_t bsize
+
+MASM_RDRAND_GenerateBlock PROC FRAME ;; arg1:QWORD, arg2:QWORD
+
+    MWSIZE EQU 08h    ;; machine word size
+    buffer EQU rcx
+    bsize  EQU rdx
+
+.endprolog
+
+            ;; Top of While loop
+RDRAND_GenerateBlock_Top:
+
+            ;; Check remaining size
+    cmp     bsize, 0
+    je      RDRAND_GenerateBlock_Return
+
+RDRAND_Call_RAX:
+            ;; RDRAND is not available prior to VS2012. Just emit
+            ;;   the byte codes using DB. This is `rdrand rax`.
+    DB      048h, 0Fh, 0C7h, 0F0h
+
+            ;; If CF=1, the number returned by RDRAND is valid.
+            ;; If CF=0, a random number was not available.
+
+            ;; Retry immediately
+    jnc     RDRAND_Call_RAX
+
+RDRAND_succeeded:
+
+    cmp     bsize, MWSIZE
+    jb      RDRAND_Partial_Machine_Word
+
+RDRAND_Full_Machine_Word:
+
+    mov     QWORD PTR [buffer], rax
+    add     buffer, MWSIZE
+    sub     bsize, MWSIZE
+
+            ;; Continue
+    jmp     RDRAND_GenerateBlock_Top
+
+            ;; 1,2,3,4,5,6,7 bytes remain
+RDRAND_Partial_Machine_Word:
+
+            ;; Test bit 2 to see if size is at least 4
+    test    bsize, 4
+    jz      RDRAND_Bit_2_Not_Set
+
+    mov     DWORD PTR [buffer], eax
+    shr     rax, 32
+    add     buffer, 4
+
+RDRAND_Bit_2_Not_Set:
+
+            ;; Test bit 1 to see if size is at least 2
+    test    bsize, 2
+    jz      RDRAND_Bit_1_Not_Set
+
+    mov     WORD PTR [buffer], ax
+    shr     eax, 16
+    add     buffer, 2
+
+RDRAND_Bit_1_Not_Set:
+
+            ;; Test bit 0 to see if size is at least 1
+    test    bsize, 1
+    jz      RDRAND_Bit_0_Not_Set
+
+    mov     BYTE PTR [buffer], al
+    ;; shr     ax, 8
+    ;; add     buffer, 1
+
+RDRAND_Bit_0_Not_Set:
+
+            ;; We've hit all the bits
+
+RDRAND_GenerateBlock_Return:
+
+            ;; Clear artifacts
+    xor     rax, rax
+    ret
+
+MASM_RDRAND_GenerateBlock ENDP
+
+ENDIF    ;; _M_X64
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+END
diff --git a/runtime/third_party/cryptopp/rdrand.cpp b/runtime/third_party/cryptopp/rdrand.cpp
new file mode 100644
index 0000000..2444cfd
--- /dev/null
+++ b/runtime/third_party/cryptopp/rdrand.cpp
@@ -0,0 +1,327 @@
+// rdrand.cpp - written and placed in public domain by Jeffrey Walton and Uri Blumenthal.
+
+#include "pch.h"
+#include "config.h"
+#include "cryptlib.h"
+#include "secblock.h"
+#include "rdrand.h"
+#include "cpu.h"
+
+// This file (and friends) provides both RDRAND and RDSEED. They were added
+//   at Crypto++ 5.6.3. At compile time, it uses CRYPTOPP_BOOL_{X86|X32|X64}
+//   to select an implementation or throws "NotImplemented". Users of the
+//   classes should call HasRDRAND() or HasRDSEED() to determine if a
+//   generator is available at runtime.
+// The original classes accepted a retry count. Retries were superfluous for
+//   RDRAND, and RDSEED encountered a failure about 1 in 256 bytes depending
+//   on the processor. Retries were removed at Crypto++ 6.0 because
+//   GenerateBlock unconditionally retries and always fulfills the request.
+// Intel recommends using a retry count in case RDRAND or RDSEED circuit
+//   is bad. This implementation does not follow the advice and requires
+//   good silicon. If the circuit or processor is bad then the user has
+//   bigger problems than generating random numbers.
+
+/////////////////////////////////////////////////////////////////////
+/////////////////////////////////////////////////////////////////////
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4702)
+#endif
+
+#if defined(CRYPTOPP_RDRAND_AVAILABLE)
+# if defined(CRYPTOPP_MSC_VERSION)
+#   define MASM_RDRAND_ASM_AVAILABLE 1
+# endif
+# if (__SUNPRO_CC >= 0x5100) || (CRYPTOPP_APPLE_CLANG_VERSION >= 30000) || \
+     (CRYPTOPP_LLVM_CLANG_VERSION >= 20800) || (CRYPTOPP_GCC_VERSION >= 30200)
+#   define GCC_RDRAND_ASM_AVAILABLE 1
+# endif
+#endif  // CRYPTOPP_RDRAND_AVAILABLE
+
+#if defined(CRYPTOPP_RDSEED_AVAILABLE)
+# if defined(CRYPTOPP_MSC_VERSION)
+#   define MASM_RDSEED_ASM_AVAILABLE 1
+# endif
+# if (__SUNPRO_CC >= 0x5100) || (CRYPTOPP_APPLE_CLANG_VERSION >= 30000) || \
+     (CRYPTOPP_LLVM_CLANG_VERSION >= 20800) || (CRYPTOPP_GCC_VERSION >= 30200)
+#   define GCC_RDSEED_ASM_AVAILABLE 1
+# endif
+#endif  // CRYPTOPP_RDSEED_AVAILABLE
+
+typedef unsigned char byte;
+
+#if MASM_RDRAND_ASM_AVAILABLE
+extern "C" void CRYPTOPP_FASTCALL MASM_RDRAND_GenerateBlock(byte*, size_t);
+#endif
+
+#if MASM_RDSEED_ASM_AVAILABLE
+extern "C" void CRYPTOPP_FASTCALL MASM_RDSEED_GenerateBlock(byte*, size_t);
+#endif
+
+/////////////////////////////////////////////////////////////////////
+/////////////////////////////////////////////////////////////////////
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_RDRAND_AVAILABLE)
+
+// Fills 4 bytes
+inline void RDRAND32(void* output)
+{
+    CRYPTOPP_UNUSED(output);  // MSC warning
+# if defined(GCC_RDRAND_ASM_AVAILABLE)
+    __asm__ __volatile__
+    (
+        "1:\n"
+        ".byte 0x0f, 0xc7, 0xf0;\n"
+        "jnc 1b;\n"
+        : "=a" (*reinterpret_cast<word32*>(output))
+        : : "cc"
+    );
+# endif
+}
+
+# if (CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32)
+// Fills 8 bytes
+inline void RDRAND64(void* output)
+{
+    CRYPTOPP_UNUSED(output);  // MSC warning
+# if defined(GCC_RDRAND_ASM_AVAILABLE)
+    __asm__ __volatile__
+    (
+        "1:\n"
+        ".byte 0x48, 0x0f, 0xc7, 0xf0;\n"
+        "jnc 1b;\n"
+        : "=a" (*reinterpret_cast<word64*>(output))
+        : : "cc"
+    );
+# endif
+}
+# endif  // RDRAND64
+
+RDRAND::RDRAND()
+{
+    if (!HasRDRAND())
+        throw RDRAND_Err("HasRDRAND");
+}
+
+void RDRAND::GenerateBlock(byte *output, size_t size)
+{
+    CRYPTOPP_ASSERT((output && size) || !(output || size));
+    if (size == 0) return;
+
+# if defined(MASM_RDRAND_ASM_AVAILABLE)
+
+    MASM_RDRAND_GenerateBlock(output, size);
+
+# elif defined(GCC_RDRAND_ASM_AVAILABLE)
+
+#   if (CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32)
+    size_t i = 0;
+    for (i = 0; i < size/8; i++)
+        RDRAND64(output+i*8);
+
+    output += i*8;
+    size -= i*8;
+
+    if (size)
+    {
+        word64 val;
+        RDRAND64(&val);
+        std::memcpy(output, &val, size);
+    }
+#   else
+    size_t i = 0;
+    for (i = 0; i < size/4; i++)
+        RDRAND32(output+i*4);
+
+    output += i*4;
+    size -= i*4;
+
+    if (size)
+    {
+        word32 val;
+        RDRAND32(&val);
+        std::memcpy(output, &val, size);
+    }
+#   endif
+# else
+    // No suitable compiler found
+    CRYPTOPP_UNUSED(output);
+    throw NotImplemented("RDRAND: failed to find a suitable implementation");
+# endif
+}
+
+void RDRAND::DiscardBytes(size_t n)
+{
+    // RoundUpToMultipleOf is used because a full word is read, and its cheaper
+    //   to discard full words. There's no sense in dealing with tail bytes.
+    FixedSizeSecBlock<word64, 16> discard;
+    n = RoundUpToMultipleOf(n, sizeof(word64));
+
+    size_t count = STDMIN(n, discard.SizeInBytes());
+    while (count)
+    {
+        GenerateBlock(discard.BytePtr(), count);
+        n -= count;
+        count = STDMIN(n, discard.SizeInBytes());
+    }
+}
+
+#endif  // CRYPTOPP_RDRAND_AVAILABLE
+
+/////////////////////////////////////////////////////////////////////
+/////////////////////////////////////////////////////////////////////
+
+#if defined(CRYPTOPP_RDSEED_AVAILABLE)
+
+// Fills 4 bytes
+inline void RDSEED32(void* output)
+{
+    CRYPTOPP_UNUSED(output);  // MSC warning
+# if defined(GCC_RDSEED_ASM_AVAILABLE)
+    __asm__ __volatile__
+    (
+        "1:\n"
+        ".byte 0x0f, 0xc7, 0xf8;\n"
+        "jnc 1b;\n"
+        : "=a" (*reinterpret_cast<word32*>(output))
+        : : "cc"
+    );
+# endif
+}
+
+# if (CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32)
+// Fills 8 bytes
+inline void RDSEED64(void* output)
+{
+    CRYPTOPP_UNUSED(output);  // MSC warning
+# if defined(GCC_RDSEED_ASM_AVAILABLE)
+    __asm__ __volatile__
+    (
+        "1:\n"
+        ".byte 0x48, 0x0f, 0xc7, 0xf8;\n"
+        "jnc 1b;\n"
+        : "=a" (*reinterpret_cast<word64*>(output))
+        : : "cc"
+    );
+# endif
+}
+# endif  // RDSEED64
+
+RDSEED::RDSEED()
+{
+    if (!HasRDSEED())
+        throw RDSEED_Err("HasRDSEED");
+}
+
+void RDSEED::GenerateBlock(byte *output, size_t size)
+{
+    CRYPTOPP_ASSERT((output && size) || !(output || size));
+    if (size == 0) return;
+
+# if defined(MASM_RDSEED_ASM_AVAILABLE)
+
+    MASM_RDSEED_GenerateBlock(output, size);
+
+# elif defined(GCC_RDSEED_ASM_AVAILABLE)
+#   if (CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32)
+    size_t i = 0;
+    for (i = 0; i < size/8; i++)
+        RDSEED64(output+i*8);
+
+    output += i*8;
+    size -= i*8;
+
+    if (size)
+    {
+        word64 val;
+        RDSEED64(&val);
+        std::memcpy(output, &val, size);
+    }
+#   else
+    size_t i = 0;
+    for (i = 0; i < size/4; i++)
+        RDSEED32(output+i*4);
+
+    output += i*4;
+    size -= i*4;
+
+    if (size)
+    {
+        word32 val;
+        RDSEED32(&val);
+        std::memcpy(output, &val, size);
+    }
+#   endif
+# else
+    // No suitable compiler found
+    CRYPTOPP_UNUSED(output);
+    throw NotImplemented("RDSEED: failed to find a suitable implementation");
+# endif  // RDSEED64
+}
+
+void RDSEED::DiscardBytes(size_t n)
+{
+    // RoundUpToMultipleOf is used because a full word is read, and its cheaper
+    //   to discard full words. There's no sense in dealing with tail bytes.
+    FixedSizeSecBlock<word64, 16> discard;
+    n = RoundUpToMultipleOf(n, sizeof(word64));
+
+    size_t count = STDMIN(n, discard.SizeInBytes());
+    while (count)
+    {
+        GenerateBlock(discard.BytePtr(), count);
+        n -= count;
+        count = STDMIN(n, discard.SizeInBytes());
+    }
+}
+
+#endif  // CRYPTOPP_RDSEED_AVAILABLE
+
+/////////////////////////////////////////////////////////////////////
+/////////////////////////////////////////////////////////////////////
+
+#if !defined(CRYPTOPP_RDRAND_AVAILABLE)
+
+RDRAND::RDRAND()
+{
+    throw RDRAND_Err("HasRDRAND");
+}
+
+void RDRAND::GenerateBlock(byte *output, size_t size)
+{
+    // Constructor will throw, should not get here
+    CRYPTOPP_UNUSED(output); CRYPTOPP_UNUSED(size);
+}
+
+void RDRAND::DiscardBytes(size_t n)
+{
+    // Constructor will throw, should not get here
+    CRYPTOPP_UNUSED(n);
+}
+
+#endif  // CRYPTOPP_RDRAND_AVAILABLE
+
+#if !defined(CRYPTOPP_RDSEED_AVAILABLE)
+
+RDSEED::RDSEED()
+{
+    throw RDSEED_Err("HasRDSEED");
+}
+
+void RDSEED::GenerateBlock(byte *output, size_t size)
+{
+    // Constructor will throw, should not get here
+    CRYPTOPP_UNUSED(output); CRYPTOPP_UNUSED(size);
+}
+
+void RDSEED::DiscardBytes(size_t n)
+{
+    // Constructor will throw, should not get here
+    CRYPTOPP_UNUSED(n);
+}
+
+#endif  // CRYPTOPP_RDSEED_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/rdrand.h b/runtime/third_party/cryptopp/rdrand.h
new file mode 100644
index 0000000..d1f3c41
--- /dev/null
+++ b/runtime/third_party/cryptopp/rdrand.h
@@ -0,0 +1,145 @@
+// rdrand.h - written and placed in public domain by Jeffrey Walton and Uri Blumenthal.
+
+/// \file rdrand.h
+/// \brief Classes for RDRAND and RDSEED
+/// \since Crypto++ 5.6.3
+
+#ifndef CRYPTOPP_RDRAND_H
+#define CRYPTOPP_RDRAND_H
+
+#include "cryptlib.h"
+
+// This class file provides both RDRAND and RDSEED. They were added at
+//   Crypto++ 5.6.3. At compile time, it uses CRYPTOPP_BOOL_{X86|X32|X64}
+//   to select an implementation or "throw NotImplemented". At runtime the
+//   constructor will throw RDRAND_Err or RDSEED_Err if a generator is
+//   is not available.
+// The original classes accepted a retry count. Retries were superfluous for
+//   RDRAND, and RDSEED encountered a failure about 1 in 256 bytes depending
+//   on the processor. Retries were removed at Crypto++ 6.0 because
+//   GenerateBlock unconditionally retries and always fulfills the request.
+
+// Throughput varies wildly depending on processor and manufacturer. A Core i5 or
+//   Core i7 RDRAND can generate at over 200 MiB/s. It is below theroetical
+//   maximum, but it takes about 5 instructions to generate, retry and store a
+//   result. A low-end Celeron may perform RDRAND at about 7 MiB/s. RDSEED
+//   performs at about 1/4 to 1/2 the rate of RDRAND. AMD RDRAND performed poorly
+//   during testing with Athlon X4 845. The Bulldozer v4 only performed at 1 MiB/s.
+
+// Microsoft added RDRAND in August 2012, VS2012; RDSEED in October 2013, VS2013.
+// GCC added RDRAND in December 2010, GCC 4.6. LLVM added RDRAND in July 2012,
+// Clang 3.2. Intel added RDRAND in September 2011, ICC 12.1.
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Exception thrown when a RDRAND generator encounters
+///    a generator related error.
+/// \since Crypto++ 5.6.3
+class RDRAND_Err : public Exception
+{
+public:
+    RDRAND_Err(const std::string &operation)
+        : Exception(OTHER_ERROR, "RDRAND: " + operation + " operation failed") {}
+};
+
+/// \brief Hardware generated random numbers using RDRAND instruction
+/// \sa MaurerRandomnessTest() for random bit generators
+/// \since Crypto++ 5.6.3
+class RDRAND : public RandomNumberGenerator
+{
+public:
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "RDRAND"; }
+
+    virtual ~RDRAND() {}
+
+    /// \brief Construct a RDRAND generator
+    /// \details According to DJ of Intel, the Intel RDRAND circuit does not underflow.
+    ///   If it did hypothetically underflow, then it would return 0 for the random value.
+    ///   AMD's RDRAND implementation appears to provide the same behavior.
+     /// \throw RDRAND_Err if the random number generator is not available
+    RDRAND();
+
+    /// \brief Generate random array of bytes
+    /// \param output the byte buffer
+    /// \param size the length of the buffer, in bytes
+    virtual void GenerateBlock(byte *output, size_t size);
+
+    /// \brief Generate and discard n bytes
+    /// \param n the number of bytes to generate and discard
+    /// \details the RDSEED generator discards words, not bytes. If n is
+    ///   not a multiple of a machine word, then it is rounded up to
+    ///   that size.
+    virtual void DiscardBytes(size_t n);
+
+    /// \brief Update RNG state with additional unpredictable values
+    /// \param input unused
+    /// \param length unused
+    /// \details The operation is a nop for this generator.
+    virtual void IncorporateEntropy(const byte *input, size_t length)
+    {
+        // Override to avoid the base class' throw.
+        CRYPTOPP_UNUSED(input); CRYPTOPP_UNUSED(length);
+    }
+
+    std::string AlgorithmProvider() const {
+        return "RDRAND";
+    }
+};
+
+/// \brief Exception thrown when a RDSEED generator encounters
+///    a generator related error.
+/// \since Crypto++ 5.6.3
+class RDSEED_Err : public Exception
+{
+public:
+    RDSEED_Err(const std::string &operation)
+        : Exception(OTHER_ERROR, "RDSEED: " + operation + " operation failed") {}
+};
+
+/// \brief Hardware generated random numbers using RDSEED instruction
+/// \sa MaurerRandomnessTest() for random bit generators
+/// \since Crypto++ 5.6.3
+class RDSEED : public RandomNumberGenerator
+{
+public:
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "RDSEED"; }
+
+    virtual ~RDSEED() {}
+
+    /// \brief Construct a RDSEED generator
+    /// \details Empirical testing under a 6th generation i7 (6200U) shows RDSEED fails
+    ///   to fulfill requests at about once every for every 256 bytes requested.
+    ///   The generator runs about 4 times slower than RDRAND.
+     /// \throw RDSEED_Err if the random number generator is not available
+    RDSEED();
+
+    /// \brief Generate random array of bytes
+    /// \param output the byte buffer
+    /// \param size the length of the buffer, in bytes
+    virtual void GenerateBlock(byte *output, size_t size);
+
+    /// \brief Generate and discard n bytes
+    /// \param n the number of bytes to generate and discard
+    /// \details the RDSEED generator discards words, not bytes. If n is
+    ///   not a multiple of a machine word, then it is rounded up to
+    ///   that size.
+    virtual void DiscardBytes(size_t n);
+
+    /// \brief Update RNG state with additional unpredictable values
+    /// \param input unused
+    /// \param length unused
+    /// \details The operation is a nop for this generator.
+    virtual void IncorporateEntropy(const byte *input, size_t length)
+    {
+        // Override to avoid the base class' throw.
+        CRYPTOPP_UNUSED(input); CRYPTOPP_UNUSED(length);
+    }
+
+    std::string AlgorithmProvider() const {
+        return "RDSEED";
+    }
+};
+
+NAMESPACE_END
+
+#endif // CRYPTOPP_RDRAND_H
diff --git a/runtime/third_party/cryptopp/rdseed.asm b/runtime/third_party/cryptopp/rdseed.asm
new file mode 100644
index 0000000..10a37e6
--- /dev/null
+++ b/runtime/third_party/cryptopp/rdseed.asm
@@ -0,0 +1,232 @@
+;; rdrand.asm - written and placed in public domain by Jeffrey Walton and Uri Blumenthal.
+;;              Copyright assigned to the Crypto++ project.
+
+;; This ASM file provides RDSEED to downlevel Microsoft tool chains.
+;; Everything "just works" under Visual Studio. Other platforms will
+;; have to run MASM/MASM-64 and then link to the object files.
+
+;; set ASFLAGS=/nologo /D_M_X86 /W3 /Cx /Zi /safeseh
+;; set ASFLAGS64=/nologo /D_M_X64 /W3 /Cx /Zi
+;; "C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\bin\ml.exe" %ASFLAGS% /Fo rdrand-x86.obj /c rdrand.asm
+;; "C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\bin\amd64\ml64.exe" %ASFLAGS64% /Fo rdrand-x64.obj /c rdrand.asm
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+TITLE    MASM_RDSEED_GenerateBlock source file
+SUBTITLE Microsoft specific ASM code to utilize RDSEED for down level Microsoft toolchains
+
+PUBLIC MASM_RDSEED_GenerateBlock
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+;; C/C++ Function prototypes (both are fastcall)
+;;   X86:
+;;      extern "C" void __fastcall MASM_RDSEED_GenerateBlock(byte* ptr, size_t size);
+;;   X64:
+;;      extern "C" void __fastcall MASM_RDSEED_GenerateBlock(byte* ptr, size_t size);
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+IFDEF _M_X86    ;; Set via the command line
+
+.486
+.MODEL FLAT
+
+;; Fastcall calling conventions exports
+ALIAS <@MASM_RDSEED_GenerateBlock@8> = <MASM_RDSEED_GenerateBlock>
+
+ENDIF
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+IFDEF _M_X86    ;; Set via the command line
+
+.CODE
+ALIGN   8
+OPTION PROLOGUE:NONE
+OPTION EPILOGUE:NONE
+
+;; No need for Load_Arguments due to fastcall
+;;   ECX (in): arg1, byte* buffer
+;;   EDX (in): arg2, size_t bsize
+
+MASM_RDSEED_GenerateBlock PROC   ;; arg1:DWORD, arg2:DWORD
+
+    MWSIZE EQU 04h    ;; machine word size
+    buffer EQU ecx
+    bsize  EQU edx
+
+            ;; Top of While loop
+RDSEED_GenerateBlock_Top:
+
+            ;; Check remaining size
+    cmp     bsize, 0
+    je      RDSEED_GenerateBlock_Return
+
+RDSEED_Call_EAX:
+            ;; RDSEED is not available prior to VS2012. Just emit
+            ;;   the byte codes using DB. This is `rdseed eax`.
+    DB      0Fh, 0C7h, 0F8h
+
+            ;; If CF=1, the number returned by RDSEED is valid.
+            ;; If CF=0, a random number was not available.
+
+            ;; Retry immediately
+    jnc     RDSEED_Call_EAX
+
+RDSEED_succeeded:
+
+    cmp     bsize, MWSIZE
+    jb      RDSEED_Partial_Machine_Word
+
+RDSEED_Full_Machine_Word:
+
+    mov     DWORD PTR [buffer], eax
+    add     buffer, MWSIZE        ;; No need for Intel Core 2 slow workarounds, like
+    sub     bsize, MWSIZE         ;;   `lea buffer,[buffer+MWSIZE]` for faster adds
+
+            ;; Continue
+    jmp     RDSEED_GenerateBlock_Top
+
+            ;; 1,2,3 bytes remain
+RDSEED_Partial_Machine_Word:
+
+            ;; Test bit 1 to see if size is at least 2
+    test    bsize, 2
+    jz      RDSEED_Bit_1_Not_Set
+
+    mov     WORD PTR [buffer], ax
+    shr     eax, 16
+    add     buffer, 2
+
+RDSEED_Bit_1_Not_Set:
+
+            ;; Test bit 0 to see if size is at least 1
+    test    bsize, 1
+    jz      RDSEED_Bit_0_Not_Set
+
+    mov     BYTE PTR [buffer], al
+    ;; shr     ax, 8
+    ;; add     buffer, 1
+
+RDSEED_Bit_0_Not_Set:
+
+            ;; We've hit all the bits
+
+RDSEED_GenerateBlock_Return:
+
+            ;; Clear artifacts
+    xor     eax, eax
+    ret
+
+MASM_RDSEED_GenerateBlock ENDP
+
+ENDIF    ;; _M_X86
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+IFDEF _M_X64    ;; Set via the command line
+
+.CODE
+ALIGN   16
+OPTION PROLOGUE:NONE
+OPTION EPILOGUE:NONE
+
+;; No need for Load_Arguments due to fastcall
+;;   RCX (in): arg1, byte* buffer
+;;   RDX (in): arg2, size_t bsize
+
+MASM_RDSEED_GenerateBlock PROC FRAME ;; arg1:QWORD, arg2:QWORD
+
+    MWSIZE EQU 08h    ;; machine word size
+    buffer EQU rcx
+    bsize  EQU rdx
+
+.endprolog
+
+            ;; Top of While loop
+RDSEED_GenerateBlock_Top:
+
+            ;; Check remaining size
+    cmp     bsize, 0
+    je      RDSEED_GenerateBlock_Return
+
+RDSEED_Call_RAX:
+            ;; RDSEED is not available prior to VS2012. Just emit
+            ;;   the byte codes using DB. This is `rdseed rax`.
+    DB      048h, 0Fh, 0C7h, 0F8h
+
+            ;; If CF=1, the number returned by RDSEED is valid.
+            ;; If CF=0, a random number was not available.
+
+            ;; Retry immediately
+    jnc     RDSEED_Call_RAX
+
+RDSEED_succeeded:
+
+    cmp     bsize, MWSIZE
+    jb      RDSEED_Partial_Machine_Word
+
+RDSEED_Full_Machine_Word:
+
+    mov     QWORD PTR [buffer], rax
+    add     buffer, MWSIZE
+    sub     bsize, MWSIZE
+
+            ;; Continue
+    jmp     RDSEED_GenerateBlock_Top
+
+            ;; 1,2,3,4,5,6,7 bytes remain
+RDSEED_Partial_Machine_Word:
+
+            ;; Test bit 2 to see if size is at least 4
+    test    bsize, 4
+    jz      RDSEED_Bit_2_Not_Set
+
+    mov     DWORD PTR [buffer], eax
+    shr     rax, 32
+    add     buffer, 4
+
+RDSEED_Bit_2_Not_Set:
+
+            ;; Test bit 1 to see if size is at least 2
+    test    bsize, 2
+    jz      RDSEED_Bit_1_Not_Set
+
+    mov     WORD PTR [buffer], ax
+    shr     eax, 16
+    add     buffer, 2
+
+RDSEED_Bit_1_Not_Set:
+
+            ;; Test bit 0 to see if size is at least 1
+    test    bsize, 1
+    jz      RDSEED_Bit_0_Not_Set
+
+    mov     BYTE PTR [buffer], al
+    ;; shr     ax, 8
+    ;; add     buffer, 1
+
+RDSEED_Bit_0_Not_Set:
+
+            ;; We've hit all the bits
+
+RDSEED_GenerateBlock_Return:
+
+            ;; Clear artifacts
+    xor     rax, rax
+    ret
+
+MASM_RDSEED_GenerateBlock ENDP
+
+ENDIF    ;; _M_X64
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+END
diff --git a/runtime/third_party/cryptopp/rdtables.cpp b/runtime/third_party/cryptopp/rdtables.cpp
new file mode 100644
index 0000000..f4446d1
--- /dev/null
+++ b/runtime/third_party/cryptopp/rdtables.cpp
@@ -0,0 +1,166 @@
+// Rijndael tables
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "rijndael.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/*
+Te0[x] = S [x].[02, 01, 01, 03];
+Te1[x] = S [x].[03, 02, 01, 01];
+Te2[x] = S [x].[01, 03, 02, 01];
+Te3[x] = S [x].[01, 01, 03, 02];
+
+Td0[x] = Si[x].[0e, 09, 0d, 0b];
+Td1[x] = Si[x].[0b, 0e, 09, 0d];
+Td2[x] = Si[x].[0d, 0b, 0e, 09];
+Td3[x] = Si[x].[09, 0d, 0b, 0e];
+*/
+
+const byte Rijndael::Base::Se[256] = {
+    0x63, 0x7c, 0x77, 0x7b,
+    0xf2, 0x6b, 0x6f, 0xc5,
+    0x30, 0x01, 0x67, 0x2b,
+    0xfe, 0xd7, 0xab, 0x76,
+    0xca, 0x82, 0xc9, 0x7d,
+    0xfa, 0x59, 0x47, 0xf0,
+    0xad, 0xd4, 0xa2, 0xaf,
+    0x9c, 0xa4, 0x72, 0xc0,
+    0xb7, 0xfd, 0x93, 0x26,
+    0x36, 0x3f, 0xf7, 0xcc,
+    0x34, 0xa5, 0xe5, 0xf1,
+    0x71, 0xd8, 0x31, 0x15,
+    0x04, 0xc7, 0x23, 0xc3,
+    0x18, 0x96, 0x05, 0x9a,
+    0x07, 0x12, 0x80, 0xe2,
+    0xeb, 0x27, 0xb2, 0x75,
+    0x09, 0x83, 0x2c, 0x1a,
+    0x1b, 0x6e, 0x5a, 0xa0,
+    0x52, 0x3b, 0xd6, 0xb3,
+    0x29, 0xe3, 0x2f, 0x84,
+    0x53, 0xd1, 0x00, 0xed,
+    0x20, 0xfc, 0xb1, 0x5b,
+    0x6a, 0xcb, 0xbe, 0x39,
+    0x4a, 0x4c, 0x58, 0xcf,
+    0xd0, 0xef, 0xaa, 0xfb,
+    0x43, 0x4d, 0x33, 0x85,
+    0x45, 0xf9, 0x02, 0x7f,
+    0x50, 0x3c, 0x9f, 0xa8,
+    0x51, 0xa3, 0x40, 0x8f,
+    0x92, 0x9d, 0x38, 0xf5,
+    0xbc, 0xb6, 0xda, 0x21,
+    0x10, 0xff, 0xf3, 0xd2,
+    0xcd, 0x0c, 0x13, 0xec,
+    0x5f, 0x97, 0x44, 0x17,
+    0xc4, 0xa7, 0x7e, 0x3d,
+    0x64, 0x5d, 0x19, 0x73,
+    0x60, 0x81, 0x4f, 0xdc,
+    0x22, 0x2a, 0x90, 0x88,
+    0x46, 0xee, 0xb8, 0x14,
+    0xde, 0x5e, 0x0b, 0xdb,
+    0xe0, 0x32, 0x3a, 0x0a,
+    0x49, 0x06, 0x24, 0x5c,
+    0xc2, 0xd3, 0xac, 0x62,
+    0x91, 0x95, 0xe4, 0x79,
+    0xe7, 0xc8, 0x37, 0x6d,
+    0x8d, 0xd5, 0x4e, 0xa9,
+    0x6c, 0x56, 0xf4, 0xea,
+    0x65, 0x7a, 0xae, 0x08,
+    0xba, 0x78, 0x25, 0x2e,
+    0x1c, 0xa6, 0xb4, 0xc6,
+    0xe8, 0xdd, 0x74, 0x1f,
+    0x4b, 0xbd, 0x8b, 0x8a,
+    0x70, 0x3e, 0xb5, 0x66,
+    0x48, 0x03, 0xf6, 0x0e,
+    0x61, 0x35, 0x57, 0xb9,
+    0x86, 0xc1, 0x1d, 0x9e,
+    0xe1, 0xf8, 0x98, 0x11,
+    0x69, 0xd9, 0x8e, 0x94,
+    0x9b, 0x1e, 0x87, 0xe9,
+    0xce, 0x55, 0x28, 0xdf,
+    0x8c, 0xa1, 0x89, 0x0d,
+    0xbf, 0xe6, 0x42, 0x68,
+    0x41, 0x99, 0x2d, 0x0f,
+    0xb0, 0x54, 0xbb, 0x16,
+};
+
+const byte Rijndael::Base::Sd[256] = {
+    0x52, 0x09, 0x6a, 0xd5,
+    0x30, 0x36, 0xa5, 0x38,
+    0xbf, 0x40, 0xa3, 0x9e,
+    0x81, 0xf3, 0xd7, 0xfb,
+    0x7c, 0xe3, 0x39, 0x82,
+    0x9b, 0x2f, 0xff, 0x87,
+    0x34, 0x8e, 0x43, 0x44,
+    0xc4, 0xde, 0xe9, 0xcb,
+    0x54, 0x7b, 0x94, 0x32,
+    0xa6, 0xc2, 0x23, 0x3d,
+    0xee, 0x4c, 0x95, 0x0b,
+    0x42, 0xfa, 0xc3, 0x4e,
+    0x08, 0x2e, 0xa1, 0x66,
+    0x28, 0xd9, 0x24, 0xb2,
+    0x76, 0x5b, 0xa2, 0x49,
+    0x6d, 0x8b, 0xd1, 0x25,
+    0x72, 0xf8, 0xf6, 0x64,
+    0x86, 0x68, 0x98, 0x16,
+    0xd4, 0xa4, 0x5c, 0xcc,
+    0x5d, 0x65, 0xb6, 0x92,
+    0x6c, 0x70, 0x48, 0x50,
+    0xfd, 0xed, 0xb9, 0xda,
+    0x5e, 0x15, 0x46, 0x57,
+    0xa7, 0x8d, 0x9d, 0x84,
+    0x90, 0xd8, 0xab, 0x00,
+    0x8c, 0xbc, 0xd3, 0x0a,
+    0xf7, 0xe4, 0x58, 0x05,
+    0xb8, 0xb3, 0x45, 0x06,
+    0xd0, 0x2c, 0x1e, 0x8f,
+    0xca, 0x3f, 0x0f, 0x02,
+    0xc1, 0xaf, 0xbd, 0x03,
+    0x01, 0x13, 0x8a, 0x6b,
+    0x3a, 0x91, 0x11, 0x41,
+    0x4f, 0x67, 0xdc, 0xea,
+    0x97, 0xf2, 0xcf, 0xce,
+    0xf0, 0xb4, 0xe6, 0x73,
+    0x96, 0xac, 0x74, 0x22,
+    0xe7, 0xad, 0x35, 0x85,
+    0xe2, 0xf9, 0x37, 0xe8,
+    0x1c, 0x75, 0xdf, 0x6e,
+    0x47, 0xf1, 0x1a, 0x71,
+    0x1d, 0x29, 0xc5, 0x89,
+    0x6f, 0xb7, 0x62, 0x0e,
+    0xaa, 0x18, 0xbe, 0x1b,
+    0xfc, 0x56, 0x3e, 0x4b,
+    0xc6, 0xd2, 0x79, 0x20,
+    0x9a, 0xdb, 0xc0, 0xfe,
+    0x78, 0xcd, 0x5a, 0xf4,
+    0x1f, 0xdd, 0xa8, 0x33,
+    0x88, 0x07, 0xc7, 0x31,
+    0xb1, 0x12, 0x10, 0x59,
+    0x27, 0x80, 0xec, 0x5f,
+    0x60, 0x51, 0x7f, 0xa9,
+    0x19, 0xb5, 0x4a, 0x0d,
+    0x2d, 0xe5, 0x7a, 0x9f,
+    0x93, 0xc9, 0x9c, 0xef,
+    0xa0, 0xe0, 0x3b, 0x4d,
+    0xae, 0x2a, 0xf5, 0xb0,
+    0xc8, 0xeb, 0xbb, 0x3c,
+    0x83, 0x53, 0x99, 0x61,
+    0x17, 0x2b, 0x04, 0x7e,
+    0xba, 0x77, 0xd6, 0x26,
+    0xe1, 0x69, 0x14, 0x63,
+    0x55, 0x21, 0x0c, 0x7d,
+};
+
+/* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+const word32 Rijndael::Base::rcon[] = {
+	0x01000000, 0x02000000, 0x04000000, 0x08000000,
+	0x10000000, 0x20000000, 0x40000000, 0x80000000,
+	0x1B000000, 0x36000000
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/regtest1.cpp b/runtime/third_party/cryptopp/regtest1.cpp
new file mode 100644
index 0000000..d5f6fec
--- /dev/null
+++ b/runtime/third_party/cryptopp/regtest1.cpp
@@ -0,0 +1,160 @@
+// regtest1.cpp - originally written and placed in the public domain by Wei Dai
+//                regtest.cpp split into 3 files due to OOM kills by JW
+//                in April 2017. A second split occurred in July 2018.
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "factory.h"
+#include "bench.h"
+#include "cpu.h"
+
+#include "crc.h"
+#include "adler32.h"
+#include "md2.h"
+#include "md5.h"
+#include "keccak.h"
+#include "sha3.h"
+#include "shake.h"
+#include "blake2.h"
+#include "sha.h"
+#include "sha3.h"
+#include "sm3.h"
+#include "hkdf.h"
+#include "tiger.h"
+#include "ripemd.h"
+#include "panama.h"
+#include "whrlpool.h"
+#include "lsh.h"
+
+#include "osrng.h"
+#include "drbg.h"
+#include "darn.h"
+#include "mersenne.h"
+#include "rdrand.h"
+#include "padlkrng.h"
+
+#include "modes.h"
+#include "aes.h"
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+USING_NAMESPACE(CryptoPP)
+
+// Unkeyed ciphers
+void RegisterFactories1();
+// MAC ciphers
+void RegisterFactories2();
+// Stream ciphers
+void RegisterFactories3();
+// Block ciphers
+void RegisterFactories4();
+// Public key ciphers
+void RegisterFactories5();
+
+void RegisterFactories(Test::TestClass suites)
+{
+	static bool s_registered = false;
+	if (s_registered)
+		return;
+
+	if ((suites & Test::Unkeyed) == Test::Unkeyed)
+		RegisterFactories1();
+
+	if ((suites & Test::SharedKeyMAC) == Test::SharedKeyMAC)
+		RegisterFactories2();
+
+	if ((suites & Test::SharedKeyStream) == Test::SharedKeyStream)
+		RegisterFactories3();
+
+	if ((suites & Test::SharedKeyBlock) == Test::SharedKeyBlock)
+		RegisterFactories4();
+
+	if ((suites & Test::PublicKey) == Test::PublicKey)
+		RegisterFactories5();
+
+	s_registered = true;
+}
+
+// Unkeyed ciphers
+void RegisterFactories1()
+{
+	RegisterDefaultFactoryFor<HashTransformation, CRC32>();
+	RegisterDefaultFactoryFor<HashTransformation, CRC32C>();
+	RegisterDefaultFactoryFor<HashTransformation, Adler32>();
+	RegisterDefaultFactoryFor<HashTransformation, Weak::MD5>();
+	RegisterDefaultFactoryFor<HashTransformation, SHA1>();
+	RegisterDefaultFactoryFor<HashTransformation, SHA224>();
+	RegisterDefaultFactoryFor<HashTransformation, SHA256>();
+	RegisterDefaultFactoryFor<HashTransformation, SHA384>();
+	RegisterDefaultFactoryFor<HashTransformation, SHA512>();
+	RegisterDefaultFactoryFor<HashTransformation, Whirlpool>();
+	RegisterDefaultFactoryFor<HashTransformation, Tiger>();
+	RegisterDefaultFactoryFor<HashTransformation, RIPEMD160>();
+	RegisterDefaultFactoryFor<HashTransformation, RIPEMD320>();
+	RegisterDefaultFactoryFor<HashTransformation, RIPEMD128>();
+	RegisterDefaultFactoryFor<HashTransformation, RIPEMD256>();
+	RegisterDefaultFactoryFor<HashTransformation, Weak::PanamaHash<LittleEndian> >();
+	RegisterDefaultFactoryFor<HashTransformation, Weak::PanamaHash<BigEndian> >();
+	RegisterDefaultFactoryFor<HashTransformation, Keccak_224>();
+	RegisterDefaultFactoryFor<HashTransformation, Keccak_256>();
+	RegisterDefaultFactoryFor<HashTransformation, Keccak_384>();
+	RegisterDefaultFactoryFor<HashTransformation, Keccak_512>();
+	RegisterDefaultFactoryFor<HashTransformation, SHA3_224>();
+	RegisterDefaultFactoryFor<HashTransformation, SHA3_256>();
+	RegisterDefaultFactoryFor<HashTransformation, SHA3_384>();
+	RegisterDefaultFactoryFor<HashTransformation, SHA3_512>();
+	RegisterDefaultFactoryFor<HashTransformation, SHAKE128>();
+	RegisterDefaultFactoryFor<HashTransformation, SHAKE256>();
+	RegisterDefaultFactoryFor<HashTransformation, SM3>();
+	RegisterDefaultFactoryFor<HashTransformation, BLAKE2s>();
+	RegisterDefaultFactoryFor<HashTransformation, BLAKE2b>();
+	RegisterDefaultFactoryFor<HashTransformation, LSH224>();
+	RegisterDefaultFactoryFor<HashTransformation, LSH256>();
+	RegisterDefaultFactoryFor<HashTransformation, LSH384>();
+	RegisterDefaultFactoryFor<HashTransformation, LSH512>();
+	RegisterDefaultFactoryFor<HashTransformation, LSH512_256>();
+
+#ifdef BLOCKING_RNG_AVAILABLE
+	RegisterDefaultFactoryFor<RandomNumberGenerator, BlockingRng>();
+#endif
+#ifdef NONBLOCKING_RNG_AVAILABLE
+	RegisterDefaultFactoryFor<RandomNumberGenerator, NonblockingRng>();
+#endif
+#ifdef OS_RNG_AVAILABLE
+	RegisterDefaultFactoryFor<RandomNumberGenerator, AutoSeededRandomPool>();
+	RegisterDefaultFactoryFor<RandomNumberGenerator, AutoSeededX917RNG<AES> >();
+#endif
+	RegisterDefaultFactoryFor<RandomNumberGenerator, MT19937>();
+#if (CRYPTOPP_BOOL_X86)
+	if (HasPadlockRNG())
+		RegisterDefaultFactoryFor<RandomNumberGenerator, PadlockRNG>();
+#endif
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+	if (HasRDRAND())
+		RegisterDefaultFactoryFor<RandomNumberGenerator, RDRAND>();
+	if (HasRDSEED())
+		RegisterDefaultFactoryFor<RandomNumberGenerator, RDSEED>();
+#endif
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+	if (HasDARN())
+		RegisterDefaultFactoryFor<RandomNumberGenerator, DARN>();
+#endif
+	RegisterDefaultFactoryFor<RandomNumberGenerator, OFB_Mode<AES>::Encryption >("AES/OFB RNG");
+	RegisterDefaultFactoryFor<NIST_DRBG, Hash_DRBG<SHA1> >("Hash_DRBG(SHA1)");
+	RegisterDefaultFactoryFor<NIST_DRBG, Hash_DRBG<SHA256> >("Hash_DRBG(SHA256)");
+	RegisterDefaultFactoryFor<NIST_DRBG, HMAC_DRBG<SHA1> >("HMAC_DRBG(SHA1)");
+	RegisterDefaultFactoryFor<NIST_DRBG, HMAC_DRBG<SHA256> >("HMAC_DRBG(SHA256)");
+
+	RegisterDefaultFactoryFor<KeyDerivationFunction, HKDF<SHA1> >();
+	RegisterDefaultFactoryFor<KeyDerivationFunction, HKDF<SHA256> >();
+	RegisterDefaultFactoryFor<KeyDerivationFunction, HKDF<SHA512> >();
+	RegisterDefaultFactoryFor<KeyDerivationFunction, HKDF<Whirlpool> >();
+}
diff --git a/runtime/third_party/cryptopp/regtest2.cpp b/runtime/third_party/cryptopp/regtest2.cpp
new file mode 100644
index 0000000..35b4605
--- /dev/null
+++ b/runtime/third_party/cryptopp/regtest2.cpp
@@ -0,0 +1,105 @@
+// regtest2.cpp - originally written and placed in the public domain by Wei Dai
+//                regtest.cpp split into 3 files due to OOM kills by JW
+//                in April 2017. A second split occurred in July 2018.
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "factory.h"
+#include "bench.h"
+#include "cpu.h"
+
+// For MAC's
+#include "hmac.h"
+#include "cmac.h"
+#include "dmac.h"
+#include "vmac.h"
+#include "ttmac.h"
+
+// Ciphers
+#include "md5.h"
+#include "keccak.h"
+#include "sha.h"
+#include "sha3.h"
+#include "blake2.h"
+#include "ripemd.h"
+#include "chacha.h"
+#include "poly1305.h"
+#include "siphash.h"
+#include "panama.h"
+
+// Stream ciphers
+#include "arc4.h"
+#include "seal.h"
+#include "wake.h"
+#include "chacha.h"
+#include "salsa.h"
+#include "rabbit.h"
+#include "hc128.h"
+#include "hc256.h"
+#include "panama.h"
+#include "sosemanuk.h"
+
+// Block for CMAC
+#include "aes.h"
+#include "des.h"
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+USING_NAMESPACE(CryptoPP)
+
+// MAC ciphers
+void RegisterFactories2()
+{
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, HMAC<Weak::MD5> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, HMAC<RIPEMD160> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, HMAC<SHA1> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, HMAC<SHA224> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, HMAC<SHA256> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, HMAC<SHA384> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, HMAC<SHA512> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, TTMAC>();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, VMAC<AES> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, VMAC<AES, 64> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, Weak::PanamaMAC<LittleEndian> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, Weak::PanamaMAC<BigEndian> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, CMAC<AES> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, DMAC<AES> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, Poly1305<AES> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, Poly1305TLS>();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, CMAC<DES_EDE3> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, BLAKE2s>();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, BLAKE2b>();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, SipHash<2,4> >();
+	RegisterDefaultFactoryFor<MessageAuthenticationCode, SipHash<4,8> >();
+}
+
+// Stream ciphers
+void RegisterFactories3()
+{
+	RegisterSymmetricCipherDefaultFactories<Weak::MARC4>();
+	RegisterSymmetricCipherDefaultFactories<SEAL<> >();
+	RegisterSymmetricCipherDefaultFactories<SEAL<LittleEndian> >();
+	RegisterSymmetricCipherDefaultFactories<WAKE_OFB<LittleEndian> >();
+	RegisterSymmetricCipherDefaultFactories<WAKE_OFB<BigEndian> >();
+	RegisterSymmetricCipherDefaultFactories<PanamaCipher<LittleEndian> >();
+	RegisterSymmetricCipherDefaultFactories<PanamaCipher<BigEndian> >();
+
+	RegisterSymmetricCipherDefaultFactories<Salsa20>();
+	RegisterSymmetricCipherDefaultFactories<XSalsa20>();
+	RegisterSymmetricCipherDefaultFactories<ChaCha>();
+	RegisterSymmetricCipherDefaultFactories<ChaChaTLS>();
+	RegisterSymmetricCipherDefaultFactories<XChaCha20>();
+	RegisterSymmetricCipherDefaultFactories<Sosemanuk>();
+	RegisterSymmetricCipherDefaultFactories<Rabbit>();
+	RegisterSymmetricCipherDefaultFactories<RabbitWithIV>();
+	RegisterSymmetricCipherDefaultFactories<HC128>();
+	RegisterSymmetricCipherDefaultFactories<HC256>();
+}
diff --git a/runtime/third_party/cryptopp/regtest3.cpp b/runtime/third_party/cryptopp/regtest3.cpp
new file mode 100644
index 0000000..f1370c8
--- /dev/null
+++ b/runtime/third_party/cryptopp/regtest3.cpp
@@ -0,0 +1,156 @@
+// regtest3.cpp - originally written and placed in the public domain by Wei Dai
+//                regtest.cpp split into 3 files due to OOM kills by JW
+//                in April 2017. A second split occurred in July 2018.
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "factory.h"
+#include "bench.h"
+#include "cpu.h"
+
+#include "modes.h"
+#include "aria.h"
+#include "seed.h"
+#include "hight.h"
+#include "camellia.h"
+#include "shacal2.h"
+#include "tea.h"
+#include "aes.h"
+#include "tiger.h"
+#include "ccm.h"
+#include "gcm.h"
+#include "eax.h"
+#include "xts.h"
+#include "twofish.h"
+#include "serpent.h"
+#include "cast.h"
+#include "rc6.h"
+#include "mars.h"
+#include "kalyna.h"
+#include "threefish.h"
+#include "cham.h"
+#include "lea.h"
+#include "simeck.h"
+#include "simon.h"
+#include "speck.h"
+#include "sm4.h"
+#include "des.h"
+#include "idea.h"
+#include "rc5.h"
+#include "skipjack.h"
+#include "blowfish.h"
+#include "chachapoly.h"
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+USING_NAMESPACE(CryptoPP)
+
+// Shared key ciphers
+void RegisterFactories4()
+{
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SHACAL2> >();
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<ARIA> >();
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<HIGHT> >();
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<HIGHT> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<HIGHT> >();
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<Camellia> >();
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<TEA> >();
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<XTEA> >();
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<AES> >();
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<AES> >();
+	RegisterSymmetricCipherDefaultFactories<CFB_Mode<AES> >();
+	RegisterSymmetricCipherDefaultFactories<OFB_Mode<AES> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<AES> >();
+	RegisterSymmetricCipherDefaultFactories<XTS_Mode<AES> >();
+
+	RegisterAuthenticatedSymmetricCipherDefaultFactories<CCM<AES> >();
+	RegisterAuthenticatedSymmetricCipherDefaultFactories<GCM<AES> >();
+	RegisterAuthenticatedSymmetricCipherDefaultFactories<EAX<AES> >();
+	RegisterAuthenticatedSymmetricCipherDefaultFactories<ChaCha20Poly1305>();
+	RegisterAuthenticatedSymmetricCipherDefaultFactories<XChaCha20Poly1305>();
+
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<ARIA> >();  // For test vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<ARIA> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Camellia> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Twofish> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Serpent> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<CAST256> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<RC6> >();
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<MARS> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<MARS> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SHACAL2> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<DES> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<DES_XEX3> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<DES_EDE3> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<IDEA> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<RC5> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<TEA> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<XTEA> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<CAST128> >();
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SKIPJACK> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SKIPJACK> >();
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<SKIPJACK> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Blowfish> >();
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SEED> >();
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SEED> >();
+
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<Kalyna128> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<Kalyna128> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<Kalyna256> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<Kalyna256> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<Kalyna512> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<Kalyna512> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Kalyna128> >();  // Benchmarks
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Kalyna256> >();  // Benchmarks
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Kalyna512> >();  // Benchmarks
+
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<Threefish256> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<Threefish256> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<Threefish512> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<Threefish512> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<Threefish1024> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<Threefish1024> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Threefish256> >();  // Benchmarks
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Threefish512> >();  // Benchmarks
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<Threefish1024> >(); // Benchmarks
+
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<CHAM64> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<CHAM128> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<CHAM64> >();  // Benchmarks
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<CHAM128> >(); // Benchmarks
+
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<LEA> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<LEA> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<LEA> >(); // Benchmarks
+
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SIMECK32> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SIMECK32> >(); // Benchmarks
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SIMECK64> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SIMECK64> >(); // Benchmarks
+
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SIMON64> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<SIMON64> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SIMON128> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<SIMON128> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SIMON64> >();  // Benchmarks
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SIMON128> >(); // Benchmarks
+
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SPECK64> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<SPECK64> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SPECK128> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<SPECK128> >(); // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SPECK64> >();  // Benchmarks
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SPECK128> >(); // Benchmarks
+
+	RegisterSymmetricCipherDefaultFactories<ECB_Mode<SM4> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CBC_Mode<SM4> >();  // Test Vectors
+	RegisterSymmetricCipherDefaultFactories<CTR_Mode<SM4> >();  // Benchmarks
+}
diff --git a/runtime/third_party/cryptopp/regtest4.cpp b/runtime/third_party/cryptopp/regtest4.cpp
new file mode 100644
index 0000000..c4637f0
--- /dev/null
+++ b/runtime/third_party/cryptopp/regtest4.cpp
@@ -0,0 +1,58 @@
+// regtest4.cpp - originally written and placed in the public domain by Wei Dai
+//                regtest.cpp split into 3 files due to OOM kills by JW
+//                in April 2017. A second split occurred in July 2018.
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "factory.h"
+#include "bench.h"
+#include "cpu.h"
+
+#include "dh.h"
+#include "nr.h"
+#include "rw.h"
+#include "rsa.h"
+#include "dsa.h"
+#include "pssr.h"
+#include "esign.h"
+
+// Hashes
+#include "md2.h"
+#include "md5.h"
+#include "sha.h"
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+USING_NAMESPACE(CryptoPP)
+
+void RegisterFactories5()
+{
+	RegisterDefaultFactoryFor<SimpleKeyAgreementDomain, DH>();
+	RegisterAsymmetricCipherDefaultFactories<RSAES<OAEP<SHA1> > >("RSA/OAEP-MGF1(SHA-1)");
+	RegisterAsymmetricCipherDefaultFactories<DLIES<> >("DLIES(NoCofactorMultiplication, KDF2(SHA-1), XOR, HMAC(SHA-1), DHAES)");
+	RegisterSignatureSchemeDefaultFactories<DSA>();
+	RegisterSignatureSchemeDefaultFactories<DSA2<SHA224> >();
+	RegisterSignatureSchemeDefaultFactories<DSA2<SHA256> >();
+	RegisterSignatureSchemeDefaultFactories<DSA2<SHA384> >();
+	RegisterSignatureSchemeDefaultFactories<DSA2<SHA512> >();
+	RegisterSignatureSchemeDefaultFactories<DSA_RFC6979<SHA1> >();
+	RegisterSignatureSchemeDefaultFactories<DSA_RFC6979<SHA224> >();
+	RegisterSignatureSchemeDefaultFactories<DSA_RFC6979<SHA256> >();
+	RegisterSignatureSchemeDefaultFactories<DSA_RFC6979<SHA384> >();
+	RegisterSignatureSchemeDefaultFactories<DSA_RFC6979<SHA512> >();
+	RegisterSignatureSchemeDefaultFactories<NR<SHA1> >("NR(1363)/EMSA1(SHA-1)");
+	RegisterSignatureSchemeDefaultFactories<GDSA<SHA1> >("DSA-1363/EMSA1(SHA-1)");
+	RegisterSignatureSchemeDefaultFactories<RSASS<PKCS1v15, Weak::MD2> >("RSA/PKCS1-1.5(MD2)");
+	RegisterSignatureSchemeDefaultFactories<RSASS<PKCS1v15, SHA1> >("RSA/PKCS1-1.5(SHA-1)");
+	RegisterSignatureSchemeDefaultFactories<ESIGN<SHA1> >("ESIGN/EMSA5-MGF1(SHA-1)");
+	RegisterSignatureSchemeDefaultFactories<RWSS<P1363_EMSA2, SHA1> >("RW/EMSA2(SHA-1)");
+	RegisterSignatureSchemeDefaultFactories<RSASS<PSS, SHA1> >("RSA/PSS-MGF1(SHA-1)");
+}
diff --git a/runtime/third_party/cryptopp/resource.h b/runtime/third_party/cryptopp/resource.h
new file mode 100644
index 0000000..ae07ae7
--- /dev/null
+++ b/runtime/third_party/cryptopp/resource.h
@@ -0,0 +1,15 @@
+//{{NO_DEPENDENCIES}}
+// Microsoft Developer Studio generated include file.
+// Used by cryptopp.rc
+//
+
+// Next default values for new objects
+//
+#ifdef APSTUDIO_INVOKED
+#ifndef APSTUDIO_READONLY_SYMBOLS
+#define _APS_NEXT_RESOURCE_VALUE        101
+#define _APS_NEXT_COMMAND_VALUE         40001
+#define _APS_NEXT_CONTROL_VALUE         1000
+#define _APS_NEXT_SYMED_VALUE           101
+#endif
+#endif
diff --git a/runtime/third_party/cryptopp/rijndael.cpp b/runtime/third_party/cryptopp/rijndael.cpp
new file mode 100644
index 0000000..f7ab9ee
--- /dev/null
+++ b/runtime/third_party/cryptopp/rijndael.cpp
@@ -0,0 +1,1333 @@
+// rijndael.cpp - modified by Chris Morgan <cmorgan@wpi.edu>
+// and Wei Dai from Paulo Baretto's Rijndael implementation
+// The original code and all modifications are in the public domain.
+
+// use "cl /EP /P /DCRYPTOPP_GENERATE_X64_MASM rijndael.cpp" to generate MASM code
+
+/*
+July 2018: Added support for ARMv7 AES instructions via Cryptogams ASM.
+           See the head notes in aes_armv4.S for copyright and license.
+*/
+
+/*
+September 2017: Added support for Power8 AES instructions via compiler intrinsics.
+*/
+
+/*
+July 2017: Added support for ARMv8 AES instructions via compiler intrinsics.
+*/
+
+/*
+July 2010: Added support for AES-NI instructions via compiler intrinsics.
+*/
+
+/*
+Feb 2009: The x86/x64 assembly code was rewritten in by Wei Dai to do counter mode
+caching, which was invented by Hongjun Wu and popularized by Daniel J. Bernstein
+and Peter Schwabe in their paper "New AES software speed records". The round
+function was also modified to include a trick similar to one in Brian Gladman's
+x86 assembly code, doing an 8-bit register move to minimize the number of
+register spills. Also switched to compressed tables and copying round keys to
+the stack.
+
+The C++ implementation uses compressed tables if
+CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS is defined.
+It is defined on x86 platforms by default but no others.
+*/
+
+/*
+July 2006: Defense against timing attacks was added in by Wei Dai.
+
+The code now uses smaller tables in the first and last rounds,
+and preloads them into L1 cache before usage (by loading at least
+one element in each cache line).
+
+We try to delay subsequent accesses to each table (used in the first
+and last rounds) until all of the table has been preloaded. Hopefully
+the compiler isn't smart enough to optimize that code away.
+
+After preloading the table, we also try not to access any memory location
+other than the table and the stack, in order to prevent table entries from
+being unloaded from L1 cache, until that round is finished.
+(Some popular CPUs have 2-way associative caches.)
+*/
+
+// This is the original introductory comment:
+
+/**
+ * version 3.0 (December 2000)
+ *
+ * Optimised ANSI C code for the Rijndael cipher (now AES)
+ *
+ * author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be>
+ * author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be>
+ * author Paulo Barreto <paulo.barreto@terra.com.br>
+ *
+ * This code is hereby placed in the public domain.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
+ * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+ * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_IMPORTS
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#include "rijndael.h"
+#include "misc.h"
+#include "cpu.h"
+
+// VS2017 and global optimization bug. Also see
+// https://github.com/weidai11/cryptopp/issues/649
+#if (CRYPTOPP_MSC_VERSION >= 1910) && (CRYPTOPP_MSC_VERSION <= 1916)
+# ifndef CRYPTOPP_DEBUG
+#  pragma optimize("", off)
+#  pragma optimize("ts", on)
+# endif
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// Hack for http://github.com/weidai11/cryptopp/issues/42 and http://github.com/weidai11/cryptopp/issues/132
+#if (CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE))
+# define CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS 1
+#endif
+
+// Clang intrinsic casts
+#define M128I_CAST(x) ((__m128i *)(void *)(x))
+#define CONST_M128I_CAST(x) ((const __m128i *)(const void *)(x))
+
+#if defined(CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS)
+# if (CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)) && !defined(CRYPTOPP_DISABLE_RIJNDAEL_ASM)
+namespace rdtable {CRYPTOPP_ALIGN_DATA(16) word64 Te[256+2];}
+using namespace rdtable;
+# else
+static word64 Te[256];
+# endif
+static word64 Td[256];
+#else // Not CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS
+# if defined(CRYPTOPP_X64_MASM_AVAILABLE)
+// Unused; avoids linker error on Microsoft X64 non-AESNI platforms
+namespace rdtable {CRYPTOPP_ALIGN_DATA(16) word64 Te[256+2];}
+# endif
+CRYPTOPP_ALIGN_DATA(16) static word32 Te[256*4];
+CRYPTOPP_ALIGN_DATA(16) static word32 Td[256*4];
+#endif // CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS
+
+static volatile bool s_TeFilled = false, s_TdFilled = false;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+#if CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86
+
+// Determine whether the range between begin and end overlaps
+//   with the same 4k block offsets as the Te table. Logically,
+//   the code is trying to create the condition:
+//
+// Two separate memory pages:
+//
+//  +-----+   +-----+
+//  |XXXXX|   |YYYYY|
+//  |XXXXX|   |YYYYY|
+//  |     |   |     |
+//  |     |   |     |
+//  +-----+   +-----+
+//  Te Table   Locals
+//
+// Have a logical cache view of (X and Y may be inverted):
+//
+// +-----+
+// |XXXXX|
+// |XXXXX|
+// |YYYYY|
+// |YYYYY|
+// +-----+
+//
+static inline bool AliasedWithTable(const byte *begin, const byte *end)
+{
+	ptrdiff_t s0 = uintptr_t(begin)%4096, s1 = uintptr_t(end)%4096;
+	ptrdiff_t t0 = uintptr_t(Te)%4096, t1 = (uintptr_t(Te)+sizeof(Te))%4096;
+	if (t1 > t0)
+		return (s0 >= t0 && s0 < t1) || (s1 > t0 && s1 <= t1);
+	else
+		return (s0 < t1 || s1 <= t1) || (s0 >= t0 || s1 > t0);
+}
+
+struct Locals
+{
+	word32 subkeys[4*12], workspace[8];
+	const byte *inBlocks, *inXorBlocks, *outXorBlocks;
+	byte *outBlocks;
+	size_t inIncrement, inXorIncrement, outXorIncrement, outIncrement;
+	size_t regSpill, lengthAndCounterFlag, keysBegin;
+};
+
+const size_t s_aliasPageSize = 4096;
+const size_t s_aliasBlockSize = 256;
+const size_t s_sizeToAllocate = s_aliasPageSize + s_aliasBlockSize + sizeof(Locals);
+
+#endif  // CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86
+
+ANONYMOUS_NAMESPACE_END
+
+// ************************* Portable Code ************************************
+
+#define QUARTER_ROUND(L, T, t, a, b, c, d)	\
+	a ^= L(T, 3, byte(t)); t >>= 8;\
+	b ^= L(T, 2, byte(t)); t >>= 8;\
+	c ^= L(T, 1, byte(t)); t >>= 8;\
+	d ^= L(T, 0, t);
+
+#define QUARTER_ROUND_LE(t, a, b, c, d)	\
+	tempBlock[a] = ((byte *)(Te+byte(t)))[1]; t >>= 8;\
+	tempBlock[b] = ((byte *)(Te+byte(t)))[1]; t >>= 8;\
+	tempBlock[c] = ((byte *)(Te+byte(t)))[1]; t >>= 8;\
+	tempBlock[d] = ((byte *)(Te+t))[1];
+
+#if defined(CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS)
+	#define QUARTER_ROUND_LD(t, a, b, c, d)	\
+		tempBlock[a] = ((byte *)(Td+byte(t)))[GetNativeByteOrder()*7]; t >>= 8;\
+		tempBlock[b] = ((byte *)(Td+byte(t)))[GetNativeByteOrder()*7]; t >>= 8;\
+		tempBlock[c] = ((byte *)(Td+byte(t)))[GetNativeByteOrder()*7]; t >>= 8;\
+		tempBlock[d] = ((byte *)(Td+t))[GetNativeByteOrder()*7];
+#else
+	#define QUARTER_ROUND_LD(t, a, b, c, d)	\
+		tempBlock[a] = Sd[byte(t)]; t >>= 8;\
+		tempBlock[b] = Sd[byte(t)]; t >>= 8;\
+		tempBlock[c] = Sd[byte(t)]; t >>= 8;\
+		tempBlock[d] = Sd[t];
+#endif
+
+#define QUARTER_ROUND_E(t, a, b, c, d)		QUARTER_ROUND(TL_M, Te, t, a, b, c, d)
+#define QUARTER_ROUND_D(t, a, b, c, d)		QUARTER_ROUND(TL_M, Td, t, a, b, c, d)
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+	#define QUARTER_ROUND_FE(t, a, b, c, d)		QUARTER_ROUND(TL_F, Te, t, d, c, b, a)
+	#define QUARTER_ROUND_FD(t, a, b, c, d)		QUARTER_ROUND(TL_F, Td, t, d, c, b, a)
+	#if defined(CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS)
+		#define TL_F(T, i, x)	(*(word32 *)(void *)((byte *)T + x*8 + (6-i)%4+1))
+		#define TL_M(T, i, x)	(*(word32 *)(void *)((byte *)T + x*8 + (i+3)%4+1))
+	#else
+		#define TL_F(T, i, x)	rotrFixed(T[x], (3-i)*8)
+		#define TL_M(T, i, x)	T[i*256 + x]
+	#endif
+#else
+	#define QUARTER_ROUND_FE(t, a, b, c, d)		QUARTER_ROUND(TL_F, Te, t, a, b, c, d)
+	#define QUARTER_ROUND_FD(t, a, b, c, d)		QUARTER_ROUND(TL_F, Td, t, a, b, c, d)
+	#if defined(CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS)
+		#define TL_F(T, i, x)	(*(word32 *)(void *)((byte *)T + x*8 + (4-i)%4))
+		#define TL_M			TL_F
+	#else
+		#define TL_F(T, i, x)	rotrFixed(T[x], i*8)
+		#define TL_M(T, i, x)	T[i*256 + x]
+	#endif
+#endif
+
+
+#define f2(x)   ((x<<1)^(((x>>7)&1)*0x11b))
+#define f4(x)   ((x<<2)^(((x>>6)&1)*0x11b)^(((x>>6)&2)*0x11b))
+#define f8(x)   ((x<<3)^(((x>>5)&1)*0x11b)^(((x>>5)&2)*0x11b)^(((x>>5)&4)*0x11b))
+
+#define f3(x)   (f2(x) ^ x)
+#define f9(x)   (f8(x) ^ x)
+#define fb(x)   (f8(x) ^ f2(x) ^ x)
+#define fd(x)   (f8(x) ^ f4(x) ^ x)
+#define fe(x)   (f8(x) ^ f4(x) ^ f2(x))
+
+unsigned int Rijndael::Base::OptimalDataAlignment() const
+{
+#if (CRYPTOPP_AESNI_AVAILABLE)
+	if (HasAESNI())
+		return 16;  // load __m128i
+#endif
+#if (CRYPTOPP_ARM_AES_AVAILABLE)
+	if (HasAES())
+		return 4;  // load uint32x4_t
+#endif
+#if (CRYPTOGAMS_ARM_AES)
+	// Must use 1 here for Cryptogams AES. Also see
+	// https://github.com/weidai11/cryptopp/issues/683
+	if (HasARMv7())
+		return 1;
+#endif
+#if (CRYPTOPP_POWER8_AES_AVAILABLE)
+	if (HasAES())
+		return 16;  // load uint32x4_p
+#endif
+	return BlockTransformation::OptimalDataAlignment();
+}
+
+void Rijndael::Base::FillEncTable()
+{
+	for (int i=0; i<256; i++)
+	{
+		byte x = Se[i];
+#if defined(CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS)
+		word32 y = word32(x)<<8 | word32(x)<<16 | word32(f2(x))<<24;
+		Te[i] = word64(y | f3(x))<<32 | y;
+#else
+		word32 y = f3(x) | word32(x)<<8 | word32(x)<<16 | word32(f2(x))<<24;
+		for (int j=0; j<4; j++)
+		{
+			Te[i+j*256] = y;
+			y = rotrConstant<8>(y);
+		}
+#endif
+	}
+#if (CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)) && !defined(CRYPTOPP_DISABLE_RIJNDAEL_ASM)
+	Te[256] = Te[257] = 0;
+#endif
+	s_TeFilled = true;
+}
+
+void Rijndael::Base::FillDecTable()
+{
+	for (int i=0; i<256; i++)
+	{
+		byte x = Sd[i];
+#if defined(CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS)
+		word32 y = word32(fd(x))<<8 | word32(f9(x))<<16 | word32(fe(x))<<24;
+		Td[i] = word64(y | fb(x))<<32 | y | x;
+#else
+		word32 y = fb(x) | word32(fd(x))<<8 | word32(f9(x))<<16 | word32(fe(x))<<24;
+		for (int j=0; j<4; j++)
+		{
+			Td[i+j*256] = y;
+			y = rotrConstant<8>(y);
+		}
+#endif
+	}
+	s_TdFilled = true;
+}
+
+#if (CRYPTOPP_AESNI_AVAILABLE)
+extern void Rijndael_UncheckedSetKey_SSE4_AESNI(const byte *userKey, size_t keyLen, word32* rk);
+extern void Rijndael_UncheckedSetKeyRev_AESNI(word32 *key, unsigned int rounds);
+
+extern size_t Rijndael_Enc_AdvancedProcessBlocks_AESNI(const word32 *subkeys, size_t rounds,
+        const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+extern size_t Rijndael_Dec_AdvancedProcessBlocks_AESNI(const word32 *subkeys, size_t rounds,
+        const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+#if (CRYPTOPP_ARM_AES_AVAILABLE)
+extern size_t Rijndael_Enc_AdvancedProcessBlocks_ARMV8(const word32 *subkeys, size_t rounds,
+        const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+extern size_t Rijndael_Dec_AdvancedProcessBlocks_ARMV8(const word32 *subkeys, size_t rounds,
+        const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+#if (CRYPTOGAMS_ARM_AES)
+extern "C" int cryptogams_AES_set_encrypt_key(const unsigned char *userKey, const int bitLen, word32 *rkey);
+extern "C" int cryptogams_AES_set_decrypt_key(const unsigned char *userKey, const int bitLen, word32 *rkey);
+extern "C" void cryptogams_AES_encrypt_block(const unsigned char *in, unsigned char *out, const word32 *rkey);
+extern "C" void cryptogams_AES_decrypt_block(const unsigned char *in, unsigned char *out, const word32 *rkey);
+#endif
+
+#if (CRYPTOPP_POWER8_AES_AVAILABLE)
+extern void Rijndael_UncheckedSetKey_POWER8(const byte* userKey, size_t keyLen,
+        word32* rk, const byte* Se);
+
+extern size_t Rijndael_Enc_AdvancedProcessBlocks128_6x1_ALTIVEC(const word32 *subkeys, size_t rounds,
+        const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+extern size_t Rijndael_Dec_AdvancedProcessBlocks128_6x1_ALTIVEC(const word32 *subkeys, size_t rounds,
+        const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+#if (CRYPTOGAMS_ARM_AES)
+int CRYPTOGAMS_set_encrypt_key(const byte *userKey, const int bitLen, word32 *rkey)
+{
+	return cryptogams_AES_set_encrypt_key(userKey, bitLen, rkey);
+}
+int CRYPTOGAMS_set_decrypt_key(const byte *userKey, const int bitLen, word32 *rkey)
+{
+	return cryptogams_AES_set_decrypt_key(userKey, bitLen, rkey);
+}
+void CRYPTOGAMS_encrypt(const byte *inBlock, const byte *xorBlock, byte *outBlock, const word32 *rkey)
+{
+	cryptogams_AES_encrypt_block(inBlock, outBlock, rkey);
+	if (xorBlock)
+		xorbuf (outBlock, xorBlock, 16);
+}
+void CRYPTOGAMS_decrypt(const byte *inBlock, const byte *xorBlock, byte *outBlock, const word32 *rkey)
+{
+	cryptogams_AES_decrypt_block(inBlock, outBlock, rkey);
+	if (xorBlock)
+		xorbuf (outBlock, xorBlock, 16);
+}
+#endif
+
+std::string Rijndael::Base::AlgorithmProvider() const
+{
+#if (CRYPTOPP_AESNI_AVAILABLE)
+	if (HasAESNI())
+		return "AESNI";
+#endif
+#if CRYPTOPP_SSE2_ASM_AVAILABLE && !defined(CRYPTOPP_DISABLE_RIJNDAEL_ASM)
+	if (HasSSE2())
+		return "SSE2";
+#endif
+#if (CRYPTOPP_ARM_AES_AVAILABLE)
+	if (HasAES())
+		return "ARMv8";
+#endif
+#if (CRYPTOGAMS_ARM_AES)
+	if (HasARMv7())
+		return "ARMv7";
+#endif
+#if (CRYPTOPP_POWER8_AES_AVAILABLE)
+	if (HasAES())
+		return "Power8";
+#endif
+	return "C++";
+}
+
+void Rijndael::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLen, const NameValuePairs &)
+{
+	AssertValidKeyLength(keyLen);
+
+#if (CRYPTOGAMS_ARM_AES)
+	if (HasARMv7())
+	{
+		m_rounds = keyLen/4 + 6;
+		m_key.New(4*(14+1)+4);
+
+		if (IsForwardTransformation())
+			CRYPTOGAMS_set_encrypt_key(userKey, keyLen*8, m_key.begin());
+		else
+			CRYPTOGAMS_set_decrypt_key(userKey, keyLen*8, m_key.begin());
+		return;
+	}
+#endif
+
+#if CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86
+	m_aliasBlock.New(s_sizeToAllocate);
+	// The alias block is only used on IA-32 when unaligned data access is in effect.
+	// Setting the low water mark to 0 avoids zeroization when m_aliasBlock is unused.
+	m_aliasBlock.SetMark(0);
+#endif
+
+	m_rounds = keyLen/4 + 6;
+	m_key.New(4*(m_rounds+1));
+	word32 *rk = m_key;
+
+#if (CRYPTOPP_AESNI_AVAILABLE && CRYPTOPP_SSE41_AVAILABLE && (!defined(CRYPTOPP_MSC_VERSION) || CRYPTOPP_MSC_VERSION >= 1600 || CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32))
+	// MSVC 2008 SP1 generates bad code for _mm_extract_epi32() when compiling for X64
+	if (HasAESNI() && HasSSE41())
+	{
+		// TODO: Add non-SSE4.1 variant for low-end Atoms. The low-end
+		//  Atoms have SSE2-SSSE3 and AES-NI, but not SSE4.1 or SSE4.2.
+		Rijndael_UncheckedSetKey_SSE4_AESNI(userKey, keyLen, rk);
+		if (!IsForwardTransformation())
+			Rijndael_UncheckedSetKeyRev_AESNI(m_key, m_rounds);
+
+		return;
+	}
+#endif
+
+#if CRYPTOPP_POWER8_AES_AVAILABLE
+	if (HasAES())
+	{
+		// We still need rcon and Se to fallback to C/C++ for AES-192 and AES-256.
+		// The IBM docs on AES sucks. Intel's docs on AESNI puts IBM to shame.
+		Rijndael_UncheckedSetKey_POWER8(userKey, keyLen, rk, Se);
+		return;
+	}
+#endif
+
+	GetUserKey(BIG_ENDIAN_ORDER, rk, keyLen/4, userKey, keyLen);
+	const word32 *rc = rcon;
+	word32 temp;
+
+	while (true)
+	{
+		temp  = rk[keyLen/4-1];
+		word32 x = (word32(Se[GETBYTE(temp, 2)]) << 24) ^ (word32(Se[GETBYTE(temp, 1)]) << 16) ^
+					(word32(Se[GETBYTE(temp, 0)]) << 8) ^ Se[GETBYTE(temp, 3)];
+		rk[keyLen/4] = rk[0] ^ x ^ *(rc++);
+		rk[keyLen/4+1] = rk[1] ^ rk[keyLen/4];
+		rk[keyLen/4+2] = rk[2] ^ rk[keyLen/4+1];
+		rk[keyLen/4+3] = rk[3] ^ rk[keyLen/4+2];
+
+		if (rk + keyLen/4 + 4 == m_key.end())
+			break;
+
+		if (keyLen == 24)
+		{
+			rk[10] = rk[ 4] ^ rk[ 9];
+			rk[11] = rk[ 5] ^ rk[10];
+		}
+		else if (keyLen == 32)
+		{
+    		temp = rk[11];
+    		rk[12] = rk[ 4] ^ (word32(Se[GETBYTE(temp, 3)]) << 24) ^ (word32(Se[GETBYTE(temp, 2)]) << 16) ^ (word32(Se[GETBYTE(temp, 1)]) << 8) ^ Se[GETBYTE(temp, 0)];
+    		rk[13] = rk[ 5] ^ rk[12];
+    		rk[14] = rk[ 6] ^ rk[13];
+    		rk[15] = rk[ 7] ^ rk[14];
+		}
+		rk += keyLen/4;
+	}
+
+	rk = m_key;
+
+	if (IsForwardTransformation())
+	{
+		if (!s_TeFilled)
+			FillEncTable();
+
+		ConditionalByteReverse(BIG_ENDIAN_ORDER, rk, rk, 16);
+		ConditionalByteReverse(BIG_ENDIAN_ORDER, rk + m_rounds*4, rk + m_rounds*4, 16);
+	}
+	else
+	{
+		if (!s_TdFilled)
+			FillDecTable();
+
+		#define InverseMixColumn(x) \
+			TL_M(Td, 0, Se[GETBYTE(x, 3)]) ^ TL_M(Td, 1, Se[GETBYTE(x, 2)]) ^ \
+			TL_M(Td, 2, Se[GETBYTE(x, 1)]) ^ TL_M(Td, 3, Se[GETBYTE(x, 0)])
+
+		unsigned int i, j;
+		for (i = 4, j = 4*m_rounds-4; i < j; i += 4, j -= 4)
+		{
+			temp = InverseMixColumn(rk[i    ]); rk[i    ] = InverseMixColumn(rk[j    ]); rk[j    ] = temp;
+			temp = InverseMixColumn(rk[i + 1]); rk[i + 1] = InverseMixColumn(rk[j + 1]); rk[j + 1] = temp;
+			temp = InverseMixColumn(rk[i + 2]); rk[i + 2] = InverseMixColumn(rk[j + 2]); rk[j + 2] = temp;
+			temp = InverseMixColumn(rk[i + 3]); rk[i + 3] = InverseMixColumn(rk[j + 3]); rk[j + 3] = temp;
+		}
+
+		rk[i+0] = InverseMixColumn(rk[i+0]);
+		rk[i+1] = InverseMixColumn(rk[i+1]);
+		rk[i+2] = InverseMixColumn(rk[i+2]);
+		rk[i+3] = InverseMixColumn(rk[i+3]);
+
+		temp = ConditionalByteReverse(BIG_ENDIAN_ORDER, rk[0]); rk[0] = ConditionalByteReverse(BIG_ENDIAN_ORDER, rk[4*m_rounds+0]); rk[4*m_rounds+0] = temp;
+		temp = ConditionalByteReverse(BIG_ENDIAN_ORDER, rk[1]); rk[1] = ConditionalByteReverse(BIG_ENDIAN_ORDER, rk[4*m_rounds+1]); rk[4*m_rounds+1] = temp;
+		temp = ConditionalByteReverse(BIG_ENDIAN_ORDER, rk[2]); rk[2] = ConditionalByteReverse(BIG_ENDIAN_ORDER, rk[4*m_rounds+2]); rk[4*m_rounds+2] = temp;
+		temp = ConditionalByteReverse(BIG_ENDIAN_ORDER, rk[3]); rk[3] = ConditionalByteReverse(BIG_ENDIAN_ORDER, rk[4*m_rounds+3]); rk[4*m_rounds+3] = temp;
+	}
+
+#if CRYPTOPP_AESNI_AVAILABLE
+	if (HasAESNI())
+		ConditionalByteReverse(BIG_ENDIAN_ORDER, rk+4, rk+4, (m_rounds-1)*16);
+#endif
+#if CRYPTOPP_ARM_AES_AVAILABLE
+	if (HasAES())
+		ConditionalByteReverse(BIG_ENDIAN_ORDER, rk+4, rk+4, (m_rounds-1)*16);
+#endif
+}
+
+void Rijndael::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE) || CRYPTOPP_AESNI_AVAILABLE
+# if (CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)) && !defined(CRYPTOPP_DISABLE_RIJNDAEL_ASM)
+	if (HasSSE2())
+# else
+	if (HasAESNI())
+# endif
+	{
+		(void)Rijndael::Enc::AdvancedProcessBlocks(inBlock, xorBlock, outBlock, 16, 0);
+		return;
+	}
+#endif
+
+#if (CRYPTOPP_ARM_AES_AVAILABLE)
+	if (HasAES())
+	{
+		(void)Rijndael::Enc::AdvancedProcessBlocks(inBlock, xorBlock, outBlock, 16, 0);
+		return;
+	}
+#endif
+
+#if (CRYPTOGAMS_ARM_AES)
+	if (HasARMv7())
+	{
+		CRYPTOGAMS_encrypt(inBlock, xorBlock, outBlock, m_key.begin());
+		return;
+	}
+#endif
+
+#if (CRYPTOPP_POWER8_AES_AVAILABLE)
+	if (HasAES())
+	{
+		(void)Rijndael::Enc::AdvancedProcessBlocks(inBlock, xorBlock, outBlock, 16, 0);
+		return;
+	}
+#endif
+
+	typedef BlockGetAndPut<word32, NativeByteOrder> Block;
+
+	word32 s0, s1, s2, s3, t0, t1, t2, t3;
+	Block::Get(inBlock)(s0)(s1)(s2)(s3);
+
+	const word32 *rk = m_key;
+	s0 ^= rk[0];
+	s1 ^= rk[1];
+	s2 ^= rk[2];
+	s3 ^= rk[3];
+	t0 = rk[4];
+	t1 = rk[5];
+	t2 = rk[6];
+	t3 = rk[7];
+	rk += 8;
+
+	// timing attack countermeasure. see comments at top for more details.
+	// also see http://github.com/weidai11/cryptopp/issues/146
+	const int cacheLineSize = GetCacheLineSize();
+	unsigned int i;
+	volatile word32 _u = 0;
+	word32 u = _u;
+#if defined(CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS)
+	for (i=0; i<2048; i+=cacheLineSize)
+#else
+	for (i=0; i<1024; i+=cacheLineSize)
+#endif
+		u &= *(const word32 *)(const void *)(((const byte *)Te)+i);
+	u &= Te[255];
+	s0 |= u; s1 |= u; s2 |= u; s3 |= u;
+
+	QUARTER_ROUND_FE(s3, t0, t1, t2, t3)
+	QUARTER_ROUND_FE(s2, t3, t0, t1, t2)
+	QUARTER_ROUND_FE(s1, t2, t3, t0, t1)
+	QUARTER_ROUND_FE(s0, t1, t2, t3, t0)
+
+	// Nr - 2 full rounds:
+	unsigned int r = m_rounds/2 - 1;
+	do
+	{
+		s0 = rk[0]; s1 = rk[1]; s2 = rk[2]; s3 = rk[3];
+
+		QUARTER_ROUND_E(t3, s0, s1, s2, s3)
+		QUARTER_ROUND_E(t2, s3, s0, s1, s2)
+		QUARTER_ROUND_E(t1, s2, s3, s0, s1)
+		QUARTER_ROUND_E(t0, s1, s2, s3, s0)
+
+		t0 = rk[4]; t1 = rk[5]; t2 = rk[6]; t3 = rk[7];
+
+		QUARTER_ROUND_E(s3, t0, t1, t2, t3)
+		QUARTER_ROUND_E(s2, t3, t0, t1, t2)
+		QUARTER_ROUND_E(s1, t2, t3, t0, t1)
+		QUARTER_ROUND_E(s0, t1, t2, t3, t0)
+
+		rk += 8;
+	} while (--r);
+
+	word32 tbw[4];
+	byte *const tempBlock = (byte *)tbw;
+
+	QUARTER_ROUND_LE(t2, 15, 2, 5, 8)
+	QUARTER_ROUND_LE(t1, 11, 14, 1, 4)
+	QUARTER_ROUND_LE(t0, 7, 10, 13, 0)
+	QUARTER_ROUND_LE(t3, 3, 6, 9, 12)
+
+	Block::Put(xorBlock, outBlock)(tbw[0]^rk[0])(tbw[1]^rk[1])(tbw[2]^rk[2])(tbw[3]^rk[3]);
+}
+
+void Rijndael::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+#if CRYPTOPP_AESNI_AVAILABLE
+	if (HasAESNI())
+	{
+		(void)Rijndael::Dec::AdvancedProcessBlocks(inBlock, xorBlock, outBlock, 16, 0);
+		return;
+	}
+#endif
+
+#if (CRYPTOPP_ARM_AES_AVAILABLE)
+	if (HasAES())
+	{
+		(void)Rijndael::Dec::AdvancedProcessBlocks(inBlock, xorBlock, outBlock, 16, 0);
+		return;
+	}
+#endif
+
+#if (CRYPTOGAMS_ARM_AES)
+	if (HasARMv7())
+	{
+		CRYPTOGAMS_decrypt(inBlock, xorBlock, outBlock, m_key.begin());
+		return;
+	}
+#endif
+
+#if (CRYPTOPP_POWER8_AES_AVAILABLE)
+	if (HasAES())
+	{
+		(void)Rijndael::Dec::AdvancedProcessBlocks(inBlock, xorBlock, outBlock, 16, 0);
+		return;
+	}
+#endif
+
+	typedef BlockGetAndPut<word32, NativeByteOrder> Block;
+
+	word32 s0, s1, s2, s3, t0, t1, t2, t3;
+	Block::Get(inBlock)(s0)(s1)(s2)(s3);
+
+	const word32 *rk = m_key;
+	s0 ^= rk[0];
+	s1 ^= rk[1];
+	s2 ^= rk[2];
+	s3 ^= rk[3];
+	t0 = rk[4];
+	t1 = rk[5];
+	t2 = rk[6];
+	t3 = rk[7];
+	rk += 8;
+
+	// timing attack countermeasure. see comments at top for more details.
+	// also see http://github.com/weidai11/cryptopp/issues/146
+	const int cacheLineSize = GetCacheLineSize();
+	unsigned int i;
+	volatile word32 _u = 0;
+	word32 u = _u;
+#if defined(CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS)
+	for (i=0; i<2048; i+=cacheLineSize)
+#else
+	for (i=0; i<1024; i+=cacheLineSize)
+#endif
+		u &= *(const word32 *)(const void *)(((const byte *)Td)+i);
+	u &= Td[255];
+	s0 |= u; s1 |= u; s2 |= u; s3 |= u;
+
+	QUARTER_ROUND_FD(s3, t2, t1, t0, t3)
+	QUARTER_ROUND_FD(s2, t1, t0, t3, t2)
+	QUARTER_ROUND_FD(s1, t0, t3, t2, t1)
+	QUARTER_ROUND_FD(s0, t3, t2, t1, t0)
+
+	// Nr - 2 full rounds:
+	unsigned int r = m_rounds/2 - 1;
+	do
+	{
+		s0 = rk[0]; s1 = rk[1]; s2 = rk[2]; s3 = rk[3];
+
+		QUARTER_ROUND_D(t3, s2, s1, s0, s3)
+		QUARTER_ROUND_D(t2, s1, s0, s3, s2)
+		QUARTER_ROUND_D(t1, s0, s3, s2, s1)
+		QUARTER_ROUND_D(t0, s3, s2, s1, s0)
+
+		t0 = rk[4]; t1 = rk[5]; t2 = rk[6]; t3 = rk[7];
+
+		QUARTER_ROUND_D(s3, t2, t1, t0, t3)
+		QUARTER_ROUND_D(s2, t1, t0, t3, t2)
+		QUARTER_ROUND_D(s1, t0, t3, t2, t1)
+		QUARTER_ROUND_D(s0, t3, t2, t1, t0)
+
+		rk += 8;
+	} while (--r);
+
+#if !(defined(CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS))
+	// timing attack countermeasure. see comments at top for more details
+	// If CRYPTOPP_ALLOW_RIJNDAEL_UNALIGNED_DATA_ACCESS is defined,
+	// QUARTER_ROUND_LD will use Td, which is already preloaded.
+	u = _u;
+	for (i=0; i<256; i+=cacheLineSize)
+		u &= *(const word32 *)(const void *)(Sd+i);
+	u &= *(const word32 *)(const void *)(Sd+252);
+	t0 |= u; t1 |= u; t2 |= u; t3 |= u;
+#endif
+
+	word32 tbw[4];
+	byte *const tempBlock = (byte *)tbw;
+
+	QUARTER_ROUND_LD(t2, 7, 2, 13, 8)
+	QUARTER_ROUND_LD(t1, 3, 14, 9, 4)
+	QUARTER_ROUND_LD(t0, 15, 10, 5, 0)
+	QUARTER_ROUND_LD(t3, 11, 6, 1, 12)
+
+	Block::Put(xorBlock, outBlock)(tbw[0]^rk[0])(tbw[1]^rk[1])(tbw[2]^rk[2])(tbw[3]^rk[3]);
+}
+
+// ************************* Assembly Code ************************************
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4731)	// frame pointer register 'ebp' modified by inline assembly code
+#endif
+
+#endif // #ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE && !defined(CRYPTOPP_DISABLE_RIJNDAEL_ASM)
+
+CRYPTOPP_NAKED void CRYPTOPP_FASTCALL Rijndael_Enc_AdvancedProcessBlocks_SSE2(void *locals, const word32 *k)
+{
+	CRYPTOPP_UNUSED(locals); CRYPTOPP_UNUSED(k);
+
+#if CRYPTOPP_BOOL_X86
+
+#define L_REG			esp
+#define L_INDEX(i)		(L_REG+768+i)
+#define L_INXORBLOCKS	L_INBLOCKS+4
+#define L_OUTXORBLOCKS	L_INBLOCKS+8
+#define L_OUTBLOCKS		L_INBLOCKS+12
+#define L_INCREMENTS	L_INDEX(16*15)
+#define L_SP			L_INDEX(16*16)
+#define L_LENGTH		L_INDEX(16*16+4)
+#define L_KEYS_BEGIN	L_INDEX(16*16+8)
+
+#define MOVD			movd
+#define MM(i)			mm##i
+
+#define MXOR(a,b,c)	\
+	AS2(	movzx	esi, b)\
+	AS2(	movd	mm7, DWORD PTR [AS_REG_7+8*WORD_REG(si)+MAP0TO4(c)])\
+	AS2(	pxor	MM(a), mm7)\
+
+#define MMOV(a,b,c)	\
+	AS2(	movzx	esi, b)\
+	AS2(	movd	MM(a), DWORD PTR [AS_REG_7+8*WORD_REG(si)+MAP0TO4(c)])\
+
+#else
+
+#define L_REG			r8
+#define L_INDEX(i)		(L_REG+i)
+#define L_INXORBLOCKS	L_INBLOCKS+8
+#define L_OUTXORBLOCKS	L_INBLOCKS+16
+#define L_OUTBLOCKS		L_INBLOCKS+24
+#define L_INCREMENTS	L_INDEX(16*16)
+#define L_LENGTH		L_INDEX(16*18+8)
+#define L_KEYS_BEGIN	L_INDEX(16*19)
+
+#define MOVD			mov
+#define MM_0			r9d
+#define MM_1			r12d
+#ifdef __GNUC__
+#define MM_2			r11d
+#else
+#define MM_2			r10d
+#endif
+#define MM(i)			MM_##i
+
+#define MXOR(a,b,c)	\
+	AS2(	movzx	esi, b)\
+	AS2(	xor		MM(a), DWORD PTR [AS_REG_7+8*WORD_REG(si)+MAP0TO4(c)])\
+
+#define MMOV(a,b,c)	\
+	AS2(	movzx	esi, b)\
+	AS2(	mov		MM(a), DWORD PTR [AS_REG_7+8*WORD_REG(si)+MAP0TO4(c)])\
+
+#endif
+
+#define L_SUBKEYS		L_INDEX(0)
+#define L_SAVED_X		L_SUBKEYS
+#define L_KEY12			L_INDEX(16*12)
+#define L_LASTROUND		L_INDEX(16*13)
+#define L_INBLOCKS		L_INDEX(16*14)
+#define MAP0TO4(i)		(ASM_MOD(i+3,4)+1)
+
+#define XOR(a,b,c)	\
+	AS2(	movzx	esi, b)\
+	AS2(	xor		a, DWORD PTR [AS_REG_7+8*WORD_REG(si)+MAP0TO4(c)])\
+
+#define MOV(a,b,c)	\
+	AS2(	movzx	esi, b)\
+	AS2(	mov		a, DWORD PTR [AS_REG_7+8*WORD_REG(si)+MAP0TO4(c)])\
+
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+		ALIGN   8
+	Rijndael_Enc_AdvancedProcessBlocks	PROC FRAME
+		rex_push_reg rsi
+		push_reg rdi
+		push_reg rbx
+		push_reg r12
+		.endprolog
+		mov L_REG, rcx
+		mov AS_REG_7, ?Te@rdtable@CryptoPP@@3PA_KA
+		mov edi, DWORD PTR [?g_cacheLineSize@CryptoPP@@3IA]
+#elif defined(__GNUC__)
+	__asm__ __volatile__
+	(
+	INTEL_NOPREFIX
+	#if CRYPTOPP_BOOL_X64
+	AS2(	mov		L_REG, rcx)
+	#endif
+	AS_PUSH_IF86(bx)
+	AS_PUSH_IF86(bp)
+	AS2(	mov		AS_REG_7, WORD_REG(si))
+#else
+	AS_PUSH_IF86(si)
+	AS_PUSH_IF86(di)
+	AS_PUSH_IF86(bx)
+	AS_PUSH_IF86(bp)
+	AS2(	lea		AS_REG_7, [Te])
+	AS2(	mov		edi, [g_cacheLineSize])
+#endif
+
+#if CRYPTOPP_BOOL_X86
+	AS2(	mov		[ecx+16*12+16*4], esp)	// save esp to L_SP
+	AS2(	lea		esp, [ecx-768])
+#endif
+
+	// copy subkeys to stack
+	AS2(	mov		WORD_REG(si), [L_KEYS_BEGIN])
+	AS2(	mov		WORD_REG(ax), 16)
+	AS2(	and		WORD_REG(ax), WORD_REG(si))
+	AS2(	movdqa	xmm3, XMMWORD_PTR [WORD_REG(dx)+16+WORD_REG(ax)])	// subkey 1 (non-counter) or 2 (counter)
+	AS2(	movdqa	[L_KEY12], xmm3)
+	AS2(	lea		WORD_REG(ax), [WORD_REG(dx)+WORD_REG(ax)+2*16])
+	AS2(	sub		WORD_REG(ax), WORD_REG(si))
+	ASL(0)
+	AS2(	movdqa	xmm0, [WORD_REG(ax)+WORD_REG(si)])
+	AS2(	movdqa	XMMWORD_PTR [L_SUBKEYS+WORD_REG(si)], xmm0)
+	AS2(	add		WORD_REG(si), 16)
+	AS2(	cmp		WORD_REG(si), 16*12)
+	ATT_NOPREFIX
+	ASJ(	jl,		0, b)
+	INTEL_NOPREFIX
+
+	// read subkeys 0, 1 and last
+	AS2(	movdqa	xmm4, [WORD_REG(ax)+WORD_REG(si)])	// last subkey
+	AS2(	movdqa	xmm1, [WORD_REG(dx)])			// subkey 0
+	AS2(	MOVD	MM(1), [WORD_REG(dx)+4*4])		// 0,1,2,3
+	AS2(	mov		ebx, [WORD_REG(dx)+5*4])		// 4,5,6,7
+	AS2(	mov		ecx, [WORD_REG(dx)+6*4])		// 8,9,10,11
+	AS2(	mov		edx, [WORD_REG(dx)+7*4])		// 12,13,14,15
+
+	// load table into cache
+	AS2(	xor		WORD_REG(ax), WORD_REG(ax))
+	ASL(9)
+	AS2(	mov		esi, [AS_REG_7+WORD_REG(ax)])
+	AS2(	add		WORD_REG(ax), WORD_REG(di))
+	AS2(	mov		esi, [AS_REG_7+WORD_REG(ax)])
+	AS2(	add		WORD_REG(ax), WORD_REG(di))
+	AS2(	mov		esi, [AS_REG_7+WORD_REG(ax)])
+	AS2(	add		WORD_REG(ax), WORD_REG(di))
+	AS2(	mov		esi, [AS_REG_7+WORD_REG(ax)])
+	AS2(	add		WORD_REG(ax), WORD_REG(di))
+	AS2(	cmp		WORD_REG(ax), 2048)
+	ATT_NOPREFIX
+	ASJ(	jl,		9, b)
+	INTEL_NOPREFIX
+	AS1(	lfence)
+
+	AS2(	test	DWORD PTR [L_LENGTH], 1)
+	ATT_NOPREFIX
+	ASJ(	jz,		8, f)
+	INTEL_NOPREFIX
+
+	// counter mode one-time setup
+	AS2(	mov		WORD_REG(si), [L_INBLOCKS])
+	AS2(	movdqu	xmm2, [WORD_REG(si)])	// counter
+	AS2(	pxor	xmm2, xmm1)
+	AS2(	psrldq	xmm1, 14)
+	AS2(	movd	eax, xmm1)
+	AS2(	mov		al, BYTE PTR [WORD_REG(si)+15])
+	AS2(	MOVD	MM(2), eax)
+#if CRYPTOPP_BOOL_X86
+	AS2(	mov		eax, 1)
+	AS2(	movd	mm3, eax)
+#endif
+
+	// partial first round, in: xmm2(15,14,13,12;11,10,9,8;7,6,5,4;3,2,1,0), out: mm1, ebx, ecx, edx
+	AS2(	movd	eax, xmm2)
+	AS2(	psrldq	xmm2, 4)
+	AS2(	movd	edi, xmm2)
+	AS2(	psrldq	xmm2, 4)
+		MXOR(		1, al, 0)		// 0
+		XOR(		edx, ah, 1)		// 1
+	AS2(	shr		eax, 16)
+		XOR(		ecx, al, 2)		// 2
+		XOR(		ebx, ah, 3)		// 3
+	AS2(	mov		eax, edi)
+	AS2(	movd	edi, xmm2)
+	AS2(	psrldq	xmm2, 4)
+		XOR(		ebx, al, 0)		// 4
+		MXOR(		1, ah, 1)		// 5
+	AS2(	shr		eax, 16)
+		XOR(		edx, al, 2)		// 6
+		XOR(		ecx, ah, 3)		// 7
+	AS2(	mov		eax, edi)
+	AS2(	movd	edi, xmm2)
+		XOR(		ecx, al, 0)		// 8
+		XOR(		ebx, ah, 1)		// 9
+	AS2(	shr		eax, 16)
+		MXOR(		1, al, 2)		// 10
+		XOR(		edx, ah, 3)		// 11
+	AS2(	mov		eax, edi)
+		XOR(		edx, al, 0)		// 12
+		XOR(		ecx, ah, 1)		// 13
+	AS2(	shr		eax, 16)
+		XOR(		ebx, al, 2)		// 14
+	AS2(	psrldq	xmm2, 3)
+
+	// partial second round, in: ebx(4,5,6,7), ecx(8,9,10,11), edx(12,13,14,15), out: eax, ebx, edi, mm0
+	AS2(	mov		eax, [L_KEY12+0*4])
+	AS2(	mov		edi, [L_KEY12+2*4])
+	AS2(	MOVD	MM(0), [L_KEY12+3*4])
+		MXOR(	0, cl, 3)	/* 11 */
+		XOR(	edi, bl, 3)	/* 7 */
+		MXOR(	0, bh, 2)	/* 6 */
+	AS2(	shr ebx, 16)	/* 4,5 */
+		XOR(	eax, bl, 1)	/* 5 */
+		MOV(	ebx, bh, 0)	/* 4 */
+	AS2(	xor		ebx, [L_KEY12+1*4])
+		XOR(	eax, ch, 2)	/* 10 */
+	AS2(	shr ecx, 16)	/* 8,9 */
+		XOR(	eax, dl, 3)	/* 15 */
+		XOR(	ebx, dh, 2)	/* 14 */
+	AS2(	shr edx, 16)	/* 12,13 */
+		XOR(	edi, ch, 0)	/* 8 */
+		XOR(	ebx, cl, 1)	/* 9 */
+		XOR(	edi, dl, 1)	/* 13 */
+		MXOR(	0, dh, 0)	/* 12 */
+
+	AS2(	movd	ecx, xmm2)
+	AS2(	MOVD	edx, MM(1))
+	AS2(	MOVD	[L_SAVED_X+3*4], MM(0))
+	AS2(	mov		[L_SAVED_X+0*4], eax)
+	AS2(	mov		[L_SAVED_X+1*4], ebx)
+	AS2(	mov		[L_SAVED_X+2*4], edi)
+	ATT_NOPREFIX
+	ASJ(	jmp,	5, f)
+	INTEL_NOPREFIX
+	ASL(3)
+	// non-counter mode per-block setup
+	AS2(	MOVD	MM(1), [L_KEY12+0*4])	// 0,1,2,3
+	AS2(	mov		ebx, [L_KEY12+1*4])		// 4,5,6,7
+	AS2(	mov		ecx, [L_KEY12+2*4])		// 8,9,10,11
+	AS2(	mov		edx, [L_KEY12+3*4])		// 12,13,14,15
+	ASL(8)
+	AS2(	mov		WORD_REG(ax), [L_INBLOCKS])
+	AS2(	movdqu	xmm2, [WORD_REG(ax)])
+	AS2(	mov		WORD_REG(si), [L_INXORBLOCKS])
+	AS2(	movdqu	xmm5, [WORD_REG(si)])
+	AS2(	pxor	xmm2, xmm1)
+	AS2(	pxor	xmm2, xmm5)
+
+	// first round, in: xmm2(15,14,13,12;11,10,9,8;7,6,5,4;3,2,1,0), out: eax, ebx, ecx, edx
+	AS2(	movd	eax, xmm2)
+	AS2(	psrldq	xmm2, 4)
+	AS2(	movd	edi, xmm2)
+	AS2(	psrldq	xmm2, 4)
+		MXOR(		1, al, 0)		// 0
+		XOR(		edx, ah, 1)		// 1
+	AS2(	shr		eax, 16)
+		XOR(		ecx, al, 2)		// 2
+		XOR(		ebx, ah, 3)		// 3
+	AS2(	mov		eax, edi)
+	AS2(	movd	edi, xmm2)
+	AS2(	psrldq	xmm2, 4)
+		XOR(		ebx, al, 0)		// 4
+		MXOR(		1, ah, 1)		// 5
+	AS2(	shr		eax, 16)
+		XOR(		edx, al, 2)		// 6
+		XOR(		ecx, ah, 3)		// 7
+	AS2(	mov		eax, edi)
+	AS2(	movd	edi, xmm2)
+		XOR(		ecx, al, 0)		// 8
+		XOR(		ebx, ah, 1)		// 9
+	AS2(	shr		eax, 16)
+		MXOR(		1, al, 2)		// 10
+		XOR(		edx, ah, 3)		// 11
+	AS2(	mov		eax, edi)
+		XOR(		edx, al, 0)		// 12
+		XOR(		ecx, ah, 1)		// 13
+	AS2(	shr		eax, 16)
+		XOR(		ebx, al, 2)		// 14
+		MXOR(		1, ah, 3)		// 15
+	AS2(	MOVD	eax, MM(1))
+
+	AS2(	add		L_REG, [L_KEYS_BEGIN])
+	AS2(	add		L_REG, 4*16)
+	ATT_NOPREFIX
+	ASJ(	jmp,	2, f)
+	INTEL_NOPREFIX
+	ASL(1)
+	// counter-mode per-block setup
+	AS2(	MOVD	ecx, MM(2))
+	AS2(	MOVD	edx, MM(1))
+	AS2(	mov		eax, [L_SAVED_X+0*4])
+	AS2(	mov		ebx, [L_SAVED_X+1*4])
+	AS2(	xor		cl, ch)
+	AS2(	and		WORD_REG(cx), 255)
+	ASL(5)
+#if CRYPTOPP_BOOL_X86
+	AS2(	paddb	MM(2), mm3)
+#else
+	AS2(	add		MM(2), 1)
+#endif
+	// remaining part of second round, in: edx(previous round),esi(keyed counter byte) eax,ebx,[L_SAVED_X+2*4],[L_SAVED_X+3*4], out: eax,ebx,ecx,edx
+	AS2(	xor		edx, DWORD PTR [AS_REG_7+WORD_REG(cx)*8+3])
+		XOR(		ebx, dl, 3)
+		MOV(		ecx, dh, 2)
+	AS2(	shr		edx, 16)
+	AS2(	xor		ecx, [L_SAVED_X+2*4])
+		XOR(		eax, dh, 0)
+		MOV(		edx, dl, 1)
+	AS2(	xor		edx, [L_SAVED_X+3*4])
+
+	AS2(	add		L_REG, [L_KEYS_BEGIN])
+	AS2(	add		L_REG, 3*16)
+	ATT_NOPREFIX
+	ASJ(	jmp,	4, f)
+	INTEL_NOPREFIX
+
+// in: eax(0,1,2,3), ebx(4,5,6,7), ecx(8,9,10,11), edx(12,13,14,15)
+// out: eax, ebx, edi, mm0
+#define ROUND()		\
+		MXOR(	0, cl, 3)	/* 11 */\
+	AS2(	mov	cl, al)		/* 8,9,10,3 */\
+		XOR(	edi, ah, 2)	/* 2 */\
+	AS2(	shr eax, 16)	/* 0,1 */\
+		XOR(	edi, bl, 3)	/* 7 */\
+		MXOR(	0, bh, 2)	/* 6 */\
+	AS2(	shr ebx, 16)	/* 4,5 */\
+		MXOR(	0, al, 1)	/* 1 */\
+		MOV(	eax, ah, 0)	/* 0 */\
+		XOR(	eax, bl, 1)	/* 5 */\
+		MOV(	ebx, bh, 0)	/* 4 */\
+		XOR(	eax, ch, 2)	/* 10 */\
+		XOR(	ebx, cl, 3)	/* 3 */\
+	AS2(	shr ecx, 16)	/* 8,9 */\
+		XOR(	eax, dl, 3)	/* 15 */\
+		XOR(	ebx, dh, 2)	/* 14 */\
+	AS2(	shr edx, 16)	/* 12,13 */\
+		XOR(	edi, ch, 0)	/* 8 */\
+		XOR(	ebx, cl, 1)	/* 9 */\
+		XOR(	edi, dl, 1)	/* 13 */\
+		MXOR(	0, dh, 0)	/* 12 */\
+
+	ASL(2)	// 2-round loop
+	AS2(	MOVD	MM(0), [L_SUBKEYS-4*16+3*4])
+	AS2(	mov		edi, [L_SUBKEYS-4*16+2*4])
+	ROUND()
+	AS2(	mov		ecx, edi)
+	AS2(	xor		eax, [L_SUBKEYS-4*16+0*4])
+	AS2(	xor		ebx, [L_SUBKEYS-4*16+1*4])
+	AS2(	MOVD	edx, MM(0))
+
+	ASL(4)
+	AS2(	MOVD	MM(0), [L_SUBKEYS-4*16+7*4])
+	AS2(	mov		edi, [L_SUBKEYS-4*16+6*4])
+	ROUND()
+	AS2(	mov		ecx, edi)
+	AS2(	xor		eax, [L_SUBKEYS-4*16+4*4])
+	AS2(	xor		ebx, [L_SUBKEYS-4*16+5*4])
+	AS2(	MOVD	edx, MM(0))
+
+	AS2(	add		L_REG, 32)
+	AS2(	test	L_REG, 255)
+	ATT_NOPREFIX
+	ASJ(	jnz,	2, b)
+	INTEL_NOPREFIX
+	AS2(	sub		L_REG, 16*16)
+
+#define LAST(a, b, c)												\
+	AS2(	movzx	esi, a											)\
+	AS2(	movzx	edi, BYTE PTR [AS_REG_7+WORD_REG(si)*8+1]	)\
+	AS2(	movzx	esi, b											)\
+	AS2(	xor		edi, DWORD PTR [AS_REG_7+WORD_REG(si)*8+0]	)\
+	AS2(	mov		WORD PTR [L_LASTROUND+c], di					)\
+
+	// last round
+	LAST(ch, dl, 2)
+	LAST(dh, al, 6)
+	AS2(	shr		edx, 16)
+	LAST(ah, bl, 10)
+	AS2(	shr		eax, 16)
+	LAST(bh, cl, 14)
+	AS2(	shr		ebx, 16)
+	LAST(dh, al, 12)
+	AS2(	shr		ecx, 16)
+	LAST(ah, bl, 0)
+	LAST(bh, cl, 4)
+	LAST(ch, dl, 8)
+
+	AS2(	mov		WORD_REG(ax), [L_OUTXORBLOCKS])
+	AS2(	mov		WORD_REG(bx), [L_OUTBLOCKS])
+
+	AS2(	mov		WORD_REG(cx), [L_LENGTH])
+	AS2(	sub		WORD_REG(cx), 16)
+
+	AS2(	movdqu	xmm2, [WORD_REG(ax)])
+	AS2(	pxor	xmm2, xmm4)
+
+#if CRYPTOPP_BOOL_X86
+	AS2(	movdqa	xmm0, [L_INCREMENTS])
+	AS2(	paddd	xmm0, [L_INBLOCKS])
+	AS2(	movdqa	[L_INBLOCKS], xmm0)
+#else
+	AS2(	movdqa	xmm0, [L_INCREMENTS+16])
+	AS2(	paddq	xmm0, [L_INBLOCKS+16])
+	AS2(	movdqa	[L_INBLOCKS+16], xmm0)
+#endif
+
+	AS2(	pxor	xmm2, [L_LASTROUND])
+	AS2(	movdqu	[WORD_REG(bx)], xmm2)
+
+	ATT_NOPREFIX
+	ASJ(	jle,	7, f)
+	INTEL_NOPREFIX
+	AS2(	mov		[L_LENGTH], WORD_REG(cx))
+	AS2(	test	WORD_REG(cx), 1)
+	ATT_NOPREFIX
+	ASJ(	jnz,	1, b)
+	INTEL_NOPREFIX
+#if CRYPTOPP_BOOL_X64
+	AS2(	movdqa	xmm0, [L_INCREMENTS])
+	AS2(	paddq	xmm0, [L_INBLOCKS])
+	AS2(	movdqa	[L_INBLOCKS], xmm0)
+#endif
+	ATT_NOPREFIX
+	ASJ(	jmp,	3, b)
+	INTEL_NOPREFIX
+
+	ASL(7)
+	// erase keys on stack
+	AS2(	xorps	xmm0, xmm0)
+	AS2(	lea		WORD_REG(ax), [L_SUBKEYS+7*16])
+	AS2(	movaps	[WORD_REG(ax)-7*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)-6*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)-5*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)-4*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)-3*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)-2*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)-1*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)+0*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)+1*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)+2*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)+3*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)+4*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)+5*16], xmm0)
+	AS2(	movaps	[WORD_REG(ax)+6*16], xmm0)
+#if CRYPTOPP_BOOL_X86
+	AS2(	mov		esp, [L_SP])
+	AS1(	emms)
+#endif
+	AS_POP_IF86(bp)
+	AS_POP_IF86(bx)
+#if defined(CRYPTOPP_MSC_VERSION) && CRYPTOPP_BOOL_X86
+	AS_POP_IF86(di)
+	AS_POP_IF86(si)
+	AS1(ret)
+#endif
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+	pop r12
+	pop rbx
+	pop rdi
+	pop rsi
+	ret
+	Rijndael_Enc_AdvancedProcessBlocks ENDP
+#endif
+#ifdef __GNUC__
+	ATT_PREFIX
+	:
+	: "c" (locals), "d" (k), "S" (Te), "D" (g_cacheLineSize)
+	: "memory", "cc", "%eax"
+	#if CRYPTOPP_BOOL_X64
+		, "%rbx", "%r8", "%r9", "%r10", "%r11", "%r12"
+	#endif
+	);
+#endif
+}
+
+#endif
+
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+extern "C" {
+void Rijndael_Enc_AdvancedProcessBlocks_SSE2(void *locals, const word32 *k);
+}
+#endif
+
+#if CRYPTOPP_RIJNDAEL_ADVANCED_PROCESS_BLOCKS
+size_t Rijndael::Enc::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const
+{
+#if CRYPTOPP_AESNI_AVAILABLE
+	if (HasAESNI())
+		return Rijndael_Enc_AdvancedProcessBlocks_AESNI(m_key, m_rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if CRYPTOPP_ARM_AES_AVAILABLE
+	if (HasAES())
+		return Rijndael_Enc_AdvancedProcessBlocks_ARMV8(m_key, m_rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if CRYPTOPP_POWER8_AES_AVAILABLE
+	if (HasAES())
+		return Rijndael_Enc_AdvancedProcessBlocks128_6x1_ALTIVEC(m_key, m_rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+
+#if (CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)) && !defined(CRYPTOPP_DISABLE_RIJNDAEL_ASM)
+	if (HasSSE2())
+	{
+		if (length < BLOCKSIZE)
+			return length;
+
+		static const byte *zeros = (const byte*)(Te+256);
+		m_aliasBlock.SetMark(m_aliasBlock.size());
+		byte *space = NULLPTR, *originalSpace = const_cast<byte*>(m_aliasBlock.data());
+
+		// round up to nearest 256 byte boundary
+		space = originalSpace +	(s_aliasBlockSize - (uintptr_t)originalSpace % s_aliasBlockSize) % s_aliasBlockSize;
+		while (AliasedWithTable(space, space + sizeof(Locals)))
+		{
+			space += 256;
+			CRYPTOPP_ASSERT(space < (originalSpace + s_aliasPageSize));
+		}
+
+		size_t increment = BLOCKSIZE;
+		if (flags & BT_ReverseDirection)
+		{
+			CRYPTOPP_ASSERT(length % BLOCKSIZE == 0);
+			inBlocks += length - BLOCKSIZE;
+			xorBlocks += length - BLOCKSIZE;
+			outBlocks += length - BLOCKSIZE;
+			increment = 0-increment;
+		}
+
+		Locals &locals = *(Locals *)(void *)space;
+
+		locals.inBlocks = inBlocks;
+		locals.inXorBlocks = (flags & BT_XorInput) && xorBlocks ? xorBlocks : zeros;
+		locals.outXorBlocks = (flags & BT_XorInput) || !xorBlocks ? zeros : xorBlocks;
+		locals.outBlocks = outBlocks;
+
+		locals.inIncrement = (flags & BT_DontIncrementInOutPointers) ? 0 : increment;
+		locals.inXorIncrement = (flags & BT_XorInput) && xorBlocks ? increment : 0;
+		locals.outXorIncrement = (flags & BT_XorInput) || !xorBlocks ? 0 : increment;
+		locals.outIncrement = (flags & BT_DontIncrementInOutPointers) ? 0 : increment;
+
+		locals.lengthAndCounterFlag = length - (length%16) - bool(flags & BT_InBlockIsCounter);
+		int keysToCopy = m_rounds - (flags & BT_InBlockIsCounter ? 3 : 2);
+		locals.keysBegin = (12-keysToCopy)*16;
+
+		Rijndael_Enc_AdvancedProcessBlocks_SSE2(&locals, m_key);
+
+		return length % BLOCKSIZE;
+	}
+#endif
+
+	return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t Rijndael::Dec::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const
+{
+#if CRYPTOPP_AESNI_AVAILABLE
+	if (HasAESNI())
+		return Rijndael_Dec_AdvancedProcessBlocks_AESNI(m_key, m_rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if CRYPTOPP_ARM_AES_AVAILABLE
+	if (HasAES())
+		return Rijndael_Dec_AdvancedProcessBlocks_ARMV8(m_key, m_rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if CRYPTOPP_POWER8_AES_AVAILABLE
+	if (HasAES())
+		return Rijndael_Dec_AdvancedProcessBlocks128_6x1_ALTIVEC(m_key, m_rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+
+	return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif	// CRYPTOPP_RIJNDAEL_ADVANCED_PROCESS_BLOCKS
+
+NAMESPACE_END
+
+#endif
+#endif
diff --git a/runtime/third_party/cryptopp/rijndael.h b/runtime/third_party/cryptopp/rijndael.h
new file mode 100644
index 0000000..272975a
--- /dev/null
+++ b/runtime/third_party/cryptopp/rijndael.h
@@ -0,0 +1,109 @@
+// rijndael.h - originally written and placed in the public domain by Wei Dai
+
+/// \file rijndael.h
+/// \brief Classes for Rijndael encryption algorithm
+/// \details All key sizes are supported. The library only provides Rijndael with 128-bit blocks,
+///   and not 192-bit or 256-bit blocks
+/// \since Rijndael since Crypto++ 3.1, Intel AES-NI since Crypto++ 5.6.1, ARMv8 AES since Crypto++ 6.0,
+///   Power8 AES since Crypto++ 6.0, ARMv7 AES since Crypto++ 8.0
+
+#ifndef CRYPTOPP_RIJNDAEL_H
+#define CRYPTOPP_RIJNDAEL_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+// Clang 3.3 integrated assembler crash on Linux. Clang 3.4 due to compiler
+// error with .intel_syntax, http://llvm.org/bugs/show_bug.cgi?id=24232
+#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+# define CRYPTOPP_DISABLE_RIJNDAEL_ASM 1
+#endif
+
+#if CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_ARM32 || \
+	CRYPTOPP_BOOL_ARMV8 || CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64
+# define CRYPTOPP_RIJNDAEL_ADVANCED_PROCESS_BLOCKS 1
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Rijndael block cipher information
+/// \details All key sizes are supported. The library only provides Rijndael with 128-bit blocks,
+///   and not 192-bit or 256-bit blocks
+/// \since Rijndael since Crypto++ 3.1, Intel AES-NI since Crypto++ 5.6.1, ARMv8 AES since Crypto++ 6.0,
+///   Power8 AES since Crypto++ 6.0, ARMv7 AES since Crypto++ 8.0
+struct Rijndael_Info : public FixedBlockSize<16>, public VariableKeyLength<16, 16, 32, 8>
+{
+	CRYPTOPP_DLL static const char * CRYPTOPP_API StaticAlgorithmName() {return "AES";}
+};
+
+/// \brief Rijndael block cipher
+/// \details All key sizes are supported. The library only provides Rijndael with 128-bit blocks,
+///   and not 192-bit or 256-bit blocks
+/// \since Rijndael since Crypto++ 3.1, Intel AES-NI since Crypto++ 5.6.1, ARMv8 AES since Crypto++ 6.0,
+///   Power8 AES since Crypto++ 6.0, ARMv7 AES since Crypto++ 8.0
+/// \sa <a href="http://www.cryptopp.com/wiki/Rijndael">Rijndael</a>
+class CRYPTOPP_DLL Rijndael : public Rijndael_Info, public BlockCipherDocumentation
+{
+	/// \brief Rijndael block cipher transformation functions
+	/// \details Provides implementation common to encryption and decryption
+	class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<Rijndael_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+		std::string AlgorithmProvider() const;
+		unsigned int OptimalDataAlignment() const;
+
+	protected:
+		static void FillEncTable();
+		static void FillDecTable();
+
+		// VS2005 workaround: have to put these on separate lines, or error C2487 is triggered in DLL build
+		static const byte Se[256];
+		static const byte Sd[256];
+
+		static const word32 rcon[];
+
+		unsigned int m_rounds;
+		SecBlock<word32, AllocatorWithCleanup<word32, true> > m_key;
+		mutable SecByteBlock m_aliasBlock;
+	};
+
+	/// \brief Encryption transformation
+	/// \details Enc provides implementation for encryption transformation. All key sizes are supported.
+	///   The library only provides Rijndael with 128-bit blocks, and not 192-bit or 256-bit blocks
+	/// \since Rijndael since Crypto++ 3.1, Intel AES-NI since Crypto++ 5.6.1, ARMv8 AES since Crypto++ 6.0,
+	///   Power8 AES since Crypto++ 6.0, ARMv7 AES since Crypto++ 8.0
+	class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+#if CRYPTOPP_RIJNDAEL_ADVANCED_PROCESS_BLOCKS
+		size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+	};
+
+	/// \brief Decryption transformation
+	/// \details Dec provides implementation for decryption transformation. All key sizes are supported.
+	///   The library only provides Rijndael with 128-bit blocks, and not 192-bit or 256-bit blocks
+	/// \since Rijndael since Crypto++ 3.1, Intel AES-NI since Crypto++ 5.6.1, ARMv8 AES since Crypto++ 6.0,
+	///   Power8 AES since Crypto++ 6.0, ARMv7 AES since Crypto++ 8.0
+	class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+#if CRYPTOPP_RIJNDAEL_ADVANCED_PROCESS_BLOCKS
+		size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef Rijndael::Encryption RijndaelEncryption;
+typedef Rijndael::Decryption RijndaelDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rijndael_simd.cpp b/runtime/third_party/cryptopp/rijndael_simd.cpp
new file mode 100644
index 0000000..17110c1
--- /dev/null
+++ b/runtime/third_party/cryptopp/rijndael_simd.cpp
@@ -0,0 +1,734 @@
+// rijndael_simd.cpp - written and placed in the public domain by
+//                     Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//                     AES-NI code originally written by Wei Dai.
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    AES-NI, ARMv8a AES and Power8 AES instructions. A separate source
+//    file is needed because additional CXXFLAGS are required to enable
+//    the appropriate instructions sets in some build configurations.
+//
+//    ARMv8a AES code based on CriticalBlue code from Johannes Schneiders,
+//    Skip Hovsmith and Barry O'Rourke for the mbedTLS project. Stepping
+//    mbedTLS under a debugger was helped for us to determine problems
+//    with our subkey generation and scheduling.
+//
+//    AltiVec and Power8 code based on http://github.com/noloader/AES-Intrinsics and
+//    http://www.ibm.com/developerworks/library/se-power8-in-core-cryptography/
+//    For Power8 do not remove the casts, even when const-ness is cast away. It causes
+//    failed compiles and a 0.3 to 0.6 cpb drop in performance. The IBM documentation
+//    absolutely sucks. Thanks to Andy Polyakov, Paul R and Trudeaun for answering
+//    questions and filling the gaps in the IBM documentation.
+//
+
+#include "pch.h"
+#include "config.h"
+#include "misc.h"
+
+#if (CRYPTOPP_AESNI_AVAILABLE)
+# include "adv_simd.h"
+# include <emmintrin.h>
+# include <smmintrin.h>
+# include <wmmintrin.h>
+#endif
+
+// Android makes <arm_acle.h> available with ARMv7-a
+#if (CRYPTOPP_BOOL_ARMV8)
+# include "adv_simd.h"
+# if (CRYPTOPP_ARM_NEON_HEADER)
+#  include <arm_neon.h>
+# endif
+# if (CRYPTOPP_ARM_ACLE_HEADER)
+#  include <stdint.h>
+#  include <arm_acle.h>
+# endif
+#endif
+
+#if defined(_M_ARM64)
+# include "adv_simd.h"
+#endif
+
+#if defined(CRYPTOPP_POWER8_AES_AVAILABLE)
+# include "adv_simd.h"
+# include "ppc_simd.h"
+#endif
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#ifndef EXCEPTION_EXECUTE_HANDLER
+# define EXCEPTION_EXECUTE_HANDLER 1
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char RIJNDAEL_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ************************* Feature Probes ************************* //
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+
+    static jmp_buf s_jmpSIGILL;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpSIGILL, 1);
+    }
+}
+#endif  // Not CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
+
+#if (CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8)
+bool CPU_ProbeAES()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif (CRYPTOPP_ARM_AES_AVAILABLE)
+# if defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+    volatile bool result = true;
+    __try
+    {
+        // AES encrypt and decrypt
+        uint8x16_t data = vdupq_n_u8(0), key = vdupq_n_u8(0);
+        uint8x16_t r1 = vaeseq_u8(data, key);
+        uint8x16_t r2 = vaesdq_u8(data, key);
+        r1 = vaesmcq_u8(r1);
+        r2 = vaesimcq_u8(r2);
+
+        result = !!(vgetq_lane_u8(r1,0) | vgetq_lane_u8(r2,7));
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        return false;
+    }
+    return result;
+# else
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile bool result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        uint8x16_t data = vdupq_n_u8(0), key = vdupq_n_u8(0);
+        uint8x16_t r1 = vaeseq_u8(data, key);
+        uint8x16_t r2 = vaesdq_u8(data, key);
+        r1 = vaesmcq_u8(r1);
+        r2 = vaesimcq_u8(r2);
+
+        // Hack... GCC optimizes away the code and returns true
+        result = !!(vgetq_lane_u8(r1,0) | vgetq_lane_u8(r2,7));
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_ARM_AES_AVAILABLE
+}
+#endif  // ARM32 or ARM64
+
+// ***************************** ARMv8 ***************************** //
+
+#if (CRYPTOPP_ARM_AES_AVAILABLE)
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+inline void ARMV8_Enc_Block(uint64x2_t &data, const word32 *subkeys, unsigned int rounds)
+{
+    CRYPTOPP_ASSERT(subkeys);
+    const byte *keys = reinterpret_cast<const byte*>(subkeys);
+    uint8x16_t block = vreinterpretq_u8_u64(data);
+
+    // AES single round encryption
+    block = vaeseq_u8(block, vld1q_u8(keys+0*16));
+    // AES mix columns
+    block = vaesmcq_u8(block);
+
+    for (unsigned int i=1; i<rounds-1; i+=2)
+    {
+        // AES single round encryption
+        block = vaeseq_u8(block, vld1q_u8(keys+i*16));
+        // AES mix columns
+        block = vaesmcq_u8(block);
+        // AES single round encryption
+        block = vaeseq_u8(block, vld1q_u8(keys+(i+1)*16));
+        // AES mix columns
+        block = vaesmcq_u8(block);
+    }
+
+    // AES single round encryption
+    block = vaeseq_u8(block, vld1q_u8(keys+(rounds-1)*16));
+    // Final Add (bitwise Xor)
+    block = veorq_u8(block, vld1q_u8(keys+rounds*16));
+
+    data = vreinterpretq_u64_u8(block);
+}
+
+inline void ARMV8_Enc_6_Blocks(uint64x2_t &data0, uint64x2_t &data1,
+    uint64x2_t &data2, uint64x2_t &data3, uint64x2_t &data4, uint64x2_t &data5,
+    const word32 *subkeys, unsigned int rounds)
+{
+    CRYPTOPP_ASSERT(subkeys);
+    const byte *keys = reinterpret_cast<const byte*>(subkeys);
+
+    uint8x16_t block0 = vreinterpretq_u8_u64(data0);
+    uint8x16_t block1 = vreinterpretq_u8_u64(data1);
+    uint8x16_t block2 = vreinterpretq_u8_u64(data2);
+    uint8x16_t block3 = vreinterpretq_u8_u64(data3);
+    uint8x16_t block4 = vreinterpretq_u8_u64(data4);
+    uint8x16_t block5 = vreinterpretq_u8_u64(data5);
+
+    uint8x16_t key;
+    for (unsigned int i=0; i<rounds-1; ++i)
+    {
+        key = vld1q_u8(keys+i*16);
+        // AES single round encryption
+        block0 = vaeseq_u8(block0, key);
+        // AES mix columns
+        block0 = vaesmcq_u8(block0);
+        // AES single round encryption
+        block1 = vaeseq_u8(block1, key);
+        // AES mix columns
+        block1 = vaesmcq_u8(block1);
+        // AES single round encryption
+        block2 = vaeseq_u8(block2, key);
+        // AES mix columns
+        block2 = vaesmcq_u8(block2);
+        // AES single round encryption
+        block3 = vaeseq_u8(block3, key);
+        // AES mix columns
+        block3 = vaesmcq_u8(block3);
+        // AES single round encryption
+        block4 = vaeseq_u8(block4, key);
+        // AES mix columns
+        block4 = vaesmcq_u8(block4);
+        // AES single round encryption
+        block5 = vaeseq_u8(block5, key);
+        // AES mix columns
+        block5 = vaesmcq_u8(block5);
+    }
+
+    // AES single round encryption
+    key = vld1q_u8(keys+(rounds-1)*16);
+    block0 = vaeseq_u8(block0, key);
+    block1 = vaeseq_u8(block1, key);
+    block2 = vaeseq_u8(block2, key);
+    block3 = vaeseq_u8(block3, key);
+    block4 = vaeseq_u8(block4, key);
+    block5 = vaeseq_u8(block5, key);
+
+    // Final Add (bitwise Xor)
+    key = vld1q_u8(keys+rounds*16);
+    data0 = vreinterpretq_u64_u8(veorq_u8(block0, key));
+    data1 = vreinterpretq_u64_u8(veorq_u8(block1, key));
+    data2 = vreinterpretq_u64_u8(veorq_u8(block2, key));
+    data3 = vreinterpretq_u64_u8(veorq_u8(block3, key));
+    data4 = vreinterpretq_u64_u8(veorq_u8(block4, key));
+    data5 = vreinterpretq_u64_u8(veorq_u8(block5, key));
+}
+
+inline void ARMV8_Dec_Block(uint64x2_t &data, const word32 *subkeys, unsigned int rounds)
+{
+    CRYPTOPP_ASSERT(subkeys);
+    const byte *keys = reinterpret_cast<const byte*>(subkeys);
+    uint8x16_t block = vreinterpretq_u8_u64(data);
+
+    // AES single round decryption
+    block = vaesdq_u8(block, vld1q_u8(keys+0*16));
+    // AES inverse mix columns
+    block = vaesimcq_u8(block);
+
+    for (unsigned int i=1; i<rounds-1; i+=2)
+    {
+        // AES single round decryption
+        block = vaesdq_u8(block, vld1q_u8(keys+i*16));
+        // AES inverse mix columns
+        block = vaesimcq_u8(block);
+        // AES single round decryption
+        block = vaesdq_u8(block, vld1q_u8(keys+(i+1)*16));
+        // AES inverse mix columns
+        block = vaesimcq_u8(block);
+    }
+
+    // AES single round decryption
+    block = vaesdq_u8(block, vld1q_u8(keys+(rounds-1)*16));
+    // Final Add (bitwise Xor)
+    block = veorq_u8(block, vld1q_u8(keys+rounds*16));
+
+    data = vreinterpretq_u64_u8(block);
+}
+
+inline void ARMV8_Dec_6_Blocks(uint64x2_t &data0, uint64x2_t &data1,
+    uint64x2_t &data2, uint64x2_t &data3, uint64x2_t &data4, uint64x2_t &data5,
+    const word32 *subkeys, unsigned int rounds)
+{
+    CRYPTOPP_ASSERT(subkeys);
+    const byte *keys = reinterpret_cast<const byte*>(subkeys);
+
+    uint8x16_t block0 = vreinterpretq_u8_u64(data0);
+    uint8x16_t block1 = vreinterpretq_u8_u64(data1);
+    uint8x16_t block2 = vreinterpretq_u8_u64(data2);
+    uint8x16_t block3 = vreinterpretq_u8_u64(data3);
+    uint8x16_t block4 = vreinterpretq_u8_u64(data4);
+    uint8x16_t block5 = vreinterpretq_u8_u64(data5);
+
+    uint8x16_t key;
+    for (unsigned int i=0; i<rounds-1; ++i)
+    {
+        key = vld1q_u8(keys+i*16);
+        // AES single round decryption
+        block0 = vaesdq_u8(block0, key);
+        // AES inverse mix columns
+        block0 = vaesimcq_u8(block0);
+        // AES single round decryption
+        block1 = vaesdq_u8(block1, key);
+        // AES inverse mix columns
+        block1 = vaesimcq_u8(block1);
+        // AES single round decryption
+        block2 = vaesdq_u8(block2, key);
+        // AES inverse mix columns
+        block2 = vaesimcq_u8(block2);
+        // AES single round decryption
+        block3 = vaesdq_u8(block3, key);
+        // AES inverse mix columns
+        block3 = vaesimcq_u8(block3);
+        // AES single round decryption
+        block4 = vaesdq_u8(block4, key);
+        // AES inverse mix columns
+        block4 = vaesimcq_u8(block4);
+        // AES single round decryption
+        block5 = vaesdq_u8(block5, key);
+        // AES inverse mix columns
+        block5 = vaesimcq_u8(block5);
+    }
+
+    // AES single round decryption
+    key = vld1q_u8(keys+(rounds-1)*16);
+    block0 = vaesdq_u8(block0, key);
+    block1 = vaesdq_u8(block1, key);
+    block2 = vaesdq_u8(block2, key);
+    block3 = vaesdq_u8(block3, key);
+    block4 = vaesdq_u8(block4, key);
+    block5 = vaesdq_u8(block5, key);
+
+    // Final Add (bitwise Xor)
+    key = vld1q_u8(keys+rounds*16);
+    data0 = vreinterpretq_u64_u8(veorq_u8(block0, key));
+    data1 = vreinterpretq_u64_u8(veorq_u8(block1, key));
+    data2 = vreinterpretq_u64_u8(veorq_u8(block2, key));
+    data3 = vreinterpretq_u64_u8(veorq_u8(block3, key));
+    data4 = vreinterpretq_u64_u8(veorq_u8(block4, key));
+    data5 = vreinterpretq_u64_u8(veorq_u8(block5, key));
+}
+
+ANONYMOUS_NAMESPACE_END
+
+size_t Rijndael_Enc_AdvancedProcessBlocks_ARMV8(const word32 *subKeys, size_t rounds,
+            const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x1_NEON(ARMV8_Enc_Block, ARMV8_Enc_6_Blocks,
+            subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t Rijndael_Dec_AdvancedProcessBlocks_ARMV8(const word32 *subKeys, size_t rounds,
+            const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x1_NEON(ARMV8_Dec_Block, ARMV8_Dec_6_Blocks,
+            subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+#endif  // CRYPTOPP_ARM_AES_AVAILABLE
+
+// ***************************** AES-NI ***************************** //
+
+#if (CRYPTOPP_AESNI_AVAILABLE)
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+/* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+CRYPTOPP_ALIGN_DATA(16)
+const word32 s_rconLE[] = {
+    0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36
+};
+
+inline void AESNI_Enc_Block(__m128i &block, MAYBE_CONST word32 *subkeys, unsigned int rounds)
+{
+    const __m128i* skeys = reinterpret_cast<const __m128i*>(subkeys);
+
+    block = _mm_xor_si128(block, skeys[0]);
+    for (unsigned int i=1; i<rounds-1; i+=2)
+    {
+        block = _mm_aesenc_si128(block, skeys[i]);
+        block = _mm_aesenc_si128(block, skeys[i+1]);
+    }
+    block = _mm_aesenc_si128(block, skeys[rounds-1]);
+    block = _mm_aesenclast_si128(block, skeys[rounds]);
+}
+
+inline void AESNI_Enc_4_Blocks(__m128i &block0, __m128i &block1, __m128i &block2, __m128i &block3,
+                               MAYBE_CONST word32 *subkeys, unsigned int rounds)
+{
+    const __m128i* skeys = reinterpret_cast<const __m128i*>(subkeys);
+
+    __m128i rk = skeys[0];
+    block0 = _mm_xor_si128(block0, rk);
+    block1 = _mm_xor_si128(block1, rk);
+    block2 = _mm_xor_si128(block2, rk);
+    block3 = _mm_xor_si128(block3, rk);
+    for (unsigned int i=1; i<rounds; i++)
+    {
+        rk = skeys[i];
+        block0 = _mm_aesenc_si128(block0, rk);
+        block1 = _mm_aesenc_si128(block1, rk);
+        block2 = _mm_aesenc_si128(block2, rk);
+        block3 = _mm_aesenc_si128(block3, rk);
+    }
+    rk = skeys[rounds];
+    block0 = _mm_aesenclast_si128(block0, rk);
+    block1 = _mm_aesenclast_si128(block1, rk);
+    block2 = _mm_aesenclast_si128(block2, rk);
+    block3 = _mm_aesenclast_si128(block3, rk);
+}
+
+inline void AESNI_Dec_Block(__m128i &block, MAYBE_CONST word32 *subkeys, unsigned int rounds)
+{
+    const __m128i* skeys = reinterpret_cast<const __m128i*>(subkeys);
+
+    block = _mm_xor_si128(block, skeys[0]);
+    for (unsigned int i=1; i<rounds-1; i+=2)
+    {
+        block = _mm_aesdec_si128(block, skeys[i]);
+        block = _mm_aesdec_si128(block, skeys[i+1]);
+    }
+    block = _mm_aesdec_si128(block, skeys[rounds-1]);
+    block = _mm_aesdeclast_si128(block, skeys[rounds]);
+}
+
+inline void AESNI_Dec_4_Blocks(__m128i &block0, __m128i &block1, __m128i &block2, __m128i &block3,
+                        MAYBE_CONST word32 *subkeys, unsigned int rounds)
+{
+    const __m128i* skeys = reinterpret_cast<const __m128i*>(subkeys);
+
+    __m128i rk = skeys[0];
+    block0 = _mm_xor_si128(block0, rk);
+    block1 = _mm_xor_si128(block1, rk);
+    block2 = _mm_xor_si128(block2, rk);
+    block3 = _mm_xor_si128(block3, rk);
+    for (unsigned int i=1; i<rounds; i++)
+    {
+        rk = skeys[i];
+        block0 = _mm_aesdec_si128(block0, rk);
+        block1 = _mm_aesdec_si128(block1, rk);
+        block2 = _mm_aesdec_si128(block2, rk);
+        block3 = _mm_aesdec_si128(block3, rk);
+    }
+    rk = skeys[rounds];
+    block0 = _mm_aesdeclast_si128(block0, rk);
+    block1 = _mm_aesdeclast_si128(block1, rk);
+    block2 = _mm_aesdeclast_si128(block2, rk);
+    block3 = _mm_aesdeclast_si128(block3, rk);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+void Rijndael_UncheckedSetKey_SSE4_AESNI(const byte *userKey, size_t keyLen, word32 *rk)
+{
+    const size_t rounds = keyLen / 4 + 6;
+    const word32 *rc = s_rconLE;
+
+    __m128i temp = _mm_loadu_si128(M128_CAST(userKey+keyLen-16));
+    std::memcpy(rk, userKey, keyLen);
+
+    // keySize: m_key allocates 4*(rounds+1) word32's.
+    const size_t keySize = 4*(rounds+1);
+    const word32* end = rk + keySize;
+
+    while (true)
+    {
+        rk[keyLen/4] = rk[0] ^ _mm_extract_epi32(_mm_aeskeygenassist_si128(temp, 0), 3) ^ *(rc++);
+        rk[keyLen/4+1] = rk[1] ^ rk[keyLen/4];
+        rk[keyLen/4+2] = rk[2] ^ rk[keyLen/4+1];
+        rk[keyLen/4+3] = rk[3] ^ rk[keyLen/4+2];
+
+        if (rk + keyLen/4 + 4 == end)
+            break;
+
+        if (keyLen == 24)
+        {
+            rk[10] = rk[ 4] ^ rk[ 9];
+            rk[11] = rk[ 5] ^ rk[10];
+            temp = _mm_insert_epi32(temp, rk[11], 3);
+        }
+        else if (keyLen == 32)
+        {
+            temp = _mm_insert_epi32(temp, rk[11], 3);
+            rk[12] = rk[ 4] ^ _mm_extract_epi32(_mm_aeskeygenassist_si128(temp, 0), 2);
+            rk[13] = rk[ 5] ^ rk[12];
+            rk[14] = rk[ 6] ^ rk[13];
+            rk[15] = rk[ 7] ^ rk[14];
+            temp = _mm_insert_epi32(temp, rk[15], 3);
+        }
+        else
+        {
+            temp = _mm_insert_epi32(temp, rk[7], 3);
+        }
+
+        rk += keyLen/4;
+    }
+}
+
+void Rijndael_UncheckedSetKeyRev_AESNI(word32 *key, unsigned int rounds)
+{
+    unsigned int i, j;
+    __m128i temp;
+
+    vec_swap(*M128_CAST(key), *M128_CAST(key+4*rounds));
+
+    for (i = 4, j = 4*rounds-4; i < j; i += 4, j -= 4)
+    {
+        temp = _mm_aesimc_si128(*M128_CAST(key+i));
+        *M128_CAST(key+i) = _mm_aesimc_si128(*M128_CAST(key+j));
+        *M128_CAST(key+j) = temp;
+    }
+
+    *M128_CAST(key+i) = _mm_aesimc_si128(*M128_CAST(key+i));
+}
+
+size_t Rijndael_Enc_AdvancedProcessBlocks_AESNI(const word32 *subKeys, size_t rounds,
+        const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    // SunCC workaround
+    MAYBE_CONST word32* sk = MAYBE_UNCONST_CAST(word32*, subKeys);
+    MAYBE_CONST   byte* ib = MAYBE_UNCONST_CAST(byte*,  inBlocks);
+    MAYBE_CONST   byte* xb = MAYBE_UNCONST_CAST(byte*, xorBlocks);
+
+    return AdvancedProcessBlocks128_4x1_SSE(AESNI_Enc_Block, AESNI_Enc_4_Blocks,
+                sk, rounds, ib, xb, outBlocks, length, flags);
+}
+
+size_t Rijndael_Dec_AdvancedProcessBlocks_AESNI(const word32 *subKeys, size_t rounds,
+        const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    MAYBE_CONST word32* sk = MAYBE_UNCONST_CAST(word32*, subKeys);
+    MAYBE_CONST   byte* ib = MAYBE_UNCONST_CAST(byte*,  inBlocks);
+    MAYBE_CONST   byte* xb = MAYBE_UNCONST_CAST(byte*, xorBlocks);
+
+    return AdvancedProcessBlocks128_4x1_SSE(AESNI_Dec_Block, AESNI_Dec_4_Blocks,
+                sk, rounds, ib, xb, outBlocks, length, flags);
+}
+
+#endif  // CRYPTOPP_AESNI_AVAILABLE
+
+// ************************** Power 8 Crypto ************************** //
+
+#if (CRYPTOPP_POWER8_AES_AVAILABLE)
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+/* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+CRYPTOPP_ALIGN_DATA(16)
+static const uint32_t s_rconBE[] = {
+    0x01000000, 0x02000000, 0x04000000, 0x08000000,
+    0x10000000, 0x20000000, 0x40000000, 0x80000000,
+    0x1B000000, 0x36000000
+};
+
+inline void POWER8_Enc_Block(uint32x4_p &block, const word32 *subkeys, unsigned int rounds)
+{
+    CRYPTOPP_ASSERT(IsAlignedOn(subkeys, 16));
+    const byte *keys = reinterpret_cast<const byte*>(subkeys);
+
+    uint32x4_p k = VecLoadAligned(keys);
+    block = VecXor(block, k);
+
+    for (size_t i=1; i<rounds-1; i+=2)
+    {
+        block = VecEncrypt(block, VecLoadAligned(  i*16,   keys));
+        block = VecEncrypt(block, VecLoadAligned((i+1)*16, keys));
+    }
+
+    block = VecEncrypt(block, VecLoadAligned((rounds-1)*16, keys));
+    block = VecEncryptLast(block, VecLoadAligned(rounds*16, keys));
+}
+
+inline void POWER8_Enc_6_Blocks(uint32x4_p &block0, uint32x4_p &block1,
+            uint32x4_p &block2, uint32x4_p &block3, uint32x4_p &block4,
+            uint32x4_p &block5, const word32 *subkeys, unsigned int rounds)
+{
+    CRYPTOPP_ASSERT(IsAlignedOn(subkeys, 16));
+    const byte *keys = reinterpret_cast<const byte*>(subkeys);
+
+    uint32x4_p k = VecLoadAligned(keys);
+    block0 = VecXor(block0, k);
+    block1 = VecXor(block1, k);
+    block2 = VecXor(block2, k);
+    block3 = VecXor(block3, k);
+    block4 = VecXor(block4, k);
+    block5 = VecXor(block5, k);
+
+    for (size_t i=1; i<rounds; ++i)
+    {
+        k = VecLoadAligned(i*16, keys);
+        block0 = VecEncrypt(block0, k);
+        block1 = VecEncrypt(block1, k);
+        block2 = VecEncrypt(block2, k);
+        block3 = VecEncrypt(block3, k);
+        block4 = VecEncrypt(block4, k);
+        block5 = VecEncrypt(block5, k);
+    }
+
+    k = VecLoadAligned(rounds*16, keys);
+    block0 = VecEncryptLast(block0, k);
+    block1 = VecEncryptLast(block1, k);
+    block2 = VecEncryptLast(block2, k);
+    block3 = VecEncryptLast(block3, k);
+    block4 = VecEncryptLast(block4, k);
+    block5 = VecEncryptLast(block5, k);
+}
+
+inline void POWER8_Dec_Block(uint32x4_p &block, const word32 *subkeys, unsigned int rounds)
+{
+    CRYPTOPP_ASSERT(IsAlignedOn(subkeys, 16));
+    const byte *keys = reinterpret_cast<const byte*>(subkeys);
+
+    uint32x4_p k = VecLoadAligned(rounds*16, keys);
+    block = VecXor(block, k);
+
+    for (size_t i=rounds-1; i>1; i-=2)
+    {
+        block = VecDecrypt(block, VecLoadAligned(  i*16,   keys));
+        block = VecDecrypt(block, VecLoadAligned((i-1)*16, keys));
+    }
+
+    block = VecDecrypt(block, VecLoadAligned(16, keys));
+    block = VecDecryptLast(block, VecLoadAligned(0, keys));
+}
+
+inline void POWER8_Dec_6_Blocks(uint32x4_p &block0, uint32x4_p &block1,
+            uint32x4_p &block2, uint32x4_p &block3, uint32x4_p &block4,
+            uint32x4_p &block5, const word32 *subkeys, unsigned int rounds)
+{
+    CRYPTOPP_ASSERT(IsAlignedOn(subkeys, 16));
+    const byte *keys = reinterpret_cast<const byte*>(subkeys);
+
+    uint32x4_p k = VecLoadAligned(rounds*16, keys);
+    block0 = VecXor(block0, k);
+    block1 = VecXor(block1, k);
+    block2 = VecXor(block2, k);
+    block3 = VecXor(block3, k);
+    block4 = VecXor(block4, k);
+    block5 = VecXor(block5, k);
+
+    for (size_t i=rounds-1; i>0; --i)
+    {
+        k = VecLoadAligned(i*16, keys);
+        block0 = VecDecrypt(block0, k);
+        block1 = VecDecrypt(block1, k);
+        block2 = VecDecrypt(block2, k);
+        block3 = VecDecrypt(block3, k);
+        block4 = VecDecrypt(block4, k);
+        block5 = VecDecrypt(block5, k);
+    }
+
+    k = VecLoadAligned(0, keys);
+    block0 = VecDecryptLast(block0, k);
+    block1 = VecDecryptLast(block1, k);
+    block2 = VecDecryptLast(block2, k);
+    block3 = VecDecryptLast(block3, k);
+    block4 = VecDecryptLast(block4, k);
+    block5 = VecDecryptLast(block5, k);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+void Rijndael_UncheckedSetKey_POWER8(const byte* userKey, size_t keyLen, word32* rk, const byte* Se)
+{
+    const size_t rounds = keyLen / 4 + 6;
+    const word32 *rc = s_rconBE;
+    word32 *rkey = rk, temp;
+
+    GetUserKey(BIG_ENDIAN_ORDER, rkey, keyLen/4, userKey, keyLen);
+
+    // keySize: m_key allocates 4*(rounds+1) word32's.
+    const size_t keySize = 4*(rounds+1);
+    const word32* end = rkey + keySize;
+
+    while (true)
+    {
+        temp  = rkey[keyLen/4-1];
+        word32 x = (word32(Se[GETBYTE(temp, 2)]) << 24) ^ (word32(Se[GETBYTE(temp, 1)]) << 16) ^
+                    (word32(Se[GETBYTE(temp, 0)]) << 8) ^ Se[GETBYTE(temp, 3)];
+        rkey[keyLen/4] = rkey[0] ^ x ^ *(rc++);
+        rkey[keyLen/4+1] = rkey[1] ^ rkey[keyLen/4];
+        rkey[keyLen/4+2] = rkey[2] ^ rkey[keyLen/4+1];
+        rkey[keyLen/4+3] = rkey[3] ^ rkey[keyLen/4+2];
+
+        if (rkey + keyLen/4 + 4 == end)
+            break;
+
+        if (keyLen == 24)
+        {
+            rkey[10] = rkey[ 4] ^ rkey[ 9];
+            rkey[11] = rkey[ 5] ^ rkey[10];
+        }
+        else if (keyLen == 32)
+        {
+            temp = rkey[11];
+            rkey[12] = rkey[ 4] ^ (word32(Se[GETBYTE(temp, 3)]) << 24) ^ (word32(Se[GETBYTE(temp, 2)]) << 16) ^ (word32(Se[GETBYTE(temp, 1)]) << 8) ^ Se[GETBYTE(temp, 0)];
+            rkey[13] = rkey[ 5] ^ rkey[12];
+            rkey[14] = rkey[ 6] ^ rkey[13];
+            rkey[15] = rkey[ 7] ^ rkey[14];
+        }
+        rkey += keyLen/4;
+    }
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+    rkey = rk;
+    const uint8x16_p mask = {12,13,14,15, 8,9,10,11, 4,5,6,7, 0,1,2,3};
+
+    unsigned int i=0;
+    for (i=0; i<rounds; i+=2, rkey+=8)
+    {
+        VecStore(VecPermute(VecLoad(rkey+0), mask), rkey+0);
+        VecStore(VecPermute(VecLoad(rkey+4), mask), rkey+4);
+    }
+
+    for ( ; i<rounds+1; i++, rkey+=4)
+        VecStore(VecPermute(VecLoad(rkey), mask), rkey);
+#endif
+}
+
+size_t Rijndael_Enc_AdvancedProcessBlocks128_6x1_ALTIVEC(const word32 *subKeys, size_t rounds,
+            const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x1_ALTIVEC(POWER8_Enc_Block, POWER8_Enc_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t Rijndael_Dec_AdvancedProcessBlocks128_6x1_ALTIVEC(const word32 *subKeys, size_t rounds,
+            const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x1_ALTIVEC(POWER8_Dec_Block, POWER8_Dec_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+#endif  // CRYPTOPP_POWER8_AES_AVAILABLE
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/ripemd.cpp b/runtime/third_party/cryptopp/ripemd.cpp
new file mode 100644
index 0000000..5911cc3
--- /dev/null
+++ b/runtime/third_party/cryptopp/ripemd.cpp
@@ -0,0 +1,803 @@
+// ripemd.cpp
+// RIPEMD-160 written and placed in the public domain by Wei Dai
+// RIPEMD-320, RIPEMD-128, RIPEMD-256 written by Kevin Springle
+// and also placed in the public domain
+
+#include "pch.h"
+#include "ripemd.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#define F(x, y, z)    (x ^ y ^ z)
+#define G(x, y, z)    (z ^ (x & (y^z)))
+#define H(x, y, z)    (z ^ (x | ~y))
+#define I(x, y, z)    (y ^ (z & (x^y)))
+#define J(x, y, z)    (x ^ (y | ~z))
+
+#define k0 0
+#define k1 0x5a827999UL
+#define k2 0x6ed9eba1UL
+#define k3 0x8f1bbcdcUL
+#define k4 0xa953fd4eUL
+#define k5 0x50a28be6UL
+#define k6 0x5c4dd124UL
+#define k7 0x6d703ef3UL
+#define k8 0x7a6d76e9UL
+#define k9 0
+
+// *************************************************************
+
+// for 160 and 320
+#define Subround(f, a, b, c, d, e, x, s, k)        \
+	a += f(b, c, d) + x + k;\
+	a = rotlVariable((word32)a, s) + e;\
+	c = rotlConstant<10>((word32)c)
+
+void RIPEMD160::InitState(HashWordType *state)
+{
+	state[0] = 0x67452301L;
+	state[1] = 0xefcdab89L;
+	state[2] = 0x98badcfeL;
+	state[3] = 0x10325476L;
+	state[4] = 0xc3d2e1f0L;
+}
+
+void RIPEMD160::Transform (word32 *digest, const word32 *X)
+{
+	unsigned long a1, b1, c1, d1, e1, a2, b2, c2, d2, e2;
+	a1 = a2 = digest[0];
+	b1 = b2 = digest[1];
+	c1 = c2 = digest[2];
+	d1 = d2 = digest[3];
+	e1 = e2 = digest[4];
+
+	Subround(F, a1, b1, c1, d1, e1, X[ 0], 11, k0);
+	Subround(F, e1, a1, b1, c1, d1, X[ 1], 14, k0);
+	Subround(F, d1, e1, a1, b1, c1, X[ 2], 15, k0);
+	Subround(F, c1, d1, e1, a1, b1, X[ 3], 12, k0);
+	Subround(F, b1, c1, d1, e1, a1, X[ 4],  5, k0);
+	Subround(F, a1, b1, c1, d1, e1, X[ 5],  8, k0);
+	Subround(F, e1, a1, b1, c1, d1, X[ 6],  7, k0);
+	Subround(F, d1, e1, a1, b1, c1, X[ 7],  9, k0);
+	Subround(F, c1, d1, e1, a1, b1, X[ 8], 11, k0);
+	Subround(F, b1, c1, d1, e1, a1, X[ 9], 13, k0);
+	Subround(F, a1, b1, c1, d1, e1, X[10], 14, k0);
+	Subround(F, e1, a1, b1, c1, d1, X[11], 15, k0);
+	Subround(F, d1, e1, a1, b1, c1, X[12],  6, k0);
+	Subround(F, c1, d1, e1, a1, b1, X[13],  7, k0);
+	Subround(F, b1, c1, d1, e1, a1, X[14],  9, k0);
+	Subround(F, a1, b1, c1, d1, e1, X[15],  8, k0);
+
+	Subround(G, e1, a1, b1, c1, d1, X[ 7],  7, k1);
+	Subround(G, d1, e1, a1, b1, c1, X[ 4],  6, k1);
+	Subround(G, c1, d1, e1, a1, b1, X[13],  8, k1);
+	Subround(G, b1, c1, d1, e1, a1, X[ 1], 13, k1);
+	Subround(G, a1, b1, c1, d1, e1, X[10], 11, k1);
+	Subround(G, e1, a1, b1, c1, d1, X[ 6],  9, k1);
+	Subround(G, d1, e1, a1, b1, c1, X[15],  7, k1);
+	Subround(G, c1, d1, e1, a1, b1, X[ 3], 15, k1);
+	Subround(G, b1, c1, d1, e1, a1, X[12],  7, k1);
+	Subround(G, a1, b1, c1, d1, e1, X[ 0], 12, k1);
+	Subround(G, e1, a1, b1, c1, d1, X[ 9], 15, k1);
+	Subround(G, d1, e1, a1, b1, c1, X[ 5],  9, k1);
+	Subround(G, c1, d1, e1, a1, b1, X[ 2], 11, k1);
+	Subround(G, b1, c1, d1, e1, a1, X[14],  7, k1);
+	Subround(G, a1, b1, c1, d1, e1, X[11], 13, k1);
+	Subround(G, e1, a1, b1, c1, d1, X[ 8], 12, k1);
+
+	Subround(H, d1, e1, a1, b1, c1, X[ 3], 11, k2);
+	Subround(H, c1, d1, e1, a1, b1, X[10], 13, k2);
+	Subround(H, b1, c1, d1, e1, a1, X[14],  6, k2);
+	Subround(H, a1, b1, c1, d1, e1, X[ 4],  7, k2);
+	Subround(H, e1, a1, b1, c1, d1, X[ 9], 14, k2);
+	Subround(H, d1, e1, a1, b1, c1, X[15],  9, k2);
+	Subround(H, c1, d1, e1, a1, b1, X[ 8], 13, k2);
+	Subround(H, b1, c1, d1, e1, a1, X[ 1], 15, k2);
+	Subround(H, a1, b1, c1, d1, e1, X[ 2], 14, k2);
+	Subround(H, e1, a1, b1, c1, d1, X[ 7],  8, k2);
+	Subround(H, d1, e1, a1, b1, c1, X[ 0], 13, k2);
+	Subround(H, c1, d1, e1, a1, b1, X[ 6],  6, k2);
+	Subround(H, b1, c1, d1, e1, a1, X[13],  5, k2);
+	Subround(H, a1, b1, c1, d1, e1, X[11], 12, k2);
+	Subround(H, e1, a1, b1, c1, d1, X[ 5],  7, k2);
+	Subround(H, d1, e1, a1, b1, c1, X[12],  5, k2);
+
+	Subround(I, c1, d1, e1, a1, b1, X[ 1], 11, k3);
+	Subround(I, b1, c1, d1, e1, a1, X[ 9], 12, k3);
+	Subround(I, a1, b1, c1, d1, e1, X[11], 14, k3);
+	Subround(I, e1, a1, b1, c1, d1, X[10], 15, k3);
+	Subround(I, d1, e1, a1, b1, c1, X[ 0], 14, k3);
+	Subround(I, c1, d1, e1, a1, b1, X[ 8], 15, k3);
+	Subround(I, b1, c1, d1, e1, a1, X[12],  9, k3);
+	Subround(I, a1, b1, c1, d1, e1, X[ 4],  8, k3);
+	Subround(I, e1, a1, b1, c1, d1, X[13],  9, k3);
+	Subround(I, d1, e1, a1, b1, c1, X[ 3], 14, k3);
+	Subround(I, c1, d1, e1, a1, b1, X[ 7],  5, k3);
+	Subround(I, b1, c1, d1, e1, a1, X[15],  6, k3);
+	Subround(I, a1, b1, c1, d1, e1, X[14],  8, k3);
+	Subround(I, e1, a1, b1, c1, d1, X[ 5],  6, k3);
+	Subround(I, d1, e1, a1, b1, c1, X[ 6],  5, k3);
+	Subround(I, c1, d1, e1, a1, b1, X[ 2], 12, k3);
+
+	Subround(J, b1, c1, d1, e1, a1, X[ 4],  9, k4);
+	Subround(J, a1, b1, c1, d1, e1, X[ 0], 15, k4);
+	Subround(J, e1, a1, b1, c1, d1, X[ 5],  5, k4);
+	Subround(J, d1, e1, a1, b1, c1, X[ 9], 11, k4);
+	Subround(J, c1, d1, e1, a1, b1, X[ 7],  6, k4);
+	Subround(J, b1, c1, d1, e1, a1, X[12],  8, k4);
+	Subround(J, a1, b1, c1, d1, e1, X[ 2], 13, k4);
+	Subround(J, e1, a1, b1, c1, d1, X[10], 12, k4);
+	Subround(J, d1, e1, a1, b1, c1, X[14],  5, k4);
+	Subround(J, c1, d1, e1, a1, b1, X[ 1], 12, k4);
+	Subround(J, b1, c1, d1, e1, a1, X[ 3], 13, k4);
+	Subround(J, a1, b1, c1, d1, e1, X[ 8], 14, k4);
+	Subround(J, e1, a1, b1, c1, d1, X[11], 11, k4);
+	Subround(J, d1, e1, a1, b1, c1, X[ 6],  8, k4);
+	Subround(J, c1, d1, e1, a1, b1, X[15],  5, k4);
+	Subround(J, b1, c1, d1, e1, a1, X[13],  6, k4);
+
+	Subround(J, a2, b2, c2, d2, e2, X[ 5],  8, k5);
+	Subround(J, e2, a2, b2, c2, d2, X[14],  9, k5);
+	Subround(J, d2, e2, a2, b2, c2, X[ 7],  9, k5);
+	Subround(J, c2, d2, e2, a2, b2, X[ 0], 11, k5);
+	Subround(J, b2, c2, d2, e2, a2, X[ 9], 13, k5);
+	Subround(J, a2, b2, c2, d2, e2, X[ 2], 15, k5);
+	Subround(J, e2, a2, b2, c2, d2, X[11], 15, k5);
+	Subround(J, d2, e2, a2, b2, c2, X[ 4],  5, k5);
+	Subround(J, c2, d2, e2, a2, b2, X[13],  7, k5);
+	Subround(J, b2, c2, d2, e2, a2, X[ 6],  7, k5);
+	Subround(J, a2, b2, c2, d2, e2, X[15],  8, k5);
+	Subround(J, e2, a2, b2, c2, d2, X[ 8], 11, k5);
+	Subround(J, d2, e2, a2, b2, c2, X[ 1], 14, k5);
+	Subround(J, c2, d2, e2, a2, b2, X[10], 14, k5);
+	Subround(J, b2, c2, d2, e2, a2, X[ 3], 12, k5);
+	Subround(J, a2, b2, c2, d2, e2, X[12],  6, k5);
+
+	Subround(I, e2, a2, b2, c2, d2, X[ 6],  9, k6);
+	Subround(I, d2, e2, a2, b2, c2, X[11], 13, k6);
+	Subround(I, c2, d2, e2, a2, b2, X[ 3], 15, k6);
+	Subround(I, b2, c2, d2, e2, a2, X[ 7],  7, k6);
+	Subround(I, a2, b2, c2, d2, e2, X[ 0], 12, k6);
+	Subround(I, e2, a2, b2, c2, d2, X[13],  8, k6);
+	Subround(I, d2, e2, a2, b2, c2, X[ 5],  9, k6);
+	Subround(I, c2, d2, e2, a2, b2, X[10], 11, k6);
+	Subround(I, b2, c2, d2, e2, a2, X[14],  7, k6);
+	Subround(I, a2, b2, c2, d2, e2, X[15],  7, k6);
+	Subround(I, e2, a2, b2, c2, d2, X[ 8], 12, k6);
+	Subround(I, d2, e2, a2, b2, c2, X[12],  7, k6);
+	Subround(I, c2, d2, e2, a2, b2, X[ 4],  6, k6);
+	Subround(I, b2, c2, d2, e2, a2, X[ 9], 15, k6);
+	Subround(I, a2, b2, c2, d2, e2, X[ 1], 13, k6);
+	Subround(I, e2, a2, b2, c2, d2, X[ 2], 11, k6);
+
+	Subround(H, d2, e2, a2, b2, c2, X[15],  9, k7);
+	Subround(H, c2, d2, e2, a2, b2, X[ 5],  7, k7);
+	Subround(H, b2, c2, d2, e2, a2, X[ 1], 15, k7);
+	Subround(H, a2, b2, c2, d2, e2, X[ 3], 11, k7);
+	Subround(H, e2, a2, b2, c2, d2, X[ 7],  8, k7);
+	Subround(H, d2, e2, a2, b2, c2, X[14],  6, k7);
+	Subround(H, c2, d2, e2, a2, b2, X[ 6],  6, k7);
+	Subround(H, b2, c2, d2, e2, a2, X[ 9], 14, k7);
+	Subround(H, a2, b2, c2, d2, e2, X[11], 12, k7);
+	Subround(H, e2, a2, b2, c2, d2, X[ 8], 13, k7);
+	Subround(H, d2, e2, a2, b2, c2, X[12],  5, k7);
+	Subround(H, c2, d2, e2, a2, b2, X[ 2], 14, k7);
+	Subround(H, b2, c2, d2, e2, a2, X[10], 13, k7);
+	Subround(H, a2, b2, c2, d2, e2, X[ 0], 13, k7);
+	Subround(H, e2, a2, b2, c2, d2, X[ 4],  7, k7);
+	Subround(H, d2, e2, a2, b2, c2, X[13],  5, k7);
+
+	Subround(G, c2, d2, e2, a2, b2, X[ 8], 15, k8);
+	Subround(G, b2, c2, d2, e2, a2, X[ 6],  5, k8);
+	Subround(G, a2, b2, c2, d2, e2, X[ 4],  8, k8);
+	Subround(G, e2, a2, b2, c2, d2, X[ 1], 11, k8);
+	Subround(G, d2, e2, a2, b2, c2, X[ 3], 14, k8);
+	Subround(G, c2, d2, e2, a2, b2, X[11], 14, k8);
+	Subround(G, b2, c2, d2, e2, a2, X[15],  6, k8);
+	Subround(G, a2, b2, c2, d2, e2, X[ 0], 14, k8);
+	Subround(G, e2, a2, b2, c2, d2, X[ 5],  6, k8);
+	Subround(G, d2, e2, a2, b2, c2, X[12],  9, k8);
+	Subround(G, c2, d2, e2, a2, b2, X[ 2], 12, k8);
+	Subround(G, b2, c2, d2, e2, a2, X[13],  9, k8);
+	Subround(G, a2, b2, c2, d2, e2, X[ 9], 12, k8);
+	Subround(G, e2, a2, b2, c2, d2, X[ 7],  5, k8);
+	Subround(G, d2, e2, a2, b2, c2, X[10], 15, k8);
+	Subround(G, c2, d2, e2, a2, b2, X[14],  8, k8);
+
+	Subround(F, b2, c2, d2, e2, a2, X[12],  8, k9);
+	Subround(F, a2, b2, c2, d2, e2, X[15],  5, k9);
+	Subround(F, e2, a2, b2, c2, d2, X[10], 12, k9);
+	Subround(F, d2, e2, a2, b2, c2, X[ 4],  9, k9);
+	Subround(F, c2, d2, e2, a2, b2, X[ 1], 12, k9);
+	Subround(F, b2, c2, d2, e2, a2, X[ 5],  5, k9);
+	Subround(F, a2, b2, c2, d2, e2, X[ 8], 14, k9);
+	Subround(F, e2, a2, b2, c2, d2, X[ 7],  6, k9);
+	Subround(F, d2, e2, a2, b2, c2, X[ 6],  8, k9);
+	Subround(F, c2, d2, e2, a2, b2, X[ 2], 13, k9);
+	Subround(F, b2, c2, d2, e2, a2, X[13],  6, k9);
+	Subround(F, a2, b2, c2, d2, e2, X[14],  5, k9);
+	Subround(F, e2, a2, b2, c2, d2, X[ 0], 15, k9);
+	Subround(F, d2, e2, a2, b2, c2, X[ 3], 13, k9);
+	Subround(F, c2, d2, e2, a2, b2, X[ 9], 11, k9);
+	Subround(F, b2, c2, d2, e2, a2, X[11], 11, k9);
+
+	c1        = digest[1] + c1 + d2;
+	digest[1] = digest[2] + d1 + e2;
+	digest[2] = digest[3] + e1 + a2;
+	digest[3] = digest[4] + a1 + b2;
+	digest[4] = digest[0] + b1 + c2;
+	digest[0] = c1;
+}
+
+// *************************************************************
+
+void RIPEMD320::InitState(HashWordType *state)
+{
+	state[0] = 0x67452301L;
+	state[1] = 0xefcdab89L;
+	state[2] = 0x98badcfeL;
+	state[3] = 0x10325476L;
+	state[4] = 0xc3d2e1f0L;
+	state[5] = 0x76543210L;
+	state[6] = 0xfedcba98L;
+	state[7] = 0x89abcdefL;
+	state[8] = 0x01234567L;
+	state[9] = 0x3c2d1e0fL;
+}
+
+void RIPEMD320::Transform (word32 *digest, const word32 *X)
+{
+	unsigned long a1, b1, c1, d1, e1, a2, b2, c2, d2, e2, t;
+	a1 = digest[0];
+	b1 = digest[1];
+	c1 = digest[2];
+	d1 = digest[3];
+	e1 = digest[4];
+	a2 = digest[5];
+	b2 = digest[6];
+	c2 = digest[7];
+	d2 = digest[8];
+	e2 = digest[9];
+
+	Subround(F, a1, b1, c1, d1, e1, X[ 0], 11, k0);
+	Subround(F, e1, a1, b1, c1, d1, X[ 1], 14, k0);
+	Subround(F, d1, e1, a1, b1, c1, X[ 2], 15, k0);
+	Subround(F, c1, d1, e1, a1, b1, X[ 3], 12, k0);
+	Subround(F, b1, c1, d1, e1, a1, X[ 4],  5, k0);
+	Subround(F, a1, b1, c1, d1, e1, X[ 5],  8, k0);
+	Subround(F, e1, a1, b1, c1, d1, X[ 6],  7, k0);
+	Subround(F, d1, e1, a1, b1, c1, X[ 7],  9, k0);
+	Subround(F, c1, d1, e1, a1, b1, X[ 8], 11, k0);
+	Subround(F, b1, c1, d1, e1, a1, X[ 9], 13, k0);
+	Subround(F, a1, b1, c1, d1, e1, X[10], 14, k0);
+	Subround(F, e1, a1, b1, c1, d1, X[11], 15, k0);
+	Subround(F, d1, e1, a1, b1, c1, X[12],  6, k0);
+	Subround(F, c1, d1, e1, a1, b1, X[13],  7, k0);
+	Subround(F, b1, c1, d1, e1, a1, X[14],  9, k0);
+	Subround(F, a1, b1, c1, d1, e1, X[15],  8, k0);
+
+	Subround(J, a2, b2, c2, d2, e2, X[ 5],  8, k5);
+	Subround(J, e2, a2, b2, c2, d2, X[14],  9, k5);
+	Subround(J, d2, e2, a2, b2, c2, X[ 7],  9, k5);
+	Subround(J, c2, d2, e2, a2, b2, X[ 0], 11, k5);
+	Subround(J, b2, c2, d2, e2, a2, X[ 9], 13, k5);
+	Subround(J, a2, b2, c2, d2, e2, X[ 2], 15, k5);
+	Subround(J, e2, a2, b2, c2, d2, X[11], 15, k5);
+	Subround(J, d2, e2, a2, b2, c2, X[ 4],  5, k5);
+	Subround(J, c2, d2, e2, a2, b2, X[13],  7, k5);
+	Subround(J, b2, c2, d2, e2, a2, X[ 6],  7, k5);
+	Subround(J, a2, b2, c2, d2, e2, X[15],  8, k5);
+	Subround(J, e2, a2, b2, c2, d2, X[ 8], 11, k5);
+	Subround(J, d2, e2, a2, b2, c2, X[ 1], 14, k5);
+	Subround(J, c2, d2, e2, a2, b2, X[10], 14, k5);
+	Subround(J, b2, c2, d2, e2, a2, X[ 3], 12, k5);
+	Subround(J, a2, b2, c2, d2, e2, X[12],  6, k5);
+
+	t = a1; a1 = a2; a2 = t;
+
+	Subround(G, e1, a1, b1, c1, d1, X[ 7],  7, k1);
+	Subround(G, d1, e1, a1, b1, c1, X[ 4],  6, k1);
+	Subround(G, c1, d1, e1, a1, b1, X[13],  8, k1);
+	Subround(G, b1, c1, d1, e1, a1, X[ 1], 13, k1);
+	Subround(G, a1, b1, c1, d1, e1, X[10], 11, k1);
+	Subround(G, e1, a1, b1, c1, d1, X[ 6],  9, k1);
+	Subround(G, d1, e1, a1, b1, c1, X[15],  7, k1);
+	Subround(G, c1, d1, e1, a1, b1, X[ 3], 15, k1);
+	Subround(G, b1, c1, d1, e1, a1, X[12],  7, k1);
+	Subround(G, a1, b1, c1, d1, e1, X[ 0], 12, k1);
+	Subround(G, e1, a1, b1, c1, d1, X[ 9], 15, k1);
+	Subround(G, d1, e1, a1, b1, c1, X[ 5],  9, k1);
+	Subround(G, c1, d1, e1, a1, b1, X[ 2], 11, k1);
+	Subround(G, b1, c1, d1, e1, a1, X[14],  7, k1);
+	Subround(G, a1, b1, c1, d1, e1, X[11], 13, k1);
+	Subround(G, e1, a1, b1, c1, d1, X[ 8], 12, k1);
+
+	Subround(I, e2, a2, b2, c2, d2, X[ 6],  9, k6);
+	Subround(I, d2, e2, a2, b2, c2, X[11], 13, k6);
+	Subround(I, c2, d2, e2, a2, b2, X[ 3], 15, k6);
+	Subround(I, b2, c2, d2, e2, a2, X[ 7],  7, k6);
+	Subround(I, a2, b2, c2, d2, e2, X[ 0], 12, k6);
+	Subround(I, e2, a2, b2, c2, d2, X[13],  8, k6);
+	Subround(I, d2, e2, a2, b2, c2, X[ 5],  9, k6);
+	Subround(I, c2, d2, e2, a2, b2, X[10], 11, k6);
+	Subround(I, b2, c2, d2, e2, a2, X[14],  7, k6);
+	Subround(I, a2, b2, c2, d2, e2, X[15],  7, k6);
+	Subround(I, e2, a2, b2, c2, d2, X[ 8], 12, k6);
+	Subround(I, d2, e2, a2, b2, c2, X[12],  7, k6);
+	Subround(I, c2, d2, e2, a2, b2, X[ 4],  6, k6);
+	Subround(I, b2, c2, d2, e2, a2, X[ 9], 15, k6);
+	Subround(I, a2, b2, c2, d2, e2, X[ 1], 13, k6);
+	Subround(I, e2, a2, b2, c2, d2, X[ 2], 11, k6);
+
+	t = b1; b1 = b2; b2 = t;
+
+	Subround(H, d1, e1, a1, b1, c1, X[ 3], 11, k2);
+	Subround(H, c1, d1, e1, a1, b1, X[10], 13, k2);
+	Subround(H, b1, c1, d1, e1, a1, X[14],  6, k2);
+	Subround(H, a1, b1, c1, d1, e1, X[ 4],  7, k2);
+	Subround(H, e1, a1, b1, c1, d1, X[ 9], 14, k2);
+	Subround(H, d1, e1, a1, b1, c1, X[15],  9, k2);
+	Subround(H, c1, d1, e1, a1, b1, X[ 8], 13, k2);
+	Subround(H, b1, c1, d1, e1, a1, X[ 1], 15, k2);
+	Subround(H, a1, b1, c1, d1, e1, X[ 2], 14, k2);
+	Subround(H, e1, a1, b1, c1, d1, X[ 7],  8, k2);
+	Subround(H, d1, e1, a1, b1, c1, X[ 0], 13, k2);
+	Subround(H, c1, d1, e1, a1, b1, X[ 6],  6, k2);
+	Subround(H, b1, c1, d1, e1, a1, X[13],  5, k2);
+	Subround(H, a1, b1, c1, d1, e1, X[11], 12, k2);
+	Subround(H, e1, a1, b1, c1, d1, X[ 5],  7, k2);
+	Subround(H, d1, e1, a1, b1, c1, X[12],  5, k2);
+
+	Subround(H, d2, e2, a2, b2, c2, X[15],  9, k7);
+	Subround(H, c2, d2, e2, a2, b2, X[ 5],  7, k7);
+	Subround(H, b2, c2, d2, e2, a2, X[ 1], 15, k7);
+	Subround(H, a2, b2, c2, d2, e2, X[ 3], 11, k7);
+	Subround(H, e2, a2, b2, c2, d2, X[ 7],  8, k7);
+	Subround(H, d2, e2, a2, b2, c2, X[14],  6, k7);
+	Subround(H, c2, d2, e2, a2, b2, X[ 6],  6, k7);
+	Subround(H, b2, c2, d2, e2, a2, X[ 9], 14, k7);
+	Subround(H, a2, b2, c2, d2, e2, X[11], 12, k7);
+	Subround(H, e2, a2, b2, c2, d2, X[ 8], 13, k7);
+	Subround(H, d2, e2, a2, b2, c2, X[12],  5, k7);
+	Subround(H, c2, d2, e2, a2, b2, X[ 2], 14, k7);
+	Subround(H, b2, c2, d2, e2, a2, X[10], 13, k7);
+	Subround(H, a2, b2, c2, d2, e2, X[ 0], 13, k7);
+	Subround(H, e2, a2, b2, c2, d2, X[ 4],  7, k7);
+	Subround(H, d2, e2, a2, b2, c2, X[13],  5, k7);
+
+	t = c1; c1 = c2; c2 = t;
+
+	Subround(I, c1, d1, e1, a1, b1, X[ 1], 11, k3);
+	Subround(I, b1, c1, d1, e1, a1, X[ 9], 12, k3);
+	Subround(I, a1, b1, c1, d1, e1, X[11], 14, k3);
+	Subround(I, e1, a1, b1, c1, d1, X[10], 15, k3);
+	Subround(I, d1, e1, a1, b1, c1, X[ 0], 14, k3);
+	Subround(I, c1, d1, e1, a1, b1, X[ 8], 15, k3);
+	Subround(I, b1, c1, d1, e1, a1, X[12],  9, k3);
+	Subround(I, a1, b1, c1, d1, e1, X[ 4],  8, k3);
+	Subround(I, e1, a1, b1, c1, d1, X[13],  9, k3);
+	Subround(I, d1, e1, a1, b1, c1, X[ 3], 14, k3);
+	Subround(I, c1, d1, e1, a1, b1, X[ 7],  5, k3);
+	Subround(I, b1, c1, d1, e1, a1, X[15],  6, k3);
+	Subround(I, a1, b1, c1, d1, e1, X[14],  8, k3);
+	Subround(I, e1, a1, b1, c1, d1, X[ 5],  6, k3);
+	Subround(I, d1, e1, a1, b1, c1, X[ 6],  5, k3);
+	Subround(I, c1, d1, e1, a1, b1, X[ 2], 12, k3);
+
+	Subround(G, c2, d2, e2, a2, b2, X[ 8], 15, k8);
+	Subround(G, b2, c2, d2, e2, a2, X[ 6],  5, k8);
+	Subround(G, a2, b2, c2, d2, e2, X[ 4],  8, k8);
+	Subround(G, e2, a2, b2, c2, d2, X[ 1], 11, k8);
+	Subround(G, d2, e2, a2, b2, c2, X[ 3], 14, k8);
+	Subround(G, c2, d2, e2, a2, b2, X[11], 14, k8);
+	Subround(G, b2, c2, d2, e2, a2, X[15],  6, k8);
+	Subround(G, a2, b2, c2, d2, e2, X[ 0], 14, k8);
+	Subround(G, e2, a2, b2, c2, d2, X[ 5],  6, k8);
+	Subround(G, d2, e2, a2, b2, c2, X[12],  9, k8);
+	Subround(G, c2, d2, e2, a2, b2, X[ 2], 12, k8);
+	Subround(G, b2, c2, d2, e2, a2, X[13],  9, k8);
+	Subround(G, a2, b2, c2, d2, e2, X[ 9], 12, k8);
+	Subround(G, e2, a2, b2, c2, d2, X[ 7],  5, k8);
+	Subround(G, d2, e2, a2, b2, c2, X[10], 15, k8);
+	Subround(G, c2, d2, e2, a2, b2, X[14],  8, k8);
+
+	t = d1; d1 = d2; d2 = t;
+
+	Subround(J, b1, c1, d1, e1, a1, X[ 4],  9, k4);
+	Subround(J, a1, b1, c1, d1, e1, X[ 0], 15, k4);
+	Subround(J, e1, a1, b1, c1, d1, X[ 5],  5, k4);
+	Subround(J, d1, e1, a1, b1, c1, X[ 9], 11, k4);
+	Subround(J, c1, d1, e1, a1, b1, X[ 7],  6, k4);
+	Subround(J, b1, c1, d1, e1, a1, X[12],  8, k4);
+	Subround(J, a1, b1, c1, d1, e1, X[ 2], 13, k4);
+	Subround(J, e1, a1, b1, c1, d1, X[10], 12, k4);
+	Subround(J, d1, e1, a1, b1, c1, X[14],  5, k4);
+	Subround(J, c1, d1, e1, a1, b1, X[ 1], 12, k4);
+	Subround(J, b1, c1, d1, e1, a1, X[ 3], 13, k4);
+	Subround(J, a1, b1, c1, d1, e1, X[ 8], 14, k4);
+	Subround(J, e1, a1, b1, c1, d1, X[11], 11, k4);
+	Subround(J, d1, e1, a1, b1, c1, X[ 6],  8, k4);
+	Subround(J, c1, d1, e1, a1, b1, X[15],  5, k4);
+	Subround(J, b1, c1, d1, e1, a1, X[13],  6, k4);
+
+	Subround(F, b2, c2, d2, e2, a2, X[12],  8, k9);
+	Subround(F, a2, b2, c2, d2, e2, X[15],  5, k9);
+	Subround(F, e2, a2, b2, c2, d2, X[10], 12, k9);
+	Subround(F, d2, e2, a2, b2, c2, X[ 4],  9, k9);
+	Subround(F, c2, d2, e2, a2, b2, X[ 1], 12, k9);
+	Subround(F, b2, c2, d2, e2, a2, X[ 5],  5, k9);
+	Subround(F, a2, b2, c2, d2, e2, X[ 8], 14, k9);
+	Subround(F, e2, a2, b2, c2, d2, X[ 7],  6, k9);
+	Subround(F, d2, e2, a2, b2, c2, X[ 6],  8, k9);
+	Subround(F, c2, d2, e2, a2, b2, X[ 2], 13, k9);
+	Subround(F, b2, c2, d2, e2, a2, X[13],  6, k9);
+	Subround(F, a2, b2, c2, d2, e2, X[14],  5, k9);
+	Subround(F, e2, a2, b2, c2, d2, X[ 0], 15, k9);
+	Subround(F, d2, e2, a2, b2, c2, X[ 3], 13, k9);
+	Subround(F, c2, d2, e2, a2, b2, X[ 9], 11, k9);
+	Subround(F, b2, c2, d2, e2, a2, X[11], 11, k9);
+
+	t = e1; e1 = e2; e2 = t;
+
+	digest[0] += a1;
+	digest[1] += b1;
+	digest[2] += c1;
+	digest[3] += d1;
+	digest[4] += e1;
+	digest[5] += a2;
+	digest[6] += b2;
+	digest[7] += c2;
+	digest[8] += d2;
+	digest[9] += e2;
+}
+
+#undef Subround
+
+// *************************************************************
+
+// for 128 and 256
+#define Subround(f, a, b, c, d, x, s, k)        \
+	a += f(b, c, d) + x + k;\
+	a = rotlVariable((word32)a, s);
+
+void RIPEMD128::InitState(HashWordType *state)
+{
+	state[0] = 0x67452301L;
+	state[1] = 0xefcdab89L;
+	state[2] = 0x98badcfeL;
+	state[3] = 0x10325476L;
+}
+
+void RIPEMD128::Transform (word32 *digest, const word32 *X)
+{
+	unsigned long a1, b1, c1, d1, a2, b2, c2, d2;
+	a1 = a2 = digest[0];
+	b1 = b2 = digest[1];
+	c1 = c2 = digest[2];
+	d1 = d2 = digest[3];
+
+	Subround(F, a1, b1, c1, d1, X[ 0], 11, k0);
+	Subround(F, d1, a1, b1, c1, X[ 1], 14, k0);
+	Subround(F, c1, d1, a1, b1, X[ 2], 15, k0);
+	Subround(F, b1, c1, d1, a1, X[ 3], 12, k0);
+	Subround(F, a1, b1, c1, d1, X[ 4],  5, k0);
+	Subround(F, d1, a1, b1, c1, X[ 5],  8, k0);
+	Subround(F, c1, d1, a1, b1, X[ 6],  7, k0);
+	Subround(F, b1, c1, d1, a1, X[ 7],  9, k0);
+	Subround(F, a1, b1, c1, d1, X[ 8], 11, k0);
+	Subround(F, d1, a1, b1, c1, X[ 9], 13, k0);
+	Subround(F, c1, d1, a1, b1, X[10], 14, k0);
+	Subround(F, b1, c1, d1, a1, X[11], 15, k0);
+	Subround(F, a1, b1, c1, d1, X[12],  6, k0);
+	Subround(F, d1, a1, b1, c1, X[13],  7, k0);
+	Subround(F, c1, d1, a1, b1, X[14],  9, k0);
+	Subround(F, b1, c1, d1, a1, X[15],  8, k0);
+
+	Subround(G, a1, b1, c1, d1, X[ 7],  7, k1);
+	Subround(G, d1, a1, b1, c1, X[ 4],  6, k1);
+	Subround(G, c1, d1, a1, b1, X[13],  8, k1);
+	Subround(G, b1, c1, d1, a1, X[ 1], 13, k1);
+	Subround(G, a1, b1, c1, d1, X[10], 11, k1);
+	Subround(G, d1, a1, b1, c1, X[ 6],  9, k1);
+	Subround(G, c1, d1, a1, b1, X[15],  7, k1);
+	Subround(G, b1, c1, d1, a1, X[ 3], 15, k1);
+	Subround(G, a1, b1, c1, d1, X[12],  7, k1);
+	Subround(G, d1, a1, b1, c1, X[ 0], 12, k1);
+	Subround(G, c1, d1, a1, b1, X[ 9], 15, k1);
+	Subround(G, b1, c1, d1, a1, X[ 5],  9, k1);
+	Subround(G, a1, b1, c1, d1, X[ 2], 11, k1);
+	Subround(G, d1, a1, b1, c1, X[14],  7, k1);
+	Subround(G, c1, d1, a1, b1, X[11], 13, k1);
+	Subround(G, b1, c1, d1, a1, X[ 8], 12, k1);
+
+	Subround(H, a1, b1, c1, d1, X[ 3], 11, k2);
+	Subround(H, d1, a1, b1, c1, X[10], 13, k2);
+	Subround(H, c1, d1, a1, b1, X[14],  6, k2);
+	Subround(H, b1, c1, d1, a1, X[ 4],  7, k2);
+	Subround(H, a1, b1, c1, d1, X[ 9], 14, k2);
+	Subround(H, d1, a1, b1, c1, X[15],  9, k2);
+	Subround(H, c1, d1, a1, b1, X[ 8], 13, k2);
+	Subround(H, b1, c1, d1, a1, X[ 1], 15, k2);
+	Subround(H, a1, b1, c1, d1, X[ 2], 14, k2);
+	Subround(H, d1, a1, b1, c1, X[ 7],  8, k2);
+	Subround(H, c1, d1, a1, b1, X[ 0], 13, k2);
+	Subround(H, b1, c1, d1, a1, X[ 6],  6, k2);
+	Subround(H, a1, b1, c1, d1, X[13],  5, k2);
+	Subround(H, d1, a1, b1, c1, X[11], 12, k2);
+	Subround(H, c1, d1, a1, b1, X[ 5],  7, k2);
+	Subround(H, b1, c1, d1, a1, X[12],  5, k2);
+
+	Subround(I, a1, b1, c1, d1, X[ 1], 11, k3);
+	Subround(I, d1, a1, b1, c1, X[ 9], 12, k3);
+	Subround(I, c1, d1, a1, b1, X[11], 14, k3);
+	Subround(I, b1, c1, d1, a1, X[10], 15, k3);
+	Subround(I, a1, b1, c1, d1, X[ 0], 14, k3);
+	Subround(I, d1, a1, b1, c1, X[ 8], 15, k3);
+	Subround(I, c1, d1, a1, b1, X[12],  9, k3);
+	Subround(I, b1, c1, d1, a1, X[ 4],  8, k3);
+	Subround(I, a1, b1, c1, d1, X[13],  9, k3);
+	Subround(I, d1, a1, b1, c1, X[ 3], 14, k3);
+	Subround(I, c1, d1, a1, b1, X[ 7],  5, k3);
+	Subround(I, b1, c1, d1, a1, X[15],  6, k3);
+	Subround(I, a1, b1, c1, d1, X[14],  8, k3);
+	Subround(I, d1, a1, b1, c1, X[ 5],  6, k3);
+	Subround(I, c1, d1, a1, b1, X[ 6],  5, k3);
+	Subround(I, b1, c1, d1, a1, X[ 2], 12, k3);
+
+	Subround(I, a2, b2, c2, d2, X[ 5],  8, k5);
+	Subround(I, d2, a2, b2, c2, X[14],  9, k5);
+	Subround(I, c2, d2, a2, b2, X[ 7],  9, k5);
+	Subround(I, b2, c2, d2, a2, X[ 0], 11, k5);
+	Subround(I, a2, b2, c2, d2, X[ 9], 13, k5);
+	Subround(I, d2, a2, b2, c2, X[ 2], 15, k5);
+	Subround(I, c2, d2, a2, b2, X[11], 15, k5);
+	Subround(I, b2, c2, d2, a2, X[ 4],  5, k5);
+	Subround(I, a2, b2, c2, d2, X[13],  7, k5);
+	Subround(I, d2, a2, b2, c2, X[ 6],  7, k5);
+	Subround(I, c2, d2, a2, b2, X[15],  8, k5);
+	Subround(I, b2, c2, d2, a2, X[ 8], 11, k5);
+	Subround(I, a2, b2, c2, d2, X[ 1], 14, k5);
+	Subround(I, d2, a2, b2, c2, X[10], 14, k5);
+	Subround(I, c2, d2, a2, b2, X[ 3], 12, k5);
+	Subround(I, b2, c2, d2, a2, X[12],  6, k5);
+
+	Subround(H, a2, b2, c2, d2, X[ 6],  9, k6);
+	Subround(H, d2, a2, b2, c2, X[11], 13, k6);
+	Subround(H, c2, d2, a2, b2, X[ 3], 15, k6);
+	Subround(H, b2, c2, d2, a2, X[ 7],  7, k6);
+	Subround(H, a2, b2, c2, d2, X[ 0], 12, k6);
+	Subround(H, d2, a2, b2, c2, X[13],  8, k6);
+	Subround(H, c2, d2, a2, b2, X[ 5],  9, k6);
+	Subround(H, b2, c2, d2, a2, X[10], 11, k6);
+	Subround(H, a2, b2, c2, d2, X[14],  7, k6);
+	Subround(H, d2, a2, b2, c2, X[15],  7, k6);
+	Subround(H, c2, d2, a2, b2, X[ 8], 12, k6);
+	Subround(H, b2, c2, d2, a2, X[12],  7, k6);
+	Subround(H, a2, b2, c2, d2, X[ 4],  6, k6);
+	Subround(H, d2, a2, b2, c2, X[ 9], 15, k6);
+	Subround(H, c2, d2, a2, b2, X[ 1], 13, k6);
+	Subround(H, b2, c2, d2, a2, X[ 2], 11, k6);
+
+	Subround(G, a2, b2, c2, d2, X[15],  9, k7);
+	Subround(G, d2, a2, b2, c2, X[ 5],  7, k7);
+	Subround(G, c2, d2, a2, b2, X[ 1], 15, k7);
+	Subround(G, b2, c2, d2, a2, X[ 3], 11, k7);
+	Subround(G, a2, b2, c2, d2, X[ 7],  8, k7);
+	Subround(G, d2, a2, b2, c2, X[14],  6, k7);
+	Subround(G, c2, d2, a2, b2, X[ 6],  6, k7);
+	Subround(G, b2, c2, d2, a2, X[ 9], 14, k7);
+	Subround(G, a2, b2, c2, d2, X[11], 12, k7);
+	Subround(G, d2, a2, b2, c2, X[ 8], 13, k7);
+	Subround(G, c2, d2, a2, b2, X[12],  5, k7);
+	Subround(G, b2, c2, d2, a2, X[ 2], 14, k7);
+	Subround(G, a2, b2, c2, d2, X[10], 13, k7);
+	Subround(G, d2, a2, b2, c2, X[ 0], 13, k7);
+	Subround(G, c2, d2, a2, b2, X[ 4],  7, k7);
+	Subround(G, b2, c2, d2, a2, X[13],  5, k7);
+
+	Subround(F, a2, b2, c2, d2, X[ 8], 15, k9);
+	Subround(F, d2, a2, b2, c2, X[ 6],  5, k9);
+	Subround(F, c2, d2, a2, b2, X[ 4],  8, k9);
+	Subround(F, b2, c2, d2, a2, X[ 1], 11, k9);
+	Subround(F, a2, b2, c2, d2, X[ 3], 14, k9);
+	Subround(F, d2, a2, b2, c2, X[11], 14, k9);
+	Subround(F, c2, d2, a2, b2, X[15],  6, k9);
+	Subround(F, b2, c2, d2, a2, X[ 0], 14, k9);
+	Subround(F, a2, b2, c2, d2, X[ 5],  6, k9);
+	Subround(F, d2, a2, b2, c2, X[12],  9, k9);
+	Subround(F, c2, d2, a2, b2, X[ 2], 12, k9);
+	Subround(F, b2, c2, d2, a2, X[13],  9, k9);
+	Subround(F, a2, b2, c2, d2, X[ 9], 12, k9);
+	Subround(F, d2, a2, b2, c2, X[ 7],  5, k9);
+	Subround(F, c2, d2, a2, b2, X[10], 15, k9);
+	Subround(F, b2, c2, d2, a2, X[14],  8, k9);
+
+	c1        = digest[1] + c1 + d2;
+	digest[1] = digest[2] + d1 + a2;
+	digest[2] = digest[3] + a1 + b2;
+	digest[3] = digest[0] + b1 + c2;
+	digest[0] = c1;
+}
+
+// *************************************************************
+
+void RIPEMD256::InitState(HashWordType *state)
+{
+	state[0] = 0x67452301L;
+	state[1] = 0xefcdab89L;
+	state[2] = 0x98badcfeL;
+	state[3] = 0x10325476L;
+	state[4] = 0x76543210L;
+	state[5] = 0xfedcba98L;
+	state[6] = 0x89abcdefL;
+	state[7] = 0x01234567L;
+}
+
+void RIPEMD256::Transform (word32 *digest, const word32 *X)
+{
+	unsigned long a1, b1, c1, d1, a2, b2, c2, d2, t;
+	a1 = digest[0];
+	b1 = digest[1];
+	c1 = digest[2];
+	d1 = digest[3];
+	a2 = digest[4];
+	b2 = digest[5];
+	c2 = digest[6];
+	d2 = digest[7];
+
+	Subround(F, a1, b1, c1, d1, X[ 0], 11, k0);
+	Subround(F, d1, a1, b1, c1, X[ 1], 14, k0);
+	Subround(F, c1, d1, a1, b1, X[ 2], 15, k0);
+	Subround(F, b1, c1, d1, a1, X[ 3], 12, k0);
+	Subround(F, a1, b1, c1, d1, X[ 4],  5, k0);
+	Subround(F, d1, a1, b1, c1, X[ 5],  8, k0);
+	Subround(F, c1, d1, a1, b1, X[ 6],  7, k0);
+	Subround(F, b1, c1, d1, a1, X[ 7],  9, k0);
+	Subround(F, a1, b1, c1, d1, X[ 8], 11, k0);
+	Subround(F, d1, a1, b1, c1, X[ 9], 13, k0);
+	Subround(F, c1, d1, a1, b1, X[10], 14, k0);
+	Subround(F, b1, c1, d1, a1, X[11], 15, k0);
+	Subround(F, a1, b1, c1, d1, X[12],  6, k0);
+	Subround(F, d1, a1, b1, c1, X[13],  7, k0);
+	Subround(F, c1, d1, a1, b1, X[14],  9, k0);
+	Subround(F, b1, c1, d1, a1, X[15],  8, k0);
+
+	Subround(I, a2, b2, c2, d2, X[ 5],  8, k5);
+	Subround(I, d2, a2, b2, c2, X[14],  9, k5);
+	Subround(I, c2, d2, a2, b2, X[ 7],  9, k5);
+	Subround(I, b2, c2, d2, a2, X[ 0], 11, k5);
+	Subround(I, a2, b2, c2, d2, X[ 9], 13, k5);
+	Subround(I, d2, a2, b2, c2, X[ 2], 15, k5);
+	Subround(I, c2, d2, a2, b2, X[11], 15, k5);
+	Subround(I, b2, c2, d2, a2, X[ 4],  5, k5);
+	Subround(I, a2, b2, c2, d2, X[13],  7, k5);
+	Subround(I, d2, a2, b2, c2, X[ 6],  7, k5);
+	Subround(I, c2, d2, a2, b2, X[15],  8, k5);
+	Subround(I, b2, c2, d2, a2, X[ 8], 11, k5);
+	Subround(I, a2, b2, c2, d2, X[ 1], 14, k5);
+	Subround(I, d2, a2, b2, c2, X[10], 14, k5);
+	Subround(I, c2, d2, a2, b2, X[ 3], 12, k5);
+	Subround(I, b2, c2, d2, a2, X[12],  6, k5);
+
+	t = a1; a1 = a2; a2 = t;
+
+	Subround(G, a1, b1, c1, d1, X[ 7],  7, k1);
+	Subround(G, d1, a1, b1, c1, X[ 4],  6, k1);
+	Subround(G, c1, d1, a1, b1, X[13],  8, k1);
+	Subround(G, b1, c1, d1, a1, X[ 1], 13, k1);
+	Subround(G, a1, b1, c1, d1, X[10], 11, k1);
+	Subround(G, d1, a1, b1, c1, X[ 6],  9, k1);
+	Subround(G, c1, d1, a1, b1, X[15],  7, k1);
+	Subround(G, b1, c1, d1, a1, X[ 3], 15, k1);
+	Subround(G, a1, b1, c1, d1, X[12],  7, k1);
+	Subround(G, d1, a1, b1, c1, X[ 0], 12, k1);
+	Subround(G, c1, d1, a1, b1, X[ 9], 15, k1);
+	Subround(G, b1, c1, d1, a1, X[ 5],  9, k1);
+	Subround(G, a1, b1, c1, d1, X[ 2], 11, k1);
+	Subround(G, d1, a1, b1, c1, X[14],  7, k1);
+	Subround(G, c1, d1, a1, b1, X[11], 13, k1);
+	Subround(G, b1, c1, d1, a1, X[ 8], 12, k1);
+
+	Subround(H, a2, b2, c2, d2, X[ 6],  9, k6);
+	Subround(H, d2, a2, b2, c2, X[11], 13, k6);
+	Subround(H, c2, d2, a2, b2, X[ 3], 15, k6);
+	Subround(H, b2, c2, d2, a2, X[ 7],  7, k6);
+	Subround(H, a2, b2, c2, d2, X[ 0], 12, k6);
+	Subround(H, d2, a2, b2, c2, X[13],  8, k6);
+	Subround(H, c2, d2, a2, b2, X[ 5],  9, k6);
+	Subround(H, b2, c2, d2, a2, X[10], 11, k6);
+	Subround(H, a2, b2, c2, d2, X[14],  7, k6);
+	Subround(H, d2, a2, b2, c2, X[15],  7, k6);
+	Subround(H, c2, d2, a2, b2, X[ 8], 12, k6);
+	Subround(H, b2, c2, d2, a2, X[12],  7, k6);
+	Subround(H, a2, b2, c2, d2, X[ 4],  6, k6);
+	Subround(H, d2, a2, b2, c2, X[ 9], 15, k6);
+	Subround(H, c2, d2, a2, b2, X[ 1], 13, k6);
+	Subround(H, b2, c2, d2, a2, X[ 2], 11, k6);
+
+	t = b1; b1 = b2; b2 = t;
+
+	Subround(H, a1, b1, c1, d1, X[ 3], 11, k2);
+	Subround(H, d1, a1, b1, c1, X[10], 13, k2);
+	Subround(H, c1, d1, a1, b1, X[14],  6, k2);
+	Subround(H, b1, c1, d1, a1, X[ 4],  7, k2);
+	Subround(H, a1, b1, c1, d1, X[ 9], 14, k2);
+	Subround(H, d1, a1, b1, c1, X[15],  9, k2);
+	Subround(H, c1, d1, a1, b1, X[ 8], 13, k2);
+	Subround(H, b1, c1, d1, a1, X[ 1], 15, k2);
+	Subround(H, a1, b1, c1, d1, X[ 2], 14, k2);
+	Subround(H, d1, a1, b1, c1, X[ 7],  8, k2);
+	Subround(H, c1, d1, a1, b1, X[ 0], 13, k2);
+	Subround(H, b1, c1, d1, a1, X[ 6],  6, k2);
+	Subround(H, a1, b1, c1, d1, X[13],  5, k2);
+	Subround(H, d1, a1, b1, c1, X[11], 12, k2);
+	Subround(H, c1, d1, a1, b1, X[ 5],  7, k2);
+	Subround(H, b1, c1, d1, a1, X[12],  5, k2);
+
+	Subround(G, a2, b2, c2, d2, X[15],  9, k7);
+	Subround(G, d2, a2, b2, c2, X[ 5],  7, k7);
+	Subround(G, c2, d2, a2, b2, X[ 1], 15, k7);
+	Subround(G, b2, c2, d2, a2, X[ 3], 11, k7);
+	Subround(G, a2, b2, c2, d2, X[ 7],  8, k7);
+	Subround(G, d2, a2, b2, c2, X[14],  6, k7);
+	Subround(G, c2, d2, a2, b2, X[ 6],  6, k7);
+	Subround(G, b2, c2, d2, a2, X[ 9], 14, k7);
+	Subround(G, a2, b2, c2, d2, X[11], 12, k7);
+	Subround(G, d2, a2, b2, c2, X[ 8], 13, k7);
+	Subround(G, c2, d2, a2, b2, X[12],  5, k7);
+	Subround(G, b2, c2, d2, a2, X[ 2], 14, k7);
+	Subround(G, a2, b2, c2, d2, X[10], 13, k7);
+	Subround(G, d2, a2, b2, c2, X[ 0], 13, k7);
+	Subround(G, c2, d2, a2, b2, X[ 4],  7, k7);
+	Subround(G, b2, c2, d2, a2, X[13],  5, k7);
+
+	t = c1; c1 = c2; c2 = t;
+
+	Subround(I, a1, b1, c1, d1, X[ 1], 11, k3);
+	Subround(I, d1, a1, b1, c1, X[ 9], 12, k3);
+	Subround(I, c1, d1, a1, b1, X[11], 14, k3);
+	Subround(I, b1, c1, d1, a1, X[10], 15, k3);
+	Subround(I, a1, b1, c1, d1, X[ 0], 14, k3);
+	Subround(I, d1, a1, b1, c1, X[ 8], 15, k3);
+	Subround(I, c1, d1, a1, b1, X[12],  9, k3);
+	Subround(I, b1, c1, d1, a1, X[ 4],  8, k3);
+	Subround(I, a1, b1, c1, d1, X[13],  9, k3);
+	Subround(I, d1, a1, b1, c1, X[ 3], 14, k3);
+	Subround(I, c1, d1, a1, b1, X[ 7],  5, k3);
+	Subround(I, b1, c1, d1, a1, X[15],  6, k3);
+	Subround(I, a1, b1, c1, d1, X[14],  8, k3);
+	Subround(I, d1, a1, b1, c1, X[ 5],  6, k3);
+	Subround(I, c1, d1, a1, b1, X[ 6],  5, k3);
+	Subround(I, b1, c1, d1, a1, X[ 2], 12, k3);
+
+	Subround(F, a2, b2, c2, d2, X[ 8], 15, k9);
+	Subround(F, d2, a2, b2, c2, X[ 6],  5, k9);
+	Subround(F, c2, d2, a2, b2, X[ 4],  8, k9);
+	Subround(F, b2, c2, d2, a2, X[ 1], 11, k9);
+	Subround(F, a2, b2, c2, d2, X[ 3], 14, k9);
+	Subround(F, d2, a2, b2, c2, X[11], 14, k9);
+	Subround(F, c2, d2, a2, b2, X[15],  6, k9);
+	Subround(F, b2, c2, d2, a2, X[ 0], 14, k9);
+	Subround(F, a2, b2, c2, d2, X[ 5],  6, k9);
+	Subround(F, d2, a2, b2, c2, X[12],  9, k9);
+	Subround(F, c2, d2, a2, b2, X[ 2], 12, k9);
+	Subround(F, b2, c2, d2, a2, X[13],  9, k9);
+	Subround(F, a2, b2, c2, d2, X[ 9], 12, k9);
+	Subround(F, d2, a2, b2, c2, X[ 7],  5, k9);
+	Subround(F, c2, d2, a2, b2, X[10], 15, k9);
+	Subround(F, b2, c2, d2, a2, X[14],  8, k9);
+
+	t = d1; d1 = d2; d2 = t;
+
+	digest[0] += a1;
+	digest[1] += b1;
+	digest[2] += c1;
+	digest[3] += d1;
+	digest[4] += a2;
+	digest[5] += b2;
+	digest[6] += c2;
+	digest[7] += d2;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/ripemd.h b/runtime/third_party/cryptopp/ripemd.h
new file mode 100644
index 0000000..cf70084
--- /dev/null
+++ b/runtime/third_party/cryptopp/ripemd.h
@@ -0,0 +1,65 @@
+// ripemd.h - originally written and placed in the public domain by Wei Dai
+
+/// \file
+/// \brief Classes for RIPEMD message digest
+
+#ifndef CRYPTOPP_RIPEMD_H
+#define CRYPTOPP_RIPEMD_H
+
+#include "iterhash.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief RIPEMD-160 message digest
+/// \details Digest size is 160-bits.
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#RIPEMD-160">RIPEMD-160</a>
+/// \since Crypto++ 2.1
+class RIPEMD160 : public IteratedHashWithStaticTransform<word32, LittleEndian, 64, 20, RIPEMD160>
+{
+public:
+	static void InitState(HashWordType *state);
+	static void Transform(word32 *digest, const word32 *data);
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "RIPEMD-160";}
+};
+
+/// \brief RIPEMD-320 message digest
+/// \details Digest size is 320-bits.
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#RIPEMD-320">RIPEMD-320</a>
+/// \since Crypto++ 2.1
+class RIPEMD320 : public IteratedHashWithStaticTransform<word32, LittleEndian, 64, 40, RIPEMD320>
+{
+public:
+	static void InitState(HashWordType *state);
+	static void Transform(word32 *digest, const word32 *data);
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "RIPEMD-320";}
+};
+
+/// \brief RIPEMD-128 message digest
+/// \details Digest size is 128-bits.
+/// \warning RIPEMD-128 is considered insecure, and should not be used unless you absolutely need it for compatibility.
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#RIPEMD-128">RIPEMD-128</a>
+/// \since Crypto++ 2.1
+class RIPEMD128 : public IteratedHashWithStaticTransform<word32, LittleEndian, 64, 16, RIPEMD128>
+{
+public:
+	static void InitState(HashWordType *state);
+	static void Transform(word32 *digest, const word32 *data);
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "RIPEMD-128";}
+};
+
+/// \brief RIPEMD-256 message digest
+/// \details Digest size is 256-bits.
+/// \warning RIPEMD-256 is considered insecure, and should not be used unless you absolutely need it for compatibility.
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#RIPEMD-256">RIPEMD-256</a>
+/// \since Crypto++ 2.1
+class RIPEMD256 : public IteratedHashWithStaticTransform<word32, LittleEndian, 64, 32, RIPEMD256>
+{
+public:
+	static void InitState(HashWordType *state);
+	static void Transform(word32 *digest, const word32 *data);
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "RIPEMD-256";}
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rng.cpp b/runtime/third_party/cryptopp/rng.cpp
new file mode 100644
index 0000000..f4a1589
--- /dev/null
+++ b/runtime/third_party/cryptopp/rng.cpp
@@ -0,0 +1,166 @@
+// rng.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#include "rng.h"
+#include "fips140.h"
+
+#include <time.h>
+#include <math.h>
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// linear congruential generator
+// originally by William S. England
+
+// do not use for cryptographic purposes
+
+/*
+** Original_numbers are the original published m and q in the
+** ACM article above.  John Burton has furnished numbers for
+** a reportedly better generator.  The new numbers are now
+** used in this program by default.
+*/
+
+#ifndef LCRNG_ORIGINAL_NUMBERS
+const word32 LC_RNG::m=2147483647L;
+const word32 LC_RNG::q=44488L;
+
+const word16 LC_RNG::a=(unsigned int)48271L;
+const word16 LC_RNG::r=3399;
+#else
+const word32 LC_RNG::m=2147483647L;
+const word32 LC_RNG::q=127773L;
+
+const word16 LC_RNG::a=16807;
+const word16 LC_RNG::r=2836;
+#endif
+
+void LC_RNG::GenerateBlock(byte *output, size_t size)
+{
+	while (size--)
+	{
+		const word32 hi = seed/q;
+		const word32 lo = seed%q;
+		const sword64 test = a*lo - r*hi;
+
+		if (test > 0)
+			seed = static_cast<word32>(test);
+		else
+			seed = static_cast<word32>(test + m);
+
+		*output++ = byte((GETBYTE(seed, 0) ^ GETBYTE(seed, 1) ^ GETBYTE(seed, 2) ^ GETBYTE(seed, 3)));
+	}
+}
+
+// ********************************************************
+
+#ifndef CRYPTOPP_IMPORTS
+
+X917RNG::X917RNG(BlockTransformation *c, const byte *seed, const byte *deterministicTimeVector)
+	: m_cipher(c),
+	  m_size(m_cipher->BlockSize()),
+	  m_datetime(m_size),
+	  m_randseed(seed, m_size),
+	  m_lastBlock(m_size),
+	  m_deterministicTimeVector(deterministicTimeVector, deterministicTimeVector ? m_size : 0)
+{
+	// Valgrind finding, http://github.com/weidai11/cryptopp/issues/105
+	// Garbage in the tail creates a non-conforming X9.17 or X9.31 generator.
+	if (m_size > 8)
+	{
+		std::memset(m_datetime, 0x00, m_size);
+		std::memset(m_lastBlock, 0x00, m_size);
+	}
+
+	if (!deterministicTimeVector)
+	{
+		time_t tstamp1 = ::time(NULLPTR);
+		xorbuf(m_datetime, (byte *)&tstamp1, UnsignedMin(sizeof(tstamp1), m_size));
+		m_cipher->ProcessBlock(m_datetime);
+		clock_t tstamp2 = clock();
+		xorbuf(m_datetime, (byte *)&tstamp2, UnsignedMin(sizeof(tstamp2), m_size));
+		m_cipher->ProcessBlock(m_datetime);
+	}
+
+	// for FIPS 140-2
+	// GenerateBlock(m_lastBlock, m_size);
+
+	// Make explicit call to avoid virtual-dispatch findings in ctor
+	ArraySink target(m_lastBlock, m_size);
+	X917RNG::GenerateIntoBufferedTransformation(target, DEFAULT_CHANNEL, m_size);
+}
+
+void X917RNG::GenerateIntoBufferedTransformation(BufferedTransformation &target, const std::string &channel, lword size)
+{
+	while (size > 0)
+	{
+		// calculate new enciphered timestamp
+		if (m_deterministicTimeVector.size())
+		{
+			m_cipher->ProcessBlock(m_deterministicTimeVector, m_datetime);
+			IncrementCounterByOne(m_deterministicTimeVector, m_size);
+		}
+		else
+		{
+			clock_t c = clock();
+			xorbuf(m_datetime, (byte *)&c, UnsignedMin(sizeof(c), m_size));
+			time_t t = ::time(NULLPTR);
+			xorbuf(m_datetime+m_size-UnsignedMin(sizeof(t), m_size), (byte *)&t, UnsignedMin(sizeof(t), m_size));
+			m_cipher->ProcessBlock(m_datetime);
+		}
+
+		// combine enciphered timestamp with seed
+		xorbuf(m_randseed, m_datetime, m_size);
+
+		// generate a new block of random bytes
+		m_cipher->ProcessBlock(m_randseed);
+		if (std::memcmp(m_lastBlock, m_randseed, m_size) == 0)
+			throw SelfTestFailure("X917RNG: Continuous random number generator test failed.");
+
+		// output random bytes
+		size_t len = UnsignedMin(m_size, size);
+		target.ChannelPut(channel, m_randseed, len);
+		size -= len;
+
+		// compute new seed vector
+		std::memcpy(m_lastBlock, m_randseed, m_size);
+		xorbuf(m_randseed, m_datetime, m_size);
+		m_cipher->ProcessBlock(m_randseed);
+	}
+}
+
+#endif
+
+MaurerRandomnessTest::MaurerRandomnessTest()
+	: sum(0.0), n(0)
+{
+	for (unsigned i=0; i<V; i++)
+		tab[i] = 0;
+}
+
+size_t MaurerRandomnessTest::Put2(const byte *inString, size_t length, int /*messageEnd*/, bool /*blocking*/)
+{
+	while (length--)
+	{
+		byte inByte = *inString++;
+		if (n >= Q)
+			sum += ::log(double(n - tab[inByte]));
+		tab[inByte] = n;
+		n++;
+	}
+	return 0;
+}
+
+double MaurerRandomnessTest::GetTestValue() const
+{
+	if (BytesNeeded() > 0)
+		throw Exception(Exception::OTHER_ERROR, "MaurerRandomnessTest: " + IntToString(BytesNeeded()) + " more bytes of input needed");
+
+	double fTu = (sum/(n-Q))/::log(2.0);	// this is the test value defined by Maurer
+
+	double value = fTu * 0.1392;		// arbitrarily normalize it to
+	return value > 1.0 ? 1.0 : value;	// a number between 0 and 1
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/rng.h b/runtime/third_party/cryptopp/rng.h
new file mode 100644
index 0000000..74456ac
--- /dev/null
+++ b/runtime/third_party/cryptopp/rng.h
@@ -0,0 +1,111 @@
+// rng.h - originally written and placed in the public domain by Wei Dai
+
+/// \file rng.h
+/// \brief Miscellaneous classes for RNGs
+/// \details This file contains miscellaneous classes for RNGs, including LC_RNG(),
+///  X917RNG() and MaurerRandomnessTest()
+/// \sa osrng.h, randpool.h
+
+#ifndef CRYPTOPP_RNG_H
+#define CRYPTOPP_RNG_H
+
+#include "cryptlib.h"
+#include "filters.h"
+#include "smartptr.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Linear Congruential Generator (LCG)
+/// \details Originally propsed by William S. England.
+/// \warning LC_RNG is suitable for simulations, where uniformaly distributed numbers are
+///  required quickly. It should not be used for cryptographic purposes.
+class LC_RNG : public RandomNumberGenerator
+{
+public:
+	/// \brief Construct a Linear Congruential Generator (LCG)
+	/// \param init_seed the initial value for the generator
+	LC_RNG(word32 init_seed)
+		: seed(init_seed) {}
+
+	void GenerateBlock(byte *output, size_t size);
+
+	word32 GetSeed() {return seed;}
+
+private:
+	word32 seed;
+
+	static const word32 m;
+	static const word32 q;
+	static const word16 a;
+	static const word16 r;
+};
+
+/// \brief ANSI X9.17 RNG
+/// \details X917RNG is from ANSI X9.17 Appendix C, and it uses a 64-bit block cipher, like TripleDES.
+///  If you use a 128-bit block cipher, like AES, then you are effectively using an ANSI X9.31 generator.
+/// \details You should reseed the generator after a fork() to avoid multiple generators
+///  with the same internal state.
+/// \sa AutoSeededX917RNG, DefaultAutoSeededRNG
+class CRYPTOPP_DLL X917RNG : public RandomNumberGenerator, public NotCopyable
+{
+public:
+	/// \brief Construct a X917RNG
+	/// \param cipher the block cipher to use for the generator
+	/// \param seed a byte buffer to use as a seed
+	/// \param deterministicTimeVector additional entropy
+	/// \details <tt>cipher</tt> will be deleted by the destructor. <tt>seed</tt> must be at least
+	///  BlockSize() in length. <tt>deterministicTimeVector = 0</tt> means obtain time vector
+	///  from the system.
+	/// \details When constructing a X917RNG, the generator must be keyed or an access
+	///  violation will occur because the time vector is encrypted using the block cipher.
+	///  To key the generator during constructions, perform the following:
+	/// <pre>
+	///  SecByteBlock key(AES::DEFAULT_KEYLENGTH), seed(AES::BLOCKSIZE);
+	///  OS_GenerateRandomBlock(false, key, key.size());
+	///  OS_GenerateRandomBlock(false, seed, seed.size());
+	///  X917RNG prng(new AES::Encryption(key, AES::DEFAULT_KEYLENGTH), seed, NULLPTR);</pre>
+	/// \sa AutoSeededX917RNG
+	X917RNG(BlockTransformation *cipher, const byte *seed, const byte *deterministicTimeVector = NULLPTR);
+
+	void GenerateIntoBufferedTransformation(BufferedTransformation &target, const std::string &channel, lword size);
+
+private:
+	member_ptr<BlockTransformation> m_cipher;
+	const unsigned int m_size;  // S, blocksize of cipher
+	SecByteBlock m_datetime;    // DT, buffer for enciphered timestamp
+	SecByteBlock m_randseed, m_lastBlock, m_deterministicTimeVector;
+};
+
+/// \brief  Maurer's Universal Statistical Test for Random Bit Generators
+/// \details This class implements Maurer's Universal Statistical Test for
+///  Random Bit Generators. It is intended for measuring the randomness of
+///  *PHYSICAL* RNGs.
+/// \details For more details see Maurer's paper in Journal of Cryptology, 1992.
+class MaurerRandomnessTest : public Bufferless<Sink>
+{
+public:
+	/// \brief Construct a MaurerRandomnessTest
+	MaurerRandomnessTest();
+
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+
+	/// \brief Provides the number of bytes of input is needed by the test
+	/// \return how many more bytes of input is needed by the test
+	// BytesNeeded() returns how many more bytes of input is needed by the test
+	// GetTestValue() should not be called before BytesNeeded()==0
+	unsigned int BytesNeeded() const {return n >= (Q+K) ? 0 : Q+K-n;}
+
+	// returns a number between 0.0 and 1.0, describing the quality of the
+	// random numbers entered
+	double GetTestValue() const;
+
+private:
+	enum {L=8, V=256, Q=2000, K=2000};
+	double sum;
+	unsigned int n;
+	unsigned int tab[V];
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rsa.cpp b/runtime/third_party/cryptopp/rsa.cpp
new file mode 100644
index 0000000..d6d9846
--- /dev/null
+++ b/runtime/third_party/cryptopp/rsa.cpp
@@ -0,0 +1,335 @@
+// rsa.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "rsa.h"
+#include "asn.h"
+#include "sha.h"
+#include "oids.h"
+#include "modarith.h"
+#include "nbtheory.h"
+#include "algparam.h"
+#include "fips140.h"
+#include "pkcspad.h"
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING) && !defined(CRYPTOPP_IS_DLL)
+#include "sha3.h"
+#include "pssr.h"
+NAMESPACE_BEGIN(CryptoPP)
+void RSA_TestInstantiations()
+{
+	RSASS<PKCS1v15, SHA1>::Verifier x1(1, 1);
+	RSASS<PKCS1v15, SHA1>::Signer x2(NullRNG(), 1);
+	RSASS<PKCS1v15, SHA1>::Verifier x3(x2);
+	RSASS<PKCS1v15, SHA1>::Verifier x4(x2.GetKey());
+	RSASS<PSS, SHA1>::Verifier x5(x3);
+#ifndef __MWERKS__
+	RSASS<PSSR, SHA1>::Signer x6 = x2;
+	x3 = x2;
+	x6 = x2;
+#endif
+	RSAES<PKCS1v15>::Encryptor x7(x2);
+#ifndef __GNUC__
+	RSAES<PKCS1v15>::Encryptor x8(x3);
+#endif
+	RSAES<OAEP<SHA1> >::Encryptor x9(x2);
+	x4 = x2.GetKey();
+
+	RSASS<PKCS1v15, SHA3_256>::Verifier x10(1, 1);
+	RSASS<PKCS1v15, SHA3_256>::Signer x11(NullRNG(), 1);
+	RSASS<PKCS1v15, SHA3_256>::Verifier x12(x11);
+	RSASS<PKCS1v15, SHA3_256>::Verifier x13(x11.GetKey());
+}
+NAMESPACE_END
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+
+NAMESPACE_BEGIN(CryptoPP)
+
+OID RSAFunction::GetAlgorithmID() const
+{
+	return ASN1::rsaEncryption();
+}
+
+void RSAFunction::BERDecodePublicKey(BufferedTransformation &bt, bool, size_t)
+{
+	BERSequenceDecoder seq(bt);
+		m_n.BERDecode(seq);
+		m_e.BERDecode(seq);
+	seq.MessageEnd();
+}
+
+void RSAFunction::DEREncodePublicKey(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+		m_n.DEREncode(seq);
+		m_e.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+Integer RSAFunction::ApplyFunction(const Integer &x) const
+{
+	DoQuickSanityCheck();
+	return a_exp_b_mod_c(x, m_e, m_n);
+}
+
+bool RSAFunction::Validate(RandomNumberGenerator& rng, unsigned int level) const
+{
+	CRYPTOPP_UNUSED(rng), CRYPTOPP_UNUSED(level);
+
+	bool pass = true;
+	pass = pass && m_n > Integer::One() && m_n.IsOdd();
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_e > Integer::One() && m_e.IsOdd() && m_e < m_n;
+	CRYPTOPP_ASSERT(pass);
+	return pass;
+}
+
+bool RSAFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_GET_FUNCTION_ENTRY(PublicExponent)
+		;
+}
+
+void RSAFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_SET_FUNCTION_ENTRY(PublicExponent)
+		;
+}
+
+// *****************************************************************************
+
+class RSAPrimeSelector : public PrimeSelector
+{
+public:
+	RSAPrimeSelector(const Integer &e) : m_e(e) {}
+	bool IsAcceptable(const Integer &candidate) const {return RelativelyPrime(m_e, candidate-Integer::One());}
+	Integer m_e;
+};
+
+void InvertibleRSAFunction::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg)
+{
+	int modulusSize = 2048;
+	alg.GetIntValue(Name::ModulusSize(), modulusSize) || alg.GetIntValue(Name::KeySize(), modulusSize);
+
+	CRYPTOPP_ASSERT(modulusSize >= 16);
+	if (modulusSize < 16)
+		throw InvalidArgument("InvertibleRSAFunction: specified modulus size is too small");
+
+	m_e = alg.GetValueWithDefault(Name::PublicExponent(), Integer(17));
+
+	CRYPTOPP_ASSERT(m_e >= 3); CRYPTOPP_ASSERT(!m_e.IsEven());
+	if (m_e < 3 || m_e.IsEven())
+		throw InvalidArgument("InvertibleRSAFunction: invalid public exponent");
+
+	// Do this in a loop for small moduli. For small moduli, u' == 0 when p == q.
+	// https://github.com/weidai11/cryptopp/issues/1136
+	do
+	{
+		RSAPrimeSelector selector(m_e);
+		AlgorithmParameters primeParam = MakeParametersForTwoPrimesOfEqualSize(modulusSize)
+			(Name::PointerToPrimeSelector(), selector.GetSelectorPointer());
+		m_p.GenerateRandom(rng, primeParam);
+		m_q.GenerateRandom(rng, primeParam);
+
+		m_d = m_e.InverseMod(LCM(m_p-1, m_q-1));
+		CRYPTOPP_ASSERT(m_d.IsPositive());
+
+		m_dp = m_d % (m_p-1);
+		m_dq = m_d % (m_q-1);
+		m_n = m_p * m_q;
+		m_u = m_q.InverseMod(m_p);
+	} while (m_u.IsZero());
+
+	if (FIPS_140_2_ComplianceEnabled())
+	{
+		RSASS<PKCS1v15, SHA1>::Signer signer(*this);
+		RSASS<PKCS1v15, SHA1>::Verifier verifier(signer);
+		SignaturePairwiseConsistencyTest_FIPS_140_Only(signer, verifier);
+
+		RSAES<OAEP<SHA1> >::Decryptor decryptor(*this);
+		RSAES<OAEP<SHA1> >::Encryptor encryptor(decryptor);
+		EncryptionPairwiseConsistencyTest_FIPS_140_Only(encryptor, decryptor);
+	}
+}
+
+void InvertibleRSAFunction::Initialize(RandomNumberGenerator &rng, unsigned int keybits, const Integer &e)
+{
+	GenerateRandom(rng, MakeParameters(Name::ModulusSize(), (int)keybits)(Name::PublicExponent(), e+e.IsEven()));
+}
+
+void InvertibleRSAFunction::Initialize(const Integer &n, const Integer &e, const Integer &d)
+{
+	if (n.IsEven() || e.IsEven() || d.IsEven())
+		throw InvalidArgument("InvertibleRSAFunction: input is not a valid RSA private key");
+
+	m_n = n;
+	m_e = e;
+	m_d = d;
+
+	Integer r = --(d*e);
+	unsigned int s = 0;
+	while (r.IsEven())
+	{
+		r >>= 1;
+		s++;
+	}
+
+	ModularArithmetic modn(n);
+	for (Integer i = 2; ; ++i)
+	{
+		Integer a = modn.Exponentiate(i, r);
+		if (a == 1)
+			continue;
+		Integer b;
+		unsigned int j = 0;
+		while (a != n-1)
+		{
+			b = modn.Square(a);
+			if (b == 1)
+			{
+				m_p = GCD(a-1, n);
+				m_q = n/m_p;
+				m_dp = m_d % (m_p-1);
+				m_dq = m_d % (m_q-1);
+				m_u = m_q.InverseMod(m_p);
+				return;
+			}
+			if (++j == s)
+				throw InvalidArgument("InvertibleRSAFunction: input is not a valid RSA private key");
+			a = b;
+		}
+	}
+}
+
+void InvertibleRSAFunction::BERDecodePrivateKey(BufferedTransformation &bt, bool, size_t)
+{
+	BERSequenceDecoder privateKey(bt);
+		word32 version;
+		BERDecodeUnsigned<word32>(privateKey, version, INTEGER, 0, 0);	// check version
+		m_n.BERDecode(privateKey);
+		m_e.BERDecode(privateKey);
+		m_d.BERDecode(privateKey);
+		m_p.BERDecode(privateKey);
+		m_q.BERDecode(privateKey);
+		m_dp.BERDecode(privateKey);
+		m_dq.BERDecode(privateKey);
+		m_u.BERDecode(privateKey);
+	privateKey.MessageEnd();
+}
+
+void InvertibleRSAFunction::DEREncodePrivateKey(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder privateKey(bt);
+		DEREncodeUnsigned<word32>(privateKey, 0);	// version
+		m_n.DEREncode(privateKey);
+		m_e.DEREncode(privateKey);
+		m_d.DEREncode(privateKey);
+		m_p.DEREncode(privateKey);
+		m_q.DEREncode(privateKey);
+		m_dp.DEREncode(privateKey);
+		m_dq.DEREncode(privateKey);
+		m_u.DEREncode(privateKey);
+	privateKey.MessageEnd();
+}
+
+Integer InvertibleRSAFunction::CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const
+{
+	DoQuickSanityCheck();
+	ModularArithmetic modn(m_n);
+	Integer r, rInv;
+	do {	// do this in a loop for people using small numbers for testing
+		r.Randomize(rng, Integer::One(), m_n - Integer::One());
+		rInv = modn.MultiplicativeInverse(r);
+	} while (rInv.IsZero());
+	Integer re = modn.Exponentiate(r, m_e);
+	re = modn.Multiply(re, x);			// blind
+	// here we follow the notation of PKCS #1 and let u=q inverse mod p
+	// but in ModRoot, u=p inverse mod q, so we reverse the order of p and q
+	Integer y = ModularRoot(re, m_dq, m_dp, m_q, m_p, m_u);
+	y = modn.Multiply(y, rInv);				// unblind
+	if (modn.Exponentiate(y, m_e) != x)		// check
+		throw Exception(Exception::OTHER_ERROR, "InvertibleRSAFunction: computational error during private key operation");
+	return y;
+}
+
+bool InvertibleRSAFunction::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+	bool pass = RSAFunction::Validate(rng, level);
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_p > Integer::One() && m_p.IsOdd() && m_p < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_q > Integer::One() && m_q.IsOdd() && m_q < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_d > Integer::One() && m_d.IsOdd() && m_d < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_dp > Integer::One() && m_dp.IsOdd() && m_dp < m_p;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_dq > Integer::One() && m_dq.IsOdd() && m_dq < m_q;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_u.IsPositive() && m_u < m_p;
+	CRYPTOPP_ASSERT(pass);
+	if (level >= 1)
+	{
+		pass = pass && m_p * m_q == m_n;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && m_e*m_d % LCM(m_p-1, m_q-1) == 1;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && m_dp == m_d%(m_p-1) && m_dq == m_d%(m_q-1);
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && m_u * m_q % m_p == 1;
+		CRYPTOPP_ASSERT(pass);
+	}
+	if (level >= 2)
+	{
+		pass = pass && VerifyPrime(rng, m_p, level-2) && VerifyPrime(rng, m_q, level-2);
+		CRYPTOPP_ASSERT(pass);
+	}
+	return pass;
+}
+
+bool InvertibleRSAFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper<RSAFunction>(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime2)
+		CRYPTOPP_GET_FUNCTION_ENTRY(PrivateExponent)
+		CRYPTOPP_GET_FUNCTION_ENTRY(ModPrime1PrivateExponent)
+		CRYPTOPP_GET_FUNCTION_ENTRY(ModPrime2PrivateExponent)
+		CRYPTOPP_GET_FUNCTION_ENTRY(MultiplicativeInverseOfPrime2ModPrime1)
+		;
+}
+
+void InvertibleRSAFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper<RSAFunction>(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime2)
+		CRYPTOPP_SET_FUNCTION_ENTRY(PrivateExponent)
+		CRYPTOPP_SET_FUNCTION_ENTRY(ModPrime1PrivateExponent)
+		CRYPTOPP_SET_FUNCTION_ENTRY(ModPrime2PrivateExponent)
+		CRYPTOPP_SET_FUNCTION_ENTRY(MultiplicativeInverseOfPrime2ModPrime1)
+		;
+}
+
+// *****************************************************************************
+
+Integer RSAFunction_ISO::ApplyFunction(const Integer &x) const
+{
+	Integer t = RSAFunction::ApplyFunction(x);
+	return t % 16 == 12 ? t : m_n - t;
+}
+
+Integer InvertibleRSAFunction_ISO::CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const
+{
+	Integer t = InvertibleRSAFunction::CalculateInverse(rng, x);
+	return STDMIN(t, m_n-t);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rsa.h b/runtime/third_party/cryptopp/rsa.h
new file mode 100644
index 0000000..1d45fb6
--- /dev/null
+++ b/runtime/third_party/cryptopp/rsa.h
@@ -0,0 +1,288 @@
+// rsa.h - originally written and placed in the public domain by Wei Dai
+
+/// \file rsa.h
+/// \brief Classes for the RSA cryptosystem
+/// \details This file contains classes that implement the RSA
+///   ciphers and signature schemes as defined in PKCS #1 v2.0.
+
+#ifndef CRYPTOPP_RSA_H
+#define CRYPTOPP_RSA_H
+
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "integer.h"
+#include "pkcspad.h"
+#include "oaep.h"
+#include "emsa2.h"
+#include "asn.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief RSA trapdoor function using the public key
+/// \since Crypto++ 1.0
+class CRYPTOPP_DLL RSAFunction : public TrapdoorFunction, public X509PublicKey
+{
+	typedef RSAFunction ThisClass;
+
+public:
+	/// \brief Initialize a RSA public key
+	/// \param n the modulus
+	/// \param e the public exponent
+	void Initialize(const Integer &n, const Integer &e)
+		{m_n = n; m_e = e;}
+
+	// X509PublicKey
+	OID GetAlgorithmID() const;
+	void BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
+	void DEREncodePublicKey(BufferedTransformation &bt) const;
+
+	// CryptoMaterial
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+
+	// TrapdoorFunction
+	Integer ApplyFunction(const Integer &x) const;
+	Integer PreimageBound() const {return m_n;}
+	Integer ImageBound() const {return m_n;}
+
+	// non-derived
+	const Integer & GetModulus() const {return m_n;}
+	const Integer & GetPublicExponent() const {return m_e;}
+
+	void SetModulus(const Integer &n) {m_n = n;}
+	void SetPublicExponent(const Integer &e) {m_e = e;}
+
+protected:
+	Integer m_n, m_e;
+};
+
+/// \brief RSA trapdoor function using the private key
+/// \since Crypto++ 1.0
+class CRYPTOPP_DLL InvertibleRSAFunction : public RSAFunction, public TrapdoorFunctionInverse, public PKCS8PrivateKey
+{
+	typedef InvertibleRSAFunction ThisClass;
+
+public:
+	/// \brief Create a RSA private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param modulusBits the size of the modulus, in bits
+	/// \param e the desired public exponent
+	/// \details Initialize() creates a new keypair using a public exponent of 17.
+	/// \details This function overload of Initialize() creates a new private key because it
+	///   takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+	///   then use one of the other Initialize() overloads.
+	void Initialize(RandomNumberGenerator &rng, unsigned int modulusBits, const Integer &e = 17);
+
+	/// \brief Initialize a RSA private key
+	/// \param n modulus
+	/// \param e public exponent
+	/// \param d private exponent
+	/// \param p first prime factor
+	/// \param q second prime factor
+	/// \param dp d mod p
+	/// \param dq d mod q
+	/// \param u q<sup>-1</sup> mod p
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	void Initialize(const Integer &n, const Integer &e, const Integer &d, const Integer &p, const Integer &q, const Integer &dp, const Integer &dq, const Integer &u)
+		{m_n = n; m_e = e; m_d = d; m_p = p; m_q = q; m_dp = dp; m_dq = dq; m_u = u;}
+
+	/// \brief Initialize a RSA private key
+	/// \param n modulus
+	/// \param e public exponent
+	/// \param d private exponent
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	///   Initialize() will factor n using d and populate {p,q,dp,dq,u}.
+	void Initialize(const Integer &n, const Integer &e, const Integer &d);
+
+	// PKCS8PrivateKey
+	void BERDecode(BufferedTransformation &bt)
+		{PKCS8PrivateKey::BERDecode(bt);}
+	void DEREncode(BufferedTransformation &bt) const
+		{PKCS8PrivateKey::DEREncode(bt);}
+	void Load(BufferedTransformation &bt)
+		{PKCS8PrivateKey::BERDecode(bt);}
+	void Save(BufferedTransformation &bt) const
+		{PKCS8PrivateKey::DEREncode(bt);}
+	OID GetAlgorithmID() const {return RSAFunction::GetAlgorithmID();}
+	void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
+	void DEREncodePrivateKey(BufferedTransformation &bt) const;
+
+	// TrapdoorFunctionInverse
+	Integer CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const;
+
+	// GeneratableCryptoMaterial
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	// parameters: (ModulusSize, PublicExponent (default 17))
+	void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+
+	// non-derived interface
+	const Integer& GetPrime1() const {return m_p;}
+	const Integer& GetPrime2() const {return m_q;}
+	const Integer& GetPrivateExponent() const {return m_d;}
+	const Integer& GetModPrime1PrivateExponent() const {return m_dp;}
+	const Integer& GetModPrime2PrivateExponent() const {return m_dq;}
+	const Integer& GetMultiplicativeInverseOfPrime2ModPrime1() const {return m_u;}
+
+	void SetPrime1(const Integer &p) {m_p = p;}
+	void SetPrime2(const Integer &q) {m_q = q;}
+	void SetPrivateExponent(const Integer &d) {m_d = d;}
+	void SetModPrime1PrivateExponent(const Integer &dp) {m_dp = dp;}
+	void SetModPrime2PrivateExponent(const Integer &dq) {m_dq = dq;}
+	void SetMultiplicativeInverseOfPrime2ModPrime1(const Integer &u) {m_u = u;}
+
+protected:
+	Integer m_d, m_p, m_q, m_dp, m_dq, m_u;
+};
+
+/// \brief RSA trapdoor function using the public key
+/// \since Crypto++ 1.0
+class CRYPTOPP_DLL RSAFunction_ISO : public RSAFunction
+{
+public:
+	Integer ApplyFunction(const Integer &x) const;
+	Integer PreimageBound() const {return ++(m_n>>1);}
+};
+
+/// \brief RSA trapdoor function using the private key
+/// \since Crypto++ 1.0
+class CRYPTOPP_DLL InvertibleRSAFunction_ISO : public InvertibleRSAFunction
+{
+public:
+	Integer CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const;
+	Integer PreimageBound() const {return ++(m_n>>1);}
+};
+
+/// \brief RSA algorithm
+/// \since Crypto++ 1.0
+struct CRYPTOPP_DLL RSA
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "RSA";}
+	typedef RSAFunction PublicKey;
+	typedef InvertibleRSAFunction PrivateKey;
+};
+
+/// \brief RSA encryption algorithm
+/// \tparam STANDARD signature standard
+/// \sa <a href="http://www.weidai.com/scan-mirror/ca.html#RSA">RSA cryptosystem</a>
+/// \since Crypto++ 1.0
+template <class STANDARD>
+struct RSAES : public TF_ES<RSA, STANDARD>
+{
+};
+
+/// \brief RSA signature algorithm
+/// \tparam STANDARD signature standard
+/// \tparam H hash transformation
+/// \details See documentation of PKCS1v15 for a list of hash functions that can be used with it.
+/// \sa <a href="http://www.weidai.com/scan-mirror/sig.html#RSA">RSA signature scheme with appendix</a>
+/// \since Crypto++ 1.0
+template <class STANDARD, class H>
+struct RSASS : public TF_SS<RSA, STANDARD, H>
+{
+};
+
+/// \brief RSA algorithm
+/// \since Crypto++ 1.0
+struct CRYPTOPP_DLL RSA_ISO
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "RSA-ISO";}
+	typedef RSAFunction_ISO PublicKey;
+	typedef InvertibleRSAFunction_ISO PrivateKey;
+};
+
+/// \brief RSA signature algorithm
+/// \tparam H hash transformation
+/// \since Crypto++ 1.0
+template <class H>
+struct RSASS_ISO : public TF_SS<RSA_ISO, P1363_EMSA2, H>
+{
+};
+
+/// \brief \ref RSAES<STANDARD> "RSAES<PKCS1v15>::Decryptor" typedef
+/// \details RSA encryption scheme defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+DOCUMENTED_TYPEDEF(RSAES<PKCS1v15>::Decryptor, RSAES_PKCS1v15_Decryptor);
+/// \brief \ref RSAES<STANDARD> "RSAES<PKCS1v15>::Encryptor" typedef
+/// \details RSA encryption scheme defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+DOCUMENTED_TYPEDEF(RSAES<PKCS1v15>::Encryptor, RSAES_PKCS1v15_Encryptor);
+
+/// \brief \ref RSAES<STANDARD> "RSAES<OAEP<SHA1>>::Decryptor" typedef
+/// \details RSA encryption scheme defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+DOCUMENTED_TYPEDEF(RSAES<OAEP<SHA1> >::Decryptor, RSAES_OAEP_SHA_Decryptor);
+/// \brief \ref RSAES<STANDARD> "RSAES<OAEP<SHA1>>::Encryptor" typedef
+/// \details RSA encryption scheme defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+DOCUMENTED_TYPEDEF(RSAES<OAEP<SHA1> >::Encryptor, RSAES_OAEP_SHA_Encryptor);
+
+/// \brief \ref RSAES<STANDARD> "RSAES<OAEP<SHA256>>::Decryptor" typedef
+/// \details RSA encryption scheme defined in PKCS #1 v2.0
+/// \since Crypto++ 8.8
+DOCUMENTED_TYPEDEF(RSAES<OAEP<SHA256> >::Decryptor, RSAES_OAEP_SHA256_Decryptor);
+/// \brief \ref RSAES<STANDARD> "RSAES<OAEP<SHA256>>::Encryptor" typedef
+/// \details RSA encryption scheme defined in PKCS #1 v2.0
+/// \since Crypto++ 8.8
+DOCUMENTED_TYPEDEF(RSAES<OAEP<SHA256> >::Encryptor, RSAES_OAEP_SHA256_Encryptor);
+
+#ifdef CRYPTOPP_DOXYGEN_PROCESSING
+/// \brief \ref RSASS<STANDARD,HASH> "RSASS<PKCS1v15,SHA1>::Signer" typedef
+/// \details RSA signature schemes defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+class RSASSA_PKCS1v15_SHA_Signer : public RSASS<PKCS1v15,SHA1>::Signer {};
+/// \brief \ref RSASS<STANDARD,HASH> "RSASS<PKCS1v15,SHA1>::Verifier" typedef
+/// \details RSA signature schemes defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+class RSASSA_PKCS1v15_SHA_Verifier : public RSASS<PKCS1v15,SHA1>::Verifier {};
+
+/// \brief \ref RSASS<STANDARD,HASH> "RSASS<PKCS1v15,SHA256>::Signer" typedef
+/// \details RSA signature schemes defined in PKCS #1 v2.0
+/// \since Crypto++ 8.8
+class RSASSA_PKCS1v15_SHA256_Signer : public RSASS<PKCS1v15,SHA256>::Signer {};
+/// \brief \ref RSASS<STANDARD,HASH> "RSASS<PKCS1v15,SHA256>::Verifier" typedef
+/// \details RSA signature schemes defined in PKCS #1 v2.0
+/// \since Crypto++ 8.8
+class RSASSA_PKCS1v15_SHA256_Verifier : public RSASS<PKCS1v15,SHA256>::Verifier {};
+
+namespace Weak {
+
+/// \brief \ref RSASS<STANDARD,HASH> "RSASS<PKCS1v15, Weak::MD2>::Signer" typedef
+/// \details RSA signature schemes defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+class RSASSA_PKCS1v15_MD2_Signer : public RSASS<PKCS1v15, Weak1::MD2>::Signer {};
+/// \brief \ref RSASS<STANDARD,HASH> "RSASS<PKCS1v15, Weak::MD2>::Verifier" typedef
+/// \details RSA signature schemes defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+class RSASSA_PKCS1v15_MD2_Verifier : public RSASS<PKCS1v15, Weak1::MD2>::Verifier {};
+
+/// \brief \ref RSASS<STANDARD,HASH> "RSASS<PKCS1v15, Weak::MD5>::Signer" typedef
+/// \details RSA signature schemes defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+class RSASSA_PKCS1v15_MD5_Signer : public RSASS<PKCS1v15, Weak1::MD5>::Signer {};
+/// \brief \ref RSASS<STANDARD,HASH> "RSASS<PKCS1v15, Weak::MD5>::Verifier" typedef
+/// \details RSA signature schemes defined in PKCS #1 v2.0
+/// \since Crypto++ 1.0
+class RSASSA_PKCS1v15_MD5_Verifier : public RSASS<PKCS1v15, Weak1::MD5>::Verifier {};
+}
+
+#else
+typedef RSASS<PKCS1v15,SHA1>::Signer RSASSA_PKCS1v15_SHA_Signer;
+typedef RSASS<PKCS1v15,SHA1>::Verifier RSASSA_PKCS1v15_SHA_Verifier;
+
+typedef RSASS<PKCS1v15,SHA256>::Signer RSASSA_PKCS1v15_SHA256_Signer;
+typedef RSASS<PKCS1v15,SHA256>::Verifier RSASSA_PKCS1v15_SHA256_Verifier;
+
+namespace Weak {
+	typedef RSASS<PKCS1v15, Weak1::MD2>::Signer RSASSA_PKCS1v15_MD2_Signer;
+	typedef RSASS<PKCS1v15, Weak1::MD2>::Verifier RSASSA_PKCS1v15_MD2_Verifier;
+	typedef RSASS<PKCS1v15, Weak1::MD5>::Signer RSASSA_PKCS1v15_MD5_Signer;
+	typedef RSASS<PKCS1v15, Weak1::MD5>::Verifier RSASSA_PKCS1v15_MD5_Verifier;
+}
+#endif // CRYPTOPP_DOXYGEN_PROCESSING
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rw.cpp b/runtime/third_party/cryptopp/rw.cpp
new file mode 100644
index 0000000..23a92ab
--- /dev/null
+++ b/runtime/third_party/cryptopp/rw.cpp
@@ -0,0 +1,314 @@
+// rw.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#include "rw.h"
+#include "asn.h"
+#include "integer.h"
+#include "nbtheory.h"
+#include "modarith.h"
+#include "asn.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#if defined(_OPENMP)
+# define CRYPTOPP_RW_USE_OMP 1
+#else
+# define CRYPTOPP_RW_USE_OMP 0
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void RWFunction::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	m_n.BERDecode(seq);
+	seq.MessageEnd();
+}
+
+void RWFunction::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+	m_n.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+Integer RWFunction::ApplyFunction(const Integer &in) const
+{
+	DoQuickSanityCheck();
+
+	Integer out = in.Squared()%m_n;
+	const word r = 12;
+	// this code was written to handle both r = 6 and r = 12,
+	// but now only r = 12 is used in P1363
+	const word r2 = r/2;
+	const word r3a = (16 + 5 - r) % 16;	// n%16 could be 5 or 13
+	const word r3b = (16 + 13 - r) % 16;
+	const word r4 = (8 + 5 - r/2) % 8;	// n%8 == 5
+	switch (out % 16)
+	{
+	case r:
+		break;
+	case r2:
+	case r2+8:
+		out <<= 1;
+		break;
+	case r3a:
+	case r3b:
+		out.Negate();
+		out += m_n;
+		break;
+	case r4:
+	case r4+8:
+		out.Negate();
+		out += m_n;
+		out <<= 1;
+		break;
+	default:
+		out = Integer::Zero();
+	}
+	return out;
+}
+
+bool RWFunction::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+	CRYPTOPP_UNUSED(rng), CRYPTOPP_UNUSED(level);
+	bool pass = true;
+	pass = pass && m_n > Integer::One() && m_n%8 == 5;
+	CRYPTOPP_ASSERT(pass);
+	return pass;
+}
+
+bool RWFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Modulus)
+		;
+}
+
+void RWFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Modulus)
+		;
+}
+
+// *****************************************************************************
+// private key operations:
+
+// generate a random private key
+void InvertibleRWFunction::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg)
+{
+	int modulusSize = 2048;
+	alg.GetIntValue("ModulusSize", modulusSize) || alg.GetIntValue("KeySize", modulusSize);
+
+	if (modulusSize < 16)
+		throw InvalidArgument("InvertibleRWFunction: specified modulus length is too small");
+
+	AlgorithmParameters primeParam = MakeParametersForTwoPrimesOfEqualSize(modulusSize);
+	m_p.GenerateRandom(rng, CombinedNameValuePairs(primeParam, MakeParameters("EquivalentTo", 3)("Mod", 8)));
+	m_q.GenerateRandom(rng, CombinedNameValuePairs(primeParam, MakeParameters("EquivalentTo", 7)("Mod", 8)));
+
+	m_n = m_p * m_q;
+	m_u = m_q.InverseMod(m_p);
+
+	Precompute();
+}
+
+void InvertibleRWFunction::Initialize(const Integer &n, const Integer &p, const Integer &q, const Integer &u)
+{
+	m_n = n; m_p = p; m_q = q; m_u = u;
+
+	Precompute();
+}
+
+void InvertibleRWFunction::PrecomputeTweakedRoots() const
+{
+	ModularArithmetic modp(m_p), modq(m_q);
+
+	// GCC warning bug, https://stackoverflow.com/q/12842306/608639
+#ifdef _OPENMP
+	#pragma omp parallel sections if(CRYPTOPP_RW_USE_OMP)
+	{
+		#pragma omp section
+			m_pre_2_9p = modp.Exponentiate(2, (9 * m_p - 11)/8);
+		#pragma omp section
+			m_pre_2_3q = modq.Exponentiate(2, (3 * m_q - 5)/8);
+		#pragma omp section
+			m_pre_q_p = modp.Exponentiate(m_q, m_p - 2);
+	}
+#else
+	m_pre_2_9p = modp.Exponentiate(2, (9 * m_p - 11)/8);
+	m_pre_2_3q = modq.Exponentiate(2, (3 * m_q - 5)/8);
+	m_pre_q_p = modp.Exponentiate(m_q, m_p - 2);
+#endif
+
+	m_precompute = true;
+}
+
+void InvertibleRWFunction::LoadPrecomputation(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	m_pre_2_9p.BERDecode(seq);
+	m_pre_2_3q.BERDecode(seq);
+	m_pre_q_p.BERDecode(seq);
+	seq.MessageEnd();
+
+	m_precompute = true;
+}
+
+void InvertibleRWFunction::SavePrecomputation(BufferedTransformation &bt) const
+{
+	if(!m_precompute)
+		Precompute();
+
+	DERSequenceEncoder seq(bt);
+	m_pre_2_9p.DEREncode(seq);
+	m_pre_2_3q.DEREncode(seq);
+	m_pre_q_p.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+void InvertibleRWFunction::BERDecode(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	m_n.BERDecode(seq);
+	m_p.BERDecode(seq);
+	m_q.BERDecode(seq);
+	m_u.BERDecode(seq);
+	seq.MessageEnd();
+
+	m_precompute = false;
+}
+
+void InvertibleRWFunction::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+	m_n.DEREncode(seq);
+	m_p.DEREncode(seq);
+	m_q.DEREncode(seq);
+	m_u.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+// DJB's "RSA signatures and Rabin-Williams signatures..." (http://cr.yp.to/sigs/rwsota-20080131.pdf).
+Integer InvertibleRWFunction::CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const
+{
+	DoQuickSanityCheck();
+
+	if(!m_precompute)
+		Precompute();
+
+	ModularArithmetic modn(m_n), modp(m_p), modq(m_q);
+	Integer r, rInv;
+
+	do
+	{
+		// Do this in a loop for people using small numbers for testing
+		r.Randomize(rng, Integer::One(), m_n - Integer::One());
+		// Fix for CVE-2015-2141. Thanks to Evgeny Sidorov for reporting.
+		// Squaring to satisfy Jacobi requirements suggested by Jean-Pierre Munch.
+		r = modn.Square(r);
+		rInv = modn.MultiplicativeInverse(r);
+	} while (rInv.IsZero());
+
+	Integer re = modn.Square(r);
+	re = modn.Multiply(re, x);    // blind
+
+	const Integer &h = re, &p = m_p, &q = m_q;
+	Integer e, f;
+
+	const Integer U = modq.Exponentiate(h, (q+1)/8);
+	if(((modq.Exponentiate(U, 4) - h) % q).IsZero())
+		e = Integer::One();
+	else
+		e = -1;
+
+	const Integer eh = e*h, V = modp.Exponentiate(eh, (p-3)/8);
+	if(((modp.Multiply(modp.Exponentiate(V, 4), modp.Exponentiate(eh, 2)) - eh) % p).IsZero())
+		f = Integer::One();
+	else
+		f = 2;
+
+#ifdef _OPENMP
+	Integer W, X;
+	#pragma omp parallel sections if(CRYPTOPP_RW_USE_OMP)
+	{
+		#pragma omp section
+		{
+			W = (f.IsUnit() ? U : modq.Multiply(m_pre_2_3q, U));
+		}
+		#pragma omp section
+		{
+			const Integer t = modp.Multiply(modp.Exponentiate(V, 3), eh);
+			X = (f.IsUnit() ? t : modp.Multiply(m_pre_2_9p, t));
+		}
+	}
+#else
+	const Integer W = (f.IsUnit() ? U : modq.Multiply(m_pre_2_3q, U));
+	const Integer t = modp.Multiply(modp.Exponentiate(V, 3), eh);
+	const Integer X = (f.IsUnit() ? t : modp.Multiply(m_pre_2_9p, t));
+#endif
+
+	const Integer Y = W + q * modp.Multiply(m_pre_q_p, (X - W));
+
+	// Signature
+	Integer s = modn.Multiply(modn.Square(Y), rInv);
+	CRYPTOPP_ASSERT((e * f * s.Squared()) % m_n == x);
+
+	// IEEE P1363, Section 8.2.8 IFSP-RW, p.44
+	s = STDMIN(s, m_n - s);
+	if (ApplyFunction(s) != x)                      // check
+		throw Exception(Exception::OTHER_ERROR, "InvertibleRWFunction: computational error during private key operation");
+
+	return s;
+}
+
+bool InvertibleRWFunction::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+	bool pass = RWFunction::Validate(rng, level);
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_p > Integer::One() && m_p%8 == 3 && m_p < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_q > Integer::One() && m_q%8 == 7 && m_q < m_n;
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_u.IsPositive() && m_u < m_p;
+	CRYPTOPP_ASSERT(pass);
+	if (level >= 1)
+	{
+		pass = pass && m_p * m_q == m_n;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && m_u * m_q % m_p == 1;
+		CRYPTOPP_ASSERT(pass);
+	}
+	if (level >= 2)
+	{
+		pass = pass && VerifyPrime(rng, m_p, level-2) && VerifyPrime(rng, m_q, level-2);
+		CRYPTOPP_ASSERT(pass);
+	}
+	return pass;
+}
+
+bool InvertibleRWFunction::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper<RWFunction>(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_GET_FUNCTION_ENTRY(Prime2)
+		CRYPTOPP_GET_FUNCTION_ENTRY(MultiplicativeInverseOfPrime2ModPrime1)
+		;
+}
+
+void InvertibleRWFunction::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper<RWFunction>(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime1)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Prime2)
+		CRYPTOPP_SET_FUNCTION_ENTRY(MultiplicativeInverseOfPrime2ModPrime1)
+		;
+
+	m_precompute = false;
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/rw.h b/runtime/third_party/cryptopp/rw.h
new file mode 100644
index 0000000..ca2cd30
--- /dev/null
+++ b/runtime/third_party/cryptopp/rw.h
@@ -0,0 +1,146 @@
+// rw.h - originally written and placed in the public domain by Wei Dai
+
+/// \file rw.h
+/// \brief Classes for Rabin-Williams signature scheme
+/// \details The implementation provides Rabin-Williams signature schemes as defined in
+///   IEEE P1363. It uses Bernstein's tweaked square roots in place of square roots to
+///   speedup calculations.
+/// \sa <A HREF="http://cr.yp.to/sigs/rwsota-20080131.pdf">RSA signatures and Rabin–Williams
+///   signatures: the state of the art (20080131)</A>, Section 6, <em>The tweaks e and f</em>.
+/// \since Crypto++ 3.0
+
+#ifndef CRYPTOPP_RW_H
+#define CRYPTOPP_RW_H
+
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "integer.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Rabin-Williams trapdoor function using the public key
+/// \since Crypto++ 3.0, Tweaked roots using <em>e</em> and <em>f</em> since Crypto++ 5.6.4
+class CRYPTOPP_DLL RWFunction : public TrapdoorFunction, public PublicKey
+{
+	typedef RWFunction ThisClass;
+
+public:
+
+	/// \brief Initialize a Rabin-Williams public key
+	/// \param n the modulus
+	void Initialize(const Integer &n)
+		{m_n = n;}
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	void Save(BufferedTransformation &bt) const
+		{DEREncode(bt);}
+	void Load(BufferedTransformation &bt)
+		{BERDecode(bt);}
+
+	Integer ApplyFunction(const Integer &x) const;
+	Integer PreimageBound() const {return ++(m_n>>1);}
+	Integer ImageBound() const {return m_n;}
+
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+
+	const Integer& GetModulus() const {return m_n;}
+	void SetModulus(const Integer &n) {m_n = n;}
+
+protected:
+	Integer m_n;
+};
+
+/// \brief Rabin-Williams trapdoor function using the private key
+/// \since Crypto++ 3.0, Tweaked roots using <em>e</em> and <em>f</em> since Crypto++ 5.6.4
+class CRYPTOPP_DLL InvertibleRWFunction : public RWFunction, public TrapdoorFunctionInverse, public PrivateKey
+{
+	typedef InvertibleRWFunction ThisClass;
+
+public:
+	/// \brief Construct an InvertibleRWFunction
+	InvertibleRWFunction() : m_precompute(false) {}
+
+	/// \brief Initialize a Rabin-Williams private key
+	/// \param n modulus
+	/// \param p first prime factor
+	/// \param q second prime factor
+	/// \param u q<sup>-1</sup> mod p
+	/// \details This Initialize() function overload initializes a private key from existing parameters.
+	void Initialize(const Integer &n, const Integer &p, const Integer &q, const Integer &u);
+
+	/// \brief Create a Rabin-Williams private key
+	/// \param rng a RandomNumberGenerator derived class
+	/// \param modulusBits the size of the modulus, in bits
+	/// \details This function overload of Initialize() creates a new private key because it
+	///   takes a RandomNumberGenerator() as a parameter. If you have an existing keypair,
+	///   then use one of the other Initialize() overloads.
+	void Initialize(RandomNumberGenerator &rng, unsigned int modulusBits)
+		{GenerateRandomWithKeySize(rng, modulusBits);}
+
+	void BERDecode(BufferedTransformation &bt);
+	void DEREncode(BufferedTransformation &bt) const;
+
+	void Save(BufferedTransformation &bt) const
+		{DEREncode(bt);}
+	void Load(BufferedTransformation &bt)
+		{BERDecode(bt);}
+
+	Integer CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const;
+
+	// GeneratibleCryptoMaterial
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+	/*! parameters: (ModulusSize) */
+	void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
+
+	const Integer& GetPrime1() const {return m_p;}
+	const Integer& GetPrime2() const {return m_q;}
+	const Integer& GetMultiplicativeInverseOfPrime2ModPrime1() const {return m_u;}
+
+	void SetPrime1(const Integer &p) {m_p = p;}
+	void SetPrime2(const Integer &q) {m_q = q;}
+	void SetMultiplicativeInverseOfPrime2ModPrime1(const Integer &u) {m_u = u;}
+
+	virtual bool SupportsPrecomputation() const {return true;}
+	virtual void Precompute(unsigned int unused = 0) {CRYPTOPP_UNUSED(unused); PrecomputeTweakedRoots();}
+	virtual void Precompute(unsigned int unused = 0) const {CRYPTOPP_UNUSED(unused); PrecomputeTweakedRoots();}
+
+	virtual void LoadPrecomputation(BufferedTransformation &storedPrecomputation);
+	virtual void SavePrecomputation(BufferedTransformation &storedPrecomputation) const;
+
+protected:
+	void PrecomputeTweakedRoots() const;
+
+protected:
+	Integer m_p, m_q, m_u;
+
+	mutable Integer m_pre_2_9p, m_pre_2_3q, m_pre_q_p;
+	mutable bool m_precompute;
+};
+
+/// \brief Rabin-Williams keys
+/// \since Crypto++ 3.0
+struct RW
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "RW";}
+	typedef RWFunction PublicKey;
+	typedef InvertibleRWFunction PrivateKey;
+};
+
+/// \brief Rabin-Williams signature scheme
+/// \tparam STANDARD signature standard
+/// \tparam H hash transformation
+/// \since Crypto++ 3.0
+template <class STANDARD, class H>
+struct RWSS : public TF_SS<RW, STANDARD, H>
+{
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/safer.cpp b/runtime/third_party/cryptopp/safer.cpp
new file mode 100644
index 0000000..38c9a29
--- /dev/null
+++ b/runtime/third_party/cryptopp/safer.cpp
@@ -0,0 +1,157 @@
+// safer.cpp - modified by by Wei Dai from Richard De Moliner's safer.c
+
+#include "pch.h"
+#include "safer.h"
+#include "misc.h"
+#include "argnames.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4244)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const byte SAFER::Base::exp_tab[256] =
+	{1, 45, 226, 147, 190, 69, 21, 174, 120, 3, 135, 164, 184, 56, 207, 63,
+	8, 103, 9, 148, 235, 38, 168, 107, 189, 24, 52, 27, 187, 191, 114, 247,
+	64, 53, 72, 156, 81, 47, 59, 85, 227, 192, 159, 216, 211, 243, 141, 177,
+	255, 167, 62, 220, 134, 119, 215, 166, 17, 251, 244, 186, 146, 145, 100, 131,
+	241, 51, 239, 218, 44, 181, 178, 43, 136, 209, 153, 203, 140, 132, 29, 20,
+	129, 151, 113, 202, 95, 163, 139, 87, 60, 130, 196, 82, 92, 28, 232, 160,
+	4, 180, 133, 74, 246, 19, 84, 182, 223, 12, 26, 142, 222, 224, 57, 252,
+	32, 155, 36, 78, 169, 152, 158, 171, 242, 96, 208, 108, 234, 250, 199, 217,
+	0, 212, 31, 110, 67, 188, 236, 83, 137, 254, 122, 93, 73, 201, 50, 194,
+	249, 154, 248, 109, 22, 219, 89, 150, 68, 233, 205, 230, 70, 66, 143, 10,
+	193, 204, 185, 101, 176, 210, 198, 172, 30, 65, 98, 41, 46, 14, 116, 80,
+	2, 90, 195, 37, 123, 138, 42, 91, 240, 6, 13, 71, 111, 112, 157, 126,
+	16, 206, 18, 39, 213, 76, 79, 214, 121, 48, 104, 54, 117, 125, 228, 237,
+	128, 106, 144, 55, 162, 94, 118, 170, 197, 127, 61, 175, 165, 229, 25, 97,
+	253, 77, 124, 183, 11, 238, 173, 75, 34, 245, 231, 115, 35, 33, 200, 5,
+	225, 102, 221, 179, 88, 105, 99, 86, 15, 161, 49, 149, 23, 7, 58, 40};
+
+const byte SAFER::Base::log_tab[256] =
+	{128, 0, 176, 9, 96, 239, 185, 253, 16, 18, 159, 228, 105, 186, 173, 248,
+	192, 56, 194, 101, 79, 6, 148, 252, 25, 222, 106, 27, 93, 78, 168, 130,
+	112, 237, 232, 236, 114, 179, 21, 195, 255, 171, 182, 71, 68, 1, 172, 37,
+	201, 250, 142, 65, 26, 33, 203, 211, 13, 110, 254, 38, 88, 218, 50, 15,
+	32, 169, 157, 132, 152, 5, 156, 187, 34, 140, 99, 231, 197, 225, 115, 198,
+	175, 36, 91, 135, 102, 39, 247, 87, 244, 150, 177, 183, 92, 139, 213, 84,
+	121, 223, 170, 246, 62, 163, 241, 17, 202, 245, 209, 23, 123, 147, 131, 188,
+	189, 82, 30, 235, 174, 204, 214, 53, 8, 200, 138, 180, 226, 205, 191, 217,
+	208, 80, 89, 63, 77, 98, 52, 10, 72, 136, 181, 86, 76, 46, 107, 158,
+	210, 61, 60, 3, 19, 251, 151, 81, 117, 74, 145, 113, 35, 190, 118, 42,
+	95, 249, 212, 85, 11, 220, 55, 49, 22, 116, 215, 119, 167, 230, 7, 219,
+	164, 47, 70, 243, 97, 69, 103, 227, 12, 162, 59, 28, 133, 24, 4, 29,
+	41, 160, 143, 178, 90, 216, 166, 126, 238, 141, 83, 75, 161, 154, 193, 14,
+	122, 73, 165, 44, 129, 196, 199, 54, 43, 127, 67, 149, 51, 242, 108, 104,
+	109, 240, 2, 40, 206, 221, 155, 234, 94, 153, 124, 20, 134, 207, 229, 66,
+	184, 64, 120, 45, 58, 233, 100, 31, 146, 144, 125, 57, 111, 224, 137, 48};
+
+#define EXP(x)       exp_tab[(x)]
+#define LOG(x)       log_tab[(x)]
+#define PHT(x, y)    { y += x; x += y; }
+#define IPHT(x, y)   { x -= y; y -= x; }
+
+static const unsigned int BLOCKSIZE = 8;
+static const unsigned int MAX_ROUNDS = 13;
+
+void SAFER::Base::UncheckedSetKey(const byte *userkey_1, unsigned int length, const NameValuePairs &params)
+{
+	bool strengthened = Strengthened();
+	unsigned int nof_rounds = params.GetIntValueWithDefault(Name::Rounds(), length == 8 ? (strengthened ? 8 : 6) : 10);
+
+	const byte *userkey_2 = length == 8 ? userkey_1 : userkey_1 + 8;
+	keySchedule.New(1 + BLOCKSIZE * (1 + 2 * nof_rounds));
+
+	unsigned int i, j;
+	byte *key = keySchedule;
+	SecByteBlock ka(BLOCKSIZE + 1), kb(BLOCKSIZE + 1);
+
+	if (MAX_ROUNDS < nof_rounds)
+		nof_rounds = MAX_ROUNDS;
+	*key++ = (unsigned char)nof_rounds;
+	ka[BLOCKSIZE] = 0;
+	kb[BLOCKSIZE] = 0;
+	for (j = 0; j < BLOCKSIZE; j++)
+	{
+		ka[BLOCKSIZE] ^= ka[j] = rotlConstant<5>(userkey_1[j]);
+		kb[BLOCKSIZE] ^= kb[j] = *key++ = userkey_2[j];
+	}
+
+	for (i = 1; i <= nof_rounds; i++)
+	{
+		for (j = 0; j < BLOCKSIZE + 1; j++)
+		{
+			ka[j] = rotlConstant<6>(ka[j]);
+			kb[j] = rotlConstant<6>(kb[j]);
+		}
+		for (j = 0; j < BLOCKSIZE; j++)
+			if (strengthened)
+				*key++ = (ka[(j + 2 * i - 1) % (BLOCKSIZE + 1)]
+								+ exp_tab[exp_tab[18 * i + j + 1]]) & 0xFF;
+			else
+				*key++ = (ka[j] + exp_tab[exp_tab[18 * i + j + 1]]) & 0xFF;
+		for (j = 0; j < BLOCKSIZE; j++)
+			if (strengthened)
+				*key++ = (kb[(j + 2 * i) % (BLOCKSIZE + 1)]
+								+ exp_tab[exp_tab[18 * i + j + 10]]) & 0xFF;
+			else
+				*key++ = (kb[j] + exp_tab[exp_tab[18 * i + j + 10]]) & 0xFF;
+	}
+}
+
+typedef BlockGetAndPut<byte, BigEndian> Block;
+
+void SAFER::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	byte a, b, c, d, e, f, g, h, t;
+	const byte *key = keySchedule+1;
+	unsigned int round = keySchedule[0];
+
+	Block::Get(inBlock)(a)(b)(c)(d)(e)(f)(g)(h);
+	while(round--)
+	{
+		a ^= key[0]; b += key[1]; c += key[2]; d ^= key[3];
+		e ^= key[4]; f += key[5]; g += key[6]; h ^= key[7];
+		a = EXP(a) + key[ 8]; b = LOG(b) ^ key[ 9];
+		c = LOG(c) ^ key[10]; d = EXP(d) + key[11];
+		e = EXP(e) + key[12]; f = LOG(f) ^ key[13];
+		g = LOG(g) ^ key[14]; h = EXP(h) + key[15];
+		key += 16;
+		PHT(a, b); PHT(c, d); PHT(e, f); PHT(g, h);
+		PHT(a, c); PHT(e, g); PHT(b, d); PHT(f, h);
+		PHT(a, e); PHT(b, f); PHT(c, g); PHT(d, h);
+		t = b; b = e; e = c; c = t; t = d; d = f; f = g; g = t;
+	}
+	a ^= key[0]; b += key[1]; c += key[2]; d ^= key[3];
+	e ^= key[4]; f += key[5]; g += key[6]; h ^= key[7];
+	Block::Put(xorBlock, outBlock)(a)(b)(c)(d)(e)(f)(g)(h);
+}
+
+void SAFER::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	byte a, b, c, d, e, f, g, h, t;
+	unsigned int round = keySchedule[0];
+	const byte *key = keySchedule + BLOCKSIZE * (1 + 2 * round) - 7;
+
+	Block::Get(inBlock)(a)(b)(c)(d)(e)(f)(g)(h);
+	h ^= key[7]; g -= key[6]; f -= key[5]; e ^= key[4];
+	d ^= key[3]; c -= key[2]; b -= key[1]; a ^= key[0];
+	while (round--)
+	{
+		key -= 16;
+		t = e; e = b; b = c; c = t; t = f; f = d; d = g; g = t;
+		IPHT(a, e); IPHT(b, f); IPHT(c, g); IPHT(d, h);
+		IPHT(a, c); IPHT(e, g); IPHT(b, d); IPHT(f, h);
+		IPHT(a, b); IPHT(c, d); IPHT(e, f); IPHT(g, h);
+		h -= key[15]; g ^= key[14]; f ^= key[13]; e -= key[12];
+		d -= key[11]; c ^= key[10]; b ^= key[9]; a -= key[8];
+		h = LOG(h) ^ key[7]; g = EXP(g) - key[6];
+		f = EXP(f) - key[5]; e = LOG(e) ^ key[4];
+		d = LOG(d) ^ key[3]; c = EXP(c) - key[2];
+		b = EXP(b) - key[1]; a = LOG(a) ^ key[0];
+	}
+	Block::Put(xorBlock, outBlock)(a)(b)(c)(d)(e)(f)(g)(h);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/safer.h b/runtime/third_party/cryptopp/safer.h
new file mode 100644
index 0000000..dacd8c3
--- /dev/null
+++ b/runtime/third_party/cryptopp/safer.h
@@ -0,0 +1,98 @@
+// safer.h - originally written and placed in the public domain by Wei Dai
+
+/// \file safer.h
+/// \brief Classes for the SAFER and SAFER-K block ciphers
+
+#ifndef CRYPTOPP_SAFER_H
+#define CRYPTOPP_SAFER_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SAFER block cipher
+class SAFER
+{
+public:
+	/// \brief SAFER block cipher default operation
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipher
+	{
+	public:
+		unsigned int OptimalDataAlignment() const {return 1;}
+		void UncheckedSetKey(const byte *userkey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		virtual bool Strengthened() const =0;
+
+		SecByteBlock keySchedule;
+		static const byte exp_tab[256];
+		static const byte log_tab[256];
+	};
+
+	/// \brief SAFER block cipher encryption operation
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief SAFER block cipher decryption operation
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+};
+
+/// \brief SAFER block cipher default implementation
+/// \tparam BASE SAFER::Enc or SAFER::Dec derived base class
+/// \tparam INFO SAFER_Info derived class
+/// \tparam STR flag indicating a strengthened implementation
+/// \details SAFER-K is not strengthened; while SAFER-SK is strengthened.
+template <class BASE, class INFO, bool STR>
+class CRYPTOPP_NO_VTABLE SAFER_Impl : public BlockCipherImpl<INFO, BASE>
+{
+protected:
+	bool Strengthened() const {return STR;}
+};
+
+/// \brief SAFER-K block cipher information
+struct SAFER_K_Info : public FixedBlockSize<8>, public VariableKeyLength<16, 8, 16, 8>, public VariableRounds<10, 1, 13>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "SAFER-K";}
+};
+
+/// \brief SAFER-K block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/SAFER-K">SAFER-K</a>
+class SAFER_K : public SAFER_K_Info, public SAFER, public BlockCipherDocumentation
+{
+public:
+	typedef BlockCipherFinal<ENCRYPTION, SAFER_Impl<Enc, SAFER_K_Info, false> > Encryption;
+	typedef BlockCipherFinal<DECRYPTION, SAFER_Impl<Dec, SAFER_K_Info, false> > Decryption;
+};
+
+/// \brief SAFER-SK block cipher information
+struct SAFER_SK_Info : public FixedBlockSize<8>, public VariableKeyLength<16, 8, 16, 8>, public VariableRounds<10, 1, 13>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "SAFER-SK";}
+};
+
+/// \brief SAFER-SK block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/SAFER-SK">SAFER-SK</a>
+class SAFER_SK : public SAFER_SK_Info, public SAFER, public BlockCipherDocumentation
+{
+public:
+	typedef BlockCipherFinal<ENCRYPTION, SAFER_Impl<Enc, SAFER_SK_Info, true> > Encryption;
+	typedef BlockCipherFinal<DECRYPTION, SAFER_Impl<Dec, SAFER_SK_Info, true> > Decryption;
+};
+
+typedef SAFER_K::Encryption SAFER_K_Encryption;
+typedef SAFER_K::Decryption SAFER_K_Decryption;
+
+typedef SAFER_SK::Encryption SAFER_SK_Encryption;
+typedef SAFER_SK::Decryption SAFER_SK_Decryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/salsa.cpp b/runtime/third_party/cryptopp/salsa.cpp
new file mode 100644
index 0000000..dc33dc3
--- /dev/null
+++ b/runtime/third_party/cryptopp/salsa.cpp
@@ -0,0 +1,759 @@
+// salsa.cpp - originally written and placed in the public domain by Wei Dai
+
+// use "cl /EP /P /DCRYPTOPP_GENERATE_X64_MASM salsa.cpp" to generate MASM code
+
+#include "pch.h"
+#include "config.h"
+
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#include "salsa.h"
+#include "argnames.h"
+#include "misc.h"
+#include "cpu.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4702 4740)
+#endif
+
+// Clang due to "Inline assembly operands don't work with .intel_syntax"
+//   https://llvm.org/bugs/show_bug.cgi?id=24232
+#if defined(CRYPTOPP_DISABLE_SALSA_ASM)
+# undef CRYPTOPP_X86_ASM_AVAILABLE
+# undef CRYPTOPP_X32_ASM_AVAILABLE
+# undef CRYPTOPP_X64_ASM_AVAILABLE
+# undef CRYPTOPP_SSE2_ASM_AVAILABLE
+# undef CRYPTOPP_SSSE3_ASM_AVAILABLE
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+// Can't use GetAlignmentOf<word32>() because of C++11 and constexpr
+// Can use 'const unsigned int' because of MSVC 2013
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+# define ALIGN_SPEC 16
+#else
+# define ALIGN_SPEC 4
+#endif
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void Salsa20_TestInstantiations()
+{
+	Salsa20::Encryption x1;
+	XSalsa20::Encryption x2;
+}
+#endif
+
+void Salsa20_Core(word32* data, unsigned int rounds)
+{
+	CRYPTOPP_ASSERT(data != NULLPTR);
+	CRYPTOPP_ASSERT(rounds % 2 == 0);
+
+	CRYPTOPP_ALIGN_DATA(ALIGN_SPEC) word32 x[16];
+
+	for (size_t i = 0; i < 16; ++i)
+		x[i] = data[i];
+
+	// Rounds must be even
+	for (size_t i = 0; i < rounds; i += 2)
+	{
+		x[ 4] ^= rotlConstant< 7>(x[ 0]+x[12]);
+		x[ 8] ^= rotlConstant< 9>(x[ 4]+x[ 0]);
+		x[12] ^= rotlConstant<13>(x[ 8]+x[ 4]);
+		x[ 0] ^= rotlConstant<18>(x[12]+x[ 8]);
+
+		x[ 9] ^= rotlConstant< 7>(x[ 5]+x[ 1]);
+		x[13] ^= rotlConstant< 9>(x[ 9]+x[ 5]);
+		x[ 1] ^= rotlConstant<13>(x[13]+x[ 9]);
+		x[ 5] ^= rotlConstant<18>(x[ 1]+x[13]);
+
+		x[14] ^= rotlConstant< 7>(x[10]+x[ 6]);
+		x[ 2] ^= rotlConstant< 9>(x[14]+x[10]);
+		x[ 6] ^= rotlConstant<13>(x[ 2]+x[14]);
+		x[10] ^= rotlConstant<18>(x[ 6]+x[ 2]);
+
+		x[ 3] ^= rotlConstant< 7>(x[15]+x[11]);
+		x[ 7] ^= rotlConstant< 9>(x[ 3]+x[15]);
+		x[11] ^= rotlConstant<13>(x[ 7]+x[ 3]);
+		x[15] ^= rotlConstant<18>(x[11]+x[ 7]);
+
+		x[ 1] ^= rotlConstant< 7>(x[ 0]+x[ 3]);
+		x[ 2] ^= rotlConstant< 9>(x[ 1]+x[ 0]);
+		x[ 3] ^= rotlConstant<13>(x[ 2]+x[ 1]);
+		x[ 0] ^= rotlConstant<18>(x[ 3]+x[ 2]);
+
+		x[ 6] ^= rotlConstant< 7>(x[ 5]+x[ 4]);
+		x[ 7] ^= rotlConstant< 9>(x[ 6]+x[ 5]);
+		x[ 4] ^= rotlConstant<13>(x[ 7]+x[ 6]);
+		x[ 5] ^= rotlConstant<18>(x[ 4]+x[ 7]);
+
+		x[11] ^= rotlConstant< 7>(x[10]+x[ 9]);
+		x[ 8] ^= rotlConstant< 9>(x[11]+x[10]);
+		x[ 9] ^= rotlConstant<13>(x[ 8]+x[11]);
+		x[10] ^= rotlConstant<18>(x[ 9]+x[ 8]);
+
+		x[12] ^= rotlConstant< 7>(x[15]+x[14]);
+		x[13] ^= rotlConstant< 9>(x[12]+x[15]);
+		x[14] ^= rotlConstant<13>(x[13]+x[12]);
+		x[15] ^= rotlConstant<18>(x[14]+x[13]);
+	}
+
+// OpenMP 4.0 released July 2013.
+#if _OPENMP >= 201307
+	#pragma omp simd
+	for (size_t i = 0; i < 16; ++i)
+		data[i] += x[i];
+#else
+	for (size_t i = 0; i < 16; ++i)
+		data[i] += x[i];
+#endif
+}
+
+std::string Salsa20_Policy::AlgorithmProvider() const
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE && !defined(CRYPTOPP_DISABLE_SALSA_ASM)
+	if (HasSSE2())
+		return "SSE2";
+#endif
+	return "C++";
+}
+
+void Salsa20_Policy::CipherSetKey(const NameValuePairs &params, const byte *key, size_t length)
+{
+	// Use previous rounds as the default value
+	int rounds = params.GetIntValueWithDefault(Name::Rounds(), m_rounds);
+	if (rounds != 20 && rounds != 12 && rounds != 8)
+		throw InvalidRounds(Salsa20::StaticAlgorithmName(), rounds);
+
+	// Latch a good value
+	m_rounds = rounds;
+
+	// m_state is reordered for SSE2
+	GetBlock<word32, LittleEndian> get1(key);
+	get1(m_state[13])(m_state[10])(m_state[7])(m_state[4]);
+	GetBlock<word32, LittleEndian> get2(key + length - 16);
+	get2(m_state[15])(m_state[12])(m_state[9])(m_state[6]);
+
+	// "expand 16-byte k" or "expand 32-byte k"
+	m_state[0] = 0x61707865;
+	m_state[1] = (length == 16) ? 0x3120646e : 0x3320646e;
+	m_state[2] = (length == 16) ? 0x79622d36 : 0x79622d32;
+	m_state[3] = 0x6b206574;
+}
+
+void Salsa20_Policy::CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(length==8);
+
+	GetBlock<word32, LittleEndian> get(IV);
+	get(m_state[14])(m_state[11]);
+	m_state[8] = m_state[5] = 0;
+}
+
+void Salsa20_Policy::SeekToIteration(lword iterationCount)
+{
+	m_state[8] = (word32)iterationCount;
+	m_state[5] = (word32)SafeRightShift<32>(iterationCount);
+}
+
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+unsigned int Salsa20_Policy::GetAlignment() const
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+	if (HasSSE2())
+		return 16;
+	else
+#endif
+		return GetAlignmentOf<word32>();
+}
+
+unsigned int Salsa20_Policy::GetOptimalBlockSize() const
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+	if (HasSSE2())
+		return 4*BYTES_PER_ITERATION;
+	else
+#endif
+		return BYTES_PER_ITERATION;
+}
+#endif
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+extern "C" {
+void Salsa20_OperateKeystream(byte *output, const byte *input, size_t iterationCount, int rounds, void *state);
+}
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4731)	// frame pointer register 'ebp' modified by inline assembly code
+#endif
+
+void Salsa20_Policy::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+#endif	// #ifdef CRYPTOPP_GENERATE_X64_MASM
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+	Salsa20_OperateKeystream(output, input, iterationCount, m_rounds, m_state.data());
+	return;
+#endif
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+		ALIGN   8
+	Salsa20_OperateKeystream	PROC FRAME
+		mov		r10, [rsp + 5*8]			; state
+		alloc_stack(10*16 + 32*16 + 8)
+		save_xmm128 xmm6, 0200h
+		save_xmm128 xmm7, 0210h
+		save_xmm128 xmm8, 0220h
+		save_xmm128 xmm9, 0230h
+		save_xmm128 xmm10, 0240h
+		save_xmm128 xmm11, 0250h
+		save_xmm128 xmm12, 0260h
+		save_xmm128 xmm13, 0270h
+		save_xmm128 xmm14, 0280h
+		save_xmm128 xmm15, 0290h
+		.endprolog
+
+	#define REG_output			rcx
+	#define REG_input			rdx
+	#define REG_iterationCount	r8
+	#define REG_state			r10
+	#define REG_rounds			e9d
+	#define REG_roundsLeft		eax
+	#define REG_temp32			r11d
+	#define REG_temp			r11
+	#define SSE2_WORKSPACE		rsp
+#else
+	if (HasSSE2())
+	{
+	#if CRYPTOPP_BOOL_X64
+		#define REG_output			%1
+		#define REG_input			%0
+		#define REG_iterationCount	%2
+		#define REG_state			%4		/* constant */
+		#define REG_rounds			%3		/* constant */
+		#define REG_roundsLeft		eax
+		#define REG_temp32			edx
+		#define REG_temp			rdx
+		#define SSE2_WORKSPACE		%5		/* constant */
+
+		CRYPTOPP_ALIGN_DATA(16) byte workspace[16*32];
+	#else
+		#define REG_output			edi
+		#define REG_input			eax
+		#define REG_iterationCount	ecx
+		#define REG_state			esi
+		#define REG_rounds			edx
+		#define REG_roundsLeft		ebx
+		#define REG_temp32			ebp
+		#define REG_temp			ebp
+		#define SSE2_WORKSPACE		esp + WORD_SZ
+	#endif
+
+	#ifdef __GNUC__
+		__asm__ __volatile__
+		(
+			INTEL_NOPREFIX
+			AS_PUSH_IF86(	bx)
+	#else
+		void *s = m_state.data();
+		word32 r = m_rounds;
+
+		AS2(	mov		REG_iterationCount, iterationCount)
+		AS2(	mov		REG_input, input)
+		AS2(	mov		REG_output, output)
+		AS2(	mov		REG_state, s)
+		AS2(	mov		REG_rounds, r)
+	#endif
+#endif	// #ifndef CRYPTOPP_GENERATE_X64_MASM
+
+		AS_PUSH_IF86(	bp)
+		AS2(	cmp		REG_iterationCount, 4)
+		ASJ(	jl,		5, f)
+
+#if CRYPTOPP_BOOL_X86
+		AS2(	mov		ebx, esp)
+		AS2(	and		esp, -16)
+		AS2(	sub		esp, 32*16)
+		AS1(	push	ebx)
+#endif
+
+#define SSE2_EXPAND_S(i, j)		\
+	ASS(	pshufd	xmm4, xmm##i, j, j, j, j)	\
+	AS2(	movdqa	[SSE2_WORKSPACE + (i*4+j)*16 + 256], xmm4)
+
+		AS2(	movdqa	xmm0, [REG_state + 0*16])
+		AS2(	movdqa	xmm1, [REG_state + 1*16])
+		AS2(	movdqa	xmm2, [REG_state + 2*16])
+		AS2(	movdqa	xmm3, [REG_state + 3*16])
+		SSE2_EXPAND_S(0, 0)
+		SSE2_EXPAND_S(0, 1)
+		SSE2_EXPAND_S(0, 2)
+		SSE2_EXPAND_S(0, 3)
+		SSE2_EXPAND_S(1, 0)
+		SSE2_EXPAND_S(1, 2)
+		SSE2_EXPAND_S(1, 3)
+		SSE2_EXPAND_S(2, 1)
+		SSE2_EXPAND_S(2, 2)
+		SSE2_EXPAND_S(2, 3)
+		SSE2_EXPAND_S(3, 0)
+		SSE2_EXPAND_S(3, 1)
+		SSE2_EXPAND_S(3, 2)
+		SSE2_EXPAND_S(3, 3)
+
+#define SSE2_EXPAND_S85(i)		\
+		AS2(	mov		dword ptr [SSE2_WORKSPACE + 8*16 + i*4 + 256], REG_roundsLeft)	\
+		AS2(	mov		dword ptr [SSE2_WORKSPACE + 5*16 + i*4 + 256], REG_temp32)	\
+		AS2(	add		REG_roundsLeft, 1)	\
+		AS2(	adc		REG_temp32, 0)
+
+		ASL(1)
+		AS2(	mov		REG_roundsLeft, dword ptr [REG_state + 8*4])
+		AS2(	mov		REG_temp32, dword ptr [REG_state + 5*4])
+		SSE2_EXPAND_S85(0)
+		SSE2_EXPAND_S85(1)
+		SSE2_EXPAND_S85(2)
+		SSE2_EXPAND_S85(3)
+		AS2(	mov		dword ptr [REG_state + 8*4], REG_roundsLeft)
+		AS2(	mov		dword ptr [REG_state + 5*4], REG_temp32)
+
+#ifdef __XOP__
+#define SSE2_QUARTER_ROUND(a, b, d, i)		\
+	AS2(	movdqa	xmm4, xmm##d)			\
+	AS2(	paddd	xmm4, xmm##a)			\
+	AS3(	vprotd	xmm4, xmm4, i)			\
+	AS2(	pxor	xmm##b, xmm4)
+#else
+#define SSE2_QUARTER_ROUND(a, b, d, i)		\
+	AS2(	movdqa	xmm4, xmm##d)			\
+	AS2(	paddd	xmm4, xmm##a)			\
+	AS2(	movdqa	xmm5, xmm4)				\
+	AS2(	pslld	xmm4, i)				\
+	AS2(	psrld	xmm5, 32-i)				\
+	AS2(	pxor	xmm##b, xmm4)			\
+	AS2(	pxor	xmm##b, xmm5)
+#endif
+
+#define L01(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	xmm##A, [SSE2_WORKSPACE + d*16 + i*256])	/* y3 */
+#define L02(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	xmm##C, [SSE2_WORKSPACE + a*16 + i*256])	/* y0 */
+#define L03(A,B,C,D,a,b,c,d,i)		AS2(	paddd	xmm##A, xmm##C)		/* y0+y3 */
+
+#ifdef __XOP__
+#define L04(A,B,C,D,a,b,c,d,i)
+#define L05(A,B,C,D,a,b,c,d,i)		AS3(	vprotd	xmm##A, xmm##A, 7)
+#define L06(A,B,C,D,a,b,c,d,i)
+#define L07(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, [SSE2_WORKSPACE + b*16 + i*256])
+#define L08(A,B,C,D,a,b,c,d,i)
+#else
+#define L04(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	xmm##B, xmm##A)
+#define L05(A,B,C,D,a,b,c,d,i)		AS2(	pslld	xmm##A, 7)
+#define L06(A,B,C,D,a,b,c,d,i)		AS2(	psrld	xmm##B, 32-7)
+#define L07(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, [SSE2_WORKSPACE + b*16 + i*256])
+#define L08(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, xmm##B)		/* z1 */
+#endif
+
+#define L09(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	[SSE2_WORKSPACE + b*16], xmm##A)
+#define L10(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	xmm##B, xmm##A)
+#define L11(A,B,C,D,a,b,c,d,i)		AS2(	paddd	xmm##A, xmm##C)		/* z1+y0 */
+
+#ifdef __XOP__
+#define L12(A,B,C,D,a,b,c,d,i)
+#define L13(A,B,C,D,a,b,c,d,i)		AS3(	vprotd	xmm##A, xmm##A, 9)
+#define L14(A,B,C,D,a,b,c,d,i)
+#define L15(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, [SSE2_WORKSPACE + c*16 + i*256])
+#define L16(A,B,C,D,a,b,c,d,i)
+#else
+#define L12(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	xmm##D, xmm##A)
+#define L13(A,B,C,D,a,b,c,d,i)		AS2(	pslld	xmm##A, 9)
+#define L14(A,B,C,D,a,b,c,d,i)		AS2(	psrld	xmm##D, 32-9)
+#define L15(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, [SSE2_WORKSPACE + c*16 + i*256])
+#define L16(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, xmm##D)		/* z2 */
+#endif
+
+#define L17(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	[SSE2_WORKSPACE + c*16], xmm##A)
+#define L18(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	xmm##D, xmm##A)
+#define L19(A,B,C,D,a,b,c,d,i)		AS2(	paddd	xmm##A, xmm##B)		/* z2+z1 */
+
+#ifdef __XOP__
+#define L20(A,B,C,D,a,b,c,d,i)
+#define L21(A,B,C,D,a,b,c,d,i)		AS3(	vprotd	xmm##A, xmm##A, 13)
+#define L22(A,B,C,D,a,b,c,d,i)
+#define L23(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, [SSE2_WORKSPACE + d*16 + i*256])
+#define L24(A,B,C,D,a,b,c,d,i)
+#else
+#define L20(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	xmm##B, xmm##A)
+#define L21(A,B,C,D,a,b,c,d,i)		AS2(	pslld	xmm##A, 13)
+#define L22(A,B,C,D,a,b,c,d,i)		AS2(	psrld	xmm##B, 32-13)
+#define L23(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, [SSE2_WORKSPACE + d*16 + i*256])
+#define L24(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, xmm##B)		/* z3 */
+#endif
+
+#define L25(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	[SSE2_WORKSPACE + d*16], xmm##A)
+#define L26(A,B,C,D,a,b,c,d,i)		AS2(	paddd	xmm##A, xmm##D)		/* z3+z2 */
+
+#ifdef __XOP__
+#define L27(A,B,C,D,a,b,c,d,i)
+#define L28(A,B,C,D,a,b,c,d,i)		AS3(	vprotd	xmm##A, xmm##A, 18)
+#define L29(A,B,C,D,a,b,c,d,i)
+#define L30(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, xmm##C)		/* xor y0 */
+#define L31(A,B,C,D,a,b,c,d,i)
+#else
+#define L27(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	xmm##D, xmm##A)
+#define L28(A,B,C,D,a,b,c,d,i)		AS2(	pslld	xmm##A, 18)
+#define L29(A,B,C,D,a,b,c,d,i)		AS2(	psrld	xmm##D, 32-18)
+#define L30(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, xmm##C)		/* xor y0 */
+#define L31(A,B,C,D,a,b,c,d,i)		AS2(	pxor	xmm##A, xmm##D)		/* z0 */
+#endif
+
+#define L32(A,B,C,D,a,b,c,d,i)		AS2(	movdqa	[SSE2_WORKSPACE + a*16], xmm##A)
+
+#define SSE2_QUARTER_ROUND_X8(i, a, b, c, d, e, f, g, h)	\
+	L01(0,1,2,3, a,b,c,d, i)	L01(4,5,6,7, e,f,g,h, i)	\
+	L02(0,1,2,3, a,b,c,d, i)	L02(4,5,6,7, e,f,g,h, i)	\
+	L03(0,1,2,3, a,b,c,d, i)	L03(4,5,6,7, e,f,g,h, i)	\
+	L04(0,1,2,3, a,b,c,d, i)	L04(4,5,6,7, e,f,g,h, i)	\
+	L05(0,1,2,3, a,b,c,d, i)	L05(4,5,6,7, e,f,g,h, i)	\
+	L06(0,1,2,3, a,b,c,d, i)	L06(4,5,6,7, e,f,g,h, i)	\
+	L07(0,1,2,3, a,b,c,d, i)	L07(4,5,6,7, e,f,g,h, i)	\
+	L08(0,1,2,3, a,b,c,d, i)	L08(4,5,6,7, e,f,g,h, i)	\
+	L09(0,1,2,3, a,b,c,d, i)	L09(4,5,6,7, e,f,g,h, i)	\
+	L10(0,1,2,3, a,b,c,d, i)	L10(4,5,6,7, e,f,g,h, i)	\
+	L11(0,1,2,3, a,b,c,d, i)	L11(4,5,6,7, e,f,g,h, i)	\
+	L12(0,1,2,3, a,b,c,d, i)	L12(4,5,6,7, e,f,g,h, i)	\
+	L13(0,1,2,3, a,b,c,d, i)	L13(4,5,6,7, e,f,g,h, i)	\
+	L14(0,1,2,3, a,b,c,d, i)	L14(4,5,6,7, e,f,g,h, i)	\
+	L15(0,1,2,3, a,b,c,d, i)	L15(4,5,6,7, e,f,g,h, i)	\
+	L16(0,1,2,3, a,b,c,d, i)	L16(4,5,6,7, e,f,g,h, i)	\
+	L17(0,1,2,3, a,b,c,d, i)	L17(4,5,6,7, e,f,g,h, i)	\
+	L18(0,1,2,3, a,b,c,d, i)	L18(4,5,6,7, e,f,g,h, i)	\
+	L19(0,1,2,3, a,b,c,d, i)	L19(4,5,6,7, e,f,g,h, i)	\
+	L20(0,1,2,3, a,b,c,d, i)	L20(4,5,6,7, e,f,g,h, i)	\
+	L21(0,1,2,3, a,b,c,d, i)	L21(4,5,6,7, e,f,g,h, i)	\
+	L22(0,1,2,3, a,b,c,d, i)	L22(4,5,6,7, e,f,g,h, i)	\
+	L23(0,1,2,3, a,b,c,d, i)	L23(4,5,6,7, e,f,g,h, i)	\
+	L24(0,1,2,3, a,b,c,d, i)	L24(4,5,6,7, e,f,g,h, i)	\
+	L25(0,1,2,3, a,b,c,d, i)	L25(4,5,6,7, e,f,g,h, i)	\
+	L26(0,1,2,3, a,b,c,d, i)	L26(4,5,6,7, e,f,g,h, i)	\
+	L27(0,1,2,3, a,b,c,d, i)	L27(4,5,6,7, e,f,g,h, i)	\
+	L28(0,1,2,3, a,b,c,d, i)	L28(4,5,6,7, e,f,g,h, i)	\
+	L29(0,1,2,3, a,b,c,d, i)	L29(4,5,6,7, e,f,g,h, i)	\
+	L30(0,1,2,3, a,b,c,d, i)	L30(4,5,6,7, e,f,g,h, i)	\
+	L31(0,1,2,3, a,b,c,d, i)	L31(4,5,6,7, e,f,g,h, i)	\
+	L32(0,1,2,3, a,b,c,d, i)	L32(4,5,6,7, e,f,g,h, i)
+
+#define SSE2_QUARTER_ROUND_X16(i, a, b, c, d, e, f, g, h, A, B, C, D, E, F, G, H)	\
+	L01(0,1,2,3, a,b,c,d, i)	L01(4,5,6,7, e,f,g,h, i)	L01(8,9,10,11, A,B,C,D, i)	L01(12,13,14,15, E,F,G,H, i)	\
+	L02(0,1,2,3, a,b,c,d, i)	L02(4,5,6,7, e,f,g,h, i)	L02(8,9,10,11, A,B,C,D, i)	L02(12,13,14,15, E,F,G,H, i)	\
+	L03(0,1,2,3, a,b,c,d, i)	L03(4,5,6,7, e,f,g,h, i)	L03(8,9,10,11, A,B,C,D, i)	L03(12,13,14,15, E,F,G,H, i)	\
+	L04(0,1,2,3, a,b,c,d, i)	L04(4,5,6,7, e,f,g,h, i)	L04(8,9,10,11, A,B,C,D, i)	L04(12,13,14,15, E,F,G,H, i)	\
+	L05(0,1,2,3, a,b,c,d, i)	L05(4,5,6,7, e,f,g,h, i)	L05(8,9,10,11, A,B,C,D, i)	L05(12,13,14,15, E,F,G,H, i)	\
+	L06(0,1,2,3, a,b,c,d, i)	L06(4,5,6,7, e,f,g,h, i)	L06(8,9,10,11, A,B,C,D, i)	L06(12,13,14,15, E,F,G,H, i)	\
+	L07(0,1,2,3, a,b,c,d, i)	L07(4,5,6,7, e,f,g,h, i)	L07(8,9,10,11, A,B,C,D, i)	L07(12,13,14,15, E,F,G,H, i)	\
+	L08(0,1,2,3, a,b,c,d, i)	L08(4,5,6,7, e,f,g,h, i)	L08(8,9,10,11, A,B,C,D, i)	L08(12,13,14,15, E,F,G,H, i)	\
+	L09(0,1,2,3, a,b,c,d, i)	L09(4,5,6,7, e,f,g,h, i)	L09(8,9,10,11, A,B,C,D, i)	L09(12,13,14,15, E,F,G,H, i)	\
+	L10(0,1,2,3, a,b,c,d, i)	L10(4,5,6,7, e,f,g,h, i)	L10(8,9,10,11, A,B,C,D, i)	L10(12,13,14,15, E,F,G,H, i)	\
+	L11(0,1,2,3, a,b,c,d, i)	L11(4,5,6,7, e,f,g,h, i)	L11(8,9,10,11, A,B,C,D, i)	L11(12,13,14,15, E,F,G,H, i)	\
+	L12(0,1,2,3, a,b,c,d, i)	L12(4,5,6,7, e,f,g,h, i)	L12(8,9,10,11, A,B,C,D, i)	L12(12,13,14,15, E,F,G,H, i)	\
+	L13(0,1,2,3, a,b,c,d, i)	L13(4,5,6,7, e,f,g,h, i)	L13(8,9,10,11, A,B,C,D, i)	L13(12,13,14,15, E,F,G,H, i)	\
+	L14(0,1,2,3, a,b,c,d, i)	L14(4,5,6,7, e,f,g,h, i)	L14(8,9,10,11, A,B,C,D, i)	L14(12,13,14,15, E,F,G,H, i)	\
+	L15(0,1,2,3, a,b,c,d, i)	L15(4,5,6,7, e,f,g,h, i)	L15(8,9,10,11, A,B,C,D, i)	L15(12,13,14,15, E,F,G,H, i)	\
+	L16(0,1,2,3, a,b,c,d, i)	L16(4,5,6,7, e,f,g,h, i)	L16(8,9,10,11, A,B,C,D, i)	L16(12,13,14,15, E,F,G,H, i)	\
+	L17(0,1,2,3, a,b,c,d, i)	L17(4,5,6,7, e,f,g,h, i)	L17(8,9,10,11, A,B,C,D, i)	L17(12,13,14,15, E,F,G,H, i)	\
+	L18(0,1,2,3, a,b,c,d, i)	L18(4,5,6,7, e,f,g,h, i)	L18(8,9,10,11, A,B,C,D, i)	L18(12,13,14,15, E,F,G,H, i)	\
+	L19(0,1,2,3, a,b,c,d, i)	L19(4,5,6,7, e,f,g,h, i)	L19(8,9,10,11, A,B,C,D, i)	L19(12,13,14,15, E,F,G,H, i)	\
+	L20(0,1,2,3, a,b,c,d, i)	L20(4,5,6,7, e,f,g,h, i)	L20(8,9,10,11, A,B,C,D, i)	L20(12,13,14,15, E,F,G,H, i)	\
+	L21(0,1,2,3, a,b,c,d, i)	L21(4,5,6,7, e,f,g,h, i)	L21(8,9,10,11, A,B,C,D, i)	L21(12,13,14,15, E,F,G,H, i)	\
+	L22(0,1,2,3, a,b,c,d, i)	L22(4,5,6,7, e,f,g,h, i)	L22(8,9,10,11, A,B,C,D, i)	L22(12,13,14,15, E,F,G,H, i)	\
+	L23(0,1,2,3, a,b,c,d, i)	L23(4,5,6,7, e,f,g,h, i)	L23(8,9,10,11, A,B,C,D, i)	L23(12,13,14,15, E,F,G,H, i)	\
+	L24(0,1,2,3, a,b,c,d, i)	L24(4,5,6,7, e,f,g,h, i)	L24(8,9,10,11, A,B,C,D, i)	L24(12,13,14,15, E,F,G,H, i)	\
+	L25(0,1,2,3, a,b,c,d, i)	L25(4,5,6,7, e,f,g,h, i)	L25(8,9,10,11, A,B,C,D, i)	L25(12,13,14,15, E,F,G,H, i)	\
+	L26(0,1,2,3, a,b,c,d, i)	L26(4,5,6,7, e,f,g,h, i)	L26(8,9,10,11, A,B,C,D, i)	L26(12,13,14,15, E,F,G,H, i)	\
+	L27(0,1,2,3, a,b,c,d, i)	L27(4,5,6,7, e,f,g,h, i)	L27(8,9,10,11, A,B,C,D, i)	L27(12,13,14,15, E,F,G,H, i)	\
+	L28(0,1,2,3, a,b,c,d, i)	L28(4,5,6,7, e,f,g,h, i)	L28(8,9,10,11, A,B,C,D, i)	L28(12,13,14,15, E,F,G,H, i)	\
+	L29(0,1,2,3, a,b,c,d, i)	L29(4,5,6,7, e,f,g,h, i)	L29(8,9,10,11, A,B,C,D, i)	L29(12,13,14,15, E,F,G,H, i)	\
+	L30(0,1,2,3, a,b,c,d, i)	L30(4,5,6,7, e,f,g,h, i)	L30(8,9,10,11, A,B,C,D, i)	L30(12,13,14,15, E,F,G,H, i)	\
+	L31(0,1,2,3, a,b,c,d, i)	L31(4,5,6,7, e,f,g,h, i)	L31(8,9,10,11, A,B,C,D, i)	L31(12,13,14,15, E,F,G,H, i)	\
+	L32(0,1,2,3, a,b,c,d, i)	L32(4,5,6,7, e,f,g,h, i)	L32(8,9,10,11, A,B,C,D, i)	L32(12,13,14,15, E,F,G,H, i)
+
+#if CRYPTOPP_BOOL_X64
+		SSE2_QUARTER_ROUND_X16(1, 0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15)
+#else
+		SSE2_QUARTER_ROUND_X8(1, 2, 6, 10, 14, 3, 7, 11, 15)
+		SSE2_QUARTER_ROUND_X8(1, 0, 4, 8, 12, 1, 5, 9, 13)
+#endif
+		AS2(	mov		REG_roundsLeft, REG_rounds)
+		ASJ(	jmp,	2, f)
+
+		ASL(SSE2_Salsa_Output)
+		AS2(	movdqa		xmm0, xmm4)
+		AS2(	punpckldq	xmm4, xmm5)
+		AS2(	movdqa		xmm1, xmm6)
+		AS2(	punpckldq	xmm6, xmm7)
+		AS2(	movdqa		xmm2, xmm4)
+		AS2(	punpcklqdq	xmm4, xmm6)	// e
+		AS2(	punpckhqdq	xmm2, xmm6)	// f
+		AS2(	punpckhdq	xmm0, xmm5)
+		AS2(	punpckhdq	xmm1, xmm7)
+		AS2(	movdqa		xmm6, xmm0)
+		AS2(	punpcklqdq	xmm0, xmm1)	// g
+		AS2(	punpckhqdq	xmm6, xmm1)	// h
+		AS_XMM_OUTPUT4(SSE2_Salsa_Output_A, REG_input, REG_output, 4, 2, 0, 6, 1, 0, 4, 8, 12, 1)
+		AS1(	ret)
+
+		ASL(6)
+#if CRYPTOPP_BOOL_X64
+		SSE2_QUARTER_ROUND_X16(0, 0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15)
+		ASL(2)
+		SSE2_QUARTER_ROUND_X16(0, 0, 13, 10, 7, 1, 14, 11, 4, 2, 15, 8, 5, 3, 12, 9, 6)
+#else
+		SSE2_QUARTER_ROUND_X8(0, 2, 6, 10, 14, 3, 7, 11, 15)
+		SSE2_QUARTER_ROUND_X8(0, 0, 4, 8, 12, 1, 5, 9, 13)
+		ASL(2)
+		SSE2_QUARTER_ROUND_X8(0, 2, 15, 8, 5, 3, 12, 9, 6)
+		SSE2_QUARTER_ROUND_X8(0, 0, 13, 10, 7, 1, 14, 11, 4)
+#endif
+		AS2(	sub		REG_roundsLeft, 2)
+		ASJ(	jnz,	6, b)
+
+#define SSE2_OUTPUT_4(a, b, c, d)	\
+	AS2(	movdqa		xmm4, [SSE2_WORKSPACE + a*16 + 256])\
+	AS2(	paddd		xmm4, [SSE2_WORKSPACE + a*16])\
+	AS2(	movdqa		xmm5, [SSE2_WORKSPACE + b*16 + 256])\
+	AS2(	paddd		xmm5, [SSE2_WORKSPACE + b*16])\
+	AS2(	movdqa		xmm6, [SSE2_WORKSPACE + c*16 + 256])\
+	AS2(	paddd		xmm6, [SSE2_WORKSPACE + c*16])\
+	AS2(	movdqa		xmm7, [SSE2_WORKSPACE + d*16 + 256])\
+	AS2(	paddd		xmm7, [SSE2_WORKSPACE + d*16])\
+	ASC(	call,		SSE2_Salsa_Output)
+
+		SSE2_OUTPUT_4(0, 13, 10, 7)
+		SSE2_OUTPUT_4(4, 1, 14, 11)
+		SSE2_OUTPUT_4(8, 5, 2, 15)
+		SSE2_OUTPUT_4(12, 9, 6, 3)
+		AS2(	test	REG_input, REG_input)
+		ASJ(	jz,		9, f)
+		AS2(	add		REG_input, 12*16)
+		ASL(9)
+		AS2(	add		REG_output, 12*16)
+		AS2(	sub		REG_iterationCount, 4)
+		AS2(	cmp		REG_iterationCount, 4)
+		ASJ(	jge,	1, b)
+		AS_POP_IF86(	sp)
+
+		ASL(5)
+		AS2(	sub		REG_iterationCount, 1)
+		ASJ(	jl,		4, f)
+		AS2(	movdqa	xmm0, [REG_state + 0*16])
+		AS2(	movdqa	xmm1, [REG_state + 1*16])
+		AS2(	movdqa	xmm2, [REG_state + 2*16])
+		AS2(	movdqa	xmm3, [REG_state + 3*16])
+		AS2(	mov		REG_roundsLeft, REG_rounds)
+
+		ASL(0)
+		SSE2_QUARTER_ROUND(0, 1, 3, 7)
+		SSE2_QUARTER_ROUND(1, 2, 0, 9)
+		SSE2_QUARTER_ROUND(2, 3, 1, 13)
+		SSE2_QUARTER_ROUND(3, 0, 2, 18)
+		ASS(	pshufd	xmm1, xmm1, 2, 1, 0, 3)
+		ASS(	pshufd	xmm2, xmm2, 1, 0, 3, 2)
+		ASS(	pshufd	xmm3, xmm3, 0, 3, 2, 1)
+		SSE2_QUARTER_ROUND(0, 3, 1, 7)
+		SSE2_QUARTER_ROUND(3, 2, 0, 9)
+		SSE2_QUARTER_ROUND(2, 1, 3, 13)
+		SSE2_QUARTER_ROUND(1, 0, 2, 18)
+		ASS(	pshufd	xmm1, xmm1, 0, 3, 2, 1)
+		ASS(	pshufd	xmm2, xmm2, 1, 0, 3, 2)
+		ASS(	pshufd	xmm3, xmm3, 2, 1, 0, 3)
+		AS2(	sub		REG_roundsLeft, 2)
+		ASJ(	jnz,	0, b)
+
+		AS2(	paddd	xmm0, [REG_state + 0*16])
+		AS2(	paddd	xmm1, [REG_state + 1*16])
+		AS2(	paddd	xmm2, [REG_state + 2*16])
+		AS2(	paddd	xmm3, [REG_state + 3*16])
+
+		AS2(	add		dword ptr [REG_state + 8*4], 1)
+		AS2(	adc		dword ptr [REG_state + 5*4], 0)
+
+		AS2(	pcmpeqb	xmm6, xmm6)			// all ones
+		AS2(	psrlq	xmm6, 32)			// lo32 mask
+		ASS(	pshufd	xmm7, xmm6, 0, 1, 2, 3)		// hi32 mask
+		AS2(	movdqa	xmm4, xmm0)
+		AS2(	movdqa	xmm5, xmm3)
+		AS2(	pand	xmm0, xmm7)
+		AS2(	pand	xmm4, xmm6)
+		AS2(	pand	xmm3, xmm6)
+		AS2(	pand	xmm5, xmm7)
+		AS2(	por		xmm4, xmm5)			// 0,13,2,15
+		AS2(	movdqa	xmm5, xmm1)
+		AS2(	pand	xmm1, xmm7)
+		AS2(	pand	xmm5, xmm6)
+		AS2(	por		xmm0, xmm5)			// 4,1,6,3
+		AS2(	pand	xmm6, xmm2)
+		AS2(	pand	xmm2, xmm7)
+		AS2(	por		xmm1, xmm6)			// 8,5,10,7
+		AS2(	por		xmm2, xmm3)			// 12,9,14,11
+
+		AS2(	movdqa	xmm5, xmm4)
+		AS2(	movdqa	xmm6, xmm0)
+		AS3(	shufpd	xmm4, xmm1, 2)		// 0,13,10,7
+		AS3(	shufpd	xmm0, xmm2, 2)		// 4,1,14,11
+		AS3(	shufpd	xmm1, xmm5, 2)		// 8,5,2,15
+		AS3(	shufpd	xmm2, xmm6, 2)		// 12,9,6,3
+
+		// output keystream
+		AS_XMM_OUTPUT4(SSE2_Salsa_Output_B, REG_input, REG_output, 4, 0, 1, 2, 3, 0, 1, 2, 3, 4)
+		ASJ(	jmp,	5, b)
+		ASL(4)
+
+		AS_POP_IF86(	bp)
+#ifdef __GNUC__
+		AS_POP_IF86(	bx)
+		ATT_PREFIX
+	#if CRYPTOPP_BOOL_X64
+			: "+r" (input), "+r" (output), "+r" (iterationCount)
+			: "r" (m_rounds), "r" (m_state.begin()), "r" (workspace)
+			: "%eax", "%rdx", "memory", "cc", "%xmm0", "%xmm1", "%xmm2", "%xmm3", "%xmm4", "%xmm5", "%xmm6", "%xmm7", "%xmm8", "%xmm9", "%xmm10", "%xmm11", "%xmm12", "%xmm13", "%xmm14", "%xmm15"
+	#else
+			: "+a" (input), "+D" (output), "+c" (iterationCount)
+			: "d" (m_rounds), "S" (m_state.begin())
+			: "memory", "cc"
+	#endif
+		);
+#endif
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+	movdqa	xmm6, [rsp + 0200h]
+	movdqa	xmm7, [rsp + 0210h]
+	movdqa	xmm8, [rsp + 0220h]
+	movdqa	xmm9, [rsp + 0230h]
+	movdqa	xmm10, [rsp + 0240h]
+	movdqa	xmm11, [rsp + 0250h]
+	movdqa	xmm12, [rsp + 0260h]
+	movdqa	xmm13, [rsp + 0270h]
+	movdqa	xmm14, [rsp + 0280h]
+	movdqa	xmm15, [rsp + 0290h]
+	add		rsp, 10*16 + 32*16 + 8
+	ret
+Salsa20_OperateKeystream ENDP
+#else
+	}
+	else
+#endif
+#endif
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+	{
+		word32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+
+		while (iterationCount--)
+		{
+			x0 = m_state[0];	x1 = m_state[1];	x2 = m_state[2];	x3 = m_state[3];
+			x4 = m_state[4];	x5 = m_state[5];	x6 = m_state[6];	x7 = m_state[7];
+			x8 = m_state[8];	x9 = m_state[9];	x10 = m_state[10];	x11 = m_state[11];
+			x12 = m_state[12];	x13 = m_state[13];	x14 = m_state[14];	x15 = m_state[15];
+
+			for (int i=m_rounds; i>0; i-=2)
+			{
+				#define QUARTER_ROUND(a, b, c, d)	\
+					b = b ^ rotlConstant<7>(a + d);	\
+					c = c ^ rotlConstant<9>(b + a);	\
+					d = d ^ rotlConstant<13>(c + b);	\
+					a = a ^ rotlConstant<18>(d + c);
+
+				QUARTER_ROUND(x0, x4, x8, x12)
+				QUARTER_ROUND(x1, x5, x9, x13)
+				QUARTER_ROUND(x2, x6, x10, x14)
+				QUARTER_ROUND(x3, x7, x11, x15)
+
+				QUARTER_ROUND(x0, x13, x10, x7)
+				QUARTER_ROUND(x1, x14, x11, x4)
+				QUARTER_ROUND(x2, x15, x8, x5)
+				QUARTER_ROUND(x3, x12, x9, x6)
+			}
+
+#ifndef CRYPTOPP_DOXYGEN_PROCESSING
+			#define SALSA_OUTPUT(x)	{\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 0, x0 + m_state[0]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 1, x13 + m_state[13]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 2, x10 + m_state[10]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 3, x7 + m_state[7]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 4, x4 + m_state[4]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 5, x1 + m_state[1]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 6, x14 + m_state[14]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 7, x11 + m_state[11]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 8, x8 + m_state[8]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 9, x5 + m_state[5]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 10, x2 + m_state[2]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 11, x15 + m_state[15]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 12, x12 + m_state[12]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 13, x9 + m_state[9]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 14, x6 + m_state[6]);\
+				CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 15, x3 + m_state[3]);}
+
+			CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(SALSA_OUTPUT, BYTES_PER_ITERATION);
+			#undef SALSA_OUTPUT
+#endif
+
+			if (++m_state[8] == 0)
+				++m_state[5];
+		}
+	}
+}	// see comment above if an internal compiler error occurs here
+
+void XSalsa20_Policy::CipherSetKey(const NameValuePairs &params, const byte *key, size_t length)
+{
+	m_rounds = params.GetIntValueWithDefault(Name::Rounds(), m_rounds);
+	if (!(m_rounds == 8 || m_rounds == 12 || m_rounds == 20))
+		throw InvalidRounds(XSalsa20::StaticAlgorithmName(), m_rounds);
+
+	GetUserKey(LITTLE_ENDIAN_ORDER, m_key.begin(), m_key.size(), key, length);
+	if (length == 16)
+		std::memcpy(m_key.begin()+4, m_key.begin(), 16);
+
+	// "expand 32-byte k"
+	m_state[0] = 0x61707865;
+	m_state[1] = 0x3320646e;
+	m_state[2] = 0x79622d32;
+	m_state[3] = 0x6b206574;
+}
+
+void XSalsa20_Policy::CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(length==24);
+
+	word32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+
+	GetBlock<word32, LittleEndian> get(IV);
+	get(x14)(x11)(x8)(x5)(m_state[14])(m_state[11]);
+
+	x13 = m_key[0];		x10 = m_key[1];		x7 = m_key[2];		x4 = m_key[3];
+	x15 = m_key[4];		x12 = m_key[5];		x9 = m_key[6];		x6 = m_key[7];
+	x0 = m_state[0];	x1 = m_state[1];	x2 = m_state[2];	x3 = m_state[3];
+
+	for (int i=m_rounds; i>0; i-=2)
+	{
+		QUARTER_ROUND(x0, x4, x8, x12)
+		QUARTER_ROUND(x1, x5, x9, x13)
+		QUARTER_ROUND(x2, x6, x10, x14)
+		QUARTER_ROUND(x3, x7, x11, x15)
+
+		QUARTER_ROUND(x0, x13, x10, x7)
+		QUARTER_ROUND(x1, x14, x11, x4)
+		QUARTER_ROUND(x2, x15, x8, x5)
+		QUARTER_ROUND(x3, x12, x9, x6)
+	}
+
+	m_state[13] = x0;	m_state[10] = x1;	m_state[7] = x2;	m_state[4] = x3;
+	m_state[15] = x14;	m_state[12] = x11;	m_state[9] = x8;	m_state[6] = x5;
+	m_state[8] = m_state[5] = 0;
+}
+
+NAMESPACE_END
+
+#endif // #ifndef CRYPTOPP_GENERATE_X64_MASM
diff --git a/runtime/third_party/cryptopp/salsa.h b/runtime/third_party/cryptopp/salsa.h
new file mode 100644
index 0000000..40df15d
--- /dev/null
+++ b/runtime/third_party/cryptopp/salsa.h
@@ -0,0 +1,104 @@
+// salsa.h - originally written and placed in the public domain by Wei Dai
+
+/// \file salsa.h
+/// \brief Classes for Salsa and Salsa20 stream ciphers
+
+#ifndef CRYPTOPP_SALSA_H
+#define CRYPTOPP_SALSA_H
+
+#include "strciphr.h"
+#include "secblock.h"
+
+// Clang 3.3 integrated assembler crash on Linux. Clang 3.4 due to compiler
+// error with .intel_syntax, http://llvm.org/bugs/show_bug.cgi?id=24232
+#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+# define CRYPTOPP_DISABLE_SALSA_ASM 1
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Salsa20 core transform
+/// \param data the data to transform
+/// \param rounds the number of rounds
+/// \details Several algorithms, like CryptoBox and Scrypt, require access to
+///  the core Salsa20 transform. The current Crypto++ implementation does not
+///  lend itself to disgorging the Salsa20 cipher from the Salsa20 core transform.
+///  Instead Salsa20_Core is provided with customary accelerations.
+void Salsa20_Core(word32* data, unsigned int rounds);
+
+/// \brief Salsa20 stream cipher information
+/// \since Crypto++ 5.4
+struct Salsa20_Info : public VariableKeyLength<32, 16, 32, 16, SimpleKeyingInterface::UNIQUE_IV, 8>
+{
+	static std::string StaticAlgorithmName() {return "Salsa20";}
+};
+
+/// \brief Salsa20 stream cipher operation
+/// \since Crypto++ 5.4
+class CRYPTOPP_NO_VTABLE Salsa20_Policy : public AdditiveCipherConcretePolicy<word32, 16>
+{
+protected:
+	Salsa20_Policy() : m_rounds(ROUNDS) {}
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	void CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length);
+	bool CipherIsRandomAccess() const {return true;}
+	void SeekToIteration(lword iterationCount);
+
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+	unsigned int GetAlignment() const;
+	unsigned int GetOptimalBlockSize() const;
+#endif
+
+	std::string AlgorithmProvider() const;
+
+	CRYPTOPP_CONSTANT(ROUNDS = 20);  // Default rounds
+	FixedSizeAlignedSecBlock<word32, 16> m_state;
+	int m_rounds;
+};
+
+/// \brief Salsa20 stream cipher
+/// \details Salsa20 provides a variable number of rounds: 8, 12 or 20. The default number of rounds is 20.
+/// \sa <A HREF="https://cr.yp.to/snuffle/salsafamily-20071225.pdf">The Salsa20
+///  family of stream ciphers (20071225)</A>,
+///  <A HREF="https://cr.yp.to/snuffle.html">Snuffle 2005: the Salsa20 encryption
+///  function</A> and <A HREF="https://www.cryptopp.com/wiki/Salsa20">Salsa20</A>
+/// \since Crypto++ 5.4
+struct Salsa20 : public Salsa20_Info, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<Salsa20_Policy, AdditiveCipherTemplate<> >, Salsa20_Info> Encryption;
+	typedef Encryption Decryption;
+};
+
+/// \brief XSalsa20 stream cipher information
+/// \since Crypto++ 5.4
+struct XSalsa20_Info : public FixedKeyLength<32, SimpleKeyingInterface::UNIQUE_IV, 24>
+{
+	static std::string StaticAlgorithmName() {return "XSalsa20";}
+};
+
+/// \brief XSalsa20 stream cipher operation
+/// \since Crypto++ 5.4
+class CRYPTOPP_NO_VTABLE XSalsa20_Policy : public Salsa20_Policy
+{
+public:
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	void CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length);
+
+protected:
+	FixedSizeSecBlock<word32, 8> m_key;
+};
+
+/// \brief XSalsa20 stream cipher
+/// \details XSalsa20 provides a variable number of rounds: 8, 12 or 20. The default number of rounds is 20.
+/// \sa <a href="http://www.cryptolounge.org/wiki/XSalsa20">XSalsa20</a>
+/// \since Crypto++ 5.4
+struct XSalsa20 : public XSalsa20_Info, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<XSalsa20_Policy, AdditiveCipherTemplate<> >, XSalsa20_Info> Encryption;
+	typedef Encryption Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/scrypt.cpp b/runtime/third_party/cryptopp/scrypt.cpp
new file mode 100644
index 0000000..d9300c2
--- /dev/null
+++ b/runtime/third_party/cryptopp/scrypt.cpp
@@ -0,0 +1,329 @@
+// scrypt.cpp - written and placed in public domain by Jeffrey Walton.
+//              Based on reference source code by Colin Percival for
+//              Scrypt and Daniel Bernstein for Salsa20 core.
+
+#include "pch.h"
+
+#include "scrypt.h"
+#include "algparam.h"
+#include "argnames.h"
+#include "pwdbased.h"
+#include "stdcpp.h"
+#include "salsa.h"
+#include "misc.h"
+#include "sha.h"
+
+#include <sstream>
+#include <limits>
+
+#ifdef _OPENMP
+# include <omp.h>
+#endif
+
+// https://github.com/weidai11/cryptopp/issues/777
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# if defined(__clang__)
+#  pragma GCC diagnostic ignored "-Wtautological-compare"
+# elif defined(__GNUC__)
+#  pragma GCC diagnostic ignored "-Wtype-limits"
+# endif
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::GetWord;
+using CryptoPP::PutWord;
+using CryptoPP::Salsa20_Core;
+using CryptoPP::rotlConstant;
+using CryptoPP::LITTLE_ENDIAN_ORDER;
+using CryptoPP::AlignedSecByteBlock;
+
+inline void LE32ENC(byte* out, word32 in)
+{
+    PutWord(false, LITTLE_ENDIAN_ORDER, out, in);
+}
+
+inline word32 LE32DEC(const byte* in)
+{
+    return GetWord<word32>(false, LITTLE_ENDIAN_ORDER, in);
+}
+
+inline word64 LE64DEC(const byte* in)
+{
+    return GetWord<word64>(false, LITTLE_ENDIAN_ORDER, in);
+}
+
+inline void BlockCopy(byte* dest, byte* src, size_t len)
+{
+// OpenMP 4.0 released July 2013.
+#if _OPENMP >= 201307
+    #pragma omp simd
+    for (size_t i = 0; i < len; ++i)
+        dest[i] = src[i];
+#else
+    for (size_t i = 0; i < len; ++i)
+        dest[i] = src[i];
+#endif
+}
+
+inline void BlockXOR(byte* dest, byte* src, size_t len)
+{
+// OpenMP 4.0 released July 2013.
+#if _OPENMP >= 201307
+    #pragma omp simd
+    for (size_t i = 0; i < len; ++i)
+        dest[i] ^= src[i];
+#else
+    for (size_t i = 0; i < len; ++i)
+        dest[i] ^= src[i];
+#endif
+}
+
+inline void PBKDF2_SHA256(byte* buf, size_t dkLen,
+    const byte* passwd, size_t passwdlen,
+    const byte* salt, size_t saltlen, byte count)
+{
+    using CryptoPP::SHA256;
+    using CryptoPP::PKCS5_PBKDF2_HMAC;
+
+    PKCS5_PBKDF2_HMAC<SHA256> pbkdf;
+    pbkdf.DeriveKey(buf, dkLen, 0, passwd, passwdlen, salt, saltlen, count, 0.0f);
+}
+
+inline void Salsa20_8(byte B[64])
+{
+    word32 B32[16];
+
+    for (size_t i = 0; i < 16; ++i)
+        B32[i] = LE32DEC(&B[i * 4]);
+
+    Salsa20_Core(B32, 8);
+
+    for (size_t i = 0; i < 16; ++i)
+        LE32ENC(&B[4 * i], B32[i]);
+}
+
+inline void BlockMix(byte* B, byte* Y, size_t r)
+{
+    byte X[64];
+
+    // 1: X <-- B_{2r - 1}
+    BlockCopy(X, &B[(2 * r - 1) * 64], 64);
+
+    // 2: for i = 0 to 2r - 1 do
+    for (size_t i = 0; i < 2 * r; ++i)
+    {
+        // 3: X <-- H(X \xor B_i)
+        BlockXOR(X, &B[i * 64], 64);
+        Salsa20_8(X);
+
+        // 4: Y_i <-- X
+        BlockCopy(&Y[i * 64], X, 64);
+    }
+
+    // 6: B' <-- (Y_0, Y_2 ... Y_{2r-2}, Y_1, Y_3 ... Y_{2r-1})
+    for (size_t i = 0; i < r; ++i)
+        BlockCopy(&B[i * 64], &Y[(i * 2) * 64], 64);
+
+    for (size_t i = 0; i < r; ++i)
+        BlockCopy(&B[(i + r) * 64], &Y[(i * 2 + 1) * 64], 64);
+}
+
+inline word64 Integerify(byte* B, size_t r)
+{
+    byte* X = &B[(2 * r - 1) * 64];
+    return LE64DEC(X);
+}
+
+inline void Smix(byte* B, size_t r, word64 N, byte* V, byte* XY)
+{
+    byte* X = XY;
+    byte* Y = XY+128*r;
+
+    // 1: X <-- B
+    BlockCopy(X, B, 128 * r);
+
+    // 2: for i = 0 to N - 1 do
+    for (word64 i = 0; i < N; ++i)
+    {
+        // 3: V_i <-- X
+        BlockCopy(&V[i * (128 * r)], X, 128 * r);
+
+        // 4: X <-- H(X)
+        BlockMix(X, Y, r);
+    }
+
+    // 6: for i = 0 to N - 1 do
+    for (word64 i = 0; i < N; ++i)
+    {
+        // 7: j <-- Integerify(X) mod N
+        word64 j = Integerify(X, r) & (N - 1);
+
+        // 8: X <-- H(X \xor V_j)
+        BlockXOR(X, &V[j * (128 * r)], 128 * r);
+        BlockMix(X, Y, r);
+    }
+
+    // 10: B' <-- X
+    BlockCopy(B, X, 128 * r);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+size_t Scrypt::GetValidDerivedLength(size_t keylength) const
+{
+    if (keylength > MaxDerivedKeyLength())
+        return MaxDerivedKeyLength();
+    return keylength;
+}
+
+void Scrypt::ValidateParameters(size_t derivedLen, word64 cost, word64 blockSize, word64 parallelization) const
+{
+    // https://github.com/weidai11/cryptopp/issues/842
+    CRYPTOPP_ASSERT(derivedLen != 0);
+    CRYPTOPP_ASSERT(cost != 0);
+    CRYPTOPP_ASSERT(blockSize != 0);
+    CRYPTOPP_ASSERT(parallelization != 0);
+
+    if (cost == 0)
+        throw InvalidArgument("Scrypt: cost cannot be 0");
+
+    if (blockSize == 0)
+        throw InvalidArgument("Scrypt: block size cannot be 0");
+
+    if (parallelization == 0)
+        throw InvalidArgument("Scrypt: parallelization cannot be 0");
+
+    // Optimizer should remove this on 32-bit platforms
+    if ((std::numeric_limits<size_t>::max)() > (std::numeric_limits<word32>::max)())
+    {
+        const word64 maxLen = ((static_cast<word64>(1) << 32) - 1) * 32;
+        if (derivedLen > maxLen) {
+            std::ostringstream oss;
+            oss << "derivedLen " << derivedLen << " is larger than " << maxLen;
+            throw InvalidArgument("Scrypt: " + oss.str());
+        }
+    }
+
+    // https://github.com/weidai11/cryptopp/issues/787
+    CRYPTOPP_ASSERT(parallelization <= static_cast<word64>((std::numeric_limits<int>::max)()));
+    if (parallelization > static_cast<word64>((std::numeric_limits<int>::max)()))
+    {
+        std::ostringstream oss;
+        oss << " parallelization " << parallelization << " is larger than ";
+        oss << (std::numeric_limits<int>::max)();
+        throw InvalidArgument("Scrypt: " + oss.str());
+    }
+
+    CRYPTOPP_ASSERT(IsPowerOf2(cost));
+    if (IsPowerOf2(cost) == false)
+        throw InvalidArgument("Scrypt: cost must be a power of 2");
+
+    const word64 prod = static_cast<word64>(blockSize) * parallelization;
+    CRYPTOPP_ASSERT(prod < (1U << 30));
+
+    if (prod >= (1U << 30)) {
+        std::ostringstream oss;
+        oss << "r*p " << prod << " is larger than " << (1U << 30);
+        throw InvalidArgument("Scrypt: " + oss.str());
+    }
+
+    // Scrypt has several tests that effectively verify allocations like
+    // '128 * r * N' and '128 * r * p' do not overflow. They are the tests
+    // that set errno to ENOMEM. We can make the logic a little more clear
+    // using word128. At first blush the word128 may seem like  overkill.
+    // However, this algorithm is dominated by slow moving parts, so a
+    // one-time check is insignificant in the bigger picture.
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    const word128 maxElems = static_cast<word128>(SIZE_MAX);
+    bool  bLimit = (maxElems >= static_cast<word128>(cost) * blockSize * 128U);
+    bool xyLimit = (maxElems >= static_cast<word128>(parallelization) * blockSize * 128U);
+    bool  vLimit = (maxElems >= static_cast<word128>(blockSize) * 256U + 64U);
+#else
+    const word64 maxElems = static_cast<word64>(SIZE_MAX);
+    bool  bLimit = (blockSize < maxElems / 128U / cost);
+    bool xyLimit = (blockSize < maxElems / 128U / parallelization);
+    bool  vLimit = (blockSize < (maxElems - 64U) / 256U);
+#endif
+
+    CRYPTOPP_ASSERT(bLimit); CRYPTOPP_ASSERT(xyLimit); CRYPTOPP_ASSERT(vLimit);
+    if (!bLimit || !xyLimit || !vLimit)
+        throw std::bad_alloc();
+}
+
+size_t Scrypt::DeriveKey(byte*derived, size_t derivedLen,
+    const byte*secret, size_t secretLen, const NameValuePairs& params) const
+{
+    CRYPTOPP_ASSERT(secret /*&& secretLen*/);
+    CRYPTOPP_ASSERT(derived && derivedLen);
+    CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+
+    word64 cost=0, blockSize=0, parallelization=0;
+    if(params.GetValue("Cost", cost) == false)
+        cost = defaultCost;
+
+    if(params.GetValue("BlockSize", blockSize) == false)
+        blockSize = defaultBlockSize;
+
+    if(params.GetValue("Parallelization", parallelization) == false)
+        parallelization = defaultParallelization;
+
+    ConstByteArrayParameter salt;
+    (void)params.GetValue("Salt", salt);
+
+    return DeriveKey(derived, derivedLen, secret, secretLen, salt.begin(), salt.size(), cost, blockSize, parallelization);
+}
+
+size_t Scrypt::DeriveKey(byte*derived, size_t derivedLen, const byte*secret, size_t secretLen,
+    const byte*salt, size_t saltLen, word64 cost, word64 blockSize, word64 parallel) const
+{
+    CRYPTOPP_ASSERT(secret /*&& secretLen*/);
+    CRYPTOPP_ASSERT(derived && derivedLen);
+    CRYPTOPP_ASSERT(derivedLen <= MaxDerivedKeyLength());
+
+    ThrowIfInvalidDerivedKeyLength(derivedLen);
+    ValidateParameters(derivedLen, cost, blockSize, parallel);
+
+    AlignedSecByteBlock B(static_cast<size_t>(blockSize * parallel * 128U));
+
+    // 1: (B_0 ... B_{p-1}) <-- PBKDF2(P, S, 1, p * MFLen)
+    PBKDF2_SHA256(B, B.size(), secret, secretLen, salt, saltLen, 1);
+
+    // Visual Studio and OpenMP 2.0 fixup. We must use int, not size_t.
+    int maxParallel=0;
+    if (!SafeConvert(parallel, maxParallel))
+        maxParallel = (std::numeric_limits<int>::max)();
+
+    #ifdef _OPENMP
+    int threads = STDMIN(omp_get_max_threads(), maxParallel);
+    #endif
+
+    // http://stackoverflow.com/q/49604260/608639
+    #pragma omp parallel num_threads(threads)
+    {
+        // Each thread gets its own copy
+        AlignedSecByteBlock XY(static_cast<size_t>(blockSize * 256U));
+        AlignedSecByteBlock  V(static_cast<size_t>(blockSize * cost * 128U));
+
+        // 2: for i = 0 to p - 1 do
+        #pragma omp for
+        for (int i = 0; i < maxParallel; ++i)
+        {
+            // 3: B_i <-- MF(B_i, N)
+            const ptrdiff_t offset = static_cast<ptrdiff_t>(blockSize*i*128);
+            Smix(B+offset, static_cast<size_t>(blockSize), cost, V, XY);
+        }
+    }
+
+    // 5: DK <-- PBKDF2(P, B, 1, dkLen)
+    PBKDF2_SHA256(derived, derivedLen, secret, secretLen, B, B.size(), 1);
+
+    return 1;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/scrypt.h b/runtime/third_party/cryptopp/scrypt.h
new file mode 100644
index 0000000..a275e99
--- /dev/null
+++ b/runtime/third_party/cryptopp/scrypt.h
@@ -0,0 +1,103 @@
+// scrypt.h - written and placed in public domain by Jeffrey Walton.
+//            Based on reference source code by Colin Percival.
+
+/// \file scrypt.h
+/// \brief Classes for Scrypt from RFC 7914
+/// \sa <A HREF="https://www.tarsnap.com/scrypt/scrypt.pdf">Stronger Key Derivation via
+///   Sequential Memory-Hard Functions</a>,
+///   <A HREF="https://www.tarsnap.com/scrypt.html">The scrypt key derivation function</A>
+///   and <A HREF="https://tools.ietf.org/html/rfc7914">RFC 7914, The scrypt Password-Based
+///   Key Derivation Function</A>
+/// \since Crypto++ 7.0
+
+#ifndef CRYPTOPP_SCRYPT_H
+#define CRYPTOPP_SCRYPT_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Scrypt key derivation function
+/// \details The Crypto++ implementation uses OpenMP to accelerate the derivation when
+///   available.
+/// \details The Crypto++ implementation of Scrypt is limited by C++ datatypes. For
+///   example, the library is limited to a derived key length of <tt>SIZE_MAX</tt>,
+///   and not <tt>(2^32 - 1) * 32</tt>.
+/// \sa <A HREF="https://www.tarsnap.com/scrypt/scrypt.pdf">Stronger Key Derivation via
+///   Sequential Memory-Hard Functions</A>,
+///   <A HREF="https://www.tarsnap.com/scrypt.html">The scrypt key derivation function</A>
+///   and <A HREF="https://tools.ietf.org/html/rfc7914">RFC 7914, The scrypt Password-Based
+///   Key Derivation Function</A>
+/// \since Crypto++ 7.0
+class Scrypt : public KeyDerivationFunction
+{
+public:
+    virtual ~Scrypt() {}
+
+    static std::string StaticAlgorithmName () {
+        return "scrypt";
+    }
+
+    // KeyDerivationFunction interface
+    std::string AlgorithmName() const {
+        return StaticAlgorithmName();
+    }
+
+    // KeyDerivationFunction interface
+    size_t MaxDerivedKeyLength() const {
+        return static_cast<size_t>(0)-1;
+    }
+
+    // KeyDerivationFunction interface
+    size_t GetValidDerivedLength(size_t keylength) const;
+
+    // KeyDerivationFunction interface
+    size_t DeriveKey(byte *derived, size_t derivedLen, const byte *secret, size_t secretLen,
+        const NameValuePairs& params) const;
+
+    /// \brief Derive a key from a seed
+    /// \param derived the derived output buffer
+    /// \param derivedLen the size of the derived buffer, in bytes
+    /// \param secret the seed input buffer
+    /// \param secretLen the size of the secret buffer, in bytes
+    /// \param salt the salt input buffer
+    /// \param saltLen the size of the salt buffer, in bytes
+    /// \param cost the CPU/memory cost factor
+    /// \param blockSize the block size
+    /// \param parallelization the parallelization factor
+    /// \return the number of iterations performed
+    /// \throw InvalidDerivedKeyLength if <tt>derivedLen</tt> is invalid for the scheme
+    /// \details DeriveKey() provides a standard interface to derive a key from
+    ///   a seed and other parameters. Each class that derives from KeyDerivationFunction
+    ///   provides an overload that accepts most parameters used by the derivation function.
+    /// \details The CPU/Memory <tt>cost</tt> parameter ("N" in the documents) must be
+    ///   larger than 1, a power of 2, and less than <tt>2^(128 * r / 8)</tt>.
+    /// \details The parameter <tt>blockSize</tt> ("r" in the documents) specifies the block
+    ///   size.
+    /// \details The <tt>parallelization</tt> parameter ("p" in the documents) is a positive
+    ///   integer less than or equal to <tt>((2^32-1) * 32) / (128 * r)</tt>. Due to Microsoft
+    ///   and its OpenMP 2.0 implementation <tt>parallelization</tt> is limited to
+    ///   <tt>std::numeric_limits<int>::max()</tt>.
+    /// \details Scrypt always returns 1 because it only performs 1 iteration. Other
+    ///   derivation functions, like PBKDF's, will return more interesting values.
+    /// \details The Crypto++ implementation of Scrypt is limited by C++ datatypes. For
+    ///   example, the library is limited to a derived key length of <tt>SIZE_MAX</tt>,
+    ///   and not <tt>(2^32 - 1) * 32</tt>.
+    size_t DeriveKey(byte *derived, size_t derivedLen, const byte *secret, size_t secretLen,
+        const byte *salt, size_t saltLen, word64 cost=2, word64 blockSize=8, word64 parallelization=1) const;
+
+protected:
+    enum {defaultCost=2, defaultBlockSize=8, defaultParallelization=1};
+
+    // KeyDerivationFunction interface
+    const Algorithm & GetAlgorithm() const {
+        return *this;
+    }
+
+    inline void ValidateParameters(size_t derivedlen, word64 cost, word64 blockSize, word64 parallelization) const;
+};
+
+NAMESPACE_END
+
+#endif // CRYPTOPP_SCRYPT_H
diff --git a/runtime/third_party/cryptopp/seal.cpp b/runtime/third_party/cryptopp/seal.cpp
new file mode 100644
index 0000000..7ed108b
--- /dev/null
+++ b/runtime/third_party/cryptopp/seal.cpp
@@ -0,0 +1,222 @@
+// seal.cpp - originally written and placed in the public domain by Wei Dai
+// updated to SEAL 3.0 by Leonard Janke
+
+#include "pch.h"
+
+#include "seal.h"
+#include "cpu.h"
+#include "sha.h"
+#include "misc.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void SEAL_TestInstantiations()
+{
+	SEAL<>::Encryption x;
+}
+#endif
+
+struct SEAL_Gamma
+{
+	SEAL_Gamma(const byte *key)
+		: H(5), Z(5), D(16), lastIndex(0xffffffff)
+	{
+		GetUserKey(BIG_ENDIAN_ORDER, H.begin(), 5, key, 20);
+		std::memset(D, 0, 64);
+	}
+
+	word32 Apply(word32 i);
+
+	SecBlock<word32> H, Z, D;
+	word32 lastIndex;
+};
+
+word32 SEAL_Gamma::Apply(word32 i)
+{
+	word32 shaIndex = i/5;
+	if (shaIndex != lastIndex)
+	{
+		std::memcpy(Z, H, 20);
+		D[0] = shaIndex;
+		SHA1::Transform(Z, D);
+		lastIndex = shaIndex;
+	}
+
+	return Z[i%5];
+}
+
+template <class B>
+void SEAL_Policy<B>::CipherSetKey(const NameValuePairs &params, const byte *key, size_t length)
+{
+	CRYPTOPP_UNUSED(length);
+	m_insideCounter = m_outsideCounter = m_startCount = 0;
+
+	unsigned int L = params.GetIntValueWithDefault("NumberOfOutputBitsPerPositionIndex", 32*1024);
+	m_iterationsPerCount = L / 8192;
+
+	SEAL_Gamma gamma(key);
+	unsigned int i;
+
+	for (i=0; i<512; i++)
+		m_T[i] = gamma.Apply(i);
+
+	for (i=0; i<256; i++)
+		m_S[i] = gamma.Apply(0x1000+i);
+
+	m_R.New(4*(L/8192));
+
+	for (i=0; i<m_R.size(); i++)
+		m_R[i] = gamma.Apply(0x2000+i);
+}
+
+template <class B>
+void SEAL_Policy<B>::CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(IV), CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(length==4);
+
+	m_outsideCounter = IV ? GetWord<word32>(false, BIG_ENDIAN_ORDER, IV) : 0;
+	m_startCount = m_outsideCounter;
+	m_insideCounter = 0;
+}
+
+template <class B>
+void SEAL_Policy<B>::SeekToIteration(lword iterationCount)
+{
+	m_outsideCounter = m_startCount + (unsigned int)(iterationCount / m_iterationsPerCount);
+	m_insideCounter = (unsigned int)(iterationCount % m_iterationsPerCount);
+}
+
+template <class B>
+void SEAL_Policy<B>::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+	word32 a, b, c, d, n1, n2, n3, n4;
+	unsigned int p, q;
+
+	CRYPTOPP_ASSERT(IsAlignedOn(m_T.begin(),GetAlignmentOf<word32>()));
+	for (size_t iteration = 0; iteration < iterationCount; ++iteration)
+	{
+		#define Ttab(x) *(word32 *)(void*)((byte *)m_T.begin()+x)
+
+		a = m_outsideCounter ^ m_R[4*m_insideCounter];
+		b = rotrConstant<8>(m_outsideCounter) ^ m_R[4*m_insideCounter+1];
+		c = rotrConstant<16>(m_outsideCounter) ^ m_R[4 * m_insideCounter + 2];
+		d = rotrConstant<24>(m_outsideCounter) ^ m_R[4 * m_insideCounter + 3];
+
+		for (unsigned int j=0; j<2; j++)
+		{
+			p = a & 0x7fc;
+			b += Ttab(p);
+			a = rotrConstant<9>(a);
+
+			p = b & 0x7fc;
+			c += Ttab(p);
+			b = rotrConstant<9>(b);
+
+			p = c & 0x7fc;
+			d += Ttab(p);
+			c = rotrConstant<9>(c);
+
+			p = d & 0x7fc;
+			a += Ttab(p);
+			d = rotrConstant<9>(d);
+		}
+
+		n1 = d, n2 = b, n3 = a, n4 = c;
+
+		p = a & 0x7fc;
+		b += Ttab(p);
+		a = rotrConstant<9>(a);
+
+		p = b & 0x7fc;
+		c += Ttab(p);
+		b = rotrConstant<9>(b);
+
+		p = c & 0x7fc;
+		d += Ttab(p);
+		c = rotrConstant<9>(c);
+
+		p = d & 0x7fc;
+		a += Ttab(p);
+		d = rotrConstant<9>(d);
+
+		// generate 8192 bits
+		for (unsigned int i=0; i<64; i++)
+		{
+			p = a & 0x7fc;
+			a = rotrConstant<9>(a);
+			b += Ttab(p);
+			b ^= a;
+
+			q = b & 0x7fc;
+			b = rotrConstant<9>(b);
+			c ^= Ttab(q);
+			c += b;
+
+			p = (p+c) & 0x7fc;
+			c = rotrConstant<9>(c);
+			d += Ttab(p);
+			d ^= c;
+
+			q = (q+d) & 0x7fc;
+			d = rotrConstant<9>(d);
+			a ^= Ttab(q);
+			a += d;
+
+			p = (p+a) & 0x7fc;
+			b ^= Ttab(p);
+			a = rotrConstant<9>(a);
+
+			q = (q+b) & 0x7fc;
+			c += Ttab(q);
+			b = rotrConstant<9>(b);
+
+			p = (p+c) & 0x7fc;
+			d ^= Ttab(p);
+			c = rotrConstant<9>(c);
+
+			q = (q+d) & 0x7fc;
+			d = rotrConstant<9>(d);
+			a += Ttab(q);
+
+#define SEAL_OUTPUT(x)	\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 0, b + m_S[4*i+0]);\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 1, c ^ m_S[4*i+1]);\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 2, d + m_S[4*i+2]);\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 3, a ^ m_S[4*i+3]);
+
+			CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(SEAL_OUTPUT, 4*4);
+
+			if (i & 1)
+			{
+				a += n3;
+				b += n4;
+				c ^= n3;
+				d ^= n4;
+			}
+			else
+			{
+				a += n1;
+				b += n2;
+				c ^= n1;
+				d ^= n2;
+			}
+		}
+
+		if (++m_insideCounter == m_iterationsPerCount)
+		{
+			++m_outsideCounter;
+			m_insideCounter = 0;
+		}
+	}
+
+	a = b = c = d = n1 = n2 = n3 = n4 = 0;
+	p = q = 0;
+}
+
+template class SEAL_Policy<BigEndian>;
+template class SEAL_Policy<LittleEndian>;
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/seal.h b/runtime/third_party/cryptopp/seal.h
new file mode 100644
index 0000000..750df96
--- /dev/null
+++ b/runtime/third_party/cryptopp/seal.h
@@ -0,0 +1,59 @@
+// seal.h - originally written and placed in the public domain by Wei Dai
+
+/// \file seal.h
+/// \brief Classes for SEAL stream cipher
+/// \since Crypto++ 2.2
+
+#ifndef CRYPTOPP_SEAL_H
+#define CRYPTOPP_SEAL_H
+
+#include "strciphr.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SEAL stream cipher information
+/// \tparam B Endianness of the stream cipher
+/// \since Crypto++ 2.2
+template <class B = BigEndian>
+struct SEAL_Info : public FixedKeyLength<20, SimpleKeyingInterface::INTERNALLY_GENERATED_IV, 4>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return B::ToEnum() == LITTLE_ENDIAN_ORDER ? "SEAL-3.0-LE" : "SEAL-3.0-BE";}
+};
+
+/// \brief SEAL stream cipher operation
+/// \tparam B Endianness of the stream cipher
+/// \since Crypto++ 2.2
+template <class B = BigEndian>
+class CRYPTOPP_NO_VTABLE SEAL_Policy : public AdditiveCipherConcretePolicy<word32, 256>, public SEAL_Info<B>
+{
+protected:
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	void CipherResynchronize(byte *keystreamBuffer, const byte *IV, size_t length);
+	bool CipherIsRandomAccess() const {return true;}
+	void SeekToIteration(lword iterationCount);
+
+private:
+	FixedSizeSecBlock<word32, 512> m_T;
+	FixedSizeSecBlock<word32, 256> m_S;
+	SecBlock<word32> m_R;
+
+	word32 m_startCount, m_iterationsPerCount;
+	word32 m_outsideCounter, m_insideCounter;
+};
+
+/// \brief SEAL stream cipher
+/// \tparam B Endianness of the stream cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/SEAL-3.0-BE">SEAL</a>
+/// \since Crypto++ 2.2
+template <class B = BigEndian>
+struct SEAL : public SEAL_Info<B>, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<SEAL_Policy<B>, AdditiveCipherTemplate<> >, SEAL_Info<B> > Encryption;
+	typedef Encryption Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/secblock.h b/runtime/third_party/cryptopp/secblock.h
new file mode 100644
index 0000000..1f20012
--- /dev/null
+++ b/runtime/third_party/cryptopp/secblock.h
@@ -0,0 +1,1310 @@
+// secblock.h - originally written and placed in the public domain by Wei Dai
+
+/// \file secblock.h
+/// \brief Classes and functions for secure memory allocations.
+
+#ifndef CRYPTOPP_SECBLOCK_H
+#define CRYPTOPP_SECBLOCK_H
+
+#include "config.h"
+#include "allocate.h"
+#include "misc.h"
+#include "stdcpp.h"
+
+#if defined(CRYPTOPP_MSC_VERSION)
+# pragma warning(push)
+# pragma warning(disable: 4231 4275 4700)
+# if (CRYPTOPP_MSC_VERSION >= 1400)
+#  pragma warning(disable: 6011 6386 28193)
+# endif
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ************** secure memory allocation ***************
+
+/// \brief Base class for all allocators used by SecBlock
+/// \tparam T the class or type
+template<class T>
+class AllocatorBase
+{
+public:
+	typedef T value_type;
+	typedef size_t size_type;
+	typedef std::ptrdiff_t difference_type;
+	typedef T * pointer;
+	typedef const T * const_pointer;
+	typedef T & reference;
+	typedef const T & const_reference;
+
+	pointer address(reference r) const {return (&r);}
+	const_pointer address(const_reference r) const {return (&r); }
+	void construct(pointer p, const T& val) {new (p) T(val);}
+	void destroy(pointer p) {CRYPTOPP_UNUSED(p); p->~T();}
+
+	/// \brief Returns the maximum number of elements the allocator can provide
+	/// \details <tt>ELEMS_MAX</tt> is the maximum number of elements the
+	///  <tt>Allocator</tt> can provide. The value of <tt>ELEMS_MAX</tt> is
+	///  <tt>SIZE_MAX/sizeof(T)</tt>. <tt>std::numeric_limits</tt> was avoided
+	///  due to lack of <tt>constexpr</tt>-ness in C++03 and below.
+	/// \note In C++03 and below <tt>ELEMS_MAX</tt> is a static data member of type
+	///  <tt>size_type</tt>. In C++11 and above <tt>ELEMS_MAX</tt> is an <tt>enum</tt>
+	///  inheriting from <tt>size_type</tt>. In both cases <tt>ELEMS_MAX</tt> can be
+	///  used before objects are fully constructed, and it does not suffer the
+	///  limitations of class methods like <tt>max_size</tt>.
+	/// \sa <A HREF="http://github.com/weidai11/cryptopp/issues/346">Issue 346/CVE-2016-9939</A>
+	/// \since Crypto++ 6.0
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	static const size_type ELEMS_MAX = ...;
+#elif defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION <= 1400)
+	static const size_type ELEMS_MAX = (~(size_type)0)/sizeof(T);
+#elif defined(CRYPTOPP_CXX11_STRONG_ENUM)
+	enum : size_type {ELEMS_MAX = SIZE_MAX/sizeof(T)};
+#else
+	static const size_type ELEMS_MAX = SIZE_MAX/sizeof(T);
+#endif
+
+	/// \brief Returns the maximum number of elements the allocator can provide
+	/// \return the maximum number of elements the allocator can provide
+	/// \details Internally, preprocessor macros are used rather than std::numeric_limits
+	///  because the latter is not a constexpr. Some compilers, like Clang, do not
+	///  optimize it well under all circumstances. Compilers like GCC, ICC and MSVC appear
+	///  to optimize it well in either form.
+	CRYPTOPP_CONSTEXPR size_type max_size() const {return ELEMS_MAX;}
+
+#if defined(__SUNPRO_CC)
+	// https://github.com/weidai11/cryptopp/issues/770
+	// and https://stackoverflow.com/q/53999461/608639
+	CRYPTOPP_CONSTEXPR size_type max_size(size_type n) const {return SIZE_MAX/n;}
+#endif
+
+#if defined(CRYPTOPP_CXX11_VARIADIC_TEMPLATES) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+	/// \brief Constructs a new V using variadic arguments
+	/// \tparam V the type to be forwarded
+	/// \tparam Args the arguments to be forwarded
+	/// \param ptr pointer to type V
+	/// \param args variadic arguments
+	/// \details This is a C++11 feature. It is available when CRYPTOPP_CXX11_VARIADIC_TEMPLATES
+	///  is defined. The define is controlled by compiler versions detected in config.h.
+    template<typename V, typename... Args>
+    void construct(V* ptr, Args&&... args) {::new ((void*)ptr) V(std::forward<Args>(args)...);}
+
+	/// \brief Destroys an V constructed with variadic arguments
+	/// \tparam V the type to be forwarded
+	/// \details This is a C++11 feature. It is available when CRYPTOPP_CXX11_VARIADIC_TEMPLATES
+	///  is defined. The define is controlled by compiler versions detected in config.h.
+    template<typename V>
+    void destroy(V* ptr) {if (ptr) ptr->~V();}
+
+#endif
+
+protected:
+
+	/// \brief Verifies the allocator can satisfy a request based on size
+	/// \param size the size of the allocation, in elements
+	/// \throw InvalidArgument
+	/// \details CheckSize verifies the number of elements requested is valid.
+	/// \details If size is greater than max_size(), then InvalidArgument is thrown.
+	///  The library throws InvalidArgument if the size is too large to satisfy.
+	/// \details Internally, preprocessor macros are used rather than std::numeric_limits
+	///  because the latter is not a constexpr. Some compilers, like Clang, do not
+	///  optimize it well under all circumstances. Compilers like GCC, ICC and MSVC appear
+	///  to optimize it well in either form.
+	/// \details The <tt>sizeof(T) != 1</tt> in the condition attempts to help the
+	///  compiler optimize the check for byte types. Coverity findings for
+	///  CONSTANT_EXPRESSION_RESULT were generated without it. For byte types,
+	///  size never exceeded ELEMS_MAX but the code was not removed.
+	/// \note size is the count of elements, and not the number of bytes
+	static void CheckSize(size_t size)
+	{
+		// Squash MSC C4100 warning for size. Also see commit 42b7c4ea5673.
+		CRYPTOPP_UNUSED(size);
+		// C++ throws std::bad_alloc (C++03) or std::bad_array_new_length (C++11) here.
+		if (sizeof(T) != 1 && size > ELEMS_MAX)
+			throw InvalidArgument("AllocatorBase: requested size would cause integer overflow");
+	}
+};
+
+#define CRYPTOPP_INHERIT_ALLOCATOR_TYPES(T_type)	\
+	typedef typename AllocatorBase<T_type>::value_type value_type;\
+	typedef typename AllocatorBase<T_type>::size_type size_type;\
+	typedef typename AllocatorBase<T_type>::difference_type difference_type;\
+	typedef typename AllocatorBase<T_type>::pointer pointer;\
+	typedef typename AllocatorBase<T_type>::const_pointer const_pointer;\
+	typedef typename AllocatorBase<T_type>::reference reference;\
+	typedef typename AllocatorBase<T_type>::const_reference const_reference;
+
+/// \brief Reallocation function
+/// \tparam T the class or type
+/// \tparam A the class or type's allocator
+/// \param alloc the allocator
+/// \param oldPtr the previous allocation
+/// \param oldSize the size of the previous allocation
+/// \param newSize the new, requested size
+/// \param preserve flag that indicates if the old allocation should be preserved
+/// \note oldSize and newSize are the count of elements, and not the
+///  number of bytes.
+template <class T, class A>
+typename A::pointer StandardReallocate(A& alloc, T *oldPtr, typename A::size_type oldSize, typename A::size_type newSize, bool preserve)
+{
+	// Avoid assert on pointer in reallocate. SecBlock regularly uses NULL
+	// pointers rather returning non-NULL 0-sized pointers.
+	if (oldSize == newSize)
+		return oldPtr;
+
+	if (preserve)
+	{
+		typename A::pointer newPtr = alloc.allocate(newSize, NULLPTR);
+		const typename A::size_type copySize = STDMIN(oldSize, newSize) * sizeof(T);
+
+		if (oldPtr && newPtr)
+			memcpy_s(newPtr, copySize, oldPtr, copySize);
+
+		if (oldPtr)
+			alloc.deallocate(oldPtr, oldSize);
+
+		return newPtr;
+	}
+	else
+	{
+		if (oldPtr)
+			alloc.deallocate(oldPtr, oldSize);
+
+		return alloc.allocate(newSize, NULLPTR);
+	}
+}
+
+/// \brief Allocates a block of memory with cleanup
+/// \tparam T class or type
+/// \tparam T_Align16 boolean that determines whether allocations should be aligned on a 16-byte boundary
+/// \details If T_Align16 is true, then AllocatorWithCleanup calls AlignedAllocate()
+///  for memory allocations. If T_Align16 is false, then AllocatorWithCleanup() calls
+///  UnalignedAllocate() for memory allocations.
+/// \details Template parameter T_Align16 is effectively controlled by cryptlib.h and mirrors
+///  CRYPTOPP_BOOL_ALIGN16. CRYPTOPP_BOOL_ALIGN16 is often used as the template parameter.
+template <class T, bool T_Align16 = false>
+class AllocatorWithCleanup : public AllocatorBase<T>
+{
+public:
+	CRYPTOPP_INHERIT_ALLOCATOR_TYPES(T)
+
+	/// \brief Allocates a block of memory
+	/// \param ptr the size of the allocation
+	/// \param size the size of the allocation, in elements
+	/// \return a memory block
+	/// \throw InvalidArgument
+	/// \details allocate() first checks the size of the request. If it is non-0
+	///  and less than max_size(), then an attempt is made to fulfill the request
+	///  using either AlignedAllocate() or UnalignedAllocate(). AlignedAllocate() is
+	///  used if T_Align16 is true. UnalignedAllocate() used if T_Align16 is false.
+	/// \details This is the C++ *Placement New* operator. ptr is not used, and the
+	///  function asserts in Debug builds if ptr is non-NULL.
+	/// \sa CallNewHandler() for the methods used to recover from a failed
+	///  allocation attempt.
+	/// \note size is the count of elements, and not the number of bytes
+	pointer allocate(size_type size, const void *ptr = NULLPTR)
+	{
+		CRYPTOPP_UNUSED(ptr); CRYPTOPP_ASSERT(ptr == NULLPTR);
+		this->CheckSize(size);
+		if (size == 0)
+			return NULLPTR;
+
+#if CRYPTOPP_BOOL_ALIGN16
+		if (T_Align16)
+			return reinterpret_cast<pointer>(AlignedAllocate(size*sizeof(T)));
+#endif
+
+		return reinterpret_cast<pointer>(UnalignedAllocate(size*sizeof(T)));
+	}
+
+	/// \brief Deallocates a block of memory
+	/// \param ptr the pointer for the allocation
+	/// \param size the size of the allocation, in elements
+	/// \details Internally, SecureWipeArray() is called before deallocating the
+	///  memory. Once the memory block is wiped or zeroized, AlignedDeallocate()
+	///  or UnalignedDeallocate() is called.
+	/// \details AlignedDeallocate() is used if T_Align16 is true.
+	///  UnalignedDeallocate() used if T_Align16 is false.
+	void deallocate(void *ptr, size_type size)
+	{
+		// Avoid assert on pointer in deallocate. SecBlock regularly uses NULL
+		// pointers rather returning non-NULL 0-sized pointers.
+		if (ptr)
+		{
+			SecureWipeArray(reinterpret_cast<pointer>(ptr), size);
+
+#if CRYPTOPP_BOOL_ALIGN16
+			if (T_Align16)
+				return AlignedDeallocate(ptr);
+#endif
+
+			UnalignedDeallocate(ptr);
+		}
+	}
+
+	/// \brief Reallocates a block of memory
+	/// \param oldPtr the previous allocation
+	/// \param oldSize the size of the previous allocation
+	/// \param newSize the new, requested size
+	/// \param preserve flag that indicates if the old allocation should be preserved
+	/// \return pointer to the new memory block
+	/// \details Internally, reallocate() calls StandardReallocate().
+	/// \details If preserve is true, then index 0 is used to begin copying the
+	///  old memory block to the new one. If the block grows, then the old array
+	///  is copied in its entirety. If the block shrinks, then only newSize
+	///  elements are copied from the old block to the new one.
+	/// \note oldSize and newSize are the count of elements, and not the
+	///  number of bytes.
+	pointer reallocate(T *oldPtr, size_type oldSize, size_type newSize, bool preserve)
+	{
+		CRYPTOPP_ASSERT((oldPtr && oldSize) || !(oldPtr || oldSize));
+		return StandardReallocate(*this, oldPtr, oldSize, newSize, preserve);
+	}
+
+	/// \brief Template class member Rebind
+	/// \tparam V bound class or type
+	/// \details Rebind allows a container class to allocate a different type of object
+	///  to store elements. For example, a std::list will allocate std::list_node to
+	///  store elements in the list.
+	/// \details VS.NET STL enforces the policy of "All STL-compliant allocators
+	///  have to provide a template class member called rebind".
+    template <class V> struct rebind { typedef AllocatorWithCleanup<V, T_Align16> other; };
+#if (CRYPTOPP_MSC_VERSION >= 1500)
+	AllocatorWithCleanup() {}
+	template <class V, bool A> AllocatorWithCleanup(const AllocatorWithCleanup<V, A> &) {}
+#endif
+};
+
+CRYPTOPP_DLL_TEMPLATE_CLASS AllocatorWithCleanup<byte>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AllocatorWithCleanup<word16>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AllocatorWithCleanup<word32>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AllocatorWithCleanup<word64>;
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+CRYPTOPP_DLL_TEMPLATE_CLASS AllocatorWithCleanup<word128, true>; // for Integer
+#endif
+#if CRYPTOPP_BOOL_X86
+CRYPTOPP_DLL_TEMPLATE_CLASS AllocatorWithCleanup<word, true>;	 // for Integer
+#endif
+
+/// \brief NULL allocator
+/// \tparam T class or type
+/// \details A NullAllocator is useful for fixed-size, stack based allocations
+///  (i.e., static arrays used by FixedSizeAllocatorWithCleanup).
+/// \details A NullAllocator always returns 0 for max_size(), and always returns
+///  NULL for allocation requests. Though the allocator does not allocate at
+///  runtime, it does perform a secure wipe or zeroization during cleanup.
+template <class T>
+class NullAllocator : public AllocatorBase<T>
+{
+public:
+	//LCOV_EXCL_START
+	CRYPTOPP_INHERIT_ALLOCATOR_TYPES(T)
+
+	// TODO: should this return NULL or throw bad_alloc? Non-Windows C++ standard
+	// libraries always throw. And late mode Windows throws. Early model Windows
+	// (circa VC++ 6.0) returned NULL.
+	pointer allocate(size_type n, const void* unused = NULLPTR)
+	{
+		CRYPTOPP_UNUSED(n); CRYPTOPP_UNUSED(unused);
+		CRYPTOPP_ASSERT(false); return NULLPTR;
+	}
+
+	void deallocate(void *p, size_type n)
+	{
+		CRYPTOPP_UNUSED(p); CRYPTOPP_UNUSED(n);
+		CRYPTOPP_ASSERT(false);
+	}
+
+	CRYPTOPP_CONSTEXPR size_type max_size() const {return 0;}
+	//LCOV_EXCL_STOP
+};
+
+/// \brief Static secure memory block with cleanup
+/// \tparam T class or type
+/// \tparam S fixed-size of the stack-based memory block, in elements
+/// \tparam T_Align16 boolean that determines whether allocations should
+///  be aligned on a 16-byte boundary
+/// \details FixedSizeAllocatorWithCleanup provides a fixed-size, stack-
+///  based allocation at compile time. The class can grow its memory
+///  block at runtime if a suitable allocator is available. If size
+///  grows beyond S and a suitable allocator is available, then the
+///  statically allocated array is obsoleted.
+/// \note This allocator can't be used with standard collections because
+///  they require that all objects of the same allocator type are equivalent.
+template <class T, size_t S, class A = NullAllocator<T>, bool T_Align16 = false>
+class FixedSizeAllocatorWithCleanup : public AllocatorBase<T>
+{
+	// The body of FixedSizeAllocatorWithCleanup is provided in the two
+	// partial specializations that follow. The two specializations
+	// pivot on the boolean template parameter T_Align16.
+};
+
+/// \brief Static secure memory block with cleanup
+/// \tparam T class or type
+/// \tparam S fixed-size of the stack-based memory block, in elements
+/// \details FixedSizeAllocatorWithCleanup provides a fixed-size, stack-
+///  based allocation at compile time. The class can grow its memory
+///  block at runtime if a suitable allocator is available. If size
+///  grows beyond S and a suitable allocator is available, then the
+///  statically allocated array is obsoleted.
+/// \note This allocator can't be used with standard collections because
+///  they require that all objects of the same allocator type are equivalent.
+template <class T, size_t S, class A>
+class FixedSizeAllocatorWithCleanup<T, S, A, true> : public AllocatorBase<T>
+{
+public:
+	CRYPTOPP_INHERIT_ALLOCATOR_TYPES(T)
+
+	/// \brief Constructs a FixedSizeAllocatorWithCleanup
+	FixedSizeAllocatorWithCleanup() : m_allocated(false) {}
+
+	/// \brief Allocates a block of memory
+	/// \param size the count elements in the memory block
+	/// \details FixedSizeAllocatorWithCleanup provides a fixed-size, stack-based
+	///  allocation at compile time. If size is less than or equal to
+	///  <tt>S</tt>, then a pointer to the static array is returned.
+	/// \details The class can grow its memory block at runtime if a suitable
+	///  allocator is available. If size grows beyond S and a suitable
+	///  allocator is available, then the statically allocated array is
+	///  obsoleted. If a suitable allocator is not available, as with a
+	///  NullAllocator, then the function returns NULL and a runtime error
+	///  eventually occurs.
+	/// \sa reallocate(), SecBlockWithHint
+	pointer allocate(size_type size)
+	{
+		CRYPTOPP_ASSERT(IsAlignedOn(m_array, 8));
+
+		if (size <= S && !m_allocated)
+		{
+			m_allocated = true;
+			return GetAlignedArray();
+		}
+		else
+			return m_fallbackAllocator.allocate(size);
+	}
+
+	/// \brief Allocates a block of memory
+	/// \param size the count elements in the memory block
+	/// \param hint an unused hint
+	/// \details FixedSizeAllocatorWithCleanup provides a fixed-size, stack-
+	///  based allocation at compile time. If size is less than or equal to
+	///  S, then a pointer to the static array is returned.
+	/// \details The class can grow its memory block at runtime if a suitable
+	///  allocator is available. If size grows beyond S and a suitable
+	///  allocator is available, then the statically allocated array is
+	///  obsoleted. If a suitable allocator is not available, as with a
+	///  NullAllocator, then the function returns NULL and a runtime error
+	///  eventually occurs.
+	/// \sa reallocate(), SecBlockWithHint
+	pointer allocate(size_type size, const void *hint)
+	{
+		CRYPTOPP_ASSERT(IsAlignedOn(m_array, 8));
+
+		if (size <= S && !m_allocated)
+		{
+			m_allocated = true;
+			return GetAlignedArray();
+		}
+		else
+			return m_fallbackAllocator.allocate(size, hint);
+	}
+
+	/// \brief Deallocates a block of memory
+	/// \param ptr a pointer to the memory block to deallocate
+	/// \param size the count elements in the memory block
+	/// \details The memory block is wiped or zeroized before deallocation.
+	///  If the statically allocated memory block is active, then no
+	///  additional actions are taken after the wipe.
+	/// \details If a dynamic memory block is active, then the pointer and
+	///  size are passed to the allocator for deallocation.
+	void deallocate(void *ptr, size_type size)
+	{
+		// Avoid assert on pointer in deallocate. SecBlock regularly uses NULL
+		// pointers rather returning non-NULL 0-sized pointers.
+		if (ptr == GetAlignedArray())
+		{
+			// If the m_allocated assert fires then the bit twiddling for
+			// GetAlignedArray() is probably incorrect for the platform.
+			// Be sure to check CRYPTOPP_ALIGN_DATA(8). The platform may
+			// not have a way to declaratively align data to 8.
+			CRYPTOPP_ASSERT(size <= S);
+			CRYPTOPP_ASSERT(m_allocated);
+			m_allocated = false;
+			SecureWipeArray(reinterpret_cast<pointer>(ptr), size);
+		}
+		else
+		{
+			if (ptr)
+				m_fallbackAllocator.deallocate(ptr, size);
+		}
+	}
+
+	/// \brief Reallocates a block of memory
+	/// \param oldPtr the previous allocation
+	/// \param oldSize the size of the previous allocation
+	/// \param newSize the new, requested size
+	/// \param preserve flag that indicates if the old allocation should
+	///  be preserved
+	/// \return pointer to the new memory block
+	/// \details FixedSizeAllocatorWithCleanup provides a fixed-size, stack-
+	///  based allocation at compile time. If size is less than or equal to
+	///  S, then a pointer to the static array is returned.
+	/// \details The class can grow its memory block at runtime if a suitable
+	///  allocator is available. If size grows beyond S and a suitable
+	///  allocator is available, then the statically allocated array is
+	///  obsoleted. If a suitable allocator is not available, as with a
+	///  NullAllocator, then the function returns NULL and a runtime error
+	///  eventually occurs.
+	/// \note size is the count of elements, and not the number of bytes.
+	/// \sa reallocate(), SecBlockWithHint
+	pointer reallocate(pointer oldPtr, size_type oldSize, size_type newSize, bool preserve)
+	{
+		if (oldPtr == GetAlignedArray() && newSize <= S)
+		{
+			CRYPTOPP_ASSERT(oldSize <= S);
+			if (oldSize > newSize)
+				SecureWipeArray(oldPtr+newSize, oldSize-newSize);
+			return oldPtr;
+		}
+
+		pointer newPtr = allocate(newSize, NULLPTR);
+		if (preserve && newSize)
+		{
+			const size_type copySize = STDMIN(oldSize, newSize);
+			if (newPtr && oldPtr)  // GCC analyzer warning
+				memcpy_s(newPtr, sizeof(T)*newSize, oldPtr, sizeof(T)*copySize);
+		}
+		deallocate(oldPtr, oldSize);
+		return newPtr;
+	}
+
+	CRYPTOPP_CONSTEXPR size_type max_size() const
+	{
+		return STDMAX(m_fallbackAllocator.max_size(), S);
+	}
+
+private:
+
+#if CRYPTOPP_BOOL_ALIGN16
+
+	// There be demons here... We cannot use CRYPTOPP_ALIGN_DATA(16)
+	// because linkers on 32-bit machines and some 64-bit machines
+	// align the stack to 8-bytes or less, and not 16-bytes as
+	// requested. We can only count on a smaller alignment. All
+	// toolchains tested appear to honor CRYPTOPP_ALIGN_DATA(8). Also
+	// see http://stackoverflow.com/a/1468656/608639.
+	//
+	// The 16-byte alignment is achieved by padding the requested
+	// size with extra elements so we have at least 8-bytes of slack
+	// to work with. Then the array pointer is moved to achieve a
+	// 16-byte alignment.
+	//
+	// The additional 8-bytes introduces a small secondary issue.
+	// The secondary issue is, a large T results in 0 = 8/sizeof(T).
+	// The library is OK but users may hit it. So we need to guard
+	// for a large T, and that is what the enum and PAD achieves.
+	T* GetAlignedArray() {
+
+		// m_array is aligned on 8 byte boundaries due to
+		// CRYPTOPP_ALIGN_DATA(8). If m_array%16 is 0, then the buffer
+		// is 16-byte aligned and nothing needs to be done. if
+		// m_array%16 is 8, then the buffer is not 16-byte aligned and
+		// we need to add 8. 8 has that nice symmetric property.
+		//
+		// If we needed to use CRYPTOPP_ALIGN_DATA(4) due to toolchain
+		// limitations, then the calculation would be slightly more
+		// costly: ptr = m_array + (16 - (m_array % 16)) % 16;
+		CRYPTOPP_ASSERT(IsAlignedOn(m_array, 8));
+		int off = reinterpret_cast<uintptr_t>(m_array) % 16;
+		byte* ptr = reinterpret_cast<byte*>(m_array) + off;
+
+		// Verify the 16-byte alignment. This is the point
+		// of these extra gyrations.
+		CRYPTOPP_ASSERT(IsAlignedOn(ptr, 16));
+		// Verify the lower bound. This is Issue 982/988.
+		CRYPTOPP_ASSERT(
+			reinterpret_cast<uintptr_t>(ptr) >=
+			  reinterpret_cast<uintptr_t>(m_array)
+		);
+		// Verify the upper bound. Allocated array with
+		// pad is large enough.
+		CRYPTOPP_ASSERT(
+			reinterpret_cast<uintptr_t>(ptr+S*sizeof(T)) <=
+			  reinterpret_cast<uintptr_t>(m_array+(S+PAD))
+		);
+
+		// void* to silence Clang warnings
+		return reinterpret_cast<T*>(
+		  static_cast<void*>(ptr)
+		);
+	}
+
+	// PAD is elements, not bytes, and rounded up to ensure no overflow.
+	enum { Q = sizeof(T), PAD = (Q >= 8) ? 1 : (Q >= 4) ? 2 : (Q >= 2) ? 4 : 8 };
+	// enum { Q = sizeof(T), PAD = (Q >= 16) ? 1 : (Q >= 8) ? 2 : (Q >= 4) ? 4 : (Q >= 2) ? 8 : 16 };
+	CRYPTOPP_ALIGN_DATA(8) T m_array[S+PAD];
+
+#else
+
+	// CRYPTOPP_BOOL_ALIGN16 is 0. If we are here then the user
+	// probably compiled with CRYPTOPP_DISABLE_ASM. Normally we
+	// would use the natural alignment of T. The problem we are
+	// having is, some toolchains are changing the boundary for
+	// 64-bit arrays. 64-bit elements require 8-byte alignment,
+	// but the toolchain is laying the array out on a 4 byte
+	// boundary. See GH #992 for mystery alignment,
+	// https://github.com/weidai11/cryptopp/issues/992
+	T* GetAlignedArray() {return m_array;}
+	CRYPTOPP_ALIGN_DATA(8) T m_array[S];
+
+#endif
+
+	A m_fallbackAllocator;
+	bool m_allocated;
+};
+
+/// \brief Static secure memory block with cleanup
+/// \tparam T class or type
+/// \tparam S fixed-size of the stack-based memory block, in elements
+/// \details FixedSizeAllocatorWithCleanup provides a fixed-size, stack-
+///  based allocation at compile time. The class can grow its memory
+///  block at runtime if a suitable allocator is available. If size
+///  grows beyond S and a suitable allocator is available, then the
+///  statically allocated array is obsoleted.
+/// \note This allocator can't be used with standard collections because
+///  they require that all objects of the same allocator type are equivalent.
+template <class T, size_t S, class A>
+class FixedSizeAllocatorWithCleanup<T, S, A, false> : public AllocatorBase<T>
+{
+public:
+	CRYPTOPP_INHERIT_ALLOCATOR_TYPES(T)
+
+	/// \brief Constructs a FixedSizeAllocatorWithCleanup
+	FixedSizeAllocatorWithCleanup() : m_allocated(false) {}
+
+	/// \brief Allocates a block of memory
+	/// \param size the count elements in the memory block
+	/// \details FixedSizeAllocatorWithCleanup provides a fixed-size, stack-based
+	///  allocation at compile time. If size is less than or equal to
+	///  <tt>S</tt>, then a pointer to the static array is returned.
+	/// \details The class can grow its memory block at runtime if a suitable
+	///  allocator is available. If size grows beyond S and a suitable
+	///  allocator is available, then the statically allocated array is
+	///  obsoleted. If a suitable allocator is not available, as with a
+	///  NullAllocator, then the function returns NULL and a runtime error
+	///  eventually occurs.
+	/// \sa reallocate(), SecBlockWithHint
+	pointer allocate(size_type size)
+	{
+		CRYPTOPP_ASSERT(IsAlignedOn(m_array, 8));
+
+		if (size <= S && !m_allocated)
+		{
+			m_allocated = true;
+			return GetAlignedArray();
+		}
+		else
+			return m_fallbackAllocator.allocate(size);
+	}
+
+	/// \brief Allocates a block of memory
+	/// \param size the count elements in the memory block
+	/// \param hint an unused hint
+	/// \details FixedSizeAllocatorWithCleanup provides a fixed-size, stack-
+	///  based allocation at compile time. If size is less than or equal to
+	///  S, then a pointer to the static array is returned.
+	/// \details The class can grow its memory block at runtime if a suitable
+	///  allocator is available. If size grows beyond S and a suitable
+	///  allocator is available, then the statically allocated array is
+	///  obsoleted. If a suitable allocator is not available, as with a
+	///  NullAllocator, then the function returns NULL and a runtime error
+	///  eventually occurs.
+	/// \sa reallocate(), SecBlockWithHint
+	pointer allocate(size_type size, const void *hint)
+	{
+		if (size <= S && !m_allocated)
+		{
+			m_allocated = true;
+			return GetAlignedArray();
+		}
+		else
+			return m_fallbackAllocator.allocate(size, hint);
+	}
+
+	/// \brief Deallocates a block of memory
+	/// \param ptr a pointer to the memory block to deallocate
+	/// \param size the count elements in the memory block
+	/// \details The memory block is wiped or zeroized before deallocation.
+	///  If the statically allocated memory block is active, then no
+	///  additional actions are taken after the wipe.
+	/// \details If a dynamic memory block is active, then the pointer and
+	///   size are passed to the allocator for deallocation.
+	void deallocate(void *ptr, size_type size)
+	{
+		// Avoid assert on pointer in deallocate. SecBlock regularly uses NULL
+		// pointers rather returning non-NULL 0-sized pointers.
+		if (ptr == GetAlignedArray())
+		{
+			// If the m_allocated assert fires then
+			// something overwrote the flag.
+			CRYPTOPP_ASSERT(size <= S);
+			CRYPTOPP_ASSERT(m_allocated);
+			m_allocated = false;
+			SecureWipeArray((pointer)ptr, size);
+		}
+		else
+		{
+			if (ptr)
+				m_fallbackAllocator.deallocate(ptr, size);
+			m_allocated = false;
+		}
+	}
+
+	/// \brief Reallocates a block of memory
+	/// \param oldPtr the previous allocation
+	/// \param oldSize the size of the previous allocation
+	/// \param newSize the new, requested size
+	/// \param preserve flag that indicates if the old allocation should
+	///  be preserved
+	/// \return pointer to the new memory block
+	/// \details FixedSizeAllocatorWithCleanup provides a fixed-size, stack-
+	///  based allocation at compile time. If size is less than or equal to
+	///  S, then a pointer to the static array is returned.
+	/// \details The class can grow its memory block at runtime if a suitable
+	///  allocator is available. If size grows beyond S and a suitable
+	///  allocator is available, then the statically allocated array is
+	///  obsoleted. If a suitable allocator is not available, as with a
+	///  NullAllocator, then the function returns NULL and a runtime error
+	///  eventually occurs.
+	/// \note size is the count of elements, and not the number of bytes.
+	/// \sa reallocate(), SecBlockWithHint
+	pointer reallocate(pointer oldPtr, size_type oldSize, size_type newSize, bool preserve)
+	{
+		if (oldPtr == GetAlignedArray() && newSize <= S)
+		{
+			CRYPTOPP_ASSERT(oldSize <= S);
+			if (oldSize > newSize)
+				SecureWipeArray(oldPtr+newSize, oldSize-newSize);
+			return oldPtr;
+		}
+
+		pointer newPtr = allocate(newSize, NULLPTR);
+		if (preserve && newSize)
+		{
+			const size_type copySize = STDMIN(oldSize, newSize);
+			if (newPtr && oldPtr)  // GCC analyzer warning
+				memcpy_s(newPtr, sizeof(T)*newSize, oldPtr, sizeof(T)*copySize);
+		}
+		deallocate(oldPtr, oldSize);
+		return newPtr;
+	}
+
+	CRYPTOPP_CONSTEXPR size_type max_size() const
+	{
+		return STDMAX(m_fallbackAllocator.max_size(), S);
+	}
+
+private:
+
+	// T_Align16 is false. Normally we would use the natural
+	// alignment of T. The problem we are having is, some toolchains
+	// are changing the boundary for 64-bit arrays. 64-bit elements
+	// require 8-byte alignment, but the toolchain is laying the array
+	// out on a 4 byte boundary. See GH #992 for mystery alignment,
+	// https://github.com/weidai11/cryptopp/issues/992
+	T* GetAlignedArray() {return m_array;}
+	CRYPTOPP_ALIGN_DATA(8) T m_array[S];
+
+	A m_fallbackAllocator;
+	bool m_allocated;
+};
+
+/// \brief Secure memory block with allocator and cleanup
+/// \tparam T a class or type
+/// \tparam A AllocatorWithCleanup derived class for allocation and cleanup
+/// \sa <A HREF="https://www.cryptopp.com/wiki/SecBlock">SecBlock</A>
+///  on the Crypto++ wiki.
+/// \since Crypto++ 2.0
+template <class T, class A = AllocatorWithCleanup<T> >
+class SecBlock
+{
+public:
+	typedef typename A::value_type value_type;
+	typedef typename A::pointer iterator;
+	typedef typename A::const_pointer const_iterator;
+	typedef typename A::size_type size_type;
+
+	/// \brief Returns the maximum number of elements the block can hold
+	/// \details <tt>ELEMS_MAX</tt> is the maximum number of elements the
+	///  <tt>SecBlock</tt> can hold. The value of <tt>ELEMS_MAX</tt> is
+	///  <tt>SIZE_MAX/sizeof(T)</tt>. <tt>std::numeric_limits</tt> was avoided
+	///  due to lack of <tt>constexpr</tt>-ness in C++03 and below.
+	/// \note In C++03 and below <tt>ELEMS_MAX</tt> is a static data member of type
+	///  <tt>size_type</tt>. In C++11 and above <tt>ELEMS_MAX</tt> is an <tt>enum</tt>
+	///  inheriting from <tt>size_type</tt>. In both cases <tt>ELEMS_MAX</tt> can be
+	///  used before objects are fully constructed, and it does not suffer the
+	///  limitations of class methods like <tt>max_size</tt>.
+	/// \sa <A HREF="http://github.com/weidai11/cryptopp/issues/346">Issue 346/CVE-2016-9939</A>
+	/// \since Crypto++ 6.0
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+	static const size_type ELEMS_MAX = ...;
+#elif defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION <= 1400)
+	static const size_type ELEMS_MAX = (~(size_type)0)/sizeof(T);
+#elif defined(CRYPTOPP_CXX11_STRONG_ENUM)
+	enum : size_type {ELEMS_MAX = A::ELEMS_MAX};
+#else
+	static const size_type ELEMS_MAX = SIZE_MAX/sizeof(T);
+#endif
+
+	/// \brief Construct a SecBlock with space for size elements.
+	/// \param size the size of the allocation, in elements
+	/// \throw std::bad_alloc
+	/// \details The elements are not initialized.
+	/// \since Crypto++ 2.0
+	/// \note size is the count of elements, and not the number of bytes
+	explicit SecBlock(size_type size=0)
+		: m_mark(ELEMS_MAX), m_size(size), m_ptr(m_alloc.allocate(size, NULLPTR)) { }
+
+	/// \brief Copy construct a SecBlock from another SecBlock
+	/// \param t the other SecBlock
+	/// \throw std::bad_alloc
+	/// \since Crypto++ 2.0
+	SecBlock(const SecBlock<T, A> &t)
+		: m_mark(t.m_mark), m_size(t.m_size), m_ptr(m_alloc.allocate(t.m_size, NULLPTR)) {
+			CRYPTOPP_ASSERT((!t.m_ptr && !m_size) || (t.m_ptr && m_size));
+			if (m_ptr && t.m_ptr)
+				memcpy_s(m_ptr, m_size*sizeof(T), t.m_ptr, t.m_size*sizeof(T));
+		}
+
+	/// \brief Construct a SecBlock from an array of elements.
+	/// \param ptr a pointer to an array of T
+	/// \param len the number of elements in the memory block
+	/// \throw std::bad_alloc
+	/// \details If <tt>ptr!=NULL</tt> and <tt>len!=0</tt>, then the block is initialized from the pointer
+	///  <tt>ptr</tt>. If <tt>ptr==NULL</tt> and <tt>len!=0</tt>, then the block is initialized to 0.
+	///  Otherwise, the block is empty and not initialized.
+	/// \since Crypto++ 2.0
+	/// \note size is the count of elements, and not the number of bytes
+	SecBlock(const T *ptr, size_type len)
+		: m_mark(ELEMS_MAX), m_size(len), m_ptr(m_alloc.allocate(len, NULLPTR)) {
+			CRYPTOPP_ASSERT((!m_ptr && !m_size) || (m_ptr && m_size));
+			if (m_ptr && ptr)
+				memcpy_s(m_ptr, m_size*sizeof(T), ptr, len*sizeof(T));
+			else if (m_ptr && m_size)
+				std::memset(m_ptr, 0, m_size*sizeof(T));
+		}
+
+	~SecBlock()
+		{m_alloc.deallocate(m_ptr, STDMIN(m_size, m_mark));}
+
+#ifdef __BORLANDC__
+	/// \brief Cast operator
+	/// \return block pointer cast to non-const <tt>T *</tt>
+	/// \since Crypto++ 2.0
+	operator T *() const
+		{return (T*)m_ptr;}
+#else
+	/// \brief Cast operator
+	/// \return block pointer cast to <tt>const void *</tt>
+	/// \since Crypto++ 2.0
+	operator const void *() const
+		{return m_ptr;}
+
+	/// \brief Cast operator
+	/// \return block pointer cast to non-const <tt>void *</tt>
+	/// \since Crypto++ 2.0
+	operator void *()
+		{return m_ptr;}
+
+	/// \brief Cast operator
+	/// \return block pointer cast to <tt>const T *</tt>
+	/// \since Crypto++ 2.0
+	operator const T *() const
+		{return m_ptr;}
+
+	/// \brief Cast operator
+	/// \return block pointer cast to non-const <tt>T *</tt>
+	/// \since Crypto++ 2.0
+	operator T *()
+		{return m_ptr;}
+#endif
+
+	/// \brief Provides an iterator pointing to the first element in the memory block
+	/// \return iterator pointing to the first element in the memory block
+	/// \since Crypto++ 2.0
+	iterator begin()
+		{return m_ptr;}
+	/// \brief Provides a constant iterator pointing to the first element in the memory block
+	/// \return constant iterator pointing to the first element in the memory block
+	/// \since Crypto++ 2.0
+	const_iterator begin() const
+		{return m_ptr;}
+	/// \brief Provides an iterator pointing beyond the last element in the memory block
+	/// \return iterator pointing beyond the last element in the memory block
+	/// \since Crypto++ 2.0
+	iterator end()
+		{return m_ptr+m_size;}
+	/// \brief Provides a constant iterator pointing beyond the last element in the memory block
+	/// \return constant iterator pointing beyond the last element in the memory block
+	/// \since Crypto++ 2.0
+	const_iterator end() const
+		{return m_ptr+m_size;}
+
+	/// \brief Provides a pointer to the first element in the memory block
+	/// \return pointer to the first element in the memory block
+	/// \since Crypto++ 2.0
+	typename A::pointer data() {return m_ptr;}
+	/// \brief Provides a pointer to the first element in the memory block
+	/// \return constant pointer to the first element in the memory block
+	/// \since Crypto++ 2.0
+	typename A::const_pointer data() const {return m_ptr;}
+
+	/// \brief Provides the count of elements in the SecBlock
+	/// \return number of elements in the memory block
+	/// \note the return value is the count of elements, and not the number of bytes
+	/// \since Crypto++ 2.0
+	size_type size() const {return m_size;}
+	/// \brief Determines if the SecBlock is empty
+	/// \return true if number of elements in the memory block is 0, false otherwise
+	/// \since Crypto++ 2.0
+	bool empty() const {return m_size == 0;}
+
+	/// \brief Provides a byte pointer to the first element in the memory block
+	/// \return byte pointer to the first element in the memory block
+	/// \since Crypto++ 2.0
+	byte * BytePtr() {return (byte *)m_ptr;}
+	/// \brief Return a byte pointer to the first element in the memory block
+	/// \return constant byte pointer to the first element in the memory block
+	/// \since Crypto++ 2.0
+	const byte * BytePtr() const {return (const byte *)m_ptr;}
+	/// \brief Provides the number of bytes in the SecBlock
+	/// \return the number of bytes in the memory block
+	/// \note the return value is the number of bytes, and not count of elements.
+	/// \since Crypto++ 2.0
+	size_type SizeInBytes() const {return m_size*sizeof(T);}
+
+	/// \brief Set contents and size from an array
+	/// \param ptr a pointer to an array of T
+	/// \param len the number of elements in the memory block
+	/// \details The array pointed to by <tt>ptr</tt> must be distinct
+	///  from this SecBlock because Assign() calls New() and then std::memcpy().
+	///  The call to New() will invalidate all pointers and iterators, like
+	///  the pointer returned from data().
+	/// \details If the memory block is reduced in size, then the reclaimed
+	///  memory is set to 0. If an assignment occurs, then Assign() resets
+	///  the element count after the previous block is zeroized.
+	/// \since Crypto++ 2.0
+	void Assign(const T *ptr, size_type len)
+	{
+		New(len);
+		if (m_ptr && ptr)  // GCC analyzer warning
+			memcpy_s(m_ptr, m_size*sizeof(T), ptr, len*sizeof(T));
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Set contents from a value
+	/// \param count the number of values to copy
+	/// \param value the value, repeated count times
+	/// \details If the memory block is reduced in size, then the reclaimed
+	///  memory is set to 0. If an assignment occurs, then Assign() resets
+	///  the element count after the previous block is zeroized.
+	/// \since Crypto++ 6.0
+	void Assign(size_type count, T value)
+	{
+		New(count);
+		for (size_t i=0; i<count; ++i)
+			m_ptr[i] = value;
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Copy contents from another SecBlock
+	/// \param t the other SecBlock
+	/// \details Assign checks for self assignment.
+	/// \details If the memory block is reduced in size, then the reclaimed
+	///  memory is set to 0. If an assignment occurs, then Assign() resets
+	///  the element count after the previous block is zeroized.
+	/// \since Crypto++ 2.0
+	void Assign(const SecBlock<T, A> &t)
+	{
+		if (this != &t)
+		{
+			New(t.m_size);
+			if (m_ptr && t.m_ptr)  // GCC analyzer warning
+				memcpy_s(m_ptr, m_size*sizeof(T), t, t.m_size*sizeof(T));
+		}
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Append contents from an array
+	/// \param ptr a pointer to an array of T
+	/// \param len the number of elements in the memory block
+	/// \throw InvalidArgument if resulting size would overflow
+	/// \details The array pointed to by <tt>ptr</tt> must be distinct
+	///  from this SecBlock because Append() calls Grow() and then std::memcpy().
+	///  The call to Grow() will invalidate all pointers and iterators, like
+	///  the pointer returned from data().
+	/// \details Append() may be less efficient than a ByteQueue because
+	///  Append() must Grow() the internal array and then copy elements.
+	///  The ByteQueue can copy elements without growing.
+	/// \sa ByteQueue
+	/// \since Crypto++ 8.6
+	void Append(const T *ptr, size_type len)
+	{
+		if (ELEMS_MAX - m_size < len)
+			throw InvalidArgument("SecBlock: buffer overflow");
+
+		const size_type oldSize = m_size;
+		Grow(m_size+len);
+		if (m_ptr && ptr)  // GCC analyzer warning
+			memcpy_s(m_ptr+oldSize, (m_size-oldSize)*sizeof(T), ptr, len*sizeof(T));
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Append contents from another SecBlock
+	/// \param t the other SecBlock
+	/// \throw InvalidArgument if resulting size would overflow
+	/// \details Internally, this SecBlock calls Grow() and then appends t.
+	/// \details Append() may be less efficient than a ByteQueue because
+	///  Append() must Grow() the internal array and then copy elements.
+	///  The ByteQueue can copy elements without growing.
+	/// \sa ByteQueue
+	/// \since Crypto++ 8.6
+	void Append(const SecBlock<T, A> &t)
+	{
+		if (ELEMS_MAX - m_size < t.m_size)
+			throw InvalidArgument("SecBlock: buffer overflow");
+
+		const size_type oldSize = m_size;
+		if (this != &t)  // s += t
+		{
+			Grow(m_size+t.m_size);
+			if (m_ptr && t.m_ptr)  // GCC analyzer warning
+				memcpy_s(m_ptr+oldSize, (m_size-oldSize)*sizeof(T), t.m_ptr, t.m_size*sizeof(T));
+		}
+		else            // t += t
+		{
+			Grow(m_size*2);
+			if (m_ptr)  // GCC analyzer warning
+				memmove_s(m_ptr+oldSize, (m_size-oldSize)*sizeof(T), m_ptr, oldSize*sizeof(T));
+		}
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Append contents from a value
+	/// \param count the number of values to copy
+	/// \param value the value, repeated count times
+	/// \throw InvalidArgument if resulting size would overflow
+	/// \details Internally, this SecBlock calls Grow() and then appends value.
+	/// \details Append() may be less efficient than a ByteQueue because
+	///  Append() must Grow() the internal array and then copy elements.
+	///  The ByteQueue can copy elements without growing.
+	/// \sa ByteQueue
+	/// \since Crypto++ 8.6
+	void Append(size_type count, T value)
+	{
+		if (ELEMS_MAX - m_size < count)
+			throw InvalidArgument("SecBlock: buffer overflow");
+
+		const size_type oldSize = m_size;
+		Grow(m_size+count);
+		for (size_t i=oldSize; i<oldSize+count; ++i)
+			m_ptr[i] = value;
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Sets the number of elements to zeroize
+	/// \param count the number of elements
+	/// \details SetMark is a remediation for Issue 346/CVE-2016-9939 while
+	///  preserving the streaming interface. The <tt>count</tt> controls the number of
+	///  elements zeroized, which can be less than <tt>size</tt> or 0.
+	/// \details An internal variable, <tt>m_mark</tt>, is initialized to the maximum number
+	///  of elements. The maximum number of elements is <tt>ELEMS_MAX</tt>. Deallocation
+	///  triggers a zeroization, and the number of elements zeroized is
+	///  <tt>STDMIN(m_size, m_mark)</tt>. After zeroization, the memory is returned to the
+	///  system.
+	/// \details The ASN.1 decoder uses SetMark() to set the element count to 0
+	///  before throwing an exception. In this case, the attacker provides a large
+	///  BER encoded length (say 64MB) but only a small number of content octets
+	///  (say 16). If the allocator zeroized all 64MB, then a transient DoS could
+	///  occur as CPU cycles are spent zeroizing uninitialized memory.
+	/// \details Generally speaking, any operation which changes the size of the SecBlock
+	///  results in the mark being reset to <tt>ELEMS_MAX</tt>. In particular, if Assign(),
+	///  New(), Grow(), CleanNew(), CleanGrow() are called, then the count is reset to
+	///  <tt>ELEMS_MAX</tt>. The list is not exhaustive.
+	/// \since Crypto++ 6.0
+	/// \sa <A HREF="http://github.com/weidai11/cryptopp/issues/346">Issue 346/CVE-2016-9939</A>
+	void SetMark(size_t count) {m_mark = count;}
+
+	/// \brief Assign contents from another SecBlock
+	/// \param t the other SecBlock
+	/// \return reference to this SecBlock
+	/// \details Internally, operator=() calls Assign().
+	/// \details If the memory block is reduced in size, then the reclaimed
+	///  memory is set to 0. If an assignment occurs, then Assign() resets
+	///  the element count after the previous block is zeroized.
+	/// \since Crypto++ 2.0
+	SecBlock<T, A>& operator=(const SecBlock<T, A> &t)
+	{
+		// Assign guards for self-assignment
+		Assign(t);
+		return *this;
+	}
+
+	/// \brief Append contents from another SecBlock
+	/// \param t the other SecBlock
+	/// \return reference to this SecBlock
+	/// \details Internally, operator+=() calls Append().
+	/// \since Crypto++ 2.0
+	SecBlock<T, A>& operator+=(const SecBlock<T, A> &t)
+	{
+		// Append guards for overflow
+		Append(t);
+		return *this;
+	}
+
+	/// \brief Construct a SecBlock from this and another SecBlock
+	/// \param t the other SecBlock
+	/// \return a newly constructed SecBlock that is a concatenation of this
+	///  and t.
+	/// \details Internally, a new SecBlock is created from this and a
+	///  concatenation of t.
+	/// \since Crypto++ 2.0
+	SecBlock<T, A> operator+(const SecBlock<T, A> &t)
+	{
+		CRYPTOPP_ASSERT((!m_ptr && !m_size) || (m_ptr && m_size));
+		CRYPTOPP_ASSERT((!t.m_ptr && !t.m_size) || (t.m_ptr && t.m_size));
+		if(!t.m_size) return SecBlock(*this);
+
+		SecBlock<T, A> result(m_size+t.m_size);
+		if (m_size)
+			memcpy_s(result.m_ptr, result.m_size*sizeof(T), m_ptr, m_size*sizeof(T));
+		if (result.m_ptr && t.m_ptr)  // GCC analyzer warning
+			memcpy_s(result.m_ptr+m_size, (result.m_size-m_size)*sizeof(T), t.m_ptr, t.m_size*sizeof(T));
+		return result;
+	}
+
+	/// \brief Bitwise compare two SecBlocks
+	/// \param t the other SecBlock
+	/// \return true if the size and bits are equal, false otherwise
+	/// \details Uses a constant time compare if the arrays are equal size.
+	///  The constant time compare is VerifyBufsEqual() found in
+	///  <tt>misc.h</tt>.
+	/// \sa operator!=()
+	/// \since Crypto++ 2.0
+	bool operator==(const SecBlock<T, A> &t) const
+	{
+		return m_size == t.m_size && VerifyBufsEqual(
+			reinterpret_cast<const byte*>(m_ptr),
+			reinterpret_cast<const byte*>(t.m_ptr), m_size*sizeof(T));
+	}
+
+	/// \brief Bitwise compare two SecBlocks
+	/// \param t the other SecBlock
+	/// \return true if the size and bits are equal, false otherwise
+	/// \details Uses a constant time compare if the arrays are equal size.
+	///  The constant time compare is VerifyBufsEqual() found in
+	///  <tt>misc.h</tt>.
+	/// \details Internally, operator!=() returns the inverse of operator==().
+	/// \sa operator==()
+	/// \since Crypto++ 2.0
+	bool operator!=(const SecBlock<T, A> &t) const
+	{
+		return !operator==(t);
+	}
+
+	/// \brief Change size without preserving contents
+	/// \param newSize the new size of the memory block
+	/// \details Old content is not preserved. If the memory block is
+	///  reduced in size, then the reclaimed content is set to 0. If the
+	///  memory block grows in size, then the new memory is initialized
+	///  to 0. New() resets the element count after the previous block
+	///  is zeroized.
+	/// \details Internally, this SecBlock calls reallocate().
+	/// \sa New(), CleanNew(), Grow(), CleanGrow(), resize()
+	/// \since Crypto++ 2.0
+	void New(size_type newSize)
+	{
+		m_ptr = m_alloc.reallocate(m_ptr, m_size, newSize, false);
+		m_size = newSize;
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Change size without preserving contents
+	/// \param newSize the new size of the memory block
+	/// \details Old content is not preserved. If the memory block is
+	///  reduced in size, then the reclaimed content is set to 0. If the
+	///  memory block grows in size, then the new memory is initialized
+	///  to 0. CleanNew() resets the element count after the previous
+	///  block is zeroized.
+	/// \details Internally, this SecBlock calls New().
+	/// \sa New(), CleanNew(), Grow(), CleanGrow(), resize()
+	/// \since Crypto++ 2.0
+	void CleanNew(size_type newSize)
+	{
+		New(newSize);
+		if (m_ptr) {memset_z(m_ptr, 0, m_size*sizeof(T));}
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Change size and preserve contents
+	/// \param newSize the new size of the memory block
+	/// \details Old content is preserved. New content is not initialized.
+	/// \details Internally, this SecBlock calls reallocate() when size must
+	///  increase. If the size does not increase, then CleanGrow() does not
+	///  take action. If the size must change, then use resize(). CleanGrow()
+	///  resets the element count after the previous block is zeroized.
+	/// \sa New(), CleanNew(), Grow(), CleanGrow(), resize()
+	/// \sa New(), CleanNew(), Grow(), CleanGrow(), resize()
+	/// \since Crypto++ 2.0
+	void Grow(size_type newSize)
+	{
+		if (newSize > m_size)
+		{
+			m_ptr = m_alloc.reallocate(m_ptr, m_size, newSize, true);
+			m_size = newSize;
+		}
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Change size and preserve contents
+	/// \param newSize the new size of the memory block
+	/// \details Old content is preserved. New content is initialized to 0.
+	/// \details Internally, this SecBlock calls reallocate() when size must
+	///  increase. If the size does not increase, then CleanGrow() does not
+	///  take action. If the size must change, then use resize(). CleanGrow()
+	///  resets the element count after the previous block is zeroized.
+	/// \sa New(), CleanNew(), Grow(), CleanGrow(), resize()
+	/// \since Crypto++ 2.0
+	void CleanGrow(size_type newSize)
+	{
+		if (newSize > m_size)
+		{
+			m_ptr = m_alloc.reallocate(m_ptr, m_size, newSize, true);
+			memset_z(m_ptr+m_size, 0, (newSize-m_size)*sizeof(T));
+			m_size = newSize;
+		}
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Change size and preserve contents
+	/// \param newSize the new size of the memory block
+	/// \details Old content is preserved. If the memory block grows in size, then
+	///  new memory is not initialized. resize() resets the element count after
+	///  the previous block is zeroized.
+	/// \details Internally, this SecBlock calls reallocate().
+	/// \sa New(), CleanNew(), Grow(), CleanGrow(), resize()
+	/// \since Crypto++ 2.0
+	void resize(size_type newSize)
+	{
+		m_ptr = m_alloc.reallocate(m_ptr, m_size, newSize, true);
+		m_size = newSize;
+		m_mark = ELEMS_MAX;
+	}
+
+	/// \brief Swap contents with another SecBlock
+	/// \param b the other SecBlock
+	/// \details Internally, std::swap() is called on m_alloc, m_size and m_ptr.
+	/// \since Crypto++ 2.0
+	void swap(SecBlock<T, A> &b)
+	{
+		// Swap must occur on the allocator in case its FixedSize that spilled into the heap.
+		std::swap(m_alloc, b.m_alloc);
+		std::swap(m_mark, b.m_mark);
+		std::swap(m_size, b.m_size);
+		std::swap(m_ptr, b.m_ptr);
+	}
+
+protected:
+	A m_alloc;
+	size_type m_mark, m_size;
+	T *m_ptr;
+};
+
+#ifdef CRYPTOPP_DOXYGEN_PROCESSING
+/// \brief \ref SecBlock "SecBlock<byte>" typedef.
+class SecByteBlock : public SecBlock<byte> {};
+/// \brief \ref SecBlock "SecBlock<word>" typedef.
+class SecWordBlock : public SecBlock<word> {};
+/// \brief SecBlock using \ref AllocatorWithCleanup "AllocatorWithCleanup<byte, true>" typedef
+class AlignedSecByteBlock : public SecBlock<byte, AllocatorWithCleanup<byte, true> > {};
+#else
+typedef SecBlock<byte> SecByteBlock;
+typedef SecBlock<word> SecWordBlock;
+typedef SecBlock<byte, AllocatorWithCleanup<byte, true> > AlignedSecByteBlock;
+#endif
+
+// No need for move semantics on derived class *if* the class does not add any
+// data members; see http://stackoverflow.com/q/31755703, and Rule of {0|3|5}.
+
+/// \brief Fixed size stack-based SecBlock
+/// \tparam T class or type
+/// \tparam S fixed-size of the stack-based memory block, in elements
+/// \tparam A AllocatorBase derived class for allocation and cleanup
+template <class T, unsigned int S, class A = FixedSizeAllocatorWithCleanup<T, S> >
+class FixedSizeSecBlock : public SecBlock<T, A>
+{
+public:
+	/// \brief Construct a FixedSizeSecBlock
+	explicit FixedSizeSecBlock() : SecBlock<T, A>(S) {}
+};
+
+/// \brief Fixed size stack-based SecBlock with 16-byte alignment
+/// \tparam T class or type
+/// \tparam S fixed-size of the stack-based memory block, in elements
+/// \tparam T_Align16 boolean that determines whether allocations should be
+///  aligned on a 16-byte boundary
+template <class T, unsigned int S, bool T_Align16 = true>
+class FixedSizeAlignedSecBlock : public FixedSizeSecBlock<T, S, FixedSizeAllocatorWithCleanup<T, S, NullAllocator<T>, T_Align16> >
+{
+};
+
+/// \brief Stack-based SecBlock that grows into the heap
+/// \tparam T class or type
+/// \tparam S fixed-size of the stack-based memory block, in elements
+/// \tparam A AllocatorBase derived class for allocation and cleanup
+template <class T, unsigned int S, class A = FixedSizeAllocatorWithCleanup<T, S, AllocatorWithCleanup<T> > >
+class SecBlockWithHint : public SecBlock<T, A>
+{
+public:
+	/// construct a SecBlockWithHint with a count of elements
+	explicit SecBlockWithHint(size_t size) : SecBlock<T, A>(size) {}
+};
+
+template<class T, bool A, class V, bool B>
+inline bool operator==(const CryptoPP::AllocatorWithCleanup<T, A>&, const CryptoPP::AllocatorWithCleanup<V, B>&) {return (true);}
+template<class T, bool A, class V, bool B>
+inline bool operator!=(const CryptoPP::AllocatorWithCleanup<T, A>&, const CryptoPP::AllocatorWithCleanup<V, B>&) {return (false);}
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(std)
+
+/// \brief Swap two SecBlocks
+/// \tparam T class or type
+/// \tparam A AllocatorBase derived class for allocation and cleanup
+/// \param a the first SecBlock
+/// \param b the second SecBlock
+template <class T, class A>
+inline void swap(CryptoPP::SecBlock<T, A> &a, CryptoPP::SecBlock<T, A> &b)
+{
+	a.swap(b);
+}
+
+#if defined(_STLP_DONT_SUPPORT_REBIND_MEMBER_TEMPLATE) || (defined(_STLPORT_VERSION) && !defined(_STLP_MEMBER_TEMPLATE_CLASSES))
+// working for STLport 5.1.3 and MSVC 6 SP5
+template <class _Tp1, class _Tp2>
+inline CryptoPP::AllocatorWithCleanup<_Tp2>&
+__stl_alloc_rebind(CryptoPP::AllocatorWithCleanup<_Tp1>& __a, const _Tp2*)
+{
+	return (CryptoPP::AllocatorWithCleanup<_Tp2>&)(__a);
+}
+#endif
+
+NAMESPACE_END
+
+#if defined(CRYPTOPP_MSC_VERSION)
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/secblockfwd.h b/runtime/third_party/cryptopp/secblockfwd.h
new file mode 100644
index 0000000..2d68c41
--- /dev/null
+++ b/runtime/third_party/cryptopp/secblockfwd.h
@@ -0,0 +1,29 @@
+// secblockfwd.h - written and placed in the public domain by Jeffrey Walton
+
+/// \file secblockfwd.h
+/// \brief Forward declarations for SecBlock
+/// \details secblock.h and misc.h have a circular dependency. secblockfwd.h
+///  allows the library to sidestep the circular dependency, and reference
+///  SecBlock classes without the full implementation.
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_SECBLOCKFWD_H
+#define CRYPTOPP_SECBLOCKFWD_H
+
+#include "config.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+template <class T, class A>
+class SecBlock;
+
+template <class T, bool A>
+class AllocatorWithCleanup;
+
+typedef SecBlock<byte, AllocatorWithCleanup<byte, false> > SecByteBlock;
+typedef SecBlock<word, AllocatorWithCleanup<word, false> > SecWordBlock;
+typedef SecBlock<byte, AllocatorWithCleanup<byte,  true> > AlignedSecByteBlock;
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_SECBLOCKFWD_H
diff --git a/runtime/third_party/cryptopp/seckey.h b/runtime/third_party/cryptopp/seckey.h
new file mode 100644
index 0000000..2fc6bed
--- /dev/null
+++ b/runtime/third_party/cryptopp/seckey.h
@@ -0,0 +1,444 @@
+// seckey.h - originally written and placed in the public domain by Wei Dai
+
+/// \file seckey.h
+/// \brief Classes and functions for implementing secret key algorithms.
+
+#ifndef CRYPTOPP_SECKEY_H
+#define CRYPTOPP_SECKEY_H
+
+#include "config.h"
+#include "cryptlib.h"
+#include "misc.h"
+#include "simple.h"
+#include "stdcpp.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4189 4296)
+#endif
+
+// Issue 340
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wconversion"
+# pragma GCC diagnostic ignored "-Wsign-conversion"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Inverts the cipher's direction
+/// \param dir the cipher's direction
+/// \return DECRYPTION if \ref CipherDir "dir" is ENCRYPTION, DECRYPTION otherwise
+inline CipherDir ReverseCipherDir(CipherDir dir)
+{
+	return (dir == ENCRYPTION) ? DECRYPTION : ENCRYPTION;
+}
+
+/// \brief Inherited by algorithms with fixed block size
+/// \tparam N the blocksize of the algorithm
+template <unsigned int N>
+class FixedBlockSize
+{
+public:
+	/// \brief The block size of the algorithm provided as a constant.
+	CRYPTOPP_CONSTANT(BLOCKSIZE = N);
+};
+
+// ************** rounds ***************
+
+/// \brief Inherited by algorithms with fixed number of rounds
+/// \tparam R the number of rounds used by the algorithm
+template <unsigned int R>
+class FixedRounds
+{
+public:
+	/// \brief The number of rounds for the algorithm provided as a constant.
+	CRYPTOPP_CONSTANT(ROUNDS = R);
+};
+
+/// \brief Inherited by algorithms with variable number of rounds
+/// \tparam D Default number of rounds
+/// \tparam N Minimum number of rounds
+/// \tparam M Maximum number of rounds
+template <unsigned int D, unsigned int N=1, unsigned int M=INT_MAX>		// use INT_MAX here because enums are treated as signed ints
+class VariableRounds
+{
+public:
+	/// \brief The default number of rounds for the algorithm provided as a constant.
+	CRYPTOPP_CONSTANT(DEFAULT_ROUNDS = D);
+	/// \brief The minimum number of rounds for the algorithm provided as a constant.
+	CRYPTOPP_CONSTANT(MIN_ROUNDS = N);
+	/// \brief The maximum number of rounds for the algorithm provided as a constant.
+	CRYPTOPP_CONSTANT(MAX_ROUNDS = M);
+	/// \brief The default number of rounds for the algorithm based on key length
+	///   provided by a static function.
+	/// \param keylength the size of the key, in bytes
+	/// \details keylength is unused in the default implementation.
+	CRYPTOPP_STATIC_CONSTEXPR unsigned int StaticGetDefaultRounds(size_t keylength)
+	{
+		return CRYPTOPP_UNUSED(keylength), static_cast<unsigned int>(DEFAULT_ROUNDS);
+	}
+
+protected:
+	/// \brief Validates the number of rounds for an algorithm.
+	/// \param rounds the candidate number of rounds
+	/// \param alg an Algorithm object used if the number of rounds are invalid
+	/// \throw InvalidRounds if the number of rounds are invalid
+	/// \details ThrowIfInvalidRounds() validates the number of rounds and throws if invalid.
+	inline void ThrowIfInvalidRounds(int rounds, const Algorithm *alg)
+	{
+		if (M == INT_MAX) // Coverity and result_independent_of_operands
+		{
+			if (rounds < MIN_ROUNDS)
+				throw InvalidRounds(alg ? alg->AlgorithmName() : std::string("VariableRounds"), rounds);
+		}
+		else
+		{
+			if (rounds < MIN_ROUNDS || rounds > MAX_ROUNDS)
+				throw InvalidRounds(alg ? alg->AlgorithmName() : std::string("VariableRounds"), rounds);
+		}
+	}
+
+	/// \brief Validates the number of rounds for an algorithm
+	/// \param param the candidate number of rounds
+	/// \param alg an Algorithm object used if the number of rounds are invalid
+	/// \return the number of rounds for the algorithm
+	/// \throw InvalidRounds if the number of rounds are invalid
+	/// \details GetRoundsAndThrowIfInvalid() validates the number of rounds and throws if invalid.
+	inline unsigned int GetRoundsAndThrowIfInvalid(const NameValuePairs &param, const Algorithm *alg)
+	{
+		int rounds = param.GetIntValueWithDefault("Rounds", DEFAULT_ROUNDS);
+		ThrowIfInvalidRounds(rounds, alg);
+		return static_cast<unsigned int>(rounds);
+	}
+};
+
+// ************** key length ***************
+
+/// \brief Inherited by keyed algorithms with fixed key length
+/// \tparam N Default key length, in bytes
+/// \tparam IV_REQ the \ref SimpleKeyingInterface::IV_Requirement "IV requirements"
+/// \tparam IV_L default IV length, in bytes
+/// \sa SimpleKeyingInterface
+template <unsigned int N, unsigned int IV_REQ = SimpleKeyingInterface::NOT_RESYNCHRONIZABLE, unsigned int IV_L = 0>
+class FixedKeyLength
+{
+public:
+	/// \brief The default key length used by the algorithm provided as a constant
+	/// \details KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(KEYLENGTH=N);
+	/// \brief The minimum key length used by the algorithm provided as a constant
+	/// \details MIN_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(MIN_KEYLENGTH=N);
+	/// \brief The maximum key length used by the algorithm provided as a constant
+	/// \details MAX_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(MAX_KEYLENGTH=N);
+	/// \brief The default key length used by the algorithm provided as a constant
+	/// \details DEFAULT_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(DEFAULT_KEYLENGTH=N);
+	/// \brief The default IV requirements for the algorithm provided as a constant
+	/// \details The default value is NOT_RESYNCHRONIZABLE. See IV_Requirement
+	///  in cryptlib.h for allowed values.
+	CRYPTOPP_CONSTANT(IV_REQUIREMENT = IV_REQ);
+	/// \brief The default IV length used by the algorithm provided as a constant
+	/// \details IV_LENGTH is provided in bytes, not bits. The default implementation uses 0.
+	CRYPTOPP_CONSTANT(IV_LENGTH = IV_L);
+	/// \brief The default key length for the algorithm provided by a static function.
+	/// \param keylength the size of the key, in bytes
+	/// \details The default implementation returns KEYLENGTH. keylength is unused
+	///   in the default implementation.
+	CRYPTOPP_STATIC_CONSTEXPR size_t CRYPTOPP_API StaticGetValidKeyLength(size_t keylength)
+	{
+		return CRYPTOPP_UNUSED(keylength), static_cast<size_t>(KEYLENGTH);
+	}
+};
+
+/// \brief Inherited by keyed algorithms with variable key length
+/// \tparam D Default key length, in bytes
+/// \tparam N Minimum key length, in bytes
+/// \tparam M Maximum key length, in bytes
+/// \tparam Q Default key length multiple, in bytes. The default multiple is 1.
+/// \tparam IV_REQ the \ref SimpleKeyingInterface::IV_Requirement "IV requirements"
+/// \tparam IV_L default IV length, in bytes. The default length is 0.
+/// \sa SimpleKeyingInterface
+template <unsigned int D, unsigned int N, unsigned int M, unsigned int Q = 1, unsigned int IV_REQ = SimpleKeyingInterface::NOT_RESYNCHRONIZABLE, unsigned int IV_L = 0>
+class VariableKeyLength
+{
+	// Make these private to avoid Doxygen documenting them in all derived classes
+	CRYPTOPP_COMPILE_ASSERT(Q > 0);
+	CRYPTOPP_COMPILE_ASSERT(N % Q == 0);
+	CRYPTOPP_COMPILE_ASSERT(M % Q == 0);
+	CRYPTOPP_COMPILE_ASSERT(N < M);
+	CRYPTOPP_COMPILE_ASSERT(D >= N);
+	CRYPTOPP_COMPILE_ASSERT(M >= D);
+
+public:
+	/// \brief The minimum key length used by the algorithm provided as a constant
+	/// \details MIN_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(MIN_KEYLENGTH=N);
+	/// \brief The maximum key length used by the algorithm provided as a constant
+	/// \details MAX_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(MAX_KEYLENGTH=M);
+	/// \brief The default key length used by the algorithm provided as a constant
+	/// \details DEFAULT_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(DEFAULT_KEYLENGTH=D);
+	/// \brief The key length multiple used by the algorithm provided as a constant
+	/// \details MAX_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(KEYLENGTH_MULTIPLE=Q);
+	/// \brief The default IV requirements for the algorithm provided as a constant
+	/// \details The default value is NOT_RESYNCHRONIZABLE. See IV_Requirement
+	///  in cryptlib.h for allowed values.
+	CRYPTOPP_CONSTANT(IV_REQUIREMENT=IV_REQ);
+	/// \brief The default initialization vector length for the algorithm provided as a constant
+	/// \details IV_LENGTH is provided in bytes, not bits. The default implementation uses 0.
+	CRYPTOPP_CONSTANT(IV_LENGTH=IV_L);
+	/// \brief Provides a valid key length for the algorithm provided by a static function.
+	/// \param keylength the size of the key, in bytes
+	/// \details If keylength is less than MIN_KEYLENGTH, then the function returns
+	///   MIN_KEYLENGTH. If keylength is greater than MAX_KEYLENGTH, then the function
+	///   returns MAX_KEYLENGTH. If keylength is a multiple of KEYLENGTH_MULTIPLE,
+	///   then keylength is returned. Otherwise, the function returns keylength rounded
+	///   \a down to the next smaller multiple of KEYLENGTH_MULTIPLE.
+	/// \details keylength is provided in bytes, not bits.
+	CRYPTOPP_STATIC_CONSTEXPR size_t CRYPTOPP_API StaticGetValidKeyLength(size_t keylength)
+	{
+		return (keylength <= N) ? N :
+			(keylength >= M) ? M :
+			(keylength+Q-1) - (keylength+Q-1)%Q;
+	}
+};
+
+/// \brief Provides key lengths based on another class's key length
+/// \tparam T another FixedKeyLength or VariableKeyLength class
+/// \tparam IV_REQ the \ref SimpleKeyingInterface::IV_Requirement "IV requirements"
+/// \tparam IV_L default IV length, in bytes
+/// \sa SimpleKeyingInterface
+template <class T, unsigned int IV_REQ = SimpleKeyingInterface::NOT_RESYNCHRONIZABLE, unsigned int IV_L = 0>
+class SameKeyLengthAs
+{
+public:
+	/// \brief The minimum key length used by the algorithm provided as a constant
+	/// \details MIN_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(MIN_KEYLENGTH=T::MIN_KEYLENGTH);
+	/// \brief The maximum key length used by the algorithm provided as a constant
+	/// \details MIN_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(MAX_KEYLENGTH=T::MAX_KEYLENGTH);
+	/// \brief The default key length used by the algorithm provided as a constant
+	/// \details MIN_KEYLENGTH is provided in bytes, not bits
+	CRYPTOPP_CONSTANT(DEFAULT_KEYLENGTH=T::DEFAULT_KEYLENGTH);
+	/// \brief The default IV requirements for the algorithm provided as a constant
+	/// \details The default value is NOT_RESYNCHRONIZABLE. See IV_Requirement
+	///  in cryptlib.h for allowed values.
+	CRYPTOPP_CONSTANT(IV_REQUIREMENT=IV_REQ);
+	/// \brief The default initialization vector length for the algorithm provided as a constant
+	/// \details IV_LENGTH is provided in bytes, not bits. The default implementation uses 0.
+	CRYPTOPP_CONSTANT(IV_LENGTH=IV_L);
+	/// \brief Provides a valid key length for the algorithm provided by a static function.
+	/// \param keylength the size of the key, in bytes
+	/// \details If keylength is less than MIN_KEYLENGTH, then the function returns
+	///   MIN_KEYLENGTH. If keylength is greater than MAX_KEYLENGTH, then the function
+	///   returns MAX_KEYLENGTH. If keylength is a multiple of KEYLENGTH_MULTIPLE,
+	///   then keylength is returned. Otherwise, the function returns keylength rounded
+	///   \a down to the next smaller multiple of KEYLENGTH_MULTIPLE.
+	/// \details keylength is provided in bytes, not bits.
+	CRYPTOPP_STATIC_CONSTEXPR size_t CRYPTOPP_API StaticGetValidKeyLength(size_t keylength)
+		{return T::StaticGetValidKeyLength(keylength);}
+};
+
+// ************** implementation helper for SimpleKeyingInterface ***************
+
+/// \brief Provides a base implementation of SimpleKeyingInterface
+/// \tparam BASE a SimpleKeyingInterface derived class
+/// \tparam INFO a SimpleKeyingInterface derived class
+/// \details SimpleKeyingInterfaceImpl() provides a default implementation for ciphers providing a keying interface.
+///   Functions are virtual and not eligible for C++11 <tt>constexpr</tt>-ness.
+/// \sa Algorithm(), SimpleKeyingInterface()
+template <class BASE, class INFO = BASE>
+class CRYPTOPP_NO_VTABLE SimpleKeyingInterfaceImpl : public BASE
+{
+public:
+	/// \brief The minimum key length used by the algorithm
+	/// \return minimum key length used by the algorithm, in bytes
+	size_t MinKeyLength() const
+		{return INFO::MIN_KEYLENGTH;}
+
+	/// \brief The maximum key length used by the algorithm
+	/// \return maximum key length used by the algorithm, in bytes
+	size_t MaxKeyLength() const
+		{return static_cast<size_t>(INFO::MAX_KEYLENGTH);}
+
+	/// \brief The default key length used by the algorithm
+	/// \return default key length used by the algorithm, in bytes
+	size_t DefaultKeyLength() const
+		{return INFO::DEFAULT_KEYLENGTH;}
+
+	/// \brief Provides a valid key length for the algorithm
+	/// \param keylength the size of the key, in bytes
+	/// \return the valid key length, in bytes
+	/// \details keylength is provided in bytes, not bits. If keylength is less than MIN_KEYLENGTH,
+	///   then the function returns MIN_KEYLENGTH. If keylength is greater than MAX_KEYLENGTH,
+	///   then the function returns MAX_KEYLENGTH. if If keylength is a multiple of KEYLENGTH_MULTIPLE,
+	///   then keylength is returned. Otherwise, the function returns a \a lower multiple of
+	///   KEYLENGTH_MULTIPLE.
+	size_t GetValidKeyLength(size_t keylength) const {return INFO::StaticGetValidKeyLength(keylength);}
+
+	/// \brief The default IV requirements for the algorithm
+	/// \details The default value is NOT_RESYNCHRONIZABLE. See IV_Requirement
+	///  in cryptlib.h for allowed values.
+	SimpleKeyingInterface::IV_Requirement IVRequirement() const
+		{return static_cast<SimpleKeyingInterface::IV_Requirement>(INFO::IV_REQUIREMENT);}
+
+	/// \brief The initialization vector length for the algorithm
+	/// \details IVSize is provided in bytes, not bits. The default implementation uses
+	///   IV_LENGTH, which is 0.
+	unsigned int IVSize() const
+		{return INFO::IV_LENGTH;}
+};
+
+/// \brief Provides a base implementation of Algorithm and SimpleKeyingInterface for block ciphers
+/// \tparam INFO a SimpleKeyingInterface derived class
+/// \tparam BASE a SimpleKeyingInterface derived class
+/// \details BlockCipherImpl() provides a default implementation for block ciphers using AlgorithmImpl()
+///   and SimpleKeyingInterfaceImpl(). Functions are virtual and not eligible for C++11 <tt>constexpr</tt>-ness.
+/// \sa Algorithm(), SimpleKeyingInterface(), AlgorithmImpl(), SimpleKeyingInterfaceImpl()
+template <class INFO, class BASE = BlockCipher>
+class CRYPTOPP_NO_VTABLE BlockCipherImpl : public AlgorithmImpl<SimpleKeyingInterfaceImpl<TwoBases<BASE, INFO> > >
+{
+public:
+	/// Provides the block size of the algorithm
+	/// \return the block size of the algorithm, in bytes
+	unsigned int BlockSize() const {return this->BLOCKSIZE;}
+};
+
+/// \brief Provides class member functions to key a block cipher
+/// \tparam DIR a CipherDir
+/// \tparam BASE a BlockCipherImpl derived class
+template <CipherDir DIR, class BASE>
+class BlockCipherFinal : public ClonableImpl<BlockCipherFinal<DIR, BASE>, BASE>
+{
+public:
+	/// \brief Construct a default BlockCipherFinal
+	/// \details The cipher is not keyed.
+ 	BlockCipherFinal() {}
+
+	/// \brief Construct a BlockCipherFinal
+	/// \param key a byte array used to key the cipher
+	/// \details key must be at least DEFAULT_KEYLENGTH in length. Internally, the function calls
+	///    SimpleKeyingInterface::SetKey.
+	BlockCipherFinal(const byte *key)
+		{this->SetKey(key, this->DEFAULT_KEYLENGTH);}
+
+	/// \brief Construct a BlockCipherFinal
+	/// \param key a byte array used to key the cipher
+	/// \param length the length of the byte array
+	/// \details key must be at least DEFAULT_KEYLENGTH in length. Internally, the function calls
+	///    SimpleKeyingInterface::SetKey.
+	BlockCipherFinal(const byte *key, size_t length)
+		{this->SetKey(key, length);}
+
+	/// \brief Construct a BlockCipherFinal
+	/// \param key a byte array used to key the cipher
+	/// \param length the length of the byte array
+	/// \param rounds the number of rounds
+	/// \details key must be at least DEFAULT_KEYLENGTH in length. Internally, the function calls
+	///    SimpleKeyingInterface::SetKeyWithRounds.
+	BlockCipherFinal(const byte *key, size_t length, unsigned int rounds)
+		{this->SetKeyWithRounds(key, length, rounds);}
+
+	/// \brief Provides the direction of the cipher
+	/// \return true if DIR is ENCRYPTION, false otherwise
+	/// \sa GetCipherDirection(), IsPermutation()
+	bool IsForwardTransformation() const {return DIR == ENCRYPTION;}
+};
+
+/// \brief Provides a base implementation of Algorithm and SimpleKeyingInterface for message authentication codes
+/// \tparam INFO a SimpleKeyingInterface derived class
+/// \tparam BASE a SimpleKeyingInterface derived class
+/// \details MessageAuthenticationCodeImpl() provides a default implementation for message authentication codes
+///   using AlgorithmImpl() and SimpleKeyingInterfaceImpl(). Functions are virtual and not subject to C++11
+///   <tt>constexpr</tt>.
+/// \sa Algorithm(), SimpleKeyingInterface(), AlgorithmImpl(), SimpleKeyingInterfaceImpl()
+template <class BASE, class INFO = BASE>
+class MessageAuthenticationCodeImpl : public AlgorithmImpl<SimpleKeyingInterfaceImpl<BASE, INFO>, INFO>
+{
+};
+
+/// \brief Provides class member functions to key a message authentication code
+/// \tparam BASE a BlockCipherImpl derived class
+/// \details A default implementation for MessageAuthenticationCode
+template <class BASE>
+class MessageAuthenticationCodeFinal : public ClonableImpl<MessageAuthenticationCodeFinal<BASE>, MessageAuthenticationCodeImpl<BASE> >
+{
+public:
+	/// \brief Construct a default MessageAuthenticationCodeFinal
+	/// \details The message authentication code is not keyed.
+ 	MessageAuthenticationCodeFinal() {}
+	/// \brief Construct a BlockCipherFinal
+	/// \param key a byte array used to key the algorithm
+	/// \details key must be at least DEFAULT_KEYLENGTH in length. Internally, the function calls
+	///    SimpleKeyingInterface::SetKey.
+	MessageAuthenticationCodeFinal(const byte *key)
+		{this->SetKey(key, this->DEFAULT_KEYLENGTH);}
+	/// \brief Construct a BlockCipherFinal
+	/// \param key a byte array used to key the algorithm
+	/// \param length the length of the byte array
+	/// \details key must be at least DEFAULT_KEYLENGTH in length. Internally, the function calls
+	///    SimpleKeyingInterface::SetKey.
+	MessageAuthenticationCodeFinal(const byte *key, size_t length)
+		{this->SetKey(key, length);}
+};
+
+// ************** documentation ***************
+
+/// \brief Provides Encryption and Decryption typedefs used by derived classes to
+///    implement a block cipher
+/// \details These objects usually should not be used directly. See CipherModeDocumentation
+///    instead. Each class derived from this one defines two types, Encryption and Decryption,
+///    both of which implement the BlockCipher interface.
+struct BlockCipherDocumentation
+{
+	/// implements the BlockCipher interface
+	typedef BlockCipher Encryption;
+	/// implements the BlockCipher interface
+	typedef BlockCipher Decryption;
+};
+
+/// \brief Provides Encryption and Decryption typedefs used by derived classes to
+///    implement a symmetric cipher
+/// \details Each class derived from this one defines two types, Encryption and Decryption,
+///    both of which implement the SymmetricCipher interface. Two types of classes derive
+///    from this class: stream ciphers and block cipher modes. Stream ciphers can be used
+///    alone, cipher mode classes need to be used with a block cipher. See CipherModeDocumentation
+///    for more for information about using cipher modes and block ciphers.
+struct SymmetricCipherDocumentation
+{
+	/// implements the SymmetricCipher interface
+	typedef SymmetricCipher Encryption;
+	/// implements the SymmetricCipher interface
+	typedef SymmetricCipher Decryption;
+};
+
+/// \brief Provides Encryption and Decryption typedefs used by derived classes to
+///    implement an authenticated encryption cipher
+/// \details Each class derived from this one defines two types, Encryption and Decryption,
+///    both of which implement the AuthenticatedSymmetricCipher interface.
+struct AuthenticatedSymmetricCipherDocumentation
+{
+	/// implements the AuthenticatedSymmetricCipher interface
+	typedef AuthenticatedSymmetricCipher Encryption;
+	/// implements the AuthenticatedSymmetricCipher interface
+	typedef AuthenticatedSymmetricCipher Decryption;
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+// Issue 340
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic pop
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/seed.cpp b/runtime/third_party/cryptopp/seed.cpp
new file mode 100644
index 0000000..3d93511
--- /dev/null
+++ b/runtime/third_party/cryptopp/seed.cpp
@@ -0,0 +1,113 @@
+// seed.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "seed.h"
+#include "misc.h"
+#include "stdcpp.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+
+const word32 s_kc[16] = {
+	0x9e3779b9, 0x3c6ef373, 0x78dde6e6, 0xf1bbcdcc, 0xe3779b99, 0xc6ef3733, 0x8dde6e67, 0x1bbcdccf,
+	0x3779b99e, 0x6ef3733c, 0xdde6e678, 0xbbcdccf1, 0x779b99e3, 0xef3733c6, 0xde6e678d, 0xbcdccf1b};
+
+const byte s_s0[256] = {
+	0xA9, 0x85, 0xD6, 0xD3, 0x54, 0x1D, 0xAC, 0x25, 0x5D, 0x43, 0x18, 0x1E, 0x51, 0xFC, 0xCA, 0x63, 0x28,
+	0x44, 0x20, 0x9D, 0xE0, 0xE2, 0xC8, 0x17, 0xA5, 0x8F, 0x03, 0x7B, 0xBB, 0x13, 0xD2, 0xEE, 0x70, 0x8C,
+	0x3F, 0xA8, 0x32, 0xDD, 0xF6, 0x74, 0xEC, 0x95, 0x0B, 0x57, 0x5C, 0x5B, 0xBD, 0x01, 0x24, 0x1C, 0x73,
+	0x98, 0x10, 0xCC, 0xF2, 0xD9, 0x2C, 0xE7, 0x72, 0x83, 0x9B, 0xD1, 0x86, 0xC9, 0x60, 0x50, 0xA3, 0xEB,
+	0x0D, 0xB6, 0x9E, 0x4F, 0xB7, 0x5A, 0xC6, 0x78, 0xA6, 0x12, 0xAF, 0xD5, 0x61, 0xC3, 0xB4, 0x41, 0x52,
+	0x7D, 0x8D, 0x08, 0x1F, 0x99, 0x00, 0x19, 0x04, 0x53, 0xF7, 0xE1, 0xFD, 0x76, 0x2F, 0x27, 0xB0, 0x8B,
+	0x0E, 0xAB, 0xA2, 0x6E, 0x93, 0x4D, 0x69, 0x7C, 0x09, 0x0A, 0xBF, 0xEF, 0xF3, 0xC5, 0x87, 0x14, 0xFE,
+	0x64, 0xDE, 0x2E, 0x4B, 0x1A, 0x06, 0x21, 0x6B, 0x66, 0x02, 0xF5, 0x92, 0x8A, 0x0C, 0xB3, 0x7E, 0xD0,
+	0x7A, 0x47, 0x96, 0xE5, 0x26, 0x80, 0xAD, 0xDF, 0xA1, 0x30, 0x37, 0xAE, 0x36, 0x15, 0x22, 0x38, 0xF4,
+	0xA7, 0x45, 0x4C, 0x81, 0xE9, 0x84, 0x97, 0x35, 0xCB, 0xCE, 0x3C, 0x71, 0x11, 0xC7, 0x89, 0x75, 0xFB,
+	0xDA, 0xF8, 0x94, 0x59, 0x82, 0xC4, 0xFF, 0x49, 0x39, 0x67, 0xC0, 0xCF, 0xD7, 0xB8, 0x0F, 0x8E, 0x42,
+	0x23, 0x91, 0x6C, 0xDB, 0xA4, 0x34, 0xF1, 0x48, 0xC2, 0x6F, 0x3D, 0x2D, 0x40, 0xBE, 0x3E, 0xBC, 0xC1,
+	0xAA, 0xBA, 0x4E, 0x55, 0x3B, 0xDC, 0x68, 0x7F, 0x9C, 0xD8, 0x4A, 0x56, 0x77, 0xA0, 0xED, 0x46, 0xB5,
+	0x2B, 0x65, 0xFA, 0xE3, 0xB9, 0xB1, 0x9F, 0x5E, 0xF9, 0xE6, 0xB2, 0x31, 0xEA, 0x6D, 0x5F, 0xE4, 0xF0,
+	0xCD, 0x88, 0x16, 0x3A, 0x58, 0xD4, 0x62, 0x29, 0x07, 0x33, 0xE8, 0x1B, 0x05, 0x79, 0x90, 0x6A, 0x2A,
+	0x9A};
+
+static const byte s_s1[256] = {
+	0x38, 0xE8, 0x2D, 0xA6, 0xCF, 0xDE, 0xB3, 0xB8, 0xAF, 0x60, 0x55, 0xC7, 0x44, 0x6F, 0x6B, 0x5B, 0xC3,
+	0x62, 0x33, 0xB5, 0x29, 0xA0, 0xE2, 0xA7, 0xD3, 0x91, 0x11, 0x06, 0x1C, 0xBC, 0x36, 0x4B, 0xEF, 0x88,
+	0x6C, 0xA8, 0x17, 0xC4, 0x16, 0xF4, 0xC2, 0x45, 0xE1, 0xD6, 0x3F, 0x3D, 0x8E, 0x98, 0x28, 0x4E, 0xF6,
+	0x3E, 0xA5, 0xF9, 0x0D, 0xDF, 0xD8, 0x2B, 0x66, 0x7A, 0x27, 0x2F, 0xF1, 0x72, 0x42, 0xD4, 0x41, 0xC0,
+	0x73, 0x67, 0xAC, 0x8B, 0xF7, 0xAD, 0x80, 0x1F, 0xCA, 0x2C, 0xAA, 0x34, 0xD2, 0x0B, 0xEE, 0xE9, 0x5D,
+	0x94, 0x18, 0xF8, 0x57, 0xAE, 0x08, 0xC5, 0x13, 0xCD, 0x86, 0xB9, 0xFF, 0x7D, 0xC1, 0x31, 0xF5, 0x8A,
+	0x6A, 0xB1, 0xD1, 0x20, 0xD7, 0x02, 0x22, 0x04, 0x68, 0x71, 0x07, 0xDB, 0x9D, 0x99, 0x61, 0xBE, 0xE6,
+	0x59, 0xDD, 0x51, 0x90, 0xDC, 0x9A, 0xA3, 0xAB, 0xD0, 0x81, 0x0F, 0x47, 0x1A, 0xE3, 0xEC, 0x8D, 0xBF,
+	0x96, 0x7B, 0x5C, 0xA2, 0xA1, 0x63, 0x23, 0x4D, 0xC8, 0x9E, 0x9C, 0x3A, 0x0C, 0x2E, 0xBA, 0x6E, 0x9F,
+	0x5A, 0xF2, 0x92, 0xF3, 0x49, 0x78, 0xCC, 0x15, 0xFB, 0x70, 0x75, 0x7F, 0x35, 0x10, 0x03, 0x64, 0x6D,
+	0xC6, 0x74, 0xD5, 0xB4, 0xEA, 0x09, 0x76, 0x19, 0xFE, 0x40, 0x12, 0xE0, 0xBD, 0x05, 0xFA, 0x01, 0xF0,
+	0x2A, 0x5E, 0xA9, 0x56, 0x43, 0x85, 0x14, 0x89, 0x9B, 0xB0, 0xE5, 0x48, 0x79, 0x97, 0xFC, 0x1E, 0x82,
+	0x21, 0x8C, 0x1B, 0x5F, 0x77, 0x54, 0xB2, 0x1D, 0x25, 0x4F, 0x00, 0x46, 0xED, 0x58, 0x52, 0xEB, 0x7E,
+	0xDA, 0xC9, 0xFD, 0x30, 0x95, 0x65, 0x3C, 0xB6, 0xE4, 0xBB, 0x7C, 0x0E, 0x50, 0x39, 0x26, 0x32, 0x84,
+	0x69, 0x93, 0x37, 0xE7, 0x24, 0xA4, 0xCB, 0x53, 0x0A, 0x87, 0xD9, 0x4C, 0x83, 0x8F, 0xCE, 0x3B, 0x4A,
+	0xB7};
+
+#define SS0(x) ((s_s0[x]*0x01010101UL) & 0x3FCFF3FC)
+#define SS1(x) ((s_s1[x]*0x01010101UL) & 0xFC3FCFF3)
+#define SS2(x) ((s_s0[x]*0x01010101UL) & 0xF3FC3FCF)
+#define SS3(x) ((s_s1[x]*0x01010101UL) & 0xCFF3FC3F)
+#define G(x) (SS0(GETBYTE(x, 0)) ^ SS1(GETBYTE(x, 1)) ^ SS2(GETBYTE(x, 2)) ^ SS3(GETBYTE(x, 3)))
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void SEED::Base::UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs& /*params*/)
+{
+	AssertValidKeyLength(length);
+
+	word64 key01, key23;
+	GetBlock<word64, BigEndian> get(userKey);
+	get(key01)(key23);
+	word32 *k = m_k;
+	ptrdiff_t kInc = 2;
+
+	if (!IsForwardTransformation())
+	{
+		k = k+30;
+		kInc = 0-kInc;
+	}
+
+	for (unsigned int i=0; i<ROUNDS; i++)
+	{
+		word32 t0 = word32(key01>>32) + word32(key23>>32) - s_kc[i];
+		word32 t1 = word32(key01) - word32(key23) + s_kc[i];
+		k[0] = G(t0);
+		k[1] = G(t1);
+		k+=kInc;
+		if (i&1)
+			key23 = rotlConstant<8,word64>(key23);
+		else
+			key01 = rotrConstant<8,word64>(key01);
+	}
+}
+
+void SEED::Base::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	typedef BlockGetAndPut<word32, BigEndian> Block;
+	word32 a0, a1, b0, b1, t0, t1;
+	Block::Get(inBlock)(a0)(a1)(b0)(b1);
+
+	for (int i=0; i<ROUNDS; i+=2)
+	{
+		t0 = b0 ^ m_k[2*i+0]; t1 = b1 ^ m_k[2*i+1] ^ t0;
+		t1 = G(t1); t0 += t1; t0 = G(t0); t1 += t0; t1 = G(t1);
+		a0 ^= t0 + t1; a1 ^= t1;
+
+		t0 = a0 ^ m_k[2*i+2]; t1 = a1 ^ m_k[2*i+3] ^ t0;
+		t1 = G(t1); t0 += t1; t0 = G(t0); t1 += t0; t1 = G(t1);
+		b0 ^= t0 + t1; b1 ^= t1;
+	}
+
+	Block::Put(xorBlock, outBlock)(b0)(b1)(a0)(a1);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/seed.h b/runtime/third_party/cryptopp/seed.h
new file mode 100644
index 0000000..63ee028
--- /dev/null
+++ b/runtime/third_party/cryptopp/seed.h
@@ -0,0 +1,44 @@
+// seed.h - originally written and placed in the public domain by Wei Dai
+
+/// \file seed.h
+/// \brief Classes for the SEED block cipher
+/// \since Crypto++ 5.6.0
+
+#ifndef CRYPTOPP_SEED_H
+#define CRYPTOPP_SEED_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SEED block cipher information
+/// \since Crypto++ 5.6.0
+struct SEED_Info : public FixedBlockSize<16>, public FixedKeyLength<16>, public FixedRounds<16>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "SEED";}
+};
+
+/// \brief SEED block cipher
+/// \sa <a href="http://www.cryptolounge.org/wiki/SEED">SEED</a>
+/// \since Crypto++ 5.6.0
+class SEED : public SEED_Info, public BlockCipherDocumentation
+{
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<SEED_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+	protected:
+		FixedSizeSecBlock<word32, 32> m_k;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Base> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Base> Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/serpent.cpp b/runtime/third_party/cryptopp/serpent.cpp
new file mode 100644
index 0000000..bc5e41e
--- /dev/null
+++ b/runtime/third_party/cryptopp/serpent.cpp
@@ -0,0 +1,125 @@
+// serpent.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#include "serpent.h"
+#include "secblock.h"
+#include "misc.h"
+
+#include "serpentp.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void Serpent_KeySchedule(word32 *k, unsigned int rounds, const byte *userKey, size_t keylen)
+{
+	FixedSizeSecBlock<word32, 8> k0;
+	GetUserKey(LITTLE_ENDIAN_ORDER, k0.begin(), 8, userKey, keylen);
+	if (keylen < 32)
+		k0[keylen/4] |= word32(1) << ((keylen%4)*8);
+
+	word32 t = k0[7];
+	unsigned int i;
+	for (i = 0; i < 8; ++i)
+		k[i] = k0[i] = t = rotlConstant<11>(k0[i] ^ k0[(i + 3) % 8] ^ k0[(i + 5) % 8] ^ t ^ 0x9e3779b9 ^ i);
+	for (i = 8; i < 4*(rounds+1); ++i)
+		k[i] = t = rotlConstant<11>(k[i-8] ^ k[i-5] ^ k[i-3] ^ t ^ 0x9e3779b9 ^ i);
+	k -= 20;
+
+	word32 a,b,c,d,e;
+	for (i=0; i<rounds/8; i++)
+	{
+		afterS2(LK); afterS2(S3); afterS3(SK);
+		afterS1(LK); afterS1(S2); afterS2(SK);
+		afterS0(LK); afterS0(S1); afterS1(SK);
+		beforeS0(LK); beforeS0(S0); afterS0(SK);
+		k += 8*4;
+		afterS6(LK); afterS6(S7); afterS7(SK);
+		afterS5(LK); afterS5(S6); afterS6(SK);
+		afterS4(LK); afterS4(S5); afterS5(SK);
+		afterS3(LK); afterS3(S4); afterS4(SK);
+	}
+	afterS2(LK); afterS2(S3); afterS3(SK);
+}
+
+void Serpent::Base::UncheckedSetKey(const byte *userKey, unsigned int keylen, const NameValuePairs &)
+{
+	AssertValidKeyLength(keylen);
+	Serpent_KeySchedule(m_key, 32, userKey, keylen);
+}
+
+typedef BlockGetAndPut<word32, LittleEndian> Block;
+
+void Serpent::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 a, b, c, d, e;
+
+	Block::Get(inBlock)(a)(b)(c)(d);
+
+	const word32 *k = m_key;
+	unsigned int i=1;
+
+	do
+	{
+		beforeS0(KX); beforeS0(S0); afterS0(LT);
+		afterS0(KX); afterS0(S1); afterS1(LT);
+		afterS1(KX); afterS1(S2); afterS2(LT);
+		afterS2(KX); afterS2(S3); afterS3(LT);
+		afterS3(KX); afterS3(S4); afterS4(LT);
+		afterS4(KX); afterS4(S5); afterS5(LT);
+		afterS5(KX); afterS5(S6); afterS6(LT);
+		afterS6(KX); afterS6(S7);
+
+		if (i == 4)
+			break;
+
+		++i;
+		c = b;
+		b = e;
+		e = d;
+		d = a;
+		a = e;
+		k += 32;
+		beforeS0(LT);
+	}
+	while (true);
+
+	afterS7(KX);
+
+	Block::Put(xorBlock, outBlock)(d)(e)(b)(a);
+}
+
+void Serpent::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 a, b, c, d, e=0;
+
+	Block::Get(inBlock)(a)(b)(c)(d);
+
+	const word32 *k = m_key + 96;
+	unsigned int i=4;
+
+	beforeI7(KX);
+	goto start;
+
+	do
+	{
+		c = b;
+		b = d;
+		d = e;
+		k -= 32;
+		beforeI7(ILT);
+start:
+		            beforeI7(I7); afterI7(KX);
+		afterI7(ILT); afterI7(I6); afterI6(KX);
+		afterI6(ILT); afterI6(I5); afterI5(KX);
+		afterI5(ILT); afterI5(I4); afterI4(KX);
+		afterI4(ILT); afterI4(I3); afterI3(KX);
+		afterI3(ILT); afterI3(I2); afterI2(KX);
+		afterI2(ILT); afterI2(I1); afterI1(KX);
+		afterI1(ILT); afterI1(I0); afterI0(KX);
+	}
+	while (--i != 0);
+
+	Block::Put(xorBlock, outBlock)(a)(d)(b)(e);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/serpent.h b/runtime/third_party/cryptopp/serpent.h
new file mode 100644
index 0000000..3fa3379
--- /dev/null
+++ b/runtime/third_party/cryptopp/serpent.h
@@ -0,0 +1,72 @@
+// serpent.h - originally written and placed in the public domain by Wei Dai
+
+/// \file serpent.h
+/// \brief Classes for the Serpent block cipher
+/// \sa <a href="https://www.cl.cam.ac.uk/~rja14/serpent.html">A
+///  Candidate Block Cipher for the Advanced Encryption Standard</a>
+
+#ifndef CRYPTOPP_SERPENT_H
+#define CRYPTOPP_SERPENT_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Serpent block cipher information
+/// \since Crypto++ 3.1
+struct Serpent_Info : public FixedBlockSize<16>, public VariableKeyLength<16, 16, 32, 8>, public FixedRounds<32>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "Serpent";}
+};
+
+/// \brief Serpent block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/Serpent">Serpent</a> on the
+///  Crypto++ wiki, <a href="https://www.cl.cam.ac.uk/~rja14/serpent.html">A
+///  Candidate Block Cipher for the Advanced Encryption Standard</a>
+/// \since Crypto++ 3.1
+class Serpent : public Serpent_Info, public BlockCipherDocumentation
+{
+	/// \brief Serpen block cipher base implementation
+	/// \details Provides implementation common to encryption and decryption
+	/// \since Crypto++ 3.1
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<Serpent_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		FixedSizeSecBlock<word32, 33*4> m_key;
+	};
+
+	/// \brief Serpent encryption transformation
+	/// \details Enc provides the encryption transformation.
+	///  All key sizes are supported.
+	/// \since Crypto++ 3.1
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief Serpent decryption transformation
+	/// \details Dec provides the decryption transformation.
+	///  All key sizes are supported.
+	/// \since Crypto++ 3.1
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef Serpent::Encryption SerpentEncryption;
+typedef Serpent::Decryption SerpentDecryption;
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_SERPENT_H
diff --git a/runtime/third_party/cryptopp/serpentp.h b/runtime/third_party/cryptopp/serpentp.h
new file mode 100644
index 0000000..124b08c
--- /dev/null
+++ b/runtime/third_party/cryptopp/serpentp.h
@@ -0,0 +1,439 @@
+// private header for Serpent and Sosemanuk
+
+#ifndef CRYPTOPP_SERPENTP_H
+#define CRYPTOPP_SERPENTP_H
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// linear transformation
+#define LT(i,a,b,c,d,e)	{\
+	a = rotlConstant<13>(a);	\
+	c = rotlConstant<3>(c); 	\
+	d = rotlConstant<7>(d ^ c ^ (a << 3)); 	\
+	b = rotlConstant<1>(b ^ a ^ c); 	\
+	a = rotlConstant<5>(a ^ b ^ d); 		\
+	c = rotlConstant<22>(c ^ d ^ (b << 7));}
+
+// inverse linear transformation
+#define ILT(i,a,b,c,d,e)	{\
+	c = rotrConstant<22>(c);	\
+	a = rotrConstant<5>(a); 	\
+	c ^= d ^ (b << 7);	\
+	a ^= b ^ d; 		\
+	b = rotrConstant<1>(b); 	\
+	d = rotrConstant<7>(d) ^ c ^ (a << 3);	\
+	b ^= a ^ c; 		\
+	c = rotrConstant<3>(c); 	\
+	a = rotrConstant<13>(a);}
+
+// order of output from S-box functions
+#define beforeS0(f) f(0,a,b,c,d,e)
+#define afterS0(f) f(1,b,e,c,a,d)
+#define afterS1(f) f(2,c,b,a,e,d)
+#define afterS2(f) f(3,a,e,b,d,c)
+#define afterS3(f) f(4,e,b,d,c,a)
+#define afterS4(f) f(5,b,a,e,c,d)
+#define afterS5(f) f(6,a,c,b,e,d)
+#define afterS6(f) f(7,a,c,d,b,e)
+#define afterS7(f) f(8,d,e,b,a,c)
+
+// order of output from inverse S-box functions
+#define beforeI7(f) f(8,a,b,c,d,e)
+#define afterI7(f) f(7,d,a,b,e,c)
+#define afterI6(f) f(6,a,b,c,e,d)
+#define afterI5(f) f(5,b,d,e,c,a)
+#define afterI4(f) f(4,b,c,e,a,d)
+#define afterI3(f) f(3,a,b,e,c,d)
+#define afterI2(f) f(2,b,d,e,c,a)
+#define afterI1(f) f(1,a,b,c,e,d)
+#define afterI0(f) f(0,a,d,b,e,c)
+
+// The instruction sequences for the S-box functions
+// come from Dag Arne Osvik's paper "Speeding up Serpent".
+
+#define S0(i, r0, r1, r2, r3, r4) \
+       {           \
+    r3 ^= r0;   \
+    r4 = r1;   \
+    r1 &= r3;   \
+    r4 ^= r2;   \
+    r1 ^= r0;   \
+    r0 |= r3;   \
+    r0 ^= r4;   \
+    r4 ^= r3;   \
+    r3 ^= r2;   \
+    r2 |= r1;   \
+    r2 ^= r4;   \
+    r4 = ~r4;      \
+    r4 |= r1;   \
+    r1 ^= r3;   \
+    r1 ^= r4;   \
+    r3 |= r0;   \
+    r1 ^= r3;   \
+    r4 ^= r3;   \
+            }
+
+#define I0(i, r0, r1, r2, r3, r4) \
+       {           \
+    r2 = ~r2;      \
+    r4 = r1;   \
+    r1 |= r0;   \
+    r4 = ~r4;      \
+    r1 ^= r2;   \
+    r2 |= r4;   \
+    r1 ^= r3;   \
+    r0 ^= r4;   \
+    r2 ^= r0;   \
+    r0 &= r3;   \
+    r4 ^= r0;   \
+    r0 |= r1;   \
+    r0 ^= r2;   \
+    r3 ^= r4;   \
+    r2 ^= r1;   \
+    r3 ^= r0;   \
+    r3 ^= r1;   \
+    r2 &= r3;   \
+    r4 ^= r2;   \
+            }
+
+#define S1(i, r0, r1, r2, r3, r4) \
+       {           \
+    r0 = ~r0;      \
+    r2 = ~r2;      \
+    r4 = r0;   \
+    r0 &= r1;   \
+    r2 ^= r0;   \
+    r0 |= r3;   \
+    r3 ^= r2;   \
+    r1 ^= r0;   \
+    r0 ^= r4;   \
+    r4 |= r1;   \
+    r1 ^= r3;   \
+    r2 |= r0;   \
+    r2 &= r4;   \
+    r0 ^= r1;   \
+    r1 &= r2;   \
+    r1 ^= r0;   \
+    r0 &= r2;   \
+    r0 ^= r4;   \
+            }
+
+#define I1(i, r0, r1, r2, r3, r4) \
+       {           \
+    r4 = r1;   \
+    r1 ^= r3;   \
+    r3 &= r1;   \
+    r4 ^= r2;   \
+    r3 ^= r0;   \
+    r0 |= r1;   \
+    r2 ^= r3;   \
+    r0 ^= r4;   \
+    r0 |= r2;   \
+    r1 ^= r3;   \
+    r0 ^= r1;   \
+    r1 |= r3;   \
+    r1 ^= r0;   \
+    r4 = ~r4;      \
+    r4 ^= r1;   \
+    r1 |= r0;   \
+    r1 ^= r0;   \
+    r1 |= r4;   \
+    r3 ^= r1;   \
+            }
+
+#define S2(i, r0, r1, r2, r3, r4) \
+       {           \
+    r4 = r0;   \
+    r0 &= r2;   \
+    r0 ^= r3;   \
+    r2 ^= r1;   \
+    r2 ^= r0;   \
+    r3 |= r4;   \
+    r3 ^= r1;   \
+    r4 ^= r2;   \
+    r1 = r3;   \
+    r3 |= r4;   \
+    r3 ^= r0;   \
+    r0 &= r1;   \
+    r4 ^= r0;   \
+    r1 ^= r3;   \
+    r1 ^= r4;   \
+    r4 = ~r4;      \
+            }
+
+#define I2(i, r0, r1, r2, r3, r4) \
+       {           \
+    r2 ^= r3;   \
+    r3 ^= r0;   \
+    r4 = r3;   \
+    r3 &= r2;   \
+    r3 ^= r1;   \
+    r1 |= r2;   \
+    r1 ^= r4;   \
+    r4 &= r3;   \
+    r2 ^= r3;   \
+    r4 &= r0;   \
+    r4 ^= r2;   \
+    r2 &= r1;   \
+    r2 |= r0;   \
+    r3 = ~r3;      \
+    r2 ^= r3;   \
+    r0 ^= r3;   \
+    r0 &= r1;   \
+    r3 ^= r4;   \
+    r3 ^= r0;   \
+            }
+
+#define S3(i, r0, r1, r2, r3, r4) \
+       {           \
+    r4 = r0;   \
+    r0 |= r3;   \
+    r3 ^= r1;   \
+    r1 &= r4;   \
+    r4 ^= r2;   \
+    r2 ^= r3;   \
+    r3 &= r0;   \
+    r4 |= r1;   \
+    r3 ^= r4;   \
+    r0 ^= r1;   \
+    r4 &= r0;   \
+    r1 ^= r3;   \
+    r4 ^= r2;   \
+    r1 |= r0;   \
+    r1 ^= r2;   \
+    r0 ^= r3;   \
+    r2 = r1;   \
+    r1 |= r3;   \
+    r1 ^= r0;   \
+            }
+
+#define I3(i, r0, r1, r2, r3, r4) \
+       {           \
+    r4 = r2;   \
+    r2 ^= r1;   \
+    r1 &= r2;   \
+    r1 ^= r0;   \
+    r0 &= r4;   \
+    r4 ^= r3;   \
+    r3 |= r1;   \
+    r3 ^= r2;   \
+    r0 ^= r4;   \
+    r2 ^= r0;   \
+    r0 |= r3;   \
+    r0 ^= r1;   \
+    r4 ^= r2;   \
+    r2 &= r3;   \
+    r1 |= r3;   \
+    r1 ^= r2;   \
+    r4 ^= r0;   \
+    r2 ^= r4;   \
+            }
+
+#define S4(i, r0, r1, r2, r3, r4) \
+       {           \
+    r1 ^= r3;   \
+    r3 = ~r3;      \
+    r2 ^= r3;   \
+    r3 ^= r0;   \
+    r4 = r1;   \
+    r1 &= r3;   \
+    r1 ^= r2;   \
+    r4 ^= r3;   \
+    r0 ^= r4;   \
+    r2 &= r4;   \
+    r2 ^= r0;   \
+    r0 &= r1;   \
+    r3 ^= r0;   \
+    r4 |= r1;   \
+    r4 ^= r0;   \
+    r0 |= r3;   \
+    r0 ^= r2;   \
+    r2 &= r3;   \
+    r0 = ~r0;      \
+    r4 ^= r2;   \
+            }
+
+#define I4(i, r0, r1, r2, r3, r4) \
+       {           \
+    r4 = r2;   \
+    r2 &= r3;   \
+    r2 ^= r1;   \
+    r1 |= r3;   \
+    r1 &= r0;   \
+    r4 ^= r2;   \
+    r4 ^= r1;   \
+    r1 &= r2;   \
+    r0 = ~r0;      \
+    r3 ^= r4;   \
+    r1 ^= r3;   \
+    r3 &= r0;   \
+    r3 ^= r2;   \
+    r0 ^= r1;   \
+    r2 &= r0;   \
+    r3 ^= r0;   \
+    r2 ^= r4;   \
+    r2 |= r3;   \
+    r3 ^= r0;   \
+    r2 ^= r1;   \
+            }
+
+#define S5(i, r0, r1, r2, r3, r4) \
+       {           \
+    r0 ^= r1;   \
+    r1 ^= r3;   \
+    r3 = ~r3;      \
+    r4 = r1;   \
+    r1 &= r0;   \
+    r2 ^= r3;   \
+    r1 ^= r2;   \
+    r2 |= r4;   \
+    r4 ^= r3;   \
+    r3 &= r1;   \
+    r3 ^= r0;   \
+    r4 ^= r1;   \
+    r4 ^= r2;   \
+    r2 ^= r0;   \
+    r0 &= r3;   \
+    r2 = ~r2;      \
+    r0 ^= r4;   \
+    r4 |= r3;   \
+    r2 ^= r4;   \
+            }
+
+#define I5(i, r0, r1, r2, r3, r4) \
+       {           \
+    r1 = ~r1;      \
+    r4 = r3;   \
+    r2 ^= r1;   \
+    r3 |= r0;   \
+    r3 ^= r2;   \
+    r2 |= r1;   \
+    r2 &= r0;   \
+    r4 ^= r3;   \
+    r2 ^= r4;   \
+    r4 |= r0;   \
+    r4 ^= r1;   \
+    r1 &= r2;   \
+    r1 ^= r3;   \
+    r4 ^= r2;   \
+    r3 &= r4;   \
+    r4 ^= r1;   \
+    r3 ^= r0;   \
+    r3 ^= r4;   \
+    r4 = ~r4;      \
+            }
+
+#define S6(i, r0, r1, r2, r3, r4) \
+       {           \
+    r2 = ~r2;      \
+    r4 = r3;   \
+    r3 &= r0;   \
+    r0 ^= r4;   \
+    r3 ^= r2;   \
+    r2 |= r4;   \
+    r1 ^= r3;   \
+    r2 ^= r0;   \
+    r0 |= r1;   \
+    r2 ^= r1;   \
+    r4 ^= r0;   \
+    r0 |= r3;   \
+    r0 ^= r2;   \
+    r4 ^= r3;   \
+    r4 ^= r0;   \
+    r3 = ~r3;      \
+    r2 &= r4;   \
+    r2 ^= r3;   \
+            }
+
+#define I6(i, r0, r1, r2, r3, r4) \
+       {           \
+    r0 ^= r2;   \
+    r4 = r2;   \
+    r2 &= r0;   \
+    r4 ^= r3;   \
+    r2 = ~r2;      \
+    r3 ^= r1;   \
+    r2 ^= r3;   \
+    r4 |= r0;   \
+    r0 ^= r2;   \
+    r3 ^= r4;   \
+    r4 ^= r1;   \
+    r1 &= r3;   \
+    r1 ^= r0;   \
+    r0 ^= r3;   \
+    r0 |= r2;   \
+    r3 ^= r1;   \
+    r4 ^= r0;   \
+            }
+
+#define S7(i, r0, r1, r2, r3, r4) \
+       {           \
+    r4 = r2;   \
+    r2 &= r1;   \
+    r2 ^= r3;   \
+    r3 &= r1;   \
+    r4 ^= r2;   \
+    r2 ^= r1;   \
+    r1 ^= r0;   \
+    r0 |= r4;   \
+    r0 ^= r2;   \
+    r3 ^= r1;   \
+    r2 ^= r3;   \
+    r3 &= r0;   \
+    r3 ^= r4;   \
+    r4 ^= r2;   \
+    r2 &= r0;   \
+    r4 = ~r4;      \
+    r2 ^= r4;   \
+    r4 &= r0;   \
+    r1 ^= r3;   \
+    r4 ^= r1;   \
+            }
+
+#define I7(i, r0, r1, r2, r3, r4) \
+       {           \
+    r4 = r2;   \
+    r2 ^= r0;   \
+    r0 &= r3;   \
+    r2 = ~r2;      \
+    r4 |= r3;   \
+    r3 ^= r1;   \
+    r1 |= r0;   \
+    r0 ^= r2;   \
+    r2 &= r4;   \
+    r1 ^= r2;   \
+    r2 ^= r0;   \
+    r0 |= r2;   \
+    r3 &= r4;   \
+    r0 ^= r3;   \
+    r4 ^= r1;   \
+    r3 ^= r4;   \
+    r4 |= r0;   \
+    r3 ^= r2;   \
+    r4 ^= r2;   \
+            }
+
+// key xor
+#define KX(r, a, b, c, d, e)	{\
+	a ^= k[4 * r + 0]; \
+	b ^= k[4 * r + 1]; \
+	c ^= k[4 * r + 2]; \
+	d ^= k[4 * r + 3];}
+
+#define LK(r, a, b, c, d, e)	{\
+	a = k[(8-r)*4 + 0];		\
+	b = k[(8-r)*4 + 1];		\
+	c = k[(8-r)*4 + 2];		\
+	d = k[(8-r)*4 + 3];}
+
+#define SK(r, a, b, c, d, e)	{\
+	k[(8-r)*4 + 4] = a;		\
+	k[(8-r)*4 + 5] = b;		\
+	k[(8-r)*4 + 6] = c;		\
+	k[(8-r)*4 + 7] = d;}
+
+void Serpent_KeySchedule(word32 *k, unsigned int rounds, const byte *userKey, size_t keylen);
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_SERPENTP_H
diff --git a/runtime/third_party/cryptopp/sha.cpp b/runtime/third_party/cryptopp/sha.cpp
new file mode 100644
index 0000000..4b52e61
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha.cpp
@@ -0,0 +1,1458 @@
+// sha.cpp - modified by Wei Dai from Steve Reid's public domain sha1.c
+
+//    Steve Reid implemented SHA-1. Wei Dai implemented SHA-2. Jeffrey
+//    Walton implemented Intel SHA extensions based on Intel articles and code
+//    by Sean Gulley. Jeffrey Walton implemented ARM SHA-1 and SHA-256 based
+//    on ARM code and code from Johannes Schneiders, Skip Hovsmith and
+//    Barry O'Rourke. Jeffrey Walton and Bill Schmidt implemented Power8
+//    SHA-256 and SHA-512. All code is in the public domain.
+
+//    In August 2017 JW reworked the internals to align all the
+//    implementations. Formerly all hashes were software based, IterHashBase
+//    handled endian conversions, and IterHashBase dispatched a single to
+//    block SHA{N}::Transform. SHA{N}::Transform then performed the single
+//    block hashing. It was repeated for multiple blocks.
+//
+//    The rework added SHA{N}::HashMultipleBlocks (class) and
+//    SHA{N}_HashMultipleBlocks (free standing). There are also hardware
+//    accelerated variations. Callers enter SHA{N}::HashMultipleBlocks (class)
+//    and the function calls SHA{N}_HashMultipleBlocks (free standing) or
+//    SHA{N}_HashBlock (free standing) as a fallback.
+//
+//    An added wrinkle is hardware is little endian, C++ is big endian, and
+//    callers use big endian, so SHA{N}_HashMultipleBlock accepts a ByteOrder
+//    for the incoming data arrangement. Hardware based SHA{N}_HashMultipleBlock
+//    can often perform the endian swap much easier by setting an EPI mask.
+//    Endian swap incurs no penalty on Intel SHA, and 4-instruction penalty on
+//    ARM SHA. Under C++ the full software based swap penalty is incurred due
+//    to use of ReverseBytes().
+//
+//    In May 2019 JW added Cryptogams ARMv7 and NEON implementations for SHA1,
+//    SHA256 and SHA512. The Cryptogams code closed a performance gap on modern
+//    32-bit ARM devices. Cryptogams is Andy Polyakov's project used to create
+//    high speed crypto algorithms and share them with other developers. Andy's
+//    code runs 30% to 50% faster than C/C++ code. The Cryptogams code can be
+//    disabled in config_asm.h. An example of integrating Andy's code is at
+//    https://wiki.openssl.org/index.php/Cryptogams_SHA.
+
+// use "cl /EP /P /DCRYPTOPP_GENERATE_X64_MASM sha.cpp" to generate MASM code
+
+#include "pch.h"
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4731)
+#endif
+
+#ifndef CRYPTOPP_IMPORTS
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#include "secblock.h"
+#include "sha.h"
+#include "misc.h"
+#include "cpu.h"
+
+#if defined(CRYPTOPP_DISABLE_SHA_ASM)
+# undef CRYPTOPP_X86_ASM_AVAILABLE
+# undef CRYPTOPP_X32_ASM_AVAILABLE
+# undef CRYPTOPP_X64_ASM_AVAILABLE
+# undef CRYPTOPP_SSE2_ASM_AVAILABLE
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if CRYPTOPP_SHANI_AVAILABLE
+extern void SHA1_HashMultipleBlocks_SHANI(word32 *state, const word32 *data, size_t length, ByteOrder order);
+extern void SHA256_HashMultipleBlocks_SHANI(word32 *state, const word32 *data, size_t length, ByteOrder order);
+#endif
+
+#if CRYPTOGAMS_ARM_SHA1
+extern "C" void cryptogams_sha1_block_data_order(word32* state, const word32 *data, size_t blocks);
+extern "C" void cryptogams_sha1_block_data_order_neon(word32* state, const word32 *data, size_t blocks);
+#endif
+
+#if CRYPTOPP_ARM_SHA1_AVAILABLE
+extern void SHA1_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order);
+#endif
+
+#if CRYPTOPP_ARM_SHA2_AVAILABLE
+extern void SHA256_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order);
+#endif
+
+#if CRYPTOGAMS_ARM_SHA256
+extern "C" void cryptogams_sha256_block_data_order(word32* state, const word32 *data, size_t blocks);
+extern "C" void cryptogams_sha256_block_data_order_neon(word32* state, const word32 *data, size_t blocks);
+#endif
+
+#if CRYPTOPP_ARM_SHA512_AVAILABLE
+extern void SHA512_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order);
+#endif
+
+#if CRYPTOPP_POWER8_SHA_AVAILABLE
+extern void SHA256_HashMultipleBlocks_POWER8(word32 *state, const word32 *data, size_t length, ByteOrder order);
+extern void SHA512_HashMultipleBlocks_POWER8(word64 *state, const word64 *data, size_t length, ByteOrder order);
+#endif
+
+#if CRYPTOGAMS_ARM_SHA512
+extern "C" void cryptogams_sha512_block_data_order(word64* state, const word64 *data, size_t blocks);
+extern "C" void cryptogams_sha512_block_data_order_neon(word64* state, const word64 *data, size_t blocks);
+#endif
+
+// We add extern to export table to sha_simd.cpp, but it
+//  cleared http://github.com/weidai11/cryptopp/issues/502
+extern const word32 SHA256_K[64];
+extern const word64 SHA512_K[80];
+
+CRYPTOPP_ALIGN_DATA(16)
+const word64 SHA512_K[80] = {
+    W64LIT(0x428a2f98d728ae22), W64LIT(0x7137449123ef65cd),
+    W64LIT(0xb5c0fbcfec4d3b2f), W64LIT(0xe9b5dba58189dbbc),
+    W64LIT(0x3956c25bf348b538), W64LIT(0x59f111f1b605d019),
+    W64LIT(0x923f82a4af194f9b), W64LIT(0xab1c5ed5da6d8118),
+    W64LIT(0xd807aa98a3030242), W64LIT(0x12835b0145706fbe),
+    W64LIT(0x243185be4ee4b28c), W64LIT(0x550c7dc3d5ffb4e2),
+    W64LIT(0x72be5d74f27b896f), W64LIT(0x80deb1fe3b1696b1),
+    W64LIT(0x9bdc06a725c71235), W64LIT(0xc19bf174cf692694),
+    W64LIT(0xe49b69c19ef14ad2), W64LIT(0xefbe4786384f25e3),
+    W64LIT(0x0fc19dc68b8cd5b5), W64LIT(0x240ca1cc77ac9c65),
+    W64LIT(0x2de92c6f592b0275), W64LIT(0x4a7484aa6ea6e483),
+    W64LIT(0x5cb0a9dcbd41fbd4), W64LIT(0x76f988da831153b5),
+    W64LIT(0x983e5152ee66dfab), W64LIT(0xa831c66d2db43210),
+    W64LIT(0xb00327c898fb213f), W64LIT(0xbf597fc7beef0ee4),
+    W64LIT(0xc6e00bf33da88fc2), W64LIT(0xd5a79147930aa725),
+    W64LIT(0x06ca6351e003826f), W64LIT(0x142929670a0e6e70),
+    W64LIT(0x27b70a8546d22ffc), W64LIT(0x2e1b21385c26c926),
+    W64LIT(0x4d2c6dfc5ac42aed), W64LIT(0x53380d139d95b3df),
+    W64LIT(0x650a73548baf63de), W64LIT(0x766a0abb3c77b2a8),
+    W64LIT(0x81c2c92e47edaee6), W64LIT(0x92722c851482353b),
+    W64LIT(0xa2bfe8a14cf10364), W64LIT(0xa81a664bbc423001),
+    W64LIT(0xc24b8b70d0f89791), W64LIT(0xc76c51a30654be30),
+    W64LIT(0xd192e819d6ef5218), W64LIT(0xd69906245565a910),
+    W64LIT(0xf40e35855771202a), W64LIT(0x106aa07032bbd1b8),
+    W64LIT(0x19a4c116b8d2d0c8), W64LIT(0x1e376c085141ab53),
+    W64LIT(0x2748774cdf8eeb99), W64LIT(0x34b0bcb5e19b48a8),
+    W64LIT(0x391c0cb3c5c95a63), W64LIT(0x4ed8aa4ae3418acb),
+    W64LIT(0x5b9cca4f7763e373), W64LIT(0x682e6ff3d6b2b8a3),
+    W64LIT(0x748f82ee5defb2fc), W64LIT(0x78a5636f43172f60),
+    W64LIT(0x84c87814a1f0ab72), W64LIT(0x8cc702081a6439ec),
+    W64LIT(0x90befffa23631e28), W64LIT(0xa4506cebde82bde9),
+    W64LIT(0xbef9a3f7b2c67915), W64LIT(0xc67178f2e372532b),
+    W64LIT(0xca273eceea26619c), W64LIT(0xd186b8c721c0c207),
+    W64LIT(0xeada7dd6cde0eb1e), W64LIT(0xf57d4f7fee6ed178),
+    W64LIT(0x06f067aa72176fba), W64LIT(0x0a637dc5a2c898a6),
+    W64LIT(0x113f9804bef90dae), W64LIT(0x1b710b35131c471b),
+    W64LIT(0x28db77f523047d84), W64LIT(0x32caab7b40c72493),
+    W64LIT(0x3c9ebe0a15c9bebc), W64LIT(0x431d67c49c100d4c),
+    W64LIT(0x4cc5d4becb3e42b6), W64LIT(0x597f299cfc657e2a),
+    W64LIT(0x5fcb6fab3ad6faec), W64LIT(0x6c44198c4a475817)
+};
+
+CRYPTOPP_ALIGN_DATA(16)
+const word32 SHA256_K[64] = {
+
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
+    0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
+    0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
+    0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
+    0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
+    0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+};
+
+////////////////////////////////
+// start of Steve Reid's code //
+////////////////////////////////
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+#define blk0(i) (W[i] = data[i])
+#define blk1(i) (W[i&15] = rotlConstant<1>(W[(i+13)&15]^W[(i+8)&15]^W[(i+2)&15]^W[i&15]))
+
+#define f1(x,y,z) (z^(x&(y^z)))
+#define f2(x,y,z) (x^y^z)
+#define f3(x,y,z) ((x&y)|(z&(x|y)))
+#define f4(x,y,z) (x^y^z)
+
+/* (R0+R1), R2, R3, R4 are the different operations used in SHA1 */
+#define R0(v,w,x,y,z,i) z+=f1(w,x,y)+blk0(i)+0x5A827999+rotlConstant<5>(v);w=rotlConstant<30>(w);
+#define R1(v,w,x,y,z,i) z+=f1(w,x,y)+blk1(i)+0x5A827999+rotlConstant<5>(v);w=rotlConstant<30>(w);
+#define R2(v,w,x,y,z,i) z+=f2(w,x,y)+blk1(i)+0x6ED9EBA1+rotlConstant<5>(v);w=rotlConstant<30>(w);
+#define R3(v,w,x,y,z,i) z+=f3(w,x,y)+blk1(i)+0x8F1BBCDC+rotlConstant<5>(v);w=rotlConstant<30>(w);
+#define R4(v,w,x,y,z,i) z+=f4(w,x,y)+blk1(i)+0xCA62C1D6+rotlConstant<5>(v);w=rotlConstant<30>(w);
+
+void SHA1_HashBlock_CXX(word32 *state, const word32 *data)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+
+    word32 W[16];
+    /* Copy context->state[] to working vars */
+    word32 a = state[0];
+    word32 b = state[1];
+    word32 c = state[2];
+    word32 d = state[3];
+    word32 e = state[4];
+    /* 4 rounds of 20 operations each. Loop unrolled. */
+    R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
+    R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
+    R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
+    R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
+    R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
+    R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
+    R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
+    R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
+    R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
+    R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
+    R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
+    R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
+    R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
+    R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
+    R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
+    R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
+    R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
+    R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
+    R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
+    R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
+    /* Add the working vars back into context.state[] */
+    state[0] += a;
+    state[1] += b;
+    state[2] += c;
+    state[3] += d;
+    state[4] += e;
+}
+
+#undef blk0
+#undef blk1
+#undef f1
+#undef f2
+#undef f3
+#undef f4
+#undef R1
+#undef R2
+#undef R3
+#undef R4
+
+ANONYMOUS_NAMESPACE_END
+
+//////////////////////////////
+// end of Steve Reid's code //
+//////////////////////////////
+
+std::string SHA1::AlgorithmProvider() const
+{
+#if CRYPTOPP_SHANI_AVAILABLE
+    if (HasSHA())
+        return "SHANI";
+#endif
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+    if (HasSSE2())
+        return "SSE2";
+#endif
+#if CRYPTOGAMS_ARM_SHA1
+# if CRYPTOPP_ARM_NEON_AVAILABLE
+    if (HasNEON())
+        return "NEON";
+    else
+# endif
+    if (HasARMv7())
+        return "ARMv7";
+#endif
+#if CRYPTOPP_ARM_SHA1_AVAILABLE
+    if (HasSHA1())
+        return "ARMv8";
+#endif
+    return "C++";
+}
+
+void SHA1::InitState(HashWordType *state)
+{
+    state[0] = 0x67452301;
+    state[1] = 0xEFCDAB89;
+    state[2] = 0x98BADCFE;
+    state[3] = 0x10325476;
+    state[4] = 0xC3D2E1F0;
+}
+
+void SHA1::Transform(word32 *state, const word32 *data)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+
+#if CRYPTOPP_SHANI_AVAILABLE
+    if (HasSHA())
+    {
+        SHA1_HashMultipleBlocks_SHANI(state, data, SHA1::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
+        return;
+    }
+#endif
+// Disabled at the moment due to MDC and SEAL failures
+#if CRYPTOGAMS_ARM_SHA1 && 0
+# if CRYPTOPP_ARM_NEON_AVAILABLE
+    if (HasNEON())
+    {
+#  if defined(CRYPTOPP_LITTLE_ENDIAN)
+        word32 dataBuf[16];
+        ByteReverse(dataBuf, data, SHA1::BLOCKSIZE);
+        cryptogams_sha1_block_data_order_neon(state, dataBuf, 1);
+#  else
+        cryptogams_sha1_block_data_order_neon(state, data, 1);
+#  endif
+        return;
+    }
+    else
+# endif
+    if (HasARMv7())
+    {
+# if defined(CRYPTOPP_LITTLE_ENDIAN)
+        word32 dataBuf[16];
+        ByteReverse(dataBuf, data, SHA1::BLOCKSIZE);
+        cryptogams_sha1_block_data_order(state, data, 1);
+# else
+        cryptogams_sha1_block_data_order(state, data, 1);
+# endif
+        return;
+    }
+#endif
+#if CRYPTOPP_ARM_SHA1_AVAILABLE
+    if (HasSHA1())
+    {
+        SHA1_HashMultipleBlocks_ARMV8(state, data, SHA1::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
+        return;
+    }
+#endif
+
+    SHA1_HashBlock_CXX(state, data);
+}
+
+size_t SHA1::HashMultipleBlocks(const word32 *input, size_t length)
+{
+    CRYPTOPP_ASSERT(input);
+    CRYPTOPP_ASSERT(length >= SHA1::BLOCKSIZE);
+
+#if CRYPTOPP_SHANI_AVAILABLE
+    if (HasSHA())
+    {
+        SHA1_HashMultipleBlocks_SHANI(m_state, input, length, BIG_ENDIAN_ORDER);
+        return length & (SHA1::BLOCKSIZE - 1);
+    }
+#endif
+#if CRYPTOGAMS_ARM_SHA1
+# if CRYPTOPP_ARM_NEON_AVAILABLE
+    if (HasNEON())
+    {
+        cryptogams_sha1_block_data_order_neon(m_state, input, length / SHA1::BLOCKSIZE);
+        return length & (SHA1::BLOCKSIZE - 1);
+    }
+    else
+# endif
+    if (HasARMv7())
+    {
+        cryptogams_sha1_block_data_order(m_state, input, length / SHA1::BLOCKSIZE);
+        return length & (SHA1::BLOCKSIZE - 1);
+    }
+#endif
+#if CRYPTOPP_ARM_SHA1_AVAILABLE
+    if (HasSHA1())
+    {
+        SHA1_HashMultipleBlocks_ARMV8(m_state, input, length, BIG_ENDIAN_ORDER);
+        return length & (SHA1::BLOCKSIZE - 1);
+    }
+#endif
+
+    const bool noReverse = NativeByteOrderIs(this->GetByteOrder());
+    word32 *dataBuf = this->DataBuf();
+    do
+    {
+        if (noReverse)
+        {
+            SHA1_HashBlock_CXX(m_state, input);
+        }
+        else
+        {
+            ByteReverse(dataBuf, input, SHA1::BLOCKSIZE);
+            SHA1_HashBlock_CXX(m_state, dataBuf);
+        }
+
+        input += SHA1::BLOCKSIZE/sizeof(word32);
+        length -= SHA1::BLOCKSIZE;
+    }
+    while (length >= SHA1::BLOCKSIZE);
+    return length;
+}
+
+// *************************************************************
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+#define a(i) T[(0-i)&7]
+#define b(i) T[(1-i)&7]
+#define c(i) T[(2-i)&7]
+#define d(i) T[(3-i)&7]
+#define e(i) T[(4-i)&7]
+#define f(i) T[(5-i)&7]
+#define g(i) T[(6-i)&7]
+#define h(i) T[(7-i)&7]
+
+#define blk0(i) (W[i] = data[i])
+#define blk2(i) (W[i&15]+=s1(W[(i-2)&15])+W[(i-7)&15]+s0(W[(i-15)&15]))
+
+#define Ch(x,y,z) (z^(x&(y^z)))
+#define Maj(x,y,z) (y^((x^y)&(y^z)))
+
+#define R(i) h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+SHA256_K[i+j]+(j?blk2(i):blk0(i));\
+    d(i)+=h(i);h(i)+=S0(a(i))+Maj(a(i),b(i),c(i))
+
+// for SHA256
+#define s0(x) (rotrConstant<7>(x)^rotrConstant<18>(x)^(x>>3))
+#define s1(x) (rotrConstant<17>(x)^rotrConstant<19>(x)^(x>>10))
+#define S0(x) (rotrConstant<2>(x)^rotrConstant<13>(x)^rotrConstant<22>(x))
+#define S1(x) (rotrConstant<6>(x)^rotrConstant<11>(x)^rotrConstant<25>(x))
+
+void SHA256_HashBlock_CXX(word32 *state, const word32 *data)
+{
+    word32 W[16]={0}, T[8];
+    /* Copy context->state[] to working vars */
+    std::memcpy(T, state, sizeof(T));
+    /* 64 operations, partially loop unrolled */
+    for (unsigned int j=0; j<64; j+=16)
+    {
+        R( 0); R( 1); R( 2); R( 3);
+        R( 4); R( 5); R( 6); R( 7);
+        R( 8); R( 9); R(10); R(11);
+        R(12); R(13); R(14); R(15);
+    }
+    /* Add the working vars back into context.state[] */
+    state[0] += a(0);
+    state[1] += b(0);
+    state[2] += c(0);
+    state[3] += d(0);
+    state[4] += e(0);
+    state[5] += f(0);
+    state[6] += g(0);
+    state[7] += h(0);
+}
+
+#undef Ch
+#undef Maj
+#undef s0
+#undef s1
+#undef S0
+#undef S1
+#undef blk0
+#undef blk1
+#undef blk2
+#undef R
+
+#undef a
+#undef b
+#undef c
+#undef d
+#undef e
+#undef f
+#undef g
+#undef h
+
+ANONYMOUS_NAMESPACE_END
+
+std::string SHA256_AlgorithmProvider()
+{
+#if CRYPTOPP_SHANI_AVAILABLE
+    if (HasSHA())
+        return "SHANI";
+#endif
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+    if (HasSSE2())
+        return "SSE2";
+#endif
+#if CRYPTOGAMS_ARM_SHA256
+# if CRYPTOPP_ARM_NEON_AVAILABLE
+    if (HasNEON())
+        return "NEON";
+    else
+# endif
+    if (HasARMv7())
+        return "ARMv7";
+#endif
+#if CRYPTOPP_ARM_SHA2_AVAILABLE
+    if (HasSHA2())
+        return "ARMv8";
+#endif
+#if (CRYPTOPP_POWER8_SHA_AVAILABLE)
+    if (HasSHA256())
+        return "Power8";
+#endif
+    return "C++";
+}
+
+std::string SHA224::AlgorithmProvider() const
+{
+    return SHA256_AlgorithmProvider();
+}
+
+void SHA224::InitState(HashWordType *state)
+{
+    static const word32 s[8] = {
+        0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939,
+        0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4};
+    std::memcpy(state, s, sizeof(s));
+}
+
+void SHA256::InitState(HashWordType *state)
+{
+    static const word32 s[8] = {
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+        0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19};
+    std::memcpy(state, s, sizeof(s));
+}
+#endif // Not CRYPTOPP_GENERATE_X64_MASM
+
+#if defined(CRYPTOPP_X86_ASM_AVAILABLE)
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+void CRYPTOPP_FASTCALL SHA256_HashMultipleBlocks_SSE2(word32 *state, const word32 *data, size_t len)
+{
+    // Due to the inline asm
+    CRYPTOPP_UNUSED(state);
+    CRYPTOPP_UNUSED(data);
+    CRYPTOPP_UNUSED(len);
+
+    #define LOCALS_SIZE  8*4 + 16*4 + 4*WORD_SZ
+    #define H(i)         [BASE+ASM_MOD(1024+7-(i),8)*4]
+    #define G(i)         H(i+1)
+    #define F(i)         H(i+2)
+    #define E(i)         H(i+3)
+    #define D(i)         H(i+4)
+    #define C(i)         H(i+5)
+    #define B(i)         H(i+6)
+    #define A(i)         H(i+7)
+    #define Wt(i)        BASE+8*4+ASM_MOD(1024+15-(i),16)*4
+    #define Wt_2(i)      Wt((i)-2)
+    #define Wt_15(i)     Wt((i)-15)
+    #define Wt_7(i)      Wt((i)-7)
+    #define K_END        [BASE+8*4+16*4+0*WORD_SZ]
+    #define STATE_SAVE   [BASE+8*4+16*4+1*WORD_SZ]
+    #define DATA_SAVE    [BASE+8*4+16*4+2*WORD_SZ]
+    #define DATA_END     [BASE+8*4+16*4+3*WORD_SZ]
+    #define Kt(i)        WORD_REG(si)+(i)*4
+#if CRYPTOPP_BOOL_X86
+    #define BASE         esp+4
+#elif defined(__GNUC__)
+    #define BASE         r8
+#else
+    #define BASE         rsp
+#endif
+
+#define RA0(i, edx, edi)        \
+    AS2(    add edx, [Kt(i)]   )\
+    AS2(    add edx, [Wt(i)]   )\
+    AS2(    add edx, H(i)      )\
+
+#define RA1(i, edx, edi)
+
+#define RB0(i, edx, edi)
+
+#define RB1(i, edx, edi)    \
+    AS2(    mov AS_REG_7d, [Wt_2(i)]    )\
+    AS2(    mov edi, [Wt_15(i)])\
+    AS2(    mov ebx, AS_REG_7d    )\
+    AS2(    shr AS_REG_7d, 10        )\
+    AS2(    ror ebx, 17        )\
+    AS2(    xor AS_REG_7d, ebx    )\
+    AS2(    ror ebx, 2        )\
+    AS2(    xor ebx, AS_REG_7d    )/* s1(W_t-2) */\
+    AS2(    add ebx, [Wt_7(i)])\
+    AS2(    mov AS_REG_7d, edi    )\
+    AS2(    shr AS_REG_7d, 3        )\
+    AS2(    ror edi, 7        )\
+    AS2(    add ebx, [Wt(i)])/* s1(W_t-2) + W_t-7 + W_t-16 */\
+    AS2(    xor AS_REG_7d, edi    )\
+    AS2(    add edx, [Kt(i)])\
+    AS2(    ror edi, 11        )\
+    AS2(    add edx, H(i)    )\
+    AS2(    xor AS_REG_7d, edi    )/* s0(W_t-15) */\
+    AS2(    add AS_REG_7d, ebx    )/* W_t = s1(W_t-2) + W_t-7 + s0(W_t-15) W_t-16*/\
+    AS2(    mov [Wt(i)], AS_REG_7d)\
+    AS2(    add edx, AS_REG_7d    )\
+
+#define ROUND(i, r, eax, ecx, edi, edx)\
+    /* in: edi = E    */\
+    /* unused: eax, ecx, temp: ebx, AS_REG_7d, out: edx = T1 */\
+    AS2(    mov edx, F(i)      )\
+    AS2(    xor edx, G(i)      )\
+    AS2(    and edx, edi       )\
+    AS2(    xor edx, G(i)      )/* Ch(E,F,G) = (G^(E&(F^G))) */\
+    AS2(    mov AS_REG_7d, edi )\
+    AS2(    ror edi, 6         )\
+    AS2(    ror AS_REG_7d, 25  )\
+    RA##r(i, edx, edi          )/* H + Wt + Kt + Ch(E,F,G) */\
+    AS2(    xor AS_REG_7d, edi )\
+    AS2(    ror edi, 5         )\
+    AS2(    xor AS_REG_7d, edi )/* S1(E) */\
+    AS2(    add edx, AS_REG_7d )/* T1 = S1(E) + Ch(E,F,G) + H + Wt + Kt */\
+    RB##r(i, edx, edi          )/* H + Wt + Kt + Ch(E,F,G) */\
+    /* in: ecx = A, eax = B^C, edx = T1 */\
+    /* unused: edx, temp: ebx, AS_REG_7d, out: eax = A, ecx = B^C, edx = E */\
+    AS2(    mov ebx, ecx       )\
+    AS2(    xor ecx, B(i)      )/* A^B */\
+    AS2(    and eax, ecx       )\
+    AS2(    xor eax, B(i)      )/* Maj(A,B,C) = B^((A^B)&(B^C) */\
+    AS2(    mov AS_REG_7d, ebx )\
+    AS2(    ror ebx, 2         )\
+    AS2(    add eax, edx       )/* T1 + Maj(A,B,C) */\
+    AS2(    add edx, D(i)      )\
+    AS2(    mov D(i), edx      )\
+    AS2(    ror AS_REG_7d, 22  )\
+    AS2(    xor AS_REG_7d, ebx )\
+    AS2(    ror ebx, 11        )\
+    AS2(    xor AS_REG_7d, ebx )\
+    AS2(    add eax, AS_REG_7d )/* T1 + S0(A) + Maj(A,B,C) */\
+    AS2(    mov H(i), eax      )\
+
+// Unroll the use of CRYPTOPP_BOOL_X64 in assembler math. The GAS assembler on X32 (version 2.25)
+//   complains "Error: invalid operands (*ABS* and *UND* sections) for `*` and `-`"
+#if CRYPTOPP_BOOL_X64
+#define SWAP_COPY(i)        \
+    AS2(    mov        WORD_REG(bx), [WORD_REG(dx)+i*WORD_SZ])\
+    AS1(    bswap      WORD_REG(bx))\
+    AS2(    mov        [Wt(i*2+1)], WORD_REG(bx))
+#else // X86 and X32
+#define SWAP_COPY(i)        \
+    AS2(    mov        WORD_REG(bx), [WORD_REG(dx)+i*WORD_SZ])\
+    AS1(    bswap      WORD_REG(bx))\
+    AS2(    mov        [Wt(i)], WORD_REG(bx))
+#endif
+
+#if defined(__GNUC__)
+    #if CRYPTOPP_BOOL_X64
+        FixedSizeAlignedSecBlock<byte, LOCALS_SIZE> workspace;
+    #endif
+    __asm__ __volatile__
+    (
+    #if CRYPTOPP_BOOL_X64
+        "lea %4, %%r8;"
+    #endif
+    INTEL_NOPREFIX
+#elif defined(CRYPTOPP_GENERATE_X64_MASM)
+        ALIGN   8
+    SHA256_HashMultipleBlocks_SSE2    PROC FRAME
+        rex_push_reg rsi
+        push_reg rdi
+        push_reg rbx
+        push_reg rbp
+        alloc_stack(LOCALS_SIZE+8)
+        .endprolog
+        mov rdi, r8
+        lea rsi, [?SHA256_K@CryptoPP@@3QBIB + 48*4]
+#endif
+
+#if CRYPTOPP_BOOL_X86
+    #ifndef __GNUC__
+        AS2(    mov        edi, [len])
+        AS2(    lea        WORD_REG(si), [SHA256_K+48*4])
+    #endif
+    #if !defined(CRYPTOPP_MSC_VERSION) || (CRYPTOPP_MSC_VERSION < 1400)
+        AS_PUSH_IF86(bx)
+    #endif
+
+    AS_PUSH_IF86(bp)
+    AS2(    mov        ebx, esp)
+    AS2(    and        esp, -16)
+    AS2(    sub        WORD_REG(sp), LOCALS_SIZE)
+    AS_PUSH_IF86(bx)
+#endif
+    AS2(    mov        STATE_SAVE, WORD_REG(cx))
+    AS2(    mov        DATA_SAVE, WORD_REG(dx))
+    AS2(    lea        WORD_REG(ax), [WORD_REG(di) + WORD_REG(dx)])
+    AS2(    mov        DATA_END, WORD_REG(ax))
+    AS2(    mov        K_END, WORD_REG(si))
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+#if CRYPTOPP_BOOL_X86
+    AS2(    test    edi, 1)
+    ASJ(    jnz,    2, f)
+    AS1(    dec        DWORD PTR K_END)
+#endif
+    AS2(    movdqu    xmm0, XMMWORD_PTR [WORD_REG(cx)+0*16])
+    AS2(    movdqu    xmm1, XMMWORD_PTR [WORD_REG(cx)+1*16])
+#endif
+
+#if CRYPTOPP_BOOL_X86
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+    ASJ(    jmp,    0, f)
+#endif
+    ASL(2)    // non-SSE2
+    AS2(    mov        esi, ecx)
+    AS2(    lea        edi, A(0))
+    AS2(    mov        ecx, 8)
+ATT_NOPREFIX
+    AS1(    rep movsd)
+INTEL_NOPREFIX
+    AS2(    mov        esi, K_END)
+    ASJ(    jmp,    3, f)
+#endif
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+    ASL(0)
+    AS2(    movdqu    E(0), xmm1)
+    AS2(    movdqu    A(0), xmm0)
+#endif
+#if CRYPTOPP_BOOL_X86
+    ASL(3)
+#endif
+    AS2(    sub        WORD_REG(si), 48*4)
+    SWAP_COPY(0)    SWAP_COPY(1)    SWAP_COPY(2)    SWAP_COPY(3)
+    SWAP_COPY(4)    SWAP_COPY(5)    SWAP_COPY(6)    SWAP_COPY(7)
+#if CRYPTOPP_BOOL_X86
+    SWAP_COPY(8)    SWAP_COPY(9)    SWAP_COPY(10)    SWAP_COPY(11)
+    SWAP_COPY(12)    SWAP_COPY(13)    SWAP_COPY(14)    SWAP_COPY(15)
+#endif
+    AS2(    mov        edi, E(0))    // E
+    AS2(    mov        eax, B(0))    // B
+    AS2(    xor        eax, C(0))    // B^C
+    AS2(    mov        ecx, A(0))    // A
+
+    ROUND(0, 0, eax, ecx, edi, edx)
+    ROUND(1, 0, ecx, eax, edx, edi)
+    ROUND(2, 0, eax, ecx, edi, edx)
+    ROUND(3, 0, ecx, eax, edx, edi)
+    ROUND(4, 0, eax, ecx, edi, edx)
+    ROUND(5, 0, ecx, eax, edx, edi)
+    ROUND(6, 0, eax, ecx, edi, edx)
+    ROUND(7, 0, ecx, eax, edx, edi)
+    ROUND(8, 0, eax, ecx, edi, edx)
+    ROUND(9, 0, ecx, eax, edx, edi)
+    ROUND(10, 0, eax, ecx, edi, edx)
+    ROUND(11, 0, ecx, eax, edx, edi)
+    ROUND(12, 0, eax, ecx, edi, edx)
+    ROUND(13, 0, ecx, eax, edx, edi)
+    ROUND(14, 0, eax, ecx, edi, edx)
+    ROUND(15, 0, ecx, eax, edx, edi)
+
+    ASL(1)
+    AS2(add WORD_REG(si), 4*16)
+    ROUND(0, 1, eax, ecx, edi, edx)
+    ROUND(1, 1, ecx, eax, edx, edi)
+    ROUND(2, 1, eax, ecx, edi, edx)
+    ROUND(3, 1, ecx, eax, edx, edi)
+    ROUND(4, 1, eax, ecx, edi, edx)
+    ROUND(5, 1, ecx, eax, edx, edi)
+    ROUND(6, 1, eax, ecx, edi, edx)
+    ROUND(7, 1, ecx, eax, edx, edi)
+    ROUND(8, 1, eax, ecx, edi, edx)
+    ROUND(9, 1, ecx, eax, edx, edi)
+    ROUND(10, 1, eax, ecx, edi, edx)
+    ROUND(11, 1, ecx, eax, edx, edi)
+    ROUND(12, 1, eax, ecx, edi, edx)
+    ROUND(13, 1, ecx, eax, edx, edi)
+    ROUND(14, 1, eax, ecx, edi, edx)
+    ROUND(15, 1, ecx, eax, edx, edi)
+    AS2(    cmp        WORD_REG(si), K_END)
+    ATT_NOPREFIX
+    ASJ(    jb,        1, b)
+    INTEL_NOPREFIX
+
+    AS2(    mov        WORD_REG(dx), DATA_SAVE)
+    AS2(    add        WORD_REG(dx), 64)
+    AS2(    mov        AS_REG_7, STATE_SAVE)
+    AS2(    mov        DATA_SAVE, WORD_REG(dx))
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+#if CRYPTOPP_BOOL_X86
+    AS2(    test    DWORD PTR K_END, 1)
+    ASJ(    jz,        4, f)
+#endif
+    AS2(    movdqu    xmm1, XMMWORD_PTR [AS_REG_7+1*16])
+    AS2(    movdqu    xmm0, XMMWORD_PTR [AS_REG_7+0*16])
+    AS2(    paddd     xmm1, E(0))
+    AS2(    paddd     xmm0, A(0))
+    AS2(    movdqu    [AS_REG_7+1*16], xmm1)
+    AS2(    movdqu    [AS_REG_7+0*16], xmm0)
+    AS2(    cmp       WORD_REG(dx), DATA_END)
+    ATT_NOPREFIX
+    ASJ(    jb,        0, b)
+    INTEL_NOPREFIX
+#endif
+
+#if CRYPTOPP_BOOL_X86
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+    ASJ(    jmp,    5, f)
+    ASL(4)    // non-SSE2
+#endif
+    AS2(    add        [AS_REG_7+0*4], ecx)    // A
+    AS2(    add        [AS_REG_7+4*4], edi)    // E
+    AS2(    mov        eax, B(0))
+    AS2(    mov        ebx, C(0))
+    AS2(    mov        ecx, D(0))
+    AS2(    add        [AS_REG_7+1*4], eax)
+    AS2(    add        [AS_REG_7+2*4], ebx)
+    AS2(    add        [AS_REG_7+3*4], ecx)
+    AS2(    mov        eax, F(0))
+    AS2(    mov        ebx, G(0))
+    AS2(    mov        ecx, H(0))
+    AS2(    add        [AS_REG_7+5*4], eax)
+    AS2(    add        [AS_REG_7+6*4], ebx)
+    AS2(    add        [AS_REG_7+7*4], ecx)
+    AS2(    mov        ecx, AS_REG_7d)
+    AS2(    cmp        WORD_REG(dx), DATA_END)
+    ASJ(    jb,        2, b)
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+    ASL(5)
+#endif
+#endif
+
+    AS_POP_IF86(sp)
+    AS_POP_IF86(bp)
+    #if !defined(CRYPTOPP_MSC_VERSION) || (CRYPTOPP_MSC_VERSION < 1400)
+        AS_POP_IF86(bx)
+    #endif
+
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+    add        rsp, LOCALS_SIZE+8
+    pop        rbp
+    pop        rbx
+    pop        rdi
+    pop        rsi
+    ret
+    SHA256_HashMultipleBlocks_SSE2 ENDP
+#endif
+
+#ifdef __GNUC__
+    ATT_PREFIX
+    :
+    : "c" (state), "d" (data), "S" (SHA256_K+48), "D" (len)
+    #if (CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+        , "m" (workspace[0])
+    #endif
+    : "memory", "cc", "%eax"
+    #if (CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+        , PERCENT_REG(AS_REG_7), "%rbx", "%r8", "%r10", "%xmm0", "%xmm1"
+    #else
+        , "%ebx"
+    #endif
+    );
+#endif
+}
+
+ANONYMOUS_NAMESPACE_END
+
+#endif    // CRYPTOPP_X86_ASM_AVAILABLE
+
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+extern "C" {
+void CRYPTOPP_FASTCALL SHA256_HashMultipleBlocks_SSE2(word32 *state, const word32 *data, size_t len);
+}
+#endif
+
+std::string SHA256::AlgorithmProvider() const
+{
+    return SHA256_AlgorithmProvider();
+}
+
+void SHA256::Transform(word32 *state, const word32 *data)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+
+#if CRYPTOPP_SHANI_AVAILABLE
+    if (HasSHA())
+    {
+        SHA256_HashMultipleBlocks_SHANI(state, data, SHA256::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
+        return;
+    }
+#endif
+// Disabled at the moment due to MDC and SEAL failures
+#if CRYPTOGAMS_ARM_SHA256 && 0
+# if CRYPTOPP_ARM_NEON_AVAILABLE
+    if (HasNEON())
+    {
+#  if defined(CRYPTOPP_LITTLE_ENDIAN)
+        word32 dataBuf[16];
+        ByteReverse(dataBuf, data, SHA256::BLOCKSIZE);
+        cryptogams_sha256_block_data_order_neon(state, dataBuf, 1);
+#  else
+        cryptogams_sha256_block_data_order_neon(state, data, 1);
+#  endif
+        return;
+    }
+    else
+# endif
+    if (HasARMv7())
+    {
+# if defined(CRYPTOPP_LITTLE_ENDIAN)
+        word32 dataBuf[16];
+        ByteReverse(dataBuf, data, SHA256::BLOCKSIZE);
+        cryptogams_sha256_block_data_order(state, data, 1);
+# else
+        cryptogams_sha256_block_data_order(state, data, 1);
+# endif
+        return;
+    }
+#endif
+#if CRYPTOPP_ARM_SHA2_AVAILABLE
+    if (HasSHA2())
+    {
+        SHA256_HashMultipleBlocks_ARMV8(state, data, SHA256::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
+        return;
+    }
+#endif
+#if CRYPTOPP_POWER8_SHA_AVAILABLE
+    if (HasSHA256())
+    {
+        SHA256_HashMultipleBlocks_POWER8(state, data, SHA256::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
+        return;
+    }
+#endif
+
+    SHA256_HashBlock_CXX(state, data);
+}
+
+size_t SHA256::HashMultipleBlocks(const word32 *input, size_t length)
+{
+    CRYPTOPP_ASSERT(input);
+    CRYPTOPP_ASSERT(length >= SHA256::BLOCKSIZE);
+
+#if CRYPTOPP_SHANI_AVAILABLE
+    if (HasSHA())
+    {
+        SHA256_HashMultipleBlocks_SHANI(m_state, input, length, BIG_ENDIAN_ORDER);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+#endif
+#if CRYPTOPP_SSE2_ASM_AVAILABLE || CRYPTOPP_X64_MASM_AVAILABLE
+    if (HasSSE2())
+    {
+        const size_t res = length & (SHA256::BLOCKSIZE - 1);
+        SHA256_HashMultipleBlocks_SSE2(m_state, input, length-res);
+        return res;
+    }
+#endif
+#if CRYPTOGAMS_ARM_SHA256
+# if CRYPTOPP_ARM_NEON_AVAILABLE
+    if (HasNEON())
+    {
+        cryptogams_sha256_block_data_order_neon(m_state, input, length / SHA256::BLOCKSIZE);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+    else
+# endif
+    if (HasARMv7())
+    {
+        cryptogams_sha256_block_data_order(m_state, input, length / SHA256::BLOCKSIZE);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+#endif
+#if CRYPTOPP_ARM_SHA2_AVAILABLE
+    if (HasSHA2())
+    {
+        SHA256_HashMultipleBlocks_ARMV8(m_state, input, length, BIG_ENDIAN_ORDER);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+#endif
+#if CRYPTOPP_POWER8_SHA_AVAILABLE
+    if (HasSHA256())
+    {
+        SHA256_HashMultipleBlocks_POWER8(m_state, input, length, BIG_ENDIAN_ORDER);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+#endif
+
+    const bool noReverse = NativeByteOrderIs(this->GetByteOrder());
+    word32 *dataBuf = this->DataBuf();
+    do
+    {
+        if (noReverse)
+        {
+            SHA256_HashBlock_CXX(m_state, input);
+        }
+        else
+        {
+            ByteReverse(dataBuf, input, SHA256::BLOCKSIZE);
+            SHA256_HashBlock_CXX(m_state, dataBuf);
+        }
+
+        input += SHA256::BLOCKSIZE/sizeof(word32);
+        length -= SHA256::BLOCKSIZE;
+    }
+    while (length >= SHA256::BLOCKSIZE);
+    return length;
+}
+
+size_t SHA224::HashMultipleBlocks(const word32 *input, size_t length)
+{
+    CRYPTOPP_ASSERT(input);
+    CRYPTOPP_ASSERT(length >= SHA256::BLOCKSIZE);
+
+#if CRYPTOPP_SHANI_AVAILABLE
+    if (HasSHA())
+    {
+        SHA256_HashMultipleBlocks_SHANI(m_state, input, length, BIG_ENDIAN_ORDER);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+#endif
+#if CRYPTOPP_SSE2_ASM_AVAILABLE || CRYPTOPP_X64_MASM_AVAILABLE
+    if (HasSSE2())
+    {
+        const size_t res = length & (SHA256::BLOCKSIZE - 1);
+        SHA256_HashMultipleBlocks_SSE2(m_state, input, length-res);
+        return res;
+    }
+#endif
+#if CRYPTOGAMS_ARM_SHA256
+# if CRYPTOPP_ARM_NEON_AVAILABLE
+    if (HasNEON())
+    {
+        cryptogams_sha256_block_data_order_neon(m_state, input, length / SHA256::BLOCKSIZE);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+    else
+# endif
+    if (HasARMv7())
+    {
+        cryptogams_sha256_block_data_order(m_state, input, length / SHA256::BLOCKSIZE);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+#endif
+#if CRYPTOPP_ARM_SHA2_AVAILABLE
+    if (HasSHA2())
+    {
+        SHA256_HashMultipleBlocks_ARMV8(m_state, input, length, BIG_ENDIAN_ORDER);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+#endif
+#if CRYPTOPP_POWER8_SHA_AVAILABLE
+    if (HasSHA256())
+    {
+        SHA256_HashMultipleBlocks_POWER8(m_state, input, length, BIG_ENDIAN_ORDER);
+        return length & (SHA256::BLOCKSIZE - 1);
+    }
+#endif
+
+    const bool noReverse = NativeByteOrderIs(this->GetByteOrder());
+    word32 *dataBuf = this->DataBuf();
+    do
+    {
+        if (noReverse)
+        {
+            SHA256_HashBlock_CXX(m_state, input);
+        }
+        else
+        {
+            ByteReverse(dataBuf, input, SHA256::BLOCKSIZE);
+            SHA256_HashBlock_CXX(m_state, dataBuf);
+        }
+
+        input += SHA256::BLOCKSIZE/sizeof(word32);
+        length -= SHA256::BLOCKSIZE;
+    }
+    while (length >= SHA256::BLOCKSIZE);
+    return length;
+}
+
+// *************************************************************
+
+std::string SHA512_AlgorithmProvider()
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+    if (HasSSE2())
+        return "SSE2";
+#endif
+#if CRYPTOGAMS_ARM_SHA512
+# if CRYPTOPP_ARM_NEON_AVAILABLE
+    if (HasNEON())
+        return "NEON";
+    else
+# endif
+    if (HasARMv7())
+        return "ARMv7";
+#endif
+#if (CRYPTOPP_POWER8_SHA_AVAILABLE)
+    if (HasSHA512())
+        return "Power8";
+#endif
+    return "C++";
+}
+
+std::string SHA384::AlgorithmProvider() const
+{
+    return SHA512_AlgorithmProvider();
+}
+
+std::string SHA512::AlgorithmProvider() const
+{
+    return SHA512_AlgorithmProvider();
+}
+
+void SHA384::InitState(HashWordType *state)
+{
+    const word64 s[8] = {
+        W64LIT(0xcbbb9d5dc1059ed8), W64LIT(0x629a292a367cd507),
+        W64LIT(0x9159015a3070dd17), W64LIT(0x152fecd8f70e5939),
+        W64LIT(0x67332667ffc00b31), W64LIT(0x8eb44a8768581511),
+        W64LIT(0xdb0c2e0d64f98fa7), W64LIT(0x47b5481dbefa4fa4)};
+    std::memcpy(state, s, sizeof(s));
+}
+
+void SHA512::InitState(HashWordType *state)
+{
+    const word64 s[8] = {
+        W64LIT(0x6a09e667f3bcc908), W64LIT(0xbb67ae8584caa73b),
+        W64LIT(0x3c6ef372fe94f82b), W64LIT(0xa54ff53a5f1d36f1),
+        W64LIT(0x510e527fade682d1), W64LIT(0x9b05688c2b3e6c1f),
+        W64LIT(0x1f83d9abfb41bd6b), W64LIT(0x5be0cd19137e2179)};
+    std::memcpy(state, s, sizeof(s));
+}
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE && (CRYPTOPP_BOOL_X86)
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+// No inlining due to https://github.com/weidai11/cryptopp/issues/684
+//   g++ -DNDEBUG -g2 -O3 -pthread -pipe -c sha.cpp
+//   sha.cpp: Assembler messages:
+//   sha.cpp:1155: Error: symbol `SHA512_Round' is already defined
+//   sha.cpp:1155: Error: symbol `SHA512_Round' is already defined
+
+CRYPTOPP_NOINLINE CRYPTOPP_NAKED
+void CRYPTOPP_FASTCALL SHA512_HashBlock_SSE2(word64 *state, const word64 *data)
+{
+    // Due to the inline asm
+    CRYPTOPP_UNUSED(state);
+    CRYPTOPP_UNUSED(data);
+
+#ifdef __GNUC__
+    __asm__ __volatile__
+    (
+    INTEL_NOPREFIX
+    AS_PUSH_IF86(    bx)
+    AS2(    mov      ebx, eax)
+#else
+    AS1(    push     ebx)
+    AS1(    push     esi)
+    AS1(    push     edi)
+    AS2(    lea      ebx, SHA512_K)
+#endif
+
+    AS2(    mov      eax, esp)
+    AS2(    and      esp, 0xfffffff0)
+    AS2(    sub      esp, 27*16)                // 17*16 for expanded data, 20*8 for state
+    AS_PUSH_IF86(    ax)
+    AS2(    xor      eax, eax)
+
+    AS2(    lea      edi, [esp+4+8*8])        // start at middle of state buffer. will decrement pointer each round to avoid copying
+    AS2(    lea      esi, [esp+4+20*8+8])    // 16-byte alignment, then add 8
+
+    AS2(    movdqu   xmm0, [ecx+0*16])
+    AS2(    movdq2q  mm4, xmm0)
+    AS2(    movdqu   [edi+0*16], xmm0)
+    AS2(    movdqu   xmm0, [ecx+1*16])
+    AS2(    movdqu   [edi+1*16], xmm0)
+    AS2(    movdqu   xmm0, [ecx+2*16])
+    AS2(    movdq2q  mm5, xmm0)
+    AS2(    movdqu   [edi+2*16], xmm0)
+    AS2(    movdqu   xmm0, [ecx+3*16])
+    AS2(    movdqu   [edi+3*16], xmm0)
+    ASJ(    jmp,     0, f)
+
+#define SSE2_S0_S1(r, a, b, c)    \
+    AS2(    movq     mm6, r)\
+    AS2(    psrlq    r, a)\
+    AS2(    movq     mm7, r)\
+    AS2(    psllq    mm6, 64-c)\
+    AS2(    pxor     mm7, mm6)\
+    AS2(    psrlq    r, b-a)\
+    AS2(    pxor     mm7, r)\
+    AS2(    psllq    mm6, c-b)\
+    AS2(    pxor     mm7, mm6)\
+    AS2(    psrlq    r, c-b)\
+    AS2(    pxor     r, mm7)\
+    AS2(    psllq    mm6, b-a)\
+    AS2(    pxor     r, mm6)
+
+#define SSE2_s0(r, a, b, c)    \
+    AS2(    movdqu   xmm6, r)\
+    AS2(    psrlq    r, a)\
+    AS2(    movdqu   xmm7, r)\
+    AS2(    psllq    xmm6, 64-c)\
+    AS2(    pxor     xmm7, xmm6)\
+    AS2(    psrlq    r, b-a)\
+    AS2(    pxor     xmm7, r)\
+    AS2(    psrlq    r, c-b)\
+    AS2(    pxor     r, xmm7)\
+    AS2(    psllq    xmm6, c-a)\
+    AS2(    pxor     r, xmm6)
+
+#define SSE2_s1(r, a, b, c)    \
+    AS2(    movdqu   xmm6, r)\
+    AS2(    psrlq    r, a)\
+    AS2(    movdqu   xmm7, r)\
+    AS2(    psllq    xmm6, 64-c)\
+    AS2(    pxor     xmm7, xmm6)\
+    AS2(    psrlq    r, b-a)\
+    AS2(    pxor     xmm7, r)\
+    AS2(    psllq    xmm6, c-b)\
+    AS2(    pxor     xmm7, xmm6)\
+    AS2(    psrlq    r, c-b)\
+    AS2(    pxor     r, xmm7)
+    ASL(SHA512_Round)
+
+    // k + w is in mm0, a is in mm4, e is in mm5
+    AS2(    paddq    mm0, [edi+7*8])      // h
+    AS2(    movq     mm2, [edi+5*8])      // f
+    AS2(    movq     mm3, [edi+6*8])      // g
+    AS2(    pxor     mm2, mm3)
+    AS2(    pand     mm2, mm5)
+    SSE2_S0_S1(mm5,14,18,41)
+    AS2(    pxor     mm2, mm3)
+    AS2(    paddq    mm0, mm2)            // h += Ch(e,f,g)
+    AS2(    paddq    mm5, mm0)            // h += S1(e)
+    AS2(    movq     mm2, [edi+1*8])      // b
+    AS2(    movq     mm1, mm2)
+    AS2(    por      mm2, mm4)
+    AS2(    pand     mm2, [edi+2*8])      // c
+    AS2(    pand     mm1, mm4)
+    AS2(    por      mm1, mm2)
+    AS2(    paddq    mm1, mm5)            // temp = h + Maj(a,b,c)
+    AS2(    paddq    mm5, [edi+3*8])      // e = d + h
+    AS2(    movq     [edi+3*8], mm5)
+    AS2(    movq     [edi+11*8], mm5)
+    SSE2_S0_S1(mm4,28,34,39)              // S0(a)
+    AS2(    paddq    mm4, mm1)            // a = temp + S0(a)
+    AS2(    movq     [edi-8], mm4)
+    AS2(    movq     [edi+7*8], mm4)
+    AS1(    ret)
+
+    // first 16 rounds
+    ASL(0)
+    AS2(    movq     mm0, [edx+eax*8])
+    AS2(    movq     [esi+eax*8], mm0)
+    AS2(    movq     [esi+eax*8+16*8], mm0)
+    AS2(    paddq    mm0, [ebx+eax*8])
+    ASC(    call,    SHA512_Round)
+
+    AS1(    inc      eax)
+    AS2(    sub      edi, 8)
+    AS2(    test     eax, 7)
+    ASJ(    jnz,     0, b)
+    AS2(    add      edi, 8*8)
+    AS2(    cmp      eax, 16)
+    ASJ(    jne,     0, b)
+
+    // rest of the rounds
+    AS2(    movdqu   xmm0, [esi+(16-2)*8])
+    ASL(1)
+    // data expansion, W[i-2] already in xmm0
+    AS2(    movdqu   xmm3, [esi])
+    AS2(    paddq    xmm3, [esi+(16-7)*8])
+    AS2(    movdqu   xmm2, [esi+(16-15)*8])
+    SSE2_s1(xmm0, 6, 19, 61)
+    AS2(    paddq    xmm0, xmm3)
+    SSE2_s0(xmm2, 1, 7, 8)
+    AS2(    paddq    xmm0, xmm2)
+    AS2(    movdq2q  mm0, xmm0)
+    AS2(    movhlps  xmm1, xmm0)
+    AS2(    paddq    mm0, [ebx+eax*8])
+    AS2(    movlps   [esi], xmm0)
+    AS2(    movlps   [esi+8], xmm1)
+    AS2(    movlps   [esi+8*16], xmm0)
+    AS2(    movlps   [esi+8*17], xmm1)
+    // 2 rounds
+    ASC(    call,    SHA512_Round)
+    AS2(    sub      edi, 8)
+    AS2(    movdq2q  mm0, xmm1)
+    AS2(    paddq    mm0, [ebx+eax*8+8])
+    ASC(    call,    SHA512_Round)
+    // update indices and loop
+    AS2(    add      esi, 16)
+    AS2(    add      eax, 2)
+    AS2(    sub      edi, 8)
+    AS2(    test     eax, 7)
+    ASJ(    jnz,     1, b)
+    // do housekeeping every 8 rounds
+    AS2(    mov      esi, 0xf)
+    AS2(    and      esi, eax)
+    AS2(    lea      esi, [esp+4+20*8+8+esi*8])
+    AS2(    add      edi, 8*8)
+    AS2(    cmp      eax, 80)
+    ASJ(    jne,     1, b)
+
+#define SSE2_CombineState(i)    \
+    AS2(    movdqu   xmm0, [edi+i*16])\
+    AS2(    paddq    xmm0, [ecx+i*16])\
+    AS2(    movdqu   [ecx+i*16], xmm0)
+
+    SSE2_CombineState(0)
+    SSE2_CombineState(1)
+    SSE2_CombineState(2)
+    SSE2_CombineState(3)
+
+    AS_POP_IF86(    sp)
+    AS1(    emms)
+
+#if defined(__GNUC__)
+    AS_POP_IF86(    bx)
+    ATT_PREFIX
+        :
+        : "a" (SHA512_K), "c" (state), "d" (data)
+        : "%ebx", "%esi", "%edi", "memory", "cc"
+#if (CRYPTOPP_BOOL_X64)
+        , "%mm0", "%mm1", "%mm2", "%mm3", "%mm4", "%mm5",
+          "%xmm0", "%xmm1", "%xmm2", "%xmm3", "%xmm4", "%xmm5", "%xmm6", "%xmm7"
+#endif
+    );
+#else
+    AS1(    pop        edi)
+    AS1(    pop        esi)
+    AS1(    pop        ebx)
+    AS1(    ret)
+#endif
+}
+
+ANONYMOUS_NAMESPACE_END
+
+#endif    // CRYPTOPP_SSE2_ASM_AVAILABLE
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+#define a(i) T[(0-i)&7]
+#define b(i) T[(1-i)&7]
+#define c(i) T[(2-i)&7]
+#define d(i) T[(3-i)&7]
+#define e(i) T[(4-i)&7]
+#define f(i) T[(5-i)&7]
+#define g(i) T[(6-i)&7]
+#define h(i) T[(7-i)&7]
+
+#define blk0(i) (W[i]=data[i])
+#define blk2(i) (W[i&15]+=s1(W[(i-2)&15])+W[(i-7)&15]+s0(W[(i-15)&15]))
+
+#define Ch(x,y,z) (z^(x&(y^z)))
+#define Maj(x,y,z) (y^((x^y)&(y^z)))
+
+#define s0(x) (rotrConstant<1>(x)^rotrConstant<8>(x)^(x>>7))
+#define s1(x) (rotrConstant<19>(x)^rotrConstant<61>(x)^(x>>6))
+#define S0(x) (rotrConstant<28>(x)^rotrConstant<34>(x)^rotrConstant<39>(x))
+#define S1(x) (rotrConstant<14>(x)^rotrConstant<18>(x)^rotrConstant<41>(x))
+
+#define R(i) h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+SHA512_K[i+j]+\
+    (j?blk2(i):blk0(i));d(i)+=h(i);h(i)+=S0(a(i))+Maj(a(i),b(i),c(i));
+
+void SHA512_HashBlock_CXX(word64 *state, const word64 *data)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+
+    word64 W[16]={0}, T[8];
+
+    /* Copy context->state[] to working vars */
+    std::memcpy(T, state, sizeof(T));
+
+    /* 80 operations, partially loop unrolled */
+    for (unsigned int j=0; j<80; j+=16)
+    {
+        R( 0); R( 1); R( 2); R( 3);
+        R( 4); R( 5); R( 6); R( 7);
+        R( 8); R( 9); R(10); R(11);
+        R(12); R(13); R(14); R(15);
+    }
+
+    state[0] += a(0);
+    state[1] += b(0);
+    state[2] += c(0);
+    state[3] += d(0);
+    state[4] += e(0);
+    state[5] += f(0);
+    state[6] += g(0);
+    state[7] += h(0);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+void SHA512::Transform(word64 *state, const word64 *data)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE && (CRYPTOPP_BOOL_X86)
+    if (HasSSE2())
+    {
+        SHA512_HashBlock_SSE2(state, data);
+        return;
+    }
+#endif
+#if CRYPTOGAMS_ARM_SHA512
+# if CRYPTOPP_ARM_NEON_AVAILABLE
+    if (HasNEON())
+    {
+#  if (CRYPTOPP_LITTLE_ENDIAN)
+        word64 dataBuf[16];
+        ByteReverse(dataBuf, data, SHA512::BLOCKSIZE);
+        cryptogams_sha512_block_data_order_neon(state, dataBuf, 1);
+#  else
+        cryptogams_sha512_block_data_order_neon(state, data, 1);
+#  endif
+        return;
+    }
+    else
+# endif
+    if (HasARMv7())
+    {
+# if (CRYPTOPP_LITTLE_ENDIAN)
+        word64 dataBuf[16];
+        ByteReverse(dataBuf, data, SHA512::BLOCKSIZE);
+        cryptogams_sha512_block_data_order(state, dataBuf, 1);
+# else
+        cryptogams_sha512_block_data_order(state, data, 1);
+# endif
+        return;
+    }
+#endif
+#if CRYPTOPP_POWER8_SHA_AVAILABLE
+    if (HasSHA512())
+    {
+        SHA512_HashMultipleBlocks_POWER8(state, data, SHA512::BLOCKSIZE, BIG_ENDIAN_ORDER);
+        return;
+    }
+#endif
+
+    SHA512_HashBlock_CXX(state, data);
+}
+
+#undef Ch
+#undef Maj
+
+#undef s0
+#undef s1
+#undef S0
+#undef S1
+
+#undef blk0
+#undef blk1
+#undef blk2
+
+#undef R
+
+#undef a
+#undef b
+#undef c
+#undef d
+#undef e
+#undef f
+#undef g
+#undef h
+
+NAMESPACE_END
+
+#endif    // Not CRYPTOPP_GENERATE_X64_MASM
+#endif    // Not CRYPTOPP_IMPORTS
diff --git a/runtime/third_party/cryptopp/sha.h b/runtime/third_party/cryptopp/sha.h
new file mode 100644
index 0000000..d4a09d7
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha.h
@@ -0,0 +1,210 @@
+// sha.h - originally written and placed in the public domain by Wei Dai
+
+/// \file sha.h
+/// \brief Classes for SHA-1 and SHA-2 family of message digests
+/// \since SHA1 since Crypto++ 1.0, SHA2 since Crypto++ 4.0, ARMv8 SHA since
+///   Crypto++ 6.0, Intel SHA since Crypto++ 6.0, Power8 SHA since Crypto++ 6.1
+
+#ifndef CRYPTOPP_SHA_H
+#define CRYPTOPP_SHA_H
+
+#include "config.h"
+#include "iterhash.h"
+
+// Clang 3.3 integrated assembler crash on Linux. Clang 3.4 due to compiler
+// error with .intel_syntax, http://llvm.org/bugs/show_bug.cgi?id=24232
+#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+# define CRYPTOPP_DISABLE_SHA_ASM 1
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SHA-1 message digest
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#SHA-1">SHA-1</a>
+/// \since SHA1 since Crypto++ 1.0, SHA2 since Crypto++ 4.0, ARMv8 SHA since
+///   Crypto++ 6.0, Intel SHA since Crypto++ 6.0
+class CRYPTOPP_DLL SHA1 : public IteratedHashWithStaticTransform<word32, BigEndian, 64, 20, SHA1>
+{
+public:
+	/// \brief Initialize state array
+	/// \param state the state of the hash
+	/// \details InitState sets a state array to SHA1 initial values
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API InitState(HashWordType *state);
+	/// \brief Operate the hash
+	/// \param digest the state of the hash
+	/// \param data the data to be digested
+	/// \details Transform operates the hash on <tt>data</tt>. When the call is invoked
+	///   <tt>digest</tt> holds initial state. Upon return <tt>digest</tt> holds the hash
+	///   or updated state.
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array and data must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API Transform(HashWordType *digest, const HashWordType *data);
+	/// \brief The algorithm name
+	/// \return C-style string "SHA-1"
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "SHA-1";}
+	// Algorithm class
+	std::string AlgorithmProvider() const;
+
+protected:
+	size_t HashMultipleBlocks(const HashWordType *input, size_t length);
+};
+
+/// \brief SHA-256 message digest
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#SHA-256">SHA-256</a>
+/// \since SHA2 since Crypto++ 4.0, ARMv8 SHA since Crypto++ 6.0,
+///   Intel SHA since Crypto++ 6.0, Power8 SHA since Crypto++ 6.1
+class CRYPTOPP_DLL SHA256 : public IteratedHashWithStaticTransform<word32, BigEndian, 64, 32, SHA256, 32, true>
+{
+public:
+	/// \brief Initialize state array
+	/// \param state the state of the hash
+	/// \details InitState sets a state array to SHA256 initial values
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API InitState(HashWordType *state);
+	/// \brief Operate the hash
+	/// \param digest the state of the hash
+	/// \param data the data to be digested
+	/// \details Transform operates the hash on <tt>data</tt>. When the call is invoked
+	///   <tt>digest</tt> holds initial state. Upon return <tt>digest</tt> holds the hash
+	///   or updated state.
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array and data must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API Transform(HashWordType *digest, const HashWordType *data);
+	/// \brief The algorithm name
+	/// \return C-style string "SHA-256"
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "SHA-256";}
+
+	// Algorithm class
+	std::string AlgorithmProvider() const;
+
+protected:
+	size_t HashMultipleBlocks(const HashWordType *input, size_t length);
+};
+
+/// \brief SHA-224 message digest
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#SHA-224">SHA-224</a>
+/// \since SHA2 since Crypto++ 4.0, ARMv8 SHA since Crypto++ 6.0,
+///   Intel SHA since Crypto++ 6.0, Power8 SHA since Crypto++ 6.1
+class CRYPTOPP_DLL SHA224 : public IteratedHashWithStaticTransform<word32, BigEndian, 64, 32, SHA224, 28, true>
+{
+public:
+	/// \brief Initialize state array
+	/// \param state the state of the hash
+	/// \details InitState sets a state array to SHA224 initial values
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API InitState(HashWordType *state);
+	/// \brief Operate the hash
+	/// \param digest the state of the hash
+	/// \param data the data to be digested
+	/// \details Transform operates the hash on <tt>data</tt>. When the call is invoked
+	///   <tt>digest</tt> holds initial state. Upon return <tt>digest</tt> holds the hash
+	///   or updated state.
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array and data must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API Transform(HashWordType *digest, const HashWordType *data) {SHA256::Transform(digest, data);}
+	/// \brief The algorithm name
+	/// \return C-style string "SHA-224"
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "SHA-224";}
+
+	// Algorithm class
+	std::string AlgorithmProvider() const;
+
+protected:
+	size_t HashMultipleBlocks(const HashWordType *input, size_t length);
+};
+
+/// \brief SHA-512 message digest
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#SHA-512">SHA-512</a>
+/// \since SHA2 since Crypto++ 4.0, Power8 SHA since Crypto++ 6.1
+class CRYPTOPP_DLL SHA512 : public IteratedHashWithStaticTransform<word64, BigEndian, 128, 64, SHA512, 64, true>
+{
+public:
+	/// \brief Initialize state array
+	/// \param state the state of the hash
+	/// \details InitState sets a state array to SHA512 initial values
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API InitState(HashWordType *state);
+	/// \brief Operate the hash
+	/// \param digest the state of the hash
+	/// \param data the data to be digested
+	/// \details Transform operates the hash on <tt>data</tt>. When the call is invoked
+	///   <tt>digest</tt> holds initial state. Upon return <tt>digest</tt> holds the hash
+	///   or updated state.
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array and data must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API Transform(HashWordType *digest, const HashWordType *data);
+	/// \brief The algorithm name
+	/// \return C-style string "SHA-512"
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "SHA-512";}
+
+	// Algorithm class
+	std::string AlgorithmProvider() const;
+};
+
+/// \brief SHA-384 message digest
+/// \sa <a href="http://www.weidai.com/scan-mirror/md.html#SHA-384">SHA-384</a>
+/// \since SHA2 since Crypto++ 4.0, Power8 SHA since Crypto++ 6.1
+class CRYPTOPP_DLL SHA384 : public IteratedHashWithStaticTransform<word64, BigEndian, 128, 64, SHA384, 48, true>
+{
+public:
+	/// \brief Initialize state array
+	/// \param state the state of the hash
+	/// \details InitState sets a state array to SHA384 initial values
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API InitState(HashWordType *state);
+	/// \brief Operate the hash
+	/// \param digest the state of the hash
+	/// \param data the data to be digested
+	/// \details Transform operates the hash on <tt>data</tt>. When the call is invoked
+	///   <tt>digest</tt> holds initial state. Upon return <tt>digest</tt> holds the hash
+	///   or updated state.
+	/// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+	///   member functions InitState and Transform. External classes, like SEAL and MDC,
+	///   can initialize state with a user provided key and operate the hash on the data
+	///   with the user supplied state.
+	/// \note On Intel platforms the state array and data must be 16-byte aligned for SSE2.
+	static void CRYPTOPP_API Transform(HashWordType *digest, const HashWordType *data) {SHA512::Transform(digest, data);}
+	/// \brief The algorithm name
+	/// \return C-style string "SHA-384"
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "SHA-384";}
+
+	// Algorithm class
+	std::string AlgorithmProvider() const;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/sha1_armv4.S b/runtime/third_party/cryptopp/sha1_armv4.S
new file mode 100644
index 0000000..49a39f4
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha1_armv4.S
@@ -0,0 +1,1410 @@
+@ Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
+@
+@ ====================================================================
+@ Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
+@ project. The module is, however, dual licensed under OpenSSL and
+@ CRYPTOGAMS licenses depending on where you obtain it. For further
+@ details see http://www.openssl.org/~appro/cryptogams/.
+@ ====================================================================
+
+@ JW, MAY 2019: Begin defines from taken from arm_arch.h
+@               The defines were included through the header.
+
+# if !defined(__ARM_ARCH__)
+#  if defined(__CC_ARM)
+#   define __ARM_ARCH__ __TARGET_ARCH_ARM
+#   if defined(__BIG_ENDIAN)
+#    define __ARMEB__
+#   else
+#    define __ARMEL__
+#   endif
+#  elif defined(__GNUC__)
+#   if   defined(__aarch64__)
+#    define __ARM_ARCH__ 8
+#    if __BYTE_ORDER__==__ORDER_BIG_ENDIAN__
+#     define __ARMEB__
+#    else
+#     define __ARMEL__
+#    endif
+
+#   elif defined(__ARM_ARCH)
+#    define __ARM_ARCH__ __ARM_ARCH
+#   elif defined(__ARM_ARCH_8A__)
+#    define __ARM_ARCH__ 8
+#   elif defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__)     || \
+        defined(__ARM_ARCH_7R__)|| defined(__ARM_ARCH_7M__)     || \
+        defined(__ARM_ARCH_7EM__)
+#    define __ARM_ARCH__ 7
+#   elif defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__)     || \
+        defined(__ARM_ARCH_6K__)|| defined(__ARM_ARCH_6M__)     || \
+        defined(__ARM_ARCH_6Z__)|| defined(__ARM_ARCH_6ZK__)    || \
+        defined(__ARM_ARCH_6T2__)
+#    define __ARM_ARCH__ 6
+#   elif defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__)     || \
+        defined(__ARM_ARCH_5E__)|| defined(__ARM_ARCH_5TE__)    || \
+        defined(__ARM_ARCH_5TEJ__)
+#    define __ARM_ARCH__ 5
+#   elif defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__)
+#    define __ARM_ARCH__ 4
+#   else
+#    error "unsupported ARM architecture"
+#   endif
+#  endif
+# endif
+
+# if !defined(__ARM_MAX_ARCH__)
+#  define __ARM_MAX_ARCH__ __ARM_ARCH__
+# endif
+
+# if __ARM_MAX_ARCH__<__ARM_ARCH__
+#  error "__ARM_MAX_ARCH__ can't be less than __ARM_ARCH__"
+# elif __ARM_MAX_ARCH__!=__ARM_ARCH__
+#  if __ARM_ARCH__<7 && __ARM_MAX_ARCH__>=7 && defined(__ARMEB__)
+#   error "can't build universal big-endian binary"
+#  endif
+# endif
+
+# define CRYPTOGAMS_ARMV7_NEON      (1<<0)
+
+@ JW, MAY 2019: End defines from taken from arm_arch.h
+@               Back to original Cryptogams code
+
+#if defined(__thumb2__)
+.syntax	unified
+.thumb
+#else
+.code	32
+#endif
+
+.text
+
+.align	5
+.globl	cryptogams_sha1_block_data_order
+.type	cryptogams_sha1_block_data_order,%function
+
+cryptogams_sha1_block_data_order:
+.Lcryptogams_sha1_block_data_order:
+
+#if __ARM_ARCH__<7 && !defined(__thumb2__)
+	sub	r3,pc,#8		@ cryptogams_sha1_block_data_order
+#else
+	adr	r3,.Lcryptogams_sha1_block_data_order
+#endif
+
+	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+	add	r2,r1,r2,lsl#6	@ r2 to point at the end of r1
+	ldmia	r0,{r3,r4,r5,r6,r7}
+
+.Lloop:
+	ldr	r8,.LK_00_19
+	mov	r14,sp
+	sub	sp,sp,#15*4
+	mov	r5,r5,ror#30
+	mov	r6,r6,ror#30
+	mov	r7,r7,ror#30		@ [6]
+.L_00_15:
+#if __ARM_ARCH__<7
+	ldrb	r10,[r1,#2]
+	ldrb	r9,[r1,#3]
+	ldrb	r11,[r1,#1]
+	add	r7,r8,r7,ror#2			@ E+=K_00_19
+	ldrb	r12,[r1],#4
+	orr	r9,r9,r10,lsl#8
+	eor	r10,r5,r6			@ F_xx_xx
+	orr	r9,r9,r11,lsl#16
+	add	r7,r7,r3,ror#27			@ E+=ROR(A,27)
+	orr	r9,r9,r12,lsl#24
+#else
+	ldr	r9,[r1],#4			@ handles unaligned
+	add	r7,r8,r7,ror#2			@ E+=K_00_19
+	eor	r10,r5,r6			@ F_xx_xx
+	add	r7,r7,r3,ror#27			@ E+=ROR(A,27)
+#ifdef __ARMEL__
+	rev	r9,r9				@ byte swap
+#endif
+#endif
+	and	r10,r4,r10,ror#2
+	add	r7,r7,r9			@ E+=X[i]
+	eor	r10,r10,r6,ror#2		@ F_00_19(B,C,D)
+	str	r9,[r14,#-4]!
+	add	r7,r7,r10			@ E+=F_00_19(B,C,D)
+#if __ARM_ARCH__<7
+	ldrb	r10,[r1,#2]
+	ldrb	r9,[r1,#3]
+	ldrb	r11,[r1,#1]
+	add	r6,r8,r6,ror#2			@ E+=K_00_19
+	ldrb	r12,[r1],#4
+	orr	r9,r9,r10,lsl#8
+	eor	r10,r4,r5			@ F_xx_xx
+	orr	r9,r9,r11,lsl#16
+	add	r6,r6,r7,ror#27			@ E+=ROR(A,27)
+	orr	r9,r9,r12,lsl#24
+#else
+	ldr	r9,[r1],#4			@ handles unaligned
+	add	r6,r8,r6,ror#2			@ E+=K_00_19
+	eor	r10,r4,r5			@ F_xx_xx
+	add	r6,r6,r7,ror#27			@ E+=ROR(A,27)
+#ifdef __ARMEL__
+	rev	r9,r9				@ byte swap
+#endif
+#endif
+	and	r10,r3,r10,ror#2
+	add	r6,r6,r9			@ E+=X[i]
+	eor	r10,r10,r5,ror#2		@ F_00_19(B,C,D)
+	str	r9,[r14,#-4]!
+	add	r6,r6,r10			@ E+=F_00_19(B,C,D)
+#if __ARM_ARCH__<7
+	ldrb	r10,[r1,#2]
+	ldrb	r9,[r1,#3]
+	ldrb	r11,[r1,#1]
+	add	r5,r8,r5,ror#2			@ E+=K_00_19
+	ldrb	r12,[r1],#4
+	orr	r9,r9,r10,lsl#8
+	eor	r10,r3,r4			@ F_xx_xx
+	orr	r9,r9,r11,lsl#16
+	add	r5,r5,r6,ror#27			@ E+=ROR(A,27)
+	orr	r9,r9,r12,lsl#24
+#else
+	ldr	r9,[r1],#4			@ handles unaligned
+	add	r5,r8,r5,ror#2			@ E+=K_00_19
+	eor	r10,r3,r4			@ F_xx_xx
+	add	r5,r5,r6,ror#27			@ E+=ROR(A,27)
+#ifdef __ARMEL__
+	rev	r9,r9				@ byte swap
+#endif
+#endif
+	and	r10,r7,r10,ror#2
+	add	r5,r5,r9			@ E+=X[i]
+	eor	r10,r10,r4,ror#2		@ F_00_19(B,C,D)
+	str	r9,[r14,#-4]!
+	add	r5,r5,r10			@ E+=F_00_19(B,C,D)
+#if __ARM_ARCH__<7
+	ldrb	r10,[r1,#2]
+	ldrb	r9,[r1,#3]
+	ldrb	r11,[r1,#1]
+	add	r4,r8,r4,ror#2			@ E+=K_00_19
+	ldrb	r12,[r1],#4
+	orr	r9,r9,r10,lsl#8
+	eor	r10,r7,r3			@ F_xx_xx
+	orr	r9,r9,r11,lsl#16
+	add	r4,r4,r5,ror#27			@ E+=ROR(A,27)
+	orr	r9,r9,r12,lsl#24
+#else
+	ldr	r9,[r1],#4			@ handles unaligned
+	add	r4,r8,r4,ror#2			@ E+=K_00_19
+	eor	r10,r7,r3			@ F_xx_xx
+	add	r4,r4,r5,ror#27			@ E+=ROR(A,27)
+#ifdef __ARMEL__
+	rev	r9,r9				@ byte swap
+#endif
+#endif
+	and	r10,r6,r10,ror#2
+	add	r4,r4,r9			@ E+=X[i]
+	eor	r10,r10,r3,ror#2		@ F_00_19(B,C,D)
+	str	r9,[r14,#-4]!
+	add	r4,r4,r10			@ E+=F_00_19(B,C,D)
+#if __ARM_ARCH__<7
+	ldrb	r10,[r1,#2]
+	ldrb	r9,[r1,#3]
+	ldrb	r11,[r1,#1]
+	add	r3,r8,r3,ror#2			@ E+=K_00_19
+	ldrb	r12,[r1],#4
+	orr	r9,r9,r10,lsl#8
+	eor	r10,r6,r7			@ F_xx_xx
+	orr	r9,r9,r11,lsl#16
+	add	r3,r3,r4,ror#27			@ E+=ROR(A,27)
+	orr	r9,r9,r12,lsl#24
+#else
+	ldr	r9,[r1],#4			@ handles unaligned
+	add	r3,r8,r3,ror#2			@ E+=K_00_19
+	eor	r10,r6,r7			@ F_xx_xx
+	add	r3,r3,r4,ror#27			@ E+=ROR(A,27)
+#ifdef __ARMEL__
+	rev	r9,r9				@ byte swap
+#endif
+#endif
+	and	r10,r5,r10,ror#2
+	add	r3,r3,r9			@ E+=X[i]
+	eor	r10,r10,r7,ror#2		@ F_00_19(B,C,D)
+	str	r9,[r14,#-4]!
+	add	r3,r3,r10			@ E+=F_00_19(B,C,D)
+#if defined(__thumb2__)
+	mov	r12,sp
+	teq	r14,r12
+#else
+	teq	r14,sp
+#endif
+	bne	.L_00_15		@ [((11+4)*5+2)*3]
+	sub	sp,sp,#25*4
+#if __ARM_ARCH__<7
+	ldrb	r10,[r1,#2]
+	ldrb	r9,[r1,#3]
+	ldrb	r11,[r1,#1]
+	add	r7,r8,r7,ror#2			@ E+=K_00_19
+	ldrb	r12,[r1],#4
+	orr	r9,r9,r10,lsl#8
+	eor	r10,r5,r6			@ F_xx_xx
+	orr	r9,r9,r11,lsl#16
+	add	r7,r7,r3,ror#27			@ E+=ROR(A,27)
+	orr	r9,r9,r12,lsl#24
+#else
+	ldr	r9,[r1],#4			@ handles unaligned
+	add	r7,r8,r7,ror#2			@ E+=K_00_19
+	eor	r10,r5,r6			@ F_xx_xx
+	add	r7,r7,r3,ror#27			@ E+=ROR(A,27)
+#ifdef __ARMEL__
+	rev	r9,r9				@ byte swap
+#endif
+#endif
+	and	r10,r4,r10,ror#2
+	add	r7,r7,r9			@ E+=X[i]
+	eor	r10,r10,r6,ror#2		@ F_00_19(B,C,D)
+	str	r9,[r14,#-4]!
+	add	r7,r7,r10			@ E+=F_00_19(B,C,D)
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r6,r8,r6,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r4,r5			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r6,r6,r7,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	and	r10,r3,r10,ror#2					@ F_xx_xx
+						@ F_xx_xx
+	add	r6,r6,r9			@ E+=X[i]
+	eor	r10,r10,r5,ror#2		@ F_00_19(B,C,D)
+	add	r6,r6,r10			@ E+=F_00_19(B,C,D)
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r5,r8,r5,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r3,r4			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r5,r5,r6,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	and	r10,r7,r10,ror#2					@ F_xx_xx
+						@ F_xx_xx
+	add	r5,r5,r9			@ E+=X[i]
+	eor	r10,r10,r4,ror#2		@ F_00_19(B,C,D)
+	add	r5,r5,r10			@ E+=F_00_19(B,C,D)
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r4,r8,r4,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r7,r3			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r4,r4,r5,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	and	r10,r6,r10,ror#2					@ F_xx_xx
+						@ F_xx_xx
+	add	r4,r4,r9			@ E+=X[i]
+	eor	r10,r10,r3,ror#2		@ F_00_19(B,C,D)
+	add	r4,r4,r10			@ E+=F_00_19(B,C,D)
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r3,r8,r3,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r6,r7			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r3,r3,r4,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	and	r10,r5,r10,ror#2					@ F_xx_xx
+						@ F_xx_xx
+	add	r3,r3,r9			@ E+=X[i]
+	eor	r10,r10,r7,ror#2		@ F_00_19(B,C,D)
+	add	r3,r3,r10			@ E+=F_00_19(B,C,D)
+
+	ldr	r8,.LK_20_39		@ [+15+16*4]
+	cmn	sp,#0			@ [+3], clear carry to denote 20_39
+.L_20_39_or_60_79:
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r7,r8,r7,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r5,r6			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r7,r7,r3,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	eor	r10,r4,r10,ror#2					@ F_xx_xx
+						@ F_xx_xx
+	add	r7,r7,r9			@ E+=X[i]
+	add	r7,r7,r10			@ E+=F_20_39(B,C,D)
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r6,r8,r6,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r4,r5			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r6,r6,r7,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	eor	r10,r3,r10,ror#2					@ F_xx_xx
+						@ F_xx_xx
+	add	r6,r6,r9			@ E+=X[i]
+	add	r6,r6,r10			@ E+=F_20_39(B,C,D)
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r5,r8,r5,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r3,r4			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r5,r5,r6,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	eor	r10,r7,r10,ror#2					@ F_xx_xx
+						@ F_xx_xx
+	add	r5,r5,r9			@ E+=X[i]
+	add	r5,r5,r10			@ E+=F_20_39(B,C,D)
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r4,r8,r4,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r7,r3			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r4,r4,r5,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	eor	r10,r6,r10,ror#2					@ F_xx_xx
+						@ F_xx_xx
+	add	r4,r4,r9			@ E+=X[i]
+	add	r4,r4,r10			@ E+=F_20_39(B,C,D)
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r3,r8,r3,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r6,r7			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r3,r3,r4,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	eor	r10,r5,r10,ror#2					@ F_xx_xx
+						@ F_xx_xx
+	add	r3,r3,r9			@ E+=X[i]
+	add	r3,r3,r10			@ E+=F_20_39(B,C,D)
+#if defined(__thumb2__)
+	mov	r12,sp
+	teq	r14,r12
+#else
+	teq	r14,sp			@ preserve carry
+#endif
+	bne	.L_20_39_or_60_79	@ [+((12+3)*5+2)*4]
+	bcs	.L_done			@ [+((12+3)*5+2)*4], spare 300 bytes
+
+	ldr	r8,.LK_40_59
+	sub	sp,sp,#20*4		@ [+2]
+.L_40_59:
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r7,r8,r7,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r5,r6			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r7,r7,r3,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	and	r10,r4,r10,ror#2					@ F_xx_xx
+	and	r11,r5,r6					@ F_xx_xx
+	add	r7,r7,r9			@ E+=X[i]
+	add	r7,r7,r10			@ E+=F_40_59(B,C,D)
+	add	r7,r7,r11,ror#2
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r6,r8,r6,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r4,r5			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r6,r6,r7,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	and	r10,r3,r10,ror#2					@ F_xx_xx
+	and	r11,r4,r5					@ F_xx_xx
+	add	r6,r6,r9			@ E+=X[i]
+	add	r6,r6,r10			@ E+=F_40_59(B,C,D)
+	add	r6,r6,r11,ror#2
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r5,r8,r5,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r3,r4			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r5,r5,r6,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	and	r10,r7,r10,ror#2					@ F_xx_xx
+	and	r11,r3,r4					@ F_xx_xx
+	add	r5,r5,r9			@ E+=X[i]
+	add	r5,r5,r10			@ E+=F_40_59(B,C,D)
+	add	r5,r5,r11,ror#2
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r4,r8,r4,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r7,r3			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r4,r4,r5,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	and	r10,r6,r10,ror#2					@ F_xx_xx
+	and	r11,r7,r3					@ F_xx_xx
+	add	r4,r4,r9			@ E+=X[i]
+	add	r4,r4,r10			@ E+=F_40_59(B,C,D)
+	add	r4,r4,r11,ror#2
+	ldr	r9,[r14,#15*4]
+	ldr	r10,[r14,#13*4]
+	ldr	r11,[r14,#7*4]
+	add	r3,r8,r3,ror#2			@ E+=K_xx_xx
+	ldr	r12,[r14,#2*4]
+	eor	r9,r9,r10
+	eor	r11,r11,r12			@ 1 cycle stall
+	eor	r10,r6,r7			@ F_xx_xx
+	mov	r9,r9,ror#31
+	add	r3,r3,r4,ror#27			@ E+=ROR(A,27)
+	eor	r9,r9,r11,ror#31
+	str	r9,[r14,#-4]!
+	and	r10,r5,r10,ror#2					@ F_xx_xx
+	and	r11,r6,r7					@ F_xx_xx
+	add	r3,r3,r9			@ E+=X[i]
+	add	r3,r3,r10			@ E+=F_40_59(B,C,D)
+	add	r3,r3,r11,ror#2
+#if defined(__thumb2__)
+	mov	r12,sp
+	teq	r14,r12
+#else
+	teq	r14,sp
+#endif
+	bne	.L_40_59		@ [+((12+5)*5+2)*4]
+
+	ldr	r8,.LK_60_79
+	sub	sp,sp,#20*4
+	cmp	sp,#0			@ set carry to denote 60_79
+	b	.L_20_39_or_60_79	@ [+4], spare 300 bytes
+.L_done:
+	add	sp,sp,#80*4		@ "deallocate" stack frame
+	ldmia	r0,{r8,r9,r10,r11,r12}
+	add	r3,r8,r3
+	add	r4,r9,r4
+	add	r5,r10,r5,ror#2
+	add	r6,r11,r6,ror#2
+	add	r7,r12,r7,ror#2
+	stmia	r0,{r3,r4,r5,r6,r7}
+	teq	r1,r2
+	bne	.Lloop			@ [+18], total 1307
+
+#if __ARM_ARCH__>=5
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,pc}
+#else
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+	tst	lr,#1
+	moveq	pc,lr			@ be binary compatible with V4, yet
+.word	0xe12fff1e			@ interoperable with Thumb ISA:-)
+#endif
+.size	cryptogams_sha1_block_data_order,.-cryptogams_sha1_block_data_order
+
+.align	5
+.LK_00_19:.word	0x5a827999
+.LK_20_39:.word	0x6ed9eba1
+.LK_40_59:.word	0x8f1bbcdc
+.LK_60_79:.word	0xca62c1d6
+
+.align	5
+#if __ARM_MAX_ARCH__>=7
+.arch	armv7-a
+.fpu	neon
+
+.globl	cryptogams_sha1_block_data_order_neon
+.type	cryptogams_sha1_block_data_order_neon,%function
+
+.align	4
+cryptogams_sha1_block_data_order_neon:
+
+	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+	add	r2,r1,r2,lsl#6	@ r2 to point at the end of r1
+	@ dmb				@ errata #451034 on early Cortex A8
+	@ vstmdb	sp!,{d8-d15}	@ ABI specification says so
+	mov	r14,sp
+	sub	r12,sp,#64
+	adr	r8,.LK_00_19
+	bic	r12,r12,#15		@ align for 128-bit stores
+
+	ldmia	r0,{r3,r4,r5,r6,r7}	@ load context
+	mov	sp,r12		@ alloca
+
+	vld1.8	{q0,q1},[r1]!	@ handles unaligned
+	veor	q15,q15,q15
+	vld1.8	{q2,q3},[r1]!
+	vld1.32	{d28[],d29[]},[r8,:32]!	@ load K_00_19
+	vrev32.8	q0,q0		@ yes, even on
+	vrev32.8	q1,q1		@ big-endian...
+	vrev32.8	q2,q2
+	vadd.i32	q8,q0,q14
+	vrev32.8	q3,q3
+	vadd.i32	q9,q1,q14
+	vst1.32	{q8},[r12,:128]!
+	vadd.i32	q10,q2,q14
+	vst1.32	{q9},[r12,:128]!
+	vst1.32	{q10},[r12,:128]!
+	ldr	r9,[sp]			@ big RAW stall
+
+.Loop_neon:
+	vext.8	q8,q0,q1,#8
+	bic	r10,r6,r4
+	add	r7,r7,r9
+	and	r11,r5,r4
+	vadd.i32	q13,q3,q14
+	ldr	r9,[sp,#4]
+	add	r7,r7,r3,ror#27
+	vext.8	q12,q3,q15,#4
+	eor	r11,r11,r10
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	veor	q8,q8,q0
+	bic	r10,r5,r3
+	add	r6,r6,r9
+	veor	q12,q12,q2
+	and	r11,r4,r3
+	ldr	r9,[sp,#8]
+	veor	q12,q12,q8
+	add	r6,r6,r7,ror#27
+	eor	r11,r11,r10
+	vst1.32	{q13},[r12,:128]!
+	sub	r12,r12,#64
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	vext.8	q13,q15,q12,#4
+	bic	r10,r4,r7
+	add	r5,r5,r9
+	vadd.i32	q8,q12,q12
+	and	r11,r3,r7
+	ldr	r9,[sp,#12]
+	vsri.32	q8,q12,#31
+	add	r5,r5,r6,ror#27
+	eor	r11,r11,r10
+	mov	r7,r7,ror#2
+	vshr.u32	q12,q13,#30
+	add	r5,r5,r11
+	bic	r10,r3,r6
+	vshl.u32	q13,q13,#2
+	add	r4,r4,r9
+	and	r11,r7,r6
+	veor	q8,q8,q12
+	ldr	r9,[sp,#16]
+	add	r4,r4,r5,ror#27
+	veor	q8,q8,q13
+	eor	r11,r11,r10
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	vext.8	q9,q1,q2,#8
+	bic	r10,r7,r5
+	add	r3,r3,r9
+	and	r11,r6,r5
+	vadd.i32	q13,q8,q14
+	ldr	r9,[sp,#20]
+	vld1.32	{d28[],d29[]},[r8,:32]!
+	add	r3,r3,r4,ror#27
+	vext.8	q12,q8,q15,#4
+	eor	r11,r11,r10
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	veor	q9,q9,q1
+	bic	r10,r6,r4
+	add	r7,r7,r9
+	veor	q12,q12,q3
+	and	r11,r5,r4
+	ldr	r9,[sp,#24]
+	veor	q12,q12,q9
+	add	r7,r7,r3,ror#27
+	eor	r11,r11,r10
+	vst1.32	{q13},[r12,:128]!
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	vext.8	q13,q15,q12,#4
+	bic	r10,r5,r3
+	add	r6,r6,r9
+	vadd.i32	q9,q12,q12
+	and	r11,r4,r3
+	ldr	r9,[sp,#28]
+	vsri.32	q9,q12,#31
+	add	r6,r6,r7,ror#27
+	eor	r11,r11,r10
+	mov	r3,r3,ror#2
+	vshr.u32	q12,q13,#30
+	add	r6,r6,r11
+	bic	r10,r4,r7
+	vshl.u32	q13,q13,#2
+	add	r5,r5,r9
+	and	r11,r3,r7
+	veor	q9,q9,q12
+	ldr	r9,[sp,#32]
+	add	r5,r5,r6,ror#27
+	veor	q9,q9,q13
+	eor	r11,r11,r10
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	vext.8	q10,q2,q3,#8
+	bic	r10,r3,r6
+	add	r4,r4,r9
+	and	r11,r7,r6
+	vadd.i32	q13,q9,q14
+	ldr	r9,[sp,#36]
+	add	r4,r4,r5,ror#27
+	vext.8	q12,q9,q15,#4
+	eor	r11,r11,r10
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	veor	q10,q10,q2
+	bic	r10,r7,r5
+	add	r3,r3,r9
+	veor	q12,q12,q8
+	and	r11,r6,r5
+	ldr	r9,[sp,#40]
+	veor	q12,q12,q10
+	add	r3,r3,r4,ror#27
+	eor	r11,r11,r10
+	vst1.32	{q13},[r12,:128]!
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	vext.8	q13,q15,q12,#4
+	bic	r10,r6,r4
+	add	r7,r7,r9
+	vadd.i32	q10,q12,q12
+	and	r11,r5,r4
+	ldr	r9,[sp,#44]
+	vsri.32	q10,q12,#31
+	add	r7,r7,r3,ror#27
+	eor	r11,r11,r10
+	mov	r4,r4,ror#2
+	vshr.u32	q12,q13,#30
+	add	r7,r7,r11
+	bic	r10,r5,r3
+	vshl.u32	q13,q13,#2
+	add	r6,r6,r9
+	and	r11,r4,r3
+	veor	q10,q10,q12
+	ldr	r9,[sp,#48]
+	add	r6,r6,r7,ror#27
+	veor	q10,q10,q13
+	eor	r11,r11,r10
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	vext.8	q11,q3,q8,#8
+	bic	r10,r4,r7
+	add	r5,r5,r9
+	and	r11,r3,r7
+	vadd.i32	q13,q10,q14
+	ldr	r9,[sp,#52]
+	add	r5,r5,r6,ror#27
+	vext.8	q12,q10,q15,#4
+	eor	r11,r11,r10
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	veor	q11,q11,q3
+	bic	r10,r3,r6
+	add	r4,r4,r9
+	veor	q12,q12,q9
+	and	r11,r7,r6
+	ldr	r9,[sp,#56]
+	veor	q12,q12,q11
+	add	r4,r4,r5,ror#27
+	eor	r11,r11,r10
+	vst1.32	{q13},[r12,:128]!
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	vext.8	q13,q15,q12,#4
+	bic	r10,r7,r5
+	add	r3,r3,r9
+	vadd.i32	q11,q12,q12
+	and	r11,r6,r5
+	ldr	r9,[sp,#60]
+	vsri.32	q11,q12,#31
+	add	r3,r3,r4,ror#27
+	eor	r11,r11,r10
+	mov	r5,r5,ror#2
+	vshr.u32	q12,q13,#30
+	add	r3,r3,r11
+	bic	r10,r6,r4
+	vshl.u32	q13,q13,#2
+	add	r7,r7,r9
+	and	r11,r5,r4
+	veor	q11,q11,q12
+	ldr	r9,[sp,#0]
+	add	r7,r7,r3,ror#27
+	veor	q11,q11,q13
+	eor	r11,r11,r10
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	vext.8	q12,q10,q11,#8
+	bic	r10,r5,r3
+	add	r6,r6,r9
+	and	r11,r4,r3
+	veor	q0,q0,q8
+	ldr	r9,[sp,#4]
+	add	r6,r6,r7,ror#27
+	veor	q0,q0,q1
+	eor	r11,r11,r10
+	mov	r3,r3,ror#2
+	vadd.i32	q13,q11,q14
+	add	r6,r6,r11
+	bic	r10,r4,r7
+	veor	q12,q12,q0
+	add	r5,r5,r9
+	and	r11,r3,r7
+	vshr.u32	q0,q12,#30
+	ldr	r9,[sp,#8]
+	add	r5,r5,r6,ror#27
+	vst1.32	{q13},[r12,:128]!
+	sub	r12,r12,#64
+	eor	r11,r11,r10
+	mov	r7,r7,ror#2
+	vsli.32	q0,q12,#2
+	add	r5,r5,r11
+	bic	r10,r3,r6
+	add	r4,r4,r9
+	and	r11,r7,r6
+	ldr	r9,[sp,#12]
+	add	r4,r4,r5,ror#27
+	eor	r11,r11,r10
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	bic	r10,r7,r5
+	add	r3,r3,r9
+	and	r11,r6,r5
+	ldr	r9,[sp,#16]
+	add	r3,r3,r4,ror#27
+	eor	r11,r11,r10
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	vext.8	q12,q11,q0,#8
+	eor	r10,r4,r6
+	add	r7,r7,r9
+	ldr	r9,[sp,#20]
+	veor	q1,q1,q9
+	eor	r11,r10,r5
+	add	r7,r7,r3,ror#27
+	veor	q1,q1,q2
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	vadd.i32	q13,q0,q14
+	eor	r10,r3,r5
+	add	r6,r6,r9
+	veor	q12,q12,q1
+	ldr	r9,[sp,#24]
+	eor	r11,r10,r4
+	vshr.u32	q1,q12,#30
+	add	r6,r6,r7,ror#27
+	mov	r3,r3,ror#2
+	vst1.32	{q13},[r12,:128]!
+	add	r6,r6,r11
+	eor	r10,r7,r4
+	vsli.32	q1,q12,#2
+	add	r5,r5,r9
+	ldr	r9,[sp,#28]
+	eor	r11,r10,r3
+	add	r5,r5,r6,ror#27
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	eor	r10,r6,r3
+	add	r4,r4,r9
+	ldr	r9,[sp,#32]
+	eor	r11,r10,r7
+	add	r4,r4,r5,ror#27
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	vext.8	q12,q0,q1,#8
+	eor	r10,r5,r7
+	add	r3,r3,r9
+	ldr	r9,[sp,#36]
+	veor	q2,q2,q10
+	eor	r11,r10,r6
+	add	r3,r3,r4,ror#27
+	veor	q2,q2,q3
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	vadd.i32	q13,q1,q14
+	eor	r10,r4,r6
+	vld1.32	{d28[],d29[]},[r8,:32]!
+	add	r7,r7,r9
+	veor	q12,q12,q2
+	ldr	r9,[sp,#40]
+	eor	r11,r10,r5
+	vshr.u32	q2,q12,#30
+	add	r7,r7,r3,ror#27
+	mov	r4,r4,ror#2
+	vst1.32	{q13},[r12,:128]!
+	add	r7,r7,r11
+	eor	r10,r3,r5
+	vsli.32	q2,q12,#2
+	add	r6,r6,r9
+	ldr	r9,[sp,#44]
+	eor	r11,r10,r4
+	add	r6,r6,r7,ror#27
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	eor	r10,r7,r4
+	add	r5,r5,r9
+	ldr	r9,[sp,#48]
+	eor	r11,r10,r3
+	add	r5,r5,r6,ror#27
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	vext.8	q12,q1,q2,#8
+	eor	r10,r6,r3
+	add	r4,r4,r9
+	ldr	r9,[sp,#52]
+	veor	q3,q3,q11
+	eor	r11,r10,r7
+	add	r4,r4,r5,ror#27
+	veor	q3,q3,q8
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	vadd.i32	q13,q2,q14
+	eor	r10,r5,r7
+	add	r3,r3,r9
+	veor	q12,q12,q3
+	ldr	r9,[sp,#56]
+	eor	r11,r10,r6
+	vshr.u32	q3,q12,#30
+	add	r3,r3,r4,ror#27
+	mov	r5,r5,ror#2
+	vst1.32	{q13},[r12,:128]!
+	add	r3,r3,r11
+	eor	r10,r4,r6
+	vsli.32	q3,q12,#2
+	add	r7,r7,r9
+	ldr	r9,[sp,#60]
+	eor	r11,r10,r5
+	add	r7,r7,r3,ror#27
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	eor	r10,r3,r5
+	add	r6,r6,r9
+	ldr	r9,[sp,#0]
+	eor	r11,r10,r4
+	add	r6,r6,r7,ror#27
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	vext.8	q12,q2,q3,#8
+	eor	r10,r7,r4
+	add	r5,r5,r9
+	ldr	r9,[sp,#4]
+	veor	q8,q8,q0
+	eor	r11,r10,r3
+	add	r5,r5,r6,ror#27
+	veor	q8,q8,q9
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	vadd.i32	q13,q3,q14
+	eor	r10,r6,r3
+	add	r4,r4,r9
+	veor	q12,q12,q8
+	ldr	r9,[sp,#8]
+	eor	r11,r10,r7
+	vshr.u32	q8,q12,#30
+	add	r4,r4,r5,ror#27
+	mov	r6,r6,ror#2
+	vst1.32	{q13},[r12,:128]!
+	sub	r12,r12,#64
+	add	r4,r4,r11
+	eor	r10,r5,r7
+	vsli.32	q8,q12,#2
+	add	r3,r3,r9
+	ldr	r9,[sp,#12]
+	eor	r11,r10,r6
+	add	r3,r3,r4,ror#27
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	eor	r10,r4,r6
+	add	r7,r7,r9
+	ldr	r9,[sp,#16]
+	eor	r11,r10,r5
+	add	r7,r7,r3,ror#27
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	vext.8	q12,q3,q8,#8
+	eor	r10,r3,r5
+	add	r6,r6,r9
+	ldr	r9,[sp,#20]
+	veor	q9,q9,q1
+	eor	r11,r10,r4
+	add	r6,r6,r7,ror#27
+	veor	q9,q9,q10
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	vadd.i32	q13,q8,q14
+	eor	r10,r7,r4
+	add	r5,r5,r9
+	veor	q12,q12,q9
+	ldr	r9,[sp,#24]
+	eor	r11,r10,r3
+	vshr.u32	q9,q12,#30
+	add	r5,r5,r6,ror#27
+	mov	r7,r7,ror#2
+	vst1.32	{q13},[r12,:128]!
+	add	r5,r5,r11
+	eor	r10,r6,r3
+	vsli.32	q9,q12,#2
+	add	r4,r4,r9
+	ldr	r9,[sp,#28]
+	eor	r11,r10,r7
+	add	r4,r4,r5,ror#27
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	eor	r10,r5,r7
+	add	r3,r3,r9
+	ldr	r9,[sp,#32]
+	eor	r11,r10,r6
+	add	r3,r3,r4,ror#27
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	vext.8	q12,q8,q9,#8
+	add	r7,r7,r9
+	and	r10,r5,r6
+	ldr	r9,[sp,#36]
+	veor	q10,q10,q2
+	add	r7,r7,r3,ror#27
+	eor	r11,r5,r6
+	veor	q10,q10,q11
+	add	r7,r7,r10
+	and	r11,r11,r4
+	vadd.i32	q13,q9,q14
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	veor	q12,q12,q10
+	add	r6,r6,r9
+	and	r10,r4,r5
+	vshr.u32	q10,q12,#30
+	ldr	r9,[sp,#40]
+	add	r6,r6,r7,ror#27
+	vst1.32	{q13},[r12,:128]!
+	eor	r11,r4,r5
+	add	r6,r6,r10
+	vsli.32	q10,q12,#2
+	and	r11,r11,r3
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	add	r5,r5,r9
+	and	r10,r3,r4
+	ldr	r9,[sp,#44]
+	add	r5,r5,r6,ror#27
+	eor	r11,r3,r4
+	add	r5,r5,r10
+	and	r11,r11,r7
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	add	r4,r4,r9
+	and	r10,r7,r3
+	ldr	r9,[sp,#48]
+	add	r4,r4,r5,ror#27
+	eor	r11,r7,r3
+	add	r4,r4,r10
+	and	r11,r11,r6
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	vext.8	q12,q9,q10,#8
+	add	r3,r3,r9
+	and	r10,r6,r7
+	ldr	r9,[sp,#52]
+	veor	q11,q11,q3
+	add	r3,r3,r4,ror#27
+	eor	r11,r6,r7
+	veor	q11,q11,q0
+	add	r3,r3,r10
+	and	r11,r11,r5
+	vadd.i32	q13,q10,q14
+	mov	r5,r5,ror#2
+	vld1.32	{d28[],d29[]},[r8,:32]!
+	add	r3,r3,r11
+	veor	q12,q12,q11
+	add	r7,r7,r9
+	and	r10,r5,r6
+	vshr.u32	q11,q12,#30
+	ldr	r9,[sp,#56]
+	add	r7,r7,r3,ror#27
+	vst1.32	{q13},[r12,:128]!
+	eor	r11,r5,r6
+	add	r7,r7,r10
+	vsli.32	q11,q12,#2
+	and	r11,r11,r4
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	add	r6,r6,r9
+	and	r10,r4,r5
+	ldr	r9,[sp,#60]
+	add	r6,r6,r7,ror#27
+	eor	r11,r4,r5
+	add	r6,r6,r10
+	and	r11,r11,r3
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	add	r5,r5,r9
+	and	r10,r3,r4
+	ldr	r9,[sp,#0]
+	add	r5,r5,r6,ror#27
+	eor	r11,r3,r4
+	add	r5,r5,r10
+	and	r11,r11,r7
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	vext.8	q12,q10,q11,#8
+	add	r4,r4,r9
+	and	r10,r7,r3
+	ldr	r9,[sp,#4]
+	veor	q0,q0,q8
+	add	r4,r4,r5,ror#27
+	eor	r11,r7,r3
+	veor	q0,q0,q1
+	add	r4,r4,r10
+	and	r11,r11,r6
+	vadd.i32	q13,q11,q14
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	veor	q12,q12,q0
+	add	r3,r3,r9
+	and	r10,r6,r7
+	vshr.u32	q0,q12,#30
+	ldr	r9,[sp,#8]
+	add	r3,r3,r4,ror#27
+	vst1.32	{q13},[r12,:128]!
+	sub	r12,r12,#64
+	eor	r11,r6,r7
+	add	r3,r3,r10
+	vsli.32	q0,q12,#2
+	and	r11,r11,r5
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	add	r7,r7,r9
+	and	r10,r5,r6
+	ldr	r9,[sp,#12]
+	add	r7,r7,r3,ror#27
+	eor	r11,r5,r6
+	add	r7,r7,r10
+	and	r11,r11,r4
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	add	r6,r6,r9
+	and	r10,r4,r5
+	ldr	r9,[sp,#16]
+	add	r6,r6,r7,ror#27
+	eor	r11,r4,r5
+	add	r6,r6,r10
+	and	r11,r11,r3
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	vext.8	q12,q11,q0,#8
+	add	r5,r5,r9
+	and	r10,r3,r4
+	ldr	r9,[sp,#20]
+	veor	q1,q1,q9
+	add	r5,r5,r6,ror#27
+	eor	r11,r3,r4
+	veor	q1,q1,q2
+	add	r5,r5,r10
+	and	r11,r11,r7
+	vadd.i32	q13,q0,q14
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	veor	q12,q12,q1
+	add	r4,r4,r9
+	and	r10,r7,r3
+	vshr.u32	q1,q12,#30
+	ldr	r9,[sp,#24]
+	add	r4,r4,r5,ror#27
+	vst1.32	{q13},[r12,:128]!
+	eor	r11,r7,r3
+	add	r4,r4,r10
+	vsli.32	q1,q12,#2
+	and	r11,r11,r6
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	add	r3,r3,r9
+	and	r10,r6,r7
+	ldr	r9,[sp,#28]
+	add	r3,r3,r4,ror#27
+	eor	r11,r6,r7
+	add	r3,r3,r10
+	and	r11,r11,r5
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	add	r7,r7,r9
+	and	r10,r5,r6
+	ldr	r9,[sp,#32]
+	add	r7,r7,r3,ror#27
+	eor	r11,r5,r6
+	add	r7,r7,r10
+	and	r11,r11,r4
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	vext.8	q12,q0,q1,#8
+	add	r6,r6,r9
+	and	r10,r4,r5
+	ldr	r9,[sp,#36]
+	veor	q2,q2,q10
+	add	r6,r6,r7,ror#27
+	eor	r11,r4,r5
+	veor	q2,q2,q3
+	add	r6,r6,r10
+	and	r11,r11,r3
+	vadd.i32	q13,q1,q14
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	veor	q12,q12,q2
+	add	r5,r5,r9
+	and	r10,r3,r4
+	vshr.u32	q2,q12,#30
+	ldr	r9,[sp,#40]
+	add	r5,r5,r6,ror#27
+	vst1.32	{q13},[r12,:128]!
+	eor	r11,r3,r4
+	add	r5,r5,r10
+	vsli.32	q2,q12,#2
+	and	r11,r11,r7
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	add	r4,r4,r9
+	and	r10,r7,r3
+	ldr	r9,[sp,#44]
+	add	r4,r4,r5,ror#27
+	eor	r11,r7,r3
+	add	r4,r4,r10
+	and	r11,r11,r6
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	add	r3,r3,r9
+	and	r10,r6,r7
+	ldr	r9,[sp,#48]
+	add	r3,r3,r4,ror#27
+	eor	r11,r6,r7
+	add	r3,r3,r10
+	and	r11,r11,r5
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	vext.8	q12,q1,q2,#8
+	eor	r10,r4,r6
+	add	r7,r7,r9
+	ldr	r9,[sp,#52]
+	veor	q3,q3,q11
+	eor	r11,r10,r5
+	add	r7,r7,r3,ror#27
+	veor	q3,q3,q8
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	vadd.i32	q13,q2,q14
+	eor	r10,r3,r5
+	add	r6,r6,r9
+	veor	q12,q12,q3
+	ldr	r9,[sp,#56]
+	eor	r11,r10,r4
+	vshr.u32	q3,q12,#30
+	add	r6,r6,r7,ror#27
+	mov	r3,r3,ror#2
+	vst1.32	{q13},[r12,:128]!
+	add	r6,r6,r11
+	eor	r10,r7,r4
+	vsli.32	q3,q12,#2
+	add	r5,r5,r9
+	ldr	r9,[sp,#60]
+	eor	r11,r10,r3
+	add	r5,r5,r6,ror#27
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	eor	r10,r6,r3
+	add	r4,r4,r9
+	ldr	r9,[sp,#0]
+	eor	r11,r10,r7
+	add	r4,r4,r5,ror#27
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	vadd.i32	q13,q3,q14
+	eor	r10,r5,r7
+	add	r3,r3,r9
+	vst1.32	{q13},[r12,:128]!
+	sub	r12,r12,#64
+	teq	r1,r2
+	sub	r8,r8,#16
+	it	eq
+	subeq	r1,r1,#64
+	vld1.8	{q0,q1},[r1]!
+	ldr	r9,[sp,#4]
+	eor	r11,r10,r6
+	vld1.8	{q2,q3},[r1]!
+	add	r3,r3,r4,ror#27
+	mov	r5,r5,ror#2
+	vld1.32	{d28[],d29[]},[r8,:32]!
+	add	r3,r3,r11
+	eor	r10,r4,r6
+	vrev32.8	q0,q0
+	add	r7,r7,r9
+	ldr	r9,[sp,#8]
+	eor	r11,r10,r5
+	add	r7,r7,r3,ror#27
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	eor	r10,r3,r5
+	add	r6,r6,r9
+	ldr	r9,[sp,#12]
+	eor	r11,r10,r4
+	add	r6,r6,r7,ror#27
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	eor	r10,r7,r4
+	add	r5,r5,r9
+	ldr	r9,[sp,#16]
+	eor	r11,r10,r3
+	add	r5,r5,r6,ror#27
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	vrev32.8	q1,q1
+	eor	r10,r6,r3
+	add	r4,r4,r9
+	vadd.i32	q8,q0,q14
+	ldr	r9,[sp,#20]
+	eor	r11,r10,r7
+	vst1.32	{q8},[r12,:128]!
+	add	r4,r4,r5,ror#27
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	eor	r10,r5,r7
+	add	r3,r3,r9
+	ldr	r9,[sp,#24]
+	eor	r11,r10,r6
+	add	r3,r3,r4,ror#27
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	eor	r10,r4,r6
+	add	r7,r7,r9
+	ldr	r9,[sp,#28]
+	eor	r11,r10,r5
+	add	r7,r7,r3,ror#27
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	eor	r10,r3,r5
+	add	r6,r6,r9
+	ldr	r9,[sp,#32]
+	eor	r11,r10,r4
+	add	r6,r6,r7,ror#27
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	vrev32.8	q2,q2
+	eor	r10,r7,r4
+	add	r5,r5,r9
+	vadd.i32	q9,q1,q14
+	ldr	r9,[sp,#36]
+	eor	r11,r10,r3
+	vst1.32	{q9},[r12,:128]!
+	add	r5,r5,r6,ror#27
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	eor	r10,r6,r3
+	add	r4,r4,r9
+	ldr	r9,[sp,#40]
+	eor	r11,r10,r7
+	add	r4,r4,r5,ror#27
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	eor	r10,r5,r7
+	add	r3,r3,r9
+	ldr	r9,[sp,#44]
+	eor	r11,r10,r6
+	add	r3,r3,r4,ror#27
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	eor	r10,r4,r6
+	add	r7,r7,r9
+	ldr	r9,[sp,#48]
+	eor	r11,r10,r5
+	add	r7,r7,r3,ror#27
+	mov	r4,r4,ror#2
+	add	r7,r7,r11
+	vrev32.8	q3,q3
+	eor	r10,r3,r5
+	add	r6,r6,r9
+	vadd.i32	q10,q2,q14
+	ldr	r9,[sp,#52]
+	eor	r11,r10,r4
+	vst1.32	{q10},[r12,:128]!
+	add	r6,r6,r7,ror#27
+	mov	r3,r3,ror#2
+	add	r6,r6,r11
+	eor	r10,r7,r4
+	add	r5,r5,r9
+	ldr	r9,[sp,#56]
+	eor	r11,r10,r3
+	add	r5,r5,r6,ror#27
+	mov	r7,r7,ror#2
+	add	r5,r5,r11
+	eor	r10,r6,r3
+	add	r4,r4,r9
+	ldr	r9,[sp,#60]
+	eor	r11,r10,r7
+	add	r4,r4,r5,ror#27
+	mov	r6,r6,ror#2
+	add	r4,r4,r11
+	eor	r10,r5,r7
+	add	r3,r3,r9
+	eor	r11,r10,r6
+	add	r3,r3,r4,ror#27
+	mov	r5,r5,ror#2
+	add	r3,r3,r11
+	ldmia	r0,{r9,r10,r11,r12}	@ accumulate context
+	add	r3,r3,r9
+	ldr	r9,[r0,#16]
+	add	r4,r4,r10
+	add	r5,r5,r11
+	add	r6,r6,r12
+	it	eq
+	moveq	sp,r14
+	add	r7,r7,r9
+	it	ne
+	ldrne	r9,[sp]
+	stmia	r0,{r3,r4,r5,r6,r7}
+	itt	ne
+	addne	r12,sp,#3*16
+	bne	.Loop_neon
+
+	@ vldmia	sp!,{d8-d15}
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,pc}
+.size	cryptogams_sha1_block_data_order_neon,.-cryptogams_sha1_block_data_order_neon
+#endif
diff --git a/runtime/third_party/cryptopp/sha1_armv4.h b/runtime/third_party/cryptopp/sha1_armv4.h
new file mode 100644
index 0000000..97f3671
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha1_armv4.h
@@ -0,0 +1,23 @@
+/* Header file for use with Cryptogam's ARMv4 SHA1.    */
+/* Also see http://www.openssl.org/~appro/cryptogams/  */
+/* https://wiki.openssl.org/index.php/Cryptogams_SHA.  */
+
+#ifndef CRYPTOGAMS_SHA1_ARMV4_H
+#define CRYPTOGAMS_SHA1_ARMV4_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Crypto++ modified sha1_block_data_order to pass caps as a parameter. */
+/* Also see https://github.com/weidai11/cryptopp/issues/846.           */
+void cryptogams_sha1_block_data_order(void *state, const void *data, size_t blocks);
+
+/* Cryptogams arm caps */
+#define CRYPTOGAMS_ARMV7_NEON (1<<0)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* CRYPTOGAMS_SHA1_ARMV4_H */
diff --git a/runtime/third_party/cryptopp/sha256_armv4.S b/runtime/third_party/cryptopp/sha256_armv4.S
new file mode 100644
index 0000000..e8c9d16
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha256_armv4.S
@@ -0,0 +1,2670 @@
+@ Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
+@
+@ ====================================================================
+@ Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
+@ project. The module is, however, dual licensed under OpenSSL and
+@ CRYPTOGAMS licenses depending on where you obtain it. For further
+@ details see http://www.openssl.org/~appro/cryptogams/.
+@ ====================================================================
+
+@ JW, MAY 2019: Begin defines from taken from arm_arch.h
+@               The defines were included through the header.
+
+# if !defined(__ARM_ARCH__)
+#  if defined(__CC_ARM)
+#   define __ARM_ARCH__ __TARGET_ARCH_ARM
+#   if defined(__BIG_ENDIAN)
+#    define __ARMEB__
+#   else
+#    define __ARMEL__
+#   endif
+#  elif defined(__GNUC__)
+#   if   defined(__aarch64__)
+#    define __ARM_ARCH__ 8
+#    if __BYTE_ORDER__==__ORDER_BIG_ENDIAN__
+#     define __ARMEB__
+#    else
+#     define __ARMEL__
+#    endif
+
+#   elif defined(__ARM_ARCH)
+#    define __ARM_ARCH__ __ARM_ARCH
+#   elif defined(__ARM_ARCH_8A__)
+#    define __ARM_ARCH__ 8
+#   elif defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__)     || \
+        defined(__ARM_ARCH_7R__)|| defined(__ARM_ARCH_7M__)     || \
+        defined(__ARM_ARCH_7EM__)
+#    define __ARM_ARCH__ 7
+#   elif defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__)     || \
+        defined(__ARM_ARCH_6K__)|| defined(__ARM_ARCH_6M__)     || \
+        defined(__ARM_ARCH_6Z__)|| defined(__ARM_ARCH_6ZK__)    || \
+        defined(__ARM_ARCH_6T2__)
+#    define __ARM_ARCH__ 6
+#   elif defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__)     || \
+        defined(__ARM_ARCH_5E__)|| defined(__ARM_ARCH_5TE__)    || \
+        defined(__ARM_ARCH_5TEJ__)
+#    define __ARM_ARCH__ 5
+#   elif defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__)
+#    define __ARM_ARCH__ 4
+#   else
+#    error "unsupported ARM architecture"
+#   endif
+#  endif
+# endif
+
+# if !defined(__ARM_MAX_ARCH__)
+#  define __ARM_MAX_ARCH__ __ARM_ARCH__
+# endif
+
+# if __ARM_MAX_ARCH__<__ARM_ARCH__
+#  error "__ARM_MAX_ARCH__ can't be less than __ARM_ARCH__"
+# elif __ARM_MAX_ARCH__!=__ARM_ARCH__
+#  if __ARM_ARCH__<7 && __ARM_MAX_ARCH__>=7 && defined(__ARMEB__)
+#   error "can't build universal big-endian binary"
+#  endif
+# endif
+
+# define CRYPTOGAMS_ARMV7_NEON      (1<<0)
+
+@ JW, MAY 2019: End defines from taken from arm_arch.h
+@               Back to original Cryptogams code
+
+#if defined(__thumb2__)
+.syntax	unified
+.thumb
+#else
+.code	32
+#endif
+
+.text
+
+.type	K256,%object
+.align	5
+K256:
+.word	0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5
+.word	0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5
+.word	0xd807aa98,0x12835b01,0x243185be,0x550c7dc3
+.word	0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174
+.word	0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc
+.word	0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da
+.word	0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7
+.word	0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967
+.word	0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13
+.word	0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85
+.word	0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3
+.word	0xd192e819,0xd6990624,0xf40e3585,0x106aa070
+.word	0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5
+.word	0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3
+.word	0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208
+.word	0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+.size	K256,.-K256
+.word	0				@ terminator
+
+.align	5
+.globl	cryptogams_sha256_block_data_order
+.type	cryptogams_sha256_block_data_order,%function
+
+cryptogams_sha256_block_data_order:
+.Lcryptogams_sha256_block_data_order:
+
+#if __ARM_ARCH__<7 && !defined(__thumb2__)
+	sub	r3,pc,#8		@ cryptogams_sha256_block_data_order
+#else
+	adr	r3,.Lcryptogams_sha256_block_data_order
+#endif
+
+	add	r2,r1,r2,lsl#6	@ len to point at the end of inp
+	stmdb	sp!,{r0,r1,r2,r4-r11,lr}
+	ldmia	r0,{r4,r5,r6,r7,r8,r9,r10,r11}
+	sub	r14,r3,#256+32	@ K256
+	sub	sp,sp,#16*4		@ alloca(X[16])
+
+.Loop:
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r5,r6		@ magic
+	eor	r12,r12,r12
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 0
+# if 0==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r8,r8,ror#5
+	add	r4,r4,r12			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r8,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 0
+	add	r4,r4,r12			@ h+=Maj(a,b,c) from the past
+	ldrb	r12,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r12,lsl#8
+	ldrb	r12,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 0==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r8,r8,ror#5
+	orr	r2,r2,r12,lsl#24
+	eor	r0,r0,r8,ror#19	@ Sigma1(e)
+#endif
+	ldr	r12,[r14],#4			@ *K256++
+	add	r11,r11,r2			@ h+=X[i]
+	str	r2,[sp,#0*4]
+	eor	r2,r9,r10
+	add	r11,r11,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r8
+	add	r11,r11,r12			@ h+=K256[i]
+	eor	r2,r2,r10			@ Ch(e,f,g)
+	eor	r0,r4,r4,ror#11
+	add	r11,r11,r2			@ h+=Ch(e,f,g)
+#if 0==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 0<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r4,r5			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#2*4]		@ from future BODY_16_xx
+	eor	r12,r4,r5			@ a^b, b^c in next round
+	ldr	r1,[sp,#15*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r4,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r7,r7,r11			@ d+=h
+	eor	r3,r3,r5			@ Maj(a,b,c)
+	add	r11,r11,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r11,r11,r3			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 1
+# if 1==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r7,r7,ror#5
+	add	r11,r11,r3			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r7,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 1
+	add	r11,r11,r3			@ h+=Maj(a,b,c) from the past
+	ldrb	r3,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r3,lsl#8
+	ldrb	r3,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 1==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r7,r7,ror#5
+	orr	r2,r2,r3,lsl#24
+	eor	r0,r0,r7,ror#19	@ Sigma1(e)
+#endif
+	ldr	r3,[r14],#4			@ *K256++
+	add	r10,r10,r2			@ h+=X[i]
+	str	r2,[sp,#1*4]
+	eor	r2,r8,r9
+	add	r10,r10,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r7
+	add	r10,r10,r3			@ h+=K256[i]
+	eor	r2,r2,r9			@ Ch(e,f,g)
+	eor	r0,r11,r11,ror#11
+	add	r10,r10,r2			@ h+=Ch(e,f,g)
+#if 1==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 1<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r11,r4			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#3*4]		@ from future BODY_16_xx
+	eor	r3,r11,r4			@ a^b, b^c in next round
+	ldr	r1,[sp,#0*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r11,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r6,r6,r10			@ d+=h
+	eor	r12,r12,r4			@ Maj(a,b,c)
+	add	r10,r10,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r10,r10,r12			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 2
+# if 2==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r6,r6,ror#5
+	add	r10,r10,r12			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r6,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 2
+	add	r10,r10,r12			@ h+=Maj(a,b,c) from the past
+	ldrb	r12,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r12,lsl#8
+	ldrb	r12,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 2==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r6,r6,ror#5
+	orr	r2,r2,r12,lsl#24
+	eor	r0,r0,r6,ror#19	@ Sigma1(e)
+#endif
+	ldr	r12,[r14],#4			@ *K256++
+	add	r9,r9,r2			@ h+=X[i]
+	str	r2,[sp,#2*4]
+	eor	r2,r7,r8
+	add	r9,r9,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r6
+	add	r9,r9,r12			@ h+=K256[i]
+	eor	r2,r2,r8			@ Ch(e,f,g)
+	eor	r0,r10,r10,ror#11
+	add	r9,r9,r2			@ h+=Ch(e,f,g)
+#if 2==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 2<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r10,r11			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#4*4]		@ from future BODY_16_xx
+	eor	r12,r10,r11			@ a^b, b^c in next round
+	ldr	r1,[sp,#1*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r10,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r5,r5,r9			@ d+=h
+	eor	r3,r3,r11			@ Maj(a,b,c)
+	add	r9,r9,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r9,r9,r3			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 3
+# if 3==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r5,r5,ror#5
+	add	r9,r9,r3			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r5,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 3
+	add	r9,r9,r3			@ h+=Maj(a,b,c) from the past
+	ldrb	r3,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r3,lsl#8
+	ldrb	r3,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 3==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r5,r5,ror#5
+	orr	r2,r2,r3,lsl#24
+	eor	r0,r0,r5,ror#19	@ Sigma1(e)
+#endif
+	ldr	r3,[r14],#4			@ *K256++
+	add	r8,r8,r2			@ h+=X[i]
+	str	r2,[sp,#3*4]
+	eor	r2,r6,r7
+	add	r8,r8,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r5
+	add	r8,r8,r3			@ h+=K256[i]
+	eor	r2,r2,r7			@ Ch(e,f,g)
+	eor	r0,r9,r9,ror#11
+	add	r8,r8,r2			@ h+=Ch(e,f,g)
+#if 3==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 3<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r9,r10			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#5*4]		@ from future BODY_16_xx
+	eor	r3,r9,r10			@ a^b, b^c in next round
+	ldr	r1,[sp,#2*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r9,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r4,r4,r8			@ d+=h
+	eor	r12,r12,r10			@ Maj(a,b,c)
+	add	r8,r8,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r8,r8,r12			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 4
+# if 4==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r4,r4,ror#5
+	add	r8,r8,r12			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r4,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 4
+	add	r8,r8,r12			@ h+=Maj(a,b,c) from the past
+	ldrb	r12,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r12,lsl#8
+	ldrb	r12,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 4==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r4,r4,ror#5
+	orr	r2,r2,r12,lsl#24
+	eor	r0,r0,r4,ror#19	@ Sigma1(e)
+#endif
+	ldr	r12,[r14],#4			@ *K256++
+	add	r7,r7,r2			@ h+=X[i]
+	str	r2,[sp,#4*4]
+	eor	r2,r5,r6
+	add	r7,r7,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r4
+	add	r7,r7,r12			@ h+=K256[i]
+	eor	r2,r2,r6			@ Ch(e,f,g)
+	eor	r0,r8,r8,ror#11
+	add	r7,r7,r2			@ h+=Ch(e,f,g)
+#if 4==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 4<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r8,r9			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#6*4]		@ from future BODY_16_xx
+	eor	r12,r8,r9			@ a^b, b^c in next round
+	ldr	r1,[sp,#3*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r8,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r11,r11,r7			@ d+=h
+	eor	r3,r3,r9			@ Maj(a,b,c)
+	add	r7,r7,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r7,r7,r3			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 5
+# if 5==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r11,r11,ror#5
+	add	r7,r7,r3			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r11,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 5
+	add	r7,r7,r3			@ h+=Maj(a,b,c) from the past
+	ldrb	r3,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r3,lsl#8
+	ldrb	r3,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 5==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r11,r11,ror#5
+	orr	r2,r2,r3,lsl#24
+	eor	r0,r0,r11,ror#19	@ Sigma1(e)
+#endif
+	ldr	r3,[r14],#4			@ *K256++
+	add	r6,r6,r2			@ h+=X[i]
+	str	r2,[sp,#5*4]
+	eor	r2,r4,r5
+	add	r6,r6,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r11
+	add	r6,r6,r3			@ h+=K256[i]
+	eor	r2,r2,r5			@ Ch(e,f,g)
+	eor	r0,r7,r7,ror#11
+	add	r6,r6,r2			@ h+=Ch(e,f,g)
+#if 5==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 5<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r7,r8			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#7*4]		@ from future BODY_16_xx
+	eor	r3,r7,r8			@ a^b, b^c in next round
+	ldr	r1,[sp,#4*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r7,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r10,r10,r6			@ d+=h
+	eor	r12,r12,r8			@ Maj(a,b,c)
+	add	r6,r6,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r6,r6,r12			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 6
+# if 6==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r10,r10,ror#5
+	add	r6,r6,r12			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r10,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 6
+	add	r6,r6,r12			@ h+=Maj(a,b,c) from the past
+	ldrb	r12,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r12,lsl#8
+	ldrb	r12,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 6==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r10,r10,ror#5
+	orr	r2,r2,r12,lsl#24
+	eor	r0,r0,r10,ror#19	@ Sigma1(e)
+#endif
+	ldr	r12,[r14],#4			@ *K256++
+	add	r5,r5,r2			@ h+=X[i]
+	str	r2,[sp,#6*4]
+	eor	r2,r11,r4
+	add	r5,r5,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r10
+	add	r5,r5,r12			@ h+=K256[i]
+	eor	r2,r2,r4			@ Ch(e,f,g)
+	eor	r0,r6,r6,ror#11
+	add	r5,r5,r2			@ h+=Ch(e,f,g)
+#if 6==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 6<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r6,r7			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#8*4]		@ from future BODY_16_xx
+	eor	r12,r6,r7			@ a^b, b^c in next round
+	ldr	r1,[sp,#5*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r6,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r9,r9,r5			@ d+=h
+	eor	r3,r3,r7			@ Maj(a,b,c)
+	add	r5,r5,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r5,r5,r3			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 7
+# if 7==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r9,r9,ror#5
+	add	r5,r5,r3			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r9,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 7
+	add	r5,r5,r3			@ h+=Maj(a,b,c) from the past
+	ldrb	r3,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r3,lsl#8
+	ldrb	r3,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 7==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r9,r9,ror#5
+	orr	r2,r2,r3,lsl#24
+	eor	r0,r0,r9,ror#19	@ Sigma1(e)
+#endif
+	ldr	r3,[r14],#4			@ *K256++
+	add	r4,r4,r2			@ h+=X[i]
+	str	r2,[sp,#7*4]
+	eor	r2,r10,r11
+	add	r4,r4,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r9
+	add	r4,r4,r3			@ h+=K256[i]
+	eor	r2,r2,r11			@ Ch(e,f,g)
+	eor	r0,r5,r5,ror#11
+	add	r4,r4,r2			@ h+=Ch(e,f,g)
+#if 7==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 7<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r5,r6			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#9*4]		@ from future BODY_16_xx
+	eor	r3,r5,r6			@ a^b, b^c in next round
+	ldr	r1,[sp,#6*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r5,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r8,r8,r4			@ d+=h
+	eor	r12,r12,r6			@ Maj(a,b,c)
+	add	r4,r4,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r4,r4,r12			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 8
+# if 8==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r8,r8,ror#5
+	add	r4,r4,r12			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r8,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 8
+	add	r4,r4,r12			@ h+=Maj(a,b,c) from the past
+	ldrb	r12,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r12,lsl#8
+	ldrb	r12,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 8==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r8,r8,ror#5
+	orr	r2,r2,r12,lsl#24
+	eor	r0,r0,r8,ror#19	@ Sigma1(e)
+#endif
+	ldr	r12,[r14],#4			@ *K256++
+	add	r11,r11,r2			@ h+=X[i]
+	str	r2,[sp,#8*4]
+	eor	r2,r9,r10
+	add	r11,r11,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r8
+	add	r11,r11,r12			@ h+=K256[i]
+	eor	r2,r2,r10			@ Ch(e,f,g)
+	eor	r0,r4,r4,ror#11
+	add	r11,r11,r2			@ h+=Ch(e,f,g)
+#if 8==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 8<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r4,r5			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#10*4]		@ from future BODY_16_xx
+	eor	r12,r4,r5			@ a^b, b^c in next round
+	ldr	r1,[sp,#7*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r4,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r7,r7,r11			@ d+=h
+	eor	r3,r3,r5			@ Maj(a,b,c)
+	add	r11,r11,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r11,r11,r3			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 9
+# if 9==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r7,r7,ror#5
+	add	r11,r11,r3			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r7,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 9
+	add	r11,r11,r3			@ h+=Maj(a,b,c) from the past
+	ldrb	r3,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r3,lsl#8
+	ldrb	r3,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 9==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r7,r7,ror#5
+	orr	r2,r2,r3,lsl#24
+	eor	r0,r0,r7,ror#19	@ Sigma1(e)
+#endif
+	ldr	r3,[r14],#4			@ *K256++
+	add	r10,r10,r2			@ h+=X[i]
+	str	r2,[sp,#9*4]
+	eor	r2,r8,r9
+	add	r10,r10,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r7
+	add	r10,r10,r3			@ h+=K256[i]
+	eor	r2,r2,r9			@ Ch(e,f,g)
+	eor	r0,r11,r11,ror#11
+	add	r10,r10,r2			@ h+=Ch(e,f,g)
+#if 9==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 9<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r11,r4			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#11*4]		@ from future BODY_16_xx
+	eor	r3,r11,r4			@ a^b, b^c in next round
+	ldr	r1,[sp,#8*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r11,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r6,r6,r10			@ d+=h
+	eor	r12,r12,r4			@ Maj(a,b,c)
+	add	r10,r10,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r10,r10,r12			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 10
+# if 10==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r6,r6,ror#5
+	add	r10,r10,r12			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r6,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 10
+	add	r10,r10,r12			@ h+=Maj(a,b,c) from the past
+	ldrb	r12,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r12,lsl#8
+	ldrb	r12,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 10==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r6,r6,ror#5
+	orr	r2,r2,r12,lsl#24
+	eor	r0,r0,r6,ror#19	@ Sigma1(e)
+#endif
+	ldr	r12,[r14],#4			@ *K256++
+	add	r9,r9,r2			@ h+=X[i]
+	str	r2,[sp,#10*4]
+	eor	r2,r7,r8
+	add	r9,r9,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r6
+	add	r9,r9,r12			@ h+=K256[i]
+	eor	r2,r2,r8			@ Ch(e,f,g)
+	eor	r0,r10,r10,ror#11
+	add	r9,r9,r2			@ h+=Ch(e,f,g)
+#if 10==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 10<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r10,r11			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#12*4]		@ from future BODY_16_xx
+	eor	r12,r10,r11			@ a^b, b^c in next round
+	ldr	r1,[sp,#9*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r10,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r5,r5,r9			@ d+=h
+	eor	r3,r3,r11			@ Maj(a,b,c)
+	add	r9,r9,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r9,r9,r3			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 11
+# if 11==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r5,r5,ror#5
+	add	r9,r9,r3			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r5,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 11
+	add	r9,r9,r3			@ h+=Maj(a,b,c) from the past
+	ldrb	r3,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r3,lsl#8
+	ldrb	r3,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 11==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r5,r5,ror#5
+	orr	r2,r2,r3,lsl#24
+	eor	r0,r0,r5,ror#19	@ Sigma1(e)
+#endif
+	ldr	r3,[r14],#4			@ *K256++
+	add	r8,r8,r2			@ h+=X[i]
+	str	r2,[sp,#11*4]
+	eor	r2,r6,r7
+	add	r8,r8,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r5
+	add	r8,r8,r3			@ h+=K256[i]
+	eor	r2,r2,r7			@ Ch(e,f,g)
+	eor	r0,r9,r9,ror#11
+	add	r8,r8,r2			@ h+=Ch(e,f,g)
+#if 11==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 11<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r9,r10			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#13*4]		@ from future BODY_16_xx
+	eor	r3,r9,r10			@ a^b, b^c in next round
+	ldr	r1,[sp,#10*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r9,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r4,r4,r8			@ d+=h
+	eor	r12,r12,r10			@ Maj(a,b,c)
+	add	r8,r8,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r8,r8,r12			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 12
+# if 12==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r4,r4,ror#5
+	add	r8,r8,r12			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r4,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 12
+	add	r8,r8,r12			@ h+=Maj(a,b,c) from the past
+	ldrb	r12,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r12,lsl#8
+	ldrb	r12,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 12==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r4,r4,ror#5
+	orr	r2,r2,r12,lsl#24
+	eor	r0,r0,r4,ror#19	@ Sigma1(e)
+#endif
+	ldr	r12,[r14],#4			@ *K256++
+	add	r7,r7,r2			@ h+=X[i]
+	str	r2,[sp,#12*4]
+	eor	r2,r5,r6
+	add	r7,r7,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r4
+	add	r7,r7,r12			@ h+=K256[i]
+	eor	r2,r2,r6			@ Ch(e,f,g)
+	eor	r0,r8,r8,ror#11
+	add	r7,r7,r2			@ h+=Ch(e,f,g)
+#if 12==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 12<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r8,r9			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#14*4]		@ from future BODY_16_xx
+	eor	r12,r8,r9			@ a^b, b^c in next round
+	ldr	r1,[sp,#11*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r8,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r11,r11,r7			@ d+=h
+	eor	r3,r3,r9			@ Maj(a,b,c)
+	add	r7,r7,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r7,r7,r3			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 13
+# if 13==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r11,r11,ror#5
+	add	r7,r7,r3			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r11,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 13
+	add	r7,r7,r3			@ h+=Maj(a,b,c) from the past
+	ldrb	r3,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r3,lsl#8
+	ldrb	r3,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 13==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r11,r11,ror#5
+	orr	r2,r2,r3,lsl#24
+	eor	r0,r0,r11,ror#19	@ Sigma1(e)
+#endif
+	ldr	r3,[r14],#4			@ *K256++
+	add	r6,r6,r2			@ h+=X[i]
+	str	r2,[sp,#13*4]
+	eor	r2,r4,r5
+	add	r6,r6,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r11
+	add	r6,r6,r3			@ h+=K256[i]
+	eor	r2,r2,r5			@ Ch(e,f,g)
+	eor	r0,r7,r7,ror#11
+	add	r6,r6,r2			@ h+=Ch(e,f,g)
+#if 13==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 13<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r7,r8			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#15*4]		@ from future BODY_16_xx
+	eor	r3,r7,r8			@ a^b, b^c in next round
+	ldr	r1,[sp,#12*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r7,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r10,r10,r6			@ d+=h
+	eor	r12,r12,r8			@ Maj(a,b,c)
+	add	r6,r6,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r6,r6,r12			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 14
+# if 14==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r10,r10,ror#5
+	add	r6,r6,r12			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r10,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 14
+	add	r6,r6,r12			@ h+=Maj(a,b,c) from the past
+	ldrb	r12,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r12,lsl#8
+	ldrb	r12,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 14==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r10,r10,ror#5
+	orr	r2,r2,r12,lsl#24
+	eor	r0,r0,r10,ror#19	@ Sigma1(e)
+#endif
+	ldr	r12,[r14],#4			@ *K256++
+	add	r5,r5,r2			@ h+=X[i]
+	str	r2,[sp,#14*4]
+	eor	r2,r11,r4
+	add	r5,r5,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r10
+	add	r5,r5,r12			@ h+=K256[i]
+	eor	r2,r2,r4			@ Ch(e,f,g)
+	eor	r0,r6,r6,ror#11
+	add	r5,r5,r2			@ h+=Ch(e,f,g)
+#if 14==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 14<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r6,r7			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#0*4]		@ from future BODY_16_xx
+	eor	r12,r6,r7			@ a^b, b^c in next round
+	ldr	r1,[sp,#13*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r6,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r9,r9,r5			@ d+=h
+	eor	r3,r3,r7			@ Maj(a,b,c)
+	add	r5,r5,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r5,r5,r3			@ h+=Maj(a,b,c)
+#if __ARM_ARCH__>=7
+	@ ldr	r2,[r1],#4			@ 15
+# if 15==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r9,r9,ror#5
+	add	r5,r5,r3			@ h+=Maj(a,b,c) from the past
+	eor	r0,r0,r9,ror#19	@ Sigma1(e)
+# ifndef __ARMEB__
+	rev	r2,r2
+# endif
+#else
+	@ ldrb	r2,[r1,#3]			@ 15
+	add	r5,r5,r3			@ h+=Maj(a,b,c) from the past
+	ldrb	r3,[r1,#2]
+	ldrb	r0,[r1,#1]
+	orr	r2,r2,r3,lsl#8
+	ldrb	r3,[r1],#4
+	orr	r2,r2,r0,lsl#16
+# if 15==15
+	str	r1,[sp,#17*4]			@ make room for r1
+# endif
+	eor	r0,r9,r9,ror#5
+	orr	r2,r2,r3,lsl#24
+	eor	r0,r0,r9,ror#19	@ Sigma1(e)
+#endif
+	ldr	r3,[r14],#4			@ *K256++
+	add	r4,r4,r2			@ h+=X[i]
+	str	r2,[sp,#15*4]
+	eor	r2,r10,r11
+	add	r4,r4,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r9
+	add	r4,r4,r3			@ h+=K256[i]
+	eor	r2,r2,r11			@ Ch(e,f,g)
+	eor	r0,r5,r5,ror#11
+	add	r4,r4,r2			@ h+=Ch(e,f,g)
+#if 15==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 15<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r5,r6			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#1*4]		@ from future BODY_16_xx
+	eor	r3,r5,r6			@ a^b, b^c in next round
+	ldr	r1,[sp,#14*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r5,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r8,r8,r4			@ d+=h
+	eor	r12,r12,r6			@ Maj(a,b,c)
+	add	r4,r4,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r4,r4,r12			@ h+=Maj(a,b,c)
+.Lrounds_16_xx:
+	@ ldr	r2,[sp,#1*4]		@ 16
+	@ ldr	r1,[sp,#14*4]
+	mov	r0,r2,ror#7
+	add	r4,r4,r12			@ h+=Maj(a,b,c) from the past
+	mov	r12,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r12,r12,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#0*4]
+	eor	r12,r12,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#9*4]
+
+	add	r12,r12,r0
+	eor	r0,r8,r8,ror#5	@ from BODY_00_15
+	add	r2,r2,r12
+	eor	r0,r0,r8,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r12,[r14],#4			@ *K256++
+	add	r11,r11,r2			@ h+=X[i]
+	str	r2,[sp,#0*4]
+	eor	r2,r9,r10
+	add	r11,r11,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r8
+	add	r11,r11,r12			@ h+=K256[i]
+	eor	r2,r2,r10			@ Ch(e,f,g)
+	eor	r0,r4,r4,ror#11
+	add	r11,r11,r2			@ h+=Ch(e,f,g)
+#if 16==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 16<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r4,r5			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#2*4]		@ from future BODY_16_xx
+	eor	r12,r4,r5			@ a^b, b^c in next round
+	ldr	r1,[sp,#15*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r4,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r7,r7,r11			@ d+=h
+	eor	r3,r3,r5			@ Maj(a,b,c)
+	add	r11,r11,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r11,r11,r3			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#2*4]		@ 17
+	@ ldr	r1,[sp,#15*4]
+	mov	r0,r2,ror#7
+	add	r11,r11,r3			@ h+=Maj(a,b,c) from the past
+	mov	r3,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r3,r3,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#1*4]
+	eor	r3,r3,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#10*4]
+
+	add	r3,r3,r0
+	eor	r0,r7,r7,ror#5	@ from BODY_00_15
+	add	r2,r2,r3
+	eor	r0,r0,r7,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r3,[r14],#4			@ *K256++
+	add	r10,r10,r2			@ h+=X[i]
+	str	r2,[sp,#1*4]
+	eor	r2,r8,r9
+	add	r10,r10,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r7
+	add	r10,r10,r3			@ h+=K256[i]
+	eor	r2,r2,r9			@ Ch(e,f,g)
+	eor	r0,r11,r11,ror#11
+	add	r10,r10,r2			@ h+=Ch(e,f,g)
+#if 17==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 17<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r11,r4			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#3*4]		@ from future BODY_16_xx
+	eor	r3,r11,r4			@ a^b, b^c in next round
+	ldr	r1,[sp,#0*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r11,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r6,r6,r10			@ d+=h
+	eor	r12,r12,r4			@ Maj(a,b,c)
+	add	r10,r10,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r10,r10,r12			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#3*4]		@ 18
+	@ ldr	r1,[sp,#0*4]
+	mov	r0,r2,ror#7
+	add	r10,r10,r12			@ h+=Maj(a,b,c) from the past
+	mov	r12,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r12,r12,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#2*4]
+	eor	r12,r12,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#11*4]
+
+	add	r12,r12,r0
+	eor	r0,r6,r6,ror#5	@ from BODY_00_15
+	add	r2,r2,r12
+	eor	r0,r0,r6,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r12,[r14],#4			@ *K256++
+	add	r9,r9,r2			@ h+=X[i]
+	str	r2,[sp,#2*4]
+	eor	r2,r7,r8
+	add	r9,r9,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r6
+	add	r9,r9,r12			@ h+=K256[i]
+	eor	r2,r2,r8			@ Ch(e,f,g)
+	eor	r0,r10,r10,ror#11
+	add	r9,r9,r2			@ h+=Ch(e,f,g)
+#if 18==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 18<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r10,r11			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#4*4]		@ from future BODY_16_xx
+	eor	r12,r10,r11			@ a^b, b^c in next round
+	ldr	r1,[sp,#1*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r10,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r5,r5,r9			@ d+=h
+	eor	r3,r3,r11			@ Maj(a,b,c)
+	add	r9,r9,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r9,r9,r3			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#4*4]		@ 19
+	@ ldr	r1,[sp,#1*4]
+	mov	r0,r2,ror#7
+	add	r9,r9,r3			@ h+=Maj(a,b,c) from the past
+	mov	r3,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r3,r3,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#3*4]
+	eor	r3,r3,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#12*4]
+
+	add	r3,r3,r0
+	eor	r0,r5,r5,ror#5	@ from BODY_00_15
+	add	r2,r2,r3
+	eor	r0,r0,r5,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r3,[r14],#4			@ *K256++
+	add	r8,r8,r2			@ h+=X[i]
+	str	r2,[sp,#3*4]
+	eor	r2,r6,r7
+	add	r8,r8,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r5
+	add	r8,r8,r3			@ h+=K256[i]
+	eor	r2,r2,r7			@ Ch(e,f,g)
+	eor	r0,r9,r9,ror#11
+	add	r8,r8,r2			@ h+=Ch(e,f,g)
+#if 19==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 19<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r9,r10			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#5*4]		@ from future BODY_16_xx
+	eor	r3,r9,r10			@ a^b, b^c in next round
+	ldr	r1,[sp,#2*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r9,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r4,r4,r8			@ d+=h
+	eor	r12,r12,r10			@ Maj(a,b,c)
+	add	r8,r8,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r8,r8,r12			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#5*4]		@ 20
+	@ ldr	r1,[sp,#2*4]
+	mov	r0,r2,ror#7
+	add	r8,r8,r12			@ h+=Maj(a,b,c) from the past
+	mov	r12,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r12,r12,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#4*4]
+	eor	r12,r12,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#13*4]
+
+	add	r12,r12,r0
+	eor	r0,r4,r4,ror#5	@ from BODY_00_15
+	add	r2,r2,r12
+	eor	r0,r0,r4,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r12,[r14],#4			@ *K256++
+	add	r7,r7,r2			@ h+=X[i]
+	str	r2,[sp,#4*4]
+	eor	r2,r5,r6
+	add	r7,r7,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r4
+	add	r7,r7,r12			@ h+=K256[i]
+	eor	r2,r2,r6			@ Ch(e,f,g)
+	eor	r0,r8,r8,ror#11
+	add	r7,r7,r2			@ h+=Ch(e,f,g)
+#if 20==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 20<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r8,r9			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#6*4]		@ from future BODY_16_xx
+	eor	r12,r8,r9			@ a^b, b^c in next round
+	ldr	r1,[sp,#3*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r8,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r11,r11,r7			@ d+=h
+	eor	r3,r3,r9			@ Maj(a,b,c)
+	add	r7,r7,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r7,r7,r3			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#6*4]		@ 21
+	@ ldr	r1,[sp,#3*4]
+	mov	r0,r2,ror#7
+	add	r7,r7,r3			@ h+=Maj(a,b,c) from the past
+	mov	r3,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r3,r3,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#5*4]
+	eor	r3,r3,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#14*4]
+
+	add	r3,r3,r0
+	eor	r0,r11,r11,ror#5	@ from BODY_00_15
+	add	r2,r2,r3
+	eor	r0,r0,r11,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r3,[r14],#4			@ *K256++
+	add	r6,r6,r2			@ h+=X[i]
+	str	r2,[sp,#5*4]
+	eor	r2,r4,r5
+	add	r6,r6,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r11
+	add	r6,r6,r3			@ h+=K256[i]
+	eor	r2,r2,r5			@ Ch(e,f,g)
+	eor	r0,r7,r7,ror#11
+	add	r6,r6,r2			@ h+=Ch(e,f,g)
+#if 21==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 21<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r7,r8			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#7*4]		@ from future BODY_16_xx
+	eor	r3,r7,r8			@ a^b, b^c in next round
+	ldr	r1,[sp,#4*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r7,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r10,r10,r6			@ d+=h
+	eor	r12,r12,r8			@ Maj(a,b,c)
+	add	r6,r6,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r6,r6,r12			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#7*4]		@ 22
+	@ ldr	r1,[sp,#4*4]
+	mov	r0,r2,ror#7
+	add	r6,r6,r12			@ h+=Maj(a,b,c) from the past
+	mov	r12,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r12,r12,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#6*4]
+	eor	r12,r12,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#15*4]
+
+	add	r12,r12,r0
+	eor	r0,r10,r10,ror#5	@ from BODY_00_15
+	add	r2,r2,r12
+	eor	r0,r0,r10,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r12,[r14],#4			@ *K256++
+	add	r5,r5,r2			@ h+=X[i]
+	str	r2,[sp,#6*4]
+	eor	r2,r11,r4
+	add	r5,r5,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r10
+	add	r5,r5,r12			@ h+=K256[i]
+	eor	r2,r2,r4			@ Ch(e,f,g)
+	eor	r0,r6,r6,ror#11
+	add	r5,r5,r2			@ h+=Ch(e,f,g)
+#if 22==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 22<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r6,r7			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#8*4]		@ from future BODY_16_xx
+	eor	r12,r6,r7			@ a^b, b^c in next round
+	ldr	r1,[sp,#5*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r6,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r9,r9,r5			@ d+=h
+	eor	r3,r3,r7			@ Maj(a,b,c)
+	add	r5,r5,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r5,r5,r3			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#8*4]		@ 23
+	@ ldr	r1,[sp,#5*4]
+	mov	r0,r2,ror#7
+	add	r5,r5,r3			@ h+=Maj(a,b,c) from the past
+	mov	r3,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r3,r3,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#7*4]
+	eor	r3,r3,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#0*4]
+
+	add	r3,r3,r0
+	eor	r0,r9,r9,ror#5	@ from BODY_00_15
+	add	r2,r2,r3
+	eor	r0,r0,r9,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r3,[r14],#4			@ *K256++
+	add	r4,r4,r2			@ h+=X[i]
+	str	r2,[sp,#7*4]
+	eor	r2,r10,r11
+	add	r4,r4,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r9
+	add	r4,r4,r3			@ h+=K256[i]
+	eor	r2,r2,r11			@ Ch(e,f,g)
+	eor	r0,r5,r5,ror#11
+	add	r4,r4,r2			@ h+=Ch(e,f,g)
+#if 23==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 23<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r5,r6			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#9*4]		@ from future BODY_16_xx
+	eor	r3,r5,r6			@ a^b, b^c in next round
+	ldr	r1,[sp,#6*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r5,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r8,r8,r4			@ d+=h
+	eor	r12,r12,r6			@ Maj(a,b,c)
+	add	r4,r4,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r4,r4,r12			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#9*4]		@ 24
+	@ ldr	r1,[sp,#6*4]
+	mov	r0,r2,ror#7
+	add	r4,r4,r12			@ h+=Maj(a,b,c) from the past
+	mov	r12,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r12,r12,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#8*4]
+	eor	r12,r12,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#1*4]
+
+	add	r12,r12,r0
+	eor	r0,r8,r8,ror#5	@ from BODY_00_15
+	add	r2,r2,r12
+	eor	r0,r0,r8,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r12,[r14],#4			@ *K256++
+	add	r11,r11,r2			@ h+=X[i]
+	str	r2,[sp,#8*4]
+	eor	r2,r9,r10
+	add	r11,r11,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r8
+	add	r11,r11,r12			@ h+=K256[i]
+	eor	r2,r2,r10			@ Ch(e,f,g)
+	eor	r0,r4,r4,ror#11
+	add	r11,r11,r2			@ h+=Ch(e,f,g)
+#if 24==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 24<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r4,r5			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#10*4]		@ from future BODY_16_xx
+	eor	r12,r4,r5			@ a^b, b^c in next round
+	ldr	r1,[sp,#7*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r4,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r7,r7,r11			@ d+=h
+	eor	r3,r3,r5			@ Maj(a,b,c)
+	add	r11,r11,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r11,r11,r3			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#10*4]		@ 25
+	@ ldr	r1,[sp,#7*4]
+	mov	r0,r2,ror#7
+	add	r11,r11,r3			@ h+=Maj(a,b,c) from the past
+	mov	r3,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r3,r3,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#9*4]
+	eor	r3,r3,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#2*4]
+
+	add	r3,r3,r0
+	eor	r0,r7,r7,ror#5	@ from BODY_00_15
+	add	r2,r2,r3
+	eor	r0,r0,r7,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r3,[r14],#4			@ *K256++
+	add	r10,r10,r2			@ h+=X[i]
+	str	r2,[sp,#9*4]
+	eor	r2,r8,r9
+	add	r10,r10,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r7
+	add	r10,r10,r3			@ h+=K256[i]
+	eor	r2,r2,r9			@ Ch(e,f,g)
+	eor	r0,r11,r11,ror#11
+	add	r10,r10,r2			@ h+=Ch(e,f,g)
+#if 25==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 25<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r11,r4			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#11*4]		@ from future BODY_16_xx
+	eor	r3,r11,r4			@ a^b, b^c in next round
+	ldr	r1,[sp,#8*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r11,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r6,r6,r10			@ d+=h
+	eor	r12,r12,r4			@ Maj(a,b,c)
+	add	r10,r10,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r10,r10,r12			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#11*4]		@ 26
+	@ ldr	r1,[sp,#8*4]
+	mov	r0,r2,ror#7
+	add	r10,r10,r12			@ h+=Maj(a,b,c) from the past
+	mov	r12,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r12,r12,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#10*4]
+	eor	r12,r12,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#3*4]
+
+	add	r12,r12,r0
+	eor	r0,r6,r6,ror#5	@ from BODY_00_15
+	add	r2,r2,r12
+	eor	r0,r0,r6,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r12,[r14],#4			@ *K256++
+	add	r9,r9,r2			@ h+=X[i]
+	str	r2,[sp,#10*4]
+	eor	r2,r7,r8
+	add	r9,r9,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r6
+	add	r9,r9,r12			@ h+=K256[i]
+	eor	r2,r2,r8			@ Ch(e,f,g)
+	eor	r0,r10,r10,ror#11
+	add	r9,r9,r2			@ h+=Ch(e,f,g)
+#if 26==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 26<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r10,r11			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#12*4]		@ from future BODY_16_xx
+	eor	r12,r10,r11			@ a^b, b^c in next round
+	ldr	r1,[sp,#9*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r10,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r5,r5,r9			@ d+=h
+	eor	r3,r3,r11			@ Maj(a,b,c)
+	add	r9,r9,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r9,r9,r3			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#12*4]		@ 27
+	@ ldr	r1,[sp,#9*4]
+	mov	r0,r2,ror#7
+	add	r9,r9,r3			@ h+=Maj(a,b,c) from the past
+	mov	r3,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r3,r3,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#11*4]
+	eor	r3,r3,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#4*4]
+
+	add	r3,r3,r0
+	eor	r0,r5,r5,ror#5	@ from BODY_00_15
+	add	r2,r2,r3
+	eor	r0,r0,r5,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r3,[r14],#4			@ *K256++
+	add	r8,r8,r2			@ h+=X[i]
+	str	r2,[sp,#11*4]
+	eor	r2,r6,r7
+	add	r8,r8,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r5
+	add	r8,r8,r3			@ h+=K256[i]
+	eor	r2,r2,r7			@ Ch(e,f,g)
+	eor	r0,r9,r9,ror#11
+	add	r8,r8,r2			@ h+=Ch(e,f,g)
+#if 27==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 27<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r9,r10			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#13*4]		@ from future BODY_16_xx
+	eor	r3,r9,r10			@ a^b, b^c in next round
+	ldr	r1,[sp,#10*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r9,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r4,r4,r8			@ d+=h
+	eor	r12,r12,r10			@ Maj(a,b,c)
+	add	r8,r8,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r8,r8,r12			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#13*4]		@ 28
+	@ ldr	r1,[sp,#10*4]
+	mov	r0,r2,ror#7
+	add	r8,r8,r12			@ h+=Maj(a,b,c) from the past
+	mov	r12,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r12,r12,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#12*4]
+	eor	r12,r12,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#5*4]
+
+	add	r12,r12,r0
+	eor	r0,r4,r4,ror#5	@ from BODY_00_15
+	add	r2,r2,r12
+	eor	r0,r0,r4,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r12,[r14],#4			@ *K256++
+	add	r7,r7,r2			@ h+=X[i]
+	str	r2,[sp,#12*4]
+	eor	r2,r5,r6
+	add	r7,r7,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r4
+	add	r7,r7,r12			@ h+=K256[i]
+	eor	r2,r2,r6			@ Ch(e,f,g)
+	eor	r0,r8,r8,ror#11
+	add	r7,r7,r2			@ h+=Ch(e,f,g)
+#if 28==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 28<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r8,r9			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#14*4]		@ from future BODY_16_xx
+	eor	r12,r8,r9			@ a^b, b^c in next round
+	ldr	r1,[sp,#11*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r8,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r11,r11,r7			@ d+=h
+	eor	r3,r3,r9			@ Maj(a,b,c)
+	add	r7,r7,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r7,r7,r3			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#14*4]		@ 29
+	@ ldr	r1,[sp,#11*4]
+	mov	r0,r2,ror#7
+	add	r7,r7,r3			@ h+=Maj(a,b,c) from the past
+	mov	r3,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r3,r3,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#13*4]
+	eor	r3,r3,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#6*4]
+
+	add	r3,r3,r0
+	eor	r0,r11,r11,ror#5	@ from BODY_00_15
+	add	r2,r2,r3
+	eor	r0,r0,r11,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r3,[r14],#4			@ *K256++
+	add	r6,r6,r2			@ h+=X[i]
+	str	r2,[sp,#13*4]
+	eor	r2,r4,r5
+	add	r6,r6,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r11
+	add	r6,r6,r3			@ h+=K256[i]
+	eor	r2,r2,r5			@ Ch(e,f,g)
+	eor	r0,r7,r7,ror#11
+	add	r6,r6,r2			@ h+=Ch(e,f,g)
+#if 29==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 29<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r7,r8			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#15*4]		@ from future BODY_16_xx
+	eor	r3,r7,r8			@ a^b, b^c in next round
+	ldr	r1,[sp,#12*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r7,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r10,r10,r6			@ d+=h
+	eor	r12,r12,r8			@ Maj(a,b,c)
+	add	r6,r6,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r6,r6,r12			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#15*4]		@ 30
+	@ ldr	r1,[sp,#12*4]
+	mov	r0,r2,ror#7
+	add	r6,r6,r12			@ h+=Maj(a,b,c) from the past
+	mov	r12,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r12,r12,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#14*4]
+	eor	r12,r12,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#7*4]
+
+	add	r12,r12,r0
+	eor	r0,r10,r10,ror#5	@ from BODY_00_15
+	add	r2,r2,r12
+	eor	r0,r0,r10,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r12,[r14],#4			@ *K256++
+	add	r5,r5,r2			@ h+=X[i]
+	str	r2,[sp,#14*4]
+	eor	r2,r11,r4
+	add	r5,r5,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r10
+	add	r5,r5,r12			@ h+=K256[i]
+	eor	r2,r2,r4			@ Ch(e,f,g)
+	eor	r0,r6,r6,ror#11
+	add	r5,r5,r2			@ h+=Ch(e,f,g)
+#if 30==31
+	and	r12,r12,#0xff
+	cmp	r12,#0xf2			@ done?
+#endif
+#if 30<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r12,r6,r7			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#0*4]		@ from future BODY_16_xx
+	eor	r12,r6,r7			@ a^b, b^c in next round
+	ldr	r1,[sp,#13*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r6,ror#20	@ Sigma0(a)
+	and	r3,r3,r12			@ (b^c)&=(a^b)
+	add	r9,r9,r5			@ d+=h
+	eor	r3,r3,r7			@ Maj(a,b,c)
+	add	r5,r5,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r5,r5,r3			@ h+=Maj(a,b,c)
+	@ ldr	r2,[sp,#0*4]		@ 31
+	@ ldr	r1,[sp,#13*4]
+	mov	r0,r2,ror#7
+	add	r5,r5,r3			@ h+=Maj(a,b,c) from the past
+	mov	r3,r1,ror#17
+	eor	r0,r0,r2,ror#18
+	eor	r3,r3,r1,ror#19
+	eor	r0,r0,r2,lsr#3	@ sigma0(X[i+1])
+	ldr	r2,[sp,#15*4]
+	eor	r3,r3,r1,lsr#10	@ sigma1(X[i+14])
+	ldr	r1,[sp,#8*4]
+
+	add	r3,r3,r0
+	eor	r0,r9,r9,ror#5	@ from BODY_00_15
+	add	r2,r2,r3
+	eor	r0,r0,r9,ror#19	@ Sigma1(e)
+	add	r2,r2,r1			@ X[i]
+	ldr	r3,[r14],#4			@ *K256++
+	add	r4,r4,r2			@ h+=X[i]
+	str	r2,[sp,#15*4]
+	eor	r2,r10,r11
+	add	r4,r4,r0,ror#6	@ h+=Sigma1(e)
+	and	r2,r2,r9
+	add	r4,r4,r3			@ h+=K256[i]
+	eor	r2,r2,r11			@ Ch(e,f,g)
+	eor	r0,r5,r5,ror#11
+	add	r4,r4,r2			@ h+=Ch(e,f,g)
+#if 31==31
+	and	r3,r3,#0xff
+	cmp	r3,#0xf2			@ done?
+#endif
+#if 31<15
+# if __ARM_ARCH__>=7
+	ldr	r2,[r1],#4			@ prefetch
+# else
+	ldrb	r2,[r1,#3]
+# endif
+	eor	r3,r5,r6			@ a^b, b^c in next round
+#else
+	ldr	r2,[sp,#1*4]		@ from future BODY_16_xx
+	eor	r3,r5,r6			@ a^b, b^c in next round
+	ldr	r1,[sp,#14*4]	@ from future BODY_16_xx
+#endif
+	eor	r0,r0,r5,ror#20	@ Sigma0(a)
+	and	r12,r12,r3			@ (b^c)&=(a^b)
+	add	r8,r8,r4			@ d+=h
+	eor	r12,r12,r6			@ Maj(a,b,c)
+	add	r4,r4,r0,ror#2	@ h+=Sigma0(a)
+	@ add	r4,r4,r12			@ h+=Maj(a,b,c)
+#ifdef	__thumb2__
+	ite	eq			@ Thumb2 thing, sanity check in ARM
+#endif
+	ldreq	r3,[sp,#16*4]		@ pull ctx
+	bne	.Lrounds_16_xx
+
+	add	r4,r4,r12		@ h+=Maj(a,b,c) from the past
+	ldr	r0,[r3,#0]
+	ldr	r2,[r3,#4]
+	ldr	r12,[r3,#8]
+	add	r4,r4,r0
+	ldr	r0,[r3,#12]
+	add	r5,r5,r2
+	ldr	r2,[r3,#16]
+	add	r6,r6,r12
+	ldr	r12,[r3,#20]
+	add	r7,r7,r0
+	ldr	r0,[r3,#24]
+	add	r8,r8,r2
+	ldr	r2,[r3,#28]
+	add	r9,r9,r12
+	ldr	r1,[sp,#17*4]		@ pull inp
+	ldr	r12,[sp,#18*4]		@ pull inp+len
+	add	r10,r10,r0
+	add	r11,r11,r2
+	stmia	r3,{r4,r5,r6,r7,r8,r9,r10,r11}
+	cmp	r1,r12
+	sub	r14,r14,#256	@ rewind Ktbl
+	bne	.Loop
+
+	add	sp,sp,#19*4	@ destroy frame
+#if __ARM_ARCH__>=5
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,pc}
+#else
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,lr}
+	tst	lr,#1
+	moveq	pc,lr			@ be binary compatible with V4, yet
+.word	0xe12fff1e			@ interoperable with Thumb ISA:-)
+#endif
+.size	cryptogams_sha256_block_data_order,.-cryptogams_sha256_block_data_order
+
+#if __ARM_MAX_ARCH__>=7
+.arch	armv7-a
+.fpu	neon
+
+.globl	cryptogams_sha256_block_data_order_neon
+.type	cryptogams_sha256_block_data_order_neon,%function
+.align	5
+.skip	16
+cryptogams_sha256_block_data_order_neon:
+
+	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+
+	sub	r11,sp,#16*4+16
+	adr	r14,K256
+	bic	r11,r11,#15		@ align for 128-bit stores
+	mov	r12,sp
+	mov	sp,r11			@ alloca
+	add	r2,r1,r2,lsl#6	@ len to point at the end of inp
+
+	vld1.8	{q0},[r1]!
+	vld1.8	{q1},[r1]!
+	vld1.8	{q2},[r1]!
+	vld1.8	{q3},[r1]!
+	vld1.32	{q8},[r14,:128]!
+	vld1.32	{q9},[r14,:128]!
+	vld1.32	{q10},[r14,:128]!
+	vld1.32	{q11},[r14,:128]!
+	vrev32.8	q0,q0		@ yes, even on
+	str	r0,[sp,#64]
+	vrev32.8	q1,q1		@ big-endian
+	str	r1,[sp,#68]
+	mov	r1,sp
+	vrev32.8	q2,q2
+	str	r2,[sp,#72]
+	vrev32.8	q3,q3
+	str	r12,[sp,#76]		@ save original sp
+	vadd.i32	q8,q8,q0
+	vadd.i32	q9,q9,q1
+	vst1.32	{q8},[r1,:128]!
+	vadd.i32	q10,q10,q2
+	vst1.32	{q9},[r1,:128]!
+	vadd.i32	q11,q11,q3
+	vst1.32	{q10},[r1,:128]!
+	vst1.32	{q11},[r1,:128]!
+
+	ldmia	r0,{r4,r5,r6,r7,r8,r9,r10,r11}
+	sub	r1,r1,#64
+	ldr	r2,[sp,#0]
+	eor	r12,r12,r12
+	eor	r3,r5,r6
+	b	.L_00_48
+
+.align	4
+.L_00_48:
+	vext.8	q8,q0,q1,#4
+	add	r11,r11,r2
+	eor	r2,r9,r10
+	eor	r0,r8,r8,ror#5
+	vext.8	q9,q2,q3,#4
+	add	r4,r4,r12
+	and	r2,r2,r8
+	eor	r12,r0,r8,ror#19
+	vshr.u32	q10,q8,#7
+	eor	r0,r4,r4,ror#11
+	eor	r2,r2,r10
+	vadd.i32	q0,q0,q9
+	add	r11,r11,r12,ror#6
+	eor	r12,r4,r5
+	vshr.u32	q9,q8,#3
+	eor	r0,r0,r4,ror#20
+	add	r11,r11,r2
+	vsli.32	q10,q8,#25
+	ldr	r2,[sp,#4]
+	and	r3,r3,r12
+	vshr.u32	q11,q8,#18
+	add	r7,r7,r11
+	add	r11,r11,r0,ror#2
+	eor	r3,r3,r5
+	veor	q9,q9,q10
+	add	r10,r10,r2
+	vsli.32	q11,q8,#14
+	eor	r2,r8,r9
+	eor	r0,r7,r7,ror#5
+	vshr.u32	d24,d7,#17
+	add	r11,r11,r3
+	and	r2,r2,r7
+	veor	q9,q9,q11
+	eor	r3,r0,r7,ror#19
+	eor	r0,r11,r11,ror#11
+	vsli.32	d24,d7,#15
+	eor	r2,r2,r9
+	add	r10,r10,r3,ror#6
+	vshr.u32	d25,d7,#10
+	eor	r3,r11,r4
+	eor	r0,r0,r11,ror#20
+	vadd.i32	q0,q0,q9
+	add	r10,r10,r2
+	ldr	r2,[sp,#8]
+	veor	d25,d25,d24
+	and	r12,r12,r3
+	add	r6,r6,r10
+	vshr.u32	d24,d7,#19
+	add	r10,r10,r0,ror#2
+	eor	r12,r12,r4
+	vsli.32	d24,d7,#13
+	add	r9,r9,r2
+	eor	r2,r7,r8
+	veor	d25,d25,d24
+	eor	r0,r6,r6,ror#5
+	add	r10,r10,r12
+	vadd.i32	d0,d0,d25
+	and	r2,r2,r6
+	eor	r12,r0,r6,ror#19
+	vshr.u32	d24,d0,#17
+	eor	r0,r10,r10,ror#11
+	eor	r2,r2,r8
+	vsli.32	d24,d0,#15
+	add	r9,r9,r12,ror#6
+	eor	r12,r10,r11
+	vshr.u32	d25,d0,#10
+	eor	r0,r0,r10,ror#20
+	add	r9,r9,r2
+	veor	d25,d25,d24
+	ldr	r2,[sp,#12]
+	and	r3,r3,r12
+	vshr.u32	d24,d0,#19
+	add	r5,r5,r9
+	add	r9,r9,r0,ror#2
+	eor	r3,r3,r11
+	vld1.32	{q8},[r14,:128]!
+	add	r8,r8,r2
+	vsli.32	d24,d0,#13
+	eor	r2,r6,r7
+	eor	r0,r5,r5,ror#5
+	veor	d25,d25,d24
+	add	r9,r9,r3
+	and	r2,r2,r5
+	vadd.i32	d1,d1,d25
+	eor	r3,r0,r5,ror#19
+	eor	r0,r9,r9,ror#11
+	vadd.i32	q8,q8,q0
+	eor	r2,r2,r7
+	add	r8,r8,r3,ror#6
+	eor	r3,r9,r10
+	eor	r0,r0,r9,ror#20
+	add	r8,r8,r2
+	ldr	r2,[sp,#16]
+	and	r12,r12,r3
+	add	r4,r4,r8
+	vst1.32	{q8},[r1,:128]!
+	add	r8,r8,r0,ror#2
+	eor	r12,r12,r10
+	vext.8	q8,q1,q2,#4
+	add	r7,r7,r2
+	eor	r2,r5,r6
+	eor	r0,r4,r4,ror#5
+	vext.8	q9,q3,q0,#4
+	add	r8,r8,r12
+	and	r2,r2,r4
+	eor	r12,r0,r4,ror#19
+	vshr.u32	q10,q8,#7
+	eor	r0,r8,r8,ror#11
+	eor	r2,r2,r6
+	vadd.i32	q1,q1,q9
+	add	r7,r7,r12,ror#6
+	eor	r12,r8,r9
+	vshr.u32	q9,q8,#3
+	eor	r0,r0,r8,ror#20
+	add	r7,r7,r2
+	vsli.32	q10,q8,#25
+	ldr	r2,[sp,#20]
+	and	r3,r3,r12
+	vshr.u32	q11,q8,#18
+	add	r11,r11,r7
+	add	r7,r7,r0,ror#2
+	eor	r3,r3,r9
+	veor	q9,q9,q10
+	add	r6,r6,r2
+	vsli.32	q11,q8,#14
+	eor	r2,r4,r5
+	eor	r0,r11,r11,ror#5
+	vshr.u32	d24,d1,#17
+	add	r7,r7,r3
+	and	r2,r2,r11
+	veor	q9,q9,q11
+	eor	r3,r0,r11,ror#19
+	eor	r0,r7,r7,ror#11
+	vsli.32	d24,d1,#15
+	eor	r2,r2,r5
+	add	r6,r6,r3,ror#6
+	vshr.u32	d25,d1,#10
+	eor	r3,r7,r8
+	eor	r0,r0,r7,ror#20
+	vadd.i32	q1,q1,q9
+	add	r6,r6,r2
+	ldr	r2,[sp,#24]
+	veor	d25,d25,d24
+	and	r12,r12,r3
+	add	r10,r10,r6
+	vshr.u32	d24,d1,#19
+	add	r6,r6,r0,ror#2
+	eor	r12,r12,r8
+	vsli.32	d24,d1,#13
+	add	r5,r5,r2
+	eor	r2,r11,r4
+	veor	d25,d25,d24
+	eor	r0,r10,r10,ror#5
+	add	r6,r6,r12
+	vadd.i32	d2,d2,d25
+	and	r2,r2,r10
+	eor	r12,r0,r10,ror#19
+	vshr.u32	d24,d2,#17
+	eor	r0,r6,r6,ror#11
+	eor	r2,r2,r4
+	vsli.32	d24,d2,#15
+	add	r5,r5,r12,ror#6
+	eor	r12,r6,r7
+	vshr.u32	d25,d2,#10
+	eor	r0,r0,r6,ror#20
+	add	r5,r5,r2
+	veor	d25,d25,d24
+	ldr	r2,[sp,#28]
+	and	r3,r3,r12
+	vshr.u32	d24,d2,#19
+	add	r9,r9,r5
+	add	r5,r5,r0,ror#2
+	eor	r3,r3,r7
+	vld1.32	{q8},[r14,:128]!
+	add	r4,r4,r2
+	vsli.32	d24,d2,#13
+	eor	r2,r10,r11
+	eor	r0,r9,r9,ror#5
+	veor	d25,d25,d24
+	add	r5,r5,r3
+	and	r2,r2,r9
+	vadd.i32	d3,d3,d25
+	eor	r3,r0,r9,ror#19
+	eor	r0,r5,r5,ror#11
+	vadd.i32	q8,q8,q1
+	eor	r2,r2,r11
+	add	r4,r4,r3,ror#6
+	eor	r3,r5,r6
+	eor	r0,r0,r5,ror#20
+	add	r4,r4,r2
+	ldr	r2,[sp,#32]
+	and	r12,r12,r3
+	add	r8,r8,r4
+	vst1.32	{q8},[r1,:128]!
+	add	r4,r4,r0,ror#2
+	eor	r12,r12,r6
+	vext.8	q8,q2,q3,#4
+	add	r11,r11,r2
+	eor	r2,r9,r10
+	eor	r0,r8,r8,ror#5
+	vext.8	q9,q0,q1,#4
+	add	r4,r4,r12
+	and	r2,r2,r8
+	eor	r12,r0,r8,ror#19
+	vshr.u32	q10,q8,#7
+	eor	r0,r4,r4,ror#11
+	eor	r2,r2,r10
+	vadd.i32	q2,q2,q9
+	add	r11,r11,r12,ror#6
+	eor	r12,r4,r5
+	vshr.u32	q9,q8,#3
+	eor	r0,r0,r4,ror#20
+	add	r11,r11,r2
+	vsli.32	q10,q8,#25
+	ldr	r2,[sp,#36]
+	and	r3,r3,r12
+	vshr.u32	q11,q8,#18
+	add	r7,r7,r11
+	add	r11,r11,r0,ror#2
+	eor	r3,r3,r5
+	veor	q9,q9,q10
+	add	r10,r10,r2
+	vsli.32	q11,q8,#14
+	eor	r2,r8,r9
+	eor	r0,r7,r7,ror#5
+	vshr.u32	d24,d3,#17
+	add	r11,r11,r3
+	and	r2,r2,r7
+	veor	q9,q9,q11
+	eor	r3,r0,r7,ror#19
+	eor	r0,r11,r11,ror#11
+	vsli.32	d24,d3,#15
+	eor	r2,r2,r9
+	add	r10,r10,r3,ror#6
+	vshr.u32	d25,d3,#10
+	eor	r3,r11,r4
+	eor	r0,r0,r11,ror#20
+	vadd.i32	q2,q2,q9
+	add	r10,r10,r2
+	ldr	r2,[sp,#40]
+	veor	d25,d25,d24
+	and	r12,r12,r3
+	add	r6,r6,r10
+	vshr.u32	d24,d3,#19
+	add	r10,r10,r0,ror#2
+	eor	r12,r12,r4
+	vsli.32	d24,d3,#13
+	add	r9,r9,r2
+	eor	r2,r7,r8
+	veor	d25,d25,d24
+	eor	r0,r6,r6,ror#5
+	add	r10,r10,r12
+	vadd.i32	d4,d4,d25
+	and	r2,r2,r6
+	eor	r12,r0,r6,ror#19
+	vshr.u32	d24,d4,#17
+	eor	r0,r10,r10,ror#11
+	eor	r2,r2,r8
+	vsli.32	d24,d4,#15
+	add	r9,r9,r12,ror#6
+	eor	r12,r10,r11
+	vshr.u32	d25,d4,#10
+	eor	r0,r0,r10,ror#20
+	add	r9,r9,r2
+	veor	d25,d25,d24
+	ldr	r2,[sp,#44]
+	and	r3,r3,r12
+	vshr.u32	d24,d4,#19
+	add	r5,r5,r9
+	add	r9,r9,r0,ror#2
+	eor	r3,r3,r11
+	vld1.32	{q8},[r14,:128]!
+	add	r8,r8,r2
+	vsli.32	d24,d4,#13
+	eor	r2,r6,r7
+	eor	r0,r5,r5,ror#5
+	veor	d25,d25,d24
+	add	r9,r9,r3
+	and	r2,r2,r5
+	vadd.i32	d5,d5,d25
+	eor	r3,r0,r5,ror#19
+	eor	r0,r9,r9,ror#11
+	vadd.i32	q8,q8,q2
+	eor	r2,r2,r7
+	add	r8,r8,r3,ror#6
+	eor	r3,r9,r10
+	eor	r0,r0,r9,ror#20
+	add	r8,r8,r2
+	ldr	r2,[sp,#48]
+	and	r12,r12,r3
+	add	r4,r4,r8
+	vst1.32	{q8},[r1,:128]!
+	add	r8,r8,r0,ror#2
+	eor	r12,r12,r10
+	vext.8	q8,q3,q0,#4
+	add	r7,r7,r2
+	eor	r2,r5,r6
+	eor	r0,r4,r4,ror#5
+	vext.8	q9,q1,q2,#4
+	add	r8,r8,r12
+	and	r2,r2,r4
+	eor	r12,r0,r4,ror#19
+	vshr.u32	q10,q8,#7
+	eor	r0,r8,r8,ror#11
+	eor	r2,r2,r6
+	vadd.i32	q3,q3,q9
+	add	r7,r7,r12,ror#6
+	eor	r12,r8,r9
+	vshr.u32	q9,q8,#3
+	eor	r0,r0,r8,ror#20
+	add	r7,r7,r2
+	vsli.32	q10,q8,#25
+	ldr	r2,[sp,#52]
+	and	r3,r3,r12
+	vshr.u32	q11,q8,#18
+	add	r11,r11,r7
+	add	r7,r7,r0,ror#2
+	eor	r3,r3,r9
+	veor	q9,q9,q10
+	add	r6,r6,r2
+	vsli.32	q11,q8,#14
+	eor	r2,r4,r5
+	eor	r0,r11,r11,ror#5
+	vshr.u32	d24,d5,#17
+	add	r7,r7,r3
+	and	r2,r2,r11
+	veor	q9,q9,q11
+	eor	r3,r0,r11,ror#19
+	eor	r0,r7,r7,ror#11
+	vsli.32	d24,d5,#15
+	eor	r2,r2,r5
+	add	r6,r6,r3,ror#6
+	vshr.u32	d25,d5,#10
+	eor	r3,r7,r8
+	eor	r0,r0,r7,ror#20
+	vadd.i32	q3,q3,q9
+	add	r6,r6,r2
+	ldr	r2,[sp,#56]
+	veor	d25,d25,d24
+	and	r12,r12,r3
+	add	r10,r10,r6
+	vshr.u32	d24,d5,#19
+	add	r6,r6,r0,ror#2
+	eor	r12,r12,r8
+	vsli.32	d24,d5,#13
+	add	r5,r5,r2
+	eor	r2,r11,r4
+	veor	d25,d25,d24
+	eor	r0,r10,r10,ror#5
+	add	r6,r6,r12
+	vadd.i32	d6,d6,d25
+	and	r2,r2,r10
+	eor	r12,r0,r10,ror#19
+	vshr.u32	d24,d6,#17
+	eor	r0,r6,r6,ror#11
+	eor	r2,r2,r4
+	vsli.32	d24,d6,#15
+	add	r5,r5,r12,ror#6
+	eor	r12,r6,r7
+	vshr.u32	d25,d6,#10
+	eor	r0,r0,r6,ror#20
+	add	r5,r5,r2
+	veor	d25,d25,d24
+	ldr	r2,[sp,#60]
+	and	r3,r3,r12
+	vshr.u32	d24,d6,#19
+	add	r9,r9,r5
+	add	r5,r5,r0,ror#2
+	eor	r3,r3,r7
+	vld1.32	{q8},[r14,:128]!
+	add	r4,r4,r2
+	vsli.32	d24,d6,#13
+	eor	r2,r10,r11
+	eor	r0,r9,r9,ror#5
+	veor	d25,d25,d24
+	add	r5,r5,r3
+	and	r2,r2,r9
+	vadd.i32	d7,d7,d25
+	eor	r3,r0,r9,ror#19
+	eor	r0,r5,r5,ror#11
+	vadd.i32	q8,q8,q3
+	eor	r2,r2,r11
+	add	r4,r4,r3,ror#6
+	eor	r3,r5,r6
+	eor	r0,r0,r5,ror#20
+	add	r4,r4,r2
+	ldr	r2,[r14]
+	and	r12,r12,r3
+	add	r8,r8,r4
+	vst1.32	{q8},[r1,:128]!
+	add	r4,r4,r0,ror#2
+	eor	r12,r12,r6
+	teq	r2,#0				@ check for K256 terminator
+	ldr	r2,[sp,#0]
+	sub	r1,r1,#64
+	bne	.L_00_48
+
+	ldr	r1,[sp,#68]
+	ldr	r0,[sp,#72]
+	sub	r14,r14,#256	@ rewind r14
+	teq	r1,r0
+	it	eq
+	subeq	r1,r1,#64		@ avoid SEGV
+	vld1.8	{q0},[r1]!		@ load next input block
+	vld1.8	{q1},[r1]!
+	vld1.8	{q2},[r1]!
+	vld1.8	{q3},[r1]!
+	it	ne
+	strne	r1,[sp,#68]
+	mov	r1,sp
+	add	r11,r11,r2
+	eor	r2,r9,r10
+	eor	r0,r8,r8,ror#5
+	add	r4,r4,r12
+	vld1.32	{q8},[r14,:128]!
+	and	r2,r2,r8
+	eor	r12,r0,r8,ror#19
+	eor	r0,r4,r4,ror#11
+	eor	r2,r2,r10
+	vrev32.8	q0,q0
+	add	r11,r11,r12,ror#6
+	eor	r12,r4,r5
+	eor	r0,r0,r4,ror#20
+	add	r11,r11,r2
+	vadd.i32	q8,q8,q0
+	ldr	r2,[sp,#4]
+	and	r3,r3,r12
+	add	r7,r7,r11
+	add	r11,r11,r0,ror#2
+	eor	r3,r3,r5
+	add	r10,r10,r2
+	eor	r2,r8,r9
+	eor	r0,r7,r7,ror#5
+	add	r11,r11,r3
+	and	r2,r2,r7
+	eor	r3,r0,r7,ror#19
+	eor	r0,r11,r11,ror#11
+	eor	r2,r2,r9
+	add	r10,r10,r3,ror#6
+	eor	r3,r11,r4
+	eor	r0,r0,r11,ror#20
+	add	r10,r10,r2
+	ldr	r2,[sp,#8]
+	and	r12,r12,r3
+	add	r6,r6,r10
+	add	r10,r10,r0,ror#2
+	eor	r12,r12,r4
+	add	r9,r9,r2
+	eor	r2,r7,r8
+	eor	r0,r6,r6,ror#5
+	add	r10,r10,r12
+	and	r2,r2,r6
+	eor	r12,r0,r6,ror#19
+	eor	r0,r10,r10,ror#11
+	eor	r2,r2,r8
+	add	r9,r9,r12,ror#6
+	eor	r12,r10,r11
+	eor	r0,r0,r10,ror#20
+	add	r9,r9,r2
+	ldr	r2,[sp,#12]
+	and	r3,r3,r12
+	add	r5,r5,r9
+	add	r9,r9,r0,ror#2
+	eor	r3,r3,r11
+	add	r8,r8,r2
+	eor	r2,r6,r7
+	eor	r0,r5,r5,ror#5
+	add	r9,r9,r3
+	and	r2,r2,r5
+	eor	r3,r0,r5,ror#19
+	eor	r0,r9,r9,ror#11
+	eor	r2,r2,r7
+	add	r8,r8,r3,ror#6
+	eor	r3,r9,r10
+	eor	r0,r0,r9,ror#20
+	add	r8,r8,r2
+	ldr	r2,[sp,#16]
+	and	r12,r12,r3
+	add	r4,r4,r8
+	add	r8,r8,r0,ror#2
+	eor	r12,r12,r10
+	vst1.32	{q8},[r1,:128]!
+	add	r7,r7,r2
+	eor	r2,r5,r6
+	eor	r0,r4,r4,ror#5
+	add	r8,r8,r12
+	vld1.32	{q8},[r14,:128]!
+	and	r2,r2,r4
+	eor	r12,r0,r4,ror#19
+	eor	r0,r8,r8,ror#11
+	eor	r2,r2,r6
+	vrev32.8	q1,q1
+	add	r7,r7,r12,ror#6
+	eor	r12,r8,r9
+	eor	r0,r0,r8,ror#20
+	add	r7,r7,r2
+	vadd.i32	q8,q8,q1
+	ldr	r2,[sp,#20]
+	and	r3,r3,r12
+	add	r11,r11,r7
+	add	r7,r7,r0,ror#2
+	eor	r3,r3,r9
+	add	r6,r6,r2
+	eor	r2,r4,r5
+	eor	r0,r11,r11,ror#5
+	add	r7,r7,r3
+	and	r2,r2,r11
+	eor	r3,r0,r11,ror#19
+	eor	r0,r7,r7,ror#11
+	eor	r2,r2,r5
+	add	r6,r6,r3,ror#6
+	eor	r3,r7,r8
+	eor	r0,r0,r7,ror#20
+	add	r6,r6,r2
+	ldr	r2,[sp,#24]
+	and	r12,r12,r3
+	add	r10,r10,r6
+	add	r6,r6,r0,ror#2
+	eor	r12,r12,r8
+	add	r5,r5,r2
+	eor	r2,r11,r4
+	eor	r0,r10,r10,ror#5
+	add	r6,r6,r12
+	and	r2,r2,r10
+	eor	r12,r0,r10,ror#19
+	eor	r0,r6,r6,ror#11
+	eor	r2,r2,r4
+	add	r5,r5,r12,ror#6
+	eor	r12,r6,r7
+	eor	r0,r0,r6,ror#20
+	add	r5,r5,r2
+	ldr	r2,[sp,#28]
+	and	r3,r3,r12
+	add	r9,r9,r5
+	add	r5,r5,r0,ror#2
+	eor	r3,r3,r7
+	add	r4,r4,r2
+	eor	r2,r10,r11
+	eor	r0,r9,r9,ror#5
+	add	r5,r5,r3
+	and	r2,r2,r9
+	eor	r3,r0,r9,ror#19
+	eor	r0,r5,r5,ror#11
+	eor	r2,r2,r11
+	add	r4,r4,r3,ror#6
+	eor	r3,r5,r6
+	eor	r0,r0,r5,ror#20
+	add	r4,r4,r2
+	ldr	r2,[sp,#32]
+	and	r12,r12,r3
+	add	r8,r8,r4
+	add	r4,r4,r0,ror#2
+	eor	r12,r12,r6
+	vst1.32	{q8},[r1,:128]!
+	add	r11,r11,r2
+	eor	r2,r9,r10
+	eor	r0,r8,r8,ror#5
+	add	r4,r4,r12
+	vld1.32	{q8},[r14,:128]!
+	and	r2,r2,r8
+	eor	r12,r0,r8,ror#19
+	eor	r0,r4,r4,ror#11
+	eor	r2,r2,r10
+	vrev32.8	q2,q2
+	add	r11,r11,r12,ror#6
+	eor	r12,r4,r5
+	eor	r0,r0,r4,ror#20
+	add	r11,r11,r2
+	vadd.i32	q8,q8,q2
+	ldr	r2,[sp,#36]
+	and	r3,r3,r12
+	add	r7,r7,r11
+	add	r11,r11,r0,ror#2
+	eor	r3,r3,r5
+	add	r10,r10,r2
+	eor	r2,r8,r9
+	eor	r0,r7,r7,ror#5
+	add	r11,r11,r3
+	and	r2,r2,r7
+	eor	r3,r0,r7,ror#19
+	eor	r0,r11,r11,ror#11
+	eor	r2,r2,r9
+	add	r10,r10,r3,ror#6
+	eor	r3,r11,r4
+	eor	r0,r0,r11,ror#20
+	add	r10,r10,r2
+	ldr	r2,[sp,#40]
+	and	r12,r12,r3
+	add	r6,r6,r10
+	add	r10,r10,r0,ror#2
+	eor	r12,r12,r4
+	add	r9,r9,r2
+	eor	r2,r7,r8
+	eor	r0,r6,r6,ror#5
+	add	r10,r10,r12
+	and	r2,r2,r6
+	eor	r12,r0,r6,ror#19
+	eor	r0,r10,r10,ror#11
+	eor	r2,r2,r8
+	add	r9,r9,r12,ror#6
+	eor	r12,r10,r11
+	eor	r0,r0,r10,ror#20
+	add	r9,r9,r2
+	ldr	r2,[sp,#44]
+	and	r3,r3,r12
+	add	r5,r5,r9
+	add	r9,r9,r0,ror#2
+	eor	r3,r3,r11
+	add	r8,r8,r2
+	eor	r2,r6,r7
+	eor	r0,r5,r5,ror#5
+	add	r9,r9,r3
+	and	r2,r2,r5
+	eor	r3,r0,r5,ror#19
+	eor	r0,r9,r9,ror#11
+	eor	r2,r2,r7
+	add	r8,r8,r3,ror#6
+	eor	r3,r9,r10
+	eor	r0,r0,r9,ror#20
+	add	r8,r8,r2
+	ldr	r2,[sp,#48]
+	and	r12,r12,r3
+	add	r4,r4,r8
+	add	r8,r8,r0,ror#2
+	eor	r12,r12,r10
+	vst1.32	{q8},[r1,:128]!
+	add	r7,r7,r2
+	eor	r2,r5,r6
+	eor	r0,r4,r4,ror#5
+	add	r8,r8,r12
+	vld1.32	{q8},[r14,:128]!
+	and	r2,r2,r4
+	eor	r12,r0,r4,ror#19
+	eor	r0,r8,r8,ror#11
+	eor	r2,r2,r6
+	vrev32.8	q3,q3
+	add	r7,r7,r12,ror#6
+	eor	r12,r8,r9
+	eor	r0,r0,r8,ror#20
+	add	r7,r7,r2
+	vadd.i32	q8,q8,q3
+	ldr	r2,[sp,#52]
+	and	r3,r3,r12
+	add	r11,r11,r7
+	add	r7,r7,r0,ror#2
+	eor	r3,r3,r9
+	add	r6,r6,r2
+	eor	r2,r4,r5
+	eor	r0,r11,r11,ror#5
+	add	r7,r7,r3
+	and	r2,r2,r11
+	eor	r3,r0,r11,ror#19
+	eor	r0,r7,r7,ror#11
+	eor	r2,r2,r5
+	add	r6,r6,r3,ror#6
+	eor	r3,r7,r8
+	eor	r0,r0,r7,ror#20
+	add	r6,r6,r2
+	ldr	r2,[sp,#56]
+	and	r12,r12,r3
+	add	r10,r10,r6
+	add	r6,r6,r0,ror#2
+	eor	r12,r12,r8
+	add	r5,r5,r2
+	eor	r2,r11,r4
+	eor	r0,r10,r10,ror#5
+	add	r6,r6,r12
+	and	r2,r2,r10
+	eor	r12,r0,r10,ror#19
+	eor	r0,r6,r6,ror#11
+	eor	r2,r2,r4
+	add	r5,r5,r12,ror#6
+	eor	r12,r6,r7
+	eor	r0,r0,r6,ror#20
+	add	r5,r5,r2
+	ldr	r2,[sp,#60]
+	and	r3,r3,r12
+	add	r9,r9,r5
+	add	r5,r5,r0,ror#2
+	eor	r3,r3,r7
+	add	r4,r4,r2
+	eor	r2,r10,r11
+	eor	r0,r9,r9,ror#5
+	add	r5,r5,r3
+	and	r2,r2,r9
+	eor	r3,r0,r9,ror#19
+	eor	r0,r5,r5,ror#11
+	eor	r2,r2,r11
+	add	r4,r4,r3,ror#6
+	eor	r3,r5,r6
+	eor	r0,r0,r5,ror#20
+	add	r4,r4,r2
+	ldr	r2,[sp,#64]
+	and	r12,r12,r3
+	add	r8,r8,r4
+	add	r4,r4,r0,ror#2
+	eor	r12,r12,r6
+	vst1.32	{q8},[r1,:128]!
+	ldr	r0,[r2,#0]
+	add	r4,r4,r12			@ h+=Maj(a,b,c) from the past
+	ldr	r12,[r2,#4]
+	ldr	r3,[r2,#8]
+	ldr	r1,[r2,#12]
+	add	r4,r4,r0			@ accumulate
+	ldr	r0,[r2,#16]
+	add	r5,r5,r12
+	ldr	r12,[r2,#20]
+	add	r6,r6,r3
+	ldr	r3,[r2,#24]
+	add	r7,r7,r1
+	ldr	r1,[r2,#28]
+	add	r8,r8,r0
+	str	r4,[r2],#4
+	add	r9,r9,r12
+	str	r5,[r2],#4
+	add	r10,r10,r3
+	str	r6,[r2],#4
+	add	r11,r11,r1
+	str	r7,[r2],#4
+	stmia	r2,{r8,r9,r10,r11}
+
+	ittte	ne
+	movne	r1,sp
+	ldrne	r2,[sp,#0]
+	eorne	r12,r12,r12
+	ldreq	sp,[sp,#76]			@ restore original sp
+	itt	ne
+	eorne	r3,r5,r6
+	bne	.L_00_48
+
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,pc}
+.size	cryptogams_sha256_block_data_order_neon,.-cryptogams_sha256_block_data_order_neon
+#endif
diff --git a/runtime/third_party/cryptopp/sha256_armv4.h b/runtime/third_party/cryptopp/sha256_armv4.h
new file mode 100644
index 0000000..5a4b88e
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha256_armv4.h
@@ -0,0 +1,23 @@
+/* Header file for use with Cryptogam's ARMv4 SHA1.    */
+/* Also see http://www.openssl.org/~appro/cryptogams/  */
+/* https://wiki.openssl.org/index.php/Cryptogams_SHA.  */
+
+#ifndef CRYPTOGAMS_SHA256_ARMV4_H
+#define CRYPTOGAMS_SHA256_ARMV4_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Crypto++ modified cryptogams_sha256_block_data_order to pass caps as a parameter. */
+/* Also see https://github.com/weidai11/cryptopp/issues/846.             */
+void cryptogams_sha256_block_data_order(void *state, const void *data, size_t blocks);
+
+/* Cryptogams arm caps */
+#define CRYPTOGAMS_ARMV7_NEON (1<<0)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* CRYPTOGAMS_SHA256_ARMV4_H */
diff --git a/runtime/third_party/cryptopp/sha3.cpp b/runtime/third_party/cryptopp/sha3.cpp
new file mode 100644
index 0000000..f9bd386
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha3.cpp
@@ -0,0 +1,71 @@
+// sha3.cpp - modified by Wei Dai from Ronny Van Keer's public domain
+//            Keccak-simple.c. All modifications here are placed in the
+//            public domain by Wei Dai.
+//            Keccack core function moved to keccakc.cpp in AUG 2018
+//            by Jeffrey Walton. Separating the core file allows both
+//            SHA3 and Keccack to share the core implementation.
+
+/*
+The Keccak sponge function, designed by Guido Bertoni, Joan Daemen,
+Michael Peeters and Gilles Van Assche. For more information, feedback or
+questions, please refer to our website: http://keccak.noekeon.org/
+
+Implementation by Ronny Van Keer, hereby denoted as "the implementer".
+
+To the extent possible under law, the implementer has waived all copyright
+and related or neighboring rights to the source code in this file.
+http://creativecommons.org/publicdomain/zero/1.0/
+*/
+
+#include "pch.h"
+#include "sha3.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// The Keccak core function
+extern void KeccakF1600(word64 *state);
+
+NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void SHA3::Update(const byte *input, size_t length)
+{
+    CRYPTOPP_ASSERT(!(input == NULLPTR && length != 0));
+    if (length == 0) { return; }
+
+    size_t spaceLeft;
+    while (length >= (spaceLeft = r() - m_counter))
+    {
+        if (spaceLeft)
+            xorbuf(m_state.BytePtr() + m_counter, input, spaceLeft);
+        KeccakF1600(m_state);
+        input += spaceLeft;
+        length -= spaceLeft;
+        m_counter = 0;
+    }
+
+    if (length)
+        xorbuf(m_state.BytePtr() + m_counter, input, length);
+    m_counter += (unsigned int)length;
+}
+
+void SHA3::Restart()
+{
+    std::memset(m_state, 0, m_state.SizeInBytes());
+    m_counter = 0;
+}
+
+void SHA3::TruncatedFinal(byte *hash, size_t size)
+{
+    CRYPTOPP_ASSERT(hash != NULLPTR);
+    ThrowIfInvalidTruncatedSize(size);
+
+    m_state.BytePtr()[m_counter] ^= 0x06;
+    m_state.BytePtr()[r()-1] ^= 0x80;
+    KeccakF1600(m_state);
+    std::memcpy(hash, m_state, size);
+    Restart();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/sha3.h b/runtime/third_party/cryptopp/sha3.h
new file mode 100644
index 0000000..97fce4b
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha3.h
@@ -0,0 +1,106 @@
+// sha3.h - originally written and placed in the public domain by Wei Dai
+
+/// \file sha3.h
+/// \brief Classes for SHA3 message digests
+/// \details The Crypto++ implementation conforms to the FIPS 202 version of SHA3 using F1600 with XOF d=0x06.
+///   Previous behavior (XOF d=0x01) is available in Keccak classes.
+/// \sa <a href="http://en.wikipedia.org/wiki/SHA-3">SHA-3</a>,
+///   <A HREF="http://csrc.nist.gov/groups/ST/hash/sha-3/fips202_standard_2015.html">SHA-3 STANDARD (FIPS 202)</A>.
+/// \since Crypto++ 5.6.2
+
+#ifndef CRYPTOPP_SHA3_H
+#define CRYPTOPP_SHA3_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SHA3 message digest base class
+/// \details The Crypto++ implementation conforms to FIPS 202 version of SHA3 using F1600 with XOF d=0x06.
+///   Previous behavior (XOF d=0x01) is available in Keccak classes.
+/// \details SHA3 is the base class for SHA3_224, SHA3_256, SHA3_384 and SHA3_512.
+///   Library users should instantiate a derived class, and only use SHA3
+///   as a base class reference or pointer.
+/// \sa Keccak, SHA3_224, SHA3_256, SHA3_384 and SHA3_512.
+/// \since Crypto++ 5.6.2
+class SHA3 : public HashTransformation
+{
+protected:
+    /// \brief Construct a SHA3
+    /// \param digestSize the digest size, in bytes
+    /// \details SHA3 is the base class for SHA3_224, SHA3_256, SHA3_384 and SHA3_512.
+    ///   Library users should instantiate a derived class, and only use SHA3
+    ///   as a base class reference or pointer.
+    /// \details This constructor was moved to protected at Crypto++ 8.1
+    ///   because users were attempting to create Keccak objects with it.
+    /// \since Crypto++ 5.6.2
+    SHA3(unsigned int digestSize) : m_digestSize(digestSize) {Restart();}
+
+public:
+    unsigned int DigestSize() const {return m_digestSize;}
+    unsigned int OptimalDataAlignment() const {return GetAlignmentOf<word64>();}
+
+    void Update(const byte *input, size_t length);
+    void Restart();
+    void TruncatedFinal(byte *hash, size_t size);
+
+protected:
+    inline unsigned int r() const {return BlockSize();}
+
+    FixedSizeSecBlock<word64, 25> m_state;
+    unsigned int m_digestSize, m_counter;
+};
+
+/// \brief SHA3 message digest template
+/// \tparam T_DigestSize the size of the digest, in bytes
+/// \since Crypto++ 5.6.2
+template<unsigned int T_DigestSize>
+class SHA3_Final : public SHA3
+{
+public:
+    CRYPTOPP_CONSTANT(DIGESTSIZE = T_DigestSize);
+    CRYPTOPP_CONSTANT(BLOCKSIZE = 200 - 2 * DIGESTSIZE);
+    static std::string StaticAlgorithmName()
+        { return "SHA3-" + IntToString(DIGESTSIZE * 8); }
+
+    /// \brief Construct a SHA3-X message digest
+    SHA3_Final() : SHA3(DIGESTSIZE) {}
+
+    /// \brief Provides the block size of the compression function
+    /// \return block size of the compression function, in bytes
+    /// \details BlockSize() will return 0 if the hash is not block based
+    ///   or does not have an equivalent block size. For example, Keccak
+    ///   and SHA-3 do not have a block size, but they do have an equivalent
+    ///   block size called rate expressed as <tt>r</tt>.
+    unsigned int BlockSize() const { return BLOCKSIZE; }
+
+    std::string AlgorithmName() const { return StaticAlgorithmName(); }
+
+private:
+#if !defined(__BORLANDC__)
+    // ensure there was no underflow in the math
+    CRYPTOPP_COMPILE_ASSERT(BLOCKSIZE < 200);
+#endif
+};
+
+/// \brief SHA3-224 message digest
+/// \since Crypto++ 5.6.2
+class SHA3_224 : public SHA3_Final<28> {};
+
+/// \brief SHA3-256 message digest
+/// \since Crypto++ 5.6.2
+class SHA3_256 : public SHA3_Final<32> {};
+
+/// \brief SHA3-384 message digest
+/// \since Crypto++ 5.6.2
+class SHA3_384 : public SHA3_Final<48> {};
+
+/// \brief SHA3-512 message digest
+/// \since Crypto++ 5.6.2
+class SHA3_512 : public SHA3_Final<64> {};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/sha512_armv4.S b/runtime/third_party/cryptopp/sha512_armv4.S
new file mode 100644
index 0000000..c8dfb19
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha512_armv4.S
@@ -0,0 +1,1861 @@
+@ Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
+@
+@ ====================================================================
+@ Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
+@ project. The module is, however, dual licensed under OpenSSL and
+@ CRYPTOGAMS licenses depending on where you obtain it. For further
+@ details see http://www.openssl.org/~appro/cryptogams/.
+@ ====================================================================
+
+@ JW, MAY 2019: Begin defines from taken from arm_arch.h
+@               The defines were included through the header.
+
+# if !defined(__ARM_ARCH__)
+#  if defined(__CC_ARM)
+#   define __ARM_ARCH__ __TARGET_ARCH_ARM
+#   if defined(__BIG_ENDIAN)
+#    define __ARMEB__
+#   else
+#    define __ARMEL__
+#   endif
+#  elif defined(__GNUC__)
+#   if   defined(__aarch64__)
+#    define __ARM_ARCH__ 8
+#    if __BYTE_ORDER__==__ORDER_BIG_ENDIAN__
+#     define __ARMEB__
+#    else
+#     define __ARMEL__
+#    endif
+
+#   elif defined(__ARM_ARCH)
+#    define __ARM_ARCH__ __ARM_ARCH
+#   elif defined(__ARM_ARCH_8A__)
+#    define __ARM_ARCH__ 8
+#   elif defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__)     || \
+        defined(__ARM_ARCH_7R__)|| defined(__ARM_ARCH_7M__)     || \
+        defined(__ARM_ARCH_7EM__)
+#    define __ARM_ARCH__ 7
+#   elif defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__)     || \
+        defined(__ARM_ARCH_6K__)|| defined(__ARM_ARCH_6M__)     || \
+        defined(__ARM_ARCH_6Z__)|| defined(__ARM_ARCH_6ZK__)    || \
+        defined(__ARM_ARCH_6T2__)
+#    define __ARM_ARCH__ 6
+#   elif defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__)     || \
+        defined(__ARM_ARCH_5E__)|| defined(__ARM_ARCH_5TE__)    || \
+        defined(__ARM_ARCH_5TEJ__)
+#    define __ARM_ARCH__ 5
+#   elif defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__)
+#    define __ARM_ARCH__ 4
+#   else
+#    error "unsupported ARM architecture"
+#   endif
+#  endif
+# endif
+
+# if !defined(__ARM_MAX_ARCH__)
+#  define __ARM_MAX_ARCH__ __ARM_ARCH__
+# endif
+
+# if __ARM_MAX_ARCH__<__ARM_ARCH__
+#  error "__ARM_MAX_ARCH__ can't be less than __ARM_ARCH__"
+# elif __ARM_MAX_ARCH__!=__ARM_ARCH__
+#  if __ARM_ARCH__<7 && __ARM_MAX_ARCH__>=7 && defined(__ARMEB__)
+#   error "can't build universal big-endian binary"
+#  endif
+# endif
+
+# define CRYPTOGAMS_ARMV7_NEON      (1<<0)
+
+@ JW, MAY 2019: End defines from taken from arm_arch.h
+@               Back to original Cryptogams code
+
+#ifdef __ARMEL__
+# define LO 0
+# define HI 4
+# define WORD64(hi0,lo0,hi1,lo1)	.word	lo0,hi0, lo1,hi1
+#else
+# define HI 0
+# define LO 4
+# define WORD64(hi0,lo0,hi1,lo1)	.word	hi0,lo0, hi1,lo1
+#endif
+
+#if defined(__thumb2__)
+.syntax	unified
+.thumb
+# define adrl adr
+#else
+.code	32
+#endif
+
+.text
+
+.type	K512,%object
+.align	5
+K512:
+	WORD64(0x428a2f98,0xd728ae22,	0x71374491,0x23ef65cd)
+	WORD64(0xb5c0fbcf,0xec4d3b2f,	0xe9b5dba5,0x8189dbbc)
+	WORD64(0x3956c25b,0xf348b538,	0x59f111f1,0xb605d019)
+	WORD64(0x923f82a4,0xaf194f9b,	0xab1c5ed5,0xda6d8118)
+	WORD64(0xd807aa98,0xa3030242,	0x12835b01,0x45706fbe)
+	WORD64(0x243185be,0x4ee4b28c,	0x550c7dc3,0xd5ffb4e2)
+	WORD64(0x72be5d74,0xf27b896f,	0x80deb1fe,0x3b1696b1)
+	WORD64(0x9bdc06a7,0x25c71235,	0xc19bf174,0xcf692694)
+	WORD64(0xe49b69c1,0x9ef14ad2,	0xefbe4786,0x384f25e3)
+	WORD64(0x0fc19dc6,0x8b8cd5b5,	0x240ca1cc,0x77ac9c65)
+	WORD64(0x2de92c6f,0x592b0275,	0x4a7484aa,0x6ea6e483)
+	WORD64(0x5cb0a9dc,0xbd41fbd4,	0x76f988da,0x831153b5)
+	WORD64(0x983e5152,0xee66dfab,	0xa831c66d,0x2db43210)
+	WORD64(0xb00327c8,0x98fb213f,	0xbf597fc7,0xbeef0ee4)
+	WORD64(0xc6e00bf3,0x3da88fc2,	0xd5a79147,0x930aa725)
+	WORD64(0x06ca6351,0xe003826f,	0x14292967,0x0a0e6e70)
+	WORD64(0x27b70a85,0x46d22ffc,	0x2e1b2138,0x5c26c926)
+	WORD64(0x4d2c6dfc,0x5ac42aed,	0x53380d13,0x9d95b3df)
+	WORD64(0x650a7354,0x8baf63de,	0x766a0abb,0x3c77b2a8)
+	WORD64(0x81c2c92e,0x47edaee6,	0x92722c85,0x1482353b)
+	WORD64(0xa2bfe8a1,0x4cf10364,	0xa81a664b,0xbc423001)
+	WORD64(0xc24b8b70,0xd0f89791,	0xc76c51a3,0x0654be30)
+	WORD64(0xd192e819,0xd6ef5218,	0xd6990624,0x5565a910)
+	WORD64(0xf40e3585,0x5771202a,	0x106aa070,0x32bbd1b8)
+	WORD64(0x19a4c116,0xb8d2d0c8,	0x1e376c08,0x5141ab53)
+	WORD64(0x2748774c,0xdf8eeb99,	0x34b0bcb5,0xe19b48a8)
+	WORD64(0x391c0cb3,0xc5c95a63,	0x4ed8aa4a,0xe3418acb)
+	WORD64(0x5b9cca4f,0x7763e373,	0x682e6ff3,0xd6b2b8a3)
+	WORD64(0x748f82ee,0x5defb2fc,	0x78a5636f,0x43172f60)
+	WORD64(0x84c87814,0xa1f0ab72,	0x8cc70208,0x1a6439ec)
+	WORD64(0x90befffa,0x23631e28,	0xa4506ceb,0xde82bde9)
+	WORD64(0xbef9a3f7,0xb2c67915,	0xc67178f2,0xe372532b)
+	WORD64(0xca273ece,0xea26619c,	0xd186b8c7,0x21c0c207)
+	WORD64(0xeada7dd6,0xcde0eb1e,	0xf57d4f7f,0xee6ed178)
+	WORD64(0x06f067aa,0x72176fba,	0x0a637dc5,0xa2c898a6)
+	WORD64(0x113f9804,0xbef90dae,	0x1b710b35,0x131c471b)
+	WORD64(0x28db77f5,0x23047d84,	0x32caab7b,0x40c72493)
+	WORD64(0x3c9ebe0a,0x15c9bebc,	0x431d67c4,0x9c100d4c)
+	WORD64(0x4cc5d4be,0xcb3e42b6,	0x597f299c,0xfc657e2a)
+	WORD64(0x5fcb6fab,0x3ad6faec,	0x6c44198c,0x4a475817)
+.size	K512,.-K512
+
+.skip	32
+
+.align	5
+.globl	cryptogams_sha512_block_data_order
+.type	cryptogams_sha512_block_data_order,%function
+
+cryptogams_sha512_block_data_order:
+.Lcryptogams_sha512_block_data_order:
+
+#if __ARM_ARCH__<7 && !defined(__thumb2__)
+	sub	r3,pc,#8		@ cryptogams_sha512_block_data_order
+#else
+	adr	r3,.Lcryptogams_sha512_block_data_order
+#endif
+
+	add	r2,r1,r2,lsl#7	@ len to point at the end of inp
+	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+	sub	r14,r3,#672		@ K512
+	sub	sp,sp,#9*8
+
+	ldr	r7,[r0,#32+LO]
+	ldr	r8,[r0,#32+HI]
+	ldr	r9, [r0,#48+LO]
+	ldr	r10, [r0,#48+HI]
+	ldr	r11, [r0,#56+LO]
+	ldr	r12, [r0,#56+HI]
+.Loop:
+	str	r9, [sp,#48+0]
+	str	r10, [sp,#48+4]
+	str	r11, [sp,#56+0]
+	str	r12, [sp,#56+4]
+	ldr	r5,[r0,#0+LO]
+	ldr	r6,[r0,#0+HI]
+	ldr	r3,[r0,#8+LO]
+	ldr	r4,[r0,#8+HI]
+	ldr	r9, [r0,#16+LO]
+	ldr	r10, [r0,#16+HI]
+	ldr	r11, [r0,#24+LO]
+	ldr	r12, [r0,#24+HI]
+	str	r3,[sp,#8+0]
+	str	r4,[sp,#8+4]
+	str	r9, [sp,#16+0]
+	str	r10, [sp,#16+4]
+	str	r11, [sp,#24+0]
+	str	r12, [sp,#24+4]
+	ldr	r3,[r0,#40+LO]
+	ldr	r4,[r0,#40+HI]
+	str	r3,[sp,#40+0]
+	str	r4,[sp,#40+4]
+
+.L00_15:
+#if __ARM_ARCH__<7
+	ldrb	r3,[r1,#7]
+	ldrb	r9, [r1,#6]
+	ldrb	r10, [r1,#5]
+	ldrb	r11, [r1,#4]
+	ldrb	r4,[r1,#3]
+	ldrb	r12, [r1,#2]
+	orr	r3,r3,r9,lsl#8
+	ldrb	r9, [r1,#1]
+	orr	r3,r3,r10,lsl#16
+	ldrb	r10, [r1],#8
+	orr	r3,r3,r11,lsl#24
+	orr	r4,r4,r12,lsl#8
+	orr	r4,r4,r9,lsl#16
+	orr	r4,r4,r10,lsl#24
+#else
+	ldr	r3,[r1,#4]
+	ldr	r4,[r1],#8
+#ifdef __ARMEL__
+	rev	r3,r3
+	rev	r4,r4
+#endif
+#endif
+	@ Sigma1(x)	(ROTR((x),14) ^ ROTR((x),18)  ^ ROTR((x),41))
+	@ LO		lo>>14^hi<<18 ^ lo>>18^hi<<14 ^ hi>>9^lo<<23
+	@ HI		hi>>14^lo<<18 ^ hi>>18^lo<<14 ^ lo>>9^hi<<23
+	mov	r9,r7,lsr#14
+	str	r3,[sp,#64+0]
+	mov	r10,r8,lsr#14
+	str	r4,[sp,#64+4]
+	eor	r9,r9,r8,lsl#18
+	ldr	r11,[sp,#56+0]	@ h.lo
+	eor	r10,r10,r7,lsl#18
+	ldr	r12,[sp,#56+4]	@ h.hi
+	eor	r9,r9,r7,lsr#18
+	eor	r10,r10,r8,lsr#18
+	eor	r9,r9,r8,lsl#14
+	eor	r10,r10,r7,lsl#14
+	eor	r9,r9,r8,lsr#9
+	eor	r10,r10,r7,lsr#9
+	eor	r9,r9,r7,lsl#23
+	eor	r10,r10,r8,lsl#23	@ Sigma1(e)
+	adds	r3,r3,r9
+	ldr	r9,[sp,#40+0]	@ f.lo
+	adc	r4,r4,r10		@ T += Sigma1(e)
+	ldr	r10,[sp,#40+4]	@ f.hi
+	adds	r3,r3,r11
+	ldr	r11,[sp,#48+0]	@ g.lo
+	adc	r4,r4,r12		@ T += h
+	ldr	r12,[sp,#48+4]	@ g.hi
+
+	eor	r9,r9,r11
+	str	r7,[sp,#32+0]
+	eor	r10,r10,r12
+	str	r8,[sp,#32+4]
+	and	r9,r9,r7
+	str	r5,[sp,#0+0]
+	and	r10,r10,r8
+	str	r6,[sp,#0+4]
+	eor	r9,r9,r11
+	ldr	r11,[r14,#LO]	@ K[i].lo
+	eor	r10,r10,r12		@ Ch(e,f,g)
+	ldr	r12,[r14,#HI]	@ K[i].hi
+
+	adds	r3,r3,r9
+	ldr	r7,[sp,#24+0]	@ d.lo
+	adc	r4,r4,r10		@ T += Ch(e,f,g)
+	ldr	r8,[sp,#24+4]	@ d.hi
+	adds	r3,r3,r11
+	and	r9,r11,#0xff
+	adc	r4,r4,r12		@ T += K[i]
+	adds	r7,r7,r3
+	ldr	r11,[sp,#8+0]	@ b.lo
+	adc	r8,r8,r4		@ d += T
+	teq	r9,#148
+
+	ldr	r12,[sp,#16+0]	@ c.lo
+#ifdef	__thumb2__
+	it	eq			@ Thumb2 thing, sanity check in ARM
+#endif
+	orreq	r14,r14,#1
+	@ Sigma0(x)	(ROTR((x),28) ^ ROTR((x),34) ^ ROTR((x),39))
+	@ LO		lo>>28^hi<<4  ^ hi>>2^lo<<30 ^ hi>>7^lo<<25
+	@ HI		hi>>28^lo<<4  ^ lo>>2^hi<<30 ^ lo>>7^hi<<25
+	mov	r9,r5,lsr#28
+	mov	r10,r6,lsr#28
+	eor	r9,r9,r6,lsl#4
+	eor	r10,r10,r5,lsl#4
+	eor	r9,r9,r6,lsr#2
+	eor	r10,r10,r5,lsr#2
+	eor	r9,r9,r5,lsl#30
+	eor	r10,r10,r6,lsl#30
+	eor	r9,r9,r6,lsr#7
+	eor	r10,r10,r5,lsr#7
+	eor	r9,r9,r5,lsl#25
+	eor	r10,r10,r6,lsl#25	@ Sigma0(a)
+	adds	r3,r3,r9
+	and	r9,r5,r11
+	adc	r4,r4,r10		@ T += Sigma0(a)
+
+	ldr	r10,[sp,#8+4]	@ b.hi
+	orr	r5,r5,r11
+	ldr	r11,[sp,#16+4]	@ c.hi
+	and	r5,r5,r12
+	and	r12,r6,r10
+	orr	r6,r6,r10
+	orr	r5,r5,r9		@ Maj(a,b,c).lo
+	and	r6,r6,r11
+	adds	r5,r5,r3
+	orr	r6,r6,r12		@ Maj(a,b,c).hi
+	sub	sp,sp,#8
+	adc	r6,r6,r4		@ h += T
+	tst	r14,#1
+	add	r14,r14,#8
+	tst	r14,#1
+	beq	.L00_15
+	ldr	r9,[sp,#184+0]
+	ldr	r10,[sp,#184+4]
+	bic	r14,r14,#1
+.L16_79:
+	@ sigma0(x)	(ROTR((x),1)  ^ ROTR((x),8)  ^ ((x)>>7))
+	@ LO		lo>>1^hi<<31  ^ lo>>8^hi<<24 ^ lo>>7^hi<<25
+	@ HI		hi>>1^lo<<31  ^ hi>>8^lo<<24 ^ hi>>7
+	mov	r3,r9,lsr#1
+	ldr	r11,[sp,#80+0]
+	mov	r4,r10,lsr#1
+	ldr	r12,[sp,#80+4]
+	eor	r3,r3,r10,lsl#31
+	eor	r4,r4,r9,lsl#31
+	eor	r3,r3,r9,lsr#8
+	eor	r4,r4,r10,lsr#8
+	eor	r3,r3,r10,lsl#24
+	eor	r4,r4,r9,lsl#24
+	eor	r3,r3,r9,lsr#7
+	eor	r4,r4,r10,lsr#7
+	eor	r3,r3,r10,lsl#25
+
+	@ sigma1(x)	(ROTR((x),19) ^ ROTR((x),61) ^ ((x)>>6))
+	@ LO		lo>>19^hi<<13 ^ hi>>29^lo<<3 ^ lo>>6^hi<<26
+	@ HI		hi>>19^lo<<13 ^ lo>>29^hi<<3 ^ hi>>6
+	mov	r9,r11,lsr#19
+	mov	r10,r12,lsr#19
+	eor	r9,r9,r12,lsl#13
+	eor	r10,r10,r11,lsl#13
+	eor	r9,r9,r12,lsr#29
+	eor	r10,r10,r11,lsr#29
+	eor	r9,r9,r11,lsl#3
+	eor	r10,r10,r12,lsl#3
+	eor	r9,r9,r11,lsr#6
+	eor	r10,r10,r12,lsr#6
+	ldr	r11,[sp,#120+0]
+	eor	r9,r9,r12,lsl#26
+
+	ldr	r12,[sp,#120+4]
+	adds	r3,r3,r9
+	ldr	r9,[sp,#192+0]
+	adc	r4,r4,r10
+
+	ldr	r10,[sp,#192+4]
+	adds	r3,r3,r11
+	adc	r4,r4,r12
+	adds	r3,r3,r9
+	adc	r4,r4,r10
+	@ Sigma1(x)	(ROTR((x),14) ^ ROTR((x),18)  ^ ROTR((x),41))
+	@ LO		lo>>14^hi<<18 ^ lo>>18^hi<<14 ^ hi>>9^lo<<23
+	@ HI		hi>>14^lo<<18 ^ hi>>18^lo<<14 ^ lo>>9^hi<<23
+	mov	r9,r7,lsr#14
+	str	r3,[sp,#64+0]
+	mov	r10,r8,lsr#14
+	str	r4,[sp,#64+4]
+	eor	r9,r9,r8,lsl#18
+	ldr	r11,[sp,#56+0]	@ h.lo
+	eor	r10,r10,r7,lsl#18
+	ldr	r12,[sp,#56+4]	@ h.hi
+	eor	r9,r9,r7,lsr#18
+	eor	r10,r10,r8,lsr#18
+	eor	r9,r9,r8,lsl#14
+	eor	r10,r10,r7,lsl#14
+	eor	r9,r9,r8,lsr#9
+	eor	r10,r10,r7,lsr#9
+	eor	r9,r9,r7,lsl#23
+	eor	r10,r10,r8,lsl#23	@ Sigma1(e)
+	adds	r3,r3,r9
+	ldr	r9,[sp,#40+0]	@ f.lo
+	adc	r4,r4,r10		@ T += Sigma1(e)
+	ldr	r10,[sp,#40+4]	@ f.hi
+	adds	r3,r3,r11
+	ldr	r11,[sp,#48+0]	@ g.lo
+	adc	r4,r4,r12		@ T += h
+	ldr	r12,[sp,#48+4]	@ g.hi
+
+	eor	r9,r9,r11
+	str	r7,[sp,#32+0]
+	eor	r10,r10,r12
+	str	r8,[sp,#32+4]
+	and	r9,r9,r7
+	str	r5,[sp,#0+0]
+	and	r10,r10,r8
+	str	r6,[sp,#0+4]
+	eor	r9,r9,r11
+	ldr	r11,[r14,#LO]	@ K[i].lo
+	eor	r10,r10,r12		@ Ch(e,f,g)
+	ldr	r12,[r14,#HI]	@ K[i].hi
+
+	adds	r3,r3,r9
+	ldr	r7,[sp,#24+0]	@ d.lo
+	adc	r4,r4,r10		@ T += Ch(e,f,g)
+	ldr	r8,[sp,#24+4]	@ d.hi
+	adds	r3,r3,r11
+	and	r9,r11,#0xff
+	adc	r4,r4,r12		@ T += K[i]
+	adds	r7,r7,r3
+	ldr	r11,[sp,#8+0]	@ b.lo
+	adc	r8,r8,r4		@ d += T
+	teq	r9,#23
+
+	ldr	r12,[sp,#16+0]	@ c.lo
+#ifdef	__thumb2__
+	it	eq			@ Thumb2 thing, sanity check in ARM
+#endif
+	orreq	r14,r14,#1
+	@ Sigma0(x)	(ROTR((x),28) ^ ROTR((x),34) ^ ROTR((x),39))
+	@ LO		lo>>28^hi<<4  ^ hi>>2^lo<<30 ^ hi>>7^lo<<25
+	@ HI		hi>>28^lo<<4  ^ lo>>2^hi<<30 ^ lo>>7^hi<<25
+	mov	r9,r5,lsr#28
+	mov	r10,r6,lsr#28
+	eor	r9,r9,r6,lsl#4
+	eor	r10,r10,r5,lsl#4
+	eor	r9,r9,r6,lsr#2
+	eor	r10,r10,r5,lsr#2
+	eor	r9,r9,r5,lsl#30
+	eor	r10,r10,r6,lsl#30
+	eor	r9,r9,r6,lsr#7
+	eor	r10,r10,r5,lsr#7
+	eor	r9,r9,r5,lsl#25
+	eor	r10,r10,r6,lsl#25	@ Sigma0(a)
+	adds	r3,r3,r9
+	and	r9,r5,r11
+	adc	r4,r4,r10		@ T += Sigma0(a)
+
+	ldr	r10,[sp,#8+4]	@ b.hi
+	orr	r5,r5,r11
+	ldr	r11,[sp,#16+4]	@ c.hi
+	and	r5,r5,r12
+	and	r12,r6,r10
+	orr	r6,r6,r10
+	orr	r5,r5,r9		@ Maj(a,b,c).lo
+	and	r6,r6,r11
+	adds	r5,r5,r3
+	orr	r6,r6,r12		@ Maj(a,b,c).hi
+	sub	sp,sp,#8
+	adc	r6,r6,r4		@ h += T
+	tst	r14,#1
+	add	r14,r14,#8
+#ifdef	__thumb2__
+	ittt	eq			@ Thumb2 thing, sanity check in ARM
+#endif
+	ldreq	r9,[sp,#184+0]
+	ldreq	r10,[sp,#184+4]
+	beq	.L16_79
+	bic	r14,r14,#1
+
+	ldr	r3,[sp,#8+0]
+	ldr	r4,[sp,#8+4]
+	ldr	r9, [r0,#0+LO]
+	ldr	r10, [r0,#0+HI]
+	ldr	r11, [r0,#8+LO]
+	ldr	r12, [r0,#8+HI]
+	adds	r9,r5,r9
+	str	r9, [r0,#0+LO]
+	adc	r10,r6,r10
+	str	r10, [r0,#0+HI]
+	adds	r11,r3,r11
+	str	r11, [r0,#8+LO]
+	adc	r12,r4,r12
+	str	r12, [r0,#8+HI]
+
+	ldr	r5,[sp,#16+0]
+	ldr	r6,[sp,#16+4]
+	ldr	r3,[sp,#24+0]
+	ldr	r4,[sp,#24+4]
+	ldr	r9, [r0,#16+LO]
+	ldr	r10, [r0,#16+HI]
+	ldr	r11, [r0,#24+LO]
+	ldr	r12, [r0,#24+HI]
+	adds	r9,r5,r9
+	str	r9, [r0,#16+LO]
+	adc	r10,r6,r10
+	str	r10, [r0,#16+HI]
+	adds	r11,r3,r11
+	str	r11, [r0,#24+LO]
+	adc	r12,r4,r12
+	str	r12, [r0,#24+HI]
+
+	ldr	r3,[sp,#40+0]
+	ldr	r4,[sp,#40+4]
+	ldr	r9, [r0,#32+LO]
+	ldr	r10, [r0,#32+HI]
+	ldr	r11, [r0,#40+LO]
+	ldr	r12, [r0,#40+HI]
+	adds	r7,r7,r9
+	str	r7,[r0,#32+LO]
+	adc	r8,r8,r10
+	str	r8,[r0,#32+HI]
+	adds	r11,r3,r11
+	str	r11, [r0,#40+LO]
+	adc	r12,r4,r12
+	str	r12, [r0,#40+HI]
+
+	ldr	r5,[sp,#48+0]
+	ldr	r6,[sp,#48+4]
+	ldr	r3,[sp,#56+0]
+	ldr	r4,[sp,#56+4]
+	ldr	r9, [r0,#48+LO]
+	ldr	r10, [r0,#48+HI]
+	ldr	r11, [r0,#56+LO]
+	ldr	r12, [r0,#56+HI]
+	adds	r9,r5,r9
+	str	r9, [r0,#48+LO]
+	adc	r10,r6,r10
+	str	r10, [r0,#48+HI]
+	adds	r11,r3,r11
+	str	r11, [r0,#56+LO]
+	adc	r12,r4,r12
+	str	r12, [r0,#56+HI]
+
+	add	sp,sp,#640
+	sub	r14,r14,#640
+
+	teq	r1,r2
+	bne	.Loop
+
+	add	sp,sp,#8*9		@ destroy frame
+#if __ARM_ARCH__>=5
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,pc}
+#else
+	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
+	tst	lr,#1
+	moveq	pc,lr			@ be binary compatible with V4, yet
+.word	0xe12fff1e			@ interoperable with Thumb ISA:-)
+#endif
+.size	cryptogams_sha512_block_data_order,.-cryptogams_sha512_block_data_order
+
+#if __ARM_MAX_ARCH__>=7
+.arch	armv7-a
+.fpu	neon
+
+.align	4
+.globl	cryptogams_sha512_block_data_order_neon
+.type	cryptogams_sha512_block_data_order_neon,%function
+
+cryptogams_sha512_block_data_order_neon:
+
+	dmb	@ errata #451034 on early Cortex A8
+	add	r2,r1,r2,lsl#7	@ len to point at the end of inp
+	adr	r3,K512
+	vstmdb  sp!,{d8-d15}
+	vldmia	r0,{d16,d17,d18,d19,d20,d21,d22,d23}		@ load context
+.Loop_neon:
+	vshr.u64	d24,d20,#14	@ 0
+#if 0<16
+	vld1.64	{d0},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d20,#18
+#if 0>0
+	vadd.i64	d16,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d20,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d20,#50
+	vsli.64	d25,d20,#46
+	vmov	d29,d20
+	vsli.64	d26,d20,#23
+#if 0<16 && defined(__ARMEL__)
+	vrev64.8	d0,d0
+#endif
+	veor	d25,d24
+	vbsl	d29,d21,d22		@ Ch(e,f,g)
+	vshr.u64	d24,d16,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d23
+	vshr.u64	d25,d16,#34
+	vsli.64	d24,d16,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d16,#39
+	vadd.i64	d28,d0
+	vsli.64	d25,d16,#30
+	veor	d30,d16,d17
+	vsli.64	d26,d16,#25
+	veor	d23,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d18,d17		@ Maj(a,b,c)
+	veor	d23,d26			@ Sigma0(a)
+	vadd.i64	d19,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d23,d30
+	vshr.u64	d24,d19,#14	@ 1
+#if 1<16
+	vld1.64	{d1},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d19,#18
+#if 1>0
+	vadd.i64	d23,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d19,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d19,#50
+	vsli.64	d25,d19,#46
+	vmov	d29,d19
+	vsli.64	d26,d19,#23
+#if 1<16 && defined(__ARMEL__)
+	vrev64.8	d1,d1
+#endif
+	veor	d25,d24
+	vbsl	d29,d20,d21		@ Ch(e,f,g)
+	vshr.u64	d24,d23,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d22
+	vshr.u64	d25,d23,#34
+	vsli.64	d24,d23,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d23,#39
+	vadd.i64	d28,d1
+	vsli.64	d25,d23,#30
+	veor	d30,d23,d16
+	vsli.64	d26,d23,#25
+	veor	d22,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d17,d16		@ Maj(a,b,c)
+	veor	d22,d26			@ Sigma0(a)
+	vadd.i64	d18,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d22,d30
+	vshr.u64	d24,d18,#14	@ 2
+#if 2<16
+	vld1.64	{d2},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d18,#18
+#if 2>0
+	vadd.i64	d22,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d18,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d18,#50
+	vsli.64	d25,d18,#46
+	vmov	d29,d18
+	vsli.64	d26,d18,#23
+#if 2<16 && defined(__ARMEL__)
+	vrev64.8	d2,d2
+#endif
+	veor	d25,d24
+	vbsl	d29,d19,d20		@ Ch(e,f,g)
+	vshr.u64	d24,d22,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d21
+	vshr.u64	d25,d22,#34
+	vsli.64	d24,d22,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d22,#39
+	vadd.i64	d28,d2
+	vsli.64	d25,d22,#30
+	veor	d30,d22,d23
+	vsli.64	d26,d22,#25
+	veor	d21,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d16,d23		@ Maj(a,b,c)
+	veor	d21,d26			@ Sigma0(a)
+	vadd.i64	d17,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d21,d30
+	vshr.u64	d24,d17,#14	@ 3
+#if 3<16
+	vld1.64	{d3},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d17,#18
+#if 3>0
+	vadd.i64	d21,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d17,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d17,#50
+	vsli.64	d25,d17,#46
+	vmov	d29,d17
+	vsli.64	d26,d17,#23
+#if 3<16 && defined(__ARMEL__)
+	vrev64.8	d3,d3
+#endif
+	veor	d25,d24
+	vbsl	d29,d18,d19		@ Ch(e,f,g)
+	vshr.u64	d24,d21,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d20
+	vshr.u64	d25,d21,#34
+	vsli.64	d24,d21,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d21,#39
+	vadd.i64	d28,d3
+	vsli.64	d25,d21,#30
+	veor	d30,d21,d22
+	vsli.64	d26,d21,#25
+	veor	d20,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d23,d22		@ Maj(a,b,c)
+	veor	d20,d26			@ Sigma0(a)
+	vadd.i64	d16,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d20,d30
+	vshr.u64	d24,d16,#14	@ 4
+#if 4<16
+	vld1.64	{d4},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d16,#18
+#if 4>0
+	vadd.i64	d20,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d16,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d16,#50
+	vsli.64	d25,d16,#46
+	vmov	d29,d16
+	vsli.64	d26,d16,#23
+#if 4<16 && defined(__ARMEL__)
+	vrev64.8	d4,d4
+#endif
+	veor	d25,d24
+	vbsl	d29,d17,d18		@ Ch(e,f,g)
+	vshr.u64	d24,d20,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d19
+	vshr.u64	d25,d20,#34
+	vsli.64	d24,d20,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d20,#39
+	vadd.i64	d28,d4
+	vsli.64	d25,d20,#30
+	veor	d30,d20,d21
+	vsli.64	d26,d20,#25
+	veor	d19,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d22,d21		@ Maj(a,b,c)
+	veor	d19,d26			@ Sigma0(a)
+	vadd.i64	d23,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d19,d30
+	vshr.u64	d24,d23,#14	@ 5
+#if 5<16
+	vld1.64	{d5},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d23,#18
+#if 5>0
+	vadd.i64	d19,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d23,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d23,#50
+	vsli.64	d25,d23,#46
+	vmov	d29,d23
+	vsli.64	d26,d23,#23
+#if 5<16 && defined(__ARMEL__)
+	vrev64.8	d5,d5
+#endif
+	veor	d25,d24
+	vbsl	d29,d16,d17		@ Ch(e,f,g)
+	vshr.u64	d24,d19,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d18
+	vshr.u64	d25,d19,#34
+	vsli.64	d24,d19,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d19,#39
+	vadd.i64	d28,d5
+	vsli.64	d25,d19,#30
+	veor	d30,d19,d20
+	vsli.64	d26,d19,#25
+	veor	d18,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d21,d20		@ Maj(a,b,c)
+	veor	d18,d26			@ Sigma0(a)
+	vadd.i64	d22,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d18,d30
+	vshr.u64	d24,d22,#14	@ 6
+#if 6<16
+	vld1.64	{d6},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d22,#18
+#if 6>0
+	vadd.i64	d18,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d22,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d22,#50
+	vsli.64	d25,d22,#46
+	vmov	d29,d22
+	vsli.64	d26,d22,#23
+#if 6<16 && defined(__ARMEL__)
+	vrev64.8	d6,d6
+#endif
+	veor	d25,d24
+	vbsl	d29,d23,d16		@ Ch(e,f,g)
+	vshr.u64	d24,d18,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d17
+	vshr.u64	d25,d18,#34
+	vsli.64	d24,d18,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d18,#39
+	vadd.i64	d28,d6
+	vsli.64	d25,d18,#30
+	veor	d30,d18,d19
+	vsli.64	d26,d18,#25
+	veor	d17,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d20,d19		@ Maj(a,b,c)
+	veor	d17,d26			@ Sigma0(a)
+	vadd.i64	d21,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d17,d30
+	vshr.u64	d24,d21,#14	@ 7
+#if 7<16
+	vld1.64	{d7},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d21,#18
+#if 7>0
+	vadd.i64	d17,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d21,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d21,#50
+	vsli.64	d25,d21,#46
+	vmov	d29,d21
+	vsli.64	d26,d21,#23
+#if 7<16 && defined(__ARMEL__)
+	vrev64.8	d7,d7
+#endif
+	veor	d25,d24
+	vbsl	d29,d22,d23		@ Ch(e,f,g)
+	vshr.u64	d24,d17,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d16
+	vshr.u64	d25,d17,#34
+	vsli.64	d24,d17,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d17,#39
+	vadd.i64	d28,d7
+	vsli.64	d25,d17,#30
+	veor	d30,d17,d18
+	vsli.64	d26,d17,#25
+	veor	d16,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d19,d18		@ Maj(a,b,c)
+	veor	d16,d26			@ Sigma0(a)
+	vadd.i64	d20,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d16,d30
+	vshr.u64	d24,d20,#14	@ 8
+#if 8<16
+	vld1.64	{d8},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d20,#18
+#if 8>0
+	vadd.i64	d16,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d20,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d20,#50
+	vsli.64	d25,d20,#46
+	vmov	d29,d20
+	vsli.64	d26,d20,#23
+#if 8<16 && defined(__ARMEL__)
+	vrev64.8	d8,d8
+#endif
+	veor	d25,d24
+	vbsl	d29,d21,d22		@ Ch(e,f,g)
+	vshr.u64	d24,d16,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d23
+	vshr.u64	d25,d16,#34
+	vsli.64	d24,d16,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d16,#39
+	vadd.i64	d28,d8
+	vsli.64	d25,d16,#30
+	veor	d30,d16,d17
+	vsli.64	d26,d16,#25
+	veor	d23,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d18,d17		@ Maj(a,b,c)
+	veor	d23,d26			@ Sigma0(a)
+	vadd.i64	d19,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d23,d30
+	vshr.u64	d24,d19,#14	@ 9
+#if 9<16
+	vld1.64	{d9},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d19,#18
+#if 9>0
+	vadd.i64	d23,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d19,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d19,#50
+	vsli.64	d25,d19,#46
+	vmov	d29,d19
+	vsli.64	d26,d19,#23
+#if 9<16 && defined(__ARMEL__)
+	vrev64.8	d9,d9
+#endif
+	veor	d25,d24
+	vbsl	d29,d20,d21		@ Ch(e,f,g)
+	vshr.u64	d24,d23,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d22
+	vshr.u64	d25,d23,#34
+	vsli.64	d24,d23,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d23,#39
+	vadd.i64	d28,d9
+	vsli.64	d25,d23,#30
+	veor	d30,d23,d16
+	vsli.64	d26,d23,#25
+	veor	d22,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d17,d16		@ Maj(a,b,c)
+	veor	d22,d26			@ Sigma0(a)
+	vadd.i64	d18,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d22,d30
+	vshr.u64	d24,d18,#14	@ 10
+#if 10<16
+	vld1.64	{d10},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d18,#18
+#if 10>0
+	vadd.i64	d22,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d18,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d18,#50
+	vsli.64	d25,d18,#46
+	vmov	d29,d18
+	vsli.64	d26,d18,#23
+#if 10<16 && defined(__ARMEL__)
+	vrev64.8	d10,d10
+#endif
+	veor	d25,d24
+	vbsl	d29,d19,d20		@ Ch(e,f,g)
+	vshr.u64	d24,d22,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d21
+	vshr.u64	d25,d22,#34
+	vsli.64	d24,d22,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d22,#39
+	vadd.i64	d28,d10
+	vsli.64	d25,d22,#30
+	veor	d30,d22,d23
+	vsli.64	d26,d22,#25
+	veor	d21,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d16,d23		@ Maj(a,b,c)
+	veor	d21,d26			@ Sigma0(a)
+	vadd.i64	d17,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d21,d30
+	vshr.u64	d24,d17,#14	@ 11
+#if 11<16
+	vld1.64	{d11},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d17,#18
+#if 11>0
+	vadd.i64	d21,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d17,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d17,#50
+	vsli.64	d25,d17,#46
+	vmov	d29,d17
+	vsli.64	d26,d17,#23
+#if 11<16 && defined(__ARMEL__)
+	vrev64.8	d11,d11
+#endif
+	veor	d25,d24
+	vbsl	d29,d18,d19		@ Ch(e,f,g)
+	vshr.u64	d24,d21,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d20
+	vshr.u64	d25,d21,#34
+	vsli.64	d24,d21,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d21,#39
+	vadd.i64	d28,d11
+	vsli.64	d25,d21,#30
+	veor	d30,d21,d22
+	vsli.64	d26,d21,#25
+	veor	d20,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d23,d22		@ Maj(a,b,c)
+	veor	d20,d26			@ Sigma0(a)
+	vadd.i64	d16,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d20,d30
+	vshr.u64	d24,d16,#14	@ 12
+#if 12<16
+	vld1.64	{d12},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d16,#18
+#if 12>0
+	vadd.i64	d20,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d16,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d16,#50
+	vsli.64	d25,d16,#46
+	vmov	d29,d16
+	vsli.64	d26,d16,#23
+#if 12<16 && defined(__ARMEL__)
+	vrev64.8	d12,d12
+#endif
+	veor	d25,d24
+	vbsl	d29,d17,d18		@ Ch(e,f,g)
+	vshr.u64	d24,d20,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d19
+	vshr.u64	d25,d20,#34
+	vsli.64	d24,d20,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d20,#39
+	vadd.i64	d28,d12
+	vsli.64	d25,d20,#30
+	veor	d30,d20,d21
+	vsli.64	d26,d20,#25
+	veor	d19,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d22,d21		@ Maj(a,b,c)
+	veor	d19,d26			@ Sigma0(a)
+	vadd.i64	d23,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d19,d30
+	vshr.u64	d24,d23,#14	@ 13
+#if 13<16
+	vld1.64	{d13},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d23,#18
+#if 13>0
+	vadd.i64	d19,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d23,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d23,#50
+	vsli.64	d25,d23,#46
+	vmov	d29,d23
+	vsli.64	d26,d23,#23
+#if 13<16 && defined(__ARMEL__)
+	vrev64.8	d13,d13
+#endif
+	veor	d25,d24
+	vbsl	d29,d16,d17		@ Ch(e,f,g)
+	vshr.u64	d24,d19,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d18
+	vshr.u64	d25,d19,#34
+	vsli.64	d24,d19,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d19,#39
+	vadd.i64	d28,d13
+	vsli.64	d25,d19,#30
+	veor	d30,d19,d20
+	vsli.64	d26,d19,#25
+	veor	d18,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d21,d20		@ Maj(a,b,c)
+	veor	d18,d26			@ Sigma0(a)
+	vadd.i64	d22,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d18,d30
+	vshr.u64	d24,d22,#14	@ 14
+#if 14<16
+	vld1.64	{d14},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d22,#18
+#if 14>0
+	vadd.i64	d18,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d22,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d22,#50
+	vsli.64	d25,d22,#46
+	vmov	d29,d22
+	vsli.64	d26,d22,#23
+#if 14<16 && defined(__ARMEL__)
+	vrev64.8	d14,d14
+#endif
+	veor	d25,d24
+	vbsl	d29,d23,d16		@ Ch(e,f,g)
+	vshr.u64	d24,d18,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d17
+	vshr.u64	d25,d18,#34
+	vsli.64	d24,d18,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d18,#39
+	vadd.i64	d28,d14
+	vsli.64	d25,d18,#30
+	veor	d30,d18,d19
+	vsli.64	d26,d18,#25
+	veor	d17,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d20,d19		@ Maj(a,b,c)
+	veor	d17,d26			@ Sigma0(a)
+	vadd.i64	d21,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d17,d30
+	vshr.u64	d24,d21,#14	@ 15
+#if 15<16
+	vld1.64	{d15},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d21,#18
+#if 15>0
+	vadd.i64	d17,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d21,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d21,#50
+	vsli.64	d25,d21,#46
+	vmov	d29,d21
+	vsli.64	d26,d21,#23
+#if 15<16 && defined(__ARMEL__)
+	vrev64.8	d15,d15
+#endif
+	veor	d25,d24
+	vbsl	d29,d22,d23		@ Ch(e,f,g)
+	vshr.u64	d24,d17,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d16
+	vshr.u64	d25,d17,#34
+	vsli.64	d24,d17,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d17,#39
+	vadd.i64	d28,d15
+	vsli.64	d25,d17,#30
+	veor	d30,d17,d18
+	vsli.64	d26,d17,#25
+	veor	d16,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d19,d18		@ Maj(a,b,c)
+	veor	d16,d26			@ Sigma0(a)
+	vadd.i64	d20,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d16,d30
+	mov	r12,#4
+.L16_79_neon:
+	subs	r12,#1
+	vshr.u64	q12,q7,#19
+	vshr.u64	q13,q7,#61
+	vadd.i64	d16,d30			@ h+=Maj from the past
+	vshr.u64	q15,q7,#6
+	vsli.64	q12,q7,#45
+	vext.8	q14,q0,q1,#8	@ X[i+1]
+	vsli.64	q13,q7,#3
+	veor	q15,q12
+	vshr.u64	q12,q14,#1
+	veor	q15,q13				@ sigma1(X[i+14])
+	vshr.u64	q13,q14,#8
+	vadd.i64	q0,q15
+	vshr.u64	q15,q14,#7
+	vsli.64	q12,q14,#63
+	vsli.64	q13,q14,#56
+	vext.8	q14,q4,q5,#8	@ X[i+9]
+	veor	q15,q12
+	vshr.u64	d24,d20,#14		@ from NEON_00_15
+	vadd.i64	q0,q14
+	vshr.u64	d25,d20,#18		@ from NEON_00_15
+	veor	q15,q13				@ sigma0(X[i+1])
+	vshr.u64	d26,d20,#41		@ from NEON_00_15
+	vadd.i64	q0,q15
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d20,#50
+	vsli.64	d25,d20,#46
+	vmov	d29,d20
+	vsli.64	d26,d20,#23
+#if 16<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d21,d22		@ Ch(e,f,g)
+	vshr.u64	d24,d16,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d23
+	vshr.u64	d25,d16,#34
+	vsli.64	d24,d16,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d16,#39
+	vadd.i64	d28,d0
+	vsli.64	d25,d16,#30
+	veor	d30,d16,d17
+	vsli.64	d26,d16,#25
+	veor	d23,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d18,d17		@ Maj(a,b,c)
+	veor	d23,d26			@ Sigma0(a)
+	vadd.i64	d19,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d23,d30
+	vshr.u64	d24,d19,#14	@ 17
+#if 17<16
+	vld1.64	{d1},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d19,#18
+#if 17>0
+	vadd.i64	d23,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d19,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d19,#50
+	vsli.64	d25,d19,#46
+	vmov	d29,d19
+	vsli.64	d26,d19,#23
+#if 17<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d20,d21		@ Ch(e,f,g)
+	vshr.u64	d24,d23,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d22
+	vshr.u64	d25,d23,#34
+	vsli.64	d24,d23,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d23,#39
+	vadd.i64	d28,d1
+	vsli.64	d25,d23,#30
+	veor	d30,d23,d16
+	vsli.64	d26,d23,#25
+	veor	d22,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d17,d16		@ Maj(a,b,c)
+	veor	d22,d26			@ Sigma0(a)
+	vadd.i64	d18,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d22,d30
+	vshr.u64	q12,q0,#19
+	vshr.u64	q13,q0,#61
+	vadd.i64	d22,d30			@ h+=Maj from the past
+	vshr.u64	q15,q0,#6
+	vsli.64	q12,q0,#45
+	vext.8	q14,q1,q2,#8	@ X[i+1]
+	vsli.64	q13,q0,#3
+	veor	q15,q12
+	vshr.u64	q12,q14,#1
+	veor	q15,q13				@ sigma1(X[i+14])
+	vshr.u64	q13,q14,#8
+	vadd.i64	q1,q15
+	vshr.u64	q15,q14,#7
+	vsli.64	q12,q14,#63
+	vsli.64	q13,q14,#56
+	vext.8	q14,q5,q6,#8	@ X[i+9]
+	veor	q15,q12
+	vshr.u64	d24,d18,#14		@ from NEON_00_15
+	vadd.i64	q1,q14
+	vshr.u64	d25,d18,#18		@ from NEON_00_15
+	veor	q15,q13				@ sigma0(X[i+1])
+	vshr.u64	d26,d18,#41		@ from NEON_00_15
+	vadd.i64	q1,q15
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d18,#50
+	vsli.64	d25,d18,#46
+	vmov	d29,d18
+	vsli.64	d26,d18,#23
+#if 18<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d19,d20		@ Ch(e,f,g)
+	vshr.u64	d24,d22,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d21
+	vshr.u64	d25,d22,#34
+	vsli.64	d24,d22,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d22,#39
+	vadd.i64	d28,d2
+	vsli.64	d25,d22,#30
+	veor	d30,d22,d23
+	vsli.64	d26,d22,#25
+	veor	d21,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d16,d23		@ Maj(a,b,c)
+	veor	d21,d26			@ Sigma0(a)
+	vadd.i64	d17,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d21,d30
+	vshr.u64	d24,d17,#14	@ 19
+#if 19<16
+	vld1.64	{d3},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d17,#18
+#if 19>0
+	vadd.i64	d21,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d17,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d17,#50
+	vsli.64	d25,d17,#46
+	vmov	d29,d17
+	vsli.64	d26,d17,#23
+#if 19<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d18,d19		@ Ch(e,f,g)
+	vshr.u64	d24,d21,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d20
+	vshr.u64	d25,d21,#34
+	vsli.64	d24,d21,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d21,#39
+	vadd.i64	d28,d3
+	vsli.64	d25,d21,#30
+	veor	d30,d21,d22
+	vsli.64	d26,d21,#25
+	veor	d20,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d23,d22		@ Maj(a,b,c)
+	veor	d20,d26			@ Sigma0(a)
+	vadd.i64	d16,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d20,d30
+	vshr.u64	q12,q1,#19
+	vshr.u64	q13,q1,#61
+	vadd.i64	d20,d30			@ h+=Maj from the past
+	vshr.u64	q15,q1,#6
+	vsli.64	q12,q1,#45
+	vext.8	q14,q2,q3,#8	@ X[i+1]
+	vsli.64	q13,q1,#3
+	veor	q15,q12
+	vshr.u64	q12,q14,#1
+	veor	q15,q13				@ sigma1(X[i+14])
+	vshr.u64	q13,q14,#8
+	vadd.i64	q2,q15
+	vshr.u64	q15,q14,#7
+	vsli.64	q12,q14,#63
+	vsli.64	q13,q14,#56
+	vext.8	q14,q6,q7,#8	@ X[i+9]
+	veor	q15,q12
+	vshr.u64	d24,d16,#14		@ from NEON_00_15
+	vadd.i64	q2,q14
+	vshr.u64	d25,d16,#18		@ from NEON_00_15
+	veor	q15,q13				@ sigma0(X[i+1])
+	vshr.u64	d26,d16,#41		@ from NEON_00_15
+	vadd.i64	q2,q15
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d16,#50
+	vsli.64	d25,d16,#46
+	vmov	d29,d16
+	vsli.64	d26,d16,#23
+#if 20<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d17,d18		@ Ch(e,f,g)
+	vshr.u64	d24,d20,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d19
+	vshr.u64	d25,d20,#34
+	vsli.64	d24,d20,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d20,#39
+	vadd.i64	d28,d4
+	vsli.64	d25,d20,#30
+	veor	d30,d20,d21
+	vsli.64	d26,d20,#25
+	veor	d19,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d22,d21		@ Maj(a,b,c)
+	veor	d19,d26			@ Sigma0(a)
+	vadd.i64	d23,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d19,d30
+	vshr.u64	d24,d23,#14	@ 21
+#if 21<16
+	vld1.64	{d5},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d23,#18
+#if 21>0
+	vadd.i64	d19,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d23,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d23,#50
+	vsli.64	d25,d23,#46
+	vmov	d29,d23
+	vsli.64	d26,d23,#23
+#if 21<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d16,d17		@ Ch(e,f,g)
+	vshr.u64	d24,d19,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d18
+	vshr.u64	d25,d19,#34
+	vsli.64	d24,d19,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d19,#39
+	vadd.i64	d28,d5
+	vsli.64	d25,d19,#30
+	veor	d30,d19,d20
+	vsli.64	d26,d19,#25
+	veor	d18,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d21,d20		@ Maj(a,b,c)
+	veor	d18,d26			@ Sigma0(a)
+	vadd.i64	d22,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d18,d30
+	vshr.u64	q12,q2,#19
+	vshr.u64	q13,q2,#61
+	vadd.i64	d18,d30			@ h+=Maj from the past
+	vshr.u64	q15,q2,#6
+	vsli.64	q12,q2,#45
+	vext.8	q14,q3,q4,#8	@ X[i+1]
+	vsli.64	q13,q2,#3
+	veor	q15,q12
+	vshr.u64	q12,q14,#1
+	veor	q15,q13				@ sigma1(X[i+14])
+	vshr.u64	q13,q14,#8
+	vadd.i64	q3,q15
+	vshr.u64	q15,q14,#7
+	vsli.64	q12,q14,#63
+	vsli.64	q13,q14,#56
+	vext.8	q14,q7,q0,#8	@ X[i+9]
+	veor	q15,q12
+	vshr.u64	d24,d22,#14		@ from NEON_00_15
+	vadd.i64	q3,q14
+	vshr.u64	d25,d22,#18		@ from NEON_00_15
+	veor	q15,q13				@ sigma0(X[i+1])
+	vshr.u64	d26,d22,#41		@ from NEON_00_15
+	vadd.i64	q3,q15
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d22,#50
+	vsli.64	d25,d22,#46
+	vmov	d29,d22
+	vsli.64	d26,d22,#23
+#if 22<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d23,d16		@ Ch(e,f,g)
+	vshr.u64	d24,d18,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d17
+	vshr.u64	d25,d18,#34
+	vsli.64	d24,d18,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d18,#39
+	vadd.i64	d28,d6
+	vsli.64	d25,d18,#30
+	veor	d30,d18,d19
+	vsli.64	d26,d18,#25
+	veor	d17,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d20,d19		@ Maj(a,b,c)
+	veor	d17,d26			@ Sigma0(a)
+	vadd.i64	d21,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d17,d30
+	vshr.u64	d24,d21,#14	@ 23
+#if 23<16
+	vld1.64	{d7},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d21,#18
+#if 23>0
+	vadd.i64	d17,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d21,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d21,#50
+	vsli.64	d25,d21,#46
+	vmov	d29,d21
+	vsli.64	d26,d21,#23
+#if 23<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d22,d23		@ Ch(e,f,g)
+	vshr.u64	d24,d17,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d16
+	vshr.u64	d25,d17,#34
+	vsli.64	d24,d17,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d17,#39
+	vadd.i64	d28,d7
+	vsli.64	d25,d17,#30
+	veor	d30,d17,d18
+	vsli.64	d26,d17,#25
+	veor	d16,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d19,d18		@ Maj(a,b,c)
+	veor	d16,d26			@ Sigma0(a)
+	vadd.i64	d20,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d16,d30
+	vshr.u64	q12,q3,#19
+	vshr.u64	q13,q3,#61
+	vadd.i64	d16,d30			@ h+=Maj from the past
+	vshr.u64	q15,q3,#6
+	vsli.64	q12,q3,#45
+	vext.8	q14,q4,q5,#8	@ X[i+1]
+	vsli.64	q13,q3,#3
+	veor	q15,q12
+	vshr.u64	q12,q14,#1
+	veor	q15,q13				@ sigma1(X[i+14])
+	vshr.u64	q13,q14,#8
+	vadd.i64	q4,q15
+	vshr.u64	q15,q14,#7
+	vsli.64	q12,q14,#63
+	vsli.64	q13,q14,#56
+	vext.8	q14,q0,q1,#8	@ X[i+9]
+	veor	q15,q12
+	vshr.u64	d24,d20,#14		@ from NEON_00_15
+	vadd.i64	q4,q14
+	vshr.u64	d25,d20,#18		@ from NEON_00_15
+	veor	q15,q13				@ sigma0(X[i+1])
+	vshr.u64	d26,d20,#41		@ from NEON_00_15
+	vadd.i64	q4,q15
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d20,#50
+	vsli.64	d25,d20,#46
+	vmov	d29,d20
+	vsli.64	d26,d20,#23
+#if 24<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d21,d22		@ Ch(e,f,g)
+	vshr.u64	d24,d16,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d23
+	vshr.u64	d25,d16,#34
+	vsli.64	d24,d16,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d16,#39
+	vadd.i64	d28,d8
+	vsli.64	d25,d16,#30
+	veor	d30,d16,d17
+	vsli.64	d26,d16,#25
+	veor	d23,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d18,d17		@ Maj(a,b,c)
+	veor	d23,d26			@ Sigma0(a)
+	vadd.i64	d19,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d23,d30
+	vshr.u64	d24,d19,#14	@ 25
+#if 25<16
+	vld1.64	{d9},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d19,#18
+#if 25>0
+	vadd.i64	d23,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d19,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d19,#50
+	vsli.64	d25,d19,#46
+	vmov	d29,d19
+	vsli.64	d26,d19,#23
+#if 25<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d20,d21		@ Ch(e,f,g)
+	vshr.u64	d24,d23,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d22
+	vshr.u64	d25,d23,#34
+	vsli.64	d24,d23,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d23,#39
+	vadd.i64	d28,d9
+	vsli.64	d25,d23,#30
+	veor	d30,d23,d16
+	vsli.64	d26,d23,#25
+	veor	d22,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d17,d16		@ Maj(a,b,c)
+	veor	d22,d26			@ Sigma0(a)
+	vadd.i64	d18,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d22,d30
+	vshr.u64	q12,q4,#19
+	vshr.u64	q13,q4,#61
+	vadd.i64	d22,d30			@ h+=Maj from the past
+	vshr.u64	q15,q4,#6
+	vsli.64	q12,q4,#45
+	vext.8	q14,q5,q6,#8	@ X[i+1]
+	vsli.64	q13,q4,#3
+	veor	q15,q12
+	vshr.u64	q12,q14,#1
+	veor	q15,q13				@ sigma1(X[i+14])
+	vshr.u64	q13,q14,#8
+	vadd.i64	q5,q15
+	vshr.u64	q15,q14,#7
+	vsli.64	q12,q14,#63
+	vsli.64	q13,q14,#56
+	vext.8	q14,q1,q2,#8	@ X[i+9]
+	veor	q15,q12
+	vshr.u64	d24,d18,#14		@ from NEON_00_15
+	vadd.i64	q5,q14
+	vshr.u64	d25,d18,#18		@ from NEON_00_15
+	veor	q15,q13				@ sigma0(X[i+1])
+	vshr.u64	d26,d18,#41		@ from NEON_00_15
+	vadd.i64	q5,q15
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d18,#50
+	vsli.64	d25,d18,#46
+	vmov	d29,d18
+	vsli.64	d26,d18,#23
+#if 26<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d19,d20		@ Ch(e,f,g)
+	vshr.u64	d24,d22,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d21
+	vshr.u64	d25,d22,#34
+	vsli.64	d24,d22,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d22,#39
+	vadd.i64	d28,d10
+	vsli.64	d25,d22,#30
+	veor	d30,d22,d23
+	vsli.64	d26,d22,#25
+	veor	d21,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d16,d23		@ Maj(a,b,c)
+	veor	d21,d26			@ Sigma0(a)
+	vadd.i64	d17,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d21,d30
+	vshr.u64	d24,d17,#14	@ 27
+#if 27<16
+	vld1.64	{d11},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d17,#18
+#if 27>0
+	vadd.i64	d21,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d17,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d17,#50
+	vsli.64	d25,d17,#46
+	vmov	d29,d17
+	vsli.64	d26,d17,#23
+#if 27<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d18,d19		@ Ch(e,f,g)
+	vshr.u64	d24,d21,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d20
+	vshr.u64	d25,d21,#34
+	vsli.64	d24,d21,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d21,#39
+	vadd.i64	d28,d11
+	vsli.64	d25,d21,#30
+	veor	d30,d21,d22
+	vsli.64	d26,d21,#25
+	veor	d20,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d23,d22		@ Maj(a,b,c)
+	veor	d20,d26			@ Sigma0(a)
+	vadd.i64	d16,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d20,d30
+	vshr.u64	q12,q5,#19
+	vshr.u64	q13,q5,#61
+	vadd.i64	d20,d30			@ h+=Maj from the past
+	vshr.u64	q15,q5,#6
+	vsli.64	q12,q5,#45
+	vext.8	q14,q6,q7,#8	@ X[i+1]
+	vsli.64	q13,q5,#3
+	veor	q15,q12
+	vshr.u64	q12,q14,#1
+	veor	q15,q13				@ sigma1(X[i+14])
+	vshr.u64	q13,q14,#8
+	vadd.i64	q6,q15
+	vshr.u64	q15,q14,#7
+	vsli.64	q12,q14,#63
+	vsli.64	q13,q14,#56
+	vext.8	q14,q2,q3,#8	@ X[i+9]
+	veor	q15,q12
+	vshr.u64	d24,d16,#14		@ from NEON_00_15
+	vadd.i64	q6,q14
+	vshr.u64	d25,d16,#18		@ from NEON_00_15
+	veor	q15,q13				@ sigma0(X[i+1])
+	vshr.u64	d26,d16,#41		@ from NEON_00_15
+	vadd.i64	q6,q15
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d16,#50
+	vsli.64	d25,d16,#46
+	vmov	d29,d16
+	vsli.64	d26,d16,#23
+#if 28<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d17,d18		@ Ch(e,f,g)
+	vshr.u64	d24,d20,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d19
+	vshr.u64	d25,d20,#34
+	vsli.64	d24,d20,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d20,#39
+	vadd.i64	d28,d12
+	vsli.64	d25,d20,#30
+	veor	d30,d20,d21
+	vsli.64	d26,d20,#25
+	veor	d19,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d22,d21		@ Maj(a,b,c)
+	veor	d19,d26			@ Sigma0(a)
+	vadd.i64	d23,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d19,d30
+	vshr.u64	d24,d23,#14	@ 29
+#if 29<16
+	vld1.64	{d13},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d23,#18
+#if 29>0
+	vadd.i64	d19,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d23,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d23,#50
+	vsli.64	d25,d23,#46
+	vmov	d29,d23
+	vsli.64	d26,d23,#23
+#if 29<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d16,d17		@ Ch(e,f,g)
+	vshr.u64	d24,d19,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d18
+	vshr.u64	d25,d19,#34
+	vsli.64	d24,d19,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d19,#39
+	vadd.i64	d28,d13
+	vsli.64	d25,d19,#30
+	veor	d30,d19,d20
+	vsli.64	d26,d19,#25
+	veor	d18,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d21,d20		@ Maj(a,b,c)
+	veor	d18,d26			@ Sigma0(a)
+	vadd.i64	d22,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d18,d30
+	vshr.u64	q12,q6,#19
+	vshr.u64	q13,q6,#61
+	vadd.i64	d18,d30			@ h+=Maj from the past
+	vshr.u64	q15,q6,#6
+	vsli.64	q12,q6,#45
+	vext.8	q14,q7,q0,#8	@ X[i+1]
+	vsli.64	q13,q6,#3
+	veor	q15,q12
+	vshr.u64	q12,q14,#1
+	veor	q15,q13				@ sigma1(X[i+14])
+	vshr.u64	q13,q14,#8
+	vadd.i64	q7,q15
+	vshr.u64	q15,q14,#7
+	vsli.64	q12,q14,#63
+	vsli.64	q13,q14,#56
+	vext.8	q14,q3,q4,#8	@ X[i+9]
+	veor	q15,q12
+	vshr.u64	d24,d22,#14		@ from NEON_00_15
+	vadd.i64	q7,q14
+	vshr.u64	d25,d22,#18		@ from NEON_00_15
+	veor	q15,q13				@ sigma0(X[i+1])
+	vshr.u64	d26,d22,#41		@ from NEON_00_15
+	vadd.i64	q7,q15
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d22,#50
+	vsli.64	d25,d22,#46
+	vmov	d29,d22
+	vsli.64	d26,d22,#23
+#if 30<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d23,d16		@ Ch(e,f,g)
+	vshr.u64	d24,d18,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d17
+	vshr.u64	d25,d18,#34
+	vsli.64	d24,d18,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d18,#39
+	vadd.i64	d28,d14
+	vsli.64	d25,d18,#30
+	veor	d30,d18,d19
+	vsli.64	d26,d18,#25
+	veor	d17,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d20,d19		@ Maj(a,b,c)
+	veor	d17,d26			@ Sigma0(a)
+	vadd.i64	d21,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d17,d30
+	vshr.u64	d24,d21,#14	@ 31
+#if 31<16
+	vld1.64	{d15},[r1]!	@ handles unaligned
+#endif
+	vshr.u64	d25,d21,#18
+#if 31>0
+	vadd.i64	d17,d30			@ h+=Maj from the past
+#endif
+	vshr.u64	d26,d21,#41
+	vld1.64	{d28},[r3,:64]!	@ K[i++]
+	vsli.64	d24,d21,#50
+	vsli.64	d25,d21,#46
+	vmov	d29,d21
+	vsli.64	d26,d21,#23
+#if 31<16 && defined(__ARMEL__)
+	vrev64.8	,
+#endif
+	veor	d25,d24
+	vbsl	d29,d22,d23		@ Ch(e,f,g)
+	vshr.u64	d24,d17,#28
+	veor	d26,d25			@ Sigma1(e)
+	vadd.i64	d27,d29,d16
+	vshr.u64	d25,d17,#34
+	vsli.64	d24,d17,#36
+	vadd.i64	d27,d26
+	vshr.u64	d26,d17,#39
+	vadd.i64	d28,d15
+	vsli.64	d25,d17,#30
+	veor	d30,d17,d18
+	vsli.64	d26,d17,#25
+	veor	d16,d24,d25
+	vadd.i64	d27,d28
+	vbsl	d30,d19,d18		@ Maj(a,b,c)
+	veor	d16,d26			@ Sigma0(a)
+	vadd.i64	d20,d27
+	vadd.i64	d30,d27
+	@ vadd.i64	d16,d30
+	bne	.L16_79_neon
+
+	vadd.i64	d16,d30		@ h+=Maj from the past
+	vldmia	r0,{d24,d25,d26,d27,d28,d29,d30,d31}	@ load context to temp
+	vadd.i64	q8,q12		@ vectorized accumulate
+	vadd.i64	q9,q13
+	vadd.i64	q10,q14
+	vadd.i64	q11,q15
+	vstmia	r0,{d16,d17,d18,d19,d20,d21,d22,d23}	@ save context
+	teq	r1,r2
+	sub	r3,#640	@ rewind K512
+	bne	.Loop_neon
+	vldmia  sp!,{d8-d15}
+	bx	lr				@ .word	0xe12fff1e
+.size	cryptogams_sha512_block_data_order_neon,.-cryptogams_sha512_block_data_order_neon
+#endif
diff --git a/runtime/third_party/cryptopp/sha512_armv4.h b/runtime/third_party/cryptopp/sha512_armv4.h
new file mode 100644
index 0000000..cead986
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha512_armv4.h
@@ -0,0 +1,23 @@
+/* Header file for use with Cryptogam's ARMv4 SHA512.  */
+/* Also see http://www.openssl.org/~appro/cryptogams/  */
+/* https://wiki.openssl.org/index.php/Cryptogams_SHA.  */
+
+#ifndef CRYPTOGAMS_SHA512_ARMV4_H
+#define CRYPTOGAMS_SHA512_ARMV4_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Crypto++ modified cryptogams_sha512_block_data_order to pass caps as a parameter. */
+/* Also see https://github.com/weidai11/cryptopp/issues/846.             */
+void cryptogams_sha512_block_data_order(void *state, const void *data, size_t blocks);
+
+/* Cryptogams arm caps */
+#define CRYPTOGAMS_ARMV7_NEON (1<<0)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* CRYPTOGAMS_SHA512_ARMV4_H */
diff --git a/runtime/third_party/cryptopp/sha_simd.cpp b/runtime/third_party/cryptopp/sha_simd.cpp
new file mode 100644
index 0000000..b2c25d0
--- /dev/null
+++ b/runtime/third_party/cryptopp/sha_simd.cpp
@@ -0,0 +1,1506 @@
+// sha_simd.cpp - written and placed in the public domain by
+//                Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//
+//    This source file uses intrinsics to gain access to SHA-NI and
+//    ARMv8a SHA instructions. A separate source file is needed
+//    because additional CXXFLAGS are required to enable the
+//    appropriate instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+#include "sha.h"
+#include "misc.h"
+
+#if defined(CRYPTOPP_DISABLE_SHA_ASM)
+# undef CRYPTOPP_X86_ASM_AVAILABLE
+# undef CRYPTOPP_X32_ASM_AVAILABLE
+# undef CRYPTOPP_X64_ASM_AVAILABLE
+# undef CRYPTOPP_SSE2_ASM_AVAILABLE
+#endif
+
+#if (CRYPTOPP_SHANI_AVAILABLE)
+# include <nmmintrin.h>
+# include <immintrin.h>
+#endif
+
+// Android makes <arm_acle.h> available with ARMv7-a
+#if (CRYPTOPP_BOOL_ARMV8)
+# if (CRYPTOPP_ARM_NEON_HEADER)
+#  include <arm_neon.h>
+# endif
+# if (CRYPTOPP_ARM_ACLE_HEADER)
+#  include <stdint.h>
+#  include <arm_acle.h>
+# endif
+#endif
+
+#if CRYPTOPP_POWER8_SHA_AVAILABLE
+# include "ppc_simd.h"
+#endif
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#ifndef EXCEPTION_EXECUTE_HANDLER
+# define EXCEPTION_EXECUTE_HANDLER 1
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char SHA_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ***************** SHA key tables ********************
+
+extern const word32 SHA256_K[64];
+extern const word64 SHA512_K[80];
+
+// ***************** SIGILL probes ********************
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+
+    static jmp_buf s_jmpSIGILL;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpSIGILL, 1);
+    }
+}
+#endif  // Not CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
+
+#if (CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8)
+bool CPU_ProbeSHA1()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif (CRYPTOPP_ARM_SHA1_AVAILABLE)
+# if defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+    volatile bool result = true;
+    __try
+    {
+        unsigned int w[] = {1,2,3,4, 5,6,7,8, 9,10,11,12};
+        uint32x4_t data1 = vld1q_u32(w+0);
+        uint32x4_t data2 = vld1q_u32(w+4);
+        uint32x4_t data3 = vld1q_u32(w+8);
+
+        uint32x4_t r1 = vsha1cq_u32 (data1, 0, data2);
+        uint32x4_t r2 = vsha1mq_u32 (data1, 0, data2);
+        uint32x4_t r3 = vsha1pq_u32 (data1, 0, data2);
+        uint32x4_t r4 = vsha1su0q_u32 (data1, data2, data3);
+        uint32x4_t r5 = vsha1su1q_u32 (data1, data2);
+
+        result = !!(vgetq_lane_u32(r1,0) | vgetq_lane_u32(r2,1) | vgetq_lane_u32(r3,2) | vgetq_lane_u32(r4,3) | vgetq_lane_u32(r5,0));
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        return false;
+    }
+    return result;
+# else
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile bool result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        unsigned int w[] = {1,2,3,4, 5,6,7,8, 9,10,11,12};
+        uint32x4_t data1 = vld1q_u32(w+0);
+        uint32x4_t data2 = vld1q_u32(w+4);
+        uint32x4_t data3 = vld1q_u32(w+8);
+
+        uint32x4_t r1 = vsha1cq_u32 (data1, 0, data2);
+        uint32x4_t r2 = vsha1mq_u32 (data1, 0, data2);
+        uint32x4_t r3 = vsha1pq_u32 (data1, 0, data2);
+        uint32x4_t r4 = vsha1su0q_u32 (data1, data2, data3);
+        uint32x4_t r5 = vsha1su1q_u32 (data1, data2);
+
+        result = !!(vgetq_lane_u32(r1,0) | vgetq_lane_u32(r2,1) | vgetq_lane_u32(r3,2) | vgetq_lane_u32(r4,3) | vgetq_lane_u32(r5,0));
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_ARM_SHA1_AVAILABLE
+}
+
+bool CPU_ProbeSHA256()
+{
+#if defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif (CRYPTOPP_ARM_SHA2_AVAILABLE)
+# if defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+    volatile bool result = true;
+    __try
+    {
+        unsigned int w[] = {1,2,3,4, 5,6,7,8, 9,10,11,12};
+        uint32x4_t data1 = vld1q_u32(w+0);
+        uint32x4_t data2 = vld1q_u32(w+4);
+        uint32x4_t data3 = vld1q_u32(w+8);
+
+        uint32x4_t r1 = vsha256hq_u32 (data1, data2, data3);
+        uint32x4_t r2 = vsha256h2q_u32 (data1, data2, data3);
+        uint32x4_t r3 = vsha256su0q_u32 (data1, data2);
+        uint32x4_t r4 = vsha256su1q_u32 (data1, data2, data3);
+
+        result = !!(vgetq_lane_u32(r1,0) | vgetq_lane_u32(r2,1) | vgetq_lane_u32(r3,2) | vgetq_lane_u32(r4,3));
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        return false;
+    }
+    return result;
+#else
+
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile bool result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+
+    if (setjmp(s_jmpSIGILL))
+        result = false;
+    else
+    {
+        unsigned int w[] = {1,2,3,4, 5,6,7,8, 9,10,11,12};
+        uint32x4_t data1 = vld1q_u32(w+0);
+        uint32x4_t data2 = vld1q_u32(w+4);
+        uint32x4_t data3 = vld1q_u32(w+8);
+
+        uint32x4_t r1 = vsha256hq_u32 (data1, data2, data3);
+        uint32x4_t r2 = vsha256h2q_u32 (data1, data2, data3);
+        uint32x4_t r3 = vsha256su0q_u32 (data1, data2);
+        uint32x4_t r4 = vsha256su1q_u32 (data1, data2, data3);
+
+        result = !!(vgetq_lane_u32(r1,0) | vgetq_lane_u32(r2,1) | vgetq_lane_u32(r3,2) | vgetq_lane_u32(r4,3));
+    }
+
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+    signal(SIGILL, oldHandler);
+    return result;
+# endif
+#else
+    return false;
+#endif  // CRYPTOPP_ARM_SHA2_AVAILABLE
+}
+#endif  // ARM32 or ARM64
+
+// ***************** Intel x86 SHA ********************
+
+/////////////////////////////////////
+// start of Walton and Gulley code //
+/////////////////////////////////////
+
+#if CRYPTOPP_SHANI_AVAILABLE
+// Based on http://software.intel.com/en-us/articles/intel-sha-extensions and code by Sean Gulley.
+void SHA1_HashMultipleBlocks_SHANI(word32 *state, const word32 *data, size_t length, ByteOrder order)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+    CRYPTOPP_ASSERT(length >= SHA1::BLOCKSIZE);
+
+    __m128i ABCD, ABCD_SAVE, E0, E0_SAVE, E1;
+    __m128i MASK, MSG0, MSG1, MSG2, MSG3;
+
+    // Load initial values
+    ABCD = _mm_loadu_si128(CONST_M128_CAST(state));
+    E0 = _mm_set_epi32(state[4], 0, 0, 0);
+    ABCD = _mm_shuffle_epi32(ABCD, 0x1B);
+
+    // IA-32 SHA is little endian, SHA::Transform is big endian,
+    // and SHA::HashMultipleBlocks can be either. ByteOrder
+    // allows us to avoid extra endian reversals. It saves 1.0 cpb.
+    MASK = order == BIG_ENDIAN_ORDER ?  // Data arrangement
+           _mm_set_epi8(0,1,2,3, 4,5,6,7, 8,9,10,11, 12,13,14,15) :
+           _mm_set_epi8(3,2,1,0, 7,6,5,4, 11,10,9,8, 15,14,13,12) ;
+
+    while (length >= SHA1::BLOCKSIZE)
+    {
+        // Save current hash
+        ABCD_SAVE = ABCD;
+        E0_SAVE = E0;
+
+        // Rounds 0-3
+        MSG0 = _mm_loadu_si128(CONST_M128_CAST(data+0));
+        MSG0 = _mm_shuffle_epi8(MSG0, MASK);
+        E0 = _mm_add_epi32(E0, MSG0);
+        E1 = ABCD;
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 0);
+
+        // Rounds 4-7
+        MSG1 = _mm_loadu_si128(CONST_M128_CAST(data+4));
+        MSG1 = _mm_shuffle_epi8(MSG1, MASK);
+        E1 = _mm_sha1nexte_epu32(E1, MSG1);
+        E0 = ABCD;
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 0);
+        MSG0 = _mm_sha1msg1_epu32(MSG0, MSG1);
+
+        // Rounds 8-11
+        MSG2 = _mm_loadu_si128(CONST_M128_CAST(data+8));
+        MSG2 = _mm_shuffle_epi8(MSG2, MASK);
+        E0 = _mm_sha1nexte_epu32(E0, MSG2);
+        E1 = ABCD;
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 0);
+        MSG1 = _mm_sha1msg1_epu32(MSG1, MSG2);
+        MSG0 = _mm_xor_si128(MSG0, MSG2);
+
+        // Rounds 12-15
+        MSG3 = _mm_loadu_si128(CONST_M128_CAST(data+12));
+        MSG3 = _mm_shuffle_epi8(MSG3, MASK);
+        E1 = _mm_sha1nexte_epu32(E1, MSG3);
+        E0 = ABCD;
+        MSG0 = _mm_sha1msg2_epu32(MSG0, MSG3);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 0);
+        MSG2 = _mm_sha1msg1_epu32(MSG2, MSG3);
+        MSG1 = _mm_xor_si128(MSG1, MSG3);
+
+        // Rounds 16-19
+        E0 = _mm_sha1nexte_epu32(E0, MSG0);
+        E1 = ABCD;
+        MSG1 = _mm_sha1msg2_epu32(MSG1, MSG0);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 0);
+        MSG3 = _mm_sha1msg1_epu32(MSG3, MSG0);
+        MSG2 = _mm_xor_si128(MSG2, MSG0);
+
+        // Rounds 20-23
+        E1 = _mm_sha1nexte_epu32(E1, MSG1);
+        E0 = ABCD;
+        MSG2 = _mm_sha1msg2_epu32(MSG2, MSG1);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 1);
+        MSG0 = _mm_sha1msg1_epu32(MSG0, MSG1);
+        MSG3 = _mm_xor_si128(MSG3, MSG1);
+
+        // Rounds 24-27
+        E0 = _mm_sha1nexte_epu32(E0, MSG2);
+        E1 = ABCD;
+        MSG3 = _mm_sha1msg2_epu32(MSG3, MSG2);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 1);
+        MSG1 = _mm_sha1msg1_epu32(MSG1, MSG2);
+        MSG0 = _mm_xor_si128(MSG0, MSG2);
+
+        // Rounds 28-31
+        E1 = _mm_sha1nexte_epu32(E1, MSG3);
+        E0 = ABCD;
+        MSG0 = _mm_sha1msg2_epu32(MSG0, MSG3);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 1);
+        MSG2 = _mm_sha1msg1_epu32(MSG2, MSG3);
+        MSG1 = _mm_xor_si128(MSG1, MSG3);
+
+        // Rounds 32-35
+        E0 = _mm_sha1nexte_epu32(E0, MSG0);
+        E1 = ABCD;
+        MSG1 = _mm_sha1msg2_epu32(MSG1, MSG0);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 1);
+        MSG3 = _mm_sha1msg1_epu32(MSG3, MSG0);
+        MSG2 = _mm_xor_si128(MSG2, MSG0);
+
+        // Rounds 36-39
+        E1 = _mm_sha1nexte_epu32(E1, MSG1);
+        E0 = ABCD;
+        MSG2 = _mm_sha1msg2_epu32(MSG2, MSG1);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 1);
+        MSG0 = _mm_sha1msg1_epu32(MSG0, MSG1);
+        MSG3 = _mm_xor_si128(MSG3, MSG1);
+
+        // Rounds 40-43
+        E0 = _mm_sha1nexte_epu32(E0, MSG2);
+        E1 = ABCD;
+        MSG3 = _mm_sha1msg2_epu32(MSG3, MSG2);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 2);
+        MSG1 = _mm_sha1msg1_epu32(MSG1, MSG2);
+        MSG0 = _mm_xor_si128(MSG0, MSG2);
+
+        // Rounds 44-47
+        E1 = _mm_sha1nexte_epu32(E1, MSG3);
+        E0 = ABCD;
+        MSG0 = _mm_sha1msg2_epu32(MSG0, MSG3);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 2);
+        MSG2 = _mm_sha1msg1_epu32(MSG2, MSG3);
+        MSG1 = _mm_xor_si128(MSG1, MSG3);
+
+        // Rounds 48-51
+        E0 = _mm_sha1nexte_epu32(E0, MSG0);
+        E1 = ABCD;
+        MSG1 = _mm_sha1msg2_epu32(MSG1, MSG0);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 2);
+        MSG3 = _mm_sha1msg1_epu32(MSG3, MSG0);
+        MSG2 = _mm_xor_si128(MSG2, MSG0);
+
+        // Rounds 52-55
+        E1 = _mm_sha1nexte_epu32(E1, MSG1);
+        E0 = ABCD;
+        MSG2 = _mm_sha1msg2_epu32(MSG2, MSG1);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 2);
+        MSG0 = _mm_sha1msg1_epu32(MSG0, MSG1);
+        MSG3 = _mm_xor_si128(MSG3, MSG1);
+
+        // Rounds 56-59
+        E0 = _mm_sha1nexte_epu32(E0, MSG2);
+        E1 = ABCD;
+        MSG3 = _mm_sha1msg2_epu32(MSG3, MSG2);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 2);
+        MSG1 = _mm_sha1msg1_epu32(MSG1, MSG2);
+        MSG0 = _mm_xor_si128(MSG0, MSG2);
+
+        // Rounds 60-63
+        E1 = _mm_sha1nexte_epu32(E1, MSG3);
+        E0 = ABCD;
+        MSG0 = _mm_sha1msg2_epu32(MSG0, MSG3);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 3);
+        MSG2 = _mm_sha1msg1_epu32(MSG2, MSG3);
+        MSG1 = _mm_xor_si128(MSG1, MSG3);
+
+        // Rounds 64-67
+        E0 = _mm_sha1nexte_epu32(E0, MSG0);
+        E1 = ABCD;
+        MSG1 = _mm_sha1msg2_epu32(MSG1, MSG0);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 3);
+        MSG3 = _mm_sha1msg1_epu32(MSG3, MSG0);
+        MSG2 = _mm_xor_si128(MSG2, MSG0);
+
+        // Rounds 68-71
+        E1 = _mm_sha1nexte_epu32(E1, MSG1);
+        E0 = ABCD;
+        MSG2 = _mm_sha1msg2_epu32(MSG2, MSG1);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 3);
+        MSG3 = _mm_xor_si128(MSG3, MSG1);
+
+        // Rounds 72-75
+        E0 = _mm_sha1nexte_epu32(E0, MSG2);
+        E1 = ABCD;
+        MSG3 = _mm_sha1msg2_epu32(MSG3, MSG2);
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E0, 3);
+
+        // Rounds 76-79
+        E1 = _mm_sha1nexte_epu32(E1, MSG3);
+        E0 = ABCD;
+        ABCD = _mm_sha1rnds4_epu32(ABCD, E1, 3);
+
+        // Add values back to state
+        E0 = _mm_sha1nexte_epu32(E0, E0_SAVE);
+        ABCD = _mm_add_epi32(ABCD, ABCD_SAVE);
+
+        data += SHA1::BLOCKSIZE/sizeof(word32);
+        length -= SHA1::BLOCKSIZE;
+    }
+
+    // Save state
+    ABCD = _mm_shuffle_epi32(ABCD, 0x1B);
+    _mm_storeu_si128(M128_CAST(state), ABCD);
+    state[4] = _mm_extract_epi32(E0, 3);
+}
+
+// Based on http://software.intel.com/en-us/articles/intel-sha-extensions and code by Sean Gulley.
+void SHA256_HashMultipleBlocks_SHANI(word32 *state, const word32 *data, size_t length, ByteOrder order)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+    CRYPTOPP_ASSERT(length >= SHA256::BLOCKSIZE);
+
+    __m128i STATE0, STATE1;
+    __m128i MSG, TMP, MASK;
+    __m128i TMSG0, TMSG1, TMSG2, TMSG3;
+    __m128i ABEF_SAVE, CDGH_SAVE;
+
+    // Load initial values
+    TMP    = _mm_loadu_si128(M128_CAST(&state[0]));
+    STATE1 = _mm_loadu_si128(M128_CAST(&state[4]));
+
+    // IA-32 SHA is little endian, SHA::Transform is big endian,
+    // and SHA::HashMultipleBlocks can be either. ByteOrder
+    // allows us to avoid extra endian reversals. It saves 1.0 cpb.
+    MASK = order == BIG_ENDIAN_ORDER ?  // Data arrangement
+           _mm_set_epi8(12,13,14,15, 8,9,10,11, 4,5,6,7, 0,1,2,3) :
+           _mm_set_epi8(15,14,13,12, 11,10,9,8, 7,6,5,4, 3,2,1,0) ;
+
+    TMP = _mm_shuffle_epi32(TMP, 0xB1);          // CDAB
+    STATE1 = _mm_shuffle_epi32(STATE1, 0x1B);    // EFGH
+    STATE0 = _mm_alignr_epi8(TMP, STATE1, 8);    // ABEF
+    STATE1 = _mm_blend_epi16(STATE1, TMP, 0xF0); // CDGH
+
+    while (length >= SHA256::BLOCKSIZE)
+    {
+        // Save current hash
+        ABEF_SAVE = STATE0;
+        CDGH_SAVE = STATE1;
+
+        // Rounds 0-3
+        MSG = _mm_loadu_si128(CONST_M128_CAST(data+0));
+        TMSG0 = _mm_shuffle_epi8(MSG, MASK);
+        MSG = _mm_add_epi32(TMSG0, _mm_set_epi64x(W64LIT(0xE9B5DBA5B5C0FBCF), W64LIT(0x71374491428A2F98)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+
+        // Rounds 4-7
+        TMSG1 = _mm_loadu_si128(CONST_M128_CAST(data+4));
+        TMSG1 = _mm_shuffle_epi8(TMSG1, MASK);
+        MSG = _mm_add_epi32(TMSG1, _mm_set_epi64x(W64LIT(0xAB1C5ED5923F82A4), W64LIT(0x59F111F13956C25B)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG0 = _mm_sha256msg1_epu32(TMSG0, TMSG1);
+
+        // Rounds 8-11
+        TMSG2 = _mm_loadu_si128(CONST_M128_CAST(data+8));
+        TMSG2 = _mm_shuffle_epi8(TMSG2, MASK);
+        MSG = _mm_add_epi32(TMSG2, _mm_set_epi64x(W64LIT(0x550C7DC3243185BE), W64LIT(0x12835B01D807AA98)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG1 = _mm_sha256msg1_epu32(TMSG1, TMSG2);
+
+        // Rounds 12-15
+        TMSG3 = _mm_loadu_si128(CONST_M128_CAST(data+12));
+        TMSG3 = _mm_shuffle_epi8(TMSG3, MASK);
+        MSG = _mm_add_epi32(TMSG3, _mm_set_epi64x(W64LIT(0xC19BF1749BDC06A7), W64LIT(0x80DEB1FE72BE5D74)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG3, TMSG2, 4);
+        TMSG0 = _mm_add_epi32(TMSG0, TMP);
+        TMSG0 = _mm_sha256msg2_epu32(TMSG0, TMSG3);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG2 = _mm_sha256msg1_epu32(TMSG2, TMSG3);
+
+        // Rounds 16-19
+        MSG = _mm_add_epi32(TMSG0, _mm_set_epi64x(W64LIT(0x240CA1CC0FC19DC6), W64LIT(0xEFBE4786E49B69C1)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG0, TMSG3, 4);
+        TMSG1 = _mm_add_epi32(TMSG1, TMP);
+        TMSG1 = _mm_sha256msg2_epu32(TMSG1, TMSG0);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG3 = _mm_sha256msg1_epu32(TMSG3, TMSG0);
+
+        // Rounds 20-23
+        MSG = _mm_add_epi32(TMSG1, _mm_set_epi64x(W64LIT(0x76F988DA5CB0A9DC), W64LIT(0x4A7484AA2DE92C6F)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG1, TMSG0, 4);
+        TMSG2 = _mm_add_epi32(TMSG2, TMP);
+        TMSG2 = _mm_sha256msg2_epu32(TMSG2, TMSG1);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG0 = _mm_sha256msg1_epu32(TMSG0, TMSG1);
+
+        // Rounds 24-27
+        MSG = _mm_add_epi32(TMSG2, _mm_set_epi64x(W64LIT(0xBF597FC7B00327C8), W64LIT(0xA831C66D983E5152)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG2, TMSG1, 4);
+        TMSG3 = _mm_add_epi32(TMSG3, TMP);
+        TMSG3 = _mm_sha256msg2_epu32(TMSG3, TMSG2);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG1 = _mm_sha256msg1_epu32(TMSG1, TMSG2);
+
+        // Rounds 28-31
+        MSG = _mm_add_epi32(TMSG3, _mm_set_epi64x(W64LIT(0x1429296706CA6351), W64LIT(0xD5A79147C6E00BF3)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG3, TMSG2, 4);
+        TMSG0 = _mm_add_epi32(TMSG0, TMP);
+        TMSG0 = _mm_sha256msg2_epu32(TMSG0, TMSG3);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG2 = _mm_sha256msg1_epu32(TMSG2, TMSG3);
+
+        // Rounds 32-35
+        MSG = _mm_add_epi32(TMSG0, _mm_set_epi64x(W64LIT(0x53380D134D2C6DFC), W64LIT(0x2E1B213827B70A85)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG0, TMSG3, 4);
+        TMSG1 = _mm_add_epi32(TMSG1, TMP);
+        TMSG1 = _mm_sha256msg2_epu32(TMSG1, TMSG0);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG3 = _mm_sha256msg1_epu32(TMSG3, TMSG0);
+
+        // Rounds 36-39
+        MSG = _mm_add_epi32(TMSG1, _mm_set_epi64x(W64LIT(0x92722C8581C2C92E), W64LIT(0x766A0ABB650A7354)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG1, TMSG0, 4);
+        TMSG2 = _mm_add_epi32(TMSG2, TMP);
+        TMSG2 = _mm_sha256msg2_epu32(TMSG2, TMSG1);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG0 = _mm_sha256msg1_epu32(TMSG0, TMSG1);
+
+        // Rounds 40-43
+        MSG = _mm_add_epi32(TMSG2, _mm_set_epi64x(W64LIT(0xC76C51A3C24B8B70), W64LIT(0xA81A664BA2BFE8A1)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG2, TMSG1, 4);
+        TMSG3 = _mm_add_epi32(TMSG3, TMP);
+        TMSG3 = _mm_sha256msg2_epu32(TMSG3, TMSG2);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG1 = _mm_sha256msg1_epu32(TMSG1, TMSG2);
+
+        // Rounds 44-47
+        MSG = _mm_add_epi32(TMSG3, _mm_set_epi64x(W64LIT(0x106AA070F40E3585), W64LIT(0xD6990624D192E819)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG3, TMSG2, 4);
+        TMSG0 = _mm_add_epi32(TMSG0, TMP);
+        TMSG0 = _mm_sha256msg2_epu32(TMSG0, TMSG3);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG2 = _mm_sha256msg1_epu32(TMSG2, TMSG3);
+
+        // Rounds 48-51
+        MSG = _mm_add_epi32(TMSG0, _mm_set_epi64x(W64LIT(0x34B0BCB52748774C), W64LIT(0x1E376C0819A4C116)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG0, TMSG3, 4);
+        TMSG1 = _mm_add_epi32(TMSG1, TMP);
+        TMSG1 = _mm_sha256msg2_epu32(TMSG1, TMSG0);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+        TMSG3 = _mm_sha256msg1_epu32(TMSG3, TMSG0);
+
+        // Rounds 52-55
+        MSG = _mm_add_epi32(TMSG1, _mm_set_epi64x(W64LIT(0x682E6FF35B9CCA4F), W64LIT(0x4ED8AA4A391C0CB3)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG1, TMSG0, 4);
+        TMSG2 = _mm_add_epi32(TMSG2, TMP);
+        TMSG2 = _mm_sha256msg2_epu32(TMSG2, TMSG1);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+
+        // Rounds 56-59
+        MSG = _mm_add_epi32(TMSG2, _mm_set_epi64x(W64LIT(0x8CC7020884C87814), W64LIT(0x78A5636F748F82EE)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        TMP = _mm_alignr_epi8(TMSG2, TMSG1, 4);
+        TMSG3 = _mm_add_epi32(TMSG3, TMP);
+        TMSG3 = _mm_sha256msg2_epu32(TMSG3, TMSG2);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+
+        // Rounds 60-63
+        MSG = _mm_add_epi32(TMSG3, _mm_set_epi64x(W64LIT(0xC67178F2BEF9A3F7), W64LIT(0xA4506CEB90BEFFFA)));
+        STATE1 = _mm_sha256rnds2_epu32(STATE1, STATE0, MSG);
+        MSG = _mm_shuffle_epi32(MSG, 0x0E);
+        STATE0 = _mm_sha256rnds2_epu32(STATE0, STATE1, MSG);
+
+        // Add values back to state
+        STATE0 = _mm_add_epi32(STATE0, ABEF_SAVE);
+        STATE1 = _mm_add_epi32(STATE1, CDGH_SAVE);
+
+        data += SHA256::BLOCKSIZE/sizeof(word32);
+        length -= SHA256::BLOCKSIZE;
+    }
+
+    TMP = _mm_shuffle_epi32(STATE0, 0x1B);       // FEBA
+    STATE1 = _mm_shuffle_epi32(STATE1, 0xB1);    // DCHG
+    STATE0 = _mm_blend_epi16(TMP, STATE1, 0xF0); // DCBA
+    STATE1 = _mm_alignr_epi8(STATE1, TMP, 8);    // ABEF
+
+    // Save state
+    _mm_storeu_si128(M128_CAST(&state[0]), STATE0);
+    _mm_storeu_si128(M128_CAST(&state[4]), STATE1);
+}
+#endif  // CRYPTOPP_SHANI_AVAILABLE
+
+///////////////////////////////////
+// end of Walton and Gulley code //
+///////////////////////////////////
+
+// ***************** ARMV8 SHA ********************
+
+/////////////////////////////////////////////////////////////
+// start of Walton, Schneiders, O'Rourke and Hovsmith code //
+/////////////////////////////////////////////////////////////
+
+#if CRYPTOPP_ARM_SHA1_AVAILABLE
+void SHA1_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+    CRYPTOPP_ASSERT(length >= SHA1::BLOCKSIZE);
+
+    uint32x4_t C0, C1, C2, C3;
+    uint32x4_t ABCD, ABCD_SAVED;
+    uint32x4_t MSG0, MSG1, MSG2, MSG3;
+    uint32x4_t TMP0, TMP1;
+    uint32_t   E0, E0_SAVED, E1;
+
+    // Load initial values
+    C0 = vdupq_n_u32(0x5A827999);
+    C1 = vdupq_n_u32(0x6ED9EBA1);
+    C2 = vdupq_n_u32(0x8F1BBCDC);
+    C3 = vdupq_n_u32(0xCA62C1D6);
+
+    ABCD = vld1q_u32(&state[0]);
+    E0 = state[4];
+
+    while (length >= SHA1::BLOCKSIZE)
+    {
+        // Save current hash
+        ABCD_SAVED = ABCD;
+        E0_SAVED = E0;
+
+        MSG0 = vld1q_u32(data +  0);
+        MSG1 = vld1q_u32(data +  4);
+        MSG2 = vld1q_u32(data +  8);
+        MSG3 = vld1q_u32(data + 12);
+
+        if (order == BIG_ENDIAN_ORDER)  // Data arrangement
+        {
+            MSG0 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(MSG0)));
+            MSG1 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(MSG1)));
+            MSG2 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(MSG2)));
+            MSG3 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(MSG3)));
+        }
+
+        TMP0 = vaddq_u32(MSG0, C0);
+        TMP1 = vaddq_u32(MSG1, C0);
+
+        // Rounds 0-3
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1cq_u32(ABCD, E0, TMP0);
+        TMP0 = vaddq_u32(MSG2, C0);
+        MSG0 = vsha1su0q_u32(MSG0, MSG1, MSG2);
+
+        // Rounds 4-7
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1cq_u32(ABCD, E1, TMP1);
+        TMP1 = vaddq_u32(MSG3, C0);
+        MSG0 = vsha1su1q_u32(MSG0, MSG3);
+        MSG1 = vsha1su0q_u32(MSG1, MSG2, MSG3);
+
+        // Rounds 8-11
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1cq_u32(ABCD, E0, TMP0);
+        TMP0 = vaddq_u32(MSG0, C0);
+        MSG1 = vsha1su1q_u32(MSG1, MSG0);
+        MSG2 = vsha1su0q_u32(MSG2, MSG3, MSG0);
+
+        // Rounds 12-15
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1cq_u32(ABCD, E1, TMP1);
+        TMP1 = vaddq_u32(MSG1, C1);
+        MSG2 = vsha1su1q_u32(MSG2, MSG1);
+        MSG3 = vsha1su0q_u32(MSG3, MSG0, MSG1);
+
+        // Rounds 16-19
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1cq_u32(ABCD, E0, TMP0);
+        TMP0 = vaddq_u32(MSG2, C1);
+        MSG3 = vsha1su1q_u32(MSG3, MSG2);
+        MSG0 = vsha1su0q_u32(MSG0, MSG1, MSG2);
+
+        // Rounds 20-23
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E1, TMP1);
+        TMP1 = vaddq_u32(MSG3, C1);
+        MSG0 = vsha1su1q_u32(MSG0, MSG3);
+        MSG1 = vsha1su0q_u32(MSG1, MSG2, MSG3);
+
+        // Rounds 24-27
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E0, TMP0);
+        TMP0 = vaddq_u32(MSG0, C1);
+        MSG1 = vsha1su1q_u32(MSG1, MSG0);
+        MSG2 = vsha1su0q_u32(MSG2, MSG3, MSG0);
+
+        // Rounds 28-31
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E1, TMP1);
+        TMP1 = vaddq_u32(MSG1, C1);
+        MSG2 = vsha1su1q_u32(MSG2, MSG1);
+        MSG3 = vsha1su0q_u32(MSG3, MSG0, MSG1);
+
+        // Rounds 32-35
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E0, TMP0);
+        TMP0 = vaddq_u32(MSG2, C2);
+        MSG3 = vsha1su1q_u32(MSG3, MSG2);
+        MSG0 = vsha1su0q_u32(MSG0, MSG1, MSG2);
+
+        // Rounds 36-39
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E1, TMP1);
+        TMP1 = vaddq_u32(MSG3, C2);
+        MSG0 = vsha1su1q_u32(MSG0, MSG3);
+        MSG1 = vsha1su0q_u32(MSG1, MSG2, MSG3);
+
+        // Rounds 40-43
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1mq_u32(ABCD, E0, TMP0);
+        TMP0 = vaddq_u32(MSG0, C2);
+        MSG1 = vsha1su1q_u32(MSG1, MSG0);
+        MSG2 = vsha1su0q_u32(MSG2, MSG3, MSG0);
+
+        // Rounds 44-47
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1mq_u32(ABCD, E1, TMP1);
+        TMP1 = vaddq_u32(MSG1, C2);
+        MSG2 = vsha1su1q_u32(MSG2, MSG1);
+        MSG3 = vsha1su0q_u32(MSG3, MSG0, MSG1);
+
+        // Rounds 48-51
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1mq_u32(ABCD, E0, TMP0);
+        TMP0 = vaddq_u32(MSG2, C2);
+        MSG3 = vsha1su1q_u32(MSG3, MSG2);
+        MSG0 = vsha1su0q_u32(MSG0, MSG1, MSG2);
+
+        // Rounds 52-55
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1mq_u32(ABCD, E1, TMP1);
+        TMP1 = vaddq_u32(MSG3, C3);
+        MSG0 = vsha1su1q_u32(MSG0, MSG3);
+        MSG1 = vsha1su0q_u32(MSG1, MSG2, MSG3);
+
+        // Rounds 56-59
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1mq_u32(ABCD, E0, TMP0);
+        TMP0 = vaddq_u32(MSG0, C3);
+        MSG1 = vsha1su1q_u32(MSG1, MSG0);
+        MSG2 = vsha1su0q_u32(MSG2, MSG3, MSG0);
+
+        // Rounds 60-63
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E1, TMP1);
+        TMP1 = vaddq_u32(MSG1, C3);
+        MSG2 = vsha1su1q_u32(MSG2, MSG1);
+        MSG3 = vsha1su0q_u32(MSG3, MSG0, MSG1);
+
+        // Rounds 64-67
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E0, TMP0);
+        TMP0 = vaddq_u32(MSG2, C3);
+        MSG3 = vsha1su1q_u32(MSG3, MSG2);
+        MSG0 = vsha1su0q_u32(MSG0, MSG1, MSG2);
+
+        // Rounds 68-71
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E1, TMP1);
+        TMP1 = vaddq_u32(MSG3, C3);
+        MSG0 = vsha1su1q_u32(MSG0, MSG3);
+
+        // Rounds 72-75
+        E1 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E0, TMP0);
+
+        // Rounds 76-79
+        E0 = vsha1h_u32(vgetq_lane_u32(ABCD, 0));
+        ABCD = vsha1pq_u32(ABCD, E1, TMP1);
+
+        E0 += E0_SAVED;
+        ABCD = vaddq_u32(ABCD_SAVED, ABCD);
+
+        data += SHA1::BLOCKSIZE/sizeof(word32);
+        length -= SHA1::BLOCKSIZE;
+    }
+
+    // Save state
+    vst1q_u32(&state[0], ABCD);
+    state[4] = E0;
+}
+#endif  // CRYPTOPP_ARM_SHA1_AVAILABLE
+
+#if CRYPTOPP_ARM_SHA2_AVAILABLE
+void SHA256_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+    CRYPTOPP_ASSERT(length >= SHA256::BLOCKSIZE);
+
+    uint32x4_t STATE0, STATE1, ABEF_SAVE, CDGH_SAVE;
+    uint32x4_t MSG0, MSG1, MSG2, MSG3;
+    uint32x4_t TMP0, TMP1, TMP2;
+
+    // Load initial values
+    STATE0 = vld1q_u32(&state[0]);
+    STATE1 = vld1q_u32(&state[4]);
+
+    while (length >= SHA256::BLOCKSIZE)
+    {
+        // Save current hash
+        ABEF_SAVE = STATE0;
+        CDGH_SAVE = STATE1;
+
+        // Load message
+        MSG0 = vld1q_u32(data +  0);
+        MSG1 = vld1q_u32(data +  4);
+        MSG2 = vld1q_u32(data +  8);
+        MSG3 = vld1q_u32(data + 12);
+
+        if (order == BIG_ENDIAN_ORDER)  // Data arrangement
+        {
+            MSG0 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(MSG0)));
+            MSG1 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(MSG1)));
+            MSG2 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(MSG2)));
+            MSG3 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(MSG3)));
+        }
+
+        TMP0 = vaddq_u32(MSG0, vld1q_u32(&SHA256_K[0x00]));
+
+        // Rounds 0-3
+        MSG0 = vsha256su0q_u32(MSG0, MSG1);
+        TMP2 = STATE0;
+        TMP1 = vaddq_u32(MSG1, vld1q_u32(&SHA256_K[0x04]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+        MSG0 = vsha256su1q_u32(MSG0, MSG2, MSG3);
+
+        // Rounds 4-7
+        MSG1 = vsha256su0q_u32(MSG1, MSG2);
+        TMP2 = STATE0;
+        TMP0 = vaddq_u32(MSG2, vld1q_u32(&SHA256_K[0x08]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+        MSG1 = vsha256su1q_u32(MSG1, MSG3, MSG0);
+
+        // Rounds 8-11
+        MSG2 = vsha256su0q_u32(MSG2, MSG3);
+        TMP2 = STATE0;
+        TMP1 = vaddq_u32(MSG3, vld1q_u32(&SHA256_K[0x0c]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+        MSG2 = vsha256su1q_u32(MSG2, MSG0, MSG1);
+
+        // Rounds 12-15
+        MSG3 = vsha256su0q_u32(MSG3, MSG0);
+        TMP2 = STATE0;
+        TMP0 = vaddq_u32(MSG0, vld1q_u32(&SHA256_K[0x10]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+        MSG3 = vsha256su1q_u32(MSG3, MSG1, MSG2);
+
+        // Rounds 16-19
+        MSG0 = vsha256su0q_u32(MSG0, MSG1);
+        TMP2 = STATE0;
+        TMP1 = vaddq_u32(MSG1, vld1q_u32(&SHA256_K[0x14]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+        MSG0 = vsha256su1q_u32(MSG0, MSG2, MSG3);
+
+        // Rounds 20-23
+        MSG1 = vsha256su0q_u32(MSG1, MSG2);
+        TMP2 = STATE0;
+        TMP0 = vaddq_u32(MSG2, vld1q_u32(&SHA256_K[0x18]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+        MSG1 = vsha256su1q_u32(MSG1, MSG3, MSG0);
+
+        // Rounds 24-27
+        MSG2 = vsha256su0q_u32(MSG2, MSG3);
+        TMP2 = STATE0;
+        TMP1 = vaddq_u32(MSG3, vld1q_u32(&SHA256_K[0x1c]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+        MSG2 = vsha256su1q_u32(MSG2, MSG0, MSG1);
+
+        // Rounds 28-31
+        MSG3 = vsha256su0q_u32(MSG3, MSG0);
+        TMP2 = STATE0;
+        TMP0 = vaddq_u32(MSG0, vld1q_u32(&SHA256_K[0x20]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+        MSG3 = vsha256su1q_u32(MSG3, MSG1, MSG2);
+
+        // Rounds 32-35
+        MSG0 = vsha256su0q_u32(MSG0, MSG1);
+        TMP2 = STATE0;
+        TMP1 = vaddq_u32(MSG1, vld1q_u32(&SHA256_K[0x24]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+        MSG0 = vsha256su1q_u32(MSG0, MSG2, MSG3);
+
+        // Rounds 36-39
+        MSG1 = vsha256su0q_u32(MSG1, MSG2);
+        TMP2 = STATE0;
+        TMP0 = vaddq_u32(MSG2, vld1q_u32(&SHA256_K[0x28]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+        MSG1 = vsha256su1q_u32(MSG1, MSG3, MSG0);
+
+        // Rounds 40-43
+        MSG2 = vsha256su0q_u32(MSG2, MSG3);
+        TMP2 = STATE0;
+        TMP1 = vaddq_u32(MSG3, vld1q_u32(&SHA256_K[0x2c]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+        MSG2 = vsha256su1q_u32(MSG2, MSG0, MSG1);
+
+        // Rounds 44-47
+        MSG3 = vsha256su0q_u32(MSG3, MSG0);
+        TMP2 = STATE0;
+        TMP0 = vaddq_u32(MSG0, vld1q_u32(&SHA256_K[0x30]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+        MSG3 = vsha256su1q_u32(MSG3, MSG1, MSG2);
+
+        // Rounds 48-51
+        TMP2 = STATE0;
+        TMP1 = vaddq_u32(MSG1, vld1q_u32(&SHA256_K[0x34]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+
+        // Rounds 52-55
+        TMP2 = STATE0;
+        TMP0 = vaddq_u32(MSG2, vld1q_u32(&SHA256_K[0x38]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+
+        // Rounds 56-59
+        TMP2 = STATE0;
+        TMP1 = vaddq_u32(MSG3, vld1q_u32(&SHA256_K[0x3c]));
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+
+        // Rounds 60-63
+        TMP2 = STATE0;
+        STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+        STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+
+        // Add back to state
+        STATE0 = vaddq_u32(STATE0, ABEF_SAVE);
+        STATE1 = vaddq_u32(STATE1, CDGH_SAVE);
+
+        data += SHA256::BLOCKSIZE/sizeof(word32);
+        length -= SHA256::BLOCKSIZE;
+    }
+
+    // Save state
+    vst1q_u32(&state[0], STATE0);
+    vst1q_u32(&state[4], STATE1);
+}
+#endif  // CRYPTOPP_ARM_SHA2_AVAILABLE
+
+///////////////////////////////////////////////////////////
+// end of Walton, Schneiders, O'Rourke and Hovsmith code //
+///////////////////////////////////////////////////////////
+
+// ***************** Power8 SHA ********************
+
+//////////////////////////////////////////////////
+// start Gustavo, Serra, Scalet and Walton code //
+//////////////////////////////////////////////////
+
+#if CRYPTOPP_POWER8_SHA_AVAILABLE
+
+// Indexes into the S[] array
+enum {A=0, B=1, C, D, E, F, G, H};
+
+inline
+uint32x4_p VecLoad32(const word32* data, int offset)
+{
+#if (CRYPTOPP_LITTLE_ENDIAN)
+    const uint8x16_p mask = {3,2,1,0, 7,6,5,4, 11,10,9,8, 15,14,13,12};
+    const uint32x4_p val = VecLoad(offset, data);
+    return (uint32x4_p)VecPermute(val, val, mask);
+#else
+    return VecLoad(offset, data);
+#endif
+}
+
+template<class T> inline
+void VecStore32(const T data, word32 dest[4])
+{
+    VecStore(data, dest);
+}
+
+inline
+uint32x4_p VectorCh(const uint32x4_p x, const uint32x4_p y, const uint32x4_p z)
+{
+    // The trick below is due to Andy Polyakov and Jack Lloyd
+    return vec_sel(z,y,x);
+}
+
+inline
+uint32x4_p VectorMaj(const uint32x4_p x, const uint32x4_p y, const uint32x4_p z)
+{
+    // The trick below is due to Andy Polyakov and Jack Lloyd
+    return vec_sel(y, z, VecXor(x, y));
+}
+
+inline
+uint32x4_p Vector_sigma0(const uint32x4_p val)
+{
+    return VecSHA256<0,0>(val);
+}
+
+inline
+uint32x4_p Vector_sigma1(const uint32x4_p val)
+{
+    return VecSHA256<0,0xf>(val);
+}
+
+inline
+uint32x4_p VectorSigma0(const uint32x4_p val)
+{
+    return VecSHA256<1,0>(val);
+}
+
+inline
+uint32x4_p VectorSigma1(const uint32x4_p val)
+{
+    return VecSHA256<1,0xf>(val);
+}
+
+inline
+uint32x4_p VectorPack(const uint32x4_p a, const uint32x4_p b,
+                       const uint32x4_p c, const uint32x4_p d)
+{
+    const uint8x16_p m1 = {0,1,2,3, 16,17,18,19, 0,0,0,0, 0,0,0,0};
+    const uint8x16_p m2 = {0,1,2,3, 4,5,6,7, 16,17,18,19, 20,21,22,23};
+    return VecPermute(VecPermute(a,b,m1), VecPermute(c,d,m1), m2);
+}
+
+template <unsigned int R> inline
+void SHA256_ROUND1(uint32x4_p W[16], uint32x4_p S[8], const uint32x4_p K, const uint32x4_p M)
+{
+    uint32x4_p T1, T2;
+
+    W[R] = M;
+    T1 = S[H] + VectorSigma1(S[E]) + VectorCh(S[E],S[F],S[G]) + K + M;
+    T2 = VectorSigma0(S[A]) + VectorMaj(S[A],S[B],S[C]);
+
+    S[H] = S[G]; S[G] = S[F]; S[F] = S[E];
+    S[E] = S[D] + T1;
+    S[D] = S[C]; S[C] = S[B]; S[B] = S[A];
+    S[A] = T1 + T2;
+}
+
+template <unsigned int R> inline
+void SHA256_ROUND2(uint32x4_p W[16], uint32x4_p S[8], const uint32x4_p K)
+{
+    // Indexes into the W[] array
+    enum {IDX0=(R+0)&0xf, IDX1=(R+1)&0xf, IDX9=(R+9)&0xf, IDX14=(R+14)&0xf};
+
+    const uint32x4_p s0 = Vector_sigma0(W[IDX1]);
+    const uint32x4_p s1 = Vector_sigma1(W[IDX14]);
+
+    uint32x4_p T1 = (W[IDX0] += s0 + s1 + W[IDX9]);
+    T1 += S[H] + VectorSigma1(S[E]) + VectorCh(S[E],S[F],S[G]) + K;
+    uint32x4_p T2 = VectorSigma0(S[A]) + VectorMaj(S[A],S[B],S[C]);
+
+    S[H] = S[G]; S[G] = S[F]; S[F] = S[E];
+    S[E] = S[D] + T1;
+    S[D] = S[C]; S[C] = S[B]; S[B] = S[A];
+    S[A] = T1 + T2;
+}
+
+void SHA256_HashMultipleBlocks_POWER8(word32 *state, const word32 *data, size_t length, ByteOrder order)
+{
+    CRYPTOPP_ASSERT(state); CRYPTOPP_ASSERT(data);
+    CRYPTOPP_ASSERT(length >= SHA256::BLOCKSIZE);
+    CRYPTOPP_UNUSED(order);
+
+    const uint32_t* k = reinterpret_cast<const uint32_t*>(SHA256_K);
+    const uint32_t* m = reinterpret_cast<const uint32_t*>(data);
+
+    uint32x4_p abcd = VecLoad(state+0);
+    uint32x4_p efgh = VecLoad(state+4);
+    uint32x4_p W[16], S[8], vm, vk;
+
+    size_t blocks = length / SHA256::BLOCKSIZE;
+    while (blocks--)
+    {
+        unsigned int offset=0;
+
+        S[A] = abcd; S[E] = efgh;
+        S[B] = VecShiftLeftOctet<4>(S[A]);
+        S[F] = VecShiftLeftOctet<4>(S[E]);
+        S[C] = VecShiftLeftOctet<4>(S[B]);
+        S[G] = VecShiftLeftOctet<4>(S[F]);
+        S[D] = VecShiftLeftOctet<4>(S[C]);
+        S[H] = VecShiftLeftOctet<4>(S[G]);
+
+        // Rounds 0-16
+        vk = VecLoad(offset, k);
+        vm = VecLoad32(m, offset);
+        SHA256_ROUND1<0>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<1>(W,S, vk,vm);
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<2>(W,S, vk,vm);
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<3>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad32(m, offset);
+        SHA256_ROUND1<4>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<5>(W,S, vk,vm);
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<6>(W,S, vk,vm);
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<7>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad32(m, offset);
+        SHA256_ROUND1<8>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<9>(W,S, vk,vm);
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<10>(W,S, vk,vm);
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<11>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad32(m, offset);
+        SHA256_ROUND1<12>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<13>(W,S, vk,vm);
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<14>(W,S, vk,vm);
+
+        vk = VecShiftLeftOctet<4>(vk);
+        vm = VecShiftLeftOctet<4>(vm);
+        SHA256_ROUND1<15>(W,S, vk,vm);
+
+        m += 16; // 32-bit words, not bytes
+
+        // Rounds 16-64
+        for (unsigned int i=16; i<64; i+=16)
+        {
+            vk = VecLoad(offset, k);
+            SHA256_ROUND2<0>(W,S, vk);
+            SHA256_ROUND2<1>(W,S, VecShiftLeftOctet<4>(vk));
+            SHA256_ROUND2<2>(W,S, VecShiftLeftOctet<8>(vk));
+            SHA256_ROUND2<3>(W,S, VecShiftLeftOctet<12>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA256_ROUND2<4>(W,S, vk);
+            SHA256_ROUND2<5>(W,S, VecShiftLeftOctet<4>(vk));
+            SHA256_ROUND2<6>(W,S, VecShiftLeftOctet<8>(vk));
+            SHA256_ROUND2<7>(W,S, VecShiftLeftOctet<12>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA256_ROUND2<8>(W,S, vk);
+            SHA256_ROUND2<9>(W,S, VecShiftLeftOctet<4>(vk));
+            SHA256_ROUND2<10>(W,S, VecShiftLeftOctet<8>(vk));
+            SHA256_ROUND2<11>(W,S, VecShiftLeftOctet<12>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA256_ROUND2<12>(W,S, vk);
+            SHA256_ROUND2<13>(W,S, VecShiftLeftOctet<4>(vk));
+            SHA256_ROUND2<14>(W,S, VecShiftLeftOctet<8>(vk));
+            SHA256_ROUND2<15>(W,S, VecShiftLeftOctet<12>(vk));
+            offset+=16;
+        }
+
+        abcd += VectorPack(S[A],S[B],S[C],S[D]);
+        efgh += VectorPack(S[E],S[F],S[G],S[H]);
+    }
+
+    VecStore32(abcd, state+0);
+    VecStore32(efgh, state+4);
+}
+
+inline
+void VecStore64(const uint64x2_p val, word64* data)
+{
+    VecStore(val, data);
+}
+
+inline
+uint64x2_p VecLoad64(const word64* data, int offset)
+{
+#if (CRYPTOPP_LITTLE_ENDIAN)
+    const uint8x16_p mask = {0,1,2,3, 4,5,6,7, 8,9,10,11, 12,13,14,15};
+    return VecPermute(VecLoad(offset, data), mask);
+#else
+    return VecLoad(offset, data);
+#endif
+}
+
+inline
+uint64x2_p VectorCh(const uint64x2_p x, const uint64x2_p y, const uint64x2_p z)
+{
+    // The trick below is due to Andy Polyakov and Jack Lloyd
+    return vec_sel(z,y,x);
+}
+
+inline
+uint64x2_p VectorMaj(const uint64x2_p x, const uint64x2_p y, const uint64x2_p z)
+{
+    // The trick below is due to Andy Polyakov and Jack Lloyd
+    return vec_sel(y, z, VecXor(x, y));
+}
+
+inline
+uint64x2_p Vector_sigma0(const uint64x2_p val)
+{
+    return VecSHA512<0,0>(val);
+}
+
+inline
+uint64x2_p Vector_sigma1(const uint64x2_p val)
+{
+    return VecSHA512<0,0xf>(val);
+}
+
+inline
+uint64x2_p VectorSigma0(const uint64x2_p val)
+{
+    return VecSHA512<1,0>(val);
+}
+
+inline
+uint64x2_p VectorSigma1(const uint64x2_p val)
+{
+    return VecSHA512<1,0xf>(val);
+}
+
+inline
+uint64x2_p VectorPack(const uint64x2_p x, const uint64x2_p y)
+{
+    const uint8x16_p m = {0,1,2,3, 4,5,6,7, 16,17,18,19, 20,21,22,23};
+    return VecPermute(x,y,m);
+}
+
+template <unsigned int R> inline
+void SHA512_ROUND1(uint64x2_p W[16], uint64x2_p S[8], const uint64x2_p K, const uint64x2_p M)
+{
+    uint64x2_p T1, T2;
+
+    W[R] = M;
+    T1 = S[H] + VectorSigma1(S[E]) + VectorCh(S[E],S[F],S[G]) + K + M;
+    T2 = VectorSigma0(S[A]) + VectorMaj(S[A],S[B],S[C]);
+
+    S[H] = S[G]; S[G] = S[F]; S[F] = S[E];
+    S[E] = S[D] + T1;
+    S[D] = S[C]; S[C] = S[B]; S[B] = S[A];
+    S[A] = T1 + T2;
+}
+
+template <unsigned int R> inline
+void SHA512_ROUND2(uint64x2_p W[16], uint64x2_p S[8], const uint64x2_p K)
+{
+    // Indexes into the W[] array
+    enum {IDX0=(R+0)&0xf, IDX1=(R+1)&0xf, IDX9=(R+9)&0xf, IDX14=(R+14)&0xf};
+
+    const uint64x2_p s0 = Vector_sigma0(W[IDX1]);
+    const uint64x2_p s1 = Vector_sigma1(W[IDX14]);
+
+    uint64x2_p T1 = (W[IDX0] += s0 + s1 + W[IDX9]);
+    T1 += S[H] + VectorSigma1(S[E]) + VectorCh(S[E],S[F],S[G]) + K;
+    uint64x2_p T2 = VectorSigma0(S[A]) + VectorMaj(S[A],S[B],S[C]);
+
+    S[H] = S[G]; S[G] = S[F]; S[F] = S[E];
+    S[E] = S[D] + T1;
+    S[D] = S[C]; S[C] = S[B]; S[B] = S[A];
+    S[A] = T1 + T2;
+}
+
+void SHA512_HashMultipleBlocks_POWER8(word64 *state, const word64 *data, size_t length, ByteOrder order)
+{
+    CRYPTOPP_ASSERT(state); CRYPTOPP_ASSERT(data);
+    CRYPTOPP_ASSERT(length >= SHA512::BLOCKSIZE);
+    CRYPTOPP_UNUSED(order);
+
+    const uint64_t* k = reinterpret_cast<const uint64_t*>(SHA512_K);
+    const uint64_t* m = reinterpret_cast<const uint64_t*>(data);
+
+    uint64x2_p ab = VecLoad(state+0);
+    uint64x2_p cd = VecLoad(state+2);
+    uint64x2_p ef = VecLoad(state+4);
+    uint64x2_p gh = VecLoad(state+6);
+    uint64x2_p W[16], S[8], vm, vk;
+
+    size_t blocks = length / SHA512::BLOCKSIZE;
+    while (blocks--)
+    {
+        unsigned int offset=0;
+
+        S[A] = ab; S[C] = cd;
+        S[E] = ef; S[G] = gh;
+        S[B] = VecShiftLeftOctet<8>(S[A]);
+        S[D] = VecShiftLeftOctet<8>(S[C]);
+        S[F] = VecShiftLeftOctet<8>(S[E]);
+        S[H] = VecShiftLeftOctet<8>(S[G]);
+
+        // Rounds 0-16
+        vk = VecLoad(offset, k);
+        vm = VecLoad64(m, offset);
+        SHA512_ROUND1<0>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<8>(vk);
+        vm = VecShiftLeftOctet<8>(vm);
+        SHA512_ROUND1<1>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad64(m, offset);
+        SHA512_ROUND1<2>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<8>(vk);
+        vm = VecShiftLeftOctet<8>(vm);
+        SHA512_ROUND1<3>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad64(m, offset);
+        SHA512_ROUND1<4>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<8>(vk);
+        vm = VecShiftLeftOctet<8>(vm);
+        SHA512_ROUND1<5>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad64(m, offset);
+        SHA512_ROUND1<6>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<8>(vk);
+        vm = VecShiftLeftOctet<8>(vm);
+        SHA512_ROUND1<7>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad64(m, offset);
+        SHA512_ROUND1<8>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<8>(vk);
+        vm = VecShiftLeftOctet<8>(vm);
+        SHA512_ROUND1<9>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad64(m, offset);
+        SHA512_ROUND1<10>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<8>(vk);
+        vm = VecShiftLeftOctet<8>(vm);
+        SHA512_ROUND1<11>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad64(m, offset);
+        SHA512_ROUND1<12>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<8>(vk);
+        vm = VecShiftLeftOctet<8>(vm);
+        SHA512_ROUND1<13>(W,S, vk,vm);
+
+        vk = VecLoad(offset, k);
+        vm = VecLoad64(m, offset);
+        SHA512_ROUND1<14>(W,S, vk,vm);
+        offset+=16;
+
+        vk = VecShiftLeftOctet<8>(vk);
+        vm = VecShiftLeftOctet<8>(vm);
+        SHA512_ROUND1<15>(W,S, vk,vm);
+
+        m += 16; // 64-bit words, not bytes
+
+        // Rounds 16-80
+        for (unsigned int i=16; i<80; i+=16)
+        {
+            vk = VecLoad(offset, k);
+            SHA512_ROUND2<0>(W,S, vk);
+            SHA512_ROUND2<1>(W,S, VecShiftLeftOctet<8>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA512_ROUND2<2>(W,S, vk);
+            SHA512_ROUND2<3>(W,S, VecShiftLeftOctet<8>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA512_ROUND2<4>(W,S, vk);
+            SHA512_ROUND2<5>(W,S, VecShiftLeftOctet<8>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA512_ROUND2<6>(W,S, vk);
+            SHA512_ROUND2<7>(W,S, VecShiftLeftOctet<8>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA512_ROUND2<8>(W,S, vk);
+            SHA512_ROUND2<9>(W,S, VecShiftLeftOctet<8>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA512_ROUND2<10>(W,S, vk);
+            SHA512_ROUND2<11>(W,S, VecShiftLeftOctet<8>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA512_ROUND2<12>(W,S, vk);
+            SHA512_ROUND2<13>(W,S, VecShiftLeftOctet<8>(vk));
+            offset+=16;
+
+            vk = VecLoad(offset, k);
+            SHA512_ROUND2<14>(W,S, vk);
+            SHA512_ROUND2<15>(W,S, VecShiftLeftOctet<8>(vk));
+            offset+=16;
+        }
+
+        ab += VectorPack(S[A],S[B]);
+        cd += VectorPack(S[C],S[D]);
+        ef += VectorPack(S[E],S[F]);
+        gh += VectorPack(S[G],S[H]);
+    }
+
+    VecStore64(ab, state+0);
+    VecStore64(cd, state+2);
+    VecStore64(ef, state+4);
+    VecStore64(gh, state+6);
+}
+
+#endif  // CRYPTOPP_POWER8_SHA_AVAILABLE
+
+////////////////////////////////////////////////
+// end Gustavo, Serra, Scalet and Walton code //
+////////////////////////////////////////////////
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/shacal2.cpp b/runtime/third_party/cryptopp/shacal2.cpp
new file mode 100644
index 0000000..007c91e
--- /dev/null
+++ b/runtime/third_party/cryptopp/shacal2.cpp
@@ -0,0 +1,172 @@
+// shacal2.cpp - written by Kevin Springle, 2003
+//
+// Portions of this code were derived from
+// Wei Dai's implementation of SHA-2
+//
+// Jack Lloyd and the Botan team allowed Crypto++ to use parts of
+// Botan's implementation under the same license as Crypto++
+// is released. The code for SHACAL2_Enc_ProcessAndXorBlock_SHANI
+// below is Botan's x86_encrypt_blocks with minor tweaks. Many thanks
+// to the Botan team. Also see http://github.com/randombit/botan/.
+//
+// The original code and all modifications are in the public domain.
+
+#include "pch.h"
+#include "config.h"
+#include "shacal2.h"
+#include "misc.h"
+#include "cpu.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// SHACAL-2 function and round definitions
+
+#define S0(x) (rotrConstant<2>(x)^rotrConstant<13>(x)^rotrConstant<22>(x))
+#define S1(x) (rotrConstant<6>(x)^rotrConstant<11>(x)^rotrConstant<25>(x))
+#define s0(x) (rotrConstant<7>(x)^rotrConstant<18>(x)^(x>>3))
+#define s1(x) (rotrConstant<17>(x)^rotrConstant<19>(x)^(x>>10))
+
+#define Ch(x,y,z) (z^(x&(y^z)))
+#define Maj(x,y,z) ((x&y)|(z&(x|y)))
+
+/* R is the SHA-256 round function. */
+/* This macro increments the k argument as a side effect. */
+#define R(a,b,c,d,e,f,g,h,k) \
+	h+=S1(e)+Ch(e,f,g)+*k++;d+=h;h+=S0(a)+Maj(a,b,c);
+
+/* P is the inverse of the SHA-256 round function. */
+/* This macro decrements the k argument as a side effect. */
+#define P(a,b,c,d,e,f,g,h,k) \
+	h-=S0(a)+Maj(a,b,c);d-=h;h-=S1(e)+Ch(e,f,g)+*--k;
+
+#if CRYPTOPP_SHANI_AVAILABLE
+extern void SHACAL2_Enc_ProcessAndXorBlock_SHANI(const word32* subKeys,
+                const byte *inBlock, const byte *xorBlock, byte *outBlock);
+#endif
+
+std::string SHACAL2::Base::AlgorithmProvider() const
+{
+#if CRYPTOPP_SHANI_AVAILABLE
+    if (HasSHA())
+        return "SHANI";
+#endif
+	return "C++";
+}
+
+void SHACAL2::Base::UncheckedSetKey(const byte *userKey, unsigned int keylen, const NameValuePairs &)
+{
+	AssertValidKeyLength(keylen);
+
+	word32 *rk = m_key;
+	unsigned int i;
+
+	// 32-bit GCC 5.4 hack... m_key.size() returns 0. Note: this surfaced after changing
+	// m_key to FixedSizeAlignedSecBlock at commit 1ab1e08ac5b5a0d63374de0c.
+	GetUserKey(BIG_ENDIAN_ORDER, rk, 64, userKey, keylen);
+	for (i = 0; i < 48; i++, rk++)
+	{
+		rk[16] = rk[0] + s0(rk[1]) + rk[9] + s1(rk[14]);
+		rk[0] += K[i];
+	}
+	for (i = 48; i < 64; i++, rk++)
+	{
+		rk[0] += K[i];
+	}
+}
+
+typedef BlockGetAndPut<word32, BigEndian> Block;
+
+void SHACAL2::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+#if CRYPTOPP_SHANI_AVAILABLE
+	if (HasSHA())
+	{
+		SHACAL2_Enc_ProcessAndXorBlock_SHANI(m_key, inBlock, xorBlock, outBlock);
+		return;
+	}
+#endif
+
+	word32 a, b, c, d, e, f, g, h;
+	const word32 *rk = m_key;
+
+	/*
+	 * map byte array block to cipher state:
+	 */
+	Block::Get(inBlock)(a)(b)(c)(d)(e)(f)(g)(h);
+
+	// Perform SHA-256 transformation.
+
+	/* 64 operations, partially loop unrolled */
+	for (unsigned int j=0; j<64; j+=8)
+	{
+		R(a,b,c,d,e,f,g,h,rk);
+		R(h,a,b,c,d,e,f,g,rk);
+		R(g,h,a,b,c,d,e,f,rk);
+		R(f,g,h,a,b,c,d,e,rk);
+		R(e,f,g,h,a,b,c,d,rk);
+		R(d,e,f,g,h,a,b,c,rk);
+		R(c,d,e,f,g,h,a,b,rk);
+		R(b,c,d,e,f,g,h,a,rk);
+	}
+
+	/*
+	 * map cipher state to byte array block:
+	 */
+
+	Block::Put(xorBlock, outBlock)(a)(b)(c)(d)(e)(f)(g)(h);
+}
+
+void SHACAL2::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 a, b, c, d, e, f, g, h;
+	const word32 *rk = m_key + 64;
+
+	/*
+	 * map byte array block to cipher state:
+	 */
+	Block::Get(inBlock)(a)(b)(c)(d)(e)(f)(g)(h);
+
+	// Perform inverse SHA-256 transformation.
+
+	/* 64 operations, partially loop unrolled */
+	for (unsigned int j=0; j<64; j+=8)
+	{
+		P(b,c,d,e,f,g,h,a,rk);
+		P(c,d,e,f,g,h,a,b,rk);
+		P(d,e,f,g,h,a,b,c,rk);
+		P(e,f,g,h,a,b,c,d,rk);
+		P(f,g,h,a,b,c,d,e,rk);
+		P(g,h,a,b,c,d,e,f,rk);
+		P(h,a,b,c,d,e,f,g,rk);
+		P(a,b,c,d,e,f,g,h,rk);
+	}
+
+	/*
+	 * map cipher state to byte array block:
+	 */
+
+	Block::Put(xorBlock, outBlock)(a)(b)(c)(d)(e)(f)(g)(h);
+}
+
+// The SHACAL-2 round constants are identical to the SHA-256 round constants.
+const word32 SHACAL2::Base::K[64] =
+{
+	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
+	0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+	0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+	0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
+	0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
+	0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+	0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+	0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
+	0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
+	0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+	0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+};
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/shacal2.h b/runtime/third_party/cryptopp/shacal2.h
new file mode 100644
index 0000000..9f72958
--- /dev/null
+++ b/runtime/third_party/cryptopp/shacal2.h
@@ -0,0 +1,66 @@
+// shacal.h - originally written and placed in the public domain by Wei Dai
+
+/// \file shacal2.h
+/// \brief Classes for the SHACAL-2 block cipher
+/// \since Crypto++ 5.2, Intel SHA since Crypto++ 6.0
+
+#ifndef CRYPTOPP_SHACAL2_H
+#define CRYPTOPP_SHACAL2_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SHACAL2 block cipher information
+struct SHACAL2_Info : public FixedBlockSize<32>, public VariableKeyLength<16, 16, 64>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "SHACAL-2";}
+};
+
+/// \brief SHACAL2 block cipher
+/// \since Crypto++ 5.2, Intel SHA since Crypto++ 6.0
+/// \sa <a href="http://www.cryptopp.com/wiki/SHACAL-2">SHACAL-2</a>
+class SHACAL2 : public SHACAL2_Info, public BlockCipherDocumentation
+{
+	/// \brief SHACAL2 block cipher transformation functions
+	/// \details Provides implementation common to encryption and decryption
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<SHACAL2_Info>
+	{
+	public:
+		std::string AlgorithmProvider() const;
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		FixedSizeAlignedSecBlock<word32, 64> m_key;
+
+		static const word32 K[64];
+	};
+
+	/// \brief SHACAL2 block cipher transformation functions
+	/// \details Encryption transformation
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief SHACAL2 block cipher transformation functions
+	/// \details Decryption transformation
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef SHACAL2::Encryption SHACAL2Encryption;
+typedef SHACAL2::Decryption SHACAL2Decryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/shacal2_simd.cpp b/runtime/third_party/cryptopp/shacal2_simd.cpp
new file mode 100644
index 0000000..289cd85
--- /dev/null
+++ b/runtime/third_party/cryptopp/shacal2_simd.cpp
@@ -0,0 +1,94 @@
+// shacla2_simd.cpp - written and placed in the public domain by
+//                    Jeffrey Walton and Jack Lloyd
+//
+//    Jack Lloyd and the Botan team allowed Crypto++ to use parts of
+//    Botan's implementation under the same license as Crypto++
+//    is released. The code for SHACAL2_Enc_ProcessAndXorBlock_SHANI
+//    below is Botan's x86_encrypt_blocks with minor tweaks. Many thanks
+//    to the Botan team. Also see http://github.com/randombit/botan/.
+//
+//    This source file uses intrinsics to gain access to SHA-NI and
+//    ARMv8a SHA instructions. A separate source file is needed because
+//    additional CXXFLAGS are required to enable the appropriate instruction
+//    sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+#include "sha.h"
+#include "misc.h"
+
+#if (CRYPTOPP_SHANI_AVAILABLE)
+# include <nmmintrin.h>
+# include <immintrin.h>
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char SHACAL2_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if CRYPTOPP_SHANI_AVAILABLE
+void SHACAL2_Enc_ProcessAndXorBlock_SHANI(const word32* subKeys, const byte *inBlock, const byte *xorBlock, byte *outBlock)
+{
+	CRYPTOPP_ASSERT(subKeys);
+	CRYPTOPP_ASSERT(inBlock);
+	CRYPTOPP_ASSERT(outBlock);
+
+	const __m128i MASK1 = _mm_set_epi8(8,9,10,11,  12,13,14,15,  0,1,2,3,  4,5,6,7);
+	const __m128i MASK2 = _mm_set_epi8(0,1,2,3,  4,5,6,7,  8,9,10,11,  12,13,14,15);
+
+	__m128i B0 = _mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(inBlock + 0)), MASK1);
+	__m128i B1 = _mm_shuffle_epi8(_mm_loadu_si128(CONST_M128_CAST(inBlock + 16)), MASK2);
+
+	__m128i TMP = _mm_alignr_epi8(B0, B1, 8);
+	B1 = _mm_blend_epi16(B1, B0, 0xF0);
+	B0 = TMP;
+
+#if 0
+	// SSE2 + SSSE3, but 0.2 cpb slower on a Celeraon J3455
+	const __m128i MASK1 = _mm_set_epi8(8,9,10,11,  12,13,14,15,  0,1,2,3,  4,5,6,7);
+	const __m128i MASK2 = _mm_set_epi8(0,1,2,3,  4,5,6,7,  8,9,10,11,  12,13,14,15);
+
+	__m128i B0 = _mm_loadu_si128(CONST_M128_CAST(inBlock + 0));
+	__m128i B1 = _mm_loadu_si128(CONST_M128_CAST(inBlock + 16));
+
+	__m128i TMP = _mm_shuffle_epi8(_mm_unpacklo_epi64(B0, B1), MASK2);
+	B1 = _mm_shuffle_epi8(_mm_unpackhi_epi64(B0, B1), MASK2);
+	B0 = TMP;
+#endif
+
+	const byte* keys = reinterpret_cast<const byte*>(subKeys);
+	for (size_t i = 0; i != 8; ++i)
+	{
+		const __m128i RK0 = _mm_load_si128(CONST_M128_CAST(keys + 32*i));
+		const __m128i RK2 = _mm_load_si128(CONST_M128_CAST(keys + 32*i+16));
+		const __m128i RK1 = _mm_srli_si128(RK0, 8);
+		const __m128i RK3 = _mm_srli_si128(RK2, 8);
+
+		B1 = _mm_sha256rnds2_epu32(B1, B0, RK0);
+		B0 = _mm_sha256rnds2_epu32(B0, B1, RK1);
+		B1 = _mm_sha256rnds2_epu32(B1, B0, RK2);
+		B0 = _mm_sha256rnds2_epu32(B0, B1, RK3);
+	}
+
+	TMP = _mm_shuffle_epi8(_mm_unpackhi_epi64(B0, B1), MASK1);
+	B1 = _mm_shuffle_epi8(_mm_unpacklo_epi64(B0, B1), MASK1);
+	B0 = TMP;
+
+	if (xorBlock)
+	{
+		_mm_storeu_si128(M128_CAST(outBlock + 0),
+			_mm_xor_si128(B0, _mm_loadu_si128(CONST_M128_CAST(xorBlock + 0))));
+
+		_mm_storeu_si128(M128_CAST(outBlock + 16),
+			_mm_xor_si128(B1, _mm_loadu_si128(CONST_M128_CAST(xorBlock + 16))));
+	}
+	else
+	{
+		_mm_storeu_si128(M128_CAST(outBlock + 0), B0);
+		_mm_storeu_si128(M128_CAST(outBlock + 16), B1);
+	}
+}
+#endif
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/shake.cpp b/runtime/third_party/cryptopp/shake.cpp
new file mode 100644
index 0000000..28bf6a1
--- /dev/null
+++ b/runtime/third_party/cryptopp/shake.cpp
@@ -0,0 +1,85 @@
+// shake.cpp - modified by Wei Dai from Ronny Van Keer's public domain
+//             sha3-simple.c. All modifications here are placed in the
+//             public domain by Wei Dai.
+//             Keccack core function moved to keccakc.cpp in AUG 2018
+//             by Jeffrey Walton. Separating the core file allows both
+//             SHA3 and Keccack to share the core implementation.
+
+/*
+The SHAKE sponge function, designed by Guido Bertoni, Joan Daemen,
+Michael Peeters and Gilles Van Assche. For more information, feedback or
+questions, please refer to our website: http://keccak.noekeon.org/
+
+Implementation by Ronny Van Keer, hereby denoted as "the implementer".
+
+To the extent possible under law, the implementer has waived all copyright
+and related or neighboring rights to the source code in this file.
+http://creativecommons.org/publicdomain/zero/1.0/
+*/
+
+#include "pch.h"
+#include "shake.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// The Keccak core function
+extern void KeccakF1600(word64 *state);
+
+void SHAKE::Update(const byte *input, size_t length)
+{
+    CRYPTOPP_ASSERT(!(input == NULLPTR && length != 0));
+    if (length == 0) { return; }
+
+    size_t spaceLeft;
+    while (length >= (spaceLeft = r() - m_counter))
+    {
+        if (spaceLeft)
+            xorbuf(m_state.BytePtr() + m_counter, input, spaceLeft);
+        KeccakF1600(m_state);
+        input += spaceLeft;
+        length -= spaceLeft;
+        m_counter = 0;
+    }
+
+    if (length)
+        xorbuf(m_state.BytePtr() + m_counter, input, length);
+    m_counter += (unsigned int)length;
+}
+
+void SHAKE::Restart()
+{
+    std::memset(m_state, 0, m_state.SizeInBytes());
+    m_counter = 0;
+}
+
+void SHAKE::ThrowIfInvalidTruncatedSize(size_t size) const
+{
+	if (size > UINT_MAX)
+		throw InvalidArgument(std::string("HashTransformation: can't truncate a ") +
+		    IntToString(UINT_MAX) + " byte digest to " + IntToString(size) + " bytes");
+}
+
+void SHAKE::TruncatedFinal(byte *hash, size_t size)
+{
+    CRYPTOPP_ASSERT(hash != NULLPTR);
+    ThrowIfInvalidTruncatedSize(size);
+
+    m_state.BytePtr()[m_counter] ^= 0x1F;
+    m_state.BytePtr()[r()-1] ^= 0x80;
+
+    // FIPS 202, Algorithm 8, pp 18-19.
+    while (size > 0)
+    {
+        KeccakF1600(m_state);
+
+        const size_t segmentLen = STDMIN(size, (size_t)BlockSize());
+        std::memcpy(hash, m_state, segmentLen);
+
+        hash += segmentLen;
+        size -= segmentLen;
+    }
+
+    Restart();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/shake.h b/runtime/third_party/cryptopp/shake.h
new file mode 100644
index 0000000..4d52132
--- /dev/null
+++ b/runtime/third_party/cryptopp/shake.h
@@ -0,0 +1,161 @@
+// shake.h - written and placed in the public domain by Jeffrey Walton
+
+/// \file shake.h
+/// \brief Classes for SHAKE message digests
+/// \details The library provides byte oriented SHAKE128 and SHAKE256 using F1600.
+///   FIPS 202 allows nearly unlimited output sizes, but Crypto++ limits the output
+///   size to <tt>UINT_MAX</tt> due underlying data types.
+/// \sa Keccak, SHA3, SHAKE128, SHAKE256,
+///   <a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf">FIPS 202,
+///   SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions</a>
+/// \since Crypto++ 8.1
+
+#ifndef CRYPTOPP_SHAKE_H
+#define CRYPTOPP_SHAKE_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SHAKE message digest base class
+/// \details SHAKE is the base class for SHAKE128 and SHAKE258.
+///   Library users should instantiate a derived class, and only use SHAKE
+///   as a base class reference or pointer.
+/// \sa Keccak, SHA3, SHAKE128, SHAKE256,
+///   <a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf">FIPS 202,
+///   SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions</a>
+/// \since Crypto++ 8.1
+class SHAKE : public HashTransformation
+{
+protected:
+    /// \brief Construct a SHAKE
+    /// \param digestSize the digest size, in bytes
+    /// \details SHAKE is the base class for SHAKE128 and SHAKE256.
+    ///   Library users should instantiate a derived class, and only use SHAKE
+    ///   as a base class reference or pointer.
+    /// \details This constructor was moved to protected at Crypto++ 8.1
+    ///   because users were attempting to create Keccak objects with it.
+    /// \since Crypto++ 8.1
+    SHAKE(unsigned int digestSize) : m_digestSize(digestSize) {Restart();}
+
+public:
+    unsigned int DigestSize() const {return m_digestSize;}
+    unsigned int OptimalDataAlignment() const {return GetAlignmentOf<word64>();}
+
+    void Update(const byte *input, size_t length);
+    void Restart();
+    void TruncatedFinal(byte *hash, size_t size);
+
+protected:
+    inline unsigned int r() const {return BlockSize();}
+
+    // SHAKE-128 and SHAKE-256 effectively allow unlimited
+    // output length. However, we use an unsigned int so
+    // we are limited in practice to UINT_MAX.
+    void ThrowIfInvalidTruncatedSize(size_t size) const;
+
+    FixedSizeSecBlock<word64, 25> m_state;
+    unsigned int m_digestSize, m_counter;
+};
+
+/// \brief SHAKE message digest template
+/// \tparam T_Strength the strength of the digest
+/// \since Crypto++ 8.1
+template<unsigned int T_Strength>
+class SHAKE_Final : public SHAKE
+{
+public:
+    CRYPTOPP_CONSTANT(DIGESTSIZE = (T_Strength == 128 ? 32 : 64));
+    CRYPTOPP_CONSTANT(BLOCKSIZE = (T_Strength == 128 ? 1344/8 : 1088/8));
+    static std::string StaticAlgorithmName()
+        { return "SHAKE-" + IntToString(T_Strength); }
+
+    /// \brief Construct a SHAKE-X message digest
+    /// \details SHAKE128 and SHAKE256 don't need the output size in advance
+    ///   because the output size does not affect the digest. TruncatedFinal
+    ///   produces the correct digest for any output size. However, cSHAKE
+    ///   requires the output size in advance because the algorithm uses
+    ///   output size as a parameter to the hash function.
+    SHAKE_Final(unsigned int outputSize=DIGESTSIZE) : SHAKE(outputSize) {}
+
+    /// \brief Provides the block size of the compression function
+    /// \return block size of the compression function, in bytes
+    /// \details BlockSize() will return 0 if the hash is not block based
+    ///   or does not have an equivalent block size. For example, Keccak
+    ///   and SHA-3 do not have a block size, but they do have an equivalent
+    ///   to block size called rate expressed as <tt>r</tt>.
+    unsigned int BlockSize() const { return BLOCKSIZE; }
+
+    std::string AlgorithmName() const { return StaticAlgorithmName(); }
+
+private:
+#if !defined(__BORLANDC__)
+    // ensure there was no underflow in the math
+    CRYPTOPP_COMPILE_ASSERT(BLOCKSIZE < 200);
+#endif
+};
+
+/// \brief SHAKE128 message digest
+/// \details The library provides byte oriented SHAKE128 using F1600.
+///   FIPS 202 allows nearly unlimited output sizes, but Crypto++ limits
+///   the output size to <tt>UINT_MAX</tt> due underlying data types.
+/// \sa Keccak, SHA3, SHAKE256,
+///   <a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf">FIPS 202,
+///   SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions</a>
+/// \since Crypto++ 8.1
+class SHAKE128 : public SHAKE_Final<128>
+{
+public:
+    /// \brief Construct a SHAKE128 message digest
+    /// \details SHAKE128 and SHAKE256 don't need the output size in advance
+    ///   because the output size does not affect the digest. TruncatedFinal
+    ///   produces the correct digest for any output size. However, cSHAKE
+    ///   requires the output size in advance because the algorithm uses
+    ///   output size as a parameter to the hash function.
+    /// \since Crypto++ 8.1
+    SHAKE128() {}
+
+    /// \brief Construct a SHAKE128 message digest
+    /// \details SHAKE128 and SHAKE256 don't need the output size in advance
+    ///   because the output size does not affect the digest. TruncatedFinal
+    ///   produces the correct digest for any output size. However, cSHAKE
+    ///   requires the output size in advance because the algorithm uses
+    ///   output size as a parameter to the hash function.
+    /// \since Crypto++ 8.1
+    SHAKE128(unsigned int outputSize) : SHAKE_Final<128>(outputSize) {}
+};
+
+/// \brief SHAKE256 message digest
+/// \details The library provides byte oriented SHAKE256 using F1600.
+///   FIPS 202 allows nearly unlimited output sizes, but Crypto++ limits
+///   the output size to <tt>UINT_MAX</tt> due underlying data types.
+/// \sa Keccak, SHA3, SHAKE128,
+///   <a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf">FIPS 202,
+///   SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions</a>
+/// \since Crypto++ 8.1
+class SHAKE256 : public SHAKE_Final<256>
+{
+public:
+    /// \brief Construct a SHAKE256 message digest
+    /// \details SHAKE128 and SHAKE256 don't need the output size in advance
+    ///   because the output size does not affect the digest. TruncatedFinal
+    ///   produces the correct digest for any output size. However, cSHAKE
+    ///   requires the output size in advance because the algorithm uses
+    ///   output size as a parameter to the hash function.
+    /// \since Crypto++ 8.1
+    SHAKE256() {}
+
+    /// \brief Construct a SHAKE256 message digest
+    /// \details SHAKE128 and SHAKE256 don't need the output size in advance
+    ///   because the output size does not affect the digest. TruncatedFinal
+    ///   produces the correct digest for any output size. However, cSHAKE
+    ///   requires the output size in advance because the algorithm uses
+    ///   output size as a parameter to the hash function.
+    /// \since Crypto++ 8.1
+    SHAKE256(unsigned int outputSize) : SHAKE_Final<256>(outputSize) {}
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/shark.cpp b/runtime/third_party/cryptopp/shark.cpp
new file mode 100644
index 0000000..8d4eef8
--- /dev/null
+++ b/runtime/third_party/cryptopp/shark.cpp
@@ -0,0 +1,163 @@
+// shark.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "shark.h"
+#include "misc.h"
+#include "modes.h"
+#include "gf256.h"
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wmissing-braces"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+static word64 SHARKTransform(word64 a)
+{
+	static const byte iG[8][8] = {
+		{0xe7, 0x30, 0x90, 0x85, 0xd0, 0x4b, 0x91, 0x41},
+		{0x53, 0x95, 0x9b, 0xa5, 0x96, 0xbc, 0xa1, 0x68},
+		{0x02, 0x45, 0xf7, 0x65, 0x5c, 0x1f, 0xb6, 0x52},
+		{0xa2, 0xca, 0x22, 0x94, 0x44, 0x63, 0x2a, 0xa2},
+		{0xfc, 0x67, 0x8e, 0x10, 0x29, 0x75, 0x85, 0x71},
+		{0x24, 0x45, 0xa2, 0xcf, 0x2f, 0x22, 0xc1, 0x0e},
+		{0xa1, 0xf1, 0x71, 0x40, 0x91, 0x27, 0x18, 0xa5},
+		{0x56, 0xf4, 0xaf, 0x32, 0xd2, 0xa4, 0xdc, 0x71}
+	};
+
+	word64 result=0;
+	GF256 gf256(0xf5);
+	for (unsigned int i=0; i<8; i++)
+		for(unsigned int j=0; j<8; j++)
+			result ^= word64(gf256.Multiply(iG[i][j], GF256::Element(a>>(56-8*j)))) << (56-8*i);
+	return result;
+}
+
+void SHARK::Base::UncheckedSetKey(const byte *key, unsigned int keyLen, const NameValuePairs &params)
+{
+	AssertValidKeyLength(keyLen);
+
+	m_rounds = GetRoundsAndThrowIfInvalid(params, this);
+	m_roundKeys.New(m_rounds+1);
+
+	// concatenate key enough times to fill a
+	for (unsigned int i=0; i<(m_rounds+1)*8; i++)
+		((byte *)m_roundKeys.begin())[i] = key[i%keyLen];
+
+	SHARK::Encryption e;
+	e.InitForKeySetup();
+	byte IV[8] = {0,0,0,0,0,0,0,0};
+	CFB_Mode_ExternalCipher::Encryption cfb(e, IV);
+
+	cfb.ProcessString((byte *)m_roundKeys.begin(), (m_rounds+1)*8);
+
+	ConditionalByteReverse(BIG_ENDIAN_ORDER, m_roundKeys.begin(), m_roundKeys.begin(), (m_rounds+1)*8);
+
+	m_roundKeys[m_rounds] = SHARKTransform(m_roundKeys[m_rounds]);
+
+	if (!IsForwardTransformation())
+	{
+		unsigned int i;
+
+		// transform encryption round keys into decryption round keys
+		for (i=0; i<m_rounds/2; i++)
+			std::swap(m_roundKeys[i], m_roundKeys[m_rounds-i]);
+
+		for (i=1; i<m_rounds; i++)
+			m_roundKeys[i] = SHARKTransform(m_roundKeys[i]);
+	}
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+	m_roundKeys[0] = ByteReverse(m_roundKeys[0]);
+	m_roundKeys[m_rounds] = ByteReverse(m_roundKeys[m_rounds]);
+#endif
+}
+
+// construct an SHARK_Enc object with fixed round keys, to be used to initialize actual round keys
+void SHARK::Enc::InitForKeySetup()
+{
+	m_rounds = DEFAULT_ROUNDS;
+	m_roundKeys.New(DEFAULT_ROUNDS+1);
+
+	for (unsigned int i=0; i<DEFAULT_ROUNDS; i++)
+		m_roundKeys[i] = cbox[0][i];
+
+	m_roundKeys[DEFAULT_ROUNDS] = SHARKTransform(cbox[0][DEFAULT_ROUNDS]);
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+	m_roundKeys[0] = ByteReverse(m_roundKeys[0]);
+	m_roundKeys[m_rounds] = ByteReverse(m_roundKeys[m_rounds]);
+#endif
+}
+
+void SHARK::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	CRYPTOPP_ASSERT(IsAlignedOn(inBlock,GetAlignmentOf<word64>()));
+	word64 tmp = *(word64 *)(void *)inBlock ^ m_roundKeys[0];
+
+	ByteOrder order = GetNativeByteOrder();
+	tmp = cbox[0][GetByte(order, tmp, 0)] ^ cbox[1][GetByte(order, tmp, 1)]
+		^ cbox[2][GetByte(order, tmp, 2)] ^ cbox[3][GetByte(order, tmp, 3)]
+		^ cbox[4][GetByte(order, tmp, 4)] ^ cbox[5][GetByte(order, tmp, 5)]
+		^ cbox[6][GetByte(order, tmp, 6)] ^ cbox[7][GetByte(order, tmp, 7)]
+		^ m_roundKeys[1];
+
+	for(unsigned int i=2; i<m_rounds; i++)
+	{
+		tmp = cbox[0][GETBYTE(tmp, 7)] ^ cbox[1][GETBYTE(tmp, 6)]
+			^ cbox[2][GETBYTE(tmp, 5)] ^ cbox[3][GETBYTE(tmp, 4)]
+			^ cbox[4][GETBYTE(tmp, 3)] ^ cbox[5][GETBYTE(tmp, 2)]
+			^ cbox[6][GETBYTE(tmp, 1)] ^ cbox[7][GETBYTE(tmp, 0)]
+			^ m_roundKeys[i];
+	}
+
+	PutBlock<byte, BigEndian>(xorBlock, outBlock)
+		(sbox[GETBYTE(tmp, 7)])
+		(sbox[GETBYTE(tmp, 6)])
+		(sbox[GETBYTE(tmp, 5)])
+		(sbox[GETBYTE(tmp, 4)])
+		(sbox[GETBYTE(tmp, 3)])
+		(sbox[GETBYTE(tmp, 2)])
+		(sbox[GETBYTE(tmp, 1)])
+		(sbox[GETBYTE(tmp, 0)]);
+
+	CRYPTOPP_ASSERT(IsAlignedOn(outBlock,GetAlignmentOf<word64>()));
+	*(word64 *)(void *)outBlock ^= m_roundKeys[m_rounds];
+}
+
+void SHARK::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	CRYPTOPP_ASSERT(IsAlignedOn(inBlock,GetAlignmentOf<word64>()));
+	word64 tmp = *(word64 *)(void *)inBlock ^ m_roundKeys[0];
+
+	ByteOrder order = GetNativeByteOrder();
+	tmp = cbox[0][GetByte(order, tmp, 0)] ^ cbox[1][GetByte(order, tmp, 1)]
+		^ cbox[2][GetByte(order, tmp, 2)] ^ cbox[3][GetByte(order, tmp, 3)]
+		^ cbox[4][GetByte(order, tmp, 4)] ^ cbox[5][GetByte(order, tmp, 5)]
+		^ cbox[6][GetByte(order, tmp, 6)] ^ cbox[7][GetByte(order, tmp, 7)]
+		^ m_roundKeys[1];
+
+	for(unsigned int i=2; i<m_rounds; i++)
+	{
+		tmp = cbox[0][GETBYTE(tmp, 7)] ^ cbox[1][GETBYTE(tmp, 6)]
+			^ cbox[2][GETBYTE(tmp, 5)] ^ cbox[3][GETBYTE(tmp, 4)]
+			^ cbox[4][GETBYTE(tmp, 3)] ^ cbox[5][GETBYTE(tmp, 2)]
+			^ cbox[6][GETBYTE(tmp, 1)] ^ cbox[7][GETBYTE(tmp, 0)]
+			^ m_roundKeys[i];
+	}
+
+	PutBlock<byte, BigEndian>(xorBlock, outBlock)
+		(sbox[GETBYTE(tmp, 7)])
+		(sbox[GETBYTE(tmp, 6)])
+		(sbox[GETBYTE(tmp, 5)])
+		(sbox[GETBYTE(tmp, 4)])
+		(sbox[GETBYTE(tmp, 3)])
+		(sbox[GETBYTE(tmp, 2)])
+		(sbox[GETBYTE(tmp, 1)])
+		(sbox[GETBYTE(tmp, 0)]);
+
+	CRYPTOPP_ASSERT(IsAlignedOn(outBlock,GetAlignmentOf<word64>()));
+	*(word64 *)(void *)outBlock ^= m_roundKeys[m_rounds];
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/shark.h b/runtime/third_party/cryptopp/shark.h
new file mode 100644
index 0000000..8c73d26
--- /dev/null
+++ b/runtime/third_party/cryptopp/shark.h
@@ -0,0 +1,77 @@
+// shark.h - originally written and placed in the public domain by Wei Dai
+
+/// \file shark.h
+/// \brief Classes for the SHARK block cipher
+/// \since Crypto++ 2.1
+
+#ifndef CRYPTOPP_SHARK_H
+#define CRYPTOPP_SHARK_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SHARK block cipher information
+/// \since Crypto++ 2.1
+struct SHARK_Info : public FixedBlockSize<8>, public FixedKeyLength<16>, public VariableRounds<6, 2>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "SHARK-E";}
+};
+
+/// \brief SHARK block cipher
+/// <a href="http://www.cryptopp.com/wiki/SHARK-E">SHARK-E</a>
+/// \since Crypto++ 2.1
+class SHARK : public SHARK_Info, public BlockCipherDocumentation
+{
+	/// \brief SHARK block cipher default operation
+	/// \since Crypto++ 2.1
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<SHARK_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &param);
+
+	protected:
+		unsigned int m_rounds;
+		SecBlock<word64> m_roundKeys;
+	};
+
+	/// \brief SHARK block cipher encryption operation
+	/// \since Crypto++ 2.1
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+		// used by Base to do key setup
+		void InitForKeySetup();
+
+	private:
+		static const byte sbox[256];
+		static const word64 cbox[8][256];
+	};
+
+	/// \brief SHARK block cipher decryption operation
+	/// \since Crypto++ 2.1
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+	private:
+		static const byte sbox[256];
+		static const word64 cbox[8][256];
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef SHARK::Encryption SHARKEncryption;
+typedef SHARK::Decryption SHARKDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/sharkbox.cpp b/runtime/third_party/cryptopp/sharkbox.cpp
new file mode 100644
index 0000000..bedc62d
--- /dev/null
+++ b/runtime/third_party/cryptopp/sharkbox.cpp
@@ -0,0 +1,4166 @@
+#include "pch.h"
+#include "shark.h"
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wmissing-braces"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const byte SHARK::Enc::sbox[256] = {
+177, 206, 195, 149,  90, 173, 231,   2,  77,  68, 251, 145,  12, 135, 161,  80,
+203, 103,  84, 221,  70, 143, 225,  78, 240, 253, 252, 235, 249, 196,  26, 110,
+ 94, 245, 204, 141,  28,  86,  67, 254,   7,  97, 248, 117,  89, 255,   3,  34,
+138, 209,  19, 238, 136,   0,  14,  52,  21, 128, 148, 227, 237, 181,  83,  35,
+ 75,  71,  23, 167, 144,  53, 171, 216, 184, 223,  79,  87, 154, 146, 219,  27,
+ 60, 200, 153,   4, 142, 224, 215, 125, 133, 187,  64,  44,  58,  69, 241,  66,
+101,  32,  65,  24, 114,  37, 147, 112,  54,   5, 242,  11, 163, 121, 236,   8,
+ 39,  49,  50, 182, 124, 176,  10, 115,  91, 123, 183, 129, 210,  13, 106,  38,
+158,  88, 156, 131, 116, 179, 172,  48, 122, 105, 119,  15, 174,  33, 222, 208,
+ 46, 151,  16, 164, 152, 168, 212, 104,  45,  98,  41, 109,  22,  73, 118, 199,
+232, 193, 150,  55, 229, 202, 244, 233,  99,  18, 194, 166,  20, 188, 211,  40,
+175,  47, 230,  36,  82, 198, 160,   9, 189, 140, 207,  93,  17,  95,   1, 197,
+159,  61, 162, 155, 201,  59, 190,  81,  25,  31,  63,  92, 178, 239,  74, 205,
+191, 186, 111, 100, 217, 243,  62, 180, 170, 220, 213,   6, 192, 126, 246, 102,
+108, 132, 113,  56, 185,  29, 127, 157,  72, 139,  42, 218, 165,  51, 130,  57,
+214, 120, 134, 250, 228,  43, 169,  30, 137,  96, 107, 234,  85,  76, 247, 226,
+};
+
+const byte SHARK::Dec::sbox[256] = {
+ 53, 190,   7,  46,  83, 105, 219,  40, 111, 183, 118, 107,  12, 125,  54, 139,
+146, 188, 169,  50, 172,  56, 156,  66,  99, 200,  30,  79,  36, 229, 247, 201,
+ 97, 141,  47,  63, 179, 101, 127, 112, 175, 154, 234, 245,  91, 152, 144, 177,
+135, 113, 114, 237,  55,  69, 104, 163, 227, 239,  92, 197,  80, 193, 214, 202,
+ 90,  98,  95,  38,   9,  93,  20,  65, 232, 157, 206,  64, 253,   8,  23,  74,
+ 15, 199, 180,  62,  18, 252,  37,  75, 129,  44,   4, 120, 203, 187,  32, 189,
+249,  41, 153, 168, 211,  96, 223,  17, 151, 137, 126, 250, 224, 155,  31, 210,
+103, 226, 100, 119, 132,  43, 158, 138, 241, 109, 136, 121, 116,  87, 221, 230,
+ 57, 123, 238, 131, 225,  88, 242,  13,  52, 248,  48, 233, 185,  35,  84,  21,
+ 68,  11,  77, 102,  58,   3, 162, 145, 148,  82,  76, 195, 130, 231, 128, 192,
+182,  14, 194, 108, 147, 236, 171,  67, 149, 246, 216,  70, 134,   5, 140, 176,
+117,   0, 204, 133, 215,  61, 115, 122,  72, 228, 209,  89, 173, 184, 198, 208,
+220, 161, 170,   2,  29, 191, 181, 159,  81, 196, 165,  16,  34, 207,   1, 186,
+143,  49, 124, 174, 150, 218, 240,  86,  71, 212, 235,  78, 217,  19, 142,  73,
+ 85,  22, 255,  59, 244, 164, 178,   6, 160, 167, 251,  27, 110,  60,  51, 205,
+ 24,  94, 106, 213, 166,  33, 222, 254,  42,  28, 243,  10,  26,  25,  39,  45,
+};
+
+const word64 SHARK::Enc::cbox[8][256] = {
+/* box 0 */
+W64LIT(0x060d838f16f3a365),
+W64LIT(0xa68857ee5cae56f6),
+W64LIT(0xebf516353c2c4d89),
+W64LIT(0x652174be88e85bdc),
+W64LIT(0x0d4e9a8086c17921),
+W64LIT(0x27ba7d33cffa58a1),
+W64LIT(0x88d9e104a237b530),
+W64LIT(0x693b8755a4fbe816),
+W64LIT(0xdac9591826b254a0),
+W64LIT(0x45c2e369fb336af3),
+W64LIT(0xa96e1fb87b3e4ef4),
+W64LIT(0xb7578f1435eb7ef0),
+W64LIT(0x839af80b32056f74),
+W64LIT(0xae37f55cc71f277a),
+W64LIT(0xa4208538fdff37d5),
+W64LIT(0x35991e74ad3cdb6f),
+W64LIT(0xba191594b32a07d1),
+W64LIT(0x5344d1772e572b7b),
+W64LIT(0xe7efe5de103ffe43),
+W64LIT(0xa3796fdc41de5e5b),
+W64LIT(0x2cf9643c5fc882e5),
+W64LIT(0xffdbf6fd48196d22),
+W64LIT(0x33949dfbbbcf780a),
+W64LIT(0x7d15679dd0cec8bd),
+W64LIT(0x5f5e229c024498b1),
+W64LIT(0x1223634762c683ce),
+W64LIT(0xdcc4da973041f7c5),
+W64LIT(0x0b43190f9032da44),
+W64LIT(0xc05598eddfc5a6e2),
+W64LIT(0x9e5fd31a7753f4b8),
+W64LIT(0x9afa8243c0f136fe),
+W64LIT(0xcc4f6b06f3d61528),
+W64LIT(0xdf38612a3bc25c0d),
+W64LIT(0x43cf60e6edc0c996),
+W64LIT(0xcfb3d0bbf855bee0),
+W64LIT(0x96e071a8ece28534),
+W64LIT(0x21b7febcd909fbc4),
+W64LIT(0x8ed4628bb4c41655),
+W64LIT(0x30682646b04cd3c2),
+W64LIT(0xb5ff5dc294ba1fd3),
+W64LIT(0x75aac52f4b7fb931),
+W64LIT(0xe809ad8837afe641),
+W64LIT(0x0eb2213d8d42d2e9),
+W64LIT(0x9852509561a057dd),
+W64LIT(0xaa92a40570bde53c),
+W64LIT(0x7b18e412c63d6bd8),
+W64LIT(0xa7dc3e85f67c9c1d),
+W64LIT(0xd8618bce87e33583),
+W64LIT(0xe34ab487a79d3c05),
+W64LIT(0x20e397d773db312f),
+W64LIT(0x05f138321d7008ad),
+W64LIT(0x17d25b757fb68b63),
+W64LIT(0x8a7133d20366d413),
+W64LIT(0x0000000000000000),
+W64LIT(0xeaa17f5e96fe8762),
+W64LIT(0xc101f18675176c09),
+W64LIT(0xbebc44cd0488c597),
+W64LIT(0xdb9d30738c609e4b),
+W64LIT(0xabc6cd6eda6f2fd7),
+W64LIT(0x5aaf1aae1f34901c),
+W64LIT(0xb00e65f089ca177e),
+W64LIT(0xd47b7825abf08649),
+W64LIT(0x924520f15b404772),
+W64LIT(0x1686321ed5644188),
+W64LIT(0x618425e73f4a999a),
+W64LIT(0xe21eddec0d4ff6ee),
+W64LIT(0xd787c398a0732d81),
+W64LIT(0x1f6df9c7e407faef),
+W64LIT(0x79b036c4676c0afb),
+W64LIT(0x0fe6485627901802),
+W64LIT(0x9cf701ccd602959b),
+W64LIT(0xbfe82da6ae5a0f7c),
+W64LIT(0x990639fecb729d36),
+W64LIT(0xca42e889e525b64d),
+W64LIT(0xb3f2de4d8249bcb6),
+W64LIT(0x4033db5be643625e),
+W64LIT(0x4167b2304c91a8b5),
+W64LIT(0x108bb191c397e2ed),
+W64LIT(0x1834132358269361),
+W64LIT(0x541d3b93927642f5),
+W64LIT(0x90edf227fa112651),
+W64LIT(0x1dc52b1145569bcc),
+W64LIT(0xe6bb8cb5baed34a8),
+W64LIT(0xd276fbaabd03252c),
+W64LIT(0x313c4f2d1a9e1929),
+W64LIT(0xfd73242be9480c01),
+W64LIT(0x9baeeb286a23fc15),
+W64LIT(0xc9be5334eea61d85),
+W64LIT(0xc70c720963e4cf6c),
+W64LIT(0x3eda077b3d0e012b),
+W64LIT(0x97b418c346304fdf),
+W64LIT(0x32c0f490111db2e1),
+W64LIT(0x2ba08ed8e3e9eb6b),
+W64LIT(0x8b255ab9a9b41ef8),
+W64LIT(0x91b99b4c50c3ecba),
+W64LIT(0xfe8f9f96e2cba7c9),
+W64LIT(0x3a7f56228aacc36d),
+W64LIT(0xb15a0c9b2318dd95),
+W64LIT(0x5953a11314b73bd4),
+W64LIT(0xf3c10516640adee8),
+W64LIT(0xedf895ba2adfeeec),
+W64LIT(0xadcb4ee1cc9c8cb2),
+W64LIT(0xde6c0841911096e6),
+W64LIT(0x84c312ef8e2406fa),
+W64LIT(0xa83a76d3d1ec841f),
+W64LIT(0x1c91427aef845127),
+W64LIT(0x3665a5c9a6bf70a7),
+W64LIT(0xf6303d24797ad645),
+W64LIT(0xcd1b026d5904dfc3),
+W64LIT(0x1bc8a89e53a538a9),
+W64LIT(0x7ee9dc20db4d6375),
+W64LIT(0x51ec03a18f064a58),
+W64LIT(0xc4f0c9b4686764a4),
+W64LIT(0xdd90b3fc9a933d2e),
+W64LIT(0x7a4c8d796cefa133),
+W64LIT(0x73a746a05d8c1a54),
+W64LIT(0x0759eae4bc21698e),
+W64LIT(0xc8ea3a5f4474d76e),
+W64LIT(0x38d784f42bfda24e),
+W64LIT(0x231f2c6a78589ae7),
+W64LIT(0xc3a92350d4460d2a),
+W64LIT(0x72f32fcbf75ed0bf),
+W64LIT(0xbd40ff700f0b6e5f),
+W64LIT(0x157a89a3dee7ea40),
+W64LIT(0x873fa95285a7ad32),
+W64LIT(0x4d7d41db60821b7f),
+W64LIT(0x1e3990ac4ed53004),
+W64LIT(0x0a1770643ae010af),
+W64LIT(0x9311499af1928d99),
+W64LIT(0x64751dd5223a9137),
+W64LIT(0xfa2acecf5569658f),
+W64LIT(0x7c410ef67a1c0256),
+W64LIT(0x56b5e945332723d6),
+W64LIT(0x6f3604dab2084b73),
+W64LIT(0xe95dc4e39d7d2caa),
+W64LIT(0x13770a2cc8144925),
+W64LIT(0xbc14961ba5d9a4b4),
+W64LIT(0xb9e5ae29b8a9ac19),
+W64LIT(0xf169d7c0c55bbfcb),
+W64LIT(0x2446c68ec479f369),
+W64LIT(0x806643b63986c4bc),
+W64LIT(0x7fbdb54b719fa99e),
+W64LIT(0x04a55159b7a2c246),
+W64LIT(0xee042e07215c4524),
+W64LIT(0x5bfb73c5b5e65af7),
+W64LIT(0x0c1af3eb2c13b3ca),
+W64LIT(0xa22d06b7eb0c94b0),
+W64LIT(0xb8b1c742127b66f2),
+W64LIT(0x285c3565e86a40a3),
+W64LIT(0x3b2b3f49207e0986),
+W64LIT(0x3c72d5ad9c5f6008),
+W64LIT(0x770217f9ea2ed812),
+W64LIT(0xfc274d40439ac6ea),
+W64LIT(0x4fd5930dc1d37a5c),
+W64LIT(0x2e51b6eafe99e3c6),
+W64LIT(0x6b93558305aa8935),
+W64LIT(0x19607a48f2f4598a),
+W64LIT(0x08bfa2b29bb1718c),
+W64LIT(0x3f8e6e1097dccbc0),
+W64LIT(0x3983ed9f812f68a5),
+W64LIT(0xac9f278a664e4659),
+W64LIT(0x82ce916098d7a59f),
+W64LIT(0xc2fd4a3b7e94c7c1),
+W64LIT(0x66ddcf03836bf014),
+W64LIT(0xe1e2665106cc5d26),
+W64LIT(0x74feac44e1ad73da),
+W64LIT(0x8d28d936bf47bd9d),
+W64LIT(0x62789e5a34c93252),
+W64LIT(0x81322add93540e57),
+W64LIT(0xcb1681e24ff77ca6),
+W64LIT(0x2512afe56eab3982),
+W64LIT(0xd18a4017b6808ee4),
+W64LIT(0x705bfd1d560fb19c),
+W64LIT(0x4b70c2547671b81a),
+W64LIT(0x49d81082d720d939),
+W64LIT(0xe0b60f3aac1e97cd),
+W64LIT(0x4e81fa666b01b0b7),
+W64LIT(0x951cca15e7612efc),
+W64LIT(0x463e58d4f0b0c13b),
+W64LIT(0x632cf7319e1bf8b9),
+W64LIT(0x5ca2992109c73379),
+W64LIT(0xf764544fd3a81cae),
+W64LIT(0x6ac73ce8af7843de),
+W64LIT(0x9f0bba71dd813e53),
+W64LIT(0x85977b8424f6cc11),
+W64LIT(0x5807c878be65f13f),
+W64LIT(0x686fee3e0e2922fd),
+W64LIT(0x78e45fafcdbec010),
+W64LIT(0x6ccabf67b98be0bb),
+W64LIT(0x11dfd8fa69452806),
+W64LIT(0xcee7b9d05287740b),
+W64LIT(0x50b86aca25d480b3),
+W64LIT(0x5df6f04aa315f992),
+W64LIT(0x5e0a4bf7a896525a),
+W64LIT(0x03fcbbbd0b83abc8),
+W64LIT(0x8f800be01e16dcbe),
+W64LIT(0xd32292c117d1efc7),
+W64LIT(0xe5473708b16e9f60),
+W64LIT(0x224b4501d28a500c),
+W64LIT(0xfb7ea7a4ffbbaf64),
+W64LIT(0x3d26bcc6368daae3),
+W64LIT(0x866bc0392f7567d9),
+W64LIT(0x3731cca20c6dba4c),
+W64LIT(0xb603e67f9f39b41b),
+W64LIT(0xa1d1bd0ae08f3f78),
+W64LIT(0xd935e2a52d31ff68),
+W64LIT(0xaf639c376dcded91),
+W64LIT(0x0154696baad2caeb),
+W64LIT(0xecacfcd1800d2407),
+W64LIT(0xf03dbeab6f897520),
+W64LIT(0x02a8d2d6a1516123),
+W64LIT(0xf498eff2d82bb766),
+W64LIT(0x710f9476fcdd7b77),
+W64LIT(0xf8821c19f43804ac),
+W64LIT(0xf9d675725eeace47),
+W64LIT(0x1a9cc1f5f977f242),
+W64LIT(0x5210b81c8485e190),
+W64LIT(0x6d9ed60c13592a50),
+W64LIT(0xf2956c7dced81403),
+W64LIT(0xbb4d7cff19f8cd3a),
+W64LIT(0x4c2928b0ca50d194),
+W64LIT(0x6e626db118da8198),
+W64LIT(0xe4135e631bbc558b),
+W64LIT(0x9da368a77cd05f70),
+W64LIT(0xa574ec53572dfd3e),
+W64LIT(0x09ebcbd93163bb67),
+W64LIT(0x4a24ab3fdca372f1),
+W64LIT(0x429b098d4712037d),
+W64LIT(0x57e1802e99f5e93d),
+W64LIT(0xef50476c8b8e8fcf),
+W64LIT(0xa085d4614a5df593),
+W64LIT(0x34cd771f07ee1184),
+W64LIT(0xc6581b62c9360587),
+W64LIT(0x2dad0d57f51a480e),
+W64LIT(0x898d886f08e57fdb),
+W64LIT(0xd6d3aaf30aa1e76a),
+W64LIT(0x76567e9240fc12f9),
+W64LIT(0xb4ab34a93e68d538),
+W64LIT(0xb2a6b726289b765d),
+W64LIT(0x8c7cb05d15957776),
+W64LIT(0x554952f838a4881e),
+W64LIT(0xd52f114e01224ca2),
+W64LIT(0x60d04c8c95985371),
+W64LIT(0x6789a66829b93aff),
+W64LIT(0x2f05df81544b292d),
+W64LIT(0x476a31bf5a620bd0),
+W64LIT(0xf5cc869972f97d8d),
+W64LIT(0x488c79e97df213d2),
+W64LIT(0x44968a0251e1a018),
+W64LIT(0x26ee14586528924a),
+W64LIT(0xd0de297c1c52440f),
+W64LIT(0xc5a4a0dfc2b5ae4f),
+W64LIT(0x29085c0e42b88a48),
+W64LIT(0x142ee0c8743520ab),
+W64LIT(0x2af4e7b3493b2180),
+W64LIT(0x9448a37e4db3e417),
+/* box 1 */
+W64LIT(0xe2795ba105ba30ce),
+W64LIT(0x65b5d634f5e0fbdd),
+W64LIT(0x2d7d7f1464dd8c55),
+W64LIT(0xeefbf778add1c20b),
+W64LIT(0x1eb0fbd1f11968e7),
+W64LIT(0xe6073f45ce30cd8d),
+W64LIT(0x21ffd3cdccb67e90),
+W64LIT(0xdf0941cfa750a262),
+W64LIT(0xc61df5b1b75ef18a),
+W64LIT(0xc5c7defa9dc337c6),
+W64LIT(0x2581b729073c83d3),
+W64LIT(0xa5e97513167173cf),
+W64LIT(0xdd3673bd381526b9),
+W64LIT(0xe8baa1eef91ebb93),
+W64LIT(0x3b314cf8f625eb34),
+W64LIT(0x579d4bc8d5fc5df8),
+W64LIT(0xbb598ec2e7681b28),
+W64LIT(0xc8a06b1a80708794),
+W64LIT(0x1c8fc9a36e5cec3c),
+W64LIT(0xf60a5a3f0807d374),
+W64LIT(0x1ace9f353a9395a4),
+W64LIT(0x7e9e50387aab2cee),
+W64LIT(0xb5e41069d0466d36),
+W64LIT(0x8cea6ee3b92602d9),
+W64LIT(0xf952ddad8af1e7fd),
+W64LIT(0xb19a748d1bcc9075),
+W64LIT(0x2464ae10b2e4c144),
+W64LIT(0xfcc9a070f4a35829),
+W64LIT(0xfa88f6e6a06c21b1),
+W64LIT(0x2c98662dd105cec2),
+W64LIT(0x9065a740d77aeee5),
+W64LIT(0xcb7a4051aaed41d8),
+W64LIT(0x55a279ba4ab9d923),
+W64LIT(0x27be855b98790708),
+W64LIT(0xbabc97fb52b059bf),
+W64LIT(0xa19711f7ddfb8e8c),
+W64LIT(0x047e64e4cb8afd43),
+W64LIT(0xc386886cc90c4e5e),
+W64LIT(0xc422c7c3281b7551),
+W64LIT(0xfb6defdf15b46326),
+W64LIT(0x01e51939b5d84297),
+W64LIT(0x5cbba8be9c809432),
+W64LIT(0x6f762c7b09447080),
+W64LIT(0xcee13d8cd4bffe0c),
+W64LIT(0x54476083ff619bb4),
+W64LIT(0x6e933542bc9c3217),
+W64LIT(0x4af79b520e78f353),
+W64LIT(0x98996f7db49be163),
+W64LIT(0xa07208ce6823cc1b),
+W64LIT(0x2b3c29823012f5cd),
+W64LIT(0x93bf8c0bfde728a9),
+W64LIT(0x2225f886e62bb8dc),
+W64LIT(0x7f7b4901cf736e79),
+W64LIT(0x0000000000000000),
+W64LIT(0x023f32729f4584db),
+W64LIT(0xd5cabb805bf4293f),
+W64LIT(0x07a44fafe1173b0f),
+W64LIT(0xe95fb8d74cc6f904),
+W64LIT(0x7b052de504f9933a),
+W64LIT(0x6aed51a67716cf54),
+W64LIT(0x68d263d4e8534b8f),
+W64LIT(0xa96bd9cabe1a810a),
+W64LIT(0x1d6ad09adb84aeab),
+W64LIT(0x0d67b5e01db3b052),
+W64LIT(0x52063615abaee22c),
+W64LIT(0x8f3045a893bbc495),
+W64LIT(0xd8ad0e604647996d),
+W64LIT(0xaf2a8f5cead5f892),
+W64LIT(0x3017af8ebf5922fe),
+W64LIT(0x4034611df2dc780e),
+W64LIT(0x721cfce1d2c0de2b),
+W64LIT(0x28e602c91a8f3381),
+W64LIT(0xe1a370ea2f27f682),
+W64LIT(0x29031bf0af577116),
+W64LIT(0x1914b47e100e53e8),
+W64LIT(0x567852f160241f6f),
+W64LIT(0x793a1f979bbc17e1),
+W64LIT(0xef1eee411809809c),
+W64LIT(0x6211999b14f7c0d2),
+W64LIT(0x059b7ddd7e52bfd4),
+W64LIT(0x43ee4a56d841be42),
+W64LIT(0xf1ae1590e910e87b),
+W64LIT(0x33cd84c595c4e4b2),
+W64LIT(0x4b12826bbba0b1c4),
+W64LIT(0xeb608aa5d3837ddf),
+W64LIT(0x201acaf4796e3c07),
+W64LIT(0xbf27ea262ce2e66b),
+W64LIT(0x58c5cc5a570a6971),
+W64LIT(0x37b3e0215e4e19f1),
+W64LIT(0xab54ebb8215f05d1),
+W64LIT(0x8ed55c9126638602),
+W64LIT(0x9aa65d0f2bde65b8),
+W64LIT(0xd7f589f2c4b1ade4),
+W64LIT(0x5039046734eb66f7),
+W64LIT(0x6cac073023d9b6cc),
+W64LIT(0x51dc1d5e81332460),
+W64LIT(0x17a92ad5272025f6),
+W64LIT(0x47902eb213cb4301),
+W64LIT(0x1b2b860c8f4bd733),
+W64LIT(0x4f6ce68f702a4c87),
+W64LIT(0xcf0424b56167bc9b),
+W64LIT(0x997c76440143a3f4),
+W64LIT(0x7ae034dcb121d1ad),
+W64LIT(0x100d657ac6371ef9),
+W64LIT(0x0ac3fa4ffca48b5d),
+W64LIT(0xdeec58f61288e0f5),
+W64LIT(0x265b9c622da1459f),
+W64LIT(0xdcd36a848dcd642e),
+W64LIT(0xe4380d3751754956),
+W64LIT(0x13d74e31ecaad8b5),
+W64LIT(0xfd2cb949417b1abe),
+W64LIT(0x9624f1d683b5977d),
+W64LIT(0x4675378ba6130196),
+W64LIT(0x0b26e376497cc9ca),
+W64LIT(0x41d1782447043a99),
+W64LIT(0xe39c4298b0627259),
+W64LIT(0xcd3b16c7fe223840),
+W64LIT(0x7787813cac9261ff),
+W64LIT(0x492db01924e5351f),
+W64LIT(0x5afafe28c84fedaa),
+W64LIT(0x8b4e214c583139d6),
+W64LIT(0xccde0ffe4bfa7ad7),
+W64LIT(0x76629805194a2368),
+W64LIT(0x7ca1624ae5eea835),
+W64LIT(0x61cbb2d03e6a069e),
+W64LIT(0x48c8a920913d7788),
+W64LIT(0x8068c23a114df01c),
+W64LIT(0xd38bed160f3b50a7),
+W64LIT(0x32289dfc201ca625),
+W64LIT(0xc1b9ba1e5649ca85),
+W64LIT(0xed21dc33874c0447),
+W64LIT(0xa3a8238542be0a57),
+W64LIT(0x5b1fe7117d97af3d),
+W64LIT(0x3d701a6ea2ea92ac),
+W64LIT(0x73f9e5d867189cbc),
+W64LIT(0x9ed839ebe05498fb),
+W64LIT(0x5920d563e2d22be6),
+W64LIT(0xca9f59681f35034f),
+W64LIT(0x11e87c4373ef5c6e),
+W64LIT(0x97c1e8ef366dd5ea),
+W64LIT(0xacf0a417c0483ede),
+W64LIT(0xd26ef42fbae31230),
+W64LIT(0xbcfdc16d067f2027),
+W64LIT(0xbec2f31f993aa4fc),
+W64LIT(0x45af1cc08c8ec7da),
+W64LIT(0x31f2b6b70a816069),
+W64LIT(0xd9481759f39fdbfa),
+W64LIT(0xe5dd140ee4ad0bc1),
+W64LIT(0xa6335e583cecb583),
+W64LIT(0x38eb67b3dcb82d78),
+W64LIT(0xf5d07174229a1538),
+W64LIT(0x5f6183f5b61d527e),
+W64LIT(0x0f58879282f63489),
+W64LIT(0x164c33ec92f86761),
+W64LIT(0x444a05f93956854d),
+W64LIT(0x818ddb03a495b28b),
+W64LIT(0x4d53d4fdef6fc85c),
+W64LIT(0x8d0f77da0cfe404e),
+W64LIT(0x8416a6dedac70d5f),
+W64LIT(0x666ffd7fdf7d3d91),
+W64LIT(0xb63e3b22fadbab7a),
+W64LIT(0xf2743edbc38d2e37),
+W64LIT(0xa40c6c2aa3a93158),
+W64LIT(0x9f3d20d2558cda6c),
+W64LIT(0xfef692026be6dcf2),
+W64LIT(0x2ea7545f4e404a19),
+W64LIT(0xb2405fc631515639),
+W64LIT(0x23c0e1bf53f3fa4b),
+W64LIT(0x83b2e9713bd03650),
+W64LIT(0x0641569654cf7998),
+W64LIT(0xb883a589cdf5dd64),
+W64LIT(0x3ad455c143fda9a3),
+W64LIT(0x925a9532483f6a3e),
+W64LIT(0xaab1f28194874746),
+W64LIT(0xf435684d974257af),
+W64LIT(0xd1b4df64907ed47c),
+W64LIT(0x390e7e8a69606fef),
+W64LIT(0xd051c65d25a696eb),
+W64LIT(0xb4010950659e2fa1),
+W64LIT(0x0c82acd9a86bf2c5),
+W64LIT(0x88940a0772acff9a),
+W64LIT(0xf39127e276556ca0),
+W64LIT(0xaecf96655f0dba05),
+W64LIT(0x03da2b4b2a9dc64c),
+W64LIT(0x3f4f281c3daf1677),
+W64LIT(0x3469cb6a74d3dfbd),
+W64LIT(0xf04b0ca95cc8aaec),
+W64LIT(0x1f55e2e844c12a70),
+W64LIT(0x4cb6cdc45ab78acb),
+W64LIT(0xc05ca327e3918812),
+W64LIT(0x95feda9da9285131),
+W64LIT(0xb966bcb0782d9ff3),
+W64LIT(0xa7d647618934f714),
+W64LIT(0xd61090cb7169ef73),
+W64LIT(0x71c6d7aaf85d1867),
+W64LIT(0xecc4c50a329446d0),
+W64LIT(0x6450cf0d4038b94a),
+W64LIT(0x420b536f6d99fcd5),
+W64LIT(0x75b8b34e33d7e524),
+W64LIT(0xc26391557cd40cc9),
+W64LIT(0xda923c12d9021db6),
+W64LIT(0x4e89ffb6c5f20e10),
+W64LIT(0x0919d104d6394d11),
+W64LIT(0x8aab3875ede97b41),
+W64LIT(0xa88ec0f30bc2c39d),
+W64LIT(0xb7db221b4f03e9ed),
+W64LIT(0xc7f8ec880286b31d),
+W64LIT(0x2f424d66fb98088e),
+W64LIT(0xe04669d39affb415),
+W64LIT(0x3eaa3125887754e0),
+W64LIT(0x5e849acc03c510e9),
+W64LIT(0x8257f0488e0874c7),
+W64LIT(0xbd18d854b3a762b0),
+W64LIT(0xb3a546ff848914ae),
+W64LIT(0x9ce70b997f111c20),
+W64LIT(0x3c9503571732d03b),
+W64LIT(0xe7e2267c7be88f1a),
+W64LIT(0x63f480a2a12f8245),
+W64LIT(0x602eabe98bb24409),
+W64LIT(0x941bc3a41cf013a6),
+W64LIT(0x678ae4466aa57f06),
+W64LIT(0x1232570859729a22),
+W64LIT(0x6d491e099601f45b),
+W64LIT(0x5d5eb1872958d6a5),
+W64LIT(0x1473019e0dbde3ba),
+W64LIT(0xa24d3abcf76648c0),
+W64LIT(0x85f3bfe76f1f4fc8),
+W64LIT(0x08fcc83d63e10f86),
+W64LIT(0x745daa77860fa7b3),
+W64LIT(0x9180be7962a2ac72),
+W64LIT(0x87cc8d95f05acb13),
+W64LIT(0x78df06ae2e645576),
+W64LIT(0x18f1ad47a5d6117f),
+W64LIT(0x358cd253c10b9d2a),
+W64LIT(0x0ebd9eab372e761e),
+W64LIT(0xf7ef4306bddf91e3),
+W64LIT(0x7023ce934d855af0),
+W64LIT(0xd42fa2b9ee2c6ba8),
+W64LIT(0x3656f918eb965b66),
+W64LIT(0x9d0212a0cac95eb7),
+W64LIT(0x2ad930bb85cab75a),
+W64LIT(0x862994ac45828984),
+W64LIT(0x7d447b735036eaa2),
+W64LIT(0xb07f6db4ae14d2e2),
+W64LIT(0x6b08489fc2ce8dc3),
+W64LIT(0x9b4344369e06272f),
+W64LIT(0xad15bd2e75907c49),
+W64LIT(0xdb77252b6cda5f21),
+W64LIT(0xea85939c665b3f48),
+W64LIT(0xc945722335a8c503),
+W64LIT(0x159618a7b865a12d),
+W64LIT(0x69377aed5d8b0918),
+W64LIT(0x8971133ec774bd0d),
+W64LIT(0x53e32f2c1e76a0bb),
+W64LIT(0xf8b7c4943f29a56a),
+W64LIT(0xff138b3bde3e9e65),
+/* box 2 */
+W64LIT(0x7c6a2eb5fdabecc6),
+W64LIT(0x401cda0a752bbea0),
+W64LIT(0x1925217156dc57c4),
+W64LIT(0x56dec6d301d70787),
+W64LIT(0x41c751ff73c6ac58),
+W64LIT(0xc9067697a92cb5f9),
+W64LIT(0x3391c917aaa0bc85),
+W64LIT(0xae0a9a4c0e742afe),
+W64LIT(0xaa8ca972162a62f4),
+W64LIT(0x5aa193912935df99),
+W64LIT(0x86fd9135fe27e5ba),
+W64LIT(0xffca074b1d3f538e),
+W64LIT(0x0e3cb65d24cdfc1b),
+W64LIT(0x4384b2e07fe9885d),
+W64LIT(0xc73ac0ca8de149e2),
+W64LIT(0x48e5bc7645972eb4),
+W64LIT(0xbe0d56b46ef9ffd6),
+W64LIT(0x200e6d05c0ef5f50),
+W64LIT(0xe1f17dee597f7abd),
+W64LIT(0x0243e31f0c2f2405),
+W64LIT(0xf4ab09dd2741f567),
+W64LIT(0xe4acc52547cc204f),
+W64LIT(0x348f92c3b83cc272),
+W64LIT(0x53837e181f645d75),
+W64LIT(0xd8da319acf4c7229),
+W64LIT(0x81e3cae1ecbb9b4d),
+W64LIT(0xd6e687c7eb818e32),
+W64LIT(0x3dad7f4a8e6d409e),
+W64LIT(0x28f70b79f053cf44),
+W64LIT(0x493e3783437a3c4c),
+W64LIT(0xb27203f6461b27c8),
+W64LIT(0xd02357e6fff0e23d),
+W64LIT(0xe8d390676f2ef851),
+W64LIT(0x26cbbd24d49e335f),
+W64LIT(0xee1640467b5f945e),
+W64LIT(0x4aa65f6949b80ab1),
+W64LIT(0xb56c58225487593f),
+W64LIT(0x4ffbe7a2570b5043),
+W64LIT(0x0aba85633c93b411),
+W64LIT(0x78ec1d8be5f5a4cc),
+W64LIT(0x501b16f215a66b88),
+W64LIT(0x271036d1d27321a7),
+W64LIT(0x7ff2465ff769da3b),
+W64LIT(0x35541936bed1d08a),
+W64LIT(0xb8c886957a8893d9),
+W64LIT(0x2fe950ade2cfb1b3),
+W64LIT(0xf90fd76a094e3f81),
+W64LIT(0x2daab3b2eee095b6),
+W64LIT(0x1abd499b5c1e6139),
+W64LIT(0x0c7f554228e2d81e),
+W64LIT(0x425f391579049aa5),
+W64LIT(0xc3bcf3f495bf01e8),
+W64LIT(0xb4b7d3d7526a4bc7),
+W64LIT(0x0000000000000000),
+W64LIT(0xa0362c112ab9d6e5),
+W64LIT(0x91e406198c364e65),
+W64LIT(0x454162c16b98e452),
+W64LIT(0x139fa4126a4fe3d5),
+W64LIT(0x01db8bf506ed12f8),
+W64LIT(0x9a85088fb648e88c),
+W64LIT(0x3ab3249e9cf13e69),
+W64LIT(0xd57eef2de143b8cf),
+W64LIT(0xb1ea6b1c4cd91135),
+W64LIT(0x7aaffe94e9da80c9),
+W64LIT(0xad92f2a604b61c03),
+W64LIT(0xa3ae44fb207be018),
+W64LIT(0xeb4bf88d65ecceac),
+W64LIT(0xc0249b1e9f7d3715),
+W64LIT(0xa8cf4a6d1a0546f1),
+W64LIT(0xc6e14b3f8b0c5b1a),
+W64LIT(0xce182d43bbb0cb0e),
+W64LIT(0xfc526fa117fd6573),
+W64LIT(0x8c471456c2b451ab),
+W64LIT(0xac497953025b0efb),
+W64LIT(0x0486333e185e480a),
+W64LIT(0x18feaa845031453c),
+W64LIT(0xa1eda7e42c54c41d),
+W64LIT(0x06c5d02114716c0f),
+W64LIT(0x055db8cb1eb35af2),
+W64LIT(0xe5774ed0412132b7),
+W64LIT(0x36cc71dcb413e677),
+W64LIT(0x470281de67b7c057),
+W64LIT(0x58e2708e251afb9c),
+W64LIT(0xa914c1981ce85409),
+W64LIT(0xb3a9880340f63530),
+W64LIT(0x638adfe5bf06d70d),
+W64LIT(0x0b610e963a7ea6e9),
+W64LIT(0x927c6ef386f47898),
+W64LIT(0xed8e28ac719da2a3),
+W64LIT(0x7548c33ccbfa6e2a),
+W64LIT(0xf3b5520935dd8b90),
+W64LIT(0x8d9c9fa3c4594353),
+W64LIT(0x31d22a08a68f9880),
+W64LIT(0x0da4deb72e0fcae6),
+W64LIT(0x8fdf7cbcc8766756),
+W64LIT(0x5dbfc8453ba9a16e),
+W64LIT(0x8e04f749ce9b75ae),
+W64LIT(0x83a029fee094bf48),
+W64LIT(0xa4b01f2f32e79eef),
+W64LIT(0x1c7899ba486f0d36),
+W64LIT(0x654f0fc4ab77bb02),
+W64LIT(0x7db1a540fb46fe3e),
+W64LIT(0x51c09d07134b7970),
+W64LIT(0xcb459588a50391fc),
+W64LIT(0x3fee9c558242649b),
+W64LIT(0xfe118cbe1bd24176),
+W64LIT(0x76d0abd6c13858d7),
+W64LIT(0x5e27a0af316b9793),
+W64LIT(0x69305a868395631c),
+W64LIT(0x3b68af6b9a1c2c91),
+W64LIT(0x6db669b89bcb2b16),
+W64LIT(0xa72877c53825a812),
+W64LIT(0xd3bb3f0cf532d4c0),
+W64LIT(0x6ff58aa797e40f13),
+W64LIT(0x96fa5dcd9eaa3092),
+W64LIT(0x2c713847e80d874e),
+W64LIT(0xc57923d581ce6de7),
+W64LIT(0x2b6f6393fa91f9b9),
+W64LIT(0x0922ed89365182ec),
+W64LIT(0x324a42e2ac4dae7d),
+W64LIT(0x16c21cd974fcb927),
+W64LIT(0x956235279468066f),
+W64LIT(0x7b747561ef379231),
+W64LIT(0x449ae9346d75f6aa),
+W64LIT(0xf570822821ace79f),
+W64LIT(0x5939fb7b23f7e964),
+W64LIT(0x7937967ee318b634),
+W64LIT(0x84be722af208c1bf),
+W64LIT(0x08f9667c30bc9014),
+W64LIT(0xefcdcbb37db286a6),
+W64LIT(0xa6f3fc303ec8baea),
+W64LIT(0xea9073786301dc54),
+W64LIT(0x62515410b9ebc5f5),
+W64LIT(0xd260b4f9f3dfc638),
+W64LIT(0x9e033bb1ae16a086),
+W64LIT(0x38f0c78190de1a6c),
+W64LIT(0xc267780193521310),
+W64LIT(0x80384114ea5689b5),
+W64LIT(0x9b5e837ab0a5fa74),
+W64LIT(0xf73361372d83c39a),
+W64LIT(0x3009a1fda0628a78),
+W64LIT(0xd4a564d8e7aeaa37),
+W64LIT(0xfb4c347505611b84),
+W64LIT(0x5b7a18642fd8cd61),
+W64LIT(0x239605efca2d69ad),
+W64LIT(0xf8d45c9f0fa32d79),
+W64LIT(0xbb50ee7f704aa524),
+W64LIT(0x392b4c7496330894),
+W64LIT(0x0fe73da82220eee3),
+W64LIT(0x3717fa29b2fef48f),
+W64LIT(0xf26ed9fc33309968),
+W64LIT(0xd73d0c32ed6c9cca),
+W64LIT(0xda99d285c363562c),
+W64LIT(0xde1fe1bbdb3d1e26),
+W64LIT(0x738d131ddf8b0225),
+W64LIT(0x292c808cf6beddbc),
+W64LIT(0xbc4eb5ab62d6dbd3),
+W64LIT(0x039868ea0ac236fd),
+W64LIT(0xcc5bce5cb79fef0b),
+W64LIT(0xb031e0e94a3403cd),
+W64LIT(0xc4a2a82087237f1f),
+W64LIT(0xb72fbb3d58a87d3a),
+W64LIT(0xafd111b908993806),
+W64LIT(0x68ebd173857871e4),
+W64LIT(0x9d9b535ba4d4967b),
+W64LIT(0xe9081b9269c3eaa9),
+W64LIT(0x71cef002d3a42620),
+W64LIT(0x93a7e50680196a60),
+W64LIT(0x891aac9ddc070b59),
+W64LIT(0x155a74337e3e8fda),
+W64LIT(0x4e206c5751e642bb),
+W64LIT(0x9721d6389847226a),
+W64LIT(0x12442fe76ca2f12d),
+W64LIT(0x2553d5cede5c05a2),
+W64LIT(0xa275cf0e2696f2e0),
+W64LIT(0x24885e3bd8b1175a),
+W64LIT(0x670cecdba7589f07),
+W64LIT(0x749348c9cd177cd2),
+W64LIT(0x64948431ad9aa9fa),
+W64LIT(0x2ab4e866fc7ceb41),
+W64LIT(0xe6ef263a4be3044a),
+W64LIT(0xe734adcf4d0e16b2),
+W64LIT(0x903f8dec8adb5c9d),
+W64LIT(0xf02d3ae33f1fbd6d),
+W64LIT(0x725698e8d96610dd),
+W64LIT(0x1da3124f4e821fce),
+W64LIT(0x1719972c7211abdf),
+W64LIT(0x11dc470d6660c7d0),
+W64LIT(0xec55a3597770b05b),
+W64LIT(0xbfd6dd416814ed2e),
+W64LIT(0x57054d26073a157f),
+W64LIT(0x1e3b7aa544402933),
+W64LIT(0x5ffc2b5a3786856b),
+W64LIT(0x61c93cfab329f308),
+W64LIT(0x3e3517a084af7663),
+W64LIT(0xf6e8eac22b6ed162),
+W64LIT(0x1007ccf8608dd528),
+W64LIT(0x66d7672ea1b58dff),
+W64LIT(0x8b594f82d0282f5c),
+W64LIT(0x1fe0f15042ad3bcb),
+W64LIT(0x4b7dd49c4f551849),
+W64LIT(0x4c638f485dc966be),
+W64LIT(0xcfc3a6b6bd5dd9f6),
+W64LIT(0x46d90a2b615ad2af),
+W64LIT(0x8565f9dff4e5d347),
+W64LIT(0x94b9bed292851497),
+W64LIT(0xfa97bf80038c097c),
+W64LIT(0xb9130d607c658121),
+W64LIT(0xdc5c02a4d7123a23),
+W64LIT(0x224d8e1accc07b55),
+W64LIT(0x87261ac0f8caf742),
+W64LIT(0xd901ba6fc9a160d1),
+W64LIT(0xab57228710c7700c),
+W64LIT(0x21d5e6f0c6024da8),
+W64LIT(0x98c6eb90ba67cc89),
+W64LIT(0x827ba20be679adb0),
+W64LIT(0x991d6065bc8ade71),
+W64LIT(0x5546ae390b15317a),
+W64LIT(0xa56b94da340a8c17),
+W64LIT(0x071e5bd4129c7ef7),
+W64LIT(0xe02af61b5f926845),
+W64LIT(0x6b73b9998fba4719),
+W64LIT(0xdfc46a4eddd00cde),
+W64LIT(0x770b2023c7d54a2f),
+W64LIT(0x7e29cdaaf184c8c3),
+W64LIT(0xba8b658a76a7b7dc),
+W64LIT(0x9c40d8aea2398483),
+W64LIT(0x9fd8b044a8fbb27e),
+W64LIT(0xdb425970c58e44d4),
+W64LIT(0xe269150453bd4c40),
+W64LIT(0x3c76f4bf88805266),
+W64LIT(0xf1f6b11639f2af95),
+W64LIT(0x549d25cc0df82382),
+W64LIT(0x4db804bd5b247446),
+W64LIT(0x8a82c477d6c53da4),
+W64LIT(0x5258f5ed19894f8d),
+W64LIT(0x6e2e015291091deb),
+W64LIT(0xc1ff10eb999025ed),
+W64LIT(0xbd953e5e643bc92b),
+W64LIT(0xc8ddfd62afc1a701),
+W64LIT(0x5c6443b03d44b396),
+W64LIT(0x6c6de24d9d2639ee),
+W64LIT(0x1481ffc678d39d22),
+W64LIT(0xd1f8dc13f91df0c5),
+W64LIT(0xca9e1e7da3ee8304),
+W64LIT(0xdd878951d1ff28db),
+W64LIT(0x6012b70fb5c4e1f0),
+W64LIT(0x1b66c26e5af373c1),
+W64LIT(0xe3b29ef155505eb8),
+W64LIT(0x70157bf7d54934d8),
+W64LIT(0x2e32db58e422a34b),
+W64LIT(0x6aa8326c895755e1),
+W64LIT(0xb6f430c85e456fc2),
+W64LIT(0xfd89e4541110778b),
+W64LIT(0x88c12768daea19a1),
+W64LIT(0xcd8045a9b172fdf3),
+/* box 3 */
+W64LIT(0x99183e616655b742),
+W64LIT(0xb2872032a50d6860),
+W64LIT(0x0946f63b060528ef),
+W64LIT(0x36612b9a141ef07d),
+W64LIT(0x0634da84dd49579b),
+W64LIT(0xfc9c9e9b486c8a57),
+W64LIT(0xa63fe3c0744e6fd0),
+W64LIT(0xf1515758d8b46bf9),
+W64LIT(0x3e82559fcd5197ff),
+W64LIT(0x92e12d262bc40177),
+W64LIT(0xc3bb433a5a7752c5),
+W64LIT(0x21c3852a5183267a),
+W64LIT(0x39130725cf528f09),
+W64LIT(0x9ba7db1d2dc12998),
+W64LIT(0xc58f99be873e055e),
+W64LIT(0xd9d424498f32656c),
+W64LIT(0x27f75fae8cca71e1),
+W64LIT(0x59b91019a8fc3430),
+W64LIT(0xce768af9caafb36b),
+W64LIT(0x9d930199f0887e03),
+W64LIT(0x63b07a7ef3706a8e),
+W64LIT(0xb5167288a70e7096),
+W64LIT(0x40cc1a28e967d22e),
+W64LIT(0x4d01d3eb79bf3380),
+W64LIT(0x9e896cdb6456afb4),
+W64LIT(0x2548bad2c75eef3b),
+W64LIT(0xa79a6bfeab0420bd),
+W64LIT(0x9f2ce4e5bb1ce0d9),
+W64LIT(0x32ea146282c3393c),
+W64LIT(0x6d67defff7765a97),
+W64LIT(0x83775912b31080eb),
+W64LIT(0xf5da68a04e69a2b8),
+W64LIT(0x1196743498d4819c),
+W64LIT(0x0bf913474d91b635),
+W64LIT(0x43d6776a7db90399),
+W64LIT(0x444725d07fba1b6f),
+W64LIT(0x6584a0fa2e393d15),
+W64LIT(0x3f27dda1121bd892),
+W64LIT(0xf6c005e2dab7730f),
+W64LIT(0x56cb3ca673b04b44),
+W64LIT(0x642128c4f1737278),
+W64LIT(0xbf4ae9f135d589ce),
+W64LIT(0xb038c54eee99f6ba),
+W64LIT(0xf47fe09e9123edd5),
+W64LIT(0x75b75cf069a7f3e4),
+W64LIT(0xd419ed8a1fea84c2),
+W64LIT(0x73838674b4eea47f),
+W64LIT(0x498aec13ef62fac1),
+W64LIT(0x20660d148ec96917),
+W64LIT(0xa48006bc3fdaf10a),
+W64LIT(0x2f1421ab55851663),
+W64LIT(0x0a5c9b7992dbf958),
+W64LIT(0xd1375a4c567d02ee),
+W64LIT(0x0000000000000000),
+W64LIT(0xc842507d17e6e4f0),
+W64LIT(0xf3eeb2249320f523),
+W64LIT(0xc9e7d843c8acab9d),
+W64LIT(0xff86f3d9dcb25be0),
+W64LIT(0xb4b3fab678443ffb),
+W64LIT(0xb19d4d7031d3b9d7),
+W64LIT(0x79df1d0d26355d27),
+W64LIT(0x8eba90d123c86145),
+W64LIT(0xaa57a23d3bdcc113),
+W64LIT(0xcb583d3f83383547),
+W64LIT(0xd871ac7750782a01),
+W64LIT(0xe162ab529f2aa508),
+W64LIT(0x38b68f1b1018c064),
+W64LIT(0x237c60561a17b8a0),
+W64LIT(0xa31154063dd9e9fc),
+W64LIT(0x713c6308ff7a3aa5),
+W64LIT(0x1a6f6773d54537a9),
+W64LIT(0x08e37e05d94f6782),
+W64LIT(0x357b46d880c021ca),
+W64LIT(0x6cc256c1283c15fa),
+W64LIT(0xcfd302c715e5fc06),
+W64LIT(0xbdf50c8d7e411714),
+W64LIT(0x7cf1aacb6fa2db0b),
+W64LIT(0x5240035ee56d8205),
+W64LIT(0x7b60f8716da1c3fd),
+W64LIT(0x01a5883edf4a4f6d),
+W64LIT(0xdd5f1bb119efac2d),
+W64LIT(0x5474d9da3824d59e),
+W64LIT(0x0f722cbfdb4c7f74),
+W64LIT(0x17a2aeb0459dd607),
+W64LIT(0x37c4a3a4cb54bf10),
+W64LIT(0xc21ecb04853d1da8),
+W64LIT(0x4273ff54a2f34cf4),
+W64LIT(0xdace490b1becb4db),
+W64LIT(0x6af68c45f5754261),
+W64LIT(0x46f8c0ac342e85b5),
+W64LIT(0x854383966e59d770),
+W64LIT(0x81c8bc6ef8841e31),
+W64LIT(0x3bace25984c611d3),
+W64LIT(0x1033fc0a479ecef1),
+W64LIT(0x1c5bbdf7080c6032),
+W64LIT(0x7412d4ceb6edbc89),
+W64LIT(0xa8e8474170485fc9),
+W64LIT(0xb8dbbb4b37d69138),
+W64LIT(0x079152ba020318f6),
+W64LIT(0x72260e4a6ba4eb12),
+W64LIT(0x905ec85a60509fad),
+W64LIT(0x2dabc4d71e1188b9),
+W64LIT(0xd092d27289374d83),
+W64LIT(0x610f9f02b8e4f454),
+W64LIT(0x02bfe57c4b949eda),
+W64LIT(0x95707f9c29c71981),
+W64LIT(0x6fd83b83bce2c44d),
+W64LIT(0x5d322fe13e21fd71),
+W64LIT(0x34decee65f8a6ea7),
+W64LIT(0xcd6ce7bb5e7162dc),
+W64LIT(0xfb0dcc214a6f92a1),
+W64LIT(0x2eb1a9958acf590e),
+W64LIT(0xdcfa938fc6a5e340),
+W64LIT(0x669ecdb8bae7eca2),
+W64LIT(0x151d4bcc0e0948dd),
+W64LIT(0xfd3916a59726c53a),
+W64LIT(0x581c982777b67b5d),
+W64LIT(0x1bcaef4d0a0f78c4),
+W64LIT(0xdfe0fecd527b32f7),
+W64LIT(0x128c19760c0a502b),
+W64LIT(0x84e60ba8b113981d),
+W64LIT(0x3c3db0e386c50925),
+W64LIT(0x7febc789fb7c0abc),
+W64LIT(0x7d5422f5b0e89466),
+W64LIT(0xd70380c88b345575),
+W64LIT(0xbbc1d609a308408f),
+W64LIT(0xe278c6100bf474bf),
+W64LIT(0x5e2842a3aaff2cc6),
+W64LIT(0x6b53047b2a3f0d0c),
+W64LIT(0xf7658ddc05fd3c62),
+W64LIT(0x9a025323f28b66f5),
+W64LIT(0x8c0575ad685cff9f),
+W64LIT(0x76ad31b2fd792253),
+W64LIT(0x68496939bee1dcbb),
+W64LIT(0x7e4e4fb7243645d1),
+W64LIT(0xe44c1c94d6bd2324),
+W64LIT(0xbeef61cfea9fc6a3),
+W64LIT(0x91fb4064bf1ad0c0),
+W64LIT(0x052eb7c64997862c),
+W64LIT(0x4a9081517bbc2b76),
+W64LIT(0x8f1f18effc822e28),
+W64LIT(0x3a096a675b8c5ebe),
+W64LIT(0xee1087ed4466da7c),
+W64LIT(0x2652d79053803e8c),
+W64LIT(0x7099eb36203075c8),
+W64LIT(0xc7307cc2ccaa9b84),
+W64LIT(0x5c97a7dfe16bb21c),
+W64LIT(0x50ffe622aef91cdf),
+W64LIT(0x8da0fd93b716b0f2),
+W64LIT(0x69ece10761ab93d6),
+W64LIT(0x31f07920161de88b),
+W64LIT(0x13299148d3401f46),
+W64LIT(0x031a6d4294ded1b7),
+W64LIT(0xccc96f85813b2db1),
+W64LIT(0x14b8c3f2d14307b0),
+W64LIT(0x8659eed4fa8706c7),
+W64LIT(0xba645e377c420fe2),
+W64LIT(0x2920fb2f88cc41f8),
+W64LIT(0x87fc66ea25cd49aa),
+W64LIT(0x1ee4588b4398fee8),
+W64LIT(0xecaf62910ff244a6),
+W64LIT(0xf817a163deb14316),
+W64LIT(0x45e2adeea0f05402),
+W64LIT(0x806d345027ce515c),
+W64LIT(0x576eb498acfa0429),
+W64LIT(0xa5258e82e090be67),
+W64LIT(0x892bc26b21cb79b3),
+W64LIT(0x6e7db3bd63a88b20),
+W64LIT(0x4e1bbea9ed61e237),
+W64LIT(0xadc6f08739dfd9e5),
+W64LIT(0x8b9427176a5fe769),
+W64LIT(0xa1aeb17a764d7726),
+W64LIT(0x4b35096fa4f6641b),
+W64LIT(0x22d9e868c55df7cd),
+W64LIT(0x55d151e4e76e9af3),
+W64LIT(0x966a12debd19c836),
+W64LIT(0x0dcdc9c390d8e1ae),
+W64LIT(0xf24b3a1a4c6aba4e),
+W64LIT(0x24ed32ec1814a056),
+W64LIT(0xaf7915fb724b473f),
+W64LIT(0x2885731157860e95),
+W64LIT(0x9c3689a72fc2316e),
+W64LIT(0x475d4892eb64cad8),
+W64LIT(0xac6378b9e6959688),
+W64LIT(0xa00b3944a907384b),
+W64LIT(0xc695f4fc13e0d4e9),
+W64LIT(0x3055f11ec957a7e6),
+W64LIT(0x6215f2402c3a25e3),
+W64LIT(0xde4576f38d317d9a),
+W64LIT(0x9344a518f48e4e1a),
+W64LIT(0x82d2d12c6c5acf86),
+W64LIT(0xefb50fd39b2c9511),
+W64LIT(0xe981d5574665c28a),
+W64LIT(0x5f8dca9d75b563ab),
+W64LIT(0xb60c1fca33d0a121),
+W64LIT(0xfe237be703f8148d),
+W64LIT(0xd6a608f6547e1a18),
+W64LIT(0xb97e3375e89cde55),
+W64LIT(0xd388bf301de99c34),
+W64LIT(0x5b06f565e368aaea),
+W64LIT(0xf0f4df6607fe2494),
+W64LIT(0x1607268e9ad7996a),
+W64LIT(0xaedc9dc5ad010852),
+W64LIT(0xe0c7236c4060ea65),
+W64LIT(0xea9bb815d2bb133d),
+W64LIT(0x888e4a55fe8136de),
+W64LIT(0x5aa37d5b3c22e587),
+W64LIT(0xc104a64611e3cc1f),
+W64LIT(0x515a6e1c71b353b2),
+W64LIT(0xc42a118058744a33),
+W64LIT(0x7708b98c22336d3e),
+W64LIT(0x2a3a966d1c12904f),
+W64LIT(0x8a31af29b515a804),
+W64LIT(0xed0aeaafd0b80bcb),
+W64LIT(0x2c0e4ce9c15bc7d4),
+W64LIT(0x0c6841fd4f92aec3),
+W64LIT(0x98bdb65fb91ff82f),
+W64LIT(0x1f41d0b59cd2b185),
+W64LIT(0xb322a80c7a47270d),
+W64LIT(0xe6f3f9e89d29bdfe),
+W64LIT(0x7ac5704fb2eb8c90),
+W64LIT(0xa94dcf7faf0210a4),
+W64LIT(0x787a9533f97f124a),
+W64LIT(0xdb6bc135c4a6fbb6),
+W64LIT(0x048b3ff896ddc941),
+W64LIT(0xe8245d69992f8de7),
+W64LIT(0xe3dd4e2ed4be3bd2),
+W64LIT(0xcafdb5015c727a2a),
+W64LIT(0xb7a997f4ec9aee4c),
+W64LIT(0xe75671d64263f293),
+W64LIT(0x2b9f1e53c358df22),
+W64LIT(0x18d0820f9ed1a973),
+W64LIT(0xabf22a03e4968e7e),
+W64LIT(0xa2b4dc38e293a691),
+W64LIT(0x673b458665ada3cf),
+W64LIT(0xf9b2295d01fb0c7b),
+W64LIT(0xd22d370ec2a3d359),
+W64LIT(0x97cf9ae06253875b),
+W64LIT(0x0ed7a48104063019),
+W64LIT(0x482f642d3028b5ac),
+W64LIT(0xc0a12e78cea98372),
+W64LIT(0x4fbe3697322bad5a),
+W64LIT(0x19750a31419be61e),
+W64LIT(0x41699216362d9d43),
+W64LIT(0xd5bc65b4c0a0cbaf),
+W64LIT(0xe5e994aa09f76c49),
+W64LIT(0xeb3e302b0df15c50),
+W64LIT(0x94d5f7a2f68d56ec),
+W64LIT(0x53e58b603a27cd68),
+W64LIT(0x3d9838dd598f4648),
+W64LIT(0x60aa173c67aebb39),
+W64LIT(0x1dfe35c9d7462f5f),
+W64LIT(0x4ca45bd5a6f57ced),
+W64LIT(0xbc5084b3a10b5879),
+W64LIT(0xfaa8441f9525ddcc),
+W64LIT(0x334f9c5c5d897651),
+/* box 4 */
+W64LIT(0xda1687a883adf27e),
+W64LIT(0xe35c9378578d9f22),
+W64LIT(0x303ca4531637fa40),
+W64LIT(0xa088321f74b20375),
+W64LIT(0xc9863f3a9acb95e9),
+W64LIT(0x5fcf47c57d0b0ed4),
+W64LIT(0x4aa211e4e1280b4b),
+W64LIT(0xe1a4c9ba871d1289),
+W64LIT(0x4926664759f03a4f),
+W64LIT(0xadfb36ede3707bca),
+W64LIT(0xcf7bd1891f8ef7e1),
+W64LIT(0x9735559e8f882792),
+W64LIT(0x5932a976f84e6cdc),
+W64LIT(0x9dc792bef547818a),
+W64LIT(0x06fdeeb385456208),
+W64LIT(0x46ad38771ea2cf5b),
+W64LIT(0x5eb36aa41543b27b),
+W64LIT(0x8b2eb33cd1bcb511),
+W64LIT(0x71105ff6e598ebbc),
+W64LIT(0x5441ad846f8c1463),
+W64LIT(0x4c5fff57646d6943),
+W64LIT(0xf3485c49f633c9b1),
+W64LIT(0x9cbbbfdf9d0f3d25),
+W64LIT(0x22d031a067192178),
+W64LIT(0xca0248992213a4ed),
+W64LIT(0x19627fb263a9c18f),
+W64LIT(0x9330e1efda5dc831),
+W64LIT(0x1390b89219666797),
+W64LIT(0x2edf18339893e568),
+W64LIT(0x6c779435d3e4c590),
+W64LIT(0x53c06e568281cac4),
+W64LIT(0x6ff3e3966b3cf494),
+W64LIT(0xfe3b58bb61f1b10e),
+W64LIT(0x77edb14560dd89b4),
+W64LIT(0x02f85ac2d0908dab),
+W64LIT(0x12ec95f3712edb38),
+W64LIT(0x85d9c06dfea6fcaa),
+W64LIT(0x90b4964c6285f935),
+W64LIT(0xf1b0068b26a3441a),
+W64LIT(0x729428555d40dab8),
+W64LIT(0x5c4b3066c5d33fd0),
+W64LIT(0x5d371d07ad9b837f),
+W64LIT(0xa48d866e2167ecd6),
+W64LIT(0xb661139d504937ee),
+W64LIT(0xa27068dda4228ede),
+W64LIT(0xf8c6b608e4b4d306),
+W64LIT(0x6bf657e73ee91b37),
+W64LIT(0xac871b8c8b38c765),
+W64LIT(0x4ea7a595b4fde4e8),
+W64LIT(0x0d7304f297c278bf),
+W64LIT(0xb71d3efc38018b41),
+W64LIT(0xae7f414e5ba84ace),
+W64LIT(0xaf036c2f33e0f661),
+W64LIT(0x0000000000000000),
+W64LIT(0xb89660cc7f537e55),
+W64LIT(0xa675dcacf1f7617d),
+W64LIT(0x610490c74426bd2f),
+W64LIT(0xc18ca2d83094be5a),
+W64LIT(0x2adaac42cd460acb),
+W64LIT(0x7d1f76651a122fac),
+W64LIT(0xc58916a9654151f9),
+W64LIT(0xedabe0297897d699),
+W64LIT(0x2d5b6f90204bd46c),
+W64LIT(0x26d585d132cccedb),
+W64LIT(0x9f3fc87c25d70c21),
+W64LIT(0xc60d610add9960fd),
+W64LIT(0x80a0597dc33bafa6),
+W64LIT(0xd0e44088f9625466),
+W64LIT(0x1d67cbc3367c2e2c),
+W64LIT(0x2c2742f1480368c3),
+W64LIT(0x89d6e9fe012c38ba),
+W64LIT(0xe9ae54582d42393a),
+W64LIT(0x3ecbd702392db3fb),
+W64LIT(0xb5e5643ee89106ea),
+W64LIT(0xa882affddeed28c6),
+W64LIT(0x1ae60811db71f08b),
+W64LIT(0x924ccc8eb215749e),
+W64LIT(0xfcc30279b1613ca5),
+W64LIT(0x825803bf13ab220d),
+W64LIT(0xd992f00b3b75c37a),
+W64LIT(0xc8fa125bf2832946),
+W64LIT(0x35453d432baaa94c),
+W64LIT(0xf9ba9b698cfc6fa9),
+W64LIT(0x37bd6781fb3a24e7),
+W64LIT(0x791ac2144fc7c00f),
+W64LIT(0x16e9218224fb349b),
+W64LIT(0xdb6aaac9ebe54ed1),
+W64LIT(0xd8eedd6a533d7fd5),
+W64LIT(0x7c635b04725a9303),
+W64LIT(0x553d80e507c4a8cc),
+W64LIT(0x9a46516c184a5f2d),
+W64LIT(0x14117b40f46bb930),
+W64LIT(0x1ee3bc608ea41f28),
+W64LIT(0x27a9a8b05a847274),
+W64LIT(0x4050d6c49be7ad53),
+W64LIT(0x7be298d69f574da4),
+W64LIT(0x6a8a7a8656a1a798),
+W64LIT(0x4d23d2360c25d5ec),
+W64LIT(0x1014cf31a1be5693),
+W64LIT(0xb264a7ec059cd84d),
+W64LIT(0xea2a23fb959a083e),
+W64LIT(0xf0cc2bea4eebf8b5),
+W64LIT(0x76919c240895351b),
+W64LIT(0x0b8eea4112871ab7),
+W64LIT(0x47d1151676ea73f4),
+W64LIT(0xbdeff9dc42ce2d59),
+W64LIT(0x2ba68123a50eb664),
+W64LIT(0x057999103d9d530c),
+W64LIT(0xe759270902587081),
+W64LIT(0xef53baeba8075b32),
+W64LIT(0x4fdb88f4dcb55847),
+W64LIT(0x6e8fcef70374483b),
+W64LIT(0x1168e250c9f6ea3c),
+W64LIT(0x1b9a2570b3394c24),
+W64LIT(0x706c72978dd05713),
+W64LIT(0x865db7ce467ecdae),
+W64LIT(0x52bc4337eac9766b),
+W64LIT(0x504419f53a59fbc0),
+W64LIT(0x8f2b074d84695ab2),
+W64LIT(0x6078bda62c6e0180),
+W64LIT(0x43d4a167233f9c57),
+W64LIT(0x0ef773512f1a49bb),
+W64LIT(0x0c0f2993ff8ac410),
+W64LIT(0x4bde3c858960b7e4),
+W64LIT(0x66855315a92b6388),
+W64LIT(0xd360372b41ba6562),
+W64LIT(0x584e84179006d073),
+W64LIT(0x9b3a7c0d7002e382),
+W64LIT(0xa5f1ab0f492f5079),
+W64LIT(0x2822f6801dd68760),
+W64LIT(0x445562b5ce3242f0),
+W64LIT(0xaa7af53f0e7da56d),
+W64LIT(0x3c338dc0e9bd3e50),
+W64LIT(0x3bb24e1204b0e0f7),
+W64LIT(0xd59dd998c4ff076a),
+W64LIT(0x91c8bb2d0acd459a),
+W64LIT(0x84a5ed0c96ee4005),
+W64LIT(0x33b8d3f0aeefcb44),
+W64LIT(0x57c5da27d7542567),
+W64LIT(0x32c4fe91c6a777eb),
+W64LIT(0x3439102243e215e3),
+W64LIT(0xc7714c6bb5d1dc52),
+W64LIT(0x3fb7fa6351650f54),
+W64LIT(0x87219aaf2e367101),
+W64LIT(0xf5b5b2fa7376abb9),
+W64LIT(0x412cfba5f3af11fc),
+W64LIT(0xdceb691b06e89076),
+W64LIT(0xbb12176fc78b4f51),
+W64LIT(0x73e8053435086617),
+W64LIT(0xe220be193fc5238d),
+W64LIT(0xb09cfd2ed50c55e6),
+W64LIT(0xb9ea4dad171bc2fa),
+W64LIT(0x9e43e51d4d9fb08e),
+W64LIT(0x36c14ae093729848),
+W64LIT(0xa9fe829cb6a59469),
+W64LIT(0x0405b47155d5efa3),
+W64LIT(0x0af2c7207acfa618),
+W64LIT(0x7e9b01c6a2ca1ea8),
+W64LIT(0xdd97447a6ea02cd9),
+W64LIT(0x0781c3d2ed0ddea7),
+W64LIT(0x7866ef75278f7ca0),
+W64LIT(0xd1986de9912ae8c9),
+W64LIT(0xcb7e65f84a5b1842),
+W64LIT(0xcd838b4bcf1e7a4a),
+W64LIT(0xab06d85e663519c2),
+W64LIT(0xd4e1f4f9acb7bbc5),
+W64LIT(0xfdbf2f18d929800a),
+W64LIT(0xf23471289e7b751e),
+W64LIT(0xbc93d4bd2a8691f6),
+W64LIT(0x3d4fa0a181f582ff),
+W64LIT(0xba6e3a0eafc3f3fe),
+W64LIT(0x5ab6ded540965dd8),
+W64LIT(0xeb560e9afdd2b491),
+W64LIT(0x0976b083c217971c),
+W64LIT(0xecd7cd4810df6a36),
+W64LIT(0x23ac1cc10f519dd7),
+W64LIT(0xbe6b8e7ffa161c5d),
+W64LIT(0x7fe72ca7ca82a207),
+W64LIT(0xc0f08fb958dc02f5),
+W64LIT(0x7a9eb5b7f71ff10b),
+W64LIT(0xa709f1cd99bfddd2),
+W64LIT(0x8dd35d8f54f9d719),
+W64LIT(0x8caf70ee3cb16bb6),
+W64LIT(0xe4dd50aaba804185),
+W64LIT(0x83242ede7be39ea2),
+W64LIT(0x98be0baec8dad286),
+W64LIT(0x690e0d25ee79969c),
+W64LIT(0x95cd0f5c5f18aa39),
+W64LIT(0x56b9f746bf1c99c8),
+W64LIT(0x7469c6e6d805b8b0),
+W64LIT(0x8a529e5db9f409be),
+W64LIT(0xe6250a686a10cc2e),
+W64LIT(0x2fa33552f0db59c7),
+W64LIT(0x42a88c064b7720f8),
+W64LIT(0x6d0bb954bbac793f),
+W64LIT(0x181e52d30be17d20),
+W64LIT(0xbf17a31e925ea0f2),
+W64LIT(0x94b1223d37501696),
+W64LIT(0xe8d27939450a8595),
+W64LIT(0xccffa62aa756c6e5),
+W64LIT(0x383639b1bc68d1f3),
+W64LIT(0xee2f978ac04fe79d),
+W64LIT(0xa30c45bccc6a3271),
+W64LIT(0x1f9f9101e6eca387),
+W64LIT(0xb1e0d04fbd44e949),
+W64LIT(0x242ddf13e25c4370),
+W64LIT(0x156d56219c23059f),
+W64LIT(0x88aac49f69648415),
+W64LIT(0x6280e764fcfe8c2b),
+W64LIT(0xdf6f1eb8be30a172),
+W64LIT(0xe5a17dcbd2c8fd2a),
+W64LIT(0xe0d8e4dbef55ae26),
+W64LIT(0x63fcca0594b63084),
+W64LIT(0xa1f41f7e1cfabfda),
+W64LIT(0x295edbe1759e3bcf),
+W64LIT(0x67f97e74c163df27),
+W64LIT(0x038477a3b8d83104),
+W64LIT(0xde1333d9d6781ddd),
+W64LIT(0x3ace63736cf85c58),
+W64LIT(0xd619ae3b7c27366e),
+W64LIT(0x5bcaf3b428dee177),
+W64LIT(0xb3188a8d6dd464e2),
+W64LIT(0x1c1be6a25e349283),
+W64LIT(0x017c2d616848bcaf),
+W64LIT(0x8e572a2cec21e61d),
+W64LIT(0xf631c559cbae9abd),
+W64LIT(0x81dc741cab731309),
+W64LIT(0xff4775da09b90da1),
+W64LIT(0xb499495f80d9ba45),
+W64LIT(0x0f8b5e304752f514),
+W64LIT(0x394a14d0d4206d5c),
+W64LIT(0xce07fce877c64b4e),
+W64LIT(0xf4c99f9b1b3e1716),
+W64LIT(0xc4f53bc80d09ed56),
+W64LIT(0xc208d57b884c8f5e),
+W64LIT(0x080a9de2aa5f2bb3),
+W64LIT(0x314089327e7f46ef),
+W64LIT(0xfa3eecca34245ead),
+W64LIT(0x20286b62b789acd3),
+W64LIT(0x7515eb87b04d041f),
+W64LIT(0x513834945211476f),
+W64LIT(0x650124b611f3528c),
+W64LIT(0x17950ce34cb38834),
+W64LIT(0x45294fd4a67afe5f),
+W64LIT(0x21544603dfc1107c),
+W64LIT(0x485a4b2631b886e0),
+W64LIT(0x6872204486312a33),
+W64LIT(0x647d09d779bbee23),
+W64LIT(0x2551f2728a14ffdf),
+W64LIT(0xd765835a146f8ac1),
+W64LIT(0xd21c1a4a29f2d9cd),
+W64LIT(0x99c226cfa0926e29),
+W64LIT(0xfb42c1ab5c6ce202),
+W64LIT(0xc374f81ae00433f1),
+W64LIT(0x964978ffe7c09b3d),
+W64LIT(0xf74de838a3e62612),
+/* box 5 */
+W64LIT(0x74b87b36b0592c6a),
+W64LIT(0x3d82d75dffb4b81c),
+W64LIT(0x8884246715267825),
+W64LIT(0xdaf2d8a77ed4e5de),
+W64LIT(0xfeb118650e53f9c7),
+W64LIT(0xbd2d1aea59226b06),
+W64LIT(0x26ce87f6dbabb191),
+W64LIT(0x32772ecbeb66bd0a),
+W64LIT(0xd4bbf82bc5104c8c),
+W64LIT(0x055357720c4e03a1),
+W64LIT(0xef5be62a32d0f6fd),
+W64LIT(0xbe1c84c45d186aca),
+W64LIT(0xacc7e4a565a1643c),
+W64LIT(0x8dd7731519687b84),
+W64LIT(0x11eafe4f3c830f3a),
+W64LIT(0x04ef8e68a358afe5),
+W64LIT(0x40ad9ca1534b930d),
+W64LIT(0xe44191d4855a5c0e),
+W64LIT(0x6001d20b809420f1),
+W64LIT(0x73666b70173b8243),
+W64LIT(0x372479b9e728beab),
+W64LIT(0x45fecbd35f0590ac),
+W64LIT(0x7057f55e1301838f),
+W64LIT(0xff0dc17fa1455583),
+W64LIT(0x0cc467b810e804da),
+W64LIT(0xb9c29482fa7ac4e3),
+W64LIT(0xa003831d754960e6),
+W64LIT(0x8a096353be0ad5ad),
+W64LIT(0xdd2cc8e1d9b64bf7),
+W64LIT(0xc7dc415052bfee3e),
+W64LIT(0x9f0c137421d17572),
+W64LIT(0x35a93e8d4c041323),
+W64LIT(0x9a5f44062d9f76d3),
+W64LIT(0x71eb2c44bc172fcb),
+W64LIT(0x0ff5f99614d20516),
+W64LIT(0x7789e518b4632da6),
+W64LIT(0xc99561dce97b476c),
+W64LIT(0x5276fcc06bf29dfb),
+W64LIT(0x4a0b32454bd795ba),
+W64LIT(0x9274add69e2fddec),
+W64LIT(0x4f5865374799961b),
+W64LIT(0xb2d8e37c4df06e10),
+W64LIT(0xc4eddf7e5685eff2),
+W64LIT(0xb3643a66e2e6c254),
+W64LIT(0xd50721316a06e0c8),
+W64LIT(0x8bb5ba49111c79e9),
+W64LIT(0x2bb639546455190f),
+W64LIT(0xf8d3d1390627fbaa),
+W64LIT(0x38d1802ff3fabbbd),
+W64LIT(0xdfa18fd5729ae67f),
+W64LIT(0x4ee4bc2de88f3a5f),
+W64LIT(0xf72628af12f5febc),
+W64LIT(0x0aa6aee4189c06b7),
+W64LIT(0x0000000000000000),
+W64LIT(0x9eb0ca6e8ec7d936),
+W64LIT(0xcb1826e84257eae4),
+W64LIT(0x187dce8520250841),
+W64LIT(0xc28f16225ef1ed9f),
+W64LIT(0xc333cf38f1e741db),
+W64LIT(0x4220db95f8673e85),
+W64LIT(0xdc9011fb76a0e7b3),
+W64LIT(0x105627559395a37e),
+W64LIT(0x2f59b73cc70db6ea),
+W64LIT(0xe112c6a689145faf),
+W64LIT(0x82228a830dba7e92),
+W64LIT(0x2ee56e26681b1aae),
+W64LIT(0x2a0ae04ecb43b54b),
+W64LIT(0x47738ce7f4293d24),
+W64LIT(0xa7dd935bd22bcecf),
+W64LIT(0xd2d93177cd644ee1),
+W64LIT(0xebb4684291885918),
+W64LIT(0x0e49208cbbc4a952),
+W64LIT(0xa550d46f79076347),
+W64LIT(0x411145bbfc5d3f49),
+W64LIT(0xe6ccd6e02e76f186),
+W64LIT(0x4bb7eb5fe4c139fe),
+W64LIT(0x5d8305567f2098ed),
+W64LIT(0x95aabd90394d73c5),
+W64LIT(0x25ff19d8df91b05d),
+W64LIT(0x86cd04ebaee2d177),
+W64LIT(0x03319e2e043a01cc),
+W64LIT(0x6b1ba5f5371e8a02),
+W64LIT(0x76353c021b7581e2),
+W64LIT(0x64ee5c6323cc8f14),
+W64LIT(0x5c3fdc4cd03634a9),
+W64LIT(0x6996e2c19c32278a),
+W64LIT(0x8938fd7dba30d461),
+W64LIT(0x7b4d82a0a48b297c),
+W64LIT(0xbfa05ddef20ec68e),
+W64LIT(0x8ee6ed3b1d527a48),
+W64LIT(0x61bd0b112f828cb5),
+W64LIT(0x66631b5788e0229c),
+W64LIT(0x55a8ec86cc9033d2),
+W64LIT(0x1c9240ed837da7a4),
+W64LIT(0x150570279fdba0df),
+W64LIT(0x53ca25dac4e431bf),
+W64LIT(0xd636bf1f6e3ce104),
+W64LIT(0xcaa4fff2ed4146a0),
+W64LIT(0x787c1c8ea0b128b0),
+W64LIT(0xad7b3dbfcab7c878),
+W64LIT(0xfc3c5f51a57f544f),
+W64LIT(0xb78bb40e41be6db1),
+W64LIT(0x8c6baa0fb67ed7c0),
+W64LIT(0xce4b719a4e19e945),
+W64LIT(0xf96f0823a93157ee),
+W64LIT(0x7d2f4bfcacff2b11),
+W64LIT(0x3eb34973fb8eb9d0),
+W64LIT(0xe39f81922238f227),
+W64LIT(0x239dd084d7e5b230),
+W64LIT(0x1fa3dec38747a668),
+W64LIT(0xc5510664f99343b6),
+W64LIT(0xc829b8c6466deb28),
+W64LIT(0x85fc9ac5aad8d0bb),
+W64LIT(0xb6376d14eea8c1f5),
+W64LIT(0x9d8154408afdd8fa),
+W64LIT(0x3be01e01f7c0ba71),
+W64LIT(0x628c953f2bb88d79),
+W64LIT(0x6d796ca93f6a886f),
+W64LIT(0xfa5e960dad0b5622),
+W64LIT(0xe5fd48ce2a4cf04a),
+W64LIT(0xe7700ffa81605dc2),
+W64LIT(0x2dd4f0086c211b62),
+W64LIT(0x2221099e78f31e74),
+W64LIT(0xdb4e01bdd1c2499a),
+W64LIT(0xf417b68116cfff70),
+W64LIT(0xb506f33aea92c039),
+W64LIT(0x514762ee6fc89c37),
+W64LIT(0x9c3d8d5a25eb74be),
+W64LIT(0x396d59355cec17f9),
+W64LIT(0xccc636aee53544cd),
+W64LIT(0x0b1a77feb78aaaf3),
+W64LIT(0xe9392f763aa4f490),
+W64LIT(0xaaa52df96dd56651),
+W64LIT(0x46cf55fd5b3f9160),
+W64LIT(0xa4ec0d75d611cf03),
+W64LIT(0xaff67a8b619b65f0),
+W64LIT(0x3415e797e312bf67),
+W64LIT(0x7af15bba0b9d8538),
+W64LIT(0x811314ad09807f5e),
+W64LIT(0x8771ddf101f47d33),
+W64LIT(0x969b23be3d777209),
+W64LIT(0xd365e86d6272e2a5),
+W64LIT(0x58d05224736e9b4c),
+W64LIT(0xc660984afda9427a),
+W64LIT(0x5414359c63869f96),
+W64LIT(0xe885f66c95b258d4),
+W64LIT(0x655285798cda2350),
+W64LIT(0x6cc5b5b3907c242b),
+W64LIT(0x6ff42b9d944625e7),
+W64LIT(0xc0025116f5dd4017),
+W64LIT(0xa28ec429de65cd6e),
+W64LIT(0x63304c2584ae213d),
+W64LIT(0x7fa20cc807d38699),
+W64LIT(0x996eda2829a5771f),
+W64LIT(0x1b4c50ab241f098d),
+W64LIT(0x1e1f07d928510a2c),
+W64LIT(0x33cbf7d14470114e),
+W64LIT(0xb055a448e6dcc398),
+W64LIT(0x98d2033286b3db5b),
+W64LIT(0xec6a780436eaf731),
+W64LIT(0xa1bf5a07da5fcca2),
+W64LIT(0xbaf30aacfe40c52f),
+W64LIT(0xf144e1f31a81fcd1),
+W64LIT(0xe0ae1fbc2602f3eb),
+W64LIT(0x14b9a93d30cd0c9b),
+W64LIT(0x596c8b3edc783708),
+W64LIT(0x682a3bdb33248bce),
+W64LIT(0xb87e4d98556c68a7),
+W64LIT(0x80afcdb7a696d31a),
+W64LIT(0x5725abb267bc9e5a),
+W64LIT(0x914533f89a15dc20),
+W64LIT(0x5eb29b787b1a9921),
+W64LIT(0x01bcd91aaf16ac44),
+W64LIT(0xc1be880c5acbec53),
+W64LIT(0xedd6a11e99fc5b75),
+W64LIT(0x028d4734ab2cad88),
+W64LIT(0x8f5a3421b244d60c),
+W64LIT(0x4dd52203ecb53b93),
+W64LIT(0x3f0f906954981594),
+W64LIT(0xae4aa391ce8dc9b4),
+W64LIT(0x3698a0a3483e12ef),
+W64LIT(0xf5ab6f9bb9d95334),
+W64LIT(0x082be9d0b3b0ab3f),
+W64LIT(0xd1e8af59c95e4f2d),
+W64LIT(0xd87f9f93d5f84856),
+W64LIT(0x6e48f2873b5089a3),
+W64LIT(0x2443c0c270871c19),
+W64LIT(0xb1e97d5249ca6fdc),
+W64LIT(0x7c9392e603e98755),
+W64LIT(0x839e5399a2acd2d6),
+W64LIT(0x19c1179f8f33a405),
+W64LIT(0xde1d56cfdd8c4a3b),
+W64LIT(0x20ac4eaad3dfb3fc),
+W64LIT(0x1af089b18b09a5c9),
+W64LIT(0x3a5cc71b58d61635),
+W64LIT(0x444212c9f0133ce8),
+W64LIT(0x72dab26ab82d2e07),
+W64LIT(0x4c69fb1943a397d7),
+W64LIT(0xf3c9a6c7b1ad5159),
+W64LIT(0x1d2e99f72c6b0be0),
+W64LIT(0xb4ba2a2045846c7d),
+W64LIT(0xe22358888d2e5e63),
+W64LIT(0x2887a77a606f18c3),
+W64LIT(0xa8286acdc6f9cbd9),
+W64LIT(0x5f0e4262d40c3565),
+W64LIT(0xeee73f309dc65ab9),
+W64LIT(0x9be39d1c8289da97),
+W64LIT(0x1634ee099be1a113),
+W64LIT(0xea08b1583e9ef55c),
+W64LIT(0x9727faa49261de4d),
+W64LIT(0x2c682912c337b726),
+W64LIT(0xcff7a880e10f4501),
+W64LIT(0x1788371334f70d57),
+W64LIT(0x27725eec74bd1dd5),
+W64LIT(0x3146b0e5ef5cbcc6),
+W64LIT(0x099730ca1ca6077b),
+W64LIT(0xf2757fdd1ebbfd1d),
+W64LIT(0x6aa77cef98082646),
+W64LIT(0xbb4fd3b65156696b),
+W64LIT(0x569972a8c8aa321e),
+W64LIT(0xa3321d337173612a),
+W64LIT(0x50fbbbf4c0de3073),
+W64LIT(0x5a5d1510d84236c4),
+W64LIT(0xfd80864b0a69f80b),
+W64LIT(0x07de1046a762ae29),
+W64LIT(0xa6614a417d3d628b),
+W64LIT(0xd78a6605c12a4d40),
+W64LIT(0x67dfc24d27f68ed8),
+W64LIT(0xbc91c3f0f634c742),
+W64LIT(0xd05476436648e369),
+W64LIT(0x493aac6b4fed9476),
+W64LIT(0x12db606138b90ef6),
+W64LIT(0xa994b3d769ef679d),
+W64LIT(0x211097b07cc91fb8),
+W64LIT(0x30fa69ff404a1082),
+W64LIT(0x3c3e0e4750a21458),
+W64LIT(0x7504a22c1f4f802e),
+W64LIT(0x844043df05ce7cff),
+W64LIT(0xf0f838e9b5975095),
+W64LIT(0x7e1ed5d2a8c52add),
+W64LIT(0x90f9eae235037064),
+W64LIT(0x0662c95c0874026d),
+W64LIT(0x9416648a965bdf81),
+W64LIT(0xf69af1b5bde352f8),
+W64LIT(0x0d78bea2bffea89e),
+W64LIT(0x293b7e60cf79b487),
+W64LIT(0xd9c346897aeee412),
+W64LIT(0xfbe24f17021dfa66),
+W64LIT(0x1367b97b97afa2b2),
+W64LIT(0xab19f4e3c2c3ca15),
+W64LIT(0x48867571e0fb3832),
+W64LIT(0x93c874cc313971a8),
+W64LIT(0x79c0c5940fa784f4),
+W64LIT(0xcd7aefb44a23e889),
+W64LIT(0x439c028f577192c1),
+W64LIT(0x5be1cc0a77549a80),
+/* box 6 */
+W64LIT(0x714d28d778656928),
+W64LIT(0xc88a7c6b84f64f7c),
+W64LIT(0xec43cac5ab89aaca),
+W64LIT(0x777fa38110dc16a3),
+W64LIT(0x0f7d5c87e4213b5c),
+W64LIT(0x73f051e5f3a1ef51),
+W64LIT(0xea714193c330d541),
+W64LIT(0x95e5f3dae016c4f3),
+W64LIT(0x63d3738095a0e173),
+W64LIT(0x9825d66f8ff379d6),
+W64LIT(0xe8cc38a148f45338),
+W64LIT(0xa840b0c025f06bb0),
+W64LIT(0x944135c35f748735),
+W64LIT(0x74661caa247ad31c),
+W64LIT(0xe7b16426acd56864),
+W64LIT(0xd1e689df6e6f0589),
+W64LIT(0xa73dec47c1d150ec),
+W64LIT(0x64453ecf427bdd3e),
+W64LIT(0x0ed99a9e5b43789a),
+W64LIT(0x7b1b402dc05be840),
+W64LIT(0x0dc025b56fe5bd25),
+W64LIT(0x3f183a284e22293a),
+W64LIT(0xa0aba108160a6ca1),
+W64LIT(0x46be033705bd4703),
+W64LIT(0x86df6e94b2b10f6e),
+W64LIT(0xa216d83a9dceead8),
+W64LIT(0x129e5b57edc5885b),
+W64LIT(0x7e3074509c445274),
+W64LIT(0x7d29cb7ba8e297cb),
+W64LIT(0x1611a9330eb871a9),
+W64LIT(0x486799a95efe3f99),
+W64LIT(0x9fb39b205828459b),
+W64LIT(0xd0424fc6d10d464f),
+W64LIT(0xe968feb8f79610fe),
+W64LIT(0x5d6f8fb164e08b8f),
+W64LIT(0xaafdc9f2ae34edc9),
+W64LIT(0x02bd79328bc48679),
+W64LIT(0x9b3c6944bb55bc69),
+W64LIT(0x6277b5992ac2a2b5),
+W64LIT(0x877ba88d0dd34ca8),
+W64LIT(0xfa5263f6a531db63),
+W64LIT(0x2e9fde54974164de),
+W64LIT(0xcda14816d8e9f548),
+W64LIT(0x675c81e476dd1881),
+W64LIT(0x2a102c30743c9d2c),
+W64LIT(0x37f32be07dd82e2b),
+W64LIT(0x256d70b7901da670),
+W64LIT(0x4ce86bcdbd83c66b),
+W64LIT(0x50afaa040b0536aa),
+W64LIT(0xef5a75ee9f2f6f75),
+W64LIT(0xb3913c4644ada73c),
+W64LIT(0x1187e47cd9634de4),
+W64LIT(0xc54a59deeb13f259),
+W64LIT(0x0000000000000000),
+W64LIT(0x01a4c619bf6243c6),
+W64LIT(0x90cec7a7bc097ec7),
+W64LIT(0xf94bdcdd91971edc),
+W64LIT(0x8e347f5c814b087f),
+W64LIT(0xc7f720ec60d77420),
+W64LIT(0x354e52d2f61ca852),
+W64LIT(0x34ea94cb497eeb94),
+W64LIT(0xae723b964d49143b),
+W64LIT(0xf48bf968fe72a3f9),
+W64LIT(0xfc60e8a0cd88a4e8),
+W64LIT(0x2909931b409a5893),
+W64LIT(0xbd48a6d81feedfa6),
+W64LIT(0x6cae2f077181da2f),
+W64LIT(0xad6b84bd79efd184),
+W64LIT(0x18c833ad55fb0933),
+W64LIT(0x204644cacc021c44),
+W64LIT(0x392ab17e269b56b1),
+W64LIT(0x14acd001857cf7d0),
+W64LIT(0x8abb8d386236f18d),
+W64LIT(0xeefeb3f7204d2cb3),
+W64LIT(0xf636805a75b62580),
+W64LIT(0x2bb4ea29cb5edeea),
+W64LIT(0xc653e6f5dfb537e6),
+W64LIT(0x8d2dc077b5edcdc0),
+W64LIT(0x31c1a0b6156151a0),
+W64LIT(0xf8ef1ac42ef55d1a),
+W64LIT(0xdbb0e125d65184e1),
+W64LIT(0x82509cf051ccf69c),
+W64LIT(0xe33e96424fa89196),
+W64LIT(0xdf3f1341352c7d13),
+W64LIT(0x8f90b9453e294bb9),
+W64LIT(0x1023226566010e22),
+W64LIT(0xa58095754a15d695),
+W64LIT(0x2c22a7661c85e2a7),
+W64LIT(0xe183ef70c46c17ef),
+W64LIT(0xafd6fd8ff22b57fd),
+W64LIT(0x471ac52ebadf04c5),
+W64LIT(0x4d4cadd402e185ad),
+W64LIT(0x916a01be036b3d01),
+W64LIT(0x28ad5502fff81b55),
+W64LIT(0x3657edf9c2ba6ded),
+W64LIT(0xd2ff36f45ac9c036),
+W64LIT(0xf1a0cd15a26d19cd),
+W64LIT(0xd90d98175d950298),
+W64LIT(0xf7924643cad46646),
+W64LIT(0xdd826a73bee8fb6a),
+W64LIT(0x9d0ee212d3ecc3e2),
+W64LIT(0xb6ba083b18b21d08),
+W64LIT(0x3da5431ac5e6af43),
+W64LIT(0x08eb11c833fa0711),
+W64LIT(0x052b347d5c1fba34),
+W64LIT(0x6fb7902c45271f90),
+W64LIT(0x133a9d4e52a7cb9d),
+W64LIT(0x6e135635fa455c56),
+W64LIT(0x725497fc4cc3ac97),
+W64LIT(0xf31db42729a99fb4),
+W64LIT(0x846217a639758917),
+W64LIT(0x4b7e26826a58fa26),
+W64LIT(0x235ffbe1f8a4d9fb),
+W64LIT(0xff79578bf92e6157),
+W64LIT(0xda14273c6933c727),
+W64LIT(0x8b1f4b21dd54b24b),
+W64LIT(0x9caa240b6c8e8024),
+W64LIT(0xc1c5abba086e0bab),
+W64LIT(0xde9bd5588a4e3ed5),
+W64LIT(0x2d86617fa3e7a161),
+W64LIT(0xbff5dfea942a59df),
+W64LIT(0x66f847fdc9bf5b47),
+W64LIT(0x3b97c84cad5fd0c8),
+W64LIT(0x3ebcfc31f1406afc),
+W64LIT(0xca3705590f32c905),
+W64LIT(0x24c9b6ae2f7fe5b6),
+W64LIT(0x408c88616d043888),
+W64LIT(0x93d7788c88afbb78),
+W64LIT(0x196cf5b4ea994af5),
+W64LIT(0x9a98af5d0437ffaf),
+W64LIT(0x8c89066e0a8f8e06),
+W64LIT(0xab590feb1156ae0f),
+W64LIT(0xd7d4028906d67a02),
+W64LIT(0xe4a8db0d9873addb),
+W64LIT(0xc378d28883aa8dd2),
+W64LIT(0x4ff1d4e6892503d4),
+W64LIT(0xd670c490b9b439c4),
+W64LIT(0x65e1f8d6fd199ef8),
+W64LIT(0xf2b9723e96cbdc72),
+W64LIT(0xb12c4574cf692145),
+W64LIT(0x569d215263bc4921),
+W64LIT(0x69851b7a2d9e601b),
+W64LIT(0x5e76309a50464e30),
+W64LIT(0x5fd2f683ef240df6),
+W64LIT(0xd8a95e0ee2f7415e),
+W64LIT(0xe29a505bf0cad250),
+W64LIT(0x96fc4cf1d4b0014c),
+W64LIT(0x8806f40ae9f277f4),
+W64LIT(0x53b6152f3fa3f315),
+W64LIT(0x1c47c1c9b686f0c1),
+W64LIT(0x80ede5c2da0870e5),
+W64LIT(0xd5697bbb8d12fc7b),
+W64LIT(0xfdc42eb972eae72e),
+W64LIT(0x0bf2aee3075cc2ae),
+W64LIT(0x22fb3df847c69a3d),
+W64LIT(0xbadeeb97c835e3eb),
+W64LIT(0xdc26ac6a018ab8ac),
+W64LIT(0xbcec60c1a08c9c60),
+W64LIT(0x4231f153e6c0bef1),
+W64LIT(0x337cd9849ea5d7d9),
+W64LIT(0x5b5d04e70c59f404),
+W64LIT(0x79a6391f4b9f6e39),
+W64LIT(0x5212d33680c1b0d3),
+W64LIT(0xb5a3b7102c14d8b7),
+W64LIT(0x7f94b249232611b2),
+W64LIT(0x17b56f2ab1da326f),
+W64LIT(0x59e07dd5879d727d),
+W64LIT(0xebd5878a7c529687),
+W64LIT(0xbb7a2d8e7757a02d),
+W64LIT(0x0319bf2b34a6c5bf),
+W64LIT(0x5ccb49a8db82c849),
+W64LIT(0x1de307d009e4b307),
+W64LIT(0x49c35fb0e19c7c5f),
+W64LIT(0x55849e79571a8c9e),
+W64LIT(0x7abf86347f39ab86),
+W64LIT(0x9273be9537cdf8be),
+W64LIT(0xe615a23f13b72ba2),
+W64LIT(0x6821dd6392fc23dd),
+W64LIT(0x5af9c2feb33bb7c2),
+W64LIT(0x06328b5668b97f8b),
+W64LIT(0x44037a058e79c17a),
+W64LIT(0x83f45ae9eeaeb55a),
+W64LIT(0x5739e74bdcde0ae7),
+W64LIT(0xfbf6a5ef1a5398a5),
+W64LIT(0xe50c1d142711ee1d),
+W64LIT(0x1a754a9fde3f8f4a),
+W64LIT(0x7802ff06f4fd2dff),
+W64LIT(0xf52f3f714110e03f),
+W64LIT(0x2674cf9ca4bb63cf),
+W64LIT(0x60caccaba10624cc),
+W64LIT(0xb088836d700b6283),
+W64LIT(0xa6992a5e7eb3132a),
+W64LIT(0xa9e476d99a922876),
+W64LIT(0x6b386248a65ae662),
+W64LIT(0xc2dc14913cc8ce14),
+W64LIT(0x76db6598afbe5565),
+W64LIT(0x32d81f9d21c7941f),
+W64LIT(0x21e282d373605f82),
+W64LIT(0xc0616da3b70c486d),
+W64LIT(0x616e0ab21e64670a),
+W64LIT(0x6d0ae91ecee399e9),
+W64LIT(0x27d009851bd92009),
+W64LIT(0xfedd9192464c2291),
+W64LIT(0x45a7bc1c311b82bc),
+W64LIT(0x54205860e878cf58),
+W64LIT(0xa10f6711a9682f67),
+W64LIT(0x9981107630913a10),
+W64LIT(0xede70cdc14ebe90c),
+W64LIT(0x70e9eecec7072aee),
+W64LIT(0x1f5e7ee28220357e),
+W64LIT(0x2f3b184d28232718),
+W64LIT(0x41284e78d2667b4e),
+W64LIT(0xa424536cf5779553),
+W64LIT(0xa3b21e2322aca91e),
+W64LIT(0x4e5512ff36474012),
+W64LIT(0x1efab8fb3d4276b8),
+W64LIT(0x89a2321356903432),
+W64LIT(0xcb93c340b0508ac3),
+W64LIT(0x306566afaa031266),
+W64LIT(0x4adae09bd53ab9e0),
+W64LIT(0xc92eba723b940cba),
+W64LIT(0x094fd7d18c9844d7),
+W64LIT(0xcc058e0f678bb68e),
+W64LIT(0xd4cdbda23270bfbd),
+W64LIT(0x0a5668fab83e8168),
+W64LIT(0x510b6c1db467756c),
+W64LIT(0xb86392a543f16592),
+W64LIT(0x048ff264e37df9f2),
+W64LIT(0x3a330e55123d930e),
+W64LIT(0xb235fa5ffbcfe4fa),
+W64LIT(0xb9c754bcfc932654),
+W64LIT(0x3c0185037a84ec85),
+W64LIT(0x0c64e3acd087fee3),
+W64LIT(0xe02729697b0e5429),
+W64LIT(0x07964d4fd7db3c4d),
+W64LIT(0x814923db656a3323),
+W64LIT(0x388e776799f91577),
+W64LIT(0x6a9ca4511938a5a4),
+W64LIT(0x1bd18c86615dcc8c),
+W64LIT(0xb407710993769b71),
+W64LIT(0x150816183a1eb416),
+W64LIT(0x4395374a59a2fd37),
+W64LIT(0xc4ee9fc75471b19f),
+W64LIT(0x5844bbcc38ff31bb),
+W64LIT(0xcf1c3124532d7331),
+W64LIT(0xb71ece22a7d05ece),
+W64LIT(0xaccf42a4c68d9242),
+W64LIT(0x97588ae86bd2428a),
+W64LIT(0x75c2dab39b1890da),
+W64LIT(0x9e175d39e74a065d),
+W64LIT(0xf0040b0c1d0f5a0b),
+W64LIT(0xceb8f73dec4f30f7),
+W64LIT(0xbe5119f32b481a19),
+W64LIT(0xd35bf0ede5ab83f0),
+W64LIT(0x7c8d0d621780d40d),
+W64LIT(0x85c6d1bf8617cad1),
+/* box 7 */
+W64LIT(0xb1c742127b66f2a4),
+W64LIT(0xce916098d7a59fc1),
+W64LIT(0xc312ef8e2406fa70),
+W64LIT(0x956c7dced81403d5),
+W64LIT(0x5a0c9b2318dd9520),
+W64LIT(0xad0d57f51a480e8b),
+W64LIT(0xe7b9d05287740b01),
+W64LIT(0x0217f9ea2ed81268),
+W64LIT(0x4d7cff19f8cd3a06),
+W64LIT(0x44d1772e572b7b67),
+W64LIT(0xfb73c5b5e65af72e),
+W64LIT(0x91427aef84512705),
+W64LIT(0x0c720963e4cf6c85),
+W64LIT(0x87c398a0732d8117),
+W64LIT(0xa17f5e96fe87620e),
+W64LIT(0x50476c8b8e8fcf1d),
+W64LIT(0xcb4ee1cc9c8cb225),
+W64LIT(0x67b2304c91a8b59a),
+W64LIT(0x54696baad2caebcd),
+W64LIT(0xddcf03836bf01437),
+W64LIT(0x46c68ec479f3690f),
+W64LIT(0x8f9f96e2cba7c942),
+W64LIT(0xe1802e99f5e93db9),
+W64LIT(0x4e9a8086c179215a),
+W64LIT(0xf0c9b4686764a427),
+W64LIT(0xfd4a3b7e94c7c196),
+W64LIT(0xfcbbbd0b83abc8a2),
+W64LIT(0xebcbd93163bb6784),
+W64LIT(0xf9643c5fc882e546),
+W64LIT(0xc4da973041f7c5fc),
+W64LIT(0x1af3eb2c13b3ca97),
+W64LIT(0x6e1fb87b3e4ef4fb),
+W64LIT(0x5e229c024498b1f0),
+W64LIT(0xf516353c2c4d89c3),
+W64LIT(0xcc869972f97d8da9),
+W64LIT(0x8d886f08e57fdb2a),
+W64LIT(0x1cca15e7612efc2f),
+W64LIT(0x567e9240fc12f9a5),
+W64LIT(0x43190f9032da44eb),
+W64LIT(0xfeac44e1ad73daca),
+W64LIT(0x07c878be65f13f8c),
+W64LIT(0x618bce87e3358322),
+W64LIT(0xf895ba2adfeeec72),
+W64LIT(0x751dd5223a913758),
+W64LIT(0x59eae4bc21698e7c),
+W64LIT(0xff5dc294ba1fd3fe),
+W64LIT(0x03e67f9f39b41b5c),
+W64LIT(0x2292c117d1efc7c9),
+W64LIT(0x8a4017b6808ee4a6),
+W64LIT(0xd1bd0ae08f3f78b2),
+W64LIT(0x135e631bbc558bf6),
+W64LIT(0xee14586528924a60),
+W64LIT(0x8857ee5cae56f6ce),
+W64LIT(0x0000000000000000),
+W64LIT(0x0e65f089ca177eed),
+W64LIT(0x34132358269361db),
+W64LIT(0x15679dd0cec8bd4e),
+W64LIT(0x800be01e16dcbe9b),
+W64LIT(0x949dfbbbcf780ae1),
+W64LIT(0xe397d773db312fd1),
+W64LIT(0xedf227fa1126513c),
+W64LIT(0xb5e945332723d674),
+W64LIT(0x53a11314b73bd441),
+W64LIT(0x23634762c683cefd),
+W64LIT(0x4b4501d28a500cbe),
+W64LIT(0x473708b16e9f603b),
+W64LIT(0x1770643ae010af26),
+W64LIT(0xa746a05d8c1a54b6),
+W64LIT(0x90b3fc9a933d2e31),
+W64LIT(0x35e2a52d31ff68ef),
+W64LIT(0xab34a93e68d53833),
+W64LIT(0xd81082d720d939d3),
+W64LIT(0xb86aca25d480b3c5),
+W64LIT(0xdfd8fa694528065f),
+W64LIT(0x4f6b06f3d615286e),
+W64LIT(0x578f1435eb7ef091),
+W64LIT(0x9af80b32056f740c),
+W64LIT(0x92a40570bde53c59),
+W64LIT(0xdbf6fd48196d228f),
+W64LIT(0x1b026d5904dfc3a3),
+W64LIT(0x3c4f2d1a9e19298e),
+W64LIT(0xc8a89e53a538a979),
+W64LIT(0x991e74ad3cdb6f50),
+W64LIT(0x042e07215c4524d0),
+W64LIT(0x8e6e1097dccbc076),
+W64LIT(0xe071a8ece285348d),
+W64LIT(0xd784f42bfda24e0a),
+W64LIT(0x7d41db60821b7f0d),
+W64LIT(0x85d4614a5df5937f),
+W64LIT(0xbb8cb5baed34a899),
+W64LIT(0x40ff700f0b6e5fb7),
+W64LIT(0x2cf7319e1bf8b924),
+W64LIT(0x3a76d3d1ec841f36),
+W64LIT(0x4520f15b40477253),
+W64LIT(0xf138321d7008ad13),
+W64LIT(0x42e889e525b64ddf),
+W64LIT(0x65a5c9a6bf70a7f2),
+W64LIT(0x208538fdff37d5a1),
+W64LIT(0x410ef67a1c025683),
+W64LIT(0x18e412c63d6bd8ff),
+W64LIT(0x72d5ad9c5f6008d4),
+W64LIT(0x255ab9a9b41ef845),
+W64LIT(0x93558305aa89356d),
+W64LIT(0x70c2547671b81abc),
+W64LIT(0x3604dab2084b73b3),
+W64LIT(0x05df81544b292de4),
+W64LIT(0xf2de4d8249bcb64f),
+W64LIT(0x0bba71dd813e5309),
+W64LIT(0xa368a77cd05f7066),
+W64LIT(0x796fdc41de5e5bdd),
+W64LIT(0xec03a18f064a5808),
+W64LIT(0x085c0e42b88a4855),
+W64LIT(0x274d40439ac6ea2d),
+W64LIT(0x31cca20c6dba4c3f),
+W64LIT(0x322add93540e5763),
+W64LIT(0xb60f3aac1e97cd28),
+W64LIT(0x7cb05d1595777639),
+W64LIT(0xb036c4676c0afb90),
+W64LIT(0x0a4bf7a896525a3d),
+W64LIT(0x73242be9480c01e0),
+W64LIT(0x5bfd1d560fb19c14),
+W64LIT(0x7b7825abf08649b5),
+W64LIT(0xb7febcd909fbc41c),
+W64LIT(0x81fa666b01b0b7af),
+W64LIT(0xd25b757fb68b63ee),
+W64LIT(0x0d838f16f3a365b1),
+W64LIT(0x6a31bf5a620bd02b),
+W64LIT(0x26bcc6368daae319),
+W64LIT(0x9ed60c13592a50dc),
+W64LIT(0x581b62c936058748),
+W64LIT(0x9cc1f5f977f242b4),
+W64LIT(0x83ed9f812f68a5c7),
+W64LIT(0x74ec53572dfd3e6c),
+W64LIT(0xb3d0bbf855bee0cc),
+W64LIT(0xacfcd1800d2407bf),
+W64LIT(0x303d24797ad6450b),
+W64LIT(0x7a89a3dee7ea4081),
+W64LIT(0x69d7c0c55bbfcb77),
+W64LIT(0x770a2cc814492530),
+W64LIT(0x0f9476fcdd7b77d9),
+W64LIT(0xaeeb286a23fc15d7),
+W64LIT(0x2174be88e85bdc95),
+W64LIT(0xde297c1c52440f6b),
+W64LIT(0xd04c8c9598537186),
+W64LIT(0x2ee0c8743520ab4c),
+W64LIT(0x977b8424f6cc11bd),
+W64LIT(0x10b81c8485e190aa),
+W64LIT(0xa4a0dfc2b5ae4fea),
+W64LIT(0x98eff2d82bb76664),
+W64LIT(0xa8d2d6a15161236f),
+W64LIT(0xd4628bb4c4165556),
+W64LIT(0x682646b04cd3c243),
+W64LIT(0x2d06b7eb0c94b010),
+W64LIT(0x626db118da81987e),
+W64LIT(0x2928b0ca50d194c0),
+W64LIT(0x6df9c7e407faefa7),
+W64LIT(0x1681e24ff77ca612),
+W64LIT(0x4952f838a4881ed6),
+W64LIT(0x76fbaabd03252c04),
+W64LIT(0xc73ce8af7843dea0),
+W64LIT(0xe82da6ae5a0f7cd8),
+W64LIT(0xc10516640adee818),
+W64LIT(0x968a0251e1a01889),
+W64LIT(0x37f55cc71f277a87),
+W64LIT(0xe5ae29b8a9ac1969),
+W64LIT(0xcabf67b98be0bb11),
+W64LIT(0xf4e7b3493b2180f7),
+W64LIT(0xe9dc20db4d6375ec),
+W64LIT(0x639c376dcded914a),
+W64LIT(0x12afe56eab3982c2),
+W64LIT(0xc2e369fb336af344),
+W64LIT(0xa6b726289b765d82),
+W64LIT(0x14961ba5d9a4b47a),
+W64LIT(0xbc44cd0488c59715),
+W64LIT(0xd3aaf30aa1e76ada),
+W64LIT(0x28d936bf47bd9df4),
+W64LIT(0xaf1aae1f34901ce3),
+W64LIT(0x2f114e01224ca278),
+W64LIT(0xe648562790180235),
+W64LIT(0x24ab3fdca372f171),
+W64LIT(0x52509561a057dd75),
+W64LIT(0xc6cd6eda6f2fd794),
+W64LIT(0xa08ed8e3e9eb6b3a),
+W64LIT(0x09ad8837afe64161),
+W64LIT(0xbdb54b719fa99e21),
+W64LIT(0x8c79e97df213d21e),
+W64LIT(0xcf60e6edc0c996f5),
+W64LIT(0x5dc4e39d7d2caaac),
+W64LIT(0x11499af1928d999e),
+W64LIT(0x5fd31a7753f4b8c4),
+W64LIT(0x01f18675176c0934),
+W64LIT(0xc52b1145569bccc8),
+W64LIT(0x9f278a664e4659e8),
+W64LIT(0x3dbeab6f897520ba),
+W64LIT(0xa2992109c7337952),
+W64LIT(0x9b098d4712037d38),
+W64LIT(0xc9591826b254a04d),
+W64LIT(0x3b8755a4fbe81602),
+W64LIT(0xbe5334eea61d857d),
+W64LIT(0x51b6eafe99e3c629),
+W64LIT(0x191594b32a07d1cb),
+W64LIT(0x1f2c6a78589ae773),
+W64LIT(0x3fa95285a7ad32d2),
+W64LIT(0x5c3565e86a40a398),
+W64LIT(0xb2213d8d42d2e9f8),
+W64LIT(0xefe5de103ffe4354),
+W64LIT(0x4ab487a79d3c058a),
+W64LIT(0xcd771f07ee11849d),
+W64LIT(0xbfa2b29bb1718c49),
+W64LIT(0xba7d33cffa58a1ad),
+W64LIT(0x6fee3e0e2922fdcf),
+W64LIT(0x64544fd3a81caec6),
+W64LIT(0xd9e104a237b530e7),
+W64LIT(0xf32fcbf75ed0bf7b),
+W64LIT(0x3e58d4f0b0c13be6),
+W64LIT(0xb418c346304fdf40),
+W64LIT(0xaac52f4b7fb93107),
+W64LIT(0xdc3e85f67c9c1d03),
+W64LIT(0xd5930dc1d37a5c62),
+W64LIT(0x0639fecb729d36b8),
+W64LIT(0xc0f490111db2e12c),
+W64LIT(0x7ea7a4ffbbaf6451),
+W64LIT(0xf6f04aa315f9929f),
+W64LIT(0x6643b63986c4bcae),
+W64LIT(0x6c0841911096e693),
+W64LIT(0x8425e73f4a999a4b),
+W64LIT(0x7133d20366d41388),
+W64LIT(0x38612a3bc25c0d5e),
+W64LIT(0xb99b4c50c3ecbaf1),
+W64LIT(0x1d3b93927642f51b),
+W64LIT(0x7f56228aacc36d65),
+W64LIT(0x9d30738c609e4b80),
+W64LIT(0x48a37e4db3e417e2),
+W64LIT(0x8bb191c397e2ed92),
+W64LIT(0x2acecf5569658f9c),
+W64LIT(0xda077b3d0e012bbb),
+W64LIT(0xa55159b7a2c246de),
+W64LIT(0x33db5be643625e57),
+W64LIT(0x821c19f43804acf3),
+W64LIT(0x3990ac4ed530046a),
+W64LIT(0xd675725eeace473e),
+W64LIT(0x789e5a34c93252e9),
+W64LIT(0x86321ed564418823),
+W64LIT(0xfa8243c0f136fe1a),
+W64LIT(0xe45fafcdbec0105d),
+W64LIT(0x2b3f49207e0986a8),
+W64LIT(0xa92350d4460d2a5b),
+W64LIT(0x1eddec0d4ff6ee47),
+W64LIT(0x89a66829b93afffa),
+W64LIT(0x607a48f2f4598a16),
+W64LIT(0x6bc0392f7567d91f),
+W64LIT(0xea3a5f4474d76eb0),
+W64LIT(0x5598eddfc5a6e2f9),
+W64LIT(0x4c8d796cefa13332),
+W64LIT(0xf701ccd602959bab),
+W64LIT(0xe2665106cc5d26e5),
+};
+
+const word64 SHARK::Dec::cbox[8][256] = {
+/* box 0 */
+W64LIT(0xe6126af05e55aff3),
+W64LIT(0x4b6c893f310b0835),
+W64LIT(0xaa4c0e84ebfc8d57),
+W64LIT(0xfb9b5c7bf3b3090d),
+W64LIT(0x4508a6a9ccba5ce2),
+W64LIT(0xe5d1d2064dc6bde9),
+W64LIT(0x348343755288edde),
+W64LIT(0xb684505de46b250c),
+W64LIT(0xa8cede205a1e91e8),
+W64LIT(0x40b89b46f9fa6acc),
+W64LIT(0x8ee1ec1afab080ba),
+W64LIT(0xde77d6b7408e0a45),
+W64LIT(0x9a3e184c2e455802),
+W64LIT(0xbe93fad23f0955ef),
+W64LIT(0x3ae76ce3af39b909),
+W64LIT(0xad7ee3cf6f5ea7c6),
+W64LIT(0x8b51d1f5cff0b694),
+W64LIT(0x70ca8d8e3c43bf99),
+W64LIT(0xccdba7f8b2a8f6c9),
+W64LIT(0x4c5e6474b5a922a4),
+W64LIT(0x5d31adcd541ccc32),
+W64LIT(0x9b7f701e8c3456a7),
+W64LIT(0x2ac9cd08ecfd593a),
+W64LIT(0x8fa0844858c18e1f),
+W64LIT(0x32f0c66c745bc9ea),
+W64LIT(0xc58d6525cbbb888f),
+W64LIT(0x8c633cbe4b529c05),
+W64LIT(0xf2cd9ea68aa0774b),
+W64LIT(0x2cba4811ca2e7d0e),
+W64LIT(0xe2e33f4dc9649778),
+W64LIT(0xf4be1bbfac73537f),
+W64LIT(0x22de6787379f29d9),
+W64LIT(0x0956c2dd79137e46),
+W64LIT(0xe061efe978868bc7),
+W64LIT(0x1cc85ed90f97a85b),
+W64LIT(0x31337e9a67c8dbf0),
+W64LIT(0x360193d1e36af161),
+W64LIT(0x7fefca4a6383e5eb),
+W64LIT(0x8535fe633241e243),
+W64LIT(0xc3fee03ced68acbb),
+W64LIT(0x81c4abdea570dac8),
+W64LIT(0x67d6c12efb25753b),
+W64LIT(0xa4282112164dd980),
+W64LIT(0xcf181f0ea13be4d3),
+W64LIT(0xa98fb672f86f9f4d),
+W64LIT(0x5c70c59ff66dc297),
+W64LIT(0xb0f7d544c2b80138),
+W64LIT(0x0da79760ee2246cd),
+W64LIT(0x3740fb83411bffc4),
+W64LIT(0x24ade29e114c0ded),
+W64LIT(0xf858e48de0201b17),
+W64LIT(0x0e642f96fdb154d7),
+W64LIT(0xddb46e41531d185f),
+W64LIT(0x25ec8accb33d0348),
+W64LIT(0x0282d0a4b1e21cbf),
+W64LIT(0x1bfab3928b3582ca),
+W64LIT(0xaffc336bdebcbb79),
+W64LIT(0x35c22b27f0f9e37b),
+W64LIT(0x03c3b8f61393121a),
+W64LIT(0xb8e07fcb19da71db),
+W64LIT(0x99fda0ba3dd64a18),
+W64LIT(0xce59775c034aea76),
+W64LIT(0x49ee599b80e9148a),
+W64LIT(0xfe2b6194c6f33f23),
+W64LIT(0x4edcb4d0044b3e1b),
+W64LIT(0xd5a3c4ce887f68bc),
+W64LIT(0xdf36bee5e2ff04e0),
+W64LIT(0x171c4ca0c766caa2),
+W64LIT(0x0bd41279c8f162f9),
+W64LIT(0xe490ba54efb7b34c),
+W64LIT(0x5b4228d472cfe806),
+W64LIT(0x5355825ba9ad98e5),
+W64LIT(0x9f8e25a31b056e2c),
+W64LIT(0xcd9acfaa10d9f86c),
+W64LIT(0x88926903dc63a48e),
+W64LIT(0xb40680f9558939b3),
+W64LIT(0x239f0fd595ee277c),
+W64LIT(0xec8710db34d5c3af),
+W64LIT(0x87b72ec783a3fefc),
+W64LIT(0x632794936c144db0),
+W64LIT(0x46cb1e5fdf294ef8),
+W64LIT(0x83467b7a1492c677),
+W64LIT(0x9c4d9d5508967c36),
+W64LIT(0xd6607c389bec7aa6),
+W64LIT(0x165d24f26517c407),
+W64LIT(0xc4cc0d7769ca862a),
+W64LIT(0xcbe94ab3360adc58),
+W64LIT(0x847496319030ece6),
+W64LIT(0x7a5ff7a556c3d3c5),
+W64LIT(0xc03d58cafefbbea1),
+W64LIT(0x76b908971a909bad),
+W64LIT(0x2f79f0e7d9bd6f14),
+W64LIT(0x197863363ad79e75),
+W64LIT(0xda86830ad7bf32ce),
+W64LIT(0x5a034086d0bee6a3),
+W64LIT(0x97998f2cc0671ecf),
+W64LIT(0x552607428f7ebcd1),
+W64LIT(0x51d752ff184f845a),
+W64LIT(0xbb23c73d0a4963c1),
+W64LIT(0x2b88a55a4e8c579f),
+W64LIT(0xd80453ae665d2e71),
+W64LIT(0xee05c07f8537df10),
+W64LIT(0x423a4be248187673),
+W64LIT(0xcaa822e1947bd2fd),
+W64LIT(0x1abbdbc029448c6f),
+W64LIT(0x96d8e77e6216106a),
+W64LIT(0x6266fcc1ce654315),
+W64LIT(0x89d301517e12aa2b),
+W64LIT(0x730935782fd0ad83),
+W64LIT(0x8085c38c0701d46d),
+W64LIT(0x6b303e1cb7763d53),
+W64LIT(0x3f57510c9a798f27),
+W64LIT(0x4449cefb6ecb5247),
+W64LIT(0x48af31c922981a2f),
+W64LIT(0x98bcc8e89fa744bd),
+W64LIT(0x69b2eeb8069421ec),
+W64LIT(0xebb5fd90b077e93e),
+W64LIT(0x6a71564e150733f6),
+W64LIT(0x116fc9b9e1b5ee96),
+W64LIT(0x4a2de16d937a0690),
+W64LIT(0xb9a11799bbab7f7e),
+W64LIT(0x9368da9157562644),
+W64LIT(0x718be5dc9e32b13c),
+W64LIT(0xc82af2452599ce42),
+W64LIT(0xb547e8abf7f83716),
+W64LIT(0x33b1ae3ed62ac74f),
+W64LIT(0x799c4f534550c1df),
+W64LIT(0x3e16395e38088182),
+W64LIT(0x7c2c72bc7010f7f1),
+W64LIT(0xf38cf6f428d179ee),
+W64LIT(0xd29129850cdd422d),
+W64LIT(0x41f9f3145b8b6469),
+W64LIT(0x945a37dad3f40cd5),
+W64LIT(0x757ab061090389b7),
+W64LIT(0x6554118a4ac76984),
+W64LIT(0x7d6d1aeed261f954),
+W64LIT(0x01416852a2710ea5),
+W64LIT(0xb27505e0735a1d87),
+W64LIT(0x77f860c5b8e19508),
+W64LIT(0x78dd2701e721cf7a),
+W64LIT(0xe12087bbdaf78562),
+W64LIT(0x86f6469521d2f059),
+W64LIT(0xef44a82d2746d1b5),
+W64LIT(0xbc112a768eeb4950),
+W64LIT(0xc2bf886e4f19a21e),
+W64LIT(0x307216c8c5b9d555),
+W64LIT(0xc96b9a1787e8c0e7),
+W64LIT(0xa31acc5992eff311),
+W64LIT(0xa0d974af817ce10b),
+W64LIT(0xdcf50613f16c16fa),
+W64LIT(0xfca9b1307711239c),
+W64LIT(0x57a4d7e63e9ca06e),
+W64LIT(0xc64eddd3d8289a95),
+W64LIT(0xa25ba40b309efdb4),
+W64LIT(0x2e3898b57bcc61b1),
+W64LIT(0xf5ff73ed0e025dda),
+W64LIT(0xa6aaf1b6a7afc53f),
+W64LIT(0xd9453bfcc42c20d4),
+W64LIT(0x9d0cf507aae77293),
+W64LIT(0x290a75feff6e4b20),
+W64LIT(0xa7eb99e405decb9a),
+W64LIT(0xa1981cfd230defae),
+W64LIT(0x12ac714ff226fc8c),
+W64LIT(0x743bd833ab728712),
+W64LIT(0x6c02d35733d417c2),
+W64LIT(0xe9372d340195f581),
+W64LIT(0xf77da349bfe04165),
+W64LIT(0x68f386eaa4e52f49),
+W64LIT(0x211ddf71240c3bc3),
+W64LIT(0x13ed191d5057f229),
+W64LIT(0xe8764566a3e4fb24),
+W64LIT(0xf9198cdf425115b2),
+W64LIT(0xd013f921bd3f5e92),
+W64LIT(0x91ea0a35e6b43afb),
+W64LIT(0x0732ed4b84a22a91),
+W64LIT(0xeaf495c21206e79b),
+W64LIT(0x5214ea090bdc9640),
+W64LIT(0x0000000000000000),
+W64LIT(0xb3346db2d12b1322),
+W64LIT(0x0ce6ff324c534868),
+W64LIT(0xaebd5b397ccdb5dc),
+W64LIT(0x0a957a2b6a806c5c),
+W64LIT(0x1f0be62f1c04ba41),
+W64LIT(0x14dff456d4f5d8b8),
+W64LIT(0x58819022615cfa1c),
+W64LIT(0x05b03def3540362e),
+W64LIT(0xe3a2571f6b1599dd),
+W64LIT(0x9229b2c3f52728e1),
+W64LIT(0xba62af6fa8386d64),
+W64LIT(0x0673851926d32434),
+W64LIT(0x641579d8e8b66721),
+W64LIT(0x04f155bd9731388b),
+W64LIT(0x9ecf4df1b9746089),
+W64LIT(0x205cb723867d3566),
+W64LIT(0x102ea1eb43c4e033),
+W64LIT(0x3ba604b10d48b7ac),
+W64LIT(0x50963aadba3e8aff),
+W64LIT(0xac3f8b9dcd2fa963),
+W64LIT(0x7b1e9ff7f4b2dd60),
+W64LIT(0xf63ccb1b1d914fc0),
+W64LIT(0x7eaea218c1f2eb4e),
+W64LIT(0x5fb37d69e5fed08d),
+W64LIT(0x56e5bfb49cedaecb),
+W64LIT(0x2dfb2043685f73ab),
+W64LIT(0x61a54437ddf6510f),
+W64LIT(0x6fc16ba1204705d8),
+W64LIT(0xe75302a2fc24a156),
+W64LIT(0x3dd581a82b9b9398),
+W64LIT(0xdbc7eb5875ce3c6b),
+W64LIT(0x90ab626744c5345e),
+W64LIT(0x59c0f870c32df4b9),
+W64LIT(0x6697a97c59547b9e),
+W64LIT(0xfde8d962d5602d39),
+W64LIT(0xd3d041d7aeac4c88),
+W64LIT(0x5ef2153b478fde28),
+W64LIT(0xd4e2ac9c2a0e6619),
+W64LIT(0x1e4a8e7dbe75b4e4),
+W64LIT(0x72485d2a8da1a326),
+W64LIT(0x437b23b0ea6978d6),
+W64LIT(0x159e9c047684d61d),
+W64LIT(0x0f2547c45fc05a72),
+W64LIT(0xf10e265099336551),
+W64LIT(0x3c94e9fa89ea9d3d),
+W64LIT(0xbfd292809d785b4a),
+W64LIT(0x0817aa8fdb6270e3),
+W64LIT(0x60e42c657f875faa),
+W64LIT(0x18390b6498a690d0),
+W64LIT(0x478a760d7d58405d),
+W64LIT(0x284b1dac5d1f4585),
+W64LIT(0xb1b6bd1660c90f9d),
+W64LIT(0xd15291731f4e5037),
+W64LIT(0x4d1f0c2617d82c01),
+W64LIT(0xc70fb5817a599430),
+W64LIT(0x6d43bb0591a51967),
+W64LIT(0x6e8003f382360b7d),
+W64LIT(0x1d89368bade6a6fe),
+W64LIT(0x4f9ddc82a63a30be),
+W64LIT(0xedc6788996a4cd0a),
+W64LIT(0xab0d66d6498d83f2),
+W64LIT(0x54676f102d0fb274),
+W64LIT(0xc17c30985c8ab004),
+W64LIT(0x3865bc471edba5b6),
+W64LIT(0x3924d415bcaaab13),
+W64LIT(0x951b5f8871850270),
+W64LIT(0x8a10b9a76d81b831),
+W64LIT(0xbd5042242c9a47f5),
+W64LIT(0xa5694940b43cd725),
+W64LIT(0xff6a09c664823186),
+W64LIT(0x8d2254ece92392a0),
+W64LIT(0xb7c5380f461a2ba9),
+W64LIT(0x82071328b6e3c8d2),
+W64LIT(0xd721146a399d7403),
+W64LIT(0xfada342951c207a8),
+W64LIT(0x262f323aa0ae1152),
+W64LIT(0xf04f4e023b426bf4),
+W64LIT(0x276e5a6802df1ff7),
+/* box 1 */
+W64LIT(0x3b4016dbfd16e203),
+W64LIT(0x9a7574c51174530a),
+W64LIT(0x90012e69c02ec8d3),
+W64LIT(0xf44580e3d780e076),
+W64LIT(0xf81dec2b49eca14b),
+W64LIT(0x26cae3e8a6e3d7ef),
+W64LIT(0x0962419e0c41f6ab),
+W64LIT(0x54d1eb4070ebd951),
+W64LIT(0x865e884b0188eec8),
+W64LIT(0xdf76067ea406fe8a),
+W64LIT(0x29849412e594fba0),
+W64LIT(0x461569896869c0f2),
+W64LIT(0xb5ddd6b3bbd6724e),
+W64LIT(0x0c586cc89e6c413d),
+W64LIT(0x6b0ad97054d904ea),
+W64LIT(0xa135621eec62b109),
+W64LIT(0x0eef7e47087ea461),
+W64LIT(0xfaaafea4dffe4417),
+W64LIT(0xe0ad344e80342331),
+W64LIT(0xab4138b23d382ad0),
+W64LIT(0x107390468e90fcff),
+W64LIT(0xbe0885a2218561b9),
+W64LIT(0xdbed22957d22c132),
+W64LIT(0x2251c7037fc7e857),
+W64LIT(0x33835ef8ba5e9c86),
+W64LIT(0xb3f1e0d7f4e0a8aa),
+W64LIT(0x3fdb32302432ddbb),
+W64LIT(0xa719547aa3546bed),
+W64LIT(0xe10c3df3cb3dab1f),
+W64LIT(0x17feaf9f8aafae35),
+W64LIT(0x9df84b1c154b01c0),
+W64LIT(0x8364a51d93a5595e),
+W64LIT(0x535cd49974d48b9b),
+W64LIT(0x01a109bd4b09882e),
+W64LIT(0xc4d0c529b0c51182),
+W64LIT(0x2e09abcbe1aba96a),
+W64LIT(0x1f3de7bccde7d0b0),
+W64LIT(0x9317355b1d35a5a1),
+W64LIT(0x6c87e6a950e65620),
+W64LIT(0x8910ffb142ffc287),
+W64LIT(0x40395fed275f1a16),
+W64LIT(0x7b794936da49f815),
+W64LIT(0xf269b68798b63a92),
+W64LIT(0xfd27c17ddbc116dd),
+W64LIT(0x8d8bdb5a9bdbfd3f),
+W64LIT(0x1ba6c35714c3ef08),
+W64LIT(0x6e30f426c6f4b37c),
+W64LIT(0x7fe26ddd036dc7ad),
+W64LIT(0x14e8b4ad57b4c347),
+W64LIT(0xb985ba7b25ba3373),
+W64LIT(0xe9cf75d08c75d59a),
+W64LIT(0x626898ee5898f241),
+W64LIT(0x5b9f9cba339cf51e),
+W64LIT(0xb250e96abfe92084),
+W64LIT(0x165fa622c1a6261b),
+W64LIT(0xf5e4895e9c896858),
+W64LIT(0xb76ac43c2dc49712),
+W64LIT(0x02b7128f9612e55c),
+W64LIT(0x1d8af5335bf535ec),
+W64LIT(0x36b973ae28732b10),
+W64LIT(0xa8572380e02347a2),
+W64LIT(0xf6f2926c4192052a),
+W64LIT(0x8c2ad2e7d0d27511),
+W64LIT(0xd32e6ab63a6abfb7),
+W64LIT(0xbd1e9e90fc9e0ccb),
+W64LIT(0x03161b32dd1b6d72),
+W64LIT(0x4dc03a98f23ad305),
+W64LIT(0x81d3b79205b7bc02),
+W64LIT(0x450372bbb572ad80),
+W64LIT(0x2d1fb0f93cb0c418),
+W64LIT(0x2a928f20388f96d2),
+W64LIT(0x721b08a8d6080ebe),
+W64LIT(0x92b63ce6563c2d8f),
+W64LIT(0xeb78675f1a6730c6),
+W64LIT(0x13658b74538b918d),
+W64LIT(0x428e4d62b14dff4a),
+W64LIT(0x88b1f60c09f64aa9),
+W64LIT(0x75963771d2375c74),
+W64LIT(0x7ad8408b9140703b),
+W64LIT(0x57c7f072adf0b423),
+W64LIT(0xe5971918121994a7),
+W64LIT(0x5666f9cfe6f93c0d),
+W64LIT(0x8f3cc9d50dc91863),
+W64LIT(0x1e9cee0186ee589e),
+W64LIT(0x8a06e4839fe4aff5),
+W64LIT(0xb824b3c66eb3bb5d),
+W64LIT(0xd1997839ac785aeb),
+W64LIT(0x6752b5b8cab545d7),
+W64LIT(0xb47cdf0ef0dffa60),
+W64LIT(0x949a0a82190af76b),
+W64LIT(0xc04be1c269e12e3a),
+W64LIT(0xfc86c8c090c89ef3),
+W64LIT(0xe3bb2f7c5d2f4e43),
+W64LIT(0x6aabd0cd1fd08cc4),
+W64LIT(0x2147dc31a2dc8525),
+W64LIT(0xca3fbb6eb8bbb5e3),
+W64LIT(0x48fa17ce60176493),
+W64LIT(0x6444ae8a17ae28a5),
+W64LIT(0x2b33869d73861efc),
+W64LIT(0xd0387184e771d2c5),
+W64LIT(0x7cf476efde76aadf),
+W64LIT(0x63c9915313917a6f),
+W64LIT(0xc929a05c65a0d891),
+W64LIT(0xda4c2b28362b491c),
+W64LIT(0xfe31da4f06da7baf),
+W64LIT(0xc1eae87f22e8a614),
+W64LIT(0x5c12a36337a3a7d4),
+W64LIT(0x18b0d865c9d8827a),
+W64LIT(0xe7200b97840b71fb),
+W64LIT(0x4bec0cfcbd0c09e1),
+W64LIT(0x0f4e77fa43772c4f),
+W64LIT(0x4c613325b9335b2b),
+W64LIT(0xf3c8bf3ad3bfb2bc),
+W64LIT(0x87ff81f64a8166e6),
+W64LIT(0xa38270917a705455),
+W64LIT(0x1911d1d882d10a54),
+W64LIT(0x44a27b06fe7b25ae),
+W64LIT(0x049b24ebd9243fb8),
+W64LIT(0xbb32a8f4b3a8d62f),
+W64LIT(0x91a027d48b2740fd),
+W64LIT(0x3d6c20bfb22038e7),
+W64LIT(0xe681022acf02f9d5),
+W64LIT(0xf17fadb545ad57e0),
+W64LIT(0xcc138d0af78d6f07),
+W64LIT(0x495b1e732b1eecbd),
+W64LIT(0x38560de9200d8f71),
+W64LIT(0xa9f62a3dab2acf8c),
+W64LIT(0x47b46034236048dc),
+W64LIT(0x8e9dc06846c0904d),
+W64LIT(0xaccc076b3907781a),
+W64LIT(0x32225745f15714a8),
+W64LIT(0xd4a3556f3e55ed7d),
+W64LIT(0xd7b54e5de34e800f),
+W64LIT(0xddc114f132141bd6),
+W64LIT(0x6d26ef141befde0e),
+W64LIT(0x85489379dc9383ba),
+W64LIT(0x0bd553119a5313f7),
+W64LIT(0x786f520407529567),
+W64LIT(0xcb9eb2d3f3b23dcd),
+W64LIT(0xa223792c3179dc7b),
+W64LIT(0x0a745aacd15a9bd9),
+W64LIT(0x710d139a0b1363cc),
+W64LIT(0x681cc24289c26998),
+W64LIT(0x1a07caea5fca6726),
+W64LIT(0x82c5aca0d8acd170),
+W64LIT(0x25dcf8da7bf8ba9d),
+W64LIT(0xc7c6de1b6dde7cf0),
+W64LIT(0xc35dfaf0b4fa4348),
+W64LIT(0xded70fc3ef0f76a4),
+W64LIT(0x504acfaba9cfe6e9),
+W64LIT(0xc571cc94fbcc99ac),
+W64LIT(0x5ea5b1eca1b14288),
+W64LIT(0xae7b15e4af159d46),
+W64LIT(0xc888a9e12ea950bf),
+W64LIT(0xf7539bd10a9b8d04),
+W64LIT(0x962d180d8f181237),
+W64LIT(0xe43610a559101c89),
+W64LIT(0x772125fe4425b928),
+W64LIT(0x84e99ac4979a0b94),
+W64LIT(0xc667d7a626d7f4de),
+W64LIT(0xefe343b4c3430f7e),
+W64LIT(0xd5025cd2755c6553),
+W64LIT(0xa6b85dc7e85de3c3),
+W64LIT(0xd61447e0a8470821),
+W64LIT(0x3e7a3b8d6f3b5595),
+W64LIT(0x52fddd243fdd03b5),
+W64LIT(0x8072be2f4ebe342c),
+W64LIT(0x12c482c9188219a3),
+W64LIT(0x9eee502ec8506cb2),
+W64LIT(0xad6d0ed6720ef034),
+W64LIT(0x59288e35a58e1042),
+W64LIT(0xe21a26c11626c66d),
+W64LIT(0x247df16730f132b3),
+W64LIT(0xf0dea4080ea4dfce),
+W64LIT(0x31344c772c4c79da),
+W64LIT(0x4f77281764283659),
+W64LIT(0x79ce5bb94c5b1d49),
+W64LIT(0x0000000000000000),
+W64LIT(0x73ba01159d018690),
+W64LIT(0x74373ecc993ed45a),
+W64LIT(0xbcbf972db79784e5),
+W64LIT(0x4ed621aa2f21be77),
+W64LIT(0xd95a301aeb30246e),
+W64LIT(0x9c5942a15e4289ee),
+W64LIT(0x37187a13637aa33e),
+W64LIT(0x276bea55edea5fc1),
+W64LIT(0x1c2bfc8e10fcbdc2),
+W64LIT(0xed54513b5551ea22),
+W64LIT(0x20e6d58ce9d50d0b),
+W64LIT(0x3ae11f66b61f6a2d),
+W64LIT(0x66f3bc0581bccdf9),
+W64LIT(0x2cbeb94477b94c36),
+W64LIT(0x99636ff7cc6f3e78),
+W64LIT(0x953b033f52037f45),
+W64LIT(0xb0e7fbe529fbc5d8),
+W64LIT(0x60df8a61ce8a171d),
+W64LIT(0x6f91fd9b8dfd3b52),
+W64LIT(0xaae0310f7631a2fe),
+W64LIT(0xbfa98c1f6a8ce997),
+W64LIT(0x8ba7ed3ed4ed27db),
+W64LIT(0x98c2664a8766b656),
+W64LIT(0x062c36644f36dae4),
+W64LIT(0x5570e2fd3be2517f),
+W64LIT(0xead96ee2516eb8e8),
+W64LIT(0x419856506c569238),
+W64LIT(0x23f0cebe34ce6079),
+W64LIT(0x309545ca6745f1f4),
+W64LIT(0x5a3e950778957d30),
+W64LIT(0x617e83dc85839f33),
+W64LIT(0xfb0bf71994f7cc39),
+W64LIT(0x3ccd2902f929b0c9),
+W64LIT(0x70ac1a27401aebe2),
+W64LIT(0xcea49f85619f8a5b),
+W64LIT(0x39f704546b04075f),
+W64LIT(0x0df96575d565c913),
+W64LIT(0x08c3482347487e85),
+W64LIT(0xd28f630b71633799),
+W64LIT(0xecf558861e58620c),
+W64LIT(0xc2fcf34dfff3cb66),
+W64LIT(0x978c11b0c4119a19),
+W64LIT(0x69bdcbffc2cbe1b6),
+W64LIT(0xba93a149f8a15e01),
+W64LIT(0x51ebc616e2c66ec7),
+W64LIT(0x078d3fd9043f52ca),
+W64LIT(0x58898788ee87986c),
+W64LIT(0x4a4d0541f60581cf),
+W64LIT(0xe86e7c6dc77c5db4),
+W64LIT(0xee424a09884a8750),
+W64LIT(0xcdb284b7bc84e729),
+W64LIT(0x65e5a7375ca7a08b),
+W64LIT(0x2fa8a276aaa22144),
+W64LIT(0xa0946ba3a76b3927),
+W64LIT(0xa5ae46f535468eb1),
+W64LIT(0x35af689cf5684662),
+W64LIT(0x28259dafae9d738e),
+W64LIT(0xcf0596382a960275),
+W64LIT(0xb6cbcd8166cd1f3c),
+W64LIT(0x7e43646048644f83),
+W64LIT(0x9bd47d785a7ddb24),
+W64LIT(0x432f44dffa447764),
+W64LIT(0x9f4f59938359e49c),
+W64LIT(0x7d557f52957f22f1),
+W64LIT(0x76802c430f2c3106),
+W64LIT(0xdc601d4c791d93f8),
+W64LIT(0x053a2d56922db796),
+W64LIT(0x11d299fbc59974d1),
+W64LIT(0xf9bce59602e52965),
+W64LIT(0xd8fb39a7a039ac40),
+W64LIT(0x340e6121be61ce4c),
+W64LIT(0x5f04b851eab8caa6),
+W64LIT(0x5db3aade7caa2ffa),
+W64LIT(0x1549bd101cbd4b69),
+W64LIT(0xff90d3f24dd3f381),
+W64LIT(0xafda1c59e41c1568),
+W64LIT(0xb146f25862f24df6),
+W64LIT(0xa40f4f487e4f069f),
+/* box 2 */
+W64LIT(0xa1a35cebf8f0f94c),
+W64LIT(0x2c203d650f3f095d),
+W64LIT(0x1a2bdaee4084a2a7),
+W64LIT(0xd32404574d7bcc68),
+W64LIT(0xf785bea594a9adc4),
+W64LIT(0xf2eb54456206949c),
+W64LIT(0x3f5e334d0475ced1),
+W64LIT(0x5994299b835d1f60),
+W64LIT(0x785b7989ac204794),
+W64LIT(0x025da6a2cf461a41),
+W64LIT(0xdf1f3a71f01a901b),
+W64LIT(0x27284f018bb77637),
+W64LIT(0xe1955a6d694c5310),
+W64LIT(0x24a1baf2d9d261ac),
+W64LIT(0xe4fbb08d9fe36a48),
+W64LIT(0x8d83618ef7cff011),
+W64LIT(0x2ac72276abf5279e),
+W64LIT(0xf9e32621e68eebf6),
+W64LIT(0xbf323fb4d3f86f69),
+W64LIT(0xbb888605b8745beb),
+W64LIT(0x70dafe1e7acd2f65),
+W64LIT(0xd0adf1a41f1edbf3),
+W64LIT(0x1e91635f2b089625),
+W64LIT(0xee2791b8864818f8),
+W64LIT(0x99ce23e4c56c1484),
+W64LIT(0xf33f0714ff259946),
+W64LIT(0xbd6f99161cbe7528),
+W64LIT(0x9f293cf761a63a47),
+W64LIT(0xb80173f6ea114c70),
+W64LIT(0x6543ef25d54dc62a),
+W64LIT(0x39b92c5ea0bfe012),
+W64LIT(0x63a4f0367187e8e9),
+W64LIT(0x4c0d38a02cddf62f),
+W64LIT(0x07334c4239e92319),
+W64LIT(0x43bff375c3d9bdc7),
+W64LIT(0xca862b4a5f9a7954),
+W64LIT(0x5d2e902ae8d12be2),
+W64LIT(0x137e0e280b4ac78c),
+W64LIT(0xf162a1b630638307),
+W64LIT(0x55af17bd3e3c4313),
+W64LIT(0x358212781ddebc61),
+W64LIT(0x94214e93e52e452d),
+W64LIT(0xc18e592edb12063e),
+W64LIT(0xec7a371a490e02b9),
+W64LIT(0x4963d240da72cf77),
+W64LIT(0x41e255d70c9fa786),
+W64LIT(0xff0439324244c535),
+W64LIT(0x88ed8b6e0160c949),
+W64LIT(0x6c163be39e83a301),
+W64LIT(0xc534e09fb09e32bc),
+W64LIT(0x806c0cf9d78da1b8),
+W64LIT(0xdba583c09b96a499),
+W64LIT(0x746047af11411be7),
+W64LIT(0xf40c4b56c6ccba5f),
+W64LIT(0x6270a367eca4e533),
+W64LIT(0xd41748157492ef71),
+W64LIT(0xeff3c2e91b6b1522),
+W64LIT(0x0e66988472274632),
+W64LIT(0x534808ae9af66dd0),
+W64LIT(0x8231aa5b18cbbbf9),
+W64LIT(0xb2dd52c3f3ba3ec0),
+W64LIT(0xdd429cd33f5c8a5a),
+W64LIT(0x4e509e02e39bec6e),
+W64LIT(0x26fc1c5016947bed),
+W64LIT(0xd9f8256254d0bed8),
+W64LIT(0x0955d4c64bce652b),
+W64LIT(0x1610e4c8fde5fed4),
+W64LIT(0x6dc268b203a0aedb),
+W64LIT(0x2e7d9bc7c079131c),
+W64LIT(0xc3d3ff8c14541c7f),
+W64LIT(0xd64aeeb7bbd4f530),
+W64LIT(0xab7f7ddee15b8bfc),
+W64LIT(0x144d426a32a3e495),
+W64LIT(0x8e0a947da5aae78a),
+W64LIT(0x798f2ad831034a4e),
+W64LIT(0x3be48afc6ff9fa53),
+W64LIT(0x529c5bff07d5600a),
+W64LIT(0xbee66ce54edb62b3),
+W64LIT(0x931202d1dcc76634),
+W64LIT(0x50c1fd5dc8937a4b),
+W64LIT(0xa4cdb60b0e5fc014),
+W64LIT(0x57f2b11ff17a5952),
+W64LIT(0x47054ac4a8558945),
+W64LIT(0x5a1ddc68d13808fb),
+W64LIT(0x5cfac37b75f22638),
+W64LIT(0xc207acdd897711a5),
+W64LIT(0x289a84d464b33ddf),
+W64LIT(0xc05a0a7f46310be4),
+W64LIT(0xe6a6162f50a57009),
+W64LIT(0x06e71f13a4ca2ec3),
+W64LIT(0x5f733688279731a3),
+W64LIT(0xeb497b5870e721a0),
+W64LIT(0xb667eb7298360a42),
+W64LIT(0xe3c8fccfa60a4951),
+W64LIT(0xe772457ecd867dd3),
+W64LIT(0x6978d103682c9a59),
+W64LIT(0x0def6d77204251a9),
+W64LIT(0xc90fdeb90dff6ecf),
+W64LIT(0xd179a2f5823dd629),
+W64LIT(0x2fa9c8965d5a1ec6),
+W64LIT(0x81b85fa84aaeac62),
+W64LIT(0xdc96cf82a27f8780),
+W64LIT(0x602d05c523e2ff72),
+W64LIT(0x19a22f1d12e1b53c),
+W64LIT(0xe52fe3dc02c06792),
+W64LIT(0x58407aca1e7e12ba),
+W64LIT(0x61f95694bec1f2a8),
+W64LIT(0x48b781114751c2ad),
+W64LIT(0xaaab2e8f7c788626),
+W64LIT(0x04bab9b16b8c3482),
+W64LIT(0x2df46e34921c0487),
+W64LIT(0x1123a88ac40cddcd),
+W64LIT(0xc6bd156ce2fb2527),
+W64LIT(0x7f6835cb95c9648d),
+W64LIT(0x83e5f90a85e8b623),
+W64LIT(0x4f84cd537eb8e1b4),
+W64LIT(0x294ed785f9903005),
+W64LIT(0x1cccc5fde44e8c64),
+W64LIT(0xcb52781bc2b9748e),
+W64LIT(0x1d1896ac796d81be),
+W64LIT(0xb30901926e99331a),
+W64LIT(0xad9862cd4591a53f),
+W64LIT(0xc8db8de890dc6315),
+W64LIT(0x7bd28c7afe45500f),
+W64LIT(0x0adc213519ab72b0),
+W64LIT(0xa8f6882db33e9c67),
+W64LIT(0xb5ee1e81ca531dd9),
+W64LIT(0x201b0343b25e552e),
+W64LIT(0x4036068691bcaa5c),
+W64LIT(0xae11973e17f4b2a4),
+W64LIT(0x9efd6fa6fc85379d),
+W64LIT(0x33650d6bb91492a2),
+W64LIT(0x3a30d9adf2daf789),
+W64LIT(0x0c3b3e26bd615c73),
+W64LIT(0xf651edf4098aa01e),
+W64LIT(0x710ead4fe7ee22bf),
+W64LIT(0x3138abc9765288e3),
+W64LIT(0x9d749a55aee02006),
+W64LIT(0x6e4b9d4151c5b940),
+W64LIT(0x84d6b548bc01953a),
+W64LIT(0x360be78b4fbbabfa),
+W64LIT(0xa22aa918aa95eed7),
+W64LIT(0xedae644bd42d0f63),
+W64LIT(0x46d119953576849f),
+W64LIT(0x6497bc74486ecbf0),
+W64LIT(0xfbbe808329c8f1b7),
+W64LIT(0x4aea27b38817d8ec),
+W64LIT(0x5626e24e6c595488),
+W64LIT(0x056eeae0f6af3958),
+W64LIT(0x4558ec6667139304),
+W64LIT(0x448cbf37fa309ede),
+W64LIT(0x6f9fce10cce6b49a),
+W64LIT(0xa0770fba65d3f496),
+W64LIT(0x671e49871a0bdc6b),
+W64LIT(0xda71d09106b5a943),
+W64LIT(0x08818797d6ed68f1),
+W64LIT(0xa3fefa4937b6e30d),
+W64LIT(0xb080f4613cfc2481),
+W64LIT(0x763de10dde0701a6),
+W64LIT(0x4dd96bf1b1fefbf5),
+W64LIT(0x92c6518041e46bee),
+W64LIT(0x3456412980fdb1bb),
+W64LIT(0x981a70b5584f195e),
+W64LIT(0x3d0395efcb33d490),
+W64LIT(0xba5cd55425575631),
+W64LIT(0x4b3e74e21534d536),
+W64LIT(0x6af124f03a498dc2),
+W64LIT(0x7ebc669a08ea6957),
+W64LIT(0x30ecf898eb718539),
+W64LIT(0xa922db7c2e1d91bd),
+W64LIT(0x7a06df2b63665dd5),
+W64LIT(0xb154a730a1df295b),
+W64LIT(0xfc8dccc11021d2ae),
+W64LIT(0xcfe8c1aaa935400c),
+W64LIT(0x97a8bb60b74b52b6),
+W64LIT(0x18767c4c8fc2b8e6),
+W64LIT(0x9a47d6179709031f),
+W64LIT(0x0000000000000000),
+W64LIT(0xac4c319cd8b2a8e5),
+W64LIT(0xb9d520a7773241aa),
+W64LIT(0xdecb69206d399dc1),
+W64LIT(0x1f45300eb62b9bff),
+W64LIT(0x10f7fbdb592fd017),
+W64LIT(0x3e8a601c9956c30b),
+W64LIT(0x8502e619212298e0),
+W64LIT(0xf5d818075befb785),
+W64LIT(0x547b44eca31f4ec9),
+W64LIT(0x9ca0c90433c32ddc),
+W64LIT(0xe041093cf46f5eca),
+W64LIT(0xa69010a9c119da55),
+W64LIT(0xc769463d7fd828fd),
+W64LIT(0xc4e0b3ce2dbd3f66),
+W64LIT(0x2575e9a344f16c76),
+W64LIT(0x01d453519d230dda),
+W64LIT(0xfa6ad3d2b4ebfc6d),
+W64LIT(0xd5c31b44e9b1e2ab),
+W64LIT(0xf83775707bade62c),
+W64LIT(0xbcbbca47819d78f2),
+W64LIT(0xd79ebde626f7f8ea),
+W64LIT(0x5bc98f394c1b0521),
+W64LIT(0x2246a5e17d184f6f),
+W64LIT(0x12aa5d799669ca56),
+W64LIT(0x5ea765d9bab43c79),
+W64LIT(0x8939d83f9c43c493),
+W64LIT(0x32b15e3a24379f78),
+W64LIT(0xe914ddfabfa13be1),
+W64LIT(0x909bf7228ea271af),
+W64LIT(0x73530bed28a838fe),
+W64LIT(0xd2f05706d058c1b2),
+W64LIT(0xfed06a63df67c8ef),
+W64LIT(0xb43a4dd057701003),
+W64LIT(0xa519e55a937ccdce),
+W64LIT(0x75b414fe8c62163d),
+W64LIT(0xafc5c46f8ad7bf7e),
+W64LIT(0x2392f6b0e03b42b5),
+W64LIT(0x386d7f0f3d9cedc8),
+W64LIT(0x21cf50122f7d58f4),
+W64LIT(0x9b9385460a2a0ec5),
+W64LIT(0x5115ae0c55b07791),
+W64LIT(0x0fb2cbd5ef044be8),
+W64LIT(0xea9d2809edc42c7a),
+W64LIT(0xcc613459fb505797),
+W64LIT(0x426ba0245efab01d),
+W64LIT(0x1599113baf80e94f),
+W64LIT(0x7d3593695a8f7ecc),
+W64LIT(0x0389f5f35265179b),
+W64LIT(0x875f40bbee6482a1),
+W64LIT(0x95f51dc2780d48f7),
+W64LIT(0x7ce1c038c7ac7316),
+W64LIT(0xce3c92fb34164dd6),
+W64LIT(0xcdb5670866735a4d),
+W64LIT(0x8ab02dccce26d308),
+W64LIT(0x914fa47313817c75),
+W64LIT(0x8b647e9d5305ded2),
+W64LIT(0xd82c7633c9f3b302),
+W64LIT(0x728758bcb58b3524),
+W64LIT(0xe8c08eab2282363b),
+W64LIT(0x8fdec72c3889ea50),
+W64LIT(0x2b13712736d62a44),
+W64LIT(0x3cd7c6be5610d94a),
+W64LIT(0x37dfb4dad298a620),
+W64LIT(0x868b13ea73478f7b),
+W64LIT(0xb7b3b82305150798),
+W64LIT(0x0b08726484887f6a),
+W64LIT(0x1bff89bfdda7af7d),
+W64LIT(0x77e9b25c43240c7c),
+W64LIT(0xf0b6f2e7ad408edd),
+W64LIT(0x17c4b79960c6f30e),
+W64LIT(0x8c5732df6aecfdcb),
+W64LIT(0x68ac8252f50f9783),
+W64LIT(0x66ca1ad68728d1b1),
+W64LIT(0x6b2577a1a76a8018),
+W64LIT(0xe21caf9e3b29448b),
+W64LIT(0xa74443f85c3ad78f),
+W64LIT(0xfd599f908d02df74),
+W64LIT(0x967ce8312a685f6c),
+/* box 3 */
+W64LIT(0xfa7b9775ba3af751),
+W64LIT(0x03ef98cb769c2d13),
+W64LIT(0x7191ce067072359e),
+W64LIT(0xbab18b6bff7516a8),
+W64LIT(0xe6e5ef4efbc1065e),
+W64LIT(0x7bec74a3b1d0dbf4),
+W64LIT(0x656b4fb907c31c4a),
+W64LIT(0x4e8520f99fc86304),
+W64LIT(0x8fd8df31d16dae58),
+W64LIT(0x90a93fc1e60a7244),
+W64LIT(0x30ad09f2b449cfc5),
+W64LIT(0x8453be7e91bb5b90),
+W64LIT(0x1d68a3d1c08feaad),
+W64LIT(0x5c54642504b410f6),
+W64LIT(0x8061383c8a9e3707),
+W64LIT(0xf9940fbecca6da42),
+W64LIT(0x46e1d97da982bbdf),
+W64LIT(0xfc50521656f7ad77),
+W64LIT(0x5e4d2704f35c2647),
+W64LIT(0x8bea5973ca48c2cf),
+W64LIT(0xd06323dfa34593bd),
+W64LIT(0x62b651306a7a5dce),
+W64LIT(0xa436b0714966d116),
+W64LIT(0x4f73fb131ebc78a6),
+W64LIT(0x92b07ce011e244f5),
+W64LIT(0x33429139c2d5e2d6),
+W64LIT(0xcee418c515565403),
+W64LIT(0xd7be3d56cefcd239),
+W64LIT(0x53ed83285f4789a9),
+W64LIT(0xf3e9b51b0d043428),
+W64LIT(0x20650e0fd8dd8a86),
+W64LIT(0xb6e7f4add21aa2e4),
+W64LIT(0x6d0fb63d3189c491),
+W64LIT(0x0da0a42cac1bafee),
+W64LIT(0x3f14eeffefba569a),
+W64LIT(0x13279f361a086850),
+W64LIT(0x9b225e8ea6dc878c),
+W64LIT(0x6684d772715f3159),
+W64LIT(0xa3ebaef824df9092),
+W64LIT(0xc499a260d4f4ba69),
+W64LIT(0xaa798c9693e153eb),
+W64LIT(0x50021be329dba4ba),
+W64LIT(0x949bb983fd2f1ed3),
+W64LIT(0xdfdac4d2f8b60ae2),
+W64LIT(0xf0062dd07b98193b),
+W64LIT(0xafbdd13e09b024de),
+W64LIT(0xb95e13a089e93bbb),
+W64LIT(0x649d945386b707e8),
+W64LIT(0xe4fcac6f0c2930ef),
+W64LIT(0x413cc7f4c43bfa5b),
+W64LIT(0x3b2668bdf49f3a0d),
+W64LIT(0xe50a77858d5d2b4d),
+W64LIT(0x05c45da89a517735),
+W64LIT(0x3ee235156ece4d38),
+W64LIT(0xfe491137a11f9bc6),
+W64LIT(0xb7112f47536eb946),
+W64LIT(0x07dd1e896db94184),
+W64LIT(0x1ab5bd58ad36ab29),
+W64LIT(0x8197e3d60bea2ca5),
+W64LIT(0xab8f577c12954849),
+W64LIT(0x9cff4007cb65c608),
+W64LIT(0xa00436335243bd81),
+W64LIT(0xfda689fcd783b6d5),
+W64LIT(0xccfd5be4e2be62b2),
+W64LIT(0x75a348446b575909),
+W64LIT(0x17151974012d04c7),
+W64LIT(0xfb8d4c9f3b4eecf3),
+W64LIT(0xac5249f57f2c09cd),
+W64LIT(0x9346a70a90965f57),
+W64LIT(0x043286421b256c97),
+W64LIT(0x27b81086b564cb02),
+W64LIT(0x3569545a2e18b8f0),
+W64LIT(0x6b24735edd449eb7),
+W64LIT(0x2193d5e559a99124),
+W64LIT(0xc7763aaba268977a),
+W64LIT(0xb0cc31ce3ed7f8c2),
+W64LIT(0xc939064c78ef1587),
+W64LIT(0x16e3c29e80591f65),
+W64LIT(0x5da2bfcf85c00b54),
+W64LIT(0x5990398d9ee567c3),
+W64LIT(0x67720c98f02b2afb),
+W64LIT(0x54309da132fec82d),
+W64LIT(0xeab39088d6aeb212),
+W64LIT(0x9682faa20ac72862),
+W64LIT(0xd38cbb14d5d9beae),
+W64LIT(0x4c9c63d8682055b5),
+W64LIT(0xd648e6bc4f88c99b),
+W64LIT(0xdc355c198e2a27f1),
+W64LIT(0x10c807fd6c944543),
+W64LIT(0x450e41b6df1e96cc),
+W64LIT(0x0b8b614f40d6f5c8),
+W64LIT(0xd27a60fe54ada50c),
+W64LIT(0x49583e70f2712280),
+W64LIT(0x8dc19c10268598e9),
+W64LIT(0x5866e2671f917c61),
+W64LIT(0x79f537824638ed45),
+W64LIT(0xc2b267033839e04f),
+W64LIT(0xcb20456d8f072336),
+W64LIT(0x2a18b4aa197f64ec),
+W64LIT(0xdbe84290e3936675),
+W64LIT(0x73888d27879a032f),
+W64LIT(0xe8aad3a9214684a3),
+W64LIT(0x6ee02ef64715e982),
+W64LIT(0xa996145de57d7ef8),
+W64LIT(0xc8cfdda6f99b0e25),
+W64LIT(0x062bc563eccd5a26),
+W64LIT(0x264ecb6c3410d0a0),
+W64LIT(0xb8a8c84a089d2019),
+W64LIT(0x7dc7b1c05d1d81d2),
+W64LIT(0xd5a77e773914e488),
+W64LIT(0x4b417d5105991431),
+W64LIT(0xf62de8b39755431d),
+W64LIT(0x993b1daf5134b13d),
+W64LIT(0x82787b1d7d7601b6),
+W64LIT(0xe321b2e66190716b),
+W64LIT(0xb5086c66a4868ff7),
+W64LIT(0x9ee603263c8df0b9),
+W64LIT(0x349f8fb0af6ca352),
+W64LIT(0x5b897aac690d5172),
+W64LIT(0x7c316a2adc699a70),
+W64LIT(0xd451a59db860ff2a),
+W64LIT(0x706715ecf1062e3c),
+W64LIT(0x838ea0f7fc021a14),
+W64LIT(0x57df056a4462e53e),
+W64LIT(0xcf12c32f94224fa1),
+W64LIT(0xed6e8e01bb17f396),
+W64LIT(0x915fe42b677e69e6),
+W64LIT(0x89f31a523da0f47e),
+W64LIT(0xe71334a47ab51dfc),
+W64LIT(0xa860cfb76409655a),
+W64LIT(0x9f10d8ccbdf9eb1b),
+W64LIT(0xef77cd204cffc527),
+W64LIT(0xf862d4544dd2c1e0),
+W64LIT(0x8a1c82994b3cd96d),
+W64LIT(0xae4b0ad488c43f7c),
+W64LIT(0x98cdc645d040aa9f),
+W64LIT(0x7fdef2e1aaf5b763),
+W64LIT(0x4717029728f6a07d),
+W64LIT(0x745593aeea2342ab),
+W64LIT(0xee8116cacd8bde85),
+W64LIT(0x727e56cd06ee188d),
+W64LIT(0x227c4d2e2f35bc37),
+W64LIT(0x977421488bb333c0),
+W64LIT(0xa21d7512a5ab8b30),
+W64LIT(0xbb4750817e010d0a),
+W64LIT(0x6cf96dd7b0fddf33),
+W64LIT(0x2801f78bee97525d),
+W64LIT(0x1c9e783b41fbf10f),
+W64LIT(0x9d099bed4a11ddaa),
+W64LIT(0x7a1aaf4930a4c056),
+W64LIT(0x32b44ad343a1f974),
+W64LIT(0x3cfb763499267b89),
+W64LIT(0xb2d572efc93fce73),
+W64LIT(0x63408adaeb0e466c),
+W64LIT(0xada4921ffe58126f),
+W64LIT(0x5fbbfcee72283de5),
+W64LIT(0x6ad2a8b45c308515),
+W64LIT(0x0c567fc62d6fb44c),
+W64LIT(0x956d62697c5b0571),
+W64LIT(0x25a153a7428cfdb3),
+W64LIT(0x150c5a55f6c53276),
+W64LIT(0xe2d7690ce0e46ac9),
+W64LIT(0xda1e997a62e77dd7),
+W64LIT(0xf5c27078e1c96e0e),
+W64LIT(0xc344bce9b94dfbed),
+W64LIT(0x60af12119d926b7f),
+W64LIT(0xa1f2edd9d337a623),
+W64LIT(0xcad69e870e733894),
+W64LIT(0x3770177bd9f08e41),
+W64LIT(0xa5c06b9bc812cab4),
+W64LIT(0x1f71e0f03767dc1c),
+W64LIT(0x44f89a5c5e6a8d6e),
+W64LIT(0x6159c9fb1ce670dd),
+W64LIT(0x8e2e04db5019b5fa),
+W64LIT(0x8805c1b8bcd4efdc),
+W64LIT(0xe138f1c7967847da),
+W64LIT(0x4ab7a6bb84ed0f93),
+W64LIT(0x0000000000000000),
+W64LIT(0x38c9f0768203171e),
+W64LIT(0x1b4366b22c42b08b),
+W64LIT(0x7803ec68c74cf6e7),
+W64LIT(0xec9855eb3a63e834),
+W64LIT(0xbe830d29e4507a3f),
+W64LIT(0x2dc5aa2374c62568),
+W64LIT(0xa62ff350be8ee7a7),
+W64LIT(0x764cd08f1dcb741a),
+W64LIT(0x8c3747faa7f1834b),
+W64LIT(0x0fb9e70d5bf3995f),
+W64LIT(0x55c6464bb38ad38f),
+W64LIT(0xf7db3359162158bf),
+W64LIT(0xd195f8352231881f),
+W64LIT(0x0992226eb73ec379),
+W64LIT(0x14fa81bf77b129d4),
+W64LIT(0x48aee59a73053922),
+W64LIT(0x2457884dc3f8e611),
+W64LIT(0xffbfcadd206b8064),
+W64LIT(0xb4feb78c25f29455),
+W64LIT(0x864afd5f66536d21),
+W64LIT(0x6f16f51cc661f220),
+W64LIT(0xde2c1f3879c21140),
+W64LIT(0x195a2593dbaa863a),
+W64LIT(0x2e2a32e8025a087b),
+W64LIT(0x432584d533d3ccea),
+W64LIT(0x2c3371c9f5b23eca),
+W64LIT(0xa7d928ba3ffafc05),
+W64LIT(0x42d35f3fb2a7d748),
+W64LIT(0x85a5659410cf4032),
+W64LIT(0x0864f984364ad8db),
+W64LIT(0xf21f6ef18c702f8a),
+W64LIT(0xf1f0f63afaec0299),
+W64LIT(0xd9f101b1147b50c4),
+W64LIT(0x2fdce902832e13d9),
+W64LIT(0x4d6ab832e9544e17),
+W64LIT(0xe0ce2a2d170c5c78),
+W64LIT(0x51f4c009a8afbf18),
+W64LIT(0x68cbeb95abd8b3a4),
+W64LIT(0xc15dffc84ea5cd5c),
+W64LIT(0x02194321f7e836b1),
+W64LIT(0x113edc17ede05ee1),
+W64LIT(0x521b58c2de33920b),
+W64LIT(0x9ad4856427a89c2e),
+W64LIT(0x5629de80c516fe9c),
+W64LIT(0x77ba0b659cbf6fb8),
+W64LIT(0x238a96c4ae41a795),
+W64LIT(0x12d144dc9b7c73f2),
+W64LIT(0xd807da5b950f4b66),
+W64LIT(0x3686cc91588495e3),
+W64LIT(0x18acfe795ade9d98),
+W64LIT(0x5a7fa146e8794ad0),
+W64LIT(0xc680e141231c8cd8),
+W64LIT(0x1e873b1ab613c7be),
+W64LIT(0xf434ab9260bd75ac),
+W64LIT(0xcd0b800e63ca7910),
+W64LIT(0xbc9a4e0813b84c8e),
+W64LIT(0x3d0dadde1852602b),
+W64LIT(0x40ca1c1e454fe1f9),
+W64LIT(0x0a7dbaa5c1a2ee6a),
+W64LIT(0x693d307f2aaca806),
+W64LIT(0x0e4f3ce7da8782fd),
+W64LIT(0xbd6c95e292cc572c),
+W64LIT(0x3ad0b35775eb21af),
+W64LIT(0x7e28290b2b81acc1),
+W64LIT(0x01f6dbea81741ba2),
+W64LIT(0x87bc26b5e7277683),
+W64LIT(0x393f2b9c03770cbc),
+W64LIT(0xddc387f30f5e3c53),
+W64LIT(0xeb454b6257daa9b0),
+W64LIT(0xb323a905484bd5d1),
+W64LIT(0xb13aea24bfa3e360),
+W64LIT(0x315bd218353dd467),
+W64LIT(0x2bee6f40980b7f4e),
+W64LIT(0xe95c0843a0329f01),
+W64LIT(0xc56f798a5580a1cb),
+W64LIT(0xbf75d6c36524619d),
+W64LIT(0x29f72c616fe349ff),
+W64LIT(0xc0ab2422cfd1d6fe),
+/* box 4 */
+W64LIT(0x561fc423e957943c),
+W64LIT(0x014287ca69079288),
+W64LIT(0x2f086129dfcd1d21),
+W64LIT(0xc537d4aea044fd99),
+W64LIT(0xf1e8c3bfd7c8a457),
+W64LIT(0x2971998a5cdf9bfb),
+W64LIT(0x23fa649a2ce9e460),
+W64LIT(0x3aa9e9c356a6716a),
+W64LIT(0xd6efa4e7aa3d1708),
+W64LIT(0x705a24b1fda5b5eb),
+W64LIT(0x101e0ce2b170a9fc),
+W64LIT(0x7ca821020e814caa),
+W64LIT(0x0bc97ada1931ed13),
+W64LIT(0x34df1711778c59ce),
+W64LIT(0xd35020ef9226d2bf),
+W64LIT(0x575d43e9805006b4),
+W64LIT(0x91acebec9b1db840),
+W64LIT(0x549b3f423b5945d9),
+W64LIT(0x99a3ed9d3925163e),
+W64LIT(0x7917a50a369a891d),
+W64LIT(0xe372343cb4b6dc4e),
+W64LIT(0x8d40e2bdd949e8fd),
+W64LIT(0xcfbc29bed0728202),
+W64LIT(0x969794857108ac12),
+W64LIT(0xdd26de3db30cfa1b),
+W64LIT(0x115c8b28d8773b74),
+W64LIT(0xe9f9c92cc480a3d5),
+W64LIT(0x4dc8b21b4116d0d3),
+W64LIT(0x316093194f979c79),
+W64LIT(0x5124bb4a0342806e),
+W64LIT(0xb31408bcdef3cea8),
+W64LIT(0xc1cad76cf158aaa6),
+W64LIT(0x88ff66b5e1522d4a),
+W64LIT(0xa8c37e8476b28a47),
+W64LIT(0x15a188ea896b6c4b),
+W64LIT(0xa24883940684f5dc),
+W64LIT(0xda1da1545919ee49),
+W64LIT(0x22b8e35045ee76e8),
+W64LIT(0x6106af9925d28e9f),
+W64LIT(0xef80318f4792250f),
+W64LIT(0x663dd0f0cfc79acd),
+W64LIT(0x302214d326900ef1),
+W64LIT(0xdfa2255c61022bfe),
+W64LIT(0xe6cdb0348cad19f9),
+W64LIT(0x50663c806a4512e6),
+W64LIT(0x65fbac5b74ced9a0),
+W64LIT(0xc4755364c9436f11),
+W64LIT(0x8fc419dc0b473918),
+W64LIT(0x5c9439339961eba7),
+W64LIT(0x3f166dcb6ebdb4dd),
+W64LIT(0xba59890715ccf25e),
+W64LIT(0xf0aa4475becf36df),
+W64LIT(0x03c67cabbb09436d),
+W64LIT(0xb99ff5acaec5b133),
+W64LIT(0xf9e7c5ce75f00a29),
+W64LIT(0x6df4aa2ad6f677de),
+W64LIT(0xaeba8627f5a00c9d),
+W64LIT(0xa573fcfdec91e18e),
+W64LIT(0x7f6e5da9b5880fc7),
+W64LIT(0xca03adb6e86947b5),
+W64LIT(0x74a72773acb9e2d4),
+W64LIT(0x604428534cd51c17),
+W64LIT(0xf8a542041cf798a1),
+W64LIT(0x448533a08a29ec25),
+W64LIT(0x80f060c4436a8334),
+W64LIT(0x0db082799a236bc9),
+W64LIT(0xfa21b965cef94944),
+W64LIT(0x64b92b911dc94b28),
+W64LIT(0x7118a37b94a22763),
+W64LIT(0xaff801ed9ca79e15),
+W64LIT(0x1dae8e9b2b53c235),
+W64LIT(0x13d870490a79ea91),
+W64LIT(0x8a7b9dd4335cfcaf),
+W64LIT(0x1f2a75faf95d13d0),
+W64LIT(0xeec2b6452e95b787),
+W64LIT(0xc34e2c0d23567b43),
+W64LIT(0x47434f0b3120af48),
+W64LIT(0xa18eff3fbd8db6b1),
+W64LIT(0x98e16a57502284b6),
+W64LIT(0x37196bbacc851aa3),
+W64LIT(0x8e869e166240ab90),
+W64LIT(0x9fda153eba3790e4),
+W64LIT(0xf515c07d86d4f368),
+W64LIT(0x72dedfd02fab640e),
+W64LIT(0xe230b3f6ddb14ec6),
+W64LIT(0x97d5134f180f3e9a),
+W64LIT(0xe1f6cf5d66b80dab),
+W64LIT(0xe78f37fee5aa8b71),
+W64LIT(0xa30a045e6f836754),
+W64LIT(0x90ee6c26f21a2ac8),
+W64LIT(0xaa4785e5a4bc5ba2),
+W64LIT(0x4e0eceb0fa1f93be),
+W64LIT(0x94136fe4a3067df7),
+W64LIT(0x7b935e6be49458f8),
+W64LIT(0x9b2716fceb2bc7db),
+W64LIT(0x840d63061276d40b),
+W64LIT(0xed04caee959cf4ea),
+W64LIT(0xea3fb5877f89e0b8),
+W64LIT(0xb56df01f5de14872),
+W64LIT(0x4935b1d9100a87ec),
+W64LIT(0x82749ba5916452d1),
+W64LIT(0x58693af1c87dbc98),
+W64LIT(0x89bde17f8855bfc2),
+W64LIT(0x677f573aa6c00845),
+W64LIT(0xeb7d324d168e7230),
+W64LIT(0x0284fb61d20ed1e5),
+W64LIT(0xb190f3dd0cfd1f4d),
+W64LIT(0x684b2e22eeedb269),
+W64LIT(0x2bf562eb8ed14a1e),
+W64LIT(0xe0b448970fbf9f23),
+W64LIT(0x396f9568edaf3207),
+W64LIT(0x52e2c7e1b84bc303),
+W64LIT(0x77615bd817b0a1b9),
+W64LIT(0x7e2cda63dc8f9d4f),
+W64LIT(0xf22ebf146cc1e73a),
+W64LIT(0xc08850a6985f382e),
+W64LIT(0xd9dbddffe210ad24),
+W64LIT(0xbfe60d0f2dd737e9),
+W64LIT(0x9a659136822c5553),
+W64LIT(0x87cb1fada97f9766),
+W64LIT(0x4c8a35d12811425b),
+W64LIT(0x83361c6ff863c059),
+W64LIT(0xd212a725fb214037),
+W64LIT(0x9e9892f4d330026c),
+W64LIT(0x45c7b46ae32e7ead),
+W64LIT(0x5baf465a7374fff5),
+W64LIT(0xdc6459f7da0b6893),
+W64LIT(0xd46b5f867833c6ed),
+W64LIT(0x5dd6bef9f066792f),
+W64LIT(0xcb412a7c816ed53d),
+W64LIT(0x75e5a0b9c5be705c),
+W64LIT(0xf6d3bcd63dddb005),
+W64LIT(0xfb633eafa7fedbcc),
+W64LIT(0xd529d84c11345465),
+W64LIT(0xc9c5d11d536004d8),
+W64LIT(0xdb5f269e301e7cc1),
+W64LIT(0x86899867c07805ee),
+W64LIT(0x3d9296aabcb36538),
+W64LIT(0x2cce1d8264c45e4c),
+W64LIT(0x5aedc1901a736d7d),
+W64LIT(0x2e4ae6e3b6ca8fa9),
+W64LIT(0x1e68f230905a8158),
+W64LIT(0xdee0a2960805b976),
+W64LIT(0xcd38d2df027c53e7),
+W64LIT(0x6909a9e887ea20e1),
+W64LIT(0x24c11bf3c6fcf032),
+W64LIT(0x18110a9313480782),
+W64LIT(0xa7f7079c3e9f306b),
+W64LIT(0xd8995a358b173fac),
+W64LIT(0x854fe4cc7b714683),
+W64LIT(0xbd62f66effd9e60c),
+W64LIT(0x14e30f20e06cfec3),
+W64LIT(0x6e32d6816dff34b3),
+W64LIT(0x217e9ffbfee73585),
+W64LIT(0xc88756d73a679650),
+W64LIT(0x359d90db1e8bcb46),
+W64LIT(0x2645e09214f221d7),
+W64LIT(0x04fd03c2511c573f),
+W64LIT(0x739c581a46acf686),
+W64LIT(0xb0d2741765fa8dc5),
+W64LIT(0xa0cc78f5d48a2439),
+W64LIT(0x5e10c2524b6f3a42),
+W64LIT(0xe50bcc9f37a45a94),
+W64LIT(0x53a0402bd14c518b),
+W64LIT(0x413ab7a8b2322992),
+W64LIT(0x203c183197e0a70d),
+W64LIT(0xcc7a55156b7bc16f),
+W64LIT(0x4601c8c158273dc0),
+W64LIT(0xbea48ac544d0a561),
+W64LIT(0x638254f8f7dc5f7a),
+W64LIT(0xa6b580565798a2e3),
+W64LIT(0x3cd01160d5b4f7b0),
+W64LIT(0x8c026577b04e7a75),
+W64LIT(0x7ad1d9a18d93ca70),
+W64LIT(0x785522c05f9d1b95),
+W64LIT(0x5f5245982268a8ca),
+W64LIT(0x9551e82eca01ef7f),
+W64LIT(0x0000000000000000),
+W64LIT(0xbb1b0ecd7ccb60d6),
+W64LIT(0x094d81bbcb3f3cf6),
+W64LIT(0x28331e4035d80973),
+W64LIT(0xf7913b1c54da228d),
+W64LIT(0x6acfd5433ce3638c),
+W64LIT(0x1bd77638a84144ef),
+W64LIT(0x62c0d3329edbcdf2),
+W64LIT(0x81b2e70e2a6d11bc),
+W64LIT(0xd7ad232dc33a8580),
+W64LIT(0x05bf8408381bc5b7),
+W64LIT(0x33e468789d994d9c),
+W64LIT(0xfedcbaa79fe51e7b),
+W64LIT(0x4f4c497a93180136),
+W64LIT(0x073b7f69ea151452),
+W64LIT(0x0cf205b3f324f941),
+W64LIT(0x382d12a284a8a08f),
+W64LIT(0x1cec0951425450bd),
+W64LIT(0x55d9b888525ed751),
+W64LIT(0x6cb62de0bff1e556),
+W64LIT(0xd1d4db8e4028035a),
+W64LIT(0x25839c39affb62ba),
+W64LIT(0x4af3cd72ab03c481),
+W64LIT(0xa4317b3785967306),
+W64LIT(0x1a95f1f2c146d667),
+W64LIT(0x926a97472014fb2d),
+W64LIT(0xb7e90b7e8fef9997),
+W64LIT(0xcefeae74b975108a),
+W64LIT(0x3e54ea0107ba2655),
+W64LIT(0xd0965c44292f91d2),
+W64LIT(0xab05022fcdbbc92a),
+W64LIT(0xfd1ac60c24ec5d16),
+W64LIT(0xfc5841c64debcf9e),
+W64LIT(0xe4494b555ea3c81c),
+W64LIT(0xb6ab8cb4e6e80b1f),
+W64LIT(0x3beb6e093fa1e3e2),
+W64LIT(0xf36c38de05c675b2),
+W64LIT(0x9c1c6995013ed389),
+W64LIT(0x8b391a1e5a5b6e27),
+W64LIT(0xec464d24fc9b6662),
+W64LIT(0xad7cfa8c4ea94ff0),
+W64LIT(0x0f347918482dba2c),
+W64LIT(0x9d5eee5f68394101),
+W64LIT(0x7623dc127eb73331),
+W64LIT(0x32a6efb2f49edf14),
+W64LIT(0x2d8c9a480dc3ccc4),
+W64LIT(0xb2568f76b7f45c20),
+W64LIT(0x0e76fed2212a28a4),
+W64LIT(0x48773613790d1564),
+W64LIT(0x129af783637e7819),
+W64LIT(0x080f0671a238ae7e),
+W64LIT(0x365bec70a582882b),
+W64LIT(0x42fccb03093b6aff),
+W64LIT(0x0a8bfd1070367f9b),
+W64LIT(0xff9e3d6df6e28cf3),
+W64LIT(0xe8bb4ee6ad87315d),
+W64LIT(0xc7b32fcf724a2c7c),
+W64LIT(0xb8dd7266c7c223bb),
+W64LIT(0x9328108d491369a5),
+W64LIT(0x0679f8a3831286da),
+W64LIT(0x270767587df5b35f),
+W64LIT(0xa981f94e1fb518cf),
+W64LIT(0x6b8d528955e4f104),
+W64LIT(0x1667f44132622f26),
+W64LIT(0x2ab7e521e7d6d896),
+W64LIT(0xac3e7d4627aedd78),
+W64LIT(0x7deaa6c86786de22),
+W64LIT(0x1725738b5b65bdae),
+W64LIT(0x4bb14ab8c2045609),
+W64LIT(0x592bbd3ba17a2e10),
+W64LIT(0xc20cabc74a51e9cb),
+W64LIT(0x6f70514b04f8a63b),
+W64LIT(0xbc2071a496de7484),
+W64LIT(0x19538d597a4f950a),
+W64LIT(0xf45747b7efd361e0),
+W64LIT(0x43be4cc9603cf877),
+W64LIT(0xc6f1a8051b4dbef4),
+W64LIT(0xb42f77d534e6dafa),
+W64LIT(0x40783062db35bb1a),
+/* box 5 */
+W64LIT(0xf5a96c292deb0a4e),
+W64LIT(0x211c9df6ee653c51),
+W64LIT(0x04de5ddcbeeef596),
+W64LIT(0xe1e5b06f7457c19f),
+W64LIT(0x74ca30f014a54fb6),
+W64LIT(0xc296f9f7c5457d85),
+W64LIT(0x7d4ee08a484d10b0),
+W64LIT(0xae87f2d0bf9b13ad),
+W64LIT(0x8df4bb480e89afb7),
+W64LIT(0x2d8b7a67d9a2d61e),
+W64LIT(0x0f3559c8bd712adb),
+W64LIT(0x541bc7312f013338),
+W64LIT(0x9ec4848b636d5164),
+W64LIT(0x952f809f60f28e29),
+W64LIT(0x28984d8cb28d6357),
+W64LIT(0xd4b5f1dfc38e361f),
+W64LIT(0x5674135f7076b373),
+W64LIT(0xb791a330042172ec),
+W64LIT(0xab94c53bd4b4a6e4),
+W64LIT(0xf17731f59305ffd8),
+W64LIT(0x39c7a621801e1dcf),
+W64LIT(0x20d1f7c13ba47c8e),
+W64LIT(0x5e3da912f95facaa),
+W64LIT(0xb1202a82e5b80731),
+W64LIT(0x13303fc36de4fed3),
+W64LIT(0x2e29c43e5314168a),
+W64LIT(0x861fbf5c0d1670fa),
+W64LIT(0x6458b16af3f771f1),
+W64LIT(0x3043765bdcf642c9),
+W64LIT(0x12fd55f4b825be0c),
+W64LIT(0x0a266e23d65e9f92),
+W64LIT(0x6595db5d2636312e),
+W64LIT(0x85bd010587a0b06e),
+W64LIT(0x9bd7b3600842e42d),
+W64LIT(0xaa59af0c0175e63b),
+W64LIT(0x240faa1d854a8918),
+W64LIT(0xf464061ef82a4a91),
+W64LIT(0x5c527d7ca6282ce1),
+W64LIT(0x03a2be598ab6c094),
+W64LIT(0x40571b7776bdf8e9),
+W64LIT(0xe4f687841f7874d6),
+W64LIT(0x115febad32937e98),
+W64LIT(0x5108f0da442e8671),
+W64LIT(0x9cab50e53c1ad12f),
+W64LIT(0x33e1c8025640825d),
+W64LIT(0x87d2d56bd8d73025),
+W64LIT(0xc0f92d999a32fdce),
+W64LIT(0x62e938d8126e042c),
+W64LIT(0x4a717554a0e3677b),
+W64LIT(0x0beb0414039fdf4d),
+W64LIT(0xd6da25b19cf9b654),
+W64LIT(0x55d6ad06fac073e7),
+W64LIT(0x632452efc7af44f3),
+W64LIT(0xb5fe775e5b56f2a7),
+W64LIT(0x892ae694b0675a21),
+W64LIT(0x7a32030f7c1525b2),
+W64LIT(0x5d9f174b73e96c3e),
+W64LIT(0xc35b93c010843d5a),
+W64LIT(0x373f95dee8ae77cb),
+W64LIT(0xfb515fd6455b604a),
+W64LIT(0xa9fb11558bc326af),
+W64LIT(0x22be23af64d3fcc5),
+W64LIT(0xa8367b625e026670),
+W64LIT(0xb8a4faf8b9505837),
+W64LIT(0x785dd7612362a5f9),
+W64LIT(0x588c20a018c6d977),
+W64LIT(0xea0eb47b77c81ed2),
+W64LIT(0xa6ce489d36b20c74),
+W64LIT(0x0c97e79137c7ea4f),
+W64LIT(0x7c838abd9d8c506f),
+W64LIT(0x57b97968a5b7f3ac),
+W64LIT(0x6c110b277ade6e28),
+W64LIT(0xc785ce1cae6ac8cc),
+W64LIT(0x1581b6718c7d8b0e),
+W64LIT(0x614b868198d8c4b8),
+W64LIT(0x27ad14440ffc498c),
+W64LIT(0xdb80a8177eff1cc4),
+W64LIT(0x472bf8f242e5cdeb),
+W64LIT(0x8a8858cd3ad19ab5),
+W64LIT(0xf60bd270a75dcada),
+W64LIT(0x43f5a52efc0b387d),
+W64LIT(0x6ddc6110af1f2ef7),
+W64LIT(0xf0ba5bc246c4bf07),
+W64LIT(0x6fb3b57ef068aebc),
+W64LIT(0x18db3bd76e7b219e),
+W64LIT(0x903cb7740bdd3b60),
+W64LIT(0x7bff6938a9d4656d),
+W64LIT(0xbdb7cd13d27fed7e),
+W64LIT(0x051337eb6b2fb549),
+W64LIT(0x77688ea99e138f22),
+W64LIT(0xd9ef7c7921889c8f),
+W64LIT(0x077ce38534583502),
+W64LIT(0xf318e59bcc727f93),
+W64LIT(0xb34ffeecbacf877a),
+W64LIT(0xe9ac0a22fd7ede46),
+W64LIT(0xfc2dbc5371035548),
+W64LIT(0x026fd46e5f77804b),
+W64LIT(0xe53bedb3cab93409),
+W64LIT(0xcc6eca08adf51781),
+W64LIT(0xe028da58a1968140),
+W64LIT(0x3a6518780aa8dd5b),
+W64LIT(0xce011e66f28297ca),
+W64LIT(0xa4a19cf369c58c3f),
+W64LIT(0xc5ea1a72f11d4887),
+W64LIT(0xc427704524dc0858),
+W64LIT(0x4238cf1929ca78a2),
+W64LIT(0x481ea13aff94e730),
+W64LIT(0xdf5ef5cbc011e952),
+W64LIT(0x80ae36eeec8f0527),
+W64LIT(0x5ae3f4ce47b1593c),
+W64LIT(0xcda3a03f7834575e),
+W64LIT(0x71d9071b7f8afaff),
+W64LIT(0xcadf43ba4c6c625c),
+W64LIT(0x1623082806cb4b9a),
+W64LIT(0x17ee621fd30a0b45),
+W64LIT(0x448946abc8530d7f),
+W64LIT(0x974054f13f850e62),
+W64LIT(0x73b6d37520fd7ab4),
+W64LIT(0xc8b097d4131be217),
+W64LIT(0x9f09eebcb6ac11bb),
+W64LIT(0x45442c9c1d924da0),
+W64LIT(0x1b79858ee4cde10a),
+W64LIT(0x0984d07a5ce85f06),
+W64LIT(0x4cc0fce6417a12a6),
+W64LIT(0x99b8670e57356466),
+W64LIT(0xad254c89352dd339),
+W64LIT(0x322ca2358381c282),
+W64LIT(0xcfcc74512743d715),
+W64LIT(0x6b6de8a24e865b2a),
+W64LIT(0xda4dc220ab3e5c1b),
+W64LIT(0x88e78ca365a61afe),
+W64LIT(0x939e092d816bfbf4),
+W64LIT(0xcb12298d99ad2283),
+W64LIT(0xeed0e9a7c926eb44),
+W64LIT(0x98750d3982f424b9),
+W64LIT(0xd5789be8164f76c0),
+W64LIT(0xbe15734a58c92dea),
+W64LIT(0x49d3cb0d2a55a7ef),
+W64LIT(0x67fa0f337941b165),
+W64LIT(0x8c39d17fdb48ef68),
+W64LIT(0x25c2c02a508bc9c7),
+W64LIT(0x349d2b876218b75f),
+W64LIT(0x70146d2caa4bba20),
+W64LIT(0x1c05660bd095d408),
+W64LIT(0xfe42683d2e74d503),
+W64LIT(0x9a1ad957dd83a4f2),
+W64LIT(0xf2d58fac19b33f4c),
+W64LIT(0x81635cd9394e45f8),
+W64LIT(0xb65cc907d1e03233),
+W64LIT(0xdd3121a59f666919),
+W64LIT(0x318e1c6c09370216),
+W64LIT(0x8b4532faef10da6a),
+W64LIT(0x191651e0bbba6141),
+W64LIT(0x3f762f9361876812),
+W64LIT(0xb96990cf6c9118e8),
+W64LIT(0xb4331d698e97b278),
+W64LIT(0xd822164ef449dc50),
+W64LIT(0x84706b325261f0b1),
+W64LIT(0x4eaf28881e0d92ed),
+W64LIT(0x69023ccc11f1db61),
+W64LIT(0x66376504ac80f1ba),
+W64LIT(0x0849ba4d89291fd9),
+W64LIT(0xff8f020afbb595dc),
+W64LIT(0x50c59aed91efc6ae),
+W64LIT(0x1dc80c3c055494d7),
+W64LIT(0x1e6ab2658fe25443),
+W64LIT(0x3d19fbfd3ef0e859),
+W64LIT(0xfa9c35e1909a2095),
+W64LIT(0x52aa4e83ce9846e5),
+W64LIT(0x419a7140a37cb836),
+W64LIT(0xa07fc12fd72b79a9),
+W64LIT(0x68cf56fbc4309bbe),
+W64LIT(0x01cd6a37d5c140df),
+W64LIT(0x9253631a54aabb2b),
+W64LIT(0xd06bac037d60c389),
+W64LIT(0x295527bb674c2388),
+W64LIT(0xd204786d221743c2),
+W64LIT(0x0000000000000000),
+W64LIT(0xf7c6b847729c8a05),
+W64LIT(0xdcfc4b924aa729c6),
+W64LIT(0xe38a64012b2041d4),
+W64LIT(0xb28294db6f0ec7a5),
+W64LIT(0x9d663ad2e9db91f0),
+W64LIT(0x91f1dd43de1c7bbf),
+W64LIT(0x6086ecb64d198467),
+W64LIT(0x59414a97cd0799a8),
+W64LIT(0xace826bee0ec93e6),
+W64LIT(0xa56cf6c4bc04cce0),
+W64LIT(0x727bb942f53c3a6b),
+W64LIT(0x6e7edf4925a9ee63),
+W64LIT(0x26607e73da3d0953),
+W64LIT(0xe75439dd95ceb442),
+W64LIT(0x7990bd56f6a3e526),
+W64LIT(0xecbf3dc996516b0f),
+W64LIT(0x76a5e49e4bd2cffd),
+W64LIT(0x968d3ec6ea444ebd),
+W64LIT(0x5b2e9ef9927019e3),
+W64LIT(0x6aa082959b471bf5),
+W64LIT(0xbb0644a133e698a3),
+W64LIT(0x830c88b76639c5b3),
+W64LIT(0xe2470e36fee1010b),
+W64LIT(0xb0ed40b5307947ee),
+W64LIT(0x355041b0b7d9f780),
+W64LIT(0x8e560511843f6f23),
+W64LIT(0x7f2134e4173a90fb),
+W64LIT(0x2af799e2edfae31c),
+W64LIT(0x4bbc1f63752227a4),
+W64LIT(0xf8f3e18fcfeda0de),
+W64LIT(0x0d5a8da6e206aa90),
+W64LIT(0x2c4610500c6396c1),
+W64LIT(0xde939ffc15d0a98d),
+W64LIT(0xaf4a98e76a5a5372),
+W64LIT(0x8f9b6f2651fe2ffc),
+W64LIT(0x36f2ffe93d6f3714),
+W64LIT(0x0ef833ff68b06a04),
+W64LIT(0xe69953ea400ff49d),
+W64LIT(0x23734998b112bc1a),
+W64LIT(0x3ebb45a4b44628cd),
+W64LIT(0x1ab4efb9310ca1d5),
+W64LIT(0x2fe4ae0986d55655),
+W64LIT(0xebc3de4ca2095e0d),
+W64LIT(0x536724b41b59063a),
+W64LIT(0x46e692c597248d34),
+W64LIT(0x2b3af3d5383ba3c3),
+W64LIT(0x3ba8724fdf699d84),
+W64LIT(0xc13447ae4ff3bd11),
+W64LIT(0x4d0d96d194bb5279),
+W64LIT(0xfde0d664a4c21597),
+W64LIT(0xd7174f864938f68b),
+W64LIT(0x7eec5ed3c2fbd024),
+W64LIT(0xbfd8197d8d086d35),
+W64LIT(0x4f6242bfcbccd232),
+W64LIT(0xa70322aae3734cab),
+W64LIT(0xa3dd7f765d9db93d),
+W64LIT(0x94e2eaa8b533cef6),
+W64LIT(0x144cdc4659bccbd1),
+W64LIT(0xc648a42b7bab8813),
+W64LIT(0xf93e8bb81a2ce001),
+W64LIT(0xbacb2e96e627d87c),
+W64LIT(0xbc7aa72407beada1),
+W64LIT(0xc97dfde3c6daa2c8),
+W64LIT(0xa1b2ab1802ea3976),
+W64LIT(0x1fa7d8525a23149c),
+W64LIT(0x75075ac7c1640f69),
+W64LIT(0xe861601528bf9e99),
+W64LIT(0xa2101541885cf9e2),
+W64LIT(0xef1d83901ce7ab9b),
+W64LIT(0x06b189b2e19975dd),
+W64LIT(0x380acc1655df5d10),
+W64LIT(0x1092819ae7523e47),
+W64LIT(0xd3c9125af7d6031d),
+W64LIT(0xd1a6c634a8a18356),
+W64LIT(0x5ff0c3252c9eec75),
+W64LIT(0x82c1e280b3f8856c),
+W64LIT(0xed7257fe43902bd0),
+W64LIT(0x3cd491caeb31a886),
+/* box 6 */
+W64LIT(0x94af9eb6fad9e7df),
+W64LIT(0x9208ae5e03c94ddd),
+W64LIT(0x1d8de8d67158480b),
+W64LIT(0xfd093cd2ba147af8),
+W64LIT(0xa45ceb22e6597ccf),
+W64LIT(0x9bbde6e77bf113da),
+W64LIT(0xe4edf4b465fffe5c),
+W64LIT(0x7125622e4e8d2a2f),
+W64LIT(0x1791b81b8f68430d),
+W64LIT(0xb56a63d1902195c0),
+W64LIT(0xa980832b30d2ee67),
+W64LIT(0x4c0a7fb384862397),
+W64LIT(0xed58bc0d1dc7a05b),
+W64LIT(0x5955d7f05c4d0637),
+W64LIT(0xd2b9b1c8806fcf4e),
+W64LIT(0x06a730e8f910aa02),
+W64LIT(0xb8b60bd846aa0768),
+W64LIT(0x45bf370afcbe7d90),
+W64LIT(0x16f6b0375ec370a1),
+W64LIT(0x892276608b81afd4),
+W64LIT(0xdcccc1b5d0ec08e7),
+W64LIT(0xe856949162df5f58),
+W64LIT(0x82592e81a41a977e),
+W64LIT(0xac8eabb74fca1164),
+W64LIT(0xfac9041692afe356),
+W64LIT(0x3b882d75331ba3ba),
+W64LIT(0xa39cd3e6cee2e561),
+W64LIT(0xd077a190d7cca9e3),
+W64LIT(0x9c7dde23534a8a74),
+W64LIT(0x80973ed9f3b9f1d3),
+W64LIT(0xce535132209cb4e9),
+W64LIT(0xaa299b5fb6dabb66),
+W64LIT(0x2d7e9d426dd8d31b),
+W64LIT(0x8a8b6e140d89fad5),
+W64LIT(0x6ca88af83fd56224),
+W64LIT(0xf5db7c4713871753),
+W64LIT(0xeef1a4799bcff55a),
+W64LIT(0x76e55aea6636b381),
+W64LIT(0x8ee24ea4a33a367a),
+W64LIT(0x25acddd7c44bbeb0),
+W64LIT(0x9adaeecbaa5a2076),
+W64LIT(0x0e75707d5083c7a9),
+W64LIT(0x2bd9adaa94c87919),
+W64LIT(0x19e4c866dfeb84a4),
+W64LIT(0x129f9087f070bc0e),
+W64LIT(0xd9c2e929aff4f7e4),
+W64LIT(0x6f01928cb9dd3725),
+W64LIT(0x39463d2d64b8c517),
+W64LIT(0xebff8ce5e4d70a59),
+W64LIT(0xb40d6bfd418aa66c),
+W64LIT(0xf21b44833b3c8efd),
+W64LIT(0x3654457ce5903112),
+W64LIT(0x431807e205aed792),
+W64LIT(0xb10343613e92596f),
+W64LIT(0x0a1c50cdfe300b06),
+W64LIT(0x778252c6b79d802d),
+W64LIT(0x0cbb60250720a104),
+W64LIT(0xe1e3dc281ae7015f),
+W64LIT(0x0f1278518128f405),
+W64LIT(0x47712752ab1d1b3d),
+W64LIT(0xe24ac45c9cef545e),
+W64LIT(0x1ceae0faa0f37ba7),
+W64LIT(0x9814fe93fdf946db),
+W64LIT(0xec3fb421cc6c93f7),
+W64LIT(0x833e26ad75b1a4d2),
+W64LIT(0x6b68b23c176efb8a),
+W64LIT(0x4904572ffb9edc94),
+W64LIT(0x4bca4777ac3dba39),
+W64LIT(0x2762cd8f93e8d81d),
+W64LIT(0x9eb3ce7b04e9ecd9),
+W64LIT(0xc2e8311727bc15ed),
+W64LIT(0xea9884c9357c39f5),
+W64LIT(0xfc6e34fe6bbf4954),
+W64LIT(0x13f898ab21db8fa2),
+W64LIT(0xb7a47389c782f36d),
+W64LIT(0x7b3932e3b0bd2129),
+W64LIT(0xaf27b3c3c9c24465),
+W64LIT(0xb6c37ba51629c0c1),
+W64LIT(0x84fe1e695d0a3d7c),
+W64LIT(0x1a4dd01259e3d1a5),
+W64LIT(0xab4e9373677188ca),
+W64LIT(0x90c6be06546a2b70),
+W64LIT(0xf37c4cafea97bd51),
+W64LIT(0x647aca6d96460f8f),
+W64LIT(0x4ec46febd325453a),
+W64LIT(0x3e8605e94c035cb9),
+W64LIT(0x0ddc6809d68b92a8),
+W64LIT(0x8bec6638dc22c979),
+W64LIT(0x67d3d219104e5a8e),
+W64LIT(0x2abea58645634ab5),
+W64LIT(0x5b9bc7a80bee609a),
+W64LIT(0x936fa672d2627e71),
+W64LIT(0x7d9e020b49ad8b2b),
+W64LIT(0x5832dfdc8de6359b),
+W64LIT(0xc7e6198b58a4eaee),
+W64LIT(0xd41e8120797f654c),
+W64LIT(0xf4bc746bc22c24ff),
+W64LIT(0xe084d404cb4c32f3),
+W64LIT(0x48635f032a35ef38),
+W64LIT(0x8757061ddb02687d),
+W64LIT(0x522e8f1173d63e9d),
+W64LIT(0xbcdf2b68e819cbc7),
+W64LIT(0xbf76331c6e119ec6),
+W64LIT(0x08d24095a9936dab),
+W64LIT(0x728c7a5ac8857f2e),
+W64LIT(0xd110a9bc06679a4f),
+W64LIT(0x1f43f88e26fb2ea6),
+W64LIT(0xb2aa5b15b89a0c6e),
+W64LIT(0x4aad4f5b7d968995),
+W64LIT(0x9fd4c657d542df75),
+W64LIT(0x323d65cc4b23fdbd),
+W64LIT(0xc38f393bf6172641),
+W64LIT(0xa152c3be994183cc),
+W64LIT(0x9d1ad60f82e1b9d8),
+W64LIT(0xe744ecc0e3f7ab5d),
+W64LIT(0x38213501b513f6bb),
+W64LIT(0xade9a39b9e6122c8),
+W64LIT(0x37334d50343b02be),
+W64LIT(0x55eeb7d55b6da733),
+W64LIT(0x970686c27cd1b2de),
+W64LIT(0x427f0fced405e43e),
+W64LIT(0xc026214f701f7340),
+W64LIT(0x40b11f9683a68293),
+W64LIT(0x02ce105857a366ad),
+W64LIT(0x7e371a7fcfa5de2a),
+W64LIT(0xffc72c8aedb71c55),
+W64LIT(0x68c1aa489166ae8b),
+W64LIT(0xc68111a7890fd942),
+W64LIT(0x79f722bbe71e4784),
+W64LIT(0xd579890ca8d456e0),
+W64LIT(0x70426a029f261983),
+W64LIT(0xb0644b4def396ac3),
+W64LIT(0xdb0cf971f8579149),
+W64LIT(0x5489bff98ac6949f),
+W64LIT(0x046920b0aeb3ccaf),
+W64LIT(0x7cf90a279806b887),
+W64LIT(0x050e289c7f18ff03),
+W64LIT(0x651dc24147ed3c23),
+W64LIT(0x5e95ef3474f69f99),
+W64LIT(0x6dcf82d4ee7e5188),
+W64LIT(0x8f854688729105d6),
+W64LIT(0x81f036f52212c27f),
+W64LIT(0xb9d103f4970134c4),
+W64LIT(0x5349873da27d0d31),
+W64LIT(0x20a2f54bbb5341b3),
+W64LIT(0xf0d554db6c9fe850),
+W64LIT(0x07c038c428bb99ae),
+W64LIT(0x30f375941c809b10),
+W64LIT(0x3fe10dc59da86f15),
+W64LIT(0x46162f7e7ab62891),
+W64LIT(0xe623e4ec325c98f1),
+W64LIT(0xfea024a63c1c2ff9),
+W64LIT(0x349a5524b23357bf),
+W64LIT(0x35fd5d0863986413),
+W64LIT(0x96618eeead7a8172),
+W64LIT(0xcb5d79ae5f844bea),
+W64LIT(0x21c5fd676af8721f),
+W64LIT(0x5720a78d0ccec19e),
+W64LIT(0xf6726433958f4252),
+W64LIT(0x8d4b56d02532637b),
+W64LIT(0x24cbd5fb15e08d1c),
+W64LIT(0x3aef2559e2b09016),
+W64LIT(0x5afccf84da455336),
+W64LIT(0x51879765f5de6b9c),
+W64LIT(0x2917bdf2c36b1fb4),
+W64LIT(0xa7f5f356605129ce),
+W64LIT(0xc1412963a1b440ec),
+W64LIT(0x3d2f1d9dca0b09b8),
+W64LIT(0xa53be30e37f24f63),
+W64LIT(0x5ff2e718a55dac35),
+W64LIT(0xa2fbdbca1f49d6cd),
+W64LIT(0xf7156c1f442471fe),
+W64LIT(0x7a5e3acf61161285),
+W64LIT(0xca3a71828e2f7846),
+W64LIT(0x1b2ad83e8848e209),
+W64LIT(0xa8e78b07e179ddcb),
+W64LIT(0xef96ac554a64c6f6),
+W64LIT(0x0000000000000000),
+W64LIT(0x6013eadd38f5c320),
+W64LIT(0x3c4815b11ba03a14),
+W64LIT(0x09b548b978385e07),
+W64LIT(0x226ce513ecf0271e),
+W64LIT(0x63baf2a9befd9621),
+W64LIT(0x44d83f262d154e3c),
+W64LIT(0xcdfa4946a694e1e8),
+W64LIT(0x113688f37678e90f),
+W64LIT(0x859916458ca10ed0),
+W64LIT(0xc52809d30f078c43),
+W64LIT(0x4d6d779f552d103b),
+W64LIT(0x1e24f0a2f7501d0a),
+W64LIT(0x0167082cd1ab33ac),
+W64LIT(0x1438a06f0960160c),
+W64LIT(0xf9601c6214a7b657),
+W64LIT(0xa035cb9248eab060),
+W64LIT(0x50e09f4924755830),
+W64LIT(0xd7b79954ff77304d),
+W64LIT(0xe58afc98b454cdf0),
+W64LIT(0x03a9187486085501),
+W64LIT(0x62ddfa856f56a58d),
+W64LIT(0xc44f01ffdeacbfef),
+W64LIT(0x73eb7276192e4c82),
+W64LIT(0xd6d091782edc03e1),
+W64LIT(0xfbae0c3a4304d0fa),
+W64LIT(0x9973f6bf2c527577),
+W64LIT(0x105180dfa7d3daa3),
+W64LIT(0x2605c5a34243ebb1),
+W64LIT(0x91a1b62a85c118dc),
+W64LIT(0xc99369f608272d47),
+W64LIT(0x5d3cf740f2feca98),
+W64LIT(0xcf34591ef1378745),
+W64LIT(0xc8f461dad98c1eeb),
+W64LIT(0x0b7b58e12f9b38aa),
+W64LIT(0xe32dcc704d4467f2),
+W64LIT(0x754c429ee03ee680),
+W64LIT(0xd3deb9e451c4fce2),
+W64LIT(0x6e669aa068760489),
+W64LIT(0x66b4da35c1e56922),
+W64LIT(0x4fa367c7028e7696),
+W64LIT(0xba781b80110961c5),
+W64LIT(0x41d617ba520db13f),
+W64LIT(0x335a6de09a88ce11),
+W64LIT(0xdf65d9c156e45de6),
+W64LIT(0xcc9d416a773fd244),
+W64LIT(0x5c5bff6c2355f934),
+W64LIT(0x2870b5de12c02c18),
+W64LIT(0x155fa843d8cb25a0),
+W64LIT(0x78902a9736b57428),
+W64LIT(0xae40bbef186977c9),
+W64LIT(0x88457e4c5a2a9c78),
+W64LIT(0x6a0fba10c6c5c826),
+W64LIT(0x7f5012531e0eed86),
+W64LIT(0x8c2c5efcf49950d7),
+W64LIT(0x31947db8cd2ba8bc),
+W64LIT(0x2c19956ebc73e0b7),
+W64LIT(0x230bed3f3d5b14b2),
+W64LIT(0x69a6a26440cd9d27),
+W64LIT(0x86300e310aa95bd1),
+W64LIT(0xb3cd533969313fc2),
+W64LIT(0x1883c04a0e40b708),
+W64LIT(0xf1b25cf7bd34dbfc),
+W64LIT(0x2fb08d1a3a7bb5b6),
+W64LIT(0xd8a5e1057e5fc448),
+W64LIT(0xddabc99901473b4b),
+W64LIT(0xde02d1ed874f6e4a),
+W64LIT(0xbdb8234439b2f86b),
+W64LIT(0x5647afa1dd65f232),
+W64LIT(0x2ed78536ebd0861a),
+W64LIT(0xe9319cbdb3746cf4),
+W64LIT(0xa692fb7ab1fa1a62),
+W64LIT(0x742b4ab23195d52c),
+W64LIT(0x95c8969a2b72d473),
+W64LIT(0x6174e2f1e95ef08c),
+W64LIT(0xf807144ec50c85fb),
+W64LIT(0xbe113b30bfbaad6a),
+W64LIT(0xda6bf15d29fca2e5),
+W64LIT(0xbb1f13acc0a25269),
+/* box 7 */
+W64LIT(0xc22b27f0f9e37bf9),
+W64LIT(0x93fad23f0955ef09),
+W64LIT(0x32ed4b84a22a91a2),
+W64LIT(0x3898b57bcc61b1cc),
+W64LIT(0x55825ba9ad98e5ad),
+W64LIT(0xb2eeb8069421ec94),
+W64LIT(0xc7eb5875ce3c6bce),
+W64LIT(0x4b1dac5d1f45851f),
+W64LIT(0xc16ba1204705d847),
+W64LIT(0xc5380f461a2ba91a),
+W64LIT(0xb908971a909bad90),
+W64LIT(0x303e1cb7763d5376),
+W64LIT(0xe6ff324c53486853),
+W64LIT(0x6d1aeed261f95461),
+W64LIT(0x0193d1e36af1616a),
+W64LIT(0x51d1f5cff0b694f0),
+W64LIT(0x29b2c3f52728e127),
+W64LIT(0x112a768eeb4950eb),
+W64LIT(0x8fb672f86f9f4d6f),
+W64LIT(0xf0c66c745bc9ea5b),
+W64LIT(0x3f8b9dcd2fa9632f),
+W64LIT(0x65bc471edba5b6db),
+W64LIT(0x4d9d5508967c3696),
+W64LIT(0x3a4be24818767318),
+W64LIT(0x2794936c144db014),
+W64LIT(0x2af2452599ce4299),
+W64LIT(0x4a8e7dbe75b4e475),
+W64LIT(0x9ddc82a63a30be3a),
+W64LIT(0xade29e114c0ded4c),
+W64LIT(0xd1d2064dc6bde9c6),
+W64LIT(0x7da349bfe04165e0),
+W64LIT(0x6b9a1787e8c0e7e8),
+W64LIT(0xa54437ddf6510ff6),
+W64LIT(0x2254ece92392a023),
+W64LIT(0x79f0e7d9bd6f14bd),
+W64LIT(0x57510c9a798f2779),
+W64LIT(0x346db2d12b13222b),
+W64LIT(0x54118a4ac76984c7),
+W64LIT(0xefca4a6383e5eb83),
+W64LIT(0xca8d8e3c43bf9943),
+W64LIT(0xfc336bdebcbb79bc),
+W64LIT(0x3e184c2e45580245),
+W64LIT(0xf495c21206e79b06),
+W64LIT(0xff73ed0e025dda02),
+W64LIT(0x4228d472cfe806cf),
+W64LIT(0xbcc8e89fa744bda7),
+W64LIT(0xab626744c5345ec5),
+W64LIT(0xb6bd1660c90f9dc9),
+W64LIT(0xb72ec783a3fefca3),
+W64LIT(0x8be5dc9e32b13c32),
+W64LIT(0x485d2a8da1a326a1),
+W64LIT(0xc6788996a4cd0aa4),
+W64LIT(0x40fb83411bffc41b),
+W64LIT(0x08a6a9ccba5ce2ba),
+W64LIT(0xf386eaa4e52f49e5),
+W64LIT(0x1acc5992eff311ef),
+W64LIT(0xa2571f6b1599dd15),
+W64LIT(0x44a82d2746d1b546),
+W64LIT(0x70c59ff66dc2976d),
+W64LIT(0x8d6525cbbb888fbb),
+W64LIT(0x963aadba3e8aff3e),
+W64LIT(0x7c30985c8ab0048a),
+W64LIT(0x607c389bec7aa6ec),
+W64LIT(0xa822e1947bd2fd7b),
+W64LIT(0x034086d0bee6a3be),
+W64LIT(0x66fcc1ce65431565),
+W64LIT(0xb37d69e5fed08dfe),
+W64LIT(0x2f323aa0ae1152ae),
+W64LIT(0x56c2dd79137e4613),
+W64LIT(0x31adcd541ccc321c),
+W64LIT(0xdff456d4f5d8b8f5),
+W64LIT(0xf9f3145b8b64698b),
+W64LIT(0x764566a3e4fb24e4),
+W64LIT(0x0cf507aae77293e7),
+W64LIT(0x59775c034aea764a),
+W64LIT(0xb89b46f9fa6accfa),
+W64LIT(0xe8d962d5602d3960),
+W64LIT(0x17aa8fdb6270e362),
+W64LIT(0x1c4ca0c766caa266),
+W64LIT(0x2de16d937a06907a),
+W64LIT(0x2547c45fc05a72c0),
+W64LIT(0x0fb5817a59943059),
+W64LIT(0x0680f9558939b389),
+W64LIT(0x16395e3808818208),
+W64LIT(0xac714ff226fc8c26),
+W64LIT(0xa9b1307711239c11),
+W64LIT(0xec8accb33d03483d),
+W64LIT(0x6c893f310b08350b),
+W64LIT(0xc4abdea570dac870),
+W64LIT(0xba4811ca2e7d0e2e),
+W64LIT(0xf155bd9731388b31),
+W64LIT(0xdd2701e721cf7a21),
+W64LIT(0xe94ab3360adc580a),
+W64LIT(0x23c73d0a4963c149),
+W64LIT(0x5cb723867d35667d),
+W64LIT(0x5042242c9a47f59a),
+W64LIT(0x198cdf425115b251),
+W64LIT(0x0a75feff6e4b206e),
+W64LIT(0xfda0ba3dd64a18d6),
+W64LIT(0xcede205a1e91e81e),
+W64LIT(0xd041d7aeac4c88ac),
+W64LIT(0xe42c657f875faa87),
+W64LIT(0x36bee5e2ff04e0ff),
+W64LIT(0x6fc9b9e1b5ee96b5),
+W64LIT(0x998f2cc0671ecf67),
+W64LIT(0xd301517e12aa2b12),
+W64LIT(0xaea218c1f2eb4ef2),
+W64LIT(0xda342951c207a8c2),
+W64LIT(0x61efe978868bc786),
+W64LIT(0x7f701e8c3456a734),
+W64LIT(0x0be62f1c04ba4104),
+W64LIT(0x9129850cdd422ddd),
+W64LIT(0xd6c12efb25753b25),
+W64LIT(0xe33f4dc964977864),
+W64LIT(0x1579d8e8b66721b6),
+W64LIT(0xf860c5b8e19508e1),
+W64LIT(0x7496319030ece630),
+W64LIT(0x88a55a4e8c579f8c),
+W64LIT(0xcf4df1b974608974),
+W64LIT(0x10b9a76d81b83181),
+W64LIT(0x0e26509933655133),
+W64LIT(0x43bb0591a51967a5),
+W64LIT(0x926903dc63a48e63),
+W64LIT(0x9c4f534550c1df50),
+W64LIT(0x3bd833ab72871272),
+W64LIT(0xa4d7e63e9ca06e9c),
+W64LIT(0xb46e41531d185f1d),
+W64LIT(0x126af05e55aff355),
+W64LIT(0x24d415bcaaab13aa),
+W64LIT(0x1e9ff7f4b2dd60b2),
+W64LIT(0x05c07f8537df1037),
+W64LIT(0x467b7a1492c67792),
+W64LIT(0x2087bbdaf78562f7),
+W64LIT(0x819022615cfa1c5c),
+W64LIT(0xcd9ea68aa0774ba0),
+W64LIT(0xa79760ee2246cd22),
+W64LIT(0x8343755288edde88),
+W64LIT(0x58e48de0201b1720),
+W64LIT(0x7216c8c5b9d555b9),
+W64LIT(0x372d340195f58195),
+W64LIT(0xa11799bbab7f7eab),
+W64LIT(0x9f0fd595ee277cee),
+W64LIT(0x676f102d0fb2740f),
+W64LIT(0x9e9c047684d61d84),
+W64LIT(0x49cefb6ecb5247cb),
+W64LIT(0xd41279c8f162f9f1),
+W64LIT(0x1f0c2617d82c01d8),
+W64LIT(0x97a97c59547b9e54),
+W64LIT(0xe76ce3af39b90939),
+W64LIT(0xc3b8f61393121a93),
+W64LIT(0x5ba40b309efdb49e),
+W64LIT(0xea0a35e6b43afbb4),
+W64LIT(0x5a37dad3f40cd5f4),
+W64LIT(0x14ea090bdc9640dc),
+W64LIT(0x5e6474b5a922a4a9),
+W64LIT(0xfee03ced68acbb68),
+W64LIT(0x071328b6e3c8d2e3),
+W64LIT(0x5302a2fc24a15624),
+W64LIT(0x85c38c0701d46d01),
+W64LIT(0x3d58cafefbbea1fb),
+W64LIT(0x84505de46b250c6b),
+W64LIT(0x642f96fdb154d7b1),
+W64LIT(0xbf886e4f19a21e19),
+W64LIT(0x02d35733d417c2d4),
+W64LIT(0x68da915756264456),
+W64LIT(0x8710db34d5c3afd5),
+W64LIT(0x0d66d6498d83f28d),
+W64LIT(0x7b23b0ea6978d669),
+W64LIT(0x1b5f887185027085),
+W64LIT(0x3ccb1b1d914fc091),
+W64LIT(0x0453ae665d2e715d),
+W64LIT(0xcb1e5fdf294ef829),
+W64LIT(0xf6469521d2f059d2),
+W64LIT(0xb03def3540362e40),
+W64LIT(0x633cbe4b529c0552),
+W64LIT(0xf7d544c2b80138b8),
+W64LIT(0x7ab061090389b703),
+W64LIT(0x0000000000000000),
+W64LIT(0xdba7f8b2a8f6c9a8),
+W64LIT(0x35fe633241e24341),
+W64LIT(0x21146a399d74039d),
+W64LIT(0xd581a82b9b93989b),
+W64LIT(0x0935782fd0ad83d0),
+W64LIT(0x5ff7a556c3d3c5c3),
+W64LIT(0xaf31c922981a2f98),
+W64LIT(0x90ba54efb7b34cb7),
+W64LIT(0x5291731f4e50374e),
+W64LIT(0xc0f870c32df4b92d),
+W64LIT(0x7ee3cf6f5ea7c65e),
+W64LIT(0xe07fcb19da71dbda),
+W64LIT(0x4eddd3d8289a9528),
+W64LIT(0x13f921bd3f5e923f),
+W64LIT(0xf50613f16c16fa6c),
+W64LIT(0x981cfd230defae0d),
+W64LIT(0x4c0e84ebfc8d57fc),
+W64LIT(0x82d0a4b1e21cbfe2),
+W64LIT(0x89368bade6a6fee6),
+W64LIT(0xd292809d785b4a78),
+W64LIT(0x47e8abf7f83716f8),
+W64LIT(0x8e25a31b056e2c05),
+W64LIT(0xd752ff184f845a4f),
+W64LIT(0xcc0d7769ca862aca),
+W64LIT(0x694940b43cd7253c),
+W64LIT(0x2ea1eb43c4e033c4),
+W64LIT(0xde6787379f29d99f),
+W64LIT(0x181f0ea13be4d33b),
+W64LIT(0x416852a2710ea571),
+W64LIT(0x62af6fa8386d6438),
+W64LIT(0xa0844858c18e1fc1),
+W64LIT(0x337e9a67c8dbf0c8),
+W64LIT(0x2c72bc7010f7f110),
+W64LIT(0xbd5b397ccdb5dccd),
+W64LIT(0xd8e77e6216106a16),
+W64LIT(0x86830ad7bf32cebf),
+W64LIT(0x4f4e023b426bf442),
+W64LIT(0xe5bfb49cedaecbed),
+W64LIT(0x8a760d7d58405d58),
+W64LIT(0xe2ac9c2a0e66190e),
+W64LIT(0xb5fd90b077e93e77),
+W64LIT(0xdcb4d0044b3e1b4b),
+W64LIT(0x453bfcc42c20d42c),
+W64LIT(0xed191d5057f22957),
+W64LIT(0xe1ec1afab080bab0),
+W64LIT(0xee599b80e9148ae9),
+W64LIT(0x2607428f7ebcd17e),
+W64LIT(0x5d24f26517c40717),
+W64LIT(0x6a09c66482318682),
+W64LIT(0xa604b10d48b7ac48),
+W64LIT(0xbe1bbfac73537f73),
+W64LIT(0x282112164dd9804d),
+W64LIT(0x7505e0735a1d875a),
+W64LIT(0x73851926d32434d3),
+W64LIT(0xd974af817ce10b7c),
+W64LIT(0xeb99e405decb9ade),
+W64LIT(0x9b5c7bf3b3090db3),
+W64LIT(0xfab3928b3582ca35),
+W64LIT(0x8003f382360b7d36),
+W64LIT(0x94e9fa89ea9d3dea),
+W64LIT(0xb1ae3ed62ac74f2a),
+W64LIT(0x9acfaa10d9f86cd9),
+W64LIT(0x390b6498a690d0a6),
+W64LIT(0xf2153b478fde288f),
+W64LIT(0x71564e150733f607),
+W64LIT(0xa3c4ce887f68bc7f),
+W64LIT(0xaaf1b6a7afc53faf),
+W64LIT(0x1ddf71240c3bc30c),
+W64LIT(0x77d6b7408e0a458e),
+W64LIT(0x2b6194c6f33f23f3),
+W64LIT(0xc9cd08ecfd593afd),
+W64LIT(0xc85ed90f97a85b97),
+W64LIT(0x8cf6f428d179eed1),
+W64LIT(0x957a2b6a806c5c80),
+W64LIT(0xbbdbc029448c6f44),
+W64LIT(0x7863363ad79e75d7),
+W64LIT(0x6e5a6802df1ff7df),
+W64LIT(0xfb2043685f73ab5f),
+};
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/simeck.cpp b/runtime/third_party/cryptopp/simeck.cpp
new file mode 100644
index 0000000..363a889
--- /dev/null
+++ b/runtime/third_party/cryptopp/simeck.cpp
@@ -0,0 +1,154 @@
+// simeck.cpp - written and placed in the public domain by Gangqiang Yang and Jeffrey Walton.
+//              Based on "The Simeck Family of Lightweight Block Ciphers" by Gangqiang Yang,
+//              Bo Zhu, Valentin Suder, Mark D. Aagaard, and Guang Gong
+
+#include "pch.h"
+#include "config.h"
+
+#include "simeck.h"
+#include "misc.h"
+#include "cpu.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::rotlConstant;
+using CryptoPP::rotrConstant;
+
+/// \brief SIMECK encryption round
+/// \tparam T word type
+/// \param key the key for the round or iteration
+/// \param left the first value
+/// \param right the second value
+/// \details SIMECK_Encryption serves as the key schedule, encryption and
+///   decryption functions.
+template <class T>
+inline void SIMECK_Encryption(const T key, T& left, T& right)
+{
+    const T temp = left;
+    left = (left & rotlConstant<5>(left)) ^ rotlConstant<1>(left) ^ right ^ key;
+    right = temp;
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+std::string SIMECK32::Base::AlgorithmProvider() const
+{
+    return "C++";
+}
+
+void SIMECK32::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_UNUSED(params);
+    CRYPTOPP_UNUSED(keyLength);
+
+    GetBlock<word16, BigEndian> kblock(userKey);
+    kblock(m_t[3])(m_t[2])(m_t[1])(m_t[0]);
+
+    word16 constant = 0xFFFC;
+    word32 sequence = 0x9A42BB1F;
+    for (unsigned int i = 0; i < ROUNDS; ++i)
+    {
+        m_rk[i] = m_t[0];
+
+        constant &= 0xFFFC;
+        constant |= sequence & 1;
+        sequence >>= 1;
+
+        SIMECK_Encryption(static_cast<word16>(constant), m_t[1], m_t[0]);
+
+        // rotate the LFSR of m_t
+        m_t[4] = m_t[1];
+        m_t[1] = m_t[2];
+        m_t[2] = m_t[3];
+        m_t[3] = m_t[4];
+    }
+}
+
+void SIMECK32::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word16, BigEndian> iblock(inBlock);
+    iblock(m_t[1])(m_t[0]);
+
+    for (int idx = 0; idx < ROUNDS; ++idx)
+        SIMECK_Encryption(m_rk[idx], m_t[1], m_t[0]);
+
+    PutBlock<word16, BigEndian> oblock(xorBlock, outBlock);
+    oblock(m_t[1])(m_t[0]);
+}
+
+void SIMECK32::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word16, BigEndian> iblock(inBlock);
+    iblock(m_t[0])(m_t[1]);
+
+    for (int idx = ROUNDS - 1; idx >= 0; --idx)
+        SIMECK_Encryption(m_rk[idx], m_t[1], m_t[0]);
+
+    PutBlock<word16, BigEndian> oblock(xorBlock, outBlock);
+    oblock(m_t[0])(m_t[1]);
+}
+
+std::string SIMECK64::Base::AlgorithmProvider() const
+{
+    return "C++";
+}
+
+void SIMECK64::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_UNUSED(params);
+    CRYPTOPP_UNUSED(keyLength);
+
+    GetBlock<word32, BigEndian> kblock(userKey);
+    kblock(m_t[3])(m_t[2])(m_t[1])(m_t[0]);
+
+    word64 constant = W64LIT(0xFFFFFFFC);
+    word64 sequence = W64LIT(0x938BCA3083F);
+    for (unsigned int i = 0; i < ROUNDS; ++i)
+    {
+        m_rk[i] = m_t[0];
+
+        constant &= W64LIT(0xFFFFFFFC);
+        constant |= sequence & 1;
+        sequence >>= 1;
+
+        SIMECK_Encryption(static_cast<word32>(constant), m_t[1], m_t[0]);
+
+        // rotate the LFSR of m_t
+        m_t[4] = m_t[1];
+        m_t[1] = m_t[2];
+        m_t[2] = m_t[3];
+        m_t[3] = m_t[4];
+    }
+}
+
+void SIMECK64::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word32, BigEndian> iblock(inBlock);
+    iblock(m_t[1])(m_t[0]);
+
+    for (int idx = 0; idx < ROUNDS; ++idx)
+        SIMECK_Encryption(m_rk[idx], m_t[1], m_t[0]);
+
+    PutBlock<word32, BigEndian> oblock(xorBlock, outBlock);
+    oblock(m_t[1])(m_t[0]);
+}
+
+void SIMECK64::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do not cast the buffer. It will SIGBUS on some ARM and SPARC.
+    GetBlock<word32, BigEndian> iblock(inBlock);
+    iblock(m_t[0])(m_t[1]);
+
+    for (int idx = ROUNDS - 1; idx >= 0; --idx)
+        SIMECK_Encryption(m_rk[idx], m_t[1], m_t[0]);
+
+    PutBlock<word32, BigEndian> oblock(xorBlock, outBlock);
+    oblock(m_t[0])(m_t[1]);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/simeck.h b/runtime/third_party/cryptopp/simeck.h
new file mode 100644
index 0000000..7e76f70
--- /dev/null
+++ b/runtime/third_party/cryptopp/simeck.h
@@ -0,0 +1,162 @@
+// simeck.h - written and placed in the public domain by Gangqiang Yang and Jeffrey Walton.
+//            Based on "The Simeck Family of Lightweight Block Ciphers" by Gangqiang Yang,
+//            Bo Zhu, Valentin Suder, Mark D. Aagaard, and Guang Gong
+
+/// \file simeck.h
+/// \brief Classes for the SIMECK block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/SIMECK">SIMECK</a>,
+///   <a href="https://eprint.iacr.org/2015/612.pdf">The Simeck
+///   Family of Lightweight Block Ciphers</a>
+/// \since Crypto++ 8.0
+
+#ifndef CRYPTOPP_SIMECK_H
+#define CRYPTOPP_SIMECK_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+#include "algparam.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SIMECK block cipher information
+/// \since Crypto++ 8.0
+struct SIMECK32_Info : public FixedBlockSize<4>, public FixedKeyLength<8>, public FixedRounds<32>
+{
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///   member function.
+    static const std::string StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize
+        return "SIMECK-32";
+    }
+};
+
+/// \brief SIMECK block cipher information
+/// \since Crypto++ 8.0
+struct SIMECK64_Info : public FixedBlockSize<8>, public FixedKeyLength<16>, public FixedRounds<44>
+{
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///   member function.
+    static const std::string StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize
+        return "SIMECK-64";
+    }
+};
+
+/// \brief SIMECK 32-bit block cipher
+/// \details SIMECK32 provides 32-bit block size. The valid key size is 64-bit.
+/// \note Crypto++ provides a byte oriented implementation
+/// \sa SIMECK64, <a href="http://www.cryptopp.com/wiki/SIMECK">SIMECK</a>,
+///   <a href="https://eprint.iacr.org/2015/612.pdf">The Simeck Family of
+///   Lightweight Block Ciphers</a>
+/// \since Crypto++ 8.0
+class CRYPTOPP_NO_VTABLE SIMECK32 : public SIMECK32_Info, public BlockCipherDocumentation
+{
+public:
+    /// \brief SIMECK block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<SIMECK32_Info>
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+        std::string AlgorithmProvider() const;
+
+        FixedSizeSecBlock<word16, ROUNDS> m_rk;
+        mutable FixedSizeSecBlock<word16, 5> m_t;
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    /// \brief Decryption transformation
+    /// \details Dec provides implementation for decryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef SIMECK32::Encryption SIMECK32Encryption;
+typedef SIMECK32::Decryption SIMECK32Decryption;
+
+/// \brief SIMECK 64-bit block cipher
+/// \details SIMECK64 provides 64-bit block size. The valid key size is 128-bit.
+/// \note Crypto++ provides a byte oriented implementation
+/// \sa SIMECK32, <a href="http://www.cryptopp.com/wiki/SIMECK">SIMECK</a>,
+///   <a href= "https://eprint.iacr.org/2015/612.pdf">The Simeck Family of
+///   Lightweight Block Ciphers</a>
+/// \since Crypto++ 8.0
+class CRYPTOPP_NO_VTABLE SIMECK64 : public SIMECK64_Info, public BlockCipherDocumentation
+{
+public:
+    /// \brief SIMECK block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<SIMECK64_Info>
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+        std::string AlgorithmProvider() const;
+
+        FixedSizeSecBlock<word32, ROUNDS> m_rk;
+        mutable FixedSizeSecBlock<word32, 5> m_t;
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+#if CRYPTOPP_SIMECK_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    /// \brief Decryption transformation
+    /// \details Dec provides implementation for decryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+
+#if CRYPTOPP_SIMECK_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef SIMECK64::Encryption SIMECK64Encryption;
+typedef SIMECK64::Decryption SIMECK64Decryption;
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_SIMECK_H
diff --git a/runtime/third_party/cryptopp/simon.cpp b/runtime/third_party/cryptopp/simon.cpp
new file mode 100644
index 0000000..e24975f
--- /dev/null
+++ b/runtime/third_party/cryptopp/simon.cpp
@@ -0,0 +1,505 @@
+// simon.h - written and placed in the public domain by Jeffrey Walton
+
+#include "pch.h"
+#include "config.h"
+
+#include "simon.h"
+#include "misc.h"
+#include "cpu.h"
+
+// Uncomment for benchmarking C++ against SSE or NEON.
+// Do so in both simon.cpp and simon_simd.cpp.
+// #undef CRYPTOPP_SSSE3_AVAILABLE
+// #undef CRYPTOPP_SSE41_AVAILABLE
+// #undef CRYPTOPP_ARM_NEON_AVAILABLE
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::rotlConstant;
+using CryptoPP::rotrConstant;
+
+/// \brief Round transformation helper
+/// \tparam W word type
+/// \param v value
+template <class W>
+inline W f(const W v)
+{
+    return (rotlConstant<1>(v) & rotlConstant<8>(v)) ^ rotlConstant<2>(v);
+}
+
+/// \brief Round transformation
+/// \tparam W word type
+/// \param x value
+/// \param y value
+/// \param k value
+/// \param l value
+template <class W>
+inline void R2(W& x, W& y, const W k, const W l)
+{
+    y ^= f(x); y ^= k;
+    x ^= f(y); x ^= l;
+}
+
+/// \brief Forward transformation
+/// \tparam W word type
+/// \tparam R number of rounds
+/// \param c output array
+/// \param p input array
+/// \param k subkey array
+template <class W, unsigned int R>
+inline void SIMON_Encrypt(W c[2], const W p[2], const W k[R])
+{
+    c[0]=p[0]; c[1]=p[1];
+
+    for (int i = 0; i < static_cast<int>(R-1); i += 2)
+        R2(c[0], c[1], k[i], k[i + 1]);
+
+    if (R & 1)
+    {
+        c[1] ^= f(c[0]); c[1] ^= k[R-1];
+        W t = c[0]; c[0] = c[1]; c[1] = t;
+    }
+}
+
+/// \brief Reverse transformation
+/// \tparam W word type
+/// \tparam R number of rounds
+/// \param p output array
+/// \param c input array
+/// \param k subkey array
+template <class W, unsigned int R>
+inline void SIMON_Decrypt(W p[2], const W c[2], const W k[R])
+{
+    p[0]=c[0]; p[1]=c[1];
+    unsigned int rounds = R;
+
+    if (R & 1)
+    {
+        const W t = p[1]; p[1] = p[0]; p[0] = t;
+        p[1] ^= k[R - 1]; p[1] ^= f(p[0]);
+        rounds--;
+    }
+
+    for (int i = static_cast<int>(rounds - 2); i >= 0; i -= 2)
+        R2(p[1], p[0], k[i + 1], k[i]);
+}
+
+/// \brief Subkey generation function
+/// \details Used for SIMON-64 with 96-bit key and 42 rounds. A template was
+///   not worthwhile because all instantiations would need specialization.
+/// \param key empty subkey array
+/// \param k user key array
+inline void SIMON64_ExpandKey_3W(word32 key[42], const word32 k[3])
+{
+    const word32 c = 0xfffffffc;
+    word64 z = W64LIT(0x7369f885192c0ef5);
+
+    key[0] = k[2]; key[1] = k[1]; key[2] = k[0];
+    for (size_t i = 3; i<42; ++i)
+    {
+        key[i] = static_cast<word32>(c ^ (z & 1) ^ key[i - 3] ^
+            rotrConstant<3>(key[i - 1]) ^ rotrConstant<4>(key[i - 1]));
+        z >>= 1;
+    }
+}
+
+/// \brief Subkey generation function
+/// \details Used for SIMON-64 with 128-bit key and 44 rounds. A template was
+///   not worthwhile because all instantiations would need specialization.
+/// \param key empty subkey array
+/// \param k user key array
+inline void SIMON64_ExpandKey_4W(word32 key[44], const word32 k[4])
+{
+    const word32 c = 0xfffffffc;
+    word64 z = W64LIT(0xfc2ce51207a635db);
+
+    key[0] = k[3]; key[1] = k[2]; key[2] = k[1]; key[3] = k[0];
+    for (size_t i = 4; i<44; ++i)
+    {
+        key[i] = static_cast<word32>(c ^ (z & 1) ^ key[i - 4] ^
+            rotrConstant<3>(key[i - 1]) ^ key[i - 3] ^ rotrConstant<4>(key[i - 1]) ^
+            rotrConstant<1>(key[i - 3]));
+        z >>= 1;
+    }
+}
+
+/// \brief Subkey generation function
+/// \details Used for SIMON-128 with 128-bit key and 68 rounds. A template was
+///   not worthwhile because all instantiations would need specialization.
+/// \param key empty subkey array
+/// \param k user key array
+inline void SIMON128_ExpandKey_2W(word64 key[68], const word64 k[2])
+{
+    const word64 c = W64LIT(0xfffffffffffffffc);
+    word64 z = W64LIT(0x7369f885192c0ef5);
+
+    key[0] = k[1]; key[1] = k[0];
+    for (size_t i=2; i<66; ++i)
+    {
+        key[i] = c ^ (z & 1) ^ key[i - 2] ^ rotrConstant<3>(key[i - 1]) ^ rotrConstant<4>(key[i - 1]);
+        z>>=1;
+    }
+
+    key[66] = c ^ 1 ^ key[64] ^ rotrConstant<3>(key[65]) ^ rotrConstant<4>(key[65]);
+    key[67] = c^key[65] ^ rotrConstant<3>(key[66]) ^ rotrConstant<4>(key[66]);
+}
+
+/// \brief Subkey generation function
+/// \details Used for SIMON-128 with 192-bit key and 69 rounds. A template was
+///   not worthwhile because all instantiations would need specialization.
+/// \param key empty subkey array
+/// \param k user key array
+inline void SIMON128_ExpandKey_3W(word64 key[69], const word64 k[3])
+{
+    const word64 c = W64LIT(0xfffffffffffffffc);
+    word64 z = W64LIT(0xfc2ce51207a635db);
+
+    key[0]=k[2]; key[1]=k[1]; key[2]=k[0];
+    for (size_t i=3; i<67; ++i)
+    {
+        key[i] = c ^ (z & 1) ^ key[i - 3] ^ rotrConstant<3>(key[i - 1]) ^ rotrConstant<4>(key[i - 1]);
+        z>>=1;
+    }
+
+    key[67] = c^key[64] ^ rotrConstant<3>(key[66]) ^ rotrConstant<4>(key[66]);
+    key[68] = c ^ 1 ^ key[65] ^ rotrConstant<3>(key[67]) ^ rotrConstant<4>(key[67]);
+}
+
+/// \brief Subkey generation function
+/// \details Used for SIMON-128 with 256-bit key and 72 rounds. A template was
+///   not worthwhile because all instantiations would need specialization.
+/// \param key empty subkey array
+/// \param k user key array
+inline void SIMON128_ExpandKey_4W(word64 key[72], const word64 k[4])
+{
+    const word64 c = W64LIT(0xfffffffffffffffc);
+    word64 z = W64LIT(0xfdc94c3a046d678b);
+
+    key[0]=k[3]; key[1]=k[2]; key[2]=k[1]; key[3]=k[0];
+    for (size_t i=4; i<68; ++i)
+    {
+        key[i] = c ^ (z & 1) ^ key[i - 4] ^ rotrConstant<3>(key[i - 1]) ^ key[i - 3] ^ rotrConstant<4>(key[i - 1]) ^ rotrConstant<1>(key[i - 3]);
+        z>>=1;
+    }
+
+    key[68] = c^key[64] ^ rotrConstant<3>(key[67]) ^ key[65] ^ rotrConstant<4>(key[67]) ^ rotrConstant<1>(key[65]);
+    key[69] = c ^ 1 ^ key[65] ^ rotrConstant<3>(key[68]) ^ key[66] ^ rotrConstant<4>(key[68]) ^ rotrConstant<1>(key[66]);
+    key[70] = c^key[66] ^ rotrConstant<3>(key[69]) ^ key[67] ^ rotrConstant<4>(key[69]) ^ rotrConstant<1>(key[67]);
+    key[71] = c^key[67] ^ rotrConstant<3>(key[70]) ^ key[68] ^ rotrConstant<4>(key[70]) ^ rotrConstant<1>(key[68]);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+///////////////////////////////////////////////////////////
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+extern size_t SIMON128_Enc_AdvancedProcessBlocks_NEON(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t SIMON128_Dec_AdvancedProcessBlocks_NEON(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+extern size_t SIMON128_Enc_AdvancedProcessBlocks_SSSE3(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t SIMON128_Dec_AdvancedProcessBlocks_SSSE3(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+extern size_t SIMON128_Enc_AdvancedProcessBlocks_ALTIVEC(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t SIMON128_Dec_AdvancedProcessBlocks_ALTIVEC(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+std::string SIMON64::Base::AlgorithmProvider() const
+{
+    return "C++";
+}
+
+unsigned int SIMON64::Base::OptimalDataAlignment() const
+{
+    return GetAlignmentOf<word32>();
+}
+
+void SIMON64::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_ASSERT(keyLength == 12 || keyLength == 16);
+    CRYPTOPP_UNUSED(params);
+
+    // Building the key schedule table requires {3,4} words workspace.
+    // Encrypting and decrypting requires 4 words workspace.
+    m_kwords = keyLength/sizeof(word32);
+    m_wspace.New(4U);
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word32, LittleEndian> KeyBlock;
+    KeyBlock kblk(userKey);
+
+    switch (m_kwords)
+    {
+    case 3:
+        m_rkeys.New((m_rounds = 42)+1);
+        kblk(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+        SIMON64_ExpandKey_3W(m_rkeys, m_wspace);
+        break;
+    case 4:
+        m_rkeys.New((m_rounds = 44)+1);
+        kblk(m_wspace[3])(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+        SIMON64_ExpandKey_4W(m_rkeys, m_wspace);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+}
+
+void SIMON64::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word32, LittleEndian> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[1])(m_wspace[0]);
+
+    switch (m_rounds)
+    {
+    case 42:
+        SIMON_Encrypt<word32, 42>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 44:
+        SIMON_Encrypt<word32, 44>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef PutBlock<word32, LittleEndian> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2]);
+}
+
+void SIMON64::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word32, LittleEndian> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[1])(m_wspace[0]);
+
+    switch (m_rounds)
+    {
+    case 42:
+        SIMON_Decrypt<word32, 42>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 44:
+        SIMON_Decrypt<word32, 44>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef PutBlock<word32, LittleEndian> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2]);
+}
+
+///////////////////////////////////////////////////////////
+
+std::string SIMON128::Base::AlgorithmProvider() const
+{
+#if (CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS)
+# if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return "SSSE3";
+# endif
+# if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return "NEON";
+# endif
+# if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return "Altivec";
+# endif
+#endif
+    return "C++";
+}
+
+unsigned int SIMON128::Base::OptimalDataAlignment() const
+{
+#if (CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS)
+# if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return 16;  // load __m128i
+# endif
+# if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return 8;  // load uint64x2_t
+# endif
+# if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return 16;  // load uint64x2_p
+# endif
+#endif
+    return GetAlignmentOf<word64>();
+}
+
+void SIMON128::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_ASSERT(keyLength == 16 || keyLength == 24 || keyLength == 32);
+    CRYPTOPP_UNUSED(params);
+
+    // Building the key schedule table requires {2,3,4} words workspace.
+    // Encrypting and decrypting requires 4 words workspace.
+    m_kwords = keyLength/sizeof(word64);
+    m_wspace.New(4U);
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word64, LittleEndian> KeyBlock;
+    KeyBlock kblk(userKey);
+
+    switch (m_kwords)
+    {
+    case 2:
+        m_rkeys.New((m_rounds = 68)+1);
+        kblk(m_wspace[1])(m_wspace[0]);
+        SIMON128_ExpandKey_2W(m_rkeys, m_wspace);
+        break;
+    case 3:
+        m_rkeys.New((m_rounds = 69)+1);
+        kblk(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+        SIMON128_ExpandKey_3W(m_rkeys, m_wspace);
+        break;
+    case 4:
+        m_rkeys.New((m_rounds = 72)+1);
+        kblk(m_wspace[3])(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+        SIMON128_ExpandKey_4W(m_rkeys, m_wspace);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+#if CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS
+
+    // Pre-splat the round keys for Altivec forward transformation
+#if CRYPTOPP_ALTIVEC_AVAILABLE
+    if (IsForwardTransformation() && HasAltivec())
+    {
+        AlignedSecBlock presplat(m_rkeys.size()*2);
+        for (size_t i=0, j=0; i<m_rkeys.size(); i++, j+=2)
+            presplat[j+0] = presplat[j+1] = m_rkeys[i];
+        m_rkeys.swap(presplat);
+    }
+#elif CRYPTOPP_SSSE3_AVAILABLE
+    if (IsForwardTransformation() && HasSSSE3())
+    {
+        AlignedSecBlock presplat(m_rkeys.size()*2);
+        for (size_t i=0, j=0; i<m_rkeys.size(); i++, j+=2)
+            presplat[j+0] = presplat[j+1] = m_rkeys[i];
+        m_rkeys.swap(presplat);
+    }
+#endif
+
+#endif  // CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS
+}
+
+void SIMON128::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word64, LittleEndian> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[1])(m_wspace[0]);
+
+    switch (m_rounds)
+    {
+    case 68:
+        SIMON_Encrypt<word64, 68>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 69:
+        SIMON_Encrypt<word64, 69>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 72:
+        SIMON_Encrypt<word64, 72>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef PutBlock<word64, LittleEndian> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2]);
+}
+
+void SIMON128::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word64, LittleEndian> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[1])(m_wspace[0]);
+
+    switch (m_rounds)
+    {
+    case 68:
+        SIMON_Decrypt<word64, 68>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 69:
+        SIMON_Decrypt<word64, 69>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 72:
+        SIMON_Decrypt<word64, 72>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef PutBlock<word64, LittleEndian> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2]);
+}
+
+#if (CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS)
+size_t SIMON128::Enc::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks,
+        byte *outBlocks, size_t length, word32 flags) const
+{
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return SIMON128_Enc_AdvancedProcessBlocks_SSSE3(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return SIMON128_Enc_AdvancedProcessBlocks_NEON(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return SIMON128_Enc_AdvancedProcessBlocks_ALTIVEC(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+    return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t SIMON128::Dec::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks,
+        byte *outBlocks, size_t length, word32 flags) const
+{
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return SIMON128_Dec_AdvancedProcessBlocks_SSSE3(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return SIMON128_Dec_AdvancedProcessBlocks_NEON(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return SIMON128_Dec_AdvancedProcessBlocks_ALTIVEC(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+    return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/simon.h b/runtime/third_party/cryptopp/simon.h
new file mode 100644
index 0000000..35bb67f
--- /dev/null
+++ b/runtime/third_party/cryptopp/simon.h
@@ -0,0 +1,206 @@
+// simon.h - written and placed in the public domain by Jeffrey Walton
+
+/// \file simon.h
+/// \brief Classes for the Simon block cipher
+/// \details Simon is a block cipher designed by Ray Beaulieu, Douglas Shors, Jason Smith,
+///  Stefan Treatman-Clark, Bryan Weeks and Louis Wingers.
+/// \sa <A HREF="http://eprint.iacr.org/2013/404">The SIMON and SPECK Families of
+///  Lightweight Block Ciphers</A>, <A HREF="http://iadgov.github.io/simon-speck/">
+///  The Simon and Speck GitHub</A> and <A HREF="https://www.cryptopp.com/wiki/SIMON">
+///  SIMON</A> on the Crypto++ wiki.
+/// \since Crypto++ 6.0
+
+#ifndef CRYPTOPP_SIMON_H
+#define CRYPTOPP_SIMON_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+
+#if CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86 || \
+    CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8 || \
+    CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64
+# ifndef CRYPTOPP_DISABLE_SIMON_SIMD
+#  define CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS 1
+# endif
+#endif
+
+// Yet another SunStudio/SunCC workaround. Failed self tests
+// in SSE code paths on i386 for SunStudio 12.3 and below.
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x5120)
+# undef CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SIMON block cipher information
+/// \tparam L block size of the cipher, in bytes
+/// \tparam D default key length, in bytes
+/// \tparam N minimum key length, in bytes
+/// \tparam M maximum key length, in bytes
+/// \since Crypto++ 6.0
+template <unsigned int L, unsigned int D, unsigned int N, unsigned int M>
+struct SIMON_Info : public FixedBlockSize<L>, VariableKeyLength<D, N, M>
+{
+	/// \brief The algorithm name
+	/// \return the algorithm name
+	/// \details StaticAlgorithmName returns the algorithm's name as a static
+	///  member function.
+    static const std::string StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize(Keylength)
+        return "SIMON-" + IntToString(L*8);
+    }
+};
+
+/// \brief SIMON block cipher base class
+/// \tparam W the word type
+/// \details User code should use SIMON64 or SIMON128
+/// \sa SIMON64, SIMON128, <a href="http://www.cryptopp.com/wiki/SIMON">SIMON</a> on the Crypto++ wiki
+/// \since Crypto++ 6.0
+template <class W>
+struct SIMON_Base
+{
+    virtual ~SIMON_Base() {}
+    SIMON_Base() : m_kwords(0), m_rounds(0) {}
+
+    typedef SecBlock<W, AllocatorWithCleanup<W, true> > AlignedSecBlock;
+    mutable AlignedSecBlock m_wspace;  // workspace
+    AlignedSecBlock         m_rkeys;   // round keys
+    unsigned int            m_kwords;  // number of key words
+    unsigned int            m_rounds;  // number of rounds
+};
+
+/// \brief SIMON 64-bit block cipher
+/// \details Simon is a block cipher designed by Ray Beaulieu, Douglas Shors, Jason Smith,
+///  Stefan Treatman-Clark, Bryan Weeks and Louis Wingers.
+/// \details SIMON64 provides 64-bit block size. The valid key sizes are 96-bit and 128-bit.
+/// \sa SIMON64, SIMON128,  <A HREF="http://eprint.iacr.org/2013/404">The SIMON and SIMON
+///  Families of Lightweight Block Ciphers</A>, <A HREF="http://iadgov.github.io/simon-speck/">
+///  The Simon and Speck GitHub</A>, <a href="http://www.cryptopp.com/wiki/SIMON">SIMON</a> on the
+///  Crypto++ wiki
+/// \since Crypto++ 6.0
+class CRYPTOPP_NO_VTABLE SIMON64 : public SIMON_Info<8, 12, 12, 16>, public BlockCipherDocumentation
+{
+public:
+    /// \brief SIMON64 block cipher base implementation
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Base : protected SIMON_Base<word32>, public BlockCipherImpl<SIMON_Info<8, 12, 12, 16> >
+    {
+    public:
+        /// \brief The algorithm name
+        /// \return the algorithm name
+        /// \details AlgorithmName returns the algorithm's name as a
+        ///  member function.
+        std::string AlgorithmName() const {
+            return StaticAlgorithmName() + (m_kwords == 0 ? "" :
+                "(" + IntToString(m_kwords*sizeof(word32)*8) + ")");
+        }
+
+        std::string AlgorithmProvider() const;
+
+        /// \brief Provides input and output data alignment for optimal performance.
+        /// \return the input data alignment that provides optimal performance
+        /// \sa GetAlignment() and OptimalBlockSize()
+        unsigned int OptimalDataAlignment() const;
+
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+    };
+
+    /// \brief SIMON64 encryption transformation
+    /// \details Enc provides the encryption transformation.
+    ///  All key sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    /// \brief SIMON64 decryption transformation
+    /// \details Dec provides the decryption transformation.
+    ///  All key sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+/// \brief SIMON 128-bit block cipher
+/// \details Simon is a block cipher designed by Ray Beaulieu, Douglas Shors, Jason Smith,
+///  Stefan Treatman-Clark, Bryan Weeks and Louis Wingers.
+/// \details SIMON128 provides 128-bit block size. The valid key sizes are 128-bit, 192-bit and 256-bit.
+/// \sa SIMON64, SIMON128,  <A HREF="http://eprint.iacr.org/2013/404">The SIMON and SIMON
+///  Families of Lightweight Block Ciphers</A>, <A HREF="http://iadgov.github.io/simon-speck/">
+///  The Simon and Speck GitHub</A>, <a href="http://www.cryptopp.com/wiki/SIMON">SIMON</a> on the
+///  Crypto++ wiki
+/// \since Crypto++ 6.0
+class CRYPTOPP_NO_VTABLE SIMON128 : public SIMON_Info<16, 16, 16, 32>, public BlockCipherDocumentation
+{
+public:
+    /// \brief SIMON128 block cipher base implementation
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Base : protected SIMON_Base<word64>, public BlockCipherImpl<SIMON_Info<16, 16, 16, 32> >
+    {
+    public:
+        /// \brief The algorithm name
+        /// \return the algorithm name
+        /// \details AlgorithmName returns the algorithm's name as a
+        ///  member function.
+        std::string AlgorithmName() const {
+            return StaticAlgorithmName() + (m_kwords == 0 ? "" :
+                "(" + IntToString(m_kwords*sizeof(word64)*8) + ")");
+        }
+
+        std::string AlgorithmProvider() const;
+
+        /// \brief Provides input and output data alignment for optimal performance.
+        /// \return the input data alignment that provides optimal performance
+        /// \sa GetAlignment() and OptimalBlockSize()
+        unsigned int OptimalDataAlignment() const;
+
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+    };
+
+    /// \brief SIMON128 encryption transformation
+    /// \details Enc provides the encryption transformation.
+    ///  All key sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+#if CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    /// \brief SIMON128 decryption transformation
+    /// \details Dec provides the decryption transformation.
+    ///  All key sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+#if CRYPTOPP_SIMON128_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_SIMON_H
diff --git a/runtime/third_party/cryptopp/simon128_simd.cpp b/runtime/third_party/cryptopp/simon128_simd.cpp
new file mode 100644
index 0000000..3ac8506
--- /dev/null
+++ b/runtime/third_party/cryptopp/simon128_simd.cpp
@@ -0,0 +1,862 @@
+// simon_simd.cpp - written and placed in the public domain by Jeffrey Walton
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    SSSE3, ARM NEON and ARMv8a, and Altivec instructions. A separate
+//    source file is needed because additional CXXFLAGS are required to enable
+//    the appropriate instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+
+#include "simon.h"
+#include "misc.h"
+
+// Uncomment for benchmarking C++ against SSE or NEON.
+// Do so in both simon.cpp and simon_simd.cpp.
+// #undef CRYPTOPP_SSSE3_AVAILABLE
+// #undef CRYPTOPP_ARM_NEON_AVAILABLE
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+# include "adv_simd.h"
+# include <pmmintrin.h>
+# include <tmmintrin.h>
+#endif
+
+#if defined(__XOP__)
+# if defined(CRYPTOPP_GCC_COMPATIBLE)
+#  include <x86intrin.h>
+# endif
+# include <ammintrin.h>
+#endif  // XOP
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include "adv_simd.h"
+# include <arm_neon.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#if defined(_M_ARM64)
+# include "adv_simd.h"
+#endif
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+# include "adv_simd.h"
+# include "ppc_simd.h"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char SIMON128_SIMD_FNAME[] = __FILE__;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::vec_swap;  // SunCC
+
+// *************************** ARM NEON ************************** //
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+
+// Missing from Microsoft's ARM A-32 implementation
+#if defined(CRYPTOPP_MSC_VERSION) && !defined(_M_ARM64)
+inline uint64x2_t vld1q_dup_u64(const uint64_t* ptr)
+{
+    return vmovq_n_u64(*ptr);
+}
+#endif
+
+template <class T>
+inline T UnpackHigh64(const T& a, const T& b)
+{
+    const uint64x1_t x(vget_high_u64((uint64x2_t)a));
+    const uint64x1_t y(vget_high_u64((uint64x2_t)b));
+    return (T)vcombine_u64(x, y);
+}
+
+template <class T>
+inline T UnpackLow64(const T& a, const T& b)
+{
+    const uint64x1_t x(vget_low_u64((uint64x2_t)a));
+    const uint64x1_t y(vget_low_u64((uint64x2_t)b));
+    return (T)vcombine_u64(x, y);
+}
+
+template <unsigned int R>
+inline uint64x2_t RotateLeft64(const uint64x2_t& val)
+{
+    const uint64x2_t a(vshlq_n_u64(val, R));
+    const uint64x2_t b(vshrq_n_u64(val, 64 - R));
+    return vorrq_u64(a, b);
+}
+
+template <unsigned int R>
+inline uint64x2_t RotateRight64(const uint64x2_t& val)
+{
+    const uint64x2_t a(vshlq_n_u64(val, 64 - R));
+    const uint64x2_t b(vshrq_n_u64(val, R));
+    return vorrq_u64(a, b);
+}
+
+#if defined(__aarch32__) || defined(__aarch64__)
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+inline uint64x2_t RotateLeft64<8>(const uint64x2_t& val)
+{
+    const uint8_t maskb[16] = { 7,0,1,2, 3,4,5,6, 15,8,9,10, 11,12,13,14 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+
+    return vreinterpretq_u64_u8(
+        vqtbl1q_u8(vreinterpretq_u8_u64(val), mask));
+}
+
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+inline uint64x2_t RotateRight64<8>(const uint64x2_t& val)
+{
+    const uint8_t maskb[16] = { 1,2,3,4, 5,6,7,0, 9,10,11,12, 13,14,15,8 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+
+    return vreinterpretq_u64_u8(
+        vqtbl1q_u8(vreinterpretq_u8_u64(val), mask));
+}
+#endif
+
+inline uint64x2_t SIMON128_f(const uint64x2_t& val)
+{
+    return veorq_u64(RotateLeft64<2>(val),
+        vandq_u64(RotateLeft64<1>(val), RotateLeft64<8>(val)));
+}
+
+inline void SIMON128_Enc_Block(uint64x2_t &block0, uint64x2_t &block1,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    uint64x2_t x1 = UnpackHigh64(block0, block1);
+    uint64x2_t y1 = UnpackLow64(block0, block1);
+
+    for (size_t i = 0; i < static_cast<size_t>(rounds & ~1)-1; i += 2)
+    {
+        const uint64x2_t rk1 = vld1q_dup_u64(subkeys+i);
+        y1 = veorq_u64(veorq_u64(y1, SIMON128_f(x1)), rk1);
+
+        const uint64x2_t rk2 = vld1q_dup_u64(subkeys+i+1);
+        x1 = veorq_u64(veorq_u64(x1, SIMON128_f(y1)), rk2);
+    }
+
+    if (rounds & 1)
+    {
+        const uint64x2_t rk = vld1q_dup_u64(subkeys+rounds-1);
+
+        y1 = veorq_u64(veorq_u64(y1, SIMON128_f(x1)), rk);
+        std::swap(x1, y1);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = UnpackLow64(y1, x1);
+    block1 = UnpackHigh64(y1, x1);
+}
+
+inline void SIMON128_Enc_6_Blocks(uint64x2_t &block0, uint64x2_t &block1,
+    uint64x2_t &block2, uint64x2_t &block3, uint64x2_t &block4, uint64x2_t &block5,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    uint64x2_t x1 = UnpackHigh64(block0, block1);
+    uint64x2_t y1 = UnpackLow64(block0, block1);
+    uint64x2_t x2 = UnpackHigh64(block2, block3);
+    uint64x2_t y2 = UnpackLow64(block2, block3);
+    uint64x2_t x3 = UnpackHigh64(block4, block5);
+    uint64x2_t y3 = UnpackLow64(block4, block5);
+
+    for (size_t i = 0; i < static_cast<size_t>(rounds & ~1) - 1; i += 2)
+    {
+        const uint64x2_t rk1 = vld1q_dup_u64(subkeys+i);
+        y1 = veorq_u64(veorq_u64(y1, SIMON128_f(x1)), rk1);
+        y2 = veorq_u64(veorq_u64(y2, SIMON128_f(x2)), rk1);
+        y3 = veorq_u64(veorq_u64(y3, SIMON128_f(x3)), rk1);
+
+        const uint64x2_t rk2 = vld1q_dup_u64(subkeys+i+1);
+        x1 = veorq_u64(veorq_u64(x1, SIMON128_f(y1)), rk2);
+        x2 = veorq_u64(veorq_u64(x2, SIMON128_f(y2)), rk2);
+        x3 = veorq_u64(veorq_u64(x3, SIMON128_f(y3)), rk2);
+    }
+
+    if (rounds & 1)
+    {
+        const uint64x2_t rk = vld1q_dup_u64(subkeys + rounds - 1);
+
+        y1 = veorq_u64(veorq_u64(y1, SIMON128_f(x1)), rk);
+        y2 = veorq_u64(veorq_u64(y2, SIMON128_f(x2)), rk);
+        y3 = veorq_u64(veorq_u64(y3, SIMON128_f(x3)), rk);
+        std::swap(x1, y1); std::swap(x2, y2); std::swap(x3, y3);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = UnpackLow64(y1, x1);
+    block1 = UnpackHigh64(y1, x1);
+    block2 = UnpackLow64(y2, x2);
+    block3 = UnpackHigh64(y2, x2);
+    block4 = UnpackLow64(y3, x3);
+    block5 = UnpackHigh64(y3, x3);
+}
+
+inline void SIMON128_Dec_Block(uint64x2_t &block0, uint64x2_t &block1,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    uint64x2_t x1 = UnpackHigh64(block0, block1);
+    uint64x2_t y1 = UnpackLow64(block0, block1);
+
+    if (rounds & 1)
+    {
+        std::swap(x1, y1);
+        const uint64x2_t rk = vld1q_dup_u64(subkeys + rounds - 1);
+
+        y1 = veorq_u64(veorq_u64(y1, rk), SIMON128_f(x1));
+        rounds--;
+    }
+
+    for (int i = static_cast<int>(rounds-2); i >= 0; i -= 2)
+    {
+        const uint64x2_t rk1 = vld1q_dup_u64(subkeys+i+1);
+        x1 = veorq_u64(veorq_u64(x1, SIMON128_f(y1)), rk1);
+
+        const uint64x2_t rk2 = vld1q_dup_u64(subkeys+i);
+        y1 = veorq_u64(veorq_u64(y1, SIMON128_f(x1)), rk2);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = UnpackLow64(y1, x1);
+    block1 = UnpackHigh64(y1, x1);
+}
+
+inline void SIMON128_Dec_6_Blocks(uint64x2_t &block0, uint64x2_t &block1,
+    uint64x2_t &block2, uint64x2_t &block3, uint64x2_t &block4, uint64x2_t &block5,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    uint64x2_t x1 = UnpackHigh64(block0, block1);
+    uint64x2_t y1 = UnpackLow64(block0, block1);
+    uint64x2_t x2 = UnpackHigh64(block2, block3);
+    uint64x2_t y2 = UnpackLow64(block2, block3);
+    uint64x2_t x3 = UnpackHigh64(block4, block5);
+    uint64x2_t y3 = UnpackLow64(block4, block5);
+
+    if (rounds & 1)
+    {
+        std::swap(x1, y1); std::swap(x2, y2); std::swap(x3, y3);
+        const uint64x2_t rk = vld1q_dup_u64(subkeys + rounds - 1);
+
+        y1 = veorq_u64(veorq_u64(y1, rk), SIMON128_f(x1));
+        y2 = veorq_u64(veorq_u64(y2, rk), SIMON128_f(x2));
+        y3 = veorq_u64(veorq_u64(y3, rk), SIMON128_f(x3));
+        rounds--;
+    }
+
+    for (int i = static_cast<int>(rounds-2); i >= 0; i -= 2)
+    {
+        const uint64x2_t rk1 = vld1q_dup_u64(subkeys + i + 1);
+        x1 = veorq_u64(veorq_u64(x1, SIMON128_f(y1)), rk1);
+        x2 = veorq_u64(veorq_u64(x2, SIMON128_f(y2)), rk1);
+        x3 = veorq_u64(veorq_u64(x3, SIMON128_f(y3)), rk1);
+
+        const uint64x2_t rk2 = vld1q_dup_u64(subkeys + i);
+        y1 = veorq_u64(veorq_u64(y1, SIMON128_f(x1)), rk2);
+        y2 = veorq_u64(veorq_u64(y2, SIMON128_f(x2)), rk2);
+        y3 = veorq_u64(veorq_u64(y3, SIMON128_f(x3)), rk2);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = UnpackLow64(y1, x1);
+    block1 = UnpackHigh64(y1, x1);
+    block2 = UnpackLow64(y2, x2);
+    block3 = UnpackHigh64(y2, x2);
+    block4 = UnpackLow64(y3, x3);
+    block5 = UnpackHigh64(y3, x3);
+}
+
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+// ***************************** IA-32 ***************************** //
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+
+// GCC double casts, https://www.spinics.net/lists/gcchelp/msg47735.html
+#ifndef DOUBLE_CAST
+# define DOUBLE_CAST(x) ((double *)(void *)(x))
+#endif
+#ifndef CONST_DOUBLE_CAST
+# define CONST_DOUBLE_CAST(x) ((const double *)(const void *)(x))
+#endif
+
+inline void Swap128(__m128i& a,__m128i& b)
+{
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x5120)
+    // __m128i is an unsigned long long[2], and support for swapping it was not added until C++11.
+    // SunCC 12.1 - 12.3 fail to consume the swap; while SunCC 12.4 consumes it without -std=c++11.
+    vec_swap(a, b);
+#else
+    std::swap(a, b);
+#endif
+}
+
+template <unsigned int R>
+inline __m128i RotateLeft64(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi64(val, R);
+#else
+    return _mm_or_si128(
+        _mm_slli_epi64(val, R), _mm_srli_epi64(val, 64-R));
+#endif
+}
+
+template <unsigned int R>
+inline __m128i RotateRight64(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi64(val, 64-R);
+#else
+    return _mm_or_si128(
+        _mm_slli_epi64(val, 64-R), _mm_srli_epi64(val, R));
+#endif
+}
+
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+__m128i RotateLeft64<8>(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi64(val, 8);
+#else
+    const __m128i mask = _mm_set_epi8(14,13,12,11, 10,9,8,15, 6,5,4,3, 2,1,0,7);
+    return _mm_shuffle_epi8(val, mask);
+#endif
+}
+
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+__m128i RotateRight64<8>(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi64(val, 64-8);
+#else
+    const __m128i mask = _mm_set_epi8(8,15,14,13, 12,11,10,9, 0,7,6,5, 4,3,2,1);
+    return _mm_shuffle_epi8(val, mask);
+#endif
+}
+
+inline __m128i SIMON128_f(const __m128i& v)
+{
+    return _mm_xor_si128(RotateLeft64<2>(v),
+        _mm_and_si128(RotateLeft64<1>(v), RotateLeft64<8>(v)));
+}
+
+inline void SIMON128_Enc_Block(__m128i &block0, __m128i &block1,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    __m128i x1 = _mm_unpackhi_epi64(block0, block1);
+    __m128i y1 = _mm_unpacklo_epi64(block0, block1);
+
+    for (size_t i = 0; i < static_cast<size_t>(rounds & ~1)-1; i += 2)
+    {
+        // Round keys are pre-splated in forward direction
+        const __m128i rk1 = _mm_load_si128(CONST_M128_CAST(subkeys+i*2));
+        y1 = _mm_xor_si128(_mm_xor_si128(y1, SIMON128_f(x1)), rk1);
+
+        const __m128i rk2 = _mm_load_si128(CONST_M128_CAST(subkeys+(i+1)*2));
+        x1 = _mm_xor_si128(_mm_xor_si128(x1, SIMON128_f(y1)), rk2);
+    }
+
+    if (rounds & 1)
+    {
+        // Round keys are pre-splated in forward direction
+        const __m128i rk = _mm_load_si128(CONST_M128_CAST(subkeys+(rounds-1)*2));
+
+        y1 = _mm_xor_si128(_mm_xor_si128(y1, SIMON128_f(x1)), rk);
+        Swap128(x1, y1);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = _mm_unpacklo_epi64(y1, x1);
+    block1 = _mm_unpackhi_epi64(y1, x1);
+}
+
+inline void SIMON128_Enc_6_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, __m128i &block4, __m128i &block5,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    __m128i x1 = _mm_unpackhi_epi64(block0, block1);
+    __m128i y1 = _mm_unpacklo_epi64(block0, block1);
+    __m128i x2 = _mm_unpackhi_epi64(block2, block3);
+    __m128i y2 = _mm_unpacklo_epi64(block2, block3);
+    __m128i x3 = _mm_unpackhi_epi64(block4, block5);
+    __m128i y3 = _mm_unpacklo_epi64(block4, block5);
+
+    for (size_t i = 0; i < static_cast<size_t>(rounds & ~1) - 1; i += 2)
+    {
+        // Round keys are pre-splated in forward direction
+        const __m128i rk1 = _mm_load_si128(CONST_M128_CAST(subkeys+i*2));
+        y1 = _mm_xor_si128(_mm_xor_si128(y1, SIMON128_f(x1)), rk1);
+        y2 = _mm_xor_si128(_mm_xor_si128(y2, SIMON128_f(x2)), rk1);
+        y3 = _mm_xor_si128(_mm_xor_si128(y3, SIMON128_f(x3)), rk1);
+
+        // Round keys are pre-splated in forward direction
+        const __m128i rk2 = _mm_load_si128(CONST_M128_CAST(subkeys+(i+1)*2));
+        x1 = _mm_xor_si128(_mm_xor_si128(x1, SIMON128_f(y1)), rk2);
+        x2 = _mm_xor_si128(_mm_xor_si128(x2, SIMON128_f(y2)), rk2);
+        x3 = _mm_xor_si128(_mm_xor_si128(x3, SIMON128_f(y3)), rk2);
+    }
+
+    if (rounds & 1)
+    {
+        // Round keys are pre-splated in forward direction
+        const __m128i rk = _mm_load_si128(CONST_M128_CAST(subkeys+(rounds-1)*2));
+        y1 = _mm_xor_si128(_mm_xor_si128(y1, SIMON128_f(x1)), rk);
+        y2 = _mm_xor_si128(_mm_xor_si128(y2, SIMON128_f(x2)), rk);
+        y3 = _mm_xor_si128(_mm_xor_si128(y3, SIMON128_f(x3)), rk);
+        Swap128(x1, y1); Swap128(x2, y2); Swap128(x3, y3);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = _mm_unpacklo_epi64(y1, x1);
+    block1 = _mm_unpackhi_epi64(y1, x1);
+    block2 = _mm_unpacklo_epi64(y2, x2);
+    block3 = _mm_unpackhi_epi64(y2, x2);
+    block4 = _mm_unpacklo_epi64(y3, x3);
+    block5 = _mm_unpackhi_epi64(y3, x3);
+}
+
+inline void SIMON128_Dec_Block(__m128i &block0, __m128i &block1,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    __m128i x1 = _mm_unpackhi_epi64(block0, block1);
+    __m128i y1 = _mm_unpacklo_epi64(block0, block1);
+
+    if (rounds & 1)
+    {
+        const __m128i rk = _mm_castpd_si128(
+            _mm_loaddup_pd(CONST_DOUBLE_CAST(subkeys + rounds - 1)));
+
+        Swap128(x1, y1);
+        y1 = _mm_xor_si128(_mm_xor_si128(y1, rk), SIMON128_f(x1));
+        rounds--;
+    }
+
+    for (int i = static_cast<int>(rounds-2); i >= 0; i -= 2)
+    {
+        const __m128i rk1 = _mm_castpd_si128(
+            _mm_loaddup_pd(CONST_DOUBLE_CAST(subkeys+i+1)));
+        x1 = _mm_xor_si128(_mm_xor_si128(x1, SIMON128_f(y1)), rk1);
+
+        const __m128i rk2 = _mm_castpd_si128(
+            _mm_loaddup_pd(CONST_DOUBLE_CAST(subkeys+i)));
+        y1 = _mm_xor_si128(_mm_xor_si128(y1, SIMON128_f(x1)), rk2);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = _mm_unpacklo_epi64(y1, x1);
+    block1 = _mm_unpackhi_epi64(y1, x1);
+}
+
+inline void SIMON128_Dec_6_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, __m128i &block4, __m128i &block5,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    __m128i x1 = _mm_unpackhi_epi64(block0, block1);
+    __m128i y1 = _mm_unpacklo_epi64(block0, block1);
+    __m128i x2 = _mm_unpackhi_epi64(block2, block3);
+    __m128i y2 = _mm_unpacklo_epi64(block2, block3);
+    __m128i x3 = _mm_unpackhi_epi64(block4, block5);
+    __m128i y3 = _mm_unpacklo_epi64(block4, block5);
+
+    if (rounds & 1)
+    {
+        const __m128i rk = _mm_castpd_si128(
+            _mm_loaddup_pd(CONST_DOUBLE_CAST(subkeys + rounds - 1)));
+
+        Swap128(x1, y1); Swap128(x2, y2); Swap128(x3, y3);
+        y1 = _mm_xor_si128(_mm_xor_si128(y1, rk), SIMON128_f(x1));
+        y2 = _mm_xor_si128(_mm_xor_si128(y2, rk), SIMON128_f(x2));
+        y3 = _mm_xor_si128(_mm_xor_si128(y3, rk), SIMON128_f(x3));
+        rounds--;
+    }
+
+    for (int i = static_cast<int>(rounds-2); i >= 0; i -= 2)
+    {
+        const __m128i rk1 = _mm_castpd_si128(
+            _mm_loaddup_pd(CONST_DOUBLE_CAST(subkeys + i + 1)));
+        x1 = _mm_xor_si128(_mm_xor_si128(x1, SIMON128_f(y1)), rk1);
+        x2 = _mm_xor_si128(_mm_xor_si128(x2, SIMON128_f(y2)), rk1);
+        x3 = _mm_xor_si128(_mm_xor_si128(x3, SIMON128_f(y3)), rk1);
+
+        const __m128i rk2 = _mm_castpd_si128(
+            _mm_loaddup_pd(CONST_DOUBLE_CAST(subkeys + i)));
+        y1 = _mm_xor_si128(_mm_xor_si128(y1, SIMON128_f(x1)), rk2);
+        y2 = _mm_xor_si128(_mm_xor_si128(y2, SIMON128_f(x2)), rk2);
+        y3 = _mm_xor_si128(_mm_xor_si128(y3, SIMON128_f(x3)), rk2);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = _mm_unpacklo_epi64(y1, x1);
+    block1 = _mm_unpackhi_epi64(y1, x1);
+    block2 = _mm_unpacklo_epi64(y2, x2);
+    block3 = _mm_unpackhi_epi64(y2, x2);
+    block4 = _mm_unpacklo_epi64(y3, x3);
+    block5 = _mm_unpackhi_epi64(y3, x3);
+}
+
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
+
+// ***************************** Altivec ***************************** //
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+
+// Altivec uses native 64-bit types on 64-bit environments, or 32-bit types
+// in 32-bit environments. Speck128 will use the appropriate type for the
+// environment. Functions like VecAdd64 have two overloads, one for each
+// environment. The 32-bit overload treats uint32x4_p like a 64-bit type,
+// and does things like perform a add with carry or subtract with borrow.
+
+// Speck128 on Power8 performed as expected because of 64-bit environment.
+// Performance sucked on old PowerPC machines because of 32-bit environments.
+// At Crypto++ 8.3 we added an implementation that operated on 32-bit words.
+// Native 64-bit Speck128 performance dropped from about 4.1 to 6.3 cpb, but
+// 32-bit Speck128 improved from 66.5 cpb to 10.4 cpb. Overall it was a
+// good win even though we lost some performance in 64-bit environments.
+
+using CryptoPP::uint8x16_p;
+using CryptoPP::uint32x4_p;
+#if defined(_ARCH_PWR8)
+using CryptoPP::uint64x2_p;
+#endif
+
+using CryptoPP::VecAdd64;
+using CryptoPP::VecSub64;
+using CryptoPP::VecAnd64;
+using CryptoPP::VecOr64;
+using CryptoPP::VecXor64;
+using CryptoPP::VecRotateLeft64;
+using CryptoPP::VecRotateRight64;
+using CryptoPP::VecSplatElement64;
+using CryptoPP::VecLoad;
+using CryptoPP::VecLoadAligned;
+using CryptoPP::VecPermute;
+
+#if defined(_ARCH_PWR8)
+#define simon128_t uint64x2_p
+#else
+#define simon128_t uint32x4_p
+#endif
+
+inline simon128_t SIMON128_f(const simon128_t val)
+{
+    return (simon128_t)VecXor64(VecRotateLeft64<2>(val),
+        VecAnd64(VecRotateLeft64<1>(val), VecRotateLeft64<8>(val)));
+}
+
+inline void SIMON128_Enc_Block(uint32x4_p &block, const word64 *subkeys, unsigned int rounds)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m1 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m2 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m1 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m2 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    simon128_t x1 = (simon128_t)VecPermute(block, block, m1);
+    simon128_t y1 = (simon128_t)VecPermute(block, block, m2);
+
+    for (size_t i = 0; i < static_cast<size_t>(rounds & ~1)-1; i += 2)
+    {
+        // Round keys are pre-splated in forward direction
+        const word32* ptr1 = reinterpret_cast<const word32*>(subkeys+i*2);
+        const simon128_t rk1 = (simon128_t)VecLoadAligned(ptr1);
+        const word32* ptr2 = reinterpret_cast<const word32*>(subkeys+(i+1)*2);
+        const simon128_t rk2 = (simon128_t)VecLoadAligned(ptr2);
+
+        y1 = VecXor64(VecXor64(y1, SIMON128_f(x1)), rk1);
+        x1 = VecXor64(VecXor64(x1, SIMON128_f(y1)), rk2);
+    }
+
+    if (rounds & 1)
+    {
+        // Round keys are pre-splated in forward direction
+        const word32* ptr = reinterpret_cast<const word32*>(subkeys+(rounds-1)*2);
+        const simon128_t rk = (simon128_t)VecLoadAligned(ptr);
+
+        y1 = VecXor64(VecXor64(y1, SIMON128_f(x1)), rk);
+
+        std::swap(x1, y1);
+    }
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m3 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    //const uint8x16_p m4 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m3 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    //const uint8x16_p m4 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block = (uint32x4_p)VecPermute(x1, y1, m3);
+}
+
+inline void SIMON128_Dec_Block(uint32x4_p &block, const word64 *subkeys, unsigned int rounds)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m1 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m2 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m1 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m2 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    simon128_t x1 = (simon128_t)VecPermute(block, block, m1);
+    simon128_t y1 = (simon128_t)VecPermute(block, block, m2);
+
+    if (rounds & 1)
+    {
+        std::swap(x1, y1);
+
+        const word32* ptr = reinterpret_cast<const word32*>(subkeys+rounds-1);
+        const simon128_t tk = (simon128_t)VecLoad(ptr);
+        const simon128_t rk = (simon128_t)VecSplatElement64<0>(tk);
+
+        y1 = VecXor64(VecXor64(y1, rk), SIMON128_f(x1));
+        rounds--;
+    }
+
+    for (int i = static_cast<int>(rounds-2); i >= 0; i -= 2)
+    {
+        const word32* ptr = reinterpret_cast<const word32*>(subkeys+i);
+        const simon128_t tk = (simon128_t)VecLoad(ptr);
+        const simon128_t rk1 = (simon128_t)VecSplatElement64<1>(tk);
+        const simon128_t rk2 = (simon128_t)VecSplatElement64<0>(tk);
+
+        x1 = VecXor64(VecXor64(x1, SIMON128_f(y1)), rk1);
+        y1 = VecXor64(VecXor64(y1, SIMON128_f(x1)), rk2);
+    }
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m3 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    //const uint8x16_p m4 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m3 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    //const uint8x16_p m4 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block = (uint32x4_p)VecPermute(x1, y1, m3);
+}
+
+inline void SIMON128_Enc_6_Blocks(uint32x4_p &block0, uint32x4_p &block1,
+            uint32x4_p &block2, uint32x4_p &block3, uint32x4_p &block4,
+            uint32x4_p &block5, const word64 *subkeys, unsigned int rounds)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m1 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m2 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m1 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m2 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    simon128_t x1 = (simon128_t)VecPermute(block0, block1, m1);
+    simon128_t y1 = (simon128_t)VecPermute(block0, block1, m2);
+    simon128_t x2 = (simon128_t)VecPermute(block2, block3, m1);
+    simon128_t y2 = (simon128_t)VecPermute(block2, block3, m2);
+    simon128_t x3 = (simon128_t)VecPermute(block4, block5, m1);
+    simon128_t y3 = (simon128_t)VecPermute(block4, block5, m2);
+
+    for (size_t i = 0; i < static_cast<size_t>(rounds & ~1)-1; i += 2)
+    {
+        // Round keys are pre-splated in forward direction
+        const word32* ptr1 = reinterpret_cast<const word32*>(subkeys+i*2);
+        const simon128_t rk1 = (simon128_t)VecLoadAligned(ptr1);
+
+        const word32* ptr2 = reinterpret_cast<const word32*>(subkeys+(i+1)*2);
+        const simon128_t rk2 = (simon128_t)VecLoadAligned(ptr2);
+
+        y1 = VecXor64(VecXor64(y1, SIMON128_f(x1)), rk1);
+        y2 = VecXor64(VecXor64(y2, SIMON128_f(x2)), rk1);
+        y3 = VecXor64(VecXor64(y3, SIMON128_f(x3)), rk1);
+
+        x1 = VecXor64(VecXor64(x1, SIMON128_f(y1)), rk2);
+        x2 = VecXor64(VecXor64(x2, SIMON128_f(y2)), rk2);
+        x3 = VecXor64(VecXor64(x3, SIMON128_f(y3)), rk2);
+    }
+
+    if (rounds & 1)
+    {
+        // Round keys are pre-splated in forward direction
+        const word32* ptr = reinterpret_cast<const word32*>(subkeys+(rounds-1)*2);
+        const simon128_t rk = (simon128_t)VecLoadAligned(ptr);
+
+        y1 = VecXor64(VecXor64(y1, SIMON128_f(x1)), rk);
+        y2 = VecXor64(VecXor64(y2, SIMON128_f(x2)), rk);
+        y3 = VecXor64(VecXor64(y3, SIMON128_f(x3)), rk);
+
+        std::swap(x1, y1); std::swap(x2, y2); std::swap(x3, y3);
+    }
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m3 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m4 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m3 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m4 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = (uint32x4_p)VecPermute(x1, y1, m3);
+    block1 = (uint32x4_p)VecPermute(x1, y1, m4);
+    block2 = (uint32x4_p)VecPermute(x2, y2, m3);
+    block3 = (uint32x4_p)VecPermute(x2, y2, m4);
+    block4 = (uint32x4_p)VecPermute(x3, y3, m3);
+    block5 = (uint32x4_p)VecPermute(x3, y3, m4);
+}
+
+inline void SIMON128_Dec_6_Blocks(uint32x4_p &block0, uint32x4_p &block1,
+            uint32x4_p &block2, uint32x4_p &block3, uint32x4_p &block4,
+            uint32x4_p &block5, const word64 *subkeys, unsigned int rounds)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m1 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m2 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m1 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m2 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    simon128_t x1 = (simon128_t)VecPermute(block0, block1, m1);
+    simon128_t y1 = (simon128_t)VecPermute(block0, block1, m2);
+    simon128_t x2 = (simon128_t)VecPermute(block2, block3, m1);
+    simon128_t y2 = (simon128_t)VecPermute(block2, block3, m2);
+    simon128_t x3 = (simon128_t)VecPermute(block4, block5, m1);
+    simon128_t y3 = (simon128_t)VecPermute(block4, block5, m2);
+
+    if (rounds & 1)
+    {
+        std::swap(x1, y1); std::swap(x2, y2); std::swap(x3, y3);
+
+        const word32* ptr = reinterpret_cast<const word32*>(subkeys+rounds-1);
+        const simon128_t tk = (simon128_t)VecLoad(ptr);
+        const simon128_t rk = (simon128_t)VecSplatElement64<0>(tk);
+
+        y1 = VecXor64(VecXor64(y1, rk), SIMON128_f(x1));
+        y2 = VecXor64(VecXor64(y2, rk), SIMON128_f(x2));
+        y3 = VecXor64(VecXor64(y3, rk), SIMON128_f(x3));
+        rounds--;
+    }
+
+    for (int i = static_cast<int>(rounds-2); i >= 0; i -= 2)
+    {
+        const word32* ptr = reinterpret_cast<const word32*>(subkeys+i);
+        const simon128_t tk = (simon128_t)VecLoad(ptr);
+        const simon128_t rk1 = (simon128_t)VecSplatElement64<1>(tk);
+        const simon128_t rk2 = (simon128_t)VecSplatElement64<0>(tk);
+
+        x1 = VecXor64(VecXor64(x1, SIMON128_f(y1)), rk1);
+        x2 = VecXor64(VecXor64(x2, SIMON128_f(y2)), rk1);
+        x3 = VecXor64(VecXor64(x3, SIMON128_f(y3)), rk1);
+
+        y1 = VecXor64(VecXor64(y1, SIMON128_f(x1)), rk2);
+        y2 = VecXor64(VecXor64(y2, SIMON128_f(x2)), rk2);
+        y3 = VecXor64(VecXor64(y3, SIMON128_f(x3)), rk2);
+    }
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m3 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m4 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m3 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m4 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = (uint32x4_p)VecPermute(x1, y1, m3);
+    block1 = (uint32x4_p)VecPermute(x1, y1, m4);
+    block2 = (uint32x4_p)VecPermute(x2, y2, m3);
+    block3 = (uint32x4_p)VecPermute(x2, y2, m4);
+    block4 = (uint32x4_p)VecPermute(x3, y3, m3);
+    block5 = (uint32x4_p)VecPermute(x3, y3, m4);
+}
+
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+
+ANONYMOUS_NAMESPACE_END
+
+///////////////////////////////////////////////////////////////////////
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// *************************** ARM NEON **************************** //
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+size_t SIMON128_Enc_AdvancedProcessBlocks_NEON(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x2_NEON(SIMON128_Enc_Block, SIMON128_Enc_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t SIMON128_Dec_AdvancedProcessBlocks_NEON(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x2_NEON(SIMON128_Dec_Block, SIMON128_Dec_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+// ***************************** IA-32 ***************************** //
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+size_t SIMON128_Enc_AdvancedProcessBlocks_SSSE3(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x2_SSE(SIMON128_Enc_Block, SIMON128_Enc_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t SIMON128_Dec_AdvancedProcessBlocks_SSSE3(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x2_SSE(SIMON128_Dec_Block, SIMON128_Dec_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
+
+// ***************************** Altivec ***************************** //
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+size_t SIMON128_Enc_AdvancedProcessBlocks_ALTIVEC(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x1_ALTIVEC(SIMON128_Enc_Block, SIMON128_Enc_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t SIMON128_Dec_AdvancedProcessBlocks_ALTIVEC(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x1_ALTIVEC(SIMON128_Dec_Block, SIMON128_Dec_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/simple.cpp b/runtime/third_party/cryptopp/simple.cpp
new file mode 100644
index 0000000..31b57b7
--- /dev/null
+++ b/runtime/third_party/cryptopp/simple.cpp
@@ -0,0 +1,13 @@
+// simple.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "simple.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/simple.h b/runtime/third_party/cryptopp/simple.h
new file mode 100644
index 0000000..885c678
--- /dev/null
+++ b/runtime/third_party/cryptopp/simple.h
@@ -0,0 +1,506 @@
+// simple.h - originally written and placed in the public domain by Wei Dai
+
+/// \file simple.h
+/// \brief Classes providing basic library services.
+
+#ifndef CRYPTOPP_SIMPLE_H
+#define CRYPTOPP_SIMPLE_H
+
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4127 4189)
+#endif
+
+#include "cryptlib.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Base class for identifying algorithm
+/// \tparam BASE base class from which to derive
+/// \tparam DERIVED class which to clone
+template <class DERIVED, class BASE>
+class CRYPTOPP_NO_VTABLE ClonableImpl : public BASE
+{
+public:
+	/// \brief Create a copy of this object
+	/// \return a copy of this object
+	/// \details The caller is responsible for freeing the object.
+	Clonable * Clone() const {return new DERIVED(*static_cast<const DERIVED *>(this));}
+};
+
+/// \brief Base class information
+/// \tparam BASE an Algorithm derived class
+/// \tparam ALGORITHM_INFO an Algorithm derived class
+/// \details AlgorithmImpl provides StaticAlgorithmName from the template parameter BASE
+template <class BASE, class ALGORITHM_INFO=BASE>
+class CRYPTOPP_NO_VTABLE AlgorithmImpl : public BASE
+{
+public:
+	/// \brief The algorithm name
+	/// \return the algorithm name
+	/// \details StaticAlgorithmName returns the algorithm's name as a static member function.
+	///  The name is taken from information provided by BASE.
+	static std::string CRYPTOPP_API StaticAlgorithmName() {return ALGORITHM_INFO::StaticAlgorithmName();}
+	/// \brief The algorithm name
+	/// \return the algorithm name
+	/// \details AlgorithmName returns the algorithm's name as a member function.
+	///  The name is acquired by calling StaticAlgorithmName.
+	std::string AlgorithmName() const {return ALGORITHM_INFO::StaticAlgorithmName();}
+};
+
+/// \brief Exception thrown when an invalid key length is encountered
+class CRYPTOPP_DLL InvalidKeyLength : public InvalidArgument
+{
+public:
+	/// \brief Construct an InvalidKeyLength
+	/// \param algorithm the Algorithm associated with the exception
+	/// \param length the key size associated with the exception
+	explicit InvalidKeyLength(const std::string &algorithm, size_t length) : InvalidArgument(algorithm + ": " + IntToString(length) + " is not a valid key length") {}
+};
+
+/// \brief Exception thrown when an invalid number of rounds is encountered
+class CRYPTOPP_DLL InvalidRounds : public InvalidArgument
+{
+public:
+	/// \brief Construct an InvalidRounds
+	/// \param algorithm the Algorithm associated with the exception
+	/// \param rounds the number of rounds associated with the exception
+	explicit InvalidRounds(const std::string &algorithm, unsigned int rounds) : InvalidArgument(algorithm + ": " + IntToString(rounds) + " is not a valid number of rounds") {}
+};
+
+/// \brief Exception thrown when an invalid block size is encountered
+class CRYPTOPP_DLL InvalidBlockSize : public InvalidArgument
+{
+public:
+	/// \brief Construct an InvalidBlockSize
+	/// \param algorithm the Algorithm associated with the exception
+	/// \param length the block size associated with the exception
+	explicit InvalidBlockSize(const std::string &algorithm, size_t length) : InvalidArgument(algorithm + ": " + IntToString(length) + " is not a valid block size") {}
+};
+
+/// \brief Exception thrown when an invalid derived key length is encountered
+class CRYPTOPP_DLL InvalidDerivedKeyLength : public InvalidArgument
+{
+public:
+	/// \brief Construct an InvalidDerivedKeyLength
+	/// \param algorithm the Algorithm associated with the exception
+	/// \param length the size associated with the exception
+	explicit InvalidDerivedKeyLength(const std::string &algorithm, size_t length) : InvalidArgument(algorithm + ": " + IntToString(length) + " is not a valid derived key length") {}
+};
+
+/// \brief Exception thrown when an invalid personalization string length is encountered
+class CRYPTOPP_DLL InvalidPersonalizationLength : public InvalidArgument
+{
+public:
+	/// \brief Construct an InvalidPersonalizationLength
+	/// \param algorithm the Algorithm associated with the exception
+	/// \param length the personalization size associated with the exception
+	explicit InvalidPersonalizationLength(const std::string &algorithm, size_t length) : InvalidArgument(algorithm + ": " + IntToString(length) + " is not a valid salt length") {}
+};
+
+/// \brief Exception thrown when an invalid salt length is encountered
+class CRYPTOPP_DLL InvalidSaltLength : public InvalidArgument
+{
+public:
+	/// \brief Construct an InvalidSaltLength
+	/// \param algorithm the Algorithm associated with the exception
+	/// \param length the salt size associated with the exception
+	explicit InvalidSaltLength(const std::string &algorithm, size_t length) : InvalidArgument(algorithm + ": " + IntToString(length) + " is not a valid salt length") {}
+};
+
+// *****************************
+
+/// \brief Base class for bufferless filters
+/// \tparam T the class or type
+template <class T>
+class CRYPTOPP_NO_VTABLE Bufferless : public T
+{
+public:
+	/// \brief Flushes data buffered by this object, without signal propagation
+	/// \param hardFlush indicates whether all data should be flushed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \note hardFlush must be used with care
+	bool IsolatedFlush(bool hardFlush, bool blocking)
+		{CRYPTOPP_UNUSED(hardFlush); CRYPTOPP_UNUSED(blocking); return false;}
+};
+
+/// \brief Base class for unflushable filters
+/// \tparam T the class or type
+template <class T>
+class CRYPTOPP_NO_VTABLE Unflushable : public T
+{
+public:
+	/// \brief Flush buffered input and/or output, with signal propagation
+	/// \param completeFlush is used to indicate whether all data should be flushed
+	/// \param propagation the number of attached transformations the Flush()
+	///  signal should be passed
+	/// \param blocking specifies whether the object should block when processing
+	///  input
+	/// \details propagation count includes this object. Setting propagation to
+	///  <tt>1</tt> means this object only. Setting propagation to <tt>-1</tt>
+	///  means unlimited propagation.
+	/// \note Hard flushes must be used with care. It means try to process and
+	///  output everything, even if there may not be enough data to complete the
+	///  action. For example, hard flushing a HexDecoder would cause an error if
+	///  you do it after inputing an odd number of hex encoded characters.
+	/// \note For some types of filters, like  ZlibDecompressor, hard flushes can
+	///  only be done at "synchronization points". These synchronization points
+	///  are positions in the data stream that are created by hard flushes on the
+	///  corresponding reverse filters, in this example ZlibCompressor. This is
+	///  useful when zlib compressed data is moved across a network in packets
+	///  and compression state is preserved across packets, as in the SSH2 protocol.
+	bool Flush(bool completeFlush, int propagation=-1, bool blocking=true)
+		{return ChannelFlush(DEFAULT_CHANNEL, completeFlush, propagation, blocking);}
+
+	/// \brief Flushes data buffered by this object, without signal propagation
+	/// \param hardFlush indicates whether all data should be flushed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \note hardFlush must be used with care
+	bool IsolatedFlush(bool hardFlush, bool blocking)
+		{CRYPTOPP_UNUSED(hardFlush); CRYPTOPP_UNUSED(blocking); CRYPTOPP_ASSERT(false); return false;}
+
+	/// \brief Flush buffered input and/or output on a channel
+	/// \param channel the channel to flush the data
+	/// \param hardFlush is used to indicate whether all data should be flushed
+	/// \param propagation the number of attached transformations the ChannelFlush()
+	///  signal should be passed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \return true of the Flush was successful
+	/// \details propagation count includes this object. Setting propagation to
+	///  <tt>1</tt> means this object only. Setting propagation to <tt>-1</tt> means
+	///  unlimited propagation.
+	bool ChannelFlush(const std::string &channel, bool hardFlush, int propagation=-1, bool blocking=true)
+	{
+		if (hardFlush && !InputBufferIsEmpty())
+			throw CannotFlush("Unflushable<T>: this object has buffered input that cannot be flushed");
+		else
+		{
+			BufferedTransformation *attached = this->AttachedTransformation();
+			return attached && propagation ? attached->ChannelFlush(channel, hardFlush, propagation-1, blocking) : false;
+		}
+	}
+
+protected:
+	virtual bool InputBufferIsEmpty() const {return false;}
+};
+
+/// \brief Base class for input rejecting filters
+/// \tparam T the class or type
+/// \details T should be a BufferedTransformation derived class
+template <class T>
+class CRYPTOPP_NO_VTABLE InputRejecting : public T
+{
+public:
+	struct InputRejected : public NotImplemented
+		{InputRejected() : NotImplemented("BufferedTransformation: this object doesn't allow input") {}};
+
+	///	\name INPUT
+	//@{
+
+	/// \brief Input a byte array for processing
+	/// \param inString the byte array to process
+	/// \param length the size of the string, in bytes
+	/// \param messageEnd means how many filters to signal MessageEnd() to, including this one
+	/// \param blocking specifies whether the object should block when processing input
+	/// \throw InputRejected
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed)
+	/// \details Internally, the default implementation throws InputRejected.
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+		{CRYPTOPP_UNUSED(inString); CRYPTOPP_UNUSED(length); CRYPTOPP_UNUSED(messageEnd); CRYPTOPP_UNUSED(blocking); throw InputRejected();}
+	//@}
+
+	///	\name SIGNALS
+	//@{
+
+	/// \brief Flushes data buffered by this object, without signal propagation
+	/// \param hardFlush indicates whether all data should be flushed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \note hardFlush must be used with care
+	bool IsolatedFlush(bool hardFlush, bool blocking)
+		{CRYPTOPP_UNUSED(hardFlush); CRYPTOPP_UNUSED(blocking); return false;}
+
+	/// \brief Marks the end of a series of messages, without signal propagation
+	/// \param blocking specifies whether the object should block when completing the processing on
+	///  the current series of messages
+	/// \return true if the message was successful, false otherwise
+	bool IsolatedMessageSeriesEnd(bool blocking)
+		{CRYPTOPP_UNUSED(blocking); throw InputRejected();}
+
+	/// \brief Input multiple bytes for processing on a channel.
+	/// \param channel the channel to process the data.
+	/// \param inString the byte buffer to process.
+	/// \param length the size of the string, in bytes.
+	/// \param messageEnd means how many filters to signal MessageEnd() to, including this one.
+	/// \param blocking specifies whether the object should block when processing input.
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed)
+	size_t ChannelPut2(const std::string &channel, const byte *inString, size_t length, int messageEnd, bool blocking)
+		{CRYPTOPP_UNUSED(channel); CRYPTOPP_UNUSED(inString); CRYPTOPP_UNUSED(length);
+		 CRYPTOPP_UNUSED(messageEnd); CRYPTOPP_UNUSED(blocking); throw InputRejected();}
+
+	/// \brief Marks the end of a series of messages on a channel
+	/// \param channel the channel to signal the end of a series of messages
+	/// \param messageEnd the number of attached transformations the ChannelMessageSeriesEnd() signal should be passed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \return true if the message was successful, false otherwise
+	/// \details Each object that receives the signal will perform its processing, decrement
+	///  propagation, and then pass the signal on to attached transformations if the value is not 0.
+	/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+	///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+	/// \note There should be a MessageEnd() immediately before MessageSeriesEnd().
+	bool ChannelMessageSeriesEnd(const std::string& channel, int messageEnd, bool blocking)
+		{CRYPTOPP_UNUSED(channel); CRYPTOPP_UNUSED(messageEnd); CRYPTOPP_UNUSED(blocking); throw InputRejected();}
+	//@}
+};
+
+/// \brief Interface for custom flush signals propagation
+/// \tparam T BufferedTransformation derived class
+template <class T>
+class CRYPTOPP_NO_VTABLE CustomFlushPropagation : public T
+{
+public:
+	///	\name SIGNALS
+	//@{
+
+	/// \brief Flush buffered input and/or output, with signal propagation
+	/// \param hardFlush is used to indicate whether all data should be flushed
+	/// \param propagation the number of attached transformations the  Flush() signal should be passed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+	///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+	/// \note Hard flushes must be used with care. It means try to process and output everything, even if
+	///  there may not be enough data to complete the action. For example, hard flushing a HexDecoder
+	///  would cause an error if you do it after inputing an odd number of hex encoded characters.
+	/// \note For some types of filters, like  ZlibDecompressor, hard flushes can only
+	///  be done at "synchronization points". These synchronization points are positions in the data
+	///  stream that are created by hard flushes on the corresponding reverse filters, in this
+	///  example ZlibCompressor. This is useful when zlib compressed data is moved across a
+	///  network in packets and compression state is preserved across packets, as in the SSH2 protocol.
+	virtual bool Flush(bool hardFlush, int propagation=-1, bool blocking=true) =0;
+
+	//@}
+
+private:
+	bool IsolatedFlush(bool hardFlush, bool blocking)
+		{CRYPTOPP_UNUSED(hardFlush); CRYPTOPP_UNUSED(blocking); CRYPTOPP_ASSERT(false); return false;}
+};
+
+/// \brief Interface for custom flush signals
+/// \tparam T BufferedTransformation derived class
+template <class T>
+class CRYPTOPP_NO_VTABLE CustomSignalPropagation : public CustomFlushPropagation<T>
+{
+public:
+	/// \brief Initialize or reinitialize this object, with signal propagation
+	/// \param parameters a set of NameValuePairs to initialize or reinitialize this object
+	/// \param propagation the number of attached transformations the Initialize() signal should be passed
+	/// \details Initialize() is used to initialize or reinitialize an object using a variable number of
+	///  arbitrarily typed arguments. The function avoids the need for multiple constructors providing
+	///  all possible combintations of configurable parameters.
+	/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+	///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+	virtual void Initialize(const NameValuePairs &parameters=g_nullNameValuePairs, int propagation=-1) =0;
+
+private:
+	void IsolatedInitialize(const NameValuePairs &parameters)
+		{CRYPTOPP_UNUSED(parameters); CRYPTOPP_ASSERT(false);}
+};
+
+/// \brief Multiple channels support for custom signal processing
+/// \tparam T the class or type
+/// \details T should be a BufferedTransformation derived class
+template <class T>
+class CRYPTOPP_NO_VTABLE Multichannel : public CustomFlushPropagation<T>
+{
+public:
+	bool Flush(bool hardFlush, int propagation=-1, bool blocking=true)
+		{return this->ChannelFlush(DEFAULT_CHANNEL, hardFlush, propagation, blocking);}
+
+	/// \brief Marks the end of a series of messages, with signal propagation
+	/// \param propagation the number of attached transformations the  MessageSeriesEnd() signal should be passed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \details Each object that receives the signal will perform its processing, decrement
+	///  propagation, and then pass the signal on to attached transformations if the value is not 0.
+	/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+	///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+	/// \note There should be a MessageEnd() immediately before MessageSeriesEnd().
+	bool MessageSeriesEnd(int propagation=-1, bool blocking=true)
+		{return this->ChannelMessageSeriesEnd(DEFAULT_CHANNEL, propagation, blocking);}
+
+	/// \brief Request space which can be written into by the caller
+	/// \param size the requested size of the buffer
+	/// \details The purpose of this method is to help avoid extra memory allocations.
+	/// \details size is an \a IN and \a OUT parameter and used as a hint. When the call is made,
+	///  size is the requested size of the buffer. When the call returns,  size is the size of
+	///  the array returned to the caller.
+	/// \details The base class implementation sets  size to 0 and returns  NULL.
+	/// \note Some objects, like ArraySink, cannot create a space because its fixed. In the case of
+	///  an ArraySink, the pointer to the array is returned and the  size is remaining size.
+	byte * CreatePutSpace(size_t &size)
+		{return this->ChannelCreatePutSpace(DEFAULT_CHANNEL, size);}
+
+	/// \brief Input multiple bytes for processing
+	/// \param inString the byte buffer to process
+	/// \param length the size of the string, in bytes
+	/// \param messageEnd means how many filters to signal MessageEnd() to, including this one
+	/// \param blocking specifies whether the object should block when processing input
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed)
+	/// \details Derived classes must implement Put2().
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+		{return this->ChannelPut2(DEFAULT_CHANNEL, inString, length, messageEnd, blocking);}
+
+	/// \brief Input multiple bytes that may be modified by callee.
+	/// \param inString the byte buffer to process.
+	/// \param length the size of the string, in bytes.
+	/// \param messageEnd means how many filters to signal MessageEnd() to, including this one.
+	/// \param blocking specifies whether the object should block when processing input.
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed)
+	/// \details Internally, PutModifiable2() calls Put2().
+	size_t PutModifiable2(byte *inString, size_t length, int messageEnd, bool blocking)
+		{return this->ChannelPutModifiable2(DEFAULT_CHANNEL, inString, length, messageEnd, blocking);}
+
+	//	void ChannelMessageSeriesEnd(const std::string &channel, int propagation=-1)
+	//		{PropagateMessageSeriesEnd(propagation, channel);}
+
+	/// \brief Request space which can be written into by the caller
+	/// \param channel the channel to process the data
+	/// \param size the requested size of the buffer
+	/// \return a pointer to a memory block with length size
+	/// \details The purpose of this method is to help avoid extra memory allocations.
+	/// \details size is an \a IN and \a OUT parameter and used as a hint. When the call is made,
+	///  size is the requested size of the buffer. When the call returns, size is the size of
+	///  the array returned to the caller.
+	/// \details The base class implementation sets size to 0 and returns NULL.
+	/// \note Some objects, like ArraySink(), cannot create a space because its fixed. In the case of
+	///  an ArraySink(), the pointer to the array is returned and the size is remaining size.
+	byte * ChannelCreatePutSpace(const std::string &channel, size_t &size)
+		{CRYPTOPP_UNUSED(channel); size = 0; return NULLPTR;}
+
+	/// \brief Input multiple bytes that may be modified by callee on a channel
+	/// \param channel the channel to process the data.
+	/// \param inString the byte buffer to process
+	/// \param length the size of the string, in bytes
+	/// \return true if all bytes were processed, false otherwise.
+	bool ChannelPutModifiable(const std::string &channel, byte *inString, size_t length)
+		{this->ChannelPut(channel, inString, length); return false;}
+
+	/// \brief Input multiple bytes for processing on a channel.
+	/// \param channel the channel to process the data.
+	/// \param begin the byte buffer to process.
+	/// \param length the size of the string, in bytes.
+	/// \param messageEnd means how many filters to signal MessageEnd() to, including this one.
+	/// \param blocking specifies whether the object should block when processing input.
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed)
+	virtual size_t ChannelPut2(const std::string &channel, const byte *begin, size_t length, int messageEnd, bool blocking) =0;
+
+	/// \brief Input multiple bytes that may be modified by callee on a channel
+	/// \param channel the channel to process the data
+	/// \param begin the byte buffer to process
+	/// \param length the size of the string, in bytes
+	/// \param messageEnd means how many filters to signal MessageEnd() to, including this one
+	/// \param blocking specifies whether the object should block when processing input
+	/// \return the number of bytes that remain to be processed (i.e., bytes not processed)
+	size_t ChannelPutModifiable2(const std::string &channel, byte *begin, size_t length, int messageEnd, bool blocking)
+		{return ChannelPut2(channel, begin, length, messageEnd, blocking);}
+
+	/// \brief Flush buffered input and/or output on a channel
+	/// \param channel the channel to flush the data
+	/// \param hardFlush is used to indicate whether all data should be flushed
+	/// \param propagation the number of attached transformations the ChannelFlush() signal should be passed
+	/// \param blocking specifies whether the object should block when processing input
+	/// \return true of the Flush was successful
+	/// \details propagation count includes this object. Setting propagation to <tt>1</tt> means this
+	///  object only. Setting propagation to <tt>-1</tt> means unlimited propagation.
+	virtual bool ChannelFlush(const std::string &channel, bool hardFlush, int propagation=-1, bool blocking=true) =0;
+};
+
+/// \brief Provides auto signaling support
+/// \tparam T BufferedTransformation derived class
+template <class T>
+class CRYPTOPP_NO_VTABLE AutoSignaling : public T
+{
+public:
+	/// \brief Construct an AutoSignaling
+	/// \param propagation the propagation count
+	AutoSignaling(int propagation=-1) : m_autoSignalPropagation(propagation) {}
+
+	/// \brief Set propagation of automatically generated and transferred signals
+	/// \param propagation then new value
+	/// \details Setting propagation to <tt>0</tt> means do not automatically generate signals. Setting
+	///  propagation to <tt>-1</tt> means unlimited propagation.
+	void SetAutoSignalPropagation(int propagation)
+		{m_autoSignalPropagation = propagation;}
+
+	/// \brief Retrieve automatic signal propagation value
+	/// \return the number of attached transformations the signal is propagated to. 0 indicates
+	///  the signal is only witnessed by this object
+	int GetAutoSignalPropagation() const
+		{return m_autoSignalPropagation;}
+
+private:
+	int m_autoSignalPropagation;
+};
+
+/// \brief Acts as a Source for pre-existing, static data
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Store : public AutoSignaling<InputRejecting<BufferedTransformation> >
+{
+public:
+	/// \brief Construct a Store
+	Store() : m_messageEnd(false) {}
+
+	void IsolatedInitialize(const NameValuePairs &parameters)
+	{
+		m_messageEnd = false;
+		StoreInitialize(parameters);
+	}
+
+	unsigned int NumberOfMessages() const {return m_messageEnd ? 0 : 1;}
+	bool GetNextMessage();
+	unsigned int CopyMessagesTo(BufferedTransformation &target, unsigned int count=UINT_MAX, const std::string &channel=DEFAULT_CHANNEL) const;
+
+protected:
+	virtual void StoreInitialize(const NameValuePairs &parameters) =0;
+
+	bool m_messageEnd;
+};
+
+/// \brief Implementation of BufferedTransformation's attachment interface
+/// \details Sink is a cornerstone of the Pipeline trinity. Data flows from
+///  Sources, through Filters, and then terminates in Sinks. The difference
+///  between a Source and Filter is a Source \a pumps data, while a Filter does
+///  not. The difference between a Filter and a Sink is a Filter allows an
+///  attached transformation, while a Sink does not.
+/// \details A Sink does not produce any retrievable output.
+/// \details See the discussion of BufferedTransformation in cryptlib.h for
+///  more details.
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Sink : public BufferedTransformation
+{
+public:
+	size_t TransferTo2(BufferedTransformation &target, lword &transferBytes, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true)
+		{CRYPTOPP_UNUSED(target); CRYPTOPP_UNUSED(transferBytes); CRYPTOPP_UNUSED(channel); CRYPTOPP_UNUSED(blocking); transferBytes = 0; return 0;}
+	size_t CopyRangeTo2(BufferedTransformation &target, lword &begin, lword end=LWORD_MAX, const std::string &channel=DEFAULT_CHANNEL, bool blocking=true) const
+		{CRYPTOPP_UNUSED(target); CRYPTOPP_UNUSED(begin); CRYPTOPP_UNUSED(end); CRYPTOPP_UNUSED(channel); CRYPTOPP_UNUSED(blocking); return 0;}
+};
+
+/// \brief Acts as an input discarding Filter or Sink
+/// \details The BitBucket discards all input and returns 0 to the caller
+///  to indicate all data was processed.
+class CRYPTOPP_DLL BitBucket : public Bufferless<Sink>
+{
+public:
+	std::string AlgorithmName() const {return "BitBucket";}
+	void IsolatedInitialize(const NameValuePairs &params)
+		{CRYPTOPP_UNUSED(params);}
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+		{CRYPTOPP_UNUSED(inString); CRYPTOPP_UNUSED(length); CRYPTOPP_UNUSED(messageEnd); CRYPTOPP_UNUSED(blocking); return 0;}
+};
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/siphash.h b/runtime/third_party/cryptopp/siphash.h
new file mode 100644
index 0000000..5eb5321
--- /dev/null
+++ b/runtime/third_party/cryptopp/siphash.h
@@ -0,0 +1,314 @@
+// siphash.h - written and placed in public domain by Jeffrey Walton.
+
+/// \file siphash.h
+/// \brief Classes for SipHash message authentication code
+/// \details SipHash computes a 64-bit or 128-bit message authentication code from a variable-length
+///   message and 128-bit secret key. It was designed to be efficient even for short inputs, with
+///   performance comparable to non-cryptographic hash functions.
+/// \details To create a SipHash-2-4 object with a 64-bit MAC use code similar to the following.
+///   <pre>  SecByteBlock key(16);
+///   prng.GenerateBlock(key, key.size());
+///
+///   SipHash<2,4,false> hash(key, key.size());
+///   hash.Update(...);
+///   hash.Final(...);</pre>
+/// \details To create a SipHash-2-4 object with a 128-bit MAC use code similar to the following.
+///   <pre>  SecByteBlock key(16);
+///   prng.GenerateBlock(key, key.size());
+///
+///   SipHash<2,4,true> hash(key, key.size());
+///   hash.Update(...);
+///   hash.Final(...);</pre>
+/// \sa Jean-Philippe Aumasson and Daniel J. Bernstein <A HREF="http://131002.net/siphash/siphash.pdf">SipHash:
+///   a fast short-input PRF</A>
+/// \since Crypto++ 6.0
+
+#ifndef CRYPTOPP_SIPHASH_H
+#define CRYPTOPP_SIPHASH_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "seckey.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SipHash message authentication code information
+/// \tparam T_128bit flag indicating 128-bit (true) versus 64-bit (false) digest size
+template <bool T_128bit>
+class SipHash_Info : public FixedKeyLength<16>
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "SipHash";}
+	CRYPTOPP_CONSTANT(DIGESTSIZE = (T_128bit ? 16 : 8));
+};
+
+/// \brief SipHash message authentication code base class
+/// \tparam C the number of compression rounds
+/// \tparam D the number of finalization rounds
+/// \tparam T_128bit flag indicating 128-bit (true) versus 64-bit (false) digest size
+template <unsigned int C, unsigned int D, bool T_128bit>
+class SipHash_Base : public MessageAuthenticationCode, public SipHash_Info<T_128bit>
+{
+public:
+	static std::string StaticAlgorithmName() {
+		return std::string(SipHash_Info<T_128bit>::StaticAlgorithmName())+"-"+IntToString(C)+"-"+IntToString(D);
+	}
+
+	virtual ~SipHash_Base() {}
+
+	SipHash_Base() : m_idx(0) {}
+
+	virtual unsigned int DigestSize() const
+		{return SipHash_Info<T_128bit>::DIGESTSIZE;}
+	virtual size_t MinKeyLength() const
+		{return SipHash_Info<T_128bit>::MIN_KEYLENGTH;}
+	virtual size_t MaxKeyLength() const
+		{return SipHash_Info<T_128bit>::MAX_KEYLENGTH;}
+	virtual size_t DefaultKeyLength() const
+		{return SipHash_Info<T_128bit>::DEFAULT_KEYLENGTH;}
+	virtual size_t GetValidKeyLength(size_t keylength) const
+		{CRYPTOPP_UNUSED(keylength); return SipHash_Info<T_128bit>::DEFAULT_KEYLENGTH;}
+	virtual IV_Requirement IVRequirement() const
+		{return SimpleKeyingInterface::NOT_RESYNCHRONIZABLE;}
+	virtual unsigned int IVSize() const
+		{return 0;}
+	virtual unsigned int OptimalBlockSize() const
+		{return sizeof(word64);}
+	virtual unsigned int OptimalDataAlignment () const
+		{return GetAlignmentOf<word64>();}
+
+	virtual void Update(const byte *input, size_t length);
+	virtual void TruncatedFinal(byte *digest, size_t digestSize);
+
+protected:
+
+	virtual void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+	virtual void Restart();
+
+	inline void SIPROUND()
+	{
+		m_v[0] += m_v[1];
+		m_v[1] = rotlConstant<13>(m_v[1]);
+		m_v[1] ^= m_v[0];
+		m_v[0] = rotlConstant<32>(m_v[0]);
+		m_v[2] += m_v[3];
+		m_v[3] = rotlConstant<16>(m_v[3]);
+		m_v[3] ^= m_v[2];
+		m_v[0] += m_v[3];
+		m_v[3] = rotlConstant<21>(m_v[3]);
+		m_v[3] ^= m_v[0];
+		m_v[2] += m_v[1];
+		m_v[1] = rotlConstant<17>(m_v[1]);
+		m_v[1] ^= m_v[2];
+		m_v[2] = rotlConstant<32>(m_v[2]);
+	}
+
+private:
+	FixedSizeSecBlock<word64, 4> m_v;
+	FixedSizeSecBlock<word64, 2> m_k;
+	FixedSizeSecBlock<word64, 2> m_b;
+
+	// Tail bytes
+	FixedSizeSecBlock<byte, 8> m_acc;
+	size_t m_idx;
+};
+
+/// \brief SipHash message authentication code
+/// \tparam C the number of compression rounds
+/// \tparam D the number of finalization rounds
+/// \tparam T_128bit flag indicating 128-bit (true) versus 64-bit (false) digest size
+/// \details SipHash computes a 64-bit or 128-bit message authentication code from a variable-length
+///   message and 128-bit secret key. It was designed to be efficient even for short inputs, with
+///   performance comparable to non-cryptographic hash functions.
+/// \details To create a SipHash-2-4 object with a 64-bit MAC use code similar to the following.
+///   <pre>  SecByteBlock key(16);
+///   prng.GenerateBlock(key, key.size());
+///
+///   SipHash<2,4,false> hash(key, key.size());
+///   hash.Update(...);
+///   hash.Final(...);</pre>
+/// \details To create a SipHash-2-4 object with a 128-bit MAC use code similar to the following.
+///   <pre>  SecByteBlock key(16);
+///   prng.GenerateBlock(key, key.size());
+///
+///   SipHash<2,4,true> hash(key, key.size());
+///   hash.Update(...);
+///   hash.Final(...);</pre>
+/// \sa Jean-Philippe Aumasson and Daniel J. Bernstein <A HREF="http://131002.net/siphash/siphash.pdf">SipHash:
+///   a fast short-input PRF</A>
+/// \since Crypto++ 6.0
+template <unsigned int C=2, unsigned int D=4, bool T_128bit=false>
+class SipHash : public SipHash_Base<C, D, T_128bit>
+{
+public:
+	/// \brief Create a SipHash
+	SipHash()
+		{this->UncheckedSetKey(NULLPTR, 0, g_nullNameValuePairs);}
+	/// \brief Create a SipHash
+	/// \param key a byte array used to key the cipher
+	/// \param length the size of the byte array, in bytes
+	SipHash(const byte *key, unsigned int length)
+		{this->ThrowIfInvalidKeyLength(length);
+		 this->UncheckedSetKey(key, length, g_nullNameValuePairs);}
+};
+
+template <unsigned int C, unsigned int D, bool T_128bit>
+void SipHash_Base<C,D,T_128bit>::Update(const byte *input, size_t length)
+{
+	CRYPTOPP_ASSERT((input && length) || !length);
+	if (!length) return;
+
+	if (m_idx)
+	{
+		size_t head = STDMIN(size_t(8U-m_idx), length);
+		std::memcpy(m_acc+m_idx, input, head);
+		m_idx += head; input += head; length -= head;
+
+		if (m_idx == 8)
+		{
+			word64 m = GetWord<word64>(true, LITTLE_ENDIAN_ORDER, m_acc);
+			m_v[3] ^= m;
+			for (unsigned int i = 0; i < C; ++i)
+				SIPROUND();
+
+			m_v[0] ^= m;
+			m_b[0] += 8;
+
+			m_idx = 0;
+		}
+	}
+
+	while (length >= 8)
+	{
+		word64 m = GetWord<word64>(false, LITTLE_ENDIAN_ORDER, input);
+		m_v[3] ^= m;
+		for (unsigned int i = 0; i < C; ++i)
+			SIPROUND();
+
+		m_v[0] ^= m;
+		m_b[0] += 8;
+
+		input += 8;
+		length -= 8;
+	}
+
+	CRYPTOPP_ASSERT(length < 8);
+	size_t tail = length % 8;
+	if (tail)
+	{
+		std::memcpy(m_acc+m_idx, input, tail);
+		m_idx += tail;
+	}
+}
+
+template <unsigned int C, unsigned int D, bool T_128bit>
+void SipHash_Base<C,D,T_128bit>::TruncatedFinal(byte *digest, size_t digestSize)
+{
+	CRYPTOPP_ASSERT(digest);      // Pointer is valid
+
+	ThrowIfInvalidTruncatedSize(digestSize);
+
+	// The high octet holds length and is digested mod 256
+	m_b[0] += m_idx; m_b[0] <<= 56U;
+	switch (m_idx)
+	{
+		case 7:
+			m_b[0] |= ((word64)m_acc[6]) << 48;
+			// fall through
+		case 6:
+			m_b[0] |= ((word64)m_acc[5]) << 40;
+			// fall through
+		case 5:
+			m_b[0] |= ((word64)m_acc[4]) << 32;
+			// fall through
+		case 4:
+			m_b[0] |= ((word64)m_acc[3]) << 24;
+			// fall through
+		case 3:
+			m_b[0] |= ((word64)m_acc[2]) << 16;
+			// fall through
+		case 2:
+			m_b[0] |= ((word64)m_acc[1]) << 8;
+			// fall through
+		case 1:
+			m_b[0] |= ((word64)m_acc[0]);
+			// fall through
+		case 0:
+			break;
+	}
+
+	m_v[3] ^= m_b[0];
+
+	for (unsigned int i=0; i<C; i++)
+		SIPROUND();
+
+	m_v[0] ^= m_b[0];
+
+	if (T_128bit)
+		m_v[2] ^= 0xee;
+	else
+		m_v[2] ^= 0xff;
+
+	for (unsigned int i=0; i<D; i++)
+		SIPROUND();
+
+	m_b[0] = m_v[0] ^ m_v[1] ^ m_v[2] ^ m_v[3];
+	m_b[0] = ConditionalByteReverse(LITTLE_ENDIAN_ORDER, m_b[0]);
+
+	if (T_128bit)
+	{
+		m_v[1] ^= 0xdd;
+		for (unsigned int i = 0; i<D; ++i)
+			SIPROUND();
+
+		m_b[1] = m_v[0] ^ m_v[1] ^ m_v[2] ^ m_v[3];
+		m_b[1] = ConditionalByteReverse(LITTLE_ENDIAN_ORDER, m_b[1]);
+	}
+
+	memcpy_s(digest, digestSize, m_b.begin(), STDMIN(digestSize, (size_t)SipHash_Info<T_128bit>::DIGESTSIZE));
+	Restart();
+}
+
+template <unsigned int C, unsigned int D, bool T_128bit>
+void SipHash_Base<C,D,T_128bit>::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	CRYPTOPP_UNUSED(params);
+	if (key && length)
+	{
+		m_k[0] = GetWord<word64>(false, LITTLE_ENDIAN_ORDER, key);
+		m_k[1] = GetWord<word64>(false, LITTLE_ENDIAN_ORDER, key+8);
+	}
+	else
+	{
+		// Avoid Coverity finding
+		m_k[0] = m_k[1] = 0;
+	}
+	Restart();
+}
+
+template <unsigned int C, unsigned int D, bool T_128bit>
+void SipHash_Base<C,D,T_128bit>::Restart ()
+{
+	m_v[0] = W64LIT(0x736f6d6570736575);
+	m_v[1] = W64LIT(0x646f72616e646f6d);
+	m_v[2] = W64LIT(0x6c7967656e657261);
+	m_v[3] = W64LIT(0x7465646279746573);
+
+	m_v[3] ^= m_k[1];
+	m_v[2] ^= m_k[0];
+	m_v[1] ^= m_k[1];
+	m_v[0] ^= m_k[0];
+
+	if (T_128bit)
+	{
+		m_v[1] ^= 0xee;
+	}
+
+	m_idx = 0;
+	m_b[0] = 0;
+}
+
+NAMESPACE_END
+
+#endif // CRYPTOPP_SIPHASH_H
diff --git a/runtime/third_party/cryptopp/skipjack.cpp b/runtime/third_party/cryptopp/skipjack.cpp
new file mode 100644
index 0000000..f6044a5
--- /dev/null
+++ b/runtime/third_party/cryptopp/skipjack.cpp
@@ -0,0 +1,202 @@
+// skipjack.cpp - modified by Wei Dai from Paulo Barreto's skipjack32.c,
+// which is public domain according to his web site.
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "skipjack.h"
+
+/*
+ *	Optimized implementation of SKIPJACK algorithm
+ *
+ *	originally written by Panu Rissanen <bande@lut.fi> 1998.06.24
+ *	optimized by Mark Tillotson <markt@chaos.org.uk> 1998.06.25
+ *	optimized by Paulo Barreto <pbarreto@nw.com.br> 1998.06.30
+ */
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/**
+ * The F-table byte permutation (see description of the G-box permutation)
+ */
+const byte SKIPJACK::Base::fTable[256] = {
+	0xa3,0xd7,0x09,0x83,0xf8,0x48,0xf6,0xf4,0xb3,0x21,0x15,0x78,0x99,0xb1,0xaf,0xf9,
+	0xe7,0x2d,0x4d,0x8a,0xce,0x4c,0xca,0x2e,0x52,0x95,0xd9,0x1e,0x4e,0x38,0x44,0x28,
+	0x0a,0xdf,0x02,0xa0,0x17,0xf1,0x60,0x68,0x12,0xb7,0x7a,0xc3,0xe9,0xfa,0x3d,0x53,
+	0x96,0x84,0x6b,0xba,0xf2,0x63,0x9a,0x19,0x7c,0xae,0xe5,0xf5,0xf7,0x16,0x6a,0xa2,
+	0x39,0xb6,0x7b,0x0f,0xc1,0x93,0x81,0x1b,0xee,0xb4,0x1a,0xea,0xd0,0x91,0x2f,0xb8,
+	0x55,0xb9,0xda,0x85,0x3f,0x41,0xbf,0xe0,0x5a,0x58,0x80,0x5f,0x66,0x0b,0xd8,0x90,
+	0x35,0xd5,0xc0,0xa7,0x33,0x06,0x65,0x69,0x45,0x00,0x94,0x56,0x6d,0x98,0x9b,0x76,
+	0x97,0xfc,0xb2,0xc2,0xb0,0xfe,0xdb,0x20,0xe1,0xeb,0xd6,0xe4,0xdd,0x47,0x4a,0x1d,
+	0x42,0xed,0x9e,0x6e,0x49,0x3c,0xcd,0x43,0x27,0xd2,0x07,0xd4,0xde,0xc7,0x67,0x18,
+	0x89,0xcb,0x30,0x1f,0x8d,0xc6,0x8f,0xaa,0xc8,0x74,0xdc,0xc9,0x5d,0x5c,0x31,0xa4,
+	0x70,0x88,0x61,0x2c,0x9f,0x0d,0x2b,0x87,0x50,0x82,0x54,0x64,0x26,0x7d,0x03,0x40,
+	0x34,0x4b,0x1c,0x73,0xd1,0xc4,0xfd,0x3b,0xcc,0xfb,0x7f,0xab,0xe6,0x3e,0x5b,0xa5,
+	0xad,0x04,0x23,0x9c,0x14,0x51,0x22,0xf0,0x29,0x79,0x71,0x7e,0xff,0x8c,0x0e,0xe2,
+	0x0c,0xef,0xbc,0x72,0x75,0x6f,0x37,0xa1,0xec,0xd3,0x8e,0x62,0x8b,0x86,0x10,0xe8,
+	0x08,0x77,0x11,0xbe,0x92,0x4f,0x24,0xc5,0x32,0x36,0x9d,0xcf,0xf3,0xa6,0xbb,0xac,
+	0x5e,0x6c,0xa9,0x13,0x57,0x25,0xb5,0xe3,0xbd,0xa8,0x3a,0x01,0x05,0x59,0x2a,0x46
+};
+
+/**
+ * The key-dependent permutation G on V^16 is a four-round Feistel network.
+ * The round function is a fixed byte-substitution table (permutation on V^8),
+ * the F-table.  Each round of G incorporates a single byte from the key.
+ */
+#define g(tab, w, i, j, k, l) \
+{ \
+	w ^= (word)tab[i*256 + (w & 0xff)] << 8; \
+	w ^= (word)tab[j*256 + (w >>   8)]; \
+	w ^= (word)tab[k*256 + (w & 0xff)] << 8; \
+	w ^= (word)tab[l*256 + (w >>   8)]; \
+}
+
+#define g0(tab, w) g(tab, w, 0, 1, 2, 3)
+#define g1(tab, w) g(tab, w, 4, 5, 6, 7)
+#define g2(tab, w) g(tab, w, 8, 9, 0, 1)
+#define g3(tab, w) g(tab, w, 2, 3, 4, 5)
+#define g4(tab, w) g(tab, w, 6, 7, 8, 9)
+
+/**
+ * The inverse of the G permutation.
+ */
+#define h(tab, w, i, j, k, l) \
+{ \
+	w ^= (word)tab[l*256 + (w >>   8)]; \
+	w ^= (word)tab[k*256 + (w & 0xff)] << 8; \
+	w ^= (word)tab[j*256 + (w >>   8)]; \
+	w ^= (word)tab[i*256 + (w & 0xff)] << 8; \
+}
+
+#define h0(tab, w) h(tab, w, 0, 1, 2, 3)
+#define h1(tab, w) h(tab, w, 4, 5, 6, 7)
+#define h2(tab, w) h(tab, w, 8, 9, 0, 1)
+#define h3(tab, w) h(tab, w, 2, 3, 4, 5)
+#define h4(tab, w) h(tab, w, 6, 7, 8, 9)
+
+/**
+ * Preprocess a user key into a table to save an XOR at each F-table access.
+ */
+void SKIPJACK::Base::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &)
+{
+	AssertValidKeyLength(length);
+
+	/* tab[i][c] = fTable[c ^ key[i]] */
+	int i;
+	for (i = 0; i < 10; i++) {
+		byte *t = tab+i*256, k = key[9-i];
+		int c;
+		for (c = 0; c < 256; c++) {
+			t[c] = fTable[c ^ k];
+		}
+	}
+}
+
+typedef BlockGetAndPut<word16, LittleEndian> Block;
+
+/**
+ * Encrypt a single block of data.
+ */
+void SKIPJACK::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word16 w1, w2, w3, w4;
+	Block::Get(inBlock)(w4)(w3)(w2)(w1);
+
+	/* stepping rule A: */
+	g0(tab, w1); w4 ^= w1 ^ 1;
+	g1(tab, w4); w3 ^= w4 ^ 2;
+	g2(tab, w3); w2 ^= w3 ^ 3;
+	g3(tab, w2); w1 ^= w2 ^ 4;
+	g4(tab, w1); w4 ^= w1 ^ 5;
+	g0(tab, w4); w3 ^= w4 ^ 6;
+	g1(tab, w3); w2 ^= w3 ^ 7;
+	g2(tab, w2); w1 ^= w2 ^ 8;
+
+	/* stepping rule B: */
+	w2 ^= w1 ^  9; g3(tab, w1);
+	w1 ^= w4 ^ 10; g4(tab, w4);
+	w4 ^= w3 ^ 11; g0(tab, w3);
+	w3 ^= w2 ^ 12; g1(tab, w2);
+	w2 ^= w1 ^ 13; g2(tab, w1);
+	w1 ^= w4 ^ 14; g3(tab, w4);
+	w4 ^= w3 ^ 15; g4(tab, w3);
+	w3 ^= w2 ^ 16; g0(tab, w2);
+
+	/* stepping rule A: */
+	g1(tab, w1); w4 ^= w1 ^ 17;
+	g2(tab, w4); w3 ^= w4 ^ 18;
+	g3(tab, w3); w2 ^= w3 ^ 19;
+	g4(tab, w2); w1 ^= w2 ^ 20;
+	g0(tab, w1); w4 ^= w1 ^ 21;
+	g1(tab, w4); w3 ^= w4 ^ 22;
+	g2(tab, w3); w2 ^= w3 ^ 23;
+	g3(tab, w2); w1 ^= w2 ^ 24;
+
+	/* stepping rule B: */
+	w2 ^= w1 ^ 25; g4(tab, w1);
+	w1 ^= w4 ^ 26; g0(tab, w4);
+	w4 ^= w3 ^ 27; g1(tab, w3);
+	w3 ^= w2 ^ 28; g2(tab, w2);
+	w2 ^= w1 ^ 29; g3(tab, w1);
+	w1 ^= w4 ^ 30; g4(tab, w4);
+	w4 ^= w3 ^ 31; g0(tab, w3);
+	w3 ^= w2 ^ 32; g1(tab, w2);
+
+	Block::Put(xorBlock, outBlock)(w4)(w3)(w2)(w1);
+}
+
+/**
+ * Decrypt a single block of data.
+ */
+void SKIPJACK::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word16 w1, w2, w3, w4;
+	Block::Get(inBlock)(w4)(w3)(w2)(w1);
+
+	/* stepping rule A: */
+	h1(tab, w2); w3 ^= w2 ^ 32;
+	h0(tab, w3); w4 ^= w3 ^ 31;
+	h4(tab, w4); w1 ^= w4 ^ 30;
+	h3(tab, w1); w2 ^= w1 ^ 29;
+	h2(tab, w2); w3 ^= w2 ^ 28;
+	h1(tab, w3); w4 ^= w3 ^ 27;
+	h0(tab, w4); w1 ^= w4 ^ 26;
+	h4(tab, w1); w2 ^= w1 ^ 25;
+
+	/* stepping rule B: */
+	w1 ^= w2 ^ 24; h3(tab, w2);
+	w2 ^= w3 ^ 23; h2(tab, w3);
+	w3 ^= w4 ^ 22; h1(tab, w4);
+	w4 ^= w1 ^ 21; h0(tab, w1);
+	w1 ^= w2 ^ 20; h4(tab, w2);
+	w2 ^= w3 ^ 19; h3(tab, w3);
+	w3 ^= w4 ^ 18; h2(tab, w4);
+	w4 ^= w1 ^ 17; h1(tab, w1);
+
+	/* stepping rule A: */
+	h0(tab, w2); w3 ^= w2 ^ 16;
+	h4(tab, w3); w4 ^= w3 ^ 15;
+	h3(tab, w4); w1 ^= w4 ^ 14;
+	h2(tab, w1); w2 ^= w1 ^ 13;
+	h1(tab, w2); w3 ^= w2 ^ 12;
+	h0(tab, w3); w4 ^= w3 ^ 11;
+	h4(tab, w4); w1 ^= w4 ^ 10;
+	h3(tab, w1); w2 ^= w1 ^  9;
+
+	/* stepping rule B: */
+	w1 ^= w2 ^ 8; h2(tab, w2);
+	w2 ^= w3 ^ 7; h1(tab, w3);
+	w3 ^= w4 ^ 6; h0(tab, w4);
+	w4 ^= w1 ^ 5; h4(tab, w1);
+	w1 ^= w2 ^ 4; h3(tab, w2);
+	w2 ^= w3 ^ 3; h2(tab, w3);
+	w3 ^= w4 ^ 2; h1(tab, w4);
+	w4 ^= w1 ^ 1; h0(tab, w1);
+
+	Block::Put(xorBlock, outBlock)(w4)(w3)(w2)(w1);
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/skipjack.h b/runtime/third_party/cryptopp/skipjack.h
new file mode 100644
index 0000000..96fdaf4
--- /dev/null
+++ b/runtime/third_party/cryptopp/skipjack.h
@@ -0,0 +1,80 @@
+// skipjack.h - originally written and placed in the public domain by Wei Dai
+
+/// \file skipjack.h
+/// \brief Classes for the SKIPJACK block cipher
+/// \details The Crypto++ implementation conforms to SKIPJACK and KEA
+///  Algorithm Specifications published by NIST in May 1998. The library passes
+///  known answer tests available in NIST SP800-17, Table 6, pp. 140-42.
+/// \sa <a href ="http://csrc.nist.gov/encryption/skipjack/skipjack.pdf">SKIPJACK
+///  and KEA Algorithm Specifications</a> (May 1998),
+///  <a href="http://www.cryptopp.com/wiki/SKIPJACK">SKIPJACK</a> on the
+//   Crypto++ wiki
+
+#ifndef CRYPTOPP_SKIPJACK_H
+#define CRYPTOPP_SKIPJACK_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SKIPJACK block cipher information
+struct SKIPJACK_Info : public FixedBlockSize<8>, public FixedKeyLength<10>
+{
+	CRYPTOPP_DLL static const char * CRYPTOPP_API StaticAlgorithmName() {return "SKIPJACK";}
+};
+
+/// \brief SKIPJACK block cipher
+/// \details The Crypto++ implementation conforms to SKIPJACK and KEA
+///  Algorithm Specifications published by NIST in May 1998. The library passes
+///  known answer tests available in NIST SP800-17, Table 6, pp. 140-42.
+/// \sa <a href ="http://csrc.nist.gov/encryption/skipjack/skipjack.pdf">SKIPJACK
+///  and KEA Algorithm Specifications</a> (May 1998),
+///  <a href="http://www.cryptopp.com/wiki/SKIPJACK">SKIPJACK</a> on the
+///  Crypto++ wiki
+class SKIPJACK : public SKIPJACK_Info, public BlockCipherDocumentation
+{
+	/// \brief SKIPJACK block cipher default operation
+	class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<SKIPJACK_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+		unsigned int OptimalDataAlignment() const {return GetAlignmentOf<word16>();}
+
+	protected:
+		static const byte fTable[256];
+
+		FixedSizeSecBlock<byte, 10*256> tab;
+	};
+
+	/// \brief SKIPJACK block cipher encryption operation
+	class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	private:
+		static const byte Se[256];
+		static const word32 Te[4][256];
+	};
+
+	/// \brief SKIPJACK block cipher decryption operation
+	class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	private:
+		static const byte Sd[256];
+		static const word32 Td[4][256];
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef SKIPJACK::Encryption SKIPJACKEncryption;
+typedef SKIPJACK::Decryption SKIPJACKDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/sm3.cpp b/runtime/third_party/cryptopp/sm3.cpp
new file mode 100644
index 0000000..ee30945
--- /dev/null
+++ b/runtime/third_party/cryptopp/sm3.cpp
@@ -0,0 +1,255 @@
+// sm3.cpp - written and placed in the public domain by Jeffrey Walton and Han Lulu
+//           Based on the specification provided by Sean Shen and Xiaodong Lee.
+//           Based on code by Krzysztof Kwiatkowski and Jack Lloyd.
+//           Also see https://tools.ietf.org/html/draft-shen-sm3-hash.
+//
+//    We understand future ARMv8 enhancements are supposed
+//    to include SM3 and SM4 related instructions so the function
+//    is stubbed for an eventual SM3_HashMultipleBlocks_ARMV8.
+
+#include "pch.h"
+#include "config.h"
+
+#include "sm3.h"
+#include "misc.h"
+#include "cpu.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::rotlConstant;
+
+using CryptoPP::SM3;
+using CryptoPP::GetBlock;
+using CryptoPP::BigEndian;
+
+inline word32 P0(word32 X)
+{
+    return X ^ rotlConstant<9>(X) ^ rotlConstant<17>(X);
+}
+
+inline word32 P1(word32 X)
+{
+    return X ^ rotlConstant<15>(X) ^ rotlConstant<23>(X);
+}
+
+inline word32 EE(word32 W0, word32 W7, word32 W13, word32 W3, word32 W10)
+{
+    return P1(W0 ^ W7 ^ rotlConstant<15>(W13)) ^ rotlConstant<7>(W3) ^ W10;
+}
+
+inline word32 FF(word32 X, word32 Y, word32 Z)
+{
+    return (X & Y) | ((X | Y) & Z);
+}
+
+inline word32 GG(word32 X, word32 Y, word32 Z)
+{
+    return ((Z ^ (X & (Y ^ Z))));
+}
+
+inline void R1(word32 A, word32& B, word32 C, word32& D, word32 E, word32& F,
+        word32 G, word32& H, word32 TJ, word32 Wi, word32 Wj)
+{
+    const word32 A12 = rotlConstant<12>(A);
+    const word32 TT0 = rotlConstant<7>(A12 + E + TJ);
+    const word32 TT1 = (A ^ B ^ C) + D + (TT0 ^ A12) + Wj;
+    const word32 TT2 = (E ^ F ^ G) + H + TT0 + Wi;
+
+    B = rotlConstant<9>(B); D = TT1;
+    F = rotlConstant<19>(F); H = P0(TT2);
+}
+
+inline void R2(word32 A, word32& B, word32 C, word32& D, word32 E, word32& F,
+        word32 G, word32& H, word32 TJ, word32 Wi, word32 Wj)
+{
+    const word32 A12 = rotlConstant<12>(A);
+    const word32 TT0 = rotlConstant<7>(A12 + E + TJ);
+    const word32 TT1 = FF(A, B, C) + D + (TT0 ^ A12) + Wj;
+    const word32 TT2 = GG(E, F, G) + H + TT0 + Wi;
+
+    B = rotlConstant<9>(B); D = TT1;
+    F = rotlConstant<19>(F); H = P0(TT2);
+}
+
+// Krzysztof Kwiatkowski did a very nice job with this function.
+size_t SM3_HashMultipleBlocks_CXX(word32 *state, const word32 *data, size_t length)
+{
+    CRYPTOPP_ASSERT(data);
+
+    word32 A = state[0], B = state[1], C = state[2], D = state[3];
+    word32 E = state[4], F = state[5], G = state[6], H = state[7];
+
+    while (length >= SM3::BLOCKSIZE)
+    {
+        // Reverse bytes on LittleEndian; align pointer on BigEndian
+        typedef GetBlock<word32, BigEndian, false> InBlock;
+        InBlock iblk(data);
+
+        word32 W00, W01, W02, W03, W04, W05, W06, W07, W08, W09, W10, W11, W12, W13, W14, W15;
+        iblk(W00)(W01)(W02)(W03)(W04)(W05)(W06)(W07)(W08)(W09)(W10)(W11)(W12)(W13)(W14)(W15);
+
+        R1(A, B, C, D, E, F, G, H, 0x79CC4519, W00, W00 ^ W04);
+        W00 = EE(W00, W07, W13, W03, W10);
+        R1(D, A, B, C, H, E, F, G, 0xF3988A32, W01, W01 ^ W05);
+        W01 = EE(W01, W08, W14, W04, W11);
+        R1(C, D, A, B, G, H, E, F, 0xE7311465, W02, W02 ^ W06);
+        W02 = EE(W02, W09, W15, W05, W12);
+        R1(B, C, D, A, F, G, H, E, 0xCE6228CB, W03, W03 ^ W07);
+        W03 = EE(W03, W10, W00, W06, W13);
+        R1(A, B, C, D, E, F, G, H, 0x9CC45197, W04, W04 ^ W08);
+        W04 = EE(W04, W11, W01, W07, W14);
+        R1(D, A, B, C, H, E, F, G, 0x3988A32F, W05, W05 ^ W09);
+        W05 = EE(W05, W12, W02, W08, W15);
+        R1(C, D, A, B, G, H, E, F, 0x7311465E, W06, W06 ^ W10);
+        W06 = EE(W06, W13, W03, W09, W00);
+        R1(B, C, D, A, F, G, H, E, 0xE6228CBC, W07, W07 ^ W11);
+        W07 = EE(W07, W14, W04, W10, W01);
+        R1(A, B, C, D, E, F, G, H, 0xCC451979, W08, W08 ^ W12);
+        W08 = EE(W08, W15, W05, W11, W02);
+        R1(D, A, B, C, H, E, F, G, 0x988A32F3, W09, W09 ^ W13);
+        W09 = EE(W09, W00, W06, W12, W03);
+        R1(C, D, A, B, G, H, E, F, 0x311465E7, W10, W10 ^ W14);
+        W10 = EE(W10, W01, W07, W13, W04);
+        R1(B, C, D, A, F, G, H, E, 0x6228CBCE, W11, W11 ^ W15);
+        W11 = EE(W11, W02, W08, W14, W05);
+        R1(A, B, C, D, E, F, G, H, 0xC451979C, W12, W12 ^ W00);
+        W12 = EE(W12, W03, W09, W15, W06);
+        R1(D, A, B, C, H, E, F, G, 0x88A32F39, W13, W13 ^ W01);
+        W13 = EE(W13, W04, W10, W00, W07);
+        R1(C, D, A, B, G, H, E, F, 0x11465E73, W14, W14 ^ W02);
+        W14 = EE(W14, W05, W11, W01, W08);
+        R1(B, C, D, A, F, G, H, E, 0x228CBCE6, W15, W15 ^ W03);
+        W15 = EE(W15, W06, W12, W02, W09);
+        R2(A, B, C, D, E, F, G, H, 0x9D8A7A87, W00, W00 ^ W04);
+        W00 = EE(W00, W07, W13, W03, W10);
+        R2(D, A, B, C, H, E, F, G, 0x3B14F50F, W01, W01 ^ W05);
+        W01 = EE(W01, W08, W14, W04, W11);
+        R2(C, D, A, B, G, H, E, F, 0x7629EA1E, W02, W02 ^ W06);
+        W02 = EE(W02, W09, W15, W05, W12);
+        R2(B, C, D, A, F, G, H, E, 0xEC53D43C, W03, W03 ^ W07);
+        W03 = EE(W03, W10, W00, W06, W13);
+        R2(A, B, C, D, E, F, G, H, 0xD8A7A879, W04, W04 ^ W08);
+        W04 = EE(W04, W11, W01, W07, W14);
+        R2(D, A, B, C, H, E, F, G, 0xB14F50F3, W05, W05 ^ W09);
+        W05 = EE(W05, W12, W02, W08, W15);
+        R2(C, D, A, B, G, H, E, F, 0x629EA1E7, W06, W06 ^ W10);
+        W06 = EE(W06, W13, W03, W09, W00);
+        R2(B, C, D, A, F, G, H, E, 0xC53D43CE, W07, W07 ^ W11);
+        W07 = EE(W07, W14, W04, W10, W01);
+        R2(A, B, C, D, E, F, G, H, 0x8A7A879D, W08, W08 ^ W12);
+        W08 = EE(W08, W15, W05, W11, W02);
+        R2(D, A, B, C, H, E, F, G, 0x14F50F3B, W09, W09 ^ W13);
+        W09 = EE(W09, W00, W06, W12, W03);
+        R2(C, D, A, B, G, H, E, F, 0x29EA1E76, W10, W10 ^ W14);
+        W10 = EE(W10, W01, W07, W13, W04);
+        R2(B, C, D, A, F, G, H, E, 0x53D43CEC, W11, W11 ^ W15);
+        W11 = EE(W11, W02, W08, W14, W05);
+        R2(A, B, C, D, E, F, G, H, 0xA7A879D8, W12, W12 ^ W00);
+        W12 = EE(W12, W03, W09, W15, W06);
+        R2(D, A, B, C, H, E, F, G, 0x4F50F3B1, W13, W13 ^ W01);
+        W13 = EE(W13, W04, W10, W00, W07);
+        R2(C, D, A, B, G, H, E, F, 0x9EA1E762, W14, W14 ^ W02);
+        W14 = EE(W14, W05, W11, W01, W08);
+        R2(B, C, D, A, F, G, H, E, 0x3D43CEC5, W15, W15 ^ W03);
+        W15 = EE(W15, W06, W12, W02, W09);
+        R2(A, B, C, D, E, F, G, H, 0x7A879D8A, W00, W00 ^ W04);
+        W00 = EE(W00, W07, W13, W03, W10);
+        R2(D, A, B, C, H, E, F, G, 0xF50F3B14, W01, W01 ^ W05);
+        W01 = EE(W01, W08, W14, W04, W11);
+        R2(C, D, A, B, G, H, E, F, 0xEA1E7629, W02, W02 ^ W06);
+        W02 = EE(W02, W09, W15, W05, W12);
+        R2(B, C, D, A, F, G, H, E, 0xD43CEC53, W03, W03 ^ W07);
+        W03 = EE(W03, W10, W00, W06, W13);
+        R2(A, B, C, D, E, F, G, H, 0xA879D8A7, W04, W04 ^ W08);
+        W04 = EE(W04, W11, W01, W07, W14);
+        R2(D, A, B, C, H, E, F, G, 0x50F3B14F, W05, W05 ^ W09);
+        W05 = EE(W05, W12, W02, W08, W15);
+        R2(C, D, A, B, G, H, E, F, 0xA1E7629E, W06, W06 ^ W10);
+        W06 = EE(W06, W13, W03, W09, W00);
+        R2(B, C, D, A, F, G, H, E, 0x43CEC53D, W07, W07 ^ W11);
+        W07 = EE(W07, W14, W04, W10, W01);
+        R2(A, B, C, D, E, F, G, H, 0x879D8A7A, W08, W08 ^ W12);
+        W08 = EE(W08, W15, W05, W11, W02);
+        R2(D, A, B, C, H, E, F, G, 0x0F3B14F5, W09, W09 ^ W13);
+        W09 = EE(W09, W00, W06, W12, W03);
+        R2(C, D, A, B, G, H, E, F, 0x1E7629EA, W10, W10 ^ W14);
+        W10 = EE(W10, W01, W07, W13, W04);
+        R2(B, C, D, A, F, G, H, E, 0x3CEC53D4, W11, W11 ^ W15);
+        W11 = EE(W11, W02, W08, W14, W05);
+        R2(A, B, C, D, E, F, G, H, 0x79D8A7A8, W12, W12 ^ W00);
+        W12 = EE(W12, W03, W09, W15, W06);
+        R2(D, A, B, C, H, E, F, G, 0xF3B14F50, W13, W13 ^ W01);
+        W13 = EE(W13, W04, W10, W00, W07);
+        R2(C, D, A, B, G, H, E, F, 0xE7629EA1, W14, W14 ^ W02);
+        W14 = EE(W14, W05, W11, W01, W08);
+        R2(B, C, D, A, F, G, H, E, 0xCEC53D43, W15, W15 ^ W03);
+        W15 = EE(W15, W06, W12, W02, W09);
+        R2(A, B, C, D, E, F, G, H, 0x9D8A7A87, W00, W00 ^ W04);
+        W00 = EE(W00, W07, W13, W03, W10);
+        R2(D, A, B, C, H, E, F, G, 0x3B14F50F, W01, W01 ^ W05);
+        W01 = EE(W01, W08, W14, W04, W11);
+        R2(C, D, A, B, G, H, E, F, 0x7629EA1E, W02, W02 ^ W06);
+        W02 = EE(W02, W09, W15, W05, W12);
+        R2(B, C, D, A, F, G, H, E, 0xEC53D43C, W03, W03 ^ W07);
+        W03 = EE(W03, W10, W00, W06, W13);
+        R2(A, B, C, D, E, F, G, H, 0xD8A7A879, W04, W04 ^ W08);
+        R2(D, A, B, C, H, E, F, G, 0xB14F50F3, W05, W05 ^ W09);
+        R2(C, D, A, B, G, H, E, F, 0x629EA1E7, W06, W06 ^ W10);
+        R2(B, C, D, A, F, G, H, E, 0xC53D43CE, W07, W07 ^ W11);
+        R2(A, B, C, D, E, F, G, H, 0x8A7A879D, W08, W08 ^ W12);
+        R2(D, A, B, C, H, E, F, G, 0x14F50F3B, W09, W09 ^ W13);
+        R2(C, D, A, B, G, H, E, F, 0x29EA1E76, W10, W10 ^ W14);
+        R2(B, C, D, A, F, G, H, E, 0x53D43CEC, W11, W11 ^ W15);
+        R2(A, B, C, D, E, F, G, H, 0xA7A879D8, W12, W12 ^ W00);
+        R2(D, A, B, C, H, E, F, G, 0x4F50F3B1, W13, W13 ^ W01);
+        R2(C, D, A, B, G, H, E, F, 0x9EA1E762, W14, W14 ^ W02);
+        R2(B, C, D, A, F, G, H, E, 0x3D43CEC5, W15, W15 ^ W03);
+
+        A = (state[0] ^= A);
+        B = (state[1] ^= B);
+        C = (state[2] ^= C);
+        D = (state[3] ^= D);
+        E = (state[4] ^= E);
+        F = (state[5] ^= F);
+        G = (state[6] ^= G);
+        H = (state[7] ^= H);
+
+        data += SM3::BLOCKSIZE/sizeof(word32);
+        length -= SM3::BLOCKSIZE;
+    }
+
+    return length;
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void SM3::InitState(HashWordType *state)
+{
+    const word32 s[] = {
+        0x7380166f, 0x4914b2b9, 0x172442d7, 0xda8a0600,
+        0xa96f30bc, 0x163138aa, 0xe38dee4d, 0xb0fb0e4e
+    };
+
+    std::memcpy(state, s, sizeof(s));
+}
+
+void SM3::Transform(word32 *state, const word32 *data)
+{
+    CRYPTOPP_ASSERT(state);
+    CRYPTOPP_ASSERT(data);
+
+    SM3_HashMultipleBlocks_CXX(state, data, SM3::BLOCKSIZE);
+}
+
+size_t SM3::HashMultipleBlocks(const HashWordType *input, size_t length)
+{
+    const size_t res = length & (SM3::BLOCKSIZE - 1);
+    SM3_HashMultipleBlocks_CXX(m_state, input, length-res);
+    return res;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/sm3.h b/runtime/third_party/cryptopp/sm3.h
new file mode 100644
index 0000000..fefcfec
--- /dev/null
+++ b/runtime/third_party/cryptopp/sm3.h
@@ -0,0 +1,61 @@
+// sm3.h - written and placed in the public domain by Jeffrey Walton and Han Lulu
+//         Based on the specification provided by Sean Shen and Xiaodong Lee.
+//         Based on code by Krzysztof Kwiatkowski and Jack Lloyd.
+//         Also see https://tools.ietf.org/html/draft-shen-sm3-hash.
+
+/// \file sm3.h
+/// \brief Classes for the SM3 hash function
+/// \details SM3 is a hash function designed by Xiaoyun Wang, et al. The hash is part of the
+///   Chinese State Cryptography Administration portfolio.
+/// \sa <A HREF="https://tools.ietf.org/html/draft-shen-sm3-hash">SM3 Hash Function</A> and
+///   <A HREF="http://github.com/guanzhi/GmSSL">Reference implementation using OpenSSL</A>.
+/// \since Crypto++ 6.0
+
+#ifndef CRYPTOPP_SM3_H
+#define CRYPTOPP_SM3_H
+
+#include "config.h"
+#include "iterhash.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SM3 hash function
+/// \details SM3 is a hash function designed by Xiaoyun Wang, et al. The hash is part of the
+///   Chinese State Cryptography Administration portfolio.
+/// \sa <A HREF="https://tools.ietf.org/html/draft-shen-sm3-hash">SM3 Hash Function</A>
+/// \since Crypto++ 6.0
+class SM3 : public IteratedHashWithStaticTransform<word32, BigEndian, 64, 32, SM3, 32, true>
+{
+public:
+    /// \brief Initialize state array
+    /// \param state the state of the hash
+    /// \details InitState sets a state array to SM3 initial values
+    /// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+    ///   member functions InitState() and Transform(). External classes, like SEAL and MDC,
+    ///   can initialize state with a user provided key and operate the hash on the data
+    ///   with the user supplied state.
+    static void InitState(HashWordType *state);
+
+    /// \brief Operate the hash
+    /// \param digest the state of the hash
+    /// \param data the data to be digested
+    /// \details Transform() operates the hash on <tt>data</tt>. When the call is invoked
+    ///   <tt>digest</tt> holds initial or current state. Upon return <tt>digest</tt> holds
+    ///   the hash or updated state.
+    /// \details Hashes which derive from IteratedHashWithStaticTransform provide static
+    ///   member functions InitState() and Transform(). External classes, like SEAL and MDC,
+    ///   can initialize state with a user provided key and operate the hash on the data
+    ///   with the user supplied state.
+    static void Transform(HashWordType *digest, const HashWordType *data);
+
+    /// \brief The algorithm name
+    /// \return C-style string "SM3"
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() { return "SM3"; }
+
+protected:
+    size_t HashMultipleBlocks(const HashWordType *input, size_t length);
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_SM3_H
diff --git a/runtime/third_party/cryptopp/sm4.cpp b/runtime/third_party/cryptopp/sm4.cpp
new file mode 100644
index 0000000..977a5a1
--- /dev/null
+++ b/runtime/third_party/cryptopp/sm4.cpp
@@ -0,0 +1,212 @@
+// sm4.cpp - written and placed in the public domain by Jeffrey Walton and Han Lulu
+//
+//    We understand future ARMv8 enhancements are supposed
+//    to include SM3 and SM4 related instructions so the function
+//    is stubbed for an eventual SM4_Round_ARMV8.
+
+#include "pch.h"
+#include "config.h"
+
+#include "sm4.h"
+#include "misc.h"
+#include "cpu.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4307)
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::rotlConstant;
+
+CRYPTOPP_ALIGN_DATA(4)
+const byte S[256] =
+{
+    0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7, 0x16, 0xB6, 0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05,
+    0x2B, 0x67, 0x9A, 0x76, 0x2A, 0xBE, 0x04, 0xC3, 0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
+    0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A, 0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62,
+    0xE4, 0xB3, 0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95, 0x80, 0xDF, 0x94, 0xFA, 0x75, 0x8F, 0x3F, 0xA6,
+    0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 0x17, 0xBA, 0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8,
+    0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B, 0xF8, 0xEB, 0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35,
+    0x1E, 0x24, 0x0E, 0x5E, 0x63, 0x58, 0xD1, 0xA2, 0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21, 0x78, 0x87,
+    0xD4, 0x00, 0x46, 0x57, 0x9F, 0xD3, 0x27, 0x52, 0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E,
+    0xEA, 0xBF, 0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5, 0xA3, 0xF7, 0xF2, 0xCE, 0xF9, 0x61, 0x15, 0xA1,
+    0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34, 0x1A, 0x55, 0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3,
+    0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60, 0xC0, 0x29, 0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F,
+    0xD5, 0xDB, 0x37, 0x45, 0xDE, 0xFD, 0x8E, 0x2F, 0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C, 0x5B, 0x51,
+    0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F, 0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8,
+    0x0A, 0xC1, 0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD, 0x2D, 0x74, 0xD0, 0x12, 0xB8, 0xE5, 0xB4, 0xB0,
+    0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96, 0x77, 0x7E, 0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84,
+    0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20, 0x79, 0xEE, 0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48
+};
+
+const word32 CK[32] =
+{
+    0x00070E15, 0x1C232A31, 0x383F464D, 0x545B6269,
+    0x70777E85, 0x8C939AA1, 0xA8AFB6BD, 0xC4CBD2D9,
+    0xE0E7EEF5, 0xFC030A11, 0x181F262D, 0x343B4249,
+    0x50575E65, 0x6C737A81, 0x888F969D, 0xA4ABB2B9,
+    0xC0C7CED5, 0xDCE3EAF1, 0xF8FF060D, 0x141B2229,
+    0x30373E45, 0x4C535A61, 0x686F767D, 0x848B9299,
+    0xA0A7AEB5, 0xBCC3CAD1, 0xD8DFE6ED, 0xF4FB0209,
+    0x10171E25, 0x2C333A41, 0x484F565D, 0x646B7279
+};
+
+inline word32 SM4_H(word32 x)
+{
+    return (S[GETBYTE(x, 3)] << 24) | (S[GETBYTE(x, 2)] << 16) | (S[GETBYTE(x, 1)] << 8) | (S[GETBYTE(x, 0)]);
+}
+
+inline word32 SM4_G(word32 x)
+{
+    const word32 t = SM4_H(x);
+    return t ^ rotlConstant<13>(t) ^ rotlConstant<23>(t);
+}
+
+inline word32 SM4_F(word32 x)
+{
+    const word32 t = SM4_H(x);
+    return t ^ rotlConstant<2>(t) ^ rotlConstant<10>(t) ^ rotlConstant<18>(t) ^ rotlConstant<24>(t);
+}
+
+template <unsigned int R, bool FWD>
+inline void SM4_Round(word32 wspace[4], const word32 rkeys[32])
+{
+    if (FWD)
+    {
+        wspace[0] ^= SM4_F(wspace[1] ^ wspace[2] ^ wspace[3] ^ rkeys[R+0]);
+        wspace[1] ^= SM4_F(wspace[0] ^ wspace[2] ^ wspace[3] ^ rkeys[R+1]);
+        wspace[2] ^= SM4_F(wspace[0] ^ wspace[1] ^ wspace[3] ^ rkeys[R+2]);
+        wspace[3] ^= SM4_F(wspace[0] ^ wspace[1] ^ wspace[2] ^ rkeys[R+3]);
+    }
+    else
+    {
+        wspace[0] ^= SM4_F(wspace[1] ^ wspace[2] ^ wspace[3] ^ rkeys[R-0]);
+        wspace[1] ^= SM4_F(wspace[0] ^ wspace[2] ^ wspace[3] ^ rkeys[R-1]);
+        wspace[2] ^= SM4_F(wspace[0] ^ wspace[1] ^ wspace[3] ^ rkeys[R-2]);
+        wspace[3] ^= SM4_F(wspace[0] ^ wspace[1] ^ wspace[2] ^ rkeys[R-3]);
+    }
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if CRYPTOPP_SM4_ADVANCED_PROCESS_BLOCKS
+# if defined(CRYPTOPP_AESNI_AVAILABLE)
+extern size_t SM4_Enc_AdvancedProcessBlocks_AESNI(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+# endif
+#endif
+
+std::string SM4::Enc::AlgorithmProvider() const
+{
+#if defined(CRYPTOPP_AESNI_AVAILABLE)
+    if (HasAESNI())
+        return "AESNI";
+#endif
+    return "C++";
+}
+
+void SM4::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_ASSERT(keyLength == 16);
+    CRYPTOPP_UNUSED(params);
+
+    m_rkeys.New(32);
+    m_wspace.New(5);
+
+    GetUserKey(BIG_ENDIAN_ORDER, m_wspace.begin(), 4, userKey, keyLength);
+    m_wspace[0] ^= 0xa3b1bac6; m_wspace[1] ^= 0x56aa3350;
+    m_wspace[2] ^= 0x677d9197; m_wspace[3] ^= 0xb27022dc;
+
+    size_t i=0;
+    do
+    {
+        m_rkeys[i] = (m_wspace[0] ^= SM4_G(m_wspace[1] ^ m_wspace[2] ^ m_wspace[3] ^ CK[i])); i++;
+        m_rkeys[i] = (m_wspace[1] ^= SM4_G(m_wspace[2] ^ m_wspace[3] ^ m_wspace[0] ^ CK[i])); i++;
+        m_rkeys[i] = (m_wspace[2] ^= SM4_G(m_wspace[3] ^ m_wspace[0] ^ m_wspace[1] ^ CK[i])); i++;
+        m_rkeys[i] = (m_wspace[3] ^= SM4_G(m_wspace[0] ^ m_wspace[1] ^ m_wspace[2] ^ CK[i])); i++;
+    }
+    while (i < 32);
+}
+
+void SM4::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Reverse bytes on LittleEndian; align pointer on BigEndian
+    typedef GetBlock<word32, BigEndian, false> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[0])(m_wspace[1])(m_wspace[2])(m_wspace[3]);
+
+    // Timing attack countermeasure, see comments in Rijndael for more details.
+    // The hardening does not materially affect benchmarks. SM4 runs at
+    // 30.5 cpb on a Core i5 Skylake with and without the code below.
+    const int cacheLineSize = GetCacheLineSize();
+    volatile word32 _u = 0;
+    word32 u = _u;
+
+    for (unsigned int i=0; i<sizeof(S); i+=cacheLineSize)
+        u |= *(const word32 *)(void*)(S+i);
+    m_wspace[4] = u;
+
+    SM4_Round< 0, true>(m_wspace, m_rkeys);
+    SM4_Round< 4, true>(m_wspace, m_rkeys);
+    SM4_Round< 8, true>(m_wspace, m_rkeys);
+    SM4_Round<12, true>(m_wspace, m_rkeys);
+    SM4_Round<16, true>(m_wspace, m_rkeys);
+    SM4_Round<20, true>(m_wspace, m_rkeys);
+    SM4_Round<24, true>(m_wspace, m_rkeys);
+    SM4_Round<28, true>(m_wspace, m_rkeys);
+
+    // Reverse bytes on LittleEndian; align pointer on BigEndian
+    typedef PutBlock<word32, BigEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+}
+
+void SM4::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Reverse bytes on LittleEndian; align pointer on BigEndian
+    typedef GetBlock<word32, BigEndian, false> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[0])(m_wspace[1])(m_wspace[2])(m_wspace[3]);
+
+    // Timing attack countermeasure, see comments in Rijndael for more details.
+    // The hardening does not materially affect benchmarks. SM4 runs at
+    // 30.5 cpb on a Core i5 Skylake with and without the code below.
+    const int cacheLineSize = GetCacheLineSize();
+    volatile word32 _u = 0;
+    word32 u = _u;
+
+    for (unsigned int i=0; i<sizeof(S); i+=cacheLineSize)
+        u |= *(const word32 *)(void*)(S+i);
+    m_wspace[4] = u;
+
+    SM4_Round<31, false>(m_wspace, m_rkeys);
+    SM4_Round<27, false>(m_wspace, m_rkeys);
+    SM4_Round<23, false>(m_wspace, m_rkeys);
+    SM4_Round<19, false>(m_wspace, m_rkeys);
+    SM4_Round<15, false>(m_wspace, m_rkeys);
+    SM4_Round<11, false>(m_wspace, m_rkeys);
+    SM4_Round< 7, false>(m_wspace, m_rkeys);
+    SM4_Round< 3, false>(m_wspace, m_rkeys);
+
+    // Reverse bytes on LittleEndian; align pointer on BigEndian
+    typedef PutBlock<word32, BigEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+}
+
+#if CRYPTOPP_SM4_ADVANCED_PROCESS_BLOCKS
+size_t SM4::Enc::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks,
+        byte *outBlocks, size_t length, word32 flags) const
+{
+#if defined(CRYPTOPP_AESNI_AVAILABLE)
+    if (HasAESNI()) {
+        return SM4_Enc_AdvancedProcessBlocks_AESNI(m_rkeys, 32,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+    }
+#endif
+    return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_SM4_ADVANCED_PROCESS_BLOCKS
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/sm4.h b/runtime/third_party/cryptopp/sm4.h
new file mode 100644
index 0000000..dc41f73
--- /dev/null
+++ b/runtime/third_party/cryptopp/sm4.h
@@ -0,0 +1,96 @@
+// sm4.h - written and placed in the public domain by Jeffrey Walton and Han Lulu
+
+/// \file sm4.h
+/// \brief Classes for the SM4 block cipher
+/// \details SM4 is a block cipher designed by Xiaoyun Wang, et al. The block cipher is part of the
+///   Chinese State Cryptography Administration portfolio. The cipher was formerly known as SMS4.
+/// \details SM4 encryption is accelerated on machines with AES-NI. Decryption is not accelerated because
+///   it is not profitable. Thanks to Markku-Juhani Olavi Saarinen for help and the code.
+/// \sa <A HREF="http://eprint.iacr.org/2008/329.pdf">SMS4 Encryption Algorithm for Wireless Networks</A>,
+///   <A HREF="http://github.com/guanzhi/GmSSL">Reference implementation using OpenSSL</A> and
+///   <A HREF="https://github.com/mjosaarinen/sm4ni">Markku-Juhani Olavi Saarinen GitHub</A>.
+/// \since Crypto++ 6.0
+
+#ifndef CRYPTOPP_SM4_H
+#define CRYPTOPP_SM4_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+
+#if (CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86)
+# ifndef CRYPTOPP_DISABLE_SM4_SIMD
+#  define CRYPTOPP_SM4_ADVANCED_PROCESS_BLOCKS 1
+# endif
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SM4 block cipher information
+/// \since Crypto++ 6.0
+struct SM4_Info : public FixedBlockSize<16>, FixedKeyLength<16>
+{
+    static const std::string StaticAlgorithmName()
+    {
+        return "SM4";
+    }
+};
+
+/// \brief Classes for the SM4 block cipher
+/// \details SM4 is a block cipher designed by Xiaoyun Wang, et al. The block cipher is part of the
+///   Chinese State Cryptography Administration portfolio. The cipher was formerly known as SMS4.
+/// \sa <A HREF="http://eprint.iacr.org/2008/329.pdf">SMS4 Encryption Algorithm for Wireless Networks</A>
+/// \since Crypto++ 6.0
+class CRYPTOPP_NO_VTABLE SM4 : public SM4_Info, public BlockCipherDocumentation
+{
+public:
+    /// \brief SM4 block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<SM4_Info>
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+
+        SecBlock<word32, AllocatorWithCleanup<word32> > m_rkeys;
+        mutable SecBlock<word32, AllocatorWithCleanup<word32> > m_wspace;
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation. All key
+    ///   sizes are supported.
+    /// \details SM4 encryption is accelerated on machines with AES-NI. Decryption is
+    ///   not accelerated because it is not profitable. Thanks to Markku-Juhani Olavi
+    ///   Saarinen.
+    /// \since Crypto++ 6.0, AESNI encryption since Crypto++ 8.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        std::string AlgorithmProvider() const;
+    protected:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+#if CRYPTOPP_SM4_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    /// \brief Decryption transformation
+    /// \details Dec provides implementation for decryption transformation. All key
+    ///   sizes are supported.
+    /// \details SM4 encryption is accelerated on machines with AES-NI. Decryption is
+    ///   not accelerated because it is not profitable. Thanks to Markku-Juhani Olavi
+    ///   Saarinen.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    protected:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+NAMESPACE_END
+
+#endif // CRYPTOPP_SM4_H
diff --git a/runtime/third_party/cryptopp/sm4_simd.cpp b/runtime/third_party/cryptopp/sm4_simd.cpp
new file mode 100644
index 0000000..606aadc
--- /dev/null
+++ b/runtime/third_party/cryptopp/sm4_simd.cpp
@@ -0,0 +1,323 @@
+// sm4_simd.cpp - written and placed in the public domain by
+//                Markku-Juhani O. Saarinen and Jeffrey Walton
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    AESNI, ARM NEON and ARMv8a, and Power7 Altivec instructions. A separate
+//    source file is needed because additional CXXFLAGS are required to enable
+//    the appropriate instructions sets in some build configurations.
+//
+//    AES-NI based on Markku-Juhani O. Saarinen work at https://github.com/mjosaarinen/sm4ni.
+//
+//    ARMv8 is upcoming.
+
+#include "pch.h"
+#include "config.h"
+
+#include "sm4.h"
+#include "misc.h"
+
+// Uncomment for benchmarking C++ against SSE.
+// Do so in both simon.cpp and simon_simd.cpp.
+// #undef CRYPTOPP_AESNI_AVAILABLE
+
+#if (CRYPTOPP_AESNI_AVAILABLE)
+# include "adv_simd.h"
+# include <emmintrin.h>
+# include <tmmintrin.h>
+# include <wmmintrin.h>
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char SM4_SIMD_FNAME[] = __FILE__;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+
+#if (CRYPTOPP_AESNI_AVAILABLE)
+
+template <unsigned int R>
+inline __m128i ShiftLeft(const __m128i& val)
+{
+    return _mm_slli_epi32(val, R);
+}
+
+template <unsigned int R>
+inline __m128i ShiftRight(const __m128i& val)
+{
+    return _mm_srli_epi32(val, R);
+}
+
+template <unsigned int R>
+inline __m128i ShiftLeft64(const __m128i& val)
+{
+    return _mm_slli_epi64(val, R);
+}
+
+template <unsigned int R>
+inline __m128i ShiftRight64(const __m128i& val)
+{
+    return _mm_srli_epi64(val, R);
+}
+
+template <unsigned int R>
+inline __m128i RotateLeft(const __m128i& val)
+{
+    return _mm_or_si128(
+        _mm_slli_epi32(val, R), _mm_srli_epi32(val, 32-R));
+}
+
+template <unsigned int R>
+inline __m128i RotateRight(const __m128i& val)
+{
+    return _mm_or_si128(
+        _mm_slli_epi32(val, 32-R), _mm_srli_epi32(val, R));
+}
+
+template <>
+inline __m128i RotateLeft<8>(const __m128i& val)
+{
+    const __m128i r08 = _mm_set_epi32(0x0E0D0C0F, 0x0A09080B, 0x06050407, 0x02010003);
+    return _mm_shuffle_epi8(val, r08);
+}
+
+template <>
+inline __m128i RotateLeft<16>(const __m128i& val)
+{
+    const __m128i mask = _mm_set_epi32(0x0D0C0F0E, 0x09080B0A, 0x05040706, 0x01000302);
+    return _mm_shuffle_epi8(val, mask);
+}
+
+template <>
+inline __m128i RotateLeft<24>(const __m128i& val)
+{
+    const __m128i mask = _mm_set_epi32(0x0C0F0E0D, 0x080B0A09, 0x04070605, 0x00030201);
+    return _mm_shuffle_epi8(val, mask);
+}
+
+/// \brief Unpack XMM words
+/// \tparam IDX the element from each XMM word
+/// \param a the first XMM word
+/// \param b the second XMM word
+/// \param c the third XMM word
+/// \param d the fourth XMM word
+/// \details UnpackXMM selects the IDX element from a, b, c, d and returns a concatenation
+///   equivalent to <tt>a[IDX] || b[IDX] || c[IDX] || d[IDX]</tt>.
+template <unsigned int IDX>
+inline __m128i UnpackXMM(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    // Should not be instantiated
+    CRYPTOPP_UNUSED(a); CRYPTOPP_UNUSED(b);
+    CRYPTOPP_UNUSED(c); CRYPTOPP_UNUSED(d);
+    CRYPTOPP_ASSERT(0);
+    return _mm_setzero_si128();
+}
+
+template <>
+inline __m128i UnpackXMM<0>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    const __m128i r1 = _mm_unpacklo_epi32(a, b);
+    const __m128i r2 = _mm_unpacklo_epi32(c, d);
+    return _mm_unpacklo_epi64(r1, r2);
+}
+
+template <>
+inline __m128i UnpackXMM<1>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    const __m128i r1 = _mm_unpacklo_epi32(a, b);
+    const __m128i r2 = _mm_unpacklo_epi32(c, d);
+    return _mm_unpackhi_epi64(r1, r2);
+}
+
+template <>
+inline __m128i UnpackXMM<2>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    const __m128i r1 = _mm_unpackhi_epi32(a, b);
+    const __m128i r2 = _mm_unpackhi_epi32(c, d);
+    return _mm_unpacklo_epi64(r1, r2);
+}
+
+template <>
+inline __m128i UnpackXMM<3>(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    const __m128i r1 = _mm_unpackhi_epi32(a, b);
+    const __m128i r2 = _mm_unpackhi_epi32(c, d);
+    return _mm_unpackhi_epi64(r1, r2);
+}
+
+/// \brief Unpack a XMM word
+/// \tparam IDX the element from each XMM word
+/// \param v the first XMM word
+/// \details UnpackXMM selects the IDX element from v and returns a concatenation
+///   equivalent to <tt>v[IDX] || v[IDX] || v[IDX] || v[IDX]</tt>.
+template <unsigned int IDX>
+inline __m128i UnpackXMM(const __m128i& v)
+{
+    // Should not be instantiated
+    CRYPTOPP_UNUSED(v); CRYPTOPP_ASSERT(0);
+    return _mm_setzero_si128();
+}
+
+template <>
+inline __m128i UnpackXMM<0>(const __m128i& v)
+{
+    // Splat to all lanes
+    return _mm_shuffle_epi8(v, _mm_set_epi8(3,2,1,0, 3,2,1,0, 3,2,1,0, 3,2,1,0));
+}
+
+template <>
+inline __m128i UnpackXMM<1>(const __m128i& v)
+{
+    // Splat to all lanes
+    return _mm_shuffle_epi8(v, _mm_set_epi8(7,6,5,4, 7,6,5,4, 7,6,5,4, 7,6,5,4));
+}
+
+template <>
+inline __m128i UnpackXMM<2>(const __m128i& v)
+{
+    // Splat to all lanes
+    return _mm_shuffle_epi8(v, _mm_set_epi8(11,10,9,8, 11,10,9,8, 11,10,9,8, 11,10,9,8));
+}
+
+template <>
+inline __m128i UnpackXMM<3>(const __m128i& v)
+{
+    // Splat to all lanes
+    return _mm_shuffle_epi8(v, _mm_set_epi8(15,14,13,12, 15,14,13,12, 15,14,13,12, 15,14,13,12));
+}
+
+template <unsigned int IDX>
+inline __m128i RepackXMM(const __m128i& a, const __m128i& b, const __m128i& c, const __m128i& d)
+{
+    return UnpackXMM<IDX>(a, b, c, d);
+}
+
+template <unsigned int IDX>
+inline __m128i RepackXMM(const __m128i& v)
+{
+    return UnpackXMM<IDX>(v);
+}
+
+inline void SM4_Encrypt(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, const word32 *subkeys)
+{
+    // nibble mask
+    const __m128i c0f = _mm_set_epi32(0x0F0F0F0F, 0x0F0F0F0F, 0x0F0F0F0F, 0x0F0F0F0F);
+
+    // flip all bytes in all 32-bit words
+    const __m128i flp = _mm_set_epi32(0x0C0D0E0F, 0x08090A0B, 0x04050607, 0x00010203);
+
+    // inverse shift rows
+    const __m128i shr = _mm_set_epi32(0x0306090C, 0x0F020508, 0x0B0E0104, 0x070A0D00);
+
+    // Affine transform 1 (low and high hibbles)
+    const __m128i m1l = _mm_set_epi32(0xC7C1B4B2, 0x22245157, 0x9197E2E4, 0x74720701);
+    const __m128i m1h = _mm_set_epi32(0xF052B91B, 0xF95BB012, 0xE240AB09, 0xEB49A200);
+
+    // Affine transform 2 (low and high hibbles)
+    const __m128i m2l = _mm_set_epi32(0xEDD14478, 0x172BBE82, 0x5B67F2CE, 0xA19D0834);
+    const __m128i m2h = _mm_set_epi32(0x11CDBE62, 0xCC1063BF, 0xAE7201DD, 0x73AFDC00);
+
+    __m128i t0 = UnpackXMM<0>(block0, block1, block2, block3);
+    __m128i t1 = UnpackXMM<1>(block0, block1, block2, block3);
+    __m128i t2 = UnpackXMM<2>(block0, block1, block2, block3);
+    __m128i t3 = UnpackXMM<3>(block0, block1, block2, block3);
+
+    t0 = _mm_shuffle_epi8(t0, flp);
+    t1 = _mm_shuffle_epi8(t1, flp);
+    t2 = _mm_shuffle_epi8(t2, flp);
+    t3 = _mm_shuffle_epi8(t3, flp);
+
+    const unsigned int ROUNDS = 32;
+    for (unsigned int i = 0; i < ROUNDS; i++)
+    {
+        const __m128i k = _mm_shuffle_epi32(_mm_castps_si128(
+            _mm_load_ss((const float*)(subkeys+i))), _MM_SHUFFLE(0,0,0,0));
+
+        __m128i x, y;
+        x = _mm_xor_si128(t1, _mm_xor_si128(t2,    _mm_xor_si128(t3, k)));
+
+        y = _mm_and_si128(x, c0f);          // inner affine
+        y = _mm_shuffle_epi8(m1l, y);
+        x = _mm_and_si128(ShiftRight64<4>(x), c0f);
+        x = _mm_xor_si128(_mm_shuffle_epi8(m1h, x), y);
+
+        x = _mm_shuffle_epi8(x, shr);       // inverse MixColumns
+        x = _mm_aesenclast_si128(x, c0f);   // AESNI instruction
+
+        y = _mm_andnot_si128(x, c0f);       // outer affine
+        y = _mm_shuffle_epi8(m2l, y);
+        x = _mm_and_si128(ShiftRight64<4>(x), c0f);
+        x = _mm_xor_si128(_mm_shuffle_epi8(m2h, x), y);
+
+        // 4 parallel L1 linear transforms
+        y = _mm_xor_si128(x, RotateLeft<8>(x));
+        y = _mm_xor_si128(y, RotateLeft<16>(x));
+        y = _mm_xor_si128(ShiftLeft<2>(y), ShiftRight<30>(y));
+        x = _mm_xor_si128(x, _mm_xor_si128(y, RotateLeft<24>(x)));
+
+        // rotate registers
+        x = _mm_xor_si128(x, t0);
+        t0 = t1; t1 = t2;
+        t2 = t3; t3 = x;
+    }
+
+    t0 = _mm_shuffle_epi8(t0, flp);
+    t1 = _mm_shuffle_epi8(t1, flp);
+    t2 = _mm_shuffle_epi8(t2, flp);
+    t3 = _mm_shuffle_epi8(t3, flp);
+
+    block0 = RepackXMM<0>(t3,t2,t1,t0);
+    block1 = RepackXMM<1>(t3,t2,t1,t0);
+    block2 = RepackXMM<2>(t3,t2,t1,t0);
+    block3 = RepackXMM<3>(t3,t2,t1,t0);
+}
+
+inline void SM4_Enc_4_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, const word32 *subkeys, unsigned int /*rounds*/)
+{
+    SM4_Encrypt(block0, block1, block2, block3, subkeys);
+}
+
+inline void SM4_Dec_4_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, const word32 *subkeys, unsigned int /*rounds*/)
+{
+    SM4_Encrypt(block0, block1, block2, block3, subkeys);
+}
+
+inline void SM4_Enc_Block(__m128i &block0,
+    const word32 *subkeys, unsigned int /*rounds*/)
+{
+    __m128i t1 = _mm_setzero_si128();
+    __m128i t2 = _mm_setzero_si128();
+    __m128i t3 = _mm_setzero_si128();
+
+    SM4_Encrypt(block0, t1, t2, t3, subkeys);
+}
+
+inline void SM4_Dec_Block(__m128i &block0,
+    const word32 *subkeys, unsigned int /*rounds*/)
+{
+    __m128i t1 = _mm_setzero_si128();
+    __m128i t2 = _mm_setzero_si128();
+    __m128i t3 = _mm_setzero_si128();
+
+    SM4_Encrypt(block0, t1, t2, t3, subkeys);
+}
+
+#endif  // CRYPTOPP_AESNI_AVAILABLE
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_AESNI_AVAILABLE)
+size_t SM4_Enc_AdvancedProcessBlocks_AESNI(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_4x1_SSE(SM4_Enc_Block, SM4_Enc_4_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif // CRYPTOPP_AESNI_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/smartptr.h b/runtime/third_party/cryptopp/smartptr.h
new file mode 100644
index 0000000..4e16a7f
--- /dev/null
+++ b/runtime/third_party/cryptopp/smartptr.h
@@ -0,0 +1,257 @@
+// smartptr.h - originally written and placed in the public domain by Wei Dai
+
+/// \file smartptr.h
+/// \brief Classes for automatic resource management
+
+#ifndef CRYPTOPP_SMARTPTR_H
+#define CRYPTOPP_SMARTPTR_H
+
+#include "config.h"
+#include "stdcpp.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Manages resources for a single object
+/// \tparam T class or type
+/// \details \p simple_ptr is used frequently in the library to manage resources and
+///   ensure cleanup under the RAII pattern (Resource Acquisition Is Initialization).
+template <class T> class simple_ptr
+{
+public:
+	simple_ptr(T *p = NULLPTR) : m_p(p) {}
+	~simple_ptr()
+	{
+		delete m_p;
+		m_p = NULLPTR;
+	}
+
+	T *m_p;
+};
+
+/// \brief Pointer that overloads operator ->
+/// \tparam T class or type
+/// \details member_ptr is used frequently in the library to avoid the issues related to
+///  std::auto_ptr in C++11 (deprecated) and std::unique_ptr in C++03 (non-existent).
+/// \bug <a href="http://github.com/weidai11/cryptopp/issues/48">Issue 48: "Use of auto_ptr
+///  causes dirty compile under C++11"</a>
+template <class T> class member_ptr
+{
+public:
+	explicit member_ptr(T *p = NULLPTR) : m_p(p) {}
+
+	~member_ptr();
+
+	const T& operator*() const { return *m_p; }
+	T& operator*() { return *m_p; }
+
+	const T* operator->() const { return m_p; }
+	T* operator->() { return m_p; }
+
+	const T* get() const { return m_p; }
+	T* get() { return m_p; }
+
+	T* release()
+	{
+		T *old_p = m_p;
+		m_p = NULLPTR;
+		return old_p;
+	}
+
+	void reset(T *p = NULLPTR);
+
+protected:
+	member_ptr(const member_ptr<T>& rhs);		// copy not allowed
+	void operator=(const member_ptr<T>& rhs);	// assignment not allowed
+
+	T *m_p;
+};
+
+template <class T> member_ptr<T>::~member_ptr() {delete m_p;}
+template <class T> void member_ptr<T>::reset(T *p) {delete m_p; m_p = p;}
+
+// ********************************************************
+
+/// \brief Value pointer
+/// \tparam T class or type
+template<class T> class value_ptr : public member_ptr<T>
+{
+public:
+	value_ptr(const T &obj) : member_ptr<T>(new T(obj)) {}
+	value_ptr(T *p = NULLPTR) : member_ptr<T>(p) {}
+	value_ptr(const value_ptr<T>& rhs)
+		: member_ptr<T>(rhs.m_p ? new T(*rhs.m_p) : NULLPTR) {}
+
+	value_ptr<T>& operator=(const value_ptr<T>& rhs);
+	bool operator==(const value_ptr<T>& rhs)
+	{
+		return (!this->m_p && !rhs.m_p) || (this->m_p && rhs.m_p && *this->m_p == *rhs.m_p);
+	}
+};
+
+template <class T> value_ptr<T>& value_ptr<T>::operator=(const value_ptr<T>& rhs)
+{
+	T *old_p = this->m_p;
+	this->m_p = rhs.m_p ? new T(*rhs.m_p) : NULLPTR;
+	delete old_p;
+	return *this;
+}
+
+// ********************************************************
+
+/// \brief A pointer which can be copied and cloned
+/// \tparam T class or type
+/// \details \p T should adhere to the \p Clonable interface
+template<class T> class clonable_ptr : public member_ptr<T>
+{
+public:
+	clonable_ptr(const T &obj) : member_ptr<T>(obj.Clone()) {}
+	clonable_ptr(T *p = NULLPTR) : member_ptr<T>(p) {}
+	clonable_ptr(const clonable_ptr<T>& rhs)
+		: member_ptr<T>(rhs.m_p ? rhs.m_p->Clone() : NULLPTR) {}
+
+	clonable_ptr<T>& operator=(const clonable_ptr<T>& rhs);
+};
+
+template <class T> clonable_ptr<T>& clonable_ptr<T>::operator=(const clonable_ptr<T>& rhs)
+{
+	T *old_p = this->m_p;
+	this->m_p = rhs.m_p ? rhs.m_p->Clone() : NULLPTR;
+	delete old_p;
+	return *this;
+}
+
+// ********************************************************
+
+/// \brief Reference counted pointer
+/// \tparam T class or type
+/// \details users should declare \p m_referenceCount as <tt>std::atomic<unsigned></tt>
+///   (or similar) under C++ 11
+template<class T> class counted_ptr
+{
+public:
+	explicit counted_ptr(T *p = NULLPTR);
+	counted_ptr(const T &r) : m_p(0) {attach(r);}
+	counted_ptr(const counted_ptr<T>& rhs);
+
+	~counted_ptr();
+
+	const T& operator*() const { return *m_p; }
+	T& operator*() { return *m_p; }
+
+	const T* operator->() const { return m_p; }
+	T* operator->() { return get(); }
+
+	const T* get() const { return m_p; }
+	T* get();
+
+	void attach(const T &p);
+
+	counted_ptr<T> & operator=(const counted_ptr<T>& rhs);
+
+private:
+	T *m_p;
+};
+
+template <class T> counted_ptr<T>::counted_ptr(T *p)
+	: m_p(p)
+{
+	if (m_p)
+		m_p->m_referenceCount = 1;
+}
+
+template <class T> counted_ptr<T>::counted_ptr(const counted_ptr<T>& rhs)
+	: m_p(rhs.m_p)
+{
+	if (m_p)
+		m_p->m_referenceCount++;
+}
+
+template <class T> counted_ptr<T>::~counted_ptr()
+{
+	if (m_p && --m_p->m_referenceCount == 0)
+		delete m_p;
+}
+
+template <class T> void counted_ptr<T>::attach(const T &r)
+{
+	if (m_p && --m_p->m_referenceCount == 0)
+		delete m_p;
+	if (r.m_referenceCount == 0)
+	{
+		m_p = r.clone();
+		m_p->m_referenceCount = 1;
+	}
+	else
+	{
+		m_p = const_cast<T *>(&r);
+		m_p->m_referenceCount++;
+	}
+}
+
+template <class T> T* counted_ptr<T>::get()
+{
+	if (m_p && m_p->m_referenceCount > 1)
+	{
+		T *temp = m_p->clone();
+		m_p->m_referenceCount--;
+		m_p = temp;
+		m_p->m_referenceCount = 1;
+	}
+	return m_p;
+}
+
+template <class T> counted_ptr<T> & counted_ptr<T>::operator=(const counted_ptr<T>& rhs)
+{
+	if (m_p != rhs.m_p)
+	{
+		if (m_p && --m_p->m_referenceCount == 0)
+			delete m_p;
+		m_p = rhs.m_p;
+		if (m_p)
+			m_p->m_referenceCount++;
+	}
+	return *this;
+}
+
+// ********************************************************
+
+/// \brief Manages resources for an array of objects
+/// \tparam T class or type
+template <class T> class vector_member_ptrs
+{
+public:
+	/// Construct an array of \p T
+	/// \param size the size of the array, in elements
+	/// \details If \p T is a Plain Old Dataype (POD), then the array is uninitialized.
+	vector_member_ptrs(size_t size=0)
+		: m_size(size), m_ptr(new member_ptr<T>[size]) {}
+	~vector_member_ptrs()
+		{delete [] this->m_ptr;}
+
+	member_ptr<T>& operator[](size_t index)
+		{CRYPTOPP_ASSERT(index<this->m_size); return this->m_ptr[index];}
+	const member_ptr<T>& operator[](size_t index) const
+		{CRYPTOPP_ASSERT(index<this->m_size); return this->m_ptr[index];}
+
+	size_t size() const {return this->m_size;}
+	void resize(size_t newSize)
+	{
+		member_ptr<T> *newPtr = new member_ptr<T>[newSize];
+		for (size_t i=0; i<this->m_size && i<newSize; i++)
+			newPtr[i].reset(this->m_ptr[i].release());
+		delete [] this->m_ptr;
+		this->m_size = newSize;
+		this->m_ptr = newPtr;
+	}
+
+private:
+	vector_member_ptrs(const vector_member_ptrs<T> &c);	// copy not allowed
+	void operator=(const vector_member_ptrs<T> &x);		// assignment not allowed
+
+	size_t m_size;
+	member_ptr<T> *m_ptr;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/sosemanuk.cpp b/runtime/third_party/cryptopp/sosemanuk.cpp
new file mode 100644
index 0000000..ac38d58
--- /dev/null
+++ b/runtime/third_party/cryptopp/sosemanuk.cpp
@@ -0,0 +1,728 @@
+// sosemanuk.cpp - originally written and placed in the public domain by Wei Dai
+
+// use "cl /EP /P /DCRYPTOPP_GENERATE_X64_MASM sosemanuk.cpp" to generate MASM code
+
+#include "pch.h"
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4702 4731)
+#endif
+
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+
+#include "sosemanuk.h"
+#include "serpentp.h"
+#include "secblock.h"
+#include "misc.h"
+#include "cpu.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+std::string SosemanukPolicy::AlgorithmProvider() const
+{
+#ifndef CRYPTOPP_DISABLE_SOSEMANUK_ASM
+# if CRYPTOPP_SSE2_ASM_AVAILABLE
+	if (HasSSE2())
+		return "SSE2";
+# endif
+#endif
+	return "C++";
+}
+
+void SosemanukPolicy::CipherSetKey(const NameValuePairs &params, const byte *userKey, size_t keylen)
+{
+	CRYPTOPP_UNUSED(params);
+	Serpent_KeySchedule(m_key, 24, userKey, keylen);
+}
+
+void SosemanukPolicy::CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length)
+{
+	CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(iv), CRYPTOPP_UNUSED(length);
+	CRYPTOPP_ASSERT(length==16);
+
+	word32 a, b, c, d, e;
+
+	typedef BlockGetAndPut<word32, LittleEndian> Block;
+	Block::Get(iv)(a)(b)(c)(d);
+
+	const word32 *k = m_key;
+	unsigned int i=1;
+
+	do
+	{
+		beforeS0(KX); beforeS0(S0); afterS0(LT);
+		afterS0(KX); afterS0(S1); afterS1(LT);
+		if (i == 3)	// after 18th round
+		{
+			m_state[4] = b;
+			m_state[5] = e;
+			m_state[10] = c;
+			m_state[11] = a;
+		}
+		afterS1(KX); afterS1(S2); afterS2(LT);
+		afterS2(KX); afterS2(S3); afterS3(LT);
+		if (i == 2)	// after 12th round
+		{
+			m_state[6] = c;
+			m_state[7] = d;
+			m_state[8] = b;
+			m_state[9] = e;
+		}
+		afterS3(KX); afterS3(S4); afterS4(LT);
+		afterS4(KX); afterS4(S5); afterS5(LT);
+		afterS5(KX); afterS5(S6); afterS6(LT);
+		afterS6(KX); afterS6(S7); afterS7(LT);
+
+		if (i == 3)
+			break;
+
+		++i;
+		c = b;
+		b = e;
+		e = d;
+		d = a;
+		a = e;
+		k += 32;
+	}
+	while (true);
+
+	afterS7(KX);
+
+	m_state[0] = a;
+	m_state[1] = b;
+	m_state[2] = e;
+	m_state[3] = d;
+
+#define XMUX(c, x, y)   (x ^ (y & (0 - (c & 1))))
+	m_state[11] += XMUX(m_state[10], m_state[1], m_state[8]);
+	m_state[10] = rotlConstant<7>(m_state[10] * 0x54655307);
+}
+
+extern "C" {
+word32 s_sosemanukMulTables[512] = {
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64) && !defined(CRYPTOPP_DISABLE_SOSEMANUK_ASM)
+	0x00000000, 0xE19FCF12, 0x6B973724, 0x8A08F836,
+	0xD6876E48, 0x3718A15A, 0xBD10596C, 0x5C8F967E,
+	0x05A7DC90, 0xE4381382, 0x6E30EBB4, 0x8FAF24A6,
+	0xD320B2D8, 0x32BF7DCA, 0xB8B785FC, 0x59284AEE,
+	0x0AE71189, 0xEB78DE9B, 0x617026AD, 0x80EFE9BF,
+	0xDC607FC1, 0x3DFFB0D3, 0xB7F748E5, 0x566887F7,
+	0x0F40CD19, 0xEEDF020B, 0x64D7FA3D, 0x8548352F,
+	0xD9C7A351, 0x38586C43, 0xB2509475, 0x53CF5B67,
+	0x146722BB, 0xF5F8EDA9, 0x7FF0159F, 0x9E6FDA8D,
+	0xC2E04CF3, 0x237F83E1, 0xA9777BD7, 0x48E8B4C5,
+	0x11C0FE2B, 0xF05F3139, 0x7A57C90F, 0x9BC8061D,
+	0xC7479063, 0x26D85F71, 0xACD0A747, 0x4D4F6855,
+	0x1E803332, 0xFF1FFC20, 0x75170416, 0x9488CB04,
+	0xC8075D7A, 0x29989268, 0xA3906A5E, 0x420FA54C,
+	0x1B27EFA2, 0xFAB820B0, 0x70B0D886, 0x912F1794,
+	0xCDA081EA, 0x2C3F4EF8, 0xA637B6CE, 0x47A879DC,
+	0x28CE44DF, 0xC9518BCD, 0x435973FB, 0xA2C6BCE9,
+	0xFE492A97, 0x1FD6E585, 0x95DE1DB3, 0x7441D2A1,
+	0x2D69984F, 0xCCF6575D, 0x46FEAF6B, 0xA7616079,
+	0xFBEEF607, 0x1A713915, 0x9079C123, 0x71E60E31,
+	0x22295556, 0xC3B69A44, 0x49BE6272, 0xA821AD60,
+	0xF4AE3B1E, 0x1531F40C, 0x9F390C3A, 0x7EA6C328,
+	0x278E89C6, 0xC61146D4, 0x4C19BEE2, 0xAD8671F0,
+	0xF109E78E, 0x1096289C, 0x9A9ED0AA, 0x7B011FB8,
+	0x3CA96664, 0xDD36A976, 0x573E5140, 0xB6A19E52,
+	0xEA2E082C, 0x0BB1C73E, 0x81B93F08, 0x6026F01A,
+	0x390EBAF4, 0xD89175E6, 0x52998DD0, 0xB30642C2,
+	0xEF89D4BC, 0x0E161BAE, 0x841EE398, 0x65812C8A,
+	0x364E77ED, 0xD7D1B8FF, 0x5DD940C9, 0xBC468FDB,
+	0xE0C919A5, 0x0156D6B7, 0x8B5E2E81, 0x6AC1E193,
+	0x33E9AB7D, 0xD276646F, 0x587E9C59, 0xB9E1534B,
+	0xE56EC535, 0x04F10A27, 0x8EF9F211, 0x6F663D03,
+	0x50358817, 0xB1AA4705, 0x3BA2BF33, 0xDA3D7021,
+	0x86B2E65F, 0x672D294D, 0xED25D17B, 0x0CBA1E69,
+	0x55925487, 0xB40D9B95, 0x3E0563A3, 0xDF9AACB1,
+	0x83153ACF, 0x628AF5DD, 0xE8820DEB, 0x091DC2F9,
+	0x5AD2999E, 0xBB4D568C, 0x3145AEBA, 0xD0DA61A8,
+	0x8C55F7D6, 0x6DCA38C4, 0xE7C2C0F2, 0x065D0FE0,
+	0x5F75450E, 0xBEEA8A1C, 0x34E2722A, 0xD57DBD38,
+	0x89F22B46, 0x686DE454, 0xE2651C62, 0x03FAD370,
+	0x4452AAAC, 0xA5CD65BE, 0x2FC59D88, 0xCE5A529A,
+	0x92D5C4E4, 0x734A0BF6, 0xF942F3C0, 0x18DD3CD2,
+	0x41F5763C, 0xA06AB92E, 0x2A624118, 0xCBFD8E0A,
+	0x97721874, 0x76EDD766, 0xFCE52F50, 0x1D7AE042,
+	0x4EB5BB25, 0xAF2A7437, 0x25228C01, 0xC4BD4313,
+	0x9832D56D, 0x79AD1A7F, 0xF3A5E249, 0x123A2D5B,
+	0x4B1267B5, 0xAA8DA8A7, 0x20855091, 0xC11A9F83,
+	0x9D9509FD, 0x7C0AC6EF, 0xF6023ED9, 0x179DF1CB,
+	0x78FBCCC8, 0x996403DA, 0x136CFBEC, 0xF2F334FE,
+	0xAE7CA280, 0x4FE36D92, 0xC5EB95A4, 0x24745AB6,
+	0x7D5C1058, 0x9CC3DF4A, 0x16CB277C, 0xF754E86E,
+	0xABDB7E10, 0x4A44B102, 0xC04C4934, 0x21D38626,
+	0x721CDD41, 0x93831253, 0x198BEA65, 0xF8142577,
+	0xA49BB309, 0x45047C1B, 0xCF0C842D, 0x2E934B3F,
+	0x77BB01D1, 0x9624CEC3, 0x1C2C36F5, 0xFDB3F9E7,
+	0xA13C6F99, 0x40A3A08B, 0xCAAB58BD, 0x2B3497AF,
+	0x6C9CEE73, 0x8D032161, 0x070BD957, 0xE6941645,
+	0xBA1B803B, 0x5B844F29, 0xD18CB71F, 0x3013780D,
+	0x693B32E3, 0x88A4FDF1, 0x02AC05C7, 0xE333CAD5,
+	0xBFBC5CAB, 0x5E2393B9, 0xD42B6B8F, 0x35B4A49D,
+	0x667BFFFA, 0x87E430E8, 0x0DECC8DE, 0xEC7307CC,
+	0xB0FC91B2, 0x51635EA0, 0xDB6BA696, 0x3AF46984,
+	0x63DC236A, 0x8243EC78, 0x084B144E, 0xE9D4DB5C,
+	0xB55B4D22, 0x54C48230, 0xDECC7A06, 0x3F53B514,
+#else
+	0x00000000, 0xE19FCF13, 0x6B973726, 0x8A08F835,
+	0xD6876E4C, 0x3718A15F, 0xBD10596A, 0x5C8F9679,
+	0x05A7DC98, 0xE438138B, 0x6E30EBBE, 0x8FAF24AD,
+	0xD320B2D4, 0x32BF7DC7, 0xB8B785F2, 0x59284AE1,
+	0x0AE71199, 0xEB78DE8A, 0x617026BF, 0x80EFE9AC,
+	0xDC607FD5, 0x3DFFB0C6, 0xB7F748F3, 0x566887E0,
+	0x0F40CD01, 0xEEDF0212, 0x64D7FA27, 0x85483534,
+	0xD9C7A34D, 0x38586C5E, 0xB250946B, 0x53CF5B78,
+	0x1467229B, 0xF5F8ED88, 0x7FF015BD, 0x9E6FDAAE,
+	0xC2E04CD7, 0x237F83C4, 0xA9777BF1, 0x48E8B4E2,
+	0x11C0FE03, 0xF05F3110, 0x7A57C925, 0x9BC80636,
+	0xC747904F, 0x26D85F5C, 0xACD0A769, 0x4D4F687A,
+	0x1E803302, 0xFF1FFC11, 0x75170424, 0x9488CB37,
+	0xC8075D4E, 0x2998925D, 0xA3906A68, 0x420FA57B,
+	0x1B27EF9A, 0xFAB82089, 0x70B0D8BC, 0x912F17AF,
+	0xCDA081D6, 0x2C3F4EC5, 0xA637B6F0, 0x47A879E3,
+	0x28CE449F, 0xC9518B8C, 0x435973B9, 0xA2C6BCAA,
+	0xFE492AD3, 0x1FD6E5C0, 0x95DE1DF5, 0x7441D2E6,
+	0x2D699807, 0xCCF65714, 0x46FEAF21, 0xA7616032,
+	0xFBEEF64B, 0x1A713958, 0x9079C16D, 0x71E60E7E,
+	0x22295506, 0xC3B69A15, 0x49BE6220, 0xA821AD33,
+	0xF4AE3B4A, 0x1531F459, 0x9F390C6C, 0x7EA6C37F,
+	0x278E899E, 0xC611468D, 0x4C19BEB8, 0xAD8671AB,
+	0xF109E7D2, 0x109628C1, 0x9A9ED0F4, 0x7B011FE7,
+	0x3CA96604, 0xDD36A917, 0x573E5122, 0xB6A19E31,
+	0xEA2E0848, 0x0BB1C75B, 0x81B93F6E, 0x6026F07D,
+	0x390EBA9C, 0xD891758F, 0x52998DBA, 0xB30642A9,
+	0xEF89D4D0, 0x0E161BC3, 0x841EE3F6, 0x65812CE5,
+	0x364E779D, 0xD7D1B88E, 0x5DD940BB, 0xBC468FA8,
+	0xE0C919D1, 0x0156D6C2, 0x8B5E2EF7, 0x6AC1E1E4,
+	0x33E9AB05, 0xD2766416, 0x587E9C23, 0xB9E15330,
+	0xE56EC549, 0x04F10A5A, 0x8EF9F26F, 0x6F663D7C,
+	0x50358897, 0xB1AA4784, 0x3BA2BFB1, 0xDA3D70A2,
+	0x86B2E6DB, 0x672D29C8, 0xED25D1FD, 0x0CBA1EEE,
+	0x5592540F, 0xB40D9B1C, 0x3E056329, 0xDF9AAC3A,
+	0x83153A43, 0x628AF550, 0xE8820D65, 0x091DC276,
+	0x5AD2990E, 0xBB4D561D, 0x3145AE28, 0xD0DA613B,
+	0x8C55F742, 0x6DCA3851, 0xE7C2C064, 0x065D0F77,
+	0x5F754596, 0xBEEA8A85, 0x34E272B0, 0xD57DBDA3,
+	0x89F22BDA, 0x686DE4C9, 0xE2651CFC, 0x03FAD3EF,
+	0x4452AA0C, 0xA5CD651F, 0x2FC59D2A, 0xCE5A5239,
+	0x92D5C440, 0x734A0B53, 0xF942F366, 0x18DD3C75,
+	0x41F57694, 0xA06AB987, 0x2A6241B2, 0xCBFD8EA1,
+	0x977218D8, 0x76EDD7CB, 0xFCE52FFE, 0x1D7AE0ED,
+	0x4EB5BB95, 0xAF2A7486, 0x25228CB3, 0xC4BD43A0,
+	0x9832D5D9, 0x79AD1ACA, 0xF3A5E2FF, 0x123A2DEC,
+	0x4B12670D, 0xAA8DA81E, 0x2085502B, 0xC11A9F38,
+	0x9D950941, 0x7C0AC652, 0xF6023E67, 0x179DF174,
+	0x78FBCC08, 0x9964031B, 0x136CFB2E, 0xF2F3343D,
+	0xAE7CA244, 0x4FE36D57, 0xC5EB9562, 0x24745A71,
+	0x7D5C1090, 0x9CC3DF83, 0x16CB27B6, 0xF754E8A5,
+	0xABDB7EDC, 0x4A44B1CF, 0xC04C49FA, 0x21D386E9,
+	0x721CDD91, 0x93831282, 0x198BEAB7, 0xF81425A4,
+	0xA49BB3DD, 0x45047CCE, 0xCF0C84FB, 0x2E934BE8,
+	0x77BB0109, 0x9624CE1A, 0x1C2C362F, 0xFDB3F93C,
+	0xA13C6F45, 0x40A3A056, 0xCAAB5863, 0x2B349770,
+	0x6C9CEE93, 0x8D032180, 0x070BD9B5, 0xE69416A6,
+	0xBA1B80DF, 0x5B844FCC, 0xD18CB7F9, 0x301378EA,
+	0x693B320B, 0x88A4FD18, 0x02AC052D, 0xE333CA3E,
+	0xBFBC5C47, 0x5E239354, 0xD42B6B61, 0x35B4A472,
+	0x667BFF0A, 0x87E43019, 0x0DECC82C, 0xEC73073F,
+	0xB0FC9146, 0x51635E55, 0xDB6BA660, 0x3AF46973,
+	0x63DC2392, 0x8243EC81, 0x084B14B4, 0xE9D4DBA7,
+	0xB55B4DDE, 0x54C482CD, 0xDECC7AF8, 0x3F53B5EB,
+#endif
+	0x00000000, 0x180F40CD, 0x301E8033, 0x2811C0FE,
+	0x603CA966, 0x7833E9AB, 0x50222955, 0x482D6998,
+	0xC078FBCC, 0xD877BB01, 0xF0667BFF, 0xE8693B32,
+	0xA04452AA, 0xB84B1267, 0x905AD299, 0x88559254,
+	0x29F05F31, 0x31FF1FFC, 0x19EEDF02, 0x01E19FCF,
+	0x49CCF657, 0x51C3B69A, 0x79D27664, 0x61DD36A9,
+	0xE988A4FD, 0xF187E430, 0xD99624CE, 0xC1996403,
+	0x89B40D9B, 0x91BB4D56, 0xB9AA8DA8, 0xA1A5CD65,
+	0x5249BE62, 0x4A46FEAF, 0x62573E51, 0x7A587E9C,
+	0x32751704, 0x2A7A57C9, 0x026B9737, 0x1A64D7FA,
+	0x923145AE, 0x8A3E0563, 0xA22FC59D, 0xBA208550,
+	0xF20DECC8, 0xEA02AC05, 0xC2136CFB, 0xDA1C2C36,
+	0x7BB9E153, 0x63B6A19E, 0x4BA76160, 0x53A821AD,
+	0x1B854835, 0x038A08F8, 0x2B9BC806, 0x339488CB,
+	0xBBC11A9F, 0xA3CE5A52, 0x8BDF9AAC, 0x93D0DA61,
+	0xDBFDB3F9, 0xC3F2F334, 0xEBE333CA, 0xF3EC7307,
+	0xA492D5C4, 0xBC9D9509, 0x948C55F7, 0x8C83153A,
+	0xC4AE7CA2, 0xDCA13C6F, 0xF4B0FC91, 0xECBFBC5C,
+	0x64EA2E08, 0x7CE56EC5, 0x54F4AE3B, 0x4CFBEEF6,
+	0x04D6876E, 0x1CD9C7A3, 0x34C8075D, 0x2CC74790,
+	0x8D628AF5, 0x956DCA38, 0xBD7C0AC6, 0xA5734A0B,
+	0xED5E2393, 0xF551635E, 0xDD40A3A0, 0xC54FE36D,
+	0x4D1A7139, 0x551531F4, 0x7D04F10A, 0x650BB1C7,
+	0x2D26D85F, 0x35299892, 0x1D38586C, 0x053718A1,
+	0xF6DB6BA6, 0xEED42B6B, 0xC6C5EB95, 0xDECAAB58,
+	0x96E7C2C0, 0x8EE8820D, 0xA6F942F3, 0xBEF6023E,
+	0x36A3906A, 0x2EACD0A7, 0x06BD1059, 0x1EB25094,
+	0x569F390C, 0x4E9079C1, 0x6681B93F, 0x7E8EF9F2,
+	0xDF2B3497, 0xC724745A, 0xEF35B4A4, 0xF73AF469,
+	0xBF179DF1, 0xA718DD3C, 0x8F091DC2, 0x97065D0F,
+	0x1F53CF5B, 0x075C8F96, 0x2F4D4F68, 0x37420FA5,
+	0x7F6F663D, 0x676026F0, 0x4F71E60E, 0x577EA6C3,
+	0xE18D0321, 0xF98243EC, 0xD1938312, 0xC99CC3DF,
+	0x81B1AA47, 0x99BEEA8A, 0xB1AF2A74, 0xA9A06AB9,
+	0x21F5F8ED, 0x39FAB820, 0x11EB78DE, 0x09E43813,
+	0x41C9518B, 0x59C61146, 0x71D7D1B8, 0x69D89175,
+	0xC87D5C10, 0xD0721CDD, 0xF863DC23, 0xE06C9CEE,
+	0xA841F576, 0xB04EB5BB, 0x985F7545, 0x80503588,
+	0x0805A7DC, 0x100AE711, 0x381B27EF, 0x20146722,
+	0x68390EBA, 0x70364E77, 0x58278E89, 0x4028CE44,
+	0xB3C4BD43, 0xABCBFD8E, 0x83DA3D70, 0x9BD57DBD,
+	0xD3F81425, 0xCBF754E8, 0xE3E69416, 0xFBE9D4DB,
+	0x73BC468F, 0x6BB30642, 0x43A2C6BC, 0x5BAD8671,
+	0x1380EFE9, 0x0B8FAF24, 0x239E6FDA, 0x3B912F17,
+	0x9A34E272, 0x823BA2BF, 0xAA2A6241, 0xB225228C,
+	0xFA084B14, 0xE2070BD9, 0xCA16CB27, 0xD2198BEA,
+	0x5A4C19BE, 0x42435973, 0x6A52998D, 0x725DD940,
+	0x3A70B0D8, 0x227FF015, 0x0A6E30EB, 0x12617026,
+	0x451FD6E5, 0x5D109628, 0x750156D6, 0x6D0E161B,
+	0x25237F83, 0x3D2C3F4E, 0x153DFFB0, 0x0D32BF7D,
+	0x85672D29, 0x9D686DE4, 0xB579AD1A, 0xAD76EDD7,
+	0xE55B844F, 0xFD54C482, 0xD545047C, 0xCD4A44B1,
+	0x6CEF89D4, 0x74E0C919, 0x5CF109E7, 0x44FE492A,
+	0x0CD320B2, 0x14DC607F, 0x3CCDA081, 0x24C2E04C,
+	0xAC977218, 0xB49832D5, 0x9C89F22B, 0x8486B2E6,
+	0xCCABDB7E, 0xD4A49BB3, 0xFCB55B4D, 0xE4BA1B80,
+	0x17566887, 0x0F59284A, 0x2748E8B4, 0x3F47A879,
+	0x776AC1E1, 0x6F65812C, 0x477441D2, 0x5F7B011F,
+	0xD72E934B, 0xCF21D386, 0xE7301378, 0xFF3F53B5,
+	0xB7123A2D, 0xAF1D7AE0, 0x870CBA1E, 0x9F03FAD3,
+	0x3EA637B6, 0x26A9777B, 0x0EB8B785, 0x16B7F748,
+	0x5E9A9ED0, 0x4695DE1D, 0x6E841EE3, 0x768B5E2E,
+	0xFEDECC7A, 0xE6D18CB7, 0xCEC04C49, 0xD6CF0C84,
+	0x9EE2651C, 0x86ED25D1, 0xAEFCE52F, 0xB6F3A5E2
+};
+}
+
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+unsigned int SosemanukPolicy::GetAlignment() const
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+#ifdef __INTEL_COMPILER
+	if (HasSSE2() && !IsP4())	// Intel compiler produces faster code for this algorithm on the P4
+#else
+	if (HasSSE2())
+#endif
+		return 16;
+	else
+#endif
+		return GetAlignmentOf<word32>();
+}
+
+unsigned int SosemanukPolicy::GetOptimalBlockSize() const
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+#ifdef __INTEL_COMPILER
+	if (HasSSE2() && !IsP4())	// Intel compiler produces faster code for this algorithm on the P4
+#else
+	if (HasSSE2())
+#endif
+		return 4*BYTES_PER_ITERATION;
+	else
+#endif
+		return BYTES_PER_ITERATION;
+}
+#endif
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+extern "C" {
+void Sosemanuk_OperateKeystream(size_t iterationCount, const byte *input, byte *output, word32 *state);
+}
+#endif
+
+void SosemanukPolicy::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+#endif	// #ifdef CRYPTOPP_GENERATE_X64_MASM
+
+#ifdef CRYPTOPP_X64_MASM_AVAILABLE
+	Sosemanuk_OperateKeystream(iterationCount, input, output, m_state.data());
+	return;
+#endif
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE && !defined(CRYPTOPP_DISABLE_SOSEMANUK_ASM)
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+		ALIGN   8
+	Sosemanuk_OperateKeystream	PROC FRAME
+		rex_push_reg rsi
+		push_reg rdi
+		alloc_stack(80*4*2+12*4+8*WORD_SZ + 2*16+8)
+		save_xmm128 xmm6, 02f0h
+		save_xmm128 xmm7, 0300h
+		.endprolog
+		mov		rdi, r8
+		mov		rax, r9
+#else
+#ifdef __INTEL_COMPILER
+	if (HasSSE2() && !IsP4())	// Intel compiler produces faster code for this algorithm on the P4
+#else
+	if (HasSSE2())
+#endif
+	{
+#ifdef __GNUC__
+	#if CRYPTOPP_BOOL_X64
+		FixedSizeAlignedSecBlock<byte, 80*4*2+12*4+8*WORD_SZ> workspace;
+	#endif
+		__asm__ __volatile__
+		(
+		INTEL_NOPREFIX
+		AS_PUSH_IF86(	bx)
+#else
+		word32 *state = m_state;
+		AS2(	mov		WORD_REG(ax), state)
+		AS2(	mov		WORD_REG(di), output)
+		AS2(	mov		WORD_REG(dx), input)
+		AS2(	mov		WORD_REG(cx), iterationCount)
+#endif
+#endif	// #ifdef CRYPTOPP_GENERATE_X64_MASM
+
+#if defined(__GNUC__) && CRYPTOPP_BOOL_X64
+	#define SSE2_workspace %5
+#else
+	#define SSE2_workspace WORD_REG(sp)
+#endif
+
+#define SSE2_output			WORD_PTR [SSE2_workspace+1*WORD_SZ]
+#define SSE2_input			WORD_PTR [SSE2_workspace+2*WORD_SZ]
+#define SSE2_wordsLeft		WORD_PTR [SSE2_workspace+3*WORD_SZ]
+#define SSE2_diEnd			WORD_PTR [SSE2_workspace+4*WORD_SZ]
+#define SSE2_pMulTables		WORD_PTR [SSE2_workspace+5*WORD_SZ]
+#define SSE2_state			WORD_PTR [SSE2_workspace+6*WORD_SZ]
+#define SSE2_wordsLeft2		WORD_PTR [SSE2_workspace+7*WORD_SZ]
+#define SSE2_stateCopy		SSE2_workspace + 8*WORD_SZ
+#define	SSE2_uvStart		SSE2_stateCopy + 12*4
+
+#if (CRYPTOPP_BOOL_X86) && !defined(CRYPTOPP_DISABLE_SOSEMANUK_ASM)
+		AS_PUSH_IF86(	bp)
+		AS2(	mov		AS_REG_6, esp)
+		AS2(	and		esp, -16)
+		AS2(	sub		esp, 80*4*2+12*4+8*WORD_SZ)	// 80 v's, 80 u's, 12 state, 8 locals
+		AS2(	mov		[esp], AS_REG_6)
+#endif
+		AS2(	mov		SSE2_output, WORD_REG(di))
+		AS2(	mov		SSE2_input, WORD_REG(dx))
+		AS2(	mov		SSE2_state, WORD_REG(ax))
+#ifndef CRYPTOPP_MSC_VERSION
+		AS2(	mov		SSE2_pMulTables, WORD_REG(si))
+#endif
+		AS2(	lea		WORD_REG(cx), [4*WORD_REG(cx)+WORD_REG(cx)])
+		AS2(	lea		WORD_REG(si), [4*WORD_REG(cx)])
+		AS2(	mov		SSE2_wordsLeft, WORD_REG(si))
+		AS2(	movdqa	xmm0, [WORD_REG(ax)+0*16])		// copy state to stack to save a register
+		AS2(	movdqa	[SSE2_stateCopy+0*16], xmm0)
+		AS2(	movdqa	xmm0, [WORD_REG(ax)+1*16])
+		AS2(	movdqa	[SSE2_stateCopy+1*16], xmm0)
+		AS2(	movq	xmm0, QWORD PTR [WORD_REG(ax)+2*16])
+		AS2(	movq	QWORD PTR [SSE2_stateCopy+2*16], xmm0)
+		AS2(	psrlq	xmm0, 32)
+		AS2(	movd	AS_REG_6d, xmm0)				// s(9)
+		AS2(	mov		ecx, [WORD_REG(ax)+10*4])
+		AS2(	mov		edx, [WORD_REG(ax)+11*4])
+		AS2(	pcmpeqb	xmm7, xmm7)				// all ones
+
+#define s(i)	SSE2_stateCopy + ASM_MOD(i,10)*4
+#define u(j)	WORD_REG(di) + (ASM_MOD(j,4)*20 + (j/4)) * 4
+#define v(j)	WORD_REG(di) + (ASM_MOD(j,4)*20 + (j/4)) * 4 + 80*4
+
+#define R10 ecx
+#define R11 edx
+#define R20 edx
+#define R21 ecx
+// workaround bug in GAS 2.15
+#define R20r WORD_REG(dx)
+#define R21r WORD_REG(cx)
+
+#define SSE2_STEP(i, j)	\
+	AS2(	mov		eax, [s(i+0)])\
+	AS2(	mov		[v(i)], eax)\
+	AS2(	rol		eax, 8)\
+	AS2(	lea		AS_REG_7, [AS_REG_6 + R2##j##r])\
+	AS2(	xor		AS_REG_7d, R1##j)\
+	AS2(	mov		[u(i)], AS_REG_7d)\
+	AS2(	mov		AS_REG_7d, 1)\
+	AS2(	and		AS_REG_7d, R2##j)\
+	AS1(	neg		AS_REG_7d)\
+	AS2(	and		AS_REG_7d, AS_REG_6d)\
+	AS2(	xor		AS_REG_6d, eax)\
+	AS2(	movzx	eax, al)\
+	AS2(	xor		AS_REG_6d, [WORD_REG(si)+WORD_REG(ax)*4])\
+	AS2(	mov		eax, [s(i+3)])\
+	AS2(	xor		AS_REG_7d, [s(i+2)])\
+	AS2(	add		R1##j, AS_REG_7d)\
+	AS2(	movzx	AS_REG_7d, al)\
+	AS2(	shr		eax, 8)\
+	AS2(	xor		AS_REG_6d, [WORD_REG(si)+1024+AS_REG_7*4])\
+	AS2(	xor		AS_REG_6d, eax)\
+	AS2(	imul	R2##j, AS_HEX(54655307))\
+	AS2(	rol		R2##j, 7)\
+	AS2(	mov		[s(i+0)], AS_REG_6d)\
+
+		ASL(2)	// outer loop, each iteration of this processes 80 words
+		AS2(	lea		WORD_REG(di), [SSE2_uvStart])	// start of v and u
+		AS2(	mov		WORD_REG(ax), 80)
+		AS2(	cmp		WORD_REG(si), 80)
+		AS2(	cmovg	WORD_REG(si), WORD_REG(ax))
+		AS2(	mov		SSE2_wordsLeft2, WORD_REG(si))
+		AS2(	lea		WORD_REG(si), [WORD_REG(di)+WORD_REG(si)])		// use to end first inner loop
+		AS2(	mov		SSE2_diEnd, WORD_REG(si))
+#ifdef CRYPTOPP_MSC_VERSION
+		AS2(	lea		WORD_REG(si), s_sosemanukMulTables)
+#else
+		AS2(	mov		WORD_REG(si), SSE2_pMulTables)
+#endif
+
+		ASL(0)	// first inner loop, 20 words each, 4 iterations
+		SSE2_STEP(0, 0)
+		SSE2_STEP(1, 1)
+		SSE2_STEP(2, 0)
+		SSE2_STEP(3, 1)
+		SSE2_STEP(4, 0)
+		SSE2_STEP(5, 1)
+		SSE2_STEP(6, 0)
+		SSE2_STEP(7, 1)
+		SSE2_STEP(8, 0)
+		SSE2_STEP(9, 1)
+		SSE2_STEP(10, 0)
+		SSE2_STEP(11, 1)
+		SSE2_STEP(12, 0)
+		SSE2_STEP(13, 1)
+		SSE2_STEP(14, 0)
+		SSE2_STEP(15, 1)
+		SSE2_STEP(16, 0)
+		SSE2_STEP(17, 1)
+		SSE2_STEP(18, 0)
+		SSE2_STEP(19, 1)
+		// loop
+		AS2(	add		WORD_REG(di), 5*4)
+		AS2(	cmp		WORD_REG(di), SSE2_diEnd)
+		ASJ(	jne,	0, b)
+
+		AS2(	mov		WORD_REG(ax), SSE2_input)
+		AS2(	mov		AS_REG_7, SSE2_output)
+		AS2(	lea		WORD_REG(di), [SSE2_uvStart])		// start of v and u
+		AS2(	mov		WORD_REG(si), SSE2_wordsLeft2)
+
+		ASL(1)	// second inner loop, 16 words each, 5 iterations
+		AS2(	movdqa	xmm0, [WORD_REG(di)+0*20*4])
+		AS2(	movdqa	xmm2, [WORD_REG(di)+2*20*4])
+		AS2(	movdqa	xmm3, [WORD_REG(di)+3*20*4])
+		AS2(	movdqa	xmm1, [WORD_REG(di)+1*20*4])
+		// S2
+		AS2(	movdqa	xmm4, xmm0)
+		AS2(	pand	xmm0, xmm2)
+		AS2(    pxor	xmm0, xmm3)
+		AS2(    pxor	xmm2, xmm1)
+ 		AS2(	pxor	xmm2, xmm0)
+ 		AS2(	por		xmm3, xmm4)
+ 		AS2(	pxor	xmm3, xmm1)
+ 		AS2(	pxor	xmm4, xmm2)
+ 		AS2(	movdqa	xmm1, xmm3)
+ 		AS2(	por		xmm3, xmm4)
+ 		AS2(	pxor	xmm3, xmm0)
+ 		AS2(	pand	xmm0, xmm1)
+ 		AS2(	pxor	xmm4, xmm0)
+ 		AS2(	pxor	xmm1, xmm3)
+ 		AS2(	pxor	xmm1, xmm4)
+		AS2(	pxor	xmm4, xmm7)
+		// xor with v
+		AS2(	pxor	xmm2, [WORD_REG(di)+80*4])
+		AS2(	pxor	xmm3, [WORD_REG(di)+80*5])
+		AS2(	pxor	xmm1, [WORD_REG(di)+80*6])
+		AS2(	pxor	xmm4, [WORD_REG(di)+80*7])
+		// exit loop early if less than 16 words left to output
+		// this is necessary because block size is 20 words, and we output 16 words in each iteration of this loop
+		AS2(	cmp		WORD_REG(si), 16)
+		ASJ(	jl,		4, f)
+		// unpack
+		AS2(	movdqa		xmm6, xmm2)
+		AS2(	punpckldq	xmm2, xmm3)
+		AS2(	movdqa		xmm5, xmm1)
+		AS2(	punpckldq	xmm1, xmm4)
+		AS2(	movdqa		xmm0, xmm2)
+		AS2(	punpcklqdq	xmm2, xmm1)
+		AS2(	punpckhqdq	xmm0, xmm1)
+		AS2(	punpckhdq	xmm6, xmm3)
+		AS2(	punpckhdq	xmm5, xmm4)
+		AS2(	movdqa		xmm3, xmm6)
+		AS2(	punpcklqdq	xmm6, xmm5)
+		AS2(	punpckhqdq	xmm3, xmm5)
+
+		// output keystream
+		AS_XMM_OUTPUT4(SSE2_Sosemanuk_Output, WORD_REG(ax), AS_REG_7, 2,0,6,3, 1, 0,1,2,3, 4)
+
+		// loop
+		AS2(	add		WORD_REG(di), 4*4)
+		AS2(	sub		WORD_REG(si), 16)
+		ASJ(	jnz,	1, b)
+
+		// outer loop
+		AS2(	mov		WORD_REG(si), SSE2_wordsLeft)
+		AS2(	sub		WORD_REG(si), 80)
+		ASJ(	jz,		6, f)
+		AS2(	mov		SSE2_wordsLeft, WORD_REG(si))
+		AS2(	mov		SSE2_input, WORD_REG(ax))
+		AS2(	mov		SSE2_output, AS_REG_7)
+		ASJ(	jmp,	2, b)
+
+		ASL(4)	// final output of less than 16 words
+		AS2(	test	WORD_REG(ax), WORD_REG(ax))
+		ASJ(	jz,		5, f)
+		AS2(	movd	xmm0, dword ptr [WORD_REG(ax)+0*4])
+		AS2(	pxor	xmm2, xmm0)
+		AS2(	movd	xmm0, dword ptr [WORD_REG(ax)+1*4])
+		AS2(	pxor	xmm3, xmm0)
+		AS2(	movd	xmm0, dword ptr [WORD_REG(ax)+2*4])
+		AS2(	pxor	xmm1, xmm0)
+		AS2(	movd	xmm0, dword ptr [WORD_REG(ax)+3*4])
+		AS2(	pxor	xmm4, xmm0)
+		AS2(	add		WORD_REG(ax), 16)
+		ASL(5)
+		AS2(	movd	dword ptr [AS_REG_7+0*4], xmm2)
+		AS2(	movd	dword ptr [AS_REG_7+1*4], xmm3)
+		AS2(	movd	dword ptr [AS_REG_7+2*4], xmm1)
+		AS2(	movd	dword ptr [AS_REG_7+3*4], xmm4)
+		AS2(	sub		WORD_REG(si), 4)
+		ASJ(	jz,		6, f)
+		AS2(	add		AS_REG_7, 16)
+		AS2(	psrldq	xmm2, 4)
+		AS2(	psrldq	xmm3, 4)
+		AS2(	psrldq	xmm1, 4)
+		AS2(	psrldq	xmm4, 4)
+		ASJ(	jmp,	4, b)
+
+		ASL(6)	// save state
+		AS2(	mov		AS_REG_6, SSE2_state)
+		AS2(	movdqa	xmm0, [SSE2_stateCopy+0*16])
+		AS2(	movdqa	[AS_REG_6+0*16], xmm0)
+		AS2(	movdqa	xmm0, [SSE2_stateCopy+1*16])
+		AS2(	movdqa	[AS_REG_6+1*16], xmm0)
+		AS2(	movq	xmm0, QWORD PTR [SSE2_stateCopy+2*16])
+		AS2(	movq	QWORD PTR [AS_REG_6+2*16], xmm0)
+		AS2(	mov		[AS_REG_6+10*4], ecx)
+		AS2(	mov		[AS_REG_6+11*4], edx)
+
+		AS_POP_IF86(	sp)
+		AS_POP_IF86(	bp)
+
+#ifdef __GNUC__
+		AS_POP_IF86(	bx)
+		ATT_PREFIX
+			:
+			: "a" (m_state.data()), "c" (iterationCount), "S" (s_sosemanukMulTables), "D" (output), "d" (input)
+	#if CRYPTOPP_BOOL_X64
+			, "r" (workspace.data())
+			: "memory", "cc", "%r9", "%r10", "%xmm0", "%xmm1", "%xmm2", "%xmm3", "%xmm4", "%xmm5", "%xmm6", "%xmm7"
+	#else
+			: "memory", "cc"
+	#endif
+		);
+#endif
+#ifdef CRYPTOPP_GENERATE_X64_MASM
+	movdqa	xmm6, [rsp + 02f0h]
+	movdqa	xmm7, [rsp + 0300h]
+	add		rsp, 80*4*2+12*4+8*WORD_SZ + 2*16+8
+	pop		rdi
+	pop		rsi
+	ret
+	Sosemanuk_OperateKeystream ENDP
+#else
+	}
+	else
+#endif
+#endif
+#ifndef CRYPTOPP_GENERATE_X64_MASM
+	{
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64) && !defined(CRYPTOPP_DISABLE_SOSEMANUK_ASM)
+#define MUL_A(x)    (x = (rotlConstant<8>(x)), x ^ s_sosemanukMulTables[byte(x)])
+#else
+#define MUL_A(x)    (((x) << 8) ^ s_sosemanukMulTables[(x) >> 24])
+#endif
+
+#define DIV_A(x)    (((x) >> 8) ^ s_sosemanukMulTables[256 + byte(x)])
+
+#define r1(i) ((i%2) ? reg2 : reg1)
+#define r2(i) ((i%2) ? reg1 : reg2)
+
+#define STEP(x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, v, u)	\
+		u = (s##x9 + r2(x0)) ^ r1(x0);\
+		t = v = s##x0;\
+		s##x0 = MUL_A(t) ^ DIV_A(s##x3) ^ s##x9;\
+		r1(x0) += XMUX(r2(x0), s##x2, s##x9);\
+		r2(x0) = rotlFixed(r2(x0) * 0x54655307, 7);\
+
+#define SOSEMANUK_OUTPUT(x)	\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 0, u2 ^ v0);\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 1, u3 ^ v1);\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 2, u1 ^ v2);\
+	CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, LITTLE_ENDIAN_ORDER, 3, u4 ^ v3);
+
+#define OUTPUT4	\
+	S2(0, u0, u1, u2, u3, u4);\
+	CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(SOSEMANUK_OUTPUT, 4*4);
+
+	word32 s0 = m_state[0];
+	word32 s1 = m_state[1];
+	word32 s2 = m_state[2];
+	word32 s3 = m_state[3];
+	word32 s4 = m_state[4];
+	word32 s5 = m_state[5];
+	word32 s6 = m_state[6];
+	word32 s7 = m_state[7];
+	word32 s8 = m_state[8];
+	word32 s9 = m_state[9];
+	word32 reg1 = m_state[10];
+	word32 reg2 = m_state[11];
+	word32 t, u0, u1, u2, u3, u4, v0, v1, v2, v3;
+
+	do
+	{
+		STEP(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, v0, u0)
+		STEP(1, 2, 3, 4, 5, 6, 7, 8, 9, 0, v1, u1)
+		STEP(2, 3, 4, 5, 6, 7, 8, 9, 0, 1, v2, u2)
+		STEP(3, 4, 5, 6, 7, 8, 9, 0, 1, 2, v3, u3)
+		OUTPUT4
+		STEP(4, 5, 6, 7, 8, 9, 0, 1, 2, 3, v0, u0)
+		STEP(5, 6, 7, 8, 9, 0, 1, 2, 3, 4, v1, u1)
+		STEP(6, 7, 8, 9, 0, 1, 2, 3, 4, 5, v2, u2)
+		STEP(7, 8, 9, 0, 1, 2, 3, 4, 5, 6, v3, u3)
+		OUTPUT4
+		STEP(8, 9, 0, 1, 2, 3, 4, 5, 6, 7, v0, u0)
+		STEP(9, 0, 1, 2, 3, 4, 5, 6, 7, 8, v1, u1)
+		STEP(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, v2, u2)
+		STEP(1, 2, 3, 4, 5, 6, 7, 8, 9, 0, v3, u3)
+		OUTPUT4
+		STEP(2, 3, 4, 5, 6, 7, 8, 9, 0, 1, v0, u0)
+		STEP(3, 4, 5, 6, 7, 8, 9, 0, 1, 2, v1, u1)
+		STEP(4, 5, 6, 7, 8, 9, 0, 1, 2, 3, v2, u2)
+		STEP(5, 6, 7, 8, 9, 0, 1, 2, 3, 4, v3, u3)
+		OUTPUT4
+		STEP(6, 7, 8, 9, 0, 1, 2, 3, 4, 5, v0, u0)
+		STEP(7, 8, 9, 0, 1, 2, 3, 4, 5, 6, v1, u1)
+		STEP(8, 9, 0, 1, 2, 3, 4, 5, 6, 7, v2, u2)
+		STEP(9, 0, 1, 2, 3, 4, 5, 6, 7, 8, v3, u3)
+		OUTPUT4
+	}
+	while (--iterationCount);
+
+	m_state[0] = s0;
+	m_state[1] = s1;
+	m_state[2] = s2;
+	m_state[3] = s3;
+	m_state[4] = s4;
+	m_state[5] = s5;
+	m_state[6] = s6;
+	m_state[7] = s7;
+	m_state[8] = s8;
+	m_state[9] = s9;
+	m_state[10] = reg1;
+	m_state[11] = reg2;
+	}
+}
+
+NAMESPACE_END
+
+#endif // #ifndef CRYPTOPP_GENERATE_X64_MASM
diff --git a/runtime/third_party/cryptopp/sosemanuk.h b/runtime/third_party/cryptopp/sosemanuk.h
new file mode 100644
index 0000000..fc1a1bb
--- /dev/null
+++ b/runtime/third_party/cryptopp/sosemanuk.h
@@ -0,0 +1,62 @@
+// sosemanuk.h - originally written and placed in the public domain by Wei Dai
+
+/// \file sosemanuk.h
+/// \brief Classes for Sosemanuk stream cipher
+/// \since Crypto++ 5.5
+
+#ifndef CRYPTOPP_SOSEMANUK_H
+#define CRYPTOPP_SOSEMANUK_H
+
+#include "strciphr.h"
+#include "secblock.h"
+
+// Clang 3.3 integrated assembler crash on Linux. Clang 3.4 due to compiler
+// error with .intel_syntax, http://llvm.org/bugs/show_bug.cgi?id=24232
+#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+# define CRYPTOPP_DISABLE_SOSEMANUK_ASM 1
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Sosemanuk stream cipher information
+/// \since Crypto++ 5.5
+struct SosemanukInfo : public VariableKeyLength<16, 1, 32, 1, SimpleKeyingInterface::UNIQUE_IV, 16>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "Sosemanuk";}
+};
+
+/// \brief Sosemanuk stream cipher implementation
+/// \since Crypto++ 5.5
+class SosemanukPolicy : public AdditiveCipherConcretePolicy<word32, 20>, public SosemanukInfo
+{
+protected:
+	std::string AlgorithmProvider() const;
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	void CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length);
+	bool CipherIsRandomAccess() const {return false;}
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+	unsigned int GetAlignment() const;
+	unsigned int GetOptimalBlockSize() const;
+#endif
+
+	FixedSizeSecBlock<word32, 25*4> m_key;
+	FixedSizeAlignedSecBlock<word32, 12> m_state;
+};
+
+/// \brief Sosemanuk stream cipher
+/// \details is a stream cipher developed by Come Berbain, Olivier Billet, Anne Canteaut, Nicolas Courtois,
+///   Henri Gilbert, Louis Goubin, Aline Gouget, Louis Granboulan, Cédric Lauradoux, Marine Minier, Thomas
+///   Pornin and Hervé Sibert. Sosemanuk is one of the final four Profile 1 (software) ciphers selected for
+///   the eSTREAM Portfolio.
+/// \sa <a href="http://www.cryptolounge.org/wiki/Sosemanuk">Sosemanuk</a>
+/// \since Crypto++ 5.5
+struct Sosemanuk : public SosemanukInfo, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<SosemanukPolicy, AdditiveCipherTemplate<> >, SosemanukInfo> Encryption;
+	typedef Encryption Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/speck.cpp b/runtime/third_party/cryptopp/speck.cpp
new file mode 100644
index 0000000..b67c960
--- /dev/null
+++ b/runtime/third_party/cryptopp/speck.cpp
@@ -0,0 +1,487 @@
+// speck.cpp - written and placed in the public domain by Jeffrey Walton
+
+#include "pch.h"
+#include "config.h"
+
+#include "speck.h"
+#include "misc.h"
+#include "cpu.h"
+
+// Uncomment for benchmarking C++ against SSE or NEON.
+// Do so in both speck.cpp and speck_simd.cpp.
+// #undef CRYPTOPP_SSSE3_AVAILABLE
+// #undef CRYPTOPP_SSE41_AVAILABLE
+// #undef CRYPTOPP_ARM_NEON_AVAILABLE
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::rotlConstant;
+using CryptoPP::rotrConstant;
+
+/// \brief Forward round transformation
+/// \tparam W word type
+/// \details TF83() is the forward round transformation using a=8 and b=3 rotations.
+///   The initial test implementation provided template parameters, but they were
+///   removed because SPECK32 using a=7 and b=2 was not on the road map. The
+///   additional template parameters also made calling SPECK_Encrypt and SPECK_Decrypt
+///   kind of messy.
+template <class W>
+inline void TF83(W& x, W& y, const W k)
+{
+    x = rotrConstant<8>(x);
+    x += y; x ^= k;
+    y = rotlConstant<3>(y);
+    y ^= x;
+}
+
+/// \brief Reverse round transformation
+/// \tparam W word type
+/// \details TR83() is the reverse round transformation using a=8 and b=3 rotations.
+///   The initial test implementation provided template parameters, but they were
+///   removed because SPECK32 using a=7 and b=2 was not on the road map. The
+///   additional template parameters also made calling SPECK_Encrypt and SPECK_Decrypt
+///   kind of messy.
+template <class W>
+inline void TR83(W& x, W& y, const W k)
+{
+    y ^= x;
+    y = rotrConstant<3>(y);
+    x ^= k; x -= y;
+    x = rotlConstant<8>(x);
+}
+
+/// \brief Forward transformation
+/// \tparam W word type
+/// \tparam R number of rounds
+/// \param c output array
+/// \param p input array
+/// \param k subkey array
+template <class W, unsigned int R>
+inline void SPECK_Encrypt(W c[2], const W p[2], const W k[R])
+{
+    c[0]=p[0]; c[1]=p[1];
+
+    // Don't unroll this loop. Things slow down.
+    for (int i = 0; i < static_cast<int>(R); ++i)
+        TF83(c[0], c[1], k[i]);
+}
+
+/// \brief Reverse transformation
+/// \tparam W word type
+/// \tparam R number of rounds
+/// \param p output array
+/// \param c input array
+/// \param k subkey array
+template <class W, unsigned int R>
+inline void SPECK_Decrypt(W p[2], const W c[2], const W k[R])
+{
+    p[0]=c[0]; p[1]=c[1];
+
+    // Don't unroll this loop. Things slow down.
+    for (int i = static_cast<int>(R-1); i >= 0; --i)
+        TR83(p[0], p[1], k[i]);
+}
+
+/// \brief Subkey generation function
+/// \details Used when the user key consists of 2 words
+/// \tparam W word type
+/// \tparam R number of rounds
+/// \param key empty subkey array
+/// \param k user key array
+template <class W, unsigned int R>
+inline void SPECK_ExpandKey_2W(W key[R], const W k[2])
+{
+    CRYPTOPP_ASSERT(R==32);
+    W i=0, B=k[0], A=k[1];
+
+    while (i<R-1)
+    {
+        key[i]=A; TF83(B, A, i);
+        i++;
+    }
+    key[R-1]=A;
+}
+
+/// \brief Subkey generation function
+/// \details Used when the user key consists of 3 words
+/// \tparam W word type
+/// \tparam R number of rounds
+/// \param key empty subkey array
+/// \param k user key array
+template <class W, unsigned int R>
+inline void SPECK_ExpandKey_3W(W key[R], const W k[3])
+{
+    CRYPTOPP_ASSERT(R==33 || R==26);
+    W i=0, C=k[0], B=k[1], A=k[2];
+
+    unsigned int blocks = R/2;
+    while (blocks--)
+    {
+        key[i+0]=A; TF83(B, A, i+0);
+        key[i+1]=A; TF83(C, A, i+1);
+        i+=2;
+    }
+
+    // The constexpr residue should allow the optimizer to remove unneeded statements
+    if(R%2 == 1)
+    {
+        key[R-1]=A;
+    }
+}
+
+/// \brief Subkey generation function
+/// \details Used when the user key consists of 4 words
+/// \tparam W word type
+/// \tparam R number of rounds
+/// \param key empty subkey array
+/// \param k user key array
+template <class W, unsigned int R>
+inline void SPECK_ExpandKey_4W(W key[R], const W k[4])
+{
+    CRYPTOPP_ASSERT(R==34 || R==27);
+    W i=0, D=k[0], C=k[1], B=k[2], A=k[3];
+
+    unsigned int blocks = R/3;
+    while (blocks--)
+    {
+        key[i+0]=A; TF83(B, A, i+0);
+        key[i+1]=A; TF83(C, A, i+1);
+        key[i+2]=A; TF83(D, A, i+2);
+        i+=3;
+    }
+
+    // The constexpr residue should allow the optimizer to remove unneeded statements
+    if(R%3 == 1)
+    {
+        key[R-1]=A;
+    }
+    else if(R%3 == 2)
+    {
+        key[R-2]=A; TF83(B, A, W(R-2));
+        key[R-1]=A;
+    }
+}
+
+ANONYMOUS_NAMESPACE_END
+
+///////////////////////////////////////////////////////////
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+extern size_t SPECK128_Enc_AdvancedProcessBlocks_NEON(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t SPECK128_Dec_AdvancedProcessBlocks_NEON(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+#if (CRYPTOPP_SSE41_AVAILABLE)
+extern size_t SPECK64_Enc_AdvancedProcessBlocks_SSE41(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t SPECK64_Dec_AdvancedProcessBlocks_SSE41(const word32* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+extern size_t SPECK128_Enc_AdvancedProcessBlocks_SSSE3(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t SPECK128_Dec_AdvancedProcessBlocks_SSSE3(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+extern size_t SPECK128_Enc_AdvancedProcessBlocks_ALTIVEC(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+
+extern size_t SPECK128_Dec_AdvancedProcessBlocks_ALTIVEC(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags);
+#endif
+
+std::string SPECK64::Base::AlgorithmProvider() const
+{
+    return "C++";
+}
+
+unsigned int SPECK64::Base::OptimalDataAlignment() const
+{
+    return GetAlignmentOf<word32>();
+}
+
+void SPECK64::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_ASSERT(keyLength == 12 || keyLength == 16);
+    CRYPTOPP_UNUSED(params);
+
+    // Building the key schedule table requires {3,4} words workspace.
+    // Encrypting and decrypting requires 4 words workspace.
+    m_kwords = keyLength/sizeof(word32);
+    m_wspace.New(4U);
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word32, LittleEndian> KeyBlock;
+    KeyBlock kblk(userKey);
+
+    switch (m_kwords)
+    {
+    case 3:
+        m_rkeys.New((m_rounds = 26));
+        kblk(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+        SPECK_ExpandKey_3W<word32, 26>(m_rkeys, m_wspace);
+        break;
+    case 4:
+        m_rkeys.New((m_rounds = 27));
+        kblk(m_wspace[3])(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+        SPECK_ExpandKey_4W<word32, 27>(m_rkeys, m_wspace);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+}
+
+void SPECK64::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word32, LittleEndian> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[1])(m_wspace[0]);
+
+    switch (m_rounds)
+    {
+    case 26:
+        SPECK_Encrypt<word32, 26>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 27:
+        SPECK_Encrypt<word32, 27>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef PutBlock<word32, LittleEndian> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2]);
+}
+
+void SPECK64::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word32, LittleEndian> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[1])(m_wspace[0]);
+
+    switch (m_rounds)
+    {
+    case 26:
+        SPECK_Decrypt<word32, 26>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 27:
+        SPECK_Decrypt<word32, 27>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef PutBlock<word32, LittleEndian> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2]);
+}
+
+///////////////////////////////////////////////////////////
+
+std::string SPECK128::Base::AlgorithmProvider() const
+{
+#if (CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS)
+# if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return "SSSE3";
+# endif
+# if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return "NEON";
+# endif
+# if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return "Altivec";
+# endif
+#endif
+    return "C++";
+}
+
+unsigned int SPECK128::Base::OptimalDataAlignment() const
+{
+#if (CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS)
+# if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return 16;  // load __m128i
+# endif
+# if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return 8;  // load uint64x2_t
+# endif
+# if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return 16;  // load uint64x2_p
+# endif
+#endif
+    return GetAlignmentOf<word64>();
+}
+
+void SPECK128::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    CRYPTOPP_ASSERT(keyLength == 16 || keyLength == 24 || keyLength == 32);
+    CRYPTOPP_UNUSED(params);
+
+    // Building the key schedule table requires {2,3,4} words workspace.
+    // Encrypting and decrypting requires 4 words workspace.
+    m_kwords = keyLength/sizeof(word64);
+    m_wspace.New(4U);
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word64, LittleEndian> KeyBlock;
+    KeyBlock kblk(userKey);
+
+    switch (m_kwords)
+    {
+    case 2:
+        m_rkeys.New((m_rounds = 32));
+        kblk(m_wspace[1])(m_wspace[0]);
+        SPECK_ExpandKey_2W<word64, 32>(m_rkeys, m_wspace);
+        break;
+    case 3:
+        m_rkeys.New((m_rounds = 33));
+        kblk(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+        SPECK_ExpandKey_3W<word64, 33>(m_rkeys, m_wspace);
+        break;
+    case 4:
+        m_rkeys.New((m_rounds = 34));
+        kblk(m_wspace[3])(m_wspace[2])(m_wspace[1])(m_wspace[0]);
+        SPECK_ExpandKey_4W<word64, 34>(m_rkeys, m_wspace);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+#if CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS
+
+    // Pre-splat the round keys for Altivec forward transformation
+#if CRYPTOPP_ALTIVEC_AVAILABLE
+    if (IsForwardTransformation() && HasAltivec())
+    {
+        AlignedSecBlock presplat(m_rkeys.size()*2);
+        for (size_t i=0, j=0; i<m_rkeys.size(); i++, j+=2)
+            presplat[j+0] = presplat[j+1] = m_rkeys[i];
+        m_rkeys.swap(presplat);
+    }
+#elif CRYPTOPP_SSSE3_AVAILABLE
+    if (IsForwardTransformation() && HasSSSE3())
+    {
+        AlignedSecBlock presplat(m_rkeys.size()*2);
+        for (size_t i=0, j=0; i<m_rkeys.size(); i++, j+=2)
+            presplat[j+0] = presplat[j+1] = m_rkeys[i];
+        m_rkeys.swap(presplat);
+    }
+#endif
+
+#endif  // CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS
+}
+
+void SPECK128::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word64, LittleEndian> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[1])(m_wspace[0]);
+
+    switch (m_rounds)
+    {
+    case 32:
+        SPECK_Encrypt<word64, 32>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 33:
+        SPECK_Encrypt<word64, 33>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 34:
+        SPECK_Encrypt<word64, 34>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef PutBlock<word64, LittleEndian> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2]);
+}
+
+void SPECK128::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    // Do the endian gyrations from the paper and align pointers
+    typedef GetBlock<word64, LittleEndian> InBlock;
+    InBlock iblk(inBlock); iblk(m_wspace[1])(m_wspace[0]);
+
+    switch (m_rounds)
+    {
+    case 32:
+        SPECK_Decrypt<word64, 32>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 33:
+        SPECK_Decrypt<word64, 33>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    case 34:
+        SPECK_Decrypt<word64, 34>(m_wspace+2, m_wspace+0, m_rkeys);
+        break;
+    default:
+        CRYPTOPP_ASSERT(0);
+    }
+
+    // Do the endian gyrations from the paper and align pointers
+    typedef PutBlock<word64, LittleEndian> OutBlock;
+    OutBlock oblk(xorBlock, outBlock); oblk(m_wspace[3])(m_wspace[2]);
+}
+
+#if (CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS)
+size_t SPECK128::Enc::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks,
+        byte *outBlocks, size_t length, word32 flags) const
+{
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return SPECK128_Enc_AdvancedProcessBlocks_SSSE3(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return SPECK128_Enc_AdvancedProcessBlocks_NEON(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return SPECK128_Enc_AdvancedProcessBlocks_ALTIVEC(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+    return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t SPECK128::Dec::AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks,
+        byte *outBlocks, size_t length, word32 flags) const
+{
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+    if (HasSSSE3())
+        return SPECK128_Dec_AdvancedProcessBlocks_SSSE3(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+    if (HasNEON())
+        return SPECK128_Dec_AdvancedProcessBlocks_NEON(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+    if (HasAltivec())
+        return SPECK128_Dec_AdvancedProcessBlocks_ALTIVEC(m_rkeys, (size_t)m_rounds,
+            inBlocks, xorBlocks, outBlocks, length, flags);
+#endif
+    return BlockTransformation::AdvancedProcessBlocks(inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/speck.h b/runtime/third_party/cryptopp/speck.h
new file mode 100644
index 0000000..5ab3ece
--- /dev/null
+++ b/runtime/third_party/cryptopp/speck.h
@@ -0,0 +1,206 @@
+// speck.h - written and placed in the public domain by Jeffrey Walton
+
+/// \file speck.h
+/// \brief Classes for the Speck block cipher
+/// \details Speck is a block cipher designed by Ray Beaulieu, Douglas Shors, Jason Smith,
+///   Stefan Treatman-Clark, Bryan Weeks and Louis Wingers.
+/// \sa <A HREF="http://eprint.iacr.org/2013/404">The SIMON and SPECK Families of
+///   Lightweight Block Ciphers</A>, <A HREF="http://iadgov.github.io/simon-speck/">
+///   The Simon and Speck GitHub</A> and <A HREF="https://www.cryptopp.com/wiki/SPECK">
+///   SPECK</A> on the Crypto++ wiki.
+/// \since Crypto++ 6.0
+
+#ifndef CRYPTOPP_SPECK_H
+#define CRYPTOPP_SPECK_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+
+#if CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86 || \
+    CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8 || \
+    CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64
+# ifndef CRYPTOPP_DISABLE_SPECK_SIMD
+#  define CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS 1
+# endif
+#endif
+
+// Yet another SunStudio/SunCC workaround. Failed self tests
+// in SSE code paths on i386 for SunStudio 12.3 and below.
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x5120)
+# undef CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief SPECK block cipher information
+/// \tparam L block size of the cipher, in bytes
+/// \tparam D default key length, in bytes
+/// \tparam N minimum key length, in bytes
+/// \tparam M maximum key length, in bytes
+/// \since Crypto++ 6.0
+template <unsigned int L, unsigned int D, unsigned int N, unsigned int M>
+struct SPECK_Info : public FixedBlockSize<L>, VariableKeyLength<D, N, M>
+{
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///   member function.
+    static const std::string StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize(Keylength)
+        return "SPECK-" + IntToString(L*8);
+    }
+};
+
+/// \brief SPECK block cipher base class
+/// \tparam W the word type
+/// \details User code should use SPECK64 or SPECK128
+/// \sa SPECK64, SPECK128, <a href="http://www.cryptopp.com/wiki/SPECK">SPECK</a>
+/// \since Crypto++ 6.0
+template <class W>
+struct SPECK_Base
+{
+    virtual ~SPECK_Base() {}
+    SPECK_Base() : m_kwords(0), m_rounds(0) {}
+
+    typedef SecBlock<W, AllocatorWithCleanup<W, true> > AlignedSecBlock;
+    mutable AlignedSecBlock m_wspace;  // workspace
+    AlignedSecBlock         m_rkeys;   // round keys
+    unsigned int            m_kwords;  // number of key words
+    unsigned int            m_rounds;  // number of rounds
+};
+
+/// \brief SPECK 64-bit block cipher
+/// \details Speck is a block cipher designed by Ray Beaulieu, Douglas Shors, Jason Smith,
+///   Stefan Treatman-Clark, Bryan Weeks and Louis Wingers.
+/// \details SPECK64 provides 64-bit block size. The valid key sizes are 96-bit and 128-bit.
+/// \sa SPECK64, SPECK128,  <A HREF="http://eprint.iacr.org/2013/404">The SIMON and SPECK
+///   Families of Lightweight Block Ciphers</A>, <A HREF="http://iadgov.github.io/simon-speck/">
+///   The Simon and Speck GitHub</A>, <a href="http://www.cryptopp.com/wiki/SPECK">SPECK</a> on the
+///   Crypto++ wiki
+/// \since Crypto++ 6.0
+class CRYPTOPP_NO_VTABLE SPECK64 : public SPECK_Info<8, 12, 12, 16>, public BlockCipherDocumentation
+{
+public:
+    /// \brief SPECK64 block cipher base implementation
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Base : protected SPECK_Base<word32>, public BlockCipherImpl<SPECK_Info<8, 12, 12, 16> >
+    {
+    public:
+        /// \brief The algorithm name
+        /// \return the algorithm name
+        /// \details AlgorithmName returns the algorithm's name as a
+        ///   member function.
+        std::string AlgorithmName() const {
+            return StaticAlgorithmName() + (m_kwords == 0 ? "" :
+                "(" + IntToString(m_kwords*sizeof(word32)*8) + ")");
+        }
+
+        std::string AlgorithmProvider() const;
+
+        /// \brief Provides input and output data alignment for optimal performance.
+        /// \return the input data alignment that provides optimal performance
+        /// \sa GetAlignment() and OptimalBlockSize()
+        unsigned int OptimalDataAlignment() const;
+
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+    };
+
+    /// \brief SPECK64 encryption transformation
+    /// \details Enc provides the encryption transformation.
+    ///  All key sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    /// \brief SPECK64 decryption transformation
+    /// \details Dec provides the decryption transformation.
+    ///  All key sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+/// \brief SPECK 128-bit block cipher
+/// \details Speck is a block cipher designed by Ray Beaulieu, Douglas Shors, Jason Smith,
+///   Stefan Treatman-Clark, Bryan Weeks and Louis Wingers.
+/// \details SPECK128 provides 128-bit block size. The valid key sizes are 128-bit, 192-bit and 256-bit.
+/// \sa SPECK64, SPECK128,  <A HREF="http://eprint.iacr.org/2013/404">The SIMON and SPECK
+///   Families of Lightweight Block Ciphers</A>, <A HREF="http://iadgov.github.io/simon-speck/">
+///   The Simon and Speck GitHub</A>, <a href="http://www.cryptopp.com/wiki/SPECK">SPECK</a> on the
+///   Crypto++ wiki
+/// \since Crypto++ 6.0
+class CRYPTOPP_NO_VTABLE SPECK128 : public SPECK_Info<16, 16, 16, 32>, public BlockCipherDocumentation
+{
+public:
+    /// \brief SPECK128 block cipher base implementation
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Base : protected SPECK_Base<word64>, public BlockCipherImpl<SPECK_Info<16, 16, 16, 32> >
+    {
+    public:
+        /// \brief The algorithm name
+        /// \return the algorithm name
+        /// \details AlgorithmName returns the algorithm's name as a
+        ///   member function.
+        std::string AlgorithmName() const {
+            return StaticAlgorithmName() + (m_kwords == 0 ? "" :
+                "(" + IntToString(m_kwords*sizeof(word64)*8) + ")");
+        }
+
+        std::string AlgorithmProvider() const;
+
+        /// \brief Provides input and output data alignment for optimal performance.
+        /// \return the input data alignment that provides optimal performance
+        /// \sa GetAlignment() and OptimalBlockSize()
+        unsigned int OptimalDataAlignment() const;
+
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+    };
+
+    /// \brief SPECK128 encryption transformation
+    /// \details Enc provides the encryption transformation.
+    ///  All key sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+#if CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    /// \brief SPECK128 decryption transformation
+    /// \details Dec provides the decryption transformation.
+    ///  All key sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    public:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+#if CRYPTOPP_SPECK128_ADVANCED_PROCESS_BLOCKS
+        size_t AdvancedProcessBlocks(const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags) const;
+#endif
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_SPECK_H
diff --git a/runtime/third_party/cryptopp/speck128_simd.cpp b/runtime/third_party/cryptopp/speck128_simd.cpp
new file mode 100644
index 0000000..37d664bd
--- /dev/null
+++ b/runtime/third_party/cryptopp/speck128_simd.cpp
@@ -0,0 +1,754 @@
+// speck128_simd.cpp - written and placed in the public domain by Jeffrey Walton
+//
+//    This source file uses intrinsics and built-ins to gain access to
+//    SSSE3, ARM NEON and ARMv8a, and Altivec instructions. A separate
+//    source file is needed because additional CXXFLAGS are required to enable
+//    the appropriate instructions sets in some build configurations.
+
+#include "pch.h"
+#include "config.h"
+
+#include "speck.h"
+#include "misc.h"
+
+// Uncomment for benchmarking C++ against SSE or NEON.
+// Do so in both speck.cpp and speck_simd.cpp.
+// #undef CRYPTOPP_SSSE3_AVAILABLE
+// #undef CRYPTOPP_ARM_NEON_AVAILABLE
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+# include "adv_simd.h"
+# include <pmmintrin.h>
+# include <tmmintrin.h>
+#endif
+
+#if defined(__XOP__)
+# if defined(CRYPTOPP_GCC_COMPATIBLE)
+#  include <x86intrin.h>
+# endif
+# include <ammintrin.h>
+#endif  // XOP
+
+#if (CRYPTOPP_ARM_NEON_HEADER)
+# include "adv_simd.h"
+# include <arm_neon.h>
+#endif
+
+#if (CRYPTOPP_ARM_ACLE_HEADER)
+# include <stdint.h>
+# include <arm_acle.h>
+#endif
+
+#if defined(_M_ARM64)
+# include "adv_simd.h"
+#endif
+
+#if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+# include "adv_simd.h"
+# include "ppc_simd.h"
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char SPECK128_SIMD_FNAME[] = __FILE__;
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+using CryptoPP::word32;
+using CryptoPP::word64;
+
+// *************************** ARM NEON ************************** //
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+
+// Missing from Microsoft's ARM A-32 implementation
+#if defined(CRYPTOPP_MSC_VERSION) && !defined(_M_ARM64)
+inline uint64x2_t vld1q_dup_u64(const uint64_t* ptr)
+{
+    return vmovq_n_u64(*ptr);
+}
+#endif
+
+template <class T>
+inline T UnpackHigh64(const T& a, const T& b)
+{
+    const uint64x1_t x(vget_high_u64((uint64x2_t)a));
+    const uint64x1_t y(vget_high_u64((uint64x2_t)b));
+    return (T)vcombine_u64(x, y);
+}
+
+template <class T>
+inline T UnpackLow64(const T& a, const T& b)
+{
+    const uint64x1_t x(vget_low_u64((uint64x2_t)a));
+    const uint64x1_t y(vget_low_u64((uint64x2_t)b));
+    return (T)vcombine_u64(x, y);
+}
+
+template <unsigned int R>
+inline uint64x2_t RotateLeft64(const uint64x2_t& val)
+{
+    const uint64x2_t a(vshlq_n_u64(val, R));
+    const uint64x2_t b(vshrq_n_u64(val, 64 - R));
+    return vorrq_u64(a, b);
+}
+
+template <unsigned int R>
+inline uint64x2_t RotateRight64(const uint64x2_t& val)
+{
+    const uint64x2_t a(vshlq_n_u64(val, 64 - R));
+    const uint64x2_t b(vshrq_n_u64(val, R));
+    return vorrq_u64(a, b);
+}
+
+#if defined(__aarch32__) || defined(__aarch64__)
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+inline uint64x2_t RotateLeft64<8>(const uint64x2_t& val)
+{
+    const uint8_t maskb[16] = { 7,0,1,2, 3,4,5,6, 15,8,9,10, 11,12,13,14 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+
+    return vreinterpretq_u64_u8(
+        vqtbl1q_u8(vreinterpretq_u8_u64(val), mask));
+}
+
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+inline uint64x2_t RotateRight64<8>(const uint64x2_t& val)
+{
+    const uint8_t maskb[16] = { 1,2,3,4, 5,6,7,0, 9,10,11,12, 13,14,15,8 };
+    const uint8x16_t mask = vld1q_u8(maskb);
+
+    return vreinterpretq_u64_u8(
+        vqtbl1q_u8(vreinterpretq_u8_u64(val), mask));
+}
+#endif
+
+inline void SPECK128_Enc_Block(uint64x2_t &block0, uint64x2_t &block1,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    uint64x2_t x1 = UnpackHigh64(block0, block1);
+    uint64x2_t y1 = UnpackLow64(block0, block1);
+
+    for (size_t i=0; i < static_cast<size_t>(rounds); ++i)
+    {
+        const uint64x2_t rk = vld1q_dup_u64(subkeys+i);
+
+        x1 = RotateRight64<8>(x1);
+        x1 = vaddq_u64(x1, y1);
+        x1 = veorq_u64(x1, rk);
+        y1 = RotateLeft64<3>(y1);
+        y1 = veorq_u64(y1, x1);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = UnpackLow64(y1, x1);
+    block1 = UnpackHigh64(y1, x1);
+}
+
+inline void SPECK128_Enc_6_Blocks(uint64x2_t &block0, uint64x2_t &block1,
+    uint64x2_t &block2, uint64x2_t &block3, uint64x2_t &block4, uint64x2_t &block5,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    uint64x2_t x1 = UnpackHigh64(block0, block1);
+    uint64x2_t y1 = UnpackLow64(block0, block1);
+    uint64x2_t x2 = UnpackHigh64(block2, block3);
+    uint64x2_t y2 = UnpackLow64(block2, block3);
+    uint64x2_t x3 = UnpackHigh64(block4, block5);
+    uint64x2_t y3 = UnpackLow64(block4, block5);
+
+    for (size_t i=0; i < static_cast<size_t>(rounds); ++i)
+    {
+        const uint64x2_t rk = vld1q_dup_u64(subkeys+i);
+
+        x1 = RotateRight64<8>(x1);
+        x2 = RotateRight64<8>(x2);
+        x3 = RotateRight64<8>(x3);
+        x1 = vaddq_u64(x1, y1);
+        x2 = vaddq_u64(x2, y2);
+        x3 = vaddq_u64(x3, y3);
+        x1 = veorq_u64(x1, rk);
+        x2 = veorq_u64(x2, rk);
+        x3 = veorq_u64(x3, rk);
+        y1 = RotateLeft64<3>(y1);
+        y2 = RotateLeft64<3>(y2);
+        y3 = RotateLeft64<3>(y3);
+        y1 = veorq_u64(y1, x1);
+        y2 = veorq_u64(y2, x2);
+        y3 = veorq_u64(y3, x3);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = UnpackLow64(y1, x1);
+    block1 = UnpackHigh64(y1, x1);
+    block2 = UnpackLow64(y2, x2);
+    block3 = UnpackHigh64(y2, x2);
+    block4 = UnpackLow64(y3, x3);
+    block5 = UnpackHigh64(y3, x3);
+}
+
+inline void SPECK128_Dec_Block(uint64x2_t &block0, uint64x2_t &block1,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    uint64x2_t x1 = UnpackHigh64(block0, block1);
+    uint64x2_t y1 = UnpackLow64(block0, block1);
+
+    for (int i = static_cast<int>(rounds-1); i >= 0; --i)
+    {
+        const uint64x2_t rk = vld1q_dup_u64(subkeys+i);
+
+        y1 = veorq_u64(y1, x1);
+        y1 = RotateRight64<3>(y1);
+        x1 = veorq_u64(x1, rk);
+        x1 = vsubq_u64(x1, y1);
+        x1 = RotateLeft64<8>(x1);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = UnpackLow64(y1, x1);
+    block1 = UnpackHigh64(y1, x1);
+}
+
+inline void SPECK128_Dec_6_Blocks(uint64x2_t &block0, uint64x2_t &block1,
+    uint64x2_t &block2, uint64x2_t &block3, uint64x2_t &block4, uint64x2_t &block5,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    uint64x2_t x1 = UnpackHigh64(block0, block1);
+    uint64x2_t y1 = UnpackLow64(block0, block1);
+    uint64x2_t x2 = UnpackHigh64(block2, block3);
+    uint64x2_t y2 = UnpackLow64(block2, block3);
+    uint64x2_t x3 = UnpackHigh64(block4, block5);
+    uint64x2_t y3 = UnpackLow64(block4, block5);
+
+    for (int i = static_cast<int>(rounds-1); i >= 0; --i)
+    {
+        const uint64x2_t rk = vld1q_dup_u64(subkeys+i);
+
+        y1 = veorq_u64(y1, x1);
+        y2 = veorq_u64(y2, x2);
+        y3 = veorq_u64(y3, x3);
+        y1 = RotateRight64<3>(y1);
+        y2 = RotateRight64<3>(y2);
+        y3 = RotateRight64<3>(y3);
+        x1 = veorq_u64(x1, rk);
+        x2 = veorq_u64(x2, rk);
+        x3 = veorq_u64(x3, rk);
+        x1 = vsubq_u64(x1, y1);
+        x2 = vsubq_u64(x2, y2);
+        x3 = vsubq_u64(x3, y3);
+        x1 = RotateLeft64<8>(x1);
+        x2 = RotateLeft64<8>(x2);
+        x3 = RotateLeft64<8>(x3);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = UnpackLow64(y1, x1);
+    block1 = UnpackHigh64(y1, x1);
+    block2 = UnpackLow64(y2, x2);
+    block3 = UnpackHigh64(y2, x2);
+    block4 = UnpackLow64(y3, x3);
+    block5 = UnpackHigh64(y3, x3);
+}
+
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+// ***************************** IA-32 ***************************** //
+
+#if defined(CRYPTOPP_SSSE3_AVAILABLE)
+
+// GCC double casts, https://www.spinics.net/lists/gcchelp/msg47735.html
+#ifndef DOUBLE_CAST
+# define DOUBLE_CAST(x) ((double *)(void *)(x))
+#endif
+#ifndef CONST_DOUBLE_CAST
+# define CONST_DOUBLE_CAST(x) ((const double *)(const void *)(x))
+#endif
+
+template <unsigned int R>
+inline __m128i RotateLeft64(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi64(val, R);
+#else
+    return _mm_or_si128(
+        _mm_slli_epi64(val, R), _mm_srli_epi64(val, 64-R));
+#endif
+}
+
+template <unsigned int R>
+inline __m128i RotateRight64(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi64(val, 64-R);
+#else
+    return _mm_or_si128(
+        _mm_slli_epi64(val, 64-R), _mm_srli_epi64(val, R));
+#endif
+}
+
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+__m128i RotateLeft64<8>(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi64(val, 8);
+#else
+    const __m128i mask = _mm_set_epi8(14,13,12,11, 10,9,8,15, 6,5,4,3, 2,1,0,7);
+    return _mm_shuffle_epi8(val, mask);
+#endif
+}
+
+// Faster than two Shifts and an Or. Thanks to Louis Wingers and Bryan Weeks.
+template <>
+__m128i RotateRight64<8>(const __m128i& val)
+{
+#if defined(__XOP__)
+    return _mm_roti_epi64(val, 64-8);
+#else
+    const __m128i mask = _mm_set_epi8(8,15,14,13, 12,11,10,9, 0,7,6,5, 4,3,2,1);
+    return _mm_shuffle_epi8(val, mask);
+#endif
+}
+
+inline void SPECK128_Enc_Block(__m128i &block0, __m128i &block1,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    __m128i x1 = _mm_unpackhi_epi64(block0, block1);
+    __m128i y1 = _mm_unpacklo_epi64(block0, block1);
+
+    for (size_t i=0; i < static_cast<size_t>(rounds); ++i)
+    {
+        // Round keys are pre-splated in forward direction
+        const __m128i rk = _mm_load_si128(CONST_M128_CAST(subkeys+i*2));
+
+        x1 = RotateRight64<8>(x1);
+        x1 = _mm_add_epi64(x1, y1);
+        x1 = _mm_xor_si128(x1, rk);
+        y1 = RotateLeft64<3>(y1);
+        y1 = _mm_xor_si128(y1, x1);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = _mm_unpacklo_epi64(y1, x1);
+    block1 = _mm_unpackhi_epi64(y1, x1);
+}
+
+inline void SPECK128_Enc_6_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, __m128i &block4, __m128i &block5,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    __m128i x1 = _mm_unpackhi_epi64(block0, block1);
+    __m128i y1 = _mm_unpacklo_epi64(block0, block1);
+    __m128i x2 = _mm_unpackhi_epi64(block2, block3);
+    __m128i y2 = _mm_unpacklo_epi64(block2, block3);
+    __m128i x3 = _mm_unpackhi_epi64(block4, block5);
+    __m128i y3 = _mm_unpacklo_epi64(block4, block5);
+
+    for (size_t i=0; i < static_cast<size_t>(rounds); ++i)
+    {
+        // Round keys are pre-splated in forward direction
+        const __m128i rk = _mm_load_si128(CONST_M128_CAST(subkeys+i*2));
+
+        x1 = RotateRight64<8>(x1);
+        x2 = RotateRight64<8>(x2);
+        x3 = RotateRight64<8>(x3);
+        x1 = _mm_add_epi64(x1, y1);
+        x2 = _mm_add_epi64(x2, y2);
+        x3 = _mm_add_epi64(x3, y3);
+        x1 = _mm_xor_si128(x1, rk);
+        x2 = _mm_xor_si128(x2, rk);
+        x3 = _mm_xor_si128(x3, rk);
+        y1 = RotateLeft64<3>(y1);
+        y2 = RotateLeft64<3>(y2);
+        y3 = RotateLeft64<3>(y3);
+        y1 = _mm_xor_si128(y1, x1);
+        y2 = _mm_xor_si128(y2, x2);
+        y3 = _mm_xor_si128(y3, x3);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = _mm_unpacklo_epi64(y1, x1);
+    block1 = _mm_unpackhi_epi64(y1, x1);
+    block2 = _mm_unpacklo_epi64(y2, x2);
+    block3 = _mm_unpackhi_epi64(y2, x2);
+    block4 = _mm_unpacklo_epi64(y3, x3);
+    block5 = _mm_unpackhi_epi64(y3, x3);
+}
+
+inline void SPECK128_Dec_Block(__m128i &block0, __m128i &block1,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    __m128i x1 = _mm_unpackhi_epi64(block0, block1);
+    __m128i y1 = _mm_unpacklo_epi64(block0, block1);
+
+    for (int i = static_cast<int>(rounds-1); i >= 0; --i)
+    {
+        const __m128i rk = _mm_castpd_si128(
+            _mm_loaddup_pd(CONST_DOUBLE_CAST(subkeys+i)));
+
+        y1 = _mm_xor_si128(y1, x1);
+        y1 = RotateRight64<3>(y1);
+        x1 = _mm_xor_si128(x1, rk);
+        x1 = _mm_sub_epi64(x1, y1);
+        x1 = RotateLeft64<8>(x1);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = _mm_unpacklo_epi64(y1, x1);
+    block1 = _mm_unpackhi_epi64(y1, x1);
+}
+
+inline void SPECK128_Dec_6_Blocks(__m128i &block0, __m128i &block1,
+    __m128i &block2, __m128i &block3, __m128i &block4, __m128i &block5,
+    const word64 *subkeys, unsigned int rounds)
+{
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    __m128i x1 = _mm_unpackhi_epi64(block0, block1);
+    __m128i y1 = _mm_unpacklo_epi64(block0, block1);
+    __m128i x2 = _mm_unpackhi_epi64(block2, block3);
+    __m128i y2 = _mm_unpacklo_epi64(block2, block3);
+    __m128i x3 = _mm_unpackhi_epi64(block4, block5);
+    __m128i y3 = _mm_unpacklo_epi64(block4, block5);
+
+    for (int i = static_cast<int>(rounds-1); i >= 0; --i)
+    {
+        const __m128i rk = _mm_castpd_si128(
+            _mm_loaddup_pd(CONST_DOUBLE_CAST(subkeys+i)));
+
+        y1 = _mm_xor_si128(y1, x1);
+        y2 = _mm_xor_si128(y2, x2);
+        y3 = _mm_xor_si128(y3, x3);
+        y1 = RotateRight64<3>(y1);
+        y2 = RotateRight64<3>(y2);
+        y3 = RotateRight64<3>(y3);
+        x1 = _mm_xor_si128(x1, rk);
+        x2 = _mm_xor_si128(x2, rk);
+        x3 = _mm_xor_si128(x3, rk);
+        x1 = _mm_sub_epi64(x1, y1);
+        x2 = _mm_sub_epi64(x2, y2);
+        x3 = _mm_sub_epi64(x3, y3);
+        x1 = RotateLeft64<8>(x1);
+        x2 = RotateLeft64<8>(x2);
+        x3 = RotateLeft64<8>(x3);
+    }
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = _mm_unpacklo_epi64(y1, x1);
+    block1 = _mm_unpackhi_epi64(y1, x1);
+    block2 = _mm_unpacklo_epi64(y2, x2);
+    block3 = _mm_unpackhi_epi64(y2, x2);
+    block4 = _mm_unpacklo_epi64(y3, x3);
+    block5 = _mm_unpackhi_epi64(y3, x3);
+}
+
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
+
+// ***************************** Altivec ***************************** //
+
+#if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+
+// Altivec uses native 64-bit types on 64-bit environments, or 32-bit types
+// in 32-bit environments. Speck128 will use the appropriate type for the
+// environment. Functions like VecAdd64 have two overloads, one for each
+// environment. The 32-bit overload treats uint32x4_p like a 64-bit type,
+// and does things like perform a add with carry or subtract with borrow.
+
+// Speck128 on Power8 performed as expected because of 64-bit environment.
+// Performance sucked on old PowerPC machines because of 32-bit environments.
+// At Crypto++ 8.3 we added an implementation that operated on 32-bit words.
+// Native 64-bit Speck128 performance dropped from about 4.1 to 6.3 cpb, but
+// 32-bit Speck128 improved from 66.5 cpb to 10.4 cpb. Overall it was a
+// good win even though we lost some performance in 64-bit environments.
+
+using CryptoPP::uint8x16_p;
+using CryptoPP::uint32x4_p;
+#if defined(_ARCH_PWR8)
+using CryptoPP::uint64x2_p;
+#endif
+
+using CryptoPP::VecAdd64;
+using CryptoPP::VecSub64;
+using CryptoPP::VecAnd64;
+using CryptoPP::VecOr64;
+using CryptoPP::VecXor64;
+using CryptoPP::VecSplatWord64;
+using CryptoPP::VecRotateLeft64;
+using CryptoPP::VecRotateRight64;
+using CryptoPP::VecLoad;
+using CryptoPP::VecLoadAligned;
+using CryptoPP::VecPermute;
+
+#if defined(_ARCH_PWR8)
+#define speck128_t uint64x2_p
+#else
+#define speck128_t uint32x4_p
+#endif
+
+void SPECK128_Enc_Block(uint32x4_p &block, const word64 *subkeys, unsigned int rounds)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m1 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m2 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m1 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m2 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    speck128_t x1 = (speck128_t)VecPermute(block, block, m1);
+    speck128_t y1 = (speck128_t)VecPermute(block, block, m2);
+
+    for (size_t i=0; i < static_cast<size_t>(rounds); ++i)
+    {
+        // Round keys are pre-splated in forward direction
+        const word32* ptr = reinterpret_cast<const word32*>(subkeys+i*2);
+        const speck128_t rk = (speck128_t)VecLoadAligned(ptr);
+
+        x1 = (speck128_t)VecRotateRight64<8>(x1);
+        x1 = (speck128_t)VecAdd64(x1, y1);
+        x1 = (speck128_t)VecXor64(x1, rk);
+
+        y1 = (speck128_t)VecRotateLeft64<3>(y1);
+        y1 = (speck128_t)VecXor64(y1, x1);
+    }
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m3 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    //const uint8x16_p m4 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m3 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    //const uint8x16_p m4 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block = (uint32x4_p)VecPermute(x1, y1, m3);
+}
+
+void SPECK128_Dec_Block(uint32x4_p &block, const word64 *subkeys, unsigned int rounds)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m1 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m2 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m1 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m2 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    speck128_t x1 = (speck128_t)VecPermute(block, block, m1);
+    speck128_t y1 = (speck128_t)VecPermute(block, block, m2);
+
+    for (int i = static_cast<int>(rounds-1); i >= 0; --i)
+    {
+        const speck128_t rk = (speck128_t)VecSplatWord64(subkeys[i]);
+
+        y1 = (speck128_t)VecXor64(y1, x1);
+        y1 = (speck128_t)VecRotateRight64<3>(y1);
+        x1 = (speck128_t)VecXor64(x1, rk);
+        x1 = (speck128_t)VecSub64(x1, y1);
+        x1 = (speck128_t)VecRotateLeft64<8>(x1);
+    }
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m3 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    //const uint8x16_p m4 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m3 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    //const uint8x16_p m4 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block = (uint32x4_p)VecPermute(x1, y1, m3);
+}
+
+void SPECK128_Enc_6_Blocks(uint32x4_p &block0, uint32x4_p &block1,
+            uint32x4_p &block2, uint32x4_p &block3, uint32x4_p &block4,
+            uint32x4_p &block5, const word64 *subkeys, unsigned int rounds)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m1 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m2 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m1 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m2 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    speck128_t x1 = (speck128_t)VecPermute(block0, block1, m1);
+    speck128_t y1 = (speck128_t)VecPermute(block0, block1, m2);
+    speck128_t x2 = (speck128_t)VecPermute(block2, block3, m1);
+    speck128_t y2 = (speck128_t)VecPermute(block2, block3, m2);
+    speck128_t x3 = (speck128_t)VecPermute(block4, block5, m1);
+    speck128_t y3 = (speck128_t)VecPermute(block4, block5, m2);
+
+    for (size_t i=0; i < static_cast<size_t>(rounds); ++i)
+    {
+        // Round keys are pre-splated in forward direction
+        const word32* ptr = reinterpret_cast<const word32*>(subkeys+i*2);
+        const speck128_t rk = (speck128_t)VecLoadAligned(ptr);
+
+        x1 = (speck128_t)VecRotateRight64<8>(x1);
+        x2 = (speck128_t)VecRotateRight64<8>(x2);
+        x3 = (speck128_t)VecRotateRight64<8>(x3);
+        x1 = (speck128_t)VecAdd64(x1, y1);
+        x2 = (speck128_t)VecAdd64(x2, y2);
+        x3 = (speck128_t)VecAdd64(x3, y3);
+        x1 = (speck128_t)VecXor64(x1, rk);
+        x2 = (speck128_t)VecXor64(x2, rk);
+        x3 = (speck128_t)VecXor64(x3, rk);
+
+        y1 = (speck128_t)VecRotateLeft64<3>(y1);
+        y2 = (speck128_t)VecRotateLeft64<3>(y2);
+        y3 = (speck128_t)VecRotateLeft64<3>(y3);
+        y1 = (speck128_t)VecXor64(y1, x1);
+        y2 = (speck128_t)VecXor64(y2, x2);
+        y3 = (speck128_t)VecXor64(y3, x3);
+    }
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m3 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m4 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m3 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m4 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = (uint32x4_p)VecPermute(x1, y1, m3);
+    block1 = (uint32x4_p)VecPermute(x1, y1, m4);
+    block2 = (uint32x4_p)VecPermute(x2, y2, m3);
+    block3 = (uint32x4_p)VecPermute(x2, y2, m4);
+    block4 = (uint32x4_p)VecPermute(x3, y3, m3);
+    block5 = (uint32x4_p)VecPermute(x3, y3, m4);
+}
+
+void SPECK128_Dec_6_Blocks(uint32x4_p &block0, uint32x4_p &block1,
+            uint32x4_p &block2, uint32x4_p &block3, uint32x4_p &block4,
+            uint32x4_p &block5, const word64 *subkeys, unsigned int rounds)
+{
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m1 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m2 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m1 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m2 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 A2][B1 B2] ... => [A1 B1][A2 B2] ...
+    speck128_t x1 = (speck128_t)VecPermute(block0, block1, m1);
+    speck128_t y1 = (speck128_t)VecPermute(block0, block1, m2);
+    speck128_t x2 = (speck128_t)VecPermute(block2, block3, m1);
+    speck128_t y2 = (speck128_t)VecPermute(block2, block3, m2);
+    speck128_t x3 = (speck128_t)VecPermute(block4, block5, m1);
+    speck128_t y3 = (speck128_t)VecPermute(block4, block5, m2);
+
+    for (int i = static_cast<int>(rounds-1); i >= 0; --i)
+    {
+        const speck128_t rk = (speck128_t)VecSplatWord64(subkeys[i]);
+
+        y1 = (speck128_t)VecXor64(y1, x1);
+        y2 = (speck128_t)VecXor64(y2, x2);
+        y3 = (speck128_t)VecXor64(y3, x3);
+        y1 = (speck128_t)VecRotateRight64<3>(y1);
+        y2 = (speck128_t)VecRotateRight64<3>(y2);
+        y3 = (speck128_t)VecRotateRight64<3>(y3);
+
+        x1 = (speck128_t)VecXor64(x1, rk);
+        x2 = (speck128_t)VecXor64(x2, rk);
+        x3 = (speck128_t)VecXor64(x3, rk);
+        x1 = (speck128_t)VecSub64(x1, y1);
+        x2 = (speck128_t)VecSub64(x2, y2);
+        x3 = (speck128_t)VecSub64(x3, y3);
+        x1 = (speck128_t)VecRotateLeft64<8>(x1);
+        x2 = (speck128_t)VecRotateLeft64<8>(x2);
+        x3 = (speck128_t)VecRotateLeft64<8>(x3);
+    }
+
+#if (CRYPTOPP_BIG_ENDIAN)
+    const uint8x16_p m3 = {31,30,29,28,27,26,25,24, 15,14,13,12,11,10,9,8};
+    const uint8x16_p m4 = {23,22,21,20,19,18,17,16, 7,6,5,4,3,2,1,0};
+#else
+    const uint8x16_p m3 = {7,6,5,4,3,2,1,0, 23,22,21,20,19,18,17,16};
+    const uint8x16_p m4 = {15,14,13,12,11,10,9,8, 31,30,29,28,27,26,25,24};
+#endif
+
+    // [A1 B1][A2 B2] ... => [A1 A2][B1 B2] ...
+    block0 = (uint32x4_p)VecPermute(x1, y1, m3);
+    block1 = (uint32x4_p)VecPermute(x1, y1, m4);
+    block2 = (uint32x4_p)VecPermute(x2, y2, m3);
+    block3 = (uint32x4_p)VecPermute(x2, y2, m4);
+    block4 = (uint32x4_p)VecPermute(x3, y3, m3);
+    block5 = (uint32x4_p)VecPermute(x3, y3, m4);
+}
+
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+
+ANONYMOUS_NAMESPACE_END
+
+///////////////////////////////////////////////////////////////////////
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// *************************** ARM NEON **************************** //
+
+#if (CRYPTOPP_ARM_NEON_AVAILABLE)
+size_t SPECK128_Enc_AdvancedProcessBlocks_NEON(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x2_NEON(SPECK128_Enc_Block, SPECK128_Enc_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t SPECK128_Dec_AdvancedProcessBlocks_NEON(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x2_NEON(SPECK128_Dec_Block, SPECK128_Dec_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_ARM_NEON_AVAILABLE
+
+// ***************************** IA-32 ***************************** //
+
+#if (CRYPTOPP_SSSE3_AVAILABLE)
+size_t SPECK128_Enc_AdvancedProcessBlocks_SSSE3(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x2_SSE(SPECK128_Enc_Block, SPECK128_Enc_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t SPECK128_Dec_AdvancedProcessBlocks_SSSE3(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x2_SSE(SPECK128_Dec_Block, SPECK128_Dec_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_SSSE3_AVAILABLE
+
+// ***************************** Altivec ***************************** //
+
+#if (CRYPTOPP_ALTIVEC_AVAILABLE)
+size_t SPECK128_Enc_AdvancedProcessBlocks_ALTIVEC(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x1_ALTIVEC(SPECK128_Enc_Block, SPECK128_Enc_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+
+size_t SPECK128_Dec_AdvancedProcessBlocks_ALTIVEC(const word64* subKeys, size_t rounds,
+    const byte *inBlocks, const byte *xorBlocks, byte *outBlocks, size_t length, word32 flags)
+{
+    return AdvancedProcessBlocks128_6x1_ALTIVEC(SPECK128_Dec_Block, SPECK128_Dec_6_Blocks,
+        subKeys, rounds, inBlocks, xorBlocks, outBlocks, length, flags);
+}
+#endif  // CRYPTOPP_ALTIVEC_AVAILABLE
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/square.cpp b/runtime/third_party/cryptopp/square.cpp
new file mode 100644
index 0000000..2726c5b
--- /dev/null
+++ b/runtime/third_party/cryptopp/square.cpp
@@ -0,0 +1,187 @@
+// square.cpp - originally written and placed in the public domain by Wei Dai
+// Based on Paulo S.L.M. Barreto's public domain implementation
+
+#include "pch.h"
+#include "config.h"
+
+#include "square.h"
+#include "misc.h"
+#include "gf256.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4244)
+#endif
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wmissing-braces"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// apply theta to a roundkey
+static void SquareTransform (word32 in[4], word32 out[4])
+{
+	static const byte G[4][4] =
+	{
+		{0x02U, 0x01U, 0x01U, 0x03U},
+		{0x03U, 0x02U, 0x01U, 0x01U},
+		{0x01U, 0x03U, 0x02U, 0x01U},
+		{0x01U, 0x01U, 0x03U, 0x02U}
+	};
+
+	GF256 gf256(0xf5);
+
+	for (int i = 0; i < 4; i++)
+	{
+		word32 temp = 0;
+		for (unsigned int j = 0; j < 4; j++)
+			for (unsigned int k = 0; k < 4; k++)
+				temp ^= (word32)gf256.Multiply(GETBYTE(in[i], 3-k), G[k][j]) << ((3-j)*8);
+		out[i] = temp;
+	}
+}
+
+#define roundkeys(i, j)		m_roundkeys[(i)*4+(j)]
+#define roundkeys4(i)		(m_roundkeys+(i)*4)
+
+void Square::Base::UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &)
+{
+	AssertValidKeyLength(length);
+
+	static const word32 offset[ROUNDS] = {
+	0x01000000UL, 0x02000000UL, 0x04000000UL, 0x08000000UL,
+	0x10000000UL, 0x20000000UL, 0x40000000UL, 0x80000000UL,
+	};
+
+	GetUserKey(BIG_ENDIAN_ORDER, m_roundkeys.data(), KEYLENGTH/4, userKey, KEYLENGTH);
+
+	/* apply the key evolution function */
+	for (int i = 1; i < ROUNDS+1; i++)
+	{
+		roundkeys(i, 0) = roundkeys(i-1, 0) ^ rotlConstant<8>(roundkeys(i-1, 3)) ^ offset[i-1];
+		roundkeys(i, 1) = roundkeys(i-1, 1) ^ roundkeys(i, 0);
+		roundkeys(i, 2) = roundkeys(i-1, 2) ^ roundkeys(i, 1);
+		roundkeys(i, 3) = roundkeys(i-1, 3) ^ roundkeys(i, 2);
+	}
+
+	/* produce the round keys */
+	if (IsForwardTransformation())
+	{
+		for (int i = 0; i < ROUNDS; i++)
+			SquareTransform (roundkeys4(i), roundkeys4(i));
+	}
+	else
+	{
+		for (int i = 0; i < ROUNDS/2; i++)
+			for (int j = 0; j < 4; j++)
+				std::swap(roundkeys(i, j), roundkeys(ROUNDS-i, j));
+		SquareTransform (roundkeys4(ROUNDS), roundkeys4(ROUNDS));
+	}
+}
+
+#define MSB(x) (((x) >> 24) & 0xffU)	/* most  significant byte */
+#define SSB(x) (((x) >> 16) & 0xffU)	/* second in significance */
+#define TSB(x) (((x) >>  8) & 0xffU)	/* third  in significance */
+#define LSB(x) (((x)      ) & 0xffU)	/* least significant byte */
+
+#define squareRound(text, temp, T0, T1, T2, T3, roundkey) \
+{ \
+	temp[0] = T0[MSB (text[0])] \
+			^ T1[MSB (text[1])] \
+			^ T2[MSB (text[2])] \
+			^ T3[MSB (text[3])] \
+			^ roundkey[0]; \
+	temp[1] = T0[SSB (text[0])] \
+			^ T1[SSB (text[1])] \
+			^ T2[SSB (text[2])] \
+			^ T3[SSB (text[3])] \
+			^ roundkey[1]; \
+	temp[2] = T0[TSB (text[0])] \
+			^ T1[TSB (text[1])] \
+			^ T2[TSB (text[2])] \
+			^ T3[TSB (text[3])] \
+			^ roundkey[2]; \
+	temp[3] = T0[LSB (text[0])] \
+			^ T1[LSB (text[1])] \
+			^ T2[LSB (text[2])] \
+			^ T3[LSB (text[3])] \
+			^ roundkey[3]; \
+} /* squareRound */
+
+#define squareFinal(text, temp, S, roundkey) \
+{ \
+	text[0] = ((word32) (S[MSB (temp[0])]) << 24) \
+			^ ((word32) (S[MSB (temp[1])]) << 16) \
+			^ ((word32) (S[MSB (temp[2])]) <<  8) \
+			^  (word32) (S[MSB (temp[3])]) \
+			^ roundkey[0]; \
+	text[1] = ((word32) (S[SSB (temp[0])]) << 24) \
+			^ ((word32) (S[SSB (temp[1])]) << 16) \
+			^ ((word32) (S[SSB (temp[2])]) <<  8) \
+			^  (word32) (S[SSB (temp[3])]) \
+			^ roundkey[1]; \
+	text[2] = ((word32) (S[TSB (temp[0])]) << 24) \
+			^ ((word32) (S[TSB (temp[1])]) << 16) \
+			^ ((word32) (S[TSB (temp[2])]) <<  8) \
+			^  (word32) (S[TSB (temp[3])]) \
+			^ roundkey[2]; \
+	text[3] = ((word32) (S[LSB (temp[0])]) << 24) \
+			^ ((word32) (S[LSB (temp[1])]) << 16) \
+			^ ((word32) (S[LSB (temp[2])]) <<  8) \
+			^  (word32) (S[LSB (temp[3])]) \
+			^ roundkey[3]; \
+} /* squareFinal */
+
+typedef BlockGetAndPut<word32, BigEndian> Block;
+
+void Square::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 text[4], temp[4];
+	Block::Get(inBlock)(text[0])(text[1])(text[2])(text[3]);
+
+	/* initial key addition */
+	text[0] ^= roundkeys(0, 0);
+	text[1] ^= roundkeys(0, 1);
+	text[2] ^= roundkeys(0, 2);
+	text[3] ^= roundkeys(0, 3);
+
+	/* ROUNDS - 1 full rounds */
+	for (int i=1; i+1<ROUNDS; i+=2)
+	{
+		squareRound (text, temp, Te[0], Te[1], Te[2], Te[3], roundkeys4(i));
+		squareRound (temp, text, Te[0], Te[1], Te[2], Te[3], roundkeys4(i+1));
+	}
+	squareRound (text, temp, Te[0], Te[1], Te[2], Te[3], roundkeys4(ROUNDS-1));
+
+	/* last round (diffusion becomes only transposition) */
+	squareFinal (text, temp, Se, roundkeys4(ROUNDS));
+
+	Block::Put(xorBlock, outBlock)(text[0])(text[1])(text[2])(text[3]);
+}
+
+void Square::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 text[4], temp[4];
+	Block::Get(inBlock)(text[0])(text[1])(text[2])(text[3]);
+
+	/* initial key addition */
+	text[0] ^= roundkeys(0, 0);
+	text[1] ^= roundkeys(0, 1);
+	text[2] ^= roundkeys(0, 2);
+	text[3] ^= roundkeys(0, 3);
+
+	/* ROUNDS - 1 full rounds */
+	for (int i=1; i+1<ROUNDS; i+=2)
+	{
+		squareRound (text, temp, Td[0], Td[1], Td[2], Td[3], roundkeys4(i));
+		squareRound (temp, text, Td[0], Td[1], Td[2], Td[3], roundkeys4(i+1));
+	}
+	squareRound (text, temp, Td[0], Td[1], Td[2], Td[3], roundkeys4(ROUNDS-1));
+
+	/* last round (diffusion becomes only transposition) */
+	squareFinal (text, temp, Sd, roundkeys4(ROUNDS));
+
+	Block::Put(xorBlock, outBlock)(text[0])(text[1])(text[2])(text[3]);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/square.h b/runtime/third_party/cryptopp/square.h
new file mode 100644
index 0000000..e43e796
--- /dev/null
+++ b/runtime/third_party/cryptopp/square.h
@@ -0,0 +1,63 @@
+// square.h - originally written and placed in the public domain by Wei Dai
+
+/// \file square.h
+/// \brief Classes for the Square block cipher
+
+#ifndef CRYPTOPP_SQUARE_H
+#define CRYPTOPP_SQUARE_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Square block cipher information
+/// \since Crypto++ 2.2
+struct Square_Info : public FixedBlockSize<16>, public FixedKeyLength<16>, FixedRounds<8>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "Square";}
+};
+
+/// \brief Square block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/Square">Square</a>
+/// \since Crypto++ 2.2
+class Square : public Square_Info, public BlockCipherDocumentation
+{
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<Square_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		FixedSizeSecBlock<word32, 4*(ROUNDS+1)> m_roundkeys;
+	};
+
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	private:
+		static const byte Se[256];
+		static const word32 Te[4][256];
+	};
+
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	private:
+		static const byte Sd[256];
+		static const word32 Td[4][256];
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef Square::Encryption SquareEncryption;
+typedef Square::Decryption SquareDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/squaretb.cpp b/runtime/third_party/cryptopp/squaretb.cpp
new file mode 100644
index 0000000..5402a92
--- /dev/null
+++ b/runtime/third_party/cryptopp/squaretb.cpp
@@ -0,0 +1,582 @@
+#include "pch.h"
+#include "square.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const byte Square::Enc::Se[256] = {
+177, 206, 195, 149,  90, 173, 231,   2,  77,  68, 251, 145,  12, 135, 161,  80,
+203, 103,  84, 221,  70, 143, 225,  78, 240, 253, 252, 235, 249, 196,  26, 110,
+ 94, 245, 204, 141,  28,  86,  67, 254,   7,  97, 248, 117,  89, 255,   3,  34,
+138, 209,  19, 238, 136,   0,  14,  52,  21, 128, 148, 227, 237, 181,  83,  35,
+ 75,  71,  23, 167, 144,  53, 171, 216, 184, 223,  79,  87, 154, 146, 219,  27,
+ 60, 200, 153,   4, 142, 224, 215, 125, 133, 187,  64,  44,  58,  69, 241,  66,
+101,  32,  65,  24, 114,  37, 147, 112,  54,   5, 242,  11, 163, 121, 236,   8,
+ 39,  49,  50, 182, 124, 176,  10, 115,  91, 123, 183, 129, 210,  13, 106,  38,
+158,  88, 156, 131, 116, 179, 172,  48, 122, 105, 119,  15, 174,  33, 222, 208,
+ 46, 151,  16, 164, 152, 168, 212, 104,  45,  98,  41, 109,  22,  73, 118, 199,
+232, 193, 150,  55, 229, 202, 244, 233,  99,  18, 194, 166,  20, 188, 211,  40,
+175,  47, 230,  36,  82, 198, 160,   9, 189, 140, 207,  93,  17,  95,   1, 197,
+159,  61, 162, 155, 201,  59, 190,  81,  25,  31,  63,  92, 178, 239,  74, 205,
+191, 186, 111, 100, 217, 243,  62, 180, 170, 220, 213,   6, 192, 126, 246, 102,
+108, 132, 113,  56, 185,  29, 127, 157,  72, 139,  42, 218, 165,  51, 130,  57,
+214, 120, 134, 250, 228,  43, 169,  30, 137,  96, 107, 234,  85,  76, 247, 226,
+};
+
+const byte Square::Dec::Sd[256] = {
+ 53, 190,   7,  46,  83, 105, 219,  40, 111, 183, 118, 107,  12, 125,  54, 139,
+146, 188, 169,  50, 172,  56, 156,  66,  99, 200,  30,  79,  36, 229, 247, 201,
+ 97, 141,  47,  63, 179, 101, 127, 112, 175, 154, 234, 245,  91, 152, 144, 177,
+135, 113, 114, 237,  55,  69, 104, 163, 227, 239,  92, 197,  80, 193, 214, 202,
+ 90,  98,  95,  38,   9,  93,  20,  65, 232, 157, 206,  64, 253,   8,  23,  74,
+ 15, 199, 180,  62,  18, 252,  37,  75, 129,  44,   4, 120, 203, 187,  32, 189,
+249,  41, 153, 168, 211,  96, 223,  17, 151, 137, 126, 250, 224, 155,  31, 210,
+103, 226, 100, 119, 132,  43, 158, 138, 241, 109, 136, 121, 116,  87, 221, 230,
+ 57, 123, 238, 131, 225,  88, 242,  13,  52, 248,  48, 233, 185,  35,  84,  21,
+ 68,  11,  77, 102,  58,   3, 162, 145, 148,  82,  76, 195, 130, 231, 128, 192,
+182,  14, 194, 108, 147, 236, 171,  67, 149, 246, 216,  70, 134,   5, 140, 176,
+117,   0, 204, 133, 215,  61, 115, 122,  72, 228, 209,  89, 173, 184, 198, 208,
+220, 161, 170,   2,  29, 191, 181, 159,  81, 196, 165,  16,  34, 207,   1, 186,
+143,  49, 124, 174, 150, 218, 240,  86,  71, 212, 235,  78, 217,  19, 142,  73,
+ 85,  22, 255,  59, 244, 164, 178,   6, 160, 167, 251,  27, 110,  60,  51, 205,
+ 24,  94, 106, 213, 166,  33, 222, 254,  42,  28, 243,  10,  26,  25,  39,  45,
+};
+
+const word32 Square::Enc::Te[4][256] = {
+{
+0x97b1b126UL, 0x69cecea7UL, 0x73c3c3b0UL, 0xdf95954aUL,
+0xb45a5aeeUL, 0xafadad02UL, 0x3be7e7dcUL, 0x04020206UL,
+0x9a4d4dd7UL, 0x884444ccUL, 0x03fbfbf8UL, 0xd7919146UL,
+0x180c0c14UL, 0xfb87877cUL, 0xb7a1a116UL, 0xa05050f0UL,
+0x63cbcba8UL, 0xce6767a9UL, 0xa85454fcUL, 0x4fdddd92UL,
+0x8c4646caUL, 0xeb8f8f64UL, 0x37e1e1d6UL, 0x9c4e4ed2UL,
+0x15f0f0e5UL, 0x0ffdfdf2UL, 0x0dfcfcf1UL, 0x23ebebc8UL,
+0x07f9f9feUL, 0x7dc4c4b9UL, 0x341a1a2eUL, 0xdc6e6eb2UL,
+0xbc5e5ee2UL, 0x1ff5f5eaUL, 0x6dcccca1UL, 0xef8d8d62UL,
+0x381c1c24UL, 0xac5656faUL, 0x864343c5UL, 0x09fefef7UL,
+0x0e070709UL, 0xc26161a3UL, 0x05f8f8fdUL, 0xea75759fUL,
+0xb25959ebUL, 0x0bfffff4UL, 0x06030305UL, 0x44222266UL,
+0xe18a8a6bUL, 0x57d1d186UL, 0x26131335UL, 0x29eeeec7UL,
+0xe588886dUL, 0x00000000UL, 0x1c0e0e12UL, 0x6834345cUL,
+0x2a15153fUL, 0xf5808075UL, 0xdd949449UL, 0x33e3e3d0UL,
+0x2fededc2UL, 0x9fb5b52aUL, 0xa65353f5UL, 0x46232365UL,
+0x964b4bddUL, 0x8e4747c9UL, 0x2e171739UL, 0xbba7a71cUL,
+0xd5909045UL, 0x6a35355fUL, 0xa3abab08UL, 0x45d8d89dUL,
+0x85b8b83dUL, 0x4bdfdf94UL, 0x9e4f4fd1UL, 0xae5757f9UL,
+0xc19a9a5bUL, 0xd1929243UL, 0x43dbdb98UL, 0x361b1b2dUL,
+0x783c3c44UL, 0x65c8c8adUL, 0xc799995eUL, 0x0804040cUL,
+0xe98e8e67UL, 0x35e0e0d5UL, 0x5bd7d78cUL, 0xfa7d7d87UL,
+0xff85857aUL, 0x83bbbb38UL, 0x804040c0UL, 0x582c2c74UL,
+0x743a3a4eUL, 0x8a4545cfUL, 0x17f1f1e6UL, 0x844242c6UL,
+0xca6565afUL, 0x40202060UL, 0x824141c3UL, 0x30181828UL,
+0xe4727296UL, 0x4a25256fUL, 0xd3939340UL, 0xe0707090UL,
+0x6c36365aUL, 0x0a05050fUL, 0x11f2f2e3UL, 0x160b0b1dUL,
+0xb3a3a310UL, 0xf279798bUL, 0x2dececc1UL, 0x10080818UL,
+0x4e272769UL, 0x62313153UL, 0x64323256UL, 0x99b6b62fUL,
+0xf87c7c84UL, 0x95b0b025UL, 0x140a0a1eUL, 0xe6737395UL,
+0xb65b5bedUL, 0xf67b7b8dUL, 0x9bb7b72cUL, 0xf7818176UL,
+0x51d2d283UL, 0x1a0d0d17UL, 0xd46a6abeUL, 0x4c26266aUL,
+0xc99e9e57UL, 0xb05858e8UL, 0xcd9c9c51UL, 0xf3838370UL,
+0xe874749cUL, 0x93b3b320UL, 0xadacac01UL, 0x60303050UL,
+0xf47a7a8eUL, 0xd26969bbUL, 0xee777799UL, 0x1e0f0f11UL,
+0xa9aeae07UL, 0x42212163UL, 0x49dede97UL, 0x55d0d085UL,
+0x5c2e2e72UL, 0xdb97974cUL, 0x20101030UL, 0xbda4a419UL,
+0xc598985dUL, 0xa5a8a80dUL, 0x5dd4d489UL, 0xd06868b8UL,
+0x5a2d2d77UL, 0xc46262a6UL, 0x5229297bUL, 0xda6d6db7UL,
+0x2c16163aUL, 0x924949dbUL, 0xec76769aUL, 0x7bc7c7bcUL,
+0x25e8e8cdUL, 0x77c1c1b6UL, 0xd996964fUL, 0x6e373759UL,
+0x3fe5e5daUL, 0x61cacaabUL, 0x1df4f4e9UL, 0x27e9e9ceUL,
+0xc66363a5UL, 0x24121236UL, 0x71c2c2b3UL, 0xb9a6a61fUL,
+0x2814143cUL, 0x8dbcbc31UL, 0x53d3d380UL, 0x50282878UL,
+0xabafaf04UL, 0x5e2f2f71UL, 0x39e6e6dfUL, 0x4824246cUL,
+0xa45252f6UL, 0x79c6c6bfUL, 0xb5a0a015UL, 0x1209091bUL,
+0x8fbdbd32UL, 0xed8c8c61UL, 0x6bcfcfa4UL, 0xba5d5de7UL,
+0x22111133UL, 0xbe5f5fe1UL, 0x02010103UL, 0x7fc5c5baUL,
+0xcb9f9f54UL, 0x7a3d3d47UL, 0xb1a2a213UL, 0xc39b9b58UL,
+0x67c9c9aeUL, 0x763b3b4dUL, 0x89bebe37UL, 0xa25151f3UL,
+0x3219192bUL, 0x3e1f1f21UL, 0x7e3f3f41UL, 0xb85c5ce4UL,
+0x91b2b223UL, 0x2befefc4UL, 0x944a4adeUL, 0x6fcdcda2UL,
+0x8bbfbf34UL, 0x81baba3bUL, 0xde6f6fb1UL, 0xc86464acUL,
+0x47d9d99eUL, 0x13f3f3e0UL, 0x7c3e3e42UL, 0x9db4b429UL,
+0xa1aaaa0bUL, 0x4ddcdc91UL, 0x5fd5d58aUL, 0x0c06060aUL,
+0x75c0c0b5UL, 0xfc7e7e82UL, 0x19f6f6efUL, 0xcc6666aaUL,
+0xd86c6cb4UL, 0xfd848479UL, 0xe2717193UL, 0x70383848UL,
+0x87b9b93eUL, 0x3a1d1d27UL, 0xfe7f7f81UL, 0xcf9d9d52UL,
+0x904848d8UL, 0xe38b8b68UL, 0x542a2a7eUL, 0x41dada9bUL,
+0xbfa5a51aUL, 0x66333355UL, 0xf1828273UL, 0x7239394bUL,
+0x59d6d68fUL, 0xf0787888UL, 0xf986867fUL, 0x01fafafbUL,
+0x3de4e4d9UL, 0x562b2b7dUL, 0xa7a9a90eUL, 0x3c1e1e22UL,
+0xe789896eUL, 0xc06060a0UL, 0xd66b6bbdUL, 0x21eaeacbUL,
+0xaa5555ffUL, 0x984c4cd4UL, 0x1bf7f7ecUL, 0x31e2e2d3UL,
+},
+
+{
+0x2697b1b1UL, 0xa769ceceUL, 0xb073c3c3UL, 0x4adf9595UL,
+0xeeb45a5aUL, 0x02afadadUL, 0xdc3be7e7UL, 0x06040202UL,
+0xd79a4d4dUL, 0xcc884444UL, 0xf803fbfbUL, 0x46d79191UL,
+0x14180c0cUL, 0x7cfb8787UL, 0x16b7a1a1UL, 0xf0a05050UL,
+0xa863cbcbUL, 0xa9ce6767UL, 0xfca85454UL, 0x924fddddUL,
+0xca8c4646UL, 0x64eb8f8fUL, 0xd637e1e1UL, 0xd29c4e4eUL,
+0xe515f0f0UL, 0xf20ffdfdUL, 0xf10dfcfcUL, 0xc823ebebUL,
+0xfe07f9f9UL, 0xb97dc4c4UL, 0x2e341a1aUL, 0xb2dc6e6eUL,
+0xe2bc5e5eUL, 0xea1ff5f5UL, 0xa16dccccUL, 0x62ef8d8dUL,
+0x24381c1cUL, 0xfaac5656UL, 0xc5864343UL, 0xf709fefeUL,
+0x090e0707UL, 0xa3c26161UL, 0xfd05f8f8UL, 0x9fea7575UL,
+0xebb25959UL, 0xf40bffffUL, 0x05060303UL, 0x66442222UL,
+0x6be18a8aUL, 0x8657d1d1UL, 0x35261313UL, 0xc729eeeeUL,
+0x6de58888UL, 0x00000000UL, 0x121c0e0eUL, 0x5c683434UL,
+0x3f2a1515UL, 0x75f58080UL, 0x49dd9494UL, 0xd033e3e3UL,
+0xc22fededUL, 0x2a9fb5b5UL, 0xf5a65353UL, 0x65462323UL,
+0xdd964b4bUL, 0xc98e4747UL, 0x392e1717UL, 0x1cbba7a7UL,
+0x45d59090UL, 0x5f6a3535UL, 0x08a3ababUL, 0x9d45d8d8UL,
+0x3d85b8b8UL, 0x944bdfdfUL, 0xd19e4f4fUL, 0xf9ae5757UL,
+0x5bc19a9aUL, 0x43d19292UL, 0x9843dbdbUL, 0x2d361b1bUL,
+0x44783c3cUL, 0xad65c8c8UL, 0x5ec79999UL, 0x0c080404UL,
+0x67e98e8eUL, 0xd535e0e0UL, 0x8c5bd7d7UL, 0x87fa7d7dUL,
+0x7aff8585UL, 0x3883bbbbUL, 0xc0804040UL, 0x74582c2cUL,
+0x4e743a3aUL, 0xcf8a4545UL, 0xe617f1f1UL, 0xc6844242UL,
+0xafca6565UL, 0x60402020UL, 0xc3824141UL, 0x28301818UL,
+0x96e47272UL, 0x6f4a2525UL, 0x40d39393UL, 0x90e07070UL,
+0x5a6c3636UL, 0x0f0a0505UL, 0xe311f2f2UL, 0x1d160b0bUL,
+0x10b3a3a3UL, 0x8bf27979UL, 0xc12dececUL, 0x18100808UL,
+0x694e2727UL, 0x53623131UL, 0x56643232UL, 0x2f99b6b6UL,
+0x84f87c7cUL, 0x2595b0b0UL, 0x1e140a0aUL, 0x95e67373UL,
+0xedb65b5bUL, 0x8df67b7bUL, 0x2c9bb7b7UL, 0x76f78181UL,
+0x8351d2d2UL, 0x171a0d0dUL, 0xbed46a6aUL, 0x6a4c2626UL,
+0x57c99e9eUL, 0xe8b05858UL, 0x51cd9c9cUL, 0x70f38383UL,
+0x9ce87474UL, 0x2093b3b3UL, 0x01adacacUL, 0x50603030UL,
+0x8ef47a7aUL, 0xbbd26969UL, 0x99ee7777UL, 0x111e0f0fUL,
+0x07a9aeaeUL, 0x63422121UL, 0x9749dedeUL, 0x8555d0d0UL,
+0x725c2e2eUL, 0x4cdb9797UL, 0x30201010UL, 0x19bda4a4UL,
+0x5dc59898UL, 0x0da5a8a8UL, 0x895dd4d4UL, 0xb8d06868UL,
+0x775a2d2dUL, 0xa6c46262UL, 0x7b522929UL, 0xb7da6d6dUL,
+0x3a2c1616UL, 0xdb924949UL, 0x9aec7676UL, 0xbc7bc7c7UL,
+0xcd25e8e8UL, 0xb677c1c1UL, 0x4fd99696UL, 0x596e3737UL,
+0xda3fe5e5UL, 0xab61cacaUL, 0xe91df4f4UL, 0xce27e9e9UL,
+0xa5c66363UL, 0x36241212UL, 0xb371c2c2UL, 0x1fb9a6a6UL,
+0x3c281414UL, 0x318dbcbcUL, 0x8053d3d3UL, 0x78502828UL,
+0x04abafafUL, 0x715e2f2fUL, 0xdf39e6e6UL, 0x6c482424UL,
+0xf6a45252UL, 0xbf79c6c6UL, 0x15b5a0a0UL, 0x1b120909UL,
+0x328fbdbdUL, 0x61ed8c8cUL, 0xa46bcfcfUL, 0xe7ba5d5dUL,
+0x33221111UL, 0xe1be5f5fUL, 0x03020101UL, 0xba7fc5c5UL,
+0x54cb9f9fUL, 0x477a3d3dUL, 0x13b1a2a2UL, 0x58c39b9bUL,
+0xae67c9c9UL, 0x4d763b3bUL, 0x3789bebeUL, 0xf3a25151UL,
+0x2b321919UL, 0x213e1f1fUL, 0x417e3f3fUL, 0xe4b85c5cUL,
+0x2391b2b2UL, 0xc42befefUL, 0xde944a4aUL, 0xa26fcdcdUL,
+0x348bbfbfUL, 0x3b81babaUL, 0xb1de6f6fUL, 0xacc86464UL,
+0x9e47d9d9UL, 0xe013f3f3UL, 0x427c3e3eUL, 0x299db4b4UL,
+0x0ba1aaaaUL, 0x914ddcdcUL, 0x8a5fd5d5UL, 0x0a0c0606UL,
+0xb575c0c0UL, 0x82fc7e7eUL, 0xef19f6f6UL, 0xaacc6666UL,
+0xb4d86c6cUL, 0x79fd8484UL, 0x93e27171UL, 0x48703838UL,
+0x3e87b9b9UL, 0x273a1d1dUL, 0x81fe7f7fUL, 0x52cf9d9dUL,
+0xd8904848UL, 0x68e38b8bUL, 0x7e542a2aUL, 0x9b41dadaUL,
+0x1abfa5a5UL, 0x55663333UL, 0x73f18282UL, 0x4b723939UL,
+0x8f59d6d6UL, 0x88f07878UL, 0x7ff98686UL, 0xfb01fafaUL,
+0xd93de4e4UL, 0x7d562b2bUL, 0x0ea7a9a9UL, 0x223c1e1eUL,
+0x6ee78989UL, 0xa0c06060UL, 0xbdd66b6bUL, 0xcb21eaeaUL,
+0xffaa5555UL, 0xd4984c4cUL, 0xec1bf7f7UL, 0xd331e2e2UL,
+},
+
+{
+0xb12697b1UL, 0xcea769ceUL, 0xc3b073c3UL, 0x954adf95UL,
+0x5aeeb45aUL, 0xad02afadUL, 0xe7dc3be7UL, 0x02060402UL,
+0x4dd79a4dUL, 0x44cc8844UL, 0xfbf803fbUL, 0x9146d791UL,
+0x0c14180cUL, 0x877cfb87UL, 0xa116b7a1UL, 0x50f0a050UL,
+0xcba863cbUL, 0x67a9ce67UL, 0x54fca854UL, 0xdd924fddUL,
+0x46ca8c46UL, 0x8f64eb8fUL, 0xe1d637e1UL, 0x4ed29c4eUL,
+0xf0e515f0UL, 0xfdf20ffdUL, 0xfcf10dfcUL, 0xebc823ebUL,
+0xf9fe07f9UL, 0xc4b97dc4UL, 0x1a2e341aUL, 0x6eb2dc6eUL,
+0x5ee2bc5eUL, 0xf5ea1ff5UL, 0xcca16dccUL, 0x8d62ef8dUL,
+0x1c24381cUL, 0x56faac56UL, 0x43c58643UL, 0xfef709feUL,
+0x07090e07UL, 0x61a3c261UL, 0xf8fd05f8UL, 0x759fea75UL,
+0x59ebb259UL, 0xfff40bffUL, 0x03050603UL, 0x22664422UL,
+0x8a6be18aUL, 0xd18657d1UL, 0x13352613UL, 0xeec729eeUL,
+0x886de588UL, 0x00000000UL, 0x0e121c0eUL, 0x345c6834UL,
+0x153f2a15UL, 0x8075f580UL, 0x9449dd94UL, 0xe3d033e3UL,
+0xedc22fedUL, 0xb52a9fb5UL, 0x53f5a653UL, 0x23654623UL,
+0x4bdd964bUL, 0x47c98e47UL, 0x17392e17UL, 0xa71cbba7UL,
+0x9045d590UL, 0x355f6a35UL, 0xab08a3abUL, 0xd89d45d8UL,
+0xb83d85b8UL, 0xdf944bdfUL, 0x4fd19e4fUL, 0x57f9ae57UL,
+0x9a5bc19aUL, 0x9243d192UL, 0xdb9843dbUL, 0x1b2d361bUL,
+0x3c44783cUL, 0xc8ad65c8UL, 0x995ec799UL, 0x040c0804UL,
+0x8e67e98eUL, 0xe0d535e0UL, 0xd78c5bd7UL, 0x7d87fa7dUL,
+0x857aff85UL, 0xbb3883bbUL, 0x40c08040UL, 0x2c74582cUL,
+0x3a4e743aUL, 0x45cf8a45UL, 0xf1e617f1UL, 0x42c68442UL,
+0x65afca65UL, 0x20604020UL, 0x41c38241UL, 0x18283018UL,
+0x7296e472UL, 0x256f4a25UL, 0x9340d393UL, 0x7090e070UL,
+0x365a6c36UL, 0x050f0a05UL, 0xf2e311f2UL, 0x0b1d160bUL,
+0xa310b3a3UL, 0x798bf279UL, 0xecc12decUL, 0x08181008UL,
+0x27694e27UL, 0x31536231UL, 0x32566432UL, 0xb62f99b6UL,
+0x7c84f87cUL, 0xb02595b0UL, 0x0a1e140aUL, 0x7395e673UL,
+0x5bedb65bUL, 0x7b8df67bUL, 0xb72c9bb7UL, 0x8176f781UL,
+0xd28351d2UL, 0x0d171a0dUL, 0x6abed46aUL, 0x266a4c26UL,
+0x9e57c99eUL, 0x58e8b058UL, 0x9c51cd9cUL, 0x8370f383UL,
+0x749ce874UL, 0xb32093b3UL, 0xac01adacUL, 0x30506030UL,
+0x7a8ef47aUL, 0x69bbd269UL, 0x7799ee77UL, 0x0f111e0fUL,
+0xae07a9aeUL, 0x21634221UL, 0xde9749deUL, 0xd08555d0UL,
+0x2e725c2eUL, 0x974cdb97UL, 0x10302010UL, 0xa419bda4UL,
+0x985dc598UL, 0xa80da5a8UL, 0xd4895dd4UL, 0x68b8d068UL,
+0x2d775a2dUL, 0x62a6c462UL, 0x297b5229UL, 0x6db7da6dUL,
+0x163a2c16UL, 0x49db9249UL, 0x769aec76UL, 0xc7bc7bc7UL,
+0xe8cd25e8UL, 0xc1b677c1UL, 0x964fd996UL, 0x37596e37UL,
+0xe5da3fe5UL, 0xcaab61caUL, 0xf4e91df4UL, 0xe9ce27e9UL,
+0x63a5c663UL, 0x12362412UL, 0xc2b371c2UL, 0xa61fb9a6UL,
+0x143c2814UL, 0xbc318dbcUL, 0xd38053d3UL, 0x28785028UL,
+0xaf04abafUL, 0x2f715e2fUL, 0xe6df39e6UL, 0x246c4824UL,
+0x52f6a452UL, 0xc6bf79c6UL, 0xa015b5a0UL, 0x091b1209UL,
+0xbd328fbdUL, 0x8c61ed8cUL, 0xcfa46bcfUL, 0x5de7ba5dUL,
+0x11332211UL, 0x5fe1be5fUL, 0x01030201UL, 0xc5ba7fc5UL,
+0x9f54cb9fUL, 0x3d477a3dUL, 0xa213b1a2UL, 0x9b58c39bUL,
+0xc9ae67c9UL, 0x3b4d763bUL, 0xbe3789beUL, 0x51f3a251UL,
+0x192b3219UL, 0x1f213e1fUL, 0x3f417e3fUL, 0x5ce4b85cUL,
+0xb22391b2UL, 0xefc42befUL, 0x4ade944aUL, 0xcda26fcdUL,
+0xbf348bbfUL, 0xba3b81baUL, 0x6fb1de6fUL, 0x64acc864UL,
+0xd99e47d9UL, 0xf3e013f3UL, 0x3e427c3eUL, 0xb4299db4UL,
+0xaa0ba1aaUL, 0xdc914ddcUL, 0xd58a5fd5UL, 0x060a0c06UL,
+0xc0b575c0UL, 0x7e82fc7eUL, 0xf6ef19f6UL, 0x66aacc66UL,
+0x6cb4d86cUL, 0x8479fd84UL, 0x7193e271UL, 0x38487038UL,
+0xb93e87b9UL, 0x1d273a1dUL, 0x7f81fe7fUL, 0x9d52cf9dUL,
+0x48d89048UL, 0x8b68e38bUL, 0x2a7e542aUL, 0xda9b41daUL,
+0xa51abfa5UL, 0x33556633UL, 0x8273f182UL, 0x394b7239UL,
+0xd68f59d6UL, 0x7888f078UL, 0x867ff986UL, 0xfafb01faUL,
+0xe4d93de4UL, 0x2b7d562bUL, 0xa90ea7a9UL, 0x1e223c1eUL,
+0x896ee789UL, 0x60a0c060UL, 0x6bbdd66bUL, 0xeacb21eaUL,
+0x55ffaa55UL, 0x4cd4984cUL, 0xf7ec1bf7UL, 0xe2d331e2UL,
+},
+
+{
+0xb1b12697UL, 0xcecea769UL, 0xc3c3b073UL, 0x95954adfUL,
+0x5a5aeeb4UL, 0xadad02afUL, 0xe7e7dc3bUL, 0x02020604UL,
+0x4d4dd79aUL, 0x4444cc88UL, 0xfbfbf803UL, 0x919146d7UL,
+0x0c0c1418UL, 0x87877cfbUL, 0xa1a116b7UL, 0x5050f0a0UL,
+0xcbcba863UL, 0x6767a9ceUL, 0x5454fca8UL, 0xdddd924fUL,
+0x4646ca8cUL, 0x8f8f64ebUL, 0xe1e1d637UL, 0x4e4ed29cUL,
+0xf0f0e515UL, 0xfdfdf20fUL, 0xfcfcf10dUL, 0xebebc823UL,
+0xf9f9fe07UL, 0xc4c4b97dUL, 0x1a1a2e34UL, 0x6e6eb2dcUL,
+0x5e5ee2bcUL, 0xf5f5ea1fUL, 0xcccca16dUL, 0x8d8d62efUL,
+0x1c1c2438UL, 0x5656faacUL, 0x4343c586UL, 0xfefef709UL,
+0x0707090eUL, 0x6161a3c2UL, 0xf8f8fd05UL, 0x75759feaUL,
+0x5959ebb2UL, 0xfffff40bUL, 0x03030506UL, 0x22226644UL,
+0x8a8a6be1UL, 0xd1d18657UL, 0x13133526UL, 0xeeeec729UL,
+0x88886de5UL, 0x00000000UL, 0x0e0e121cUL, 0x34345c68UL,
+0x15153f2aUL, 0x808075f5UL, 0x949449ddUL, 0xe3e3d033UL,
+0xededc22fUL, 0xb5b52a9fUL, 0x5353f5a6UL, 0x23236546UL,
+0x4b4bdd96UL, 0x4747c98eUL, 0x1717392eUL, 0xa7a71cbbUL,
+0x909045d5UL, 0x35355f6aUL, 0xabab08a3UL, 0xd8d89d45UL,
+0xb8b83d85UL, 0xdfdf944bUL, 0x4f4fd19eUL, 0x5757f9aeUL,
+0x9a9a5bc1UL, 0x929243d1UL, 0xdbdb9843UL, 0x1b1b2d36UL,
+0x3c3c4478UL, 0xc8c8ad65UL, 0x99995ec7UL, 0x04040c08UL,
+0x8e8e67e9UL, 0xe0e0d535UL, 0xd7d78c5bUL, 0x7d7d87faUL,
+0x85857affUL, 0xbbbb3883UL, 0x4040c080UL, 0x2c2c7458UL,
+0x3a3a4e74UL, 0x4545cf8aUL, 0xf1f1e617UL, 0x4242c684UL,
+0x6565afcaUL, 0x20206040UL, 0x4141c382UL, 0x18182830UL,
+0x727296e4UL, 0x25256f4aUL, 0x939340d3UL, 0x707090e0UL,
+0x36365a6cUL, 0x05050f0aUL, 0xf2f2e311UL, 0x0b0b1d16UL,
+0xa3a310b3UL, 0x79798bf2UL, 0xececc12dUL, 0x08081810UL,
+0x2727694eUL, 0x31315362UL, 0x32325664UL, 0xb6b62f99UL,
+0x7c7c84f8UL, 0xb0b02595UL, 0x0a0a1e14UL, 0x737395e6UL,
+0x5b5bedb6UL, 0x7b7b8df6UL, 0xb7b72c9bUL, 0x818176f7UL,
+0xd2d28351UL, 0x0d0d171aUL, 0x6a6abed4UL, 0x26266a4cUL,
+0x9e9e57c9UL, 0x5858e8b0UL, 0x9c9c51cdUL, 0x838370f3UL,
+0x74749ce8UL, 0xb3b32093UL, 0xacac01adUL, 0x30305060UL,
+0x7a7a8ef4UL, 0x6969bbd2UL, 0x777799eeUL, 0x0f0f111eUL,
+0xaeae07a9UL, 0x21216342UL, 0xdede9749UL, 0xd0d08555UL,
+0x2e2e725cUL, 0x97974cdbUL, 0x10103020UL, 0xa4a419bdUL,
+0x98985dc5UL, 0xa8a80da5UL, 0xd4d4895dUL, 0x6868b8d0UL,
+0x2d2d775aUL, 0x6262a6c4UL, 0x29297b52UL, 0x6d6db7daUL,
+0x16163a2cUL, 0x4949db92UL, 0x76769aecUL, 0xc7c7bc7bUL,
+0xe8e8cd25UL, 0xc1c1b677UL, 0x96964fd9UL, 0x3737596eUL,
+0xe5e5da3fUL, 0xcacaab61UL, 0xf4f4e91dUL, 0xe9e9ce27UL,
+0x6363a5c6UL, 0x12123624UL, 0xc2c2b371UL, 0xa6a61fb9UL,
+0x14143c28UL, 0xbcbc318dUL, 0xd3d38053UL, 0x28287850UL,
+0xafaf04abUL, 0x2f2f715eUL, 0xe6e6df39UL, 0x24246c48UL,
+0x5252f6a4UL, 0xc6c6bf79UL, 0xa0a015b5UL, 0x09091b12UL,
+0xbdbd328fUL, 0x8c8c61edUL, 0xcfcfa46bUL, 0x5d5de7baUL,
+0x11113322UL, 0x5f5fe1beUL, 0x01010302UL, 0xc5c5ba7fUL,
+0x9f9f54cbUL, 0x3d3d477aUL, 0xa2a213b1UL, 0x9b9b58c3UL,
+0xc9c9ae67UL, 0x3b3b4d76UL, 0xbebe3789UL, 0x5151f3a2UL,
+0x19192b32UL, 0x1f1f213eUL, 0x3f3f417eUL, 0x5c5ce4b8UL,
+0xb2b22391UL, 0xefefc42bUL, 0x4a4ade94UL, 0xcdcda26fUL,
+0xbfbf348bUL, 0xbaba3b81UL, 0x6f6fb1deUL, 0x6464acc8UL,
+0xd9d99e47UL, 0xf3f3e013UL, 0x3e3e427cUL, 0xb4b4299dUL,
+0xaaaa0ba1UL, 0xdcdc914dUL, 0xd5d58a5fUL, 0x06060a0cUL,
+0xc0c0b575UL, 0x7e7e82fcUL, 0xf6f6ef19UL, 0x6666aaccUL,
+0x6c6cb4d8UL, 0x848479fdUL, 0x717193e2UL, 0x38384870UL,
+0xb9b93e87UL, 0x1d1d273aUL, 0x7f7f81feUL, 0x9d9d52cfUL,
+0x4848d890UL, 0x8b8b68e3UL, 0x2a2a7e54UL, 0xdada9b41UL,
+0xa5a51abfUL, 0x33335566UL, 0x828273f1UL, 0x39394b72UL,
+0xd6d68f59UL, 0x787888f0UL, 0x86867ff9UL, 0xfafafb01UL,
+0xe4e4d93dUL, 0x2b2b7d56UL, 0xa9a90ea7UL, 0x1e1e223cUL,
+0x89896ee7UL, 0x6060a0c0UL, 0x6b6bbdd6UL, 0xeaeacb21UL,
+0x5555ffaaUL, 0x4c4cd498UL, 0xf7f7ec1bUL, 0xe2e2d331UL,
+}};
+
+const word32 Square::Dec::Td[4][256] = {
+{
+0xe368bc02UL, 0x5585620cUL, 0x2a3f2331UL, 0x61ab13f7UL,
+0x98d46d72UL, 0x21cb9a19UL, 0x3c22a461UL, 0x459d3dcdUL,
+0x05fdb423UL, 0x2bc4075fUL, 0x9b2c01c0UL, 0x3dd9800fUL,
+0x486c5c74UL, 0xf97f7e85UL, 0xf173ab1fUL, 0xb6edde0eUL,
+0x283c6bedUL, 0x4997781aUL, 0x9f2a918dUL, 0xc9579f33UL,
+0xa907a8aaUL, 0xa50ded7dUL, 0x7c422d8fUL, 0x764db0c9UL,
+0x4d91e857UL, 0xcea963ccUL, 0xb4ee96d2UL, 0x3028e1b6UL,
+0x0df161b9UL, 0xbd196726UL, 0x419bad80UL, 0xc0a06ec7UL,
+0x5183f241UL, 0x92dbf034UL, 0x6fa21efcUL, 0x8f32ce4cUL,
+0x13e03373UL, 0x69a7c66dUL, 0xe56d6493UL, 0xbf1a2ffaUL,
+0xbb1cbfb7UL, 0x587403b5UL, 0xe76e2c4fUL, 0x5d89b796UL,
+0xe89c052aUL, 0x446619a3UL, 0x342e71fbUL, 0x0ff22965UL,
+0xfe81827aUL, 0xb11322f1UL, 0xa30835ecUL, 0xcd510f7eUL,
+0xff7aa614UL, 0x5c7293f8UL, 0x2fc29712UL, 0xf370e3c3UL,
+0x992f491cUL, 0xd1431568UL, 0xc2a3261bUL, 0x88cc32b3UL,
+0x8acf7a6fUL, 0xb0e8069fUL, 0x7a47f51eUL, 0xd2bb79daUL,
+0xe6950821UL, 0x4398e55cUL, 0xd0b83106UL, 0x11e37bafUL,
+0x7e416553UL, 0xccaa2b10UL, 0xd8b4e49cUL, 0x6456a7d4UL,
+0xfb7c3659UL, 0x724b2084UL, 0xea9f4df6UL, 0x6a5faadfUL,
+0x2dc1dfceUL, 0x70486858UL, 0xcaaff381UL, 0x0605d891UL,
+0x5a774b69UL, 0x94de28a5UL, 0x39df1042UL, 0x813bc347UL,
+0xfc82caa6UL, 0x23c8d2c5UL, 0x03f86cb2UL, 0x080cd59aUL,
+0xdab7ac40UL, 0x7db909e1UL, 0x3824342cUL, 0xcf5247a2UL,
+0xdcb274d1UL, 0x63a85b2bUL, 0x35d55595UL, 0x479e7511UL,
+0x15e5ebe2UL, 0x4b9430c6UL, 0x4a6f14a8UL, 0x91239c86UL,
+0x4c6acc39UL, 0x5f8aff4aUL, 0x0406904dUL, 0xee99ddbbUL,
+0x1e1152caUL, 0xaaffc418UL, 0xeb646998UL, 0x07fefcffUL,
+0x8b345e01UL, 0x567d0ebeUL, 0xbae79bd9UL, 0x4263c132UL,
+0x75b5dc7bUL, 0x97264417UL, 0x67aecb66UL, 0x95250ccbUL,
+0xec9a9567UL, 0x57862ad0UL, 0x60503799UL, 0xb8e4d305UL,
+0x65ad83baUL, 0x19efae35UL, 0xa4f6c913UL, 0xc15b4aa9UL,
+0x873e1bd6UL, 0xa0f0595eUL, 0x18148a5bUL, 0xaf02703bUL,
+0xab04e076UL, 0xdd4950bfUL, 0xdf4a1863UL, 0xc6a5b656UL,
+0x853d530aUL, 0xfa871237UL, 0x77b694a7UL, 0x4665517fUL,
+0xed61b109UL, 0x1bece6e9UL, 0xd5458525UL, 0xf5753b52UL,
+0x7fba413dUL, 0x27ce4288UL, 0xb2eb4e43UL, 0xd6bde997UL,
+0x527b9ef3UL, 0x62537f45UL, 0x2c3afba0UL, 0x7bbcd170UL,
+0xb91ff76bUL, 0x121b171dUL, 0xfd79eec8UL, 0x3a277cf0UL,
+0x0c0a45d7UL, 0x96dd6079UL, 0x2233f6abUL, 0xacfa1c89UL,
+0xc8acbb5dUL, 0xa10b7d30UL, 0xd4bea14bUL, 0xbee10b94UL,
+0x25cd0a54UL, 0x547e4662UL, 0xa2f31182UL, 0x17e6a33eUL,
+0x263566e6UL, 0xc3580275UL, 0x83388b9bUL, 0x7844bdc2UL,
+0x020348dcUL, 0x4f92a08bUL, 0x2e39b37cUL, 0x4e6984e5UL,
+0xf0888f71UL, 0x362d3927UL, 0x9cd2fd3fUL, 0x01fb246eUL,
+0x893716ddUL, 0x00000000UL, 0xf68d57e0UL, 0xe293986cUL,
+0x744ef815UL, 0x9320d45aUL, 0xad0138e7UL, 0xd3405db4UL,
+0x1a17c287UL, 0xb3106a2dUL, 0x5078d62fUL, 0xf48e1f3cUL,
+0xa70ea5a1UL, 0x71b34c36UL, 0x9ad725aeUL, 0x5e71db24UL,
+0x161d8750UL, 0xef62f9d5UL, 0x8d318690UL, 0x1c121a16UL,
+0xa6f581cfUL, 0x5b8c6f07UL, 0x37d61d49UL, 0x6e593a92UL,
+0x84c67764UL, 0x86c53fb8UL, 0xd746cdf9UL, 0xe090d0b0UL,
+0x29c74f83UL, 0xe49640fdUL, 0x0e090d0bUL, 0x6da15620UL,
+0x8ec9ea22UL, 0xdb4c882eUL, 0xf776738eUL, 0xb515b2bcUL,
+0x10185fc1UL, 0x322ba96aUL, 0x6ba48eb1UL, 0xaef95455UL,
+0x406089eeUL, 0x6655ef08UL, 0xe9672144UL, 0x3e21ecbdUL,
+0x2030be77UL, 0xf28bc7adUL, 0x80c0e729UL, 0x141ecf8cUL,
+0xbce24348UL, 0xc4a6fe8aUL, 0x31d3c5d8UL, 0xb716fa60UL,
+0x5380ba9dUL, 0xd94fc0f2UL, 0x1de93e78UL, 0x24362e3aUL,
+0xe16bf4deUL, 0xcb54d7efUL, 0x09f7f1f4UL, 0x82c3aff5UL,
+0x0bf4b928UL, 0x9d29d951UL, 0xc75e9238UL, 0xf8845aebUL,
+0x90d8b8e8UL, 0xdeb13c0dUL, 0x33d08d04UL, 0x685ce203UL,
+0xc55ddae4UL, 0x3bdc589eUL, 0x0a0f9d46UL, 0x3fdac8d3UL,
+0x598f27dbUL, 0xa8fc8cc4UL, 0x79bf99acUL, 0x6c5a724eUL,
+0x8ccaa2feUL, 0x9ed1b5e3UL, 0x1fea76a4UL, 0x73b004eaUL,
+},
+
+{
+0x02e368bcUL, 0x0c558562UL, 0x312a3f23UL, 0xf761ab13UL,
+0x7298d46dUL, 0x1921cb9aUL, 0x613c22a4UL, 0xcd459d3dUL,
+0x2305fdb4UL, 0x5f2bc407UL, 0xc09b2c01UL, 0x0f3dd980UL,
+0x74486c5cUL, 0x85f97f7eUL, 0x1ff173abUL, 0x0eb6eddeUL,
+0xed283c6bUL, 0x1a499778UL, 0x8d9f2a91UL, 0x33c9579fUL,
+0xaaa907a8UL, 0x7da50dedUL, 0x8f7c422dUL, 0xc9764db0UL,
+0x574d91e8UL, 0xcccea963UL, 0xd2b4ee96UL, 0xb63028e1UL,
+0xb90df161UL, 0x26bd1967UL, 0x80419badUL, 0xc7c0a06eUL,
+0x415183f2UL, 0x3492dbf0UL, 0xfc6fa21eUL, 0x4c8f32ceUL,
+0x7313e033UL, 0x6d69a7c6UL, 0x93e56d64UL, 0xfabf1a2fUL,
+0xb7bb1cbfUL, 0xb5587403UL, 0x4fe76e2cUL, 0x965d89b7UL,
+0x2ae89c05UL, 0xa3446619UL, 0xfb342e71UL, 0x650ff229UL,
+0x7afe8182UL, 0xf1b11322UL, 0xeca30835UL, 0x7ecd510fUL,
+0x14ff7aa6UL, 0xf85c7293UL, 0x122fc297UL, 0xc3f370e3UL,
+0x1c992f49UL, 0x68d14315UL, 0x1bc2a326UL, 0xb388cc32UL,
+0x6f8acf7aUL, 0x9fb0e806UL, 0x1e7a47f5UL, 0xdad2bb79UL,
+0x21e69508UL, 0x5c4398e5UL, 0x06d0b831UL, 0xaf11e37bUL,
+0x537e4165UL, 0x10ccaa2bUL, 0x9cd8b4e4UL, 0xd46456a7UL,
+0x59fb7c36UL, 0x84724b20UL, 0xf6ea9f4dUL, 0xdf6a5faaUL,
+0xce2dc1dfUL, 0x58704868UL, 0x81caaff3UL, 0x910605d8UL,
+0x695a774bUL, 0xa594de28UL, 0x4239df10UL, 0x47813bc3UL,
+0xa6fc82caUL, 0xc523c8d2UL, 0xb203f86cUL, 0x9a080cd5UL,
+0x40dab7acUL, 0xe17db909UL, 0x2c382434UL, 0xa2cf5247UL,
+0xd1dcb274UL, 0x2b63a85bUL, 0x9535d555UL, 0x11479e75UL,
+0xe215e5ebUL, 0xc64b9430UL, 0xa84a6f14UL, 0x8691239cUL,
+0x394c6accUL, 0x4a5f8affUL, 0x4d040690UL, 0xbbee99ddUL,
+0xca1e1152UL, 0x18aaffc4UL, 0x98eb6469UL, 0xff07fefcUL,
+0x018b345eUL, 0xbe567d0eUL, 0xd9bae79bUL, 0x324263c1UL,
+0x7b75b5dcUL, 0x17972644UL, 0x6667aecbUL, 0xcb95250cUL,
+0x67ec9a95UL, 0xd057862aUL, 0x99605037UL, 0x05b8e4d3UL,
+0xba65ad83UL, 0x3519efaeUL, 0x13a4f6c9UL, 0xa9c15b4aUL,
+0xd6873e1bUL, 0x5ea0f059UL, 0x5b18148aUL, 0x3baf0270UL,
+0x76ab04e0UL, 0xbfdd4950UL, 0x63df4a18UL, 0x56c6a5b6UL,
+0x0a853d53UL, 0x37fa8712UL, 0xa777b694UL, 0x7f466551UL,
+0x09ed61b1UL, 0xe91bece6UL, 0x25d54585UL, 0x52f5753bUL,
+0x3d7fba41UL, 0x8827ce42UL, 0x43b2eb4eUL, 0x97d6bde9UL,
+0xf3527b9eUL, 0x4562537fUL, 0xa02c3afbUL, 0x707bbcd1UL,
+0x6bb91ff7UL, 0x1d121b17UL, 0xc8fd79eeUL, 0xf03a277cUL,
+0xd70c0a45UL, 0x7996dd60UL, 0xab2233f6UL, 0x89acfa1cUL,
+0x5dc8acbbUL, 0x30a10b7dUL, 0x4bd4bea1UL, 0x94bee10bUL,
+0x5425cd0aUL, 0x62547e46UL, 0x82a2f311UL, 0x3e17e6a3UL,
+0xe6263566UL, 0x75c35802UL, 0x9b83388bUL, 0xc27844bdUL,
+0xdc020348UL, 0x8b4f92a0UL, 0x7c2e39b3UL, 0xe54e6984UL,
+0x71f0888fUL, 0x27362d39UL, 0x3f9cd2fdUL, 0x6e01fb24UL,
+0xdd893716UL, 0x00000000UL, 0xe0f68d57UL, 0x6ce29398UL,
+0x15744ef8UL, 0x5a9320d4UL, 0xe7ad0138UL, 0xb4d3405dUL,
+0x871a17c2UL, 0x2db3106aUL, 0x2f5078d6UL, 0x3cf48e1fUL,
+0xa1a70ea5UL, 0x3671b34cUL, 0xae9ad725UL, 0x245e71dbUL,
+0x50161d87UL, 0xd5ef62f9UL, 0x908d3186UL, 0x161c121aUL,
+0xcfa6f581UL, 0x075b8c6fUL, 0x4937d61dUL, 0x926e593aUL,
+0x6484c677UL, 0xb886c53fUL, 0xf9d746cdUL, 0xb0e090d0UL,
+0x8329c74fUL, 0xfde49640UL, 0x0b0e090dUL, 0x206da156UL,
+0x228ec9eaUL, 0x2edb4c88UL, 0x8ef77673UL, 0xbcb515b2UL,
+0xc110185fUL, 0x6a322ba9UL, 0xb16ba48eUL, 0x55aef954UL,
+0xee406089UL, 0x086655efUL, 0x44e96721UL, 0xbd3e21ecUL,
+0x772030beUL, 0xadf28bc7UL, 0x2980c0e7UL, 0x8c141ecfUL,
+0x48bce243UL, 0x8ac4a6feUL, 0xd831d3c5UL, 0x60b716faUL,
+0x9d5380baUL, 0xf2d94fc0UL, 0x781de93eUL, 0x3a24362eUL,
+0xdee16bf4UL, 0xefcb54d7UL, 0xf409f7f1UL, 0xf582c3afUL,
+0x280bf4b9UL, 0x519d29d9UL, 0x38c75e92UL, 0xebf8845aUL,
+0xe890d8b8UL, 0x0ddeb13cUL, 0x0433d08dUL, 0x03685ce2UL,
+0xe4c55ddaUL, 0x9e3bdc58UL, 0x460a0f9dUL, 0xd33fdac8UL,
+0xdb598f27UL, 0xc4a8fc8cUL, 0xac79bf99UL, 0x4e6c5a72UL,
+0xfe8ccaa2UL, 0xe39ed1b5UL, 0xa41fea76UL, 0xea73b004UL,
+},
+
+{
+0xbc02e368UL, 0x620c5585UL, 0x23312a3fUL, 0x13f761abUL,
+0x6d7298d4UL, 0x9a1921cbUL, 0xa4613c22UL, 0x3dcd459dUL,
+0xb42305fdUL, 0x075f2bc4UL, 0x01c09b2cUL, 0x800f3dd9UL,
+0x5c74486cUL, 0x7e85f97fUL, 0xab1ff173UL, 0xde0eb6edUL,
+0x6bed283cUL, 0x781a4997UL, 0x918d9f2aUL, 0x9f33c957UL,
+0xa8aaa907UL, 0xed7da50dUL, 0x2d8f7c42UL, 0xb0c9764dUL,
+0xe8574d91UL, 0x63cccea9UL, 0x96d2b4eeUL, 0xe1b63028UL,
+0x61b90df1UL, 0x6726bd19UL, 0xad80419bUL, 0x6ec7c0a0UL,
+0xf2415183UL, 0xf03492dbUL, 0x1efc6fa2UL, 0xce4c8f32UL,
+0x337313e0UL, 0xc66d69a7UL, 0x6493e56dUL, 0x2ffabf1aUL,
+0xbfb7bb1cUL, 0x03b55874UL, 0x2c4fe76eUL, 0xb7965d89UL,
+0x052ae89cUL, 0x19a34466UL, 0x71fb342eUL, 0x29650ff2UL,
+0x827afe81UL, 0x22f1b113UL, 0x35eca308UL, 0x0f7ecd51UL,
+0xa614ff7aUL, 0x93f85c72UL, 0x97122fc2UL, 0xe3c3f370UL,
+0x491c992fUL, 0x1568d143UL, 0x261bc2a3UL, 0x32b388ccUL,
+0x7a6f8acfUL, 0x069fb0e8UL, 0xf51e7a47UL, 0x79dad2bbUL,
+0x0821e695UL, 0xe55c4398UL, 0x3106d0b8UL, 0x7baf11e3UL,
+0x65537e41UL, 0x2b10ccaaUL, 0xe49cd8b4UL, 0xa7d46456UL,
+0x3659fb7cUL, 0x2084724bUL, 0x4df6ea9fUL, 0xaadf6a5fUL,
+0xdfce2dc1UL, 0x68587048UL, 0xf381caafUL, 0xd8910605UL,
+0x4b695a77UL, 0x28a594deUL, 0x104239dfUL, 0xc347813bUL,
+0xcaa6fc82UL, 0xd2c523c8UL, 0x6cb203f8UL, 0xd59a080cUL,
+0xac40dab7UL, 0x09e17db9UL, 0x342c3824UL, 0x47a2cf52UL,
+0x74d1dcb2UL, 0x5b2b63a8UL, 0x559535d5UL, 0x7511479eUL,
+0xebe215e5UL, 0x30c64b94UL, 0x14a84a6fUL, 0x9c869123UL,
+0xcc394c6aUL, 0xff4a5f8aUL, 0x904d0406UL, 0xddbbee99UL,
+0x52ca1e11UL, 0xc418aaffUL, 0x6998eb64UL, 0xfcff07feUL,
+0x5e018b34UL, 0x0ebe567dUL, 0x9bd9bae7UL, 0xc1324263UL,
+0xdc7b75b5UL, 0x44179726UL, 0xcb6667aeUL, 0x0ccb9525UL,
+0x9567ec9aUL, 0x2ad05786UL, 0x37996050UL, 0xd305b8e4UL,
+0x83ba65adUL, 0xae3519efUL, 0xc913a4f6UL, 0x4aa9c15bUL,
+0x1bd6873eUL, 0x595ea0f0UL, 0x8a5b1814UL, 0x703baf02UL,
+0xe076ab04UL, 0x50bfdd49UL, 0x1863df4aUL, 0xb656c6a5UL,
+0x530a853dUL, 0x1237fa87UL, 0x94a777b6UL, 0x517f4665UL,
+0xb109ed61UL, 0xe6e91becUL, 0x8525d545UL, 0x3b52f575UL,
+0x413d7fbaUL, 0x428827ceUL, 0x4e43b2ebUL, 0xe997d6bdUL,
+0x9ef3527bUL, 0x7f456253UL, 0xfba02c3aUL, 0xd1707bbcUL,
+0xf76bb91fUL, 0x171d121bUL, 0xeec8fd79UL, 0x7cf03a27UL,
+0x45d70c0aUL, 0x607996ddUL, 0xf6ab2233UL, 0x1c89acfaUL,
+0xbb5dc8acUL, 0x7d30a10bUL, 0xa14bd4beUL, 0x0b94bee1UL,
+0x0a5425cdUL, 0x4662547eUL, 0x1182a2f3UL, 0xa33e17e6UL,
+0x66e62635UL, 0x0275c358UL, 0x8b9b8338UL, 0xbdc27844UL,
+0x48dc0203UL, 0xa08b4f92UL, 0xb37c2e39UL, 0x84e54e69UL,
+0x8f71f088UL, 0x3927362dUL, 0xfd3f9cd2UL, 0x246e01fbUL,
+0x16dd8937UL, 0x00000000UL, 0x57e0f68dUL, 0x986ce293UL,
+0xf815744eUL, 0xd45a9320UL, 0x38e7ad01UL, 0x5db4d340UL,
+0xc2871a17UL, 0x6a2db310UL, 0xd62f5078UL, 0x1f3cf48eUL,
+0xa5a1a70eUL, 0x4c3671b3UL, 0x25ae9ad7UL, 0xdb245e71UL,
+0x8750161dUL, 0xf9d5ef62UL, 0x86908d31UL, 0x1a161c12UL,
+0x81cfa6f5UL, 0x6f075b8cUL, 0x1d4937d6UL, 0x3a926e59UL,
+0x776484c6UL, 0x3fb886c5UL, 0xcdf9d746UL, 0xd0b0e090UL,
+0x4f8329c7UL, 0x40fde496UL, 0x0d0b0e09UL, 0x56206da1UL,
+0xea228ec9UL, 0x882edb4cUL, 0x738ef776UL, 0xb2bcb515UL,
+0x5fc11018UL, 0xa96a322bUL, 0x8eb16ba4UL, 0x5455aef9UL,
+0x89ee4060UL, 0xef086655UL, 0x2144e967UL, 0xecbd3e21UL,
+0xbe772030UL, 0xc7adf28bUL, 0xe72980c0UL, 0xcf8c141eUL,
+0x4348bce2UL, 0xfe8ac4a6UL, 0xc5d831d3UL, 0xfa60b716UL,
+0xba9d5380UL, 0xc0f2d94fUL, 0x3e781de9UL, 0x2e3a2436UL,
+0xf4dee16bUL, 0xd7efcb54UL, 0xf1f409f7UL, 0xaff582c3UL,
+0xb9280bf4UL, 0xd9519d29UL, 0x9238c75eUL, 0x5aebf884UL,
+0xb8e890d8UL, 0x3c0ddeb1UL, 0x8d0433d0UL, 0xe203685cUL,
+0xdae4c55dUL, 0x589e3bdcUL, 0x9d460a0fUL, 0xc8d33fdaUL,
+0x27db598fUL, 0x8cc4a8fcUL, 0x99ac79bfUL, 0x724e6c5aUL,
+0xa2fe8ccaUL, 0xb5e39ed1UL, 0x76a41feaUL, 0x04ea73b0UL,
+},
+
+{
+0x68bc02e3UL, 0x85620c55UL, 0x3f23312aUL, 0xab13f761UL,
+0xd46d7298UL, 0xcb9a1921UL, 0x22a4613cUL, 0x9d3dcd45UL,
+0xfdb42305UL, 0xc4075f2bUL, 0x2c01c09bUL, 0xd9800f3dUL,
+0x6c5c7448UL, 0x7f7e85f9UL, 0x73ab1ff1UL, 0xedde0eb6UL,
+0x3c6bed28UL, 0x97781a49UL, 0x2a918d9fUL, 0x579f33c9UL,
+0x07a8aaa9UL, 0x0ded7da5UL, 0x422d8f7cUL, 0x4db0c976UL,
+0x91e8574dUL, 0xa963ccceUL, 0xee96d2b4UL, 0x28e1b630UL,
+0xf161b90dUL, 0x196726bdUL, 0x9bad8041UL, 0xa06ec7c0UL,
+0x83f24151UL, 0xdbf03492UL, 0xa21efc6fUL, 0x32ce4c8fUL,
+0xe0337313UL, 0xa7c66d69UL, 0x6d6493e5UL, 0x1a2ffabfUL,
+0x1cbfb7bbUL, 0x7403b558UL, 0x6e2c4fe7UL, 0x89b7965dUL,
+0x9c052ae8UL, 0x6619a344UL, 0x2e71fb34UL, 0xf229650fUL,
+0x81827afeUL, 0x1322f1b1UL, 0x0835eca3UL, 0x510f7ecdUL,
+0x7aa614ffUL, 0x7293f85cUL, 0xc297122fUL, 0x70e3c3f3UL,
+0x2f491c99UL, 0x431568d1UL, 0xa3261bc2UL, 0xcc32b388UL,
+0xcf7a6f8aUL, 0xe8069fb0UL, 0x47f51e7aUL, 0xbb79dad2UL,
+0x950821e6UL, 0x98e55c43UL, 0xb83106d0UL, 0xe37baf11UL,
+0x4165537eUL, 0xaa2b10ccUL, 0xb4e49cd8UL, 0x56a7d464UL,
+0x7c3659fbUL, 0x4b208472UL, 0x9f4df6eaUL, 0x5faadf6aUL,
+0xc1dfce2dUL, 0x48685870UL, 0xaff381caUL, 0x05d89106UL,
+0x774b695aUL, 0xde28a594UL, 0xdf104239UL, 0x3bc34781UL,
+0x82caa6fcUL, 0xc8d2c523UL, 0xf86cb203UL, 0x0cd59a08UL,
+0xb7ac40daUL, 0xb909e17dUL, 0x24342c38UL, 0x5247a2cfUL,
+0xb274d1dcUL, 0xa85b2b63UL, 0xd5559535UL, 0x9e751147UL,
+0xe5ebe215UL, 0x9430c64bUL, 0x6f14a84aUL, 0x239c8691UL,
+0x6acc394cUL, 0x8aff4a5fUL, 0x06904d04UL, 0x99ddbbeeUL,
+0x1152ca1eUL, 0xffc418aaUL, 0x646998ebUL, 0xfefcff07UL,
+0x345e018bUL, 0x7d0ebe56UL, 0xe79bd9baUL, 0x63c13242UL,
+0xb5dc7b75UL, 0x26441797UL, 0xaecb6667UL, 0x250ccb95UL,
+0x9a9567ecUL, 0x862ad057UL, 0x50379960UL, 0xe4d305b8UL,
+0xad83ba65UL, 0xefae3519UL, 0xf6c913a4UL, 0x5b4aa9c1UL,
+0x3e1bd687UL, 0xf0595ea0UL, 0x148a5b18UL, 0x02703bafUL,
+0x04e076abUL, 0x4950bfddUL, 0x4a1863dfUL, 0xa5b656c6UL,
+0x3d530a85UL, 0x871237faUL, 0xb694a777UL, 0x65517f46UL,
+0x61b109edUL, 0xece6e91bUL, 0x458525d5UL, 0x753b52f5UL,
+0xba413d7fUL, 0xce428827UL, 0xeb4e43b2UL, 0xbde997d6UL,
+0x7b9ef352UL, 0x537f4562UL, 0x3afba02cUL, 0xbcd1707bUL,
+0x1ff76bb9UL, 0x1b171d12UL, 0x79eec8fdUL, 0x277cf03aUL,
+0x0a45d70cUL, 0xdd607996UL, 0x33f6ab22UL, 0xfa1c89acUL,
+0xacbb5dc8UL, 0x0b7d30a1UL, 0xbea14bd4UL, 0xe10b94beUL,
+0xcd0a5425UL, 0x7e466254UL, 0xf31182a2UL, 0xe6a33e17UL,
+0x3566e626UL, 0x580275c3UL, 0x388b9b83UL, 0x44bdc278UL,
+0x0348dc02UL, 0x92a08b4fUL, 0x39b37c2eUL, 0x6984e54eUL,
+0x888f71f0UL, 0x2d392736UL, 0xd2fd3f9cUL, 0xfb246e01UL,
+0x3716dd89UL, 0x00000000UL, 0x8d57e0f6UL, 0x93986ce2UL,
+0x4ef81574UL, 0x20d45a93UL, 0x0138e7adUL, 0x405db4d3UL,
+0x17c2871aUL, 0x106a2db3UL, 0x78d62f50UL, 0x8e1f3cf4UL,
+0x0ea5a1a7UL, 0xb34c3671UL, 0xd725ae9aUL, 0x71db245eUL,
+0x1d875016UL, 0x62f9d5efUL, 0x3186908dUL, 0x121a161cUL,
+0xf581cfa6UL, 0x8c6f075bUL, 0xd61d4937UL, 0x593a926eUL,
+0xc6776484UL, 0xc53fb886UL, 0x46cdf9d7UL, 0x90d0b0e0UL,
+0xc74f8329UL, 0x9640fde4UL, 0x090d0b0eUL, 0xa156206dUL,
+0xc9ea228eUL, 0x4c882edbUL, 0x76738ef7UL, 0x15b2bcb5UL,
+0x185fc110UL, 0x2ba96a32UL, 0xa48eb16bUL, 0xf95455aeUL,
+0x6089ee40UL, 0x55ef0866UL, 0x672144e9UL, 0x21ecbd3eUL,
+0x30be7720UL, 0x8bc7adf2UL, 0xc0e72980UL, 0x1ecf8c14UL,
+0xe24348bcUL, 0xa6fe8ac4UL, 0xd3c5d831UL, 0x16fa60b7UL,
+0x80ba9d53UL, 0x4fc0f2d9UL, 0xe93e781dUL, 0x362e3a24UL,
+0x6bf4dee1UL, 0x54d7efcbUL, 0xf7f1f409UL, 0xc3aff582UL,
+0xf4b9280bUL, 0x29d9519dUL, 0x5e9238c7UL, 0x845aebf8UL,
+0xd8b8e890UL, 0xb13c0ddeUL, 0xd08d0433UL, 0x5ce20368UL,
+0x5ddae4c5UL, 0xdc589e3bUL, 0x0f9d460aUL, 0xdac8d33fUL,
+0x8f27db59UL, 0xfc8cc4a8UL, 0xbf99ac79UL, 0x5a724e6cUL,
+0xcaa2fe8cUL, 0xd1b5e39eUL, 0xea76a41fUL, 0xb004ea73UL,
+}};
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/sse_simd.cpp b/runtime/third_party/cryptopp/sse_simd.cpp
new file mode 100644
index 0000000..9e0cff4
--- /dev/null
+++ b/runtime/third_party/cryptopp/sse_simd.cpp
@@ -0,0 +1,115 @@
+// sse_simd.cpp - written and placed in the public domain by
+//                Jeffrey Walton, Uri Blumenthal and Marcel Raad.
+//
+//    This source file uses intrinsics to gain access to SSE for CPU
+//    feature testing. A separate source file is needed because additional
+//    CXXFLAGS are required to enable the appropriate instructions set in
+//    some build configurations.
+
+#include "pch.h"
+#include "config.h"
+#include "cpu.h"
+
+// Needed by MIPS for definition of NULL
+#include "stdcpp.h"
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+# include <signal.h>
+# include <setjmp.h>
+#endif
+
+#ifndef EXCEPTION_EXECUTE_HANDLER
+# define EXCEPTION_EXECUTE_HANDLER 1
+#endif
+
+// Needed by SunCC and MSVC
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+# if !defined(CRYPTOPP_NO_CPU_FEATURE_PROBES) && !CRYPTOPP_SSE2_ASM_AVAILABLE && CRYPTOPP_SSE2_INTRIN_AVAILABLE
+#  include <emmintrin.h>
+# endif
+#endif
+
+// Squash MS LNK4221 and libtool warnings
+extern const char SSE_SIMD_FNAME[] = __FILE__;
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#ifdef CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+extern "C" {
+    typedef void (*SigHandler)(int);
+}
+
+extern "C"
+{
+    static jmp_buf s_jmpNoSSE2;
+    static void SigIllHandler(int)
+    {
+        longjmp(s_jmpNoSSE2, 1);
+    }
+}
+#endif  // CRYPTOPP_GNU_STYLE_INLINE_ASSEMBLY
+
+bool CPU_ProbeSSE2()
+{
+    // Apple switched to Intel desktops in 2005/2006 using
+    //   Core2 Duo's, which provides SSE2 and above.
+#if CRYPTOPP_BOOL_X64 || defined(__APPLE__)
+    return true;
+#elif defined(CRYPTOPP_NO_CPU_FEATURE_PROBES)
+    return false;
+#elif defined(CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY)
+    __try
+    {
+# if CRYPTOPP_SSE2_ASM_AVAILABLE
+        AS2(por xmm0, xmm0)        // executing SSE2 instruction
+# elif CRYPTOPP_SSE2_INTRIN_AVAILABLE
+        __m128i x = _mm_setzero_si128();
+        return _mm_cvtsi128_si32(x) == 0;
+# endif
+    }
+    // GetExceptionCode() == EXCEPTION_ILLEGAL_INSTRUCTION
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        return false;
+    }
+    return true;
+#else
+    // longjmp and clobber warnings. Volatile is required.
+    // http://github.com/weidai11/cryptopp/issues/24 and http://stackoverflow.com/q/7721854
+    volatile bool result = true;
+
+    volatile SigHandler oldHandler = signal(SIGILL, SigIllHandler);
+    if (oldHandler == SIG_ERR)
+        return false;
+
+# ifndef __MINGW32__
+    volatile sigset_t oldMask;
+    if (sigprocmask(0, NULLPTR, (sigset_t*)&oldMask))
+    {
+        signal(SIGILL, oldHandler);
+        return false;
+    }
+# endif
+
+    if (setjmp(s_jmpNoSSE2))
+        result = false;
+    else
+    {
+# if CRYPTOPP_SSE2_ASM_AVAILABLE
+        __asm __volatile ("por %xmm0, %xmm0");
+# elif CRYPTOPP_SSE2_INTRIN_AVAILABLE
+        __m128i x = _mm_setzero_si128();
+        result = _mm_cvtsi128_si32(x) == 0;
+# endif
+    }
+
+# ifndef __MINGW32__
+    sigprocmask(SIG_SETMASK, (sigset_t*)&oldMask, NULLPTR);
+# endif
+
+    signal(SIGILL, oldHandler);
+    return result;
+#endif
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/stdcpp.h b/runtime/third_party/cryptopp/stdcpp.h
new file mode 100644
index 0000000..4b5d842
--- /dev/null
+++ b/runtime/third_party/cryptopp/stdcpp.h
@@ -0,0 +1,101 @@
+// stdcpp.h - originally written and placed in the public domain by Wei Dai
+
+/// \file stdcpp.h
+/// \brief Common C++ header files
+
+#ifndef CRYPTOPP_STDCPP_H
+#define CRYPTOPP_STDCPP_H
+
+#if (CRYPTOPP_MSC_VERSION >= 1500)
+#define _DO_NOT_DECLARE_INTERLOCKED_INTRINSICS_IN_MEMORY
+#include <intrin.h>
+#endif
+
+#include <string>
+#include <memory>
+#include <exception>
+#include <typeinfo>
+#include <algorithm>
+#include <functional>
+#include <utility>
+#include <vector>
+#include <limits>
+#include <deque>
+#include <list>
+#include <map>
+#include <new>
+
+// http://connect.microsoft.com/VisualStudio/feedback/details/1600701/type-info-does-not-compile-with-has-exceptions-0
+#if defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION < 1900) && defined(_HAS_EXCEPTIONS) && (_HAS_EXCEPTIONS == 0)
+namespace std {
+  using ::type_info;
+}
+#endif
+
+// workaround needed for IBM XLC and debug heaps on AIX
+#if defined(_AIX) && (defined(__xlc__) || defined(__xlC__) || defined(__ibmxl__))
+# if defined(__DEBUG_ALLOC__)
+namespace std {
+  using ::_debug_memset;
+  using ::_debug_memcpy;
+}
+# endif
+#endif
+
+// make_unchecked_array_iterator
+#if (CRYPTOPP_MSC_VERSION >= 1600)
+#include <iterator>
+#endif
+
+#if defined(CRYPTOPP_CXX11_ATOMIC)
+#include <atomic>
+#endif
+
+#if defined(CRYPTOPP_CXX11_SYNCHRONIZATION)
+#include <mutex>
+#endif
+
+#if defined(CRYPTOPP_CXX11_RVALUES)
+# include <utility>
+#endif
+
+#include <cstdlib>
+#include <cstring>
+#include <climits>
+#include <cmath>
+
+// It is 2019 and VS2017/Win10 still can't compile a
+// program that includes <cstddef> without making users
+// do something special. "Epic fail" comes to mind.
+// Also see https://github.com/weidai11/cryptopp/issues/781
+#ifndef CRYPTOPP_MSC_VERSION
+# include <cstddef>
+#endif
+
+// uintptr_t and ptrdiff_t
+#if defined(__SUNPRO_CC)
+# if (__SUNPRO_CC >= 0x5100)
+#  include <stdint.h>
+# endif
+#elif defined(CRYPTOPP_MSC_VERSION)
+# if (CRYPTOPP_MSC_VERSION >= 1700)
+#  include <stdint.h>
+# else
+#  include <stddef.h>
+# endif
+#elif (__cplusplus < 201103L)
+# include <stdint.h>
+#endif
+
+// workaround needed on Sun Studio 12u1 Sun C++ 5.10 SunOS_i386 128229-02 2009/09/21
+#ifdef CRYPTOPP_INCLUDE_VECTOR_CC
+# include <vector.cc>
+#endif
+
+// C++Builder's standard library (Dinkumware) do not have C's global log() function
+// https://github.com/weidai11/cryptopp/issues/520
+#ifdef __BORLANDC__
+using std::log;
+#endif
+
+#endif  // CRYPTOPP_STDCPP_H
diff --git a/runtime/third_party/cryptopp/strciphr.cpp b/runtime/third_party/cryptopp/strciphr.cpp
new file mode 100644
index 0000000..87bb846
--- /dev/null
+++ b/runtime/third_party/cryptopp/strciphr.cpp
@@ -0,0 +1,259 @@
+// strciphr.cpp - originally written and placed in the public domain by Wei Dai.
+
+#include "pch.h"
+
+#ifndef CRYPTOPP_IMPORTS
+
+#include "strciphr.h"
+
+// Squash MS LNK4221 and libtool warnings
+#ifndef CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES
+extern const char STRCIPHER_FNAME[] = __FILE__;
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+template <class S>
+void AdditiveCipherTemplate<S>::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	PolicyInterface &policy = this->AccessPolicy();
+	policy.CipherSetKey(params, key, length);
+	m_leftOver = 0;
+	unsigned int bufferByteSize = policy.CanOperateKeystream() ? GetBufferByteSize(policy) : RoundUpToMultipleOf(1024U, GetBufferByteSize(policy));
+	m_buffer.New(bufferByteSize);
+
+	if (this->IsResynchronizable())
+	{
+		size_t ivLength;
+		const byte *iv = this->GetIVAndThrowIfInvalid(params, ivLength);
+		policy.CipherResynchronize(m_buffer, iv, ivLength);
+	}
+}
+
+template <class S>
+void AdditiveCipherTemplate<S>::GenerateBlock(byte *outString, size_t length)
+{
+	if (m_leftOver > 0)
+	{
+		const size_t len = STDMIN(m_leftOver, length);
+		std::memcpy(outString, PtrSub(KeystreamBufferEnd(), m_leftOver), len);
+
+		length -= len; m_leftOver -= len;
+		outString = PtrAdd(outString, len);
+		if (!length) {return;}
+	}
+
+	PolicyInterface &policy = this->AccessPolicy();
+	size_t bytesPerIteration = policy.GetBytesPerIteration();
+
+	if (length >= bytesPerIteration)
+	{
+		const size_t iterations = length / bytesPerIteration;
+		policy.WriteKeystream(outString, iterations);
+		length -= iterations * bytesPerIteration;
+		outString = PtrAdd(outString, iterations * bytesPerIteration);
+	}
+
+	if (length > 0)
+	{
+		size_t bufferByteSize = RoundUpToMultipleOf(length, bytesPerIteration);
+		size_t bufferIterations = bufferByteSize / bytesPerIteration;
+
+		policy.WriteKeystream(PtrSub(KeystreamBufferEnd(), bufferByteSize), bufferIterations);
+		std::memcpy(outString, PtrSub(KeystreamBufferEnd(), bufferByteSize), length);
+		m_leftOver = bufferByteSize - length;
+	}
+}
+
+template <class S>
+void AdditiveCipherTemplate<S>::ProcessData(byte *outString, const byte *inString, size_t length)
+{
+	CRYPTOPP_ASSERT(outString); CRYPTOPP_ASSERT(inString);
+	CRYPTOPP_ASSERT(length % this->MandatoryBlockSize() == 0);
+
+	PolicyInterface &policy = this->AccessPolicy();
+	size_t bytesPerIteration = policy.GetBytesPerIteration();
+
+	if (m_leftOver > 0)
+	{
+		const size_t len = STDMIN(m_leftOver, length);
+		xorbuf(outString, inString, PtrSub(KeystreamBufferEnd(), m_leftOver), len);
+
+		inString = PtrAdd(inString, len);
+		outString = PtrAdd(outString, len);
+		length -= len; m_leftOver -= len;
+	}
+
+	if (!length) { return; }
+
+	const word32 alignment = policy.GetAlignment();
+	const bool inAligned = IsAlignedOn(inString, alignment);
+	const bool outAligned = IsAlignedOn(outString, alignment);
+	CRYPTOPP_UNUSED(inAligned); CRYPTOPP_UNUSED(outAligned);
+
+	if (policy.CanOperateKeystream() && length >= bytesPerIteration)
+	{
+		const size_t iterations = length / bytesPerIteration;
+		KeystreamOperationFlags flags = static_cast<KeystreamOperationFlags>(
+			(inAligned ? EnumToInt(INPUT_ALIGNED) : 0) | (outAligned ? EnumToInt(OUTPUT_ALIGNED) : 0));
+		KeystreamOperation operation = KeystreamOperation(flags);
+		policy.OperateKeystream(operation, outString, inString, iterations);
+
+		inString = PtrAdd(inString, iterations * bytesPerIteration);
+		outString = PtrAdd(outString, iterations * bytesPerIteration);
+		length -= iterations * bytesPerIteration;
+	}
+
+	size_t bufferByteSize = m_buffer.size();
+	size_t bufferIterations = bufferByteSize / bytesPerIteration;
+
+	while (length >= bufferByteSize)
+	{
+		policy.WriteKeystream(m_buffer, bufferIterations);
+		xorbuf(outString, inString, KeystreamBufferBegin(), bufferByteSize);
+
+		inString = PtrAdd(inString, bufferByteSize);
+		outString = PtrAdd(outString, bufferByteSize);
+		length -= bufferByteSize;
+	}
+
+	if (length > 0)
+	{
+		bufferByteSize = RoundUpToMultipleOf(length, bytesPerIteration);
+		bufferIterations = bufferByteSize / bytesPerIteration;
+
+		policy.WriteKeystream(PtrSub(KeystreamBufferEnd(), bufferByteSize), bufferIterations);
+		xorbuf(outString, inString, PtrSub(KeystreamBufferEnd(), bufferByteSize), length);
+
+		m_leftOver = bufferByteSize - length;
+	}
+}
+
+template <class S>
+void AdditiveCipherTemplate<S>::Resynchronize(const byte *iv, int length)
+{
+	PolicyInterface &policy = this->AccessPolicy();
+	m_leftOver = 0;
+	m_buffer.New(GetBufferByteSize(policy));
+	policy.CipherResynchronize(m_buffer, iv, this->ThrowIfInvalidIVLength(length));
+}
+
+template <class BASE>
+void AdditiveCipherTemplate<BASE>::Seek(lword position)
+{
+	PolicyInterface &policy = this->AccessPolicy();
+	unsigned int bytesPerIteration = policy.GetBytesPerIteration();
+
+	policy.SeekToIteration(position / bytesPerIteration);
+	position %= bytesPerIteration;
+
+	if (position > 0)
+	{
+		policy.WriteKeystream(PtrSub(KeystreamBufferEnd(), bytesPerIteration), 1);
+		m_leftOver = bytesPerIteration - static_cast<unsigned int>(position);
+	}
+	else
+		m_leftOver = 0;
+}
+
+template <class BASE>
+void CFB_CipherTemplate<BASE>::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+{
+	PolicyInterface &policy = this->AccessPolicy();
+	policy.CipherSetKey(params, key, length);
+
+	if (this->IsResynchronizable())
+	{
+		size_t ivLength;
+		const byte *iv = this->GetIVAndThrowIfInvalid(params, ivLength);
+		policy.CipherResynchronize(iv, ivLength);
+	}
+
+	m_leftOver = policy.GetBytesPerIteration();
+}
+
+template <class BASE>
+void CFB_CipherTemplate<BASE>::Resynchronize(const byte *iv, int length)
+{
+	PolicyInterface &policy = this->AccessPolicy();
+	policy.CipherResynchronize(iv, this->ThrowIfInvalidIVLength(length));
+	m_leftOver = policy.GetBytesPerIteration();
+}
+
+template <class BASE>
+void CFB_CipherTemplate<BASE>::ProcessData(byte *outString, const byte *inString, size_t length)
+{
+	CRYPTOPP_ASSERT(outString); CRYPTOPP_ASSERT(inString);
+	CRYPTOPP_ASSERT(length % this->MandatoryBlockSize() == 0);
+
+	PolicyInterface &policy = this->AccessPolicy();
+	unsigned int bytesPerIteration = policy.GetBytesPerIteration();
+	byte *reg = policy.GetRegisterBegin();
+
+	if (m_leftOver)
+	{
+		const size_t len = STDMIN(m_leftOver, length);
+		CombineMessageAndShiftRegister(outString, PtrAdd(reg, bytesPerIteration - m_leftOver), inString, len);
+
+		inString = PtrAdd(inString, len);
+		outString = PtrAdd(outString, len);
+		m_leftOver -= len; length -= len;
+	}
+
+	if (!length) { return; }
+
+	const word32 alignment = policy.GetAlignment();
+	const bool inAligned = IsAlignedOn(inString, alignment);
+	const bool outAligned = IsAlignedOn(outString, alignment);
+	CRYPTOPP_UNUSED(inAligned); CRYPTOPP_UNUSED(outAligned);
+
+	if (policy.CanIterate() && length >= bytesPerIteration && outAligned)
+	{
+		CipherDir cipherDir = GetCipherDir(*this);
+		policy.Iterate(outString, inString, cipherDir, length / bytesPerIteration);
+
+		const size_t remainder = length % bytesPerIteration;
+		inString = PtrAdd(inString, length - remainder);
+		outString = PtrAdd(outString, length - remainder);
+		length = remainder;
+	}
+
+	while (length >= bytesPerIteration)
+	{
+		policy.TransformRegister();
+		CombineMessageAndShiftRegister(outString, reg, inString, bytesPerIteration);
+
+		inString = PtrAdd(inString, bytesPerIteration);
+		outString = PtrAdd(outString, bytesPerIteration);
+		length -= bytesPerIteration;
+	}
+
+	if (length > 0)
+	{
+		policy.TransformRegister();
+		CombineMessageAndShiftRegister(outString, reg, inString, length);
+		m_leftOver = bytesPerIteration - length;
+	}
+}
+
+template <class BASE>
+void CFB_EncryptionTemplate<BASE>::CombineMessageAndShiftRegister(byte *output, byte *reg, const byte *message, size_t length)
+{
+	xorbuf(reg, message, length);
+	std::memcpy(output, reg, length);
+}
+
+template <class BASE>
+void CFB_DecryptionTemplate<BASE>::CombineMessageAndShiftRegister(byte *output, byte *reg, const byte *message, size_t length)
+{
+	for (size_t i=0; i<length; i++)
+	{
+		byte b = message[i];
+		output[i] = reg[i] ^ b;
+		reg[i] = b;
+	}
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/strciphr.h b/runtime/third_party/cryptopp/strciphr.h
new file mode 100644
index 0000000..ef8989d
--- /dev/null
+++ b/runtime/third_party/cryptopp/strciphr.h
@@ -0,0 +1,737 @@
+// strciphr.h - originally written and placed in the public domain by Wei Dai
+
+/// \file strciphr.h
+/// \brief Classes for implementing stream ciphers
+/// \details This file contains helper classes for implementing stream ciphers.
+///  All this infrastructure may look very complex compared to what's in Crypto++ 4.x,
+///  but stream ciphers implementations now support a lot of new functionality,
+///  including better performance (minimizing copying), resetting of keys and IVs, and
+///  methods to query which features are supported by a cipher.
+/// \details Here's an explanation of these classes. The word "policy" is used here to
+///  mean a class with a set of methods that must be implemented by individual stream
+///  cipher implementations. This is usually much simpler than the full stream cipher
+///  API, which is implemented by either AdditiveCipherTemplate or CFB_CipherTemplate
+///  using the policy. So for example, an implementation of SEAL only needs to implement
+///  the AdditiveCipherAbstractPolicy interface (since it's an additive cipher, i.e., it
+///  xors a keystream into the plaintext). See this line in seal.h:
+/// <pre>
+///     typedef SymmetricCipherFinal\<ConcretePolicyHolder\<SEAL_Policy\<B\>, AdditiveCipherTemplate\<\> \> \> Encryption;
+/// </pre>
+/// \details AdditiveCipherTemplate and CFB_CipherTemplate are designed so that they don't
+///  need to take a policy class as a template parameter (although this is allowed), so
+///  that their code is not duplicated for each new cipher. Instead they each get a
+///  reference to an abstract policy interface by calling AccessPolicy() on itself, so
+///  AccessPolicy() must be overridden to return the actual policy reference. This is done
+///  by the ConcretePolicyHolder class. Finally, SymmetricCipherFinal implements the
+///  constructors and other functions that must be implemented by the most derived class.
+
+#ifndef CRYPTOPP_STRCIPHR_H
+#define CRYPTOPP_STRCIPHR_H
+
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(push)
+# pragma warning(disable: 4127 4189 4231 4275)
+#endif
+
+#include "cryptlib.h"
+#include "seckey.h"
+#include "secblock.h"
+#include "argnames.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Access a stream cipher policy object
+/// \tparam POLICY_INTERFACE class implementing AbstractPolicyHolder
+/// \tparam BASE class or type to use as a base class
+template <class POLICY_INTERFACE, class BASE = Empty>
+class CRYPTOPP_NO_VTABLE AbstractPolicyHolder : public BASE
+{
+public:
+	typedef POLICY_INTERFACE PolicyInterface;
+	virtual ~AbstractPolicyHolder() {}
+
+protected:
+	virtual const POLICY_INTERFACE & GetPolicy() const =0;
+	virtual POLICY_INTERFACE & AccessPolicy() =0;
+};
+
+/// \brief Stream cipher policy object
+/// \tparam POLICY class implementing AbstractPolicyHolder
+/// \tparam BASE class or type to use as a base class
+template <class POLICY, class BASE, class POLICY_INTERFACE = typename BASE::PolicyInterface>
+class ConcretePolicyHolder : public BASE, protected POLICY
+{
+public:
+	virtual ~ConcretePolicyHolder() {}
+protected:
+	const POLICY_INTERFACE & GetPolicy() const {return *this;}
+	POLICY_INTERFACE & AccessPolicy() {return *this;}
+};
+
+/// \brief Keystream operation flags
+/// \sa AdditiveCipherAbstractPolicy::GetBytesPerIteration(), AdditiveCipherAbstractPolicy::GetOptimalBlockSize()
+///  and AdditiveCipherAbstractPolicy::GetAlignment()
+enum KeystreamOperationFlags {
+	/// \brief Output buffer is aligned
+	OUTPUT_ALIGNED=1,
+	/// \brief Input buffer is aligned
+	INPUT_ALIGNED=2,
+	/// \brief Input buffer is NULL
+	INPUT_NULL = 4
+};
+
+/// \brief Keystream operation flags
+/// \sa AdditiveCipherAbstractPolicy::GetBytesPerIteration(), AdditiveCipherAbstractPolicy::GetOptimalBlockSize()
+///  and AdditiveCipherAbstractPolicy::GetAlignment()
+enum KeystreamOperation {
+	/// \brief Write the keystream to the output buffer, input is NULL
+	WRITE_KEYSTREAM				= INPUT_NULL,
+	/// \brief Write the keystream to the aligned output buffer, input is NULL
+	WRITE_KEYSTREAM_ALIGNED		= INPUT_NULL | OUTPUT_ALIGNED,
+	/// \brief XOR the input buffer and keystream, write to the output buffer
+	XOR_KEYSTREAM				= 0,
+	/// \brief XOR the aligned input buffer and keystream, write to the output buffer
+	XOR_KEYSTREAM_INPUT_ALIGNED = INPUT_ALIGNED,
+	/// \brief XOR the input buffer and keystream, write to the aligned output buffer
+	XOR_KEYSTREAM_OUTPUT_ALIGNED= OUTPUT_ALIGNED,
+	/// \brief XOR the aligned input buffer and keystream, write to the aligned output buffer
+	XOR_KEYSTREAM_BOTH_ALIGNED	= OUTPUT_ALIGNED | INPUT_ALIGNED
+};
+
+/// \brief Policy object for additive stream ciphers
+struct CRYPTOPP_DLL CRYPTOPP_NO_VTABLE AdditiveCipherAbstractPolicy
+{
+	virtual ~AdditiveCipherAbstractPolicy() {}
+
+	/// \brief Provides data alignment requirements
+	/// \return data alignment requirements, in bytes
+	/// \details Internally, the default implementation returns 1. If the stream cipher is implemented
+	///  using an SSE2 ASM or intrinsics, then the value returned is usually 16.
+	virtual unsigned int GetAlignment() const {return 1;}
+
+	/// \brief Provides number of bytes operated upon during an iteration
+	/// \return bytes operated upon during an iteration, in bytes
+	/// \sa GetOptimalBlockSize()
+	virtual unsigned int GetBytesPerIteration() const =0;
+
+	/// \brief Provides number of ideal bytes to process
+	/// \return the ideal number of bytes to process
+	/// \details Internally, the default implementation returns GetBytesPerIteration()
+	/// \sa GetBytesPerIteration()
+	virtual unsigned int GetOptimalBlockSize() const {return GetBytesPerIteration();}
+
+	/// \brief Provides buffer size based on iterations
+	/// \return the buffer size based on iterations, in bytes
+	virtual unsigned int GetIterationsToBuffer() const =0;
+
+	/// \brief Generate the keystream
+	/// \param keystream the key stream
+	/// \param iterationCount the number of iterations to generate the key stream
+	/// \sa CanOperateKeystream(), OperateKeystream(), WriteKeystream()
+	virtual void WriteKeystream(byte *keystream, size_t iterationCount)
+		{OperateKeystream(KeystreamOperation(INPUT_NULL | static_cast<KeystreamOperationFlags>(IsAlignedOn(keystream, GetAlignment()))), keystream, NULLPTR, iterationCount);}
+
+	/// \brief Flag indicating
+	/// \return true if the stream can be generated independent of the transformation input, false otherwise
+	/// \sa CanOperateKeystream(), OperateKeystream(), WriteKeystream()
+	virtual bool CanOperateKeystream() const {return false;}
+
+	/// \brief Operates the keystream
+	/// \param operation the operation with additional flags
+	/// \param output the output buffer
+	/// \param input the input buffer
+	/// \param iterationCount the number of iterations to perform on the input
+	/// \details OperateKeystream() will attempt to operate upon GetOptimalBlockSize() buffer,
+	///  which will be derived from GetBytesPerIteration().
+	/// \sa CanOperateKeystream(), OperateKeystream(), WriteKeystream(), KeystreamOperation()
+	virtual void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+		{CRYPTOPP_UNUSED(operation); CRYPTOPP_UNUSED(output); CRYPTOPP_UNUSED(input);
+		CRYPTOPP_UNUSED(iterationCount); CRYPTOPP_ASSERT(false);}
+
+	/// \brief Key the cipher
+	/// \param params set of NameValuePairs use to initialize this object
+	/// \param key a byte array used to key the cipher
+	/// \param length the size of the key array
+	virtual void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length) =0;
+
+	/// \brief Resynchronize the cipher
+	/// \param keystreamBuffer the keystream buffer
+	/// \param iv a byte array used to resynchronize the cipher
+	/// \param length the size of the IV array
+	virtual void CipherResynchronize(byte *keystreamBuffer, const byte *iv, size_t length)
+		{CRYPTOPP_UNUSED(keystreamBuffer); CRYPTOPP_UNUSED(iv); CRYPTOPP_UNUSED(length);
+		throw NotImplemented("SimpleKeyingInterface: this object doesn't support resynchronization");}
+
+	/// \brief Flag indicating random access
+	/// \return true if the cipher is seekable, false otherwise
+	/// \sa SeekToIteration()
+	virtual bool CipherIsRandomAccess() const =0;
+
+	/// \brief Seeks to a random position in the stream
+	/// \sa CipherIsRandomAccess()
+	virtual void SeekToIteration(lword iterationCount)
+		{CRYPTOPP_UNUSED(iterationCount); CRYPTOPP_ASSERT(!CipherIsRandomAccess());
+		throw NotImplemented("StreamTransformation: this object doesn't support random access");}
+
+	/// \brief Retrieve the provider of this algorithm
+	/// \return the algorithm provider
+	/// \details The algorithm provider can be a name like "C++", "SSE", "NEON", "AESNI",
+	///  "ARMv8" and "Power8". C++ is standard C++ code. Other labels, like SSE,
+	///  usually indicate a specialized implementation using instructions from a higher
+	///  instruction set architecture (ISA). Future labels may include external hardware
+	///  like a hardware security module (HSM).
+	/// \details Generally speaking Wei Dai's original IA-32 ASM code falls under "SSE2".
+	///  Labels like "SSSE3" and "SSE4.1" follow after Wei's code and use intrinsics
+	///  instead of ASM.
+	/// \details Algorithms which combine different instructions or ISAs provide the
+	///  dominant one. For example on x86 <tt>AES/GCM</tt> returns "AESNI" rather than
+	///  "CLMUL" or "AES+SSE4.1" or "AES+CLMUL" or "AES+SSE4.1+CLMUL".
+	/// \note Provider is not universally implemented yet.
+	virtual std::string AlgorithmProvider() const { return "C++"; }
+};
+
+/// \brief Base class for additive stream ciphers
+/// \tparam WT word type
+/// \tparam W count of words
+/// \tparam X bytes per iteration count
+/// \tparam BASE AdditiveCipherAbstractPolicy derived base class
+template <typename WT, unsigned int W, unsigned int X = 1, class BASE = AdditiveCipherAbstractPolicy>
+struct CRYPTOPP_NO_VTABLE AdditiveCipherConcretePolicy : public BASE
+{
+	/// \brief Word type for the cipher
+	typedef WT WordType;
+
+	/// \brief Number of bytes for an iteration
+	/// \details BYTES_PER_ITERATION is the product <tt>sizeof(WordType) * W</tt>.
+	///  For example, ChaCha uses 16 each <tt>word32</tt>, and the value of
+	///  BYTES_PER_ITERATION is 64. Each invocation of the ChaCha block function
+	///  produces 64 bytes of keystream.
+	CRYPTOPP_CONSTANT(BYTES_PER_ITERATION = sizeof(WordType) * W);
+
+	virtual ~AdditiveCipherConcretePolicy() {}
+
+	/// \brief Provides data alignment requirements
+	/// \return data alignment requirements, in bytes
+	/// \details Internally, the default implementation returns 1. If the stream
+	///  cipher is implemented using an SSE2 ASM or intrinsics, then the value
+	///  returned is usually 16.
+	unsigned int GetAlignment() const {return GetAlignmentOf<WordType>();}
+
+	/// \brief Provides number of bytes operated upon during an iteration
+	/// \return bytes operated upon during an iteration, in bytes
+	/// \sa GetOptimalBlockSize()
+	unsigned int GetBytesPerIteration() const {return BYTES_PER_ITERATION;}
+
+	/// \brief Provides buffer size based on iterations
+	/// \return the buffer size based on iterations, in bytes
+	unsigned int GetIterationsToBuffer() const {return X;}
+
+	/// \brief Flag indicating
+	/// \return true if the stream can be generated independent of the
+	///  transformation input, false otherwise
+	/// \sa CanOperateKeystream(), OperateKeystream(), WriteKeystream()
+	bool CanOperateKeystream() const {return true;}
+
+	/// \brief Operates the keystream
+	/// \param operation the operation with additional flags
+	/// \param output the output buffer
+	/// \param input the input buffer
+	/// \param iterationCount the number of iterations to perform on the input
+	/// \details OperateKeystream() will attempt to operate upon GetOptimalBlockSize() buffer,
+	///  which will be derived from GetBytesPerIteration().
+	/// \sa CanOperateKeystream(), OperateKeystream(), WriteKeystream(), KeystreamOperation()
+	virtual void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount) =0;
+};
+
+/// \brief Helper macro to implement OperateKeystream
+/// \param x KeystreamOperation mask
+/// \param b Endian order
+/// \param i index in output buffer
+/// \param a value to output
+#define CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, b, i, a)	\
+	PutWord(((x & OUTPUT_ALIGNED) != 0), b, output+i*sizeof(WordType), (x & INPUT_NULL) ? (a) : (a) ^ GetWord<WordType>(((x & INPUT_ALIGNED) != 0), b, input+i*sizeof(WordType)));
+
+/// \brief Helper macro to implement OperateKeystream
+/// \param x KeystreamOperation mask
+/// \param i index in output buffer
+/// \param a value to output
+#define CRYPTOPP_KEYSTREAM_OUTPUT_XMM(x, i, a)	{\
+	__m128i t = (x & INPUT_NULL) ? a : _mm_xor_si128(a, (x & INPUT_ALIGNED) ? _mm_load_si128((__m128i *)input+i) : _mm_loadu_si128((__m128i *)input+i));\
+	if (x & OUTPUT_ALIGNED) _mm_store_si128((__m128i *)output+i, t);\
+	else _mm_storeu_si128((__m128i *)output+i, t);}
+
+/// \brief Helper macro to implement OperateKeystream
+#define CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(x, y)		\
+	switch (operation)								\
+	{												\
+		case WRITE_KEYSTREAM:						\
+			x(EnumToInt(WRITE_KEYSTREAM))	\
+			break;									\
+		case XOR_KEYSTREAM:							\
+			x(EnumToInt(XOR_KEYSTREAM))		\
+			input += y;								\
+			break;									\
+		case XOR_KEYSTREAM_INPUT_ALIGNED:			\
+			x(EnumToInt(XOR_KEYSTREAM_INPUT_ALIGNED))		\
+			input += y;								\
+			break;									\
+		case XOR_KEYSTREAM_OUTPUT_ALIGNED:			\
+			x(EnumToInt(XOR_KEYSTREAM_OUTPUT_ALIGNED))		\
+			input += y;								\
+			break;									\
+		case WRITE_KEYSTREAM_ALIGNED:				\
+			x(EnumToInt(WRITE_KEYSTREAM_ALIGNED))			\
+			break;									\
+		case XOR_KEYSTREAM_BOTH_ALIGNED:			\
+			x(EnumToInt(XOR_KEYSTREAM_BOTH_ALIGNED))		\
+			input += y;								\
+			break;									\
+	}												\
+	output += y;
+
+/// \brief Base class for additive stream ciphers with SymmetricCipher interface
+/// \tparam BASE AbstractPolicyHolder base class
+template <class BASE = AbstractPolicyHolder<AdditiveCipherAbstractPolicy, SymmetricCipher> >
+class CRYPTOPP_NO_VTABLE AdditiveCipherTemplate : public BASE, public RandomNumberGenerator
+{
+public:
+	virtual ~AdditiveCipherTemplate() {}
+	AdditiveCipherTemplate() : m_leftOver(0) {}
+
+	/// \brief Generate random array of bytes
+	/// \param output the byte buffer
+	/// \param size the length of the buffer, in bytes
+	/// \details All generated values are uniformly distributed over the range specified
+	///  within the constraints of a particular generator.
+	void GenerateBlock(byte *output, size_t size);
+
+	/// \brief Apply keystream to data
+	/// \param outString a buffer to write the transformed data
+	/// \param inString a buffer to read the data
+	/// \param length the size of the buffers, in bytes
+	/// \details This is the primary method to operate a stream cipher. For example:
+	/// <pre>
+	///     size_t size = 30;
+	///     byte plain[size] = "Do or do not; there is no try";
+	///     byte cipher[size];
+	///     ...
+	///     ChaCha20 chacha(key, keySize);
+	///     chacha.ProcessData(cipher, plain, size);
+	/// </pre>
+	/// \details You should use distinct buffers for inString and outString. If the buffers
+	///  are the same, then the data will be copied to an internal buffer to avoid GCC alias
+	///  violations. The internal copy will impact performance.
+	/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/1088">Issue 1088, 36% loss
+	///  of performance with AES</A>, <A HREF="https://github.com/weidai11/cryptopp/issues/1010">Issue
+	///  1010, HIGHT cipher troubles with FileSource</A>
+	void ProcessData(byte *outString, const byte *inString, size_t length);
+
+	/// \brief Resynchronize the cipher
+	/// \param iv a byte array used to resynchronize the cipher
+	/// \param length the size of the IV array
+	void Resynchronize(const byte *iv, int length=-1);
+
+	/// \brief Provides number of ideal bytes to process
+	/// \return the ideal number of bytes to process
+	/// \details Internally, the default implementation returns GetBytesPerIteration()
+	/// \sa GetBytesPerIteration() and GetOptimalNextBlockSize()
+	unsigned int OptimalBlockSize() const {return this->GetPolicy().GetOptimalBlockSize();}
+
+	/// \brief Provides number of ideal bytes to process
+	/// \return the ideal number of bytes to process
+	/// \details Internally, the default implementation returns remaining unprocessed bytes
+	/// \sa GetBytesPerIteration() and OptimalBlockSize()
+	unsigned int GetOptimalNextBlockSize() const {return (unsigned int)this->m_leftOver;}
+
+	/// \brief Provides number of ideal data alignment
+	/// \return the ideal data alignment, in bytes
+	/// \sa GetAlignment() and OptimalBlockSize()
+	unsigned int OptimalDataAlignment() const {return this->GetPolicy().GetAlignment();}
+
+	/// \brief Determines if the cipher is self inverting
+	/// \return true if the stream cipher is self inverting, false otherwise
+	bool IsSelfInverting() const {return true;}
+
+	/// \brief Determines if the cipher is a forward transformation
+	/// \return true if the stream cipher is a forward transformation, false otherwise
+	bool IsForwardTransformation() const {return true;}
+
+	/// \brief Flag indicating random access
+	/// \return true if the cipher is seekable, false otherwise
+	/// \sa Seek()
+	bool IsRandomAccess() const {return this->GetPolicy().CipherIsRandomAccess();}
+
+	/// \brief Seeks to a random position in the stream
+	/// \param position the absolute position in the stream
+	/// \sa IsRandomAccess()
+	void Seek(lword position);
+
+	/// \brief Retrieve the provider of this algorithm
+	/// \return the algorithm provider
+	/// \details The algorithm provider can be a name like "C++", "SSE", "NEON", "AESNI",
+	///  "ARMv8" and "Power8". C++ is standard C++ code. Other labels, like SSE,
+	///  usually indicate a specialized implementation using instructions from a higher
+	///  instruction set architecture (ISA). Future labels may include external hardware
+	///  like a hardware security module (HSM).
+	/// \details Generally speaking Wei Dai's original IA-32 ASM code falls under "SSE2".
+	///  Labels like "SSSE3" and "SSE4.1" follow after Wei's code and use intrinsics
+	///  instead of ASM.
+	/// \details Algorithms which combine different instructions or ISAs provide the
+	///  dominant one. For example on x86 <tt>AES/GCM</tt> returns "AESNI" rather than
+	///  "CLMUL" or "AES+SSE4.1" or "AES+CLMUL" or "AES+SSE4.1+CLMUL".
+	/// \note Provider is not universally implemented yet.
+	std::string AlgorithmProvider() const { return this->GetPolicy().AlgorithmProvider(); }
+
+	typedef typename BASE::PolicyInterface PolicyInterface;
+
+protected:
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+
+	unsigned int GetBufferByteSize(const PolicyInterface &policy) const {return policy.GetBytesPerIteration() * policy.GetIterationsToBuffer();}
+
+	inline byte * KeystreamBufferBegin() {return this->m_buffer.data();}
+	inline byte * KeystreamBufferEnd() {return (PtrAdd(this->m_buffer.data(), this->m_buffer.size()));}
+
+	AlignedSecByteBlock m_buffer;
+	size_t m_leftOver;
+};
+
+/// \brief Policy object for feedback based stream ciphers
+class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE CFB_CipherAbstractPolicy
+{
+public:
+	virtual ~CFB_CipherAbstractPolicy() {}
+
+	/// \brief Provides data alignment requirements
+	/// \return data alignment requirements, in bytes
+	/// \details Internally, the default implementation returns 1. If the stream cipher is implemented
+	///  using an SSE2 ASM or intrinsics, then the value returned is usually 16.
+	virtual unsigned int GetAlignment() const =0;
+
+	/// \brief Provides number of bytes operated upon during an iteration
+	/// \return bytes operated upon during an iteration, in bytes
+	/// \sa GetOptimalBlockSize()
+	virtual unsigned int GetBytesPerIteration() const =0;
+
+	/// \brief Access the feedback register
+	/// \return pointer to the first byte of the feedback register
+	virtual byte * GetRegisterBegin() =0;
+
+	/// \brief TODO
+	virtual void TransformRegister() =0;
+
+	/// \brief Flag indicating iteration support
+	/// \return true if the cipher supports iteration, false otherwise
+	virtual bool CanIterate() const {return false;}
+
+	/// \brief Iterate the cipher
+	/// \param output the output buffer
+	/// \param input the input buffer
+	/// \param dir the direction of the cipher
+	/// \param iterationCount the number of iterations to perform on the input
+	/// \sa IsSelfInverting() and IsForwardTransformation()
+	virtual void Iterate(byte *output, const byte *input, CipherDir dir, size_t iterationCount)
+		{CRYPTOPP_UNUSED(output); CRYPTOPP_UNUSED(input); CRYPTOPP_UNUSED(dir);
+		CRYPTOPP_UNUSED(iterationCount); CRYPTOPP_ASSERT(false);
+		throw Exception(Exception::OTHER_ERROR, "SimpleKeyingInterface: unexpected error");}
+
+	/// \brief Key the cipher
+	/// \param params set of NameValuePairs use to initialize this object
+	/// \param key a byte array used to key the cipher
+	/// \param length the size of the key array
+	virtual void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length) =0;
+
+	/// \brief Resynchronize the cipher
+	/// \param iv a byte array used to resynchronize the cipher
+	/// \param length the size of the IV array
+	virtual void CipherResynchronize(const byte *iv, size_t length)
+		{CRYPTOPP_UNUSED(iv); CRYPTOPP_UNUSED(length);
+		throw NotImplemented("SimpleKeyingInterface: this object doesn't support resynchronization");}
+
+	/// \brief Retrieve the provider of this algorithm
+	/// \return the algorithm provider
+	/// \details The algorithm provider can be a name like "C++", "SSE", "NEON", "AESNI",
+	///  "ARMv8" and "Power8". C++ is standard C++ code. Other labels, like SSE,
+	///  usually indicate a specialized implementation using instructions from a higher
+	///  instruction set architecture (ISA). Future labels may include external hardware
+	///  like a hardware security module (HSM).
+	/// \details Generally speaking Wei Dai's original IA-32 ASM code falls under "SSE2".
+	///  Labels like "SSSE3" and "SSE4.1" follow after Wei's code and use intrinsics
+	///  instead of ASM.
+	/// \details Algorithms which combine different instructions or ISAs provide the
+	///  dominant one. For example on x86 <tt>AES/GCM</tt> returns "AESNI" rather than
+	///  "CLMUL" or "AES+SSE4.1" or "AES+CLMUL" or "AES+SSE4.1+CLMUL".
+	/// \note Provider is not universally implemented yet.
+	virtual std::string AlgorithmProvider() const { return "C++"; }
+};
+
+/// \brief Base class for feedback based stream ciphers
+/// \tparam WT word type
+/// \tparam W count of words
+/// \tparam BASE CFB_CipherAbstractPolicy derived base class
+template <typename WT, unsigned int W, class BASE = CFB_CipherAbstractPolicy>
+struct CRYPTOPP_NO_VTABLE CFB_CipherConcretePolicy : public BASE
+{
+	typedef WT WordType;
+
+	virtual ~CFB_CipherConcretePolicy() {}
+
+	/// \brief Provides data alignment requirements
+	/// \return data alignment requirements, in bytes
+	/// \details Internally, the default implementation returns 1. If the stream cipher is implemented
+	///   using an SSE2 ASM or intrinsics, then the value returned is usually 16.
+	unsigned int GetAlignment() const {return sizeof(WordType);}
+
+	/// \brief Provides number of bytes operated upon during an iteration
+	/// \return bytes operated upon during an iteration, in bytes
+	/// \sa GetOptimalBlockSize()
+	unsigned int GetBytesPerIteration() const {return sizeof(WordType) * W;}
+
+	/// \brief Flag indicating iteration support
+	/// \return true if the cipher supports iteration, false otherwise
+	bool CanIterate() const {return true;}
+
+	/// \brief Perform one iteration in the forward direction
+	void TransformRegister() {this->Iterate(NULLPTR, NULLPTR, ENCRYPTION, 1);}
+
+	/// \brief Provides alternate access to a feedback register
+	/// \tparam B enumeration indicating endianness
+	/// \details RegisterOutput() provides alternate access to the feedback register. The
+	///   enumeration B is BigEndian or LittleEndian. Repeatedly applying operator()
+	///   results in advancing in the register.
+	template <class B>
+	struct RegisterOutput
+	{
+		RegisterOutput(byte *output, const byte *input, CipherDir dir)
+			: m_output(output), m_input(input), m_dir(dir) {}
+
+		/// \brief XOR feedback register with data
+		/// \param registerWord data represented as a word type
+		/// \return reference to the next feedback register word
+		inline RegisterOutput& operator()(WordType &registerWord)
+		{
+			//CRYPTOPP_ASSERT(IsAligned<WordType>(m_output));
+			//CRYPTOPP_ASSERT(IsAligned<WordType>(m_input));
+
+			if (!NativeByteOrderIs(B::ToEnum()))
+				registerWord = ByteReverse(registerWord);
+
+			if (m_dir == ENCRYPTION)
+			{
+				if (m_input == NULLPTR)
+				{
+					CRYPTOPP_ASSERT(m_output == NULLPTR);
+				}
+				else
+				{
+					// WordType ct = *(const WordType *)m_input ^ registerWord;
+					WordType ct = GetWord<WordType>(false, NativeByteOrder::ToEnum(), m_input) ^ registerWord;
+					registerWord = ct;
+
+					// *(WordType*)m_output = ct;
+					PutWord<WordType>(false, NativeByteOrder::ToEnum(), m_output, ct);
+
+					m_input += sizeof(WordType);
+					m_output += sizeof(WordType);
+				}
+			}
+			else
+			{
+				// WordType ct = *(const WordType *)m_input;
+				WordType ct = GetWord<WordType>(false, NativeByteOrder::ToEnum(), m_input);
+
+				// *(WordType*)m_output = registerWord ^ ct;
+				PutWord<WordType>(false, NativeByteOrder::ToEnum(), m_output, registerWord ^ ct);
+				registerWord = ct;
+
+				m_input += sizeof(WordType);
+				m_output += sizeof(WordType);
+			}
+
+			// registerWord is left unreversed so it can be xor-ed with further input
+
+			return *this;
+		}
+
+		byte *m_output;
+		const byte *m_input;
+		CipherDir m_dir;
+	};
+};
+
+/// \brief Base class for feedback based stream ciphers with SymmetricCipher interface
+/// \tparam BASE AbstractPolicyHolder base class
+template <class BASE>
+class CRYPTOPP_NO_VTABLE CFB_CipherTemplate : public BASE
+{
+public:
+	virtual ~CFB_CipherTemplate() {}
+	CFB_CipherTemplate() : m_leftOver(0) {}
+
+	/// \brief Apply keystream to data
+	/// \param outString a buffer to write the transformed data
+	/// \param inString a buffer to read the data
+	/// \param length the size of the buffers, in bytes
+	/// \details This is the primary method to operate a stream cipher. For example:
+	/// <pre>
+	///     size_t size = 30;
+	///     byte plain[size] = "Do or do not; there is no try";
+	///     byte cipher[size];
+	///     ...
+	///     ChaCha20 chacha(key, keySize);
+	///     chacha.ProcessData(cipher, plain, size);
+	/// </pre>
+	/// \details You should use distinct buffers for inString and outString. If the buffers
+	///  are the same, then the data will be copied to an internal buffer to avoid GCC alias
+	///  violations. The internal copy will impact performance.
+	/// \sa <A HREF="https://github.com/weidai11/cryptopp/issues/1088">Issue 1088, 36% loss
+	///  of performance with AES</A>, <A HREF="https://github.com/weidai11/cryptopp/issues/1010">Issue
+	///  1010, HIGHT cipher troubles with FileSource</A>
+	void ProcessData(byte *outString, const byte *inString, size_t length);
+
+	/// \brief Resynchronize the cipher
+	/// \param iv a byte array used to resynchronize the cipher
+	/// \param length the size of the IV array
+	void Resynchronize(const byte *iv, int length=-1);
+
+	/// \brief Provides number of ideal bytes to process
+	/// \return the ideal number of bytes to process
+	/// \details Internally, the default implementation returns GetBytesPerIteration()
+	/// \sa GetBytesPerIteration() and GetOptimalNextBlockSize()
+	unsigned int OptimalBlockSize() const {return this->GetPolicy().GetBytesPerIteration();}
+
+	/// \brief Provides number of ideal bytes to process
+	/// \return the ideal number of bytes to process
+	/// \details Internally, the default implementation returns remaining unprocessed bytes
+	/// \sa GetBytesPerIteration() and OptimalBlockSize()
+	unsigned int GetOptimalNextBlockSize() const {return (unsigned int)m_leftOver;}
+
+	/// \brief Provides number of ideal data alignment
+	/// \return the ideal data alignment, in bytes
+	/// \sa GetAlignment() and OptimalBlockSize()
+	unsigned int OptimalDataAlignment() const {return this->GetPolicy().GetAlignment();}
+
+	/// \brief Flag indicating random access
+	/// \return true if the cipher is seekable, false otherwise
+	/// \sa Seek()
+	bool IsRandomAccess() const {return false;}
+
+	/// \brief Determines if the cipher is self inverting
+	/// \return true if the stream cipher is self inverting, false otherwise
+	bool IsSelfInverting() const {return false;}
+
+	/// \brief Retrieve the provider of this algorithm
+	/// \return the algorithm provider
+	/// \details The algorithm provider can be a name like "C++", "SSE", "NEON", "AESNI",
+	///  "ARMv8" and "Power8". C++ is standard C++ code. Other labels, like SSE,
+	///  usually indicate a specialized implementation using instructions from a higher
+	///  instruction set architecture (ISA). Future labels may include external hardware
+	///  like a hardware security module (HSM).
+	/// \details Generally speaking Wei Dai's original IA-32 ASM code falls under "SSE2".
+	///  Labels like "SSSE3" and "SSE4.1" follow after Wei's code and use intrinsics
+	///  instead of ASM.
+	/// \details Algorithms which combine different instructions or ISAs provide the
+	///  dominant one. For example on x86 <tt>AES/GCM</tt> returns "AESNI" rather than
+	///  "CLMUL" or "AES+SSE4.1" or "AES+CLMUL" or "AES+SSE4.1+CLMUL".
+	/// \note Provider is not universally implemented yet.
+	std::string AlgorithmProvider() const { return this->GetPolicy().AlgorithmProvider(); }
+
+	typedef typename BASE::PolicyInterface PolicyInterface;
+
+protected:
+	virtual void CombineMessageAndShiftRegister(byte *output, byte *reg, const byte *message, size_t length) =0;
+
+	void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
+
+	size_t m_leftOver;
+};
+
+/// \brief Base class for feedback based stream ciphers in the forward direction with SymmetricCipher interface
+/// \tparam BASE AbstractPolicyHolder base class
+template <class BASE = AbstractPolicyHolder<CFB_CipherAbstractPolicy, SymmetricCipher> >
+class CRYPTOPP_NO_VTABLE CFB_EncryptionTemplate : public CFB_CipherTemplate<BASE>
+{
+	bool IsForwardTransformation() const {return true;}
+	void CombineMessageAndShiftRegister(byte *output, byte *reg, const byte *message, size_t length);
+};
+
+/// \brief Base class for feedback based stream ciphers in the reverse direction with SymmetricCipher interface
+/// \tparam BASE AbstractPolicyHolder base class
+template <class BASE = AbstractPolicyHolder<CFB_CipherAbstractPolicy, SymmetricCipher> >
+class CRYPTOPP_NO_VTABLE CFB_DecryptionTemplate : public CFB_CipherTemplate<BASE>
+{
+	bool IsForwardTransformation() const {return false;}
+	void CombineMessageAndShiftRegister(byte *output, byte *reg, const byte *message, size_t length);
+};
+
+/// \brief Base class for feedback based stream ciphers with a mandatory block size
+/// \tparam BASE CFB_EncryptionTemplate or CFB_DecryptionTemplate base class
+template <class BASE>
+class CFB_RequireFullDataBlocks : public BASE
+{
+public:
+	unsigned int MandatoryBlockSize() const {return this->OptimalBlockSize();}
+};
+
+/// \brief SymmetricCipher implementation
+/// \tparam BASE AbstractPolicyHolder derived base class
+/// \tparam INFO AbstractPolicyHolder derived information class
+/// \sa Weak::ARC4, ChaCha8, ChaCha12, ChaCha20, Salsa20, SEAL, Sosemanuk, WAKE
+template <class BASE, class INFO = BASE>
+class SymmetricCipherFinal : public AlgorithmImpl<SimpleKeyingInterfaceImpl<BASE, INFO>, INFO>
+{
+public:
+	virtual ~SymmetricCipherFinal() {}
+
+	/// \brief Construct a stream cipher
+ 	SymmetricCipherFinal() {}
+
+	/// \brief Construct a stream cipher
+	/// \param key a byte array used to key the cipher
+	/// \details This overload uses DEFAULT_KEYLENGTH
+	SymmetricCipherFinal(const byte *key)
+		{this->SetKey(key, this->DEFAULT_KEYLENGTH);}
+
+	/// \brief Construct a stream cipher
+	/// \param key a byte array used to key the cipher
+	/// \param length the size of the key array
+	SymmetricCipherFinal(const byte *key, size_t length)
+		{this->SetKey(key, length);}
+
+	/// \brief Construct a stream cipher
+	/// \param key a byte array used to key the cipher
+	/// \param length the size of the key array
+	/// \param iv a byte array used as an initialization vector
+	SymmetricCipherFinal(const byte *key, size_t length, const byte *iv)
+		{this->SetKeyWithIV(key, length, iv);}
+
+	/// \brief Clone a SymmetricCipher
+	/// \return a new SymmetricCipher based on this object
+	Clonable * Clone() const {return static_cast<SymmetricCipher *>(new SymmetricCipherFinal<BASE, INFO>(*this));}
+};
+
+NAMESPACE_END
+
+// Used by dll.cpp to ensure objects are in dll.o, and not strciphr.o.
+#ifdef CRYPTOPP_MANUALLY_INSTANTIATE_TEMPLATES
+# include "strciphr.cpp"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+CRYPTOPP_DLL_TEMPLATE_CLASS AbstractPolicyHolder<AdditiveCipherAbstractPolicy, SymmetricCipher>;
+CRYPTOPP_DLL_TEMPLATE_CLASS AdditiveCipherTemplate<AbstractPolicyHolder<AdditiveCipherAbstractPolicy, SymmetricCipher> >;
+
+CRYPTOPP_DLL_TEMPLATE_CLASS CFB_CipherTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, SymmetricCipher> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS CFB_EncryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, SymmetricCipher> >;
+CRYPTOPP_DLL_TEMPLATE_CLASS CFB_DecryptionTemplate<AbstractPolicyHolder<CFB_CipherAbstractPolicy, SymmetricCipher> >;
+
+NAMESPACE_END
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(pop)
+#endif
+
+#endif
diff --git a/runtime/third_party/cryptopp/tea.cpp b/runtime/third_party/cryptopp/tea.cpp
new file mode 100644
index 0000000..cf6bf18
--- /dev/null
+++ b/runtime/third_party/cryptopp/tea.cpp
@@ -0,0 +1,165 @@
+// tea.cpp - modified by Wei Dai from code in the original paper
+
+#include "pch.h"
+#include "tea.h"
+#include "misc.h"
+
+// http://github.com/weidai11/cryptopp/issues/503
+#if defined(__xlC__) || defined(__SUNPRO_CC)
+# define MAYBE_VOLATILE(x) (*const_cast<volatile word32*>(&x))
+#else
+# define MAYBE_VOLATILE(x) (x)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+static const word32 DELTA = 0x9e3779b9;
+typedef BlockGetAndPut<word32, BigEndian> Block;
+
+#define UINT32_CAST(x) ((word32*)(void*)(x))
+#define CONST_UINT32_CAST(x) ((const word32*)(const void*)(x))
+
+void TEA::Base::UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params)
+{
+	AssertValidKeyLength(length);
+
+	GetUserKey(BIG_ENDIAN_ORDER, m_k.begin(), 4, userKey, KEYLENGTH);
+	m_limit = GetRoundsAndThrowIfInvalid(params, this) * DELTA;
+}
+
+void TEA::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 y, z, sum = 0;
+	Block::Get(inBlock)(y)(z);
+
+	// http://github.com/weidai11/cryptopp/issues/503
+	while (MAYBE_VOLATILE(sum) != m_limit)
+	{
+		sum += DELTA;
+		y += ((z << 4) + m_k[0]) ^ (z + sum) ^ ((z >> 5) + m_k[1]);
+		z += ((y << 4) + m_k[2]) ^ (y + sum) ^ ((y >> 5) + m_k[3]);
+	}
+
+	Block::Put(xorBlock, outBlock)(y)(z);
+}
+
+void TEA::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 y, z, sum = m_limit;
+	Block::Get(inBlock)(y)(z);
+
+	// http://github.com/weidai11/cryptopp/issues/503
+	while (MAYBE_VOLATILE(sum) != 0)
+	{
+		z -= ((y << 4) + m_k[2]) ^ (y + sum) ^ ((y >> 5) + m_k[3]);
+		y -= ((z << 4) + m_k[0]) ^ (z + sum) ^ ((z >> 5) + m_k[1]);
+		sum -= DELTA;
+	}
+
+	Block::Put(xorBlock, outBlock)(y)(z);
+}
+
+void XTEA::Base::UncheckedSetKey(const byte *userKey, unsigned int length,  const NameValuePairs &params)
+{
+	AssertValidKeyLength(length);
+
+	GetUserKey(BIG_ENDIAN_ORDER, m_k.begin(), 4, userKey, KEYLENGTH);
+	m_limit = GetRoundsAndThrowIfInvalid(params, this) * DELTA;
+}
+
+void XTEA::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 y, z, sum = 0;
+	Block::Get(inBlock)(y)(z);
+
+	// http://github.com/weidai11/cryptopp/issues/503
+	while (MAYBE_VOLATILE(sum) != m_limit)
+	{
+		y += ((z<<4 ^ z>>5) + z) ^ (sum + m_k[sum&3]);
+		sum += DELTA;
+		z += ((y<<4 ^ y>>5) + y) ^ (sum + m_k[sum>>11 & 3]);
+	}
+
+	Block::Put(xorBlock, outBlock)(y)(z);
+}
+
+void XTEA::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 y, z, sum = m_limit;
+	Block::Get(inBlock)(y)(z);
+
+	// http://github.com/weidai11/cryptopp/issues/503
+	while (MAYBE_VOLATILE(sum) != 0)
+	{
+		z -= ((y<<4 ^ y>>5) + y) ^ (sum + m_k[sum>>11 & 3]);
+		sum -= DELTA;
+		y -= ((z<<4 ^ z>>5) + z) ^ (sum + m_k[sum&3]);
+	}
+
+	Block::Put(xorBlock, outBlock)(y)(z);
+}
+
+#define MX ((z>>5^y<<2)+(y>>3^z<<4))^((sum^y)+(m_k[(p&3)^e]^z))
+
+void BTEA::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	CRYPTOPP_UNUSED(xorBlock);
+	CRYPTOPP_ASSERT(IsAlignedOn(inBlock,GetAlignmentOf<word32>()));
+	CRYPTOPP_ASSERT(IsAlignedOn(outBlock,GetAlignmentOf<word32>()));
+
+	unsigned int n = m_blockSize / 4;
+	word32 *v = UINT32_CAST(outBlock);
+	ConditionalByteReverse(BIG_ENDIAN_ORDER, v, CONST_UINT32_CAST(inBlock), m_blockSize);
+
+	word32 y, z = v[n-1], e;
+	word32 p, q = 6+52/n;
+	word32 sum = 0;
+
+	while (q-- > 0)
+	{
+		sum += DELTA;
+		e = sum>>2 & 3;
+		for (p = 0; p < n-1; p++)
+		{
+			y = v[p+1];
+			z = v[p] += MX;
+		}
+		y = v[0];
+		z = v[n-1] += MX;
+	}
+
+	ConditionalByteReverse(BIG_ENDIAN_ORDER, v, v, m_blockSize);
+}
+
+void BTEA::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	CRYPTOPP_UNUSED(xorBlock);
+	CRYPTOPP_ASSERT(IsAlignedOn(inBlock,GetAlignmentOf<word32>()));
+	CRYPTOPP_ASSERT(IsAlignedOn(outBlock,GetAlignmentOf<word32>()));
+
+	unsigned int n = m_blockSize / 4;
+	word32 *v = UINT32_CAST(outBlock);
+	ConditionalByteReverse(BIG_ENDIAN_ORDER, v, CONST_UINT32_CAST(inBlock), m_blockSize);
+
+	word32 y = v[0], z, e;
+	word32 p, q = 6+52/n;
+	word32 sum = q * DELTA;
+
+	while (sum != 0)
+	{
+		e = sum>>2 & 3;
+		for (p = n-1; p > 0; p--)
+		{
+			z = v[p-1];
+			y = v[p] -= MX;
+		}
+
+		z = v[n-1];
+		y = v[0] -= MX;
+		sum -= DELTA;
+	}
+
+	ConditionalByteReverse(BIG_ENDIAN_ORDER, v, v, m_blockSize);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/tea.h b/runtime/third_party/cryptopp/tea.h
new file mode 100644
index 0000000..e4ba5df
--- /dev/null
+++ b/runtime/third_party/cryptopp/tea.h
@@ -0,0 +1,161 @@
+// tea.h - originally written and placed in the public domain by Wei Dai
+
+/// \file tea.h
+/// \brief Classes for the TEA, BTEA and XTEA block ciphers
+
+#ifndef CRYPTOPP_TEA_H
+#define CRYPTOPP_TEA_H
+
+#include "seckey.h"
+#include "secblock.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief TEA block cipher information
+struct TEA_Info : public FixedBlockSize<8>, public FixedKeyLength<16>, public VariableRounds<32>
+{
+	/// \brief The algorithm name
+	/// \return the algorithm name
+	/// \details StaticAlgorithmName returns the algorithm's name as a static
+	///   member function.
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "TEA";}
+};
+
+/// \brief TEA block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/TEA">TEA</a>
+class TEA : public TEA_Info, public BlockCipherDocumentation
+{
+	/// \brief TEA block cipher default operation
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<TEA_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		FixedSizeSecBlock<word32, 4> m_k;
+		word32 m_limit;
+	};
+
+	/// \brief TEA block cipher encryption operation
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief TEA block cipher decryption operation
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef TEA::Encryption TEAEncryption;
+typedef TEA::Decryption TEADecryption;
+
+/// \brief XTEA block cipher information
+struct XTEA_Info : public FixedBlockSize<8>, public FixedKeyLength<16>, public VariableRounds<32>
+{
+	/// \brief The algorithm name
+	/// \return the algorithm name
+	/// \details StaticAlgorithmName returns the algorithm's name as a static
+	///   member function.
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "XTEA";}
+};
+
+/// \brief XTEA block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/TEA">XTEA</a>
+class XTEA : public XTEA_Info, public BlockCipherDocumentation
+{
+	/// \brief XTEA block cipher default operation
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<XTEA_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		FixedSizeSecBlock<word32, 4> m_k;
+		word32 m_limit;
+	};
+
+	/// \brief XTEA block cipher encryption operation
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief XTEA block cipher decryption operation
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+/// \brief BTEA block cipher information
+struct BTEA_Info : public FixedKeyLength<16>
+{
+	/// \brief The algorithm name
+	/// \return the algorithm name
+	/// \details StaticAlgorithmName returns the algorithm's name as a static
+	///   member function.
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "BTEA";}
+};
+
+/// \brief BTEA block cipher
+/// \details Corrected Block TEA as described in "xxtea". This class hasn't been tested yet.
+/// \sa <A HREF="http://www.movable-type.co.uk/scripts/xxtea.pdf">Correction to xtea</A> and
+///   <a href="http://www.cryptopp.com/wiki/TEA">Corrected Block TEA</a>.
+class BTEA : public BTEA_Info, public BlockCipherDocumentation
+{
+	/// \brief BTEA block cipher default operation
+	class CRYPTOPP_NO_VTABLE Base : public AlgorithmImpl<SimpleKeyingInterfaceImpl<BlockCipher, BTEA_Info>, BTEA_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
+		{
+			CRYPTOPP_UNUSED(length), CRYPTOPP_UNUSED(params);
+			m_blockSize = params.GetIntValueWithDefault("BlockSize", 60*4);
+			GetUserKey(BIG_ENDIAN_ORDER, m_k.begin(), 4, key, KEYLENGTH);
+		}
+
+		unsigned int BlockSize() const {return m_blockSize;}
+
+	protected:
+		FixedSizeSecBlock<word32, 4> m_k;
+		unsigned int m_blockSize;
+	};
+
+	/// \brief BTEA block cipher encryption operation
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	/// \brief BTEA block cipher decryption operation
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/test.cpp b/runtime/third_party/cryptopp/test.cpp
new file mode 100644
index 0000000..22286f2
--- /dev/null
+++ b/runtime/third_party/cryptopp/test.cpp
@@ -0,0 +1,1098 @@
+// test.cpp - originally written and placed in the public domain by Wei Dai
+//            CryptoPP::Test namespace added by JW in February 2017
+//            scoped_main added to CryptoPP::Test namespace by JW in July 2017
+//            Also see http://github.com/weidai11/cryptopp/issues/447
+
+#define CRYPTOPP_DEFAULT_NO_DLL
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "dll.h"
+#include "cryptlib.h"
+#include "aes.h"
+#include "filters.h"
+#include "md5.h"
+#include "ripemd.h"
+#include "rng.h"
+#include "gzip.h"
+#include "default.h"
+#include "randpool.h"
+#include "ida.h"
+#include "base64.h"
+#include "factory.h"
+#include "whrlpool.h"
+#include "tiger.h"
+#include "smartptr.h"
+#include "pkcspad.h"
+#include "stdcpp.h"
+#include "osrng.h"
+#include "ossig.h"
+#include "trap.h"
+
+#include "validate.h"
+#include "bench.h"
+
+#include <iostream>
+#include <sstream>
+#include <locale>
+#include <cstdlib>
+#include <ctime>
+
+#ifdef CRYPTOPP_WIN32_AVAILABLE
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#endif
+
+#if defined(CRYPTOPP_UNIX_AVAILABLE) || defined(CRYPTOPP_BSD_AVAILABLE)
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#define UNIX_PATH_FAMILY 1
+#endif
+
+#if defined(CRYPTOPP_OSX_AVAILABLE)
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <mach-o/dyld.h>
+#define UNIX_PATH_FAMILY 1
+#endif
+
+#if (CRYPTOPP_MSC_VERSION >= 1000)
+#include <crtdbg.h>		// for the debug heap
+#endif
+
+#if defined(__MWERKS__) && defined(macintosh)
+#include <console.h>
+#endif
+
+#ifdef _OPENMP
+# include <omp.h>
+#endif
+
+#ifdef __BORLANDC__
+#pragma comment(lib, "cryptlib_bds.lib")
+#endif
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+// If CRYPTOPP_USE_AES_GENERATOR is 1 then AES/OFB based is used.
+// Otherwise the OS random number generator is used.
+#define CRYPTOPP_USE_AES_GENERATOR 1
+
+// Global namespace, provided by other source files
+void FIPS140_SampleApplication();
+void RegisterFactories(CryptoPP::Test::TestClass suites);
+int (*AdhocTest)(int argc, char *argv[]) = NULLPTR;
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+const int MAX_PHRASE_LENGTH = 250;
+const int GLOBAL_SEED_LENGTH = 16;
+std::string g_argvPathHint="";
+
+void GenerateRSAKey(unsigned int keyLength, const char *privFilename, const char *pubFilename, const char *seed);
+std::string RSAEncryptString(const char *pubFilename, const char *seed, const char *message);
+std::string RSADecryptString(const char *privFilename, const char *ciphertext);
+void RSASignFile(const char *privFilename, const char *messageFilename, const char *signatureFilename);
+bool RSAVerifyFile(const char *pubFilename, const char *messageFilename, const char *signatureFilename);
+
+void DigestFile(const char *file);
+void HmacFile(const char *hexKey, const char *file);
+
+void AES_CTR_Encrypt(const char *hexKey, const char *hexIV, const char *infile, const char *outfile);
+
+std::string EncryptString(const char *plaintext, const char *passPhrase);
+std::string DecryptString(const char *ciphertext, const char *passPhrase);
+
+void EncryptFile(const char *in, const char *out, const char *passPhrase);
+void DecryptFile(const char *in, const char *out, const char *passPhrase);
+
+void SecretShareFile(int threshold, int nShares, const char *filename, const char *seed);
+void SecretRecoverFile(int threshold, const char *outFilename, char *const *inFilenames);
+
+void InformationDisperseFile(int threshold, int nShares, const char *filename);
+void InformationRecoverFile(int threshold, const char *outFilename, char *const *inFilenames);
+
+void GzipFile(const char *in, const char *out, int deflate_level);
+void GunzipFile(const char *in, const char *out);
+
+void Base64Encode(const char *infile, const char *outfile);
+void Base64Decode(const char *infile, const char *outfile);
+void HexEncode(const char *infile, const char *outfile);
+void HexDecode(const char *infile, const char *outfile);
+
+void FIPS140_GenerateRandomFiles();
+
+bool Validate(int, bool);
+bool SetGlobalSeed(int argc, char* argv[], std::string& seed);
+void SetArgvPathHint(const char* argv0, std::string& pathHint);
+
+ANONYMOUS_NAMESPACE_BEGIN
+#if (CRYPTOPP_USE_AES_GENERATOR)
+OFB_Mode<AES>::Encryption s_globalRNG;
+#else
+NonblockingRng s_globalRNG;
+#endif
+NAMESPACE_END
+
+RandomNumberGenerator & GlobalRNG()
+{
+	return dynamic_cast<RandomNumberGenerator&>(s_globalRNG);
+}
+
+// Global seed used for the self tests
+std::string s_globalSeed;
+void PrintSeedAndThreads();
+
+// See misc.h and trap.h for comments and usage
+#if defined(CRYPTOPP_DEBUG) && defined(UNIX_SIGNALS_AVAILABLE)
+static const SignalHandler<SIGTRAP, false> s_dummyHandler;
+// static const DebugTrapHandler s_dummyHandler;
+#endif
+
+int scoped_main(int argc, char *argv[])
+{
+#ifdef _CRTDBG_LEAK_CHECK_DF
+	// Turn on leak-checking
+	int tempflag = _CrtSetDbgFlag( _CRTDBG_REPORT_FLAG );
+	tempflag |= _CRTDBG_LEAK_CHECK_DF;
+	_CrtSetDbgFlag( tempflag );
+#endif
+
+#ifdef _SUNPRO_CC
+	// No need for thread safety for the test program
+	cout.set_safe_flag(stream_MT::unsafe_object);
+	cin.set_safe_flag(stream_MT::unsafe_object);
+#endif
+
+	try
+	{
+		RegisterFactories(All);
+
+		// A hint to help locate TestData/ and TestVectors/ after install.
+		SetArgvPathHint(argv[0], g_argvPathHint);
+
+		// Set a seed for reproducible results. If the seed is too short then
+		// it is padded with spaces. If the seed is missing then time() is used.
+		// For example:
+		//   ./cryptest.exe v seed=abcdefg
+		SetGlobalSeed(argc, argv, s_globalSeed);
+
+#if (CRYPTOPP_USE_AES_GENERATOR)
+		// Fetch the SymmetricCipher interface, not the RandomNumberGenerator
+		//  interface, to key the underlying cipher. If CRYPTOPP_USE_AES_GENERATOR is 1
+		//  then AES/OFB based is used. Otherwise the OS random number generator is used.
+		SymmetricCipher& cipher = dynamic_cast<SymmetricCipher&>(GlobalRNG());
+		cipher.SetKeyWithIV((byte *)s_globalSeed.data(), s_globalSeed.size(), (byte *)s_globalSeed.data());
+#endif
+
+		std::string command, executableName, macFilename;
+
+		if (argc < 2)
+			command = "X-help";
+		else
+			command = argv[1];
+
+		if (command == "g")
+		{
+			char thisSeed[1024], privFilename[128], pubFilename[128];
+			unsigned int keyLength;
+
+			std::cout << "Key length in bits: ";
+			std::cin >> keyLength;
+
+			std::cout << "\nSave private key to file: ";
+			std::cin >> privFilename;
+
+			std::cout << "\nSave public key to file: ";
+			std::cin >> pubFilename;
+
+			std::cout << "\nRandom Seed: ";
+			std::ws(std::cin);
+			std::cin.getline(thisSeed, 1024);
+
+			GenerateRSAKey(keyLength, privFilename, pubFilename, thisSeed);
+		}
+		else if (command == "rs")
+			RSASignFile(argv[2], argv[3], argv[4]);
+		else if (command == "rv")
+		{
+			bool verified = RSAVerifyFile(argv[2], argv[3], argv[4]);
+			std::cout << (verified ? "valid signature" : "invalid signature") << std::endl;
+		}
+		else if (command == "r")
+		{
+			char privFilename[128], pubFilename[128];
+			char thisSeed[1024], message[1024];
+
+			std::cout << "Private key file: ";
+			std::cin >> privFilename;
+
+			std::cout << "\nPublic key file: ";
+			std::cin >> pubFilename;
+
+			std::cout << "\nRandom Seed: ";
+			std::ws(std::cin);
+			std::cin.getline(thisSeed, 1024);
+
+			std::cout << "\nMessage: ";
+			std::cin.getline(message, 1024);
+
+			std::string ciphertext = RSAEncryptString(pubFilename, thisSeed, message);
+			std::cout << "\nCiphertext: " << ciphertext << std::endl;
+
+			std::string decrypted = RSADecryptString(privFilename, ciphertext.c_str());
+			std::cout << "\nDecrypted: " << decrypted << std::endl;
+		}
+		else if (command == "mt")
+		{
+			MaurerRandomnessTest mt;
+			FileStore fs(argv[2]);
+			fs.TransferAllTo(mt);
+			std::cout << "Maurer Test Value: " << mt.GetTestValue() << std::endl;
+		}
+		else if (command == "mac_dll")
+		{
+			std::string fname(argv[2] ? argv[2] : "");
+
+			// sanity check on file size
+			std::fstream dllFile(fname.c_str(), std::ios::in | std::ios::out | std::ios::binary);
+			if (!dllFile.good())
+			{
+				std::cerr << "Failed to open file \"" << fname << "\"\n";
+				return 1;
+			}
+
+			std::ifstream::pos_type fileEnd = dllFile.seekg(0, std::ios_base::end).tellg();
+			if (fileEnd > 20*1000*1000)
+			{
+				std::cerr << "Input file " << fname << " is too large";
+				std::cerr << "(size is " << fileEnd << ").\n";
+				return 1;
+			}
+
+			// read file into memory
+			unsigned int fileSize = (unsigned int)fileEnd;
+			SecByteBlock buf(fileSize);
+			dllFile.seekg(0, std::ios_base::beg);
+			dllFile.read((char *)buf.begin(), fileSize);
+
+			// find positions of relevant sections in the file, based on version 8 of documentation from http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx
+			word32 coffPos = *(word16 *)(void *)(buf+0x3c);
+			word32 optionalHeaderPos = coffPos + 24;
+			word16 optionalHeaderMagic = *(word16 *)(void *)(buf+optionalHeaderPos);
+			if (optionalHeaderMagic != 0x10b && optionalHeaderMagic != 0x20b)
+			{
+				std::cerr << "Target file is not a PE32 or PE32+ image.\n";
+				return 3;
+			}
+			word32 checksumPos = optionalHeaderPos + 64;
+			word32 certificateTableDirectoryPos = optionalHeaderPos + (optionalHeaderMagic == 0x10b ? 128 : 144);
+			word32 certificateTablePos = *(word32 *)(void *)(buf+certificateTableDirectoryPos);
+			word32 certificateTableSize = *(word32 *)(void *)(buf+certificateTableDirectoryPos+4);
+			if (certificateTableSize != 0)
+				std::cerr << "Warning: certificate table (IMAGE_DIRECTORY_ENTRY_SECURITY) of target image is not empty.\n";
+
+			// find where to place computed MAC
+			byte mac[] = CRYPTOPP_DUMMY_DLL_MAC;
+			byte *found = std::search(buf.begin(), buf.end(), mac+0, mac+sizeof(mac));
+			if (found == buf.end())
+			{
+				std::cerr << "MAC placeholder not found. The MAC may already be placed.\n";
+				return 2;
+			}
+			word32 macPos = (unsigned int)(found-buf.begin());
+
+			// compute MAC
+			member_ptr<MessageAuthenticationCode> pMac(NewIntegrityCheckingMAC());
+			CRYPTOPP_ASSERT(pMac->DigestSize() == sizeof(mac));
+			MeterFilter f(new HashFilter(*pMac, new ArraySink(mac, sizeof(mac))));
+			f.AddRangeToSkip(0, checksumPos, 4);
+			f.AddRangeToSkip(0, certificateTableDirectoryPos, 8);
+			f.AddRangeToSkip(0, macPos, sizeof(mac));
+			f.AddRangeToSkip(0, certificateTablePos, certificateTableSize);
+			f.PutMessageEnd(buf.begin(), buf.size());
+
+			// Encode MAC
+			std::string hexMac;
+			HexEncoder encoder;
+			encoder.Put(mac, sizeof(mac)), encoder.MessageEnd();
+			hexMac.resize(static_cast<size_t>(encoder.MaxRetrievable()));
+			encoder.Get(reinterpret_cast<byte*>(&hexMac[0]), hexMac.size());
+
+			// Report MAC and location
+			std::cout << "Placing MAC " << hexMac << " in " << fname << " at file offset " << macPos;
+			std::cout << " (0x" << std::hex << macPos << std::dec << ").\n";
+
+			// place MAC
+			dllFile.seekg(macPos, std::ios_base::beg);
+			dllFile.write((char *)mac, sizeof(mac));
+		}
+		else if (command == "m")
+			DigestFile(argv[2]);
+		else if (command == "tv")
+		{
+			// TestDataFile() adds CRYPTOPP_DATA_DIR as required
+			std::string fname = (argv[2] ? argv[2] : "all");
+			if (fname.find(".txt") == std::string::npos)
+				fname += ".txt";
+			if (fname.find("TestVectors") == std::string::npos)
+				fname = "TestVectors/" + fname;
+
+			PrintSeedAndThreads();
+			return !RunTestDataFile(fname.c_str());
+		}
+		else if (command == "t")
+		{
+			// VC60 workaround: use char array instead of std::string to workaround MSVC's getline bug
+			char passPhrase[MAX_PHRASE_LENGTH], plaintext[1024];
+
+			std::cout << "Passphrase: ";
+			std::cin.getline(passPhrase, MAX_PHRASE_LENGTH);
+
+			std::cout << "\nPlaintext: ";
+			std::cin.getline(plaintext, sizeof(plaintext));
+
+			std::string ciphertext = EncryptString(plaintext, passPhrase);
+			std::cout << "\nCiphertext: " << ciphertext << std::endl;
+
+			std::string decrypted = DecryptString(ciphertext.c_str(), passPhrase);
+			std::cout << "\nDecrypted: " << decrypted << std::endl;
+
+			return 0;
+		}
+		else if (command == "e64")
+			Base64Encode(argv[2], argv[3]);
+		else if (command == "d64")
+			Base64Decode(argv[2], argv[3]);
+		else if (command == "e16")
+			HexEncode(argv[2], argv[3]);
+		else if (command == "d16")
+			HexDecode(argv[2], argv[3]);
+		else if (command == "e" || command == "d")
+		{
+			char passPhrase[MAX_PHRASE_LENGTH];
+			std::cout << "Passphrase: ";
+			std::cin.getline(passPhrase, MAX_PHRASE_LENGTH);
+			if (command == "e")
+				EncryptFile(argv[2], argv[3], passPhrase);
+			else
+				DecryptFile(argv[2], argv[3], passPhrase);
+		}
+		else if (command == "ss")
+		{
+			char thisSeed[1024];
+			std::cout << "\nRandom Seed: ";
+			std::ws(std::cin);
+			std::cin.getline(thisSeed, sizeof(thisSeed));
+			SecretShareFile(StringToValue<int, true>(argv[2]), StringToValue<int, true>(argv[3]), argv[4], thisSeed);
+		}
+		else if (command == "sr")
+			SecretRecoverFile(argc-3, argv[2], argv+3);
+		else if (command == "id")
+			InformationDisperseFile(StringToValue<int, true>(argv[2]), StringToValue<int, true>(argv[3]), argv[4]);
+		else if (command == "ir")
+			InformationRecoverFile(argc-3, argv[2], argv+3);
+		else if (command == "v" || command == "vv")
+		{
+			int testNumber = argc>2 ? StringToValue<int, true>(argv[2]) : 0;
+			return Validate(testNumber, command == "vv" /*thorough*/) ? 0 : 1;
+        }
+		else if (command.substr(0,1) == "b") // "b", "b1", "b2", ...
+			BenchmarkWithCommand(argc, argv);
+		else if (command == "z")
+			GzipFile(argv[3], argv[4], argv[2][0]-'0');
+		else if (command == "u")
+			GunzipFile(argv[2], argv[3]);
+		else if (command == "fips")
+			FIPS140_SampleApplication();
+		else if (command == "fips-rand")
+			FIPS140_GenerateRandomFiles();
+		else if (command == "a")
+		{
+			if (AdhocTest)
+				return (*AdhocTest)(argc, argv);
+			else
+			{
+				std::cerr << "AdhocTest not defined.\n";
+				return 1;
+			}
+		}
+		else if (command == "hmac")
+			HmacFile(argv[2], argv[3]);
+		else if (command == "ae")
+			AES_CTR_Encrypt(argv[2], argv[3], argv[4], argv[5]);
+		else if (command == "h" || command == "X-help")
+		{
+			FileSource usage(DataDir("TestData/usage.dat").c_str(), true, new FileSink(std::cout));
+			return command == "h" ? 0 : 1;
+		}
+		else if (command == "V")
+		{
+			std::cout << CRYPTOPP_VERSION / 100 << '.' << (CRYPTOPP_VERSION % 100) / 10 << '.' << CRYPTOPP_VERSION % 10 << std::endl;
+		}
+		else
+		{
+			std::cerr << "Unrecognized command. Run \"cryptest h\" to obtain usage information.\n";
+			return 1;
+		}
+		return 0;
+	}
+	catch(const Exception &e)
+	{
+		std::cout << "\nException caught: " << e.what() << std::endl;
+		return -1;
+	}
+	catch(const std::exception &e)
+	{
+		std::cout << "\nstd::exception caught: " << e.what() << std::endl;
+		return -2;
+	}
+} // main()
+
+bool SetGlobalSeed(int argc, char* argv[], std::string& seed)
+{
+	bool ret = false;
+
+	for (int i=0; i<argc; ++i)
+	{
+		std::string arg(argv[i]);
+		std::string::size_type pos = arg.find("seed=");
+
+		if (pos != std::string::npos)
+		{
+			// length of "seed=" is 5
+			seed = arg.substr(pos+5);
+			ret = true; goto finish;
+		}
+	}
+
+	// Use a random seed if none is provided
+	if (s_globalSeed.empty())
+		s_globalSeed = IntToString(time(NULLPTR));
+
+finish:
+
+	// Some editors have problems with '\0' fill characters when redirecting output.
+	s_globalSeed.resize(GLOBAL_SEED_LENGTH, ' ');
+
+	return ret;
+}
+
+void SetArgvPathHint(const char* argv0, std::string& pathHint)
+{
+# if (PATH_MAX > 0)  // Posix
+	size_t path_max = (size_t)PATH_MAX;
+#elif (MAX_PATH > 0)  // Microsoft
+	size_t path_max = (size_t)MAX_PATH;
+#else
+	size_t path_max = 260;
+#endif
+
+	// OS X and Solaris provide a larger path using pathconf than MAX_PATH.
+	// Also see https://stackoverflow.com/a/33249023/608639 for FreeBSD.
+#if defined(_PC_PATH_MAX)
+	long ret = pathconf(argv0, _PC_PATH_MAX);
+	const size_t old_path_max = path_max;
+	if (SafeConvert(ret, path_max) == false)
+		path_max = old_path_max;
+#endif
+
+	const size_t argLen = std::strlen(argv0);
+	if (argLen >= path_max)
+		return; // Can't use realpath safely
+	pathHint = std::string(argv0, argLen);
+
+#if defined(AT_EXECFN)
+	if (getauxval(AT_EXECFN))
+		pathHint = getauxval(AT_EXECFN);
+#elif defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION > 1310)
+	char* pgmptr = NULLPTR;
+	errno_t err = _get_pgmptr(&pgmptr);
+	if (err == 0 && pgmptr != NULLPTR)
+		pathHint = pgmptr;
+#elif defined(__MINGW32__) || defined(__MINGW64__)
+	std::string t(path_max, (char)0);
+	if (_fullpath(&t[0], pathHint.c_str(), path_max))
+	{
+		t.resize(strlen(t.c_str()));
+		std::swap(pathHint, t);
+	}
+#elif defined(CRYPTOPP_OSX_AVAILABLE)
+	std::string t(path_max, (char)0);
+	unsigned int len = (unsigned int)t.size();
+	if (_NSGetExecutablePath(&t[0], &len) == 0)
+	{
+		t.resize(len);
+		std::swap(pathHint, t);
+	}
+#elif defined(sun) || defined(__sun)
+	if (getexecname())
+		pathHint = getexecname();
+#endif
+
+#if defined(__MINGW32__) || defined(__MINGW64__)
+	// This path exists to stay out of the Posix paths that follow
+	;;
+#elif (_POSIX_C_SOURCE >= 200809L) || (_XOPEN_SOURCE >= 700)
+	char* resolved = realpath (pathHint.c_str(), NULLPTR);
+	if (resolved != NULLPTR)
+	{
+		pathHint = resolved;
+		std::free(resolved);
+	}
+#elif defined(UNIX_PATH_FAMILY)
+	std::string resolved(path_max, (char)0);
+	char* r = realpath (pathHint.c_str(), &resolved[0]);
+	if (r != NULLPTR)
+	{
+		resolved.resize(std::strlen(&resolved[0]));
+		std::swap(pathHint, resolved);
+	}
+#endif
+
+#if defined(UNIX_PATH_FAMILY)
+	// Is it possible for realpath to fail?
+	struct stat buf; int x;
+	x = lstat(pathHint.c_str(), &buf);
+	if (x != 0 || S_ISLNK(buf.st_mode))
+		pathHint.clear();
+#endif
+
+	// Trim the executable name, leave the path with a slash.
+	std::string::size_type pos = pathHint.find_last_of("\\/");
+	if (pos != std::string::npos)
+		pathHint.erase(pos+1);
+}
+
+void FIPS140_GenerateRandomFiles()
+{
+#ifdef OS_RNG_AVAILABLE
+	DefaultAutoSeededRNG rng;
+	RandomNumberStore store(rng, ULONG_MAX);
+
+	for (unsigned int i=0; i<100000; i++)
+		store.TransferTo(FileSink((IntToString(i) + ".rnd").c_str()).Ref(), 20000);
+#else
+	std::cout << "OS provided RNG not available.\n";
+	exit(-1);
+#endif
+}
+
+void PrintSeedAndThreads()
+{
+	std::cout << "Using seed: " << s_globalSeed << std::endl;
+
+#ifdef _OPENMP
+	int tc = 0;
+	#pragma omp parallel
+	{
+		tc = omp_get_num_threads();
+	}
+
+	std::cout << "OpenMP version " << (int)_OPENMP << ", ";
+	std::cout << tc << (tc == 1 ? " thread" : " threads") << std::endl;
+#endif
+}
+
+SecByteBlock HexDecodeString(const char *hex)
+{
+	StringSource ss(hex, true, new HexDecoder);
+	SecByteBlock result((size_t)ss.MaxRetrievable());
+	ss.Get(result, result.size());
+	return result;
+}
+
+void GenerateRSAKey(unsigned int keyLength, const char *privFilename, const char *pubFilename, const char *seed)
+{
+	// DEREncode() changed to Save() at Issue 569.
+	RandomPool randPool;
+	randPool.IncorporateEntropy((byte *)seed, strlen(seed));
+
+	RSAES_OAEP_SHA_Decryptor priv(randPool, keyLength);
+	HexEncoder privFile(new FileSink(privFilename));
+	priv.AccessMaterial().Save(privFile);
+	privFile.MessageEnd();
+
+	RSAES_OAEP_SHA_Encryptor pub(priv);
+	HexEncoder pubFile(new FileSink(pubFilename));
+	pub.AccessMaterial().Save(pubFile);
+	pubFile.MessageEnd();
+}
+
+std::string RSAEncryptString(const char *pubFilename, const char *seed, const char *message)
+{
+	FileSource pubFile(pubFilename, true, new HexDecoder);
+	RSAES_OAEP_SHA_Encryptor pub(pubFile);
+
+	RandomPool randPool;
+	randPool.IncorporateEntropy((byte *)seed, strlen(seed));
+
+	std::string result;
+	StringSource(message, true, new PK_EncryptorFilter(randPool, pub, new HexEncoder(new StringSink(result))));
+	return result;
+}
+
+std::string RSADecryptString(const char *privFilename, const char *ciphertext)
+{
+	FileSource privFile(privFilename, true, new HexDecoder);
+	RSAES_OAEP_SHA_Decryptor priv(privFile);
+
+	std::string result;
+	StringSource(ciphertext, true, new HexDecoder(new PK_DecryptorFilter(GlobalRNG(), priv, new StringSink(result))));
+	return result;
+}
+
+void RSASignFile(const char *privFilename, const char *messageFilename, const char *signatureFilename)
+{
+	FileSource privFile(privFilename, true, new HexDecoder);
+	RSASS<PKCS1v15, SHA1>::Signer priv(privFile);
+	FileSource f(messageFilename, true, new SignerFilter(GlobalRNG(), priv, new HexEncoder(new FileSink(signatureFilename))));
+}
+
+bool RSAVerifyFile(const char *pubFilename, const char *messageFilename, const char *signatureFilename)
+{
+	FileSource pubFile(pubFilename, true, new HexDecoder);
+	RSASS<PKCS1v15, SHA1>::Verifier pub(pubFile);
+
+	FileSource signatureFile(signatureFilename, true, new HexDecoder);
+	if (signatureFile.MaxRetrievable() != pub.SignatureLength())
+		return false;
+	SecByteBlock signature(pub.SignatureLength());
+	signatureFile.Get(signature, signature.size());
+
+	SignatureVerificationFilter *verifierFilter = new SignatureVerificationFilter(pub);
+	verifierFilter->Put(signature, pub.SignatureLength());
+	FileSource f(messageFilename, true, verifierFilter);
+
+	return verifierFilter->GetLastResult();
+}
+
+void DigestFile(const char *filename)
+{
+	SHA1 sha;
+	RIPEMD160 ripemd;
+	SHA256 sha256;
+	Tiger tiger;
+	SHA512 sha512;
+	Whirlpool whirlpool;
+
+	vector_member_ptrs<HashFilter> filters(6);
+	filters[0].reset(new HashFilter(sha));
+	filters[1].reset(new HashFilter(ripemd));
+	filters[2].reset(new HashFilter(tiger));
+	filters[3].reset(new HashFilter(sha256));
+	filters[4].reset(new HashFilter(sha512));
+	filters[5].reset(new HashFilter(whirlpool));
+
+	member_ptr<ChannelSwitch> channelSwitch(new ChannelSwitch);
+	size_t i;
+	for (i=0; i<filters.size(); i++)
+		channelSwitch->AddDefaultRoute(*filters[i]);
+	FileSource(filename, true, channelSwitch.release());
+
+	HexEncoder encoder(new FileSink(std::cout), false);
+	for (i=0; i<filters.size(); i++)
+	{
+		std::cout << filters[i]->AlgorithmName() << ": ";
+		filters[i]->TransferTo(encoder);
+		std::cout << "\n";
+	}
+}
+
+void HmacFile(const char *hexKey, const char *file)
+{
+	member_ptr<MessageAuthenticationCode> mac;
+	if (strcmp(hexKey, "selftest") == 0)
+	{
+		std::cerr << "Computing HMAC/SHA1 value for self test.\n";
+		mac.reset(NewIntegrityCheckingMAC());
+	}
+	else
+	{
+		std::string decodedKey;
+		StringSource(hexKey, true, new HexDecoder(new StringSink(decodedKey)));
+		mac.reset(new HMAC<SHA1>((const byte *)decodedKey.data(), decodedKey.size()));
+	}
+	FileSource(file, true, new HashFilter(*mac, new HexEncoder(new FileSink(std::cout))));
+}
+
+void AES_CTR_Encrypt(const char *hexKey, const char *hexIV, const char *infile, const char *outfile)
+{
+	SecByteBlock key = HexDecodeString(hexKey);
+	SecByteBlock iv = HexDecodeString(hexIV);
+	CTR_Mode<AES>::Encryption aes(key, key.size(), iv);
+	FileSource(infile, true, new StreamTransformationFilter(aes, new FileSink(outfile)));
+}
+
+std::string EncryptString(const char *instr, const char *passPhrase)
+{
+	std::string outstr;
+
+	DefaultEncryptorWithMAC encryptor(passPhrase, new HexEncoder(new StringSink(outstr)));
+	encryptor.Put((byte *)instr, strlen(instr));
+	encryptor.MessageEnd();
+
+	return outstr;
+}
+
+std::string DecryptString(const char *instr, const char *passPhrase)
+{
+	std::string outstr;
+
+	HexDecoder decryptor(new DefaultDecryptorWithMAC(passPhrase, new StringSink(outstr)));
+	decryptor.Put((byte *)instr, strlen(instr));
+	decryptor.MessageEnd();
+
+	return outstr;
+}
+
+void EncryptFile(const char *in, const char *out, const char *passPhrase)
+{
+	FileSource f(in, true, new DefaultEncryptorWithMAC(passPhrase, new FileSink(out)));
+}
+
+void DecryptFile(const char *in, const char *out, const char *passPhrase)
+{
+	FileSource f(in, true, new DefaultDecryptorWithMAC(passPhrase, new FileSink(out)));
+}
+
+void SecretShareFile(int threshold, int nShares, const char *filename, const char *seed)
+{
+	CRYPTOPP_ASSERT(nShares >= 1 && nShares<=1000);
+	if (nShares < 1 || nShares > 1000)
+		throw InvalidArgument("SecretShareFile: " + IntToString(nShares) + " is not in range [1, 1000]");
+
+	RandomPool rng;
+	rng.IncorporateEntropy((byte *)seed, strlen(seed));
+
+	ChannelSwitch *channelSwitch = NULLPTR;
+	FileSource source(filename, false, new SecretSharing(rng, threshold, nShares, channelSwitch = new ChannelSwitch));
+
+	// Be careful of the type of Sink used. An ArraySink will stop writing data once the array
+	//    is full. Also see http://groups.google.com/forum/#!topic/cryptopp-users/XEKKLCEFH3Y.
+	vector_member_ptrs<FileSink> fileSinks(nShares);
+	std::string channel;
+	for (int i=0; i<nShares; i++)
+	{
+		char extension[5] = ".000";
+		extension[1]='0'+byte(i/100);
+		extension[2]='0'+byte((i/10)%10);
+		extension[3]='0'+byte(i%10);
+		fileSinks[i].reset(new FileSink((std::string(filename)+extension).c_str()));
+
+		channel = WordToString<word32>(i);
+		fileSinks[i]->Put((const byte *)channel.data(), 4);
+		channelSwitch->AddRoute(channel, *fileSinks[i], DEFAULT_CHANNEL);
+	}
+
+	source.PumpAll();
+}
+
+void SecretRecoverFile(int threshold, const char *outFilename, char *const *inFilenames)
+{
+	CRYPTOPP_ASSERT(threshold >= 1 && threshold <=1000);
+	if (threshold < 1 || threshold > 1000)
+		throw InvalidArgument("SecretRecoverFile: " + IntToString(threshold) + " is not in range [1, 1000]");
+
+	SecretRecovery recovery(threshold, new FileSink(outFilename));
+
+	vector_member_ptrs<FileSource> fileSources(threshold);
+	SecByteBlock channel(4);
+	int i;
+	for (i=0; i<threshold; i++)
+	{
+		fileSources[i].reset(new FileSource(inFilenames[i], false));
+		fileSources[i]->Pump(4);
+		fileSources[i]->Get(channel, 4);
+		fileSources[i]->Attach(new ChannelSwitch(recovery, std::string((char *)channel.begin(), 4)));
+	}
+
+	while (fileSources[0]->Pump(256))
+		for (i=1; i<threshold; i++)
+			fileSources[i]->Pump(256);
+
+	for (i=0; i<threshold; i++)
+		fileSources[i]->PumpAll();
+}
+
+void InformationDisperseFile(int threshold, int nShares, const char *filename)
+{
+	CRYPTOPP_ASSERT(threshold >= 1 && threshold <=1000);
+	if (threshold < 1 || threshold > 1000)
+		throw InvalidArgument("InformationDisperseFile: " + IntToString(nShares) + " is not in range [1, 1000]");
+
+	ChannelSwitch *channelSwitch = NULLPTR;
+	FileSource source(filename, false, new InformationDispersal(threshold, nShares, channelSwitch = new ChannelSwitch));
+
+	// Be careful of the type of Sink used. An ArraySink will stop writing data once the array
+	//    is full. Also see http://groups.google.com/forum/#!topic/cryptopp-users/XEKKLCEFH3Y.
+	vector_member_ptrs<FileSink> fileSinks(nShares);
+	std::string channel;
+	for (int i=0; i<nShares; i++)
+	{
+		char extension[5] = ".000";
+		extension[1]='0'+byte(i/100);
+		extension[2]='0'+byte((i/10)%10);
+		extension[3]='0'+byte(i%10);
+		fileSinks[i].reset(new FileSink((std::string(filename)+extension).c_str()));
+
+		channel = WordToString<word32>(i);
+		fileSinks[i]->Put((const byte *)channel.data(), 4);
+		channelSwitch->AddRoute(channel, *fileSinks[i], DEFAULT_CHANNEL);
+	}
+
+	source.PumpAll();
+}
+
+void InformationRecoverFile(int threshold, const char *outFilename, char *const *inFilenames)
+{
+	CRYPTOPP_ASSERT(threshold<=1000);
+	if (threshold < 1 || threshold > 1000)
+		throw InvalidArgument("InformationRecoverFile: " + IntToString(threshold) + " is not in range [1, 1000]");
+
+	InformationRecovery recovery(threshold, new FileSink(outFilename));
+
+	vector_member_ptrs<FileSource> fileSources(threshold);
+	SecByteBlock channel(4);
+	int i;
+	for (i=0; i<threshold; i++)
+	{
+		fileSources[i].reset(new FileSource(inFilenames[i], false));
+		fileSources[i]->Pump(4);
+		fileSources[i]->Get(channel, 4);
+		fileSources[i]->Attach(new ChannelSwitch(recovery, std::string((char *)channel.begin(), 4)));
+	}
+
+	while (fileSources[0]->Pump(256))
+		for (i=1; i<threshold; i++)
+			fileSources[i]->Pump(256);
+
+	for (i=0; i<threshold; i++)
+		fileSources[i]->PumpAll();
+}
+
+void GzipFile(const char *in, const char *out, int deflate_level)
+{
+//	FileSource(in, true, new Gzip(new FileSink(out), deflate_level));
+
+	// use a filter graph to compare decompressed data with original
+	//
+	// Source ----> Gzip ------> Sink
+	//    \           |
+	//	    \       Gunzip
+	//		  \       |
+	//		    \     v
+	//		      > ComparisonFilter
+
+	EqualityComparisonFilter comparison;
+
+	Gunzip gunzip(new ChannelSwitch(comparison, "0"));
+	gunzip.SetAutoSignalPropagation(0);
+
+	FileSink sink(out);
+
+	ChannelSwitch *cs;
+	Gzip gzip(cs = new ChannelSwitch(sink), deflate_level);
+	cs->AddDefaultRoute(gunzip);
+
+	cs = new ChannelSwitch(gzip);
+	cs->AddDefaultRoute(comparison, "1");
+	FileSource source(in, true, cs);
+
+	comparison.ChannelMessageSeriesEnd("0");
+	comparison.ChannelMessageSeriesEnd("1");
+}
+
+void GunzipFile(const char *in, const char *out)
+{
+	FileSource(in, true, new Gunzip(new FileSink(out)));
+}
+
+void Base64Encode(const char *in, const char *out)
+{
+	FileSource(in, true, new Base64Encoder(new FileSink(out)));
+}
+
+void Base64Decode(const char *in, const char *out)
+{
+	FileSource(in, true, new Base64Decoder(new FileSink(out)));
+}
+
+void HexEncode(const char *in, const char *out)
+{
+	FileSource(in, true, new HexEncoder(new FileSink(out)));
+}
+
+void HexDecode(const char *in, const char *out)
+{
+	FileSource(in, true, new HexDecoder(new FileSink(out)));
+}
+
+bool Validate(int alg, bool thorough)
+{
+	bool result;
+
+	g_testBegin = ::time(NULLPTR);
+	PrintSeedAndThreads();
+
+	// TODO: we need to group these tests like benchmarks...
+	switch (alg)
+	{
+	case 0: result = ValidateAll(thorough); break;
+	case 1: result = TestSettings(); break;
+	case 2: result = TestOS_RNG(); break;
+//	case 3: result = TestSecRandom(); break;
+	case 4: result = ValidateMD5(); break;
+	case 5: result = ValidateSHA(); break;
+	case 6: result = ValidateDES(); break;
+	case 7: result = ValidateIDEA(); break;
+	case 8: result = ValidateARC4(); break;
+	case 9: result = ValidateRC5(); break;
+	case 10: result = ValidateBlowfish(); break;
+//	case 11: result = ValidateDiamond2(); break;
+	case 12: result = ValidateThreeWay(); break;
+	case 13: result = ValidateBBS(); break;
+	case 14: result = ValidateDH(); break;
+	case 15: result = ValidateX25519(); break;
+	case 16: result = ValidateRSA(); break;
+	case 17: result = ValidateElGamal(); break;
+	case 18: result = ValidateDSA(thorough); break;
+//	case 18: result = ValidateHAVAL(); break;
+	case 19: result = ValidateSAFER(); break;
+	case 20: result = ValidateLUC(); break;
+	case 21: result = ValidateRabin(); break;
+//	case 22: result = ValidateBlumGoldwasser(); break;
+	case 23: result = ValidateECP(); break;
+	case 24: result = ValidateEC2N(); break;
+//	case 25: result = ValidateMD5MAC(); break;
+	case 26: result = ValidateGOST(); break;
+	case 27: result = ValidateTiger(); break;
+	case 28: result = ValidateRIPEMD(); break;
+	case 29: result = ValidateHMAC(); break;
+//	case 30: result = ValidateXMACC(); break;
+	case 31: result = ValidateSHARK(); break;
+	case 32: result = ValidateLUC_DH(); break;
+	case 33: result = ValidateLUC_DL(); break;
+	case 34: result = ValidateSEAL(); break;
+	case 35: result = ValidateCAST(); break;
+	case 36: result = ValidateSquare(); break;
+	case 37: result = ValidateRC2(); break;
+	case 38: result = ValidateRC6(); break;
+	case 39: result = ValidateMARS(); break;
+	case 40: result = ValidateRW(); break;
+	case 41: result = ValidateMD2(); break;
+	case 42: result = ValidateNR(); break;
+	case 43: result = ValidateMQV(); break;
+	case 44: result = ValidateRijndael(); break;
+	case 45: result = ValidateTwofish(); break;
+	case 46: result = ValidateSerpent(); break;
+	case 47: result = ValidateCipherModes(); break;
+	case 48: result = ValidateCRC32(); break;
+	case 49: result = ValidateCRC32C(); break;
+	case 50: result = ValidateECDSA(); break;
+	case 51: result = ValidateECGDSA(thorough); break;
+	case 52: result = ValidateXTR_DH(); break;
+	case 53: result = ValidateSKIPJACK(); break;
+	case 54: result = ValidateSHA2(); break;
+	case 55: result = ValidatePanama(); break;
+	case 56: result = ValidateAdler32(); break;
+	case 57: result = ValidateMD4(); break;
+	case 58: result = ValidatePBKDF(); break;
+	case 59: result = ValidateHKDF(); break;
+	case 60: result = ValidateScrypt(); break;
+	case 61: result = ValidateESIGN(); break;
+	case 62: result = ValidateDLIES(); break;
+	case 63: result = ValidateBaseCode(); break;
+	case 64: result = ValidateSHACAL2(); break;
+	case 65: result = ValidateARIA(); break;
+	case 66: result = ValidateCamellia(); break;
+	case 67: result = ValidateWhirlpool(); break;
+	case 68: result = ValidateLSH(); break;
+	case 69: result = ValidateTTMAC(); break;
+	case 70: result = ValidateSalsa(); break;
+	case 71: result = ValidateChaCha(); break;
+	case 72: result = ValidateChaChaTLS(); break;
+	case 73: result = ValidateSosemanuk(); break;
+	case 74: result = ValidateRabbit(); break;
+	case 75: result = ValidateHC128(); break;
+	case 76: result = ValidateHC256(); break;
+	case 80: result = ValidateVMAC(); break;
+	case 81: result = ValidateCCM(); break;
+	case 82: result = ValidateGCM(); break;
+	case 83: result = ValidateXTS(); break;
+	case 84: result = ValidateCMAC(); break;
+	case 85: result = ValidateSM3(); break;
+	case 86: result = ValidateBLAKE2s(); break;
+	case 87: result = ValidateBLAKE2b(); break;
+	case 88: result = ValidatePoly1305(); break;
+	case 89: result = ValidateSipHash(); break;
+	case 90: result = ValidateHashDRBG(); break;
+	case 91: result = ValidateHmacDRBG(); break;
+	case 92: result = ValidateNaCl(); break;
+
+	case 100: result = ValidateCHAM(); break;
+	case 101: result = ValidateSIMECK(); break;
+	case 102: result = ValidateSIMON(); break;
+	case 103: result = ValidateSPECK(); break;
+
+	case 110: result = ValidateSHA3(); break;
+	case 111: result = ValidateSHAKE(); break;
+	case 112: result = ValidateSHAKE_XOF(); break;
+
+	case 120: result = ValidateMQV(); break;
+	case 121: result = ValidateHMQV(); break;
+	case 122: result = ValidateFHMQV(); break;
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+	// http://github.com/weidai11/cryptopp/issues/92
+	case 9999: result = TestSecBlock(); break;
+	// http://github.com/weidai11/cryptopp/issues/64
+	case 9998: result = TestPolynomialMod2(); break;
+	// http://github.com/weidai11/cryptopp/issues/336
+	case 9997: result = TestIntegerBitops(); break;
+	// http://github.com/weidai11/cryptopp/issues/602
+	case 9996: result = TestIntegerOps(); break;
+	// http://github.com/weidai11/cryptopp/issues/360
+	case 9995: result = TestRounding(); break;
+	// http://github.com/weidai11/cryptopp/issues/242
+	case 9994: result = TestHuffmanCodes(); break;
+	// http://github.com/weidai11/cryptopp/issues/346
+	case 9993: result = TestASN1Parse(); break;
+	case 9992: result = TestASN1Functions(); break;
+	// http://github.com/weidai11/cryptopp/issues/242
+	case 9991: result = TestX25519(); break;
+	// http://github.com/weidai11/cryptopp/issues/346
+	case 9990: result = TestEd25519(); break;
+# if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+	case 9989: result = TestAltivecOps(); break;
+# endif
+#endif
+
+	default: return false;
+	}
+
+	g_testEnd = ::time(NULLPTR);
+
+	std::cout << "\nSeed used was " << s_globalSeed;
+	std::cout << "\nTest started at " << TimeToString(g_testBegin);
+	std::cout << "\nTest ended at " << TimeToString(g_testEnd) << std::endl;
+
+	return result;
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
+
+// Microsoft puts a byte in global namespace. Combined with
+// a 'using namespace CryptoPP', it causes compile failures.
+// Also see http://github.com/weidai11/cryptopp/issues/442
+// and http://github.com/weidai11/cryptopp/issues/447.
+int CRYPTOPP_API main(int argc, char *argv[])
+{
+	return CryptoPP::Test::scoped_main(argc, argv);
+}
diff --git a/runtime/third_party/cryptopp/tftables.cpp b/runtime/third_party/cryptopp/tftables.cpp
new file mode 100644
index 0000000..2241547
--- /dev/null
+++ b/runtime/third_party/cryptopp/tftables.cpp
@@ -0,0 +1,323 @@
+// Twofish tables
+
+#include "pch.h"
+#include "config.h"
+
+#include "twofish.h"
+
+#if CRYPTOPP_GCC_DIAGNOSTIC_AVAILABLE
+# pragma GCC diagnostic ignored "-Wmissing-braces"
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const byte Twofish::Base::q[2][256] = {
+  {0xA9, 0x67, 0xB3, 0xE8, 0x04, 0xFD, 0xA3, 0x76, 0x9A, 0x92, 0x80, 0x78,
+   0xE4, 0xDD, 0xD1, 0x38, 0x0D, 0xC6, 0x35, 0x98, 0x18, 0xF7, 0xEC, 0x6C,
+   0x43, 0x75, 0x37, 0x26, 0xFA, 0x13, 0x94, 0x48, 0xF2, 0xD0, 0x8B, 0x30,
+   0x84, 0x54, 0xDF, 0x23, 0x19, 0x5B, 0x3D, 0x59, 0xF3, 0xAE, 0xA2, 0x82,
+   0x63, 0x01, 0x83, 0x2E, 0xD9, 0x51, 0x9B, 0x7C, 0xA6, 0xEB, 0xA5, 0xBE,
+   0x16, 0x0C, 0xE3, 0x61, 0xC0, 0x8C, 0x3A, 0xF5, 0x73, 0x2C, 0x25, 0x0B,
+   0xBB, 0x4E, 0x89, 0x6B, 0x53, 0x6A, 0xB4, 0xF1, 0xE1, 0xE6, 0xBD, 0x45,
+   0xE2, 0xF4, 0xB6, 0x66, 0xCC, 0x95, 0x03, 0x56, 0xD4, 0x1C, 0x1E, 0xD7,
+   0xFB, 0xC3, 0x8E, 0xB5, 0xE9, 0xCF, 0xBF, 0xBA, 0xEA, 0x77, 0x39, 0xAF,
+   0x33, 0xC9, 0x62, 0x71, 0x81, 0x79, 0x09, 0xAD, 0x24, 0xCD, 0xF9, 0xD8,
+   0xE5, 0xC5, 0xB9, 0x4D, 0x44, 0x08, 0x86, 0xE7, 0xA1, 0x1D, 0xAA, 0xED,
+   0x06, 0x70, 0xB2, 0xD2, 0x41, 0x7B, 0xA0, 0x11, 0x31, 0xC2, 0x27, 0x90,
+   0x20, 0xF6, 0x60, 0xFF, 0x96, 0x5C, 0xB1, 0xAB, 0x9E, 0x9C, 0x52, 0x1B,
+   0x5F, 0x93, 0x0A, 0xEF, 0x91, 0x85, 0x49, 0xEE, 0x2D, 0x4F, 0x8F, 0x3B,
+   0x47, 0x87, 0x6D, 0x46, 0xD6, 0x3E, 0x69, 0x64, 0x2A, 0xCE, 0xCB, 0x2F,
+   0xFC, 0x97, 0x05, 0x7A, 0xAC, 0x7F, 0xD5, 0x1A, 0x4B, 0x0E, 0xA7, 0x5A,
+   0x28, 0x14, 0x3F, 0x29, 0x88, 0x3C, 0x4C, 0x02, 0xB8, 0xDA, 0xB0, 0x17,
+   0x55, 0x1F, 0x8A, 0x7D, 0x57, 0xC7, 0x8D, 0x74, 0xB7, 0xC4, 0x9F, 0x72,
+   0x7E, 0x15, 0x22, 0x12, 0x58, 0x07, 0x99, 0x34, 0x6E, 0x50, 0xDE, 0x68,
+   0x65, 0xBC, 0xDB, 0xF8, 0xC8, 0xA8, 0x2B, 0x40, 0xDC, 0xFE, 0x32, 0xA4,
+   0xCA, 0x10, 0x21, 0xF0, 0xD3, 0x5D, 0x0F, 0x00, 0x6F, 0x9D, 0x36, 0x42,
+   0x4A, 0x5E, 0xC1, 0xE0},
+
+  {0x75, 0xF3, 0xC6, 0xF4, 0xDB, 0x7B, 0xFB, 0xC8, 0x4A, 0xD3, 0xE6, 0x6B,
+   0x45, 0x7D, 0xE8, 0x4B, 0xD6, 0x32, 0xD8, 0xFD, 0x37, 0x71, 0xF1, 0xE1,
+   0x30, 0x0F, 0xF8, 0x1B, 0x87, 0xFA, 0x06, 0x3F, 0x5E, 0xBA, 0xAE, 0x5B,
+   0x8A, 0x00, 0xBC, 0x9D, 0x6D, 0xC1, 0xB1, 0x0E, 0x80, 0x5D, 0xD2, 0xD5,
+   0xA0, 0x84, 0x07, 0x14, 0xB5, 0x90, 0x2C, 0xA3, 0xB2, 0x73, 0x4C, 0x54,
+   0x92, 0x74, 0x36, 0x51, 0x38, 0xB0, 0xBD, 0x5A, 0xFC, 0x60, 0x62, 0x96,
+   0x6C, 0x42, 0xF7, 0x10, 0x7C, 0x28, 0x27, 0x8C, 0x13, 0x95, 0x9C, 0xC7,
+   0x24, 0x46, 0x3B, 0x70, 0xCA, 0xE3, 0x85, 0xCB, 0x11, 0xD0, 0x93, 0xB8,
+   0xA6, 0x83, 0x20, 0xFF, 0x9F, 0x77, 0xC3, 0xCC, 0x03, 0x6F, 0x08, 0xBF,
+   0x40, 0xE7, 0x2B, 0xE2, 0x79, 0x0C, 0xAA, 0x82, 0x41, 0x3A, 0xEA, 0xB9,
+   0xE4, 0x9A, 0xA4, 0x97, 0x7E, 0xDA, 0x7A, 0x17, 0x66, 0x94, 0xA1, 0x1D,
+   0x3D, 0xF0, 0xDE, 0xB3, 0x0B, 0x72, 0xA7, 0x1C, 0xEF, 0xD1, 0x53, 0x3E,
+   0x8F, 0x33, 0x26, 0x5F, 0xEC, 0x76, 0x2A, 0x49, 0x81, 0x88, 0xEE, 0x21,
+   0xC4, 0x1A, 0xEB, 0xD9, 0xC5, 0x39, 0x99, 0xCD, 0xAD, 0x31, 0x8B, 0x01,
+   0x18, 0x23, 0xDD, 0x1F, 0x4E, 0x2D, 0xF9, 0x48, 0x4F, 0xF2, 0x65, 0x8E,
+   0x78, 0x5C, 0x58, 0x19, 0x8D, 0xE5, 0x98, 0x57, 0x67, 0x7F, 0x05, 0x64,
+   0xAF, 0x63, 0xB6, 0xFE, 0xF5, 0xB7, 0x3C, 0xA5, 0xCE, 0xE9, 0x68, 0x44,
+   0xE0, 0x4D, 0x43, 0x69, 0x29, 0x2E, 0xAC, 0x15, 0x59, 0xA8, 0x0A, 0x9E,
+   0x6E, 0x47, 0xDF, 0x34, 0x35, 0x6A, 0xCF, 0xDC, 0x22, 0xC9, 0xC0, 0x9B,
+   0x89, 0xD4, 0xED, 0xAB, 0x12, 0xA2, 0x0D, 0x52, 0xBB, 0x02, 0x2F, 0xA9,
+   0xD7, 0x61, 0x1E, 0xB4, 0x50, 0x04, 0xF6, 0xC2, 0x16, 0x25, 0x86, 0x56,
+   0x55, 0x09, 0xBE, 0x91}
+};
+
+const word32 Twofish::Base::mds[4][256] = {
+	0xbcbc3275, 0xecec21f3, 0x202043c6, 0xb3b3c9f4,
+	0xdada03db, 0x02028b7b, 0xe2e22bfb, 0x9e9efac8,
+	0xc9c9ec4a, 0xd4d409d3, 0x18186be6, 0x1e1e9f6b,
+	0x98980e45, 0xb2b2387d, 0xa6a6d2e8, 0x2626b74b,
+	0x3c3c57d6, 0x93938a32, 0x8282eed8, 0x525298fd,
+	0x7b7bd437, 0xbbbb3771, 0x5b5b97f1, 0x474783e1,
+	0x24243c30, 0x5151e20f, 0xbabac6f8, 0x4a4af31b,
+	0xbfbf4887, 0x0d0d70fa, 0xb0b0b306, 0x7575de3f,
+	0xd2d2fd5e, 0x7d7d20ba, 0x666631ae, 0x3a3aa35b,
+	0x59591c8a, 0x00000000, 0xcdcd93bc, 0x1a1ae09d,
+	0xaeae2c6d, 0x7f7fabc1, 0x2b2bc7b1, 0xbebeb90e,
+	0xe0e0a080, 0x8a8a105d, 0x3b3b52d2, 0x6464bad5,
+	0xd8d888a0, 0xe7e7a584, 0x5f5fe807, 0x1b1b1114,
+	0x2c2cc2b5, 0xfcfcb490, 0x3131272c, 0x808065a3,
+	0x73732ab2, 0x0c0c8173, 0x79795f4c, 0x6b6b4154,
+	0x4b4b0292, 0x53536974, 0x94948f36, 0x83831f51,
+	0x2a2a3638, 0xc4c49cb0, 0x2222c8bd, 0xd5d5f85a,
+	0xbdbdc3fc, 0x48487860, 0xffffce62, 0x4c4c0796,
+	0x4141776c, 0xc7c7e642, 0xebeb24f7, 0x1c1c1410,
+	0x5d5d637c, 0x36362228, 0x6767c027, 0xe9e9af8c,
+	0x4444f913, 0x1414ea95, 0xf5f5bb9c, 0xcfcf18c7,
+	0x3f3f2d24, 0xc0c0e346, 0x7272db3b, 0x54546c70,
+	0x29294cca, 0xf0f035e3, 0x0808fe85, 0xc6c617cb,
+	0xf3f34f11, 0x8c8ce4d0, 0xa4a45993, 0xcaca96b8,
+	0x68683ba6, 0xb8b84d83, 0x38382820, 0xe5e52eff,
+	0xadad569f, 0x0b0b8477, 0xc8c81dc3, 0x9999ffcc,
+	0x5858ed03, 0x19199a6f, 0x0e0e0a08, 0x95957ebf,
+	0x70705040, 0xf7f730e7, 0x6e6ecf2b, 0x1f1f6ee2,
+	0xb5b53d79, 0x09090f0c, 0x616134aa, 0x57571682,
+	0x9f9f0b41, 0x9d9d803a, 0x111164ea, 0x2525cdb9,
+	0xafafdde4, 0x4545089a, 0xdfdf8da4, 0xa3a35c97,
+	0xeaead57e, 0x353558da, 0xededd07a, 0x4343fc17,
+	0xf8f8cb66, 0xfbfbb194, 0x3737d3a1, 0xfafa401d,
+	0xc2c2683d, 0xb4b4ccf0, 0x32325dde, 0x9c9c71b3,
+	0x5656e70b, 0xe3e3da72, 0x878760a7, 0x15151b1c,
+	0xf9f93aef, 0x6363bfd1, 0x3434a953, 0x9a9a853e,
+	0xb1b1428f, 0x7c7cd133, 0x88889b26, 0x3d3da65f,
+	0xa1a1d7ec, 0xe4e4df76, 0x8181942a, 0x91910149,
+	0x0f0ffb81, 0xeeeeaa88, 0x161661ee, 0xd7d77321,
+	0x9797f5c4, 0xa5a5a81a, 0xfefe3feb, 0x6d6db5d9,
+	0x7878aec5, 0xc5c56d39, 0x1d1de599, 0x7676a4cd,
+	0x3e3edcad, 0xcbcb6731, 0xb6b6478b, 0xefef5b01,
+	0x12121e18, 0x6060c523, 0x6a6ab0dd, 0x4d4df61f,
+	0xcecee94e, 0xdede7c2d, 0x55559df9, 0x7e7e5a48,
+	0x2121b24f, 0x03037af2, 0xa0a02665, 0x5e5e198e,
+	0x5a5a6678, 0x65654b5c, 0x62624e58, 0xfdfd4519,
+	0x0606f48d, 0x404086e5, 0xf2f2be98, 0x3333ac57,
+	0x17179067, 0x05058e7f, 0xe8e85e05, 0x4f4f7d64,
+	0x89896aaf, 0x10109563, 0x74742fb6, 0x0a0a75fe,
+	0x5c5c92f5, 0x9b9b74b7, 0x2d2d333c, 0x3030d6a5,
+	0x2e2e49ce, 0x494989e9, 0x46467268, 0x77775544,
+	0xa8a8d8e0, 0x9696044d, 0x2828bd43, 0xa9a92969,
+	0xd9d97929, 0x8686912e, 0xd1d187ac, 0xf4f44a15,
+	0x8d8d1559, 0xd6d682a8, 0xb9b9bc0a, 0x42420d9e,
+	0xf6f6c16e, 0x2f2fb847, 0xdddd06df, 0x23233934,
+	0xcccc6235, 0xf1f1c46a, 0xc1c112cf, 0x8585ebdc,
+	0x8f8f9e22, 0x7171a1c9, 0x9090f0c0, 0xaaaa539b,
+	0x0101f189, 0x8b8be1d4, 0x4e4e8ced, 0x8e8e6fab,
+	0xababa212, 0x6f6f3ea2, 0xe6e6540d, 0xdbdbf252,
+	0x92927bbb, 0xb7b7b602, 0x6969ca2f, 0x3939d9a9,
+	0xd3d30cd7, 0xa7a72361, 0xa2a2ad1e, 0xc3c399b4,
+	0x6c6c4450, 0x07070504, 0x04047ff6, 0x272746c2,
+	0xacaca716, 0xd0d07625, 0x50501386, 0xdcdcf756,
+	0x84841a55, 0xe1e15109, 0x7a7a25be, 0x1313ef91,
+
+	0xa9d93939, 0x67901717, 0xb3719c9c, 0xe8d2a6a6,
+	0x04050707, 0xfd985252, 0xa3658080, 0x76dfe4e4,
+	0x9a084545, 0x92024b4b, 0x80a0e0e0, 0x78665a5a,
+	0xe4ddafaf, 0xddb06a6a, 0xd1bf6363, 0x38362a2a,
+	0x0d54e6e6, 0xc6432020, 0x3562cccc, 0x98bef2f2,
+	0x181e1212, 0xf724ebeb, 0xecd7a1a1, 0x6c774141,
+	0x43bd2828, 0x7532bcbc, 0x37d47b7b, 0x269b8888,
+	0xfa700d0d, 0x13f94444, 0x94b1fbfb, 0x485a7e7e,
+	0xf27a0303, 0xd0e48c8c, 0x8b47b6b6, 0x303c2424,
+	0x84a5e7e7, 0x54416b6b, 0xdf06dddd, 0x23c56060,
+	0x1945fdfd, 0x5ba33a3a, 0x3d68c2c2, 0x59158d8d,
+	0xf321ecec, 0xae316666, 0xa23e6f6f, 0x82165757,
+	0x63951010, 0x015befef, 0x834db8b8, 0x2e918686,
+	0xd9b56d6d, 0x511f8383, 0x9b53aaaa, 0x7c635d5d,
+	0xa63b6868, 0xeb3ffefe, 0xa5d63030, 0xbe257a7a,
+	0x16a7acac, 0x0c0f0909, 0xe335f0f0, 0x6123a7a7,
+	0xc0f09090, 0x8cafe9e9, 0x3a809d9d, 0xf5925c5c,
+	0x73810c0c, 0x2c273131, 0x2576d0d0, 0x0be75656,
+	0xbb7b9292, 0x4ee9cece, 0x89f10101, 0x6b9f1e1e,
+	0x53a93434, 0x6ac4f1f1, 0xb499c3c3, 0xf1975b5b,
+	0xe1834747, 0xe66b1818, 0xbdc82222, 0x450e9898,
+	0xe26e1f1f, 0xf4c9b3b3, 0xb62f7474, 0x66cbf8f8,
+	0xccff9999, 0x95ea1414, 0x03ed5858, 0x56f7dcdc,
+	0xd4e18b8b, 0x1c1b1515, 0x1eada2a2, 0xd70cd3d3,
+	0xfb2be2e2, 0xc31dc8c8, 0x8e195e5e, 0xb5c22c2c,
+	0xe9894949, 0xcf12c1c1, 0xbf7e9595, 0xba207d7d,
+	0xea641111, 0x77840b0b, 0x396dc5c5, 0xaf6a8989,
+	0x33d17c7c, 0xc9a17171, 0x62ceffff, 0x7137bbbb,
+	0x81fb0f0f, 0x793db5b5, 0x0951e1e1, 0xaddc3e3e,
+	0x242d3f3f, 0xcda47676, 0xf99d5555, 0xd8ee8282,
+	0xe5864040, 0xc5ae7878, 0xb9cd2525, 0x4d049696,
+	0x44557777, 0x080a0e0e, 0x86135050, 0xe730f7f7,
+	0xa1d33737, 0x1d40fafa, 0xaa346161, 0xed8c4e4e,
+	0x06b3b0b0, 0x706c5454, 0xb22a7373, 0xd2523b3b,
+	0x410b9f9f, 0x7b8b0202, 0xa088d8d8, 0x114ff3f3,
+	0x3167cbcb, 0xc2462727, 0x27c06767, 0x90b4fcfc,
+	0x20283838, 0xf67f0404, 0x60784848, 0xff2ee5e5,
+	0x96074c4c, 0x5c4b6565, 0xb1c72b2b, 0xab6f8e8e,
+	0x9e0d4242, 0x9cbbf5f5, 0x52f2dbdb, 0x1bf34a4a,
+	0x5fa63d3d, 0x9359a4a4, 0x0abcb9b9, 0xef3af9f9,
+	0x91ef1313, 0x85fe0808, 0x49019191, 0xee611616,
+	0x2d7cdede, 0x4fb22121, 0x8f42b1b1, 0x3bdb7272,
+	0x47b82f2f, 0x8748bfbf, 0x6d2caeae, 0x46e3c0c0,
+	0xd6573c3c, 0x3e859a9a, 0x6929a9a9, 0x647d4f4f,
+	0x2a948181, 0xce492e2e, 0xcb17c6c6, 0x2fca6969,
+	0xfcc3bdbd, 0x975ca3a3, 0x055ee8e8, 0x7ad0eded,
+	0xac87d1d1, 0x7f8e0505, 0xd5ba6464, 0x1aa8a5a5,
+	0x4bb72626, 0x0eb9bebe, 0xa7608787, 0x5af8d5d5,
+	0x28223636, 0x14111b1b, 0x3fde7575, 0x2979d9d9,
+	0x88aaeeee, 0x3c332d2d, 0x4c5f7979, 0x02b6b7b7,
+	0xb896caca, 0xda583535, 0xb09cc4c4, 0x17fc4343,
+	0x551a8484, 0x1ff64d4d, 0x8a1c5959, 0x7d38b2b2,
+	0x57ac3333, 0xc718cfcf, 0x8df40606, 0x74695353,
+	0xb7749b9b, 0xc4f59797, 0x9f56adad, 0x72dae3e3,
+	0x7ed5eaea, 0x154af4f4, 0x229e8f8f, 0x12a2abab,
+	0x584e6262, 0x07e85f5f, 0x99e51d1d, 0x34392323,
+	0x6ec1f6f6, 0x50446c6c, 0xde5d3232, 0x68724646,
+	0x6526a0a0, 0xbc93cdcd, 0xdb03dada, 0xf8c6baba,
+	0xc8fa9e9e, 0xa882d6d6, 0x2bcf6e6e, 0x40507070,
+	0xdceb8585, 0xfe750a0a, 0x328a9393, 0xa48ddfdf,
+	0xca4c2929, 0x10141c1c, 0x2173d7d7, 0xf0ccb4b4,
+	0xd309d4d4, 0x5d108a8a, 0x0fe25151, 0x00000000,
+	0x6f9a1919, 0x9de01a1a, 0x368f9494, 0x42e6c7c7,
+	0x4aecc9c9, 0x5efdd2d2, 0xc1ab7f7f, 0xe0d8a8a8,
+
+	0xbc75bc32, 0xecf3ec21, 0x20c62043, 0xb3f4b3c9,
+	0xdadbda03, 0x027b028b, 0xe2fbe22b, 0x9ec89efa,
+	0xc94ac9ec, 0xd4d3d409, 0x18e6186b, 0x1e6b1e9f,
+	0x9845980e, 0xb27db238, 0xa6e8a6d2, 0x264b26b7,
+	0x3cd63c57, 0x9332938a, 0x82d882ee, 0x52fd5298,
+	0x7b377bd4, 0xbb71bb37, 0x5bf15b97, 0x47e14783,
+	0x2430243c, 0x510f51e2, 0xbaf8bac6, 0x4a1b4af3,
+	0xbf87bf48, 0x0dfa0d70, 0xb006b0b3, 0x753f75de,
+	0xd25ed2fd, 0x7dba7d20, 0x66ae6631, 0x3a5b3aa3,
+	0x598a591c, 0x00000000, 0xcdbccd93, 0x1a9d1ae0,
+	0xae6dae2c, 0x7fc17fab, 0x2bb12bc7, 0xbe0ebeb9,
+	0xe080e0a0, 0x8a5d8a10, 0x3bd23b52, 0x64d564ba,
+	0xd8a0d888, 0xe784e7a5, 0x5f075fe8, 0x1b141b11,
+	0x2cb52cc2, 0xfc90fcb4, 0x312c3127, 0x80a38065,
+	0x73b2732a, 0x0c730c81, 0x794c795f, 0x6b546b41,
+	0x4b924b02, 0x53745369, 0x9436948f, 0x8351831f,
+	0x2a382a36, 0xc4b0c49c, 0x22bd22c8, 0xd55ad5f8,
+	0xbdfcbdc3, 0x48604878, 0xff62ffce, 0x4c964c07,
+	0x416c4177, 0xc742c7e6, 0xebf7eb24, 0x1c101c14,
+	0x5d7c5d63, 0x36283622, 0x672767c0, 0xe98ce9af,
+	0x441344f9, 0x149514ea, 0xf59cf5bb, 0xcfc7cf18,
+	0x3f243f2d, 0xc046c0e3, 0x723b72db, 0x5470546c,
+	0x29ca294c, 0xf0e3f035, 0x088508fe, 0xc6cbc617,
+	0xf311f34f, 0x8cd08ce4, 0xa493a459, 0xcab8ca96,
+	0x68a6683b, 0xb883b84d, 0x38203828, 0xe5ffe52e,
+	0xad9fad56, 0x0b770b84, 0xc8c3c81d, 0x99cc99ff,
+	0x580358ed, 0x196f199a, 0x0e080e0a, 0x95bf957e,
+	0x70407050, 0xf7e7f730, 0x6e2b6ecf, 0x1fe21f6e,
+	0xb579b53d, 0x090c090f, 0x61aa6134, 0x57825716,
+	0x9f419f0b, 0x9d3a9d80, 0x11ea1164, 0x25b925cd,
+	0xafe4afdd, 0x459a4508, 0xdfa4df8d, 0xa397a35c,
+	0xea7eead5, 0x35da3558, 0xed7aedd0, 0x431743fc,
+	0xf866f8cb, 0xfb94fbb1, 0x37a137d3, 0xfa1dfa40,
+	0xc23dc268, 0xb4f0b4cc, 0x32de325d, 0x9cb39c71,
+	0x560b56e7, 0xe372e3da, 0x87a78760, 0x151c151b,
+	0xf9eff93a, 0x63d163bf, 0x345334a9, 0x9a3e9a85,
+	0xb18fb142, 0x7c337cd1, 0x8826889b, 0x3d5f3da6,
+	0xa1eca1d7, 0xe476e4df, 0x812a8194, 0x91499101,
+	0x0f810ffb, 0xee88eeaa, 0x16ee1661, 0xd721d773,
+	0x97c497f5, 0xa51aa5a8, 0xfeebfe3f, 0x6dd96db5,
+	0x78c578ae, 0xc539c56d, 0x1d991de5, 0x76cd76a4,
+	0x3ead3edc, 0xcb31cb67, 0xb68bb647, 0xef01ef5b,
+	0x1218121e, 0x602360c5, 0x6add6ab0, 0x4d1f4df6,
+	0xce4ecee9, 0xde2dde7c, 0x55f9559d, 0x7e487e5a,
+	0x214f21b2, 0x03f2037a, 0xa065a026, 0x5e8e5e19,
+	0x5a785a66, 0x655c654b, 0x6258624e, 0xfd19fd45,
+	0x068d06f4, 0x40e54086, 0xf298f2be, 0x335733ac,
+	0x17671790, 0x057f058e, 0xe805e85e, 0x4f644f7d,
+	0x89af896a, 0x10631095, 0x74b6742f, 0x0afe0a75,
+	0x5cf55c92, 0x9bb79b74, 0x2d3c2d33, 0x30a530d6,
+	0x2ece2e49, 0x49e94989, 0x46684672, 0x77447755,
+	0xa8e0a8d8, 0x964d9604, 0x284328bd, 0xa969a929,
+	0xd929d979, 0x862e8691, 0xd1acd187, 0xf415f44a,
+	0x8d598d15, 0xd6a8d682, 0xb90ab9bc, 0x429e420d,
+	0xf66ef6c1, 0x2f472fb8, 0xdddfdd06, 0x23342339,
+	0xcc35cc62, 0xf16af1c4, 0xc1cfc112, 0x85dc85eb,
+	0x8f228f9e, 0x71c971a1, 0x90c090f0, 0xaa9baa53,
+	0x018901f1, 0x8bd48be1, 0x4eed4e8c, 0x8eab8e6f,
+	0xab12aba2, 0x6fa26f3e, 0xe60de654, 0xdb52dbf2,
+	0x92bb927b, 0xb702b7b6, 0x692f69ca, 0x39a939d9,
+	0xd3d7d30c, 0xa761a723, 0xa21ea2ad, 0xc3b4c399,
+	0x6c506c44, 0x07040705, 0x04f6047f, 0x27c22746,
+	0xac16aca7, 0xd025d076, 0x50865013, 0xdc56dcf7,
+	0x8455841a, 0xe109e151, 0x7abe7a25, 0x139113ef,
+
+	0xd939a9d9, 0x90176790, 0x719cb371, 0xd2a6e8d2,
+	0x05070405, 0x9852fd98, 0x6580a365, 0xdfe476df,
+	0x08459a08, 0x024b9202, 0xa0e080a0, 0x665a7866,
+	0xddafe4dd, 0xb06addb0, 0xbf63d1bf, 0x362a3836,
+	0x54e60d54, 0x4320c643, 0x62cc3562, 0xbef298be,
+	0x1e12181e, 0x24ebf724, 0xd7a1ecd7, 0x77416c77,
+	0xbd2843bd, 0x32bc7532, 0xd47b37d4, 0x9b88269b,
+	0x700dfa70, 0xf94413f9, 0xb1fb94b1, 0x5a7e485a,
+	0x7a03f27a, 0xe48cd0e4, 0x47b68b47, 0x3c24303c,
+	0xa5e784a5, 0x416b5441, 0x06dddf06, 0xc56023c5,
+	0x45fd1945, 0xa33a5ba3, 0x68c23d68, 0x158d5915,
+	0x21ecf321, 0x3166ae31, 0x3e6fa23e, 0x16578216,
+	0x95106395, 0x5bef015b, 0x4db8834d, 0x91862e91,
+	0xb56dd9b5, 0x1f83511f, 0x53aa9b53, 0x635d7c63,
+	0x3b68a63b, 0x3ffeeb3f, 0xd630a5d6, 0x257abe25,
+	0xa7ac16a7, 0x0f090c0f, 0x35f0e335, 0x23a76123,
+	0xf090c0f0, 0xafe98caf, 0x809d3a80, 0x925cf592,
+	0x810c7381, 0x27312c27, 0x76d02576, 0xe7560be7,
+	0x7b92bb7b, 0xe9ce4ee9, 0xf10189f1, 0x9f1e6b9f,
+	0xa93453a9, 0xc4f16ac4, 0x99c3b499, 0x975bf197,
+	0x8347e183, 0x6b18e66b, 0xc822bdc8, 0x0e98450e,
+	0x6e1fe26e, 0xc9b3f4c9, 0x2f74b62f, 0xcbf866cb,
+	0xff99ccff, 0xea1495ea, 0xed5803ed, 0xf7dc56f7,
+	0xe18bd4e1, 0x1b151c1b, 0xada21ead, 0x0cd3d70c,
+	0x2be2fb2b, 0x1dc8c31d, 0x195e8e19, 0xc22cb5c2,
+	0x8949e989, 0x12c1cf12, 0x7e95bf7e, 0x207dba20,
+	0x6411ea64, 0x840b7784, 0x6dc5396d, 0x6a89af6a,
+	0xd17c33d1, 0xa171c9a1, 0xceff62ce, 0x37bb7137,
+	0xfb0f81fb, 0x3db5793d, 0x51e10951, 0xdc3eaddc,
+	0x2d3f242d, 0xa476cda4, 0x9d55f99d, 0xee82d8ee,
+	0x8640e586, 0xae78c5ae, 0xcd25b9cd, 0x04964d04,
+	0x55774455, 0x0a0e080a, 0x13508613, 0x30f7e730,
+	0xd337a1d3, 0x40fa1d40, 0x3461aa34, 0x8c4eed8c,
+	0xb3b006b3, 0x6c54706c, 0x2a73b22a, 0x523bd252,
+	0x0b9f410b, 0x8b027b8b, 0x88d8a088, 0x4ff3114f,
+	0x67cb3167, 0x4627c246, 0xc06727c0, 0xb4fc90b4,
+	0x28382028, 0x7f04f67f, 0x78486078, 0x2ee5ff2e,
+	0x074c9607, 0x4b655c4b, 0xc72bb1c7, 0x6f8eab6f,
+	0x0d429e0d, 0xbbf59cbb, 0xf2db52f2, 0xf34a1bf3,
+	0xa63d5fa6, 0x59a49359, 0xbcb90abc, 0x3af9ef3a,
+	0xef1391ef, 0xfe0885fe, 0x01914901, 0x6116ee61,
+	0x7cde2d7c, 0xb2214fb2, 0x42b18f42, 0xdb723bdb,
+	0xb82f47b8, 0x48bf8748, 0x2cae6d2c, 0xe3c046e3,
+	0x573cd657, 0x859a3e85, 0x29a96929, 0x7d4f647d,
+	0x94812a94, 0x492ece49, 0x17c6cb17, 0xca692fca,
+	0xc3bdfcc3, 0x5ca3975c, 0x5ee8055e, 0xd0ed7ad0,
+	0x87d1ac87, 0x8e057f8e, 0xba64d5ba, 0xa8a51aa8,
+	0xb7264bb7, 0xb9be0eb9, 0x6087a760, 0xf8d55af8,
+	0x22362822, 0x111b1411, 0xde753fde, 0x79d92979,
+	0xaaee88aa, 0x332d3c33, 0x5f794c5f, 0xb6b702b6,
+	0x96cab896, 0x5835da58, 0x9cc4b09c, 0xfc4317fc,
+	0x1a84551a, 0xf64d1ff6, 0x1c598a1c, 0x38b27d38,
+	0xac3357ac, 0x18cfc718, 0xf4068df4, 0x69537469,
+	0x749bb774, 0xf597c4f5, 0x56ad9f56, 0xdae372da,
+	0xd5ea7ed5, 0x4af4154a, 0x9e8f229e, 0xa2ab12a2,
+	0x4e62584e, 0xe85f07e8, 0xe51d99e5, 0x39233439,
+	0xc1f66ec1, 0x446c5044, 0x5d32de5d, 0x72466872,
+	0x26a06526, 0x93cdbc93, 0x03dadb03, 0xc6baf8c6,
+	0xfa9ec8fa, 0x82d6a882, 0xcf6e2bcf, 0x50704050,
+	0xeb85dceb, 0x750afe75, 0x8a93328a, 0x8ddfa48d,
+	0x4c29ca4c, 0x141c1014, 0x73d72173, 0xccb4f0cc,
+	0x09d4d309, 0x108a5d10, 0xe2510fe2, 0x00000000,
+	0x9a196f9a, 0xe01a9de0, 0x8f94368f, 0xe6c742e6,
+	0xecc94aec, 0xfdd25efd, 0xab7fc1ab, 0xd8a8e0d8};
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/threefish.cpp b/runtime/third_party/cryptopp/threefish.cpp
new file mode 100644
index 0000000..494418d
--- /dev/null
+++ b/runtime/third_party/cryptopp/threefish.cpp
@@ -0,0 +1,503 @@
+// threefish.cpp - written and placed in the public domain by Jeffrey Walton
+//                 Based on public domain code by Keru Kuro. Kuro's code is
+//                 available at http://cppcrypto.sourceforge.net/.
+
+#include "pch.h"
+#include "config.h"
+
+#include "threefish.h"
+#include "misc.h"
+#include "algparam.h"
+#include "argnames.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+using CryptoPP::word64;
+using CryptoPP::rotlConstant;
+using CryptoPP::rotrConstant;
+using CryptoPP::rotlVariable;
+using CryptoPP::rotrVariable;
+
+template <unsigned int C0, unsigned int C1>
+inline void G256(word64& G0, word64& G1, word64& G2, word64& G3)
+{
+    G0 += G1;
+    G1 = rotlConstant<C0>(G1) ^ G0;
+    G2 += G3;
+    G3 = rotlConstant<C1>(G3) ^ G2;
+}
+
+template <unsigned int C0, unsigned int C1>
+inline void IG256(word64& G0, word64& G1, word64& G2, word64& G3)
+{
+    G3 = rotrConstant<C1>(G3 ^ G2);
+    G2 -= G3;
+    G1 = rotrConstant<C0>(G1 ^ G0);
+    G0 -= G1;
+}
+
+#define KS256(r) \
+    G0 += m_rkey[(r + 1) % 5]; \
+    G1 += m_rkey[(r + 2) % 5] + m_tweak[(r + 1) % 3]; \
+    G2 += m_rkey[(r + 3) % 5] + m_tweak[(r + 2) % 3]; \
+    G3 += m_rkey[(r + 4) % 5] + r + 1;
+
+#define IKS256(r) \
+    G0 -= m_rkey[(r + 1) % 5]; \
+    G1 -= (m_rkey[(r + 2) % 5] + m_tweak[(r + 1) % 3]); \
+    G2 -= (m_rkey[(r + 3) % 5] + m_tweak[(r + 2) % 3]); \
+    G3 -= (m_rkey[(r + 4) % 5] + r + 1);
+
+#define G256x8(r) \
+    G256<14, 16>(G0, G1, G2, G3); \
+    G256<52, 57>(G0, G3, G2, G1); \
+    G256<23, 40>(G0, G1, G2, G3); \
+    G256< 5, 37>(G0, G3, G2, G1); \
+    KS256(r); \
+    G256<25, 33>(G0, G1, G2, G3); \
+    G256<46, 12>(G0, G3, G2, G1); \
+    G256<58, 22>(G0, G1, G2, G3); \
+    G256<32, 32>(G0, G3, G2, G1); \
+    KS256(r + 1);
+
+#define IG256x8(r) \
+    IG256<32, 32>(G0, G3, G2, G1); \
+    IG256<58, 22>(G0, G1, G2, G3); \
+    IG256<46, 12>(G0, G3, G2, G1); \
+    IG256<25, 33>(G0, G1, G2, G3); \
+    IKS256(r); \
+    IG256< 5, 37>(G0, G3, G2, G1); \
+    IG256<23, 40>(G0, G1, G2, G3); \
+    IG256<52, 57>(G0, G3, G2, G1); \
+    IG256<14, 16>(G0, G1, G2, G3); \
+    IKS256(r - 1);
+
+///////////////////
+
+template <unsigned int C0, unsigned int C1, unsigned int C2, unsigned int C3>
+inline void G512(word64& G0, word64& G1, word64& G2, word64& G3, word64& G4, word64& G5, word64& G6, word64& G7)
+{
+    G0 += G1;
+    G1 = rotlConstant<C0>(G1) ^ G0;
+    G2 += G3;
+    G3 = rotlConstant<C1>(G3) ^ G2;
+    G4 += G5;
+    G5 = rotlConstant<C2>(G5) ^ G4;
+    G6 += G7;
+    G7 = rotlConstant<C3>(G7) ^ G6;
+}
+
+template <unsigned int C0, unsigned int C1, unsigned int C2, unsigned int C3>
+inline void IG512(word64& G0, word64& G1, word64& G2, word64& G3, word64& G4, word64& G5, word64& G6, word64& G7)
+{
+    G7 = rotrConstant<C3>(G7 ^ G6);
+    G6 -= G7;
+    G5 = rotrConstant<C2>(G5 ^ G4);
+    G4 -= G5;
+    G3 = rotrConstant<C1>(G3 ^ G2);
+    G2 -= G3;
+    G1 = rotrConstant<C0>(G1 ^ G0);
+    G0 -= G1;
+}
+
+#define KS512(r) \
+    G0 += m_rkey[(r + 1) % 9]; \
+    G1 += m_rkey[(r + 2) % 9]; \
+    G2 += m_rkey[(r + 3) % 9]; \
+    G3 += m_rkey[(r + 4) % 9]; \
+    G4 += m_rkey[(r + 5) % 9]; \
+    G5 += m_rkey[(r + 6) % 9] + m_tweak[(r + 1) % 3]; \
+    G6 += m_rkey[(r + 7) % 9] + m_tweak[(r + 2) % 3]; \
+    G7 += m_rkey[(r + 8) % 9] + r + 1;
+
+#define IKS512(r) \
+    G0 -= m_rkey[(r + 1) % 9]; \
+    G1 -= m_rkey[(r + 2) % 9]; \
+    G2 -= m_rkey[(r + 3) % 9]; \
+    G3 -= m_rkey[(r + 4) % 9]; \
+    G4 -= m_rkey[(r + 5) % 9]; \
+    G5 -= (m_rkey[(r + 6) % 9] + m_tweak[(r + 1) % 3]); \
+    G6 -= (m_rkey[(r + 7) % 9] + m_tweak[(r + 2) % 3]); \
+    G7 -= (m_rkey[(r + 8) % 9] + r + 1);
+
+#define IG512x8(r) \
+    IG512< 8, 35, 56, 22>(G6, G1, G0, G7, G2, G5, G4, G3); \
+    IG512<25, 29, 39, 43>(G4, G1, G6, G3, G0, G5, G2, G7); \
+    IG512<13, 50, 10, 17>(G2, G1, G4, G7, G6, G5, G0, G3); \
+    IG512<39, 30, 34, 24>(G0, G1, G2, G3, G4, G5, G6, G7); \
+    IKS512(r) \
+    IG512<44,  9, 54, 56>(G6, G1, G0, G7, G2, G5, G4, G3); \
+    IG512<17, 49, 36, 39>(G4, G1, G6, G3, G0, G5, G2, G7); \
+    IG512<33, 27, 14, 42>(G2, G1, G4, G7, G6, G5, G0, G3); \
+    IG512<46, 36, 19, 37>(G0, G1, G2, G3, G4, G5, G6, G7); \
+    IKS512(r - 1)
+
+#define G512x8(r) \
+    G512<46, 36, 19, 37>(G0, G1, G2, G3, G4, G5, G6, G7); \
+    G512<33, 27, 14, 42>(G2, G1, G4, G7, G6, G5, G0, G3); \
+    G512<17, 49, 36, 39>(G4, G1, G6, G3, G0, G5, G2, G7); \
+    G512<44,  9, 54, 56>(G6, G1, G0, G7, G2, G5, G4, G3); \
+    KS512(r) \
+    G512<39, 30, 34, 24>(G0, G1, G2, G3, G4, G5, G6, G7); \
+    G512<13, 50, 10, 17>(G2, G1, G4, G7, G6, G5, G0, G3); \
+    G512<25, 29, 39, 43>(G4, G1, G6, G3, G0, G5, G2, G7); \
+    G512< 8, 35, 56, 22>(G6, G1, G0, G7, G2, G5, G4, G3); \
+    KS512(r + 1)
+
+///////////////////
+
+template <unsigned int C0, unsigned int C1, unsigned int C2, unsigned int C3>
+inline void G1024A(word64& G0, word64& G1, word64& G2, word64& G3,
+        word64& G4, word64& G5, word64& G6, word64& G7)
+{
+    G0 += G1;
+    G1 = rotlConstant<C0>(G1) ^ G0;
+    G2 += G3;
+    G3 = rotlConstant<C1>(G3) ^ G2;
+    G4 += G5;
+    G5 = rotlConstant<C2>(G5) ^ G4;
+    G6 += G7;
+    G7 = rotlConstant<C3>(G7) ^ G6;
+}
+
+template <unsigned int C4, unsigned int C5, unsigned int C6, unsigned int C7>
+inline void G1024B(word64& G8, word64& G9, word64& G10, word64& G11,
+        word64& G12, word64& G13, word64& G14, word64& G15)
+{
+    G8 += G9;
+    G9 = rotlConstant<C4>(G9) ^ G8;
+    G10 += G11;
+    G11 = rotlConstant<C5>(G11) ^ G10;
+    G12 += G13;
+    G13 = rotlConstant<C6>(G13) ^ G12;
+    G14 += G15;
+    G15 = rotlConstant<C7>(G15) ^ G14;
+}
+
+template <unsigned int C0, unsigned int C1, unsigned int C2, unsigned int C3,
+    unsigned int C4, unsigned int C5, unsigned int C6, unsigned int C7>
+inline void G1024(word64& G0, word64& G1, word64& G2, word64& G3, word64& G4, word64& G5,
+    word64& G6, word64& G7, word64& G8, word64& G9, word64& G10, word64& G11, word64& G12,
+    word64& G13, word64& G14, word64& G15)
+{
+	// The extra gyrations promote inlining. Without it Threefish1024 looses 10 cpb.
+	G1024A<C0, C1, C2, C3>(G0, G1,  G2,  G3,  G4,  G5,  G6,  G7);
+	G1024B<C4, C5, C6, C7>(G8, G9, G10, G11, G12, G13, G14, G15);
+}
+
+template <unsigned int C4, unsigned int C5, unsigned int C6, unsigned int C7>
+inline void IG1024A(word64& G8, word64& G9, word64& G10, word64& G11,
+        word64& G12, word64& G13, word64& G14, word64& G15)
+{
+    G15 = rotrConstant<C7>(G15 ^ G14);
+    G14 -= G15;
+    G13 = rotrConstant<C6>(G13 ^ G12);
+    G12 -= G13;
+    G11 = rotrConstant<C5>(G11 ^ G10);
+    G10 -= G11;
+    G9 = rotrConstant<C4>(G9 ^ G8);
+    G8 -= G9;
+}
+
+template <unsigned int C0, unsigned int C1, unsigned int C2, unsigned int C3>
+inline void IG1024B(word64& G0, word64& G1, word64& G2, word64& G3,
+        word64& G4, word64& G5, word64& G6, word64& G7)
+{
+    G7 = rotrConstant<C3>(G7 ^ G6);
+    G6 -= G7;
+    G5 = rotrConstant<C2>(G5 ^ G4);
+    G4 -= G5;
+    G3 = rotrConstant<C1>(G3 ^ G2);
+    G2 -= G3;
+    G1 = rotrConstant<C0>(G1 ^ G0);
+    G0 -= G1;
+}
+
+template <unsigned int C0, unsigned int C1, unsigned int C2, unsigned int C3,
+    unsigned int C4, unsigned int C5, unsigned int C6, unsigned int C7>
+inline void IG1024(word64& G0, word64& G1, word64& G2, word64& G3, word64& G4, word64& G5,
+    word64& G6, word64& G7, word64& G8, word64& G9, word64& G10, word64& G11, word64& G12,
+    word64& G13, word64& G14, word64& G15)
+{
+	// The extra gyrations promote inlining. Without it Threefish1024 looses 10 cpb.
+	IG1024A<C4, C5, C6, C7>(G8, G9, G10, G11, G12, G13, G14, G15);
+	IG1024B<C0, C1, C2, C3>(G0, G1,  G2,  G3,  G4,  G5,  G6,  G7);
+}
+
+#define KS1024(r) \
+    G0 += m_rkey[(r + 1) % 17]; \
+    G1 += m_rkey[(r + 2) % 17]; \
+    G2 += m_rkey[(r + 3) % 17]; \
+    G3 += m_rkey[(r + 4) % 17]; \
+    G4 += m_rkey[(r + 5) % 17]; \
+    G5 += m_rkey[(r + 6) % 17]; \
+    G6 += m_rkey[(r + 7) % 17]; \
+    G7 += m_rkey[(r + 8) % 17]; \
+    G8 += m_rkey[(r + 9) % 17]; \
+    G9 += m_rkey[(r + 10) % 17]; \
+    G10 += m_rkey[(r + 11) % 17]; \
+    G11 += m_rkey[(r + 12) % 17]; \
+    G12 += m_rkey[(r + 13) % 17]; \
+    G13 += m_rkey[(r + 14) % 17] + m_tweak[(r + 1) % 3]; \
+    G14 += m_rkey[(r + 15) % 17] + m_tweak[(r + 2) % 3]; \
+    G15 += m_rkey[(r + 16) % 17] + r + 1;
+
+#define IKS1024(r) \
+    G0 -= m_rkey[(r + 1) % 17]; \
+    G1 -= m_rkey[(r + 2) % 17]; \
+    G2 -= m_rkey[(r + 3) % 17]; \
+    G3 -= m_rkey[(r + 4) % 17]; \
+    G4 -= m_rkey[(r + 5) % 17]; \
+    G5 -= m_rkey[(r + 6) % 17]; \
+    G6 -= m_rkey[(r + 7) % 17]; \
+    G7 -= m_rkey[(r + 8) % 17]; \
+    G8 -= m_rkey[(r + 9) % 17]; \
+    G9 -= m_rkey[(r + 10) % 17]; \
+    G10 -= m_rkey[(r + 11) % 17]; \
+    G11 -= m_rkey[(r + 12) % 17]; \
+    G12 -= m_rkey[(r + 13) % 17]; \
+    G13 -= (m_rkey[(r + 14) % 17] + m_tweak[(r + 1) % 3]); \
+    G14 -= (m_rkey[(r + 15) % 17] + m_tweak[(r + 2) % 3]); \
+    G15 -= (m_rkey[(r + 16) % 17] + r + 1);
+
+#define G1024x8(r) \
+    G1024A<24, 13,  8, 47>(G0, G1, G2, G3, G4, G5, G6, G7); \
+    G1024B< 8, 17, 22, 37>(G8, G9, G10, G11, G12, G13, G14, G15); \
+    G1024A<38, 19, 10, 55>(G0, G9, G2, G13, G6, G11, G4, G15); \
+    G1024B<49, 18, 23, 52>(G10, G7, G12, G3, G14, G5, G8, G1); \
+    G1024A<33,  4, 51, 13>(G0, G7, G2, G5, G4, G3, G6, G1); \
+    G1024B<34, 41, 59, 17>(G12, G15, G14, G13, G8, G11, G10, G9); \
+    G1024A< 5, 20, 48, 41>(G0, G15, G2, G11, G6, G13, G4, G9); \
+    G1024B<47, 28, 16, 25>(G14, G1, G8, G5, G10, G3, G12, G7); \
+    KS1024(r); \
+    G1024A<41,  9, 37, 31>(G0, G1, G2, G3, G4, G5, G6, G7); \
+    G1024B<12, 47, 44, 30>(G8, G9, G10, G11, G12, G13, G14, G15); \
+    G1024A<16, 34, 56, 51>(G0, G9, G2, G13, G6, G11, G4, G15); \
+    G1024B< 4, 53, 42, 41>(G10, G7, G12, G3, G14, G5, G8, G1); \
+    G1024A<31, 44, 47, 46>(G0, G7, G2, G5, G4, G3, G6, G1); \
+    G1024B<19, 42, 44, 25>(G12, G15, G14, G13, G8, G11, G10, G9); \
+    G1024A< 9, 48, 35, 52>(G0, G15, G2, G11, G6, G13, G4, G9); \
+    G1024B<23, 31, 37, 20>(G14, G1, G8, G5, G10, G3, G12, G7); \
+    KS1024(r + 1);
+
+#define IG1024x8(r) \
+    IG1024A< 9, 48, 35, 52>(G0, G15, G2, G11, G6, G13, G4, G9); \
+    IG1024B<23, 31, 37, 20>(G14, G1, G8, G5, G10, G3, G12, G7); \
+    IG1024A<31, 44, 47, 46>(G0, G7, G2, G5, G4, G3, G6, G1); \
+    IG1024B<19, 42, 44, 25>(G12, G15, G14, G13, G8, G11, G10, G9); \
+    IG1024A<16, 34, 56, 51>(G0, G9, G2, G13, G6, G11, G4, G15); \
+    IG1024B< 4, 53, 42, 41>(G10, G7, G12, G3, G14, G5, G8, G1); \
+    IG1024A<41,  9, 37, 31>(G0, G1, G2, G3, G4, G5, G6, G7); \
+    IG1024B<12, 47, 44, 30>(G8, G9, G10, G11, G12, G13, G14, G15); \
+    IKS1024(r); \
+    IG1024A< 5, 20, 48, 41>(G0, G15, G2, G11, G6, G13, G4, G9); \
+    IG1024B<47, 28, 16, 25>(G14, G1, G8, G5, G10, G3, G12, G7); \
+    IG1024A<33,  4, 51, 13>(G0, G7, G2, G5, G4, G3, G6, G1); \
+    IG1024B<34, 41, 59, 17>(G12, G15, G14, G13, G8, G11, G10, G9); \
+    IG1024A<38, 19, 10, 55>(G0, G9, G2, G13, G6, G11, G4, G15); \
+    IG1024B<49, 18, 23, 52>(G10, G7, G12, G3, G14, G5, G8, G1); \
+    IG1024A<24, 13,  8, 47>(G0, G1, G2, G3, G4, G5, G6, G7); \
+    IG1024B< 8, 17, 22, 37>(G8, G9, G10, G11, G12, G13, G14, G15); \
+    IKS1024(r - 1);
+
+ANONYMOUS_NAMESPACE_END
+
+///////////////////////////////////////////////////////////////////////////////
+///////////////////////////////////////////////////////////////////////////////
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void Threefish256::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    // Blocksize is Keylength for Threefish
+    CRYPTOPP_ASSERT(keyLength == KEYLENGTH);
+
+    m_rkey.New(5);
+    m_wspace.New(4);
+
+    GetUserKey(LITTLE_ENDIAN_ORDER, m_rkey.begin(), 4, userKey, keyLength);
+    m_rkey[4] = W64LIT(0x1BD11BDAA9FC1A22) ^ m_rkey[0] ^ m_rkey[1] ^ m_rkey[2] ^ m_rkey[3];
+
+    SetTweak(params);
+}
+
+void Threefish256::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64 &G0=m_wspace[0], &G1=m_wspace[1], &G2=m_wspace[2], &G3=m_wspace[3];
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(G0)(G1)(G2)(G3);
+
+    G0 += m_rkey[0]; G1 += m_rkey[1]; G2 += m_rkey[2];
+    G3 += m_rkey[3]; G1 += m_tweak[0]; G2 += m_tweak[1];
+
+    G256x8(0); G256x8(2); G256x8(4); G256x8(6); G256x8(8);
+    G256x8(10); G256x8(12); G256x8(14); G256x8(16);
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(G0)(G1)(G2)(G3);
+}
+
+void Threefish256::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64 &G0=m_wspace[0], &G1=m_wspace[1], &G2=m_wspace[2], &G3=m_wspace[3];
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(G0)(G1)(G2)(G3);
+
+    G0 -= m_rkey[3]; G1 -= m_rkey[4]; G2 -= m_rkey[0]; G3 -= m_rkey[1];
+    G1 -= m_tweak[0]; G2 -= m_tweak[1]; G3 -= 18;
+
+    IG256x8(16); IG256x8(14); IG256x8(12); IG256x8(10);
+    IG256x8(8); IG256x8(6); IG256x8(4); IG256x8(2); IG256x8(0);
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(G0)(G1)(G2)(G3);
+}
+
+/////////////////////////////////////////////////////////////////
+
+void Threefish512::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    // Blocksize is Keylength for Threefish
+    CRYPTOPP_ASSERT(keyLength == KEYLENGTH);
+
+    m_rkey.New(9);
+    m_wspace.New(8);
+
+    GetUserKey(LITTLE_ENDIAN_ORDER, m_rkey.begin(), 8, userKey, keyLength);
+    m_rkey[8] = W64LIT(0x1BD11BDAA9FC1A22) ^ m_rkey[0] ^ m_rkey[1] ^ m_rkey[2] ^ m_rkey[3] ^
+        m_rkey[4] ^ m_rkey[5] ^ m_rkey[6] ^ m_rkey[7];
+
+    SetTweak(params);
+}
+
+void Threefish512::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64 &G0=m_wspace[0],   &G1=m_wspace[1],   &G2=m_wspace[2],   &G3=m_wspace[3];
+    word64 &G4=m_wspace[4],   &G5=m_wspace[5],   &G6=m_wspace[6],   &G7=m_wspace[7];
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(G0)(G1)(G2)(G3)(G4)(G5)(G6)(G7);
+
+    // 34 integer instructions total
+    G0 += m_rkey[0]; G1 += m_rkey[1]; G2 += m_rkey[2]; G3 += m_rkey[3];
+    G4 += m_rkey[4]; G5 += m_rkey[5]; G6 += m_rkey[6]; G7 += m_rkey[7];
+    G5 += m_tweak[0]; G6 += m_tweak[1];
+
+    G512x8(0); G512x8(2); G512x8(4); G512x8(6); G512x8(8);
+    G512x8(10); G512x8(12); G512x8(14); G512x8(16);
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(G0)(G1)(G2)(G3)(G4)(G5)(G6)(G7);
+}
+
+void Threefish512::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64 &G0=m_wspace[0],   &G1=m_wspace[1],   &G2=m_wspace[2],   &G3=m_wspace[3];
+    word64 &G4=m_wspace[4],   &G5=m_wspace[5],   &G6=m_wspace[6],   &G7=m_wspace[7];
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(G0)(G1)(G2)(G3)(G4)(G5)(G6)(G7);
+
+    G0 -= m_rkey[0]; G1 -= m_rkey[1]; G2 -= m_rkey[2]; G3 -= m_rkey[3];
+    G4 -= m_rkey[4]; G5 -= m_rkey[5]; G6 -= m_rkey[6]; G7 -= m_rkey[7];
+    G5 -= m_tweak[0]; G6 -= m_tweak[1]; G7 -= 18;
+
+    IG512x8(16); IG512x8(14); IG512x8(12); IG512x8(10);
+    IG512x8(8); IG512x8(6); IG512x8(4); IG512x8(2); IG512x8(0);
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(G0)(G1)(G2)(G3)(G4)(G5)(G6)(G7);
+}
+
+/////////////////////////////////////////////////////////////////
+
+void Threefish1024::Base::UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params)
+{
+    // Blocksize is Keylength for Threefish
+    CRYPTOPP_ASSERT(keyLength == KEYLENGTH);
+
+    m_rkey.New(17);
+    m_wspace.New(16);
+
+    GetUserKey(LITTLE_ENDIAN_ORDER, m_rkey.begin(), 16, userKey, keyLength);
+    m_rkey[16] = W64LIT(0x1BD11BDAA9FC1A22) ^ m_rkey[0] ^ m_rkey[1] ^ m_rkey[2] ^ m_rkey[3] ^ m_rkey[4] ^
+        m_rkey[5] ^ m_rkey[6] ^ m_rkey[7] ^ m_rkey[8] ^ m_rkey[9] ^ m_rkey[10] ^ m_rkey[11] ^ m_rkey[12] ^
+        m_rkey[13] ^ m_rkey[14] ^ m_rkey[15];
+
+    SetTweak(params);
+}
+
+void Threefish1024::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64  &G0=m_wspace[0],   &G1=m_wspace[1],   &G2=m_wspace[2],   &G3=m_wspace[3];
+    word64  &G4=m_wspace[4],   &G5=m_wspace[5],   &G6=m_wspace[6],   &G7=m_wspace[7];
+    word64  &G8=m_wspace[8],   &G9=m_wspace[9],  &G10=m_wspace[10], &G11=m_wspace[11];
+    word64 &G12=m_wspace[12], &G13=m_wspace[13], &G14=m_wspace[14], &G15=m_wspace[15];
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(G0)(G1)(G2)(G3)(G4)(G5)(G6)(G7)(G8)(G9)(G10)(G11)(G12)(G13)(G14)(G15);
+
+    G0 += m_rkey[0]; G1 += m_rkey[1]; G2 += m_rkey[2]; G3 += m_rkey[3];
+    G4 += m_rkey[4]; G5 += m_rkey[5]; G6 += m_rkey[6]; G7 += m_rkey[7];
+    G8 += m_rkey[8]; G9 += m_rkey[9]; G10 += m_rkey[10]; G11 += m_rkey[11];
+    G12 += m_rkey[12]; G13 += m_rkey[13]; G14 += m_rkey[14]; G15 += m_rkey[15];
+    G13 += m_tweak[0]; G14 += m_tweak[1];
+
+    G1024x8(0); G1024x8(2); G1024x8(4); G1024x8(6); G1024x8(8);
+    G1024x8(10); G1024x8(12); G1024x8(14); G1024x8(16); G1024x8(18);
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(G0)(G1)(G2)(G3)(G4)(G5)(G6)(G7)(G8)(G9)(G10)(G11)(G12)(G13)(G14)(G15);
+}
+
+void Threefish1024::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+    word64  &G0=m_wspace[0],   &G1=m_wspace[1],   &G2=m_wspace[2],   &G3=m_wspace[3];
+    word64  &G4=m_wspace[4],   &G5=m_wspace[5],   &G6=m_wspace[6],   &G7=m_wspace[7];
+    word64  &G8=m_wspace[8],   &G9=m_wspace[9],  &G10=m_wspace[10], &G11=m_wspace[11];
+    word64 &G12=m_wspace[12], &G13=m_wspace[13], &G14=m_wspace[14], &G15=m_wspace[15];
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef GetBlock<word64, LittleEndian, false> InBlock;
+    InBlock iblk(inBlock);
+    iblk(G0)(G1)(G2)(G3)(G4)(G5)(G6)(G7)(G8)(G9)(G10)(G11)(G12)(G13)(G14)(G15);
+
+    G0 -= m_rkey[3]; G1 -= m_rkey[4]; G2 -= m_rkey[5]; G3 -= m_rkey[6];
+    G4 -= m_rkey[7]; G5 -= m_rkey[8]; G6 -= m_rkey[9]; G7 -= m_rkey[10];
+    G8 -= m_rkey[11]; G9 -= m_rkey[12]; G10 -= m_rkey[13]; G11 -= m_rkey[14];
+    G12 -= m_rkey[15]; G13 -= m_rkey[16]; G14 -= m_rkey[0]; G15 -= m_rkey[1];
+    G13 -= m_tweak[2]; G14 -= m_tweak[0]; G15 -= 20;
+
+    IG1024x8(18); IG1024x8(16); IG1024x8(14); IG1024x8(12); IG1024x8(10);
+    IG1024x8(8); IG1024x8(6); IG1024x8(4); IG1024x8(2); IG1024x8(0);
+
+    // Reverse bytes on BigEndian; align pointer on LittleEndian
+    typedef PutBlock<word64, LittleEndian, false> OutBlock;
+    OutBlock oblk(xorBlock, outBlock);
+    oblk(G0)(G1)(G2)(G3)(G4)(G5)(G6)(G7)(G8)(G9)(G10)(G11)(G12)(G13)(G14)(G15);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/threefish.h b/runtime/third_party/cryptopp/threefish.h
new file mode 100644
index 0000000..ab32ce0
--- /dev/null
+++ b/runtime/third_party/cryptopp/threefish.h
@@ -0,0 +1,201 @@
+// threefish.h - written and placed in the public domain by Jeffrey Walton
+//               Based on public domain code by Keru Kuro. Kuro's code is
+//               available at http://cppcrypto.sourceforge.net/.
+
+/// \file Threefish.h
+/// \brief Classes for the Threefish block cipher
+/// \since Crypto++ 6.0
+
+#ifndef CRYPTOPP_THREEFISH_H
+#define CRYPTOPP_THREEFISH_H
+
+#include "config.h"
+#include "seckey.h"
+#include "secblock.h"
+#include "algparam.h"
+#include "argnames.h"
+#include "stdcpp.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Threefish block cipher information
+/// \tparam BS block size of the cipher, in bytes
+/// \since Crypto++ 6.0
+template <unsigned int BS>
+struct Threefish_Info : public FixedBlockSize<BS>, FixedKeyLength<BS>
+{
+    static const std::string StaticAlgorithmName()
+    {
+        // Format is Cipher-Blocksize(Keylength)
+        return "Threefish-" + IntToString(BS*8) + "(" + IntToString(BS*8) + ")";
+    }
+};
+
+/// \brief Threefish block cipher base class
+/// \tparam BS block size of the cipher, in bytes
+/// \details User code should use Threefish256, Threefish512, Threefish1024
+/// \sa Threefish256, Threefish512, Threefish1024, <a href="http://www.cryptopp.com/wiki/Threefish">Threefish</a>
+/// \since Crypto++ 6.0
+template <unsigned int BS>
+struct CRYPTOPP_NO_VTABLE Threefish_Base
+{
+	virtual ~Threefish_Base() {}
+
+    void SetTweak(const NameValuePairs &params)
+    {
+        m_tweak.New(3);
+        ConstByteArrayParameter t;
+        if (params.GetValue(Name::Tweak(), t))
+        {
+            // Tweak size is fixed at 16 for Threefish
+            CRYPTOPP_ASSERT(t.size() == 16);
+            GetUserKey(LITTLE_ENDIAN_ORDER, m_tweak.begin(), 2, t.begin(), 16);
+            m_tweak[2] = m_tweak[0] ^ m_tweak[1];
+        }
+        else
+        {
+            std::memset(m_tweak.begin(), 0x00, 24);
+        }
+    }
+
+    typedef SecBlock<word64, AllocatorWithCleanup<word64, true> > AlignedSecBlock64;
+    mutable AlignedSecBlock64 m_wspace;   // workspace
+    AlignedSecBlock64         m_rkey;     // keys
+    AlignedSecBlock64         m_tweak;
+};
+
+/// \brief Threefish 256-bit block cipher
+/// \details Threefish256 provides 256-bit block size. The valid key size is 256-bit.
+/// \note Crypto++ provides a byte oriented implementation
+/// \sa Threefish512, Threefish1024, <a href="http://www.cryptopp.com/wiki/Threefish">Threefish</a>
+/// \since Crypto++ 6.0
+class CRYPTOPP_NO_VTABLE Threefish256 : public Threefish_Info<32>, public BlockCipherDocumentation
+{
+public:
+    /// \brief Threefish block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Base : public Threefish_Base<32>, public BlockCipherImpl<Threefish_Info<32> >
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    protected:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    /// \brief Decryption transformation
+    /// \details Dec provides implementation for decryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    protected:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef Threefish256::Encryption Threefish256Encryption;
+typedef Threefish256::Decryption Threefish256Decryption;
+
+/// \brief Threefish 512-bit block cipher
+/// \details Threefish512 provides 512-bit block size. The valid key size is 512-bit.
+/// \note Crypto++ provides a byte oriented implementation
+/// \sa Threefish256, Threefish1024, <a href="http://www.cryptopp.com/wiki/Threefish">Threefish</a>
+/// \since Crypto++ 6.0
+class CRYPTOPP_NO_VTABLE Threefish512 : public Threefish_Info<64>, public BlockCipherDocumentation
+{
+public:
+    /// \brief Threefish block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Base : public Threefish_Base<64>, public BlockCipherImpl<Threefish_Info<64> >
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    protected:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    /// \brief Decryption transformation
+    /// \details Dec provides implementation for decryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    protected:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef Threefish512::Encryption Threefish512Encryption;
+typedef Threefish512::Decryption Threefish512Decryption;
+
+/// \brief Threefish 1024-bit block cipher
+/// \details Threefish1024 provides 1024-bit block size. The valid key size is 1024-bit.
+/// \note Crypto++ provides a byte oriented implementation
+/// \sa Threefish256, Threefish512, <a href="http://www.cryptopp.com/wiki/Threefish">Threefish</a>
+/// \since Crypto++ 6.0
+class CRYPTOPP_NO_VTABLE Threefish1024 : public Threefish_Info<128>, public BlockCipherDocumentation
+{
+public:
+    /// \brief Threefish block cipher transformation functions
+    /// \details Provides implementation common to encryption and decryption
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Base : public Threefish_Base<128>, public BlockCipherImpl<Threefish_Info<128> >
+    {
+    protected:
+        void UncheckedSetKey(const byte *userKey, unsigned int keyLength, const NameValuePairs &params);
+    };
+
+    /// \brief Encryption transformation
+    /// \details Enc provides implementation for encryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Enc : public Base
+    {
+    protected:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    /// \brief Encryption transformation
+    /// \details Dec provides implementation for decryption transformation. All key and block
+    ///   sizes are supported.
+    /// \since Crypto++ 6.0
+    class CRYPTOPP_NO_VTABLE Dec : public Base
+    {
+    protected:
+        void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+    };
+
+    typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+    typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef Threefish1024::Encryption Threefish1024Encryption;
+typedef Threefish1024::Decryption Threefish1024Decryption;
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_THREEFISH_H
diff --git a/runtime/third_party/cryptopp/tiger.cpp b/runtime/third_party/cryptopp/tiger.cpp
new file mode 100644
index 0000000..a1816a2
--- /dev/null
+++ b/runtime/third_party/cryptopp/tiger.cpp
@@ -0,0 +1,282 @@
+// tiger.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+#include "config.h"
+
+#include "tiger.h"
+#include "misc.h"
+#include "cpu.h"
+
+#if defined(CRYPTOPP_DISABLE_TIGER_ASM)
+# undef CRYPTOPP_X86_ASM_AVAILABLE
+# undef CRYPTOPP_X32_ASM_AVAILABLE
+# undef CRYPTOPP_X64_ASM_AVAILABLE
+# undef CRYPTOPP_SSE2_ASM_AVAILABLE
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+std::string Tiger::AlgorithmProvider() const
+{
+#ifndef CRYPTOPP_DISABLE_TIGER_ASM
+# if CRYPTOPP_SSE2_ASM_AVAILABLE
+	if (HasSSE2())
+		return "SSE2";
+# endif
+#endif
+	return "C++";
+}
+
+void Tiger::InitState(HashWordType *state)
+{
+	state[0] = W64LIT(0x0123456789ABCDEF);
+	state[1] = W64LIT(0xFEDCBA9876543210);
+	state[2] = W64LIT(0xF096A5B4C3B2E187);
+}
+
+void Tiger::TruncatedFinal(byte *digest, size_t digestSize)
+{
+	CRYPTOPP_ASSERT(digest != NULLPTR);
+	ThrowIfInvalidTruncatedSize(digestSize);
+
+	PadLastBlock(56, 0x01);
+	CorrectEndianess(m_data, m_data, 56);
+
+	m_data[7] = GetBitCountLo();
+
+	Transform(m_state, m_data);
+	CorrectEndianess(m_state, m_state, DigestSize());
+	std::memcpy(digest, m_state, digestSize);
+
+	Restart();		// reinit for next use
+}
+
+void Tiger::Transform (word64 *state, const word64 *data)
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE && CRYPTOPP_BOOL_X86
+	if (HasSSE2())
+	{
+#ifdef __GNUC__
+		__asm__ __volatile__
+		(
+		INTEL_NOPREFIX
+		AS_PUSH_IF86(bx)
+#else
+		AS2(	lea		edx, [table])
+		AS2(	mov		eax, state)
+		AS2(	mov		esi, data)
+#endif
+		AS2(	movq	mm0, [eax])
+		AS2(	movq	mm1, [eax+1*8])
+		AS2(	movq	mm5, mm1)
+		AS2(	movq	mm2, [eax+2*8])
+		AS2(	movq	mm7, [edx+4*2048+0*8])
+		AS2(	movq	mm6, [edx+4*2048+1*8])
+		AS2(	mov		ecx, esp)
+		AS2(	and		esp, 0xfffffff0)
+		AS2(	sub		esp, 8*8)
+		AS_PUSH_IF86(cx)
+
+#define SSE2_round(a,b,c,x,mul) \
+		AS2(	pxor	c, [x])\
+		AS2(	movd	ecx, c)\
+		AS2(	movzx	edi, cl)\
+		AS2(	movq	mm3, [edx+0*2048+edi*8])\
+		AS2(	movzx	edi, ch)\
+		AS2(	movq	mm4, [edx+3*2048+edi*8])\
+		AS2(	shr		ecx, 16)\
+		AS2(	movzx	edi, cl)\
+		AS2(	pxor	mm3, [edx+1*2048+edi*8])\
+		AS2(	movzx	edi, ch)\
+		AS2(	pxor	mm4, [edx+2*2048+edi*8])\
+		AS3(	pextrw	ecx, c, 2)\
+		AS2(	movzx	edi, cl)\
+		AS2(	pxor	mm3, [edx+2*2048+edi*8])\
+		AS2(	movzx	edi, ch)\
+		AS2(	pxor	mm4, [edx+1*2048+edi*8])\
+		AS3(	pextrw	ecx, c, 3)\
+		AS2(	movzx	edi, cl)\
+		AS2(	pxor	mm3, [edx+3*2048+edi*8])\
+		AS2(	psubq	a, mm3)\
+		AS2(	movzx	edi, ch)\
+		AS2(	pxor	mm4, [edx+0*2048+edi*8])\
+		AS2(	paddq	b, mm4)\
+		SSE2_mul_##mul(b)
+
+#define SSE2_mul_5(b)	\
+		AS2(	movq	mm3, b)\
+		AS2(	psllq	b, 2)\
+		AS2(	paddq	b, mm3)
+
+#define SSE2_mul_7(b)	\
+		AS2(	movq	mm3, b)\
+		AS2(	psllq	b, 3)\
+		AS2(	psubq	b, mm3)
+
+#define SSE2_mul_9(b)	\
+		AS2(	movq	mm3, b)\
+		AS2(	psllq	b, 3)\
+		AS2(	paddq	b, mm3)
+
+#define label2_5 1
+#define label2_7 2
+#define label2_9 3
+
+#define SSE2_pass(A,B,C,mul,X)	\
+		AS2(	xor		ebx, ebx)\
+		ASL(mul)\
+		SSE2_round(A,B,C,X+0*8+ebx,mul)\
+		SSE2_round(B,C,A,X+1*8+ebx,mul)\
+		AS2(	cmp		ebx, 6*8)\
+		ASJ(	je,		label2_##mul, f)\
+		SSE2_round(C,A,B,X+2*8+ebx,mul)\
+		AS2(	add		ebx, 3*8)\
+		ASJ(	jmp,	mul, b)\
+		ASL(label2_##mul)
+
+#define SSE2_key_schedule(Y,X) \
+		AS2(	movq	mm3, [X+7*8])\
+		AS2(	pxor	mm3, mm6)\
+		AS2(	movq	mm4, [X+0*8])\
+		AS2(	psubq	mm4, mm3)\
+		AS2(	movq	[Y+0*8], mm4)\
+		AS2(	pxor	mm4, [X+1*8])\
+		AS2(	movq	mm3, mm4)\
+		AS2(	movq	[Y+1*8], mm4)\
+		AS2(	paddq	mm4, [X+2*8])\
+		AS2(	pxor	mm3, mm7)\
+		AS2(	psllq	mm3, 19)\
+		AS2(	movq	[Y+2*8], mm4)\
+		AS2(	pxor	mm3, mm4)\
+		AS2(	movq	mm4, [X+3*8])\
+		AS2(	psubq	mm4, mm3)\
+		AS2(	movq	[Y+3*8], mm4)\
+		AS2(	pxor	mm4, [X+4*8])\
+		AS2(	movq	mm3, mm4)\
+		AS2(	movq	[Y+4*8], mm4)\
+		AS2(	paddq	mm4, [X+5*8])\
+		AS2(	pxor	mm3, mm7)\
+		AS2(	psrlq	mm3, 23)\
+		AS2(	movq	[Y+5*8], mm4)\
+		AS2(	pxor	mm3, mm4)\
+		AS2(	movq	mm4, [X+6*8])\
+		AS2(	psubq	mm4, mm3)\
+		AS2(	movq	[Y+6*8], mm4)\
+		AS2(	pxor	mm4, [X+7*8])\
+		AS2(	movq	mm3, mm4)\
+		AS2(	movq	[Y+7*8], mm4)\
+		AS2(	paddq	mm4, [Y+0*8])\
+		AS2(	pxor	mm3, mm7)\
+		AS2(	psllq	mm3, 19)\
+		AS2(	movq	[Y+0*8], mm4)\
+		AS2(	pxor	mm3, mm4)\
+		AS2(	movq	mm4, [Y+1*8])\
+		AS2(	psubq	mm4, mm3)\
+		AS2(	movq	[Y+1*8], mm4)\
+		AS2(	pxor	mm4, [Y+2*8])\
+		AS2(	movq	mm3, mm4)\
+		AS2(	movq	[Y+2*8], mm4)\
+		AS2(	paddq	mm4, [Y+3*8])\
+		AS2(	pxor	mm3, mm7)\
+		AS2(	psrlq	mm3, 23)\
+		AS2(	movq	[Y+3*8], mm4)\
+		AS2(	pxor	mm3, mm4)\
+		AS2(	movq	mm4, [Y+4*8])\
+		AS2(	psubq	mm4, mm3)\
+		AS2(	movq	[Y+4*8], mm4)\
+		AS2(	pxor	mm4, [Y+5*8])\
+		AS2(	movq	[Y+5*8], mm4)\
+		AS2(	paddq	mm4, [Y+6*8])\
+		AS2(	movq	[Y+6*8], mm4)\
+		AS2(	pxor	mm4, [edx+4*2048+2*8])\
+		AS2(	movq	mm3, [Y+7*8])\
+		AS2(	psubq	mm3, mm4)\
+		AS2(	movq	[Y+7*8], mm3)
+
+		SSE2_pass(mm0, mm1, mm2, 5, esi)
+		SSE2_key_schedule(esp+4, esi)
+		SSE2_pass(mm2, mm0, mm1, 7, esp+4)
+		SSE2_key_schedule(esp+4, esp+4)
+		SSE2_pass(mm1, mm2, mm0, 9, esp+4)
+
+		AS2(	pxor	mm0, [eax+0*8])
+		AS2(	movq	[eax+0*8], mm0)
+		AS2(	psubq	mm1, mm5)
+		AS2(	movq	[eax+1*8], mm1)
+		AS2(	paddq	mm2, [eax+2*8])
+		AS2(	movq	[eax+2*8], mm2)
+
+		AS_POP_IF86(sp)
+		AS1(	emms)
+
+#ifdef __GNUC__
+		AS_POP_IF86(bx)
+		ATT_PREFIX
+			:
+			: "a" (state), "S" (data), "d" (table)
+			: "%ecx", "%edi", "memory", "cc"
+		);
+#endif
+	}
+	else
+#endif
+	{
+		word64 a = state[0];
+		word64 b = state[1];
+		word64 c = state[2];
+		word64 Y[8];
+
+#define t1 (table)
+#define t2 (table+256)
+#define t3 (table+256*2)
+#define t4 (table+256*3)
+
+#define round(a,b,c,x,mul) \
+	c ^= x; \
+	a -= t1[GETBYTE(c,0)] ^ t2[GETBYTE(c,2)] ^ t3[GETBYTE(c,4)] ^ t4[GETBYTE(c,6)]; \
+	b += t4[GETBYTE(c,1)] ^ t3[GETBYTE(c,3)] ^ t2[GETBYTE(c,5)] ^ t1[GETBYTE(c,7)]; \
+	b *= mul
+
+#define pass(a,b,c,mul,X) {\
+	int i=0;\
+	while (true)\
+	{\
+		round(a,b,c,X[i+0],mul); \
+		round(b,c,a,X[i+1],mul); \
+		if (i==6)\
+			break;\
+		round(c,a,b,X[i+2],mul); \
+		i+=3;\
+	}}
+
+#define key_schedule(Y,X) \
+	Y[0] = X[0] - (X[7]^W64LIT(0xA5A5A5A5A5A5A5A5)); \
+	Y[1] = X[1] ^ Y[0]; \
+	Y[2] = X[2] + Y[1]; \
+	Y[3] = X[3] - (Y[2] ^ ((~Y[1])<<19)); \
+	Y[4] = X[4] ^ Y[3]; \
+	Y[5] = X[5] + Y[4]; \
+	Y[6] = X[6] - (Y[5] ^ ((~Y[4])>>23)); \
+	Y[7] = X[7] ^ Y[6]; \
+	Y[0] += Y[7]; \
+	Y[1] -= Y[0] ^ ((~Y[7])<<19); \
+	Y[2] ^= Y[1]; \
+	Y[3] += Y[2]; \
+	Y[4] -= Y[3] ^ ((~Y[2])>>23); \
+	Y[5] ^= Y[4]; \
+	Y[6] += Y[5]; \
+	Y[7] -= Y[6] ^ W64LIT(0x0123456789ABCDEF)
+
+		pass(a,b,c,5,data);
+		key_schedule(Y,data);
+		pass(c,a,b,7,Y);
+		key_schedule(Y,Y);
+		pass(b,c,a,9,Y);
+
+		state[0] = a ^ state[0];
+		state[1] = b - state[1];
+		state[2] = c + state[2];
+	}
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/tiger.h b/runtime/third_party/cryptopp/tiger.h
new file mode 100644
index 0000000..369f1cc
--- /dev/null
+++ b/runtime/third_party/cryptopp/tiger.h
@@ -0,0 +1,61 @@
+// tiger.h - originally written and placed in the public domain by Wei Dai
+
+/// \file tiger.h
+/// \brief Classes for the Tiger message digest
+/// \details Crypto++ provides the original Tiger hash that was
+///  submitted to the NESSIE project. The implementation is different
+///  from the revised Tiger2 hash.
+/// \sa <a href="https://www.cryptopp.com/wiki/Tiger">Tiger</a> and
+///  <a href="http://www.cs.technion.ac.il/~biham/Reports/Tiger/">Tiger:
+///  A Fast New Cryptographic Hash Function</a>
+/// \since Crypto++ 2.1
+
+#ifndef CRYPTOPP_TIGER_H
+#define CRYPTOPP_TIGER_H
+
+#include "config.h"
+#include "iterhash.h"
+
+// Clang 3.3 integrated assembler crash on Linux. Clang 3.4 due to compiler
+// error with .intel_syntax, http://llvm.org/bugs/show_bug.cgi?id=24232
+#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+# define CRYPTOPP_DISABLE_TIGER_ASM 1
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Tiger message digest
+/// \details Crypto++ provides the original Tiger hash that was
+///  submitted to the NESSIE project. The implementation is different
+///  from the revised Tiger2 hash.
+/// \sa <a href="https://www.cryptopp.com/wiki/Tiger">Tiger</a> and
+///  <a href="http://www.cs.technion.ac.il/~biham/Reports/Tiger/">Tiger:
+///  A Fast New Cryptographic Hash Function</a>
+/// \since Crypto++ 2.1
+class Tiger : public IteratedHashWithStaticTransform<word64, LittleEndian, 64, 24, Tiger>
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "Tiger";}
+	std::string AlgorithmProvider() const;
+
+	/// \brief Initialize state array
+	/// \param state the state of the hash
+	static void InitState(HashWordType *state);
+	/// \brief Operate the hash
+	/// \param digest the state of the hash
+	/// \param data the data to be digested
+	static void Transform(word64 *digest, const word64 *data);
+	/// \brief Computes the hash of the current message
+	/// \param digest a pointer to the buffer to receive the hash
+	/// \param digestSize the size of the truncated digest, in bytes
+	/// \details TruncatedFinal() calls Final() and then copies digestSize bytes to digest.
+	///   The hash is restarted the hash for the next message.
+	void TruncatedFinal(byte *digest, size_t digestSize);
+
+protected:
+	static const word64 table[4*256+3];
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/tigertab.cpp b/runtime/third_party/cryptopp/tigertab.cpp
new file mode 100644
index 0000000..85f3fdf
--- /dev/null
+++ b/runtime/third_party/cryptopp/tigertab.cpp
@@ -0,0 +1,525 @@
+#include "pch.h"
+#include "tiger.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const word64 Tiger::table[4*256+3] =
+{
+	W64LIT(0x02AAB17CF7E90C5E)   /*    0 */,    W64LIT(0xAC424B03E243A8EC)   /*    1 */,
+	W64LIT(0x72CD5BE30DD5FCD3)   /*    2 */,    W64LIT(0x6D019B93F6F97F3A)   /*    3 */,
+	W64LIT(0xCD9978FFD21F9193)   /*    4 */,    W64LIT(0x7573A1C9708029E2)   /*    5 */,
+	W64LIT(0xB164326B922A83C3)   /*    6 */,    W64LIT(0x46883EEE04915870)   /*    7 */,
+	W64LIT(0xEAACE3057103ECE6)   /*    8 */,    W64LIT(0xC54169B808A3535C)   /*    9 */,
+	W64LIT(0x4CE754918DDEC47C)   /*   10 */,    W64LIT(0x0AA2F4DFDC0DF40C)   /*   11 */,
+	W64LIT(0x10B76F18A74DBEFA)   /*   12 */,    W64LIT(0xC6CCB6235AD1AB6A)   /*   13 */,
+	W64LIT(0x13726121572FE2FF)   /*   14 */,    W64LIT(0x1A488C6F199D921E)   /*   15 */,
+	W64LIT(0x4BC9F9F4DA0007CA)   /*   16 */,    W64LIT(0x26F5E6F6E85241C7)   /*   17 */,
+	W64LIT(0x859079DBEA5947B6)   /*   18 */,    W64LIT(0x4F1885C5C99E8C92)   /*   19 */,
+	W64LIT(0xD78E761EA96F864B)   /*   20 */,    W64LIT(0x8E36428C52B5C17D)   /*   21 */,
+	W64LIT(0x69CF6827373063C1)   /*   22 */,    W64LIT(0xB607C93D9BB4C56E)   /*   23 */,
+	W64LIT(0x7D820E760E76B5EA)   /*   24 */,    W64LIT(0x645C9CC6F07FDC42)   /*   25 */,
+	W64LIT(0xBF38A078243342E0)   /*   26 */,    W64LIT(0x5F6B343C9D2E7D04)   /*   27 */,
+	W64LIT(0xF2C28AEB600B0EC6)   /*   28 */,    W64LIT(0x6C0ED85F7254BCAC)   /*   29 */,
+	W64LIT(0x71592281A4DB4FE5)   /*   30 */,    W64LIT(0x1967FA69CE0FED9F)   /*   31 */,
+	W64LIT(0xFD5293F8B96545DB)   /*   32 */,    W64LIT(0xC879E9D7F2A7600B)   /*   33 */,
+	W64LIT(0x860248920193194E)   /*   34 */,    W64LIT(0xA4F9533B2D9CC0B3)   /*   35 */,
+	W64LIT(0x9053836C15957613)   /*   36 */,    W64LIT(0xDB6DCF8AFC357BF1)   /*   37 */,
+	W64LIT(0x18BEEA7A7A370F57)   /*   38 */,    W64LIT(0x037117CA50B99066)   /*   39 */,
+	W64LIT(0x6AB30A9774424A35)   /*   40 */,    W64LIT(0xF4E92F02E325249B)   /*   41 */,
+	W64LIT(0x7739DB07061CCAE1)   /*   42 */,    W64LIT(0xD8F3B49CECA42A05)   /*   43 */,
+	W64LIT(0xBD56BE3F51382F73)   /*   44 */,    W64LIT(0x45FAED5843B0BB28)   /*   45 */,
+	W64LIT(0x1C813D5C11BF1F83)   /*   46 */,    W64LIT(0x8AF0E4B6D75FA169)   /*   47 */,
+	W64LIT(0x33EE18A487AD9999)   /*   48 */,    W64LIT(0x3C26E8EAB1C94410)   /*   49 */,
+	W64LIT(0xB510102BC0A822F9)   /*   50 */,    W64LIT(0x141EEF310CE6123B)   /*   51 */,
+	W64LIT(0xFC65B90059DDB154)   /*   52 */,    W64LIT(0xE0158640C5E0E607)   /*   53 */,
+	W64LIT(0x884E079826C3A3CF)   /*   54 */,    W64LIT(0x930D0D9523C535FD)   /*   55 */,
+	W64LIT(0x35638D754E9A2B00)   /*   56 */,    W64LIT(0x4085FCCF40469DD5)   /*   57 */,
+	W64LIT(0xC4B17AD28BE23A4C)   /*   58 */,    W64LIT(0xCAB2F0FC6A3E6A2E)   /*   59 */,
+	W64LIT(0x2860971A6B943FCD)   /*   60 */,    W64LIT(0x3DDE6EE212E30446)   /*   61 */,
+	W64LIT(0x6222F32AE01765AE)   /*   62 */,    W64LIT(0x5D550BB5478308FE)   /*   63 */,
+	W64LIT(0xA9EFA98DA0EDA22A)   /*   64 */,    W64LIT(0xC351A71686C40DA7)   /*   65 */,
+	W64LIT(0x1105586D9C867C84)   /*   66 */,    W64LIT(0xDCFFEE85FDA22853)   /*   67 */,
+	W64LIT(0xCCFBD0262C5EEF76)   /*   68 */,    W64LIT(0xBAF294CB8990D201)   /*   69 */,
+	W64LIT(0xE69464F52AFAD975)   /*   70 */,    W64LIT(0x94B013AFDF133E14)   /*   71 */,
+	W64LIT(0x06A7D1A32823C958)   /*   72 */,    W64LIT(0x6F95FE5130F61119)   /*   73 */,
+	W64LIT(0xD92AB34E462C06C0)   /*   74 */,    W64LIT(0xED7BDE33887C71D2)   /*   75 */,
+	W64LIT(0x79746D6E6518393E)   /*   76 */,    W64LIT(0x5BA419385D713329)   /*   77 */,
+	W64LIT(0x7C1BA6B948A97564)   /*   78 */,    W64LIT(0x31987C197BFDAC67)   /*   79 */,
+	W64LIT(0xDE6C23C44B053D02)   /*   80 */,    W64LIT(0x581C49FED002D64D)   /*   81 */,
+	W64LIT(0xDD474D6338261571)   /*   82 */,    W64LIT(0xAA4546C3E473D062)   /*   83 */,
+	W64LIT(0x928FCE349455F860)   /*   84 */,    W64LIT(0x48161BBACAAB94D9)   /*   85 */,
+	W64LIT(0x63912430770E6F68)   /*   86 */,    W64LIT(0x6EC8A5E602C6641C)   /*   87 */,
+	W64LIT(0x87282515337DDD2B)   /*   88 */,    W64LIT(0x2CDA6B42034B701B)   /*   89 */,
+	W64LIT(0xB03D37C181CB096D)   /*   90 */,    W64LIT(0xE108438266C71C6F)   /*   91 */,
+	W64LIT(0x2B3180C7EB51B255)   /*   92 */,    W64LIT(0xDF92B82F96C08BBC)   /*   93 */,
+	W64LIT(0x5C68C8C0A632F3BA)   /*   94 */,    W64LIT(0x5504CC861C3D0556)   /*   95 */,
+	W64LIT(0xABBFA4E55FB26B8F)   /*   96 */,    W64LIT(0x41848B0AB3BACEB4)   /*   97 */,
+	W64LIT(0xB334A273AA445D32)   /*   98 */,    W64LIT(0xBCA696F0A85AD881)   /*   99 */,
+	W64LIT(0x24F6EC65B528D56C)   /*  100 */,    W64LIT(0x0CE1512E90F4524A)   /*  101 */,
+	W64LIT(0x4E9DD79D5506D35A)   /*  102 */,    W64LIT(0x258905FAC6CE9779)   /*  103 */,
+	W64LIT(0x2019295B3E109B33)   /*  104 */,    W64LIT(0xF8A9478B73A054CC)   /*  105 */,
+	W64LIT(0x2924F2F934417EB0)   /*  106 */,    W64LIT(0x3993357D536D1BC4)   /*  107 */,
+	W64LIT(0x38A81AC21DB6FF8B)   /*  108 */,    W64LIT(0x47C4FBF17D6016BF)   /*  109 */,
+	W64LIT(0x1E0FAADD7667E3F5)   /*  110 */,    W64LIT(0x7ABCFF62938BEB96)   /*  111 */,
+	W64LIT(0xA78DAD948FC179C9)   /*  112 */,    W64LIT(0x8F1F98B72911E50D)   /*  113 */,
+	W64LIT(0x61E48EAE27121A91)   /*  114 */,    W64LIT(0x4D62F7AD31859808)   /*  115 */,
+	W64LIT(0xECEBA345EF5CEAEB)   /*  116 */,    W64LIT(0xF5CEB25EBC9684CE)   /*  117 */,
+	W64LIT(0xF633E20CB7F76221)   /*  118 */,    W64LIT(0xA32CDF06AB8293E4)   /*  119 */,
+	W64LIT(0x985A202CA5EE2CA4)   /*  120 */,    W64LIT(0xCF0B8447CC8A8FB1)   /*  121 */,
+	W64LIT(0x9F765244979859A3)   /*  122 */,    W64LIT(0xA8D516B1A1240017)   /*  123 */,
+	W64LIT(0x0BD7BA3EBB5DC726)   /*  124 */,    W64LIT(0xE54BCA55B86ADB39)   /*  125 */,
+	W64LIT(0x1D7A3AFD6C478063)   /*  126 */,    W64LIT(0x519EC608E7669EDD)   /*  127 */,
+	W64LIT(0x0E5715A2D149AA23)   /*  128 */,    W64LIT(0x177D4571848FF194)   /*  129 */,
+	W64LIT(0xEEB55F3241014C22)   /*  130 */,    W64LIT(0x0F5E5CA13A6E2EC2)   /*  131 */,
+	W64LIT(0x8029927B75F5C361)   /*  132 */,    W64LIT(0xAD139FABC3D6E436)   /*  133 */,
+	W64LIT(0x0D5DF1A94CCF402F)   /*  134 */,    W64LIT(0x3E8BD948BEA5DFC8)   /*  135 */,
+	W64LIT(0xA5A0D357BD3FF77E)   /*  136 */,    W64LIT(0xA2D12E251F74F645)   /*  137 */,
+	W64LIT(0x66FD9E525E81A082)   /*  138 */,    W64LIT(0x2E0C90CE7F687A49)   /*  139 */,
+	W64LIT(0xC2E8BCBEBA973BC5)   /*  140 */,    W64LIT(0x000001BCE509745F)   /*  141 */,
+	W64LIT(0x423777BBE6DAB3D6)   /*  142 */,    W64LIT(0xD1661C7EAEF06EB5)   /*  143 */,
+	W64LIT(0xA1781F354DAACFD8)   /*  144 */,    W64LIT(0x2D11284A2B16AFFC)   /*  145 */,
+	W64LIT(0xF1FC4F67FA891D1F)   /*  146 */,    W64LIT(0x73ECC25DCB920ADA)   /*  147 */,
+	W64LIT(0xAE610C22C2A12651)   /*  148 */,    W64LIT(0x96E0A810D356B78A)   /*  149 */,
+	W64LIT(0x5A9A381F2FE7870F)   /*  150 */,    W64LIT(0xD5AD62EDE94E5530)   /*  151 */,
+	W64LIT(0xD225E5E8368D1427)   /*  152 */,    W64LIT(0x65977B70C7AF4631)   /*  153 */,
+	W64LIT(0x99F889B2DE39D74F)   /*  154 */,    W64LIT(0x233F30BF54E1D143)   /*  155 */,
+	W64LIT(0x9A9675D3D9A63C97)   /*  156 */,    W64LIT(0x5470554FF334F9A8)   /*  157 */,
+	W64LIT(0x166ACB744A4F5688)   /*  158 */,    W64LIT(0x70C74CAAB2E4AEAD)   /*  159 */,
+	W64LIT(0xF0D091646F294D12)   /*  160 */,    W64LIT(0x57B82A89684031D1)   /*  161 */,
+	W64LIT(0xEFD95A5A61BE0B6B)   /*  162 */,    W64LIT(0x2FBD12E969F2F29A)   /*  163 */,
+	W64LIT(0x9BD37013FEFF9FE8)   /*  164 */,    W64LIT(0x3F9B0404D6085A06)   /*  165 */,
+	W64LIT(0x4940C1F3166CFE15)   /*  166 */,    W64LIT(0x09542C4DCDF3DEFB)   /*  167 */,
+	W64LIT(0xB4C5218385CD5CE3)   /*  168 */,    W64LIT(0xC935B7DC4462A641)   /*  169 */,
+	W64LIT(0x3417F8A68ED3B63F)   /*  170 */,    W64LIT(0xB80959295B215B40)   /*  171 */,
+	W64LIT(0xF99CDAEF3B8C8572)   /*  172 */,    W64LIT(0x018C0614F8FCB95D)   /*  173 */,
+	W64LIT(0x1B14ACCD1A3ACDF3)   /*  174 */,    W64LIT(0x84D471F200BB732D)   /*  175 */,
+	W64LIT(0xC1A3110E95E8DA16)   /*  176 */,    W64LIT(0x430A7220BF1A82B8)   /*  177 */,
+	W64LIT(0xB77E090D39DF210E)   /*  178 */,    W64LIT(0x5EF4BD9F3CD05E9D)   /*  179 */,
+	W64LIT(0x9D4FF6DA7E57A444)   /*  180 */,    W64LIT(0xDA1D60E183D4A5F8)   /*  181 */,
+	W64LIT(0xB287C38417998E47)   /*  182 */,    W64LIT(0xFE3EDC121BB31886)   /*  183 */,
+	W64LIT(0xC7FE3CCC980CCBEF)   /*  184 */,    W64LIT(0xE46FB590189BFD03)   /*  185 */,
+	W64LIT(0x3732FD469A4C57DC)   /*  186 */,    W64LIT(0x7EF700A07CF1AD65)   /*  187 */,
+	W64LIT(0x59C64468A31D8859)   /*  188 */,    W64LIT(0x762FB0B4D45B61F6)   /*  189 */,
+	W64LIT(0x155BAED099047718)   /*  190 */,    W64LIT(0x68755E4C3D50BAA6)   /*  191 */,
+	W64LIT(0xE9214E7F22D8B4DF)   /*  192 */,    W64LIT(0x2ADDBF532EAC95F4)   /*  193 */,
+	W64LIT(0x32AE3909B4BD0109)   /*  194 */,    W64LIT(0x834DF537B08E3450)   /*  195 */,
+	W64LIT(0xFA209DA84220728D)   /*  196 */,    W64LIT(0x9E691D9B9EFE23F7)   /*  197 */,
+	W64LIT(0x0446D288C4AE8D7F)   /*  198 */,    W64LIT(0x7B4CC524E169785B)   /*  199 */,
+	W64LIT(0x21D87F0135CA1385)   /*  200 */,    W64LIT(0xCEBB400F137B8AA5)   /*  201 */,
+	W64LIT(0x272E2B66580796BE)   /*  202 */,    W64LIT(0x3612264125C2B0DE)   /*  203 */,
+	W64LIT(0x057702BDAD1EFBB2)   /*  204 */,    W64LIT(0xD4BABB8EACF84BE9)   /*  205 */,
+	W64LIT(0x91583139641BC67B)   /*  206 */,    W64LIT(0x8BDC2DE08036E024)   /*  207 */,
+	W64LIT(0x603C8156F49F68ED)   /*  208 */,    W64LIT(0xF7D236F7DBEF5111)   /*  209 */,
+	W64LIT(0x9727C4598AD21E80)   /*  210 */,    W64LIT(0xA08A0896670A5FD7)   /*  211 */,
+	W64LIT(0xCB4A8F4309EBA9CB)   /*  212 */,    W64LIT(0x81AF564B0F7036A1)   /*  213 */,
+	W64LIT(0xC0B99AA778199ABD)   /*  214 */,    W64LIT(0x959F1EC83FC8E952)   /*  215 */,
+	W64LIT(0x8C505077794A81B9)   /*  216 */,    W64LIT(0x3ACAAF8F056338F0)   /*  217 */,
+	W64LIT(0x07B43F50627A6778)   /*  218 */,    W64LIT(0x4A44AB49F5ECCC77)   /*  219 */,
+	W64LIT(0x3BC3D6E4B679EE98)   /*  220 */,    W64LIT(0x9CC0D4D1CF14108C)   /*  221 */,
+	W64LIT(0x4406C00B206BC8A0)   /*  222 */,    W64LIT(0x82A18854C8D72D89)   /*  223 */,
+	W64LIT(0x67E366B35C3C432C)   /*  224 */,    W64LIT(0xB923DD61102B37F2)   /*  225 */,
+	W64LIT(0x56AB2779D884271D)   /*  226 */,    W64LIT(0xBE83E1B0FF1525AF)   /*  227 */,
+	W64LIT(0xFB7C65D4217E49A9)   /*  228 */,    W64LIT(0x6BDBE0E76D48E7D4)   /*  229 */,
+	W64LIT(0x08DF828745D9179E)   /*  230 */,    W64LIT(0x22EA6A9ADD53BD34)   /*  231 */,
+	W64LIT(0xE36E141C5622200A)   /*  232 */,    W64LIT(0x7F805D1B8CB750EE)   /*  233 */,
+	W64LIT(0xAFE5C7A59F58E837)   /*  234 */,    W64LIT(0xE27F996A4FB1C23C)   /*  235 */,
+	W64LIT(0xD3867DFB0775F0D0)   /*  236 */,    W64LIT(0xD0E673DE6E88891A)   /*  237 */,
+	W64LIT(0x123AEB9EAFB86C25)   /*  238 */,    W64LIT(0x30F1D5D5C145B895)   /*  239 */,
+	W64LIT(0xBB434A2DEE7269E7)   /*  240 */,    W64LIT(0x78CB67ECF931FA38)   /*  241 */,
+	W64LIT(0xF33B0372323BBF9C)   /*  242 */,    W64LIT(0x52D66336FB279C74)   /*  243 */,
+	W64LIT(0x505F33AC0AFB4EAA)   /*  244 */,    W64LIT(0xE8A5CD99A2CCE187)   /*  245 */,
+	W64LIT(0x534974801E2D30BB)   /*  246 */,    W64LIT(0x8D2D5711D5876D90)   /*  247 */,
+	W64LIT(0x1F1A412891BC038E)   /*  248 */,    W64LIT(0xD6E2E71D82E56648)   /*  249 */,
+	W64LIT(0x74036C3A497732B7)   /*  250 */,    W64LIT(0x89B67ED96361F5AB)   /*  251 */,
+	W64LIT(0xFFED95D8F1EA02A2)   /*  252 */,    W64LIT(0xE72B3BD61464D43D)   /*  253 */,
+	W64LIT(0xA6300F170BDC4820)   /*  254 */,    W64LIT(0xEBC18760ED78A77A)   /*  255 */,
+	W64LIT(0xE6A6BE5A05A12138)   /*  256 */,    W64LIT(0xB5A122A5B4F87C98)   /*  257 */,
+	W64LIT(0x563C6089140B6990)   /*  258 */,    W64LIT(0x4C46CB2E391F5DD5)   /*  259 */,
+	W64LIT(0xD932ADDBC9B79434)   /*  260 */,    W64LIT(0x08EA70E42015AFF5)   /*  261 */,
+	W64LIT(0xD765A6673E478CF1)   /*  262 */,    W64LIT(0xC4FB757EAB278D99)   /*  263 */,
+	W64LIT(0xDF11C6862D6E0692)   /*  264 */,    W64LIT(0xDDEB84F10D7F3B16)   /*  265 */,
+	W64LIT(0x6F2EF604A665EA04)   /*  266 */,    W64LIT(0x4A8E0F0FF0E0DFB3)   /*  267 */,
+	W64LIT(0xA5EDEEF83DBCBA51)   /*  268 */,    W64LIT(0xFC4F0A2A0EA4371E)   /*  269 */,
+	W64LIT(0xE83E1DA85CB38429)   /*  270 */,    W64LIT(0xDC8FF882BA1B1CE2)   /*  271 */,
+	W64LIT(0xCD45505E8353E80D)   /*  272 */,    W64LIT(0x18D19A00D4DB0717)   /*  273 */,
+	W64LIT(0x34A0CFEDA5F38101)   /*  274 */,    W64LIT(0x0BE77E518887CAF2)   /*  275 */,
+	W64LIT(0x1E341438B3C45136)   /*  276 */,    W64LIT(0xE05797F49089CCF9)   /*  277 */,
+	W64LIT(0xFFD23F9DF2591D14)   /*  278 */,    W64LIT(0x543DDA228595C5CD)   /*  279 */,
+	W64LIT(0x661F81FD99052A33)   /*  280 */,    W64LIT(0x8736E641DB0F7B76)   /*  281 */,
+	W64LIT(0x15227725418E5307)   /*  282 */,    W64LIT(0xE25F7F46162EB2FA)   /*  283 */,
+	W64LIT(0x48A8B2126C13D9FE)   /*  284 */,    W64LIT(0xAFDC541792E76EEA)   /*  285 */,
+	W64LIT(0x03D912BFC6D1898F)   /*  286 */,    W64LIT(0x31B1AAFA1B83F51B)   /*  287 */,
+	W64LIT(0xF1AC2796E42AB7D9)   /*  288 */,    W64LIT(0x40A3A7D7FCD2EBAC)   /*  289 */,
+	W64LIT(0x1056136D0AFBBCC5)   /*  290 */,    W64LIT(0x7889E1DD9A6D0C85)   /*  291 */,
+	W64LIT(0xD33525782A7974AA)   /*  292 */,    W64LIT(0xA7E25D09078AC09B)   /*  293 */,
+	W64LIT(0xBD4138B3EAC6EDD0)   /*  294 */,    W64LIT(0x920ABFBE71EB9E70)   /*  295 */,
+	W64LIT(0xA2A5D0F54FC2625C)   /*  296 */,    W64LIT(0xC054E36B0B1290A3)   /*  297 */,
+	W64LIT(0xF6DD59FF62FE932B)   /*  298 */,    W64LIT(0x3537354511A8AC7D)   /*  299 */,
+	W64LIT(0xCA845E9172FADCD4)   /*  300 */,    W64LIT(0x84F82B60329D20DC)   /*  301 */,
+	W64LIT(0x79C62CE1CD672F18)   /*  302 */,    W64LIT(0x8B09A2ADD124642C)   /*  303 */,
+	W64LIT(0xD0C1E96A19D9E726)   /*  304 */,    W64LIT(0x5A786A9B4BA9500C)   /*  305 */,
+	W64LIT(0x0E020336634C43F3)   /*  306 */,    W64LIT(0xC17B474AEB66D822)   /*  307 */,
+	W64LIT(0x6A731AE3EC9BAAC2)   /*  308 */,    W64LIT(0x8226667AE0840258)   /*  309 */,
+	W64LIT(0x67D4567691CAECA5)   /*  310 */,    W64LIT(0x1D94155C4875ADB5)   /*  311 */,
+	W64LIT(0x6D00FD985B813FDF)   /*  312 */,    W64LIT(0x51286EFCB774CD06)   /*  313 */,
+	W64LIT(0x5E8834471FA744AF)   /*  314 */,    W64LIT(0xF72CA0AEE761AE2E)   /*  315 */,
+	W64LIT(0xBE40E4CDAEE8E09A)   /*  316 */,    W64LIT(0xE9970BBB5118F665)   /*  317 */,
+	W64LIT(0x726E4BEB33DF1964)   /*  318 */,    W64LIT(0x703B000729199762)   /*  319 */,
+	W64LIT(0x4631D816F5EF30A7)   /*  320 */,    W64LIT(0xB880B5B51504A6BE)   /*  321 */,
+	W64LIT(0x641793C37ED84B6C)   /*  322 */,    W64LIT(0x7B21ED77F6E97D96)   /*  323 */,
+	W64LIT(0x776306312EF96B73)   /*  324 */,    W64LIT(0xAE528948E86FF3F4)   /*  325 */,
+	W64LIT(0x53DBD7F286A3F8F8)   /*  326 */,    W64LIT(0x16CADCE74CFC1063)   /*  327 */,
+	W64LIT(0x005C19BDFA52C6DD)   /*  328 */,    W64LIT(0x68868F5D64D46AD3)   /*  329 */,
+	W64LIT(0x3A9D512CCF1E186A)   /*  330 */,    W64LIT(0x367E62C2385660AE)   /*  331 */,
+	W64LIT(0xE359E7EA77DCB1D7)   /*  332 */,    W64LIT(0x526C0773749ABE6E)   /*  333 */,
+	W64LIT(0x735AE5F9D09F734B)   /*  334 */,    W64LIT(0x493FC7CC8A558BA8)   /*  335 */,
+	W64LIT(0xB0B9C1533041AB45)   /*  336 */,    W64LIT(0x321958BA470A59BD)   /*  337 */,
+	W64LIT(0x852DB00B5F46C393)   /*  338 */,    W64LIT(0x91209B2BD336B0E5)   /*  339 */,
+	W64LIT(0x6E604F7D659EF19F)   /*  340 */,    W64LIT(0xB99A8AE2782CCB24)   /*  341 */,
+	W64LIT(0xCCF52AB6C814C4C7)   /*  342 */,    W64LIT(0x4727D9AFBE11727B)   /*  343 */,
+	W64LIT(0x7E950D0C0121B34D)   /*  344 */,    W64LIT(0x756F435670AD471F)   /*  345 */,
+	W64LIT(0xF5ADD442615A6849)   /*  346 */,    W64LIT(0x4E87E09980B9957A)   /*  347 */,
+	W64LIT(0x2ACFA1DF50AEE355)   /*  348 */,    W64LIT(0xD898263AFD2FD556)   /*  349 */,
+	W64LIT(0xC8F4924DD80C8FD6)   /*  350 */,    W64LIT(0xCF99CA3D754A173A)   /*  351 */,
+	W64LIT(0xFE477BACAF91BF3C)   /*  352 */,    W64LIT(0xED5371F6D690C12D)   /*  353 */,
+	W64LIT(0x831A5C285E687094)   /*  354 */,    W64LIT(0xC5D3C90A3708A0A4)   /*  355 */,
+	W64LIT(0x0F7F903717D06580)   /*  356 */,    W64LIT(0x19F9BB13B8FDF27F)   /*  357 */,
+	W64LIT(0xB1BD6F1B4D502843)   /*  358 */,    W64LIT(0x1C761BA38FFF4012)   /*  359 */,
+	W64LIT(0x0D1530C4E2E21F3B)   /*  360 */,    W64LIT(0x8943CE69A7372C8A)   /*  361 */,
+	W64LIT(0xE5184E11FEB5CE66)   /*  362 */,    W64LIT(0x618BDB80BD736621)   /*  363 */,
+	W64LIT(0x7D29BAD68B574D0B)   /*  364 */,    W64LIT(0x81BB613E25E6FE5B)   /*  365 */,
+	W64LIT(0x071C9C10BC07913F)   /*  366 */,    W64LIT(0xC7BEEB7909AC2D97)   /*  367 */,
+	W64LIT(0xC3E58D353BC5D757)   /*  368 */,    W64LIT(0xEB017892F38F61E8)   /*  369 */,
+	W64LIT(0xD4EFFB9C9B1CC21A)   /*  370 */,    W64LIT(0x99727D26F494F7AB)   /*  371 */,
+	W64LIT(0xA3E063A2956B3E03)   /*  372 */,    W64LIT(0x9D4A8B9A4AA09C30)   /*  373 */,
+	W64LIT(0x3F6AB7D500090FB4)   /*  374 */,    W64LIT(0x9CC0F2A057268AC0)   /*  375 */,
+	W64LIT(0x3DEE9D2DEDBF42D1)   /*  376 */,    W64LIT(0x330F49C87960A972)   /*  377 */,
+	W64LIT(0xC6B2720287421B41)   /*  378 */,    W64LIT(0x0AC59EC07C00369C)   /*  379 */,
+	W64LIT(0xEF4EAC49CB353425)   /*  380 */,    W64LIT(0xF450244EEF0129D8)   /*  381 */,
+	W64LIT(0x8ACC46E5CAF4DEB6)   /*  382 */,    W64LIT(0x2FFEAB63989263F7)   /*  383 */,
+	W64LIT(0x8F7CB9FE5D7A4578)   /*  384 */,    W64LIT(0x5BD8F7644E634635)   /*  385 */,
+	W64LIT(0x427A7315BF2DC900)   /*  386 */,    W64LIT(0x17D0C4AA2125261C)   /*  387 */,
+	W64LIT(0x3992486C93518E50)   /*  388 */,    W64LIT(0xB4CBFEE0A2D7D4C3)   /*  389 */,
+	W64LIT(0x7C75D6202C5DDD8D)   /*  390 */,    W64LIT(0xDBC295D8E35B6C61)   /*  391 */,
+	W64LIT(0x60B369D302032B19)   /*  392 */,    W64LIT(0xCE42685FDCE44132)   /*  393 */,
+	W64LIT(0x06F3DDB9DDF65610)   /*  394 */,    W64LIT(0x8EA4D21DB5E148F0)   /*  395 */,
+	W64LIT(0x20B0FCE62FCD496F)   /*  396 */,    W64LIT(0x2C1B912358B0EE31)   /*  397 */,
+	W64LIT(0xB28317B818F5A308)   /*  398 */,    W64LIT(0xA89C1E189CA6D2CF)   /*  399 */,
+	W64LIT(0x0C6B18576AAADBC8)   /*  400 */,    W64LIT(0xB65DEAA91299FAE3)   /*  401 */,
+	W64LIT(0xFB2B794B7F1027E7)   /*  402 */,    W64LIT(0x04E4317F443B5BEB)   /*  403 */,
+	W64LIT(0x4B852D325939D0A6)   /*  404 */,    W64LIT(0xD5AE6BEEFB207FFC)   /*  405 */,
+	W64LIT(0x309682B281C7D374)   /*  406 */,    W64LIT(0xBAE309A194C3B475)   /*  407 */,
+	W64LIT(0x8CC3F97B13B49F05)   /*  408 */,    W64LIT(0x98A9422FF8293967)   /*  409 */,
+	W64LIT(0x244B16B01076FF7C)   /*  410 */,    W64LIT(0xF8BF571C663D67EE)   /*  411 */,
+	W64LIT(0x1F0D6758EEE30DA1)   /*  412 */,    W64LIT(0xC9B611D97ADEB9B7)   /*  413 */,
+	W64LIT(0xB7AFD5887B6C57A2)   /*  414 */,    W64LIT(0x6290AE846B984FE1)   /*  415 */,
+	W64LIT(0x94DF4CDEACC1A5FD)   /*  416 */,    W64LIT(0x058A5BD1C5483AFF)   /*  417 */,
+	W64LIT(0x63166CC142BA3C37)   /*  418 */,    W64LIT(0x8DB8526EB2F76F40)   /*  419 */,
+	W64LIT(0xE10880036F0D6D4E)   /*  420 */,    W64LIT(0x9E0523C9971D311D)   /*  421 */,
+	W64LIT(0x45EC2824CC7CD691)   /*  422 */,    W64LIT(0x575B8359E62382C9)   /*  423 */,
+	W64LIT(0xFA9E400DC4889995)   /*  424 */,    W64LIT(0xD1823ECB45721568)   /*  425 */,
+	W64LIT(0xDAFD983B8206082F)   /*  426 */,    W64LIT(0xAA7D29082386A8CB)   /*  427 */,
+	W64LIT(0x269FCD4403B87588)   /*  428 */,    W64LIT(0x1B91F5F728BDD1E0)   /*  429 */,
+	W64LIT(0xE4669F39040201F6)   /*  430 */,    W64LIT(0x7A1D7C218CF04ADE)   /*  431 */,
+	W64LIT(0x65623C29D79CE5CE)   /*  432 */,    W64LIT(0x2368449096C00BB1)   /*  433 */,
+	W64LIT(0xAB9BF1879DA503BA)   /*  434 */,    W64LIT(0xBC23ECB1A458058E)   /*  435 */,
+	W64LIT(0x9A58DF01BB401ECC)   /*  436 */,    W64LIT(0xA070E868A85F143D)   /*  437 */,
+	W64LIT(0x4FF188307DF2239E)   /*  438 */,    W64LIT(0x14D565B41A641183)   /*  439 */,
+	W64LIT(0xEE13337452701602)   /*  440 */,    W64LIT(0x950E3DCF3F285E09)   /*  441 */,
+	W64LIT(0x59930254B9C80953)   /*  442 */,    W64LIT(0x3BF299408930DA6D)   /*  443 */,
+	W64LIT(0xA955943F53691387)   /*  444 */,    W64LIT(0xA15EDECAA9CB8784)   /*  445 */,
+	W64LIT(0x29142127352BE9A0)   /*  446 */,    W64LIT(0x76F0371FFF4E7AFB)   /*  447 */,
+	W64LIT(0x0239F450274F2228)   /*  448 */,    W64LIT(0xBB073AF01D5E868B)   /*  449 */,
+	W64LIT(0xBFC80571C10E96C1)   /*  450 */,    W64LIT(0xD267088568222E23)   /*  451 */,
+	W64LIT(0x9671A3D48E80B5B0)   /*  452 */,    W64LIT(0x55B5D38AE193BB81)   /*  453 */,
+	W64LIT(0x693AE2D0A18B04B8)   /*  454 */,    W64LIT(0x5C48B4ECADD5335F)   /*  455 */,
+	W64LIT(0xFD743B194916A1CA)   /*  456 */,    W64LIT(0x2577018134BE98C4)   /*  457 */,
+	W64LIT(0xE77987E83C54A4AD)   /*  458 */,    W64LIT(0x28E11014DA33E1B9)   /*  459 */,
+	W64LIT(0x270CC59E226AA213)   /*  460 */,    W64LIT(0x71495F756D1A5F60)   /*  461 */,
+	W64LIT(0x9BE853FB60AFEF77)   /*  462 */,    W64LIT(0xADC786A7F7443DBF)   /*  463 */,
+	W64LIT(0x0904456173B29A82)   /*  464 */,    W64LIT(0x58BC7A66C232BD5E)   /*  465 */,
+	W64LIT(0xF306558C673AC8B2)   /*  466 */,    W64LIT(0x41F639C6B6C9772A)   /*  467 */,
+	W64LIT(0x216DEFE99FDA35DA)   /*  468 */,    W64LIT(0x11640CC71C7BE615)   /*  469 */,
+	W64LIT(0x93C43694565C5527)   /*  470 */,    W64LIT(0xEA038E6246777839)   /*  471 */,
+	W64LIT(0xF9ABF3CE5A3E2469)   /*  472 */,    W64LIT(0x741E768D0FD312D2)   /*  473 */,
+	W64LIT(0x0144B883CED652C6)   /*  474 */,    W64LIT(0xC20B5A5BA33F8552)   /*  475 */,
+	W64LIT(0x1AE69633C3435A9D)   /*  476 */,    W64LIT(0x97A28CA4088CFDEC)   /*  477 */,
+	W64LIT(0x8824A43C1E96F420)   /*  478 */,    W64LIT(0x37612FA66EEEA746)   /*  479 */,
+	W64LIT(0x6B4CB165F9CF0E5A)   /*  480 */,    W64LIT(0x43AA1C06A0ABFB4A)   /*  481 */,
+	W64LIT(0x7F4DC26FF162796B)   /*  482 */,    W64LIT(0x6CBACC8E54ED9B0F)   /*  483 */,
+	W64LIT(0xA6B7FFEFD2BB253E)   /*  484 */,    W64LIT(0x2E25BC95B0A29D4F)   /*  485 */,
+	W64LIT(0x86D6A58BDEF1388C)   /*  486 */,    W64LIT(0xDED74AC576B6F054)   /*  487 */,
+	W64LIT(0x8030BDBC2B45805D)   /*  488 */,    W64LIT(0x3C81AF70E94D9289)   /*  489 */,
+	W64LIT(0x3EFF6DDA9E3100DB)   /*  490 */,    W64LIT(0xB38DC39FDFCC8847)   /*  491 */,
+	W64LIT(0x123885528D17B87E)   /*  492 */,    W64LIT(0xF2DA0ED240B1B642)   /*  493 */,
+	W64LIT(0x44CEFADCD54BF9A9)   /*  494 */,    W64LIT(0x1312200E433C7EE6)   /*  495 */,
+	W64LIT(0x9FFCC84F3A78C748)   /*  496 */,    W64LIT(0xF0CD1F72248576BB)   /*  497 */,
+	W64LIT(0xEC6974053638CFE4)   /*  498 */,    W64LIT(0x2BA7B67C0CEC4E4C)   /*  499 */,
+	W64LIT(0xAC2F4DF3E5CE32ED)   /*  500 */,    W64LIT(0xCB33D14326EA4C11)   /*  501 */,
+	W64LIT(0xA4E9044CC77E58BC)   /*  502 */,    W64LIT(0x5F513293D934FCEF)   /*  503 */,
+	W64LIT(0x5DC9645506E55444)   /*  504 */,    W64LIT(0x50DE418F317DE40A)   /*  505 */,
+	W64LIT(0x388CB31A69DDE259)   /*  506 */,    W64LIT(0x2DB4A83455820A86)   /*  507 */,
+	W64LIT(0x9010A91E84711AE9)   /*  508 */,    W64LIT(0x4DF7F0B7B1498371)   /*  509 */,
+	W64LIT(0xD62A2EABC0977179)   /*  510 */,    W64LIT(0x22FAC097AA8D5C0E)   /*  511 */,
+	W64LIT(0xF49FCC2FF1DAF39B)   /*  512 */,    W64LIT(0x487FD5C66FF29281)   /*  513 */,
+	W64LIT(0xE8A30667FCDCA83F)   /*  514 */,    W64LIT(0x2C9B4BE3D2FCCE63)   /*  515 */,
+	W64LIT(0xDA3FF74B93FBBBC2)   /*  516 */,    W64LIT(0x2FA165D2FE70BA66)   /*  517 */,
+	W64LIT(0xA103E279970E93D4)   /*  518 */,    W64LIT(0xBECDEC77B0E45E71)   /*  519 */,
+	W64LIT(0xCFB41E723985E497)   /*  520 */,    W64LIT(0xB70AAA025EF75017)   /*  521 */,
+	W64LIT(0xD42309F03840B8E0)   /*  522 */,    W64LIT(0x8EFC1AD035898579)   /*  523 */,
+	W64LIT(0x96C6920BE2B2ABC5)   /*  524 */,    W64LIT(0x66AF4163375A9172)   /*  525 */,
+	W64LIT(0x2174ABDCCA7127FB)   /*  526 */,    W64LIT(0xB33CCEA64A72FF41)   /*  527 */,
+	W64LIT(0xF04A4933083066A5)   /*  528 */,    W64LIT(0x8D970ACDD7289AF5)   /*  529 */,
+	W64LIT(0x8F96E8E031C8C25E)   /*  530 */,    W64LIT(0xF3FEC02276875D47)   /*  531 */,
+	W64LIT(0xEC7BF310056190DD)   /*  532 */,    W64LIT(0xF5ADB0AEBB0F1491)   /*  533 */,
+	W64LIT(0x9B50F8850FD58892)   /*  534 */,    W64LIT(0x4975488358B74DE8)   /*  535 */,
+	W64LIT(0xA3354FF691531C61)   /*  536 */,    W64LIT(0x0702BBE481D2C6EE)   /*  537 */,
+	W64LIT(0x89FB24057DEDED98)   /*  538 */,    W64LIT(0xAC3075138596E902)   /*  539 */,
+	W64LIT(0x1D2D3580172772ED)   /*  540 */,    W64LIT(0xEB738FC28E6BC30D)   /*  541 */,
+	W64LIT(0x5854EF8F63044326)   /*  542 */,    W64LIT(0x9E5C52325ADD3BBE)   /*  543 */,
+	W64LIT(0x90AA53CF325C4623)   /*  544 */,    W64LIT(0xC1D24D51349DD067)   /*  545 */,
+	W64LIT(0x2051CFEEA69EA624)   /*  546 */,    W64LIT(0x13220F0A862E7E4F)   /*  547 */,
+	W64LIT(0xCE39399404E04864)   /*  548 */,    W64LIT(0xD9C42CA47086FCB7)   /*  549 */,
+	W64LIT(0x685AD2238A03E7CC)   /*  550 */,    W64LIT(0x066484B2AB2FF1DB)   /*  551 */,
+	W64LIT(0xFE9D5D70EFBF79EC)   /*  552 */,    W64LIT(0x5B13B9DD9C481854)   /*  553 */,
+	W64LIT(0x15F0D475ED1509AD)   /*  554 */,    W64LIT(0x0BEBCD060EC79851)   /*  555 */,
+	W64LIT(0xD58C6791183AB7F8)   /*  556 */,    W64LIT(0xD1187C5052F3EEE4)   /*  557 */,
+	W64LIT(0xC95D1192E54E82FF)   /*  558 */,    W64LIT(0x86EEA14CB9AC6CA2)   /*  559 */,
+	W64LIT(0x3485BEB153677D5D)   /*  560 */,    W64LIT(0xDD191D781F8C492A)   /*  561 */,
+	W64LIT(0xF60866BAA784EBF9)   /*  562 */,    W64LIT(0x518F643BA2D08C74)   /*  563 */,
+	W64LIT(0x8852E956E1087C22)   /*  564 */,    W64LIT(0xA768CB8DC410AE8D)   /*  565 */,
+	W64LIT(0x38047726BFEC8E1A)   /*  566 */,    W64LIT(0xA67738B4CD3B45AA)   /*  567 */,
+	W64LIT(0xAD16691CEC0DDE19)   /*  568 */,    W64LIT(0xC6D4319380462E07)   /*  569 */,
+	W64LIT(0xC5A5876D0BA61938)   /*  570 */,    W64LIT(0x16B9FA1FA58FD840)   /*  571 */,
+	W64LIT(0x188AB1173CA74F18)   /*  572 */,    W64LIT(0xABDA2F98C99C021F)   /*  573 */,
+	W64LIT(0x3E0580AB134AE816)   /*  574 */,    W64LIT(0x5F3B05B773645ABB)   /*  575 */,
+	W64LIT(0x2501A2BE5575F2F6)   /*  576 */,    W64LIT(0x1B2F74004E7E8BA9)   /*  577 */,
+	W64LIT(0x1CD7580371E8D953)   /*  578 */,    W64LIT(0x7F6ED89562764E30)   /*  579 */,
+	W64LIT(0xB15926FF596F003D)   /*  580 */,    W64LIT(0x9F65293DA8C5D6B9)   /*  581 */,
+	W64LIT(0x6ECEF04DD690F84C)   /*  582 */,    W64LIT(0x4782275FFF33AF88)   /*  583 */,
+	W64LIT(0xE41433083F820801)   /*  584 */,    W64LIT(0xFD0DFE409A1AF9B5)   /*  585 */,
+	W64LIT(0x4325A3342CDB396B)   /*  586 */,    W64LIT(0x8AE77E62B301B252)   /*  587 */,
+	W64LIT(0xC36F9E9F6655615A)   /*  588 */,    W64LIT(0x85455A2D92D32C09)   /*  589 */,
+	W64LIT(0xF2C7DEA949477485)   /*  590 */,    W64LIT(0x63CFB4C133A39EBA)   /*  591 */,
+	W64LIT(0x83B040CC6EBC5462)   /*  592 */,    W64LIT(0x3B9454C8FDB326B0)   /*  593 */,
+	W64LIT(0x56F56A9E87FFD78C)   /*  594 */,    W64LIT(0x2DC2940D99F42BC6)   /*  595 */,
+	W64LIT(0x98F7DF096B096E2D)   /*  596 */,    W64LIT(0x19A6E01E3AD852BF)   /*  597 */,
+	W64LIT(0x42A99CCBDBD4B40B)   /*  598 */,    W64LIT(0xA59998AF45E9C559)   /*  599 */,
+	W64LIT(0x366295E807D93186)   /*  600 */,    W64LIT(0x6B48181BFAA1F773)   /*  601 */,
+	W64LIT(0x1FEC57E2157A0A1D)   /*  602 */,    W64LIT(0x4667446AF6201AD5)   /*  603 */,
+	W64LIT(0xE615EBCACFB0F075)   /*  604 */,    W64LIT(0xB8F31F4F68290778)   /*  605 */,
+	W64LIT(0x22713ED6CE22D11E)   /*  606 */,    W64LIT(0x3057C1A72EC3C93B)   /*  607 */,
+	W64LIT(0xCB46ACC37C3F1F2F)   /*  608 */,    W64LIT(0xDBB893FD02AAF50E)   /*  609 */,
+	W64LIT(0x331FD92E600B9FCF)   /*  610 */,    W64LIT(0xA498F96148EA3AD6)   /*  611 */,
+	W64LIT(0xA8D8426E8B6A83EA)   /*  612 */,    W64LIT(0xA089B274B7735CDC)   /*  613 */,
+	W64LIT(0x87F6B3731E524A11)   /*  614 */,    W64LIT(0x118808E5CBC96749)   /*  615 */,
+	W64LIT(0x9906E4C7B19BD394)   /*  616 */,    W64LIT(0xAFED7F7E9B24A20C)   /*  617 */,
+	W64LIT(0x6509EADEEB3644A7)   /*  618 */,    W64LIT(0x6C1EF1D3E8EF0EDE)   /*  619 */,
+	W64LIT(0xB9C97D43E9798FB4)   /*  620 */,    W64LIT(0xA2F2D784740C28A3)   /*  621 */,
+	W64LIT(0x7B8496476197566F)   /*  622 */,    W64LIT(0x7A5BE3E6B65F069D)   /*  623 */,
+	W64LIT(0xF96330ED78BE6F10)   /*  624 */,    W64LIT(0xEEE60DE77A076A15)   /*  625 */,
+	W64LIT(0x2B4BEE4AA08B9BD0)   /*  626 */,    W64LIT(0x6A56A63EC7B8894E)   /*  627 */,
+	W64LIT(0x02121359BA34FEF4)   /*  628 */,    W64LIT(0x4CBF99F8283703FC)   /*  629 */,
+	W64LIT(0x398071350CAF30C8)   /*  630 */,    W64LIT(0xD0A77A89F017687A)   /*  631 */,
+	W64LIT(0xF1C1A9EB9E423569)   /*  632 */,    W64LIT(0x8C7976282DEE8199)   /*  633 */,
+	W64LIT(0x5D1737A5DD1F7ABD)   /*  634 */,    W64LIT(0x4F53433C09A9FA80)   /*  635 */,
+	W64LIT(0xFA8B0C53DF7CA1D9)   /*  636 */,    W64LIT(0x3FD9DCBC886CCB77)   /*  637 */,
+	W64LIT(0xC040917CA91B4720)   /*  638 */,    W64LIT(0x7DD00142F9D1DCDF)   /*  639 */,
+	W64LIT(0x8476FC1D4F387B58)   /*  640 */,    W64LIT(0x23F8E7C5F3316503)   /*  641 */,
+	W64LIT(0x032A2244E7E37339)   /*  642 */,    W64LIT(0x5C87A5D750F5A74B)   /*  643 */,
+	W64LIT(0x082B4CC43698992E)   /*  644 */,    W64LIT(0xDF917BECB858F63C)   /*  645 */,
+	W64LIT(0x3270B8FC5BF86DDA)   /*  646 */,    W64LIT(0x10AE72BB29B5DD76)   /*  647 */,
+	W64LIT(0x576AC94E7700362B)   /*  648 */,    W64LIT(0x1AD112DAC61EFB8F)   /*  649 */,
+	W64LIT(0x691BC30EC5FAA427)   /*  650 */,    W64LIT(0xFF246311CC327143)   /*  651 */,
+	W64LIT(0x3142368E30E53206)   /*  652 */,    W64LIT(0x71380E31E02CA396)   /*  653 */,
+	W64LIT(0x958D5C960AAD76F1)   /*  654 */,    W64LIT(0xF8D6F430C16DA536)   /*  655 */,
+	W64LIT(0xC8FFD13F1BE7E1D2)   /*  656 */,    W64LIT(0x7578AE66004DDBE1)   /*  657 */,
+	W64LIT(0x05833F01067BE646)   /*  658 */,    W64LIT(0xBB34B5AD3BFE586D)   /*  659 */,
+	W64LIT(0x095F34C9A12B97F0)   /*  660 */,    W64LIT(0x247AB64525D60CA8)   /*  661 */,
+	W64LIT(0xDCDBC6F3017477D1)   /*  662 */,    W64LIT(0x4A2E14D4DECAD24D)   /*  663 */,
+	W64LIT(0xBDB5E6D9BE0A1EEB)   /*  664 */,    W64LIT(0x2A7E70F7794301AB)   /*  665 */,
+	W64LIT(0xDEF42D8A270540FD)   /*  666 */,    W64LIT(0x01078EC0A34C22C1)   /*  667 */,
+	W64LIT(0xE5DE511AF4C16387)   /*  668 */,    W64LIT(0x7EBB3A52BD9A330A)   /*  669 */,
+	W64LIT(0x77697857AA7D6435)   /*  670 */,    W64LIT(0x004E831603AE4C32)   /*  671 */,
+	W64LIT(0xE7A21020AD78E312)   /*  672 */,    W64LIT(0x9D41A70C6AB420F2)   /*  673 */,
+	W64LIT(0x28E06C18EA1141E6)   /*  674 */,    W64LIT(0xD2B28CBD984F6B28)   /*  675 */,
+	W64LIT(0x26B75F6C446E9D83)   /*  676 */,    W64LIT(0xBA47568C4D418D7F)   /*  677 */,
+	W64LIT(0xD80BADBFE6183D8E)   /*  678 */,    W64LIT(0x0E206D7F5F166044)   /*  679 */,
+	W64LIT(0xE258A43911CBCA3E)   /*  680 */,    W64LIT(0x723A1746B21DC0BC)   /*  681 */,
+	W64LIT(0xC7CAA854F5D7CDD3)   /*  682 */,    W64LIT(0x7CAC32883D261D9C)   /*  683 */,
+	W64LIT(0x7690C26423BA942C)   /*  684 */,    W64LIT(0x17E55524478042B8)   /*  685 */,
+	W64LIT(0xE0BE477656A2389F)   /*  686 */,    W64LIT(0x4D289B5E67AB2DA0)   /*  687 */,
+	W64LIT(0x44862B9C8FBBFD31)   /*  688 */,    W64LIT(0xB47CC8049D141365)   /*  689 */,
+	W64LIT(0x822C1B362B91C793)   /*  690 */,    W64LIT(0x4EB14655FB13DFD8)   /*  691 */,
+	W64LIT(0x1ECBBA0714E2A97B)   /*  692 */,    W64LIT(0x6143459D5CDE5F14)   /*  693 */,
+	W64LIT(0x53A8FBF1D5F0AC89)   /*  694 */,    W64LIT(0x97EA04D81C5E5B00)   /*  695 */,
+	W64LIT(0x622181A8D4FDB3F3)   /*  696 */,    W64LIT(0xE9BCD341572A1208)   /*  697 */,
+	W64LIT(0x1411258643CCE58A)   /*  698 */,    W64LIT(0x9144C5FEA4C6E0A4)   /*  699 */,
+	W64LIT(0x0D33D06565CF620F)   /*  700 */,    W64LIT(0x54A48D489F219CA1)   /*  701 */,
+	W64LIT(0xC43E5EAC6D63C821)   /*  702 */,    W64LIT(0xA9728B3A72770DAF)   /*  703 */,
+	W64LIT(0xD7934E7B20DF87EF)   /*  704 */,    W64LIT(0xE35503B61A3E86E5)   /*  705 */,
+	W64LIT(0xCAE321FBC819D504)   /*  706 */,    W64LIT(0x129A50B3AC60BFA6)   /*  707 */,
+	W64LIT(0xCD5E68EA7E9FB6C3)   /*  708 */,    W64LIT(0xB01C90199483B1C7)   /*  709 */,
+	W64LIT(0x3DE93CD5C295376C)   /*  710 */,    W64LIT(0xAED52EDF2AB9AD13)   /*  711 */,
+	W64LIT(0x2E60F512C0A07884)   /*  712 */,    W64LIT(0xBC3D86A3E36210C9)   /*  713 */,
+	W64LIT(0x35269D9B163951CE)   /*  714 */,    W64LIT(0x0C7D6E2AD0CDB5FA)   /*  715 */,
+	W64LIT(0x59E86297D87F5733)   /*  716 */,    W64LIT(0x298EF221898DB0E7)   /*  717 */,
+	W64LIT(0x55000029D1A5AA7E)   /*  718 */,    W64LIT(0x8BC08AE1B5061B45)   /*  719 */,
+	W64LIT(0xC2C31C2B6C92703A)   /*  720 */,    W64LIT(0x94CC596BAF25EF42)   /*  721 */,
+	W64LIT(0x0A1D73DB22540456)   /*  722 */,    W64LIT(0x04B6A0F9D9C4179A)   /*  723 */,
+	W64LIT(0xEFFDAFA2AE3D3C60)   /*  724 */,    W64LIT(0xF7C8075BB49496C4)   /*  725 */,
+	W64LIT(0x9CC5C7141D1CD4E3)   /*  726 */,    W64LIT(0x78BD1638218E5534)   /*  727 */,
+	W64LIT(0xB2F11568F850246A)   /*  728 */,    W64LIT(0xEDFABCFA9502BC29)   /*  729 */,
+	W64LIT(0x796CE5F2DA23051B)   /*  730 */,    W64LIT(0xAAE128B0DC93537C)   /*  731 */,
+	W64LIT(0x3A493DA0EE4B29AE)   /*  732 */,    W64LIT(0xB5DF6B2C416895D7)   /*  733 */,
+	W64LIT(0xFCABBD25122D7F37)   /*  734 */,    W64LIT(0x70810B58105DC4B1)   /*  735 */,
+	W64LIT(0xE10FDD37F7882A90)   /*  736 */,    W64LIT(0x524DCAB5518A3F5C)   /*  737 */,
+	W64LIT(0x3C9E85878451255B)   /*  738 */,    W64LIT(0x4029828119BD34E2)   /*  739 */,
+	W64LIT(0x74A05B6F5D3CECCB)   /*  740 */,    W64LIT(0xB610021542E13ECA)   /*  741 */,
+	W64LIT(0x0FF979D12F59E2AC)   /*  742 */,    W64LIT(0x6037DA27E4F9CC50)   /*  743 */,
+	W64LIT(0x5E92975A0DF1847D)   /*  744 */,    W64LIT(0xD66DE190D3E623FE)   /*  745 */,
+	W64LIT(0x5032D6B87B568048)   /*  746 */,    W64LIT(0x9A36B7CE8235216E)   /*  747 */,
+	W64LIT(0x80272A7A24F64B4A)   /*  748 */,    W64LIT(0x93EFED8B8C6916F7)   /*  749 */,
+	W64LIT(0x37DDBFF44CCE1555)   /*  750 */,    W64LIT(0x4B95DB5D4B99BD25)   /*  751 */,
+	W64LIT(0x92D3FDA169812FC0)   /*  752 */,    W64LIT(0xFB1A4A9A90660BB6)   /*  753 */,
+	W64LIT(0x730C196946A4B9B2)   /*  754 */,    W64LIT(0x81E289AA7F49DA68)   /*  755 */,
+	W64LIT(0x64669A0F83B1A05F)   /*  756 */,    W64LIT(0x27B3FF7D9644F48B)   /*  757 */,
+	W64LIT(0xCC6B615C8DB675B3)   /*  758 */,    W64LIT(0x674F20B9BCEBBE95)   /*  759 */,
+	W64LIT(0x6F31238275655982)   /*  760 */,    W64LIT(0x5AE488713E45CF05)   /*  761 */,
+	W64LIT(0xBF619F9954C21157)   /*  762 */,    W64LIT(0xEABAC46040A8EAE9)   /*  763 */,
+	W64LIT(0x454C6FE9F2C0C1CD)   /*  764 */,    W64LIT(0x419CF6496412691C)   /*  765 */,
+	W64LIT(0xD3DC3BEF265B0F70)   /*  766 */,    W64LIT(0x6D0E60F5C3578A9E)   /*  767 */,
+	W64LIT(0x5B0E608526323C55)   /*  768 */,    W64LIT(0x1A46C1A9FA1B59F5)   /*  769 */,
+	W64LIT(0xA9E245A17C4C8FFA)   /*  770 */,    W64LIT(0x65CA5159DB2955D7)   /*  771 */,
+	W64LIT(0x05DB0A76CE35AFC2)   /*  772 */,    W64LIT(0x81EAC77EA9113D45)   /*  773 */,
+	W64LIT(0x528EF88AB6AC0A0D)   /*  774 */,    W64LIT(0xA09EA253597BE3FF)   /*  775 */,
+	W64LIT(0x430DDFB3AC48CD56)   /*  776 */,    W64LIT(0xC4B3A67AF45CE46F)   /*  777 */,
+	W64LIT(0x4ECECFD8FBE2D05E)   /*  778 */,    W64LIT(0x3EF56F10B39935F0)   /*  779 */,
+	W64LIT(0x0B22D6829CD619C6)   /*  780 */,    W64LIT(0x17FD460A74DF2069)   /*  781 */,
+	W64LIT(0x6CF8CC8E8510ED40)   /*  782 */,    W64LIT(0xD6C824BF3A6ECAA7)   /*  783 */,
+	W64LIT(0x61243D581A817049)   /*  784 */,    W64LIT(0x048BACB6BBC163A2)   /*  785 */,
+	W64LIT(0xD9A38AC27D44CC32)   /*  786 */,    W64LIT(0x7FDDFF5BAAF410AB)   /*  787 */,
+	W64LIT(0xAD6D495AA804824B)   /*  788 */,    W64LIT(0xE1A6A74F2D8C9F94)   /*  789 */,
+	W64LIT(0xD4F7851235DEE8E3)   /*  790 */,    W64LIT(0xFD4B7F886540D893)   /*  791 */,
+	W64LIT(0x247C20042AA4BFDA)   /*  792 */,    W64LIT(0x096EA1C517D1327C)   /*  793 */,
+	W64LIT(0xD56966B4361A6685)   /*  794 */,    W64LIT(0x277DA5C31221057D)   /*  795 */,
+	W64LIT(0x94D59893A43ACFF7)   /*  796 */,    W64LIT(0x64F0C51CCDC02281)   /*  797 */,
+	W64LIT(0x3D33BCC4FF6189DB)   /*  798 */,    W64LIT(0xE005CB184CE66AF1)   /*  799 */,
+	W64LIT(0xFF5CCD1D1DB99BEA)   /*  800 */,    W64LIT(0xB0B854A7FE42980F)   /*  801 */,
+	W64LIT(0x7BD46A6A718D4B9F)   /*  802 */,    W64LIT(0xD10FA8CC22A5FD8C)   /*  803 */,
+	W64LIT(0xD31484952BE4BD31)   /*  804 */,    W64LIT(0xC7FA975FCB243847)   /*  805 */,
+	W64LIT(0x4886ED1E5846C407)   /*  806 */,    W64LIT(0x28CDDB791EB70B04)   /*  807 */,
+	W64LIT(0xC2B00BE2F573417F)   /*  808 */,    W64LIT(0x5C9590452180F877)   /*  809 */,
+	W64LIT(0x7A6BDDFFF370EB00)   /*  810 */,    W64LIT(0xCE509E38D6D9D6A4)   /*  811 */,
+	W64LIT(0xEBEB0F00647FA702)   /*  812 */,    W64LIT(0x1DCC06CF76606F06)   /*  813 */,
+	W64LIT(0xE4D9F28BA286FF0A)   /*  814 */,    W64LIT(0xD85A305DC918C262)   /*  815 */,
+	W64LIT(0x475B1D8732225F54)   /*  816 */,    W64LIT(0x2D4FB51668CCB5FE)   /*  817 */,
+	W64LIT(0xA679B9D9D72BBA20)   /*  818 */,    W64LIT(0x53841C0D912D43A5)   /*  819 */,
+	W64LIT(0x3B7EAA48BF12A4E8)   /*  820 */,    W64LIT(0x781E0E47F22F1DDF)   /*  821 */,
+	W64LIT(0xEFF20CE60AB50973)   /*  822 */,    W64LIT(0x20D261D19DFFB742)   /*  823 */,
+	W64LIT(0x16A12B03062A2E39)   /*  824 */,    W64LIT(0x1960EB2239650495)   /*  825 */,
+	W64LIT(0x251C16FED50EB8B8)   /*  826 */,    W64LIT(0x9AC0C330F826016E)   /*  827 */,
+	W64LIT(0xED152665953E7671)   /*  828 */,    W64LIT(0x02D63194A6369570)   /*  829 */,
+	W64LIT(0x5074F08394B1C987)   /*  830 */,    W64LIT(0x70BA598C90B25CE1)   /*  831 */,
+	W64LIT(0x794A15810B9742F6)   /*  832 */,    W64LIT(0x0D5925E9FCAF8C6C)   /*  833 */,
+	W64LIT(0x3067716CD868744E)   /*  834 */,    W64LIT(0x910AB077E8D7731B)   /*  835 */,
+	W64LIT(0x6A61BBDB5AC42F61)   /*  836 */,    W64LIT(0x93513EFBF0851567)   /*  837 */,
+	W64LIT(0xF494724B9E83E9D5)   /*  838 */,    W64LIT(0xE887E1985C09648D)   /*  839 */,
+	W64LIT(0x34B1D3C675370CFD)   /*  840 */,    W64LIT(0xDC35E433BC0D255D)   /*  841 */,
+	W64LIT(0xD0AAB84234131BE0)   /*  842 */,    W64LIT(0x08042A50B48B7EAF)   /*  843 */,
+	W64LIT(0x9997C4EE44A3AB35)   /*  844 */,    W64LIT(0x829A7B49201799D0)   /*  845 */,
+	W64LIT(0x263B8307B7C54441)   /*  846 */,    W64LIT(0x752F95F4FD6A6CA6)   /*  847 */,
+	W64LIT(0x927217402C08C6E5)   /*  848 */,    W64LIT(0x2A8AB754A795D9EE)   /*  849 */,
+	W64LIT(0xA442F7552F72943D)   /*  850 */,    W64LIT(0x2C31334E19781208)   /*  851 */,
+	W64LIT(0x4FA98D7CEAEE6291)   /*  852 */,    W64LIT(0x55C3862F665DB309)   /*  853 */,
+	W64LIT(0xBD0610175D53B1F3)   /*  854 */,    W64LIT(0x46FE6CB840413F27)   /*  855 */,
+	W64LIT(0x3FE03792DF0CFA59)   /*  856 */,    W64LIT(0xCFE700372EB85E8F)   /*  857 */,
+	W64LIT(0xA7BE29E7ADBCE118)   /*  858 */,    W64LIT(0xE544EE5CDE8431DD)   /*  859 */,
+	W64LIT(0x8A781B1B41F1873E)   /*  860 */,    W64LIT(0xA5C94C78A0D2F0E7)   /*  861 */,
+	W64LIT(0x39412E2877B60728)   /*  862 */,    W64LIT(0xA1265EF3AFC9A62C)   /*  863 */,
+	W64LIT(0xBCC2770C6A2506C5)   /*  864 */,    W64LIT(0x3AB66DD5DCE1CE12)   /*  865 */,
+	W64LIT(0xE65499D04A675B37)   /*  866 */,    W64LIT(0x7D8F523481BFD216)   /*  867 */,
+	W64LIT(0x0F6F64FCEC15F389)   /*  868 */,    W64LIT(0x74EFBE618B5B13C8)   /*  869 */,
+	W64LIT(0xACDC82B714273E1D)   /*  870 */,    W64LIT(0xDD40BFE003199D17)   /*  871 */,
+	W64LIT(0x37E99257E7E061F8)   /*  872 */,    W64LIT(0xFA52626904775AAA)   /*  873 */,
+	W64LIT(0x8BBBF63A463D56F9)   /*  874 */,    W64LIT(0xF0013F1543A26E64)   /*  875 */,
+	W64LIT(0xA8307E9F879EC898)   /*  876 */,    W64LIT(0xCC4C27A4150177CC)   /*  877 */,
+	W64LIT(0x1B432F2CCA1D3348)   /*  878 */,    W64LIT(0xDE1D1F8F9F6FA013)   /*  879 */,
+	W64LIT(0x606602A047A7DDD6)   /*  880 */,    W64LIT(0xD237AB64CC1CB2C7)   /*  881 */,
+	W64LIT(0x9B938E7225FCD1D3)   /*  882 */,    W64LIT(0xEC4E03708E0FF476)   /*  883 */,
+	W64LIT(0xFEB2FBDA3D03C12D)   /*  884 */,    W64LIT(0xAE0BCED2EE43889A)   /*  885 */,
+	W64LIT(0x22CB8923EBFB4F43)   /*  886 */,    W64LIT(0x69360D013CF7396D)   /*  887 */,
+	W64LIT(0x855E3602D2D4E022)   /*  888 */,    W64LIT(0x073805BAD01F784C)   /*  889 */,
+	W64LIT(0x33E17A133852F546)   /*  890 */,    W64LIT(0xDF4874058AC7B638)   /*  891 */,
+	W64LIT(0xBA92B29C678AA14A)   /*  892 */,    W64LIT(0x0CE89FC76CFAADCD)   /*  893 */,
+	W64LIT(0x5F9D4E0908339E34)   /*  894 */,    W64LIT(0xF1AFE9291F5923B9)   /*  895 */,
+	W64LIT(0x6E3480F60F4A265F)   /*  896 */,    W64LIT(0xEEBF3A2AB29B841C)   /*  897 */,
+	W64LIT(0xE21938A88F91B4AD)   /*  898 */,    W64LIT(0x57DFEFF845C6D3C3)   /*  899 */,
+	W64LIT(0x2F006B0BF62CAAF2)   /*  900 */,    W64LIT(0x62F479EF6F75EE78)   /*  901 */,
+	W64LIT(0x11A55AD41C8916A9)   /*  902 */,    W64LIT(0xF229D29084FED453)   /*  903 */,
+	W64LIT(0x42F1C27B16B000E6)   /*  904 */,    W64LIT(0x2B1F76749823C074)   /*  905 */,
+	W64LIT(0x4B76ECA3C2745360)   /*  906 */,    W64LIT(0x8C98F463B91691BD)   /*  907 */,
+	W64LIT(0x14BCC93CF1ADE66A)   /*  908 */,    W64LIT(0x8885213E6D458397)   /*  909 */,
+	W64LIT(0x8E177DF0274D4711)   /*  910 */,    W64LIT(0xB49B73B5503F2951)   /*  911 */,
+	W64LIT(0x10168168C3F96B6B)   /*  912 */,    W64LIT(0x0E3D963B63CAB0AE)   /*  913 */,
+	W64LIT(0x8DFC4B5655A1DB14)   /*  914 */,    W64LIT(0xF789F1356E14DE5C)   /*  915 */,
+	W64LIT(0x683E68AF4E51DAC1)   /*  916 */,    W64LIT(0xC9A84F9D8D4B0FD9)   /*  917 */,
+	W64LIT(0x3691E03F52A0F9D1)   /*  918 */,    W64LIT(0x5ED86E46E1878E80)   /*  919 */,
+	W64LIT(0x3C711A0E99D07150)   /*  920 */,    W64LIT(0x5A0865B20C4E9310)   /*  921 */,
+	W64LIT(0x56FBFC1FE4F0682E)   /*  922 */,    W64LIT(0xEA8D5DE3105EDF9B)   /*  923 */,
+	W64LIT(0x71ABFDB12379187A)   /*  924 */,    W64LIT(0x2EB99DE1BEE77B9C)   /*  925 */,
+	W64LIT(0x21ECC0EA33CF4523)   /*  926 */,    W64LIT(0x59A4D7521805C7A1)   /*  927 */,
+	W64LIT(0x3896F5EB56AE7C72)   /*  928 */,    W64LIT(0xAA638F3DB18F75DC)   /*  929 */,
+	W64LIT(0x9F39358DABE9808E)   /*  930 */,    W64LIT(0xB7DEFA91C00B72AC)   /*  931 */,
+	W64LIT(0x6B5541FD62492D92)   /*  932 */,    W64LIT(0x6DC6DEE8F92E4D5B)   /*  933 */,
+	W64LIT(0x353F57ABC4BEEA7E)   /*  934 */,    W64LIT(0x735769D6DA5690CE)   /*  935 */,
+	W64LIT(0x0A234AA642391484)   /*  936 */,    W64LIT(0xF6F9508028F80D9D)   /*  937 */,
+	W64LIT(0xB8E319A27AB3F215)   /*  938 */,    W64LIT(0x31AD9C1151341A4D)   /*  939 */,
+	W64LIT(0x773C22A57BEF5805)   /*  940 */,    W64LIT(0x45C7561A07968633)   /*  941 */,
+	W64LIT(0xF913DA9E249DBE36)   /*  942 */,    W64LIT(0xDA652D9B78A64C68)   /*  943 */,
+	W64LIT(0x4C27A97F3BC334EF)   /*  944 */,    W64LIT(0x76621220E66B17F4)   /*  945 */,
+	W64LIT(0x967743899ACD7D0B)   /*  946 */,    W64LIT(0xF3EE5BCAE0ED6782)   /*  947 */,
+	W64LIT(0x409F753600C879FC)   /*  948 */,    W64LIT(0x06D09A39B5926DB6)   /*  949 */,
+	W64LIT(0x6F83AEB0317AC588)   /*  950 */,    W64LIT(0x01E6CA4A86381F21)   /*  951 */,
+	W64LIT(0x66FF3462D19F3025)   /*  952 */,    W64LIT(0x72207C24DDFD3BFB)   /*  953 */,
+	W64LIT(0x4AF6B6D3E2ECE2EB)   /*  954 */,    W64LIT(0x9C994DBEC7EA08DE)   /*  955 */,
+	W64LIT(0x49ACE597B09A8BC4)   /*  956 */,    W64LIT(0xB38C4766CF0797BA)   /*  957 */,
+	W64LIT(0x131B9373C57C2A75)   /*  958 */,    W64LIT(0xB1822CCE61931E58)   /*  959 */,
+	W64LIT(0x9D7555B909BA1C0C)   /*  960 */,    W64LIT(0x127FAFDD937D11D2)   /*  961 */,
+	W64LIT(0x29DA3BADC66D92E4)   /*  962 */,    W64LIT(0xA2C1D57154C2ECBC)   /*  963 */,
+	W64LIT(0x58C5134D82F6FE24)   /*  964 */,    W64LIT(0x1C3AE3515B62274F)   /*  965 */,
+	W64LIT(0xE907C82E01CB8126)   /*  966 */,    W64LIT(0xF8ED091913E37FCB)   /*  967 */,
+	W64LIT(0x3249D8F9C80046C9)   /*  968 */,    W64LIT(0x80CF9BEDE388FB63)   /*  969 */,
+	W64LIT(0x1881539A116CF19E)   /*  970 */,    W64LIT(0x5103F3F76BD52457)   /*  971 */,
+	W64LIT(0x15B7E6F5AE47F7A8)   /*  972 */,    W64LIT(0xDBD7C6DED47E9CCF)   /*  973 */,
+	W64LIT(0x44E55C410228BB1A)   /*  974 */,    W64LIT(0xB647D4255EDB4E99)   /*  975 */,
+	W64LIT(0x5D11882BB8AAFC30)   /*  976 */,    W64LIT(0xF5098BBB29D3212A)   /*  977 */,
+	W64LIT(0x8FB5EA14E90296B3)   /*  978 */,    W64LIT(0x677B942157DD025A)   /*  979 */,
+	W64LIT(0xFB58E7C0A390ACB5)   /*  980 */,    W64LIT(0x89D3674C83BD4A01)   /*  981 */,
+	W64LIT(0x9E2DA4DF4BF3B93B)   /*  982 */,    W64LIT(0xFCC41E328CAB4829)   /*  983 */,
+	W64LIT(0x03F38C96BA582C52)   /*  984 */,    W64LIT(0xCAD1BDBD7FD85DB2)   /*  985 */,
+	W64LIT(0xBBB442C16082AE83)   /*  986 */,    W64LIT(0xB95FE86BA5DA9AB0)   /*  987 */,
+	W64LIT(0xB22E04673771A93F)   /*  988 */,    W64LIT(0x845358C9493152D8)   /*  989 */,
+	W64LIT(0xBE2A488697B4541E)   /*  990 */,    W64LIT(0x95A2DC2DD38E6966)   /*  991 */,
+	W64LIT(0xC02C11AC923C852B)   /*  992 */,    W64LIT(0x2388B1990DF2A87B)   /*  993 */,
+	W64LIT(0x7C8008FA1B4F37BE)   /*  994 */,    W64LIT(0x1F70D0C84D54E503)   /*  995 */,
+	W64LIT(0x5490ADEC7ECE57D4)   /*  996 */,    W64LIT(0x002B3C27D9063A3A)   /*  997 */,
+	W64LIT(0x7EAEA3848030A2BF)   /*  998 */,    W64LIT(0xC602326DED2003C0)   /*  999 */,
+	W64LIT(0x83A7287D69A94086)   /* 1000 */,    W64LIT(0xC57A5FCB30F57A8A)   /* 1001 */,
+	W64LIT(0xB56844E479EBE779)   /* 1002 */,    W64LIT(0xA373B40F05DCBCE9)   /* 1003 */,
+	W64LIT(0xD71A786E88570EE2)   /* 1004 */,    W64LIT(0x879CBACDBDE8F6A0)   /* 1005 */,
+	W64LIT(0x976AD1BCC164A32F)   /* 1006 */,    W64LIT(0xAB21E25E9666D78B)   /* 1007 */,
+	W64LIT(0x901063AAE5E5C33C)   /* 1008 */,    W64LIT(0x9818B34448698D90)   /* 1009 */,
+	W64LIT(0xE36487AE3E1E8ABB)   /* 1010 */,    W64LIT(0xAFBDF931893BDCB4)   /* 1011 */,
+	W64LIT(0x6345A0DC5FBBD519)   /* 1012 */,    W64LIT(0x8628FE269B9465CA)   /* 1013 */,
+	W64LIT(0x1E5D01603F9C51EC)   /* 1014 */,    W64LIT(0x4DE44006A15049B7)   /* 1015 */,
+	W64LIT(0xBF6C70E5F776CBB1)   /* 1016 */,    W64LIT(0x411218F2EF552BED)   /* 1017 */,
+	W64LIT(0xCB0C0708705A36A3)   /* 1018 */,    W64LIT(0xE74D14754F986044)   /* 1019 */,
+	W64LIT(0xCD56D9430EA8280E)   /* 1020 */,    W64LIT(0xC12591D7535F5065)   /* 1021 */,
+	W64LIT(0xC83223F1720AEF96)   /* 1022 */,    W64LIT(0xC3A0396F7363A51F)   /* 1023 */,
+	W64LIT(0xffffffffffffffff),
+	W64LIT(0xA5A5A5A5A5A5A5A5),
+	W64LIT(0x0123456789ABCDEF),
+};
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/trap.h b/runtime/third_party/cryptopp/trap.h
new file mode 100644
index 0000000..2c2906b
--- /dev/null
+++ b/runtime/third_party/cryptopp/trap.h
@@ -0,0 +1,163 @@
+// trap.h - written and placed in public domain by Jeffrey Walton.
+
+/// \file trap.h
+/// \brief Debugging and diagnostic assertions
+/// \details <tt>CRYPTOPP_ASSERT</tt> is the library's debugging and diagnostic
+///  assertion. <tt>CRYPTOPP_ASSERT</tt> is enabled by <tt>CRYPTOPP_DEBUG</tt>,
+///  <tt>DEBUG</tt> or <tt>_DEBUG</tt>.
+/// \details <tt>CRYPTOPP_ASSERT</tt> raises a <tt>SIGTRAP</tt> (Unix) or calls
+///  <tt>DebugBreak()</tt> (Windows).
+/// \details <tt>CRYPTOPP_ASSERT</tt> is only in effect when the user requests a
+///  debug configuration. <tt>NDEBUG</tt> (or failure to define it) does not
+///  affect <tt>CRYPTOPP_ASSERT</tt>.
+/// \since Crypto++ 5.6.5
+/// \sa DebugTrapHandler, <A
+///  HREF="http://github.com/weidai11/cryptopp/issues/277">Issue 277</A>,
+///  <A HREF="http://seclists.org/oss-sec/2016/q3/520">CVE-2016-7420</A>
+
+#ifndef CRYPTOPP_TRAP_H
+#define CRYPTOPP_TRAP_H
+
+#include "config.h"
+
+#if defined(CRYPTOPP_DEBUG)
+#  include <iostream>
+#  include <sstream>
+#  if defined(UNIX_SIGNALS_AVAILABLE)
+#    include "ossig.h"
+#  elif defined(CRYPTOPP_WIN32_AVAILABLE) && !defined(__CYGWIN__)
+     extern "C" __declspec(dllimport) void __stdcall DebugBreak();
+     extern "C" __declspec(dllimport)  int __stdcall IsDebuggerPresent();
+#  endif
+#endif // CRYPTOPP_DEBUG
+
+// ************** run-time assertion ***************
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Debugging and diagnostic assertion
+/// \details <tt>CRYPTOPP_ASSERT</tt> is the library's debugging and diagnostic
+///  assertion. <tt>CRYPTOPP_ASSERT</tt> is enabled by the preprocessor macros
+///  <tt>CRYPTOPP_DEBUG</tt>, <tt>DEBUG</tt> or <tt>_DEBUG</tt>.
+/// \details <tt>CRYPTOPP_ASSERT</tt> raises a <tt>SIGTRAP</tt> (Unix) or calls
+///  <tt>DebugBreak()</tt> (Windows). <tt>CRYPTOPP_ASSERT</tt> is only in effect
+///  when the user explicitly requests a debug configuration.
+/// \details If you want to ensure <tt>CRYPTOPP_ASSERT</tt> is inert, then <em>do
+///  not</em> define <tt>CRYPTOPP_DEBUG</tt>, <tt>DEBUG</tt> or <tt>_DEBUG</tt>.
+///  Avoiding the defines means <tt>CRYPTOPP_ASSERT</tt> is preprocessed into an
+///  empty string.
+/// \details The traditional Posix define <tt>NDEBUG</tt> has no effect on
+///  <tt>CRYPTOPP_DEBUG</tt>, <tt>CRYPTOPP_ASSERT</tt> or DebugTrapHandler.
+/// \details An example of using CRYPTOPP_ASSERT and DebugTrapHandler is shown
+///  below. The library's test program, <tt>cryptest.exe</tt> (from test.cpp),
+///  exercises the structure:
+///  <pre>
+///   \#if defined(CRYPTOPP_DEBUG) && defined(UNIX_SIGNALS_AVAILABLE)
+///   static const DebugTrapHandler g_dummyHandler;
+///   \#endif
+///
+///   int main(int argc, char* argv[])
+///   {
+///      CRYPTOPP_ASSERT(argv != nullptr);
+///      ...
+///   }
+///  </pre>
+/// \since Crypto++ 5.6.5
+/// \sa DebugTrapHandler, SignalHandler, <A
+///  HREF="http://github.com/weidai11/cryptopp/issues/277">Issue 277</A>,
+///  <A HREF="http://seclists.org/oss-sec/2016/q3/520">CVE-2016-7420</A>
+#  define CRYPTOPP_ASSERT(exp) { ... }
+#endif
+
+#if defined(CRYPTOPP_DEBUG)
+# if defined(UNIX_SIGNALS_AVAILABLE) || defined(__CYGWIN__)
+#  define CRYPTOPP_ASSERT(exp) {                                  \
+    if (!(exp)) {                                                 \
+      std::ostringstream oss;                                     \
+      oss << "Assertion failed: " << __FILE__ << "("              \
+          << __LINE__ << "): " << __func__                        \
+          << std::endl;                                           \
+      std::cout << std::flush;                                    \
+      std::cerr << oss.str();                                     \
+      raise(SIGTRAP);                                             \
+    }                                                             \
+  }
+# elif CRYPTOPP_DEBUG && defined(CRYPTOPP_WIN32_AVAILABLE)
+#  define CRYPTOPP_ASSERT(exp) {                                  \
+    if (!(exp)) {                                                 \
+      std::ostringstream oss;                                     \
+      oss << "Assertion failed: " << __FILE__ << "("              \
+          << __LINE__ << "): " << __FUNCTION__                    \
+          << std::endl;                                           \
+      std::cout << std::flush;                                    \
+      std::cerr << oss.str();                                     \
+      if (IsDebuggerPresent()) {DebugBreak();}                    \
+    }                                                             \
+  }
+# endif // Unix or Windows
+#endif  // CRYPTOPP_DEBUG
+
+// Remove CRYPTOPP_ASSERT in non-debug builds.
+#ifndef CRYPTOPP_ASSERT
+#  define CRYPTOPP_ASSERT(exp) (void)0
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ************** SIGTRAP handler ***************
+
+#if (CRYPTOPP_DEBUG && defined(UNIX_SIGNALS_AVAILABLE)) || defined(CRYPTOPP_DOXYGEN_PROCESSING)
+/// \brief Default SIGTRAP handler
+/// \details DebugTrapHandler() can be used by a program to install an empty
+///  SIGTRAP handler. If present, the handler ensures there is a signal
+///  handler in place for <tt>SIGTRAP</tt> raised by
+///  <tt>CRYPTOPP_ASSERT</tt>. If <tt>CRYPTOPP_ASSERT</tt> raises
+///  <tt>SIGTRAP</tt> <em>without</em> a handler, then one of two things can
+///  occur. First, the OS might allow the program to continue. Second, the OS
+///  might terminate the program. OS X allows the program to continue, while
+///  some Linuxes terminate the program.
+/// \details If DebugTrapHandler detects another handler in place, then it will
+///  not install a handler. This ensures a debugger can gain control of the
+///  <tt>SIGTRAP</tt> signal without contention. It also allows multiple
+///  DebugTrapHandler to be created without contentious or unusual behavior.
+///  Though multiple DebugTrapHandler can be created, a program should only
+///  create one, if needed.
+/// \details A DebugTrapHandler is subject to C++ static initialization
+///  [dis]order. If you need to install a handler and it must be installed
+///  early, then reference the code associated with
+///  <tt>CRYPTOPP_INIT_PRIORITY</tt> in cryptlib.cpp and cpu.cpp.
+/// \details If you want to ensure <tt>CRYPTOPP_ASSERT</tt> is inert, then
+///  <em>do not</em> define <tt>CRYPTOPP_DEBUG</tt>, <tt>DEBUG</tt> or
+///  <tt>_DEBUG</tt>. Avoiding the defines means <tt>CRYPTOPP_ASSERT</tt>
+///  is processed into <tt>((void)0)</tt>.
+/// \details The traditional Posix define <tt>NDEBUG</tt> has no effect on
+///  <tt>CRYPTOPP_DEBUG</tt>, <tt>CRYPTOPP_ASSERT</tt> or DebugTrapHandler.
+/// \details An example of using \ref CRYPTOPP_ASSERT "CRYPTOPP_ASSERT" and
+///  DebugTrapHandler is shown below. The library's test program,
+///  <tt>cryptest.exe</tt> (from test.cpp), exercises the structure:
+///  <pre>
+///   \#if defined(CRYPTOPP_DEBUG) && defined(UNIX_SIGNALS_AVAILABLE)
+///   const DebugTrapHandler g_dummyHandler;
+///   \#endif
+///
+///   int main(int argc, char* argv[])
+///   {
+///      CRYPTOPP_ASSERT(argv != nullptr);
+///      ...
+///   }
+///  </pre>
+/// \since Crypto++ 5.6.5
+/// \sa \ref CRYPTOPP_ASSERT "CRYPTOPP_ASSERT", SignalHandler, <A
+///  HREF="http://github.com/weidai11/cryptopp/issues/277">Issue 277</A>,
+///  <A HREF="http://seclists.org/oss-sec/2016/q3/520">CVE-2016-7420</A>
+
+#if defined(CRYPTOPP_DOXYGEN_PROCESSING)
+class DebugTrapHandler : public SignalHandler<SIGTRAP, false> { };
+#else
+typedef SignalHandler<SIGTRAP, false> DebugTrapHandler;
+#endif
+
+#endif  // Linux, Unix and Documentation
+
+NAMESPACE_END
+
+#endif // CRYPTOPP_TRAP_H
diff --git a/runtime/third_party/cryptopp/trunhash.h b/runtime/third_party/cryptopp/trunhash.h
new file mode 100644
index 0000000..e659cc8
--- /dev/null
+++ b/runtime/third_party/cryptopp/trunhash.h
@@ -0,0 +1,63 @@
+// trunhash.h - originally written and placed in the public domain by Wei Dai
+
+/// \file trunhash.h
+/// \brief Classes for truncated hashes
+
+#ifndef CRYPTOPP_TRUNHASH_H
+#define CRYPTOPP_TRUNHASH_H
+
+#include "cryptlib.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Null hash
+/// \details A null hash that conforms to HashTransformation interface
+class NullHash : public HashTransformation
+{
+public:
+	void Update(const byte *input, size_t length)
+		{CRYPTOPP_UNUSED(input);CRYPTOPP_UNUSED(length);}
+	unsigned int DigestSize() const
+		{return 0;}
+	void TruncatedFinal(byte *digest, size_t digestSize)
+		{CRYPTOPP_UNUSED(digest);CRYPTOPP_UNUSED(digestSize);}
+	bool TruncatedVerify(const byte *digest, size_t digestLength)
+		{CRYPTOPP_UNUSED(digest);CRYPTOPP_UNUSED(digestLength);return true;}
+};
+
+/// \brief Construct new HashModule with smaller digest size from an existing one
+/// \tparam T HashTransformation derived class
+template <class T>
+class TruncatedHashTemplate : public HashTransformation
+{
+public:
+	/// \brief Construct a TruncatedHashTemplate
+	TruncatedHashTemplate(T hm, unsigned int digestSize)
+		: m_hm(hm), m_digestSize(digestSize) {}
+	/// \brief Construct a TruncatedHashTemplate
+	TruncatedHashTemplate(const byte *key, size_t keyLength, unsigned int digestSize)
+		: m_hm(key, keyLength), m_digestSize(digestSize) {}
+	/// \brief Construct a TruncatedHashTemplate
+	TruncatedHashTemplate(size_t digestSize)
+		: m_digestSize(digestSize) {}
+
+	void Restart()
+		{m_hm.Restart();}
+	void Update(const byte *input, size_t length)
+		{m_hm.Update(input, length);}
+	unsigned int DigestSize() const {return m_digestSize;}
+	void TruncatedFinal(byte *digest, size_t digestSize)
+		{m_hm.TruncatedFinal(digest, digestSize);}
+	bool TruncatedVerify(const byte *digest, size_t digestLength)
+		{return m_hm.TruncatedVerify(digest, digestLength);}
+
+private:
+	T m_hm;
+	unsigned int m_digestSize;
+};
+
+typedef TruncatedHashTemplate<HashTransformation &> TruncatedHashModule;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/ttmac.cpp b/runtime/third_party/cryptopp/ttmac.cpp
new file mode 100644
index 0000000..d1f94dc
--- /dev/null
+++ b/runtime/third_party/cryptopp/ttmac.cpp
@@ -0,0 +1,348 @@
+// ttmac.cpp - written and placed in the public domain by Kevin Springle
+
+#include "pch.h"
+#include "ttmac.h"
+#include "misc.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::word32;
+using CryptoPP::rotlVariable;
+using CryptoPP::rotlConstant;
+
+// RIPEMD-160 definitions used by Two-Track-MAC
+word32 F(word32 x, word32 y, word32 z) { return x ^ y ^ z; }
+word32 G(word32 x, word32 y, word32 z) { return z ^ (x & (y^z)); }
+word32 H(word32 x, word32 y, word32 z) { return z ^ (x | ~y); }
+word32 I(word32 x, word32 y, word32 z) { return y ^ (z & (x^y)); }
+word32 J(word32 x, word32 y, word32 z) { return x ^ (y | ~z); }
+
+template <unsigned int S, typename Fn>
+void Subround(Fn fn, word32& a, word32 b, word32& c, word32 d, word32 e, word32 x, word32 k)
+{
+	a += fn(b, c, d) + x + k;
+	a = rotlVariable(a, S) + e;
+	c = rotlConstant<10>(c);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const unsigned int k0 = 0;
+const unsigned int k1 = 0x5a827999;
+const unsigned int k2 = 0x6ed9eba1;
+const unsigned int k3 = 0x8f1bbcdc;
+const unsigned int k4 = 0xa953fd4e;
+const unsigned int k5 = 0x50a28be6;
+const unsigned int k6 = 0x5c4dd124;
+const unsigned int k7 = 0x6d703ef3;
+const unsigned int k8 = 0x7a6d76e9;
+const unsigned int k9 = 0;
+
+void TTMAC_Base::UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &)
+{
+	AssertValidKeyLength(keylength);
+
+	std::memcpy(m_key, userKey, KEYLENGTH);
+	CorrectEndianess(m_key, m_key, KEYLENGTH);
+
+	Init();
+}
+
+void TTMAC_Base::Init()
+{
+	m_digest[0] = m_digest[5] = m_key[0];
+	m_digest[1] = m_digest[6] = m_key[1];
+	m_digest[2] = m_digest[7] = m_key[2];
+	m_digest[3] = m_digest[8] = m_key[3];
+	m_digest[4] = m_digest[9] = m_key[4];
+}
+
+void TTMAC_Base::TruncatedFinal(byte *hash, size_t size)
+{
+	PadLastBlock(BlockSize() - 2*sizeof(HashWordType));
+	CorrectEndianess(m_data, m_data, BlockSize() - 2*sizeof(HashWordType));
+
+	m_data[m_data.size()-2] = GetBitCountLo();
+	m_data[m_data.size()-1] = GetBitCountHi();
+
+	Transform(m_digest, m_data, true);
+
+	word32 t2 = m_digest[2];
+	word32 t3 = m_digest[3];
+	if (size != DIGESTSIZE)
+	{
+		switch (size)
+		{
+			case 16:
+				m_digest[3] += m_digest[1] + m_digest[4];
+				// fall through
+			case 12:
+				m_digest[2] += m_digest[0] + t3;
+				// fall through
+			case 8:
+				m_digest[0] += m_digest[1] + t3;
+				m_digest[1] += m_digest[4] + t2;
+				break;
+
+			case 4:
+				m_digest[0] +=
+						m_digest[1] +
+						m_digest[2] +
+						m_digest[3] +
+						m_digest[4];
+				break;
+
+			case 0:
+				// Used by HashTransformation::Restart()
+				break;
+
+			default:
+				throw InvalidArgument("TTMAC_Base: can't truncate a Two-Track-MAC 20 byte digest to " + IntToString(size) + " bytes");
+				break;
+		}
+	}
+
+	CorrectEndianess(m_digest, m_digest, size);
+	std::memcpy(hash, m_digest, size);
+
+	Restart();		// reinit for next use
+}
+
+void TTMAC_Base::Transform(word32 *digest, const word32 *X, bool last)
+{
+	word32 a1, b1, c1, d1, e1, a2, b2, c2, d2, e2;
+	word32 *trackA, *trackB;
+
+	if (!last)
+	{
+		trackA = digest;
+		trackB = digest+5;
+	}
+	else
+	{
+		trackB = digest;
+		trackA = digest+5;
+	}
+	a1 = trackA[0];
+	b1 = trackA[1];
+	c1 = trackA[2];
+	d1 = trackA[3];
+	e1 = trackA[4];
+	a2 = trackB[0];
+	b2 = trackB[1];
+	c2 = trackB[2];
+	d2 = trackB[3];
+	e2 = trackB[4];
+
+	Subround<11>(F, a1, b1, c1, d1, e1, X[ 0], k0);
+	Subround<14>(F, e1, a1, b1, c1, d1, X[ 1], k0);
+	Subround<15>(F, d1, e1, a1, b1, c1, X[ 2], k0);
+	Subround<12>(F, c1, d1, e1, a1, b1, X[ 3], k0);
+	Subround< 5>(F, b1, c1, d1, e1, a1, X[ 4], k0);
+	Subround< 8>(F, a1, b1, c1, d1, e1, X[ 5], k0);
+	Subround< 7>(F, e1, a1, b1, c1, d1, X[ 6], k0);
+	Subround< 9>(F, d1, e1, a1, b1, c1, X[ 7], k0);
+	Subround<11>(F, c1, d1, e1, a1, b1, X[ 8], k0);
+	Subround<13>(F, b1, c1, d1, e1, a1, X[ 9], k0);
+	Subround<14>(F, a1, b1, c1, d1, e1, X[10], k0);
+	Subround<15>(F, e1, a1, b1, c1, d1, X[11], k0);
+	Subround< 6>(F, d1, e1, a1, b1, c1, X[12], k0);
+	Subround< 7>(F, c1, d1, e1, a1, b1, X[13], k0);
+	Subround< 9>(F, b1, c1, d1, e1, a1, X[14], k0);
+	Subround< 8>(F, a1, b1, c1, d1, e1, X[15], k0);
+
+	Subround< 7>(G, e1, a1, b1, c1, d1, X[ 7], k1);
+	Subround< 6>(G, d1, e1, a1, b1, c1, X[ 4], k1);
+	Subround< 8>(G, c1, d1, e1, a1, b1, X[13], k1);
+	Subround<13>(G, b1, c1, d1, e1, a1, X[ 1], k1);
+	Subround<11>(G, a1, b1, c1, d1, e1, X[10], k1);
+	Subround< 9>(G, e1, a1, b1, c1, d1, X[ 6], k1);
+	Subround< 7>(G, d1, e1, a1, b1, c1, X[15], k1);
+	Subround<15>(G, c1, d1, e1, a1, b1, X[ 3], k1);
+	Subround< 7>(G, b1, c1, d1, e1, a1, X[12], k1);
+	Subround<12>(G, a1, b1, c1, d1, e1, X[ 0], k1);
+	Subround<15>(G, e1, a1, b1, c1, d1, X[ 9], k1);
+	Subround< 9>(G, d1, e1, a1, b1, c1, X[ 5], k1);
+	Subround<11>(G, c1, d1, e1, a1, b1, X[ 2], k1);
+	Subround< 7>(G, b1, c1, d1, e1, a1, X[14], k1);
+	Subround<13>(G, a1, b1, c1, d1, e1, X[11], k1);
+	Subround<12>(G, e1, a1, b1, c1, d1, X[ 8], k1);
+
+	Subround<11>(H, d1, e1, a1, b1, c1, X[ 3], k2);
+	Subround<13>(H, c1, d1, e1, a1, b1, X[10], k2);
+	Subround< 6>(H, b1, c1, d1, e1, a1, X[14], k2);
+	Subround< 7>(H, a1, b1, c1, d1, e1, X[ 4], k2);
+	Subround<14>(H, e1, a1, b1, c1, d1, X[ 9], k2);
+	Subround< 9>(H, d1, e1, a1, b1, c1, X[15], k2);
+	Subround<13>(H, c1, d1, e1, a1, b1, X[ 8], k2);
+	Subround<15>(H, b1, c1, d1, e1, a1, X[ 1], k2);
+	Subround<14>(H, a1, b1, c1, d1, e1, X[ 2], k2);
+	Subround< 8>(H, e1, a1, b1, c1, d1, X[ 7], k2);
+	Subround<13>(H, d1, e1, a1, b1, c1, X[ 0], k2);
+	Subround< 6>(H, c1, d1, e1, a1, b1, X[ 6], k2);
+	Subround< 5>(H, b1, c1, d1, e1, a1, X[13], k2);
+	Subround<12>(H, a1, b1, c1, d1, e1, X[11], k2);
+	Subround< 7>(H, e1, a1, b1, c1, d1, X[ 5], k2);
+	Subround< 5>(H, d1, e1, a1, b1, c1, X[12], k2);
+
+	Subround<11>(I, c1, d1, e1, a1, b1, X[ 1], k3);
+	Subround<12>(I, b1, c1, d1, e1, a1, X[ 9], k3);
+	Subround<14>(I, a1, b1, c1, d1, e1, X[11], k3);
+	Subround<15>(I, e1, a1, b1, c1, d1, X[10], k3);
+	Subround<14>(I, d1, e1, a1, b1, c1, X[ 0], k3);
+	Subround<15>(I, c1, d1, e1, a1, b1, X[ 8], k3);
+	Subround< 9>(I, b1, c1, d1, e1, a1, X[12], k3);
+	Subround< 8>(I, a1, b1, c1, d1, e1, X[ 4], k3);
+	Subround< 9>(I, e1, a1, b1, c1, d1, X[13], k3);
+	Subround<14>(I, d1, e1, a1, b1, c1, X[ 3], k3);
+	Subround< 5>(I, c1, d1, e1, a1, b1, X[ 7], k3);
+	Subround< 6>(I, b1, c1, d1, e1, a1, X[15], k3);
+	Subround< 8>(I, a1, b1, c1, d1, e1, X[14], k3);
+	Subround< 6>(I, e1, a1, b1, c1, d1, X[ 5], k3);
+	Subround< 5>(I, d1, e1, a1, b1, c1, X[ 6], k3);
+	Subround<12>(I, c1, d1, e1, a1, b1, X[ 2], k3);
+
+	Subround< 9>(J, b1, c1, d1, e1, a1, X[ 4], k4);
+	Subround<15>(J, a1, b1, c1, d1, e1, X[ 0], k4);
+	Subround< 5>(J, e1, a1, b1, c1, d1, X[ 5], k4);
+	Subround<11>(J, d1, e1, a1, b1, c1, X[ 9], k4);
+	Subround< 6>(J, c1, d1, e1, a1, b1, X[ 7], k4);
+	Subround< 8>(J, b1, c1, d1, e1, a1, X[12], k4);
+	Subround<13>(J, a1, b1, c1, d1, e1, X[ 2], k4);
+	Subround<12>(J, e1, a1, b1, c1, d1, X[10], k4);
+	Subround< 5>(J, d1, e1, a1, b1, c1, X[14], k4);
+	Subround<12>(J, c1, d1, e1, a1, b1, X[ 1], k4);
+	Subround<13>(J, b1, c1, d1, e1, a1, X[ 3], k4);
+	Subround<14>(J, a1, b1, c1, d1, e1, X[ 8], k4);
+	Subround<11>(J, e1, a1, b1, c1, d1, X[11], k4);
+	Subround< 8>(J, d1, e1, a1, b1, c1, X[ 6], k4);
+	Subround< 5>(J, c1, d1, e1, a1, b1, X[15], k4);
+	Subround< 6>(J, b1, c1, d1, e1, a1, X[13], k4);
+
+	Subround< 8>(J, a2, b2, c2, d2, e2, X[ 5], k5);
+	Subround< 9>(J, e2, a2, b2, c2, d2, X[14], k5);
+	Subround< 9>(J, d2, e2, a2, b2, c2, X[ 7], k5);
+	Subround<11>(J, c2, d2, e2, a2, b2, X[ 0], k5);
+	Subround<13>(J, b2, c2, d2, e2, a2, X[ 9], k5);
+	Subround<15>(J, a2, b2, c2, d2, e2, X[ 2], k5);
+	Subround<15>(J, e2, a2, b2, c2, d2, X[11], k5);
+	Subround< 5>(J, d2, e2, a2, b2, c2, X[ 4], k5);
+	Subround< 7>(J, c2, d2, e2, a2, b2, X[13], k5);
+	Subround< 7>(J, b2, c2, d2, e2, a2, X[ 6], k5);
+	Subround< 8>(J, a2, b2, c2, d2, e2, X[15], k5);
+	Subround<11>(J, e2, a2, b2, c2, d2, X[ 8], k5);
+	Subround<14>(J, d2, e2, a2, b2, c2, X[ 1], k5);
+	Subround<14>(J, c2, d2, e2, a2, b2, X[10], k5);
+	Subround<12>(J, b2, c2, d2, e2, a2, X[ 3], k5);
+	Subround< 6>(J, a2, b2, c2, d2, e2, X[12], k5);
+
+	Subround< 9>(I, e2, a2, b2, c2, d2, X[ 6], k6);
+	Subround<13>(I, d2, e2, a2, b2, c2, X[11], k6);
+	Subround<15>(I, c2, d2, e2, a2, b2, X[ 3], k6);
+	Subround< 7>(I, b2, c2, d2, e2, a2, X[ 7], k6);
+	Subround<12>(I, a2, b2, c2, d2, e2, X[ 0], k6);
+	Subround< 8>(I, e2, a2, b2, c2, d2, X[13], k6);
+	Subround< 9>(I, d2, e2, a2, b2, c2, X[ 5], k6);
+	Subround<11>(I, c2, d2, e2, a2, b2, X[10], k6);
+	Subround< 7>(I, b2, c2, d2, e2, a2, X[14], k6);
+	Subround< 7>(I, a2, b2, c2, d2, e2, X[15], k6);
+	Subround<12>(I, e2, a2, b2, c2, d2, X[ 8], k6);
+	Subround< 7>(I, d2, e2, a2, b2, c2, X[12], k6);
+	Subround< 6>(I, c2, d2, e2, a2, b2, X[ 4], k6);
+	Subround<15>(I, b2, c2, d2, e2, a2, X[ 9], k6);
+	Subround<13>(I, a2, b2, c2, d2, e2, X[ 1], k6);
+	Subround<11>(I, e2, a2, b2, c2, d2, X[ 2], k6);
+
+	Subround< 9>(H, d2, e2, a2, b2, c2, X[15], k7);
+	Subround< 7>(H, c2, d2, e2, a2, b2, X[ 5], k7);
+	Subround<15>(H, b2, c2, d2, e2, a2, X[ 1], k7);
+	Subround<11>(H, a2, b2, c2, d2, e2, X[ 3], k7);
+	Subround< 8>(H, e2, a2, b2, c2, d2, X[ 7], k7);
+	Subround< 6>(H, d2, e2, a2, b2, c2, X[14], k7);
+	Subround< 6>(H, c2, d2, e2, a2, b2, X[ 6], k7);
+	Subround<14>(H, b2, c2, d2, e2, a2, X[ 9], k7);
+	Subround<12>(H, a2, b2, c2, d2, e2, X[11], k7);
+	Subround<13>(H, e2, a2, b2, c2, d2, X[ 8], k7);
+	Subround< 5>(H, d2, e2, a2, b2, c2, X[12], k7);
+	Subround<14>(H, c2, d2, e2, a2, b2, X[ 2], k7);
+	Subround<13>(H, b2, c2, d2, e2, a2, X[10], k7);
+	Subround<13>(H, a2, b2, c2, d2, e2, X[ 0], k7);
+	Subround< 7>(H, e2, a2, b2, c2, d2, X[ 4], k7);
+	Subround< 5>(H, d2, e2, a2, b2, c2, X[13], k7);
+
+	Subround<15>(G, c2, d2, e2, a2, b2, X[ 8], k8);
+	Subround< 5>(G, b2, c2, d2, e2, a2, X[ 6], k8);
+	Subround< 8>(G, a2, b2, c2, d2, e2, X[ 4], k8);
+	Subround<11>(G, e2, a2, b2, c2, d2, X[ 1], k8);
+	Subround<14>(G, d2, e2, a2, b2, c2, X[ 3], k8);
+	Subround<14>(G, c2, d2, e2, a2, b2, X[11], k8);
+	Subround< 6>(G, b2, c2, d2, e2, a2, X[15], k8);
+	Subround<14>(G, a2, b2, c2, d2, e2, X[ 0], k8);
+	Subround< 6>(G, e2, a2, b2, c2, d2, X[ 5], k8);
+	Subround< 9>(G, d2, e2, a2, b2, c2, X[12], k8);
+	Subround<12>(G, c2, d2, e2, a2, b2, X[ 2], k8);
+	Subround< 9>(G, b2, c2, d2, e2, a2, X[13], k8);
+	Subround<12>(G, a2, b2, c2, d2, e2, X[ 9], k8);
+	Subround< 5>(G, e2, a2, b2, c2, d2, X[ 7], k8);
+	Subround<15>(G, d2, e2, a2, b2, c2, X[10], k8);
+	Subround< 8>(G, c2, d2, e2, a2, b2, X[14], k8);
+
+	Subround< 8>(F, b2, c2, d2, e2, a2, X[12], k9);
+	Subround< 5>(F, a2, b2, c2, d2, e2, X[15], k9);
+	Subround<12>(F, e2, a2, b2, c2, d2, X[10], k9);
+	Subround< 9>(F, d2, e2, a2, b2, c2, X[ 4], k9);
+	Subround<12>(F, c2, d2, e2, a2, b2, X[ 1], k9);
+	Subround< 5>(F, b2, c2, d2, e2, a2, X[ 5], k9);
+	Subround<14>(F, a2, b2, c2, d2, e2, X[ 8], k9);
+	Subround< 6>(F, e2, a2, b2, c2, d2, X[ 7], k9);
+	Subround< 8>(F, d2, e2, a2, b2, c2, X[ 6], k9);
+	Subround<13>(F, c2, d2, e2, a2, b2, X[ 2], k9);
+	Subround< 6>(F, b2, c2, d2, e2, a2, X[13], k9);
+	Subround< 5>(F, a2, b2, c2, d2, e2, X[14], k9);
+	Subround<15>(F, e2, a2, b2, c2, d2, X[ 0], k9);
+	Subround<13>(F, d2, e2, a2, b2, c2, X[ 3], k9);
+	Subround<11>(F, c2, d2, e2, a2, b2, X[ 9], k9);
+	Subround<11>(F, b2, c2, d2, e2, a2, X[11], k9);
+
+	a1 -= trackA[0];
+	b1 -= trackA[1];
+	c1 -= trackA[2];
+	d1 -= trackA[3];
+	e1 -= trackA[4];
+	a2 -= trackB[0];
+	b2 -= trackB[1];
+	c2 -= trackB[2];
+	d2 -= trackB[3];
+	e2 -= trackB[4];
+
+	if (!last)
+	{
+		trackA[0] = (b1 + e1) - d2;
+		trackA[1] = c1 - e2;
+		trackA[2] = d1 - a2;
+		trackA[3] = e1 - b2;
+		trackA[4] = a1 - c2;
+		trackB[0] = d1 - e2;
+		trackB[1] = (e1 + c1) - a2;
+		trackB[2] = a1 - b2;
+		trackB[3] = b1 - c2;
+		trackB[4] = c1 - d2;
+	}
+	else
+	{
+		trackB[0] = a2 - a1;
+		trackB[1] = b2 - b1;
+		trackB[2] = c2 - c1;
+		trackB[3] = d2 - d1;
+		trackB[4] = e2 - e1;
+		trackA[0] = 0;
+		trackA[1] = 0;
+		trackA[2] = 0;
+		trackA[3] = 0;
+		trackA[4] = 0;
+	}
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/ttmac.h b/runtime/third_party/cryptopp/ttmac.h
new file mode 100644
index 0000000..9d95987
--- /dev/null
+++ b/runtime/third_party/cryptopp/ttmac.h
@@ -0,0 +1,44 @@
+// ttmac.h - written and placed in the public domain by Kevin Springle
+
+/// \file ttmac.h
+/// \brief Classes for the TTMAC message authentication code
+
+#ifndef CRYPTOPP_TTMAC_H
+#define CRYPTOPP_TTMAC_H
+
+#include "seckey.h"
+#include "iterhash.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief TTMAC message authentication code information
+class CRYPTOPP_NO_VTABLE TTMAC_Base : public FixedKeyLength<20>, public IteratedHash<word32, LittleEndian, 64, MessageAuthenticationCode>
+{
+public:
+	static std::string StaticAlgorithmName() {return std::string("Two-Track-MAC");}
+	CRYPTOPP_CONSTANT(DIGESTSIZE=20);
+
+	unsigned int DigestSize() const {return DIGESTSIZE;};
+	void UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &params);
+	void TruncatedFinal(byte *mac, size_t size);
+
+protected:
+	static void Transform (word32 *digest, const word32 *X, bool last);
+	void HashEndianCorrectedBlock(const word32 *data) {Transform(m_digest, data, false);}
+	void Init();
+	word32* StateBuf() {return m_digest;}
+
+	FixedSizeSecBlock<word32, 10> m_digest;
+	FixedSizeSecBlock<word32, 5> m_key;
+};
+
+/// \brief Two-Track-MAC message authentication code
+/// \tparam T HashTransformation class
+/// \details 160-bit MAC with 160-bit key
+/// \sa MessageAuthenticationCode(), <a href="http://www.weidai.com/scan-mirror/mac.html#TTMAC">Two-Track-MAC</a>
+DOCUMENTED_TYPEDEF(MessageAuthenticationCodeFinal<TTMAC_Base>, TTMAC);
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/tweetnacl.cpp b/runtime/third_party/cryptopp/tweetnacl.cpp
new file mode 100644
index 0000000..e12c62f
--- /dev/null
+++ b/runtime/third_party/cryptopp/tweetnacl.cpp
@@ -0,0 +1,924 @@
+// tweetnacl.cpp - modified tweetnacl.c placed in public domain by Jeffrey Walton.
+//                 The NaCl library and tweetnacl.c is public domain source code
+//                 written by Daniel J. Bernstein, Bernard van Gastel, Wesley
+//                 Janssen, Tanja Lange, Peter Schwabe and Sjaak Smetsers.
+
+#include "pch.h"
+#include "config.h"
+#include "naclite.h"
+#include "misc.h"
+#include "osrng.h"
+#include "stdcpp.h"
+
+// Don't destroy const time properties when squashing warnings.
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4146 4242 4244 4245)
+#endif
+
+// Can't use GetAlignmentOf<word32>() because of C++11 and constexpr
+// Can use 'const unsigned int' because of MSVC 2013
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+# define ALIGN_SPEC 16
+#else
+# define ALIGN_SPEC 4
+#endif
+
+#ifndef CRYPTOPP_DISABLE_NACL
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(NaCl)
+
+typedef sword64 gf[16];
+
+static const byte
+  _0[32] = {0},
+  _9[32] = {9};
+
+static const gf
+  gf0 = {0},
+  gf1 = {1},
+  _121665 = {0xDB41,1},
+  D = {0x78a3, 0x1359, 0x4dca, 0x75eb, 0xd8ab, 0x4141, 0x0a4d, 0x0070, 0xe898, 0x7779, 0x4079, 0x8cc7, 0xfe73, 0x2b6f, 0x6cee, 0x5203},
+  D2 = {0xf159, 0x26b2, 0x9b94, 0xebd6, 0xb156, 0x8283, 0x149a, 0x00e0, 0xd130, 0xeef3, 0x80f2, 0x198e, 0xfce7, 0x56df, 0xd9dc, 0x2406},
+  X = {0xd51a, 0x8f25, 0x2d60, 0xc956, 0xa7b2, 0x9525, 0xc760, 0x692c, 0xdc5c, 0xfdd6, 0xe231, 0xc0a4, 0x53fe, 0xcd6e, 0x36d3, 0x2169},
+  Y = {0x6658, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666},
+  I = {0xa0b0, 0x4a0e, 0x1b27, 0xc4ee, 0xe478, 0xad2f, 0x1806, 0x2f43, 0xd7a7, 0x3dfb, 0x0099, 0x2b4d, 0xdf0b, 0x4fc1, 0x2480, 0x2b83};
+
+// Added by Crypto++ for TweetNaCl
+static void randombytes(byte * block, word64 size)
+{
+    DefaultAutoSeededRNG prng;
+    prng.GenerateBlock(block, (size_t)size);
+}
+
+static word32 L32(word32 x,int c) { return (x << c) | ((x&0xffffffff) >> (32 - c)); }
+
+static word32 ld32(const byte *x)
+{
+  word32 u = x[3];
+  u = (u<<8)|x[2];
+  u = (u<<8)|x[1];
+  return (u<<8)|x[0];
+}
+
+static word64 dl64(const byte *x)
+{
+  word64 i,u=0;
+  for(i=0; i<8; ++i) u=(u<<8)|x[i];
+  return u;
+}
+
+static void st32(byte *x,word32 u)
+{
+  int i;
+  for(i=0; i<4; ++i) { x[i] = u; u >>= 8; }
+}
+
+static void ts64(byte *x,word64 u)
+{
+  int i;
+  for (i = 7;i >= 0;--i) { x[i] = u; u >>= 8; }
+}
+
+// Extra cast due to Coverity CID 186949
+static int verify_n(const byte *x,const byte *y,word32 n)
+{
+  word32 i,d = 0;
+  for(i=0; i<n; ++i) d |= x[i]^y[i];
+  const sword32 v = (sword32) d;
+  return (1 & ((word32)(v - 1) >> 8)) - 1;
+}
+
+int crypto_verify_16(const byte *x,const byte *y)
+{
+  return verify_n(x,y,16);
+}
+
+int crypto_verify_32(const byte *x,const byte *y)
+{
+  return verify_n(x,y,32);
+}
+
+static void core(byte *out,const byte *in,const byte *k,const byte *c,int h)
+{
+  word32 w[16],x[16],y[16],t[4];
+  int i,j,m;
+
+  for(i=0; i<4; ++i) {
+    x[5*i] = ld32(c+4*i);
+    x[1+i] = ld32(k+4*i);
+    x[6+i] = ld32(in+4*i);
+    x[11+i] = ld32(k+16+4*i);
+  }
+
+  for(i=0; i<16; ++i) y[i] = x[i];
+
+  for(i=0; i<20; ++i) {
+    for(j=0; j<4; ++j) {
+      for(m=0; m<4; ++m) t[m] = x[(5*j+4*m)%16];
+      t[1] ^= L32(t[0]+t[3], 7);
+      t[2] ^= L32(t[1]+t[0], 9);
+      t[3] ^= L32(t[2]+t[1],13);
+      t[0] ^= L32(t[3]+t[2],18);
+      for(m=0; m<4; ++m) w[4*j+(j+m)%4] = t[m];
+    }
+    for(m=0; m<16; ++m) x[m] = w[m];
+  }
+
+  if (h) {
+    for(i=0; i<16; ++i) x[i] += y[i];
+    for(i=0; i<4; ++i) {
+      x[5*i] -= ld32(c+4*i);
+      x[6+i] -= ld32(in+4*i);
+    }
+    for(i=0; i<4; ++i) {
+      st32(out+4*i,x[5*i]);
+      st32(out+16+4*i,x[6+i]);
+    }
+  } else
+    for(i=0; i<16; ++i) st32(out + 4 * i,x[i] + y[i]);
+}
+
+int crypto_core_salsa20(byte *out,const byte *in,const byte *k,const byte *c)
+{
+  core(out,in,k,c,0);
+  return 0;
+}
+
+int crypto_core_hsalsa20(byte *out,const byte *in,const byte *k,const byte *c)
+{
+  core(out,in,k,c,1);
+  return 0;
+}
+
+static const byte sigma[16] = {0x65,0x78,0x70,0x61,0x6E,0x64,0x20,0x33,0x32,0x2D,0x62,0x79,0x74,0x65,0x20,0x6B};
+
+int crypto_stream_salsa20_xor(byte *c,const byte *m,word64 b,const byte *n,const byte *k)
+{
+  byte z[16],x[64];
+  word32 u,i;
+  if (!b) return 0;
+  for(i=0; i<16; ++i) z[i] = 0;
+  for(i=0; i<8; ++i) z[i] = n[i];
+  while (b >= 64) {
+    crypto_core_salsa20(x,z,k,sigma);
+    for(i=0; i<64; ++i) c[i] = (m?m[i]:0) ^ x[i];
+    u = 1;
+    for (i = 8;i < 16;++i) {
+      u += (word32) z[i];
+      z[i] = u;
+      u >>= 8;
+    }
+    b -= 64;
+    c += 64;
+    if (m) m += 64;
+  }
+  if (b) {
+    crypto_core_salsa20(x,z,k,sigma);
+    for(i=0; i<b; ++i) c[i] = (m?m[i]:0) ^ x[i];
+  }
+  return 0;
+}
+
+int crypto_stream_salsa20(byte *c,word64 d,const byte *n,const byte *k)
+{
+  return crypto_stream_salsa20_xor(c,0,d,n,k);
+}
+
+int crypto_stream(byte *c,word64 d,const byte *n,const byte *k)
+{
+  byte s[32];
+  crypto_core_hsalsa20(s,n,k,sigma);
+  return crypto_stream_salsa20(c,d,n+16,s);
+}
+
+int crypto_stream_xor(byte *c,const byte *m,word64 d,const byte *n,const byte *k)
+{
+  byte s[32];
+  crypto_core_hsalsa20(s,n,k,sigma);
+  return crypto_stream_salsa20_xor(c,m,d,n+16,s);
+}
+
+static void add1305(word32 *h,const word32 *c)
+{
+  word32 j,u = 0;
+  for(j=0; j<17; ++j) {
+    u += h[j] + c[j];
+    h[j] = u & 255;
+    u >>= 8;
+  }
+}
+
+static const word32 minusp[17] = {
+  5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 252
+} ;
+
+int crypto_onetimeauth(byte *out,const byte *m,word64 n,const byte *k)
+{
+  word32 s,i,j,u,x[17],r[17],h[17],c[17],g[17];
+
+  for(j=0; j<17; ++j) r[j]=h[j]=0;
+  for(j=0; j<16; ++j) r[j]=k[j];
+  r[3]&=15;
+  r[4]&=252;
+  r[7]&=15;
+  r[8]&=252;
+  r[11]&=15;
+  r[12]&=252;
+  r[15]&=15;
+
+  while (n > 0) {
+    for(j=0; j<17; ++j) c[j] = 0;
+    for (j = 0;(j < 16) && (j < n);++j) c[j] = m[j];
+    c[j] = 1;
+    m += j; n -= j;
+    add1305(h,c);
+    for(i=0; i<17; ++i) {
+      x[i] = 0;
+      for(j=0; j<17; ++j) x[i] += h[j] * ((j <= i) ? r[i - j] : 320 * r[i + 17 - j]);
+    }
+    for(i=0; i<17; ++i) h[i] = x[i];
+    u = 0;
+    for(j=0; j<16; ++j) {
+      u += h[j];
+      h[j] = u & 255;
+      u >>= 8;
+    }
+    u += h[16]; h[16] = u & 3;
+    u = 5 * (u >> 2);
+    for(j=0; j<16; ++j) {
+      u += h[j];
+      h[j] = u & 255;
+      u >>= 8;
+    }
+    u += h[16]; h[16] = u;
+  }
+
+  for(j=0; j<17; ++j) g[j] = h[j];
+  add1305(h,minusp);
+  s = -(h[16] >> 7);
+  for(j=0; j<17; ++j) h[j] ^= s & (g[j] ^ h[j]);
+
+  for(j=0; j<16; ++j) c[j] = k[j + 16];
+  c[16] = 0;
+  add1305(h,c);
+  for(j=0; j<16; ++j) out[j] = h[j];
+  return 0;
+}
+
+int crypto_onetimeauth_verify(const byte *h,const byte *m,word64 n,const byte *k)
+{
+  byte x[16];
+  crypto_onetimeauth(x,m,n,k);
+  return crypto_verify_16(h,x);
+}
+
+int crypto_secretbox(byte *c,const byte *m,word64 d,const byte *n,const byte *k)
+{
+  int i;
+  if (d < 32) return -1;
+  crypto_stream_xor(c,m,d,n,k);
+  crypto_onetimeauth(c + 16,c + 32,d - 32,c);
+  for(i=0; i<16; ++i) c[i] = 0;
+  return 0;
+}
+
+int crypto_secretbox_open(byte *m,const byte *c,word64 d,const byte *n,const byte *k)
+{
+  int i;
+  byte x[32];
+  if (d < 32) return -1;
+  crypto_stream(x,32,n,k);
+  if (crypto_onetimeauth_verify(c + 16,c + 32,d - 32,x) != 0) return -1;
+  crypto_stream_xor(m,c,d,n,k);
+  for(i=0; i<32; ++i) m[i] = 0;
+  return 0;
+}
+
+static void set25519(gf r, const gf a)
+{
+  int i;
+  for(i=0; i<16; ++i) r[i]=a[i];
+}
+
+static void car25519(gf o)
+{
+  int i;
+  sword64 c;
+  for(i=0; i<16; ++i) {
+    o[i]+=(1LL<<16);
+    c=o[i]>>16;
+    o[(i+1)*(i<15)]+=c-1+37*(c-1)*(i==15);
+    o[i]-=((word64)c)<<16;
+  }
+}
+
+static void sel25519(gf p,gf q,int b)
+{
+  sword64 t,i,c=~(b-1);
+  for(i=0; i<16; ++i) {
+    t= c&(p[i]^q[i]);
+    p[i]^=t;
+    q[i]^=t;
+  }
+}
+
+static void pack25519(byte *o,const gf n)
+{
+  int i,j,b;
+  gf m,t;
+  for(i=0; i<16; ++i) t[i]=n[i];
+  car25519(t);
+  car25519(t);
+  car25519(t);
+  for(j=0; j<2; ++j) {
+    m[0]=t[0]-0xffed;
+    for(i=1;i<15;i++) {
+      m[i]=t[i]-0xffff-((m[i-1]>>16)&1);
+      m[i-1]&=0xffff;
+    }
+    m[15]=t[15]-0x7fff-((m[14]>>16)&1);
+    b=(m[15]>>16)&1;
+    m[14]&=0xffff;
+    sel25519(t,m,1-b);
+  }
+  for(i=0; i<16; ++i) {
+    o[2*i]=t[i]&0xff;
+    o[2*i+1]=t[i]>>8;
+  }
+}
+
+static int neq25519(const gf a, const gf b)
+{
+  byte c[32],d[32];
+  pack25519(c,a);
+  pack25519(d,b);
+  return crypto_verify_32(c,d);
+}
+
+static byte par25519(const gf a)
+{
+  byte d[32];
+  pack25519(d,a);
+  return d[0]&1;
+}
+
+static void unpack25519(gf o, const byte *n)
+{
+  int i;
+  for(i=0; i<16; ++i) o[i]=n[2*i]+((sword64)n[2*i+1]<<8);
+  o[15]&=0x7fff;
+}
+
+static void A(gf o,const gf a,const gf b)
+{
+  int i;
+  for(i=0; i<16; ++i) o[i]=a[i]+b[i];
+}
+
+static void Z(gf o,const gf a,const gf b)
+{
+  int i;
+  for(i=0; i<16; ++i) o[i]=a[i]-b[i];
+}
+
+static void M(gf o,const gf a,const gf b)
+{
+  sword64 i,j,t[31];
+  for(i=0; i<31; ++i) t[i]=0;
+  for(i=0; i<16; ++i) for(j=0; j<16; ++j) t[i+j]+=a[i]*b[j];
+  for(i=0; i<15; ++i) t[i]+=38*t[i+16];
+  for(i=0; i<16; ++i) o[i]=t[i];
+  car25519(o);
+  car25519(o);
+}
+
+static void S(gf o,const gf a)
+{
+  M(o,a,a);
+}
+
+static void inv25519(gf o,const gf i)
+{
+  gf c;
+  int a;
+  for(a=0; a<16; ++a) c[a]=i[a];
+  for(a=253;a>=0;a--) {
+    S(c,c);
+    if(a!=2&&a!=4) M(c,c,i);
+  }
+  for(a=0; a<16; ++a) o[a]=c[a];
+}
+
+static void pow2523(gf o,const gf i)
+{
+  gf c;
+  int a;
+  for(a=0; a<16; ++a) c[a]=i[a];
+  for(a=250;a>=0;a--) {
+    S(c,c);
+    if(a!=1) M(c,c,i);
+  }
+  for(a=0; a<16; ++a) o[a]=c[a];
+}
+
+// https://github.com/jedisct1/libsodium/blob/master/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c
+static int has_small_order(const byte s[32])
+{
+  CRYPTOPP_ALIGN_DATA(ALIGN_SPEC)
+  const byte blacklist[][32] = {
+    { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+    { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+    { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a, 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 },
+    { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24, 0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b, 0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86, 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 },
+    { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+    { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+    { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+    { 0xcd, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a, 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x80 },
+    { 0x4c, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24, 0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b, 0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86, 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0xd7 },
+    { 0xd9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+    { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+    { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }
+  };
+  CRYPTOPP_COMPILE_ASSERT(12 == COUNTOF(blacklist));
+
+  byte c[12] = { 0 };
+  for (size_t j = 0; j < 32; j++) {
+    for (size_t i = 0; i < COUNTOF(blacklist); i++) {
+      c[i] |= s[j] ^ blacklist[i][j];
+    }
+  }
+
+  unsigned int k = 0;
+  for (size_t i = 0; i < COUNTOF(blacklist); i++) {
+    k |= (c[i] - 1);
+  }
+
+  return (int) ((k >> 8) & 1);
+}
+
+int crypto_scalarmult(byte *q,const byte *n,const byte *p)
+{
+  byte z[32];
+  sword64 x[80],r,i;
+  gf a,b,c,d,e,f;
+  for(i=0; i<31; ++i) z[i]=n[i];
+  z[31]=(n[31]&127)|64;
+  z[0]&=248;
+  unpack25519(x,p);
+  for(i=0; i<16; ++i) {
+    b[i]=x[i];
+    d[i]=a[i]=c[i]=0;
+  }
+  a[0]=d[0]=1;
+  for(i=254;i>=0;--i) {
+    r=(z[i>>3]>>(i&7))&1;
+    sel25519(a,b,r);
+    sel25519(c,d,r);
+    A(e,a,c);
+    Z(a,a,c);
+    A(c,b,d);
+    Z(b,b,d);
+    S(d,e);
+    S(f,a);
+    M(a,c,a);
+    M(c,b,e);
+    A(e,a,c);
+    Z(a,a,c);
+    S(b,a);
+    Z(c,d,f);
+    M(a,c,_121665);
+    A(a,a,d);
+    M(c,c,a);
+    M(a,d,f);
+    M(d,b,x);
+    S(b,e);
+    sel25519(a,b,r);
+    sel25519(c,d,r);
+  }
+  for(i=0; i<16; ++i) {
+    x[i+16]=a[i];
+    x[i+32]=c[i];
+    x[i+48]=b[i];
+    x[i+64]=d[i];
+  }
+  inv25519(x+32,x+32);
+  M(x+16,x+16,x+32);
+  pack25519(q,x+16);
+  return 0;
+}
+
+int crypto_scalarmult_base(byte *q,const byte *n)
+{
+  return crypto_scalarmult(q,n,_9);
+}
+
+int crypto_box_keypair(byte *y,byte *x)
+{
+  randombytes(x,32);
+  return crypto_scalarmult_base(y,x);
+}
+
+// Avoid small order elements. Also see https://eprint.iacr.org/2017/806.pdf
+// and https://github.com/jedisct1/libsodium/commit/675149b9b8b66ff4.
+int crypto_box_beforenm(byte *k,const byte *y,const byte *x)
+{
+  byte s[32];
+  if(crypto_scalarmult(s,x,y) != 0) return -1;
+  if(has_small_order(s) != 0) return -1;
+  return crypto_core_hsalsa20(k,_0,s,sigma);
+}
+
+// Allow small order elements. Also see https://eprint.iacr.org/2017/806.pdf
+int crypto_box_beforenm_unchecked(byte *k,const byte *y,const byte *x)
+{
+  byte s[32];
+  if(crypto_scalarmult(s,x,y) != 0) return -1;
+  return crypto_core_hsalsa20(k,_0,s,sigma);
+}
+
+int crypto_box_afternm(byte *c,const byte *m,word64 d,const byte *n,const byte *k)
+{
+  return crypto_secretbox(c,m,d,n,k);
+}
+
+int crypto_box_open_afternm(byte *m,const byte *c,word64 d,const byte *n,const byte *k)
+{
+  return crypto_secretbox_open(m,c,d,n,k);
+}
+
+int crypto_box(byte *c, const byte *m, word64 d, const byte *n, const byte *y, const byte *x)
+{
+  byte k[32];
+  if (crypto_box_beforenm(k, y, x) != 0) return -1;
+  return crypto_box_afternm(c, m, d, n, k);
+}
+
+int crypto_box_unchecked(byte *c, const byte *m, word64 d, const byte *n, const byte *y, const byte *x)
+{
+  byte k[32];
+  crypto_box_beforenm_unchecked(k, y, x);
+  return crypto_box_afternm(c, m, d, n, k);
+}
+
+int crypto_box_open(byte *m,const byte *c,word64 d,const byte *n,const byte *y,const byte *x)
+{
+  byte k[32];
+  if(crypto_box_beforenm(k,y,x) != 0) return -1;
+  return crypto_box_open_afternm(m,c,d,n,k);
+}
+
+int crypto_box_open_unchecked(byte *m,const byte *c,word64 d,const byte *n,const byte *y,const byte *x)
+{
+  byte k[32];
+  crypto_box_beforenm_unchecked(k,y,x);
+  return crypto_box_open_afternm(m,c,d,n,k);
+}
+
+static word64 R(word64 x,int c) { return (x >> c) | (x << (64 - c)); }
+static word64 Ch(word64 x,word64 y,word64 z) { return (x & y) ^ (~x & z); }
+static word64 Maj(word64 x,word64 y,word64 z) { return (x & y) ^ (x & z) ^ (y & z); }
+static word64 Sigma0(word64 x) { return R(x,28) ^ R(x,34) ^ R(x,39); }
+static word64 Sigma1(word64 x) { return R(x,14) ^ R(x,18) ^ R(x,41); }
+static word64 sigma0(word64 x) { return R(x, 1) ^ R(x, 8) ^ (x >> 7); }
+static word64 sigma1(word64 x) { return R(x,19) ^ R(x,61) ^ (x >> 6); }
+
+static const word64 K[80] =
+{
+  W64LIT(0x428a2f98d728ae22), W64LIT(0x7137449123ef65cd), W64LIT(0xb5c0fbcfec4d3b2f), W64LIT(0xe9b5dba58189dbbc),
+  W64LIT(0x3956c25bf348b538), W64LIT(0x59f111f1b605d019), W64LIT(0x923f82a4af194f9b), W64LIT(0xab1c5ed5da6d8118),
+  W64LIT(0xd807aa98a3030242), W64LIT(0x12835b0145706fbe), W64LIT(0x243185be4ee4b28c), W64LIT(0x550c7dc3d5ffb4e2),
+  W64LIT(0x72be5d74f27b896f), W64LIT(0x80deb1fe3b1696b1), W64LIT(0x9bdc06a725c71235), W64LIT(0xc19bf174cf692694),
+  W64LIT(0xe49b69c19ef14ad2), W64LIT(0xefbe4786384f25e3), W64LIT(0x0fc19dc68b8cd5b5), W64LIT(0x240ca1cc77ac9c65),
+  W64LIT(0x2de92c6f592b0275), W64LIT(0x4a7484aa6ea6e483), W64LIT(0x5cb0a9dcbd41fbd4), W64LIT(0x76f988da831153b5),
+  W64LIT(0x983e5152ee66dfab), W64LIT(0xa831c66d2db43210), W64LIT(0xb00327c898fb213f), W64LIT(0xbf597fc7beef0ee4),
+  W64LIT(0xc6e00bf33da88fc2), W64LIT(0xd5a79147930aa725), W64LIT(0x06ca6351e003826f), W64LIT(0x142929670a0e6e70),
+  W64LIT(0x27b70a8546d22ffc), W64LIT(0x2e1b21385c26c926), W64LIT(0x4d2c6dfc5ac42aed), W64LIT(0x53380d139d95b3df),
+  W64LIT(0x650a73548baf63de), W64LIT(0x766a0abb3c77b2a8), W64LIT(0x81c2c92e47edaee6), W64LIT(0x92722c851482353b),
+  W64LIT(0xa2bfe8a14cf10364), W64LIT(0xa81a664bbc423001), W64LIT(0xc24b8b70d0f89791), W64LIT(0xc76c51a30654be30),
+  W64LIT(0xd192e819d6ef5218), W64LIT(0xd69906245565a910), W64LIT(0xf40e35855771202a), W64LIT(0x106aa07032bbd1b8),
+  W64LIT(0x19a4c116b8d2d0c8), W64LIT(0x1e376c085141ab53), W64LIT(0x2748774cdf8eeb99), W64LIT(0x34b0bcb5e19b48a8),
+  W64LIT(0x391c0cb3c5c95a63), W64LIT(0x4ed8aa4ae3418acb), W64LIT(0x5b9cca4f7763e373), W64LIT(0x682e6ff3d6b2b8a3),
+  W64LIT(0x748f82ee5defb2fc), W64LIT(0x78a5636f43172f60), W64LIT(0x84c87814a1f0ab72), W64LIT(0x8cc702081a6439ec),
+  W64LIT(0x90befffa23631e28), W64LIT(0xa4506cebde82bde9), W64LIT(0xbef9a3f7b2c67915), W64LIT(0xc67178f2e372532b),
+  W64LIT(0xca273eceea26619c), W64LIT(0xd186b8c721c0c207), W64LIT(0xeada7dd6cde0eb1e), W64LIT(0xf57d4f7fee6ed178),
+  W64LIT(0x06f067aa72176fba), W64LIT(0x0a637dc5a2c898a6), W64LIT(0x113f9804bef90dae), W64LIT(0x1b710b35131c471b),
+  W64LIT(0x28db77f523047d84), W64LIT(0x32caab7b40c72493), W64LIT(0x3c9ebe0a15c9bebc), W64LIT(0x431d67c49c100d4c),
+  W64LIT(0x4cc5d4becb3e42b6), W64LIT(0x597f299cfc657e2a), W64LIT(0x5fcb6fab3ad6faec), W64LIT(0x6c44198c4a475817)
+};
+
+int crypto_hashblocks(byte *x,const byte *m,word64 n)
+{
+  word64 z[8],b[8],a[8],w[16],t;
+  int i,j;
+
+  for(i=0; i<8; ++i) z[i] = a[i] = dl64(x + 8 * i);
+
+  while (n >= 128) {
+    for(i=0; i<16; ++i) w[i] = dl64(m + 8 * i);
+
+    for(i=0; i<80; ++i) {
+      for(j=0; j<8; ++j) b[j] = a[j];
+      t = a[7] + Sigma1(a[4]) + Ch(a[4],a[5],a[6]) + K[i] + w[i%16];
+      b[7] = t + Sigma0(a[0]) + Maj(a[0],a[1],a[2]);
+      b[3] += t;
+      for(j=0; j<8; ++j) a[(j+1)%8] = b[j];
+      if (i%16 == 15)
+        for(j=0; j<16; ++j)
+          w[j] += w[(j+9)%16] + sigma0(w[(j+1)%16]) + sigma1(w[(j+14)%16]);
+    }
+
+    for(i=0; i<8; ++i) { a[i] += z[i]; z[i] = a[i]; }
+
+    m += 128;
+    n -= 128;
+  }
+
+  for(i=0; i<8; ++i) ts64(x+8*i,z[i]);
+
+  return n;
+}
+
+static const byte iv[64] = {
+  0x6a,0x09,0xe6,0x67,0xf3,0xbc,0xc9,0x08,
+  0xbb,0x67,0xae,0x85,0x84,0xca,0xa7,0x3b,
+  0x3c,0x6e,0xf3,0x72,0xfe,0x94,0xf8,0x2b,
+  0xa5,0x4f,0xf5,0x3a,0x5f,0x1d,0x36,0xf1,
+  0x51,0x0e,0x52,0x7f,0xad,0xe6,0x82,0xd1,
+  0x9b,0x05,0x68,0x8c,0x2b,0x3e,0x6c,0x1f,
+  0x1f,0x83,0xd9,0xab,0xfb,0x41,0xbd,0x6b,
+  0x5b,0xe0,0xcd,0x19,0x13,0x7e,0x21,0x79
+} ;
+
+int crypto_hash(byte *out,const byte *m,word64 n)
+{
+  byte h[64],x[256];
+  word64 i,b = n;
+
+  for(i=0; i<64; ++i) h[i] = iv[i];
+
+  crypto_hashblocks(h,m,n);
+  m += n;
+  n &= 127;
+  m -= n;
+
+  for(i=0; i<256; ++i) x[i] = 0;
+  for(i=0; i<n; ++i) x[i] = m[i];
+  x[n] = 128;
+
+  n = 256-128*(n<112);
+  x[n-9] = b >> 61;
+  ts64(x+n-8,b<<3);
+  crypto_hashblocks(h,x,n);
+
+  for(i=0; i<64; ++i) out[i] = h[i];
+
+  return 0;
+}
+
+static void add(gf p[4],gf q[4])
+{
+  gf a,b,c,d,t,e,f,g,h;
+
+  Z(a, p[1], p[0]);
+  Z(t, q[1], q[0]);
+  M(a, a, t);
+  A(b, p[0], p[1]);
+  A(t, q[0], q[1]);
+  M(b, b, t);
+  M(c, p[3], q[3]);
+  M(c, c, D2);
+  M(d, p[2], q[2]);
+  A(d, d, d);
+  Z(e, b, a);
+  Z(f, d, c);
+  A(g, d, c);
+  A(h, b, a);
+
+  M(p[0], e, f);
+  M(p[1], h, g);
+  M(p[2], g, f);
+  M(p[3], e, h);
+}
+
+static void cswap(gf p[4],gf q[4],byte b)
+{
+  int i;
+  for(i=0; i<4; ++i)
+    sel25519(p[i],q[i],b);
+}
+
+static void pack(byte *r,gf p[4])
+{
+  gf tx, ty, zi;
+  inv25519(zi, p[2]);
+  M(tx, p[0], zi);
+  M(ty, p[1], zi);
+  pack25519(r, ty);
+  r[31] ^= par25519(tx) << 7;
+}
+
+static void scalarmult(gf p[4],gf q[4],const byte *s)
+{
+  int i;
+  set25519(p[0],gf0);
+  set25519(p[1],gf1);
+  set25519(p[2],gf1);
+  set25519(p[3],gf0);
+  for (i = 255;i >= 0;--i) {
+    byte b = (s[i/8]>>(i&7))&1;
+    cswap(p,q,b);
+    add(q,p);
+    add(p,p);
+    cswap(p,q,b);
+  }
+}
+
+static void scalarbase(gf p[4],const byte *s)
+{
+  gf q[4];
+  set25519(q[0],X);
+  set25519(q[1],Y);
+  set25519(q[2],gf1);
+  M(q[3],X,Y);
+  scalarmult(p,q,s);
+}
+
+int crypto_sign_keypair(byte *pk, byte *sk)
+{
+  byte d[64];
+  gf p[4];
+  int i;
+
+  randombytes(sk, 32);
+  crypto_hash(d, sk, 32);
+  d[0] &= 248;
+  d[31] &= 127;
+  d[31] |= 64;
+
+  scalarbase(p,d);
+  pack(pk,p);
+
+  for(i=0; i<32; ++i) sk[32 + i] = pk[i];
+  return 0;
+}
+
+int crypto_sign_sk2pk(byte *pk, const byte *sk)
+{
+  byte d[64];
+  gf p[4];
+  // int i;
+
+  // randombytes(sk, 32);
+  crypto_hash(d, sk, 32);
+  d[0] &= 248;
+  d[31] &= 127;
+  d[31] |= 64;
+
+  scalarbase(p,d);
+  pack(pk,p);
+
+  // for(i=0; i<32; ++i) sk[32 + i] = pk[i];
+  return 0;
+}
+
+static const word64 L[32] = {0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x10};
+
+static void modL(byte *r,sword64 x[64])
+{
+  sword64 carry,i,j;
+  for (i = 63;i >= 32;--i) {
+    carry = 0;
+    for (j = i - 32;j < i - 12;++j) {
+      x[j] += carry - 16 * x[i] * L[j - (i - 32)];
+      carry = (x[j] + 128) >> 8;
+      x[j] -= ((word64)carry) << 8;
+    }
+    x[j] += carry;
+    x[i] = 0;
+  }
+  carry = 0;
+  for(j=0; j<32; ++j) {
+    x[j] += carry - (x[31] >> 4) * L[j];
+    carry = x[j] >> 8;
+    x[j] &= 255;
+  }
+  for(j=0; j<32; ++j) x[j] -= carry * L[j];
+  for(i=0; i<32; ++i) {
+    x[i+1] += x[i] >> 8;
+    r[i] = x[i] & 255;
+  }
+}
+
+static void reduce(byte *r)
+{
+  sword64 x[64],i;
+  for(i=0; i<64; ++i) x[i] = (word64) r[i];
+  for(i=0; i<64; ++i) r[i] = 0;
+  modL(r,x);
+}
+
+int crypto_sign(byte *sm,word64 *smlen,const byte *m,word64 n,const byte *sk)
+{
+  byte d[64],h[64],r[64];
+  word64 i; sword64 j,x[64];
+  gf p[4];
+
+  crypto_hash(d, sk, 32);
+  d[0] &= 248;
+  d[31] &= 127;
+  d[31] |= 64;
+
+  *smlen = n+64;
+  for(i=0; i<n; ++i) sm[64 + i] = m[i];
+  for(i=0; i<32; ++i) sm[32 + i] = d[32 + i];
+
+  crypto_hash(r, sm+32, n+32);
+  reduce(r);
+  scalarbase(p,r);
+  pack(sm,p);
+
+  for(i=0; i<32; ++i) sm[i+32] = sk[i+32];
+  crypto_hash(h,sm,n + 64);
+  reduce(h);
+
+  for(i=0; i<64; ++i) x[i] = 0;
+  for(i=0; i<32; ++i) x[i] = (word64) r[i];
+  for(i=0; i<32; ++i) for(j=0; j<32; ++j) x[i+j] += h[i] * (word64) d[j];
+  modL(sm + 32,x);
+
+  return 0;
+}
+
+static int unpackneg(gf r[4],const byte p[32])
+{
+  gf t, chk, num, den, den2, den4, den6;
+  set25519(r[2],gf1);
+  unpack25519(r[1],p);
+  S(num,r[1]);
+  M(den,num,D);
+  Z(num,num,r[2]);
+  A(den,r[2],den);
+
+  S(den2,den);
+  S(den4,den2);
+  M(den6,den4,den2);
+  M(t,den6,num);
+  M(t,t,den);
+
+  pow2523(t,t);
+  M(t,t,num);
+  M(t,t,den);
+  M(t,t,den);
+  M(r[0],t,den);
+
+  S(chk,r[0]);
+  M(chk,chk,den);
+  if (neq25519(chk, num)) M(r[0],r[0],I);
+
+  S(chk,r[0]);
+  M(chk,chk,den);
+  if (neq25519(chk, num)) return -1;
+
+  if (par25519(r[0]) == (p[31]>>7)) Z(r[0],gf0,r[0]);
+
+  M(r[3],r[0],r[1]);
+  return 0;
+}
+
+int crypto_sign_open(byte *m,word64 *mlen,const byte *sm,word64 n,const byte *pk)
+{
+  word32 i;
+  byte t[32],h[64];
+  gf p[4],q[4];
+
+  *mlen = ~W64LIT(0);
+  if (n < 64) return -1;
+
+  if (unpackneg(q,pk)) return -1;
+
+  for(i=0; i<n; ++i) m[i] = sm[i];
+  for(i=0; i<32; ++i) m[i+32] = pk[i];
+  crypto_hash(h,m,n);
+  reduce(h);
+  scalarmult(p,q,h);
+
+  scalarbase(q,sm + 32);
+  add(p,q);
+  pack(t,p);
+
+  n -= 64;
+  if (crypto_verify_32(sm, t)) {
+    for(i=0; i<n; ++i) m[i] = 0;
+    return -1;
+  }
+
+  for(i=0; i<n; ++i) m[i] = sm[i + 64];
+  *mlen = n;
+  return 0;
+}
+
+NAMESPACE_END  // CryptoPP
+NAMESPACE_END  // NaCl
+
+#endif  // NO_OS_DEPENDENCE
diff --git a/runtime/third_party/cryptopp/tweetnacl.h b/runtime/third_party/cryptopp/tweetnacl.h
new file mode 100644
index 0000000..beafb75
--- /dev/null
+++ b/runtime/third_party/cryptopp/tweetnacl.h
@@ -0,0 +1,281 @@
+// tweetnacl.h - written and placed in the public domain by Jeffrey Walton
+
+/// \file nr.h
+/// \brief Declarations for Bernstein's TweetNaCL
+/// \details TweetNaCL is used to cross-validate the library's implementations.
+///  The implementation itself is not optimized and kind of amusing. However
+///  it serves a valuable purpose for cross-validation.
+/// \details Don't use this in production.
+
+#ifndef TWEETNACL_H
+#define TWEETNACL_H
+#define crypto_auth_PRIMITIVE "hmacsha512256"
+#define crypto_auth crypto_auth_hmacsha512256
+#define crypto_auth_verify crypto_auth_hmacsha512256_verify
+#define crypto_auth_BYTES crypto_auth_hmacsha512256_BYTES
+#define crypto_auth_KEYBYTES crypto_auth_hmacsha512256_KEYBYTES
+#define crypto_auth_IMPLEMENTATION crypto_auth_hmacsha512256_IMPLEMENTATION
+#define crypto_auth_VERSION crypto_auth_hmacsha512256_VERSION
+#define crypto_auth_hmacsha512256_tweet_BYTES 32
+#define crypto_auth_hmacsha512256_tweet_KEYBYTES 32
+extern int crypto_auth_hmacsha512256_tweet(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *);
+extern int crypto_auth_hmacsha512256_tweet_verify(const unsigned char *,const unsigned char *,unsigned long long,const unsigned char *);
+#define crypto_auth_hmacsha512256_tweet_VERSION "-"
+#define crypto_auth_hmacsha512256 crypto_auth_hmacsha512256_tweet
+#define crypto_auth_hmacsha512256_verify crypto_auth_hmacsha512256_tweet_verify
+#define crypto_auth_hmacsha512256_BYTES crypto_auth_hmacsha512256_tweet_BYTES
+#define crypto_auth_hmacsha512256_KEYBYTES crypto_auth_hmacsha512256_tweet_KEYBYTES
+#define crypto_auth_hmacsha512256_VERSION crypto_auth_hmacsha512256_tweet_VERSION
+#define crypto_auth_hmacsha512256_IMPLEMENTATION "crypto_auth/hmacsha512256/tweet"
+#define crypto_box_PRIMITIVE "curve25519xsalsa20poly1305"
+#define crypto_box crypto_box_curve25519xsalsa20poly1305
+#define crypto_box_open crypto_box_curve25519xsalsa20poly1305_open
+#define crypto_box_keypair crypto_box_curve25519xsalsa20poly1305_keypair
+#define crypto_box_beforenm crypto_box_curve25519xsalsa20poly1305_beforenm
+#define crypto_box_afternm crypto_box_curve25519xsalsa20poly1305_afternm
+#define crypto_box_open_afternm crypto_box_curve25519xsalsa20poly1305_open_afternm
+#define crypto_box_PUBLICKEYBYTES crypto_box_curve25519xsalsa20poly1305_PUBLICKEYBYTES
+#define crypto_box_SECRETKEYBYTES crypto_box_curve25519xsalsa20poly1305_SECRETKEYBYTES
+#define crypto_box_BEFORENMBYTES crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES
+#define crypto_box_NONCEBYTES crypto_box_curve25519xsalsa20poly1305_NONCEBYTES
+#define crypto_box_ZEROBYTES crypto_box_curve25519xsalsa20poly1305_ZEROBYTES
+#define crypto_box_BOXZEROBYTES crypto_box_curve25519xsalsa20poly1305_BOXZEROBYTES
+#define crypto_box_IMPLEMENTATION crypto_box_curve25519xsalsa20poly1305_IMPLEMENTATION
+#define crypto_box_VERSION crypto_box_curve25519xsalsa20poly1305_VERSION
+#define crypto_box_curve25519xsalsa20poly1305_tweet_PUBLICKEYBYTES 32
+#define crypto_box_curve25519xsalsa20poly1305_tweet_SECRETKEYBYTES 32
+#define crypto_box_curve25519xsalsa20poly1305_tweet_BEFORENMBYTES 32
+#define crypto_box_curve25519xsalsa20poly1305_tweet_NONCEBYTES 24
+#define crypto_box_curve25519xsalsa20poly1305_tweet_ZEROBYTES 32
+#define crypto_box_curve25519xsalsa20poly1305_tweet_BOXZEROBYTES 16
+extern int crypto_box_curve25519xsalsa20poly1305_tweet(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *,const unsigned char *);
+extern int crypto_box_curve25519xsalsa20poly1305_tweet_open(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *,const unsigned char *);
+extern int crypto_box_curve25519xsalsa20poly1305_tweet_keypair(unsigned char *,unsigned char *);
+extern int crypto_box_curve25519xsalsa20poly1305_tweet_beforenm(unsigned char *,const unsigned char *,const unsigned char *);
+extern int crypto_box_curve25519xsalsa20poly1305_tweet_afternm(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *);
+extern int crypto_box_curve25519xsalsa20poly1305_tweet_open_afternm(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *);
+#define crypto_box_curve25519xsalsa20poly1305_tweet_VERSION "-"
+#define crypto_box_curve25519xsalsa20poly1305 crypto_box_curve25519xsalsa20poly1305_tweet
+#define crypto_box_curve25519xsalsa20poly1305_open crypto_box_curve25519xsalsa20poly1305_tweet_open
+#define crypto_box_curve25519xsalsa20poly1305_keypair crypto_box_curve25519xsalsa20poly1305_tweet_keypair
+#define crypto_box_curve25519xsalsa20poly1305_beforenm crypto_box_curve25519xsalsa20poly1305_tweet_beforenm
+#define crypto_box_curve25519xsalsa20poly1305_afternm crypto_box_curve25519xsalsa20poly1305_tweet_afternm
+#define crypto_box_curve25519xsalsa20poly1305_open_afternm crypto_box_curve25519xsalsa20poly1305_tweet_open_afternm
+#define crypto_box_curve25519xsalsa20poly1305_PUBLICKEYBYTES crypto_box_curve25519xsalsa20poly1305_tweet_PUBLICKEYBYTES
+#define crypto_box_curve25519xsalsa20poly1305_SECRETKEYBYTES crypto_box_curve25519xsalsa20poly1305_tweet_SECRETKEYBYTES
+#define crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES crypto_box_curve25519xsalsa20poly1305_tweet_BEFORENMBYTES
+#define crypto_box_curve25519xsalsa20poly1305_NONCEBYTES crypto_box_curve25519xsalsa20poly1305_tweet_NONCEBYTES
+#define crypto_box_curve25519xsalsa20poly1305_ZEROBYTES crypto_box_curve25519xsalsa20poly1305_tweet_ZEROBYTES
+#define crypto_box_curve25519xsalsa20poly1305_BOXZEROBYTES crypto_box_curve25519xsalsa20poly1305_tweet_BOXZEROBYTES
+#define crypto_box_curve25519xsalsa20poly1305_VERSION crypto_box_curve25519xsalsa20poly1305_tweet_VERSION
+#define crypto_box_curve25519xsalsa20poly1305_IMPLEMENTATION "crypto_box/curve25519xsalsa20poly1305/tweet"
+#define crypto_core_PRIMITIVE "salsa20"
+#define crypto_core crypto_core_salsa20
+#define crypto_core_OUTPUTBYTES crypto_core_salsa20_OUTPUTBYTES
+#define crypto_core_INPUTBYTES crypto_core_salsa20_INPUTBYTES
+#define crypto_core_KEYBYTES crypto_core_salsa20_KEYBYTES
+#define crypto_core_CONSTBYTES crypto_core_salsa20_CONSTBYTES
+#define crypto_core_IMPLEMENTATION crypto_core_salsa20_IMPLEMENTATION
+#define crypto_core_VERSION crypto_core_salsa20_VERSION
+#define crypto_core_salsa20_tweet_OUTPUTBYTES 64
+#define crypto_core_salsa20_tweet_INPUTBYTES 16
+#define crypto_core_salsa20_tweet_KEYBYTES 32
+#define crypto_core_salsa20_tweet_CONSTBYTES 16
+extern int crypto_core_salsa20_tweet(unsigned char *,const unsigned char *,const unsigned char *,const unsigned char *);
+#define crypto_core_salsa20_tweet_VERSION "-"
+#define crypto_core_salsa20 crypto_core_salsa20_tweet
+#define crypto_core_salsa20_OUTPUTBYTES crypto_core_salsa20_tweet_OUTPUTBYTES
+#define crypto_core_salsa20_INPUTBYTES crypto_core_salsa20_tweet_INPUTBYTES
+#define crypto_core_salsa20_KEYBYTES crypto_core_salsa20_tweet_KEYBYTES
+#define crypto_core_salsa20_CONSTBYTES crypto_core_salsa20_tweet_CONSTBYTES
+#define crypto_core_salsa20_VERSION crypto_core_salsa20_tweet_VERSION
+#define crypto_core_salsa20_IMPLEMENTATION "crypto_core/salsa20/tweet"
+#define crypto_core_hsalsa20_tweet_OUTPUTBYTES 32
+#define crypto_core_hsalsa20_tweet_INPUTBYTES 16
+#define crypto_core_hsalsa20_tweet_KEYBYTES 32
+#define crypto_core_hsalsa20_tweet_CONSTBYTES 16
+extern int crypto_core_hsalsa20_tweet(unsigned char *,const unsigned char *,const unsigned char *,const unsigned char *);
+#define crypto_core_hsalsa20_tweet_VERSION "-"
+#define crypto_core_hsalsa20 crypto_core_hsalsa20_tweet
+#define crypto_core_hsalsa20_OUTPUTBYTES crypto_core_hsalsa20_tweet_OUTPUTBYTES
+#define crypto_core_hsalsa20_INPUTBYTES crypto_core_hsalsa20_tweet_INPUTBYTES
+#define crypto_core_hsalsa20_KEYBYTES crypto_core_hsalsa20_tweet_KEYBYTES
+#define crypto_core_hsalsa20_CONSTBYTES crypto_core_hsalsa20_tweet_CONSTBYTES
+#define crypto_core_hsalsa20_VERSION crypto_core_hsalsa20_tweet_VERSION
+#define crypto_core_hsalsa20_IMPLEMENTATION "crypto_core/hsalsa20/tweet"
+#define crypto_hashblocks_PRIMITIVE "sha512"
+#define crypto_hashblocks crypto_hashblocks_sha512
+#define crypto_hashblocks_STATEBYTES crypto_hashblocks_sha512_STATEBYTES
+#define crypto_hashblocks_BLOCKBYTES crypto_hashblocks_sha512_BLOCKBYTES
+#define crypto_hashblocks_IMPLEMENTATION crypto_hashblocks_sha512_IMPLEMENTATION
+#define crypto_hashblocks_VERSION crypto_hashblocks_sha512_VERSION
+#define crypto_hashblocks_sha512_tweet_STATEBYTES 64
+#define crypto_hashblocks_sha512_tweet_BLOCKBYTES 128
+extern int crypto_hashblocks_sha512_tweet(unsigned char *,const unsigned char *,unsigned long long);
+#define crypto_hashblocks_sha512_tweet_VERSION "-"
+#define crypto_hashblocks_sha512 crypto_hashblocks_sha512_tweet
+#define crypto_hashblocks_sha512_STATEBYTES crypto_hashblocks_sha512_tweet_STATEBYTES
+#define crypto_hashblocks_sha512_BLOCKBYTES crypto_hashblocks_sha512_tweet_BLOCKBYTES
+#define crypto_hashblocks_sha512_VERSION crypto_hashblocks_sha512_tweet_VERSION
+#define crypto_hashblocks_sha512_IMPLEMENTATION "crypto_hashblocks/sha512/tweet"
+#define crypto_hashblocks_sha256_tweet_STATEBYTES 32
+#define crypto_hashblocks_sha256_tweet_BLOCKBYTES 64
+extern int crypto_hashblocks_sha256_tweet(unsigned char *,const unsigned char *,unsigned long long);
+#define crypto_hashblocks_sha256_tweet_VERSION "-"
+#define crypto_hashblocks_sha256 crypto_hashblocks_sha256_tweet
+#define crypto_hashblocks_sha256_STATEBYTES crypto_hashblocks_sha256_tweet_STATEBYTES
+#define crypto_hashblocks_sha256_BLOCKBYTES crypto_hashblocks_sha256_tweet_BLOCKBYTES
+#define crypto_hashblocks_sha256_VERSION crypto_hashblocks_sha256_tweet_VERSION
+#define crypto_hashblocks_sha256_IMPLEMENTATION "crypto_hashblocks/sha256/tweet"
+#define crypto_hash_PRIMITIVE "sha512"
+#define crypto_hash crypto_hash_sha512
+#define crypto_hash_BYTES crypto_hash_sha512_BYTES
+#define crypto_hash_IMPLEMENTATION crypto_hash_sha512_IMPLEMENTATION
+#define crypto_hash_VERSION crypto_hash_sha512_VERSION
+#define crypto_hash_sha512_tweet_BYTES 64
+extern int crypto_hash_sha512_tweet(unsigned char *,const unsigned char *,unsigned long long);
+#define crypto_hash_sha512_tweet_VERSION "-"
+#define crypto_hash_sha512 crypto_hash_sha512_tweet
+#define crypto_hash_sha512_BYTES crypto_hash_sha512_tweet_BYTES
+#define crypto_hash_sha512_VERSION crypto_hash_sha512_tweet_VERSION
+#define crypto_hash_sha512_IMPLEMENTATION "crypto_hash/sha512/tweet"
+#define crypto_hash_sha256_tweet_BYTES 32
+extern int crypto_hash_sha256_tweet(unsigned char *,const unsigned char *,unsigned long long);
+#define crypto_hash_sha256_tweet_VERSION "-"
+#define crypto_hash_sha256 crypto_hash_sha256_tweet
+#define crypto_hash_sha256_BYTES crypto_hash_sha256_tweet_BYTES
+#define crypto_hash_sha256_VERSION crypto_hash_sha256_tweet_VERSION
+#define crypto_hash_sha256_IMPLEMENTATION "crypto_hash/sha256/tweet"
+#define crypto_onetimeauth_PRIMITIVE "poly1305"
+#define crypto_onetimeauth crypto_onetimeauth_poly1305
+#define crypto_onetimeauth_verify crypto_onetimeauth_poly1305_verify
+#define crypto_onetimeauth_BYTES crypto_onetimeauth_poly1305_BYTES
+#define crypto_onetimeauth_KEYBYTES crypto_onetimeauth_poly1305_KEYBYTES
+#define crypto_onetimeauth_IMPLEMENTATION crypto_onetimeauth_poly1305_IMPLEMENTATION
+#define crypto_onetimeauth_VERSION crypto_onetimeauth_poly1305_VERSION
+#define crypto_onetimeauth_poly1305_tweet_BYTES 16
+#define crypto_onetimeauth_poly1305_tweet_KEYBYTES 32
+extern int crypto_onetimeauth_poly1305_tweet(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *);
+extern int crypto_onetimeauth_poly1305_tweet_verify(const unsigned char *,const unsigned char *,unsigned long long,const unsigned char *);
+#define crypto_onetimeauth_poly1305_tweet_VERSION "-"
+#define crypto_onetimeauth_poly1305 crypto_onetimeauth_poly1305_tweet
+#define crypto_onetimeauth_poly1305_verify crypto_onetimeauth_poly1305_tweet_verify
+#define crypto_onetimeauth_poly1305_BYTES crypto_onetimeauth_poly1305_tweet_BYTES
+#define crypto_onetimeauth_poly1305_KEYBYTES crypto_onetimeauth_poly1305_tweet_KEYBYTES
+#define crypto_onetimeauth_poly1305_VERSION crypto_onetimeauth_poly1305_tweet_VERSION
+#define crypto_onetimeauth_poly1305_IMPLEMENTATION "crypto_onetimeauth/poly1305/tweet"
+#define crypto_scalarmult_PRIMITIVE "curve25519"
+#define crypto_scalarmult crypto_scalarmult_curve25519
+#define crypto_scalarmult_base crypto_scalarmult_curve25519_base
+#define crypto_scalarmult_BYTES crypto_scalarmult_curve25519_BYTES
+#define crypto_scalarmult_SCALARBYTES crypto_scalarmult_curve25519_SCALARBYTES
+#define crypto_scalarmult_IMPLEMENTATION crypto_scalarmult_curve25519_IMPLEMENTATION
+#define crypto_scalarmult_VERSION crypto_scalarmult_curve25519_VERSION
+#define crypto_scalarmult_curve25519_tweet_BYTES 32
+#define crypto_scalarmult_curve25519_tweet_SCALARBYTES 32
+extern int crypto_scalarmult_curve25519_tweet(unsigned char *,const unsigned char *,const unsigned char *);
+extern int crypto_scalarmult_curve25519_tweet_base(unsigned char *,const unsigned char *);
+#define crypto_scalarmult_curve25519_tweet_VERSION "-"
+#define crypto_scalarmult_curve25519 crypto_scalarmult_curve25519_tweet
+#define crypto_scalarmult_curve25519_base crypto_scalarmult_curve25519_tweet_base
+#define crypto_scalarmult_curve25519_BYTES crypto_scalarmult_curve25519_tweet_BYTES
+#define crypto_scalarmult_curve25519_SCALARBYTES crypto_scalarmult_curve25519_tweet_SCALARBYTES
+#define crypto_scalarmult_curve25519_VERSION crypto_scalarmult_curve25519_tweet_VERSION
+#define crypto_scalarmult_curve25519_IMPLEMENTATION "crypto_scalarmult/curve25519/tweet"
+#define crypto_secretbox_PRIMITIVE "xsalsa20poly1305"
+#define crypto_secretbox crypto_secretbox_xsalsa20poly1305
+#define crypto_secretbox_open crypto_secretbox_xsalsa20poly1305_open
+#define crypto_secretbox_KEYBYTES crypto_secretbox_xsalsa20poly1305_KEYBYTES
+#define crypto_secretbox_NONCEBYTES crypto_secretbox_xsalsa20poly1305_NONCEBYTES
+#define crypto_secretbox_ZEROBYTES crypto_secretbox_xsalsa20poly1305_ZEROBYTES
+#define crypto_secretbox_BOXZEROBYTES crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES
+#define crypto_secretbox_IMPLEMENTATION crypto_secretbox_xsalsa20poly1305_IMPLEMENTATION
+#define crypto_secretbox_VERSION crypto_secretbox_xsalsa20poly1305_VERSION
+#define crypto_secretbox_xsalsa20poly1305_tweet_KEYBYTES 32
+#define crypto_secretbox_xsalsa20poly1305_tweet_NONCEBYTES 24
+#define crypto_secretbox_xsalsa20poly1305_tweet_ZEROBYTES 32
+#define crypto_secretbox_xsalsa20poly1305_tweet_BOXZEROBYTES 16
+extern int crypto_secretbox_xsalsa20poly1305_tweet(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *);
+extern int crypto_secretbox_xsalsa20poly1305_tweet_open(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *);
+#define crypto_secretbox_xsalsa20poly1305_tweet_VERSION "-"
+#define crypto_secretbox_xsalsa20poly1305 crypto_secretbox_xsalsa20poly1305_tweet
+#define crypto_secretbox_xsalsa20poly1305_open crypto_secretbox_xsalsa20poly1305_tweet_open
+#define crypto_secretbox_xsalsa20poly1305_KEYBYTES crypto_secretbox_xsalsa20poly1305_tweet_KEYBYTES
+#define crypto_secretbox_xsalsa20poly1305_NONCEBYTES crypto_secretbox_xsalsa20poly1305_tweet_NONCEBYTES
+#define crypto_secretbox_xsalsa20poly1305_ZEROBYTES crypto_secretbox_xsalsa20poly1305_tweet_ZEROBYTES
+#define crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES crypto_secretbox_xsalsa20poly1305_tweet_BOXZEROBYTES
+#define crypto_secretbox_xsalsa20poly1305_VERSION crypto_secretbox_xsalsa20poly1305_tweet_VERSION
+#define crypto_secretbox_xsalsa20poly1305_IMPLEMENTATION "crypto_secretbox/xsalsa20poly1305/tweet"
+#define crypto_sign_PRIMITIVE "ed25519"
+#define crypto_sign crypto_sign_ed25519
+#define crypto_sign_open crypto_sign_ed25519_open
+#define crypto_sign_keypair crypto_sign_ed25519_keypair
+#define crypto_sign_BYTES crypto_sign_ed25519_BYTES
+#define crypto_sign_PUBLICKEYBYTES crypto_sign_ed25519_PUBLICKEYBYTES
+#define crypto_sign_SECRETKEYBYTES crypto_sign_ed25519_SECRETKEYBYTES
+#define crypto_sign_IMPLEMENTATION crypto_sign_ed25519_IMPLEMENTATION
+#define crypto_sign_VERSION crypto_sign_ed25519_VERSION
+#define crypto_sign_ed25519_tweet_BYTES 64
+#define crypto_sign_ed25519_tweet_PUBLICKEYBYTES 32
+#define crypto_sign_ed25519_tweet_SECRETKEYBYTES 64
+extern int crypto_sign_ed25519_tweet(unsigned char *,unsigned long long *,const unsigned char *,unsigned long long,const unsigned char *);
+extern int crypto_sign_ed25519_tweet_open(unsigned char *,unsigned long long *,const unsigned char *,unsigned long long,const unsigned char *);
+extern int crypto_sign_ed25519_tweet_keypair(unsigned char *,unsigned char *);
+#define crypto_sign_ed25519_tweet_VERSION "-"
+#define crypto_sign_ed25519 crypto_sign_ed25519_tweet
+#define crypto_sign_ed25519_open crypto_sign_ed25519_tweet_open
+#define crypto_sign_ed25519_keypair crypto_sign_ed25519_tweet_keypair
+#define crypto_sign_ed25519_BYTES crypto_sign_ed25519_tweet_BYTES
+#define crypto_sign_ed25519_PUBLICKEYBYTES crypto_sign_ed25519_tweet_PUBLICKEYBYTES
+#define crypto_sign_ed25519_SECRETKEYBYTES crypto_sign_ed25519_tweet_SECRETKEYBYTES
+#define crypto_sign_ed25519_VERSION crypto_sign_ed25519_tweet_VERSION
+#define crypto_sign_ed25519_IMPLEMENTATION "crypto_sign/ed25519/tweet"
+#define crypto_stream_PRIMITIVE "xsalsa20"
+#define crypto_stream crypto_stream_xsalsa20
+#define crypto_stream_xor crypto_stream_xsalsa20_xor
+#define crypto_stream_KEYBYTES crypto_stream_xsalsa20_KEYBYTES
+#define crypto_stream_NONCEBYTES crypto_stream_xsalsa20_NONCEBYTES
+#define crypto_stream_IMPLEMENTATION crypto_stream_xsalsa20_IMPLEMENTATION
+#define crypto_stream_VERSION crypto_stream_xsalsa20_VERSION
+#define crypto_stream_xsalsa20_tweet_KEYBYTES 32
+#define crypto_stream_xsalsa20_tweet_NONCEBYTES 24
+extern int crypto_stream_xsalsa20_tweet(unsigned char *,unsigned long long,const unsigned char *,const unsigned char *);
+extern int crypto_stream_xsalsa20_tweet_xor(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *);
+#define crypto_stream_xsalsa20_tweet_VERSION "-"
+#define crypto_stream_xsalsa20 crypto_stream_xsalsa20_tweet
+#define crypto_stream_xsalsa20_xor crypto_stream_xsalsa20_tweet_xor
+#define crypto_stream_xsalsa20_KEYBYTES crypto_stream_xsalsa20_tweet_KEYBYTES
+#define crypto_stream_xsalsa20_NONCEBYTES crypto_stream_xsalsa20_tweet_NONCEBYTES
+#define crypto_stream_xsalsa20_VERSION crypto_stream_xsalsa20_tweet_VERSION
+#define crypto_stream_xsalsa20_IMPLEMENTATION "crypto_stream/xsalsa20/tweet"
+#define crypto_stream_salsa20_tweet_KEYBYTES 32
+#define crypto_stream_salsa20_tweet_NONCEBYTES 8
+extern int crypto_stream_salsa20_tweet(unsigned char *,unsigned long long,const unsigned char *,const unsigned char *);
+extern int crypto_stream_salsa20_tweet_xor(unsigned char *,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *);
+#define crypto_stream_salsa20_tweet_VERSION "-"
+#define crypto_stream_salsa20 crypto_stream_salsa20_tweet
+#define crypto_stream_salsa20_xor crypto_stream_salsa20_tweet_xor
+#define crypto_stream_salsa20_KEYBYTES crypto_stream_salsa20_tweet_KEYBYTES
+#define crypto_stream_salsa20_NONCEBYTES crypto_stream_salsa20_tweet_NONCEBYTES
+#define crypto_stream_salsa20_VERSION crypto_stream_salsa20_tweet_VERSION
+#define crypto_stream_salsa20_IMPLEMENTATION "crypto_stream/salsa20/tweet"
+#define crypto_verify_PRIMITIVE "16"
+#define crypto_verify crypto_verify_16
+#define crypto_verify_BYTES crypto_verify_16_BYTES
+#define crypto_verify_IMPLEMENTATION crypto_verify_16_IMPLEMENTATION
+#define crypto_verify_VERSION crypto_verify_16_VERSION
+#define crypto_verify_16_tweet_BYTES 16
+extern int crypto_verify_16_tweet(const unsigned char *,const unsigned char *);
+#define crypto_verify_16_tweet_VERSION "-"
+#define crypto_verify_16 crypto_verify_16_tweet
+#define crypto_verify_16_BYTES crypto_verify_16_tweet_BYTES
+#define crypto_verify_16_VERSION crypto_verify_16_tweet_VERSION
+#define crypto_verify_16_IMPLEMENTATION "crypto_verify/16/tweet"
+#define crypto_verify_32_tweet_BYTES 32
+extern int crypto_verify_32_tweet(const unsigned char *,const unsigned char *);
+#define crypto_verify_32_tweet_VERSION "-"
+#define crypto_verify_32 crypto_verify_32_tweet
+#define crypto_verify_32_BYTES crypto_verify_32_tweet_BYTES
+#define crypto_verify_32_VERSION crypto_verify_32_tweet_VERSION
+#define crypto_verify_32_IMPLEMENTATION "crypto_verify/32/tweet"
+#endif
diff --git a/runtime/third_party/cryptopp/twofish.cpp b/runtime/third_party/cryptopp/twofish.cpp
new file mode 100644
index 0000000..c938145
--- /dev/null
+++ b/runtime/third_party/cryptopp/twofish.cpp
@@ -0,0 +1,171 @@
+// twofish.cpp - modified by Wei Dai from Matthew Skala's twofish.c
+// The original code and all modifications are in the public domain.
+
+#include "pch.h"
+#include "twofish.h"
+#include "secblock.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// compute (c * x^4) mod (x^4 + (a + 1/a) * x^3 + a * x^2 + (a + 1/a) * x + 1)
+// over GF(256)
+static inline unsigned int Mod(unsigned int c)
+{
+	static const unsigned int modulus = 0x14d;
+	unsigned int c2 = (c<<1) ^ ((c & 0x80) ? modulus : 0);
+	unsigned int c1 = c2 ^ (c>>1) ^ ((c & 1) ? (modulus>>1) : 0);
+	return c | (c1 << 8) | (c2 << 16) | (c1 << 24);
+}
+
+// compute RS(12,8) code with the above polynomial as generator
+// this is equivalent to multiplying by the RS matrix
+static word32 ReedSolomon(word32 high, word32 low)
+{
+	for (unsigned int i=0; i<8; i++)
+	{
+		high = Mod(high>>24) ^ (high<<8) ^ (low>>24);
+		low <<= 8;
+	}
+	return high;
+}
+
+inline word32 Twofish::Base::h0(word32 x, const word32 *key, unsigned int kLen)
+{
+	x = x | (x<<8) | (x<<16) | (x<<24);
+	switch(kLen)
+	{
+#define Q(a, b, c, d, t) q[a][GETBYTE(t,0)] ^ (q[b][GETBYTE(t,1)] << 8) ^ (q[c][GETBYTE(t,2)] << 16) ^ (q[d][GETBYTE(t,3)] << 24)
+	case 4: x = Q(1, 0, 0, 1, x) ^ key[6];
+	// fall through
+	case 3: x = Q(1, 1, 0, 0, x) ^ key[4];
+	// fall through
+	case 2: x = Q(0, 1, 0, 1, x) ^ key[2];
+			x = Q(0, 0, 1, 1, x) ^ key[0];
+	}
+	return x;
+}
+
+inline word32 Twofish::Base::h(word32 x, const word32 *key, unsigned int kLen)
+{
+	x = h0(x, key, kLen);
+	return mds[0][GETBYTE(x,0)] ^ mds[1][GETBYTE(x,1)] ^ mds[2][GETBYTE(x,2)] ^ mds[3][GETBYTE(x,3)];
+}
+
+void Twofish::Base::UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &)
+{
+	AssertValidKeyLength(keylength);
+
+	unsigned int len = (keylength <= 16 ? 2 : (keylength <= 24 ? 3 : 4));
+	SecBlock<word32> key(len*2);
+	GetUserKey(LITTLE_ENDIAN_ORDER, key.begin(), len*2, userKey, keylength);
+
+	unsigned int i;
+	for (i=0; i<40; i+=2)
+	{
+		word32 a = h(i, key, len);
+		word32 b = rotlConstant<8>(h(i + 1, key + 1, len));
+		m_k[i] = a+b;
+		m_k[i + 1] = rotlConstant<9>(a + 2 * b);
+	}
+
+	SecBlock<word32> svec(2*len);
+	for (i=0; i<len; i++)
+		svec[2*(len-i-1)] = ReedSolomon(key[2*i+1], key[2*i]);
+	for (i=0; i<256; i++)
+	{
+		word32 t = h0(i, svec, len);
+		m_s[0*256+i] = mds[0][GETBYTE(t, 0)];
+		m_s[1*256+i] = mds[1][GETBYTE(t, 1)];
+		m_s[2*256+i] = mds[2][GETBYTE(t, 2)];
+		m_s[3*256+i] = mds[3][GETBYTE(t, 3)];
+	}
+}
+
+#define G1(x) (m_s[0*256+GETBYTE(x,0)] ^ m_s[1*256+GETBYTE(x,1)] ^ m_s[2*256+GETBYTE(x,2)] ^ m_s[3*256+GETBYTE(x,3)])
+#define G2(x) (m_s[0*256+GETBYTE(x,3)] ^ m_s[1*256+GETBYTE(x,0)] ^ m_s[2*256+GETBYTE(x,1)] ^ m_s[3*256+GETBYTE(x,2)])
+
+#define ENCROUND(n, a, b, c, d) \
+	x = G1 (a); y = G2 (b); \
+	x += y; y += x + k[2 * (n) + 1]; \
+	(c) ^= x + k[2 * (n)]; \
+	(c) = rotrConstant<1>(c); \
+	(d) = rotlConstant<1>(d) ^ y
+
+#define ENCCYCLE(n) \
+	ENCROUND (2 * (n), a, b, c, d); \
+	ENCROUND (2 * (n) + 1, c, d, a, b)
+
+#define DECROUND(n, a, b, c, d) \
+	x = G1 (a); y = G2 (b); \
+	x += y; y += x; \
+	(d) ^= y + k[2 * (n) + 1]; \
+	(d) = rotrConstant<1>(d); \
+	(c) = rotlConstant<1>(c); \
+	(c) ^= (x + k[2 * (n)])
+
+#define DECCYCLE(n) \
+	DECROUND (2 * (n) + 1, c, d, a, b); \
+	DECROUND (2 * (n), a, b, c, d)
+
+typedef BlockGetAndPut<word32, LittleEndian> Block;
+
+void Twofish::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 x, y, a, b, c, d;
+
+	Block::Get(inBlock)(a)(b)(c)(d);
+
+	a ^= m_k[0];
+	b ^= m_k[1];
+	c ^= m_k[2];
+	d ^= m_k[3];
+
+	const word32 *k = m_k+8;
+	ENCCYCLE (0);
+	ENCCYCLE (1);
+	ENCCYCLE (2);
+	ENCCYCLE (3);
+	ENCCYCLE (4);
+	ENCCYCLE (5);
+	ENCCYCLE (6);
+	ENCCYCLE (7);
+
+	c ^= m_k[4];
+	d ^= m_k[5];
+	a ^= m_k[6];
+	b ^= m_k[7];
+
+	Block::Put(xorBlock, outBlock)(c)(d)(a)(b);
+}
+
+void Twofish::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
+{
+	word32 x, y, a, b, c, d;
+
+	Block::Get(inBlock)(c)(d)(a)(b);
+
+	c ^= m_k[4];
+	d ^= m_k[5];
+	a ^= m_k[6];
+	b ^= m_k[7];
+
+	const word32 *k = m_k+8;
+	DECCYCLE (7);
+	DECCYCLE (6);
+	DECCYCLE (5);
+	DECCYCLE (4);
+	DECCYCLE (3);
+	DECCYCLE (2);
+	DECCYCLE (1);
+	DECCYCLE (0);
+
+	a ^= m_k[0];
+	b ^= m_k[1];
+	c ^= m_k[2];
+	d ^= m_k[3];
+
+	Block::Put(xorBlock, outBlock)(a)(b)(c)(d);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/twofish.h b/runtime/third_party/cryptopp/twofish.h
new file mode 100644
index 0000000..cf28902
--- /dev/null
+++ b/runtime/third_party/cryptopp/twofish.h
@@ -0,0 +1,64 @@
+// twofish.h - originally written and placed in the public domain by Wei Dai
+
+/// \file twofish.h
+/// \brief Classes for the Twofish block cipher
+
+#ifndef CRYPTOPP_TWOFISH_H
+#define CRYPTOPP_TWOFISH_H
+
+#include "seckey.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Twofish block cipher information
+/// \since Crypto++ 3.1
+struct Twofish_Info : public FixedBlockSize<16>, public VariableKeyLength<16, 16, 32, 8>, FixedRounds<16>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "Twofish";}
+};
+
+/// \brief Twofish block cipher
+/// \sa <a href="http://www.cryptopp.com/wiki/Twofish">Twofish</a>
+/// \since Crypto++ 3.1
+class Twofish : public Twofish_Info, public BlockCipherDocumentation
+{
+	class CRYPTOPP_NO_VTABLE Base : public BlockCipherImpl<Twofish_Info>
+	{
+	public:
+		void UncheckedSetKey(const byte *userKey, unsigned int length, const NameValuePairs &params);
+
+	protected:
+		static word32 h0(word32 x, const word32 *key, unsigned int kLen);
+		static word32 h(word32 x, const word32 *key, unsigned int kLen);
+
+		static const byte q[2][256];
+		static const word32 mds[4][256];
+
+		FixedSizeSecBlock<word32, 40> m_k;
+		FixedSizeSecBlock<word32, 4*256> m_s;
+	};
+
+	class CRYPTOPP_NO_VTABLE Enc : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+	class CRYPTOPP_NO_VTABLE Dec : public Base
+	{
+	public:
+		void ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const;
+	};
+
+public:
+	typedef BlockCipherFinal<ENCRYPTION, Enc> Encryption;
+	typedef BlockCipherFinal<DECRYPTION, Dec> Decryption;
+};
+
+typedef Twofish::Encryption TwofishEncryption;
+typedef Twofish::Decryption TwofishDecryption;
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/validat0.cpp b/runtime/third_party/cryptopp/validat0.cpp
new file mode 100644
index 0000000..9e69ee3
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat0.cpp
@@ -0,0 +1,1672 @@
+// validat0.cpp - originally written and placed in the public domain by Wei Dai and Jeffrey Walton
+//                Routines in this source file are only tested in Debug builds.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "asn.h"
+#include "gf2n.h"
+#include "default.h"
+#include "integer.h"
+#include "polynomi.h"
+#include "channels.h"
+
+#include "ida.h"
+#include "gzip.h"
+#include "zlib.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+// Issue 64: "PolynomialMod2::operator<<=", http://github.com/weidai11/cryptopp/issues/64
+bool TestPolynomialMod2()
+{
+    std::cout << "\nTesting PolynomialMod2 bit operations...\n\n";
+    bool pass1 = true, pass2 = true, pass3 = true;
+
+    const unsigned int start = 0;
+    const unsigned int stop = 4 * WORD_BITS + 1;
+
+    for (unsigned int i = start; i < stop; i++)
+    {
+        PolynomialMod2 p(1);
+        p <<= i;
+
+        Integer n(Integer::One());
+        n <<= i;
+
+        std::ostringstream oss1;
+        oss1 << p;
+
+        std::string str1, str2;
+
+        // str1 needs the commas removed used for grouping
+        str1 = oss1.str();
+        str1.erase(std::remove(str1.begin(), str1.end(), ','), str1.end());
+
+        // str1 needs the trailing 'b' removed
+        str1.erase(str1.end() - 1);
+
+        // str2 is fine as-is
+        str2 = IntToString(n, 2);
+
+        pass1 &= (str1 == str2);
+    }
+
+    for (unsigned int i = start; i < stop; i++)
+    {
+        const word w((word)SIZE_MAX);
+
+        PolynomialMod2 p(w);
+        p <<= i;
+
+        Integer n(Integer::POSITIVE, static_cast<lword>(w));
+        n <<= i;
+
+        std::ostringstream oss1;
+        oss1 << p;
+
+        std::string str1, str2;
+
+        // str1 needs the commas removed used for grouping
+        str1 = oss1.str();
+        str1.erase(std::remove(str1.begin(), str1.end(), ','), str1.end());
+
+        // str1 needs the trailing 'b' removed
+        str1.erase(str1.end() - 1);
+
+        // str2 is fine as-is
+        str2 = IntToString(n, 2);
+
+        pass2 &= (str1 == str2);
+    }
+
+    RandomNumberGenerator& prng = GlobalRNG();
+    for (unsigned int i = start; i < stop; i++)
+    {
+        word w;     // Cast to lword due to Visual Studio
+        prng.GenerateBlock((byte*)&w, sizeof(w));
+
+        PolynomialMod2 p(w);
+        p <<= i;
+
+        Integer n(Integer::POSITIVE, static_cast<lword>(w));
+        n <<= i;
+
+        std::ostringstream oss1;
+        oss1 << p;
+
+        std::string str1, str2;
+
+        // str1 needs the commas removed used for grouping
+        str1 = oss1.str();
+        str1.erase(std::remove(str1.begin(), str1.end(), ','), str1.end());
+
+        // str1 needs the trailing 'b' removed
+        str1.erase(str1.end() - 1);
+
+        // str2 is fine as-is
+        str2 = IntToString(n, 2);
+
+        if (str1 != str2)
+        {
+            std::cout << "  Oops..." << "\n";
+            std::cout << "     random: " << std::hex << n << std::dec << "\n";
+            std::cout << "     str1: " << str1 << "\n";
+            std::cout << "     str2: " << str2 << "\n";
+        }
+
+        pass3 &= (str1 == str2);
+    }
+
+    std::cout << (!pass1 ? "FAILED" : "passed") << ":  " << "1 shifted over range [" << std::dec << start << "," << stop << "]" << "\n";
+    std::cout << (!pass2 ? "FAILED" : "passed") << ":  " << "0x" << std::hex << word(SIZE_MAX) << std::dec << " shifted over range [" << start << "," << stop << "]" << "\n";
+    std::cout << (!pass3 ? "FAILED" : "passed") << ":  " << "random values shifted over range [" << std::dec << start << "," << stop << "]" << "\n";
+
+    return pass1 && pass2 && pass3;
+}
+#endif
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+bool TestCompressors()
+{
+    std::cout << "\nTesting Compressors and Decompressors...\n\n";
+    bool fail1 = false, fail2 = false, fail3 = false;
+    const unsigned int COMP_COUNT = 64;
+
+    try
+    {
+        // Gzip uses Adler32 checksums. We expect a failure to happen on occasion.
+        // If we see more than 2 failures in a run of 128, then we need to investigate.
+        unsigned int truncatedCount=0;
+        for (unsigned int i = 0; i<COMP_COUNT; ++i)
+        {
+            std::string src, dest, rec;
+            unsigned int len = GlobalRNG().GenerateWord32(4, 0xfff);
+
+            RandomNumberSource(GlobalRNG(), len, true, new StringSink(src));
+            StringSource(src, true, new Gzip(new StringSink(dest)));
+            StringSource(dest, true, new Gunzip(new StringSink(rec)));
+
+            if (src != rec)
+                throw Exception(Exception::OTHER_ERROR, "Gzip failed to decompress stream");
+
+            // Tamper
+            try {
+                StringSource(dest.substr(0, len - 2), true, new Gunzip(new StringSink(rec)));
+                if (truncatedCount++ >= 2)
+                {
+                    std::cout << "FAILED:  Gzip failed to detect a truncated stream\n";
+                    fail1 = true;
+                }
+            }
+            catch (const Exception&) {}
+        }
+    }
+    catch (const Exception& ex)
+    {
+        std::cout << "FAILED:   " << ex.what() << "\n";
+        fail1 = true;
+    }
+
+    // **************************************************************
+
+    // Gzip Filename, Filetime and Comment
+    try
+    {
+        std::string filename = "test.txt";
+        std::string comment = "This is a test";
+        word32 filetime = GlobalRNG().GenerateWord32(4, 0xffffff);
+
+        AlgorithmParameters params = MakeParameters(Name::FileTime(), (int)filetime)
+            (Name::FileName(), ConstByteArrayParameter(filename.c_str(), false))
+            (Name::Comment(), ConstByteArrayParameter(comment.c_str(), false));
+
+        std::string src, dest;
+        unsigned int len = GlobalRNG().GenerateWord32(4, 0xfff);
+
+        RandomNumberSource(GlobalRNG(), len, true, new StringSink(src));
+        Gunzip unzip(new StringSink(dest));
+        StringSource(src, true, new Gzip(params, new Redirector(unzip)));
+
+        if (filename != unzip.GetFilename())
+            throw Exception(Exception::OTHER_ERROR, "Failed to retrieve filename");
+
+        if (filetime != unzip.GetFiletime())
+            throw Exception(Exception::OTHER_ERROR, "Failed to retrieve filetime");
+
+        if (comment != unzip.GetComment())
+            throw Exception(Exception::OTHER_ERROR, "Failed to retrieve comment");
+
+        std::cout << "passed:  filenames, filetimes and comments\n";
+    }
+    catch (const Exception& ex)
+    {
+        std::cout << "FAILED:  " << ex.what() << "\n";
+    }
+
+    // Unzip random data. See if we can induce a crash
+    for (unsigned int i = 0; i<COMP_COUNT; i++)
+    {
+        SecByteBlock src;
+        unsigned int len = GlobalRNG().GenerateWord32(4, 0xfff);
+        RandomNumberSource(GlobalRNG(), len, true, new ArraySink(src, src.size()));
+
+        try {
+            ArraySource(src.data(), src.size(), true, new Gunzip(new Redirector(TheBitBucket())));
+        }
+        catch (const Exception&) {}
+    }
+
+    // Unzip random data. See if we can induce a crash
+    for (unsigned int i = 0; i<COMP_COUNT; i++)
+    {
+        SecByteBlock src;
+        unsigned int len = GlobalRNG().GenerateWord32(4, 0xfff);
+        src.resize(len);
+        RandomNumberSource(GlobalRNG(), len, true, new ArraySink(src, src.size()));
+
+        src[0] = (byte)0x1f;  // magic header
+        src[1] = (byte)0x8b;
+        src[2] = 0x00;  // extra flags
+        src[3] = src[3] & (2 | 4 | 8 | 16 | 32);   // flags
+
+        // Commit d901ecd9a4de added Filenames, Filetimes and Comments. Gzip does
+        // not specify a length for them; rather, they are NULL terminated. We add
+        // a couple of NULLs in random places near filenames and comments to ensure
+        // we are getting coverage in areas beyond the header.
+        len = GlobalRNG().GenerateWord32(12, 24);
+        if (len < src.size())  // guard it to ensure in-bounds
+            src[len] = (byte)0x00;
+        len = GlobalRNG().GenerateWord32(12+len, 24+len);
+        if (len < src.size())  // guard it to ensure in-bounds
+            src[len] = (byte)0x00;
+
+        // The remainder are extra headers and the payload
+
+        try {
+            ArraySource(src.data(), src.size(), true, new Gunzip(new Redirector(TheBitBucket())));
+        }
+        catch (const Exception&) {}
+    }
+
+    if (!fail1)
+        std::cout << "passed:";
+    else
+        std::cout << "FAILED:";
+    std::cout << "  " << COMP_COUNT << " zips and unzips" << std::endl;
+
+    // **************************************************************
+
+    try
+    {
+        for (unsigned int i = 0; i<COMP_COUNT; ++i)
+        {
+            std::string src, dest, rec;
+            unsigned int len = GlobalRNG().GenerateWord32(4, 0xfff);
+
+            RandomNumberSource(GlobalRNG(), len, true, new StringSink(src));
+            StringSource(src, true, new Deflator(new StringSink(dest)));
+            StringSource(dest, true, new Inflator(new StringSink(rec)));
+
+            if (src != rec)
+                throw Exception(Exception::OTHER_ERROR, "Inflate failed to decompress stream");
+
+            // Tamper
+            try {
+                StringSource(dest.substr(0, len - 2), true, new Gunzip(new StringSink(rec)));
+                std::cout << "FAILED:  Inflate failed to detect a truncated stream\n";
+                fail2 = true;
+            }
+            catch (const Exception&) {}
+        }
+    }
+    catch (const Exception& ex)
+    {
+        std::cout << "FAILED:   " << ex.what() << "\n";
+        fail2 = true;
+    }
+
+    // **************************************************************
+
+    // Inflate random data. See if we can induce a crash
+    for (unsigned int i = 0; i<COMP_COUNT; i++)
+    {
+        SecByteBlock src;
+        unsigned int len = GlobalRNG().GenerateWord32(4, 0xfff);
+        src.resize(len);
+        RandomNumberSource(GlobalRNG(), len, true, new ArraySink(src, src.size()));
+
+        src[0] = (byte)0x1f;  // magic header
+        src[1] = (byte)0x8b;
+        src[2] = 0x00;  // extra flags
+        src[3] = src[3] & (2 | 4 | 8 | 16 | 32);   // flags
+
+        // Don't allow ENCRYPTED|CONTINUED to over-run tests
+        if (src[3] & (2 | 32)) {
+            if (i % 3 == 0) { src[3] &= ~2; }
+            if (i % 3 == 1) { src[3] &= ~32; }
+        }
+
+        // The remainder are extra headers and the payload
+
+        try {
+            ArraySource(src.data(), src.size(), true, new Inflator(new Redirector(TheBitBucket())));
+        }
+        catch (const Exception&) {}
+    }
+
+    // Inflate random data. See if we can induce a crash
+    for (unsigned int i = 0; i<COMP_COUNT; i++)
+    {
+        SecByteBlock src;
+        unsigned int len = GlobalRNG().GenerateWord32(4, 0xfff);
+        RandomNumberSource(GlobalRNG(), len, true, new ArraySink(src, src.size()));
+
+        try {
+            ArraySource(src.data(), src.size(), true, new Inflator(new Redirector(TheBitBucket())));
+        }
+        catch (const Exception&) {}
+    }
+
+    if (!fail2)
+        std::cout << "passed:";
+    else
+        std::cout << "FAILED:";
+    std::cout << "  " << COMP_COUNT << " deflates and inflates\n";
+
+    // **************************************************************
+
+    try
+    {
+        for (unsigned int i = 0; i<COMP_COUNT; ++i)
+        {
+            std::string src, dest, rec;
+            unsigned int len = GlobalRNG().GenerateWord32(4, 0xfff);
+
+            RandomNumberSource(GlobalRNG(), len, true, new StringSink(src));
+            StringSource(src, true, new ZlibCompressor(new StringSink(dest)));
+            StringSource(dest, true, new ZlibDecompressor(new StringSink(rec)));
+
+            if (src != rec)
+                throw Exception(Exception::OTHER_ERROR, "Zlib failed to decompress stream");
+
+            // Tamper
+            try {
+                StringSource(dest.substr(0, len - 2), true, new Gunzip(new StringSink(rec)));
+                std::cout << "FAILED:  Zlib failed to detect a truncated stream\n";
+                fail3 = true;
+            }
+            catch (const Exception&) {}
+        }
+    }
+    catch (const Exception& ex)
+    {
+        std::cout << "FAILED:   " << ex.what() << "\n";
+        fail3 = true;
+    }
+
+    // **************************************************************
+
+    // Decompress random data. See if we can induce a crash
+    for (unsigned int i = 0; i<COMP_COUNT; i++)
+    {
+        SecByteBlock src;
+        unsigned int len = GlobalRNG().GenerateWord32(4, 0xfff);
+        src.resize(len);
+        RandomNumberSource(GlobalRNG(), len, true, new ArraySink(src, src.size()));
+
+        // CMF byte
+        src[0] = (byte)(GlobalRNG().GenerateWord32(0, 14) << 4);
+        src[0] |= (byte)(GlobalRNG().GenerateWord32(0, 7));
+
+        // FLG byte
+        src[1] = (byte)(GlobalRNG().GenerateWord32(0, 7) << 5);
+        src[1] |= (byte)(31 - (src[0] * 256 + src[1]) % 31);
+
+        // The remainder are the payload, but missing Adler32
+
+        try {
+            ArraySource(src.data(), src.size(), true, new ZlibDecompressor(new Redirector(TheBitBucket())));
+        }
+        catch (const Exception&) {}
+    }
+
+    if (!fail3)
+        std::cout << "passed:";
+    else
+        std::cout << "FAILED:";
+    std::cout << "  " << COMP_COUNT << " zlib decompress and compress" << std::endl;
+
+    // **************************************************************
+
+    return !fail1 && !fail2 && !fail3;
+}
+
+bool TestEncryptors()
+{
+    std::cout << "\nTesting Default Encryptors and Decryptors...\n\n";
+    const unsigned int ENCRYPT_COUNT = 64, ENCRYPT_MAC_COUNT = 64;
+    bool fail0 = false, fail1 = false, fail2 = false, fail3 = false, fail4 = false;
+
+    // **************************************************************
+
+    try
+    {
+        // Common password and message.
+        std::string password = "super secret password";
+        std::string recovered, message = "Now is the time for all good men to come to the aide of their country.";
+
+        // This data was generated with Crypto++ 5.6.2
+        //StringSource(message, true, new LegacyEncryptorWithMAC(password.c_str(), new FileSink("TestData/defdmac1.bin")));
+        FileSource(DataDir("TestData/defdmac1.bin").c_str(), true, new LegacyDecryptorWithMAC(password.c_str(), new StringSink(recovered)));
+        if (message != recovered)
+            throw Exception(Exception::OTHER_ERROR, "LegacyDecryptorWithMAC failed a self test");
+
+        // Reset sink
+        recovered.clear();
+
+        // This data was generated with Crypto++ 6.0
+        //StringSource(message, true, new DefaultEncryptorWithMAC(password.c_str(), new FileSink("TestData/defdmac2.bin")));
+        FileSource(DataDir("TestData/defdmac2.bin").c_str(), true, new DefaultDecryptorWithMAC(password.c_str(), new StringSink(recovered)));
+        if (message != recovered)
+            throw Exception(Exception::OTHER_ERROR, "DefaultDecryptorWithMAC failed a self test");
+    }
+    catch(const Exception&)
+    {
+        fail0 = true;
+    }
+
+    if (!fail0)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  cross-platform decryption with MAC of binary file" << std::endl;
+
+    // **************************************************************
+
+    try
+    {
+        for (unsigned int i=0; i<ENCRYPT_COUNT; ++i)
+        {
+            std::string pwd, src, dest, rec;
+            unsigned int len = GlobalRNG().GenerateWord32(8, 0xfff);
+            unsigned int plen = GlobalRNG().GenerateWord32(0, 32);
+
+            RandomNumberSource(GlobalRNG(), len, true, new StringSink(src));
+            RandomNumberSource(GlobalRNG(), plen, true, new HexEncoder(new StringSink(pwd)));
+
+            StringSource(src, true, new DefaultEncryptor(pwd.c_str(), new StringSink(dest)));
+            StringSource(dest, true, new DefaultDecryptor(pwd.c_str(), new StringSink(rec)));
+            if (src != rec)
+                throw Exception(Exception::OTHER_ERROR, "DefaultEncryptor failed a self test");
+        }
+    }
+    catch(const Exception&)
+    {
+        fail1 = true;
+    }
+
+    if (!fail1)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  " << ENCRYPT_COUNT << " default encryptions and decryptions" << std::endl;
+
+    // **************************************************************
+
+    try
+    {
+        for (unsigned int i=0; i<ENCRYPT_MAC_COUNT; ++i)
+        {
+            const unsigned int runt = EnumToInt(DefaultEncryptorWithMAC::SALTLENGTH) + EnumToInt(DefaultEncryptorWithMAC::KEYLENGTH);
+            std::string pwd, src, dest, rec;
+            unsigned int len = GlobalRNG().GenerateWord32(runt, 0xfff);
+            unsigned int plen = GlobalRNG().GenerateWord32(0, 32);
+
+            RandomNumberSource(GlobalRNG(), len, true, new StringSink(src));
+            RandomNumberSource(GlobalRNG(), plen, true, new HexEncoder(new StringSink(pwd)));
+
+            StringSource(src, true, new DefaultEncryptorWithMAC(pwd.c_str(),new StringSink(dest)));
+            StringSource(dest, true, new DefaultDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+            if (src != rec)
+                throw Exception(Exception::OTHER_ERROR, "DefaultEncryptorWithMAC failed a self test");
+
+            // Tamper with the stream. Data format is [SALT][KEYCHECK][ENCRYPTED DATA].
+            try {
+                StringSource(dest.substr(0, len-2), true, new DefaultDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+                std::cout << "FAILED:  DefaultDecryptorWithMAC failed to detect a truncated stream\n";
+                fail2 = true;
+            } catch(const Exception&) { }
+            try {
+                // tamper salt
+                dest[DefaultDecryptorWithMAC::SALTLENGTH/2] ^= 0x01;
+                StringSource(dest, true, new DefaultDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+                std::cout << "FAILED:  DefaultDecryptorWithMAC failed to detect a tampered salt\n";
+                fail2 = true;
+            } catch(const Exception&) { }
+            try {
+                // undo previous tamper
+                dest[DefaultDecryptorWithMAC::SALTLENGTH/2] ^= 0x01;
+                // tamper keycheck
+                dest[DefaultDecryptorWithMAC::SALTLENGTH+DefaultDecryptorWithMAC::KEYLENGTH/2] ^= 0x01;
+                StringSource(dest, true, new DefaultDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+                std::cout << "FAILED:  DefaultDecryptorWithMAC failed to detect a tampered keycheck\n";
+                fail2 = true;
+            } catch(const Exception&) { }
+            try {
+                // undo previous tamper
+                dest[DefaultDecryptorWithMAC::SALTLENGTH+DefaultDecryptorWithMAC::KEYLENGTH/2] ^= 0x01;
+                // tamper encrypted data
+                dest[dest.size()-2] ^= 0x01;
+                StringSource(dest, true, new DefaultDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+                std::cout << "FAILED:  DefaultDecryptorWithMAC failed to detect a tampered data\n";
+                fail2 = true;
+            } catch(const Exception&) { }
+        }
+    }
+    catch(const Exception&)
+    {
+        fail2 = true;
+    }
+
+    if (!fail2)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  " << ENCRYPT_MAC_COUNT << " default encryptions and decryptions with MAC" << std::endl;
+
+    // **************************************************************
+
+    try
+    {
+        for (unsigned int i=0; i<ENCRYPT_COUNT; ++i)
+        {
+            std::string pwd, src, dest, rec;
+            unsigned int len = GlobalRNG().GenerateWord32(16, 0xfff);
+            unsigned int plen = GlobalRNG().GenerateWord32(0, 32);
+
+            RandomNumberSource(GlobalRNG(), len, true, new StringSink(src));
+            RandomNumberSource(GlobalRNG(), plen, true, new HexEncoder(new StringSink(pwd)));
+
+            StringSource(src, true, new LegacyEncryptor(pwd.c_str(),new StringSink(dest)));
+            StringSource(dest, true, new LegacyDecryptor(pwd.c_str(),new StringSink(rec)));
+
+            if (src != rec)
+                throw Exception(Exception::OTHER_ERROR, "LegacyEncryptor failed a self test");
+        }
+    }
+    catch(const Exception&)
+    {
+        fail3 = true;
+    }
+
+    if (!fail3)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  " << ENCRYPT_COUNT << " legacy encryptions and decryptions" << std::endl;
+
+    // **************************************************************
+
+    try
+    {
+        for (unsigned int i=0; i<ENCRYPT_MAC_COUNT; ++i)
+        {
+            const unsigned int runt = EnumToInt(LegacyDecryptorWithMAC::SALTLENGTH) + EnumToInt(LegacyDecryptorWithMAC::KEYLENGTH);
+            std::string pwd, src, dest, rec;
+            unsigned int len = GlobalRNG().GenerateWord32(runt, 0xfff);
+            unsigned int plen = GlobalRNG().GenerateWord32(0, 32);
+
+            RandomNumberSource(GlobalRNG(), len, true, new StringSink(src));
+            RandomNumberSource(GlobalRNG(), plen, true, new HexEncoder(new StringSink(pwd)));
+
+            StringSource(src, true, new LegacyEncryptorWithMAC(pwd.c_str(), new StringSink(dest)));
+            StringSource(dest, true, new LegacyDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+            if (src != rec)
+                throw Exception(Exception::OTHER_ERROR, "LegacyEncryptorWithMAC failed a self test");
+
+            // Tamper with the stream. Data format is [SALT][KEYCHECK][ENCRYPTED DATA].
+            try {
+                StringSource(dest.substr(0, len-2), true, new LegacyDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+                std::cout << "FAILED:  LegacyEncryptorWithMAC failed to detect a truncated stream\n";
+                fail4 = true;
+            } catch(const Exception&) { }
+            try {
+                // tamper salt
+                dest[LegacyEncryptorWithMAC::SALTLENGTH/2] ^= 0x01;
+                StringSource(dest, true, new LegacyDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+                std::cout << "FAILED:  LegacyEncryptorWithMAC failed to detect a tampered salt\n";
+                fail4 = true;
+            } catch(const Exception&) { }
+            try {
+                // undo previous tamper
+                dest[LegacyEncryptorWithMAC::SALTLENGTH/2] ^= 0x01;
+                // tamper keycheck
+                dest[LegacyEncryptorWithMAC::SALTLENGTH+LegacyEncryptorWithMAC::KEYLENGTH/2] ^= 0x01;
+                StringSource(dest, true, new LegacyDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+                std::cout << "FAILED:  LegacyEncryptorWithMAC failed to detect a tampered keycheck\n";
+                fail4 = true;
+            } catch(const Exception&) { }
+            try {
+                // undo previous tamper
+                dest[LegacyEncryptorWithMAC::SALTLENGTH+LegacyEncryptorWithMAC::KEYLENGTH/2] ^= 0x01;
+                // tamper encrypted data
+                dest[dest.size()-2] ^= 0x01;
+                StringSource(dest, true, new LegacyDecryptorWithMAC(pwd.c_str(), new StringSink(rec)));
+                std::cout << "FAILED:  LegacyEncryptorWithMAC failed to detect a tampered data\n";
+                fail4 = true;
+            } catch(const Exception&) { }
+        }
+    }
+    catch(const Exception&)
+    {
+        fail4 = true;
+    }
+
+    if (!fail4)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  " << ENCRYPT_MAC_COUNT << " legacy encryptions and decryptions with MAC" << std::endl;
+
+    return !fail0 && !fail1 && !fail2 && !fail3 && !fail4;
+}
+
+// Information Dispesal and Secret Sharing
+bool TestSharing()
+{
+    std::cout << "\nInformation Dispersal and Secret Sharing...\n\n";
+    const unsigned int INFORMATION_SHARES = 64;
+    const unsigned int SECRET_SHARES = 64;
+    const unsigned int CHID_LENGTH = 4;
+    bool pass=true, fail=false;
+
+    // ********** Infrmation Dispersal **********//
+
+    for (unsigned int shares=3; shares<INFORMATION_SHARES; ++shares)
+    {
+        std::string message;
+        unsigned int len = GlobalRNG().GenerateWord32(4, 0xff);
+        unsigned int threshold = GlobalRNG().GenerateWord32(2, shares-1);
+
+        RandomNumberSource(GlobalRNG(), len, true, new StringSink(message));
+
+        ChannelSwitch *channelSwitch = NULLPTR;
+        StringSource source(message, false, new InformationDispersal(threshold, shares, channelSwitch = new ChannelSwitch));
+
+        std::vector<std::string> strShares(shares);
+        vector_member_ptrs<StringSink> strSinks(shares);
+        std::string channel;
+
+        // ********** Create Shares
+        for (unsigned int i=0; i<shares; i++)
+        {
+            strSinks[i].reset(new StringSink(strShares[i]));
+            channel = WordToString<word32>(i);
+            strSinks[i]->Put((const byte *)channel.data(), CHID_LENGTH);
+            channelSwitch->AddRoute(channel, *strSinks[i], DEFAULT_CHANNEL);
+        }
+        source.PumpAll();
+
+        // ********** Randomize shares
+
+        GlobalRNG().Shuffle(strShares.begin(), strShares.end());
+
+        // ********** Recover secret
+        try
+        {
+            std::string recovered;
+            InformationRecovery recovery(threshold, new StringSink(recovered));
+
+            vector_member_ptrs<StringSource> strSources(threshold);
+            channel.resize(CHID_LENGTH);
+
+            for (unsigned int i=0; i<threshold; i++)
+            {
+                strSources[i].reset(new StringSource(strShares[i], false));
+                strSources[i]->Pump(CHID_LENGTH);
+                strSources[i]->Get((byte*)&channel[0], CHID_LENGTH);
+                strSources[i]->Attach(new ChannelSwitch(recovery, channel));
+            }
+
+            while (strSources[0]->Pump(256))
+            {
+                for (unsigned int i=1; i<threshold; i++)
+                    strSources[i]->Pump(256);
+            }
+
+            for (unsigned int i=0; i<threshold; i++)
+                strSources[i]->PumpAll();
+
+            fail = (message != recovered);
+        }
+        catch (const Exception&)
+        {
+            fail = true;
+        }
+
+        pass &= !fail;
+    }
+
+    std::cout << (fail ? "FAILED:" : "passed:") << "  " << INFORMATION_SHARES << " information dispersals\n";
+
+    // ********** Secret Sharing **********//
+
+    for (unsigned int shares=3; shares<SECRET_SHARES; ++shares)
+    {
+
+        std::string message;
+        unsigned int len = GlobalRNG().GenerateWord32(4, 0xff);
+        unsigned int threshold = GlobalRNG().GenerateWord32(2, shares-1);
+
+        RandomNumberSource(GlobalRNG(), len, true, new StringSink(message));
+
+        ChannelSwitch *channelSwitch = NULLPTR;
+        StringSource source(message, false, new SecretSharing(GlobalRNG(), threshold, shares, channelSwitch = new ChannelSwitch));
+
+        std::vector<std::string> strShares(shares);
+        vector_member_ptrs<StringSink> strSinks(shares);
+        std::string channel;
+
+        // ********** Create Shares
+        for (unsigned int i=0; i<shares; i++)
+        {
+            strSinks[i].reset(new StringSink(strShares[i]));
+            channel = WordToString<word32>(i);
+            strSinks[i]->Put((const byte *)channel.data(), CHID_LENGTH);
+            channelSwitch->AddRoute(channel, *strSinks[i], DEFAULT_CHANNEL);
+        }
+        source.PumpAll();
+
+        // ********** Randomize shares
+
+        GlobalRNG().Shuffle(strShares.begin(), strShares.end());
+
+        // ********** Recover secret
+        try
+        {
+            std::string recovered;
+            SecretRecovery recovery(threshold, new StringSink(recovered));
+
+            vector_member_ptrs<StringSource> strSources(threshold);
+            channel.resize(CHID_LENGTH);
+            for (unsigned int i=0; i<threshold; i++)
+            {
+                strSources[i].reset(new StringSource(strShares[i], false));
+                strSources[i]->Pump(CHID_LENGTH);
+                strSources[i]->Get((byte*)&channel[0], CHID_LENGTH);
+                strSources[i]->Attach(new ChannelSwitch(recovery, channel));
+            }
+
+            while (strSources[0]->Pump(256))
+            {
+                for (unsigned int i=1; i<threshold; i++)
+                    strSources[i]->Pump(256);
+            }
+
+            for (unsigned int i=0; i<threshold; i++)
+                strSources[i]->PumpAll();
+
+            fail = (message != recovered);
+        }
+        catch (const Exception&)
+        {
+            fail = true;
+        }
+
+        pass &= !fail;
+    }
+
+    std::cout << (fail ? "FAILED:" : "passed:") << "  " << SECRET_SHARES << " secret sharings\n";
+
+    return pass;
+}
+
+bool TestRounding()
+{
+    std::cout << "\nTesting RoundUpToMultipleOf/RoundDownToMultipleOf...\n\n";
+    bool pass=true, fail;
+
+    // ********** byte **********//
+    try
+    {
+        const byte v=0, b=0x08;
+        byte r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, byte, no overflow\n";
+
+    try
+    {
+        const byte v=1, b=0x08;
+        byte r=RoundUpToMultipleOf(v, b);
+        fail = (r != b);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, byte, no overflow\n";
+
+    try
+    {
+        const byte v=0x08, b=0x08;
+        byte r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, byte, no overflow\n";
+
+    try
+    {
+        const byte v=0xf7, b=0x08;
+        byte r=RoundUpToMultipleOf(v, b);
+        fail = (r != 0xf8);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, byte, no overflow\n";
+
+    try
+    {
+        const byte v=0xf8, b=0x08;
+        byte r=RoundUpToMultipleOf(v, b);
+        fail = (r != 0xf8);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, byte, no overflow\n";
+
+    try
+    {
+        const byte v=0xf9, b=0x08;
+        byte r=RoundUpToMultipleOf(v, b);
+        CRYPTOPP_UNUSED(r);
+        fail = true;
+    }
+    catch(const Exception&)
+    {
+        fail = false;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, byte, overflow\n";
+
+    // ********** word16 **********//
+    try
+    {
+        const word16 v=0, b=0x08;
+        word16 r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word16, no overflow\n";
+
+    try
+    {
+        const word16 v=1, b=0x08;
+        word16 r=RoundUpToMultipleOf(v, b);
+        fail = (r != b);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word16, no overflow\n";
+
+    try
+    {
+        const word16 v=0x08, b=0x08;
+        word16 r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word16, no overflow\n";
+
+    try
+    {
+        const word16 v=0xfff7, b=0x08;
+        word16 r=RoundUpToMultipleOf(v, b);
+        fail = (r != 0xfff8);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word16, no overflow\n";
+
+    try
+    {
+        const word16 v=0xfff8, b=0x08;
+        word16 r=RoundUpToMultipleOf(v, b);
+        fail = (r != 0xfff8);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word16, no overflow\n";
+
+    try
+    {
+        const word16 v=0xfff9, b=0x08;
+        word16 r=RoundUpToMultipleOf(v, b);
+        CRYPTOPP_UNUSED(r);
+        fail = true;
+    }
+    catch(const Exception&)
+    {
+        fail = false;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word16, overflow\n";
+
+    // ********** word32 **********//
+    try
+    {
+        const word32 v=0, b=0x08;
+        word32 r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word32, no overflow\n";
+
+    try
+    {
+        const word32 v=1, b=0x08;
+        word32 r=RoundUpToMultipleOf(v, b);
+        fail = (r != b);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word32, no overflow\n";
+
+    try
+    {
+        const word32 v=0x08, b=0x08;
+        word32 r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word32, no overflow\n";
+
+    try
+    {
+        const word32 v=0xfffffff7, b=0x08;
+        word32 r=RoundUpToMultipleOf(v, b);
+        fail = (r != 0xfffffff8);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word32, no overflow\n";
+
+    try
+    {
+        const word32 v=0xfffffff8, b=0x08;
+        word32 r=RoundUpToMultipleOf(v, b);
+        fail = (r != 0xfffffff8);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word32, no overflow\n";
+
+    try
+    {
+        const word32 v=0xfffffff9, b=0x08;
+        word32 r=RoundUpToMultipleOf(v, b);
+        CRYPTOPP_UNUSED(r);
+        fail = true;
+    }
+    catch(const Exception&)
+    {
+        fail = false;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word32, overflow\n";
+
+    // ********** word64 **********//
+    try
+    {
+        const word64 v=0, b=0x08;
+        word64 r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word64, no overflow\n";
+
+    try
+    {
+        const word64 v=1, b=0x08;
+        word64 r=RoundUpToMultipleOf(v, b);
+        fail = (r != b);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word64, no overflow\n";
+
+    try
+    {
+        const word64 v=0x08, b=0x08;
+        word64 r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word64, no overflow\n";
+
+    try
+    {
+        const word64 v=W64LIT(0xffffffffffffff7), b=0x08;
+        word64 r=RoundUpToMultipleOf(v, b);
+        fail = (r != W64LIT(0xffffffffffffff8));
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word64, no overflow\n";
+
+    try
+    {
+        const word64 v=W64LIT(0xffffffffffffff8), b=0x08;
+        word64 r=RoundUpToMultipleOf(v, b);
+        fail = (r != W64LIT(0xffffffffffffff8));
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word64, no overflow\n";
+
+    try
+    {
+        const word64 v=W64LIT(0xfffffffffffffff9), b=0x08;
+        word64 r=RoundUpToMultipleOf(v, b);
+        CRYPTOPP_UNUSED(r);
+        fail = true;
+    }
+    catch(const Exception&)
+    {
+        fail = false;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word64, overflow\n";
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    // ********** word128 **********//
+    try
+    {
+        const word128 v=0, b=0x08;
+        word128 r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word128, no overflow\n";
+
+    try
+    {
+        const word128 v=1, b=0x08;
+        word128 r=RoundUpToMultipleOf(v, b);
+        fail = (r != b);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word128, no overflow\n";
+
+    try
+    {
+        const word128 v=0x08, b=0x08;
+        word128 r=RoundUpToMultipleOf(v, b);
+        fail = (r != v);
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word128, no overflow\n";
+
+    try
+    {
+        // http://stackoverflow.com/q/31461318/608639
+        const word128 h = ((word128)W64LIT(0xffffffffffffffff)) << 64U;
+        const word128 v = h | (word128)W64LIT(0xfffffffffffffff7), b=0x08;
+        word128 r=RoundUpToMultipleOf(v, b);
+        fail = (r != (h | (word128)W64LIT(0xfffffffffffffff8)));
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word128, no overflow\n";
+
+    try
+    {
+        const word128 h = ((word128)W64LIT(0xffffffffffffffff)) << 64U;
+        const word128 v = h | (word128)W64LIT(0xfffffffffffffff8), b=0x08;
+        word128 r=RoundUpToMultipleOf(v, b);
+        fail = (r != (h | (word128)W64LIT(0xfffffffffffffff8)));
+    }
+    catch(const Exception&)
+    {
+        fail = true;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word128, no overflow\n";
+
+    try
+    {
+        const word128 h = ((word128)W64LIT(0xffffffffffffffff)) << 64U;
+        const word128 v = h | (word128)W64LIT(0xfffffffffffffff9), b=0x08;
+        word128 r=RoundUpToMultipleOf(v, b);
+        CRYPTOPP_UNUSED(r);
+        fail = true;
+    }
+    catch(const Exception&)
+    {
+        fail = false;
+    }
+
+    pass = !fail && pass;
+    std::cout << (fail ? "FAILED:" : "passed:") << "  RoundUpToMultipleOf, word128, overflow\n";
+#endif
+
+    return pass;
+}
+#endif
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+struct ASN1_TestTuple
+{
+    ASN1_TestTuple(int tag, int result, const char* data, size_t len) {
+        m_result = result;
+        m_tag = tag;
+        m_data = std::string(data, len);
+    }
+
+    std::string Name() const {
+        return Id2String();
+    }
+
+    const byte* Data() const {
+        return ConstBytePtr(m_data);
+    }
+
+    size_t Size() const {
+        return BytePtrSize(m_data);
+    }
+
+    int Tag() const {
+        return m_tag;
+    }
+
+    int Result() const {
+        return m_result;
+    }
+
+    std::string Id2String() const
+    {
+        switch(m_tag)
+        {
+        case BIT_STRING:
+            return "BIT_STRING";
+        case OCTET_STRING:
+            return "OCTET_STRING";
+        case INTEGER:
+            return "INTEGER";
+        case UTF8_STRING:
+            return "UTF8_STRING";
+        case PRINTABLE_STRING:
+            return "PRINTABLE_STRING";
+        case IA5_STRING:
+            return "IA5_STRING";
+        default:
+            return "Unknown";
+        }
+    }
+
+protected:
+    std::string m_data;
+    int m_tag, m_result;
+};
+
+bool RunASN1TestSet(const ASN1_TestTuple asnTuples[], size_t count)
+{
+    bool pass=true, fail;
+
+    // Disposition
+    enum {REJECT=3, ACCEPT=4};
+
+    for(size_t i=0; i<count; i++)
+    {
+        const ASN1_TestTuple & thisTest = asnTuples[i];
+        ArraySource as1(thisTest.Data(), thisTest.Size(), true);
+        ArraySource as2(thisTest.Data(), thisTest.Size(), true);
+
+        SecByteBlock unused1;
+        std::string unused2;
+        unsigned int unused3;
+        word32 unused4;
+        word64 unused5;
+
+        // Reporting
+        std::string val;
+        HexEncoder encoder(new StringSink(val));
+        encoder.Put(thisTest.Data(), thisTest.Size());
+        encoder.MessageEnd();
+
+        try
+        {
+            byte tag = (byte)thisTest.Tag();
+            switch (tag)
+            {
+                case BIT_STRING:
+                    BERDecodeBitString(as1, unused1, unused3);
+                    break;
+
+                case OCTET_STRING:
+                    BERDecodeOctetString(as1, unused1);
+                    break;
+
+                case INTEGER:
+                    BERDecodeUnsigned(as1, unused4);
+                    BERDecodeUnsigned<word64>(as2, unused5, byte(INTEGER), 0, W64LIT(0xffffffffffffffff));
+                    break;
+
+                case UTF8_STRING: case PRINTABLE_STRING: case IA5_STRING:
+                    BERDecodeTextString(as1, unused2, tag);
+                    break;
+
+                default:
+                    BERGeneralDecoder(as1, tag);
+                    break;
+            }
+
+            fail = thisTest.Result() != ACCEPT;
+        }
+        catch(const Exception&)
+        {
+            fail = thisTest.Result() != REJECT;
+        }
+
+        std::cout << (fail ? "FAILED:" : "passed:") << (thisTest.Result() == ACCEPT ? "  accept " : "  reject ");
+        std::cout << asnTuples[i].Name() << " " << val << "\n";
+        pass = !fail && pass;
+    }
+
+    return pass;
+}
+
+bool TestASN1Parse()
+{
+    std::cout << "\nTesting ASN.1 parser...\n\n";
+
+    bool pass = true;
+
+    // Disposition
+    enum {REJECT=3, ACCEPT=4};
+
+    // All the types Crypto++ recognizes.
+    //   "C" is one content octet with value 0x43.
+    const ASN1_TestTuple bitStrings[] =
+    {
+        // The first "\x00" content octet is the "initial octet" representing unused bits. In the
+        //   primitive encoding form, there may be zero, one or more contents after the initial octet.
+        ASN1_TestTuple(BIT_STRING, ACCEPT, "\x03\x01" "\x00", 3),  // definite length, short form, initial octet, zero subsequent octets
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x01" "\x08", 3),  // definite length, short form, initial octet, zero subsequent octets
+        ASN1_TestTuple(BIT_STRING, ACCEPT, "\x03\x02" "\x00" "C", 4),  // definite length, short form, expected subsequent octets
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x02" "\x08" "C", 4),  // too many unused bits
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x7F" "\x00" "C", 4),  // runt or underrun
+        ASN1_TestTuple(BIT_STRING, ACCEPT, "\x03\x81\x01" "\x00", 4),  // definite length, long form, initial octet, zero subsequent octets
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x81\x01" "\x08", 4),  // definite length, long form, initial octet, zero subsequent octets
+        ASN1_TestTuple(BIT_STRING, ACCEPT, "\x03\x81\x02" "\x00" "C", 5),  // definite length, long form
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x81\x02" "\x08" "C", 5),  // too many unused bits
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x81\xff" "\x00" "C", 5),  // runt or underrun
+        ASN1_TestTuple(BIT_STRING, ACCEPT, "\x03\x82\x00\x02" "\x00" "C", 6),  // definite length, long form
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x82\x00\x02" "\x08" "C", 6),  // too many unused bits
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x82\xff\xff" "\x00" "C", 6),  // runt or underrun
+        ASN1_TestTuple(BIT_STRING, ACCEPT, "\x03\x83\x00\x00\x02" "\x00" "C", 7),  // definite length, long form
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x83\x00\x00\x02" "\x08" "C", 7),  // too many unused bits
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x83\xff\xff\xff" "\x00" "C", 7),  // runt or underrun
+        ASN1_TestTuple(BIT_STRING, ACCEPT, "\x03\x84\x00\x00\x00\x02" "\x00" "C", 8),  // definite length, long form
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x84\x00\x00\x00\x02" "\x08" "C", 8),  // too many unused bits
+        ASN1_TestTuple(BIT_STRING, REJECT, "\x03\x84\xff\xff\xff\xff" "\x00" "C", 8),  // <== Issue 346; requires large allocation
+    };
+
+    pass = RunASN1TestSet(bitStrings, COUNTOF(bitStrings)) && pass;
+
+    const ASN1_TestTuple octetStrings[] =
+    {
+        // In the primitive encoding form, there may be zero, one or more contents.
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x00", 2),  // definite length, short form, zero content octets
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x01" "C", 3),  // definite length, short form, expected content octets
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x02" "C", 3),  // runt or underrun
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x7F" "C", 3),  // runt or underrun
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x81\x00", 3),  // definite length, long form, zero content octets
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x81\x01" "C", 4),  // definite length, long form, expected content octets
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x81\x02" "C", 4),  // runt or underrun
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x81\xff" "C", 4),  // runt or underrun
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x82\x00\x00", 4),  // definite length, long form, zero content octets
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x82\x00\x01" "C", 5),  // definite length, long form, expected content octets
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x82\x00\x02" "C", 5),  // runt or underrun
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x82\xff\xff" "C", 5),  // runt or underrun
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x83\x00\x00\x00", 5),  // definite length, long form, zero content octets
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x83\x00\x00\x01" "C", 6),  // definite length, long form, expected content octets
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x83\x00\x00\x02" "C", 6),  // runt or underrun
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x83\xff\xff\xff" "C", 6),  // runt or underrun
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x84\x00\x00\x00\x00", 6),  // definite length, long form, zero content octets
+        ASN1_TestTuple(OCTET_STRING, ACCEPT, "\x04\x84\x00\x00\x00\x01" "C", 7),  // definite length, long form, expected content octets
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x84\x00\x00\x00\x02" "C", 7),  // runt or underrun
+        ASN1_TestTuple(OCTET_STRING, REJECT, "\x04\x84\xff\xff\xff\xff" "C", 7),  // <== Issue 346; requires large allocation
+    };
+
+    pass = RunASN1TestSet(octetStrings, COUNTOF(octetStrings)) && pass;
+
+    const ASN1_TestTuple utf8Strings[] =
+    {
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x00", 2),  // definite length, short form, zero content octets
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x01" "C", 3),  // definite length, short form, expected content octets
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x02" "C", 3),  // runt or underrun
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x7F" "C", 3),  // runt or underrun
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x81\x00", 3),  // definite length, long form, zero content octets
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x81\x01" "C", 4),  // definite length, long form, expected content octets
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x81\x02" "C", 4),  // runt or underrun
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x81\xff" "C", 4),  // runt or underrun
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x82\x00\x00", 4),  // definite length, long form, zero content octets
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x82\x00\x01" "C", 5),  // definite length, long form, expected content octets
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x82\x00\x02" "C", 5),  // runt or underrun
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x82\xff\xff" "C", 5),  // runt or underrun
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x83\x00\x00\x00", 5),  // definite length, long form, zero content octets
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x83\x00\x00\x01" "C", 6),  // definite length, long form, expected content octets
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x83\x00\x00\x02" "C", 6),  // runt or underrun
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x83\xff\xff\xff" "C", 6),  // runt or underrun
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x84\x00\x00\x00\x00", 6),  // definite length, long form, zero content octets
+        ASN1_TestTuple(UTF8_STRING, ACCEPT, "\x0c\x84\x00\x00\x00\x01" "C", 7),  // definite length, long form, expected content octets
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x84\x00\x00\x00\x02" "C", 7),  // runt or underrun
+        ASN1_TestTuple(UTF8_STRING, REJECT, "\x0c\x84\xff\xff\xff\xff" "C", 7),  // <== Issue 346; requires large allocation
+    };
+
+    pass = RunASN1TestSet(utf8Strings, COUNTOF(utf8Strings)) && pass;
+
+    const ASN1_TestTuple printableStrings[] =
+    {
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x00", 2),  // definite length, short form, zero content octets
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x01" "C", 3),  // definite length, short form, expected content octets
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x02" "C", 3),  // runt or underrun
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x7F" "C", 3),  // runt or underrun
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x81\x00", 3),  // definite length, long form, zero content octets
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x81\x01" "C", 4),  // definite length, long form, expected content octets
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x81\x02" "C", 4),  // runt or underrun
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x81\xff" "C", 4),  // runt or underrun
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x82\x00\x00", 4),  // definite length, long form, zero content octets
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x82\x00\x01" "C", 5),  // definite length, long form, expected content octets
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x82\x00\x02" "C", 5),  // runt or underrun
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x82\xff\xff" "C", 5),  // runt or underrun
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x83\x00\x00\x00", 5),  // definite length, long form, zero content octets
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x83\x00\x00\x01" "C", 6),  // definite length, long form, expected content octets
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x83\x00\x00\x02" "C", 6),  // runt or underrun
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x83\xff\xff\xff" "C", 6),  // runt or underrun
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x84\x00\x00\x00\x00", 6),  // definite length, long form, zero content octets
+        ASN1_TestTuple(PRINTABLE_STRING, ACCEPT, "\x13\x84\x00\x00\x00\x01" "C", 7),  // definite length, long form, expected content octets
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x84\x00\x00\x00\x02" "C", 7),  // runt or underrun
+        ASN1_TestTuple(PRINTABLE_STRING, REJECT, "\x13\x84\xff\xff\xff\xff" "C", 7),  // <== Issue 346; requires large allocation
+    };
+
+    pass = RunASN1TestSet(printableStrings, COUNTOF(printableStrings)) && pass;
+
+    const ASN1_TestTuple ia5Strings[] =
+    {
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x00", 2),  // definite length, short form, zero content octets
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x01" "C", 3),  // definite length, short form, expected content octets
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x02" "C", 3),  // runt or underrun
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x7F" "C", 3),  // runt or underrun
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x81\x00", 3),  // definite length, long form, zero content octets
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x81\x01" "C", 4),  // definite length, long form, expected content octets
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x81\x02" "C", 4),  // runt or underrun
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x81\xff" "C", 4),  // runt or underrun
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x82\x00\x00", 4),  // definite length, long form, zero content octets
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x82\x00\x01" "C", 5),  // definite length, long form, expected content octets
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x82\x00\x02" "C", 5),  // runt or underrun
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x82\xff\xff" "C", 5),  // runt or underrun
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x83\x00\x00\x00", 5),  // definite length, long form, zero content octets
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x83\x00\x00\x01" "C", 6),  // definite length, long form, expected content octets
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x83\x00\x00\x02" "C", 6),  // runt or underrun
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x83\xff\xff\xff" "C", 6),  // runt or underrun
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x84\x00\x00\x00\x00", 6),  // definite length, long form, zero content octets
+        ASN1_TestTuple(IA5_STRING, ACCEPT, "\x16\x84\x00\x00\x00\x01" "C", 7),  // definite length, long form, expected content octets
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x84\x00\x00\x00\x02" "C", 7),  // runt or underrun
+        ASN1_TestTuple(IA5_STRING, REJECT, "\x16\x84\xff\xff\xff\xff" "C", 7),  // <== Issue 346; requires large allocation
+    };
+
+    pass = RunASN1TestSet(ia5Strings, COUNTOF(ia5Strings)) && pass;
+
+    const ASN1_TestTuple integerValues[] =
+    {
+        // 8.3.1 The encoding of an integer value shall be primitive. The contents octets shall consist of one or more octets.
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x00", 2),  // definite length, short form, zero content octets
+        ASN1_TestTuple(INTEGER, ACCEPT, "\x02\x01" "C", 3),  // definite length, short form, expected content octets
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x02" "C", 3),  // runt or underrun
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x7F" "C", 3),  // runt or underrun
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x81\x00", 3),  // definite length, long form, zero content octets
+        ASN1_TestTuple(INTEGER, ACCEPT, "\x02\x81\x01" "C", 4),  // definite length, long form, expected content octets
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x81\x02" "C", 4),  // runt or underrun
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x81\xff" "C", 4),  // runt or underrun
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x82\x00\x00", 4),  // definite length, long form, zero content octets
+        ASN1_TestTuple(INTEGER, ACCEPT, "\x02\x82\x00\x01" "C", 5),  // definite length, long form, expected content octets
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x82\x00\x02" "C", 5),  // runt or underrun
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x82\xff\xff" "C", 5),  // runt or underrun
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x83\x00\x00\x00", 5),  // definite length, long form, zero content octets
+        ASN1_TestTuple(INTEGER, ACCEPT, "\x02\x83\x00\x00\x01" "C", 6),  // definite length, long form, expected content octets
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x83\x00\x00\x02" "C", 6),  // runt or underrun
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x83\xff\xff\xff" "C", 6),  // runt or underrun
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x84\x00\x00\x00\x00", 6),  // definite length, long form, zero content octets
+        ASN1_TestTuple(INTEGER, ACCEPT, "\x02\x84\x00\x00\x00\x01" "C", 7),  // definite length, long form, expected content octets
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x84\x00\x00\x00\x02" "C", 7),  // runt or underrun
+        ASN1_TestTuple(INTEGER, REJECT, "\x02\x84\xff\xff\xff\xff" "C", 7),  // <== Issue 346; requires large allocation
+    };
+
+    pass = RunASN1TestSet(integerValues, COUNTOF(integerValues)) && pass;
+
+    return pass;
+}
+
+bool TestASN1Functions()
+{
+    std::cout << "\nTesting ASN.1 functions...\n\n";
+
+    bool pass = true, fail;
+
+    {
+        const std::string message = "Now is the time for all good men to come to the aide of their country";
+        ByteQueue encoded, reencoded, decoded;
+        size_t len = 0, rlen = 0;
+
+        len = DEREncodeOctetString(encoded, ConstBytePtr(message), BytePtrSize(message));
+        DERReencode(encoded, reencoded);
+        rlen = (size_t)reencoded.MaxRetrievable();
+        (void)BERDecodeOctetString(reencoded, decoded);
+
+        std::string recovered;
+        StringSink sink(recovered);
+        decoded.TransferTo(sink);
+
+        fail = (len != rlen || message != recovered);
+        pass = pass && !fail;
+        CRYPTOPP_ASSERT(!fail);
+
+        std::cout << (fail ? "FAILED" : "passed") << "  ";
+        std::cout << "DEREncodeOctetString" << "\n";
+        std::cout << (fail ? "FAILED" : "passed") << "  ";
+        std::cout << "BERDecodeOctetString" << "\n";
+    }
+
+    {
+        const std::string message = "Now is the time for all good men to come to the aide of their country";
+        const byte asnStringTypes[] = {
+            UTF8_STRING, PRINTABLE_STRING, T61_STRING, VIDEOTEXT_STRING,IA5_STRING, VISIBLE_STRING
+        };
+
+        unsigned int failed = 0;
+        size_t len = 0, rlen = 0, i = 0;
+
+        for (i = 0; i < COUNTOF(asnStringTypes); ++i)
+        {
+            ByteQueue encoded, reencoded, decoded;
+            std::string recovered;
+
+            len = DEREncodeTextString(encoded, ConstBytePtr(message), BytePtrSize(message), asnStringTypes[i]);
+            DERReencode(encoded, reencoded);
+            rlen = (size_t)reencoded.MaxRetrievable();
+            (void)BERDecodeTextString(reencoded, recovered, asnStringTypes[i]);
+
+            fail = (len != rlen || message != recovered);
+            if (fail) failed++;
+            CRYPTOPP_ASSERT(!fail);
+        }
+
+        failed ? fail = true : fail = false;
+        pass = pass && !fail;
+
+        std::cout << (fail ? "FAILED" : "passed") << "  ";
+        std::cout << "DEREncodeTextString" << "\n";
+        std::cout << (fail ? "FAILED" : "passed") << "  ";
+        std::cout << "DEREncodeTextString" << "\n";
+    }
+
+    {
+        const byte date[] = "Sun, 21 Mar 2021 01:00:00 +0000";
+        SecByteBlock message; message.Assign(date, sizeof(date)-1);
+        const byte asnDateTypes[] = {UTC_TIME, GENERALIZED_TIME};
+        unsigned int failed = 0;
+        size_t i = 0;
+
+        for (i = 0; i < COUNTOF(asnDateTypes); ++i)
+        {
+            ByteQueue encoded, decoded;
+            SecByteBlock recovered;
+
+            (void)DEREncodeDate(encoded, message, asnDateTypes[i]);
+            (void)BERDecodeDate(encoded, recovered, asnDateTypes[i]);
+
+            fail = (message != recovered);
+            if (fail) failed++;
+            CRYPTOPP_ASSERT(!fail);
+        }
+
+        failed ? fail = true : fail = false;
+        pass = pass && !fail;
+
+        std::cout << (fail ? "FAILED" : "passed") << "  ";
+        std::cout << "DEREncodeDate" << "\n";
+        std::cout << (fail ? "FAILED" : "passed") << "  ";
+        std::cout << "BERDecodeDate" << "\n";
+    }
+
+    return pass;
+}
+
+#endif
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+bool TestStringSink()
+{
+    try
+    {
+        std::string in = "The quick brown fox jumps over the lazy dog";
+
+        std::string str;
+        StringSource s1(in, true, new StringSink(str));
+
+        std::vector<byte> vec;
+        StringSource s2(in, true, new VectorSink(vec));
+
+        std::vector<byte> vec2;
+        VectorSource s3(vec, true, new VectorSink(vec2));
+
+        return str.size() == vec.size() &&
+            std::equal(str.begin(), str.end(), vec.begin()) &&
+            vec.size() == vec2.size() &&
+            std::equal(vec.begin(), vec.end(), vec2.begin());
+    }
+    catch(const std::exception&)
+    {
+    }
+    return false;
+}
+#endif
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validat1.cpp b/runtime/third_party/cryptopp/validat1.cpp
new file mode 100644
index 0000000..6aa4e60
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat1.cpp
@@ -0,0 +1,1225 @@
+// validat1.cpp - originally written and placed in the public domain by Wei Dai and Jeffrey Walton
+//                Routines in this source file are only tested in Debug builds.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "secblock.h"
+#include "gzip.h"
+#include "zlib.h"
+
+#if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+# include "ppc_simd.h"
+#endif
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+bool TestSecBlock()
+{
+    std::cout << "\nTesting SecBlock...\n\n";
+
+    bool pass1=true, pass2=true, pass3=true, pass4=true, pass5=true, pass6=true, pass7=true, temp=false;
+
+    //************ Allocators ************//
+
+    {
+        std::basic_string<char, std::char_traits<char>, AllocatorWithCleanup<char, false> > s1;
+        std::basic_string<char, std::char_traits<char>, AllocatorWithCleanup<char,  true> > s2;
+        s1.resize(1024); s2.resize(1024);
+
+        std::vector<byte, AllocatorWithCleanup<byte, false> > v1;
+        std::vector<byte, AllocatorWithCleanup<byte,  true> > v2;
+        v1.resize(1024); v2.resize(1024);
+    }
+
+    //********** Zeroized block **********//
+
+    {
+        // NULL ptr with a size means to create a new SecBlock with all elements zero'd
+        SecByteBlock z1(NULLPTR, 256);
+        temp = true;
+
+        for (size_t i = 0; i < z1.size(); i++)
+            temp &= (z1[i] == 0);
+
+        pass1 &= temp;
+        if (!temp)
+            std::cout << "FAILED:";
+        else
+            std::cout << "passed:";
+        std::cout << "  Zeroized byte array\n";
+
+        SecBlock<word32> z2(NULLPTR, 256);
+        temp = true;
+
+        for (size_t i = 0; i < z2.size(); i++)
+            temp &= (z2[i] == 0);
+
+        pass1 &= temp;
+        if (!temp)
+            std::cout << "FAILED:";
+        else
+            std::cout << "passed:";
+        std::cout << "  Zeroized word32 array\n";
+
+        SecBlock<word64> z3(NULLPTR, 256);
+        temp = true;
+
+        for (size_t i = 0; i < z3.size(); i++)
+            temp &= (z3[i] == 0);
+
+        pass1 &= temp;
+        if (!temp)
+            std::cout << "FAILED:";
+        else
+            std::cout << "passed:";
+        std::cout << "  Zeroized word64 array\n";
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+        SecBlock<word128> z4(NULLPTR, 256);
+        temp = true;
+
+        for (size_t i = 0; i < z4.size(); i++)
+            temp &= (z4[i] == 0);
+
+        pass1 &= temp;
+        if (!temp)
+            std::cout << "FAILED:";
+        else
+            std::cout << "passed:";
+        std::cout << "  Zeroized word128 array\n";
+#endif
+    }
+
+    //********** Non-zero'd block **********//
+
+    {
+        SecByteBlock z1(NULLPTR, 256);
+        z1.SetMark(0);
+
+        SecBlock<word32> z2(NULLPTR, 256);
+        z2.SetMark(0);
+
+        SecBlock<word64> z3(NULLPTR, 256);
+        z3.SetMark(0);
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+        SecBlock<word128> z4(NULLPTR, 256);
+        z4.SetMark(0);
+#endif
+    }
+
+    //********** Assign **********//
+
+    try
+    {
+        SecByteBlock a, b;
+        temp = true;
+
+        a.Assign((const byte*)"a", 1);
+        b.Assign((const byte*)"b", 1);
+
+        temp &= (a.SizeInBytes() == 1);
+        temp &= (b.SizeInBytes() == 1);
+        temp &= (a[0] == 'a');
+        temp &= (b[0] == 'b');
+
+        a.Assign((const byte*)"ab", 2);
+        b.Assign((const byte*)"cd", 2);
+
+        temp &= (a.SizeInBytes() == 2);
+        temp &= (b.SizeInBytes() == 2);
+        temp &= (a[0] == 'a' && a[1] == 'b');
+        temp &= (b[0] == 'c' && b[1] == 'd');
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass2 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Assign byte\n";
+
+    try
+    {
+        SecBlock<word32> a, b;
+        temp = true;
+
+        word32 one[1] = {1}, two[1] = {2};
+        a.Assign(one, 1);
+        b.Assign(two, 1);
+
+        temp &= (a.SizeInBytes() == 4);
+        temp &= (b.SizeInBytes() == 4);
+        temp &= (a[0] == 1);
+        temp &= (b[0] == 2);
+
+        word32 three[2] = {1,2}, four[2] = {3,4};
+        a.Assign(three, 2);
+        b.Assign(four, 2);
+
+        temp &= (a.SizeInBytes() == 8);
+        temp &= (b.SizeInBytes() == 8);
+        temp &= (a[0] == 1 && a[1] == 2);
+        temp &= (b[0] == 3 && b[1] == 4);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass2 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Assign word32\n";
+
+    try
+    {
+        SecBlock<word64> a, b;
+        temp = true;
+
+        word64 one[1] = {1}, two[1] = {2};
+        a.Assign(one, 1);
+        b.Assign(two, 1);
+
+        temp &= (a.SizeInBytes() == 8);
+        temp &= (b.SizeInBytes() == 8);
+        temp &= (a[0] == 1);
+        temp &= (b[0] == 2);
+
+        word64 three[2] = {1,2}, four[2] = {3,4};
+        a.Assign(three, 2);
+        b.Assign(four, 2);
+
+        temp &= (a.SizeInBytes() == 16);
+        temp &= (b.SizeInBytes() == 16);
+        temp &= (a[0] == 1 && a[1] == 2);
+        temp &= (b[0] == 3 && b[1] == 4);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass2 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Assign word64\n";
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    try
+    {
+        SecBlock<word128> a, b;
+        temp = true;
+
+        word128 one[1] = {1}, two[1] = {2};
+        a.Assign(one, 1);
+        b.Assign(two, 1);
+
+        temp &= (a.SizeInBytes() == 16);
+        temp &= (b.SizeInBytes() == 16);
+        temp &= (a[0] == 1);
+        temp &= (b[0] == 2);
+
+        word128 three[2] = {1,2}, four[2] = {3,4};
+        a.Assign(three, 2);
+        b.Assign(four, 2);
+
+        temp &= (a.SizeInBytes() == 32);
+        temp &= (b.SizeInBytes() == 32);
+        temp &= (a[0] == 1 && a[1] == 2);
+        temp &= (b[0] == 3 && b[1] == 4);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass2 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Assign word128\n";
+#endif
+
+    //********** Append **********//
+
+    try
+    {
+        SecByteBlock a, b;
+        temp = true;
+
+        a.Assign((const byte*)"a", 1);
+        b.Assign((const byte*)"b", 1);
+
+        a += b;
+        temp &= (a.SizeInBytes() == 2);
+        temp &= (a[0] == 'a' && a[1] == 'b');
+
+        a.Assign((const byte*)"ab", 2);
+        b.Assign((const byte*)"cd", 2);
+
+        a += b;
+        temp &= (a.SizeInBytes() == 4);
+        temp &= (a[0] == 'a' && a[1] == 'b' && a[2] == 'c' && a[3] == 'd');
+
+        a.Assign((const byte*)"a", 1);
+
+        a += a;
+        temp &= (a.SizeInBytes() == 2);
+        temp &= (a[0] == 'a' && a[1] == 'a');
+
+        a.Assign((const byte*)"ab", 2);
+
+        a += a;
+        temp &= (a.SizeInBytes() == 4);
+        temp &= (a[0] == 'a' && a[1] == 'b' && a[2] == 'a' && a[3] == 'b');
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass3 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Append byte\n";
+
+    try
+    {
+        SecBlock<word32> a, b;
+        temp = true;
+
+        const word32 one[1] = {1}, two[1] = {2};
+        a.Assign(one, 1);
+        b.Assign(two, 1);
+
+        a += b;
+        temp &= (a.SizeInBytes() == 8);
+        temp &= (a[0] == 1 && a[1] == 2);
+
+        const word32 three[2] = {1,2}, four[2] = {3,4};
+        a.Assign(three, 2);
+        b.Assign(four, 2);
+
+        a += b;
+        temp &= (a.SizeInBytes() == 16);
+        temp &= (a[0] == 1 && a[1] == 2 && a[2] == 3 && a[3] == 4);
+
+        a.Assign(one, 1);
+
+        a += a;
+        temp &= (a.SizeInBytes() == 8);
+        temp &= (a[0] == 1 && a[1] == 1);
+
+        a.Assign(three, 2);
+
+        a += a;
+        temp &= (a.SizeInBytes() == 16);
+        temp &= (a[0] == 1 && a[1] == 2 && a[2] == 1 && a[3] == 2);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass3 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Append word32\n";
+
+    try
+    {
+        SecBlock<word64> a, b;
+        temp = true;
+
+        const word64 one[1] = {1}, two[1] = {2};
+        a.Assign(one, 1);
+        b.Assign(two, 1);
+
+        a += b;
+        temp &= (a.SizeInBytes() == 16);
+        temp &= (a[0] == 1 && a[1] == 2);
+
+        const word64 three[2] = {1,2}, four[2] = {3,4};
+        a.Assign(three, 2);
+        b.Assign(four, 2);
+
+        a += b;
+        temp &= (a.SizeInBytes() == 32);
+        temp &= (a[0] == 1 && a[1] == 2 && a[2] == 3 && a[3] == 4);
+
+        a.Assign(one, 1);
+
+        a += a;
+        temp &= (a.SizeInBytes() == 16);
+        temp &= (a[0] == 1 && a[1] == 1);
+
+        a.Assign(three, 2);
+
+        a += a;
+        temp &= (a.SizeInBytes() == 32);
+        temp &= (a[0] == 1 && a[1] == 2 && a[2] == 1 && a[3] == 2);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass3 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Append word64\n";
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    try
+    {
+        SecBlock<word128> a, b;
+        temp = true;
+
+        const word128 one[1] = {1}, two[1] = {2};
+        a.Assign(one, 1);
+        b.Assign(two, 1);
+
+        a += b;
+        temp &= (a.SizeInBytes() == 32);
+        temp &= (a[0] == 1 && a[1] == 2);
+
+        const word128 three[2] = {1,2}, four[2] = {3,4};
+        a.Assign(three, 2);
+        b.Assign(four, 2);
+
+        a += b;
+        temp &= (a.SizeInBytes() == 64);
+        temp &= (a[0] == 1 && a[1] == 2 && a[2] == 3 && a[3] == 4);
+
+        a.Assign(one, 1);
+
+        a += a;
+        temp &= (a.SizeInBytes() == 32);
+        temp &= (a[0] == 1 && a[1] == 1);
+
+        a.Assign(three, 2);
+
+        a += a;
+        temp &= (a.SizeInBytes() == 64);
+        temp &= (a[0] == 1 && a[1] == 2 && a[2] == 1 && a[3] == 2);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass3 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Append word128\n";
+#endif
+
+    //********** Concatenate **********//
+
+    // byte
+    try
+    {
+        SecByteBlock a, b, c;
+        temp = true;
+
+        a.Assign((const byte*)"a", 1);
+        b.Assign((const byte*)"b", 1);
+
+        c = a + b;
+        temp &= (a[0] == 'a');
+        temp &= (b[0] == 'b');
+        temp &= (c.SizeInBytes() == 2);
+        temp &= (c[0] == 'a' && c[1] == 'b');
+
+        a.Assign((const byte*)"ab", 2);
+        b.Assign((const byte*)"cd", 2);
+
+        c = a + b;
+        temp &= (a[0] == 'a' && a[1] == 'b');
+        temp &= (b[0] == 'c' && b[1] == 'd');
+        temp &= (c.SizeInBytes() == 4);
+        temp &= (c[0] == 'a' && c[1] == 'b' && c[2] == 'c' && c[3] == 'd');
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass4 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Concatenate byte\n";
+
+    // word32
+    try
+    {
+        SecBlock<word32> a, b, c;
+        temp = true;
+
+        const word32 one[1] = {1}, two[1] = {2};
+        a.Assign(one, 1);
+        b.Assign(two, 1);
+
+        c = a + b;
+        temp &= (a[0] == 1);
+        temp &= (b[0] == 2);
+        temp &= (c.SizeInBytes() == 8);
+        temp &= (c[0] == 1 && c[1] == 2);
+
+        const word32 three[2] = {1,2}, four[2] = {3,4};
+        a.Assign(three, 2);
+        b.Assign(four, 2);
+
+        c = a + b;
+        temp &= (a[0] == 1 && a[1] == 2);
+        temp &= (b[0] == 3 && b[1] == 4);
+        temp &= (c.SizeInBytes() == 16);
+        temp &= (c[0] == 1 && c[1] == 2 && c[2] == 3 && c[3] == 4);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass4 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Concatenate word32\n";
+
+    // word64
+    try
+    {
+        SecBlock<word64> a, b, c;
+        temp = true;
+
+        const word64 one[1] = {1}, two[1] = {2};
+        a.Assign(one, 1);
+        b.Assign(two, 1);
+
+        c = a + b;
+        temp &= (a[0] == 1);
+        temp &= (b[0] == 2);
+        temp &= (c.SizeInBytes() == 16);
+        temp &= (c[0] == 1 && c[1] == 2);
+
+        const word64 three[2] = {1,2}, four[2] = {3,4};
+        a.Assign(three, 2);
+        b.Assign(four, 2);
+
+        c = a + b;
+        temp &= (a[0] == 1 && a[1] == 2);
+        temp &= (b[0] == 3 && b[1] == 4);
+        temp &= (c.SizeInBytes() == 32);
+        temp &= (c[0] == 1 && c[1] == 2 && c[2] == 3 && c[3] == 4);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass4 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Concatenate word64\n";
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    try
+    {
+        SecBlock<word128> a, b, c;
+        temp = true;
+
+        const word128 one[1] = {1}, two[1] = {2};
+        a.Assign(one, 1);
+        b.Assign(two, 1);
+
+        c = a + b;
+        temp &= (a[0] == 1);
+        temp &= (b[0] == 2);
+        temp &= (c.SizeInBytes() == 32);
+        temp &= (c[0] == 1 && c[1] == 2);
+
+        const word128 three[2] = {1,2}, four[2] = {3,4};
+        a.Assign(three, 2);
+        b.Assign(four, 2);
+
+        c = a + b;
+        temp &= (a[0] == 1 && a[1] == 2);
+        temp &= (b[0] == 3 && b[1] == 4);
+        temp &= (c.SizeInBytes() == 64);
+        temp &= (c[0] == 1 && c[1] == 2 && c[2] == 3 && c[3] == 4);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass4 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Concatenate word128\n";
+#endif
+
+    //********** Equality **********//
+
+    // byte
+    try
+    {
+        static const byte str1[] = "abcdefghijklmnopqrstuvwxyz";
+        static const byte str2[] = "zyxwvutsrqponmlkjihgfedcba";
+        static const byte str3[] = "0123456789";
+
+        temp = true;
+        SecByteBlock a,b;
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str1, COUNTOF(str1));
+        temp &= (a.operator==(b));
+
+        a.Assign(str3, COUNTOF(str3));
+        b.Assign(str3, COUNTOF(str3));
+        temp &= (a == b);
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str2, COUNTOF(str2));
+        temp &= (a.operator!=(b));
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str3, COUNTOF(str3));
+        temp &= (a != b);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass5 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Equality byte\n";
+
+    // word32
+    try
+    {
+        static const word32 str1[] = {2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97};
+        static const word32 str2[] = {97,89,83,79,73,71,67,61,59,53,47,43,41,37,31,29,23,19,17,13,11,7,5,3,2};
+        static const word32 str3[] = {0,1,2,3,4,5,6,7,8,9};
+
+        temp = true;
+        SecBlock<word32> a,b;
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str1, COUNTOF(str1));
+        temp &= (a.operator==(b));
+
+        a.Assign(str3, COUNTOF(str3));
+        b.Assign(str3, COUNTOF(str3));
+        temp &= (a == b);
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str2, COUNTOF(str2));
+        temp &= (a.operator!=(b));
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str3, COUNTOF(str3));
+        temp &= (a != b);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass5 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Equality word32\n";
+
+    // word64
+    try
+    {
+        static const word64 str1[] = {2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97};
+        static const word64 str2[] = {97,89,83,79,73,71,67,61,59,53,47,43,41,37,31,29,23,19,17,13,11,7,5,3,2};
+        static const word64 str3[] = {0,1,2,3,4,5,6,7,8,9};
+
+        temp = true;
+        SecBlock<word64> a,b;
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str1, COUNTOF(str1));
+        temp &= (a.operator==(b));
+
+        a.Assign(str3, COUNTOF(str3));
+        b.Assign(str3, COUNTOF(str3));
+        temp &= (a == b);
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str2, COUNTOF(str2));
+        temp &= (a.operator!=(b));
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str3, COUNTOF(str3));
+        temp &= (a != b);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass5 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Equality word64\n";
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    // word128
+    try
+    {
+        static const word128 str1[] = {2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97};
+        static const word128 str2[] = {97,89,83,79,73,71,67,61,59,53,47,43,41,37,31,29,23,19,17,13,11,7,5,3,2};
+        static const word128 str3[] = {0,1,2,3,4,5,6,7,8,9};
+
+        temp = true;
+        SecBlock<word128> a,b;
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str1, COUNTOF(str1));
+        temp &= (a.operator==(b));
+
+        a.Assign(str3, COUNTOF(str3));
+        b.Assign(str3, COUNTOF(str3));
+        temp &= (a == b);
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str2, COUNTOF(str2));
+        temp &= (a.operator!=(b));
+
+        a.Assign(str1, COUNTOF(str1));
+        b.Assign(str3, COUNTOF(str3));
+        temp &= (a != b);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass5 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Equality word128\n";
+#endif
+
+    //********** Allocator Size/Overflow **********//
+
+    try
+    {
+        temp = false;
+
+        AllocatorBase<word32> A;
+        const size_t max = A.max_size();
+        SecBlock<word32> t(max+1);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = true;
+    }
+    catch(const std::exception& /*ex*/)
+    {
+        temp = true;
+    }
+
+    pass6 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Overflow word32\n";
+
+    try
+    {
+        temp = false;
+
+        AllocatorBase<word64> A;
+        const size_t max = A.max_size();
+        SecBlock<word64> t(max+1);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = true;
+    }
+    catch(const std::exception& /*ex*/)
+    {
+        temp = true;
+    }
+
+    pass6 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Overflow word64\n";
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    try
+    {
+        temp = false;
+
+        AllocatorBase<word128> A;
+        const size_t max = A.max_size();
+        SecBlock<word128> t(max+1);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = true;
+    }
+    catch(const std::exception& /*ex*/)
+    {
+        temp = true;
+    }
+
+    pass6 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Overflow word128\n";
+#endif
+
+    //********** FixedSizeAllocatorWithCleanup and Grow **********//
+
+    // byte
+    try
+    {
+        static const unsigned int SIZE = 8;
+        SecBlockWithHint<byte, SIZE> block(SIZE);
+        std::memset(block, 0xaa, block.SizeInBytes());
+
+        temp = true;
+        block.CleanGrow(SIZE*2);
+        temp &= (block.size() == SIZE*2);
+
+        for (size_t i = 0; i < block.size()/2; i++)
+            temp &= (block[i] == 0xaa);
+        for (size_t i = block.size()/2; i < block.size(); i++)
+            temp &= (block[i] == 0);
+
+        block.CleanNew(SIZE*4);
+        temp &= (block.size() == SIZE*4);
+        for (size_t i = 0; i < block.size(); i++)
+            temp &= (block[i] == 0);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+    catch(const std::exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass7 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  FixedSizeAllocator Grow with byte\n";
+
+    // word32
+    try
+    {
+        static const unsigned int SIZE = 8;
+        SecBlockWithHint<word32, SIZE> block(SIZE);
+        std::memset(block, 0xaa, block.SizeInBytes());
+
+        temp = true;
+        block.CleanGrow(SIZE*2);
+        temp &= (block.size() == SIZE*2);
+
+        for (size_t i = 0; i < block.size()/2; i++)
+            temp &= (block[i] == 0xaaaaaaaa);
+
+        for (size_t i = block.size()/2; i < block.size(); i++)
+            temp &= (block[i] == 0);
+
+        block.CleanNew(SIZE*4);
+        temp &= (block.size() == SIZE*4);
+        for (size_t i = 0; i < block.size(); i++)
+            temp &= (block[i] == 0);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+    catch(const std::exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass7 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  FixedSizeAllocator Grow with word32\n";
+
+    // word64
+    try
+    {
+        static const unsigned int SIZE = 8;
+        SecBlockWithHint<word64, SIZE> block(SIZE);
+        std::memset(block, 0xaa, block.SizeInBytes());
+
+        temp = true;
+        block.CleanGrow(SIZE*2);
+        temp &= (block.size() == SIZE*2);
+
+        for (size_t i = 0; i < block.size()/2; i++)
+            temp &= (block[i] == W64LIT(0xaaaaaaaaaaaaaaaa));
+
+        for (size_t i = block.size()/2; i < block.size(); i++)
+            temp &= (block[i] == 0);
+
+        block.CleanNew(SIZE*4);
+        temp &= (block.size() == SIZE*4);
+        for (size_t i = 0; i < block.size(); i++)
+            temp &= (block[i] == 0);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+    catch(const std::exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass7 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  FixedSizeAllocator Grow with word64\n";
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    // word128
+    try
+    {
+        static const unsigned int SIZE = 8;
+        SecBlock<word128, AllocatorWithCleanup<word128, true> > block(SIZE);
+        std::memset(block, 0xaa, block.SizeInBytes());
+
+        temp = true;
+        block.CleanGrow(SIZE*2);
+        temp &= (block.size() == SIZE*2);
+
+        for (size_t i = 0; i < block.size()/2; i++)
+            temp &= (block[i] == (((word128)W64LIT(0xaaaaaaaaaaaaaaaa) << 64U) | W64LIT(0xaaaaaaaaaaaaaaaa)));
+
+        for (size_t i = block.size()/2; i < block.size(); i++)
+            temp &= (block[i] == 0);
+
+        block.CleanNew(SIZE*4);
+        temp &= (block.size() == SIZE*4);
+        for (size_t i = 0; i < block.size(); i++)
+            temp &= (block[i] == 0);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        temp = false;
+    }
+    catch(const std::exception& /*ex*/)
+    {
+        temp = false;
+    }
+
+    pass7 &= temp;
+    if (!temp)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  FixedSizeAllocator Grow with word128\n";
+#endif
+
+    return pass1 && pass2 && pass3 && pass4 && pass5 && pass6 && pass7;
+}
+#endif
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+bool TestHuffmanCodes()
+{
+    std::cout << "\nTesting Huffman codes...\n\n";
+    bool pass=true;
+
+    static const size_t nCodes = 30;
+    const unsigned int codeCounts[nCodes] = {
+        1, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+
+    static const unsigned int maxCodeBits = nCodes >> 1;
+    unsigned int codeBits[nCodes] = {
+        ~0u, ~0u, ~0u, ~0u, ~0u,
+        ~0u, ~0u, ~0u, ~0u, ~0u,
+        ~0u, ~0u, ~0u, ~0u, ~0u,
+    };
+
+    try
+    {
+        HuffmanEncoder::GenerateCodeLengths(codeBits, maxCodeBits, codeCounts, nCodes);
+    }
+    catch(const Exception& /*ex*/)
+    {
+        pass=false;
+    }
+
+    if (!pass)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  GenerateCodeLengths" << std::endl;
+
+    // Try to crash the HuffmanDecoder
+    for (unsigned int i=0; i<128; ++i)
+    {
+        try
+        {
+            byte data1[0xfff];  // Place on stack, avoid new
+            unsigned int data2[0xff];
+
+            unsigned int len1 = GlobalRNG().GenerateWord32(4, 0xfff);
+            GlobalRNG().GenerateBlock(data1, len1);
+            unsigned int len2 = GlobalRNG().GenerateWord32(4, 0xff);
+            GlobalRNG().GenerateBlock((byte*)data2, len2*sizeof(unsigned int));
+
+            ArraySource source(data1, len1, false);
+            HuffmanDecoder decoder(data2, len2);
+
+            LowFirstBitReader reader(source);
+            unsigned int val;
+            for (unsigned int j=0; !source.AnyRetrievable(); ++j)
+                decoder.Decode(reader, val);
+        }
+        catch (const Exception&) {}
+    }
+
+    std::cout << "passed:  HuffmanDecoder decode" << std::endl;
+
+    return pass;
+}
+#endif
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+# if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+bool TestAltivecOps()
+{
+    std::cout << "\nTesting Altivec operations...\n\n";
+
+    if (HasAltivec() == false)
+    {
+        std::cout << "\nAltivec not available, skipping test." << std::endl;
+        return true;
+    }
+
+    // These tests may seem superfluous, but we really want to test the
+    // Altivec/POWER4 implementation. That does not happen when POWER7
+    // or POWER8 is available because we use POWER7's unaligned loads
+    // and stores with POWER8's AES, SHA, etc. These tests enage
+    // Altivec/POWER4 without POWER7, like on an old PowerMac.
+
+    //********** Unaligned loads and stores **********//
+    bool pass1=true;
+
+    CRYPTOPP_ALIGN_DATA(16)
+    byte dest[20], src[20] = {23,22,21,20,19,18,17,16,15,14,13,12,11,10,9,8,7,6,5,4};
+    const byte st1[16] = {22,21,20,19,18,17,16,15,14,13,12,11,10,9,8,7};
+    const byte st2[16] = {21,20,19,18,17,16,15,14,13,12,11,10,9,8,7,6};
+    const byte st3[16] = {20,19,18,17,16,15,14,13,12,11,10,9,8,7,6,5};
+
+    VecStore(VecLoad(src), dest);
+    pass1 = (0 == std::memcmp(src, dest, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+
+    VecStore(VecLoad(src+1), dest+1);
+    pass1 = (0 == std::memcmp(st1, dest+1, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+
+    VecStore(VecLoad(src+2), dest+2);
+    pass1 = (0 == std::memcmp(st2, dest+2, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+
+    VecStore(VecLoad(src+3), dest+3);
+    pass1 = (0 == std::memcmp(st3, dest+3, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+
+    VecStoreBE(VecLoadBE(src), dest);
+    pass1 = (0 == std::memcmp(src, dest, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+
+    VecStoreBE(VecLoadBE(src+1), dest+1);
+    pass1 = (0 == std::memcmp(st1, dest+1, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+
+    VecStoreBE(VecLoadBE(src+2), dest+2);
+    pass1 = (0 == std::memcmp(st2, dest+2, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+
+    VecStoreBE(VecLoadBE(src+3), dest+3);
+    pass1 = (0 == std::memcmp(st3, dest+3, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+
+#if (CRYPTOPP_LITTLE_ENDIAN)
+    VecStore(VecLoadBE(src), dest);
+    pass1 = (0 != std::memcmp(src, dest, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+
+    VecStoreBE(VecLoad(src), dest);
+    pass1 = (0 != std::memcmp(src, dest, 16)) && pass1;
+    CRYPTOPP_ASSERT(pass1);
+#endif
+
+    if (!pass1)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Altivec loads and stores" << std::endl;
+
+    //********** Shifts **********//
+    bool pass2=true;
+
+    uint8x16_p val = {0xff,0xff,0xff,0xff, 0xff,0xff,0xff,0xff,
+                      0xff,0xff,0xff,0xff, 0xff,0xff,0xff,0xff};
+
+    pass2 = (VecEqual(val, VecShiftLeftOctet<0>(val))) && pass2;
+    CRYPTOPP_ASSERT(pass2);
+    pass2 = (VecEqual(val, VecShiftRightOctet<0>(val))) && pass2;
+    CRYPTOPP_ASSERT(pass2);
+
+    uint8x16_p lsh1 = {0xff,0xff,0xff,0xff, 0xff,0xff,0xff,0xff,
+                       0xff,0xff,0xff,0xff, 0xff,0xff,0xff,0x00};
+    uint8x16_p rsh1 = {0x00,0xff,0xff,0xff, 0xff,0xff,0xff,0xff,
+                       0xff,0xff,0xff,0xff, 0xff,0xff,0xff,0xff};
+
+    pass2 = (VecEqual(lsh1, VecShiftLeftOctet<1>(val))) && pass2;
+    CRYPTOPP_ASSERT(pass2);
+    pass2 = (VecEqual(rsh1, VecShiftRightOctet<1>(val))) && pass2;
+    CRYPTOPP_ASSERT(pass2);
+
+    uint8x16_p lsh15 = {0xff,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
+                        0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00};
+    uint8x16_p rsh15 = {0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
+                        0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0xff};
+
+    pass2 = (VecEqual(lsh15, VecShiftLeftOctet<15>(val))) && pass2;
+    CRYPTOPP_ASSERT(pass2);
+    pass2 = (VecEqual(rsh15, VecShiftRightOctet<15>(val))) && pass2;
+    CRYPTOPP_ASSERT(pass2);
+
+    uint8x16_p lsh16 = {0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
+                        0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00};
+    uint8x16_p rsh16 = {0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
+                        0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00};
+
+    pass2 = (VecEqual(lsh16, VecShiftLeftOctet<16>(val))) && pass2;
+    CRYPTOPP_ASSERT(pass2);
+    pass2 = (VecEqual(rsh16, VecShiftRightOctet<16>(val))) && pass2;
+    CRYPTOPP_ASSERT(pass2);
+
+    if (!pass2)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Altivec left and right shifts" << std::endl;
+
+    //********** Extraction **********//
+    bool pass3=true;
+
+    const byte bex1[] = {0x1f,0x1e,0x1d,0x1c, 0x1b,0x1a,0x19,0x18,
+                         0x17,0x16,0x15,0x14, 0x13,0x12,0x11,0x10};
+    const byte bex2[] = {0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
+                         0x17,0x16,0x15,0x14, 0x13,0x12,0x11,0x10};
+    const byte bex3[] = {0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
+                         0x1f,0x1e,0x1d,0x1c, 0x1b,0x1a,0x19,0x18};
+
+    const uint8x16_p ex1 = (uint8x16_p)VecLoad(bex1);
+    const uint8x16_p ex2 = (uint8x16_p)VecLoad(bex2);
+    const uint8x16_p ex3 = (uint8x16_p)VecLoad(bex3);
+
+    pass3 = VecEqual(ex2, VecGetLow(ex1)) && pass3;
+    CRYPTOPP_ASSERT(pass3);
+    pass3 = VecEqual(ex3, VecGetHigh(ex1)) && pass3;
+    CRYPTOPP_ASSERT(pass3);
+
+    uint8x16_p ex4 = VecShiftRightOctet<8>(VecShiftLeftOctet<8>(ex1));
+    pass3 = VecEqual(ex4, VecGetLow(ex1)) && pass3;
+    CRYPTOPP_ASSERT(pass3);
+    uint8x16_p ex5 = VecShiftRightOctet<8>(ex1);
+    pass3 = VecEqual(ex5, VecGetHigh(ex1)) && pass3;
+    CRYPTOPP_ASSERT(pass3);
+
+    if (!pass3)
+        std::cout << "FAILED:";
+    else
+        std::cout << "passed:";
+    std::cout << "  Altivec vector extraction" << std::endl;
+
+    return pass1 && pass2 && pass3;
+}
+#endif
+#endif
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validat10.cpp b/runtime/third_party/cryptopp/validat10.cpp
new file mode 100644
index 0000000..d91d8be
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat10.cpp
@@ -0,0 +1,535 @@
+// validat10.cpp - written and placed in the public domain by Jeffrey Walton
+//                Routines in this source file test NaCl library routines.
+//                Source files split in July 2018 to expedite compiles.
+//
+//    There are two types or sets of self tests. First is a known answer test,
+//    and second are pairwise consistency checks. The known answer tests are test
+//    vectors lifted from libsodium. The pairwise consistency checks are randomized
+//    and confirm the library can arrive at the same result or round trip data
+//    using it's own transformations.
+//
+//    A link like https://github.com/jedisct1/libsodium/blob/master/test/default/box.c
+//    references the libsodium test data for a test. For example, box.c is one of the
+//    test runners for crypto_box, and there is a box.exp with the known answer. The
+//    glue code for box.c and box.exp is in "cmptest.h". box.c runs the test and
+//    generates output, while cmptest.h gathers the output and compares them.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "integer.h"
+#include "naclite.h"
+#include "validate.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4610 4510 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+#ifndef CRYPTOPP_DISABLE_NACL
+
+USING_NAMESPACE(NaCl)
+
+bool TestCryptoBox()
+{
+    // https://github.com/jedisct1/libsodium/blob/master/test/default/box.c
+    const byte alicesk[32] = {
+        0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d, 0x3c, 0x16, 0xc1,
+        0x72, 0x51, 0xb2, 0x66, 0x45, 0xdf, 0x4c, 0x2f, 0x87, 0xeb, 0xc0,
+        0x99, 0x2a, 0xb1, 0x77, 0xfb, 0xa5, 0x1d, 0xb9, 0x2c, 0x2a
+    };
+
+    const byte bobpk[32] = {
+        0xde, 0x9e, 0xdb, 0x7d, 0x7b, 0x7d, 0xc1, 0xb4, 0xd3, 0x5b, 0x61,
+        0xc2, 0xec, 0xe4, 0x35, 0x37, 0x3f, 0x83, 0x43, 0xc8, 0x5b, 0x78,
+        0x67, 0x4d, 0xad, 0xfc, 0x7e, 0x14, 0x6f, 0x88, 0x2b, 0x4f
+    };
+
+    const byte small_order_p[crypto_box_PUBLICKEYBYTES] = {
+        0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3,
+        0xfa, 0xf1, 0x9f, 0xc4, 0x6a, 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32,
+        0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00
+    };
+
+    const byte nonce[24] = {
+        0x69, 0x69, 0x6e, 0xe9, 0x55, 0xb6, 0x2b, 0x73, 0xcd, 0x62, 0xbd, 0xa8,
+        0x75, 0xfc, 0x73, 0xd6, 0x82, 0x19, 0xe0, 0x03, 0x6b, 0x7a, 0x0b, 0x37
+    };
+
+    /* API requires first 32 bytes to be 0 */
+    const byte m[163] = {
+        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
+        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
+        0,    0,    0,    0,    0,    0,    0,    0,    0xbe, 0x07, 0x5f, 0xc5,
+        0x3c, 0x81, 0xf2, 0xd5, 0xcf, 0x14, 0x13, 0x16, 0xeb, 0xeb, 0x0c, 0x7b,
+        0x52, 0x28, 0xc5, 0x2a, 0x4c, 0x62, 0xcb, 0xd4, 0x4b, 0x66, 0x84, 0x9b,
+        0x64, 0x24, 0x4f, 0xfc, 0xe5, 0xec, 0xba, 0xaf, 0x33, 0xbd, 0x75, 0x1a,
+        0x1a, 0xc7, 0x28, 0xd4, 0x5e, 0x6c, 0x61, 0x29, 0x6c, 0xdc, 0x3c, 0x01,
+        0x23, 0x35, 0x61, 0xf4, 0x1d, 0xb6, 0x6c, 0xce, 0x31, 0x4a, 0xdb, 0x31,
+        0x0e, 0x3b, 0xe8, 0x25, 0x0c, 0x46, 0xf0, 0x6d, 0xce, 0xea, 0x3a, 0x7f,
+        0xa1, 0x34, 0x80, 0x57, 0xe2, 0xf6, 0x55, 0x6a, 0xd6, 0xb1, 0x31, 0x8a,
+        0x02, 0x4a, 0x83, 0x8f, 0x21, 0xaf, 0x1f, 0xde, 0x04, 0x89, 0x77, 0xeb,
+        0x48, 0xf5, 0x9f, 0xfd, 0x49, 0x24, 0xca, 0x1c, 0x60, 0x90, 0x2e, 0x52,
+        0xf0, 0xa0, 0x89, 0xbc, 0x76, 0x89, 0x70, 0x40, 0xe0, 0x82, 0xf9, 0x37,
+        0x76, 0x38, 0x48, 0x64, 0x5e, 0x07, 0x05
+    };
+
+    const byte exp1[] = {
+        0xf3,0xff,0xc7,0x70,0x3f,0x94,0x00,0xe5 ,0x2a,0x7d,0xfb,0x4b,0x3d,0x33,0x05,0xd9,
+        0x8e,0x99,0x3b,0x9f,0x48,0x68,0x12,0x73 ,0xc2,0x96,0x50,0xba,0x32,0xfc,0x76,0xce,
+        0x48,0x33,0x2e,0xa7,0x16,0x4d,0x96,0xa4 ,0x47,0x6f,0xb8,0xc5,0x31,0xa1,0x18,0x6a,
+        0xc0,0xdf,0xc1,0x7c,0x98,0xdc,0xe8,0x7b ,0x4d,0xa7,0xf0,0x11,0xec,0x48,0xc9,0x72,
+        0x71,0xd2,0xc2,0x0f,0x9b,0x92,0x8f,0xe2 ,0x27,0x0d,0x6f,0xb8,0x63,0xd5,0x17,0x38,
+        0xb4,0x8e,0xee,0xe3,0x14,0xa7,0xcc,0x8a ,0xb9,0x32,0x16,0x45,0x48,0xe5,0x26,0xae,
+        0x90,0x22,0x43,0x68,0x51,0x7a,0xcf,0xea ,0xbd,0x6b,0xb3,0x73,0x2b,0xc0,0xe9,0xda,
+        0x99,0x83,0x2b,0x61,0xca,0x01,0xb6,0xde ,0x56,0x24,0x4a,0x9e,0x88,0xd5,0xf9,0xb3,
+        0x79,0x73,0xf6,0x22,0xa4,0x3d,0x14,0xa6 ,0x59,0x9b,0x1f,0x65,0x4c,0xb4,0x5a,0x74,
+        0xe3,0x55,0xa5
+    };
+
+    const byte exp2[] = {
+        0xf3,0xff,0xc7,0x70,0x3f,0x94,0x00,0xe5 ,0x2a,0x7d,0xfb,0x4b,0x3d,0x33,0x05,0xd9,
+        0x8e,0x99,0x3b,0x9f,0x48,0x68,0x12,0x73 ,0xc2,0x96,0x50,0xba,0x32,0xfc,0x76,0xce,
+        0x48,0x33,0x2e,0xa7,0x16,0x4d,0x96,0xa4 ,0x47,0x6f,0xb8,0xc5,0x31,0xa1,0x18,0x6a,
+        0xc0,0xdf,0xc1,0x7c,0x98,0xdc,0xe8,0x7b ,0x4d,0xa7,0xf0,0x11,0xec,0x48,0xc9,0x72,
+        0x71,0xd2,0xc2,0x0f,0x9b,0x92,0x8f,0xe2 ,0x27,0x0d,0x6f,0xb8,0x63,0xd5,0x17,0x38,
+        0xb4,0x8e,0xee,0xe3,0x14,0xa7,0xcc,0x8a ,0xb9,0x32,0x16,0x45,0x48,0xe5,0x26,0xae,
+        0x90,0x22,0x43,0x68,0x51,0x7a,0xcf,0xea ,0xbd,0x6b,0xb3,0x73,0x2b,0xc0,0xe9,0xda,
+        0x99,0x83,0x2b,0x61,0xca,0x01,0xb6,0xde ,0x56,0x24,0x4a,0x9e,0x88,0xd5,0xf9,0xb3,
+        0x79,0x73,0xf6,0x22,0xa4,0x3d,0x14,0xa6 ,0x59,0x9b,0x1f,0x65,0x4c,0xb4,0x5a,0x74,
+        0xe3,0x55,0xa5
+    };
+
+    byte c[163];
+    byte k[crypto_box_BEFORENMBYTES];
+
+    bool pass = true; int rc;
+
+    // Reject small order elements
+
+    rc = crypto_box(c, m, 163, nonce, bobpk, alicesk);
+    pass = (rc == 0) && pass;
+    pass = (std::memcmp(c+16, exp1, 163-16) == 0) && pass;
+
+    rc = crypto_box(c, m, 163, nonce, small_order_p, alicesk);
+    pass = (rc != 0) && pass;
+    std::memset(c, 0, sizeof(c));
+
+    rc = crypto_box_beforenm(k, bobpk, alicesk);
+    pass = (rc == 0) && pass;
+    rc = crypto_box_afternm(c, m, 163, nonce, k);
+    pass = (rc == 0) && pass;
+    pass = (std::memcmp(c+16, exp2, 163-16) == 0) && pass;
+
+    rc = crypto_box_beforenm(k, small_order_p, alicesk);
+    pass = (rc != 0) && pass;
+
+    // Allow small order elements
+
+    rc = crypto_box_unchecked(c, m, 163, nonce, bobpk, alicesk);
+    pass = (rc == 0) && pass;
+    pass = (std::memcmp(c+16, exp1, 163-16) == 0) && pass;
+
+    rc = crypto_box_unchecked(c, m, 163, nonce, small_order_p, alicesk);
+    pass = (rc == 0) && pass;
+    std::memset(c, 0, sizeof(c));
+
+    rc = crypto_box_beforenm_unchecked(k, bobpk, alicesk);
+    pass = (rc == 0) && pass;
+    rc = crypto_box_afternm(c, m, 163, nonce, k);
+    pass = (rc == 0) && pass;
+    pass = (std::memcmp(c+16, exp2, 163-16) == 0) && pass;
+
+    rc = crypto_box_beforenm_unchecked(k, small_order_p, alicesk);
+    pass = (rc == 0) && pass;
+
+    return pass;
+}
+
+bool TestCryptoBoxOpen()
+{
+    // https://github.com/jedisct1/libsodium/blob/master/test/default/box2.c
+    const byte bobsk[32] = {
+        0x5d, 0xab, 0x08, 0x7e, 0x62, 0x4a, 0x8a, 0x4b, 0x79, 0xe1, 0x7f, 0x8b, 0x83, 0x80,
+        0x0e, 0xe6, 0x6f, 0x3b, 0xb1, 0x29, 0x26, 0x18, 0xb6, 0xfd, 0x1c, 0x2f, 0x8b, 0x27,
+        0xff, 0x88, 0xe0, 0xeb
+    };
+
+    const byte alicepk[32] = {
+        0x85, 0x20, 0xf0, 0x09, 0x89, 0x30, 0xa7, 0x54, 0x74, 0x8b, 0x7d, 0xdc, 0xb4, 0x3e,
+        0xf7, 0x5a, 0x0d, 0xbf, 0x3a, 0x0d, 0x26, 0x38, 0x1a, 0xf4, 0xeb, 0xa4, 0xa9, 0x8e,
+        0xaa, 0x9b, 0x4e, 0x6a
+    };
+
+    static const byte small_order_p[crypto_box_PUBLICKEYBYTES] = {
+        0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f,
+        0xc4, 0x6a, 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16,
+        0x5f, 0x49, 0xb8, 0x00
+    };
+
+    const byte nonce[24] = {
+        0x69, 0x69, 0x6e, 0xe9, 0x55, 0xb6, 0x2b, 0x73, 0xcd, 0x62, 0xbd, 0xa8,
+        0x75, 0xfc, 0x73, 0xd6, 0x82, 0x19, 0xe0, 0x03, 0x6b, 0x7a, 0x0b, 0x37
+    };
+
+    /* API requires first 16 bytes to be 0 */
+    const byte c[163] = {
+        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
+        0,    0,    0,    0,    0xf3, 0xff, 0xc7, 0x70, 0x3f, 0x94, 0x00, 0xe5,
+        0x2a, 0x7d, 0xfb, 0x4b, 0x3d, 0x33, 0x05, 0xd9, 0x8e, 0x99, 0x3b, 0x9f,
+        0x48, 0x68, 0x12, 0x73, 0xc2, 0x96, 0x50, 0xba, 0x32, 0xfc, 0x76, 0xce,
+        0x48, 0x33, 0x2e, 0xa7, 0x16, 0x4d, 0x96, 0xa4, 0x47, 0x6f, 0xb8, 0xc5,
+        0x31, 0xa1, 0x18, 0x6a, 0xc0, 0xdf, 0xc1, 0x7c, 0x98, 0xdc, 0xe8, 0x7b,
+        0x4d, 0xa7, 0xf0, 0x11, 0xec, 0x48, 0xc9, 0x72, 0x71, 0xd2, 0xc2, 0x0f,
+        0x9b, 0x92, 0x8f, 0xe2, 0x27, 0x0d, 0x6f, 0xb8, 0x63, 0xd5, 0x17, 0x38,
+        0xb4, 0x8e, 0xee, 0xe3, 0x14, 0xa7, 0xcc, 0x8a, 0xb9, 0x32, 0x16, 0x45,
+        0x48, 0xe5, 0x26, 0xae, 0x90, 0x22, 0x43, 0x68, 0x51, 0x7a, 0xcf, 0xea,
+        0xbd, 0x6b, 0xb3, 0x73, 0x2b, 0xc0, 0xe9, 0xda, 0x99, 0x83, 0x2b, 0x61,
+        0xca, 0x01, 0xb6, 0xde, 0x56, 0x24, 0x4a, 0x9e, 0x88, 0xd5, 0xf9, 0xb3,
+        0x79, 0x73, 0xf6, 0x22, 0xa4, 0x3d, 0x14, 0xa6, 0x59, 0x9b, 0x1f, 0x65,
+        0x4c, 0xb4, 0x5a, 0x74, 0xe3, 0x55, 0xa5
+    };
+
+    const byte exp1[] = {
+        0xbe,0x07,0x5f,0xc5,0x3c,0x81,0xf2,0xd5, 0xcf,0x14,0x13,0x16,0xeb,0xeb,0x0c,0x7b,
+        0x52,0x28,0xc5,0x2a,0x4c,0x62,0xcb,0xd4, 0x4b,0x66,0x84,0x9b,0x64,0x24,0x4f,0xfc,
+        0xe5,0xec,0xba,0xaf,0x33,0xbd,0x75,0x1a, 0x1a,0xc7,0x28,0xd4,0x5e,0x6c,0x61,0x29,
+        0x6c,0xdc,0x3c,0x01,0x23,0x35,0x61,0xf4, 0x1d,0xb6,0x6c,0xce,0x31,0x4a,0xdb,0x31,
+        0x0e,0x3b,0xe8,0x25,0x0c,0x46,0xf0,0x6d, 0xce,0xea,0x3a,0x7f,0xa1,0x34,0x80,0x57,
+        0xe2,0xf6,0x55,0x6a,0xd6,0xb1,0x31,0x8a, 0x02,0x4a,0x83,0x8f,0x21,0xaf,0x1f,0xde,
+        0x04,0x89,0x77,0xeb,0x48,0xf5,0x9f,0xfd, 0x49,0x24,0xca,0x1c,0x60,0x90,0x2e,0x52,
+        0xf0,0xa0,0x89,0xbc,0x76,0x89,0x70,0x40, 0xe0,0x82,0xf9,0x37,0x76,0x38,0x48,0x64,
+        0x5e,0x07,0x05
+    };
+
+    const byte exp2[] = {
+        0xbe,0x07,0x5f,0xc5,0x3c,0x81,0xf2,0xd5, 0xcf,0x14,0x13,0x16,0xeb,0xeb,0x0c,0x7b,
+        0x52,0x28,0xc5,0x2a,0x4c,0x62,0xcb,0xd4, 0x4b,0x66,0x84,0x9b,0x64,0x24,0x4f,0xfc,
+        0xe5,0xec,0xba,0xaf,0x33,0xbd,0x75,0x1a, 0x1a,0xc7,0x28,0xd4,0x5e,0x6c,0x61,0x29,
+        0x6c,0xdc,0x3c,0x01,0x23,0x35,0x61,0xf4, 0x1d,0xb6,0x6c,0xce,0x31,0x4a,0xdb,0x31,
+        0x0e,0x3b,0xe8,0x25,0x0c,0x46,0xf0,0x6d, 0xce,0xea,0x3a,0x7f,0xa1,0x34,0x80,0x57,
+        0xe2,0xf6,0x55,0x6a,0xd6,0xb1,0x31,0x8a, 0x02,0x4a,0x83,0x8f,0x21,0xaf,0x1f,0xde,
+        0x04,0x89,0x77,0xeb,0x48,0xf5,0x9f,0xfd, 0x49,0x24,0xca,0x1c,0x60,0x90,0x2e,0x52,
+        0xf0,0xa0,0x89,0xbc,0x76,0x89,0x70,0x40, 0xe0,0x82,0xf9,0x37,0x76,0x38,0x48,0x64,
+        0x5e,0x07,0x05
+    };
+
+    byte m[163];
+    byte k[crypto_box_BEFORENMBYTES];
+
+    bool pass = true; int rc;
+
+    // Reject small order elements
+
+    rc = crypto_box_open(m, c, 163, nonce, alicepk, bobsk);
+    pass = (rc == 0) && pass;
+    pass = (std::memcmp(m+32, exp1, 163-32) == 0) && pass;
+
+    rc = crypto_box_open(m, c, 163, nonce, small_order_p, bobsk);
+    pass = (rc != 0) && pass;
+
+    rc = crypto_box_beforenm(k, small_order_p, bobsk);
+    pass = (rc != 0) && pass;
+    rc = crypto_box_beforenm(k, alicepk, bobsk);
+    pass = (rc == 0) && pass;
+
+    rc = crypto_box_open_afternm(m, c, 163, nonce, k);
+    pass = (rc == 0) && pass;
+    pass = (std::memcmp(m+32, exp2, 163-32) == 0) && pass;
+
+    // Allow small order elements
+
+    rc = crypto_box_open_unchecked(m, c, 163, nonce, alicepk, bobsk);
+    pass = (rc == 0) && pass;
+    pass = (std::memcmp(m+32, exp1, 163-32) == 0) && pass;
+
+    rc = crypto_box_beforenm_unchecked(k, small_order_p, bobsk);
+    pass = (rc == 0) && pass;
+    rc = crypto_box_beforenm_unchecked(k, alicepk, bobsk);
+    pass = (rc == 0) && pass;
+
+    rc = crypto_box_open_afternm(m, c, 163, nonce, k);
+    pass = (rc == 0) && pass;
+    pass = (std::memcmp(m+32, exp2, 163-32) == 0) && pass;
+
+    return pass;
+}
+
+bool TestCryptoBoxKeys()
+{
+    // https://github.com/jedisct1/libsodium/blob/master/test/default/box7.c
+    const unsigned int MAX_TEST = 64;
+    const unsigned int MAX_MESSAGE = 4096;
+
+    byte alicesk[crypto_box_SECRETKEYBYTES];
+    byte alicepk[crypto_box_PUBLICKEYBYTES];
+    byte bobsk[crypto_box_SECRETKEYBYTES];
+    byte bobpk[crypto_box_PUBLICKEYBYTES];
+
+    // byte m[MAX_MESSAGE+32];
+    // byte c[MAX_MESSAGE+32];
+    // byte r[MAX_MESSAGE+32];
+
+    bool pass = true, fail; int rc;
+    for (unsigned int i=0; i < MAX_TEST; ++i)
+    {
+        fail = (crypto_box_keypair(alicepk, alicesk) != 0);
+        pass = !fail && pass;
+        fail = (crypto_box_keypair(bobpk, bobsk) != 0);
+        pass = !fail && pass;
+
+        SecByteBlock m, c, r, n;
+        const word32 len = (i == 0 ? 0 : GlobalRNG().GenerateWord32(1, MAX_MESSAGE));
+
+        m.New(len+crypto_box_ZEROBYTES);
+        c.New(len+crypto_box_BOXZEROBYTES+crypto_box_MACBYTES);
+        r.New(len+crypto_box_ZEROBYTES);
+        n.New(crypto_box_NONCEBYTES);
+
+        GlobalRNG().GenerateBlock(m+crypto_box_ZEROBYTES, len);
+        GlobalRNG().GenerateBlock(n, crypto_box_NONCEBYTES);
+
+        std::memset(m, 0x00, crypto_box_ZEROBYTES);
+        rc = crypto_box(c, m, len + crypto_box_ZEROBYTES, n, bobpk, alicesk);
+        fail = (rc != 0); pass = !fail && pass;
+
+        std::memset(c, 0x00, crypto_box_BOXZEROBYTES);
+        rc = crypto_box_open(r, c, len + crypto_box_BOXZEROBYTES + crypto_box_MACBYTES, n, alicepk, bobsk);
+        fail = (rc != 0); pass = !fail && pass;
+
+        fail = std::memcmp(m+crypto_box_ZEROBYTES, r+crypto_box_ZEROBYTES, len) != 0;
+        pass = !fail && pass;
+
+        m.SetMark(16); c.SetMark(16); r.SetMark(16);
+    }
+
+    return pass;
+}
+
+struct TestData {
+    const byte  sk[crypto_sign_SEEDBYTES];
+    const byte  pk[crypto_sign_PUBLICKEYBYTES];
+    const byte  sig[crypto_sign_BYTES];
+    const word32 len;
+    const char*    msg;
+};
+
+// https://github.com/jedisct1/libsodium/blob/master/test/default/sign.c
+const TestData test_data[] = {
+    {{0x9d,0x61,0xb1,0x9d,0xef,0xfd,0x5a,0x60,0xba,0x84,0x4a,0xf4,0x92,0xec,0x2c,0xc4,0x44,0x49,0xc5,0x69,0x7b,0x32,0x69,0x19,0x70,0x3b,0xac,0x03,0x1c,0xae,0x7f,0x60,},{0xd7,0x5a,0x98,0x01,0x82,0xb1,0x0a,0xb7,0xd5,0x4b,0xfe,0xd3,0xc9,0x64,0x07,0x3a,0x0e,0xe1,0x72,0xf3,0xda,0xa6,0x23,0x25,0xaf,0x02,0x1a,0x68,0xf7,0x07,0x51,0x1a,},{0xe5,0x56,0x43,0x00,0xc3,0x60,0xac,0x72,0x90,0x86,0xe2,0xcc,0x80,0x6e,0x82,0x8a,0x84,0x87,0x7f,0x1e,0xb8,0xe5,0xd9,0x74,0xd8,0x73,0xe0,0x65,0x22,0x49,0x01,0x55,0x5f,0xb8,0x82,0x15,0x90,0xa3,0x3b,0xac,0xc6,0x1e,0x39,0x70,0x1c,0xf9,0xb4,0x6b,0xd2,0x5b,0xf5,0xf0,0x59,0x5b,0xbe,0x24,0x65,0x51,0x41,0x43,0x8e,0x7a,0x10,0x0b,},0,""},
+    {{0x4c,0xcd,0x08,0x9b,0x28,0xff,0x96,0xda,0x9d,0xb6,0xc3,0x46,0xec,0x11,0x4e,0x0f,0x5b,0x8a,0x31,0x9f,0x35,0xab,0xa6,0x24,0xda,0x8c,0xf6,0xed,0x4f,0xb8,0xa6,0xfb,},{0x3d,0x40,0x17,0xc3,0xe8,0x43,0x89,0x5a,0x92,0xb7,0x0a,0xa7,0x4d,0x1b,0x7e,0xbc,0x9c,0x98,0x2c,0xcf,0x2e,0xc4,0x96,0x8c,0xc0,0xcd,0x55,0xf1,0x2a,0xf4,0x66,0x0c,},{0x92,0xa0,0x09,0xa9,0xf0,0xd4,0xca,0xb8,0x72,0x0e,0x82,0x0b,0x5f,0x64,0x25,0x40,0xa2,0xb2,0x7b,0x54,0x16,0x50,0x3f,0x8f,0xb3,0x76,0x22,0x23,0xeb,0xdb,0x69,0xda,0x08,0x5a,0xc1,0xe4,0x3e,0x15,0x99,0x6e,0x45,0x8f,0x36,0x13,0xd0,0xf1,0x1d,0x8c,0x38,0x7b,0x2e,0xae,0xb4,0x30,0x2a,0xee,0xb0,0x0d,0x29,0x16,0x12,0xbb,0x0c,0x00,},1,"\x72"},
+    {{0xc5,0xaa,0x8d,0xf4,0x3f,0x9f,0x83,0x7b,0xed,0xb7,0x44,0x2f,0x31,0xdc,0xb7,0xb1,0x66,0xd3,0x85,0x35,0x07,0x6f,0x09,0x4b,0x85,0xce,0x3a,0x2e,0x0b,0x44,0x58,0xf7,},{0xfc,0x51,0xcd,0x8e,0x62,0x18,0xa1,0xa3,0x8d,0xa4,0x7e,0xd0,0x02,0x30,0xf0,0x58,0x08,0x16,0xed,0x13,0xba,0x33,0x03,0xac,0x5d,0xeb,0x91,0x15,0x48,0x90,0x80,0x25,},{0x62,0x91,0xd6,0x57,0xde,0xec,0x24,0x02,0x48,0x27,0xe6,0x9c,0x3a,0xbe,0x01,0xa3,0x0c,0xe5,0x48,0xa2,0x84,0x74,0x3a,0x44,0x5e,0x36,0x80,0xd7,0xdb,0x5a,0xc3,0xac,0x18,0xff,0x9b,0x53,0x8d,0x16,0xf2,0x90,0xae,0x67,0xf7,0x60,0x98,0x4d,0xc6,0x59,0x4a,0x7c,0x15,0xe9,0x71,0x6e,0xd2,0x8d,0xc0,0x27,0xbe,0xce,0xea,0x1e,0xc4,0x0a,},2,"\xaf\x82"},
+    {{0x0d,0x4a,0x05,0xb0,0x73,0x52,0xa5,0x43,0x6e,0x18,0x03,0x56,0xda,0x0a,0xe6,0xef,0xa0,0x34,0x5f,0xf7,0xfb,0x15,0x72,0x57,0x57,0x72,0xe8,0x00,0x5e,0xd9,0x78,0xe9,},{0xe6,0x1a,0x18,0x5b,0xce,0xf2,0x61,0x3a,0x6c,0x7c,0xb7,0x97,0x63,0xce,0x94,0x5d,0x3b,0x24,0x5d,0x76,0x11,0x4d,0xd4,0x40,0xbc,0xf5,0xf2,0xdc,0x1a,0xa5,0x70,0x57,},{0xd9,0x86,0x8d,0x52,0xc2,0xbe,0xbc,0xe5,0xf3,0xfa,0x5a,0x79,0x89,0x19,0x70,0xf3,0x09,0xcb,0x65,0x91,0xe3,0xe1,0x70,0x2a,0x70,0x27,0x6f,0xa9,0x7c,0x24,0xb3,0xa8,0xe5,0x86,0x06,0xc3,0x8c,0x97,0x58,0x52,0x9d,0xa5,0x0e,0xe3,0x1b,0x82,0x19,0xcb,0xa4,0x52,0x71,0xc6,0x89,0xaf,0xa6,0x0b,0x0e,0xa2,0x6c,0x99,0xdb,0x19,0xb0,0x0c,},3,"\xcb\xc7\x7b"},
+    {{0x6d,0xf9,0x34,0x0c,0x13,0x8c,0xc1,0x88,0xb5,0xfe,0x44,0x64,0xeb,0xaa,0x3f,0x7f,0xc2,0x06,0xa2,0xd5,0x5c,0x34,0x34,0x70,0x7e,0x74,0xc9,0xfc,0x04,0xe2,0x0e,0xbb,},{0xc0,0xda,0xc1,0x02,0xc4,0x53,0x31,0x86,0xe2,0x5d,0xc4,0x31,0x28,0x47,0x23,0x53,0xea,0xab,0xdb,0x87,0x8b,0x15,0x2a,0xeb,0x8e,0x00,0x1f,0x92,0xd9,0x02,0x33,0xa7,},{0x12,0x4f,0x6f,0xc6,0xb0,0xd1,0x00,0x84,0x27,0x69,0xe7,0x1b,0xd5,0x30,0x66,0x4d,0x88,0x8d,0xf8,0x50,0x7d,0xf6,0xc5,0x6d,0xed,0xfd,0xb5,0x09,0xae,0xb9,0x34,0x16,0xe2,0x6b,0x91,0x8d,0x38,0xaa,0x06,0x30,0x5d,0xf3,0x09,0x56,0x97,0xc1,0x8b,0x2a,0xa8,0x32,0xea,0xa5,0x2e,0xdc,0x0a,0xe4,0x9f,0xba,0xe5,0xa8,0x5e,0x15,0x0c,0x07,},4,"\x5f\x4c\x89\x89"},
+    {{0xb7,0x80,0x38,0x1a,0x65,0xed,0xf8,0xb7,0x8f,0x69,0x45,0xe8,0xdb,0xec,0x79,0x41,0xac,0x04,0x9f,0xd4,0xc6,0x10,0x40,0xcf,0x0c,0x32,0x43,0x57,0x97,0x5a,0x29,0x3c,},{0xe2,0x53,0xaf,0x07,0x66,0x80,0x4b,0x86,0x9b,0xb1,0x59,0x5b,0xe9,0x76,0x5b,0x53,0x48,0x86,0xbb,0xaa,0xb8,0x30,0x5b,0xf5,0x0d,0xbc,0x7f,0x89,0x9b,0xfb,0x5f,0x01,},{0xb2,0xfc,0x46,0xad,0x47,0xaf,0x46,0x44,0x78,0xc1,0x99,0xe1,0xf8,0xbe,0x16,0x9f,0x1b,0xe6,0x32,0x7c,0x7f,0x9a,0x0a,0x66,0x89,0x37,0x1c,0xa9,0x4c,0xaf,0x04,0x06,0x4a,0x01,0xb2,0x2a,0xff,0x15,0x20,0xab,0xd5,0x89,0x51,0x34,0x16,0x03,0xfa,0xed,0x76,0x8c,0xf7,0x8c,0xe9,0x7a,0xe7,0xb0,0x38,0xab,0xfe,0x45,0x6a,0xa1,0x7c,0x09,},5,"\x18\xb6\xbe\xc0\x97"},
+    {{0x78,0xae,0x9e,0xff,0xe6,0xf2,0x45,0xe9,0x24,0xa7,0xbe,0x63,0x04,0x11,0x46,0xeb,0xc6,0x70,0xdb,0xd3,0x06,0x0c,0xba,0x67,0xfb,0xc6,0x21,0x6f,0xeb,0xc4,0x45,0x46,},{0xfb,0xcf,0xbf,0xa4,0x05,0x05,0xd7,0xf2,0xbe,0x44,0x4a,0x33,0xd1,0x85,0xcc,0x54,0xe1,0x6d,0x61,0x52,0x60,0xe1,0x64,0x0b,0x2b,0x50,0x87,0xb8,0x3e,0xe3,0x64,0x3d,},{0x6e,0xd6,0x29,0xfc,0x1d,0x9c,0xe9,0xe1,0x46,0x87,0x55,0xff,0x63,0x6d,0x5a,0x3f,0x40,0xa5,0xd9,0xc9,0x1a,0xfd,0x93,0xb7,0x9d,0x24,0x18,0x30,0xf7,0xe5,0xfa,0x29,0x85,0x4b,0x8f,0x20,0xcc,0x6e,0xec,0xbb,0x24,0x8d,0xbd,0x8d,0x16,0xd1,0x4e,0x99,0x75,0x21,0x94,0xe4,0x90,0x4d,0x09,0xc7,0x4d,0x63,0x95,0x18,0x83,0x9d,0x23,0x00,},6,"\x89\x01\x0d\x85\x59\x72"},
+    {{0x69,0x18,0x65,0xbf,0xc8,0x2a,0x1e,0x4b,0x57,0x4e,0xec,0xde,0x4c,0x75,0x19,0x09,0x3f,0xaf,0x0c,0xf8,0x67,0x38,0x02,0x34,0xe3,0x66,0x46,0x45,0xc6,0x1c,0x5f,0x79,},{0x98,0xa5,0xe3,0xa3,0x6e,0x67,0xaa,0xba,0x89,0x88,0x8b,0xf0,0x93,0xde,0x1a,0xd9,0x63,0xe7,0x74,0x01,0x3b,0x39,0x02,0xbf,0xab,0x35,0x6d,0x8b,0x90,0x17,0x8a,0x63,},{0x6e,0x0a,0xf2,0xfe,0x55,0xae,0x37,0x7a,0x6b,0x7a,0x72,0x78,0xed,0xfb,0x41,0x9b,0xd3,0x21,0xe0,0x6d,0x0d,0xf5,0xe2,0x70,0x37,0xdb,0x88,0x12,0xe7,0xe3,0x52,0x98,0x10,0xfa,0x55,0x52,0xf6,0xc0,0x02,0x09,0x85,0xca,0x17,0xa0,0xe0,0x2e,0x03,0x6d,0x7b,0x22,0x2a,0x24,0xf9,0x9b,0x77,0xb7,0x5f,0xdd,0x16,0xcb,0x05,0x56,0x81,0x07,},7,"\xb4\xa8\xf3\x81\xe7\x0e\x7a"},
+    {{0x3b,0x26,0x51,0x6f,0xb3,0xdc,0x88,0xeb,0x18,0x1b,0x9e,0xd7,0x3f,0x0b,0xcd,0x52,0xbc,0xd6,0xb4,0xc7,0x88,0xe4,0xbc,0xaf,0x46,0x05,0x7f,0xd0,0x78,0xbe,0xe0,0x73,},{0xf8,0x1f,0xb5,0x4a,0x82,0x5f,0xce,0xd9,0x5e,0xb0,0x33,0xaf,0xcd,0x64,0x31,0x40,0x75,0xab,0xfb,0x0a,0xbd,0x20,0xa9,0x70,0x89,0x25,0x03,0x43,0x6f,0x34,0xb8,0x63,},{0xd6,0xad,0xde,0xc5,0xaf,0xb0,0x52,0x8a,0xc1,0x7b,0xb1,0x78,0xd3,0xe7,0xf2,0x88,0x7f,0x9a,0xdb,0xb1,0xad,0x16,0xe1,0x10,0x54,0x5e,0xf3,0xbc,0x57,0xf9,0xde,0x23,0x14,0xa5,0xc8,0x38,0x8f,0x72,0x3b,0x89,0x07,0xbe,0x0f,0x3a,0xc9,0x0c,0x62,0x59,0xbb,0xe8,0x85,0xec,0xc1,0x76,0x45,0xdf,0x3d,0xb7,0xd4,0x88,0xf8,0x05,0xfa,0x08,},8,"\x42\x84\xab\xc5\x1b\xb6\x72\x35"},
+    {{0xed,0xc6,0xf5,0xfb,0xdd,0x1c,0xee,0x4d,0x10,0x1c,0x06,0x35,0x30,0xa3,0x04,0x90,0xb2,0x21,0xbe,0x68,0xc0,0x36,0xf5,0xb0,0x7d,0x0f,0x95,0x3b,0x74,0x5d,0xf1,0x92,},{0xc1,0xa4,0x9c,0x66,0xe6,0x17,0xf9,0xef,0x5e,0xc6,0x6b,0xc4,0xc6,0x56,0x4c,0xa3,0x3d,0xe2,0xa5,0xfb,0x5e,0x14,0x64,0x06,0x2e,0x6d,0x6c,0x62,0x19,0x15,0x5e,0xfd,},{0x2c,0x76,0xa0,0x4a,0xf2,0x39,0x1c,0x14,0x70,0x82,0xe3,0x3f,0xaa,0xcd,0xbe,0x56,0x64,0x2a,0x1e,0x13,0x4b,0xd3,0x88,0x62,0x0b,0x85,0x2b,0x90,0x1a,0x6b,0xc1,0x6f,0xf6,0xc9,0xcc,0x94,0x04,0xc4,0x1d,0xea,0x12,0xed,0x28,0x1d,0xa0,0x67,0xa1,0x51,0x38,0x66,0xf9,0xd9,0x64,0xf8,0xbd,0xd2,0x49,0x53,0x85,0x6c,0x50,0x04,0x29,0x01,},9,"\x67\x2b\xf8\x96\x5d\x04\xbc\x51\x46"},
+    {{0x4e,0x7d,0x21,0xfb,0x3b,0x18,0x97,0x57,0x1a,0x44,0x58,0x33,0xbe,0x0f,0x9f,0xd4,0x1c,0xd6,0x2b,0xe3,0xaa,0x04,0x04,0x0f,0x89,0x34,0xe1,0xfc,0xbd,0xca,0xcd,0x45,},{0x31,0xb2,0x52,0x4b,0x83,0x48,0xf7,0xab,0x1d,0xfa,0xfa,0x67,0x5c,0xc5,0x38,0xe9,0xa8,0x4e,0x3f,0xe5,0x81,0x9e,0x27,0xc1,0x2a,0xd8,0xbb,0xc1,0xa3,0x6e,0x4d,0xff,},{0x28,0xe4,0x59,0x8c,0x41,0x5a,0xe9,0xde,0x01,0xf0,0x3f,0x9f,0x3f,0xab,0x4e,0x91,0x9e,0x8b,0xf5,0x37,0xdd,0x2b,0x0c,0xdf,0x6e,0x79,0xb9,0xe6,0x55,0x9c,0x94,0x09,0xd9,0x15,0x1a,0x4c,0x40,0xf0,0x83,0x19,0x39,0x37,0x62,0x7c,0x36,0x94,0x88,0x25,0x9e,0x99,0xda,0x5a,0x9f,0x0a,0x87,0x49,0x7f,0xa6,0x69,0x6a,0x5d,0xd6,0xce,0x08,},10,"\x33\xd7\xa7\x86\xad\xed\x8c\x1b\xf6\x91"},
+    {{0xa9,0x80,0xf8,0x92,0xdb,0x13,0xc9,0x9a,0x3e,0x89,0x71,0xe9,0x65,0xb2,0xff,0x3d,0x41,0xea,0xfd,0x54,0x09,0x3b,0xc9,0xf3,0x4d,0x1f,0xd2,0x2d,0x84,0x11,0x5b,0xb6,},{0x44,0xb5,0x7e,0xe3,0x0c,0xdb,0x55,0x82,0x9d,0x0a,0x5d,0x4f,0x04,0x6b,0xae,0xf0,0x78,0xf1,0xe9,0x7a,0x7f,0x21,0xb6,0x2d,0x75,0xf8,0xe9,0x6e,0xa1,0x39,0xc3,0x5f,},{0x77,0xd3,0x89,0xe5,0x99,0x63,0x0d,0x93,0x40,0x76,0x32,0x95,0x83,0xcd,0x41,0x05,0xa6,0x49,0xa9,0x29,0x2a,0xbc,0x44,0xcd,0x28,0xc4,0x00,0x00,0xc8,0xe2,0xf5,0xac,0x76,0x60,0xa8,0x1c,0x85,0xb7,0x2a,0xf8,0x45,0x2d,0x7d,0x25,0xc0,0x70,0x86,0x1d,0xae,0x91,0x60,0x1c,0x78,0x03,0xd6,0x56,0x53,0x16,0x50,0xdd,0x4e,0x5c,0x41,0x00,},11,"\x34\x86\xf6\x88\x48\xa6\x5a\x0e\xb5\x50\x7d"},
+    {{0x5b,0x5a,0x61,0x9f,0x8c,0xe1,0xc6,0x6d,0x7c,0xe2,0x6e,0x5a,0x2a,0xe7,0xb0,0xc0,0x4f,0xeb,0xcd,0x34,0x6d,0x28,0x6c,0x92,0x9e,0x19,0xd0,0xd5,0x97,0x3b,0xfe,0xf9,},{0x6f,0xe8,0x36,0x93,0xd0,0x11,0xd1,0x11,0x13,0x1c,0x4f,0x3f,0xba,0xaa,0x40,0xa9,0xd3,0xd7,0x6b,0x30,0x01,0x2f,0xf7,0x3b,0xb0,0xe3,0x9e,0xc2,0x7a,0xb1,0x82,0x57,},{0x0f,0x9a,0xd9,0x79,0x30,0x33,0xa2,0xfa,0x06,0x61,0x4b,0x27,0x7d,0x37,0x38,0x1e,0x6d,0x94,0xf6,0x5a,0xc2,0xa5,0xa9,0x45,0x58,0xd0,0x9e,0xd6,0xce,0x92,0x22,0x58,0xc1,0xa5,0x67,0x95,0x2e,0x86,0x3a,0xc9,0x42,0x97,0xae,0xc3,0xc0,0xd0,0xc8,0xdd,0xf7,0x10,0x84,0xe5,0x04,0x86,0x0b,0xb6,0xba,0x27,0x44,0x9b,0x55,0xad,0xc4,0x0e,},12,"\x5a\x8d\x9d\x0a\x22\x35\x7e\x66\x55\xf9\xc7\x85"},
+    {{0x94,0x0c,0x89,0xfe,0x40,0xa8,0x1d,0xaf,0xbd,0xb2,0x41,0x6d,0x14,0xae,0x46,0x91,0x19,0x86,0x97,0x44,0x41,0x0c,0x33,0x03,0xbf,0xaa,0x02,0x41,0xda,0xc5,0x78,0x00,},{0xa2,0xeb,0x8c,0x05,0x01,0xe3,0x0b,0xae,0x0c,0xf8,0x42,0xd2,0xbd,0xe8,0xde,0xc7,0x38,0x6f,0x6b,0x7f,0xc3,0x98,0x1b,0x8c,0x57,0xc9,0x79,0x2b,0xb9,0x4c,0xf2,0xdd,},{0xd8,0xbb,0x64,0xaa,0xd8,0xc9,0x95,0x5a,0x11,0x5a,0x79,0x3a,0xdd,0xd2,0x4f,0x7f,0x2b,0x07,0x76,0x48,0x71,0x4f,0x49,0xc4,0x69,0x4e,0xc9,0x95,0xb3,0x30,0xd0,0x9d,0x64,0x0d,0xf3,0x10,0xf4,0x47,0xfd,0x7b,0x6c,0xb5,0xc1,0x4f,0x9f,0xe9,0xf4,0x90,0xbc,0xf8,0xcf,0xad,0xbf,0xd2,0x16,0x9c,0x8a,0xc2,0x0d,0x3b,0x8a,0xf4,0x9a,0x0c,},13,"\xb8\x7d\x38\x13\xe0\x3f\x58\xcf\x19\xfd\x0b\x63\x95"},
+    {{0x9a,0xca,0xd9,0x59,0xd2,0x16,0x21,0x2d,0x78,0x9a,0x11,0x92,0x52,0xeb,0xfe,0x0c,0x96,0x51,0x2a,0x23,0xc7,0x3b,0xd9,0xf3,0xb2,0x02,0x29,0x2d,0x69,0x16,0xa7,0x38,},{0xcf,0x3a,0xf8,0x98,0x46,0x7a,0x5b,0x7a,0x52,0xd3,0x3d,0x53,0xbc,0x03,0x7e,0x26,0x42,0xa8,0xda,0x99,0x69,0x03,0xfc,0x25,0x22,0x17,0xe9,0xc0,0x33,0xe2,0xf2,0x91,},{0x6e,0xe3,0xfe,0x81,0xe2,0x3c,0x60,0xeb,0x23,0x12,0xb2,0x00,0x6b,0x3b,0x25,0xe6,0x83,0x8e,0x02,0x10,0x66,0x23,0xf8,0x44,0xc4,0x4e,0xdb,0x8d,0xaf,0xd6,0x6a,0xb0,0x67,0x10,0x87,0xfd,0x19,0x5d,0xf5,0xb8,0xf5,0x8a,0x1d,0x6e,0x52,0xaf,0x42,0x90,0x80,0x53,0xd5,0x5c,0x73,0x21,0x01,0x00,0x92,0x74,0x87,0x95,0xef,0x94,0xcf,0x06,},14,"\x55\xc7\xfa\x43\x4f\x5e\xd8\xcd\xec\x2b\x7a\xea\xc1\x73"},
+    {{0xd5,0xae,0xee,0x41,0xee,0xb0,0xe9,0xd1,0xbf,0x83,0x37,0xf9,0x39,0x58,0x7e,0xbe,0x29,0x61,0x61,0xe6,0xbf,0x52,0x09,0xf5,0x91,0xec,0x93,0x9e,0x14,0x40,0xc3,0x00,},{0xfd,0x2a,0x56,0x57,0x23,0x16,0x3e,0x29,0xf5,0x3c,0x9d,0xe3,0xd5,0xe8,0xfb,0xe3,0x6a,0x7a,0xb6,0x6e,0x14,0x39,0xec,0x4e,0xae,0x9c,0x0a,0x60,0x4a,0xf2,0x91,0xa5,},{0xf6,0x8d,0x04,0x84,0x7e,0x5b,0x24,0x97,0x37,0x89,0x9c,0x01,0x4d,0x31,0xc8,0x05,0xc5,0x00,0x7a,0x62,0xc0,0xa1,0x0d,0x50,0xbb,0x15,0x38,0xc5,0xf3,0x55,0x03,0x95,0x1f,0xbc,0x1e,0x08,0x68,0x2f,0x2c,0xc0,0xc9,0x2e,0xfe,0x8f,0x49,0x85,0xde,0xc6,0x1d,0xcb,0xd5,0x4d,0x4b,0x94,0xa2,0x25,0x47,0xd2,0x44,0x51,0x27,0x1c,0x8b,0x00,},15,"\x0a\x68\x8e\x79\xbe\x24\xf8\x66\x28\x6d\x46\x46\xb5\xd8\x1c"},
+    {{0x0a,0x47,0xd1,0x04,0x52,0xae,0x2f,0xeb,0xec,0x51,0x8a,0x1c,0x7c,0x36,0x28,0x90,0xc3,0xfc,0x1a,0x49,0xd3,0x4b,0x03,0xb6,0x46,0x7d,0x35,0xc9,0x04,0xa8,0x36,0x2d,},{0x34,0xe5,0xa8,0x50,0x8c,0x47,0x43,0x74,0x69,0x62,0xc0,0x66,0xe4,0xba,0xde,0xa2,0x20,0x1b,0x8a,0xb4,0x84,0xde,0x5c,0x4f,0x94,0x47,0x6c,0xcd,0x21,0x43,0x95,0x5b,},{0x2a,0x3d,0x27,0xdc,0x40,0xd0,0xa8,0x12,0x79,0x49,0xa3,0xb7,0xf9,0x08,0xb3,0x68,0x8f,0x63,0xb7,0xf1,0x4f,0x65,0x1a,0xac,0xd7,0x15,0x94,0x0b,0xdb,0xe2,0x7a,0x08,0x09,0xaa,0xc1,0x42,0xf4,0x7a,0xb0,0xe1,0xe4,0x4f,0xa4,0x90,0xba,0x87,0xce,0x53,0x92,0xf3,0x3a,0x89,0x15,0x39,0xca,0xf1,0xef,0x4c,0x36,0x7c,0xae,0x54,0x50,0x0c,},16,"\xc9\x42\xfa\x7a\xc6\xb2\x3a\xb7\xff\x61\x2f\xdc\x8e\x68\xef\x39"},
+    {{0xf8,0x14,0x8f,0x75,0x06,0xb7,0x75,0xef,0x46,0xfd,0xc8,0xe8,0xc7,0x56,0x51,0x68,0x12,0xd4,0x7d,0x6c,0xfb,0xfa,0x31,0x8c,0x27,0xc9,0xa2,0x26,0x41,0xe5,0x6f,0x17,},{0x04,0x45,0xe4,0x56,0xda,0xcc,0x7d,0x5b,0x0b,0xbe,0xd2,0x3c,0x82,0x00,0xcd,0xb7,0x4b,0xdc,0xb0,0x3e,0x4c,0x7b,0x73,0xf0,0xa2,0xb9,0xb4,0x6e,0xac,0x5d,0x43,0x72,},{0x36,0x53,0xcc,0xb2,0x12,0x19,0x20,0x2b,0x84,0x36,0xfb,0x41,0xa3,0x2b,0xa2,0x61,0x8c,0x4a,0x13,0x34,0x31,0xe6,0xe6,0x34,0x63,0xce,0xb3,0xb6,0x10,0x6c,0x4d,0x56,0xe1,0xd2,0xba,0x16,0x5b,0xa7,0x6e,0xaa,0xd3,0xdc,0x39,0xbf,0xfb,0x13,0x0f,0x1d,0xe3,0xd8,0xe6,0x42,0x7d,0xb5,0xb7,0x19,0x38,0xdb,0x4e,0x27,0x2b,0xc3,0xe2,0x0b,},17,"\x73\x68\x72\x4a\x5b\x0e\xfb\x57\xd2\x8d\x97\x62\x2d\xbd\xe7\x25\xaf"},
+    {{0x77,0xf8,0x86,0x91,0xc4,0xef,0xf2,0x3e,0xbb,0x73,0x64,0x94,0x70,0x92,0x95,0x1a,0x5f,0xf3,0xf1,0x07,0x85,0xb4,0x17,0xe9,0x18,0x82,0x3a,0x55,0x2d,0xab,0x7c,0x75,},{0x74,0xd2,0x91,0x27,0xf1,0x99,0xd8,0x6a,0x86,0x76,0xae,0xc3,0x3b,0x4c,0xe3,0xf2,0x25,0xcc,0xb1,0x91,0xf5,0x2c,0x19,0x1c,0xcd,0x1e,0x8c,0xca,0x65,0x21,0x3a,0x6b,},{0xfb,0xe9,0x29,0xd7,0x43,0xa0,0x3c,0x17,0x91,0x05,0x75,0x49,0x2f,0x30,0x92,0xee,0x2a,0x2b,0xf1,0x4a,0x60,0xa3,0xfc,0xac,0xec,0x74,0xa5,0x8c,0x73,0x34,0x51,0x0f,0xc2,0x62,0xdb,0x58,0x27,0x91,0x32,0x2d,0x6c,0x8c,0x41,0xf1,0x70,0x0a,0xdb,0x80,0x02,0x7e,0xca,0xbc,0x14,0x27,0x0b,0x70,0x34,0x44,0xae,0x3e,0xe7,0x62,0x3e,0x0a,},18,"\xbd\x8e\x05\x03\x3f\x3a\x8b\xcd\xcb\xf4\xbe\xce\xb7\x09\x01\xc8\x2e\x31"},
+    {{0xab,0x6f,0x7a,0xee,0x6a,0x08,0x37,0xb3,0x34,0xba,0x5e,0xb1,0xb2,0xad,0x7f,0xce,0xcf,0xab,0x7e,0x32,0x3c,0xab,0x18,0x7f,0xe2,0xe0,0xa9,0x5d,0x80,0xef,0xf1,0x32,},{0x5b,0x96,0xdc,0xa4,0x97,0x87,0x5b,0xf9,0x66,0x4c,0x5e,0x75,0xfa,0xcf,0x3f,0x9b,0xc5,0x4b,0xae,0x91,0x3d,0x66,0xca,0x15,0xee,0x85,0xf1,0x49,0x1c,0xa2,0x4d,0x2c,},{0x73,0xbc,0xa6,0x4e,0x9d,0xd0,0xdb,0x88,0x13,0x8e,0xed,0xfa,0xfc,0xea,0x8f,0x54,0x36,0xcf,0xb7,0x4b,0xfb,0x0e,0x77,0x33,0xcf,0x34,0x9b,0xaa,0x0c,0x49,0x77,0x5c,0x56,0xd5,0x93,0x4e,0x1d,0x38,0xe3,0x6f,0x39,0xb7,0xc5,0xbe,0xb0,0xa8,0x36,0x51,0x0c,0x45,0x12,0x6f,0x8e,0xc4,0xb6,0x81,0x05,0x19,0x90,0x5b,0x0c,0xa0,0x7c,0x09,},19,"\x81\x71\x45\x6f\x8b\x90\x71\x89\xb1\xd7\x79\xe2\x6b\xc5\xaf\xbb\x08\xc6\x7a"},
+    {{0x8d,0x13,0x5d,0xe7,0xc8,0x41,0x1b,0xbd,0xbd,0x1b,0x31,0xe5,0xdc,0x67,0x8f,0x2a,0xc7,0x10,0x9e,0x79,0x2b,0x60,0xf3,0x8c,0xd2,0x49,0x36,0xe8,0xa8,0x98,0xc3,0x2d,},{0x1c,0xa2,0x81,0x93,0x85,0x29,0x89,0x65,0x35,0xa7,0x71,0x4e,0x35,0x84,0x08,0x5b,0x86,0xef,0x9f,0xec,0x72,0x3f,0x42,0x81,0x9f,0xc8,0xdd,0x5d,0x8c,0x00,0x81,0x7f,},{0xa1,0xad,0xc2,0xbc,0x6a,0x2d,0x98,0x06,0x62,0x67,0x7e,0x7f,0xdf,0xf6,0x42,0x4d,0xe7,0xdb,0xa5,0x0f,0x57,0x95,0xca,0x90,0xfd,0xf3,0xe9,0x6e,0x25,0x6f,0x32,0x85,0xca,0xc7,0x1d,0x33,0x60,0x48,0x2e,0x99,0x3d,0x02,0x94,0xba,0x4e,0xc7,0x44,0x0c,0x61,0xaf,0xfd,0xf3,0x5f,0xe8,0x3e,0x6e,0x04,0x26,0x39,0x37,0xdb,0x93,0xf1,0x05,},20,"\x8b\xa6\xa4\xc9\xa1\x5a\x24\x4a\x9c\x26\xbb\x2a\x59\xb1\x02\x6f\x21\x34\x8b\x49"},
+    {{0x0e,0x76,0x5d,0x72,0x0e,0x70,0x5f,0x93,0x66,0xc1,0xab,0x8c,0x3f,0xa8,0x4c,0x9a,0x44,0x37,0x0c,0x06,0x96,0x9f,0x80,0x32,0x96,0x88,0x4b,0x28,0x46,0xa6,0x52,0xa4,},{0x7f,0xae,0x45,0xdd,0x0a,0x05,0x97,0x10,0x26,0xd4,0x10,0xbc,0x49,0x7a,0xf5,0xbe,0x7d,0x08,0x27,0xa8,0x2a,0x14,0x5c,0x20,0x3f,0x62,0x5d,0xfc,0xb8,0xb0,0x3b,0xa8,},{0xbb,0x61,0xcf,0x84,0xde,0x61,0x86,0x22,0x07,0xc6,0xa4,0x55,0x25,0x8b,0xc4,0xdb,0x4e,0x15,0xee,0xa0,0x31,0x7f,0xf8,0x87,0x18,0xb8,0x82,0xa0,0x6b,0x5c,0xf6,0xec,0x6f,0xd2,0x0c,0x5a,0x26,0x9e,0x5d,0x5c,0x80,0x5b,0xaf,0xbc,0xc5,0x79,0xe2,0x59,0x0a,0xf4,0x14,0xc7,0xc2,0x27,0x27,0x3c,0x10,0x2a,0x10,0x07,0x0c,0xdf,0xe8,0x0f,},21,"\x1d\x56\x6a\x62\x32\xbb\xaa\xb3\xe6\xd8\x80\x4b\xb5\x18\xa4\x98\xed\x0f\x90\x49\x86"},
+    {{0xdb,0x36,0xe3,0x26,0xd6,0x76,0xc2,0xd1,0x9c,0xc8,0xfe,0x0c,0x14,0xb7,0x09,0x20,0x2e,0xcf,0xc7,0x61,0xd2,0x70,0x89,0xeb,0x6e,0xa4,0xb1,0xbb,0x02,0x1e,0xcf,0xa7,},{0x48,0x35,0x9b,0x85,0x0d,0x23,0xf0,0x71,0x5d,0x94,0xbb,0x8b,0xb7,0x5e,0x7e,0x14,0x32,0x2e,0xaf,0x14,0xf0,0x6f,0x28,0xa8,0x05,0x40,0x3f,0xbd,0xa0,0x02,0xfc,0x85,},{0xb6,0xdc,0xd0,0x99,0x89,0xdf,0xba,0xc5,0x43,0x22,0xa3,0xce,0x87,0x87,0x6e,0x1d,0x62,0x13,0x4d,0xa9,0x98,0xc7,0x9d,0x24,0xb5,0x0b,0xd7,0xa6,0xa7,0x97,0xd8,0x6a,0x0e,0x14,0xdc,0x9d,0x74,0x91,0xd6,0xc1,0x4a,0x67,0x3c,0x65,0x2c,0xfb,0xec,0x9f,0x96,0x2a,0x38,0xc9,0x45,0xda,0x3b,0x2f,0x08,0x79,0xd0,0xb6,0x8a,0x92,0x13,0x00,},22,"\x1b\x0a\xfb\x0a\xc4\xba\x9a\xb7\xb7\x17\x2c\xdd\xc9\xeb\x42\xbb\xa1\xa6\x4b\xce\x47\xd4"},
+    {{0xc8,0x99,0x55,0xe0,0xf7,0x74,0x1d,0x90,0x5d,0xf0,0x73,0x0b,0x3d,0xc2,0xb0,0xce,0x1a,0x13,0x13,0x4e,0x44,0xfe,0xf3,0xd4,0x0d,0x60,0xc0,0x20,0xef,0x19,0xdf,0x77,},{0xfd,0xb3,0x06,0x73,0x40,0x2f,0xaf,0x1c,0x80,0x33,0x71,0x4f,0x35,0x17,0xe4,0x7c,0xc0,0xf9,0x1f,0xe7,0x0c,0xf3,0x83,0x6d,0x6c,0x23,0x63,0x6e,0x3f,0xd2,0x28,0x7c,},{0x7e,0xf6,0x6e,0x5e,0x86,0xf2,0x36,0x08,0x48,0xe0,0x01,0x4e,0x94,0x88,0x0a,0xe2,0x92,0x0a,0xd8,0xa3,0x18,0x5a,0x46,0xb3,0x5d,0x1e,0x07,0xde,0xa8,0xfa,0x8a,0xe4,0xf6,0xb8,0x43,0xba,0x17,0x4d,0x99,0xfa,0x79,0x86,0x65,0x4a,0x08,0x91,0xc1,0x2a,0x79,0x44,0x55,0x66,0x93,0x75,0xbf,0x92,0xaf,0x4c,0xc2,0x77,0x0b,0x57,0x9e,0x0c,},23,"\x50\x7c\x94\xc8\x82\x0d\x2a\x57\x93\xcb\xf3\x44\x2b\x3d\x71\x93\x6f\x35\xfe\x3a\xfe\xf3\x16"},
+    {{0x4e,0x62,0x62,0x7f,0xc2,0x21,0x14,0x24,0x78,0xae,0xe7,0xf0,0x07,0x81,0xf8,0x17,0xf6,0x62,0xe3,0xb7,0x5d,0xb2,0x9b,0xb1,0x4a,0xb4,0x7c,0xf8,0xe8,0x41,0x04,0xd6,},{0xb1,0xd3,0x98,0x01,0x89,0x20,0x27,0xd5,0x8a,0x8c,0x64,0x33,0x51,0x63,0x19,0x58,0x93,0xbf,0xc1,0xb6,0x1d,0xbe,0xca,0x32,0x60,0x49,0x7e,0x1f,0x30,0x37,0x11,0x07,},{0x83,0x6a,0xfa,0x76,0x4d,0x9c,0x48,0xaa,0x47,0x70,0xa4,0x38,0x8b,0x65,0x4e,0x97,0xb3,0xc1,0x6f,0x08,0x29,0x67,0xfe,0xbc,0xa2,0x7f,0x2f,0xc4,0x7d,0xdf,0xd9,0x24,0x4b,0x03,0xcf,0xc7,0x29,0x69,0x8a,0xcf,0x51,0x09,0x70,0x43,0x46,0xb6,0x0b,0x23,0x0f,0x25,0x54,0x30,0x08,0x9d,0xdc,0x56,0x91,0x23,0x99,0xd1,0x12,0x2d,0xe7,0x0a,},24,"\xd3\xd6\x15\xa8\x47\x2d\x99\x62\xbb\x70\xc5\xb5\x46\x6a\x3d\x98\x3a\x48\x11\x04\x6e\x2a\x0e\xf5"},
+    {{0x6b,0x83,0xd7,0xda,0x89,0x08,0xc3,0xe7,0x20,0x5b,0x39,0x86,0x4b,0x56,0xe5,0xf3,0xe1,0x71,0x96,0xa3,0xfc,0x9c,0x2f,0x58,0x05,0xaa,0xd0,0xf5,0x55,0x4c,0x14,0x2d,},{0xd0,0xc8,0x46,0xf9,0x7f,0xe2,0x85,0x85,0xc0,0xee,0x15,0x90,0x15,0xd6,0x4c,0x56,0x31,0x1c,0x88,0x6e,0xdd,0xcc,0x18,0x5d,0x29,0x6d,0xbb,0x16,0x5d,0x26,0x25,0xd6,},{0x16,0xe4,0x62,0xa2,0x9a,0x6d,0xd4,0x98,0x68,0x5a,0x37,0x18,0xb3,0xee,0xd0,0x0c,0xc1,0x59,0x86,0x01,0xee,0x47,0x82,0x04,0x86,0x03,0x2d,0x6b,0x9a,0xcc,0x9b,0xf8,0x9f,0x57,0x68,0x4e,0x08,0xd8,0xc0,0xf0,0x55,0x89,0xcd,0xa2,0x88,0x2a,0x05,0xdc,0x4c,0x63,0xf9,0xd0,0x43,0x1d,0x65,0x52,0x71,0x08,0x12,0x43,0x30,0x03,0xbc,0x08,},25,"\x6a\xda\x80\xb6\xfa\x84\xf7\x03\x49\x20\x78\x9e\x85\x36\xb8\x2d\x5e\x46\x78\x05\x9a\xed\x27\xf7\x1c"},
+    {{0x19,0xa9,0x1f,0xe2,0x3a,0x4e,0x9e,0x33,0xec,0xc4,0x74,0x87,0x8f,0x57,0xc6,0x4c,0xf1,0x54,0xb3,0x94,0x20,0x34,0x87,0xa7,0x03,0x5e,0x1a,0xd9,0xcd,0x69,0x7b,0x0d,},{0x2b,0xf3,0x2b,0xa1,0x42,0xba,0x46,0x22,0xd8,0xf3,0xe2,0x9e,0xcd,0x85,0xee,0xa0,0x7b,0x9c,0x47,0xbe,0x9d,0x64,0x41,0x2c,0x9b,0x51,0x0b,0x27,0xdd,0x21,0x8b,0x23,},{0x88,0x1f,0x5b,0x8c,0x5a,0x03,0x0d,0xf0,0xf7,0x5b,0x66,0x34,0xb0,0x70,0xdd,0x27,0xbd,0x1e,0xe3,0xc0,0x87,0x38,0xae,0x34,0x93,0x38,0xb3,0xee,0x64,0x69,0xbb,0xf9,0x76,0x0b,0x13,0x57,0x8a,0x23,0x7d,0x51,0x82,0x53,0x5e,0xde,0x12,0x12,0x83,0x02,0x7a,0x90,0xb5,0xf8,0x65,0xd6,0x3a,0x65,0x37,0xdc,0xa0,0x7b,0x44,0x04,0x9a,0x0f,},26,"\x82\xcb\x53\xc4\xd5\xa0\x13\xba\xe5\x07\x07\x59\xec\x06\xc3\xc6\x95\x5a\xb7\xa4\x05\x09\x58\xec\x32\x8c"},
+    {{0x1d,0x5b,0x8c,0xb6,0x21,0x5c,0x18,0x14,0x16,0x66,0xba,0xee,0xfc,0xf5,0xd6,0x9d,0xad,0x5b,0xea,0x9a,0x34,0x93,0xdd,0xda,0xa3,0x57,0xa4,0x39,0x7a,0x13,0xd4,0xde,},{0x94,0xd2,0x3d,0x97,0x7c,0x33,0xe4,0x9e,0x5e,0x49,0x92,0xc6,0x8f,0x25,0xec,0x99,0xa2,0x7c,0x41,0xce,0x6b,0x91,0xf2,0xbf,0xa0,0xcd,0x82,0x92,0xfe,0x96,0x28,0x35,},{0x3a,0xcd,0x39,0xbe,0xc8,0xc3,0xcd,0x2b,0x44,0x29,0x97,0x22,0xb5,0x85,0x0a,0x04,0x00,0xc1,0x44,0x35,0x90,0xfd,0x48,0x61,0xd5,0x9a,0xae,0x74,0x96,0xac,0xb3,0xdf,0x73,0xfc,0x3f,0xdf,0x79,0x69,0xae,0x5f,0x50,0xba,0x47,0xdd,0xdc,0x43,0x52,0x46,0xe5,0xfd,0x37,0x6f,0x6b,0x89,0x1c,0xd4,0xc2,0xca,0xf5,0xd6,0x14,0xb6,0x17,0x0c,},27,"\xa9\xa8\xcb\xb0\xad\x58\x51\x24\xe5\x22\xab\xbf\xb4\x05\x33\xbd\xd6\xf4\x93\x47\xb5\x5b\x18\xe8\x55\x8c\xb0"},
+    {{0x6a,0x91,0xb3,0x22,0x7c,0x47,0x22,0x99,0x08,0x9b,0xdc,0xe9,0x35,0x6e,0x72,0x6a,0x40,0xef,0xd8,0x40,0xf1,0x10,0x02,0x70,0x8b,0x7e,0xe5,0x5b,0x64,0x10,0x5a,0xc2,},{0x9d,0x08,0x4a,0xa8,0xb9,0x7a,0x6b,0x9b,0xaf,0xa4,0x96,0xdb,0xc6,0xf7,0x6f,0x33,0x06,0xa1,0x16,0xc9,0xd9,0x17,0xe6,0x81,0x52,0x0a,0x0f,0x91,0x43,0x69,0x42,0x7e,},{0xf5,0x87,0x54,0x23,0x78,0x1b,0x66,0x21,0x6c,0xb5,0xe8,0x99,0x8d,0xe5,0xd9,0xff,0xc2,0x9d,0x1d,0x67,0x10,0x70,0x54,0xac,0xe3,0x37,0x45,0x03,0xa9,0xc3,0xef,0x81,0x15,0x77,0xf2,0x69,0xde,0x81,0x29,0x67,0x44,0xbd,0x70,0x6f,0x1a,0xc4,0x78,0xca,0xf0,0x9b,0x54,0xcd,0xf8,0x71,0xb3,0xf8,0x02,0xbd,0x57,0xf9,0xa6,0xcb,0x91,0x01,},28,"\x5c\xb6\xf9\xaa\x59\xb8\x0e\xca\x14\xf6\xa6\x8f\xb4\x0c\xf0\x7b\x79\x4e\x75\x17\x1f\xba\x96\x26\x2c\x1c\x6a\xdc"},
+    {{0x93,0xea,0xa8,0x54,0xd7,0x91,0xf0,0x53,0x72,0xce,0x72,0xb9,0x4f,0xc6,0x50,0x3b,0x2f,0xf8,0xae,0x68,0x19,0xe6,0xa2,0x1a,0xfe,0x82,0x5e,0x27,0xad,0xa9,0xe4,0xfb,},{0x16,0xce,0xe8,0xa3,0xf2,0x63,0x18,0x34,0xc8,0x8b,0x67,0x08,0x97,0xff,0x0b,0x08,0xce,0x90,0xcc,0x14,0x7b,0x45,0x93,0xb3,0xf1,0xf4,0x03,0x72,0x7f,0x7e,0x7a,0xd5,},{0xd8,0x34,0x19,0x7c,0x1a,0x30,0x80,0x61,0x4e,0x0a,0x5f,0xa0,0xaa,0xaa,0x80,0x88,0x24,0xf2,0x1c,0x38,0xd6,0x92,0xe6,0xff,0xbd,0x20,0x0f,0x7d,0xfb,0x3c,0x8f,0x44,0x40,0x2a,0x73,0x82,0x18,0x0b,0x98,0xad,0x0a,0xfc,0x8e,0xec,0x1a,0x02,0xac,0xec,0xf3,0xcb,0x7f,0xde,0x62,0x7b,0x9f,0x18,0x11,0x1f,0x26,0x0a,0xb1,0xdb,0x9a,0x07,},29,"\x32\xfe\x27\x99\x41\x24\x20\x21\x53\xb5\xc7\x0d\x38\x13\xfd\xee\x9c\x2a\xa6\xe7\xdc\x74\x3d\x4d\x53\x5f\x18\x40\xa5"},
+    {{0x94,0x1c,0xac,0x69,0xfb,0x7b,0x18,0x15,0xc5,0x7b,0xb9,0x87,0xc4,0xd6,0xc2,0xad,0x2c,0x35,0xd5,0xf9,0xa3,0x18,0x2a,0x79,0xd4,0xba,0x13,0xea,0xb2,0x53,0xa8,0xad,},{0x23,0xbe,0x32,0x3c,0x56,0x2d,0xfd,0x71,0xce,0x65,0xf5,0xbb,0xa5,0x6a,0x74,0xa3,0xa6,0xdf,0xc3,0x6b,0x57,0x3d,0x2f,0x94,0xf6,0x35,0xc7,0xf9,0xb4,0xfd,0x5a,0x5b,},{0x0f,0x8f,0xad,0x1e,0x6b,0xde,0x77,0x1b,0x4f,0x54,0x20,0xea,0xc7,0x5c,0x37,0x8b,0xae,0x6d,0xb5,0xac,0x66,0x50,0xcd,0x2b,0xc2,0x10,0xc1,0x82,0x3b,0x43,0x2b,0x48,0xe0,0x16,0xb1,0x05,0x95,0x45,0x8f,0xfa,0xb9,0x2f,0x7a,0x89,0x89,0xb2,0x93,0xce,0xb8,0xdf,0xed,0x6c,0x24,0x3a,0x20,0x38,0xfc,0x06,0x65,0x2a,0xaa,0xf1,0x6f,0x02,},30,"\xbb\x31\x72\x79\x57\x10\xfe\x00\x05\x4d\x3b\x5d\xfe\xf8\xa1\x16\x23\x58\x2d\xa6\x8b\xf8\xe4\x6d\x72\xd2\x7c\xec\xe2\xaa"},
+    {{0x1a,0xcd,0xbb,0x79,0x3b,0x03,0x84,0x93,0x46,0x27,0x47,0x0d,0x79,0x5c,0x3d,0x1d,0xd4,0xd7,0x9c,0xea,0x59,0xef,0x98,0x3f,0x29,0x5b,0x9b,0x59,0x17,0x9c,0xbb,0x28,},{0x3f,0x60,0xc7,0x54,0x1a,0xfa,0x76,0xc0,0x19,0xcf,0x5a,0xa8,0x2d,0xcd,0xb0,0x88,0xed,0x9e,0x4e,0xd9,0x78,0x05,0x14,0xae,0xfb,0x37,0x9d,0xab,0xc8,0x44,0xf3,0x1a,},{0xbe,0x71,0xef,0x48,0x06,0xcb,0x04,0x1d,0x88,0x5e,0xff,0xd9,0xe6,0xb0,0xfb,0xb7,0x3d,0x65,0xd7,0xcd,0xec,0x47,0xa8,0x9c,0x8a,0x99,0x48,0x92,0xf4,0xe5,0x5a,0x56,0x8c,0x4c,0xc7,0x8d,0x61,0xf9,0x01,0xe8,0x0d,0xbb,0x62,0x8b,0x86,0xa2,0x3c,0xcd,0x59,0x4e,0x71,0x2b,0x57,0xfa,0x94,0xc2,0xd6,0x7e,0xc2,0x66,0x34,0x87,0x85,0x07,},31,"\x7c\xf3\x4f\x75\xc3\xda\xc9\xa8\x04\xd0\xfc\xd0\x9e\xba\x9b\x29\xc9\x48\x4e\x8a\x01\x8f\xa9\xe0\x73\x04\x2d\xf8\x8e\x3c\x56"},
+    {{0x8e,0xd7,0xa7,0x97,0xb9,0xce,0xa8,0xa8,0x37,0x0d,0x41,0x91,0x36,0xbc,0xdf,0x68,0x3b,0x75,0x9d,0x2e,0x3c,0x69,0x47,0xf1,0x7e,0x13,0xe2,0x48,0x5a,0xa9,0xd4,0x20,},{0xb4,0x9f,0x3a,0x78,0xb1,0xc6,0xa7,0xfc,0xa8,0xf3,0x46,0x6f,0x33,0xbc,0x0e,0x92,0x9f,0x01,0xfb,0xa0,0x43,0x06,0xc2,0xa7,0x46,0x5f,0x46,0xc3,0x75,0x93,0x16,0xd9,},{0x04,0x26,0x6c,0x03,0x3b,0x91,0xc1,0x32,0x2c,0xeb,0x34,0x46,0xc9,0x01,0xff,0xcf,0x3c,0xc4,0x0c,0x40,0x34,0xe8,0x87,0xc9,0x59,0x7c,0xa1,0x89,0x3b,0xa7,0x33,0x0b,0xec,0xbb,0xd8,0xb4,0x81,0x42,0xef,0x35,0xc0,0x12,0xc6,0xba,0x51,0xa6,0x6d,0xf9,0x30,0x8c,0xb6,0x26,0x8a,0xd6,0xb1,0xe4,0xb0,0x3e,0x70,0x10,0x24,0x95,0x79,0x0b,},32,"\xa7\x50\xc2\x32\x93\x3d\xc1\x4b\x11\x84\xd8\x6d\x8b\x4c\xe7\x2e\x16\xd6\x97\x44\xba\x69\x81\x8b\x6a\xc3\x3b\x1d\x82\x3b\xb2\xc3"},
+    {{0xf2,0xab,0x39,0x6f,0xe8,0x90,0x6e,0x3e,0x56,0x33,0xe9,0x9c,0xab,0xcd,0x5b,0x09,0xdf,0x08,0x59,0xb5,0x16,0x23,0x0b,0x1e,0x04,0x50,0xb5,0x80,0xb6,0x5f,0x61,0x6c,},{0x8e,0xa0,0x74,0x24,0x51,0x59,0xa1,0x16,0xaa,0x71,0x22,0xa2,0x5e,0xc1,0x6b,0x89,0x1d,0x62,0x5a,0x68,0xf3,0x36,0x60,0x42,0x39,0x08,0xf6,0xbd,0xc4,0x4f,0x8c,0x1b,},{0xa0,0x6a,0x23,0xd9,0x82,0xd8,0x1a,0xb8,0x83,0xaa,0xe2,0x30,0xad,0xbc,0x36,0x8a,0x6a,0x99,0x77,0xf0,0x03,0xce,0xbb,0x00,0xd4,0xc2,0xe4,0x01,0x84,0x90,0x19,0x1a,0x84,0xd3,0xa2,0x82,0xfd,0xbf,0xb2,0xfc,0x88,0x04,0x6e,0x62,0xde,0x43,0xe1,0x5f,0xb5,0x75,0x33,0x6b,0x3c,0x8b,0x77,0xd1,0x9c,0xe6,0xa0,0x09,0xce,0x51,0xf5,0x0c,},33,"\x5a\x44\xe3\x4b\x74\x6c\x5f\xd1\x89\x8d\x55\x2a\xb3\x54\xd2\x8f\xb4\x71\x38\x56\xd7\x69\x7d\xd6\x3e\xb9\xbd\x6b\x99\xc2\x80\xe1\x87"},
+    {{0x55,0x0a,0x41,0xc0,0x13,0xf7,0x9b,0xab,0x8f,0x06,0xe4,0x3a,0xd1,0x83,0x6d,0x51,0x31,0x27,0x36,0xa9,0x71,0x38,0x06,0xfa,0xfe,0x66,0x45,0x21,0x9e,0xaa,0x1f,0x9d,},{0xaf,0x6b,0x71,0x45,0x47,0x4d,0xc9,0x95,0x4b,0x9a,0xf9,0x3a,0x9c,0xdb,0x34,0x44,0x9d,0x5b,0x7c,0x65,0x1c,0x82,0x4d,0x24,0xe2,0x30,0xb9,0x00,0x33,0xce,0x59,0xc0,},{0x16,0xdc,0x1e,0x2b,0x9f,0xa9,0x09,0xee,0xfd,0xc2,0x77,0xba,0x16,0xeb,0xe2,0x07,0xb8,0xda,0x5e,0x91,0x14,0x3c,0xde,0x78,0xc5,0x04,0x7a,0x89,0xf6,0x81,0xc3,0x3c,0x4e,0x4e,0x34,0x28,0xd5,0xc9,0x28,0x09,0x59,0x03,0xa8,0x11,0xec,0x00,0x2d,0x52,0xa3,0x9e,0xd7,0xf8,0xb3,0xfe,0x19,0x27,0x20,0x0c,0x6d,0xd0,0xb9,0xab,0x3e,0x04,},34,"\x8b\xc4\x18\x5e\x50\xe5\x7d\x5f\x87\xf4\x75\x15\xfe\x2b\x18\x37\xd5\x85\xf0\xaa\xe9\xe1\xca\x38\x3b\x3e\xc9\x08\x88\x4b\xb9\x00\xff\x27"},
+    {{0x19,0xac,0x3e,0x27,0x24,0x38,0xc7,0x2d,0xdf,0x7b,0x88,0x19,0x64,0x86,0x7c,0xb3,0xb3,0x1f,0xf4,0xc7,0x93,0xbb,0x7e,0xa1,0x54,0x61,0x3c,0x1d,0xb0,0x68,0xcb,0x7e,},{0xf8,0x5b,0x80,0xe0,0x50,0xa1,0xb9,0x62,0x0d,0xb1,0x38,0xbf,0xc9,0xe1,0x00,0x32,0x7e,0x25,0xc2,0x57,0xc5,0x92,0x17,0xb6,0x01,0xf1,0xf6,0xac,0x9a,0x41,0x3d,0x3f,},{0xea,0x85,0x5d,0x78,0x1c,0xbe,0xa4,0x68,0x2e,0x35,0x01,0x73,0xcb,0x89,0xe8,0x61,0x9c,0xcf,0xdd,0xb9,0x7c,0xdc,0xe1,0x6f,0x9a,0x2f,0x6f,0x68,0x92,0xf4,0x6d,0xbe,0x68,0xe0,0x4b,0x12,0xb8,0xd8,0x86,0x89,0xa7,0xa3,0x16,0x70,0xcd,0xff,0x40,0x9a,0xf9,0x8a,0x93,0xb4,0x9a,0x34,0x53,0x7b,0x6a,0xa0,0x09,0xd2,0xeb,0x8b,0x47,0x01,},35,"\x95\x87\x2d\x5f\x78\x9f\x95\x48\x4e\x30\xcb\xb0\xe1\x14\x02\x89\x53\xb1\x6f\x5c\x6a\x8d\x9f\x65\xc0\x03\xa8\x35\x43\xbe\xaa\x46\xb3\x86\x45"},
+    {{0xca,0x26,0x7d,0xe9,0x6c,0x93,0xc2,0x38,0xfa,0xfb,0x12,0x79,0x81,0x20,0x59,0xab,0x93,0xac,0x03,0x05,0x96,0x57,0xfd,0x99,0x4f,0x8f,0xa5,0xa0,0x92,0x39,0xc8,0x21,},{0x01,0x73,0x70,0xc8,0x79,0x09,0x0a,0x81,0xc7,0xf2,0x72,0xc2,0xfc,0x80,0xe3,0xaa,0xc2,0xbc,0x60,0x3f,0xcb,0x37,0x9a,0xfc,0x98,0x69,0x11,0x60,0xab,0x74,0x5b,0x26,},{0xac,0x95,0x7f,0x82,0x33,0x5a,0xa7,0x14,0x1e,0x96,0xb5,0x9d,0x63,0xe3,0xcc,0xee,0x95,0xc3,0xa2,0xc4,0x7d,0x02,0x65,0x40,0xc2,0xaf,0x42,0xdc,0x95,0x33,0xd5,0xfd,0x81,0x82,0x7d,0x16,0x79,0xad,0x18,0x7a,0xea,0xf3,0x78,0x34,0x91,0x5e,0x75,0xb1,0x47,0xa9,0x28,0x68,0x06,0xc8,0x01,0x75,0x16,0xba,0x43,0xdd,0x05,0x1a,0x5e,0x0c,},36,"\xe0\x5f\x71\xe4\xe4\x9a\x72\xec\x55\x0c\x44\xa3\xb8\x5a\xca\x8f\x20\xff\x26\xc3\xee\x94\xa8\x0f\x1b\x43\x1c\x7d\x15\x4e\xc9\x60\x3e\xe0\x25\x31"},
+    {{0x3d,0xff,0x5e,0x89,0x94,0x75,0xe7,0xe9,0x1d,0xd2,0x61,0x32,0x2f,0xab,0x09,0x98,0x0c,0x52,0x97,0x0d,0xe1,0xda,0x6e,0x2e,0x20,0x16,0x60,0xcc,0x4f,0xce,0x70,0x32,},{0xf3,0x01,0x62,0xba,0xc9,0x84,0x47,0xc4,0x04,0x2f,0xac,0x05,0xda,0x44,0x80,0x34,0x62,0x9b,0xe2,0xc6,0xa5,0x8d,0x30,0xdf,0xd5,0x78,0xba,0x9f,0xb5,0xe3,0x93,0x0b,},{0x5e,0xfe,0x7a,0x92,0xff,0x96,0x23,0x08,0x9b,0x3e,0x3b,0x78,0xf3,0x52,0x11,0x53,0x66,0xe2,0x6b,0xa3,0xfb,0x1a,0x41,0x62,0x09,0xbc,0x02,0x9e,0x9c,0xad,0xcc,0xd9,0xf4,0xaf,0xfa,0x33,0x35,0x55,0xa8,0xf3,0xa3,0x5a,0x9d,0x0f,0x7c,0x34,0xb2,0x92,0xca,0xe7,0x7e,0xc9,0x6f,0xa3,0xad,0xfc,0xaa,0xde,0xe2,0xd9,0xce,0xd8,0xf8,0x05,},37,"\x93\x8f\x0e\x77\x62\x1b\xf3\xea\x52\xc7\xc4\x91\x1c\x51\x57\xc2\xd8\xa2\xa8\x58\x09\x3e\xf1\x6a\xa9\xb1\x07\xe6\x9d\x98\x03\x7b\xa1\x39\xa3\xc3\x82"},
+    {{0x9a,0x6b,0x84,0x78,0x64,0xe7,0x0c,0xfe,0x8b,0xa6,0xab,0x22,0xfa,0x0c,0xa3,0x08,0xc0,0xcc,0x8b,0xec,0x71,0x41,0xfb,0xca,0xa3,0xb8,0x1f,0x5d,0x1e,0x1c,0xfc,0xfc,},{0x34,0xad,0x0f,0xbd,0xb2,0x56,0x65,0x07,0xa8,0x1c,0x2b,0x1f,0x8a,0xa8,0xf5,0x3d,0xcc,0xaa,0x64,0xcc,0x87,0xad,0xa9,0x1b,0x90,0x3e,0x90,0x0d,0x07,0xee,0xe9,0x30,},{0x2a,0xb2,0x55,0x16,0x9c,0x48,0x9c,0x54,0xc7,0x32,0x23,0x2e,0x37,0xc8,0x73,0x49,0xd4,0x86,0xb1,0xeb,0xa2,0x05,0x09,0xdb,0xab,0xe7,0xfe,0xd3,0x29,0xef,0x08,0xfd,0x75,0xba,0x1c,0xd1,0x45,0xe6,0x7b,0x2e,0xa2,0x6c,0xb5,0xcc,0x51,0xca,0xb3,0x43,0xee,0xb0,0x85,0xfe,0x1f,0xd7,0xb0,0xec,0x4c,0x6a,0xfc,0xd9,0xb9,0x79,0xf9,0x05,},38,"\x83\x83\x67\x47\x11\x83\xc7\x1f\x7e\x71\x77\x24\xf8\x9d\x40\x1c\x3a\xd9\x86\x3f\xd9\xcc\x7a\xa3\xcf\x33\xd3\xc5\x29\x86\x0c\xb5\x81\xf3\x09\x3d\x87\xda"},
+    {{0x57,0x5b,0xe0,0x7a,0xfc,0xa5,0xd0,0x63,0xc2,0x38,0xcd,0x9b,0x80,0x28,0x77,0x2c,0xc4,0x9c,0xda,0x34,0x47,0x14,0x32,0xa2,0xe1,0x66,0xe0,0x96,0xe2,0x21,0x9e,0xfc,},{0x94,0xe5,0xeb,0x4d,0x50,0x24,0xf4,0x9d,0x7e,0xbf,0x79,0x81,0x7c,0x8d,0xe1,0x14,0x97,0xdc,0x2b,0x55,0x62,0x2a,0x51,0xae,0x12,0x3f,0xfc,0x74,0x9d,0xbb,0x16,0xe0,},{0x58,0x27,0x1d,0x44,0x23,0x6f,0x3b,0x98,0xc5,0x8f,0xd7,0xae,0x0d,0x2f,0x49,0xef,0x2b,0x6e,0x3a,0xff,0xdb,0x22,0x5a,0xa3,0xba,0x55,0x5f,0x0e,0x11,0xcc,0x53,0xc2,0x3a,0xd1,0x9b,0xaf,0x24,0x34,0x65,0x90,0xd0,0x5d,0x7d,0x53,0x90,0x58,0x20,0x82,0xcf,0x94,0xd3,0x9c,0xad,0x65,0x30,0xab,0x93,0xd1,0x3e,0xfb,0x39,0x27,0x95,0x06,},39,"\x33\xe5\x91\x8b\x66\xd3\x3d\x55\xfe\x71\x7c\xa3\x43\x83\xea\xe7\x8f\x0a\xf8\x28\x89\xca\xf6\x69\x6e\x1a\xc9\xd9\x5d\x1f\xfb\x32\xcb\xa7\x55\xf9\xe3\x50\x3e"},
+    {{0x15,0xff,0xb4,0x55,0x14,0xd4,0x34,0x44,0xd6,0x1f,0xcb,0x10,0x5e,0x30,0xe1,0x35,0xfd,0x26,0x85,0x23,0xdd,0xa2,0x0b,0x82,0x75,0x8b,0x17,0x94,0x23,0x11,0x04,0x41,},{0x17,0x72,0xc5,0xab,0xc2,0xd2,0x3f,0xd2,0xf9,0xd1,0xc3,0x25,0x7b,0xe7,0xbc,0x3c,0x1c,0xd7,0x9c,0xee,0x40,0x84,0x4b,0x74,0x9b,0x3a,0x77,0x43,0xd2,0xf9,0x64,0xb8,},{0x68,0x28,0xcd,0x76,0x24,0xe7,0x93,0xb8,0xa4,0xce,0xb9,0x6d,0x3c,0x2a,0x97,0x5b,0xf7,0x73,0xe5,0xff,0x66,0x45,0xf3,0x53,0x61,0x40,0x58,0x62,0x1e,0x58,0x83,0x52,0x89,0xe7,0xf3,0x1f,0x42,0xdf,0xe6,0xaf,0x6d,0x73,0x6f,0x26,0x44,0x51,0x1e,0x32,0x0c,0x0f,0xa6,0x98,0x58,0x2a,0x79,0x77,0x8d,0x18,0x73,0x0e,0xd3,0xe8,0xcb,0x08,},40,"\xda\x9c\x55\x59\xd0\xea\x51\xd2\x55\xb6\xbd\x9d\x76\x38\xb8\x76\x47\x2f\x94\x2b\x33\x0f\xc0\xe2\xb3\x0a\xea\x68\xd7\x73\x68\xfc\xe4\x94\x82\x72\x99\x1d\x25\x7e"},
+    {{0xfe,0x05,0x68,0x64,0x29,0x43,0xb2,0xe1,0xaf,0xbf,0xd1,0xf1,0x0f,0xe8,0xdf,0x87,0xa4,0x23,0x6b,0xea,0x40,0xdc,0xe7,0x42,0x07,0x2c,0xb2,0x18,0x86,0xee,0xc1,0xfa,},{0x29,0x9e,0xbd,0x1f,0x13,0x17,0x7d,0xbd,0xb6,0x6a,0x91,0x2b,0xbf,0x71,0x20,0x38,0xfd,0xf7,0x3b,0x06,0xc3,0xac,0x02,0x0c,0x7b,0x19,0x12,0x67,0x55,0xd4,0x7f,0x61,},{0xd5,0x9e,0x6d,0xfc,0xc6,0xd7,0xe3,0xe2,0xc5,0x8d,0xec,0x81,0xe9,0x85,0xd2,0x45,0xe6,0x81,0xac,0xf6,0x59,0x4a,0x23,0xc5,0x92,0x14,0xf7,0xbe,0xd8,0x01,0x5d,0x81,0x3c,0x76,0x82,0xb6,0x0b,0x35,0x83,0x44,0x03,0x11,0xe7,0x2a,0x86,0x65,0xba,0x2c,0x96,0xde,0xc2,0x3c,0xe8,0x26,0xe1,0x60,0x12,0x7e,0x18,0x13,0x2b,0x03,0x04,0x04,},41,"\xc5\x9d\x08\x62\xec\x1c\x97\x46\xab\xcc\x3c\xf8\x3c\x9e\xeb\xa2\xc7\x08\x2a\x03\x6a\x8c\xb5\x7c\xe4\x87\xe7\x63\x49\x27\x96\xd4\x7e\x6e\x06\x3a\x0c\x1f\xec\xcc\x2d"},
+    {{0x5e,0xcb,0x16,0xc2,0xdf,0x27,0xc8,0xcf,0x58,0xe4,0x36,0xa9,0xd3,0xaf,0xfb,0xd5,0x8e,0x95,0x38,0xa9,0x26,0x59,0xa0,0xf9,0x7c,0x4c,0x4f,0x99,0x46,0x35,0xa8,0xca,},{0xda,0x76,0x8b,0x20,0xc4,0x37,0xdd,0x3a,0xa5,0xf8,0x4b,0xb6,0xa0,0x77,0xff,0xa3,0x4a,0xb6,0x85,0x01,0xc5,0x35,0x2b,0x5c,0xc3,0xfd,0xce,0x7f,0xe6,0xc2,0x39,0x8d,},{0x1c,0x72,0x3a,0x20,0xc6,0x77,0x24,0x26,0xa6,0x70,0xe4,0xd5,0xc4,0xa9,0x7c,0x6e,0xbe,0x91,0x47,0xf7,0x1b,0xb0,0xa4,0x15,0x63,0x1e,0x44,0x40,0x6e,0x29,0x03,0x22,0xe4,0xca,0x97,0x7d,0x34,0x8f,0xe7,0x85,0x6a,0x8e,0xdc,0x23,0x5d,0x0f,0xe9,0x5f,0x7e,0xd9,0x1a,0xef,0xdd,0xf2,0x8a,0x77,0xe2,0xc7,0xdb,0xfd,0x8f,0x55,0x2f,0x0a,},42,"\x56\xf1\x32\x9d\x9a\x6b\xe2\x5a\x61\x59\xc7\x2f\x12\x68\x8d\xc8\x31\x4e\x85\xdd\x9e\x7e\x4d\xc0\x5b\xbe\xcb\x77\x29\xe0\x23\xc8\x6f\x8e\x09\x37\x35\x3f\x27\xc7\xed\xe9"},
+    {{0xd5,0x99,0xd6,0x37,0xb3,0xc3,0x0a,0x82,0xa9,0x98,0x4e,0x2f,0x75,0x84,0x97,0xd1,0x44,0xde,0x6f,0x06,0xb9,0xfb,0xa0,0x4d,0xd4,0x0f,0xd9,0x49,0x03,0x9d,0x7c,0x84,},{0x67,0x91,0xd8,0xce,0x50,0xa4,0x46,0x89,0xfc,0x17,0x87,0x27,0xc5,0xc3,0xa1,0xc9,0x59,0xfb,0xee,0xd7,0x4e,0xf7,0xd8,0xe7,0xbd,0x3c,0x1a,0xb4,0xda,0x31,0xc5,0x1f,},{0xeb,0xf1,0x0d,0x9a,0xc7,0xc9,0x61,0x08,0x14,0x0e,0x7d,0xef,0x6f,0xe9,0x53,0x3d,0x72,0x76,0x46,0xff,0x5b,0x3a,0xf2,0x73,0xc1,0xdf,0x95,0x76,0x2a,0x66,0xf3,0x2b,0x65,0xa0,0x96,0x34,0xd0,0x13,0xf5,0x4b,0x5d,0xd6,0x01,0x1f,0x91,0xbc,0x33,0x6c,0xa8,0xb3,0x55,0xce,0x33,0xf8,0xcf,0xbe,0xc2,0x53,0x5a,0x4c,0x42,0x7f,0x82,0x05,},43,"\xa7\xc0\x4e\x8b\xa7\x5d\x0a\x03\xd8\xb1\x66\xad\x7a\x1d\x77\xe1\xb9\x1c\x7a\xaf\x7b\xef\xdd\x99\x31\x1f\xc3\xc5\x4a\x68\x4d\xdd\x97\x1d\x5b\x32\x11\xc3\xee\xaf\xf1\xe5\x4e"},
+    {{0x30,0xab,0x82,0x32,0xfa,0x70,0x18,0xf0,0xce,0x6c,0x39,0xbd,0x8f,0x78,0x2f,0xe2,0xe1,0x59,0x75,0x8b,0xb0,0xf2,0xf4,0x38,0x6c,0x7f,0x28,0xcf,0xd2,0xc8,0x58,0x98,},{0xec,0xfb,0x6a,0x2b,0xd4,0x2f,0x31,0xb6,0x12,0x50,0xba,0x5d,0xe7,0xe4,0x6b,0x47,0x19,0xaf,0xdf,0xbc,0x66,0x0d,0xb7,0x1a,0x7b,0xd1,0xdf,0x7b,0x0a,0x3a,0xbe,0x37,},{0x9a,0xf8,0x85,0x34,0x4c,0xc7,0x23,0x94,0x98,0xf7,0x12,0xdf,0x80,0xbc,0x01,0xb8,0x06,0x38,0x29,0x1e,0xd4,0xa1,0xd2,0x8b,0xaa,0x55,0x45,0x01,0x7a,0x72,0xe2,0xf6,0x56,0x49,0xcc,0xf9,0x60,0x3d,0xa6,0xeb,0x5b,0xfa,0xb9,0xf5,0x54,0x3a,0x6c,0xa4,0xa7,0xaf,0x38,0x66,0x15,0x3c,0x76,0xbf,0x66,0xbf,0x95,0xde,0xf6,0x15,0xb0,0x0c,},44,"\x63\xb8\x0b\x79\x56\xac\xbe\xcf\x0c\x35\xe9\xab\x06\xb9\x14\xb0\xc7\x01\x4f\xe1\xa4\xbb\xc0\x21\x72\x40\xc1\xa3\x30\x95\xd7\x07\x95\x3e\xd7\x7b\x15\xd2\x11\xad\xaf\x9b\x97\xdc"},
+    {{0x0d,0xdc,0xdc,0x87,0x2c,0x7b,0x74,0x8d,0x40,0xef,0xe9,0x6c,0x28,0x81,0xae,0x18,0x9d,0x87,0xf5,0x61,0x48,0xed,0x8a,0xf3,0xeb,0xbb,0xc8,0x03,0x24,0xe3,0x8b,0xdd,},{0x58,0x8d,0xda,0xdc,0xbc,0xed,0xf4,0x0d,0xf0,0xe9,0x69,0x7d,0x8b,0xb2,0x77,0xc7,0xbb,0x14,0x98,0xfa,0x1d,0x26,0xce,0x0a,0x83,0x5a,0x76,0x0b,0x92,0xca,0x7c,0x85,},{0xc1,0x79,0xc0,0x94,0x56,0xe2,0x35,0xfe,0x24,0x10,0x5a,0xfa,0x6e,0x8e,0xc0,0x46,0x37,0xf8,0xf9,0x43,0x81,0x7c,0xd0,0x98,0xba,0x95,0x38,0x7f,0x96,0x53,0xb2,0xad,0xd1,0x81,0xa3,0x14,0x47,0xd9,0x2d,0x1a,0x1d,0xdf,0x1c,0xeb,0x0d,0xb6,0x21,0x18,0xde,0x9d,0xff,0xb7,0xdc,0xd2,0x42,0x40,0x57,0xcb,0xdf,0xf5,0xd4,0x1d,0x04,0x03,},45,"\x65\x64\x1c\xd4\x02\xad\xd8\xbf\x3d\x1d\x67\xdb\xeb\x6d\x41\xde\xbf\xbe\xf6\x7e\x43\x17\xc3\x5b\x0a\x6d\x5b\xbb\xae\x0e\x03\x4d\xe7\xd6\x70\xba\x14\x13\xd0\x56\xf2\xd6\xf1\xde\x12"},
+    {{0x89,0xf0,0xd6,0x82,0x99,0xba,0x0a,0x5a,0x83,0xf2,0x48,0xae,0x0c,0x16,0x9f,0x8e,0x38,0x49,0xa9,0xb4,0x7b,0xd4,0x54,0x98,0x84,0x30,0x5c,0x99,0x12,0xb4,0x66,0x03,},{0xab,0xa3,0xe7,0x95,0xaa,0xb2,0x01,0x2a,0xcc,0xea,0xdd,0x7b,0x3b,0xd9,0xda,0xee,0xed,0x6f,0xf5,0x25,0x8b,0xdc,0xd7,0xc9,0x36,0x99,0xc2,0xa3,0x83,0x6e,0x38,0x32,},{0x2c,0x69,0x1f,0xa8,0xd4,0x87,0xce,0x20,0xd5,0xd2,0xfa,0x41,0x55,0x91,0x16,0xe0,0xbb,0xf4,0x39,0x7c,0xf5,0x24,0x0e,0x15,0x25,0x56,0x18,0x35,0x41,0xd6,0x6c,0xf7,0x53,0x58,0x24,0x01,0xa4,0x38,0x8d,0x39,0x03,0x39,0xdb,0xef,0x4d,0x38,0x47,0x43,0xca,0xa3,0x46,0xf5,0x5f,0x8d,0xab,0xa6,0x8b,0xa7,0xb9,0x13,0x1a,0x8a,0x6e,0x0b,},46,"\x4f\x18\x46\xdd\x7a\xd5\x0e\x54\x5d\x4c\xfb\xff\xbb\x1d\xc2\xff\x14\x5d\xc1\x23\x75\x4d\x08\xaf\x4e\x44\xec\xc0\xbc\x8c\x91\x41\x13\x88\xbc\x76\x53\xe2\xd8\x93\xd1\xea\xc2\x10\x7d\x05"},
+    {{0x0a,0x3c,0x18,0x44,0xe2,0xdb,0x07,0x0f,0xb2,0x4e,0x3c,0x95,0xcb,0x1c,0xc6,0x71,0x4e,0xf8,0x4e,0x2c,0xcd,0x2b,0x9d,0xd2,0xf1,0x46,0x0e,0xbf,0x7e,0xcf,0x13,0xb1,},{0x72,0xe4,0x09,0x93,0x7e,0x06,0x10,0xeb,0x5c,0x20,0xb3,0x26,0xdc,0x6e,0xa1,0xbb,0xbc,0x04,0x06,0x70,0x1c,0x5c,0xd6,0x7d,0x1f,0xbd,0xe0,0x91,0x92,0xb0,0x7c,0x01,},{0x87,0xf7,0xfd,0xf4,0x60,0x95,0x20,0x1e,0x87,0x7a,0x58,0x8f,0xe3,0xe5,0xaa,0xf4,0x76,0xbd,0x63,0x13,0x8d,0x8a,0x87,0x8b,0x89,0xd6,0xac,0x60,0x63,0x1b,0x34,0x58,0xb9,0xd4,0x1a,0x3c,0x61,0xa5,0x88,0xe1,0xdb,0x8d,0x29,0xa5,0x96,0x89,0x81,0xb0,0x18,0x77,0x6c,0x58,0x87,0x80,0x92,0x2f,0x5a,0xa7,0x32,0xba,0x63,0x79,0xdd,0x05,},47,"\x4c\x82\x74\xd0\xed\x1f\x74\xe2\xc8\x6c\x08\xd9\x55\xbd\xe5\x5b\x2d\x54\x32\x7e\x82\x06\x2a\x1f\x71\xf7\x0d\x53\x6f\xdc\x87\x22\xcd\xea\xd7\xd2\x2a\xae\xad\x2b\xfa\xa1\xad\x00\xb8\x29\x57"},
+    {{0xc8,0xd7,0xa8,0x81,0x8b,0x98,0xdf,0xdb,0x20,0x83,0x9c,0x87,0x1c,0xb5,0xc4,0x8e,0x9e,0x94,0x70,0xca,0x3a,0xd3,0x5b,0xa2,0x61,0x3a,0x5d,0x31,0x99,0xc8,0xab,0x23,},{0x90,0xd2,0xef,0xbb,0xa4,0xd4,0x3e,0x6b,0x2b,0x99,0x2c,0xa1,0x60,0x83,0xdb,0xcf,0xa2,0xb3,0x22,0x38,0x39,0x07,0xb0,0xee,0x75,0xf3,0xe9,0x58,0x45,0xd3,0xc4,0x7f,},{0xfa,0x2e,0x99,0x44,0x21,0xae,0xf1,0xd5,0x85,0x66,0x74,0x81,0x3d,0x05,0xcb,0xd2,0xcf,0x84,0xef,0x5e,0xb4,0x24,0xaf,0x6e,0xcd,0x0d,0xc6,0xfd,0xbd,0xc2,0xfe,0x60,0x5f,0xe9,0x85,0x88,0x33,0x12,0xec,0xf3,0x4f,0x59,0xbf,0xb2,0xf1,0xc9,0x14,0x9e,0x5b,0x9c,0xc9,0xec,0xda,0x05,0xb2,0x73,0x11,0x30,0xf3,0xed,0x28,0xdd,0xae,0x0b,},48,"\x78\x3e\x33\xc3\xac\xbd\xbb\x36\xe8\x19\xf5\x44\xa7\x78\x1d\x83\xfc\x28\x3d\x33\x09\xf5\xd3\xd1\x2c\x8d\xcd\x6b\x0b\x3d\x0e\x89\xe3\x8c\xfd\x3b\x4d\x08\x85\x66\x1c\xa5\x47\xfb\x97\x64\xab\xff"},
+    {{0xb4,0x82,0x70,0x36,0x12,0xd0,0xc5,0x86,0xf7,0x6c,0xfc,0xb2,0x1c,0xfd,0x21,0x03,0xc9,0x57,0x25,0x15,0x04,0xa8,0xc0,0xac,0x4c,0x86,0xc9,0xc6,0xf3,0xe4,0x29,0xff,},{0xfd,0x71,0x1d,0xc7,0xdd,0x3b,0x1d,0xfb,0x9d,0xf9,0x70,0x4b,0xe3,0xe6,0xb2,0x6f,0x58,0x7f,0xe7,0xdd,0x7b,0xa4,0x56,0xa9,0x1b,0xa4,0x3f,0xe5,0x1a,0xec,0x09,0xad,},{0x58,0x83,0x2b,0xde,0xb2,0x6f,0xea,0xfc,0x31,0xb4,0x62,0x77,0xcf,0x3f,0xb5,0xd7,0xa1,0x7d,0xfb,0x7c,0xcd,0x9b,0x1f,0x58,0xec,0xbe,0x6f,0xeb,0x97,0x96,0x66,0x82,0x8f,0x23,0x9b,0xa4,0xd7,0x52,0x19,0x26,0x0e,0xca,0xc0,0xac,0xf4,0x0f,0x0e,0x5e,0x25,0x90,0xf4,0xca,0xa1,0x6b,0xbb,0xcd,0x8a,0x15,0x5d,0x34,0x79,0x67,0xa6,0x07,},49,"\x29\xd7\x7a\xcf\xd9\x9c\x7a\x00\x70\xa8\x8f\xeb\x62\x47\xa2\xbc\xe9\x98\x4f\xe3\xe6\xfb\xf1\x9d\x40\x45\x04\x2a\x21\xab\x26\xcb\xd7\x71\xe1\x84\xa9\xa7\x5f\x31\x6b\x64\x8c\x69\x20\xdb\x92\xb8\x7b"},
+    {{0x84,0xe5,0x0d,0xd9,0xa0,0xf1,0x97,0xe3,0x89,0x3c,0x38,0xdb,0xd9,0x1f,0xaf,0xc3,0x44,0xc1,0x77,0x6d,0x3a,0x40,0x0e,0x2f,0x0f,0x0e,0xe7,0xaa,0x82,0x9e,0xb8,0xa2,},{0x2c,0x50,0xf8,0x70,0xee,0x48,0xb3,0x6b,0x0a,0xc2,0xf8,0xa5,0xf3,0x36,0xfb,0x09,0x0b,0x11,0x30,0x50,0xdb,0xcc,0x25,0xe0,0x78,0x20,0x0a,0x6e,0x16,0x15,0x3e,0xea,},{0x69,0xe6,0xa4,0x49,0x1a,0x63,0x83,0x73,0x16,0xe8,0x6a,0x5f,0x4b,0xa7,0xcd,0x0d,0x73,0x1e,0xcc,0x58,0xf1,0xd0,0xa2,0x64,0xc6,0x7c,0x89,0xbe,0xfd,0xd8,0xd3,0x82,0x9d,0x8d,0xe1,0x3b,0x33,0xcc,0x0b,0xf5,0x13,0x93,0x17,0x15,0xc7,0x80,0x96,0x57,0xe2,0xbf,0xb9,0x60,0xe5,0xc7,0x64,0xc9,0x71,0xd7,0x33,0x74,0x60,0x93,0xe5,0x00,},50,"\xf3\x99\x2c\xde\x64\x93\xe6\x71\xf1\xe1\x29\xdd\xca\x80\x38\xb0\xab\xdb\x77\xbb\x90\x35\xf9\xf8\xbe\x54\xbd\x5d\x68\xc1\xae\xff\x72\x4f\xf4\x7d\x29\x34\x43\x91\xdc\x53\x61\x66\xb8\x67\x1c\xbb\xf1\x23"},
+    {{0xb3,0x22,0xd4,0x65,0x77,0xa2,0xa9,0x91,0xa4,0xd1,0x69,0x82,0x87,0x83,0x2a,0x39,0xc4,0x87,0xef,0x77,0x6b,0x4b,0xff,0x03,0x7a,0x05,0xc7,0xf1,0x81,0x2b,0xde,0xec,},{0xeb,0x2b,0xca,0xdf,0xd3,0xee,0xc2,0x98,0x6b,0xaf,0xf3,0x2b,0x98,0xe7,0xc4,0xdb,0xf0,0x3f,0xf9,0x5d,0x8a,0xd5,0xff,0x9a,0xa9,0x50,0x6e,0x54,0x72,0xff,0x84,0x5f,},{0xc7,0xb5,0x51,0x37,0x31,0x7c,0xa2,0x1e,0x33,0x48,0x9f,0xf6,0xa9,0xbf,0xab,0x97,0xc8,0x55,0xdc,0x6f,0x85,0x68,0x4a,0x70,0xa9,0x12,0x5a,0x26,0x1b,0x56,0xd5,0xe6,0xf1,0x49,0xc5,0x77,0x4d,0x73,0x4f,0x2d,0x8d,0xeb,0xfc,0x77,0xb7,0x21,0x89,0x6a,0x82,0x67,0xc2,0x37,0x68,0xe9,0xba,0xdb,0x91,0x0e,0xef,0x83,0xec,0x25,0x88,0x02,},51,"\x19\xf1\xbf\x5d\xcf\x17\x50\xc6\x11\xf1\xc4\xa2\x86\x52\x00\x50\x4d\x82\x29\x8e\xdd\x72\x67\x1f\x62\xa7\xb1\x47\x1a\xc3\xd4\xa3\x0f\x7d\xe9\xe5\xda\x41\x08\xc5\x2a\x4c\xe7\x0a\x3e\x11\x4a\x52\xa3\xb3\xc5"},
+    {{0x96,0x0c,0xab,0x50,0x34,0xb9,0x83,0x8d,0x09,0x8d,0x2d,0xcb,0xf4,0x36,0x4b,0xec,0x16,0xd3,0x88,0xf6,0x37,0x6d,0x73,0xa6,0x27,0x3b,0x70,0xf8,0x2b,0xbc,0x98,0xc0,},{0x5e,0x3c,0x19,0xf2,0x41,0x5a,0xcf,0x72,0x9f,0x82,0x9a,0x4e,0xbd,0x5c,0x40,0xe1,0xa6,0xbc,0x9f,0xbc,0xa9,0x57,0x03,0xa9,0x37,0x60,0x87,0xed,0x09,0x37,0xe5,0x1a,},{0x27,0xd4,0xc3,0xa1,0x81,0x1e,0xf9,0xd4,0x36,0x0b,0x3b,0xdd,0x13,0x3c,0x2c,0xcc,0x30,0xd0,0x2c,0x2f,0x24,0x82,0x15,0x77,0x6c,0xb0,0x7e,0xe4,0x17,0x7f,0x9b,0x13,0xfc,0x42,0xdd,0x70,0xa6,0xc2,0xfe,0xd8,0xf2,0x25,0xc7,0x66,0x3c,0x7f,0x18,0x2e,0x7e,0xe8,0xec,0xcf,0xf2,0x0d,0xc7,0xb0,0xe1,0xd5,0x83,0x4e,0xc5,0xb1,0xea,0x01,},52,"\xf8\xb2\x19\x62\x44\x7b\x0a\x8f\x2e\x42\x79\xde\x41\x1b\xea\x12\x8e\x0b\xe4\x4b\x69\x15\xe6\xcd\xa8\x83\x41\xa6\x8a\x0d\x81\x83\x57\xdb\x93\x8e\xac\x73\xe0\xaf\x6d\x31\x20\x6b\x39\x48\xf8\xc4\x8a\x44\x73\x08"},
+    {{0xeb,0x77,0xb2,0x63,0x8f,0x23,0xee,0xbc,0x82,0xef,0xe4,0x5e,0xe9,0xe5,0xa0,0x32,0x66,0x37,0x40,0x1e,0x66,0x3e,0xd0,0x29,0x69,0x9b,0x21,0xe6,0x44,0x3f,0xb4,0x8e,},{0x9e,0xf2,0x76,0x08,0x96,0x1a,0xc7,0x11,0xde,0x71,0xa6,0xe2,0xd4,0xd4,0x66,0x3e,0xa3,0xec,0xd4,0x2f,0xb7,0xe4,0xe8,0x62,0x7c,0x39,0x62,0x2d,0xf4,0xaf,0x0b,0xbc,},{0x18,0xdc,0x56,0xd7,0xbd,0x9a,0xcd,0x4f,0x4d,0xaa,0x78,0x54,0x0b,0x4a,0xc8,0xff,0x7a,0xa9,0x81,0x5f,0x45,0xa0,0xbb,0xa3,0x70,0x73,0x1a,0x14,0xea,0xab,0xe9,0x6d,0xf8,0xb5,0xf3,0x7d,0xbf,0x8e,0xae,0x4c,0xb1,0x5a,0x64,0xb2,0x44,0x65,0x1e,0x59,0xd6,0xa3,0xd6,0x76,0x1d,0x9e,0x3c,0x50,0xf2,0xd0,0xcb,0xb0,0x9c,0x05,0xec,0x06,},53,"\x99\xe3\xd0\x09\x34\x00\x3e\xba\xfc\x3e\x9f\xdb\x68\x7b\x0f\x5f\xf9\xd5\x78\x2a\x4b\x1f\x56\xb9\x70\x00\x46\xc0\x77\x91\x56\x02\xc3\x13\x4e\x22\xfc\x90\xed\x7e\x69\x0f\xdd\xd4\x43\x3e\x20\x34\xdc\xb2\xdc\x99\xab"},
+    {{0xb6,0x25,0xaa,0x89,0xd3,0xf7,0x30,0x87,0x15,0x42,0x7b,0x6c,0x39,0xbb,0xac,0x58,0xef,0xfd,0x3a,0x0f,0xb7,0x31,0x6f,0x7a,0x22,0xb9,0x9e,0xe5,0x92,0x2f,0x2d,0xc9,},{0x65,0xa9,0x9c,0x3e,0x16,0xfe,0xa8,0x94,0xec,0x33,0xc6,0xb2,0x0d,0x91,0x05,0xe2,0xa0,0x4e,0x27,0x64,0xa4,0x76,0x9d,0x9b,0xbd,0x4d,0x8b,0xac,0xfe,0xab,0x4a,0x2e,},{0x01,0xbb,0x90,0x1d,0x83,0xb8,0xb6,0x82,0xd3,0x61,0x4a,0xf4,0x6a,0x80,0x7b,0xa2,0x69,0x13,0x58,0xfe,0xb7,0x75,0x32,0x5d,0x34,0x23,0xf5,0x49,0xff,0x0a,0xa5,0x75,0x7e,0x4e,0x1a,0x74,0xe9,0xc7,0x0f,0x97,0x21,0xd8,0xf3,0x54,0xb3,0x19,0xd4,0xf4,0xa1,0xd9,0x14,0x45,0xc8,0x70,0xfd,0x0f,0xfb,0x94,0xfe,0xd6,0x46,0x64,0x73,0x0d,},54,"\xe0\x72\x41\xdb\xd3\xad\xbe\x61\x0b\xbe\x4d\x00\x5d\xd4\x67\x32\xa4\xc2\x50\x86\xec\xb8\xec\x29\xcd\x7b\xca\x11\x6e\x1b\xf9\xf5\x3b\xfb\xf3\xe1\x1f\xa4\x90\x18\xd3\x9f\xf1\x15\x4a\x06\x66\x8e\xf7\xdf\x5c\x67\x8e\x6a"},
+    {{0xb1,0xc9,0xf8,0xbd,0x03,0xfe,0x82,0xe7,0x8f,0x5c,0x0f,0xb0,0x64,0x50,0xf2,0x7d,0xac,0xdf,0x71,0x64,0x34,0xdb,0x26,0x82,0x75,0xdf,0x3e,0x1d,0xc1,0x77,0xaf,0x42,},{0x7f,0xc8,0x8b,0x1f,0x7b,0x3f,0x11,0xc6,0x29,0xbe,0x67,0x1c,0x21,0x62,0x1f,0x5c,0x10,0x67,0x2f,0xaf,0xc8,0x49,0x2d,0xa8,0x85,0x74,0x20,0x59,0xee,0x67,0x74,0xcf,},{0x4b,0x22,0x99,0x51,0xef,0x26,0x2f,0x16,0x97,0x8f,0x79,0x14,0xbc,0x67,0x2e,0x72,0x26,0xc5,0xf8,0x37,0x9d,0x27,0x78,0xc5,0xa2,0xdc,0x0a,0x26,0x50,0x86,0x9f,0x7a,0xcf,0xbd,0x0b,0xcd,0x30,0xfd,0xb0,0x61,0x9b,0xb4,0x4f,0xc1,0xae,0x59,0x39,0xb8,0x7c,0xc3,0x18,0x13,0x30,0x09,0xc2,0x03,0x95,0xb6,0xc7,0xeb,0x98,0x10,0x77,0x01,},55,"\x33\x1d\xa7\xa9\xc1\xf8\x7b\x2a\xc9\x1e\xe3\xb8\x6d\x06\xc2\x91\x63\xc0\x5e\xd6\xf8\xd8\xa9\x72\x5b\x47\x1b\x7d\xb0\xd6\xac\xec\x7f\x0f\x70\x24\x87\x16\x3f\x5e\xda\x02\x0c\xa5\xb4\x93\xf3\x99\xe1\xc8\xd3\x08\xc3\xc0\xc2"},
+    {{0x6d,0x8c,0xdb,0x2e,0x07,0x5f,0x3a,0x2f,0x86,0x13,0x72,0x14,0xcb,0x23,0x6c,0xeb,0x89,0xa6,0x72,0x8b,0xb4,0xa2,0x00,0x80,0x6b,0xf3,0x55,0x7f,0xb7,0x8f,0xac,0x69,},{0x57,0xa0,0x4c,0x7a,0x51,0x13,0xcd,0xdf,0xe4,0x9a,0x4c,0x12,0x46,0x91,0xd4,0x6c,0x1f,0x9c,0xdc,0x8f,0x34,0x3f,0x9d,0xcb,0x72,0xa1,0x33,0x0a,0xec,0xa7,0x1f,0xda,},{0xa6,0xcb,0xc9,0x47,0xf9,0xc8,0x7d,0x14,0x55,0xcf,0x1a,0x70,0x85,0x28,0xc0,0x90,0xf1,0x1e,0xce,0xe4,0x85,0x5d,0x1d,0xba,0xad,0xf4,0x74,0x54,0xa4,0xde,0x55,0xfa,0x4c,0xe8,0x4b,0x36,0xd7,0x3a,0x5b,0x5f,0x8f,0x59,0x29,0x8c,0xcf,0x21,0x99,0x2d,0xf4,0x92,0xef,0x34,0x16,0x3d,0x87,0x75,0x3b,0x7e,0x9d,0x32,0xf2,0xc3,0x66,0x0b,},56,"\x7f\x31\x8d\xbd\x12\x1c\x08\xbf\xdd\xfe\xff\x4f\x6a\xff\x4e\x45\x79\x32\x51\xf8\xab\xf6\x58\x40\x33\x58\x23\x89\x84\x36\x00\x54\xf2\xa8\x62\xc5\xbb\x83\xed\x89\x02\x5d\x20\x14\xa7\xa0\xce\xe5\x0d\xa3\xcb\x0e\x76\xbb\xb6\xbf"},
+    {{0x47,0xad,0xc6,0xd6,0xbf,0x57,0x1e,0xe9,0x57,0x0c,0xa0,0xf7,0x5b,0x60,0x4a,0xc4,0x3e,0x30,0x3e,0x4a,0xb3,0x39,0xca,0x9b,0x53,0xca,0xcc,0x5b,0xe4,0x5b,0x2c,0xcb,},{0xa3,0xf5,0x27,0xa1,0xc1,0xf1,0x7d,0xfe,0xed,0x92,0x27,0x73,0x47,0xc9,0xf9,0x8a,0xb4,0x75,0xde,0x17,0x55,0xb0,0xab,0x54,0x6b,0x8a,0x15,0xd0,0x1b,0x9b,0xd0,0xbe,},{0x4e,0x8c,0x31,0x83,0x43,0xc3,0x06,0xad,0xbb,0xa6,0x0c,0x92,0xb7,0x5c,0xb0,0x56,0x9b,0x92,0x19,0xd8,0xa8,0x6e,0x5d,0x57,0x75,0x2e,0xd2,0x35,0xfc,0x10,0x9a,0x43,0xc2,0xcf,0x4e,0x94,0x2c,0xac,0xf2,0x97,0x27,0x9f,0xbb,0x28,0x67,0x53,0x47,0xe0,0x80,0x27,0x72,0x2a,0x4e,0xb7,0x39,0x5e,0x00,0xa1,0x74,0x95,0xd3,0x2e,0xdf,0x0b,},57,"\xce\x49\x7c\x5f\xf5\xa7\x79\x90\xb7\xd8\xf8\x69\x9e\xb1\xf5\xd8\xc0\x58\x2f\x70\xcb\x7a\xc5\xc5\x4d\x9d\x92\x49\x13\x27\x8b\xc6\x54\xd3\x7e\xa2\x27\x59\x0e\x15\x20\x22\x17\xfc\x98\xda\xc4\xc0\xf3\xbe\x21\x83\xd1\x33\x31\x57\x39"},
+    {{0x3c,0x19,0xb5,0x0b,0x0f,0xe4,0x79,0x61,0x71,0x9c,0x38,0x1d,0x0d,0x8d,0xa9,0xb9,0x86,0x9d,0x31,0x2f,0x13,0xe3,0x29,0x8b,0x97,0xfb,0x22,0xf0,0xaf,0x29,0xcb,0xbe,},{0x0f,0x7e,0xda,0x09,0x14,0x99,0x62,0x5e,0x2b,0xae,0x85,0x36,0xea,0x35,0xcd,0xa5,0x48,0x3b,0xd1,0x6a,0x9c,0x7e,0x41,0x6b,0x34,0x1d,0x6f,0x2c,0x83,0x34,0x36,0x12,},{0xef,0xbd,0x41,0xf2,0x6a,0x5d,0x62,0x68,0x55,0x16,0xf8,0x82,0xb6,0xec,0x74,0xe0,0xd5,0xa7,0x18,0x30,0xd2,0x03,0xc2,0x31,0x24,0x8f,0x26,0xe9,0x9a,0x9c,0x65,0x78,0xec,0x90,0x0d,0x68,0xcd,0xb8,0xfa,0x72,0x16,0xad,0x0d,0x24,0xf9,0xec,0xbc,0x9f,0xfa,0x65,0x53,0x51,0x66,0x65,0x82,0xf6,0x26,0x64,0x53,0x95,0xa3,0x1f,0xa7,0x04,},58,"\x8d\xdc\xd6\x30\x43\xf5\x5e\xc3\xbf\xc8\x3d\xce\xae\x69\xd8\xf8\xb3\x2f\x4c\xdb\x6e\x2a\xeb\xd9\x4b\x43\x14\xf8\xfe\x72\x87\xdc\xb6\x27\x32\xc9\x05\x2e\x75\x57\xfe\x63\x53\x43\x38\xef\xb5\xb6\x25\x4c\x5d\x41\xd2\x69\x0c\xf5\x14\x4f"},
+    {{0x34,0xe1,0xe9,0xd5,0x39,0x10,0x7e,0xb8,0x6b,0x39,0x3a,0x5c,0xce,0xa1,0x49,0x6d,0x35,0xbc,0x7d,0x5e,0x9a,0x8c,0x51,0x59,0xd9,0x57,0xe4,0xe5,0x85,0x2b,0x3e,0xb0,},{0x0e,0xcb,0x26,0x01,0xd5,0xf7,0x04,0x74,0x28,0xe9,0xf9,0x09,0x88,0x3a,0x12,0x42,0x00,0x85,0xf0,0x4e,0xe2,0xa8,0x8b,0x6d,0x95,0xd3,0xd7,0xf2,0xc9,0x32,0xbd,0x76,},{0x32,0xd2,0x29,0x04,0xd3,0xe7,0x01,0x2d,0x6f,0x5a,0x44,0x1b,0x0b,0x42,0x28,0x06,0x4a,0x5c,0xf9,0x5b,0x72,0x3a,0x66,0xb0,0x48,0xa0,0x87,0xec,0xd5,0x59,0x20,0xc3,0x1c,0x20,0x4c,0x3f,0x20,0x06,0x89,0x1a,0x85,0xdd,0x19,0x32,0xe3,0xf1,0xd6,0x14,0xcf,0xd6,0x33,0xb5,0xe6,0x32,0x91,0xc6,0xd8,0x16,0x6f,0x30,0x11,0x43,0x1e,0x09,},59,"\xa6\xd4\xd0\x54\x2c\xfe\x0d\x24\x0a\x90\x50\x7d\xeb\xac\xab\xce\x7c\xbb\xd4\x87\x32\x35\x3f\x4f\xad\x82\xc7\xbb\x7d\xbd\x9d\xf8\xe7\xd9\xa1\x69\x80\xa4\x51\x86\xd8\x78\x6c\x5e\xf6\x54\x45\xbc\xc5\xb2\xad\x5f\x66\x0f\xfc\x7c\x8e\xaa\xc0"},
+    {{0x49,0xdd,0x47,0x3e,0xde,0x6a,0xa3,0xc8,0x66,0x82,0x4a,0x40,0xad,0xa4,0x99,0x6c,0x23,0x9a,0x20,0xd8,0x4c,0x93,0x65,0xe4,0xf0,0xa4,0x55,0x4f,0x80,0x31,0xb9,0xcf,},{0x78,0x8d,0xe5,0x40,0x54,0x4d,0x3f,0xeb,0x0c,0x91,0x92,0x40,0xb3,0x90,0x72,0x9b,0xe4,0x87,0xe9,0x4b,0x64,0xad,0x97,0x3e,0xb6,0x5b,0x46,0x69,0xec,0xf2,0x35,0x01,},{0xd2,0xfd,0xe0,0x27,0x91,0xe7,0x20,0x85,0x25,0x07,0xfa,0xa7,0xc3,0x78,0x90,0x40,0xd9,0xef,0x86,0x64,0x63,0x21,0xf3,0x13,0xac,0x55,0x7f,0x40,0x02,0x49,0x15,0x42,0xdd,0x67,0xd0,0x5c,0x69,0x90,0xcd,0xb0,0xd4,0x95,0x50,0x1f,0xbc,0x5d,0x51,0x88,0xbf,0xbb,0x84,0xdc,0x1b,0xf6,0x09,0x8b,0xee,0x06,0x03,0xa4,0x7f,0xc2,0x69,0x0f,},60,"\x3a\x53\x59\x4f\x3f\xba\x03\x02\x93\x18\xf5\x12\xb0\x84\xa0\x71\xeb\xd6\x0b\xae\xc7\xf5\x5b\x02\x8d\xc7\x3b\xfc\x9c\x74\xe0\xca\x49\x6b\xf8\x19\xdd\x92\xab\x61\xcd\x8b\x74\xbe\x3c\x0d\x6d\xcd\x12\x8e\xfc\x5e\xd3\x34\x2c\xba\x12\x4f\x72\x6c"},
+    {{0x33,0x1c,0x64,0xda,0x48,0x2b,0x6b,0x55,0x13,0x73,0xc3,0x64,0x81,0xa0,0x2d,0x81,0x36,0xec,0xad,0xbb,0x01,0xab,0x11,0x4b,0x44,0x70,0xbf,0x41,0x60,0x7a,0xc5,0x71,},{0x52,0xa0,0x0d,0x96,0xa3,0x14,0x8b,0x47,0x26,0x69,0x2d,0x9e,0xff,0x89,0x16,0x0e,0xa9,0xf9,0x9a,0x5c,0xc4,0x38,0x9f,0x36,0x1f,0xed,0x0b,0xb1,0x6a,0x42,0xd5,0x21,},{0x22,0xc9,0x9a,0xa9,0x46,0xea,0xd3,0x9a,0xc7,0x99,0x75,0x62,0x81,0x0c,0x01,0xc2,0x0b,0x46,0xbd,0x61,0x06,0x45,0xbd,0x2d,0x56,0xdc,0xdc,0xba,0xac,0xc5,0x45,0x2c,0x74,0xfb,0xf4,0xb8,0xb1,0x81,0x3b,0x0e,0x94,0xc3,0x0d,0x80,0x8c,0xe5,0x49,0x8e,0x61,0xd4,0xf7,0xcc,0xbb,0x4c,0xc5,0xf0,0x4d,0xfc,0x61,0x40,0x82,0x5a,0x96,0x00,},61,"\x20\xe1\xd0\x5a\x0d\x5b\x32\xcc\x81\x50\xb8\x11\x6c\xef\x39\x65\x9d\xd5\xfb\x44\x3a\xb1\x56\x00\xf7\x8e\x5b\x49\xc4\x53\x26\xd9\x32\x3f\x28\x50\xa6\x3c\x38\x08\x85\x94\x95\xae\x27\x3f\x58\xa5\x1e\x9d\xe9\xa1\x45\xd7\x74\xb4\x0b\xa9\xd7\x53\xd3"},
+    {{0x5c,0x0b,0x96,0xf2,0xaf,0x87,0x12,0x12,0x2c,0xf7,0x43,0xc8,0xf8,0xdc,0x77,0xb6,0xcd,0x55,0x70,0xa7,0xde,0x13,0x29,0x7b,0xb3,0xdd,0xe1,0x88,0x62,0x13,0xcc,0xe2,},{0x05,0x10,0xea,0xf5,0x7d,0x73,0x01,0xb0,0xe1,0xd5,0x27,0x03,0x9b,0xf4,0xc6,0xe2,0x92,0x30,0x0a,0x3a,0x61,0xb4,0x76,0x54,0x34,0xf3,0x20,0x3c,0x10,0x03,0x51,0xb1,},{0x06,0xe5,0xd8,0x43,0x6a,0xc7,0x70,0x5b,0x3a,0x90,0xf1,0x63,0x1c,0xdd,0x38,0xec,0x1a,0x3f,0xa4,0x97,0x78,0xa9,0xb9,0xf2,0xfa,0x5e,0xbe,0xa4,0xe7,0xd5,0x60,0xad,0xa7,0xdd,0x26,0xff,0x42,0xfa,0xfa,0x8b,0xa4,0x20,0x32,0x37,0x42,0x76,0x1a,0xca,0x69,0x04,0x94,0x0d,0xc2,0x1b,0xbe,0xf6,0x3f,0xf7,0x2d,0xaa,0xb4,0x5d,0x43,0x0b,},62,"\x54\xe0\xca\xa8\xe6\x39\x19\xca\x61\x4b\x2b\xfd\x30\x8c\xcf\xe5\x0c\x9e\xa8\x88\xe1\xee\x44\x46\xd6\x82\xcb\x50\x34\x62\x7f\x97\xb0\x53\x92\xc0\x4e\x83\x55\x56\xc3\x1c\x52\x81\x6a\x48\xe4\xfb\x19\x66\x93\x20\x6b\x8a\xfb\x44\x08\x66\x2b\x3c\xb5\x75"},
+    {{0xde,0x84,0xf2,0x43,0x5f,0x78,0xde,0xdb,0x87,0xda,0x18,0x19,0x4f,0xf6,0xa3,0x36,0xf0,0x81,0x11,0x15,0x0d,0xef,0x90,0x1c,0x1a,0xc4,0x18,0x14,0x6e,0xb7,0xb5,0x4a,},{0xd3,0xa9,0x2b,0xba,0xa4,0xd6,0x3a,0xf7,0x9c,0x22,0x26,0xa7,0x23,0x6e,0x64,0x27,0x42,0x8d,0xf8,0xb3,0x62,0x42,0x7f,0x87,0x30,0x23,0xb2,0x2d,0x2f,0x5e,0x03,0xf2,},{0x47,0x1e,0xbc,0x97,0x3c,0xfd,0xac,0xee,0xc0,0x72,0x79,0x30,0x73,0x68,0xb7,0x3b,0xe3,0x5b,0xc6,0xf8,0xd8,0x31,0x2b,0x70,0x15,0x05,0x67,0x36,0x90,0x96,0x70,0x6d,0xc4,0x71,0x12,0x6c,0x35,0x76,0xf9,0xf0,0xeb,0x55,0x0d,0xf5,0xac,0x6a,0x52,0x51,0x81,0x11,0x00,0x29,0xdd,0x1f,0xc1,0x11,0x74,0xd1,0xaa,0xce,0xd4,0x8d,0x63,0x0f,},63,"\x20\x51\x35\xec\x7f\x41\x7c\x85\x80\x72\xd5\x23\x3f\xb3\x64\x82\xd4\x90\x6a\xbd\x60\xa7\x4a\x49\x8c\x34\x7f\xf2\x48\xdf\xa2\x72\x2c\xa7\x4e\x87\x9d\xe3\x31\x69\xfa\xdc\x7c\xd4\x4d\x6c\x94\xa1\x7d\x16\xe1\xe6\x30\x82\x4b\xa3\xe0\xdf\x22\xed\x68\xea\xab"},
+    {{0xba,0x4d,0x6e,0x67,0xb2,0xce,0x67,0xa1,0xe4,0x43,0x26,0x49,0x40,0x44,0xf3,0x7a,0x44,0x2f,0x3b,0x81,0x72,0x5b,0xc1,0xf9,0x34,0x14,0x62,0x71,0x8b,0x55,0xee,0x20,},{0xf7,0x3f,0xa0,0x76,0xf8,0x4b,0x6d,0xb6,0x75,0xa5,0xfd,0xa5,0xad,0x67,0xe3,0x51,0xa4,0x1e,0x8e,0x7f,0x29,0xad,0xd1,0x68,0x09,0xca,0x01,0x03,0x87,0xe9,0xc6,0xcc,},{0x57,0xb9,0xd2,0xa7,0x11,0x20,0x7f,0x83,0x74,0x21,0xba,0xe7,0xdd,0x48,0xea,0xa1,0x8e,0xab,0x1a,0x9a,0x70,0xa0,0xf1,0x30,0x58,0x06,0xfe,0xe1,0x7b,0x45,0x8f,0x3a,0x09,0x64,0xb3,0x02,0xd1,0x83,0x4d,0x3e,0x0a,0xc9,0xe8,0x49,0x6f,0x00,0x0b,0x77,0xf0,0x08,0x3b,0x41,0xf8,0xa9,0x57,0xe6,0x32,0xfb,0xc7,0x84,0x0e,0xee,0x6a,0x06,},64,"\x4b\xaf\xda\xc9\x09\x9d\x40\x57\xed\x6d\xd0\x8b\xca\xee\x87\x56\xe9\xa4\x0f\x2c\xb9\x59\x80\x20\xeb\x95\x01\x95\x28\x40\x9b\xbe\xa3\x8b\x38\x4a\x59\xf1\x19\xf5\x72\x97\xbf\xb2\xfa\x14\x2f\xc7\xbb\x1d\x90\xdb\xdd\xde\x77\x2b\xcd\xe4\x8c\x56\x70\xd5\xfa\x13"},
+    {{0x0d,0x13,0x1c,0x45,0xae,0xa6,0xf3,0xa4,0xe1,0xb9,0xa2,0xcf,0x60,0xc5,0x51,0x04,0x58,0x7e,0xfa,0xa8,0x46,0xb2,0x22,0xbf,0x0a,0x7b,0x74,0xce,0x7a,0x3f,0x63,0xb6,},{0x3c,0x67,0x29,0xdb,0xe9,0x3b,0x49,0x9c,0x4e,0x61,0x4a,0x2f,0x21,0xbe,0xb7,0x29,0x43,0x8d,0x49,0x8e,0x1a,0xc8,0xd1,0x4c,0xba,0xd9,0x71,0x7a,0x5d,0xbd,0x97,0xcd,},{0xa9,0xc5,0xee,0x86,0xfb,0x06,0xd9,0xe4,0x6b,0x37,0x9c,0x32,0xdd,0xa7,0xc9,0x2c,0x9c,0x13,0xdb,0x27,0x4d,0xc2,0x41,0x16,0xfb,0xdd,0x87,0x86,0x96,0x04,0x54,0x88,0xcc,0x75,0xa5,0x2f,0xff,0x67,0xd1,0xa5,0x11,0x3d,0x06,0xe3,0x33,0xac,0x67,0xff,0x66,0x4b,0x3f,0x2a,0x40,0x5f,0xa1,0xd1,0x4d,0xd5,0xbb,0xb9,0x74,0x09,0xb6,0x06,},65,"\xb4\x29\x1d\x08\xb8\x8f\xb2\xf7\xb8\xf9\x9d\x0d\xce\x40\x07\x9f\xcb\xab\x71\x8b\xbd\x8f\x4e\x8e\xab\xc3\xc1\x42\x8b\x6a\x07\x1f\xb2\xa3\xc8\xeb\xa1\xca\xcc\xcf\xa8\x71\xb3\x65\xc7\x08\xbe\xf2\x68\x5b\xc1\x3e\x6b\x80\xbc\x14\xa5\xf2\x49\x17\x0f\xfc\x56\xd0\x14"},
+};
+
+bool TestCryptoSign()
+{
+    // https://github.com/jedisct1/libsodium/blob/master/test/default/sign.c
+    const unsigned int MAX_MESSAGE = 65; // Sync with test data
+
+    byte pk[crypto_sign_PUBLICKEYBYTES];
+    byte sk[crypto_sign_SECRETKEYBYTES];
+    SecByteBlock sm(MAX_MESSAGE+crypto_sign_BYTES);
+    SecByteBlock rm(MAX_MESSAGE+crypto_sign_BYTES);
+
+    bool pass = true, fail; int rc;
+
+    for  (unsigned int  i=0; i<COUNTOF(test_data); ++i)
+    {
+        const TestData& data = test_data[i];
+        std::memcpy(sk, data.sk, crypto_sign_SEEDBYTES);
+        std::memcpy(sk+crypto_sign_SEEDBYTES, data.pk, crypto_sign_PUBLICKEYBYTES);
+        std::memcpy(pk, data.pk, crypto_sign_PUBLICKEYBYTES);
+
+        const byte* m = reinterpret_cast<const byte*>(data.msg);
+        const word64 l = data.len;
+        word64 smlen;
+
+        rc = crypto_sign(sm, &smlen, m, l, sk);
+        fail = (rc != 0); pass = !fail && pass;
+
+        word64 s = STDMIN(smlen, (word64)crypto_sign_BYTES);
+        pass = (s >= crypto_sign_BYTES) && pass;
+
+        fail = std::memcmp(sm, data.sig, (size_t)s) != 0;
+        pass = !fail && pass;
+
+        word64 rmlen;
+        rc = crypto_sign_open(rm, &rmlen, sm, smlen, pk);
+        fail = (rc != 0); pass = !fail && pass;
+
+        pass = (l == rmlen) && pass;
+        fail = std::memcmp(m, rm, (size_t)STDMIN(l, rmlen)) != 0;
+        pass = !fail && pass;
+    }
+
+    return pass;
+}
+
+bool TestCryptoSignKeys()
+{
+    // https://github.com/jedisct1/libsodium/blob/master/test/default/sign.c
+    const unsigned int MAX_TEST = 64;
+    const unsigned int MAX_MESSAGE = 4096;
+
+    byte pk[crypto_sign_PUBLICKEYBYTES];
+    byte sk[crypto_sign_SECRETKEYBYTES];
+
+    bool pass = true, fail; int rc;
+
+    for  (unsigned int  i=0; i<MAX_TEST; ++i)
+    {
+        fail = (crypto_sign_keypair(pk, sk) != 0);
+        pass = !fail && pass;
+
+        byte xk[crypto_sign_PUBLICKEYBYTES];
+        fail = (crypto_sign_sk2pk(xk, sk) != 0);
+        pass = !fail && pass;
+
+        fail = std::memcmp(xk, pk, sizeof(xk)) != 0;
+        pass = !fail && pass;
+
+        const word32 len = (i == 0 ? 0 : GlobalRNG().GenerateWord32(1, MAX_MESSAGE));
+        SecByteBlock m(len), sm(len+crypto_sign_BYTES), rm(len+crypto_sign_BYTES);
+        if (len) { GlobalRNG().GenerateBlock(m, len); }
+
+        word64 mlen = len, smlen, rmlen;
+        rc = crypto_sign(sm, &smlen, m, mlen, sk);
+        fail = (rc != 0); pass = !fail && pass;
+
+        rc = crypto_sign_open(rm, &rmlen, sm, smlen, pk);
+        fail = (rc != 0); pass = !fail && pass;
+
+        if(mlen && rmlen)
+        {
+            pass = (mlen == rmlen) && pass;
+            fail = std::memcmp(m, rm, (size_t)STDMIN(mlen, rmlen)) != 0;
+            pass = !fail && pass;
+        }
+
+        m.SetMark(16); sm.SetMark(16); rm.SetMark(16);
+    }
+
+    return pass;
+}
+
+#endif  // CRYPTOPP_DISABLE_NACL
+
+// NaCl requires an integrated random number generator; see randombytes()
+// in tweetnacl.cpp. We use DefaultAutoSeededRNG but it means we need
+// Operating System features to seed the generator. If you use another
+// generator, like RDRAND, then undefine CRYPTOPP_DISABLE_NACL in naclite.h.
+bool ValidateNaCl()
+{
+    std::cout << "\nTesting NaCl library functions...\n\n";
+    bool pass = true, fail = false;
+
+#ifdef CRYPTOPP_DISABLE_NACL
+
+    std::cout << "NaCl not available, skipping test." << std::endl;
+
+#else
+
+    fail = !TestCryptoBox();
+    std::cout << (fail ? "FAILED" : "passed") << "    crypto_box, crypto_box_beforenm, crypto_box_afternm\n";
+    pass = !fail && pass;
+
+    fail = !TestCryptoBoxOpen();
+    std::cout << (fail ? "FAILED" : "passed") << "    crypto_box_open, crypto_box_open_afternm\n";
+    pass = !fail && pass;
+
+    fail = !TestCryptoBoxKeys();
+    std::cout << (fail ? "FAILED" : "passed") << "    crypto_box_keypair pairwise consistency\n";
+    pass = !fail && pass;
+
+    fail = !TestCryptoSign();
+    std::cout << (fail ? "FAILED" : "passed") << "    crypto_sign, crypto_sign_open, crypto_sign_keypair\n";
+    pass = !fail && pass;
+
+    fail = !TestCryptoSignKeys();
+    std::cout << (fail ? "FAILED" : "passed") << "    crypto_sign_keypair pairwise consistency\n";
+    pass = !fail && pass;
+
+#endif
+
+    return pass;
+}
+
+NAMESPACE_END
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/validat2.cpp b/runtime/third_party/cryptopp/validat2.cpp
new file mode 100644
index 0000000..5bec5ec
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat2.cpp
@@ -0,0 +1,1328 @@
+// validat2.cpp - originally written and placed in the public domain by Wei Dai and Jeffrey Walton
+//                Routines in this source file are only tested in Debug builds.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "algebra.h"
+#include "integer.h"
+#include "nbtheory.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+bool TestIntegerBitops()
+{
+    std::cout << "\nTesting Integer bit operations...\n\n";
+
+    struct Bitops_TestTuple
+    {
+        // m,n are operands; a,o,x are and,or,xor results
+        const char *m, *n, *a, *o, *x;
+    };
+    static const Bitops_TestTuple tests[] = {
+        {
+            "0xc2cea8a4", "0xb36e5794", "0x824e0084", "0xf3eeffb4", "0x71a0ff30"
+        },
+        {
+            "0x436eb828", "0x1b375cb4", "0x3261820", "0x5b7ffcbc", "0x5859e49c"
+        },
+        {
+            "0x1e5c0b28", "0x4fded465", "0xe5c0020", "0x5fdedf6d", "0x5182df4d"
+        },
+        {
+            "0xeb71fde7", "0xf7bb47cf", "0xe33145c7", "0xfffbffef", "0x1ccaba28"
+        },
+        {
+            "0xa6b0f01f", "0x8a8ca98", "0xa0c018", "0xaeb8fa9f", "0xae183a87"
+        },
+        {
+            "0xa70bd8b7", "0x5c758cf5", "0x40188b5", "0xff7fdcf7", "0xfb7e5442"
+        },
+        {
+            "0xf91af382", "0x718a9995", "0x710a9180", "0xf99afb97", "0x88906a17"
+        },
+        {
+            "0xbd2a76ad", "0xddd8dfeb", "0x9d0856a9", "0xfdfaffef", "0x60f2a946"
+        },
+        {
+            "0xd4b559cc", "0x91a53295", "0x90a51084", "0xd5b57bdd", "0x45106b59"
+        },
+        {
+            "0x89434e9e", "0xa42fdaf9", "0x80034a98", "0xad6fdeff", "0x2d6c9467"
+        },
+        {
+            "0xb947ac04", "0xd4201e52", "0x90000c00", "0xfd67be56", "0x6d67b256"
+        },
+        {
+            "0xa83945c1", "0x3a9c5dba", "0x28184580", "0xbabd5dfb", "0x92a5187b"
+        },
+        {
+            "0xbca38ffa", "0x881ba9fd", "0x880389f8", "0xbcbbafff", "0x34b82607"
+        },
+        {
+            "0xfcd0b92", "0xeaad8534", "0xa8d0110", "0xefed8fb6", "0xe5608ea6"
+        },
+        {
+            "0x50d160d0", "0x64646f75", "0x40406050", "0x74f56ff5", "0x34b50fa5"
+        },
+        {
+            "0x165ccff8", "0x67d49127", "0x6548120", "0x77dcdfff", "0x71885edf"
+        },
+        {
+            "0x8c4f4bbb7adaacb5", "0x2566b7a909b24aa9", "0x44603a9089208a1", "0xad6fffbb7bfaeebd", "0xa929fc127368e61c"
+        },
+        {
+            "0x6f9ef50aafb31e8d", "0x7a93b2ccd1bbbff2", "0x6a92b00881b31e80", "0x7f9ff7ceffbbbfff", "0x150d47c67e08a17f"
+        },
+        {
+            "0x4c99e967f8de5294", "0x1f4699e0c14e6974", "0xc008960c04e4014", "0x5fdff9e7f9de7bf4", "0x53df708739903be0"
+        },
+        {
+            "0xcc55f5d6d3ea45c", "0x6805b4ddb6390c2f", "0x805145d2438040c", "0x6cc5ffddff3fac7f", "0x64c0eb80db07a873"
+        },
+        {
+            "0x90620d1a012459e7", "0x89d31098ce3fed42", "0x8042001800244942", "0x99f31d9acf3ffde7", "0x19b11d82cf1bb4a5"
+        },
+        {
+            "0xb87d1674e90a935a", "0x75ea466cbb782ac4", "0x30680664a9080240", "0xfdff567cfb7abbde", "0xcd9750185272b99e"
+        },
+        {
+            "0x1f135732240701f0", "0x6aa09a1614bf4dd4", "0xa001212040701d0", "0x7fb3df3634bf4df4", "0x75b3cd2430b84c24"
+        },
+        {
+            "0xc9a88d8300099a31", "0xdc8e91df745169ee", "0xc888818300010820", "0xddae9ddf7459fbff", "0x15261c5c7458f3df"
+        },
+        {
+            "0xc8c828d15228b562", "0x43f86cffa3d15d80", "0x40c828d102001500", "0xcbf86cfff3f9fde2", "0x8b30442ef1f9e8e2"
+        },
+        {
+            "0x41fdc0bc2009563f", "0x59dd1c417e3c07bc", "0x41dd00002008063c", "0x59fddcfd7e3d57bf", "0x1820dcfd5e355183"
+        },
+        {
+            "0x9e2f78600c3a84e7", "0xac69a0e1fe7887b0", "0x8c2920600c3884a0", "0xbe6ff8e1fe7a87f7", "0x3246d881f2420357"
+        },
+        {
+            "0xd424d1d9a955f617", "0x9608f5bde1c4d893", "0x9400d199a144d013", "0xd62cf5fde9d5fe97", "0x422c246448912e84"
+        },
+        {
+            "0x1aa8b60a0627719a", "0x5b26e6aca95f5f60", "0x1a20a60800075100", "0x5baef6aeaf7f7ffa", "0x418e50a6af782efa"
+        },
+        {
+            "0xcf5db499233fac00", "0xf33e7a29c3c33da8", "0xc31c300903032c00", "0xff7ffeb9e3ffbda8", "0x3c63ceb0e0fc91a8"
+        },
+        {
+            "0x6b47c03d576e878d", "0x2032d13574d67da4", "0x2002c03554460584", "0x6b77d13d77feffad", "0x4b75110823b8fa29"
+        },
+        {
+            "0xd47eeb3aefebf074", "0x6d7ba17a42c66b89", "0x447aa13a42c26000", "0xfd7feb7aefeffbfd", "0xb9054a40ad2d9bfd"
+        },
+        {
+            "0x33ad9c5d20b03f5c05535f20a2941c8f4ae0f1f19500759151060dce39e5dfed41ec4f",
+            "0x277401dc000fde7eda4d60a5698935f7febd8fbe49e5d6f56ca2e7f6118380d3cd655da392df3ba6c1b13dc0119af34cfa1d18a65",
+            "0x10a9841c002016480453410020041c8640c0312191006411110401082924cfa1418845",
+            "0x277401dc000fde7eda4d60a5698935f7febfbfffcdf7dff7fde2f7f7f38ba9d3cdf5ffaf9fdf7ba7d9b53de0ddfbff5dfedd1ee6f",
+            "0x277401dc000fde7eda4d60a5698935f7febeb5678c37ddf69962b2c3e389a9920591f3ac8dc66ba198a42da0cd796d1104c90662a"
+        },
+        {
+            "0xb6ea335c13111216862e370d12fb9c761a6266617f62a1904b0d7944ab3cddc71f11752ad9424b0",
+            "0xa6b380f048a9cbe45ff4ea824064c831eb03ff875e1e3e",
+            "0xa62200104028090410d480020044c831e1035285140430",
+            "0xb6ea335c13111216862e370d12fb9c761a6b7e6f7feabdbe4fff7fecaf3eddc71fb17ffafde3ebe",
+            "0xb6ea335c13111216862e370d12fb9c7610095e6e7be83d2e0ef237ec8f3a914401a14ad2aca3a8e"
+        },
+        {
+            "0x8fb9486ad1f89ca5b3f6da9f0d5ef9ec328b8cc3e5122afbd8a67bd1b2b4ab5c548b90cf9fe1933a0362922f1e84ef0",
+            "0x10615f963dffc13718ed1ecdb9cfbef33148befeb91b190dc7e7d28d8821ff248ab26a34e1b89885c643e447c72",
+            "0x6051901ca58136188d0c4cb9cc32830040a412281b180443c192848800540080820a208138000082030404c70",
+            "0x8fb9586bdffebdfff3f7daff1fdff9efbefbbdcbfffebbfbd9affff7f2bdab7dffaf9afffff5f3ba9be7d66ffec7ef2",
+            "0x8fb9580b8e6ea15a72c1c272139340238c78bd8b5bec93e0c1abbc366039237dabaf1a7df5d572829be7546cfac3282"
+        },
+        {
+            "0x10af96443b186faf790279bf3bbe0517d56ffc01e7fec8c88e765d48cc32333390224f4d762d1ba788c50801cba02524cb49",
+            "0x95d44e7344fb1701bace3ae83affbb6290bf282f7565b9a82c386823f5f213a53eccb2cfe5deb4dd040067a64ada8c1b6828599b96cc70647e7d19dc7dfba393addabe689ffbe1a36642bc9844b81c6c4c2e178",
+            "0x2c96442b084000000260ad288004028509b800c70640c080144548883032118022094d3608122408c1000181800400c148",
+            "0x95d44e7344fb1701bace3ae83affbb6290bf282f7565b9a82c386823f5f213a53ecdbaffe5dfb5dffef7f7a7dbfbbffb797d5fffd6de7fecfefdfffdfdffe3b3bffbbe6cffffe3f3fe7abcd8c4bcbe6e5e6eb79",
+            "0x95d44e7344fb1701bace3ae83affbb6290bf282f7565b9a82c386823f5f213a53ecdb836819d055bfef7f781d12937fb39550f6456d20f88f2f5feb9a97760b09ee3bc4c6b2c8372dc3a30c8c4a4a66e1e62a31"
+        },
+        {
+            "0x5fc77dab8cd9c1da8c91eb7ba9c23ce85375b61bf3b9a8c4e4df7bc917aa8a14e747888c9756a2be2fd2e256e44194ce093a0185594de0dcf8340c45b6af7dbdc7682fbef6313f9f1cb234689d9f1ff603e1273faad89d0fe1ab57fbc7c32d29dce125fafc973754464b55ae5de58a8a5661c2065b95c2c94d7ec34",
+            "0xd4a9158961d4c11258cd047eda13d6804c16c3a374b7f4115bd835bde0b5",
+            "0x1080158800548100504504649012c480480081221420641158081495e034",
+            "0x5fc77dab8cd9c1da8c91eb7ba9c23ce85375b61bf3b9a8c4e4df7bc917aa8a14e747888c9756a2be2fd2e256e44194ce093a0185594de0dcf8340c45b6af7dbdc7682fbef6313f9f1cb234689d9f1ff603e1273faad89d0fe1ab57fbc7cf6fb9dcf73dfefdb7bfd447eff5bf7de5cbee7e77cb7f5b95ffcb5ffecb5",
+            "0x5fc77dab8cd9c1da8c91eb7ba9c23ce85375b61bf3b9a8c4e4df7bc917aa8a14e747888c9756a2be2fd2e256e44194ce093a0185594de0dcf8340c45b6af7dbdc7682fbef6313f9f1cb234689d9f1ff603e1273faad89d0fe1ab57fbc7ce67b8847738b6edb2bb8401a6f49335e14be66c5689791a807f4a16a0c81"
+        },
+        {
+            "0x52cbea1f4d78445fb8f9267203f0f04bddf65b69b1acb0877143e77317f2d9679cb",
+            "0x331e156a1e1daa0039926a08ec80c2d7c1500bc435a53ebfc32fa398a3304fcd79d90725528e320add050da666b9de42b8307b",
+            "0x88421a41684412b839023200f0d00990725128a120a0805042666315e0090304b",
+            "0x331e156a1e1daa0039926a08ec80c2d7c1552ffeb5f5ffbfc7ffaf9ae7307fcf7dfddf65f69f3acbdd771dbe77b9ff6fbe79fb",
+            "0x331e156a1e1daa0039926a08ec80c2d7c155277a9451e93b86d42c0ac41070c27d64d840e41528c1d57219981188a16f2e49b0"
+        },
+        {
+            "0xbde7e20f37c3ed822555d36050240dcfb5a9a3867d149cffe78e92b95573cbdde33a8c9495148e04cafa1325aae058b4a98c50f7019de1345de6dce12436bed4b86eca2d",
+            "0xee480b4096f0c1ac565d623dd53b62dba81c507d3c8e15372396fa49de0ecf074fb0ed1785f00f8094022ff50fc436a7cbd18de8ff317c33ea9bdbd8814a7658fcd1fd10b2ed10eaf7e4c2b8f409df3c36f1f0c986a49805a9ed08bbcd603e2eec9e18",
+            "0x547a00d1781e0020014022050040406a58981846814107c238a929950014a544038809410108c00caf20000a8e00894280450f00184a01005a0cc0020042014286c8a08",
+            "0xee480b4096f0c1ac565d623dd53b62dba81c507d3c8e15372396fa49de0ecfbfeff2ef37c7fd8fa5d5d36ff52fcdffb7ebf38ffdffbdfff7ee9bfbddf3cbfffbfeddfd95b6ef14eafff7e7baf459ffbdbef1f7c99fe5bc5deffde9bffffefebeeede3d",
+            "0xee480b4096f0c1ac565d623dd53b62dba81c507d3c8e15372396fa49de0ecfbaa852e220461d8da5c1d14fa52bc9f91262720b95ebad83d46409628df281abbbc65d6985a66314200df7e71214516b95baa107c81b45ac584f31e99ffbdeea96825435"
+        },
+        {
+            "0x17ed0a1aa80542396e82ab79f6d4dda731d10f9487467fcfa5c8b501fa86488fbe268605c01beb257c9e301a42833d22965ea2ff0eda5f18427481a300a8f9aa81e76d774ea1dbed40268eca094bef627d2c206f6885fc12f71557bfda836",
+            "0x422340e8ff3b4177efa5f58111fe306aa602d8020164fa34c12acdb3de81e",
+            "0x2340604e21416540248480014a2062240000020004f810c10045b3da816",
+            "0x17ed0a1aa80542396e82ab79f6d4dda731d10f9487467fcfa5c8b501fa86488fbe268605c01beb257c9e301a42833d22965ea2ff0eda5f18427481a300a8f9aac3e76dffffbbdbffefa7ffcb19ffff6aff2ef86f69e5fe36f73fdfbfde83e",
+            "0x17ed0a1aa80542396e82ab79f6d4dda731d10f9487467fcfa5c8b501fa86488fbe268605c01beb257c9e301a42833d22965ea2ff0eda5f18427481a300a8f9aac3c42d9fb19a9a9aaf837b4b18b5df08db2ef86d69e10626363f9a0c04028"
+        },
+        {
+            "0x290796408a0b8baa742b9d466afc4958528f7976fdce50caa83ed63285f58d200e4c65842ea24c3d4a3850a1824b61d25af9d3b41b9e64407a5262a75d9efd08481cfbc339ae26b0755438894b9e2298a35ed9",
+            "0x4cb6f7935f5cc586320c6ce957f82cff774cde7d4201735a5acd22190fcb1c9c16d1887a",
+            "0x4012f193141884040008406007580cfd00481c794201220210450018094b1c0010810858",
+            "0x290796408a0b8baa742b9d466afc4958528f7976fdce50caa83ed63285f58d200e4c65842ea24c3d4a3850a1824b61defeffd3ff5fdfe6727e7eebf7fdbeff7f4cdeffc339ff7efafd76398fcb9ebe9ef3defb",
+            "0x290796408a0b8baa742b9d466afc4958528f7976fdce50caa83ed63285f58d200e4c65842ea24c3d4a3850a1824b619eec0e40eb475be272763e8bf0a5b2027f04c2868138dd7ceab87621868082be8e72d6a3"
+        },
+        {
+            "0x14e55ecb09d8c6827022df7c713c05a5d882e25782",
+            "0x2dbdb54cb6341fcea6f67cfaa5186aa0a91b9782e362cbb0dd0ef3cbc130ce0cb2ce7232c0562",
+            "0x10600e020898048060209c1000200124c002200502",
+            "0x2dbdb54cb6341fcea6f67cfaa5186aa0a91bdfd7eff2dfbcfd2ff3eff7f7dfccfadffa3ee57e2",
+            "0x2dbdb54cb6341fcea6f67cfaa5186aa0a91ad9d70fd2563cb529f1e636f7ddcce893fa1ce52e0"
+        },
+        {
+            "0x2b0dfd23fc740e1759697bcba800aa1be7df28c59fe72b9869766ac34ecb4e5d0dbc74c2cbb5f734bb8d38dab59c3f22cdc706c657839580c2793c4c7660606548c048a697db3dfbad82e695c605",
+            "0x33080f6fd52aeca572f24a98ff19b9e7327c3b951ccfd8c9a6b9bd6f7c940079e4be88178a2a6d5a2b17",
+            "0x30007249108288030900a00cd0100c612001180004918482620206548800020849a0813880264100205",
+            "0x2b0dfd23fc740e1759697bcba800aa1be7df28c59fe72b9869766ac34ecb4e5d0dbc74c2fbbdff7fffaffcfff7fe7fbaffdfbfe777ffbf95defffccdf6f9fd6f7cd448fff7ffbdffafaaefdfef17",
+            "0x2b0dfd23fc740e1759697bcba800aa1be7df28c59fe72b9869766ac34ecb4e5d0dbc74c2f8bdf85b6ea7d47fc76e75ba32debf2165ffae15deb6e485d0d9dd0a345448df7365b5ec27a88bcfed12"
+        },
+        {
+            "0xc0cc21922748d7626df1ab92b4ad4df1861050ca7de74adb92a140",
+            "0x3531a6880ccc47bc3826056efe912f3db02df9c0b6931e253ab9248f472359fe59218690f6781f35da89b8f1ff45cd5a1db9a414c9d7ec62ff5859a1572b1c1880a99aa74ebe8b12c68e791c11dd6cc0e5ed5",
+            "0xc40192054091400800898234a948b104004080410542c8020040",
+            "0x3531a6880ccc47bc3826056efe912f3db02df9c0b6931e253ab9248f472359fe59218690f6781f35da89b8f1ff45cd5a1db9a414c9d7ec6effda59a377af7e3edfbbbbaf4efedf1ae78f7dbfdffdedf9effd5",
+            "0x3531a6880ccc47bc3826056efe912f3db02df9c0b6931e253ab9248f472359fe59218690f6781f35da89b8f1ff45cd5a1db9a414c9d7ec6ef39a408323a66a3e5fb3238c046a540aa78b75bbcfa9c179cff95"
+        },
+        {
+            "0x68cbb0a526d1fa61003e12401db51090fa4649b00b7be7465d0eb18f74c86157a919",
+            "0x1ca7d6f9bc3e11d3c365af63bf9499b6c7e9c569da7361f0214b8d",
+            "0x1610001c111080600641b00019a6464904218a704060010909",
+            "0x68cbb0a526d1fa7da7fefbfc3fb5d3d3ffef6bbf9ffbf7c7fdcff9df77e9f177eb9d",
+            "0x68cbb0a526d1fa7da7e8ebfc23a4c3539fe92a0f9fe25181b4cbd85507a99176e294"
+        },
+        {
+            "0x210bef18d384992c5eb72e2b362c7296d9810f5ba9fd25e2d5648989d65095e45d1478f2a83140a0f68033a08fa3d7c392a3dc77e8e6aeba9ed76038e9e7825255fac990bf1098e6f9cba0",
+            "0xdb48641b3f63e5f1f41ff3b1578c4b190de42379d45cba03c4c6f34b1b14ea930fdff90dca53116710228e45b081fbddc9273a542e6f689642453adb91086bdb99681342113262d67f5517f2691024fe367459b01872549211067798063cc00b16c883b8cd2ffaa6d6116863f204bb23ce26c5bcdaf3e1b816dcf65ca",
+            "0x21014200d280002452a52800062c309681000113202d25e051640081024081644510008220010000660000208c00914080238c52e8a22c201686202049a20042445ac9803e108064c94180",
+            "0xdb48641b3f63e5f1f41ff3b1578c4b190de42379d45cba03c4c6f34b1b14ea930fdff90dca53116710228e45b081fbddc9273afeffef78dfd2c5fbfbf3bb6bdfb96d9b52f5baffd67f7d57faf99d65ff7e75d9f79f7ad7961b0f7f9b3e3cfa3f7ef9abbdcf7ffeeeffb9ed77f38ebf7bef27dfbcdbfbf1b99efffefea",
+            "0xdb48641b3f63e5f1f41ff3b1578c4b190de42379d45cba03c4c6f34b1b14ea930fdff90dca53116710228e45b081fbddc9252aeadfe250dfd080d1a973bb091cb0058b52e488fd04217841baf18d41f7683188f79758d7861b091f9b3c343a366af1a9850a5174cc3db88515f18a255beb039a1043f810b198b36ae6a"
+        },
+        {
+            "0x143143205d76a7287d48be24db8fbfe37c291d82e103aa05cfc172fb920f0e8cc15c47de948b964e39be34a5b8a2610198c0c5b98543e6e727be153cfff0338f229cc22f029e04f766c62988634fee1a0a16880c93e5b10bada4018b6765b54c08f5710344dbfb9e9ad5dd7914cab496b22a6",
+            "0x2d58b8b513f4bceb8300f8b978e31c163f36155e9678bb0f221ee7cbcf7262b9d53c7a395ea916218fa2478baada74f3e69df63a7be0c9554c07004f9e4d869642bbd63a9fe07138a6aef7ad14c74231cf6401c597f9b6d15c266c42c28613838609bd4f4522c9eb65fc8456acc339c641ac7d7b7bc2c48c8f2",
+            "0x100201970a308140836045a8638a30c201c82c103220089c1307a100e0804010c0246808a924431a614a4382260011040050005024486060211143a902001208482270014044220c620004107e8120014000c02c080038184018947452048086570004488c31882418c79104a8084800a2",
+            "0x2d58b8b513f4bcffb343f8fd7ee73c7f7fbe35df9ffffb7f2b1fe7ebcffa67ffd57efbbb5faf9ee1dfe7df9fabde7efbfebdf7bafbe1c9ddccc7b9cfdfefe7b7febffefffff3ff3abeeeffaf9ec7f777cf6d89e7dfffbedb5eae6cd3e7b71bafa609bf6f65b7cdebf5fd8756fffbbfded5fd7d7ffbf6d6beaf6",
+            "0x2d58b8b513f4bcffb243d8e40e44346b7788318519c758730b03652accd86776144e81ab51a79ae0d3e5991f214c3aca58a95382d981c8cd8cc2b9caddab61b1fcaeeac56fd3fe1a3a6cd8af8ac3b557094d89a6d817acdb4aae60d12737182e22083628209785e3908d87127738a75c9471046fb176523ea54"
+        },
+        {
+            "0x258e988b847b06b73462629161e28517f7b9ad7b5c19a9ad2c07f9a66f33fb2220fddb5a33b9cd5c2d63fd543efa1bef16e26b95484d70d0d7cfce28491ace0a608fb6cf9e97cb88d73c96c9150f9ef53c5e75bd68805fdce891e5935e9428ca67eba1e345148fcf2",
+            "0x1857c0e26e0476169cf804c8d5a431022cce0da75d7642a2414a900370f201f5073c7e700ff6626fbd8a104182954fa9f23a45474af5456a00e36f6a6c8162afdf7492d387a455dd8506167d5cc24e6861d7b480b1458230",
+            "0x1812c0a04000121280780040d12430020ccc05a319144082400a900360a000f10624385004d6000d3c880000808440a0003a44414874000800c16c0040816203c56412d2800455cc8106103548420c206092140011408030",
+            "0x258e988b847b06b73462629161e28517f7bdfd7f7ef9efed6dcff9eeef7bfb3222fdfbda77ffed7e2d77fd543fff3bff56f3eff748ff76f6ffdfef2c593bdefaffafb6dffebfdfdef73eb6ffb7cf9efffdff7dbd78fa5fddf8d1e5f7dfdc2ceee7fffbeb4f14dfef2",
+            "0x258e988b847b06b73462629161e28517f63cd1757af9eecc45c879eae269b83202313b80466ea9760977545409f53bf04691ac7248b216f62c176f2c51339af0ffac129bea389fde7732a03fb3c788dfc1a93c9050fa1a8130c184f48b580c2ce1f6daab4e00d7ec2"
+        },
+        {
+            "0x328edc02c67d84bf095ac048e50c2dc29cffc08184b11e4da02904be14eccd317e9f6bdd6fe2b8233e8928d65d4ad434ef8a629cae6013bfb3c54be167e16371dc6412b62c2b1213424dfb7d391cea8a7494a28576ce823d8e111994182909efba7dd3533dbbe510dab4ac5ef",
+            "0x61a1365a1226597896c514f5bb16a064f6ff6982ac91ea568daa43e473aa63867bdb628e92e97ebd4f2091",
+            "0x4121224210201020968510918a00a04042284100a801c84001884180108a63865911228a92410ca94a0081",
+            "0x328edc02c67d84bf095ac048e50c2dc29cffc08184b11e4da02904be14eccd317e9f6bdd6fe2b8233e8928d65d4ad434ef8a629cae6013bfb3c54be167e16371dc661ab76dab3277d7cdff7d7f5ffbea76dfeff7feeecb3faf79dbb43e6f3befba7ffff73dfbef97fbf4fe5ff",
+            "0x328edc02c67d84bf095ac048e50c2dc29cffc08184b11e4da02904be14eccd317e9f6bdd6fe2b8233e8928d65d4ad434ef8a629cae6013bfb3c54be167e16371dc6208a5498a3076d5c4972c76475be072dbcd73eee44b232b79c330266e3349821a6ee51552cb8731605e57e"
+        },
+        {
+            "0x37a92944b67fae733d201c024838975531bc3f748d98089eed38faed40c9463441cf48ac40e98097ce75db2bf0120ef69087a176d31d562cc99137c67e4a659cbb1298ba150aa191ced4089deee7048511de602414936af93cb2cef1b7ee801d9b75d961d33bb2958669b16193abf7b55ccfebac3a490415128dac92",
+            "0x6fb8d83d986c4604db1b9396493a0a68270806cdbcc3299a049ebe77bd6891258e6313c720fb1b30ae9c4387ba51db3325e15033d9e01d499707c138b4cf4b85032da65e9ce3aabc5effbf7003771476ff71e86f665d2d3e7578dfcbb8f08c1619f609ec147f0",
+            "0x88c811882c440490030014400a0008000804c51c822900008e2800380001218462008100780320a6184381280181102001102140801c4810004118a4024101022d824a0ce30a3c4801993001161432bb2148660214093a357855c8b8b080041040012810490",
+            "0x37a92944b67fae733d201c024838975531bc3f748d9efb9feff9feed60cdf7bd79efdbace6ebf097eeffdf3bf9b24ffff7fff7ffd35df63dfdf33ff7ff4aeddcbb7bbdbfb73aff95cffd9e9dfeff74fd13df6cf4bcd37afb7dfbcefbbfefefffff75ff71d77ff79f86fff5f3d3eff7bdfcffefacfb699f759ecdeff2",
+            "0x37a92944b67fae733d201c024838975531bc3f748d9ef3136ee17c292084f78d78abdb0ce66bf017a2ae171969b2471d77fc77ffc145b01df5e33877cd408c5883693da7a638ff84cde9969c3a7e74f902552cd0acc35823595b00cb1c2b6fe66c75ee109454458b009fd4b3404ca038a07464a4fb289b758c4ceb62"
+        },
+        {
+            "0x1ab020d8beb54c354411f3a5658b5e5e87a896d7049c5eab20a302b6e35ca98364d7edd00eb3e209dcb035fe4b6eeace4e525229bf790c67bae63821e1282712d7c624efa64b3e5ad1a73aeb1033d4cd5949d63183173632445c9f488e74cd",
+            "0x4d706a200a7a70e0b6eeef2dbdb88779dd50af16e6405c17fd2c2efb5493cf13b730207a009a14ca150042af3e6b7f05230161a10073f87a56afede3c2cfd09857f78d7913cdd966e9a2e6e6e3",
+            "0x45000000a2a20a002a6e30ca9800451cd500e12e2005c10352c0a6a40824e1212202078000210c21000402826025704200120010052d02212ab0023c0cd5008563181111200404489008664c1",
+            "0x1ab020d8beb54c354411f3a5658b5e5e87a8dff76ebc5efb70e3b6feef7dbdbbe7fffdd0afb7e649dcb7fdfe6ffffedfcf53f739bf7b0cffbeee3d21e3af3f7bffc727efe7eb3e7bf9ff7eeffdf3d6cfd9d9d7f78f7f37ffdd7effeaeef6ef",
+            "0x1ab020d8beb54c354411f3a5658b5e5e87a8dba76ebc54d15043b4580c71143be3ae3080a1a5044980a7c8d26595be5d8141e5199f030cfdae2c2d21a3871979a8c307eec7ea3e2929dd6c44fdd0160289d181c60e6e25ff9d3a76ea68922e"
+        },
+        {
+            "0x85993ec08ac960d46bcba87136f24042485c6d3e0a9973e828df60e537860d6bc83dafa7fb292beef466d0a939ab9da2b",
+            "0x4c9a310b11d6e4b4d29d7ede30fb42161fd6a58792440f416abda6df55913a8a26c35140524de5dd9519c30f19641f4f0863bfefc2ae6c89333dd77d6f688cffcbde281772cee0dac9bb0dd16b6c1d33fa7e39b2e781896dcc2b0aba3abedf1381f9f38eb210f5bd2001ea8453ceb136dc3915fabdc30709db0b1a07ec40be",
+            "0x811926c08a08601002c8803022a2004040180d1e0889210808d2000420040c6b002d83815b290820700490a1202a8402a",
+            "0x4c9a310b11d6e4b4d29d7ede30fb42161fd6a58792440f416abda6df55913a8a26c35140524de5dd9519c30f19641f4f0863bfefc2ae6c89333dd77d6f688cffcbde281772cee0dac9bb0dd16b6c1d7bfbfe39bef78dcffdfeaf1bff3ebeff97c7fbf3afb73ef7bdf60ffbfc73debdb7defb7ffabfffef4fff0b9b9ffddabf",
+            "0x4c9a310b11d6e4b4d29d7ede30fb42161fd6a58792440f416abda6df55913a8a26c35140524de5dd9519c30f19641f4f0863bfefc2ae6c89333dd77d6f688cffcbde281772cee0dac9bb0dd16b6c156a6992311e718ccfd176ac19d51ebafb96472a1327252e7730d60fb9fc33180db506c36a482f7de84fb601899d559a95"
+        },
+        {
+            "0x4d9f3e8aae22123e382e7835d3d9d7e944a5c81cab3415fda40d0ec8fde8a50d8b21b2298f83a65bbdb10d120d302d8db4e9807715be0e",
+            "0x4dacc1a6f2cecd4179556cbbdfe1cedbc952de5232ff1fe1ae9c0c3bbfcd9087e4ed5bcd1f8c289b1456ef032d888",
+            "0xa48104308c4c004854008a93414eda4050cc02128a10c0a2180018b8080083c00051001300089b0410070109808",
+            "0x4d9f3e8aae22123e3cfefc3ffffdfffd57b5dedfbffe1dfdbc9d2fedffeff5ff9be9f2ebbfffff5bffffddbeddf8ef8db5edeef737fe8e",
+            "0x4d9f3e8aae22123e3cf4b42fbcf53b3d53309ed716ca09101898232ddec754f391c872ea347f7f53c3ffd8aedcc8ef0405acee87276686"
+        },
+        {
+            "0x28d61d5ca1f56b4d3134009f478b17ac208a5b559d9c3726a7a16919e3b12ec6d61a142dc04d834141a9a4",
+            "0xb444947aba00d50e10326ebea7a2618a10144dde07c15c685d4785eae16d232eb741bc2a09b7cf794a33ed3598803ad61af",
+            "0xc00104a1e06a041020000445801404008050501c8c160222a16019c2a00a44d610002cc04980010121a4",
+            "0xb444947aba00d78f71f7eebff7b6f39b501dfdfeb7fbde68fdf7ddfbe37f6b7eb7d1be3b1bffef79eb73fd35d8b43ede9af",
+            "0xb444947aba00d78371e7a4a1f116b299501db9a6b6bb9e60f8f2dc33221f4954a1d022111b5ba218eb71313140b42ecc80b"
+        },
+        {
+            "0x1b9a0b9c87fa234d05d06e18171cce3f8fc4adf7f75a402c4c5a281f46e714b96badab2184546aa11a7be482616cbb973da00e329628d3e692b69b43d34391884d87fcd64e2339fbb30044a370fffde97a128d1e5",
+            "0x7d641e556550c3ddb89ee553cbc0d8d92cdaec6519a2ff3bd792e0b309c24cb49056fb219ef4dfb2a72e76ac7df3407a44e55af5689e9c85c87e74d542dfb445f56a0a518c",
+            "0x78640a55655080008084a001c0405049049ac8201800462a1182a000000248b01052002108608d32212a60a43d30001804c05ac56082108588300440020fb4449520085184",
+            "0x1b9a0b9c87fa234d05d06e18171cce3fdfc5edf7f75e7dffcdfe7d3ffeef9dbbefafef719e7ffbbd7b7fefb2fd6cfbdf3defbe3bff6dfbeef2f7fbc7df7797ac4fd7ffd6cfebf9ffb7e74df77dfffdff7eb2ad1ed",
+            "0x1b9a0b9c87fa234d05d06e18171cce38598548a1a2567df7c5b47d23faea992ba6036d701e7b991c6355efb2fd4870de38cfbc2b796528cce051f1840c77962c03d25380c7caf1a734e709f75d04b9b62cb228069"
+        },
+        {
+            "0x142cd4c71f04927a526ca430e542cd9432860",
+            "0x1337869f6c145daf15b226485ef3c48b8037bf7cb2cc9834153b90f55d4217a5e4a9ea133",
+            "0x142c90c41804103a106404000500c48022020",
+            "0x1337869f6c145daf15b226485ef3c48b8037bf7cf6cf9f34977bd2fdfd72f7e7edbdfa973",
+            "0x1337869f6c145daf15b226485ef3c48b8037ab50660b87308741c299f972f2e7293dd8953"
+        },
+        {
+            "0x4f517f63e95a08284faaf4d4a290c334fc5d039e386727ddbb5d0a6d5fbb5540e97767023d60bedd158ed25051a6c56",
+            "0x9e2c9c6d2e3be2ad25733871aeba4ba64081294478f936f9c4fc45ada6bb2c098c98f21e709a88995cc3b0cf7e693f8e73f58f8f4735c81e8421182fc15426174f3b6da7b493135c",
+            "0x4f405a4269120008498a20c400808114cc190096200320c53b5808645318014040110200154020541186d2504120054",
+            "0x9e2c9c6d2e3be2ad25733871aeba4ba64081294478f936f9c4fd57ffbebfac8b8cfaff5f7abb8cbb5fc7f0ffffef7ffffbf5dfafd7fffd5e8eb77e7fe3d62fffdf7beda7b59b7f5e",
+            "0x9e2c9c6d2e3be2ad25733871aeba4ba64081294478f936f9c009525b982e8c8b08625d533ab384aa130660f69def4df3a8405f2992ce7d4a8ab66e5fe2822dfa9e638082b1897f0a"
+        },
+        {
+            "0x1713f8f439c07e35b741ec9b0bca80149a7ef129c73c23c34b4515d29dc7dec711007fa395ced70f3bebc6d229edb75bf04231f2414e0a826f3edae4edcf770d59650cc252c6a2eff07fda9baa70938085d1e15144a451d26304d8f3df2406b8eb40f4fae3666780d2e54cd93a5f17439a4d3656dc5d48",
+            "0x328df4b64b0bd0fbea359666904ea4aa215b03727a70bda853b6cf612b12c3d56ee93b003bd00a7b9c1d6755f580b467deba33bf7f33da4c37fffe79e73e4381ad4bf1306d1b58f5eb276cae813d6f9153d1294c51098d37b3b80154da",
+            "0x108094864a0310006a219446900e20aa005201603250b00011b241400a0243144ae02900330008610c004244a080b067da9a22301300804021514420411243008843d12004184840e02260260100428140d1284c110188053210005448",
+            "0x1713f8f439c07e35b741ec9b0bca80149a7ef129c73c23c34b4537dffdf7dfcfd1fbffb797eed74fbfebe7db2bffff7bfdea73f6cf6f2b92effffeedffcf7fdd5b7f9cdf77d7f7eff47fdebbbbffffb3dfddf7fffefdf7fe6385fdfbff346fbbfbf5ffffefeee7bdfff55fd93b5f574b9f7fb7fedd5dda",
+            "0x1713f8f439c07e35b741ec9b0bca80149a7ef129c73c23c34b45275f697195ccc1fb959603a847419f41e7892a9fcd2b4dea62448e2f2190acebb40dd6cf4cdd531e90df3593576f4418042199cfecb35f9dd6aebaddb6ec208575b82e146ba3b3b51fdd8fc8e6bdbd741f081313464a177a85eedd0992"
+        },
+        {
+            "0x68bc9c8f8257c6c88c0b2d46defc4539748fb906140acbf1a68820d1748bfc13ec84619f2b495d1ce74e0ca441a246497",
+            "0x2d30db90794c4b611858b19c973ea865904346738291751ba5fccc5cbf02c09876aca6bf23289174f545ad8039e0fbcefe359521dfc9681a7715e672fdc23cc446c7900851d2ed09568729c88bf9653c63f7e229893f31059e8b51924a54968d44e5bb26decae3159ce786d9b3a1454c6d6cb8108d22bd5111d2cc7eddb",
+            "0x68241c03824200880c0105068a50000854868904040a02d0828000906482d813a004400d2808100c220c0000408046493",
+            "0x2d30db90794c4b611858b19c973ea865904346738291751ba5fccc5cbf02c09876aca6bf23289174f545ad8039e0fbcefe359521dfc9681a7715e672fdc23cc446c7900851d2ed09568729c88bf9fdbceff7f7efc9bf3b2ddedffdd77b749fbd46f5bbefffeeeb35ddf78ffdb3edc56dff6ff95d9de7ff5db5d3ee7eddf",
+            "0x2d30db90794c4b611858b19c973ea865904346738291751ba5fccc5cbf02c09876aca6bf23289174f545ad8039e0fbcefe359521dfc9681a7715e672fdc23cc446c7900851d2ed09568729c88b91d9a0ec75b5ef41b33a28d855add77320193442f1b1ed2f6c6b354d930d25a04dc12df247f14d91c5f35db5936e3894c"
+        },
+        {
+            "0x6eef644a36b1e052a413160909a537f81d46b2d330981f507d84737065541b5bb5faebfa8491dcd0347fbe498a501e254b91f6d82d6771a69d0aee5a490e2a44a8ba4f5da963d70b486f36f4a65f372a6a60522cac6e6a01d1a2da8743d5381",
+            "0x391d108a0ba169bb746b3d5816fa985288c230bdde7e3b8433f8d595b63f08a90448923f30926960cf736be42e377b087e68848af89d80d95122b942b0162153d9d665c0e3508d8a25c8862c0bb7ad4f00e4b1213326f5ce32433df12cb9",
+            "0x3004000a0a01280130601018127a8050080030098074038003300415003508090408800910800140cb6008a4002250081e688082701800d00020a000a004000380d4408021508482214802240332a406002080002220150a200034310081",
+            "0x6eeff5db3eb1fa56bfb756bbdda57ff99d6ebef33bddfff3fdc77ffd7d5f7bfbbffaeffba7f3ddf6b67fff7fbe52ff77fb97f6d86deff9fe9d9ffe7bdd2f2b66bdbfdf7ffd6ff70bd8ef7efce6dfbf7afef05e6fbe7f7a6fdde3feb7dfd7fb9",
+            "0x6eecf59b3e115a443fa450badc245851986e3ef03b45f8b3c5c74cfd3c0f78ab3f6aaf73a762d5f6a273497f3412fd52fb16105065c8f87e909ffc71dd252b26bd87d23bf56de20390cd6a7cc49f8c50be905c67be7d586e8d41feb49cc7f38"
+        },
+        {
+            "0xa210334e6ffbec2fcfa42021075f84222c7",
+            "0x181b940df674ffa93b3346264fed88e40b8d8f252487bc1f2cb4c3284fa17145d2cd0c77102fc177898e53fb12c40525aeb017a57661a80a268f27b4c78cbb4bae0e96ed0065e32bc7dcb01be9cc4e6bd5db5e453e94855cb2d1d3f86e8218fe55035102fc10901add0eb539089af",
+            "0x821032440351002c0080000106150000087",
+            "0x181b940df674ffa93b3346264fed88e40b8d8f252487bc1f2cb4c3284fa17145d2cd0c77102fc177898e53fb12c40525aeb017a57661a80a268f27b4c78cbb4bae0e96ed0065e32bc7dcb01be9cc4e6bd5db5e453e94855cb2d1d3f86ea218ff5f6ffbeeffdfb43afd0fffbd2abef",
+            "0x181b940df674ffa93b3346264fed88e40b8d8f252487bc1f2cb4c3284fa17145d2cd0c77102fc177898e53fb12c40525aeb017a57661a80a268f27b4c78cbb4bae0e96ed0065e32bc7dcb01be9cc4e6bd5db5e453e94855cb2d1d3f86e2008cd1b6caaeed3df343afc09eabd2ab68"
+        },
+        {
+            "0x2db0666cd0edeeab9e46e5b729521be3ece0714ffeefe18cd1b8b0f17e04c51b0d79fc6d428c22b9af63756",
+            "0x1c1d5f18453c10d365065465c676fb8b58cb436b88660a0e19c350feb1f6954caf029a43a3e59bb35ce0bdbf80a7b8ff4b4f5d7d133bd244df8813e9695b1a6af9cea293e5da9ce4f8e1035fc8ce4ca62ecbec89e89fe25053e4153899415f61c41fcb412f13b58ac70fb84077831497f",
+            "0x8906468c0014e888e44a426094009e08ce05043e4052088411820c01e00410b01318845028800318300156",
+            "0x1c1d5f18453c10d365065465c676fb8b58cb436b88660a0e19c350feb1f6954caf029a43a3e59bb35ce0bdbf80a7b8ff4b4f5d7d133bd244df8813e9695b1a6af9cea293e5ffbce6fcf1efffebde4ee7bfebfe9bebffe2715ffefff99dd1fff1f57fcfc53f1ffdfeef4fbc62ffaf77f7f",
+            "0x1c1d5f18453c10d365065465c676fb8b58cb436b88660a0e19c350feb1f6954caf029a43a3e59bb35ce0bdbf80a7b8ff4b4f5d7d133bd244df8813e9695b1a6af9cea293e5f72c829431eeb163500a4399e2be920b7302211c1afad91590e7d13561cf84341ecc76aa4d3462ce2c77e29"
+        },
+        {
+            "0x33de1dc3fc5d6eeb5cbca27cc816a3727d1f9188400ea6b2c2799a40f7e611770b45cac7ed49fc0b66a46fcaf2393c0e03741bd08d26308fce62b0c56fbe44cb0949990bc3d4e5919ee1706dce518d6a06e865bdc26e761ef6723241b33583262bc4365103ba49dd17c0",
+            "0x148a80223564208532d09dd94cf189921325cad8f2a6a32568e36b2007f00866ce0c8e59034cac999f915817492737af76413832e2c4e840627b91b54766a1555e91b87b2692df16c41161184ac9a124d59aad5c06b1a61892cf5c0cd6cc628f764a161f1bdd6546cb51a1510eef5ddfbd",
+            "0x1121081d84c608910102048c812a222250881080006a00042480800510200240905804005492403262441083220040800601b9085062081444290806b2600cb004011010040c18104c1102d4c0081220080451c00464402867202001311812402c01001010a495d1780",
+            "0x148a8022356420b7fedddffd5dffebdebfa7fed8f6a7f37d7ff3eb600ff6bae6ff9eceffe75dff9bdfdbdfff49ff3feff66ffaf2fbfcee43767bd1bd6776afdf7eb1fd7fbed6df1fcd996bdbdeedb1bef5faedde57bdee1efaeffdcefefe7eff767a57bf3fdf676fcf77f153beefdddffd",
+            "0x148a8022356420b6eccd5e25119f62ceaf87b610e405d1587772e3600956baa4b796ceaee55ddb92da5b9ffa00db3cc9d22ef2c0dbf8e6431660413861562e9b3c217d1498d6141f8d886adb9e2c30ba34eac092573ccc1e7aaae1ceb8ba7c79047857ac2e5e436d0f67f052b4a680c87d"
+        },
+        {
+            "0x683d881de1820ee9fbb71ccd74fd10e3a9ce71bd132955b9e9840d9259275498d2fae81b112416f37e9af907c319657d5d81623462b98d93818a23751a2196de6dd7c18e05960",
+            "0xa9a2ae43423e6c78cc59ceba6601f6d85397527c462767dceeb1ebc6ad425fb2810a2b7525",
+            "0xa880a002402e24688c104c300601d4d81203422800012018a2314182094046900008205120",
+            "0x683d881de1820ee9fbb71ccd74fd10e3a9ce71bd132955b9e9840d9259275498d2fafa3bf53437f7ff9efd9febbf657f7d857b7567fdeff7fdceeb7fbe6bd6ffffffd1aeb7d65",
+            "0x683d881de1820ee9fbb71ccd74fd10e3a9ce71bd132955b9e9840d9259275498d2f07231f5103515b9163c9b28bf056230045b41457defe5fc44c86ba64b42fb96ffd12cb2c45"
+        },
+        {
+            "0xa827c5e2bd4293ed726065b32cac5c18d9df68b18300848f23f98c22fecd6b9fe7ed38a5adedd78f8dfe975d85c171f62b766947d7cd3d2ed3be52b50b792c0d6bb2701e28f22674a092e5ee0ec89bcd52680c6ae673a",
+            "0x1deac63a0a7ae71db949662f05aafcefed47a6c6dd5819dc82d250d978001903a1f19e1b8b44e76bd5899884bb97121fa13a63c33822314a486d29b59b66f141fd64af3414a3ea6bdca9b4362e704c744e8a12c1ab736636ca3aa9da4b75795f1a",
+            "0x202040a28c429068606045810c880c00099700018000040921b88402768d48998049382121e813860c328201048000d20b502047140d140ad30042340239080943226004004020202012a52602488388102004428471a",
+            "0x1deac63a0a7ae71db9496eaf7dfeffffed7ff7e6df5b3bdec7d3ddddfe8b1933a9f9fe3f9bc6efefd7b9fefefb9f5adffd7afbdff977f95e5f7f6bb7fff6fd7dfff6ef3ff5abfaffdee9f6bf2f71eeff6eef5ac9af7fe6fecbbefdfecbf7ff7f3a",
+            "0x1deac63a0a7ae71db9496cad79f4d73bc47971e0db032b164713dd448e8b0133a9b96c241386c887033066fa681d48c17c429b1cd157e9165f724b02fdf28c3d2eb6420ff188badc4e69628d0971aefb6ced58c8852d86da43867cfccbb3d73820"
+        },
+        {
+            "0x1cc981657c8a20f5c777fc1df0e3cde0b23d434e043732dcaaa0758e009a8d1bf8591ff8db693d676eff2c39645b79c06b510ac22b1b47551eb728aa9404c24f2a6dee6bbdf2276759786f4116d21f4009dd6fb8e277976668bd021effecc797ca23682b97dbdffb93333834b8bb8fb68e922f42e3c00111",
+            "0x1e52f1e05fbedda88873e9984a7a19bfbfbe9ea43e30588f46317b5cadc8eb02d255875f1dde872476d05dec1164e46c7fcf3fd718fff34a80d4c6e951d10f6ae0225d00e3953e99e",
+            "0x61010a002b094200063608808400824b2a69ea43a10000644110254014821000015865b0c060124668050200164c4687c823682187db14a801002814181086a60200000221400110",
+            "0x1cc981657c8a20f5c777fc1df0e3cde0b23d434e043732dcaaa0758e009a8d1bf8591ff8db693d676eff2c39645b79c1ef7f1ec7fbffdfdd9fbfb9aeb7a5dbfffbedee6bfff7aff77b7fffcbdedebf6d2ddd7ff9fffff7676dbddedfffeec7d7fef3fd7b9ffffffb9f7f7eb5bdbbffbe8eb7ff4efbd3e99f",
+            "0x1cc981657c8a20f5c777fc1df0e3cde0b23d434e043732dcaaa0758e009a8d1bf8591ff8db693d676eff2c39645b79c18e7e14c7d0f69ddd9989b12e33a559b4d18404285ef7af933a6fda8bca5caf6d2c851a493f9fe52105b8dcdfe9a2815036d0955a1824eb539e7f56a1a5ab79188cb7ff4cda93e88f"
+        },
+        {
+            "0xb77c8e0971a4f32bc9539c14b542ed2fa08e87560981cbdca4ccf4f7cc04fe7546a4a7eebe2592d131329fd591f66728a4179e",
+            "0x2fb77bc1694a8265e74ee9f41672fc681d72ea8eb65ef5807bcba4bc52ef9e381a4e4315a771497e506b734def1ca93dd519fe9e6944dd782380dff70b72798c",
+            "0x327c080970a08222485180108100ac02a08e0012080101842048745048004c6504a025c4182492410010180180d6670820118c",
+            "0x2fb77bc1694a8265e74ee9f416f7fcee1d73eeffbfdff79c7fffe6fd7fef9ebf5e4fc3dffff5cdfef7ef77ffff5eadbfffbfff9ef975fffff791fff72bf67f9e",
+            "0x2fb77bc1694a8265e74ee9f416c580e614034e7d9d97a61c6f7ee6517d4f10bf4c47c2de7bd5858aa7a777b39a5a0d9a3ba7db0cb875efe7f611299023d66e12"
+        },
+        {
+            "0x89a0fbe80f4c622f45f4f7a15d8dc23bff17d939349f39cffa643af024db78243fc46c7948ab14ea12595e8a6cf2196ed4f353d9b1b8834b96fb61073301b99af019f042b2215e8cd5f31cf65123dab47d6b697a",
+            "0xc2b6f7a999af54a94c156f771b995b528",
+            "0x22215a8890f108944102d23039012128",
+            "0x89a0fbe80f4c622f45f4f7a15d8dc23bff17d939349f39cffa643af024db78243fc46c7948ab14ea12595e8a6cf2196ed4f353d9b1b8834b96fb61073301b99af019f04ebb6f7e9ddff75ef6d177fff5fdfffd7a",
+            "0x89a0fbe80f4c622f45f4f7a15d8dc23bff17d939349f39cffa643af024db78243fc46c7948ab14ea12595e8a6cf2196ed4f353d9b1b8834b96fb61073301b99af019f04e994e24154f06566290752dc5c4fedc52"
+        },
+        {
+            "0x61cc2de53fe06a0381ce0dc4999795469453324c9036484632c257f02dddee71188198ed649bbe9ddae347178970bfbd3f1f28a787ee407a433f8473ba4fb77940227b769c9d555a8a70917ecfd038f80da4c6d5dc7211cc468c69a2275cfc119f145d2887543bbeb24",
+            "0x117135d192a9645062d1be59a1f8b151692159285e5877a0ae304521ad800f51fbba812d038e053cb79578c70cd34248a2b4026533bb961add83d9362893b74ce01695861c82b6f94f181feb4a957875c74cf1e7fe48dcc5196bf1214cc564f599168bf2fee1a07e617cfac992443fcdb28247",
+            "0x1c408050b000202018205c4811200420452124800340802200250302051ca71108010cd24008a09402243138960ad983d13208103644000411800402a4f947100223020148554508a1011648dc010900d0004c454421180408c29a20204e4118f04192003541b28204",
+            "0x117135d192a9645062d7bedbfffbff57e9395de8de59fff9fe794533adc90f75fffbad2d7f8eddfef795f8df8ed74bfbebfdae7573fb971bffd3f9f6aafbffece7b6b7fe5fbbb6fb7f9c1feffffdf9f5d7ecf7efffecfdc79febfb6d6ddde7f59dd6ebf6fee3f5ffe17dfbcdd2cc7fcfbbeb67",
+            "0x117135d192a9645062d7a29b7fab4f57c91945c88211eed9fa59001289490c357fd9ad087c8cd8e25084f0de82050bf34b69ac5142c30111265028c4a2ebc9a8e7b2a67e5bb91202388c1dccfdfcb1a092e456eee9a421c696eb2b6d2198a3d485d2e33464c3d5b1a0650b8c40cc4a8e096963"
+        },
+        {
+            "0x1af3ce2ba6101f661c52430ae7280e3491d8d044a6621c3ef348c4e6e45fc6dfc91ec46b27214a9ebff52a0922fdebf1e895cd7cc4f428c64b7b3c4711b53f1f04f25b2f63ba70f281f52cb8149509f1ad38156397556eedf9e5c72388364cdba9112913",
+            "0x5c5811bd255dad9049ec956e6eeaa95895e56e1c5c03cbfe24ae065ac3f528fda51a966771d288dfe3aab7611232e6f6bde10cf0d97620ebde6370ab24dbdecd4d7783c05cc8579517951049f16b26cf1612f6344a669d93ac990a997dfb5180a07a75f6a20dc110fd5547e744cfe0b348cc1786d8c7f587dc83fd9e8fdb9",
+            "0xa00e02861011200452010885280a201010000426621c10c3088462041dc61708124429240042183c050801205169510095043044f02006434024411130091000925b25000a00a201602098100501502c30046203140cc1786584230834481b89002911",
+            "0x5c5811bd255dad9049ec956e6eeaa95895e56e1c5c03cbfe24ae07fffff7bafda5fef7e775f2aeffe3ebff7d9f36eef6bde3eff4dd7e6eeffe6ffcbbecdffeff5dffebff5ee8d7bfdfbf1ec9fdffeecf569ef6b7fbe6fd9bfff9fadf7dfbf7bba77f7dfff2cfc159fddf5ff7c5dff9f75eeedf9edcf7fd87fccfff9f9fdbb",
+            "0x5c5811bd255dad9049ec956e6eeaa95895e56e1c5c03cbfe24ae07f5ff17929ca4ecf7a255e226ad6349fe7c9f36ac909c22e3c455384eae220e8c3ac89d6cbf59de683f0e68c5bac92a0ec0adbcea80549e9283f9a2ec88ff68fad65849a7bb07755de9f0c64059adca5d34c599d9c61e22c81884b5cd04b84e470f9d4aa"
+        },
+        {
+            "0xcd10bb69c381582eff7391a446db73312e738c6978564b350ca88e09cad650ef89dfb4cb00831c41d4739e957fdac00124348c91183da60b8f12dd3e349cad8b8d752fd9ea5613b1a41818032e0a2f2030790009a4fe9cdca54f96402b143e",
+            "0x7c4f944973a8882522976043833419c2c15b1531af1207b40092dd1e3c123a4cf06370c3111b",
+            "0x104d140010a888052007404202101180001801200a020030000009043c10180440024003101a",
+            "0xcd10bb69c381582eff7391a446db73312e738c6978564b350ca88e09cad650ef89dfb4cb00831c41d4739e957fdac00124348c91183da60b8f7edfbe7dffad8bad77bff9ebd737b9e6d95b173faf3f27b47992ddbefe9efeedfff770eb153f",
+            "0xcd10bb69c381582eff7391a446db73312e738c6978564b350ca88e09cad650ef89dfb4cb00831c41d4739e957fdac00124348c91183da60b8f6e92aa7def0503a857b8b9a9d527a866d943161fa53d27847992d4bac28ee6e9bff530e80525"
+        },
+        {
+            "0x1cdc2579b3f1727c03a0f733c6a1a50025c8b51640ed21fb0e700f873d35c83797a14",
+            "0xe3e7298d39a9c7cd225125b1a01505e3d9ca63f8b494e4d7218b10e8bddc06984bbbe43e263f30f6a92a9d7",
+            "0x10042120110162580220f03084a085000100a0144004004b0a600e063d30c02102814",
+            "0xe3e7298d39a9c7cd225dfdb5f9b7f5f3fdcbe3ffb7d6e5f721afd8fdbfdcefb9fbbff43fa73f35febfbfbd7",
+            "0xe3e7298d39a9c7cd224df994d9a6f491a5c9c30f8752457221aed85dab9cebb9b0b59431a102053e9ebd3c3"
+        },
+        {
+            "0x3ac7a7062a50d421ec7b732acfeafd988b5fe95661d371a7f2fdb5b9c1d37e304dd3a0dfcb995e9f99e1b86696b54df83fcd4e87764ffe27fbbd785875c31993f20f4628df79cbaeb50c3dfd132e20935f33ee0276c23f445dff5a075a8198907c1e248787fb28c44495d2e2ed677832432eeda5026afb91467cef4b8",
+            "0x12659e0b26181845981459681797ab57a50c5b4a34882e973f884d99c1e89c0457b99c9445be077039c60cffa057c608594d38423730d3eae76e8a8db6f946877e90bfecde4aaa320128ef3811cd31c3834e66fa7a61d1454778bf82781c091ae5fd348fd903d85116f83f331d84edaa925d1d65b0b30c1b7c6c69da380",
+            "0x20860306081044000459600287aa5580085b481400021127804d9181c0900410099080458a0150198000b820168408580d0842073043ea276a88081071420112900f44084a280200200c3811012000834e22ea0260c0054458bf0200180118807c14048103d800044015120084652812410c65a002081b104468ca080",
+            "0x127fdfaf263a58d5b9fc7b7b3fdfebffbd8f5feb76e9fff7bffafdbdf9e9df7e77fddfb4dfff9f7ebfdfedffe6d7f74df97ffd4eb776dffee7ffbffdfefdc79ffff2bfeefedffbfbafbdef3dfddf3fe3935f77fe7a77d37f477dffda7f5e899af5fd3eafdf87fb79d6fcbff3ffedeffab25f3fedb5b36efbfd6e7dff7b8",
+            "0x125f59ac20324891b9f8221b3d5841aa3d8704a362e9fde6987ab02c78294f7a67f44f349a759e2ea65fed47c6c17345a172f50cb0469c14c09537f5ee8c859eed62b0aaf695d3f9af9de305ecde1fe3101155147817137a032540d87f46888275812aab5e842379d2bcaae1ff698ad2a01e338815b166e0ed2a1535738"
+        },
+        {
+            "0x39d2210d760b098917fd1293f0708ed6ffcd7686a4041e774a0f52e808524d686429da6774dd45dcf69abb4a7a48116d71f8e38074196cddf128b041a28cdc1e12cf755c7",
+            "0x59d65c9b948dab08f5c3604fb8b4d15085e4ae6ea8e762bbcceb904b3d9b5837977c4c9f2b9e9f3f8c6babd3b5e846ed8bdad898648bc4f8ccbea95d7a9cf5fd694e6b1a176058fbb30257aafa296741ab7181398c43a264a94972c08b4a5c56807a5f06b5b88eb420df822b43c43b400d0",
+            "0x284221095208080003c41080b0200c529cc5740004001a17400852a000520868202140237081018c42822008484000094058428070190495b008b00082800802000b400c0",
+            "0x59d65c9b948dab08f5c3604fb8b4d15085e4ae6ea8e762bbcceb904b3d9b5837977c4c9f2b9e9f3f8c6babd3b5f9d6ed8ffedb99ed9ffdfadffef9dffefffdffefee6f1e776a5ffbfb0a57effa6d6fdbef75dd7ddcf7baffeb7b7ad1ef7bfcf7807e5f6efdf9aeb461ff8eff5fd6ff755d7",
+            "0x59d65c9b948dab08f5c3604fb8b4d15085e4ae6ea8e762bbcceb904b3d9b5837977c4c9f2b9e9f3f8c6babd3b5d194cc86acd391ed9c39ea5f4ed9d3ac63388befea6f04602a57a95b0a05e7924d4e9bcc055c7c50b538dfe3333ad1e63ba4b5000e466a6849a604617d0ef75dd6f435517"
+        },
+        {
+            "0xcf08fe64414998cc59938913e660f0f9b221f459cd8e04126cf902d0b6cea0edc26164b9d84e9ce7dfe058c1fe0fb452848616368c3",
+            "0x234286d14c1098ea9fd7f83508641ef3288da679fce09dd1359514ebf0dbcdc73b8f7f6171762d3d5df6492591c9386",
+            "0x4000910810806090d1b02100400c820000247900c094c0208500616099c84618875f6050402c0d145200041000082",
+            "0xcf08fe644149bbcedfd3cd13feeafffffa35fc7ddfff2c9feef9fef0bfdfb5fdd6ebf4fbddcfbfefffe179f7ff3ffdf6cda797ffbc7",
+            "0xcf08fe644149bb8edf42c5037e8a6f2e4a14fc3dd37d2c9fca80fe302b1f9578d68a94621589a768a08129b7d332e9a4cda387ffb45"
+        },
+        {
+            "0x343e32e61b86c0c7cc895cf233ea3d5b5ad65435c1f87e034b59788a9af14ffae9249f1f3cfe0789abbe8edc8ce",
+            "0x63f7afb1dcebc9d65f9d468754ea558119988cb7d85e427003f2c1d9b360d2c75b97c1308ee3a7b5901044c6353e14f3e6b54a2ead64acdf914c6f7b6d4ed3205abdc78aa7bb47d548607b4ffe1db7331aac39c8bc7fcfd62238467352656a3ad04a423",
+            "0x241e10440b024046c00058b0038a251b42d4402041487e010311188818c00c7ac9040218047202012a3a8048002",
+            "0x63f7afb1dcebc9d65f9d468754ea558119988cb7d85e427003f2c1d9b360d2c75b97c1308ee3a7b5901044c6353e14f3e6b54a2ead64bcffb3ee7fffedcfdfa95efff7eabffb5fd75c75fbfffe1fff7b7aaebbf9ffffeff6bf3f7eff57edebbededecef",
+            "0x63f7afb1dcebc9d65f9d468754ea558119988cb7d85e427003f2c1d9b360d2c75b97c1308ee3a7b5901044c6353e14f3e6b54a2ead6498e1a3aa74fdad891fa9064ff4609ae01d031c55bab7801efc6a6226a339f38526f2bd277a8d55ecc1845e96ced"
+        },
+        {
+            "0x981ba5db1da1fe952887e32cd21d51ba024022c8d837ec00f9772a111f87644012cee4a01f66d09ef168ebdfb91232e9e8f65d63ee7e6e050ae9707e7b15df4f8037b0d8d427f32429a45312a24081ed5a9c8ec22358f3621c961349638f30e049d00d513901fe065d5364f4cfca93f14a2b1b",
+            "0x1ba08accd8474ea8d9dc2f10d3c2c2edcbf9c3a909ab45",
+            "0x38000c048400c0019002e00514240e4cbc883a1082b01",
+            "0x981ba5db1da1fe952887e32cd21d51ba024022c8d837ec00f9772a111f87644012cee4a01f66d09ef168ebdfb91232e9e8f65d63ee7e6e050ae9707e7b15df4f8037b0d8d427f32429a45312a24081ed5a9c8ec22358f3621c9613497bafbaecd9d74ff9f9ddff16dfd3e6fdcffbd3f94bab5f",
+            "0x981ba5db1da1fe952887e32cd21d51ba024022c8d837ec00f9772a111f87644012cee4a01f66d09ef168ebdfb91232e9e8f65d63ee7e6e050ae9707e7b15df4f8037b0d8d427f32429a45312a24081ed5a9c8ec22358f3621c961349782fba2c919743f9e0ddd1168e91a6190433505843805e"
+        },
+        {
+            "0x1d9992a4fce731fe937e70ec9efba437b1efa9e5459e3145f8c9142c6988eca9a61273750bcc1f00a64b32bab5a3a4c89858231f4fedce7a73bcc7285bbd18b328ccc298919f5511e973cd124f7e1c3912d52f4593c676f1c3f87a521",
+            "0x6e195204da93bdade43f0622217647326502417d70305d050d988",
+            "0x421810045011a921c412062200300210250001447030410008100",
+            "0x1d9992a4fce731fe937e70ec9efba437b1efa9e5459e3145f8c9142c6988eca9a61273750bcc1f00a64b32bab5a3a4c89858231f4fedce7a73bcc7285bbd18b328ccee99d39fdf93fdffed3f4f7e3d7f57f76f47d3ff76f1dffd7fda9",
+            "0x1d9992a4fce731fe937e70ec9efba437b1efa9e5459e3145f8c9142c6988eca9a61273750bcc1f00a64b32bab5a3a4c89858231f4fedce7a73bcc7285bbd18b328ccac81c39b8f8254de292d495c3d4f55e74a47d2bb06c19efd77ca9"
+        },
+        {
+            "0x123b8aaf5660144d596f10574b4c232f267222596831",
+            "0x10ab460448ce805f18a3c1d64fc8cc0c02b2cd5f860d462e33602f09fd131e5468c86997e5a033729b2a03d3c284ee0111488ea",
+            "0x1021028c0600144801270012000c2028066000100820",
+            "0x10ab460448ce805f18a3c1d64fc8cc0c02b2cd5f860d462e33602f09fd133ffceafd6f97e5f5b7f39f7eb7d3f2f6ef2335de8fb",
+            "0x10ab460448ce805f18a3c1d64fc8cc0c02b2cd5f860d462e33602f09fd123decc23d0f96a175a5839e5eb711f076892334de0db"
+        },
+        {
+            "0x17529608c59c36277d9e89f9b275032e62ab42b4dc006f1943e12b088c36657b02937109db797e2fbb83c984f507841be083c5e36dd04a8b7d3",
+            "0x1d556659e3b765044e08b1f7879bf057ef",
+            "0x1814004940304104080810368500a017c3",
+            "0x17529608c59c36277d9e89f9b275032e62ab42b4dc006f1943e12b088c36657b02937109db797e2fbbd7dfe5ff3ff65be4e3cfff7df9ff8f7ff",
+            "0x17529608c59c36277d9e89f9b275032e62ab42b4dc006f1943e12b088c36657b02937109db797e2fba569fe16b3cf24ba4634efc15a9f58e03c"
+        },
+        {
+            "0x23ed0547893da2de2673832f9e6d988ce38c44a47495c1e0a714eb2f18ec455157cc20ea9da75cdcb0c4e9afa546efb3650b7e5cb7e659359d17fe79d2d5116bcd6c5cca45e0719d063e7df33f6788e5c6bd77c114340748cf553c5aa4992076953c4904181e24bb7c26a6e895d8b808c70133b52c9ca4a2266c2e2302bf777",
+            "0x3eaf5dd3cbba83558163fd16469a3d64905ff28ee65c15ff01f4d720b1ad669a893671bb614382f2331985333b0af52cbc0af22e50e4cb39d4ab3ad58127b3c481e692bb22dc0b497690e57e6fc84a87c2e1eb85e6c8bfc253fd497fc88",
+            "0x20aa1d83489880448123a50646922500105cb286401415170070d20011294408080241a061010232311105230800c42c340010240040cb11140a2091002691040104101a20980800268085582808420102a12884a48026400221003f400",
+            "0x23ed0547893da2de2673832f9e6d988ce38c44a47495c1e0a714eb2f18ec455157cc3eefddf7dffeb3d5e9effd56efbb7d6ffe5ff7eeff7d9dfffffdd7f5b1efeffeddfe75fb71df86fe7ffbbf77bbeff7bdffcbf63e57eccf7dfcfbbedda177b7fcc9e69abf26ff7f6ff6f8f5feffc8cf87f3f5ef9de6eabfee7fff4bfffff",
+            "0x23ed0547893da2de2673832f9e6d988ce38c44a47495c1e0a714eb2f18ec455157cc1e45c0749766339168cc5850a929586fee034568bf6988e8ff8d05f5a0c6abf6d5fc345b10de84cc4eeaba54b3ef3391cbcbe61a57ac046ce8f19e4ca15126f8c8e28aa50667776fd07870a6d7c08d86f154c719426a99ae7dde4bc0bff"
+        },
+        {
+            "0x4881b1172db56487aa0b4362479871a57",
+            "0xd40bc374f241c2bb638ed6dea08d7885135052619d2f58523b3218b57371993a62bea6cfc8abf4abb8e4a96b0a38bbffffdd0bc5e5a6514f0db",
+            "0x4081210228b16487880b4160061041053",
+            "0xd40bc374f241c2bb638ed6dea08d7885135052619d2f58523b3218b57371993a62bea6cfc8abf4abb8eca9fb1f3dbfffffff0bc7e7e7d97fadf",
+            "0xd40bc374f241c2bb638ed6dea08d7885135052619d2f58523b3218b57371993a62bea6cfc8abf4abb8ac28da1d150e9b7877008687e1c93ea8c"
+        },
+        {
+            "0x1e0e22b43b6de9f7ee3000e87eef492f84ee1bcd3f490cdbf35171b174335fe53afa9b752d9b1e1b0bd58d71d35687cb7b74",
+            "0xac57c7cfa532414e1182c7c499ffa996f7a28187f7f5d7586f0fd6b64e566bff1ff68daa60d7b650cfece99b8e2551941008aaa5ab966c526d584251600baf9f48d6b573e2779363363cea427961c0ac63d9c9abcc30976c3755b739dcbcccfbb7ae06b5deed54c59a5271caaa26134877898f75b065f3c72a8429ab5",
+            "0x40602140a4429948a30000876c3410b008c0bcc0f0908c0635160914411052518aa82612483181803510451105280421a34",
+            "0xac57c7cfa532414e1182c7c499ffa996f7a28187f7f5d7586f0fd6b64e566bff1ff68daa60d7b650cfece99b8e2551941008aaa5ab966c526d584251600baf9f48d6b573e2779363363cebe2fb6bc3beffdfffebcc3e97eef7d7ff7ffdbcdfffb7efbfb5dfff57c7bffe73efabb753d9f7e9bffdf8f7fff76afcbfbf5",
+            "0xac57c7cfa532414e1182c7c499ffa996f7a28187f7f5d7586f0fd6b64e566bff1ff68daa60d7b650cfece99b8e2551941008aaa5ab966c526d584251600baf9f48d6b573e2779363363ceba29b4a831abd46b748cc3e1082c3c74f773d001f0f2763b980c9f64386afac226503914191c6683fc8e8b2eef242f89e1c1"
+        },
+        {
+            "0x46529c1d4b03b4a0efd29ce200ce9564cdc4fa4b53b9b6725e3fffe3454d6e53848fa573858f0bdbcf846d790a5bfc7470d0b8ac1d494804fa7048b869d5e016e389bf93cb959469dca3f4c5e93f8bcb7dbb64bcec19c8d9dbc5f2cecb285d81f5fefe99ff4564662c7cc275a40f0ea519adb2",
+            "0x1b10fed79bfd5e52ba14eea13cf223bfbeb5f42bd781083545c4306ed5f69250efc19707288aadf9df45b4056a293da0cfae076ee9b08e7a7058ef0a58e67149980cdc60a75825607ec4e531e9d036e71e3df52048853e3",
+            "0x1010d6c518485a523810e0a13cf0029790a5b4034701080041c4100045a6000086811601280889f91c01100408083d004e82002ca190864a40408c0818a4510888008440075825601ec4440060c004271a00f02040801a2",
+            "0x46529c1d4b03b4a0efd29ce200ce9564cdc4fa4b53b9b6725e3fffe3f54fef7bbfdfe57ba5cfebdbcfa67ffbeb5ffefd78d0bbfc5d4b4eedff796dbefdddf076ebabff9fffdfd47ffeb3fecdfbffffefffbbe7bfed9ff8fddfe7f6dfcbeddf8bf5fefe9fff4f777ebd7fee75e7df5ea599fff3",
+            "0x46529c1d4b03b4a0efd29ce200ce9564cdc4fa4b53b9b6725e3fffe2f442832a3b5a405824c1e1c800a65682e104bec908c03bf8410a4ee9a5196db695cc90646b23600e3fced43f7e302ec913dffd25e6b3831be997387c55a2e6574be59b8b807ca89e130b3778b17fac0447d05ca191fe51"
+        },
+        {
+            "0x1c61ea1ba6135d29a669cc258f24a09ce0c6af1fa717",
+            "0x277557a8f45578e7730c64350cd3fd389bf96320fb3079402e9949062868fda63a6c371adf34952bd8fbf8a361671041556548ecabc7561f3febfcf26290dc819caa54b8eb26a7fb3a593202b2eb9a87fa214342ea4d639c3487882c7b6a03401d0715171c8ec44d45eff0c2571ca3f556d0d986fbeb5ff",
+            "0x10416008a4005408a60804218a24000c00802f1ea517",
+            "0x277557a8f45578e7730c64350cd3fd389bf96320fb3079402e9949062868fda63a6c371adf34952bd8fbf8a361671041556548ecabc7561f3febfcf26290dc819caa54b8eb26a7fb3a593202b2eb9a87fa214342ea4d639c3487882c7b6a03401d07d71fbdbee57dd7fff6ded75cf3ff5fdeddeefbfb7ff",
+            "0x277557a8f45578e7730c64350cd3fd389bf96320fb3079402e9949062868fda63a6c371adf34952bd8fbf8a361671041556548ecabc7561f3febfcf26290dc819caa54b8eb26a7fb3a593202b2eb9a87fa214342ea4d639c3487882c7b6a03401d06d309bd34a5789775965e954451bf5f1ed5ec0a112e8"
+        },
+        {
+            "0x259856f9c56582b4f8056fdbd37332ff6684ad104683782087ef2b965fa2d22153ca880d735c116878afac5b2477b7f",
+            "0x1518494828299164e2ee455afe73cd24484df0def1e24c01926bdb2566d44e483a04bbdd5aeab159678305b6ade08cb5bc83e0e63a7bd9e2bb016c355f0fd9e94044e8e9dd380c64ea2f83d239d0987a6864dd1a07c9d742",
+            "0x20105268c4008210c8040e438331122b2004811040811800044e0a945380c20002c8080111080120000d80002415342",
+            "0x1518494828299164e2ee455afe73cd24484df0def1e24c01926bdb2566d44e483a04bbdd5aeab15967db85ffbdf6dcbfff83f6ffbf7ffbefff696ef55f6fffeb487efaf9fdfa2d66ff3fabd2fff5d97eefeeffdfb7cfff7f",
+            "0x1518494828299164e2ee455afe73cd24484df0def1e24c01926bdb2566d44e483a04bbdd5aeab15965da80d931b6d49ef303b61b874ceacd4d6926e45b67ee6b483a1a50b8c22146ff132b52eee5596cefee27dfb58eac3d"
+        },
+        {
+            "0xd8526c4a399bb415b422ab254fb7c9a053c1507e3260aac195366c5fed9ff583053547f1b8f54561838e8d5fff273e25",
+            "0xdc8169197ca1b7f60394685c3438a5b9ff07c0deafe3d68064567be3d9ad3c577600e0d98c4bda37a6ed8175d437cded052bdf221c4c3d76221331061",
+            "0x4002480a30180400b42028044527882012c14076200008808434205a6c981501013446d010b540218082854221231021",
+            "0xdc8169197ca1b7f60394685c3dbda7fdff9ffbdfffe3feb274ff7ffbddbd3d57f726eafd9d5bfef7fefdff7df477ddff1fafdf761c7cfdf7fff373e65",
+            "0xdc8169197ca1b7f60394685c39bd837d5c9e7b9ff4a1fc3230ad0779dc9129509526ea759518bcf258347e2de46499921ea48b740474d5a3dde142e44"
+        },
+        {
+            "0x47ac96c78ee0c7a9906ce5af63d0ad1b0420e1ca783cc6904ee84",
+            "0x630297e0f122e36f0c5f2f34efbb078c2f4c00e7c16f96cb054",
+            "0x20028780e002a1000c452f20c0a90304204000600046904a004",
+            "0x47ef96d7eef1e7ebff6cffaf77ffbf1f8c2fedcafffdef96cfed4",
+            "0x47cf94506e11e54aff60ba80573f161c880fadca9ffda90685ed0"
+        },
+        {
+            "0x432a40ea48fcb8b8161bc19a26b544f54833bf5e005c7d1c19e8405c5464c8c139fdd9b627865e596c513fc68454827f070310dd7efe80306693ce441c89a74d91db5e27d6ba966aa1e109cc8385bd86a23d127cf609eea4118e0e1d9be83b561dcffb0ec3844d22",
+            "0x70d78d38ebcadb77733fc709a6d3b76576ca71acd7e3196640d6adc00225142070b943d5624a3a3d4e77a787d8221848ab06c5135",
+            "0x50c7880002481864410882008011b560744a212482021004401009c002211020402002c0400820214836838540001800a80044120",
+            "0x432a40ea48fcb8b8161bc19a26b544f54833bf5e005c7d1c19e8405c5464c8c139fdd9b627865e596c513fc68454827f070310df7ffed3befebfff773ffdf7dffdfb7e77febf9eeffff19fec8feffd86a27d527fff9dfff635afafddfffa7b7f9fefff8ef3ec5d37",
+            "0x432a40ea48fcb8b8161bc19a26b544f54833bf5e005c7d1c19e8405c5464c8c139fdd9b627865e596c513fc68454827f070310da738653beda3e79332f75d7d7fce02870ba1d8ca7dfd09fa88eef6186806c507bfd9dd3f2352dadc97c92432b9fee7f8473e81c17"
+        },
+        {
+            "0x7c4c2d104ca2a5c080fbf1e717e47f848ff9be3555bcff60c07907ade9e334a556157dcd28ebbfd73367defdc4d8f5de60815360394e4de6e7535d356ccb8a2d896157ba65a7e8541a06e604454aef3e8cebfc7aedb48466eb65039cf17c13fcdb1b",
+            "0x2a73b2854f05d043d4e28e0b2634fd7023aaf3e57e58f213dd0693769",
+            "0x2a0100804e00404084e2880a2604ac50000262a45018c213c10681309",
+            "0x7c4c2d104ca2a5c080fbf1e717e47f848ff9be3555bcff60c07907ade9e334a556157dcd28ebbfd73367defdc4d8f5de60815360394e4de6e7535d356ccb8a2d896157ba65a7ef7f3a56f65d457fef3eecfbff7fffb6beefff77e79ff17dd3fdff7b",
+            "0x7c4c2d104ca2a5c080fbf1e717e47f848ff9be3555bcff60c07907ade9e334a556157dcd28ebbfd73367defdc4d8f5de60815360394e4de6e7535d356ccb8a2d896157ba65a54f6f325216594177a1166c599f353ab6bec9d532e613d041c395ec72"
+        },
+        {
+            "0x3ee957090c3ab10e1c8af669f2093bba430a4322a741522d2ce1d20b07558298627de3dbbbef8828abc64195bad0f9f6acbb734a420d0d8dd330e90d23ab633826a612060eb95070758199006b547b24792d59f97c3191b2dee7a96e",
+            "0x7e30cfb7abf89648583c2f705f30abb997ded579a0de3172e2b546c920f92fbdf3bf5ffbd5d73620da518e7b4964a44505817d16c7028f4da494135d2589deffbfdb19f6a454f0431cda1884e51f48c67605f9f044e955a4f23da9dfa92af8dfba09ea6adf0390c",
+            "0x4e102090838a1061808e20122091028020a02228701502d2c415202050500802014424010480000284000949a4041348018114a420d018d42004904218921080600100406205010040091004b005a0478000989782090a28ce0290c",
+            "0x7e30cfb7abf89648583c2f73ffb5fbb9d7ffd5f9e8ff77ffe2b7ffed30fd3fbff7bf7ffbdfdf36b0ff59afff6ffebdffbff9ff9eff669f5fad9f9f7fefbffeffbfdbd9ffb75ef0d33efe3b86ef7f68e6ff95fff75cf9d5a6f77fbbdfbbffffdffb19fb6fff7b96e",
+            "0x7e30cfb7abf89648583c2f73b1a5db295475c598687157edc226fd6d105d1d9787aa7d291bca1690af09a7fd6eba99febb79ff9c7b669616099b8c37ee3eea5b9f0bc12b975a6091266c2b068f7e68a69d90fef71cf0c5a2477a1b983bff67487910f1473179062"
+        },
+        {
+            "0x20265b43c9319cd56eac6a02cbf7913ba44b",
+            "0x995b92e854a8e0d548bfc02e18529b37790f0e4d9aaf36e7abc4a0f1e6d69489215aaa61b5863b1c86b3536b443dc639d1eb3db7789c2cb2f8cad1a74e5168ef33948c81a06fbad3b9ab0b7c84045cd1f77620ef43c7f2088d2901917bec5346a44f679be9491d273dbe5bf6e39095bb411cac63e38626013d671445c",
+            "0x20261901493010c0462c2802401390310448",
+            "0x995b92e854a8e0d548bfc02e18529b37790f0e4d9aaf36e7abc4a0f1e6d69489215aaa61b5863b1c86b3536b443dc639d1eb3db7789c2cb2f8cad1a74e5168ef33948c81a06fbad3b9ab0b7c84045cd1f77620ef43c7f2088d2901917bec5346a44f679be9491d273dbe5bf6e7b4bdbb59ddfeebe7a62ebf7d77be45f",
+            "0x995b92e854a8e0d548bfc02e18529b37790f0e4d9aaf36e7abc4a0f1e6d69489215aaa61b5863b1c86b3536b443dc639d1eb3db7789c2cb2f8cad1a74e5168ef33948c81a06fbad3b9ab0b7c84045cd1f77620ef43c7f2088d2901917bec5346a44f679be9491d273dbe59f48624a92858d1fa8925260abe4474ae017"
+        },
+        {
+            "0x20a92c71c161a786989694109718416d7a291b8f9c71a5a71ee827e003a5a19cf2aa8faeecbfa231c330e2d4c747b75ccc4d43d8c37472b60",
+            "0xc2ba3ef844b62f020cd6e4b010499c2c28ab3c15ed2ef3114e5b806244e57be1a7d999a21399c1e950977f021c82a906bed39caeec6aa077628421f9d5dfed01b24fe857000e259537fbe07d6a83080080ae927512d4518f9a56f0a40376234855377d8ef40dcb6055bd8d351",
+            "0x20282071400021809096840092084045000801851471a0250a80000000a480141280018e8816a020033022404507350cc40d4340413400340",
+            "0xc2ba3ef844b62f020cd6e4b010499c2c28ab3c15ed2ef3114e5b806244e57be1a7d999a21399c1e950977f021c82a906bed39caeecebac77e3e5a7ffdddffd11b75fe97f7a2f3f9fbffbe5ff7eeb2fe083afb3fdf2fedfaffefff2b5c376e3dcd777ffdefc4dcbf8d7fdffb71",
+            "0xc2ba3ef844b62f020cd6e4b010499c2c28ab3c15ed2ef3114e5b806244e57be1a7d999a21399c1e950977f021c82a906bed39caeccc38c06a3e5867f4d4979112557a93a7a273e1aab8a45da746b2fe0830b33e9e07ede2176e95295c046c19c9270cad2384088b896c9ff831"
+        },
+        {
+            "0xf6b7f399370d10b097b17e514f044d77a8f170148f4837033bb5d425f73a4079e1c7a9c3e69246f902d8c9fd27caad1e93d83578d4af8d3b7b1c02041c44917a22ed56f2562ac1426a356f8d31965e8e367b8929f3907b1dc6e73a8f3a566ca5c4e113e9d2c53770b110df51cf504701ff3fcea5b819b9bfc49f",
+            "0x61989df2b7097a6a84dc016aec2716d9cac359d2d799d90ec006a66efe3f1fd0851978c4cfe2f64b307b852e23f5dfdc2f63196e1076782a228a46f5f7d4e54afc1ad7abf1f8fef46edaad1706956f95eb95953bd4",
+            "0x990290097822808c0002c82510d08a8119521400000c40002222ec1612500001404005628401105a8426238109d0006319460032082a020804c4e110e142c41250a110d850c440420117068425900991950094",
+            "0xf6b7f399370d10b097b17e514f044d77a8f170148f4837033bb5d425f73a4079e1c7a9c3e6f3defdf2ffc9ff6fcefd1ffbfc377eddefcf7bfbdf9bdd1ec497fe6eff7fffd6afd97aeeffefff7bb67f8f3e7bfdffffbf7b1deef77eff3a76eee7f5f7d7eddafd3ff7bbf1ffffff7edfadff3fdfefbdfbbdbfffdf",
+            "0xf6b7f399370d10b097b17e514f044d77a8f170148f4837033bb5d425f73a4079e1c7a9c3e6f3de64f06fc0874d4e711ff934126e0d654e62a9cb9bdd128497dc4c1369ed86afd83aaefa8d7b7aa6250b18587cf62fbf1804a8f74cf71074e6e33116c70c98392da71ae127af3b3e9dace8395bca2df22c2aff4b"
+        },
+        {
+            "0x31d126e874580b754389fad8b64aaa61cabb4f8eb6904fe7e504341ed903f7daa3e74d4da3afca80b2415672a",
+            "0x16fb17a0468c0afa6bad456efa4f9baf26860eda9d7c00c2520c8c9b6026fb50df59b8cb74f6d9be861052c5e831158e7ffd98746328ce11f91d9ea22f0803a8b059aea22d1715ca1abeae53a8bc6b8bfb9b6c9d24ae714767",
+            "0x11100e0745803440288e0189048aa20c0800a8a04904a22c10014008902e51a83c6080da1a6c880024114722",
+            "0x16fb17a0468c0afa6bad456efa4f9baf26860eda9d7c00c2520c8c9b6026fb50df59b8cb74f6d9be861052c5eb3d17eefffd98f77738dfbdfb7dbea63fabb7f8fb79aefe7f5757cbffbebf7faabe7fdffbbbfcbd2fae75676f",
+            "0x16fb17a0468c0afa6bad456efa4f9baf26860eda9d7c00c2520c8c9b6026fb50df59b8cb74f6d9be861052c5eb2c07e0f8b818c3371051bc7279340433a3b7505b30aa5c5347568bf72e912e02821f5f21a190352f8a64204d"
+        },
+        {
+            "0xbf1a14e469c234b72d56324d100e016bc38cdf7158e35f230c047585e7b107acc8e222e7f19552541e59316affd90e96ca657b6112f5e8c786dfcff342fc46252fcdab10c632578540dbf6235f164bc5711924c7c6ba9da85ab",
+            "0x5dd3fb9a3de26cd89eb9517af6bb25678f149f906e8751a0c20d7646d21c17191237022a990e0156541e376986fd6a680c60228e5955df08bae5789c81751cdcafe5a2e72d45b09",
+            "0x5d5158821d220c001481413006a800620204919042041000000876400214020112210220880600564412026806252a480800020251054008b22158140145101824c582a20d00109",
+            "0xbf1a14e469c234b72d56324d100e016bc38cdff3fbfb7fe36cdcffbdf7fbf7bfede7aff7ff957ed75ff9f36fffdfde9edf7d7b7712fff9cf87dfdfff77fdc6fd6fedaf70e6be5fd5dfdbfee77f9ecbf57dddafe7e6ffbdedfab",
+            "0xbf1a14e469c234b72d56324d100e016bc38c82a2a37962c160dceb3cb6cbf117ed85adf36e053cd34ff9f367899fdc8add7c695610df71c987899bed7595c0d845a5a770e4bc0ed09fd34cc6278acab06dc58b22645db0edea2"
+        },
+    };
+
+    bool opa=true, opo=true, opx=true;
+
+    //////////////////// AND ////////////////////
+
+    for (size_t i=0; i<COUNTOF(tests); i++)
+    {
+        Integer m(tests[i].m), n(tests[i].n), a(tests[i].a);
+
+        opa &= ((m & n) == a);
+        opa &= ((-m & n) == a);
+        opa &= ((m & -n) == a);
+        opa &= ((-m & -n) == a);
+
+        // And reversed
+        opa &= ((n & m) == a);
+        opa &= ((-n & m) == a);
+        opa &= ((n & -m) == a);
+        opa &= ((-n & -m) == a);
+
+        Integer t(m); t &= n;
+        opa &= (t == a);
+        t = n; t &= m;
+        opa &= (t == a);
+
+        opa &= ((m & m) == m);
+        opa &= ((n & n) == n);
+    }
+
+    if (opa)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  Bitwise AND over 32-bits to 1024-bits\n";
+
+    //////////////////// OR ////////////////////
+
+    for (size_t i=0; i<COUNTOF(tests); i++)
+    {
+        Integer m(tests[i].m), n(tests[i].n), o(tests[i].o);
+
+        opo &= ((m | n) == o);
+        opo &= ((-m | n) == o);
+        opo &= ((m | -n) == o);
+        opo &= ((-m | -n) == o);
+
+        // And reversed
+        opo &= ((n | m) == o);
+        opo &= ((-n | m) == o);
+        opo &= ((n | -m) == o);
+        opo &= ((-n | -m) == o);
+
+        Integer t(m); t |= n;
+        opo &= (t == o);
+        t = n; t |= m;
+        opo &= (t == o);
+
+        opo &= ((m | m) == m);
+        opo &= ((n | n) == n);
+    }
+
+    if (opo)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  Bitwise OR over 32-bits to 1024-bits\n";
+
+    //////////////////// XOR ////////////////////
+
+    for (size_t i=0; i<COUNTOF(tests); i++)
+    {
+        Integer m(tests[i].m), n(tests[i].n), x(tests[i].x);
+
+        opx &= ((m ^ n) == x);
+        opx &= ((-m ^ n) == x);
+        opx &= ((m ^ -n) == x);
+        opx &= ((-m ^ -n) == x);
+
+        // And reversed
+        opx &= ((n ^ m) == x);
+        opx &= ((-n ^ m) == x);
+        opx &= ((n ^ -m) == x);
+        opx &= ((-n ^ -m) == x);
+
+        Integer t(m); t ^= n;
+        opx &= (t == x);
+        t = n; t ^= m;
+        opx &= (t == x);
+
+        opx &= ((m ^ m) == Integer::Zero());
+        opx &= ((n ^ n) == Integer::Zero());
+    }
+
+    if (opx)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  Bitwise XOR over 32-bits to 1024-bits\n";
+
+    return opa && opo && opx;
+}
+
+bool TestIntegerOps()
+{
+    std::cout << "\nTesting Integer operations...\n\n";
+    bool pass=true, result;
+    RandomNumberGenerator& prng = GlobalRNG();
+
+    // The tests below include 0^0 and 0^0%0. There are mixed opinions about what the result
+    // should be. Some say it is undefined, others say it is 0, and yet others say it is 1.
+
+    // Be careful with unfettered exponentiation using EuclideanDomainOf<Integer> and
+    // Exponentiate(). It can easily consume all machine memory because it is an exponentiation
+    // without a modular reduction.
+
+    // ****************************** DivideByZero ******************************
+
+    {
+        try {
+            Integer x = Integer(prng, 128) / Integer::Zero();
+            result=false;
+        } catch (const Exception&) {
+            result=true;
+        }
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Integer DivideByZero\n";
+    }
+
+    // The 0*0 % 0 test.
+    {
+        try {
+            Integer x = 0;
+            Integer y = 0;
+            Integer z = ModularMultiplication(y, y, x);
+            result = false;
+        }
+        catch(const Integer::DivideByZero&) {
+            result = true;
+        }
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Integer DivideByZero\n";
+    }
+
+    // Another 0*0 % 0 test.
+    {
+        try {
+            Integer x = 0;
+            Integer y = 0;
+            Integer z = (y * y) % x;
+            result = false;
+        }
+        catch(const Integer::DivideByZero&) {
+            result = true;
+        }
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Integer DivideByZero\n";
+    }
+
+    // The 0^0 % 0 test.
+    {
+        try {
+            Integer x = 0;
+            Integer y = 0;
+            Integer z = ModularExponentiation(y, y, x);
+            result = false;
+        }
+        catch(const Integer::DivideByZero&) {
+            result = true;
+        }
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Integer DivideByZero\n";
+    }
+
+    // Another 0^0 % 0 test.
+    {
+        try {
+            Integer x = 0;
+            Integer y = 0;
+            Integer z = EuclideanDomainOf<Integer>().Exponentiate(y, y) % x;
+            result = false;
+        }
+        catch(const Integer::DivideByZero&) {
+            result = true;
+        }
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Integer DivideByZero\n";
+    }
+
+    // Integer divide by 0
+    {
+        try {
+            Integer r=1, q=1, a=1, d=0;
+            Integer::Divide(r, q, a, d);
+            result = false;
+        }
+        catch(const Integer::DivideByZero&) {
+            result = true;
+        }
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Integer DivideByZero\n";
+    }
+
+    // Another Integer divide by 0
+    {
+        try {
+            Integer q=1, a=1; word r=1, d=0;
+            Integer::Divide(r, q, a, d);
+            result = false;
+        }
+        catch(const Integer::DivideByZero&) {
+            result = true;
+        }
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Integer DivideByZero\n";
+    }
+
+    if (pass)
+        std::cout << "passed:";
+    else
+        std::cout << "FAILED:";
+    std::cout << "  Integer DivideByZero\n";
+
+    // ************************ RandomNumberNotFound ************************
+
+    try {
+        // A run of 71 composites; see http://en.wikipedia.org/wiki/Prime_gap
+        Integer x = Integer(GlobalRNG(), 31398, 31468, Integer::PRIME);
+        result=false;
+    } catch (const Exception&) {
+        result=true;
+    }
+
+    pass = result && pass;
+    if (result)
+        std::cout << "passed:";
+    else
+        std::cout << "FAILED:";
+    std::cout << "  Integer RandomNumberNotFound\n";
+
+    // ************************ Carmichael pseudo-primes ************************
+
+    result=true;
+    if (IsPrime(Integer("561")))
+        result = false;
+    if (IsPrime(Integer("41041")))
+        result = false;
+    if (IsPrime(Integer("321197185")))
+        result = false;
+    if (IsPrime(Integer("5394826801")))
+        result = false;
+    if (IsPrime(Integer("232250619601")))
+        result = false;
+    if (IsPrime(Integer("974637772161")))
+        result = false;
+
+    pass = result && pass;
+    if (result)
+        std::cout << "passed:";
+    else
+        std::cout << "FAILED:";
+    std::cout << "  Carmichael pseudo-primes\n";
+
+    // ****************************** Integer Double ******************************
+
+    try {
+        Integer x = Integer::One().Doubled();
+        result = (x == Integer::Two());
+    } catch (const Exception&) {
+        result=false;
+    }
+
+    pass = result && pass;
+    if (!result)
+        std::cout << "FAILED:  Integer Doubled\n";
+
+    // ****************************** Integer Square ******************************
+
+    try {
+        Integer x = Integer::Two().Squared();
+        result = (x == 4);
+    } catch (const Exception&) {
+        result=false;
+    }
+
+    pass = result && pass;
+    if (!result)
+        std::cout << "FAILED:  Integer Squared\n";
+
+    try {
+        Integer x = Integer::Two().Squared();
+        result = (x == 4) && x.IsSquare();
+    } catch (const Exception&) {
+        result=false;
+    }
+
+    pass = result && pass;
+    if (!result)
+        std::cout << "FAILED:  Integer IsSquare\n";
+
+    if (pass)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  Squaring operations\n";
+
+    // ****************************** Integer GCD ******************************
+
+    {
+        for (unsigned int i=0; i<128; ++i)
+        {
+            Integer x, y;
+            switch(i%2)
+            {
+                case 0:
+                {
+                    AlgorithmParameters params =
+                        MakeParameters("BitLength", 256)("RandomNumberType", Integer::PRIME);
+                    x.GenerateRandom(prng, params);
+                    y.GenerateRandom(prng, params);
+                    break;
+                }
+                case 1:
+                {
+                    x = MaurerProvablePrime(prng, 256);
+                    y = MihailescuProvablePrime(prng, 256);
+                }
+            }
+
+            if (x != y)
+            {
+                result = (RelativelyPrime(x, y) == true);
+                pass = result && pass;
+
+                if (!result)
+                    std::cout << "FAILED:  Integer GCD\n";
+            }
+        }
+
+        if (pass)
+           std::cout << "passed:";
+        else
+           std::cout << "FAILED:";
+        std::cout << "  GCD operations\n";
+    }
+
+    // ******************** Integer Modulo and InverseMod ********************
+
+    // http://github.com/weidai11/cryptopp/issues/602
+    //   The bug report that uncovered the InverseMod problems
+    {
+        Integer a("0x2F0500010000018000000000001C1C000000000000000A000B0000000000000000000000000000FDFFFFFF00000000");
+        Integer b("0x3D2F050001");
+
+        result = (Integer("0x3529E4FEBC") == a.InverseMod(b));
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  InverseMod operation\n";
+    }
+
+    // Integer Integer::InverseMod(const Integer &m)
+    //   Large 'a' and 'm'
+    for (unsigned int i=0; i<128; ++i)
+    {
+        Integer a(prng, 1024), m(prng, 1024);
+        a++, m++;  // make non-0
+
+        Integer x = a.InverseMod(m);
+        Integer y = (a % m).InverseMod(m);
+        Integer z = (a * y).Modulo(m);
+
+        if (RelativelyPrime(a, m) == true)
+            result = (x == y) && (z == 1) && (ModularMultiplication(a, x, m) == 1);
+        else
+            result = (x == y);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  InverseMod operation\n";
+    }
+
+    // Integer Integer::InverseMod(const Integer &m)
+    //   Corner cases like 0, 2m-1 and 2m+1
+    for (unsigned int i=0; i<128; ++i)
+    {
+        Integer a(prng, 1024), m(prng, 1024);
+        a++, m++;  // make non-0
+
+        // Corner cases
+        int j = i % 12;
+        switch (j)
+        {
+        case 0:
+            a = -1; break;
+        case 1:
+            a = 0; break;
+        case 2:
+            a = 1; break;
+        case 3:
+            a = m-1; break;
+        case 4:
+            a = m; break;
+        case 5:
+            a = m+1; break;
+        case 6:
+            a = 2*m-1; break;
+        case 7:
+            a = 2*m; break;
+        case 8:
+            a = 2*m+1; break;
+        case 9:
+            a = (m<<256)-1; break;
+        case 10:
+            a = (m<<256); break;
+        case 11:
+            a = (m<<256)+1; break;
+        default:
+            ;
+        }
+
+        Integer x = a.InverseMod(m);
+        Integer y = (a % m).InverseMod(m);
+        Integer z = (a * y).Modulo(m);
+
+        if (RelativelyPrime(a, m) == true)
+            result = (x == y) && (z == 1) && (ModularMultiplication(a, x, m) == 1);
+        else
+            result = (x == y);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  InverseMod operation\n";
+    }
+
+    // Integer Integer::InverseMod(const Integer &m)
+    //   Large 'a', small 'm'
+    for (unsigned int i=0; i<128; ++i)
+    {
+        Integer a(prng, 4096), m(prng, 32);
+        a++, m++; // make non-0
+
+        Integer x = a.InverseMod(m);
+        Integer y = (a % m).InverseMod(m);
+        Integer z = (a * y).Modulo(m);
+
+        if (RelativelyPrime(a, m) == true)
+            result = (x == y) && (z == 1) && (ModularMultiplication(a, x, m) == 1);
+        else
+            result = (x == y);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  InverseMod operation\n";
+    }
+
+    // Integer Integer::InverseMod(word m)
+    //   Small 'm' using word
+    for (unsigned int i=0; i<128; ++i)
+    {
+        Integer a(prng, 4096); word m;
+        prng.GenerateBlock((byte*)&m, sizeof(m));
+
+        a++; // make non-0
+        if (m == 0) m++;
+
+        // Avoid the conversion from word to long
+        Integer mi = Integer(Integer::POSITIVE, 0, m);
+        Integer ri = a % Integer(Integer::POSITIVE, 0, m);
+
+        Integer x = Integer(Integer::POSITIVE, 0, a.InverseMod(m));
+        Integer y = Integer(Integer::POSITIVE, 0, ri.InverseMod(m));
+        Integer z = Integer(Integer::POSITIVE, 0, (a * y).Modulo(m));
+
+        if (GCD(a,mi) == 1)
+            result = (x == y) && (z == 1);
+        else
+            result = (x == y);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  InverseMod operation\n";
+    }
+
+    if (pass)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  InverseMod operations\n";
+
+    // ****************************** Integer Divide ******************************
+
+    // Divide (Integer &r, Integer &q, const Integer &a, const Integer &d)
+    for (unsigned int i=0; i<128; ++i)
+    {
+        Integer r, q, a(prng, 1024), d(prng, 1024);
+        Integer::Divide(r, q, a, d);
+
+        Integer xr = a % d;
+        Integer xq = a / d;
+        result = (r == xr) && (q == xq);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Divide operation\n";
+    }
+
+    // Divide (word &r, Integer &q, const Integer &a, word d)
+    for (unsigned int i=0; i<128; ++i)
+    {
+        word r, d = prng.GenerateWord32();
+        Integer q, a(prng, 1024);
+        Integer::Divide(r, q, a, d);
+
+        Integer xr = a % Integer(Integer::POSITIVE, 0, d);
+        Integer xq = a / Integer(Integer::POSITIVE, 0, d);
+        result = (Integer(Integer::POSITIVE, 0, r) == xr) && (q == xq);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Divide operation\n";
+    }
+
+    if (pass)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  Divide operations\n";
+
+    // ****************************** Integer Power2 ******************************
+
+    {
+        Integer x, y;
+
+        x = Integer::Power2(0);
+        result = (x == 1);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Power2 operation\n";
+
+        x = Integer::Power2(1);
+        result = (x == 2);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Power2 operation\n";
+    }
+
+    for (unsigned int i=0; i<128; i+=2)
+    {
+        Integer b = 2, m(prng, 2048);
+
+        Integer x = EuclideanDomainOf<Integer>().Exponentiate(b, i) % m;
+        Integer y = Integer::Power2(i) % m;
+        result = (x == y);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Power2 operation\n";
+    }
+
+    if (pass)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  Power2 operations\n";
+
+    // ****************************** Integer Exponentiation ******************************
+
+    {
+        word32  m = prng.GenerateWord32();
+        if (m == 0) m++;
+
+        Integer z = Integer::Zero();
+        Integer x = ModularExponentiation(z, z, m);
+        Integer y = EuclideanDomainOf<Integer>().Exponentiate(z, z) % m;
+        result = (x == y) && (x == 1);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Exponentiation operation\n";
+    }
+
+    // The 0^0 % 0 test.
+    {
+        try
+        {
+            Integer x = 0;
+            Integer y = ModularExponentiation(x, x, x);
+            result = false;
+        }
+        catch(const Integer::DivideByZero&)
+        {
+            result = true;
+        }
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Exponentiation operation\n";
+    }
+
+    // Another 0^0 % 0 test.
+    {
+        try
+        {
+            Integer x = 0;
+            Integer z = EuclideanDomainOf<Integer>().Exponentiate(0, 0) % x;
+            result = false;
+        }
+        catch(const Integer::DivideByZero&)
+        {
+            result = true;
+        }
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Exponentiation operation\n";
+    }
+
+    // Run the exponent 0 to 128 on base 0
+    for (unsigned int i=0; i<128; i+=2)
+    {
+        Integer b = 0, m(prng, 2048);
+
+        Integer x = ModularExponentiation(b, i, m);
+        Integer y = EuclideanDomainOf<Integer>().Exponentiate(b, i) % m;
+        result = (x == y);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Exponentiation operation\n";
+    }
+
+    // Run the exponent 1 to 128 on base 2
+    for (unsigned int i=0; i<128; i+=2)
+    {
+        Integer b = 1, m(prng, 2048);
+
+        Integer x = ModularExponentiation(b, i, m);
+        Integer y = EuclideanDomainOf<Integer>().Exponentiate(b, i) % m;
+        result = (x == y);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Exponentiation operation\n";
+    }
+
+    // Run the exponent 0 to 128 on base 2
+    for (unsigned int i=0; i<128; i+=2)
+    {
+        Integer b = 2, m(prng, 2048);
+
+        Integer x = ModularExponentiation(b, i, m);
+        Integer y = EuclideanDomainOf<Integer>().Exponentiate(b, i) % m;
+        result = (x == y);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Exponentiation operation\n";
+    }
+
+    // Run the exponent 0 to 24 on random base
+    for (unsigned int i=0; i<24; ++i)
+    {
+        Integer b(prng, 32), m(prng, 2048);
+
+        Integer x = ModularExponentiation(b, i, m);
+        Integer y = EuclideanDomainOf<Integer>().Exponentiate(b, i) % m;
+        result = (x == y);
+
+        pass = result && pass;
+        if (!result)
+            std::cout << "FAILED:  Exponentiation operation\n";
+    }
+
+    if (pass)
+       std::cout << "passed:";
+    else
+       std::cout << "FAILED:";
+    std::cout << "  Exponentiation operations\n";
+
+    // ****************************** Integer Randomize ******************************
+
+	try
+	{
+		const word32 bitCounts[] = {
+            0,1,2,3,4,5,6,7,8,9,15,16,17,31,32,33,63,64,65,127,128,129
+		};
+
+		for (size_t i=0; i<COUNTOF(bitCounts); ++i)
+		{
+			result = true;
+            unsigned int maxBits = 0;
+			const size_t bitCount = bitCounts[i];
+			Integer n;
+
+			for (size_t j=0; j<128; ++j)
+			{
+				n.Randomize(prng, bitCount);
+				maxBits = (std::max)(maxBits, n.BitCount());
+			}
+
+			result &= (maxBits == bitCount);
+			if (!result)
+				std::cout << "FAILED:  Randomize " << bitCount << "-bits\n";
+
+			pass &= result;
+		}
+	}
+	catch (const Exception&)
+	{
+		pass = false;
+		result = false;
+	}
+
+	if (!pass)
+		std::cout << "FAILED:";
+	else
+		std::cout << "passed:";
+	std::cout << "  Randomize of various bit lengths\n";
+
+	return pass;
+}
+#endif
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validat3.cpp b/runtime/third_party/cryptopp/validat3.cpp
new file mode 100644
index 0000000..a5a6132
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat3.cpp
@@ -0,0 +1,1341 @@
+// validat3.cpp - originally written and placed in the public domain by Wei Dai
+//                CryptoPP::Test namespace added by JW in February 2017.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "rng.h"
+#include "drbg.h"
+#include "darn.h"
+#include "osrng.h"
+#include "rdrand.h"
+#include "mersenne.h"
+#include "padlkrng.h"
+#include "randpool.h"
+
+#include "gzip.h"
+#include "channels.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (CRYPTOPP_MSC_VERSION >= 1500)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+bool ValidateAll(bool thorough)
+{
+	bool pass=TestSettings();
+	pass=TestOS_RNG() && pass;
+	pass=TestRandomPool() && pass;
+#if !defined(NO_OS_DEPENDENCE) && defined(OS_RNG_AVAILABLE)
+	pass=TestAutoSeededX917() && pass;
+#endif
+	// pass=TestSecRandom() && pass;
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+	pass=TestMersenne() && pass;
+#endif
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+	pass=TestPadlockRNG() && pass;
+	pass=TestRDRAND() && pass;
+	pass=TestRDSEED() && pass;
+#endif
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+	pass=TestDARN() && pass;
+#endif
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+	// http://github.com/weidai11/cryptopp/issues/92
+	pass=TestSecBlock() && pass;
+	// http://github.com/weidai11/cryptopp/issues/602
+	pass=TestIntegerOps() && pass;
+	// http://github.com/weidai11/cryptopp/issues/336
+	pass=TestIntegerBitops() && pass;
+	// http://github.com/weidai11/cryptopp/issues/64
+	pass=TestPolynomialMod2() && pass;
+	// http://github.com/weidai11/cryptopp/issues/360
+	pass=TestRounding() && pass;
+	// http://github.com/weidai11/cryptopp/issues/242
+	pass=TestHuffmanCodes() && pass;
+	// http://github.com/weidai11/cryptopp/issues/346
+	pass=TestASN1Parse() && pass;
+	pass=TestASN1Functions() && pass;
+	// https://github.com/weidai11/cryptopp/pull/334
+	pass=TestStringSink() && pass;
+	// Always part of the self tests; call in Debug
+# if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+	pass=TestAltivecOps() && pass;
+# endif
+	// Always part of the self tests; call in Debug
+	pass=ValidateBaseCode() && pass;
+	// https://github.com/weidai11/cryptopp/issues/562
+	pass=ValidateEncoder() && pass;
+	// Additional tests due to no coverage
+	pass=TestCompressors() && pass;
+	pass=TestSharing() && pass;
+	pass=TestEncryptors() && pass;
+	pass=TestX25519() && pass;
+	pass=TestEd25519() && pass;
+#endif
+
+	pass=ValidateCRC32() && pass;
+	pass=ValidateCRC32C() && pass;
+	pass=ValidateAdler32() && pass;
+	pass=ValidateMD2() && pass;
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+	pass=ValidateMD4() && pass;
+#endif
+	pass=ValidateMD5() && pass;
+	pass=ValidateSHA() && pass;
+
+	pass=ValidateKeccak() && pass;
+	pass=ValidateSHA3() && pass;
+	pass=ValidateSHAKE() && pass;
+	pass=ValidateSHAKE_XOF() && pass;
+
+	pass=ValidateLSH() && pass;
+
+	pass=ValidateHashDRBG() && pass;
+	pass=ValidateHmacDRBG() && pass;
+
+	pass=ValidateTiger() && pass;
+	pass=ValidateRIPEMD() && pass;
+	pass=ValidatePanama() && pass;
+	pass=ValidateWhirlpool() && pass;
+
+	pass=ValidateSM3() && pass;
+	pass=ValidateBLAKE2s() && pass;
+	pass=ValidateBLAKE2b() && pass;
+	pass=ValidatePoly1305() && pass;
+	pass=ValidateSipHash() && pass;
+
+	pass=ValidateHMAC() && pass;
+	pass=ValidateTTMAC() && pass;
+
+	pass=ValidatePBKDF() && pass;
+	pass=ValidateHKDF() && pass;
+	pass=ValidateScrypt() && pass;
+
+	pass=ValidateDES() && pass;
+	pass=ValidateCipherModes() && pass;
+	pass=ValidateIDEA() && pass;
+	pass=ValidateSAFER() && pass;
+	pass=ValidateRC2() && pass;
+	pass=ValidateARC4() && pass;
+	pass=ValidateRC5() && pass;
+	pass=ValidateBlowfish() && pass;
+	pass=ValidateThreeWay() && pass;
+	pass=ValidateGOST() && pass;
+	pass=ValidateSHARK() && pass;
+	pass=ValidateCAST() && pass;
+	pass=ValidateSquare() && pass;
+	pass=ValidateSKIPJACK() && pass;
+	pass=ValidateSEAL() && pass;
+	pass=ValidateRC6() && pass;
+	pass=ValidateMARS() && pass;
+	pass=ValidateRijndael() && pass;
+	pass=ValidateTwofish() && pass;
+	pass=ValidateSerpent() && pass;
+	pass=ValidateSHACAL2() && pass;
+	pass=ValidateARIA() && pass;
+	pass=ValidateCHAM() && pass;
+	pass=ValidateHIGHT() && pass;
+	pass=ValidateLEA() && pass;
+	pass=ValidateSIMECK() && pass;
+	pass=ValidateSIMON() && pass;
+	pass=ValidateSPECK() && pass;
+	pass=ValidateCamellia() && pass;
+	pass=ValidateSalsa() && pass;
+	pass=ValidateChaCha() && pass;
+	pass=ValidateChaChaTLS() && pass;
+	pass=ValidateSosemanuk() && pass;
+	pass=ValidateRabbit() && pass;
+	pass=ValidateHC128() && pass;
+	pass=ValidateHC256() && pass;
+	pass=RunTestDataFile("TestVectors/seed.txt") && pass;
+	pass=RunTestDataFile("TestVectors/threefish.txt") && pass;
+	pass=RunTestDataFile("TestVectors/kalyna.txt") && pass;
+	pass=RunTestDataFile("TestVectors/sm4.txt") && pass;
+	pass=ValidateVMAC() && pass;
+	pass=ValidateCCM() && pass;
+	pass=ValidateGCM() && pass;
+	pass=ValidateXTS() && pass;
+	pass=ValidateCMAC() && pass;
+	pass=RunTestDataFile("TestVectors/eax.txt") && pass;
+
+	pass=ValidateBBS() && pass;
+	pass=ValidateDH() && pass;
+	pass=ValidateX25519() && pass;
+	pass=ValidateMQV() && pass;
+	pass=ValidateHMQV() && pass;
+	pass=ValidateFHMQV() && pass;
+	pass=ValidateRSA() && pass;
+	pass=ValidateElGamal() && pass;
+	pass=ValidateDLIES() && pass;
+	pass=ValidateNR() && pass;
+	pass=ValidateDSA(thorough) && pass;
+	pass=ValidateLUC() && pass;
+	pass=ValidateLUC_DH() && pass;
+	pass=ValidateLUC_DL() && pass;
+	pass=ValidateXTR_DH() && pass;
+	pass=ValidateRabin() && pass;
+	pass=ValidateRW() && pass;
+	pass=ValidateECP() && pass;
+	pass=ValidateEC2N() && pass;
+	pass=ValidateECP_Legacy_Encrypt() && pass;
+	pass=ValidateEC2N_Legacy_Encrypt() && pass;
+	pass=ValidateECDSA() && pass;
+	pass=ValidateECDSA_RFC6979() && pass;
+	pass=ValidateECGDSA(thorough) && pass;
+	pass=ValidateESIGN() && pass;
+
+	pass=ValidateX25519() && pass;
+	pass=ValidateEd25519() && pass;
+	pass=ValidateNaCl() && pass;
+
+	if (pass)
+		std::cout << "\nAll tests passed!\n";
+	else
+		std::cout << "\nOops!  Not all tests passed.\n";
+
+	return pass;
+}
+
+bool TestSettings()
+{
+	bool pass = true;
+
+	std::cout << "\nTesting Settings...\n\n";
+
+	word32 w;
+	const byte s[] = "\x01\x02\x03\x04";
+
+#if (CRYPTOPP_MSC_VERSION >= 1400)
+	memcpy_s(&w, 4, s, 4);
+#else
+	std::copy(s, s+4, reinterpret_cast<byte*>(&w));
+#endif
+
+	if (w == 0x04030201L)
+	{
+#if (CRYPTOPP_LITTLE_ENDIAN)
+		std::cout << "passed:  ";
+#else
+		std::cout << "FAILED:  ";
+		pass = false;
+#endif
+		std::cout << "Your machine is little endian.\n";
+	}
+	else if (w == 0x01020304L)
+	{
+#if (CRYPTOPP_BIG_ENDIAN)
+		std::cout << "passed:  ";
+#else
+		std::cout << "FAILED:  ";
+		pass = false;
+#endif
+		std::cout << "Your machine is big endian.\n";
+	}
+	else
+	{
+		std::cout << "FAILED:  Your machine is neither big endian nor little endian.\n";
+		pass = false;
+	}
+
+	if (sizeof(void*) == 8)
+	{
+		std::cout << "passed:  Your machine is 64-bit.\n";
+	}
+	else if (sizeof(void*) == 4)
+	{
+		std::cout << "passed:  Your machine is 32-bit.\n";
+	}
+	else
+	{
+		std::cout << "FAILED:  Your machine is neither 32-bit nor 64-bit.\n";
+		pass = false;
+	}
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+	// App and library versions, http://github.com/weidai11/cryptopp/issues/371
+	const int v1 = LibraryVersion();
+	const int v2 = HeaderVersion();
+	if(v1/10 == v2/10)
+		std::cout << "passed:  ";
+	else
+	{
+		std::cout << "FAILED:  ";
+		pass = false;
+	}
+	std::cout << "Library version (library): " << v1 << ", header version (app): " << v2 << "\n";
+#endif
+
+	if (sizeof(byte) == 1)
+		std::cout << "passed:  ";
+	else
+	{
+		std::cout << "FAILED:  ";
+		pass = false;
+	}
+	std::cout << "sizeof(byte) == " << sizeof(byte) << "\n";
+
+	if (sizeof(word16) == 2)
+		std::cout << "passed:  ";
+	else
+	{
+		std::cout << "FAILED:  ";
+		pass = false;
+	}
+	std::cout << "sizeof(word16) == " << sizeof(word16) << "\n";
+
+	if (sizeof(word32) == 4)
+		std::cout << "passed:  ";
+	else
+	{
+		std::cout << "FAILED:  ";
+		pass = false;
+	}
+	std::cout << "sizeof(word32) == " << sizeof(word32) << "\n";
+
+	if (sizeof(word64) == 8)
+		std::cout << "passed:  ";
+	else
+	{
+		std::cout << "FAILED:  ";
+		pass = false;
+	}
+	std::cout << "sizeof(word64) == " << sizeof(word64) << "\n";
+
+#ifdef CRYPTOPP_WORD128_AVAILABLE
+	if (sizeof(word128) == 16)
+		std::cout << "passed:  ";
+	else
+	{
+		std::cout << "FAILED:  ";
+		pass = false;
+	}
+	std::cout << "sizeof(word128) == " << sizeof(word128) << "\n";
+#endif
+
+	if (sizeof(word) == 2*sizeof(hword)
+#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+		&& sizeof(dword) == 2*sizeof(word)
+#endif
+		)
+		std::cout << "passed:  ";
+	else
+	{
+		std::cout << "FAILED:  ";
+		pass = false;
+	}
+	std::cout << "sizeof(hword) == " << sizeof(hword) << ", sizeof(word) == " << sizeof(word);
+#ifdef CRYPTOPP_NATIVE_DWORD_AVAILABLE
+	std::cout << ", sizeof(dword) == " << sizeof(dword);
+#endif
+	std::cout << "\n";
+
+	const int cacheLineSize = GetCacheLineSize();
+	if (cacheLineSize < 16 || cacheLineSize > 256 || !IsPowerOf2(cacheLineSize))
+	{
+		std::cout << "FAILED:  ";
+		pass = false;
+	}
+	else
+		std::cout << "passed:  ";
+	std::cout << "cacheLineSize == " << cacheLineSize << "\n";
+
+#ifdef CRYPTOPP_CPUID_AVAILABLE
+	bool hasSSE2 = HasSSE2();
+	bool hasSSSE3 = HasSSSE3();
+	bool hasSSE41 = HasSSE41();
+	bool hasSSE42 = HasSSE42();
+	bool hasAVX = HasAVX();
+	bool hasAVX2 = HasAVX2();
+	bool hasAESNI = HasAESNI();
+	bool hasCLMUL = HasCLMUL();
+	bool hasRDRAND = HasRDRAND();
+	bool hasRDSEED = HasRDSEED();
+	bool hasSHA = HasSHA();
+	bool isP4 = IsP4();
+
+	std::cout << "hasSSE2 == " << hasSSE2 << ", hasSSSE3 == " << hasSSSE3;
+	std::cout << ", hasSSE4.1 == " << hasSSE41 << ", hasSSE4.2 == " << hasSSE42;
+	std::cout << ", hasAVX == " << hasAVX << ", hasAVX2 == " << hasAVX2;
+	std::cout << ", hasAESNI == " << hasAESNI << ", hasCLMUL == " << hasCLMUL;
+	std::cout << ", hasRDRAND == " << hasRDRAND << ", hasRDSEED == " << hasRDSEED;
+	std::cout << ", hasSHA == " << hasSHA << ", isP4 == " << isP4;
+	std::cout << "\n";
+
+#elif (CRYPTOPP_BOOL_ARM32 || CRYPTOPP_BOOL_ARMV8)
+
+# if defined(__arm__)
+	bool hasARMv7 = HasARMv7();
+	bool hasNEON = HasNEON();
+
+	std::cout << "passed:  ";
+	std::cout << "hasARMv7 == " << hasARMv7 << ", hasNEON == " << hasNEON << "\n";
+# else  // __arch32__ and __aarch64__
+	bool hasCRC32 = HasCRC32();
+	bool hasPMULL = HasPMULL();
+	bool hasAES = HasAES();
+	bool hasSHA1 = HasSHA1();
+	bool hasSHA2 = HasSHA2();
+	bool hasSHA3 = HasSHA3();
+	bool hasSHA512 = HasSHA512();
+	bool hasSM3 = HasSM3();
+	bool hasSM4 = HasSM4();
+
+	std::cout << "passed:  hasASIMD == 1";
+	std::cout << ", hasCRC32 == " << hasCRC32 << ", hasAES == " << hasAES;
+	std::cout << ", hasPMULL == " << hasPMULL << ", hasSHA1 == " << hasSHA1;
+	std::cout << ", hasSHA2 == " << hasSHA2 << ", hasSHA3 == " << hasSHA3;
+	std::cout << ", hasSHA512 == " << hasSHA512 << ", hasSM3 == " << hasSM3;
+	std::cout << ", hasSM4 == " << hasSM4 << "\n";
+# endif
+
+#elif (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+	const bool hasAltivec = HasAltivec();
+	const bool hasPower7 = HasPower7();
+	const bool hasPower8 = HasPower8();
+	const bool hasPower9 = HasPower9();
+	const bool hasAES = HasAES();
+	const bool hasPMULL = HasPMULL();
+	const bool hasSHA256 = HasSHA256();
+	const bool hasSHA512 = HasSHA512();
+	const bool hasDARN = HasDARN();
+
+	std::cout << "passed:  ";
+	std::cout << "hasAltivec == " << hasAltivec << ", hasPower7 == " << hasPower7;
+	std::cout << ", hasPower8 == " << hasPower8 << ", hasPower9 == " << hasPower9;
+	std::cout << ", hasAES == " << hasAES << ", hasPMULL == " << hasPMULL;
+	std::cout << ", hasSHA256 == " << hasSHA256 << ", hasSHA512 == " << hasSHA512;
+	std::cout << ", hasDARN == " << hasDARN << "\n";
+
+#endif
+
+	if (!pass)
+	{
+		std::cerr << "Some critical setting in config.h is in error.  Please fix it and recompile.\n";
+		std::abort();
+	}
+	return pass;
+}
+
+bool Test_RandomNumberGenerator(RandomNumberGenerator& prng, bool drain=false)
+{
+	bool pass = true, result = true;
+	const size_t GENERATE_SIZE = 1024*10, DISCARD_SIZE = 256, ENTROPY_SIZE = 32;
+
+	if(drain)
+	{
+		RandomNumberSource(prng, UINT_MAX, true, new Redirector(TheBitBucket()));
+	}
+
+	MeterFilter meter(new Redirector(TheBitBucket()));
+	RandomNumberSource(prng, GENERATE_SIZE, true, new Deflator(new Redirector(meter)));
+
+	if (meter.GetTotalBytes() < GENERATE_SIZE)
+	{
+		pass = false;
+		result = false;
+	}
+
+	if (!pass)
+		std::cout << "FAILED:";
+	else
+		std::cout << "passed:";
+	std::cout << "  " << GENERATE_SIZE << " generated bytes compressed to ";
+	std::cout << meter.GetTotalBytes() << " bytes by DEFLATE\n";
+
+	try
+	{
+		pass = true;
+		if(prng.CanIncorporateEntropy())
+		{
+			SecByteBlock entropy(ENTROPY_SIZE);
+			GlobalRNG().GenerateBlock(entropy, entropy.SizeInBytes());
+
+			prng.IncorporateEntropy(entropy, entropy.SizeInBytes());
+			prng.IncorporateEntropy(entropy, entropy.SizeInBytes()-1);
+			prng.IncorporateEntropy(entropy, entropy.SizeInBytes()-2);
+			prng.IncorporateEntropy(entropy, entropy.SizeInBytes()-3);
+		}
+	}
+	catch (const Exception& /*ex*/)
+	{
+		pass = false;
+		result = false;
+	}
+
+	if (!pass)
+		std::cout << "FAILED:";
+	else
+		std::cout << "passed:";
+	std::cout << "  IncorporateEntropy with " << 4*ENTROPY_SIZE << " bytes\n";
+
+	try
+	{
+		word32 val = prng.GenerateWord32();
+		val = prng.GenerateWord32((val & 0xff), 0xffffffff - (val & 0xff));
+
+		prng.GenerateBlock(reinterpret_cast<byte*>(&val), 4);
+		prng.GenerateBlock(reinterpret_cast<byte*>(&val), 3);
+		prng.GenerateBlock(reinterpret_cast<byte*>(&val), 2);
+		prng.GenerateBlock(reinterpret_cast<byte*>(&val), 1);
+	}
+	catch (const Exception&)
+	{
+		pass = false;
+		result = false;
+	}
+
+	if (!pass)
+		std::cout << "FAILED:";
+	else
+		std::cout << "passed:";
+	std::cout << "  GenerateWord32 and Crop\n";
+
+	try
+	{
+		pass = true;
+		prng.DiscardBytes(DISCARD_SIZE);
+		prng.DiscardBytes(DISCARD_SIZE-1);
+		prng.DiscardBytes(DISCARD_SIZE-2);
+		prng.DiscardBytes(DISCARD_SIZE-3);
+	}
+	catch (const Exception&)
+	{
+		pass = false;
+		result = false;
+	}
+
+	if (!pass)
+		std::cout << "FAILED:";
+	else
+		std::cout << "passed:";
+	std::cout << "  DiscardBytes with " << 4*DISCARD_SIZE << " bytes\n";
+
+	// Miscellaneous for code coverage
+	(void)prng.AlgorithmName();  // "unknown"
+
+	CRYPTOPP_ASSERT(result);
+	return result;
+}
+
+bool TestOS_RNG()
+{
+	bool pass = true;
+
+	member_ptr<RandomNumberGenerator> rng;
+
+#ifdef BLOCKING_RNG_AVAILABLE
+	try {rng.reset(new BlockingRng);}
+	catch (const OS_RNG_Err &) {}
+
+	if (rng.get())
+	{
+		std::cout << "\nTesting operating system provided blocking random number generator...\n\n";
+
+		MeterFilter meter(new Redirector(TheBitBucket()));
+		RandomNumberSource test(*rng, UINT_MAX, false, new Deflator(new Redirector(meter)));
+		unsigned long total=0;
+		time_t t = time(NULLPTR), t1 = 0;
+
+		// check that it doesn't take too long to generate a reasonable amount of randomness
+		while (total < 16 && (t1 < 10 || total*8 > (unsigned long)t1))
+		{
+			test.Pump(1);
+			total += 1;
+			t1 = time(NULLPTR) - t;
+		}
+
+		if (total < 16)
+		{
+			std::cout << "FAILED:";
+			pass = false;
+		}
+		else
+			std::cout << "passed:";
+		std::cout << "  it took " << long(t1) << " seconds to generate " << total << " bytes" << std::endl;
+
+		test.AttachedTransformation()->MessageEnd();
+
+		if (meter.GetTotalBytes() < total)
+		{
+			std::cout << "FAILED:";
+			pass = false;
+		}
+		else
+			std::cout << "passed:";
+		std::cout << "  " << total << " generated bytes compressed to " << meter.GetTotalBytes() << " bytes by DEFLATE\n";
+
+		try
+		{
+			// Miscellaneous for code coverage
+			RandomNumberGenerator& prng = *rng.get();
+			(void)prng.AlgorithmName();
+			word32 result = prng.GenerateWord32();
+			result = prng.GenerateWord32((result & 0xff), 0xffffffff - (result & 0xff));
+			prng.GenerateBlock(reinterpret_cast<byte*>(&result), 4);
+			prng.GenerateBlock(reinterpret_cast<byte*>(&result), 3);
+			prng.GenerateBlock(reinterpret_cast<byte*>(&result), 2);
+			prng.GenerateBlock(reinterpret_cast<byte*>(&result), 1);
+			prng.GenerateBlock(reinterpret_cast<byte*>(&result), 0);
+			pass = true;
+		}
+		catch (const Exception&)
+		{
+			pass = false;
+		}
+
+		if (!pass)
+			std::cout << "FAILED:";
+		else
+			std::cout << "passed:";
+		std::cout << "  GenerateWord32 and Crop\n";
+	}
+	else
+		std::cout << "\nNo operating system provided blocking random number generator, skipping test." << std::endl;
+#endif
+
+#ifdef NONBLOCKING_RNG_AVAILABLE
+	try {rng.reset(new NonblockingRng);}
+	catch (OS_RNG_Err &) {}
+
+	if (rng.get())
+	{
+		std::cout << "\nTesting operating system provided nonblocking random number generator...\n\n";
+
+		pass = Test_RandomNumberGenerator(*rng.get()) && pass;
+	}
+	else
+		std::cout << "\nNo operating system provided non-blocking random number generator, skipping test." << std::endl;
+#endif
+
+	CRYPTOPP_ASSERT(pass);
+	return pass;
+}
+
+bool TestRandomPool()
+{
+	member_ptr<RandomNumberGenerator> prng;
+	bool pass=true;
+
+	try {prng.reset(new RandomPool);}
+	catch (Exception &) {}
+
+	if(prng.get())
+	{
+		std::cout << "\nTesting RandomPool generator...\n\n";
+		pass = Test_RandomNumberGenerator(*prng.get()) && pass;
+	}
+
+#if !defined(NO_OS_DEPENDENCE) && defined(OS_RNG_AVAILABLE)
+	try {prng.reset(new AutoSeededRandomPool);}
+	catch (Exception &) {}
+
+	if(prng.get())
+	{
+		std::cout << "\nTesting AutoSeeded RandomPool generator...\n\n";
+		pass = Test_RandomNumberGenerator(*prng.get()) && pass;
+	}
+#endif
+
+	// Old, PGP 2.6 style RandomPool. Added because users were still having problems
+	//  with it in 2017. The missing functionality was a barrier to upgrades.
+	try {prng.reset(new OldRandomPool);}
+	catch (Exception &) {}
+
+	if(prng.get())
+	{
+		std::cout << "\nTesting OldRandomPool generator...\n\n";
+		pass = Test_RandomNumberGenerator(*prng.get()) && pass;
+
+		// https://github.com/weidai11/cryptopp/issues/452
+		byte actual[32], expected[32] = {
+			0x41,0xD1,0xEF,0x8F,0x10,0x3C,0xE2,0x94,
+			0x47,0xC0,0xC3,0x86,0x66,0xBC,0x86,0x09,
+			0x57,0x77,0x73,0x91,0x57,0x4D,0x93,0x66,
+			0xD1,0x13,0xE1,0xBA,0x07,0x49,0x8F,0x75
+		};
+
+		prng.reset(new OldRandomPool);
+		RandomNumberGenerator& old = *prng.get();
+
+		SecByteBlock seed(384);
+		for (size_t i=0; i<384; ++i)
+			seed[i] = static_cast<byte>(i);
+		old.IncorporateEntropy(seed, seed.size());
+
+		old.GenerateBlock(actual, sizeof(actual));
+		pass = (0 == std::memcmp(actual, expected, sizeof(expected))) && pass;
+
+		if (!pass)
+			std::cout << "FAILED:";
+		else
+			std::cout << "passed:";
+		std::cout << "  Expected sequence from PGP-style RandomPool (circa 2007)\n";
+	}
+
+	return pass;
+}
+
+#if !defined(NO_OS_DEPENDENCE) && defined(OS_RNG_AVAILABLE)
+bool TestAutoSeededX917()
+{
+	// This tests Auto-Seeding and GenerateIntoBufferedTransformation.
+	std::cout << "\nTesting AutoSeeded X917 generator...\n\n";
+
+	AutoSeededX917RNG<AES> prng;
+	return Test_RandomNumberGenerator(prng);
+}
+#endif
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+bool TestMersenne()
+{
+	std::cout << "\nTesting Mersenne Twister...\n\n";
+
+	member_ptr<RandomNumberGenerator> rng;
+	bool pass = true;
+
+	try {rng.reset(new MT19937ar);}
+	catch (const Exception &) {}
+
+	if(rng.get())
+	{
+		pass = Test_RandomNumberGenerator(*rng.get());
+	}
+
+	// Reset state
+	try {rng.reset(new MT19937ar);}
+	catch (const Exception &) {}
+
+	if(rng.get())
+	{
+		// First 10; http://create.stephan-brumme.com/mersenne-twister/
+		word32 result[10], expected[10] = {
+			0xD091BB5C, 0x22AE9EF6, 0xE7E1FAEE, 0xD5C31F79,
+			0x2082352C, 0xF807B7DF, 0xE9D30005, 0x3895AFE1,
+			0xA1E24BBA, 0x4EE4092B
+		};
+
+		rng->GenerateBlock(reinterpret_cast<byte*>(result), sizeof(result));
+		pass = (0 == std::memcmp(result, expected, sizeof(expected))) && pass;
+
+		if (!pass)
+			std::cout << "FAILED:";
+		else
+			std::cout << "passed:";
+		std::cout << "  Expected sequence from MT19937\n";
+	}
+
+	return pass;
+}
+#endif
+
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+bool TestPadlockRNG()
+{
+	std::cout << "\nTesting Padlock RNG generator...\n\n";
+
+	member_ptr<RandomNumberGenerator> rng;
+	bool pass = true, fail;
+
+	try {rng.reset(new PadlockRNG);}
+	catch (const PadlockRNG_Err &) {}
+
+	if (rng.get())
+	{
+		PadlockRNG& padlock = dynamic_cast<PadlockRNG&>(*rng.get());
+		pass = Test_RandomNumberGenerator(padlock);
+
+		// PadlockRNG does not accept entropy. However, the contract is no throw
+		const byte entropy[] = {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15};
+		(void)padlock.IncorporateEntropy(entropy, sizeof(entropy));
+
+		SecByteBlock zero(16), one(16), t(16);
+		std::memset(zero, 0x00, zero.size());
+		std::memset( one, 0xff,  one.size());
+
+		// Cryptography Research, Inc tests
+		word32 oldDivisor = padlock.SetDivisor(0);
+		padlock.GenerateBlock(t, t.size());
+		word32 msr = padlock.GetMSR();
+		padlock.SetDivisor(oldDivisor);
+
+		// Bit 6 should be set
+		fail = !(msr & (1 << 6U));
+		pass &= !fail;
+		if (fail)
+			std::cout << "FAILED:";
+		else
+			std::cout << "passed:";
+		std::cout << "  VIA RNG is activated\n";
+
+		// Bit 13 should be unset
+		fail = !!(msr & (1 << 13U));
+		pass &= !fail;
+		if (fail)
+			std::cout << "FAILED:";
+		else
+			std::cout << "passed:";
+		std::cout << "  von Neumann corrector is activated\n";
+
+		// Bit 14 should be unset
+		fail = !!(msr & (1 << 14U));
+		pass &= !fail;
+		if (fail)
+			std::cout << "FAILED:";
+		else
+			std::cout << "passed:";
+		std::cout << "  String filter is deactivated\n";
+
+		// Bit 12:10 should be unset
+		fail = !!(msr & (0x7 << 10U));
+		pass &= !fail;
+		if (fail)
+			std::cout << "FAILED:";
+		else
+			std::cout << "passed:";
+		std::cout << "  Bias voltage is unmodified\n";
+
+		fail = false;
+		if (t == zero || t == one)
+			fail = true;
+
+		pass &= !fail;
+		if (fail)
+			std::cout << "FAILED:";
+		else
+			std::cout << "passed:";
+		std::cout << "  All 0's or all 1's test\n";
+	}
+	else
+		std::cout << "Padlock RNG generator not available, skipping test.\n";
+
+	return pass;
+}
+
+bool TestRDRAND()
+{
+	std::cout << "\nTesting RDRAND generator...\n\n";
+
+	bool pass = true;
+	member_ptr<RandomNumberGenerator> rng;
+
+	try {rng.reset(new RDRAND);}
+	catch (const RDRAND_Err &) {}
+
+	if (rng.get())
+	{
+		RDRAND& rdrand = dynamic_cast<RDRAND&>(*rng.get());
+		pass = Test_RandomNumberGenerator(rdrand) && pass;
+
+		// RDRAND does not accept entropy. However, the contract is no throw
+		const byte entropy[] = {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15};
+		(void)rdrand.IncorporateEntropy(entropy, sizeof(entropy));
+
+		MaurerRandomnessTest maurer;
+		const unsigned int SIZE = 1024*10;
+		RandomNumberSource(rdrand, SIZE, true, new Redirector(maurer));
+
+		CRYPTOPP_ASSERT(0 == maurer.BytesNeeded());
+		const double mv = maurer.GetTestValue();
+		if (mv < 0.98f)
+			pass = false;
+
+		std::ostringstream oss;
+		oss.flags(std::ios::fixed);
+		oss.precision(6);
+
+		if (!pass)
+			oss << "FAILED:";
+		else
+			oss << "passed:";
+		oss << "  Maurer Randomness Test returned value " << mv << "\n";
+		std::cout << oss.str();
+	}
+	else
+		std::cout << "RDRAND generator not available, skipping test.\n";
+
+	return pass;
+}
+
+bool TestRDSEED()
+{
+	std::cout << "\nTesting RDSEED generator...\n\n";
+
+	bool pass = true;
+	member_ptr<RandomNumberGenerator> rng;
+
+	try {rng.reset(new RDSEED);}
+	catch (const RDSEED_Err &) {}
+
+	if (rng.get())
+	{
+		RDSEED& rdseed = dynamic_cast<RDSEED&>(*rng.get());
+		pass = Test_RandomNumberGenerator(rdseed) && pass;
+
+		// RDSEED does not accept entropy. However, the contract is no throw
+		const byte entropy[] = {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15};
+		(void)rdseed.IncorporateEntropy(entropy, sizeof(entropy));
+
+		MaurerRandomnessTest maurer;
+		const unsigned int SIZE = 1024*10;
+		RandomNumberSource(rdseed, SIZE, true, new Redirector(maurer));
+
+		CRYPTOPP_ASSERT(0 == maurer.BytesNeeded());
+		const double mv = maurer.GetTestValue();
+		if (mv < 0.98f)
+			pass = false;
+
+		std::ostringstream oss;
+		oss.flags(std::ios::fixed);
+		oss.precision(6);
+
+		if (!pass)
+			oss << "FAILED:";
+		else
+			oss << "passed:";
+		oss << "  Maurer Randomness Test returned value " << mv << "\n";
+		std::cout << oss.str();
+	}
+	else
+		std::cout << "RDSEED generator not available, skipping test.\n";
+
+	return pass;
+}
+#endif // x86, x32, or x64
+
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+bool TestDARN()
+{
+	std::cout << "\nTesting DARN generator...\n\n";
+
+	bool pass = true;
+	member_ptr<RandomNumberGenerator> rng;
+
+	try {rng.reset(new DARN);}
+	catch (const DARN_Err &) {}
+
+	if (rng.get())
+	{
+		DARN& darn = dynamic_cast<DARN&>(*rng.get());
+		pass = Test_RandomNumberGenerator(darn) && pass;
+
+		// DARN does not accept entropy. However, the contract is no throw
+		const byte entropy[] = {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15};
+		(void)darn.IncorporateEntropy(entropy, sizeof(entropy));
+
+		MaurerRandomnessTest maurer;
+		const unsigned int SIZE = 1024*10;
+		RandomNumberSource(darn, SIZE, true, new Redirector(maurer));
+
+		CRYPTOPP_ASSERT(0 == maurer.BytesNeeded());
+		const double mv = maurer.GetTestValue();
+		if (mv < 0.98f)
+			pass = false;
+
+		std::ostringstream oss;
+		oss.flags(std::ios::fixed);
+		oss.precision(6);
+
+		if (!pass)
+			oss << "FAILED:";
+		else
+			oss << "passed:";
+		oss << "  Maurer Randomness Test returned value " << mv << "\n";
+		std::cout << oss.str();
+	}
+	else
+		std::cout << "DARN generator not available, skipping test.\n";
+
+	return pass;
+}
+#endif  // PPC32 or PPC64
+
+bool ValidateHashDRBG()
+{
+	std::cout << "\nTesting NIST Hash DRBGs...\n\n";
+	bool pass=true, fail;
+
+	// # CAVS 14.3
+	// # DRBG800-90A information for "drbg_pr"
+	// # Generated on Tue Apr 02 15:32:09 2013
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 0], [AdditionalInputLen = 0], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x16\x10\xb8\x28\xcc\xd2\x7d\xe0\x8c\xee\xa0\x32\xa2\x0e\x92\x08";
+		const byte entropy2[] = "\x72\xd2\x8c\x90\x8e\xda\xf9\xa4\xd1\xe5\x26\xd8\xf2\xde\xd5\x44";
+		const byte nonce[] = "\x49\x2c\xf1\x70\x92\x42\xf6\xb5";
+
+		Hash_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8);
+		drbg.IncorporateEntropy(entropy2, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(result, result.size());
+		drbg.GenerateBlock(result, result.size());
+
+		const byte expected[] = "\x56\xF3\x3D\x4F\xDB\xB9\xA5\xB6\x4D\x26\x23\x44\x97\xE9\xDC\xB8\x77\x98\xC6\x8D"
+			"\x08\xF7\xC4\x11\x99\xD4\xBD\xDF\x97\xEB\xBF\x6C\xB5\x55\x0E\x5D\x14\x9F\xF4\xD5"
+			"\xBD\x0F\x05\xF2\x5A\x69\x88\xC1\x74\x36\x39\x62\x27\x18\x4A\xF8\x4A\x56\x43\x35"
+			"\x65\x8E\x2F\x85\x72\xBE\xA3\x33\xEE\xE2\xAB\xFF\x22\xFF\xA6\xDE\x3E\x22\xAC\xA2";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA1/128/440 (COUNT=0, E=16, N=8)\n";
+	}
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 0], [AdditionalInputLen = 0], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x55\x08\x75\xb7\x4e\xc1\x1f\x90\x67\x78\xa3\x1a\x37\xa3\x29\xfd";
+		const byte entropy2[] = "\x96\xc6\x39\xec\x14\x9f\x6b\x28\xe2\x79\x3b\xb9\x37\x9e\x60\x67";
+		const byte nonce[] = "\x08\xdd\x8c\xd3\x5b\xfa\x00\x94";
+
+		Hash_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8);
+		drbg.IncorporateEntropy(entropy2, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(result, result.size());
+		drbg.GenerateBlock(result, result.size());
+
+		const byte expected[] = "\xEE\x44\xC6\xCF\x2C\x0C\x73\xA8\xAC\x4C\xA5\x6C\x0E\x71\x2C\xA5\x50\x9A\x19\x5D"
+			"\xE4\x5B\x8D\x2B\xC9\x40\xA7\xDB\x66\xC3\xEB\x2A\xA1\xBD\xB4\xDD\x76\x85\x12\x45"
+			"\x80\x2E\x68\x05\x4A\xAB\xA8\x7C\xD6\x3A\xD3\xE5\xC9\x7C\x06\xE7\xA3\x9F\xF6\xF9"
+			"\x8E\xB3\xD9\x72\xD4\x11\x35\xE5\xE7\x46\x1B\x49\x9C\x56\x45\x6A\xBE\x7F\x77\xD4";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA1/128/440 (COUNT=1, E=16, N=8)\n";
+	}
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 0], [AdditionalInputLen = 128], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\xd9\xba\xb5\xce\xdc\xa9\x6f\x61\x78\xd6\x45\x09\xa0\xdf\xdc\x5e";
+		const byte entropy2[] = "\xc6\xba\xd0\x74\xc5\x90\x67\x86\xf5\xe1\xf3\x20\x99\xf5\xb4\x91";
+		const byte nonce[] = "\xda\xd8\x98\x94\x14\x45\x0e\x01";
+		const byte additional1[] = "\x3e\x6b\xf4\x6f\x4d\xaa\x38\x25\xd7\x19\x4e\x69\x4e\x77\x52\xf7";
+		const byte additional2[] = "\x04\xfa\x28\x95\xaa\x5a\x6f\x8c\x57\x43\x34\x3b\x80\x5e\x5e\xa4";
+		const byte additional3[] = "\xdf\x5d\xc4\x59\xdf\xf0\x2a\xa2\xf0\x52\xd7\x21\xec\x60\x72\x30";
+
+		Hash_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8);
+		drbg.IncorporateEntropy(entropy2, 16, additional1, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(additional2, 16, result, result.size());
+		drbg.GenerateBlock(additional3, 16, result, result.size());
+
+		const byte expected[] = "\xC4\x8B\x89\xF9\xDA\x3F\x74\x82\x45\x55\x5D\x5D\x03\x3B\x69\x3D\xD7\x1A\x4D\xF5"
+			"\x69\x02\x05\xCE\xFC\xD7\x20\x11\x3C\xC2\x4E\x09\x89\x36\xFF\x5E\x77\xB5\x41\x53"
+			"\x58\x70\xB3\x39\x46\x8C\xDD\x8D\x6F\xAF\x8C\x56\x16\x3A\x70\x0A\x75\xB2\x3E\x59"
+			"\x9B\x5A\xEC\xF1\x6F\x3B\xAF\x6D\x5F\x24\x19\x97\x1F\x24\xF4\x46\x72\x0F\xEA\xBE";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA1/128/440 (C0UNT=0, E=16, N=8, A=16)\n";
+	}
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 0], [AdditionalInputLen = 128], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x28\x00\x0f\xbf\xf0\x57\x22\xc8\x89\x93\x06\xc2\x9b\x50\x78\x0a";
+		const byte entropy2[] = "\xd9\x95\x8e\x8c\x08\xaf\x5a\x41\x0e\x91\x9b\xdf\x40\x8e\x5a\x0a";
+		const byte nonce[] = "\x11\x2f\x6e\x20\xc0\x29\xed\x3f";
+		const byte additional1[] = "\x91\x1d\x96\x5b\x6e\x77\xa9\x6c\xfe\x3f\xf2\xd2\xe3\x0e\x2a\x86";
+		const byte additional2[] = "\xcd\x44\xd9\x96\xab\x05\xef\xe8\x27\xd3\x65\x83\xf1\x43\x18\x2c";
+		const byte additional3[] = "\x9f\x6a\x31\x82\x12\x18\x4e\x70\xaf\x5d\x00\x14\x1f\x42\x82\xf6";
+
+		Hash_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8);
+		drbg.IncorporateEntropy(entropy2, 16, additional1, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(additional2, 16, result, result.size());
+		drbg.GenerateBlock(additional3, 16, result, result.size());
+
+		const byte expected[] = "\x54\x61\x65\x92\x1E\x71\x4A\xD1\x39\x02\x2F\x97\xD2\x65\x3F\x0D\x47\x69\xB1\x4A"
+			"\x3E\x6E\xEF\xA1\xA0\x16\xD6\x9E\xA9\x7F\x51\xD5\x81\xDC\xAA\xCF\x66\xF9\xB1\xE8"
+			"\x06\x94\x41\xD6\xB5\xC5\x44\x60\x54\x07\xE8\xE7\xDC\x1C\xD8\xE4\x70\xAD\x84\x77"
+			"\x5A\x65\x31\xBE\xE0\xFC\x81\x36\xE2\x8F\x0B\xFE\xEB\xE1\x98\x62\x7E\x98\xE0\xC1";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA1/128/440 (C0UNT=1, E=16, N=8, A=16)\n";
+	}
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 128], [AdditionalInputLen = 0], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x0e\xd5\x4c\xef\x44\x5c\x61\x7d\x58\x86\xe0\x34\xc0\x97\x36\xd4";
+		const byte entropy2[] = "\x0b\x90\x27\xb8\x01\xe7\xf7\x2e\xe6\xec\x50\x2b\x8b\x6b\xd7\x11";
+		const byte nonce[] = "\x2c\x8b\x07\x13\x55\x6c\x91\x6f";
+		const byte personalization[] = "\xf3\x37\x8e\xa1\x45\x34\x30\x41\x12\xe0\xee\x57\xe9\xb3\x4a\x4b";
+
+		Hash_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8, personalization, 16);
+		drbg.IncorporateEntropy(entropy2, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(result, result.size());
+		drbg.GenerateBlock(result, result.size());
+
+		const byte expected[] = "\x55\x37\x0E\xD4\xB7\xCA\xA4\xBB\x67\x3A\x0F\x58\x40\xB3\x9F\x76\x4E\xDA\xD2\x85"
+			"\xD5\x6F\x01\x8F\x2D\xA7\x54\x4B\x0E\x66\x39\x62\x35\x96\x1D\xB7\xF6\xDA\xFB\x30"
+			"\xB6\xC5\x68\xD8\x40\x6E\x2B\xD4\x3D\x23\xEB\x0F\x10\xBA\x5F\x24\x9C\xC9\xE9\x4A"
+			"\xD3\xA5\xF1\xDF\xA4\xF2\xB4\x80\x40\x91\xED\x8C\xD6\x6D\xE7\xB7\x53\xB2\x09\xD5";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA1/128/440 (C0UNT=0, E=16, N=8, A=0, P=16)\n";
+	}
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 128], [AdditionalInputLen = 0], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x8f\x2a\x33\x9f\x5f\x45\x21\x30\xa4\x57\xa9\x6f\xcb\xe2\xe6\x36";
+		const byte entropy2[] = "\x1f\xff\x9e\x4f\x4d\x66\x3a\x1f\x9e\x85\x4a\x15\x7d\xad\x97\xe0";
+		const byte nonce[] = "\x0e\xd0\xe9\xa5\xa4\x54\x8a\xd0";
+		const byte personalization[] = "\x45\xe4\xb3\xe2\x63\x87\x62\x57\x2c\x99\xe4\x03\x45\xd6\x32\x6f";
+
+		Hash_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8, personalization, 16);
+		drbg.IncorporateEntropy(entropy2, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(result, result.size());
+		drbg.GenerateBlock(result, result.size());
+
+		const byte expected[] = "\x4F\xE8\x96\x41\xF8\xD3\x95\xC4\x43\x6E\xFB\xF8\x05\x75\xA7\x69\x74\x6E\x0C\x5F"
+			"\x54\x14\x35\xB4\xE6\xA6\xB3\x40\x7C\xA2\xC4\x42\xA2\x2F\x66\x28\x28\xCF\x4A\xA8"
+			"\xDC\x16\xBC\x5F\x69\xE5\xBB\x05\xD1\x43\x8F\x80\xAB\xC5\x8F\x9C\x3F\x75\x57\xEB"
+			"\x44\x0D\xF5\x0C\xF4\x95\x23\x94\x67\x11\x55\x98\x14\x43\xFF\x13\x14\x85\x5A\xBC";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA1/128/440 (C0UNT=1, E=16, N=8, A=0, P=16)\n";
+	}
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 128], [AdditionalInputLen = 16], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x48\xa1\xa9\x7c\xcc\x49\xd7\xcc\xf6\xe3\x78\xa2\xf1\x6b\x0f\xcd";
+		const byte entropy2[] = "\xba\x5d\xa6\x79\x12\x37\x24\x3f\xea\x60\x50\xf5\xb9\x9e\xcd\xf5";
+		const byte nonce[] = "\xb0\x91\xd2\xec\x12\xa8\x39\xfe";
+		const byte personalization[] = "\x3d\xc1\x6c\x1a\xdd\x9c\xac\x4e\xbb\xb0\xb8\x89\xe4\x3b\x9e\x12";
+		const byte additional1[] = "\xd1\x23\xe3\x8e\x4c\x97\xe8\x29\x94\xa9\x71\x7a\xc6\xf1\x7c\x08";
+		const byte additional2[] = "\x80\x0b\xed\x97\x29\xcf\xad\xe6\x68\x0d\xfe\x53\xba\x0c\x1e\x28";
+		const byte additional3[] = "\x25\x1e\x66\xb9\xe3\x85\xac\x1c\x17\xfb\x77\x1b\x5d\xc7\x6c\xf2";
+
+		Hash_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8, personalization, 16);
+		drbg.IncorporateEntropy(entropy2, 16, additional1, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(additional2, 16, result, result.size());
+		drbg.GenerateBlock(additional3, 16, result, result.size());
+
+		const byte expected[] = "\xA1\xB2\xEE\x86\xA0\xF1\xDA\xB7\x93\x83\x13\x3A\x62\x27\x99\x08\x95\x3A\x1C\x9A"
+			"\x98\x77\x60\x12\x11\x19\xCC\x78\xB8\x51\x2B\xD5\x37\xA1\x9D\xB9\x73\xCA\x39\x7A"
+			"\xDD\x92\x33\x78\x6D\x5D\x41\xFF\xFA\xE9\x80\x59\x04\x85\x21\xE2\x52\x84\xBC\x6F"
+			"\xDB\x97\xF3\x4E\x6A\x12\x7A\xCD\x41\x0F\x50\x68\x28\x46\xBE\x56\x9E\x9A\x6B\xC8";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA1/128/440 (C0UNT=0, E=16, N=8, A=16, P=16)\n";
+	}
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 128], [AdditionalInputLen = 16], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x3b\xcb\xa8\x3b\x6d\xfb\x06\x79\x80\xef\xc3\x1e\xd2\x9e\x68\x57";
+		const byte entropy2[] = "\x2f\xc9\x87\x49\x19\xcb\x52\x4a\x5b\xac\xf0\xcd\x96\x4e\xf8\x6e";
+		const byte nonce[] = "\x23\xfe\x20\x9f\xac\x70\x45\xde";
+		const byte personalization[] = "\xf2\x25\xf4\xd9\x6b\x9c\xab\x49\x1e\xab\x18\x14\xb2\x5e\x78\xef";
+		const byte additional1[] = "\x57\x5b\x9a\x11\x32\x7a\xab\x89\x08\xfe\x46\x11\x9a\xed\x14\x5d";
+		const byte additional2[] = "\x5d\x19\xcd\xed\xb7\xe3\x44\x66\x8e\x11\x42\x96\xa0\x38\xb1\x7f";
+		const byte additional3[] = "\x2b\xaf\xa0\x15\xed\xdd\x5c\x76\x32\x75\x34\x35\xd1\x37\x72\xfb";
+
+		Hash_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8, personalization, 16);
+		drbg.IncorporateEntropy(entropy2, 16, additional1, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(additional2, 16, result, result.size());
+		drbg.GenerateBlock(additional3, 16, result, result.size());
+
+		const byte expected[] = "\x1D\x12\xEB\x6D\x42\x60\xBD\xFB\xA7\x99\xB8\x53\xCC\x6F\x19\xB1\x64\xFE\x2F\x55"
+			"\xBA\xA2\x1C\x89\xD4\xD0\xE9\xB4\xBA\xD4\xE5\xF8\xC5\x30\x06\x41\xBA\xC4\x3D\x2B"
+			"\x73\x91\x27\xE9\x31\xC0\x55\x55\x11\xE8\xB6\x57\x02\x0D\xCE\x90\xAC\x31\xB9\x00"
+			"\x31\xC1\xD4\x4F\xE7\x12\x3B\xCC\x85\x16\x2F\x12\x8F\xB2\xDF\x84\x4E\xF7\x06\xBE";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA1/128/440 (C0UNT=1, E=16, N=8, A=16, P=16)\n";
+	}
+
+	{
+		// [SHA-256], [PredictionResistance = False], [EntropyInputLen = 256], [NonceLen = 128]
+		// [PersonalizationStringLen = 256], [AdditionalInputLen = 256], [ReturnedBitsLen = 1024]
+		const byte entropy1[] = "\xf0\x5b\xab\x56\xc7\xac\x6e\xeb\x31\xa0\xcf\x8a\x8a\x06\x2a\x49\x17\x9a\xcf\x3c\x5b\x20\x4d\x60\xdd\x7a\x3e\xb7\x8f\x5d\x8e\x3b";
+		const byte entropy2[] = "\x72\xd4\x02\xa2\x59\x7b\x98\xa3\xb8\xf5\x0b\x71\x6c\x63\xc6\xdb\xa7\x3a\x07\xe6\x54\x89\x06\x3f\x02\xc5\x32\xf5\xda\xc4\xd4\x18";
+		const byte nonce[] = "\xa1\x45\x08\x53\x41\x68\xb6\x88\xf0\x5f\x1e\x41\x9c\x88\xcc\x30";
+		const byte personalization[] = "\xa0\x34\x72\xf4\x04\x59\xe2\x87\xea\xcb\x21\x32\xc0\xb6\x54\x02\x7d\xa3\xe6\x69\x25\xb4\x21\x25\x54\xc4\x48\x18\x8c\x0e\x86\x01";
+		const byte additional1[] = "\xb3\x0d\x28\xaf\xa4\x11\x6b\xbc\x13\x6e\x65\x09\xb5\x82\xa6\x93\xbc\x91\x71\x40\x46\xaa\x3c\x66\xb6\x77\xb3\xef\xf9\xad\xfd\x49";
+		const byte additional2[] = "\x77\xfd\x1d\x68\xd6\xa4\xdd\xd5\xf3\x27\x25\x2d\x3f\x6b\xdf\xee\x8c\x35\xce\xd3\x83\xbe\xaf\xc9\x32\x77\xef\xf2\x1b\x6f\xf4\x1b";
+		const byte additional3[] = "\x59\xa0\x1f\xf8\x6a\x58\x72\x1e\x85\xd2\xf8\x3f\x73\x99\xf1\x96\x4e\x27\xf8\x7f\xcd\x1b\xf5\xc1\xeb\xf3\x37\x10\x9b\x13\xbd\x24";
+
+		Hash_DRBG<SHA256, 128/8, 440/8> drbg(entropy1, 32, nonce, 16, personalization, 32);
+		drbg.IncorporateEntropy(entropy2, 32, additional1, 32);
+
+		SecByteBlock result(128);
+		drbg.GenerateBlock(additional2, 32, result, result.size());
+		drbg.GenerateBlock(additional3, 32, result, result.size());
+
+		const byte expected[] = "\xFF\x27\x96\x38\x5C\x32\xBF\x84\x3D\xFA\xBB\xF0\x3E\x70\x5A\x39\xCB\xA3\x4C\xF1"
+			"\x4F\xAE\xC3\x05\x63\xDF\x5A\xDD\xBD\x2D\x35\x83\xF5\x7E\x05\xF9\x40\x30\x56\x18"
+			"\xF2\x00\x88\x14\x03\xC2\xD9\x81\x36\x39\xE6\x67\x55\xDC\xFC\x4E\x88\xEA\x71\xDD"
+			"\xB2\x25\x2E\x09\x91\x49\x40\xEB\xE2\x3D\x63\x44\xA0\xF4\xDB\x5E\xE8\x39\xE6\x70"
+			"\xEC\x47\x24\x3F\xA0\xFC\xF5\x13\x61\xCE\x53\x98\xAA\xBF\xB4\x19\x1B\xFE\xD5\x00"
+			"\xE1\x03\x3A\x76\x54\xFF\xD7\x24\x70\x5E\x8C\xB2\x41\x7D\x92\x0A\x2F\x4F\x27\xB8"
+			"\x45\x13\x7F\xFB\x87\x90\xA9\x49";
+
+		fail = !!std::memcmp(result, expected, 1024/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA256/128/440 (C0UNT=0, E=32, N=16, A=32, P=32)\n";
+	}
+
+	{
+		// [SHA-256], [PredictionResistance = False], [EntropyInputLen = 256], [NonceLen = 128]
+		// [PersonalizationStringLen = 256], [AdditionalInputLen = 256], [ReturnedBitsLen = 1024]
+		const byte entropy1[] = "\xfe\x61\x50\x79\xf1\xad\x2a\x71\xea\x7f\x0f\x5a\x14\x34\xee\xc8\x46\x35\x54\x4a\x95\x6a\x4f\xbd\x64\xff\xba\xf6\x1d\x34\x61\x83";
+		const byte entropy2[] = "\x18\x89\x7b\xd8\x3e\xff\x38\xab\xb5\x6e\x82\xa8\x1b\x8c\x5e\x59\x3c\x3d\x85\x62\x2a\xe2\x88\xe5\xb2\xc6\xc5\xd2\xad\x7d\xc9\x45";
+		const byte nonce[] = "\x9d\xa7\x87\x56\xb7\x49\x17\x02\x4c\xd2\x00\x65\x11\x9b\xe8\x7e";
+		const byte personalization[] = "\x77\x5d\xbf\x32\xf3\x5c\xf3\x51\xf4\xb8\x1c\xd3\xfa\x7f\x65\x0b\xcf\x31\x88\xa1\x25\x57\x0c\xdd\xac\xaa\xfe\xa1\x7b\x3b\x29\xbc";
+		const byte additional1[] = "\xef\x96\xc7\x9c\xb1\x73\x1d\x82\x85\x0a\x6b\xca\x9b\x5c\x34\x39\xba\xd3\x4e\x4d\x82\x6f\x35\x9f\x61\x5c\xf6\xf2\xa3\x3e\x91\x05";
+		const byte additional2[] = "\xaf\x25\xc4\x6e\x21\xfc\xc3\xaf\x1f\xbb\xf8\x76\xb4\x57\xab\x1a\x94\x0a\x85\x16\x47\x81\xa4\xab\xda\xc8\xab\xca\xd0\x84\xda\xae";
+		const byte additional3[] = "\x59\x5b\x44\x94\x38\x86\x36\xff\x8e\x45\x1a\x0c\x42\xc8\xcc\x21\x06\x38\x3a\xc5\xa6\x30\x96\xb9\x14\x81\xb3\xa1\x2b\xc8\xcd\xf6";
+
+		Hash_DRBG<SHA256, 128/8, 440/8> drbg(entropy1, 32, nonce, 16, personalization, 32);
+		drbg.IncorporateEntropy(entropy2, 32, additional1, 32);
+
+		SecByteBlock result(128);
+		drbg.GenerateBlock(additional2, 32, result, result.size());
+		drbg.GenerateBlock(additional3, 32, result, result.size());
+
+		const byte expected[] = "\x8B\x1C\x9C\x76\xC4\x9B\x3B\xAE\xFD\x6E\xEB\x6C\xFF\xA3\xA1\x03\x3A\x8C\xAF\x09"
+			"\xFE\xBD\x44\x00\xFC\x0F\xD3\xA8\x26\x9C\xEE\x01\xAC\xE3\x73\x0E\xBE\xDA\x9A\xC6"
+			"\x23\x44\x6D\xA1\x56\x94\x29\xEC\x4B\xCD\x01\x84\x32\x25\xEF\x00\x91\x0B\xCC\xF3"
+			"\x06\x3B\x80\xF5\x46\xAC\xD2\xED\x5F\x70\x2B\x56\x2F\x21\x0A\xE9\x80\x87\x38\xAD"
+			"\xB0\x2A\xEB\x27\xF2\xD9\x20\x2A\x66\x0E\xF5\xC9\x20\x4A\xB4\x3C\xCE\xD6\x24\x97"
+			"\xDB\xB1\xED\x94\x12\x6A\x2F\x03\x98\x4A\xD4\xD1\x72\xF3\x7A\x66\x74\x7E\x2A\x5B"
+			"\xDE\xEF\x43\xBC\xB9\x8C\x49\x01";
+
+		fail = !!std::memcmp(result, expected, 1024/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA256/128/440 (C0UNT=1, E=32, N=16, A=32, P=32)\n";
+	}
+
+	{
+		// [SHA-512], [PredictionResistance = False], [EntropyInputLen = 256], [NonceLen = 128]
+		// [PersonalizationStringLen = 256], [AdditionalInputLen = 256], [ReturnedBitsLen = 2048]
+		const byte entropy1[] = "\x55\x4e\x8f\xfd\xc4\x9a\xd8\xf9\x9a\xe5\xd5\xf8\x1a\xf5\xda\xfb\x7f\x75\x53\xd7\xcb\x56\x8e\xa7\x3c\xc0\x82\xdd\x80\x76\x25\xc0";
+		const byte entropy2[] = "\x78\x07\x3e\x86\x79\x4b\x10\x95\x88\xf4\x22\xf9\xbd\x04\x7e\xc0\xce\xab\xd6\x78\x6b\xdf\xe2\x89\xb3\x16\x43\x9c\x32\x2d\xb2\x59";
+		const byte nonce[] = "\xf0\x89\x78\xde\x2d\xc2\xcd\xd9\xc0\xfd\x3d\x84\xd9\x8b\x8e\x8e";
+		const byte personalization[] = "\x3e\x52\x7a\xb5\x81\x2b\x0c\x0e\x98\x2a\x95\x78\x93\x98\xd9\xeb\xf1\xb9\xeb\xd6\x1d\x02\x05\xed\x42\x21\x2d\x24\xb8\x37\xf8\x41";
+		const byte additional1[] = "\xf2\x6b\xb1\xef\x30\xca\x8f\x97\xc0\x19\xd0\x79\xe5\xc6\x5e\xae\xd1\xa3\x9a\x52\xaf\x12\xe8\x28\xde\x03\x70\x79\x9a\x70\x11\x8b";
+		const byte additional2[] = "\xb0\x9d\xb5\xa8\x45\xec\x79\x7a\x4b\x60\x7e\xe4\xd5\x58\x56\x70\x35\x20\x9b\xd8\xe5\x01\x6c\x78\xff\x1f\x6b\x93\xbf\x7c\x34\xca";
+		const byte additional3[] = "\x45\x92\x2f\xb3\x5a\xd0\x6a\x84\x5f\xc9\xca\x16\x4a\x42\xbb\x59\x84\xb4\x38\x57\xa9\x16\x23\x48\xf0\x2f\x51\x61\x24\x35\xb8\x62";
+
+		Hash_DRBG<SHA512, 256/8, 888/8> drbg(entropy1, 32, nonce, 16, personalization, 32);
+		drbg.IncorporateEntropy(entropy2, 32, additional1, 32);
+
+		SecByteBlock result(256);
+		drbg.GenerateBlock(additional2, 32, result, result.size());
+		drbg.GenerateBlock(additional3, 32, result, result.size());
+
+		const byte expected[] = "\x1F\x20\x83\x9E\x22\x55\x3B\x1E\x6C\xD4\xF6\x3A\x47\xC3\x99\x54\x0F\x69\xA3\xBB"
+			"\x37\x47\xA0\x2A\x12\xAC\xC7\x00\x85\xC5\xCC\xF4\x7B\x12\x5A\x4A\xEA\xED\x2F\xE5"
+			"\x31\x51\x0D\xC1\x8E\x50\x29\xE2\xA6\xCB\x8F\x34\xBA\xDA\x8B\x47\x32\x33\x81\xF1"
+			"\x2D\xF6\x8B\x73\x8C\xFF\x15\xC8\x8E\x8C\x31\x48\xFA\xC3\xC4\x9F\x52\x81\x23\xC2"
+			"\x2A\x83\xBD\xF1\x44\xEF\x15\x49\x93\x44\x83\x6B\x37\x5D\xBB\xFF\x72\xD2\x86\x96"
+			"\x62\xF8\x4D\x12\x3B\x16\xCB\xAC\xA1\x00\x12\x1F\x94\xA8\xD5\xAE\x9A\x9E\xDA\xC8"
+			"\xD7\x6D\x59\x33\xFD\x55\xC9\xCC\x5B\xAD\x39\x73\xB5\x13\x8B\x96\xDF\xDB\xF5\x90"
+			"\x81\xDF\x68\x6A\x30\x72\x42\xF2\x74\xAE\x7F\x1F\x7F\xFE\x8B\x3D\x49\x38\x98\x34"
+			"\x7C\x63\x46\x6E\xAF\xFA\xCB\x06\x06\x08\xE6\xC8\x35\x3C\x68\xB8\xCC\x9D\x5C\xDF"
+			"\xDB\xC0\x41\x44\x48\xE6\x11\xD4\x78\x50\x81\x91\xED\x1D\x75\xF3\xBD\x79\xFF\x1E"
+			"\x37\xAF\xC6\x5D\x49\xD6\x5C\xAC\x5B\xCB\xD6\x91\x37\x51\xFA\x98\x70\xFC\x32\xB3"
+			"\xF2\x86\xE4\xED\x74\xF2\x5D\x8B\x6C\x4D\xB8\xDE\xD8\x4A\xD6\x5E\xD6\x6D\xAE\xB1"
+			"\x1B\xA2\x94\x52\x54\xAD\x3C\x3D\x25\xBD\x12\x46\x3C\xA0\x45\x9D";
+
+		fail = !!std::memcmp(result, expected, 2048/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA512/256/888 (C0UNT=0, E=32, N=16, A=32, P=32)\n";
+	}
+
+	{
+		// [SHA-512], [PredictionResistance = False], [EntropyInputLen = 256], [NonceLen = 128]
+		// [PersonalizationStringLen = 256], [AdditionalInputLen = 256], [ReturnedBitsLen = 2048]
+		const byte entropy1[] = "\x0c\x9f\xcd\x06\x21\x3c\xb2\xf6\x3c\xdf\x79\x76\x4b\x46\x74\xfc\xdf\x68\xb0\xff\xae\xc7\x21\x8a\xa2\xaf\x4e\x4c\xb9\xe6\x60\x78";
+		const byte entropy2[] = "\x75\xb8\x49\x54\xdf\x30\x10\x16\x2c\x06\x8c\x12\xeb\x6c\x1d\x03\x64\x5c\xad\x10\x5c\xc3\x17\x69\xb2\x5a\xc1\x7c\xb8\x33\x5b\x45";
+		const byte nonce[] = "\x43\x1c\x4d\x65\x93\x96\xad\xdc\xc1\x6d\x17\x9f\x7f\x57\x24\x4d";
+		const byte personalization[] = "\x7e\x54\xbd\x87\xd2\x0a\x95\xd7\xc4\x0c\x3b\x1b\x32\x15\x26\xd2\x06\x67\xa4\xac\xc1\xaa\xfb\x55\x91\x68\x2c\xb5\xc9\xcd\x66\x05";
+		const byte additional1[] = "\xd5\x74\x9e\x56\xfb\x5f\xf3\xf8\x2c\x73\x2b\x7a\x83\xe0\xde\x06\x85\x0b\xf0\x57\x50\xc8\x55\x60\x4a\x41\x4f\x86\xb1\x68\x14\x03";
+		const byte additional2[] = "\x9a\x83\xbb\x06\xdf\x4d\x53\x89\xf5\x3f\x24\xff\xf7\xcd\x0c\xcf\x4f\xbe\x46\x79\x8e\xce\x82\xa8\xc4\x6b\x5f\x8e\x58\x32\x62\x23";
+		const byte additional3[] = "\x48\x13\xc4\x95\x10\x99\xdd\x7f\xd4\x77\x3c\x9b\x8a\xa4\x1c\x3d\xb0\x93\x92\x50\xba\x23\x98\xef\x4b\x1b\xd2\x53\xc1\x61\xda\xc6";
+
+		Hash_DRBG<SHA512, 256/8, 888/8> drbg(entropy1, 32, nonce, 16, personalization, 32);
+		drbg.IncorporateEntropy(entropy2, 32, additional1, 32);
+
+		SecByteBlock result(256);
+		drbg.GenerateBlock(additional2, 32, result, result.size());
+		drbg.GenerateBlock(additional3, 32, result, result.size());
+
+		const byte expected[] = "\xE1\x7E\x4B\xEE\xD1\x65\x4F\xB2\xFC\xC8\xE8\xD7\xC6\x72\x7D\xD2\xE3\x15\x73\xC0"
+			"\x23\xC8\x55\x5D\x2B\xD8\x28\xD8\x31\xE4\xC9\x87\x42\x51\x87\x66\x43\x1F\x2C\xA4"
+			"\x73\xED\x4E\x50\x12\xC4\x50\x0E\x4C\xDD\x14\x73\xA2\xFB\xB3\x07\x0C\x66\x97\x4D"
+			"\x89\xDE\x35\x1C\x93\xE7\xE6\x8F\x20\x3D\x84\xE6\x73\x46\x0F\x7C\xF4\x3B\x6C\x02"
+			"\x23\x7C\x79\x6C\x86\xD9\x48\x80\x9C\x34\xCB\xA1\x23\xE7\xF7\x8A\x2E\x4B\x9D\x39"
+			"\xA5\x86\x1A\x73\x58\x28\x5A\x1D\x8D\x4A\xBD\x42\xD5\x49\x2B\xDF\x53\x1D\xE7\x4A"
+			"\x5F\x74\x09\x7F\xDC\x29\x7D\x58\x9C\x4B\xC5\x2F\x3B\x8F\xBF\x56\xCA\x48\x0A\x74"
+			"\xAE\xFF\xDD\x12\xE4\xF6\xAB\x83\x26\x4F\x52\x8A\x19\xBB\x91\x32\xA4\x42\xEC\x4F"
+			"\x3C\x76\xED\x9F\x03\xAA\x5E\x53\x79\x4C\xD0\x06\xD2\x1A\x42\x9D\xB1\xA7\xEC\xF7"
+			"\x5B\xD4\x03\x70\x1E\xF2\x47\x26\x48\xAC\x35\xEE\xD0\x58\x40\x94\x8C\x11\xD0\xEB"
+			"\x77\x39\x5A\xA3\xD5\xD0\xD3\xC3\x68\xE1\x75\xAA\xC0\x44\xEA\xD8\xDD\x13\x3F\xF9"
+			"\x7D\x21\x14\x34\xA5\x87\x43\xA4\x0A\x96\x77\x00\xCC\xCA\xB1\xDA\xC4\x39\xE0\x66"
+			"\x37\x05\x6E\xAC\xF2\xE6\xC6\xC5\x4F\x79\xD3\xE5\x6A\x3D\x36\x3F";
+
+		fail = !!std::memcmp(result, expected, 2048/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Hash_DRBG SHA512/256/888 (C0UNT=1, E=32, N=16, A=32, P=32)\n";
+	}
+
+	return pass;
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validat4.cpp b/runtime/third_party/cryptopp/validat4.cpp
new file mode 100644
index 0000000..3ca3c13
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat4.cpp
@@ -0,0 +1,1813 @@
+// validat4.cpp - originally written and placed in the public domain by Wei Dai
+//                CryptoPP::Test namespace added by JW in February 2017.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "hex.h"
+#include "base32.h"
+#include "base64.h"
+
+#include "rc2.h"
+#include "aes.h"
+#include "des.h"
+#include "rc5.h"
+#include "rc6.h"
+#include "3way.h"
+#include "aria.h"
+#include "cast.h"
+#include "mars.h"
+#include "idea.h"
+#include "gost.h"
+#include "seal.h"
+#include "seed.h"
+#include "safer.h"
+#include "shark.h"
+#include "square.h"
+#include "serpent.h"
+#include "shacal2.h"
+#include "twofish.h"
+#include "blowfish.h"
+#include "camellia.h"
+#include "skipjack.h"
+
+#include "arc4.h"
+#include "salsa.h"
+#include "chacha.h"
+#include "rabbit.h"
+#include "sosemanuk.h"
+
+#include "modes.h"
+#include "cmac.h"
+#include "dmac.h"
+#include "hmac.h"
+#include "vmac.h"
+#include "ttmac.h"
+
+#include "drbg.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+
+bool ValidateHmacDRBG()
+{
+	std::cout << "\nTesting NIST HMAC DRBGs...\n\n";
+	bool pass=true, fail;
+
+	// # CAVS 14.3
+	// # DRBG800-90A information for "drbg_pr"
+	// # Generated on Tue Apr 02 15:32:12 2013
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 0], [AdditionalInputLen = 0], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x79\x34\x9b\xbf\x7c\xdd\xa5\x79\x95\x57\x86\x66\x21\xc9\x13\x83";
+		const byte entropy2[] = "\xc7\x21\x5b\x5b\x96\xc4\x8e\x9b\x33\x8c\x74\xe3\xe9\x9d\xfe\xdf";
+		const byte nonce[] = "\x11\x46\x73\x3a\xbf\x8c\x35\xc8";
+
+		HMAC_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8);
+		drbg.IncorporateEntropy(entropy2, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(result, result.size());
+		drbg.GenerateBlock(result, result.size());
+
+		const byte expected[] = "\xc6\xa1\x6a\xb8\xd4\x20\x70\x6f\x0f\x34\xab\x7f\xec\x5a\xdc\xa9\xd8\xca\x3a\x13"
+			"\x3e\x15\x9c\xa6\xac\x43\xc6\xf8\xa2\xbe\x22\x83\x4a\x4c\x0a\x0a\xff\xb1\x0d\x71"
+			"\x94\xf1\xc1\xa5\xcf\x73\x22\xec\x1a\xe0\x96\x4e\xd4\xbf\x12\x27\x46\xe0\x87\xfd"
+			"\xb5\xb3\xe9\x1b\x34\x93\xd5\xbb\x98\xfa\xed\x49\xe8\x5f\x13\x0f\xc8\xa4\x59\xb7";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "HMAC_DRBG SHA1/128/440 (COUNT=0, E=16, N=8)\n";
+	}
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 0], [AdditionalInputLen = 0], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\xee\x57\xfc\x23\x60\x0f\xb9\x02\x9a\x9e\xc6\xc8\x2e\x7b\x51\xe4";
+		const byte entropy2[] = "\x84\x1d\x27\x6c\xa9\x51\x90\x61\xd9\x2d\x7d\xdf\xa6\x62\x8c\xa3";
+		const byte nonce[] = "\x3e\x97\x21\xe4\x39\x3e\xf9\xad";
+
+		HMAC_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8);
+		drbg.IncorporateEntropy(entropy2, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(result, result.size());
+		drbg.GenerateBlock(result, result.size());
+
+		const byte expected[] = "\xee\x26\xa5\xc8\xef\x08\xa1\xca\x8f\x14\x15\x4d\x67\xc8\x8f\x5e\x7e\xd8\x21\x9d"
+			"\x93\x1b\x98\x42\xac\x00\x39\xf2\x14\x55\x39\xf2\x14\x2b\x44\x11\x7a\x99\x8c\x22"
+			"\xf5\x90\xf6\xc9\xb3\x8b\x46\x5b\x78\x3e\xcf\xf1\x3a\x77\x50\x20\x1f\x7e\xcf\x1b"
+			"\x8a\xb3\x93\x60\x4c\x73\xb2\x38\x93\x36\x60\x9a\xf3\x44\x0c\xde\x43\x29\x8b\x84";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "HMAC_DRBG SHA1/128/440 (COUNT=1, E=16, N=8)\n";
+	}
+
+	// *****************************************************
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 0], [AdditionalInputLen = 16], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x7d\x70\x52\xa7\x76\xfd\x2f\xb3\xd7\x19\x1f\x73\x33\x04\xee\x8b";
+		const byte entropy2[] = "\x49\x04\x7e\x87\x9d\x61\x09\x55\xee\xd9\x16\xe4\x06\x0e\x00\xc9";
+		const byte nonce[] = "\xbe\x4a\x0c\xee\xdc\xa8\x02\x07";
+		const byte additional1[] = "\xfd\x8b\xb3\x3a\xab\x2f\x6c\xdf\xbc\x54\x18\x11\x86\x1d\x51\x8d";
+		const byte additional2[] = "\x99\xaf\xe3\x47\x54\x04\x61\xdd\xf6\xab\xeb\x49\x1e\x07\x15\xb4";
+		const byte additional3[] = "\x02\xf7\x73\x48\x2d\xd7\xae\x66\xf7\x6e\x38\x15\x98\xa6\x4e\xf0";
+
+		HMAC_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8);
+		drbg.IncorporateEntropy(entropy2, 16, additional1, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(additional2, 16, result, result.size());
+		drbg.GenerateBlock(additional3, 16, result, result.size());
+
+		const byte expected[] = "\xa7\x36\x34\x38\x44\xfc\x92\x51\x13\x91\xdb\x0a\xdd\xd9\x06\x4d\xbe\xe2\x4c\x89"
+			"\x76\xaa\x25\x9a\x9e\x3b\x63\x68\xaa\x6d\xe4\xc9\xbf\x3a\x0e\xff\xcd\xa9\xcb\x0e"
+			"\x9d\xc3\x36\x52\xab\x58\xec\xb7\x65\x0e\xd8\x04\x67\xf7\x6a\x84\x9f\xb1\xcf\xc1"
+			"\xed\x0a\x09\xf7\x15\x50\x86\x06\x4d\xb3\x24\xb1\xe1\x24\xf3\xfc\x9e\x61\x4f\xcb";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "HMAC_DRBG SHA1/128/440 (COUNT=0, E=16, N=8, A=16)\n";
+	}
+
+	{
+		// [SHA-1], [PredictionResistance = False], [EntropyInputLen = 128], [NonceLen = 64]
+		// [PersonalizationStringLen = 0], [AdditionalInputLen = 16], [ReturnedBitsLen = 640]
+		const byte entropy1[] = "\x29\xc6\x2a\xfa\x3c\x52\x20\x8a\x3f\xde\xcb\x43\xfa\x61\x3f\x15";
+		const byte entropy2[] = "\xbd\x87\xbe\x99\xd1\x84\x16\x54\x12\x31\x41\x40\xd4\x02\x71\x41";
+		const byte nonce[] = "\x6c\x9e\xb5\x9a\xc3\xc2\xd4\x8b";
+		const byte additional1[] = "\x43\x3d\xda\xf2\x59\xd1\x4b\xcf\x89\x76\x30\xcc\xaa\x27\x33\x8c";
+		const byte additional2[] = "\x14\x11\x46\xd4\x04\xf2\x84\xc2\xd0\x2b\x6a\x10\x15\x6e\x33\x82";
+		const byte additional3[] = "\xed\xc3\x43\xdb\xff\xe7\x1a\xb4\x11\x4a\xc3\x63\x9d\x44\x5b\x65";
+
+		HMAC_DRBG<SHA1, 128/8, 440/8> drbg(entropy1, 16, nonce, 8);
+		drbg.IncorporateEntropy(entropy2, 16, additional1, 16);
+
+		SecByteBlock result(80);
+		drbg.GenerateBlock(additional2, 16, result, result.size());
+		drbg.GenerateBlock(additional3, 16, result, result.size());
+
+		const byte expected[] = "\x8c\x73\x0f\x05\x26\x69\x4d\x5a\x9a\x45\xdb\xab\x05\x7a\x19\x75\x35\x7d\x65\xaf"
+			"\xd3\xef\xf3\x03\x32\x0b\xd1\x40\x61\xf9\xad\x38\x75\x91\x02\xb6\xc6\x01\x16\xf6"
+			"\xdb\x7a\x6e\x8e\x7a\xb9\x4c\x05\x50\x0b\x4d\x1e\x35\x7d\xf8\xe9\x57\xac\x89\x37"
+			"\xb0\x5f\xb3\xd0\x80\xa0\xf9\x06\x74\xd4\x4d\xe1\xbd\x6f\x94\xd2\x95\xc4\x51\x9d";
+
+		fail = !!std::memcmp(result, expected, 640/8);
+		pass = !fail && pass;
+
+		std::cout << (fail ? "FAILED   " : "passed   ") << "HMAC_DRBG SHA1/128/440 (COUNT=1, E=16, N=8, A=16)\n";
+	}
+
+	return pass;
+}
+
+class CipherFactory
+{
+public:
+	virtual unsigned int BlockSize() const =0;
+	virtual unsigned int KeyLength() const =0;
+
+	virtual BlockTransformation* NewEncryption(const byte *keyStr) const =0;
+	virtual BlockTransformation* NewDecryption(const byte *keyStr) const =0;
+};
+
+template <class E, class D> class FixedRoundsCipherFactory : public CipherFactory
+{
+public:
+	FixedRoundsCipherFactory(unsigned int keylen=0) :
+		m_keylen(keylen ? keylen : static_cast<unsigned int>(E::DEFAULT_KEYLENGTH)) {}
+
+	unsigned int BlockSize() const {return E::BLOCKSIZE;}
+	unsigned int KeyLength() const {return m_keylen;}
+
+	BlockTransformation* NewEncryption(const byte *keyStr) const
+		{return new E(keyStr, m_keylen);}
+	BlockTransformation* NewDecryption(const byte *keyStr) const
+		{return new D(keyStr, m_keylen);}
+
+	unsigned int m_keylen;
+};
+
+template <class E, class D> class VariableRoundsCipherFactory : public CipherFactory
+{
+public:
+	VariableRoundsCipherFactory(unsigned int keylen=0, unsigned int rounds=0) :
+		m_keylen(keylen ? keylen : static_cast<unsigned int>(E::DEFAULT_KEYLENGTH)),
+		m_rounds(rounds ? rounds : static_cast<unsigned int>(E::DEFAULT_ROUNDS)) {}
+
+	unsigned int BlockSize() const {return static_cast<unsigned int>(E::BLOCKSIZE);}
+	unsigned int KeyLength() const {return m_keylen;}
+
+	BlockTransformation* NewEncryption(const byte *keyStr) const
+		{return new E(keyStr, m_keylen, m_rounds);}
+	BlockTransformation* NewDecryption(const byte *keyStr) const
+		{return new D(keyStr, m_keylen, m_rounds);}
+
+	unsigned int m_keylen, m_rounds;
+};
+
+bool BlockTransformationTest(const CipherFactory &cg, BufferedTransformation &valdata, unsigned int tuples = 0xffff)
+{
+	HexEncoder output(new FileSink(std::cout));
+	SecByteBlock plain(cg.BlockSize()), cipher(cg.BlockSize()), out(cg.BlockSize()), outplain(cg.BlockSize());
+	SecByteBlock key(cg.KeyLength());
+	bool pass=true, fail;
+
+	while (valdata.MaxRetrievable() && tuples--)
+	{
+		(void)valdata.Get(key, cg.KeyLength());
+		(void)valdata.Get(plain, cg.BlockSize());
+		(void)valdata.Get(cipher, cg.BlockSize());
+
+		member_ptr<BlockTransformation> transE(cg.NewEncryption(key));
+		transE->ProcessBlock(plain, out);
+		fail = std::memcmp(out, cipher, cg.BlockSize()) != 0;
+
+		member_ptr<BlockTransformation> transD(cg.NewDecryption(key));
+		transD->ProcessBlock(out, outplain);
+		fail=fail || std::memcmp(outplain, plain, cg.BlockSize());
+
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED   " : "passed   ");
+		output.Put(key, cg.KeyLength());
+		std::cout << "   ";
+		output.Put(outplain, cg.BlockSize());
+		std::cout << "   ";
+		output.Put(out, cg.BlockSize());
+		std::cout << std::endl;
+	}
+	return pass;
+}
+
+class FilterTester : public Unflushable<Sink>
+{
+public:
+	FilterTester(const byte *validOutput, size_t outputLen)
+		: validOutput(validOutput), outputLen(outputLen), counter(0), fail(false) {}
+	void PutByte(byte inByte)
+	{
+		if (counter >= outputLen || validOutput[counter] != inByte)
+		{
+			std::cerr << "incorrect output " << counter << ", " << (word16)validOutput[counter] << ", " << (word16)inByte << "\n";
+			fail = true;
+			CRYPTOPP_ASSERT(false);
+		}
+		counter++;
+	}
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+	{
+		CRYPTOPP_UNUSED(messageEnd), CRYPTOPP_UNUSED(blocking);
+
+		while (length--)
+			FilterTester::PutByte(*inString++);
+
+		if (messageEnd)
+			if (counter != outputLen)
+			{
+				fail = true;
+				CRYPTOPP_ASSERT(false);
+			}
+
+		return 0;
+	}
+	bool GetResult()
+	{
+		return !fail;
+	}
+
+	const byte *validOutput;
+	size_t outputLen, counter;
+	bool fail;
+};
+
+bool TestFilter(BufferedTransformation &bt, const byte *in, size_t inLen, const byte *out, size_t outLen)
+{
+	FilterTester *ft;
+	bt.Attach(ft = new FilterTester(out, outLen));
+
+	while (inLen)
+	{
+		size_t randomLen = GlobalRNG().GenerateWord32(0, (word32)inLen);
+		bt.Put(in, randomLen);
+		in += randomLen;
+		inLen -= randomLen;
+	}
+	bt.MessageEnd();
+	return ft->GetResult();
+}
+
+bool ValidateDES()
+{
+	std::cout << "\nDES validation suite running...\n\n";
+
+	FileSource valdata(DataDir("TestData/descert.dat").c_str(), true, new HexDecoder);
+	bool pass = BlockTransformationTest(FixedRoundsCipherFactory<DESEncryption, DESDecryption>(), valdata);
+
+	std::cout << "\nTesting EDE2, EDE3, and XEX3 variants...\n\n";
+
+	FileSource valdata1(DataDir("TestData/3desval.dat").c_str(), true, new HexDecoder);
+	pass = BlockTransformationTest(FixedRoundsCipherFactory<DES_EDE2_Encryption, DES_EDE2_Decryption>(), valdata1, 1) && pass;
+	pass = BlockTransformationTest(FixedRoundsCipherFactory<DES_EDE3_Encryption, DES_EDE3_Decryption>(), valdata1, 1) && pass;
+	pass = BlockTransformationTest(FixedRoundsCipherFactory<DES_XEX3_Encryption, DES_XEX3_Decryption>(), valdata1, 1) && pass;
+
+	return pass;
+}
+
+bool TestModeIV(SymmetricCipher &e, SymmetricCipher &d)
+{
+	SecByteBlock lastIV, iv(e.IVSize());
+	StreamTransformationFilter filter(e, new StreamTransformationFilter(d));
+
+	// Enterprise Analysis finding on the stack based array
+	const int BUF_SIZE=20480U;
+	AlignedSecByteBlock plaintext(BUF_SIZE);
+
+	for (unsigned int i=1; i<BUF_SIZE; i*=2)
+	{
+		e.GetNextIV(GlobalRNG(), iv);
+		if (iv == lastIV)
+			return false;
+		else
+			lastIV = iv;
+
+		e.Resynchronize(iv);
+		d.Resynchronize(iv);
+
+		unsigned int length = STDMAX(GlobalRNG().GenerateWord32(0, i), (word32)e.MinLastBlockSize());
+		GlobalRNG().GenerateBlock(plaintext, length);
+
+		if (!TestFilter(filter, plaintext, length, plaintext, length))
+			return false;
+	}
+
+	return true;
+}
+
+bool ValidateCipherModes()
+{
+	std::cout << "\nTesting DES modes...\n\n";
+	const byte key[] = {0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
+	const byte iv[] = {0x12,0x34,0x56,0x78,0x90,0xab,0xcd,0xef};
+	const byte plain[] = {	// "Now is the time for all " without tailing 0
+		0x4e,0x6f,0x77,0x20,0x69,0x73,0x20,0x74,
+		0x68,0x65,0x20,0x74,0x69,0x6d,0x65,0x20,
+		0x66,0x6f,0x72,0x20,0x61,0x6c,0x6c,0x20};
+	DESEncryption desE(key);
+	DESDecryption desD(key);
+	bool pass=true, fail;
+
+	{
+		// from FIPS 81
+		const byte encrypted[] = {
+			0x3f, 0xa4, 0x0e, 0x8a, 0x98, 0x4d, 0x48, 0x15,
+			0x6a, 0x27, 0x17, 0x87, 0xab, 0x88, 0x83, 0xf9,
+			0x89, 0x3d, 0x51, 0xec, 0x4b, 0x56, 0x3b, 0x53};
+
+		ECB_Mode_ExternalCipher::Encryption modeE(desE);
+		fail = !TestFilter(StreamTransformationFilter(modeE, NULLPTR, StreamTransformationFilter::NO_PADDING).Ref(),
+			plain, sizeof(plain), encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "ECB encryption" << std::endl;
+
+		ECB_Mode_ExternalCipher::Decryption modeD(desD);
+		fail = !TestFilter(StreamTransformationFilter(modeD, NULLPTR, StreamTransformationFilter::NO_PADDING).Ref(),
+			encrypted, sizeof(encrypted), plain, sizeof(plain));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "ECB decryption" << std::endl;
+	}
+	{
+		// from FIPS 81
+		const byte encrypted[] = {
+			0xE5, 0xC7, 0xCD, 0xDE, 0x87, 0x2B, 0xF2, 0x7C,
+			0x43, 0xE9, 0x34, 0x00, 0x8C, 0x38, 0x9C, 0x0F,
+			0x68, 0x37, 0x88, 0x49, 0x9A, 0x7C, 0x05, 0xF6};
+
+		CBC_Mode_ExternalCipher::Encryption modeE(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeE, NULLPTR, StreamTransformationFilter::NO_PADDING).Ref(),
+			plain, sizeof(plain), encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC encryption with no padding" << std::endl;
+
+		CBC_Mode_ExternalCipher::Decryption modeD(desD, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeD, NULLPTR, StreamTransformationFilter::NO_PADDING).Ref(),
+			encrypted, sizeof(encrypted), plain, sizeof(plain));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC decryption with no padding" << std::endl;
+
+		fail = !TestModeIV(modeE, modeD);
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC mode IV generation" << std::endl;
+	}
+	{
+		// generated with Crypto++, matches FIPS 81
+		// but has extra 8 bytes as result of padding
+		const byte encrypted[] = {
+			0xE5, 0xC7, 0xCD, 0xDE, 0x87, 0x2B, 0xF2, 0x7C,
+			0x43, 0xE9, 0x34, 0x00, 0x8C, 0x38, 0x9C, 0x0F,
+			0x68, 0x37, 0x88, 0x49, 0x9A, 0x7C, 0x05, 0xF6,
+			0x62, 0xC1, 0x6A, 0x27, 0xE4, 0xFC, 0xF2, 0x77};
+
+		CBC_Mode_ExternalCipher::Encryption modeE(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeE).Ref(),
+			plain, sizeof(plain), encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC encryption with PKCS #7 padding" << std::endl;
+
+		CBC_Mode_ExternalCipher::Decryption modeD(desD, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeD).Ref(),
+			encrypted, sizeof(encrypted), plain, sizeof(plain));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC decryption with PKCS #7 padding" << std::endl;
+	}
+	{
+		// generated with Crypto++ 5.2, matches FIPS 81
+		// but has extra 8 bytes as result of padding
+		const byte encrypted[] = {
+			0xE5, 0xC7, 0xCD, 0xDE, 0x87, 0x2B, 0xF2, 0x7C,
+			0x43, 0xE9, 0x34, 0x00, 0x8C, 0x38, 0x9C, 0x0F,
+			0x68, 0x37, 0x88, 0x49, 0x9A, 0x7C, 0x05, 0xF6,
+			0xcf, 0xb7, 0xc7, 0x64, 0x0e, 0x7c, 0xd9, 0xa7};
+
+		CBC_Mode_ExternalCipher::Encryption modeE(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeE, NULLPTR, StreamTransformationFilter::ONE_AND_ZEROS_PADDING).Ref(),
+			plain, sizeof(plain), encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC encryption with one-and-zeros padding" << std::endl;
+
+		CBC_Mode_ExternalCipher::Decryption modeD(desD, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeD, NULLPTR, StreamTransformationFilter::ONE_AND_ZEROS_PADDING).Ref(),
+			encrypted, sizeof(encrypted), plain, sizeof(plain));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC decryption with one-and-zeros padding" << std::endl;
+	}
+	{
+		const byte plain_1[] = {'a', 0, 0, 0, 0, 0, 0, 0};
+		// generated with Crypto++
+		const byte encrypted[] = {
+			0x9B, 0x47, 0x57, 0x59, 0xD6, 0x9C, 0xF6, 0xD0};
+
+		CBC_Mode_ExternalCipher::Encryption modeE(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeE, NULLPTR, StreamTransformationFilter::ZEROS_PADDING).Ref(),
+			plain_1, 1, encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC encryption with zeros padding" << std::endl;
+
+		CBC_Mode_ExternalCipher::Decryption modeD(desD, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeD, NULLPTR, StreamTransformationFilter::ZEROS_PADDING).Ref(),
+			encrypted, sizeof(encrypted), plain_1, sizeof(plain_1));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC decryption with zeros padding" << std::endl;
+	}
+	{
+		// generated with Crypto++, matches FIPS 81
+		// but with last two blocks swapped as result of CTS
+		const byte encrypted[] = {
+			0xE5, 0xC7, 0xCD, 0xDE, 0x87, 0x2B, 0xF2, 0x7C,
+			0x68, 0x37, 0x88, 0x49, 0x9A, 0x7C, 0x05, 0xF6,
+			0x43, 0xE9, 0x34, 0x00, 0x8C, 0x38, 0x9C, 0x0F};
+
+		CBC_CTS_Mode_ExternalCipher::Encryption modeE(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeE).Ref(),
+			plain, sizeof(plain), encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC encryption with ciphertext stealing (CTS)" << std::endl;
+
+		CBC_CTS_Mode_ExternalCipher::Decryption modeD(desD, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeD).Ref(),
+			encrypted, sizeof(encrypted), plain, sizeof(plain));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC decryption with ciphertext stealing (CTS)" << std::endl;
+
+		fail = !TestModeIV(modeE, modeD);
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC CTS IV generation" << std::endl;
+	}
+	{
+		// generated with Crypto++
+		const byte decryptionIV[] = {0x4D, 0xD0, 0xAC, 0x8F, 0x47, 0xCF, 0x79, 0xCE};
+		const byte encrypted[] = {0x12, 0x34, 0x56};
+
+		byte stolenIV[8];
+
+		CBC_CTS_Mode_ExternalCipher::Encryption modeE(desE, iv);
+		modeE.SetStolenIV(stolenIV);
+		fail = !TestFilter(StreamTransformationFilter(modeE).Ref(),
+			plain, 3, encrypted, sizeof(encrypted));
+		fail = std::memcmp(stolenIV, decryptionIV, 8) != 0 || fail;
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC encryption with ciphertext and IV stealing" << std::endl;
+
+		CBC_CTS_Mode_ExternalCipher::Decryption modeD(desD, stolenIV);
+		fail = !TestFilter(StreamTransformationFilter(modeD).Ref(),
+			encrypted, sizeof(encrypted), plain, 3);
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC decryption with ciphertext and IV stealing" << std::endl;
+	}
+	{
+		const byte encrypted[] = {	// from FIPS 81
+			0xF3,0x09,0x62,0x49,0xC7,0xF4,0x6E,0x51,
+			0xA6,0x9E,0x83,0x9B,0x1A,0x92,0xF7,0x84,
+			0x03,0x46,0x71,0x33,0x89,0x8E,0xA6,0x22};
+
+		CFB_Mode_ExternalCipher::Encryption modeE(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeE).Ref(),
+			plain, sizeof(plain), encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CFB encryption" << std::endl;
+
+		CFB_Mode_ExternalCipher::Decryption modeD(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeD).Ref(),
+			encrypted, sizeof(encrypted), plain, sizeof(plain));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CFB decryption" << std::endl;
+
+		fail = !TestModeIV(modeE, modeD);
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CFB mode IV generation" << std::endl;
+	}
+	{
+		const byte plain_2[] = {	// "Now is the." without tailing 0
+			0x4e,0x6f,0x77,0x20,0x69,0x73,0x20,0x74,0x68,0x65};
+		const byte encrypted[] = {	// from FIPS 81
+			0xf3,0x1f,0xda,0x07,0x01,0x14,0x62,0xee,0x18,0x7f};
+
+		CFB_Mode_ExternalCipher::Encryption modeE(desE, iv, 1);
+		fail = !TestFilter(StreamTransformationFilter(modeE).Ref(),
+			plain_2, sizeof(plain_2), encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CFB (8-bit feedback) encryption" << std::endl;
+
+		CFB_Mode_ExternalCipher::Decryption modeD(desE, iv, 1);
+		fail = !TestFilter(StreamTransformationFilter(modeD).Ref(),
+			encrypted, sizeof(encrypted), plain_2, sizeof(plain_2));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CFB (8-bit feedback) decryption" << std::endl;
+
+		fail = !TestModeIV(modeE, modeD);
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CFB (8-bit feedback) IV generation" << std::endl;
+	}
+	{
+		const byte encrypted[] = {	// from Eric Young's libdes
+			0xf3,0x09,0x62,0x49,0xc7,0xf4,0x6e,0x51,
+			0x35,0xf2,0x4a,0x24,0x2e,0xeb,0x3d,0x3f,
+			0x3d,0x6d,0x5b,0xe3,0x25,0x5a,0xf8,0xc3};
+
+		OFB_Mode_ExternalCipher::Encryption modeE(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeE).Ref(),
+			plain, sizeof(plain), encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "OFB encryption" << std::endl;
+
+		OFB_Mode_ExternalCipher::Decryption modeD(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeD).Ref(),
+			encrypted, sizeof(encrypted), plain, sizeof(plain));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "OFB decryption" << std::endl;
+
+		fail = !TestModeIV(modeE, modeD);
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "OFB IV generation" << std::endl;
+	}
+	{
+		const byte encrypted[] = {	// generated with Crypto++
+			0xF3, 0x09, 0x62, 0x49, 0xC7, 0xF4, 0x6E, 0x51,
+			0x16, 0x3A, 0x8C, 0xA0, 0xFF, 0xC9, 0x4C, 0x27,
+			0xFA, 0x2F, 0x80, 0xF4, 0x80, 0xB8, 0x6F, 0x75};
+
+		CTR_Mode_ExternalCipher::Encryption modeE(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeE).Ref(),
+			plain, sizeof(plain), encrypted, sizeof(encrypted));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Counter Mode encryption" << std::endl;
+
+		CTR_Mode_ExternalCipher::Decryption modeD(desE, iv);
+		fail = !TestFilter(StreamTransformationFilter(modeD).Ref(),
+			encrypted, sizeof(encrypted), plain, sizeof(plain));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Counter Mode decryption" << std::endl;
+
+		fail = !TestModeIV(modeE, modeD);
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "Counter Mode IV generation" << std::endl;
+	}
+	{
+		const byte plain_3[] = {	// "7654321 Now is the time for "
+			0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x20,
+			0x4e, 0x6f, 0x77, 0x20, 0x69, 0x73, 0x20, 0x74,
+			0x68, 0x65, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x20,
+			0x66, 0x6f, 0x72, 0x20};
+		const byte mac1[] = {	// from FIPS 113
+			0xf1, 0xd3, 0x0f, 0x68, 0x49, 0x31, 0x2c, 0xa4};
+		const byte mac2[] = {	// generated with Crypto++
+			0x35, 0x80, 0xC5, 0xC4, 0x6B, 0x81, 0x24, 0xE2};
+
+		CBC_MAC<DES> cbcmac(key);
+		HashFilter cbcmacFilter(cbcmac);
+		fail = !TestFilter(cbcmacFilter, plain_3, sizeof(plain_3), mac1, sizeof(mac1));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "CBC MAC" << std::endl;
+
+		DMAC<DES> dmac(key);
+		HashFilter dmacFilter(dmac);
+		fail = !TestFilter(dmacFilter, plain_3, sizeof(plain_3), mac2, sizeof(mac2));
+		pass = pass && !fail;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "DMAC" << std::endl;
+	}
+
+	return pass;
+}
+
+bool ValidateIDEA()
+{
+	std::cout << "\nIDEA validation suite running...\n\n";
+
+	FileSource valdata(DataDir("TestData/ideaval.dat").c_str(), true, new HexDecoder);
+	return BlockTransformationTest(FixedRoundsCipherFactory<IDEAEncryption, IDEADecryption>(), valdata);
+}
+
+bool ValidateSAFER()
+{
+	std::cout << "\nSAFER validation suite running...\n\n";
+
+	FileSource valdata(DataDir("TestData/saferval.dat").c_str(), true, new HexDecoder);
+	bool pass = true;
+	pass = BlockTransformationTest(VariableRoundsCipherFactory<SAFER_K_Encryption, SAFER_K_Decryption>(8,6), valdata, 4) && pass;
+	pass = BlockTransformationTest(VariableRoundsCipherFactory<SAFER_K_Encryption, SAFER_K_Decryption>(16,12), valdata, 4) && pass;
+	pass = BlockTransformationTest(VariableRoundsCipherFactory<SAFER_SK_Encryption, SAFER_SK_Decryption>(8,6), valdata, 4) && pass;
+	pass = BlockTransformationTest(VariableRoundsCipherFactory<SAFER_SK_Encryption, SAFER_SK_Decryption>(16,10), valdata, 4) && pass;
+	return pass;
+}
+
+bool ValidateRC2()
+{
+	std::cout << "\nRC2 validation suite running...\n\n";
+
+	FileSource valdata(DataDir("TestData/rc2val.dat").c_str(), true, new HexDecoder);
+	HexEncoder output(new FileSink(std::cout));
+	SecByteBlock plain(RC2Encryption::BLOCKSIZE), cipher(RC2Encryption::BLOCKSIZE), out(RC2Encryption::BLOCKSIZE), outplain(RC2Encryption::BLOCKSIZE);
+	SecByteBlock key(128);
+	bool pass=true, fail;
+
+	while (valdata.MaxRetrievable())
+	{
+		byte keyLen, effectiveLen;
+
+		(void)valdata.Get(keyLen);
+		(void)valdata.Get(effectiveLen);
+		(void)valdata.Get(key, keyLen);
+		(void)valdata.Get(plain, RC2Encryption::BLOCKSIZE);
+		(void)valdata.Get(cipher, RC2Encryption::BLOCKSIZE);
+
+		member_ptr<BlockTransformation> transE(new RC2Encryption(key, keyLen, effectiveLen));
+		transE->ProcessBlock(plain, out);
+		fail = std::memcmp(out, cipher, RC2Encryption::BLOCKSIZE) != 0;
+
+		member_ptr<BlockTransformation> transD(new RC2Decryption(key, keyLen, effectiveLen));
+		transD->ProcessBlock(out, outplain);
+		fail=fail || std::memcmp(outplain, plain, RC2Encryption::BLOCKSIZE);
+
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED   " : "passed   ");
+		output.Put(key, keyLen);
+		std::cout << "   ";
+		output.Put(outplain, RC2Encryption::BLOCKSIZE);
+		std::cout << "   ";
+		output.Put(out, RC2Encryption::BLOCKSIZE);
+		std::cout << std::endl;
+	}
+	return pass;
+}
+
+bool ValidateARC4()
+{
+	unsigned char Key0[] = {0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef };
+	unsigned char Input0[]={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
+	unsigned char Output0[] = {0x75,0xb7,0x87,0x80,0x99,0xe0,0xc5,0x96};
+
+	unsigned char Key1[]={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
+	unsigned char Input1[]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	unsigned char Output1[]={0x74,0x94,0xc2,0xe7,0x10,0x4b,0x08,0x79};
+
+	unsigned char Key2[]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	unsigned char Input2[]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	unsigned char Output2[]={0xde,0x18,0x89,0x41,0xa3,0x37,0x5d,0x3a};
+
+	unsigned char Key3[]={0xef,0x01,0x23,0x45};
+	unsigned char Input3[]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	unsigned char Output3[]={0xd6,0xa1,0x41,0xa7,0xec,0x3c,0x38,0xdf,0xbd,0x61};
+
+	unsigned char Key4[]={ 0x01,0x23,0x45,0x67,0x89,0xab, 0xcd,0xef };
+	unsigned char Input4[] =
+	{0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
+	0x01};
+	unsigned char Output4[]= {
+	0x75,0x95,0xc3,0xe6,0x11,0x4a,0x09,0x78,0x0c,0x4a,0xd4,
+	0x52,0x33,0x8e,0x1f,0xfd,0x9a,0x1b,0xe9,0x49,0x8f,
+	0x81,0x3d,0x76,0x53,0x34,0x49,0xb6,0x77,0x8d,0xca,
+	0xd8,0xc7,0x8a,0x8d,0x2b,0xa9,0xac,0x66,0x08,0x5d,
+	0x0e,0x53,0xd5,0x9c,0x26,0xc2,0xd1,0xc4,0x90,0xc1,
+	0xeb,0xbe,0x0c,0xe6,0x6d,0x1b,0x6b,0x1b,0x13,0xb6,
+	0xb9,0x19,0xb8,0x47,0xc2,0x5a,0x91,0x44,0x7a,0x95,
+	0xe7,0x5e,0x4e,0xf1,0x67,0x79,0xcd,0xe8,0xbf,0x0a,
+	0x95,0x85,0x0e,0x32,0xaf,0x96,0x89,0x44,0x4f,0xd3,
+	0x77,0x10,0x8f,0x98,0xfd,0xcb,0xd4,0xe7,0x26,0x56,
+	0x75,0x00,0x99,0x0b,0xcc,0x7e,0x0c,0xa3,0xc4,0xaa,
+	0xa3,0x04,0xa3,0x87,0xd2,0x0f,0x3b,0x8f,0xbb,0xcd,
+	0x42,0xa1,0xbd,0x31,0x1d,0x7a,0x43,0x03,0xdd,0xa5,
+	0xab,0x07,0x88,0x96,0xae,0x80,0xc1,0x8b,0x0a,0xf6,
+	0x6d,0xff,0x31,0x96,0x16,0xeb,0x78,0x4e,0x49,0x5a,
+	0xd2,0xce,0x90,0xd7,0xf7,0x72,0xa8,0x17,0x47,0xb6,
+	0x5f,0x62,0x09,0x3b,0x1e,0x0d,0xb9,0xe5,0xba,0x53,
+	0x2f,0xaf,0xec,0x47,0x50,0x83,0x23,0xe6,0x71,0x32,
+	0x7d,0xf9,0x44,0x44,0x32,0xcb,0x73,0x67,0xce,0xc8,
+	0x2f,0x5d,0x44,0xc0,0xd0,0x0b,0x67,0xd6,0x50,0xa0,
+	0x75,0xcd,0x4b,0x70,0xde,0xdd,0x77,0xeb,0x9b,0x10,
+	0x23,0x1b,0x6b,0x5b,0x74,0x13,0x47,0x39,0x6d,0x62,
+	0x89,0x74,0x21,0xd4,0x3d,0xf9,0xb4,0x2e,0x44,0x6e,
+	0x35,0x8e,0x9c,0x11,0xa9,0xb2,0x18,0x4e,0xcb,0xef,
+	0x0c,0xd8,0xe7,0xa8,0x77,0xef,0x96,0x8f,0x13,0x90,
+	0xec,0x9b,0x3d,0x35,0xa5,0x58,0x5c,0xb0,0x09,0x29,
+	0x0e,0x2f,0xcd,0xe7,0xb5,0xec,0x66,0xd9,0x08,0x4b,
+	0xe4,0x40,0x55,0xa6,0x19,0xd9,0xdd,0x7f,0xc3,0x16,
+	0x6f,0x94,0x87,0xf7,0xcb,0x27,0x29,0x12,0x42,0x64,
+	0x45,0x99,0x85,0x14,0xc1,0x5d,0x53,0xa1,0x8c,0x86,
+	0x4c,0xe3,0xa2,0xb7,0x55,0x57,0x93,0x98,0x81,0x26,
+	0x52,0x0e,0xac,0xf2,0xe3,0x06,0x6e,0x23,0x0c,0x91,
+	0xbe,0xe4,0xdd,0x53,0x04,0xf5,0xfd,0x04,0x05,0xb3,
+	0x5b,0xd9,0x9c,0x73,0x13,0x5d,0x3d,0x9b,0xc3,0x35,
+	0xee,0x04,0x9e,0xf6,0x9b,0x38,0x67,0xbf,0x2d,0x7b,
+	0xd1,0xea,0xa5,0x95,0xd8,0xbf,0xc0,0x06,0x6f,0xf8,
+	0xd3,0x15,0x09,0xeb,0x0c,0x6c,0xaa,0x00,0x6c,0x80,
+	0x7a,0x62,0x3e,0xf8,0x4c,0x3d,0x33,0xc1,0x95,0xd2,
+	0x3e,0xe3,0x20,0xc4,0x0d,0xe0,0x55,0x81,0x57,0xc8,
+	0x22,0xd4,0xb8,0xc5,0x69,0xd8,0x49,0xae,0xd5,0x9d,
+	0x4e,0x0f,0xd7,0xf3,0x79,0x58,0x6b,0x4b,0x7f,0xf6,
+	0x84,0xed,0x6a,0x18,0x9f,0x74,0x86,0xd4,0x9b,0x9c,
+	0x4b,0xad,0x9b,0xa2,0x4b,0x96,0xab,0xf9,0x24,0x37,
+	0x2c,0x8a,0x8f,0xff,0xb1,0x0d,0x55,0x35,0x49,0x00,
+	0xa7,0x7a,0x3d,0xb5,0xf2,0x05,0xe1,0xb9,0x9f,0xcd,
+	0x86,0x60,0x86,0x3a,0x15,0x9a,0xd4,0xab,0xe4,0x0f,
+	0xa4,0x89,0x34,0x16,0x3d,0xdd,0xe5,0x42,0xa6,0x58,
+	0x55,0x40,0xfd,0x68,0x3c,0xbf,0xd8,0xc0,0x0f,0x12,
+	0x12,0x9a,0x28,0x4d,0xea,0xcc,0x4c,0xde,0xfe,0x58,
+	0xbe,0x71,0x37,0x54,0x1c,0x04,0x71,0x26,0xc8,0xd4,
+	0x9e,0x27,0x55,0xab,0x18,0x1a,0xb7,0xe9,0x40,0xb0,
+	0xc0};
+
+	member_ptr<Weak::ARC4> arc4;
+	bool pass=true, fail;
+	unsigned int i;
+
+	std::cout << "\nARC4 validation suite running...\n\n";
+
+	arc4.reset(new Weak::ARC4(Key0, sizeof(Key0)));
+	arc4->ProcessString(Input0, sizeof(Input0));
+	fail = std::memcmp(Input0, Output0, sizeof(Input0)) != 0;
+	std::cout << (fail ? "FAILED" : "passed") << "   Test 0" << std::endl;
+	pass = pass && !fail;
+
+	arc4.reset(new Weak::ARC4(Key1, sizeof(Key1)));
+	arc4->ProcessString(Key1, Input1, sizeof(Key1));
+	fail = std::memcmp(Output1, Key1, sizeof(Key1)) != 0;
+	std::cout << (fail ? "FAILED" : "passed") << "   Test 1" << std::endl;
+	pass = pass && !fail;
+
+	arc4.reset(new Weak::ARC4(Key2, sizeof(Key2)));
+	for (i=0, fail=false; i<sizeof(Input2); i++)
+		if (arc4->ProcessByte(Input2[i]) != Output2[i])
+			fail = true;
+	std::cout << (fail ? "FAILED" : "passed") << "   Test 2" << std::endl;
+	pass = pass && !fail;
+
+	arc4.reset(new Weak::ARC4(Key3, sizeof(Key3)));
+	for (i=0, fail=false; i<sizeof(Input3); i++)
+		if (arc4->ProcessByte(Input3[i]) != Output3[i])
+			fail = true;
+	std::cout << (fail ? "FAILED" : "passed") << "   Test 3" << std::endl;
+	pass = pass && !fail;
+
+	arc4.reset(new Weak::ARC4(Key4, sizeof(Key4)));
+	for (i=0, fail=false; i<sizeof(Input4); i++)
+		if (arc4->ProcessByte(Input4[i]) != Output4[i])
+			fail = true;
+	std::cout << (fail ? "FAILED" : "passed") << "   Test 4" << std::endl;
+	pass = pass && !fail;
+
+	return pass;
+}
+
+bool ValidateRC5()
+{
+	std::cout << "\nRC5 validation suite running...\n\n";
+	bool pass1 = true, pass2 = true;
+
+	RC5Encryption enc;  // 0 to 2040-bits (255-bytes)
+	pass1 = RC5Encryption::DEFAULT_KEYLENGTH ==  16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(0) == 0 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(254) == 254 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(255) == 255 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(256) == 255 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(0) == enc.MinKeyLength() && pass1;
+	pass1 = enc.StaticGetValidKeyLength(SIZE_MAX) == enc.MaxKeyLength() && pass1;
+
+	RC5Decryption dec;
+	pass2 = RC5Decryption::DEFAULT_KEYLENGTH ==  16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(0) == 0 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(254) == 254 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(255) == 255 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(256) == 255 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(0) == dec.MinKeyLength() && pass2;
+	pass2 = dec.StaticGetValidKeyLength(SIZE_MAX) == dec.MaxKeyLength() && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/rc5val.dat").c_str(), true, new HexDecoder);
+	return BlockTransformationTest(VariableRoundsCipherFactory<RC5Encryption, RC5Decryption>(16, 12), valdata) && pass1 && pass2;
+}
+
+bool ValidateRC6()
+{
+	std::cout << "\nRC6 validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true;
+
+	RC6Encryption enc;
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(24) == 24 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(32) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(64) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(128) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(0) == enc.MinKeyLength() && pass1;
+	pass1 = enc.StaticGetValidKeyLength(SIZE_MAX) == enc.MaxKeyLength() && pass1;
+
+	RC6Decryption dec;
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(24) == 24 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(32) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(64) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(128) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(0) == dec.MinKeyLength() && pass2;
+	pass2 = dec.StaticGetValidKeyLength(SIZE_MAX) == dec.MaxKeyLength() && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/rc6val.dat").c_str(), true, new HexDecoder);
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<RC6Encryption, RC6Decryption>(16), valdata, 2) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<RC6Encryption, RC6Decryption>(24), valdata, 2) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<RC6Encryption, RC6Decryption>(32), valdata, 2) && pass3;
+	return pass1 && pass2 && pass3;
+}
+
+bool ValidateMARS()
+{
+	std::cout << "\nMARS validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true;
+
+	MARSEncryption enc;
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(24) == 24 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(32) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(64) == 56 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(128) == 56 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(0) == enc.MinKeyLength() && pass1;
+	pass1 = enc.StaticGetValidKeyLength(SIZE_MAX) == enc.MaxKeyLength() && pass1;
+
+	MARSDecryption dec;
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(24) == 24 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(32) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(64) == 56 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(128) == 56 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(0) == dec.MinKeyLength() && pass2;
+	pass2 = dec.StaticGetValidKeyLength(SIZE_MAX) == dec.MaxKeyLength() && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/marsval.dat").c_str(), true, new HexDecoder);
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<MARSEncryption, MARSDecryption>(16), valdata, 4) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<MARSEncryption, MARSDecryption>(24), valdata, 3) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<MARSEncryption, MARSDecryption>(32), valdata, 2) && pass3;
+	return pass1 && pass2 && pass3;
+}
+
+bool ValidateRijndael()
+{
+	std::cout << "\nRijndael (AES) validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true;
+
+	RijndaelEncryption enc;
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(24) == 24 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(32) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(64) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(128) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(0) == enc.MinKeyLength() && pass1;
+	pass1 = enc.StaticGetValidKeyLength(SIZE_MAX) == enc.MaxKeyLength() && pass1;
+
+	RijndaelDecryption dec;
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(24) == 24 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(32) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(64) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(128) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(0) == dec.MinKeyLength() && pass2;
+	pass2 = dec.StaticGetValidKeyLength(SIZE_MAX) == dec.MaxKeyLength() && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/rijndael.dat").c_str(), true, new HexDecoder);
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<RijndaelEncryption, RijndaelDecryption>(16), valdata, 4) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<RijndaelEncryption, RijndaelDecryption>(24), valdata, 3) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<RijndaelEncryption, RijndaelDecryption>(32), valdata, 2) && pass3;
+	pass3 = RunTestDataFile("TestVectors/aes.txt") && pass3;
+	return pass1 && pass2 && pass3;
+}
+
+bool ValidateTwofish()
+{
+	std::cout << "\nTwofish validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true;
+
+	TwofishEncryption enc;
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(24) == 24 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(32) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(64) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(128) == 32 && pass1;
+
+	TwofishDecryption dec;
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(24) == 24 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(32) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(64) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(128) == 32 && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/twofishv.dat").c_str(), true, new HexDecoder);
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<TwofishEncryption, TwofishDecryption>(16), valdata, 4) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<TwofishEncryption, TwofishDecryption>(24), valdata, 3) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<TwofishEncryption, TwofishDecryption>(32), valdata, 2) && pass3;
+	return pass1 && pass2 && pass3;
+}
+
+bool ValidateSerpent()
+{
+	std::cout << "\nSerpent validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true;
+
+	SerpentEncryption enc;
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(24) == 24 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(32) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(64) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(128) == 32 && pass1;
+
+	SerpentDecryption dec;
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(24) == 24 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(32) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(64) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(128) == 32 && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/serpentv.dat").c_str(), true, new HexDecoder);
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<SerpentEncryption, SerpentDecryption>(16), valdata, 5) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<SerpentEncryption, SerpentDecryption>(24), valdata, 4) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<SerpentEncryption, SerpentDecryption>(32), valdata, 3) && pass3;
+	return pass1 && pass2 && pass3;
+}
+
+bool ValidateBlowfish()
+{
+	std::cout << "\nBlowfish validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true, fail;
+
+	BlowfishEncryption enc1;	// 32 to 448-bits (4 to 56-bytes)
+	pass1 = enc1.StaticGetValidKeyLength(3) == 4 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(4) == 4 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(5) == 5 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(8) == 8 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(24) == 24 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(32) == 32 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(56) == 56 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(57) == 56 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(60) == 56 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(64) == 56 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(128) == 56 && pass1;
+
+	BlowfishDecryption dec1; // 32 to 448-bits (4 to 56-bytes)
+	pass2 = dec1.StaticGetValidKeyLength(3) == 4 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(4) == 4 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(5) == 5 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(8) == 8 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(24) == 24 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(32) == 32 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(56) == 56 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(57) == 56 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(60) == 56 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(64) == 56 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(128) == 56 && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	HexEncoder output(new FileSink(std::cout));
+	const char *key[]={"abcdefghijklmnopqrstuvwxyz", "Who is John Galt?"};
+	byte *plain[]={(byte *)"BLOWFISH", (byte *)"\xfe\xdc\xba\x98\x76\x54\x32\x10"};
+	byte *cipher[]={(byte *)"\x32\x4e\xd0\xfe\xf4\x13\xa2\x03", (byte *)"\xcc\x91\x73\x2b\x80\x22\xf6\x84"};
+	byte out[8], outplain[8];
+
+	for (int i=0; i<2; i++)
+	{
+		ECB_Mode<Blowfish>::Encryption enc2((byte *)key[i], strlen(key[i]));
+		enc2.ProcessData(out, plain[i], 8);
+		fail = std::memcmp(out, cipher[i], 8) != 0;
+
+		ECB_Mode<Blowfish>::Decryption dec2((byte *)key[i], strlen(key[i]));
+		dec2.ProcessData(outplain, cipher[i], 8);
+		fail = fail || std::memcmp(outplain, plain[i], 8);
+		pass3 = pass3 && !fail;
+
+		std::cout << (fail ? "FAILED   " : "passed   ");
+		std::cout << '\"' << key[i] << '\"';
+		for (int j=0; j<(signed int)(30-strlen(key[i])); j++)
+			std::cout << ' ';
+		output.Put(outplain, 8);
+		std::cout << "  ";
+		output.Put(out, 8);
+		std::cout << std::endl;
+	}
+	return pass1 && pass2 && pass3;
+}
+
+bool ValidateThreeWay()
+{
+	std::cout << "\n3-WAY validation suite running...\n\n";
+	bool pass1 = true, pass2 = true;
+
+	ThreeWayEncryption enc;  // 96-bit only
+	pass1 = ThreeWayEncryption::KEYLENGTH ==  12 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(8) == 12 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(12) == 12 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 12 && pass1;
+
+	ThreeWayDecryption dec;  // 96-bit only
+	pass2 = ThreeWayDecryption::KEYLENGTH ==  12 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(8) == 12 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(12) == 12 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 12 && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/3wayval.dat").c_str(), true, new HexDecoder);
+	return BlockTransformationTest(FixedRoundsCipherFactory<ThreeWayEncryption, ThreeWayDecryption>(), valdata) && pass1 && pass2;
+}
+
+bool ValidateGOST()
+{
+	std::cout << "\nGOST validation suite running...\n\n";
+	bool pass1 = true, pass2 = true;
+
+	GOSTEncryption enc;  // 256-bit only
+	pass1 = GOSTEncryption::KEYLENGTH ==  32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(24) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(32) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(40) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(64) == 32 && pass1;
+
+	GOSTDecryption dec;  // 256-bit only
+	pass2 = GOSTDecryption::KEYLENGTH ==  32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(24) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(32) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(40) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(64) == 32 && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/gostval.dat").c_str(), true, new HexDecoder);
+	return BlockTransformationTest(FixedRoundsCipherFactory<GOSTEncryption, GOSTDecryption>(), valdata) && pass1 && pass2;
+}
+
+bool ValidateSHARK()
+{
+	std::cout << "\nSHARK validation suite running...\n\n";
+	bool pass1 = true, pass2 = true;
+
+	SHARKEncryption enc;  // 128-bit only
+	pass1 = SHARKEncryption::KEYLENGTH ==  16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(15) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(17) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(32) == 16 && pass1;
+
+	SHARKDecryption dec;  // 128-bit only
+	pass2 = SHARKDecryption::KEYLENGTH ==  16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(15) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(17) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(32) == 16 && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/sharkval.dat").c_str(), true, new HexDecoder);
+	return BlockTransformationTest(FixedRoundsCipherFactory<SHARKEncryption, SHARKDecryption>(), valdata) && pass1 && pass2;
+}
+
+bool ValidateCAST()
+{
+	std::cout << "\nCAST-128 validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true;
+
+	CAST128Encryption enc1;  // 40 to 128-bits (5 to 16-bytes)
+	pass1 = CAST128Encryption::DEFAULT_KEYLENGTH ==  16 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(4) == 5 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(5) == 5 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(15) == 15 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc1.StaticGetValidKeyLength(17) == 16 && pass1;
+
+	CAST128Decryption dec1;  // 40 to 128-bits (5 to 16-bytes)
+	pass2 = CAST128Decryption::DEFAULT_KEYLENGTH ==  16 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(4) == 5 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(5) == 5 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(15) == 15 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec1.StaticGetValidKeyLength(17) == 16 && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource val128(DataDir("TestData/cast128v.dat").c_str(), true, new HexDecoder);
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<CAST128Encryption, CAST128Decryption>(16), val128, 1) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<CAST128Encryption, CAST128Decryption>(10), val128, 1) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<CAST128Encryption, CAST128Decryption>(5), val128, 1) && pass3;
+
+	std::cout << "\nCAST-256 validation suite running...\n\n";
+	bool pass4 = true, pass5 = true, pass6 = true;
+
+	CAST256Encryption enc2;  // 128, 160, 192, 224, or 256-bits (16 to 32-bytes, step 4)
+	pass1 = CAST128Encryption::DEFAULT_KEYLENGTH ==  16 && pass1;
+	pass4 = enc2.StaticGetValidKeyLength(15) == 16 && pass4;
+	pass4 = enc2.StaticGetValidKeyLength(16) == 16 && pass4;
+	pass4 = enc2.StaticGetValidKeyLength(17) == 20 && pass4;
+	pass4 = enc2.StaticGetValidKeyLength(20) == 20 && pass4;
+	pass4 = enc2.StaticGetValidKeyLength(24) == 24 && pass4;
+	pass4 = enc2.StaticGetValidKeyLength(28) == 28 && pass4;
+	pass4 = enc2.StaticGetValidKeyLength(31) == 32 && pass4;
+	pass4 = enc2.StaticGetValidKeyLength(32) == 32 && pass4;
+	pass4 = enc2.StaticGetValidKeyLength(33) == 32 && pass4;
+
+	CAST256Decryption dec2;  // 128, 160, 192, 224, or 256-bits (16 to 32-bytes, step 4)
+	pass2 = CAST256Decryption::DEFAULT_KEYLENGTH ==  16 && pass2;
+	pass5 = dec2.StaticGetValidKeyLength(15) == 16 && pass5;
+	pass5 = dec2.StaticGetValidKeyLength(16) == 16 && pass5;
+	pass5 = dec2.StaticGetValidKeyLength(17) == 20 && pass5;
+	pass5 = dec2.StaticGetValidKeyLength(20) == 20 && pass5;
+	pass5 = dec2.StaticGetValidKeyLength(24) == 24 && pass5;
+	pass5 = dec2.StaticGetValidKeyLength(28) == 28 && pass5;
+	pass5 = dec2.StaticGetValidKeyLength(31) == 32 && pass5;
+	pass5 = dec2.StaticGetValidKeyLength(32) == 32 && pass5;
+	pass5 = dec2.StaticGetValidKeyLength(33) == 32 && pass5;
+	std::cout << (pass4 && pass5 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource val256(DataDir("TestData/cast256v.dat").c_str(), true, new HexDecoder);
+	pass6 = BlockTransformationTest(FixedRoundsCipherFactory<CAST256Encryption, CAST256Decryption>(16), val256, 1) && pass6;
+	pass6 = BlockTransformationTest(FixedRoundsCipherFactory<CAST256Encryption, CAST256Decryption>(24), val256, 1) && pass6;
+	pass6 = BlockTransformationTest(FixedRoundsCipherFactory<CAST256Encryption, CAST256Decryption>(32), val256, 1) && pass6;
+
+	return pass1 && pass2 && pass3 && pass4 && pass5 && pass6;
+}
+
+bool ValidateSquare()
+{
+	std::cout << "\nSquare validation suite running...\n\n";
+	bool pass1 = true, pass2 = true;
+
+	SquareEncryption enc;  // 128-bits only
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(15) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(17) == 16 && pass1;
+
+	SquareDecryption dec;  // 128-bits only
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(15) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(17) == 16 && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/squareva.dat").c_str(), true, new HexDecoder);
+	return BlockTransformationTest(FixedRoundsCipherFactory<SquareEncryption, SquareDecryption>(), valdata) && pass1 && pass2;
+}
+
+bool ValidateSKIPJACK()
+{
+	std::cout << "\nSKIPJACK validation suite running...\n\n";
+	bool pass1 = true, pass2 = true;
+
+	SKIPJACKEncryption enc;  // 80-bits only
+	pass1 = enc.StaticGetValidKeyLength(8) == 10 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(9) == 10 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(10) == 10 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 10 && pass1;
+
+	SKIPJACKDecryption dec;  // 80-bits only
+	pass2 = dec.StaticGetValidKeyLength(8) == 10 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(9) == 10 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(10) == 10 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 10 && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/skipjack.dat").c_str(), true, new HexDecoder);
+	return BlockTransformationTest(FixedRoundsCipherFactory<SKIPJACKEncryption, SKIPJACKDecryption>(), valdata) && pass1 && pass2;
+}
+
+bool ValidateSEAL()
+{
+	const byte input[] = {0x37,0xa0,0x05,0x95,0x9b,0x84,0xc4,0x9c,0xa4,0xbe,0x1e,0x05,0x06,0x73,0x53,0x0f,0x5f,0xb0,0x97,0xfd,0xf6,0xa1,0x3f,0xbd,0x6c,0x2c,0xde,0xcd,0x81,0xfd,0xee,0x7c};
+	const byte key[] = {0x67, 0x45, 0x23, 0x01, 0xef, 0xcd, 0xab, 0x89, 0x98, 0xba, 0xdc, 0xfe, 0x10, 0x32, 0x54, 0x76, 0xc3, 0xd2, 0xe1, 0xf0};
+	const byte iv[] = {0x01, 0x35, 0x77, 0xaf};
+	byte output[32];
+
+	std::cout << "\nSEAL validation suite running...\n\n";
+
+	SEAL<>::Encryption seal(key, sizeof(key), iv);
+	unsigned int size = sizeof(input);
+	bool pass = true;
+
+	std::memset(output, 1, size);
+	seal.ProcessString(output, input, size);
+	for (unsigned int i=0; i<size; i++)
+		if (output[i] != 0)
+			pass = false;
+
+	seal.Seek(1);
+	output[1] = seal.ProcessByte(output[1]);
+	seal.ProcessString(output+2, size-2);
+	pass = pass && std::memcmp(output+1, input+1, size-1) == 0;
+
+	std::cout << (pass ? "passed" : "FAILED") << std::endl;
+	return pass;
+}
+
+bool ValidateBaseCode()
+{
+	bool pass = true, fail;
+	byte data[255];
+	for (unsigned int i=0; i<255; i++)
+		data[i] = byte(i);
+
+	const char hexEncoded[] =
+		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627"
+		"28292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F"
+		"505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F7071727374757677"
+		"78797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9F"
+		"A0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7"
+		"C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEF"
+		"F0F1F2F3F4F5F6F7F8F9FAFBFCFDFE";
+	const char base32Encoded[] =
+		"AAASEA2EAWDAQCAJBIFS2DIQB6IBCESVCSKTNF22DEPBYHA7D2RUAIJCENUCKJTHFAWUWK3NFWZC8NBT"
+		"GI3VIPJYG66DUQT5HS8V6R4AIFBEGTCFI3DWSUKKJPGE4VURKBIXEW4WKXMFQYC3MJPX2ZK8M7SGC2VD"
+		"NTUYN35IPFXGY5DPP3ZZA6MUQP4HK7VZRB6ZW856RX9H9AEBSKB2JBNGS8EIVCWMTUG27D6SUGJJHFEX"
+		"U4M3TGN4VQQJ5HW9WCS4FI7EWYVKRKFJXKX43MPQX82MDNXVYU45PP72ZG7MZRF7Z496BSQC2RCNMTYH"
+		"3DE6XU8N3ZHN9WGT4MJ7JXQY49NPVYY55VQ77Z9A6HTQH3HF65V8T4RK7RYQ55ZR8D29F69W8Z5RR8H3"
+		"9M7939R8";
+	const char base64AndHexEncoded[] =
+		"41414543417751464267634943516F4C4441304F4478415245684D554652595847426B6147787764"
+		"486838674953496A4A43556D4A7967704B6973734C5334764D4445794D7A51310A4E6A63344F546F"
+		"375044302B50304242516B4E4552555A4853456C4B5330784E546B395155564A5456465657563168"
+		"5A576C746358563566594746695932526C5A6D646F615770720A6247317562334278636E4E306458"
+		"5A3365486C3665337839666E2B4167594B44684957476834694A696F754D6A5936506B4A47536B35"
+		"53566C7065596D5A71626E4A32656E3643680A6F714F6B7061616E714B6D717136797472712B7773"
+		"624B7A744C573274376935757275387662362F774D484377385446787366497963724C7A4D334F7A"
+		"39445230745055316462580A324E6E6132397A6433742F6734654C6A354F586D352B6A7036757673"
+		"3765377638504879382F5431397666342B6672372F50332B0A";
+	const char base64URLAndHexEncoded[] =
+		"41414543417751464267634943516F4C4441304F4478415245684D554652595847426B6147787764"
+		"486838674953496A4A43556D4A7967704B6973734C5334764D4445794D7A51314E6A63344F546F37"
+		"5044302D50304242516B4E4552555A4853456C4B5330784E546B395155564A54564656575631685A"
+		"576C746358563566594746695932526C5A6D646F615770726247317562334278636E4E3064585A33"
+		"65486C3665337839666E2D4167594B44684957476834694A696F754D6A5936506B4A47536B355356"
+		"6C7065596D5A71626E4A32656E3643686F714F6B7061616E714B6D717136797472712D7773624B7A"
+		"744C573274376935757275387662365F774D484377385446787366497963724C7A4D334F7A394452"
+		"3074505531646258324E6E6132397A6433745F6734654C6A354F586D352D6A703675767337653776"
+		"38504879385F5431397666342D6672375F50332D";
+
+	std::cout << "\nBase64, Base64URL, Base32 and Base16 coding validation suite running...\n\n";
+
+	fail = !TestFilter(HexEncoder().Ref(), data, 255, (const byte *)hexEncoded, strlen(hexEncoded));
+	try {HexEncoder().IsolatedInitialize(g_nullNameValuePairs);}
+	catch (const Exception&) {fail=true;}
+	std::cout << (fail ? "FAILED:" : "passed:");
+	std::cout << "  Hex Encoding\n";
+	pass = pass && !fail;
+
+	fail = !TestFilter(HexDecoder().Ref(), (const byte *)hexEncoded, strlen(hexEncoded), data, 255);
+	try {HexDecoder().IsolatedInitialize(g_nullNameValuePairs);}
+	catch (const Exception&) {fail=true;}
+	std::cout << (fail ? "FAILED:" : "passed:");
+	std::cout << "  Hex Decoding\n";
+	pass = pass && !fail;
+
+	fail = !TestFilter(Base32Encoder().Ref(), data, 255, (const byte *)base32Encoded, strlen(base32Encoded));
+	try {Base32Encoder().IsolatedInitialize(g_nullNameValuePairs);}
+	catch (const Exception&) {fail=true;}
+	std::cout << (fail ? "FAILED:" : "passed:");
+	std::cout << "  Base32 Encoding\n";
+	pass = pass && !fail;
+
+	fail = !TestFilter(Base32Decoder().Ref(), (const byte *)base32Encoded, strlen(base32Encoded), data, 255);
+	try {Base32Decoder().IsolatedInitialize(g_nullNameValuePairs);}
+	catch (const Exception&) {fail=true;}
+	std::cout << (fail ? "FAILED:" : "passed:");
+	std::cout << "  Base32 Decoding\n";
+	pass = pass && !fail;
+
+	fail = !TestFilter(Base64Encoder(new HexEncoder).Ref(), data, 255, (const byte *)base64AndHexEncoded, strlen(base64AndHexEncoded));
+	try {Base64Encoder().IsolatedInitialize(g_nullNameValuePairs);}
+	catch (const Exception&) {fail=true;}
+	std::cout << (fail ? "FAILED:" : "passed:");
+	std::cout << "  Base64 Encoding\n";
+	pass = pass && !fail;
+
+	fail = !TestFilter(HexDecoder(new Base64Decoder).Ref(), (const byte *)base64AndHexEncoded, strlen(base64AndHexEncoded), data, 255);
+	try {Base64Decoder().IsolatedInitialize(g_nullNameValuePairs);}
+	catch (const Exception&) {fail=true;}
+	std::cout << (fail ? "FAILED:" : "passed:");
+	std::cout << "  Base64 Decoding\n";
+	pass = pass && !fail;
+
+	fail = !TestFilter(Base64URLEncoder(new HexEncoder).Ref(), data, 255, (const byte *)base64URLAndHexEncoded, strlen(base64URLAndHexEncoded));
+	try {Base64URLEncoder().IsolatedInitialize(g_nullNameValuePairs);}
+	catch (const Exception&) {fail=true;}
+	std::cout << (fail ? "FAILED:" : "passed:");
+	std::cout << "  Base64 URL Encoding\n";
+	pass = pass && !fail;
+
+	fail = !TestFilter(HexDecoder(new Base64URLDecoder).Ref(), (const byte *)base64URLAndHexEncoded, strlen(base64URLAndHexEncoded), data, 255);
+	try {Base64URLDecoder().IsolatedInitialize(g_nullNameValuePairs);}
+	catch (const Exception&) {fail=true;}
+	std::cout << (fail ? "FAILED:" : "passed:");
+	std::cout << "  Base64 URL Decoding\n";
+	pass = pass && !fail;
+
+	return pass;
+}
+
+class MyEncoder : public SimpleProxyFilter
+{
+public:
+	MyEncoder(BufferedTransformation *attachment = NULLPTR);
+	void IsolatedInitialize(const NameValuePairs &params);
+};
+
+MyEncoder::MyEncoder(BufferedTransformation *attachment)
+	: SimpleProxyFilter(new BaseN_Encoder(new Grouper), attachment)
+{
+	IsolatedInitialize(MakeParameters(Name::InsertLineBreaks(), true)(Name::MaxLineLength(), 72));
+}
+
+void MyEncoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	bool insertLineBreaks = parameters.GetValueWithDefault(Name::InsertLineBreaks(), true);
+	int maxLineLength = parameters.GetIntValueWithDefault(Name::MaxLineLength(), 72);
+
+	const byte padding = '=';
+	const char *lineBreak = insertLineBreaks ? "\n" : "";
+
+	char stars[64];
+	std::memset(stars, '*', 64);
+
+	m_filter->Initialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::EncodingLookupArray(), (const byte *)&stars[0], false)
+			(Name::PaddingByte(), padding)
+			(Name::GroupSize(), insertLineBreaks ? maxLineLength : 0)
+			(Name::Separator(), ConstByteArrayParameter(lineBreak))
+			(Name::Terminator(), ConstByteArrayParameter(lineBreak))
+			(Name::Log2Base(), 6, true)));
+}
+
+class MyDecoder : public BaseN_Decoder
+{
+public:
+	MyDecoder(BufferedTransformation *attachment = NULLPTR);
+	void IsolatedInitialize(const NameValuePairs &params);
+	static const int * CRYPTOPP_API GetDecodingLookupArray();
+};
+
+MyDecoder::MyDecoder(BufferedTransformation *attachment)
+	: BaseN_Decoder(GetDecodingLookupArray(), 6, attachment)
+{
+}
+
+void MyDecoder::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	BaseN_Decoder::IsolatedInitialize(CombinedNameValuePairs(
+		parameters,
+		MakeParameters(Name::DecodingLookupArray(), GetDecodingLookupArray(), false)(Name::Log2Base(), 6, true)));
+}
+
+struct MyDecoderAlphabet
+{
+	MyDecoderAlphabet() {
+		std::fill(tab, tab+COUNTOF(tab), '*');
+	}
+	byte tab[64];
+};
+
+struct MyDecoderArray
+{
+	MyDecoderArray() {
+		std::fill(tab, tab+COUNTOF(tab), -1);
+	}
+	int tab[256];
+};
+
+const int * MyDecoder::GetDecodingLookupArray()
+{
+	static bool s_initialized = false;
+	static MyDecoderAlphabet s_alpha;
+	static MyDecoderArray s_array;
+
+	MEMORY_BARRIER();
+	if (!s_initialized)
+	{
+		InitializeDecodingLookupArray(s_array.tab, s_alpha.tab, COUNTOF(s_alpha.tab), false);
+		s_initialized = true;
+		MEMORY_BARRIER();
+	}
+	return s_array.tab;
+}
+
+bool ValidateEncoder()
+{
+	// The default encoder and decoder alphabet are bogus. They are a
+	// string of '*'. To round trip a string both IsolatedInitialize
+	// must be called and work correctly.
+	std::cout << "\nCustom encoder validation running...\n\n";
+	bool pass = true;
+
+	int lookup[256];
+	const char alphabet[64+1] =
+		"AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz01234576789*";
+	const char expected[] =
+		"ILcBMSgriDicmKmTi2oENCsuJTufN0yWjL1HnS8xKdaiOkeZK3gKock1ktmlo1q4LlsNPrAyGrG0gjO2gzQ5FQ==";
+
+	MyEncoder encoder;
+	std::string str1;
+
+	AlgorithmParameters eparams = MakeParameters(Name::EncodingLookupArray(),(const byte*)alphabet)
+	                                            (Name::InsertLineBreaks(), false);
+	encoder.IsolatedInitialize(eparams);
+
+	encoder.Detach(new StringSink(str1));
+	encoder.Put((const byte*) alphabet, 64);
+	encoder.MessageEnd();
+
+	MyDecoder decoder;
+	std::string str2;
+
+	MyDecoder::InitializeDecodingLookupArray(lookup, (const byte*) alphabet, 64, false);
+	AlgorithmParameters dparams = MakeParameters(Name::DecodingLookupArray(),(const int*)lookup);
+	decoder.IsolatedInitialize(dparams);
+
+	decoder.Detach(new StringSink(str2));
+	decoder.Put(ConstBytePtr(str1), BytePtrSize(str1));
+	decoder.MessageEnd();
+
+	pass = (str1 == std::string(expected)) && pass;
+	pass = (str2 == std::string(alphabet, 64)) && pass;
+
+	std::cout << (pass ? "passed:" : "FAILED:");
+	std::cout << "  Encode and decode\n";
+
+	// Try forcing an empty message. This is the Monero bug
+	// at https://github.com/weidai11/cryptopp/issues/562.
+	{
+		MyDecoder decoder2;
+		SecByteBlock empty;
+
+		AlgorithmParameters dparams2 = MakeParameters(Name::DecodingLookupArray(),(const int*)lookup);
+		decoder2.IsolatedInitialize(dparams2);
+
+		decoder2.Detach(new Redirector(TheBitBucket()));
+		decoder2.Put(empty.BytePtr(), empty.SizeInBytes());
+		decoder2.MessageEnd();
+
+		// Tame the optimizer
+		volatile lword size = decoder2.MaxRetrievable();
+		lword shadow = size;
+		CRYPTOPP_UNUSED(shadow);
+	}
+
+	std::cout << "passed:  0-length message\n";
+
+	return pass;
+}
+
+bool ValidateSHACAL2()
+{
+	std::cout << "\nSHACAL-2 validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true;
+
+	SHACAL2Encryption enc;  // 128 to 512-bits (16 to 64-bytes)
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(15) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(64) == 64 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(65) == 64 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(128) == 64 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(0) == enc.MinKeyLength() && pass1;
+	pass1 = enc.StaticGetValidKeyLength(SIZE_MAX) == enc.MaxKeyLength() && pass1;
+
+	SHACAL2Decryption dec;  // 128 to 512-bits (16 to 64-bytes)
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(15) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(64) == 64 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(65) == 64 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(128) == 64 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(0) == dec.MinKeyLength() && pass2;
+	pass2 = dec.StaticGetValidKeyLength(SIZE_MAX) == dec.MaxKeyLength() && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/shacal2v.dat").c_str(), true, new HexDecoder);
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<SHACAL2Encryption, SHACAL2Decryption>(16), valdata, 4) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<SHACAL2Encryption, SHACAL2Decryption>(64), valdata, 10) && pass3;
+	return pass1 && pass2 && pass3;
+}
+
+bool ValidateARIA()
+{
+	std::cout << "\nARIA validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true;
+
+	ARIAEncryption enc;
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(24) == 24 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(32) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(64) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(128) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(0) == enc.MinKeyLength() && pass1;
+	pass1 = enc.StaticGetValidKeyLength(SIZE_MAX) == enc.MaxKeyLength() && pass1;
+
+	ARIADecryption dec;
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(24) == 24 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(32) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(64) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(128) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(0) == dec.MinKeyLength() && pass2;
+	pass2 = dec.StaticGetValidKeyLength(SIZE_MAX) == dec.MaxKeyLength() && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/aria.dat").c_str(), true, new HexDecoder);
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<ARIAEncryption, ARIADecryption>(16), valdata, 15) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<ARIAEncryption, ARIADecryption>(24), valdata, 15) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<ARIAEncryption, ARIADecryption>(32), valdata, 15) && pass3;
+	return pass1 && pass2 && pass3;
+}
+
+bool ValidateSIMECK()
+{
+	std::cout << "\nSIMECK validation suite running...\n";
+
+	return RunTestDataFile("TestVectors/simeck.txt");
+}
+
+bool ValidateCHAM()
+{
+	std::cout << "\nCHAM validation suite running...\n";
+
+	return RunTestDataFile("TestVectors/cham.txt");
+}
+
+bool ValidateHIGHT()
+{
+	std::cout << "\nHIGHT validation suite running...\n";
+
+	return RunTestDataFile("TestVectors/hight.txt");
+}
+
+bool ValidateLEA()
+{
+	std::cout << "\nLEA validation suite running...\n";
+
+	return RunTestDataFile("TestVectors/lea.txt");
+}
+
+bool ValidateSIMON()
+{
+	std::cout << "\nSIMON validation suite running...\n";
+
+	return RunTestDataFile("TestVectors/simon.txt");
+}
+
+bool ValidateSPECK()
+{
+	std::cout << "\nSPECK validation suite running...\n";
+
+	return RunTestDataFile("TestVectors/speck.txt");
+}
+
+bool ValidateCamellia()
+{
+	std::cout << "\nCamellia validation suite running...\n\n";
+	bool pass1 = true, pass2 = true, pass3 = true;
+
+	CamelliaEncryption enc;
+	pass1 = enc.StaticGetValidKeyLength(8) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(16) == 16 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(24) == 24 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(32) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(64) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(128) == 32 && pass1;
+	pass1 = enc.StaticGetValidKeyLength(0) == enc.MinKeyLength() && pass1;
+	pass1 = enc.StaticGetValidKeyLength(SIZE_MAX) == enc.MaxKeyLength() && pass1;
+
+	CamelliaDecryption dec;
+	pass2 = dec.StaticGetValidKeyLength(8) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(16) == 16 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(24) == 24 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(32) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(64) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(128) == 32 && pass2;
+	pass2 = dec.StaticGetValidKeyLength(0) == dec.MinKeyLength() && pass2;
+	pass2 = dec.StaticGetValidKeyLength(SIZE_MAX) == dec.MaxKeyLength() && pass2;
+	std::cout << (pass1 && pass2 ? "passed:" : "FAILED:") << "  Algorithm key lengths\n";
+
+	FileSource valdata(DataDir("TestData/camellia.dat").c_str(), true, new HexDecoder);
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<CamelliaEncryption, CamelliaDecryption>(16), valdata, 15) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<CamelliaEncryption, CamelliaDecryption>(24), valdata, 15) && pass3;
+	pass3 = BlockTransformationTest(FixedRoundsCipherFactory<CamelliaEncryption, CamelliaDecryption>(32), valdata, 15) && pass3;
+	return pass1 && pass2 && pass3;
+}
+
+bool ValidateSalsa()
+{
+	std::cout << "\nSalsa validation suite running...\n";
+
+	return RunTestDataFile("TestVectors/salsa.txt");
+}
+
+bool ValidateChaCha()
+{
+	std::cout << "\nChaCha validation suite running...\n";
+
+	return RunTestDataFile("TestVectors/chacha.txt");
+}
+
+bool ValidateChaChaTLS()
+{
+	std::cout << "\nChaCha-TLS validation suite running...\n";
+
+	return RunTestDataFile("TestVectors/chacha_tls.txt");
+}
+
+bool ValidateSosemanuk()
+{
+	std::cout << "\nSosemanuk validation suite running...\n";
+	return RunTestDataFile("TestVectors/sosemanuk.txt");
+}
+
+bool ValidateRabbit()
+{
+	std::cout << "\nRabbit validation suite running...\n";
+	return RunTestDataFile("TestVectors/rabbit.txt");
+}
+
+bool ValidateHC128()
+{
+	std::cout << "\nHC-128 validation suite running...\n";
+	return RunTestDataFile("TestVectors/hc128.txt");
+}
+
+bool ValidateHC256()
+{
+	std::cout << "\nHC-256 validation suite running...\n";
+	return RunTestDataFile("TestVectors/hc256.txt");
+}
+
+bool ValidateVMAC()
+{
+	std::cout << "\nVMAC validation suite running...\n";
+	return RunTestDataFile("TestVectors/vmac.txt");
+}
+
+bool ValidateCCM()
+{
+	std::cout << "\nAES/CCM validation suite running...\n";
+	return RunTestDataFile("TestVectors/ccm.txt");
+}
+
+bool ValidateGCM()
+{
+	std::cout << "\nAES/GCM validation suite running...\n";
+	std::cout << "\n2K tables:";
+	bool pass = RunTestDataFile("TestVectors/gcm.txt", MakeParameters(Name::TableSize(), (int)2048));
+	std::cout << "\n64K tables:";
+	return RunTestDataFile("TestVectors/gcm.txt", MakeParameters(Name::TableSize(), (int)64*1024)) && pass;
+}
+
+bool ValidateXTS()
+{
+	std::cout << "\nAES/XTS validation suite running...\n";
+	return RunTestDataFile("TestVectors/xts.txt");
+}
+
+bool ValidateCMAC()
+{
+	std::cout << "\nCMAC validation suite running...\n";
+	return RunTestDataFile("TestVectors/cmac.txt");
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validat5.cpp b/runtime/third_party/cryptopp/validat5.cpp
new file mode 100644
index 0000000..56d6cc7
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat5.cpp
@@ -0,0 +1,2224 @@
+// validat5.cpp - originally written and placed in the public domain by Wei Dai
+//                CryptoPP::Test namespace added by JW in February 2017.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "aes.h"
+#include "crc.h"
+#include "adler32.h"
+
+#include "md2.h"
+#include "md4.h"
+#include "md5.h"
+
+#include "sha.h"
+#include "sha3.h"
+#include "shake.h"
+#include "keccak.h"
+#include "tiger.h"
+#include "blake2.h"
+#include "ripemd.h"
+#include "siphash.h"
+#include "poly1305.h"
+#include "whrlpool.h"
+#include "lsh.h"
+
+#include "pssr.h"
+#include "hkdf.h"
+#include "scrypt.h"
+#include "pwdbased.h"
+
+#include "cmac.h"
+#include "dmac.h"
+#include "hmac.h"
+#include "ttmac.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+struct HashTestTuple
+{
+	HashTestTuple(const char *input, const char *output, unsigned int repeatTimes=1)
+		: input((byte *)input), output((byte *)output), inputLen(strlen(input)), repeatTimes(repeatTimes) {}
+
+	HashTestTuple(const char *input, unsigned int inputLen, const char *output, unsigned int repeatTimes)
+		: input((byte *)input), output((byte *)output), inputLen(inputLen), repeatTimes(repeatTimes) {}
+
+	const byte *input, *output;
+	size_t inputLen, repeatTimes;
+};
+
+bool HashModuleTest(HashTransformation &md, const HashTestTuple *testSet, size_t testSetSize)
+{
+	bool pass=true, fail;
+	std::ostringstream oss;
+
+	SecByteBlock digest(md.DigestSize());
+	for (size_t i=0; i<testSetSize; i++)
+	{
+		size_t j;
+
+		for (j=0; j<testSet[i].repeatTimes; j++)
+			md.Update(testSet[i].input, testSet[i].inputLen);
+		md.Final(digest);
+		fail = std::memcmp(digest, testSet[i].output, md.DigestSize()) != 0;
+		pass = pass && !fail;
+
+		oss << (fail ? "FAILED   " : "passed   ");
+		for (j=0; j<md.DigestSize(); j++)
+			oss << std::setw(2) << std::setfill('0') << std::hex << (int)digest[j];
+		oss << "   \"" << (char *)testSet[i].input << '\"';
+		if (testSet[i].repeatTimes != 1)
+			oss << " repeated " << std::dec << testSet[i].repeatTimes << " times";
+		oss  << std::endl;
+	}
+
+	std::cout << oss.str();
+	return pass;
+}
+
+bool ValidateCRC32()
+{
+	const HashTestTuple testSet[] =
+	{
+		HashTestTuple("", "\x00\x00\x00\x00"),
+		HashTestTuple("a", "\x43\xbe\xb7\xe8"),
+		HashTestTuple("abc", "\xc2\x41\x24\x35"),
+		HashTestTuple("message digest", "\x7f\x9d\x15\x20"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\xbd\x50\x27\x4c"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\xd2\xe6\xc2\x1f"),
+		HashTestTuple("12345678901234567890123456789012345678901234567890123456789012345678901234567890", "\x72\x4a\xa9\x7c"),
+		HashTestTuple("123456789", "\x26\x39\xf4\xcb")
+	};
+
+	CRC32 crc;
+
+	std::cout << "\nCRC-32 validation suite running...\n\n";
+	return HashModuleTest(crc, testSet, COUNTOF(testSet));
+}
+
+bool ValidateCRC32C()
+{
+	const HashTestTuple testSet[] =
+	{
+		HashTestTuple("", "\x00\x00\x00\x00"),
+		HashTestTuple("a", "\x30\x43\xd0\xc1"),
+		HashTestTuple("abc", "\xb7\x3f\x4b\x36"),
+		HashTestTuple("message digest", "\xd0\x79\xbd\x02"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\x25\xef\xe6\x9e"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\x7d\xd5\x45\xa2"),
+		HashTestTuple("12345678901234567890123456789012345678901234567890123456789012345678901234567890", "\x81\x67\x7a\x47"),
+		HashTestTuple("123456789", "\x83\x92\x06\xe3")
+	};
+
+	CRC32C crc;
+
+	std::cout << "\nCRC-32C validation suite running...\n\n";
+	return HashModuleTest(crc, testSet, COUNTOF(testSet));
+}
+
+bool ValidateAdler32()
+{
+	const HashTestTuple testSet[] =
+	{
+		HashTestTuple("", "\x00\x00\x00\x01"),
+		HashTestTuple("a", "\x00\x62\x00\x62"),
+		HashTestTuple("abc", "\x02\x4d\x01\x27"),
+		HashTestTuple("message digest", "\x29\x75\x05\x86"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\x90\x86\x0b\x20"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\x8a\xdb\x15\x0c"),
+		HashTestTuple("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "\x15\xd8\x70\xf9", 15625)
+	};
+
+	Adler32 md;
+
+	std::cout << "\nAdler-32 validation suite running...\n\n";
+	return HashModuleTest(md, testSet, COUNTOF(testSet));
+}
+
+bool ValidateMD2()
+{
+	const HashTestTuple testSet[] =
+	{
+		HashTestTuple("", "\x83\x50\xe5\xa3\xe2\x4c\x15\x3d\xf2\x27\x5c\x9f\x80\x69\x27\x73"),
+		HashTestTuple("a", "\x32\xec\x01\xec\x4a\x6d\xac\x72\xc0\xab\x96\xfb\x34\xc0\xb5\xd1"),
+		HashTestTuple("abc", "\xda\x85\x3b\x0d\x3f\x88\xd9\x9b\x30\x28\x3a\x69\xe6\xde\xd6\xbb"),
+		HashTestTuple("message digest", "\xab\x4f\x49\x6b\xfb\x2a\x53\x0b\x21\x9f\xf3\x30\x31\xfe\x06\xb0"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\x4e\x8d\xdf\xf3\x65\x02\x92\xab\x5a\x41\x08\xc3\xaa\x47\x94\x0b"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\xda\x33\xde\xf2\xa4\x2d\xf1\x39\x75\x35\x28\x46\xc3\x03\x38\xcd"),
+		HashTestTuple("12345678901234567890123456789012345678901234567890123456789012345678901234567890", "\xd5\x97\x6f\x79\xd8\x3d\x3a\x0d\xc9\x80\x6c\x3c\x66\xf3\xef\xd8")
+	};
+
+	Weak::MD2 md2;
+
+	std::cout << "\nMD2 validation suite running...\n\n";
+	return HashModuleTest(md2, testSet, COUNTOF(testSet));
+}
+
+bool ValidateMD4()
+{
+	const HashTestTuple testSet[] =
+	{
+		HashTestTuple("", "\x31\xd6\xcf\xe0\xd1\x6a\xe9\x31\xb7\x3c\x59\xd7\xe0\xc0\x89\xc0"),
+		HashTestTuple("a", "\xbd\xe5\x2c\xb3\x1d\xe3\x3e\x46\x24\x5e\x05\xfb\xdb\xd6\xfb\x24"),
+		HashTestTuple("abc", "\xa4\x48\x01\x7a\xaf\x21\xd8\x52\x5f\xc1\x0a\xe8\x7a\xa6\x72\x9d"),
+		HashTestTuple("message digest", "\xd9\x13\x0a\x81\x64\x54\x9f\xe8\x18\x87\x48\x06\xe1\xc7\x01\x4b"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\xd7\x9e\x1c\x30\x8a\xa5\xbb\xcd\xee\xa8\xed\x63\xdf\x41\x2d\xa9"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\x04\x3f\x85\x82\xf2\x41\xdb\x35\x1c\xe6\x27\xe1\x53\xe7\xf0\xe4"),
+		HashTestTuple("12345678901234567890123456789012345678901234567890123456789012345678901234567890", "\xe3\x3b\x4d\xdc\x9c\x38\xf2\x19\x9c\x3e\x7b\x16\x4f\xcc\x05\x36")
+	};
+
+	Weak::MD4 md4;
+
+	std::cout << "\nMD4 validation suite running...\n\n";
+	return HashModuleTest(md4, testSet, COUNTOF(testSet));
+}
+
+bool ValidateMD5()
+{
+	const HashTestTuple testSet[] =
+	{
+		HashTestTuple("", "\xd4\x1d\x8c\xd9\x8f\x00\xb2\x04\xe9\x80\x09\x98\xec\xf8\x42\x7e"),
+		HashTestTuple("a", "\x0c\xc1\x75\xb9\xc0\xf1\xb6\xa8\x31\xc3\x99\xe2\x69\x77\x26\x61"),
+		HashTestTuple("abc", "\x90\x01\x50\x98\x3c\xd2\x4f\xb0\xd6\x96\x3f\x7d\x28\xe1\x7f\x72"),
+		HashTestTuple("message digest", "\xf9\x6b\x69\x7d\x7c\xb7\x93\x8d\x52\x5a\x2f\x31\xaa\xf1\x61\xd0"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\xc3\xfc\xd3\xd7\x61\x92\xe4\x00\x7d\xfb\x49\x6c\xca\x67\xe1\x3b"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\xd1\x74\xab\x98\xd2\x77\xd9\xf5\xa5\x61\x1c\x2c\x9f\x41\x9d\x9f"),
+		HashTestTuple("12345678901234567890123456789012345678901234567890123456789012345678901234567890", "\x57\xed\xf4\xa2\x2b\xe3\xc9\x55\xac\x49\xda\x2e\x21\x07\xb6\x7a")
+	};
+
+	Weak::MD5 md5;
+
+	std::cout << "\nMD5 validation suite running...\n\n";
+	return HashModuleTest(md5, testSet, COUNTOF(testSet));
+}
+
+bool ValidateSHA()
+{
+	std::cout << "\nSHA validation suite running...\n";
+	return RunTestDataFile("TestVectors/sha.txt");
+}
+
+bool ValidateSHA2()
+{
+	std::cout << "\nSHA-2 validation suite running...\n";
+	return RunTestDataFile("TestVectors/sha2.txt");
+}
+
+bool ValidateKeccak()
+{
+	std::cout << "\nKeccak validation suite running...\n";
+	return RunTestDataFile("TestVectors/keccak.txt");
+}
+
+bool ValidateSHA3()
+{
+	std::cout << "\nSHA-3 validation suite running...\n";
+	return RunTestDataFile("TestVectors/sha3.txt");
+}
+
+bool ValidateSHAKE()
+{
+	std::cout << "\nSHAKE validation suite running...\n";
+	return RunTestDataFile("TestVectors/shake.txt");
+}
+
+// We needed to hand craft the SHAKE tests because SHAKE128 and SHAKE256
+// use digestSize 'd' as an input parameter for the hash. When 'd > r',
+// where 'r' is rate and acts like a blockSize, then TruncatedFinal acts
+// like a traditional KDF and applies KeccakF1600 core function multiple
+// times on state to create the stream. Regarding the NIST test vectors,
+// the SHAKE128 KATs do not engage 'd > r'. However, the SHAKE256 KATs
+// do engage it.
+bool ValidateSHAKE_XOF()
+{
+	std::cout << "\nSHAKE XOF validation suite running...\n";
+	bool pass = true, fail;
+
+	////// NIST test vectors SHAKE128VariableOut.rsp //////
+
+	// SHAKE128, COUNT = 0 (first test)
+	{
+		std::string m, msg = "84e950051876050dc851fbd99e6247b8";
+		std::string o, out = "8599bd89f63a848c49ca593ec37a12c6";
+		std::string r;
+
+		StringSource(msg, true, new HexDecoder(new StringSink(m)));
+		StringSource(out, true, new HexDecoder(new StringSink(o)));
+		r.resize(o.size());
+
+		SHAKE128 hash((unsigned int)o.size());
+		hash.Update(ConstBytePtr(m), BytePtrSize(m));
+		hash.TruncatedFinal(BytePtr(r), BytePtrSize(r));
+
+		fail = r != o;
+		pass = pass & !fail;
+
+		if (fail)
+			std::cout << "FAILED   " << "SHAKE128 test COUNT=0" << std::endl;
+
+		pass = pass && !fail;
+	}
+
+	// SHAKE128, COUNT = 1125 (last test)
+	{
+		std::string m, msg = "0a13ad2c7a239b4ba73ea6592ae84ea9";
+		std::string o, out = "5feaf99c15f48851943ff9baa6e5055d 8377f0dd347aa4dbece51ad3a6d9ce0c"
+		                     "01aee9fe2260b80a4673a909b532adcd d1e421c32d6460535b5fe392a58d2634"
+		                     "979a5a104d6c470aa3306c400b061db9 1c463b2848297bca2bc26d1864ba49d7"
+		                     "ff949ebca50fbf79a5e63716dc82b600 bd52ca7437ed774d169f6bf02e464879"
+		                     "56fba2230f34cd2a0485484d";
+		std::string r;
+
+		StringSource(msg, true, new HexDecoder(new StringSink(m)));
+		StringSource(out, true, new HexDecoder(new StringSink(o)));
+		r.resize(o.size());
+
+		SHAKE128 hash((unsigned int)o.size());
+		hash.Update(ConstBytePtr(m), BytePtrSize(m));
+		hash.TruncatedFinal(BytePtr(r), BytePtrSize(r));
+
+		fail = r != o;
+		pass = pass & !fail;
+
+		if (fail)
+			std::cout << "FAILED   " << "SHAKE128 test COUNT=1125" << std::endl;
+
+		pass = pass && !fail;
+	}
+
+	////// NIST test vectors SHAKE256VariableOut.rsp //////
+
+	// SHAKE256, COUNT = 0 (first test)
+	{
+		std::string m, msg = "c61a9188812ae73994bc0d6d4021e31b f124dc72669749111232da7ac29e61c4";
+		std::string o, out = "23ce";
+		std::string r;
+
+		StringSource(msg, true, new HexDecoder(new StringSink(m)));
+		StringSource(out, true, new HexDecoder(new StringSink(o)));
+		r.resize(o.size());
+
+		SHAKE256 hash((unsigned int)o.size());
+		hash.Update(ConstBytePtr(m), BytePtrSize(m));
+		hash.TruncatedFinal(BytePtr(r), BytePtrSize(r));
+
+		fail = r != o;
+		pass = pass & !fail;
+
+		if (fail)
+			std::cout << "FAILED   " << "SHAKE256 test COUNT=0" << std::endl;
+
+		pass = pass && !fail;
+	}
+
+	// SHAKE256, COUNT = 1245 (last test)
+	{
+		std::string m, msg = "8d8001e2c096f1b88e7c9224a086efd4 797fbf74a8033a2d422a2b6b8f6747e4";
+		std::string o, out = "2e975f6a8a14f0704d51b13667d8195c 219f71e6345696c49fa4b9d08e9225d3"
+		                     "d39393425152c97e71dd24601c11abcf a0f12f53c680bd3ae757b8134a9c10d4"
+		                     "29615869217fdd5885c4db174985703a 6d6de94a667eac3023443a8337ae1bc6"
+		                     "01b76d7d38ec3c34463105f0d3949d78 e562a039e4469548b609395de5a4fd43"
+		                     "c46ca9fd6ee29ada5efc07d84d553249 450dab4a49c483ded250c9338f85cd93"
+		                     "7ae66bb436f3b4026e859fda1ca57143 2f3bfc09e7c03ca4d183b741111ca048"
+		                     "3d0edabc03feb23b17ee48e844ba2408 d9dcfd0139d2e8c7310125aee801c61a"
+		                     "b7900d1efc47c078281766f361c5e611 1346235e1dc38325666c";
+		std::string r;
+
+		StringSource(msg, true, new HexDecoder(new StringSink(m)));
+		StringSource(out, true, new HexDecoder(new StringSink(o)));
+		r.resize(o.size());
+
+		SHAKE256 hash((unsigned int)o.size());
+		hash.Update(ConstBytePtr(m), BytePtrSize(m));
+		hash.TruncatedFinal(BytePtr(r), BytePtrSize(r));
+
+		fail = r != o;
+		pass = pass & !fail;
+
+		if (fail)
+			std::cout << "FAILED   " << "SHAKE256 test COUNT=0" << std::endl;
+
+		pass = pass && !fail;
+	}
+
+	std::cout << (!pass ? "FAILED   " : "passed   ") << "SHAKE XOF message digests" << std::endl;
+
+	return pass;
+}
+
+bool ValidateTiger()
+{
+	std::cout << "\nTiger validation suite running...\n\n";
+
+	const HashTestTuple testSet[] =
+	{
+		HashTestTuple("", "\x32\x93\xac\x63\x0c\x13\xf0\x24\x5f\x92\xbb\xb1\x76\x6e\x16\x16\x7a\x4e\x58\x49\x2d\xde\x73\xf3"),
+		HashTestTuple("a", "\x77\xBE\xFB\xEF\x2E\x7E\xF8\xAB\x2E\xC8\xF9\x3B\xF5\x87\xA7\xFC\x61\x3E\x24\x7F\x5F\x24\x78\x09"),
+		HashTestTuple("abc", "\x2a\xab\x14\x84\xe8\xc1\x58\xf2\xbf\xb8\xc5\xff\x41\xb5\x7a\x52\x51\x29\x13\x1c\x95\x7b\x5f\x93"),
+		HashTestTuple("Tiger", "\xdd\x00\x23\x07\x99\xf5\x00\x9f\xec\x6d\xeb\xc8\x38\xbb\x6a\x27\xdf\x2b\x9d\x6f\x11\x0c\x79\x37"),
+		HashTestTuple("message digest", "\xD9\x81\xF8\xCB\x78\x20\x1A\x95\x0D\xCF\x30\x48\x75\x1E\x44\x1C\x51\x7F\xCA\x1A\xA5\x5A\x29\xF6"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\x8d\xce\xa6\x80\xa1\x75\x83\xee\x50\x2b\xa3\x8a\x3c\x36\x86\x51\x89\x0f\xfb\xcc\xdc\x49\xa8\xcc"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-", "\xf7\x1c\x85\x83\x90\x2a\xfb\x87\x9e\xdf\xe6\x10\xf8\x2c\x0d\x47\x86\xa3\xa5\x34\x50\x44\x86\xb5"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZ=abcdefghijklmnopqrstuvwxyz+0123456789", "\x48\xce\xeb\x63\x08\xb8\x7d\x46\xe9\x5d\x65\x61\x12\xcd\xf1\x8d\x97\x91\x5f\x97\x65\x65\x89\x57"),
+		HashTestTuple("Tiger - A Fast New Hash Function, by Ross Anderson and Eli Biham", "\x8a\x86\x68\x29\x04\x0a\x41\x0c\x72\x9a\xd2\x3f\x5a\xda\x71\x16\x03\xb3\xcd\xd3\x57\xe4\xc1\x5e"),
+		HashTestTuple("Tiger - A Fast New Hash Function, by Ross Anderson and Eli Biham, proceedings of Fast Software Encryption 3, Cambridge.", "\xce\x55\xa6\xaf\xd5\x91\xf5\xeb\xac\x54\x7f\xf8\x4f\x89\x22\x7f\x93\x31\xda\xb0\xb6\x11\xc8\x89"),
+		HashTestTuple("Tiger - A Fast New Hash Function, by Ross Anderson and Eli Biham, proceedings of Fast Software Encryption 3, Cambridge, 1996.", "\x63\x1a\xbd\xd1\x03\xeb\x9a\x3d\x24\x5b\x6d\xfd\x4d\x77\xb2\x57\xfc\x74\x39\x50\x1d\x15\x68\xdd"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-", "\xc5\x40\x34\xe5\xb4\x3e\xb8\x00\x58\x48\xa7\xe0\xae\x6a\xac\x76\xe4\xff\x59\x0a\xe7\x15\xfd\x25")
+	};
+
+	Tiger tiger;
+
+	return HashModuleTest(tiger, testSet, COUNTOF(testSet));
+}
+
+bool ValidateRIPEMD()
+{
+	const HashTestTuple testSet128[] =
+	{
+		HashTestTuple("", "\xcd\xf2\x62\x13\xa1\x50\xdc\x3e\xcb\x61\x0f\x18\xf6\xb3\x8b\x46"),
+		HashTestTuple("a", "\x86\xbe\x7a\xfa\x33\x9d\x0f\xc7\xcf\xc7\x85\xe7\x2f\x57\x8d\x33"),
+		HashTestTuple("abc", "\xc1\x4a\x12\x19\x9c\x66\xe4\xba\x84\x63\x6b\x0f\x69\x14\x4c\x77"),
+		HashTestTuple("message digest", "\x9e\x32\x7b\x3d\x6e\x52\x30\x62\xaf\xc1\x13\x2d\x7d\xf9\xd1\xb8"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\xfd\x2a\xa6\x07\xf7\x1d\xc8\xf5\x10\x71\x49\x22\xb3\x71\x83\x4e"),
+		HashTestTuple("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "\xa1\xaa\x06\x89\xd0\xfa\xfa\x2d\xdc\x22\xe8\x8b\x49\x13\x3a\x06"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\xd1\xe9\x59\xeb\x17\x9c\x91\x1f\xae\xa4\x62\x4c\x60\xc5\xc7\x02"),
+		HashTestTuple("12345678901234567890123456789012345678901234567890123456789012345678901234567890", "\x3f\x45\xef\x19\x47\x32\xc2\xdb\xb2\xc4\xa2\xc7\x69\x79\x5f\xa3"),
+		HashTestTuple("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "\x4a\x7f\x57\x23\xf9\x54\xeb\xa1\x21\x6c\x9d\x8f\x63\x20\x43\x1f", 15625)
+	};
+
+	const HashTestTuple testSet160[] =
+	{
+		HashTestTuple("", "\x9c\x11\x85\xa5\xc5\xe9\xfc\x54\x61\x28\x08\x97\x7e\xe8\xf5\x48\xb2\x25\x8d\x31"),
+		HashTestTuple("a", "\x0b\xdc\x9d\x2d\x25\x6b\x3e\xe9\xda\xae\x34\x7b\xe6\xf4\xdc\x83\x5a\x46\x7f\xfe"),
+		HashTestTuple("abc", "\x8e\xb2\x08\xf7\xe0\x5d\x98\x7a\x9b\x04\x4a\x8e\x98\xc6\xb0\x87\xf1\x5a\x0b\xfc"),
+		HashTestTuple("message digest", "\x5d\x06\x89\xef\x49\xd2\xfa\xe5\x72\xb8\x81\xb1\x23\xa8\x5f\xfa\x21\x59\x5f\x36"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\xf7\x1c\x27\x10\x9c\x69\x2c\x1b\x56\xbb\xdc\xeb\x5b\x9d\x28\x65\xb3\x70\x8d\xbc"),
+		HashTestTuple("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "\x12\xa0\x53\x38\x4a\x9c\x0c\x88\xe4\x05\xa0\x6c\x27\xdc\xf4\x9a\xda\x62\xeb\x2b"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\xb0\xe2\x0b\x6e\x31\x16\x64\x02\x86\xed\x3a\x87\xa5\x71\x30\x79\xb2\x1f\x51\x89"),
+		HashTestTuple("12345678901234567890123456789012345678901234567890123456789012345678901234567890", "\x9b\x75\x2e\x45\x57\x3d\x4b\x39\xf4\xdb\xd3\x32\x3c\xab\x82\xbf\x63\x32\x6b\xfb"),
+		HashTestTuple("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "\x52\x78\x32\x43\xc1\x69\x7b\xdb\xe1\x6d\x37\xf9\x7f\x68\xf0\x83\x25\xdc\x15\x28", 15625)
+	};
+
+	const HashTestTuple testSet256[] =
+	{
+		HashTestTuple("", "\x02\xba\x4c\x4e\x5f\x8e\xcd\x18\x77\xfc\x52\xd6\x4d\x30\xe3\x7a\x2d\x97\x74\xfb\x1e\x5d\x02\x63\x80\xae\x01\x68\xe3\xc5\x52\x2d"),
+		HashTestTuple("a", "\xf9\x33\x3e\x45\xd8\x57\xf5\xd9\x0a\x91\xba\xb7\x0a\x1e\xba\x0c\xfb\x1b\xe4\xb0\x78\x3c\x9a\xcf\xcd\x88\x3a\x91\x34\x69\x29\x25"),
+		HashTestTuple("abc", "\xaf\xbd\x6e\x22\x8b\x9d\x8c\xbb\xce\xf5\xca\x2d\x03\xe6\xdb\xa1\x0a\xc0\xbc\x7d\xcb\xe4\x68\x0e\x1e\x42\xd2\xe9\x75\x45\x9b\x65"),
+		HashTestTuple("message digest", "\x87\xe9\x71\x75\x9a\x1c\xe4\x7a\x51\x4d\x5c\x91\x4c\x39\x2c\x90\x18\xc7\xc4\x6b\xc1\x44\x65\x55\x4a\xfc\xdf\x54\xa5\x07\x0c\x0e"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\x64\x9d\x30\x34\x75\x1e\xa2\x16\x77\x6b\xf9\xa1\x8a\xcc\x81\xbc\x78\x96\x11\x8a\x51\x97\x96\x87\x82\xdd\x1f\xd9\x7d\x8d\x51\x33"),
+		HashTestTuple("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "\x38\x43\x04\x55\x83\xaa\xc6\xc8\xc8\xd9\x12\x85\x73\xe7\xa9\x80\x9a\xfb\x2a\x0f\x34\xcc\xc3\x6e\xa9\xe7\x2f\x16\xf6\x36\x8e\x3f"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\x57\x40\xa4\x08\xac\x16\xb7\x20\xb8\x44\x24\xae\x93\x1c\xbb\x1f\xe3\x63\xd1\xd0\xbf\x40\x17\xf1\xa8\x9f\x7e\xa6\xde\x77\xa0\xb8"),
+		HashTestTuple("12345678901234567890123456789012345678901234567890123456789012345678901234567890", "\x06\xfd\xcc\x7a\x40\x95\x48\xaa\xf9\x13\x68\xc0\x6a\x62\x75\xb5\x53\xe3\xf0\x99\xbf\x0e\xa4\xed\xfd\x67\x78\xdf\x89\xa8\x90\xdd"),
+		HashTestTuple("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "\xac\x95\x37\x44\xe1\x0e\x31\x51\x4c\x15\x0d\x4d\x8d\x7b\x67\x73\x42\xe3\x33\x99\x78\x82\x96\xe4\x3a\xe4\x85\x0c\xe4\xf9\x79\x78", 15625)
+	};
+
+	const HashTestTuple testSet320[] =
+	{
+		HashTestTuple("", "\x22\xd6\x5d\x56\x61\x53\x6c\xdc\x75\xc1\xfd\xf5\xc6\xde\x7b\x41\xb9\xf2\x73\x25\xeb\xc6\x1e\x85\x57\x17\x7d\x70\x5a\x0e\xc8\x80\x15\x1c\x3a\x32\xa0\x08\x99\xb8"),
+		HashTestTuple("a", "\xce\x78\x85\x06\x38\xf9\x26\x58\xa5\xa5\x85\x09\x75\x79\x92\x6d\xda\x66\x7a\x57\x16\x56\x2c\xfc\xf6\xfb\xe7\x7f\x63\x54\x2f\x99\xb0\x47\x05\xd6\x97\x0d\xff\x5d"),
+		HashTestTuple("abc", "\xde\x4c\x01\xb3\x05\x4f\x89\x30\xa7\x9d\x09\xae\x73\x8e\x92\x30\x1e\x5a\x17\x08\x5b\xef\xfd\xc1\xb8\xd1\x16\x71\x3e\x74\xf8\x2f\xa9\x42\xd6\x4c\xdb\xc4\x68\x2d"),
+		HashTestTuple("message digest", "\x3a\x8e\x28\x50\x2e\xd4\x5d\x42\x2f\x68\x84\x4f\x9d\xd3\x16\xe7\xb9\x85\x33\xfa\x3f\x2a\x91\xd2\x9f\x84\xd4\x25\xc8\x8d\x6b\x4e\xff\x72\x7d\xf6\x6a\x7c\x01\x97"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\xca\xbd\xb1\x81\x0b\x92\x47\x0a\x20\x93\xaa\x6b\xce\x05\x95\x2c\x28\x34\x8c\xf4\x3f\xf6\x08\x41\x97\x51\x66\xbb\x40\xed\x23\x40\x04\xb8\x82\x44\x63\xe6\xb0\x09"),
+		HashTestTuple("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "\xd0\x34\xa7\x95\x0c\xf7\x22\x02\x1b\xa4\xb8\x4d\xf7\x69\xa5\xde\x20\x60\xe2\x59\xdf\x4c\x9b\xb4\xa4\x26\x8c\x0e\x93\x5b\xbc\x74\x70\xa9\x69\xc9\xd0\x72\xa1\xac"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\xed\x54\x49\x40\xc8\x6d\x67\xf2\x50\xd2\x32\xc3\x0b\x7b\x3e\x57\x70\xe0\xc6\x0c\x8c\xb9\xa4\xca\xfe\x3b\x11\x38\x8a\xf9\x92\x0e\x1b\x99\x23\x0b\x84\x3c\x86\xa4"),
+		HashTestTuple("12345678901234567890123456789012345678901234567890123456789012345678901234567890", "\x55\x78\x88\xaf\x5f\x6d\x8e\xd6\x2a\xb6\x69\x45\xc6\xd2\xa0\xa4\x7e\xcd\x53\x41\xe9\x15\xeb\x8f\xea\x1d\x05\x24\x95\x5f\x82\x5d\xc7\x17\xe4\xa0\x08\xab\x2d\x42"),
+		HashTestTuple("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "\xbd\xee\x37\xf4\x37\x1e\x20\x64\x6b\x8b\x0d\x86\x2d\xda\x16\x29\x2a\xe3\x6f\x40\x96\x5e\x8c\x85\x09\xe6\x3d\x1d\xbd\xde\xcc\x50\x3e\x2b\x63\xeb\x92\x45\xbb\x66", 15625)
+	};
+
+	bool pass = true;
+
+	std::cout << "\nRIPEMD-128 validation suite running...\n\n";
+	RIPEMD128 md128;
+	pass = HashModuleTest(md128, testSet128, COUNTOF(testSet128)) && pass;
+
+	std::cout << "\nRIPEMD-160 validation suite running...\n\n";
+	RIPEMD160 md160;
+	pass = HashModuleTest(md160, testSet160, COUNTOF(testSet160)) && pass;
+
+	std::cout << "\nRIPEMD-256 validation suite running...\n\n";
+	RIPEMD256 md256;
+	pass = HashModuleTest(md256, testSet256, COUNTOF(testSet256)) && pass;
+
+	std::cout << "\nRIPEMD-320 validation suite running...\n\n";
+	RIPEMD320 md320;
+	pass = HashModuleTest(md320, testSet320, COUNTOF(testSet320)) && pass;
+
+	return pass;
+}
+
+#ifdef CRYPTOPP_REMOVED
+bool ValidateHAVAL()
+{
+	const HashTestTuple testSet[] =
+	{
+		HashTestTuple("", "\xC6\x8F\x39\x91\x3F\x90\x1F\x3D\xDF\x44\xC7\x07\x35\x7A\x7D\x70"),
+		HashTestTuple("a", "\x4D\xA0\x8F\x51\x4A\x72\x75\xDB\xC4\xCE\xCE\x4A\x34\x73\x85\x98\x39\x83\xA8\x30"),
+		HashTestTuple("HAVAL", "\x0C\x13\x96\xD7\x77\x26\x89\xC4\x67\x73\xF3\xDA\xAC\xA4\xEF\xA9\x82\xAD\xBF\xB2\xF1\x46\x7E\xEA"),
+		HashTestTuple("0123456789", "\xBE\xBD\x78\x16\xF0\x9B\xAE\xEC\xF8\x90\x3B\x1B\x9B\xC6\x72\xD9\xFA\x42\x8E\x46\x2B\xA6\x99\xF8\x14\x84\x15\x29"),
+		HashTestTuple("abcdefghijklmnopqrstuvwxyz", "\xC9\xC7\xD8\xAF\xA1\x59\xFD\x9E\x96\x5C\xB8\x3F\xF5\xEE\x6F\x58\xAE\xDA\x35\x2C\x0E\xFF\x00\x55\x48\x15\x3A\x61\x55\x1C\x38\xEE"),
+		HashTestTuple("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\xB4\x5C\xB6\xE6\x2F\x2B\x13\x20\xE4\xF8\xF1\xB0\xB2\x73\xD4\x5A\xDD\x47\xC3\x21\xFD\x23\x99\x9D\xCF\x40\x3A\xC3\x76\x36\xD9\x63")
+	};
+
+	bool pass=true;
+
+	std::cout << "\nHAVAL validation suite running...\n\n";
+	{
+		HAVAL3 md(16);
+		pass = HashModuleTest(md, testSet+0, 1) && pass;
+	}
+	{
+		HAVAL3 md(20);
+		pass = HashModuleTest(md, testSet+1, 1) && pass;
+	}
+	{
+		HAVAL4 md(24);
+		pass = HashModuleTest(md, testSet+2, 1) && pass;
+	}
+	{
+		HAVAL4 md(28);
+		pass = HashModuleTest(md, testSet+3, 1) && pass;
+	}
+	{
+		HAVAL5 md(32);
+		pass = HashModuleTest(md, testSet+4, 1) && pass;
+	}
+	{
+		HAVAL5 md(32);
+		pass = HashModuleTest(md, testSet+5, 1) && pass;
+	}
+
+	return pass;
+}
+#endif
+
+bool ValidatePanama()
+{
+	std::cout << "\nPanama validation suite running...\n";
+	return RunTestDataFile("TestVectors/panama.txt");
+}
+
+bool ValidateWhirlpool()
+{
+	std::cout << "\nWhirlpool validation suite running...\n";
+	return RunTestDataFile("TestVectors/whrlpool.txt");
+}
+
+bool ValidateLSH()
+{
+	std::cout << "\nLSH validation suite running...\n";
+	return RunTestDataFile("TestVectors/lsh.txt");
+}
+
+#ifdef CRYPTOPP_REMOVED
+bool ValidateMD5MAC()
+{
+	const byte keys[2][MD5MAC::KEYLENGTH]={
+		{0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff},
+		{0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10}};
+
+	const char *TestVals[7]={
+		"",
+		"a",
+		"abc",
+		"message digest",
+		"abcdefghijklmnopqrstuvwxyz",
+		"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
+		"12345678901234567890123456789012345678901234567890123456789012345678901234567890"};
+
+	const byte output[2][7][MD5MAC::DIGESTSIZE]={
+		{{0x1f,0x1e,0xf2,0x37,0x5c,0xc0,0xe0,0x84,0x4f,0x98,0xe7,0xe8,0x11,0xa3,0x4d,0xa8},
+		{0x7a,0x76,0xee,0x64,0xca,0x71,0xef,0x23,0x7e,0x26,0x29,0xed,0x94,0x52,0x73,0x65},
+		{0xe8,0x01,0x3c,0x11,0xf7,0x20,0x9d,0x13,0x28,0xc0,0xca,0xa0,0x4f,0xd0,0x12,0xa6},
+		{0xc8,0x95,0x53,0x4f,0x22,0xa1,0x74,0xbc,0x3e,0x6a,0x25,0xa2,0xb2,0xef,0xd6,0x30},
+		{0x91,0x72,0x86,0x7e,0xb6,0x00,0x17,0x88,0x4c,0x6f,0xa8,0xcc,0x88,0xeb,0xe7,0xc9},
+		{0x3b,0xd0,0xe1,0x1d,0x5e,0x09,0x4c,0xb7,0x1e,0x35,0x44,0xac,0xa9,0xb8,0xbf,0xa2},
+		{0x93,0x37,0x16,0x64,0x44,0xcc,0x95,0x35,0xb7,0xd5,0xb8,0x0f,0x91,0xe5,0x29,0xcb}},
+		{{0x2f,0x6e,0x73,0x13,0xbf,0xbb,0xbf,0xcc,0x3a,0x2d,0xde,0x26,0x8b,0x59,0xcc,0x4d},
+		{0x69,0xf6,0xca,0xff,0x40,0x25,0x36,0xd1,0x7a,0xe1,0x38,0x03,0x2c,0x0c,0x5f,0xfd},
+		{0x56,0xd3,0x2b,0x6c,0x34,0x76,0x65,0xd9,0x74,0xd6,0xf7,0x5c,0x3f,0xc6,0xf0,0x40},
+		{0xb8,0x02,0xb2,0x15,0x4e,0x59,0x8b,0x6f,0x87,0x60,0x56,0xc7,0x85,0x46,0x2c,0x0b},
+		{0x5a,0xde,0xf4,0xbf,0xf8,0x04,0xbe,0x08,0x58,0x7e,0x94,0x41,0xcf,0x6d,0xbd,0x57},
+		{0x18,0xe3,0x49,0xa5,0x24,0x44,0xb3,0x0e,0x5e,0xba,0x5a,0xdd,0xdc,0xd9,0xf1,0x8d},
+		{0xf2,0xb9,0x06,0xa5,0xb8,0x4b,0x9b,0x4b,0xbe,0x95,0xed,0x32,0x56,0x4e,0xe7,0xeb}}};
+
+	byte digest[MD5MAC::DIGESTSIZE];
+	bool pass=true, fail;
+	std::ostringstream oss;
+
+	oss << "\nMD5MAC validation suite running...\n";
+
+	for (int k=0; k<2; k++)
+	{
+		MD5MAC mac(keys[k]);
+		oss << "\nKEY: ";
+		for (int j=0;j<MD5MAC::KEYLENGTH;j++)
+			oss << std::setw(2) << std::setfill('0') << std::hex << (int)keys[k][j];
+		oss << std::endl << std::endl;
+		for (int i=0;i<7;i++)
+		{
+			mac.Update((byte *)TestVals[i], strlen(TestVals[i]));
+			mac.Final(digest);
+			fail = std::memcmp(digest, output[k][i], MD5MAC::DIGESTSIZE) != 0
+				 || !mac.VerifyDigest(output[k][i], (byte *)TestVals[i], strlen(TestVals[i]));
+			pass = pass && !fail;
+			oss << (fail ? "FAILED   " : "passed   ");
+			for (int j=0;j<MD5MAC::DIGESTSIZE;j++)
+				oss << std::setw(2) << std::setfill('0') << std::hex << (int)digest[j];
+			oss << "   \"" << TestVals[i] << '\"' << std::endl;
+		}
+	}
+
+	std::cout << oss.str();
+	return pass;
+}
+#endif
+
+bool ValidateHMAC()
+{
+	return RunTestDataFile("TestVectors/hmac.txt");
+}
+
+#ifdef CRYPTOPP_REMOVED
+bool ValidateXMACC()
+{
+	typedef XMACC<MD5> XMACC_MD5;
+
+	const byte keys[2][XMACC_MD5::KEYLENGTH]={
+		{0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb},
+		{0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xfe,0xdc,0xba,0x98}};
+
+	const word32 counters[2]={0xccddeeff, 0x76543210};
+
+	const char *TestVals[7]={
+		"",
+		"a",
+		"abc",
+		"message digest",
+		"abcdefghijklmnopqrstuvwxyz",
+		"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
+		"12345678901234567890123456789012345678901234567890123456789012345678901234567890"};
+
+	const byte output[2][7][XMACC_MD5::DIGESTSIZE]={
+		{{0xcc,0xdd,0xef,0x00,0xfa,0x89,0x54,0x92,0x86,0x32,0xda,0x2a,0x3f,0x29,0xc5,0x52,0xa0,0x0d,0x05,0x13},
+		{0xcc,0xdd,0xef,0x01,0xae,0xdb,0x8b,0x7b,0x69,0x71,0xc7,0x91,0x71,0x48,0x9d,0x18,0xe7,0xdf,0x9d,0x5a},
+		{0xcc,0xdd,0xef,0x02,0x5e,0x01,0x2e,0x2e,0x4b,0xc3,0x83,0x62,0xc2,0xf4,0xe6,0x18,0x1c,0x44,0xaf,0xca},
+		{0xcc,0xdd,0xef,0x03,0x3e,0xa9,0xf1,0xe0,0x97,0x91,0xf8,0xe2,0xbe,0xe0,0xdf,0xf3,0x41,0x03,0xb3,0x5a},
+		{0xcc,0xdd,0xef,0x04,0x2e,0x6a,0x8d,0xb9,0x72,0xe3,0xce,0x9f,0xf4,0x28,0x45,0xe7,0xbc,0x80,0xa9,0xc7},
+		{0xcc,0xdd,0xef,0x05,0x1a,0xd5,0x40,0x78,0xfb,0x16,0x37,0xfc,0x7a,0x1d,0xce,0xb4,0x77,0x10,0xb2,0xa0},
+		{0xcc,0xdd,0xef,0x06,0x13,0x2f,0x11,0x47,0xd7,0x1b,0xb5,0x52,0x36,0x51,0x26,0xb0,0x96,0xd7,0x60,0x81}},
+		{{0x76,0x54,0x32,0x11,0xe9,0xcb,0x74,0x32,0x07,0x93,0xfe,0x01,0xdd,0x27,0xdb,0xde,0x6b,0x77,0xa4,0x56},
+		{0x76,0x54,0x32,0x12,0xcd,0x55,0x87,0x5c,0xc0,0x35,0x85,0x99,0x44,0x02,0xa5,0x0b,0x8c,0xe7,0x2c,0x68},
+		{0x76,0x54,0x32,0x13,0xac,0xfd,0x87,0x50,0xc3,0x8f,0xcd,0x58,0xaa,0xa5,0x7e,0x7a,0x25,0x63,0x26,0xd1},
+		{0x76,0x54,0x32,0x14,0xe3,0x30,0xf5,0xdd,0x27,0x2b,0x76,0x22,0x7f,0xaa,0x90,0x73,0x6a,0x48,0xdb,0x00},
+		{0x76,0x54,0x32,0x15,0xfc,0x57,0x00,0x20,0x7c,0x9d,0xf6,0x30,0x6f,0xbd,0x46,0x3e,0xfb,0x8a,0x2c,0x60},
+		{0x76,0x54,0x32,0x16,0xfb,0x0f,0xd3,0xdf,0x4c,0x4b,0xc3,0x05,0x9d,0x63,0x1e,0xba,0x25,0x2b,0xbe,0x35},
+		{0x76,0x54,0x32,0x17,0xc6,0xfe,0xe6,0x5f,0xb1,0x35,0x8a,0xf5,0x32,0x7a,0x80,0xbd,0xb8,0x72,0xee,0xae}}};
+
+	// Coverity finding, also see http://stackoverflow.com/a/34509163/608639.
+	StreamState ss(std::cout);
+
+	byte digest[XMACC_MD5::DIGESTSIZE];
+	bool pass=true, fail;
+
+	std::cout << "\nXMACC/MD5 validation suite running...\n";
+
+	for (int k=0; k<2; k++)
+	{
+		XMACC_MD5 mac(keys[k], counters[k]);
+		std::cout << "\nKEY: ";
+		for (int j=0;j<XMACC_MD5::KEYLENGTH;j++)
+			std::cout << std::setw(2) << std::setfill('0') << std::hex << (int)keys[k][j];
+		std::cout << "    COUNTER: 0x" << std::hex << counters[k] << std::endl << std::endl;
+		for (int i=0;i<7;i++)
+		{
+			mac.Update((byte *)TestVals[i], strlen(TestVals[i]));
+			mac.Final(digest);
+			fail = std::memcmp(digest, output[k][i], XMACC_MD5::DIGESTSIZE) != 0
+				 || !mac.VerifyDigest(output[k][i], (byte *)TestVals[i], strlen(TestVals[i]));
+			pass = pass && !fail;
+			std::cout << (fail ? "FAILED   " : "passed   ");
+			for (int j=0;j<XMACC_MD5::DIGESTSIZE;j++)
+				std::cout << std::setw(2) << std::setfill('0') << std::hex << (int)digest[j];
+			std::cout << "   \"" << TestVals[i] << '\"' << std::endl;
+		}
+	}
+
+	return pass;
+}
+#endif
+
+bool ValidateTTMAC()
+{
+	const byte key[TTMAC::KEYLENGTH]={
+		0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,
+		0xaa,0xbb,0xcc,0xdd,0xee,0xff,0x01,0x23,0x45,0x67};
+
+	const char *TestVals[8]={
+		"",
+		"a",
+		"abc",
+		"message digest",
+		"abcdefghijklmnopqrstuvwxyz",
+		"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
+		"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
+		"12345678901234567890123456789012345678901234567890123456789012345678901234567890"};
+
+	const byte output[8][TTMAC::DIGESTSIZE]={
+		{0x2d,0xec,0x8e,0xd4,0xa0,0xfd,0x71,0x2e,0xd9,0xfb,0xf2,0xab,0x46,0x6e,0xc2,0xdf,0x21,0x21,0x5e,0x4a},
+		{0x58,0x93,0xe3,0xe6,0xe3,0x06,0x70,0x4d,0xd7,0x7a,0xd6,0xe6,0xed,0x43,0x2c,0xde,0x32,0x1a,0x77,0x56},
+		{0x70,0xbf,0xd1,0x02,0x97,0x97,0xa5,0xc1,0x6d,0xa5,0xb5,0x57,0xa1,0xf0,0xb2,0x77,0x9b,0x78,0x49,0x7e},
+		{0x82,0x89,0xf4,0xf1,0x9f,0xfe,0x4f,0x2a,0xf7,0x37,0xde,0x4b,0xd7,0x1c,0x82,0x9d,0x93,0xa9,0x72,0xfa},
+		{0x21,0x86,0xca,0x09,0xc5,0x53,0x31,0x98,0xb7,0x37,0x1f,0x24,0x52,0x73,0x50,0x4c,0xa9,0x2b,0xae,0x60},
+		{0x8a,0x7b,0xf7,0x7a,0xef,0x62,0xa2,0x57,0x84,0x97,0xa2,0x7c,0x0d,0x65,0x18,0xa4,0x29,0xe7,0xc1,0x4d},
+		{0x54,0xba,0xc3,0x92,0xa8,0x86,0x80,0x6d,0x16,0x95,0x56,0xfc,0xbb,0x67,0x89,0xb5,0x4f,0xb3,0x64,0xfb},
+		{0x0c,0xed,0x2c,0x9f,0x8f,0x0d,0x9d,0x03,0x98,0x1a,0xb5,0xc8,0x18,0x4b,0xac,0x43,0xdd,0x54,0xc4,0x84}};
+
+	byte digest[TTMAC::DIGESTSIZE];
+	bool pass=true, fail;
+	std::ostringstream oss;
+
+	oss << "\nTwo-Track-MAC validation suite running...\n";
+
+	TTMAC mac(key, sizeof(key));
+	for (unsigned int k = 0; k<COUNTOF(TestVals); k++)
+	{
+		mac.Update((byte *)TestVals[k], strlen(TestVals[k]));
+		mac.Final(digest);
+		fail = std::memcmp(digest, output[k], TTMAC::DIGESTSIZE) != 0
+			|| !mac.VerifyDigest(output[k], (byte *)TestVals[k], strlen(TestVals[k]));
+		pass = pass && !fail;
+		oss << (fail ? "FAILED   " : "passed   ");
+		for (int j=0;j<TTMAC::DIGESTSIZE;j++)
+			oss << std::setw(2) << std::setfill('0') << std::hex << (int)digest[j];
+		oss << "   \"" << TestVals[k] << '\"' << std::endl;
+	}
+
+	std::cout << oss.str();
+	return true;
+}
+
+struct PBKDF_TestTuple
+{
+	byte purpose;
+	unsigned int iterations;
+	const char *hexPassword, *hexSalt, *hexDerivedKey;
+};
+
+bool TestPBKDF(KeyDerivationFunction &pbkdf, const PBKDF_TestTuple *testSet, size_t testSetSize)
+{
+	bool pass = true;
+
+	for (size_t i=0; i<testSetSize; i++)
+	{
+		const PBKDF_TestTuple &tuple = testSet[i];
+
+		std::string password, salt, derivedKey;
+		StringSource(tuple.hexPassword, true, new HexDecoder(new StringSink(password)));
+		StringSource(tuple.hexSalt, true, new HexDecoder(new StringSink(salt)));
+		StringSource(tuple.hexDerivedKey, true, new HexDecoder(new StringSink(derivedKey)));
+
+		double timeInSeconds = 0.0f;
+		AlgorithmParameters params = MakeParameters("Purpose", (int)tuple.purpose)
+		    (Name::Salt(), ConstByteArrayParameter(ConstBytePtr(salt), BytePtrSize(salt)))
+		    ("Iterations", (int)tuple.iterations)("TimeInSeconds", timeInSeconds);
+
+		SecByteBlock derived(derivedKey.size());
+		pbkdf.DeriveKey(derived, derived.size(), ConstBytePtr(password), BytePtrSize(password), params);
+		bool fail = std::memcmp(derived, derivedKey.data(), derived.size()) != 0;
+		pass = pass && !fail;
+
+		HexEncoder enc(new FileSink(std::cout));
+		std::cout << (fail ? "FAILED   " : "passed   ");
+		enc.Put(tuple.purpose);
+		std::cout << " " << tuple.iterations;
+		std::cout << " " << tuple.hexPassword << " " << tuple.hexSalt << " ";
+		enc.Put(derived, derived.size());
+		std::cout << std::endl;
+	}
+
+	return pass;
+}
+
+bool ValidatePBKDF()
+{
+	bool pass = true;
+
+	{
+	// from OpenSSL PKCS #12 Program FAQ v1.77, at http://www.drh-consultancy.demon.co.uk/test.txt
+	PBKDF_TestTuple testSet[] =
+	{
+		{1, 1, "0073006D006500670000", "0A58CF64530D823F", "8AAAE6297B6CB04642AB5B077851284EB7128F1A2A7FBCA3"},
+		{2, 1, "0073006D006500670000", "0A58CF64530D823F", "79993DFE048D3B76"},
+		{1, 1, "0073006D006500670000", "642B99AB44FB4B1F", "F3A95FEC48D7711E985CFE67908C5AB79FA3D7C5CAA5D966"},
+		{2, 1, "0073006D006500670000", "642B99AB44FB4B1F", "C0A38D64A79BEA1D"},
+		{3, 1, "0073006D006500670000", "3D83C0E4546AC140", "8D967D88F6CAA9D714800AB3D48051D63F73A312"},
+		{1, 1000, "007100750065006500670000", "05DEC959ACFF72F7", "ED2034E36328830FF09DF1E1A07DD357185DAC0D4F9EB3D4"},
+		{2, 1000, "007100750065006500670000", "05DEC959ACFF72F7", "11DEDAD7758D4860"},
+		{1, 1000, "007100750065006500670000", "1682C0FC5B3F7EC5", "483DD6E919D7DE2E8E648BA8F862F3FBFBDC2BCB2C02957F"},
+		{2, 1000, "007100750065006500670000", "1682C0FC5B3F7EC5", "9D461D1B00355C50"},
+		{3, 1000, "007100750065006500670000", "263216FCC2FAB31C", "5EC4C7A80DF652294C3925B6489A7AB857C83476"}
+	};
+
+	PKCS12_PBKDF<SHA1> pbkdf;
+
+	std::cout << "\nPKCS #12 PBKDF validation suite running...\n\n";
+	pass = TestPBKDF(pbkdf, testSet, COUNTOF(testSet)) && pass;
+	}
+
+	{
+	// from draft-ietf-smime-password-03.txt, at http://www.imc.org/draft-ietf-smime-password
+	PBKDF_TestTuple testSet[] =
+	{
+		{0, 5, "70617373776f7264", "1234567878563412", "D1DAA78615F287E6"},
+		{0, 500, "416C6C206E2D656E746974696573206D75737420636F6D6D756E69636174652077697468206F74686572206E2d656E74697469657320766961206E2D3120656E746974656568656568656573", "1234567878563412","6A8970BF68C92CAEA84A8DF28510858607126380CC47AB2D"}
+	};
+
+	PKCS5_PBKDF2_HMAC<SHA1> pbkdf;
+
+	std::cout << "\nPKCS #5 PBKDF2 validation suite running...\n\n";
+	pass = TestPBKDF(pbkdf, testSet, COUNTOF(testSet)) && pass;
+	}
+
+	return pass;
+}
+
+struct HKDF_TestTuple
+{
+	const char *hexSecret, *hexSalt, *hexInfo, *hexExpected;
+	size_t len;
+};
+
+bool TestHKDF(KeyDerivationFunction &kdf, const HKDF_TestTuple *testSet, size_t testSetSize)
+{
+	bool pass = true;
+
+	for (size_t i=0; i<testSetSize; i++)
+	{
+		const HKDF_TestTuple &tuple = testSet[i];
+
+		std::string secret, salt, info, expected;
+		StringSource(tuple.hexSecret, true, new HexDecoder(new StringSink(secret)));
+		StringSource(tuple.hexSalt ? tuple.hexSalt : "", true, new HexDecoder(new StringSink(salt)));
+		StringSource(tuple.hexInfo ? tuple.hexInfo : "", true, new HexDecoder(new StringSink(info)));
+		StringSource(tuple.hexExpected, true, new HexDecoder(new StringSink(expected)));
+		SecByteBlock derived(expected.size());
+
+		AlgorithmParameters params;
+		if (tuple.hexSalt)
+			params(Name::Salt(), ConstByteArrayParameter(ConstBytePtr(salt), BytePtrSize(salt)));
+		if (tuple.hexSalt)
+			params("Info", ConstByteArrayParameter(ConstBytePtr(info), BytePtrSize(info)));
+
+		kdf.DeriveKey(derived, derived.size(), ConstBytePtr(secret), BytePtrSize(secret), params);
+
+		bool fail = !VerifyBufsEqual(derived, ConstBytePtr(expected), BytePtrSize(expected));
+		pass = pass && !fail;
+
+		HexEncoder enc(new FileSink(std::cout));
+		std::cout << (fail ? "FAILED   " : "passed   ");
+		std::cout << " " << tuple.hexSecret << " ";
+		std::cout << (tuple.hexSalt ? (strlen(tuple.hexSalt) ? tuple.hexSalt : "<0-LEN SALT>") : "<NO SALT>");
+		std::cout << " ";
+		std::cout << (tuple.hexInfo ? (strlen(tuple.hexInfo) ? tuple.hexInfo : "<0-LEN INFO>") : "<NO INFO>");
+		std::cout << " ";
+		enc.Put(derived, derived.size());
+		std::cout << std::endl;
+	}
+
+	return pass;
+}
+
+bool ValidateHKDF()
+{
+	bool pass = true;
+
+	{
+	// SHA-1 from RFC 5869, Appendix A, https://tools.ietf.org/html/rfc5869
+	const HKDF_TestTuple testSet[] =
+	{
+		// Test Case #4
+		{"0b0b0b0b0b0b0b0b0b0b0b", "000102030405060708090a0b0c", "f0f1f2f3f4f5f6f7f8f9", "085a01ea1b10f36933068b56efa5ad81 a4f14b822f5b091568a9cdd4f155fda2 c22e422478d305f3f896", 42},
+		// Test Case #5
+		{"000102030405060708090a0b0c0d0e0f 101112131415161718191a1b1c1d1e1f 202122232425262728292a2b2c2d2e2f 303132333435363738393a3b3c3d3e3f 404142434445464748494a4b4c4d4e4f", "606162636465666768696a6b6c6d6e6f 707172737475767778797a7b7c7d7e7f 808182838485868788898a8b8c8d8e8f 909192939495969798999a9b9c9d9e9f a0a1a2a3a4a5a6a7a8a9aaabacadaeaf", "b0b1b2b3b4b5b6b7b8b9babbbcbdbebf c0c1c2c3c4c5c6c7c8c9cacbcccdcecf d0d1d2d3d4d5d6d7d8d9dadbdcdddedf e0e1e2e3e4e5e6e7e8e9eaebecedeeef f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff", "0bd770a74d1160f7c9f12cd5912a06eb ff6adcae899d92191fe4305673ba2ffe 8fa3f1a4e5ad79f3f334b3b202b2173c 486ea37ce3d397ed034c7f9dfeb15c5e 927336d0441f4c4300e2cff0d0900b52 d3b4", 82},
+		// Test Case #6
+		{"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b", "", "", "0ac1af7002b3d761d1e55298da9d0506 b9ae52057220a306e07b6b87e8df21d0 ea00033de03984d34918", 42},
+		// Test Case #7
+		{"0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c", NULLPTR, "", "2c91117204d745f3500d636a62f64f0 ab3bae548aa53d423b0d1f27ebba6f5e5 673a081d70cce7acfc48", 42}
+	};
+
+	HKDF<SHA1> hkdf;
+
+	std::cout << "\nRFC 5869 HKDF(SHA-1) validation suite running...\n\n";
+	pass = TestHKDF(hkdf, testSet, COUNTOF(testSet)) && pass;
+	}
+
+	{
+	// SHA-256 from RFC 5869, Appendix A, https://tools.ietf.org/html/rfc5869
+	const HKDF_TestTuple testSet[] =
+	{
+		// Test Case #1
+		{"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b", "000102030405060708090a0b0c", "f0f1f2f3f4f5f6f7f8f9", "3cb25f25faacd57a90434f64d0362f2a 2d2d0a90cf1a5a4c5db02d56ecc4c5bf 34007208d5b887185865", 42},
+		// Test Case #2
+		{"000102030405060708090a0b0c0d0e0f 101112131415161718191a1b1c1d1e1f 202122232425262728292a2b2c2d2e2f 303132333435363738393a3b3c3d3e3f 404142434445464748494a4b4c4d4e4f", "606162636465666768696a6b6c6d6e6f 707172737475767778797a7b7c7d7e7f 808182838485868788898a8b8c8d8e8f 909192939495969798999a9b9c9d9e9f a0a1a2a3a4a5a6a7a8a9aaabacadaeaf", "b0b1b2b3b4b5b6b7b8b9babbbcbdbebf c0c1c2c3c4c5c6c7c8c9cacbcccdcecf d0d1d2d3d4d5d6d7d8d9dadbdcdddedf e0e1e2e3e4e5e6e7e8e9eaebecedeeef f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff", "b11e398dc80327a1c8e7f78c596a4934 4f012eda2d4efad8a050cc4c19afa97c 59045a99cac7827271cb41c65e590e09 da3275600c2f09b8367793a9aca3db71 cc30c58179ec3e87c14c01d5c1f3434f 1d87", 82},
+		// Test Case #3
+		{"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b", "", "", "8da4e775a563c18f715f802a063c5a31 b8a11f5c5ee1879ec3454e5f3c738d2d 9d201395faa4b61a96c8", 42}
+	};
+
+	HKDF<SHA256> hkdf;
+
+	std::cout << "\nRFC 5869 HKDF(SHA-256) validation suite running...\n\n";
+	pass = TestHKDF(hkdf, testSet, COUNTOF(testSet)) && pass;
+	}
+
+	{
+	// SHA-512, Crypto++ generated, based on RFC 5869, https://tools.ietf.org/html/rfc5869
+	const HKDF_TestTuple testSet[] =
+	{
+		// Test Case #0
+		{"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b", "000102030405060708090a0b0c", "f0f1f2f3f4f5f6f7f8f9", "832390086CDA71FB47625BB5CEB168E4 C8E26A1A16ED34D9FC7FE92C14815793 38DA362CB8D9F925D7CB", 42},
+		// Test Case #0
+		{"000102030405060708090a0b0c0d0e0f 101112131415161718191a1b1c1d1e1f 202122232425262728292a2b2c2d2e2f 303132333435363738393a3b3c3d3e3f 404142434445464748494a4b4c4d4e4f", "606162636465666768696a6b6c6d6e6f 707172737475767778797a7b7c7d7e7f 808182838485868788898a8b8c8d8e8f 909192939495969798999a9b9c9d9e9f a0a1a2a3a4a5a6a7a8a9aaabacadaeaf", "b0b1b2b3b4b5b6b7b8b9babbbcbdbebf c0c1c2c3c4c5c6c7c8c9cacbcccdcecf d0d1d2d3d4d5d6d7d8d9dadbdcdddedf e0e1e2e3e4e5e6e7e8e9eaebecedeeef f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff", "CE6C97192805B346E6161E821ED16567 3B84F400A2B514B2FE23D84CD189DDF1 B695B48CBD1C8388441137B3CE28F16A A64BA33BA466B24DF6CFCB021ECFF235 F6A2056CE3AF1DE44D572097A8505D9E 7A93", 82},
+		// Test Case #0
+		{"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b", "", "", "F5FA02B18298A72A8C23898A8703472C 6EB179DC204C03425C970E3B164BF90F FF22D04836D0E2343BAC", 42},
+		// Test Case #0
+		{"0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c", NULLPTR, "", "1407D46013D98BC6DECEFCFEE55F0F90 B0C7F63D68EB1A80EAF07E953CFC0A3A 5240A155D6E4DAA965BB", 42}
+	};
+
+	HKDF<SHA512> hkdf;
+
+	std::cout << "\nRFC 5869 HKDF(SHA-512) validation suite running...\n\n";
+	pass = TestHKDF(hkdf, testSet, COUNTOF(testSet)) && pass;
+	}
+
+	{
+	// Whirlpool, Crypto++ generated, based on RFC 5869, https://tools.ietf.org/html/rfc5869
+	const HKDF_TestTuple testSet[] =
+	{
+		// Test Case #0
+		{"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b", "000102030405060708090a0b0c", "f0f1f2f3f4f5f6f7f8f9", "0D29F74CCD8640F44B0DD9638111C1B5 766EFED752AF358109E2E7C9CD4A28EF 2F90B2AD461FBA0744D4", 42},
+		// Test Case #0
+		{"000102030405060708090a0b0c0d0e0f 101112131415161718191a1b1c1d1e1f 202122232425262728292a2b2c2d2e2f 303132333435363738393a3b3c3d3e3f 404142434445464748494a4b4c4d4e4f", "606162636465666768696a6b6c6d6e6f 707172737475767778797a7b7c7d7e7f 808182838485868788898a8b8c8d8e8f 909192939495969798999a9b9c9d9e9f a0a1a2a3a4a5a6a7a8a9aaabacadaeaf", "b0b1b2b3b4b5b6b7b8b9babbbcbdbebf c0c1c2c3c4c5c6c7c8c9cacbcccdcecf d0d1d2d3d4d5d6d7d8d9dadbdcdddedf e0e1e2e3e4e5e6e7e8e9eaebecedeeef f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff", "4EBE4FE2DCCEC42661699500BE279A99 3FED90351E19373B3926FAA3A410700B2 BBF77E254CF1451AE6068D64A0904D96 6F4FF25498445A501B88F50D21E3A68A8 90E09445DC5886DD00E7F4F7C58A5121 70", 82},
+		// Test Case #0
+		{"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b", "", "", "110632D0F7AEFAC31771FC66C22BB346 2614B81E4B04BA7F2B662E0BD694F564 58615F9A9CB56C57ECF2", 42},
+		// Test Case #0
+		{"0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c" /*key*/, NULLPTR /*salt*/, "" /*info*/, "4089286EBFB23DD8A02F0C9DAA35D538 EB09CD0A8CBAB203F39083AA3E0BD313 E6F91E64F21A187510B0", 42}
+	};
+
+	HKDF<Whirlpool> hkdf;
+
+	std::cout << "\nRFC 5869 HKDF(Whirlpool) validation suite running...\n\n";
+	pass = TestHKDF(hkdf, testSet, COUNTOF(testSet)) && pass;
+	}
+
+	return pass;
+}
+
+struct Scrypt_TestTuple
+{
+	const char * passwd;
+	const char * salt;
+	word64 n;
+	word32 r;
+	word32 p;
+	const char * expect;
+};
+
+bool TestScrypt(KeyDerivationFunction &pbkdf, const Scrypt_TestTuple *testSet, size_t testSetSize)
+{
+	bool pass = true;
+
+	for (size_t i=0; i<testSetSize; i++)
+	{
+		const Scrypt_TestTuple &tuple = testSet[i];
+
+		std::string password(tuple.passwd), salt(tuple.salt), expect;
+		StringSource(tuple.expect, true, new HexDecoder(new StringSink(expect)));
+
+		AlgorithmParameters params = MakeParameters("Cost", (word64)tuple.n)
+			("BlockSize", (word64)tuple.r)("Parallelization", (word64)tuple.p)
+			(Name::Salt(), ConstByteArrayParameter(ConstBytePtr(salt), BytePtrSize(salt)));
+
+		SecByteBlock derived(expect.size());
+		pbkdf.DeriveKey(derived, derived.size(), ConstBytePtr(password), BytePtrSize(password), params);
+		bool fail = std::memcmp(derived, expect.data(), expect.size()) != 0;
+		pass = pass && !fail;
+
+		if (password.empty()) {password="\"\"";}
+		if (salt.empty()) {salt="\"\"";}
+
+		HexEncoder enc(new FileSink(std::cout));
+		std::cout << (fail ? "FAILED   " : "passed   ");
+		std::cout << " " << password << " " << salt << " ";
+		std::cout << " " << tuple.n << " " << tuple.r;
+		std::cout << " " << tuple.p << " ";
+		enc.Put(derived, derived.size());
+		std::cout << std::endl;
+	}
+
+	return pass;
+}
+
+bool ValidateScrypt()
+{
+	bool pass = true;
+
+	// https://tools.ietf.org/html/rfc7914
+	const Scrypt_TestTuple testSet[] =
+	{
+			{ "", "", 16, 1, 1, "77d6576238657b203b19ca42c18a0497f16b4844e3074ae8dfdffa3fede21442fcd0069ded0948f8326a753a0fc81f17e8d3e0fb2e0d3628cf35e20c38d18906"},
+			{ "password", "NaCl", 1024, 8, 16, "fdbabe1c9d3472007856e7190d01e9fe7c6ad7cbc8237830e77376634b3731622eaf30d92e22a3886ff109279d9830dac727afb94a83ee6d8360cbdfa2cc0640"},
+			{ "pleaseletmein", "SodiumChloride", 16384, 8, 1, "7023bdcb3afd7348461c06cd81fd38ebfda8fbba904f8e3ea9b543f6545da1f2d5432955613f0fcf62d49705242a9af9e61e85dc0d651e40dfcf017b45575887"},
+#ifndef CRYPTOPP_DEBUG
+			// This one takes too long in debug builds
+			// { "pleaseletmein", "SodiumChloride", 1048576, 8, 1, "2101cb9b6a511aaeaddbbe09cf70f881ec568d574a2ffd4dabe5ee9820adaa478e56fd8f4ba5d09ffa1c6d927c40f4c337304049e8a952fbcbf45c6fa77a41a4"}
+#endif
+	};
+
+	Scrypt pbkdf;
+
+	std::cout << "\nRFC 7914 Scrypt validation suite running...\n\n";
+	pass = TestScrypt(pbkdf, testSet, COUNTOF(testSet)) && pass;
+
+	return pass;
+}
+
+struct Poly1305_TestTuples
+{
+	const char *key, *message, *nonce, *digest;
+	size_t klen, mlen, nlen, dlen;
+};
+
+bool ValidatePoly1305()
+{
+	std::cout << "\nPoly1305 validation suite running...\n\n";
+	bool fail, pass = true;
+
+	{
+		fail = (Poly1305<AES>::StaticAlgorithmName() != "Poly1305(AES)");
+		std::cout << (fail ? "FAILED   " : "passed   ") << "algorithm name\n";
+		pass = pass && !fail;
+	}
+
+	// Test data from http://cr.yp.to/mac/poly1305-20050329.pdf
+	const Poly1305_TestTuples tests[] =
+	{
+		// Appendix B, Test 1
+		{
+			"\xec\x07\x4c\x83\x55\x80\x74\x17\x01\x42\x5b\x62\x32\x35\xad\xd6"   // Key
+			"\x85\x1f\xc4\x0c\x34\x67\xac\x0b\xe0\x5c\xc2\x04\x04\xf3\xf7\x00",
+			"\xf3\xf6",                                                          // Message
+			"\xfb\x44\x73\x50\xc4\xe8\x68\xc5\x2a\xc3\x27\x5c\xf9\xd4\x32\x7e",  // Nonce
+			"\xf4\xc6\x33\xc3\x04\x4f\xc1\x45\xf8\x4f\x33\x5c\xb8\x19\x53\xde",  // Digest
+			32, 2, 16, 16
+		},
+		// Appendix B, Test 2
+		{
+			"\x75\xde\xaa\x25\xc0\x9f\x20\x8e\x1d\xc4\xce\x6b\x5c\xad\x3f\xbf"   // Key
+			"\x61\xee\x09\x21\x8d\x29\xb0\xaa\xed\x7e\x15\x4a\x2c\x55\x09\xcc",
+			"",                                                                  // Message
+			"\x61\xee\x09\x21\x8d\x29\xb0\xaa\xed\x7e\x15\x4a\x2c\x55\x09\xcc",  // Nonce
+			"\xdd\x3f\xab\x22\x51\xf1\x1a\xc7\x59\xf0\x88\x71\x29\xcc\x2e\xe7",  // Digest
+			32, 0, 16, 16
+		},
+		// Appendix B, Test 3
+		{
+			"\x6a\xcb\x5f\x61\xa7\x17\x6d\xd3\x20\xc5\xc1\xeb\x2e\xdc\xdc\x74"   // Key
+			"\x48\x44\x3d\x0b\xb0\xd2\x11\x09\xc8\x9a\x10\x0b\x5c\xe2\xc2\x08",
+			"\x66\x3c\xea\x19\x0f\xfb\x83\xd8\x95\x93\xf3\xf4\x76\xb6\xbc\x24"   // Message
+			"\xd7\xe6\x79\x10\x7e\xa2\x6a\xdb\x8c\xaf\x66\x52\xd0\x65\x61\x36",
+			"\xae\x21\x2a\x55\x39\x97\x29\x59\x5d\xea\x45\x8b\xc6\x21\xff\x0e",  // Nonce
+			"\x0e\xe1\xc1\x6b\xb7\x3f\x0f\x4f\xd1\x98\x81\x75\x3c\x01\xcd\xbe",  // Digest
+			32, 32, 16, 16
+		},
+		// Appendix B, Test 4
+		{
+			"\xe1\xa5\x66\x8a\x4d\x5b\x66\xa5\xf6\x8c\xc5\x42\x4e\xd5\x98\x2d"   // Key
+			"\x12\x97\x6a\x08\xc4\x42\x6d\x0c\xe8\xa8\x24\x07\xc4\xf4\x82\x07",
+			"\xab\x08\x12\x72\x4a\x7f\x1e\x34\x27\x42\xcb\xed\x37\x4d\x94\xd1"   // Message
+			"\x36\xc6\xb8\x79\x5d\x45\xb3\x81\x98\x30\xf2\xc0\x44\x91\xfa\xf0"
+			"\x99\x0c\x62\xe4\x8b\x80\x18\xb2\xc3\xe4\xa0\xfa\x31\x34\xcb\x67"
+			"\xfa\x83\xe1\x58\xc9\x94\xd9\x61\xc4\xcb\x21\x09\x5c\x1b\xf9",
+			"\x9a\xe8\x31\xe7\x43\x97\x8d\x3a\x23\x52\x7c\x71\x28\x14\x9e\x3a",  // Nonce
+			"\x51\x54\xad\x0d\x2c\xb2\x6e\x01\x27\x4f\xc5\x11\x48\x49\x1f\x1b",  // Digest
+			32, 63, 16, 16
+		}
+	};
+
+	unsigned int count = 0;
+	byte digest[Poly1305<AES>::DIGESTSIZE];
+
+	// Positive tests
+	for (size_t i=0; i<COUNTOF(tests); ++i)
+	{
+		Poly1305<AES> poly1305((const byte*)tests[i].key, tests[i].klen);
+		poly1305.Resynchronize((const byte*)tests[i].nonce, (int)tests[i].nlen);
+		poly1305.Update((const byte*)tests[i].message, tests[i].mlen);
+		poly1305.Final(digest);
+
+		fail = std::memcmp(digest, tests[i].digest, tests[i].dlen) != 0;
+		if (fail)
+		{
+			std::cout << "FAILED   " << "Poly1305 test set " << count << std::endl;
+		}
+
+		count++;
+		pass = pass && !fail;
+	}
+
+	// Positive tests
+	for (size_t i=0; i<COUNTOF(tests); ++i)
+	{
+		Poly1305<AES> poly1305((const byte*)tests[i].key, tests[i].klen,(const byte*)tests[i].nonce, (int)tests[i].nlen);
+		poly1305.Update((const byte*)tests[i].message, tests[i].mlen);
+		poly1305.Final(digest);
+
+		fail = std::memcmp(digest, tests[i].digest, tests[i].dlen) != 0;
+		if (fail)
+		{
+			std::cout << "FAILED   " << "Poly1305 test set " << count << std::endl;
+		}
+
+		count++;
+		pass = pass && !fail;
+	}
+
+	// Negative tests
+	for (size_t i=0; i<COUNTOF(tests); ++i)
+	{
+		Poly1305<AES> poly1305((const byte*)tests[i].key, tests[i].klen);
+		poly1305.Resynchronize((const byte*)tests[i].nonce, (int)tests[i].nlen);
+		poly1305.Update((const byte*)tests[i].message, tests[i].mlen);
+		poly1305.Final(digest);
+
+		unsigned int next = (i+1) % COUNTOF(tests);
+		fail = std::memcmp(digest, tests[next].digest, tests[next].dlen) == 0;
+		if (fail)
+		{
+			std::cout << "FAILED   " << "Poly1305 test set " << count << std::endl;
+		}
+
+		count++;
+		pass = pass && !fail;
+	}
+
+	std::cout << (!pass ? "FAILED   " : "passed   ") << count << " message authentication codes" << std::endl;
+
+	return pass;
+}
+
+bool ValidateSipHash()
+{
+	std::cout << "\nSipHash validation suite running...\n\n";
+	bool fail, pass = true, pass1=true, pass2=true, pass3=true, pass4=true;
+
+	{
+		fail = (SipHash<2,4>::StaticAlgorithmName() != "SipHash-2-4");
+		std::cout << (fail ? "FAILED   " : "passed   ") << "SipHash-2-4 algorithm name\n";
+		pass = pass && !fail;
+
+		fail = (SipHash<2,4, false>::DIGESTSIZE != 8);
+		std::cout << (fail ? "FAILED   " : "passed   ") << "SipHash-2-4 64-bit digest size\n";
+		pass = pass && !fail;
+
+		fail = (SipHash<2,4, true>::DIGESTSIZE != 16);
+		std::cout << (fail ? "FAILED   " : "passed   ") << "SipHash-2-4 128-bit digest size\n";
+		pass = pass && !fail;
+
+		fail = (SipHash<4,8>::StaticAlgorithmName() != "SipHash-4-8");
+		std::cout << (fail ? "FAILED   " : "passed   ") << "SipHash-4-8 algorithm name\n";
+		pass = pass && !fail;
+
+		fail = (SipHash<4,8, false>::DIGESTSIZE != 8);
+		std::cout << (fail ? "FAILED   " : "passed   ") << "SipHash-4-8 64-bit digest size\n";
+		pass = pass && !fail;
+
+		fail = (SipHash<4,8, true>::DIGESTSIZE != 16);
+		std::cout << (fail ? "FAILED   " : "passed   ") << "SipHash-4-8 128-bit digest size\n";
+		pass = pass && !fail;
+	}
+
+	// Siphash-2-4, 64-bit MAC
+	{
+		const byte key[] = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
+		SipHash<2,4, false> hash(key, 16);
+		byte digest[SipHash<2,4, false>::DIGESTSIZE];
+
+		hash.Update((const byte*)"", 0);
+		hash.Final(digest);
+		fail = std::memcmp("\x31\x0E\x0E\xDD\x47\xDB\x6F\x72", digest, COUNTOF(digest)) != 0;
+		pass1 = !fail && pass1;
+
+		hash.Update((const byte*)"\x00", 1);
+		hash.Final(digest);
+		fail = std::memcmp("\xFD\x67\xDC\x93\xC5\x39\xF8\x74", digest, COUNTOF(digest)) != 0;
+		pass1 = !fail && pass1;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06", 7);
+		hash.Final(digest);
+		fail = std::memcmp("\x37\xD1\x01\x8B\xF5\x00\x02\xAB", digest, COUNTOF(digest)) != 0;
+		pass1 = !fail && pass1;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06\x07", 8);
+		hash.Final(digest);
+		fail = std::memcmp("\x62\x24\x93\x9A\x79\xF5\xF5\x93", digest, COUNTOF(digest)) != 0;
+		pass1 = !fail && pass1;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06\x07\x08", 9);
+		hash.Final(digest);
+		fail = std::memcmp("\xB0\xE4\xA9\x0B\xDF\x82\x00\x9E", digest, COUNTOF(digest)) != 0;
+		pass1 = !fail && pass1;
+
+		std::cout << (pass1 ? "passed   " : "FAILED   ") << "SipHash-2-4 64-bit MAC\n";
+		pass = pass1 && pass;
+	}
+
+	// Siphash-2-4, 128-bit MAC
+	{
+		const byte key[] = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
+		SipHash<2,4, true> hash(key, 16);
+		byte digest[SipHash<2,4, true>::DIGESTSIZE];
+
+		hash.Update((const byte*)"", 0);
+		hash.Final(digest);
+		fail = std::memcmp("\xA3\x81\x7F\x04\xBA\x25\xA8\xE6\x6D\xF6\x72\x14\xC7\x55\x02\x93", digest, COUNTOF(digest)) != 0;
+		pass3 = !fail && pass3;
+
+		hash.Update((const byte*)"\x00", 1);
+		hash.Final(digest);
+		fail = std::memcmp("\xDA\x87\xC1\xD8\x6B\x99\xAF\x44\x34\x76\x59\x11\x9B\x22\xFC\x45", digest, COUNTOF(digest)) != 0;
+		pass3 = !fail && pass3;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06", 7);
+		hash.Final(digest);
+		fail = std::memcmp("\xA1\xF1\xEB\xBE\xD8\xDB\xC1\x53\xC0\xB8\x4A\xA6\x1F\xF0\x82\x39", digest, COUNTOF(digest)) != 0;
+		pass3 = !fail && pass3;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06\x07", 8);
+		hash.Final(digest);
+		fail = std::memcmp("\x3B\x62\xA9\xBA\x62\x58\xF5\x61\x0F\x83\xE2\x64\xF3\x14\x97\xB4", digest, COUNTOF(digest)) != 0;
+		pass3 = !fail && pass3;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06\x07\x08", 9);
+		hash.Final(digest);
+		fail = std::memcmp("\x26\x44\x99\x06\x0A\xD9\xBA\xAB\xC4\x7F\x8B\x02\xBB\x6D\x71\xED", digest, COUNTOF(digest)) != 0;
+		pass3 = !fail && pass3;
+
+		std::cout << (pass3 ? "passed   " : "FAILED   ") << "SipHash-2-4 128-bit MAC\n";
+		pass = pass3 && pass;
+	}
+
+	// Siphash-4-8, 64-bit MAC
+	{
+		const byte key[] = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
+		SipHash<4, 8, false> hash(key, 16);
+		byte digest[SipHash<4, 8, false>::DIGESTSIZE];
+
+		hash.Update((const byte*)"", 0);
+		hash.Final(digest);
+		fail = std::memcmp("\x41\xDA\x38\x99\x2B\x05\x79\xC8", digest, COUNTOF(digest)) != 0;
+		pass2 = !fail && pass2;
+
+		hash.Update((const byte*)"\x00", 1);
+		hash.Final(digest);
+		fail = std::memcmp("\x51\xB8\x95\x52\xF9\x14\x59\xC8", digest, COUNTOF(digest)) != 0;
+		pass2 = !fail && pass2;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06", 7);
+		hash.Final(digest);
+		fail = std::memcmp("\x47\xD7\x3F\x71\x5A\xBE\xFD\x4E", digest, COUNTOF(digest)) != 0;
+		pass2 = !fail && pass2;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06\x07", 8);
+		hash.Final(digest);
+		fail = std::memcmp("\x20\xB5\x8B\x9C\x07\x2F\xDB\x50", digest, COUNTOF(digest)) != 0;
+		pass2 = !fail && pass2;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06\x07\x08", 9);
+		hash.Final(digest);
+		fail = std::memcmp("\x36\x31\x9A\xF3\x5E\xE1\x12\x53", digest, COUNTOF(digest)) != 0;
+		pass2 = !fail && pass2;
+
+		std::cout << (pass2 ? "passed   " : "FAILED   ") << "SipHash-4-8 64-bit MAC\n";
+		pass = pass2 && pass;
+	}
+
+	// Siphash-4-8, 128-bit MAC
+	{
+		const byte key[] = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
+		SipHash<4, 8, true> hash(key, 16);
+		byte digest[SipHash<4, 8, true>::DIGESTSIZE];
+
+		hash.Update((const byte*)"", 0);
+		hash.Final(digest);
+		fail = std::memcmp("\x1F\x64\xCE\x58\x6D\xA9\x04\xE9\xCF\xEC\xE8\x54\x83\xA7\x0A\x6C", digest, COUNTOF(digest)) != 0;
+		pass4 = !fail && pass4;
+
+		hash.Update((const byte*)"\x00", 1);
+		hash.Final(digest);
+		fail = std::memcmp("\x47\x34\x5D\xA8\xEF\x4C\x79\x47\x6A\xF2\x7C\xA7\x91\xC7\xA2\x80", digest, COUNTOF(digest)) != 0;
+		pass4 = !fail && pass4;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06", 7);
+		hash.Final(digest);
+		fail = std::memcmp("\xED\x00\xE1\x3B\x18\x4B\xF1\xC2\x72\x6B\x8B\x54\xFF\xD2\xEE\xE0", digest, COUNTOF(digest)) != 0;
+		pass4 = !fail && pass4;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06\x07", 8);
+		hash.Final(digest);
+		fail = std::memcmp("\xA7\xD9\x46\x13\x8F\xF9\xED\xF5\x36\x4A\x5A\x23\xAF\xCA\xE0\x63", digest, COUNTOF(digest)) != 0;
+		pass4 = !fail && pass4;
+
+		hash.Update((const byte*)"\x00\x01\x02\x03\x04\x05\x06\x07\x08", 9);
+		hash.Final(digest);
+		fail = std::memcmp("\x9E\x73\x14\xB7\x54\x5C\xEC\xA3\x8B\x9A\x55\x49\xE4\xFB\x0B\xE8", digest, COUNTOF(digest)) != 0;
+		pass4 = !fail && pass4;
+
+		std::cout << (pass4 ? "passed   " : "FAILED   ") << "SipHash-4-8 128-bit MAC\n";
+		pass = pass4 && pass;
+	}
+
+	return pass;
+}
+
+struct BLAKE2_TestTuples
+{
+	const char *key, *message, *digest;
+	size_t klen, mlen, dlen;
+};
+
+bool ValidateBLAKE2s()
+{
+	std::cout << "\nBLAKE2s validation suite running...\n\n";
+	bool fail, pass = true;
+
+	{
+		fail = strcmp(BLAKE2s::StaticAlgorithmName(), "BLAKE2s") != 0;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "algorithm name\n";
+		pass = pass && !fail;
+	}
+
+	const BLAKE2_TestTuples tests[] = {
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\x8F\x38",
+	        0, 0, 2
+	    },
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\x36\xE9\xD2\x46",
+	        0, 0, 4
+	    },
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\xEF\x2A\x8B\x78\xDD\x80\xDA\x9C",
+	        0, 0, 8
+	    },
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\x64\x55\x0D\x6F\xFE\x2C\x0A\x01\xA1\x4A\xBA\x1E\xAD\xE0\x20\x0C",
+	        0, 0, 16
+	    },
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\x69\x21\x7A\x30\x79\x90\x80\x94\xE1\x11\x21\xD0\x42\x35\x4A\x7C\x1F\x55\xB6\x48\x2C\xA1\xA5\x1E\x1B\x25\x0D\xFD\x1E\xD0\xEE\xF9",
+	        0, 0, 32
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x25\xEC\xB2\xF6\xA7\x81\x82\x57\x5D\x4B\xD7\x02\x72\x6D\xE1\x82\xBB\x1E\x21\xA8\x5D\x51\x34\xAD\xA2\x25\x8D\x7E\x21\x38\x03\xA7",
+	        0, 15, 32
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xD4\x1C\x69\x87\x29\x7E\xDE\x4F\x08\x9B\x66\x9B\xC7\x0E\x62\xB9\xFA\xFA\x1C\x37\xCC\x31\x29\x22\xE0\xEA\x63\xE2\xE5\x85\xAA\x9F",
+	        0, 16, 32
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xE0\xAD\xF2\xCC\x1F\x1F\x55\x3A\xE6\xC3\xCD\x3D\xF7\x68\xEA\x66\x9C\x32\xBE\x1D\x37\xF9\xA2\x61\xD4\x4F\x45\x26\x69\xD0\xD3\xA4",
+	        0, 17, 32
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x10\x42\x65\x1C\x86\x15\xC4\x87\x69\x41\x19\x1F\xB6\xD5\xC5\x1D\xEB\x4C\xA1\x8C\xAF\xEF\xEB\x79\x69\x62\x87\x0D\x6A\x5D\xEE\x20",
+	        0, 31, 32
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xEA\xB1\xC5\xDD\xDF\xB5\x7C\x48\xC5\xB0\xB3\xF5\xBE\x5B\x47\x6D\xBB\xF5\xA3\x5C\x21\xD3\xDD\x94\x13\xA1\x04\xB8\x14\xF9\x2D\x4B",
+	        0, 32, 32
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x7E\x82\x07\x49\x14\x62\x11\x96\xC5\xE8\xF3\xCB\x0F\x21\x7B\x37\xAE\x9B\x64\x58\xF4\x66\x01\xB9\x21\x23\xAC\x48\x64\x30\x83\x8F",
+	        0, 33, 32
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x90\xB5\xA2\x5E\x8E\xA8\xA0\xC8\x74\x85\xAE\x18\x08\x9D\x92\xEB\x14\x5A\x5D\x4E\x2C\x60\x7B\xCB\x4B\x94\xD1\x0F\xAE\x59\x33\xC1",
+	        0, 63, 32
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x71\x27\x28\x45\x9E\x67\xD7\xED\xB7\xAE\xFA\x88\xFF\x5C\x7E\x7B\x5D\xA9\x94\xA1\xC3\xB1\x7B\x64\xFB\xC1\x4E\x47\xCA\xDA\x45\xDD",
+	        0, 64, 32
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x58\x72\x3B\xB1\xBE\x18\x33\x12\x31\x5E\x6E\xF7\xF2\xB1\x84\x60\x97\x2C\x19\xD3\x01\xAF\x42\x00\xAB\xDB\x04\x26\xFC\xB0\xC1\xF8",
+	        0, 65, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\x9A\xD4\x81\xEF\x81\x6C\xAC\xB6\x59\x35\x8E\x6D\x6B\x73\xF1\xE5\xAC\x71\xD6\x6E\x8B\x12\x6B\x73\xD9\xD9\x7D\x2F\xA7\xA4\x61\xB4",
+	        15, 0, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x61\x8C\xBE\x19\x4B\x28\xDC\xA3\x8B\xE5\x1A\x79\x37\x45\xB4\x66\x3D\xF1\x9D\xB5\x8F\xFF\xEF\xC4\x5D\x37\x82\x25\x93\xEB\xE2\x93",
+	        15, 15, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xF3\xEC\x81\x61\x44\x5C\x6E\x2E\xE6\x52\x6A\xCA\x5F\xD9\x25\x74\x2A\x33\xB9\x1F\xEF\x0F\x7E\x54\x4F\x50\xC2\xFB\x04\x3C\x52\xD2",
+	        15, 16, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xF4\x81\x43\x6E\x2F\x4C\x5D\x09\x21\x73\x24\xDA\xA6\x23\x9E\xFD\xF8\x82\xCE\x0E\x3E\x4C\xB4\x17\xCC\x27\xCD\x1A\xAE\x90\x9B\x94",
+	        15, 17, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x99\x5E\x74\x8E\x96\xFE\xC0\x39\x5B\x73\xA3\xC0\x4E\xC7\xF7\xBE\x89\x83\xCD\x18\x24\x60\x60\x7B\xBC\xF5\x50\xF5\x84\xD1\x71\x6B",
+	        15, 31, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x21\x6E\xB9\xE2\xE4\xAF\x94\x5F\x6A\xA3\xD2\xCA\x25\x72\xFB\x8F\xDB\x95\x2F\xAC\x1C\x69\xC1\x26\x28\x31\x63\x16\x25\xA5\x2C\xF8",
+	        15, 32, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xE3\x71\x9F\xD8\xAE\x68\xC8\xC4\x5D\x17\xDD\x21\x33\xBB\xE1\x61\x51\x22\xC2\x3B\x00\x6E\xDD\x66\x7E\x2A\x0A\x6B\x77\xA9\x0B\x8D",
+	        15, 33, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xD3\xF8\x5F\x1B\xBE\x9C\x53\xCB\x7F\x5F\x5F\x62\x4D\x06\x36\x8F\xF8\x15\xA7\xF5\xEB\x77\xC6\xC5\xB4\x81\x15\x01\x82\x8D\x9D\x40",
+	        15, 63, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xBF\xA3\xDA\x09\xF9\xDE\x1B\xE6\x57\x4B\x55\x82\x85\x69\x79\xA1\x89\xD6\xF4\x15\x8B\x03\xFA\xAC\x6E\x00\x80\x26\xF1\x6B\xA1\x28",
+	        15, 64, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x77\x45\xEA\x51\x24\x46\x53\x19\x6F\xE4\xED\x6B\x54\x5C\x9B\x95\x88\xF5\xD4\x2B\x4C\x3E\xE6\xB7\xA1\xA3\x9F\xC4\x3A\x27\x1E\x45",
+	        15, 65, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\xFD\x61\x6D\xA6\x8E\xEF\x10\x24\x16\xC7\xBD\x7D\xC8\xCA\xF8\x2B\x3D\x92\x7B\xCB\xDD\x06\x8E\x7C\xCA\xA7\x72\x76\xCE\x6C\x8C\xD4",
+	        16, 0, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x10\x18\x97\x28\xFB\x05\x1D\xA0\xA8\xD6\x8F\x1C\xAD\x81\xFC\x7C\xA2\x6D\x41\x4B\xAA\x0C\x2A\x95\xB7\xF4\xEF\x9A\x67\xB5\x26\x5F",
+	        16, 15, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x9E\x3B\x50\xF3\xB5\xF4\xC9\xB3\x57\x03\x74\xF1\xB3\xA0\x4B\x3C\xC1\x71\xB4\x30\x42\xE4\x65\x90\xE5\xE2\x8A\x4D\xBA\xCD\xB1\x9F",
+	        16, 16, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x69\x70\x88\xAB\x61\x39\x46\xEA\x3B\xEB\x98\x98\x78\xCD\x8E\xF1\xB5\x7E\x81\xFC\x42\x7D\x46\xB8\xDA\x85\xD2\xEB\xB8\x56\xE4\xAC",
+	        16, 17, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xD2\xDA\xAC\x63\x09\xF1\x81\xBB\xCC\x06\x0D\xCC\xB8\xFA\x67\x08\x14\xD4\x6A\x50\xD7\x4F\xBF\x3B\x4A\x2E\x39\x4D\x45\x55\x27\x2F",
+	        16, 31, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xEB\xB0\xF3\x27\xC3\xC4\x35\x97\x4F\x89\x73\x5A\x4D\xEB\xBB\x4C\x7C\xE9\x0C\x3E\x13\xEB\x07\x83\x74\x67\x0A\x86\xA7\xF4\xA8\x73",
+	        16, 32, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xC8\x96\xC3\x3A\x26\x77\x02\x84\x5D\x95\x1B\x0D\x9F\x5C\x07\xC5\x6D\x21\x5D\x7E\x20\xF1\x2F\xE0\x45\xE3\x50\x42\x9D\x58\xB0\xEA",
+	        16, 33, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x8A\x3C\x9F\xA4\xAC\x78\x82\xA7\x08\x76\xB9\xE1\xED\x22\x9B\x43\x45\xF4\xD4\x01\x76\xC4\xED\x5D\xA4\x5A\x41\xDE\x28\xB8\x09\x6C",
+	        16, 63, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x2D\x0C\x97\xBE\xD2\xF2\x13\x40\xB9\xC8\x15\x91\x6A\x55\x86\x7A\x43\xB1\xFD\xC7\x04\x08\x1B\x58\x37\x09\x12\x80\x40\x99\x7C\xED",
+	        16, 64, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xF7\xC0\x08\xE1\x31\x52\x9B\x71\x87\x51\xCF\xFF\x8B\x08\xA3\x14\x32\x08\x06\x8C\x22\xAD\x83\x97\x71\x95\xC5\x2C\xFC\x66\xA4\xAD",
+	        16, 65, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\xD0\xCE\x8E\x8D\xA0\xBA\xA4\x26\x0E\xD3\x1F\xD1\x7B\x78\xE6\x18\x15\xC6\xFF\xD8\x5A\xDB\x41\x8A\xE7\x36\xF0\xE7\xB9\x87\x2B\x6A",
+	        17, 0, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xCB\xE4\x63\xEB\x6B\x24\x6C\x08\x55\x84\x36\x30\x8E\xFA\xC1\x6B\x97\x43\xD7\x1F\x1F\x3E\x96\xBA\x7E\x87\xF2\x42\x3E\xF5\x69\x5E",
+	        17, 15, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xEF\x39\x55\x9D\x92\x20\xDC\xB6\x8C\x21\x79\xD6\x7C\x51\xB7\x36\xAC\x4E\xFC\xA1\xDE\x66\xC7\xED\x40\xBF\x23\x15\xD1\x25\x82\x4B",
+	        17, 16, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xE3\x3E\x44\x7B\xA2\x7F\x69\x21\x09\x57\x79\x72\xE7\x4B\xE0\xC7\xCD\x54\xDC\xCD\x55\x60\x75\x61\x82\x66\xD7\x5B\x6F\x60\xDD\x73",
+	        17, 17, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xA9\xC4\x29\x2F\x5B\x49\x9A\xE0\x71\xE7\xFD\x65\x98\x53\x42\xC0\xC0\xF1\x75\xBC\xB5\x7B\x5C\xA1\x61\xFC\x8B\x45\x44\x54\xEC\x06",
+	        17, 31, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x29\x60\xBD\x05\x28\xEA\xF1\xA9\x43\xEF\x2D\x87\xC7\xB5\x27\x47\x33\xBA\xC8\x0C\x9F\x1C\xF5\x72\x62\x4C\xA7\x9E\x10\x23\x66\x76",
+	        17, 32, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xE2\xF1\x33\x23\x9D\xD8\xBC\x60\x1F\xB7\xD8\x21\xF5\x13\x98\xE2\x5C\x24\x0E\xC0\x60\x18\xB4\x0B\x93\xF1\x04\x25\xC5\xEC\x20\x14",
+	        17, 33, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xEB\x4F\x8D\xB3\xF5\x03\x72\x55\x72\xCE\xF3\x91\x22\xCD\xEA\x5A\xC4\x9A\xD0\x42\xE1\xC4\x62\x90\xCE\x11\x9E\xFD\x11\xDB\xCA\x23",
+	        17, 63, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xB5\x9A\xA7\x74\xDA\xB8\xDE\x5C\xBB\xC3\x5A\xFC\xF0\xD7\xAF\x51\x1E\x0F\x05\x45\xDB\xDA\xB7\xA4\xA6\x52\xB2\x9E\x0E\x23\x14\x3D",
+	        17, 64, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x69\xA2\x95\x6C\x87\xED\x22\x76\x0A\x53\x75\x6D\x28\xF4\xCD\xC5\xF7\xF9\x88\x51\x73\xA7\xD9\x44\x0C\x96\xB1\x5F\xE5\x57\xFE\xE3",
+	        17, 65, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\x39\x4A\xB9\x85\xDD\xFF\x59\x59\x84\x5A\xF7\x54\xD6\xFC\x19\xFB\x94\x0E\xAE\xA4\xEA\x70\x54\x3E\x0D\x7E\x9D\xC7\x8A\x22\x77\x3B",
+	        31, 0, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x1B\x46\x57\xC0\x48\x26\x7B\xC6\x17\xEC\xD5\x76\x89\xEE\x81\xE5\x5B\xE0\xAC\xCE\xB7\x5D\x33\x2A\xAF\xB6\xE2\xF6\xC0\xBB\x93\xE6",
+	        31, 15, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x53\xB3\x3A\x58\x98\xD2\x0D\x25\x61\x5A\x0C\xF5\x74\x7F\x44\x2F\x51\x70\x31\x66\x5E\x41\x5E\xBC\xF5\xF0\x03\x12\x98\x12\x90\xCC",
+	        31, 16, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x0B\x2C\x2A\x74\x72\x12\x18\xE1\xCE\xCD\x8A\x7E\xFC\xCE\x8D\x57\xBE\x42\x1A\xCC\xA2\x20\x24\x33\xC5\x1E\x31\x54\x1F\xB6\x45\xBD",
+	        31, 17, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xEF\x13\x95\xD4\x42\xC9\x9A\x04\xFE\xF0\x11\xE9\x72\xA9\x37\x74\x3E\x14\xC4\x4C\x58\x0C\xAC\x81\x4A\x75\x73\x35\x05\xC0\x81\x32",
+	        31, 31, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x0D\x35\xCF\x7F\x82\x08\x1E\x1B\xE9\x1E\x75\xE1\x96\x05\x9F\xBD\x63\x94\x8E\xE0\x71\xEF\x53\xDE\x79\xC6\x68\x21\xD6\x8A\x5A\xE4",
+	        31, 32, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x74\x0D\xCB\x50\x59\x59\xB9\x48\x52\x2B\x0B\x2A\x1F\xFC\x4F\x12\xF5\x9F\x49\x11\xED\x43\x61\xA6\x38\x8D\xF9\x35\x5C\xCD\x18\xBB",
+	        31, 33, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xDD\x48\xE5\xE8\x86\x8E\x61\xFF\x8A\x85\xC6\x5A\xB8\x5A\x32\xD2\x2A\x9C\xA2\xC8\xDC\xB9\xD6\x0A\x44\xD3\xF1\xB4\x8B\x5B\xD3\x80",
+	        31, 63, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x81\xEF\xAD\x79\x16\xE4\x29\x02\xDB\x89\x8D\xF2\xA4\x6D\xB4\xC4\x2A\x8C\xC6\x7E\xDE\x9B\xF7\x63\xB2\x10\xED\x15\xED\x0A\x0E\x3C",
+	        31, 64, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xEB\x54\xC4\x8A\x8F\x92\x53\x4D\xDF\x1D\x78\xCA\x98\x38\xF9\x10\xE4\x05\xCD\x6D\xB6\x82\x3B\x76\xB7\x82\x3A\xD2\x20\x77\xD4\x89",
+	        31, 65, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\x18\xE3\xCE\x19\x98\x7B\xA5\x0B\x30\xDD\x14\x4C\x16\xF2\x26\x55\xEB\xA3\x14\x09\xD6\x62\x10\xBC\x38\xBB\xC1\x4B\x5D\xAB\x05\x19",
+	        32, 0, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x10\x9D\x6C\xB3\x37\x9C\x9E\x2B\xC9\x1C\xF9\x79\x7A\x46\xEA\xFA\x78\x5C\xA1\x54\x83\xBD\xC2\x67\x31\xFA\x66\xAC\x5D\x4C\xE7\xAB",
+	        32, 15, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x76\x83\x9A\x8F\xBC\x20\x81\xD6\x09\x5C\x97\x46\xD3\xD6\xA4\xC4\xC1\x17\x8E\x3B\x14\xFC\xFD\x8F\x72\x20\xEF\xC6\x0B\xD3\xFF\x42",
+	        32, 16, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xEA\x0C\x05\xE6\x8F\xD6\xA6\xA1\xD9\xFC\xDA\x3C\xCB\x49\x02\xA5\xF9\x5D\x80\x9E\x89\xF6\xA2\x15\x74\x48\x84\x87\x77\x47\x6D\xBB",
+	        32, 17, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x98\x79\xD8\x91\x48\xB3\x12\x10\xE8\x49\x73\x38\x1B\xFA\x6C\xCA\x85\x59\xF9\xF9\xFE\xD3\xF2\x98\x9E\x9D\x5C\xE8\x1E\x59\xB3\x46",
+	        32, 31, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xC7\x41\x7E\x23\xDD\x7D\xB0\x84\xCA\x64\x26\x5A\xE0\x98\xD7\xF2\x29\xE4\x4C\x88\xC9\xF9\x15\x00\x19\x73\xC7\xCF\x95\xF5\x30\x68",
+	        32, 32, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x0F\xDA\x45\x55\xAC\x8F\xB0\x17\x1D\xF2\x41\x54\xFB\x41\x26\x16\x0C\x00\x84\x49\x3D\x54\xAE\x9F\x13\xD4\xE5\x11\x2B\x42\xB5\xF5",
+	        32, 33, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xF1\x1B\x54\x05\xCE\x3A\xEB\xA1\x1B\x49\x99\x43\xBF\x2C\x73\x10\x0E\x35\x6B\xEA\x40\xAC\xE5\xBC\xD8\xD5\xB0\xAE\xB2\x8E\xFB\x05",
+	        32, 63, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xEA\xAF\xA4\xBE\xD6\x9D\x98\x73\x5E\xDF\xFC\x35\xFD\xB8\x26\x18\xAC\x15\x9E\x2B\xB2\xF9\x36\xEC\x51\x58\x1E\xD8\x53\xB7\x11\x10",
+	        32, 64, 32
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xC3\x0A\xE0\xAB\xFA\x38\x3C\x3F\xBC\x44\xD3\x2A\x4F\xC8\xFA\x86\xF2\x15\x9E\x83\x75\x65\xE4\x78\x63\xED\xEF\x31\x79\xEC\x00\x21",
+	        32, 65, 32
+	    }
+	};
+
+	{
+		byte digest[BLAKE2s::DIGESTSIZE];
+		for (size_t i=0; i<COUNTOF(tests); ++i)
+		{
+			// the condition is written in a way which for non-default digest sizes
+			// tests the BLAKE2_Base(bool treeMode, unsigned int digestSize) constructor.
+			// See https://github.com/weidai11/cryptopp/issues/415
+			if (tests[i].dlen < BLAKE2s::DIGESTSIZE && tests[i].key == NULLPTR)
+			{
+				BLAKE2s blake2s(false, (unsigned int)tests[i].dlen);
+				blake2s.Update((const byte*)tests[i].message, tests[i].mlen);
+				blake2s.Final(digest);
+			}
+			else
+			{
+				BLAKE2s blake2s((const byte*)tests[i].key, tests[i].klen, NULLPTR, 0, NULLPTR, 0, false, (unsigned int)tests[i].dlen);
+				blake2s.Update((const byte*)tests[i].message, tests[i].mlen);
+				blake2s.Final(digest);
+			}
+
+			fail = std::memcmp(digest, tests[i].digest, tests[i].dlen) != 0;
+			if (fail)
+			{
+				std::cout << "FAILED   " << "BLAKE2s test set " << i << std::endl;
+			}
+
+			pass = pass && !fail;
+		}
+	}
+
+	{
+		// One test with salt and personalization for GH #921
+		// Test vector generated with modified BLAKE2 ref implementation
+		// https://github.com/noloader/cryptopp-test/tree/master/BLAKE2
+		const std::string key = "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42\x43\x44\x45\x46";
+		const std::string salt = "\x41\x42\x43\x44";
+		const std::string personalization = "\x41\x42\x43\x44";
+		const std::string message = "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50";
+		const std::string digest = "\x0b\x62\x56\x59\xb0\x0a\xb7\x43\x72\x53\xa2\x6a\x6c\x97\x91\xa4\x83\x74\x95\x27\x55\xc5\xa2\x6d\x89\xcc\x9d\x46\xba\x9a\xff\x57";
+		std::string calculated;
+
+		BLAKE2s blake2s(ConstBytePtr(key), BytePtrSize(key), ConstBytePtr(salt), BytePtrSize(salt),
+				ConstBytePtr(personalization), BytePtrSize(personalization));
+		blake2s.Update(ConstBytePtr(message), BytePtrSize(message));
+
+		calculated.resize(32);
+		blake2s.TruncatedFinal(BytePtr(calculated), BytePtrSize(calculated));
+
+		pass = pass && (digest == calculated);
+	}
+
+	std::cout << (!pass ? "FAILED   " : "passed   ") << COUNTOF(tests)+1 << " hashes and keyed hashes" << std::endl;
+
+	return pass;
+}
+
+bool ValidateBLAKE2b()
+{
+	std::cout << "\nBLAKE2b validation suite running...\n\n";
+	bool fail, pass = true;
+
+	{
+		fail = strcmp(BLAKE2b::StaticAlgorithmName(), "BLAKE2b") != 0;
+		std::cout << (fail ? "FAILED   " : "passed   ") << "algorithm name\n";
+		pass = pass && !fail;
+	}
+
+	const BLAKE2_TestTuples tests[] = {
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\x12\x71\xCF\x25",
+	        0, 0, 4
+	    },
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\xE4\xA6\xA0\x57\x74\x79\xB2\xB4",
+	        0, 0, 8
+	    },
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\xCA\xE6\x69\x41\xD9\xEF\xBD\x40\x4E\x4D\x88\x75\x8E\xA6\x76\x70",
+	        0, 0, 16
+	    },
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\x0E\x57\x51\xC0\x26\xE5\x43\xB2\xE8\xAB\x2E\xB0\x60\x99\xDA\xA1\xD1\xE5\xDF\x47\x77\x8F\x77\x87\xFA\xAB\x45\xCD\xF1\x2F\xE3\xA8",
+	        0, 0, 32
+	    },
+	    {
+	        NULLPTR,
+	        NULLPTR,
+	        "\x78\x6A\x02\xF7\x42\x01\x59\x03\xC6\xC6\xFD\x85\x25\x52\xD2\x72\x91\x2F\x47\x40\xE1\x58\x47\x61\x8A\x86\xE2\x17\xF7\x1F\x54\x19\xD2\x5E\x10\x31\xAF\xEE\x58\x53\x13\x89\x64\x44\x93\x4E\xB0\x4B\x90\x3A\x68\x5B\x14\x48\xB7\x55\xD5\x6F\x70\x1A\xFE\x9B\xE2\xCE",
+	        0, 0, 64
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x2A\xF7\xA1\x34\x71\x1C\x5A\x03\xCE\xC8\xFC\xA9\x88\xD9\x9C\x8B\x99\x9A\x95\x33\x0D\xC9\x37\xBE\xE3\x3B\xB3\x0B\xAD\x1B\xE3\x7E\x4F\x66\x81\xF1\xE8\x0E\x64\xA1\x9D\xFC\x86\x83\xF1\xFE\x32\x5D\xAA\xDD\xB8\x1B\xA7\xA3\x88\x3F\x71\x1F\x04\x14\x08\x91\x16\x39",
+	        0, 31, 64
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x49\x9A\x63\x97\x86\x14\xB9\x50\xCC\x1D\xA0\xAB\x63\xAF\x3B\xC3\xFF\xBC\x63\xA2\x91\xE5\x2A\xD7\xA8\x11\xD6\xD4\x23\x32\x52\xCF\xA9\xD6\x5A\x19\x51\xBA\x20\xF1\x74\xEF\x7D\x82\x38\xFB\x85\x20\x82\x16\x0B\xC7\x3C\xD0\xD2\x72\x45\x75\x38\x5C\xE4\x17\xB1\xAA",
+	        0, 32, 64
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xA5\x5B\x85\xDD\x70\x10\xE5\x04\xD3\xB5\x10\xEF\x08\xE1\x95\x40\x19\x69\x82\x87\x44\xFD\xBF\x5B\xE8\xE2\xBB\xE3\x57\x8F\x24\x0B\xFB\x92\xD1\x50\x98\xAC\x06\xED\xC2\xBB\x93\x04\x54\x84\x35\x23\x83\xA1\xB0\x47\x91\x99\x0C\x4C\xA6\xFD\x73\x8D\xE5\x78\xA5\x5E",
+	        0, 33, 64
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xB8\xBC\xDA\xB9\x66\xE2\x5A\x76\x72\x38\x55\xD9\x5A\x4E\x8C\x4F\xA9\xEC\x8C\xFF\x0B\x18\x38\x98\x5C\x8C\x90\xBC\x46\x56\x24\xD7\x96\xAB\x26\x2B\x49\x14\xD0\xEE\x91\x69\x9A\x0C\xC3\xE6\xCA\x14\x55\x37\xDA\xF6\x59\x4A\x31\x78\x67\x49\x89\x0E\x84\xDC\xE7\x5D",
+	        0, 63, 64
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xA1\xD7\x6B\x3B\xB7\xCE\x56\x22\xD1\x13\x94\xDF\xF4\xA2\x04\xEF\x75\x85\xAF\x93\x63\x55\xBF\xCE\xAF\x01\x25\xCA\x17\x65\xC3\xD2\x6E\x67\x71\x95\x33\x18\xE7\xE4\xC1\xFA\xE0\xE6\x24\x8A\xE9\x56\xB7\x63\xE2\xBF\x8F\xB3\xA7\xD4\xD7\xFD\x1A\xC1\xAB\x1F\x17\x77",
+	        0, 64, 64
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xF3\x26\x82\x25\x97\xE1\x91\x53\xF8\x57\xC6\xD9\x57\x46\x09\xDF\x1E\x05\x81\xF6\x23\xEE\x8B\xBC\xFA\xA1\x9F\x21\xB6\xF3\x1D\xAD\x9F\x4E\x47\x0B\xE6\x3C\x5E\x28\xE9\x11\x1D\xAA\x52\xF2\x6B\x1A\x61\xCF\x61\x1C\xB0\x7D\xE5\x79\x14\x79\x79\xA6\x08\xDF\x76\x4B",
+	        0, 65, 64
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x6A\x3F\x90\x50\x84\x5D\x84\xB7\xA2\x43\xF3\xEE\x2C\x7A\x10\x50\xC4\x4C\x5E\x39\xF4\xB8\xCC\x1D\xB3\xF1\x39\x82\x77\x22\x10\x92\x36\x21\xA0\xBA\x13\xCC\x4F\xA3\x1C\x4F\xEC\x1A\x15\x29\x20\x20\x3E\x1A\x06\xEA\xF4\xFF\xCB\x44\x72\x52\x3B\xE5\xE0\x08\x79\x92",
+	        0, 127, 64
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xC2\xB8\x8C\x5F\xBD\x61\x0F\xAB\x04\xD3\x40\xAD\x88\x74\x02\x6B\x27\x33\x5C\x6F\x8C\xE5\x93\xC3\x2F\x1A\xE5\xE8\x42\xA6\x07\xCB\xB7\x73\x88\xF3\xF5\xFF\xDC\xBF\xCC\x87\x8F\x56\x1F\xF2\x30\x37\x02\xBE\xC3\x1D\xA7\x8F\x12\x56\x35\x03\x50\xC6\x1E\xD8\xBD\x84",
+	        0, 128, 64
+	    },
+	    {
+	        NULLPTR,
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xAD\xE2\x77\xD8\x19\xA7\xBE\xF1\x4E\x47\x92\xDF\x4B\xFD\x1E\x7B\xDE\xC8\x41\x54\x31\xF6\x18\x79\x8B\x7F\x9A\x23\x3C\x6F\xA0\x56\xE6\xB3\x85\xBE\x76\x78\x88\x58\x86\x47\xEB\x48\xC5\x20\x62\xF3\x40\xA5\xB2\xB3\x3F\x33\x18\x3A\x12\xA8\xE9\x9A\x74\x9B\xE8\x8F",
+	        0, 129, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\x55\xD9\xFB\xF8\x8E\x42\x80\xBF\xE2\x75\xB8\xA7\xA1\xFA\xAD\x7D\xEA\x4B\x65\xB3\xDF\xA2\x92\xE1\xB0\x43\xB6\x36\x74\xB4\xC7\x87\x5D\x68\x02\x21\x39\x49\x0B\x69\x70\xC8\x80\x14\x82\x26\x77\x3D\x2D\x97\xAD\x01\x67\x55\x7D\x54\x62\xA0\x88\x0C\xB3\xFA\x69\x85",
+	        31, 0, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xBA\xD4\xD2\x86\x9D\x23\x5A\xBD\x76\x77\x0A\xD4\x28\xFD\x31\x8B\x34\xD6\xAA\x7A\x22\xB7\x2E\x8E\x09\x55\x79\xF9\xE9\xB4\x0D\xB7\xA8\x05\x0E\xAB\x17\xD9\xFC\x97\x97\xA0\x61\x40\xC6\x35\x61\xC1\x9A\x91\xF5\x69\x41\xA1\x3D\x3F\xFE\x8B\xEA\xC8\xC4\xE4\xDD\xD7",
+	        31, 31, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x24\x4C\x4F\xD1\x8D\x4B\xEC\xE4\x7E\x45\x25\x33\x75\xBE\x95\xCB\x5D\x20\xA0\xE7\x62\xB4\x81\x62\x74\x12\xFD\x86\x09\x4A\xBB\x35\x6B\x26\xF8\xE4\x5A\x8F\x38\xD2\xA1\x10\x89\xC1\x93\xDB\xB0\xB2\xA7\xD8\xE0\x83\x3D\xE6\x76\x18\xF6\xFE\x1A\x14\xBC\x9E\x63\xEF",
+	        31, 32, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x91\x58\xD9\x2B\xF2\x81\x65\xA2\xDE\x73\x9E\x9D\x15\x04\xFB\x9C\x47\x76\x04\xA3\x51\xE6\x84\xEF\x1C\xF0\xF5\xF1\x1B\x5F\xE5\x78\x39\x3D\x23\xCA\x3C\x95\xAB\xB1\xD7\xC1\xE9\x10\x4A\x6C\x51\x46\x6C\x19\x02\x48\x75\xD5\x23\x76\xCF\xCC\x64\x02\x15\xC2\xCF\xD6",
+	        31, 33, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xEA\xFA\xD7\x50\xFD\x93\x65\xB6\xA7\x29\x75\x07\x17\x80\xF7\xE2\xE2\xF9\x60\xF3\x9C\x9F\x06\xFC\x13\x16\x79\x66\x7A\x3A\x92\xE2\x75\x79\x71\x89\x34\x5C\x6F\x85\x76\x31\xCF\x7A\x76\xB4\x52\xF5\xDC\xC7\x39\x2A\x39\x1A\x26\xD6\x74\xEA\xF4\xC7\x44\x53\xF6\x43",
+	        31, 63, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x5C\x55\x87\x5A\xCA\xF3\x78\x11\x33\x91\x5C\x40\x3C\xE8\xDB\x74\xEA\x68\x4D\x76\x44\x91\x6A\x03\x72\xF7\xAA\x0B\x09\x0A\xAD\xC1\x14\xDF\xC0\x52\x83\x0C\x5A\x75\x2B\x25\x0D\x6F\x7F\x94\xBE\x48\x93\xA2\x19\xED\x2E\x4C\x4C\x47\xA3\xF4\xD0\xBD\x9D\x51\x4A\xDA",
+	        31, 64, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xA2\x3C\xB9\x96\xBC\x40\x61\x12\xF7\x5A\xE7\xBE\x2F\x04\xBB\xCF\x4F\x6D\x65\x65\xF8\x65\xA6\xF6\x88\x5D\x56\x57\x79\xA3\x11\x33\x37\xD1\x72\x84\xEE\x75\x56\x4E\x00\x52\xF1\x88\x07\xC6\xD6\x4D\xFB\x55\xF0\x25\x39\x70\x51\x35\x1A\x73\x85\x6D\x6B\x26\x7A\x79",
+	        31, 65, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x22\xEA\xC1\x75\x7B\xBF\x13\xA1\x91\x8B\x46\x89\x2A\xEC\xEB\x07\x6F\x3F\xF4\x70\x68\x8F\xD3\x6D\xE5\x5B\xB9\x03\x69\x38\xF3\x11\x2E\x1E\x6E\x24\xD9\x60\xB7\x4E\xB1\xD4\x67\x38\xBD\x1B\x45\x7C\xF9\x29\xFC\xBB\x4C\x23\x78\xE3\xE5\xFE\x4A\x2D\xED\xDA\x29\x05",
+	        31, 127, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x9C\xAE\xD2\x2D\x53\x1B\x52\x07\x39\x4F\xE4\x9F\xE4\x8D\x55\x2C\xC6\x00\x6D\x61\xA5\x83\xA5\xE7\x10\x3B\x34\xFD\x24\xBD\x4E\xE1\xD0\xC2\x02\x8A\xE2\x86\x57\xF3\xAC\x31\xBD\x51\xDE\xEB\x54\xFD\xEB\x84\x80\x2C\x79\x16\x28\x98\x1E\x3C\x83\x87\xDE\x14\x83\x34",
+	        31, 128, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xF3\x73\x96\x41\x7B\xEF\x67\xF3\x97\xF5\xCD\x8D\xFD\x79\xAA\xBC\xC7\x95\x70\x48\xC8\xC3\x89\xFE\xEC\x7B\xDB\x23\x43\x1E\xFA\x85\x51\x75\x4E\x04\xB3\xF3\xCB\xA6\x46\x58\x2A\x3E\x22\xBE\xFF\x85\x12\xC9\x2B\xE7\xA7\x93\x78\x47\xF5\xFD\xB8\x43\xAF\xBD\x11\x9A",
+	        31, 129, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\x0C\xAB\xE4\x02\x57\xEB\xAC\x85\xBC\xD6\x13\xBD\x40\x56\x58\xEC\x0B\x7F\x32\xB4\xDB\xBE\x6A\x31\x57\x60\x25\xC4\xFA\xBB\x3E\xDB\x55\x63\xE8\xD1\x27\x19\xB9\xEE\x9C\x7B\xE0\x0D\x8F\x09\xA4\x66\x5C\x32\x34\x34\xC8\x7F\x66\x00\xB7\x0B\x7B\x9C\x32\x74\xFC\x40",
+	        32, 0, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xA8\x09\x82\xFC\x9A\x5B\xC7\xC5\xF0\x37\x26\x7B\x86\x5D\x35\xA2\x2E\x4D\x79\xCE\xBE\x99\x56\xD6\x56\xBB\xCA\x48\x4C\xFB\x47\xD9\xF4\xBE\xA2\x7A\x3A\xA3\xA7\x91\x34\x8B\x23\xB4\x84\xD1\x66\x8A\xBC\x0F\x4E\xE4\xF1\x70\x8E\xFB\x1A\x95\x12\x2B\x2F\xFF\x49\x87",
+	        32, 31, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xE0\xD6\xF6\x98\xC1\x50\xBB\xBF\xC1\x65\x47\x20\xC3\x2A\xD6\xE4\x1E\x3B\x31\xC0\xBA\xCF\x7C\xF8\xF8\xA5\xDB\x17\xCF\x4B\x84\x98\x02\x2D\x23\xF6\x18\x78\x8E\x10\xE2\xD3\x53\x5D\x43\x37\x8E\x3F\x9D\x68\xD2\x99\xBB\xC8\x04\xA7\xF4\xCA\xD2\x5C\x0C\x99\xA8\xF4",
+	        32, 32, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x43\x62\x70\x1E\xFE\x4C\x12\x39\x03\x01\x04\xA8\x5E\xB5\x55\xE6\xE9\xE5\x55\x6A\xCE\x80\x18\x1D\x81\xA6\xBA\x87\x92\xAB\xFC\x0C\x54\x83\x09\xD2\x45\xFD\xA6\xBC\x1A\x7E\x79\x45\x74\x06\xCC\x77\x3D\x18\x77\x8C\x0D\x38\x03\xC2\x76\x2B\x91\x6F\xF7\xE8\xCA\x61",
+	        32, 33, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x08\x1C\xBA\x80\x31\x39\xDF\x39\x37\xBE\x58\xB7\x22\xB3\x3E\x17\x9D\xBF\xE3\xCC\x02\x3C\x60\x2B\x1A\xB8\xEF\x77\x40\x32\x5A\x23\x8F\x48\x3F\x48\x64\x5E\x35\xA6\xBE\xB5\xBE\x1E\x3C\x35\x19\x15\xDE\x87\x41\xFF\xBB\xC4\x65\xB0\xDD\x4A\x5A\x88\x96\x47\xF5\x48",
+	        32, 63, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xA5\x35\x83\xFB\x6B\x15\x35\x70\x70\x23\x1A\x21\xC3\xBC\x97\x6C\x9C\x59\xDA\x51\xE4\xC4\x11\xDE\x3F\x04\x4E\x0F\x11\x8B\x9F\x1D\xA5\x26\x12\xBC\x2C\x54\x03\x67\x03\x0D\xD5\xB3\xFB\x34\x67\xE7\x02\xC6\x6F\xD9\x31\x1E\xA6\x5C\xBC\xA3\xFE\x86\x2D\x12\x45\xD7",
+	        32, 64, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xD9\x1C\xA9\xC0\xE9\x06\xEF\x1E\xDE\xD4\x84\x42\x89\xCD\x7A\xFF\x96\x92\x3E\x43\xAE\xAC\xC6\xDA\xD5\x2E\x55\x3E\x9A\xAA\x10\x86\x2E\xE9\xE4\xEF\x56\xDF\x9D\xD2\x70\x84\x5A\xF7\xD7\xD6\x58\x99\xE9\x01\xCC\x70\xBE\x98\xE0\x20\x3E\xCB\xCB\xCD\x4A\xD0\xA7\x81",
+	        32, 65, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xC5\x0E\x8C\x76\x05\x2D\xA7\x43\x90\x73\x8D\x38\xB0\x6C\x9D\x83\x2C\x14\xB1\x2C\x61\x42\x19\xC9\x82\xC5\x90\xB6\xB6\xCE\x78\xFD\x73\x9A\x2A\x79\x27\xA6\xBA\xAF\xEF\xCE\x68\x1D\x00\x53\x49\x2E\x89\x1E\x4C\x13\x12\x77\x9A\x78\xA5\x0F\x2A\xE7\x73\x78\xE2\x0A",
+	        32, 127, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x17\xB1\x1E\x2B\xB1\xDF\x49\xFA\x9A\xD0\xD1\x6E\x79\x33\x2A\x62\xA2\x11\x3B\x5E\xE0\xEF\xA2\x49\x44\x6C\x70\xD2\x69\x69\x7F\x69\xC3\xB4\x0B\x21\x1E\x76\x43\x58\x81\x8E\xA1\x2F\x73\x75\xDB\xC3\x22\xF3\x9C\xB7\x03\x56\x49\x8C\xDE\x60\x5A\xB7\x52\x7A\xA1\x53",
+	        32, 128, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xE4\xF6\xE4\x01\x8A\xA6\xD0\x8D\xCF\x81\x1D\x38\x60\x5C\xB6\xF5\x83\xAA\xB2\x1F\xC0\xC8\x77\xA5\xA4\x77\xE0\x65\x55\xB7\x34\xFC\x7C\x40\x53\x6A\xEC\x32\x7D\x2A\xA3\xE8\xD0\x31\x91\xA8\x15\x11\x58\xE8\x51\xF7\xA0\xDB\xCA\x8A\x71\x6D\x5B\x19\x7B\x78\xDA\xF7",
+	        32, 129, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\x0D\x19\x8F\xB3\x01\xE3\x83\x7D\xF1\xB9\x98\xEE\x48\x47\xF5\x1D\x91\x01\xEB\x91\x4A\x85\xFA\x6A\x7E\xBA\x7C\xDB\x12\x69\x45\xD7\x15\x6F\xF2\xF5\x05\x81\x27\xA0\x4A\xE4\xE8\xCF\x43\xD8\x76\x8A\x64\xFE\x9D\x97\x61\xE1\x0B\xC1\xBE\x45\xF9\xFA\x1C\xEB\x4B\xB6",
+	        33, 0, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x0E\xC6\xDC\x77\xF3\x78\x55\xDE\xF9\x10\x48\x37\x28\xC6\xC1\x93\x0D\x65\x6B\x51\x20\x78\x48\x90\x10\x01\x1B\x9D\xFC\xDB\xB2\x6E\x6D\xD9\xAC\xF5\x1A\xBE\xEF\xBF\xAF\x46\x99\x61\x65\x53\x50\xA6\x08\x09\x90\x8E\x77\x36\x33\x80\xC1\xD7\x7E\xD2\x59\x8A\xA9\x51",
+	        33, 31, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x44\x66\x17\xF1\x0A\xDD\x2A\xCC\x5C\x23\xAF\x6D\x1B\xF8\xE6\x99\x6B\x69\x41\x82\xFD\x7D\x1D\xBD\x83\x44\xF7\x80\x1D\x96\x8F\xF6\xB5\x4A\xA2\x60\x72\x06\x7D\x06\xA6\x11\x87\x44\x27\xAF\x2D\x04\xA7\x8E\xF0\x90\x72\x7F\xED\x05\x90\x36\x27\xD9\x37\xBF\xDF\x9B",
+	        33, 32, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xA8\xAE\x4B\x1B\x9C\x20\x5F\xF3\xE8\xBC\xA5\xD0\x8B\xB0\x10\x1F\xB9\xFB\x10\xB5\x29\xB2\xA0\x72\x43\xD8\x75\x08\xF5\x65\x3C\xA8\xB2\x93\x92\x2F\x85\xB2\xE6\xC2\xAF\x72\x30\xDF\x50\x5F\x1F\x60\xFD\x4A\xC5\x02\x4D\xDF\x01\xBD\x83\x4F\xC7\x9A\x9E\x15\xAA\x8B",
+	        33, 33, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x88\x18\xC9\xDB\x3A\xD3\x29\x7F\xC3\xC0\x6A\x27\x62\x50\x06\x72\x74\x7D\x60\xAF\x53\xA8\xB0\x4D\xF2\xE2\x9E\x50\xF8\xE8\xFD\x93\x21\x11\x4D\x69\x42\xA0\xD8\x60\xFA\xDD\xEE\x95\x59\xED\x51\x5B\x29\xA9\x19\x4B\xE5\xE5\x5B\x88\x63\x06\x05\xBF\x6E\x57\x3E\xE2",
+	        33, 63, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x35\xEC\xD6\x75\x45\x34\xAD\x71\x93\x99\xE8\xC0\xB0\x2F\x0D\xE2\x79\xB1\x7A\x5E\xA3\x54\x59\x3F\x1B\x73\x92\xC4\xAD\x18\xEE\x56\xE1\xE6\x76\x6D\x7B\xCC\x62\xE8\x9C\x38\x56\x7B\xC4\x0A\xE4\x89\x7C\x66\x84\x8C\xB3\x99\xDE\x2E\x60\xDD\x48\xA0\x08\x0A\xDE\xA0",
+	        33, 64, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xBA\x5D\xDD\x7B\xE8\x47\xB7\x2D\x90\x17\x52\x66\xDD\x17\x54\xFC\x69\x59\x9D\x43\x1B\x3C\x6D\xE8\x08\x3B\xB2\xEA\xA5\x8C\xDE\xE9\x71\x69\xF5\x62\x22\x14\x67\xC9\xAC\xC2\xB7\xEA\xEA\xAF\x10\x17\xDA\xD8\x52\xFA\x45\x65\x9F\x5E\xAE\x38\xB7\xCF\x01\xD2\x66\x53",
+	        33, 65, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x9B\x61\x94\x75\x04\x23\x28\xED\xAF\x0C\x9B\x50\x58\xEB\x5F\xD0\x8F\x78\x16\xA7\x81\xA6\x29\xA1\xEC\x50\xA7\xE6\x41\x53\xE2\x3B\x38\x84\x28\x4C\xE7\x33\x25\xA5\xF2\xB4\xEB\x0C\x7A\x40\xEA\xA0\x39\x54\x76\x7D\x94\xDA\xE7\x2B\x67\x68\x60\xF1\xD2\x8A\x05\xA5",
+	        33, 127, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x9C\x18\x11\x0D\x2C\x8D\xE4\x07\x0D\x7F\x99\xB5\x0F\x88\x55\x7C\xBB\xB8\x4C\x8D\xE3\x42\x04\x32\x2C\xF0\x77\x79\xBE\x35\xE2\xEA\x0B\x4B\xA1\x44\x69\xDA\xA6\xFB\xBD\x40\xD6\x66\x5A\x99\x4E\x9E\x7B\x32\x20\xB8\xC7\x34\x3F\xCA\x66\x5C\x86\x2A\x60\x1A\x69\x74",
+	        33, 128, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xCB\xEC\x77\x51\x9F\xD7\xAC\x67\xEE\xB7\x8D\xAC\xB8\x1E\xE2\x8D\x3E\x17\x61\x29\xC0\x39\xF5\xDD\xB4\x5A\xC6\x8A\xBB\x40\x55\x81\x03\x7E\x58\x43\x9E\xDD\x36\x08\x04\x96\xCD\xC1\x95\xCF\xF1\x71\x20\x81\x66\x10\x89\xE3\x88\x22\xB8\x5E\x65\xA4\xC8\x8E\xAA\x2A",
+	        33, 129, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\x31\xD7\x85\x5E\xBC\xAA\x40\xE2\xEF\xA6\xD4\x35\xC7\x9E\x37\x1E\x80\xBD\x1E\x37\x72\xE6\xEF\xD6\xB1\x41\x1A\xE5\xF8\xB2\x92\x1A\xE0\xAD\x11\xBF\xF0\x57\xD5\x9A\xF8\xC4\x4C\x11\x88\x64\xDA\x88\x45\x3C\xCC\xF7\xCB\x44\x9E\x34\x23\xA3\x9D\x6D\x11\x98\x0B\xAC",
+	        63, 0, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x3E\x7E\xA0\x5E\x1B\x64\x0D\x9F\x5B\xDA\xF9\xB8\x56\x4E\x2D\xEC\x99\x5E\xDC\xF3\xAF\x26\xE1\x19\x4E\x1B\xC2\xA6\xDA\x2D\x41\x8A\xDD\xC2\x12\xA6\x54\x6C\x90\x98\x74\x27\x29\xF6\x2D\x94\x55\xA6\x92\x95\x4C\x8E\xD3\x23\x72\x06\xEF\x92\x38\x99\xA6\x9E\xE2\x14",
+	        63, 31, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x79\xA5\x33\xEA\x9A\xBC\xBF\xB9\x48\x23\xDF\x8F\x27\x7E\x96\x4A\xB9\x2D\xA7\x3D\xEE\x9E\xBE\x97\x5E\x1B\xC1\x4A\xD0\x19\xF8\xF8\xF4\x6D\x0C\x59\x94\xB3\x6C\x2E\xCA\x18\xD7\xEF\x20\x98\x21\x77\x7E\x07\xEB\x4F\x51\x0C\x82\xCE\xD3\x3F\x48\x82\xBC\x98\x3C\xBA",
+	        63, 32, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xF8\x34\x86\xBD\x50\xEC\xB7\x32\x3A\xCC\x9A\x93\x6B\xA6\x45\x3D\xD5\x77\x42\xC7\x88\xC1\x34\xEB\x17\xE4\x0C\x41\xB0\xDD\x4F\xC9\x83\x29\x38\x26\x64\x1C\x21\xC9\xD1\x8A\xA5\xFC\x9F\x64\x5E\xE8\x11\x17\x41\x0C\xE6\xEB\x8C\x73\x93\xF6\xB2\xEB\xEF\xC7\xB8\xBE",
+	        63, 33, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x9B\xDF\x77\xB9\xC0\x1F\xC9\xC5\xAA\x6B\x52\x8B\x30\x77\xE5\x1C\xD0\x09\x79\x44\x45\x6D\xB6\x1A\xFF\x1B\xEE\x54\xD1\xE9\x8D\x84\xB9\x53\x5F\x50\x50\x75\x58\x69\x7C\x5C\xEE\x86\xCC\x19\x4D\x3D\x8A\x4F\xCD\x93\x48\xEF\xAE\xBF\x95\x12\x72\x88\x45\xCB\x00\xD3",
+	        63, 63, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x79\x8A\xB1\xD6\x8A\x88\x62\x00\xF4\x20\xA6\xC6\x5D\x63\x7D\x2D\xEB\x91\xB9\xDA\x63\xA9\xFF\xC4\x6A\x49\x19\x30\x73\xE2\xDE\x95\x7B\x9A\xEE\x23\xAE\x58\xD9\x58\x91\xFE\x43\x9D\x82\x0B\x95\x50\xE1\x58\x1D\xA6\x93\x70\x84\x4A\x70\xE5\xC2\xED\x28\x39\x5C\x29",
+	        63, 64, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xD2\x0E\x26\xF0\xDE\xB8\x75\xEF\xD0\xB9\xD3\x29\x2D\x1F\x94\x46\x62\xB5\x9A\x55\xFB\xAB\x4C\x13\xFF\xB9\x62\x82\x90\x93\x04\xE6\x8B\xA5\x32\x9A\x50\xB9\x2D\xAE\x79\x6B\xC3\xE1\x3E\x58\xE1\x5F\xAB\x9B\xA7\x07\x95\x52\x8B\x60\x5C\x64\x0C\xEB\x15\x93\x16\x2A",
+	        63, 65, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x60\x41\x21\xAA\x32\x6A\x49\x68\xDF\xBA\xAE\x5A\xF2\x43\xE6\xA6\x7B\xB7\x4A\x4C\x0D\xD6\xE7\x32\x71\x1E\x24\xCC\x14\xD0\x5F\x5A\x94\x0A\x21\x4F\xBB\x68\xA1\x43\x78\xC8\x71\x8C\x5C\x4E\xB8\x19\x91\xA6\x5B\x1E\x59\x87\x86\xB7\x6F\x5D\xB8\xCB\xF2\xEC\x7C\x50",
+	        63, 127, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x5A\xC4\xD5\xD9\xA5\x67\x38\x66\x0B\x18\x67\xF7\xD8\xD3\x4E\x82\x6C\xFA\xC1\x91\x40\x73\x60\xE7\xCA\x0E\x71\x7D\x30\xC8\x55\x88\x25\x83\xCF\xB2\x55\xCA\x9B\xE9\x61\x53\x73\xCF\xB1\xB8\x40\x3F\xC1\x37\xB2\x20\xEB\x4F\x03\xC5\x15\x48\x94\xE6\xAE\xDB\xA4\x60",
+	        63, 128, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x0A\x3E\x43\x52\x9D\x71\xDA\x38\x49\xBC\x64\x93\xA9\x43\x78\x1E\xB2\x5B\x79\xE9\xF5\x3F\x1A\xFE\xEB\x41\xBE\x41\x33\xDA\x6B\x31\x2E\xC5\xBD\xD6\xC2\x96\xE2\x4C\xA1\x2C\x05\xA8\x52\x86\x4C\x8F\xEE\x73\x6F\x71\x71\x6D\x5B\x60\xE1\x1C\xAC\x7D\x2F\xC6\x23\x55",
+	        63, 129, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        NULLPTR,
+	        "\xD9\x38\xD6\xD9\x8F\x0B\xD9\x87\x39\xA6\x59\x19\xD2\xB3\xC9\x14\x9A\x4F\xCE\x6C\x98\xB0\x6A\xF4\xF9\x58\x58\x31\x35\x0B\x57\x47\xC2\xF6\xA7\x82\xA3\x39\x61\xA8\x1B\x62\x59\x7A\x2E\xB1\xE9\xC0\xA5\x80\x3D\xA7\xC5\xD3\x93\x4B\xB2\x0A\x6E\x88\xBA\xA4\xAE\x02",
+	        64, 0, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xE9\x47\xAF\x37\x5E\x3D\xBF\x30\x27\x8E\x29\xE6\x39\x0A\x48\x77\x3F\xB0\x0E\x80\x86\xDF\x3B\x98\x8A\x11\x97\xA7\x3C\xBE\x9C\x4A\x23\xAC\x25\x28\xF5\xD0\x9F\xBA\xFC\xDE\xCD\x88\x85\x30\x00\x00\xA3\xC2\x51\xCF\x9A\x41\x88\x00\x02\xA6\xB5\x46\xD2\x58\xB1\xB6",
+	        64, 31, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x64\x24\x6B\xA8\x6C\x93\x07\xE2\x62\xC2\x35\xD6\xD9\xA7\xD1\xCD\xFA\xCE\x0A\x12\xB0\x5E\x57\x1C\xBC\x61\xDF\xFB\x59\x6C\x95\xAD\x04\xEF\x02\xCD\x89\xDD\x39\x80\x7D\x78\x3E\x55\x32\x3C\x53\x32\xF3\x91\xFE\x16\x0C\xF9\xF4\x41\xBB\x9E\xF7\xBA\xE6\x0A\xB7\x6F",
+	        64, 32, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xB0\x09\xE7\x5A\xBA\x9F\xED\xBE\x3C\xA4\x6A\x93\xF8\x9A\x79\x3A\x01\x8F\x06\xC6\x4A\xA6\xED\xC5\xDD\x21\xDF\x3C\x87\xD4\xBD\xC1\x0E\x29\x3E\x3F\x3B\x6A\x16\x7B\x41\xB8\xB7\x79\xC9\xB2\x16\xD0\xC2\xC2\xF8\xA7\x68\x9B\xB2\x93\x2B\x0A\x43\x58\xC0\x76\xE0\x40",
+	        64, 33, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x62\x47\x33\xE4\x70\xCC\xBE\x7A\x64\xE1\xBC\xF4\x37\x0E\x61\x92\xCC\x78\xA0\x1B\x26\x11\x39\x82\x36\x29\x76\xFA\x0A\x2A\x99\x52\xE5\xDC\x08\xB5\xFF\xBC\xEA\x5F\xE7\xDD\x48\xF7\x77\x36\x49\x58\x46\xA3\x53\x38\xCB\xFD\x96\x39\x2C\xDB\x01\x94\x4E\x8D\xCC\xD9",
+	        64, 63, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x76\x31\x38\x1F\x2B\x49\xCF\x26\xCA\x9B\xD9\x8F\x48\x09\x67\x50\x6F\x0E\xC3\x26\xC3\x44\x05\xC1\xE5\x8F\x58\x20\x80\xE0\x2F\x47\xAE\xC9\xF4\x5C\x8C\x48\x41\xA5\xF8\xBA\xD3\x24\x60\x64\xBE\x6C\x23\x15\xC8\x36\xC1\x91\xE4\x4A\x76\x8F\x2A\x8D\xBC\x22\x42\x14",
+	        64, 64, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x97\x13\x7E\x8C\x18\x22\x5B\x6B\xBC\x61\xF3\x9A\xB4\x10\x77\x91\x43\x80\x05\x9D\x13\x1D\xDC\xA7\x95\x1B\x41\x95\x4D\x49\x6A\xFF\x51\xE1\x03\x87\xCF\x61\x86\x21\x64\x7F\xD6\x4D\x4C\x5A\x49\xC5\xC7\x47\x18\x6F\xDB\x87\xBA\x22\xD3\x4C\xB3\x85\x76\x01\x64\x9D",
+	        64, 65, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\xB9\x5F\x66\xD3\x80\xDC\x88\xBF\x0F\x75\xB8\xA7\x0F\x93\xAB\xBB\x46\x34\x8C\x38\xD0\x71\x1F\x83\xAC\x80\x4A\x2C\x68\xFD\xCD\x3C\x82\x31\x83\x3B\x25\xE0\xC4\x5C\xCF\xD7\x4A\x33\x9D\x27\x2E\xC0\x2F\x44\x39\x7C\x9F\xBA\x54\x07\x0B\xA3\x5C\x71\x39\xA0\x9A\x11",
+	        64, 127, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x59\xB3\xCE\x2E\x95\xDB\x70\x0A\xA7\x34\xC1\x50\x70\xCA\x57\xDE\x3C\x37\x6C\xB7\x22\xF8\x99\x60\x6E\xE4\x0E\x67\xBF\x7C\x10\xC6\x7C\x16\xDE\x7A\xEF\x06\x02\x13\x3E\x57\x75\xE3\x9A\x4D\x88\xAE\x1C\x32\x07\xEC\x57\x77\x11\x53\x47\x07\x79\x9C\xA8\x60\x30\x96",
+	        64, 128, 64
+	    },
+	    {
+	        "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61",
+	        "\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A\x7A",
+	        "\x43\x06\xF9\x3E\x7C\xFB\xDE\x72\x5F\x83\x3E\x39\xCD\x07\x57\x89\x9B\xCD\x81\x0F\x83\x51\x56\x18\x19\xB4\x6F\xFD\xA4\x61\x86\x2E\x68\x9C\x55\x5A\xF4\xBC\x88\x46\x04\x5C\xDD\x27\xC6\xE0\x0C\x81\x07\x7C\xC5\x90\x0B\x25\x2D\xF1\xD1\x40\x01\xD8\x39\x69\x3C\x2E",
+	        64, 129, 64
+	    }
+	};
+
+	{
+		byte digest[BLAKE2b::DIGESTSIZE];
+		for (size_t i=0; i<COUNTOF(tests); ++i)
+		{
+			// the condition is written in a way which for non-default digest sizes
+			// tests the BLAKE2_Base(bool treeMode, unsigned int digestSize) constructor.
+			// See https://github.com/weidai11/cryptopp/issues/415
+			if (tests[i].dlen < BLAKE2b::DIGESTSIZE && tests[i].key == NULLPTR)
+			{
+				BLAKE2b blake2b(false, (unsigned int)tests[i].dlen);
+				blake2b.Update((const byte*)tests[i].message, tests[i].mlen);
+				blake2b.Final(digest);
+			}
+			else
+			{
+				BLAKE2b blake2b((const byte*)tests[i].key, tests[i].klen, NULLPTR, 0, NULLPTR, 0, false, (unsigned int)tests[i].dlen);
+				blake2b.Update((const byte*)tests[i].message, tests[i].mlen);
+				blake2b.Final(digest);
+			}
+
+			fail = std::memcmp(digest, tests[i].digest, tests[i].dlen) != 0;
+			if (fail)
+			{
+				std::cout << "FAILED   " << "BLAKE2b test set " << i << std::endl;
+			}
+
+			pass = pass && !fail;
+		}
+	}
+
+	{
+		// One test with salt and personalization for GH #921
+		// Test vector generated with modified BLAKE2 ref implementation
+		// https://github.com/noloader/cryptopp-test/tree/master/BLAKE2
+		const std::string key = "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c";
+		const std::string salt = "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c";
+		const std::string personalization = "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c";
+		const std::string message = "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42";
+		const std::string digest = "\x0c\xab\x0f\x22\x5d\xbe\xce\x14\xab\xcb\x70\xc9\x90\x69\xc3\xdf\xf5\x08\x18\x51\x90\xa3\x5d\x14\x41\xf2\xac\xb9\x2d\xf0\x5b\x9e\x7c\x2c\x18\x08\xe8\x01\x06\xcf\xb2\x8f\xf3\xe5\x38\xff\xd0\x72\xd8\xa6\xd3\x70\x24\x5b\x86\x61\x7d\x86\xaa\x8d\x64\xb6\xcc\xc6";
+		std::string calculated;
+
+		BLAKE2b blake2b(ConstBytePtr(key), BytePtrSize(key), ConstBytePtr(salt), BytePtrSize(salt),
+				ConstBytePtr(personalization), BytePtrSize(personalization));
+		blake2b.Update(ConstBytePtr(message), BytePtrSize(message));
+
+		calculated.resize(64);
+		blake2b.TruncatedFinal(BytePtr(calculated), BytePtrSize(calculated));
+
+		pass = pass && (digest == calculated);
+	}
+
+	std::cout << (!pass ? "FAILED   " : "passed   ") << COUNTOF(tests)+1 << " hashes and keyed hashes" << std::endl;
+
+	return pass;
+}
+
+bool ValidateSM3()
+{
+	return RunTestDataFile("TestVectors/sm3.txt");
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validat6.cpp b/runtime/third_party/cryptopp/validat6.cpp
new file mode 100644
index 0000000..d424d95
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat6.cpp
@@ -0,0 +1,408 @@
+// validat6.cpp - originally written and placed in the public domain by Wei Dai
+//                CryptoPP::Test namespace added by JW in February 2017.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "asn.h"
+#include "oids.h"
+#include "blumshub.h"
+#include "eccrypto.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+bool CryptoSystemValidate(PK_Decryptor &priv, PK_Encryptor &pub, bool thorough)
+{
+	bool pass = true, fail;
+
+	fail = !pub.GetMaterial().Validate(GlobalRNG(), thorough ? 3 : 2) || !priv.GetMaterial().Validate(GlobalRNG(), thorough ? 3 : 2);
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED    " : "passed    ");
+	std::cout << "cryptosystem key validation\n";
+
+	const byte message[] = "test message";
+	const int messageLen = 12;
+	SecByteBlock ciphertext(priv.CiphertextLength(messageLen));
+	SecByteBlock plaintext(priv.MaxPlaintextLength(ciphertext.size()));
+
+	pub.Encrypt(GlobalRNG(), message, messageLen, ciphertext);
+	fail = priv.Decrypt(GlobalRNG(), ciphertext, priv.CiphertextLength(messageLen), plaintext) != DecodingResult(messageLen);
+	fail = fail || std::memcmp(message, plaintext, messageLen);
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED    " : "passed    ");
+	std::cout << "encryption and decryption\n";
+
+	return pass;
+}
+
+bool SimpleKeyAgreementValidate(SimpleKeyAgreementDomain &d)
+{
+	if (d.GetCryptoParameters().Validate(GlobalRNG(), 3))
+		std::cout << "passed    simple key agreement domain parameters validation" << std::endl;
+	else
+	{
+		std::cout << "FAILED    simple key agreement domain parameters invalid" << std::endl;
+		return false;
+	}
+
+	SecByteBlock priv1(d.PrivateKeyLength()), priv2(d.PrivateKeyLength());
+	SecByteBlock pub1(d.PublicKeyLength()), pub2(d.PublicKeyLength());
+	SecByteBlock val1(d.AgreedValueLength()), val2(d.AgreedValueLength());
+
+	d.GenerateKeyPair(GlobalRNG(), priv1, pub1);
+	d.GenerateKeyPair(GlobalRNG(), priv2, pub2);
+
+	std::memset(val1.begin(), 0x10, val1.size());
+	std::memset(val2.begin(), 0x11, val2.size());
+
+	if (!(d.Agree(val1, priv1, pub2) && d.Agree(val2, priv2, pub1)))
+	{
+		std::cout << "FAILED    simple key agreement failed" << std::endl;
+		return false;
+	}
+
+	if (std::memcmp(val1.begin(), val2.begin(), d.AgreedValueLength()))
+	{
+		std::cout << "FAILED    simple agreed values not equal" << std::endl;
+		return false;
+	}
+
+	std::cout << "passed    simple key agreement" << std::endl;
+	return true;
+}
+
+bool AuthenticatedKeyAgreementValidate(AuthenticatedKeyAgreementDomain &d)
+{
+	if (d.GetCryptoParameters().Validate(GlobalRNG(), 3))
+		std::cout << "passed    authenticated key agreement domain parameters validation" << std::endl;
+	else
+	{
+		std::cout << "FAILED    authenticated key agreement domain parameters invalid" << std::endl;
+		return false;
+	}
+
+	SecByteBlock spriv1(d.StaticPrivateKeyLength()), spriv2(d.StaticPrivateKeyLength());
+	SecByteBlock epriv1(d.EphemeralPrivateKeyLength()), epriv2(d.EphemeralPrivateKeyLength());
+	SecByteBlock spub1(d.StaticPublicKeyLength()), spub2(d.StaticPublicKeyLength());
+	SecByteBlock epub1(d.EphemeralPublicKeyLength()), epub2(d.EphemeralPublicKeyLength());
+	SecByteBlock val1(d.AgreedValueLength()), val2(d.AgreedValueLength());
+
+	d.GenerateStaticKeyPair(GlobalRNG(), spriv1, spub1);
+	d.GenerateStaticKeyPair(GlobalRNG(), spriv2, spub2);
+	d.GenerateEphemeralKeyPair(GlobalRNG(), epriv1, epub1);
+	d.GenerateEphemeralKeyPair(GlobalRNG(), epriv2, epub2);
+
+	std::memset(val1.begin(), 0x10, val1.size());
+	std::memset(val2.begin(), 0x11, val2.size());
+
+	if (d.Agree(val1, spriv1, epriv1, spub2, epub2) && d.Agree(val2, spriv2, epriv2, spub1, epub1))
+	{
+		std::cout << "passed    authenticated key agreement protocol execution" << std::endl;
+	}
+	else
+	{
+		std::cout << "FAILED    authenticated key agreement protocol execution" << std::endl;
+		return false;
+	}
+
+	if (std::memcmp(val1.begin(), val2.begin(), d.AgreedValueLength()))
+	{
+		std::cout << "FAILED    authenticated agreed values not equal" << std::endl;
+		return false;
+	}
+
+	std::cout << "passed    authenticated key agreement" << std::endl;
+	return true;
+}
+
+bool AuthenticatedKeyAgreementWithRolesValidate(AuthenticatedKeyAgreementDomain &initiator, AuthenticatedKeyAgreementDomain &recipient)
+{
+	if (initiator.GetCryptoParameters().Validate(GlobalRNG(), 3))
+		std::cout << "passed    authenticated key agreement domain parameters validation (initiator)" << std::endl;
+	else
+	{
+		std::cout << "FAILED    authenticated key agreement domain parameters invalid (initiator)" << std::endl;
+		return false;
+	}
+
+	if (recipient.GetCryptoParameters().Validate(GlobalRNG(), 3))
+		std::cout << "passed    authenticated key agreement domain parameters validation (recipient)" << std::endl;
+	else
+	{
+		std::cout << "FAILED    authenticated key agreement domain parameters invalid (recipient)" << std::endl;
+		return false;
+	}
+
+	if (initiator.StaticPrivateKeyLength() != recipient.StaticPrivateKeyLength() ||
+	    initiator.EphemeralPrivateKeyLength() != recipient.EphemeralPrivateKeyLength() ||
+	    initiator.StaticPublicKeyLength() != recipient.StaticPublicKeyLength() ||
+	    initiator.EphemeralPublicKeyLength() != recipient.EphemeralPublicKeyLength() ||
+	    initiator.AgreedValueLength() != recipient.AgreedValueLength())
+	{
+		std::cout << "FAILED    authenticated key agreement domain parameter consistency" << std::endl;
+		return false;
+	}
+	else
+	{
+		std::cout << "passed    authenticated key agreement domain parameter consistency" << std::endl;
+	}
+
+	SecByteBlock spriv1(initiator.StaticPrivateKeyLength()), spriv2(recipient.StaticPrivateKeyLength());
+	SecByteBlock epriv1(initiator.EphemeralPrivateKeyLength()), epriv2(recipient.EphemeralPrivateKeyLength());
+	SecByteBlock spub1(initiator.StaticPublicKeyLength()), spub2(recipient.StaticPublicKeyLength());
+	SecByteBlock epub1(initiator.EphemeralPublicKeyLength()), epub2(recipient.EphemeralPublicKeyLength());
+	SecByteBlock val1(initiator.AgreedValueLength()), val2(recipient.AgreedValueLength());
+
+	initiator.GenerateStaticKeyPair(GlobalRNG(), spriv1, spub1);
+	recipient.GenerateStaticKeyPair(GlobalRNG(), spriv2, spub2);
+	initiator.GenerateEphemeralKeyPair(GlobalRNG(), epriv1, epub1);
+	recipient.GenerateEphemeralKeyPair(GlobalRNG(), epriv2, epub2);
+
+	std::memset(val1.begin(), 0x10, val1.size());
+	std::memset(val2.begin(), 0x11, val2.size());
+
+	if (initiator.Agree(val1, spriv1, epriv1, spub2, epub2) && recipient.Agree(val2, spriv2, epriv2, spub1, epub1))
+	{
+		std::cout << "passed    authenticated key agreement protocol execution" << std::endl;
+	}
+	else
+	{
+		std::cout << "FAILED    authenticated key agreement protocol execution" << std::endl;
+		return false;
+	}
+
+	if (std::memcmp(val1.begin(), val2.begin(), initiator.AgreedValueLength()))
+	{
+		std::cout << "FAILED    authenticated agreed values not equal" << std::endl;
+		return false;
+	}
+
+	std::cout << "passed    authenticated key agreement shared secret" << std::endl;
+	return true;
+}
+
+bool SignatureValidate(PK_Signer &priv, PK_Verifier &pub, bool thorough)
+{
+	bool pass = true, fail;
+
+	fail = !pub.GetMaterial().Validate(GlobalRNG(), thorough ? 3 : 2) || !priv.GetMaterial().Validate(GlobalRNG(), thorough ? 3 : 2);
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED    " : "passed    ");
+	std::cout << "signature key validation\n";
+
+	const byte message[] = "test message";
+	const int messageLen = 12;
+
+	SecByteBlock signature(priv.MaxSignatureLength());
+	size_t signatureLength = priv.SignMessage(GlobalRNG(), message, messageLen, signature);
+	fail = !pub.VerifyMessage(message, messageLen, signature, signatureLength);
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED    " : "passed    ");
+	std::cout << "signature and verification\n";
+
+	++signature[0];
+	fail = pub.VerifyMessage(message, messageLen, signature, signatureLength);
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED    " : "passed    ");
+	std::cout << "checking invalid signature" << std::endl;
+
+	if (priv.MaxRecoverableLength() > 0)
+	{
+		signatureLength = priv.SignMessageWithRecovery(GlobalRNG(), message, messageLen, NULLPTR, 0, signature);
+		SecByteBlock recovered(priv.MaxRecoverableLengthFromSignatureLength(signatureLength));
+		DecodingResult result = pub.RecoverMessage(recovered, NULLPTR, 0, signature, signatureLength);
+		fail = !(result.isValidCoding && result.messageLength == messageLen && std::memcmp(recovered, message, messageLen) == 0);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "signature and verification with recovery" << std::endl;
+
+		++signature[0];
+		result = pub.RecoverMessage(recovered, NULLPTR, 0, signature, signatureLength);
+		fail = result.isValidCoding;
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "recovery with invalid signature" << std::endl;
+	}
+
+	return pass;
+}
+
+bool ValidateBBS()
+{
+	std::cout << "\nBlumBlumShub validation suite running...\n\n";
+
+	Integer p("212004934506826557583707108431463840565872545889679278744389317666981496005411448865750399674653351");
+	Integer q("100677295735404212434355574418077394581488455772477016953458064183204108039226017738610663984508231");
+	Integer seed("63239752671357255800299643604761065219897634268887145610573595874544114193025997412441121667211431");
+	BlumBlumShub bbs(p, q, seed);
+	bool pass = true, fail;
+	int j;
+
+	const byte output1[] = {
+		0x49,0xEA,0x2C,0xFD,0xB0,0x10,0x64,0xA0,0xBB,0xB9,
+		0x2A,0xF1,0x01,0xDA,0xC1,0x8A,0x94,0xF7,0xB7,0xCE};
+	const byte output2[] = {
+		0x74,0x45,0x48,0xAE,0xAC,0xB7,0x0E,0xDF,0xAF,0xD7,
+		0xD5,0x0E,0x8E,0x29,0x83,0x75,0x6B,0x27,0x46,0xA1};
+
+	byte buf[20];
+	std::ostringstream oss;
+
+	bbs.GenerateBlock(buf, 20);
+	fail = std::memcmp(output1, buf, 20) != 0;
+	pass = pass && !fail;
+
+	oss << (fail ? "FAILED    " : "passed    ");
+	for (j=0;j<20;j++)
+		oss << std::setw(2) << std::setfill('0') << std::hex << (int)buf[j];
+	oss << std::endl;
+
+	bbs.Seek(10);
+	bbs.GenerateBlock(buf, 10);
+	fail = std::memcmp(output1+10, buf, 10) != 0;
+	pass = pass && !fail;
+
+	oss << (fail ? "FAILED    " : "passed    ");
+	for (j=0;j<10;j++)
+		oss << std::setw(2) << std::setfill('0') << std::hex << (int)buf[j];
+	oss << std::endl;
+
+	bbs.Seek(1234567);
+	bbs.GenerateBlock(buf, 20);
+	fail = std::memcmp(output2, buf, 20) != 0;
+	pass = pass && !fail;
+
+	oss << (fail ? "FAILED    " : "passed    ");
+	for (j=0;j<20;j++)
+		oss << std::setw(2) << std::setfill('0') << std::hex << (int)buf[j];
+	oss << std::endl;
+
+	std::cout << oss.str();
+	return pass;
+}
+
+bool ValidateECP()
+{
+	// Remove word recommend. Some ECP curves may not be recommended depending
+	// on whom you ask. ECP is more descriptive item in this case.
+	std::cout << "\nTesting SEC 2, NIST and Brainpool ECP curves...\n\n";
+	bool pass = true; OID oid;
+
+	while (!(oid = DL_GroupParameters_EC<ECP>::GetNextRecommendedParametersOID(oid)).GetValues().empty())
+	{
+		DL_GroupParameters_EC<ECP> params(oid);
+		pass = params.Validate(GlobalRNG(), 2);
+
+		// Test addition of identity element
+		DL_GroupParameters_EC<ECP>::Element e1;
+		e1 = params.GetCurve().Add(e1, e1);
+		pass = params.IsIdentity(e1) && pass;
+
+		// Test doubling of identity element
+		DL_GroupParameters_EC<ECP>::Element e2;
+		e2 = params.GetCurve().Double(e2);
+		pass = params.IsIdentity(e2) && pass;
+
+		// Test multiplication of identity element
+		DL_GroupParameters_EC<ECP>::Element e3;
+		Integer two = Integer::Two();
+		e3 = params.GetCurve().Multiply(two, e3);
+		pass = params.IsIdentity(e3) && pass;
+
+		std::cout << (pass ? "passed" : "FAILED") << "    " << std::dec << params.GetCurve().GetField().MaxElementBitLength() << " bits\n";
+	}
+
+	std::cout << "\nECP validation suite running...\n\n";
+	return ValidateECP_Agreement() && ValidateECP_Encrypt() && ValidateECP_NULLDigest_Encrypt() && ValidateECP_Sign() && pass;
+}
+
+bool ValidateEC2N()
+{
+	// Remove word recommend. Binary curves may not be recommended depending
+	// on whom you ask. EC2N is more descriptive item in this case.
+	std::cout << "\nTesting SEC 2 EC2N curves...\n\n";
+	bool pass = true; OID oid;
+
+#if 1	// TODO: turn this back on when I make EC2N faster for pentanomial basis
+	while (!(oid = DL_GroupParameters_EC<EC2N>::GetNextRecommendedParametersOID(oid)).GetValues().empty())
+	{
+		DL_GroupParameters_EC<EC2N> params(oid);
+		pass = params.Validate(GlobalRNG(), 2);
+
+		// Test addition of identity element
+		DL_GroupParameters_EC<EC2N>::Element e1;
+		e1 = params.GetCurve().Add(e1, e1);
+		pass = params.IsIdentity(e1) && pass;
+
+		// Test doubling of identity element
+		DL_GroupParameters_EC<EC2N>::Element e2;
+		e2 = params.GetCurve().Double(e2);
+		pass = params.IsIdentity(e2) && pass;
+
+		// Test multiplication of identity element
+		DL_GroupParameters_EC<EC2N>::Element e3;
+		Integer two = Integer::Two();
+		e3 = params.GetCurve().Multiply(two, e3);
+		pass = params.IsIdentity(e3) && pass;
+
+		std::cout << (pass ? "passed" : "FAILED") << "    " << params.GetCurve().GetField().MaxElementBitLength() << " bits\n";
+	}
+#endif
+
+	std::cout << "\nEC2N validation suite running...\n\n";
+	return ValidateEC2N_Agreement() && ValidateEC2N_Encrypt() && ValidateEC2N_Sign() && pass;
+}
+
+bool ValidateRSA()
+{
+	std::cout << "\nRSA validation suite running...\n\n";
+	return ValidateRSA_Encrypt() && ValidateRSA_Sign();
+}
+
+bool ValidateLUC()
+{
+	std::cout << "\nLUC validation suite running...\n\n";
+	return ValidateLUC_Encrypt() && ValidateLUC_Sign();
+}
+
+bool ValidateLUC_DL()
+{
+	// Prologue printed in each function
+	return ValidateLUC_DL_Encrypt() && ValidateLUC_DL_Sign();
+}
+
+bool ValidateRabin()
+{
+	std::cout << "\nRabin validation suite running...\n\n";
+	return ValidateRabin_Encrypt() && ValidateRabin_Sign();
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validat7.cpp b/runtime/third_party/cryptopp/validat7.cpp
new file mode 100644
index 0000000..ac17592
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat7.cpp
@@ -0,0 +1,705 @@
+// validat7.cpp - originally written and placed in the public domain by Wei Dai
+//                CryptoPP::Test namespace added by JW in February 2017.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "asn.h"
+#include "oids.h"
+
+#include "sha.h"
+#include "sha3.h"
+
+#include "dh.h"
+#include "luc.h"
+#include "mqv.h"
+#include "xtr.h"
+#include "hmqv.h"
+#include "pubkey.h"
+#include "xtrcrypt.h"
+#include "eccrypto.h"
+
+// Curve25519
+#include "xed25519.h"
+#include "donna.h"
+#include "naclite.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+inline bool operator==(const x25519& lhs, const x25519& rhs)
+{
+	// This is a hack because the KeyAgreement classes do not make it easy to access the PrivateKey
+	ByteQueue q1, q2;
+	lhs.DEREncodePrivateKey(q1);
+	rhs.DEREncodePrivateKey(q2);
+
+	return q1 == q2;
+}
+
+inline bool operator!=(const x25519& lhs, const x25519& rhs)
+{
+	return !operator==(lhs, rhs);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+bool ValidateDH()
+{
+	std::cout << "\nDH validation suite running...\n\n";
+
+	FileSource f(DataDir("TestData/dh1024.dat").c_str(), true, new HexDecoder);
+	DH dh(f);
+	return SimpleKeyAgreementValidate(dh);
+}
+
+bool ValidateX25519()
+{
+	std::cout << "\nx25519 validation suite running...\n\n";
+
+	FileSource f(DataDir("TestData/x25519.dat").c_str(), true, new HexDecoder);
+	x25519 dh(f);
+	return SimpleKeyAgreementValidate(dh);
+}
+
+bool ValidateMQV()
+{
+	std::cout << "\nMQV validation suite running...\n\n";
+
+	FileSource f(DataDir("TestData/mqv1024.dat").c_str(), true, new HexDecoder);
+	MQV mqv(f);
+	return AuthenticatedKeyAgreementValidate(mqv);
+}
+
+bool ValidateHMQV()
+{
+	std::cout << "\nHMQV validation suite running...\n\n";
+	bool success = true, fail;
+
+	FileSource f256(DataDir("TestData/hmqv256.dat").c_str(), true, new HexDecoder);
+	FileSource f384(DataDir("TestData/hmqv384.dat").c_str(), true, new HexDecoder);
+	FileSource f512(DataDir("TestData/hmqv512.dat").c_str(), true, new HexDecoder);
+
+	/////////////////////////
+
+	std::cout << "HMQV with NIST P-256 and SHA-256:" << std::endl;
+
+	ECHMQV256 hmqvB256(false);
+	hmqvB256.AccessGroupParameters().BERDecode(f256);
+	const OID oid = ASN1::secp256r1();
+	ECHMQV< ECP >::Domain hmqvA256(oid, true /*client*/);
+
+	fail = !AuthenticatedKeyAgreementWithRolesValidate(hmqvA256, hmqvB256);
+	success = !fail && success;
+	if (fail == false)
+		std::cout << "passed    authenticated key agreement" << std::endl;
+	else
+		std::cout << "FAILED    authenticated key agreement" << std::endl;
+
+	/////////////////////////
+
+	std::cout << "HMQV with NIST P-384 and SHA-384:" << std::endl;
+
+	ECHMQV384 hmqvB384(false);
+	hmqvB384.AccessGroupParameters().BERDecode(f384);
+	const OID oid384 = ASN1::secp384r1();
+	ECHMQV384 hmqvA384(oid384, true /*client*/);
+
+	fail = !AuthenticatedKeyAgreementWithRolesValidate(hmqvA384, hmqvB384);
+	success = !fail && success;
+	if (fail == false)
+		std::cout << "passed    authenticated key agreement" << std::endl;
+	else
+		std::cout << "FAILED    authenticated key agreement" << std::endl;
+
+	/////////////////////////
+
+	std::cout << "HMQV with NIST P-521 and SHA-512:" << std::endl;
+
+	ECHMQV512 hmqvB521(false);
+	hmqvB521.AccessGroupParameters().BERDecode(f512);
+	const OID oid521 = ASN1::secp521r1();
+	ECHMQV512 hmqvA521(oid521, true /*client*/);
+
+	fail = !AuthenticatedKeyAgreementWithRolesValidate(hmqvA521, hmqvB521);
+	success = !fail && success;
+	if (fail == false)
+		std::cout << "passed    authenticated key agreement" << std::endl;
+	else
+		std::cout << "FAILED    authenticated key agreement" << std::endl;
+
+	return success;
+}
+
+bool ValidateFHMQV()
+{
+	std::cout << "\nFHMQV validation suite running...\n\n";
+	bool success = true, fail;
+
+	FileSource f256(DataDir("TestData/fhmqv256.dat").c_str(), true, new HexDecoder);
+	FileSource f384(DataDir("TestData/fhmqv384.dat").c_str(), true, new HexDecoder);
+	FileSource f512(DataDir("TestData/fhmqv512.dat").c_str(), true, new HexDecoder);
+
+	/////////////////////////
+
+	std::cout << "FHMQV with NIST P-256 and SHA-256:" << std::endl;
+
+	ECFHMQV256 fhmqvB256(false);
+	fhmqvB256.AccessGroupParameters().BERDecode(f256);
+	const OID oid = ASN1::secp256r1();
+	ECFHMQV< ECP >::Domain fhmqvA256(oid, true /*client*/);
+
+	fail = !AuthenticatedKeyAgreementWithRolesValidate(fhmqvA256, fhmqvB256);
+	success = !fail && success;
+	if (fail == false)
+		std::cout << "passed    authenticated key agreement" << std::endl;
+	else
+		std::cout << "FAILED    authenticated key agreement" << std::endl;
+
+	/////////////////////////
+
+	std::cout << "FHMQV with NIST P-384 and SHA-384:" << std::endl;
+
+	ECHMQV384 fhmqvB384(false);
+	fhmqvB384.AccessGroupParameters().BERDecode(f384);
+	const OID oid384 = ASN1::secp384r1();
+	ECHMQV384 fhmqvA384(oid384, true /*client*/);
+
+	fail = !AuthenticatedKeyAgreementWithRolesValidate(fhmqvA384, fhmqvB384);
+	success = !fail && success;
+	if (fail == false)
+		std::cout << "passed    authenticated key agreement" << std::endl;
+	else
+		std::cout << "FAILED    authenticated key agreement" << std::endl;
+
+	/////////////////////////
+
+	std::cout << "FHMQV with NIST P-521 and SHA-512:" << std::endl;
+
+	ECHMQV512 fhmqvB521(false);
+	fhmqvB521.AccessGroupParameters().BERDecode(f512);
+	const OID oid521 = ASN1::secp521r1();
+	ECHMQV512 fhmqvA521(oid521, true /*client*/);
+
+	fail = !AuthenticatedKeyAgreementWithRolesValidate(fhmqvA521, fhmqvB521);
+	success = !fail && success;
+	if (fail == false)
+		std::cout << "passed    authenticated key agreement" << std::endl;
+	else
+		std::cout << "FAILED    authenticated key agreement" << std::endl;
+
+	return success;
+}
+
+bool ValidateLUC_DH()
+{
+	std::cout << "\nLUC-DH validation suite running...\n\n";
+
+	FileSource f(DataDir("TestData/lucd512.dat").c_str(), true, new HexDecoder);
+	LUC_DH dh(f);
+	return SimpleKeyAgreementValidate(dh);
+}
+
+bool ValidateXTR_DH()
+{
+	std::cout << "\nXTR-DH validation suite running...\n\n";
+
+	FileSource f(DataDir("TestData/xtrdh171.dat").c_str(), true, new HexDecoder);
+	XTR_DH dh(f);
+	return SimpleKeyAgreementValidate(dh);
+}
+
+bool ValidateECP_Agreement()
+{
+	ECDH<ECP>::Domain ecdhc(ASN1::secp192r1());
+	ECMQV<ECP>::Domain ecmqvc(ASN1::secp192r1());
+	bool pass = SimpleKeyAgreementValidate(ecdhc);
+	pass = AuthenticatedKeyAgreementValidate(ecmqvc) && pass;
+
+	std::cout << "Turning on point compression..." << std::endl;
+	ecdhc.AccessGroupParameters().SetPointCompression(true);
+	ecmqvc.AccessGroupParameters().SetPointCompression(true);
+	pass = SimpleKeyAgreementValidate(ecdhc) && pass;
+	pass = AuthenticatedKeyAgreementValidate(ecmqvc) && pass;
+
+	return pass;
+}
+
+bool ValidateEC2N_Agreement()
+{
+	ECDH<EC2N>::Domain ecdhc(ASN1::sect193r1());
+	ECMQV<EC2N>::Domain ecmqvc(ASN1::sect193r1());
+	bool pass = SimpleKeyAgreementValidate(ecdhc);
+	pass = AuthenticatedKeyAgreementValidate(ecmqvc) && pass;
+
+	std::cout << "Turning on point compression..." << std::endl;
+	ecdhc.AccessGroupParameters().SetPointCompression(true);
+	ecmqvc.AccessGroupParameters().SetPointCompression(true);
+	pass = SimpleKeyAgreementValidate(ecdhc) && pass;
+	pass = AuthenticatedKeyAgreementValidate(ecmqvc) && pass;
+
+	return pass;
+}
+
+// TestX25519 is slightly more comprehensive than ValidateX25519
+// because it cross-validates against Bernstein's NaCL library.
+// TestX25519 called in Debug builds.
+bool TestX25519()
+{
+	std::cout << "\nTesting curve25519 Key Agreements...\n\n";
+	const unsigned int AGREE_COUNT = 64;
+	bool pass = true, fail;
+
+	size_t i = 0;
+	unsigned int failed = 0;
+
+	SecByteBlock priv1(32), priv2(32), pub1(32), pub2(32), share1(32), share2(32);
+	for (i=0, failed=0; i<AGREE_COUNT; ++i)
+	{
+		GlobalRNG().GenerateBlock(priv1, priv1.size());
+		GlobalRNG().GenerateBlock(priv2, priv2.size());
+
+		priv1[0] &= 248; priv1[31] &= 127; priv1[31] |= 64;
+		priv2[0] &= 248; priv2[31] &= 127; priv2[31] |= 64;
+
+		// Andrew Moon's curve25519-donna
+		Donna::curve25519_mult(pub1, priv1);
+		Donna::curve25519_mult(pub2, priv2);
+
+		int ret1 = Donna::curve25519_mult(share1, priv1, pub2);
+		int ret2 = Donna::curve25519_mult(share2, priv2, pub1);
+		int ret3 = std::memcmp(share1, share2, 32);
+
+#if defined(CRYPTOPP_DISABLE_NACL)
+		int ret4=0, ret5=0, ret6=0;
+#else
+		// Bernstein's NaCl requires DefaultAutoSeededRNG.
+		NaCl::crypto_box_keypair(pub2, priv2);
+
+		int ret4 = Donna::curve25519_mult(share1, priv1, pub2);
+		int ret5 = NaCl::crypto_scalarmult(share2, priv2, pub1);
+		int ret6 = std::memcmp(share1, share2, 32);
+#endif
+
+		fail = ret1 != 0 || ret2 != 0 || ret3 != 0 || ret4 != 0 || ret5 != 0 || ret6 != 0;
+		if (fail) failed++;
+	}
+
+	failed ? fail = true : fail = false;
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED" : "passed") << "  ";
+	std::cout << AGREE_COUNT << " key agreements" << std::endl;
+
+	try {
+
+		FileSource f1(DataDir("TestData/x25519.dat").c_str(), true, new HexDecoder);
+		FileSource f2(DataDir("TestData/x25519v0.dat").c_str(), true, new HexDecoder);
+		FileSource f3(DataDir("TestData/x25519v1.dat").c_str(), true, new HexDecoder);
+
+		x25519 x1(f1);
+		x25519 x2(f2);
+		x25519 x3(f3);
+
+		FileSource f4(DataDir("TestData/x25519.dat").c_str(), true, new HexDecoder);
+		FileSource f5(DataDir("TestData/x25519v0.dat").c_str(), true, new HexDecoder);
+		FileSource f6(DataDir("TestData/x25519v1.dat").c_str(), true, new HexDecoder);
+
+		x1.Load(f4);
+		x2.Load(f5);
+		x3.Load(f6);
+
+		// No throw is success
+		fail = false;
+	}
+	catch (const BERDecodeErr&) {
+		fail = true;
+	}
+
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED" : "passed") << "  ";
+	std::cout << "x25519 load and save\n";
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+	{
+		x25519 x1(GlobalRNG()), x2;
+
+		ByteQueue q;
+		x1.DEREncode(q);
+		x2.BERDecode(q);
+
+		fail = (x1 != x2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED" : "passed") << "  ";
+		std::cout << "x25519 encoding and decoding\n";
+	}
+	{
+		SecByteBlock b1(32);
+		GlobalRNG().GenerateBlock(b1, b1.size());
+		b1[0] &= 248; b1[31] &= 127; b1[31] |= 64;
+
+		try {
+			fail = false;
+			x25519 x1(b1);
+			if (!x1.Validate(GlobalRNG(), 3))
+				throw Exception(Exception::OTHER_ERROR, "x25519::Validate");
+		} catch(const Exception&) {
+			fail = true;
+		}
+
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED" : "passed") << "  ";
+		std::cout << "x25519 private key byte buffer construction\n";
+
+		std::reverse(b1.begin(), b1.begin()+b1.size());
+		Integer x(b1.begin(), b1.size());
+
+		try {
+			fail = false;
+			x25519 x1(x);
+			if (!x1.Validate(GlobalRNG(), 3))
+				throw Exception(Exception::OTHER_ERROR, "x25519::Validate");
+		} catch(const Exception&) {
+			fail = true;
+		}
+
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED" : "passed") << "  ";
+		std::cout << "x25519 private key Integer construction\n";
+	}
+
+	{
+		SecByteBlock b1(32), b2(32);
+		GlobalRNG().GenerateBlock(b1, b1.size());
+		b1[0] &= 248; b1[31] &= 127; b1[31] |= 64;
+		Donna::curve25519_mult(b2, b1);
+
+		try {
+			fail = false;
+			x25519 x1(b2, b1);
+			if (!x1.Validate(GlobalRNG(), 3))
+				throw Exception(Exception::OTHER_ERROR, "x25519::Validate");
+		} catch(const Exception&) {
+			fail = true;
+		}
+
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED" : "passed") << "  ";
+		std::cout << "x25519 public key byte buffer construction\n";
+
+		SecByteBlock b3(b1), b4(b2);
+		std::reverse(b3.begin(), b3+b3.size());
+		std::reverse(b4.begin(), b4+b4.size());
+
+		Integer x(b3, b3.size());
+		Integer y(b4, b4.size());
+
+		try {
+			fail = false;
+			x25519 x1(y, x);
+			if (!x1.Validate(GlobalRNG(), 3))
+				throw Exception(Exception::OTHER_ERROR, "x25519::Validate");
+		} catch(const Exception&) {
+			fail = true;
+		}
+
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED" : "passed");
+		std::cout << "  " << "x25519 public key Integer construction\n";
+
+		try {
+			fail = false;
+			x25519 x1(b2, b1);
+			x25519 x2(y, x);
+			if (x1 != x2)
+				throw Exception(Exception::OTHER_ERROR, "x25519::Validate");
+		} catch(const Exception&) {
+			fail = true;
+		}
+
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED" : "passed") << "  ";
+		std::cout << "x25519 byte buffer and Integer consistency\n";
+	}
+#endif
+
+	return pass;
+}
+
+// TestEd25519 is slightly more comprehensive than ValidateEd25519
+// because it cross-validates against Bernstein's NaCL library.
+// TestEd25519 called in Debug builds.
+bool TestEd25519()
+{
+	std::cout << "\nTesting ed25519 Signatures...\n\n";
+	bool pass = true, fail;
+
+	size_t i = 0;
+	unsigned int failed = 0;
+
+#ifndef CRYPTOPP_DISABLE_NACL
+	const unsigned int SIGN_COUNT = 64, MSG_SIZE=128;
+	const unsigned int NACL_EXTRA=NaCl::crypto_sign_BYTES;
+
+	// Test key conversion
+	byte seed[32], sk1[64], sk2[64], pk1[32], pk2[32];
+	for (i = 0, failed = 0; i<SIGN_COUNT; ++i)
+	{
+		GlobalRNG().GenerateBlock(seed, 32);
+		std::memcpy(sk1, seed, 32);
+		std::memcpy(sk2, seed, 32);
+
+		int ret1 = NaCl::crypto_sign_sk2pk(pk1, sk1);
+		int ret2 = Donna::ed25519_publickey(pk2, sk2);
+		int ret3 = std::memcmp(pk1, pk2, 32);
+
+		fail = ret1 != 0 || ret2 != 0 || ret3 != 0;
+		if (fail) failed++;
+	}
+
+	failed ? fail = true : fail = false;
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED" : "passed") << "  ";
+	std::cout << SIGN_COUNT << " public keys" << std::endl;
+
+	// Test signature generation
+	for (i = 0, failed = 0; i<SIGN_COUNT; ++i)
+	{
+		// Fresh keypair
+		(void)NaCl::crypto_sign_keypair(pk1, sk1);
+		std::memcpy(sk2, sk1, 32);
+		std::memcpy(pk2, pk1, 32);
+
+		// Message and signatures
+		byte msg[MSG_SIZE], sig1[MSG_SIZE+NACL_EXTRA], sig2[64];
+		GlobalRNG().GenerateBlock(msg, MSG_SIZE);
+		size_t len = GlobalRNG().GenerateWord32(0, MSG_SIZE);
+
+		// Spike the signatures
+		sig1[1] = 1; sig2[2] = 2;
+		word64 smlen = sizeof(sig1);
+
+		int ret1 = NaCl::crypto_sign(sig1, &smlen, msg, len, sk1);
+		int ret2 = Donna::ed25519_sign(msg, len, sk2, pk2, sig2);
+		int ret3 = std::memcmp(sig1, sig2, 64);
+
+		fail = ret1 != 0 || ret2 != 0 || ret3 != 0;
+		if (fail) failed++;
+	}
+
+	failed ? fail = true : fail = false;
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED" : "passed") << "  ";
+	std::cout << SIGN_COUNT << " signatures" << std::endl;
+
+	// Test signature verification
+	for (i = 0, failed = 0; i<SIGN_COUNT; ++i)
+	{
+		// Fresh keypair
+		(void)NaCl::crypto_sign_keypair(pk1, sk1);
+		std::memcpy(sk2, sk1, 32);
+		std::memcpy(pk2, pk1, 32);
+
+		// Message and signatures
+		byte msg1[MSG_SIZE+NACL_EXTRA], msg2[MSG_SIZE];
+		byte sig1[MSG_SIZE+NACL_EXTRA], sig2[64];
+		GlobalRNG().GenerateBlock(msg1, MSG_SIZE);
+		size_t len = GlobalRNG().GenerateWord32(0, MSG_SIZE);
+		std::memcpy(msg2, msg1, len);
+
+		// Spike the signatures
+		sig1[1] = 1; sig2[2] = 2;
+
+		word64 smlen = sizeof(sig1);
+		int ret1 = NaCl::crypto_sign(sig1, &smlen, msg1, len, sk1);
+		int ret2 = Donna::ed25519_sign(msg2, len, sk2, pk2, sig2);
+		int ret3 = std::memcmp(sig1, sig2, 64);
+
+		bool tamper = !!GlobalRNG().GenerateBit();
+		if (tamper)
+		{
+			sig1[1] ^= 1;
+			sig2[1] ^= 1;
+		}
+
+		// Verify the other's signature using the other's key
+		word64 mlen = len+NACL_EXTRA;
+		int ret4 = NaCl::crypto_sign_open(msg1, &mlen, sig1, smlen, pk2);
+		int ret5 = Donna::ed25519_sign_open(msg2, len, pk1, sig2);
+
+		fail = ret1 != 0 || ret2 != 0 || ret3 != 0 || ((ret4 != 0) ^ tamper) || ((ret5 != 0) ^ tamper);
+		if (fail) failed++;
+	}
+
+	failed ? fail = true : fail = false;
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED" : "passed") << "  ";
+	std::cout << SIGN_COUNT << " verifications" << std::endl;
+
+	// Test signature verification using streams
+	for (i = 0, failed = 0; i<SIGN_COUNT; ++i)
+	{
+		// Fresh keypair
+		(void)NaCl::crypto_sign_keypair(pk1, sk1);
+		std::memcpy(sk2, sk1, 32);
+		std::memcpy(pk2, pk1, 32);
+
+		// Message and signatures
+		byte msg1[MSG_SIZE+NACL_EXTRA], msg2[MSG_SIZE];
+		byte sig1[MSG_SIZE+NACL_EXTRA], sig2[64];
+		GlobalRNG().GenerateBlock(msg1, MSG_SIZE);
+		size_t len = GlobalRNG().GenerateWord32(0, MSG_SIZE);
+		std::memcpy(msg2, msg1, len);
+
+		// Spike the signatures
+		sig1[1] = 1; sig2[2] = 2;
+
+		// Create a stream
+		std::string str2((const char*)msg2, len);
+		std::istringstream iss(str2);
+
+		word64 smlen = sizeof(sig1);
+		int ret1 = NaCl::crypto_sign(sig1, &smlen, msg1, len, sk1);
+		int ret2 = Donna::ed25519_sign(iss, sk2, pk2, sig2);
+		int ret3 = std::memcmp(sig1, sig2, 64);
+
+		bool tamper = !!GlobalRNG().GenerateBit();
+		if (tamper)
+		{
+			sig1[1] ^= 1;
+			sig2[1] ^= 1;
+		}
+
+		// Reset stream
+		iss.clear();
+		iss.seekg(0);
+
+		// Verify the other's signature using the other's key
+		word64 mlen = len+NACL_EXTRA;
+		int ret4 = NaCl::crypto_sign_open(msg1, &mlen, sig1, smlen, pk2);
+		int ret5 = Donna::ed25519_sign_open(iss, pk1, sig2);
+
+		fail = ret1 != 0 || ret2 != 0 || ret3 != 0 || ((ret4 != 0) ^ tamper) || ((ret5 != 0) ^ tamper);
+		if (fail) failed++;
+	}
+
+	failed ? fail = true : fail = false;
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED" : "passed") << "  ";
+	std::cout << SIGN_COUNT << " streams" << std::endl;
+#endif
+
+	// RFC 8032 test vector
+	try
+	{
+		// RFC 8032 Ed25519 test vector 3, p. 23
+		byte sk[] = {
+			0xc5,0xaa,0x8d,0xf4,0x3f,0x9f,0x83,0x7b,0xed,0xb7,0x44,0x2f,0x31,0xdc,0xb7,0xb1,
+			0x66,0xd3,0x85,0x35,0x07,0x6f,0x09,0x4b,0x85,0xce,0x3a,0x2e,0x0b,0x44,0x58,0xf7
+		};
+		byte pk[] = {
+			0xfc,0x51,0xcd,0x8e,0x62,0x18,0xa1,0xa3,0x8d,0xa4,0x7e,0xd0,0x02,0x30,0xf0,0x58,
+			0x08,0x16,0xed,0x13,0xba,0x33,0x03,0xac,0x5d,0xeb,0x91,0x15,0x48,0x90,0x80,0x25
+		};
+
+		const byte exp[] = {
+			0x62,0x91,0xd6,0x57,0xde,0xec,0x24,0x02,0x48,0x27,0xe6,0x9c,0x3a,0xbe,0x01,0xa3,
+			0x0c,0xe5,0x48,0xa2,0x84,0x74,0x3a,0x44,0x5e,0x36,0x80,0xd7,0xdb,0x5a,0xc3,0xac,
+			0x18,0xff,0x9b,0x53,0x8d,0x16,0xf2,0x90,0xae,0x67,0xf7,0x60,0x98,0x4d,0xc6,0x59,
+			0x4a,0x7c,0x15,0xe9,0x71,0x6e,0xd2,0x8d,0xc0,0x27,0xbe,0xce,0xea,0x1e,0xc4,0x0a
+		};
+
+		const byte msg[2] = {0xaf, 0x82}; byte sig[64];
+
+		// Test the filter framework
+		ed25519Signer signer(pk, sk);
+		StringSource(msg, sizeof(msg), true, new SignerFilter(NullRNG(), signer, new ArraySink(sig, sizeof(sig))));
+
+		if (std::memcmp(exp, sig, 64) != 0)
+			throw Exception(Exception::OTHER_ERROR, "TestEd25519: SignerFilter");
+
+		ed25519Verifier verifier(pk);
+		int flags = SignatureVerificationFilter::THROW_EXCEPTION | SignatureVerificationFilter::SIGNATURE_AT_END;
+		std::string msg_sig = std::string((char*)msg, sizeof(msg)) + std::string((char*)sig, sizeof(sig));
+		StringSource(msg_sig, true, new SignatureVerificationFilter(verifier, NULLPTR, flags));
+
+		// No throw is success
+		fail = false;
+	}
+	catch(const Exception&)
+	{
+		fail = true;
+	}
+
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED" : "passed") << "  ";
+	std::cout << "RFC 8032 test vectors" << std::endl;
+
+	// Test key loads
+	try {
+		FileSource f1(DataDir("TestData/ed25519.dat").c_str(), true, new HexDecoder);
+		FileSource f2(DataDir("TestData/ed25519v0.dat").c_str(), true, new HexDecoder);
+		FileSource f3(DataDir("TestData/ed25519v1.dat").c_str(), true, new HexDecoder);
+
+		ed25519::Signer s1(f1);
+		ed25519::Signer s2(f2);
+		ed25519::Signer s3(f3);
+
+		FileSource f4(DataDir("TestData/ed25519.dat").c_str(), true, new HexDecoder);
+		FileSource f5(DataDir("TestData/ed25519v0.dat").c_str(), true, new HexDecoder);
+		FileSource f6(DataDir("TestData/ed25519v1.dat").c_str(), true, new HexDecoder);
+
+		s1.AccessKey().Load(f4);
+		s2.AccessKey().Load(f5);
+		s3.AccessKey().Load(f6);
+
+		// No throw is success
+		fail = false;
+	}
+	catch (const BERDecodeErr&) {
+		fail = true;
+	}
+
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED" : "passed") << "  ";
+	std::cout << "RFC 5208 and 5958 key loads" << std::endl;
+
+	return pass;
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validat8.cpp b/runtime/third_party/cryptopp/validat8.cpp
new file mode 100644
index 0000000..2798c2b
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat8.cpp
@@ -0,0 +1,631 @@
+// validat8.cpp - originally written and placed in the public domain by Wei Dai
+//                CryptoPP::Test namespace added by JW in February 2017.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "asn.h"
+#include "oids.h"
+
+#include "luc.h"
+#include "rsa.h"
+#include "xtr.h"
+#include "rabin.h"
+#include "pubkey.h"
+#include "elgamal.h"
+#include "xtrcrypt.h"
+#include "eccrypto.h"
+
+#include "hex.h"
+#include "base64.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+inline byte* C2B(char* ptr) {
+    return reinterpret_cast<byte*>(ptr);
+}
+
+inline const byte* C2B(const char* ptr) {
+    return reinterpret_cast<const byte*>(ptr);
+}
+
+inline bool operator==(const RSA::PrivateKey& lhs, const RSA::PrivateKey& rhs) {
+	return lhs.GetModulus() == rhs.GetModulus() &&
+		lhs.GetPublicExponent() == rhs.GetPublicExponent() &&
+		lhs.GetPrivateExponent() == rhs.GetPrivateExponent();
+}
+
+inline bool operator!=(const RSA::PrivateKey& lhs, const RSA::PrivateKey& rhs) {
+	return !operator==(lhs, rhs);
+}
+
+inline bool operator==(const RSA::PublicKey& lhs, const RSA::PublicKey& rhs) {
+	return lhs.GetModulus() == rhs.GetModulus() &&
+		lhs.GetPublicExponent() == rhs.GetPublicExponent();
+}
+
+inline bool operator!=(const RSA::PublicKey& lhs, const RSA::PublicKey& rhs) {
+	return !operator==(lhs, rhs);
+}
+
+inline bool operator==(const LUC::PrivateKey& lhs, const LUC::PrivateKey& rhs) {
+	return lhs.GetModulus() == rhs.GetModulus() &&
+		lhs.GetPublicExponent() == rhs.GetPublicExponent() &&
+		lhs.GetPrime1() == rhs.GetPrime1() &&
+		lhs.GetPrime2() == rhs.GetPrime2() &&
+		lhs.GetMultiplicativeInverseOfPrime2ModPrime1() == rhs.GetMultiplicativeInverseOfPrime2ModPrime1();
+}
+
+inline bool operator!=(const LUC::PrivateKey& lhs, const LUC::PrivateKey& rhs) {
+	return !operator==(lhs, rhs);
+}
+
+inline bool operator==(const LUC::PublicKey& lhs, const LUC::PublicKey& rhs) {
+	return lhs.GetModulus() == rhs.GetModulus() &&
+		lhs.GetPublicExponent() == rhs.GetPublicExponent();
+}
+
+inline bool operator!=(const LUC::PublicKey& lhs, const LUC::PublicKey& rhs) {
+	return !operator==(lhs, rhs);
+}
+
+inline bool operator==(const Rabin::PrivateKey& lhs, const Rabin::PrivateKey& rhs) {
+	return lhs.GetModulus() == rhs.GetModulus() &&
+		lhs.GetQuadraticResidueModPrime1() == rhs.GetQuadraticResidueModPrime1() &&
+		lhs.GetQuadraticResidueModPrime2() == rhs.GetQuadraticResidueModPrime2() &&
+		lhs.GetPrime1() == rhs.GetPrime1() &&
+		lhs.GetPrime2() == rhs.GetPrime2() &&
+		lhs.GetMultiplicativeInverseOfPrime2ModPrime1() == rhs.GetMultiplicativeInverseOfPrime2ModPrime1();
+}
+
+inline bool operator!=(const Rabin::PrivateKey& lhs, const Rabin::PrivateKey& rhs) {
+	return !operator==(lhs, rhs);
+}
+
+inline bool operator==(const Rabin::PublicKey& lhs, const Rabin::PublicKey& rhs) {
+	return lhs.GetModulus() == rhs.GetModulus() &&
+		lhs.GetQuadraticResidueModPrime1() == rhs.GetQuadraticResidueModPrime1() &&
+		lhs.GetQuadraticResidueModPrime2() == rhs.GetQuadraticResidueModPrime2();
+}
+
+inline bool operator!=(const Rabin::PublicKey& lhs, const Rabin::PublicKey& rhs) {
+	return !operator==(lhs, rhs);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+bool ValidateRSA_Encrypt()
+{
+	// Must be large enough for RSA-3072 to test SHA3_256
+	byte out[256], outPlain[128];
+	bool pass = true, fail;
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+	{
+		FileSource keys(DataDir("TestData/rsa1024.dat").c_str(), true, new HexDecoder);
+		RSA::PrivateKey rsaPriv; rsaPriv.Load(keys);
+		RSA::PublicKey rsaPub(rsaPriv);
+
+		const Integer& n = rsaPriv.GetModulus();
+		const Integer& e = rsaPriv.GetPublicExponent();
+		const Integer& d = rsaPriv.GetPrivateExponent();
+
+		RSA::PrivateKey rsaPriv2;
+		rsaPriv2.Initialize(n, e, d);
+
+		fail = (rsaPriv != rsaPriv2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "RSA::PrivateKey initialization\n";
+
+		RSA::PublicKey rsaPub2;
+		rsaPub2.Initialize(n, e);
+
+		fail = (rsaPub != rsaPub2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "RSA::PublicKey initialization\n";
+	}
+	{
+		FileSource keys(DataDir("TestData/rsa1024.dat").c_str(), true, new HexDecoder);
+		RSA::PrivateKey rsaPriv; rsaPriv.Load(keys);
+
+		ByteQueue q;
+		rsaPriv.DEREncodePrivateKey(q);
+
+		RSA::PrivateKey rsaPriv2;
+		rsaPriv2.BERDecodePrivateKey(q, true, (size_t)q.MaxRetrievable());
+
+		fail = (rsaPriv != rsaPriv2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "RSA::PrivateKey encoding and decoding\n";
+	}
+#endif
+
+	{
+		FileSource keys(DataDir("TestData/rsa1024.dat").c_str(), true, new HexDecoder);
+		RSAES_PKCS1v15_Decryptor rsaPriv(keys);
+		RSAES_PKCS1v15_Encryptor rsaPub(rsaPriv);
+
+		fail = !CryptoSystemValidate(rsaPriv, rsaPub);
+		pass = pass && !fail;
+	}
+	{
+		RSAES_OAEP_SHA_Decryptor rsaPriv(GlobalRNG(), 512);
+		RSAES_OAEP_SHA_Encryptor rsaPub(rsaPriv);
+
+		fail = !CryptoSystemValidate(rsaPriv, rsaPub);
+		pass = pass && !fail;
+	}
+	{
+		RSAES_OAEP_SHA256_Decryptor rsaPriv(GlobalRNG(), 1024);
+		RSAES_OAEP_SHA256_Encryptor rsaPub(rsaPriv);
+
+		fail = !CryptoSystemValidate(rsaPriv, rsaPub);
+		pass = pass && !fail;
+	}
+	{
+		const byte plain[] =
+			"\x54\x85\x9b\x34\x2c\x49\xea\x2a";
+		const byte encrypted[] =
+			"\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a"
+			"\x8b\x40\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4"
+			"\x17\x53\x03\x29\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52"
+			"\x62\x51";
+		const byte oaepSeed[] =
+			"\xaa\xfd\x12\xf6\x59\xca\xe6\x34\x89\xb4\x79\xe5\x07\x6d\xde\xc2"
+			"\xf0\x6c\xb5\x8f";
+		ByteQueue bq;
+		bq.Put(oaepSeed, 20);
+		FixedRNG rng(bq);
+
+		FileSource privFile(DataDir("TestData/rsa400pv.dat").c_str(), true, new HexDecoder);
+		FileSource pubFile(DataDir("TestData/rsa400pb.dat").c_str(), true, new HexDecoder);
+		RSAES_OAEP_SHA_Decryptor rsaPriv;
+		rsaPriv.AccessKey().BERDecodePrivateKey(privFile, false, 0);
+		RSAES_OAEP_SHA_Encryptor rsaPub(pubFile);
+
+		std::memset(out, 0, 50);
+		std::memset(outPlain, 0, 8);
+		rsaPub.Encrypt(rng, plain, 8, out);
+		DecodingResult result = rsaPriv.FixedLengthDecrypt(GlobalRNG(), encrypted, outPlain);
+		fail = !result.isValidCoding || (result.messageLength!=8) || std::memcmp(out, encrypted, 50) || std::memcmp(plain, outPlain, 8);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "PKCS 2.0 encryption and decryption\n";
+	}
+
+	return pass;
+}
+
+bool ValidateLUC_Encrypt()
+{
+	bool pass = true, fail;
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+	{
+		FileSource keys(DataDir("TestData/luc1024.dat").c_str(), true, new HexDecoder);
+		LUC::PrivateKey lucPriv; lucPriv.BERDecode(keys);
+		LUC::PublicKey lucPub(lucPriv);
+
+		const Integer& n = lucPriv.GetModulus();
+		const Integer& e = lucPriv.GetPublicExponent();
+		const Integer& p = lucPriv.GetPrime1();
+		const Integer& q = lucPriv.GetPrime2();
+		const Integer& u = lucPriv.GetMultiplicativeInverseOfPrime2ModPrime1();
+
+		LUC::PrivateKey lucPriv2;
+		lucPriv2.Initialize(n, e, p, q, u);
+
+		fail = (lucPriv != lucPriv2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "LUC::PrivateKey initialization\n";
+
+		LUC::PublicKey lucPub2;
+		lucPub2.Initialize(n, e);
+
+		fail = (lucPub != lucPub2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "LUC::PublicKey initialization\n";
+	}
+	{
+		FileSource keys(DataDir("TestData/luc1024.dat").c_str(), true, new HexDecoder);
+		LUC::PrivateKey lucPriv; lucPriv.BERDecode(keys);
+
+		ByteQueue q;
+		lucPriv.DEREncode(q);
+
+		LUC::PrivateKey lucPriv2;
+		lucPriv2.BERDecode(q);
+
+		fail = (lucPriv != lucPriv2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "LUC::PrivateKey encoding and decoding\n";
+	}
+	{
+		FileSource keys(DataDir("TestData/luc1024.dat").c_str(), true, new HexDecoder);
+		LUC::PrivateKey lucPriv; lucPriv.BERDecode(keys);
+		LUC::PublicKey lucPub(lucPriv);
+
+		ByteQueue q;
+		lucPub.DEREncode(q);
+
+		LUC::PublicKey lucPub2;
+		lucPub2.BERDecode(q);
+
+		fail = (lucPub != lucPub2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "LUC::PublicKey encoding and decoding\n";
+	}
+#endif
+
+	LUCES_OAEP_SHA_Decryptor priv(GlobalRNG(), 512);
+	LUCES_OAEP_SHA_Encryptor pub(priv);
+	fail = !CryptoSystemValidate(priv, pub);
+	pass = pass && !fail;
+
+	return pass;
+}
+
+bool ValidateLUC_DL_Encrypt()
+{
+	std::cout << "\nLUC-IES validation suite running...\n\n";
+
+	FileSource fc(DataDir("TestData/lucc512.dat").c_str(), true, new HexDecoder);
+	LUC_IES<>::Decryptor privC(fc);
+	LUC_IES<>::Encryptor pubC(privC);
+	return CryptoSystemValidate(privC, pubC);
+}
+
+bool ValidateRabin_Encrypt()
+{
+	bool pass = true, fail;
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+	{
+		FileSource keys(DataDir("TestData/rabi1024.dat").c_str(), true, new HexDecoder);
+		Rabin::PrivateKey rabinPriv; rabinPriv.BERDecode(keys);
+		Rabin::PublicKey rabinPub(rabinPriv);
+
+		const Integer& n = rabinPriv.GetModulus();
+		const Integer& r = rabinPriv.GetQuadraticResidueModPrime1();
+		const Integer& s = rabinPriv.GetQuadraticResidueModPrime2();
+		const Integer& p = rabinPriv.GetPrime1();
+		const Integer& q = rabinPriv.GetPrime2();
+		const Integer& u = rabinPriv.GetMultiplicativeInverseOfPrime2ModPrime1();
+
+		Rabin::PrivateKey rabinPriv2;
+		rabinPriv2.Initialize(n, r, s, p, q, u);
+
+		fail = (rabinPriv != rabinPriv2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "Rabin::PrivateKey initialization\n";
+
+		Rabin::PublicKey rabinPub2;
+		rabinPub2.Initialize(n, r, s);
+
+		fail = (rabinPub != rabinPub2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "Rabin::PublicKey initialization\n";
+	}
+	{
+		FileSource keys(DataDir("TestData/rabi1024.dat").c_str(), true, new HexDecoder);
+		Rabin::PrivateKey rabinPriv; rabinPriv.BERDecode(keys);
+
+		ByteQueue q;
+		rabinPriv.DEREncode(q);
+
+		Rabin::PrivateKey rabinPriv2;
+		rabinPriv2.BERDecode(q);
+
+		fail = (rabinPriv != rabinPriv2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "Rabin::PrivateKey encoding and decoding\n";
+	}
+	{
+		FileSource keys(DataDir("TestData/rabi1024.dat").c_str(), true, new HexDecoder);
+		Rabin::PrivateKey rabinPriv; rabinPriv.BERDecode(keys);
+		Rabin::PublicKey rabinPub(rabinPriv);
+
+		ByteQueue q;
+		rabinPub.DEREncode(q);
+
+		Rabin::PublicKey rabinPub2;
+		rabinPub2.BERDecode(q);
+
+		fail = (rabinPub != rabinPub2);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "Rabin::PublicKey encoding and decoding\n";
+	}
+#endif
+
+	FileSource f(DataDir("TestData/rabi1024.dat").c_str(), true, new HexDecoder);
+	RabinES<OAEP<SHA1> >::Decryptor priv(f);
+	RabinES<OAEP<SHA1> >::Encryptor pub(priv);
+	fail = !CryptoSystemValidate(priv, pub);
+	pass = pass && !fail;
+
+	return pass;
+}
+
+bool ValidateECP_Encrypt()
+{
+	ECIES<ECP>::Decryptor cpriv(GlobalRNG(), ASN1::secp192r1());
+	ECIES<ECP>::Encryptor cpub(cpriv);
+	ByteQueue bq;
+	cpriv.GetKey().DEREncode(bq);
+	cpub.AccessKey().AccessGroupParameters().SetEncodeAsOID(true);
+	cpub.GetKey().DEREncode(bq);
+
+	cpub.AccessKey().Precompute();
+	cpriv.AccessKey().Precompute();
+	bool pass = CryptoSystemValidate(cpriv, cpub);
+
+	std::cout << "Turning on point compression..." << std::endl;
+	cpriv.AccessKey().AccessGroupParameters().SetPointCompression(true);
+	cpub.AccessKey().AccessGroupParameters().SetPointCompression(true);
+	pass = CryptoSystemValidate(cpriv, cpub) && pass;
+
+	return pass;
+}
+
+// https://github.com/weidai11/cryptopp/issues/856
+// Not to be confused with NullHash in trunhash.h.
+class NULL_Hash : public CryptoPP::IteratedHashWithStaticTransform
+    <CryptoPP::word32, CryptoPP::BigEndian, 32, 0, NULL_Hash, 0>
+{
+public:
+    static void InitState(HashWordType *state) {
+        CRYPTOPP_UNUSED(state);
+    }
+    static void Transform(CryptoPP::word32 *digest, const CryptoPP::word32 *data) {
+        CRYPTOPP_UNUSED(digest); CRYPTOPP_UNUSED(data);
+    }
+    static const char *StaticAlgorithmName() {
+        return "NULL_Hash";
+    }
+};
+
+// https://github.com/weidai11/cryptopp/issues/856
+template <class EC, class HASH = SHA1, class COFACTOR_OPTION = NoCofactorMultiplication, bool DHAES_MODE = true, bool LABEL_OCTETS = false>
+struct ECIES_NULLDigest
+	: public DL_ES<
+		DL_Keys_EC<EC>,
+		DL_KeyAgreementAlgorithm_DH<typename EC::Point, COFACTOR_OPTION>,
+		DL_KeyDerivationAlgorithm_P1363<typename EC::Point, DHAES_MODE, P1363_KDF2<HASH> >,
+		DL_EncryptionAlgorithm_Xor<HMAC<NULL_Hash>, DHAES_MODE, LABEL_OCTETS>,
+		ECIES<EC> >
+{
+	// TODO: fix this after name is standardized
+	CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "ECIES-NULLDigest";}
+};
+
+bool ValidateECP_NULLDigest_Encrypt()
+{
+	ECIES_NULLDigest<ECP>::Decryptor cpriv(GlobalRNG(), ASN1::secp256k1());
+	ECIES_NULLDigest<ECP>::Encryptor cpub(cpriv);
+	ByteQueue bq;
+	cpriv.GetKey().DEREncode(bq);
+	cpub.AccessKey().AccessGroupParameters().SetEncodeAsOID(true);
+	cpub.GetKey().DEREncode(bq);
+
+	cpub.AccessKey().Precompute();
+	cpriv.AccessKey().Precompute();
+	bool pass = CryptoSystemValidate(cpriv, cpub);
+
+	std::cout << "Turning on point compression..." << std::endl;
+	cpriv.AccessKey().AccessGroupParameters().SetPointCompression(true);
+	cpub.AccessKey().AccessGroupParameters().SetPointCompression(true);
+	pass = CryptoSystemValidate(cpriv, cpub) && pass;
+
+	return pass;
+}
+
+// Ensure interop with Crypto++ 5.6.4 and earlier
+bool ValidateECP_Legacy_Encrypt()
+{
+	std::cout << "\nLegacy ECIES ECP validation suite running...\n\n";
+	bool pass = true;
+	{
+		FileSource fc(DataDir("TestData/ecies_p160.dat").c_str(), true, new HexDecoder);
+		ECIES<ECP,SHA1,NoCofactorMultiplication,false,true>::Decryptor privC(fc);
+		ECIES<ECP,SHA1,NoCofactorMultiplication,false,true>::Encryptor pubC(privC);
+
+		pass = CryptoSystemValidate(privC, pubC) && pass;
+
+		// Test data generated by Crypto++ 5.6.2.
+		// Also see https://github.com/weidai11/cryptopp/pull/857.
+		const std::string plain = "Yoda said, Do or do not. There is no try.";
+		const std::string cipher =
+			"\x04\xF6\xC1\xB1\xFA\xAC\x8A\xD5\xD3\x96\xE7\x13\xAE\xBD\x0C\xCE"
+			"\x15\xCF\x44\x54\x08\x63\xCC\xBF\x89\x4D\xD0\xB8\x38\xA1\x3A\xB2"
+			"\x90\x75\x86\x82\x7F\x9D\x95\x26\xA5\x74\x13\x3A\x74\x63\x11\x71"
+			"\x70\x4C\x01\xA4\x08\x04\x95\x69\x6A\x91\xF0\xC0\xA4\xBD\x1E\xAA"
+			"\x59\x57\xB8\xA9\xD2\xF7\x7C\x98\xE3\xC5\xE3\xF4\x4F\xA7\x6E\x73"
+			"\x83\xF3\x1E\x05\x73\xA4\xEE\x63\x55\xFD\x6D\x31\xBB\x9E\x36\x4C"
+			"\x79\xD0\x76\xC0\x0D\xE9";
+
+		std::string recover;
+		recover.resize(privC.MaxPlaintextLength(cipher.size()));
+
+		DecodingResult result = privC.Decrypt(GlobalRNG(), C2B(&cipher[0]), cipher.size(), C2B(&recover[0]));
+		if (result.isValidCoding)
+			recover.resize(result.messageLength);
+		else
+			recover.resize(0);
+
+		pass = (plain == recover) && pass;
+		std::cout << (pass ? "passed    " : "FAILED    ");
+		std::cout << "decryption known answer\n";
+	}
+	return pass;
+}
+
+// Ensure interop with Crypto++ 5.6.4 and earlier
+bool ValidateEC2N_Legacy_Encrypt()
+{
+	std::cout << "\nLegacy ECIES EC2N validation suite running...\n\n";
+	bool pass = true;
+	{
+		FileSource fc(DataDir("TestData/ecies_t163.dat").c_str(), true, new HexDecoder);
+		ECIES<EC2N,SHA1,NoCofactorMultiplication,false,true>::Decryptor privC(fc);
+		ECIES<EC2N,SHA1,NoCofactorMultiplication,false,true>::Encryptor pubC(privC);
+
+		pass = CryptoSystemValidate(privC, pubC) && pass;
+
+		// Test data generated by Crypto++ 5.6.2.
+		// Also see https://github.com/weidai11/cryptopp/pull/857.
+		const std::string plain = "Yoda said, Do or do not. There is no try.";
+		const std::string cipher =
+			"\x04\x01\x3F\x64\x94\x6A\xBE\x2B\x7E\x48\x67\x63\xA2\xD4\x01\xEF"
+			"\x2B\x13\x1C\x9A\x1B\x7C\x07\x4B\x89\x78\x6C\x65\x51\x1C\x1A\x4E"
+			"\x20\x7F\xB5\xBF\x12\x3B\x6E\x0A\x87\xFD\xB7\x94\xEF\x4B\xED\x40"
+			"\xD4\x7A\xCF\xB6\xFC\x9B\x6D\xB0\xB8\x43\x99\x7E\x37\xC1\xF0\xC0"
+			"\x95\xD4\x80\xE1\x8B\x84\xAE\x64\x9F\xA5\xBA\x32\x95\x8A\xD1\xBE"
+			"\x7F\xDE\x7E\xA9\xE6\x59\xBF\x89\xA6\xE9\x9F\x5B\x64\xB4\xDD\x0E"
+			"\x76\xB6\x82\xF6\xA9\xAD\xB5\xC4";
+
+		std::string recover;
+		recover.resize(privC.MaxPlaintextLength(cipher.size()));
+
+		DecodingResult result = privC.Decrypt(GlobalRNG(), C2B(&cipher[0]), cipher.size(), C2B(&recover[0]));
+		if (result.isValidCoding)
+			recover.resize(result.messageLength);
+		else
+			recover.resize(0);
+
+		pass = (plain == recover) && pass;
+		std::cout << (pass ? "passed    " : "FAILED    ");
+		std::cout << "decryption known answer\n";
+	}
+	return pass;
+}
+
+bool ValidateEC2N_Encrypt()
+{
+	// DEREncode() changed to Save() at Issue 569.
+	ECIES<EC2N>::Decryptor cpriv(GlobalRNG(), ASN1::sect193r1());
+	ECIES<EC2N>::Encryptor cpub(cpriv);
+	ByteQueue bq;
+	cpriv.AccessMaterial().Save(bq);
+	cpub.AccessKey().AccessGroupParameters().SetEncodeAsOID(true);
+	cpub.AccessMaterial().Save(bq);
+	bool pass = CryptoSystemValidate(cpriv, cpub);
+
+	std::cout << "Turning on point compression..." << std::endl;
+	cpriv.AccessKey().AccessGroupParameters().SetPointCompression(true);
+	cpub.AccessKey().AccessGroupParameters().SetPointCompression(true);
+	pass = CryptoSystemValidate(cpriv, cpub) && pass;
+
+	return pass;
+}
+
+bool ValidateElGamal()
+{
+	std::cout << "\nElGamal validation suite running...\n\n";
+	bool pass = true;
+	{
+		// Data from https://github.com/weidai11/cryptopp/issues/876.
+		const std::string encodedPublicKey =
+			"MHYwTwYGKw4HAgEBMEUCIQDebUvQDd9UPMmD27BJ ovZSIgWfexL0SWkfJQPMLsJvMwIgDy/kEthwO6Q+"
+			"L8XHnzumnEKs+txH8QkQD+M/8u82ql0DIwACIAY6 rfW+BTcRZ9QAJovgoB8DgNLJ8ocqOeF4nEBB0DHH";
+		StringSource decodedPublicKey(encodedPublicKey, true, new Base64Decoder);
+
+		ElGamal::PublicKey publicKey;
+		publicKey.Load(decodedPublicKey);
+		pass = publicKey.Validate(GlobalRNG(), 3) && pass;
+	}
+	{
+		// Data from https://github.com/weidai11/cryptopp/issues/876.
+		const std::string encodedPrivateKey =
+			"MHkCAQAwTwYGKw4HAgEBMEUCIQDebUvQDd9UPMmD 27BJovZSIgWfexL0SWkfJQPMLsJvMwIgDy/kEthw"
+			"O6Q+L8XHnzumnEKs+txH8QkQD+M/8u82ql0EIwIh AJb0S4TZLvApTVjXZyocPJ5tUgWgRqScXm5vNqu2"
+			"YqdM";
+		StringSource decodedPrivateKey(encodedPrivateKey, true, new Base64Decoder);
+
+		ElGamal::PrivateKey privateKey;
+		privateKey.Load(decodedPrivateKey);
+		pass = privateKey.Validate(GlobalRNG(), 3) && pass;
+	}
+	{
+		FileSource fc(DataDir("TestData/elgc1024.dat").c_str(), true, new HexDecoder);
+		ElGamalDecryptor privC(fc);
+		ElGamalEncryptor pubC(privC);
+		privC.AccessKey().Precompute();
+		ByteQueue queue;
+		privC.AccessKey().SavePrecomputation(queue);
+		privC.AccessKey().LoadPrecomputation(queue);
+
+		pass = CryptoSystemValidate(privC, pubC) && pass;
+	}
+	return pass;
+}
+
+bool ValidateDLIES()
+{
+	std::cout << "\nDLIES validation suite running...\n\n";
+	bool pass = true;
+	{
+		FileSource fc(DataDir("TestData/dlie1024.dat").c_str(), true, new HexDecoder);
+		DLIES<>::Decryptor privC(fc);
+		DLIES<>::Encryptor pubC(privC);
+		pass = CryptoSystemValidate(privC, pubC) && pass;
+	}
+	{
+		std::cout << "Generating new encryption key..." << std::endl;
+		DLIES<>::GroupParameters gp;
+		gp.GenerateRandomWithKeySize(GlobalRNG(), 128);
+		DLIES<>::Decryptor decryptor;
+		decryptor.AccessKey().GenerateRandom(GlobalRNG(), gp);
+		DLIES<>::Encryptor encryptor(decryptor);
+
+		pass = CryptoSystemValidate(decryptor, encryptor) && pass;
+	}
+	return pass;
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validat9.cpp b/runtime/third_party/cryptopp/validat9.cpp
new file mode 100644
index 0000000..d4ee587
--- /dev/null
+++ b/runtime/third_party/cryptopp/validat9.cpp
@@ -0,0 +1,735 @@
+// validat9.cpp - originally written and placed in the public domain by Wei Dai
+//                CryptoPP::Test namespace added by JW in February 2017.
+//                Source files split in July 2018 to expedite compiles.
+
+#include "pch.h"
+
+#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
+
+#include "cryptlib.h"
+#include "cpu.h"
+#include "validate.h"
+
+#include "asn.h"
+#include "oids.h"
+
+#include "md2.h"
+#include "md4.h"
+#include "md5.h"
+
+#include "sha.h"
+#include "sha3.h"
+#include "pssr.h"
+#include "ripemd.h"
+#include "whrlpool.h"
+
+#include "rw.h"
+#include "dsa.h"
+#include "luc.h"
+#include "rsa.h"
+#include "esign.h"
+#include "rabin.h"
+#include "pubkey.h"
+#include "eccrypto.h"
+
+// Curve25519
+#include "xed25519.h"
+#include "donna.h"
+#include "naclite.h"
+
+#include <iostream>
+#include <iomanip>
+#include <sstream>
+
+// Aggressive stack checking with VS2005 SP1 and above.
+#if (_MSC_FULL_VER >= 140050727)
+# pragma strict_gs_check (on)
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4505 4355)
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+bool ValidateRSA_Sign()
+{
+	// Must be large enough for RSA-3072 to test SHA3_256
+	byte out[256];
+	bool pass = true, fail;
+
+	{
+		const char plain[] = "Everyone gets Friday off.";
+		const byte signature[] =
+			"\x05\xfa\x6a\x81\x2f\xc7\xdf\x8b\xf4\xf2\x54\x25\x09\xe0\x3e\x84"
+			"\x6e\x11\xb9\xc6\x20\xbe\x20\x09\xef\xb4\x40\xef\xbc\xc6\x69\x21"
+			"\x69\x94\xac\x04\xf3\x41\xb5\x7d\x05\x20\x2d\x42\x8f\xb2\xa2\x7b"
+			"\x5c\x77\xdf\xd9\xb1\x5b\xfc\x3d\x55\x93\x53\x50\x34\x10\xc1\xe1";
+
+		FileSource keys(DataDir("TestData/rsa512a.dat").c_str(), true, new HexDecoder);
+		Weak::RSASSA_PKCS1v15_MD2_Signer rsaPriv(keys);
+		Weak::RSASSA_PKCS1v15_MD2_Verifier rsaPub(rsaPriv);
+
+		size_t signatureLength = rsaPriv.SignMessage(GlobalRNG(), (byte *)plain, strlen(plain), out);
+		CRYPTOPP_ASSERT(signatureLength <= sizeof(out));
+		fail = std::memcmp(signature, out, signatureLength) != 0;
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "signature check against test vector\n";
+
+		fail = !rsaPub.VerifyMessage((byte *)plain, strlen(plain), out, signatureLength);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "verification check against test vector\n";
+
+		out[10]++;
+		fail = rsaPub.VerifyMessage((byte *)plain, strlen(plain), out, signatureLength);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "invalid signature verification\n";
+	}
+	/////
+	{
+		const char plain[] = "Everyone gets Friday off.";
+		const byte signature[] =
+			"\x2e\x87\xda\x1f\xe4\xda\x1d\x7a\xb7\xf2\x42\x36\xe9\xc0\x4e\xab\x3f\x03\x71\xe1"
+			"\x2b\xc5\x3c\xbf\x21\x21\xa8\xd6\x28\xb0\x08\xfd\x9c\xf6\x94\xbd\x37\x32\xda\xfc"
+			"\x42\x1c\x8e\xdb\x8a\x81\x90\x46\x45\xb4\xde\x9e\xce\x90\xfe\xa1\xfd\xbc\x5a\xce"
+			"\xca\x59\x89\x93\xc0\x0f\x2f\xf1\x13\xb0\xf5\x3d\xa3\x9a\x85\xb7\x40\xd9\x34\x88"
+			"\x29\xb2\x4a\x0f\x9b\xbe\x22\x3a\x5b\x54\x51\xb7\xf0\x10\x72\x50\xc4\x2a\xe9\xe4"
+			"\xc3\x82\xeb\x32\x33\x14\xb6\xf2\x7b\x30\x7a\xbf\xc2\xf3\x0f\x4d\x72\xa0\x8d\xa1"
+			"\xc6\xce\xd0\xa3\x3c\xf7\x23\x4b\xb7\x2c\x5e\xca\x83\x01\xc7\x5c\xd5\xd0\xd1\x94"
+			"\x43\xf0\xad\xa2\xe6\x72\x2b\x13\x39\xb2\x4b\x25\x91\x3a\x4f\x53\x05\x00\x8c\xc7"
+			"\xcf\x4f\x11\x64\xe6\xf4\x1a\x4d\x90\x7e\xf1\xfe\xed\xec\x8d\xbb\x00\x31\x2e\x03"
+			"\xbe\x87\x84\x60\xfb\x5e\xef\x9d\x18\x2c\x28\x3d\xaa\x67\x80\xa3\x62\x07\x06\x5e"
+			"\xce\xee\x3b\xd0\x78\xb5\x98\x38\x1e\xe8\x62\x19\x9c\xc3\xd4\xf7\xc2\xc5\x00\xf0"
+			"\xeb\x89\x65\x53\x35\xe7\x13\x7e\xbb\x26\xb0\x76\x9c\xf2\x80\xaa\xe1\xb1\x0a\xa6"
+			"\x47\xfc\x5f\xe0\x7f\x82\xd7\x83\x41\xc3\x50\xa1\xe0\x0e\x1a\xe4";
+
+		FileSource keys(DataDir("TestData/rsa2048a.dat").c_str(), true, new HexDecoder);
+		RSASS<PKCS1v15, SHA3_256>::Signer rsaPriv(keys);
+		RSASS<PKCS1v15, SHA3_256>::Verifier rsaPub(rsaPriv);
+
+		size_t signatureLength = rsaPriv.SignMessage(GlobalRNG(), (byte *)plain, strlen(plain), out);
+		CRYPTOPP_ASSERT(signatureLength <= sizeof(out));
+		fail = std::memcmp(signature, out, signatureLength) != 0;
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "signature check against test vector\n";
+
+		fail = !rsaPub.VerifyMessage((byte *)plain, strlen(plain), out, signatureLength);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "verification check against test vector\n";
+
+		out[10]++;
+		fail = rsaPub.VerifyMessage((byte *)plain, strlen(plain), out, signatureLength);
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "invalid signature verification\n";
+	}
+
+	return pass;
+}
+
+bool ValidateNR()
+{
+	std::cout << "\nNR validation suite running...\n\n";
+	bool pass = true;
+	{
+		FileSource f(DataDir("TestData/nr2048.dat").c_str(), true, new HexDecoder);
+		NR<SHA1>::Signer privS(f);
+		privS.AccessKey().Precompute();
+		NR<SHA1>::Verifier pubS(privS);
+
+		pass = SignatureValidate(privS, pubS) && pass;
+	}
+	{
+		std::cout << "Generating new signature key..." << std::endl;
+		NR<SHA1>::Signer privS(GlobalRNG(), 256);
+		NR<SHA1>::Verifier pubS(privS);
+
+		pass = SignatureValidate(privS, pubS) && pass;
+	}
+	return pass;
+}
+
+bool ValidateDSA(bool thorough)
+{
+	std::cout << "\nDSA validation suite running...\n\n";
+
+	bool pass = true;
+	FileSource fs1(DataDir("TestData/dsa1024.dat").c_str(), true, new HexDecoder);
+	DSA::Signer priv(fs1);
+	DSA::Verifier pub(priv);
+	FileSource fs2(DataDir("TestData/dsa1024b.dat").c_str(), true, new HexDecoder);
+	DSA::Verifier pub1(fs2);
+	CRYPTOPP_ASSERT(pub.GetKey() == pub1.GetKey());
+	pass = SignatureValidate(priv, pub, thorough) && pass;
+
+	return pass;
+}
+
+bool ValidateLUC_Sign()
+{
+	FileSource f(DataDir("TestData/luc1024.dat").c_str(), true, new HexDecoder);
+	LUCSSA_PKCS1v15_SHA_Signer priv(f);
+	LUCSSA_PKCS1v15_SHA_Verifier pub(priv);
+	return SignatureValidate(priv, pub);
+}
+
+bool ValidateLUC_DL_Sign()
+{
+	std::cout << "\nLUC-HMP validation suite running...\n\n";
+
+	FileSource f(DataDir("TestData/lucs512.dat").c_str(), true, new HexDecoder);
+	LUC_HMP<SHA1>::Signer privS(f);
+	LUC_HMP<SHA1>::Verifier pubS(privS);
+	return SignatureValidate(privS, pubS);
+}
+
+bool ValidateRabin_Sign()
+{
+	FileSource f(DataDir("TestData/rabi1024.dat").c_str(), true, new HexDecoder);
+	RabinSS<PSSR, SHA1>::Signer priv(f);
+	RabinSS<PSSR, SHA1>::Verifier pub(priv);
+	return SignatureValidate(priv, pub);
+}
+
+bool ValidateRW()
+{
+	std::cout << "\nRW validation suite running...\n\n";
+
+	FileSource f(DataDir("TestData/rw1024.dat").c_str(), true, new HexDecoder);
+	RWSS<PSSR, SHA1>::Signer priv(f);
+	RWSS<PSSR, SHA1>::Verifier pub(priv);
+
+	return SignatureValidate(priv, pub);
+}
+
+bool ValidateECP_Sign()
+{
+	ECDSA<ECP, SHA1>::Signer spriv(GlobalRNG(), ASN1::secp192r1());
+	ECDSA<ECP, SHA1>::Verifier spub(spriv);
+	ByteQueue bq;
+	spriv.GetKey().DEREncode(bq);
+	spub.AccessKey().AccessGroupParameters().SetEncodeAsOID(true);
+	spub.GetKey().DEREncode(bq);
+	spriv.AccessKey().BERDecode(bq);
+	spub.AccessKey().BERDecode(bq);
+
+	spriv.AccessKey().Precompute();
+	ByteQueue queue;
+	spriv.AccessKey().SavePrecomputation(queue);
+	spriv.AccessKey().LoadPrecomputation(queue);
+
+	return SignatureValidate(spriv, spub);
+}
+
+bool ValidateEC2N_Sign()
+{
+	// DEREncode() changed to Save() at Issue 569.
+	ECDSA<EC2N, SHA1>::Signer spriv(GlobalRNG(), ASN1::sect193r1());
+	ECDSA<EC2N, SHA1>::Verifier spub(spriv);
+	ByteQueue bq;
+	spriv.AccessMaterial().Save(bq);
+	spub.AccessKey().AccessGroupParameters().SetEncodeAsOID(true);
+	spub.AccessMaterial().Save(bq);
+	spriv.AccessMaterial().Load(bq);
+	spub.AccessMaterial().Load(bq);
+
+	spriv.AccessKey().Precompute();
+	ByteQueue queue;
+	spriv.AccessKey().SavePrecomputation(queue);
+	spriv.AccessKey().LoadPrecomputation(queue);
+
+	return SignatureValidate(spriv, spub);
+}
+
+bool ValidateECDSA()
+{
+	std::cout << "\nECDSA validation suite running...\n\n";
+
+	// from Sample Test Vectors for P1363
+	GF2NT gf2n(191, 9, 0);
+	const byte a[]="\x28\x66\x53\x7B\x67\x67\x52\x63\x6A\x68\xF5\x65\x54\xE1\x26\x40\x27\x6B\x64\x9E\xF7\x52\x62\x67";
+	const byte b[]="\x2E\x45\xEF\x57\x1F\x00\x78\x6F\x67\xB0\x08\x1B\x94\x95\xA3\xD9\x54\x62\xF5\xDE\x0A\xA1\x85\xEC";
+	EC2N ec(gf2n, PolynomialMod2(a,24), PolynomialMod2(b,24));
+
+	EC2N::Point P;
+	bool result = ec.DecodePoint(P, (byte *)"\x04\x36\xB3\xDA\xF8\xA2\x32\x06\xF9\xC4\xF2\x99\xD7\xB2\x1A\x9C\x36\x91\x37\xF2\xC8\x4A\xE1\xAA\x0D"
+		"\x76\x5B\xE7\x34\x33\xB3\xF9\x5E\x33\x29\x32\xE7\x0E\xA2\x45\xCA\x24\x18\xEA\x0E\xF9\x80\x18\xFB", ec.EncodedPointSize());
+	CRYPTOPP_ASSERT(result); CRYPTOPP_UNUSED(result);
+
+	Integer n("40000000000000000000000004a20e90c39067c893bbb9a5H");
+	Integer d("340562e1dda332f9d2aec168249b5696ee39d0ed4d03760fH");
+	EC2N::Point Q(ec.Multiply(d, P));
+	ECDSA<EC2N, SHA1>::Signer priv(ec, P, n, d);
+	ECDSA<EC2N, SHA1>::Verifier pub(priv);
+
+	Integer h("A9993E364706816ABA3E25717850C26C9CD0D89DH");
+	Integer k("3eeace72b4919d991738d521879f787cb590aff8189d2b69H");
+	const byte sig[]="\x03\x8e\x5a\x11\xfb\x55\xe4\xc6\x54\x71\xdc\xd4\x99\x84\x52\xb1\xe0\x2d\x8a\xf7\x09\x9b\xb9\x30"
+		"\x0c\x9a\x08\xc3\x44\x68\xc2\x44\xb4\xe5\xd6\xb2\x1b\x3c\x68\x36\x28\x07\x41\x60\x20\x32\x8b\x6e";
+	Integer r(sig, 24);
+	Integer s(sig+24, 24);
+
+	Integer rOut, sOut;
+	bool fail, pass=true;
+
+	priv.RawSign(k, h, rOut, sOut);
+	fail = (rOut != r) || (sOut != s);
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED    " : "passed    ");
+	std::cout << "signature check against test vector\n";
+
+	fail = !pub.VerifyMessage((byte *)"abc", 3, sig, sizeof(sig));
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED    " : "passed    ");
+	std::cout << "verification check against test vector\n";
+
+	fail = pub.VerifyMessage((byte *)"xyz", 3, sig, sizeof(sig));
+	pass = pass && !fail;
+
+	pass = SignatureValidate(priv, pub) && pass;
+
+	return pass;
+}
+
+bool ValidateECDSA_RFC6979()
+{
+	std::cout << "\nRFC6979 deterministic ECDSA validation suite running...\n\n";
+
+	DL_Algorithm_ECDSA_RFC6979<ECP, SHA256> sign;
+
+	const Integer x("09A4D6792295A7F730FC3F2B49CBC0F62E862272Fh");
+	const Integer e("AF2BDBE1AA9B6EC1E2ADE1D694F41FC71A831D0268E9891562113D8A62ADD1BFh");
+	const Integer q("4000000000000000000020108A2E0CC0D99F8A5EFh");
+	const Integer k("23AF4074C90A02B3FE61D286D5C87F425E6BDD81Bh");
+	const Integer &k_out = sign.GenerateRandom(x, q, e);
+
+	bool pass  = (k_out == k);
+
+	std::cout << (pass ? "passed    " : "FAILED    ");
+	std::cout << "deterministic k generation against test vector\n";
+
+	return pass;
+}
+
+// from http://www.teletrust.de/fileadmin/files/oid/ecgdsa_final.pdf
+// ValidateECGDSA split into standard and thorough due to GH #1134
+bool ValidateECGDSAStandard()
+{
+	bool fail, pass=true;
+
+	// 2.4.1 Examples of ECGDSA over GF(p) with the hash function SHA-1 (p. 19)
+	{
+		const OID oid = ASN1::brainpoolP192r1();
+		DL_GroupParameters_EC<ECP> params(oid);
+		Integer x("0x 80F2425E 89B4F585 F27F3536 ED834D68 E3E492DE 08FE84B9");
+		ECGDSA<ECP, SHA1>::Signer signer(params, x);
+		ECGDSA<ECP, SHA1>::Verifier verifier(signer);
+
+		Integer e("0x 00000000 CF00CD42 CAA80DDF 8DDEBDFD 32F2DA15 11B53F29");
+		Integer k("0x 22C17C2A 367DD85A B8A365ED 06F19C43 F9ED1834 9A9BC044");
+
+		Integer r, s;
+		signer.RawSign(k, e, r, s);
+
+		Integer rExp("0x 2D017BE7 F117FF99 4ED6FC63 CA5B4C7A 0430E9FA 095DAFC4");
+		Integer sExp("0x 18FD604E 5F00F55B 3585C052 8C319A2B 05B8F2DD EE9CF1A6");
+
+		fail = (r != rExp) || (s != sExp);
+		pass = pass && !fail;
+
+		const byte msg[] = "Example of ECGDSA with the hash function SHA-1";
+		const size_t len = strlen((char*)msg);
+
+		const size_t maxLength = signer.MaxSignatureLength();
+		SecByteBlock signature(maxLength);
+		r.Encode(signature+          0, maxLength/2);
+		s.Encode(signature+maxLength/2, maxLength/2);
+
+		fail = !verifier.VerifyMessage(msg, len, signature, signature.size());
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "brainpoolP192r1 using SHA-1\n";
+
+		fail = !SignatureValidate(signer, verifier);
+		pass = pass && !fail;
+	}
+
+	// 2.4.1 Examples of ECGDSA over GF(p) with the hash function SHA-224 (p. 23)
+	{
+		const OID oid = ASN1::brainpoolP320r1();
+		DL_GroupParameters_EC<ECP> params(oid);
+		Integer x("0x 48683594 5A3A284F FC52629A D48D8F37 F4B2E993 9C52BC72 362A9961 40192AEF 7D2AAFF0 C73A51C5");
+		ECGDSA<ECP, SHA224>::Signer signer(params, x);
+		ECGDSA<ECP, SHA224>::Verifier verifier(signer);
+
+		Integer e("0x 00000000 00000000 00000000 92AE8A0E 8D08EADE E9426378 714FF3E0 1957587D 2876FA70 D40E3144");
+		Integer k("0x C70BC00A 77AD7872 5D36CEEC 27D6F956 FB546EEF 6DC90E35 31452BD8 7ECE8A4A 7AD730AD C299D81B");
+
+		Integer r, s;
+		signer.RawSign(k, e, r, s);
+
+		Integer rExp("0x 3C925969 FAB22F7A E7B8CC5D 50CB0867 DFDB2CF4 FADA3D49 0DF75D72 F7563186 419494C9 8F9C82A6");
+		Integer sExp("0x 6EA191CA 0D468AC3 E9568768 9338357C 7D0BACB3 F1D87E0D EC05F635 B7ADB842 75AA0086 60F812CF");
+
+		fail = (r != rExp) || (s != sExp);
+		pass = pass && !fail;
+
+		const byte msg[] = "Example of ECGDSA with the hash function SHA-224";
+		const size_t len = strlen((char*)msg);
+
+		const size_t maxLength = signer.MaxSignatureLength();
+		SecByteBlock signature(maxLength);
+		r.Encode(signature+          0, maxLength/2);
+		s.Encode(signature+maxLength/2, maxLength/2);
+
+		fail = !verifier.VerifyMessage(msg, len, signature, signature.size());
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "brainpoolP320r1 using SHA-224\n";
+
+		fail = !SignatureValidate(signer, verifier);
+		pass = pass && !fail;
+	}
+
+	// 2.4.1 Examples of ECGDSA over GF(p) with the hash function SHA-256 (p. 27)
+	{
+		const OID oid = ASN1::brainpoolP320r1();
+		DL_GroupParameters_EC<ECP> params(oid);
+		Integer x("0x 48683594 5A3A284F FC52629A D48D8F37 F4B2E993 9C52BC72 362A9961 40192AEF 7D2AAFF0 C73A51C5");
+		ECGDSA<ECP, SHA256>::Signer signer(params, x);
+		ECGDSA<ECP, SHA256>::Verifier verifier(signer);
+
+		Integer e("0x 00000000 00000000 37ED8AA9 4AE667DB BB753330 E050EB8E 12195807 ECDC4FB1 0E0662B4 22C219D7");
+		Integer k("0x C70BC00A 77AD7872 5D36CEEC 27D6F956 FB546EEF 6DC90E35 31452BD8 7ECE8A4A 7AD730AD C299D81B");
+
+		Integer r, s;
+		signer.RawSign(k, e, r, s);
+
+		Integer rExp("0x 3C925969 FAB22F7A E7B8CC5D 50CB0867 DFDB2CF4 FADA3D49 0DF75D72 F7563186 419494C9 8F9C82A6");
+		Integer sExp("0x 24370797 A9D11717 BBBB2B76 2E08ECD0 7DD7E033 F544E47C BF3C6D16 FD90B51D CC2E4DD8 E6ECD8CD");
+
+		fail = (r != rExp) || (s != sExp);
+		pass = pass && !fail;
+
+		const byte msg[] = "Example of ECGDSA with the hash function SHA-256";
+		const size_t len = strlen((char*)msg);
+
+		const size_t maxLength = signer.MaxSignatureLength();
+		SecByteBlock signature(maxLength);
+		r.Encode(signature+          0, maxLength/2);
+		s.Encode(signature+maxLength/2, maxLength/2);
+
+		fail = !verifier.VerifyMessage(msg, len, signature, signature.size());
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "brainpoolP320r1 using SHA-256\n";
+
+		fail = !SignatureValidate(signer, verifier);
+		pass = pass && !fail;
+	}
+
+	// 2.4.1 Examples of ECGDSA over GF(p) with the hash function SHA-384 (p. 34)
+	{
+		const OID oid = ASN1::brainpoolP512r1();
+		DL_GroupParameters_EC<ECP> params(oid);
+		Integer x("0x 92006A98 8AF96D91 57AADCF8 62716962 7CE2ECC4 C58ECE5C 1A0A8642 11AB764C 04236FA0 160857A7 8E71CCAE 4D79D52E 5A69A457 8AF50658 1F598FA9 B4F7DA68");
+		ECGDSA<ECP, SHA384>::Signer signer(params, x);
+		ECGDSA<ECP, SHA384>::Verifier verifier(signer);
+
+		Integer e("0x 00000000 00000000 00000000 00000000 68FEAB7D 8BF8A779 4466E447 5959946B 2136C084 A86090CA 8070C980 68B1250D 88213190 6B7E0CB8 475F9054 E9290C2E");
+		Integer k("0x 6942B01D 5901BEC1 506BB874 9618E22E C0FCD7F3 5159D51E D53BA77A 78752128 A58232AD 8E0E021A FDE1477F F4C74FDF FE88AE2D 15D89B56 F6D73C03 77631D2B");
+
+		Integer r, s;
+		signer.RawSign(k, e, r, s);
+
+		Integer rExp("0x 0104918B 2B32B1A5 49BD43C3 0092953B 4164CA01 A1A97B5B 0756EA06 3AC16B41 B88A1BAB 4538CD7D 8466180B 3E3F5C86 46AC4A45 F564E9B6 8FEE72ED 00C7AC48");
+		Integer sExp("0x 3D233E9F D9EB152E 889F4F7C F325B464 0894E5EA 44C51443 54305CD4 BF70D234 8257C2DB E06C5544 92CE9FDD 6861A565 77B53E5E E80E6062 31A4CF06 8FA1EC21");
+
+		fail = (r != rExp) || (s != sExp);
+		pass = pass && !fail;
+
+		const byte msg[] = "Example of ECGDSA with the hash function SHA-384";
+		const size_t len = strlen((char*)msg);
+
+		const size_t maxLength = signer.MaxSignatureLength();
+		SecByteBlock signature(maxLength);
+		r.Encode(signature+          0, maxLength/2);
+		s.Encode(signature+maxLength/2, maxLength/2);
+
+		fail = !verifier.VerifyMessage(msg, len, signature, signature.size());
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "brainpoolP512r1 using SHA-384\n";
+
+		fail = !SignatureValidate(signer, verifier);
+		pass = pass && !fail;
+	}
+
+	// 2.4.1 Examples of ECGDSA over GF(p) with the hash function SHA-512 (p. 38)
+	{
+		const OID oid = ASN1::brainpoolP512r1();
+		DL_GroupParameters_EC<ECP> params(oid);
+		Integer x("0x 92006A98 8AF96D91 57AADCF8 62716962 7CE2ECC4 C58ECE5C 1A0A8642 11AB764C 04236FA0 160857A7 8E71CCAE 4D79D52E 5A69A457 8AF50658 1F598FA9 B4F7DA68");
+		ECGDSA<ECP, SHA512>::Signer signer(params, x);
+		ECGDSA<ECP, SHA512>::Verifier verifier(signer);
+
+		Integer e("0x 1A95EF81 D213BD3B 8191E7FE 7F5BFD43 F51E3EE5 A4FD3D08 4A7C9BB5 411F4649 746AEBC6 623D4DEA 7E02DC5A 85E24AF2 96B5A555 AD470413 71E4BF64 380F3E34");
+		Integer k("0x 6942B01D 5901BEC1 506BB874 9618E22E C0FCD7F3 5159D51E D53BA77A 78752128 A58232AD 8E0E021A FDE1477F F4C74FDF FE88AE2D 15D89B56 F6D73C03 77631D2B");
+
+		Integer r, s;
+		signer.RawSign(k, e, r, s);
+
+		Integer rExp("0x 0104918B 2B32B1A5 49BD43C3 0092953B 4164CA01 A1A97B5B 0756EA06 3AC16B41 B88A1BAB 4538CD7D 8466180B 3E3F5C86 46AC4A45 F564E9B6 8FEE72ED 00C7AC48");
+		Integer sExp("0x 17A011F8 DD7B5665 2B27AA6D 6E7BDF3C 7C23B5FA 32910FBA A107E627 0E1CA8A7 A263F661 8E6098A0 D6CD6BA1 C03544C5 425875EC B3418AF5 A3EE3F32 143E48D2");
+
+		fail = (r != rExp) || (s != sExp);
+		pass = pass && !fail;
+
+		const byte msg[] = "Example of ECGDSA with the hash function SHA-512";
+		const size_t len = strlen((char*)msg);
+
+		const size_t maxLength = signer.MaxSignatureLength();
+		SecByteBlock signature(maxLength);
+		r.Encode(signature+          0, maxLength/2);
+		s.Encode(signature+maxLength/2, maxLength/2);
+
+		fail = !verifier.VerifyMessage(msg, len, signature, signature.size());
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "brainpoolP512r1 using SHA-512\n";
+
+		fail = !SignatureValidate(signer, verifier);
+		pass = pass && !fail;
+	}
+
+	return pass;
+}
+
+// from http://www.teletrust.de/fileadmin/files/oid/ecgdsa_final.pdf
+// ValidateECGDSA split into standard and thorough due to GH #1134
+bool ValidateECGDSAThorough()
+{
+	bool fail, pass=true;
+
+	// 2.4.1 Examples of ECGDSA over GF(p) with the hash function RIPEMD-160 (p. 10)
+	{
+		const OID oid = ASN1::brainpoolP192r1();
+		DL_GroupParameters_EC<ECP> params(oid);
+		Integer x("0x 80F2425E 89B4F585 F27F3536 ED834D68 E3E492DE 08FE84B9");
+		ECGDSA<ECP, RIPEMD160>::Signer signer(params, x);
+		ECGDSA<ECP, RIPEMD160>::Verifier verifier(signer);
+
+		Integer e("0x 00000000 577EF842 B32FDE45 79727FFF 02F7A280 74ADC4EF");
+		Integer k("0x 22C17C2A 367DD85A B8A365ED 06F19C43 F9ED1834 9A9BC044");
+
+		Integer r, s;
+		signer.RawSign(k, e, r, s);
+
+		Integer rExp("0x 2D017BE7 F117FF99 4ED6FC63 CA5B4C7A 0430E9FA 095DAFC4");
+		Integer sExp("0x C02B5CC5 C51D5411 060BF024 5049F824 839F671D 78A1BBF1");
+
+		fail = (r != rExp) || (s != sExp);
+		pass = pass && !fail;
+
+		const byte msg[] = "Example of ECGDSA with the hash function RIPEMD-160";
+		const size_t len = strlen((char*)msg);
+
+		const size_t maxLength = signer.MaxSignatureLength();
+		SecByteBlock signature(maxLength);
+		r.Encode(signature+          0, maxLength/2);
+		s.Encode(signature+maxLength/2, maxLength/2);
+
+		fail = !verifier.VerifyMessage(msg, len, signature, signature.size());
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "brainpoolP192r1 using RIPEMD-160\n";
+
+		fail = !SignatureValidate(signer, verifier);
+		pass = pass && !fail;
+	}
+
+	// 2.4.1 Examples of ECGDSA over GF(p) with the hash function RIPEMD-160 (p. 13)
+	{
+		const OID oid = ASN1::brainpoolP256r1();
+		DL_GroupParameters_EC<ECP> params(oid);
+		Integer x("0x 47B3A278 62DEF037 49ACF0D6 00E69F9B 851D01ED AEFA531F 4D168E78 7307F4D8");
+		ECGDSA<ECP, RIPEMD160>::Signer signer(params, x);
+		ECGDSA<ECP, RIPEMD160>::Verifier verifier(signer);
+
+		Integer e("0x 00000000 00000000 00000000 577EF842 B32FDE45 79727FFF 02F7A280 74ADC4EF");
+		Integer k("0x 908E3099 776261A4 558FF7A9 FA6DFFE0 CA6BB3F9 CB35C2E4 E1DC73FD 5E8C08A3");
+
+		Integer r, s;
+		signer.RawSign(k, e, r, s);
+
+		Integer rExp("0x 62CCD1D2 91E62F6A 4FFBD966 C66C85AA BA990BB6 AB0C087D BD54A456 CCC84E4C");
+		Integer sExp("0x 9119719B 08EEA0D6 BC56E4D1 D37369BC F3768445 EF65CAE4 A37BF6D4 3BD01646");
+
+		fail = (r != rExp) || (s != sExp);
+		pass = pass && !fail;
+
+		const byte msg[] = "Example of ECGDSA with the hash function RIPEMD-160";
+		const size_t len = strlen((char*)msg);
+
+		const size_t maxLength = signer.MaxSignatureLength();
+		SecByteBlock signature(maxLength);
+		r.Encode(signature+          0, maxLength/2);
+		s.Encode(signature+maxLength/2, maxLength/2);
+
+		fail = !verifier.VerifyMessage(msg, len, signature, signature.size());
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "brainpoolP256r1 using RIPEMD-160\n";
+
+		fail = !SignatureValidate(signer, verifier);
+		pass = pass && !fail;
+	}
+
+	// 2.4.1 Examples of ECGDSA over GF(p) with the hash function RIPEMD-160 (p. 16)
+	{
+		const OID oid = ASN1::brainpoolP320r1();
+		DL_GroupParameters_EC<ECP> params(oid);
+		Integer x("0x 48683594 5A3A284F FC52629A D48D8F37 F4B2E993 9C52BC72 362A9961 40192AEF 7D2AAFF0 C73A51C5");
+		ECGDSA<ECP, RIPEMD160>::Signer signer(params, x);
+		ECGDSA<ECP, RIPEMD160>::Verifier verifier(signer);
+
+		Integer e("0x 00000000 00000000 00000000 00000000 00000000 577EF842 B32FDE45 79727FFF 02F7A280 74ADC4EF");
+		Integer k("0x C70BC00A 77AD7872 5D36CEEC 27D6F956 FB546EEF 6DC90E35 31452BD8 7ECE8A4A 7AD730AD C299D81B");
+
+		Integer r, s;
+		signer.RawSign(k, e, r, s);
+
+		Integer rExp("0x 3C925969 FAB22F7A E7B8CC5D 50CB0867 DFDB2CF4 FADA3D49 0DF75D72 F7563186 419494C9 8F9C82A6");
+		Integer sExp("0x 06AB5250 B31A8E93 56194894 61733200 E4FD5C12 75C0AB37 E7E41149 5BAAE145 41DF6DE6 66B8CA56");
+
+		fail = (r != rExp) || (s != sExp);
+		pass = pass && !fail;
+
+		const byte msg[] = "Example of ECGDSA with the hash function RIPEMD-160";
+		const size_t len = strlen((char*)msg);
+
+		const size_t maxLength = signer.MaxSignatureLength();
+		SecByteBlock signature(maxLength);
+		r.Encode(signature+          0, maxLength/2);
+		s.Encode(signature+maxLength/2, maxLength/2);
+
+		fail = !verifier.VerifyMessage(msg, len, signature, signature.size());
+		pass = pass && !fail;
+
+		std::cout << (fail ? "FAILED    " : "passed    ");
+		std::cout << "brainpoolP320r1 using RIPEMD-160\n";
+
+		fail = !SignatureValidate(signer, verifier);
+		pass = pass && !fail;
+	}
+
+	return pass;
+}
+
+// ValidateECGDSA split into standard and thorough due to GH #1134
+bool ValidateECGDSA(bool thorough)
+{
+	std::cout << "\nECGDSA validation suite running...\n\n";
+
+	bool pass = true, fail;
+
+	fail = !ValidateECGDSAStandard();
+	pass = pass && !fail;
+
+	if (thorough) {
+		fail = !ValidateECGDSAThorough();
+		pass = pass && !fail;
+	}
+
+	return pass;
+}
+
+bool ValidateESIGN()
+{
+	std::cout << "\nESIGN validation suite running...\n\n";
+
+	bool pass = true, fail;
+
+	const char plain[] = "test";
+	const byte signature[] =
+		"\xA3\xE3\x20\x65\xDE\xDA\xE7\xEC\x05\xC1\xBF\xCD\x25\x79\x7D\x99\xCD\xD5\x73\x9D\x9D\xF3\xA4\xAA\x9A\xA4\x5A\xC8\x23\x3D\x0D\x37"
+		"\xFE\xBC\x76\x3F\xF1\x84\xF6\x59\x14\x91\x4F\x0C\x34\x1B\xAE\x9A\x5C\x2E\x2E\x38\x08\x78\x77\xCB\xDC\x3C\x7E\xA0\x34\x44\x5B\x0F"
+		"\x67\xD9\x35\x2A\x79\x47\x1A\x52\x37\x71\xDB\x12\x67\xC1\xB6\xC6\x66\x73\xB3\x40\x2E\xD6\xF2\x1A\x84\x0A\xB6\x7B\x0F\xEB\x8B\x88"
+		"\xAB\x33\xDD\xE4\x83\x21\x90\x63\x2D\x51\x2A\xB1\x6F\xAB\xA7\x5C\xFD\x77\x99\xF2\xE1\xEF\x67\x1A\x74\x02\x37\x0E\xED\x0A\x06\xAD"
+		"\xF4\x15\x65\xB8\xE1\xD1\x45\xAE\x39\x19\xB4\xFF\x5D\xF1\x45\x7B\xE0\xFE\x72\xED\x11\x92\x8F\x61\x41\x4F\x02\x00\xF2\x76\x6F\x7C"
+		"\x79\xA2\xE5\x52\x20\x5D\x97\x5E\xFE\x39\xAE\x21\x10\xFB\x35\xF4\x80\x81\x41\x13\xDD\xE8\x5F\xCA\x1E\x4F\xF8\x9B\xB2\x68\xFB\x28";
+
+	FileSource keys(DataDir("TestData/esig1536.dat").c_str(), true, new HexDecoder);
+	ESIGN<SHA1>::Signer signer(keys);
+	ESIGN<SHA1>::Verifier verifier(signer);
+
+	fail = !SignatureValidate(signer, verifier);
+	pass = pass && !fail;
+
+	fail = !verifier.VerifyMessage((byte *)plain, strlen(plain), signature, verifier.SignatureLength());
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED    " : "passed    ");
+	std::cout << "verification check against test vector\n";
+
+	std::cout << "Generating signature key from seed..." << std::endl;
+	signer.AccessKey().GenerateRandom(GlobalRNG(), MakeParameters("Seed", ConstByteArrayParameter((const byte *)"test", 4))("KeySize", 3*512));
+	verifier = signer;
+
+	fail = !SignatureValidate(signer, verifier);
+	pass = pass && !fail;
+
+	return pass;
+}
+
+bool ValidateEd25519()
+{
+	std::cout << "\ned25519 validation suite running...\n\n";
+	bool pass = true, fail;
+
+	const char plain[] = "test";
+	const byte signature[] =
+		"\x91\x12\x44\x91\xA5\x99\xF8\x49\xBA\xB2\xC4\xF2\xBA\x0B\xAA\x99"
+		"\xC8\xC5\xF5\x19\xDC\x07\xD4\x4C\xF7\x31\xDE\x2F\x2B\x81\xB2\x81"
+		"\xF6\xA7\xDE\x33\x29\xCA\x45\xAC\x69\x2A\x80\xB7\xDB\x7F\x07\x37"
+		"\x77\xC4\xBF\xC5\x45\x79\x3A\xAC\xB5\x16\xAE\x4E\xD9\x16\x95\x0E";
+
+	FileSource keys(DataDir("TestData/ed25519.dat").c_str(), true, new HexDecoder);
+	ed25519::Signer signer(keys);
+	ed25519::Verifier verifier(signer);
+
+	fail = !SignatureValidate(signer, verifier);
+	pass = pass && !fail;
+
+	fail = !verifier.VerifyMessage((byte *)plain, strlen(plain), signature, verifier.SignatureLength());
+	pass = pass && !fail;
+
+	std::cout << (fail ? "FAILED    " : "passed    ");
+	std::cout << "verification check against test vector\n";
+
+	return pass;
+}
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/validate.h b/runtime/third_party/cryptopp/validate.h
new file mode 100644
index 0000000..17474b5
--- /dev/null
+++ b/runtime/third_party/cryptopp/validate.h
@@ -0,0 +1,395 @@
+// validate.h - originally written and placed in the public domain by Wei Dai
+//              CryptoPP::Test namespace added by JW in February 2017
+
+#ifndef CRYPTOPP_VALIDATE_H
+#define CRYPTOPP_VALIDATE_H
+
+#include "cryptlib.h"
+#include "misc.h"
+#include "files.h"
+#include "argnames.h"
+#include "algparam.h"
+#include "hex.h"
+
+#include <iostream>
+#include <sstream>
+#include <iomanip>
+#include <ctime>
+#include <cctype>
+
+NAMESPACE_BEGIN(CryptoPP)
+NAMESPACE_BEGIN(Test)
+
+// A hint to help locate TestData/ and TestVectors/ after install. Due to
+// execve the path can be malicious. If the path is ficticous then we move
+// onto the next potential path. Also note we only read from the path; we
+// never write through it. Storage for the string is in test.cpp.
+extern std::string g_argvPathHint;
+
+bool ValidateAll(bool thorough);
+bool TestSettings();
+bool TestOS_RNG();
+// bool TestSecRandom();
+bool TestRandomPool();
+#if !defined(NO_OS_DEPENDENCE)
+bool TestAutoSeededX917();
+#endif
+#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
+bool TestRDRAND();
+bool TestRDSEED();
+bool TestPadlockRNG();
+#endif
+#if (CRYPTOPP_BOOL_PPC32 || CRYPTOPP_BOOL_PPC64)
+bool TestDARN();
+#endif
+bool ValidateBaseCode();
+bool ValidateEncoder();
+bool ValidateCRC32();
+bool ValidateCRC32C();
+bool ValidateAdler32();
+bool ValidateMD2();
+bool ValidateMD4();
+bool ValidateMD5();
+bool ValidateSHA();
+bool ValidateSHA2();
+bool ValidateSHA3();
+bool ValidateSHAKE();      // output <= r, where r is blocksize
+bool ValidateSHAKE_XOF();  // output > r, needs hand crafted tests
+bool ValidateKeccak();
+bool ValidateTiger();
+bool ValidateRIPEMD();
+bool ValidatePanama();
+bool ValidateWhirlpool();
+bool ValidateLSH();
+
+bool ValidateSM3();
+bool ValidateBLAKE2s();
+bool ValidateBLAKE2b();
+bool ValidatePoly1305();
+bool ValidateSipHash();
+
+bool ValidateHMAC();
+bool ValidateTTMAC();
+
+bool ValidateCipherModes();
+bool ValidatePBKDF();
+bool ValidateHKDF();
+bool ValidateScrypt();
+
+bool ValidateDES();
+bool ValidateIDEA();
+bool ValidateSAFER();
+bool ValidateRC2();
+bool ValidateARC4();
+
+bool ValidateRC5();
+bool ValidateBlowfish();
+bool ValidateBlowfishCompat();
+bool ValidateThreeWay();
+bool ValidateGOST();
+bool ValidateSHARK();
+bool ValidateSEAL();
+bool ValidateCAST();
+bool ValidateSquare();
+bool ValidateSKIPJACK();
+bool ValidateRC6();
+bool ValidateMARS();
+bool ValidateRijndael();
+bool ValidateTwofish();
+bool ValidateSerpent();
+bool ValidateSHACAL2();
+bool ValidateARIA();
+bool ValidateSIMECK();
+bool ValidateCHAM();
+bool ValidateHIGHT();
+bool ValidateLEA();
+bool ValidateSIMON();
+bool ValidateSPECK();
+bool ValidateCamellia();
+
+bool ValidateHC128();
+bool ValidateHC256();
+bool ValidateRabbit();
+bool ValidateSalsa();
+bool ValidateChaCha();
+bool ValidateChaChaTLS();
+bool ValidateSosemanuk();
+
+bool ValidateVMAC();
+bool ValidateCCM();
+bool ValidateGCM();
+bool ValidateXTS();
+bool ValidateCMAC();
+
+bool ValidateBBS();
+bool ValidateDH();
+bool ValidateMQV();
+bool ValidateHMQV();
+bool ValidateFHMQV();
+bool ValidateRSA();
+bool ValidateElGamal();
+bool ValidateDLIES();
+bool ValidateNR();
+bool ValidateDSA(bool thorough);
+bool ValidateLUC();
+bool ValidateLUC_DL();
+bool ValidateLUC_DH();
+bool ValidateXTR_DH();
+bool ValidateRabin();
+bool ValidateRW();
+bool ValidateECP();
+bool ValidateEC2N();
+bool ValidateECDSA();
+bool ValidateECDSA_RFC6979();
+bool ValidateECGDSA(bool thorough);
+bool ValidateESIGN();
+
+bool ValidateHashDRBG();
+bool ValidateHmacDRBG();
+
+bool TestX25519();
+bool TestEd25519();
+bool ValidateX25519();
+bool ValidateEd25519();
+bool ValidateNaCl();
+
+// If CRYPTOPP_DEBUG or CRYPTOPP_COVERAGE is in effect, then perform additional tests
+#if (defined(CRYPTOPP_DEBUG) || defined(CRYPTOPP_COVERAGE)) && !defined(CRYPTOPP_IMPORTS)
+# define CRYPTOPP_EXTENDED_VALIDATION 1
+#endif
+
+#if defined(CRYPTOPP_EXTENDED_VALIDATION)
+// http://github.com/weidai11/cryptopp/issues/92
+bool TestSecBlock();
+// http://github.com/weidai11/cryptopp/issues/64
+bool TestPolynomialMod2();
+// http://github.com/weidai11/cryptopp/issues/336
+bool TestIntegerBitops();
+// http://github.com/weidai11/cryptopp/issues/602
+bool TestIntegerOps();
+// http://github.com/weidai11/cryptopp/issues/360
+bool TestRounding();
+// http://github.com/weidai11/cryptopp/issues/242
+bool TestHuffmanCodes();
+// http://github.com/weidai11/cryptopp/issues/346
+bool TestASN1Parse();
+bool TestASN1Functions();
+// https://github.com/weidai11/cryptopp/pull/334
+bool TestStringSink();
+// Additional tests due to no coverage
+bool TestCompressors();
+bool TestEncryptors();
+bool TestMersenne();
+bool TestSharing();
+# if defined(CRYPTOPP_ALTIVEC_AVAILABLE)
+bool TestAltivecOps();
+# endif
+#endif
+
+class FixedRNG : public RandomNumberGenerator
+{
+public:
+	FixedRNG(BufferedTransformation &source) : m_source(source) {}
+
+	void GenerateBlock(byte *output, size_t size)
+	{
+		m_source.Get(output, size);
+	}
+
+private:
+	BufferedTransformation &m_source;
+};
+
+// Safer functions on Windows for C&A, http://github.com/weidai11/cryptopp/issues/55
+inline std::string TimeToString(const time_t& t)
+{
+#if (CRYPTOPP_MSC_VERSION >= 1400)
+	tm localTime;
+	char timeBuf[64];
+	errno_t err;
+
+	err = ::localtime_s(&localTime, &t);
+	CRYPTOPP_ASSERT(err == 0);
+	err = ::asctime_s(timeBuf, sizeof(timeBuf), &localTime);
+	CRYPTOPP_ASSERT(err == 0);
+
+	std::string str(err == 0 ? timeBuf : "");
+#elif defined(__MINGW32__) || defined(__MINGW64__)
+	char* timeString = ::asctime(::localtime(&t));
+	std::string str(timeString ? timeString : "");
+#elif (_POSIX_C_SOURCE >= 1 || _XOPEN_SOURCE || _BSD_SOURCE || _SVID_SOURCE || defined(_POSIX_SOURCE))
+	tm localTime;
+	char timeBuf[64];
+	char* timeString = ::asctime_r(::localtime_r(&t, &localTime), timeBuf);
+	std::string str(timeString ? timeString : "");
+#else
+	char* timeString = ::asctime(::localtime(&t));
+	std::string str(timeString ? timeString : "");
+#endif
+
+	// Cleanup whitespace
+	std::string::size_type pos = 0;
+	while (!str.empty() && std::isspace(str[str.length()-1]))
+		{str.erase(str.end()-1);}
+	while (!str.empty() && std::string::npos != (pos = str.find("  ", pos)))
+		{str.erase(pos, 1);}
+
+	return str;
+}
+
+// Coverity finding
+template <class T, bool NON_NEGATIVE>
+inline T StringToValue(const std::string& str)
+{
+	std::istringstream iss(str);
+
+	// Arbitrary, but we need to clear a Coverity finding TAINTED_SCALAR
+	if (iss.str().length() > 25)
+		throw InvalidArgument(str + "' is too long");
+
+	T value;
+	iss >> std::noskipws >> value;
+
+	// Use fail(), not bad()
+	if (iss.fail())
+		throw InvalidArgument(str + "' is not a value");
+
+	if (NON_NEGATIVE && value < 0)
+		throw InvalidArgument(str + "' is negative");
+
+	return value;
+}
+
+// Coverity finding
+template<>
+inline int StringToValue<int, true>(const std::string& str)
+{
+	Integer n(str.c_str());
+	long l = n.ConvertToLong();
+
+	int r;
+	if (!SafeConvert(l, r))
+		throw InvalidArgument(str + "' is not an integer value");
+
+	return r;
+}
+
+inline std::string AddSeparator(std::string str)
+{
+	if (str.empty()) return "";
+	const char last = str[str.length()-1];
+	if (last != '/' && last != '\\')
+		return str + "/";
+	return str;
+}
+
+// Use CRYPTOPP_DATA_DIR last. The problem this sidesteps is, finding an
+// old version of Crypto++ library in CRYPTOPP_DATA_DIR when the library
+// has been staged in DESTDIR. Using CRYPTOPP_DATA_DIR first only works
+// as expected when CRYPTOPP_DATA_DIR is empty before an install. We
+// encountered this problem rather quickly during testing of Crypto++ 8.1
+// when Crypto++ 8.0 was installed locally. It took some time to realize
+// where the old test data was coming from.
+static std::string GetDataDir()
+{
+	std::ifstream file;
+	std::string name, filename = "TestData/usage.dat";
+
+#ifndef CRYPTOPP_DISABLE_DATA_DIR_SEARCH
+	// Look in $ORIGIN/../share/. This is likely a Linux install directory.
+	name = AddSeparator(g_argvPathHint) + std::string("../share/cryptopp/") + filename;
+	file.open(name.c_str());
+	if (file.is_open())
+		return AddSeparator(g_argvPathHint) + std::string("../share/cryptopp/");
+#endif
+#ifndef CRYPTOPP_DISABLE_DATA_DIR_SEARCH
+	// Look in current working directory
+	name = AddSeparator(g_argvPathHint) + filename;
+	file.open(name.c_str());
+	if (file.is_open())
+		return AddSeparator(g_argvPathHint);
+#endif
+#ifdef CRYPTOPP_DATA_DIR
+	// Honor CRYPTOPP_DATA_DIR. This is likely an install directory if it is not "./".
+	name = AddSeparator(CRYPTOPP_DATA_DIR) + filename;
+	file.open(name.c_str());
+	if (file.is_open())
+		return AddSeparator(CRYPTOPP_DATA_DIR);
+#endif
+	return "./";
+}
+
+inline std::string DataDir(const std::string& filename)
+{
+	std::string name;
+	std::ifstream file;
+
+#if CRYPTOPP_CXX11_STATIC_INIT
+	static std::string path = AddSeparator(GetDataDir());
+	name = path + filename;
+	file.open(name.c_str());
+	if (file.is_open())
+		return name;
+#else
+	// Avoid static initialization problems
+	name = AddSeparator(GetDataDir()) + filename;
+	file.open(name.c_str());
+	if (file.is_open())
+		return name;
+#endif
+
+	// This will cause the expected exception in the caller
+	return filename;
+}
+
+// Definition in test.cpp
+RandomNumberGenerator& GlobalRNG();
+
+// Definition in datatest.cpp
+bool RunTestDataFile(const char *filename, const NameValuePairs &overrideParameters=g_nullNameValuePairs, bool thorough=true);
+
+// Definitions in validat6.cpp
+bool CryptoSystemValidate(PK_Decryptor &priv, PK_Encryptor &pub, bool thorough = false);
+bool SimpleKeyAgreementValidate(SimpleKeyAgreementDomain &d);
+bool AuthenticatedKeyAgreementWithRolesValidate(AuthenticatedKeyAgreementDomain &initiator, AuthenticatedKeyAgreementDomain &recipient);
+bool AuthenticatedKeyAgreementValidate(AuthenticatedKeyAgreementDomain &d);
+bool SignatureValidate(PK_Signer &priv, PK_Verifier &pub, bool thorough = false);
+
+// Miscellaneous PK definitions in validat6.cpp
+// Key Agreement definitions in validat7.cpp
+// Encryption and Decryption definitions in validat8.cpp
+// Sign and Verify definitions in validat9.cpp
+
+bool ValidateECP();
+bool ValidateEC2N();
+
+bool ValidateRSA_Encrypt();
+bool ValidateRSA_Sign();
+
+bool ValidateLUC_Encrypt();
+bool ValidateLUC_Sign();
+
+bool ValidateLUC_DL_Encrypt();
+bool ValidateLUC_DL_Sign();
+
+bool ValidateRabin_Encrypt();
+bool ValidateRabin_Sign();
+
+bool ValidateECP();
+bool ValidateECP_Agreement();
+bool ValidateECP_Encrypt();
+bool ValidateECP_Sign();
+
+bool ValidateECP_Legacy_Encrypt();
+bool ValidateEC2N_Legacy_Encrypt();
+bool ValidateECP_NULLDigest_Encrypt();
+
+bool ValidateEC2N();
+bool ValidateEC2N_Agreement();
+bool ValidateEC2N_Encrypt();
+bool ValidateEC2N_Sign();
+
+NAMESPACE_END  // Test
+NAMESPACE_END  // CryptoPP
+
+#endif
diff --git a/runtime/third_party/cryptopp/vmac.cpp b/runtime/third_party/cryptopp/vmac.cpp
new file mode 100644
index 0000000..fe67534
--- /dev/null
+++ b/runtime/third_party/cryptopp/vmac.cpp
@@ -0,0 +1,894 @@
+// vmac.cpp - originally written and placed in the public domain by Wei Dai
+// based on Ted Krovetz's public domain vmac.c and draft-krovetz-vmac-01.txt
+
+#include "pch.h"
+#include "config.h"
+
+#include "vmac.h"
+#include "cpu.h"
+#include "argnames.h"
+#include "secblock.h"
+
+#if defined(CRYPTOPP_MSC_VERSION) && !CRYPTOPP_BOOL_SLOW_WORD64
+#include <intrin.h>
+#endif
+
+#if defined(CRYPTOPP_DISABLE_VMAC_ASM)
+# undef CRYPTOPP_X86_ASM_AVAILABLE
+# undef CRYPTOPP_X32_ASM_AVAILABLE
+# undef CRYPTOPP_X64_ASM_AVAILABLE
+# undef CRYPTOPP_SSE2_ASM_AVAILABLE
+#endif
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4731)
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+#if defined(CRYPTOPP_WORD128_AVAILABLE) && !defined(CRYPTOPP_X64_ASM_AVAILABLE)
+using CryptoPP::word128;
+using CryptoPP::word64;
+# define VMAC_BOOL_WORD128 1
+#else
+using CryptoPP::word64;
+# define VMAC_BOOL_WORD128 0
+#endif
+
+#ifdef __BORLANDC__
+#define const	// Turbo C++ 2006 workaround
+#endif
+const word64 p64   = W64LIT(0xfffffffffffffeff);  /* 2^64 - 257 prime  */
+const word64 m62   = W64LIT(0x3fffffffffffffff);  /* 62-bit mask       */
+const word64 m63   = W64LIT(0x7fffffffffffffff);  /* 63-bit mask       */
+const word64 m64   = W64LIT(0xffffffffffffffff);  /* 64-bit mask       */
+const word64 mpoly = W64LIT(0x1fffffff1fffffff);  /* Poly key mask     */
+#ifdef __BORLANDC__
+#undef const
+#endif
+
+#if VMAC_BOOL_WORD128
+// workaround GCC Bug 31690: ICE with const __uint128_t and C++ front-end
+# if defined(__powerpc__) && defined (CRYPTOPP_GCC_VERSION) && (CRYPTOPP_GCC_VERSION < 50300)
+#  define m126				((word128(m62)<<64)|m64)
+# else
+const word128 m126 = (word128(m62)<<64)|m64;		 /* 126-bit mask      */
+# endif
+#endif
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void VMAC_Base::UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &params)
+{
+	int digestLength = params.GetIntValueWithDefault(Name::DigestSize(), DefaultDigestSize());
+	if (digestLength != 8 && digestLength != 16)
+		throw InvalidArgument("VMAC: DigestSize must be 8 or 16");
+	m_is128 = digestLength == 16;
+
+	m_L1KeyLength = params.GetIntValueWithDefault(Name::L1KeyLength(), 128);
+	if (m_L1KeyLength <= 0 || m_L1KeyLength % 128 != 0)
+		throw InvalidArgument("VMAC: L1KeyLength must be a positive multiple of 128");
+
+	AllocateBlocks();
+
+	BlockCipher &cipher = AccessCipher();
+	cipher.SetKey(userKey, keylength, params);
+	const unsigned int blockSize = cipher.BlockSize();
+	const unsigned int blockSizeInWords = blockSize / sizeof(word64);
+	SecBlock<word64, AllocatorWithCleanup<word64, true> > out(blockSizeInWords);
+	AlignedSecByteBlock in;
+	in.CleanNew(blockSize);
+	size_t i;
+
+	/* Fill nh key */
+	in[0] = 0x80;
+	cipher.AdvancedProcessBlocks(in, NULLPTR, (byte *)m_nhKey(), m_nhKeySize()*sizeof(word64), cipher.BT_InBlockIsCounter);
+	ConditionalByteReverse<word64>(BIG_ENDIAN_ORDER, m_nhKey(), m_nhKey(), m_nhKeySize()*sizeof(word64));
+
+	/* Fill poly key */
+	in[0] = 0xC0;
+	in[15] = 0;
+	for (i = 0; i <= (size_t)m_is128; i++)
+	{
+		cipher.ProcessBlock(in, out.BytePtr());
+		m_polyState()[i*4+2] = GetWord<word64>(true, BIG_ENDIAN_ORDER, out.BytePtr()) & mpoly;
+		m_polyState()[i*4+3]  = GetWord<word64>(true, BIG_ENDIAN_ORDER, out.BytePtr()+8) & mpoly;
+		in[15]++;
+	}
+
+	/* Fill ip key */
+	in[0] = 0xE0;
+	in[15] = 0;
+	word64 *l3Key = m_l3Key();
+	CRYPTOPP_ASSERT(IsAlignedOn(l3Key,GetAlignmentOf<word64>()));
+
+	for (i = 0; i <= (size_t)m_is128; i++)
+		do
+		{
+			cipher.ProcessBlock(in, out.BytePtr());
+			l3Key[i*2+0] = GetWord<word64>(true, BIG_ENDIAN_ORDER, out.BytePtr());
+			l3Key[i*2+1] = GetWord<word64>(true, BIG_ENDIAN_ORDER, out.BytePtr()+8);
+			in[15]++;
+		} while ((l3Key[i*2+0] >= p64) || (l3Key[i*2+1] >= p64));
+
+	m_padCached = false;
+	size_t nonceLength;
+	const byte *nonce = GetIVAndThrowIfInvalid(params, nonceLength);
+	Resynchronize(nonce, (int)nonceLength);
+}
+
+void VMAC_Base::GetNextIV(RandomNumberGenerator &rng, byte *IV)
+{
+	SimpleKeyingInterface::GetNextIV(rng, IV);
+	IV[0] &= 0x7f;
+}
+
+void VMAC_Base::Resynchronize(const byte *nonce, int len)
+{
+	size_t length = ThrowIfInvalidIVLength(len);
+	size_t s = IVSize();
+	byte *storedNonce = m_nonce();
+
+	if (m_is128)
+	{
+		std::memset(storedNonce, 0, s-length);
+		std::memcpy(storedNonce+s-length, nonce, length);
+		AccessCipher().ProcessBlock(storedNonce, m_pad());
+	}
+	else
+	{
+		if (m_padCached && (storedNonce[s-1] | 1) == (nonce[length-1] | 1))
+		{
+			m_padCached = VerifyBufsEqual(storedNonce+s-length, nonce, length-1);
+			for (size_t i=0; m_padCached && i<s-length; i++)
+				m_padCached = (storedNonce[i] == 0);
+		}
+		if (!m_padCached)
+		{
+			std::memset(storedNonce, 0, s-length);
+			std::memcpy(storedNonce+s-length, nonce, length-1);
+			storedNonce[s-1] = nonce[length-1] & 0xfe;
+			AccessCipher().ProcessBlock(storedNonce, m_pad());
+			m_padCached = true;
+		}
+		storedNonce[s-1] = nonce[length-1];
+	}
+	m_isFirstBlock = true;
+	Restart();
+}
+
+void VMAC_Base::HashEndianCorrectedBlock(const word64 *data)
+{
+	CRYPTOPP_UNUSED(data);
+	CRYPTOPP_ASSERT(false);
+	throw NotImplemented("VMAC: HashEndianCorrectedBlock is not implemented");
+}
+
+unsigned int VMAC_Base::OptimalDataAlignment() const
+{
+	return
+#if CRYPTOPP_SSE2_ASM_AVAILABLE || defined(CRYPTOPP_X64_MASM_AVAILABLE)
+		HasSSE2() ? 16 :
+#endif
+		GetCipher().OptimalDataAlignment();
+}
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE && CRYPTOPP_BOOL_X86
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4731)	// frame pointer register 'ebp' modified by inline assembly code
+#endif
+
+CRYPTOPP_NOINLINE
+void VMAC_Base::VHASH_Update_SSE2(const word64 *data, size_t blocksRemainingInWord64, int tagPart)
+{
+	const word64 *nhK = m_nhKey();
+	word64 *polyS = (word64*)(void*)m_polyState();
+	word32 L1KeyLength = m_L1KeyLength;
+
+	// These are used in the ASM, but some analysis services miss it.
+	CRYPTOPP_UNUSED(data); CRYPTOPP_UNUSED(tagPart);
+	CRYPTOPP_UNUSED(L1KeyLength);
+	CRYPTOPP_UNUSED(blocksRemainingInWord64);
+
+	// This inline ASM is tricky, and down right difficult on 32-bit when
+	// PIC is in effect. The ASM uses all the general purpose registers
+	// and all the XMM registers on 32-bit machines. When PIC is in effect
+	// on a 32-bit machine, GCC uses EBX as a base register for PLT. Saving
+	// EBX with 'mov %%ebx, %0' and restoring EBX with 'mov %0, %%ebx'
+	// causes GCC to generate 'mov -0x40(%ebx), %ebx' for the restore. That
+	// obviously won't work because EBX is no longer valid. We can push and
+	// pop EBX, but that breaks the stack-based references. Attempting to
+	// sidestep with clobber lists results in "error: ‘asm’ operand has
+	// impossible constraints". Eventually, we found we could save EBX to
+	// ESP-20, which is one word below our stack in the frame.
+#ifdef __GNUC__
+	__asm__ __volatile__
+	(
+# if CRYPTOPP_BOOL_X86
+	// Hack. Save EBX for PIC. Do NOT 'push EBX' here.
+	// GCC issues 'mov ESP+8, EBX' to load L1KeyLength.
+	// A push breaks the reference to L1KeyLength.
+	AS2(	mov 	%%ebx, -20(%%esp))
+# endif
+	// L1KeyLength into EBX.
+	// GCC generates 'mov ESP+8, EBX'.
+	AS2(	mov 	%0, %%ebx)
+	INTEL_NOPREFIX
+#else
+	#if defined(__INTEL_COMPILER)
+	char isFirstBlock = m_isFirstBlock;
+	AS2(	mov 	ebx, [L1KeyLength])
+	AS2(	mov 	dl, [isFirstBlock])
+	#else
+	AS2(	mov 	ecx, this)
+	AS2(	mov 	ebx, [ecx+m_L1KeyLength])
+	AS2(	mov 	dl, [ecx+m_isFirstBlock])
+	#endif
+	AS2(	mov 	eax, tagPart)
+	AS2(	shl 	eax, 4)
+	AS2(	mov 	edi, nhK)
+	AS2(	add 	edi, eax)
+	AS2(	add 	eax, eax)
+	AS2(	add 	eax, polyS)
+
+	AS2(	mov 	esi, data)
+	AS2(	mov 	ecx, blocksRemainingInWord64)
+#endif
+
+	AS2(	shr 	ebx, 3)
+	AS_PUSH_IF86(	bp)
+	AS2(	sub 	esp, 12)
+	ASL(4)
+	AS2(	mov 	ebp, ebx)
+	AS2(	cmp 	ecx, ebx)
+	AS2(	cmovl	ebp, ecx)
+	AS2(	sub 	ecx, ebp)
+	AS2(	lea 	ebp, [edi+8*ebp])	// end of nhK
+	AS2(	movq	mm6, [esi])
+	AS2(	paddq	mm6, [edi])
+	AS2(	movq	mm5, [esi+8])
+	AS2(	paddq	mm5, [edi+8])
+	AS2(	add 	esi, 16)
+	AS2(	add 	edi, 16)
+	AS2(	movq	mm4, mm6)
+	ASS(	pshufw	mm2, mm6, 1, 0, 3, 2)
+	AS2(	pmuludq	mm6, mm5)
+	ASS(	pshufw	mm3, mm5, 1, 0, 3, 2)
+	AS2(	pmuludq	mm5, mm2)
+	AS2(	pmuludq	mm2, mm3)
+	AS2(	pmuludq	mm3, mm4)
+	AS2(	pxor	mm7, mm7)
+	AS2(	movd	[esp], mm6)
+	AS2(	psrlq	mm6, 32)
+	AS2(	movd	[esp+4], mm5)
+	AS2(	psrlq	mm5, 32)
+	AS2(	cmp 	edi, ebp)
+	ASJ(	je,  	1, f)
+	ASL(0)
+	AS2(	movq	mm0, [esi])
+	AS2(	paddq	mm0, [edi])
+	AS2(	movq	mm1, [esi+8])
+	AS2(	paddq	mm1, [edi+8])
+	AS2(	add 	esi, 16)
+	AS2(	add 	edi, 16)
+	AS2(	movq	mm4, mm0)
+	AS2(	paddq	mm5, mm2)
+	ASS(	pshufw	mm2, mm0, 1, 0, 3, 2)
+	AS2(	pmuludq	mm0, mm1)
+	AS2(	movd	[esp+8], mm3)
+	AS2(	psrlq	mm3, 32)
+	AS2(	paddq	mm5, mm3)
+	ASS(	pshufw	mm3, mm1, 1, 0, 3, 2)
+	AS2(	pmuludq	mm1, mm2)
+	AS2(	pmuludq	mm2, mm3)
+	AS2(	pmuludq	mm3, mm4)
+	AS2(	movd	mm4, [esp])
+	AS2(	paddq	mm7, mm4)
+	AS2(	movd	mm4, [esp+4])
+	AS2(	paddq	mm6, mm4)
+	AS2(	movd	mm4, [esp+8])
+	AS2(	paddq	mm6, mm4)
+	AS2(	movd	[esp], mm0)
+	AS2(	psrlq	mm0, 32)
+	AS2(	paddq	mm6, mm0)
+	AS2(	movd	[esp+4], mm1)
+	AS2(	psrlq	mm1, 32)
+	AS2(	paddq	mm5, mm1)
+	AS2(	cmp 	edi, ebp)
+	ASJ(	jne,	0, b)
+	ASL(1)
+	AS2(	paddq	mm5, mm2)
+	AS2(	movd	[esp+8], mm3)
+	AS2(	psrlq	mm3, 32)
+	AS2(	paddq	mm5, mm3)
+	AS2(	movd	mm4, [esp])
+	AS2(	paddq	mm7, mm4)
+	AS2(	movd	mm4, [esp+4])
+	AS2(	paddq	mm6, mm4)
+	AS2(	movd	mm4, [esp+8])
+	AS2(	paddq	mm6, mm4)
+	AS2(	lea 	ebp, [8*ebx])
+	AS2(	sub 	edi, ebp)		// reset edi to start of nhK
+
+	AS2(	movd	[esp], mm7)
+	AS2(	psrlq	mm7, 32)
+	AS2(	paddq	mm6, mm7)
+	AS2(	movd	[esp+4], mm6)
+	AS2(	psrlq	mm6, 32)
+	AS2(	paddq	mm5, mm6)
+	AS2(	psllq	mm5, 2)
+	AS2(	psrlq	mm5, 2)
+
+#define a0 [eax+2*4]
+#define a1 [eax+3*4]
+#define a2 [eax+0*4]
+#define a3 [eax+1*4]
+#define k0 [eax+2*8+2*4]
+#define k1 [eax+2*8+3*4]
+#define k2 [eax+2*8+0*4]
+#define k3 [eax+2*8+1*4]
+
+	AS2(	test	dl, dl)
+	ASJ(	jz,  	2, f)
+	AS2(	movd	mm1, k0)
+	AS2(	movd	mm0, [esp])
+	AS2(	paddq	mm0, mm1)
+	AS2(	movd	a0, mm0)
+	AS2(	psrlq	mm0, 32)
+	AS2(	movd	mm1, k1)
+	AS2(	movd	mm2, [esp+4])
+	AS2(	paddq	mm1, mm2)
+	AS2(	paddq	mm0, mm1)
+	AS2(	movd	a1, mm0)
+	AS2(	psrlq	mm0, 32)
+	AS2(	paddq	mm5, k2)
+	AS2(	paddq	mm0, mm5)
+	AS2(	movq	a2, mm0)
+	AS2(	xor 	edx, edx)
+	ASJ(	jmp,	3, f)
+	ASL(2)
+	AS2(	movd	mm0, a3)
+	AS2(	movq	mm4, mm0)
+	AS2(	pmuludq	mm0, k3)		// a3*k3
+	AS2(	movd	mm1, a0)
+	AS2(	pmuludq	mm1, k2)		// a0*k2
+	AS2(	movd	mm2, a1)
+	AS2(	movd	mm6, k1)
+	AS2(	pmuludq	mm2, mm6)		// a1*k1
+	AS2(	movd	mm3, a2)
+	AS2(	psllq	mm0, 1)
+	AS2(	paddq	mm0, mm5)
+	AS2(	movq	mm5, mm3)
+	AS2(	movd	mm7, k0)
+	AS2(	pmuludq	mm3, mm7)		// a2*k0
+	AS2(	pmuludq	mm4, mm7)		// a3*k0
+	AS2(	pmuludq	mm5, mm6)		// a2*k1
+	AS2(	paddq	mm0, mm1)
+	AS2(	movd	mm1, a1)
+	AS2(	paddq	mm4, mm5)
+	AS2(	movq	mm5, mm1)
+	AS2(	pmuludq	mm1, k2)		// a1*k2
+	AS2(	paddq	mm0, mm2)
+	AS2(	movd	mm2, a0)
+	AS2(	paddq	mm0, mm3)
+	AS2(	movq	mm3, mm2)
+	AS2(	pmuludq	mm2, k3)		// a0*k3
+	AS2(	pmuludq	mm3, mm7)		// a0*k0
+	AS2(	movd	[esp+8], mm0)
+	AS2(	psrlq	mm0, 32)
+	AS2(	pmuludq	mm7, mm5)		// a1*k0
+	AS2(	pmuludq	mm5, k3)		// a1*k3
+	AS2(	paddq	mm0, mm1)
+	AS2(	movd	mm1, a2)
+	AS2(	pmuludq	mm1, k2)		// a2*k2
+	AS2(	paddq	mm0, mm2)
+	AS2(	paddq	mm0, mm4)
+	AS2(	movq	mm4, mm0)
+	AS2(	movd	mm2, a3)
+	AS2(	pmuludq	mm2, mm6)		// a3*k1
+	AS2(	pmuludq	mm6, a0)		// a0*k1
+	AS2(	psrlq	mm0, 31)
+	AS2(	paddq	mm0, mm3)
+	AS2(	movd	mm3, [esp])
+	AS2(	paddq	mm0, mm3)
+	AS2(	movd	mm3, a2)
+	AS2(	pmuludq	mm3, k3)		// a2*k3
+	AS2(	paddq	mm5, mm1)
+	AS2(	movd	mm1, a3)
+	AS2(	pmuludq	mm1, k2)		// a3*k2
+	AS2(	paddq	mm5, mm2)
+	AS2(	movd	mm2, [esp+4])
+	AS2(	psllq	mm5, 1)
+	AS2(	paddq	mm0, mm5)
+	AS2(	psllq	mm4, 33)
+	AS2(	movd	a0, mm0)
+	AS2(	psrlq	mm0, 32)
+	AS2(	paddq	mm6, mm7)
+	AS2(	movd	mm7, [esp+8])
+	AS2(	paddq	mm0, mm6)
+	AS2(	paddq	mm0, mm2)
+	AS2(	paddq	mm3, mm1)
+	AS2(	psllq	mm3, 1)
+	AS2(	paddq	mm0, mm3)
+	AS2(	psrlq	mm4, 1)
+	AS2(	movd	a1, mm0)
+	AS2(	psrlq	mm0, 32)
+	AS2(	por 	mm4, mm7)
+	AS2(	paddq	mm0, mm4)
+	AS2(	movq	a2, mm0)
+
+#undef a0
+#undef a1
+#undef a2
+#undef a3
+#undef k0
+#undef k1
+#undef k2
+#undef k3
+
+	ASL(3)
+	AS2(	test	ecx, ecx)
+	ASJ(	jnz,	4, b)
+	AS2(	add 	esp, 12)
+	AS_POP_IF86(	bp)
+	AS1(	emms)
+#ifdef __GNUC__
+	ATT_PREFIX
+# if CRYPTOPP_BOOL_X86
+	// Restore EBX for PIC
+	AS2(	mov 	-20(%%esp), %%ebx)
+# endif
+		:
+		: "m" (L1KeyLength), "c" (blocksRemainingInWord64), "S" (data),
+		  "D" (nhK+tagPart*2), "d" (m_isFirstBlock), "a" (polyS+tagPart*4)
+		: "memory", "cc"
+	);
+#endif
+}
+#endif
+
+#if VMAC_BOOL_WORD128
+	#define DeclareNH(a) word128 a=0
+	#define MUL64(rh,rl,i1,i2) {word128 p = word128(i1)*(i2); rh = word64(p>>64); rl = word64(p);}
+	#define AccumulateNH(a, b, c) a += word128(b)*(c)
+	#define Multiply128(r, i1, i2) r = word128(word64(i1)) * word64(i2)
+#else
+	#if CRYPTOPP_MSC_VERSION >= 1400 && !defined(__INTEL_COMPILER) && (defined(_M_IX86) || defined(_M_X64) || defined(_M_IA64))
+		#define MUL32(a, b) __emulu(word32(a), word32(b))
+	#else
+		#define MUL32(a, b) ((word64)((word32)(a)) * (word32)(b))
+	#endif
+	#if defined(CRYPTOPP_X64_ASM_AVAILABLE)
+		#define DeclareNH(a)			word64 a##0=0, a##1=0
+		#define MUL64(rh,rl,i1,i2)		asm ("mulq %3" : "=a"(rl), "=d"(rh) : "a"(i1), "g"(i2) : "cc");
+		#define AccumulateNH(a, b, c)	asm ("mulq %3; addq %%rax, %0; adcq %%rdx, %1" : "+r"(a##0), "+r"(a##1) : "a"(b), "g"(c) : "%rdx", "cc");
+		#define ADD128(rh,rl,ih,il)     asm ("addq %3, %1; adcq %2, %0" : "+r"(rh),"+r"(rl) : "r"(ih),"r"(il) : "cc");
+	#elif defined(CRYPTOPP_MSC_VERSION) && !CRYPTOPP_BOOL_SLOW_WORD64
+		#define DeclareNH(a) word64 a##0=0, a##1=0
+		#define MUL64(rh,rl,i1,i2)   (rl) = _umul128(i1,i2,&(rh));
+		#define AccumulateNH(a, b, c)	{\
+			word64 ph, pl;\
+			pl = _umul128(b,c,&ph);\
+			a##0 += pl;\
+			a##1 += ph + (a##0 < pl);}
+	#else
+		#define VMAC_BOOL_32BIT 1
+		#define DeclareNH(a) word64 a##0=0, a##1=0, a##2=0
+		#define MUL64(rh,rl,i1,i2)                                               \
+			{   word64 _i1 = (i1), _i2 = (i2);                                 \
+				word64 m1= MUL32(_i1,_i2>>32);                                 \
+				word64 m2= MUL32(_i1>>32,_i2);                                 \
+				rh         = MUL32(_i1>>32,_i2>>32);                             \
+				rl         = MUL32(_i1,_i2);                                     \
+				ADD128(rh,rl,(m1 >> 32),(m1 << 32));                             \
+				ADD128(rh,rl,(m2 >> 32),(m2 << 32));                             \
+			}
+		#define AccumulateNH(a, b, c)	{\
+			word64 p = MUL32(b, c);\
+			a##1 += word32((p)>>32);\
+			a##0 += word32(p);\
+			p = MUL32((b)>>32, c);\
+			a##2 += word32((p)>>32);\
+			a##1 += word32(p);\
+			p = MUL32((b)>>32, (c)>>32);\
+			a##2 += p;\
+			p = MUL32(b, (c)>>32);\
+			a##1 += word32(p);\
+			a##2 += word32(p>>32);}
+	#endif
+#endif
+#ifndef VMAC_BOOL_32BIT
+	#define VMAC_BOOL_32BIT 0
+#endif
+#ifndef ADD128
+	#define ADD128(rh,rl,ih,il)                                          \
+		{   word64 _il = (il);                                         \
+			(rl) += (_il);                                               \
+			(rh) += (ih) + ((rl) < (_il));                               \
+		}
+#endif
+
+template <bool T_128BitTag>
+void VMAC_Base::VHASH_Update_Template(const word64 *data, size_t blocksRemainingInWord64)
+{
+	CRYPTOPP_ASSERT(IsAlignedOn(m_polyState(),GetAlignmentOf<word64>()));
+	CRYPTOPP_ASSERT(IsAlignedOn(m_nhKey(),GetAlignmentOf<word64>()));
+
+	#define INNER_LOOP_ITERATION(j)	{\
+		word64 d0 = ConditionalByteReverse(LITTLE_ENDIAN_ORDER, data[i+2*j+0]);\
+		word64 d1 = ConditionalByteReverse(LITTLE_ENDIAN_ORDER, data[i+2*j+1]);\
+		AccumulateNH(nhA, d0+nhK[i+2*j+0], d1+nhK[i+2*j+1]);\
+		if (T_128BitTag)\
+			AccumulateNH(nhB, d0+nhK[i+2*j+2], d1+nhK[i+2*j+3]);\
+		}
+
+	size_t L1KeyLengthInWord64 = m_L1KeyLength / 8;
+	size_t innerLoopEnd = L1KeyLengthInWord64;
+	const word64 *nhK = m_nhKey();
+	word64 *polyS = (word64*)(void*)m_polyState();
+	bool isFirstBlock = true;
+	size_t i;
+
+	#if !VMAC_BOOL_32BIT
+		#if VMAC_BOOL_WORD128
+			word128 a1=0, a2=0;
+		#else
+			word64 ah1=0, al1=0, ah2=0, al2=0;
+		#endif
+		word64 kh1, kl1, kh2, kl2;
+		kh1=(polyS+0*4+2)[0]; kl1=(polyS+0*4+2)[1];
+		if (T_128BitTag)
+		{
+			kh2=(polyS+1*4+2)[0]; kl2=(polyS+1*4+2)[1];
+		}
+	#endif
+
+	do
+	{
+		DeclareNH(nhA);
+		DeclareNH(nhB);
+
+		i = 0;
+		if (blocksRemainingInWord64 < L1KeyLengthInWord64)
+		{
+			if (blocksRemainingInWord64 % 8)
+			{
+				innerLoopEnd = blocksRemainingInWord64 % 8;
+				for (; i<innerLoopEnd; i+=2)
+					INNER_LOOP_ITERATION(0);
+			}
+			innerLoopEnd = blocksRemainingInWord64;
+		}
+		for (; i<innerLoopEnd; i+=8)
+		{
+			INNER_LOOP_ITERATION(0);
+			INNER_LOOP_ITERATION(1);
+			INNER_LOOP_ITERATION(2);
+			INNER_LOOP_ITERATION(3);
+		}
+		blocksRemainingInWord64 -= innerLoopEnd;
+		data += innerLoopEnd;
+
+		#if VMAC_BOOL_32BIT
+			word32 nh0[2],  nh1[2];
+			word64 nh2[2];
+
+			nh0[0] = word32(nhA0);
+			nhA1 += (nhA0 >> 32);
+			nh1[0] = word32(nhA1);
+			nh2[0] = (nhA2 + (nhA1 >> 32)) & m62;
+
+			if (T_128BitTag)
+			{
+				nh0[1] = word32(nhB0);
+				nhB1 += (nhB0 >> 32);
+				nh1[1] = word32(nhB1);
+				nh2[1] = (nhB2 + (nhB1 >> 32)) & m62;
+			}
+
+			#define a0 (((word32 *)(polyS+i*4))[2+NativeByteOrder::ToEnum()])
+			#define a1 (*(((word32 *)(polyS+i*4))+3-NativeByteOrder::ToEnum()))		// workaround for GCC 3.2
+			#define a2 (((word32 *)(polyS+i*4))[0+NativeByteOrder::ToEnum()])
+			#define a3 (*(((word32 *)(polyS+i*4))+1-NativeByteOrder::ToEnum()))
+			#define aHi ((polyS+i*4)[0])
+			#define k0 (((word32 *)(polyS+i*4+2))[2+NativeByteOrder::ToEnum()])
+			#define k1 (*(((word32 *)(polyS+i*4+2))+3-NativeByteOrder::ToEnum()))
+			#define k2 (((word32 *)(polyS+i*4+2))[0+NativeByteOrder::ToEnum()])
+			#define k3 (*(((word32 *)(polyS+i*4+2))+1-NativeByteOrder::ToEnum()))
+			#define kHi ((polyS+i*4+2)[0])
+
+			if (isFirstBlock)
+			{
+				isFirstBlock = false;
+				if (m_isFirstBlock)
+				{
+					m_isFirstBlock = false;
+					for (i=0; i<=(size_t)T_128BitTag; i++)
+					{
+						word64 t = (word64)nh0[i] + k0;
+						a0 = (word32)t;
+						t = (t >> 32) + nh1[i] + k1;
+						a1 = (word32)t;
+						aHi = (t >> 32) + nh2[i] + kHi;
+					}
+					continue;
+				}
+			}
+			for (i=0; i<=(size_t)T_128BitTag; i++)
+			{
+				word64 p, t;
+				word32 t2;
+
+				p = MUL32(a3, 2*k3);
+				p += nh2[i];
+				p += MUL32(a0, k2);
+				p += MUL32(a1, k1);
+				p += MUL32(a2, k0);
+				t2 = (word32)p;
+				p >>= 32;
+				p += MUL32(a0, k3);
+				p += MUL32(a1, k2);
+				p += MUL32(a2, k1);
+				p += MUL32(a3, k0);
+				t = (word64(word32(p) & 0x7fffffff) << 32) | t2;
+				p >>= 31;
+				p += nh0[i];
+				p += MUL32(a0, k0);
+				p += MUL32(a1, 2*k3);
+				p += MUL32(a2, 2*k2);
+				p += MUL32(a3, 2*k1);
+				t2 = (word32)p;
+				p >>= 32;
+				p += nh1[i];
+				p += MUL32(a0, k1);
+				p += MUL32(a1, k0);
+				p += MUL32(a2, 2*k3);
+				p += MUL32(a3, 2*k2);
+				a0 = t2;
+				a1 = (word32)p;
+				aHi = (p >> 32) + t;
+			}
+
+			#undef a0
+			#undef a1
+			#undef a2
+			#undef a3
+			#undef aHi
+			#undef k0
+			#undef k1
+			#undef k2
+			#undef k3
+			#undef kHi
+		#else		// #if VMAC_BOOL_32BIT
+			if (isFirstBlock)
+			{
+				isFirstBlock = false;
+				if (m_isFirstBlock)
+				{
+					m_isFirstBlock = false;
+					#if VMAC_BOOL_WORD128
+						#define first_poly_step(a, kh, kl, m)	a = (m & m126) + ((word128(kh) << 64) | kl)
+
+						first_poly_step(a1, kh1, kl1, nhA);
+						if (T_128BitTag)
+							first_poly_step(a2, kh2, kl2, nhB);
+					#else
+						#define first_poly_step(ah, al, kh, kl, mh, ml)		{\
+							mh &= m62;\
+							ADD128(mh, ml, kh, kl);	\
+							ah = mh; al = ml;}
+
+						first_poly_step(ah1, al1, kh1, kl1, nhA1, nhA0);
+						if (T_128BitTag)
+							first_poly_step(ah2, al2, kh2, kl2, nhB1, nhB0);
+					#endif
+					continue;
+				}
+				else
+				{
+					#if VMAC_BOOL_WORD128
+						a1 = (word128((polyS+0*4)[0]) << 64) | (polyS+0*4)[1];
+					#else
+						ah1=(polyS+0*4)[0]; al1=(polyS+0*4)[1];
+					#endif
+					if (T_128BitTag)
+					{
+						#if VMAC_BOOL_WORD128
+							a2 = (word128((polyS+1*4)[0]) << 64) | (polyS+1*4)[1];
+						#else
+							ah2=(polyS+1*4)[0]; al2=(polyS+1*4)[1];
+						#endif
+					}
+				}
+			}
+
+			#if VMAC_BOOL_WORD128
+				#define poly_step(a, kh, kl, m)	\
+				{   word128 t1, t2, t3, t4;\
+					Multiply128(t2, a>>64, kl);\
+					Multiply128(t3, a, kh);\
+					Multiply128(t1, a, kl);\
+					Multiply128(t4, a>>64, 2*kh);\
+					t2 += t3;\
+					t4 += t1;\
+					t2 += t4>>64;\
+					a = (word128(word64(t2)&m63) << 64) | word64(t4);\
+					t2 *= 2;\
+					a += m & m126;\
+					a += t2>>64;}
+
+				poly_step(a1, kh1, kl1, nhA);
+				if (T_128BitTag)
+					poly_step(a2, kh2, kl2, nhB);
+			#else
+				#define poly_step(ah, al, kh, kl, mh, ml)					\
+				{   word64 t1h, t1l, t2h, t2l, t3h, t3l, z=0;				\
+					/* compute ab*cd, put bd into result registers */       \
+					MUL64(t2h,t2l,ah,kl);                                   \
+					MUL64(t3h,t3l,al,kh);                                   \
+					MUL64(t1h,t1l,ah,2*kh);                                 \
+					MUL64(ah,al,al,kl);                                     \
+					/* add together ad + bc */                              \
+					ADD128(t2h,t2l,t3h,t3l);                                \
+					/* add 2 * ac to result */                              \
+					ADD128(ah,al,t1h,t1l);                                  \
+					/* now (ah,al), (t2l,2*t2h) need summing */             \
+					/* first add the high registers, carrying into t2h */   \
+					ADD128(t2h,ah,z,t2l);                                   \
+					/* double t2h and add top bit of ah */                  \
+					t2h += t2h + (ah >> 63);                                \
+					ah &= m63;                                              \
+					/* now add the low registers */                         \
+					mh &= m62;												\
+					ADD128(ah,al,mh,ml);                                    \
+					ADD128(ah,al,z,t2h);                                    \
+				}
+
+				poly_step(ah1, al1, kh1, kl1, nhA1, nhA0);
+				if (T_128BitTag)
+					poly_step(ah2, al2, kh2, kl2, nhB1, nhB0);
+			#endif
+		#endif		// #if VMAC_BOOL_32BIT
+	} while (blocksRemainingInWord64);
+
+	#if VMAC_BOOL_WORD128
+		(polyS+0*4)[0]=word64(a1>>64); (polyS+0*4)[1]=word64(a1);
+		if (T_128BitTag)
+		{
+			(polyS+1*4)[0]=word64(a2>>64); (polyS+1*4)[1]=word64(a2);
+		}
+	#elif !VMAC_BOOL_32BIT
+		(polyS+0*4)[0]=ah1; (polyS+0*4)[1]=al1;
+		if (T_128BitTag)
+		{
+			(polyS+1*4)[0]=ah2; (polyS+1*4)[1]=al2;
+		}
+	#endif
+}
+
+inline void VMAC_Base::VHASH_Update(const word64 *data, size_t blocksRemainingInWord64)
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE && CRYPTOPP_BOOL_X86
+	if (HasSSE2())
+	{
+		VHASH_Update_SSE2(data, blocksRemainingInWord64, 0);
+		if (m_is128)
+			VHASH_Update_SSE2(data, blocksRemainingInWord64, 1);
+		m_isFirstBlock = false;
+	}
+	else
+#endif
+	{
+		if (m_is128)
+			VHASH_Update_Template<true>(data, blocksRemainingInWord64);
+		else
+			VHASH_Update_Template<false>(data, blocksRemainingInWord64);
+	}
+}
+
+size_t VMAC_Base::HashMultipleBlocks(const word64 *data, size_t length)
+{
+	size_t remaining = ModPowerOf2(length, m_L1KeyLength);
+	VHASH_Update(data, (length-remaining)/8);
+	return remaining;
+}
+
+word64 L3Hash(const word64 *input, const word64 *l3Key, size_t len)
+{
+    word64 rh, rl, t, z=0;
+	word64 p1 = input[0], p2 = input[1];
+	word64 k1 = l3Key[0], k2 = l3Key[1];
+
+    /* fully reduce (p1,p2)+(len,0) mod p127 */
+    t = p1 >> 63;
+    p1 &= m63;
+    ADD128(p1, p2, len, t);
+    /* At this point, (p1,p2) is at most 2^127+(len<<64) */
+    t = (p1 > m63) + ((p1 == m63) & (p2 == m64));
+    ADD128(p1, p2, z, t);
+    p1 &= m63;
+
+    /* compute (p1,p2)/(2^64-2^32) and (p1,p2)%(2^64-2^32) */
+    t = p1 + (p2 >> 32);
+    t += (t >> 32);
+    t += (word32)t > 0xfffffffeU;
+    p1 += (t >> 32);
+    p2 += (p1 << 32);
+
+    /* compute (p1+k1)%p64 and (p2+k2)%p64 */
+    p1 += k1;
+    p1 += (0 - (p1 < k1)) & 257;
+    p2 += k2;
+    p2 += (0 - (p2 < k2)) & 257;
+
+    /* compute (p1+k1)*(p2+k2)%p64 */
+    MUL64(rh, rl, p1, p2);
+    t = rh >> 56;
+    ADD128(t, rl, z, rh);
+    rh <<= 8;
+    ADD128(t, rl, z, rh);
+    t += t << 8;
+    rl += t;
+    rl += (0 - (rl < t)) & 257;
+    rl += (0 - (rl > p64-1)) & 257;
+    return rl;
+}
+
+void VMAC_Base::TruncatedFinal(byte *mac, size_t size)
+{
+	CRYPTOPP_ASSERT(IsAlignedOn(DataBuf(),GetAlignmentOf<word64>()));
+	CRYPTOPP_ASSERT(IsAlignedOn(m_polyState(),GetAlignmentOf<word64>()));
+	size_t len = ModPowerOf2(GetBitCountLo()/8, m_L1KeyLength);
+
+	if (len)
+	{
+		std::memset(m_data()+len, 0, (0-len)%16);
+		VHASH_Update(DataBuf(), ((len+15)/16)*2);
+		len *= 8;	// convert to bits
+	}
+	else if (m_isFirstBlock)
+	{
+		// special case for empty string
+		m_polyState()[0] = m_polyState()[2];
+		m_polyState()[1] = m_polyState()[3];
+		if (m_is128)
+		{
+			m_polyState()[4] = m_polyState()[6];
+			m_polyState()[5] = m_polyState()[7];
+		}
+	}
+
+	if (m_is128)
+	{
+		word64 t[2];
+		t[0] = L3Hash(m_polyState(), m_l3Key(), len) + GetWord<word64>(true, BIG_ENDIAN_ORDER, m_pad());
+		t[1] = L3Hash(m_polyState()+4, m_l3Key()+2, len) + GetWord<word64>(true, BIG_ENDIAN_ORDER, m_pad()+8);
+		if (size == 16)
+		{
+			PutWord(false, BIG_ENDIAN_ORDER, mac, t[0]);
+			PutWord(false, BIG_ENDIAN_ORDER, mac+8, t[1]);
+		}
+		else
+		{
+			t[0] = ConditionalByteReverse(BIG_ENDIAN_ORDER, t[0]);
+			t[1] = ConditionalByteReverse(BIG_ENDIAN_ORDER, t[1]);
+			std::memcpy(mac, t, size);
+		}
+	}
+	else
+	{
+		word64 t = L3Hash(m_polyState(), m_l3Key(), len);
+		t += GetWord<word64>(true, BIG_ENDIAN_ORDER, m_pad() + (m_nonce()[IVSize()-1]&1) * 8);
+		if (size == 8)
+			PutWord(false, BIG_ENDIAN_ORDER, mac, t);
+		else
+		{
+			t = ConditionalByteReverse(BIG_ENDIAN_ORDER, t);
+			std::memcpy(mac, &t, size);
+		}
+	}
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/vmac.h b/runtime/third_party/cryptopp/vmac.h
new file mode 100644
index 0000000..2da1c7f
--- /dev/null
+++ b/runtime/third_party/cryptopp/vmac.h
@@ -0,0 +1,91 @@
+// vmac.h - originally written and placed in the public domain by Wei Dai
+
+/// \file vmac.h
+/// \brief Classes for the VMAC message authentication code
+/// \since Crypto++ 5.5
+
+#ifndef CRYPTOPP_VMAC_H
+#define CRYPTOPP_VMAC_H
+
+#include "cryptlib.h"
+#include "iterhash.h"
+#include "seckey.h"
+
+// Clang 3.3 integrated assembler crash on Linux. Clang 3.4 due to compiler
+// error with .intel_syntax, http://llvm.org/bugs/show_bug.cgi?id=24232
+#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+# define CRYPTOPP_DISABLE_VMAC_ASM 1
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief VMAC message authentication code base class
+/// \since Crypto++ 5.5
+class VMAC_Base : public IteratedHashBase<word64, MessageAuthenticationCode>
+{
+public:
+	std::string AlgorithmName() const {return std::string("VMAC(") + GetCipher().AlgorithmName() + ")-" + IntToString(DigestSize()*8);}
+	std::string AlgorithmProvider() const {return GetCipher().AlgorithmProvider();}
+	unsigned int IVSize() const {return GetCipher().BlockSize();}
+	unsigned int MinIVLength() const {return 1;}
+	void Resynchronize(const byte *nonce, int length=-1);
+	void GetNextIV(RandomNumberGenerator &rng, byte *IV);
+	unsigned int DigestSize() const {return m_is128 ? 16 : 8;};
+	void UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &params);
+	void TruncatedFinal(byte *mac, size_t size);
+	unsigned int BlockSize() const {return m_L1KeyLength;}
+	ByteOrder GetByteOrder() const {return LITTLE_ENDIAN_ORDER;}
+	unsigned int OptimalDataAlignment() const;
+
+protected:
+	virtual BlockCipher & AccessCipher() =0;
+	virtual int DefaultDigestSize() const =0;
+	const BlockCipher & GetCipher() const {return const_cast<VMAC_Base *>(this)->AccessCipher();}
+	void HashEndianCorrectedBlock(const word64 *data);
+	size_t HashMultipleBlocks(const word64 *input, size_t length);
+	void Init() {}
+	word64* StateBuf() {return NULLPTR;}
+	word64* DataBuf() {return (word64 *)(void*)m_data();}
+
+	void VHASH_Update_SSE2(const word64 *data, size_t blocksRemainingInWord64, int tagPart);
+	template <bool T_128BitTag>
+		void VHASH_Update_Template(const word64 *data, size_t blockRemainingInWord128);
+	void VHASH_Update(const word64 *data, size_t blocksRemainingInWord128);
+
+	CRYPTOPP_BLOCK_1(polyState, word64, (m_is128 ? 8 : 4))
+	CRYPTOPP_BLOCK_2(nhKey, word64, m_L1KeyLength/sizeof(word64) + 2*m_is128)
+	CRYPTOPP_BLOCK_3(data, byte, m_L1KeyLength)
+	CRYPTOPP_BLOCK_4(l3Key, word64, (m_is128 ? 4 : 2))
+	CRYPTOPP_BLOCK_5(nonce, byte, IVSize())
+	CRYPTOPP_BLOCK_6(pad, byte, IVSize())
+	CRYPTOPP_BLOCKS_END(6)
+
+	bool m_is128, m_padCached, m_isFirstBlock;
+	unsigned int m_L1KeyLength;
+};
+
+/// \brief VMAC message authentication code
+/// \tparam T_BlockCipher block cipher
+/// \tparam T_DigestBitSize digest size, in bits
+/// \details VMAC is a block cipher-based message authentication code algorithm
+///  using a universal hash proposed by Ted Krovetz and Wei Dai in April 2007. The
+///  algorithm was designed for high performance backed by a formal analysis.
+/// \details The implementation is based on Ted Krovetz's public domain vmac.c
+///  and <a href="http://tools.ietf.org/html/draft-krovetz-vmac-01">draft-krovetz-vmac-01.txt</a>.
+/// \sa <a href="http://www.cryptolounge.org/wiki/VMAC">VMAC</a>.
+/// \since Crypto++ 5.5
+template <class T_BlockCipher, int T_DigestBitSize = 128>
+class VMAC : public SimpleKeyingInterfaceImpl<VMAC_Base, SameKeyLengthAs<T_BlockCipher, SimpleKeyingInterface::UNIQUE_IV, T_BlockCipher::BLOCKSIZE> >
+{
+public:
+	static std::string StaticAlgorithmName() {return std::string("VMAC(") + T_BlockCipher::StaticAlgorithmName() + ")-" + IntToString(T_DigestBitSize);}
+
+private:
+	BlockCipher & AccessCipher() {return m_cipher;}
+	int DefaultDigestSize() const {return T_DigestBitSize/8;}
+	typename T_BlockCipher::Encryption m_cipher;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/wake.cpp b/runtime/third_party/cryptopp/wake.cpp
new file mode 100644
index 0000000..cab45c6
--- /dev/null
+++ b/runtime/third_party/cryptopp/wake.cpp
@@ -0,0 +1,111 @@
+// wake.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#include "wake.h"
+#include "smartptr.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+const unsigned int TT[8]= {
+	0x726a8f3b,	0xe69a3b5c, 0xd3c71fe5, 0xab3c73d2,
+	0x4d3a8eb3, 0x0396d6e8, 0x3d4c2f7a, 0x9ee27cf3
+} ;
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void WAKE_TestInstantiations()
+{
+	WAKE_OFB<>::Encryption x2;
+	WAKE_OFB<>::Decryption x4;
+}
+#endif
+
+inline word32 WAKE_Base::M(word32 x, word32 y)
+{
+	word32 w = x+y;
+	return (w>>8) ^ t[w & 0xff];
+}
+
+void WAKE_Base::GenKey(word32 k0, word32 k1, word32 k2, word32 k3)
+{
+	// this code is mostly copied from David Wheeler's paper "A Bulk Data Encryption Algorithm"
+	signed int x, z, p;
+
+	t[0] = k0;
+	t[1] = k1;
+	t[2] = k2;
+	t[3] = k3;
+	for (p=4 ; p<256 ; p++)
+	{
+	  x=t[p-4]+t[p-1] ; 					   // fill t
+	  t[p]= (x>>3) ^ TT[x&7] ;
+	}
+
+	for (p=0 ; p<23 ; p++)
+		t[p]+=t[p+89] ; 		  // mix first entries
+	x=t[33] ; z=t[59] | 0x01000001 ;
+	z=z&0xff7fffff ;
+	for (p=0 ; p<256 ; p++) {		//change top byte to
+	  x=(x&0xff7fffff)+z ; 		 // a permutation etc
+	  t[p]=(t[p] & 0x00ffffff) ^ x ; }
+
+	t[256]=t[0] ;
+	byte y=byte(x);
+	for (p=0 ; p<256 ; p++) {	  // further change perm.
+	  t[p]=t[y=byte(t[p^y]^y)] ;  // and other digits
+	  t[y]=t[p+1] ;  }
+}
+
+template <class B>
+void WAKE_Policy<B>::CipherSetKey(const NameValuePairs &params, const byte *key, size_t length)
+{
+	CRYPTOPP_UNUSED(params); CRYPTOPP_UNUSED(key); CRYPTOPP_UNUSED(length);
+	word32 k0, k1, k2, k3;
+	BlockGetAndPut<word32, BigEndian>::Get(key)(r3)(r4)(r5)(r6)(k0)(k1)(k2)(k3);
+	GenKey(k0, k1, k2, k3);
+}
+
+// OFB
+template <class B>
+void WAKE_Policy<B>::OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount)
+{
+#define WAKE_OUTPUT(x)\
+	while (iterationCount--)\
+	{\
+		CRYPTOPP_KEYSTREAM_OUTPUT_WORD(x, B::ToEnum(), 0, r6);\
+		r3 = M(r3, r6);\
+		r4 = M(r4, r3);\
+		r5 = M(r5, r4);\
+		r6 = M(r6, r5);\
+		output += 4;\
+		if (!(x & INPUT_NULL))\
+			input += 4;\
+	}
+
+	typedef word32 WordType;
+	CRYPTOPP_KEYSTREAM_OUTPUT_SWITCH(WAKE_OUTPUT, 0);
+}
+/*
+template <class B>
+void WAKE_ROFB_Policy<B>::Iterate(KeystreamOperation operation, byte *output, const byte *input, unsigned int iterationCount)
+{
+	KeystreamOutput<B> keystreamOperation(operation, output, input);
+
+	while (iterationCount--)
+	{
+		keystreamOperation(r6);
+		r3 = M(r3, r6);
+		r4 = M(r4, r3);
+		r5 = M(r5, r4);
+		r6 = M(r6, r5);
+	}
+}
+*/
+template class WAKE_Policy<BigEndian>;
+template class WAKE_Policy<LittleEndian>;
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/wake.h b/runtime/third_party/cryptopp/wake.h
new file mode 100644
index 0000000..616cbf1
--- /dev/null
+++ b/runtime/third_party/cryptopp/wake.h
@@ -0,0 +1,59 @@
+// wake.h - originally written and placed in the public domain by Wei Dai
+
+/// \file wake.h
+/// \brief Classes for WAKE stream cipher
+
+#ifndef CRYPTOPP_WAKE_H
+#define CRYPTOPP_WAKE_H
+
+#include "seckey.h"
+#include "secblock.h"
+#include "strciphr.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief WAKE stream cipher information
+/// \tparam B Endianness of the stream cipher
+/// \since Crypto++ 1.0
+template <class B = BigEndian>
+struct WAKE_OFB_Info : public FixedKeyLength<32>
+{
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return B::ToEnum() == LITTLE_ENDIAN_ORDER ? "WAKE-OFB-LE" : "WAKE-OFB-BE";}
+};
+
+class CRYPTOPP_NO_VTABLE WAKE_Base
+{
+protected:
+	word32 M(word32 x, word32 y);
+	void GenKey(word32 k0, word32 k1, word32 k2, word32 k3);
+
+	word32 t[257];
+	word32 r3, r4, r5, r6;
+};
+
+/// \brief WAKE stream cipher operation
+/// \tparam B Endianness of the stream cipher
+/// \since Crypto++ 1.0
+template <class B = BigEndian>
+class CRYPTOPP_NO_VTABLE WAKE_Policy : public AdditiveCipherConcretePolicy<word32, 1, 64>, protected WAKE_Base
+{
+protected:
+	void CipherSetKey(const NameValuePairs &params, const byte *key, size_t length);
+	// OFB
+	void OperateKeystream(KeystreamOperation operation, byte *output, const byte *input, size_t iterationCount);
+	bool CipherIsRandomAccess() const {return false;}
+};
+
+/// \brief WAKE stream cipher
+/// \tparam B Endianness of the stream cipher
+/// \since Crypto++ 1.0
+template <class B = BigEndian>
+struct WAKE_OFB : public WAKE_OFB_Info<B>, public SymmetricCipherDocumentation
+{
+	typedef SymmetricCipherFinal<ConcretePolicyHolder<WAKE_Policy<B>, AdditiveCipherTemplate<> >,  WAKE_OFB_Info<B> > Encryption;
+	typedef Encryption Decryption;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/whrlpool.cpp b/runtime/third_party/cryptopp/whrlpool.cpp
new file mode 100644
index 0000000..c572759
--- /dev/null
+++ b/runtime/third_party/cryptopp/whrlpool.cpp
@@ -0,0 +1,730 @@
+// whrlpool.cpp - originally modified by Kevin Springle from Paulo Barreto and Vincent Rijmen's
+//                public domain code, whirlpool.c. Updated to Whirlpool version 3.0, optimized
+//                and SSE version added by WD. All modifications are placed in the public domain.
+//
+// This is the original introductory comment:
+
+/**
+ * The Whirlpool hashing function.
+ *
+ * <P>
+ * <b>References</b>
+ *
+ * <P>
+ * The Whirlpool algorithm was developed by
+ * <a href="mailto:pbarreto@scopus.com.br">Paulo S. L. M. Barreto</a> and
+ * <a href="mailto:vincent.rijmen@cryptomathic.com">Vincent Rijmen</a>.
+ *
+ * See
+ *      P.S.L.M. Barreto, V. Rijmen,
+ *      ``The Whirlpool hashing function,''
+ *      NESSIE submission, 2000 (tweaked version, 2001),
+ *      <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>
+ *
+ * @author  Paulo S.L.M. Barreto
+ * @author  Vincent Rijmen.
+ *
+ * @version 3.0 (2003.03.12)
+ *
+ * =============================================================================
+ *
+ * Differences from version 2.1:
+ *
+ * - Suboptimal diffusion matrix replaced by cir(1, 1, 4, 1, 8, 5, 2, 9).
+ *
+ * =============================================================================
+ *
+ * Differences from version 2.0:
+ *
+ * - Generation of ISO/IEC 10118-3 test vectors.
+ * - Bug fix: nonzero carry was ignored when tallying the data length
+ *      (this bug apparently only manifested itself when feeding data
+ *      in pieces rather than in a single chunk at once).
+ * - Support for MS Visual C++ 64-bit integer arithmetic.
+ *
+ * Differences from version 1.0:
+ *
+ * - Original S-box replaced by the tweaked, hardware-efficient version.
+ *
+ * =============================================================================
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
+ * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+ * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "pch.h"
+#include "config.h"
+
+#if CRYPTOPP_MSC_VERSION
+# pragma warning(disable: 4127)
+#endif
+
+#include "whrlpool.h"
+#include "misc.h"
+#include "cpu.h"
+
+#if defined(CRYPTOPP_DISABLE_WHIRLPOOL_ASM)
+# undef CRYPTOPP_X86_ASM_AVAILABLE
+# undef CRYPTOPP_X32_ASM_AVAILABLE
+# undef CRYPTOPP_X64_ASM_AVAILABLE
+# undef CRYPTOPP_SSE2_ASM_AVAILABLE
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+void Whirlpool_TestInstantiations()
+{
+	Whirlpool x;
+}
+#endif
+
+std::string Whirlpool::AlgorithmProvider() const
+{
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+	if (HasSSE2())
+		return "SSE2";
+#endif
+	return "C++";
+}
+
+void Whirlpool::InitState(HashWordType *state)
+{
+	std::memset(state, 0, 8*sizeof(state[0]));
+}
+
+void Whirlpool::TruncatedFinal(byte *hash, size_t size)
+{
+	CRYPTOPP_ASSERT(hash != NULLPTR);
+	ThrowIfInvalidTruncatedSize(size);
+
+	PadLastBlock(32);
+	CorrectEndianess(m_data, m_data, 32);
+
+	m_data[m_data.size()-4] = 0;
+	m_data[m_data.size()-3] = 0;
+	m_data[m_data.size()-2] = GetBitCountHi();
+	m_data[m_data.size()-1] = GetBitCountLo();
+
+	Transform(m_state, m_data);
+	CorrectEndianess(m_state, m_state, DigestSize());
+	std::memcpy(hash, m_state, size);
+
+	Restart();		// reinit for next use
+}
+
+/*
+ * The number of rounds of the internal dedicated block cipher.
+ */
+#define R 10
+
+/*
+ * Though Whirlpool is endianness-neutral, the encryption tables are listed
+ * in BIG-ENDIAN format, which is adopted throughout this implementation
+ * (but little-endian notation would be equally suitable if consistently
+ * employed).
+ */
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+CRYPTOPP_ALIGN_DATA(16)
+CRYPTOPP_TABLE
+const word64 Whirlpool_C[4*256+R] = {
+#else
+const word64 Whirlpool_C[4*256+R] = {
+#endif
+    W64LIT(0x18186018c07830d8), W64LIT(0x23238c2305af4626), W64LIT(0xc6c63fc67ef991b8), W64LIT(0xe8e887e8136fcdfb),
+    W64LIT(0x878726874ca113cb), W64LIT(0xb8b8dab8a9626d11), W64LIT(0x0101040108050209), W64LIT(0x4f4f214f426e9e0d),
+    W64LIT(0x3636d836adee6c9b), W64LIT(0xa6a6a2a6590451ff), W64LIT(0xd2d26fd2debdb90c), W64LIT(0xf5f5f3f5fb06f70e),
+    W64LIT(0x7979f979ef80f296), W64LIT(0x6f6fa16f5fcede30), W64LIT(0x91917e91fcef3f6d), W64LIT(0x52525552aa07a4f8),
+    W64LIT(0x60609d6027fdc047), W64LIT(0xbcbccabc89766535), W64LIT(0x9b9b569baccd2b37), W64LIT(0x8e8e028e048c018a),
+    W64LIT(0xa3a3b6a371155bd2), W64LIT(0x0c0c300c603c186c), W64LIT(0x7b7bf17bff8af684), W64LIT(0x3535d435b5e16a80),
+    W64LIT(0x1d1d741de8693af5), W64LIT(0xe0e0a7e05347ddb3), W64LIT(0xd7d77bd7f6acb321), W64LIT(0xc2c22fc25eed999c),
+    W64LIT(0x2e2eb82e6d965c43), W64LIT(0x4b4b314b627a9629), W64LIT(0xfefedffea321e15d), W64LIT(0x575741578216aed5),
+    W64LIT(0x15155415a8412abd), W64LIT(0x7777c1779fb6eee8), W64LIT(0x3737dc37a5eb6e92), W64LIT(0xe5e5b3e57b56d79e),
+    W64LIT(0x9f9f469f8cd92313), W64LIT(0xf0f0e7f0d317fd23), W64LIT(0x4a4a354a6a7f9420), W64LIT(0xdada4fda9e95a944),
+    W64LIT(0x58587d58fa25b0a2), W64LIT(0xc9c903c906ca8fcf), W64LIT(0x2929a429558d527c), W64LIT(0x0a0a280a5022145a),
+    W64LIT(0xb1b1feb1e14f7f50), W64LIT(0xa0a0baa0691a5dc9), W64LIT(0x6b6bb16b7fdad614), W64LIT(0x85852e855cab17d9),
+    W64LIT(0xbdbdcebd8173673c), W64LIT(0x5d5d695dd234ba8f), W64LIT(0x1010401080502090), W64LIT(0xf4f4f7f4f303f507),
+    W64LIT(0xcbcb0bcb16c08bdd), W64LIT(0x3e3ef83eedc67cd3), W64LIT(0x0505140528110a2d), W64LIT(0x676781671fe6ce78),
+    W64LIT(0xe4e4b7e47353d597), W64LIT(0x27279c2725bb4e02), W64LIT(0x4141194132588273), W64LIT(0x8b8b168b2c9d0ba7),
+    W64LIT(0xa7a7a6a7510153f6), W64LIT(0x7d7de97dcf94fab2), W64LIT(0x95956e95dcfb3749), W64LIT(0xd8d847d88e9fad56),
+    W64LIT(0xfbfbcbfb8b30eb70), W64LIT(0xeeee9fee2371c1cd), W64LIT(0x7c7ced7cc791f8bb), W64LIT(0x6666856617e3cc71),
+    W64LIT(0xdddd53dda68ea77b), W64LIT(0x17175c17b84b2eaf), W64LIT(0x4747014702468e45), W64LIT(0x9e9e429e84dc211a),
+    W64LIT(0xcaca0fca1ec589d4), W64LIT(0x2d2db42d75995a58), W64LIT(0xbfbfc6bf9179632e), W64LIT(0x07071c07381b0e3f),
+    W64LIT(0xadad8ead012347ac), W64LIT(0x5a5a755aea2fb4b0), W64LIT(0x838336836cb51bef), W64LIT(0x3333cc3385ff66b6),
+    W64LIT(0x636391633ff2c65c), W64LIT(0x02020802100a0412), W64LIT(0xaaaa92aa39384993), W64LIT(0x7171d971afa8e2de),
+    W64LIT(0xc8c807c80ecf8dc6), W64LIT(0x19196419c87d32d1), W64LIT(0x494939497270923b), W64LIT(0xd9d943d9869aaf5f),
+    W64LIT(0xf2f2eff2c31df931), W64LIT(0xe3e3abe34b48dba8), W64LIT(0x5b5b715be22ab6b9), W64LIT(0x88881a8834920dbc),
+    W64LIT(0x9a9a529aa4c8293e), W64LIT(0x262698262dbe4c0b), W64LIT(0x3232c8328dfa64bf), W64LIT(0xb0b0fab0e94a7d59),
+    W64LIT(0xe9e983e91b6acff2), W64LIT(0x0f0f3c0f78331e77), W64LIT(0xd5d573d5e6a6b733), W64LIT(0x80803a8074ba1df4),
+    W64LIT(0xbebec2be997c6127), W64LIT(0xcdcd13cd26de87eb), W64LIT(0x3434d034bde46889), W64LIT(0x48483d487a759032),
+    W64LIT(0xffffdbffab24e354), W64LIT(0x7a7af57af78ff48d), W64LIT(0x90907a90f4ea3d64), W64LIT(0x5f5f615fc23ebe9d),
+    W64LIT(0x202080201da0403d), W64LIT(0x6868bd6867d5d00f), W64LIT(0x1a1a681ad07234ca), W64LIT(0xaeae82ae192c41b7),
+    W64LIT(0xb4b4eab4c95e757d), W64LIT(0x54544d549a19a8ce), W64LIT(0x93937693ece53b7f), W64LIT(0x222288220daa442f),
+    W64LIT(0x64648d6407e9c863), W64LIT(0xf1f1e3f1db12ff2a), W64LIT(0x7373d173bfa2e6cc), W64LIT(0x12124812905a2482),
+    W64LIT(0x40401d403a5d807a), W64LIT(0x0808200840281048), W64LIT(0xc3c32bc356e89b95), W64LIT(0xecec97ec337bc5df),
+    W64LIT(0xdbdb4bdb9690ab4d), W64LIT(0xa1a1bea1611f5fc0), W64LIT(0x8d8d0e8d1c830791), W64LIT(0x3d3df43df5c97ac8),
+    W64LIT(0x97976697ccf1335b), W64LIT(0x0000000000000000), W64LIT(0xcfcf1bcf36d483f9), W64LIT(0x2b2bac2b4587566e),
+    W64LIT(0x7676c57697b3ece1), W64LIT(0x8282328264b019e6), W64LIT(0xd6d67fd6fea9b128), W64LIT(0x1b1b6c1bd87736c3),
+    W64LIT(0xb5b5eeb5c15b7774), W64LIT(0xafaf86af112943be), W64LIT(0x6a6ab56a77dfd41d), W64LIT(0x50505d50ba0da0ea),
+    W64LIT(0x45450945124c8a57), W64LIT(0xf3f3ebf3cb18fb38), W64LIT(0x3030c0309df060ad), W64LIT(0xefef9bef2b74c3c4),
+    W64LIT(0x3f3ffc3fe5c37eda), W64LIT(0x55554955921caac7), W64LIT(0xa2a2b2a2791059db), W64LIT(0xeaea8fea0365c9e9),
+    W64LIT(0x656589650fecca6a), W64LIT(0xbabad2bab9686903), W64LIT(0x2f2fbc2f65935e4a), W64LIT(0xc0c027c04ee79d8e),
+    W64LIT(0xdede5fdebe81a160), W64LIT(0x1c1c701ce06c38fc), W64LIT(0xfdfdd3fdbb2ee746), W64LIT(0x4d4d294d52649a1f),
+    W64LIT(0x92927292e4e03976), W64LIT(0x7575c9758fbceafa), W64LIT(0x06061806301e0c36), W64LIT(0x8a8a128a249809ae),
+    W64LIT(0xb2b2f2b2f940794b), W64LIT(0xe6e6bfe66359d185), W64LIT(0x0e0e380e70361c7e), W64LIT(0x1f1f7c1ff8633ee7),
+    W64LIT(0x6262956237f7c455), W64LIT(0xd4d477d4eea3b53a), W64LIT(0xa8a89aa829324d81), W64LIT(0x96966296c4f43152),
+    W64LIT(0xf9f9c3f99b3aef62), W64LIT(0xc5c533c566f697a3), W64LIT(0x2525942535b14a10), W64LIT(0x59597959f220b2ab),
+    W64LIT(0x84842a8454ae15d0), W64LIT(0x7272d572b7a7e4c5), W64LIT(0x3939e439d5dd72ec), W64LIT(0x4c4c2d4c5a619816),
+    W64LIT(0x5e5e655eca3bbc94), W64LIT(0x7878fd78e785f09f), W64LIT(0x3838e038ddd870e5), W64LIT(0x8c8c0a8c14860598),
+    W64LIT(0xd1d163d1c6b2bf17), W64LIT(0xa5a5aea5410b57e4), W64LIT(0xe2e2afe2434dd9a1), W64LIT(0x616199612ff8c24e),
+    W64LIT(0xb3b3f6b3f1457b42), W64LIT(0x2121842115a54234), W64LIT(0x9c9c4a9c94d62508), W64LIT(0x1e1e781ef0663cee),
+    W64LIT(0x4343114322528661), W64LIT(0xc7c73bc776fc93b1), W64LIT(0xfcfcd7fcb32be54f), W64LIT(0x0404100420140824),
+    W64LIT(0x51515951b208a2e3), W64LIT(0x99995e99bcc72f25), W64LIT(0x6d6da96d4fc4da22), W64LIT(0x0d0d340d68391a65),
+    W64LIT(0xfafacffa8335e979), W64LIT(0xdfdf5bdfb684a369), W64LIT(0x7e7ee57ed79bfca9), W64LIT(0x242490243db44819),
+    W64LIT(0x3b3bec3bc5d776fe), W64LIT(0xabab96ab313d4b9a), W64LIT(0xcece1fce3ed181f0), W64LIT(0x1111441188552299),
+    W64LIT(0x8f8f068f0c890383), W64LIT(0x4e4e254e4a6b9c04), W64LIT(0xb7b7e6b7d1517366), W64LIT(0xebeb8beb0b60cbe0),
+    W64LIT(0x3c3cf03cfdcc78c1), W64LIT(0x81813e817cbf1ffd), W64LIT(0x94946a94d4fe3540), W64LIT(0xf7f7fbf7eb0cf31c),
+    W64LIT(0xb9b9deb9a1676f18), W64LIT(0x13134c13985f268b), W64LIT(0x2c2cb02c7d9c5851), W64LIT(0xd3d36bd3d6b8bb05),
+    W64LIT(0xe7e7bbe76b5cd38c), W64LIT(0x6e6ea56e57cbdc39), W64LIT(0xc4c437c46ef395aa), W64LIT(0x03030c03180f061b),
+    W64LIT(0x565645568a13acdc), W64LIT(0x44440d441a49885e), W64LIT(0x7f7fe17fdf9efea0), W64LIT(0xa9a99ea921374f88),
+    W64LIT(0x2a2aa82a4d825467), W64LIT(0xbbbbd6bbb16d6b0a), W64LIT(0xc1c123c146e29f87), W64LIT(0x53535153a202a6f1),
+    W64LIT(0xdcdc57dcae8ba572), W64LIT(0x0b0b2c0b58271653), W64LIT(0x9d9d4e9d9cd32701), W64LIT(0x6c6cad6c47c1d82b),
+    W64LIT(0x3131c43195f562a4), W64LIT(0x7474cd7487b9e8f3), W64LIT(0xf6f6fff6e309f115), W64LIT(0x464605460a438c4c),
+    W64LIT(0xacac8aac092645a5), W64LIT(0x89891e893c970fb5), W64LIT(0x14145014a04428b4), W64LIT(0xe1e1a3e15b42dfba),
+    W64LIT(0x16165816b04e2ca6), W64LIT(0x3a3ae83acdd274f7), W64LIT(0x6969b9696fd0d206), W64LIT(0x09092409482d1241),
+    W64LIT(0x7070dd70a7ade0d7), W64LIT(0xb6b6e2b6d954716f), W64LIT(0xd0d067d0ceb7bd1e), W64LIT(0xeded93ed3b7ec7d6),
+    W64LIT(0xcccc17cc2edb85e2), W64LIT(0x424215422a578468), W64LIT(0x98985a98b4c22d2c), W64LIT(0xa4a4aaa4490e55ed),
+	W64LIT(0x2828a0285d885075), W64LIT(0x5c5c6d5cda31b886), W64LIT(0xf8f8c7f8933fed6b), W64LIT(0x8686228644a411c2),
+
+	W64LIT(0xd818186018c07830), W64LIT(0x2623238c2305af46), W64LIT(0xb8c6c63fc67ef991), W64LIT(0xfbe8e887e8136fcd),
+    W64LIT(0xcb878726874ca113), W64LIT(0x11b8b8dab8a9626d), W64LIT(0x0901010401080502), W64LIT(0x0d4f4f214f426e9e),
+    W64LIT(0x9b3636d836adee6c), W64LIT(0xffa6a6a2a6590451), W64LIT(0x0cd2d26fd2debdb9), W64LIT(0x0ef5f5f3f5fb06f7),
+    W64LIT(0x967979f979ef80f2), W64LIT(0x306f6fa16f5fcede), W64LIT(0x6d91917e91fcef3f), W64LIT(0xf852525552aa07a4),
+    W64LIT(0x4760609d6027fdc0), W64LIT(0x35bcbccabc897665), W64LIT(0x379b9b569baccd2b), W64LIT(0x8a8e8e028e048c01),
+    W64LIT(0xd2a3a3b6a371155b), W64LIT(0x6c0c0c300c603c18), W64LIT(0x847b7bf17bff8af6), W64LIT(0x803535d435b5e16a),
+    W64LIT(0xf51d1d741de8693a), W64LIT(0xb3e0e0a7e05347dd), W64LIT(0x21d7d77bd7f6acb3), W64LIT(0x9cc2c22fc25eed99),
+    W64LIT(0x432e2eb82e6d965c), W64LIT(0x294b4b314b627a96), W64LIT(0x5dfefedffea321e1), W64LIT(0xd5575741578216ae),
+    W64LIT(0xbd15155415a8412a), W64LIT(0xe87777c1779fb6ee), W64LIT(0x923737dc37a5eb6e), W64LIT(0x9ee5e5b3e57b56d7),
+    W64LIT(0x139f9f469f8cd923), W64LIT(0x23f0f0e7f0d317fd), W64LIT(0x204a4a354a6a7f94), W64LIT(0x44dada4fda9e95a9),
+    W64LIT(0xa258587d58fa25b0), W64LIT(0xcfc9c903c906ca8f), W64LIT(0x7c2929a429558d52), W64LIT(0x5a0a0a280a502214),
+    W64LIT(0x50b1b1feb1e14f7f), W64LIT(0xc9a0a0baa0691a5d), W64LIT(0x146b6bb16b7fdad6), W64LIT(0xd985852e855cab17),
+    W64LIT(0x3cbdbdcebd817367), W64LIT(0x8f5d5d695dd234ba), W64LIT(0x9010104010805020), W64LIT(0x07f4f4f7f4f303f5),
+    W64LIT(0xddcbcb0bcb16c08b), W64LIT(0xd33e3ef83eedc67c), W64LIT(0x2d0505140528110a), W64LIT(0x78676781671fe6ce),
+    W64LIT(0x97e4e4b7e47353d5), W64LIT(0x0227279c2725bb4e), W64LIT(0x7341411941325882), W64LIT(0xa78b8b168b2c9d0b),
+    W64LIT(0xf6a7a7a6a7510153), W64LIT(0xb27d7de97dcf94fa), W64LIT(0x4995956e95dcfb37), W64LIT(0x56d8d847d88e9fad),
+    W64LIT(0x70fbfbcbfb8b30eb), W64LIT(0xcdeeee9fee2371c1), W64LIT(0xbb7c7ced7cc791f8), W64LIT(0x716666856617e3cc),
+    W64LIT(0x7bdddd53dda68ea7), W64LIT(0xaf17175c17b84b2e), W64LIT(0x454747014702468e), W64LIT(0x1a9e9e429e84dc21),
+    W64LIT(0xd4caca0fca1ec589), W64LIT(0x582d2db42d75995a), W64LIT(0x2ebfbfc6bf917963), W64LIT(0x3f07071c07381b0e),
+    W64LIT(0xacadad8ead012347), W64LIT(0xb05a5a755aea2fb4), W64LIT(0xef838336836cb51b), W64LIT(0xb63333cc3385ff66),
+    W64LIT(0x5c636391633ff2c6), W64LIT(0x1202020802100a04), W64LIT(0x93aaaa92aa393849), W64LIT(0xde7171d971afa8e2),
+    W64LIT(0xc6c8c807c80ecf8d), W64LIT(0xd119196419c87d32), W64LIT(0x3b49493949727092), W64LIT(0x5fd9d943d9869aaf),
+    W64LIT(0x31f2f2eff2c31df9), W64LIT(0xa8e3e3abe34b48db), W64LIT(0xb95b5b715be22ab6), W64LIT(0xbc88881a8834920d),
+    W64LIT(0x3e9a9a529aa4c829), W64LIT(0x0b262698262dbe4c), W64LIT(0xbf3232c8328dfa64), W64LIT(0x59b0b0fab0e94a7d),
+    W64LIT(0xf2e9e983e91b6acf), W64LIT(0x770f0f3c0f78331e), W64LIT(0x33d5d573d5e6a6b7), W64LIT(0xf480803a8074ba1d),
+    W64LIT(0x27bebec2be997c61), W64LIT(0xebcdcd13cd26de87), W64LIT(0x893434d034bde468), W64LIT(0x3248483d487a7590),
+    W64LIT(0x54ffffdbffab24e3), W64LIT(0x8d7a7af57af78ff4), W64LIT(0x6490907a90f4ea3d), W64LIT(0x9d5f5f615fc23ebe),
+    W64LIT(0x3d202080201da040), W64LIT(0x0f6868bd6867d5d0), W64LIT(0xca1a1a681ad07234), W64LIT(0xb7aeae82ae192c41),
+    W64LIT(0x7db4b4eab4c95e75), W64LIT(0xce54544d549a19a8), W64LIT(0x7f93937693ece53b), W64LIT(0x2f222288220daa44),
+    W64LIT(0x6364648d6407e9c8), W64LIT(0x2af1f1e3f1db12ff), W64LIT(0xcc7373d173bfa2e6), W64LIT(0x8212124812905a24),
+    W64LIT(0x7a40401d403a5d80), W64LIT(0x4808082008402810), W64LIT(0x95c3c32bc356e89b), W64LIT(0xdfecec97ec337bc5),
+    W64LIT(0x4ddbdb4bdb9690ab), W64LIT(0xc0a1a1bea1611f5f), W64LIT(0x918d8d0e8d1c8307), W64LIT(0xc83d3df43df5c97a),
+    W64LIT(0x5b97976697ccf133), W64LIT(0x0000000000000000), W64LIT(0xf9cfcf1bcf36d483), W64LIT(0x6e2b2bac2b458756),
+    W64LIT(0xe17676c57697b3ec), W64LIT(0xe68282328264b019), W64LIT(0x28d6d67fd6fea9b1), W64LIT(0xc31b1b6c1bd87736),
+    W64LIT(0x74b5b5eeb5c15b77), W64LIT(0xbeafaf86af112943), W64LIT(0x1d6a6ab56a77dfd4), W64LIT(0xea50505d50ba0da0),
+    W64LIT(0x5745450945124c8a), W64LIT(0x38f3f3ebf3cb18fb), W64LIT(0xad3030c0309df060), W64LIT(0xc4efef9bef2b74c3),
+    W64LIT(0xda3f3ffc3fe5c37e), W64LIT(0xc755554955921caa), W64LIT(0xdba2a2b2a2791059), W64LIT(0xe9eaea8fea0365c9),
+    W64LIT(0x6a656589650fecca), W64LIT(0x03babad2bab96869), W64LIT(0x4a2f2fbc2f65935e), W64LIT(0x8ec0c027c04ee79d),
+    W64LIT(0x60dede5fdebe81a1), W64LIT(0xfc1c1c701ce06c38), W64LIT(0x46fdfdd3fdbb2ee7), W64LIT(0x1f4d4d294d52649a),
+    W64LIT(0x7692927292e4e039), W64LIT(0xfa7575c9758fbcea), W64LIT(0x3606061806301e0c), W64LIT(0xae8a8a128a249809),
+    W64LIT(0x4bb2b2f2b2f94079), W64LIT(0x85e6e6bfe66359d1), W64LIT(0x7e0e0e380e70361c), W64LIT(0xe71f1f7c1ff8633e),
+    W64LIT(0x556262956237f7c4), W64LIT(0x3ad4d477d4eea3b5), W64LIT(0x81a8a89aa829324d), W64LIT(0x5296966296c4f431),
+    W64LIT(0x62f9f9c3f99b3aef), W64LIT(0xa3c5c533c566f697), W64LIT(0x102525942535b14a), W64LIT(0xab59597959f220b2),
+    W64LIT(0xd084842a8454ae15), W64LIT(0xc57272d572b7a7e4), W64LIT(0xec3939e439d5dd72), W64LIT(0x164c4c2d4c5a6198),
+    W64LIT(0x945e5e655eca3bbc), W64LIT(0x9f7878fd78e785f0), W64LIT(0xe53838e038ddd870), W64LIT(0x988c8c0a8c148605),
+    W64LIT(0x17d1d163d1c6b2bf), W64LIT(0xe4a5a5aea5410b57), W64LIT(0xa1e2e2afe2434dd9), W64LIT(0x4e616199612ff8c2),
+    W64LIT(0x42b3b3f6b3f1457b), W64LIT(0x342121842115a542), W64LIT(0x089c9c4a9c94d625), W64LIT(0xee1e1e781ef0663c),
+    W64LIT(0x6143431143225286), W64LIT(0xb1c7c73bc776fc93), W64LIT(0x4ffcfcd7fcb32be5), W64LIT(0x2404041004201408),
+    W64LIT(0xe351515951b208a2), W64LIT(0x2599995e99bcc72f), W64LIT(0x226d6da96d4fc4da), W64LIT(0x650d0d340d68391a),
+    W64LIT(0x79fafacffa8335e9), W64LIT(0x69dfdf5bdfb684a3), W64LIT(0xa97e7ee57ed79bfc), W64LIT(0x19242490243db448),
+    W64LIT(0xfe3b3bec3bc5d776), W64LIT(0x9aabab96ab313d4b), W64LIT(0xf0cece1fce3ed181), W64LIT(0x9911114411885522),
+    W64LIT(0x838f8f068f0c8903), W64LIT(0x044e4e254e4a6b9c), W64LIT(0x66b7b7e6b7d15173), W64LIT(0xe0ebeb8beb0b60cb),
+    W64LIT(0xc13c3cf03cfdcc78), W64LIT(0xfd81813e817cbf1f), W64LIT(0x4094946a94d4fe35), W64LIT(0x1cf7f7fbf7eb0cf3),
+    W64LIT(0x18b9b9deb9a1676f), W64LIT(0x8b13134c13985f26), W64LIT(0x512c2cb02c7d9c58), W64LIT(0x05d3d36bd3d6b8bb),
+    W64LIT(0x8ce7e7bbe76b5cd3), W64LIT(0x396e6ea56e57cbdc), W64LIT(0xaac4c437c46ef395), W64LIT(0x1b03030c03180f06),
+    W64LIT(0xdc565645568a13ac), W64LIT(0x5e44440d441a4988), W64LIT(0xa07f7fe17fdf9efe), W64LIT(0x88a9a99ea921374f),
+    W64LIT(0x672a2aa82a4d8254), W64LIT(0x0abbbbd6bbb16d6b), W64LIT(0x87c1c123c146e29f), W64LIT(0xf153535153a202a6),
+    W64LIT(0x72dcdc57dcae8ba5), W64LIT(0x530b0b2c0b582716), W64LIT(0x019d9d4e9d9cd327), W64LIT(0x2b6c6cad6c47c1d8),
+    W64LIT(0xa43131c43195f562), W64LIT(0xf37474cd7487b9e8), W64LIT(0x15f6f6fff6e309f1), W64LIT(0x4c464605460a438c),
+    W64LIT(0xa5acac8aac092645), W64LIT(0xb589891e893c970f), W64LIT(0xb414145014a04428), W64LIT(0xbae1e1a3e15b42df),
+    W64LIT(0xa616165816b04e2c), W64LIT(0xf73a3ae83acdd274), W64LIT(0x066969b9696fd0d2), W64LIT(0x4109092409482d12),
+    W64LIT(0xd77070dd70a7ade0), W64LIT(0x6fb6b6e2b6d95471), W64LIT(0x1ed0d067d0ceb7bd), W64LIT(0xd6eded93ed3b7ec7),
+    W64LIT(0xe2cccc17cc2edb85), W64LIT(0x68424215422a5784), W64LIT(0x2c98985a98b4c22d), W64LIT(0xeda4a4aaa4490e55),
+    W64LIT(0x752828a0285d8850), W64LIT(0x865c5c6d5cda31b8), W64LIT(0x6bf8f8c7f8933fed), W64LIT(0xc28686228644a411),
+
+	W64LIT(0x30d818186018c078), W64LIT(0x462623238c2305af), W64LIT(0x91b8c6c63fc67ef9), W64LIT(0xcdfbe8e887e8136f),
+    W64LIT(0x13cb878726874ca1), W64LIT(0x6d11b8b8dab8a962), W64LIT(0x0209010104010805), W64LIT(0x9e0d4f4f214f426e),
+    W64LIT(0x6c9b3636d836adee), W64LIT(0x51ffa6a6a2a65904), W64LIT(0xb90cd2d26fd2debd), W64LIT(0xf70ef5f5f3f5fb06),
+    W64LIT(0xf2967979f979ef80), W64LIT(0xde306f6fa16f5fce), W64LIT(0x3f6d91917e91fcef), W64LIT(0xa4f852525552aa07),
+    W64LIT(0xc04760609d6027fd), W64LIT(0x6535bcbccabc8976), W64LIT(0x2b379b9b569baccd), W64LIT(0x018a8e8e028e048c),
+    W64LIT(0x5bd2a3a3b6a37115), W64LIT(0x186c0c0c300c603c), W64LIT(0xf6847b7bf17bff8a), W64LIT(0x6a803535d435b5e1),
+    W64LIT(0x3af51d1d741de869), W64LIT(0xddb3e0e0a7e05347), W64LIT(0xb321d7d77bd7f6ac), W64LIT(0x999cc2c22fc25eed),
+    W64LIT(0x5c432e2eb82e6d96), W64LIT(0x96294b4b314b627a), W64LIT(0xe15dfefedffea321), W64LIT(0xaed5575741578216),
+    W64LIT(0x2abd15155415a841), W64LIT(0xeee87777c1779fb6), W64LIT(0x6e923737dc37a5eb), W64LIT(0xd79ee5e5b3e57b56),
+    W64LIT(0x23139f9f469f8cd9), W64LIT(0xfd23f0f0e7f0d317), W64LIT(0x94204a4a354a6a7f), W64LIT(0xa944dada4fda9e95),
+    W64LIT(0xb0a258587d58fa25), W64LIT(0x8fcfc9c903c906ca), W64LIT(0x527c2929a429558d), W64LIT(0x145a0a0a280a5022),
+    W64LIT(0x7f50b1b1feb1e14f), W64LIT(0x5dc9a0a0baa0691a), W64LIT(0xd6146b6bb16b7fda), W64LIT(0x17d985852e855cab),
+    W64LIT(0x673cbdbdcebd8173), W64LIT(0xba8f5d5d695dd234), W64LIT(0x2090101040108050), W64LIT(0xf507f4f4f7f4f303),
+    W64LIT(0x8bddcbcb0bcb16c0), W64LIT(0x7cd33e3ef83eedc6), W64LIT(0x0a2d050514052811), W64LIT(0xce78676781671fe6),
+    W64LIT(0xd597e4e4b7e47353), W64LIT(0x4e0227279c2725bb), W64LIT(0x8273414119413258), W64LIT(0x0ba78b8b168b2c9d),
+    W64LIT(0x53f6a7a7a6a75101), W64LIT(0xfab27d7de97dcf94), W64LIT(0x374995956e95dcfb), W64LIT(0xad56d8d847d88e9f),
+    W64LIT(0xeb70fbfbcbfb8b30), W64LIT(0xc1cdeeee9fee2371), W64LIT(0xf8bb7c7ced7cc791), W64LIT(0xcc716666856617e3),
+    W64LIT(0xa77bdddd53dda68e), W64LIT(0x2eaf17175c17b84b), W64LIT(0x8e45474701470246), W64LIT(0x211a9e9e429e84dc),
+    W64LIT(0x89d4caca0fca1ec5), W64LIT(0x5a582d2db42d7599), W64LIT(0x632ebfbfc6bf9179), W64LIT(0x0e3f07071c07381b),
+    W64LIT(0x47acadad8ead0123), W64LIT(0xb4b05a5a755aea2f), W64LIT(0x1bef838336836cb5), W64LIT(0x66b63333cc3385ff),
+    W64LIT(0xc65c636391633ff2), W64LIT(0x041202020802100a), W64LIT(0x4993aaaa92aa3938), W64LIT(0xe2de7171d971afa8),
+    W64LIT(0x8dc6c8c807c80ecf), W64LIT(0x32d119196419c87d), W64LIT(0x923b494939497270), W64LIT(0xaf5fd9d943d9869a),
+    W64LIT(0xf931f2f2eff2c31d), W64LIT(0xdba8e3e3abe34b48), W64LIT(0xb6b95b5b715be22a), W64LIT(0x0dbc88881a883492),
+    W64LIT(0x293e9a9a529aa4c8), W64LIT(0x4c0b262698262dbe), W64LIT(0x64bf3232c8328dfa), W64LIT(0x7d59b0b0fab0e94a),
+    W64LIT(0xcff2e9e983e91b6a), W64LIT(0x1e770f0f3c0f7833), W64LIT(0xb733d5d573d5e6a6), W64LIT(0x1df480803a8074ba),
+    W64LIT(0x6127bebec2be997c), W64LIT(0x87ebcdcd13cd26de), W64LIT(0x68893434d034bde4), W64LIT(0x903248483d487a75),
+    W64LIT(0xe354ffffdbffab24), W64LIT(0xf48d7a7af57af78f), W64LIT(0x3d6490907a90f4ea), W64LIT(0xbe9d5f5f615fc23e),
+    W64LIT(0x403d202080201da0), W64LIT(0xd00f6868bd6867d5), W64LIT(0x34ca1a1a681ad072), W64LIT(0x41b7aeae82ae192c),
+    W64LIT(0x757db4b4eab4c95e), W64LIT(0xa8ce54544d549a19), W64LIT(0x3b7f93937693ece5), W64LIT(0x442f222288220daa),
+    W64LIT(0xc86364648d6407e9), W64LIT(0xff2af1f1e3f1db12), W64LIT(0xe6cc7373d173bfa2), W64LIT(0x248212124812905a),
+    W64LIT(0x807a40401d403a5d), W64LIT(0x1048080820084028), W64LIT(0x9b95c3c32bc356e8), W64LIT(0xc5dfecec97ec337b),
+    W64LIT(0xab4ddbdb4bdb9690), W64LIT(0x5fc0a1a1bea1611f), W64LIT(0x07918d8d0e8d1c83), W64LIT(0x7ac83d3df43df5c9),
+    W64LIT(0x335b97976697ccf1), W64LIT(0x0000000000000000), W64LIT(0x83f9cfcf1bcf36d4), W64LIT(0x566e2b2bac2b4587),
+    W64LIT(0xece17676c57697b3), W64LIT(0x19e68282328264b0), W64LIT(0xb128d6d67fd6fea9), W64LIT(0x36c31b1b6c1bd877),
+    W64LIT(0x7774b5b5eeb5c15b), W64LIT(0x43beafaf86af1129), W64LIT(0xd41d6a6ab56a77df), W64LIT(0xa0ea50505d50ba0d),
+    W64LIT(0x8a5745450945124c), W64LIT(0xfb38f3f3ebf3cb18), W64LIT(0x60ad3030c0309df0), W64LIT(0xc3c4efef9bef2b74),
+    W64LIT(0x7eda3f3ffc3fe5c3), W64LIT(0xaac755554955921c), W64LIT(0x59dba2a2b2a27910), W64LIT(0xc9e9eaea8fea0365),
+    W64LIT(0xca6a656589650fec), W64LIT(0x6903babad2bab968), W64LIT(0x5e4a2f2fbc2f6593), W64LIT(0x9d8ec0c027c04ee7),
+    W64LIT(0xa160dede5fdebe81), W64LIT(0x38fc1c1c701ce06c), W64LIT(0xe746fdfdd3fdbb2e), W64LIT(0x9a1f4d4d294d5264),
+    W64LIT(0x397692927292e4e0), W64LIT(0xeafa7575c9758fbc), W64LIT(0x0c3606061806301e), W64LIT(0x09ae8a8a128a2498),
+    W64LIT(0x794bb2b2f2b2f940), W64LIT(0xd185e6e6bfe66359), W64LIT(0x1c7e0e0e380e7036), W64LIT(0x3ee71f1f7c1ff863),
+    W64LIT(0xc4556262956237f7), W64LIT(0xb53ad4d477d4eea3), W64LIT(0x4d81a8a89aa82932), W64LIT(0x315296966296c4f4),
+    W64LIT(0xef62f9f9c3f99b3a), W64LIT(0x97a3c5c533c566f6), W64LIT(0x4a102525942535b1), W64LIT(0xb2ab59597959f220),
+    W64LIT(0x15d084842a8454ae), W64LIT(0xe4c57272d572b7a7), W64LIT(0x72ec3939e439d5dd), W64LIT(0x98164c4c2d4c5a61),
+    W64LIT(0xbc945e5e655eca3b), W64LIT(0xf09f7878fd78e785), W64LIT(0x70e53838e038ddd8), W64LIT(0x05988c8c0a8c1486),
+    W64LIT(0xbf17d1d163d1c6b2), W64LIT(0x57e4a5a5aea5410b), W64LIT(0xd9a1e2e2afe2434d), W64LIT(0xc24e616199612ff8),
+    W64LIT(0x7b42b3b3f6b3f145), W64LIT(0x42342121842115a5), W64LIT(0x25089c9c4a9c94d6), W64LIT(0x3cee1e1e781ef066),
+    W64LIT(0x8661434311432252), W64LIT(0x93b1c7c73bc776fc), W64LIT(0xe54ffcfcd7fcb32b), W64LIT(0x0824040410042014),
+    W64LIT(0xa2e351515951b208), W64LIT(0x2f2599995e99bcc7), W64LIT(0xda226d6da96d4fc4), W64LIT(0x1a650d0d340d6839),
+    W64LIT(0xe979fafacffa8335), W64LIT(0xa369dfdf5bdfb684), W64LIT(0xfca97e7ee57ed79b), W64LIT(0x4819242490243db4),
+    W64LIT(0x76fe3b3bec3bc5d7), W64LIT(0x4b9aabab96ab313d), W64LIT(0x81f0cece1fce3ed1), W64LIT(0x2299111144118855),
+    W64LIT(0x03838f8f068f0c89), W64LIT(0x9c044e4e254e4a6b), W64LIT(0x7366b7b7e6b7d151), W64LIT(0xcbe0ebeb8beb0b60),
+    W64LIT(0x78c13c3cf03cfdcc), W64LIT(0x1ffd81813e817cbf), W64LIT(0x354094946a94d4fe), W64LIT(0xf31cf7f7fbf7eb0c),
+    W64LIT(0x6f18b9b9deb9a167), W64LIT(0x268b13134c13985f), W64LIT(0x58512c2cb02c7d9c), W64LIT(0xbb05d3d36bd3d6b8),
+    W64LIT(0xd38ce7e7bbe76b5c), W64LIT(0xdc396e6ea56e57cb), W64LIT(0x95aac4c437c46ef3), W64LIT(0x061b03030c03180f),
+    W64LIT(0xacdc565645568a13), W64LIT(0x885e44440d441a49), W64LIT(0xfea07f7fe17fdf9e), W64LIT(0x4f88a9a99ea92137),
+    W64LIT(0x54672a2aa82a4d82), W64LIT(0x6b0abbbbd6bbb16d), W64LIT(0x9f87c1c123c146e2), W64LIT(0xa6f153535153a202),
+    W64LIT(0xa572dcdc57dcae8b), W64LIT(0x16530b0b2c0b5827), W64LIT(0x27019d9d4e9d9cd3), W64LIT(0xd82b6c6cad6c47c1),
+    W64LIT(0x62a43131c43195f5), W64LIT(0xe8f37474cd7487b9), W64LIT(0xf115f6f6fff6e309), W64LIT(0x8c4c464605460a43),
+    W64LIT(0x45a5acac8aac0926), W64LIT(0x0fb589891e893c97), W64LIT(0x28b414145014a044), W64LIT(0xdfbae1e1a3e15b42),
+    W64LIT(0x2ca616165816b04e), W64LIT(0x74f73a3ae83acdd2), W64LIT(0xd2066969b9696fd0), W64LIT(0x124109092409482d),
+    W64LIT(0xe0d77070dd70a7ad), W64LIT(0x716fb6b6e2b6d954), W64LIT(0xbd1ed0d067d0ceb7), W64LIT(0xc7d6eded93ed3b7e),
+    W64LIT(0x85e2cccc17cc2edb), W64LIT(0x8468424215422a57), W64LIT(0x2d2c98985a98b4c2), W64LIT(0x55eda4a4aaa4490e),
+    W64LIT(0x50752828a0285d88), W64LIT(0xb8865c5c6d5cda31), W64LIT(0xed6bf8f8c7f8933f), W64LIT(0x11c28686228644a4),
+
+	W64LIT(0x7830d818186018c0), W64LIT(0xaf462623238c2305), W64LIT(0xf991b8c6c63fc67e), W64LIT(0x6fcdfbe8e887e813),
+    W64LIT(0xa113cb878726874c), W64LIT(0x626d11b8b8dab8a9), W64LIT(0x0502090101040108), W64LIT(0x6e9e0d4f4f214f42),
+    W64LIT(0xee6c9b3636d836ad), W64LIT(0x0451ffa6a6a2a659), W64LIT(0xbdb90cd2d26fd2de), W64LIT(0x06f70ef5f5f3f5fb),
+    W64LIT(0x80f2967979f979ef), W64LIT(0xcede306f6fa16f5f), W64LIT(0xef3f6d91917e91fc), W64LIT(0x07a4f852525552aa),
+    W64LIT(0xfdc04760609d6027), W64LIT(0x766535bcbccabc89), W64LIT(0xcd2b379b9b569bac), W64LIT(0x8c018a8e8e028e04),
+    W64LIT(0x155bd2a3a3b6a371), W64LIT(0x3c186c0c0c300c60), W64LIT(0x8af6847b7bf17bff), W64LIT(0xe16a803535d435b5),
+    W64LIT(0x693af51d1d741de8), W64LIT(0x47ddb3e0e0a7e053), W64LIT(0xacb321d7d77bd7f6), W64LIT(0xed999cc2c22fc25e),
+    W64LIT(0x965c432e2eb82e6d), W64LIT(0x7a96294b4b314b62), W64LIT(0x21e15dfefedffea3), W64LIT(0x16aed55757415782),
+    W64LIT(0x412abd15155415a8), W64LIT(0xb6eee87777c1779f), W64LIT(0xeb6e923737dc37a5), W64LIT(0x56d79ee5e5b3e57b),
+    W64LIT(0xd923139f9f469f8c), W64LIT(0x17fd23f0f0e7f0d3), W64LIT(0x7f94204a4a354a6a), W64LIT(0x95a944dada4fda9e),
+    W64LIT(0x25b0a258587d58fa), W64LIT(0xca8fcfc9c903c906), W64LIT(0x8d527c2929a42955), W64LIT(0x22145a0a0a280a50),
+    W64LIT(0x4f7f50b1b1feb1e1), W64LIT(0x1a5dc9a0a0baa069), W64LIT(0xdad6146b6bb16b7f), W64LIT(0xab17d985852e855c),
+    W64LIT(0x73673cbdbdcebd81), W64LIT(0x34ba8f5d5d695dd2), W64LIT(0x5020901010401080), W64LIT(0x03f507f4f4f7f4f3),
+    W64LIT(0xc08bddcbcb0bcb16), W64LIT(0xc67cd33e3ef83eed), W64LIT(0x110a2d0505140528), W64LIT(0xe6ce78676781671f),
+    W64LIT(0x53d597e4e4b7e473), W64LIT(0xbb4e0227279c2725), W64LIT(0x5882734141194132), W64LIT(0x9d0ba78b8b168b2c),
+    W64LIT(0x0153f6a7a7a6a751), W64LIT(0x94fab27d7de97dcf), W64LIT(0xfb374995956e95dc), W64LIT(0x9fad56d8d847d88e),
+    W64LIT(0x30eb70fbfbcbfb8b), W64LIT(0x71c1cdeeee9fee23), W64LIT(0x91f8bb7c7ced7cc7), W64LIT(0xe3cc716666856617),
+    W64LIT(0x8ea77bdddd53dda6), W64LIT(0x4b2eaf17175c17b8), W64LIT(0x468e454747014702), W64LIT(0xdc211a9e9e429e84),
+    W64LIT(0xc589d4caca0fca1e), W64LIT(0x995a582d2db42d75), W64LIT(0x79632ebfbfc6bf91), W64LIT(0x1b0e3f07071c0738),
+    W64LIT(0x2347acadad8ead01), W64LIT(0x2fb4b05a5a755aea), W64LIT(0xb51bef838336836c), W64LIT(0xff66b63333cc3385),
+    W64LIT(0xf2c65c636391633f), W64LIT(0x0a04120202080210), W64LIT(0x384993aaaa92aa39), W64LIT(0xa8e2de7171d971af),
+    W64LIT(0xcf8dc6c8c807c80e), W64LIT(0x7d32d119196419c8), W64LIT(0x70923b4949394972), W64LIT(0x9aaf5fd9d943d986),
+    W64LIT(0x1df931f2f2eff2c3), W64LIT(0x48dba8e3e3abe34b), W64LIT(0x2ab6b95b5b715be2), W64LIT(0x920dbc88881a8834),
+    W64LIT(0xc8293e9a9a529aa4), W64LIT(0xbe4c0b262698262d), W64LIT(0xfa64bf3232c8328d), W64LIT(0x4a7d59b0b0fab0e9),
+    W64LIT(0x6acff2e9e983e91b), W64LIT(0x331e770f0f3c0f78), W64LIT(0xa6b733d5d573d5e6), W64LIT(0xba1df480803a8074),
+    W64LIT(0x7c6127bebec2be99), W64LIT(0xde87ebcdcd13cd26), W64LIT(0xe468893434d034bd), W64LIT(0x75903248483d487a),
+    W64LIT(0x24e354ffffdbffab), W64LIT(0x8ff48d7a7af57af7), W64LIT(0xea3d6490907a90f4), W64LIT(0x3ebe9d5f5f615fc2),
+    W64LIT(0xa0403d202080201d), W64LIT(0xd5d00f6868bd6867), W64LIT(0x7234ca1a1a681ad0), W64LIT(0x2c41b7aeae82ae19),
+    W64LIT(0x5e757db4b4eab4c9), W64LIT(0x19a8ce54544d549a), W64LIT(0xe53b7f93937693ec), W64LIT(0xaa442f222288220d),
+    W64LIT(0xe9c86364648d6407), W64LIT(0x12ff2af1f1e3f1db), W64LIT(0xa2e6cc7373d173bf), W64LIT(0x5a24821212481290),
+    W64LIT(0x5d807a40401d403a), W64LIT(0x2810480808200840), W64LIT(0xe89b95c3c32bc356), W64LIT(0x7bc5dfecec97ec33),
+    W64LIT(0x90ab4ddbdb4bdb96), W64LIT(0x1f5fc0a1a1bea161), W64LIT(0x8307918d8d0e8d1c), W64LIT(0xc97ac83d3df43df5),
+    W64LIT(0xf1335b97976697cc), W64LIT(0x0000000000000000), W64LIT(0xd483f9cfcf1bcf36), W64LIT(0x87566e2b2bac2b45),
+    W64LIT(0xb3ece17676c57697), W64LIT(0xb019e68282328264), W64LIT(0xa9b128d6d67fd6fe), W64LIT(0x7736c31b1b6c1bd8),
+    W64LIT(0x5b7774b5b5eeb5c1), W64LIT(0x2943beafaf86af11), W64LIT(0xdfd41d6a6ab56a77), W64LIT(0x0da0ea50505d50ba),
+    W64LIT(0x4c8a574545094512), W64LIT(0x18fb38f3f3ebf3cb), W64LIT(0xf060ad3030c0309d), W64LIT(0x74c3c4efef9bef2b),
+    W64LIT(0xc37eda3f3ffc3fe5), W64LIT(0x1caac75555495592), W64LIT(0x1059dba2a2b2a279), W64LIT(0x65c9e9eaea8fea03),
+    W64LIT(0xecca6a656589650f), W64LIT(0x686903babad2bab9), W64LIT(0x935e4a2f2fbc2f65), W64LIT(0xe79d8ec0c027c04e),
+    W64LIT(0x81a160dede5fdebe), W64LIT(0x6c38fc1c1c701ce0), W64LIT(0x2ee746fdfdd3fdbb), W64LIT(0x649a1f4d4d294d52),
+    W64LIT(0xe0397692927292e4), W64LIT(0xbceafa7575c9758f), W64LIT(0x1e0c360606180630), W64LIT(0x9809ae8a8a128a24),
+    W64LIT(0x40794bb2b2f2b2f9), W64LIT(0x59d185e6e6bfe663), W64LIT(0x361c7e0e0e380e70), W64LIT(0x633ee71f1f7c1ff8),
+    W64LIT(0xf7c4556262956237), W64LIT(0xa3b53ad4d477d4ee), W64LIT(0x324d81a8a89aa829), W64LIT(0xf4315296966296c4),
+    W64LIT(0x3aef62f9f9c3f99b), W64LIT(0xf697a3c5c533c566), W64LIT(0xb14a102525942535), W64LIT(0x20b2ab59597959f2),
+    W64LIT(0xae15d084842a8454), W64LIT(0xa7e4c57272d572b7), W64LIT(0xdd72ec3939e439d5), W64LIT(0x6198164c4c2d4c5a),
+    W64LIT(0x3bbc945e5e655eca), W64LIT(0x85f09f7878fd78e7), W64LIT(0xd870e53838e038dd), W64LIT(0x8605988c8c0a8c14),
+    W64LIT(0xb2bf17d1d163d1c6), W64LIT(0x0b57e4a5a5aea541), W64LIT(0x4dd9a1e2e2afe243), W64LIT(0xf8c24e616199612f),
+    W64LIT(0x457b42b3b3f6b3f1), W64LIT(0xa542342121842115), W64LIT(0xd625089c9c4a9c94), W64LIT(0x663cee1e1e781ef0),
+    W64LIT(0x5286614343114322), W64LIT(0xfc93b1c7c73bc776), W64LIT(0x2be54ffcfcd7fcb3), W64LIT(0x1408240404100420),
+    W64LIT(0x08a2e351515951b2), W64LIT(0xc72f2599995e99bc), W64LIT(0xc4da226d6da96d4f), W64LIT(0x391a650d0d340d68),
+    W64LIT(0x35e979fafacffa83), W64LIT(0x84a369dfdf5bdfb6), W64LIT(0x9bfca97e7ee57ed7), W64LIT(0xb44819242490243d),
+    W64LIT(0xd776fe3b3bec3bc5), W64LIT(0x3d4b9aabab96ab31), W64LIT(0xd181f0cece1fce3e), W64LIT(0x5522991111441188),
+    W64LIT(0x8903838f8f068f0c), W64LIT(0x6b9c044e4e254e4a), W64LIT(0x517366b7b7e6b7d1), W64LIT(0x60cbe0ebeb8beb0b),
+    W64LIT(0xcc78c13c3cf03cfd), W64LIT(0xbf1ffd81813e817c), W64LIT(0xfe354094946a94d4), W64LIT(0x0cf31cf7f7fbf7eb),
+    W64LIT(0x676f18b9b9deb9a1), W64LIT(0x5f268b13134c1398), W64LIT(0x9c58512c2cb02c7d), W64LIT(0xb8bb05d3d36bd3d6),
+    W64LIT(0x5cd38ce7e7bbe76b), W64LIT(0xcbdc396e6ea56e57), W64LIT(0xf395aac4c437c46e), W64LIT(0x0f061b03030c0318),
+    W64LIT(0x13acdc565645568a), W64LIT(0x49885e44440d441a), W64LIT(0x9efea07f7fe17fdf), W64LIT(0x374f88a9a99ea921),
+    W64LIT(0x8254672a2aa82a4d), W64LIT(0x6d6b0abbbbd6bbb1), W64LIT(0xe29f87c1c123c146), W64LIT(0x02a6f153535153a2),
+    W64LIT(0x8ba572dcdc57dcae), W64LIT(0x2716530b0b2c0b58), W64LIT(0xd327019d9d4e9d9c), W64LIT(0xc1d82b6c6cad6c47),
+    W64LIT(0xf562a43131c43195), W64LIT(0xb9e8f37474cd7487), W64LIT(0x09f115f6f6fff6e3), W64LIT(0x438c4c464605460a),
+    W64LIT(0x2645a5acac8aac09), W64LIT(0x970fb589891e893c), W64LIT(0x4428b414145014a0), W64LIT(0x42dfbae1e1a3e15b),
+    W64LIT(0x4e2ca616165816b0), W64LIT(0xd274f73a3ae83acd), W64LIT(0xd0d2066969b9696f), W64LIT(0x2d12410909240948),
+    W64LIT(0xade0d77070dd70a7), W64LIT(0x54716fb6b6e2b6d9), W64LIT(0xb7bd1ed0d067d0ce), W64LIT(0x7ec7d6eded93ed3b),
+    W64LIT(0xdb85e2cccc17cc2e), W64LIT(0x578468424215422a), W64LIT(0xc22d2c98985a98b4), W64LIT(0x0e55eda4a4aaa449),
+    W64LIT(0x8850752828a0285d), W64LIT(0x31b8865c5c6d5cda), W64LIT(0x3fed6bf8f8c7f893), W64LIT(0xa411c28686228644),
+
+	W64LIT(0x1823c6e887b8014f),
+	W64LIT(0x36a6d2f5796f9152),
+	W64LIT(0x60bc9b8ea30c7b35),
+	W64LIT(0x1de0d7c22e4bfe57),
+	W64LIT(0x157737e59ff04ada),
+	W64LIT(0x58c9290ab1a06b85),
+	W64LIT(0xbd5d10f4cb3e0567),
+	W64LIT(0xe427418ba77d95d8),
+	W64LIT(0xfbee7c66dd17479e),
+	W64LIT(0xca2dbf07ad5a8333)
+};
+
+// Whirlpool basic transformation. Transforms state based on block.
+void Whirlpool::Transform(word64 *digest, const word64 *block)
+{
+	CRYPTOPP_ASSERT(digest != NULLPTR);
+	CRYPTOPP_ASSERT(block != NULLPTR);
+
+#if CRYPTOPP_SSE2_ASM_AVAILABLE
+	if (HasSSE2())
+	{
+		// MMX version has the same structure as C version below
+#ifdef __GNUC__
+	#if CRYPTOPP_BOOL_X64
+		word64 workspace[16];
+	#endif
+	__asm__ __volatile__
+	(
+		INTEL_NOPREFIX
+		AS_PUSH_IF86(	bx)
+		AS2(	mov		AS_REG_6, WORD_REG(ax))
+#else
+		AS2(	lea		AS_REG_6, [Whirlpool_C])
+		AS2(	mov		WORD_REG(cx), digest)
+		AS2(	mov		WORD_REG(dx), block)
+#endif
+#if CRYPTOPP_BOOL_X86
+		AS2(	mov		eax, esp)
+		AS2(	and		esp, -16)
+		AS2(	sub		esp, 16*8)
+		AS_PUSH_IF86(	ax)
+	#if CRYPTOPP_BOOL_X86
+		#define SSE2_workspace	esp+WORD_SZ
+	#endif
+#else
+	#define SSE2_workspace	%3
+#endif
+		AS2(	xor		esi, esi)
+		ASL(0)
+		AS2(	movq	mm0, [WORD_REG(cx)+8*WORD_REG(si)])
+		AS2(	movq	[SSE2_workspace+8*WORD_REG(si)], mm0)		// k
+		AS2(	pxor	mm0, [WORD_REG(dx)+8*WORD_REG(si)])
+		AS2(	movq	[SSE2_workspace+64+8*WORD_REG(si)], mm0)	// s
+		AS2(	movq	[WORD_REG(cx)+8*WORD_REG(si)], mm0)
+		AS1(	inc		WORD_REG(si))
+		AS2(	cmp		WORD_REG(si), 8)
+		ASJ(	jne,	0, b)
+
+		AS2(	xor		esi, esi)
+		ASL(1)
+
+#define KSL0(a, b)	AS2(movq	mm##a, b)
+#define KSL1(a, b)	AS2(pxor	mm##a, b)
+
+#define KSL(op, i, a, b, c, d)	\
+	AS2(mov		eax, [SSE2_workspace+8*i])\
+	AS2(movzx	edi, al)\
+	KSL##op(a, [AS_REG_6+3*2048+8*WORD_REG(di)])\
+	AS2(movzx	edi, ah)\
+	KSL##op(b, [AS_REG_6+2*2048+8*WORD_REG(di)])\
+	AS2(shr		eax, 16)\
+	AS2(movzx	edi, al)\
+	AS2(shr		eax, 8)\
+	KSL##op(c, [AS_REG_6+1*2048+8*WORD_REG(di)])\
+	KSL##op(d, [AS_REG_6+0*2048+8*WORD_REG(ax)])
+
+#define KSH0(a, b)	\
+	ASS(pshufw	mm##a, mm##a, 1, 0, 3, 2)\
+	AS2(pxor	mm##a, b)
+#define KSH1(a, b)	\
+	AS2(pxor	mm##a, b)
+#define KSH2(a, b)	\
+	AS2(pxor	mm##a, b)\
+	AS2(movq	[SSE2_workspace+8*a], mm##a)
+
+#define KSH(op, i, a, b, c, d)	\
+	AS2(mov		eax, [SSE2_workspace+8*((i+4)-8*((i+4)/8))+4])\
+	AS2(movzx	edi, al)\
+	KSH##op(a, [AS_REG_6+3*2048+8*WORD_REG(di)])\
+	AS2(movzx	edi, ah)\
+	KSH##op(b, [AS_REG_6+2*2048+8*WORD_REG(di)])\
+	AS2(shr		eax, 16)\
+	AS2(movzx	edi, al)\
+	AS2(shr		eax, 8)\
+	KSH##op(c, [AS_REG_6+1*2048+8*WORD_REG(di)])\
+	KSH##op(d, [AS_REG_6+0*2048+8*WORD_REG(ax)])
+
+#define TSL(op, i, a, b, c, d)	\
+	AS2(mov		eax, [SSE2_workspace+64+8*i])\
+	AS2(movzx	edi, al)\
+	KSL##op(a, [AS_REG_6+3*2048+8*WORD_REG(di)])\
+	AS2(movzx	edi, ah)\
+	KSL##op(b, [AS_REG_6+2*2048+8*WORD_REG(di)])\
+	AS2(shr		eax, 16)\
+	AS2(movzx	edi, al)\
+	AS2(shr		eax, 8)\
+	KSL##op(c, [AS_REG_6+1*2048+8*WORD_REG(di)])\
+	KSL##op(d, [AS_REG_6+0*2048+8*WORD_REG(ax)])
+
+#define TSH0(a, b)	\
+	ASS(pshufw	mm##a, mm##a, 1, 0, 3, 2)\
+	AS2(pxor	mm##a, [SSE2_workspace+8*a])\
+	AS2(pxor	mm##a, b)
+#define TSH1(a, b)	\
+	AS2(pxor	mm##a, b)
+#define TSH2(a, b)	\
+	AS2(pxor	mm##a, b)\
+	AS2(movq	[SSE2_workspace+64+8*a], mm##a)
+#define TSH3(a, b)	\
+	AS2(pxor	mm##a, b)\
+	AS2(pxor	mm##a, [WORD_REG(cx)+8*a])\
+	AS2(movq	[WORD_REG(cx)+8*a], mm##a)
+
+#define TSH(op, i, a, b, c, d)	\
+	AS2(mov		eax, [SSE2_workspace+64+8*((i+4)-8*((i+4)/8))+4])\
+	AS2(movzx	edi, al)\
+	TSH##op(a, [AS_REG_6+3*2048+8*WORD_REG(di)])\
+	AS2(movzx	edi, ah)\
+	TSH##op(b, [AS_REG_6+2*2048+8*WORD_REG(di)])\
+	AS2(shr		eax, 16)\
+	AS2(movzx	edi, al)\
+	AS2(shr		eax, 8)\
+	TSH##op(c, [AS_REG_6+1*2048+8*WORD_REG(di)])\
+	TSH##op(d, [AS_REG_6+0*2048+8*WORD_REG(ax)])
+
+		KSL(0, 4, 3, 2, 1, 0)
+		KSL(0, 0, 7, 6, 5, 4)
+		KSL(1, 1, 0, 7, 6, 5)
+		KSL(1, 2, 1, 0, 7, 6)
+		KSL(1, 3, 2, 1, 0, 7)
+		KSL(1, 5, 4, 3, 2, 1)
+		KSL(1, 6, 5, 4, 3, 2)
+		KSL(1, 7, 6, 5, 4, 3)
+		KSH(0, 0, 7, 6, 5, 4)
+		KSH(0, 4, 3, 2, 1, 0)
+		KSH(1, 1, 0, 7, 6, 5)
+		KSH(1, 2, 1, 0, 7, 6)
+		KSH(1, 5, 4, 3, 2, 1)
+		KSH(1, 6, 5, 4, 3, 2)
+		KSH(2, 3, 2, 1, 0, 7)
+		KSH(2, 7, 6, 5, 4, 3)
+
+		AS2(	pxor	mm0, [AS_REG_6 + 8*1024 + WORD_REG(si)*8])
+		AS2(	movq	[SSE2_workspace], mm0)
+
+		TSL(0, 4, 3, 2, 1, 0)
+		TSL(0, 0, 7, 6, 5, 4)
+		TSL(1, 1, 0, 7, 6, 5)
+		TSL(1, 2, 1, 0, 7, 6)
+		TSL(1, 3, 2, 1, 0, 7)
+		TSL(1, 5, 4, 3, 2, 1)
+		TSL(1, 6, 5, 4, 3, 2)
+		TSL(1, 7, 6, 5, 4, 3)
+		TSH(0, 0, 7, 6, 5, 4)
+		TSH(0, 4, 3, 2, 1, 0)
+		TSH(1, 1, 0, 7, 6, 5)
+		TSH(1, 2, 1, 0, 7, 6)
+		TSH(1, 5, 4, 3, 2, 1)
+		TSH(1, 6, 5, 4, 3, 2)
+
+		AS1(	inc		WORD_REG(si))
+		AS2(	cmp		WORD_REG(si), 10)
+		ASJ(	je,		2, f)
+
+		TSH(2, 3, 2, 1, 0, 7)
+		TSH(2, 7, 6, 5, 4, 3)
+
+		ASJ(	jmp,	1, b)
+		ASL(2)
+
+		TSH(3, 3, 2, 1, 0, 7)
+		TSH(3, 7, 6, 5, 4, 3)
+
+#undef KSL
+#undef KSH
+#undef TSL
+#undef TSH
+
+		AS_POP_IF86(	sp)
+		AS1(	emms)
+
+#if defined(__GNUC__)
+		AS_POP_IF86(	bx)
+#endif
+#ifdef __GNUC__
+		ATT_PREFIX
+			:
+			: "a" (Whirlpool_C), "c" (digest), "d" (block)
+	#if CRYPTOPP_BOOL_X64
+			, "r" (workspace)
+	#endif
+			: "%esi", "%edi", "memory", "cc"
+	#if CRYPTOPP_BOOL_X64
+			, "%r9"
+	#endif
+		);
+#endif
+	}
+	else
+#endif		// #ifdef CRYPTOPP_X86_ASM_AVAILABLE
+	{
+	word64 s[8];	// the cipher state
+	word64 k[8];	// the round key
+
+	// Compute and apply K^0 to the cipher state
+	// Also apply part of the Miyaguchi-Preneel compression function
+	for (int i=0; i<8; i++)
+		digest[i] = s[i] = block[i] ^ (k[i] = digest[i]);
+
+#define KSL(op, i, a, b, c, d)	\
+	t = (word32)k[i];\
+	w##a = Whirlpool_C[3*256 + (byte)t] ^ (op ? w##a : 0);\
+	t >>= 8;\
+	w##b = Whirlpool_C[2*256 + (byte)t] ^ (op ? w##b : 0);\
+	t >>= 8;\
+	w##c = Whirlpool_C[1*256 + (byte)t] ^ (op ? w##c : 0);\
+	t >>= 8;\
+	w##d = Whirlpool_C[0*256 + t]       ^ (op ? w##d : 0);
+
+#define KSH(op, i, a, b, c, d)	\
+	t = (word32)(k[(i+4)%8]>>32);\
+	w##a = Whirlpool_C[3*256 + (byte)t] ^ (op ? w##a : rotrConstant<32>(w##a));\
+	if (op==2) k[a] = w##a;\
+	t >>= 8;\
+	w##b = Whirlpool_C[2*256 + (byte)t] ^ (op ? w##b : rotrConstant<32>(w##b));\
+	if (op==2) k[b] = w##b;\
+	t >>= 8;\
+	w##c = Whirlpool_C[1*256 + (byte)t] ^ (op ? w##c : rotrConstant<32>(w##c));\
+	if (op==2) k[c] = w##c;\
+	t >>= 8;\
+	w##d = Whirlpool_C[0*256 + t]       ^ (op ? w##d : rotrConstant<32>(w##d));\
+	if (op==2) k[d] = w##d;\
+
+#define TSL(op, i, a, b, c, d)	\
+	t = (word32)s[i];\
+	w##a = Whirlpool_C[3*256 + (byte)t] ^ (op ? w##a : 0);\
+	t >>= 8;\
+	w##b = Whirlpool_C[2*256 + (byte)t] ^ (op ? w##b : 0);\
+	t >>= 8;\
+	w##c = Whirlpool_C[1*256 + (byte)t] ^ (op ? w##c : 0);\
+	t >>= 8;\
+	w##d = Whirlpool_C[0*256 + t]       ^ (op ? w##d : 0);
+
+#define TSH_OP(op, a, b)	\
+	w##a = Whirlpool_C[b*256 + (byte)t] ^ (op ? w##a : rotrConstant<32>(w##a) ^ k[a]);\
+	if (op==2) s[a] = w##a;\
+	if (op==3) digest[a] ^= w##a;\
+
+#define TSH(op, i, a, b, c, d)	\
+	t = (word32)(s[(i+4)%8]>>32);\
+	TSH_OP(op, a, 3);\
+	t >>= 8;\
+	TSH_OP(op, b, 2);\
+	t >>= 8;\
+	TSH_OP(op, c, 1);\
+	t >>= 8;\
+	TSH_OP(op, d, 0);\
+
+	// Iterate over all rounds:
+	int r=0;
+	while (true)
+	{
+		// Added initialization due to Coverity findings.
+		word64 w0=0, w1=0, w2=0, w3=0, w4=0, w5=0, w6=0, w7=0;
+		word32 t=0;
+
+		KSL(0, 4, 3, 2, 1, 0)
+		KSL(0, 0, 7, 6, 5, 4)
+		KSL(1, 1, 0, 7, 6, 5)
+		KSL(1, 2, 1, 0, 7, 6)
+		KSL(1, 3, 2, 1, 0, 7)
+		KSL(1, 5, 4, 3, 2, 1)
+		KSL(1, 6, 5, 4, 3, 2)
+		KSL(1, 7, 6, 5, 4, 3)
+		KSH(0, 0, 7, 6, 5, 4)
+		KSH(0, 4, 3, 2, 1, 0)
+		KSH(1, 1, 0, 7, 6, 5)
+		KSH(1, 2, 1, 0, 7, 6)
+		KSH(1, 5, 4, 3, 2, 1)
+		KSH(1, 6, 5, 4, 3, 2)
+		KSH(2, 3, 2, 1, 0, 7)
+		KSH(2, 7, 6, 5, 4, 3)
+
+		k[0] ^= Whirlpool_C[1024+r];
+
+		TSL(0, 4, 3, 2, 1, 0)
+		TSL(0, 0, 7, 6, 5, 4)
+		TSL(1, 1, 0, 7, 6, 5)
+		TSL(1, 2, 1, 0, 7, 6)
+		TSL(1, 3, 2, 1, 0, 7)
+		TSL(1, 5, 4, 3, 2, 1)
+		TSL(1, 6, 5, 4, 3, 2)
+		TSL(1, 7, 6, 5, 4, 3)
+		TSH(0, 0, 7, 6, 5, 4)
+		TSH(0, 4, 3, 2, 1, 0)
+		TSH(1, 1, 0, 7, 6, 5)
+		TSH(1, 2, 1, 0, 7, 6)
+		TSH(1, 5, 4, 3, 2, 1)
+		TSH(1, 6, 5, 4, 3, 2)
+
+		if (++r < R)
+		{
+			TSH(2, 3, 2, 1, 0, 7)
+			TSH(2, 7, 6, 5, 4, 3)
+		}
+		else
+		{
+			TSH(3, 3, 2, 1, 0, 7)
+			TSH(3, 7, 6, 5, 4, 3)
+			break;
+		}
+	}
+	}
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/whrlpool.h b/runtime/third_party/cryptopp/whrlpool.h
new file mode 100644
index 0000000..d5b202f
--- /dev/null
+++ b/runtime/third_party/cryptopp/whrlpool.h
@@ -0,0 +1,42 @@
+// whrlpool.h - originally modified by Kevin Springle from Paulo Barreto and Vincent Rijmen's
+//              public domain code, whirlpool.c. Updated to Whirlpool version 3.0, optimized
+//              and SSE version added by WD. All modifications are placed in the public domain.
+
+#ifndef CRYPTOPP_WHIRLPOOL_H
+#define CRYPTOPP_WHIRLPOOL_H
+
+/// \file whrlpool.h
+/// \brief Classes for the Whirlpool message digest
+/// \details Crypto++ provides version 3.0 of the Whirlpool algorithm.
+///   This version of the algorithm was submitted for ISO standardization.
+
+#include "config.h"
+#include "iterhash.h"
+
+// Clang 3.3 integrated assembler crash on Linux. Clang 3.4 due to compiler
+// error with .intel_syntax, http://llvm.org/bugs/show_bug.cgi?id=24232
+#if CRYPTOPP_BOOL_X32 || defined(CRYPTOPP_DISABLE_MIXED_ASM)
+# define CRYPTOPP_DISABLE_WHIRLPOOL_ASM 1
+#endif
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Whirlpool message digest
+/// \details Crypto++ provides version 3.0 of the Whirlpool algorithm.
+///   This version of the algorithm was submitted for ISO standardization.
+/// \since Crypto++ 5.2
+/// \sa <a href="http://www.cryptopp.com/wiki/Whirlpool">Whirlpool</a>
+class Whirlpool : public IteratedHashWithStaticTransform<word64, BigEndian, 64, 64, Whirlpool>
+{
+public:
+	CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName() {return "Whirlpool";}
+	std::string AlgorithmProvider() const;
+
+	static void InitState(HashWordType *state);
+	static void Transform(word64 *digest, const word64 *data);
+	void TruncatedFinal(byte *hash, size_t size);
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/words.h b/runtime/third_party/cryptopp/words.h
new file mode 100644
index 0000000..a7ac199
--- /dev/null
+++ b/runtime/third_party/cryptopp/words.h
@@ -0,0 +1,225 @@
+// words.h - originally written and placed in the public domain by Wei Dai
+
+/// \file words.h
+/// \brief Support functions for word operations
+
+#ifndef CRYPTOPP_WORDS_H
+#define CRYPTOPP_WORDS_H
+
+#include "config.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Count the number of words
+/// \param x word array
+/// \param n size of the word array, in elements
+/// \return number of words used in the array.
+/// \details CountWords counts the number of words in a word array.
+///  Leading 0-words are not included in the count.
+/// \since Crypto++ 1.0
+inline size_t CountWords(const word *x, size_t n)
+{
+	while (n && x[n-1]==0)
+		n--;
+	return n;
+}
+
+/// \brief Set the value of words
+/// \param r word array
+/// \param a value
+/// \param n size of the word array, in elements
+/// \details SetWords sets all elements in the word array to the
+///  specified value.
+/// \since Crypto++ 1.0
+inline void SetWords(word *r, word a, size_t n)
+{
+	for (size_t i=0; i<n; i++)
+		r[i] = a;
+}
+
+/// \brief Copy word array
+/// \param r destination word array
+/// \param a source word array
+/// \param n size of the word array, in elements
+/// \details CopyWords copies the source word array to the destination
+///  word array.
+/// \since Crypto++ 1.0
+inline void CopyWords(word *r, const word *a, size_t n)
+{
+	if (r != a)
+#if CRYPTOPP_MSC_VERSION
+		memcpy_s(r, n*WORD_SIZE, a, n*WORD_SIZE);
+#else
+		std::memcpy(r, a, n*WORD_SIZE);
+#endif
+}
+
+/// \brief XOR word arrays
+/// \param r destination word array
+/// \param a first source word array
+/// \param b second source word array
+/// \param n size of the word array, in elements
+/// \details XorWords XORs the two source word arrays and copies the
+///  result to the destination word array.
+/// \since Crypto++ 1.0
+inline void XorWords(word *r, const word *a, const word *b, size_t n)
+{
+	for (size_t i=0; i<n; i++)
+		r[i] = a[i] ^ b[i];
+}
+
+/// \brief XOR word arrays
+/// \param r destination word array
+/// \param a source word array
+/// \param n size of the word array, in elements
+/// \details XorWords XORs the source word array with the
+///  destination word array.
+/// \since Crypto++ 1.0
+inline void XorWords(word *r, const word *a, size_t n)
+{
+	for (size_t i=0; i<n; i++)
+		r[i] ^= a[i];
+}
+
+/// \brief AND word arrays
+/// \param r destination word array
+/// \param a first source word array
+/// \param b second source word array
+/// \param n size of the word array, in elements
+/// \details AndWords ANDs the two source word arrays and copies the
+///  result to the destination word array.
+/// \since Crypto++ 1.0
+inline void AndWords(word *r, const word *a, const word *b, size_t n)
+{
+	for (size_t i=0; i<n; i++)
+		r[i] = a[i] & b[i];
+}
+
+/// \brief AND word arrays
+/// \param r destination word array
+/// \param a source word array
+/// \param n size of the word array, in elements
+/// \details AndWords ANDs the source word array with the
+///  destination word array.
+/// \since Crypto++ 1.0
+inline void AndWords(word *r, const word *a, size_t n)
+{
+	for (size_t i=0; i<n; i++)
+		r[i] &= a[i];
+}
+
+/// \brief OR word arrays
+/// \param r destination word array
+/// \param a first source word array
+/// \param b second source word array
+/// \param n size of the word array, in elements
+/// \details OrWords ORs the two source word arrays and copies the
+///  result to the destination word array.
+/// \since Crypto++ 1.0
+inline void OrWords(word *r, const word *a, const word *b, size_t n)
+{
+	for (size_t i=0; i<n; i++)
+		r[i] = a[i] | b[i];
+}
+
+/// \brief OR word arrays
+/// \param r destination word array
+/// \param a source word array
+/// \param n size of the word array, in elements
+/// \details OrWords ORs the source word array with the
+///  destination word array.
+/// \since Crypto++ 1.0
+inline void OrWords(word *r, const word *a, size_t n)
+{
+	for (size_t i=0; i<n; i++)
+		r[i] |= a[i];
+}
+
+/// \brief Left shift word array
+/// \param r word array
+/// \param n size of the word array, in elements
+/// \param shiftBits number of bits to shift
+/// \return word shifted out
+/// \details ShiftWordsLeftByBits shifts the word array left by
+///  shiftBits. ShiftWordsLeftByBits shifts bits out on the left;
+///  it does not extend the array.
+/// \note shiftBits must be less than WORD_BITS.
+/// \since Crypto++ 1.0
+inline word ShiftWordsLeftByBits(word *r, size_t n, unsigned int shiftBits)
+{
+	CRYPTOPP_ASSERT (shiftBits<WORD_BITS);
+	word u, carry=0;
+	if (shiftBits)
+		for (size_t i=0; i<n; i++)
+		{
+			u = r[i];
+			r[i] = (u << shiftBits) | carry;
+			carry = u >> (WORD_BITS-shiftBits);
+		}
+	return carry;
+}
+
+/// \brief Right shift word array
+/// \param r word array
+/// \param n size of the word array, in elements
+/// \param shiftBits number of bits to shift
+/// \return word shifted out
+/// \details ShiftWordsRightByBits shifts the word array shight by
+///  shiftBits. ShiftWordsRightByBits shifts bits out on the right.
+/// \note shiftBits must be less than WORD_BITS.
+/// \since Crypto++ 1.0
+inline word ShiftWordsRightByBits(word *r, size_t n, unsigned int shiftBits)
+{
+	CRYPTOPP_ASSERT (shiftBits<WORD_BITS);
+	word u, carry=0;
+	if (shiftBits)
+		for (size_t i=n; i>0; i--)
+		{
+			u = r[i-1];
+			r[i-1] = (u >> shiftBits) | carry;
+			carry = u << (WORD_BITS-shiftBits);
+		}
+	return carry;
+}
+
+/// \brief Left shift word array
+/// \param r word array
+/// \param n size of the word array, in elements
+/// \param shiftWords number of words to shift
+/// \details ShiftWordsLeftByWords shifts the word array left by
+///  shiftWords. ShiftWordsLeftByWords shifts bits out on the left;
+///  it does not extend the array.
+/// \since Crypto++ 1.0
+inline void ShiftWordsLeftByWords(word *r, size_t n, size_t shiftWords)
+{
+	shiftWords = STDMIN(shiftWords, n);
+	if (shiftWords)
+	{
+		for (size_t i=n-1; i>=shiftWords; i--)
+			r[i] = r[i-shiftWords];
+		SetWords(r, 0, shiftWords);
+	}
+}
+
+/// \brief Right shift word array
+/// \param r word array
+/// \param n size of the word array, in elements
+/// \param shiftWords number of words to shift
+/// \details ShiftWordsRightByWords shifts the word array right by
+///  shiftWords. ShiftWordsRightByWords shifts bits out on the right.
+/// \since Crypto++ 1.0
+inline void ShiftWordsRightByWords(word *r, size_t n, size_t shiftWords)
+{
+	shiftWords = STDMIN(shiftWords, n);
+	if (shiftWords)
+	{
+		for (size_t i=0; i+shiftWords<n; i++)
+			r[i] = r[i+shiftWords];
+		SetWords(r+n-shiftWords, 0, shiftWords);
+	}
+}
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/x64dll.asm b/runtime/third_party/cryptopp/x64dll.asm
new file mode 100644
index 0000000..2ed6105
--- /dev/null
+++ b/runtime/third_party/cryptopp/x64dll.asm
@@ -0,0 +1,2024 @@
+;; https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention
+;; The first four integer arguments are passed in registers.
+;; Integer values are passed in left-to-right order in RCX,
+;; RDX, R8, and R9, respectively. Arguments five and higher
+;; are passed on the stack.
+
+;; The registers RAX, RCX, RDX, R8, R9, R10, R11, XMM0-5,
+;; and the upper portions of YMM0-15 and ZMM0-15 are
+;; considered volatile and must be considered destroyed on
+;; function calls.
+
+include ksamd64.inc
+EXTERNDEF ?Te@rdtable@CryptoPP@@3PA_KA:FAR
+EXTERNDEF ?g_cacheLineSize@CryptoPP@@3IA:FAR
+EXTERNDEF ?SHA256_K@CryptoPP@@3QBIB:FAR
+.CODE
+
+    ALIGN   8
+Baseline_Add	PROC
+	lea		rdx, [rdx+8*rcx]
+	lea		r8, [r8+8*rcx]
+	lea		r9, [r9+8*rcx]
+	neg		rcx					; rcx is negative index
+	jz		$1@Baseline_Add
+	mov		rax,[r8+8*rcx]
+	add		rax,[r9+8*rcx]
+	mov		[rdx+8*rcx],rax
+$0@Baseline_Add:
+	mov		rax,[r8+8*rcx+8]
+	adc		rax,[r9+8*rcx+8]
+	mov		[rdx+8*rcx+8],rax
+	lea		rcx,[rcx+2]			; advance index, avoid inc which causes slowdown on Intel Core 2
+	jrcxz	$1@Baseline_Add		; loop until rcx overflows and becomes zero
+	mov		rax,[r8+8*rcx]
+	adc		rax,[r9+8*rcx]
+	mov		[rdx+8*rcx],rax
+	jmp		$0@Baseline_Add
+$1@Baseline_Add:
+	mov		rax, 0
+	adc		rax, rax			; store carry into rax (return result register)
+	ret
+Baseline_Add ENDP
+
+    ALIGN   8
+Baseline_Sub	PROC
+	lea		rdx, [rdx+8*rcx]
+	lea		r8, [r8+8*rcx]
+	lea		r9, [r9+8*rcx]
+	neg		rcx					; rcx is negative index
+	jz		$1@Baseline_Sub
+	mov		rax,[r8+8*rcx]
+	sub		rax,[r9+8*rcx]
+	mov		[rdx+8*rcx],rax
+$0@Baseline_Sub:
+	mov		rax,[r8+8*rcx+8]
+	sbb		rax,[r9+8*rcx+8]
+	mov		[rdx+8*rcx+8],rax
+	lea		rcx,[rcx+2]			; advance index, avoid inc which causes slowdown on Intel Core 2
+	jrcxz	$1@Baseline_Sub		; loop until rcx overflows and becomes zero
+	mov		rax,[r8+8*rcx]
+	sbb		rax,[r9+8*rcx]
+	mov		[rdx+8*rcx],rax
+	jmp		$0@Baseline_Sub
+$1@Baseline_Sub:
+	mov		rax, 0
+	adc		rax, rax			; store carry into rax (return result register)
+
+	ret
+Baseline_Sub ENDP
+
+ALIGN   8
+Rijndael_Enc_AdvancedProcessBlocks_SSE2	PROC FRAME
+rex_push_reg rsi
+push_reg rdi
+push_reg rbx
+push_reg r12
+.endprolog
+mov r8, rcx
+mov r11, ?Te@rdtable@CryptoPP@@3PA_KA
+mov edi, DWORD PTR [?g_cacheLineSize@CryptoPP@@3IA]
+mov rsi, [(r8+16*19)]
+mov rax, 16
+and rax, rsi
+movdqa xmm3, XMMWORD PTR [rdx+16+rax]
+movdqa [(r8+16*12)], xmm3
+lea rax, [rdx+rax+2*16]
+sub rax, rsi
+label0:
+movdqa xmm0, [rax+rsi]
+movdqa XMMWORD PTR [(r8+0)+rsi], xmm0
+add rsi, 16
+cmp rsi, 16*12
+jl label0
+movdqa xmm4, [rax+rsi]
+movdqa xmm1, [rdx]
+mov r12d, [rdx+4*4]
+mov ebx, [rdx+5*4]
+mov ecx, [rdx+6*4]
+mov edx, [rdx+7*4]
+xor rax, rax
+label9:
+mov esi, [r11+rax]
+add rax, rdi
+mov esi, [r11+rax]
+add rax, rdi
+mov esi, [r11+rax]
+add rax, rdi
+mov esi, [r11+rax]
+add rax, rdi
+cmp rax, 2048
+jl label9
+lfence
+test DWORD PTR [(r8+16*18+8)], 1
+jz label8
+mov rsi, [(r8+16*14)]
+movdqu xmm2, [rsi]
+pxor xmm2, xmm1
+psrldq xmm1, 14
+movd eax, xmm1
+mov al, BYTE PTR [rsi+15]
+mov r10d, eax
+movd eax, xmm2
+psrldq xmm2, 4
+movd edi, xmm2
+psrldq xmm2, 4
+movzx esi, al
+xor r12d, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ah
+xor edx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, al
+xor ecx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+movzx esi, ah
+xor ebx, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+mov eax, edi
+movd edi, xmm2
+psrldq xmm2, 4
+movzx esi, al
+xor ebx, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ah
+xor r12d, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, al
+xor edx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+movzx esi, ah
+xor ecx, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+mov eax, edi
+movd edi, xmm2
+movzx esi, al
+xor ecx, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ah
+xor ebx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, al
+xor r12d, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+movzx esi, ah
+xor edx, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+mov eax, edi
+movzx esi, al
+xor edx, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ah
+xor ecx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, al
+xor ebx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+psrldq xmm2, 3
+mov eax, [(r8+16*12)+0*4]
+mov edi, [(r8+16*12)+2*4]
+mov r9d, [(r8+16*12)+3*4]
+movzx esi, cl
+xor r9d, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+movzx esi, bl
+xor edi, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+movzx esi, bh
+xor r9d, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr ebx, 16
+movzx esi, bl
+xor eax, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, bh
+mov ebx, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+xor ebx, [(r8+16*12)+1*4]
+movzx esi, ch
+xor eax, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr ecx, 16
+movzx esi, dl
+xor eax, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+movzx esi, dh
+xor ebx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr edx, 16
+movzx esi, ch
+xor edi, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, cl
+xor ebx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, dl
+xor edi, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, dh
+xor r9d, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movd ecx, xmm2
+mov edx, r12d
+mov [(r8+0)+3*4], r9d
+mov [(r8+0)+0*4], eax
+mov [(r8+0)+1*4], ebx
+mov [(r8+0)+2*4], edi
+jmp label5
+label3:
+mov r12d, [(r8+16*12)+0*4]
+mov ebx, [(r8+16*12)+1*4]
+mov ecx, [(r8+16*12)+2*4]
+mov edx, [(r8+16*12)+3*4]
+label8:
+mov rax, [(r8+16*14)]
+movdqu xmm2, [rax]
+mov rsi, [(r8+16*14)+8]
+movdqu xmm5, [rsi]
+pxor xmm2, xmm1
+pxor xmm2, xmm5
+movd eax, xmm2
+psrldq xmm2, 4
+movd edi, xmm2
+psrldq xmm2, 4
+movzx esi, al
+xor r12d, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ah
+xor edx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, al
+xor ecx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+movzx esi, ah
+xor ebx, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+mov eax, edi
+movd edi, xmm2
+psrldq xmm2, 4
+movzx esi, al
+xor ebx, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ah
+xor r12d, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, al
+xor edx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+movzx esi, ah
+xor ecx, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+mov eax, edi
+movd edi, xmm2
+movzx esi, al
+xor ecx, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ah
+xor ebx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, al
+xor r12d, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+movzx esi, ah
+xor edx, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+mov eax, edi
+movzx esi, al
+xor edx, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ah
+xor ecx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, al
+xor ebx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+movzx esi, ah
+xor r12d, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+mov eax, r12d
+add r8, [(r8+16*19)]
+add r8, 4*16
+jmp label2
+label1:
+mov ecx, r10d
+mov edx, r12d
+mov eax, [(r8+0)+0*4]
+mov ebx, [(r8+0)+1*4]
+xor cl, ch
+and rcx, 255
+label5:
+add r10d, 1
+xor edx, DWORD PTR [r11+rcx*8+3]
+movzx esi, dl
+xor ebx, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+movzx esi, dh
+mov ecx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr edx, 16
+xor ecx, [(r8+0)+2*4]
+movzx esi, dh
+xor eax, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, dl
+mov edx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+xor edx, [(r8+0)+3*4]
+add r8, [(r8+16*19)]
+add r8, 3*16
+jmp label4
+label2:
+mov r9d, [(r8+0)-4*16+3*4]
+mov edi, [(r8+0)-4*16+2*4]
+movzx esi, cl
+xor r9d, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+mov cl, al
+movzx esi, ah
+xor edi, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, bl
+xor edi, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+movzx esi, bh
+xor r9d, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr ebx, 16
+movzx esi, al
+xor r9d, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, ah
+mov eax, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, bl
+xor eax, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, bh
+mov ebx, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ch
+xor eax, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+movzx esi, cl
+xor ebx, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+shr ecx, 16
+movzx esi, dl
+xor eax, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+movzx esi, dh
+xor ebx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr edx, 16
+movzx esi, ch
+xor edi, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, cl
+xor ebx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, dl
+xor edi, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, dh
+xor r9d, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+mov ecx, edi
+xor eax, [(r8+0)-4*16+0*4]
+xor ebx, [(r8+0)-4*16+1*4]
+mov edx, r9d
+label4:
+mov r9d, [(r8+0)-4*16+7*4]
+mov edi, [(r8+0)-4*16+6*4]
+movzx esi, cl
+xor r9d, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+mov cl, al
+movzx esi, ah
+xor edi, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr eax, 16
+movzx esi, bl
+xor edi, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+movzx esi, bh
+xor r9d, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr ebx, 16
+movzx esi, al
+xor r9d, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, ah
+mov eax, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, bl
+xor eax, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, bh
+mov ebx, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, ch
+xor eax, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+movzx esi, cl
+xor ebx, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+shr ecx, 16
+movzx esi, dl
+xor eax, DWORD PTR [r11+8*rsi+(((3+3) MOD (4))+1)]
+movzx esi, dh
+xor ebx, DWORD PTR [r11+8*rsi+(((2+3) MOD (4))+1)]
+shr edx, 16
+movzx esi, ch
+xor edi, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+movzx esi, cl
+xor ebx, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, dl
+xor edi, DWORD PTR [r11+8*rsi+(((1+3) MOD (4))+1)]
+movzx esi, dh
+xor r9d, DWORD PTR [r11+8*rsi+(((0+3) MOD (4))+1)]
+mov ecx, edi
+xor eax, [(r8+0)-4*16+4*4]
+xor ebx, [(r8+0)-4*16+5*4]
+mov edx, r9d
+add r8, 32
+test r8, 255
+jnz label2
+sub r8, 16*16
+movzx esi, ch
+movzx edi, BYTE PTR [r11+rsi*8+1]
+movzx esi, dl
+xor edi, DWORD PTR [r11+rsi*8+0]
+mov WORD PTR [(r8+16*13)+2], di
+movzx esi, dh
+movzx edi, BYTE PTR [r11+rsi*8+1]
+movzx esi, al
+xor edi, DWORD PTR [r11+rsi*8+0]
+mov WORD PTR [(r8+16*13)+6], di
+shr edx, 16
+movzx esi, ah
+movzx edi, BYTE PTR [r11+rsi*8+1]
+movzx esi, bl
+xor edi, DWORD PTR [r11+rsi*8+0]
+mov WORD PTR [(r8+16*13)+10], di
+shr eax, 16
+movzx esi, bh
+movzx edi, BYTE PTR [r11+rsi*8+1]
+movzx esi, cl
+xor edi, DWORD PTR [r11+rsi*8+0]
+mov WORD PTR [(r8+16*13)+14], di
+shr ebx, 16
+movzx esi, dh
+movzx edi, BYTE PTR [r11+rsi*8+1]
+movzx esi, al
+xor edi, DWORD PTR [r11+rsi*8+0]
+mov WORD PTR [(r8+16*13)+12], di
+shr ecx, 16
+movzx esi, ah
+movzx edi, BYTE PTR [r11+rsi*8+1]
+movzx esi, bl
+xor edi, DWORD PTR [r11+rsi*8+0]
+mov WORD PTR [(r8+16*13)+0], di
+movzx esi, bh
+movzx edi, BYTE PTR [r11+rsi*8+1]
+movzx esi, cl
+xor edi, DWORD PTR [r11+rsi*8+0]
+mov WORD PTR [(r8+16*13)+4], di
+movzx esi, ch
+movzx edi, BYTE PTR [r11+rsi*8+1]
+movzx esi, dl
+xor edi, DWORD PTR [r11+rsi*8+0]
+mov WORD PTR [(r8+16*13)+8], di
+mov rax, [(r8+16*14)+16]
+mov rbx, [(r8+16*14)+24]
+mov rcx, [(r8+16*18+8)]
+sub rcx, 16
+movdqu xmm2, [rax]
+pxor xmm2, xmm4
+movdqa xmm0, [(r8+16*16)+16]
+paddq xmm0, [(r8+16*14)+16]
+movdqa [(r8+16*14)+16], xmm0
+pxor xmm2, [(r8+16*13)]
+movdqu [rbx], xmm2
+jle label7
+mov [(r8+16*18+8)], rcx
+test rcx, 1
+jnz label1
+movdqa xmm0, [(r8+16*16)]
+paddq xmm0, [(r8+16*14)]
+movdqa [(r8+16*14)], xmm0
+jmp label3
+label7:
+xorps xmm0, xmm0
+lea rax, [(r8+0)+7*16]
+movaps [rax-7*16], xmm0
+movaps [rax-6*16], xmm0
+movaps [rax-5*16], xmm0
+movaps [rax-4*16], xmm0
+movaps [rax-3*16], xmm0
+movaps [rax-2*16], xmm0
+movaps [rax-1*16], xmm0
+movaps [rax+0*16], xmm0
+movaps [rax+1*16], xmm0
+movaps [rax+2*16], xmm0
+movaps [rax+3*16], xmm0
+movaps [rax+4*16], xmm0
+movaps [rax+5*16], xmm0
+movaps [rax+6*16], xmm0
+pop r12
+pop rbx
+pop rdi
+pop rsi
+ret
+Rijndael_Enc_AdvancedProcessBlocks_SSE2 ENDP
+
+ALIGN   8
+GCM_AuthenticateBlocks_2K_SSE2	PROC FRAME
+rex_push_reg rsi
+push_reg rdi
+push_reg rbx
+.endprolog
+mov rsi, r8
+mov r11, r9
+movdqa xmm0, [rsi]
+label0:
+movdqu xmm4, [rcx]
+pxor xmm0, xmm4
+movd ebx, xmm0
+mov eax, 0f0f0f0f0h
+and eax, ebx
+shl ebx, 4
+and ebx, 0f0f0f0f0h
+movzx edi, ah
+movdqa xmm5, XMMWORD PTR [rsi + 32 + 1024 + rdi]
+movzx edi, al
+movdqa xmm4, XMMWORD PTR [rsi + 32 + 1024 + rdi]
+shr eax, 16
+movzx edi, ah
+movdqa xmm3, XMMWORD PTR [rsi + 32 + 1024 + rdi]
+movzx edi, al
+movdqa xmm2, XMMWORD PTR [rsi + 32 + 1024 + rdi]
+psrldq xmm0, 4
+movd eax, xmm0
+and eax, 0f0f0f0f0h
+movzx edi, bh
+pxor xmm5, XMMWORD PTR [rsi + 32 + (1-1)*256 + rdi]
+movzx edi, bl
+pxor xmm4, XMMWORD PTR [rsi + 32 + (1-1)*256 + rdi]
+shr ebx, 16
+movzx edi, bh
+pxor xmm3, XMMWORD PTR [rsi + 32 + (1-1)*256 + rdi]
+movzx edi, bl
+pxor xmm2, XMMWORD PTR [rsi + 32 + (1-1)*256 + rdi]
+movd ebx, xmm0
+shl ebx, 4
+and ebx, 0f0f0f0f0h
+movzx edi, ah
+pxor xmm5, XMMWORD PTR [rsi + 32 + 1024 + 1*256 + rdi]
+movzx edi, al
+pxor xmm4, XMMWORD PTR [rsi + 32 + 1024 + 1*256 + rdi]
+shr eax, 16
+movzx edi, ah
+pxor xmm3, XMMWORD PTR [rsi + 32 + 1024 + 1*256 + rdi]
+movzx edi, al
+pxor xmm2, XMMWORD PTR [rsi + 32 + 1024 + 1*256 + rdi]
+psrldq xmm0, 4
+movd eax, xmm0
+and eax, 0f0f0f0f0h
+movzx edi, bh
+pxor xmm5, XMMWORD PTR [rsi + 32 + (2-1)*256 + rdi]
+movzx edi, bl
+pxor xmm4, XMMWORD PTR [rsi + 32 + (2-1)*256 + rdi]
+shr ebx, 16
+movzx edi, bh
+pxor xmm3, XMMWORD PTR [rsi + 32 + (2-1)*256 + rdi]
+movzx edi, bl
+pxor xmm2, XMMWORD PTR [rsi + 32 + (2-1)*256 + rdi]
+movd ebx, xmm0
+shl ebx, 4
+and ebx, 0f0f0f0f0h
+movzx edi, ah
+pxor xmm5, XMMWORD PTR [rsi + 32 + 1024 + 2*256 + rdi]
+movzx edi, al
+pxor xmm4, XMMWORD PTR [rsi + 32 + 1024 + 2*256 + rdi]
+shr eax, 16
+movzx edi, ah
+pxor xmm3, XMMWORD PTR [rsi + 32 + 1024 + 2*256 + rdi]
+movzx edi, al
+pxor xmm2, XMMWORD PTR [rsi + 32 + 1024 + 2*256 + rdi]
+psrldq xmm0, 4
+movd eax, xmm0
+and eax, 0f0f0f0f0h
+movzx edi, bh
+pxor xmm5, XMMWORD PTR [rsi + 32 + (3-1)*256 + rdi]
+movzx edi, bl
+pxor xmm4, XMMWORD PTR [rsi + 32 + (3-1)*256 + rdi]
+shr ebx, 16
+movzx edi, bh
+pxor xmm3, XMMWORD PTR [rsi + 32 + (3-1)*256 + rdi]
+movzx edi, bl
+pxor xmm2, XMMWORD PTR [rsi + 32 + (3-1)*256 + rdi]
+movd ebx, xmm0
+shl ebx, 4
+and ebx, 0f0f0f0f0h
+movzx edi, ah
+pxor xmm5, XMMWORD PTR [rsi + 32 + 1024 + 3*256 + rdi]
+movzx edi, al
+pxor xmm4, XMMWORD PTR [rsi + 32 + 1024 + 3*256 + rdi]
+shr eax, 16
+movzx edi, ah
+pxor xmm3, XMMWORD PTR [rsi + 32 + 1024 + 3*256 + rdi]
+movzx edi, al
+pxor xmm2, XMMWORD PTR [rsi + 32 + 1024 + 3*256 + rdi]
+movzx edi, bh
+pxor xmm5, XMMWORD PTR [rsi + 32 + 3*256 + rdi]
+movzx edi, bl
+pxor xmm4, XMMWORD PTR [rsi + 32 + 3*256 + rdi]
+shr ebx, 16
+movzx edi, bh
+pxor xmm3, XMMWORD PTR [rsi + 32 + 3*256 + rdi]
+movzx edi, bl
+pxor xmm2, XMMWORD PTR [rsi + 32 + 3*256 + rdi]
+movdqa xmm0, xmm3
+pslldq xmm3, 1
+pxor xmm2, xmm3
+movdqa xmm1, xmm2
+pslldq xmm2, 1
+pxor xmm5, xmm2
+psrldq xmm0, 15
+movd rdi, xmm0
+movzx eax, WORD PTR [r11 + rdi*2]
+shl eax, 8
+movdqa xmm0, xmm5
+pslldq xmm5, 1
+pxor xmm4, xmm5
+psrldq xmm1, 15
+movd rdi, xmm1
+xor ax, WORD PTR [r11 + rdi*2]
+shl eax, 8
+psrldq xmm0, 15
+movd rdi, xmm0
+xor ax, WORD PTR [r11 + rdi*2]
+movd xmm0, eax
+pxor xmm0, xmm4
+add rcx, 16
+sub rdx, 1
+jnz label0
+movdqa [rsi], xmm0
+pop rbx
+pop rdi
+pop rsi
+ret
+GCM_AuthenticateBlocks_2K_SSE2 ENDP
+
+ALIGN   8
+GCM_AuthenticateBlocks_64K_SSE2	PROC FRAME
+rex_push_reg rsi
+push_reg rdi
+.endprolog
+mov rsi, r8
+movdqa xmm0, [rsi]
+label1:
+movdqu xmm1, [rcx]
+pxor xmm1, xmm0
+pxor xmm0, xmm0
+movd eax, xmm1
+psrldq xmm1, 4
+movzx edi, al
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (0*4+0)*256*16 + rdi*8]
+movzx edi, ah
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (0*4+1)*256*16 + rdi*8]
+shr eax, 16
+movzx edi, al
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (0*4+2)*256*16 + rdi*8]
+movzx edi, ah
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (0*4+3)*256*16 + rdi*8]
+movd eax, xmm1
+psrldq xmm1, 4
+movzx edi, al
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (1*4+0)*256*16 + rdi*8]
+movzx edi, ah
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (1*4+1)*256*16 + rdi*8]
+shr eax, 16
+movzx edi, al
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (1*4+2)*256*16 + rdi*8]
+movzx edi, ah
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (1*4+3)*256*16 + rdi*8]
+movd eax, xmm1
+psrldq xmm1, 4
+movzx edi, al
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (2*4+0)*256*16 + rdi*8]
+movzx edi, ah
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (2*4+1)*256*16 + rdi*8]
+shr eax, 16
+movzx edi, al
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (2*4+2)*256*16 + rdi*8]
+movzx edi, ah
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (2*4+3)*256*16 + rdi*8]
+movd eax, xmm1
+psrldq xmm1, 4
+movzx edi, al
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (3*4+0)*256*16 + rdi*8]
+movzx edi, ah
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (3*4+1)*256*16 + rdi*8]
+shr eax, 16
+movzx edi, al
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (3*4+2)*256*16 + rdi*8]
+movzx edi, ah
+add rdi, rdi
+pxor xmm0, [rsi + 32 + (3*4+3)*256*16 + rdi*8]
+add rcx, 16
+sub rdx, 1
+jnz label1
+movdqa [rsi], xmm0
+pop rdi
+pop rsi
+ret
+GCM_AuthenticateBlocks_64K_SSE2 ENDP
+
+ALIGN   8
+SHA256_HashMultipleBlocks_SSE2	PROC FRAME
+rex_push_reg rsi
+push_reg rdi
+push_reg rbx
+push_reg rbp
+alloc_stack(8*4 + 16*4 + 4*8 + 8)
+.endprolog
+mov rdi, r8
+lea rsi, [?SHA256_K@CryptoPP@@3QBIB + 48*4]
+mov [rsp+8*4+16*4+1*8], rcx
+mov [rsp+8*4+16*4+2*8], rdx
+add rdi, rdx
+mov [rsp+8*4+16*4+3*8], rdi
+movdqa xmm0, XMMWORD PTR [rcx+0*16]
+movdqa xmm1, XMMWORD PTR [rcx+1*16]
+mov [rsp+8*4+16*4+0*8], rsi
+label0:
+sub rsi, 48*4
+movdqa [rsp+((1024+7-(0+3)) MOD (8))*4], xmm1
+movdqa [rsp+((1024+7-(0+7)) MOD (8))*4], xmm0
+mov rbx, [rdx+0*8]
+bswap rbx
+mov [rsp+8*4+((1024+15-(0*(1+1)+1)) MOD (16))*4], rbx
+mov rbx, [rdx+1*8]
+bswap rbx
+mov [rsp+8*4+((1024+15-(1*(1+1)+1)) MOD (16))*4], rbx
+mov rbx, [rdx+2*8]
+bswap rbx
+mov [rsp+8*4+((1024+15-(2*(1+1)+1)) MOD (16))*4], rbx
+mov rbx, [rdx+3*8]
+bswap rbx
+mov [rsp+8*4+((1024+15-(3*(1+1)+1)) MOD (16))*4], rbx
+mov rbx, [rdx+4*8]
+bswap rbx
+mov [rsp+8*4+((1024+15-(4*(1+1)+1)) MOD (16))*4], rbx
+mov rbx, [rdx+5*8]
+bswap rbx
+mov [rsp+8*4+((1024+15-(5*(1+1)+1)) MOD (16))*4], rbx
+mov rbx, [rdx+6*8]
+bswap rbx
+mov [rsp+8*4+((1024+15-(6*(1+1)+1)) MOD (16))*4], rbx
+mov rbx, [rdx+7*8]
+bswap rbx
+mov [rsp+8*4+((1024+15-(7*(1+1)+1)) MOD (16))*4], rbx
+mov edi, [rsp+((1024+7-(0+3)) MOD (8))*4]
+mov eax, [rsp+((1024+7-(0+6)) MOD (8))*4]
+xor eax, [rsp+((1024+7-(0+5)) MOD (8))*4]
+mov ecx, [rsp+((1024+7-(0+7)) MOD (8))*4]
+mov edx, [rsp+((1024+7-(0+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(0+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(0+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+add edx, [rsi+(0)*4]
+add edx, [rsp+8*4+((1024+15-(0)) MOD (16))*4]
+add edx, [rsp+((1024+7-(0)) MOD (8))*4]
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(0+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(0+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(0+4)) MOD (8))*4]
+mov [rsp+((1024+7-(0+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(0)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(1+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(1+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(1+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+add edi, [rsi+(1)*4]
+add edi, [rsp+8*4+((1024+15-(1)) MOD (16))*4]
+add edi, [rsp+((1024+7-(1)) MOD (8))*4]
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(1+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(1+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(1+4)) MOD (8))*4]
+mov [rsp+((1024+7-(1+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(1)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(2+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(2+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(2+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+add edx, [rsi+(2)*4]
+add edx, [rsp+8*4+((1024+15-(2)) MOD (16))*4]
+add edx, [rsp+((1024+7-(2)) MOD (8))*4]
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(2+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(2+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(2+4)) MOD (8))*4]
+mov [rsp+((1024+7-(2+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(2)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(3+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(3+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(3+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+add edi, [rsi+(3)*4]
+add edi, [rsp+8*4+((1024+15-(3)) MOD (16))*4]
+add edi, [rsp+((1024+7-(3)) MOD (8))*4]
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(3+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(3+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(3+4)) MOD (8))*4]
+mov [rsp+((1024+7-(3+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(3)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(4+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(4+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(4+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+add edx, [rsi+(4)*4]
+add edx, [rsp+8*4+((1024+15-(4)) MOD (16))*4]
+add edx, [rsp+((1024+7-(4)) MOD (8))*4]
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(4+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(4+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(4+4)) MOD (8))*4]
+mov [rsp+((1024+7-(4+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(4)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(5+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(5+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(5+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+add edi, [rsi+(5)*4]
+add edi, [rsp+8*4+((1024+15-(5)) MOD (16))*4]
+add edi, [rsp+((1024+7-(5)) MOD (8))*4]
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(5+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(5+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(5+4)) MOD (8))*4]
+mov [rsp+((1024+7-(5+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(5)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(6+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(6+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(6+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+add edx, [rsi+(6)*4]
+add edx, [rsp+8*4+((1024+15-(6)) MOD (16))*4]
+add edx, [rsp+((1024+7-(6)) MOD (8))*4]
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(6+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(6+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(6+4)) MOD (8))*4]
+mov [rsp+((1024+7-(6+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(6)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(7+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(7+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(7+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+add edi, [rsi+(7)*4]
+add edi, [rsp+8*4+((1024+15-(7)) MOD (16))*4]
+add edi, [rsp+((1024+7-(7)) MOD (8))*4]
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(7+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(7+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(7+4)) MOD (8))*4]
+mov [rsp+((1024+7-(7+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(7)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(8+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(8+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(8+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+add edx, [rsi+(8)*4]
+add edx, [rsp+8*4+((1024+15-(8)) MOD (16))*4]
+add edx, [rsp+((1024+7-(8)) MOD (8))*4]
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(8+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(8+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(8+4)) MOD (8))*4]
+mov [rsp+((1024+7-(8+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(8)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(9+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(9+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(9+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+add edi, [rsi+(9)*4]
+add edi, [rsp+8*4+((1024+15-(9)) MOD (16))*4]
+add edi, [rsp+((1024+7-(9)) MOD (8))*4]
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(9+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(9+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(9+4)) MOD (8))*4]
+mov [rsp+((1024+7-(9+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(9)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(10+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(10+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(10+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+add edx, [rsi+(10)*4]
+add edx, [rsp+8*4+((1024+15-(10)) MOD (16))*4]
+add edx, [rsp+((1024+7-(10)) MOD (8))*4]
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(10+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(10+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(10+4)) MOD (8))*4]
+mov [rsp+((1024+7-(10+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(10)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(11+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(11+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(11+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+add edi, [rsi+(11)*4]
+add edi, [rsp+8*4+((1024+15-(11)) MOD (16))*4]
+add edi, [rsp+((1024+7-(11)) MOD (8))*4]
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(11+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(11+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(11+4)) MOD (8))*4]
+mov [rsp+((1024+7-(11+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(11)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(12+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(12+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(12+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+add edx, [rsi+(12)*4]
+add edx, [rsp+8*4+((1024+15-(12)) MOD (16))*4]
+add edx, [rsp+((1024+7-(12)) MOD (8))*4]
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(12+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(12+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(12+4)) MOD (8))*4]
+mov [rsp+((1024+7-(12+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(12)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(13+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(13+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(13+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+add edi, [rsi+(13)*4]
+add edi, [rsp+8*4+((1024+15-(13)) MOD (16))*4]
+add edi, [rsp+((1024+7-(13)) MOD (8))*4]
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(13+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(13+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(13+4)) MOD (8))*4]
+mov [rsp+((1024+7-(13+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(13)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(14+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(14+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(14+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+add edx, [rsi+(14)*4]
+add edx, [rsp+8*4+((1024+15-(14)) MOD (16))*4]
+add edx, [rsp+((1024+7-(14)) MOD (8))*4]
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(14+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(14+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(14+4)) MOD (8))*4]
+mov [rsp+((1024+7-(14+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(14)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(15+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(15+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(15+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+add edi, [rsi+(15)*4]
+add edi, [rsp+8*4+((1024+15-(15)) MOD (16))*4]
+add edi, [rsp+((1024+7-(15)) MOD (8))*4]
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(15+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(15+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(15+4)) MOD (8))*4]
+mov [rsp+((1024+7-(15+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(15)) MOD (8))*4], ecx
+label1:
+add rsi, 4*16
+mov edx, [rsp+((1024+7-(0+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(0+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(0+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebp, [rsp+8*4+((1024+15-((0)-2)) MOD (16))*4]
+mov edi, [rsp+8*4+((1024+15-((0)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((0)-7)) MOD (16))*4]
+mov ebp, edi
+shr ebp, 3
+ror edi, 7
+add ebx, [rsp+8*4+((1024+15-(0)) MOD (16))*4]
+xor ebp, edi
+add edx, [rsi+(0)*4]
+ror edi, 11
+add edx, [rsp+((1024+7-(0)) MOD (8))*4]
+xor ebp, edi
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(0)) MOD (16))*4], ebp
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(0+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(0+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(0+4)) MOD (8))*4]
+mov [rsp+((1024+7-(0+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(0)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(1+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(1+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(1+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebp, [rsp+8*4+((1024+15-((1)-2)) MOD (16))*4]
+mov edx, [rsp+8*4+((1024+15-((1)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((1)-7)) MOD (16))*4]
+mov ebp, edx
+shr ebp, 3
+ror edx, 7
+add ebx, [rsp+8*4+((1024+15-(1)) MOD (16))*4]
+xor ebp, edx
+add edi, [rsi+(1)*4]
+ror edx, 11
+add edi, [rsp+((1024+7-(1)) MOD (8))*4]
+xor ebp, edx
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(1)) MOD (16))*4], ebp
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(1+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(1+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(1+4)) MOD (8))*4]
+mov [rsp+((1024+7-(1+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(1)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(2+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(2+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(2+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebp, [rsp+8*4+((1024+15-((2)-2)) MOD (16))*4]
+mov edi, [rsp+8*4+((1024+15-((2)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((2)-7)) MOD (16))*4]
+mov ebp, edi
+shr ebp, 3
+ror edi, 7
+add ebx, [rsp+8*4+((1024+15-(2)) MOD (16))*4]
+xor ebp, edi
+add edx, [rsi+(2)*4]
+ror edi, 11
+add edx, [rsp+((1024+7-(2)) MOD (8))*4]
+xor ebp, edi
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(2)) MOD (16))*4], ebp
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(2+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(2+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(2+4)) MOD (8))*4]
+mov [rsp+((1024+7-(2+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(2)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(3+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(3+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(3+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebp, [rsp+8*4+((1024+15-((3)-2)) MOD (16))*4]
+mov edx, [rsp+8*4+((1024+15-((3)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((3)-7)) MOD (16))*4]
+mov ebp, edx
+shr ebp, 3
+ror edx, 7
+add ebx, [rsp+8*4+((1024+15-(3)) MOD (16))*4]
+xor ebp, edx
+add edi, [rsi+(3)*4]
+ror edx, 11
+add edi, [rsp+((1024+7-(3)) MOD (8))*4]
+xor ebp, edx
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(3)) MOD (16))*4], ebp
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(3+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(3+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(3+4)) MOD (8))*4]
+mov [rsp+((1024+7-(3+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(3)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(4+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(4+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(4+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebp, [rsp+8*4+((1024+15-((4)-2)) MOD (16))*4]
+mov edi, [rsp+8*4+((1024+15-((4)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((4)-7)) MOD (16))*4]
+mov ebp, edi
+shr ebp, 3
+ror edi, 7
+add ebx, [rsp+8*4+((1024+15-(4)) MOD (16))*4]
+xor ebp, edi
+add edx, [rsi+(4)*4]
+ror edi, 11
+add edx, [rsp+((1024+7-(4)) MOD (8))*4]
+xor ebp, edi
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(4)) MOD (16))*4], ebp
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(4+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(4+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(4+4)) MOD (8))*4]
+mov [rsp+((1024+7-(4+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(4)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(5+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(5+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(5+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebp, [rsp+8*4+((1024+15-((5)-2)) MOD (16))*4]
+mov edx, [rsp+8*4+((1024+15-((5)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((5)-7)) MOD (16))*4]
+mov ebp, edx
+shr ebp, 3
+ror edx, 7
+add ebx, [rsp+8*4+((1024+15-(5)) MOD (16))*4]
+xor ebp, edx
+add edi, [rsi+(5)*4]
+ror edx, 11
+add edi, [rsp+((1024+7-(5)) MOD (8))*4]
+xor ebp, edx
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(5)) MOD (16))*4], ebp
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(5+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(5+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(5+4)) MOD (8))*4]
+mov [rsp+((1024+7-(5+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(5)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(6+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(6+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(6+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebp, [rsp+8*4+((1024+15-((6)-2)) MOD (16))*4]
+mov edi, [rsp+8*4+((1024+15-((6)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((6)-7)) MOD (16))*4]
+mov ebp, edi
+shr ebp, 3
+ror edi, 7
+add ebx, [rsp+8*4+((1024+15-(6)) MOD (16))*4]
+xor ebp, edi
+add edx, [rsi+(6)*4]
+ror edi, 11
+add edx, [rsp+((1024+7-(6)) MOD (8))*4]
+xor ebp, edi
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(6)) MOD (16))*4], ebp
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(6+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(6+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(6+4)) MOD (8))*4]
+mov [rsp+((1024+7-(6+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(6)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(7+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(7+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(7+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebp, [rsp+8*4+((1024+15-((7)-2)) MOD (16))*4]
+mov edx, [rsp+8*4+((1024+15-((7)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((7)-7)) MOD (16))*4]
+mov ebp, edx
+shr ebp, 3
+ror edx, 7
+add ebx, [rsp+8*4+((1024+15-(7)) MOD (16))*4]
+xor ebp, edx
+add edi, [rsi+(7)*4]
+ror edx, 11
+add edi, [rsp+((1024+7-(7)) MOD (8))*4]
+xor ebp, edx
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(7)) MOD (16))*4], ebp
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(7+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(7+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(7+4)) MOD (8))*4]
+mov [rsp+((1024+7-(7+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(7)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(8+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(8+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(8+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebp, [rsp+8*4+((1024+15-((8)-2)) MOD (16))*4]
+mov edi, [rsp+8*4+((1024+15-((8)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((8)-7)) MOD (16))*4]
+mov ebp, edi
+shr ebp, 3
+ror edi, 7
+add ebx, [rsp+8*4+((1024+15-(8)) MOD (16))*4]
+xor ebp, edi
+add edx, [rsi+(8)*4]
+ror edi, 11
+add edx, [rsp+((1024+7-(8)) MOD (8))*4]
+xor ebp, edi
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(8)) MOD (16))*4], ebp
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(8+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(8+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(8+4)) MOD (8))*4]
+mov [rsp+((1024+7-(8+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(8)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(9+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(9+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(9+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebp, [rsp+8*4+((1024+15-((9)-2)) MOD (16))*4]
+mov edx, [rsp+8*4+((1024+15-((9)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((9)-7)) MOD (16))*4]
+mov ebp, edx
+shr ebp, 3
+ror edx, 7
+add ebx, [rsp+8*4+((1024+15-(9)) MOD (16))*4]
+xor ebp, edx
+add edi, [rsi+(9)*4]
+ror edx, 11
+add edi, [rsp+((1024+7-(9)) MOD (8))*4]
+xor ebp, edx
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(9)) MOD (16))*4], ebp
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(9+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(9+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(9+4)) MOD (8))*4]
+mov [rsp+((1024+7-(9+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(9)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(10+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(10+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(10+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebp, [rsp+8*4+((1024+15-((10)-2)) MOD (16))*4]
+mov edi, [rsp+8*4+((1024+15-((10)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((10)-7)) MOD (16))*4]
+mov ebp, edi
+shr ebp, 3
+ror edi, 7
+add ebx, [rsp+8*4+((1024+15-(10)) MOD (16))*4]
+xor ebp, edi
+add edx, [rsi+(10)*4]
+ror edi, 11
+add edx, [rsp+((1024+7-(10)) MOD (8))*4]
+xor ebp, edi
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(10)) MOD (16))*4], ebp
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(10+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(10+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(10+4)) MOD (8))*4]
+mov [rsp+((1024+7-(10+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(10)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(11+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(11+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(11+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebp, [rsp+8*4+((1024+15-((11)-2)) MOD (16))*4]
+mov edx, [rsp+8*4+((1024+15-((11)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((11)-7)) MOD (16))*4]
+mov ebp, edx
+shr ebp, 3
+ror edx, 7
+add ebx, [rsp+8*4+((1024+15-(11)) MOD (16))*4]
+xor ebp, edx
+add edi, [rsi+(11)*4]
+ror edx, 11
+add edi, [rsp+((1024+7-(11)) MOD (8))*4]
+xor ebp, edx
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(11)) MOD (16))*4], ebp
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(11+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(11+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(11+4)) MOD (8))*4]
+mov [rsp+((1024+7-(11+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(11)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(12+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(12+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(12+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebp, [rsp+8*4+((1024+15-((12)-2)) MOD (16))*4]
+mov edi, [rsp+8*4+((1024+15-((12)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((12)-7)) MOD (16))*4]
+mov ebp, edi
+shr ebp, 3
+ror edi, 7
+add ebx, [rsp+8*4+((1024+15-(12)) MOD (16))*4]
+xor ebp, edi
+add edx, [rsi+(12)*4]
+ror edi, 11
+add edx, [rsp+((1024+7-(12)) MOD (8))*4]
+xor ebp, edi
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(12)) MOD (16))*4], ebp
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(12+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(12+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(12+4)) MOD (8))*4]
+mov [rsp+((1024+7-(12+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(12)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(13+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(13+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(13+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebp, [rsp+8*4+((1024+15-((13)-2)) MOD (16))*4]
+mov edx, [rsp+8*4+((1024+15-((13)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((13)-7)) MOD (16))*4]
+mov ebp, edx
+shr ebp, 3
+ror edx, 7
+add ebx, [rsp+8*4+((1024+15-(13)) MOD (16))*4]
+xor ebp, edx
+add edi, [rsi+(13)*4]
+ror edx, 11
+add edi, [rsp+((1024+7-(13)) MOD (8))*4]
+xor ebp, edx
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(13)) MOD (16))*4], ebp
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(13+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(13+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(13+4)) MOD (8))*4]
+mov [rsp+((1024+7-(13+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(13)) MOD (8))*4], ecx
+mov edx, [rsp+((1024+7-(14+2)) MOD (8))*4]
+xor edx, [rsp+((1024+7-(14+1)) MOD (8))*4]
+and edx, edi
+xor edx, [rsp+((1024+7-(14+1)) MOD (8))*4]
+mov ebp, edi
+ror edi, 6
+ror ebp, 25
+xor ebp, edi
+ror edi, 5
+xor ebp, edi
+add edx, ebp
+mov ebp, [rsp+8*4+((1024+15-((14)-2)) MOD (16))*4]
+mov edi, [rsp+8*4+((1024+15-((14)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((14)-7)) MOD (16))*4]
+mov ebp, edi
+shr ebp, 3
+ror edi, 7
+add ebx, [rsp+8*4+((1024+15-(14)) MOD (16))*4]
+xor ebp, edi
+add edx, [rsi+(14)*4]
+ror edi, 11
+add edx, [rsp+((1024+7-(14)) MOD (8))*4]
+xor ebp, edi
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(14)) MOD (16))*4], ebp
+add edx, ebp
+mov ebx, ecx
+xor ecx, [rsp+((1024+7-(14+6)) MOD (8))*4]
+and eax, ecx
+xor eax, [rsp+((1024+7-(14+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add eax, edx
+add edx, [rsp+((1024+7-(14+4)) MOD (8))*4]
+mov [rsp+((1024+7-(14+4)) MOD (8))*4], edx
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add eax, ebp
+mov [rsp+((1024+7-(14)) MOD (8))*4], eax
+mov edi, [rsp+((1024+7-(15+2)) MOD (8))*4]
+xor edi, [rsp+((1024+7-(15+1)) MOD (8))*4]
+and edi, edx
+xor edi, [rsp+((1024+7-(15+1)) MOD (8))*4]
+mov ebp, edx
+ror edx, 6
+ror ebp, 25
+xor ebp, edx
+ror edx, 5
+xor ebp, edx
+add edi, ebp
+mov ebp, [rsp+8*4+((1024+15-((15)-2)) MOD (16))*4]
+mov edx, [rsp+8*4+((1024+15-((15)-15)) MOD (16))*4]
+mov ebx, ebp
+shr ebp, 10
+ror ebx, 17
+xor ebp, ebx
+ror ebx, 2
+xor ebx, ebp
+add ebx, [rsp+8*4+((1024+15-((15)-7)) MOD (16))*4]
+mov ebp, edx
+shr ebp, 3
+ror edx, 7
+add ebx, [rsp+8*4+((1024+15-(15)) MOD (16))*4]
+xor ebp, edx
+add edi, [rsi+(15)*4]
+ror edx, 11
+add edi, [rsp+((1024+7-(15)) MOD (8))*4]
+xor ebp, edx
+add ebp, ebx
+mov [rsp+8*4+((1024+15-(15)) MOD (16))*4], ebp
+add edi, ebp
+mov ebx, eax
+xor eax, [rsp+((1024+7-(15+6)) MOD (8))*4]
+and ecx, eax
+xor ecx, [rsp+((1024+7-(15+6)) MOD (8))*4]
+mov ebp, ebx
+ror ebx, 2
+add ecx, edi
+add edi, [rsp+((1024+7-(15+4)) MOD (8))*4]
+mov [rsp+((1024+7-(15+4)) MOD (8))*4], edi
+ror ebp, 22
+xor ebp, ebx
+ror ebx, 11
+xor ebp, ebx
+add ecx, ebp
+mov [rsp+((1024+7-(15)) MOD (8))*4], ecx
+cmp rsi, [rsp+8*4+16*4+0*8]
+jne label1
+mov rcx, [rsp+8*4+16*4+1*8]
+movdqa xmm1, XMMWORD PTR [rcx+1*16]
+movdqa xmm0, XMMWORD PTR [rcx+0*16]
+paddd xmm1, [rsp+((1024+7-(0+3)) MOD (8))*4]
+paddd xmm0, [rsp+((1024+7-(0+7)) MOD (8))*4]
+movdqa [rcx+1*16], xmm1
+movdqa [rcx+0*16], xmm0
+mov rdx, [rsp+8*4+16*4+2*8]
+add rdx, 64
+mov [rsp+8*4+16*4+2*8], rdx
+cmp rdx, [rsp+8*4+16*4+3*8]
+jne label0
+add		rsp, 8*4 + 16*4 + 4*8 + 8
+pop		rbp
+pop		rbx
+pop		rdi
+pop		rsi
+ret
+SHA256_HashMultipleBlocks_SSE2 ENDP
+
+;; http://www.agner.org/optimize/vectorclass/read.php?i=65
+;; word64 Xgetbv(word32 ctrl)
+;; ctrl = rcx
+
+    ALIGN   8
+XGETBV64	PROC FRAME
+.endprolog
+    ;; query
+    DB  	0fh, 01h, 0d0h
+    ;; xcr = (EDX << 32) | EAX
+    and 	rax, 0ffffffffh
+    shl 	rdx, 32
+    or  	rax, rdx
+    ret
+XGETBV64	ENDP
+
+;; word64 CpuId(word32 func, word32 subfunc, word32 output[4])
+;; func = rcx
+;; subfunc = rdx
+;; output = r8
+
+    ALIGN   8
+CPUID64	PROC FRAME
+    ;; preserve per ABI
+    mov 	[rsp+8], rbx
+.savereg 	rbx, 8
+.endprolog
+    ;; eax = func
+    mov 	rax, rcx
+    ;; ecx = subfunc
+    mov 	rcx, rdx
+    ;; query
+    cpuid
+    ;; save
+    mov 	[r8+0],  eax
+    mov 	[r8+4],  ebx
+    mov 	[r8+8],  ecx
+    mov 	[r8+12], edx
+    ;; return value
+    mov 	rax, 1
+    ;; restore
+    mov 	rbx, [rsp+8]
+    ret
+CPUID64	ENDP
+
+_TEXT ENDS
+END
diff --git a/runtime/third_party/cryptopp/x64masm.asm b/runtime/third_party/cryptopp/x64masm.asm
new file mode 100644
index 0000000..c7ff836
--- /dev/null
+++ b/runtime/third_party/cryptopp/x64masm.asm
@@ -0,0 +1,1565 @@
+include ksamd64.inc
+EXTERNDEF s_sosemanukMulTables:FAR
+.CODE
+
+ALIGN 8
+Salsa20_OperateKeystream PROC FRAME
+mov r10, [rsp + 5*8]
+alloc_stack(10*16 + 32*16 + 8)
+save_xmm128 xmm6, 0200h
+save_xmm128 xmm7, 0210h
+save_xmm128 xmm8, 0220h
+save_xmm128 xmm9, 0230h
+save_xmm128 xmm10, 0240h
+save_xmm128 xmm11, 0250h
+save_xmm128 xmm12, 0260h
+save_xmm128 xmm13, 0270h
+save_xmm128 xmm14, 0280h
+save_xmm128 xmm15, 0290h
+.endprolog
+cmp r8, 4
+jl label5
+movdqa xmm0, [r10 + 0*16]
+movdqa xmm1, [r10 + 1*16]
+movdqa xmm2, [r10 + 2*16]
+movdqa xmm3, [r10 + 3*16]
+pshufd xmm4, xmm0, 0*64+0*16+0*4+0
+movdqa [rsp + (0*4+0)*16 + 256], xmm4
+pshufd xmm4, xmm0, 1*64+1*16+1*4+1
+movdqa [rsp + (0*4+1)*16 + 256], xmm4
+pshufd xmm4, xmm0, 2*64+2*16+2*4+2
+movdqa [rsp + (0*4+2)*16 + 256], xmm4
+pshufd xmm4, xmm0, 3*64+3*16+3*4+3
+movdqa [rsp + (0*4+3)*16 + 256], xmm4
+pshufd xmm4, xmm1, 0*64+0*16+0*4+0
+movdqa [rsp + (1*4+0)*16 + 256], xmm4
+pshufd xmm4, xmm1, 2*64+2*16+2*4+2
+movdqa [rsp + (1*4+2)*16 + 256], xmm4
+pshufd xmm4, xmm1, 3*64+3*16+3*4+3
+movdqa [rsp + (1*4+3)*16 + 256], xmm4
+pshufd xmm4, xmm2, 1*64+1*16+1*4+1
+movdqa [rsp + (2*4+1)*16 + 256], xmm4
+pshufd xmm4, xmm2, 2*64+2*16+2*4+2
+movdqa [rsp + (2*4+2)*16 + 256], xmm4
+pshufd xmm4, xmm2, 3*64+3*16+3*4+3
+movdqa [rsp + (2*4+3)*16 + 256], xmm4
+pshufd xmm4, xmm3, 0*64+0*16+0*4+0
+movdqa [rsp + (3*4+0)*16 + 256], xmm4
+pshufd xmm4, xmm3, 1*64+1*16+1*4+1
+movdqa [rsp + (3*4+1)*16 + 256], xmm4
+pshufd xmm4, xmm3, 2*64+2*16+2*4+2
+movdqa [rsp + (3*4+2)*16 + 256], xmm4
+pshufd xmm4, xmm3, 3*64+3*16+3*4+3
+movdqa [rsp + (3*4+3)*16 + 256], xmm4
+label1:
+mov eax, dword ptr [r10 + 8*4]
+mov r11d, dword ptr [r10 + 5*4]
+mov dword ptr [rsp + 8*16 + 0*4 + 256], eax
+mov dword ptr [rsp + 5*16 + 0*4 + 256], r11d
+add eax, 1
+adc r11d, 0
+mov dword ptr [rsp + 8*16 + 1*4 + 256], eax
+mov dword ptr [rsp + 5*16 + 1*4 + 256], r11d
+add eax, 1
+adc r11d, 0
+mov dword ptr [rsp + 8*16 + 2*4 + 256], eax
+mov dword ptr [rsp + 5*16 + 2*4 + 256], r11d
+add eax, 1
+adc r11d, 0
+mov dword ptr [rsp + 8*16 + 3*4 + 256], eax
+mov dword ptr [rsp + 5*16 + 3*4 + 256], r11d
+add eax, 1
+adc r11d, 0
+mov dword ptr [r10 + 8*4], eax
+mov dword ptr [r10 + 5*4], r11d
+movdqa xmm0, [rsp + 12*16 + 1*256]
+movdqa xmm4, [rsp + 13*16 + 1*256]
+movdqa xmm8, [rsp + 14*16 + 1*256]
+movdqa xmm12, [rsp + 15*16 + 1*256]
+movdqa xmm2, [rsp + 0*16 + 1*256]
+movdqa xmm6, [rsp + 1*16 + 1*256]
+movdqa xmm10, [rsp + 2*16 + 1*256]
+movdqa xmm14, [rsp + 3*16 + 1*256]
+paddd xmm0, xmm2
+paddd xmm4, xmm6
+paddd xmm8, xmm10
+paddd xmm12, xmm14
+movdqa xmm1, xmm0
+movdqa xmm5, xmm4
+movdqa xmm9, xmm8
+movdqa xmm13, xmm12
+pslld xmm0, 7
+pslld xmm4, 7
+pslld xmm8, 7
+pslld xmm12, 7
+psrld xmm1, 32-7
+psrld xmm5, 32-7
+psrld xmm9, 32-7
+psrld xmm13, 32-7
+pxor xmm0, [rsp + 4*16 + 1*256]
+pxor xmm4, [rsp + 5*16 + 1*256]
+pxor xmm8, [rsp + 6*16 + 1*256]
+pxor xmm12, [rsp + 7*16 + 1*256]
+pxor xmm0, xmm1
+pxor xmm4, xmm5
+pxor xmm8, xmm9
+pxor xmm12, xmm13
+movdqa [rsp + 4*16], xmm0
+movdqa [rsp + 5*16], xmm4
+movdqa [rsp + 6*16], xmm8
+movdqa [rsp + 7*16], xmm12
+movdqa xmm1, xmm0
+movdqa xmm5, xmm4
+movdqa xmm9, xmm8
+movdqa xmm13, xmm12
+paddd xmm0, xmm2
+paddd xmm4, xmm6
+paddd xmm8, xmm10
+paddd xmm12, xmm14
+movdqa xmm3, xmm0
+movdqa xmm7, xmm4
+movdqa xmm11, xmm8
+movdqa xmm15, xmm12
+pslld xmm0, 9
+pslld xmm4, 9
+pslld xmm8, 9
+pslld xmm12, 9
+psrld xmm3, 32-9
+psrld xmm7, 32-9
+psrld xmm11, 32-9
+psrld xmm15, 32-9
+pxor xmm0, [rsp + 8*16 + 1*256]
+pxor xmm4, [rsp + 9*16 + 1*256]
+pxor xmm8, [rsp + 10*16 + 1*256]
+pxor xmm12, [rsp + 11*16 + 1*256]
+pxor xmm0, xmm3
+pxor xmm4, xmm7
+pxor xmm8, xmm11
+pxor xmm12, xmm15
+movdqa [rsp + 8*16], xmm0
+movdqa [rsp + 9*16], xmm4
+movdqa [rsp + 10*16], xmm8
+movdqa [rsp + 11*16], xmm12
+movdqa xmm3, xmm0
+movdqa xmm7, xmm4
+movdqa xmm11, xmm8
+movdqa xmm15, xmm12
+paddd xmm0, xmm1
+paddd xmm4, xmm5
+paddd xmm8, xmm9
+paddd xmm12, xmm13
+movdqa xmm1, xmm0
+movdqa xmm5, xmm4
+movdqa xmm9, xmm8
+movdqa xmm13, xmm12
+pslld xmm0, 13
+pslld xmm4, 13
+pslld xmm8, 13
+pslld xmm12, 13
+psrld xmm1, 32-13
+psrld xmm5, 32-13
+psrld xmm9, 32-13
+psrld xmm13, 32-13
+pxor xmm0, [rsp + 12*16 + 1*256]
+pxor xmm4, [rsp + 13*16 + 1*256]
+pxor xmm8, [rsp + 14*16 + 1*256]
+pxor xmm12, [rsp + 15*16 + 1*256]
+pxor xmm0, xmm1
+pxor xmm4, xmm5
+pxor xmm8, xmm9
+pxor xmm12, xmm13
+movdqa [rsp + 12*16], xmm0
+movdqa [rsp + 13*16], xmm4
+movdqa [rsp + 14*16], xmm8
+movdqa [rsp + 15*16], xmm12
+paddd xmm0, xmm3
+paddd xmm4, xmm7
+paddd xmm8, xmm11
+paddd xmm12, xmm15
+movdqa xmm3, xmm0
+movdqa xmm7, xmm4
+movdqa xmm11, xmm8
+movdqa xmm15, xmm12
+pslld xmm0, 18
+pslld xmm4, 18
+pslld xmm8, 18
+pslld xmm12, 18
+psrld xmm3, 32-18
+psrld xmm7, 32-18
+psrld xmm11, 32-18
+psrld xmm15, 32-18
+pxor xmm0, xmm2
+pxor xmm4, xmm6
+pxor xmm8, xmm10
+pxor xmm12, xmm14
+pxor xmm0, xmm3
+pxor xmm4, xmm7
+pxor xmm8, xmm11
+pxor xmm12, xmm15
+movdqa [rsp + 0*16], xmm0
+movdqa [rsp + 1*16], xmm4
+movdqa [rsp + 2*16], xmm8
+movdqa [rsp + 3*16], xmm12
+mov rax, r9
+jmp label2
+labelSSE2_Salsa_Output:
+movdqa xmm0, xmm4
+punpckldq xmm4, xmm5
+movdqa xmm1, xmm6
+punpckldq xmm6, xmm7
+movdqa xmm2, xmm4
+punpcklqdq xmm4, xmm6
+punpckhqdq xmm2, xmm6
+punpckhdq xmm0, xmm5
+punpckhdq xmm1, xmm7
+movdqa xmm6, xmm0
+punpcklqdq xmm0, xmm1
+punpckhqdq xmm6, xmm1
+test rdx, rdx
+jz labelSSE2_Salsa_Output_A3
+test rdx, 15
+jnz labelSSE2_Salsa_Output_A7
+pxor xmm4, [rdx+0*16]
+pxor xmm2, [rdx+4*16]
+pxor xmm0, [rdx+8*16]
+pxor xmm6, [rdx+12*16]
+add rdx, 1*16
+jmp labelSSE2_Salsa_Output_A3
+labelSSE2_Salsa_Output_A7:
+movdqu xmm1, [rdx+0*16]
+pxor xmm4, xmm1
+movdqu xmm1, [rdx+4*16]
+pxor xmm2, xmm1
+movdqu xmm1, [rdx+8*16]
+pxor xmm0, xmm1
+movdqu xmm1, [rdx+12*16]
+pxor xmm6, xmm1
+add rdx, 1*16
+labelSSE2_Salsa_Output_A3:
+test rcx, 15
+jnz labelSSE2_Salsa_Output_A8
+movdqa [rcx+0*16], xmm4
+movdqa [rcx+4*16], xmm2
+movdqa [rcx+8*16], xmm0
+movdqa [rcx+12*16], xmm6
+jmp labelSSE2_Salsa_Output_A9
+labelSSE2_Salsa_Output_A8:
+movdqu [rcx+0*16], xmm4
+movdqu [rcx+4*16], xmm2
+movdqu [rcx+8*16], xmm0
+movdqu [rcx+12*16], xmm6
+labelSSE2_Salsa_Output_A9:
+add rcx, 1*16
+ret
+label6:
+movdqa xmm0, [rsp + 12*16 + 0*256]
+movdqa xmm4, [rsp + 13*16 + 0*256]
+movdqa xmm8, [rsp + 14*16 + 0*256]
+movdqa xmm12, [rsp + 15*16 + 0*256]
+movdqa xmm2, [rsp + 0*16 + 0*256]
+movdqa xmm6, [rsp + 1*16 + 0*256]
+movdqa xmm10, [rsp + 2*16 + 0*256]
+movdqa xmm14, [rsp + 3*16 + 0*256]
+paddd xmm0, xmm2
+paddd xmm4, xmm6
+paddd xmm8, xmm10
+paddd xmm12, xmm14
+movdqa xmm1, xmm0
+movdqa xmm5, xmm4
+movdqa xmm9, xmm8
+movdqa xmm13, xmm12
+pslld xmm0, 7
+pslld xmm4, 7
+pslld xmm8, 7
+pslld xmm12, 7
+psrld xmm1, 32-7
+psrld xmm5, 32-7
+psrld xmm9, 32-7
+psrld xmm13, 32-7
+pxor xmm0, [rsp + 4*16 + 0*256]
+pxor xmm4, [rsp + 5*16 + 0*256]
+pxor xmm8, [rsp + 6*16 + 0*256]
+pxor xmm12, [rsp + 7*16 + 0*256]
+pxor xmm0, xmm1
+pxor xmm4, xmm5
+pxor xmm8, xmm9
+pxor xmm12, xmm13
+movdqa [rsp + 4*16], xmm0
+movdqa [rsp + 5*16], xmm4
+movdqa [rsp + 6*16], xmm8
+movdqa [rsp + 7*16], xmm12
+movdqa xmm1, xmm0
+movdqa xmm5, xmm4
+movdqa xmm9, xmm8
+movdqa xmm13, xmm12
+paddd xmm0, xmm2
+paddd xmm4, xmm6
+paddd xmm8, xmm10
+paddd xmm12, xmm14
+movdqa xmm3, xmm0
+movdqa xmm7, xmm4
+movdqa xmm11, xmm8
+movdqa xmm15, xmm12
+pslld xmm0, 9
+pslld xmm4, 9
+pslld xmm8, 9
+pslld xmm12, 9
+psrld xmm3, 32-9
+psrld xmm7, 32-9
+psrld xmm11, 32-9
+psrld xmm15, 32-9
+pxor xmm0, [rsp + 8*16 + 0*256]
+pxor xmm4, [rsp + 9*16 + 0*256]
+pxor xmm8, [rsp + 10*16 + 0*256]
+pxor xmm12, [rsp + 11*16 + 0*256]
+pxor xmm0, xmm3
+pxor xmm4, xmm7
+pxor xmm8, xmm11
+pxor xmm12, xmm15
+movdqa [rsp + 8*16], xmm0
+movdqa [rsp + 9*16], xmm4
+movdqa [rsp + 10*16], xmm8
+movdqa [rsp + 11*16], xmm12
+movdqa xmm3, xmm0
+movdqa xmm7, xmm4
+movdqa xmm11, xmm8
+movdqa xmm15, xmm12
+paddd xmm0, xmm1
+paddd xmm4, xmm5
+paddd xmm8, xmm9
+paddd xmm12, xmm13
+movdqa xmm1, xmm0
+movdqa xmm5, xmm4
+movdqa xmm9, xmm8
+movdqa xmm13, xmm12
+pslld xmm0, 13
+pslld xmm4, 13
+pslld xmm8, 13
+pslld xmm12, 13
+psrld xmm1, 32-13
+psrld xmm5, 32-13
+psrld xmm9, 32-13
+psrld xmm13, 32-13
+pxor xmm0, [rsp + 12*16 + 0*256]
+pxor xmm4, [rsp + 13*16 + 0*256]
+pxor xmm8, [rsp + 14*16 + 0*256]
+pxor xmm12, [rsp + 15*16 + 0*256]
+pxor xmm0, xmm1
+pxor xmm4, xmm5
+pxor xmm8, xmm9
+pxor xmm12, xmm13
+movdqa [rsp + 12*16], xmm0
+movdqa [rsp + 13*16], xmm4
+movdqa [rsp + 14*16], xmm8
+movdqa [rsp + 15*16], xmm12
+paddd xmm0, xmm3
+paddd xmm4, xmm7
+paddd xmm8, xmm11
+paddd xmm12, xmm15
+movdqa xmm3, xmm0
+movdqa xmm7, xmm4
+movdqa xmm11, xmm8
+movdqa xmm15, xmm12
+pslld xmm0, 18
+pslld xmm4, 18
+pslld xmm8, 18
+pslld xmm12, 18
+psrld xmm3, 32-18
+psrld xmm7, 32-18
+psrld xmm11, 32-18
+psrld xmm15, 32-18
+pxor xmm0, xmm2
+pxor xmm4, xmm6
+pxor xmm8, xmm10
+pxor xmm12, xmm14
+pxor xmm0, xmm3
+pxor xmm4, xmm7
+pxor xmm8, xmm11
+pxor xmm12, xmm15
+movdqa [rsp + 0*16], xmm0
+movdqa [rsp + 1*16], xmm4
+movdqa [rsp + 2*16], xmm8
+movdqa [rsp + 3*16], xmm12
+label2:
+movdqa xmm0, [rsp + 7*16 + 0*256]
+movdqa xmm4, [rsp + 4*16 + 0*256]
+movdqa xmm8, [rsp + 5*16 + 0*256]
+movdqa xmm12, [rsp + 6*16 + 0*256]
+movdqa xmm2, [rsp + 0*16 + 0*256]
+movdqa xmm6, [rsp + 1*16 + 0*256]
+movdqa xmm10, [rsp + 2*16 + 0*256]
+movdqa xmm14, [rsp + 3*16 + 0*256]
+paddd xmm0, xmm2
+paddd xmm4, xmm6
+paddd xmm8, xmm10
+paddd xmm12, xmm14
+movdqa xmm1, xmm0
+movdqa xmm5, xmm4
+movdqa xmm9, xmm8
+movdqa xmm13, xmm12
+pslld xmm0, 7
+pslld xmm4, 7
+pslld xmm8, 7
+pslld xmm12, 7
+psrld xmm1, 32-7
+psrld xmm5, 32-7
+psrld xmm9, 32-7
+psrld xmm13, 32-7
+pxor xmm0, [rsp + 13*16 + 0*256]
+pxor xmm4, [rsp + 14*16 + 0*256]
+pxor xmm8, [rsp + 15*16 + 0*256]
+pxor xmm12, [rsp + 12*16 + 0*256]
+pxor xmm0, xmm1
+pxor xmm4, xmm5
+pxor xmm8, xmm9
+pxor xmm12, xmm13
+movdqa [rsp + 13*16], xmm0
+movdqa [rsp + 14*16], xmm4
+movdqa [rsp + 15*16], xmm8
+movdqa [rsp + 12*16], xmm12
+movdqa xmm1, xmm0
+movdqa xmm5, xmm4
+movdqa xmm9, xmm8
+movdqa xmm13, xmm12
+paddd xmm0, xmm2
+paddd xmm4, xmm6
+paddd xmm8, xmm10
+paddd xmm12, xmm14
+movdqa xmm3, xmm0
+movdqa xmm7, xmm4
+movdqa xmm11, xmm8
+movdqa xmm15, xmm12
+pslld xmm0, 9
+pslld xmm4, 9
+pslld xmm8, 9
+pslld xmm12, 9
+psrld xmm3, 32-9
+psrld xmm7, 32-9
+psrld xmm11, 32-9
+psrld xmm15, 32-9
+pxor xmm0, [rsp + 10*16 + 0*256]
+pxor xmm4, [rsp + 11*16 + 0*256]
+pxor xmm8, [rsp + 8*16 + 0*256]
+pxor xmm12, [rsp + 9*16 + 0*256]
+pxor xmm0, xmm3
+pxor xmm4, xmm7
+pxor xmm8, xmm11
+pxor xmm12, xmm15
+movdqa [rsp + 10*16], xmm0
+movdqa [rsp + 11*16], xmm4
+movdqa [rsp + 8*16], xmm8
+movdqa [rsp + 9*16], xmm12
+movdqa xmm3, xmm0
+movdqa xmm7, xmm4
+movdqa xmm11, xmm8
+movdqa xmm15, xmm12
+paddd xmm0, xmm1
+paddd xmm4, xmm5
+paddd xmm8, xmm9
+paddd xmm12, xmm13
+movdqa xmm1, xmm0
+movdqa xmm5, xmm4
+movdqa xmm9, xmm8
+movdqa xmm13, xmm12
+pslld xmm0, 13
+pslld xmm4, 13
+pslld xmm8, 13
+pslld xmm12, 13
+psrld xmm1, 32-13
+psrld xmm5, 32-13
+psrld xmm9, 32-13
+psrld xmm13, 32-13
+pxor xmm0, [rsp + 7*16 + 0*256]
+pxor xmm4, [rsp + 4*16 + 0*256]
+pxor xmm8, [rsp + 5*16 + 0*256]
+pxor xmm12, [rsp + 6*16 + 0*256]
+pxor xmm0, xmm1
+pxor xmm4, xmm5
+pxor xmm8, xmm9
+pxor xmm12, xmm13
+movdqa [rsp + 7*16], xmm0
+movdqa [rsp + 4*16], xmm4
+movdqa [rsp + 5*16], xmm8
+movdqa [rsp + 6*16], xmm12
+paddd xmm0, xmm3
+paddd xmm4, xmm7
+paddd xmm8, xmm11
+paddd xmm12, xmm15
+movdqa xmm3, xmm0
+movdqa xmm7, xmm4
+movdqa xmm11, xmm8
+movdqa xmm15, xmm12
+pslld xmm0, 18
+pslld xmm4, 18
+pslld xmm8, 18
+pslld xmm12, 18
+psrld xmm3, 32-18
+psrld xmm7, 32-18
+psrld xmm11, 32-18
+psrld xmm15, 32-18
+pxor xmm0, xmm2
+pxor xmm4, xmm6
+pxor xmm8, xmm10
+pxor xmm12, xmm14
+pxor xmm0, xmm3
+pxor xmm4, xmm7
+pxor xmm8, xmm11
+pxor xmm12, xmm15
+movdqa [rsp + 0*16], xmm0
+movdqa [rsp + 1*16], xmm4
+movdqa [rsp + 2*16], xmm8
+movdqa [rsp + 3*16], xmm12
+sub eax, 2
+jnz label6
+movdqa xmm4, [rsp + 0*16 + 256]
+paddd xmm4, [rsp + 0*16]
+movdqa xmm5, [rsp + 13*16 + 256]
+paddd xmm5, [rsp + 13*16]
+movdqa xmm6, [rsp + 10*16 + 256]
+paddd xmm6, [rsp + 10*16]
+movdqa xmm7, [rsp + 7*16 + 256]
+paddd xmm7, [rsp + 7*16]
+call labelSSE2_Salsa_Output
+movdqa xmm4, [rsp + 4*16 + 256]
+paddd xmm4, [rsp + 4*16]
+movdqa xmm5, [rsp + 1*16 + 256]
+paddd xmm5, [rsp + 1*16]
+movdqa xmm6, [rsp + 14*16 + 256]
+paddd xmm6, [rsp + 14*16]
+movdqa xmm7, [rsp + 11*16 + 256]
+paddd xmm7, [rsp + 11*16]
+call labelSSE2_Salsa_Output
+movdqa xmm4, [rsp + 8*16 + 256]
+paddd xmm4, [rsp + 8*16]
+movdqa xmm5, [rsp + 5*16 + 256]
+paddd xmm5, [rsp + 5*16]
+movdqa xmm6, [rsp + 2*16 + 256]
+paddd xmm6, [rsp + 2*16]
+movdqa xmm7, [rsp + 15*16 + 256]
+paddd xmm7, [rsp + 15*16]
+call labelSSE2_Salsa_Output
+movdqa xmm4, [rsp + 12*16 + 256]
+paddd xmm4, [rsp + 12*16]
+movdqa xmm5, [rsp + 9*16 + 256]
+paddd xmm5, [rsp + 9*16]
+movdqa xmm6, [rsp + 6*16 + 256]
+paddd xmm6, [rsp + 6*16]
+movdqa xmm7, [rsp + 3*16 + 256]
+paddd xmm7, [rsp + 3*16]
+call labelSSE2_Salsa_Output
+test rdx, rdx
+jz label9
+add rdx, 12*16
+label9:
+add rcx, 12*16
+sub r8, 4
+cmp r8, 4
+jge label1
+label5:
+sub r8, 1
+jl label4
+movdqa xmm0, [r10 + 0*16]
+movdqa xmm1, [r10 + 1*16]
+movdqa xmm2, [r10 + 2*16]
+movdqa xmm3, [r10 + 3*16]
+mov rax, r9
+label0:
+movdqa xmm4, xmm3
+paddd xmm4, xmm0
+movdqa xmm5, xmm4
+pslld xmm4, 7
+psrld xmm5, 32-7
+pxor xmm1, xmm4
+pxor xmm1, xmm5
+movdqa xmm4, xmm0
+paddd xmm4, xmm1
+movdqa xmm5, xmm4
+pslld xmm4, 9
+psrld xmm5, 32-9
+pxor xmm2, xmm4
+pxor xmm2, xmm5
+movdqa xmm4, xmm1
+paddd xmm4, xmm2
+movdqa xmm5, xmm4
+pslld xmm4, 13
+psrld xmm5, 32-13
+pxor xmm3, xmm4
+pxor xmm3, xmm5
+movdqa xmm4, xmm2
+paddd xmm4, xmm3
+movdqa xmm5, xmm4
+pslld xmm4, 18
+psrld xmm5, 32-18
+pxor xmm0, xmm4
+pxor xmm0, xmm5
+pshufd xmm1, xmm1, 2*64+1*16+0*4+3
+pshufd xmm2, xmm2, 1*64+0*16+3*4+2
+pshufd xmm3, xmm3, 0*64+3*16+2*4+1
+movdqa xmm4, xmm1
+paddd xmm4, xmm0
+movdqa xmm5, xmm4
+pslld xmm4, 7
+psrld xmm5, 32-7
+pxor xmm3, xmm4
+pxor xmm3, xmm5
+movdqa xmm4, xmm0
+paddd xmm4, xmm3
+movdqa xmm5, xmm4
+pslld xmm4, 9
+psrld xmm5, 32-9
+pxor xmm2, xmm4
+pxor xmm2, xmm5
+movdqa xmm4, xmm3
+paddd xmm4, xmm2
+movdqa xmm5, xmm4
+pslld xmm4, 13
+psrld xmm5, 32-13
+pxor xmm1, xmm4
+pxor xmm1, xmm5
+movdqa xmm4, xmm2
+paddd xmm4, xmm1
+movdqa xmm5, xmm4
+pslld xmm4, 18
+psrld xmm5, 32-18
+pxor xmm0, xmm4
+pxor xmm0, xmm5
+pshufd xmm1, xmm1, 0*64+3*16+2*4+1
+pshufd xmm2, xmm2, 1*64+0*16+3*4+2
+pshufd xmm3, xmm3, 2*64+1*16+0*4+3
+sub eax, 2
+jnz label0
+paddd xmm0, [r10 + 0*16]
+paddd xmm1, [r10 + 1*16]
+paddd xmm2, [r10 + 2*16]
+paddd xmm3, [r10 + 3*16]
+add dword ptr [r10 + 8*4], 1
+adc dword ptr [r10 + 5*4], 0
+pcmpeqb xmm6, xmm6
+psrlq xmm6, 32
+pshufd xmm7, xmm6, 0*64+1*16+2*4+3
+movdqa xmm4, xmm0
+movdqa xmm5, xmm3
+pand xmm0, xmm7
+pand xmm4, xmm6
+pand xmm3, xmm6
+pand xmm5, xmm7
+por xmm4, xmm5
+movdqa xmm5, xmm1
+pand xmm1, xmm7
+pand xmm5, xmm6
+por xmm0, xmm5
+pand xmm6, xmm2
+pand xmm2, xmm7
+por xmm1, xmm6
+por xmm2, xmm3
+movdqa xmm5, xmm4
+movdqa xmm6, xmm0
+shufpd xmm4, xmm1, 2
+shufpd xmm0, xmm2, 2
+shufpd xmm1, xmm5, 2
+shufpd xmm2, xmm6, 2
+test rdx, rdx
+jz labelSSE2_Salsa_Output_B3
+test rdx, 15
+jnz labelSSE2_Salsa_Output_B7
+pxor xmm4, [rdx+0*16]
+pxor xmm0, [rdx+1*16]
+pxor xmm1, [rdx+2*16]
+pxor xmm2, [rdx+3*16]
+add rdx, 4*16
+jmp labelSSE2_Salsa_Output_B3
+labelSSE2_Salsa_Output_B7:
+movdqu xmm3, [rdx+0*16]
+pxor xmm4, xmm3
+movdqu xmm3, [rdx+1*16]
+pxor xmm0, xmm3
+movdqu xmm3, [rdx+2*16]
+pxor xmm1, xmm3
+movdqu xmm3, [rdx+3*16]
+pxor xmm2, xmm3
+add rdx, 4*16
+labelSSE2_Salsa_Output_B3:
+test rcx, 15
+jnz labelSSE2_Salsa_Output_B8
+movdqa [rcx+0*16], xmm4
+movdqa [rcx+1*16], xmm0
+movdqa [rcx+2*16], xmm1
+movdqa [rcx+3*16], xmm2
+jmp labelSSE2_Salsa_Output_B9
+labelSSE2_Salsa_Output_B8:
+movdqu [rcx+0*16], xmm4
+movdqu [rcx+1*16], xmm0
+movdqu [rcx+2*16], xmm1
+movdqu [rcx+3*16], xmm2
+labelSSE2_Salsa_Output_B9:
+add rcx, 4*16
+jmp label5
+label4:
+movdqa xmm6, [rsp + 0200h]
+movdqa xmm7, [rsp + 0210h]
+movdqa xmm8, [rsp + 0220h]
+movdqa xmm9, [rsp + 0230h]
+movdqa xmm10, [rsp + 0240h]
+movdqa xmm11, [rsp + 0250h]
+movdqa xmm12, [rsp + 0260h]
+movdqa xmm13, [rsp + 0270h]
+movdqa xmm14, [rsp + 0280h]
+movdqa xmm15, [rsp + 0290h]
+add rsp, 10*16 + 32*16 + 8
+ret
+Salsa20_OperateKeystream ENDP
+
+ALIGN 8
+Sosemanuk_OperateKeystream PROC FRAME
+rex_push_reg rsi
+push_reg rdi
+alloc_stack(80*4*2+12*4+8*8 + 2*16+8)
+save_xmm128 xmm6, 02f0h
+save_xmm128 xmm7, 0300h
+.endprolog
+mov rdi, r8
+mov rax, r9
+mov QWORD PTR [rsp+1*8], rdi
+mov QWORD PTR [rsp+2*8], rdx
+mov QWORD PTR [rsp+6*8], rax
+lea rcx, [4*rcx+rcx]
+lea rsi, [4*rcx]
+mov QWORD PTR [rsp+3*8], rsi
+movdqa xmm0, [rax+0*16]
+movdqa [rsp + 8*8+0*16], xmm0
+movdqa xmm0, [rax+1*16]
+movdqa [rsp + 8*8+1*16], xmm0
+movq xmm0, QWORD PTR [rax+2*16]
+movq QWORD PTR [rsp + 8*8+2*16], xmm0
+psrlq xmm0, 32
+movd r10d, xmm0
+mov ecx, [rax+10*4]
+mov edx, [rax+11*4]
+pcmpeqb xmm7, xmm7
+label2:
+lea rdi, [rsp + 8*8 + 12*4]
+mov rax, 80
+cmp rsi, 80
+cmovg rsi, rax
+mov QWORD PTR [rsp+7*8], rsi
+lea rsi, [rdi+rsi]
+mov QWORD PTR [rsp+4*8], rsi
+lea rsi, s_sosemanukMulTables
+label0:
+mov eax, [rsp + 8*8 + ((0+0)-((0+0)/(10))*(10))*4]
+mov [rdi + (((0)-((0)/(4))*(4))*20 + (0/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((0)-((0)/(4))*(4))*20 + (0/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((0+3)-((0+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((0+2)-((0+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((0+0)-((0+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((1+0)-((1+0)/(10))*(10))*4]
+mov [rdi + (((1)-((1)/(4))*(4))*20 + (1/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((1)-((1)/(4))*(4))*20 + (1/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((1+3)-((1+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((1+2)-((1+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((1+0)-((1+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((2+0)-((2+0)/(10))*(10))*4]
+mov [rdi + (((2)-((2)/(4))*(4))*20 + (2/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((2)-((2)/(4))*(4))*20 + (2/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((2+3)-((2+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((2+2)-((2+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((2+0)-((2+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((3+0)-((3+0)/(10))*(10))*4]
+mov [rdi + (((3)-((3)/(4))*(4))*20 + (3/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((3)-((3)/(4))*(4))*20 + (3/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((3+3)-((3+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((3+2)-((3+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((3+0)-((3+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((4+0)-((4+0)/(10))*(10))*4]
+mov [rdi + (((4)-((4)/(4))*(4))*20 + (4/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((4)-((4)/(4))*(4))*20 + (4/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((4+3)-((4+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((4+2)-((4+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((4+0)-((4+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((5+0)-((5+0)/(10))*(10))*4]
+mov [rdi + (((5)-((5)/(4))*(4))*20 + (5/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((5)-((5)/(4))*(4))*20 + (5/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((5+3)-((5+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((5+2)-((5+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((5+0)-((5+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((6+0)-((6+0)/(10))*(10))*4]
+mov [rdi + (((6)-((6)/(4))*(4))*20 + (6/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((6)-((6)/(4))*(4))*20 + (6/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((6+3)-((6+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((6+2)-((6+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((6+0)-((6+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((7+0)-((7+0)/(10))*(10))*4]
+mov [rdi + (((7)-((7)/(4))*(4))*20 + (7/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((7)-((7)/(4))*(4))*20 + (7/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((7+3)-((7+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((7+2)-((7+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((7+0)-((7+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((8+0)-((8+0)/(10))*(10))*4]
+mov [rdi + (((8)-((8)/(4))*(4))*20 + (8/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((8)-((8)/(4))*(4))*20 + (8/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((8+3)-((8+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((8+2)-((8+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((8+0)-((8+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((9+0)-((9+0)/(10))*(10))*4]
+mov [rdi + (((9)-((9)/(4))*(4))*20 + (9/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((9)-((9)/(4))*(4))*20 + (9/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((9+3)-((9+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((9+2)-((9+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((9+0)-((9+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((10+0)-((10+0)/(10))*(10))*4]
+mov [rdi + (((10)-((10)/(4))*(4))*20 + (10/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((10)-((10)/(4))*(4))*20 + (10/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((10+3)-((10+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((10+2)-((10+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((10+0)-((10+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((11+0)-((11+0)/(10))*(10))*4]
+mov [rdi + (((11)-((11)/(4))*(4))*20 + (11/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((11)-((11)/(4))*(4))*20 + (11/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((11+3)-((11+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((11+2)-((11+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((11+0)-((11+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((12+0)-((12+0)/(10))*(10))*4]
+mov [rdi + (((12)-((12)/(4))*(4))*20 + (12/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((12)-((12)/(4))*(4))*20 + (12/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((12+3)-((12+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((12+2)-((12+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((12+0)-((12+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((13+0)-((13+0)/(10))*(10))*4]
+mov [rdi + (((13)-((13)/(4))*(4))*20 + (13/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((13)-((13)/(4))*(4))*20 + (13/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((13+3)-((13+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((13+2)-((13+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((13+0)-((13+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((14+0)-((14+0)/(10))*(10))*4]
+mov [rdi + (((14)-((14)/(4))*(4))*20 + (14/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((14)-((14)/(4))*(4))*20 + (14/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((14+3)-((14+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((14+2)-((14+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((14+0)-((14+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((15+0)-((15+0)/(10))*(10))*4]
+mov [rdi + (((15)-((15)/(4))*(4))*20 + (15/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((15)-((15)/(4))*(4))*20 + (15/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((15+3)-((15+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((15+2)-((15+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((15+0)-((15+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((16+0)-((16+0)/(10))*(10))*4]
+mov [rdi + (((16)-((16)/(4))*(4))*20 + (16/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((16)-((16)/(4))*(4))*20 + (16/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((16+3)-((16+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((16+2)-((16+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((16+0)-((16+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((17+0)-((17+0)/(10))*(10))*4]
+mov [rdi + (((17)-((17)/(4))*(4))*20 + (17/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((17)-((17)/(4))*(4))*20 + (17/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((17+3)-((17+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((17+2)-((17+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((17+0)-((17+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((18+0)-((18+0)/(10))*(10))*4]
+mov [rdi + (((18)-((18)/(4))*(4))*20 + (18/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + edx]
+xor r11d, ecx
+mov [rdi + (((18)-((18)/(4))*(4))*20 + (18/4)) * 4], r11d
+mov r11d, 1
+and r11d, edx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((18+3)-((18+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((18+2)-((18+2)/(10))*(10))*4]
+add ecx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul edx, 54655307h
+rol edx, 7
+mov [rsp + 8*8 + ((18+0)-((18+0)/(10))*(10))*4], r10d
+mov eax, [rsp + 8*8 + ((19+0)-((19+0)/(10))*(10))*4]
+mov [rdi + (((19)-((19)/(4))*(4))*20 + (19/4)) * 4 + 80*4], eax
+rol eax, 8
+lea r11d, [r10d + ecx]
+xor r11d, edx
+mov [rdi + (((19)-((19)/(4))*(4))*20 + (19/4)) * 4], r11d
+mov r11d, 1
+and r11d, ecx
+neg r11d
+and r11d, r10d
+xor r10d, eax
+movzx eax, al
+xor r10d, [rsi+rax*4]
+mov eax, [rsp + 8*8 + ((19+3)-((19+3)/(10))*(10))*4]
+xor r11d, [rsp + 8*8 + ((19+2)-((19+2)/(10))*(10))*4]
+add edx, r11d
+movzx r11d, al
+shr eax, 8
+xor r10d, [rsi+1024+r11*4]
+xor r10d, eax
+imul ecx, 54655307h
+rol ecx, 7
+mov [rsp + 8*8 + ((19+0)-((19+0)/(10))*(10))*4], r10d
+add rdi, 5*4
+cmp rdi, QWORD PTR [rsp+4*8]
+jne label0
+mov rax, QWORD PTR [rsp+2*8]
+mov r11, QWORD PTR [rsp+1*8]
+lea rdi, [rsp + 8*8 + 12*4]
+mov rsi, QWORD PTR [rsp+7*8]
+label1:
+movdqa xmm0, [rdi+0*20*4]
+movdqa xmm2, [rdi+2*20*4]
+movdqa xmm3, [rdi+3*20*4]
+movdqa xmm1, [rdi+1*20*4]
+movdqa xmm4, xmm0
+pand xmm0, xmm2
+pxor xmm0, xmm3
+pxor xmm2, xmm1
+pxor xmm2, xmm0
+por xmm3, xmm4
+pxor xmm3, xmm1
+pxor xmm4, xmm2
+movdqa xmm1, xmm3
+por xmm3, xmm4
+pxor xmm3, xmm0
+pand xmm0, xmm1
+pxor xmm4, xmm0
+pxor xmm1, xmm3
+pxor xmm1, xmm4
+pxor xmm4, xmm7
+pxor xmm2, [rdi+80*4]
+pxor xmm3, [rdi+80*5]
+pxor xmm1, [rdi+80*6]
+pxor xmm4, [rdi+80*7]
+cmp rsi, 16
+jl label4
+movdqa xmm6, xmm2
+punpckldq xmm2, xmm3
+movdqa xmm5, xmm1
+punpckldq xmm1, xmm4
+movdqa xmm0, xmm2
+punpcklqdq xmm2, xmm1
+punpckhqdq xmm0, xmm1
+punpckhdq xmm6, xmm3
+punpckhdq xmm5, xmm4
+movdqa xmm3, xmm6
+punpcklqdq xmm6, xmm5
+punpckhqdq xmm3, xmm5
+test rax, rax
+jz labelSSE2_Sosemanuk_Output3
+test rax, 15
+jnz labelSSE2_Sosemanuk_Output7
+pxor xmm2, [rax+0*16]
+pxor xmm0, [rax+1*16]
+pxor xmm6, [rax+2*16]
+pxor xmm3, [rax+3*16]
+add rax, 4*16
+jmp labelSSE2_Sosemanuk_Output3
+labelSSE2_Sosemanuk_Output7:
+movdqu xmm1, [rax+0*16]
+pxor xmm2, xmm1
+movdqu xmm1, [rax+1*16]
+pxor xmm0, xmm1
+movdqu xmm1, [rax+2*16]
+pxor xmm6, xmm1
+movdqu xmm1, [rax+3*16]
+pxor xmm3, xmm1
+add rax, 4*16
+labelSSE2_Sosemanuk_Output3:
+test r11, 15
+jnz labelSSE2_Sosemanuk_Output8
+movdqa [r11+0*16], xmm2
+movdqa [r11+1*16], xmm0
+movdqa [r11+2*16], xmm6
+movdqa [r11+3*16], xmm3
+jmp labelSSE2_Sosemanuk_Output9
+labelSSE2_Sosemanuk_Output8:
+movdqu [r11+0*16], xmm2
+movdqu [r11+1*16], xmm0
+movdqu [r11+2*16], xmm6
+movdqu [r11+3*16], xmm3
+labelSSE2_Sosemanuk_Output9:
+add r11, 4*16
+add rdi, 4*4
+sub rsi, 16
+jnz label1
+mov rsi, QWORD PTR [rsp+3*8]
+sub rsi, 80
+jz label6
+mov QWORD PTR [rsp+3*8], rsi
+mov QWORD PTR [rsp+2*8], rax
+mov QWORD PTR [rsp+1*8], r11
+jmp label2
+label4:
+test rax, rax
+jz label5
+movd xmm0, dword ptr [rax+0*4]
+pxor xmm2, xmm0
+movd xmm0, dword ptr [rax+1*4]
+pxor xmm3, xmm0
+movd xmm0, dword ptr [rax+2*4]
+pxor xmm1, xmm0
+movd xmm0, dword ptr [rax+3*4]
+pxor xmm4, xmm0
+add rax, 16
+label5:
+movd dword ptr [r11+0*4], xmm2
+movd dword ptr [r11+1*4], xmm3
+movd dword ptr [r11+2*4], xmm1
+movd dword ptr [r11+3*4], xmm4
+sub rsi, 4
+jz label6
+add r11, 16
+psrldq xmm2, 4
+psrldq xmm3, 4
+psrldq xmm1, 4
+psrldq xmm4, 4
+jmp label4
+label6:
+mov r10, QWORD PTR [rsp+6*8]
+movdqa xmm0, [rsp + 8*8+0*16]
+movdqa [r10+0*16], xmm0
+movdqa xmm0, [rsp + 8*8+1*16]
+movdqa [r10+1*16], xmm0
+movq xmm0, QWORD PTR [rsp + 8*8+2*16]
+movq QWORD PTR [r10+2*16], xmm0
+mov [r10+10*4], ecx
+mov [r10+11*4], edx
+movdqa xmm6, [rsp + 02f0h]
+movdqa xmm7, [rsp + 0300h]
+add rsp, 80*4*2+12*4+8*8 + 2*16+8
+pop		rdi
+pop		rsi
+ret
+Sosemanuk_OperateKeystream ENDP
+
+Panama_SSE2_Pull PROC FRAME
+rex_push_reg rdi
+alloc_stack(2*16)
+save_xmm128 xmm6, 0h
+save_xmm128 xmm7, 10h
+.endprolog
+shl rcx, 5
+jz label5
+mov r10d, [rdx+4*17]
+add rcx, r10
+mov rdi, rcx
+movdqa xmm0, xmmword ptr [rdx+0*16]
+movdqa xmm1, xmmword ptr [rdx+1*16]
+movdqa xmm2, xmmword ptr [rdx+2*16]
+movdqa xmm3, xmmword ptr [rdx+3*16]
+mov eax, dword ptr [rdx+4*16]
+label4:
+movdqa xmm6, xmm2
+movss xmm6, xmm3
+pshufd xmm5, xmm6, 0*64+3*16+2*4+1
+movd xmm6, eax
+movdqa xmm7, xmm3
+movss xmm7, xmm6
+pshufd xmm6, xmm7, 0*64+3*16+2*4+1
+movd ecx, xmm2
+not ecx
+movd r11d, xmm3
+or ecx, r11d
+xor eax, ecx
+pcmpeqb xmm7, xmm7
+pxor xmm7, xmm1
+por xmm7, xmm2
+pxor xmm7, xmm3
+movd ecx, xmm7
+rol ecx, (((((5*1) MOD (17))*(((5*1) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(1)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pshuflw xmm7, xmm7, 1*64+0*16+3*4+2
+movd ecx, xmm7
+rol ecx, (((((5*5) MOD (17))*(((5*5) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(5)) MOD (17)))*13+16)) MOD (17))*4], ecx
+punpckhqdq xmm7, xmm7
+movd ecx, xmm7
+rol ecx, (((((5*9) MOD (17))*(((5*9) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(9)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pshuflw xmm7, xmm7, 1*64+0*16+3*4+2
+movd ecx, xmm7
+rol ecx, (((((5*13) MOD (17))*(((5*13) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(13)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pcmpeqb xmm7, xmm7
+pxor xmm7, xmm0
+por xmm7, xmm1
+pxor xmm7, xmm2
+movd ecx, xmm7
+rol ecx, (((((5*2) MOD (17))*(((5*2) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(2)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pshuflw xmm7, xmm7, 1*64+0*16+3*4+2
+movd ecx, xmm7
+rol ecx, (((((5*6) MOD (17))*(((5*6) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(6)) MOD (17)))*13+16)) MOD (17))*4], ecx
+punpckhqdq xmm7, xmm7
+movd ecx, xmm7
+rol ecx, (((((5*10) MOD (17))*(((5*10) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(10)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pshuflw xmm7, xmm7, 1*64+0*16+3*4+2
+movd ecx, xmm7
+rol ecx, (((((5*14) MOD (17))*(((5*14) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(14)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pcmpeqb xmm7, xmm7
+pxor xmm7, xmm6
+por xmm7, xmm0
+pxor xmm7, xmm1
+movd ecx, xmm7
+rol ecx, (((((5*3) MOD (17))*(((5*3) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(3)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pshuflw xmm7, xmm7, 1*64+0*16+3*4+2
+movd ecx, xmm7
+rol ecx, (((((5*7) MOD (17))*(((5*7) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(7)) MOD (17)))*13+16)) MOD (17))*4], ecx
+punpckhqdq xmm7, xmm7
+movd ecx, xmm7
+rol ecx, (((((5*11) MOD (17))*(((5*11) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(11)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pshuflw xmm7, xmm7, 1*64+0*16+3*4+2
+movd ecx, xmm7
+rol ecx, (((((5*15) MOD (17))*(((5*15) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(15)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pcmpeqb xmm7, xmm7
+pxor xmm7, xmm5
+por xmm7, xmm6
+pxor xmm7, xmm0
+movd ecx, xmm7
+rol ecx, (((((5*4) MOD (17))*(((5*4) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(4)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pshuflw xmm7, xmm7, 1*64+0*16+3*4+2
+movd ecx, xmm7
+rol ecx, (((((5*8) MOD (17))*(((5*8) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(8)) MOD (17)))*13+16)) MOD (17))*4], ecx
+punpckhqdq xmm7, xmm7
+movd ecx, xmm7
+rol ecx, (((((5*12) MOD (17))*(((5*12) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(12)) MOD (17)))*13+16)) MOD (17))*4], ecx
+pshuflw xmm7, xmm7, 1*64+0*16+3*4+2
+movd ecx, xmm7
+rol ecx, (((((5*16) MOD (17))*(((5*16) MOD (17))+1)/2)) MOD (32))
+mov [rdx+((((((5*(16)) MOD (17)))*13+16)) MOD (17))*4], ecx
+movdqa xmm4, xmm3
+punpcklqdq xmm3, xmm2
+punpckhdq xmm4, xmm2
+movdqa xmm2, xmm1
+punpcklqdq xmm1, xmm0
+punpckhdq xmm2, xmm0
+test r8, r8
+jz label0
+movdqa xmm6, xmm4
+punpcklqdq xmm4, xmm2
+punpckhqdq xmm6, xmm2
+test r9, 15
+jnz label2
+test r9, r9
+jz label1
+pxor xmm4, [r9]
+pxor xmm6, [r9+16]
+add r9, 32
+jmp label1
+label2:
+movdqu xmm0, [r9]
+movdqu xmm2, [r9+16]
+pxor xmm4, xmm0
+pxor xmm6, xmm2
+add r9, 32
+label1:
+test r8, 15
+jnz label3
+movdqa xmmword ptr [r8], xmm4
+movdqa xmmword ptr [r8+16], xmm6
+add r8, 32
+jmp label0
+label3:
+movdqu xmmword ptr [r8], xmm4
+movdqu xmmword ptr [r8+16], xmm6
+add r8, 32
+label0:
+lea rcx, [r10 + 32]
+and rcx, 31*32
+lea r11, [r10 + (32-24)*32]
+and r11, 31*32
+movdqa xmm0, xmmword ptr [rdx+20*4+rcx+0*8]
+pxor xmm3, xmm0
+pshufd xmm0, xmm0, 2*64+3*16+0*4+1
+movdqa xmmword ptr [rdx+20*4+rcx+0*8], xmm3
+pxor xmm0, xmmword ptr [rdx+20*4+r11+2*8]
+movdqa xmmword ptr [rdx+20*4+r11+2*8], xmm0
+movdqa xmm4, xmmword ptr [rdx+20*4+rcx+2*8]
+pxor xmm1, xmm4
+movdqa xmmword ptr [rdx+20*4+rcx+2*8], xmm1
+pxor xmm4, xmmword ptr [rdx+20*4+r11+0*8]
+movdqa xmmword ptr [rdx+20*4+r11+0*8], xmm4
+movdqa xmm3, xmmword ptr [rdx+3*16]
+movdqa xmm2, xmmword ptr [rdx+2*16]
+movdqa xmm1, xmmword ptr [rdx+1*16]
+movdqa xmm0, xmmword ptr [rdx+0*16]
+movd xmm6, eax
+movdqa xmm7, xmm3
+movss xmm7, xmm6
+movdqa xmm6, xmm2
+movss xmm6, xmm3
+movdqa xmm5, xmm1
+movss xmm5, xmm2
+movdqa xmm4, xmm0
+movss xmm4, xmm1
+pshufd xmm7, xmm7, 0*64+3*16+2*4+1
+pshufd xmm6, xmm6, 0*64+3*16+2*4+1
+pshufd xmm5, xmm5, 0*64+3*16+2*4+1
+pshufd xmm4, xmm4, 0*64+3*16+2*4+1
+xor eax, 1
+movd ecx, xmm0
+xor eax, ecx
+movd ecx, xmm3
+xor eax, ecx
+pxor xmm3, xmm2
+pxor xmm2, xmm1
+pxor xmm1, xmm0
+pxor xmm0, xmm7
+pxor xmm3, xmm7
+pxor xmm2, xmm6
+pxor xmm1, xmm5
+pxor xmm0, xmm4
+lea rcx, [r10 + (32-4)*32]
+and rcx, 31*32
+lea r11, [r10 + 16*32]
+and r11, 31*32
+movdqa xmm4, xmmword ptr [rdx+20*4+rcx+0*16]
+movdqa xmm5, xmmword ptr [rdx+20*4+r11+0*16]
+movdqa xmm6, xmm4
+punpcklqdq xmm4, xmm5
+punpckhqdq xmm6, xmm5
+pxor xmm3, xmm4
+pxor xmm2, xmm6
+movdqa xmm4, xmmword ptr [rdx+20*4+rcx+1*16]
+movdqa xmm5, xmmword ptr [rdx+20*4+r11+1*16]
+movdqa xmm6, xmm4
+punpcklqdq xmm4, xmm5
+punpckhqdq xmm6, xmm5
+pxor xmm1, xmm4
+pxor xmm0, xmm6
+add r10, 32
+cmp r10, rdi
+jne label4
+mov [rdx+4*16], eax
+movdqa xmmword ptr [rdx+3*16], xmm3
+movdqa xmmword ptr [rdx+2*16], xmm2
+movdqa xmmword ptr [rdx+1*16], xmm1
+movdqa xmmword ptr [rdx+0*16], xmm0
+label5:
+movdqa xmm6, [rsp + 0h]
+movdqa xmm7, [rsp + 10h]
+add rsp, 2*16
+pop	rdi
+ret
+Panama_SSE2_Pull ENDP
+
+_TEXT ENDS
+END
diff --git a/runtime/third_party/cryptopp/xed25519.cpp b/runtime/third_party/cryptopp/xed25519.cpp
new file mode 100644
index 0000000..5339d48
--- /dev/null
+++ b/runtime/third_party/cryptopp/xed25519.cpp
@@ -0,0 +1,900 @@
+// xed25519.cpp - written and placed in public domain by Jeffrey Walton
+//                Crypto++ specific implementation wrapped around Andrew
+//                Moon's public domain curve25519-donna and ed25519-donna,
+//                https://github.com/floodyberry/curve25519-donna and
+//                https://github.com/floodyberry/ed25519-donna.
+
+#include "pch.h"
+
+#include "cryptlib.h"
+#include "asn.h"
+#include "integer.h"
+#include "filters.h"
+#include "stdcpp.h"
+
+#include "xed25519.h"
+#include "donna.h"
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using CryptoPP::byte;
+
+CRYPTOPP_ALIGN_DATA(16)
+const byte blacklist[][32] = {
+    { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+    { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+    { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
+      0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 },
+    { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24, 0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
+      0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86, 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 },
+    { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+    { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+    { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+    { 0xcd, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
+      0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x80 },
+    { 0x4c, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24, 0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
+      0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86, 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0xd7 },
+    { 0xd9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+    { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+    { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }
+};
+
+bool HasSmallOrder(const byte y[32])
+{
+    // The magic 12 is the count of blaklisted points
+    byte c[12] = { 0 };
+    for (size_t j = 0; j < 32; j++) {
+        for (size_t i = 0; i < COUNTOF(blacklist); i++) {
+            c[i] |= y[j] ^ blacklist[i][j];
+        }
+    }
+
+    unsigned int k = 0;
+    for (size_t i = 0; i < COUNTOF(blacklist); i++) {
+        k |= (c[i] - 1);
+    }
+
+    return (bool)((k >> 8) & 1);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+// ******************** x25519 Agreement ************************* //
+
+x25519::x25519(const byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH])
+{
+    std::memcpy(m_pk, y, PUBLIC_KEYLENGTH);
+    std::memcpy(m_sk, x, SECRET_KEYLENGTH);
+
+    CRYPTOPP_ASSERT(IsClamped(m_sk) == true);
+    CRYPTOPP_ASSERT(IsSmallOrder(m_pk) == false);
+}
+
+x25519::x25519(const byte x[SECRET_KEYLENGTH])
+{
+    std::memcpy(m_sk, x, SECRET_KEYLENGTH);
+    Donna::curve25519_mult(m_pk, m_sk);
+
+    CRYPTOPP_ASSERT(IsClamped(m_sk) == true);
+    CRYPTOPP_ASSERT(IsSmallOrder(m_pk) == false);
+}
+
+x25519::x25519(const Integer &y, const Integer &x)
+{
+    CRYPTOPP_ASSERT(y.MinEncodedSize() <= PUBLIC_KEYLENGTH);
+    CRYPTOPP_ASSERT(x.MinEncodedSize() <= SECRET_KEYLENGTH);
+
+    y.Encode(m_pk, PUBLIC_KEYLENGTH); std::reverse(m_pk+0, m_pk+PUBLIC_KEYLENGTH);
+    x.Encode(m_sk, SECRET_KEYLENGTH); std::reverse(m_sk+0, m_sk+SECRET_KEYLENGTH);
+
+    CRYPTOPP_ASSERT(IsClamped(m_sk) == true);
+    CRYPTOPP_ASSERT(IsSmallOrder(m_pk) == false);
+}
+
+x25519::x25519(const Integer &x)
+{
+    CRYPTOPP_ASSERT(x.MinEncodedSize() <= SECRET_KEYLENGTH);
+
+    x.Encode(m_sk, SECRET_KEYLENGTH);
+    std::reverse(m_sk+0, m_sk+SECRET_KEYLENGTH);
+    Donna::curve25519_mult(m_pk, m_sk);
+
+    CRYPTOPP_ASSERT(IsClamped(m_sk) == true);
+    CRYPTOPP_ASSERT(IsSmallOrder(m_pk) == false);
+}
+
+x25519::x25519(RandomNumberGenerator &rng)
+{
+    rng.GenerateBlock(m_sk, SECRET_KEYLENGTH);
+    ClampKey(m_sk);
+    SecretToPublicKey(m_pk, m_sk);
+}
+
+x25519::x25519(BufferedTransformation &params)
+{
+    Load(params);
+}
+
+void x25519::ClampKey(byte x[SECRET_KEYLENGTH]) const
+{
+    x[0] &= 248; x[31] &= 127; x[31] |= 64;
+}
+
+bool x25519::IsClamped(const byte x[SECRET_KEYLENGTH]) const
+{
+    return (x[0] & 248) == x[0] && (x[31] & 127) == x[31] && (x[31] | 64) == x[31];
+}
+
+bool x25519::IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const
+{
+    return HasSmallOrder(y);
+}
+
+void x25519::SecretToPublicKey(byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]) const
+{
+    Donna::curve25519_mult(y, x);
+}
+
+void x25519::BERDecodeAndCheckAlgorithmID(BufferedTransformation &bt)
+{
+    // We have not yet determined the OID to use for this object.
+    // We can't use OID's decoder because it throws BERDecodeError
+    // if the OIDs do not match.
+    OID oid(bt);
+
+    // 1.3.6.1.4.1.3029.1.5.1/curvey25519 from Cryptlib used by OpenPGP.
+    // https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-rfc4880bis
+    if (!m_oid.Empty() && m_oid != oid)
+        BERDecodeError();  // Only accept user specified OID
+    else if (oid == ASN1::curve25519() || oid == ASN1::X25519() ||
+        oid == OID(1)+3+6+1+4+1+3029+1+5)
+        m_oid = oid;  // Accept any of the x25519 OIDs
+    else
+        BERDecodeError();
+}
+
+void x25519::BERDecode(BufferedTransformation &bt)
+{
+    // https://tools.ietf.org/html/rfc8410, section 7 and
+    // https://www.cryptopp.com/wiki/curve25519_keys
+    BERSequenceDecoder privateKeyInfo(bt);
+        word32 version;
+        BERDecodeUnsigned<word32>(privateKeyInfo, version, INTEGER, 0, 1);    // check version
+
+        BERSequenceDecoder algorithm(privateKeyInfo);
+            // GetAlgorithmID().BERDecodeAndCheck(algorithm);
+            BERDecodeAndCheckAlgorithmID(algorithm);
+        algorithm.MessageEnd();
+
+        BERGeneralDecoder octetString(privateKeyInfo, OCTET_STRING);
+            BERDecodePrivateKey(octetString, false, (size_t)privateKeyInfo.RemainingLength());
+        octetString.MessageEnd();
+
+        // publicKey [1] IMPLICIT PublicKey OPTIONAL
+        bool generatePublicKey = true;
+        if (privateKeyInfo.EndReached() == false /*version == 1?*/)
+        {
+            // Should we test this before decoding? In either case we
+            // just throw a BERDecodeErr() when we can't parse it.
+            BERGeneralDecoder publicKey(privateKeyInfo, CONTEXT_SPECIFIC | CONSTRUCTED | 1);
+            SecByteBlock subjectPublicKey;
+            unsigned int unusedBits;
+            BERDecodeBitString(publicKey, subjectPublicKey, unusedBits);
+                CRYPTOPP_ASSERT(unusedBits == 0);
+                CRYPTOPP_ASSERT(subjectPublicKey.size() == PUBLIC_KEYLENGTH);
+                if (subjectPublicKey.size() != PUBLIC_KEYLENGTH)
+                    BERDecodeError();
+                std::memcpy(m_pk.begin(), subjectPublicKey, PUBLIC_KEYLENGTH);
+                generatePublicKey = false;
+            publicKey.MessageEnd();
+        }
+
+    privateKeyInfo.MessageEnd();
+
+    if (generatePublicKey)
+        Donna::curve25519_mult(m_pk, m_sk);
+
+    CRYPTOPP_ASSERT(IsClamped(m_sk) == true);
+    CRYPTOPP_ASSERT(IsSmallOrder(m_pk) == false);
+}
+
+void x25519::DEREncode(BufferedTransformation &bt, int version) const
+{
+    // https://tools.ietf.org/html/rfc8410, section 7 and
+    // https://www.cryptopp.com/wiki/curve25519_keys
+    CRYPTOPP_ASSERT(version == 0 || version == 1);
+
+    DERSequenceEncoder privateKeyInfo(bt);
+        DEREncodeUnsigned<word32>(privateKeyInfo, version);
+
+        DERSequenceEncoder algorithm(privateKeyInfo);
+            GetAlgorithmID().DEREncode(algorithm);
+        algorithm.MessageEnd();
+
+        DERGeneralEncoder octetString(privateKeyInfo, OCTET_STRING);
+            DEREncodePrivateKey(octetString);
+        octetString.MessageEnd();
+
+        if (version == 1)
+        {
+            DERGeneralEncoder publicKey(privateKeyInfo, CONTEXT_SPECIFIC | CONSTRUCTED | 1);
+                DEREncodeBitString(publicKey, m_pk, PUBLIC_KEYLENGTH);
+            publicKey.MessageEnd();
+        }
+
+    privateKeyInfo.MessageEnd();
+}
+
+void x25519::BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t /*size*/)
+{
+    // https://tools.ietf.org/html/rfc8410 and
+    // https://www.cryptopp.com/wiki/curve25519_keys
+
+    BERGeneralDecoder privateKey(bt, OCTET_STRING);
+
+        if (!privateKey.IsDefiniteLength())
+            BERDecodeError();
+
+        size_t size = privateKey.Get(m_sk, SECRET_KEYLENGTH);
+        if (size != SECRET_KEYLENGTH)
+            BERDecodeError();
+
+        // We don't know how to decode them
+        if (parametersPresent)
+            BERDecodeError();
+
+    privateKey.MessageEnd();
+}
+
+void x25519::DEREncodePrivateKey(BufferedTransformation &bt) const
+{
+    // https://tools.ietf.org/html/rfc8410
+    DERGeneralEncoder privateKey(bt, OCTET_STRING);
+        privateKey.Put(m_sk, SECRET_KEYLENGTH);
+    privateKey.MessageEnd();
+}
+
+bool x25519::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+    CRYPTOPP_UNUSED(rng);
+    CRYPTOPP_ASSERT(IsClamped(m_sk) == true);
+    CRYPTOPP_ASSERT(IsSmallOrder(m_pk) == false);
+
+    if (level >= 1 && IsClamped(m_sk) == false)
+        return false;
+    if (level >= 2 && IsSmallOrder(m_pk) == true)
+        return false;
+    if (level >= 3)
+    {
+        // Verify m_pk is pairwise consistent with m_sk
+        SecByteBlock pk(PUBLIC_KEYLENGTH);
+        SecretToPublicKey(pk, m_sk);
+
+        if (VerifyBufsEqual(pk, m_pk, PUBLIC_KEYLENGTH) == false)
+            return false;
+    }
+
+    return true;
+}
+
+bool x25519::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+    if (std::strcmp(name, Name::PrivateExponent()) == 0 || std::strcmp(name, "SecretKey") == 0)
+    {
+        this->ThrowIfTypeMismatch(name, typeid(ConstByteArrayParameter), valueType);
+        reinterpret_cast<ConstByteArrayParameter*>(pValue)->Assign(m_sk, SECRET_KEYLENGTH, false);
+        return true;
+    }
+
+    if (std::strcmp(name, Name::PublicElement()) == 0)
+    {
+        this->ThrowIfTypeMismatch(name, typeid(ConstByteArrayParameter), valueType);
+        reinterpret_cast<ConstByteArrayParameter*>(pValue)->Assign(m_pk, PUBLIC_KEYLENGTH, false);
+        return true;
+    }
+
+    if (std::strcmp(name, Name::GroupOID()) == 0)
+    {
+        if (m_oid.Empty())
+            return false;
+
+        this->ThrowIfTypeMismatch(name, typeid(OID), valueType);
+        *reinterpret_cast<OID *>(pValue) = m_oid;
+        return true;
+    }
+
+    return false;
+}
+
+void x25519::AssignFrom(const NameValuePairs &source)
+{
+    ConstByteArrayParameter val;
+    if (source.GetValue(Name::PrivateExponent(), val) || source.GetValue("SecretKey", val))
+    {
+        std::memcpy(m_sk, val.begin(), SECRET_KEYLENGTH);
+    }
+
+    if (source.GetValue(Name::PublicElement(), val))
+    {
+        std::memcpy(m_pk, val.begin(), PUBLIC_KEYLENGTH);
+    }
+
+    OID oid;
+    if (source.GetValue(Name::GroupOID(), oid))
+    {
+        m_oid = oid;
+    }
+
+    bool derive = false;
+    if (source.GetValue("DerivePublicKey", derive) && derive == true)
+        SecretToPublicKey(m_pk, m_sk);
+}
+
+void x25519::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params)
+{
+    ConstByteArrayParameter seed;
+    if (params.GetValue(Name::Seed(), seed) && rng.CanIncorporateEntropy())
+        rng.IncorporateEntropy(seed.begin(), seed.size());
+
+    rng.GenerateBlock(m_sk, SECRET_KEYLENGTH);
+    ClampKey(m_sk);
+    SecretToPublicKey(m_pk, m_sk);
+}
+
+void x25519::GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+{
+    rng.GenerateBlock(privateKey, SECRET_KEYLENGTH);
+    ClampKey(privateKey);
+}
+
+void x25519::GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+{
+    CRYPTOPP_UNUSED(rng);
+    SecretToPublicKey(publicKey, privateKey);
+}
+
+bool x25519::Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey) const
+{
+    CRYPTOPP_ASSERT(agreedValue != NULLPTR);
+    CRYPTOPP_ASSERT(otherPublicKey != NULLPTR);
+
+    if (validateOtherPublicKey && IsSmallOrder(otherPublicKey))
+        return false;
+
+    return Donna::curve25519_mult(agreedValue, privateKey, otherPublicKey) == 0;
+}
+
+// ******************** ed25519 Signer ************************* //
+
+void ed25519PrivateKey::SecretToPublicKey(byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]) const
+{
+    int ret = Donna::ed25519_publickey(y, x);
+    CRYPTOPP_ASSERT(ret == 0); CRYPTOPP_UNUSED(ret);
+}
+
+bool ed25519PrivateKey::IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const
+{
+    return HasSmallOrder(y);
+}
+
+bool ed25519PrivateKey::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+    CRYPTOPP_UNUSED(rng);
+    CRYPTOPP_ASSERT(IsSmallOrder(m_pk) == false);
+
+    if (level >= 1 && IsSmallOrder(m_pk) == true)
+        return false;
+    if (level >= 3)
+    {
+        // Verify m_pk is pairwise consistent with m_sk
+        SecByteBlock pk(PUBLIC_KEYLENGTH);
+        SecretToPublicKey(pk, m_sk);
+
+        if (VerifyBufsEqual(pk, m_pk, PUBLIC_KEYLENGTH) == false)
+            return false;
+    }
+
+    return true;
+}
+
+bool ed25519PrivateKey::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+     if (std::strcmp(name, Name::PrivateExponent()) == 0 || std::strcmp(name, "SecretKey") == 0)
+     {
+        this->ThrowIfTypeMismatch(name, typeid(ConstByteArrayParameter), valueType);
+        reinterpret_cast<ConstByteArrayParameter*>(pValue)->Assign(m_sk, SECRET_KEYLENGTH, false);
+        return true;
+    }
+
+    if (std::strcmp(name, Name::PublicElement()) == 0)
+    {
+        this->ThrowIfTypeMismatch(name, typeid(ConstByteArrayParameter), valueType);
+        reinterpret_cast<ConstByteArrayParameter*>(pValue)->Assign(m_pk, PUBLIC_KEYLENGTH, false);
+        return true;
+    }
+
+    if (std::strcmp(name, Name::GroupOID()) == 0)
+    {
+        if (m_oid.Empty())
+            return false;
+
+        this->ThrowIfTypeMismatch(name, typeid(OID), valueType);
+        *reinterpret_cast<OID *>(pValue) = m_oid;
+        return true;
+    }
+
+    return false;
+}
+
+void ed25519PrivateKey::AssignFrom(const NameValuePairs &source)
+{
+    ConstByteArrayParameter val;
+    if (source.GetValue(Name::PrivateExponent(), val) || source.GetValue("SecretKey", val))
+    {
+        CRYPTOPP_ASSERT(val.size() == SECRET_KEYLENGTH);
+        std::memcpy(m_sk, val.begin(), SECRET_KEYLENGTH);
+    }
+    if (source.GetValue(Name::PublicElement(), val))
+    {
+        CRYPTOPP_ASSERT(val.size() == PUBLIC_KEYLENGTH);
+        std::memcpy(m_pk, val.begin(), PUBLIC_KEYLENGTH);
+    }
+
+    OID oid;
+    if (source.GetValue(Name::GroupOID(), oid))
+    {
+        m_oid = oid;
+    }
+
+    bool derive = false;
+    if (source.GetValue("DerivePublicKey", derive) && derive == true)
+        SecretToPublicKey(m_pk, m_sk);
+
+    CRYPTOPP_ASSERT(IsSmallOrder(m_pk) == false);
+}
+
+void ed25519PrivateKey::GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params=g_nullNameValuePairs)
+{
+    ConstByteArrayParameter seed;
+    if (params.GetValue(Name::Seed(), seed) && rng.CanIncorporateEntropy())
+        rng.IncorporateEntropy(seed.begin(), seed.size());
+
+    rng.GenerateBlock(m_sk, SECRET_KEYLENGTH);
+    int ret = Donna::ed25519_publickey(m_pk, m_sk);
+    CRYPTOPP_ASSERT(ret == 0); CRYPTOPP_UNUSED(ret);
+}
+
+void ed25519PrivateKey::MakePublicKey (PublicKey &pub) const
+{
+    pub.AssignFrom(MakeParameters
+        (Name::PublicElement(), ConstByteArrayParameter(m_pk.begin(), PUBLIC_KEYLENGTH))
+        (Name::GroupOID(), GetAlgorithmID()));
+}
+
+void ed25519PrivateKey::BERDecodeAndCheckAlgorithmID(BufferedTransformation &bt)
+{
+    // We have not yet determined the OID to use for this object.
+    // We can't use OID's decoder because it throws BERDecodeError
+    // if the OIDs do not match.
+    OID oid(bt);
+
+    if (!m_oid.Empty() && m_oid != oid)
+        BERDecodeError();  // Only accept user specified OID
+    else if (oid == ASN1::curve25519() || oid == ASN1::Ed25519())
+        m_oid = oid;  // Accept any of the ed25519PrivateKey OIDs
+    else
+        BERDecodeError();
+}
+
+void ed25519PrivateKey::BERDecode(BufferedTransformation &bt)
+{
+    // https://tools.ietf.org/html/rfc8410, section 7 and
+    // https://www.cryptopp.com/wiki/curve25519_keys
+    BERSequenceDecoder privateKeyInfo(bt);
+        word32 version;
+        BERDecodeUnsigned<word32>(privateKeyInfo, version, INTEGER, 0, 1);    // check version
+
+        BERSequenceDecoder algorithm(privateKeyInfo);
+            // GetAlgorithmID().BERDecodeAndCheck(algorithm);
+            BERDecodeAndCheckAlgorithmID(algorithm);
+        algorithm.MessageEnd();
+
+        BERGeneralDecoder octetString(privateKeyInfo, OCTET_STRING);
+            BERDecodePrivateKey(octetString, false, (size_t)privateKeyInfo.RemainingLength());
+        octetString.MessageEnd();
+
+        // publicKey [1] IMPLICIT PublicKey OPTIONAL
+        bool generatePublicKey = true;
+        if (privateKeyInfo.EndReached() == false /*version == 1?*/)
+        {
+            // Should we test this before decoding? In either case we
+            // just throw a BERDecodeErr() when we can't parse it.
+            BERGeneralDecoder publicKey(privateKeyInfo, CONTEXT_SPECIFIC | CONSTRUCTED | 1);
+            SecByteBlock subjectPublicKey;
+            unsigned int unusedBits;
+            BERDecodeBitString(publicKey, subjectPublicKey, unusedBits);
+                CRYPTOPP_ASSERT(unusedBits == 0);
+                CRYPTOPP_ASSERT(subjectPublicKey.size() == PUBLIC_KEYLENGTH);
+                if (subjectPublicKey.size() != PUBLIC_KEYLENGTH)
+                    BERDecodeError();
+                std::memcpy(m_pk.begin(), subjectPublicKey, PUBLIC_KEYLENGTH);
+                generatePublicKey = false;
+            publicKey.MessageEnd();
+        }
+
+    privateKeyInfo.MessageEnd();
+
+    if (generatePublicKey)
+        Donna::ed25519_publickey(m_pk, m_sk);
+
+    CRYPTOPP_ASSERT(IsSmallOrder(m_pk) == false);
+}
+
+void ed25519PrivateKey::DEREncode(BufferedTransformation &bt, int version) const
+{
+    // https://tools.ietf.org/html/rfc8410, section 7 and
+    // https://www.cryptopp.com/wiki/curve25519_keys
+    CRYPTOPP_ASSERT(version == 0 || version == 1);
+
+    DERSequenceEncoder privateKeyInfo(bt);
+        DEREncodeUnsigned<word32>(privateKeyInfo, version);
+
+        DERSequenceEncoder algorithm(privateKeyInfo);
+            GetAlgorithmID().DEREncode(algorithm);
+        algorithm.MessageEnd();
+
+        DERGeneralEncoder octetString(privateKeyInfo, OCTET_STRING);
+            DEREncodePrivateKey(octetString);
+        octetString.MessageEnd();
+
+        if (version == 1)
+        {
+            DERGeneralEncoder publicKey(privateKeyInfo, CONTEXT_SPECIFIC | CONSTRUCTED | 1);
+                DEREncodeBitString(publicKey, m_pk, PUBLIC_KEYLENGTH);
+            publicKey.MessageEnd();
+        }
+
+    privateKeyInfo.MessageEnd();
+}
+
+void ed25519PrivateKey::BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t /*size*/)
+{
+    // https://tools.ietf.org/html/rfc8410 and
+    // https://www.cryptopp.com/wiki/curve25519_keys
+
+    BERGeneralDecoder privateKey(bt, OCTET_STRING);
+
+        if (!privateKey.IsDefiniteLength())
+            BERDecodeError();
+
+        size_t size = privateKey.Get(m_sk, SECRET_KEYLENGTH);
+        if (size != SECRET_KEYLENGTH)
+            BERDecodeError();
+
+        // We don't know how to decode them
+        if (parametersPresent)
+            BERDecodeError();
+
+    privateKey.MessageEnd();
+}
+
+void ed25519PrivateKey::DEREncodePrivateKey(BufferedTransformation &bt) const
+{
+    // https://tools.ietf.org/html/rfc8410
+    DERGeneralEncoder privateKey(bt, OCTET_STRING);
+        privateKey.Put(m_sk, SECRET_KEYLENGTH);
+    privateKey.MessageEnd();
+}
+
+void ed25519PrivateKey::SetPrivateExponent (const byte x[SECRET_KEYLENGTH])
+{
+    AssignFrom(MakeParameters
+        (Name::PrivateExponent(), ConstByteArrayParameter(x, SECRET_KEYLENGTH))
+        ("DerivePublicKey", true));
+}
+
+void ed25519PrivateKey::SetPrivateExponent (const Integer &x)
+{
+    CRYPTOPP_ASSERT(x.MinEncodedSize() <= SECRET_KEYLENGTH);
+
+    SecByteBlock bx(SECRET_KEYLENGTH);
+    x.Encode(bx, SECRET_KEYLENGTH); std::reverse(bx+0, bx+SECRET_KEYLENGTH);
+
+    AssignFrom(MakeParameters
+        (Name::PrivateExponent(), ConstByteArrayParameter(bx, SECRET_KEYLENGTH, false))
+        ("DerivePublicKey", true));
+}
+
+const Integer& ed25519PrivateKey::GetPrivateExponent() const
+{
+    m_x = Integer(m_sk, SECRET_KEYLENGTH, Integer::UNSIGNED, LITTLE_ENDIAN_ORDER);
+    return m_x;
+}
+
+////////////////////////
+
+ed25519Signer::ed25519Signer(const byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH])
+{
+    AccessPrivateKey().AssignFrom(MakeParameters
+        (Name::PrivateExponent(), ConstByteArrayParameter(x, SECRET_KEYLENGTH, false))
+        (Name::PublicElement(), ConstByteArrayParameter(y, PUBLIC_KEYLENGTH, false)));
+}
+
+ed25519Signer::ed25519Signer(const byte x[SECRET_KEYLENGTH])
+{
+    AccessPrivateKey().AssignFrom(MakeParameters
+        (Name::PrivateExponent(), ConstByteArrayParameter(x, SECRET_KEYLENGTH, false))
+        ("DerivePublicKey", true));
+}
+
+ed25519Signer::ed25519Signer(const Integer &y, const Integer &x)
+{
+    CRYPTOPP_ASSERT(y.MinEncodedSize() <= PUBLIC_KEYLENGTH);
+    CRYPTOPP_ASSERT(x.MinEncodedSize() <= SECRET_KEYLENGTH);
+
+    SecByteBlock by(PUBLIC_KEYLENGTH), bx(SECRET_KEYLENGTH);
+    y.Encode(by, PUBLIC_KEYLENGTH); std::reverse(by+0, by+PUBLIC_KEYLENGTH);
+    x.Encode(bx, SECRET_KEYLENGTH); std::reverse(bx+0, bx+SECRET_KEYLENGTH);
+
+    AccessPrivateKey().AssignFrom(MakeParameters
+        (Name::PublicElement(), ConstByteArrayParameter(by, PUBLIC_KEYLENGTH, false))
+        (Name::PrivateExponent(), ConstByteArrayParameter(bx, SECRET_KEYLENGTH, false)));
+}
+
+ed25519Signer::ed25519Signer(const Integer &x)
+{
+    CRYPTOPP_ASSERT(x.MinEncodedSize() <= SECRET_KEYLENGTH);
+
+    SecByteBlock bx(SECRET_KEYLENGTH);
+    x.Encode(bx, SECRET_KEYLENGTH); std::reverse(bx+0, bx+SECRET_KEYLENGTH);
+
+    AccessPrivateKey().AssignFrom(MakeParameters
+        (Name::PrivateExponent(), ConstByteArrayParameter(bx, SECRET_KEYLENGTH, false))
+        ("DerivePublicKey", true));
+}
+
+ed25519Signer::ed25519Signer(const PKCS8PrivateKey &key)
+{
+    // Load all fields from the other key
+    ByteQueue queue;
+    key.Save(queue);
+    AccessPrivateKey().Load(queue);
+}
+
+ed25519Signer::ed25519Signer(RandomNumberGenerator &rng)
+{
+    AccessPrivateKey().GenerateRandom(rng);
+}
+
+ed25519Signer::ed25519Signer(BufferedTransformation &params)
+{
+    AccessPrivateKey().Load(params);
+}
+
+size_t ed25519Signer::SignAndRestart(RandomNumberGenerator &rng, PK_MessageAccumulator &messageAccumulator, byte *signature, bool restart) const
+{
+    CRYPTOPP_ASSERT(signature != NULLPTR); CRYPTOPP_UNUSED(rng);
+
+    ed25519_MessageAccumulator& accum = dynamic_cast<ed25519_MessageAccumulator&>(messageAccumulator);
+    const ed25519PrivateKey& pk = dynamic_cast<const ed25519PrivateKey&>(GetPrivateKey());
+    int ret = Donna::ed25519_sign(accum.data(), accum.size(), pk.GetPrivateKeyBytePtr(), pk.GetPublicKeyBytePtr(), signature);
+    CRYPTOPP_ASSERT(ret == 0);
+
+    if (restart)
+        accum.Restart();
+
+    return ret == 0 ? SIGNATURE_LENGTH : 0;
+}
+
+size_t ed25519Signer::SignStream (RandomNumberGenerator &rng, std::istream& stream, byte *signature) const
+{
+    CRYPTOPP_ASSERT(signature != NULLPTR); CRYPTOPP_UNUSED(rng);
+
+    const ed25519PrivateKey& pk = dynamic_cast<const ed25519PrivateKey&>(GetPrivateKey());
+    int ret = Donna::ed25519_sign(stream, pk.GetPrivateKeyBytePtr(), pk.GetPublicKeyBytePtr(), signature);
+    CRYPTOPP_ASSERT(ret == 0);
+
+    return ret == 0 ? SIGNATURE_LENGTH : 0;
+}
+
+// ******************** ed25519 Verifier ************************* //
+
+bool ed25519PublicKey::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+    if (std::strcmp(name, Name::PublicElement()) == 0)
+    {
+        this->ThrowIfTypeMismatch(name, typeid(ConstByteArrayParameter), valueType);
+        reinterpret_cast<ConstByteArrayParameter*>(pValue)->Assign(m_pk, PUBLIC_KEYLENGTH, false);
+        return true;
+    }
+
+    if (std::strcmp(name, Name::GroupOID()) == 0)
+    {
+        if (m_oid.Empty())
+            return false;
+
+        this->ThrowIfTypeMismatch(name, typeid(OID), valueType);
+        *reinterpret_cast<OID *>(pValue) = m_oid;
+        return true;
+    }
+
+    return false;
+}
+
+void ed25519PublicKey::AssignFrom(const NameValuePairs &source)
+{
+    ConstByteArrayParameter ba;
+    if (source.GetValue(Name::PublicElement(), ba))
+    {
+        std::memcpy(m_pk, ba.begin(), PUBLIC_KEYLENGTH);
+    }
+
+    OID oid;
+    if (source.GetValue(Name::GroupOID(), oid))
+    {
+        m_oid = oid;
+    }
+}
+
+void ed25519PublicKey::BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt)
+{
+    // We have not yet determined the OID to use for this object.
+    // We can't use OID's decoder because it throws BERDecodeError
+    // if the OIDs do not match.
+    OID oid(bt);
+
+    if (!m_oid.Empty() && m_oid != oid)
+        BERDecodeError();  // Only accept user specified OID
+    else if (oid == ASN1::curve25519() || oid == ASN1::Ed25519())
+        m_oid = oid;  // Accept any of the ed25519PublicKey OIDs
+    else
+        BERDecodeError();
+}
+
+void ed25519PublicKey::BERDecode(BufferedTransformation &bt)
+{
+    BERSequenceDecoder publicKeyInfo(bt);
+
+        BERSequenceDecoder algorithm(publicKeyInfo);
+            // GetAlgorithmID().BERDecodeAndCheck(algorithm);
+            BERDecodeAndCheckAlgorithmID(algorithm);
+        algorithm.MessageEnd();
+
+        BERDecodePublicKey(publicKeyInfo, false, (size_t)publicKeyInfo.RemainingLength());
+
+    publicKeyInfo.MessageEnd();
+}
+
+void ed25519PublicKey::DEREncode(BufferedTransformation &bt) const
+{
+    DERSequenceEncoder publicKeyInfo(bt);
+
+        DERSequenceEncoder algorithm(publicKeyInfo);
+            GetAlgorithmID().DEREncode(algorithm);
+        algorithm.MessageEnd();
+
+        DEREncodePublicKey(publicKeyInfo);
+
+    publicKeyInfo.MessageEnd();
+}
+
+void ed25519PublicKey::BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t /*size*/)
+{
+    // We don't know how to decode them
+    if (parametersPresent)
+        BERDecodeError();
+
+    SecByteBlock subjectPublicKey;
+    unsigned int unusedBits;
+    BERDecodeBitString(bt, subjectPublicKey, unusedBits);
+
+    CRYPTOPP_ASSERT(unusedBits == 0);
+    CRYPTOPP_ASSERT(subjectPublicKey.size() == PUBLIC_KEYLENGTH);
+    if (subjectPublicKey.size() != PUBLIC_KEYLENGTH)
+        BERDecodeError();
+
+    std::memcpy(m_pk.begin(), subjectPublicKey, PUBLIC_KEYLENGTH);
+}
+
+void ed25519PublicKey::DEREncodePublicKey(BufferedTransformation &bt) const
+{
+    DEREncodeBitString(bt, m_pk, PUBLIC_KEYLENGTH);
+}
+
+void ed25519PublicKey::SetPublicElement (const byte y[PUBLIC_KEYLENGTH])
+{
+    std::memcpy(m_pk, y, PUBLIC_KEYLENGTH);
+}
+
+void ed25519PublicKey::SetPublicElement (const Integer &y)
+{
+    CRYPTOPP_ASSERT(y.MinEncodedSize() <= PUBLIC_KEYLENGTH);
+
+    SecByteBlock by(PUBLIC_KEYLENGTH);
+    y.Encode(by, PUBLIC_KEYLENGTH); std::reverse(by+0, by+PUBLIC_KEYLENGTH);
+
+    std::memcpy(m_pk, by, PUBLIC_KEYLENGTH);
+}
+
+const Integer& ed25519PublicKey::GetPublicElement() const
+{
+    m_y = Integer(m_pk, PUBLIC_KEYLENGTH, Integer::UNSIGNED, LITTLE_ENDIAN_ORDER);
+    return m_y;
+}
+
+bool ed25519PublicKey::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+    CRYPTOPP_UNUSED(rng); CRYPTOPP_UNUSED(level);
+    return true;
+}
+
+////////////////////////
+
+ed25519Verifier::ed25519Verifier(const byte y[PUBLIC_KEYLENGTH])
+{
+    AccessPublicKey().AssignFrom(MakeParameters
+        (Name::PublicElement(), ConstByteArrayParameter(y, PUBLIC_KEYLENGTH)));
+}
+
+ed25519Verifier::ed25519Verifier(const Integer &y)
+{
+    CRYPTOPP_ASSERT(y.MinEncodedSize() <= PUBLIC_KEYLENGTH);
+
+    SecByteBlock by(PUBLIC_KEYLENGTH);
+    y.Encode(by, PUBLIC_KEYLENGTH); std::reverse(by+0, by+PUBLIC_KEYLENGTH);
+
+    AccessPublicKey().AssignFrom(MakeParameters
+        (Name::PublicElement(), ConstByteArrayParameter(by, PUBLIC_KEYLENGTH, false)));
+}
+
+ed25519Verifier::ed25519Verifier(const X509PublicKey &key)
+{
+    // Load all fields from the other key
+    ByteQueue queue;
+    key.Save(queue);
+    AccessPublicKey().Load(queue);
+}
+
+ed25519Verifier::ed25519Verifier(BufferedTransformation &params)
+{
+    AccessPublicKey().Load(params);
+}
+
+ed25519Verifier::ed25519Verifier(const ed25519Signer& signer)
+{
+    const ed25519PrivateKey& priv = dynamic_cast<const ed25519PrivateKey&>(signer.GetPrivateKey());
+    priv.MakePublicKey(AccessPublicKey());
+}
+
+bool ed25519Verifier::VerifyAndRestart(PK_MessageAccumulator &messageAccumulator) const
+{
+    ed25519_MessageAccumulator& accum = static_cast<ed25519_MessageAccumulator&>(messageAccumulator);
+    const ed25519PublicKey& pk = dynamic_cast<const ed25519PublicKey&>(GetPublicKey());
+    int ret = Donna::ed25519_sign_open(accum.data(), accum.size(), pk.GetPublicKeyBytePtr(), accum.signature());
+    accum.Restart();
+
+    return ret == 0;
+}
+
+bool ed25519Verifier::VerifyStream(std::istream& stream, const byte *signature, size_t signatureLen) const
+{
+    CRYPTOPP_ASSERT(signatureLen == SIGNATURE_LENGTH);
+    CRYPTOPP_UNUSED(signatureLen);
+
+    const ed25519PublicKey& pk = static_cast<const ed25519PublicKey&>(GetPublicKey());
+    int ret = Donna::ed25519_sign_open(stream, pk.GetPublicKeyBytePtr(), signature);
+
+    return ret == 0;
+}
+
+NAMESPACE_END  // CryptoPP
diff --git a/runtime/third_party/cryptopp/xed25519.h b/runtime/third_party/cryptopp/xed25519.h
new file mode 100644
index 0000000..cd0c75c
--- /dev/null
+++ b/runtime/third_party/cryptopp/xed25519.h
@@ -0,0 +1,825 @@
+// xed25519.h - written and placed in public domain by Jeffrey Walton
+//              Crypto++ specific implementation wrapped around Andrew
+//              Moon's public domain curve25519-donna and ed25519-donna,
+//              http://github.com/floodyberry/curve25519-donna and
+//              http://github.com/floodyberry/ed25519-donna.
+
+// Typically the key agreement classes encapsulate their data more
+// than x25519 does below. They are a little more accessible
+// due to crypto_box operations.
+
+/// \file xed25519.h
+/// \brief Classes for x25519 and ed25519 operations
+/// \details This implementation integrates Andrew Moon's public domain code
+///  for curve25519-donna and ed25519-donna.
+/// \details Moving keys into and out of the library proceeds as follows.
+///  If an Integer class is accepted or returned, then the data is in big
+///  endian format. That is, the MSB is at byte position 0, and the LSB
+///  is at byte position 31. The Integer will work as expected, just like
+///  an int or a long.
+/// \details If a byte array is accepted, then the byte array is in little
+///  endian format. That is, the LSB is at byte position 0, and the MSB is
+///  at byte position 31. This follows the implementation where byte 0 is
+///  clamed with 248. That is my_arr[0] &= 248 to mask the lower 3 bits.
+/// \details PKCS8 and X509 keys encoded using ASN.1 follow little endian
+///  arrays. The format is specified in <A HREF=
+///  "http:///tools.ietf.org/html/draft-ietf-curdle-pkix">draft-ietf-curdle-pkix</A>.
+/// \details If you have a little endian array and you want to wrap it in
+///  an Integer using big endian then you can perform the following:
+/// <pre>Integer x(my_arr, SECRET_KEYLENGTH, UNSIGNED, LITTLE_ENDIAN_ORDER);</pre>
+/// \sa Andrew Moon's x22519 GitHub <A
+///  HREF="http://github.com/floodyberry/curve25519-donna">curve25519-donna</A>,
+///  ed22519 GitHub <A
+///  HREF="http://github.com/floodyberry/ed25519-donna">ed25519-donna</A>, and
+///  <A HREF="http:///tools.ietf.org/html/draft-ietf-curdle-pkix">draft-ietf-curdle-pkix</A>
+/// \since Crypto++ 8.0
+
+#ifndef CRYPTOPP_XED25519_H
+#define CRYPTOPP_XED25519_H
+
+#include "cryptlib.h"
+#include "pubkey.h"
+#include "oids.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+class Integer;
+struct ed25519Signer;
+struct ed25519Verifier;
+
+// ******************** x25519 Agreement ************************* //
+
+/// \brief x25519 with key validation
+/// \since Crypto++ 8.0
+class x25519 : public SimpleKeyAgreementDomain, public CryptoParameters, public PKCS8PrivateKey
+{
+public:
+    /// \brief Size of the private key
+    /// \details SECRET_KEYLENGTH is the size of the private key, in bytes.
+    CRYPTOPP_CONSTANT(SECRET_KEYLENGTH = 32);
+    /// \brief Size of the public key
+    /// \details PUBLIC_KEYLENGTH is the size of the public key, in bytes.
+    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
+    /// \brief Size of the shared key
+    /// \details SHARED_KEYLENGTH is the size of the shared key, in bytes.
+    CRYPTOPP_CONSTANT(SHARED_KEYLENGTH = 32);
+
+    virtual ~x25519() {}
+
+    /// \brief Create a x25519 object
+    /// \details This constructor creates an empty x25519 object. It is
+    ///  intended for use in loading existing parameters, like CryptoBox
+    ///  parameters. If you are performing key agreement you should use a
+    ///   constructor that generates random parameters on construction.
+    x25519() {}
+
+    /// \brief Create a x25519 object
+    /// \param y public key
+    /// \param x private key
+    /// \details This constructor creates a x25519 object using existing parameters.
+    /// \note The public key is not validated.
+    x25519(const byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]);
+
+    /// \brief Create a x25519 object
+    /// \param x private key
+    /// \details This constructor creates a x25519 object using existing parameters.
+    ///  The public key is calculated from the private key.
+    x25519(const byte x[SECRET_KEYLENGTH]);
+
+    /// \brief Create a x25519 object
+    /// \param y public key
+    /// \param x private key
+    /// \details This constructor creates a x25519 object using existing parameters.
+    /// \note The public key is not validated.
+    x25519(const Integer &y, const Integer &x);
+
+    /// \brief Create a x25519 object
+    /// \param x private key
+    /// \details This constructor creates a x25519 object using existing parameters.
+    ///  The public key is calculated from the private key.
+    x25519(const Integer &x);
+
+    /// \brief Create a x25519 object
+    /// \param rng RandomNumberGenerator derived class
+    /// \details This constructor creates a new x25519 using the random number generator.
+    x25519(RandomNumberGenerator &rng);
+
+    /// \brief Create a x25519 object
+    /// \param params public and private key
+    /// \details This constructor creates a x25519 object using existing parameters.
+    ///  The <tt>params</tt> can be created with <tt>Save</tt>.
+    /// \note The public key is not validated.
+    x25519(BufferedTransformation &params);
+
+    /// \brief Create a x25519 object
+    /// \param oid an object identifier
+    /// \details This constructor creates a new x25519 using the specified OID. The public
+    ///  and private points are uninitialized.
+    x25519(const OID &oid);
+
+    /// \brief Clamp a private key
+    /// \param x private key
+    /// \details ClampKeys() clamps a private key and then regenerates the
+    ///  public key from the private key.
+    void ClampKey(byte x[SECRET_KEYLENGTH]) const;
+
+    /// \brief Determine if private key is clamped
+    /// \param x private key
+    bool IsClamped(const byte x[SECRET_KEYLENGTH]) const;
+
+    /// \brief Test if a key has small order
+    /// \param y public key
+    bool IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const;
+
+    /// \brief Get the Object Identifier
+    /// \return the Object Identifier
+    /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
+    ///  The default private key format is RFC 5208.
+    OID GetAlgorithmID() const {
+        return m_oid.Empty() ? ASN1::X25519() : m_oid;
+    }
+
+    /// \brief Set the Object Identifier
+    /// \param oid the new Object Identifier
+    void SetAlgorithmID(const OID& oid) {
+        m_oid = oid;
+    }
+
+    // CryptoParameters
+    bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+    void AssignFrom(const NameValuePairs &source);
+
+    // CryptoParameters
+    CryptoParameters & AccessCryptoParameters() {return *this;}
+
+    /// \brief DER encode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \details Save() will write the OID associated with algorithm or scheme.
+    ///  In the case of public and private keys, this function writes the
+    ///  subjectPublicKeyInfo parts.
+    /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
+    ///  The default private key format is RFC 5208, which is the old format.
+    ///  The old format provides the best interop, and keys will work
+    ///  with OpenSSL.
+    /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
+    ///  Key Packages</A>
+    void Save(BufferedTransformation &bt) const {
+        DEREncode(bt, 0);
+    }
+
+    /// \brief DER encode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \param v1 flag indicating v1
+    /// \details Save() will write the OID associated with algorithm or scheme.
+    ///  In the case of public and private keys, this function writes the
+    ///  subjectPublicKeyInfo parts.
+    /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
+    ///  The default private key format is RFC 5208.
+    /// \details v1 means INTEGER 0 is written. INTEGER 0 means
+    ///  RFC 5208 format, which is the old format. The old format provides
+    ///  the best interop, and keys will work with OpenSSL. The other
+    ///  option uses INTEGER 1. INTEGER 1 means RFC 5958 format,
+    ///  which is the new format.
+    /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
+    ///  Key Packages</A>
+    void Save(BufferedTransformation &bt, bool v1) const {
+        DEREncode(bt, v1 ? 0 : 1);
+    }
+
+    /// \brief BER decode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
+    ///  Key Packages</A>
+    void Load(BufferedTransformation &bt) {
+        BERDecode(bt);
+    }
+
+    // PKCS8PrivateKey
+    void BERDecode(BufferedTransformation &bt);
+    void DEREncode(BufferedTransformation &bt) const { DEREncode(bt, 0); }
+    void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
+    void DEREncodePrivateKey(BufferedTransformation &bt) const;
+
+    /// \brief DER encode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \param version indicates version
+    /// \details DEREncode() will write the OID associated with algorithm or
+    ///  scheme. In the case of public and private keys, this function writes
+    ///  the subjectPublicKeyInfo parts.
+    /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
+    ///  The default private key format is RFC 5208.
+    /// \details The value of version is written as the INTEGER. INTEGER 0 means
+    ///  RFC 5208 format, which is the old format. The old format provides
+    ///  the best interop, and keys will work with OpenSSL. The INTEGER 1
+    ///  means RFC 5958 format, which is the new format.
+    void DEREncode(BufferedTransformation &bt, int version) const;
+
+    /// \brief Determine if OID is valid for this object
+    /// \details BERDecodeAndCheckAlgorithmID() parses the OID from
+    ///  <tt>bt</tt> and determines if it valid for this object. The
+    ///  problem in practice is there are multiple OIDs available to
+    ///  denote curve25519 operations. The OIDs include an old GNU
+    ///  OID used by SSH, OIDs specified in draft-josefsson-pkix-newcurves,
+    ///  and OIDs specified in draft-ietf-curdle-pkix.
+    /// \details By default BERDecodeAndCheckAlgorithmID() accepts an
+    ///  OID set by the user, <tt>ASN1::curve25519()</tt> and <tt>ASN1::X25519()</tt>.
+    ///  <tt>ASN1::curve25519()</tt> is generic and says "this key is valid for
+    ///  curve25519 operations". <tt>ASN1::X25519()</tt> is specific and says
+    ///  "this key is valid for x25519 key exchange."
+    void BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt);
+
+    // DL_PrivateKey
+    void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params);
+
+    // SimpleKeyAgreementDomain
+    unsigned int AgreedValueLength() const {return SHARED_KEYLENGTH;}
+    unsigned int PrivateKeyLength() const {return SECRET_KEYLENGTH;}
+    unsigned int PublicKeyLength() const {return PUBLIC_KEYLENGTH;}
+
+    // SimpleKeyAgreementDomain
+    void GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const;
+    void GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const;
+    bool Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey=true) const;
+
+protected:
+    // Create a public key from a private key
+    void SecretToPublicKey(byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]) const;
+
+protected:
+    FixedSizeSecBlock<byte, SECRET_KEYLENGTH> m_sk;
+    FixedSizeSecBlock<byte, PUBLIC_KEYLENGTH> m_pk;
+    OID m_oid;  // preferred OID
+};
+
+// ****************** ed25519 Signer *********************** //
+
+/// \brief ed25519 message accumulator
+/// \details ed25519 buffers the entire message, and does not
+///  digest the message incrementally. You should be careful with
+///  large messages like files on-disk. The behavior is by design
+///  because Bernstein feels small messages should be authenticated;
+///  and larger messages will be digested by the application.
+/// \details The accumulator is used for signing and verification.
+///  The first 64-bytes of storage is reserved for the signature.
+///  During signing the signature storage is unused. During
+///  verification the first 64 bytes holds the signature. The
+///  signature is provided by the PK_Verifier framework and the
+///  call to PK_Signer::InputSignature. Member functions data()
+///  and size() refer to the accumulated message. Member function
+///  signature() refers to the signature with an implicit size of
+///  SIGNATURE_LENGTH bytes.
+/// \details Applications which digest large messages, like an ISO
+///  disk file, should take care because the design effectively
+///  disgorges the format operation from the signing operation.
+///  Put another way, be careful to ensure what you are signing is
+///  is in fact a digest of the intended message, and not a different
+///  message digest supplied by an attacker.
+struct ed25519_MessageAccumulator : public PK_MessageAccumulator
+{
+    CRYPTOPP_CONSTANT(RESERVE_SIZE=2048+64);
+    CRYPTOPP_CONSTANT(SIGNATURE_LENGTH=64);
+
+    /// \brief Create a message accumulator
+    ed25519_MessageAccumulator() {
+        Restart();
+    }
+
+    /// \brief Create a message accumulator
+    /// \details ed25519 does not use a RNG. You can safely use
+    ///  NullRNG() because IsProbablistic returns false.
+    ed25519_MessageAccumulator(RandomNumberGenerator &rng) {
+        CRYPTOPP_UNUSED(rng); Restart();
+    }
+
+    /// \brief Add data to the accumulator
+    /// \param msg pointer to the data to accumulate
+    /// \param len the size of the data, in bytes
+    void Update(const byte* msg, size_t len) {
+        if (msg && len)
+            m_msg.insert(m_msg.end(), msg, msg+len);
+    }
+
+    /// \brief Reset the accumulator
+    void Restart() {
+        m_msg.reserve(RESERVE_SIZE);
+        m_msg.resize(SIGNATURE_LENGTH);
+    }
+
+    /// \brief Retrieve pointer to signature buffer
+    /// \return pointer to signature buffer
+    byte* signature() {
+        return &m_msg[0];
+    }
+
+    /// \brief Retrieve pointer to signature buffer
+    /// \return pointer to signature buffer
+    const byte* signature() const {
+        return &m_msg[0];
+    }
+
+    /// \brief Retrieve pointer to data buffer
+    /// \return pointer to data buffer
+    const byte* data() const {
+        return &m_msg[0]+SIGNATURE_LENGTH;
+    }
+
+    /// \brief Retrieve size of data buffer
+    /// \return size of the data buffer, in bytes
+    size_t size() const {
+        return m_msg.size()-SIGNATURE_LENGTH;
+    }
+
+protected:
+    // TODO: Find an equivalent Crypto++ structure.
+    std::vector<byte, AllocatorWithCleanup<byte> > m_msg;
+};
+
+/// \brief Ed25519 private key
+/// \details ed25519PrivateKey is somewhat of a hack. It needed to
+///  provide DL_PrivateKey interface to fit into the existing
+///  framework, but it lacks a lot of the internals of a true
+///  DL_PrivateKey. The missing pieces include GroupParameters
+///  and Point, which provide the low level field operations
+///  found in traditional implementations like NIST curves over
+///  prime and binary fields.
+/// \details ed25519PrivateKey is also unusual because the
+///  class members of interest are byte arrays and not Integers.
+///  In addition, the byte arrays are little-endian meaning
+///  LSB is at element 0 and the MSB is at element 31.
+///  If you call GetPrivateExponent() then the little-endian byte
+///  array is converted to a big-endian Integer() so it can be
+///  returned the way a caller expects. And calling
+///  SetPrivateExponent performs a similar internal conversion.
+/// \since Crypto++ 8.0
+struct ed25519PrivateKey : public PKCS8PrivateKey
+{
+    /// \brief Size of the private key
+    /// \details SECRET_KEYLENGTH is the size of the private key, in bytes.
+    CRYPTOPP_CONSTANT(SECRET_KEYLENGTH = 32);
+    /// \brief Size of the public key
+    /// \details PUBLIC_KEYLENGTH is the size of the public key, in bytes.
+    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
+    /// \brief Size of the signature
+    /// \details SIGNATURE_LENGTH is the size of the signature, in bytes.
+    ///  ed25519 is a DL-based signature scheme. The signature is the
+    ///  concatenation of <tt>r || s</tt>.
+    CRYPTOPP_CONSTANT(SIGNATURE_LENGTH = 64);
+
+    virtual ~ed25519PrivateKey() {}
+
+    // CryptoMaterial
+    bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+    void AssignFrom(const NameValuePairs &source);
+
+    // GroupParameters
+    OID GetAlgorithmID() const {
+        return m_oid.Empty() ? ASN1::Ed25519() : m_oid;
+    }
+
+    /// \brief DER encode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \details Save() will write the OID associated with algorithm or scheme.
+    ///  In the case of public and private keys, this function writes the
+    ///  subjectPublicKeyInfo parts.
+    /// \details The default OID is from RFC 8410 using <tt>id-Ed25519</tt>.
+    ///  The default private key format is RFC 5208, which is the old format.
+    ///  The old format provides the best interop, and keys will work
+    ///  with OpenSSL.
+    /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
+    ///  Key Packages</A>
+    void Save(BufferedTransformation &bt) const {
+        DEREncode(bt, 0);
+    }
+
+    /// \brief DER encode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \param v1 flag indicating v1
+    /// \details Save() will write the OID associated with algorithm or scheme.
+    ///  In the case of public and private keys, this function writes the
+    ///  subjectPublicKeyInfo parts.
+    /// \details The default OID is from RFC 8410 using <tt>id-Ed25519</tt>.
+    ///  The default private key format is RFC 5208.
+    /// \details v1 means INTEGER 0 is written. INTEGER 0 means
+    ///  RFC 5208 format, which is the old format. The old format provides
+    ///  the best interop, and keys will work with OpenSSL. The other
+    ///  option uses INTEGER 1. INTEGER 1 means RFC 5958 format,
+    ///  which is the new format.
+    /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
+    ///  Key Packages</A>
+    void Save(BufferedTransformation &bt, bool v1) const {
+        DEREncode(bt, v1 ? 0 : 1);
+    }
+
+    /// \brief BER decode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
+    ///  Key Packages</A>
+    void Load(BufferedTransformation &bt) {
+        BERDecode(bt);
+    }
+
+    /// \brief Initializes a public key from this key
+    /// \param pub reference to a public key
+    void MakePublicKey(PublicKey &pub) const;
+
+    // PKCS8PrivateKey
+    void BERDecode(BufferedTransformation &bt);
+    void DEREncode(BufferedTransformation &bt) const { DEREncode(bt, 0); }
+    void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
+    void DEREncodePrivateKey(BufferedTransformation &bt) const;
+
+    /// \brief DER encode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \param version indicates version
+    /// \details DEREncode() will write the OID associated with algorithm or
+    ///  scheme. In the case of public and private keys, this function writes
+    ///  the subjectPublicKeyInfo parts.
+    /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
+    ///  The default private key format is RFC 5208.
+    /// \details The value of version is written as the INTEGER. INTEGER 0 means
+    ///  RFC 5208 format, which is the old format. The old format provides
+    ///  the best interop, and keys will work with OpenSSL. The INTEGER 1
+    ///  means RFC 5958 format, which is the new format.
+    void DEREncode(BufferedTransformation &bt, int version) const;
+
+    /// \brief Determine if OID is valid for this object
+    /// \details BERDecodeAndCheckAlgorithmID() parses the OID from
+    ///  <tt>bt</tt> and determines if it valid for this object. The
+    ///  problem in practice is there are multiple OIDs available to
+    ///  denote curve25519 operations. The OIDs include an old GNU
+    ///  OID used by SSH, OIDs specified in draft-josefsson-pkix-newcurves,
+    ///  and OIDs specified in draft-ietf-curdle-pkix.
+    /// \details By default BERDecodeAndCheckAlgorithmID() accepts an
+    ///  OID set by the user, <tt>ASN1::curve25519()</tt> and <tt>ASN1::Ed25519()</tt>.
+    ///  <tt>ASN1::curve25519()</tt> is generic and says "this key is valid for
+    ///  curve25519 operations". <tt>ASN1::Ed25519()</tt> is specific and says
+    ///  "this key is valid for ed25519 signing."
+    void BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt);
+
+    // PKCS8PrivateKey
+    void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params);
+    void SetPrivateExponent(const byte x[SECRET_KEYLENGTH]);
+    void SetPrivateExponent(const Integer &x);
+    const Integer& GetPrivateExponent() const;
+
+    /// \brief Test if a key has small order
+    /// \param y public key
+    bool IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const;
+
+    /// \brief Retrieve private key byte array
+    /// \return the private key byte array
+    /// \details GetPrivateKeyBytePtr() is used by signing code to call ed25519_sign.
+    const byte* GetPrivateKeyBytePtr() const {
+        return m_sk.begin();
+    }
+
+    /// \brief Retrieve public key byte array
+    /// \return the public key byte array
+    /// \details GetPublicKeyBytePtr() is used by signing code to call ed25519_sign.
+    const byte* GetPublicKeyBytePtr() const {
+        return m_pk.begin();
+    }
+
+protected:
+    // Create a public key from a private key
+    void SecretToPublicKey(byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]) const;
+
+protected:
+    FixedSizeSecBlock<byte, SECRET_KEYLENGTH> m_sk;
+    FixedSizeSecBlock<byte, PUBLIC_KEYLENGTH> m_pk;
+    OID m_oid;  // preferred OID
+    mutable Integer m_x;  // for DL_PrivateKey
+};
+
+/// \brief Ed25519 signature algorithm
+/// \since Crypto++ 8.0
+struct ed25519Signer : public PK_Signer
+{
+    /// \brief Size of the private key
+    /// \details SECRET_KEYLENGTH is the size of the private key, in bytes.
+    CRYPTOPP_CONSTANT(SECRET_KEYLENGTH = 32);
+    /// \brief Size of the public key
+    /// \details PUBLIC_KEYLENGTH is the size of the public key, in bytes.
+    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
+    /// \brief Size of the signature
+    /// \details SIGNATURE_LENGTH is the size of the signature, in bytes.
+    ///  ed25519 is a DL-based signature scheme. The signature is the
+    ///  concatenation of <tt>r || s</tt>.
+    CRYPTOPP_CONSTANT(SIGNATURE_LENGTH = 64);
+    typedef Integer Element;
+
+    virtual ~ed25519Signer() {}
+
+    /// \brief Create an ed25519Signer object
+    ed25519Signer() {}
+
+    /// \brief Create an ed25519Signer object
+    /// \param y public key
+    /// \param x private key
+    /// \details This constructor creates an ed25519Signer object using existing parameters.
+    /// \note The public key is not validated.
+    ed25519Signer(const byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]);
+
+    /// \brief Create an ed25519Signer object
+    /// \param x private key
+    /// \details This constructor creates an ed25519Signer object using existing parameters.
+    ///  The public key is calculated from the private key.
+    ed25519Signer(const byte x[SECRET_KEYLENGTH]);
+
+    /// \brief Create an ed25519Signer object
+    /// \param y public key
+    /// \param x private key
+    /// \details This constructor creates an ed25519Signer object using existing parameters.
+    /// \note The public key is not validated.
+    ed25519Signer(const Integer &y, const Integer &x);
+
+    /// \brief Create an ed25519Signer object
+    /// \param x private key
+    /// \details This constructor creates an ed25519Signer object using existing parameters.
+    ///  The public key is calculated from the private key.
+    ed25519Signer(const Integer &x);
+
+    /// \brief Create an ed25519Signer object
+    /// \param key PKCS8 private key
+    /// \details This constructor creates an ed25519Signer object using existing private key.
+    /// \note The keys are not validated.
+    /// \since Crypto++ 8.6
+    ed25519Signer(const PKCS8PrivateKey &key);
+
+    /// \brief Create an ed25519Signer object
+    /// \param rng RandomNumberGenerator derived class
+    /// \details This constructor creates a new ed25519Signer using the random number generator.
+    ed25519Signer(RandomNumberGenerator &rng);
+
+    /// \brief Create an ed25519Signer object
+    /// \param params public and private key
+    /// \details This constructor creates an ed25519Signer object using existing parameters.
+    ///  The <tt>params</tt> can be created with <tt>Save</tt>.
+    /// \note The public key is not validated.
+    ed25519Signer(BufferedTransformation &params);
+
+    // DL_ObjectImplBase
+    /// \brief Retrieves a reference to a Private Key
+    /// \details AccessKey() retrieves a non-const reference to a private key.
+    PrivateKey& AccessKey() { return m_key; }
+    PrivateKey& AccessPrivateKey() { return m_key; }
+
+    /// \brief Retrieves a reference to a Private Key
+    /// \details AccessKey() retrieves a const reference to a private key.
+    const PrivateKey& GetKey() const { return m_key; }
+    const PrivateKey& GetPrivateKey() const { return m_key; }
+
+    // DL_SignatureSchemeBase
+    size_t SignatureLength() const { return SIGNATURE_LENGTH; }
+    size_t MaxRecoverableLength() const { return 0; }
+    size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const {
+        CRYPTOPP_UNUSED(signatureLength); return 0;
+    }
+
+    bool IsProbabilistic() const { return false; }
+    bool AllowNonrecoverablePart() const { return false; }
+    bool RecoverablePartFirst() const { return false; }
+
+    PK_MessageAccumulator* NewSignatureAccumulator(RandomNumberGenerator &rng) const {
+        return new ed25519_MessageAccumulator(rng);
+    }
+
+    void InputRecoverableMessage(PK_MessageAccumulator &messageAccumulator, const byte *recoverableMessage, size_t recoverableMessageLength) const {
+        CRYPTOPP_UNUSED(messageAccumulator); CRYPTOPP_UNUSED(recoverableMessage);
+        CRYPTOPP_UNUSED(recoverableMessageLength);
+        throw NotImplemented("ed25519Signer: this object does not support recoverable messages");
+    }
+
+    size_t SignAndRestart(RandomNumberGenerator &rng, PK_MessageAccumulator &messageAccumulator, byte *signature, bool restart) const;
+
+    /// \brief Sign a stream
+    /// \param rng a RandomNumberGenerator derived class
+    /// \param stream an std::istream derived class
+    /// \param signature a block of bytes for the signature
+    /// \return actual signature length
+    /// \details SignStream() handles large streams. The Stream functions were added to
+    ///  ed25519 for signing and verifying files that are too large for a memory allocation.
+    ///  The functions are not present in other library signers and verifiers.
+    /// \details ed25519 is a deterministic signature scheme. <tt>IsProbabilistic()</tt>
+    ///  returns false and the random number generator can be <tt>NullRNG()</tt>.
+    /// \pre <tt>COUNTOF(signature) == MaxSignatureLength()</tt>
+    /// \since Crypto++ 8.1
+    size_t SignStream (RandomNumberGenerator &rng, std::istream& stream, byte *signature) const;
+
+protected:
+    ed25519PrivateKey m_key;
+};
+
+// ****************** ed25519 Verifier *********************** //
+
+/// \brief Ed25519 public key
+/// \details ed25519PublicKey is somewhat of a hack. It needed to
+///  provide DL_PublicKey interface to fit into the existing
+///  framework, but it lacks a lot of the internals of a true
+///  DL_PublicKey. The missing pieces include GroupParameters
+///  and Point, which provide the low level field operations
+///  found in traditional implementations like NIST curves over
+///  prime and binary fields.
+/// \details ed25519PublicKey is also unusual because the
+///  class members of interest are byte arrays and not Integers.
+///  In addition, the byte arrays are little-endian meaning
+///  LSB is at element 0 and the MSB is at element 31.
+///  If you call GetPublicElement() then the little-endian byte
+///  array is converted to a big-endian Integer() so it can be
+///  returned the way a caller expects. And calling
+///  SetPublicElement() performs a similar internal conversion.
+/// \since Crypto++ 8.0
+struct ed25519PublicKey : public X509PublicKey
+{
+    /// \brief Size of the public key
+    /// \details PUBLIC_KEYLENGTH is the size of the public key, in bytes.
+    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
+    typedef Integer Element;
+
+    virtual ~ed25519PublicKey() {}
+
+    OID GetAlgorithmID() const {
+        return m_oid.Empty() ? ASN1::Ed25519() : m_oid;
+    }
+
+    /// \brief DER encode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \details Save() will write the OID associated with algorithm or scheme.
+    ///  In the case of public and private keys, this function writes the
+    ///  subjectPublicKeyInfo parts.
+    /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
+    ///  The default private key format is RFC 5208, which is the old format.
+    ///  The old format provides the best interop, and keys will work
+    ///  with OpenSSL.
+    void Save(BufferedTransformation &bt) const {
+        DEREncode(bt);
+    }
+
+    /// \brief BER decode ASN.1 object
+    /// \param bt BufferedTransformation object
+    /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
+    ///  Key Packages</A>
+    void Load(BufferedTransformation &bt) {
+        BERDecode(bt);
+    }
+
+    // X509PublicKey
+    void BERDecode(BufferedTransformation &bt);
+    void DEREncode(BufferedTransformation &bt) const;
+    void BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
+    void DEREncodePublicKey(BufferedTransformation &bt) const;
+
+    /// \brief Determine if OID is valid for this object
+    /// \details BERDecodeAndCheckAlgorithmID() parses the OID from
+    ///  <tt>bt</tt> and determines if it valid for this object. The
+    ///  problem in practice is there are multiple OIDs available to
+    ///  denote curve25519 operations. The OIDs include an old GNU
+    ///  OID used by SSH, OIDs specified in draft-josefsson-pkix-newcurves,
+    ///  and OIDs specified in draft-ietf-curdle-pkix.
+    /// \details By default BERDecodeAndCheckAlgorithmID() accepts an
+    ///  OID set by the user, <tt>ASN1::curve25519()</tt> and <tt>ASN1::Ed25519()</tt>.
+    ///  <tt>ASN1::curve25519()</tt> is generic and says "this key is valid for
+    ///  curve25519 operations". <tt>ASN1::Ed25519()</tt> is specific and says
+    ///  "this key is valid for ed25519 signing."
+    void BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt);
+
+    bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+    void AssignFrom(const NameValuePairs &source);
+
+    // DL_PublicKey
+    void SetPublicElement(const byte y[PUBLIC_KEYLENGTH]);
+    void SetPublicElement(const Element &y);
+    const Element& GetPublicElement() const;
+
+    /// \brief Retrieve public key byte array
+    /// \return the public key byte array
+    /// \details GetPublicKeyBytePtr() is used by signing code to call ed25519_sign.
+    const byte* GetPublicKeyBytePtr() const {
+        return m_pk.begin();
+    }
+
+protected:
+    FixedSizeSecBlock<byte, PUBLIC_KEYLENGTH> m_pk;
+    OID m_oid;  // preferred OID
+    mutable Integer m_y;  // for DL_PublicKey
+};
+
+/// \brief Ed25519 signature verification algorithm
+/// \since Crypto++ 8.0
+struct ed25519Verifier : public PK_Verifier
+{
+    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
+    CRYPTOPP_CONSTANT(SIGNATURE_LENGTH = 64);
+    typedef Integer Element;
+
+    virtual ~ed25519Verifier() {}
+
+    /// \brief Create an ed25519Verifier object
+    ed25519Verifier() {}
+
+    /// \brief Create an ed25519Verifier object
+    /// \param y public key
+    /// \details This constructor creates an ed25519Verifier object using existing parameters.
+    /// \note The public key is not validated.
+    ed25519Verifier(const byte y[PUBLIC_KEYLENGTH]);
+
+    /// \brief Create an ed25519Verifier object
+    /// \param y public key
+    /// \details This constructor creates an ed25519Verifier object using existing parameters.
+    /// \note The public key is not validated.
+    ed25519Verifier(const Integer &y);
+
+    /// \brief Create an ed25519Verifier object
+    /// \param key X509 public key
+    /// \details This constructor creates an ed25519Verifier object using an existing public key.
+    /// \note The public key is not validated.
+    /// \since Crypto++ 8.6
+    ed25519Verifier(const X509PublicKey &key);
+
+    /// \brief Create an ed25519Verifier object
+    /// \param params public and private key
+    /// \details This constructor creates an ed25519Verifier object using existing parameters.
+    ///  The <tt>params</tt> can be created with <tt>Save</tt>.
+    /// \note The public key is not validated.
+    ed25519Verifier(BufferedTransformation &params);
+
+    /// \brief Create an ed25519Verifier object
+    /// \param signer ed25519 signer object
+    /// \details This constructor creates an ed25519Verifier object using existing parameters.
+    ///  The <tt>params</tt> can be created with <tt>Save</tt>.
+    /// \note The public key is not validated.
+    ed25519Verifier(const ed25519Signer& signer);
+
+    // DL_ObjectImplBase
+    /// \brief Retrieves a reference to a Public Key
+    /// \details AccessKey() retrieves a non-const reference to a public key.
+    PublicKey& AccessKey() { return m_key; }
+    PublicKey& AccessPublicKey() { return m_key; }
+
+    /// \brief Retrieves a reference to a Public Key
+    /// \details GetKey() retrieves a const reference to a public key.
+    const PublicKey& GetKey() const { return m_key; }
+    const PublicKey& GetPublicKey() const { return m_key; }
+
+    // DL_SignatureSchemeBase
+    size_t SignatureLength() const { return SIGNATURE_LENGTH; }
+    size_t MaxRecoverableLength() const { return 0; }
+    size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const {
+        CRYPTOPP_UNUSED(signatureLength); return 0;
+    }
+
+    bool IsProbabilistic() const { return false; }
+    bool AllowNonrecoverablePart() const { return false; }
+    bool RecoverablePartFirst() const { return false; }
+
+    ed25519_MessageAccumulator* NewVerificationAccumulator() const {
+        return new ed25519_MessageAccumulator;
+    }
+
+    void InputSignature(PK_MessageAccumulator &messageAccumulator, const byte *signature, size_t signatureLength) const {
+        CRYPTOPP_ASSERT(signature != NULLPTR);
+        CRYPTOPP_ASSERT(signatureLength == SIGNATURE_LENGTH);
+        ed25519_MessageAccumulator& accum = static_cast<ed25519_MessageAccumulator&>(messageAccumulator);
+        if (signature && signatureLength)
+            std::memcpy(accum.signature(), signature, STDMIN((size_t)SIGNATURE_LENGTH, signatureLength));
+    }
+
+    bool VerifyAndRestart(PK_MessageAccumulator &messageAccumulator) const;
+
+    /// \brief Check whether input signature is a valid signature for input message
+    /// \param stream an std::istream derived class
+    /// \param signature a pointer to the signature over the message
+    /// \param signatureLen the size of the signature
+    /// \return true if the signature is valid, false otherwise
+    /// \details VerifyStream() handles large streams. The Stream functions were added to
+    ///  ed25519 for signing and verifying files that are too large for a memory allocation.
+    ///  The functions are not present in other library signers and verifiers.
+    /// \since Crypto++ 8.1
+    bool VerifyStream(std::istream& stream, const byte *signature, size_t signatureLen) const;
+
+    DecodingResult RecoverAndRestart(byte *recoveredMessage, PK_MessageAccumulator &messageAccumulator) const {
+        CRYPTOPP_UNUSED(recoveredMessage); CRYPTOPP_UNUSED(messageAccumulator);
+        throw NotImplemented("ed25519Verifier: this object does not support recoverable messages");
+    }
+
+protected:
+    ed25519PublicKey m_key;
+};
+
+/// \brief Ed25519 signature scheme
+/// \sa <A HREF="http://cryptopp.com/wiki/Ed25519">Ed25519</A> on the Crypto++ wiki.
+/// \since Crypto++ 8.0
+struct ed25519
+{
+    /// \brief ed25519 Signer
+    typedef ed25519Signer Signer;
+    /// \brief ed25519 Verifier
+    typedef ed25519Verifier Verifier;
+};
+
+NAMESPACE_END  // CryptoPP
+
+#endif  // CRYPTOPP_XED25519_H
diff --git a/runtime/third_party/cryptopp/xtr.cpp b/runtime/third_party/cryptopp/xtr.cpp
new file mode 100644
index 0000000..e436f21
--- /dev/null
+++ b/runtime/third_party/cryptopp/xtr.cpp
@@ -0,0 +1,120 @@
+// xtr.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#include "xtr.h"
+#include "nbtheory.h"
+#include "integer.h"
+#include "algebra.h"
+#include "modarith.h"
+#include "algebra.cpp"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+const GFP2Element & GFP2Element::Zero()
+{
+#if defined(CRYPTOPP_CXX11_STATIC_INIT)
+	static const GFP2Element s_zero;
+	return s_zero;
+#else
+	return Singleton<GFP2Element>().Ref();
+#endif
+}
+
+void XTR_FindPrimesAndGenerator(RandomNumberGenerator &rng, Integer &p, Integer &q, GFP2Element &g, unsigned int pbits, unsigned int qbits)
+{
+	CRYPTOPP_ASSERT(qbits > 9);	// no primes exist for pbits = 10, qbits = 9
+	CRYPTOPP_ASSERT(pbits > qbits);
+
+	const Integer minQ = Integer::Power2(qbits - 1);
+	const Integer maxQ = Integer::Power2(qbits) - 1;
+	const Integer minP = Integer::Power2(pbits - 1);
+	const Integer maxP = Integer::Power2(pbits) - 1;
+
+top:
+
+	Integer r1, r2;
+	do
+	{
+		(void)q.Randomize(rng, minQ, maxQ, Integer::PRIME, 7, 12);
+		// Solution always exists because q === 7 mod 12.
+		(void)SolveModularQuadraticEquation(r1, r2, 1, -1, 1, q);
+		// I believe k_i, r1 and r2 are being used slightly different than the
+		// paper's algorithm. I believe it is leading to the failed asserts.
+		// Just make the assert part of the condition.
+		if(!p.Randomize(rng, minP, maxP, Integer::PRIME, CRT(rng.GenerateBit() ?
+			r1 : r2, q, 2, 3, EuclideanMultiplicativeInverse(p, 3)), 3 * q)) { continue; }
+	} while (((p % 3U) != 2) || (((p.Squared() - p + 1) % q).NotZero()));
+
+	// CRYPTOPP_ASSERT((p % 3U) == 2);
+	// CRYPTOPP_ASSERT(((p.Squared() - p + 1) % q).IsZero());
+
+	GFP2_ONB<ModularArithmetic> gfp2(p);
+	GFP2Element three = gfp2.ConvertIn(3), t;
+
+	while (true)
+	{
+		g.c1.Randomize(rng, Integer::Zero(), p-1);
+		g.c2.Randomize(rng, Integer::Zero(), p-1);
+		t = XTR_Exponentiate(g, p+1, p);
+		if (t.c1 == t.c2)
+			continue;
+		g = XTR_Exponentiate(g, (p.Squared()-p+1)/q, p);
+		if (g != three)
+			break;
+	}
+
+	if (XTR_Exponentiate(g, q, p) != three)
+		goto top;
+
+	// CRYPTOPP_ASSERT(XTR_Exponentiate(g, q, p) == three);
+}
+
+GFP2Element XTR_Exponentiate(const GFP2Element &b, const Integer &e, const Integer &p)
+{
+	unsigned int bitCount = e.BitCount();
+	if (bitCount == 0)
+		return GFP2Element(-3, -3);
+
+	// find the lowest bit of e that is 1
+	unsigned int lowest1bit;
+	for (lowest1bit=0; e.GetBit(lowest1bit) == 0; lowest1bit++) {}
+
+	GFP2_ONB<MontgomeryRepresentation> gfp2(p);
+	GFP2Element c = gfp2.ConvertIn(b);
+	GFP2Element cp = gfp2.PthPower(c);
+	GFP2Element S[5] = {gfp2.ConvertIn(3), c, gfp2.SpecialOperation1(c)};
+
+	// do all exponents bits except the lowest zeros starting from the top
+	unsigned int i;
+	for (i = e.BitCount() - 1; i>lowest1bit; i--)
+	{
+		if (e.GetBit(i))
+		{
+			gfp2.RaiseToPthPower(S[0]);
+			gfp2.Accumulate(S[0], gfp2.SpecialOperation2(S[2], c, S[1]));
+			S[1] = gfp2.SpecialOperation1(S[1]);
+			S[2] = gfp2.SpecialOperation1(S[2]);
+			S[0].swap(S[1]);
+		}
+		else
+		{
+			gfp2.RaiseToPthPower(S[2]);
+			gfp2.Accumulate(S[2], gfp2.SpecialOperation2(S[0], cp, S[1]));
+			S[1] = gfp2.SpecialOperation1(S[1]);
+			S[0] = gfp2.SpecialOperation1(S[0]);
+			S[2].swap(S[1]);
+		}
+	}
+
+	// now do the lowest zeros
+	while (i--)
+		S[1] = gfp2.SpecialOperation1(S[1]);
+
+	return gfp2.ConvertOut(S[1]);
+}
+
+template class AbstractRing<GFP2Element>;
+template class AbstractGroup<GFP2Element>;
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/xtr.h b/runtime/third_party/cryptopp/xtr.h
new file mode 100644
index 0000000..3d1c338
--- /dev/null
+++ b/runtime/third_party/cryptopp/xtr.h
@@ -0,0 +1,219 @@
+#ifndef CRYPTOPP_XTR_H
+#define CRYPTOPP_XTR_H
+
+/// \file xtr.h
+/// \brief The XTR public key system
+/// \details The XTR public key system by Arjen K. Lenstra and Eric R. Verheul
+
+#include "cryptlib.h"
+#include "modarith.h"
+#include "integer.h"
+#include "algebra.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief an element of GF(p^2)
+class GFP2Element
+{
+public:
+	GFP2Element() {}
+	GFP2Element(const Integer &c1, const Integer &c2) : c1(c1), c2(c2) {}
+	GFP2Element(const byte *encodedElement, unsigned int size)
+		: c1(encodedElement, size/2), c2(encodedElement+size/2, size/2) {}
+
+	void Encode(byte *encodedElement, unsigned int size)
+	{
+		c1.Encode(encodedElement, size/2);
+		c2.Encode(encodedElement+size/2, size/2);
+	}
+
+	bool operator==(const GFP2Element &rhs)	const {return c1 == rhs.c1 && c2 == rhs.c2;}
+	bool operator!=(const GFP2Element &rhs) const {return !operator==(rhs);}
+
+	void swap(GFP2Element &a)
+	{
+		c1.swap(a.c1);
+		c2.swap(a.c2);
+	}
+
+	static const GFP2Element & Zero();
+
+	Integer c1, c2;
+};
+
+/// \brief GF(p^2), optimal normal basis
+template <class F>
+class GFP2_ONB : public AbstractRing<GFP2Element>
+{
+public:
+	typedef F BaseField;
+
+	GFP2_ONB(const Integer &p) : modp(p)
+	{
+		if (p%3 != 2)
+			throw InvalidArgument("GFP2_ONB: modulus must be equivalent to 2 mod 3");
+	}
+
+	const Integer& GetModulus() const {return modp.GetModulus();}
+
+	GFP2Element ConvertIn(const Integer &a) const
+	{
+		t = modp.Inverse(modp.ConvertIn(a));
+		return GFP2Element(t, t);
+	}
+
+	GFP2Element ConvertIn(const GFP2Element &a) const
+		{return GFP2Element(modp.ConvertIn(a.c1), modp.ConvertIn(a.c2));}
+
+	GFP2Element ConvertOut(const GFP2Element &a) const
+		{return GFP2Element(modp.ConvertOut(a.c1), modp.ConvertOut(a.c2));}
+
+	bool Equal(const GFP2Element &a, const GFP2Element &b) const
+	{
+		return modp.Equal(a.c1, b.c1) && modp.Equal(a.c2, b.c2);
+	}
+
+	const Element& Identity() const
+	{
+		return GFP2Element::Zero();
+	}
+
+	const Element& Add(const Element &a, const Element &b) const
+	{
+		result.c1 = modp.Add(a.c1, b.c1);
+		result.c2 = modp.Add(a.c2, b.c2);
+		return result;
+	}
+
+	const Element& Inverse(const Element &a) const
+	{
+		result.c1 = modp.Inverse(a.c1);
+		result.c2 = modp.Inverse(a.c2);
+		return result;
+	}
+
+	const Element& Double(const Element &a) const
+	{
+		result.c1 = modp.Double(a.c1);
+		result.c2 = modp.Double(a.c2);
+		return result;
+	}
+
+	const Element& Subtract(const Element &a, const Element &b) const
+	{
+		result.c1 = modp.Subtract(a.c1, b.c1);
+		result.c2 = modp.Subtract(a.c2, b.c2);
+		return result;
+	}
+
+	Element& Accumulate(Element &a, const Element &b) const
+	{
+		modp.Accumulate(a.c1, b.c1);
+		modp.Accumulate(a.c2, b.c2);
+		return a;
+	}
+
+	Element& Reduce(Element &a, const Element &b) const
+	{
+		modp.Reduce(a.c1, b.c1);
+		modp.Reduce(a.c2, b.c2);
+		return a;
+	}
+
+	bool IsUnit(const Element &a) const
+	{
+		return a.c1.NotZero() || a.c2.NotZero();
+	}
+
+	const Element& MultiplicativeIdentity() const
+	{
+		result.c1 = result.c2 = modp.Inverse(modp.MultiplicativeIdentity());
+		return result;
+	}
+
+	const Element& Multiply(const Element &a, const Element &b) const
+	{
+		t = modp.Add(a.c1, a.c2);
+		t = modp.Multiply(t, modp.Add(b.c1, b.c2));
+		result.c1 = modp.Multiply(a.c1, b.c1);
+		result.c2 = modp.Multiply(a.c2, b.c2);
+		result.c1.swap(result.c2);
+		modp.Reduce(t, result.c1);
+		modp.Reduce(t, result.c2);
+		modp.Reduce(result.c1, t);
+		modp.Reduce(result.c2, t);
+		return result;
+	}
+
+	const Element& MultiplicativeInverse(const Element &a) const
+	{
+		return result = Exponentiate(a, modp.GetModulus()-2);
+	}
+
+	const Element& Square(const Element &a) const
+	{
+		const Integer &ac1 = (&a == &result) ? (t = a.c1) : a.c1;
+		result.c1 = modp.Multiply(modp.Subtract(modp.Subtract(a.c2, a.c1), a.c1), a.c2);
+		result.c2 = modp.Multiply(modp.Subtract(modp.Subtract(ac1, a.c2), a.c2), ac1);
+		return result;
+	}
+
+	Element Exponentiate(const Element &a, const Integer &e) const
+	{
+		Integer edivp, emodp;
+		Integer::Divide(emodp, edivp, e, modp.GetModulus());
+		Element b = PthPower(a);
+		return AbstractRing<GFP2Element>::CascadeExponentiate(a, emodp, b, edivp);
+	}
+
+	const Element & PthPower(const Element &a) const
+	{
+		result = a;
+		result.c1.swap(result.c2);
+		return result;
+	}
+
+	void RaiseToPthPower(Element &a) const
+	{
+		a.c1.swap(a.c2);
+	}
+
+	// a^2 - 2a^p
+	const Element & SpecialOperation1(const Element &a) const
+	{
+		CRYPTOPP_ASSERT(&a != &result);
+		result = Square(a);
+		modp.Reduce(result.c1, a.c2);
+		modp.Reduce(result.c1, a.c2);
+		modp.Reduce(result.c2, a.c1);
+		modp.Reduce(result.c2, a.c1);
+		return result;
+	}
+
+	// x * z - y * z^p
+	const Element & SpecialOperation2(const Element &x, const Element &y, const Element &z) const
+	{
+		CRYPTOPP_ASSERT(&x != &result && &y != &result && &z != &result);
+		t = modp.Add(x.c2, y.c2);
+		result.c1 = modp.Multiply(z.c1, modp.Subtract(y.c1, t));
+		modp.Accumulate(result.c1, modp.Multiply(z.c2, modp.Subtract(t, x.c1)));
+		t = modp.Add(x.c1, y.c1);
+		result.c2 = modp.Multiply(z.c2, modp.Subtract(y.c2, t));
+		modp.Accumulate(result.c2, modp.Multiply(z.c1, modp.Subtract(t, x.c2)));
+		return result;
+	}
+
+protected:
+	BaseField modp;
+	mutable GFP2Element result;
+	mutable Integer t;
+};
+
+/// \brief Creates primes p,q and generator g for XTR
+void XTR_FindPrimesAndGenerator(RandomNumberGenerator &rng, Integer &p, Integer &q, GFP2Element &g, unsigned int pbits, unsigned int qbits);
+
+GFP2Element XTR_Exponentiate(const GFP2Element &b, const Integer &e, const Integer &p);
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/xtrcrypt.cpp b/runtime/third_party/cryptopp/xtrcrypt.cpp
new file mode 100644
index 0000000..eb93e34
--- /dev/null
+++ b/runtime/third_party/cryptopp/xtrcrypt.cpp
@@ -0,0 +1,122 @@
+// xtrcrypt.cpp - originally written and placed in the public domain by Wei Dai
+
+#include "pch.h"
+
+#include "asn.h"
+#include "integer.h"
+#include "xtrcrypt.h"
+#include "nbtheory.h"
+#include "modarith.h"
+#include "argnames.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+XTR_DH::XTR_DH(const Integer &p, const Integer &q, const GFP2Element &g)
+	: m_p(p), m_q(q), m_g(g)
+{
+}
+
+XTR_DH::XTR_DH(RandomNumberGenerator &rng, unsigned int pbits, unsigned int qbits)
+{
+	XTR_FindPrimesAndGenerator(rng, m_p, m_q, m_g, pbits, qbits);
+}
+
+XTR_DH::XTR_DH(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	m_p.BERDecode(seq);
+	m_q.BERDecode(seq);
+	m_g.c1.BERDecode(seq);
+	m_g.c2.BERDecode(seq);
+	seq.MessageEnd();
+}
+
+void XTR_DH::DEREncode(BufferedTransformation &bt) const
+{
+	DERSequenceEncoder seq(bt);
+	m_p.DEREncode(seq);
+	m_q.DEREncode(seq);
+	m_g.c1.DEREncode(seq);
+	m_g.c2.DEREncode(seq);
+	seq.MessageEnd();
+}
+
+bool XTR_DH::Validate(RandomNumberGenerator &rng, unsigned int level) const
+{
+	bool pass = true;
+	pass = pass && m_p > Integer::One() && m_p.IsOdd();
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && m_q > Integer::One() && m_q.IsOdd();
+	CRYPTOPP_ASSERT(pass);
+	GFP2Element three = GFP2_ONB<ModularArithmetic>(m_p).ConvertIn(3);
+	CRYPTOPP_ASSERT(pass);
+	pass = pass && !(m_g.c1.IsNegative() || m_g.c2.IsNegative() || m_g.c1 >= m_p || m_g.c2 >= m_p || m_g == three);
+	CRYPTOPP_ASSERT(pass);
+	if (level >= 1)
+	{
+		pass = pass && ((m_p.Squared()-m_p+1)%m_q).IsZero();
+		CRYPTOPP_ASSERT(pass);
+	}
+	if (level >= 2)
+	{
+		pass = pass && VerifyPrime(rng, m_p, level-2) && VerifyPrime(rng, m_q, level-2);
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && XTR_Exponentiate(m_g, (m_p.Squared()-m_p+1)/m_q, m_p) != three;
+		CRYPTOPP_ASSERT(pass);
+		pass = pass && XTR_Exponentiate(m_g, m_q, m_p) == three;
+		CRYPTOPP_ASSERT(pass);
+	}
+	return pass;
+}
+
+bool XTR_DH::GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
+{
+	return GetValueHelper(this, name, valueType, pValue).Assignable()
+		CRYPTOPP_GET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_GET_FUNCTION_ENTRY(SubgroupOrder)
+		CRYPTOPP_GET_FUNCTION_ENTRY(SubgroupGenerator)
+		;
+}
+
+void XTR_DH::AssignFrom(const NameValuePairs &source)
+{
+	AssignFromHelper(this, source)
+		CRYPTOPP_SET_FUNCTION_ENTRY(Modulus)
+		CRYPTOPP_SET_FUNCTION_ENTRY(SubgroupOrder)
+		CRYPTOPP_SET_FUNCTION_ENTRY(SubgroupGenerator)
+		;
+}
+
+void XTR_DH::GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
+{
+	Integer x(rng, Integer::Zero(), m_q-1);
+	x.Encode(privateKey, PrivateKeyLength());
+}
+
+void XTR_DH::GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
+{
+	CRYPTOPP_UNUSED(rng);
+	Integer x(privateKey, PrivateKeyLength());
+	GFP2Element y = XTR_Exponentiate(m_g, x, m_p);
+	y.Encode(publicKey, PublicKeyLength());
+}
+
+bool XTR_DH::Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey) const
+{
+	GFP2Element w(otherPublicKey, PublicKeyLength());
+	if (validateOtherPublicKey)
+	{
+		GFP2_ONB<ModularArithmetic> gfp2(m_p);
+		GFP2Element three = gfp2.ConvertIn(3);
+		if (w.c1.IsNegative() || w.c2.IsNegative() || w.c1 >= m_p || w.c2 >= m_p || w == three)
+			return false;
+		if (XTR_Exponentiate(w, m_q, m_p) != three)
+			return false;
+	}
+	Integer s(privateKey, PrivateKeyLength());
+	GFP2Element z = XTR_Exponentiate(w, s, m_p);
+	z.Encode(agreedValue, AgreedValueLength());
+	return true;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/xtrcrypt.h b/runtime/third_party/cryptopp/xtrcrypt.h
new file mode 100644
index 0000000..0248788
--- /dev/null
+++ b/runtime/third_party/cryptopp/xtrcrypt.h
@@ -0,0 +1,55 @@
+#ifndef CRYPTOPP_XTRCRYPT_H
+#define CRYPTOPP_XTRCRYPT_H
+
+/// \file
+/// \brief XTR public key system
+/// \sa  "The XTR public key system" by Arjen K. Lenstra and Eric R. Verheul
+
+#include "cryptlib.h"
+#include "xtr.h"
+#include "integer.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief XTR-DH with key validation
+class XTR_DH : public SimpleKeyAgreementDomain, public CryptoParameters
+{
+	typedef XTR_DH ThisClass;
+
+public:
+	XTR_DH(const Integer &p, const Integer &q, const GFP2Element &g);
+	XTR_DH(RandomNumberGenerator &rng, unsigned int pbits, unsigned int qbits);
+	XTR_DH(BufferedTransformation &domainParams);
+
+	void DEREncode(BufferedTransformation &domainParams) const;
+
+	bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
+	bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
+	void AssignFrom(const NameValuePairs &source);
+	CryptoParameters & AccessCryptoParameters() {return *this;}
+	unsigned int AgreedValueLength() const {return 2*m_p.ByteCount();}
+	unsigned int PrivateKeyLength() const {return m_q.ByteCount();}
+	unsigned int PublicKeyLength() const {return 2*m_p.ByteCount();}
+
+	void GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const;
+	void GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const;
+	bool Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey=true) const;
+
+	const Integer &GetModulus() const {return m_p;}
+	const Integer &GetSubgroupOrder() const {return m_q;}
+	const GFP2Element &GetSubgroupGenerator() const {return m_g;}
+
+	void SetModulus(const Integer &p) {m_p = p;}
+	void SetSubgroupOrder(const Integer &q) {m_q = q;}
+	void SetSubgroupGenerator(const GFP2Element &g) {m_g = g;}
+
+private:
+	unsigned int ExponentBitLength() const;
+
+	Integer m_p, m_q;
+	GFP2Element m_g;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/xts.cpp b/runtime/third_party/cryptopp/xts.cpp
new file mode 100644
index 0000000..6e41891
--- /dev/null
+++ b/runtime/third_party/cryptopp/xts.cpp
@@ -0,0 +1,521 @@
+// xts.cpp - written and placed in the public domain by Jeffrey Walton
+
+// Aarch32, Aarch64, Altivec and X86_64 include SIMD as part of the
+// base architecture. We can use the SIMD code below without an
+// architecture option. No runtime tests are required. Unfortunately,
+// we can't use it on Altivec because an architecture switch is required.
+// The updated XorBuffer gains 0.3 to 1.5 cpb on the architectures for
+// 16-byte block sizes.
+
+#include "pch.h"
+
+#include "xts.h"
+#include "misc.h"
+#include "modes.h"
+#include "cpu.h"
+
+#if defined(CRYPTOPP_DEBUG)
+# include "aes.h"
+# include "threefish.h"
+#endif
+
+// 0.3 to 0.4 cpb profit
+#if defined(__SSE2__) || defined(_M_X64)
+# include <emmintrin.h>
+#endif
+
+#if defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+# if (CRYPTOPP_ARM_NEON_HEADER) || (CRYPTOPP_ARM_ASIMD_AVAILABLE)
+#  include <arm_neon.h>
+# endif
+#endif
+
+#if defined(__ALTIVEC__)
+# include "ppc_simd.h"
+#endif
+
+ANONYMOUS_NAMESPACE_BEGIN
+
+using namespace CryptoPP;
+
+#if defined(CRYPTOPP_DEBUG) && !defined(CRYPTOPP_DOXYGEN_PROCESSING)
+
+using CryptoPP::AES;
+using CryptoPP::XTS_Mode;
+using CryptoPP::Threefish512;
+
+void Modes_TestInstantiations()
+{
+    XTS_Mode<AES>::Encryption m0;
+    XTS_Mode<AES>::Decryption m1;
+    XTS_Mode<AES>::Encryption m2;
+    XTS_Mode<AES>::Decryption m3;
+
+#if CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS
+    XTS_Mode<Threefish512>::Encryption m4;
+    XTS_Mode<Threefish512>::Decryption m5;
+#endif
+}
+#endif  // CRYPTOPP_DEBUG
+
+inline void XorBuffer(byte *output, const byte *input, const byte *mask, size_t count)
+{
+    CRYPTOPP_ASSERT(count >= 16 && (count % 16 == 0));
+
+#if defined(CRYPTOPP_DISABLE_ASM)
+    xorbuf(output, input, mask, count);
+
+#elif defined(__SSE2__) || defined(_M_X64)
+    for (size_t i=0; i<count; i+=16)
+        _mm_storeu_si128(M128_CAST(output+i),
+            _mm_xor_si128(
+                _mm_loadu_si128(CONST_M128_CAST(input+i)),
+                _mm_loadu_si128(CONST_M128_CAST(mask+i))));
+
+#elif defined(__aarch32__) || defined(__aarch64__) || defined(_M_ARM64)
+    for (size_t i=0; i<count; i+=16)
+        vst1q_u8(output+i, veorq_u8(vld1q_u8(input+i), vld1q_u8(mask+i)));
+
+#elif defined(__ALTIVEC__)
+    for (size_t i=0; i<count; i+=16)
+        VecStore(VecXor(VecLoad(input+i), VecLoad(mask+i)), output+i);
+
+#else
+    xorbuf(output, input, mask, count);
+#endif
+}
+
+inline void XorBuffer(byte *buf, const byte *mask, size_t count)
+{
+    XorBuffer(buf, buf, mask, count);
+}
+
+// Borrowed from CMAC, but little-endian representation
+inline void GF_Double(byte *out, const byte* in, unsigned int len)
+{
+#if defined(CRYPTOPP_WORD128_AVAILABLE)
+    word128 carry = 0, x;
+    for (size_t i=0, idx=0; i<len/16; ++i, idx+=16)
+    {
+        x = GetWord<word128>(false, LITTLE_ENDIAN_ORDER, in+idx);
+        word128 y = (x >> 127); x = (x << 1) + carry;
+        PutWord<word128>(false, LITTLE_ENDIAN_ORDER, out+idx, x);
+        carry = y;
+    }
+#elif defined(_M_X64) || defined(_M_ARM64) || defined(_LP64) || defined(__LP64__)
+    word64 carry = 0, x;
+    for (size_t i=0, idx=0; i<len/8; ++i, idx+=8)
+    {
+        x = GetWord<word64>(false, LITTLE_ENDIAN_ORDER, in+idx);
+        word64 y = (x >> 63); x = (x << 1) + carry;
+        PutWord<word64>(false, LITTLE_ENDIAN_ORDER, out+idx, x);
+        carry = y;
+    }
+#else
+    word32 carry = 0, x;
+    for (size_t i=0, idx=0; i<len/4; ++i, idx+=4)
+    {
+        x = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, in+idx);
+        word32 y = (x >> 31); x = (x << 1) + carry;
+        PutWord<word32>(false, LITTLE_ENDIAN_ORDER, out+idx, x);
+        carry = y;
+    }
+#endif
+
+#if CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS
+
+    CRYPTOPP_ASSERT(IsPowerOf2(len));
+    CRYPTOPP_ASSERT(len >= 16);
+    CRYPTOPP_ASSERT(len <= 128);
+
+    byte* k = out;
+    if (carry)
+    {
+        switch (len)
+        {
+        case 16:
+        {
+            const size_t LEIDX = 16-1;
+            k[LEIDX-15] ^= 0x87;
+            break;
+        }
+        case 32:
+        {
+            // https://crypto.stackexchange.com/q/9815/10496
+            // Polynomial x^256 + x^10 + x^5 + x^2 + 1
+            const size_t LEIDX = 32-1;
+            k[LEIDX-30] ^= 4;
+            k[LEIDX-31] ^= 0x25;
+            break;
+        }
+        case 64:
+        {
+            // https://crypto.stackexchange.com/q/9815/10496
+            // Polynomial x^512 + x^8 + x^5 + x^2 + 1
+            const size_t LEIDX = 64-1;
+            k[LEIDX-62] ^= 1;
+            k[LEIDX-63] ^= 0x25;
+            break;
+        }
+        case 128:
+        {
+            // https://crypto.stackexchange.com/q/9815/10496
+            // Polynomial x^1024 + x^19 + x^6 + x + 1
+            const size_t LEIDX = 128-1;
+            k[LEIDX-125] ^= 8;
+            k[LEIDX-126] ^= 0x00;
+            k[LEIDX-127] ^= 0x43;
+            break;
+        }
+        default:
+            CRYPTOPP_ASSERT(0);
+        }
+    }
+#else
+    CRYPTOPP_ASSERT(len == 16);
+
+    byte* k = out;
+    if (carry)
+    {
+        k[0] ^= 0x87;
+        return;
+    }
+#endif  // CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS
+}
+
+inline void GF_Double(byte *inout, unsigned int len)
+{
+    GF_Double(inout, inout, len);
+}
+
+ANONYMOUS_NAMESPACE_END
+
+NAMESPACE_BEGIN(CryptoPP)
+
+void XTS_ModeBase::ThrowIfInvalidBlockSize(size_t length)
+{
+#if CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS
+    CRYPTOPP_ASSERT(length >= 16 && length <= 128 && IsPowerOf2(length));
+    if (length < 16 || length > 128 || !IsPowerOf2(length))
+        throw InvalidArgument(AlgorithmName() + ": block size of underlying block cipher is not valid");
+#else
+    CRYPTOPP_ASSERT(length == 16);
+    if (length != 16)
+        throw InvalidArgument(AlgorithmName() + ": block size of underlying block cipher is not 16");
+#endif
+}
+
+void XTS_ModeBase::ThrowIfInvalidKeyLength(size_t length)
+{
+    CRYPTOPP_ASSERT(length % 2 == 0);
+    if (!GetBlockCipher().IsValidKeyLength((length+1)/2))
+        throw InvalidKeyLength(AlgorithmName(), length);
+}
+
+void XTS_ModeBase::SetKey(const byte *key, size_t length, const NameValuePairs &params)
+{
+    ThrowIfInvalidKeyLength(length);
+    ThrowIfInvalidBlockSize(BlockSize());
+
+    const size_t klen = length/2;
+    AccessBlockCipher().SetKey(key+0, klen, params);
+    AccessTweakCipher().SetKey(key+klen, klen, params);
+
+    ResizeBuffers();
+
+    size_t ivLength;
+    const byte *iv = GetIVAndThrowIfInvalid(params, ivLength);
+    Resynchronize(iv, (int)ivLength);
+}
+
+void XTS_ModeBase::Resynchronize(const byte *iv, int ivLength)
+{
+    BlockOrientedCipherModeBase::Resynchronize(iv, ivLength);
+    std::memcpy(m_xregister, m_register, ivLength);
+    GetTweakCipher().ProcessBlock(m_xregister);
+}
+
+void XTS_ModeBase::Resynchronize(word64 sector, ByteOrder order)
+{
+    SecByteBlock iv(GetTweakCipher().BlockSize());
+    PutWord<word64>(false, order, iv, sector);
+    std::memset(iv+8, 0x00, iv.size()-8);
+
+    BlockOrientedCipherModeBase::Resynchronize(iv, (int)iv.size());
+    std::memcpy(m_xregister, iv, iv.size());
+    GetTweakCipher().ProcessBlock(m_xregister);
+}
+
+void XTS_ModeBase::ResizeBuffers()
+{
+    BlockOrientedCipherModeBase::ResizeBuffers();
+    m_xworkspace.New(GetBlockCipher().BlockSize()*ParallelBlocks);
+    m_xregister.New(GetBlockCipher().BlockSize()*ParallelBlocks);
+}
+
+// ProcessData runs either 12-4-1 blocks, 8-2-1 or 4-1 blocks. Which is
+// selected depends on ParallelBlocks in the header file. 12-4-1 or 8-2-1
+// can be used on Aarch64 and PowerPC. Intel should use 4-1 due to lack
+// of registers. The unneeded code paths should be removed by optimizer.
+// The extra gyrations save us 1.8 cpb on Aarch64 and 2.1 cpb on PowerPC.
+void XTS_ModeBase::ProcessData(byte *outString, const byte *inString, size_t length)
+{
+    // data unit is multiple of 16 bytes
+    CRYPTOPP_ASSERT(length % BlockSize() == 0);
+
+    enum { lastParallelBlock = ParallelBlocks-1 };
+    const unsigned int blockSize = GetBlockCipher().BlockSize();
+    const size_t parallelSize = blockSize*ParallelBlocks;
+
+    // encrypt the data unit, optimal size at a time
+    while (length >= parallelSize)
+    {
+        // m_xregister[0] always points to the next tweak.
+        GF_Double(m_xregister+1*blockSize, m_xregister+0*blockSize, blockSize);
+        GF_Double(m_xregister+2*blockSize, m_xregister+1*blockSize, blockSize);
+        GF_Double(m_xregister+3*blockSize, m_xregister+2*blockSize, blockSize);
+
+        if (ParallelBlocks > 4)
+        {
+            GF_Double(m_xregister+4*blockSize, m_xregister+3*blockSize, blockSize);
+            GF_Double(m_xregister+5*blockSize, m_xregister+4*blockSize, blockSize);
+            GF_Double(m_xregister+6*blockSize, m_xregister+5*blockSize, blockSize);
+            GF_Double(m_xregister+7*blockSize, m_xregister+6*blockSize, blockSize);
+        }
+        if (ParallelBlocks > 8)
+        {
+            GF_Double(m_xregister+8*blockSize, m_xregister+7*blockSize, blockSize);
+            GF_Double(m_xregister+9*blockSize, m_xregister+8*blockSize, blockSize);
+            GF_Double(m_xregister+10*blockSize, m_xregister+9*blockSize, blockSize);
+            GF_Double(m_xregister+11*blockSize, m_xregister+10*blockSize, blockSize);
+        }
+
+        // merge the tweak into the input block
+        XorBuffer(m_xworkspace, inString, m_xregister, parallelSize);
+
+        // encrypt one block, merge the tweak into the output block
+        GetBlockCipher().AdvancedProcessBlocks(m_xworkspace, m_xregister,
+            outString, parallelSize, BlockTransformation::BT_AllowParallel);
+
+        // m_xregister[0] always points to the next tweak.
+        GF_Double(m_xregister+0, m_xregister+lastParallelBlock*blockSize, blockSize);
+
+        inString += parallelSize;
+        outString += parallelSize;
+        length -= parallelSize;
+    }
+
+    // encrypt the data unit, 4 blocks at a time
+    while (ParallelBlocks == 12 && length >= blockSize*4)
+    {
+        // m_xregister[0] always points to the next tweak.
+        GF_Double(m_xregister+1*blockSize, m_xregister+0*blockSize, blockSize);
+        GF_Double(m_xregister+2*blockSize, m_xregister+1*blockSize, blockSize);
+        GF_Double(m_xregister+3*blockSize, m_xregister+2*blockSize, blockSize);
+
+        // merge the tweak into the input block
+        XorBuffer(m_xworkspace, inString, m_xregister, blockSize*4);
+
+        // encrypt one block, merge the tweak into the output block
+        GetBlockCipher().AdvancedProcessBlocks(m_xworkspace, m_xregister,
+            outString, blockSize*4, BlockTransformation::BT_AllowParallel);
+
+        // m_xregister[0] always points to the next tweak.
+        GF_Double(m_xregister+0, m_xregister+3*blockSize, blockSize);
+
+        inString += blockSize*4;
+        outString += blockSize*4;
+        length -= blockSize*4;
+    }
+
+    // encrypt the data unit, 2 blocks at a time
+    while (ParallelBlocks == 8 && length >= blockSize*2)
+    {
+        // m_xregister[0] always points to the next tweak.
+        GF_Double(m_xregister+1*blockSize, m_xregister+0*blockSize, blockSize);
+
+        // merge the tweak into the input block
+        XorBuffer(m_xworkspace, inString, m_xregister, blockSize*2);
+
+        // encrypt one block, merge the tweak into the output block
+        GetBlockCipher().AdvancedProcessBlocks(m_xworkspace, m_xregister,
+            outString, blockSize*2, BlockTransformation::BT_AllowParallel);
+
+        // m_xregister[0] always points to the next tweak.
+        GF_Double(m_xregister+0, m_xregister+1*blockSize, blockSize);
+
+        inString += blockSize*2;
+        outString += blockSize*2;
+        length -= blockSize*2;
+    }
+
+    // encrypt the data unit, blocksize at a time
+    while (length)
+    {
+        // merge the tweak into the input block
+        XorBuffer(m_xworkspace, inString, m_xregister, blockSize);
+
+        // encrypt one block
+        GetBlockCipher().ProcessBlock(m_xworkspace);
+
+        // merge the tweak into the output block
+        XorBuffer(outString, m_xworkspace, m_xregister, blockSize);
+
+        // Multiply T by alpha
+        GF_Double(m_xregister, blockSize);
+
+        inString += blockSize;
+        outString += blockSize;
+        length -= blockSize;
+    }
+}
+
+size_t XTS_ModeBase::ProcessLastBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength)
+{
+    // need at least a full AES block
+    CRYPTOPP_ASSERT(inLength >= BlockSize());
+
+    if (inLength < BlockSize())
+        throw InvalidArgument("XTS: message is too short for ciphertext stealing");
+
+    if (IsForwardTransformation())
+        return ProcessLastPlainBlock(outString, outLength, inString, inLength);
+    else
+        return ProcessLastCipherBlock(outString, outLength, inString, inLength);
+}
+
+size_t XTS_ModeBase::ProcessLastPlainBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength)
+{
+    // ensure output buffer is large enough
+    CRYPTOPP_ASSERT(outLength >= inLength);
+
+    const unsigned int blockSize = GetBlockCipher().BlockSize();
+    const size_t blocks = inLength / blockSize;
+    const size_t tail = inLength % blockSize;
+    outLength = inLength;
+
+    if (tail == 0)
+    {
+        // Allow ProcessData to handle all the full blocks
+        ProcessData(outString, inString, inLength);
+        return inLength;
+    }
+    else if (blocks > 1)
+    {
+        // Allow ProcessData to handle full blocks except one
+        const size_t head = (blocks-1)*blockSize;
+        ProcessData(outString, inString, inLength-head);
+
+        outString += head;
+        inString  += head; inLength -= head;
+    }
+
+    ///// handle the full block /////
+
+    // merge the tweak into the input block
+    XorBuffer(m_xworkspace, inString, m_xregister, blockSize);
+
+    // encrypt one block
+    GetBlockCipher().ProcessBlock(m_xworkspace);
+
+    // merge the tweak into the output block
+    XorBuffer(outString, m_xworkspace, m_xregister, blockSize);
+
+    // Multiply T by alpha
+    GF_Double(m_xregister, blockSize);
+
+    ///// handle final partial block /////
+
+    inString += blockSize;
+    outString += blockSize;
+    const size_t len = inLength-blockSize;
+
+    // copy in the final plaintext bytes
+    std::memcpy(m_xworkspace, inString, len);
+    // and copy out the final ciphertext bytes
+    std::memcpy(outString, outString-blockSize, len);
+    // "steal" ciphertext to complete the block
+    std::memcpy(m_xworkspace+len, outString-blockSize+len, blockSize-len);
+
+    // merge the tweak into the input block
+    XorBuffer(m_xworkspace, m_xregister, blockSize);
+
+    // encrypt one block
+    GetBlockCipher().ProcessBlock(m_xworkspace);
+
+    // merge the tweak into the previous output block
+    XorBuffer(outString-blockSize, m_xworkspace, m_xregister, blockSize);
+
+    return outLength;
+}
+
+size_t XTS_ModeBase::ProcessLastCipherBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength)
+{
+    // ensure output buffer is large enough
+    CRYPTOPP_ASSERT(outLength >= inLength);
+
+    const unsigned int blockSize = GetBlockCipher().BlockSize();
+    const size_t blocks = inLength / blockSize;
+    const size_t tail = inLength % blockSize;
+    outLength = inLength;
+
+    if (tail == 0)
+    {
+        // Allow ProcessData to handle all the full blocks
+        ProcessData(outString, inString, inLength);
+        return inLength;
+    }
+    else if (blocks > 1)
+    {
+        // Allow ProcessData to handle full blocks except one
+        const size_t head = (blocks-1)*blockSize;
+        ProcessData(outString, inString, inLength-head);
+
+        outString += head;
+        inString  += head; inLength -= head;
+    }
+
+    #define poly1 (m_xregister+0*blockSize)
+    #define poly2 (m_xregister+1*blockSize)
+    GF_Double(poly2, poly1, blockSize);
+
+    ///// handle final partial block /////
+
+    inString += blockSize;
+    outString += blockSize;
+    const size_t len = inLength-blockSize;
+
+    // merge the tweak into the input block
+    XorBuffer(m_xworkspace, inString-blockSize, poly2, blockSize);
+
+    // encrypt one block
+    GetBlockCipher().ProcessBlock(m_xworkspace);
+
+    // merge the tweak into the output block
+    XorBuffer(m_xworkspace, poly2, blockSize);
+
+    // copy in the final plaintext bytes
+    std::memcpy(outString-blockSize, inString, len);
+    // and copy out the final ciphertext bytes
+    std::memcpy(outString, m_xworkspace, len);
+    // "steal" ciphertext to complete the block
+    std::memcpy(outString-blockSize+len, m_xworkspace+len, blockSize-len);
+
+    ///// handle the full previous block /////
+
+    inString -= blockSize;
+    outString -= blockSize;
+
+    // merge the tweak into the input block
+    XorBuffer(m_xworkspace, outString, poly1, blockSize);
+
+    // encrypt one block
+    GetBlockCipher().ProcessBlock(m_xworkspace);
+
+    // merge the tweak into the output block
+    XorBuffer(outString, m_xworkspace, poly1, blockSize);
+
+    return outLength;
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/xts.h b/runtime/third_party/cryptopp/xts.h
new file mode 100644
index 0000000..6eac379
--- /dev/null
+++ b/runtime/third_party/cryptopp/xts.h
@@ -0,0 +1,224 @@
+// xts.h - written and placed in the public domain by Jeffrey Walton
+
+/// \file xts.h
+/// \brief Classes for XTS block cipher mode of operation
+/// \details XTS mode is a wide block mode defined by IEEE P1619-2008. NIST
+///  SP-800-38E approves the mode for storage devices citing IEEE 1619-2007.
+///  IEEE 1619-2007 provides both a reference implementation and test vectors.
+///  The IEEE reference implementation fails to arrive at the expected result
+///  for some test vectors.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of
+///  Operation</A> on the Crypto++ wiki, <A
+///  HREF="https://web.cs.ucdavis.edu/~rogaway/papers/modes.pdf"> Evaluation of Some
+///  Blockcipher Modes of Operation</A>, <A
+///  HREF="https://csrc.nist.gov/publications/detail/sp/800-38e/final">Recommendation
+///  for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality on
+///  Storage Devices</A>, <A
+///  HREF="http://libeccio.di.unisa.it/Crypto14/Lab/p1619.pdf">IEEE P1619-2007</A>
+///  and <A HREF="https://crypto.stackexchange.com/q/74925/10496">IEEE P1619/XTS,
+///  inconsistent reference implementation and test vectors</A>.
+/// \since Crypto++ 8.3
+
+#ifndef CRYPTOPP_XTS_MODE_H
+#define CRYPTOPP_XTS_MODE_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "modes.h"
+#include "misc.h"
+
+/// \brief Enable XTS for wide block ciphers
+/// \details XTS is only defined for AES. The library can support wide
+///  block ciphers like Kaylna and Threefish since we know the polynomials.
+///  To enable wide block ciphers define <tt>CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS</tt>
+///  to non-zero. Note this is a library compile time define.
+/// \details There is risk involved with using XTS with wider block ciphers.
+///  According to Phillip Rogaway, "The narrow width of the underlying PRP and
+///  the poor treatment of fractional final blocks are problems."
+/// \sa <A HREF="https://web.cs.ucdavis.edu/~rogaway/papers/modes.pdf">Evaluation
+///  of Some Blockcipher Modes of Operation</A>
+/// \since Crypto++ 8.3
+#ifndef CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS
+# define CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS 0
+#endif  // CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief XTS block cipher mode of operation default implementation
+/// \since Crypto++ 8.3
+class CRYPTOPP_NO_VTABLE XTS_ModeBase : public BlockOrientedCipherModeBase
+{
+public:
+    /// \brief The algorithm name
+    /// \return the algorithm name
+    /// \details StaticAlgorithmName returns the algorithm's name as a static
+    ///  member function.
+    CRYPTOPP_STATIC_CONSTEXPR const char* StaticAlgorithmName()
+        {return "XTS";}
+
+    virtual ~XTS_ModeBase() {}
+
+    std::string AlgorithmName() const
+        {return GetBlockCipher().AlgorithmName() + "/XTS";}
+    std::string AlgorithmProvider() const
+        {return GetBlockCipher().AlgorithmProvider();}
+
+    size_t MinKeyLength() const
+        {return GetBlockCipher().MinKeyLength()*2;}
+    size_t MaxKeyLength() const
+        {return GetBlockCipher().MaxKeyLength()*2;}
+    size_t DefaultKeyLength() const
+        {return GetBlockCipher().DefaultKeyLength()*2;}
+    size_t GetValidKeyLength(size_t n) const
+        {return 2*GetBlockCipher().GetValidKeyLength((n+1)/2);}
+    bool IsValidKeyLength(size_t keylength) const
+        {return keylength == GetValidKeyLength(keylength);}
+
+    /// \brief Validates the key length
+    /// \param length the size of the keying material, in bytes
+    /// \throw InvalidKeyLength if the key length is invalid
+    void ThrowIfInvalidKeyLength(size_t length);
+
+    /// Provides the block size of the cipher
+    /// \return the block size of the cipher, in bytes
+    unsigned int BlockSize() const
+        {return GetBlockCipher().BlockSize();}
+
+    /// \brief Provides the input block size most efficient for this cipher
+    /// \return The input block size that is most efficient for the cipher
+    /// \details The base class implementation returns MandatoryBlockSize().
+    /// \note Optimal input length is
+    ///  <tt>n * OptimalBlockSize() - GetOptimalBlockSizeUsed()</tt> for
+    ///  any <tt>n \> 0</tt>.
+    unsigned int GetOptimalBlockSize() const
+        {return GetBlockCipher().BlockSize()*ParallelBlocks;}
+    unsigned int MinLastBlockSize() const
+        {return GetBlockCipher().BlockSize()+1;}
+    unsigned int OptimalDataAlignment() const
+        {return GetBlockCipher().OptimalDataAlignment();}
+
+    /// \brief Validates the block size
+    /// \param length the block size of the cipher, in bytes
+    /// \throw InvalidArgument if the block size is invalid
+    /// \details If <tt>CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS</tt> is 0,
+    ///  then CIPHER must be a 16-byte block cipher. If
+    ///  <tt>CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS</tt> is non-zero then
+    ///  CIPHER can be 16, 32, 64, or 128-byte block cipher.
+    void ThrowIfInvalidBlockSize(size_t length);
+
+    void SetKey(const byte *key, size_t length, const NameValuePairs &params = g_nullNameValuePairs);
+    IV_Requirement IVRequirement() const {return UNIQUE_IV;}
+    void Resynchronize(const byte *iv, int ivLength=-1);
+    void ProcessData(byte *outString, const byte *inString, size_t length);
+    size_t ProcessLastBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength);
+
+    /// \brief Resynchronize the cipher
+    /// \param sector a 64-bit sector number
+    /// \param order the endian order the word should be written
+    /// \details The Resynchronize() overload was provided for API
+    ///  compatibility with the IEEE P1619 paper.
+    void Resynchronize(word64 sector, ByteOrder order=BIG_ENDIAN_ORDER);
+
+protected:
+    virtual void ResizeBuffers();
+
+    inline size_t ProcessLastPlainBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength);
+    inline size_t ProcessLastCipherBlock(byte *outString, size_t outLength, const byte *inString, size_t inLength);
+
+    virtual BlockCipher& AccessBlockCipher() = 0;
+    virtual BlockCipher& AccessTweakCipher() = 0;
+
+    const BlockCipher& GetBlockCipher() const
+        {return const_cast<XTS_ModeBase*>(this)->AccessBlockCipher();}
+    const BlockCipher& GetTweakCipher() const
+        {return const_cast<XTS_ModeBase*>(this)->AccessTweakCipher();}
+
+    // Buffers are sized based on ParallelBlocks
+    AlignedSecByteBlock m_xregister;
+    AlignedSecByteBlock m_xworkspace;
+
+    // Intel lacks the SSE registers to run 8 or 12 parallel blocks.
+    // Do not change this value after compiling. It has no effect.
+#if CRYPTOPP_BOOL_X64 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X86
+    enum {ParallelBlocks = 4};
+#else
+    enum {ParallelBlocks = 12};
+#endif
+};
+
+/// \brief XTS block cipher mode of operation implementation
+/// \tparam CIPHER BlockCipher derived class or type
+/// \details XTS_Final() provides access to CIPHER in base class XTS_ModeBase()
+///  through an interface. AccessBlockCipher() and AccessTweakCipher() allow
+///  the XTS_ModeBase() base class to access the user's block cipher without
+///  recompiling the library.
+/// \details If <tt>CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS</tt> is 0, then CIPHER must
+///  be a 16-byte block cipher. If <tt>CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS</tt> is
+///  non-zero then CIPHER can be 16, 32, 64, or 128-byte block cipher.
+///  There is risk involved with using XTS with wider block ciphers.
+///  According to Phillip Rogaway, "The narrow width of the underlying PRP and
+///  the poor treatment of fractional final blocks are problems." To enable
+///  wide block cipher support define <tt>CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS</tt> to
+///  non-zero.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of
+///  Operation</A> on the Crypto++ wiki, <A
+///  HREF="https://web.cs.ucdavis.edu/~rogaway/papers/modes.pdf"> Evaluation of Some
+///  Blockcipher Modes of Operation</A>, <A
+///  HREF="https://csrc.nist.gov/publications/detail/sp/800-38e/final">Recommendation
+///  for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality on
+///  Storage Devices</A>, <A
+///  HREF="http://libeccio.di.unisa.it/Crypto14/Lab/p1619.pdf">IEEE P1619-2007</A>
+///  and <A HREF="https://crypto.stackexchange.com/q/74925/10496">IEEE P1619/XTS,
+///  inconsistent reference implementation and test vectors</A>.
+/// \since Crypto++ 8.3
+template <class CIPHER>
+class CRYPTOPP_NO_VTABLE XTS_Final : public XTS_ModeBase
+{
+protected:
+    BlockCipher& AccessBlockCipher()
+        {return *m_cipher;}
+    BlockCipher& AccessTweakCipher()
+        {return m_tweaker;}
+
+protected:
+    typename CIPHER::Encryption m_tweaker;
+};
+
+/// \brief XTS block cipher mode of operation
+/// \tparam CIPHER BlockCipher derived class or type
+/// \details XTS mode is a wide block mode defined by IEEE P1619-2008. NIST
+///  SP-800-38E approves the mode for storage devices citing IEEE 1619-2007.
+///  IEEE 1619-2007 provides both a reference implementation and test vectors.
+///  The IEEE reference implementation fails to arrive at the expected result
+///  for some test vectors.
+/// \details XTS is only defined for AES. The library can support wide
+///  block ciphers like Kaylna and Threefish since we know the polynomials.
+///  There is risk involved with using XTS with wider block ciphers.
+///  According to Phillip Rogaway, "The narrow width of the underlying PRP and
+///  the poor treatment of fractional final blocks are problems." To enable
+///  wide block cipher support define <tt>CRYPTOPP_XTS_WIDE_BLOCK_CIPHERS</tt> to
+///  non-zero.
+/// \sa <A HREF="http://www.cryptopp.com/wiki/Modes_of_Operation">Modes of
+///  Operation</A> on the Crypto++ wiki, <A
+///  HREF="https://web.cs.ucdavis.edu/~rogaway/papers/modes.pdf"> Evaluation of Some
+///  Blockcipher Modes of Operation</A>, <A
+///  HREF="https://csrc.nist.gov/publications/detail/sp/800-38e/final">Recommendation
+///  for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality on
+///  Storage Devices</A>, <A
+///  HREF="http://libeccio.di.unisa.it/Crypto14/Lab/p1619.pdf">IEEE P1619-2007</A>
+///  and <A HREF="https://crypto.stackexchange.com/q/74925/10496">IEEE P1619/XTS,
+///  inconsistent reference implementation and test vectors</A>.
+/// \since Crypto++ 8.3
+template <class CIPHER>
+struct XTS : public CipherModeDocumentation
+{
+    typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Encryption, XTS_Final<CIPHER> > Encryption;
+    typedef CipherModeFinalTemplate_CipherHolder<typename CIPHER::Decryption, XTS_Final<CIPHER> > Decryption;
+};
+
+// C++03 lacks the mechanics to typedef a template
+#define XTS_Mode XTS
+
+NAMESPACE_END
+
+#endif  // CRYPTOPP_XTS_MODE_H
diff --git a/runtime/third_party/cryptopp/zdeflate.cpp b/runtime/third_party/cryptopp/zdeflate.cpp
new file mode 100644
index 0000000..6b2b6cb
--- /dev/null
+++ b/runtime/third_party/cryptopp/zdeflate.cpp
@@ -0,0 +1,821 @@
+// zdeflate.cpp - originally written and placed in the public domain by Wei Dai
+
+// Many of the algorithms and tables used here came from the deflate implementation
+// by Jean-loup Gailly, which was included in Crypto++ 4.0 and earlier. I completely
+// rewrote it in order to fix a bug that I could not figure out. This code
+// is less clever, but hopefully more understandable and maintainable.
+
+#include "pch.h"
+#include "zdeflate.h"
+#include "stdcpp.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+#if (defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION < 1400)) && !defined(__MWERKS__)
+	// VC60 and VC7 workaround: built-in std::reverse_iterator has two template parameters, Dinkumware only has one
+	typedef std::reverse_bidirectional_iterator<unsigned int *, unsigned int> RevIt;
+#elif defined(_RWSTD_NO_CLASS_PARTIAL_SPEC)
+	typedef std::reverse_iterator<unsigned int *, std::random_access_iterator_tag, unsigned int> RevIt;
+#else
+	typedef std::reverse_iterator<unsigned int *> RevIt;
+#endif
+
+LowFirstBitWriter::LowFirstBitWriter(BufferedTransformation *attachment)
+	: Filter(attachment), m_counting(false), m_bitCount(0), m_buffer(0)
+	, m_bitsBuffered(0), m_bytesBuffered(0)
+{
+}
+
+void LowFirstBitWriter::StartCounting()
+{
+	CRYPTOPP_ASSERT(!m_counting);
+	m_counting = true;
+	m_bitCount = 0;
+}
+
+unsigned long LowFirstBitWriter::FinishCounting()
+{
+	CRYPTOPP_ASSERT(m_counting);
+	m_counting = false;
+	return m_bitCount;
+}
+
+void LowFirstBitWriter::PutBits(unsigned long value, unsigned int length)
+{
+	if (m_counting)
+		m_bitCount += length;
+	else
+	{
+		m_buffer |= value << m_bitsBuffered;
+		m_bitsBuffered += length;
+		CRYPTOPP_ASSERT(m_bitsBuffered <= sizeof(unsigned long)*8);
+		while (m_bitsBuffered >= 8)
+		{
+			m_outputBuffer[m_bytesBuffered++] = (byte)m_buffer;
+			if (m_bytesBuffered == m_outputBuffer.size())
+			{
+				AttachedTransformation()->PutModifiable(m_outputBuffer, m_bytesBuffered);
+				m_bytesBuffered = 0;
+			}
+			m_buffer >>= 8;
+			m_bitsBuffered -= 8;
+		}
+	}
+}
+
+void LowFirstBitWriter::FlushBitBuffer()
+{
+	if (m_counting)
+		m_bitCount += 8*(m_bitsBuffered > 0);
+	else
+	{
+		if (m_bytesBuffered > 0)
+		{
+			AttachedTransformation()->PutModifiable(m_outputBuffer, m_bytesBuffered);
+			m_bytesBuffered = 0;
+		}
+		if (m_bitsBuffered > 0)
+		{
+			AttachedTransformation()->Put((byte)m_buffer);
+			m_buffer = 0;
+			m_bitsBuffered = 0;
+		}
+	}
+}
+
+void LowFirstBitWriter::ClearBitBuffer()
+{
+	m_buffer = 0;
+	m_bytesBuffered = 0;
+	m_bitsBuffered = 0;
+}
+
+HuffmanEncoder::HuffmanEncoder(const unsigned int *codeBits, unsigned int nCodes)
+{
+	Initialize(codeBits, nCodes);
+}
+
+struct HuffmanNode
+{
+	HuffmanNode()
+		: symbol(0), parent(0) {}
+	HuffmanNode(const HuffmanNode& rhs)
+		: symbol(rhs.symbol), parent(rhs.parent) {}
+	HuffmanNode& operator=(const HuffmanNode& rhs)
+	{
+		// No this guard
+		symbol = rhs.symbol;
+		parent = rhs.parent;
+		return *this;
+	}
+
+	size_t symbol;
+	union {size_t parent; unsigned depth, freq;};
+};
+
+struct FreqLessThan
+{
+	inline bool operator()(unsigned int lhs, const HuffmanNode &rhs) {return lhs < rhs.freq;}
+	inline bool operator()(const HuffmanNode &lhs, const HuffmanNode &rhs) const {return lhs.freq < rhs.freq;}
+	// needed for MSVC .NET 2005
+	inline bool operator()(const HuffmanNode &lhs, unsigned int rhs) {return lhs.freq < rhs;}
+};
+
+void HuffmanEncoder::GenerateCodeLengths(unsigned int *codeBits, unsigned int maxCodeBits, const unsigned int *codeCounts, size_t nCodes)
+{
+	CRYPTOPP_ASSERT(nCodes > 0);
+	CRYPTOPP_ASSERT(nCodes <= ((size_t)1 << maxCodeBits));
+
+	size_t i;
+	SecBlockWithHint<HuffmanNode, 2*286> tree(nCodes);
+	for (i=0; i<nCodes; i++)
+	{
+		tree[i].symbol = i;
+		tree[i].freq = codeCounts[i];
+	}
+	std::sort(tree.begin(), tree.end(), FreqLessThan());
+	size_t treeBegin = std::upper_bound(tree.begin(), tree.end(), 0, FreqLessThan()) - tree.begin();
+	if (treeBegin == nCodes)
+	{	// special case for no codes
+		std::fill(codeBits, codeBits+nCodes, 0);
+		return;
+	}
+	tree.resize(nCodes + nCodes - treeBegin - 1);
+
+	size_t leastLeaf = treeBegin, leastInterior = nCodes;
+	for (i=nCodes; i<tree.size(); i++)
+	{
+		size_t least;
+		least = (leastLeaf == nCodes || (leastInterior < i && tree[leastInterior].freq < tree[leastLeaf].freq)) ? leastInterior++ : leastLeaf++;
+		tree[i].freq = tree[least].freq;
+		tree[least].parent = i;
+		least = (leastLeaf == nCodes || (leastInterior < i && tree[leastInterior].freq < tree[leastLeaf].freq)) ? leastInterior++ : leastLeaf++;
+		tree[i].freq += tree[least].freq;
+		tree[least].parent = i;
+	}
+
+	tree[tree.size()-1].depth = 0;
+	if (tree.size() >= 2)
+		for (i=tree.size()-2; i>=nCodes; i--)
+			tree[i].depth = tree[tree[i].parent].depth + 1;
+	unsigned int sum = 0;
+	SecBlockWithHint<unsigned int, 15+1> blCount(maxCodeBits+1);
+	std::fill(blCount.begin(), blCount.end(), 0);
+	for (i=treeBegin; i<nCodes; i++)
+	{
+		const size_t n = tree[i].parent;
+		const size_t depth = STDMIN(maxCodeBits, tree[n].depth + 1);
+		blCount[depth]++;
+		sum += 1 << (maxCodeBits - depth);
+	}
+
+	unsigned int overflow = sum > (unsigned int)(1 << maxCodeBits) ? sum - (1 << maxCodeBits) : 0;
+
+	while (overflow--)
+	{
+		unsigned int bits = maxCodeBits-1;
+		while (blCount[bits] == 0)
+			bits--;
+		blCount[bits]--;
+		blCount[bits+1] += 2;
+		CRYPTOPP_ASSERT(blCount[maxCodeBits] > 0);
+		blCount[maxCodeBits]--;
+	}
+
+	for (i=0; i<treeBegin; i++)
+		codeBits[tree[i].symbol] = 0;
+	unsigned int bits = maxCodeBits;
+	for (i=treeBegin; i<nCodes; i++)
+	{
+		while (blCount[bits] == 0)
+			bits--;
+		codeBits[tree[i].symbol] = bits;
+		blCount[bits]--;
+	}
+	CRYPTOPP_ASSERT(blCount[bits] == 0);
+}
+
+void HuffmanEncoder::Initialize(const unsigned int *codeBits, unsigned int nCodes)
+{
+	CRYPTOPP_ASSERT(nCodes > 0);
+	unsigned int maxCodeBits = *std::max_element(codeBits, codeBits+nCodes);
+	if (maxCodeBits == 0)
+		return;		// assume this object won't be used
+
+	SecBlockWithHint<unsigned int, 15+1> blCount(maxCodeBits+1);
+	std::fill(blCount.begin(), blCount.end(), 0);
+	unsigned int i;
+	for (i=0; i<nCodes; i++)
+		blCount[codeBits[i]]++;
+
+	code_t code = 0;
+	SecBlockWithHint<code_t, 15+1> nextCode(maxCodeBits+1);
+	nextCode[1] = 0;
+	for (i=2; i<=maxCodeBits; i++)
+	{
+		code = (code + blCount[i-1]) << 1;
+		nextCode[i] = code;
+	}
+	CRYPTOPP_ASSERT(maxCodeBits == 1 || code == (1 << maxCodeBits) - blCount[maxCodeBits]);
+
+	m_valueToCode.resize(nCodes);
+	for (i=0; i<nCodes; i++)
+	{
+		unsigned int len = m_valueToCode[i].len = codeBits[i];
+		if (len != 0)
+			m_valueToCode[i].code = BitReverse(nextCode[len]++) >> (8*sizeof(code_t)-len);
+	}
+}
+
+inline void HuffmanEncoder::Encode(LowFirstBitWriter &writer, value_t value) const
+{
+	CRYPTOPP_ASSERT(m_valueToCode[value].len > 0);
+	writer.PutBits(m_valueToCode[value].code, m_valueToCode[value].len);
+}
+
+Deflator::Deflator(BufferedTransformation *attachment, int deflateLevel, int log2WindowSize, bool detectUncompressible)
+	: LowFirstBitWriter(attachment)
+	, m_deflateLevel(-1)
+{
+	InitializeStaticEncoders();
+	Deflator::IsolatedInitialize(MakeParameters("DeflateLevel", deflateLevel)("Log2WindowSize", log2WindowSize)("DetectUncompressible", detectUncompressible));
+}
+
+Deflator::Deflator(const NameValuePairs &parameters, BufferedTransformation *attachment)
+	: LowFirstBitWriter(attachment)
+	, m_deflateLevel(-1)
+{
+	InitializeStaticEncoders();
+	Deflator::IsolatedInitialize(parameters);
+}
+
+void Deflator::InitializeStaticEncoders()
+{
+	unsigned int codeLengths[288];
+	std::fill(codeLengths + 0, codeLengths + 144, 8);
+	std::fill(codeLengths + 144, codeLengths + 256, 9);
+	std::fill(codeLengths + 256, codeLengths + 280, 7);
+	std::fill(codeLengths + 280, codeLengths + 288, 8);
+	m_staticLiteralEncoder.Initialize(codeLengths, 288);
+	std::fill(codeLengths + 0, codeLengths + 32, 5);
+	m_staticDistanceEncoder.Initialize(codeLengths, 32);
+}
+
+void Deflator::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	int log2WindowSize = parameters.GetIntValueWithDefault("Log2WindowSize", DEFAULT_LOG2_WINDOW_SIZE);
+	if (!(MIN_LOG2_WINDOW_SIZE <= log2WindowSize && log2WindowSize <= MAX_LOG2_WINDOW_SIZE))
+		throw InvalidArgument("Deflator: " + IntToString(log2WindowSize) + " is an invalid window size");
+
+	m_log2WindowSize = log2WindowSize;
+	DSIZE = 1 << m_log2WindowSize;
+	DMASK = DSIZE - 1;
+	HSIZE = 1 << m_log2WindowSize;
+	HMASK = HSIZE - 1;
+	m_byteBuffer.New(2*DSIZE);
+	m_head.New(HSIZE);
+	m_prev.New(DSIZE);
+	m_matchBuffer.New(DSIZE/2);
+	Reset(true);
+
+	const int deflateLevel = parameters.GetIntValueWithDefault("DeflateLevel", DEFAULT_DEFLATE_LEVEL);
+	CRYPTOPP_ASSERT(deflateLevel >= MIN_DEFLATE_LEVEL /*0*/ && deflateLevel <= MAX_DEFLATE_LEVEL /*9*/);
+	SetDeflateLevel(deflateLevel);
+	bool detectUncompressible = parameters.GetValueWithDefault("DetectUncompressible", true);
+	m_compressibleDeflateLevel = detectUncompressible ? m_deflateLevel : 0;
+}
+
+void Deflator::Reset(bool forceReset)
+{
+	if (forceReset)
+		ClearBitBuffer();
+	else
+		CRYPTOPP_ASSERT(m_bitsBuffered == 0);
+
+	m_headerWritten = false;
+	m_matchAvailable = false;
+	m_dictionaryEnd = 0;
+	m_stringStart = 0;
+	m_lookahead = 0;
+	m_minLookahead = MAX_MATCH;
+	m_matchBufferEnd = 0;
+	m_blockStart = 0;
+	m_blockLength = 0;
+
+	m_detectCount = 1;
+	m_detectSkip = 0;
+
+	// m_prev will be initialized automatically in InsertString
+	std::fill(m_head.begin(), m_head.end(), byte(0));
+
+	std::fill(m_literalCounts.begin(), m_literalCounts.end(), byte(0));
+	std::fill(m_distanceCounts.begin(), m_distanceCounts.end(), byte(0));
+}
+
+void Deflator::SetDeflateLevel(int deflateLevel)
+{
+	if (!(MIN_DEFLATE_LEVEL <= deflateLevel && deflateLevel <= MAX_DEFLATE_LEVEL))
+		throw InvalidArgument("Deflator: " + IntToString(deflateLevel) + " is an invalid deflate level");
+
+	if (deflateLevel == m_deflateLevel)
+		return;
+
+	EndBlock(false);
+
+	static const unsigned int configurationTable[10][4] = {
+		/*      good lazy nice chain */
+		/* 0 */ {0,    0,  0,    0},  /* store only */
+		/* 1 */ {4,    3,  8,    4},  /* maximum speed, no lazy matches */
+		/* 2 */ {4,    3, 16,    8},
+		/* 3 */ {4,    3, 32,   32},
+		/* 4 */ {4,    4, 16,   16},  /* lazy matches */
+		/* 5 */ {8,   16, 32,   32},
+		/* 6 */ {8,   16, 128, 128},
+		/* 7 */ {8,   32, 128, 256},
+		/* 8 */ {32, 128, 258, 1024},
+		/* 9 */ {32, 258, 258, 4096}}; /* maximum compression */
+
+	GOOD_MATCH = configurationTable[deflateLevel][0];
+	MAX_LAZYLENGTH = configurationTable[deflateLevel][1];
+	MAX_CHAIN_LENGTH = configurationTable[deflateLevel][3];
+
+	m_deflateLevel = deflateLevel;
+}
+
+unsigned int Deflator::FillWindow(const byte *str, size_t length)
+{
+	unsigned int maxBlockSize = (unsigned int)STDMIN(2UL*DSIZE, 0xffffUL);
+
+	if (m_stringStart >= maxBlockSize - MAX_MATCH)
+	{
+		if (m_blockStart < DSIZE)
+			EndBlock(false);
+
+		std::memcpy(m_byteBuffer, m_byteBuffer + DSIZE, DSIZE);
+
+		m_dictionaryEnd = m_dictionaryEnd < DSIZE ? 0 : m_dictionaryEnd-DSIZE;
+		CRYPTOPP_ASSERT(m_stringStart >= DSIZE);
+		m_stringStart -= DSIZE;
+		CRYPTOPP_ASSERT(!m_matchAvailable || m_previousMatch >= DSIZE);
+		m_previousMatch -= DSIZE;
+		CRYPTOPP_ASSERT(m_blockStart >= DSIZE);
+		m_blockStart -= DSIZE;
+
+		// These are set to the same value in IsolatedInitialize(). If they
+		//   are the same, then we can clear a Coverity false alarm.
+		CRYPTOPP_ASSERT(DSIZE == HSIZE);
+
+		unsigned int i;
+		for (i=0; i<HSIZE; i++)
+			m_head[i] = SaturatingSubtract(m_head[i], HSIZE); // was DSIZE???
+
+		for (i=0; i<DSIZE; i++)
+			m_prev[i] = SaturatingSubtract(m_prev[i], DSIZE);
+	}
+
+	CRYPTOPP_ASSERT(maxBlockSize > m_stringStart+m_lookahead);
+	unsigned int accepted = UnsignedMin(maxBlockSize-(m_stringStart+m_lookahead), length);
+	CRYPTOPP_ASSERT(accepted > 0);
+	std::memcpy(m_byteBuffer + m_stringStart + m_lookahead, str, accepted);
+	m_lookahead += accepted;
+	return accepted;
+}
+
+inline unsigned int Deflator::ComputeHash(const byte *str) const
+{
+	CRYPTOPP_ASSERT(str+3 <= m_byteBuffer + m_stringStart + m_lookahead);
+	return ((str[0] << 10) ^ (str[1] << 5) ^ str[2]) & HMASK;
+}
+
+unsigned int Deflator::LongestMatch(unsigned int &bestMatch) const
+{
+	CRYPTOPP_ASSERT(m_previousLength < MAX_MATCH);
+
+	bestMatch = 0;
+	unsigned int bestLength = STDMAX(m_previousLength, (unsigned int)MIN_MATCH-1);
+	if (m_lookahead <= bestLength)
+		return 0;
+
+	const byte *scan = m_byteBuffer + m_stringStart, *scanEnd = scan + STDMIN((unsigned int)MAX_MATCH, m_lookahead);
+	unsigned int limit = m_stringStart > (DSIZE-MAX_MATCH) ? m_stringStart - (DSIZE-MAX_MATCH) : 0;
+	unsigned int current = m_head[ComputeHash(scan)];
+
+	unsigned int chainLength = MAX_CHAIN_LENGTH;
+	if (m_previousLength >= GOOD_MATCH)
+		chainLength >>= 2;
+
+	while (current > limit && --chainLength > 0)
+	{
+		const byte *match = m_byteBuffer + current;
+		CRYPTOPP_ASSERT(scan + bestLength < m_byteBuffer + m_stringStart + m_lookahead);
+		if (scan[bestLength-1] == match[bestLength-1] && scan[bestLength] == match[bestLength] && scan[0] == match[0] && scan[1] == match[1])
+		{
+			CRYPTOPP_ASSERT(scan[2] == match[2]);
+			unsigned int len = (unsigned int)(
+#if defined(_STDEXT_BEGIN) && !(defined(CRYPTOPP_MSC_VERSION) && (CRYPTOPP_MSC_VERSION < 1400 || CRYPTOPP_MSC_VERSION >= 1600)) && !defined(_STLPORT_VERSION)
+				stdext::unchecked_mismatch
+#else
+				std::mismatch
+#endif
+#if CRYPTOPP_MSC_VERSION >= 1600
+				(stdext::make_unchecked_array_iterator(scan)+3, stdext::make_unchecked_array_iterator(scanEnd), stdext::make_unchecked_array_iterator(match)+3).first - stdext::make_unchecked_array_iterator(scan));
+#else
+				(scan+3, scanEnd, match+3).first - scan);
+#endif
+			CRYPTOPP_ASSERT(len != bestLength);
+			if (len > bestLength)
+			{
+				bestLength = len;
+				bestMatch = current;
+
+				CRYPTOPP_ASSERT(scanEnd >= scan);
+				if (len == (unsigned int)(scanEnd - scan))
+					break;
+			}
+		}
+		current = m_prev[current & DMASK];
+	}
+	return (bestMatch > 0) ? bestLength : 0;
+}
+
+inline void Deflator::InsertString(unsigned int start)
+{
+	CRYPTOPP_ASSERT(start <= 0xffff);
+	unsigned int hash = ComputeHash(m_byteBuffer + start);
+	m_prev[start & DMASK] = m_head[hash];
+	m_head[hash] = word16(start);
+}
+
+void Deflator::ProcessBuffer()
+{
+	if (!m_headerWritten)
+	{
+		WritePrestreamHeader();
+		m_headerWritten = true;
+	}
+
+	if (m_deflateLevel == 0)
+	{
+		m_stringStart += m_lookahead;
+		m_lookahead = 0;
+		m_blockLength = m_stringStart - m_blockStart;
+		m_matchAvailable = false;
+		return;
+	}
+
+	while (m_lookahead > m_minLookahead)
+	{
+		while (m_dictionaryEnd < m_stringStart && m_dictionaryEnd+3 <= m_stringStart+m_lookahead)
+			InsertString(m_dictionaryEnd++);
+
+		if (m_matchAvailable)
+		{
+			unsigned int matchPosition = 0, matchLength = 0;
+			bool usePreviousMatch;
+			if (m_previousLength >= MAX_LAZYLENGTH)
+				usePreviousMatch = true;
+			else
+			{
+				matchLength = LongestMatch(matchPosition);
+				usePreviousMatch = (matchLength == 0);
+			}
+			if (usePreviousMatch)
+			{
+				MatchFound(m_stringStart-1-m_previousMatch, m_previousLength);
+				m_stringStart += m_previousLength-1;
+				m_lookahead -= m_previousLength-1;
+				m_matchAvailable = false;
+			}
+			else
+			{
+				m_previousLength = matchLength;
+				m_previousMatch = matchPosition;
+				LiteralByte(m_byteBuffer[m_stringStart-1]);
+				m_stringStart++;
+				m_lookahead--;
+			}
+		}
+		else
+		{
+			m_previousLength = 0;
+			m_previousLength = LongestMatch(m_previousMatch);
+			if (m_previousLength)
+				m_matchAvailable = true;
+			else
+				LiteralByte(m_byteBuffer[m_stringStart]);
+			m_stringStart++;
+			m_lookahead--;
+		}
+
+		CRYPTOPP_ASSERT(m_stringStart - (m_blockStart+m_blockLength) == (unsigned int)m_matchAvailable);
+	}
+
+	if (m_minLookahead == 0 && m_matchAvailable)
+	{
+		LiteralByte(m_byteBuffer[m_stringStart-1]);
+		m_matchAvailable = false;
+	}
+}
+
+size_t Deflator::Put2(const byte *str, size_t length, int messageEnd, bool blocking)
+{
+	if (!blocking)
+		throw BlockingInputOnly("Deflator");
+
+	size_t accepted = 0;
+	while (accepted < length)
+	{
+		unsigned int newAccepted = FillWindow(str+accepted, length-accepted);
+		ProcessBuffer();
+		// call ProcessUncompressedData() after WritePrestreamHeader()
+		ProcessUncompressedData(str+accepted, newAccepted);
+		accepted += newAccepted;
+	}
+	CRYPTOPP_ASSERT(accepted == length);
+
+	if (messageEnd)
+	{
+		m_minLookahead = 0;
+		ProcessBuffer();
+		EndBlock(true);
+		FlushBitBuffer();
+		WritePoststreamTail();
+		Reset();
+	}
+
+	Output(0, NULLPTR, 0, messageEnd, blocking);
+	return 0;
+}
+
+bool Deflator::IsolatedFlush(bool hardFlush, bool blocking)
+{
+	if (!blocking)
+		throw BlockingInputOnly("Deflator");
+
+	m_minLookahead = 0;
+	ProcessBuffer();
+	m_minLookahead = MAX_MATCH;
+	EndBlock(false);
+	if (hardFlush)
+		EncodeBlock(false, STORED);
+	return false;
+}
+
+void Deflator::LiteralByte(byte b)
+{
+	if (m_matchBufferEnd == m_matchBuffer.size())
+		EndBlock(false);
+
+	m_matchBuffer[m_matchBufferEnd++].literalCode = b;
+	m_literalCounts[b]++;
+	m_blockLength++;
+}
+
+void Deflator::MatchFound(unsigned int distance, unsigned int length)
+{
+	if (m_matchBufferEnd == m_matchBuffer.size())
+		EndBlock(false);
+
+	static const unsigned int lengthCodes[] = {
+		257, 258, 259, 260, 261, 262, 263, 264, 265, 265, 266, 266, 267, 267, 268, 268,
+		269, 269, 269, 269, 270, 270, 270, 270, 271, 271, 271, 271, 272, 272, 272, 272,
+		273, 273, 273, 273, 273, 273, 273, 273, 274, 274, 274, 274, 274, 274, 274, 274,
+		275, 275, 275, 275, 275, 275, 275, 275, 276, 276, 276, 276, 276, 276, 276, 276,
+		277, 277, 277, 277, 277, 277, 277, 277, 277, 277, 277, 277, 277, 277, 277, 277,
+		278, 278, 278, 278, 278, 278, 278, 278, 278, 278, 278, 278, 278, 278, 278, 278,
+		279, 279, 279, 279, 279, 279, 279, 279, 279, 279, 279, 279, 279, 279, 279, 279,
+		280, 280, 280, 280, 280, 280, 280, 280, 280, 280, 280, 280, 280, 280, 280, 280,
+		281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281,
+		281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281, 281,
+		282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282,
+		282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, 282,
+		283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283,
+		283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283, 283,
+		284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284,
+		284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 284, 285};
+	static const unsigned int lengthBases[] =
+		{3,4,5,6,7,8,9,10,11,13,15,17,19,23,27,31,35,43,51,59,67,83,99,115,131,163,195,
+		 227,258};
+	static const unsigned int distanceBases[30] =
+		{1,2,3,4,5,7,9,13,17,25,33,49,65,97,129,193,257,385,513,769,1025,1537,2049,3073,
+		 4097,6145,8193,12289,16385,24577};
+
+	CRYPTOPP_ASSERT(m_matchBufferEnd < m_matchBuffer.size());
+	EncodedMatch &m = m_matchBuffer[m_matchBufferEnd++];
+	CRYPTOPP_ASSERT((length >= 3) && (length-3 < COUNTOF(lengthCodes)));
+	unsigned int lengthCode = lengthCodes[length-3];
+	m.literalCode = lengthCode;
+	m.literalExtra = length - lengthBases[lengthCode-257];
+	unsigned int distanceCode = (unsigned int)(std::upper_bound(distanceBases, distanceBases+30, distance) - distanceBases - 1);
+	m.distanceCode = distanceCode;
+	m.distanceExtra = distance - distanceBases[distanceCode];
+
+	m_literalCounts[lengthCode]++;
+	m_distanceCounts[distanceCode]++;
+	m_blockLength += length;
+}
+
+inline unsigned int CodeLengthEncode(const unsigned int *begin,
+									 const unsigned int *end,
+									 const unsigned int *& p,
+									 unsigned int &extraBits,
+									 unsigned int &extraBitsLength)
+{
+	unsigned int v = *p;
+	if ((end-p) >= 3)
+	{
+		const unsigned int *oldp = p;
+		if (v==0 && p[1]==0 && p[2]==0)
+		{
+			for (p=p+3; p!=end && *p==0 && p!=oldp+138; p++) {}
+			unsigned int repeat = (unsigned int)(p - oldp);
+			if (repeat <= 10)
+			{
+				extraBits = repeat-3;
+				extraBitsLength = 3;
+				return 17;
+			}
+			else
+			{
+				extraBits = repeat-11;
+				extraBitsLength = 7;
+				return 18;
+			}
+		}
+		else if (p!=begin && v==p[-1] && v==p[1] && v==p[2])
+		{
+			for (p=p+3; p!=end && *p==v && p!=oldp+6; p++) {}
+			unsigned int repeat = (unsigned int)(p - oldp);
+			extraBits = repeat-3;
+			extraBitsLength = 2;
+			return 16;
+		}
+	}
+	p++;
+	extraBits = 0;
+	extraBitsLength = 0;
+	return v;
+}
+
+void Deflator::EncodeBlock(bool eof, unsigned int blockType)
+{
+	PutBits(eof, 1);
+	PutBits(blockType, 2);
+
+	if (blockType == STORED)
+	{
+		CRYPTOPP_ASSERT(m_blockStart + m_blockLength <= m_byteBuffer.size());
+		CRYPTOPP_ASSERT(m_blockLength <= 0xffff);
+		FlushBitBuffer();
+		AttachedTransformation()->PutWord16(word16(m_blockLength), LITTLE_ENDIAN_ORDER);
+		AttachedTransformation()->PutWord16(word16(~m_blockLength), LITTLE_ENDIAN_ORDER);
+		AttachedTransformation()->Put(m_byteBuffer + m_blockStart, m_blockLength);
+	}
+	else
+	{
+		if (blockType == DYNAMIC)
+		{
+			FixedSizeSecBlock<unsigned int, 286> literalCodeLengths;
+			FixedSizeSecBlock<unsigned int, 30> distanceCodeLengths;
+
+			m_literalCounts[256] = 1;
+			HuffmanEncoder::GenerateCodeLengths(literalCodeLengths, 15, m_literalCounts, 286);
+			m_dynamicLiteralEncoder.Initialize(literalCodeLengths, 286);
+			unsigned int hlit = (unsigned int)(FindIfNot(RevIt(literalCodeLengths.end()), RevIt(literalCodeLengths.begin()+257), 0).base() - (literalCodeLengths.begin()+257));
+
+			HuffmanEncoder::GenerateCodeLengths(distanceCodeLengths, 15, m_distanceCounts, 30);
+			m_dynamicDistanceEncoder.Initialize(distanceCodeLengths, 30);
+			unsigned int hdist = (unsigned int)(FindIfNot(RevIt(distanceCodeLengths.end()), RevIt(distanceCodeLengths.begin()+1), 0).base() - (distanceCodeLengths.begin()+1));
+
+			SecBlockWithHint<unsigned int, 286+30> combinedLengths(hlit+257+hdist+1);
+			std::memcpy(combinedLengths, literalCodeLengths, (hlit+257)*sizeof(unsigned int));
+			std::memcpy(combinedLengths+hlit+257, distanceCodeLengths, (hdist+1)*sizeof(unsigned int));
+
+			FixedSizeSecBlock<unsigned int, 19> codeLengthCodeCounts, codeLengthCodeLengths;
+			std::fill(codeLengthCodeCounts.begin(), codeLengthCodeCounts.end(), 0);
+			const unsigned int *p = combinedLengths.begin(), *begin = combinedLengths.begin(), *end = combinedLengths.end();
+			while (p != end)
+			{
+				unsigned int code=0, extraBits=0, extraBitsLength=0;
+				code = CodeLengthEncode(begin, end, p, extraBits, extraBitsLength);
+				codeLengthCodeCounts[code]++;
+			}
+			HuffmanEncoder::GenerateCodeLengths(codeLengthCodeLengths, 7, codeLengthCodeCounts, 19);
+			HuffmanEncoder codeLengthEncoder(codeLengthCodeLengths, 19);
+			static const unsigned int border[] = {    // Order of the bit length code lengths
+				16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
+			unsigned int hclen = 19;
+			while (hclen > 4 && codeLengthCodeLengths[border[hclen-1]] == 0)
+				hclen--;
+			hclen -= 4;
+
+			PutBits(hlit, 5);
+			PutBits(hdist, 5);
+			PutBits(hclen, 4);
+
+			for (unsigned int i=0; i<hclen+4; i++)
+				PutBits(codeLengthCodeLengths[border[i]], 3);
+
+			p = combinedLengths.begin();
+			while (p != end)
+			{
+				unsigned int code=0, extraBits=0, extraBitsLength=0;
+				code = CodeLengthEncode(begin, end, p, extraBits, extraBitsLength);
+				codeLengthEncoder.Encode(*this, code);
+				PutBits(extraBits, extraBitsLength);
+			}
+		}
+
+		static const unsigned int lengthExtraBits[] = {
+			0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
+			3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
+		static const unsigned int distanceExtraBits[] = {
+			0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
+			7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
+			12, 12, 13, 13};
+
+		const HuffmanEncoder &literalEncoder = (blockType == STATIC) ? m_staticLiteralEncoder : m_dynamicLiteralEncoder;
+		const HuffmanEncoder &distanceEncoder = (blockType == STATIC) ? m_staticDistanceEncoder : m_dynamicDistanceEncoder;
+
+		for (unsigned int i=0; i<m_matchBufferEnd; i++)
+		{
+			unsigned int literalCode = m_matchBuffer[i].literalCode;
+			literalEncoder.Encode(*this, literalCode);
+			if (literalCode >= 257)
+			{
+				CRYPTOPP_ASSERT(literalCode <= 285);
+				PutBits(m_matchBuffer[i].literalExtra, lengthExtraBits[literalCode-257]);
+				unsigned int distanceCode = m_matchBuffer[i].distanceCode;
+				distanceEncoder.Encode(*this, distanceCode);
+				PutBits(m_matchBuffer[i].distanceExtra, distanceExtraBits[distanceCode]);
+			}
+		}
+		literalEncoder.Encode(*this, 256);	// end of block
+	}
+}
+
+void Deflator::EndBlock(bool eof)
+{
+	if (m_blockLength == 0 && !eof)
+		return;
+
+	if (m_deflateLevel == 0)
+	{
+		EncodeBlock(eof, STORED);
+
+		if (m_compressibleDeflateLevel > 0 && ++m_detectCount == m_detectSkip)
+		{
+			m_deflateLevel = m_compressibleDeflateLevel;
+			m_detectCount = 1;
+		}
+	}
+	else
+	{
+		unsigned long storedLen = 8*((unsigned long)m_blockLength+4) + RoundUpToMultipleOf(m_bitsBuffered+3, 8U)-m_bitsBuffered;
+
+		StartCounting();
+		EncodeBlock(eof, STATIC);
+		unsigned long staticLen = FinishCounting();
+
+		unsigned long dynamicLen;
+		if (m_blockLength < 128 && m_deflateLevel < 8)
+			dynamicLen = ULONG_MAX;
+		else
+		{
+			StartCounting();
+			EncodeBlock(eof, DYNAMIC);
+			dynamicLen = FinishCounting();
+		}
+
+		if (storedLen <= staticLen && storedLen <= dynamicLen)
+		{
+			EncodeBlock(eof, STORED);
+
+			if (m_compressibleDeflateLevel > 0)
+			{
+				if (m_detectSkip)
+					m_deflateLevel = 0;
+				m_detectSkip = m_detectSkip ? STDMIN(2*m_detectSkip, 128U) : 1;
+			}
+		}
+		else
+		{
+			if (staticLen <= dynamicLen)
+				EncodeBlock(eof, STATIC);
+			else
+				EncodeBlock(eof, DYNAMIC);
+
+			if (m_compressibleDeflateLevel > 0)
+				m_detectSkip = 0;
+		}
+	}
+
+	m_matchBufferEnd = 0;
+	m_blockStart += m_blockLength;
+	m_blockLength = 0;
+	std::fill(m_literalCounts.begin(), m_literalCounts.end(), 0);
+	std::fill(m_distanceCounts.begin(), m_distanceCounts.end(), 0);
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/zdeflate.h b/runtime/third_party/cryptopp/zdeflate.h
new file mode 100644
index 0000000..36ae33c
--- /dev/null
+++ b/runtime/third_party/cryptopp/zdeflate.h
@@ -0,0 +1,174 @@
+// zdeflate.h - originally written and placed in the public domain by Wei Dai
+
+/// \file zdeflate.h
+/// \brief DEFLATE compression and decompression (RFC 1951)
+
+#ifndef CRYPTOPP_ZDEFLATE_H
+#define CRYPTOPP_ZDEFLATE_H
+
+#include "cryptlib.h"
+#include "filters.h"
+#include "misc.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \brief Encoding table writer
+/// \since Crypto++ 1.0
+class LowFirstBitWriter : public Filter
+{
+public:
+	/// \brief Construct a LowFirstBitWriter
+	/// \param attachment an attached transformation
+	LowFirstBitWriter(BufferedTransformation *attachment);
+
+	void PutBits(unsigned long value, unsigned int length);
+	void FlushBitBuffer();
+	void ClearBitBuffer();
+
+	void StartCounting();
+	unsigned long FinishCounting();
+
+protected:
+	bool m_counting;
+	unsigned long m_bitCount;
+	unsigned long m_buffer;
+	unsigned int m_bitsBuffered, m_bytesBuffered;
+	FixedSizeSecBlock<byte, 256> m_outputBuffer;
+};
+
+/// \brief Huffman Encoder
+/// \since Crypto++ 1.0
+class HuffmanEncoder
+{
+public:
+	typedef unsigned int code_t;
+	typedef unsigned int value_t;
+
+	/// \brief Construct a HuffmanEncoder
+	HuffmanEncoder() {}
+
+	/// \brief Construct a HuffmanEncoder
+	/// \param codeBits a table of code bits
+	/// \param nCodes the number of codes in the table
+	HuffmanEncoder(const unsigned int *codeBits, unsigned int nCodes);
+
+	/// \brief Initialize or reinitialize this object
+	/// \param codeBits a table of code bits
+	/// \param nCodes the number of codes in the table
+	void Initialize(const unsigned int *codeBits, unsigned int nCodes);
+
+	static void GenerateCodeLengths(unsigned int *codeBits, unsigned int maxCodeBits, const unsigned int *codeCounts, size_t nCodes);
+
+	void Encode(LowFirstBitWriter &writer, value_t value) const;
+
+	struct Code
+	{
+		unsigned int code;
+		unsigned int len;
+	};
+
+	SecBlock<Code> m_valueToCode;
+};
+
+/// \brief DEFLATE compressor (RFC 1951)
+/// \since Crypto++ 1.0
+class Deflator : public LowFirstBitWriter
+{
+public:
+	/// \brief Deflate level as enumerated values.
+	enum {
+		/// \brief Minimum deflation level, fastest speed (0)
+		MIN_DEFLATE_LEVEL = 0,
+		/// \brief Default deflation level, compromise between speed (6)
+		DEFAULT_DEFLATE_LEVEL = 6,
+		/// \brief Minimum deflation level, slowest speed (9)
+		MAX_DEFLATE_LEVEL = 9};
+
+	/// \brief Windows size as enumerated values.
+	enum {
+		/// \brief Minimum window size, smallest table (9)
+		MIN_LOG2_WINDOW_SIZE = 9,
+		/// \brief Default window size (15)
+		DEFAULT_LOG2_WINDOW_SIZE = 15,
+		/// \brief Maximum window size, largest table (15)
+		MAX_LOG2_WINDOW_SIZE = 15};
+
+	/// \brief Construct a Deflator compressor
+	/// \param attachment an attached transformation
+	/// \param deflateLevel the deflate level
+	/// \param log2WindowSize the window size
+	/// \param detectUncompressible flag to detect if data is compressible
+	/// \details detectUncompressible makes it faster to process uncompressible files, but
+	///   if a file has both compressible and uncompressible parts, it may fail to compress
+	///   some of the compressible parts.
+	Deflator(BufferedTransformation *attachment=NULLPTR, int deflateLevel=DEFAULT_DEFLATE_LEVEL, int log2WindowSize=DEFAULT_LOG2_WINDOW_SIZE, bool detectUncompressible=true);
+	/// \brief Construct a Deflator compressor
+	/// \param parameters a set of NameValuePairs to initialize this object
+	/// \param attachment an attached transformation
+	/// \details Possible parameter names: Log2WindowSize, DeflateLevel, DetectUncompressible
+	Deflator(const NameValuePairs &parameters, BufferedTransformation *attachment=NULLPTR);
+
+	/// \brief Sets the deflation level
+	/// \param deflateLevel the level of deflation
+	/// \details SetDeflateLevel can be used to set the deflate level in the middle of compression
+	void SetDeflateLevel(int deflateLevel);
+
+	/// \brief Retrieves the deflation level
+	/// \return the level of deflation
+	int GetDeflateLevel() const {return m_deflateLevel;}
+
+	/// \brief Retrieves the window size
+	/// \return the windows size
+	int GetLog2WindowSize() const {return m_log2WindowSize;}
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+	bool IsolatedFlush(bool hardFlush, bool blocking);
+
+protected:
+	virtual void WritePrestreamHeader() {}
+	virtual void ProcessUncompressedData(const byte *string, size_t length)
+		{CRYPTOPP_UNUSED(string), CRYPTOPP_UNUSED(length);}
+	virtual void WritePoststreamTail() {}
+
+	enum {STORED = 0, STATIC = 1, DYNAMIC = 2};
+	enum {MIN_MATCH = 3, MAX_MATCH = 258};
+
+	void InitializeStaticEncoders();
+	void Reset(bool forceReset = false);
+	unsigned int FillWindow(const byte *str, size_t length);
+	unsigned int ComputeHash(const byte *str) const;
+	unsigned int LongestMatch(unsigned int &bestMatch) const;
+	void InsertString(unsigned int start);
+	void ProcessBuffer();
+
+	void LiteralByte(byte b);
+	void MatchFound(unsigned int distance, unsigned int length);
+	void EncodeBlock(bool eof, unsigned int blockType);
+	void EndBlock(bool eof);
+
+	struct EncodedMatch
+	{
+		unsigned literalCode : 9;
+		unsigned literalExtra : 5;
+		unsigned distanceCode : 5;
+		unsigned distanceExtra : 13;
+	};
+
+	int m_deflateLevel, m_log2WindowSize, m_compressibleDeflateLevel;
+	unsigned int m_detectSkip, m_detectCount;
+	unsigned int DSIZE, DMASK, HSIZE, HMASK, GOOD_MATCH, MAX_LAZYLENGTH, MAX_CHAIN_LENGTH;
+	bool m_headerWritten, m_matchAvailable;
+	unsigned int m_dictionaryEnd, m_stringStart, m_lookahead, m_minLookahead, m_previousMatch, m_previousLength;
+	HuffmanEncoder m_staticLiteralEncoder, m_staticDistanceEncoder, m_dynamicLiteralEncoder, m_dynamicDistanceEncoder;
+	SecByteBlock m_byteBuffer;
+	SecBlock<word16> m_head, m_prev;
+	FixedSizeSecBlock<unsigned int, 286> m_literalCounts;
+	FixedSizeSecBlock<unsigned int, 30> m_distanceCounts;
+	SecBlock<EncodedMatch> m_matchBuffer;
+	unsigned int m_matchBufferEnd, m_blockStart, m_blockLength;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/zinflate.cpp b/runtime/third_party/cryptopp/zinflate.cpp
new file mode 100644
index 0000000..6ac792c
--- /dev/null
+++ b/runtime/third_party/cryptopp/zinflate.cpp
@@ -0,0 +1,662 @@
+// zinflate.cpp - originally written and placed in the public domain by Wei Dai
+
+// This is a complete reimplementation of the DEFLATE decompression algorithm.
+// It should not be affected by any security vulnerabilities in the zlib
+// compression library. In particular it is not affected by the double free bug
+// (http://www.kb.cert.org/vuls/id/368819).
+
+#include "pch.h"
+
+#include "zinflate.h"
+#include "secblock.h"
+#include "smartptr.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+struct CodeLessThan
+{
+	inline bool operator()(CryptoPP::HuffmanDecoder::code_t lhs, const CryptoPP::HuffmanDecoder::CodeInfo &rhs)
+		{return lhs < rhs.code;}
+	// needed for MSVC .NET 2005
+	inline bool operator()(const CryptoPP::HuffmanDecoder::CodeInfo &lhs, const CryptoPP::HuffmanDecoder::CodeInfo &rhs)
+		{return lhs.code < rhs.code;}
+};
+
+inline bool LowFirstBitReader::FillBuffer(unsigned int length)
+{
+	while (m_bitsBuffered < length)
+	{
+		byte b;
+		if (!m_store.Get(b))
+			return false;
+		m_buffer |= (unsigned long)b << m_bitsBuffered;
+		m_bitsBuffered += 8;
+	}
+	CRYPTOPP_ASSERT(m_bitsBuffered <= sizeof(unsigned long)*8);
+	return true;
+}
+
+inline unsigned long LowFirstBitReader::PeekBits(unsigned int length)
+{
+	bool result = FillBuffer(length);
+	CRYPTOPP_UNUSED(result); CRYPTOPP_ASSERT(result);
+	return m_buffer & (((unsigned long)1 << length) - 1);
+}
+
+inline void LowFirstBitReader::SkipBits(unsigned int length)
+{
+	CRYPTOPP_ASSERT(m_bitsBuffered >= length);
+	m_buffer >>= length;
+	m_bitsBuffered -= length;
+}
+
+inline unsigned long LowFirstBitReader::GetBits(unsigned int length)
+{
+	unsigned long result = PeekBits(length);
+	SkipBits(length);
+	return result;
+}
+
+inline HuffmanDecoder::code_t HuffmanDecoder::NormalizeCode(HuffmanDecoder::code_t code, unsigned int codeBits)
+{
+	return code << (MAX_CODE_BITS - codeBits);
+}
+
+void HuffmanDecoder::Initialize(const unsigned int *codeBits, unsigned int nCodes)
+{
+	// the Huffman codes are represented in 3 ways in this code:
+	//
+	// 1. most significant code bit (i.e. top of code tree) in the least significant bit position
+	// 2. most significant code bit (i.e. top of code tree) in the most significant bit position
+	// 3. most significant code bit (i.e. top of code tree) in n-th least significant bit position,
+	//    where n is the maximum code length for this code tree
+	//
+	// (1) is the way the codes come in from the deflate stream
+	// (2) is used to sort codes so they can be binary searched
+	// (3) is used in this function to compute codes from code lengths
+	//
+	// a code in representation (2) is called "normalized" here
+	// The BitReverse() function is used to convert between (1) and (2)
+	// The NormalizeCode() function is used to convert from (3) to (2)
+
+	if (nCodes == 0)
+		throw Err("null code");
+
+	m_maxCodeBits = *std::max_element(codeBits, codeBits+nCodes);
+
+	if (m_maxCodeBits > MAX_CODE_BITS)
+		throw Err("code length exceeds maximum");
+
+	if (m_maxCodeBits == 0)
+		throw Err("null code");
+
+	// count number of codes of each length
+	SecBlockWithHint<unsigned int, 15+1> blCount(m_maxCodeBits+1);
+	std::fill(blCount.begin(), blCount.end(), 0);
+	unsigned int i;
+	for (i=0; i<nCodes; i++)
+		blCount[codeBits[i]]++;
+
+	// compute the starting code of each length
+	code_t code = 0;
+	SecBlockWithHint<code_t, 15+1> nextCode(m_maxCodeBits+1);
+	nextCode[1] = 0;
+	for (i=2; i<=m_maxCodeBits; i++)
+	{
+		// compute this while checking for overflow: code = (code + blCount[i-1]) << 1
+		if (code > code + blCount[i-1])
+			throw Err("codes oversubscribed");
+		code += blCount[i-1];
+		if (code > (code << 1))
+			throw Err("codes oversubscribed");
+		code <<= 1;
+		nextCode[i] = code;
+	}
+
+	// MAX_CODE_BITS is 32, m_maxCodeBits may be smaller.
+	const word64 shiftedMaxCode = ((word64)1 << m_maxCodeBits);
+	if (code > shiftedMaxCode - blCount[m_maxCodeBits])
+		throw Err("codes oversubscribed");
+	else if (m_maxCodeBits != 1 && code < shiftedMaxCode - blCount[m_maxCodeBits])
+		throw Err("codes incomplete");
+
+	// compute a vector of <code, length, value> triples sorted by code
+	m_codeToValue.resize(nCodes - blCount[0]);
+	unsigned int j=0;
+	for (i=0; i<nCodes; i++)
+	{
+		unsigned int len = codeBits[i];
+		if (len != 0)
+		{
+			CRYPTOPP_ASSERT(j < m_codeToValue.size());
+			code = NormalizeCode(nextCode[len]++, len);
+			m_codeToValue[j].code = code;
+			m_codeToValue[j].len = len;
+			m_codeToValue[j].value = i;
+			j++;
+		}
+	}
+	std::sort(m_codeToValue.begin(), m_codeToValue.end());
+
+	// initialize the decoding cache
+	m_cacheBits = STDMIN(9U, m_maxCodeBits);
+	m_cacheMask = (1 << m_cacheBits) - 1;
+	m_normalizedCacheMask = NormalizeCode(m_cacheMask, m_cacheBits);
+	CRYPTOPP_ASSERT(m_normalizedCacheMask == BitReverse(m_cacheMask));
+
+	const word64 shiftedCache = ((word64)1 << m_cacheBits);
+	CRYPTOPP_ASSERT(shiftedCache <= SIZE_MAX);
+	if (m_cache.size() != shiftedCache)
+		m_cache.resize((size_t)shiftedCache);
+
+	for (i=0; i<m_cache.size(); i++)
+		m_cache[i].type = 0;
+}
+
+void HuffmanDecoder::FillCacheEntry(LookupEntry &entry, code_t normalizedCode) const
+{
+	normalizedCode &= m_normalizedCacheMask;
+	const CodeInfo &codeInfo = *(std::upper_bound(m_codeToValue.begin(), m_codeToValue.end(), normalizedCode, CodeLessThan())-1);
+	if (codeInfo.len <= m_cacheBits)
+	{
+		entry.type = 1;
+		entry.value = codeInfo.value;
+		entry.len = codeInfo.len;
+	}
+	else
+	{
+		entry.begin = &codeInfo;
+		const CodeInfo *last = & *(std::upper_bound(m_codeToValue.begin(), m_codeToValue.end(), normalizedCode + ~m_normalizedCacheMask, CodeLessThan())-1);
+		if (codeInfo.len == last->len)
+		{
+			entry.type = 2;
+			entry.len = codeInfo.len;
+		}
+		else
+		{
+			entry.type = 3;
+			entry.end = last+1;
+		}
+	}
+}
+
+inline unsigned int HuffmanDecoder::Decode(code_t code, /* out */ value_t &value) const
+{
+	CRYPTOPP_ASSERT(((int)(code & m_cacheMask)) < (int)m_cache.size());
+	LookupEntry &entry = m_cache[code & m_cacheMask];
+
+	code_t normalizedCode = 0;
+	if (entry.type != 1)
+		normalizedCode = BitReverse(code);
+
+	if (entry.type == 0)
+		FillCacheEntry(entry, normalizedCode);
+
+	if (entry.type == 1)
+	{
+		value = entry.value;
+		return entry.len;
+	}
+	else
+	{
+		const CodeInfo &codeInfo = (entry.type == 2)
+			? entry.begin[(normalizedCode << m_cacheBits) >> (MAX_CODE_BITS - (entry.len - m_cacheBits))]
+			: *(std::upper_bound(entry.begin, entry.end, normalizedCode, CodeLessThan())-1);
+		value = codeInfo.value;
+		return codeInfo.len;
+	}
+}
+
+bool HuffmanDecoder::Decode(LowFirstBitReader &reader, value_t &value) const
+{
+	bool result = reader.FillBuffer(m_maxCodeBits);
+	CRYPTOPP_UNUSED(result); // CRYPTOPP_ASSERT(result);
+
+	unsigned int codeBits = Decode(reader.PeekBuffer(), value);
+	if (codeBits > reader.BitsBuffered())
+		return false;
+	reader.SkipBits(codeBits);
+	return true;
+}
+
+// *************************************************************
+
+Inflator::Inflator(BufferedTransformation *attachment, bool repeat, int propagation)
+	: AutoSignaling<Filter>(propagation)
+	, m_state(PRE_STREAM), m_repeat(repeat), m_eof(0), m_wrappedAround(0)
+	, m_blockType(0xff), m_storedLen(0xffff), m_nextDecode(), m_literal(0)
+	, m_distance(0), m_reader(m_inQueue), m_current(0), m_lastFlush(0)
+{
+	Detach(attachment);
+}
+
+void Inflator::IsolatedInitialize(const NameValuePairs &parameters)
+{
+	m_state = PRE_STREAM;
+	parameters.GetValue("Repeat", m_repeat);
+	m_inQueue.Clear();
+	m_reader.SkipBits(m_reader.BitsBuffered());
+}
+
+void Inflator::OutputByte(byte b)
+{
+	m_window[m_current++] = b;
+	if (m_current == m_window.size())
+	{
+		ProcessDecompressedData(m_window + m_lastFlush, m_window.size() - m_lastFlush);
+		m_lastFlush = 0;
+		m_current = 0;
+		m_wrappedAround = true;
+	}
+}
+
+void Inflator::OutputString(const byte *string, size_t length)
+{
+	while (length)
+	{
+		size_t len = UnsignedMin(length, m_window.size() - m_current);
+		std::memcpy(m_window + m_current, string, len);
+		m_current += len;
+		if (m_current == m_window.size())
+		{
+			ProcessDecompressedData(m_window + m_lastFlush, m_window.size() - m_lastFlush);
+			m_lastFlush = 0;
+			m_current = 0;
+			m_wrappedAround = true;
+		}
+		string += len;
+		length -= len;
+	}
+}
+
+void Inflator::OutputPast(unsigned int length, unsigned int distance)
+{
+	size_t start;
+	if (distance <= m_current)
+		start = m_current - distance;
+	else if (m_wrappedAround && distance <= m_window.size())
+		start = m_current + m_window.size() - distance;
+	else
+		throw BadBlockErr();
+
+	if (start + length > m_window.size())
+	{
+		for (; start < m_window.size(); start++, length--)
+			OutputByte(m_window[start]);
+		start = 0;
+	}
+
+	if (start + length > m_current || m_current + length >= m_window.size())
+	{
+		while (length--)
+			OutputByte(m_window[start++]);
+	}
+	else
+	{
+		std::memcpy(m_window + m_current, m_window + start, length);
+		m_current += length;
+	}
+}
+
+size_t Inflator::Put2(const byte *inString, size_t length, int messageEnd, bool blocking)
+{
+	if (!blocking)
+		throw BlockingInputOnly("Inflator");
+
+	LazyPutter lp(m_inQueue, inString, length);
+	ProcessInput(messageEnd != 0);
+
+	if (messageEnd)
+		if (!(m_state == PRE_STREAM || m_state == AFTER_END))
+			throw UnexpectedEndErr();
+
+	Output(0, NULLPTR, 0, messageEnd, blocking);
+	return 0;
+}
+
+bool Inflator::IsolatedFlush(bool hardFlush, bool blocking)
+{
+	if (!blocking)
+		throw BlockingInputOnly("Inflator");
+
+	if (hardFlush)
+		ProcessInput(true);
+	FlushOutput();
+
+	return false;
+}
+
+void Inflator::ProcessInput(bool flush)
+{
+	while (true)
+	{
+		switch (m_state)
+		{
+		case PRE_STREAM:
+			if (!flush && m_inQueue.CurrentSize() < MaxPrestreamHeaderSize())
+				return;
+			ProcessPrestreamHeader();
+			m_state = WAIT_HEADER;
+			m_wrappedAround = false;
+			m_current = 0;
+			m_lastFlush = 0;
+			m_window.New(((size_t) 1) << GetLog2WindowSize());
+			break;
+		case WAIT_HEADER:
+			{
+			// maximum number of bytes before actual compressed data starts
+			const size_t MAX_HEADER_SIZE = BitsToBytes(3+5+5+4+19*7+286*15+19*15);
+			if (m_inQueue.CurrentSize() < (flush ? 1 : MAX_HEADER_SIZE))
+				return;
+			DecodeHeader();
+			break;
+			}
+		case DECODING_BODY:
+			if (!DecodeBody())
+				return;
+			break;
+		case POST_STREAM:
+			if (!flush && m_inQueue.CurrentSize() < MaxPoststreamTailSize())
+				return;
+			ProcessPoststreamTail();
+			m_state = m_repeat ? PRE_STREAM : AFTER_END;
+			Output(0, NULLPTR, 0, GetAutoSignalPropagation(), true);	// TODO: non-blocking
+			if (m_inQueue.IsEmpty())
+				return;
+			break;
+		case AFTER_END:
+			m_inQueue.TransferTo(*AttachedTransformation());
+			return;
+		}
+	}
+}
+
+void Inflator::DecodeHeader()
+{
+	if (!m_reader.FillBuffer(3))
+		throw UnexpectedEndErr();
+	m_eof = m_reader.GetBits(1) != 0;
+	m_blockType = (byte)m_reader.GetBits(2);
+
+	switch (m_blockType)
+	{
+	case 0:	// stored
+		{
+		m_reader.SkipBits(m_reader.BitsBuffered() % 8);
+		if (!m_reader.FillBuffer(32))
+			throw UnexpectedEndErr();
+		m_storedLen = (word16)m_reader.GetBits(16);
+		word16 nlen = (word16)m_reader.GetBits(16);
+		if (nlen != (word16)~m_storedLen)
+			throw BadBlockErr();
+		break;
+		}
+	case 1:	// fixed codes
+		m_nextDecode = LITERAL;
+		break;
+	case 2:	// dynamic codes
+		{
+		if (!m_reader.FillBuffer(5+5+4))
+			throw UnexpectedEndErr();
+		unsigned int hlit = m_reader.GetBits(5);
+		unsigned int hdist = m_reader.GetBits(5);
+		unsigned int hclen = m_reader.GetBits(4);
+		unsigned int i = 0;
+
+		FixedSizeSecBlock<unsigned int, 286+32> codeLengths;
+		static const unsigned int border[] = {    // Order of the bit length code lengths
+			16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
+		std::fill(codeLengths.begin(), codeLengths+19, 0);
+		for (i=0; i<hclen+4; ++i)
+		{
+			CRYPTOPP_ASSERT(border[i] < codeLengths.size());
+			codeLengths[border[i]] = m_reader.GetBits(3);
+		}
+
+		try
+		{
+			bool result = false;
+			unsigned int k=0, count=0, repeater=0;
+			HuffmanDecoder codeLengthDecoder(codeLengths, 19);
+			for (i=0; i < hlit+257+hdist+1; )
+			{
+				k = 0, count = 0, repeater = 0;
+				result = codeLengthDecoder.Decode(m_reader, k);
+				if (!result)
+					throw UnexpectedEndErr();
+				if (k <= 15)
+				{
+					count = 1;
+					repeater = k;
+				}
+				else switch (k)
+				{
+				case 16:
+					if (!m_reader.FillBuffer(2))
+						throw UnexpectedEndErr();
+					count = 3 + m_reader.GetBits(2);
+					if (i == 0)
+						throw BadBlockErr();
+					repeater = codeLengths[i-1];
+					break;
+				case 17:
+					if (!m_reader.FillBuffer(3))
+						throw UnexpectedEndErr();
+					count = 3 + m_reader.GetBits(3);
+					repeater = 0;
+					break;
+				case 18:
+					if (!m_reader.FillBuffer(7))
+						throw UnexpectedEndErr();
+					count = 11 + m_reader.GetBits(7);
+					repeater = 0;
+					break;
+				}
+				if (i + count > hlit+257+hdist+1)
+					throw BadBlockErr();
+				std::fill(codeLengths + i, codeLengths + i + count, repeater);
+				i += count;
+			}
+			m_dynamicLiteralDecoder.Initialize(codeLengths, hlit+257);
+			if (hdist == 0 && codeLengths[hlit+257] == 0)
+			{
+				if (hlit != 0)	// a single zero distance code length means all literals
+					throw BadBlockErr();
+			}
+			else
+				m_dynamicDistanceDecoder.Initialize(codeLengths+hlit+257, hdist+1);
+			m_nextDecode = LITERAL;
+		}
+		catch (HuffmanDecoder::Err &)
+		{
+			throw BadBlockErr();
+		}
+		break;
+		}
+	default:
+		throw BadBlockErr();	// reserved block type
+	}
+	m_state = DECODING_BODY;
+}
+
+bool Inflator::DecodeBody()
+{
+	bool blockEnd = false;
+	switch (m_blockType)
+	{
+	case 0:	// stored
+		CRYPTOPP_ASSERT(m_reader.BitsBuffered() == 0);
+		while (!m_inQueue.IsEmpty() && !blockEnd)
+		{
+			size_t size;
+			const byte *block = m_inQueue.Spy(size);
+			size = UnsignedMin(m_storedLen, size);
+			CRYPTOPP_ASSERT(size <= 0xffff);
+
+			OutputString(block, size);
+			m_inQueue.Skip(size);
+			m_storedLen = m_storedLen - (word16)size;
+			if (m_storedLen == 0)
+				blockEnd = true;
+		}
+		break;
+	case 1:	// fixed codes
+	case 2:	// dynamic codes
+		static const unsigned int lengthStarts[] = {
+			3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
+			35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
+		static const unsigned int lengthExtraBits[] = {
+			0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
+			3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
+		static const unsigned int distanceStarts[] = {
+			1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
+			257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
+			8193, 12289, 16385, 24577};
+		static const unsigned int distanceExtraBits[] = {
+			0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
+			7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
+			12, 12, 13, 13};
+
+		const HuffmanDecoder& literalDecoder = GetLiteralDecoder();
+		const HuffmanDecoder& distanceDecoder = GetDistanceDecoder();
+
+		switch (m_nextDecode)
+		{
+		case LITERAL:
+			while (true)
+			{
+				if (!literalDecoder.Decode(m_reader, m_literal))
+				{
+					m_nextDecode = LITERAL;
+					break;
+				}
+				if (m_literal < 256)
+					OutputByte((byte)m_literal);
+				else if (m_literal == 256)	// end of block
+				{
+					blockEnd = true;
+					break;
+				}
+				else
+				{
+					if (m_literal > 285)
+						throw BadBlockErr();
+					unsigned int bits;
+		case LENGTH_BITS:
+					CRYPTOPP_ASSERT(m_literal-257 < COUNTOF(lengthExtraBits));
+					bits = lengthExtraBits[m_literal-257];
+					if (!m_reader.FillBuffer(bits))
+					{
+						m_nextDecode = LENGTH_BITS;
+						break;
+					}
+					CRYPTOPP_ASSERT(m_literal-257 < COUNTOF(lengthStarts));
+					m_literal = m_reader.GetBits(bits) + lengthStarts[m_literal-257];
+		case DISTANCE:
+					if (!distanceDecoder.Decode(m_reader, m_distance))
+					{
+						m_nextDecode = DISTANCE;
+						break;
+					}
+		case DISTANCE_BITS:
+					CRYPTOPP_ASSERT(m_distance < COUNTOF(distanceExtraBits));
+					if (m_distance >= COUNTOF(distanceExtraBits))
+						throw BadDistanceErr();
+					bits = distanceExtraBits[m_distance];
+					if (!m_reader.FillBuffer(bits))
+					{
+						m_nextDecode = DISTANCE_BITS;
+						break;
+					}
+					CRYPTOPP_ASSERT(m_distance < COUNTOF(distanceStarts));
+					if (m_distance >= COUNTOF(distanceStarts))
+						throw BadDistanceErr();
+					m_distance = m_reader.GetBits(bits) + distanceStarts[m_distance];
+					OutputPast(m_literal, m_distance);
+				}
+			}
+			break;
+		default:
+			CRYPTOPP_ASSERT(0);
+		}
+	}
+	if (blockEnd)
+	{
+		if (m_eof)
+		{
+			FlushOutput();
+			m_reader.SkipBits(m_reader.BitsBuffered()%8);
+			if (m_reader.BitsBuffered())
+			{
+				// undo too much lookahead
+				SecBlockWithHint<byte, 4> buffer(m_reader.BitsBuffered() / 8);
+				for (unsigned int i=0; i<buffer.size(); i++)
+					buffer[i] = (byte)m_reader.GetBits(8);
+				m_inQueue.Unget(buffer, buffer.size());
+			}
+			m_state = POST_STREAM;
+		}
+		else
+			m_state = WAIT_HEADER;
+	}
+	return blockEnd;
+}
+
+void Inflator::FlushOutput()
+{
+	if (m_state != PRE_STREAM)
+	{
+		CRYPTOPP_ASSERT(m_current >= m_lastFlush);
+		ProcessDecompressedData(m_window + m_lastFlush, m_current - m_lastFlush);
+		m_lastFlush = m_current;
+	}
+}
+
+void Inflator::CreateFixedLiteralDecoder()
+{
+	unsigned int codeLengths[288];
+	std::fill(codeLengths + 0, codeLengths + 144, 8);
+	std::fill(codeLengths + 144, codeLengths + 256, 9);
+	std::fill(codeLengths + 256, codeLengths + 280, 7);
+	std::fill(codeLengths + 280, codeLengths + 288, 8);
+	m_fixedLiteralDecoder.reset(new HuffmanDecoder);
+	m_fixedLiteralDecoder->Initialize(codeLengths, 288);
+}
+
+void Inflator::CreateFixedDistanceDecoder()
+{
+	unsigned int codeLengths[32];
+	std::fill(codeLengths + 0, codeLengths + 32, 5);
+	m_fixedDistanceDecoder.reset(new HuffmanDecoder);
+	m_fixedDistanceDecoder->Initialize(codeLengths, 32);
+}
+
+const HuffmanDecoder& Inflator::GetLiteralDecoder()
+{
+	if (m_blockType == 1)
+	{
+		if (m_fixedLiteralDecoder.get() == NULLPTR)
+			CreateFixedLiteralDecoder();
+		return *m_fixedLiteralDecoder;
+	}
+	else
+	{
+		return m_dynamicLiteralDecoder;
+	}
+}
+
+const HuffmanDecoder& Inflator::GetDistanceDecoder()
+{
+	if (m_blockType == 1)
+	{
+		if (m_fixedDistanceDecoder.get() == NULLPTR)
+			CreateFixedDistanceDecoder();
+		return *m_fixedDistanceDecoder;
+	}
+	else
+	{
+		return m_dynamicDistanceDecoder;
+	}
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/zinflate.h b/runtime/third_party/cryptopp/zinflate.h
new file mode 100644
index 0000000..db9b942
--- /dev/null
+++ b/runtime/third_party/cryptopp/zinflate.h
@@ -0,0 +1,164 @@
+// zinflate.h - originally written and placed in the public domain by Wei Dai
+
+/// \file zinflate.h
+/// \brief DEFLATE compression and decompression (RFC 1951)
+
+#ifndef CRYPTOPP_ZINFLATE_H
+#define CRYPTOPP_ZINFLATE_H
+
+#include "cryptlib.h"
+#include "secblock.h"
+#include "filters.h"
+#include "stdcpp.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// \since Crypto++ 1.0
+class LowFirstBitReader
+{
+public:
+	LowFirstBitReader(BufferedTransformation &store)
+		: m_store(store), m_buffer(0), m_bitsBuffered(0) {}
+	unsigned int BitsBuffered() const {return m_bitsBuffered;}
+	unsigned long PeekBuffer() const {return m_buffer;}
+	bool FillBuffer(unsigned int length);
+	unsigned long PeekBits(unsigned int length);
+	void SkipBits(unsigned int length);
+	unsigned long GetBits(unsigned int length);
+
+private:
+	BufferedTransformation &m_store;
+	unsigned long m_buffer;
+	unsigned int m_bitsBuffered;
+};
+
+struct CodeLessThan;
+
+/// \brief Huffman Decoder
+/// \since Crypto++ 1.0
+class HuffmanDecoder
+{
+public:
+	typedef unsigned int code_t;
+	typedef unsigned int value_t;
+	enum {MAX_CODE_BITS = sizeof(code_t)*8};
+
+	class Err : public Exception {public: Err(const std::string &what) : Exception(INVALID_DATA_FORMAT, "HuffmanDecoder: " + what) {}};
+
+	HuffmanDecoder() : m_maxCodeBits(0), m_cacheBits(0), m_cacheMask(0), m_normalizedCacheMask(0) {}
+	HuffmanDecoder(const unsigned int *codeBitLengths, unsigned int nCodes)
+		: m_maxCodeBits(0), m_cacheBits(0), m_cacheMask(0), m_normalizedCacheMask(0)
+			{Initialize(codeBitLengths, nCodes);}
+
+	void Initialize(const unsigned int *codeBitLengths, unsigned int nCodes);
+	unsigned int Decode(code_t code, /* out */ value_t &value) const;
+	bool Decode(LowFirstBitReader &reader, value_t &value) const;
+
+private:
+	friend struct CodeLessThan;
+
+	struct CodeInfo
+	{
+		CodeInfo(code_t code=0, unsigned int len=0, value_t value=0) : code(code), len(len), value(value) {}
+		inline bool operator<(const CodeInfo &rhs) const {return code < rhs.code;}
+		code_t code;
+		unsigned int len;
+		value_t value;
+	};
+
+	struct LookupEntry
+	{
+		unsigned int type;
+		union
+		{
+			value_t value;
+			const CodeInfo *begin;
+		};
+		union
+		{
+			unsigned int len;
+			const CodeInfo *end;
+		};
+	};
+
+	static code_t NormalizeCode(code_t code, unsigned int codeBits);
+	void FillCacheEntry(LookupEntry &entry, code_t normalizedCode) const;
+
+	unsigned int m_maxCodeBits, m_cacheBits, m_cacheMask, m_normalizedCacheMask;
+	std::vector<CodeInfo, AllocatorWithCleanup<CodeInfo> > m_codeToValue;
+	mutable std::vector<LookupEntry, AllocatorWithCleanup<LookupEntry> > m_cache;
+};
+
+/// \brief DEFLATE decompressor (RFC 1951)
+/// \since Crypto++ 1.0
+class Inflator : public AutoSignaling<Filter>
+{
+public:
+	class Err : public Exception
+	{
+	public:
+		Err(ErrorType e, const std::string &s)
+			: Exception(e, s) {}
+	};
+	/// \brief Exception thrown when a truncated stream is encountered
+	class UnexpectedEndErr : public Err {public: UnexpectedEndErr() : Err(INVALID_DATA_FORMAT, "Inflator: unexpected end of compressed block") {}};
+	/// \brief Exception thrown when a bad block is encountered
+	class BadBlockErr : public Err {public: BadBlockErr() : Err(INVALID_DATA_FORMAT, "Inflator: error in compressed block") {}};
+	/// \brief Exception thrown when an invalid distance is encountered
+	class BadDistanceErr : public Err {public: BadDistanceErr() : Err(INVALID_DATA_FORMAT, "Inflator: error in bit distance") {}};
+
+	/// \brief RFC 1951 Decompressor
+	/// \param attachment the filter's attached transformation
+	/// \param repeat decompress multiple compressed streams in series
+	/// \param autoSignalPropagation 0 to turn off MessageEnd signal
+	Inflator(BufferedTransformation *attachment = NULLPTR, bool repeat = false, int autoSignalPropagation = -1);
+
+	void IsolatedInitialize(const NameValuePairs &parameters);
+	size_t Put2(const byte *inString, size_t length, int messageEnd, bool blocking);
+	bool IsolatedFlush(bool hardFlush, bool blocking);
+
+	virtual unsigned int GetLog2WindowSize() const {return 15;}
+
+protected:
+	ByteQueue m_inQueue;
+
+private:
+	virtual unsigned int MaxPrestreamHeaderSize() const {return 0;}
+	virtual void ProcessPrestreamHeader() {}
+	virtual void ProcessDecompressedData(const byte *string, size_t length)
+		{AttachedTransformation()->Put(string, length);}
+	virtual unsigned int MaxPoststreamTailSize() const {return 0;}
+	virtual void ProcessPoststreamTail() {}
+
+	void ProcessInput(bool flush);
+	void DecodeHeader();
+	bool DecodeBody();
+	void FlushOutput();
+	void OutputByte(byte b);
+	void OutputString(const byte *string, size_t length);
+	void OutputPast(unsigned int length, unsigned int distance);
+
+	void CreateFixedDistanceDecoder();
+	void CreateFixedLiteralDecoder();
+
+	const HuffmanDecoder& GetLiteralDecoder();
+	const HuffmanDecoder& GetDistanceDecoder();
+
+	enum State {PRE_STREAM, WAIT_HEADER, DECODING_BODY, POST_STREAM, AFTER_END};
+	State m_state;
+	bool m_repeat, m_eof, m_wrappedAround;
+	byte m_blockType;
+	word16 m_storedLen;
+	enum NextDecode {LITERAL, LENGTH_BITS, DISTANCE, DISTANCE_BITS};
+	NextDecode m_nextDecode;
+	unsigned int m_literal, m_distance;	// for LENGTH_BITS or DISTANCE_BITS
+	HuffmanDecoder m_dynamicLiteralDecoder, m_dynamicDistanceDecoder;
+	member_ptr<HuffmanDecoder> m_fixedLiteralDecoder, m_fixedDistanceDecoder;
+	LowFirstBitReader m_reader;
+	SecByteBlock m_window;
+	size_t m_current, m_lastFlush;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/cryptopp/zlib.cpp b/runtime/third_party/cryptopp/zlib.cpp
new file mode 100644
index 0000000..2dad0d1
--- /dev/null
+++ b/runtime/third_party/cryptopp/zlib.cpp
@@ -0,0 +1,93 @@
+// zlib.cpp - originally written and placed in the public domain by Wei Dai
+
+// "zlib" is the name of a well known C language compression library
+// (http://www.zlib.org) and also the name of a compression format
+// (RFC 1950) that the library implements. This file is part of a
+// complete reimplementation of the zlib compression format.
+
+#include "pch.h"
+#include "zlib.h"
+#include "zdeflate.h"
+#include "zinflate.h"
+#include "secblock.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+static const byte DEFLATE_METHOD = 8;
+static const byte FDICT_FLAG = (1 << 5);
+
+// *************************************************************
+
+void ZlibCompressor::WritePrestreamHeader()
+{
+	m_adler32.Restart();
+	CRYPTOPP_ASSERT(((GetLog2WindowSize()-8) << 4) <= 255);
+	byte cmf = byte(DEFLATE_METHOD | ((GetLog2WindowSize()-8) << 4));
+	CRYPTOPP_ASSERT((GetCompressionLevel() << 6) <= 255);
+	byte flags = byte(GetCompressionLevel() << 6);
+	AttachedTransformation()->PutWord16(RoundUpToMultipleOf(word16(cmf*256+flags), word16(31)));
+}
+
+void ZlibCompressor::ProcessUncompressedData(const byte *inString, size_t length)
+{
+	m_adler32.Update(inString, length);
+}
+
+void ZlibCompressor::WritePoststreamTail()
+{
+	FixedSizeSecBlock<byte, 4> adler32;
+	m_adler32.Final(adler32);
+	AttachedTransformation()->Put(adler32, 4);
+}
+
+unsigned int ZlibCompressor::GetCompressionLevel() const
+{
+	static const unsigned int deflateToCompressionLevel[] = {0, 1, 1, 1, 2, 2, 2, 2, 2, 3};
+	return deflateToCompressionLevel[GetDeflateLevel()];
+}
+
+// *************************************************************
+
+ZlibDecompressor::ZlibDecompressor(BufferedTransformation *attachment, bool repeat, int propagation)
+	: Inflator(attachment, repeat, propagation), m_log2WindowSize(0)
+{
+}
+
+void ZlibDecompressor::ProcessPrestreamHeader()
+{
+	m_adler32.Restart();
+
+	byte cmf;
+	byte flags;
+
+	if (!m_inQueue.Get(cmf) || !m_inQueue.Get(flags))
+		throw HeaderErr();
+
+	if ((cmf*256+flags) % 31 != 0)
+		throw HeaderErr();	// if you hit this exception, you're probably trying to decompress invalid data
+
+	if ((cmf & 0xf) != DEFLATE_METHOD)
+		throw UnsupportedAlgorithm();
+
+	if (flags & FDICT_FLAG)
+		throw UnsupportedPresetDictionary();
+
+	m_log2WindowSize = 8 + (cmf >> 4);
+}
+
+void ZlibDecompressor::ProcessDecompressedData(const byte *inString, size_t length)
+{
+	AttachedTransformation()->Put(inString, length);
+	m_adler32.Update(inString, length);
+}
+
+void ZlibDecompressor::ProcessPoststreamTail()
+{
+	FixedSizeSecBlock<byte, 4> adler32;
+	if (m_inQueue.Get(adler32, 4) != 4)
+		throw Adler32Err();
+	if (!m_adler32.Verify(adler32))
+		throw Adler32Err();
+}
+
+NAMESPACE_END
diff --git a/runtime/third_party/cryptopp/zlib.h b/runtime/third_party/cryptopp/zlib.h
new file mode 100644
index 0000000..b5fca51
--- /dev/null
+++ b/runtime/third_party/cryptopp/zlib.h
@@ -0,0 +1,65 @@
+// zlib.h - originally written and placed in the public domain by Wei Dai
+
+/// \file zlib.h
+/// \brief ZLIB compression and decompression (RFC 1950)
+
+#ifndef CRYPTOPP_ZLIB_H
+#define CRYPTOPP_ZLIB_H
+
+#include "cryptlib.h"
+#include "adler32.h"
+#include "zdeflate.h"
+#include "zinflate.h"
+
+NAMESPACE_BEGIN(CryptoPP)
+
+/// ZLIB Compressor (RFC 1950)
+class ZlibCompressor : public Deflator
+{
+public:
+	ZlibCompressor(BufferedTransformation *attachment=NULLPTR, unsigned int deflateLevel=DEFAULT_DEFLATE_LEVEL, unsigned int log2WindowSize=DEFAULT_LOG2_WINDOW_SIZE, bool detectUncompressible=true)
+		: Deflator(attachment, deflateLevel, log2WindowSize, detectUncompressible) {}
+	ZlibCompressor(const NameValuePairs &parameters, BufferedTransformation *attachment=NULLPTR)
+		: Deflator(parameters, attachment) {}
+
+	unsigned int GetCompressionLevel() const;
+
+protected:
+	void WritePrestreamHeader();
+	void ProcessUncompressedData(const byte *string, size_t length);
+	void WritePoststreamTail();
+
+	Adler32 m_adler32;
+};
+
+/// ZLIB Decompressor (RFC 1950)
+class ZlibDecompressor : public Inflator
+{
+public:
+	typedef Inflator::Err Err;
+	class HeaderErr : public Err {public: HeaderErr() : Err(INVALID_DATA_FORMAT, "ZlibDecompressor: header decoding error") {}};
+	class Adler32Err : public Err {public: Adler32Err() : Err(DATA_INTEGRITY_CHECK_FAILED, "ZlibDecompressor: ADLER32 check error") {}};
+	class UnsupportedAlgorithm : public Err {public: UnsupportedAlgorithm() : Err(INVALID_DATA_FORMAT, "ZlibDecompressor: unsupported algorithm") {}};
+	class UnsupportedPresetDictionary : public Err {public: UnsupportedPresetDictionary() : Err(INVALID_DATA_FORMAT, "ZlibDecompressor: unsupported preset dictionary") {}};
+
+	/// \brief Construct a ZlibDecompressor
+	/// \param attachment a \ BufferedTransformation to attach to this object
+	/// \param repeat decompress multiple compressed streams in series
+	/// \param autoSignalPropagation 0 to turn off MessageEnd signal
+	ZlibDecompressor(BufferedTransformation *attachment = NULLPTR, bool repeat = false, int autoSignalPropagation = -1);
+	unsigned int GetLog2WindowSize() const {return m_log2WindowSize;}
+
+private:
+	unsigned int MaxPrestreamHeaderSize() const {return 2;}
+	void ProcessPrestreamHeader();
+	void ProcessDecompressedData(const byte *string, size_t length);
+	unsigned int MaxPoststreamTailSize() const {return 4;}
+	void ProcessPoststreamTail();
+
+	unsigned int m_log2WindowSize;
+	Adler32 m_adler32;
+};
+
+NAMESPACE_END
+
+#endif
diff --git a/runtime/third_party/pugixml/LICENSE.md b/runtime/third_party/pugixml/LICENSE.md
new file mode 100644
index 0000000..1ea0d5e
--- /dev/null
+++ b/runtime/third_party/pugixml/LICENSE.md
@@ -0,0 +1,24 @@
+MIT License
+
+Copyright (c) 2006-2025 Arseny Kapoulkine
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
diff --git a/runtime/third_party/pugixml/pugiconfig.hpp b/runtime/third_party/pugixml/pugiconfig.hpp
new file mode 100644
index 0000000..5f1bafd
--- /dev/null
+++ b/runtime/third_party/pugixml/pugiconfig.hpp
@@ -0,0 +1,80 @@
+/**
+ * pugixml parser - version 1.15
+ * --------------------------------------------------------
+ * Copyright (C) 2006-2025, by Arseny Kapoulkine (arseny.kapoulkine@gmail.com)
+ * Report bugs and download new versions at https://pugixml.org/
+ *
+ * This library is distributed under the MIT License. See notice at the end
+ * of this file.
+ *
+ * This work is based on the pugxml parser, which is:
+ * Copyright (C) 2003, by Kristen Wegner (kristen@tima.net)
+ */
+
+#ifndef HEADER_PUGICONFIG_HPP
+#define HEADER_PUGICONFIG_HPP
+
+// Uncomment this to enable wchar_t mode
+// #define PUGIXML_WCHAR_MODE
+
+// Uncomment this to enable compact mode
+// #define PUGIXML_COMPACT
+
+// Uncomment this to disable XPath
+// #define PUGIXML_NO_XPATH
+
+// Uncomment this to disable STL
+// #define PUGIXML_NO_STL
+
+// Uncomment this to disable exceptions
+// #define PUGIXML_NO_EXCEPTIONS
+
+// Set this to control attributes for public classes/functions, i.e.:
+// #define PUGIXML_API __declspec(dllexport) // to export all public symbols from DLL
+// #define PUGIXML_CLASS __declspec(dllimport) // to import all classes from DLL
+// #define PUGIXML_FUNCTION __fastcall // to set calling conventions to all public functions to fastcall
+// In absence of PUGIXML_CLASS/PUGIXML_FUNCTION definitions PUGIXML_API is used instead
+
+// Tune these constants to adjust memory-related behavior
+// #define PUGIXML_MEMORY_PAGE_SIZE 32768
+// #define PUGIXML_MEMORY_OUTPUT_STACK 10240
+// #define PUGIXML_MEMORY_XPATH_PAGE_SIZE 4096
+
+// Tune this constant to adjust max nesting for XPath queries
+// #define PUGIXML_XPATH_DEPTH_LIMIT 1024
+
+// Uncomment this to switch to header-only version
+// #define PUGIXML_HEADER_ONLY
+
+// Uncomment this to enable long long support (usually enabled automatically)
+// #define PUGIXML_HAS_LONG_LONG
+
+// Uncomment this to enable support for std::string_view (usually enabled automatically)
+// #define PUGIXML_HAS_STRING_VIEW
+
+#endif
+
+/**
+ * Copyright (c) 2006-2025 Arseny Kapoulkine
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
diff --git a/runtime/third_party/pugixml/pugixml.cpp b/runtime/third_party/pugixml/pugixml.cpp
new file mode 100644
index 0000000..53a0526
--- /dev/null
+++ b/runtime/third_party/pugixml/pugixml.cpp
@@ -0,0 +1,13553 @@
+/**
+ * pugixml parser - version 1.15
+ * --------------------------------------------------------
+ * Copyright (C) 2006-2025, by Arseny Kapoulkine (arseny.kapoulkine@gmail.com)
+ * Report bugs and download new versions at https://pugixml.org/
+ *
+ * This library is distributed under the MIT License. See notice at the end
+ * of this file.
+ *
+ * This work is based on the pugxml parser, which is:
+ * Copyright (C) 2003, by Kristen Wegner (kristen@tima.net)
+ */
+
+#ifndef SOURCE_PUGIXML_CPP
+#define SOURCE_PUGIXML_CPP
+
+#include "pugixml.hpp"
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include <limits.h>
+
+#ifdef PUGIXML_WCHAR_MODE
+#	include <wchar.h>
+#endif
+
+#ifndef PUGIXML_NO_XPATH
+#	include <math.h>
+#	include <float.h>
+#endif
+
+#ifndef PUGIXML_NO_STL
+#	include <istream>
+#	include <ostream>
+#	include <string>
+#endif
+
+// For placement new
+#include <new>
+
+// For load_file
+#if defined(__linux__) || defined(__APPLE__)
+#include <sys/stat.h>
+#endif
+
+#ifdef _MSC_VER
+#	pragma warning(push)
+#	pragma warning(disable: 4127) // conditional expression is constant
+#	pragma warning(disable: 4324) // structure was padded due to __declspec(align())
+#	pragma warning(disable: 4702) // unreachable code
+#	pragma warning(disable: 4996) // this function or variable may be unsafe
+#endif
+
+#if defined(__clang__)
+#	pragma clang diagnostic push
+#	pragma clang diagnostic ignored "-Wzero-as-null-pointer-constant" // NULL as null pointer constant
+#endif
+
+#if defined(_MSC_VER) && defined(__c2__)
+#	pragma clang diagnostic push
+#	pragma clang diagnostic ignored "-Wdeprecated" // this function or variable may be unsafe
+#endif
+
+#ifdef __INTEL_COMPILER
+#	pragma warning(disable: 177) // function was declared but never referenced
+#	pragma warning(disable: 279) // controlling expression is constant
+#	pragma warning(disable: 1478 1786) // function was declared "deprecated"
+#	pragma warning(disable: 1684) // conversion from pointer to same-sized integral type
+#endif
+
+#if defined(__BORLANDC__) && defined(PUGIXML_HEADER_ONLY)
+#	pragma warn -8080 // symbol is declared but never used; disabling this inside push/pop bracket does not make the warning go away
+#endif
+
+#ifdef __BORLANDC__
+#	pragma option push
+#	pragma warn -8008 // condition is always false
+#	pragma warn -8066 // unreachable code
+#endif
+
+#ifdef __SNC__
+// Using diag_push/diag_pop does not disable the warnings inside templates due to a compiler bug
+#	pragma diag_suppress=178 // function was declared but never referenced
+#	pragma diag_suppress=237 // controlling expression is constant
+#endif
+
+#ifdef __TI_COMPILER_VERSION__
+#	pragma diag_suppress 179 // function was declared but never referenced
+#endif
+
+// Inlining controls
+#if defined(_MSC_VER) && _MSC_VER >= 1300
+#	define PUGI_IMPL_NO_INLINE __declspec(noinline)
+#elif defined(__GNUC__)
+#	define PUGI_IMPL_NO_INLINE __attribute__((noinline))
+#else
+#	define PUGI_IMPL_NO_INLINE
+#endif
+
+// Branch weight controls
+#if defined(__GNUC__) && !defined(__c2__)
+#	define PUGI_IMPL_UNLIKELY(cond) __builtin_expect(cond, 0)
+#else
+#	define PUGI_IMPL_UNLIKELY(cond) (cond)
+#endif
+
+// Simple static assertion
+#define PUGI_IMPL_STATIC_ASSERT(cond) { static const char condition_failed[(cond) ? 1 : -1] = {0}; (void)condition_failed[0]; }
+
+// Digital Mars C++ bug workaround for passing char loaded from memory via stack
+#ifdef __DMC__
+#	define PUGI_IMPL_DMC_VOLATILE volatile
+#else
+#	define PUGI_IMPL_DMC_VOLATILE
+#endif
+
+// Integer sanitizer workaround; we only apply this for clang since gcc8 has no_sanitize but not unsigned-integer-overflow and produces "attribute directive ignored" warnings
+#if defined(__clang__) && defined(__has_attribute)
+#	if __has_attribute(no_sanitize)
+#		define PUGI_IMPL_UNSIGNED_OVERFLOW __attribute__((no_sanitize("unsigned-integer-overflow")))
+#	else
+#		define PUGI_IMPL_UNSIGNED_OVERFLOW
+#	endif
+#else
+#	define PUGI_IMPL_UNSIGNED_OVERFLOW
+#endif
+
+// Borland C++ bug workaround for not defining ::memcpy depending on header include order (can't always use std::memcpy because some compilers don't have it at all)
+#if defined(__BORLANDC__) && !defined(__MEM_H_USING_LIST)
+using std::memcpy;
+using std::memmove;
+using std::memset;
+#endif
+
+// Old versions of GCC do not define ::malloc and ::free depending on header include order
+#if defined(__GNUC__) && (__GNUC__ < 3 || (__GNUC__ == 3 && __GNUC_MINOR__ < 4))
+using std::malloc;
+using std::free;
+#endif
+
+// Some MinGW/GCC versions have headers that erroneously omit LLONG_MIN/LLONG_MAX/ULLONG_MAX definitions from limits.h in some configurations
+#if defined(PUGIXML_HAS_LONG_LONG) && defined(__GNUC__) && !defined(LLONG_MAX) && !defined(LLONG_MIN) && !defined(ULLONG_MAX)
+#	define LLONG_MIN (-LLONG_MAX - 1LL)
+#	define LLONG_MAX __LONG_LONG_MAX__
+#	define ULLONG_MAX (LLONG_MAX * 2ULL + 1ULL)
+#endif
+
+// In some environments MSVC is a compiler but the CRT lacks certain MSVC-specific features
+#if defined(_MSC_VER) && !defined(__S3E__) && !defined(_WIN32_WCE)
+#	define PUGI_IMPL_MSVC_CRT_VERSION _MSC_VER
+#elif defined(_WIN32_WCE)
+#	define PUGI_IMPL_MSVC_CRT_VERSION 1310 // MSVC7.1
+#endif
+
+// Not all platforms have snprintf; we define a wrapper that uses snprintf if possible. This only works with buffers with a known size.
+#if __cplusplus >= 201103
+#	define PUGI_IMPL_SNPRINTF(buf, ...) snprintf(buf, sizeof(buf), __VA_ARGS__)
+#elif defined(PUGI_IMPL_MSVC_CRT_VERSION) && PUGI_IMPL_MSVC_CRT_VERSION >= 1400
+#	define PUGI_IMPL_SNPRINTF(buf, ...) _snprintf_s(buf, _countof(buf), _TRUNCATE, __VA_ARGS__)
+#elif defined(__APPLE__) && __clang_major__ >= 14 // Xcode 14 marks sprintf as deprecated while still using C++98 by default
+#	define PUGI_IMPL_SNPRINTF(buf, fmt, arg1, arg2) snprintf(buf, sizeof(buf), fmt, arg1, arg2)
+#else
+#	define PUGI_IMPL_SNPRINTF sprintf
+#endif
+
+// We put implementation details into an anonymous namespace in source mode, but have to keep it in non-anonymous namespace in header-only mode to prevent binary bloat.
+#ifdef PUGIXML_HEADER_ONLY
+#	define PUGI_IMPL_NS_BEGIN namespace pugi { namespace impl {
+#	define PUGI_IMPL_NS_END } }
+#	define PUGI_IMPL_FN inline
+#	define PUGI_IMPL_FN_NO_INLINE inline
+#else
+#	if defined(_MSC_VER) && _MSC_VER < 1300 // MSVC6 seems to have an amusing bug with anonymous namespaces inside namespaces
+#		define PUGI_IMPL_NS_BEGIN namespace pugi { namespace impl {
+#		define PUGI_IMPL_NS_END } }
+#	else
+#		define PUGI_IMPL_NS_BEGIN namespace pugi { namespace impl { namespace {
+#		define PUGI_IMPL_NS_END } } }
+#	endif
+#	define PUGI_IMPL_FN
+#	define PUGI_IMPL_FN_NO_INLINE PUGI_IMPL_NO_INLINE
+#endif
+
+// uintptr_t
+#if (defined(_MSC_VER) && _MSC_VER < 1600) || (defined(__BORLANDC__) && __BORLANDC__ < 0x561)
+namespace pugi
+{
+#	ifndef _UINTPTR_T_DEFINED
+	typedef size_t uintptr_t;
+#	endif
+
+	typedef unsigned __int8 uint8_t;
+	typedef unsigned __int16 uint16_t;
+	typedef unsigned __int32 uint32_t;
+}
+#else
+#	include <stdint.h>
+#endif
+
+// Memory allocation
+PUGI_IMPL_NS_BEGIN
+	PUGI_IMPL_FN void* default_allocate(size_t size)
+	{
+		return malloc(size);
+	}
+
+	PUGI_IMPL_FN void default_deallocate(void* ptr)
+	{
+		free(ptr);
+	}
+
+	template <typename T>
+	struct xml_memory_management_function_storage
+	{
+		static allocation_function allocate;
+		static deallocation_function deallocate;
+	};
+
+	// Global allocation functions are stored in class statics so that in header mode linker deduplicates them
+	// Without a template<> we'll get multiple definitions of the same static
+	template <typename T> allocation_function xml_memory_management_function_storage<T>::allocate = default_allocate;
+	template <typename T> deallocation_function xml_memory_management_function_storage<T>::deallocate = default_deallocate;
+
+	typedef xml_memory_management_function_storage<int> xml_memory;
+PUGI_IMPL_NS_END
+
+// String utilities
+PUGI_IMPL_NS_BEGIN
+	// Get string length
+	PUGI_IMPL_FN size_t strlength(const char_t* s)
+	{
+		assert(s);
+
+	#ifdef PUGIXML_WCHAR_MODE
+		return wcslen(s);
+	#else
+		return strlen(s);
+	#endif
+	}
+
+	// Compare two strings
+	PUGI_IMPL_FN bool strequal(const char_t* src, const char_t* dst)
+	{
+		assert(src && dst);
+
+	#ifdef PUGIXML_WCHAR_MODE
+		return wcscmp(src, dst) == 0;
+	#else
+		return strcmp(src, dst) == 0;
+	#endif
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	// Check if the null-terminated dst string is equal to the entire contents of srcview
+	PUGI_IMPL_FN bool stringview_equal(string_view_t srcview, const char_t* dst)
+	{
+		// std::basic_string_view::compare(const char*) has the right behavior, but it performs an
+		// extra traversal of dst to compute its length.
+		assert(dst);
+		const char_t* src = srcview.data();
+		size_t srclen = srcview.size();
+
+		while (srclen && *dst && *src == *dst)
+		{
+			--srclen; ++dst; ++src; 
+		}
+		return srclen == 0 && *dst == 0;
+	}
+#endif
+
+	// Compare lhs with [rhs_begin, rhs_end)
+	PUGI_IMPL_FN bool strequalrange(const char_t* lhs, const char_t* rhs, size_t count)
+	{
+		for (size_t i = 0; i < count; ++i)
+			if (lhs[i] != rhs[i])
+				return false;
+
+		return lhs[count] == 0;
+	}
+
+	// Get length of wide string, even if CRT lacks wide character support
+	PUGI_IMPL_FN size_t strlength_wide(const wchar_t* s)
+	{
+		assert(s);
+
+	#ifdef PUGIXML_WCHAR_MODE
+		return wcslen(s);
+	#else
+		const wchar_t* end = s;
+		while (*end) end++;
+		return static_cast<size_t>(end - s);
+	#endif
+	}
+PUGI_IMPL_NS_END
+
+// auto_ptr-like object for exception recovery
+PUGI_IMPL_NS_BEGIN
+	template <typename T> struct auto_deleter
+	{
+		typedef void (*D)(T*);
+
+		T* data;
+		D deleter;
+
+		auto_deleter(T* data_, D deleter_): data(data_), deleter(deleter_)
+		{
+		}
+
+		~auto_deleter()
+		{
+			if (data) deleter(data);
+		}
+
+		T* release()
+		{
+			T* result = data;
+			data = NULL;
+			return result;
+		}
+	};
+PUGI_IMPL_NS_END
+
+#ifdef PUGIXML_COMPACT
+PUGI_IMPL_NS_BEGIN
+	class compact_hash_table
+	{
+	public:
+		compact_hash_table(): _items(NULL), _capacity(0), _count(0)
+		{
+		}
+
+		void clear()
+		{
+			if (_items)
+			{
+				xml_memory::deallocate(_items);
+				_items = NULL;
+				_capacity = 0;
+				_count = 0;
+			}
+		}
+
+		void* find(const void* key)
+		{
+			if (_capacity == 0) return NULL;
+
+			item_t* item = get_item(key);
+			assert(item);
+			assert(item->key == key || (item->key == NULL && item->value == NULL));
+
+			return item->value;
+		}
+
+		void insert(const void* key, void* value)
+		{
+			assert(_capacity != 0 && _count < _capacity - _capacity / 4);
+
+			item_t* item = get_item(key);
+			assert(item);
+
+			if (item->key == NULL)
+			{
+				_count++;
+				item->key = key;
+			}
+
+			item->value = value;
+		}
+
+		bool reserve(size_t extra = 16)
+		{
+			if (_count + extra >= _capacity - _capacity / 4)
+				return rehash(_count + extra);
+
+			return true;
+		}
+
+	private:
+		struct item_t
+		{
+			const void* key;
+			void* value;
+		};
+
+		item_t* _items;
+		size_t _capacity;
+
+		size_t _count;
+
+		bool rehash(size_t count);
+
+		item_t* get_item(const void* key)
+		{
+			assert(key);
+			assert(_capacity > 0);
+
+			size_t hashmod = _capacity - 1;
+			size_t bucket = hash(key) & hashmod;
+
+			for (size_t probe = 0; probe <= hashmod; ++probe)
+			{
+				item_t& probe_item = _items[bucket];
+
+				if (probe_item.key == key || probe_item.key == NULL)
+					return &probe_item;
+
+				// hash collision, quadratic probing
+				bucket = (bucket + probe + 1) & hashmod;
+			}
+
+			assert(false && "Hash table is full"); // unreachable
+			return NULL;
+		}
+
+		static PUGI_IMPL_UNSIGNED_OVERFLOW unsigned int hash(const void* key)
+		{
+			unsigned int h = static_cast<unsigned int>(reinterpret_cast<uintptr_t>(key) & 0xffffffff);
+
+			// MurmurHash3 32-bit finalizer
+			h ^= h >> 16;
+			h *= 0x85ebca6bu;
+			h ^= h >> 13;
+			h *= 0xc2b2ae35u;
+			h ^= h >> 16;
+
+			return h;
+		}
+	};
+
+	PUGI_IMPL_FN_NO_INLINE bool compact_hash_table::rehash(size_t count)
+	{
+		size_t capacity = 32;
+		while (count >= capacity - capacity / 4)
+			capacity *= 2;
+
+		compact_hash_table rt;
+		rt._capacity = capacity;
+		rt._items = static_cast<item_t*>(xml_memory::allocate(sizeof(item_t) * capacity));
+
+		if (!rt._items)
+			return false;
+
+		memset(rt._items, 0, sizeof(item_t) * capacity);
+
+		for (size_t i = 0; i < _capacity; ++i)
+			if (_items[i].key)
+				rt.insert(_items[i].key, _items[i].value);
+
+		if (_items)
+			xml_memory::deallocate(_items);
+
+		_capacity = capacity;
+		_items = rt._items;
+
+		assert(_count == rt._count);
+
+		return true;
+	}
+
+PUGI_IMPL_NS_END
+#endif
+
+PUGI_IMPL_NS_BEGIN
+#ifdef PUGIXML_COMPACT
+	static const uintptr_t xml_memory_block_alignment = 4;
+#else
+	static const uintptr_t xml_memory_block_alignment = sizeof(void*);
+#endif
+
+	// extra metadata bits
+	static const uintptr_t xml_memory_page_contents_shared_mask = 64;
+	static const uintptr_t xml_memory_page_name_allocated_mask = 32;
+	static const uintptr_t xml_memory_page_value_allocated_mask = 16;
+	static const uintptr_t xml_memory_page_type_mask = 15;
+
+	// combined masks for string uniqueness
+	static const uintptr_t xml_memory_page_name_allocated_or_shared_mask = xml_memory_page_name_allocated_mask | xml_memory_page_contents_shared_mask;
+	static const uintptr_t xml_memory_page_value_allocated_or_shared_mask = xml_memory_page_value_allocated_mask | xml_memory_page_contents_shared_mask;
+
+#ifdef PUGIXML_COMPACT
+	#define PUGI_IMPL_GETHEADER_IMPL(object, page, flags) // unused
+	#define PUGI_IMPL_GETPAGE_IMPL(header) (header).get_page()
+#else
+	#define PUGI_IMPL_GETHEADER_IMPL(object, page, flags) (((reinterpret_cast<char*>(object) - reinterpret_cast<char*>(page)) << 8) | (flags))
+	// this macro casts pointers through void* to avoid 'cast increases required alignment of target type' warnings
+	#define PUGI_IMPL_GETPAGE_IMPL(header) static_cast<impl::xml_memory_page*>(const_cast<void*>(static_cast<const void*>(reinterpret_cast<const char*>(&header) - (header >> 8))))
+#endif
+
+	#define PUGI_IMPL_GETPAGE(n) PUGI_IMPL_GETPAGE_IMPL((n)->header)
+	#define PUGI_IMPL_NODETYPE(n) static_cast<xml_node_type>((n)->header & impl::xml_memory_page_type_mask)
+
+	struct xml_allocator;
+
+	struct xml_memory_page
+	{
+		static xml_memory_page* construct(void* memory)
+		{
+			xml_memory_page* result = static_cast<xml_memory_page*>(memory);
+
+			result->allocator = NULL;
+			result->prev = NULL;
+			result->next = NULL;
+			result->busy_size = 0;
+			result->freed_size = 0;
+
+		#ifdef PUGIXML_COMPACT
+			result->compact_string_base = NULL;
+			result->compact_shared_parent = NULL;
+			result->compact_page_marker = NULL;
+		#endif
+
+			return result;
+		}
+
+		xml_allocator* allocator;
+
+		xml_memory_page* prev;
+		xml_memory_page* next;
+
+		size_t busy_size;
+		size_t freed_size;
+
+	#ifdef PUGIXML_COMPACT
+		char_t* compact_string_base;
+		void* compact_shared_parent;
+		uint32_t* compact_page_marker;
+	#endif
+	};
+
+	static const size_t xml_memory_page_size =
+	#ifdef PUGIXML_MEMORY_PAGE_SIZE
+		(PUGIXML_MEMORY_PAGE_SIZE)
+	#else
+		32768
+	#endif
+		- sizeof(xml_memory_page);
+
+	struct xml_memory_string_header
+	{
+		uint16_t page_offset; // offset from page->data
+		uint16_t full_size; // 0 if string occupies whole page
+	};
+
+	struct xml_allocator
+	{
+		xml_allocator(xml_memory_page* root): _root(root), _busy_size(root->busy_size)
+		{
+		#ifdef PUGIXML_COMPACT
+			_hash = NULL;
+		#endif
+		}
+
+		xml_memory_page* allocate_page(size_t data_size)
+		{
+			size_t size = sizeof(xml_memory_page) + data_size;
+
+			// allocate block with some alignment, leaving memory for worst-case padding
+			void* memory = xml_memory::allocate(size);
+			if (!memory) return NULL;
+
+			// prepare page structure
+			xml_memory_page* page = xml_memory_page::construct(memory);
+			assert(page);
+
+			assert(this == _root->allocator);
+			page->allocator = this;
+
+			return page;
+		}
+
+		static void deallocate_page(xml_memory_page* page)
+		{
+			xml_memory::deallocate(page);
+		}
+
+		void* allocate_memory_oob(size_t size, xml_memory_page*& out_page);
+
+		void* allocate_memory(size_t size, xml_memory_page*& out_page)
+		{
+			if (PUGI_IMPL_UNLIKELY(_busy_size + size > xml_memory_page_size))
+				return allocate_memory_oob(size, out_page);
+
+			void* buf = reinterpret_cast<char*>(_root) + sizeof(xml_memory_page) + _busy_size;
+
+			_busy_size += size;
+
+			out_page = _root;
+
+			return buf;
+		}
+
+	#ifdef PUGIXML_COMPACT
+		void* allocate_object(size_t size, xml_memory_page*& out_page)
+		{
+			void* result = allocate_memory(size + sizeof(uint32_t), out_page);
+			if (!result) return NULL;
+
+			// adjust for marker
+			ptrdiff_t offset = static_cast<char*>(result) - reinterpret_cast<char*>(out_page->compact_page_marker);
+
+			if (PUGI_IMPL_UNLIKELY(static_cast<uintptr_t>(offset) >= 256 * xml_memory_block_alignment))
+			{
+				// insert new marker
+				uint32_t* marker = static_cast<uint32_t*>(result);
+
+				*marker = static_cast<uint32_t>(reinterpret_cast<char*>(marker) - reinterpret_cast<char*>(out_page));
+				out_page->compact_page_marker = marker;
+
+				// since we don't reuse the page space until we reallocate it, we can just pretend that we freed the marker block
+				// this will make sure deallocate_memory correctly tracks the size
+				out_page->freed_size += sizeof(uint32_t);
+
+				return marker + 1;
+			}
+			else
+			{
+				// roll back uint32_t part
+				_busy_size -= sizeof(uint32_t);
+
+				return result;
+			}
+		}
+	#else
+		void* allocate_object(size_t size, xml_memory_page*& out_page)
+		{
+			return allocate_memory(size, out_page);
+		}
+	#endif
+
+		void deallocate_memory(void* ptr, size_t size, xml_memory_page* page)
+		{
+			if (page == _root) page->busy_size = _busy_size;
+
+			assert(ptr >= reinterpret_cast<char*>(page) + sizeof(xml_memory_page) && ptr < reinterpret_cast<char*>(page) + sizeof(xml_memory_page) + page->busy_size);
+			(void)!ptr;
+
+			page->freed_size += size;
+			assert(page->freed_size <= page->busy_size);
+
+			if (page->freed_size == page->busy_size)
+			{
+				if (page->next == NULL)
+				{
+					assert(_root == page);
+
+					// top page freed, just reset sizes
+					page->busy_size = 0;
+					page->freed_size = 0;
+
+				#ifdef PUGIXML_COMPACT
+					// reset compact state to maximize efficiency
+					page->compact_string_base = NULL;
+					page->compact_shared_parent = NULL;
+					page->compact_page_marker = NULL;
+				#endif
+
+					_busy_size = 0;
+				}
+				else
+				{
+					assert(_root != page);
+					assert(page->prev);
+
+					// remove from the list
+					page->prev->next = page->next;
+					page->next->prev = page->prev;
+
+					// deallocate
+					deallocate_page(page);
+				}
+			}
+		}
+
+		char_t* allocate_string(size_t length)
+		{
+			static const size_t max_encoded_offset = (1 << 16) * xml_memory_block_alignment;
+
+			PUGI_IMPL_STATIC_ASSERT(xml_memory_page_size <= max_encoded_offset);
+
+			// allocate memory for string and header block
+			size_t size = sizeof(xml_memory_string_header) + length * sizeof(char_t);
+
+			// round size up to block alignment boundary
+			size_t full_size = (size + (xml_memory_block_alignment - 1)) & ~(xml_memory_block_alignment - 1);
+
+			xml_memory_page* page;
+			xml_memory_string_header* header = static_cast<xml_memory_string_header*>(allocate_memory(full_size, page));
+
+			if (!header) return NULL;
+
+			// setup header
+			ptrdiff_t page_offset = reinterpret_cast<char*>(header) - reinterpret_cast<char*>(page) - sizeof(xml_memory_page);
+
+			assert(page_offset % xml_memory_block_alignment == 0);
+			assert(page_offset >= 0 && static_cast<size_t>(page_offset) < max_encoded_offset);
+			header->page_offset = static_cast<uint16_t>(static_cast<size_t>(page_offset) / xml_memory_block_alignment);
+
+			// full_size == 0 for large strings that occupy the whole page
+			assert(full_size % xml_memory_block_alignment == 0);
+			assert(full_size < max_encoded_offset || (page->busy_size == full_size && page_offset == 0));
+			header->full_size = static_cast<uint16_t>(full_size < max_encoded_offset ? full_size / xml_memory_block_alignment : 0);
+
+			// round-trip through void* to avoid 'cast increases required alignment of target type' warning
+			// header is guaranteed a pointer-sized alignment, which should be enough for char_t
+			return static_cast<char_t*>(static_cast<void*>(header + 1));
+		}
+
+		void deallocate_string(char_t* string)
+		{
+			// this function casts pointers through void* to avoid 'cast increases required alignment of target type' warnings
+			// we're guaranteed the proper (pointer-sized) alignment on the input string if it was allocated via allocate_string
+
+			// get header
+			xml_memory_string_header* header = static_cast<xml_memory_string_header*>(static_cast<void*>(string)) - 1;
+			assert(header);
+
+			// deallocate
+			size_t page_offset = sizeof(xml_memory_page) + header->page_offset * xml_memory_block_alignment;
+			xml_memory_page* page = reinterpret_cast<xml_memory_page*>(static_cast<void*>(reinterpret_cast<char*>(header) - page_offset));
+
+			// if full_size == 0 then this string occupies the whole page
+			size_t full_size = header->full_size == 0 ? page->busy_size : header->full_size * xml_memory_block_alignment;
+
+			deallocate_memory(header, full_size, page);
+		}
+
+		bool reserve()
+		{
+		#ifdef PUGIXML_COMPACT
+			return _hash->reserve();
+		#else
+			return true;
+		#endif
+		}
+
+		xml_memory_page* _root;
+		size_t _busy_size;
+
+	#ifdef PUGIXML_COMPACT
+		compact_hash_table* _hash;
+	#endif
+	};
+
+	PUGI_IMPL_FN_NO_INLINE void* xml_allocator::allocate_memory_oob(size_t size, xml_memory_page*& out_page)
+	{
+		const size_t large_allocation_threshold = xml_memory_page_size / 4;
+
+		xml_memory_page* page = allocate_page(size <= large_allocation_threshold ? xml_memory_page_size : size);
+		out_page = page;
+
+		if (!page) return NULL;
+
+		if (size <= large_allocation_threshold)
+		{
+			_root->busy_size = _busy_size;
+
+			// insert page at the end of linked list
+			page->prev = _root;
+			_root->next = page;
+			_root = page;
+
+			_busy_size = size;
+		}
+		else
+		{
+			// insert page before the end of linked list, so that it is deleted as soon as possible
+			// the last page is not deleted even if it's empty (see deallocate_memory)
+			assert(_root->prev);
+
+			page->prev = _root->prev;
+			page->next = _root;
+
+			_root->prev->next = page;
+			_root->prev = page;
+
+			page->busy_size = size;
+		}
+
+		return reinterpret_cast<char*>(page) + sizeof(xml_memory_page);
+	}
+PUGI_IMPL_NS_END
+
+#ifdef PUGIXML_COMPACT
+PUGI_IMPL_NS_BEGIN
+	static const uintptr_t compact_alignment_log2 = 2;
+	static const uintptr_t compact_alignment = 1 << compact_alignment_log2;
+
+	class compact_header
+	{
+	public:
+		compact_header(xml_memory_page* page, unsigned int flags)
+		{
+			PUGI_IMPL_STATIC_ASSERT(xml_memory_block_alignment == compact_alignment);
+
+			ptrdiff_t offset = (reinterpret_cast<char*>(this) - reinterpret_cast<char*>(page->compact_page_marker));
+			assert(offset % compact_alignment == 0 && static_cast<uintptr_t>(offset) < 256 * compact_alignment);
+
+			_page = static_cast<unsigned char>(offset >> compact_alignment_log2);
+			_flags = static_cast<unsigned char>(flags);
+		}
+
+		void operator&=(uintptr_t mod)
+		{
+			_flags &= static_cast<unsigned char>(mod);
+		}
+
+		void operator|=(uintptr_t mod)
+		{
+			_flags |= static_cast<unsigned char>(mod);
+		}
+
+		uintptr_t operator&(uintptr_t mod) const
+		{
+			return _flags & mod;
+		}
+
+		xml_memory_page* get_page() const
+		{
+			// round-trip through void* to silence 'cast increases required alignment of target type' warnings
+			const char* page_marker = reinterpret_cast<const char*>(this) - (_page << compact_alignment_log2);
+			const char* page = page_marker - *reinterpret_cast<const uint32_t*>(static_cast<const void*>(page_marker));
+
+			return const_cast<xml_memory_page*>(reinterpret_cast<const xml_memory_page*>(static_cast<const void*>(page)));
+		}
+
+	private:
+		unsigned char _page;
+		unsigned char _flags;
+	};
+
+	PUGI_IMPL_FN xml_memory_page* compact_get_page(const void* object, int header_offset)
+	{
+		const compact_header* header = reinterpret_cast<const compact_header*>(static_cast<const char*>(object) - header_offset);
+
+		return header->get_page();
+	}
+
+	template <int header_offset, typename T> PUGI_IMPL_FN_NO_INLINE T* compact_get_value(const void* object)
+	{
+		return static_cast<T*>(compact_get_page(object, header_offset)->allocator->_hash->find(object));
+	}
+
+	template <int header_offset, typename T> PUGI_IMPL_FN_NO_INLINE void compact_set_value(const void* object, T* value)
+	{
+		compact_get_page(object, header_offset)->allocator->_hash->insert(object, value);
+	}
+
+	template <typename T, int header_offset, int start = -126> class compact_pointer
+	{
+	public:
+		compact_pointer(): _data(0)
+		{
+		}
+
+		void operator=(const compact_pointer& rhs)
+		{
+			*this = rhs + 0;
+		}
+
+		void operator=(T* value)
+		{
+			if (value)
+			{
+				// value is guaranteed to be compact-aligned; 'this' is not
+				// our decoding is based on 'this' aligned to compact alignment downwards (see operator T*)
+				// so for negative offsets (e.g. -3) we need to adjust the diff by compact_alignment - 1 to
+				// compensate for arithmetic shift rounding for negative values
+				ptrdiff_t diff = reinterpret_cast<char*>(value) - reinterpret_cast<char*>(this);
+				ptrdiff_t offset = ((diff + int(compact_alignment - 1)) >> compact_alignment_log2) - start;
+
+				if (static_cast<uintptr_t>(offset) <= 253)
+					_data = static_cast<unsigned char>(offset + 1);
+				else
+				{
+					compact_set_value<header_offset>(this, value);
+
+					_data = 255;
+				}
+			}
+			else
+				_data = 0;
+		}
+
+		operator T*() const
+		{
+			if (_data)
+			{
+				if (_data < 255)
+				{
+					uintptr_t base = reinterpret_cast<uintptr_t>(this) & ~(compact_alignment - 1);
+
+					return reinterpret_cast<T*>(base + (_data - 1 + start) * compact_alignment);
+				}
+				else
+					return compact_get_value<header_offset, T>(this);
+			}
+			else
+				return NULL;
+		}
+
+		T* operator->() const
+		{
+			return *this;
+		}
+
+	private:
+		unsigned char _data;
+	};
+
+	template <typename T, int header_offset> class compact_pointer_parent
+	{
+	public:
+		compact_pointer_parent(): _data(0)
+		{
+		}
+
+		void operator=(const compact_pointer_parent& rhs)
+		{
+			*this = rhs + 0;
+		}
+
+		void operator=(T* value)
+		{
+			if (value)
+			{
+				// value is guaranteed to be compact-aligned; 'this' is not
+				// our decoding is based on 'this' aligned to compact alignment downwards (see operator T*)
+				// so for negative offsets (e.g. -3) we need to adjust the diff by compact_alignment - 1 to
+				// compensate for arithmetic shift behavior for negative values
+				ptrdiff_t diff = reinterpret_cast<char*>(value) - reinterpret_cast<char*>(this);
+				ptrdiff_t offset = ((diff + int(compact_alignment - 1)) >> compact_alignment_log2) + 65533;
+
+				if (static_cast<uintptr_t>(offset) <= 65533)
+				{
+					_data = static_cast<unsigned short>(offset + 1);
+				}
+				else
+				{
+					xml_memory_page* page = compact_get_page(this, header_offset);
+
+					if (PUGI_IMPL_UNLIKELY(page->compact_shared_parent == NULL))
+						page->compact_shared_parent = value;
+
+					if (page->compact_shared_parent == value)
+					{
+						_data = 65534;
+					}
+					else
+					{
+						compact_set_value<header_offset>(this, value);
+
+						_data = 65535;
+					}
+				}
+			}
+			else
+			{
+				_data = 0;
+			}
+		}
+
+		operator T*() const
+		{
+			if (_data)
+			{
+				if (_data < 65534)
+				{
+					uintptr_t base = reinterpret_cast<uintptr_t>(this) & ~(compact_alignment - 1);
+
+					return reinterpret_cast<T*>(base + (_data - 1 - 65533) * compact_alignment);
+				}
+				else if (_data == 65534)
+					return static_cast<T*>(compact_get_page(this, header_offset)->compact_shared_parent);
+				else
+					return compact_get_value<header_offset, T>(this);
+			}
+			else
+				return NULL;
+		}
+
+		T* operator->() const
+		{
+			return *this;
+		}
+
+	private:
+		uint16_t _data;
+	};
+
+	template <int header_offset, int base_offset> class compact_string
+	{
+	public:
+		compact_string(): _data(0)
+		{
+		}
+
+		void operator=(const compact_string& rhs)
+		{
+			*this = rhs + 0;
+		}
+
+		void operator=(char_t* value)
+		{
+			if (value)
+			{
+				xml_memory_page* page = compact_get_page(this, header_offset);
+
+				if (PUGI_IMPL_UNLIKELY(page->compact_string_base == NULL))
+					page->compact_string_base = value;
+
+				ptrdiff_t offset = value - page->compact_string_base;
+
+				if (static_cast<uintptr_t>(offset) < (65535 << 7))
+				{
+					// round-trip through void* to silence 'cast increases required alignment of target type' warnings
+					uint16_t* base = reinterpret_cast<uint16_t*>(static_cast<void*>(reinterpret_cast<char*>(this) - base_offset));
+
+					if (*base == 0)
+					{
+						*base = static_cast<uint16_t>((offset >> 7) + 1);
+						_data = static_cast<unsigned char>((offset & 127) + 1);
+					}
+					else
+					{
+						ptrdiff_t remainder = offset - ((*base - 1) << 7);
+
+						if (static_cast<uintptr_t>(remainder) <= 253)
+						{
+							_data = static_cast<unsigned char>(remainder + 1);
+						}
+						else
+						{
+							compact_set_value<header_offset>(this, value);
+
+							_data = 255;
+						}
+					}
+				}
+				else
+				{
+					compact_set_value<header_offset>(this, value);
+
+					_data = 255;
+				}
+			}
+			else
+			{
+				_data = 0;
+			}
+		}
+
+		operator char_t*() const
+		{
+			if (_data)
+			{
+				if (_data < 255)
+				{
+					xml_memory_page* page = compact_get_page(this, header_offset);
+
+					// round-trip through void* to silence 'cast increases required alignment of target type' warnings
+					const uint16_t* base = reinterpret_cast<const uint16_t*>(static_cast<const void*>(reinterpret_cast<const char*>(this) - base_offset));
+					assert(*base);
+
+					ptrdiff_t offset = ((*base - 1) << 7) + (_data - 1);
+
+					return page->compact_string_base + offset;
+				}
+				else
+				{
+					return compact_get_value<header_offset, char_t>(this);
+				}
+			}
+			else
+				return NULL;
+		}
+
+	private:
+		unsigned char _data;
+	};
+PUGI_IMPL_NS_END
+#endif
+
+#ifdef PUGIXML_COMPACT
+namespace pugi
+{
+	struct xml_attribute_struct
+	{
+		xml_attribute_struct(impl::xml_memory_page* page): header(page, 0), namevalue_base(0)
+		{
+			PUGI_IMPL_STATIC_ASSERT(sizeof(xml_attribute_struct) == 8);
+		}
+
+		impl::compact_header header;
+
+		uint16_t namevalue_base;
+
+		impl::compact_string<4, 2> name;
+		impl::compact_string<5, 3> value;
+
+		impl::compact_pointer<xml_attribute_struct, 6> prev_attribute_c;
+		impl::compact_pointer<xml_attribute_struct, 7, 0> next_attribute;
+	};
+
+	struct xml_node_struct
+	{
+		xml_node_struct(impl::xml_memory_page* page, xml_node_type type): header(page, type), namevalue_base(0)
+		{
+			PUGI_IMPL_STATIC_ASSERT(sizeof(xml_node_struct) == 12);
+		}
+
+		impl::compact_header header;
+
+		uint16_t namevalue_base;
+
+		impl::compact_string<4, 2> name;
+		impl::compact_string<5, 3> value;
+
+		impl::compact_pointer_parent<xml_node_struct, 6> parent;
+
+		impl::compact_pointer<xml_node_struct, 8, 0> first_child;
+
+		impl::compact_pointer<xml_node_struct,  9>    prev_sibling_c;
+		impl::compact_pointer<xml_node_struct, 10, 0> next_sibling;
+
+		impl::compact_pointer<xml_attribute_struct, 11, 0> first_attribute;
+	};
+}
+#else
+namespace pugi
+{
+	struct xml_attribute_struct
+	{
+		xml_attribute_struct(impl::xml_memory_page* page): name(NULL), value(NULL), prev_attribute_c(NULL), next_attribute(NULL)
+		{
+			header = PUGI_IMPL_GETHEADER_IMPL(this, page, 0);
+		}
+
+		uintptr_t header;
+
+		char_t*	name;
+		char_t*	value;
+
+		xml_attribute_struct* prev_attribute_c;
+		xml_attribute_struct* next_attribute;
+	};
+
+	struct xml_node_struct
+	{
+		xml_node_struct(impl::xml_memory_page* page, xml_node_type type): name(NULL), value(NULL), parent(NULL), first_child(NULL), prev_sibling_c(NULL), next_sibling(NULL), first_attribute(NULL)
+		{
+			header = PUGI_IMPL_GETHEADER_IMPL(this, page, type);
+		}
+
+		uintptr_t header;
+
+		char_t* name;
+		char_t* value;
+
+		xml_node_struct* parent;
+
+		xml_node_struct* first_child;
+
+		xml_node_struct* prev_sibling_c;
+		xml_node_struct* next_sibling;
+
+		xml_attribute_struct* first_attribute;
+	};
+}
+#endif
+
+PUGI_IMPL_NS_BEGIN
+	struct xml_extra_buffer
+	{
+		char_t* buffer;
+		xml_extra_buffer* next;
+	};
+
+	struct xml_document_struct: public xml_node_struct, public xml_allocator
+	{
+		xml_document_struct(xml_memory_page* page): xml_node_struct(page, node_document), xml_allocator(page), buffer(NULL), extra_buffers(NULL)
+		{
+		}
+
+		const char_t* buffer;
+
+		xml_extra_buffer* extra_buffers;
+
+	#ifdef PUGIXML_COMPACT
+		compact_hash_table hash;
+	#endif
+	};
+
+	template <typename Object> inline xml_allocator& get_allocator(const Object* object)
+	{
+		assert(object);
+
+		return *PUGI_IMPL_GETPAGE(object)->allocator;
+	}
+
+	template <typename Object> inline xml_document_struct& get_document(const Object* object)
+	{
+		assert(object);
+
+		return *static_cast<xml_document_struct*>(PUGI_IMPL_GETPAGE(object)->allocator);
+	}
+PUGI_IMPL_NS_END
+
+// Low-level DOM operations
+PUGI_IMPL_NS_BEGIN
+	inline xml_attribute_struct* allocate_attribute(xml_allocator& alloc)
+	{
+		xml_memory_page* page;
+		void* memory = alloc.allocate_object(sizeof(xml_attribute_struct), page);
+		if (!memory) return NULL;
+
+		return new (memory) xml_attribute_struct(page);
+	}
+
+	inline xml_node_struct* allocate_node(xml_allocator& alloc, xml_node_type type)
+	{
+		xml_memory_page* page;
+		void* memory = alloc.allocate_object(sizeof(xml_node_struct), page);
+		if (!memory) return NULL;
+
+		return new (memory) xml_node_struct(page, type);
+	}
+
+	inline void destroy_attribute(xml_attribute_struct* a, xml_allocator& alloc)
+	{
+		if (a->header & impl::xml_memory_page_name_allocated_mask)
+			alloc.deallocate_string(a->name);
+
+		if (a->header & impl::xml_memory_page_value_allocated_mask)
+			alloc.deallocate_string(a->value);
+
+		alloc.deallocate_memory(a, sizeof(xml_attribute_struct), PUGI_IMPL_GETPAGE(a));
+	}
+
+	inline void destroy_node(xml_node_struct* n, xml_allocator& alloc)
+	{
+		if (n->header & impl::xml_memory_page_name_allocated_mask)
+			alloc.deallocate_string(n->name);
+
+		if (n->header & impl::xml_memory_page_value_allocated_mask)
+			alloc.deallocate_string(n->value);
+
+		for (xml_attribute_struct* attr = n->first_attribute; attr; )
+		{
+			xml_attribute_struct* next = attr->next_attribute;
+
+			destroy_attribute(attr, alloc);
+
+			attr = next;
+		}
+
+		for (xml_node_struct* child = n->first_child; child; )
+		{
+			xml_node_struct* next = child->next_sibling;
+
+			destroy_node(child, alloc);
+
+			child = next;
+		}
+
+		alloc.deallocate_memory(n, sizeof(xml_node_struct), PUGI_IMPL_GETPAGE(n));
+	}
+
+	inline void append_node(xml_node_struct* child, xml_node_struct* node)
+	{
+		child->parent = node;
+
+		xml_node_struct* head = node->first_child;
+
+		if (head)
+		{
+			xml_node_struct* tail = head->prev_sibling_c;
+
+			tail->next_sibling = child;
+			child->prev_sibling_c = tail;
+			head->prev_sibling_c = child;
+		}
+		else
+		{
+			node->first_child = child;
+			child->prev_sibling_c = child;
+		}
+	}
+
+	inline void prepend_node(xml_node_struct* child, xml_node_struct* node)
+	{
+		child->parent = node;
+
+		xml_node_struct* head = node->first_child;
+
+		if (head)
+		{
+			child->prev_sibling_c = head->prev_sibling_c;
+			head->prev_sibling_c = child;
+		}
+		else
+			child->prev_sibling_c = child;
+
+		child->next_sibling = head;
+		node->first_child = child;
+	}
+
+	inline void insert_node_after(xml_node_struct* child, xml_node_struct* node)
+	{
+		xml_node_struct* parent = node->parent;
+
+		child->parent = parent;
+
+		xml_node_struct* next = node->next_sibling;
+
+		if (next)
+			next->prev_sibling_c = child;
+		else
+			parent->first_child->prev_sibling_c = child;
+
+		child->next_sibling = next;
+		child->prev_sibling_c = node;
+
+		node->next_sibling = child;
+	}
+
+	inline void insert_node_before(xml_node_struct* child, xml_node_struct* node)
+	{
+		xml_node_struct* parent = node->parent;
+
+		child->parent = parent;
+
+		xml_node_struct* prev = node->prev_sibling_c;
+
+		if (prev->next_sibling)
+			prev->next_sibling = child;
+		else
+			parent->first_child = child;
+
+		child->prev_sibling_c = prev;
+		child->next_sibling = node;
+
+		node->prev_sibling_c = child;
+	}
+
+	inline void remove_node(xml_node_struct* node)
+	{
+		xml_node_struct* parent = node->parent;
+
+		xml_node_struct* next = node->next_sibling;
+		xml_node_struct* prev = node->prev_sibling_c;
+
+		if (next)
+			next->prev_sibling_c = prev;
+		else
+			parent->first_child->prev_sibling_c = prev;
+
+		if (prev->next_sibling)
+			prev->next_sibling = next;
+		else
+			parent->first_child = next;
+
+		node->parent = NULL;
+		node->prev_sibling_c = NULL;
+		node->next_sibling = NULL;
+	}
+
+	inline void append_attribute(xml_attribute_struct* attr, xml_node_struct* node)
+	{
+		xml_attribute_struct* head = node->first_attribute;
+
+		if (head)
+		{
+			xml_attribute_struct* tail = head->prev_attribute_c;
+
+			tail->next_attribute = attr;
+			attr->prev_attribute_c = tail;
+			head->prev_attribute_c = attr;
+		}
+		else
+		{
+			node->first_attribute = attr;
+			attr->prev_attribute_c = attr;
+		}
+	}
+
+	inline void prepend_attribute(xml_attribute_struct* attr, xml_node_struct* node)
+	{
+		xml_attribute_struct* head = node->first_attribute;
+
+		if (head)
+		{
+			attr->prev_attribute_c = head->prev_attribute_c;
+			head->prev_attribute_c = attr;
+		}
+		else
+			attr->prev_attribute_c = attr;
+
+		attr->next_attribute = head;
+		node->first_attribute = attr;
+	}
+
+	inline void insert_attribute_after(xml_attribute_struct* attr, xml_attribute_struct* place, xml_node_struct* node)
+	{
+		xml_attribute_struct* next = place->next_attribute;
+
+		if (next)
+			next->prev_attribute_c = attr;
+		else
+			node->first_attribute->prev_attribute_c = attr;
+
+		attr->next_attribute = next;
+		attr->prev_attribute_c = place;
+		place->next_attribute = attr;
+	}
+
+	inline void insert_attribute_before(xml_attribute_struct* attr, xml_attribute_struct* place, xml_node_struct* node)
+	{
+		xml_attribute_struct* prev = place->prev_attribute_c;
+
+		if (prev->next_attribute)
+			prev->next_attribute = attr;
+		else
+			node->first_attribute = attr;
+
+		attr->prev_attribute_c = prev;
+		attr->next_attribute = place;
+		place->prev_attribute_c = attr;
+	}
+
+	inline void remove_attribute(xml_attribute_struct* attr, xml_node_struct* node)
+	{
+		xml_attribute_struct* next = attr->next_attribute;
+		xml_attribute_struct* prev = attr->prev_attribute_c;
+
+		if (next)
+			next->prev_attribute_c = prev;
+		else
+			node->first_attribute->prev_attribute_c = prev;
+
+		if (prev->next_attribute)
+			prev->next_attribute = next;
+		else
+			node->first_attribute = next;
+
+		attr->prev_attribute_c = NULL;
+		attr->next_attribute = NULL;
+	}
+
+	PUGI_IMPL_FN_NO_INLINE xml_node_struct* append_new_node(xml_node_struct* node, xml_allocator& alloc, xml_node_type type = node_element)
+	{
+		if (!alloc.reserve()) return NULL;
+
+		xml_node_struct* child = allocate_node(alloc, type);
+		if (!child) return NULL;
+
+		append_node(child, node);
+
+		return child;
+	}
+
+	PUGI_IMPL_FN_NO_INLINE xml_attribute_struct* append_new_attribute(xml_node_struct* node, xml_allocator& alloc)
+	{
+		if (!alloc.reserve()) return NULL;
+
+		xml_attribute_struct* attr = allocate_attribute(alloc);
+		if (!attr) return NULL;
+
+		append_attribute(attr, node);
+
+		return attr;
+	}
+PUGI_IMPL_NS_END
+
+// Helper classes for code generation
+PUGI_IMPL_NS_BEGIN
+	struct opt_false
+	{
+		enum { value = 0 };
+	};
+
+	struct opt_true
+	{
+		enum { value = 1 };
+	};
+PUGI_IMPL_NS_END
+
+// Unicode utilities
+PUGI_IMPL_NS_BEGIN
+	inline uint16_t endian_swap(uint16_t value)
+	{
+		return static_cast<uint16_t>(((value & 0xff) << 8) | (value >> 8));
+	}
+
+	inline uint32_t endian_swap(uint32_t value)
+	{
+		return ((value & 0xff) << 24) | ((value & 0xff00) << 8) | ((value & 0xff0000) >> 8) | (value >> 24);
+	}
+
+	struct utf8_counter
+	{
+		typedef size_t value_type;
+
+		static value_type low(value_type result, uint32_t ch)
+		{
+			// U+0000..U+007F
+			if (ch < 0x80) return result + 1;
+			// U+0080..U+07FF
+			else if (ch < 0x800) return result + 2;
+			// U+0800..U+FFFF
+			else return result + 3;
+		}
+
+		static value_type high(value_type result, uint32_t)
+		{
+			// U+10000..U+10FFFF
+			return result + 4;
+		}
+	};
+
+	struct utf8_writer
+	{
+		typedef uint8_t* value_type;
+
+		static value_type low(value_type result, uint32_t ch)
+		{
+			// U+0000..U+007F
+			if (ch < 0x80)
+			{
+				*result = static_cast<uint8_t>(ch);
+				return result + 1;
+			}
+			// U+0080..U+07FF
+			else if (ch < 0x800)
+			{
+				result[0] = static_cast<uint8_t>(0xC0 | (ch >> 6));
+				result[1] = static_cast<uint8_t>(0x80 | (ch & 0x3F));
+				return result + 2;
+			}
+			// U+0800..U+FFFF
+			else
+			{
+				result[0] = static_cast<uint8_t>(0xE0 | (ch >> 12));
+				result[1] = static_cast<uint8_t>(0x80 | ((ch >> 6) & 0x3F));
+				result[2] = static_cast<uint8_t>(0x80 | (ch & 0x3F));
+				return result + 3;
+			}
+		}
+
+		static value_type high(value_type result, uint32_t ch)
+		{
+			// U+10000..U+10FFFF
+			result[0] = static_cast<uint8_t>(0xF0 | (ch >> 18));
+			result[1] = static_cast<uint8_t>(0x80 | ((ch >> 12) & 0x3F));
+			result[2] = static_cast<uint8_t>(0x80 | ((ch >> 6) & 0x3F));
+			result[3] = static_cast<uint8_t>(0x80 | (ch & 0x3F));
+			return result + 4;
+		}
+
+		static value_type any(value_type result, uint32_t ch)
+		{
+			return (ch < 0x10000) ? low(result, ch) : high(result, ch);
+		}
+	};
+
+	struct utf16_counter
+	{
+		typedef size_t value_type;
+
+		static value_type low(value_type result, uint32_t)
+		{
+			return result + 1;
+		}
+
+		static value_type high(value_type result, uint32_t)
+		{
+			return result + 2;
+		}
+	};
+
+	struct utf16_writer
+	{
+		typedef uint16_t* value_type;
+
+		static value_type low(value_type result, uint32_t ch)
+		{
+			*result = static_cast<uint16_t>(ch);
+
+			return result + 1;
+		}
+
+		static value_type high(value_type result, uint32_t ch)
+		{
+			uint32_t msh = (ch - 0x10000U) >> 10;
+			uint32_t lsh = (ch - 0x10000U) & 0x3ff;
+
+			result[0] = static_cast<uint16_t>(0xD800 + msh);
+			result[1] = static_cast<uint16_t>(0xDC00 + lsh);
+
+			return result + 2;
+		}
+
+		static value_type any(value_type result, uint32_t ch)
+		{
+			return (ch < 0x10000) ? low(result, ch) : high(result, ch);
+		}
+	};
+
+	struct utf32_counter
+	{
+		typedef size_t value_type;
+
+		static value_type low(value_type result, uint32_t)
+		{
+			return result + 1;
+		}
+
+		static value_type high(value_type result, uint32_t)
+		{
+			return result + 1;
+		}
+	};
+
+	struct utf32_writer
+	{
+		typedef uint32_t* value_type;
+
+		static value_type low(value_type result, uint32_t ch)
+		{
+			*result = ch;
+
+			return result + 1;
+		}
+
+		static value_type high(value_type result, uint32_t ch)
+		{
+			*result = ch;
+
+			return result + 1;
+		}
+
+		static value_type any(value_type result, uint32_t ch)
+		{
+			*result = ch;
+
+			return result + 1;
+		}
+	};
+
+	struct latin1_writer
+	{
+		typedef uint8_t* value_type;
+
+		static value_type low(value_type result, uint32_t ch)
+		{
+			*result = static_cast<uint8_t>(ch > 255 ? '?' : ch);
+
+			return result + 1;
+		}
+
+		static value_type high(value_type result, uint32_t ch)
+		{
+			(void)ch;
+
+			*result = '?';
+
+			return result + 1;
+		}
+	};
+
+	struct utf8_decoder
+	{
+		typedef uint8_t type;
+
+		template <typename Traits> static inline typename Traits::value_type process(const uint8_t* data, size_t size, typename Traits::value_type result, Traits)
+		{
+			const uint8_t utf8_byte_mask = 0x3f;
+
+			while (size)
+			{
+				uint8_t lead = *data;
+
+				// 0xxxxxxx -> U+0000..U+007F
+				if (lead < 0x80)
+				{
+					result = Traits::low(result, lead);
+					data += 1;
+					size -= 1;
+
+					// process aligned single-byte (ascii) blocks
+					if ((reinterpret_cast<uintptr_t>(data) & 3) == 0)
+					{
+						// round-trip through void* to silence 'cast increases required alignment of target type' warnings
+						while (size >= 4 && (*static_cast<const uint32_t*>(static_cast<const void*>(data)) & 0x80808080) == 0)
+						{
+							result = Traits::low(result, data[0]);
+							result = Traits::low(result, data[1]);
+							result = Traits::low(result, data[2]);
+							result = Traits::low(result, data[3]);
+							data += 4;
+							size -= 4;
+						}
+					}
+				}
+				// 110xxxxx -> U+0080..U+07FF
+				else if (static_cast<unsigned int>(lead - 0xC0) < 0x20 && size >= 2 && (data[1] & 0xc0) == 0x80)
+				{
+					result = Traits::low(result, ((lead & ~0xC0) << 6) | (data[1] & utf8_byte_mask));
+					data += 2;
+					size -= 2;
+				}
+				// 1110xxxx -> U+0800-U+FFFF
+				else if (static_cast<unsigned int>(lead - 0xE0) < 0x10 && size >= 3 && (data[1] & 0xc0) == 0x80 && (data[2] & 0xc0) == 0x80)
+				{
+					result = Traits::low(result, ((lead & ~0xE0) << 12) | ((data[1] & utf8_byte_mask) << 6) | (data[2] & utf8_byte_mask));
+					data += 3;
+					size -= 3;
+				}
+				// 11110xxx -> U+10000..U+10FFFF
+				else if (static_cast<unsigned int>(lead - 0xF0) < 0x08 && size >= 4 && (data[1] & 0xc0) == 0x80 && (data[2] & 0xc0) == 0x80 && (data[3] & 0xc0) == 0x80)
+				{
+					result = Traits::high(result, ((lead & ~0xF0) << 18) | ((data[1] & utf8_byte_mask) << 12) | ((data[2] & utf8_byte_mask) << 6) | (data[3] & utf8_byte_mask));
+					data += 4;
+					size -= 4;
+				}
+				// 10xxxxxx or 11111xxx -> invalid
+				else
+				{
+					data += 1;
+					size -= 1;
+				}
+			}
+
+			return result;
+		}
+	};
+
+	template <typename opt_swap> struct utf16_decoder
+	{
+		typedef uint16_t type;
+
+		template <typename Traits> static inline typename Traits::value_type process(const uint16_t* data, size_t size, typename Traits::value_type result, Traits)
+		{
+			while (size)
+			{
+				uint16_t lead = opt_swap::value ? endian_swap(*data) : *data;
+
+				// U+0000..U+D7FF
+				if (lead < 0xD800)
+				{
+					result = Traits::low(result, lead);
+					data += 1;
+					size -= 1;
+				}
+				// U+E000..U+FFFF
+				else if (static_cast<unsigned int>(lead - 0xE000) < 0x2000)
+				{
+					result = Traits::low(result, lead);
+					data += 1;
+					size -= 1;
+				}
+				// surrogate pair lead
+				else if (static_cast<unsigned int>(lead - 0xD800) < 0x400 && size >= 2)
+				{
+					uint16_t next = opt_swap::value ? endian_swap(data[1]) : data[1];
+
+					if (static_cast<unsigned int>(next - 0xDC00) < 0x400)
+					{
+						result = Traits::high(result, 0x10000 + ((lead & 0x3ff) << 10) + (next & 0x3ff));
+						data += 2;
+						size -= 2;
+					}
+					else
+					{
+						data += 1;
+						size -= 1;
+					}
+				}
+				else
+				{
+					data += 1;
+					size -= 1;
+				}
+			}
+
+			return result;
+		}
+	};
+
+	template <typename opt_swap> struct utf32_decoder
+	{
+		typedef uint32_t type;
+
+		template <typename Traits> static inline typename Traits::value_type process(const uint32_t* data, size_t size, typename Traits::value_type result, Traits)
+		{
+			while (size)
+			{
+				uint32_t lead = opt_swap::value ? endian_swap(*data) : *data;
+
+				// U+0000..U+FFFF
+				if (lead < 0x10000)
+				{
+					result = Traits::low(result, lead);
+					data += 1;
+					size -= 1;
+				}
+				// U+10000..U+10FFFF
+				else
+				{
+					result = Traits::high(result, lead);
+					data += 1;
+					size -= 1;
+				}
+			}
+
+			return result;
+		}
+	};
+
+	struct latin1_decoder
+	{
+		typedef uint8_t type;
+
+		template <typename Traits> static inline typename Traits::value_type process(const uint8_t* data, size_t size, typename Traits::value_type result, Traits)
+		{
+			while (size)
+			{
+				result = Traits::low(result, *data);
+				data += 1;
+				size -= 1;
+			}
+
+			return result;
+		}
+	};
+
+	template <size_t size> struct wchar_selector;
+
+	template <> struct wchar_selector<2>
+	{
+		typedef uint16_t type;
+		typedef utf16_counter counter;
+		typedef utf16_writer writer;
+		typedef utf16_decoder<opt_false> decoder;
+	};
+
+	template <> struct wchar_selector<4>
+	{
+		typedef uint32_t type;
+		typedef utf32_counter counter;
+		typedef utf32_writer writer;
+		typedef utf32_decoder<opt_false> decoder;
+	};
+
+	typedef wchar_selector<sizeof(wchar_t)>::counter wchar_counter;
+	typedef wchar_selector<sizeof(wchar_t)>::writer wchar_writer;
+
+	struct wchar_decoder
+	{
+		typedef wchar_t type;
+
+		template <typename Traits> static inline typename Traits::value_type process(const wchar_t* data, size_t size, typename Traits::value_type result, Traits traits)
+		{
+			typedef wchar_selector<sizeof(wchar_t)>::decoder decoder;
+
+			return decoder::process(reinterpret_cast<const typename decoder::type*>(data), size, result, traits);
+		}
+	};
+
+#ifdef PUGIXML_WCHAR_MODE
+	PUGI_IMPL_FN void convert_wchar_endian_swap(wchar_t* result, const wchar_t* data, size_t length)
+	{
+		for (size_t i = 0; i < length; ++i)
+			result[i] = static_cast<wchar_t>(endian_swap(static_cast<wchar_selector<sizeof(wchar_t)>::type>(data[i])));
+	}
+#endif
+PUGI_IMPL_NS_END
+
+PUGI_IMPL_NS_BEGIN
+	enum chartype_t
+	{
+		ct_parse_pcdata = 1,	// \0, &, \r, <
+		ct_parse_attr = 2,		// \0, &, \r, ', "
+		ct_parse_attr_ws = 4,	// \0, &, \r, ', ", \n, tab
+		ct_space = 8,			// \r, \n, space, tab
+		ct_parse_cdata = 16,	// \0, ], >, \r
+		ct_parse_comment = 32,	// \0, -, >, \r
+		ct_symbol = 64,			// Any symbol > 127, a-z, A-Z, 0-9, _, :, -, .
+		ct_start_symbol = 128	// Any symbol > 127, a-z, A-Z, _, :
+	};
+
+	static const unsigned char chartype_table[256] =
+	{
+		55,  0,   0,   0,   0,   0,   0,   0,      0,   12,  12,  0,   0,   63,  0,   0,   // 0-15
+		0,   0,   0,   0,   0,   0,   0,   0,      0,   0,   0,   0,   0,   0,   0,   0,   // 16-31
+		8,   0,   6,   0,   0,   0,   7,   6,      0,   0,   0,   0,   0,   96,  64,  0,   // 32-47
+		64,  64,  64,  64,  64,  64,  64,  64,     64,  64,  192, 0,   1,   0,   48,  0,   // 48-63
+		0,   192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192, // 64-79
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 0,   0,   16,  0,   192, // 80-95
+		0,   192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192, // 96-111
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 0, 0, 0, 0, 0,           // 112-127
+
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192, // 128+
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192,
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192,
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192,
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192,
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192,
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192,
+		192, 192, 192, 192, 192, 192, 192, 192,    192, 192, 192, 192, 192, 192, 192, 192
+	};
+
+	enum chartypex_t
+	{
+		ctx_special_pcdata = 1,   // Any symbol >= 0 and < 32 (except \t, \r, \n), &, <, >
+		ctx_special_attr = 2,     // Any symbol >= 0 and < 32, &, <, ", '
+		ctx_start_symbol = 4,	  // Any symbol > 127, a-z, A-Z, _
+		ctx_digit = 8,			  // 0-9
+		ctx_symbol = 16			  // Any symbol > 127, a-z, A-Z, 0-9, _, -, .
+	};
+
+	static const unsigned char chartypex_table[256] =
+	{
+		3,  3,  3,  3,  3,  3,  3,  3,     3,  2,  2,  3,  3,  2,  3,  3,     // 0-15
+		3,  3,  3,  3,  3,  3,  3,  3,     3,  3,  3,  3,  3,  3,  3,  3,     // 16-31
+		0,  0,  2,  0,  0,  0,  3,  2,     0,  0,  0,  0,  0, 16, 16,  0,     // 32-47
+		24, 24, 24, 24, 24, 24, 24, 24,    24, 24, 0,  0,  3,  0,  1,  0,     // 48-63
+
+		0,  20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20,    // 64-79
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 0,  0,  0,  0,  20,    // 80-95
+		0,  20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20,    // 96-111
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 0,  0,  0,  0,  0,     // 112-127
+
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20,    // 128+
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20,
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20,
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20,
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20,
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20,
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20,
+		20, 20, 20, 20, 20, 20, 20, 20,    20, 20, 20, 20, 20, 20, 20, 20
+	};
+
+#ifdef PUGIXML_WCHAR_MODE
+	#define PUGI_IMPL_IS_CHARTYPE_IMPL(c, ct, table) ((static_cast<unsigned int>(c) < 128 ? table[static_cast<unsigned int>(c)] : table[128]) & (ct))
+#else
+	#define PUGI_IMPL_IS_CHARTYPE_IMPL(c, ct, table) (table[static_cast<unsigned char>(c)] & (ct))
+#endif
+
+	#define PUGI_IMPL_IS_CHARTYPE(c, ct) PUGI_IMPL_IS_CHARTYPE_IMPL(c, ct, chartype_table)
+	#define PUGI_IMPL_IS_CHARTYPEX(c, ct) PUGI_IMPL_IS_CHARTYPE_IMPL(c, ct, chartypex_table)
+
+	PUGI_IMPL_FN bool is_little_endian()
+	{
+		unsigned int ui = 1;
+
+		return *reinterpret_cast<unsigned char*>(&ui) == 1;
+	}
+
+	PUGI_IMPL_FN xml_encoding get_wchar_encoding()
+	{
+		PUGI_IMPL_STATIC_ASSERT(sizeof(wchar_t) == 2 || sizeof(wchar_t) == 4);
+
+		if (sizeof(wchar_t) == 2)
+			return is_little_endian() ? encoding_utf16_le : encoding_utf16_be;
+		else
+			return is_little_endian() ? encoding_utf32_le : encoding_utf32_be;
+	}
+
+	PUGI_IMPL_FN bool parse_declaration_encoding(const uint8_t* data, size_t size, const uint8_t*& out_encoding, size_t& out_length)
+	{
+	#define PUGI_IMPL_SCANCHAR(ch) { if (offset >= size || data[offset] != ch) return false; offset++; }
+	#define PUGI_IMPL_SCANCHARTYPE(ct) { while (offset < size && PUGI_IMPL_IS_CHARTYPE(data[offset], ct)) offset++; }
+
+		// check if we have a non-empty XML declaration
+		if (size < 6 || !((data[0] == '<') & (data[1] == '?') & (data[2] == 'x') & (data[3] == 'm') & (data[4] == 'l') && PUGI_IMPL_IS_CHARTYPE(data[5], ct_space)))
+			return false;
+
+		// scan XML declaration until the encoding field
+		for (size_t i = 6; i + 1 < size; ++i)
+		{
+			// declaration can not contain ? in quoted values
+			if (data[i] == '?')
+				return false;
+
+			if (data[i] == 'e' && data[i + 1] == 'n')
+			{
+				size_t offset = i;
+
+				// encoding follows the version field which can't contain 'en' so this has to be the encoding if XML is well formed
+				PUGI_IMPL_SCANCHAR('e'); PUGI_IMPL_SCANCHAR('n'); PUGI_IMPL_SCANCHAR('c'); PUGI_IMPL_SCANCHAR('o');
+				PUGI_IMPL_SCANCHAR('d'); PUGI_IMPL_SCANCHAR('i'); PUGI_IMPL_SCANCHAR('n'); PUGI_IMPL_SCANCHAR('g');
+
+				// S? = S?
+				PUGI_IMPL_SCANCHARTYPE(ct_space);
+				PUGI_IMPL_SCANCHAR('=');
+				PUGI_IMPL_SCANCHARTYPE(ct_space);
+
+				// the only two valid delimiters are ' and "
+				uint8_t delimiter = (offset < size && data[offset] == '"') ? '"' : '\'';
+
+				PUGI_IMPL_SCANCHAR(delimiter);
+
+				size_t start = offset;
+
+				out_encoding = data + offset;
+
+				PUGI_IMPL_SCANCHARTYPE(ct_symbol);
+
+				out_length = offset - start;
+
+				PUGI_IMPL_SCANCHAR(delimiter);
+
+				return true;
+			}
+		}
+
+		return false;
+
+	#undef PUGI_IMPL_SCANCHAR
+	#undef PUGI_IMPL_SCANCHARTYPE
+	}
+
+	PUGI_IMPL_FN xml_encoding guess_buffer_encoding(const uint8_t* data, size_t size)
+	{
+		// skip encoding autodetection if input buffer is too small
+		if (size < 4) return encoding_utf8;
+
+		uint8_t d0 = data[0], d1 = data[1], d2 = data[2], d3 = data[3];
+
+		// look for BOM in first few bytes
+		if (d0 == 0 && d1 == 0 && d2 == 0xfe && d3 == 0xff) return encoding_utf32_be;
+		if (d0 == 0xff && d1 == 0xfe && d2 == 0 && d3 == 0) return encoding_utf32_le;
+		if (d0 == 0xfe && d1 == 0xff) return encoding_utf16_be;
+		if (d0 == 0xff && d1 == 0xfe) return encoding_utf16_le;
+		if (d0 == 0xef && d1 == 0xbb && d2 == 0xbf) return encoding_utf8;
+
+		// look for <, <? or <?xm in various encodings
+		if (d0 == 0 && d1 == 0 && d2 == 0 && d3 == 0x3c) return encoding_utf32_be;
+		if (d0 == 0x3c && d1 == 0 && d2 == 0 && d3 == 0) return encoding_utf32_le;
+		if (d0 == 0 && d1 == 0x3c && d2 == 0 && d3 == 0x3f) return encoding_utf16_be;
+		if (d0 == 0x3c && d1 == 0 && d2 == 0x3f && d3 == 0) return encoding_utf16_le;
+
+		// look for utf16 < followed by node name (this may fail, but is better than utf8 since it's zero terminated so early)
+		if (d0 == 0 && d1 == 0x3c) return encoding_utf16_be;
+		if (d0 == 0x3c && d1 == 0) return encoding_utf16_le;
+
+		// no known BOM detected; parse declaration
+		const uint8_t* enc = NULL;
+		size_t enc_length = 0;
+
+		if (d0 == 0x3c && d1 == 0x3f && d2 == 0x78 && d3 == 0x6d && parse_declaration_encoding(data, size, enc, enc_length))
+		{
+			// iso-8859-1 (case-insensitive)
+			if (enc_length == 10
+				&& (enc[0] | ' ') == 'i' && (enc[1] | ' ') == 's' && (enc[2] | ' ') == 'o'
+				&& enc[3] == '-' && enc[4] == '8' && enc[5] == '8' && enc[6] == '5' && enc[7] == '9'
+				&& enc[8] == '-' && enc[9] == '1')
+				return encoding_latin1;
+
+			// latin1 (case-insensitive)
+			if (enc_length == 6
+				&& (enc[0] | ' ') == 'l' && (enc[1] | ' ') == 'a' && (enc[2] | ' ') == 't'
+				&& (enc[3] | ' ') == 'i' && (enc[4] | ' ') == 'n'
+				&& enc[5] == '1')
+				return encoding_latin1;
+		}
+
+		return encoding_utf8;
+	}
+
+	PUGI_IMPL_FN xml_encoding get_buffer_encoding(xml_encoding encoding, const void* contents, size_t size)
+	{
+		// replace wchar encoding with utf implementation
+		if (encoding == encoding_wchar) return get_wchar_encoding();
+
+		// replace utf16 encoding with utf16 with specific endianness
+		if (encoding == encoding_utf16) return is_little_endian() ? encoding_utf16_le : encoding_utf16_be;
+
+		// replace utf32 encoding with utf32 with specific endianness
+		if (encoding == encoding_utf32) return is_little_endian() ? encoding_utf32_le : encoding_utf32_be;
+
+		// only do autodetection if no explicit encoding is requested
+		if (encoding != encoding_auto) return encoding;
+
+		// try to guess encoding (based on XML specification, Appendix F.1)
+		const uint8_t* data = static_cast<const uint8_t*>(contents);
+
+		return guess_buffer_encoding(data, size);
+	}
+
+	PUGI_IMPL_FN bool get_mutable_buffer(char_t*& out_buffer, size_t& out_length, const void* contents, size_t size, bool is_mutable)
+	{
+		size_t length = size / sizeof(char_t);
+
+		if (is_mutable)
+		{
+			out_buffer = static_cast<char_t*>(const_cast<void*>(contents));
+			out_length = length;
+		}
+		else
+		{
+			char_t* buffer = static_cast<char_t*>(xml_memory::allocate((length + 1) * sizeof(char_t)));
+			if (!buffer) return false;
+
+			if (contents)
+				memcpy(buffer, contents, length * sizeof(char_t));
+			else
+				assert(length == 0);
+
+			buffer[length] = 0;
+
+			out_buffer = buffer;
+			out_length = length + 1;
+		}
+
+		return true;
+	}
+
+#ifdef PUGIXML_WCHAR_MODE
+	PUGI_IMPL_FN bool need_endian_swap_utf(xml_encoding le, xml_encoding re)
+	{
+		return (le == encoding_utf16_be && re == encoding_utf16_le) || (le == encoding_utf16_le && re == encoding_utf16_be) ||
+			   (le == encoding_utf32_be && re == encoding_utf32_le) || (le == encoding_utf32_le && re == encoding_utf32_be);
+	}
+
+	PUGI_IMPL_FN bool convert_buffer_endian_swap(char_t*& out_buffer, size_t& out_length, const void* contents, size_t size, bool is_mutable)
+	{
+		const char_t* data = static_cast<const char_t*>(contents);
+		size_t length = size / sizeof(char_t);
+
+		if (is_mutable)
+		{
+			char_t* buffer = const_cast<char_t*>(data);
+
+			convert_wchar_endian_swap(buffer, data, length);
+
+			out_buffer = buffer;
+			out_length = length;
+		}
+		else
+		{
+			char_t* buffer = static_cast<char_t*>(xml_memory::allocate((length + 1) * sizeof(char_t)));
+			if (!buffer) return false;
+
+			convert_wchar_endian_swap(buffer, data, length);
+			buffer[length] = 0;
+
+			out_buffer = buffer;
+			out_length = length + 1;
+		}
+
+		return true;
+	}
+
+	template <typename D> PUGI_IMPL_FN bool convert_buffer_generic(char_t*& out_buffer, size_t& out_length, const void* contents, size_t size, D)
+	{
+		const typename D::type* data = static_cast<const typename D::type*>(contents);
+		size_t data_length = size / sizeof(typename D::type);
+
+		// first pass: get length in wchar_t units
+		size_t length = D::process(data, data_length, 0, wchar_counter());
+
+		// allocate buffer of suitable length
+		char_t* buffer = static_cast<char_t*>(xml_memory::allocate((length + 1) * sizeof(char_t)));
+		if (!buffer) return false;
+
+		// second pass: convert utf16 input to wchar_t
+		wchar_writer::value_type obegin = reinterpret_cast<wchar_writer::value_type>(buffer);
+		wchar_writer::value_type oend = D::process(data, data_length, obegin, wchar_writer());
+
+		assert(oend == obegin + length);
+		*oend = 0;
+
+		out_buffer = buffer;
+		out_length = length + 1;
+
+		return true;
+	}
+
+	PUGI_IMPL_FN bool convert_buffer(char_t*& out_buffer, size_t& out_length, xml_encoding encoding, const void* contents, size_t size, bool is_mutable)
+	{
+		// get native encoding
+		xml_encoding wchar_encoding = get_wchar_encoding();
+
+		// fast path: no conversion required
+		if (encoding == wchar_encoding)
+			return get_mutable_buffer(out_buffer, out_length, contents, size, is_mutable);
+
+		// only endian-swapping is required
+		if (need_endian_swap_utf(encoding, wchar_encoding))
+			return convert_buffer_endian_swap(out_buffer, out_length, contents, size, is_mutable);
+
+		// source encoding is utf8
+		if (encoding == encoding_utf8)
+			return convert_buffer_generic(out_buffer, out_length, contents, size, utf8_decoder());
+
+		// source encoding is utf16
+		if (encoding == encoding_utf16_be || encoding == encoding_utf16_le)
+		{
+			xml_encoding native_encoding = is_little_endian() ? encoding_utf16_le : encoding_utf16_be;
+
+			return (native_encoding == encoding) ?
+				convert_buffer_generic(out_buffer, out_length, contents, size, utf16_decoder<opt_false>()) :
+				convert_buffer_generic(out_buffer, out_length, contents, size, utf16_decoder<opt_true>());
+		}
+
+		// source encoding is utf32
+		if (encoding == encoding_utf32_be || encoding == encoding_utf32_le)
+		{
+			xml_encoding native_encoding = is_little_endian() ? encoding_utf32_le : encoding_utf32_be;
+
+			return (native_encoding == encoding) ?
+				convert_buffer_generic(out_buffer, out_length, contents, size, utf32_decoder<opt_false>()) :
+				convert_buffer_generic(out_buffer, out_length, contents, size, utf32_decoder<opt_true>());
+		}
+
+		// source encoding is latin1
+		if (encoding == encoding_latin1)
+			return convert_buffer_generic(out_buffer, out_length, contents, size, latin1_decoder());
+
+		assert(false && "Invalid encoding"); // unreachable
+		return false;
+	}
+#else
+	template <typename D> PUGI_IMPL_FN bool convert_buffer_generic(char_t*& out_buffer, size_t& out_length, const void* contents, size_t size, D)
+	{
+		const typename D::type* data = static_cast<const typename D::type*>(contents);
+		size_t data_length = size / sizeof(typename D::type);
+
+		// first pass: get length in utf8 units
+		size_t length = D::process(data, data_length, 0, utf8_counter());
+
+		// allocate buffer of suitable length
+		char_t* buffer = static_cast<char_t*>(xml_memory::allocate((length + 1) * sizeof(char_t)));
+		if (!buffer) return false;
+
+		// second pass: convert utf16 input to utf8
+		uint8_t* obegin = reinterpret_cast<uint8_t*>(buffer);
+		uint8_t* oend = D::process(data, data_length, obegin, utf8_writer());
+
+		assert(oend == obegin + length);
+		*oend = 0;
+
+		out_buffer = buffer;
+		out_length = length + 1;
+
+		return true;
+	}
+
+	PUGI_IMPL_FN size_t get_latin1_7bit_prefix_length(const uint8_t* data, size_t size)
+	{
+		for (size_t i = 0; i < size; ++i)
+			if (data[i] > 127)
+				return i;
+
+		return size;
+	}
+
+	PUGI_IMPL_FN bool convert_buffer_latin1(char_t*& out_buffer, size_t& out_length, const void* contents, size_t size, bool is_mutable)
+	{
+		const uint8_t* data = static_cast<const uint8_t*>(contents);
+		size_t data_length = size;
+
+		// get size of prefix that does not need utf8 conversion
+		size_t prefix_length = get_latin1_7bit_prefix_length(data, data_length);
+		assert(prefix_length <= data_length);
+
+		const uint8_t* postfix = data + prefix_length;
+		size_t postfix_length = data_length - prefix_length;
+
+		// if no conversion is needed, just return the original buffer
+		if (postfix_length == 0) return get_mutable_buffer(out_buffer, out_length, contents, size, is_mutable);
+
+		// first pass: get length in utf8 units
+		size_t length = prefix_length + latin1_decoder::process(postfix, postfix_length, 0, utf8_counter());
+
+		// allocate buffer of suitable length
+		char_t* buffer = static_cast<char_t*>(xml_memory::allocate((length + 1) * sizeof(char_t)));
+		if (!buffer) return false;
+
+		// second pass: convert latin1 input to utf8
+		memcpy(buffer, data, prefix_length);
+
+		uint8_t* obegin = reinterpret_cast<uint8_t*>(buffer);
+		uint8_t* oend = latin1_decoder::process(postfix, postfix_length, obegin + prefix_length, utf8_writer());
+
+		assert(oend == obegin + length);
+		*oend = 0;
+
+		out_buffer = buffer;
+		out_length = length + 1;
+
+		return true;
+	}
+
+	PUGI_IMPL_FN bool convert_buffer(char_t*& out_buffer, size_t& out_length, xml_encoding encoding, const void* contents, size_t size, bool is_mutable)
+	{
+		// fast path: no conversion required
+		if (encoding == encoding_utf8)
+			return get_mutable_buffer(out_buffer, out_length, contents, size, is_mutable);
+
+		// source encoding is utf16
+		if (encoding == encoding_utf16_be || encoding == encoding_utf16_le)
+		{
+			xml_encoding native_encoding = is_little_endian() ? encoding_utf16_le : encoding_utf16_be;
+
+			return (native_encoding == encoding) ?
+				convert_buffer_generic(out_buffer, out_length, contents, size, utf16_decoder<opt_false>()) :
+				convert_buffer_generic(out_buffer, out_length, contents, size, utf16_decoder<opt_true>());
+		}
+
+		// source encoding is utf32
+		if (encoding == encoding_utf32_be || encoding == encoding_utf32_le)
+		{
+			xml_encoding native_encoding = is_little_endian() ? encoding_utf32_le : encoding_utf32_be;
+
+			return (native_encoding == encoding) ?
+				convert_buffer_generic(out_buffer, out_length, contents, size, utf32_decoder<opt_false>()) :
+				convert_buffer_generic(out_buffer, out_length, contents, size, utf32_decoder<opt_true>());
+		}
+
+		// source encoding is latin1
+		if (encoding == encoding_latin1)
+			return convert_buffer_latin1(out_buffer, out_length, contents, size, is_mutable);
+
+		assert(false && "Invalid encoding"); // unreachable
+		return false;
+	}
+#endif
+
+	PUGI_IMPL_FN size_t as_utf8_begin(const wchar_t* str, size_t length)
+	{
+		// get length in utf8 characters
+		return wchar_decoder::process(str, length, 0, utf8_counter());
+	}
+
+	PUGI_IMPL_FN void as_utf8_end(char* buffer, size_t size, const wchar_t* str, size_t length)
+	{
+		// convert to utf8
+		uint8_t* begin = reinterpret_cast<uint8_t*>(buffer);
+		uint8_t* end = wchar_decoder::process(str, length, begin, utf8_writer());
+
+		assert(begin + size == end);
+		(void)!end;
+		(void)!size;
+	}
+
+#ifndef PUGIXML_NO_STL
+	PUGI_IMPL_FN std::string as_utf8_impl(const wchar_t* str, size_t length)
+	{
+		// first pass: get length in utf8 characters
+		size_t size = as_utf8_begin(str, length);
+
+		// allocate resulting string
+		std::string result;
+		result.resize(size);
+
+		// second pass: convert to utf8
+		if (size > 0) as_utf8_end(&result[0], size, str, length);
+
+		return result;
+	}
+
+	PUGI_IMPL_FN std::basic_string<wchar_t> as_wide_impl(const char* str, size_t size)
+	{
+		const uint8_t* data = reinterpret_cast<const uint8_t*>(str);
+
+		// first pass: get length in wchar_t units
+		size_t length = utf8_decoder::process(data, size, 0, wchar_counter());
+
+		// allocate resulting string
+		std::basic_string<wchar_t> result;
+		result.resize(length);
+
+		// second pass: convert to wchar_t
+		if (length > 0)
+		{
+			wchar_writer::value_type begin = reinterpret_cast<wchar_writer::value_type>(&result[0]);
+			wchar_writer::value_type end = utf8_decoder::process(data, size, begin, wchar_writer());
+
+			assert(begin + length == end);
+			(void)!end;
+		}
+
+		return result;
+	}
+#endif
+
+	template <typename Header>
+	inline bool strcpy_insitu_allow(size_t length, const Header& header, uintptr_t header_mask, char_t* target)
+	{
+		// never reuse shared memory
+		if (header & xml_memory_page_contents_shared_mask) return false;
+
+		size_t target_length = strlength(target);
+
+		// always reuse document buffer memory if possible
+		if ((header & header_mask) == 0) return target_length >= length;
+
+		// reuse heap memory if waste is not too great
+		const size_t reuse_threshold = 32;
+
+		return target_length >= length && (target_length < reuse_threshold || target_length - length < target_length / 2);
+	}
+
+	template <typename String, typename Header>
+	PUGI_IMPL_FN bool strcpy_insitu(String& dest, Header& header, uintptr_t header_mask, const char_t* source, size_t source_length)
+	{
+		assert((header & header_mask) == 0 || dest); // header bit indicates whether dest was previously allocated
+
+		if (source_length == 0)
+		{
+			// empty string and null pointer are equivalent, so just deallocate old memory
+			xml_allocator* alloc = PUGI_IMPL_GETPAGE_IMPL(header)->allocator;
+
+			if (header & header_mask) alloc->deallocate_string(dest);
+
+			// mark the string as not allocated
+			dest = NULL;
+			header &= ~header_mask;
+
+			return true;
+		}
+		else if (dest && strcpy_insitu_allow(source_length, header, header_mask, dest))
+		{
+			// we can reuse old buffer, so just copy the new data (including zero terminator)
+			memcpy(dest, source, source_length * sizeof(char_t));
+			dest[source_length] = 0;
+
+			return true;
+		}
+		else
+		{
+			xml_allocator* alloc = PUGI_IMPL_GETPAGE_IMPL(header)->allocator;
+
+			if (!alloc->reserve()) return false;
+
+			// allocate new buffer
+			char_t* buf = alloc->allocate_string(source_length + 1);
+			if (!buf) return false;
+
+			// copy the string (including zero terminator)
+			memcpy(buf, source, source_length * sizeof(char_t));
+			buf[source_length] = 0;
+
+			// deallocate old buffer (*after* the above to protect against overlapping memory and/or allocation failures)
+			if (header & header_mask) alloc->deallocate_string(dest);
+
+			// the string is now allocated, so set the flag
+			dest = buf;
+			header |= header_mask;
+
+			return true;
+		}
+	}
+
+	struct gap
+	{
+		char_t* end;
+		size_t size;
+
+		gap(): end(NULL), size(0)
+		{
+		}
+
+		// Push new gap, move s count bytes further (skipping the gap).
+		// Collapse previous gap.
+		void push(char_t*& s, size_t count)
+		{
+			if (end) // there was a gap already; collapse it
+			{
+				// Move [old_gap_end, new_gap_start) to [old_gap_start, ...)
+				assert(s >= end);
+				memmove(end - size, end, (s - end) * sizeof(char_t));
+			}
+
+			s += count; // end of current gap
+
+			// "merge" two gaps
+			end = s;
+			size += count;
+		}
+
+		// Collapse all gaps, return past-the-end pointer
+		char_t* flush(char_t* s)
+		{
+			if (end)
+			{
+				// Move [old_gap_end, current_pos) to [old_gap_start, ...)
+				assert(s >= end);
+				memmove(end - size, end, (s - end) * sizeof(char_t));
+
+				return s - size;
+			}
+			else return s;
+		}
+	};
+
+	PUGI_IMPL_FN char_t* strconv_escape(char_t* s, gap& g)
+	{
+		char_t* stre = s + 1;
+
+		switch (*stre)
+		{
+			case '#':	// &#...
+			{
+				unsigned int ucsc = 0;
+
+				if (stre[1] == 'x') // &#x... (hex code)
+				{
+					stre += 2;
+
+					char_t ch = *stre;
+
+					if (ch == ';') return stre;
+
+					for (;;)
+					{
+						if (static_cast<unsigned int>(ch - '0') <= 9)
+							ucsc = 16 * ucsc + (ch - '0');
+						else if (static_cast<unsigned int>((ch | ' ') - 'a') <= 5)
+							ucsc = 16 * ucsc + ((ch | ' ') - 'a' + 10);
+						else if (ch == ';')
+							break;
+						else // cancel
+							return stre;
+
+						ch = *++stre;
+					}
+
+					++stre;
+				}
+				else	// &#... (dec code)
+				{
+					char_t ch = *++stre;
+
+					if (ch == ';') return stre;
+
+					for (;;)
+					{
+						if (static_cast<unsigned int>(ch - '0') <= 9)
+							ucsc = 10 * ucsc + (ch - '0');
+						else if (ch == ';')
+							break;
+						else // cancel
+							return stre;
+
+						ch = *++stre;
+					}
+
+					++stre;
+				}
+
+			#ifdef PUGIXML_WCHAR_MODE
+				s = reinterpret_cast<char_t*>(wchar_writer::any(reinterpret_cast<wchar_writer::value_type>(s), ucsc));
+			#else
+				s = reinterpret_cast<char_t*>(utf8_writer::any(reinterpret_cast<uint8_t*>(s), ucsc));
+			#endif
+
+				g.push(s, stre - s);
+				return stre;
+			}
+
+			case 'a':	// &a
+			{
+				++stre;
+
+				if (*stre == 'm') // &am
+				{
+					if (*++stre == 'p' && *++stre == ';') // &amp;
+					{
+						*s++ = '&';
+						++stre;
+
+						g.push(s, stre - s);
+						return stre;
+					}
+				}
+				else if (*stre == 'p') // &ap
+				{
+					if (*++stre == 'o' && *++stre == 's' && *++stre == ';') // &apos;
+					{
+						*s++ = '\'';
+						++stre;
+
+						g.push(s, stre - s);
+						return stre;
+					}
+				}
+				break;
+			}
+
+			case 'g': // &g
+			{
+				if (*++stre == 't' && *++stre == ';') // &gt;
+				{
+					*s++ = '>';
+					++stre;
+
+					g.push(s, stre - s);
+					return stre;
+				}
+				break;
+			}
+
+			case 'l': // &l
+			{
+				if (*++stre == 't' && *++stre == ';') // &lt;
+				{
+					*s++ = '<';
+					++stre;
+
+					g.push(s, stre - s);
+					return stre;
+				}
+				break;
+			}
+
+			case 'q': // &q
+			{
+				if (*++stre == 'u' && *++stre == 'o' && *++stre == 't' && *++stre == ';') // &quot;
+				{
+					*s++ = '"';
+					++stre;
+
+					g.push(s, stre - s);
+					return stre;
+				}
+				break;
+			}
+
+			default:
+				break;
+		}
+
+		return stre;
+	}
+
+	// Parser utilities
+	#define PUGI_IMPL_ENDSWITH(c, e)        ((c) == (e) || ((c) == 0 && endch == (e)))
+	#define PUGI_IMPL_SKIPWS()              { while (PUGI_IMPL_IS_CHARTYPE(*s, ct_space)) ++s; }
+	#define PUGI_IMPL_OPTSET(OPT)           ( optmsk & (OPT) )
+	#define PUGI_IMPL_PUSHNODE(TYPE)        { cursor = append_new_node(cursor, *alloc, TYPE); if (!cursor) PUGI_IMPL_THROW_ERROR(status_out_of_memory, s); }
+	#define PUGI_IMPL_POPNODE()             { cursor = cursor->parent; }
+	#define PUGI_IMPL_SCANFOR(X)            { while (*s != 0 && !(X)) ++s; }
+	#define PUGI_IMPL_SCANWHILE(X)          { while (X) ++s; }
+	#define PUGI_IMPL_SCANWHILE_UNROLL(X)   { for (;;) { char_t ss = s[0]; if (PUGI_IMPL_UNLIKELY(!(X))) { break; } ss = s[1]; if (PUGI_IMPL_UNLIKELY(!(X))) { s += 1; break; } ss = s[2]; if (PUGI_IMPL_UNLIKELY(!(X))) { s += 2; break; } ss = s[3]; if (PUGI_IMPL_UNLIKELY(!(X))) { s += 3; break; } s += 4; } }
+	#define PUGI_IMPL_ENDSEG()              { ch = *s; *s = 0; ++s; }
+	#define PUGI_IMPL_THROW_ERROR(err, m)   return error_offset = m, error_status = err, static_cast<char_t*>(NULL)
+	#define PUGI_IMPL_CHECK_ERROR(err, m)   { if (*s == 0) PUGI_IMPL_THROW_ERROR(err, m); }
+
+	PUGI_IMPL_FN char_t* strconv_comment(char_t* s, char_t endch)
+	{
+		gap g;
+
+		while (true)
+		{
+			PUGI_IMPL_SCANWHILE_UNROLL(!PUGI_IMPL_IS_CHARTYPE(ss, ct_parse_comment));
+
+			if (*s == '\r') // Either a single 0x0d or 0x0d 0x0a pair
+			{
+				*s++ = '\n'; // replace first one with 0x0a
+
+				if (*s == '\n') g.push(s, 1);
+			}
+			else if (s[0] == '-' && s[1] == '-' && PUGI_IMPL_ENDSWITH(s[2], '>')) // comment ends here
+			{
+				*g.flush(s) = 0;
+
+				return s + (s[2] == '>' ? 3 : 2);
+			}
+			else if (*s == 0)
+			{
+				return NULL;
+			}
+			else ++s;
+		}
+	}
+
+	PUGI_IMPL_FN char_t* strconv_cdata(char_t* s, char_t endch)
+	{
+		gap g;
+
+		while (true)
+		{
+			PUGI_IMPL_SCANWHILE_UNROLL(!PUGI_IMPL_IS_CHARTYPE(ss, ct_parse_cdata));
+
+			if (*s == '\r') // Either a single 0x0d or 0x0d 0x0a pair
+			{
+				*s++ = '\n'; // replace first one with 0x0a
+
+				if (*s == '\n') g.push(s, 1);
+			}
+			else if (s[0] == ']' && s[1] == ']' && PUGI_IMPL_ENDSWITH(s[2], '>')) // CDATA ends here
+			{
+				*g.flush(s) = 0;
+
+				return s + 1;
+			}
+			else if (*s == 0)
+			{
+				return NULL;
+			}
+			else ++s;
+		}
+	}
+
+	typedef char_t* (*strconv_pcdata_t)(char_t*);
+
+	template <typename opt_trim, typename opt_eol, typename opt_escape> struct strconv_pcdata_impl
+	{
+		static char_t* parse(char_t* s)
+		{
+			gap g;
+
+			char_t* begin = s;
+
+			while (true)
+			{
+				PUGI_IMPL_SCANWHILE_UNROLL(!PUGI_IMPL_IS_CHARTYPE(ss, ct_parse_pcdata));
+
+				if (*s == '<') // PCDATA ends here
+				{
+					char_t* end = g.flush(s);
+
+					if (opt_trim::value)
+						while (end > begin && PUGI_IMPL_IS_CHARTYPE(end[-1], ct_space))
+							--end;
+
+					*end = 0;
+
+					return s + 1;
+				}
+				else if (opt_eol::value && *s == '\r') // Either a single 0x0d or 0x0d 0x0a pair
+				{
+					*s++ = '\n'; // replace first one with 0x0a
+
+					if (*s == '\n') g.push(s, 1);
+				}
+				else if (opt_escape::value && *s == '&')
+				{
+					s = strconv_escape(s, g);
+				}
+				else if (*s == 0)
+				{
+					char_t* end = g.flush(s);
+
+					if (opt_trim::value)
+						while (end > begin && PUGI_IMPL_IS_CHARTYPE(end[-1], ct_space))
+							--end;
+
+					*end = 0;
+
+					return s;
+				}
+				else ++s;
+			}
+		}
+	};
+
+	PUGI_IMPL_FN strconv_pcdata_t get_strconv_pcdata(unsigned int optmask)
+	{
+		PUGI_IMPL_STATIC_ASSERT(parse_escapes == 0x10 && parse_eol == 0x20 && parse_trim_pcdata == 0x0800);
+
+		switch (((optmask >> 4) & 3) | ((optmask >> 9) & 4)) // get bitmask for flags (trim eol escapes); this simultaneously checks 3 options from assertion above
+		{
+		case 0: return strconv_pcdata_impl<opt_false, opt_false, opt_false>::parse;
+		case 1: return strconv_pcdata_impl<opt_false, opt_false, opt_true>::parse;
+		case 2: return strconv_pcdata_impl<opt_false, opt_true, opt_false>::parse;
+		case 3: return strconv_pcdata_impl<opt_false, opt_true, opt_true>::parse;
+		case 4: return strconv_pcdata_impl<opt_true, opt_false, opt_false>::parse;
+		case 5: return strconv_pcdata_impl<opt_true, opt_false, opt_true>::parse;
+		case 6: return strconv_pcdata_impl<opt_true, opt_true, opt_false>::parse;
+		case 7: return strconv_pcdata_impl<opt_true, opt_true, opt_true>::parse;
+		default: assert(false); return NULL; // unreachable
+		}
+	}
+
+	typedef char_t* (*strconv_attribute_t)(char_t*, char_t);
+
+	template <typename opt_escape> struct strconv_attribute_impl
+	{
+		static char_t* parse_wnorm(char_t* s, char_t end_quote)
+		{
+			gap g;
+
+			// trim leading whitespaces
+			if (PUGI_IMPL_IS_CHARTYPE(*s, ct_space))
+			{
+				char_t* str = s;
+
+				do ++str;
+				while (PUGI_IMPL_IS_CHARTYPE(*str, ct_space));
+
+				g.push(s, str - s);
+			}
+
+			while (true)
+			{
+				PUGI_IMPL_SCANWHILE_UNROLL(!PUGI_IMPL_IS_CHARTYPE(ss, ct_parse_attr_ws | ct_space));
+
+				if (*s == end_quote)
+				{
+					char_t* str = g.flush(s);
+
+					do *str-- = 0;
+					while (PUGI_IMPL_IS_CHARTYPE(*str, ct_space));
+
+					return s + 1;
+				}
+				else if (PUGI_IMPL_IS_CHARTYPE(*s, ct_space))
+				{
+					*s++ = ' ';
+
+					if (PUGI_IMPL_IS_CHARTYPE(*s, ct_space))
+					{
+						char_t* str = s + 1;
+						while (PUGI_IMPL_IS_CHARTYPE(*str, ct_space)) ++str;
+
+						g.push(s, str - s);
+					}
+				}
+				else if (opt_escape::value && *s == '&')
+				{
+					s = strconv_escape(s, g);
+				}
+				else if (!*s)
+				{
+					return NULL;
+				}
+				else ++s;
+			}
+		}
+
+		static char_t* parse_wconv(char_t* s, char_t end_quote)
+		{
+			gap g;
+
+			while (true)
+			{
+				PUGI_IMPL_SCANWHILE_UNROLL(!PUGI_IMPL_IS_CHARTYPE(ss, ct_parse_attr_ws));
+
+				if (*s == end_quote)
+				{
+					*g.flush(s) = 0;
+
+					return s + 1;
+				}
+				else if (PUGI_IMPL_IS_CHARTYPE(*s, ct_space))
+				{
+					if (*s == '\r')
+					{
+						*s++ = ' ';
+
+						if (*s == '\n') g.push(s, 1);
+					}
+					else *s++ = ' ';
+				}
+				else if (opt_escape::value && *s == '&')
+				{
+					s = strconv_escape(s, g);
+				}
+				else if (!*s)
+				{
+					return NULL;
+				}
+				else ++s;
+			}
+		}
+
+		static char_t* parse_eol(char_t* s, char_t end_quote)
+		{
+			gap g;
+
+			while (true)
+			{
+				PUGI_IMPL_SCANWHILE_UNROLL(!PUGI_IMPL_IS_CHARTYPE(ss, ct_parse_attr));
+
+				if (*s == end_quote)
+				{
+					*g.flush(s) = 0;
+
+					return s + 1;
+				}
+				else if (*s == '\r')
+				{
+					*s++ = '\n';
+
+					if (*s == '\n') g.push(s, 1);
+				}
+				else if (opt_escape::value && *s == '&')
+				{
+					s = strconv_escape(s, g);
+				}
+				else if (!*s)
+				{
+					return NULL;
+				}
+				else ++s;
+			}
+		}
+
+		static char_t* parse_simple(char_t* s, char_t end_quote)
+		{
+			gap g;
+
+			while (true)
+			{
+				PUGI_IMPL_SCANWHILE_UNROLL(!PUGI_IMPL_IS_CHARTYPE(ss, ct_parse_attr));
+
+				if (*s == end_quote)
+				{
+					*g.flush(s) = 0;
+
+					return s + 1;
+				}
+				else if (opt_escape::value && *s == '&')
+				{
+					s = strconv_escape(s, g);
+				}
+				else if (!*s)
+				{
+					return NULL;
+				}
+				else ++s;
+			}
+		}
+	};
+
+	PUGI_IMPL_FN strconv_attribute_t get_strconv_attribute(unsigned int optmask)
+	{
+		PUGI_IMPL_STATIC_ASSERT(parse_escapes == 0x10 && parse_eol == 0x20 && parse_wconv_attribute == 0x40 && parse_wnorm_attribute == 0x80);
+
+		switch ((optmask >> 4) & 15) // get bitmask for flags (wnorm wconv eol escapes); this simultaneously checks 4 options from assertion above
+		{
+		case 0:  return strconv_attribute_impl<opt_false>::parse_simple;
+		case 1:  return strconv_attribute_impl<opt_true>::parse_simple;
+		case 2:  return strconv_attribute_impl<opt_false>::parse_eol;
+		case 3:  return strconv_attribute_impl<opt_true>::parse_eol;
+		case 4:  return strconv_attribute_impl<opt_false>::parse_wconv;
+		case 5:  return strconv_attribute_impl<opt_true>::parse_wconv;
+		case 6:  return strconv_attribute_impl<opt_false>::parse_wconv;
+		case 7:  return strconv_attribute_impl<opt_true>::parse_wconv;
+		case 8:  return strconv_attribute_impl<opt_false>::parse_wnorm;
+		case 9:  return strconv_attribute_impl<opt_true>::parse_wnorm;
+		case 10: return strconv_attribute_impl<opt_false>::parse_wnorm;
+		case 11: return strconv_attribute_impl<opt_true>::parse_wnorm;
+		case 12: return strconv_attribute_impl<opt_false>::parse_wnorm;
+		case 13: return strconv_attribute_impl<opt_true>::parse_wnorm;
+		case 14: return strconv_attribute_impl<opt_false>::parse_wnorm;
+		case 15: return strconv_attribute_impl<opt_true>::parse_wnorm;
+		default: assert(false); return NULL; // unreachable
+		}
+	}
+
+	inline xml_parse_result make_parse_result(xml_parse_status status, ptrdiff_t offset = 0)
+	{
+		xml_parse_result result;
+		result.status = status;
+		result.offset = offset;
+
+		return result;
+	}
+
+	struct xml_parser
+	{
+		xml_allocator* alloc;
+		char_t* error_offset;
+		xml_parse_status error_status;
+
+		xml_parser(xml_allocator* alloc_): alloc(alloc_), error_offset(NULL), error_status(status_ok)
+		{
+		}
+
+		// DOCTYPE consists of nested sections of the following possible types:
+		// <!-- ... -->, <? ... ?>, "...", '...'
+		// <![...]]>
+		// <!...>
+		// First group can not contain nested groups
+		// Second group can contain nested groups of the same type
+		// Third group can contain all other groups
+		char_t* parse_doctype_primitive(char_t* s)
+		{
+			if (*s == '"' || *s == '\'')
+			{
+				// quoted string
+				char_t ch = *s++;
+				PUGI_IMPL_SCANFOR(*s == ch);
+				if (!*s) PUGI_IMPL_THROW_ERROR(status_bad_doctype, s);
+
+				s++;
+			}
+			else if (s[0] == '<' && s[1] == '?')
+			{
+				// <? ... ?>
+				s += 2;
+				PUGI_IMPL_SCANFOR(s[0] == '?' && s[1] == '>'); // no need for ENDSWITH because ?> can't terminate proper doctype
+				if (!*s) PUGI_IMPL_THROW_ERROR(status_bad_doctype, s);
+
+				s += 2;
+			}
+			else if (s[0] == '<' && s[1] == '!' && s[2] == '-' && s[3] == '-')
+			{
+				s += 4;
+				PUGI_IMPL_SCANFOR(s[0] == '-' && s[1] == '-' && s[2] == '>'); // no need for ENDSWITH because --> can't terminate proper doctype
+				if (!*s) PUGI_IMPL_THROW_ERROR(status_bad_doctype, s);
+
+				s += 3;
+			}
+			else PUGI_IMPL_THROW_ERROR(status_bad_doctype, s);
+
+			return s;
+		}
+
+		char_t* parse_doctype_ignore(char_t* s)
+		{
+			size_t depth = 0;
+
+			assert(s[0] == '<' && s[1] == '!' && s[2] == '[');
+			s += 3;
+
+			while (*s)
+			{
+				if (s[0] == '<' && s[1] == '!' && s[2] == '[')
+				{
+					// nested ignore section
+					s += 3;
+					depth++;
+				}
+				else if (s[0] == ']' && s[1] == ']' && s[2] == '>')
+				{
+					// ignore section end
+					s += 3;
+
+					if (depth == 0)
+						return s;
+
+					depth--;
+				}
+				else s++;
+			}
+
+			PUGI_IMPL_THROW_ERROR(status_bad_doctype, s);
+		}
+
+		char_t* parse_doctype_group(char_t* s, char_t endch)
+		{
+			size_t depth = 0;
+
+			assert((s[0] == '<' || s[0] == 0) && s[1] == '!');
+			s += 2;
+
+			while (*s)
+			{
+				if (s[0] == '<' && s[1] == '!' && s[2] != '-')
+				{
+					if (s[2] == '[')
+					{
+						// ignore
+						s = parse_doctype_ignore(s);
+						if (!s) return s;
+					}
+					else
+					{
+						// some control group
+						s += 2;
+						depth++;
+					}
+				}
+				else if (s[0] == '<' || s[0] == '"' || s[0] == '\'')
+				{
+					// unknown tag (forbidden), or some primitive group
+					s = parse_doctype_primitive(s);
+					if (!s) return s;
+				}
+				else if (*s == '>')
+				{
+					if (depth == 0)
+						return s;
+
+					depth--;
+					s++;
+				}
+				else s++;
+			}
+
+			if (depth != 0 || endch != '>') PUGI_IMPL_THROW_ERROR(status_bad_doctype, s);
+
+			return s;
+		}
+
+		char_t* parse_exclamation(char_t* s, xml_node_struct* cursor, unsigned int optmsk, char_t endch)
+		{
+			// parse node contents, starting with exclamation mark
+			++s;
+
+			if (*s == '-') // '<!-...'
+			{
+				++s;
+
+				if (*s == '-') // '<!--...'
+				{
+					++s;
+
+					if (PUGI_IMPL_OPTSET(parse_comments))
+					{
+						PUGI_IMPL_PUSHNODE(node_comment); // Append a new node on the tree.
+						cursor->value = s; // Save the offset.
+					}
+
+					if (PUGI_IMPL_OPTSET(parse_eol) && PUGI_IMPL_OPTSET(parse_comments))
+					{
+						s = strconv_comment(s, endch);
+
+						if (!s) PUGI_IMPL_THROW_ERROR(status_bad_comment, cursor->value);
+					}
+					else
+					{
+						// Scan for terminating '-->'.
+						PUGI_IMPL_SCANFOR(s[0] == '-' && s[1] == '-' && PUGI_IMPL_ENDSWITH(s[2], '>'));
+						PUGI_IMPL_CHECK_ERROR(status_bad_comment, s);
+
+						if (PUGI_IMPL_OPTSET(parse_comments))
+							*s = 0; // Zero-terminate this segment at the first terminating '-'.
+
+						s += (s[2] == '>' ? 3 : 2); // Step over the '\0->'.
+					}
+				}
+				else PUGI_IMPL_THROW_ERROR(status_bad_comment, s);
+			}
+			else if (*s == '[')
+			{
+				// '<![CDATA[...'
+				if (*++s=='C' && *++s=='D' && *++s=='A' && *++s=='T' && *++s=='A' && *++s == '[')
+				{
+					++s;
+
+					if (PUGI_IMPL_OPTSET(parse_cdata))
+					{
+						PUGI_IMPL_PUSHNODE(node_cdata); // Append a new node on the tree.
+						cursor->value = s; // Save the offset.
+
+						if (PUGI_IMPL_OPTSET(parse_eol))
+						{
+							s = strconv_cdata(s, endch);
+
+							if (!s) PUGI_IMPL_THROW_ERROR(status_bad_cdata, cursor->value);
+						}
+						else
+						{
+							// Scan for terminating ']]>'.
+							PUGI_IMPL_SCANFOR(s[0] == ']' && s[1] == ']' && PUGI_IMPL_ENDSWITH(s[2], '>'));
+							PUGI_IMPL_CHECK_ERROR(status_bad_cdata, s);
+
+							*s++ = 0; // Zero-terminate this segment.
+						}
+					}
+					else // Flagged for discard, but we still have to scan for the terminator.
+					{
+						// Scan for terminating ']]>'.
+						PUGI_IMPL_SCANFOR(s[0] == ']' && s[1] == ']' && PUGI_IMPL_ENDSWITH(s[2], '>'));
+						PUGI_IMPL_CHECK_ERROR(status_bad_cdata, s);
+
+						++s;
+					}
+
+					s += (s[1] == '>' ? 2 : 1); // Step over the last ']>'.
+				}
+				else PUGI_IMPL_THROW_ERROR(status_bad_cdata, s);
+			}
+			else if (s[0] == 'D' && s[1] == 'O' && s[2] == 'C' && s[3] == 'T' && s[4] == 'Y' && s[5] == 'P' && PUGI_IMPL_ENDSWITH(s[6], 'E'))
+			{
+				s -= 2;
+
+				if (cursor->parent) PUGI_IMPL_THROW_ERROR(status_bad_doctype, s);
+
+				char_t* mark = s + 9;
+
+				s = parse_doctype_group(s, endch);
+				if (!s) return s;
+
+				assert((*s == 0 && endch == '>') || *s == '>');
+				if (*s) *s++ = 0;
+
+				if (PUGI_IMPL_OPTSET(parse_doctype))
+				{
+					while (PUGI_IMPL_IS_CHARTYPE(*mark, ct_space)) ++mark;
+
+					PUGI_IMPL_PUSHNODE(node_doctype);
+
+					cursor->value = mark;
+				}
+			}
+			else if (*s == 0 && endch == '-') PUGI_IMPL_THROW_ERROR(status_bad_comment, s);
+			else if (*s == 0 && endch == '[') PUGI_IMPL_THROW_ERROR(status_bad_cdata, s);
+			else PUGI_IMPL_THROW_ERROR(status_unrecognized_tag, s);
+
+			return s;
+		}
+
+		char_t* parse_question(char_t* s, xml_node_struct*& ref_cursor, unsigned int optmsk, char_t endch)
+		{
+			// load into registers
+			xml_node_struct* cursor = ref_cursor;
+			char_t ch = 0;
+
+			// parse node contents, starting with question mark
+			++s;
+
+			// read PI target
+			char_t* target = s;
+
+			if (!PUGI_IMPL_IS_CHARTYPE(*s, ct_start_symbol)) PUGI_IMPL_THROW_ERROR(status_bad_pi, s);
+
+			PUGI_IMPL_SCANWHILE(PUGI_IMPL_IS_CHARTYPE(*s, ct_symbol));
+			PUGI_IMPL_CHECK_ERROR(status_bad_pi, s);
+
+			// determine node type; stricmp / strcasecmp is not portable
+			bool declaration = (target[0] | ' ') == 'x' && (target[1] | ' ') == 'm' && (target[2] | ' ') == 'l' && target + 3 == s;
+
+			if (declaration ? PUGI_IMPL_OPTSET(parse_declaration) : PUGI_IMPL_OPTSET(parse_pi))
+			{
+				if (declaration)
+				{
+					// disallow non top-level declarations
+					if (cursor->parent) PUGI_IMPL_THROW_ERROR(status_bad_pi, s);
+
+					PUGI_IMPL_PUSHNODE(node_declaration);
+				}
+				else
+				{
+					PUGI_IMPL_PUSHNODE(node_pi);
+				}
+
+				cursor->name = target;
+
+				PUGI_IMPL_ENDSEG();
+
+				// parse value/attributes
+				if (ch == '?')
+				{
+					// empty node
+					if (!PUGI_IMPL_ENDSWITH(*s, '>')) PUGI_IMPL_THROW_ERROR(status_bad_pi, s);
+					s += (*s == '>');
+
+					PUGI_IMPL_POPNODE();
+				}
+				else if (PUGI_IMPL_IS_CHARTYPE(ch, ct_space))
+				{
+					PUGI_IMPL_SKIPWS();
+
+					// scan for tag end
+					char_t* value = s;
+
+					PUGI_IMPL_SCANFOR(s[0] == '?' && PUGI_IMPL_ENDSWITH(s[1], '>'));
+					PUGI_IMPL_CHECK_ERROR(status_bad_pi, s);
+
+					if (declaration)
+					{
+						// replace ending ? with / so that 'element' terminates properly
+						*s = '/';
+
+						// we exit from this function with cursor at node_declaration, which is a signal to parse() to go to LOC_ATTRIBUTES
+						s = value;
+					}
+					else
+					{
+						// store value and step over >
+						cursor->value = value;
+
+						PUGI_IMPL_POPNODE();
+
+						PUGI_IMPL_ENDSEG();
+
+						s += (*s == '>');
+					}
+				}
+				else PUGI_IMPL_THROW_ERROR(status_bad_pi, s);
+			}
+			else
+			{
+				// scan for tag end
+				PUGI_IMPL_SCANFOR(s[0] == '?' && PUGI_IMPL_ENDSWITH(s[1], '>'));
+				PUGI_IMPL_CHECK_ERROR(status_bad_pi, s);
+
+				s += (s[1] == '>' ? 2 : 1);
+			}
+
+			// store from registers
+			ref_cursor = cursor;
+
+			return s;
+		}
+
+		char_t* parse_tree(char_t* s, xml_node_struct* root, unsigned int optmsk, char_t endch)
+		{
+			strconv_attribute_t strconv_attribute = get_strconv_attribute(optmsk);
+			strconv_pcdata_t strconv_pcdata = get_strconv_pcdata(optmsk);
+
+			char_t ch = 0;
+			xml_node_struct* cursor = root;
+			char_t* mark = s;
+			char_t* merged_pcdata = s;
+
+			while (*s != 0)
+			{
+				if (*s == '<')
+				{
+					++s;
+
+				LOC_TAG:
+					if (PUGI_IMPL_IS_CHARTYPE(*s, ct_start_symbol)) // '<#...'
+					{
+						PUGI_IMPL_PUSHNODE(node_element); // Append a new node to the tree.
+
+						cursor->name = s;
+
+						PUGI_IMPL_SCANWHILE_UNROLL(PUGI_IMPL_IS_CHARTYPE(ss, ct_symbol)); // Scan for a terminator.
+						PUGI_IMPL_ENDSEG(); // Save char in 'ch', terminate & step over.
+
+						if (ch == '>')
+						{
+							// end of tag
+						}
+						else if (PUGI_IMPL_IS_CHARTYPE(ch, ct_space))
+						{
+						LOC_ATTRIBUTES:
+							while (true)
+							{
+								PUGI_IMPL_SKIPWS(); // Eat any whitespace.
+
+								if (PUGI_IMPL_IS_CHARTYPE(*s, ct_start_symbol)) // <... #...
+								{
+									xml_attribute_struct* a = append_new_attribute(cursor, *alloc); // Make space for this attribute.
+									if (!a) PUGI_IMPL_THROW_ERROR(status_out_of_memory, s);
+
+									a->name = s; // Save the offset.
+
+									PUGI_IMPL_SCANWHILE_UNROLL(PUGI_IMPL_IS_CHARTYPE(ss, ct_symbol)); // Scan for a terminator.
+									PUGI_IMPL_ENDSEG(); // Save char in 'ch', terminate & step over.
+
+									if (PUGI_IMPL_IS_CHARTYPE(ch, ct_space))
+									{
+										PUGI_IMPL_SKIPWS(); // Eat any whitespace.
+
+										ch = *s;
+										++s;
+									}
+
+									if (ch == '=') // '<... #=...'
+									{
+										PUGI_IMPL_SKIPWS(); // Eat any whitespace.
+
+										if (*s == '"' || *s == '\'') // '<... #="...'
+										{
+											ch = *s; // Save quote char to avoid breaking on "''" -or- '""'.
+											++s; // Step over the quote.
+											a->value = s; // Save the offset.
+
+											s = strconv_attribute(s, ch);
+
+											if (!s) PUGI_IMPL_THROW_ERROR(status_bad_attribute, a->value);
+
+											// After this line the loop continues from the start;
+											// Whitespaces, / and > are ok, symbols and EOF are wrong,
+											// everything else will be detected
+											if (PUGI_IMPL_IS_CHARTYPE(*s, ct_start_symbol)) PUGI_IMPL_THROW_ERROR(status_bad_attribute, s);
+										}
+										else PUGI_IMPL_THROW_ERROR(status_bad_attribute, s);
+									}
+									else PUGI_IMPL_THROW_ERROR(status_bad_attribute, s);
+								}
+								else if (*s == '/')
+								{
+									++s;
+
+									if (*s == '>')
+									{
+										PUGI_IMPL_POPNODE();
+										s++;
+										break;
+									}
+									else if (*s == 0 && endch == '>')
+									{
+										PUGI_IMPL_POPNODE();
+										break;
+									}
+									else PUGI_IMPL_THROW_ERROR(status_bad_start_element, s);
+								}
+								else if (*s == '>')
+								{
+									++s;
+
+									break;
+								}
+								else if (*s == 0 && endch == '>')
+								{
+									break;
+								}
+								else PUGI_IMPL_THROW_ERROR(status_bad_start_element, s);
+							}
+
+							// !!!
+						}
+						else if (ch == '/') // '<#.../'
+						{
+							if (!PUGI_IMPL_ENDSWITH(*s, '>')) PUGI_IMPL_THROW_ERROR(status_bad_start_element, s);
+
+							PUGI_IMPL_POPNODE(); // Pop.
+
+							s += (*s == '>');
+						}
+						else if (ch == 0)
+						{
+							// we stepped over null terminator, backtrack & handle closing tag
+							--s;
+
+							if (endch != '>') PUGI_IMPL_THROW_ERROR(status_bad_start_element, s);
+						}
+						else PUGI_IMPL_THROW_ERROR(status_bad_start_element, s);
+					}
+					else if (*s == '/')
+					{
+						++s;
+
+						mark = s;
+
+						char_t* name = cursor->name;
+						if (!name) PUGI_IMPL_THROW_ERROR(status_end_element_mismatch, mark);
+
+						while (PUGI_IMPL_IS_CHARTYPE(*s, ct_symbol))
+						{
+							if (*s++ != *name++) PUGI_IMPL_THROW_ERROR(status_end_element_mismatch, mark);
+						}
+
+						if (*name)
+						{
+							if (*s == 0 && name[0] == endch && name[1] == 0) PUGI_IMPL_THROW_ERROR(status_bad_end_element, s);
+							else PUGI_IMPL_THROW_ERROR(status_end_element_mismatch, mark);
+						}
+
+						PUGI_IMPL_POPNODE(); // Pop.
+
+						PUGI_IMPL_SKIPWS();
+
+						if (*s == 0)
+						{
+							if (endch != '>') PUGI_IMPL_THROW_ERROR(status_bad_end_element, s);
+						}
+						else
+						{
+							if (*s != '>') PUGI_IMPL_THROW_ERROR(status_bad_end_element, s);
+							++s;
+						}
+					}
+					else if (*s == '?') // '<?...'
+					{
+						s = parse_question(s, cursor, optmsk, endch);
+						if (!s) return s;
+
+						assert(cursor);
+						if (PUGI_IMPL_NODETYPE(cursor) == node_declaration) goto LOC_ATTRIBUTES;
+					}
+					else if (*s == '!') // '<!...'
+					{
+						s = parse_exclamation(s, cursor, optmsk, endch);
+						if (!s) return s;
+					}
+					else if (*s == 0 && endch == '?') PUGI_IMPL_THROW_ERROR(status_bad_pi, s);
+					else PUGI_IMPL_THROW_ERROR(status_unrecognized_tag, s);
+				}
+				else
+				{
+					mark = s; // Save this offset while searching for a terminator.
+
+					PUGI_IMPL_SKIPWS(); // Eat whitespace if no genuine PCDATA here.
+
+					if (*s == '<' || !*s)
+					{
+						// We skipped some whitespace characters because otherwise we would take the tag branch instead of PCDATA one
+						assert(mark != s);
+
+						if (!PUGI_IMPL_OPTSET(parse_ws_pcdata | parse_ws_pcdata_single) || PUGI_IMPL_OPTSET(parse_trim_pcdata))
+						{
+							continue;
+						}
+						else if (PUGI_IMPL_OPTSET(parse_ws_pcdata_single))
+						{
+							if (s[0] != '<' || s[1] != '/' || cursor->first_child) continue;
+						}
+					}
+
+					if (!PUGI_IMPL_OPTSET(parse_trim_pcdata))
+						s = mark;
+
+					if (cursor->parent || PUGI_IMPL_OPTSET(parse_fragment))
+					{
+						char_t* parsed_pcdata = s;
+
+						s = strconv_pcdata(s);
+
+						if (PUGI_IMPL_OPTSET(parse_embed_pcdata) && cursor->parent && !cursor->first_child && !cursor->value)
+						{
+							cursor->value = parsed_pcdata; // Save the offset.
+						}
+						else if (PUGI_IMPL_OPTSET(parse_merge_pcdata) && cursor->first_child && PUGI_IMPL_NODETYPE(cursor->first_child->prev_sibling_c) == node_pcdata)
+						{
+							assert(merged_pcdata >= cursor->first_child->prev_sibling_c->value);
+
+							// Catch up to the end of last parsed value; only needed for the first fragment.
+							merged_pcdata += strlength(merged_pcdata);
+
+							size_t length = strlength(parsed_pcdata);
+
+							// Must use memmove instead of memcpy as this move may overlap
+							memmove(merged_pcdata, parsed_pcdata, (length + 1) * sizeof(char_t));
+							merged_pcdata += length;
+						}
+						else
+						{
+							xml_node_struct* prev_cursor = cursor;
+							PUGI_IMPL_PUSHNODE(node_pcdata); // Append a new node on the tree.
+
+							cursor->value = parsed_pcdata; // Save the offset.
+							merged_pcdata = parsed_pcdata; // Used for parse_merge_pcdata above, cheaper to save unconditionally
+
+							cursor = prev_cursor; // Pop since this is a standalone.
+						}
+
+						if (!*s) break;
+					}
+					else
+					{
+						PUGI_IMPL_SCANFOR(*s == '<'); // '...<'
+						if (!*s) break;
+
+						++s;
+					}
+
+					// We're after '<'
+					goto LOC_TAG;
+				}
+			}
+
+			// check that last tag is closed
+			if (cursor != root) PUGI_IMPL_THROW_ERROR(status_end_element_mismatch, s);
+
+			return s;
+		}
+
+	#ifdef PUGIXML_WCHAR_MODE
+		static char_t* parse_skip_bom(char_t* s)
+		{
+			unsigned int bom = 0xfeff;
+			return (s[0] == static_cast<wchar_t>(bom)) ? s + 1 : s;
+		}
+	#else
+		static char_t* parse_skip_bom(char_t* s)
+		{
+			return (s[0] == '\xef' && s[1] == '\xbb' && s[2] == '\xbf') ? s + 3 : s;
+		}
+	#endif
+
+		static bool has_element_node_siblings(xml_node_struct* node)
+		{
+			while (node)
+			{
+				if (PUGI_IMPL_NODETYPE(node) == node_element) return true;
+
+				node = node->next_sibling;
+			}
+
+			return false;
+		}
+
+		static xml_parse_result parse(char_t* buffer, size_t length, xml_document_struct* xmldoc, xml_node_struct* root, unsigned int optmsk)
+		{
+			// early-out for empty documents
+			if (length == 0)
+				return make_parse_result(PUGI_IMPL_OPTSET(parse_fragment) ? status_ok : status_no_document_element);
+
+			// get last child of the root before parsing
+			xml_node_struct* last_root_child = root->first_child ? root->first_child->prev_sibling_c + 0 : NULL;
+
+			// create parser on stack
+			xml_parser parser(static_cast<xml_allocator*>(xmldoc));
+
+			// save last character and make buffer zero-terminated (speeds up parsing)
+			char_t endch = buffer[length - 1];
+			buffer[length - 1] = 0;
+
+			// skip BOM to make sure it does not end up as part of parse output
+			char_t* buffer_data = parse_skip_bom(buffer);
+
+			// perform actual parsing
+			parser.parse_tree(buffer_data, root, optmsk, endch);
+
+			xml_parse_result result = make_parse_result(parser.error_status, parser.error_offset ? parser.error_offset - buffer : 0);
+			assert(result.offset >= 0 && static_cast<size_t>(result.offset) <= length);
+
+			if (result)
+			{
+				// since we removed last character, we have to handle the only possible false positive (stray <)
+				if (endch == '<')
+					return make_parse_result(status_unrecognized_tag, length - 1);
+
+				// check if there are any element nodes parsed
+				xml_node_struct* first_root_child_parsed = last_root_child ? last_root_child->next_sibling + 0 : root->first_child + 0;
+
+				if (!PUGI_IMPL_OPTSET(parse_fragment) && !has_element_node_siblings(first_root_child_parsed))
+					return make_parse_result(status_no_document_element, length - 1);
+			}
+			else
+			{
+				// roll back offset if it occurs on a null terminator in the source buffer
+				if (result.offset > 0 && static_cast<size_t>(result.offset) == length - 1 && endch == 0)
+					result.offset--;
+			}
+
+			return result;
+		}
+	};
+
+	// Output facilities
+	PUGI_IMPL_FN xml_encoding get_write_native_encoding()
+	{
+	#ifdef PUGIXML_WCHAR_MODE
+		return get_wchar_encoding();
+	#else
+		return encoding_utf8;
+	#endif
+	}
+
+	PUGI_IMPL_FN xml_encoding get_write_encoding(xml_encoding encoding)
+	{
+		// replace wchar encoding with utf implementation
+		if (encoding == encoding_wchar) return get_wchar_encoding();
+
+		// replace utf16 encoding with utf16 with specific endianness
+		if (encoding == encoding_utf16) return is_little_endian() ? encoding_utf16_le : encoding_utf16_be;
+
+		// replace utf32 encoding with utf32 with specific endianness
+		if (encoding == encoding_utf32) return is_little_endian() ? encoding_utf32_le : encoding_utf32_be;
+
+		// only do autodetection if no explicit encoding is requested
+		if (encoding != encoding_auto) return encoding;
+
+		// assume utf8 encoding
+		return encoding_utf8;
+	}
+
+	template <typename D, typename T> PUGI_IMPL_FN size_t convert_buffer_output_generic(typename T::value_type dest, const char_t* data, size_t length, D, T)
+	{
+		PUGI_IMPL_STATIC_ASSERT(sizeof(char_t) == sizeof(typename D::type));
+
+		typename T::value_type end = D::process(reinterpret_cast<const typename D::type*>(data), length, dest, T());
+
+		return static_cast<size_t>(end - dest) * sizeof(*dest);
+	}
+
+	template <typename D, typename T> PUGI_IMPL_FN size_t convert_buffer_output_generic(typename T::value_type dest, const char_t* data, size_t length, D, T, bool opt_swap)
+	{
+		PUGI_IMPL_STATIC_ASSERT(sizeof(char_t) == sizeof(typename D::type));
+
+		typename T::value_type end = D::process(reinterpret_cast<const typename D::type*>(data), length, dest, T());
+
+		if (opt_swap)
+		{
+			for (typename T::value_type i = dest; i != end; ++i)
+				*i = endian_swap(*i);
+		}
+
+		return static_cast<size_t>(end - dest) * sizeof(*dest);
+	}
+
+#ifdef PUGIXML_WCHAR_MODE
+	PUGI_IMPL_FN size_t get_valid_length(const char_t* data, size_t length)
+	{
+		if (length < 1) return 0;
+
+		// discard last character if it's the lead of a surrogate pair
+		return (sizeof(wchar_t) == 2 && static_cast<unsigned int>(static_cast<uint16_t>(data[length - 1]) - 0xD800) < 0x400) ? length - 1 : length;
+	}
+
+	PUGI_IMPL_FN size_t convert_buffer_output(char_t* r_char, uint8_t* r_u8, uint16_t* r_u16, uint32_t* r_u32, const char_t* data, size_t length, xml_encoding encoding)
+	{
+		// only endian-swapping is required
+		if (need_endian_swap_utf(encoding, get_wchar_encoding()))
+		{
+			convert_wchar_endian_swap(r_char, data, length);
+
+			return length * sizeof(char_t);
+		}
+
+		// convert to utf8
+		if (encoding == encoding_utf8)
+			return convert_buffer_output_generic(r_u8, data, length, wchar_decoder(), utf8_writer());
+
+		// convert to utf16
+		if (encoding == encoding_utf16_be || encoding == encoding_utf16_le)
+		{
+			xml_encoding native_encoding = is_little_endian() ? encoding_utf16_le : encoding_utf16_be;
+
+			return convert_buffer_output_generic(r_u16, data, length, wchar_decoder(), utf16_writer(), native_encoding != encoding);
+		}
+
+		// convert to utf32
+		if (encoding == encoding_utf32_be || encoding == encoding_utf32_le)
+		{
+			xml_encoding native_encoding = is_little_endian() ? encoding_utf32_le : encoding_utf32_be;
+
+			return convert_buffer_output_generic(r_u32, data, length, wchar_decoder(), utf32_writer(), native_encoding != encoding);
+		}
+
+		// convert to latin1
+		if (encoding == encoding_latin1)
+			return convert_buffer_output_generic(r_u8, data, length, wchar_decoder(), latin1_writer());
+
+		assert(false && "Invalid encoding"); // unreachable
+		return 0;
+	}
+#else
+	PUGI_IMPL_FN size_t get_valid_length(const char_t* data, size_t length)
+	{
+		if (length < 5) return 0;
+
+		for (size_t i = 1; i <= 4; ++i)
+		{
+			uint8_t ch = static_cast<uint8_t>(data[length - i]);
+
+			// either a standalone character or a leading one
+			if ((ch & 0xc0) != 0x80) return length - i;
+		}
+
+		// there are four non-leading characters at the end, sequence tail is broken so might as well process the whole chunk
+		return length;
+	}
+
+	PUGI_IMPL_FN size_t convert_buffer_output(char_t* /* r_char */, uint8_t* r_u8, uint16_t* r_u16, uint32_t* r_u32, const char_t* data, size_t length, xml_encoding encoding)
+	{
+		if (encoding == encoding_utf16_be || encoding == encoding_utf16_le)
+		{
+			xml_encoding native_encoding = is_little_endian() ? encoding_utf16_le : encoding_utf16_be;
+
+			return convert_buffer_output_generic(r_u16, data, length, utf8_decoder(), utf16_writer(), native_encoding != encoding);
+		}
+
+		if (encoding == encoding_utf32_be || encoding == encoding_utf32_le)
+		{
+			xml_encoding native_encoding = is_little_endian() ? encoding_utf32_le : encoding_utf32_be;
+
+			return convert_buffer_output_generic(r_u32, data, length, utf8_decoder(), utf32_writer(), native_encoding != encoding);
+		}
+
+		if (encoding == encoding_latin1)
+			return convert_buffer_output_generic(r_u8, data, length, utf8_decoder(), latin1_writer());
+
+		assert(false && "Invalid encoding"); // unreachable
+		return 0;
+	}
+#endif
+
+	class xml_buffered_writer
+	{
+		xml_buffered_writer(const xml_buffered_writer&);
+		xml_buffered_writer& operator=(const xml_buffered_writer&);
+
+	public:
+		xml_buffered_writer(xml_writer& writer_, xml_encoding user_encoding): writer(writer_), bufsize(0), encoding(get_write_encoding(user_encoding))
+		{
+			PUGI_IMPL_STATIC_ASSERT(bufcapacity >= 8);
+		}
+
+		size_t flush()
+		{
+			flush(buffer, bufsize);
+			bufsize = 0;
+			return 0;
+		}
+
+		void flush(const char_t* data, size_t size)
+		{
+			if (size == 0) return;
+
+			// fast path, just write data
+			if (encoding == get_write_native_encoding())
+				writer.write(data, size * sizeof(char_t));
+			else
+			{
+				// convert chunk
+				size_t result = convert_buffer_output(scratch.data_char, scratch.data_u8, scratch.data_u16, scratch.data_u32, data, size, encoding);
+				assert(result <= sizeof(scratch));
+
+				// write data
+				writer.write(scratch.data_u8, result);
+			}
+		}
+
+		void write_direct(const char_t* data, size_t length)
+		{
+			// flush the remaining buffer contents
+			flush();
+
+			// handle large chunks
+			if (length > bufcapacity)
+			{
+				if (encoding == get_write_native_encoding())
+				{
+					// fast path, can just write data chunk
+					writer.write(data, length * sizeof(char_t));
+					return;
+				}
+
+				// need to convert in suitable chunks
+				while (length > bufcapacity)
+				{
+					// get chunk size by selecting such number of characters that are guaranteed to fit into scratch buffer
+					// and form a complete codepoint sequence (i.e. discard start of last codepoint if necessary)
+					size_t chunk_size = get_valid_length(data, bufcapacity);
+					assert(chunk_size);
+
+					// convert chunk and write
+					flush(data, chunk_size);
+
+					// iterate
+					data += chunk_size;
+					length -= chunk_size;
+				}
+
+				// small tail is copied below
+				bufsize = 0;
+			}
+
+			memcpy(buffer + bufsize, data, length * sizeof(char_t));
+			bufsize += length;
+		}
+
+		void write_buffer(const char_t* data, size_t length)
+		{
+			size_t offset = bufsize;
+
+			if (offset + length <= bufcapacity)
+			{
+				memcpy(buffer + offset, data, length * sizeof(char_t));
+				bufsize = offset + length;
+			}
+			else
+			{
+				write_direct(data, length);
+			}
+		}
+
+		void write_string(const char_t* data)
+		{
+			// write the part of the string that fits in the buffer
+			size_t offset = bufsize;
+
+			while (*data && offset < bufcapacity)
+				buffer[offset++] = *data++;
+
+			// write the rest
+			if (offset < bufcapacity)
+			{
+				bufsize = offset;
+			}
+			else
+			{
+				// backtrack a bit if we have split the codepoint
+				size_t length = offset - bufsize;
+				size_t extra = length - get_valid_length(data - length, length);
+
+				bufsize = offset - extra;
+
+				write_direct(data - extra, strlength(data) + extra);
+			}
+		}
+
+		void write(char_t d0)
+		{
+			size_t offset = bufsize;
+			if (offset > bufcapacity - 1) offset = flush();
+
+			buffer[offset + 0] = d0;
+			bufsize = offset + 1;
+		}
+
+		void write(char_t d0, char_t d1)
+		{
+			size_t offset = bufsize;
+			if (offset > bufcapacity - 2) offset = flush();
+
+			buffer[offset + 0] = d0;
+			buffer[offset + 1] = d1;
+			bufsize = offset + 2;
+		}
+
+		void write(char_t d0, char_t d1, char_t d2)
+		{
+			size_t offset = bufsize;
+			if (offset > bufcapacity - 3) offset = flush();
+
+			buffer[offset + 0] = d0;
+			buffer[offset + 1] = d1;
+			buffer[offset + 2] = d2;
+			bufsize = offset + 3;
+		}
+
+		void write(char_t d0, char_t d1, char_t d2, char_t d3)
+		{
+			size_t offset = bufsize;
+			if (offset > bufcapacity - 4) offset = flush();
+
+			buffer[offset + 0] = d0;
+			buffer[offset + 1] = d1;
+			buffer[offset + 2] = d2;
+			buffer[offset + 3] = d3;
+			bufsize = offset + 4;
+		}
+
+		void write(char_t d0, char_t d1, char_t d2, char_t d3, char_t d4)
+		{
+			size_t offset = bufsize;
+			if (offset > bufcapacity - 5) offset = flush();
+
+			buffer[offset + 0] = d0;
+			buffer[offset + 1] = d1;
+			buffer[offset + 2] = d2;
+			buffer[offset + 3] = d3;
+			buffer[offset + 4] = d4;
+			bufsize = offset + 5;
+		}
+
+		void write(char_t d0, char_t d1, char_t d2, char_t d3, char_t d4, char_t d5)
+		{
+			size_t offset = bufsize;
+			if (offset > bufcapacity - 6) offset = flush();
+
+			buffer[offset + 0] = d0;
+			buffer[offset + 1] = d1;
+			buffer[offset + 2] = d2;
+			buffer[offset + 3] = d3;
+			buffer[offset + 4] = d4;
+			buffer[offset + 5] = d5;
+			bufsize = offset + 6;
+		}
+
+		// utf8 maximum expansion: x4 (-> utf32)
+		// utf16 maximum expansion: x2 (-> utf32)
+		// utf32 maximum expansion: x1
+		enum
+		{
+			bufcapacitybytes =
+			#ifdef PUGIXML_MEMORY_OUTPUT_STACK
+				PUGIXML_MEMORY_OUTPUT_STACK
+			#else
+				10240
+			#endif
+			,
+			bufcapacity = bufcapacitybytes / (sizeof(char_t) + 4)
+		};
+
+		char_t buffer[bufcapacity];
+
+		union
+		{
+			uint8_t data_u8[4 * bufcapacity];
+			uint16_t data_u16[2 * bufcapacity];
+			uint32_t data_u32[bufcapacity];
+			char_t data_char[bufcapacity];
+		} scratch;
+
+		xml_writer& writer;
+		size_t bufsize;
+		xml_encoding encoding;
+	};
+
+	PUGI_IMPL_FN void text_output_escaped(xml_buffered_writer& writer, const char_t* s, chartypex_t type, unsigned int flags)
+	{
+		while (*s)
+		{
+			const char_t* prev = s;
+
+			// While *s is a usual symbol
+			PUGI_IMPL_SCANWHILE_UNROLL(!PUGI_IMPL_IS_CHARTYPEX(ss, type));
+
+			writer.write_buffer(prev, static_cast<size_t>(s - prev));
+
+			switch (*s)
+			{
+				case 0: break;
+				case '&':
+					writer.write('&', 'a', 'm', 'p', ';');
+					++s;
+					break;
+				case '<':
+					writer.write('&', 'l', 't', ';');
+					++s;
+					break;
+				case '>':
+					writer.write('&', 'g', 't', ';');
+					++s;
+					break;
+				case '"':
+					if (flags & format_attribute_single_quote)
+						writer.write('"');
+					else
+						writer.write('&', 'q', 'u', 'o', 't', ';');
+					++s;
+					break;
+				case '\'':
+					if (flags & format_attribute_single_quote)
+						writer.write('&', 'a', 'p', 'o', 's', ';');
+					else
+						writer.write('\'');
+					++s;
+					break;
+				default: // s is not a usual symbol
+				{
+					unsigned int ch = static_cast<unsigned int>(*s++);
+					assert(ch < 32);
+
+					if (!(flags & format_skip_control_chars))
+						writer.write('&', '#', static_cast<char_t>((ch / 10) + '0'), static_cast<char_t>((ch % 10) + '0'), ';');
+				}
+			}
+		}
+	}
+
+	PUGI_IMPL_FN void text_output(xml_buffered_writer& writer, const char_t* s, chartypex_t type, unsigned int flags)
+	{
+		if (flags & format_no_escapes)
+			writer.write_string(s);
+		else
+			text_output_escaped(writer, s, type, flags);
+	}
+
+	PUGI_IMPL_FN void text_output_cdata(xml_buffered_writer& writer, const char_t* s)
+	{
+		do
+		{
+			writer.write('<', '!', '[', 'C', 'D');
+			writer.write('A', 'T', 'A', '[');
+
+			const char_t* prev = s;
+
+			// look for ]]> sequence - we can't output it as is since it terminates CDATA
+			while (*s && !(s[0] == ']' && s[1] == ']' && s[2] == '>')) ++s;
+
+			// skip ]] if we stopped at ]]>, > will go to the next CDATA section
+			if (*s) s += 2;
+
+			writer.write_buffer(prev, static_cast<size_t>(s - prev));
+
+			writer.write(']', ']', '>');
+		}
+		while (*s);
+	}
+
+	PUGI_IMPL_FN void text_output_indent(xml_buffered_writer& writer, const char_t* indent, size_t indent_length, unsigned int depth)
+	{
+		switch (indent_length)
+		{
+		case 1:
+		{
+			for (unsigned int i = 0; i < depth; ++i)
+				writer.write(indent[0]);
+			break;
+		}
+
+		case 2:
+		{
+			for (unsigned int i = 0; i < depth; ++i)
+				writer.write(indent[0], indent[1]);
+			break;
+		}
+
+		case 3:
+		{
+			for (unsigned int i = 0; i < depth; ++i)
+				writer.write(indent[0], indent[1], indent[2]);
+			break;
+		}
+
+		case 4:
+		{
+			for (unsigned int i = 0; i < depth; ++i)
+				writer.write(indent[0], indent[1], indent[2], indent[3]);
+			break;
+		}
+
+		default:
+		{
+			for (unsigned int i = 0; i < depth; ++i)
+				writer.write_buffer(indent, indent_length);
+		}
+		}
+	}
+
+	PUGI_IMPL_FN void node_output_comment(xml_buffered_writer& writer, const char_t* s)
+	{
+		writer.write('<', '!', '-', '-');
+
+		while (*s)
+		{
+			const char_t* prev = s;
+
+			// look for -\0 or -- sequence - we can't output it since -- is illegal in comment body
+			while (*s && !(s[0] == '-' && (s[1] == '-' || s[1] == 0))) ++s;
+
+			writer.write_buffer(prev, static_cast<size_t>(s - prev));
+
+			if (*s)
+			{
+				assert(*s == '-');
+
+				writer.write('-', ' ');
+				++s;
+			}
+		}
+
+		writer.write('-', '-', '>');
+	}
+
+	PUGI_IMPL_FN void node_output_pi_value(xml_buffered_writer& writer, const char_t* s)
+	{
+		while (*s)
+		{
+			const char_t* prev = s;
+
+			// look for ?> sequence - we can't output it since ?> terminates PI
+			while (*s && !(s[0] == '?' && s[1] == '>')) ++s;
+
+			writer.write_buffer(prev, static_cast<size_t>(s - prev));
+
+			if (*s)
+			{
+				assert(s[0] == '?' && s[1] == '>');
+
+				writer.write('?', ' ', '>');
+				s += 2;
+			}
+		}
+	}
+
+	PUGI_IMPL_FN void node_output_attributes(xml_buffered_writer& writer, xml_node_struct* node, const char_t* indent, size_t indent_length, unsigned int flags, unsigned int depth)
+	{
+		const char_t* default_name = PUGIXML_TEXT(":anonymous");
+		const char_t enquotation_char = (flags & format_attribute_single_quote) ? '\'' : '"';
+
+		for (xml_attribute_struct* a = node->first_attribute; a; a = a->next_attribute)
+		{
+			if ((flags & (format_indent_attributes | format_raw)) == format_indent_attributes)
+			{
+				writer.write('\n');
+
+				text_output_indent(writer, indent, indent_length, depth + 1);
+			}
+			else
+			{
+				writer.write(' ');
+			}
+
+			writer.write_string(a->name ? a->name + 0 : default_name);
+			writer.write('=', enquotation_char);
+
+			if (a->value)
+				text_output(writer, a->value, ctx_special_attr, flags);
+
+			writer.write(enquotation_char);
+		}
+	}
+
+	PUGI_IMPL_FN bool node_output_start(xml_buffered_writer& writer, xml_node_struct* node, const char_t* indent, size_t indent_length, unsigned int flags, unsigned int depth)
+	{
+		const char_t* default_name = PUGIXML_TEXT(":anonymous");
+		const char_t* name = node->name ? node->name + 0 : default_name;
+
+		writer.write('<');
+		writer.write_string(name);
+
+		if (node->first_attribute)
+			node_output_attributes(writer, node, indent, indent_length, flags, depth);
+
+		// element nodes can have value if parse_embed_pcdata was used
+		if (!node->value)
+		{
+			if (!node->first_child)
+			{
+				if (flags & format_no_empty_element_tags)
+				{
+					writer.write('>', '<', '/');
+					writer.write_string(name);
+					writer.write('>');
+
+					return false;
+				}
+				else
+				{
+					if ((flags & format_raw) == 0)
+						writer.write(' ');
+
+					writer.write('/', '>');
+
+					return false;
+				}
+			}
+			else
+			{
+				writer.write('>');
+
+				return true;
+			}
+		}
+		else
+		{
+			writer.write('>');
+
+			text_output(writer, node->value, ctx_special_pcdata, flags);
+
+			if (!node->first_child)
+			{
+				writer.write('<', '/');
+				writer.write_string(name);
+				writer.write('>');
+
+				return false;
+			}
+			else
+			{
+				return true;
+			}
+		}
+	}
+
+	PUGI_IMPL_FN void node_output_end(xml_buffered_writer& writer, xml_node_struct* node)
+	{
+		const char_t* default_name = PUGIXML_TEXT(":anonymous");
+		const char_t* name = node->name ? node->name + 0 : default_name;
+
+		writer.write('<', '/');
+		writer.write_string(name);
+		writer.write('>');
+	}
+
+	PUGI_IMPL_FN void node_output_simple(xml_buffered_writer& writer, xml_node_struct* node, unsigned int flags)
+	{
+		const char_t* default_name = PUGIXML_TEXT(":anonymous");
+
+		switch (PUGI_IMPL_NODETYPE(node))
+		{
+			case node_pcdata:
+				text_output(writer, node->value ? node->value + 0 : PUGIXML_TEXT(""), ctx_special_pcdata, flags);
+				break;
+
+			case node_cdata:
+				text_output_cdata(writer, node->value ? node->value + 0 : PUGIXML_TEXT(""));
+				break;
+
+			case node_comment:
+				node_output_comment(writer, node->value ? node->value + 0 : PUGIXML_TEXT(""));
+				break;
+
+			case node_pi:
+				writer.write('<', '?');
+				writer.write_string(node->name ? node->name + 0 : default_name);
+
+				if (node->value)
+				{
+					writer.write(' ');
+					node_output_pi_value(writer, node->value);
+				}
+
+				writer.write('?', '>');
+				break;
+
+			case node_declaration:
+				writer.write('<', '?');
+				writer.write_string(node->name ? node->name + 0 : default_name);
+				node_output_attributes(writer, node, PUGIXML_TEXT(""), 0, flags | format_raw, 0);
+				writer.write('?', '>');
+				break;
+
+			case node_doctype:
+				writer.write('<', '!', 'D', 'O', 'C');
+				writer.write('T', 'Y', 'P', 'E');
+
+				if (node->value)
+				{
+					writer.write(' ');
+					writer.write_string(node->value);
+				}
+
+				writer.write('>');
+				break;
+
+			default:
+				assert(false && "Invalid node type"); // unreachable
+		}
+	}
+
+	enum indent_flags_t
+	{
+		indent_newline = 1,
+		indent_indent = 2
+	};
+
+	PUGI_IMPL_FN void node_output(xml_buffered_writer& writer, xml_node_struct* root, const char_t* indent, unsigned int flags, unsigned int depth)
+	{
+		size_t indent_length = ((flags & (format_indent | format_indent_attributes)) && (flags & format_raw) == 0) ? strlength(indent) : 0;
+		unsigned int indent_flags = indent_indent;
+
+		xml_node_struct* node = root;
+
+		do
+		{
+			assert(node);
+
+			// begin writing current node
+			if (PUGI_IMPL_NODETYPE(node) == node_pcdata || PUGI_IMPL_NODETYPE(node) == node_cdata)
+			{
+				node_output_simple(writer, node, flags);
+
+				indent_flags = 0;
+			}
+			else
+			{
+				if ((indent_flags & indent_newline) && (flags & format_raw) == 0)
+					writer.write('\n');
+
+				if ((indent_flags & indent_indent) && indent_length)
+					text_output_indent(writer, indent, indent_length, depth);
+
+				if (PUGI_IMPL_NODETYPE(node) == node_element)
+				{
+					indent_flags = indent_newline | indent_indent;
+
+					if (node_output_start(writer, node, indent, indent_length, flags, depth))
+					{
+						// element nodes can have value if parse_embed_pcdata was used
+						if (node->value)
+							indent_flags = 0;
+
+						node = node->first_child;
+						depth++;
+						continue;
+					}
+				}
+				else if (PUGI_IMPL_NODETYPE(node) == node_document)
+				{
+					indent_flags = indent_indent;
+
+					if (node->first_child)
+					{
+						node = node->first_child;
+						continue;
+					}
+				}
+				else
+				{
+					node_output_simple(writer, node, flags);
+
+					indent_flags = indent_newline | indent_indent;
+				}
+			}
+
+			// continue to the next node
+			while (node != root)
+			{
+				if (node->next_sibling)
+				{
+					node = node->next_sibling;
+					break;
+				}
+
+				node = node->parent;
+
+				// write closing node
+				if (PUGI_IMPL_NODETYPE(node) == node_element)
+				{
+					depth--;
+
+					if ((indent_flags & indent_newline) && (flags & format_raw) == 0)
+						writer.write('\n');
+
+					if ((indent_flags & indent_indent) && indent_length)
+						text_output_indent(writer, indent, indent_length, depth);
+
+					node_output_end(writer, node);
+
+					indent_flags = indent_newline | indent_indent;
+				}
+			}
+		}
+		while (node != root);
+
+		if ((indent_flags & indent_newline) && (flags & format_raw) == 0)
+			writer.write('\n');
+	}
+
+	PUGI_IMPL_FN bool has_declaration(xml_node_struct* node)
+	{
+		for (xml_node_struct* child = node->first_child; child; child = child->next_sibling)
+		{
+			xml_node_type type = PUGI_IMPL_NODETYPE(child);
+
+			if (type == node_declaration) return true;
+			if (type == node_element) return false;
+		}
+
+		return false;
+	}
+
+	PUGI_IMPL_FN bool is_attribute_of(xml_attribute_struct* attr, xml_node_struct* node)
+	{
+		for (xml_attribute_struct* a = node->first_attribute; a; a = a->next_attribute)
+			if (a == attr)
+				return true;
+
+		return false;
+	}
+
+	PUGI_IMPL_FN bool allow_insert_attribute(xml_node_type parent)
+	{
+		return parent == node_element || parent == node_declaration;
+	}
+
+	PUGI_IMPL_FN bool allow_insert_child(xml_node_type parent, xml_node_type child)
+	{
+		if (parent != node_document && parent != node_element) return false;
+		if (child == node_document || child == node_null) return false;
+		if (parent != node_document && (child == node_declaration || child == node_doctype)) return false;
+
+		return true;
+	}
+
+	PUGI_IMPL_FN bool allow_move(xml_node parent, xml_node child)
+	{
+		// check that child can be a child of parent
+		if (!allow_insert_child(parent.type(), child.type()))
+			return false;
+
+		// check that node is not moved between documents
+		if (parent.root() != child.root())
+			return false;
+
+		// check that new parent is not in the child subtree
+		xml_node cur = parent;
+
+		while (cur)
+		{
+			if (cur == child)
+				return false;
+
+			cur = cur.parent();
+		}
+
+		return true;
+	}
+
+	template <typename String, typename Header>
+	PUGI_IMPL_FN void node_copy_string(String& dest, Header& header, uintptr_t header_mask, char_t* source, Header& source_header, xml_allocator* alloc)
+	{
+		assert(!dest && (header & header_mask) == 0); // copies are performed into fresh nodes
+
+		if (source)
+		{
+			if (alloc && (source_header & header_mask) == 0)
+			{
+				dest = source;
+
+				// since strcpy_insitu can reuse document buffer memory we need to mark both source and dest as shared
+				header |= xml_memory_page_contents_shared_mask;
+				source_header |= xml_memory_page_contents_shared_mask;
+			}
+			else
+				strcpy_insitu(dest, header, header_mask, source, strlength(source));
+		}
+	}
+
+	PUGI_IMPL_FN void node_copy_contents(xml_node_struct* dn, xml_node_struct* sn, xml_allocator* shared_alloc)
+	{
+		node_copy_string(dn->name, dn->header, xml_memory_page_name_allocated_mask, sn->name, sn->header, shared_alloc);
+		node_copy_string(dn->value, dn->header, xml_memory_page_value_allocated_mask, sn->value, sn->header, shared_alloc);
+
+		for (xml_attribute_struct* sa = sn->first_attribute; sa; sa = sa->next_attribute)
+		{
+			xml_attribute_struct* da = append_new_attribute(dn, get_allocator(dn));
+
+			if (da)
+			{
+				node_copy_string(da->name, da->header, xml_memory_page_name_allocated_mask, sa->name, sa->header, shared_alloc);
+				node_copy_string(da->value, da->header, xml_memory_page_value_allocated_mask, sa->value, sa->header, shared_alloc);
+			}
+		}
+	}
+
+	PUGI_IMPL_FN void node_copy_tree(xml_node_struct* dn, xml_node_struct* sn)
+	{
+		xml_allocator& alloc = get_allocator(dn);
+		xml_allocator* shared_alloc = (&alloc == &get_allocator(sn)) ? &alloc : NULL;
+
+		node_copy_contents(dn, sn, shared_alloc);
+
+		xml_node_struct* dit = dn;
+		xml_node_struct* sit = sn->first_child;
+
+		while (sit && sit != sn)
+		{
+			// loop invariant: dit is inside the subtree rooted at dn
+			assert(dit);
+
+			// when a tree is copied into one of the descendants, we need to skip that subtree to avoid an infinite loop
+			if (sit != dn)
+			{
+				xml_node_struct* copy = append_new_node(dit, alloc, PUGI_IMPL_NODETYPE(sit));
+
+				if (copy)
+				{
+					node_copy_contents(copy, sit, shared_alloc);
+
+					if (sit->first_child)
+					{
+						dit = copy;
+						sit = sit->first_child;
+						continue;
+					}
+				}
+			}
+
+			// continue to the next node
+			do
+			{
+				if (sit->next_sibling)
+				{
+					sit = sit->next_sibling;
+					break;
+				}
+
+				sit = sit->parent;
+				dit = dit->parent;
+
+				// loop invariant: dit is inside the subtree rooted at dn while sit is inside sn
+				assert(sit == sn || dit);
+			}
+			while (sit != sn);
+		}
+
+		assert(!sit || dit == dn->parent);
+	}
+
+	PUGI_IMPL_FN void node_copy_attribute(xml_attribute_struct* da, xml_attribute_struct* sa)
+	{
+		xml_allocator& alloc = get_allocator(da);
+		xml_allocator* shared_alloc = (&alloc == &get_allocator(sa)) ? &alloc : NULL;
+
+		node_copy_string(da->name, da->header, xml_memory_page_name_allocated_mask, sa->name, sa->header, shared_alloc);
+		node_copy_string(da->value, da->header, xml_memory_page_value_allocated_mask, sa->value, sa->header, shared_alloc);
+	}
+
+	inline bool is_text_node(xml_node_struct* node)
+	{
+		xml_node_type type = PUGI_IMPL_NODETYPE(node);
+
+		return type == node_pcdata || type == node_cdata;
+	}
+
+	// get value with conversion functions
+	template <typename U> PUGI_IMPL_FN PUGI_IMPL_UNSIGNED_OVERFLOW U string_to_integer(const char_t* value, U minv, U maxv)
+	{
+		U result = 0;
+		const char_t* s = value;
+
+		while (PUGI_IMPL_IS_CHARTYPE(*s, ct_space))
+			s++;
+
+		bool negative = (*s == '-');
+
+		s += (*s == '+' || *s == '-');
+
+		bool overflow = false;
+
+		if (s[0] == '0' && (s[1] | ' ') == 'x')
+		{
+			s += 2;
+
+			// since overflow detection relies on length of the sequence skip leading zeros
+			while (*s == '0')
+				s++;
+
+			const char_t* start = s;
+
+			for (;;)
+			{
+				if (static_cast<unsigned>(*s - '0') < 10)
+					result = result * 16 + (*s - '0');
+				else if (static_cast<unsigned>((*s | ' ') - 'a') < 6)
+					result = result * 16 + ((*s | ' ') - 'a' + 10);
+				else
+					break;
+
+				s++;
+			}
+
+			size_t digits = static_cast<size_t>(s - start);
+
+			overflow = digits > sizeof(U) * 2;
+		}
+		else
+		{
+			// since overflow detection relies on length of the sequence skip leading zeros
+			while (*s == '0')
+				s++;
+
+			const char_t* start = s;
+
+			for (;;)
+			{
+				if (static_cast<unsigned>(*s - '0') < 10)
+					result = result * 10 + (*s - '0');
+				else
+					break;
+
+				s++;
+			}
+
+			size_t digits = static_cast<size_t>(s - start);
+
+			PUGI_IMPL_STATIC_ASSERT(sizeof(U) == 8 || sizeof(U) == 4 || sizeof(U) == 2);
+
+			const size_t max_digits10 = sizeof(U) == 8 ? 20 : sizeof(U) == 4 ? 10 : 5;
+			const char_t max_lead = sizeof(U) == 8 ? '1' : sizeof(U) == 4 ? '4' : '6';
+			const size_t high_bit = sizeof(U) * 8 - 1;
+
+			overflow = digits >= max_digits10 && !(digits == max_digits10 && (*start < max_lead || (*start == max_lead && result >> high_bit)));
+		}
+
+		if (negative)
+		{
+			// Workaround for crayc++ CC-3059: Expected no overflow in routine.
+		#ifdef _CRAYC
+			return (overflow || result > ~minv + 1) ? minv : ~result + 1;
+		#else
+			return (overflow || result > 0 - minv) ? minv : 0 - result;
+		#endif
+		}
+		else
+			return (overflow || result > maxv) ? maxv : result;
+	}
+
+	PUGI_IMPL_FN int get_value_int(const char_t* value)
+	{
+		return string_to_integer<unsigned int>(value, static_cast<unsigned int>(INT_MIN), INT_MAX);
+	}
+
+	PUGI_IMPL_FN unsigned int get_value_uint(const char_t* value)
+	{
+		return string_to_integer<unsigned int>(value, 0, UINT_MAX);
+	}
+
+	PUGI_IMPL_FN double get_value_double(const char_t* value)
+	{
+	#ifdef PUGIXML_WCHAR_MODE
+		return wcstod(value, NULL);
+	#else
+		return strtod(value, NULL);
+	#endif
+	}
+
+	PUGI_IMPL_FN float get_value_float(const char_t* value)
+	{
+	#ifdef PUGIXML_WCHAR_MODE
+		return static_cast<float>(wcstod(value, NULL));
+	#else
+		return static_cast<float>(strtod(value, NULL));
+	#endif
+	}
+
+	PUGI_IMPL_FN bool get_value_bool(const char_t* value)
+	{
+		// only look at first char
+		char_t first = *value;
+
+		// 1*, t* (true), T* (True), y* (yes), Y* (YES)
+		return (first == '1' || first == 't' || first == 'T' || first == 'y' || first == 'Y');
+	}
+
+#ifdef PUGIXML_HAS_LONG_LONG
+	PUGI_IMPL_FN long long get_value_llong(const char_t* value)
+	{
+		return string_to_integer<unsigned long long>(value, static_cast<unsigned long long>(LLONG_MIN), LLONG_MAX);
+	}
+
+	PUGI_IMPL_FN unsigned long long get_value_ullong(const char_t* value)
+	{
+		return string_to_integer<unsigned long long>(value, 0, ULLONG_MAX);
+	}
+#endif
+
+	template <typename U> PUGI_IMPL_FN PUGI_IMPL_UNSIGNED_OVERFLOW char_t* integer_to_string(char_t* begin, char_t* end, U value, bool negative)
+	{
+		char_t* result = end - 1;
+		U rest = negative ? 0 - value : value;
+
+		do
+		{
+			*result-- = static_cast<char_t>('0' + (rest % 10));
+			rest /= 10;
+		}
+		while (rest);
+
+		assert(result >= begin);
+		(void)begin;
+
+		*result = '-';
+
+		return result + !negative;
+	}
+
+	// set value with conversion functions
+	template <typename String, typename Header>
+	PUGI_IMPL_FN bool set_value_ascii(String& dest, Header& header, uintptr_t header_mask, char* buf)
+	{
+	#ifdef PUGIXML_WCHAR_MODE
+		char_t wbuf[128];
+		assert(strlen(buf) < sizeof(wbuf) / sizeof(wbuf[0]));
+
+		size_t offset = 0;
+		for (; buf[offset]; ++offset) wbuf[offset] = buf[offset];
+
+		return strcpy_insitu(dest, header, header_mask, wbuf, offset);
+	#else
+		return strcpy_insitu(dest, header, header_mask, buf, strlen(buf));
+	#endif
+	}
+
+	template <typename U, typename String, typename Header>
+	PUGI_IMPL_FN bool set_value_integer(String& dest, Header& header, uintptr_t header_mask, U value, bool negative)
+	{
+		char_t buf[64];
+		char_t* end = buf + sizeof(buf) / sizeof(buf[0]);
+		char_t* begin = integer_to_string(buf, end, value, negative);
+
+		return strcpy_insitu(dest, header, header_mask, begin, end - begin);
+	}
+
+	template <typename String, typename Header>
+	PUGI_IMPL_FN bool set_value_convert(String& dest, Header& header, uintptr_t header_mask, float value, int precision)
+	{
+		char buf[128];
+		PUGI_IMPL_SNPRINTF(buf, "%.*g", precision, double(value));
+
+		return set_value_ascii(dest, header, header_mask, buf);
+	}
+
+	template <typename String, typename Header>
+	PUGI_IMPL_FN bool set_value_convert(String& dest, Header& header, uintptr_t header_mask, double value, int precision)
+	{
+		char buf[128];
+		PUGI_IMPL_SNPRINTF(buf, "%.*g", precision, value);
+
+		return set_value_ascii(dest, header, header_mask, buf);
+	}
+
+	template <typename String, typename Header>
+	PUGI_IMPL_FN bool set_value_bool(String& dest, Header& header, uintptr_t header_mask, bool value)
+	{
+		return strcpy_insitu(dest, header, header_mask, value ? PUGIXML_TEXT("true") : PUGIXML_TEXT("false"), value ? 4 : 5);
+	}
+
+	PUGI_IMPL_FN xml_parse_result load_buffer_impl(xml_document_struct* doc, xml_node_struct* root, void* contents, size_t size, unsigned int options, xml_encoding encoding, bool is_mutable, bool own, char_t** out_buffer)
+	{
+		// check input buffer
+		if (!contents && size) return make_parse_result(status_io_error);
+
+		// get actual encoding
+		xml_encoding buffer_encoding = impl::get_buffer_encoding(encoding, contents, size);
+
+		// if convert_buffer below throws bad_alloc, we still need to deallocate contents if we own it
+		auto_deleter<void> contents_guard(own ? contents : NULL, xml_memory::deallocate);
+
+		// get private buffer
+		char_t* buffer = NULL;
+		size_t length = 0;
+
+		// coverity[var_deref_model]
+		if (!impl::convert_buffer(buffer, length, buffer_encoding, contents, size, is_mutable)) return impl::make_parse_result(status_out_of_memory);
+
+		// after this we either deallocate contents (below) or hold on to it via doc->buffer, so we don't need to guard it
+		contents_guard.release();
+
+		// delete original buffer if we performed a conversion
+		if (own && buffer != contents && contents) impl::xml_memory::deallocate(contents);
+
+		// grab onto buffer if it's our buffer, user is responsible for deallocating contents himself
+		if (own || buffer != contents) *out_buffer = buffer;
+
+		// store buffer for offset_debug
+		doc->buffer = buffer;
+
+		// parse
+		xml_parse_result res = impl::xml_parser::parse(buffer, length, doc, root, options);
+
+		// remember encoding
+		res.encoding = buffer_encoding;
+
+		return res;
+	}
+
+	template <typename T> PUGI_IMPL_FN xml_parse_status convert_file_size(T length, size_t& out_result)
+	{
+		// check for I/O errors
+		if (length < 0) return status_io_error;
+
+		// check for overflow
+		size_t result = static_cast<size_t>(length);
+
+		if (static_cast<T>(result) != length) return status_out_of_memory;
+
+		out_result = result;
+		return status_ok;
+	}
+
+	// we need to get length of entire file to load it in memory; the only (relatively) sane way to do it is via seek/tell trick
+	PUGI_IMPL_FN xml_parse_status get_file_size(FILE* file, size_t& out_result)
+	{
+	#if defined(__linux__) || defined(__APPLE__)
+		// this simultaneously retrieves the file size and file mode (to guard against loading non-files)
+		struct stat st;
+		if (fstat(fileno(file), &st) != 0) return status_io_error;
+
+		// anything that's not a regular file doesn't have a coherent length
+		if (!S_ISREG(st.st_mode)) return status_io_error;
+
+		xml_parse_status status = convert_file_size(st.st_size, out_result);
+	#elif defined(PUGI_IMPL_MSVC_CRT_VERSION) && PUGI_IMPL_MSVC_CRT_VERSION >= 1400
+		// there are 64-bit versions of fseek/ftell, let's use them
+		_fseeki64(file, 0, SEEK_END);
+		__int64 length = _ftelli64(file);
+		_fseeki64(file, 0, SEEK_SET);
+
+		xml_parse_status status = convert_file_size(length, out_result);
+	#elif defined(__MINGW32__) && !defined(__NO_MINGW_LFS) && (!defined(__STRICT_ANSI__) || defined(__MINGW64_VERSION_MAJOR))
+		// there are 64-bit versions of fseek/ftell, let's use them
+		fseeko64(file, 0, SEEK_END);
+		off64_t length = ftello64(file);
+		fseeko64(file, 0, SEEK_SET);
+
+		xml_parse_status status = convert_file_size(length, out_result);
+	#else
+		// if this is a 32-bit OS, long is enough; if this is a unix system, long is 64-bit, which is enough; otherwise we can't do anything anyway.
+		fseek(file, 0, SEEK_END);
+		long length = ftell(file);
+		fseek(file, 0, SEEK_SET);
+
+		xml_parse_status status = convert_file_size(length, out_result);
+	#endif
+
+		return status;
+	}
+
+	// This function assumes that buffer has extra sizeof(char_t) writable bytes after size
+	PUGI_IMPL_FN size_t zero_terminate_buffer(void* buffer, size_t size, xml_encoding encoding)
+	{
+		// We only need to zero-terminate if encoding conversion does not do it for us
+	#ifdef PUGIXML_WCHAR_MODE
+		xml_encoding wchar_encoding = get_wchar_encoding();
+
+		if (encoding == wchar_encoding || need_endian_swap_utf(encoding, wchar_encoding))
+		{
+			size_t length = size / sizeof(char_t);
+
+			static_cast<char_t*>(buffer)[length] = 0;
+			return (length + 1) * sizeof(char_t);
+		}
+	#else
+		if (encoding == encoding_utf8)
+		{
+			static_cast<char*>(buffer)[size] = 0;
+			return size + 1;
+		}
+	#endif
+
+		return size;
+	}
+
+	PUGI_IMPL_FN xml_parse_result load_file_impl(xml_document_struct* doc, FILE* file, unsigned int options, xml_encoding encoding, char_t** out_buffer)
+	{
+		if (!file) return make_parse_result(status_file_not_found);
+
+		// get file size (can result in I/O errors)
+		size_t size = 0;
+		xml_parse_status size_status = get_file_size(file, size);
+		if (size_status != status_ok) return make_parse_result(size_status);
+
+		size_t max_suffix_size = sizeof(char_t);
+
+		// allocate buffer for the whole file
+		char* contents = static_cast<char*>(xml_memory::allocate(size + max_suffix_size));
+		if (!contents) return make_parse_result(status_out_of_memory);
+
+		// read file in memory
+		size_t read_size = fread(contents, 1, size, file);
+
+		if (read_size != size)
+		{
+			xml_memory::deallocate(contents);
+			return make_parse_result(status_io_error);
+		}
+
+		xml_encoding real_encoding = get_buffer_encoding(encoding, contents, size);
+
+		return load_buffer_impl(doc, doc, contents, zero_terminate_buffer(contents, size, real_encoding), options, real_encoding, true, true, out_buffer);
+	}
+
+	PUGI_IMPL_FN void close_file(FILE* file)
+	{
+		fclose(file);
+	}
+
+#ifndef PUGIXML_NO_STL
+	template <typename T> struct xml_stream_chunk
+	{
+		static xml_stream_chunk* create()
+		{
+			void* memory = xml_memory::allocate(sizeof(xml_stream_chunk));
+			if (!memory) return NULL;
+
+			return new (memory) xml_stream_chunk();
+		}
+
+		static void destroy(xml_stream_chunk* chunk)
+		{
+			// free chunk chain
+			while (chunk)
+			{
+				xml_stream_chunk* next_ = chunk->next;
+
+				xml_memory::deallocate(chunk);
+
+				chunk = next_;
+			}
+		}
+
+		xml_stream_chunk(): next(NULL), size(0)
+		{
+		}
+
+		xml_stream_chunk* next;
+		size_t size;
+
+		T data[xml_memory_page_size / sizeof(T)];
+	};
+
+	template <typename T> PUGI_IMPL_FN xml_parse_status load_stream_data_noseek(std::basic_istream<T>& stream, void** out_buffer, size_t* out_size)
+	{
+		auto_deleter<xml_stream_chunk<T> > chunks(NULL, xml_stream_chunk<T>::destroy);
+
+		// read file to a chunk list
+		size_t total = 0;
+		xml_stream_chunk<T>* last = NULL;
+
+		while (!stream.eof())
+		{
+			// allocate new chunk
+			xml_stream_chunk<T>* chunk = xml_stream_chunk<T>::create();
+			if (!chunk) return status_out_of_memory;
+
+			// append chunk to list
+			if (last) last = last->next = chunk;
+			else chunks.data = last = chunk;
+
+			// read data to chunk
+			stream.read(chunk->data, static_cast<std::streamsize>(sizeof(chunk->data) / sizeof(T)));
+			chunk->size = static_cast<size_t>(stream.gcount()) * sizeof(T);
+
+			// read may set failbit | eofbit in case gcount() is less than read length, so check for other I/O errors
+			if (stream.bad() || (!stream.eof() && stream.fail())) return status_io_error;
+
+			// guard against huge files (chunk size is small enough to make this overflow check work)
+			if (total + chunk->size < total) return status_out_of_memory;
+			total += chunk->size;
+		}
+
+		size_t max_suffix_size = sizeof(char_t);
+
+		// copy chunk list to a contiguous buffer
+		char* buffer = static_cast<char*>(xml_memory::allocate(total + max_suffix_size));
+		if (!buffer) return status_out_of_memory;
+
+		char* write = buffer;
+
+		for (xml_stream_chunk<T>* chunk = chunks.data; chunk; chunk = chunk->next)
+		{
+			assert(write + chunk->size <= buffer + total);
+			memcpy(write, chunk->data, chunk->size);
+			write += chunk->size;
+		}
+
+		assert(write == buffer + total);
+
+		// return buffer
+		*out_buffer = buffer;
+		*out_size = total;
+
+		return status_ok;
+	}
+
+	template <typename T> PUGI_IMPL_FN xml_parse_status load_stream_data_seek(std::basic_istream<T>& stream, void** out_buffer, size_t* out_size)
+	{
+		// get length of remaining data in stream
+		typename std::basic_istream<T>::pos_type pos = stream.tellg();
+		stream.seekg(0, std::ios::end);
+		std::streamoff length = stream.tellg() - pos;
+		stream.seekg(pos);
+
+		if (stream.fail() || pos < 0) return status_io_error;
+
+		// guard against huge files
+		size_t read_length = static_cast<size_t>(length);
+
+		if (static_cast<std::streamsize>(read_length) != length || length < 0) return status_out_of_memory;
+
+		size_t max_suffix_size = sizeof(char_t);
+
+		// read stream data into memory (guard against stream exceptions with buffer holder)
+		auto_deleter<void> buffer(xml_memory::allocate(read_length * sizeof(T) + max_suffix_size), xml_memory::deallocate);
+		if (!buffer.data) return status_out_of_memory;
+
+		stream.read(static_cast<T*>(buffer.data), static_cast<std::streamsize>(read_length));
+
+		// read may set failbit | eofbit in case gcount() is less than read_length (i.e. line ending conversion), so check for other I/O errors
+		if (stream.bad() || (!stream.eof() && stream.fail())) return status_io_error;
+
+		// return buffer
+		size_t actual_length = static_cast<size_t>(stream.gcount());
+		assert(actual_length <= read_length);
+
+		*out_buffer = buffer.release();
+		*out_size = actual_length * sizeof(T);
+
+		return status_ok;
+	}
+
+	template <typename T> PUGI_IMPL_FN xml_parse_result load_stream_impl(xml_document_struct* doc, std::basic_istream<T>& stream, unsigned int options, xml_encoding encoding, char_t** out_buffer)
+	{
+		void* buffer = NULL;
+		size_t size = 0;
+		xml_parse_status status = status_ok;
+
+		// if stream has an error bit set, bail out (otherwise tellg() can fail and we'll clear error bits)
+		if (stream.fail()) return make_parse_result(status_io_error);
+
+		// load stream to memory (using seek-based implementation if possible, since it's faster and takes less memory)
+		if (stream.tellg() < 0)
+		{
+			stream.clear(); // clear error flags that could be set by a failing tellg
+			status = load_stream_data_noseek(stream, &buffer, &size);
+		}
+		else
+			status = load_stream_data_seek(stream, &buffer, &size);
+
+		if (status != status_ok) return make_parse_result(status);
+
+		xml_encoding real_encoding = get_buffer_encoding(encoding, buffer, size);
+
+		return load_buffer_impl(doc, doc, buffer, zero_terminate_buffer(buffer, size, real_encoding), options, real_encoding, true, true, out_buffer);
+	}
+#endif
+
+#if defined(PUGI_IMPL_MSVC_CRT_VERSION) || defined(__BORLANDC__) || (defined(__MINGW32__) && (!defined(__STRICT_ANSI__) || defined(__MINGW64_VERSION_MAJOR)))
+	PUGI_IMPL_FN FILE* open_file_wide(const wchar_t* path, const wchar_t* mode)
+	{
+#ifdef PUGIXML_NO_STL
+		// ensure these symbols are consistently referenced to avoid 'unreferenced function' warnings
+		// note that generally these functions are used in STL builds, but PUGIXML_NO_STL leaves the only usage in convert_path_heap
+		(void)&as_utf8_begin;
+		(void)&as_utf8_end;
+		(void)&strlength_wide;
+#endif
+
+#if defined(PUGI_IMPL_MSVC_CRT_VERSION) && PUGI_IMPL_MSVC_CRT_VERSION >= 1400
+		FILE* file = NULL;
+		return _wfopen_s(&file, path, mode) == 0 ? file : NULL;
+#else
+		return _wfopen(path, mode);
+#endif
+	}
+#else
+	PUGI_IMPL_FN char* convert_path_heap(const wchar_t* str)
+	{
+		assert(str);
+
+		// first pass: get length in utf8 characters
+		size_t length = strlength_wide(str);
+		size_t size = as_utf8_begin(str, length);
+
+		// allocate resulting string
+		char* result = static_cast<char*>(xml_memory::allocate(size + 1));
+		if (!result) return NULL;
+
+		// second pass: convert to utf8
+		as_utf8_end(result, size, str, length);
+
+		// zero-terminate
+		result[size] = 0;
+
+		return result;
+	}
+
+	PUGI_IMPL_FN FILE* open_file_wide(const wchar_t* path, const wchar_t* mode)
+	{
+		// there is no standard function to open wide paths, so our best bet is to try utf8 path
+		char* path_utf8 = convert_path_heap(path);
+		if (!path_utf8) return NULL;
+
+		// convert mode to ASCII (we mirror _wfopen interface)
+		char mode_ascii[4] = {0};
+		for (size_t i = 0; mode[i]; ++i) mode_ascii[i] = static_cast<char>(mode[i]);
+
+		// try to open the utf8 path
+		FILE* result = fopen(path_utf8, mode_ascii);
+
+		// free dummy buffer
+		xml_memory::deallocate(path_utf8);
+
+		return result;
+	}
+#endif
+
+	PUGI_IMPL_FN FILE* open_file(const char* path, const char* mode)
+	{
+#if defined(PUGI_IMPL_MSVC_CRT_VERSION) && PUGI_IMPL_MSVC_CRT_VERSION >= 1400
+		FILE* file = NULL;
+		return fopen_s(&file, path, mode) == 0 ? file : NULL;
+#else
+		return fopen(path, mode);
+#endif
+	}
+
+	PUGI_IMPL_FN bool save_file_impl(const xml_document& doc, FILE* file, const char_t* indent, unsigned int flags, xml_encoding encoding)
+	{
+		if (!file) return false;
+
+		xml_writer_file writer(file);
+		doc.save(writer, indent, flags, encoding);
+
+		return fflush(file) == 0 && ferror(file) == 0;
+	}
+
+	struct name_null_sentry
+	{
+		xml_node_struct* node;
+		char_t* name;
+
+		name_null_sentry(xml_node_struct* node_): node(node_), name(node_->name)
+		{
+			node->name = NULL;
+		}
+
+		~name_null_sentry()
+		{
+			node->name = name;
+		}
+	};
+PUGI_IMPL_NS_END
+
+namespace pugi
+{
+	PUGI_IMPL_FN xml_writer::~xml_writer()
+	{
+	}
+
+	PUGI_IMPL_FN xml_writer_file::xml_writer_file(void* file_): file(file_)
+	{
+	}
+
+	PUGI_IMPL_FN void xml_writer_file::write(const void* data, size_t size)
+	{
+		size_t result = fwrite(data, 1, size, static_cast<FILE*>(file));
+		(void)!result; // unfortunately we can't do proper error handling here
+	}
+
+#ifndef PUGIXML_NO_STL
+	PUGI_IMPL_FN xml_writer_stream::xml_writer_stream(std::basic_ostream<char>& stream): narrow_stream(&stream), wide_stream(NULL)
+	{
+	}
+
+	PUGI_IMPL_FN xml_writer_stream::xml_writer_stream(std::basic_ostream<wchar_t>& stream): narrow_stream(NULL), wide_stream(&stream)
+	{
+	}
+
+	PUGI_IMPL_FN void xml_writer_stream::write(const void* data, size_t size)
+	{
+		if (narrow_stream)
+		{
+			assert(!wide_stream);
+			narrow_stream->write(reinterpret_cast<const char*>(data), static_cast<std::streamsize>(size));
+		}
+		else
+		{
+			assert(wide_stream);
+			assert(size % sizeof(wchar_t) == 0);
+
+			wide_stream->write(reinterpret_cast<const wchar_t*>(data), static_cast<std::streamsize>(size / sizeof(wchar_t)));
+		}
+	}
+#endif
+
+	PUGI_IMPL_FN xml_tree_walker::xml_tree_walker(): _depth(0)
+	{
+	}
+
+	PUGI_IMPL_FN xml_tree_walker::~xml_tree_walker()
+	{
+	}
+
+	PUGI_IMPL_FN int xml_tree_walker::depth() const
+	{
+		return _depth;
+	}
+
+	PUGI_IMPL_FN bool xml_tree_walker::begin(xml_node&)
+	{
+		return true;
+	}
+
+	PUGI_IMPL_FN bool xml_tree_walker::end(xml_node&)
+	{
+		return true;
+	}
+
+	PUGI_IMPL_FN xml_attribute::xml_attribute(): _attr(NULL)
+	{
+	}
+
+	PUGI_IMPL_FN xml_attribute::xml_attribute(xml_attribute_struct* attr): _attr(attr)
+	{
+	}
+
+	PUGI_IMPL_FN static void unspecified_bool_xml_attribute(xml_attribute***)
+	{
+	}
+
+	PUGI_IMPL_FN xml_attribute::operator xml_attribute::unspecified_bool_type() const
+	{
+		return _attr ? unspecified_bool_xml_attribute : NULL;
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::operator!() const
+	{
+		return !_attr;
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::operator==(const xml_attribute& r) const
+	{
+		return (_attr == r._attr);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::operator!=(const xml_attribute& r) const
+	{
+		return (_attr != r._attr);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::operator<(const xml_attribute& r) const
+	{
+		return (_attr < r._attr);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::operator>(const xml_attribute& r) const
+	{
+		return (_attr > r._attr);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::operator<=(const xml_attribute& r) const
+	{
+		return (_attr <= r._attr);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::operator>=(const xml_attribute& r) const
+	{
+		return (_attr >= r._attr);
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_attribute::next_attribute() const
+	{
+		if (!_attr) return xml_attribute();
+		return xml_attribute(_attr->next_attribute);
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_attribute::previous_attribute() const
+	{
+		if (!_attr) return xml_attribute();
+		xml_attribute_struct* prev = _attr->prev_attribute_c;
+		return prev->next_attribute ? xml_attribute(prev) : xml_attribute();
+	}
+
+	PUGI_IMPL_FN const char_t* xml_attribute::as_string(const char_t* def) const
+	{
+		if (!_attr) return def;
+		const char_t* value = _attr->value;
+		return value ? value : def;
+	}
+
+	PUGI_IMPL_FN int xml_attribute::as_int(int def) const
+	{
+		if (!_attr) return def;
+		const char_t* value = _attr->value;
+		return value ? impl::get_value_int(value) : def;
+	}
+
+	PUGI_IMPL_FN unsigned int xml_attribute::as_uint(unsigned int def) const
+	{
+		if (!_attr) return def;
+		const char_t* value = _attr->value;
+		return value ? impl::get_value_uint(value) : def;
+	}
+
+	PUGI_IMPL_FN double xml_attribute::as_double(double def) const
+	{
+		if (!_attr) return def;
+		const char_t* value = _attr->value;
+		return value ? impl::get_value_double(value) : def;
+	}
+
+	PUGI_IMPL_FN float xml_attribute::as_float(float def) const
+	{
+		if (!_attr) return def;
+		const char_t* value = _attr->value;
+		return value ? impl::get_value_float(value) : def;
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::as_bool(bool def) const
+	{
+		if (!_attr) return def;
+		const char_t* value = _attr->value;
+		return value ? impl::get_value_bool(value) : def;
+	}
+
+#ifdef PUGIXML_HAS_LONG_LONG
+	PUGI_IMPL_FN long long xml_attribute::as_llong(long long def) const
+	{
+		if (!_attr) return def;
+		const char_t* value = _attr->value;
+		return value ? impl::get_value_llong(value) : def;
+	}
+
+	PUGI_IMPL_FN unsigned long long xml_attribute::as_ullong(unsigned long long def) const
+	{
+		if (!_attr) return def;
+		const char_t* value = _attr->value;
+		return value ? impl::get_value_ullong(value) : def;
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_attribute::empty() const
+	{
+		return !_attr;
+	}
+
+	PUGI_IMPL_FN const char_t* xml_attribute::name() const
+	{
+		if (!_attr) return PUGIXML_TEXT("");
+		const char_t* name = _attr->name;
+		return name ? name : PUGIXML_TEXT("");
+	}
+
+	PUGI_IMPL_FN const char_t* xml_attribute::value() const
+	{
+		if (!_attr) return PUGIXML_TEXT("");
+		const char_t* value = _attr->value;
+		return value ? value : PUGIXML_TEXT("");
+	}
+
+	PUGI_IMPL_FN size_t xml_attribute::hash_value() const
+	{
+		return reinterpret_cast<uintptr_t>(_attr) / sizeof(xml_attribute_struct);
+	}
+
+	PUGI_IMPL_FN xml_attribute_struct* xml_attribute::internal_object() const
+	{
+		return _attr;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(const char_t* rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(int rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(unsigned int rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(long rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(unsigned long rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(double rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(float rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(bool rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(string_view_t rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+#endif
+
+#ifdef PUGIXML_HAS_LONG_LONG
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(long long rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute::operator=(unsigned long long rhs)
+	{
+		set_value(rhs);
+		return *this;
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_attribute::set_name(const char_t* rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::strcpy_insitu(_attr->name, _attr->header, impl::xml_memory_page_name_allocated_mask, rhs, impl::strlength(rhs));
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_name(const char_t* rhs, size_t size)
+	{
+		if (!_attr) return false;
+
+		return impl::strcpy_insitu(_attr->name, _attr->header, impl::xml_memory_page_name_allocated_mask, rhs, size);
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN bool xml_attribute::set_name(string_view_t rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::strcpy_insitu(_attr->name, _attr->header, impl::xml_memory_page_name_allocated_mask, rhs.data(), rhs.size());
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(const char_t* rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::strcpy_insitu(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, impl::strlength(rhs));
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(const char_t* rhs, size_t size)
+	{
+		if (!_attr) return false;
+
+		return impl::strcpy_insitu(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, size);
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN bool xml_attribute::set_value(string_view_t rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::strcpy_insitu(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs.data(), rhs.size());
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(int rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_integer<unsigned int>(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, rhs < 0);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(unsigned int rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_integer<unsigned int>(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, false);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(long rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_integer<unsigned long>(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, rhs < 0);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(unsigned long rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_integer<unsigned long>(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, false);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(double rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_convert(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, default_double_precision);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(double rhs, int precision)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_convert(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, precision);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(float rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_convert(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, default_float_precision);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(float rhs, int precision)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_convert(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, precision);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(bool rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_bool(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs);
+	}
+
+#ifdef PUGIXML_HAS_LONG_LONG
+	PUGI_IMPL_FN bool xml_attribute::set_value(long long rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_integer<unsigned long long>(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, rhs < 0);
+	}
+
+	PUGI_IMPL_FN bool xml_attribute::set_value(unsigned long long rhs)
+	{
+		if (!_attr) return false;
+
+		return impl::set_value_integer<unsigned long long>(_attr->value, _attr->header, impl::xml_memory_page_value_allocated_mask, rhs, false);
+	}
+#endif
+
+#ifdef __BORLANDC__
+	PUGI_IMPL_FN bool operator&&(const xml_attribute& lhs, bool rhs)
+	{
+		return (bool)lhs && rhs;
+	}
+
+	PUGI_IMPL_FN bool operator||(const xml_attribute& lhs, bool rhs)
+	{
+		return (bool)lhs || rhs;
+	}
+#endif
+
+	PUGI_IMPL_FN xml_node::xml_node(): _root(NULL)
+	{
+	}
+
+	PUGI_IMPL_FN xml_node::xml_node(xml_node_struct* p): _root(p)
+	{
+	}
+
+	PUGI_IMPL_FN static void unspecified_bool_xml_node(xml_node***)
+	{
+	}
+
+	PUGI_IMPL_FN xml_node::operator xml_node::unspecified_bool_type() const
+	{
+		return _root ? unspecified_bool_xml_node : NULL;
+	}
+
+	PUGI_IMPL_FN bool xml_node::operator!() const
+	{
+		return !_root;
+	}
+
+	PUGI_IMPL_FN xml_node::iterator xml_node::begin() const
+	{
+		return iterator(_root ? _root->first_child + 0 : NULL, _root);
+	}
+
+	PUGI_IMPL_FN xml_node::iterator xml_node::end() const
+	{
+		return iterator(NULL, _root);
+	}
+
+	PUGI_IMPL_FN xml_node::attribute_iterator xml_node::attributes_begin() const
+	{
+		return attribute_iterator(_root ? _root->first_attribute + 0 : NULL, _root);
+	}
+
+	PUGI_IMPL_FN xml_node::attribute_iterator xml_node::attributes_end() const
+	{
+		return attribute_iterator(NULL, _root);
+	}
+
+	PUGI_IMPL_FN xml_object_range<xml_node_iterator> xml_node::children() const
+	{
+		return xml_object_range<xml_node_iterator>(begin(), end());
+	}
+
+	PUGI_IMPL_FN xml_object_range<xml_named_node_iterator> xml_node::children(const char_t* name_) const
+	{
+		return xml_object_range<xml_named_node_iterator>(xml_named_node_iterator(child(name_)._root, _root, name_), xml_named_node_iterator(NULL, _root, name_));
+	}
+
+	PUGI_IMPL_FN xml_object_range<xml_attribute_iterator> xml_node::attributes() const
+	{
+		return xml_object_range<xml_attribute_iterator>(attributes_begin(), attributes_end());
+	}
+
+	PUGI_IMPL_FN bool xml_node::operator==(const xml_node& r) const
+	{
+		return (_root == r._root);
+	}
+
+	PUGI_IMPL_FN bool xml_node::operator!=(const xml_node& r) const
+	{
+		return (_root != r._root);
+	}
+
+	PUGI_IMPL_FN bool xml_node::operator<(const xml_node& r) const
+	{
+		return (_root < r._root);
+	}
+
+	PUGI_IMPL_FN bool xml_node::operator>(const xml_node& r) const
+	{
+		return (_root > r._root);
+	}
+
+	PUGI_IMPL_FN bool xml_node::operator<=(const xml_node& r) const
+	{
+		return (_root <= r._root);
+	}
+
+	PUGI_IMPL_FN bool xml_node::operator>=(const xml_node& r) const
+	{
+		return (_root >= r._root);
+	}
+
+	PUGI_IMPL_FN bool xml_node::empty() const
+	{
+		return !_root;
+	}
+
+	PUGI_IMPL_FN const char_t* xml_node::name() const
+	{
+		if (!_root) return PUGIXML_TEXT("");
+		const char_t* name = _root->name;
+		return name ? name : PUGIXML_TEXT("");
+	}
+
+	PUGI_IMPL_FN xml_node_type xml_node::type() const
+	{
+		return _root ? PUGI_IMPL_NODETYPE(_root) : node_null;
+	}
+
+	PUGI_IMPL_FN const char_t* xml_node::value() const
+	{
+		if (!_root) return PUGIXML_TEXT("");
+		const char_t* value = _root->value;
+		return value ? value : PUGIXML_TEXT("");
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::child(const char_t* name_) const
+	{
+		if (!_root) return xml_node();
+
+		for (xml_node_struct* i = _root->first_child; i; i = i->next_sibling)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::strequal(name_, iname))
+				return xml_node(i);
+		}
+
+		return xml_node();
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::attribute(const char_t* name_) const
+	{
+		if (!_root) return xml_attribute();
+
+		for (xml_attribute_struct* i = _root->first_attribute; i; i = i->next_attribute)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::strequal(name_, iname))
+				return xml_attribute(i);
+		}
+
+		return xml_attribute();
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::next_sibling(const char_t* name_) const
+	{
+		if (!_root) return xml_node();
+
+		for (xml_node_struct* i = _root->next_sibling; i; i = i->next_sibling)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::strequal(name_, iname))
+				return xml_node(i);
+		}
+
+		return xml_node();
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::next_sibling() const
+	{
+		return _root ? xml_node(_root->next_sibling) : xml_node();
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::previous_sibling(const char_t* name_) const
+	{
+		if (!_root) return xml_node();
+
+		for (xml_node_struct* i = _root->prev_sibling_c; i->next_sibling; i = i->prev_sibling_c)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::strequal(name_, iname))
+				return xml_node(i);
+		}
+
+		return xml_node();
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN xml_node xml_node::child(string_view_t name_) const
+	{
+		if (!_root) return xml_node();
+
+		for (xml_node_struct* i = _root->first_child; i; i = i->next_sibling)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::stringview_equal(name_, iname))
+				return xml_node(i);
+		}
+
+		return xml_node();
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::attribute(string_view_t name_) const
+	{
+		if (!_root) return xml_attribute();
+
+		for (xml_attribute_struct* i = _root->first_attribute; i; i = i->next_attribute)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::stringview_equal(name_, iname))
+				return xml_attribute(i);
+		}
+
+		return xml_attribute();
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::next_sibling(string_view_t name_) const
+	{
+		if (!_root) return xml_node();
+
+		for (xml_node_struct* i = _root->next_sibling; i; i = i->next_sibling)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::stringview_equal(name_, iname))
+				return xml_node(i);
+		}
+
+		return xml_node();
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::previous_sibling(string_view_t name_) const
+	{
+		if (!_root) return xml_node();
+
+		for (xml_node_struct* i = _root->prev_sibling_c; i->next_sibling; i = i->prev_sibling_c)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::stringview_equal(name_, iname))
+				return xml_node(i);
+		}
+
+		return xml_node();
+	}
+#endif
+
+	PUGI_IMPL_FN xml_attribute xml_node::attribute(const char_t* name_, xml_attribute& hint_) const
+	{
+		xml_attribute_struct* hint = hint_._attr;
+
+		// if hint is not an attribute of node, behavior is not defined
+		assert(!hint || (_root && impl::is_attribute_of(hint, _root)));
+
+		if (!_root) return xml_attribute();
+
+		// optimistically search from hint up until the end
+		for (xml_attribute_struct* i = hint; i; i = i->next_attribute)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::strequal(name_, iname))
+			{
+				// update hint to maximize efficiency of searching for consecutive attributes
+				hint_._attr = i->next_attribute;
+
+				return xml_attribute(i);
+			}
+		}
+
+		// wrap around and search from the first attribute until the hint
+		// 'j' null pointer check is technically redundant, but it prevents a crash in case the assertion above fails
+		for (xml_attribute_struct* j = _root->first_attribute; j && j != hint; j = j->next_attribute)
+		{
+			const char_t* jname = j->name;
+			if (jname && impl::strequal(name_, jname))
+			{
+				// update hint to maximize efficiency of searching for consecutive attributes
+				hint_._attr = j->next_attribute;
+
+				return xml_attribute(j);
+			}
+		}
+
+		return xml_attribute();
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN xml_attribute xml_node::attribute(string_view_t name_, xml_attribute& hint_) const
+	{
+		xml_attribute_struct* hint = hint_._attr;
+
+		// if hint is not an attribute of node, behavior is not defined
+		assert(!hint || (_root && impl::is_attribute_of(hint, _root)));
+
+		if (!_root) return xml_attribute();
+
+		// optimistically search from hint up until the end
+		for (xml_attribute_struct* i = hint; i; i = i->next_attribute)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::stringview_equal(name_, iname))
+			{
+				// update hint to maximize efficiency of searching for consecutive attributes
+				hint_._attr = i->next_attribute;
+
+				return xml_attribute(i);
+			}
+		}
+
+		// wrap around and search from the first attribute until the hint
+		// 'j' null pointer check is technically redundant, but it prevents a crash in case the assertion above fails
+		for (xml_attribute_struct* j = _root->first_attribute; j && j != hint; j = j->next_attribute)
+		{
+			const char_t* jname = j->name;
+			if (jname && impl::stringview_equal(name_, jname))
+			{
+				// update hint to maximize efficiency of searching for consecutive attributes
+				hint_._attr = j->next_attribute;
+
+				return xml_attribute(j);
+			}
+		}
+
+		return xml_attribute();
+	}
+#endif
+
+	PUGI_IMPL_FN xml_node xml_node::previous_sibling() const
+	{
+		if (!_root) return xml_node();
+		xml_node_struct* prev = _root->prev_sibling_c;
+		return prev->next_sibling ? xml_node(prev) : xml_node();
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::parent() const
+	{
+		return _root ? xml_node(_root->parent) : xml_node();
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::root() const
+	{
+		return _root ? xml_node(&impl::get_document(_root)) : xml_node();
+	}
+
+	PUGI_IMPL_FN xml_text xml_node::text() const
+	{
+		return xml_text(_root);
+	}
+
+	PUGI_IMPL_FN const char_t* xml_node::child_value() const
+	{
+		if (!_root) return PUGIXML_TEXT("");
+
+		// element nodes can have value if parse_embed_pcdata was used
+		if (PUGI_IMPL_NODETYPE(_root) == node_element && _root->value)
+			return _root->value;
+
+		for (xml_node_struct* i = _root->first_child; i; i = i->next_sibling)
+		{
+			const char_t* ivalue = i->value;
+			if (impl::is_text_node(i) && ivalue)
+				return ivalue;
+		}
+
+		return PUGIXML_TEXT("");
+	}
+
+	PUGI_IMPL_FN const char_t* xml_node::child_value(const char_t* name_) const
+	{
+		return child(name_).child_value();
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::first_attribute() const
+	{
+		if (!_root) return xml_attribute();
+		return xml_attribute(_root->first_attribute);
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::last_attribute() const
+	{
+		if (!_root) return xml_attribute();
+		xml_attribute_struct* first = _root->first_attribute;
+		return first ? xml_attribute(first->prev_attribute_c) : xml_attribute();
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::first_child() const
+	{
+		if (!_root) return xml_node();
+		return xml_node(_root->first_child);
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::last_child() const
+	{
+		if (!_root) return xml_node();
+		xml_node_struct* first = _root->first_child;
+		return first ? xml_node(first->prev_sibling_c) : xml_node();
+	}
+
+	PUGI_IMPL_FN bool xml_node::set_name(const char_t* rhs)
+	{
+		xml_node_type type_ = _root ? PUGI_IMPL_NODETYPE(_root) : node_null;
+
+		if (type_ != node_element && type_ != node_pi && type_ != node_declaration)
+			return false;
+
+		return impl::strcpy_insitu(_root->name, _root->header, impl::xml_memory_page_name_allocated_mask, rhs, impl::strlength(rhs));
+	}
+
+	PUGI_IMPL_FN bool xml_node::set_name(const char_t* rhs, size_t size)
+	{
+		xml_node_type type_ = _root ? PUGI_IMPL_NODETYPE(_root) : node_null;
+
+		if (type_ != node_element && type_ != node_pi && type_ != node_declaration)
+			return false;
+
+		return impl::strcpy_insitu(_root->name, _root->header, impl::xml_memory_page_name_allocated_mask, rhs, size);
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN bool xml_node::set_name(string_view_t rhs)
+	{
+		xml_node_type type_ = _root ? PUGI_IMPL_NODETYPE(_root) : node_null;
+
+		if (type_ != node_element && type_ != node_pi && type_ != node_declaration)
+			return false;
+
+		return impl::strcpy_insitu(_root->name, _root->header, impl::xml_memory_page_name_allocated_mask, rhs.data(), rhs.size());
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_node::set_value(const char_t* rhs)
+	{
+		xml_node_type type_ = _root ? PUGI_IMPL_NODETYPE(_root) : node_null;
+
+		if (type_ != node_pcdata && type_ != node_cdata && type_ != node_comment && type_ != node_pi && type_ != node_doctype)
+			return false;
+
+		return impl::strcpy_insitu(_root->value, _root->header, impl::xml_memory_page_value_allocated_mask, rhs, impl::strlength(rhs));
+	}
+
+	PUGI_IMPL_FN bool xml_node::set_value(const char_t* rhs, size_t size)
+	{
+		xml_node_type type_ = _root ? PUGI_IMPL_NODETYPE(_root) : node_null;
+
+		if (type_ != node_pcdata && type_ != node_cdata && type_ != node_comment && type_ != node_pi && type_ != node_doctype)
+			return false;
+
+		return impl::strcpy_insitu(_root->value, _root->header, impl::xml_memory_page_value_allocated_mask, rhs, size);
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN bool xml_node::set_value(string_view_t rhs)
+	{
+		xml_node_type type_ = _root ? PUGI_IMPL_NODETYPE(_root) : node_null;
+
+		if (type_ != node_pcdata && type_ != node_cdata && type_ != node_comment && type_ != node_pi && type_ != node_doctype)
+			return false;
+
+		return impl::strcpy_insitu(_root->value, _root->header, impl::xml_memory_page_value_allocated_mask, rhs.data(), rhs.size());
+	}
+#endif
+
+	PUGI_IMPL_FN xml_attribute xml_node::append_attribute(const char_t* name_)
+	{
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::append_attribute(a._attr, _root);
+
+		a.set_name(name_);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::prepend_attribute(const char_t* name_)
+	{
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::prepend_attribute(a._attr, _root);
+
+		a.set_name(name_);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::insert_attribute_after(const char_t* name_, const xml_attribute& attr)
+	{
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+		if (!attr || !impl::is_attribute_of(attr._attr, _root)) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::insert_attribute_after(a._attr, attr._attr, _root);
+
+		a.set_name(name_);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::insert_attribute_before(const char_t* name_, const xml_attribute& attr)
+	{
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+		if (!attr || !impl::is_attribute_of(attr._attr, _root)) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::insert_attribute_before(a._attr, attr._attr, _root);
+
+		a.set_name(name_);
+
+		return a;
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN xml_attribute xml_node::append_attribute(string_view_t name_)
+	{
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::append_attribute(a._attr, _root);
+
+		a.set_name(name_);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::prepend_attribute(string_view_t name_)
+	{
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::prepend_attribute(a._attr, _root);
+
+		a.set_name(name_);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::insert_attribute_after(string_view_t name_, const xml_attribute& attr)
+	{
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+		if (!attr || !impl::is_attribute_of(attr._attr, _root)) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::insert_attribute_after(a._attr, attr._attr, _root);
+
+		a.set_name(name_);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::insert_attribute_before(string_view_t name_, const xml_attribute& attr)
+	{
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+		if (!attr || !impl::is_attribute_of(attr._attr, _root)) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::insert_attribute_before(a._attr, attr._attr, _root);
+
+		a.set_name(name_);
+
+		return a;
+	}
+#endif
+
+	PUGI_IMPL_FN xml_attribute xml_node::append_copy(const xml_attribute& proto)
+	{
+		if (!proto) return xml_attribute();
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::append_attribute(a._attr, _root);
+		impl::node_copy_attribute(a._attr, proto._attr);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::prepend_copy(const xml_attribute& proto)
+	{
+		if (!proto) return xml_attribute();
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::prepend_attribute(a._attr, _root);
+		impl::node_copy_attribute(a._attr, proto._attr);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::insert_copy_after(const xml_attribute& proto, const xml_attribute& attr)
+	{
+		if (!proto) return xml_attribute();
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+		if (!attr || !impl::is_attribute_of(attr._attr, _root)) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::insert_attribute_after(a._attr, attr._attr, _root);
+		impl::node_copy_attribute(a._attr, proto._attr);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_attribute xml_node::insert_copy_before(const xml_attribute& proto, const xml_attribute& attr)
+	{
+		if (!proto) return xml_attribute();
+		if (!impl::allow_insert_attribute(type())) return xml_attribute();
+		if (!attr || !impl::is_attribute_of(attr._attr, _root)) return xml_attribute();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_attribute();
+
+		xml_attribute a(impl::allocate_attribute(alloc));
+		if (!a) return xml_attribute();
+
+		impl::insert_attribute_before(a._attr, attr._attr, _root);
+		impl::node_copy_attribute(a._attr, proto._attr);
+
+		return a;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::append_child(xml_node_type type_)
+	{
+		if (!impl::allow_insert_child(type(), type_)) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		xml_node n(impl::allocate_node(alloc, type_));
+		if (!n) return xml_node();
+
+		impl::append_node(n._root, _root);
+
+		if (type_ == node_declaration) n.set_name(PUGIXML_TEXT("xml"));
+
+		return n;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::prepend_child(xml_node_type type_)
+	{
+		if (!impl::allow_insert_child(type(), type_)) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		xml_node n(impl::allocate_node(alloc, type_));
+		if (!n) return xml_node();
+
+		impl::prepend_node(n._root, _root);
+
+		if (type_ == node_declaration) n.set_name(PUGIXML_TEXT("xml"));
+
+		return n;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_child_before(xml_node_type type_, const xml_node& node)
+	{
+		if (!impl::allow_insert_child(type(), type_)) return xml_node();
+		if (!node._root || node._root->parent != _root) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		xml_node n(impl::allocate_node(alloc, type_));
+		if (!n) return xml_node();
+
+		impl::insert_node_before(n._root, node._root);
+
+		if (type_ == node_declaration) n.set_name(PUGIXML_TEXT("xml"));
+
+		return n;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_child_after(xml_node_type type_, const xml_node& node)
+	{
+		if (!impl::allow_insert_child(type(), type_)) return xml_node();
+		if (!node._root || node._root->parent != _root) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		xml_node n(impl::allocate_node(alloc, type_));
+		if (!n) return xml_node();
+
+		impl::insert_node_after(n._root, node._root);
+
+		if (type_ == node_declaration) n.set_name(PUGIXML_TEXT("xml"));
+
+		return n;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::append_child(const char_t* name_)
+	{
+		xml_node result = append_child(node_element);
+
+		result.set_name(name_);
+
+		return result;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::prepend_child(const char_t* name_)
+	{
+		xml_node result = prepend_child(node_element);
+
+		result.set_name(name_);
+
+		return result;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_child_after(const char_t* name_, const xml_node& node)
+	{
+		xml_node result = insert_child_after(node_element, node);
+
+		result.set_name(name_);
+
+		return result;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_child_before(const char_t* name_, const xml_node& node)
+	{
+		xml_node result = insert_child_before(node_element, node);
+
+		result.set_name(name_);
+
+		return result;
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN xml_node xml_node::append_child(string_view_t name_)
+	{
+		xml_node result = append_child(node_element);
+
+		result.set_name(name_);
+
+		return result;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::prepend_child(string_view_t name_)
+	{
+		xml_node result = prepend_child(node_element);
+
+		result.set_name(name_);
+
+		return result;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_child_after(string_view_t name_, const xml_node& node)
+	{
+		xml_node result = insert_child_after(node_element, node);
+
+		result.set_name(name_);
+
+		return result;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_child_before(string_view_t name_, const xml_node& node)
+	{
+		xml_node result = insert_child_before(node_element, node);
+
+		result.set_name(name_);
+
+		return result;
+	}
+#endif
+
+	PUGI_IMPL_FN xml_node xml_node::append_copy(const xml_node& proto)
+	{
+		xml_node_type type_ = proto.type();
+		if (!impl::allow_insert_child(type(), type_)) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		xml_node n(impl::allocate_node(alloc, type_));
+		if (!n) return xml_node();
+
+		impl::append_node(n._root, _root);
+		impl::node_copy_tree(n._root, proto._root);
+
+		return n;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::prepend_copy(const xml_node& proto)
+	{
+		xml_node_type type_ = proto.type();
+		if (!impl::allow_insert_child(type(), type_)) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		xml_node n(impl::allocate_node(alloc, type_));
+		if (!n) return xml_node();
+
+		impl::prepend_node(n._root, _root);
+		impl::node_copy_tree(n._root, proto._root);
+
+		return n;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_copy_after(const xml_node& proto, const xml_node& node)
+	{
+		xml_node_type type_ = proto.type();
+		if (!impl::allow_insert_child(type(), type_)) return xml_node();
+		if (!node._root || node._root->parent != _root) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		xml_node n(impl::allocate_node(alloc, type_));
+		if (!n) return xml_node();
+
+		impl::insert_node_after(n._root, node._root);
+		impl::node_copy_tree(n._root, proto._root);
+
+		return n;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_copy_before(const xml_node& proto, const xml_node& node)
+	{
+		xml_node_type type_ = proto.type();
+		if (!impl::allow_insert_child(type(), type_)) return xml_node();
+		if (!node._root || node._root->parent != _root) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		xml_node n(impl::allocate_node(alloc, type_));
+		if (!n) return xml_node();
+
+		impl::insert_node_before(n._root, node._root);
+		impl::node_copy_tree(n._root, proto._root);
+
+		return n;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::append_move(const xml_node& moved)
+	{
+		if (!impl::allow_move(*this, moved)) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		// disable document_buffer_order optimization since moving nodes around changes document order without changing buffer pointers
+		impl::get_document(_root).header |= impl::xml_memory_page_contents_shared_mask;
+
+		impl::remove_node(moved._root);
+		impl::append_node(moved._root, _root);
+
+		return moved;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::prepend_move(const xml_node& moved)
+	{
+		if (!impl::allow_move(*this, moved)) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		// disable document_buffer_order optimization since moving nodes around changes document order without changing buffer pointers
+		impl::get_document(_root).header |= impl::xml_memory_page_contents_shared_mask;
+
+		impl::remove_node(moved._root);
+		impl::prepend_node(moved._root, _root);
+
+		return moved;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_move_after(const xml_node& moved, const xml_node& node)
+	{
+		if (!impl::allow_move(*this, moved)) return xml_node();
+		if (!node._root || node._root->parent != _root) return xml_node();
+		if (moved._root == node._root) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		// disable document_buffer_order optimization since moving nodes around changes document order without changing buffer pointers
+		impl::get_document(_root).header |= impl::xml_memory_page_contents_shared_mask;
+
+		impl::remove_node(moved._root);
+		impl::insert_node_after(moved._root, node._root);
+
+		return moved;
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::insert_move_before(const xml_node& moved, const xml_node& node)
+	{
+		if (!impl::allow_move(*this, moved)) return xml_node();
+		if (!node._root || node._root->parent != _root) return xml_node();
+		if (moved._root == node._root) return xml_node();
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return xml_node();
+
+		// disable document_buffer_order optimization since moving nodes around changes document order without changing buffer pointers
+		impl::get_document(_root).header |= impl::xml_memory_page_contents_shared_mask;
+
+		impl::remove_node(moved._root);
+		impl::insert_node_before(moved._root, node._root);
+
+		return moved;
+	}
+
+	PUGI_IMPL_FN bool xml_node::remove_attribute(const char_t* name_)
+	{
+		return remove_attribute(attribute(name_));
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN bool xml_node::remove_attribute(string_view_t name_)
+	{
+		return remove_attribute(attribute(name_));
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_node::remove_attribute(const xml_attribute& a)
+	{
+		if (!_root || !a._attr) return false;
+		if (!impl::is_attribute_of(a._attr, _root)) return false;
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return false;
+
+		impl::remove_attribute(a._attr, _root);
+		impl::destroy_attribute(a._attr, alloc);
+
+		return true;
+	}
+
+	PUGI_IMPL_FN bool xml_node::remove_attributes()
+	{
+		if (!_root) return false;
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return false;
+
+		for (xml_attribute_struct* attr = _root->first_attribute; attr; )
+		{
+			xml_attribute_struct* next = attr->next_attribute;
+
+			impl::destroy_attribute(attr, alloc);
+
+			attr = next;
+		}
+
+		_root->first_attribute = NULL;
+
+		return true;
+	}
+
+	PUGI_IMPL_FN bool xml_node::remove_child(const char_t* name_)
+	{
+		return remove_child(child(name_));
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN bool xml_node::remove_child(string_view_t name_)
+	{
+		return remove_child(child(name_));
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_node::remove_child(const xml_node& n)
+	{
+		if (!_root || !n._root || n._root->parent != _root) return false;
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return false;
+
+		impl::remove_node(n._root);
+		impl::destroy_node(n._root, alloc);
+
+		return true;
+	}
+
+	PUGI_IMPL_FN bool xml_node::remove_children()
+	{
+		if (!_root) return false;
+
+		impl::xml_allocator& alloc = impl::get_allocator(_root);
+		if (!alloc.reserve()) return false;
+
+		for (xml_node_struct* cur = _root->first_child; cur; )
+		{
+			xml_node_struct* next = cur->next_sibling;
+
+			impl::destroy_node(cur, alloc);
+
+			cur = next;
+		}
+
+		_root->first_child = NULL;
+
+		return true;
+	}
+
+	PUGI_IMPL_FN xml_parse_result xml_node::append_buffer(const void* contents, size_t size, unsigned int options, xml_encoding encoding)
+	{
+		// append_buffer is only valid for elements/documents
+		if (!impl::allow_insert_child(type(), node_element)) return impl::make_parse_result(status_append_invalid_root);
+
+		// append buffer can not merge PCDATA into existing PCDATA nodes
+		if ((options & parse_merge_pcdata) != 0 && last_child().type() == node_pcdata) return impl::make_parse_result(status_append_invalid_root);
+
+		// get document node
+		impl::xml_document_struct* doc = &impl::get_document(_root);
+
+		// disable document_buffer_order optimization since in a document with multiple buffers comparing buffer pointers does not make sense
+		doc->header |= impl::xml_memory_page_contents_shared_mask;
+
+		// get extra buffer element (we'll store the document fragment buffer there so that we can deallocate it later)
+		impl::xml_memory_page* page = NULL;
+		impl::xml_extra_buffer* extra = static_cast<impl::xml_extra_buffer*>(doc->allocate_memory(sizeof(impl::xml_extra_buffer) + sizeof(void*), page));
+		(void)page;
+
+		if (!extra) return impl::make_parse_result(status_out_of_memory);
+
+	#ifdef PUGIXML_COMPACT
+		// align the memory block to a pointer boundary; this is required for compact mode where memory allocations are only 4b aligned
+		// note that this requires up to sizeof(void*)-1 additional memory, which the allocation above takes into account
+		extra = reinterpret_cast<impl::xml_extra_buffer*>((reinterpret_cast<uintptr_t>(extra) + (sizeof(void*) - 1)) & ~(sizeof(void*) - 1));
+	#endif
+
+		// add extra buffer to the list
+		extra->buffer = NULL;
+		extra->next = doc->extra_buffers;
+		doc->extra_buffers = extra;
+
+		// name of the root has to be NULL before parsing - otherwise closing node mismatches will not be detected at the top level
+		impl::name_null_sentry sentry(_root);
+
+		return impl::load_buffer_impl(doc, _root, const_cast<void*>(contents), size, options, encoding, false, false, &extra->buffer);
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::find_child_by_attribute(const char_t* name_, const char_t* attr_name, const char_t* attr_value) const
+	{
+		if (!_root) return xml_node();
+
+		for (xml_node_struct* i = _root->first_child; i; i = i->next_sibling)
+		{
+			const char_t* iname = i->name;
+			if (iname && impl::strequal(name_, iname))
+			{
+				for (xml_attribute_struct* a = i->first_attribute; a; a = a->next_attribute)
+				{
+					const char_t* aname = a->name;
+					if (aname && impl::strequal(attr_name, aname))
+					{
+						const char_t* avalue = a->value;
+						if (impl::strequal(attr_value, avalue ? avalue : PUGIXML_TEXT("")))
+							return xml_node(i);
+					}
+				}
+			}
+		}
+
+		return xml_node();
+	}
+
+	PUGI_IMPL_FN xml_node xml_node::find_child_by_attribute(const char_t* attr_name, const char_t* attr_value) const
+	{
+		if (!_root) return xml_node();
+
+		for (xml_node_struct* i = _root->first_child; i; i = i->next_sibling)
+			for (xml_attribute_struct* a = i->first_attribute; a; a = a->next_attribute)
+			{
+				const char_t* aname = a->name;
+				if (aname && impl::strequal(attr_name, aname))
+				{
+					const char_t* avalue = a->value;
+					if (impl::strequal(attr_value, avalue ? avalue : PUGIXML_TEXT("")))
+						return xml_node(i);
+				}
+			}
+
+		return xml_node();
+	}
+
+#ifndef PUGIXML_NO_STL
+	PUGI_IMPL_FN string_t xml_node::path(char_t delimiter) const
+	{
+		if (!_root) return string_t();
+
+		size_t offset = 0;
+
+		for (xml_node_struct* i = _root; i; i = i->parent)
+		{
+			const char_t* iname = i->name;
+			offset += (i != _root);
+			offset += iname ? impl::strlength(iname) : 0;
+		}
+
+		string_t result;
+		result.resize(offset);
+
+		for (xml_node_struct* j = _root; j; j = j->parent)
+		{
+			if (j != _root)
+				result[--offset] = delimiter;
+
+			const char_t* jname = j->name;
+			if (jname)
+			{
+				size_t length = impl::strlength(jname);
+
+				offset -= length;
+				memcpy(&result[offset], jname, length * sizeof(char_t));
+			}
+		}
+
+		assert(offset == 0);
+
+		return result;
+	}
+#endif
+
+	PUGI_IMPL_FN xml_node xml_node::first_element_by_path(const char_t* path_, char_t delimiter) const
+	{
+		xml_node context = path_[0] == delimiter ? root() : *this;
+
+		if (!context._root) return xml_node();
+
+		const char_t* path_segment = path_;
+
+		while (*path_segment == delimiter) ++path_segment;
+
+		const char_t* path_segment_end = path_segment;
+
+		while (*path_segment_end && *path_segment_end != delimiter) ++path_segment_end;
+
+		if (path_segment == path_segment_end) return context;
+
+		const char_t* next_segment = path_segment_end;
+
+		while (*next_segment == delimiter) ++next_segment;
+
+		if (*path_segment == '.' && path_segment + 1 == path_segment_end)
+			return context.first_element_by_path(next_segment, delimiter);
+		else if (*path_segment == '.' && *(path_segment+1) == '.' && path_segment + 2 == path_segment_end)
+			return context.parent().first_element_by_path(next_segment, delimiter);
+		else
+		{
+			for (xml_node_struct* j = context._root->first_child; j; j = j->next_sibling)
+			{
+				const char_t* jname = j->name;
+				if (jname && impl::strequalrange(jname, path_segment, static_cast<size_t>(path_segment_end - path_segment)))
+				{
+					xml_node subsearch = xml_node(j).first_element_by_path(next_segment, delimiter);
+
+					if (subsearch) return subsearch;
+				}
+			}
+
+			return xml_node();
+		}
+	}
+
+	PUGI_IMPL_FN bool xml_node::traverse(xml_tree_walker& walker)
+	{
+		walker._depth = -1;
+
+		xml_node arg_begin(_root);
+		if (!walker.begin(arg_begin)) return false;
+
+		xml_node_struct* cur = _root ? _root->first_child + 0 : NULL;
+
+		if (cur)
+		{
+			++walker._depth;
+
+			do
+			{
+				xml_node arg_for_each(cur);
+				if (!walker.for_each(arg_for_each))
+					return false;
+
+				if (cur->first_child)
+				{
+					++walker._depth;
+					cur = cur->first_child;
+				}
+				else if (cur->next_sibling)
+					cur = cur->next_sibling;
+				else
+				{
+					while (!cur->next_sibling && cur != _root && cur->parent)
+					{
+						--walker._depth;
+						cur = cur->parent;
+					}
+
+					if (cur != _root)
+						cur = cur->next_sibling;
+				}
+			}
+			while (cur && cur != _root);
+		}
+
+		assert(walker._depth == -1);
+
+		xml_node arg_end(_root);
+		return walker.end(arg_end);
+	}
+
+	PUGI_IMPL_FN size_t xml_node::hash_value() const
+	{
+		return reinterpret_cast<uintptr_t>(_root) / sizeof(xml_node_struct);
+	}
+
+	PUGI_IMPL_FN xml_node_struct* xml_node::internal_object() const
+	{
+		return _root;
+	}
+
+	PUGI_IMPL_FN void xml_node::print(xml_writer& writer, const char_t* indent, unsigned int flags, xml_encoding encoding, unsigned int depth) const
+	{
+		if (!_root) return;
+
+		impl::xml_buffered_writer buffered_writer(writer, encoding);
+
+		impl::node_output(buffered_writer, _root, indent, flags, depth);
+
+		buffered_writer.flush();
+	}
+
+#ifndef PUGIXML_NO_STL
+	PUGI_IMPL_FN void xml_node::print(std::basic_ostream<char>& stream, const char_t* indent, unsigned int flags, xml_encoding encoding, unsigned int depth) const
+	{
+		xml_writer_stream writer(stream);
+
+		print(writer, indent, flags, encoding, depth);
+	}
+
+	PUGI_IMPL_FN void xml_node::print(std::basic_ostream<wchar_t>& stream, const char_t* indent, unsigned int flags, unsigned int depth) const
+	{
+		xml_writer_stream writer(stream);
+
+		print(writer, indent, flags, encoding_wchar, depth);
+	}
+#endif
+
+	PUGI_IMPL_FN ptrdiff_t xml_node::offset_debug() const
+	{
+		if (!_root) return -1;
+
+		impl::xml_document_struct& doc = impl::get_document(_root);
+
+		// we can determine the offset reliably only if there is exactly once parse buffer
+		if (!doc.buffer || doc.extra_buffers) return -1;
+
+		switch (type())
+		{
+		case node_document:
+			return 0;
+
+		case node_element:
+		case node_declaration:
+		case node_pi:
+			return _root->name && (_root->header & impl::xml_memory_page_name_allocated_or_shared_mask) == 0 ? _root->name - doc.buffer : -1;
+
+		case node_pcdata:
+		case node_cdata:
+		case node_comment:
+		case node_doctype:
+			return _root->value && (_root->header & impl::xml_memory_page_value_allocated_or_shared_mask) == 0 ? _root->value - doc.buffer : -1;
+
+		default:
+			assert(false && "Invalid node type"); // unreachable
+			return -1;
+		}
+	}
+
+#ifdef __BORLANDC__
+	PUGI_IMPL_FN bool operator&&(const xml_node& lhs, bool rhs)
+	{
+		return (bool)lhs && rhs;
+	}
+
+	PUGI_IMPL_FN bool operator||(const xml_node& lhs, bool rhs)
+	{
+		return (bool)lhs || rhs;
+	}
+#endif
+
+	PUGI_IMPL_FN xml_text::xml_text(xml_node_struct* root): _root(root)
+	{
+	}
+
+	PUGI_IMPL_FN xml_node_struct* xml_text::_data() const
+	{
+		if (!_root || impl::is_text_node(_root)) return _root;
+
+		// element nodes can have value if parse_embed_pcdata was used
+		if (PUGI_IMPL_NODETYPE(_root) == node_element && _root->value)
+			return _root;
+
+		for (xml_node_struct* node = _root->first_child; node; node = node->next_sibling)
+			if (impl::is_text_node(node))
+				return node;
+
+		return NULL;
+	}
+
+	PUGI_IMPL_FN xml_node_struct* xml_text::_data_new()
+	{
+		xml_node_struct* d = _data();
+		if (d) return d;
+
+		return xml_node(_root).append_child(node_pcdata).internal_object();
+	}
+
+	PUGI_IMPL_FN xml_text::xml_text(): _root(NULL)
+	{
+	}
+
+	PUGI_IMPL_FN static void unspecified_bool_xml_text(xml_text***)
+	{
+	}
+
+	PUGI_IMPL_FN xml_text::operator xml_text::unspecified_bool_type() const
+	{
+		return _data() ? unspecified_bool_xml_text : NULL;
+	}
+
+	PUGI_IMPL_FN bool xml_text::operator!() const
+	{
+		return !_data();
+	}
+
+	PUGI_IMPL_FN bool xml_text::empty() const
+	{
+		return _data() == NULL;
+	}
+
+	PUGI_IMPL_FN const char_t* xml_text::get() const
+	{
+		xml_node_struct* d = _data();
+		if (!d) return PUGIXML_TEXT("");
+		const char_t* value = d->value;
+		return value ? value : PUGIXML_TEXT("");
+	}
+
+	PUGI_IMPL_FN const char_t* xml_text::as_string(const char_t* def) const
+	{
+		xml_node_struct* d = _data();
+		if (!d) return def;
+		const char_t* value = d->value;
+		return value ? value : def;
+	}
+
+	PUGI_IMPL_FN int xml_text::as_int(int def) const
+	{
+		xml_node_struct* d = _data();
+		if (!d) return def;
+		const char_t* value = d->value;
+		return value ? impl::get_value_int(value) : def;
+	}
+
+	PUGI_IMPL_FN unsigned int xml_text::as_uint(unsigned int def) const
+	{
+		xml_node_struct* d = _data();
+		if (!d) return def;
+		const char_t* value = d->value;
+		return value ? impl::get_value_uint(value) : def;
+	}
+
+	PUGI_IMPL_FN double xml_text::as_double(double def) const
+	{
+		xml_node_struct* d = _data();
+		if (!d) return def;
+		const char_t* value = d->value;
+		return value ? impl::get_value_double(value) : def;
+	}
+
+	PUGI_IMPL_FN float xml_text::as_float(float def) const
+	{
+		xml_node_struct* d = _data();
+		if (!d) return def;
+		const char_t* value = d->value;
+		return value ? impl::get_value_float(value) : def;
+	}
+
+	PUGI_IMPL_FN bool xml_text::as_bool(bool def) const
+	{
+		xml_node_struct* d = _data();
+		if (!d) return def;
+		const char_t* value = d->value;
+		return value ? impl::get_value_bool(value) : def;
+	}
+
+#ifdef PUGIXML_HAS_LONG_LONG
+	PUGI_IMPL_FN long long xml_text::as_llong(long long def) const
+	{
+		xml_node_struct* d = _data();
+		if (!d) return def;
+		const char_t* value = d->value;
+		return value ? impl::get_value_llong(value) : def;
+	}
+
+	PUGI_IMPL_FN unsigned long long xml_text::as_ullong(unsigned long long def) const
+	{
+		xml_node_struct* d = _data();
+		if (!d) return def;
+		const char_t* value = d->value;
+		return value ? impl::get_value_ullong(value) : def;
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_text::set(const char_t* rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::strcpy_insitu(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, impl::strlength(rhs)) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(const char_t* rhs, size_t size)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::strcpy_insitu(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, size) : false;
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN bool xml_text::set(string_view_t rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::strcpy_insitu(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs.data(), rhs.size()) : false;
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_text::set(int rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_integer<unsigned int>(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, rhs < 0) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(unsigned int rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_integer<unsigned int>(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, false) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(long rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_integer<unsigned long>(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, rhs < 0) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(unsigned long rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_integer<unsigned long>(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, false) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(float rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_convert(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, default_float_precision) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(float rhs, int precision)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_convert(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, precision) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(double rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_convert(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, default_double_precision) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(double rhs, int precision)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_convert(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, precision) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(bool rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_bool(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs) : false;
+	}
+
+#ifdef PUGIXML_HAS_LONG_LONG
+	PUGI_IMPL_FN bool xml_text::set(long long rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_integer<unsigned long long>(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, rhs < 0) : false;
+	}
+
+	PUGI_IMPL_FN bool xml_text::set(unsigned long long rhs)
+	{
+		xml_node_struct* dn = _data_new();
+
+		return dn ? impl::set_value_integer<unsigned long long>(dn->value, dn->header, impl::xml_memory_page_value_allocated_mask, rhs, false) : false;
+	}
+#endif
+
+	PUGI_IMPL_FN xml_text& xml_text::operator=(const char_t* rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_text& xml_text::operator=(int rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_text& xml_text::operator=(unsigned int rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_text& xml_text::operator=(long rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_text& xml_text::operator=(unsigned long rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_text& xml_text::operator=(double rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_text& xml_text::operator=(float rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_text& xml_text::operator=(bool rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	PUGI_IMPL_FN xml_text& xml_text::operator=(string_view_t rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+#endif
+
+#ifdef PUGIXML_HAS_LONG_LONG
+	PUGI_IMPL_FN xml_text& xml_text::operator=(long long rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_text& xml_text::operator=(unsigned long long rhs)
+	{
+		set(rhs);
+		return *this;
+	}
+#endif
+
+	PUGI_IMPL_FN xml_node xml_text::data() const
+	{
+		return xml_node(_data());
+	}
+
+#ifdef __BORLANDC__
+	PUGI_IMPL_FN bool operator&&(const xml_text& lhs, bool rhs)
+	{
+		return (bool)lhs && rhs;
+	}
+
+	PUGI_IMPL_FN bool operator||(const xml_text& lhs, bool rhs)
+	{
+		return (bool)lhs || rhs;
+	}
+#endif
+
+	PUGI_IMPL_FN xml_node_iterator::xml_node_iterator()
+	{
+	}
+
+	PUGI_IMPL_FN xml_node_iterator::xml_node_iterator(const xml_node& node): _wrap(node), _parent(node.parent())
+	{
+	}
+
+	PUGI_IMPL_FN xml_node_iterator::xml_node_iterator(xml_node_struct* ref, xml_node_struct* parent): _wrap(ref), _parent(parent)
+	{
+	}
+
+	PUGI_IMPL_FN bool xml_node_iterator::operator==(const xml_node_iterator& rhs) const
+	{
+		return _wrap._root == rhs._wrap._root && _parent._root == rhs._parent._root;
+	}
+
+	PUGI_IMPL_FN bool xml_node_iterator::operator!=(const xml_node_iterator& rhs) const
+	{
+		return _wrap._root != rhs._wrap._root || _parent._root != rhs._parent._root;
+	}
+
+	PUGI_IMPL_FN xml_node& xml_node_iterator::operator*() const
+	{
+		assert(_wrap._root);
+		return _wrap;
+	}
+
+	PUGI_IMPL_FN xml_node* xml_node_iterator::operator->() const
+	{
+		assert(_wrap._root);
+		return &_wrap;
+	}
+
+	PUGI_IMPL_FN xml_node_iterator& xml_node_iterator::operator++()
+	{
+		assert(_wrap._root);
+		_wrap._root = _wrap._root->next_sibling;
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_node_iterator xml_node_iterator::operator++(int)
+	{
+		xml_node_iterator temp = *this;
+		++*this;
+		return temp;
+	}
+
+	PUGI_IMPL_FN xml_node_iterator& xml_node_iterator::operator--()
+	{
+		_wrap = _wrap._root ? _wrap.previous_sibling() : _parent.last_child();
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_node_iterator xml_node_iterator::operator--(int)
+	{
+		xml_node_iterator temp = *this;
+		--*this;
+		return temp;
+	}
+
+	PUGI_IMPL_FN xml_attribute_iterator::xml_attribute_iterator()
+	{
+	}
+
+	PUGI_IMPL_FN xml_attribute_iterator::xml_attribute_iterator(const xml_attribute& attr, const xml_node& parent): _wrap(attr), _parent(parent)
+	{
+	}
+
+	PUGI_IMPL_FN xml_attribute_iterator::xml_attribute_iterator(xml_attribute_struct* ref, xml_node_struct* parent): _wrap(ref), _parent(parent)
+	{
+	}
+
+	PUGI_IMPL_FN bool xml_attribute_iterator::operator==(const xml_attribute_iterator& rhs) const
+	{
+		return _wrap._attr == rhs._wrap._attr && _parent._root == rhs._parent._root;
+	}
+
+	PUGI_IMPL_FN bool xml_attribute_iterator::operator!=(const xml_attribute_iterator& rhs) const
+	{
+		return _wrap._attr != rhs._wrap._attr || _parent._root != rhs._parent._root;
+	}
+
+	PUGI_IMPL_FN xml_attribute& xml_attribute_iterator::operator*() const
+	{
+		assert(_wrap._attr);
+		return _wrap;
+	}
+
+	PUGI_IMPL_FN xml_attribute* xml_attribute_iterator::operator->() const
+	{
+		assert(_wrap._attr);
+		return &_wrap;
+	}
+
+	PUGI_IMPL_FN xml_attribute_iterator& xml_attribute_iterator::operator++()
+	{
+		assert(_wrap._attr);
+		_wrap._attr = _wrap._attr->next_attribute;
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute_iterator xml_attribute_iterator::operator++(int)
+	{
+		xml_attribute_iterator temp = *this;
+		++*this;
+		return temp;
+	}
+
+	PUGI_IMPL_FN xml_attribute_iterator& xml_attribute_iterator::operator--()
+	{
+		_wrap = _wrap._attr ? _wrap.previous_attribute() : _parent.last_attribute();
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_attribute_iterator xml_attribute_iterator::operator--(int)
+	{
+		xml_attribute_iterator temp = *this;
+		--*this;
+		return temp;
+	}
+
+	PUGI_IMPL_FN xml_named_node_iterator::xml_named_node_iterator(): _name(NULL)
+	{
+	}
+
+	PUGI_IMPL_FN xml_named_node_iterator::xml_named_node_iterator(const xml_node& node, const char_t* name): _wrap(node), _parent(node.parent()), _name(name)
+	{
+	}
+
+	PUGI_IMPL_FN xml_named_node_iterator::xml_named_node_iterator(xml_node_struct* ref, xml_node_struct* parent, const char_t* name): _wrap(ref), _parent(parent), _name(name)
+	{
+	}
+
+	PUGI_IMPL_FN bool xml_named_node_iterator::operator==(const xml_named_node_iterator& rhs) const
+	{
+		return _wrap._root == rhs._wrap._root && _parent._root == rhs._parent._root;
+	}
+
+	PUGI_IMPL_FN bool xml_named_node_iterator::operator!=(const xml_named_node_iterator& rhs) const
+	{
+		return _wrap._root != rhs._wrap._root || _parent._root != rhs._parent._root;
+	}
+
+	PUGI_IMPL_FN xml_node& xml_named_node_iterator::operator*() const
+	{
+		assert(_wrap._root);
+		return _wrap;
+	}
+
+	PUGI_IMPL_FN xml_node* xml_named_node_iterator::operator->() const
+	{
+		assert(_wrap._root);
+		return &_wrap;
+	}
+
+	PUGI_IMPL_FN xml_named_node_iterator& xml_named_node_iterator::operator++()
+	{
+		assert(_wrap._root);
+		_wrap = _wrap.next_sibling(_name);
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_named_node_iterator xml_named_node_iterator::operator++(int)
+	{
+		xml_named_node_iterator temp = *this;
+		++*this;
+		return temp;
+	}
+
+	PUGI_IMPL_FN xml_named_node_iterator& xml_named_node_iterator::operator--()
+	{
+		if (_wrap._root)
+			_wrap = _wrap.previous_sibling(_name);
+		else
+		{
+			_wrap = _parent.last_child();
+
+			if (!impl::strequal(_wrap.name(), _name))
+				_wrap = _wrap.previous_sibling(_name);
+		}
+
+		return *this;
+	}
+
+	PUGI_IMPL_FN xml_named_node_iterator xml_named_node_iterator::operator--(int)
+	{
+		xml_named_node_iterator temp = *this;
+		--*this;
+		return temp;
+	}
+
+	PUGI_IMPL_FN xml_parse_result::xml_parse_result(): status(status_internal_error), offset(0), encoding(encoding_auto)
+	{
+	}
+
+	PUGI_IMPL_FN xml_parse_result::operator bool() const
+	{
+		return status == status_ok;
+	}
+
+	PUGI_IMPL_FN const char* xml_parse_result::description() const
+	{
+		switch (status)
+		{
+		case status_ok: return "No error";
+
+		case status_file_not_found: return "File was not found";
+		case status_io_error: return "Error reading from file/stream";
+		case status_out_of_memory: return "Could not allocate memory";
+		case status_internal_error: return "Internal error occurred";
+
+		case status_unrecognized_tag: return "Could not determine tag type";
+
+		case status_bad_pi: return "Error parsing document declaration/processing instruction";
+		case status_bad_comment: return "Error parsing comment";
+		case status_bad_cdata: return "Error parsing CDATA section";
+		case status_bad_doctype: return "Error parsing document type declaration";
+		case status_bad_pcdata: return "Error parsing PCDATA section";
+		case status_bad_start_element: return "Error parsing start element tag";
+		case status_bad_attribute: return "Error parsing element attribute";
+		case status_bad_end_element: return "Error parsing end element tag";
+		case status_end_element_mismatch: return "Start-end tags mismatch";
+
+		case status_append_invalid_root: return "Unable to append nodes: root is not an element or document";
+
+		case status_no_document_element: return "No document element found";
+
+		default: return "Unknown error";
+		}
+	}
+
+	PUGI_IMPL_FN xml_document::xml_document(): _buffer(NULL)
+	{
+		_create();
+	}
+
+	PUGI_IMPL_FN xml_document::~xml_document()
+	{
+		_destroy();
+	}
+
+#ifdef PUGIXML_HAS_MOVE
+	PUGI_IMPL_FN xml_document::xml_document(xml_document&& rhs) PUGIXML_NOEXCEPT_IF_NOT_COMPACT: _buffer(NULL)
+	{
+		_create();
+		_move(rhs);
+	}
+
+	PUGI_IMPL_FN xml_document& xml_document::operator=(xml_document&& rhs) PUGIXML_NOEXCEPT_IF_NOT_COMPACT
+	{
+		if (this == &rhs) return *this;
+
+		_destroy();
+		_create();
+		_move(rhs);
+
+		return *this;
+	}
+#endif
+
+	PUGI_IMPL_FN void xml_document::reset()
+	{
+		_destroy();
+		_create();
+	}
+
+	PUGI_IMPL_FN void xml_document::reset(const xml_document& proto)
+	{
+		reset();
+
+		impl::node_copy_tree(_root, proto._root);
+	}
+
+	PUGI_IMPL_FN void xml_document::_create()
+	{
+		assert(!_root);
+
+	#ifdef PUGIXML_COMPACT
+		// space for page marker for the first page (uint32_t), rounded up to pointer size; assumes pointers are at least 32-bit
+		const size_t page_offset = sizeof(void*);
+	#else
+		const size_t page_offset = 0;
+	#endif
+
+		// initialize sentinel page
+		PUGI_IMPL_STATIC_ASSERT(sizeof(impl::xml_memory_page) + sizeof(impl::xml_document_struct) + page_offset <= sizeof(_memory));
+
+		// prepare page structure
+		impl::xml_memory_page* page = impl::xml_memory_page::construct(_memory);
+		assert(page);
+
+		page->busy_size = impl::xml_memory_page_size;
+
+		// setup first page marker
+	#ifdef PUGIXML_COMPACT
+		// round-trip through void* to avoid 'cast increases required alignment of target type' warning
+		page->compact_page_marker = reinterpret_cast<uint32_t*>(static_cast<void*>(reinterpret_cast<char*>(page) + sizeof(impl::xml_memory_page)));
+		*page->compact_page_marker = sizeof(impl::xml_memory_page);
+	#endif
+
+		// allocate new root
+		_root = new (reinterpret_cast<char*>(page) + sizeof(impl::xml_memory_page) + page_offset) impl::xml_document_struct(page);
+		_root->prev_sibling_c = _root;
+
+		// setup sentinel page
+		page->allocator = static_cast<impl::xml_document_struct*>(_root);
+
+		// setup hash table pointer in allocator
+	#ifdef PUGIXML_COMPACT
+		page->allocator->_hash = &static_cast<impl::xml_document_struct*>(_root)->hash;
+	#endif
+
+		// verify the document allocation
+		assert(reinterpret_cast<char*>(_root) + sizeof(impl::xml_document_struct) <= _memory + sizeof(_memory));
+	}
+
+	PUGI_IMPL_FN void xml_document::_destroy()
+	{
+		assert(_root);
+
+		// destroy static storage
+		if (_buffer)
+		{
+			impl::xml_memory::deallocate(_buffer);
+			_buffer = NULL;
+		}
+
+		// destroy extra buffers (note: no need to destroy linked list nodes, they're allocated using document allocator)
+		for (impl::xml_extra_buffer* extra = static_cast<impl::xml_document_struct*>(_root)->extra_buffers; extra; extra = extra->next)
+		{
+			if (extra->buffer) impl::xml_memory::deallocate(extra->buffer);
+		}
+
+		// destroy dynamic storage, leave sentinel page (it's in static memory)
+		impl::xml_memory_page* root_page = PUGI_IMPL_GETPAGE(_root);
+		assert(root_page && !root_page->prev);
+		assert(reinterpret_cast<char*>(root_page) >= _memory && reinterpret_cast<char*>(root_page) < _memory + sizeof(_memory));
+
+		for (impl::xml_memory_page* page = root_page->next; page; )
+		{
+			impl::xml_memory_page* next = page->next;
+
+			impl::xml_allocator::deallocate_page(page);
+
+			page = next;
+		}
+
+	#ifdef PUGIXML_COMPACT
+		// destroy hash table
+		static_cast<impl::xml_document_struct*>(_root)->hash.clear();
+	#endif
+
+		_root = NULL;
+	}
+
+#ifdef PUGIXML_HAS_MOVE
+	PUGI_IMPL_FN void xml_document::_move(xml_document& rhs) PUGIXML_NOEXCEPT_IF_NOT_COMPACT
+	{
+		impl::xml_document_struct* doc = static_cast<impl::xml_document_struct*>(_root);
+		impl::xml_document_struct* other = static_cast<impl::xml_document_struct*>(rhs._root);
+
+		// save first child pointer for later; this needs hash access
+		xml_node_struct* other_first_child = other->first_child;
+
+	#ifdef PUGIXML_COMPACT
+		// reserve space for the hash table up front; this is the only operation that can fail
+		// if it does, we have no choice but to throw (if we have exceptions)
+		if (other_first_child)
+		{
+			size_t other_children = 0;
+			for (xml_node_struct* node = other_first_child; node; node = node->next_sibling)
+				other_children++;
+
+			// in compact mode, each pointer assignment could result in a hash table request
+			// during move, we have to relocate document first_child and parents of all children
+			// normally there's just one child and its parent has a pointerless encoding but
+			// we assume the worst here
+			if (!other->_hash->reserve(other_children + 1))
+			{
+			#ifdef PUGIXML_NO_EXCEPTIONS
+				return;
+			#else
+				throw std::bad_alloc();
+			#endif
+			}
+		}
+	#endif
+
+		// move allocation state
+		// note that other->_root may point to the embedded document page, in which case we should keep original (empty) state
+		if (other->_root != PUGI_IMPL_GETPAGE(other))
+		{
+			doc->_root = other->_root;
+			doc->_busy_size = other->_busy_size;
+		}
+
+		// move buffer state
+		doc->buffer = other->buffer;
+		doc->extra_buffers = other->extra_buffers;
+		_buffer = rhs._buffer;
+
+	#ifdef PUGIXML_COMPACT
+		// move compact hash; note that the hash table can have pointers to other but they will be "inactive", similarly to nodes removed with remove_child
+		doc->hash = other->hash;
+		doc->_hash = &doc->hash;
+
+		// make sure we don't access other hash up until the end when we reinitialize other document
+		other->_hash = NULL;
+	#endif
+
+		// move page structure
+		impl::xml_memory_page* doc_page = PUGI_IMPL_GETPAGE(doc);
+		assert(doc_page && !doc_page->prev && !doc_page->next);
+
+		impl::xml_memory_page* other_page = PUGI_IMPL_GETPAGE(other);
+		assert(other_page && !other_page->prev);
+
+		// relink pages since root page is embedded into xml_document
+		if (impl::xml_memory_page* page = other_page->next)
+		{
+			assert(page->prev == other_page);
+
+			page->prev = doc_page;
+
+			doc_page->next = page;
+			other_page->next = NULL;
+		}
+
+		// make sure pages point to the correct document state
+		for (impl::xml_memory_page* page = doc_page->next; page; page = page->next)
+		{
+			assert(page->allocator == other);
+
+			page->allocator = doc;
+
+		#ifdef PUGIXML_COMPACT
+			// this automatically migrates most children between documents and prevents ->parent assignment from allocating
+			if (page->compact_shared_parent == other)
+				page->compact_shared_parent = doc;
+		#endif
+		}
+
+		// move tree structure
+		assert(!doc->first_child);
+
+		doc->first_child = other_first_child;
+
+		for (xml_node_struct* node = other_first_child; node; node = node->next_sibling)
+		{
+		#ifdef PUGIXML_COMPACT
+			// most children will have migrated when we reassigned compact_shared_parent
+			assert(node->parent == other || node->parent == doc);
+
+			node->parent = doc;
+		#else
+			assert(node->parent == other);
+			node->parent = doc;
+		#endif
+		}
+
+		// reset other document
+		new (other) impl::xml_document_struct(PUGI_IMPL_GETPAGE(other));
+		rhs._buffer = NULL;
+	}
+#endif
+
+#ifndef PUGIXML_NO_STL
+	PUGI_IMPL_FN xml_parse_result xml_document::load(std::basic_istream<char>& stream, unsigned int options, xml_encoding encoding)
+	{
+		reset();
+
+		return impl::load_stream_impl(static_cast<impl::xml_document_struct*>(_root), stream, options, encoding, &_buffer);
+	}
+
+	PUGI_IMPL_FN xml_parse_result xml_document::load(std::basic_istream<wchar_t>& stream, unsigned int options)
+	{
+		reset();
+
+		return impl::load_stream_impl(static_cast<impl::xml_document_struct*>(_root), stream, options, encoding_wchar, &_buffer);
+	}
+#endif
+
+	PUGI_IMPL_FN xml_parse_result xml_document::load_string(const char_t* contents, unsigned int options)
+	{
+		// Force native encoding (skip autodetection)
+	#ifdef PUGIXML_WCHAR_MODE
+		xml_encoding encoding = encoding_wchar;
+	#else
+		xml_encoding encoding = encoding_utf8;
+	#endif
+
+		return load_buffer(contents, impl::strlength(contents) * sizeof(char_t), options, encoding);
+	}
+
+	PUGI_IMPL_FN xml_parse_result xml_document::load(const char_t* contents, unsigned int options)
+	{
+		return load_string(contents, options);
+	}
+
+	PUGI_IMPL_FN xml_parse_result xml_document::load_file(const char* path_, unsigned int options, xml_encoding encoding)
+	{
+		reset();
+
+		using impl::auto_deleter; // MSVC7 workaround
+		auto_deleter<FILE> file(impl::open_file(path_, "rb"), impl::close_file);
+
+		return impl::load_file_impl(static_cast<impl::xml_document_struct*>(_root), file.data, options, encoding, &_buffer);
+	}
+
+	PUGI_IMPL_FN xml_parse_result xml_document::load_file(const wchar_t* path_, unsigned int options, xml_encoding encoding)
+	{
+		reset();
+
+		using impl::auto_deleter; // MSVC7 workaround
+		auto_deleter<FILE> file(impl::open_file_wide(path_, L"rb"), impl::close_file);
+
+		return impl::load_file_impl(static_cast<impl::xml_document_struct*>(_root), file.data, options, encoding, &_buffer);
+	}
+
+	PUGI_IMPL_FN xml_parse_result xml_document::load_buffer(const void* contents, size_t size, unsigned int options, xml_encoding encoding)
+	{
+		reset();
+
+		return impl::load_buffer_impl(static_cast<impl::xml_document_struct*>(_root), _root, const_cast<void*>(contents), size, options, encoding, false, false, &_buffer);
+	}
+
+	PUGI_IMPL_FN xml_parse_result xml_document::load_buffer_inplace(void* contents, size_t size, unsigned int options, xml_encoding encoding)
+	{
+		reset();
+
+		return impl::load_buffer_impl(static_cast<impl::xml_document_struct*>(_root), _root, contents, size, options, encoding, true, false, &_buffer);
+	}
+
+	PUGI_IMPL_FN xml_parse_result xml_document::load_buffer_inplace_own(void* contents, size_t size, unsigned int options, xml_encoding encoding)
+	{
+		reset();
+
+		return impl::load_buffer_impl(static_cast<impl::xml_document_struct*>(_root), _root, contents, size, options, encoding, true, true, &_buffer);
+	}
+
+	PUGI_IMPL_FN void xml_document::save(xml_writer& writer, const char_t* indent, unsigned int flags, xml_encoding encoding) const
+	{
+		impl::xml_buffered_writer buffered_writer(writer, encoding);
+
+		if ((flags & format_write_bom) && buffered_writer.encoding != encoding_latin1)
+		{
+			// BOM always represents the codepoint U+FEFF, so just write it in native encoding
+		#ifdef PUGIXML_WCHAR_MODE
+			unsigned int bom = 0xfeff;
+			buffered_writer.write(static_cast<wchar_t>(bom));
+		#else
+			buffered_writer.write('\xef', '\xbb', '\xbf');
+		#endif
+		}
+
+		if (!(flags & format_no_declaration) && !impl::has_declaration(_root))
+		{
+			buffered_writer.write_string(PUGIXML_TEXT("<?xml version=\"1.0\""));
+			if (buffered_writer.encoding == encoding_latin1) buffered_writer.write_string(PUGIXML_TEXT(" encoding=\"ISO-8859-1\""));
+			buffered_writer.write('?', '>');
+			if (!(flags & format_raw)) buffered_writer.write('\n');
+		}
+
+		impl::node_output(buffered_writer, _root, indent, flags, 0);
+
+		buffered_writer.flush();
+	}
+
+#ifndef PUGIXML_NO_STL
+	PUGI_IMPL_FN void xml_document::save(std::basic_ostream<char>& stream, const char_t* indent, unsigned int flags, xml_encoding encoding) const
+	{
+		xml_writer_stream writer(stream);
+
+		save(writer, indent, flags, encoding);
+	}
+
+	PUGI_IMPL_FN void xml_document::save(std::basic_ostream<wchar_t>& stream, const char_t* indent, unsigned int flags) const
+	{
+		xml_writer_stream writer(stream);
+
+		save(writer, indent, flags, encoding_wchar);
+	}
+#endif
+
+	PUGI_IMPL_FN bool xml_document::save_file(const char* path_, const char_t* indent, unsigned int flags, xml_encoding encoding) const
+	{
+		using impl::auto_deleter; // MSVC7 workaround
+		auto_deleter<FILE> file(impl::open_file(path_, (flags & format_save_file_text) ? "w" : "wb"), impl::close_file);
+
+		return impl::save_file_impl(*this, file.data, indent, flags, encoding) && fclose(file.release()) == 0;
+	}
+
+	PUGI_IMPL_FN bool xml_document::save_file(const wchar_t* path_, const char_t* indent, unsigned int flags, xml_encoding encoding) const
+	{
+		using impl::auto_deleter; // MSVC7 workaround
+		auto_deleter<FILE> file(impl::open_file_wide(path_, (flags & format_save_file_text) ? L"w" : L"wb"), impl::close_file);
+
+		return impl::save_file_impl(*this, file.data, indent, flags, encoding) && fclose(file.release()) == 0;
+	}
+
+	PUGI_IMPL_FN xml_node xml_document::document_element() const
+	{
+		assert(_root);
+
+		for (xml_node_struct* i = _root->first_child; i; i = i->next_sibling)
+			if (PUGI_IMPL_NODETYPE(i) == node_element)
+				return xml_node(i);
+
+		return xml_node();
+	}
+
+#ifndef PUGIXML_NO_STL
+	PUGI_IMPL_FN std::string PUGIXML_FUNCTION as_utf8(const wchar_t* str)
+	{
+		assert(str);
+
+		return impl::as_utf8_impl(str, impl::strlength_wide(str));
+	}
+
+	PUGI_IMPL_FN std::string PUGIXML_FUNCTION as_utf8(const std::basic_string<wchar_t>& str)
+	{
+		return impl::as_utf8_impl(str.c_str(), str.size());
+	}
+
+	PUGI_IMPL_FN std::basic_string<wchar_t> PUGIXML_FUNCTION as_wide(const char* str)
+	{
+		assert(str);
+
+		return impl::as_wide_impl(str, strlen(str));
+	}
+
+	PUGI_IMPL_FN std::basic_string<wchar_t> PUGIXML_FUNCTION as_wide(const std::string& str)
+	{
+		return impl::as_wide_impl(str.c_str(), str.size());
+	}
+#endif
+
+	PUGI_IMPL_FN void PUGIXML_FUNCTION set_memory_management_functions(allocation_function allocate, deallocation_function deallocate)
+	{
+		impl::xml_memory::allocate = allocate;
+		impl::xml_memory::deallocate = deallocate;
+	}
+
+	PUGI_IMPL_FN allocation_function PUGIXML_FUNCTION get_memory_allocation_function()
+	{
+		return impl::xml_memory::allocate;
+	}
+
+	PUGI_IMPL_FN deallocation_function PUGIXML_FUNCTION get_memory_deallocation_function()
+	{
+		return impl::xml_memory::deallocate;
+	}
+}
+
+#if !defined(PUGIXML_NO_STL) && (defined(_MSC_VER) || defined(__ICC))
+namespace std
+{
+	// Workarounds for (non-standard) iterator category detection for older versions (MSVC7/IC8 and earlier)
+	PUGI_IMPL_FN std::bidirectional_iterator_tag _Iter_cat(const pugi::xml_node_iterator&)
+	{
+		return std::bidirectional_iterator_tag();
+	}
+
+	PUGI_IMPL_FN std::bidirectional_iterator_tag _Iter_cat(const pugi::xml_attribute_iterator&)
+	{
+		return std::bidirectional_iterator_tag();
+	}
+
+	PUGI_IMPL_FN std::bidirectional_iterator_tag _Iter_cat(const pugi::xml_named_node_iterator&)
+	{
+		return std::bidirectional_iterator_tag();
+	}
+}
+#endif
+
+#if !defined(PUGIXML_NO_STL) && defined(__SUNPRO_CC)
+namespace std
+{
+	// Workarounds for (non-standard) iterator category detection
+	PUGI_IMPL_FN std::bidirectional_iterator_tag __iterator_category(const pugi::xml_node_iterator&)
+	{
+		return std::bidirectional_iterator_tag();
+	}
+
+	PUGI_IMPL_FN std::bidirectional_iterator_tag __iterator_category(const pugi::xml_attribute_iterator&)
+	{
+		return std::bidirectional_iterator_tag();
+	}
+
+	PUGI_IMPL_FN std::bidirectional_iterator_tag __iterator_category(const pugi::xml_named_node_iterator&)
+	{
+		return std::bidirectional_iterator_tag();
+	}
+}
+#endif
+
+#ifndef PUGIXML_NO_XPATH
+// STL replacements
+PUGI_IMPL_NS_BEGIN
+	struct equal_to
+	{
+		template <typename T> bool operator()(const T& lhs, const T& rhs) const
+		{
+			return lhs == rhs;
+		}
+	};
+
+	struct not_equal_to
+	{
+		template <typename T> bool operator()(const T& lhs, const T& rhs) const
+		{
+			return lhs != rhs;
+		}
+	};
+
+	struct less
+	{
+		template <typename T> bool operator()(const T& lhs, const T& rhs) const
+		{
+			return lhs < rhs;
+		}
+	};
+
+	struct less_equal
+	{
+		template <typename T> bool operator()(const T& lhs, const T& rhs) const
+		{
+			return lhs <= rhs;
+		}
+	};
+
+	template <typename T> inline void swap(T& lhs, T& rhs)
+	{
+		T temp = lhs;
+		lhs = rhs;
+		rhs = temp;
+	}
+
+	template <typename I, typename Pred> PUGI_IMPL_FN I min_element(I begin, I end, const Pred& pred)
+	{
+		I result = begin;
+
+		for (I it = begin + 1; it != end; ++it)
+			if (pred(*it, *result))
+				result = it;
+
+		return result;
+	}
+
+	template <typename I> PUGI_IMPL_FN void reverse(I begin, I end)
+	{
+		while (end - begin > 1)
+			swap(*begin++, *--end);
+	}
+
+	template <typename I> PUGI_IMPL_FN I unique(I begin, I end)
+	{
+		// fast skip head
+		while (end - begin > 1 && *begin != *(begin + 1))
+			begin++;
+
+		if (begin == end)
+			return begin;
+
+		// last written element
+		I write = begin++;
+
+		// merge unique elements
+		while (begin != end)
+		{
+			if (*begin != *write)
+				*++write = *begin++;
+			else
+				begin++;
+		}
+
+		// past-the-end (write points to live element)
+		return write + 1;
+	}
+
+	template <typename T, typename Pred> PUGI_IMPL_FN void insertion_sort(T* begin, T* end, const Pred& pred)
+	{
+		if (begin == end)
+			return;
+
+		for (T* it = begin + 1; it != end; ++it)
+		{
+			T val = *it;
+			T* hole = it;
+
+			// move hole backwards
+			while (hole > begin && pred(val, *(hole - 1)))
+			{
+				*hole = *(hole - 1);
+				hole--;
+			}
+
+			// fill hole with element
+			*hole = val;
+		}
+	}
+
+	template <typename I, typename Pred> inline I median3(I first, I middle, I last, const Pred& pred)
+	{
+		if (pred(*middle, *first))
+			swap(middle, first);
+		if (pred(*last, *middle))
+			swap(last, middle);
+		if (pred(*middle, *first))
+			swap(middle, first);
+
+		return middle;
+	}
+
+	template <typename T, typename Pred> PUGI_IMPL_FN void partition3(T* begin, T* end, T pivot, const Pred& pred, T** out_eqbeg, T** out_eqend)
+	{
+		// invariant: array is split into 4 groups: = < ? > (each variable denotes the boundary between the groups)
+		T* eq = begin;
+		T* lt = begin;
+		T* gt = end;
+
+		while (lt < gt)
+		{
+			if (pred(*lt, pivot))
+				lt++;
+			else if (*lt == pivot)
+				swap(*eq++, *lt++);
+			else
+				swap(*lt, *--gt);
+		}
+
+		// we now have just 4 groups: = < >; move equal elements to the middle
+		T* eqbeg = gt;
+
+		for (T* it = begin; it != eq; ++it)
+			swap(*it, *--eqbeg);
+
+		*out_eqbeg = eqbeg;
+		*out_eqend = gt;
+	}
+
+	template <typename I, typename Pred> PUGI_IMPL_FN void sort(I begin, I end, const Pred& pred)
+	{
+		// sort large chunks
+		while (end - begin > 16)
+		{
+			// find median element
+			I middle = begin + (end - begin) / 2;
+			I median = median3(begin, middle, end - 1, pred);
+
+			// partition in three chunks (< = >)
+			I eqbeg, eqend;
+			partition3(begin, end, *median, pred, &eqbeg, &eqend);
+
+			// loop on larger half
+			if (eqbeg - begin > end - eqend)
+			{
+				sort(eqend, end, pred);
+				end = eqbeg;
+			}
+			else
+			{
+				sort(begin, eqbeg, pred);
+				begin = eqend;
+			}
+		}
+
+		// insertion sort small chunk
+		insertion_sort(begin, end, pred);
+	}
+
+	PUGI_IMPL_FN bool hash_insert(const void** table, size_t size, const void* key)
+	{
+		assert(key);
+
+		unsigned int h = static_cast<unsigned int>(reinterpret_cast<uintptr_t>(key));
+
+		// MurmurHash3 32-bit finalizer
+		h ^= h >> 16;
+		h *= 0x85ebca6bu;
+		h ^= h >> 13;
+		h *= 0xc2b2ae35u;
+		h ^= h >> 16;
+
+		size_t hashmod = size - 1;
+		size_t bucket = h & hashmod;
+
+		for (size_t probe = 0; probe <= hashmod; ++probe)
+		{
+			if (table[bucket] == NULL)
+			{
+				table[bucket] = key;
+				return true;
+			}
+
+			if (table[bucket] == key)
+				return false;
+
+			// hash collision, quadratic probing
+			bucket = (bucket + probe + 1) & hashmod;
+		}
+
+		assert(false && "Hash table is full"); // unreachable
+		return false;
+	}
+PUGI_IMPL_NS_END
+
+// Allocator used for AST and evaluation stacks
+PUGI_IMPL_NS_BEGIN
+	static const size_t xpath_memory_page_size =
+	#ifdef PUGIXML_MEMORY_XPATH_PAGE_SIZE
+		PUGIXML_MEMORY_XPATH_PAGE_SIZE
+	#else
+		4096
+	#endif
+		;
+
+	static const uintptr_t xpath_memory_block_alignment = sizeof(double) > sizeof(void*) ? sizeof(double) : sizeof(void*);
+
+	struct xpath_memory_block
+	{
+		xpath_memory_block* next;
+		size_t capacity;
+
+		union
+		{
+			char data[xpath_memory_page_size];
+			double alignment;
+		};
+	};
+
+	struct xpath_allocator
+	{
+		xpath_memory_block* _root;
+		size_t _root_size;
+		bool* _error;
+
+		xpath_allocator(xpath_memory_block* root, bool* error = NULL): _root(root), _root_size(0), _error(error)
+		{
+		}
+
+		void* allocate(size_t size)
+		{
+			// round size up to block alignment boundary
+			size = (size + xpath_memory_block_alignment - 1) & ~(xpath_memory_block_alignment - 1);
+
+			if (_root_size + size <= _root->capacity)
+			{
+				void* buf = &_root->data[0] + _root_size;
+				_root_size += size;
+				return buf;
+			}
+			else
+			{
+				// make sure we have at least 1/4th of the page free after allocation to satisfy subsequent allocation requests
+				size_t block_capacity_base = sizeof(_root->data);
+				size_t block_capacity_req = size + block_capacity_base / 4;
+				size_t block_capacity = (block_capacity_base > block_capacity_req) ? block_capacity_base : block_capacity_req;
+
+				size_t block_size = block_capacity + offsetof(xpath_memory_block, data);
+
+				xpath_memory_block* block = static_cast<xpath_memory_block*>(xml_memory::allocate(block_size));
+				if (!block)
+				{
+					if (_error) *_error = true;
+					return NULL;
+				}
+
+				block->next = _root;
+				block->capacity = block_capacity;
+
+				_root = block;
+				_root_size = size;
+
+				return block->data;
+			}
+		}
+
+		void* reallocate(void* ptr, size_t old_size, size_t new_size)
+		{
+			// round size up to block alignment boundary
+			old_size = (old_size + xpath_memory_block_alignment - 1) & ~(xpath_memory_block_alignment - 1);
+			new_size = (new_size + xpath_memory_block_alignment - 1) & ~(xpath_memory_block_alignment - 1);
+
+			// we can only reallocate the last object
+			assert(ptr == NULL || static_cast<char*>(ptr) + old_size == &_root->data[0] + _root_size);
+
+			// try to reallocate the object inplace
+			if (ptr && _root_size - old_size + new_size <= _root->capacity)
+			{
+				_root_size = _root_size - old_size + new_size;
+				return ptr;
+			}
+
+			// allocate a new block
+			void* result = allocate(new_size);
+			if (!result) return NULL;
+
+			// we have a new block
+			if (ptr)
+			{
+				// copy old data (we only support growing)
+				assert(new_size >= old_size);
+				memcpy(result, ptr, old_size);
+
+				// free the previous page if it had no other objects
+				assert(_root->data == result);
+				assert(_root->next);
+
+				if (_root->next->data == ptr)
+				{
+					// deallocate the whole page, unless it was the first one
+					xpath_memory_block* next = _root->next->next;
+
+					if (next)
+					{
+						xml_memory::deallocate(_root->next);
+						_root->next = next;
+					}
+				}
+			}
+
+			return result;
+		}
+
+		void revert(const xpath_allocator& state)
+		{
+			// free all new pages
+			xpath_memory_block* cur = _root;
+
+			while (cur != state._root)
+			{
+				xpath_memory_block* next = cur->next;
+
+				xml_memory::deallocate(cur);
+
+				cur = next;
+			}
+
+			// restore state
+			_root = state._root;
+			_root_size = state._root_size;
+		}
+
+		void release()
+		{
+			xpath_memory_block* cur = _root;
+			assert(cur);
+
+			while (cur->next)
+			{
+				xpath_memory_block* next = cur->next;
+
+				xml_memory::deallocate(cur);
+
+				cur = next;
+			}
+		}
+	};
+
+	struct xpath_allocator_capture
+	{
+		xpath_allocator_capture(xpath_allocator* alloc): _target(alloc), _state(*alloc)
+		{
+		}
+
+		~xpath_allocator_capture()
+		{
+			_target->revert(_state);
+		}
+
+		xpath_allocator* _target;
+		xpath_allocator _state;
+	};
+
+	struct xpath_stack
+	{
+		xpath_allocator* result;
+		xpath_allocator* temp;
+	};
+
+	struct xpath_stack_data
+	{
+		xpath_memory_block blocks[2];
+		xpath_allocator result;
+		xpath_allocator temp;
+		xpath_stack stack;
+		bool oom;
+
+		xpath_stack_data(): result(blocks + 0, &oom), temp(blocks + 1, &oom), oom(false)
+		{
+			blocks[0].next = blocks[1].next = NULL;
+			blocks[0].capacity = blocks[1].capacity = sizeof(blocks[0].data);
+
+			stack.result = &result;
+			stack.temp = &temp;
+		}
+
+		~xpath_stack_data()
+		{
+			result.release();
+			temp.release();
+		}
+	};
+PUGI_IMPL_NS_END
+
+// String class
+PUGI_IMPL_NS_BEGIN
+	class xpath_string
+	{
+		const char_t* _buffer;
+		bool _uses_heap;
+		size_t _length_heap;
+
+		static char_t* duplicate_string(const char_t* string, size_t length, xpath_allocator* alloc)
+		{
+			char_t* result = static_cast<char_t*>(alloc->allocate((length + 1) * sizeof(char_t)));
+			if (!result) return NULL;
+
+			memcpy(result, string, length * sizeof(char_t));
+			result[length] = 0;
+
+			return result;
+		}
+
+		xpath_string(const char_t* buffer, bool uses_heap_, size_t length_heap): _buffer(buffer), _uses_heap(uses_heap_), _length_heap(length_heap)
+		{
+		}
+
+	public:
+		static xpath_string from_const(const char_t* str)
+		{
+			return xpath_string(str, false, 0);
+		}
+
+		static xpath_string from_heap_preallocated(const char_t* begin, const char_t* end)
+		{
+			assert(begin <= end && *end == 0);
+
+			return xpath_string(begin, true, static_cast<size_t>(end - begin));
+		}
+
+		static xpath_string from_heap(const char_t* begin, const char_t* end, xpath_allocator* alloc)
+		{
+			assert(begin <= end);
+
+			if (begin == end)
+				return xpath_string();
+
+			size_t length = static_cast<size_t>(end - begin);
+			const char_t* data = duplicate_string(begin, length, alloc);
+
+			return data ? xpath_string(data, true, length) : xpath_string();
+		}
+
+		xpath_string(): _buffer(PUGIXML_TEXT("")), _uses_heap(false), _length_heap(0)
+		{
+		}
+
+		void append(const xpath_string& o, xpath_allocator* alloc)
+		{
+			// skip empty sources
+			if (!*o._buffer) return;
+
+			// fast append for constant empty target and constant source
+			if (!*_buffer && !_uses_heap && !o._uses_heap)
+			{
+				_buffer = o._buffer;
+			}
+			else
+			{
+				// need to make heap copy
+				size_t target_length = length();
+				size_t source_length = o.length();
+				size_t result_length = target_length + source_length;
+
+				// allocate new buffer
+				char_t* result = static_cast<char_t*>(alloc->reallocate(_uses_heap ? const_cast<char_t*>(_buffer) : NULL, (target_length + 1) * sizeof(char_t), (result_length + 1) * sizeof(char_t)));
+				if (!result) return;
+
+				// append first string to the new buffer in case there was no reallocation
+				if (!_uses_heap) memcpy(result, _buffer, target_length * sizeof(char_t));
+
+				// append second string to the new buffer
+				memcpy(result + target_length, o._buffer, source_length * sizeof(char_t));
+				result[result_length] = 0;
+
+				// finalize
+				_buffer = result;
+				_uses_heap = true;
+				_length_heap = result_length;
+			}
+		}
+
+		const char_t* c_str() const
+		{
+			return _buffer;
+		}
+
+		size_t length() const
+		{
+			return _uses_heap ? _length_heap : strlength(_buffer);
+		}
+
+		char_t* data(xpath_allocator* alloc)
+		{
+			// make private heap copy
+			if (!_uses_heap)
+			{
+				size_t length_ = strlength(_buffer);
+				const char_t* data_ = duplicate_string(_buffer, length_, alloc);
+
+				if (!data_) return NULL;
+
+				_buffer = data_;
+				_uses_heap = true;
+				_length_heap = length_;
+			}
+
+			return const_cast<char_t*>(_buffer);
+		}
+
+		bool empty() const
+		{
+			return *_buffer == 0;
+		}
+
+		bool operator==(const xpath_string& o) const
+		{
+			return strequal(_buffer, o._buffer);
+		}
+
+		bool operator!=(const xpath_string& o) const
+		{
+			return !strequal(_buffer, o._buffer);
+		}
+
+		bool uses_heap() const
+		{
+			return _uses_heap;
+		}
+	};
+PUGI_IMPL_NS_END
+
+PUGI_IMPL_NS_BEGIN
+	PUGI_IMPL_FN bool starts_with(const char_t* string, const char_t* pattern)
+	{
+		while (*pattern && *string == *pattern)
+		{
+			string++;
+			pattern++;
+		}
+
+		return *pattern == 0;
+	}
+
+	PUGI_IMPL_FN const char_t* find_char(const char_t* s, char_t c)
+	{
+	#ifdef PUGIXML_WCHAR_MODE
+		return wcschr(s, c);
+	#else
+		return strchr(s, c);
+	#endif
+	}
+
+	PUGI_IMPL_FN const char_t* find_substring(const char_t* s, const char_t* p)
+	{
+	#ifdef PUGIXML_WCHAR_MODE
+		// MSVC6 wcsstr bug workaround (if s is empty it always returns 0)
+		return (*p == 0) ? s : wcsstr(s, p);
+	#else
+		return strstr(s, p);
+	#endif
+	}
+
+	// Converts symbol to lower case, if it is an ASCII one
+	PUGI_IMPL_FN char_t tolower_ascii(char_t ch)
+	{
+		return static_cast<unsigned int>(ch - 'A') < 26 ? static_cast<char_t>(ch | ' ') : ch;
+	}
+
+	PUGI_IMPL_FN xpath_string string_value(const xpath_node& na, xpath_allocator* alloc)
+	{
+		if (na.attribute())
+			return xpath_string::from_const(na.attribute().value());
+		else
+		{
+			xml_node n = na.node();
+
+			switch (n.type())
+			{
+			case node_pcdata:
+			case node_cdata:
+			case node_comment:
+			case node_pi:
+				return xpath_string::from_const(n.value());
+
+			case node_document:
+			case node_element:
+			{
+				xpath_string result;
+
+				// element nodes can have value if parse_embed_pcdata was used
+				if (n.value()[0])
+					result.append(xpath_string::from_const(n.value()), alloc);
+
+				xml_node cur = n.first_child();
+
+				while (cur && cur != n)
+				{
+					if (cur.type() == node_pcdata || cur.type() == node_cdata)
+						result.append(xpath_string::from_const(cur.value()), alloc);
+
+					if (cur.first_child())
+						cur = cur.first_child();
+					else if (cur.next_sibling())
+						cur = cur.next_sibling();
+					else
+					{
+						while (!cur.next_sibling() && cur != n)
+							cur = cur.parent();
+
+						if (cur != n) cur = cur.next_sibling();
+					}
+				}
+
+				return result;
+			}
+
+			default:
+				return xpath_string();
+			}
+		}
+	}
+
+	PUGI_IMPL_FN bool node_is_before_sibling(xml_node_struct* ln, xml_node_struct* rn)
+	{
+		assert(ln->parent == rn->parent);
+
+		// there is no common ancestor (the shared parent is null), nodes are from different documents
+		if (!ln->parent) return ln < rn;
+
+		// determine sibling order
+		xml_node_struct* ls = ln;
+		xml_node_struct* rs = rn;
+
+		while (ls && rs)
+		{
+			if (ls == rn) return true;
+			if (rs == ln) return false;
+
+			ls = ls->next_sibling;
+			rs = rs->next_sibling;
+		}
+
+		// if rn sibling chain ended ln must be before rn
+		return !rs;
+	}
+
+	PUGI_IMPL_FN bool node_is_before(xml_node_struct* ln, xml_node_struct* rn)
+	{
+		// find common ancestor at the same depth, if any
+		xml_node_struct* lp = ln;
+		xml_node_struct* rp = rn;
+
+		while (lp && rp && lp->parent != rp->parent)
+		{
+			lp = lp->parent;
+			rp = rp->parent;
+		}
+
+		// parents are the same!
+		if (lp && rp) return node_is_before_sibling(lp, rp);
+
+		// nodes are at different depths, need to normalize heights
+		bool left_higher = !lp;
+
+		while (lp)
+		{
+			lp = lp->parent;
+			ln = ln->parent;
+		}
+
+		while (rp)
+		{
+			rp = rp->parent;
+			rn = rn->parent;
+		}
+
+		// one node is the ancestor of the other
+		if (ln == rn) return left_higher;
+
+		// find common ancestor... again
+		while (ln->parent != rn->parent)
+		{
+			ln = ln->parent;
+			rn = rn->parent;
+		}
+
+		return node_is_before_sibling(ln, rn);
+	}
+
+	PUGI_IMPL_FN bool node_is_ancestor(xml_node_struct* parent, xml_node_struct* node)
+	{
+		while (node && node != parent) node = node->parent;
+
+		return parent && node == parent;
+	}
+
+	PUGI_IMPL_FN const void* document_buffer_order(const xpath_node& xnode)
+	{
+		xml_node_struct* node = xnode.node().internal_object();
+
+		if (node)
+		{
+			if ((get_document(node).header & xml_memory_page_contents_shared_mask) == 0)
+			{
+				if (node->name && (node->header & impl::xml_memory_page_name_allocated_or_shared_mask) == 0) return node->name;
+				if (node->value && (node->header & impl::xml_memory_page_value_allocated_or_shared_mask) == 0) return node->value;
+			}
+
+			return NULL;
+		}
+
+		xml_attribute_struct* attr = xnode.attribute().internal_object();
+
+		if (attr)
+		{
+			if ((get_document(attr).header & xml_memory_page_contents_shared_mask) == 0)
+			{
+				if ((attr->header & impl::xml_memory_page_name_allocated_or_shared_mask) == 0) return attr->name;
+				if ((attr->header & impl::xml_memory_page_value_allocated_or_shared_mask) == 0) return attr->value;
+			}
+
+			return NULL;
+		}
+
+		return NULL;
+	}
+
+	struct document_order_comparator
+	{
+		bool operator()(const xpath_node& lhs, const xpath_node& rhs) const
+		{
+			// optimized document order based check
+			const void* lo = document_buffer_order(lhs);
+			const void* ro = document_buffer_order(rhs);
+
+			if (lo && ro) return lo < ro;
+
+			// slow comparison
+			xml_node ln = lhs.node(), rn = rhs.node();
+
+			// compare attributes
+			if (lhs.attribute() && rhs.attribute())
+			{
+				// shared parent
+				if (lhs.parent() == rhs.parent())
+				{
+					// determine sibling order
+					for (xml_attribute a = lhs.attribute(); a; a = a.next_attribute())
+						if (a == rhs.attribute())
+							return true;
+
+					return false;
+				}
+
+				// compare attribute parents
+				ln = lhs.parent();
+				rn = rhs.parent();
+			}
+			else if (lhs.attribute())
+			{
+				// attributes go after the parent element
+				if (lhs.parent() == rhs.node()) return false;
+
+				ln = lhs.parent();
+			}
+			else if (rhs.attribute())
+			{
+				// attributes go after the parent element
+				if (rhs.parent() == lhs.node()) return true;
+
+				rn = rhs.parent();
+			}
+
+			if (ln == rn) return false;
+
+			if (!ln || !rn) return ln < rn;
+
+			return node_is_before(ln.internal_object(), rn.internal_object());
+		}
+	};
+
+	PUGI_IMPL_FN double gen_nan()
+	{
+	#if defined(__STDC_IEC_559__) || ((FLT_RADIX - 0 == 2) && (FLT_MAX_EXP - 0 == 128) && (FLT_MANT_DIG - 0 == 24))
+		PUGI_IMPL_STATIC_ASSERT(sizeof(float) == sizeof(uint32_t));
+		typedef uint32_t UI; // BCC5 workaround
+		union { float f; UI i; } u;
+		u.i = 0x7fc00000;
+		return double(u.f);
+	#else
+		// fallback
+		const volatile double zero = 0.0;
+		return zero / zero;
+	#endif
+	}
+
+	PUGI_IMPL_FN bool is_nan(double value)
+	{
+	#if defined(PUGI_IMPL_MSVC_CRT_VERSION) || defined(__BORLANDC__)
+		return !!_isnan(value);
+	#elif defined(fpclassify) && defined(FP_NAN)
+		return fpclassify(value) == FP_NAN;
+	#else
+		// fallback
+		const volatile double v = value;
+		return v != v;
+	#endif
+	}
+
+	PUGI_IMPL_FN const char_t* convert_number_to_string_special(double value)
+	{
+	#if defined(PUGI_IMPL_MSVC_CRT_VERSION) || defined(__BORLANDC__)
+		if (_finite(value)) return (value == 0) ? PUGIXML_TEXT("0") : 0;
+		if (_isnan(value)) return PUGIXML_TEXT("NaN");
+		return value > 0 ? PUGIXML_TEXT("Infinity") : PUGIXML_TEXT("-Infinity");
+	#elif defined(fpclassify) && defined(FP_NAN) && defined(FP_INFINITE) && defined(FP_ZERO)
+		switch (fpclassify(value))
+		{
+		case FP_NAN:
+			return PUGIXML_TEXT("NaN");
+
+		case FP_INFINITE:
+			return value > 0 ? PUGIXML_TEXT("Infinity") : PUGIXML_TEXT("-Infinity");
+
+		case FP_ZERO:
+			return PUGIXML_TEXT("0");
+
+		default:
+			return 0;
+		}
+	#else
+		// fallback
+		const volatile double v = value;
+
+		if (v == 0) return PUGIXML_TEXT("0");
+		if (v != v) return PUGIXML_TEXT("NaN");
+		if (v * 2 == v) return value > 0 ? PUGIXML_TEXT("Infinity") : PUGIXML_TEXT("-Infinity");
+		return NULL;
+	#endif
+	}
+
+	PUGI_IMPL_FN bool convert_number_to_boolean(double value)
+	{
+		return (value != 0 && !is_nan(value));
+	}
+
+	PUGI_IMPL_FN void truncate_zeros(char* begin, char* end)
+	{
+		while (begin != end && end[-1] == '0') end--;
+
+		*end = 0;
+	}
+
+	// gets mantissa digits in the form of 0.xxxxx with 0. implied and the exponent
+#if defined(PUGI_IMPL_MSVC_CRT_VERSION) && PUGI_IMPL_MSVC_CRT_VERSION >= 1400
+	PUGI_IMPL_FN void convert_number_to_mantissa_exponent(double value, char (&buffer)[32], char** out_mantissa, int* out_exponent)
+	{
+		// get base values
+		int sign, exponent;
+		_ecvt_s(buffer, sizeof(buffer), value, DBL_DIG + 1, &exponent, &sign);
+
+		// truncate redundant zeros
+		truncate_zeros(buffer, buffer + strlen(buffer));
+
+		// fill results
+		*out_mantissa = buffer;
+		*out_exponent = exponent;
+	}
+#else
+	PUGI_IMPL_FN void convert_number_to_mantissa_exponent(double value, char (&buffer)[32], char** out_mantissa, int* out_exponent)
+	{
+		// get a scientific notation value with IEEE DBL_DIG decimals
+		PUGI_IMPL_SNPRINTF(buffer, "%.*e", DBL_DIG, value);
+
+		// get the exponent (possibly negative)
+		char* exponent_string = strchr(buffer, 'e');
+		assert(exponent_string);
+
+		int exponent = atoi(exponent_string + 1);
+
+		// extract mantissa string: skip sign
+		char* mantissa = buffer[0] == '-' ? buffer + 1 : buffer;
+		assert(mantissa[0] != '0' && (mantissa[1] == '.' || mantissa[1] == ','));
+
+		// divide mantissa by 10 to eliminate integer part
+		mantissa[1] = mantissa[0];
+		mantissa++;
+		exponent++;
+
+		// remove extra mantissa digits and zero-terminate mantissa
+		truncate_zeros(mantissa, exponent_string);
+
+		// fill results
+		*out_mantissa = mantissa;
+		*out_exponent = exponent;
+	}
+#endif
+
+	PUGI_IMPL_FN xpath_string convert_number_to_string(double value, xpath_allocator* alloc)
+	{
+		// try special number conversion
+		const char_t* special = convert_number_to_string_special(value);
+		if (special) return xpath_string::from_const(special);
+
+		// get mantissa + exponent form
+		char mantissa_buffer[32];
+
+		char* mantissa;
+		int exponent;
+		convert_number_to_mantissa_exponent(value, mantissa_buffer, &mantissa, &exponent);
+
+		// allocate a buffer of suitable length for the number
+		size_t result_size = strlen(mantissa_buffer) + (exponent > 0 ? exponent : -exponent) + 4;
+		char_t* result = static_cast<char_t*>(alloc->allocate(sizeof(char_t) * result_size));
+		if (!result) return xpath_string();
+
+		// make the number!
+		char_t* s = result;
+
+		// sign
+		if (value < 0) *s++ = '-';
+
+		// integer part
+		if (exponent <= 0)
+		{
+			*s++ = '0';
+		}
+		else
+		{
+			while (exponent > 0)
+			{
+				assert(*mantissa == 0 || static_cast<unsigned int>(*mantissa - '0') <= 9);
+				*s++ = *mantissa ? *mantissa++ : '0';
+				exponent--;
+			}
+		}
+
+		// fractional part
+		if (*mantissa)
+		{
+			// decimal point
+			*s++ = '.';
+
+			// extra zeroes from negative exponent
+			while (exponent < 0)
+			{
+				*s++ = '0';
+				exponent++;
+			}
+
+			// extra mantissa digits
+			while (*mantissa)
+			{
+				assert(static_cast<unsigned int>(*mantissa - '0') <= 9);
+				*s++ = *mantissa++;
+			}
+		}
+
+		// zero-terminate
+		assert(s < result + result_size);
+		*s = 0;
+
+		return xpath_string::from_heap_preallocated(result, s);
+	}
+
+	PUGI_IMPL_FN bool check_string_to_number_format(const char_t* string)
+	{
+		// parse leading whitespace
+		while (PUGI_IMPL_IS_CHARTYPE(*string, ct_space)) ++string;
+
+		// parse sign
+		if (*string == '-') ++string;
+
+		if (!*string) return false;
+
+		// if there is no integer part, there should be a decimal part with at least one digit
+		if (!PUGI_IMPL_IS_CHARTYPEX(string[0], ctx_digit) && (string[0] != '.' || !PUGI_IMPL_IS_CHARTYPEX(string[1], ctx_digit))) return false;
+
+		// parse integer part
+		while (PUGI_IMPL_IS_CHARTYPEX(*string, ctx_digit)) ++string;
+
+		// parse decimal part
+		if (*string == '.')
+		{
+			++string;
+
+			while (PUGI_IMPL_IS_CHARTYPEX(*string, ctx_digit)) ++string;
+		}
+
+		// parse trailing whitespace
+		while (PUGI_IMPL_IS_CHARTYPE(*string, ct_space)) ++string;
+
+		return *string == 0;
+	}
+
+	PUGI_IMPL_FN double convert_string_to_number(const char_t* string)
+	{
+		// check string format
+		if (!check_string_to_number_format(string)) return gen_nan();
+
+		// parse string
+	#ifdef PUGIXML_WCHAR_MODE
+		return wcstod(string, NULL);
+	#else
+		return strtod(string, NULL);
+	#endif
+	}
+
+	PUGI_IMPL_FN bool convert_string_to_number_scratch(char_t (&buffer)[32], const char_t* begin, const char_t* end, double* out_result)
+	{
+		size_t length = static_cast<size_t>(end - begin);
+		char_t* scratch = buffer;
+
+		if (length >= sizeof(buffer) / sizeof(buffer[0]))
+		{
+			// need to make dummy on-heap copy
+			scratch = static_cast<char_t*>(xml_memory::allocate((length + 1) * sizeof(char_t)));
+			if (!scratch) return false;
+		}
+
+		// copy string to zero-terminated buffer and perform conversion
+		memcpy(scratch, begin, length * sizeof(char_t));
+		scratch[length] = 0;
+
+		*out_result = convert_string_to_number(scratch);
+
+		// free dummy buffer
+		if (scratch != buffer) xml_memory::deallocate(scratch);
+
+		return true;
+	}
+
+	PUGI_IMPL_FN double round_nearest(double value)
+	{
+		return floor(value + 0.5);
+	}
+
+	PUGI_IMPL_FN double round_nearest_nzero(double value)
+	{
+		// same as round_nearest, but returns -0 for [-0.5, -0]
+		// ceil is used to differentiate between +0 and -0 (we return -0 for [-0.5, -0] and +0 for +0)
+		return (value >= -0.5 && value <= 0) ? ceil(value) : floor(value + 0.5);
+	}
+
+	PUGI_IMPL_FN const char_t* qualified_name(const xpath_node& node)
+	{
+		return node.attribute() ? node.attribute().name() : node.node().name();
+	}
+
+	PUGI_IMPL_FN const char_t* local_name(const xpath_node& node)
+	{
+		const char_t* name = qualified_name(node);
+		const char_t* p = find_char(name, ':');
+
+		return p ? p + 1 : name;
+	}
+
+	struct namespace_uri_predicate
+	{
+		const char_t* prefix;
+		size_t prefix_length;
+
+		namespace_uri_predicate(const char_t* name)
+		{
+			const char_t* pos = find_char(name, ':');
+
+			prefix = pos ? name : NULL;
+			prefix_length = pos ? static_cast<size_t>(pos - name) : 0;
+		}
+
+		bool operator()(xml_attribute a) const
+		{
+			const char_t* name = a.name();
+
+			if (!starts_with(name, PUGIXML_TEXT("xmlns"))) return false;
+
+			return prefix ? name[5] == ':' && strequalrange(name + 6, prefix, prefix_length) : name[5] == 0;
+		}
+	};
+
+	PUGI_IMPL_FN const char_t* namespace_uri(xml_node node)
+	{
+		namespace_uri_predicate pred = node.name();
+
+		xml_node p = node;
+
+		while (p)
+		{
+			xml_attribute a = p.find_attribute(pred);
+
+			if (a) return a.value();
+
+			p = p.parent();
+		}
+
+		return PUGIXML_TEXT("");
+	}
+
+	PUGI_IMPL_FN const char_t* namespace_uri(xml_attribute attr, xml_node parent)
+	{
+		namespace_uri_predicate pred = attr.name();
+
+		// Default namespace does not apply to attributes
+		if (!pred.prefix) return PUGIXML_TEXT("");
+
+		xml_node p = parent;
+
+		while (p)
+		{
+			xml_attribute a = p.find_attribute(pred);
+
+			if (a) return a.value();
+
+			p = p.parent();
+		}
+
+		return PUGIXML_TEXT("");
+	}
+
+	PUGI_IMPL_FN const char_t* namespace_uri(const xpath_node& node)
+	{
+		return node.attribute() ? namespace_uri(node.attribute(), node.parent()) : namespace_uri(node.node());
+	}
+
+	PUGI_IMPL_FN char_t* normalize_space(char_t* buffer)
+	{
+		char_t* write = buffer;
+
+		for (char_t* it = buffer; *it; )
+		{
+			char_t ch = *it++;
+
+			if (PUGI_IMPL_IS_CHARTYPE(ch, ct_space))
+			{
+				// replace whitespace sequence with single space
+				while (PUGI_IMPL_IS_CHARTYPE(*it, ct_space)) it++;
+
+				// avoid leading spaces
+				if (write != buffer) *write++ = ' ';
+			}
+			else *write++ = ch;
+		}
+
+		// remove trailing space
+		if (write != buffer && PUGI_IMPL_IS_CHARTYPE(write[-1], ct_space)) write--;
+
+		// zero-terminate
+		*write = 0;
+
+		return write;
+	}
+
+	PUGI_IMPL_FN char_t* translate(char_t* buffer, const char_t* from, const char_t* to, size_t to_length)
+	{
+		char_t* write = buffer;
+
+		while (*buffer)
+		{
+			PUGI_IMPL_DMC_VOLATILE char_t ch = *buffer++;
+
+			const char_t* pos = find_char(from, ch);
+
+			if (!pos)
+				*write++ = ch; // do not process
+			else if (static_cast<size_t>(pos - from) < to_length)
+				*write++ = to[pos - from]; // replace
+		}
+
+		// zero-terminate
+		*write = 0;
+
+		return write;
+	}
+
+	PUGI_IMPL_FN unsigned char* translate_table_generate(xpath_allocator* alloc, const char_t* from, const char_t* to)
+	{
+		unsigned char table[128] = {0};
+
+		while (*from)
+		{
+			unsigned int fc = static_cast<unsigned int>(*from);
+			unsigned int tc = static_cast<unsigned int>(*to);
+
+			if (fc >= 128 || tc >= 128)
+				return NULL;
+
+			// code=128 means "skip character"
+			if (!table[fc])
+				table[fc] = static_cast<unsigned char>(tc ? tc : 128);
+
+			from++;
+			if (tc) to++;
+		}
+
+		for (int i = 0; i < 128; ++i)
+			if (!table[i])
+				table[i] = static_cast<unsigned char>(i);
+
+		void* result = alloc->allocate(sizeof(table));
+		if (!result) return NULL;
+
+		memcpy(result, table, sizeof(table));
+
+		return static_cast<unsigned char*>(result);
+	}
+
+	PUGI_IMPL_FN char_t* translate_table(char_t* buffer, const unsigned char* table)
+	{
+		char_t* write = buffer;
+
+		while (*buffer)
+		{
+			char_t ch = *buffer++;
+			unsigned int index = static_cast<unsigned int>(ch);
+
+			if (index < 128)
+			{
+				unsigned char code = table[index];
+
+				// code=128 means "skip character" (table size is 128 so 128 can be a special value)
+				// this code skips these characters without extra branches
+				*write = static_cast<char_t>(code);
+				write += 1 - (code >> 7);
+			}
+			else
+			{
+				*write++ = ch;
+			}
+		}
+
+		// zero-terminate
+		*write = 0;
+
+		return write;
+	}
+
+	inline bool is_xpath_attribute(const char_t* name)
+	{
+		return !(starts_with(name, PUGIXML_TEXT("xmlns")) && (name[5] == 0 || name[5] == ':'));
+	}
+
+	struct xpath_variable_boolean: xpath_variable
+	{
+		xpath_variable_boolean(): xpath_variable(xpath_type_boolean), value(false)
+		{
+		}
+
+		bool value;
+		char_t name[1];
+	};
+
+	struct xpath_variable_number: xpath_variable
+	{
+		xpath_variable_number(): xpath_variable(xpath_type_number), value(0)
+		{
+		}
+
+		double value;
+		char_t name[1];
+	};
+
+	struct xpath_variable_string: xpath_variable
+	{
+		xpath_variable_string(): xpath_variable(xpath_type_string), value(NULL)
+		{
+		}
+
+		~xpath_variable_string()
+		{
+			if (value) xml_memory::deallocate(value);
+		}
+
+		char_t* value;
+		char_t name[1];
+	};
+
+	struct xpath_variable_node_set: xpath_variable
+	{
+		xpath_variable_node_set(): xpath_variable(xpath_type_node_set)
+		{
+		}
+
+		xpath_node_set value;
+		char_t name[1];
+	};
+
+	static const xpath_node_set dummy_node_set;
+
+	PUGI_IMPL_FN PUGI_IMPL_UNSIGNED_OVERFLOW unsigned int hash_string(const char_t* str)
+	{
+		// Jenkins one-at-a-time hash (http://en.wikipedia.org/wiki/Jenkins_hash_function#one-at-a-time)
+		unsigned int result = 0;
+
+		while (*str)
+		{
+			result += static_cast<unsigned int>(*str++);
+			result += result << 10;
+			result ^= result >> 6;
+		}
+
+		result += result << 3;
+		result ^= result >> 11;
+		result += result << 15;
+
+		return result;
+	}
+
+	template <typename T> PUGI_IMPL_FN T* new_xpath_variable(const char_t* name)
+	{
+		size_t length = strlength(name);
+		if (length == 0) return NULL; // empty variable names are invalid
+
+		// $$ we can't use offsetof(T, name) because T is non-POD, so we just allocate additional length characters
+		void* memory = xml_memory::allocate(sizeof(T) + length * sizeof(char_t));
+		if (!memory) return NULL;
+
+		T* result = new (memory) T();
+
+		memcpy(result->name, name, (length + 1) * sizeof(char_t));
+
+		return result;
+	}
+
+	PUGI_IMPL_FN xpath_variable* new_xpath_variable(xpath_value_type type, const char_t* name)
+	{
+		switch (type)
+		{
+		case xpath_type_node_set:
+			return new_xpath_variable<xpath_variable_node_set>(name);
+
+		case xpath_type_number:
+			return new_xpath_variable<xpath_variable_number>(name);
+
+		case xpath_type_string:
+			return new_xpath_variable<xpath_variable_string>(name);
+
+		case xpath_type_boolean:
+			return new_xpath_variable<xpath_variable_boolean>(name);
+
+		default:
+			return NULL;
+		}
+	}
+
+	template <typename T> PUGI_IMPL_FN void delete_xpath_variable(T* var)
+	{
+		var->~T();
+		xml_memory::deallocate(var);
+	}
+
+	PUGI_IMPL_FN void delete_xpath_variable(xpath_value_type type, xpath_variable* var)
+	{
+		switch (type)
+		{
+		case xpath_type_node_set:
+			delete_xpath_variable(static_cast<xpath_variable_node_set*>(var));
+			break;
+
+		case xpath_type_number:
+			delete_xpath_variable(static_cast<xpath_variable_number*>(var));
+			break;
+
+		case xpath_type_string:
+			delete_xpath_variable(static_cast<xpath_variable_string*>(var));
+			break;
+
+		case xpath_type_boolean:
+			delete_xpath_variable(static_cast<xpath_variable_boolean*>(var));
+			break;
+
+		default:
+			assert(false && "Invalid variable type"); // unreachable
+		}
+	}
+
+	PUGI_IMPL_FN bool copy_xpath_variable(xpath_variable* lhs, const xpath_variable* rhs)
+	{
+		switch (rhs->type())
+		{
+		case xpath_type_node_set:
+			return lhs->set(static_cast<const xpath_variable_node_set*>(rhs)->value);
+
+		case xpath_type_number:
+			return lhs->set(static_cast<const xpath_variable_number*>(rhs)->value);
+
+		case xpath_type_string:
+			return lhs->set(static_cast<const xpath_variable_string*>(rhs)->value);
+
+		case xpath_type_boolean:
+			return lhs->set(static_cast<const xpath_variable_boolean*>(rhs)->value);
+
+		default:
+			assert(false && "Invalid variable type"); // unreachable
+			return false;
+		}
+	}
+
+	PUGI_IMPL_FN bool get_variable_scratch(char_t (&buffer)[32], xpath_variable_set* set, const char_t* begin, const char_t* end, xpath_variable** out_result)
+	{
+		size_t length = static_cast<size_t>(end - begin);
+		char_t* scratch = buffer;
+
+		if (length >= sizeof(buffer) / sizeof(buffer[0]))
+		{
+			// need to make dummy on-heap copy
+			scratch = static_cast<char_t*>(xml_memory::allocate((length + 1) * sizeof(char_t)));
+			if (!scratch) return false;
+		}
+
+		// copy string to zero-terminated buffer and perform lookup
+		memcpy(scratch, begin, length * sizeof(char_t));
+		scratch[length] = 0;
+
+		*out_result = set->get(scratch);
+
+		// free dummy buffer
+		if (scratch != buffer) xml_memory::deallocate(scratch);
+
+		return true;
+	}
+PUGI_IMPL_NS_END
+
+// Internal node set class
+PUGI_IMPL_NS_BEGIN
+	PUGI_IMPL_FN xpath_node_set::type_t xpath_get_order(const xpath_node* begin, const xpath_node* end)
+	{
+		if (end - begin < 2)
+			return xpath_node_set::type_sorted;
+
+		document_order_comparator cmp;
+
+		bool first = cmp(begin[0], begin[1]);
+
+		for (const xpath_node* it = begin + 1; it + 1 < end; ++it)
+			if (cmp(it[0], it[1]) != first)
+				return xpath_node_set::type_unsorted;
+
+		return first ? xpath_node_set::type_sorted : xpath_node_set::type_sorted_reverse;
+	}
+
+	PUGI_IMPL_FN xpath_node_set::type_t xpath_sort(xpath_node* begin, xpath_node* end, xpath_node_set::type_t type, bool rev)
+	{
+		xpath_node_set::type_t order = rev ? xpath_node_set::type_sorted_reverse : xpath_node_set::type_sorted;
+
+		if (type == xpath_node_set::type_unsorted)
+		{
+			xpath_node_set::type_t sorted = xpath_get_order(begin, end);
+
+			if (sorted == xpath_node_set::type_unsorted)
+			{
+				sort(begin, end, document_order_comparator());
+
+				type = xpath_node_set::type_sorted;
+			}
+			else
+				type = sorted;
+		}
+
+		if (type != order) reverse(begin, end);
+
+		return order;
+	}
+
+	PUGI_IMPL_FN xpath_node xpath_first(const xpath_node* begin, const xpath_node* end, xpath_node_set::type_t type)
+	{
+		if (begin == end) return xpath_node();
+
+		switch (type)
+		{
+		case xpath_node_set::type_sorted:
+			return *begin;
+
+		case xpath_node_set::type_sorted_reverse:
+			return *(end - 1);
+
+		case xpath_node_set::type_unsorted:
+			return *min_element(begin, end, document_order_comparator());
+
+		default:
+			assert(false && "Invalid node set type"); // unreachable
+			return xpath_node();
+		}
+	}
+
+	class xpath_node_set_raw
+	{
+		xpath_node_set::type_t _type;
+
+		xpath_node* _begin;
+		xpath_node* _end;
+		xpath_node* _eos;
+
+	public:
+		xpath_node_set_raw(): _type(xpath_node_set::type_unsorted), _begin(NULL), _end(NULL), _eos(NULL)
+		{
+		}
+
+		xpath_node* begin() const
+		{
+			return _begin;
+		}
+
+		xpath_node* end() const
+		{
+			return _end;
+		}
+
+		bool empty() const
+		{
+			return _begin == _end;
+		}
+
+		size_t size() const
+		{
+			return static_cast<size_t>(_end - _begin);
+		}
+
+		xpath_node first() const
+		{
+			return xpath_first(_begin, _end, _type);
+		}
+
+		void push_back_grow(const xpath_node& node, xpath_allocator* alloc);
+
+		void push_back(const xpath_node& node, xpath_allocator* alloc)
+		{
+			if (_end != _eos)
+				*_end++ = node;
+			else
+				push_back_grow(node, alloc);
+		}
+
+		void append(const xpath_node* begin_, const xpath_node* end_, xpath_allocator* alloc)
+		{
+			if (begin_ == end_) return;
+
+			size_t size_ = static_cast<size_t>(_end - _begin);
+			size_t capacity = static_cast<size_t>(_eos - _begin);
+			size_t count = static_cast<size_t>(end_ - begin_);
+
+			if (size_ + count > capacity)
+			{
+				// reallocate the old array or allocate a new one
+				xpath_node* data = static_cast<xpath_node*>(alloc->reallocate(_begin, capacity * sizeof(xpath_node), (size_ + count) * sizeof(xpath_node)));
+				if (!data) return;
+
+				// finalize
+				_begin = data;
+				_end = data + size_;
+				_eos = data + size_ + count;
+			}
+
+			memcpy(_end, begin_, count * sizeof(xpath_node));
+			_end += count;
+		}
+
+		void sort_do()
+		{
+			_type = xpath_sort(_begin, _end, _type, false);
+		}
+
+		void truncate(xpath_node* pos)
+		{
+			assert(_begin <= pos && pos <= _end);
+
+			_end = pos;
+		}
+
+		void remove_duplicates(xpath_allocator* alloc)
+		{
+			if (_type == xpath_node_set::type_unsorted && _end - _begin > 2)
+			{
+				xpath_allocator_capture cr(alloc);
+
+				size_t size_ = static_cast<size_t>(_end - _begin);
+
+				size_t hash_size = 1;
+				while (hash_size < size_ + size_ / 2) hash_size *= 2;
+
+				const void** hash_data = static_cast<const void**>(alloc->allocate(hash_size * sizeof(void**)));
+				if (!hash_data) return;
+
+				memset(hash_data, 0, hash_size * sizeof(const void**));
+
+				xpath_node* write = _begin;
+
+				for (xpath_node* it = _begin; it != _end; ++it)
+				{
+					const void* attr = it->attribute().internal_object();
+					const void* node = it->node().internal_object();
+					const void* key = attr ? attr : node;
+
+					if (key && hash_insert(hash_data, hash_size, key))
+					{
+						*write++ = *it;
+					}
+				}
+
+				_end = write;
+			}
+			else
+			{
+				_end = unique(_begin, _end);
+			}
+		}
+
+		xpath_node_set::type_t type() const
+		{
+			return _type;
+		}
+
+		void set_type(xpath_node_set::type_t value)
+		{
+			_type = value;
+		}
+	};
+
+	PUGI_IMPL_FN_NO_INLINE void xpath_node_set_raw::push_back_grow(const xpath_node& node, xpath_allocator* alloc)
+	{
+		size_t capacity = static_cast<size_t>(_eos - _begin);
+
+		// get new capacity (1.5x rule)
+		size_t new_capacity = capacity + capacity / 2 + 1;
+
+		// reallocate the old array or allocate a new one
+		xpath_node* data = static_cast<xpath_node*>(alloc->reallocate(_begin, capacity * sizeof(xpath_node), new_capacity * sizeof(xpath_node)));
+		if (!data) return;
+
+		// finalize
+		_begin = data;
+		_end = data + capacity;
+		_eos = data + new_capacity;
+
+		// push
+		*_end++ = node;
+	}
+PUGI_IMPL_NS_END
+
+PUGI_IMPL_NS_BEGIN
+	struct xpath_context
+	{
+		xpath_node n;
+		size_t position, size;
+
+		xpath_context(const xpath_node& n_, size_t position_, size_t size_): n(n_), position(position_), size(size_)
+		{
+		}
+	};
+
+	enum lexeme_t
+	{
+		lex_none = 0,
+		lex_equal,
+		lex_not_equal,
+		lex_less,
+		lex_greater,
+		lex_less_or_equal,
+		lex_greater_or_equal,
+		lex_plus,
+		lex_minus,
+		lex_multiply,
+		lex_union,
+		lex_var_ref,
+		lex_open_brace,
+		lex_close_brace,
+		lex_quoted_string,
+		lex_number,
+		lex_slash,
+		lex_double_slash,
+		lex_open_square_brace,
+		lex_close_square_brace,
+		lex_string,
+		lex_comma,
+		lex_axis_attribute,
+		lex_dot,
+		lex_double_dot,
+		lex_double_colon,
+		lex_eof
+	};
+
+	struct xpath_lexer_string
+	{
+		const char_t* begin;
+		const char_t* end;
+
+		xpath_lexer_string(): begin(NULL), end(NULL)
+		{
+		}
+
+		bool operator==(const char_t* other) const
+		{
+			size_t length = static_cast<size_t>(end - begin);
+
+			return strequalrange(other, begin, length);
+		}
+	};
+
+	class xpath_lexer
+	{
+		const char_t* _cur;
+		const char_t* _cur_lexeme_pos;
+		xpath_lexer_string _cur_lexeme_contents;
+
+		lexeme_t _cur_lexeme;
+
+	public:
+		explicit xpath_lexer(const char_t* query): _cur(query)
+		{
+			next();
+		}
+
+		const char_t* state() const
+		{
+			return _cur;
+		}
+
+		void next()
+		{
+			const char_t* cur = _cur;
+
+			while (PUGI_IMPL_IS_CHARTYPE(*cur, ct_space)) ++cur;
+
+			// save lexeme position for error reporting
+			_cur_lexeme_pos = cur;
+
+			switch (*cur)
+			{
+			case 0:
+				_cur_lexeme = lex_eof;
+				break;
+
+			case '>':
+				if (*(cur+1) == '=')
+				{
+					cur += 2;
+					_cur_lexeme = lex_greater_or_equal;
+				}
+				else
+				{
+					cur += 1;
+					_cur_lexeme = lex_greater;
+				}
+				break;
+
+			case '<':
+				if (*(cur+1) == '=')
+				{
+					cur += 2;
+					_cur_lexeme = lex_less_or_equal;
+				}
+				else
+				{
+					cur += 1;
+					_cur_lexeme = lex_less;
+				}
+				break;
+
+			case '!':
+				if (*(cur+1) == '=')
+				{
+					cur += 2;
+					_cur_lexeme = lex_not_equal;
+				}
+				else
+				{
+					_cur_lexeme = lex_none;
+				}
+				break;
+
+			case '=':
+				cur += 1;
+				_cur_lexeme = lex_equal;
+
+				break;
+
+			case '+':
+				cur += 1;
+				_cur_lexeme = lex_plus;
+
+				break;
+
+			case '-':
+				cur += 1;
+				_cur_lexeme = lex_minus;
+
+				break;
+
+			case '*':
+				cur += 1;
+				_cur_lexeme = lex_multiply;
+
+				break;
+
+			case '|':
+				cur += 1;
+				_cur_lexeme = lex_union;
+
+				break;
+
+			case '$':
+				cur += 1;
+
+				if (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_start_symbol))
+				{
+					_cur_lexeme_contents.begin = cur;
+
+					while (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_symbol)) cur++;
+
+					if (cur[0] == ':' && PUGI_IMPL_IS_CHARTYPEX(cur[1], ctx_symbol)) // qname
+					{
+						cur++; // :
+
+						while (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_symbol)) cur++;
+					}
+
+					_cur_lexeme_contents.end = cur;
+
+					_cur_lexeme = lex_var_ref;
+				}
+				else
+				{
+					_cur_lexeme = lex_none;
+				}
+
+				break;
+
+			case '(':
+				cur += 1;
+				_cur_lexeme = lex_open_brace;
+
+				break;
+
+			case ')':
+				cur += 1;
+				_cur_lexeme = lex_close_brace;
+
+				break;
+
+			case '[':
+				cur += 1;
+				_cur_lexeme = lex_open_square_brace;
+
+				break;
+
+			case ']':
+				cur += 1;
+				_cur_lexeme = lex_close_square_brace;
+
+				break;
+
+			case ',':
+				cur += 1;
+				_cur_lexeme = lex_comma;
+
+				break;
+
+			case '/':
+				if (*(cur+1) == '/')
+				{
+					cur += 2;
+					_cur_lexeme = lex_double_slash;
+				}
+				else
+				{
+					cur += 1;
+					_cur_lexeme = lex_slash;
+				}
+				break;
+
+			case '.':
+				if (*(cur+1) == '.')
+				{
+					cur += 2;
+					_cur_lexeme = lex_double_dot;
+				}
+				else if (PUGI_IMPL_IS_CHARTYPEX(*(cur+1), ctx_digit))
+				{
+					_cur_lexeme_contents.begin = cur; // .
+
+					++cur;
+
+					while (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_digit)) cur++;
+
+					_cur_lexeme_contents.end = cur;
+
+					_cur_lexeme = lex_number;
+				}
+				else
+				{
+					cur += 1;
+					_cur_lexeme = lex_dot;
+				}
+				break;
+
+			case '@':
+				cur += 1;
+				_cur_lexeme = lex_axis_attribute;
+
+				break;
+
+			case '"':
+			case '\'':
+			{
+				char_t terminator = *cur;
+
+				++cur;
+
+				_cur_lexeme_contents.begin = cur;
+				while (*cur && *cur != terminator) cur++;
+				_cur_lexeme_contents.end = cur;
+
+				if (!*cur)
+					_cur_lexeme = lex_none;
+				else
+				{
+					cur += 1;
+					_cur_lexeme = lex_quoted_string;
+				}
+
+				break;
+			}
+
+			case ':':
+				if (*(cur+1) == ':')
+				{
+					cur += 2;
+					_cur_lexeme = lex_double_colon;
+				}
+				else
+				{
+					_cur_lexeme = lex_none;
+				}
+				break;
+
+			default:
+				if (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_digit))
+				{
+					_cur_lexeme_contents.begin = cur;
+
+					while (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_digit)) cur++;
+
+					if (*cur == '.')
+					{
+						cur++;
+
+						while (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_digit)) cur++;
+					}
+
+					_cur_lexeme_contents.end = cur;
+
+					_cur_lexeme = lex_number;
+				}
+				else if (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_start_symbol))
+				{
+					_cur_lexeme_contents.begin = cur;
+
+					while (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_symbol)) cur++;
+
+					if (cur[0] == ':')
+					{
+						if (cur[1] == '*') // namespace test ncname:*
+						{
+							cur += 2; // :*
+						}
+						else if (PUGI_IMPL_IS_CHARTYPEX(cur[1], ctx_symbol)) // namespace test qname
+						{
+							cur++; // :
+
+							while (PUGI_IMPL_IS_CHARTYPEX(*cur, ctx_symbol)) cur++;
+						}
+					}
+
+					_cur_lexeme_contents.end = cur;
+
+					_cur_lexeme = lex_string;
+				}
+				else
+				{
+					_cur_lexeme = lex_none;
+				}
+			}
+
+			_cur = cur;
+		}
+
+		lexeme_t current() const
+		{
+			return _cur_lexeme;
+		}
+
+		const char_t* current_pos() const
+		{
+			return _cur_lexeme_pos;
+		}
+
+		const xpath_lexer_string& contents() const
+		{
+			assert(_cur_lexeme == lex_var_ref || _cur_lexeme == lex_number || _cur_lexeme == lex_string || _cur_lexeme == lex_quoted_string);
+
+			return _cur_lexeme_contents;
+		}
+	};
+
+	enum ast_type_t
+	{
+		ast_unknown,
+		ast_op_or,						// left or right
+		ast_op_and,						// left and right
+		ast_op_equal,					// left = right
+		ast_op_not_equal,				// left != right
+		ast_op_less,					// left < right
+		ast_op_greater,					// left > right
+		ast_op_less_or_equal,			// left <= right
+		ast_op_greater_or_equal,		// left >= right
+		ast_op_add,						// left + right
+		ast_op_subtract,				// left - right
+		ast_op_multiply,				// left * right
+		ast_op_divide,					// left / right
+		ast_op_mod,						// left % right
+		ast_op_negate,					// left - right
+		ast_op_union,					// left | right
+		ast_predicate,					// apply predicate to set; next points to next predicate
+		ast_filter,						// select * from left where right
+		ast_string_constant,			// string constant
+		ast_number_constant,			// number constant
+		ast_variable,					// variable
+		ast_func_last,					// last()
+		ast_func_position,				// position()
+		ast_func_count,					// count(left)
+		ast_func_id,					// id(left)
+		ast_func_local_name_0,			// local-name()
+		ast_func_local_name_1,			// local-name(left)
+		ast_func_namespace_uri_0,		// namespace-uri()
+		ast_func_namespace_uri_1,		// namespace-uri(left)
+		ast_func_name_0,				// name()
+		ast_func_name_1,				// name(left)
+		ast_func_string_0,				// string()
+		ast_func_string_1,				// string(left)
+		ast_func_concat,				// concat(left, right, siblings)
+		ast_func_starts_with,			// starts_with(left, right)
+		ast_func_contains,				// contains(left, right)
+		ast_func_substring_before,		// substring-before(left, right)
+		ast_func_substring_after,		// substring-after(left, right)
+		ast_func_substring_2,			// substring(left, right)
+		ast_func_substring_3,			// substring(left, right, third)
+		ast_func_string_length_0,		// string-length()
+		ast_func_string_length_1,		// string-length(left)
+		ast_func_normalize_space_0,		// normalize-space()
+		ast_func_normalize_space_1,		// normalize-space(left)
+		ast_func_translate,				// translate(left, right, third)
+		ast_func_boolean,				// boolean(left)
+		ast_func_not,					// not(left)
+		ast_func_true,					// true()
+		ast_func_false,					// false()
+		ast_func_lang,					// lang(left)
+		ast_func_number_0,				// number()
+		ast_func_number_1,				// number(left)
+		ast_func_sum,					// sum(left)
+		ast_func_floor,					// floor(left)
+		ast_func_ceiling,				// ceiling(left)
+		ast_func_round,					// round(left)
+		ast_step,						// process set left with step
+		ast_step_root,					// select root node
+
+		ast_opt_translate_table,		// translate(left, right, third) where right/third are constants
+		ast_opt_compare_attribute		// @name = 'string'
+	};
+
+	enum axis_t
+	{
+		axis_ancestor,
+		axis_ancestor_or_self,
+		axis_attribute,
+		axis_child,
+		axis_descendant,
+		axis_descendant_or_self,
+		axis_following,
+		axis_following_sibling,
+		axis_namespace,
+		axis_parent,
+		axis_preceding,
+		axis_preceding_sibling,
+		axis_self
+	};
+
+	enum nodetest_t
+	{
+		nodetest_none,
+		nodetest_name,
+		nodetest_type_node,
+		nodetest_type_comment,
+		nodetest_type_pi,
+		nodetest_type_text,
+		nodetest_pi,
+		nodetest_all,
+		nodetest_all_in_namespace
+	};
+
+	enum predicate_t
+	{
+		predicate_default,
+		predicate_posinv,
+		predicate_constant,
+		predicate_constant_one
+	};
+
+	enum nodeset_eval_t
+	{
+		nodeset_eval_all,
+		nodeset_eval_any,
+		nodeset_eval_first
+	};
+
+	template <axis_t N> struct axis_to_type
+	{
+		static const axis_t axis;
+	};
+
+	template <axis_t N> const axis_t axis_to_type<N>::axis = N;
+
+	class xpath_ast_node
+	{
+	private:
+		// node type
+		char _type;
+		char _rettype;
+
+		// for ast_step
+		char _axis;
+
+		// for ast_step/ast_predicate/ast_filter
+		char _test;
+
+		// tree node structure
+		xpath_ast_node* _left;
+		xpath_ast_node* _right;
+		xpath_ast_node* _next;
+
+		union
+		{
+			// value for ast_string_constant
+			const char_t* string;
+			// value for ast_number_constant
+			double number;
+			// variable for ast_variable
+			xpath_variable* variable;
+			// node test for ast_step (node name/namespace/node type/pi target)
+			const char_t* nodetest;
+			// table for ast_opt_translate_table
+			const unsigned char* table;
+		} _data;
+
+		xpath_ast_node(const xpath_ast_node&);
+		xpath_ast_node& operator=(const xpath_ast_node&);
+
+		template <class Comp> static bool compare_eq(xpath_ast_node* lhs, xpath_ast_node* rhs, const xpath_context& c, const xpath_stack& stack, const Comp& comp)
+		{
+			xpath_value_type lt = lhs->rettype(), rt = rhs->rettype();
+
+			if (lt != xpath_type_node_set && rt != xpath_type_node_set)
+			{
+				if (lt == xpath_type_boolean || rt == xpath_type_boolean)
+					return comp(lhs->eval_boolean(c, stack), rhs->eval_boolean(c, stack));
+				else if (lt == xpath_type_number || rt == xpath_type_number)
+					return comp(lhs->eval_number(c, stack), rhs->eval_number(c, stack));
+				else if (lt == xpath_type_string || rt == xpath_type_string)
+				{
+					xpath_allocator_capture cr(stack.result);
+
+					xpath_string ls = lhs->eval_string(c, stack);
+					xpath_string rs = rhs->eval_string(c, stack);
+
+					return comp(ls, rs);
+				}
+			}
+			else if (lt == xpath_type_node_set && rt == xpath_type_node_set)
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				xpath_node_set_raw ls = lhs->eval_node_set(c, stack, nodeset_eval_all);
+				xpath_node_set_raw rs = rhs->eval_node_set(c, stack, nodeset_eval_all);
+
+				for (const xpath_node* li = ls.begin(); li != ls.end(); ++li)
+					for (const xpath_node* ri = rs.begin(); ri != rs.end(); ++ri)
+					{
+						xpath_allocator_capture cri(stack.result);
+
+						if (comp(string_value(*li, stack.result), string_value(*ri, stack.result)))
+							return true;
+					}
+
+				return false;
+			}
+			else
+			{
+				if (lt == xpath_type_node_set)
+				{
+					swap(lhs, rhs);
+					swap(lt, rt);
+				}
+
+				if (lt == xpath_type_boolean)
+					return comp(lhs->eval_boolean(c, stack), rhs->eval_boolean(c, stack));
+				else if (lt == xpath_type_number)
+				{
+					xpath_allocator_capture cr(stack.result);
+
+					double l = lhs->eval_number(c, stack);
+					xpath_node_set_raw rs = rhs->eval_node_set(c, stack, nodeset_eval_all);
+
+					for (const xpath_node* ri = rs.begin(); ri != rs.end(); ++ri)
+					{
+						xpath_allocator_capture cri(stack.result);
+
+						if (comp(l, convert_string_to_number(string_value(*ri, stack.result).c_str())))
+							return true;
+					}
+
+					return false;
+				}
+				else if (lt == xpath_type_string)
+				{
+					xpath_allocator_capture cr(stack.result);
+
+					xpath_string l = lhs->eval_string(c, stack);
+					xpath_node_set_raw rs = rhs->eval_node_set(c, stack, nodeset_eval_all);
+
+					for (const xpath_node* ri = rs.begin(); ri != rs.end(); ++ri)
+					{
+						xpath_allocator_capture cri(stack.result);
+
+						if (comp(l, string_value(*ri, stack.result)))
+							return true;
+					}
+
+					return false;
+				}
+			}
+
+			assert(false && "Wrong types"); // unreachable
+			return false;
+		}
+
+		static bool eval_once(xpath_node_set::type_t type, nodeset_eval_t eval)
+		{
+			return type == xpath_node_set::type_sorted ? eval != nodeset_eval_all : eval == nodeset_eval_any;
+		}
+
+		template <class Comp> static bool compare_rel(xpath_ast_node* lhs, xpath_ast_node* rhs, const xpath_context& c, const xpath_stack& stack, const Comp& comp)
+		{
+			xpath_value_type lt = lhs->rettype(), rt = rhs->rettype();
+
+			if (lt != xpath_type_node_set && rt != xpath_type_node_set)
+				return comp(lhs->eval_number(c, stack), rhs->eval_number(c, stack));
+			else if (lt == xpath_type_node_set && rt == xpath_type_node_set)
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				xpath_node_set_raw ls = lhs->eval_node_set(c, stack, nodeset_eval_all);
+				xpath_node_set_raw rs = rhs->eval_node_set(c, stack, nodeset_eval_all);
+
+				for (const xpath_node* li = ls.begin(); li != ls.end(); ++li)
+				{
+					xpath_allocator_capture cri(stack.result);
+
+					double l = convert_string_to_number(string_value(*li, stack.result).c_str());
+
+					for (const xpath_node* ri = rs.begin(); ri != rs.end(); ++ri)
+					{
+						xpath_allocator_capture crii(stack.result);
+
+						if (comp(l, convert_string_to_number(string_value(*ri, stack.result).c_str())))
+							return true;
+					}
+				}
+
+				return false;
+			}
+			else if (lt != xpath_type_node_set && rt == xpath_type_node_set)
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				double l = lhs->eval_number(c, stack);
+				xpath_node_set_raw rs = rhs->eval_node_set(c, stack, nodeset_eval_all);
+
+				for (const xpath_node* ri = rs.begin(); ri != rs.end(); ++ri)
+				{
+					xpath_allocator_capture cri(stack.result);
+
+					if (comp(l, convert_string_to_number(string_value(*ri, stack.result).c_str())))
+						return true;
+				}
+
+				return false;
+			}
+			else if (lt == xpath_type_node_set && rt != xpath_type_node_set)
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				xpath_node_set_raw ls = lhs->eval_node_set(c, stack, nodeset_eval_all);
+				double r = rhs->eval_number(c, stack);
+
+				for (const xpath_node* li = ls.begin(); li != ls.end(); ++li)
+				{
+					xpath_allocator_capture cri(stack.result);
+
+					if (comp(convert_string_to_number(string_value(*li, stack.result).c_str()), r))
+						return true;
+				}
+
+				return false;
+			}
+			else
+			{
+				assert(false && "Wrong types"); // unreachable
+				return false;
+			}
+		}
+
+		static void apply_predicate_boolean(xpath_node_set_raw& ns, size_t first, xpath_ast_node* expr, const xpath_stack& stack, bool once)
+		{
+			assert(ns.size() >= first);
+			assert(expr->rettype() != xpath_type_number);
+
+			size_t i = 1;
+			size_t size = ns.size() - first;
+
+			xpath_node* last = ns.begin() + first;
+
+			// remove_if... or well, sort of
+			for (xpath_node* it = last; it != ns.end(); ++it, ++i)
+			{
+				xpath_context c(*it, i, size);
+
+				if (expr->eval_boolean(c, stack))
+				{
+					*last++ = *it;
+
+					if (once) break;
+				}
+			}
+
+			ns.truncate(last);
+		}
+
+		static void apply_predicate_number(xpath_node_set_raw& ns, size_t first, xpath_ast_node* expr, const xpath_stack& stack, bool once)
+		{
+			assert(ns.size() >= first);
+			assert(expr->rettype() == xpath_type_number);
+
+			size_t i = 1;
+			size_t size = ns.size() - first;
+
+			xpath_node* last = ns.begin() + first;
+
+			// remove_if... or well, sort of
+			for (xpath_node* it = last; it != ns.end(); ++it, ++i)
+			{
+				xpath_context c(*it, i, size);
+
+				if (expr->eval_number(c, stack) == static_cast<double>(i))
+				{
+					*last++ = *it;
+
+					if (once) break;
+				}
+			}
+
+			ns.truncate(last);
+		}
+
+		static void apply_predicate_number_const(xpath_node_set_raw& ns, size_t first, xpath_ast_node* expr, const xpath_stack& stack)
+		{
+			assert(ns.size() >= first);
+			assert(expr->rettype() == xpath_type_number);
+
+			size_t size = ns.size() - first;
+
+			xpath_node* last = ns.begin() + first;
+
+			xpath_node cn;
+			xpath_context c(cn, 1, size);
+
+			double er = expr->eval_number(c, stack);
+
+			if (er >= 1.0 && er <= static_cast<double>(size))
+			{
+				size_t eri = static_cast<size_t>(er);
+
+				if (er == static_cast<double>(eri))
+				{
+					xpath_node r = last[eri - 1];
+
+					*last++ = r;
+				}
+			}
+
+			ns.truncate(last);
+		}
+
+		void apply_predicate(xpath_node_set_raw& ns, size_t first, const xpath_stack& stack, bool once)
+		{
+			if (ns.size() == first) return;
+
+			assert(_type == ast_filter || _type == ast_predicate);
+
+			if (_test == predicate_constant || _test == predicate_constant_one)
+				apply_predicate_number_const(ns, first, _right, stack);
+			else if (_right->rettype() == xpath_type_number)
+				apply_predicate_number(ns, first, _right, stack, once);
+			else
+				apply_predicate_boolean(ns, first, _right, stack, once);
+		}
+
+		void apply_predicates(xpath_node_set_raw& ns, size_t first, const xpath_stack& stack, nodeset_eval_t eval)
+		{
+			if (ns.size() == first) return;
+
+			bool last_once = eval_once(ns.type(), eval);
+
+			for (xpath_ast_node* pred = _right; pred; pred = pred->_next)
+				pred->apply_predicate(ns, first, stack, !pred->_next && last_once);
+		}
+
+		bool step_push(xpath_node_set_raw& ns, xml_attribute_struct* a, xml_node_struct* parent, xpath_allocator* alloc)
+		{
+			assert(a);
+
+			const char_t* name = a->name ? a->name + 0 : PUGIXML_TEXT("");
+
+			switch (_test)
+			{
+			case nodetest_name:
+				if (strequal(name, _data.nodetest) && is_xpath_attribute(name))
+				{
+					ns.push_back(xpath_node(xml_attribute(a), xml_node(parent)), alloc);
+					return true;
+				}
+				break;
+
+			case nodetest_type_node:
+			case nodetest_all:
+				if (is_xpath_attribute(name))
+				{
+					ns.push_back(xpath_node(xml_attribute(a), xml_node(parent)), alloc);
+					return true;
+				}
+				break;
+
+			case nodetest_all_in_namespace:
+				if (starts_with(name, _data.nodetest) && is_xpath_attribute(name))
+				{
+					ns.push_back(xpath_node(xml_attribute(a), xml_node(parent)), alloc);
+					return true;
+				}
+				break;
+
+			default:
+				;
+			}
+
+			return false;
+		}
+
+		bool step_push(xpath_node_set_raw& ns, xml_node_struct* n, xpath_allocator* alloc)
+		{
+			assert(n);
+
+			xml_node_type type = PUGI_IMPL_NODETYPE(n);
+
+			switch (_test)
+			{
+			case nodetest_name:
+				if (type == node_element && n->name && strequal(n->name, _data.nodetest))
+				{
+					ns.push_back(xml_node(n), alloc);
+					return true;
+				}
+				break;
+
+			case nodetest_type_node:
+				ns.push_back(xml_node(n), alloc);
+				return true;
+
+			case nodetest_type_comment:
+				if (type == node_comment)
+				{
+					ns.push_back(xml_node(n), alloc);
+					return true;
+				}
+				break;
+
+			case nodetest_type_text:
+				if (type == node_pcdata || type == node_cdata)
+				{
+					ns.push_back(xml_node(n), alloc);
+					return true;
+				}
+				break;
+
+			case nodetest_type_pi:
+				if (type == node_pi)
+				{
+					ns.push_back(xml_node(n), alloc);
+					return true;
+				}
+				break;
+
+			case nodetest_pi:
+				if (type == node_pi && n->name && strequal(n->name, _data.nodetest))
+				{
+					ns.push_back(xml_node(n), alloc);
+					return true;
+				}
+				break;
+
+			case nodetest_all:
+				if (type == node_element)
+				{
+					ns.push_back(xml_node(n), alloc);
+					return true;
+				}
+				break;
+
+			case nodetest_all_in_namespace:
+				if (type == node_element && n->name && starts_with(n->name, _data.nodetest))
+				{
+					ns.push_back(xml_node(n), alloc);
+					return true;
+				}
+				break;
+
+			default:
+				assert(false && "Unknown axis"); // unreachable
+			}
+
+			return false;
+		}
+
+		template <class T> void step_fill(xpath_node_set_raw& ns, xml_node_struct* n, xpath_allocator* alloc, bool once, T)
+		{
+			const axis_t axis = T::axis;
+
+			switch (axis)
+			{
+			case axis_attribute:
+			{
+				for (xml_attribute_struct* a = n->first_attribute; a; a = a->next_attribute)
+					if (step_push(ns, a, n, alloc) & once)
+						return;
+
+				break;
+			}
+
+			case axis_child:
+			{
+				for (xml_node_struct* c = n->first_child; c; c = c->next_sibling)
+					if (step_push(ns, c, alloc) & once)
+						return;
+
+				break;
+			}
+
+			case axis_descendant:
+			case axis_descendant_or_self:
+			{
+				if (axis == axis_descendant_or_self)
+					if (step_push(ns, n, alloc) & once)
+						return;
+
+				xml_node_struct* cur = n->first_child;
+
+				while (cur)
+				{
+					if (step_push(ns, cur, alloc) & once)
+						return;
+
+					if (cur->first_child)
+						cur = cur->first_child;
+					else
+					{
+						while (!cur->next_sibling)
+						{
+							cur = cur->parent;
+
+							if (cur == n) return;
+						}
+
+						cur = cur->next_sibling;
+					}
+				}
+
+				break;
+			}
+
+			case axis_following_sibling:
+			{
+				for (xml_node_struct* c = n->next_sibling; c; c = c->next_sibling)
+					if (step_push(ns, c, alloc) & once)
+						return;
+
+				break;
+			}
+
+			case axis_preceding_sibling:
+			{
+				for (xml_node_struct* c = n->prev_sibling_c; c->next_sibling; c = c->prev_sibling_c)
+					if (step_push(ns, c, alloc) & once)
+						return;
+
+				break;
+			}
+
+			case axis_following:
+			{
+				xml_node_struct* cur = n;
+
+				// exit from this node so that we don't include descendants
+				while (!cur->next_sibling)
+				{
+					cur = cur->parent;
+
+					if (!cur) return;
+				}
+
+				cur = cur->next_sibling;
+
+				while (cur)
+				{
+					if (step_push(ns, cur, alloc) & once)
+						return;
+
+					if (cur->first_child)
+						cur = cur->first_child;
+					else
+					{
+						while (!cur->next_sibling)
+						{
+							cur = cur->parent;
+
+							if (!cur) return;
+						}
+
+						cur = cur->next_sibling;
+					}
+				}
+
+				break;
+			}
+
+			case axis_preceding:
+			{
+				xml_node_struct* cur = n;
+
+				// exit from this node so that we don't include descendants
+				while (!cur->prev_sibling_c->next_sibling)
+				{
+					cur = cur->parent;
+
+					if (!cur) return;
+				}
+
+				cur = cur->prev_sibling_c;
+
+				while (cur)
+				{
+					if (cur->first_child)
+						cur = cur->first_child->prev_sibling_c;
+					else
+					{
+						// leaf node, can't be ancestor
+						if (step_push(ns, cur, alloc) & once)
+							return;
+
+						while (!cur->prev_sibling_c->next_sibling)
+						{
+							cur = cur->parent;
+
+							if (!cur) return;
+
+							if (!node_is_ancestor(cur, n))
+								if (step_push(ns, cur, alloc) & once)
+									return;
+						}
+
+						cur = cur->prev_sibling_c;
+					}
+				}
+
+				break;
+			}
+
+			case axis_ancestor:
+			case axis_ancestor_or_self:
+			{
+				if (axis == axis_ancestor_or_self)
+					if (step_push(ns, n, alloc) & once)
+						return;
+
+				xml_node_struct* cur = n->parent;
+
+				while (cur)
+				{
+					if (step_push(ns, cur, alloc) & once)
+						return;
+
+					cur = cur->parent;
+				}
+
+				break;
+			}
+
+			case axis_self:
+			{
+				step_push(ns, n, alloc);
+
+				break;
+			}
+
+			case axis_parent:
+			{
+				if (n->parent)
+					step_push(ns, n->parent, alloc);
+
+				break;
+			}
+
+			default:
+				assert(false && "Unimplemented axis"); // unreachable
+			}
+		}
+
+		template <class T> void step_fill(xpath_node_set_raw& ns, xml_attribute_struct* a, xml_node_struct* p, xpath_allocator* alloc, bool once, T v)
+		{
+			const axis_t axis = T::axis;
+
+			switch (axis)
+			{
+			case axis_ancestor:
+			case axis_ancestor_or_self:
+			{
+				if (axis == axis_ancestor_or_self && _test == nodetest_type_node) // reject attributes based on principal node type test
+					if (step_push(ns, a, p, alloc) & once)
+						return;
+
+				xml_node_struct* cur = p;
+
+				while (cur)
+				{
+					if (step_push(ns, cur, alloc) & once)
+						return;
+
+					cur = cur->parent;
+				}
+
+				break;
+			}
+
+			case axis_descendant_or_self:
+			case axis_self:
+			{
+				if (_test == nodetest_type_node) // reject attributes based on principal node type test
+					step_push(ns, a, p, alloc);
+
+				break;
+			}
+
+			case axis_following:
+			{
+				xml_node_struct* cur = p;
+
+				while (cur)
+				{
+					if (cur->first_child)
+						cur = cur->first_child;
+					else
+					{
+						while (!cur->next_sibling)
+						{
+							cur = cur->parent;
+
+							if (!cur) return;
+						}
+
+						cur = cur->next_sibling;
+					}
+
+					if (step_push(ns, cur, alloc) & once)
+						return;
+				}
+
+				break;
+			}
+
+			case axis_parent:
+			{
+				step_push(ns, p, alloc);
+
+				break;
+			}
+
+			case axis_preceding:
+			{
+				// preceding:: axis does not include attribute nodes and attribute ancestors (they are the same as parent's ancestors), so we can reuse node preceding
+				step_fill(ns, p, alloc, once, v);
+				break;
+			}
+
+			default:
+				assert(false && "Unimplemented axis"); // unreachable
+			}
+		}
+
+		template <class T> void step_fill(xpath_node_set_raw& ns, const xpath_node& xn, xpath_allocator* alloc, bool once, T v)
+		{
+			const axis_t axis = T::axis;
+			const bool axis_has_attributes = (axis == axis_ancestor || axis == axis_ancestor_or_self || axis == axis_descendant_or_self || axis == axis_following || axis == axis_parent || axis == axis_preceding || axis == axis_self);
+
+			if (xn.node())
+				step_fill(ns, xn.node().internal_object(), alloc, once, v);
+			else if (axis_has_attributes && xn.attribute() && xn.parent())
+				step_fill(ns, xn.attribute().internal_object(), xn.parent().internal_object(), alloc, once, v);
+		}
+
+		template <class T> xpath_node_set_raw step_do(const xpath_context& c, const xpath_stack& stack, nodeset_eval_t eval, T v)
+		{
+			const axis_t axis = T::axis;
+			const bool axis_reverse = (axis == axis_ancestor || axis == axis_ancestor_or_self || axis == axis_preceding || axis == axis_preceding_sibling);
+			const xpath_node_set::type_t axis_type = axis_reverse ? xpath_node_set::type_sorted_reverse : xpath_node_set::type_sorted;
+
+			bool once =
+				(axis == axis_attribute && _test == nodetest_name) ||
+				(!_right && eval_once(axis_type, eval)) ||
+			    // coverity[mixed_enums]
+				(_right && !_right->_next && _right->_test == predicate_constant_one);
+
+			xpath_node_set_raw ns;
+			ns.set_type(axis_type);
+
+			if (_left)
+			{
+				xpath_node_set_raw s = _left->eval_node_set(c, stack, nodeset_eval_all);
+
+				// self axis preserves the original order
+				if (axis == axis_self) ns.set_type(s.type());
+
+				for (const xpath_node* it = s.begin(); it != s.end(); ++it)
+				{
+					size_t size = ns.size();
+
+					// in general, all axes generate elements in a particular order, but there is no order guarantee if axis is applied to two nodes
+					if (axis != axis_self && size != 0) ns.set_type(xpath_node_set::type_unsorted);
+
+					step_fill(ns, *it, stack.result, once, v);
+					if (_right) apply_predicates(ns, size, stack, eval);
+				}
+			}
+			else
+			{
+				step_fill(ns, c.n, stack.result, once, v);
+				if (_right) apply_predicates(ns, 0, stack, eval);
+			}
+
+			// child, attribute and self axes always generate unique set of nodes
+			// for other axis, if the set stayed sorted, it stayed unique because the traversal algorithms do not visit the same node twice
+			if (axis != axis_child && axis != axis_attribute && axis != axis_self && ns.type() == xpath_node_set::type_unsorted)
+				ns.remove_duplicates(stack.temp);
+
+			return ns;
+		}
+
+	public:
+		xpath_ast_node(ast_type_t type, xpath_value_type rettype_, const char_t* value):
+			_type(static_cast<char>(type)), _rettype(static_cast<char>(rettype_)), _axis(0), _test(0), _left(NULL), _right(NULL), _next(NULL)
+		{
+			assert(type == ast_string_constant);
+			_data.string = value;
+		}
+
+		xpath_ast_node(ast_type_t type, xpath_value_type rettype_, double value):
+			_type(static_cast<char>(type)), _rettype(static_cast<char>(rettype_)), _axis(0), _test(0), _left(NULL), _right(NULL), _next(NULL)
+		{
+			assert(type == ast_number_constant);
+			_data.number = value;
+		}
+
+		xpath_ast_node(ast_type_t type, xpath_value_type rettype_, xpath_variable* value):
+			_type(static_cast<char>(type)), _rettype(static_cast<char>(rettype_)), _axis(0), _test(0), _left(NULL), _right(NULL), _next(NULL)
+		{
+			assert(type == ast_variable);
+			_data.variable = value;
+		}
+
+		xpath_ast_node(ast_type_t type, xpath_value_type rettype_, xpath_ast_node* left = NULL, xpath_ast_node* right = NULL):
+			_type(static_cast<char>(type)), _rettype(static_cast<char>(rettype_)), _axis(0), _test(0), _left(left), _right(right), _next(NULL)
+		{
+		}
+
+		xpath_ast_node(ast_type_t type, xpath_ast_node* left, axis_t axis, nodetest_t test, const char_t* contents):
+			_type(static_cast<char>(type)), _rettype(xpath_type_node_set), _axis(static_cast<char>(axis)), _test(static_cast<char>(test)), _left(left), _right(NULL), _next(NULL)
+		{
+			assert(type == ast_step);
+			_data.nodetest = contents;
+		}
+
+		xpath_ast_node(ast_type_t type, xpath_ast_node* left, xpath_ast_node* right, predicate_t test):
+			_type(static_cast<char>(type)), _rettype(xpath_type_node_set), _axis(0), _test(static_cast<char>(test)), _left(left), _right(right), _next(NULL)
+		{
+			assert(type == ast_filter || type == ast_predicate);
+		}
+
+		void set_next(xpath_ast_node* value)
+		{
+			_next = value;
+		}
+
+		void set_right(xpath_ast_node* value)
+		{
+			_right = value;
+		}
+
+		bool eval_boolean(const xpath_context& c, const xpath_stack& stack)
+		{
+			switch (_type)
+			{
+			case ast_op_or:
+				return _left->eval_boolean(c, stack) || _right->eval_boolean(c, stack);
+
+			case ast_op_and:
+				return _left->eval_boolean(c, stack) && _right->eval_boolean(c, stack);
+
+			case ast_op_equal:
+				return compare_eq(_left, _right, c, stack, equal_to());
+
+			case ast_op_not_equal:
+				return compare_eq(_left, _right, c, stack, not_equal_to());
+
+			case ast_op_less:
+				return compare_rel(_left, _right, c, stack, less());
+
+			case ast_op_greater:
+				return compare_rel(_right, _left, c, stack, less());
+
+			case ast_op_less_or_equal:
+				return compare_rel(_left, _right, c, stack, less_equal());
+
+			case ast_op_greater_or_equal:
+				return compare_rel(_right, _left, c, stack, less_equal());
+
+			case ast_func_starts_with:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				xpath_string lr = _left->eval_string(c, stack);
+				xpath_string rr = _right->eval_string(c, stack);
+
+				return starts_with(lr.c_str(), rr.c_str());
+			}
+
+			case ast_func_contains:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				xpath_string lr = _left->eval_string(c, stack);
+				xpath_string rr = _right->eval_string(c, stack);
+
+				return find_substring(lr.c_str(), rr.c_str()) != NULL;
+			}
+
+			case ast_func_boolean:
+				return _left->eval_boolean(c, stack);
+
+			case ast_func_not:
+				return !_left->eval_boolean(c, stack);
+
+			case ast_func_true:
+				return true;
+
+			case ast_func_false:
+				return false;
+
+			case ast_func_lang:
+			{
+				if (c.n.attribute()) return false;
+
+				xpath_allocator_capture cr(stack.result);
+
+				xpath_string lang = _left->eval_string(c, stack);
+
+				for (xml_node n = c.n.node(); n; n = n.parent())
+				{
+					xml_attribute a = n.attribute(PUGIXML_TEXT("xml:lang"));
+
+					if (a)
+					{
+						const char_t* value = a.value();
+
+						// strnicmp / strncasecmp is not portable
+						for (const char_t* lit = lang.c_str(); *lit; ++lit)
+						{
+							if (tolower_ascii(*lit) != tolower_ascii(*value)) return false;
+							++value;
+						}
+
+						return *value == 0 || *value == '-';
+					}
+				}
+
+				return false;
+			}
+
+			case ast_opt_compare_attribute:
+			{
+				const char_t* value = (_right->_type == ast_string_constant) ? _right->_data.string : _right->_data.variable->get_string();
+
+				xml_attribute attr = c.n.node().attribute(_left->_data.nodetest);
+
+				return attr && strequal(attr.value(), value) && is_xpath_attribute(attr.name());
+			}
+
+			case ast_variable:
+			{
+				assert(_rettype == _data.variable->type());
+
+				if (_rettype == xpath_type_boolean)
+					return _data.variable->get_boolean();
+
+				// variable needs to be converted to the correct type, this is handled by the fallthrough block below
+				break;
+			}
+
+			default:
+				;
+			}
+
+			// none of the ast types that return the value directly matched, we need to perform type conversion
+			switch (_rettype)
+			{
+			case xpath_type_number:
+				return convert_number_to_boolean(eval_number(c, stack));
+
+			case xpath_type_string:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				return !eval_string(c, stack).empty();
+			}
+
+			case xpath_type_node_set:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				return !eval_node_set(c, stack, nodeset_eval_any).empty();
+			}
+
+			default:
+				assert(false && "Wrong expression for return type boolean"); // unreachable
+				return false;
+			}
+		}
+
+		double eval_number(const xpath_context& c, const xpath_stack& stack)
+		{
+			switch (_type)
+			{
+			case ast_op_add:
+				return _left->eval_number(c, stack) + _right->eval_number(c, stack);
+
+			case ast_op_subtract:
+				return _left->eval_number(c, stack) - _right->eval_number(c, stack);
+
+			case ast_op_multiply:
+				return _left->eval_number(c, stack) * _right->eval_number(c, stack);
+
+			case ast_op_divide:
+				return _left->eval_number(c, stack) / _right->eval_number(c, stack);
+
+			case ast_op_mod:
+				return fmod(_left->eval_number(c, stack), _right->eval_number(c, stack));
+
+			case ast_op_negate:
+				return -_left->eval_number(c, stack);
+
+			case ast_number_constant:
+				return _data.number;
+
+			case ast_func_last:
+				return static_cast<double>(c.size);
+
+			case ast_func_position:
+				return static_cast<double>(c.position);
+
+			case ast_func_count:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				return static_cast<double>(_left->eval_node_set(c, stack, nodeset_eval_all).size());
+			}
+
+			case ast_func_string_length_0:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				return static_cast<double>(string_value(c.n, stack.result).length());
+			}
+
+			case ast_func_string_length_1:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				return static_cast<double>(_left->eval_string(c, stack).length());
+			}
+
+			case ast_func_number_0:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				return convert_string_to_number(string_value(c.n, stack.result).c_str());
+			}
+
+			case ast_func_number_1:
+				return _left->eval_number(c, stack);
+
+			case ast_func_sum:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				double r = 0;
+
+				xpath_node_set_raw ns = _left->eval_node_set(c, stack, nodeset_eval_all);
+
+				for (const xpath_node* it = ns.begin(); it != ns.end(); ++it)
+				{
+					xpath_allocator_capture cri(stack.result);
+
+					r += convert_string_to_number(string_value(*it, stack.result).c_str());
+				}
+
+				return r;
+			}
+
+			case ast_func_floor:
+			{
+				double r = _left->eval_number(c, stack);
+
+				return r == r ? floor(r) : r;
+			}
+
+			case ast_func_ceiling:
+			{
+				double r = _left->eval_number(c, stack);
+
+				return r == r ? ceil(r) : r;
+			}
+
+			case ast_func_round:
+				return round_nearest_nzero(_left->eval_number(c, stack));
+
+			case ast_variable:
+			{
+				assert(_rettype == _data.variable->type());
+
+				if (_rettype == xpath_type_number)
+					return _data.variable->get_number();
+
+				// variable needs to be converted to the correct type, this is handled by the fallthrough block below
+				break;
+			}
+
+			default:
+				;
+			}
+
+			// none of the ast types that return the value directly matched, we need to perform type conversion
+			switch (_rettype)
+			{
+			case xpath_type_boolean:
+				return eval_boolean(c, stack) ? 1 : 0;
+
+			case xpath_type_string:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				return convert_string_to_number(eval_string(c, stack).c_str());
+			}
+
+			case xpath_type_node_set:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				return convert_string_to_number(eval_string(c, stack).c_str());
+			}
+
+			default:
+				assert(false && "Wrong expression for return type number"); // unreachable
+				return 0;
+			}
+		}
+
+		xpath_string eval_string_concat(const xpath_context& c, const xpath_stack& stack)
+		{
+			assert(_type == ast_func_concat);
+
+			xpath_allocator_capture ct(stack.temp);
+
+			// count the string number
+			size_t count = 1;
+			for (xpath_ast_node* nc = _right; nc; nc = nc->_next) count++;
+
+			// allocate a buffer for temporary string objects
+			xpath_string* buffer = static_cast<xpath_string*>(stack.temp->allocate(count * sizeof(xpath_string)));
+			if (!buffer) return xpath_string();
+
+			// evaluate all strings to temporary stack
+			xpath_stack swapped_stack = {stack.temp, stack.result};
+
+			buffer[0] = _left->eval_string(c, swapped_stack);
+
+			size_t pos = 1;
+			for (xpath_ast_node* n = _right; n; n = n->_next, ++pos) buffer[pos] = n->eval_string(c, swapped_stack);
+			assert(pos == count);
+
+			// get total length
+			size_t length = 0;
+			for (size_t i = 0; i < count; ++i) length += buffer[i].length();
+
+			// create final string
+			char_t* result = static_cast<char_t*>(stack.result->allocate((length + 1) * sizeof(char_t)));
+			if (!result) return xpath_string();
+
+			char_t* ri = result;
+
+			for (size_t j = 0; j < count; ++j)
+				for (const char_t* bi = buffer[j].c_str(); *bi; ++bi)
+					*ri++ = *bi;
+
+			*ri = 0;
+
+			return xpath_string::from_heap_preallocated(result, ri);
+		}
+
+		xpath_string eval_string(const xpath_context& c, const xpath_stack& stack)
+		{
+			switch (_type)
+			{
+			case ast_string_constant:
+				return xpath_string::from_const(_data.string);
+
+			case ast_func_local_name_0:
+			{
+				xpath_node na = c.n;
+
+				return xpath_string::from_const(local_name(na));
+			}
+
+			case ast_func_local_name_1:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				xpath_node_set_raw ns = _left->eval_node_set(c, stack, nodeset_eval_first);
+				xpath_node na = ns.first();
+
+				return xpath_string::from_const(local_name(na));
+			}
+
+			case ast_func_name_0:
+			{
+				xpath_node na = c.n;
+
+				return xpath_string::from_const(qualified_name(na));
+			}
+
+			case ast_func_name_1:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				xpath_node_set_raw ns = _left->eval_node_set(c, stack, nodeset_eval_first);
+				xpath_node na = ns.first();
+
+				return xpath_string::from_const(qualified_name(na));
+			}
+
+			case ast_func_namespace_uri_0:
+			{
+				xpath_node na = c.n;
+
+				return xpath_string::from_const(namespace_uri(na));
+			}
+
+			case ast_func_namespace_uri_1:
+			{
+				xpath_allocator_capture cr(stack.result);
+
+				xpath_node_set_raw ns = _left->eval_node_set(c, stack, nodeset_eval_first);
+				xpath_node na = ns.first();
+
+				return xpath_string::from_const(namespace_uri(na));
+			}
+
+			case ast_func_string_0:
+				return string_value(c.n, stack.result);
+
+			case ast_func_string_1:
+				return _left->eval_string(c, stack);
+
+			case ast_func_concat:
+				return eval_string_concat(c, stack);
+
+			case ast_func_substring_before:
+			{
+				xpath_allocator_capture cr(stack.temp);
+
+				xpath_stack swapped_stack = {stack.temp, stack.result};
+
+				xpath_string s = _left->eval_string(c, swapped_stack);
+				xpath_string p = _right->eval_string(c, swapped_stack);
+
+				const char_t* pos = find_substring(s.c_str(), p.c_str());
+
+				return pos ? xpath_string::from_heap(s.c_str(), pos, stack.result) : xpath_string();
+			}
+
+			case ast_func_substring_after:
+			{
+				xpath_allocator_capture cr(stack.temp);
+
+				xpath_stack swapped_stack = {stack.temp, stack.result};
+
+				xpath_string s = _left->eval_string(c, swapped_stack);
+				xpath_string p = _right->eval_string(c, swapped_stack);
+
+				const char_t* pos = find_substring(s.c_str(), p.c_str());
+				if (!pos) return xpath_string();
+
+				const char_t* rbegin = pos + p.length();
+				const char_t* rend = s.c_str() + s.length();
+
+				return s.uses_heap() ? xpath_string::from_heap(rbegin, rend, stack.result) : xpath_string::from_const(rbegin);
+			}
+
+			case ast_func_substring_2:
+			{
+				xpath_allocator_capture cr(stack.temp);
+
+				xpath_stack swapped_stack = {stack.temp, stack.result};
+
+				xpath_string s = _left->eval_string(c, swapped_stack);
+				size_t s_length = s.length();
+
+				double first = round_nearest(_right->eval_number(c, stack));
+
+				if (is_nan(first)) return xpath_string(); // NaN
+				else if (first >= static_cast<double>(s_length + 1)) return xpath_string();
+
+				size_t pos = first < 1 ? 1 : static_cast<size_t>(first);
+				assert(1 <= pos && pos <= s_length + 1);
+
+				const char_t* rbegin = s.c_str() + (pos - 1);
+				const char_t* rend = s.c_str() + s.length();
+
+				return s.uses_heap() ? xpath_string::from_heap(rbegin, rend, stack.result) : xpath_string::from_const(rbegin);
+			}
+
+			case ast_func_substring_3:
+			{
+				xpath_allocator_capture cr(stack.temp);
+
+				xpath_stack swapped_stack = {stack.temp, stack.result};
+
+				xpath_string s = _left->eval_string(c, swapped_stack);
+				size_t s_length = s.length();
+
+				double first = round_nearest(_right->eval_number(c, stack));
+				double last = first + round_nearest(_right->_next->eval_number(c, stack));
+
+				if (is_nan(first) || is_nan(last)) return xpath_string();
+				else if (first >= static_cast<double>(s_length + 1)) return xpath_string();
+				else if (first >= last) return xpath_string();
+				else if (last < 1) return xpath_string();
+
+				size_t pos = first < 1 ? 1 : static_cast<size_t>(first);
+				size_t end = last >= static_cast<double>(s_length + 1) ? s_length + 1 : static_cast<size_t>(last);
+
+				assert(1 <= pos && pos <= end && end <= s_length + 1);
+				const char_t* rbegin = s.c_str() + (pos - 1);
+				const char_t* rend = s.c_str() + (end - 1);
+
+				return (end == s_length + 1 && !s.uses_heap()) ? xpath_string::from_const(rbegin) : xpath_string::from_heap(rbegin, rend, stack.result);
+			}
+
+			case ast_func_normalize_space_0:
+			{
+				xpath_string s = string_value(c.n, stack.result);
+
+				char_t* begin = s.data(stack.result);
+				if (!begin) return xpath_string();
+
+				char_t* end = normalize_space(begin);
+
+				return xpath_string::from_heap_preallocated(begin, end);
+			}
+
+			case ast_func_normalize_space_1:
+			{
+				xpath_string s = _left->eval_string(c, stack);
+
+				char_t* begin = s.data(stack.result);
+				if (!begin) return xpath_string();
+
+				char_t* end = normalize_space(begin);
+
+				return xpath_string::from_heap_preallocated(begin, end);
+			}
+
+			case ast_func_translate:
+			{
+				xpath_allocator_capture cr(stack.temp);
+
+				xpath_stack swapped_stack = {stack.temp, stack.result};
+
+				xpath_string s = _left->eval_string(c, stack);
+				xpath_string from = _right->eval_string(c, swapped_stack);
+				xpath_string to = _right->_next->eval_string(c, swapped_stack);
+
+				char_t* begin = s.data(stack.result);
+				if (!begin) return xpath_string();
+
+				char_t* end = translate(begin, from.c_str(), to.c_str(), to.length());
+
+				return xpath_string::from_heap_preallocated(begin, end);
+			}
+
+			case ast_opt_translate_table:
+			{
+				xpath_string s = _left->eval_string(c, stack);
+
+				char_t* begin = s.data(stack.result);
+				if (!begin) return xpath_string();
+
+				char_t* end = translate_table(begin, _data.table);
+
+				return xpath_string::from_heap_preallocated(begin, end);
+			}
+
+			case ast_variable:
+			{
+				assert(_rettype == _data.variable->type());
+
+				if (_rettype == xpath_type_string)
+					return xpath_string::from_const(_data.variable->get_string());
+
+				// variable needs to be converted to the correct type, this is handled by the fallthrough block below
+				break;
+			}
+
+			default:
+				;
+			}
+
+			// none of the ast types that return the value directly matched, we need to perform type conversion
+			switch (_rettype)
+			{
+			case xpath_type_boolean:
+				return xpath_string::from_const(eval_boolean(c, stack) ? PUGIXML_TEXT("true") : PUGIXML_TEXT("false"));
+
+			case xpath_type_number:
+				return convert_number_to_string(eval_number(c, stack), stack.result);
+
+			case xpath_type_node_set:
+			{
+				xpath_allocator_capture cr(stack.temp);
+
+				xpath_stack swapped_stack = {stack.temp, stack.result};
+
+				xpath_node_set_raw ns = eval_node_set(c, swapped_stack, nodeset_eval_first);
+				return ns.empty() ? xpath_string() : string_value(ns.first(), stack.result);
+			}
+
+			default:
+				assert(false && "Wrong expression for return type string"); // unreachable
+				return xpath_string();
+			}
+		}
+
+		xpath_node_set_raw eval_node_set(const xpath_context& c, const xpath_stack& stack, nodeset_eval_t eval)
+		{
+			switch (_type)
+			{
+			case ast_op_union:
+			{
+				xpath_allocator_capture cr(stack.temp);
+
+				xpath_stack swapped_stack = {stack.temp, stack.result};
+
+				xpath_node_set_raw ls = _left->eval_node_set(c, stack, eval);
+				xpath_node_set_raw rs = _right->eval_node_set(c, swapped_stack, eval);
+
+				// we can optimize merging two sorted sets, but this is a very rare operation, so don't bother
+				ls.set_type(xpath_node_set::type_unsorted);
+
+				ls.append(rs.begin(), rs.end(), stack.result);
+				ls.remove_duplicates(stack.temp);
+
+				return ls;
+			}
+
+			case ast_filter:
+			{
+				xpath_node_set_raw set = _left->eval_node_set(c, stack, _test == predicate_constant_one ? nodeset_eval_first : nodeset_eval_all);
+
+				// either expression is a number or it contains position() call; sort by document order
+				if (_test != predicate_posinv) set.sort_do();
+
+				bool once = eval_once(set.type(), eval);
+
+				apply_predicate(set, 0, stack, once);
+
+				return set;
+			}
+
+			case ast_func_id:
+				return xpath_node_set_raw();
+
+			case ast_step:
+			{
+				switch (_axis)
+				{
+				case axis_ancestor:
+					return step_do(c, stack, eval, axis_to_type<axis_ancestor>());
+
+				case axis_ancestor_or_self:
+					return step_do(c, stack, eval, axis_to_type<axis_ancestor_or_self>());
+
+				case axis_attribute:
+					return step_do(c, stack, eval, axis_to_type<axis_attribute>());
+
+				case axis_child:
+					return step_do(c, stack, eval, axis_to_type<axis_child>());
+
+				case axis_descendant:
+					return step_do(c, stack, eval, axis_to_type<axis_descendant>());
+
+				case axis_descendant_or_self:
+					return step_do(c, stack, eval, axis_to_type<axis_descendant_or_self>());
+
+				case axis_following:
+					return step_do(c, stack, eval, axis_to_type<axis_following>());
+
+				case axis_following_sibling:
+					return step_do(c, stack, eval, axis_to_type<axis_following_sibling>());
+
+				case axis_namespace:
+					// namespaced axis is not supported
+					return xpath_node_set_raw();
+
+				case axis_parent:
+					return step_do(c, stack, eval, axis_to_type<axis_parent>());
+
+				case axis_preceding:
+					return step_do(c, stack, eval, axis_to_type<axis_preceding>());
+
+				case axis_preceding_sibling:
+					return step_do(c, stack, eval, axis_to_type<axis_preceding_sibling>());
+
+				case axis_self:
+					return step_do(c, stack, eval, axis_to_type<axis_self>());
+
+				default:
+					assert(false && "Unknown axis"); // unreachable
+					return xpath_node_set_raw();
+				}
+			}
+
+			case ast_step_root:
+			{
+				assert(!_right); // root step can't have any predicates
+
+				xpath_node_set_raw ns;
+
+				ns.set_type(xpath_node_set::type_sorted);
+
+				if (c.n.node()) ns.push_back(c.n.node().root(), stack.result);
+				else if (c.n.attribute()) ns.push_back(c.n.parent().root(), stack.result);
+
+				return ns;
+			}
+
+			case ast_variable:
+			{
+				assert(_rettype == _data.variable->type());
+
+				if (_rettype == xpath_type_node_set)
+				{
+					const xpath_node_set& s = _data.variable->get_node_set();
+
+					xpath_node_set_raw ns;
+
+					ns.set_type(s.type());
+					ns.append(s.begin(), s.end(), stack.result);
+
+					return ns;
+				}
+
+				// variable needs to be converted to the correct type, this is handled by the fallthrough block below
+				break;
+			}
+
+			default:
+				;
+			}
+
+			// none of the ast types that return the value directly matched, but conversions to node set are invalid
+			assert(false && "Wrong expression for return type node set"); // unreachable
+			return xpath_node_set_raw();
+		}
+
+		void optimize(xpath_allocator* alloc)
+		{
+			if (_left)
+				_left->optimize(alloc);
+
+			if (_right)
+				_right->optimize(alloc);
+
+			if (_next)
+				_next->optimize(alloc);
+
+			// coverity[var_deref_model]
+			optimize_self(alloc);
+		}
+
+		void optimize_self(xpath_allocator* alloc)
+		{
+			// Rewrite [position()=expr] with [expr]
+			// Note that this step has to go before classification to recognize [position()=1]
+			if ((_type == ast_filter || _type == ast_predicate) &&
+				_right && // workaround for clang static analyzer (_right is never null for ast_filter/ast_predicate)
+				_right->_type == ast_op_equal && _right->_left->_type == ast_func_position && _right->_right->_rettype == xpath_type_number)
+			{
+				_right = _right->_right;
+			}
+
+			// Classify filter/predicate ops to perform various optimizations during evaluation
+			if ((_type == ast_filter || _type == ast_predicate) && _right) // workaround for clang static analyzer (_right is never null for ast_filter/ast_predicate)
+			{
+				assert(_test == predicate_default);
+
+				if (_right->_type == ast_number_constant && _right->_data.number == 1.0)
+					_test = predicate_constant_one;
+				else if (_right->_rettype == xpath_type_number && (_right->_type == ast_number_constant || _right->_type == ast_variable || _right->_type == ast_func_last))
+					_test = predicate_constant;
+				else if (_right->_rettype != xpath_type_number && _right->is_posinv_expr())
+					_test = predicate_posinv;
+			}
+
+			// Rewrite descendant-or-self::node()/child::foo with descendant::foo
+			// The former is a full form of //foo, the latter is much faster since it executes the node test immediately
+			// Do a similar kind of rewrite for self/descendant/descendant-or-self axes
+			// Note that we only rewrite positionally invariant steps (//foo[1] != /descendant::foo[1])
+			if (_type == ast_step && (_axis == axis_child || _axis == axis_self || _axis == axis_descendant || _axis == axis_descendant_or_self) &&
+				_left && _left->_type == ast_step && _left->_axis == axis_descendant_or_self && _left->_test == nodetest_type_node && !_left->_right &&
+				is_posinv_step())
+			{
+				if (_axis == axis_child || _axis == axis_descendant)
+					_axis = axis_descendant;
+				else
+					_axis = axis_descendant_or_self;
+
+				_left = _left->_left;
+			}
+
+			// Use optimized lookup table implementation for translate() with constant arguments
+			if (_type == ast_func_translate &&
+				_right && // workaround for clang static analyzer (_right is never null for ast_func_translate)
+				_right->_type == ast_string_constant && _right->_next->_type == ast_string_constant)
+			{
+				unsigned char* table = translate_table_generate(alloc, _right->_data.string, _right->_next->_data.string);
+
+				if (table)
+				{
+					_type = ast_opt_translate_table;
+					_data.table = table;
+				}
+			}
+
+			// Use optimized path for @attr = 'value' or @attr = $value
+			if (_type == ast_op_equal &&
+				_left && _right && // workaround for clang static analyzer and Coverity (_left and _right are never null for ast_op_equal)
+                // coverity[mixed_enums]
+				_left->_type == ast_step && _left->_axis == axis_attribute && _left->_test == nodetest_name && !_left->_left && !_left->_right &&
+				(_right->_type == ast_string_constant || (_right->_type == ast_variable && _right->_rettype == xpath_type_string)))
+			{
+				_type = ast_opt_compare_attribute;
+			}
+		}
+
+		bool is_posinv_expr() const
+		{
+			switch (_type)
+			{
+			case ast_func_position:
+			case ast_func_last:
+				return false;
+
+			case ast_string_constant:
+			case ast_number_constant:
+			case ast_variable:
+				return true;
+
+			case ast_step:
+			case ast_step_root:
+				return true;
+
+			case ast_predicate:
+			case ast_filter:
+				return true;
+
+			default:
+				if (_left && !_left->is_posinv_expr()) return false;
+
+				for (xpath_ast_node* n = _right; n; n = n->_next)
+					if (!n->is_posinv_expr()) return false;
+
+				return true;
+			}
+		}
+
+		bool is_posinv_step() const
+		{
+			assert(_type == ast_step);
+
+			for (xpath_ast_node* n = _right; n; n = n->_next)
+			{
+				assert(n->_type == ast_predicate);
+
+				if (n->_test != predicate_posinv)
+					return false;
+			}
+
+			return true;
+		}
+
+		xpath_value_type rettype() const
+		{
+			return static_cast<xpath_value_type>(_rettype);
+		}
+	};
+
+	static const size_t xpath_ast_depth_limit =
+	#ifdef PUGIXML_XPATH_DEPTH_LIMIT
+		PUGIXML_XPATH_DEPTH_LIMIT
+	#else
+		1024
+	#endif
+		;
+
+	struct xpath_parser
+	{
+		xpath_allocator* _alloc;
+		xpath_lexer _lexer;
+
+		const char_t* _query;
+		xpath_variable_set* _variables;
+
+		xpath_parse_result* _result;
+
+		char_t _scratch[32];
+
+		size_t _depth;
+
+		xpath_ast_node* error(const char* message)
+		{
+			_result->error = message;
+			_result->offset = _lexer.current_pos() - _query;
+
+			return NULL;
+		}
+
+		xpath_ast_node* error_oom()
+		{
+			assert(_alloc->_error);
+			*_alloc->_error = true;
+
+			return NULL;
+		}
+
+		xpath_ast_node* error_rec()
+		{
+			return error("Exceeded maximum allowed query depth");
+		}
+
+		void* alloc_node()
+		{
+			return _alloc->allocate(sizeof(xpath_ast_node));
+		}
+
+		xpath_ast_node* alloc_node(ast_type_t type, xpath_value_type rettype, const char_t* value)
+		{
+			void* memory = alloc_node();
+			return memory ? new (memory) xpath_ast_node(type, rettype, value) : NULL;
+		}
+
+		xpath_ast_node* alloc_node(ast_type_t type, xpath_value_type rettype, double value)
+		{
+			void* memory = alloc_node();
+			return memory ? new (memory) xpath_ast_node(type, rettype, value) : NULL;
+		}
+
+		xpath_ast_node* alloc_node(ast_type_t type, xpath_value_type rettype, xpath_variable* value)
+		{
+			void* memory = alloc_node();
+			return memory ? new (memory) xpath_ast_node(type, rettype, value) : NULL;
+		}
+
+		xpath_ast_node* alloc_node(ast_type_t type, xpath_value_type rettype, xpath_ast_node* left = NULL, xpath_ast_node* right = NULL)
+		{
+			void* memory = alloc_node();
+			return memory ? new (memory) xpath_ast_node(type, rettype, left, right) : NULL;
+		}
+
+		xpath_ast_node* alloc_node(ast_type_t type, xpath_ast_node* left, axis_t axis, nodetest_t test, const char_t* contents)
+		{
+			void* memory = alloc_node();
+			return memory ? new (memory) xpath_ast_node(type, left, axis, test, contents) : NULL;
+		}
+
+		xpath_ast_node* alloc_node(ast_type_t type, xpath_ast_node* left, xpath_ast_node* right, predicate_t test)
+		{
+			void* memory = alloc_node();
+			return memory ? new (memory) xpath_ast_node(type, left, right, test) : NULL;
+		}
+
+		const char_t* alloc_string(const xpath_lexer_string& value)
+		{
+			if (!value.begin)
+				return PUGIXML_TEXT("");
+
+			size_t length = static_cast<size_t>(value.end - value.begin);
+
+			char_t* c = static_cast<char_t*>(_alloc->allocate((length + 1) * sizeof(char_t)));
+			if (!c) return NULL;
+
+			memcpy(c, value.begin, length * sizeof(char_t));
+			c[length] = 0;
+
+			return c;
+		}
+
+		xpath_ast_node* parse_function(const xpath_lexer_string& name, size_t argc, xpath_ast_node* args[2])
+		{
+			switch (name.begin[0])
+			{
+			case 'b':
+				if (name == PUGIXML_TEXT("boolean") && argc == 1)
+					return alloc_node(ast_func_boolean, xpath_type_boolean, args[0]);
+
+				break;
+
+			case 'c':
+				if (name == PUGIXML_TEXT("count") && argc == 1)
+				{
+					if (args[0]->rettype() != xpath_type_node_set) return error("Function has to be applied to node set");
+					return alloc_node(ast_func_count, xpath_type_number, args[0]);
+				}
+				else if (name == PUGIXML_TEXT("contains") && argc == 2)
+					return alloc_node(ast_func_contains, xpath_type_boolean, args[0], args[1]);
+				else if (name == PUGIXML_TEXT("concat") && argc >= 2)
+					return alloc_node(ast_func_concat, xpath_type_string, args[0], args[1]);
+				else if (name == PUGIXML_TEXT("ceiling") && argc == 1)
+					return alloc_node(ast_func_ceiling, xpath_type_number, args[0]);
+
+				break;
+
+			case 'f':
+				if (name == PUGIXML_TEXT("false") && argc == 0)
+					return alloc_node(ast_func_false, xpath_type_boolean);
+				else if (name == PUGIXML_TEXT("floor") && argc == 1)
+					return alloc_node(ast_func_floor, xpath_type_number, args[0]);
+
+				break;
+
+			case 'i':
+				if (name == PUGIXML_TEXT("id") && argc == 1)
+					return alloc_node(ast_func_id, xpath_type_node_set, args[0]);
+
+				break;
+
+			case 'l':
+				if (name == PUGIXML_TEXT("last") && argc == 0)
+					return alloc_node(ast_func_last, xpath_type_number);
+				else if (name == PUGIXML_TEXT("lang") && argc == 1)
+					return alloc_node(ast_func_lang, xpath_type_boolean, args[0]);
+				else if (name == PUGIXML_TEXT("local-name") && argc <= 1)
+				{
+					if (argc == 1 && args[0]->rettype() != xpath_type_node_set) return error("Function has to be applied to node set");
+					return alloc_node(argc == 0 ? ast_func_local_name_0 : ast_func_local_name_1, xpath_type_string, args[0]);
+				}
+
+				break;
+
+			case 'n':
+				if (name == PUGIXML_TEXT("name") && argc <= 1)
+				{
+					if (argc == 1 && args[0]->rettype() != xpath_type_node_set) return error("Function has to be applied to node set");
+					return alloc_node(argc == 0 ? ast_func_name_0 : ast_func_name_1, xpath_type_string, args[0]);
+				}
+				else if (name == PUGIXML_TEXT("namespace-uri") && argc <= 1)
+				{
+					if (argc == 1 && args[0]->rettype() != xpath_type_node_set) return error("Function has to be applied to node set");
+					return alloc_node(argc == 0 ? ast_func_namespace_uri_0 : ast_func_namespace_uri_1, xpath_type_string, args[0]);
+				}
+				else if (name == PUGIXML_TEXT("normalize-space") && argc <= 1)
+					return alloc_node(argc == 0 ? ast_func_normalize_space_0 : ast_func_normalize_space_1, xpath_type_string, args[0], args[1]);
+				else if (name == PUGIXML_TEXT("not") && argc == 1)
+					return alloc_node(ast_func_not, xpath_type_boolean, args[0]);
+				else if (name == PUGIXML_TEXT("number") && argc <= 1)
+					return alloc_node(argc == 0 ? ast_func_number_0 : ast_func_number_1, xpath_type_number, args[0]);
+
+				break;
+
+			case 'p':
+				if (name == PUGIXML_TEXT("position") && argc == 0)
+					return alloc_node(ast_func_position, xpath_type_number);
+
+				break;
+
+			case 'r':
+				if (name == PUGIXML_TEXT("round") && argc == 1)
+					return alloc_node(ast_func_round, xpath_type_number, args[0]);
+
+				break;
+
+			case 's':
+				if (name == PUGIXML_TEXT("string") && argc <= 1)
+					return alloc_node(argc == 0 ? ast_func_string_0 : ast_func_string_1, xpath_type_string, args[0]);
+				else if (name == PUGIXML_TEXT("string-length") && argc <= 1)
+					return alloc_node(argc == 0 ? ast_func_string_length_0 : ast_func_string_length_1, xpath_type_number, args[0]);
+				else if (name == PUGIXML_TEXT("starts-with") && argc == 2)
+					return alloc_node(ast_func_starts_with, xpath_type_boolean, args[0], args[1]);
+				else if (name == PUGIXML_TEXT("substring-before") && argc == 2)
+					return alloc_node(ast_func_substring_before, xpath_type_string, args[0], args[1]);
+				else if (name == PUGIXML_TEXT("substring-after") && argc == 2)
+					return alloc_node(ast_func_substring_after, xpath_type_string, args[0], args[1]);
+				else if (name == PUGIXML_TEXT("substring") && (argc == 2 || argc == 3))
+					return alloc_node(argc == 2 ? ast_func_substring_2 : ast_func_substring_3, xpath_type_string, args[0], args[1]);
+				else if (name == PUGIXML_TEXT("sum") && argc == 1)
+				{
+					if (args[0]->rettype() != xpath_type_node_set) return error("Function has to be applied to node set");
+					return alloc_node(ast_func_sum, xpath_type_number, args[0]);
+				}
+
+				break;
+
+			case 't':
+				if (name == PUGIXML_TEXT("translate") && argc == 3)
+					return alloc_node(ast_func_translate, xpath_type_string, args[0], args[1]);
+				else if (name == PUGIXML_TEXT("true") && argc == 0)
+					return alloc_node(ast_func_true, xpath_type_boolean);
+
+				break;
+
+			default:
+				break;
+			}
+
+			return error("Unrecognized function or wrong parameter count");
+		}
+
+		axis_t parse_axis_name(const xpath_lexer_string& name, bool& specified)
+		{
+			specified = true;
+
+			switch (name.begin[0])
+			{
+			case 'a':
+				if (name == PUGIXML_TEXT("ancestor"))
+					return axis_ancestor;
+				else if (name == PUGIXML_TEXT("ancestor-or-self"))
+					return axis_ancestor_or_self;
+				else if (name == PUGIXML_TEXT("attribute"))
+					return axis_attribute;
+
+				break;
+
+			case 'c':
+				if (name == PUGIXML_TEXT("child"))
+					return axis_child;
+
+				break;
+
+			case 'd':
+				if (name == PUGIXML_TEXT("descendant"))
+					return axis_descendant;
+				else if (name == PUGIXML_TEXT("descendant-or-self"))
+					return axis_descendant_or_self;
+
+				break;
+
+			case 'f':
+				if (name == PUGIXML_TEXT("following"))
+					return axis_following;
+				else if (name == PUGIXML_TEXT("following-sibling"))
+					return axis_following_sibling;
+
+				break;
+
+			case 'n':
+				if (name == PUGIXML_TEXT("namespace"))
+					return axis_namespace;
+
+				break;
+
+			case 'p':
+				if (name == PUGIXML_TEXT("parent"))
+					return axis_parent;
+				else if (name == PUGIXML_TEXT("preceding"))
+					return axis_preceding;
+				else if (name == PUGIXML_TEXT("preceding-sibling"))
+					return axis_preceding_sibling;
+
+				break;
+
+			case 's':
+				if (name == PUGIXML_TEXT("self"))
+					return axis_self;
+
+				break;
+
+			default:
+				break;
+			}
+
+			specified = false;
+			return axis_child;
+		}
+
+		nodetest_t parse_node_test_type(const xpath_lexer_string& name)
+		{
+			switch (name.begin[0])
+			{
+			case 'c':
+				if (name == PUGIXML_TEXT("comment"))
+					return nodetest_type_comment;
+
+				break;
+
+			case 'n':
+				if (name == PUGIXML_TEXT("node"))
+					return nodetest_type_node;
+
+				break;
+
+			case 'p':
+				if (name == PUGIXML_TEXT("processing-instruction"))
+					return nodetest_type_pi;
+
+				break;
+
+			case 't':
+				if (name == PUGIXML_TEXT("text"))
+					return nodetest_type_text;
+
+				break;
+
+			default:
+				break;
+			}
+
+			return nodetest_none;
+		}
+
+		// PrimaryExpr ::= VariableReference | '(' Expr ')' | Literal | Number | FunctionCall
+		xpath_ast_node* parse_primary_expression()
+		{
+			switch (_lexer.current())
+			{
+			case lex_var_ref:
+			{
+				xpath_lexer_string name = _lexer.contents();
+
+				if (!_variables)
+					return error("Unknown variable: variable set is not provided");
+
+				xpath_variable* var = NULL;
+				if (!get_variable_scratch(_scratch, _variables, name.begin, name.end, &var))
+					return error_oom();
+
+				if (!var)
+					return error("Unknown variable: variable set does not contain the given name");
+
+				_lexer.next();
+
+				return alloc_node(ast_variable, var->type(), var);
+			}
+
+			case lex_open_brace:
+			{
+				_lexer.next();
+
+				xpath_ast_node* n = parse_expression();
+				if (!n) return NULL;
+
+				if (_lexer.current() != lex_close_brace)
+					return error("Expected ')' to match an opening '('");
+
+				_lexer.next();
+
+				return n;
+			}
+
+			case lex_quoted_string:
+			{
+				const char_t* value = alloc_string(_lexer.contents());
+				if (!value) return NULL;
+
+				_lexer.next();
+
+				return alloc_node(ast_string_constant, xpath_type_string, value);
+			}
+
+			case lex_number:
+			{
+				double value = 0;
+
+				if (!convert_string_to_number_scratch(_scratch, _lexer.contents().begin, _lexer.contents().end, &value))
+					return error_oom();
+
+				_lexer.next();
+
+				return alloc_node(ast_number_constant, xpath_type_number, value);
+			}
+
+			case lex_string:
+			{
+				xpath_ast_node* args[2] = {NULL};
+				size_t argc = 0;
+
+				xpath_lexer_string function = _lexer.contents();
+				_lexer.next();
+
+				xpath_ast_node* last_arg = NULL;
+
+				if (_lexer.current() != lex_open_brace)
+					return error("Unrecognized function call");
+				_lexer.next();
+
+				size_t old_depth = _depth;
+
+				while (_lexer.current() != lex_close_brace)
+				{
+					if (argc > 0)
+					{
+						if (_lexer.current() != lex_comma)
+							return error("No comma between function arguments");
+						_lexer.next();
+					}
+
+					if (++_depth > xpath_ast_depth_limit)
+						return error_rec();
+
+					xpath_ast_node* n = parse_expression();
+					if (!n) return NULL;
+
+					if (argc < 2) args[argc] = n;
+					else last_arg->set_next(n);
+
+					argc++;
+					last_arg = n;
+				}
+
+				_lexer.next();
+
+				_depth = old_depth;
+
+				return parse_function(function, argc, args);
+			}
+
+			default:
+				return error("Unrecognizable primary expression");
+			}
+		}
+
+		// FilterExpr ::= PrimaryExpr | FilterExpr Predicate
+		// Predicate ::= '[' PredicateExpr ']'
+		// PredicateExpr ::= Expr
+		xpath_ast_node* parse_filter_expression()
+		{
+			xpath_ast_node* n = parse_primary_expression();
+			if (!n) return NULL;
+
+			size_t old_depth = _depth;
+
+			while (_lexer.current() == lex_open_square_brace)
+			{
+				_lexer.next();
+
+				if (++_depth > xpath_ast_depth_limit)
+					return error_rec();
+
+				if (n->rettype() != xpath_type_node_set)
+					return error("Predicate has to be applied to node set");
+
+				xpath_ast_node* expr = parse_expression();
+				if (!expr) return NULL;
+
+				n = alloc_node(ast_filter, n, expr, predicate_default);
+				if (!n) return NULL;
+
+				if (_lexer.current() != lex_close_square_brace)
+					return error("Expected ']' to match an opening '['");
+
+				_lexer.next();
+			}
+
+			_depth = old_depth;
+
+			return n;
+		}
+
+		// Step ::= AxisSpecifier NodeTest Predicate* | AbbreviatedStep
+		// AxisSpecifier ::= AxisName '::' | '@'?
+		// NodeTest ::= NameTest | NodeType '(' ')' | 'processing-instruction' '(' Literal ')'
+		// NameTest ::= '*' | NCName ':' '*' | QName
+		// AbbreviatedStep ::= '.' | '..'
+		xpath_ast_node* parse_step(xpath_ast_node* set)
+		{
+			if (set && set->rettype() != xpath_type_node_set)
+				return error("Step has to be applied to node set");
+
+			bool axis_specified = false;
+			axis_t axis = axis_child; // implied child axis
+
+			if (_lexer.current() == lex_axis_attribute)
+			{
+				axis = axis_attribute;
+				axis_specified = true;
+
+				_lexer.next();
+			}
+			else if (_lexer.current() == lex_dot)
+			{
+				_lexer.next();
+
+				if (_lexer.current() == lex_open_square_brace)
+					return error("Predicates are not allowed after an abbreviated step");
+
+				return alloc_node(ast_step, set, axis_self, nodetest_type_node, NULL);
+			}
+			else if (_lexer.current() == lex_double_dot)
+			{
+				_lexer.next();
+
+				if (_lexer.current() == lex_open_square_brace)
+					return error("Predicates are not allowed after an abbreviated step");
+
+				return alloc_node(ast_step, set, axis_parent, nodetest_type_node, NULL);
+			}
+
+			nodetest_t nt_type = nodetest_none;
+			xpath_lexer_string nt_name;
+
+			if (_lexer.current() == lex_string)
+			{
+				// node name test
+				nt_name = _lexer.contents();
+				_lexer.next();
+
+				// was it an axis name?
+				if (_lexer.current() == lex_double_colon)
+				{
+					// parse axis name
+					if (axis_specified)
+						return error("Two axis specifiers in one step");
+
+					axis = parse_axis_name(nt_name, axis_specified);
+
+					if (!axis_specified)
+						return error("Unknown axis");
+
+					// read actual node test
+					_lexer.next();
+
+					if (_lexer.current() == lex_multiply)
+					{
+						nt_type = nodetest_all;
+						nt_name = xpath_lexer_string();
+						_lexer.next();
+					}
+					else if (_lexer.current() == lex_string)
+					{
+						nt_name = _lexer.contents();
+						_lexer.next();
+					}
+					else
+					{
+						return error("Unrecognized node test");
+					}
+				}
+
+				if (nt_type == nodetest_none)
+				{
+					// node type test or processing-instruction
+					if (_lexer.current() == lex_open_brace)
+					{
+						_lexer.next();
+
+						if (_lexer.current() == lex_close_brace)
+						{
+							_lexer.next();
+
+							nt_type = parse_node_test_type(nt_name);
+
+							if (nt_type == nodetest_none)
+								return error("Unrecognized node type");
+
+							nt_name = xpath_lexer_string();
+						}
+						else if (nt_name == PUGIXML_TEXT("processing-instruction"))
+						{
+							if (_lexer.current() != lex_quoted_string)
+								return error("Only literals are allowed as arguments to processing-instruction()");
+
+							nt_type = nodetest_pi;
+							nt_name = _lexer.contents();
+							_lexer.next();
+
+							if (_lexer.current() != lex_close_brace)
+								return error("Unmatched brace near processing-instruction()");
+							_lexer.next();
+						}
+						else
+						{
+							return error("Unmatched brace near node type test");
+						}
+					}
+					// QName or NCName:*
+					else
+					{
+						if (nt_name.end - nt_name.begin > 2 && nt_name.end[-2] == ':' && nt_name.end[-1] == '*') // NCName:*
+						{
+							nt_name.end--; // erase *
+
+							nt_type = nodetest_all_in_namespace;
+						}
+						else
+						{
+							nt_type = nodetest_name;
+						}
+					}
+				}
+			}
+			else if (_lexer.current() == lex_multiply)
+			{
+				nt_type = nodetest_all;
+				_lexer.next();
+			}
+			else
+			{
+				return error("Unrecognized node test");
+			}
+
+			const char_t* nt_name_copy = alloc_string(nt_name);
+			if (!nt_name_copy) return NULL;
+
+			xpath_ast_node* n = alloc_node(ast_step, set, axis, nt_type, nt_name_copy);
+			if (!n) return NULL;
+
+			size_t old_depth = _depth;
+
+			xpath_ast_node* last = NULL;
+
+			while (_lexer.current() == lex_open_square_brace)
+			{
+				_lexer.next();
+
+				if (++_depth > xpath_ast_depth_limit)
+					return error_rec();
+
+				xpath_ast_node* expr = parse_expression();
+				if (!expr) return NULL;
+
+				xpath_ast_node* pred = alloc_node(ast_predicate, NULL, expr, predicate_default);
+				if (!pred) return NULL;
+
+				if (_lexer.current() != lex_close_square_brace)
+					return error("Expected ']' to match an opening '['");
+				_lexer.next();
+
+				if (last) last->set_next(pred);
+				else n->set_right(pred);
+
+				last = pred;
+			}
+
+			_depth = old_depth;
+
+			return n;
+		}
+
+		// RelativeLocationPath ::= Step | RelativeLocationPath '/' Step | RelativeLocationPath '//' Step
+		xpath_ast_node* parse_relative_location_path(xpath_ast_node* set)
+		{
+			xpath_ast_node* n = parse_step(set);
+			if (!n) return NULL;
+
+			size_t old_depth = _depth;
+
+			while (_lexer.current() == lex_slash || _lexer.current() == lex_double_slash)
+			{
+				lexeme_t l = _lexer.current();
+				_lexer.next();
+
+				if (l == lex_double_slash)
+				{
+					n = alloc_node(ast_step, n, axis_descendant_or_self, nodetest_type_node, NULL);
+					if (!n) return NULL;
+
+					++_depth;
+				}
+
+				if (++_depth > xpath_ast_depth_limit)
+					return error_rec();
+
+				n = parse_step(n);
+				if (!n) return NULL;
+			}
+
+			_depth = old_depth;
+
+			return n;
+		}
+
+		// LocationPath ::= RelativeLocationPath | AbsoluteLocationPath
+		// AbsoluteLocationPath ::= '/' RelativeLocationPath? | '//' RelativeLocationPath
+		xpath_ast_node* parse_location_path()
+		{
+			if (_lexer.current() == lex_slash)
+			{
+				_lexer.next();
+
+				xpath_ast_node* n = alloc_node(ast_step_root, xpath_type_node_set);
+				if (!n) return NULL;
+
+				// relative location path can start from axis_attribute, dot, double_dot, multiply and string lexemes; any other lexeme means standalone root path
+				lexeme_t l = _lexer.current();
+
+				if (l == lex_string || l == lex_axis_attribute || l == lex_dot || l == lex_double_dot || l == lex_multiply)
+					return parse_relative_location_path(n);
+				else
+					return n;
+			}
+			else if (_lexer.current() == lex_double_slash)
+			{
+				_lexer.next();
+
+				xpath_ast_node* n = alloc_node(ast_step_root, xpath_type_node_set);
+				if (!n) return NULL;
+
+				n = alloc_node(ast_step, n, axis_descendant_or_self, nodetest_type_node, NULL);
+				if (!n) return NULL;
+
+				return parse_relative_location_path(n);
+			}
+
+			// else clause moved outside of if because of bogus warning 'control may reach end of non-void function being inlined' in gcc 4.0.1
+			return parse_relative_location_path(NULL);
+		}
+
+		// PathExpr ::= LocationPath
+		//				| FilterExpr
+		//				| FilterExpr '/' RelativeLocationPath
+		//				| FilterExpr '//' RelativeLocationPath
+		// UnionExpr ::= PathExpr | UnionExpr '|' PathExpr
+		// UnaryExpr ::= UnionExpr | '-' UnaryExpr
+		xpath_ast_node* parse_path_or_unary_expression()
+		{
+			// Clarification.
+			// PathExpr begins with either LocationPath or FilterExpr.
+			// FilterExpr begins with PrimaryExpr
+			// PrimaryExpr begins with '$' in case of it being a variable reference,
+			// '(' in case of it being an expression, string literal, number constant or
+			// function call.
+			if (_lexer.current() == lex_var_ref || _lexer.current() == lex_open_brace ||
+				_lexer.current() == lex_quoted_string || _lexer.current() == lex_number ||
+				_lexer.current() == lex_string)
+			{
+				if (_lexer.current() == lex_string)
+				{
+					// This is either a function call, or not - if not, we shall proceed with location path
+					const char_t* state = _lexer.state();
+
+					while (PUGI_IMPL_IS_CHARTYPE(*state, ct_space)) ++state;
+
+					if (*state != '(')
+						return parse_location_path();
+
+					// This looks like a function call; however this still can be a node-test. Check it.
+					if (parse_node_test_type(_lexer.contents()) != nodetest_none)
+						return parse_location_path();
+				}
+
+				xpath_ast_node* n = parse_filter_expression();
+				if (!n) return NULL;
+
+				if (_lexer.current() == lex_slash || _lexer.current() == lex_double_slash)
+				{
+					lexeme_t l = _lexer.current();
+					_lexer.next();
+
+					if (l == lex_double_slash)
+					{
+						if (n->rettype() != xpath_type_node_set)
+							return error("Step has to be applied to node set");
+
+						n = alloc_node(ast_step, n, axis_descendant_or_self, nodetest_type_node, NULL);
+						if (!n) return NULL;
+					}
+
+					// select from location path
+					return parse_relative_location_path(n);
+				}
+
+				return n;
+			}
+			else if (_lexer.current() == lex_minus)
+			{
+				_lexer.next();
+
+				// precedence 7+ - only parses union expressions
+				xpath_ast_node* n = parse_expression(7);
+				if (!n) return NULL;
+
+				return alloc_node(ast_op_negate, xpath_type_number, n);
+			}
+			else
+			{
+				return parse_location_path();
+			}
+		}
+
+		struct binary_op_t
+		{
+			ast_type_t asttype;
+			xpath_value_type rettype;
+			int precedence;
+
+			binary_op_t(): asttype(ast_unknown), rettype(xpath_type_none), precedence(0)
+			{
+			}
+
+			binary_op_t(ast_type_t asttype_, xpath_value_type rettype_, int precedence_): asttype(asttype_), rettype(rettype_), precedence(precedence_)
+			{
+			}
+
+			static binary_op_t parse(xpath_lexer& lexer)
+			{
+				switch (lexer.current())
+				{
+				case lex_string:
+					if (lexer.contents() == PUGIXML_TEXT("or"))
+						return binary_op_t(ast_op_or, xpath_type_boolean, 1);
+					else if (lexer.contents() == PUGIXML_TEXT("and"))
+						return binary_op_t(ast_op_and, xpath_type_boolean, 2);
+					else if (lexer.contents() == PUGIXML_TEXT("div"))
+						return binary_op_t(ast_op_divide, xpath_type_number, 6);
+					else if (lexer.contents() == PUGIXML_TEXT("mod"))
+						return binary_op_t(ast_op_mod, xpath_type_number, 6);
+					else
+						return binary_op_t();
+
+				case lex_equal:
+					return binary_op_t(ast_op_equal, xpath_type_boolean, 3);
+
+				case lex_not_equal:
+					return binary_op_t(ast_op_not_equal, xpath_type_boolean, 3);
+
+				case lex_less:
+					return binary_op_t(ast_op_less, xpath_type_boolean, 4);
+
+				case lex_greater:
+					return binary_op_t(ast_op_greater, xpath_type_boolean, 4);
+
+				case lex_less_or_equal:
+					return binary_op_t(ast_op_less_or_equal, xpath_type_boolean, 4);
+
+				case lex_greater_or_equal:
+					return binary_op_t(ast_op_greater_or_equal, xpath_type_boolean, 4);
+
+				case lex_plus:
+					return binary_op_t(ast_op_add, xpath_type_number, 5);
+
+				case lex_minus:
+					return binary_op_t(ast_op_subtract, xpath_type_number, 5);
+
+				case lex_multiply:
+					return binary_op_t(ast_op_multiply, xpath_type_number, 6);
+
+				case lex_union:
+					return binary_op_t(ast_op_union, xpath_type_node_set, 7);
+
+				default:
+					return binary_op_t();
+				}
+			}
+		};
+
+		xpath_ast_node* parse_expression_rec(xpath_ast_node* lhs, int limit)
+		{
+			binary_op_t op = binary_op_t::parse(_lexer);
+
+			while (op.asttype != ast_unknown && op.precedence >= limit)
+			{
+				_lexer.next();
+
+				if (++_depth > xpath_ast_depth_limit)
+					return error_rec();
+
+				xpath_ast_node* rhs = parse_path_or_unary_expression();
+				if (!rhs) return NULL;
+
+				binary_op_t nextop = binary_op_t::parse(_lexer);
+
+				while (nextop.asttype != ast_unknown && nextop.precedence > op.precedence)
+				{
+					rhs = parse_expression_rec(rhs, nextop.precedence);
+					if (!rhs) return NULL;
+
+					nextop = binary_op_t::parse(_lexer);
+				}
+
+				if (op.asttype == ast_op_union && (lhs->rettype() != xpath_type_node_set || rhs->rettype() != xpath_type_node_set))
+					return error("Union operator has to be applied to node sets");
+
+				lhs = alloc_node(op.asttype, op.rettype, lhs, rhs);
+				if (!lhs) return NULL;
+
+				op = binary_op_t::parse(_lexer);
+			}
+
+			return lhs;
+		}
+
+		// Expr ::= OrExpr
+		// OrExpr ::= AndExpr | OrExpr 'or' AndExpr
+		// AndExpr ::= EqualityExpr | AndExpr 'and' EqualityExpr
+		// EqualityExpr ::= RelationalExpr
+		//					| EqualityExpr '=' RelationalExpr
+		//					| EqualityExpr '!=' RelationalExpr
+		// RelationalExpr ::= AdditiveExpr
+		//					  | RelationalExpr '<' AdditiveExpr
+		//					  | RelationalExpr '>' AdditiveExpr
+		//					  | RelationalExpr '<=' AdditiveExpr
+		//					  | RelationalExpr '>=' AdditiveExpr
+		// AdditiveExpr ::= MultiplicativeExpr
+		//					| AdditiveExpr '+' MultiplicativeExpr
+		//					| AdditiveExpr '-' MultiplicativeExpr
+		// MultiplicativeExpr ::= UnaryExpr
+		//						  | MultiplicativeExpr '*' UnaryExpr
+		//						  | MultiplicativeExpr 'div' UnaryExpr
+		//						  | MultiplicativeExpr 'mod' UnaryExpr
+		xpath_ast_node* parse_expression(int limit = 0)
+		{
+			size_t old_depth = _depth;
+
+			if (++_depth > xpath_ast_depth_limit)
+				return error_rec();
+
+			xpath_ast_node* n = parse_path_or_unary_expression();
+			if (!n) return NULL;
+
+			n = parse_expression_rec(n, limit);
+
+			_depth = old_depth;
+
+			return n;
+		}
+
+		xpath_parser(const char_t* query, xpath_variable_set* variables, xpath_allocator* alloc, xpath_parse_result* result): _alloc(alloc), _lexer(query), _query(query), _variables(variables), _result(result), _depth(0)
+		{
+		}
+
+		xpath_ast_node* parse()
+		{
+			xpath_ast_node* n = parse_expression();
+			if (!n) return NULL;
+
+			assert(_depth == 0);
+
+			// check if there are unparsed tokens left
+			if (_lexer.current() != lex_eof)
+				return error("Incorrect query");
+
+			return n;
+		}
+
+		static xpath_ast_node* parse(const char_t* query, xpath_variable_set* variables, xpath_allocator* alloc, xpath_parse_result* result)
+		{
+			xpath_parser parser(query, variables, alloc, result);
+
+			return parser.parse();
+		}
+	};
+
+	struct xpath_query_impl
+	{
+		static xpath_query_impl* create()
+		{
+			void* memory = xml_memory::allocate(sizeof(xpath_query_impl));
+			if (!memory) return NULL;
+
+			return new (memory) xpath_query_impl();
+		}
+
+		static void destroy(xpath_query_impl* impl)
+		{
+			// free all allocated pages
+			impl->alloc.release();
+
+			// free allocator memory (with the first page)
+			xml_memory::deallocate(impl);
+		}
+
+		xpath_query_impl(): root(NULL), alloc(&block, &oom), oom(false)
+		{
+			block.next = NULL;
+			block.capacity = sizeof(block.data);
+		}
+
+		xpath_ast_node* root;
+		xpath_allocator alloc;
+		xpath_memory_block block;
+		bool oom;
+	};
+
+	PUGI_IMPL_FN impl::xpath_ast_node* evaluate_node_set_prepare(xpath_query_impl* impl)
+	{
+		if (!impl) return NULL;
+
+		if (impl->root->rettype() != xpath_type_node_set)
+		{
+		#ifdef PUGIXML_NO_EXCEPTIONS
+			return 0;
+		#else
+			xpath_parse_result res;
+			res.error = "Expression does not evaluate to node set";
+
+			throw xpath_exception(res);
+		#endif
+		}
+
+		return impl->root;
+	}
+PUGI_IMPL_NS_END
+
+namespace pugi
+{
+#ifndef PUGIXML_NO_EXCEPTIONS
+	PUGI_IMPL_FN xpath_exception::xpath_exception(const xpath_parse_result& result_): _result(result_)
+	{
+		assert(_result.error);
+	}
+
+	PUGI_IMPL_FN const char* xpath_exception::what() const PUGIXML_NOEXCEPT
+	{
+		return _result.error;
+	}
+
+	PUGI_IMPL_FN const xpath_parse_result& xpath_exception::result() const
+	{
+		return _result;
+	}
+#endif
+
+	PUGI_IMPL_FN xpath_node::xpath_node()
+	{
+	}
+
+	PUGI_IMPL_FN xpath_node::xpath_node(const xml_node& node_): _node(node_)
+	{
+	}
+
+	PUGI_IMPL_FN xpath_node::xpath_node(const xml_attribute& attribute_, const xml_node& parent_): _node(attribute_ ? parent_ : xml_node()), _attribute(attribute_)
+	{
+	}
+
+	PUGI_IMPL_FN xml_node xpath_node::node() const
+	{
+		return _attribute ? xml_node() : _node;
+	}
+
+	PUGI_IMPL_FN xml_attribute xpath_node::attribute() const
+	{
+		return _attribute;
+	}
+
+	PUGI_IMPL_FN xml_node xpath_node::parent() const
+	{
+		return _attribute ? _node : _node.parent();
+	}
+
+	PUGI_IMPL_FN static void unspecified_bool_xpath_node(xpath_node***)
+	{
+	}
+
+	PUGI_IMPL_FN xpath_node::operator xpath_node::unspecified_bool_type() const
+	{
+		return (_node || _attribute) ? unspecified_bool_xpath_node : NULL;
+	}
+
+	PUGI_IMPL_FN bool xpath_node::operator!() const
+	{
+		return !(_node || _attribute);
+	}
+
+	PUGI_IMPL_FN bool xpath_node::operator==(const xpath_node& n) const
+	{
+		return _node == n._node && _attribute == n._attribute;
+	}
+
+	PUGI_IMPL_FN bool xpath_node::operator!=(const xpath_node& n) const
+	{
+		return _node != n._node || _attribute != n._attribute;
+	}
+
+#ifdef __BORLANDC__
+	PUGI_IMPL_FN bool operator&&(const xpath_node& lhs, bool rhs)
+	{
+		return (bool)lhs && rhs;
+	}
+
+	PUGI_IMPL_FN bool operator||(const xpath_node& lhs, bool rhs)
+	{
+		return (bool)lhs || rhs;
+	}
+#endif
+
+	PUGI_IMPL_FN void xpath_node_set::_assign(const_iterator begin_, const_iterator end_, type_t type_)
+	{
+		assert(begin_ <= end_);
+
+		size_t size_ = static_cast<size_t>(end_ - begin_);
+
+		// use internal buffer for 0 or 1 elements, heap buffer otherwise
+		xpath_node* storage = (size_ <= 1) ? _storage : static_cast<xpath_node*>(impl::xml_memory::allocate(size_ * sizeof(xpath_node)));
+
+		if (!storage)
+		{
+		#ifdef PUGIXML_NO_EXCEPTIONS
+			return;
+		#else
+			throw std::bad_alloc();
+		#endif
+		}
+
+		// deallocate old buffer
+		if (_begin != _storage)
+			impl::xml_memory::deallocate(_begin);
+
+		// size check is necessary because for begin_ = end_ = nullptr, memcpy is UB
+		if (size_)
+			memcpy(storage, begin_, size_ * sizeof(xpath_node));
+
+		_begin = storage;
+		_end = storage + size_;
+		_type = type_;
+	}
+
+#ifdef PUGIXML_HAS_MOVE
+	PUGI_IMPL_FN void xpath_node_set::_move(xpath_node_set& rhs) PUGIXML_NOEXCEPT
+	{
+		_type = rhs._type;
+		_storage[0] = rhs._storage[0];
+		_begin = (rhs._begin == rhs._storage) ? _storage : rhs._begin;
+		_end = _begin + (rhs._end - rhs._begin);
+
+		rhs._type = type_unsorted;
+		rhs._begin = rhs._storage;
+		rhs._end = rhs._storage;
+	}
+#endif
+
+	PUGI_IMPL_FN xpath_node_set::xpath_node_set(): _type(type_unsorted), _begin(_storage), _end(_storage)
+	{
+	}
+
+	PUGI_IMPL_FN xpath_node_set::xpath_node_set(const_iterator begin_, const_iterator end_, type_t type_): _type(type_unsorted), _begin(_storage), _end(_storage)
+	{
+		_assign(begin_, end_, type_);
+	}
+
+	PUGI_IMPL_FN xpath_node_set::~xpath_node_set()
+	{
+		if (_begin != _storage)
+			impl::xml_memory::deallocate(_begin);
+	}
+
+	PUGI_IMPL_FN xpath_node_set::xpath_node_set(const xpath_node_set& ns): _type(type_unsorted), _begin(_storage), _end(_storage)
+	{
+		_assign(ns._begin, ns._end, ns._type);
+	}
+
+	PUGI_IMPL_FN xpath_node_set& xpath_node_set::operator=(const xpath_node_set& ns)
+	{
+		if (this == &ns) return *this;
+
+		_assign(ns._begin, ns._end, ns._type);
+
+		return *this;
+	}
+
+#ifdef PUGIXML_HAS_MOVE
+	PUGI_IMPL_FN xpath_node_set::xpath_node_set(xpath_node_set&& rhs) PUGIXML_NOEXCEPT: _type(type_unsorted), _begin(_storage), _end(_storage)
+	{
+		_move(rhs);
+	}
+
+	PUGI_IMPL_FN xpath_node_set& xpath_node_set::operator=(xpath_node_set&& rhs) PUGIXML_NOEXCEPT
+	{
+		if (this == &rhs) return *this;
+
+		if (_begin != _storage)
+			impl::xml_memory::deallocate(_begin);
+
+		_move(rhs);
+
+		return *this;
+	}
+#endif
+
+	PUGI_IMPL_FN xpath_node_set::type_t xpath_node_set::type() const
+	{
+		return _type;
+	}
+
+	PUGI_IMPL_FN size_t xpath_node_set::size() const
+	{
+		return _end - _begin;
+	}
+
+	PUGI_IMPL_FN bool xpath_node_set::empty() const
+	{
+		return _begin == _end;
+	}
+
+	PUGI_IMPL_FN const xpath_node& xpath_node_set::operator[](size_t index) const
+	{
+		assert(index < size());
+		return _begin[index];
+	}
+
+	PUGI_IMPL_FN xpath_node_set::const_iterator xpath_node_set::begin() const
+	{
+		return _begin;
+	}
+
+	PUGI_IMPL_FN xpath_node_set::const_iterator xpath_node_set::end() const
+	{
+		return _end;
+	}
+
+	PUGI_IMPL_FN void xpath_node_set::sort(bool reverse)
+	{
+		_type = impl::xpath_sort(_begin, _end, _type, reverse);
+	}
+
+	PUGI_IMPL_FN xpath_node xpath_node_set::first() const
+	{
+		return impl::xpath_first(_begin, _end, _type);
+	}
+
+	PUGI_IMPL_FN xpath_parse_result::xpath_parse_result(): error("Internal error"), offset(0)
+	{
+	}
+
+	PUGI_IMPL_FN xpath_parse_result::operator bool() const
+	{
+		return error == NULL;
+	}
+
+	PUGI_IMPL_FN const char* xpath_parse_result::description() const
+	{
+		return error ? error : "No error";
+	}
+
+	PUGI_IMPL_FN xpath_variable::xpath_variable(xpath_value_type type_): _type(type_), _next(NULL)
+	{
+	}
+
+	PUGI_IMPL_FN const char_t* xpath_variable::name() const
+	{
+		switch (_type)
+		{
+		case xpath_type_node_set:
+			return static_cast<const impl::xpath_variable_node_set*>(this)->name;
+
+		case xpath_type_number:
+			return static_cast<const impl::xpath_variable_number*>(this)->name;
+
+		case xpath_type_string:
+			return static_cast<const impl::xpath_variable_string*>(this)->name;
+
+		case xpath_type_boolean:
+			return static_cast<const impl::xpath_variable_boolean*>(this)->name;
+
+		default:
+			assert(false && "Invalid variable type"); // unreachable
+			return NULL;
+		}
+	}
+
+	PUGI_IMPL_FN xpath_value_type xpath_variable::type() const
+	{
+		return _type;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable::get_boolean() const
+	{
+		return (_type == xpath_type_boolean) ? static_cast<const impl::xpath_variable_boolean*>(this)->value : false;
+	}
+
+	PUGI_IMPL_FN double xpath_variable::get_number() const
+	{
+		return (_type == xpath_type_number) ? static_cast<const impl::xpath_variable_number*>(this)->value : impl::gen_nan();
+	}
+
+	PUGI_IMPL_FN const char_t* xpath_variable::get_string() const
+	{
+		const char_t* value = (_type == xpath_type_string) ? static_cast<const impl::xpath_variable_string*>(this)->value : NULL;
+		return value ? value : PUGIXML_TEXT("");
+	}
+
+	PUGI_IMPL_FN const xpath_node_set& xpath_variable::get_node_set() const
+	{
+		return (_type == xpath_type_node_set) ? static_cast<const impl::xpath_variable_node_set*>(this)->value : impl::dummy_node_set;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable::set(bool value)
+	{
+		if (_type != xpath_type_boolean) return false;
+
+		static_cast<impl::xpath_variable_boolean*>(this)->value = value;
+		return true;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable::set(double value)
+	{
+		if (_type != xpath_type_number) return false;
+
+		static_cast<impl::xpath_variable_number*>(this)->value = value;
+		return true;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable::set(const char_t* value)
+	{
+		if (_type != xpath_type_string) return false;
+
+		impl::xpath_variable_string* var = static_cast<impl::xpath_variable_string*>(this);
+
+		// duplicate string
+		size_t size = (impl::strlength(value) + 1) * sizeof(char_t);
+
+		char_t* copy = static_cast<char_t*>(impl::xml_memory::allocate(size));
+		if (!copy) return false;
+
+		memcpy(copy, value, size);
+
+		// replace old string
+		if (var->value) impl::xml_memory::deallocate(var->value);
+		var->value = copy;
+
+		return true;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable::set(const xpath_node_set& value)
+	{
+		if (_type != xpath_type_node_set) return false;
+
+		static_cast<impl::xpath_variable_node_set*>(this)->value = value;
+		return true;
+	}
+
+	PUGI_IMPL_FN xpath_variable_set::xpath_variable_set()
+	{
+		for (size_t i = 0; i < sizeof(_data) / sizeof(_data[0]); ++i)
+			_data[i] = NULL;
+	}
+
+	PUGI_IMPL_FN xpath_variable_set::~xpath_variable_set()
+	{
+		for (size_t i = 0; i < sizeof(_data) / sizeof(_data[0]); ++i)
+			_destroy(_data[i]);
+	}
+
+	PUGI_IMPL_FN xpath_variable_set::xpath_variable_set(const xpath_variable_set& rhs)
+	{
+		for (size_t i = 0; i < sizeof(_data) / sizeof(_data[0]); ++i)
+			_data[i] = NULL;
+
+		_assign(rhs);
+	}
+
+	PUGI_IMPL_FN xpath_variable_set& xpath_variable_set::operator=(const xpath_variable_set& rhs)
+	{
+		if (this == &rhs) return *this;
+
+		_assign(rhs);
+
+		return *this;
+	}
+
+#ifdef PUGIXML_HAS_MOVE
+	PUGI_IMPL_FN xpath_variable_set::xpath_variable_set(xpath_variable_set&& rhs) PUGIXML_NOEXCEPT
+	{
+		for (size_t i = 0; i < sizeof(_data) / sizeof(_data[0]); ++i)
+		{
+			_data[i] = rhs._data[i];
+			rhs._data[i] = NULL;
+		}
+	}
+
+	PUGI_IMPL_FN xpath_variable_set& xpath_variable_set::operator=(xpath_variable_set&& rhs) PUGIXML_NOEXCEPT
+	{
+		for (size_t i = 0; i < sizeof(_data) / sizeof(_data[0]); ++i)
+		{
+			_destroy(_data[i]);
+
+			_data[i] = rhs._data[i];
+			rhs._data[i] = NULL;
+		}
+
+		return *this;
+	}
+#endif
+
+	PUGI_IMPL_FN void xpath_variable_set::_assign(const xpath_variable_set& rhs)
+	{
+		xpath_variable_set temp;
+
+		for (size_t i = 0; i < sizeof(_data) / sizeof(_data[0]); ++i)
+			if (rhs._data[i] && !_clone(rhs._data[i], &temp._data[i]))
+				return;
+
+		_swap(temp);
+	}
+
+	PUGI_IMPL_FN void xpath_variable_set::_swap(xpath_variable_set& rhs)
+	{
+		for (size_t i = 0; i < sizeof(_data) / sizeof(_data[0]); ++i)
+		{
+			xpath_variable* chain = _data[i];
+
+			_data[i] = rhs._data[i];
+			rhs._data[i] = chain;
+		}
+	}
+
+	PUGI_IMPL_FN xpath_variable* xpath_variable_set::_find(const char_t* name) const
+	{
+		const size_t hash_size = sizeof(_data) / sizeof(_data[0]);
+		size_t hash = impl::hash_string(name) % hash_size;
+
+		// look for existing variable
+		for (xpath_variable* var = _data[hash]; var; var = var->_next)
+			if (impl::strequal(var->name(), name))
+				return var;
+
+		return NULL;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable_set::_clone(xpath_variable* var, xpath_variable** out_result)
+	{
+		xpath_variable* last = NULL;
+
+		while (var)
+		{
+			// allocate storage for new variable
+			xpath_variable* nvar = impl::new_xpath_variable(var->_type, var->name());
+			if (!nvar) return false;
+
+			// link the variable to the result immediately to handle failures gracefully
+			if (last)
+				last->_next = nvar;
+			else
+				*out_result = nvar;
+
+			last = nvar;
+
+			// copy the value; this can fail due to out-of-memory conditions
+			if (!impl::copy_xpath_variable(nvar, var)) return false;
+
+			var = var->_next;
+		}
+
+		return true;
+	}
+
+	PUGI_IMPL_FN void xpath_variable_set::_destroy(xpath_variable* var)
+	{
+		while (var)
+		{
+			xpath_variable* next = var->_next;
+
+			impl::delete_xpath_variable(var->_type, var);
+
+			var = next;
+		}
+	}
+
+	PUGI_IMPL_FN xpath_variable* xpath_variable_set::add(const char_t* name, xpath_value_type type)
+	{
+		const size_t hash_size = sizeof(_data) / sizeof(_data[0]);
+		size_t hash = impl::hash_string(name) % hash_size;
+
+		// look for existing variable
+		for (xpath_variable* var = _data[hash]; var; var = var->_next)
+			if (impl::strequal(var->name(), name))
+				return var->type() == type ? var : NULL;
+
+		// add new variable
+		xpath_variable* result = impl::new_xpath_variable(type, name);
+
+		if (result)
+		{
+			result->_next = _data[hash];
+
+			_data[hash] = result;
+		}
+
+		return result;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable_set::set(const char_t* name, bool value)
+	{
+		xpath_variable* var = add(name, xpath_type_boolean);
+		return var ? var->set(value) : false;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable_set::set(const char_t* name, double value)
+	{
+		xpath_variable* var = add(name, xpath_type_number);
+		return var ? var->set(value) : false;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable_set::set(const char_t* name, const char_t* value)
+	{
+		xpath_variable* var = add(name, xpath_type_string);
+		return var ? var->set(value) : false;
+	}
+
+	PUGI_IMPL_FN bool xpath_variable_set::set(const char_t* name, const xpath_node_set& value)
+	{
+		xpath_variable* var = add(name, xpath_type_node_set);
+		return var ? var->set(value) : false;
+	}
+
+	PUGI_IMPL_FN xpath_variable* xpath_variable_set::get(const char_t* name)
+	{
+		return _find(name);
+	}
+
+	PUGI_IMPL_FN const xpath_variable* xpath_variable_set::get(const char_t* name) const
+	{
+		return _find(name);
+	}
+
+	PUGI_IMPL_FN xpath_query::xpath_query(const char_t* query, xpath_variable_set* variables): _impl(NULL)
+	{
+		impl::xpath_query_impl* qimpl = impl::xpath_query_impl::create();
+
+		if (!qimpl)
+		{
+		#ifdef PUGIXML_NO_EXCEPTIONS
+			_result.error = "Out of memory";
+		#else
+			throw std::bad_alloc();
+		#endif
+		}
+		else
+		{
+			using impl::auto_deleter; // MSVC7 workaround
+			auto_deleter<impl::xpath_query_impl> impl(qimpl, impl::xpath_query_impl::destroy);
+
+			qimpl->root = impl::xpath_parser::parse(query, variables, &qimpl->alloc, &_result);
+
+			if (qimpl->root)
+			{
+				qimpl->root->optimize(&qimpl->alloc);
+
+				_impl = impl.release();
+				_result.error = NULL;
+			}
+			else
+			{
+			#ifdef PUGIXML_NO_EXCEPTIONS
+				if (qimpl->oom) _result.error = "Out of memory";
+			#else
+				if (qimpl->oom) throw std::bad_alloc();
+				throw xpath_exception(_result);
+			#endif
+			}
+		}
+	}
+
+	PUGI_IMPL_FN xpath_query::xpath_query(): _impl(NULL)
+	{
+	}
+
+	PUGI_IMPL_FN xpath_query::~xpath_query()
+	{
+		if (_impl)
+			impl::xpath_query_impl::destroy(static_cast<impl::xpath_query_impl*>(_impl));
+	}
+
+#ifdef PUGIXML_HAS_MOVE
+	PUGI_IMPL_FN xpath_query::xpath_query(xpath_query&& rhs) PUGIXML_NOEXCEPT
+	{
+		_impl = rhs._impl;
+		_result = rhs._result;
+		rhs._impl = NULL;
+		rhs._result = xpath_parse_result();
+	}
+
+	PUGI_IMPL_FN xpath_query& xpath_query::operator=(xpath_query&& rhs) PUGIXML_NOEXCEPT
+	{
+		if (this == &rhs) return *this;
+
+		if (_impl)
+			impl::xpath_query_impl::destroy(static_cast<impl::xpath_query_impl*>(_impl));
+
+		_impl = rhs._impl;
+		_result = rhs._result;
+		rhs._impl = NULL;
+		rhs._result = xpath_parse_result();
+
+		return *this;
+	}
+#endif
+
+	PUGI_IMPL_FN xpath_value_type xpath_query::return_type() const
+	{
+		if (!_impl) return xpath_type_none;
+
+		return static_cast<impl::xpath_query_impl*>(_impl)->root->rettype();
+	}
+
+	PUGI_IMPL_FN bool xpath_query::evaluate_boolean(const xpath_node& n) const
+	{
+		if (!_impl) return false;
+
+		impl::xpath_context c(n, 1, 1);
+		impl::xpath_stack_data sd;
+
+		bool r = static_cast<impl::xpath_query_impl*>(_impl)->root->eval_boolean(c, sd.stack);
+
+		if (sd.oom)
+		{
+		#ifdef PUGIXML_NO_EXCEPTIONS
+			return false;
+		#else
+			throw std::bad_alloc();
+		#endif
+		}
+
+		return r;
+	}
+
+	PUGI_IMPL_FN double xpath_query::evaluate_number(const xpath_node& n) const
+	{
+		if (!_impl) return impl::gen_nan();
+
+		impl::xpath_context c(n, 1, 1);
+		impl::xpath_stack_data sd;
+
+		double r = static_cast<impl::xpath_query_impl*>(_impl)->root->eval_number(c, sd.stack);
+
+		if (sd.oom)
+		{
+		#ifdef PUGIXML_NO_EXCEPTIONS
+			return impl::gen_nan();
+		#else
+			throw std::bad_alloc();
+		#endif
+		}
+
+		return r;
+	}
+
+#ifndef PUGIXML_NO_STL
+	PUGI_IMPL_FN string_t xpath_query::evaluate_string(const xpath_node& n) const
+	{
+		if (!_impl) return string_t();
+
+		impl::xpath_context c(n, 1, 1);
+		impl::xpath_stack_data sd;
+
+		impl::xpath_string r = static_cast<impl::xpath_query_impl*>(_impl)->root->eval_string(c, sd.stack);
+
+		if (sd.oom)
+		{
+		#ifdef PUGIXML_NO_EXCEPTIONS
+			return string_t();
+		#else
+			throw std::bad_alloc();
+		#endif
+		}
+
+		return string_t(r.c_str(), r.length());
+	}
+#endif
+
+	PUGI_IMPL_FN size_t xpath_query::evaluate_string(char_t* buffer, size_t capacity, const xpath_node& n) const
+	{
+		impl::xpath_context c(n, 1, 1);
+		impl::xpath_stack_data sd;
+
+		impl::xpath_string r = _impl ? static_cast<impl::xpath_query_impl*>(_impl)->root->eval_string(c, sd.stack) : impl::xpath_string();
+
+		if (sd.oom)
+		{
+		#ifdef PUGIXML_NO_EXCEPTIONS
+			r = impl::xpath_string();
+		#else
+			throw std::bad_alloc();
+		#endif
+		}
+
+		size_t full_size = r.length() + 1;
+
+		if (capacity > 0)
+		{
+			size_t size = (full_size < capacity) ? full_size : capacity;
+			assert(size > 0);
+
+			memcpy(buffer, r.c_str(), (size - 1) * sizeof(char_t));
+			buffer[size - 1] = 0;
+		}
+
+		return full_size;
+	}
+
+	PUGI_IMPL_FN xpath_node_set xpath_query::evaluate_node_set(const xpath_node& n) const
+	{
+		impl::xpath_ast_node* root = impl::evaluate_node_set_prepare(static_cast<impl::xpath_query_impl*>(_impl));
+		if (!root) return xpath_node_set();
+
+		impl::xpath_context c(n, 1, 1);
+		impl::xpath_stack_data sd;
+
+		impl::xpath_node_set_raw r = root->eval_node_set(c, sd.stack, impl::nodeset_eval_all);
+
+		if (sd.oom)
+		{
+		#ifdef PUGIXML_NO_EXCEPTIONS
+			return xpath_node_set();
+		#else
+			throw std::bad_alloc();
+		#endif
+		}
+
+		return xpath_node_set(r.begin(), r.end(), r.type());
+	}
+
+	PUGI_IMPL_FN xpath_node xpath_query::evaluate_node(const xpath_node& n) const
+	{
+		impl::xpath_ast_node* root = impl::evaluate_node_set_prepare(static_cast<impl::xpath_query_impl*>(_impl));
+		if (!root) return xpath_node();
+
+		impl::xpath_context c(n, 1, 1);
+		impl::xpath_stack_data sd;
+
+		impl::xpath_node_set_raw r = root->eval_node_set(c, sd.stack, impl::nodeset_eval_first);
+
+		if (sd.oom)
+		{
+		#ifdef PUGIXML_NO_EXCEPTIONS
+			return xpath_node();
+		#else
+			throw std::bad_alloc();
+		#endif
+		}
+
+		return r.first();
+	}
+
+	PUGI_IMPL_FN const xpath_parse_result& xpath_query::result() const
+	{
+		return _result;
+	}
+
+	PUGI_IMPL_FN static void unspecified_bool_xpath_query(xpath_query***)
+	{
+	}
+
+	PUGI_IMPL_FN xpath_query::operator xpath_query::unspecified_bool_type() const
+	{
+		return _impl ? unspecified_bool_xpath_query : NULL;
+	}
+
+	PUGI_IMPL_FN bool xpath_query::operator!() const
+	{
+		return !_impl;
+	}
+
+	PUGI_IMPL_FN xpath_node xml_node::select_node(const char_t* query, xpath_variable_set* variables) const
+	{
+		xpath_query q(query, variables);
+		return q.evaluate_node(*this);
+	}
+
+	PUGI_IMPL_FN xpath_node xml_node::select_node(const xpath_query& query) const
+	{
+		return query.evaluate_node(*this);
+	}
+
+	PUGI_IMPL_FN xpath_node_set xml_node::select_nodes(const char_t* query, xpath_variable_set* variables) const
+	{
+		xpath_query q(query, variables);
+		return q.evaluate_node_set(*this);
+	}
+
+	PUGI_IMPL_FN xpath_node_set xml_node::select_nodes(const xpath_query& query) const
+	{
+		return query.evaluate_node_set(*this);
+	}
+
+	PUGI_IMPL_FN xpath_node xml_node::select_single_node(const char_t* query, xpath_variable_set* variables) const
+	{
+		xpath_query q(query, variables);
+		return q.evaluate_node(*this);
+	}
+
+	PUGI_IMPL_FN xpath_node xml_node::select_single_node(const xpath_query& query) const
+	{
+		return query.evaluate_node(*this);
+	}
+}
+
+#endif
+
+#ifdef __BORLANDC__
+#	pragma option pop
+#endif
+
+#if defined(_MSC_VER) && defined(__c2__)
+#	pragma clang diagnostic pop
+#endif
+
+#if defined(__clang__)
+#	pragma clang diagnostic pop
+#endif
+
+// Intel C++ does not properly keep warning state for function templates,
+// so popping warning state at the end of translation unit leads to warnings in the middle.
+#if defined(_MSC_VER) && !defined(__INTEL_COMPILER)
+#	pragma warning(pop)
+#endif
+
+// Undefine all local macros (makes sure we're not leaking macros in header-only mode)
+#undef PUGI_IMPL_NO_INLINE
+#undef PUGI_IMPL_UNLIKELY
+#undef PUGI_IMPL_STATIC_ASSERT
+#undef PUGI_IMPL_DMC_VOLATILE
+#undef PUGI_IMPL_UNSIGNED_OVERFLOW
+#undef PUGI_IMPL_MSVC_CRT_VERSION
+#undef PUGI_IMPL_SNPRINTF
+#undef PUGI_IMPL_NS_BEGIN
+#undef PUGI_IMPL_NS_END
+#undef PUGI_IMPL_FN
+#undef PUGI_IMPL_FN_NO_INLINE
+#undef PUGI_IMPL_GETHEADER_IMPL
+#undef PUGI_IMPL_GETPAGE_IMPL
+#undef PUGI_IMPL_GETPAGE
+#undef PUGI_IMPL_NODETYPE
+#undef PUGI_IMPL_IS_CHARTYPE_IMPL
+#undef PUGI_IMPL_IS_CHARTYPE
+#undef PUGI_IMPL_IS_CHARTYPEX
+#undef PUGI_IMPL_ENDSWITH
+#undef PUGI_IMPL_SKIPWS
+#undef PUGI_IMPL_OPTSET
+#undef PUGI_IMPL_PUSHNODE
+#undef PUGI_IMPL_POPNODE
+#undef PUGI_IMPL_SCANFOR
+#undef PUGI_IMPL_SCANWHILE
+#undef PUGI_IMPL_SCANWHILE_UNROLL
+#undef PUGI_IMPL_ENDSEG
+#undef PUGI_IMPL_THROW_ERROR
+#undef PUGI_IMPL_CHECK_ERROR
+
+#endif
+
+/**
+ * Copyright (c) 2006-2025 Arseny Kapoulkine
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
diff --git a/runtime/third_party/pugixml/pugixml.hpp b/runtime/third_party/pugixml/pugixml.hpp
new file mode 100644
index 0000000..74e884b
--- /dev/null
+++ b/runtime/third_party/pugixml/pugixml.hpp
@@ -0,0 +1,1585 @@
+/**
+ * pugixml parser - version 1.15
+ * --------------------------------------------------------
+ * Copyright (C) 2006-2025, by Arseny Kapoulkine (arseny.kapoulkine@gmail.com)
+ * Report bugs and download new versions at https://pugixml.org/
+ *
+ * This library is distributed under the MIT License. See notice at the end
+ * of this file.
+ *
+ * This work is based on the pugxml parser, which is:
+ * Copyright (C) 2003, by Kristen Wegner (kristen@tima.net)
+ */
+
+// Define version macro; evaluates to major * 1000 + minor * 10 + patch so that it's safe to use in less-than comparisons
+// Note: pugixml used major * 100 + minor * 10 + patch format up until 1.9 (which had version identifier 190); starting from pugixml 1.10, the minor version number is two digits
+#ifndef PUGIXML_VERSION
+#	define PUGIXML_VERSION 1150 // 1.15
+#endif
+
+// Include user configuration file (this can define various configuration macros)
+#include "pugiconfig.hpp"
+
+#ifndef HEADER_PUGIXML_HPP
+#define HEADER_PUGIXML_HPP
+
+// Include stddef.h for size_t and ptrdiff_t
+#include <stddef.h>
+
+// Include exception header for XPath
+#if !defined(PUGIXML_NO_XPATH) && !defined(PUGIXML_NO_EXCEPTIONS)
+#	include <exception>
+#endif
+
+// Include STL headers
+#ifndef PUGIXML_NO_STL
+#	include <iterator>
+#	include <iosfwd>
+#	include <string>
+#endif
+
+// Check if std::string_view is available
+#if !defined(PUGIXML_HAS_STRING_VIEW) && !defined(PUGIXML_NO_STL)
+#	if __cplusplus >= 201703L
+#		define PUGIXML_HAS_STRING_VIEW
+#	elif defined(_MSVC_LANG) && _MSVC_LANG >= 201703L
+#		define PUGIXML_HAS_STRING_VIEW
+#	endif
+#endif
+
+// Include string_view if appropriate
+#ifdef PUGIXML_HAS_STRING_VIEW
+#	include <string_view>
+#endif
+
+// Macro for deprecated features
+#ifndef PUGIXML_DEPRECATED
+#	if defined(__GNUC__)
+#		define PUGIXML_DEPRECATED __attribute__((deprecated))
+#	elif defined(_MSC_VER) && _MSC_VER >= 1300
+#		define PUGIXML_DEPRECATED __declspec(deprecated)
+#	else
+#		define PUGIXML_DEPRECATED
+#	endif
+#endif
+
+// If no API is defined, assume default
+#ifndef PUGIXML_API
+#	define PUGIXML_API
+#endif
+
+// If no API for classes is defined, assume default
+#ifndef PUGIXML_CLASS
+#	define PUGIXML_CLASS PUGIXML_API
+#endif
+
+// If no API for functions is defined, assume default
+#ifndef PUGIXML_FUNCTION
+#	define PUGIXML_FUNCTION PUGIXML_API
+#endif
+
+// If the platform is known to have long long support, enable long long functions
+#ifndef PUGIXML_HAS_LONG_LONG
+#	if __cplusplus >= 201103
+#		define PUGIXML_HAS_LONG_LONG
+#	elif defined(_MSC_VER) && _MSC_VER >= 1400
+#		define PUGIXML_HAS_LONG_LONG
+#	endif
+#endif
+
+// If the platform is known to have move semantics support, compile move ctor/operator implementation
+#ifndef PUGIXML_HAS_MOVE
+#	if __cplusplus >= 201103
+#		define PUGIXML_HAS_MOVE
+#	elif defined(_MSC_VER) && _MSC_VER >= 1600
+#		define PUGIXML_HAS_MOVE
+#	endif
+#endif
+
+// If C++ is 2011 or higher, use 'noexcept' specifiers
+#ifndef PUGIXML_NOEXCEPT
+#	if __cplusplus >= 201103
+#		define PUGIXML_NOEXCEPT noexcept
+#	elif defined(_MSC_VER) && _MSC_VER >= 1900
+#		define PUGIXML_NOEXCEPT noexcept
+#	else
+#		define PUGIXML_NOEXCEPT throw()
+#	endif
+#endif
+
+// Some functions can not be noexcept in compact mode
+#ifdef PUGIXML_COMPACT
+#	define PUGIXML_NOEXCEPT_IF_NOT_COMPACT
+#else
+#	define PUGIXML_NOEXCEPT_IF_NOT_COMPACT PUGIXML_NOEXCEPT
+#endif
+
+// If C++ is 2011 or higher, add 'override' qualifiers
+#ifndef PUGIXML_OVERRIDE
+#	if __cplusplus >= 201103
+#		define PUGIXML_OVERRIDE override
+#	elif defined(_MSC_VER) && _MSC_VER >= 1700
+#		define PUGIXML_OVERRIDE override
+#	else
+#		define PUGIXML_OVERRIDE
+#	endif
+#endif
+
+// If C++ is 2011 or higher, use 'nullptr'
+#ifndef PUGIXML_NULL
+#	if __cplusplus >= 201103
+#		define PUGIXML_NULL nullptr
+#	elif defined(_MSC_VER) && _MSC_VER >= 1600
+#		define PUGIXML_NULL nullptr
+#	else
+#		define PUGIXML_NULL 0
+#	endif
+#endif
+
+// Character interface macros
+#ifdef PUGIXML_WCHAR_MODE
+#	define PUGIXML_TEXT(t) L ## t
+#	define PUGIXML_CHAR wchar_t
+#else
+#	define PUGIXML_TEXT(t) t
+#	define PUGIXML_CHAR char
+#endif
+
+namespace pugi
+{
+	// Character type used for all internal storage and operations; depends on PUGIXML_WCHAR_MODE
+	typedef PUGIXML_CHAR char_t;
+
+#ifndef PUGIXML_NO_STL
+	// String type used for operations that work with STL string; depends on PUGIXML_WCHAR_MODE
+	typedef std::basic_string<PUGIXML_CHAR> string_t;
+#endif
+
+#ifdef PUGIXML_HAS_STRING_VIEW
+	// String view type used for operations that can work with a length delimited string; depends on PUGIXML_WCHAR_MODE
+	typedef std::basic_string_view<PUGIXML_CHAR> string_view_t;
+#endif
+}
+
+// The PugiXML namespace
+namespace pugi
+{
+	// Tree node types
+	enum xml_node_type
+	{
+		node_null,			// Empty (null) node handle
+		node_document,		// A document tree's absolute root
+		node_element,		// Element tag, i.e. '<node/>'
+		node_pcdata,		// Plain character data, i.e. 'text'
+		node_cdata,			// Character data, i.e. '<![CDATA[text]]>'
+		node_comment,		// Comment tag, i.e. '<!-- text -->'
+		node_pi,			// Processing instruction, i.e. '<?name?>'
+		node_declaration,	// Document declaration, i.e. '<?xml version="1.0"?>'
+		node_doctype		// Document type declaration, i.e. '<!DOCTYPE doc>'
+	};
+
+	// Parsing options
+
+	// Minimal parsing mode (equivalent to turning all other flags off).
+	// Only elements and PCDATA sections are added to the DOM tree, no text conversions are performed.
+	const unsigned int parse_minimal = 0x0000;
+
+	// This flag determines if processing instructions (node_pi) are added to the DOM tree. This flag is off by default.
+	const unsigned int parse_pi = 0x0001;
+
+	// This flag determines if comments (node_comment) are added to the DOM tree. This flag is off by default.
+	const unsigned int parse_comments = 0x0002;
+
+	// This flag determines if CDATA sections (node_cdata) are added to the DOM tree. This flag is on by default.
+	const unsigned int parse_cdata = 0x0004;
+
+	// This flag determines if plain character data (node_pcdata) that consist only of whitespace are added to the DOM tree.
+	// This flag is off by default; turning it on usually results in slower parsing and more memory consumption.
+	const unsigned int parse_ws_pcdata = 0x0008;
+
+	// This flag determines if character and entity references are expanded during parsing. This flag is on by default.
+	const unsigned int parse_escapes = 0x0010;
+
+	// This flag determines if EOL characters are normalized (converted to #xA) during parsing. This flag is on by default.
+	const unsigned int parse_eol = 0x0020;
+
+	// This flag determines if attribute values are normalized using CDATA normalization rules during parsing. This flag is on by default.
+	const unsigned int parse_wconv_attribute = 0x0040;
+
+	// This flag determines if attribute values are normalized using NMTOKENS normalization rules during parsing. This flag is off by default.
+	const unsigned int parse_wnorm_attribute = 0x0080;
+
+	// This flag determines if document declaration (node_declaration) is added to the DOM tree. This flag is off by default.
+	const unsigned int parse_declaration = 0x0100;
+
+	// This flag determines if document type declaration (node_doctype) is added to the DOM tree. This flag is off by default.
+	const unsigned int parse_doctype = 0x0200;
+
+	// This flag determines if plain character data (node_pcdata) that is the only child of the parent node and that consists only
+	// of whitespace is added to the DOM tree.
+	// This flag is off by default; turning it on may result in slower parsing and more memory consumption.
+	const unsigned int parse_ws_pcdata_single = 0x0400;
+
+	// This flag determines if leading and trailing whitespace is to be removed from plain character data. This flag is off by default.
+	const unsigned int parse_trim_pcdata = 0x0800;
+
+	// This flag determines if plain character data that does not have a parent node is added to the DOM tree, and if an empty document
+	// is a valid document. This flag is off by default.
+	const unsigned int parse_fragment = 0x1000;
+
+	// This flag determines if plain character data is be stored in the parent element's value. This significantly changes the structure of
+	// the document; this flag is only recommended for parsing documents with many PCDATA nodes in memory-constrained environments.
+	// This flag is off by default.
+	const unsigned int parse_embed_pcdata = 0x2000;
+
+	// This flag determines whether determines whether the the two pcdata should be merged or not, if no intermediatory data are parsed in the document.
+	// This flag is off by default.
+	const unsigned int parse_merge_pcdata = 0x4000;
+
+	// The default parsing mode.
+	// Elements, PCDATA and CDATA sections are added to the DOM tree, character/reference entities are expanded,
+	// End-of-Line characters are normalized, attribute values are normalized using CDATA normalization rules.
+	const unsigned int parse_default = parse_cdata | parse_escapes | parse_wconv_attribute | parse_eol;
+
+	// The full parsing mode.
+	// Nodes of all types are added to the DOM tree, character/reference entities are expanded,
+	// End-of-Line characters are normalized, attribute values are normalized using CDATA normalization rules.
+	const unsigned int parse_full = parse_default | parse_pi | parse_comments | parse_declaration | parse_doctype;
+
+	// These flags determine the encoding of input data for XML document
+	enum xml_encoding
+	{
+		encoding_auto,		// Auto-detect input encoding using BOM or < / <? detection; use UTF8 if BOM is not found
+		encoding_utf8,		// UTF8 encoding
+		encoding_utf16_le,	// Little-endian UTF16
+		encoding_utf16_be,	// Big-endian UTF16
+		encoding_utf16,		// UTF16 with native endianness
+		encoding_utf32_le,	// Little-endian UTF32
+		encoding_utf32_be,	// Big-endian UTF32
+		encoding_utf32,		// UTF32 with native endianness
+		encoding_wchar,		// The same encoding wchar_t has (either UTF16 or UTF32)
+		encoding_latin1
+	};
+
+	// Formatting flags
+
+	// Indent the nodes that are written to output stream with as many indentation strings as deep the node is in DOM tree. This flag is on by default.
+	const unsigned int format_indent = 0x01;
+
+	// Write encoding-specific BOM to the output stream. This flag is off by default.
+	const unsigned int format_write_bom = 0x02;
+
+	// Use raw output mode (no indentation and no line breaks are written). This flag is off by default.
+	const unsigned int format_raw = 0x04;
+
+	// Omit default XML declaration even if there is no declaration in the document. This flag is off by default.
+	const unsigned int format_no_declaration = 0x08;
+
+	// Don't escape attribute values and PCDATA contents. This flag is off by default.
+	const unsigned int format_no_escapes = 0x10;
+
+	// Open file using text mode in xml_document::save_file. This enables special character (i.e. new-line) conversions on some systems. This flag is off by default.
+	const unsigned int format_save_file_text = 0x20;
+
+	// Write every attribute on a new line with appropriate indentation. This flag is off by default.
+	const unsigned int format_indent_attributes = 0x40;
+
+	// Don't output empty element tags, instead writing an explicit start and end tag even if there are no children. This flag is off by default.
+	const unsigned int format_no_empty_element_tags = 0x80;
+
+	// Skip characters belonging to range [0; 32) instead of "&#xNN;" encoding. This flag is off by default.
+	const unsigned int format_skip_control_chars = 0x100;
+
+	// Use single quotes ' instead of double quotes " for enclosing attribute values. This flag is off by default.
+	const unsigned int format_attribute_single_quote = 0x200;
+
+	// The default set of formatting flags.
+	// Nodes are indented depending on their depth in DOM tree, a default declaration is output if document has none.
+	const unsigned int format_default = format_indent;
+
+	const int default_double_precision = 17;
+	const int default_float_precision = 9;
+
+	// Forward declarations
+	struct xml_attribute_struct;
+	struct xml_node_struct;
+
+	class xml_node_iterator;
+	class xml_attribute_iterator;
+	class xml_named_node_iterator;
+
+	class xml_tree_walker;
+
+	struct xml_parse_result;
+
+	class xml_node;
+
+	class xml_text;
+
+	#ifndef PUGIXML_NO_XPATH
+	class xpath_node;
+	class xpath_node_set;
+	class xpath_query;
+	class xpath_variable_set;
+	#endif
+
+	// Range-based for loop support
+	template <typename It> class xml_object_range
+	{
+	public:
+		typedef It const_iterator;
+		typedef It iterator;
+
+		xml_object_range(It b, It e): _begin(b), _end(e)
+		{
+		}
+
+		It begin() const { return _begin; }
+		It end() const { return _end; }
+
+		bool empty() const { return _begin == _end; }
+
+	private:
+		It _begin, _end;
+	};
+
+	// Writer interface for node printing (see xml_node::print)
+	class PUGIXML_CLASS xml_writer
+	{
+	public:
+		virtual ~xml_writer();
+
+		// Write memory chunk into stream/file/whatever
+		virtual void write(const void* data, size_t size) = 0;
+	};
+
+	// xml_writer implementation for FILE*
+	class PUGIXML_CLASS xml_writer_file: public xml_writer
+	{
+	public:
+		// Construct writer from a FILE* object; void* is used to avoid header dependencies on stdio
+		xml_writer_file(void* file);
+
+		virtual void write(const void* data, size_t size) PUGIXML_OVERRIDE;
+
+	private:
+		void* file;
+	};
+
+	#ifndef PUGIXML_NO_STL
+	// xml_writer implementation for streams
+	class PUGIXML_CLASS xml_writer_stream: public xml_writer
+	{
+	public:
+		// Construct writer from an output stream object
+		xml_writer_stream(std::basic_ostream<char>& stream);
+		xml_writer_stream(std::basic_ostream<wchar_t>& stream);
+
+		virtual void write(const void* data, size_t size) PUGIXML_OVERRIDE;
+
+	private:
+		std::basic_ostream<char>* narrow_stream;
+		std::basic_ostream<wchar_t>* wide_stream;
+	};
+	#endif
+
+	// A light-weight handle for manipulating attributes in DOM tree
+	class PUGIXML_CLASS xml_attribute
+	{
+		friend class xml_attribute_iterator;
+		friend class xml_node;
+
+	private:
+		xml_attribute_struct* _attr;
+
+		typedef void (*unspecified_bool_type)(xml_attribute***);
+
+	public:
+		// Default constructor. Constructs an empty attribute.
+		xml_attribute();
+
+		// Constructs attribute from internal pointer
+		explicit xml_attribute(xml_attribute_struct* attr);
+
+		// Safe bool conversion operator
+		operator unspecified_bool_type() const;
+
+		// Borland C++ workaround
+		bool operator!() const;
+
+		// Comparison operators (compares wrapped attribute pointers)
+		bool operator==(const xml_attribute& r) const;
+		bool operator!=(const xml_attribute& r) const;
+		bool operator<(const xml_attribute& r) const;
+		bool operator>(const xml_attribute& r) const;
+		bool operator<=(const xml_attribute& r) const;
+		bool operator>=(const xml_attribute& r) const;
+
+		// Check if attribute is empty (null)
+		bool empty() const;
+
+		// Get attribute name/value, or "" if attribute is empty
+		const char_t* name() const;
+		const char_t* value() const;
+
+		// Get attribute value, or the default value if attribute is empty
+		const char_t* as_string(const char_t* def = PUGIXML_TEXT("")) const;
+
+		// Get attribute value as a number, or the default value if conversion did not succeed or attribute is empty
+		int as_int(int def = 0) const;
+		unsigned int as_uint(unsigned int def = 0) const;
+		double as_double(double def = 0) const;
+		float as_float(float def = 0) const;
+
+	#ifdef PUGIXML_HAS_LONG_LONG
+		long long as_llong(long long def = 0) const;
+		unsigned long long as_ullong(unsigned long long def = 0) const;
+	#endif
+
+		// Get attribute value as bool (returns true if first character is in '1tTyY' set), or the default value if attribute is empty
+		bool as_bool(bool def = false) const;
+
+		// Set attribute name/value (returns false if attribute is empty or there is not enough memory)
+		bool set_name(const char_t* rhs);
+		bool set_name(const char_t* rhs, size_t size);
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		bool set_name(string_view_t rhs);
+	#endif
+		bool set_value(const char_t* rhs);
+		bool set_value(const char_t* rhs, size_t size);
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		bool set_value(string_view_t rhs);
+	#endif
+
+		// Set attribute value with type conversion (numbers are converted to strings, boolean is converted to "true"/"false")
+		bool set_value(int rhs);
+		bool set_value(unsigned int rhs);
+		bool set_value(long rhs);
+		bool set_value(unsigned long rhs);
+		bool set_value(double rhs);
+		bool set_value(double rhs, int precision);
+		bool set_value(float rhs);
+		bool set_value(float rhs, int precision);
+		bool set_value(bool rhs);
+
+	#ifdef PUGIXML_HAS_LONG_LONG
+		bool set_value(long long rhs);
+		bool set_value(unsigned long long rhs);
+	#endif
+
+		// Set attribute value (equivalent to set_value without error checking)
+		xml_attribute& operator=(const char_t* rhs);
+		xml_attribute& operator=(int rhs);
+		xml_attribute& operator=(unsigned int rhs);
+		xml_attribute& operator=(long rhs);
+		xml_attribute& operator=(unsigned long rhs);
+		xml_attribute& operator=(double rhs);
+		xml_attribute& operator=(float rhs);
+		xml_attribute& operator=(bool rhs);
+
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		xml_attribute& operator=(string_view_t rhs);
+	#endif
+
+	#ifdef PUGIXML_HAS_LONG_LONG
+		xml_attribute& operator=(long long rhs);
+		xml_attribute& operator=(unsigned long long rhs);
+	#endif
+
+		// Get next/previous attribute in the attribute list of the parent node
+		xml_attribute next_attribute() const;
+		xml_attribute previous_attribute() const;
+
+		// Get hash value (unique for handles to the same object)
+		size_t hash_value() const;
+
+		// Get internal pointer
+		xml_attribute_struct* internal_object() const;
+	};
+
+#ifdef __BORLANDC__
+	// Borland C++ workaround
+	bool PUGIXML_FUNCTION operator&&(const xml_attribute& lhs, bool rhs);
+	bool PUGIXML_FUNCTION operator||(const xml_attribute& lhs, bool rhs);
+#endif
+
+	// A light-weight handle for manipulating nodes in DOM tree
+	class PUGIXML_CLASS xml_node
+	{
+		friend class xml_attribute_iterator;
+		friend class xml_node_iterator;
+		friend class xml_named_node_iterator;
+
+	protected:
+		xml_node_struct* _root;
+
+		typedef void (*unspecified_bool_type)(xml_node***);
+
+	public:
+		// Default constructor. Constructs an empty node.
+		xml_node();
+
+		// Constructs node from internal pointer
+		explicit xml_node(xml_node_struct* p);
+
+		// Safe bool conversion operator
+		operator unspecified_bool_type() const;
+
+		// Borland C++ workaround
+		bool operator!() const;
+
+		// Comparison operators (compares wrapped node pointers)
+		bool operator==(const xml_node& r) const;
+		bool operator!=(const xml_node& r) const;
+		bool operator<(const xml_node& r) const;
+		bool operator>(const xml_node& r) const;
+		bool operator<=(const xml_node& r) const;
+		bool operator>=(const xml_node& r) const;
+
+		// Check if node is empty (null)
+		bool empty() const;
+
+		// Get node type
+		xml_node_type type() const;
+
+		// Get node name, or "" if node is empty or it has no name
+		const char_t* name() const;
+
+		// Get node value, or "" if node is empty or it has no value
+		// Note: For <node>text</node> node.value() does not return "text"! Use child_value() or text() methods to access text inside nodes.
+		const char_t* value() const;
+
+		// Get attribute list
+		xml_attribute first_attribute() const;
+		xml_attribute last_attribute() const;
+
+		// Get children list
+		xml_node first_child() const;
+		xml_node last_child() const;
+
+		// Get next/previous sibling in the children list of the parent node
+		xml_node next_sibling() const;
+		xml_node previous_sibling() const;
+
+		// Get parent node
+		xml_node parent() const;
+
+		// Get root of DOM tree this node belongs to
+		xml_node root() const;
+
+		// Get text object for the current node
+		xml_text text() const;
+
+		// Get child, attribute or next/previous sibling with the specified name
+		xml_node child(const char_t* name) const;
+		xml_attribute attribute(const char_t* name) const;
+		xml_node next_sibling(const char_t* name) const;
+		xml_node previous_sibling(const char_t* name) const;
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		xml_node child(string_view_t name) const;
+		xml_attribute attribute(string_view_t name) const;
+		xml_node next_sibling(string_view_t name) const;
+		xml_node previous_sibling(string_view_t name) const;
+	#endif
+
+		// Get attribute, starting the search from a hint (and updating hint so that searching for a sequence of attributes is fast)
+		xml_attribute attribute(const char_t* name, xml_attribute& hint) const;
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		xml_attribute attribute(string_view_t name, xml_attribute& hint) const;
+	#endif
+
+		// Get child value of current node; that is, value of the first child node of type PCDATA/CDATA
+		const char_t* child_value() const;
+
+		// Get child value of child with specified name. Equivalent to child(name).child_value().
+		const char_t* child_value(const char_t* name) const;
+
+		// Set node name/value (returns false if node is empty, there is not enough memory, or node can not have name/value)
+		bool set_name(const char_t* rhs);
+		bool set_name(const char_t* rhs, size_t size);
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		bool set_name(string_view_t rhs);
+	#endif
+		bool set_value(const char_t* rhs);
+		bool set_value(const char_t* rhs, size_t size);
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		bool set_value(string_view_t rhs);
+	#endif
+
+		// Add attribute with specified name. Returns added attribute, or empty attribute on errors.
+		xml_attribute append_attribute(const char_t* name);
+		xml_attribute prepend_attribute(const char_t* name);
+		xml_attribute insert_attribute_after(const char_t* name, const xml_attribute& attr);
+		xml_attribute insert_attribute_before(const char_t* name, const xml_attribute& attr);
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		xml_attribute append_attribute(string_view_t name);
+		xml_attribute prepend_attribute(string_view_t name);
+		xml_attribute insert_attribute_after(string_view_t name, const xml_attribute& attr);
+		xml_attribute insert_attribute_before(string_view_t name, const xml_attribute& attr);
+	#endif
+
+		// Add a copy of the specified attribute. Returns added attribute, or empty attribute on errors.
+		xml_attribute append_copy(const xml_attribute& proto);
+		xml_attribute prepend_copy(const xml_attribute& proto);
+		xml_attribute insert_copy_after(const xml_attribute& proto, const xml_attribute& attr);
+		xml_attribute insert_copy_before(const xml_attribute& proto, const xml_attribute& attr);
+
+		// Add child node with specified type. Returns added node, or empty node on errors.
+		xml_node append_child(xml_node_type type = node_element);
+		xml_node prepend_child(xml_node_type type = node_element);
+		xml_node insert_child_after(xml_node_type type, const xml_node& node);
+		xml_node insert_child_before(xml_node_type type, const xml_node& node);
+
+		// Add child element with specified name. Returns added node, or empty node on errors.
+		xml_node append_child(const char_t* name);
+		xml_node prepend_child(const char_t* name);
+		xml_node insert_child_after(const char_t* name, const xml_node& node);
+		xml_node insert_child_before(const char_t* name, const xml_node& node);
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		xml_node append_child(string_view_t name);
+		xml_node prepend_child(string_view_t name);
+		xml_node insert_child_after(string_view_t, const xml_node& node);
+		xml_node insert_child_before(string_view_t name, const xml_node& node);
+	#endif
+
+		// Add a copy of the specified node as a child. Returns added node, or empty node on errors.
+		xml_node append_copy(const xml_node& proto);
+		xml_node prepend_copy(const xml_node& proto);
+		xml_node insert_copy_after(const xml_node& proto, const xml_node& node);
+		xml_node insert_copy_before(const xml_node& proto, const xml_node& node);
+
+		// Move the specified node to become a child of this node. Returns moved node, or empty node on errors.
+		xml_node append_move(const xml_node& moved);
+		xml_node prepend_move(const xml_node& moved);
+		xml_node insert_move_after(const xml_node& moved, const xml_node& node);
+		xml_node insert_move_before(const xml_node& moved, const xml_node& node);
+
+		// Remove specified attribute
+		bool remove_attribute(const xml_attribute& a);
+		bool remove_attribute(const char_t* name);
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		bool remove_attribute(string_view_t name);
+	#endif
+
+		// Remove all attributes
+		bool remove_attributes();
+
+		// Remove specified child
+		bool remove_child(const xml_node& n);
+		bool remove_child(const char_t* name);
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		bool remove_child(string_view_t name);
+	#endif
+
+		// Remove all children
+		bool remove_children();
+
+		// Parses buffer as an XML document fragment and appends all nodes as children of the current node.
+		// Copies/converts the buffer, so it may be deleted or changed after the function returns.
+		// Note: append_buffer allocates memory that has the lifetime of the owning document; removing the appended nodes does not immediately reclaim that memory.
+		xml_parse_result append_buffer(const void* contents, size_t size, unsigned int options = parse_default, xml_encoding encoding = encoding_auto);
+
+		// Find attribute using predicate. Returns first attribute for which predicate returned true.
+		template <typename Predicate> xml_attribute find_attribute(Predicate pred) const
+		{
+			if (!_root) return xml_attribute();
+
+			for (xml_attribute attrib = first_attribute(); attrib; attrib = attrib.next_attribute())
+				if (pred(attrib))
+					return attrib;
+
+			return xml_attribute();
+		}
+
+		// Find child node using predicate. Returns first child for which predicate returned true.
+		template <typename Predicate> xml_node find_child(Predicate pred) const
+		{
+			if (!_root) return xml_node();
+
+			for (xml_node node = first_child(); node; node = node.next_sibling())
+				if (pred(node))
+					return node;
+
+			return xml_node();
+		}
+
+		// Find node from subtree using predicate. Returns first node from subtree (depth-first), for which predicate returned true.
+		template <typename Predicate> xml_node find_node(Predicate pred) const
+		{
+			if (!_root) return xml_node();
+
+			xml_node cur = first_child();
+
+			while (cur._root && cur._root != _root)
+			{
+				if (pred(cur)) return cur;
+
+				if (cur.first_child()) cur = cur.first_child();
+				else if (cur.next_sibling()) cur = cur.next_sibling();
+				else
+				{
+					while (!cur.next_sibling() && cur._root != _root) cur = cur.parent();
+
+					if (cur._root != _root) cur = cur.next_sibling();
+				}
+			}
+
+			return xml_node();
+		}
+
+		// Find child node by attribute name/value
+		xml_node find_child_by_attribute(const char_t* name, const char_t* attr_name, const char_t* attr_value) const;
+		xml_node find_child_by_attribute(const char_t* attr_name, const char_t* attr_value) const;
+
+	#ifndef PUGIXML_NO_STL
+		// Get the absolute node path from root as a text string.
+		string_t path(char_t delimiter = '/') const;
+	#endif
+
+		// Search for a node by path consisting of node names and . or .. elements.
+		xml_node first_element_by_path(const char_t* path, char_t delimiter = '/') const;
+
+		// Recursively traverse subtree with xml_tree_walker
+		bool traverse(xml_tree_walker& walker);
+
+	#ifndef PUGIXML_NO_XPATH
+		// Select single node by evaluating XPath query. Returns first node from the resulting node set.
+		xpath_node select_node(const char_t* query, xpath_variable_set* variables = PUGIXML_NULL) const;
+		xpath_node select_node(const xpath_query& query) const;
+
+		// Select node set by evaluating XPath query
+		xpath_node_set select_nodes(const char_t* query, xpath_variable_set* variables = PUGIXML_NULL) const;
+		xpath_node_set select_nodes(const xpath_query& query) const;
+
+		// (deprecated: use select_node instead) Select single node by evaluating XPath query.
+		PUGIXML_DEPRECATED xpath_node select_single_node(const char_t* query, xpath_variable_set* variables = PUGIXML_NULL) const;
+		PUGIXML_DEPRECATED xpath_node select_single_node(const xpath_query& query) const;
+
+	#endif
+
+		// Print subtree using a writer object
+		void print(xml_writer& writer, const char_t* indent = PUGIXML_TEXT("\t"), unsigned int flags = format_default, xml_encoding encoding = encoding_auto, unsigned int depth = 0) const;
+
+	#ifndef PUGIXML_NO_STL
+		// Print subtree to stream
+		void print(std::basic_ostream<char>& os, const char_t* indent = PUGIXML_TEXT("\t"), unsigned int flags = format_default, xml_encoding encoding = encoding_auto, unsigned int depth = 0) const;
+		void print(std::basic_ostream<wchar_t>& os, const char_t* indent = PUGIXML_TEXT("\t"), unsigned int flags = format_default, unsigned int depth = 0) const;
+	#endif
+
+		// Child nodes iterators
+		typedef xml_node_iterator iterator;
+
+		iterator begin() const;
+		iterator end() const;
+
+		// Attribute iterators
+		typedef xml_attribute_iterator attribute_iterator;
+
+		attribute_iterator attributes_begin() const;
+		attribute_iterator attributes_end() const;
+
+		// Range-based for support
+		xml_object_range<xml_node_iterator> children() const;
+		xml_object_range<xml_attribute_iterator> attributes() const;
+
+		// Range-based for support for all children with the specified name
+		// Note: name pointer must have a longer lifetime than the returned object; be careful with passing temporaries!
+		xml_object_range<xml_named_node_iterator> children(const char_t* name) const;
+
+		// Get node offset in parsed file/string (in char_t units) for debugging purposes
+		ptrdiff_t offset_debug() const;
+
+		// Get hash value (unique for handles to the same object)
+		size_t hash_value() const;
+
+		// Get internal pointer
+		xml_node_struct* internal_object() const;
+	};
+
+#ifdef __BORLANDC__
+	// Borland C++ workaround
+	bool PUGIXML_FUNCTION operator&&(const xml_node& lhs, bool rhs);
+	bool PUGIXML_FUNCTION operator||(const xml_node& lhs, bool rhs);
+#endif
+
+	// A helper for working with text inside PCDATA nodes
+	class PUGIXML_CLASS xml_text
+	{
+		friend class xml_node;
+
+		xml_node_struct* _root;
+
+		typedef void (*unspecified_bool_type)(xml_text***);
+
+		explicit xml_text(xml_node_struct* root);
+
+		xml_node_struct* _data_new();
+		xml_node_struct* _data() const;
+
+	public:
+		// Default constructor. Constructs an empty object.
+		xml_text();
+
+		// Safe bool conversion operator
+		operator unspecified_bool_type() const;
+
+		// Borland C++ workaround
+		bool operator!() const;
+
+		// Check if text object is empty (null)
+		bool empty() const;
+
+		// Get text, or "" if object is empty
+		const char_t* get() const;
+
+		// Get text, or the default value if object is empty
+		const char_t* as_string(const char_t* def = PUGIXML_TEXT("")) const;
+
+		// Get text as a number, or the default value if conversion did not succeed or object is empty
+		int as_int(int def = 0) const;
+		unsigned int as_uint(unsigned int def = 0) const;
+		double as_double(double def = 0) const;
+		float as_float(float def = 0) const;
+
+	#ifdef PUGIXML_HAS_LONG_LONG
+		long long as_llong(long long def = 0) const;
+		unsigned long long as_ullong(unsigned long long def = 0) const;
+	#endif
+
+		// Get text as bool (returns true if first character is in '1tTyY' set), or the default value if object is empty
+		bool as_bool(bool def = false) const;
+
+		// Set text (returns false if object is empty or there is not enough memory)
+		bool set(const char_t* rhs);
+		bool set(const char_t* rhs, size_t size);
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		bool set(string_view_t rhs);
+	#endif
+
+		// Set text with type conversion (numbers are converted to strings, boolean is converted to "true"/"false")
+		bool set(int rhs);
+		bool set(unsigned int rhs);
+		bool set(long rhs);
+		bool set(unsigned long rhs);
+		bool set(double rhs);
+		bool set(double rhs, int precision);
+		bool set(float rhs);
+		bool set(float rhs, int precision);
+		bool set(bool rhs);
+
+	#ifdef PUGIXML_HAS_LONG_LONG
+		bool set(long long rhs);
+		bool set(unsigned long long rhs);
+	#endif
+
+		// Set text (equivalent to set without error checking)
+		xml_text& operator=(const char_t* rhs);
+		xml_text& operator=(int rhs);
+		xml_text& operator=(unsigned int rhs);
+		xml_text& operator=(long rhs);
+		xml_text& operator=(unsigned long rhs);
+		xml_text& operator=(double rhs);
+		xml_text& operator=(float rhs);
+		xml_text& operator=(bool rhs);
+
+	#ifdef PUGIXML_HAS_STRING_VIEW
+		xml_text& operator=(string_view_t rhs);
+	#endif
+
+	#ifdef PUGIXML_HAS_LONG_LONG
+		xml_text& operator=(long long rhs);
+		xml_text& operator=(unsigned long long rhs);
+	#endif
+
+		// Get the data node (node_pcdata or node_cdata) for this object
+		xml_node data() const;
+	};
+
+#ifdef __BORLANDC__
+	// Borland C++ workaround
+	bool PUGIXML_FUNCTION operator&&(const xml_text& lhs, bool rhs);
+	bool PUGIXML_FUNCTION operator||(const xml_text& lhs, bool rhs);
+#endif
+
+	// Child node iterator (a bidirectional iterator over a collection of xml_node)
+	class PUGIXML_CLASS xml_node_iterator
+	{
+		friend class xml_node;
+
+	private:
+		mutable xml_node _wrap;
+		xml_node _parent;
+
+		xml_node_iterator(xml_node_struct* ref, xml_node_struct* parent);
+
+	public:
+		// Iterator traits
+		typedef ptrdiff_t difference_type;
+		typedef xml_node value_type;
+		typedef xml_node* pointer;
+		typedef xml_node& reference;
+
+	#ifndef PUGIXML_NO_STL
+		typedef std::bidirectional_iterator_tag iterator_category;
+	#endif
+
+		// Default constructor
+		xml_node_iterator();
+
+		// Construct an iterator which points to the specified node
+		xml_node_iterator(const xml_node& node);
+
+		// Iterator operators
+		bool operator==(const xml_node_iterator& rhs) const;
+		bool operator!=(const xml_node_iterator& rhs) const;
+
+		xml_node& operator*() const;
+		xml_node* operator->() const;
+
+		xml_node_iterator& operator++();
+		xml_node_iterator operator++(int);
+
+		xml_node_iterator& operator--();
+		xml_node_iterator operator--(int);
+	};
+
+	// Attribute iterator (a bidirectional iterator over a collection of xml_attribute)
+	class PUGIXML_CLASS xml_attribute_iterator
+	{
+		friend class xml_node;
+
+	private:
+		mutable xml_attribute _wrap;
+		xml_node _parent;
+
+		xml_attribute_iterator(xml_attribute_struct* ref, xml_node_struct* parent);
+
+	public:
+		// Iterator traits
+		typedef ptrdiff_t difference_type;
+		typedef xml_attribute value_type;
+		typedef xml_attribute* pointer;
+		typedef xml_attribute& reference;
+
+	#ifndef PUGIXML_NO_STL
+		typedef std::bidirectional_iterator_tag iterator_category;
+	#endif
+
+		// Default constructor
+		xml_attribute_iterator();
+
+		// Construct an iterator which points to the specified attribute
+		xml_attribute_iterator(const xml_attribute& attr, const xml_node& parent);
+
+		// Iterator operators
+		bool operator==(const xml_attribute_iterator& rhs) const;
+		bool operator!=(const xml_attribute_iterator& rhs) const;
+
+		xml_attribute& operator*() const;
+		xml_attribute* operator->() const;
+
+		xml_attribute_iterator& operator++();
+		xml_attribute_iterator operator++(int);
+
+		xml_attribute_iterator& operator--();
+		xml_attribute_iterator operator--(int);
+	};
+
+	// Named node range helper
+	class PUGIXML_CLASS xml_named_node_iterator
+	{
+		friend class xml_node;
+
+	public:
+		// Iterator traits
+		typedef ptrdiff_t difference_type;
+		typedef xml_node value_type;
+		typedef xml_node* pointer;
+		typedef xml_node& reference;
+
+	#ifndef PUGIXML_NO_STL
+		typedef std::bidirectional_iterator_tag iterator_category;
+	#endif
+
+		// Default constructor
+		xml_named_node_iterator();
+
+		// Construct an iterator which points to the specified node
+		// Note: name pointer is stored in the iterator and must have a longer lifetime than iterator itself
+		xml_named_node_iterator(const xml_node& node, const char_t* name);
+
+		// Iterator operators
+		bool operator==(const xml_named_node_iterator& rhs) const;
+		bool operator!=(const xml_named_node_iterator& rhs) const;
+
+		xml_node& operator*() const;
+		xml_node* operator->() const;
+
+		xml_named_node_iterator& operator++();
+		xml_named_node_iterator operator++(int);
+
+		xml_named_node_iterator& operator--();
+		xml_named_node_iterator operator--(int);
+
+	private:
+		mutable xml_node _wrap;
+		xml_node _parent;
+		const char_t* _name;
+
+		xml_named_node_iterator(xml_node_struct* ref, xml_node_struct* parent, const char_t* name);
+	};
+
+	// Abstract tree walker class (see xml_node::traverse)
+	class PUGIXML_CLASS xml_tree_walker
+	{
+		friend class xml_node;
+
+	private:
+		int _depth;
+
+	protected:
+		// Get current traversal depth
+		int depth() const;
+
+	public:
+		xml_tree_walker();
+		virtual ~xml_tree_walker();
+
+		// Callback that is called when traversal begins
+		virtual bool begin(xml_node& node);
+
+		// Callback that is called for each node traversed
+		virtual bool for_each(xml_node& node) = 0;
+
+		// Callback that is called when traversal ends
+		virtual bool end(xml_node& node);
+	};
+
+	// Parsing status, returned as part of xml_parse_result object
+	enum xml_parse_status
+	{
+		status_ok = 0,				// No error
+
+		status_file_not_found,		// File was not found during load_file()
+		status_io_error,			// Error reading from file/stream
+		status_out_of_memory,		// Could not allocate memory
+		status_internal_error,		// Internal error occurred
+
+		status_unrecognized_tag,	// Parser could not determine tag type
+
+		status_bad_pi,				// Parsing error occurred while parsing document declaration/processing instruction
+		status_bad_comment,			// Parsing error occurred while parsing comment
+		status_bad_cdata,			// Parsing error occurred while parsing CDATA section
+		status_bad_doctype,			// Parsing error occurred while parsing document type declaration
+		status_bad_pcdata,			// Parsing error occurred while parsing PCDATA section
+		status_bad_start_element,	// Parsing error occurred while parsing start element tag
+		status_bad_attribute,		// Parsing error occurred while parsing element attribute
+		status_bad_end_element,		// Parsing error occurred while parsing end element tag
+		status_end_element_mismatch,// There was a mismatch of start-end tags (closing tag had incorrect name, some tag was not closed or there was an excessive closing tag)
+
+		status_append_invalid_root,	// Unable to append nodes since root type is not node_element or node_document (exclusive to xml_node::append_buffer)
+
+		status_no_document_element	// Parsing resulted in a document without element nodes
+	};
+
+	// Parsing result
+	struct PUGIXML_CLASS xml_parse_result
+	{
+		// Parsing status (see xml_parse_status)
+		xml_parse_status status;
+
+		// Last parsed offset (in char_t units from start of input data)
+		ptrdiff_t offset;
+
+		// Source document encoding
+		xml_encoding encoding;
+
+		// Default constructor, initializes object to failed state
+		xml_parse_result();
+
+		// Cast to bool operator
+		operator bool() const;
+
+		// Get error description
+		const char* description() const;
+	};
+
+	// Document class (DOM tree root)
+	class PUGIXML_CLASS xml_document: public xml_node
+	{
+	private:
+		char_t* _buffer;
+
+		char _memory[192];
+
+		// Non-copyable semantics
+		xml_document(const xml_document&);
+		xml_document& operator=(const xml_document&);
+
+		void _create();
+		void _destroy();
+		void _move(xml_document& rhs) PUGIXML_NOEXCEPT_IF_NOT_COMPACT;
+
+	public:
+		// Default constructor, makes empty document
+		xml_document();
+
+		// Destructor, invalidates all node/attribute handles to this document
+		~xml_document();
+
+	#ifdef PUGIXML_HAS_MOVE
+		// Move semantics support
+		xml_document(xml_document&& rhs) PUGIXML_NOEXCEPT_IF_NOT_COMPACT;
+		xml_document& operator=(xml_document&& rhs) PUGIXML_NOEXCEPT_IF_NOT_COMPACT;
+	#endif
+
+		// Removes all nodes, leaving the empty document
+		void reset();
+
+		// Removes all nodes, then copies the entire contents of the specified document
+		void reset(const xml_document& proto);
+
+	#ifndef PUGIXML_NO_STL
+		// Load document from stream.
+		xml_parse_result load(std::basic_istream<char>& stream, unsigned int options = parse_default, xml_encoding encoding = encoding_auto);
+		xml_parse_result load(std::basic_istream<wchar_t>& stream, unsigned int options = parse_default);
+	#endif
+
+		// (deprecated: use load_string instead) Load document from zero-terminated string. No encoding conversions are applied.
+		PUGIXML_DEPRECATED xml_parse_result load(const char_t* contents, unsigned int options = parse_default);
+
+		// Load document from zero-terminated string. No encoding conversions are applied.
+		xml_parse_result load_string(const char_t* contents, unsigned int options = parse_default);
+
+		// Load document from file
+		xml_parse_result load_file(const char* path, unsigned int options = parse_default, xml_encoding encoding = encoding_auto);
+		xml_parse_result load_file(const wchar_t* path, unsigned int options = parse_default, xml_encoding encoding = encoding_auto);
+
+		// Load document from buffer. Copies/converts the buffer, so it may be deleted or changed after the function returns.
+		xml_parse_result load_buffer(const void* contents, size_t size, unsigned int options = parse_default, xml_encoding encoding = encoding_auto);
+
+		// Load document from buffer, using the buffer for in-place parsing (the buffer is modified and used for storage of document data).
+		// You should ensure that buffer data will persist throughout the document's lifetime, and free the buffer memory manually once document is destroyed.
+		xml_parse_result load_buffer_inplace(void* contents, size_t size, unsigned int options = parse_default, xml_encoding encoding = encoding_auto);
+
+		// Load document from buffer, using the buffer for in-place parsing (the buffer is modified and used for storage of document data).
+		// You should allocate the buffer with pugixml allocation function; document will free the buffer when it is no longer needed (you can't use it anymore).
+		xml_parse_result load_buffer_inplace_own(void* contents, size_t size, unsigned int options = parse_default, xml_encoding encoding = encoding_auto);
+
+		// Save XML document to writer (semantics is slightly different from xml_node::print, see documentation for details).
+		void save(xml_writer& writer, const char_t* indent = PUGIXML_TEXT("\t"), unsigned int flags = format_default, xml_encoding encoding = encoding_auto) const;
+
+	#ifndef PUGIXML_NO_STL
+		// Save XML document to stream (semantics is slightly different from xml_node::print, see documentation for details).
+		void save(std::basic_ostream<char>& stream, const char_t* indent = PUGIXML_TEXT("\t"), unsigned int flags = format_default, xml_encoding encoding = encoding_auto) const;
+		void save(std::basic_ostream<wchar_t>& stream, const char_t* indent = PUGIXML_TEXT("\t"), unsigned int flags = format_default) const;
+	#endif
+
+		// Save XML to file
+		bool save_file(const char* path, const char_t* indent = PUGIXML_TEXT("\t"), unsigned int flags = format_default, xml_encoding encoding = encoding_auto) const;
+		bool save_file(const wchar_t* path, const char_t* indent = PUGIXML_TEXT("\t"), unsigned int flags = format_default, xml_encoding encoding = encoding_auto) const;
+
+		// Get document element
+		xml_node document_element() const;
+	};
+
+#ifndef PUGIXML_NO_XPATH
+	// XPath query return type
+	enum xpath_value_type
+	{
+		xpath_type_none,	  // Unknown type (query failed to compile)
+		xpath_type_node_set,  // Node set (xpath_node_set)
+		xpath_type_number,	  // Number
+		xpath_type_string,	  // String
+		xpath_type_boolean	  // Boolean
+	};
+
+	// XPath parsing result
+	struct PUGIXML_CLASS xpath_parse_result
+	{
+		// Error message (0 if no error)
+		const char* error;
+
+		// Last parsed offset (in char_t units from string start)
+		ptrdiff_t offset;
+
+		// Default constructor, initializes object to failed state
+		xpath_parse_result();
+
+		// Cast to bool operator
+		operator bool() const;
+
+		// Get error description
+		const char* description() const;
+	};
+
+	// A single XPath variable
+	class PUGIXML_CLASS xpath_variable
+	{
+		friend class xpath_variable_set;
+
+	protected:
+		xpath_value_type _type;
+		xpath_variable* _next;
+
+		xpath_variable(xpath_value_type type);
+
+		// Non-copyable semantics
+		xpath_variable(const xpath_variable&);
+		xpath_variable& operator=(const xpath_variable&);
+
+	public:
+		// Get variable name
+		const char_t* name() const;
+
+		// Get variable type
+		xpath_value_type type() const;
+
+		// Get variable value; no type conversion is performed, default value (false, NaN, empty string, empty node set) is returned on type mismatch error
+		bool get_boolean() const;
+		double get_number() const;
+		const char_t* get_string() const;
+		const xpath_node_set& get_node_set() const;
+
+		// Set variable value; no type conversion is performed, false is returned on type mismatch error
+		bool set(bool value);
+		bool set(double value);
+		bool set(const char_t* value);
+		bool set(const xpath_node_set& value);
+	};
+
+	// A set of XPath variables
+	class PUGIXML_CLASS xpath_variable_set
+	{
+	private:
+		xpath_variable* _data[64];
+
+		void _assign(const xpath_variable_set& rhs);
+		void _swap(xpath_variable_set& rhs);
+
+		xpath_variable* _find(const char_t* name) const;
+
+		static bool _clone(xpath_variable* var, xpath_variable** out_result);
+		static void _destroy(xpath_variable* var);
+
+	public:
+		// Default constructor/destructor
+		xpath_variable_set();
+		~xpath_variable_set();
+
+		// Copy constructor/assignment operator
+		xpath_variable_set(const xpath_variable_set& rhs);
+		xpath_variable_set& operator=(const xpath_variable_set& rhs);
+
+	#ifdef PUGIXML_HAS_MOVE
+		// Move semantics support
+		xpath_variable_set(xpath_variable_set&& rhs) PUGIXML_NOEXCEPT;
+		xpath_variable_set& operator=(xpath_variable_set&& rhs) PUGIXML_NOEXCEPT;
+	#endif
+
+		// Add a new variable or get the existing one, if the types match
+		xpath_variable* add(const char_t* name, xpath_value_type type);
+
+		// Set value of an existing variable; no type conversion is performed, false is returned if there is no such variable or if types mismatch
+		bool set(const char_t* name, bool value);
+		bool set(const char_t* name, double value);
+		bool set(const char_t* name, const char_t* value);
+		bool set(const char_t* name, const xpath_node_set& value);
+
+		// Get existing variable by name
+		xpath_variable* get(const char_t* name);
+		const xpath_variable* get(const char_t* name) const;
+	};
+
+	// A compiled XPath query object
+	class PUGIXML_CLASS xpath_query
+	{
+	private:
+		void* _impl;
+		xpath_parse_result _result;
+
+		typedef void (*unspecified_bool_type)(xpath_query***);
+
+		// Non-copyable semantics
+		xpath_query(const xpath_query&);
+		xpath_query& operator=(const xpath_query&);
+
+	public:
+		// Construct a compiled object from XPath expression.
+		// If PUGIXML_NO_EXCEPTIONS is not defined, throws xpath_exception on compilation errors.
+		explicit xpath_query(const char_t* query, xpath_variable_set* variables = PUGIXML_NULL);
+
+		// Constructor
+		xpath_query();
+
+		// Destructor
+		~xpath_query();
+
+	#ifdef PUGIXML_HAS_MOVE
+		// Move semantics support
+		xpath_query(xpath_query&& rhs) PUGIXML_NOEXCEPT;
+		xpath_query& operator=(xpath_query&& rhs) PUGIXML_NOEXCEPT;
+	#endif
+
+		// Get query expression return type
+		xpath_value_type return_type() const;
+
+		// Evaluate expression as boolean value in the specified context; performs type conversion if necessary.
+		// If PUGIXML_NO_EXCEPTIONS is not defined, throws std::bad_alloc on out of memory errors.
+		bool evaluate_boolean(const xpath_node& n) const;
+
+		// Evaluate expression as double value in the specified context; performs type conversion if necessary.
+		// If PUGIXML_NO_EXCEPTIONS is not defined, throws std::bad_alloc on out of memory errors.
+		double evaluate_number(const xpath_node& n) const;
+
+	#ifndef PUGIXML_NO_STL
+		// Evaluate expression as string value in the specified context; performs type conversion if necessary.
+		// If PUGIXML_NO_EXCEPTIONS is not defined, throws std::bad_alloc on out of memory errors.
+		string_t evaluate_string(const xpath_node& n) const;
+	#endif
+
+		// Evaluate expression as string value in the specified context; performs type conversion if necessary.
+		// At most capacity characters are written to the destination buffer, full result size is returned (includes terminating zero).
+		// If PUGIXML_NO_EXCEPTIONS is not defined, throws std::bad_alloc on out of memory errors.
+		// If PUGIXML_NO_EXCEPTIONS is defined, returns empty  set instead.
+		size_t evaluate_string(char_t* buffer, size_t capacity, const xpath_node& n) const;
+
+		// Evaluate expression as node set in the specified context.
+		// If PUGIXML_NO_EXCEPTIONS is not defined, throws xpath_exception on type mismatch and std::bad_alloc on out of memory errors.
+		// If PUGIXML_NO_EXCEPTIONS is defined, returns empty node set instead.
+		xpath_node_set evaluate_node_set(const xpath_node& n) const;
+
+		// Evaluate expression as node set in the specified context.
+		// Return first node in document order, or empty node if node set is empty.
+		// If PUGIXML_NO_EXCEPTIONS is not defined, throws xpath_exception on type mismatch and std::bad_alloc on out of memory errors.
+		// If PUGIXML_NO_EXCEPTIONS is defined, returns empty node instead.
+		xpath_node evaluate_node(const xpath_node& n) const;
+
+		// Get parsing result (used to get compilation errors in PUGIXML_NO_EXCEPTIONS mode)
+		const xpath_parse_result& result() const;
+
+		// Safe bool conversion operator
+		operator unspecified_bool_type() const;
+
+		// Borland C++ workaround
+		bool operator!() const;
+	};
+
+	#ifndef PUGIXML_NO_EXCEPTIONS
+        #if defined(_MSC_VER)
+          // C4275 can be ignored in Visual C++ if you are deriving
+          // from a type in the Standard C++ Library
+          #pragma warning(push)
+          #pragma warning(disable: 4275)
+        #endif
+	// XPath exception class
+	class PUGIXML_CLASS xpath_exception: public std::exception
+	{
+	private:
+		xpath_parse_result _result;
+
+	public:
+		// Construct exception from parse result
+		explicit xpath_exception(const xpath_parse_result& result);
+
+		// Get error message
+		virtual const char* what() const PUGIXML_NOEXCEPT PUGIXML_OVERRIDE;
+
+		// Get parse result
+		const xpath_parse_result& result() const;
+	};
+        #if defined(_MSC_VER)
+          #pragma warning(pop)
+        #endif
+	#endif
+
+	// XPath node class (either xml_node or xml_attribute)
+	class PUGIXML_CLASS xpath_node
+	{
+	private:
+		xml_node _node;
+		xml_attribute _attribute;
+
+		typedef void (*unspecified_bool_type)(xpath_node***);
+
+	public:
+		// Default constructor; constructs empty XPath node
+		xpath_node();
+
+		// Construct XPath node from XML node/attribute
+		xpath_node(const xml_node& node);
+		xpath_node(const xml_attribute& attribute, const xml_node& parent);
+
+		// Get node/attribute, if any
+		xml_node node() const;
+		xml_attribute attribute() const;
+
+		// Get parent of contained node/attribute
+		xml_node parent() const;
+
+		// Safe bool conversion operator
+		operator unspecified_bool_type() const;
+
+		// Borland C++ workaround
+		bool operator!() const;
+
+		// Comparison operators
+		bool operator==(const xpath_node& n) const;
+		bool operator!=(const xpath_node& n) const;
+	};
+
+#ifdef __BORLANDC__
+	// Borland C++ workaround
+	bool PUGIXML_FUNCTION operator&&(const xpath_node& lhs, bool rhs);
+	bool PUGIXML_FUNCTION operator||(const xpath_node& lhs, bool rhs);
+#endif
+
+	// A fixed-size collection of XPath nodes
+	class PUGIXML_CLASS xpath_node_set
+	{
+	public:
+		// Collection type
+		enum type_t
+		{
+			type_unsorted,			// Not ordered
+			type_sorted,			// Sorted by document order (ascending)
+			type_sorted_reverse		// Sorted by document order (descending)
+		};
+
+		// Constant iterator type
+		typedef const xpath_node* const_iterator;
+
+		// We define non-constant iterator to be the same as constant iterator so that various generic algorithms (i.e. boost foreach) work
+		typedef const xpath_node* iterator;
+
+		// Default constructor. Constructs empty set.
+		xpath_node_set();
+
+		// Constructs a set from iterator range; data is not checked for duplicates and is not sorted according to provided type, so be careful
+		xpath_node_set(const_iterator begin, const_iterator end, type_t type = type_unsorted);
+
+		// Destructor
+		~xpath_node_set();
+
+		// Copy constructor/assignment operator
+		xpath_node_set(const xpath_node_set& ns);
+		xpath_node_set& operator=(const xpath_node_set& ns);
+
+	#ifdef PUGIXML_HAS_MOVE
+		// Move semantics support
+		xpath_node_set(xpath_node_set&& rhs) PUGIXML_NOEXCEPT;
+		xpath_node_set& operator=(xpath_node_set&& rhs) PUGIXML_NOEXCEPT;
+	#endif
+
+		// Get collection type
+		type_t type() const;
+
+		// Get collection size
+		size_t size() const;
+
+		// Indexing operator
+		const xpath_node& operator[](size_t index) const;
+
+		// Collection iterators
+		const_iterator begin() const;
+		const_iterator end() const;
+
+		// Sort the collection in ascending/descending order by document order
+		void sort(bool reverse = false);
+
+		// Get first node in the collection by document order
+		xpath_node first() const;
+
+		// Check if collection is empty
+		bool empty() const;
+
+	private:
+		type_t _type;
+
+		xpath_node _storage[1];
+
+		xpath_node* _begin;
+		xpath_node* _end;
+
+		void _assign(const_iterator begin, const_iterator end, type_t type);
+		void _move(xpath_node_set& rhs) PUGIXML_NOEXCEPT;
+	};
+#endif
+
+#ifndef PUGIXML_NO_STL
+	// Convert wide string to UTF8
+	std::basic_string<char> PUGIXML_FUNCTION as_utf8(const wchar_t* str);
+	std::basic_string<char> PUGIXML_FUNCTION as_utf8(const std::basic_string<wchar_t>& str);
+
+	// Convert UTF8 to wide string
+	std::basic_string<wchar_t> PUGIXML_FUNCTION as_wide(const char* str);
+	std::basic_string<wchar_t> PUGIXML_FUNCTION as_wide(const std::basic_string<char>& str);
+#endif
+
+	// Memory allocation function interface; returns pointer to allocated memory or NULL on failure
+	typedef void* (*allocation_function)(size_t size);
+
+	// Memory deallocation function interface
+	typedef void (*deallocation_function)(void* ptr);
+
+	// Override default memory management functions. All subsequent allocations/deallocations will be performed via supplied functions.
+	void PUGIXML_FUNCTION set_memory_management_functions(allocation_function allocate, deallocation_function deallocate);
+
+	// Get current memory management functions
+	allocation_function PUGIXML_FUNCTION get_memory_allocation_function();
+	deallocation_function PUGIXML_FUNCTION get_memory_deallocation_function();
+}
+
+#if !defined(PUGIXML_NO_STL) && (defined(_MSC_VER) || defined(__ICC))
+namespace std
+{
+	// Workarounds for (non-standard) iterator category detection for older versions (MSVC7/IC8 and earlier)
+	std::bidirectional_iterator_tag PUGIXML_FUNCTION _Iter_cat(const pugi::xml_node_iterator&);
+	std::bidirectional_iterator_tag PUGIXML_FUNCTION _Iter_cat(const pugi::xml_attribute_iterator&);
+	std::bidirectional_iterator_tag PUGIXML_FUNCTION _Iter_cat(const pugi::xml_named_node_iterator&);
+}
+#endif
+
+#if !defined(PUGIXML_NO_STL) && defined(__SUNPRO_CC)
+namespace std
+{
+	// Workarounds for (non-standard) iterator category detection
+	std::bidirectional_iterator_tag PUGIXML_FUNCTION __iterator_category(const pugi::xml_node_iterator&);
+	std::bidirectional_iterator_tag PUGIXML_FUNCTION __iterator_category(const pugi::xml_attribute_iterator&);
+	std::bidirectional_iterator_tag PUGIXML_FUNCTION __iterator_category(const pugi::xml_named_node_iterator&);
+}
+#endif
+
+#endif
+
+// Make sure implementation is included in header-only mode
+// Use macro expansion in #include to work around QMake (QTBUG-11923)
+#if defined(PUGIXML_HEADER_ONLY) && !defined(PUGIXML_SOURCE)
+#	define PUGIXML_SOURCE "pugixml.cpp"
+#	include PUGIXML_SOURCE
+#endif
+
+/**
+ * Copyright (c) 2006-2025 Arseny Kapoulkine
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
diff --git a/runtime/third_party/toml11/LICENSE b/runtime/third_party/toml11/LICENSE
new file mode 100644
index 0000000..f55c511
--- /dev/null
+++ b/runtime/third_party/toml11/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Toru Niina
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/runtime/third_party/toml11/README.md b/runtime/third_party/toml11/README.md
new file mode 100644
index 0000000..9eee9d2
--- /dev/null
+++ b/runtime/third_party/toml11/README.md
@@ -0,0 +1,712 @@
+# toml11
+
+[![Build Status on GitHub Actions](https://github.com/ToruNiina/toml11/workflows/build/badge.svg)](https://github.com/ToruNiina/toml11/actions)
+[![Build status](https://ci.appveyor.com/api/projects/status/m2n08a926asvg5mg/branch/main?svg=true)](https://ci.appveyor.com/project/ToruNiina/toml11/branch/main)
+[![Version](https://img.shields.io/github/release/ToruNiina/toml11.svg?style=flat)](https://github.com/ToruNiina/toml11/releases)
+[![License](https://img.shields.io/github/license/ToruNiina/toml11.svg?style=flat)](LICENSE)
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.1209136.svg)](https://doi.org/10.5281/zenodo.1209136)
+
+[日本語版](https://github.com/ToruNiina/toml11/blob/main/README_ja.md)
+
+toml11 is a feature-rich TOML language library for C++11/14/17/20.
+
+- It complies with [the latest TOML language specification](https://toml.io/en/v1.0.0).
+- It passes all the standard TOML language [test cases](https://github.com/toml-lang/toml-test).
+- It supports new features merged into the upcoming TOML version (v1.1.0).
+- It provides clear error messages, including the location of the error.
+- It parses and retains comments, associating them with corresponding values.
+- It maintains formatting information such as hex integers and considers these during serialization.
+- It provides exception-less parse function.
+- It supports complex type conversions from TOML values.
+- It allows customization of the types stored in `toml::value`.
+- It provides some extensions not present in the TOML language standard.
+
+## Example
+
+```toml
+# example.toml
+title = "an example toml file"
+nums  = [3, 1, 4, 1, 5] # pi!
+```
+
+```cpp
+#include <toml.hpp>
+#include <iostream>
+
+int main()
+{
+    // select TOML version at runtime (optional)
+    auto data = toml::parse("example.toml", toml::spec::v(1,1,0));
+
+    // find a value with the specified type from a table
+    std::string title = toml::find<std::string>(data, "title");
+
+    // convert the whole array into STL-like container automatically
+    std::vector<int> nums = toml::find<std::vector<int>>(data, "nums");
+
+    // access with STL-like manner
+    if( ! data.contains("foo"))
+    {
+        data["foo"] = "bar";
+    }
+    if(data.at("nums").is_array())
+    {
+        data["nums"].as_array().push_back(9);
+    }
+
+    // check comments
+    assert(data.at("nums").comments().at(0) == "# pi!");
+
+    // pass a fallback
+    std::string name = toml::find_or<std::string>(data, "name", "not found");
+
+    // serialization considering format info
+    data.at("nums").as_array_fmt().fmt = toml::array_format::multiline;
+    data.at("nums").as_array_fmt().indent_type = toml::indent_char::space;
+    data.at("nums").as_array_fmt().body_indent = 2;
+
+    std::cout << toml::format(data) << std::endl;
+
+    return 0;
+}
+```
+
+
+For more details, please refer to the [documentation](https://toruniina.github.io/toml11/).
+
+## Table of Contents
+
+- [toml11](#toml11)
+  - [Example](#example)
+  - [Table of Contents](#table-of-contents)
+  - [Integration](#integration)
+    - [Single Include File](#single-include-file)
+    - [git submodule](#git-submodule)
+    - [CMake `FetchContent`](#cmake-fetchcontent)
+    - [CMake Package Manager (CPM)](#cmake-package-manager-cpm)
+    - [Install Using CMake](#install-using-cmake)
+    - [Precompile Library](#precompile-library)
+    - [Building Example](#building-example)
+    - [Building Tests](#building-tests)
+  - [Features](#features)
+    - [Parsing a File](#parsing-a-file)
+    - [finding a value](#finding-a-value)
+    - [comments](#comments)
+    - [error messages](#error-messages)
+    - [serialization](#serialization)
+    - [Configuring Types](#configuring-types)
+  - [Examples](#examples)
+  - [Changes from v3](#changes-from-v3)
+    - [Breaking Changes](#breaking-changes)
+    - [Added features](#added-features)
+  - [Contributors](#contributors)
+  - [Licensing terms](#licensing-terms)
+
+## Integration
+
+There are several ways to use toml11.
+
+Here is a brief overview of each method. For more details, please refer to the [documentation](https://toruniina.github.io/toml11/docs/installation/).
+
+### Single Include File
+
+Copy `single_include/toml.hpp` to your preferred location and add it to your include path.
+
+### git submodule
+
+By adding toml11 as a subdirectory using `git submodule` (or any other way),
+you can either add `toml11/include` to your include path or use `add_subdirectory(toml11)` in your CMake project.
+
+### CMake `FetchContent`
+
+Using `FetchContent`, you can automatically download it.
+
+```cmake
+include(FetchContent)
+FetchContent_Declare(
+  toml11
+  GIT_REPOSITORY https://github.com/ToruNiina/toml11.git
+  GIT_TAG        v4.4.0
+)
+FetchContent_MakeAvailable(toml11)
+
+add_executable(main main.cpp)
+target_link_libraries(main PRIVATE toml11::toml11)
+```
+
+### CMake Package Manager (CPM)
+
+After [adding cpm to your project](https://github.com/cpm-cmake/CPM.cmake?tab=readme-ov-file#adding-cpm), you can use toml11 by doing:
+
+```cmake
+include(cmake/CPM.cmake)
+
+CPMAddPackage("gh:ToruNiina/toml11@4.4.0")
+
+# OR
+
+CPMAddPackage(
+    NAME toml11
+    GITHUB_REPOSITORY "ToruNiina/toml11"
+    VERSION 4.4.0
+    OPTIONS
+    "TOML11_PRECOMPILE ON" # to pre-compile
+    "TOML11_ENABLE_ACCESS_CHECK ON" # to use value.accessed()
+    )
+
+add_executable(main main.cpp)
+target_link_libraries(main PUBLIC toml11::toml11)
+```
+
+### Install Using CMake
+
+You can install toml11 using CMake with the following steps:
+
+```console
+$ git clone https://github.com/ToruNiina/toml11
+$ cd toml11
+$ git submodule update --init --recursive
+$ cmake -B ./build/
+$ cmake --build ./build/
+$ cmake --install ./build/ --prefix /path/to/toml11
+```
+
+### Precompile Library
+
+By setting `-DTOML11_PRECOMPILE=ON`, you can precompile some of the library functions.
+In this case, the standard library features available will vary with the C++ version, and part of the interface will change.
+Therefore, you need to specify `CMAKE_CXX_STANDARD`.
+
+```console
+$ cmake -B ./build/ -DTOML11_PRECOMPILE=ON -DCMAKE_CXX_STANDARD=11/14/17/20
+$ cmake --build ./build/
+```
+
+When linking the library, use `target_link_libraries` in CMake
+
+```cmake
+target_link_libraries(your_target PUBLIC toml11::toml11)
+```
+
+or pass `-DTOML11_COMPILE_SOURCES` to the compiler.
+
+### Building Example
+
+To compile the examples in the `examples/` directory, set `-DTOML11_BUILD_EXAMPLES=ON`.
+
+```console
+$ cmake -B ./build/ -DTOML11_BUILD_EXAMPLES=ON
+$ cmake --build ./build/
+```
+
+### Building Tests
+
+To compile unit tests, set `-DTOML11_BUILD_TESTS=ON`.
+Additionally, to compile the encoder and decoder for toml-test, set `-DTOML11_BUILD_TOML_TESTS=ON`.
+
+```console
+$ cmake -B ./build/ -DTOML11_BUILD_EXAMPLES=ON
+$ cmake --build ./build/
+```
+
+## Features
+
+Here is a brief overview of the features provided by toml11.
+
+For more details, please refer to the [documentation](https://toruniina.github.io/toml11/docs/features/).
+
+### Parsing a File
+
+To parse a file, use `toml::parse`.
+
+The overall type of the file is always a table.
+However, since `toml::value` contains metadata such as comments and formatting information,
+`toml::parse` returns a `toml::value` rather than a `toml::table`.
+
+```cpp
+const toml::value input = toml::parse("input.toml");
+```
+
+To parse a string directly, use `toml::parse_str`.
+
+```cpp
+const toml::value input = toml::parse_str("a = 42");
+```
+
+When parsing string literals, you can use the `""_toml` literal.
+
+```cpp
+using namespace toml::literals::toml_literals;
+const toml::value lit = "a = 42"_toml;
+```
+
+`toml::parse`, `parse_str` and `_toml` literal throw a `toml::syntax_error` exception in case of a syntax error.
+
+The error message obtained with `what()` will look like this:
+
+```
+[error] bad integer: `_` must be surrounded by digits
+ --> internal string at line 64 in file main.cpp
+   |
+ 1 | a = 123__456
+   |        ^-- invalid underscore
+Hint: valid  : -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755
+Hint: invalid: _42, 1__000, 0123
+```
+
+Error messages can also be colorized by calling `toml::color::enable()`.
+
+By using `toml::try_parse`, you can receive a `toml::result<toml::value, std::vector<toml::error_info>>` without throwing exceptions.
+
+```cpp
+const auto input = toml::try_parse("input.toml");
+if(input.is_ok())
+{
+    std::cout << input.unwrap().at("a").as_integer() << std::endl;
+}
+```
+
+Additionally, toml11 allows easy and precise control over the version of the TOML language being used.
+
+You can enable specific new features from TOML v1.1.0 while using TOML v1.0.0.
+
+```cpp
+toml::spec s = toml::spec::v(1, 0, 0);
+s.v1_1_0_allow_trailing_comma_in_inline_tables = true;
+
+const toml::value input = toml::parse("input.toml");
+```
+
+Moreover, several language extensions not included in the TOML standard are available.
+
+```cpp
+toml::spec s = toml::spec::v(1, 0, 0);
+s.ext_hex_float  = true; // this allows hexadecimal floating-point numbers
+s.ext_null_value = true; // this allows `key = null` value
+s.ext_num_suffix = true; // this allows numeric suffixes like `100_msec`
+```
+
+For more detail and reference of each feature, please refer to the [documentation](https://toruniina.github.io/toml11/docs/features/).
+
+### finding a value
+
+`toml::value` provides member functions for accessing values, such as `at()`, `is_xxx()`, and `as_xxx()`.
+
+```cpp
+const toml::value input = toml::parse("input.toml");
+if(input.contains("a") && input.at("a").is_integer())
+{
+    std::cout << input.at("a").as_integer() << std::endl;
+}
+```
+
+By using `toml::find`, you can perform type conversion and search simultaneously.
+
+```cpp
+const toml::value input = toml::parse("input.toml");
+std::cout << toml::find<int>(input, "a") << std::endl;
+```
+
+If type conversion or value lookup fails, a `toml::type_error` is thrown. The error message will look like this:
+
+```
+[error] toml::value::as_string(): bad_cast to string
+ --> input.toml
+   |
+ 1 | a = 123_456
+   |     ^^^^^^^-- the actual type is integer
+```
+
+You can access nested tables or arrays of tables in the same way.
+
+```cpp
+// [a]
+// b = [
+//   {c = 42},
+//   {c = 54}
+// ]
+const toml::value input = toml::parse("input.toml");
+std::cout << toml::find<int>(input, "a", "b", 1, "c") << std::endl;
+```
+
+Most STL containers and those with similar interfaces can be converted.
+
+```cpp
+// array = [3,1,4,1,5]
+const toml::value input = toml::parse("input.toml");
+
+const auto a1 = toml::find<std::vector<int>>(input, "array");
+const auto a2 = toml::find<std::array<int, 5>>(input, "array");
+const auto a3 = toml::find<std::deque<int>>(input, "array");
+const auto a4 = toml::find<boost::container::small_vector<int, 8>>(input, "array");
+```
+
+You can perform advanced type conversions on complex TOML values.
+
+```toml
+mixed_array = [
+    42,
+    3.14,
+    {a = "foo", b = "bar"}
+]
+```
+
+```cpp
+const toml::value input = toml::parse("input.toml");
+
+const auto mixed = toml::find<
+        std::tuple<int, double, std::map<std::string, std::string>>
+    >(input, "mixed_array") << std::endl;
+```
+
+User-defined types can also be converted by using macros or defining some specific functions.
+
+```cpp
+namespace extlib
+{
+struct foo
+{
+    int a;
+    std::string b;
+};
+} // extlib
+TOML11_DEFINE_CONVERSION_NON_INTRUSIVE(extlib::foo, a, b)
+
+// ...
+
+const auto input = R"(
+  [foo]
+  a = 42
+  b = "bar"
+)"_toml;
+const extlib::foo f = toml::find<extlib::foo>(input, "foo");
+```
+
+Using `toml::find_or`, you can get a default value in case of failure.
+
+```cpp
+const toml::value input = toml::parse("input.toml");
+std::cout << toml::find_or(input, "a", 6*9) << std::endl;
+```
+
+For more details, please refer to the [documentation](https://toruniina.github.io/toml11/docs/features/value/).
+
+### comments
+
+toml11 stores comments related to values within the value itself.
+
+Comments related to a value include a series of comments written immediately before the value
+and any comments written after the value without a newline in between.
+
+```toml
+# This is a comment for a.
+# This is also a comment for a.
+a = 42 # This is also a comment for a.
+
+# This is separated by a newline, so it is not a comment for b.
+
+# This is a comment for b.
+b = "foo"
+```
+
+These comments are stored in `toml::value` with an interface similar to `std::vector<std::string>`.
+
+```cpp
+const toml::value input = toml::parse("input.toml");
+std::cout << input.at("a").comments().size() << std::endl;
+std::cout << input.at("a").comments().at(0) << std::endl;
+```
+
+For more details, please refer to the [documentation](https://toruniina.github.io/toml11/docs/features/value/#accessing-comments).
+
+### error messages
+
+One of the goals of toml11 is to provide clear and understandable error messages.
+
+For parsing errors, you might see an error message like the following:
+
+```
+[error] bad integer: `_` must be surrounded by digits
+ --> internal string at line 64 in file main.cpp
+   |
+ 1 | a = 123__456
+   |        ^-- invalid underscore
+Hint: valid  : -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755
+Hint: invalid: _42, 1__000, 0123
+```
+
+If you request a type different from the actual stored type, an error message like this will be displayed:
+
+```
+[error] toml::value::as_string(): bad_cast to string
+ --> input.toml
+   |
+ 1 | a = 123_456
+   |     ^^^^^^^-- the actual type is integer
+```
+
+Such error messages can also be produced for user-specific algorithm that is not related to TOML syntax.
+
+```cpp
+const toml::value& a = input.at("a");
+if(a.as_integer() < 0)
+{
+    const toml::error_info err = toml::make_error_info(
+            "positive integer is required",
+            a, "but got negative value"
+        );
+    std::cerr << toml::format_error(err) << std::endl;
+}
+```
+
+For more details, please refer to the [documentation](https://toruniina.github.io/toml11/docs/features/error_message/).
+
+### serialization
+
+You can format a `toml::value` into a `std::string` using `toml::format`.
+
+```cpp
+const toml::value input = toml::parse("input.toml");
+std::cout << toml::format(input) << std::endl;
+```
+
+`toml::format` references the formatting information, allowing you to change the formatting method.
+
+```cpp
+toml::value output(toml::table{ {"a", 0xDEADBEEF} });
+output.at("a").as_integer_fmt().fmt = toml::integer_format::hex;
+output.at("a").as_integer_fmt().spacer = 4; // position of `_`
+
+std::cout << toml::format(input) << std::endl;
+// a = 0xdead_beef
+```
+
+You can also specify the formatting for tables and arrays.
+
+```cpp
+toml::value output(toml::table{
+  {"array-of-tables", toml::array{}},
+  {"subtable", toml::table{}},
+});
+
+auto& aot = output.at("array-of-tables");
+aot.as_array_fmt().fmt = toml::array_format::multiline; // one element per line
+aot.as_array_fmt().body_indent    = 4;
+aot.as_array_fmt().closing_indent = 2;
+
+toml::value v1(toml::table{ {"a", 42}, {"b", 3.14} });
+v1.as_table_fmt().fmt = toml::table_format::oneline;
+aot.push_back(std::move(v1));
+
+toml::value v2(toml::table{ {"a", 42}, {"b", 3.14} });
+v2.as_table_fmt().fmt = toml::table_format::oneline;
+aot.push_back(std::move(v2));
+
+output.at("subtable").as_table_fmt().fmt = toml::table_format::dotted;
+output.at("subtable")["a"] = 42;
+output.at("subtable")["b"] = 3.14;
+
+std::cout << toml::format(output) << std::endl;
+// subtable.b = 3.14
+// subtable.a = 42
+// array-of-tables = [
+//     {b = 3.14, a = 42},
+//     {b = 3.14, a = 42},
+//   ]
+```
+
+These settings are read during parsing and will be maintained as long as the value type does not change when modified.
+
+For details on possible formatting specifications, please refer to the [documentation](https://toruniina.github.io/toml11/docs/features/serialize/).
+
+### Configuring Types
+
+Many types in `toml::value`, such as `integer_type`, `array_type`, `table_type`, etc, can be modified by changing the `type_config` type.
+
+One commonly used example is an `ordered_map` that keeps the added order.
+toml11 provides a`type_config` that changes `table_type` to `ordered_map` as `toml::ordered_type_config`.
+
+```cpp
+const toml::ordered_value input = toml::parse<toml::ordered_type_config>("input.toml");
+```
+
+Here, `toml::ordered_value` is an alias of `toml::basic_value<toml::ordered_type_config>`.
+
+Note that, since `toml::value` uses `std::unordered_map`, once you convert it to `toml::value`, then the order of the values will be randomized.
+
+For more details about how to implement `type_config` variant, please refer to the [documentation](https://toruniina.github.io/toml11/docs/features/configure_types/).
+
+Also, refer to the [`examples` directory](https://github.com/ToruNiina/toml11/tree/main/examples) for complex use cases such as using multi-precision integers, changing containers, and normalizing Unicode.
+Use these examples as references for implementing such configurations.
+
+## Examples
+
+The [`examples`](https://github.com/ToruNiina/toml11/tree/main/examples) directory provides various implementation examples in addition to type configurations.
+
+- [boost_container](https://github.com/ToruNiina/toml11/tree/main/examples/boost_container)
+  - This example shows how to use `boost::container` containers for `array_type` and `table_type`.
+- [boost_multiprecision](https://github.com/ToruNiina/toml11/tree/main/examples/boost_multiprecision)
+  - This example demonstrates the use of `boost::multiprecision` multi-precision numeric types for `integer_type` and `floating_type`.
+- [parse_file](https://github.com/ToruNiina/toml11/tree/main/examples/parse_file)
+  - This example includes type conversion implementations, covering slightly more complex cases. The corresponding TOML file is included.
+- [reflect](https://github.com/ToruNiina/toml11/tree/main/examples/reflect)
+  - This example shows self-type conversion using boost-ext/reflect for user-defined types.
+- [unicode](https://github.com/ToruNiina/toml11/tree/main/examples/unicode)
+  - This example demonstrates normalizing Unicode strings when searching for keys using uni-algo.
+
+## Changes from v3
+
+toml11 v4 introduces several breaking changes.
+
+Efforts have been made to minimize the need for changes for those using simple functionality.
+However, if you were utilizing advanced features, some adjustments may be necessary.
+
+Nevertheless, we believe that the added or streamlined features will provide enhanced convenience in return.
+
+### Breaking Changes
+
+- Changed branch from `master` to `main`.
+- Changed template arguments of `toml::basic_value`.
+- Removed `toml::string` and explicitly store formatting information of all the values.
+- Modified arguments of `toml::format` to accommodate formatting information.
+- Changed default arguments of `toml::parse` to take `toml::spec` for specifying TOML version information.
+- Updated the interface of `toml::source_location` to accommodate multiline regions.
+- Modified arguments of `toml::format_error`.
+- Renamed `toml::format_underline` to `toml::format_location`.
+- Unified control method of `toml::color` to `toml::color::enable/disable()`.
+
+### Added features
+
+- Added `toml::parse_str`.
+- Added `toml::try_parse`.
+- Added support for parsing byte sequences.
+- Added formatting information to `toml::value`.
+- Changed to saving comments in `toml::value` by default.
+- Added `single_include/toml.hpp`.
+- Enabled to use as a precompiled library.
+
+## Contributors
+
+I appreciate the help of the contributors who introduced the great feature to this library.
+
+- Guillaume Fraux (@Luthaf)
+  - Windows support and CI on Appvayor
+  - Intel Compiler support
+- Quentin Khan (@xaxousis)
+  - Found & Fixed a bug around ODR
+  - Improved error messages for invalid keys to show the location where the parser fails
+- Petr Beneš (@wbenny)
+  - Fixed warnings on MSVC
+- Ivan Shynkarenka (@chronoxor)
+  - Fixed Visual Studio 2019 warnings
+  - Fix compilation error in `<filesystem>` with MinGW
+- Khoi Dinh Trinh (@khoitd1997)
+  - Fixed warnings while type conversion
+- @KerstinKeller
+  - Added installation script to CMake
+- J.C. Moyer (@jcmoyer)
+  - Fixed an example code in the documentation
+- Jt Freeman (@blockparty-sh)
+  - Fixed feature test macro around `localtime_s`
+  - Suppress warnings in Debug mode
+- OGAWA Kenichi (@kenichiice)
+  - Suppress warnings on intel compiler
+  - Fix include path in README
+- Jordan Williams (@jwillikers)
+  - Fixed clang range-loop-analysis warnings
+  - Fixed feature test macro to suppress -Wundef
+  - Use cache variables in CMakeLists.txt
+  - Automate test set fetching, update and refactor CMakeLists.txt
+- Scott McCaskill
+  - Parse 9 digits (nanoseconds) of fractional seconds in a `local_time`
+- Shu Wang (@halfelf)
+  - fix "Finding a value in an array" example in README
+- @maass-tv and @SeverinLeonhardt
+  - Fix MSVC warning C4866
+- Mohammed Alyousef (@MoAlyousef)
+  - Made testing optional in CMake
+- Alex Merry (@amerry)
+  - Add missing include files
+- sneakypete81 (@sneakypete81)
+  - Fix typo in error message
+- Oliver Kahrmann (@founderio)
+  - Fix missing filename in error message if parsed file is empty
+- Karl Nilsson (@karl-nilsson)
+  - Fix many spelling errors
+- ohdarling88 (@ohdarling)
+  - Fix a bug in a constructor of serializer
+- estshorter (@estshorter)
+  - Fix MSVC warning C26478
+- Philip Top (@phlptp)
+  - Improve checking standard library feature availability check
+- Louis Marascio (@marascio)
+  - Fix free-nonheap-object warning
+- Axel Huebl (@ax3l)
+  - Make installation optional if the library is embedded
+- Ken Matsui (@ken-matsui)
+  - Support user-defined error message prefix
+  - Support dynamic color mode
+  - Support `std::optional` members for `TOML11_DEFINE_CONVERSION_NON_INTRUSIVE`
+  - Make `thread_local` for `color_mode` optional
+  - Add `toml::find_or_default`
+  - Fix static assertions in success that checks if specified type is void
+- Giel van Schijndel (@muggenhor)
+  - Remove needless copy in `parse` function
+- Lukáš Hrázký (@lukash)
+  - Add a `parse(FILE *)` interface and improve file-related error messages
+- spiderman idog (@spiderman-idog)
+  - Fix typo in README
+- Jajauma's GitHub (@Jajauma)
+  - Avoid possible lexer truncation warnings
+- Moritz Klammler (@ctcmkl)
+  - Many patches in (#200) including:
+  - Improve CMake scripts, build process, and test file handling
+  - Detect error when `discard_comments` is accessed
+  - And more.
+- Chris White (@cxw42)
+  - Fix address-sanitizer error when parsing literal strings having invalid UTF-8 characters
+  - Fix function name in error messages
+- offa (@offa)
+  - Update checkout action to v3
+  - Update Required CMake version
+  - Cleanup old CI settings
+- Sergey Vidyuk (@VestniK)
+  - Fix for case when vector iterator is raw pointer
+- Kfir Gollan (@kfirgollan)
+  - Add installation example with checkinstall and cmake
+- Martin Tournoij (@arp242)
+  - Escape control characters in keys
+- @DavidKorczynski
+  - Add fuzzing test based on ClusterFuzzLite
+- Esonhugh Skyworship (@Esonhugh)
+  - Fix function signature of `strerror_r` on macos
+- Alberto (@0X1A)
+  - Fix issues with CMake package configuration when used with vcpkg
+- Egor Pugin (@egorpugin)
+  - Fix incorrect operator<<() argument type that gives build error
+- Andreas Keller (@andreaskeller96)
+  - Fix not checking for \r\n when parsing line comments
+- 萧迩珀 (@CDK6182CHR)
+  - Support template into_toml members
+- Pino Toscano (@pinotree)
+  - Suppress warnings by manually cast file size to `std::streamsize`
+- Jack W (@jackwil1)
+  - Fix typos in documentation template syntax
+- amatej (@kontura)
+  - Fix: `toml::detail::region::last_` may be used uninitialized
+- Severin Leonhardt (@SeverinLeonhardt)
+  - Fix use with CMake 3.21 and older
+- hayt (@hayt)
+  - fix: prevent size_t-max length string allocation
+- somebody (@oldoldtea), (lz)
+  - Update README for better ToC, fixing example code
+- Sunlight (@SunPodder)
+  - Add `erase(...)` function to `ordered_map`
+
+## Licensing terms
+
+This product is licensed under the terms of the [MIT License](LICENSE).
+
+- Copyright (c) 2017-2024 Toru Niina
+
+All rights reserved.
diff --git a/runtime/third_party/toml11/toml.hpp b/runtime/third_party/toml11/toml.hpp
new file mode 100644
index 0000000..ee7f9cf
--- /dev/null
+++ b/runtime/third_party/toml11/toml.hpp
@@ -0,0 +1,18162 @@
+#ifndef TOML11_VERSION_HPP
+#define TOML11_VERSION_HPP
+
+#define TOML11_VERSION_MAJOR 4
+#define TOML11_VERSION_MINOR 4
+#define TOML11_VERSION_PATCH 0
+
+#ifndef __cplusplus
+#    error "__cplusplus is not defined"
+#endif
+
+// Since MSVC does not define `__cplusplus` correctly unless you pass
+// `/Zc:__cplusplus` when compiling, the workaround macros are added.
+//
+// The value of `__cplusplus` macro is defined in the C++ standard spec, but
+// MSVC ignores the value, maybe because of backward compatibility. Instead,
+// MSVC defines _MSVC_LANG that has the same value as __cplusplus defined in
+// the C++ standard. So we check if _MSVC_LANG is defined before using `__cplusplus`.
+//
+// FYI: https://docs.microsoft.com/en-us/cpp/build/reference/zc-cplusplus?view=msvc-170
+//      https://docs.microsoft.com/en-us/cpp/preprocessor/predefined-macros?view=msvc-170
+//
+
+#if defined(_MSVC_LANG) && defined(_MSC_VER) && 190024210 <= _MSC_FULL_VER
+#  define TOML11_CPLUSPLUS_STANDARD_VERSION _MSVC_LANG
+#else
+#  define TOML11_CPLUSPLUS_STANDARD_VERSION __cplusplus
+#endif
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION < 201103L
+#    error "toml11 requires C++11 or later."
+#endif
+
+#if ! defined(__has_include)
+#  define __has_include(x) 0
+#endif
+
+#if ! defined(__has_cpp_attribute)
+#  define __has_cpp_attribute(x) 0
+#endif
+
+#if ! defined(__has_builtin)
+#  define __has_builtin(x) 0
+#endif
+
+// hard to remember
+
+#ifndef TOML11_CXX14_VALUE
+#define TOML11_CXX14_VALUE 201402L
+#endif//TOML11_CXX14_VALUE
+
+#ifndef TOML11_CXX17_VALUE
+#define TOML11_CXX17_VALUE 201703L
+#endif//TOML11_CXX17_VALUE
+
+#ifndef TOML11_CXX20_VALUE
+#define TOML11_CXX20_VALUE 202002L
+#endif//TOML11_CXX20_VALUE
+
+#if defined(__cpp_char8_t)
+#  if __cpp_char8_t >= 201811L
+#    define TOML11_HAS_CHAR8_T 1
+#  endif
+#endif
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX17_VALUE
+#  if __has_include(<string_view>)
+#    define TOML11_HAS_STRING_VIEW 1
+#  endif
+#endif
+
+#ifndef TOML11_DISABLE_STD_FILESYSTEM
+#  if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX17_VALUE
+#    if __has_include(<filesystem>)
+#      define TOML11_HAS_FILESYSTEM 1
+#    endif
+#  endif
+#endif
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX17_VALUE
+#  if __has_include(<optional>)
+#    define TOML11_HAS_OPTIONAL 1
+#  endif
+#endif
+
+#if defined(TOML11_COMPILE_SOURCES)
+#  define TOML11_INLINE
+#else
+#  define TOML11_INLINE inline
+#endif
+
+namespace toml
+{
+
+inline const char* license_notice() noexcept
+{
+    return R"(The MIT License (MIT)
+
+Copyright (c) 2017-now Toru Niina
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.)";
+}
+
+} // toml
+#endif // TOML11_VERSION_HPP
+#ifndef TOML11_FORMAT_HPP
+#define TOML11_FORMAT_HPP
+
+#ifndef TOML11_FORMAT_FWD_HPP
+#define TOML11_FORMAT_FWD_HPP
+
+#include <iosfwd>
+#include <string>
+#include <utility>
+
+#include <cstddef>
+#include <cstdint>
+
+namespace toml
+{
+
+// toml types with serialization info
+
+enum class indent_char : std::uint8_t
+{
+    space, // use space
+    tab,   // use tab
+    none   // no indent
+};
+
+std::ostream& operator<<(std::ostream& os, const indent_char& c);
+std::string to_string(const indent_char c);
+
+// ----------------------------------------------------------------------------
+// boolean
+
+struct boolean_format_info
+{
+    // nothing, for now
+};
+
+inline bool operator==(const boolean_format_info&, const boolean_format_info&) noexcept
+{
+    return true;
+}
+inline bool operator!=(const boolean_format_info&, const boolean_format_info&) noexcept
+{
+    return false;
+}
+
+// ----------------------------------------------------------------------------
+// integer
+
+enum class integer_format : std::uint8_t
+{
+    dec = 0,
+    bin = 1,
+    oct = 2,
+    hex = 3,
+};
+
+std::ostream& operator<<(std::ostream& os, const integer_format f);
+std::string to_string(const integer_format);
+
+struct integer_format_info
+{
+    integer_format fmt = integer_format::dec;
+    bool        uppercase = true; // hex with uppercase
+    std::size_t width     = 0;    // minimal width (may exceed)
+    std::size_t spacer    = 0;    // position of `_` (if 0, no spacer)
+    std::string suffix    = "";   // _suffix (library extension)
+};
+
+bool operator==(const integer_format_info&, const integer_format_info&) noexcept;
+bool operator!=(const integer_format_info&, const integer_format_info&) noexcept;
+
+// ----------------------------------------------------------------------------
+// floating
+
+enum class floating_format : std::uint8_t
+{
+    defaultfloat = 0,
+    fixed        = 1, // does not include exponential part
+    scientific   = 2, // always include exponential part
+    hex          = 3  // hexfloat extension
+};
+
+std::ostream& operator<<(std::ostream& os, const floating_format f);
+std::string to_string(const floating_format);
+
+struct floating_format_info
+{
+    floating_format fmt = floating_format::defaultfloat;
+    std::size_t prec  = 0;        // precision (if 0, use the default)
+    std::string suffix = "";      // 1.0e+2_suffix (library extension)
+};
+
+bool operator==(const floating_format_info&, const floating_format_info&) noexcept;
+bool operator!=(const floating_format_info&, const floating_format_info&) noexcept;
+
+// ----------------------------------------------------------------------------
+// string
+
+enum class string_format : std::uint8_t
+{
+    basic             = 0,
+    literal           = 1,
+    multiline_basic   = 2,
+    multiline_literal = 3
+};
+
+std::ostream& operator<<(std::ostream& os, const string_format f);
+std::string to_string(const string_format);
+
+struct string_format_info
+{
+    string_format fmt = string_format::basic;
+    bool start_with_newline    = false;
+};
+
+bool operator==(const string_format_info&, const string_format_info&) noexcept;
+bool operator!=(const string_format_info&, const string_format_info&) noexcept;
+
+// ----------------------------------------------------------------------------
+// datetime
+
+enum class datetime_delimiter_kind : std::uint8_t
+{
+    upper_T = 0,
+    lower_t = 1,
+    space   = 2,
+};
+std::ostream& operator<<(std::ostream& os, const datetime_delimiter_kind d);
+std::string to_string(const datetime_delimiter_kind);
+
+struct offset_datetime_format_info
+{
+    datetime_delimiter_kind delimiter = datetime_delimiter_kind::upper_T;
+    bool has_seconds = true;
+    std::size_t subsecond_precision = 6; // [us]
+};
+
+bool operator==(const offset_datetime_format_info&, const offset_datetime_format_info&) noexcept;
+bool operator!=(const offset_datetime_format_info&, const offset_datetime_format_info&) noexcept;
+
+struct local_datetime_format_info
+{
+    datetime_delimiter_kind delimiter = datetime_delimiter_kind::upper_T;
+    bool has_seconds = true;
+    std::size_t subsecond_precision = 6; // [us]
+};
+
+bool operator==(const local_datetime_format_info&, const local_datetime_format_info&) noexcept;
+bool operator!=(const local_datetime_format_info&, const local_datetime_format_info&) noexcept;
+
+struct local_date_format_info
+{
+    // nothing, for now
+};
+
+bool operator==(const local_date_format_info&, const local_date_format_info&) noexcept;
+bool operator!=(const local_date_format_info&, const local_date_format_info&) noexcept;
+
+struct local_time_format_info
+{
+    bool has_seconds = true;
+    std::size_t subsecond_precision = 6; // [us]
+};
+
+bool operator==(const local_time_format_info&, const local_time_format_info&) noexcept;
+bool operator!=(const local_time_format_info&, const local_time_format_info&) noexcept;
+
+// ----------------------------------------------------------------------------
+// array
+
+enum class array_format : std::uint8_t
+{
+    default_format  = 0,
+    oneline         = 1,
+    multiline       = 2,
+    array_of_tables = 3 // [[format.in.this.way]]
+};
+
+std::ostream& operator<<(std::ostream& os, const array_format f);
+std::string to_string(const array_format);
+
+struct array_format_info
+{
+    array_format fmt            = array_format::default_format;
+    indent_char  indent_type    = indent_char::space;
+    std::int32_t body_indent    = 4; // indent in case of multiline
+    std::int32_t closing_indent = 0; // indent of `]`
+};
+
+bool operator==(const array_format_info&, const array_format_info&) noexcept;
+bool operator!=(const array_format_info&, const array_format_info&) noexcept;
+
+// ----------------------------------------------------------------------------
+// table
+
+enum class table_format : std::uint8_t
+{
+    multiline         = 0, // [foo] \n bar = "baz"
+    oneline           = 1, // foo = {bar = "baz"}
+    dotted            = 2, // foo.bar = "baz"
+    multiline_oneline = 3, // foo = { \n bar = "baz" \n }
+    implicit          = 4  // [x] defined by [x.y.z]. skip in serializer.
+};
+
+std::ostream& operator<<(std::ostream& os, const table_format f);
+std::string to_string(const table_format);
+
+struct table_format_info
+{
+    table_format fmt = table_format::multiline;
+    indent_char  indent_type    = indent_char::space;
+    std::int32_t body_indent    = 0; // indent of values
+    std::int32_t name_indent    = 0; // indent of [table]
+    std::int32_t closing_indent = 0; // in case of {inline-table}
+};
+
+bool operator==(const table_format_info&, const table_format_info&) noexcept;
+bool operator!=(const table_format_info&, const table_format_info&) noexcept;
+
+// ----------------------------------------------------------------------------
+// wrapper
+
+namespace detail
+{
+template<typename T, typename F>
+struct value_with_format
+{
+    using value_type  = T;
+    using format_type = F;
+
+    value_with_format()  = default;
+    ~value_with_format() = default;
+    value_with_format(const value_with_format&) = default;
+    value_with_format(value_with_format&&)      = default;
+    value_with_format& operator=(const value_with_format&) = default;
+    value_with_format& operator=(value_with_format&&)      = default;
+
+    value_with_format(value_type v, format_type f)
+        : value{std::move(v)}, format{std::move(f)}
+    {}
+
+    template<typename U>
+    value_with_format(value_with_format<U, format_type> other)
+        : value{std::move(other.value)}, format{std::move(other.format)}
+    {}
+
+    value_type  value;
+    format_type format;
+};
+} // detail
+
+} // namespace toml
+#endif // TOML11_FORMAT_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_FORMAT_IMPL_HPP
+#define TOML11_FORMAT_IMPL_HPP
+
+
+#include <ostream>
+#include <sstream>
+
+namespace toml
+{
+
+// toml types with serialization info
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const indent_char& c)
+{
+    switch(c)
+    {
+        case indent_char::space:         {os << "space"        ; break;}
+        case indent_char::tab:           {os << "tab"          ; break;}
+        case indent_char::none:          {os << "none"         ; break;}
+        default:
+        {
+            os << "unknown indent char: " << static_cast<std::uint8_t>(c);
+        }
+    }
+    return os;
+}
+
+TOML11_INLINE std::string to_string(const indent_char c)
+{
+    std::ostringstream oss;
+    oss << c;
+    return oss.str();
+}
+
+// ----------------------------------------------------------------------------
+// boolean
+
+// ----------------------------------------------------------------------------
+// integer
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const integer_format f)
+{
+    switch(f)
+    {
+        case integer_format::dec: {os << "dec"; break;}
+        case integer_format::bin: {os << "bin"; break;}
+        case integer_format::oct: {os << "oct"; break;}
+        case integer_format::hex: {os << "hex"; break;}
+        default:
+        {
+            os << "unknown integer_format: " << static_cast<std::uint8_t>(f);
+            break;
+        }
+    }
+    return os;
+}
+TOML11_INLINE std::string to_string(const integer_format c)
+{
+    std::ostringstream oss;
+    oss << c;
+    return oss.str();
+}
+
+
+TOML11_INLINE bool operator==(const integer_format_info& lhs, const integer_format_info& rhs) noexcept
+{
+    return lhs.fmt       == rhs.fmt    &&
+           lhs.uppercase == rhs.uppercase &&
+           lhs.width     == rhs.width  &&
+           lhs.spacer    == rhs.spacer &&
+           lhs.suffix    == rhs.suffix ;
+}
+TOML11_INLINE bool operator!=(const integer_format_info& lhs, const integer_format_info& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
+// ----------------------------------------------------------------------------
+// floating
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const floating_format f)
+{
+    switch(f)
+    {
+        case floating_format::defaultfloat: {os << "defaultfloat"; break;}
+        case floating_format::fixed       : {os << "fixed"       ; break;}
+        case floating_format::scientific  : {os << "scientific"  ; break;}
+        case floating_format::hex         : {os << "hex"         ; break;}
+        default:
+        {
+            os << "unknown floating_format: " << static_cast<std::uint8_t>(f);
+            break;
+        }
+    }
+    return os;
+}
+TOML11_INLINE std::string to_string(const floating_format c)
+{
+    std::ostringstream oss;
+    oss << c;
+    return oss.str();
+}
+
+TOML11_INLINE bool operator==(const floating_format_info& lhs, const floating_format_info& rhs) noexcept
+{
+    return lhs.fmt          == rhs.fmt          &&
+           lhs.prec         == rhs.prec         &&
+           lhs.suffix       == rhs.suffix       ;
+}
+TOML11_INLINE bool operator!=(const floating_format_info& lhs, const floating_format_info& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
+// ----------------------------------------------------------------------------
+// string
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const string_format f)
+{
+    switch(f)
+    {
+        case string_format::basic            : {os << "basic"            ; break;}
+        case string_format::literal          : {os << "literal"          ; break;}
+        case string_format::multiline_basic  : {os << "multiline_basic"  ; break;}
+        case string_format::multiline_literal: {os << "multiline_literal"; break;}
+        default:
+        {
+            os << "unknown string_format: " << static_cast<std::uint8_t>(f);
+            break;
+        }
+    }
+    return os;
+}
+TOML11_INLINE std::string to_string(const string_format c)
+{
+    std::ostringstream oss;
+    oss << c;
+    return oss.str();
+}
+
+TOML11_INLINE bool operator==(const string_format_info& lhs, const string_format_info& rhs) noexcept
+{
+    return lhs.fmt                == rhs.fmt                &&
+           lhs.start_with_newline == rhs.start_with_newline ;
+}
+TOML11_INLINE bool operator!=(const string_format_info& lhs, const string_format_info& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+// ----------------------------------------------------------------------------
+// datetime
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const datetime_delimiter_kind d)
+{
+    switch(d)
+    {
+        case datetime_delimiter_kind::upper_T: { os << "upper_T, "; break; }
+        case datetime_delimiter_kind::lower_t: { os << "lower_t, "; break; }
+        case datetime_delimiter_kind::space:   { os << "space, ";   break; }
+        default:
+        {
+            os << "unknown datetime delimiter: " << static_cast<std::uint8_t>(d);
+            break;
+        }
+    }
+    return os;
+}
+TOML11_INLINE std::string to_string(const datetime_delimiter_kind c)
+{
+    std::ostringstream oss;
+    oss << c;
+    return oss.str();
+}
+
+TOML11_INLINE bool operator==(const offset_datetime_format_info& lhs, const offset_datetime_format_info& rhs) noexcept
+{
+    return lhs.delimiter           == rhs.delimiter   &&
+           lhs.has_seconds         == rhs.has_seconds &&
+           lhs.subsecond_precision == rhs.subsecond_precision ;
+}
+TOML11_INLINE bool operator!=(const offset_datetime_format_info& lhs, const offset_datetime_format_info& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
+TOML11_INLINE bool operator==(const local_datetime_format_info& lhs, const local_datetime_format_info& rhs) noexcept
+{
+    return lhs.delimiter           == rhs.delimiter   &&
+           lhs.has_seconds         == rhs.has_seconds &&
+           lhs.subsecond_precision == rhs.subsecond_precision ;
+}
+TOML11_INLINE bool operator!=(const local_datetime_format_info& lhs, const local_datetime_format_info& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
+TOML11_INLINE bool operator==(const local_date_format_info&, const local_date_format_info&) noexcept
+{
+    return true;
+}
+TOML11_INLINE bool operator!=(const local_date_format_info& lhs, const local_date_format_info& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
+TOML11_INLINE bool operator==(const local_time_format_info& lhs, const local_time_format_info& rhs) noexcept
+{
+    return lhs.has_seconds         == rhs.has_seconds         &&
+           lhs.subsecond_precision == rhs.subsecond_precision ;
+}
+TOML11_INLINE bool operator!=(const local_time_format_info& lhs, const local_time_format_info& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
+// ----------------------------------------------------------------------------
+// array
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const array_format f)
+{
+    switch(f)
+    {
+        case array_format::default_format : {os << "default_format" ; break;}
+        case array_format::oneline        : {os << "oneline"        ; break;}
+        case array_format::multiline      : {os << "multiline"      ; break;}
+        case array_format::array_of_tables: {os << "array_of_tables"; break;}
+        default:
+        {
+            os << "unknown array_format: " << static_cast<std::uint8_t>(f);
+            break;
+        }
+    }
+    return os;
+}
+TOML11_INLINE std::string to_string(const array_format c)
+{
+    std::ostringstream oss;
+    oss << c;
+    return oss.str();
+}
+
+TOML11_INLINE bool operator==(const array_format_info& lhs, const array_format_info& rhs) noexcept
+{
+    return lhs.fmt            == rhs.fmt            &&
+           lhs.indent_type    == rhs.indent_type    &&
+           lhs.body_indent    == rhs.body_indent    &&
+           lhs.closing_indent == rhs.closing_indent ;
+}
+TOML11_INLINE bool operator!=(const array_format_info& lhs, const array_format_info& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
+// ----------------------------------------------------------------------------
+// table
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const table_format f)
+{
+    switch(f)
+    {
+        case table_format::multiline        : {os << "multiline"        ; break;}
+        case table_format::oneline          : {os << "oneline"          ; break;}
+        case table_format::dotted           : {os << "dotted"           ; break;}
+        case table_format::multiline_oneline: {os << "multiline_oneline"; break;}
+        case table_format::implicit         : {os << "implicit"         ; break;}
+        default:
+        {
+            os << "unknown table_format: " << static_cast<std::uint8_t>(f);
+            break;
+        }
+    }
+    return os;
+}
+TOML11_INLINE std::string to_string(const table_format c)
+{
+    std::ostringstream oss;
+    oss << c;
+    return oss.str();
+}
+
+TOML11_INLINE bool operator==(const table_format_info& lhs, const table_format_info& rhs) noexcept
+{
+    return lhs.fmt                == rhs.fmt              &&
+           lhs.indent_type        == rhs.indent_type      &&
+           lhs.body_indent        == rhs.body_indent      &&
+           lhs.name_indent        == rhs.name_indent      &&
+           lhs.closing_indent     == rhs.closing_indent   ;
+}
+TOML11_INLINE bool operator!=(const table_format_info& lhs, const table_format_info& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
+} // namespace toml
+#endif // TOML11_FORMAT_IMPL_HPP
+#endif
+
+#endif// TOML11_FORMAT_HPP
+#ifndef TOML11_DATETIME_HPP
+#define TOML11_DATETIME_HPP
+
+#ifndef TOML11_DATETIME_FWD_HPP
+#define TOML11_DATETIME_FWD_HPP
+
+#include <chrono>
+#include <iosfwd>
+#include <string>
+
+#include <cstdint>
+#include <cstdlib>
+#include <ctime>
+
+namespace toml
+{
+
+enum class month_t : std::uint8_t
+{
+    Jan =  0,
+    Feb =  1,
+    Mar =  2,
+    Apr =  3,
+    May =  4,
+    Jun =  5,
+    Jul =  6,
+    Aug =  7,
+    Sep =  8,
+    Oct =  9,
+    Nov = 10,
+    Dec = 11
+};
+
+// ----------------------------------------------------------------------------
+
+struct local_date
+{
+    std::int16_t year{0};   // A.D. (like, 2018)
+    std::uint8_t month{0};  // [0, 11]
+    std::uint8_t day{0};    // [1, 31]
+
+    local_date(int y, month_t m, int d)
+        : year {static_cast<std::int16_t>(y)},
+          month{static_cast<std::uint8_t>(m)},
+          day  {static_cast<std::uint8_t>(d)}
+    {}
+
+    explicit local_date(const std::tm& t)
+        : year {static_cast<std::int16_t>(t.tm_year + 1900)},
+          month{static_cast<std::uint8_t>(t.tm_mon)},
+          day  {static_cast<std::uint8_t>(t.tm_mday)}
+    {}
+
+    explicit local_date(const std::chrono::system_clock::time_point& tp);
+    explicit local_date(const std::time_t t);
+
+    operator std::chrono::system_clock::time_point() const;
+    operator std::time_t() const;
+
+    local_date() = default;
+    ~local_date() = default;
+    local_date(local_date const&) = default;
+    local_date(local_date&&)      = default;
+    local_date& operator=(local_date const&) = default;
+    local_date& operator=(local_date&&)      = default;
+};
+bool operator==(const local_date& lhs, const local_date& rhs);
+bool operator!=(const local_date& lhs, const local_date& rhs);
+bool operator< (const local_date& lhs, const local_date& rhs);
+bool operator<=(const local_date& lhs, const local_date& rhs);
+bool operator> (const local_date& lhs, const local_date& rhs);
+bool operator>=(const local_date& lhs, const local_date& rhs);
+
+std::ostream& operator<<(std::ostream& os, const local_date& date);
+std::string to_string(const local_date& date);
+
+// -----------------------------------------------------------------------------
+
+struct local_time
+{
+    std::uint8_t  hour{0};        // [0, 23]
+    std::uint8_t  minute{0};      // [0, 59]
+    std::uint8_t  second{0};      // [0, 60]
+    std::uint16_t millisecond{0}; // [0, 999]
+    std::uint16_t microsecond{0}; // [0, 999]
+    std::uint16_t nanosecond{0};  // [0, 999]
+
+    local_time(int h, int m, int s,
+               int ms = 0, int us = 0, int ns = 0)
+        : hour  {static_cast<std::uint8_t>(h)},
+          minute{static_cast<std::uint8_t>(m)},
+          second{static_cast<std::uint8_t>(s)},
+          millisecond{static_cast<std::uint16_t>(ms)},
+          microsecond{static_cast<std::uint16_t>(us)},
+          nanosecond {static_cast<std::uint16_t>(ns)}
+    {}
+
+    explicit local_time(const std::tm& t)
+        : hour  {static_cast<std::uint8_t>(t.tm_hour)},
+          minute{static_cast<std::uint8_t>(t.tm_min )},
+          second{static_cast<std::uint8_t>(t.tm_sec )},
+          millisecond{0}, microsecond{0}, nanosecond{0}
+    {}
+
+    template<typename Rep, typename Period>
+    explicit local_time(const std::chrono::duration<Rep, Period>& t)
+    {
+        const auto h = std::chrono::duration_cast<std::chrono::hours>(t);
+        this->hour = static_cast<std::uint8_t>(h.count());
+        const auto t2 = t - h;
+        const auto m = std::chrono::duration_cast<std::chrono::minutes>(t2);
+        this->minute = static_cast<std::uint8_t>(m.count());
+        const auto t3 = t2 - m;
+        const auto s = std::chrono::duration_cast<std::chrono::seconds>(t3);
+        this->second = static_cast<std::uint8_t>(s.count());
+        const auto t4 = t3 - s;
+        const auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(t4);
+        this->millisecond = static_cast<std::uint16_t>(ms.count());
+        const auto t5 = t4 - ms;
+        const auto us = std::chrono::duration_cast<std::chrono::microseconds>(t5);
+        this->microsecond = static_cast<std::uint16_t>(us.count());
+        const auto t6 = t5 - us;
+        const auto ns = std::chrono::duration_cast<std::chrono::nanoseconds>(t6);
+        this->nanosecond = static_cast<std::uint16_t>(ns.count());
+    }
+
+    operator std::chrono::nanoseconds() const;
+
+    local_time() = default;
+    ~local_time() = default;
+    local_time(local_time const&) = default;
+    local_time(local_time&&)      = default;
+    local_time& operator=(local_time const&) = default;
+    local_time& operator=(local_time&&)      = default;
+};
+
+bool operator==(const local_time& lhs, const local_time& rhs);
+bool operator!=(const local_time& lhs, const local_time& rhs);
+bool operator< (const local_time& lhs, const local_time& rhs);
+bool operator<=(const local_time& lhs, const local_time& rhs);
+bool operator> (const local_time& lhs, const local_time& rhs);
+bool operator>=(const local_time& lhs, const local_time& rhs);
+
+std::ostream& operator<<(std::ostream& os, const local_time& time);
+std::string to_string(const local_time& time);
+
+// ----------------------------------------------------------------------------
+
+struct time_offset
+{
+    std::int8_t hour{0};   // [-12, 12]
+    std::int8_t minute{0}; // [-59, 59]
+
+    time_offset(int h, int m)
+        : hour  {static_cast<std::int8_t>(h)},
+          minute{static_cast<std::int8_t>(m)}
+    {}
+
+    operator std::chrono::minutes() const;
+
+    time_offset() = default;
+    ~time_offset() = default;
+    time_offset(time_offset const&) = default;
+    time_offset(time_offset&&)      = default;
+    time_offset& operator=(time_offset const&) = default;
+    time_offset& operator=(time_offset&&)      = default;
+};
+
+bool operator==(const time_offset& lhs, const time_offset& rhs);
+bool operator!=(const time_offset& lhs, const time_offset& rhs);
+bool operator< (const time_offset& lhs, const time_offset& rhs);
+bool operator<=(const time_offset& lhs, const time_offset& rhs);
+bool operator> (const time_offset& lhs, const time_offset& rhs);
+bool operator>=(const time_offset& lhs, const time_offset& rhs);
+
+std::ostream& operator<<(std::ostream& os, const time_offset& offset);
+
+std::string to_string(const time_offset& offset);
+
+// -----------------------------------------------------------------------------
+
+struct local_datetime
+{
+    local_date date{};
+    local_time time{};
+
+    local_datetime(local_date d, local_time t): date{d}, time{t} {}
+
+    explicit local_datetime(const std::tm& t): date{t}, time{t}{}
+
+    explicit local_datetime(const std::chrono::system_clock::time_point& tp);
+    explicit local_datetime(const std::time_t t);
+
+    operator std::chrono::system_clock::time_point() const;
+    operator std::time_t() const;
+
+    local_datetime() = default;
+    ~local_datetime() = default;
+    local_datetime(local_datetime const&) = default;
+    local_datetime(local_datetime&&)      = default;
+    local_datetime& operator=(local_datetime const&) = default;
+    local_datetime& operator=(local_datetime&&)      = default;
+};
+
+bool operator==(const local_datetime& lhs, const local_datetime& rhs);
+bool operator!=(const local_datetime& lhs, const local_datetime& rhs);
+bool operator< (const local_datetime& lhs, const local_datetime& rhs);
+bool operator<=(const local_datetime& lhs, const local_datetime& rhs);
+bool operator> (const local_datetime& lhs, const local_datetime& rhs);
+bool operator>=(const local_datetime& lhs, const local_datetime& rhs);
+
+std::ostream& operator<<(std::ostream& os, const local_datetime& dt);
+
+std::string to_string(const local_datetime& dt);
+
+// -----------------------------------------------------------------------------
+
+struct offset_datetime
+{
+    local_date  date{};
+    local_time  time{};
+    time_offset offset{};
+
+    offset_datetime(local_date d, local_time t, time_offset o)
+        : date{d}, time{t}, offset{o}
+    {}
+    offset_datetime(const local_datetime& dt, time_offset o)
+        : date{dt.date}, time{dt.time}, offset{o}
+    {}
+    // use the current local timezone offset
+    explicit offset_datetime(const local_datetime& ld);
+    explicit offset_datetime(const std::chrono::system_clock::time_point& tp);
+    explicit offset_datetime(const std::time_t& t);
+    explicit offset_datetime(const std::tm& t);
+
+    operator std::chrono::system_clock::time_point() const;
+
+    operator std::time_t() const;
+
+    offset_datetime() = default;
+    ~offset_datetime() = default;
+    offset_datetime(offset_datetime const&) = default;
+    offset_datetime(offset_datetime&&)      = default;
+    offset_datetime& operator=(offset_datetime const&) = default;
+    offset_datetime& operator=(offset_datetime&&)      = default;
+
+  private:
+
+    static time_offset get_local_offset(const std::time_t* tp);
+};
+
+bool operator==(const offset_datetime& lhs, const offset_datetime& rhs);
+bool operator!=(const offset_datetime& lhs, const offset_datetime& rhs);
+bool operator< (const offset_datetime& lhs, const offset_datetime& rhs);
+bool operator<=(const offset_datetime& lhs, const offset_datetime& rhs);
+bool operator> (const offset_datetime& lhs, const offset_datetime& rhs);
+bool operator>=(const offset_datetime& lhs, const offset_datetime& rhs);
+
+std::ostream& operator<<(std::ostream& os, const offset_datetime& dt);
+
+std::string to_string(const offset_datetime& dt);
+
+}//toml
+#endif // TOML11_DATETIME_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_DATETIME_IMPL_HPP
+#define TOML11_DATETIME_IMPL_HPP
+
+
+#include <array>
+#include <iomanip>
+#include <ostream>
+#include <sstream>
+#include <tuple>
+
+#include <cstdlib>
+#include <ctime>
+
+namespace toml
+{
+
+// To avoid non-threadsafe std::localtime. In C11 (not C++11!), localtime_s is
+// provided in the absolutely same purpose, but C++11 is actually not compatible
+// with C11. We need to dispatch the function depending on the OS.
+namespace detail
+{
+// TODO: find more sophisticated way to handle this
+#if defined(_MSC_VER)
+TOML11_INLINE std::tm localtime_s(const std::time_t* src)
+{
+    std::tm dst;
+    const auto result = ::localtime_s(&dst, src);
+    if (result) { throw std::runtime_error("localtime_s failed."); }
+    return dst;
+}
+TOML11_INLINE std::tm gmtime_s(const std::time_t* src)
+{
+    std::tm dst;
+    const auto result = ::gmtime_s(&dst, src);
+    if (result) { throw std::runtime_error("gmtime_s failed."); }
+    return dst;
+}
+#elif (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE >= 1) || defined(_XOPEN_SOURCE) || defined(_BSD_SOURCE) || defined(_SVID_SOURCE) || defined(_POSIX_SOURCE)
+TOML11_INLINE std::tm localtime_s(const std::time_t* src)
+{
+    std::tm dst;
+    const auto result = ::localtime_r(src, &dst);
+    if (!result) { throw std::runtime_error("localtime_r failed."); }
+    return dst;
+}
+TOML11_INLINE std::tm gmtime_s(const std::time_t* src)
+{
+    std::tm dst;
+    const auto result = ::gmtime_r(src, &dst);
+    if (!result) { throw std::runtime_error("gmtime_r failed."); }
+    return dst;
+}
+#else // fallback. not threadsafe
+TOML11_INLINE std::tm localtime_s(const std::time_t* src)
+{
+    const auto result = std::localtime(src);
+    if (!result) { throw std::runtime_error("localtime failed."); }
+    return *result;
+}
+TOML11_INLINE std::tm gmtime_s(const std::time_t* src)
+{
+    const auto result = std::gmtime(src);
+    if (!result) { throw std::runtime_error("gmtime failed."); }
+    return *result;
+}
+#endif
+} // detail
+
+// ----------------------------------------------------------------------------
+
+TOML11_INLINE local_date::local_date(const std::chrono::system_clock::time_point& tp)
+{
+    const auto t    = std::chrono::system_clock::to_time_t(tp);
+    const auto time = detail::localtime_s(&t);
+    *this = local_date(time);
+}
+
+TOML11_INLINE local_date::local_date(const std::time_t t)
+    : local_date{std::chrono::system_clock::from_time_t(t)}
+{}
+
+TOML11_INLINE local_date::operator std::chrono::system_clock::time_point() const
+{
+    // std::mktime returns date as local time zone. no conversion needed
+    std::tm t;
+    t.tm_sec   = 0;
+    t.tm_min   = 0;
+    t.tm_hour  = 0;
+    t.tm_mday  = static_cast<int>(this->day);
+    t.tm_mon   = static_cast<int>(this->month);
+    t.tm_year  = static_cast<int>(this->year) - 1900;
+    t.tm_wday  = 0; // the value will be ignored
+    t.tm_yday  = 0; // the value will be ignored
+    t.tm_isdst = -1;
+    return std::chrono::system_clock::from_time_t(std::mktime(&t));
+}
+
+TOML11_INLINE local_date::operator std::time_t() const
+{
+    return std::chrono::system_clock::to_time_t(
+            std::chrono::system_clock::time_point(*this));
+}
+
+TOML11_INLINE bool operator==(const local_date& lhs, const local_date& rhs)
+{
+    return std::make_tuple(lhs.year, lhs.month, lhs.day) ==
+           std::make_tuple(rhs.year, rhs.month, rhs.day);
+}
+TOML11_INLINE bool operator!=(const local_date& lhs, const local_date& rhs)
+{
+    return !(lhs == rhs);
+}
+TOML11_INLINE bool operator< (const local_date& lhs, const local_date& rhs)
+{
+    return std::make_tuple(lhs.year, lhs.month, lhs.day) <
+           std::make_tuple(rhs.year, rhs.month, rhs.day);
+}
+TOML11_INLINE bool operator<=(const local_date& lhs, const local_date& rhs)
+{
+    return (lhs < rhs) || (lhs == rhs);
+}
+TOML11_INLINE bool operator> (const local_date& lhs, const local_date& rhs)
+{
+    return !(lhs <= rhs);
+}
+TOML11_INLINE bool operator>=(const local_date& lhs, const local_date& rhs)
+{
+    return !(lhs < rhs);
+}
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const local_date& date)
+{
+    os << std::setfill('0') << std::setw(4) << static_cast<int>(date.year )     << '-';
+    os << std::setfill('0') << std::setw(2) << static_cast<int>(date.month) + 1 << '-';
+    os << std::setfill('0') << std::setw(2) << static_cast<int>(date.day  )    ;
+    return os;
+}
+
+TOML11_INLINE std::string to_string(const local_date& date)
+{
+    std::ostringstream oss;
+    oss.imbue(std::locale::classic());
+    oss << date;
+    return oss.str();
+}
+
+// -----------------------------------------------------------------------------
+
+TOML11_INLINE local_time::operator std::chrono::nanoseconds() const
+{
+    return std::chrono::nanoseconds (this->nanosecond)  +
+           std::chrono::microseconds(this->microsecond) +
+           std::chrono::milliseconds(this->millisecond) +
+           std::chrono::seconds(this->second) +
+           std::chrono::minutes(this->minute) +
+           std::chrono::hours(this->hour);
+}
+
+TOML11_INLINE bool operator==(const local_time& lhs, const local_time& rhs)
+{
+    return std::make_tuple(lhs.hour, lhs.minute, lhs.second, lhs.millisecond, lhs.microsecond, lhs.nanosecond) ==
+           std::make_tuple(rhs.hour, rhs.minute, rhs.second, rhs.millisecond, rhs.microsecond, rhs.nanosecond);
+}
+TOML11_INLINE bool operator!=(const local_time& lhs, const local_time& rhs)
+{
+    return !(lhs == rhs);
+}
+TOML11_INLINE bool operator< (const local_time& lhs, const local_time& rhs)
+{
+    return std::make_tuple(lhs.hour, lhs.minute, lhs.second, lhs.millisecond, lhs.microsecond, lhs.nanosecond) <
+           std::make_tuple(rhs.hour, rhs.minute, rhs.second, rhs.millisecond, rhs.microsecond, rhs.nanosecond);
+}
+TOML11_INLINE bool operator<=(const local_time& lhs, const local_time& rhs)
+{
+    return (lhs < rhs) || (lhs == rhs);
+}
+TOML11_INLINE bool operator> (const local_time& lhs, const local_time& rhs)
+{
+    return !(lhs <= rhs);
+}
+TOML11_INLINE bool operator>=(const local_time& lhs, const local_time& rhs)
+{
+    return !(lhs < rhs);
+}
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const local_time& time)
+{
+    os << std::setfill('0') << std::setw(2) << static_cast<int>(time.hour  ) << ':';
+    os << std::setfill('0') << std::setw(2) << static_cast<int>(time.minute) << ':';
+    os << std::setfill('0') << std::setw(2) << static_cast<int>(time.second);
+    if(time.millisecond != 0 || time.microsecond != 0 || time.nanosecond != 0)
+    {
+        os << '.';
+        os << std::setfill('0') << std::setw(3) << static_cast<int>(time.millisecond);
+        if(time.microsecond != 0 || time.nanosecond != 0)
+        {
+            os << std::setfill('0') << std::setw(3) << static_cast<int>(time.microsecond);
+            if(time.nanosecond != 0)
+            {
+                os << std::setfill('0') << std::setw(3) << static_cast<int>(time.nanosecond);
+            }
+        }
+    }
+    return os;
+}
+
+TOML11_INLINE std::string to_string(const local_time& time)
+{
+    std::ostringstream oss;
+    oss.imbue(std::locale::classic());
+    oss << time;
+    return oss.str();
+}
+
+// ----------------------------------------------------------------------------
+
+TOML11_INLINE time_offset::operator std::chrono::minutes() const
+{
+    return std::chrono::minutes(this->minute) +
+           std::chrono::hours(this->hour);
+}
+
+TOML11_INLINE bool operator==(const time_offset& lhs, const time_offset& rhs)
+{
+    return std::make_tuple(lhs.hour, lhs.minute) ==
+           std::make_tuple(rhs.hour, rhs.minute);
+}
+TOML11_INLINE bool operator!=(const time_offset& lhs, const time_offset& rhs)
+{
+    return !(lhs == rhs);
+}
+TOML11_INLINE bool operator< (const time_offset& lhs, const time_offset& rhs)
+{
+    return std::make_tuple(lhs.hour, lhs.minute) <
+           std::make_tuple(rhs.hour, rhs.minute);
+}
+TOML11_INLINE bool operator<=(const time_offset& lhs, const time_offset& rhs)
+{
+    return (lhs < rhs) || (lhs == rhs);
+}
+TOML11_INLINE bool operator> (const time_offset& lhs, const time_offset& rhs)
+{
+    return !(lhs <= rhs);
+}
+TOML11_INLINE bool operator>=(const time_offset& lhs, const time_offset& rhs)
+{
+    return !(lhs < rhs);
+}
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const time_offset& offset)
+{
+    if(offset.hour == 0 && offset.minute == 0)
+    {
+        os << 'Z';
+        return os;
+    }
+    int minute = static_cast<int>(offset.hour) * 60 + offset.minute;
+    if(minute < 0){os << '-'; minute = std::abs(minute);} else {os << '+';}
+    os << std::setfill('0') << std::setw(2) << minute / 60 << ':';
+    os << std::setfill('0') << std::setw(2) << minute % 60;
+    return os;
+}
+
+TOML11_INLINE std::string to_string(const time_offset& offset)
+{
+    std::ostringstream oss;
+    oss.imbue(std::locale::classic());
+    oss << offset;
+    return oss.str();
+}
+
+// -----------------------------------------------------------------------------
+
+TOML11_INLINE local_datetime::local_datetime(const std::chrono::system_clock::time_point& tp)
+{
+    const auto t = std::chrono::system_clock::to_time_t(tp);
+    std::tm ltime = detail::localtime_s(&t);
+
+    this->date = local_date(ltime);
+    this->time = local_time(ltime);
+
+    // std::tm lacks subsecond information, so diff between tp and tm
+    // can be used to get millisecond & microsecond information.
+    const auto t_diff = tp -
+        std::chrono::system_clock::from_time_t(std::mktime(&ltime));
+    this->time.millisecond = static_cast<std::uint16_t>(
+      std::chrono::duration_cast<std::chrono::milliseconds>(t_diff).count());
+    this->time.microsecond = static_cast<std::uint16_t>(
+      std::chrono::duration_cast<std::chrono::microseconds>(t_diff).count());
+    this->time.nanosecond = static_cast<std::uint16_t>(
+      std::chrono::duration_cast<std::chrono::nanoseconds >(t_diff).count());
+}
+
+TOML11_INLINE local_datetime::local_datetime(const std::time_t t)
+    : local_datetime{std::chrono::system_clock::from_time_t(t)}
+{}
+
+TOML11_INLINE local_datetime::operator std::chrono::system_clock::time_point() const
+{
+    using internal_duration =
+        typename std::chrono::system_clock::time_point::duration;
+
+    // Normally DST begins at A.M. 3 or 4. If we re-use conversion operator
+    // of local_date and local_time independently, the conversion fails if
+    // it is the day when DST begins or ends. Since local_date considers the
+    // time is 00:00 A.M. and local_time does not consider DST because it
+    // does not have any date information. We need to consider both date and
+    // time information at the same time to convert it correctly.
+
+    std::tm t;
+    t.tm_sec   = static_cast<int>(this->time.second);
+    t.tm_min   = static_cast<int>(this->time.minute);
+    t.tm_hour  = static_cast<int>(this->time.hour);
+    t.tm_mday  = static_cast<int>(this->date.day);
+    t.tm_mon   = static_cast<int>(this->date.month);
+    t.tm_year  = static_cast<int>(this->date.year) - 1900;
+    t.tm_wday  = 0; // the value will be ignored
+    t.tm_yday  = 0; // the value will be ignored
+    t.tm_isdst = -1;
+
+    // std::mktime returns date as local time zone. no conversion needed
+    auto dt = std::chrono::system_clock::from_time_t(std::mktime(&t));
+    dt += std::chrono::duration_cast<internal_duration>(
+            std::chrono::milliseconds(this->time.millisecond) +
+            std::chrono::microseconds(this->time.microsecond) +
+            std::chrono::nanoseconds (this->time.nanosecond));
+    return dt;
+}
+
+TOML11_INLINE local_datetime::operator std::time_t() const
+{
+    return std::chrono::system_clock::to_time_t(
+            std::chrono::system_clock::time_point(*this));
+}
+
+TOML11_INLINE bool operator==(const local_datetime& lhs, const local_datetime& rhs)
+{
+    return std::make_tuple(lhs.date, lhs.time) ==
+           std::make_tuple(rhs.date, rhs.time);
+}
+TOML11_INLINE bool operator!=(const local_datetime& lhs, const local_datetime& rhs)
+{
+    return !(lhs == rhs);
+}
+TOML11_INLINE bool operator< (const local_datetime& lhs, const local_datetime& rhs)
+{
+    return std::make_tuple(lhs.date, lhs.time) <
+           std::make_tuple(rhs.date, rhs.time);
+}
+TOML11_INLINE bool operator<=(const local_datetime& lhs, const local_datetime& rhs)
+{
+    return (lhs < rhs) || (lhs == rhs);
+}
+TOML11_INLINE bool operator> (const local_datetime& lhs, const local_datetime& rhs)
+{
+    return !(lhs <= rhs);
+}
+TOML11_INLINE bool operator>=(const local_datetime& lhs, const local_datetime& rhs)
+{
+    return !(lhs < rhs);
+}
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const local_datetime& dt)
+{
+    os << dt.date << 'T' << dt.time;
+    return os;
+}
+
+TOML11_INLINE std::string to_string(const local_datetime& dt)
+{
+    std::ostringstream oss;
+    oss.imbue(std::locale::classic());
+    oss << dt;
+    return oss.str();
+}
+
+// -----------------------------------------------------------------------------
+
+
+TOML11_INLINE offset_datetime::offset_datetime(const local_datetime& ld)
+    : date{ld.date}, time{ld.time}, offset{get_local_offset(nullptr)}
+      // use the current local timezone offset
+{}
+TOML11_INLINE offset_datetime::offset_datetime(const std::chrono::system_clock::time_point& tp)
+    : offset{0, 0} // use gmtime
+{
+    const auto timet = std::chrono::system_clock::to_time_t(tp);
+    const auto tm    = detail::gmtime_s(&timet);
+    this->date = local_date(tm);
+    this->time = local_time(tm);
+}
+TOML11_INLINE offset_datetime::offset_datetime(const std::time_t& t)
+    : offset{0, 0} // use gmtime
+{
+    const auto tm    = detail::gmtime_s(&t);
+    this->date = local_date(tm);
+    this->time = local_time(tm);
+}
+TOML11_INLINE offset_datetime::offset_datetime(const std::tm& t)
+    : offset{0, 0} // assume gmtime
+{
+    this->date = local_date(t);
+    this->time = local_time(t);
+}
+
+TOML11_INLINE offset_datetime::operator std::chrono::system_clock::time_point() const
+{
+    // get date-time
+    using internal_duration =
+        typename std::chrono::system_clock::time_point::duration;
+
+    // first, convert it to local date-time information in the same way as
+    // local_datetime does. later we will use time_t to adjust time offset.
+    std::tm t;
+    t.tm_sec   = static_cast<int>(this->time.second);
+    t.tm_min   = static_cast<int>(this->time.minute);
+    t.tm_hour  = static_cast<int>(this->time.hour);
+    t.tm_mday  = static_cast<int>(this->date.day);
+    t.tm_mon   = static_cast<int>(this->date.month);
+    t.tm_year  = static_cast<int>(this->date.year) - 1900;
+    t.tm_wday  = 0; // the value will be ignored
+    t.tm_yday  = 0; // the value will be ignored
+    t.tm_isdst = -1;
+    const std::time_t tp_loc = std::mktime(std::addressof(t));
+
+    auto tp = std::chrono::system_clock::from_time_t(tp_loc);
+    tp += std::chrono::duration_cast<internal_duration>(
+            std::chrono::milliseconds(this->time.millisecond) +
+            std::chrono::microseconds(this->time.microsecond) +
+            std::chrono::nanoseconds (this->time.nanosecond));
+
+    // Since mktime uses local time zone, it should be corrected.
+    // `12:00:00+09:00` means `03:00:00Z`. So mktime returns `03:00:00Z` if
+    // we are in `+09:00` timezone. To represent `12:00:00Z` there, we need
+    // to add `+09:00` to `03:00:00Z`.
+    //    Here, it uses the time_t converted from date-time info to handle
+    // daylight saving time.
+    const auto ofs = get_local_offset(std::addressof(tp_loc));
+    tp += std::chrono::hours  (ofs.hour);
+    tp += std::chrono::minutes(ofs.minute);
+
+    // We got `12:00:00Z` by correcting local timezone applied by mktime.
+    // Then we will apply the offset. Let's say `12:00:00-08:00` is given.
+    // And now, we have `12:00:00Z`. `12:00:00-08:00` means `20:00:00Z`.
+    // So we need to subtract the offset.
+    tp -= std::chrono::minutes(this->offset);
+    return tp;
+}
+
+TOML11_INLINE offset_datetime::operator std::time_t() const
+{
+    return std::chrono::system_clock::to_time_t(
+            std::chrono::system_clock::time_point(*this));
+}
+
+TOML11_INLINE time_offset offset_datetime::get_local_offset(const std::time_t* tp)
+{
+    // get local timezone with the same date-time information as mktime
+    const auto t = detail::localtime_s(tp);
+
+    std::array<char, 6> buf;
+    const auto result = std::strftime(buf.data(), 6, "%z", &t); // +hhmm\0
+    if(result != 5)
+    {
+        throw std::runtime_error("toml::offset_datetime: cannot obtain "
+                                 "timezone information of current env");
+    }
+    const int ofs = std::atoi(buf.data());
+    const int ofs_h = ofs / 100;
+    const int ofs_m = ofs - (ofs_h * 100);
+    return time_offset(ofs_h, ofs_m);
+}
+
+TOML11_INLINE bool operator==(const offset_datetime& lhs, const offset_datetime& rhs)
+{
+    return std::make_tuple(lhs.date, lhs.time, lhs.offset) ==
+           std::make_tuple(rhs.date, rhs.time, rhs.offset);
+}
+TOML11_INLINE bool operator!=(const offset_datetime& lhs, const offset_datetime& rhs)
+{
+    return !(lhs == rhs);
+}
+TOML11_INLINE bool operator< (const offset_datetime& lhs, const offset_datetime& rhs)
+{
+    return std::make_tuple(lhs.date, lhs.time, lhs.offset) <
+           std::make_tuple(rhs.date, rhs.time, rhs.offset);
+}
+TOML11_INLINE bool operator<=(const offset_datetime& lhs, const offset_datetime& rhs)
+{
+    return (lhs < rhs) || (lhs == rhs);
+}
+TOML11_INLINE bool operator> (const offset_datetime& lhs, const offset_datetime& rhs)
+{
+    return !(lhs <= rhs);
+}
+TOML11_INLINE bool operator>=(const offset_datetime& lhs, const offset_datetime& rhs)
+{
+    return !(lhs < rhs);
+}
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const offset_datetime& dt)
+{
+    os << dt.date << 'T' << dt.time << dt.offset;
+    return os;
+}
+
+TOML11_INLINE std::string to_string(const offset_datetime& dt)
+{
+    std::ostringstream oss;
+    oss.imbue(std::locale::classic());
+    oss << dt;
+    return oss.str();
+}
+
+}//toml
+#endif // TOML11_DATETIME_IMPL_HPP
+#endif
+
+#endif // TOML11_DATETIME_HPP
+#ifndef TOML11_COMPAT_HPP
+#define TOML11_COMPAT_HPP
+
+
+#include <algorithm>
+#include <iterator>
+#include <memory>
+#include <string>
+#include <type_traits>
+
+#include <cassert>
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX20_VALUE
+#  if __has_include(<bit>)
+#    include <bit>
+#  endif
+#endif
+
+#include <cstring>
+
+// ----------------------------------------------------------------------------
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX14_VALUE
+#  if __has_cpp_attribute(deprecated)
+#    define TOML11_HAS_ATTR_DEPRECATED 1
+#  endif
+#endif
+
+#if defined(TOML11_HAS_ATTR_DEPRECATED)
+#  define TOML11_DEPRECATED(msg) [[deprecated(msg)]]
+#elif defined(__GNUC__)
+#  define TOML11_DEPRECATED(msg) __attribute__((deprecated(msg)))
+#elif defined(_MSC_VER)
+#  define TOML11_DEPRECATED(msg) __declspec(deprecated(msg))
+#else
+#  define TOML11_DEPRECATED(msg)
+#endif
+
+// ----------------------------------------------------------------------------
+
+#if defined(__cpp_if_constexpr)
+#  if __cpp_if_constexpr >= 201606L
+#    define TOML11_HAS_CONSTEXPR_IF 1
+#  endif
+#endif
+
+#if defined(TOML11_HAS_CONSTEXPR_IF)
+#  define TOML11_CONSTEXPR_IF if constexpr
+#else
+#  define TOML11_CONSTEXPR_IF if
+#endif
+
+// ----------------------------------------------------------------------------
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX14_VALUE
+#  if defined(__cpp_lib_make_unique)
+#    if __cpp_lib_make_unique >= 201304L
+#      define TOML11_HAS_STD_MAKE_UNIQUE 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+
+#if defined(TOML11_HAS_STD_MAKE_UNIQUE)
+
+using std::make_unique;
+
+#else
+
+template<typename T, typename ... Ts>
+std::unique_ptr<T> make_unique(Ts&& ... args)
+{
+    return std::unique_ptr<T>(new T(std::forward<Ts>(args)...));
+}
+
+#endif // TOML11_HAS_STD_MAKE_UNIQUE
+
+} // cxx
+} // toml
+
+// ---------------------------------------------------------------------------
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX14_VALUE
+#  if defined(__cpp_lib_make_reverse_iterator)
+#    if __cpp_lib_make_reverse_iterator >= 201402L
+#      define TOML11_HAS_STD_MAKE_REVERSE_ITERATOR 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+# if defined(TOML11_HAS_STD_MAKE_REVERSE_ITERATOR)
+
+using std::make_reverse_iterator;
+
+#else
+
+template<typename Iterator>
+std::reverse_iterator<Iterator> make_reverse_iterator(Iterator iter)
+{
+    return std::reverse_iterator<Iterator>(iter);
+}
+
+#endif // TOML11_HAS_STD_MAKE_REVERSE_ITERATOR
+
+} // cxx
+} // toml
+
+// ---------------------------------------------------------------------------
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX20_VALUE
+#  if defined(__cpp_lib_clamp)
+#    if __cpp_lib_clamp >= 201603L
+#      define TOML11_HAS_STD_CLAMP 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+#if defined(TOML11_HAS_STD_CLAMP)
+
+using std::clamp;
+
+#else
+
+template<typename T>
+T clamp(const T& x, const T& low, const T& high) noexcept
+{
+    assert(low <= high);
+    return (std::min)((std::max)(x, low), high);
+}
+
+#endif // TOML11_HAS_STD_CLAMP
+
+} // cxx
+} // toml
+
+// ---------------------------------------------------------------------------
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX20_VALUE
+#  if defined(__cpp_lib_bit_cast)
+#    if __cpp_lib_bit_cast >= 201806L
+#      define TOML11_HAS_STD_BIT_CAST 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+#if defined(TOML11_HAS_STD_BIT_CAST)
+
+using std::bit_cast;
+
+#else
+
+template<typename U, typename T>
+U bit_cast(const T& x) noexcept
+{
+    static_assert(sizeof(T) == sizeof(U), "");
+    static_assert(std::is_default_constructible<T>::value, "");
+
+    U z;
+    std::memcpy(reinterpret_cast<char*>(std::addressof(z)),
+                reinterpret_cast<const char*>(std::addressof(x)),
+                sizeof(T));
+
+    return z;
+}
+
+#endif // TOML11_HAS_STD_BIT_CAST
+
+} // cxx
+} // toml
+
+// ---------------------------------------------------------------------------
+// C++20 remove_cvref_t
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX20_VALUE
+#  if defined(__cpp_lib_remove_cvref)
+#    if __cpp_lib_remove_cvref >= 201711L
+#      define TOML11_HAS_STD_REMOVE_CVREF 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+#if defined(TOML11_HAS_STD_REMOVE_CVREF)
+
+using std::remove_cvref;
+using std::remove_cvref_t;
+
+#else
+
+template<typename T>
+struct remove_cvref
+{
+    using type = typename std::remove_cv<
+        typename std::remove_reference<T>::type>::type;
+};
+
+template<typename T>
+using remove_cvref_t = typename remove_cvref<T>::type;
+
+#endif // TOML11_HAS_STD_REMOVE_CVREF
+
+} // cxx
+} // toml
+
+// ---------------------------------------------------------------------------
+// C++17 and/or/not
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX17_VALUE
+#  if defined(__cpp_lib_logical_traits)
+#    if __cpp_lib_logical_traits >= 201510L
+#      define TOML11_HAS_STD_CONJUNCTION 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+#if defined(TOML11_HAS_STD_CONJUNCTION)
+
+using std::conjunction;
+using std::disjunction;
+using std::negation;
+
+#else
+
+template<typename ...> struct conjunction : std::true_type{};
+template<typename T>   struct conjunction<T> : T{};
+template<typename T, typename ... Ts>
+struct conjunction<T, Ts...> :
+    std::conditional<static_cast<bool>(T::value), conjunction<Ts...>, T>::type
+{};
+
+template<typename ...> struct disjunction : std::false_type{};
+template<typename T>   struct disjunction<T> : T {};
+template<typename T, typename ... Ts>
+struct disjunction<T, Ts...> :
+    std::conditional<static_cast<bool>(T::value), T, disjunction<Ts...>>::type
+{};
+
+template<typename T>
+struct negation : std::integral_constant<bool, !static_cast<bool>(T::value)>{};
+
+#endif // TOML11_HAS_STD_CONJUNCTION
+
+} // cxx
+} // toml
+
+// ---------------------------------------------------------------------------
+// C++14 index_sequence
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX14_VALUE
+#  if defined(__cpp_lib_integer_sequence)
+#    if __cpp_lib_integer_sequence >= 201304L
+#      define TOML11_HAS_STD_INTEGER_SEQUENCE 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+#if defined(TOML11_HAS_STD_INTEGER_SEQUENCE)
+
+using std::index_sequence;
+using std::make_index_sequence;
+
+#else
+
+template<std::size_t ... Ns> struct index_sequence{};
+
+template<bool B, std::size_t N, typename T>
+struct double_index_sequence;
+
+template<std::size_t N, std::size_t ... Is>
+struct double_index_sequence<true, N, index_sequence<Is...>>
+{
+    using type = index_sequence<Is..., (Is+N)..., N*2>;
+};
+template<std::size_t N, std::size_t ... Is>
+struct double_index_sequence<false, N, index_sequence<Is...>>
+{
+    using type = index_sequence<Is..., (Is+N)...>;
+};
+
+template<std::size_t N>
+struct index_sequence_maker
+{
+    using type = typename double_index_sequence<
+            N % 2 == 1, N/2, typename index_sequence_maker<N/2>::type
+        >::type;
+};
+template<>
+struct index_sequence_maker<0>
+{
+    using type = index_sequence<>;
+};
+
+template<std::size_t N>
+using make_index_sequence = typename index_sequence_maker<N>::type;
+
+#endif // TOML11_HAS_STD_INTEGER_SEQUENCE
+
+} // cxx
+} // toml
+
+// ---------------------------------------------------------------------------
+// C++14 enable_if_t
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX14_VALUE
+#  if defined(__cpp_lib_transformation_trait_aliases)
+#    if __cpp_lib_transformation_trait_aliases >= 201304L
+#      define TOML11_HAS_STD_ENABLE_IF_T 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+#if defined(TOML11_HAS_STD_ENABLE_IF_T)
+
+using std::enable_if_t;
+
+#else
+
+template<bool B, typename T>
+using enable_if_t = typename std::enable_if<B, T>::type;
+
+#endif // TOML11_HAS_STD_ENABLE_IF_T
+
+} // cxx
+} // toml
+
+// ---------------------------------------------------------------------------
+// return_type_of_t
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX17_VALUE
+#  if defined(__cpp_lib_is_invocable)
+#    if __cpp_lib_is_invocable >= 201703
+#      define TOML11_HAS_STD_INVOKE_RESULT 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+#if defined(TOML11_HAS_STD_INVOKE_RESULT)
+
+template<typename F, typename ... Args>
+using return_type_of_t = std::invoke_result_t<F, Args...>;
+
+#else
+
+// result_of is deprecated after C++17
+template<typename F, typename ... Args>
+using return_type_of_t = typename std::result_of<F(Args...)>::type;
+
+#endif // TOML11_HAS_STD_INVOKE_RESULT
+
+} // cxx
+} // toml
+
+// ---------------------------------------------------------------------------
+// C++17 void_t
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX17_VALUE
+#  if defined(__cpp_lib_void_t)
+#    if __cpp_lib_void_t >= 201411L
+#      define TOML11_HAS_STD_VOID_T 1
+#    endif
+#  endif
+#endif
+
+namespace toml
+{
+namespace cxx
+{
+#if defined(TOML11_HAS_STD_VOID_T)
+
+using std::void_t;
+
+#else
+
+template<typename ...>
+using void_t = void;
+
+#endif // TOML11_HAS_STD_VOID_T
+
+} // cxx
+} // toml
+
+// ----------------------------------------------------------------------------
+// (subset of) source_location
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= 202002L
+#  if __has_include(<source_location>)
+#    define TOML11_HAS_STD_SOURCE_LOCATION
+#  endif // has_include
+#endif // c++20
+
+#if ! defined(TOML11_HAS_STD_SOURCE_LOCATION)
+#  if defined(__GNUC__) && ! defined(__clang__)
+#    if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX14_VALUE
+#      if __has_include(<experimental/source_location>)
+#        define TOML11_HAS_EXPERIMENTAL_SOURCE_LOCATION
+#      endif
+#    endif
+#  endif // GNU g++
+#endif // not TOML11_HAS_STD_SOURCE_LOCATION
+
+#if ! defined(TOML11_HAS_STD_SOURCE_LOCATION) && ! defined(TOML11_HAS_EXPERIMENTAL_SOURCE_LOCATION)
+#  if defined(__GNUC__) && ! defined(__clang__)
+#    if (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 9))
+#      define TOML11_HAS_BUILTIN_FILE_LINE 1
+#      define TOML11_BUILTIN_LINE_TYPE int
+#    endif
+#  elif defined(__clang__) // clang 9.0.0 implements builtin_FILE/LINE
+#    if __has_builtin(__builtin_FILE) && __has_builtin(__builtin_LINE)
+#      define TOML11_HAS_BUILTIN_FILE_LINE 1
+#      define TOML11_BUILTIN_LINE_TYPE unsigned int
+#    endif
+#  elif defined(_MSVC_LANG) && defined(_MSC_VER)
+#    if _MSC_VER > 1926
+#      define TOML11_HAS_BUILTIN_FILE_LINE 1
+#      define TOML11_BUILTIN_LINE_TYPE int
+#    endif
+#  endif
+#endif
+
+#if defined(TOML11_HAS_STD_SOURCE_LOCATION)
+#include <source_location>
+namespace toml
+{
+namespace cxx
+{
+using source_location = std::source_location;
+
+inline std::string to_string(const source_location& loc)
+{
+    const char* fname = loc.file_name();
+    if(fname)
+    {
+        return std::string(" at line ") + std::to_string(loc.line()) +
+               std::string(" in file ") + std::string(fname);
+    }
+    else
+    {
+        return std::string(" at line ") + std::to_string(loc.line()) +
+               std::string(" in unknown file");
+    }
+}
+
+} // cxx
+} // toml
+#elif defined(TOML11_HAS_EXPERIMENTAL_SOURCE_LOCATION)
+#include <experimental/source_location>
+namespace toml
+{
+namespace cxx
+{
+using source_location = std::experimental::source_location;
+
+inline std::string to_string(const source_location& loc)
+{
+    const char* fname = loc.file_name();
+    if(fname)
+    {
+        return std::string(" at line ") + std::to_string(loc.line()) +
+               std::string(" in file ") + std::string(fname);
+    }
+    else
+    {
+        return std::string(" at line ") + std::to_string(loc.line()) +
+               std::string(" in unknown file");
+    }
+}
+
+} // cxx
+} // toml
+#elif defined(TOML11_HAS_BUILTIN_FILE_LINE)
+namespace toml
+{
+namespace cxx
+{
+struct source_location
+{
+    using line_type = TOML11_BUILTIN_LINE_TYPE;
+    static source_location current(const line_type line = __builtin_LINE(),
+                                   const char*     file = __builtin_FILE())
+    {
+        return source_location(line, file);
+    }
+
+    source_location(const line_type line, const char* file)
+        : line_(line), file_name_(file)
+    {}
+
+    line_type   line()      const noexcept {return line_;}
+    const char* file_name() const noexcept {return file_name_;}
+
+  private:
+
+    line_type   line_;
+    const char* file_name_;
+};
+
+inline std::string to_string(const source_location& loc)
+{
+    const char* fname = loc.file_name();
+    if(fname)
+    {
+        return std::string(" at line ") + std::to_string(loc.line()) +
+               std::string(" in file ") + std::string(fname);
+    }
+    else
+    {
+        return std::string(" at line ") + std::to_string(loc.line()) +
+               std::string(" in unknown file");
+    }
+}
+
+} // cxx
+} // toml
+#else // no builtin
+namespace toml
+{
+namespace cxx
+{
+struct source_location
+{
+    static source_location current() { return source_location{}; }
+};
+
+inline std::string to_string(const source_location&)
+{
+    return std::string("");
+}
+} // cxx
+} // toml
+#endif // TOML11_HAS_STD_SOURCE_LOCATION
+
+// ----------------------------------------------------------------------------
+// (subset of) optional
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX17_VALUE
+#  if __has_include(<optional>)
+#    include <optional>
+#  endif // has_include(optional)
+#endif // C++17
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX17_VALUE
+#  if defined(__cpp_lib_optional)
+#    if __cpp_lib_optional >= 201606L
+#      define TOML11_HAS_STD_OPTIONAL 1
+#    endif
+#  endif
+#endif
+
+#if defined(TOML11_HAS_STD_OPTIONAL)
+
+namespace toml
+{
+namespace cxx
+{
+using std::optional;
+
+inline std::nullopt_t make_nullopt() {return std::nullopt;}
+
+template<typename charT, typename traitsT>
+std::basic_ostream<charT, traitsT>&
+operator<<(std::basic_ostream<charT, traitsT>& os, const std::nullopt_t&)
+{
+    os << "nullopt";
+    return os;
+}
+
+} // cxx
+} // toml
+
+#else // TOML11_HAS_STD_OPTIONAL
+
+namespace toml
+{
+namespace cxx
+{
+
+struct nullopt_t{};
+inline nullopt_t make_nullopt() {return nullopt_t{};}
+
+inline bool operator==(const nullopt_t&, const nullopt_t&) noexcept {return true;}
+inline bool operator!=(const nullopt_t&, const nullopt_t&) noexcept {return false;}
+inline bool operator< (const nullopt_t&, const nullopt_t&) noexcept {return false;}
+inline bool operator<=(const nullopt_t&, const nullopt_t&) noexcept {return true;}
+inline bool operator> (const nullopt_t&, const nullopt_t&) noexcept {return false;}
+inline bool operator>=(const nullopt_t&, const nullopt_t&) noexcept {return true;}
+
+template<typename charT, typename traitsT>
+std::basic_ostream<charT, traitsT>&
+operator<<(std::basic_ostream<charT, traitsT>& os, const nullopt_t&)
+{
+    os << "nullopt";
+    return os;
+}
+
+template<typename T>
+class optional
+{
+  public:
+
+    using value_type = T;
+
+  public:
+
+    optional() noexcept : has_value_(false), null_('\0') {}
+    optional(nullopt_t) noexcept : has_value_(false), null_('\0') {}
+
+    optional(const T& x): has_value_(true), value_(x) {}
+    optional(T&& x): has_value_(true), value_(std::move(x)) {}
+
+    template<typename U, enable_if_t<std::is_constructible<T, U>::value, std::nullptr_t> = nullptr>
+    explicit optional(U&& x): has_value_(true), value_(std::forward<U>(x)) {}
+
+    optional(const optional& rhs): has_value_(rhs.has_value_)
+    {
+        if(rhs.has_value_)
+        {
+            this->assigner(rhs.value_);
+        }
+    }
+    optional(optional&& rhs): has_value_(rhs.has_value_)
+    {
+        if(this->has_value_)
+        {
+            this->assigner(std::move(rhs.value_));
+        }
+    }
+
+    optional& operator=(const optional& rhs)
+    {
+        if(this == std::addressof(rhs)) {return *this;}
+
+        this->cleanup();
+        this->has_value_ = rhs.has_value_;
+        if(this->has_value_)
+        {
+            this->assigner(rhs.value_);
+        }
+        return *this;
+    }
+    optional& operator=(optional&& rhs)
+    {
+        if(this == std::addressof(rhs)) {return *this;}
+
+        this->cleanup();
+        this->has_value_ = rhs.has_value_;
+        if(this->has_value_)
+        {
+            this->assigner(std::move(rhs.value_));
+        }
+        return *this;
+    }
+
+    template<typename U, enable_if_t<conjunction<
+        negation<std::is_same<T, U>>, std::is_constructible<T, U>
+        >::value, std::nullptr_t> = nullptr>
+    explicit optional(const optional<U>& rhs): has_value_(rhs.has_value_), null_('\0')
+    {
+        if(rhs.has_value_)
+        {
+            this->assigner(rhs.value_);
+        }
+    }
+    template<typename U, enable_if_t<conjunction<
+        negation<std::is_same<T, U>>, std::is_constructible<T, U>
+        >::value, std::nullptr_t> = nullptr>
+    explicit optional(optional<U>&& rhs): has_value_(rhs.has_value_), null_('\0')
+    {
+        if(this->has_value_)
+        {
+            this->assigner(std::move(rhs.value_));
+        }
+    }
+
+    template<typename U, enable_if_t<conjunction<
+        negation<std::is_same<T, U>>, std::is_constructible<T, U>
+        >::value, std::nullptr_t> = nullptr>
+    optional& operator=(const optional<U>& rhs)
+    {
+        if(this == std::addressof(rhs)) {return *this;}
+
+        this->cleanup();
+        this->has_value_ = rhs.has_value_;
+        if(this->has_value_)
+        {
+            this->assigner(rhs.value_);
+        }
+        return *this;
+    }
+
+    template<typename U, enable_if_t<conjunction<
+        negation<std::is_same<T, U>>, std::is_constructible<T, U>
+        >::value, std::nullptr_t> = nullptr>
+    optional& operator=(optional<U>&& rhs)
+    {
+        if(this == std::addressof(rhs)) {return *this;}
+
+        this->cleanup();
+        this->has_value_ = rhs.has_value_;
+        if(this->has_value_)
+        {
+            this->assigner(std::move(rhs.value_));
+        }
+        return *this;
+    }
+    ~optional() noexcept
+    {
+        this->cleanup();
+    }
+
+    explicit operator bool() const noexcept
+    {
+        return has_value_;
+    }
+
+    bool has_value() const noexcept {return has_value_;}
+
+    value_type const& value(source_location loc = source_location::current()) const
+    {
+        if( ! this->has_value_)
+        {
+            throw std::runtime_error("optional::value(): bad_unwrap" + to_string(loc));
+        }
+        return this->value_;
+    }
+    value_type& value(source_location loc = source_location::current())
+    {
+        if( ! this->has_value_)
+        {
+            throw std::runtime_error("optional::value(): bad_unwrap" + to_string(loc));
+        }
+        return this->value_;
+    }
+
+    value_type const& value_or(const value_type& opt) const
+    {
+        if(this->has_value_) {return this->value_;} else {return opt;}
+    }
+    value_type& value_or(value_type& opt)
+    {
+        if(this->has_value_) {return this->value_;} else {return opt;}
+    }
+
+  private:
+
+    void cleanup() noexcept
+    {
+        if(this->has_value_)
+        {
+            value_.~T();
+        }
+    }
+
+    template<typename U>
+    void assigner(U&& x)
+    {
+        const auto tmp = ::new(std::addressof(this->value_)) value_type(std::forward<U>(x));
+        assert(tmp == std::addressof(this->value_));
+        (void)tmp;
+    }
+
+  private:
+
+    bool has_value_;
+    union
+    {
+        char null_;
+        T    value_;
+    };
+};
+} // cxx
+} // toml
+#endif // TOML11_HAS_STD_OPTIONAL
+
+#endif // TOML11_COMPAT_HPP
+#ifndef TOML11_VALUE_T_HPP
+#define TOML11_VALUE_T_HPP
+
+#ifndef TOML11_VALUE_T_FWD_HPP
+#define TOML11_VALUE_T_FWD_HPP
+
+
+#include <iosfwd>
+#include <string>
+#include <type_traits>
+
+#include <cstdint>
+
+namespace toml
+{
+
+// forward decl
+template<typename TypeConfig>
+class basic_value;
+
+// ----------------------------------------------------------------------------
+// enum representing toml types
+
+enum class value_t : std::uint8_t
+{
+    empty           =  0,
+    boolean         =  1,
+    integer         =  2,
+    floating        =  3,
+    string          =  4,
+    offset_datetime =  5,
+    local_datetime  =  6,
+    local_date      =  7,
+    local_time      =  8,
+    array           =  9,
+    table           = 10
+};
+
+std::ostream& operator<<(std::ostream& os, value_t t);
+std::string to_string(value_t t);
+
+
+// ----------------------------------------------------------------------------
+// meta functions for internal use
+
+namespace detail
+{
+
+template<value_t V>
+using value_t_constant = std::integral_constant<value_t, V>;
+
+template<typename T, typename Value>
+struct type_to_enum : value_t_constant<value_t::empty> {};
+
+template<typename V> struct type_to_enum<typename V::boolean_type        , V> : value_t_constant<value_t::boolean        > {};
+template<typename V> struct type_to_enum<typename V::integer_type        , V> : value_t_constant<value_t::integer        > {};
+template<typename V> struct type_to_enum<typename V::floating_type       , V> : value_t_constant<value_t::floating       > {};
+template<typename V> struct type_to_enum<typename V::string_type         , V> : value_t_constant<value_t::string         > {};
+template<typename V> struct type_to_enum<typename V::offset_datetime_type, V> : value_t_constant<value_t::offset_datetime> {};
+template<typename V> struct type_to_enum<typename V::local_datetime_type , V> : value_t_constant<value_t::local_datetime > {};
+template<typename V> struct type_to_enum<typename V::local_date_type     , V> : value_t_constant<value_t::local_date     > {};
+template<typename V> struct type_to_enum<typename V::local_time_type     , V> : value_t_constant<value_t::local_time     > {};
+template<typename V> struct type_to_enum<typename V::array_type          , V> : value_t_constant<value_t::array          > {};
+template<typename V> struct type_to_enum<typename V::table_type          , V> : value_t_constant<value_t::table          > {};
+
+template<value_t V, typename Value>
+struct enum_to_type { using type = void; };
+
+template<typename V> struct enum_to_type<value_t::boolean        , V> { using type = typename V::boolean_type        ; };
+template<typename V> struct enum_to_type<value_t::integer        , V> { using type = typename V::integer_type        ; };
+template<typename V> struct enum_to_type<value_t::floating       , V> { using type = typename V::floating_type       ; };
+template<typename V> struct enum_to_type<value_t::string         , V> { using type = typename V::string_type         ; };
+template<typename V> struct enum_to_type<value_t::offset_datetime, V> { using type = typename V::offset_datetime_type; };
+template<typename V> struct enum_to_type<value_t::local_datetime , V> { using type = typename V::local_datetime_type ; };
+template<typename V> struct enum_to_type<value_t::local_date     , V> { using type = typename V::local_date_type     ; };
+template<typename V> struct enum_to_type<value_t::local_time     , V> { using type = typename V::local_time_type     ; };
+template<typename V> struct enum_to_type<value_t::array          , V> { using type = typename V::array_type          ; };
+template<typename V> struct enum_to_type<value_t::table          , V> { using type = typename V::table_type          ; };
+
+template<value_t V, typename Value>
+using enum_to_type_t = typename enum_to_type<V, Value>::type;
+
+template<value_t V>
+struct enum_to_fmt_type { using type = void; };
+
+template<> struct enum_to_fmt_type<value_t::boolean        > { using type = boolean_format_info        ; };
+template<> struct enum_to_fmt_type<value_t::integer        > { using type = integer_format_info        ; };
+template<> struct enum_to_fmt_type<value_t::floating       > { using type = floating_format_info       ; };
+template<> struct enum_to_fmt_type<value_t::string         > { using type = string_format_info         ; };
+template<> struct enum_to_fmt_type<value_t::offset_datetime> { using type = offset_datetime_format_info; };
+template<> struct enum_to_fmt_type<value_t::local_datetime > { using type = local_datetime_format_info ; };
+template<> struct enum_to_fmt_type<value_t::local_date     > { using type = local_date_format_info     ; };
+template<> struct enum_to_fmt_type<value_t::local_time     > { using type = local_time_format_info     ; };
+template<> struct enum_to_fmt_type<value_t::array          > { using type = array_format_info          ; };
+template<> struct enum_to_fmt_type<value_t::table          > { using type = table_format_info          ; };
+
+template<value_t V>
+using enum_to_fmt_type_t = typename enum_to_fmt_type<V>::type;
+
+template<typename T, typename Value>
+struct is_exact_toml_type0 : cxx::disjunction<
+    std::is_same<T, typename Value::boolean_type        >,
+    std::is_same<T, typename Value::integer_type        >,
+    std::is_same<T, typename Value::floating_type       >,
+    std::is_same<T, typename Value::string_type         >,
+    std::is_same<T, typename Value::offset_datetime_type>,
+    std::is_same<T, typename Value::local_datetime_type >,
+    std::is_same<T, typename Value::local_date_type     >,
+    std::is_same<T, typename Value::local_time_type     >,
+    std::is_same<T, typename Value::array_type          >,
+    std::is_same<T, typename Value::table_type          >
+    >{};
+template<typename T, typename V> struct is_exact_toml_type: is_exact_toml_type0<cxx::remove_cvref_t<T>, V> {};
+template<typename T, typename V> struct is_not_toml_type : cxx::negation<is_exact_toml_type<T, V>> {};
+
+} // namespace detail
+} // namespace toml
+#endif // TOML11_VALUE_T_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_VALUE_T_IMPL_HPP
+#define TOML11_VALUE_T_IMPL_HPP
+
+
+#include <ostream>
+#include <sstream>
+#include <string>
+
+namespace toml
+{
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, value_t t)
+{
+    switch(t)
+    {
+        case value_t::boolean         : os << "boolean";         return os;
+        case value_t::integer         : os << "integer";         return os;
+        case value_t::floating        : os << "floating";        return os;
+        case value_t::string          : os << "string";          return os;
+        case value_t::offset_datetime : os << "offset_datetime"; return os;
+        case value_t::local_datetime  : os << "local_datetime";  return os;
+        case value_t::local_date      : os << "local_date";      return os;
+        case value_t::local_time      : os << "local_time";      return os;
+        case value_t::array           : os << "array";           return os;
+        case value_t::table           : os << "table";           return os;
+        case value_t::empty           : os << "empty";           return os;
+        default                       : os << "unknown";         return os;
+    }
+}
+
+TOML11_INLINE std::string to_string(value_t t)
+{
+    std::ostringstream oss;
+    oss << t;
+    return oss.str();
+}
+
+} // namespace toml
+#endif // TOML11_VALUE_T_IMPL_HPP
+#endif
+
+#endif // TOML11_VALUE_T_HPP
+#ifndef TOML11_STORAGE_HPP
+#define TOML11_STORAGE_HPP
+
+
+namespace toml
+{
+namespace detail
+{
+
+// It owns a pointer to T. It does deep-copy when copied.
+// This struct is introduced to implement a recursive type.
+//
+// `toml::value` contains `std::vector<toml::value>` to represent a toml array.
+// But, in the definition of `toml::value`, `toml::value` is still incomplete.
+// `std::vector` of an incomplete type is not allowed in C++11 (it is allowed
+// after C++17). To avoid this, we need to use a pointer to `toml::value`, like
+// `std::vector<std::unique_ptr<toml::value>>`. Although `std::unique_ptr` is
+// noncopyable, we want to make `toml::value` copyable. `storage` is introduced
+// to resolve those problems.
+template<typename T>
+struct storage
+{
+    using value_type = T;
+
+    explicit storage(value_type v): ptr_(cxx::make_unique<T>(std::move(v))) {}
+    ~storage() = default;
+
+    storage(const storage& rhs): ptr_(cxx::make_unique<T>(*rhs.ptr_)) {}
+    storage& operator=(const storage& rhs)
+    {
+        this->ptr_ = cxx::make_unique<T>(*rhs.ptr_);
+        return *this;
+    }
+
+    storage(storage&&) = default;
+    storage& operator=(storage&&) = default;
+
+    bool is_ok() const noexcept {return static_cast<bool>(ptr_);}
+
+    value_type& get() const noexcept {return *ptr_;}
+
+  private:
+    std::unique_ptr<value_type> ptr_;
+};
+
+} // detail
+} // toml
+#endif // TOML11_STORAGE_HPP
+#ifndef TOML11_COMMENTS_HPP
+#define TOML11_COMMENTS_HPP
+
+#ifndef TOML11_COMMENTS_FWD_HPP
+#define TOML11_COMMENTS_FWD_HPP
+
+// to use __has_builtin
+
+#include <exception>
+#include <initializer_list>
+#include <iterator>
+#include <stdexcept>
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <vector>
+#include <ostream>
+
+// This file provides mainly two classes, `preserve_comments` and `discard_comments`.
+// Those two are a container that have the same interface as `std::vector<std::string>`
+// but bahaves in the opposite way. `preserve_comments` is just the same as
+// `std::vector<std::string>` and each `std::string` corresponds to a comment line.
+// Conversely, `discard_comments` discards all the strings and ignores everything
+// assigned in it. `discard_comments` is always empty and you will encounter an
+// error whenever you access to the element.
+namespace toml
+{
+class discard_comments; // forward decl
+
+class preserve_comments
+{
+  public:
+    // `container_type` is not provided in discard_comments.
+    // do not use this inner-type in a generic code.
+    using container_type         = std::vector<std::string>;
+
+    using size_type              = container_type::size_type;
+    using difference_type        = container_type::difference_type;
+    using value_type             = container_type::value_type;
+    using reference              = container_type::reference;
+    using const_reference        = container_type::const_reference;
+    using pointer                = container_type::pointer;
+    using const_pointer          = container_type::const_pointer;
+    using iterator               = container_type::iterator;
+    using const_iterator         = container_type::const_iterator;
+    using reverse_iterator       = container_type::reverse_iterator;
+    using const_reverse_iterator = container_type::const_reverse_iterator;
+
+  public:
+
+    preserve_comments()  = default;
+    ~preserve_comments() = default;
+    preserve_comments(preserve_comments const&) = default;
+    preserve_comments(preserve_comments &&)     = default;
+    preserve_comments& operator=(preserve_comments const&) = default;
+    preserve_comments& operator=(preserve_comments &&)     = default;
+
+    explicit preserve_comments(const std::vector<std::string>& c): comments(c){}
+    explicit preserve_comments(std::vector<std::string>&& c)
+        : comments(std::move(c))
+    {}
+    preserve_comments& operator=(const std::vector<std::string>& c)
+    {
+        comments = c;
+        return *this;
+    }
+    preserve_comments& operator=(std::vector<std::string>&& c)
+    {
+        comments = std::move(c);
+        return *this;
+    }
+
+    explicit preserve_comments(const discard_comments&) {}
+
+    explicit preserve_comments(size_type n): comments(n) {}
+    preserve_comments(size_type n, const std::string& x): comments(n, x) {}
+    preserve_comments(std::initializer_list<std::string> x): comments(x) {}
+    template<typename InputIterator>
+    preserve_comments(InputIterator first, InputIterator last)
+        : comments(first, last)
+    {}
+
+    template<typename InputIterator>
+    void assign(InputIterator first, InputIterator last) {comments.assign(first, last);}
+    void assign(std::initializer_list<std::string> ini)  {comments.assign(ini);}
+    void assign(size_type n, const std::string& val)     {comments.assign(n, val);}
+
+    // Related to the issue #97.
+    //
+    // `std::vector::insert` and `std::vector::erase` in the STL implementation
+    // included in GCC 4.8.5 takes `std::vector::iterator` instead of
+    // `std::vector::const_iterator`. It causes compilation error in GCC 4.8.5.
+#if defined(__GNUC__) && defined(__GNUC_MINOR__) && defined(__GNUC_PATCHLEVEL__) && !defined(__clang__)
+#  if (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__) <= 40805
+#    define TOML11_WORKAROUND_GCC_4_8_X_STANDARD_LIBRARY_IMPLEMENTATION
+#  endif
+#endif
+
+#ifdef TOML11_WORKAROUND_GCC_4_8_X_STANDARD_LIBRARY_IMPLEMENTATION
+    iterator insert(iterator p, const std::string& x)
+    {
+        return comments.insert(p, x);
+    }
+    iterator insert(iterator p, std::string&&      x)
+    {
+        return comments.insert(p, std::move(x));
+    }
+    void insert(iterator p, size_type n, const std::string& x)
+    {
+        return comments.insert(p, n, x);
+    }
+    template<typename InputIterator>
+    void insert(iterator p, InputIterator first, InputIterator last)
+    {
+        return comments.insert(p, first, last);
+    }
+    void insert(iterator p, std::initializer_list<std::string> ini)
+    {
+        return comments.insert(p, ini);
+    }
+
+    template<typename ... Ts>
+    iterator emplace(iterator p, Ts&& ... args)
+    {
+        return comments.emplace(p, std::forward<Ts>(args)...);
+    }
+
+    iterator erase(iterator pos) {return comments.erase(pos);}
+    iterator erase(iterator first, iterator last)
+    {
+        return comments.erase(first, last);
+    }
+#else
+    iterator insert(const_iterator p, const std::string& x)
+    {
+        return comments.insert(p, x);
+    }
+    iterator insert(const_iterator p, std::string&&      x)
+    {
+        return comments.insert(p, std::move(x));
+    }
+    iterator insert(const_iterator p, size_type n, const std::string& x)
+    {
+        return comments.insert(p, n, x);
+    }
+    template<typename InputIterator>
+    iterator insert(const_iterator p, InputIterator first, InputIterator last)
+    {
+        return comments.insert(p, first, last);
+    }
+    iterator insert(const_iterator p, std::initializer_list<std::string> ini)
+    {
+        return comments.insert(p, ini);
+    }
+
+    template<typename ... Ts>
+    iterator emplace(const_iterator p, Ts&& ... args)
+    {
+        return comments.emplace(p, std::forward<Ts>(args)...);
+    }
+
+    iterator erase(const_iterator pos) {return comments.erase(pos);}
+    iterator erase(const_iterator first, const_iterator last)
+    {
+        return comments.erase(first, last);
+    }
+#endif
+
+    void swap(preserve_comments& other) {comments.swap(other.comments);}
+
+    void push_back(const std::string& v) {comments.push_back(v);}
+    void push_back(std::string&&      v) {comments.push_back(std::move(v));}
+    void pop_back()                      {comments.pop_back();}
+
+    template<typename ... Ts>
+    void emplace_back(Ts&& ... args) {comments.emplace_back(std::forward<Ts>(args)...);}
+
+    void clear() {comments.clear();}
+
+    size_type size()     const noexcept {return comments.size();}
+    size_type max_size() const noexcept {return comments.max_size();}
+    size_type capacity() const noexcept {return comments.capacity();}
+    bool      empty()    const noexcept {return comments.empty();}
+
+    void reserve(size_type n)                      {comments.reserve(n);}
+    void resize(size_type n)                       {comments.resize(n);}
+    void resize(size_type n, const std::string& c) {comments.resize(n, c);}
+    void shrink_to_fit()                           {comments.shrink_to_fit();}
+
+    reference       operator[](const size_type n)       noexcept {return comments[n];}
+    const_reference operator[](const size_type n) const noexcept {return comments[n];}
+    reference       at(const size_type n)       {return comments.at(n);}
+    const_reference at(const size_type n) const {return comments.at(n);}
+    reference       front()       noexcept {return comments.front();}
+    const_reference front() const noexcept {return comments.front();}
+    reference       back()        noexcept {return comments.back();}
+    const_reference back()  const noexcept {return comments.back();}
+
+    pointer         data()        noexcept {return comments.data();}
+    const_pointer   data()  const noexcept {return comments.data();}
+
+    iterator       begin()        noexcept {return comments.begin();}
+    iterator       end()          noexcept {return comments.end();}
+    const_iterator begin()  const noexcept {return comments.begin();}
+    const_iterator end()    const noexcept {return comments.end();}
+    const_iterator cbegin() const noexcept {return comments.cbegin();}
+    const_iterator cend()   const noexcept {return comments.cend();}
+
+    reverse_iterator       rbegin()        noexcept {return comments.rbegin();}
+    reverse_iterator       rend()          noexcept {return comments.rend();}
+    const_reverse_iterator rbegin()  const noexcept {return comments.rbegin();}
+    const_reverse_iterator rend()    const noexcept {return comments.rend();}
+    const_reverse_iterator crbegin() const noexcept {return comments.crbegin();}
+    const_reverse_iterator crend()   const noexcept {return comments.crend();}
+
+    friend bool operator==(const preserve_comments&, const preserve_comments&);
+    friend bool operator!=(const preserve_comments&, const preserve_comments&);
+    friend bool operator< (const preserve_comments&, const preserve_comments&);
+    friend bool operator<=(const preserve_comments&, const preserve_comments&);
+    friend bool operator> (const preserve_comments&, const preserve_comments&);
+    friend bool operator>=(const preserve_comments&, const preserve_comments&);
+
+    friend void swap(preserve_comments&, std::vector<std::string>&);
+    friend void swap(std::vector<std::string>&, preserve_comments&);
+
+  private:
+
+    container_type comments;
+};
+
+bool operator==(const preserve_comments& lhs, const preserve_comments& rhs);
+bool operator!=(const preserve_comments& lhs, const preserve_comments& rhs);
+bool operator< (const preserve_comments& lhs, const preserve_comments& rhs);
+bool operator<=(const preserve_comments& lhs, const preserve_comments& rhs);
+bool operator> (const preserve_comments& lhs, const preserve_comments& rhs);
+bool operator>=(const preserve_comments& lhs, const preserve_comments& rhs);
+
+void swap(preserve_comments& lhs, preserve_comments& rhs);
+void swap(preserve_comments& lhs, std::vector<std::string>& rhs);
+void swap(std::vector<std::string>& lhs, preserve_comments& rhs);
+
+std::ostream& operator<<(std::ostream& os, const preserve_comments& com);
+
+namespace detail
+{
+
+// To provide the same interface with `preserve_comments`, `discard_comments`
+// should have an iterator. But it does not contain anything, so we need to
+// add an iterator that points nothing.
+//
+// It always points null, so DO NOT unwrap this iterator. It always crashes
+// your program.
+template<typename T, bool is_const>
+struct empty_iterator
+{
+    using value_type        = T;
+    using reference_type    = typename std::conditional<is_const, T const&, T&>::type;
+    using pointer_type      = typename std::conditional<is_const, T const*, T*>::type;
+    using difference_type   = std::ptrdiff_t;
+    using iterator_category = std::random_access_iterator_tag;
+
+    empty_iterator()  = default;
+    ~empty_iterator() = default;
+    empty_iterator(empty_iterator const&) = default;
+    empty_iterator(empty_iterator &&)     = default;
+    empty_iterator& operator=(empty_iterator const&) = default;
+    empty_iterator& operator=(empty_iterator &&)     = default;
+
+    // DO NOT call these operators.
+    reference_type operator*()  const noexcept {std::terminate();}
+    pointer_type   operator->() const noexcept {return nullptr;}
+    reference_type operator[](difference_type) const noexcept {return this->operator*();}
+
+    // These operators do nothing.
+    empty_iterator& operator++()    noexcept {return *this;}
+    empty_iterator  operator++(int) noexcept {return *this;}
+    empty_iterator& operator--()    noexcept {return *this;}
+    empty_iterator  operator--(int) noexcept {return *this;}
+
+    empty_iterator& operator+=(difference_type) noexcept {return *this;}
+    empty_iterator& operator-=(difference_type) noexcept {return *this;}
+
+    empty_iterator  operator+(difference_type) const noexcept {return *this;}
+    empty_iterator  operator-(difference_type) const noexcept {return *this;}
+};
+
+template<typename T, bool C>
+bool operator==(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return true;}
+template<typename T, bool C>
+bool operator!=(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return false;}
+template<typename T, bool C>
+bool operator< (const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return false;}
+template<typename T, bool C>
+bool operator<=(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return true;}
+template<typename T, bool C>
+bool operator> (const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return false;}
+template<typename T, bool C>
+bool operator>=(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return true;}
+
+template<typename T, bool C>
+typename empty_iterator<T, C>::difference_type
+operator-(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return 0;}
+
+template<typename T, bool C>
+empty_iterator<T, C>
+operator+(typename empty_iterator<T, C>::difference_type, const empty_iterator<T, C>& rhs) noexcept {return rhs;}
+template<typename T, bool C>
+empty_iterator<T, C>
+operator+(const empty_iterator<T, C>& lhs, typename empty_iterator<T, C>::difference_type) noexcept {return lhs;}
+
+} // detail
+
+// The default comment type. It discards all the comments. It requires only one
+// byte to contain, so the memory footprint is smaller than preserve_comments.
+//
+// It just ignores `push_back`, `insert`, `erase`, and any other modifications.
+// IT always returns size() == 0, the iterator taken by `begin()` is always the
+// same as that of `end()`, and accessing through `operator[]` or iterators
+// always causes a segmentation fault. DO NOT access to the element of this.
+//
+// Why this is chose as the default type is because the last version (2.x.y)
+// does not contain any comments in a value. To minimize the impact on the
+// efficiency, this is chosen as a default.
+//
+// To reduce the memory footprint, later we can try empty base optimization (EBO).
+class discard_comments
+{
+  public:
+    using size_type              = std::size_t;
+    using difference_type        = std::ptrdiff_t;
+    using value_type             = std::string;
+    using reference              = std::string&;
+    using const_reference        = std::string const&;
+    using pointer                = std::string*;
+    using const_pointer          = std::string const*;
+    using iterator               = detail::empty_iterator<std::string, false>;
+    using const_iterator         = detail::empty_iterator<std::string, true>;
+    using reverse_iterator       = detail::empty_iterator<std::string, false>;
+    using const_reverse_iterator = detail::empty_iterator<std::string, true>;
+
+  public:
+    discard_comments() = default;
+    ~discard_comments() = default;
+    discard_comments(discard_comments const&) = default;
+    discard_comments(discard_comments &&)     = default;
+    discard_comments& operator=(discard_comments const&) = default;
+    discard_comments& operator=(discard_comments &&)     = default;
+
+    explicit discard_comments(const std::vector<std::string>&) noexcept {}
+    explicit discard_comments(std::vector<std::string>&&)      noexcept {}
+    discard_comments& operator=(const std::vector<std::string>&) noexcept {return *this;}
+    discard_comments& operator=(std::vector<std::string>&&)      noexcept {return *this;}
+
+    explicit discard_comments(const preserve_comments&)        noexcept {}
+
+    explicit discard_comments(size_type) noexcept {}
+    discard_comments(size_type, const std::string&) noexcept {}
+    discard_comments(std::initializer_list<std::string>) noexcept {}
+    template<typename InputIterator>
+    discard_comments(InputIterator, InputIterator) noexcept {}
+
+    template<typename InputIterator>
+    void assign(InputIterator, InputIterator)       noexcept {}
+    void assign(std::initializer_list<std::string>) noexcept {}
+    void assign(size_type, const std::string&)      noexcept {}
+
+    iterator insert(const_iterator, const std::string&)                 {return iterator{};}
+    iterator insert(const_iterator, std::string&&)                      {return iterator{};}
+    iterator insert(const_iterator, size_type, const std::string&)      {return iterator{};}
+    template<typename InputIterator>
+    iterator insert(const_iterator, InputIterator, InputIterator)       {return iterator{};}
+    iterator insert(const_iterator, std::initializer_list<std::string>) {return iterator{};}
+
+    template<typename ... Ts>
+    iterator emplace(const_iterator, Ts&& ...)     {return iterator{};}
+    iterator erase(const_iterator)                 {return iterator{};}
+    iterator erase(const_iterator, const_iterator) {return iterator{};}
+
+    void swap(discard_comments&) {return;}
+
+    void push_back(const std::string&) {return;}
+    void push_back(std::string&&     ) {return;}
+    void pop_back()                    {return;}
+
+    template<typename ... Ts>
+    void emplace_back(Ts&& ...) {return;}
+
+    void clear() {return;}
+
+    size_type size()     const noexcept {return 0;}
+    size_type max_size() const noexcept {return 0;}
+    size_type capacity() const noexcept {return 0;}
+    bool      empty()    const noexcept {return true;}
+
+    void reserve(size_type)                    {return;}
+    void resize(size_type)                     {return;}
+    void resize(size_type, const std::string&) {return;}
+    void shrink_to_fit()                       {return;}
+
+    // DO NOT access to the element of this container. This container is always
+    // empty, so accessing through operator[], front/back, data causes address
+    // error.
+
+    reference       operator[](const size_type)       noexcept {never_call("toml::discard_comment::operator[]");}
+    const_reference operator[](const size_type) const noexcept {never_call("toml::discard_comment::operator[]");}
+    reference       at(const size_type)       {throw std::out_of_range("toml::discard_comment is always empty.");}
+    const_reference at(const size_type) const {throw std::out_of_range("toml::discard_comment is always empty.");}
+    reference       front()       noexcept {never_call("toml::discard_comment::front");}
+    const_reference front() const noexcept {never_call("toml::discard_comment::front");}
+    reference       back()        noexcept {never_call("toml::discard_comment::back");}
+    const_reference back()  const noexcept {never_call("toml::discard_comment::back");}
+
+    pointer         data()        noexcept {return nullptr;}
+    const_pointer   data()  const noexcept {return nullptr;}
+
+    iterator       begin()        noexcept {return iterator{};}
+    iterator       end()          noexcept {return iterator{};}
+    const_iterator begin()  const noexcept {return const_iterator{};}
+    const_iterator end()    const noexcept {return const_iterator{};}
+    const_iterator cbegin() const noexcept {return const_iterator{};}
+    const_iterator cend()   const noexcept {return const_iterator{};}
+
+    reverse_iterator       rbegin()        noexcept {return iterator{};}
+    reverse_iterator       rend()          noexcept {return iterator{};}
+    const_reverse_iterator rbegin()  const noexcept {return const_iterator{};}
+    const_reverse_iterator rend()    const noexcept {return const_iterator{};}
+    const_reverse_iterator crbegin() const noexcept {return const_iterator{};}
+    const_reverse_iterator crend()   const noexcept {return const_iterator{};}
+
+  private:
+
+    [[noreturn]] static void never_call(const char *const this_function)
+    {
+#if __has_builtin(__builtin_unreachable)
+        __builtin_unreachable();
+#endif
+        throw std::logic_error{this_function};
+    }
+};
+
+inline bool operator==(const discard_comments&, const discard_comments&) noexcept {return true;}
+inline bool operator!=(const discard_comments&, const discard_comments&) noexcept {return false;}
+inline bool operator< (const discard_comments&, const discard_comments&) noexcept {return false;}
+inline bool operator<=(const discard_comments&, const discard_comments&) noexcept {return true;}
+inline bool operator> (const discard_comments&, const discard_comments&) noexcept {return false;}
+inline bool operator>=(const discard_comments&, const discard_comments&) noexcept {return true;}
+
+inline void swap(const discard_comments&, const discard_comments&) noexcept {return;}
+
+inline std::ostream& operator<<(std::ostream& os, const discard_comments&) {return os;}
+
+} // toml11
+#endif // TOML11_COMMENTS_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_COMMENTS_IMPL_HPP
+#define TOML11_COMMENTS_IMPL_HPP
+
+
+namespace toml
+{
+
+TOML11_INLINE bool operator==(const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments == rhs.comments;}
+TOML11_INLINE bool operator!=(const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments != rhs.comments;}
+TOML11_INLINE bool operator< (const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments <  rhs.comments;}
+TOML11_INLINE bool operator<=(const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments <= rhs.comments;}
+TOML11_INLINE bool operator> (const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments >  rhs.comments;}
+TOML11_INLINE bool operator>=(const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments >= rhs.comments;}
+
+TOML11_INLINE void swap(preserve_comments& lhs, preserve_comments& rhs)
+{
+    lhs.swap(rhs);
+    return;
+}
+TOML11_INLINE void swap(preserve_comments& lhs, std::vector<std::string>& rhs)
+{
+    lhs.comments.swap(rhs);
+    return;
+}
+TOML11_INLINE void swap(std::vector<std::string>& lhs, preserve_comments& rhs)
+{
+    lhs.swap(rhs.comments);
+    return;
+}
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const preserve_comments& com)
+{
+    for(const auto& c : com)
+    {
+        if(c.front() != '#')
+        {
+            os << '#';
+        }
+        os << c << '\n';
+    }
+    return os;
+}
+
+} // toml11
+#endif // TOML11_COMMENTS_IMPL_HPP
+#endif
+
+#endif // TOML11_COMMENTS_HPP
+#ifndef TOML11_COLOR_HPP
+#define TOML11_COLOR_HPP
+
+#ifndef TOML11_COLOR_FWD_HPP
+#define TOML11_COLOR_FWD_HPP
+
+#include <iosfwd>
+
+#ifdef TOML11_COLORIZE_ERROR_MESSAGE
+#define TOML11_ERROR_MESSAGE_COLORIZED true
+#else
+#define TOML11_ERROR_MESSAGE_COLORIZED false
+#endif
+
+#ifdef TOML11_USE_THREAD_LOCAL_COLORIZATION
+#define TOML11_THREAD_LOCAL_COLORIZATION thread_local
+#else
+#define TOML11_THREAD_LOCAL_COLORIZATION
+#endif
+
+namespace toml
+{
+namespace color
+{
+// put ANSI escape sequence to ostream
+inline namespace ansi
+{
+namespace detail
+{
+
+// Control color mode globally
+class color_mode
+{
+  public:
+
+    void enable() noexcept
+    {
+        should_color_ = true;
+    }
+    void disable() noexcept
+    {
+        should_color_ = false;
+    }
+    bool should_color() const noexcept
+    {
+        return should_color_;
+    }
+
+  private:
+
+    bool should_color_ = TOML11_ERROR_MESSAGE_COLORIZED;
+};
+
+inline color_mode& color_status() noexcept
+{
+    static TOML11_THREAD_LOCAL_COLORIZATION color_mode status;
+    return status;
+}
+
+} // detail
+
+std::ostream& reset  (std::ostream& os);
+std::ostream& bold   (std::ostream& os);
+std::ostream& grey   (std::ostream& os);
+std::ostream& gray   (std::ostream& os);
+std::ostream& red    (std::ostream& os);
+std::ostream& green  (std::ostream& os);
+std::ostream& yellow (std::ostream& os);
+std::ostream& blue   (std::ostream& os);
+std::ostream& magenta(std::ostream& os);
+std::ostream& cyan   (std::ostream& os);
+std::ostream& white  (std::ostream& os);
+
+} // ansi
+
+inline void enable()
+{
+    return detail::color_status().enable();
+}
+inline void disable()
+{
+    return detail::color_status().disable();
+}
+inline bool should_color()
+{
+    return detail::color_status().should_color();
+}
+
+} // color
+} // toml
+#endif // TOML11_COLOR_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_COLOR_IMPL_HPP
+#define TOML11_COLOR_IMPL_HPP
+
+
+#include <ostream>
+
+namespace toml
+{
+namespace color
+{
+// put ANSI escape sequence to ostream
+inline namespace ansi
+{
+
+TOML11_INLINE std::ostream& reset(std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[00m";}
+    return os;
+}
+TOML11_INLINE std::ostream& bold(std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[01m";}
+    return os;
+}
+TOML11_INLINE std::ostream& grey(std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[30m";}
+    return os;
+}
+TOML11_INLINE std::ostream& gray(std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[30m";}
+    return os;
+}
+TOML11_INLINE std::ostream& red(std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[31m";}
+    return os;
+}
+TOML11_INLINE std::ostream& green(std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[32m";}
+    return os;
+}
+TOML11_INLINE std::ostream& yellow(std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[33m";}
+    return os;
+}
+TOML11_INLINE std::ostream& blue(std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[34m";}
+    return os;
+}
+TOML11_INLINE std::ostream& magenta(std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[35m";}
+    return os;
+}
+TOML11_INLINE std::ostream& cyan   (std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[36m";}
+    return os;
+}
+TOML11_INLINE std::ostream& white  (std::ostream& os)
+{
+    if(detail::color_status().should_color()) {os << "\033[37m";}
+    return os;
+}
+
+} // ansi
+} // color
+} // toml
+#endif // TOML11_COLOR_IMPL_HPP
+#endif
+
+#endif // TOML11_COLOR_HPP
+#ifndef TOML11_SPEC_HPP
+#define TOML11_SPEC_HPP
+
+#include <array>
+#include <functional>
+#include <ostream>
+#include <sstream>
+#include <utility>
+
+#include <cstdint>
+
+namespace toml
+{
+
+struct semantic_version
+{
+    constexpr semantic_version(std::uint32_t mjr, std::uint32_t mnr, std::uint32_t p) noexcept
+        : major{mjr}, minor{mnr}, patch{p}
+    {}
+
+    std::uint32_t major;
+    std::uint32_t minor;
+    std::uint32_t patch;
+};
+
+constexpr inline semantic_version
+make_semver(std::uint32_t mjr, std::uint32_t mnr, std::uint32_t p) noexcept
+{
+    return semantic_version(mjr, mnr, p);
+}
+
+constexpr inline bool
+operator==(const semantic_version& lhs, const semantic_version& rhs) noexcept
+{
+    return lhs.major == rhs.major &&
+           lhs.minor == rhs.minor &&
+           lhs.patch == rhs.patch;
+}
+constexpr inline bool
+operator!=(const semantic_version& lhs, const semantic_version& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+constexpr inline bool
+operator<(const semantic_version& lhs, const semantic_version& rhs) noexcept
+{
+    return lhs.major < rhs.major ||
+           (lhs.major == rhs.major && lhs.minor < rhs.minor) ||
+           (lhs.major == rhs.major && lhs.minor == rhs.minor && lhs.patch < rhs.patch);
+}
+constexpr inline bool
+operator>(const semantic_version& lhs, const semantic_version& rhs) noexcept
+{
+    return rhs < lhs;
+}
+constexpr inline bool
+operator<=(const semantic_version& lhs, const semantic_version& rhs) noexcept
+{
+    return !(lhs > rhs);
+}
+constexpr inline bool
+operator>=(const semantic_version& lhs, const semantic_version& rhs) noexcept
+{
+    return !(lhs < rhs);
+}
+
+inline std::ostream& operator<<(std::ostream& os, const semantic_version& v)
+{
+    os << v.major << '.' << v.minor << '.' << v.patch;
+    return os;
+}
+
+inline std::string to_string(const semantic_version& v)
+{
+    std::ostringstream oss;
+    oss << v;
+    return oss.str();
+}
+
+struct spec
+{
+    constexpr static spec default_version() noexcept
+    {
+        return spec::v(1, 0, 0);
+    }
+
+    constexpr static spec v(std::uint32_t mjr, std::uint32_t mnr, std::uint32_t p) noexcept
+    {
+        return spec(make_semver(mjr, mnr, p));
+    }
+
+    constexpr explicit spec(const semantic_version& semver) noexcept
+        : version{semver},
+          v1_1_0_allow_control_characters_in_comments {semantic_version{1, 1, 0} <= semver},
+          v1_1_0_allow_newlines_in_inline_tables      {semantic_version{1, 1, 0} <= semver},
+          v1_1_0_allow_trailing_comma_in_inline_tables{semantic_version{1, 1, 0} <= semver},
+          v1_1_0_allow_non_english_in_bare_keys       {semantic_version{1, 1, 0} <= semver},
+          v1_1_0_add_escape_sequence_e                {semantic_version{1, 1, 0} <= semver},
+          v1_1_0_add_escape_sequence_x                {semantic_version{1, 1, 0} <= semver},
+          v1_1_0_make_seconds_optional                {semantic_version{1, 1, 0} <= semver},
+          ext_hex_float {false},
+          ext_num_suffix{false},
+          ext_null_value{false}
+    {}
+
+    semantic_version version; // toml version
+
+    // diff from v1.0.0 -> v1.1.0
+    bool v1_1_0_allow_control_characters_in_comments;
+    bool v1_1_0_allow_newlines_in_inline_tables;
+    bool v1_1_0_allow_trailing_comma_in_inline_tables;
+    bool v1_1_0_allow_non_english_in_bare_keys;
+    bool v1_1_0_add_escape_sequence_e;
+    bool v1_1_0_add_escape_sequence_x;
+    bool v1_1_0_make_seconds_optional;
+
+    // library extensions
+    bool ext_hex_float;  // allow hex float (in C++ style)
+    bool ext_num_suffix; // allow number suffix (in C++ style)
+    bool ext_null_value; // allow `null` as a value
+};
+
+namespace detail
+{
+inline std::pair<const semantic_version&, std::array<bool, 10>>
+to_tuple(const spec& s) noexcept
+{
+    return std::make_pair(std::cref(s.version), std::array<bool, 10>{{
+            s.v1_1_0_allow_control_characters_in_comments,
+            s.v1_1_0_allow_newlines_in_inline_tables,
+            s.v1_1_0_allow_trailing_comma_in_inline_tables,
+            s.v1_1_0_allow_non_english_in_bare_keys,
+            s.v1_1_0_add_escape_sequence_e,
+            s.v1_1_0_add_escape_sequence_x,
+            s.v1_1_0_make_seconds_optional,
+            s.ext_hex_float,
+            s.ext_num_suffix,
+            s.ext_null_value
+        }});
+}
+} // detail
+
+inline bool operator==(const spec& lhs, const spec& rhs) noexcept
+{
+    return detail::to_tuple(lhs) == detail::to_tuple(rhs);
+}
+inline bool operator!=(const spec& lhs, const spec& rhs) noexcept
+{
+    return detail::to_tuple(lhs) != detail::to_tuple(rhs);
+}
+inline bool operator< (const spec& lhs, const spec& rhs) noexcept
+{
+    return detail::to_tuple(lhs) <  detail::to_tuple(rhs);
+}
+inline bool operator<=(const spec& lhs, const spec& rhs) noexcept
+{
+    return detail::to_tuple(lhs) <= detail::to_tuple(rhs);
+}
+inline bool operator> (const spec& lhs, const spec& rhs) noexcept
+{
+    return detail::to_tuple(lhs) >  detail::to_tuple(rhs);
+}
+inline bool operator>=(const spec& lhs, const spec& rhs) noexcept
+{
+    return detail::to_tuple(lhs) >= detail::to_tuple(rhs);
+}
+
+} // namespace toml
+#endif // TOML11_SPEC_HPP
+#ifndef TOML11_ORDERED_MAP_HPP
+#define TOML11_ORDERED_MAP_HPP
+
+#include <algorithm>
+#include <stdexcept>
+#include <utility>
+#include <vector>
+
+namespace toml
+{
+
+namespace detail
+{
+template<typename Cmp>
+struct ordered_map_ebo_container
+{
+    Cmp cmp_; // empty base optimization for empty Cmp type
+};
+} // detail
+
+template<typename Key, typename Val, typename Cmp = std::equal_to<Key>,
+         typename Allocator = std::allocator<std::pair<Key, Val>>>
+class ordered_map : detail::ordered_map_ebo_container<Cmp>
+{
+  public:
+    using key_type    = Key;
+    using mapped_type = Val;
+    using value_type  = std::pair<Key, Val>;
+
+    using key_compare    = Cmp;
+    using allocator_type = Allocator;
+
+    using container_type  = std::vector<value_type, Allocator>;
+    using reference       = typename container_type::reference;
+    using pointer         = typename container_type::pointer;
+    using const_reference = typename container_type::const_reference;
+    using const_pointer   = typename container_type::const_pointer;
+    using iterator        = typename container_type::iterator;
+    using const_iterator  = typename container_type::const_iterator;
+    using size_type       = typename container_type::size_type;
+    using difference_type = typename container_type::difference_type;
+
+  private:
+
+    using ebo_base = detail::ordered_map_ebo_container<Cmp>;
+
+  public:
+
+    ordered_map() = default;
+    ~ordered_map() = default;
+    ordered_map(const ordered_map&) = default;
+    ordered_map(ordered_map&&)      = default;
+    ordered_map& operator=(const ordered_map&) = default;
+    ordered_map& operator=(ordered_map&&)      = default;
+
+    ordered_map(const ordered_map& other, const Allocator& alloc)
+        : container_(other.container_, alloc)
+    {}
+    ordered_map(ordered_map&& other, const Allocator& alloc)
+        : container_(std::move(other.container_), alloc)
+    {}
+
+    explicit ordered_map(const Cmp& cmp, const Allocator& alloc = Allocator())
+        : ebo_base{cmp}, container_(alloc)
+    {}
+    explicit ordered_map(const Allocator& alloc)
+        : container_(alloc)
+    {}
+
+    template<typename InputIterator>
+    ordered_map(InputIterator first, InputIterator last, const Cmp& cmp = Cmp(), const Allocator& alloc = Allocator())
+        : ebo_base{cmp}, container_(first, last, alloc)
+    {}
+    template<typename InputIterator>
+    ordered_map(InputIterator first, InputIterator last, const Allocator& alloc)
+        : container_(first, last, alloc)
+    {}
+
+    ordered_map(std::initializer_list<value_type> v, const Cmp& cmp = Cmp(), const Allocator& alloc = Allocator())
+        : ebo_base{cmp}, container_(std::move(v), alloc)
+    {}
+    ordered_map(std::initializer_list<value_type> v, const Allocator& alloc)
+        : container_(std::move(v), alloc)
+    {}
+    ordered_map& operator=(std::initializer_list<value_type> v)
+    {
+        this->container_ = std::move(v);
+        return *this;
+    }
+
+    iterator       begin()        noexcept {return container_.begin();}
+    iterator       end()          noexcept {return container_.end();}
+    const_iterator begin()  const noexcept {return container_.begin();}
+    const_iterator end()    const noexcept {return container_.end();}
+    const_iterator cbegin() const noexcept {return container_.cbegin();}
+    const_iterator cend()   const noexcept {return container_.cend();}
+
+    bool        empty()    const noexcept {return container_.empty();}
+    std::size_t size()     const noexcept {return container_.size();}
+    std::size_t max_size() const noexcept {return container_.max_size();}
+
+    void clear() {container_.clear();}
+
+    void push_back(const value_type& v)
+    {
+        if(this->contains(v.first))
+        {
+            throw std::out_of_range("ordered_map: value already exists");
+        }
+        container_.push_back(v);
+    }
+    void push_back(value_type&& v)
+    {
+        if(this->contains(v.first))
+        {
+            throw std::out_of_range("ordered_map: value already exists");
+        }
+        container_.push_back(std::move(v));
+    }
+    void emplace_back(key_type k, mapped_type v)
+    {
+        if(this->contains(k))
+        {
+            throw std::out_of_range("ordered_map: value already exists");
+        }
+        container_.emplace_back(std::move(k), std::move(v));
+    }
+    void pop_back()  {container_.pop_back();}
+
+    void insert(value_type kv)
+    {
+        if(this->contains(kv.first))
+        {
+            throw std::out_of_range("ordered_map: value already exists");
+        }
+        container_.push_back(std::move(kv));
+    }
+    void emplace(key_type k, mapped_type v)
+    {
+        if(this->contains(k))
+        {
+            throw std::out_of_range("ordered_map: value already exists");
+        }
+        container_.emplace_back(std::move(k), std::move(v));
+    }
+
+    std::size_t count(const key_type& key) const
+    {
+        if(this->find(key) != this->end())
+        {
+            return 1;
+        }
+        else
+        {
+            return 0;
+        }
+    }
+    bool contains(const key_type& key) const
+    {
+        return this->find(key) != this->end();
+    }
+    iterator find(const key_type& key) noexcept
+    {
+        return std::find_if(this->begin(), this->end(),
+            [&key, this](const value_type& v) {return this->cmp_(v.first, key);});
+    }
+    const_iterator find(const key_type& key) const noexcept
+    {
+        return std::find_if(this->begin(), this->end(),
+            [&key, this](const value_type& v) {return this->cmp_(v.first, key);});
+    }
+
+    mapped_type&       at(const key_type& k)
+    {
+        const auto iter = this->find(k);
+        if(iter == this->end())
+        {
+            throw std::out_of_range("ordered_map: no such element");
+        }
+        return iter->second;
+    }
+    mapped_type const& at(const key_type& k) const
+    {
+        const auto iter = this->find(k);
+        if(iter == this->end())
+        {
+            throw std::out_of_range("ordered_map: no such element");
+        }
+        return iter->second;
+    }
+
+    iterator erase(iterator pos)
+    {
+        return container_.erase(pos);
+    }
+    
+    iterator erase(const_iterator pos)
+    {
+        return container_.erase(pos);
+    }
+    
+    iterator erase(const_iterator first, const_iterator last)
+    {
+        return container_.erase(first, last);
+    }
+    
+    size_type erase(const key_type& key)
+    {
+        auto it = this->find(key);
+        if (it != this->end())
+        {
+            container_.erase(it);
+            return 1;
+        }
+        return 0;
+    }
+
+    mapped_type& operator[](const key_type& k)
+    {
+        const auto iter = this->find(k);
+        if(iter == this->end())
+        {
+            this->container_.emplace_back(k, mapped_type{});
+            return this->container_.back().second;
+        }
+        return iter->second;
+    }
+
+    mapped_type const& operator[](const key_type& k) const
+    {
+        const auto iter = this->find(k);
+        if(iter == this->end())
+        {
+            throw std::out_of_range("ordered_map: no such element");
+        }
+        return iter->second;
+    }
+
+    key_compare key_comp() const {return this->cmp_;}
+
+    void swap(ordered_map& other)
+    {
+        container_.swap(other.container_);
+    }
+
+  private:
+
+    container_type container_;
+};
+
+template<typename K, typename V, typename C, typename A>
+bool operator==(const ordered_map<K,V,C,A>& lhs, const ordered_map<K,V,C,A>& rhs)
+{
+    return lhs.size() == rhs.size() && std::equal(lhs.begin(), lhs.end(), rhs.begin());
+}
+template<typename K, typename V, typename C, typename A>
+bool operator!=(const ordered_map<K,V,C,A>& lhs, const ordered_map<K,V,C,A>& rhs)
+{
+    return !(lhs == rhs);
+}
+template<typename K, typename V, typename C, typename A>
+bool operator<(const ordered_map<K,V,C,A>& lhs, const ordered_map<K,V,C,A>& rhs)
+{
+    return std::lexicographical_compare(lhs.begin(), lhs.end(), rhs.begin(), rhs.end());
+}
+template<typename K, typename V, typename C, typename A>
+bool operator>(const ordered_map<K,V,C,A>& lhs, const ordered_map<K,V,C,A>& rhs)
+{
+    return rhs < lhs;
+}
+template<typename K, typename V, typename C, typename A>
+bool operator<=(const ordered_map<K,V,C,A>& lhs, const ordered_map<K,V,C,A>& rhs)
+{
+    return !(lhs > rhs);
+}
+template<typename K, typename V, typename C, typename A>
+bool operator>=(const ordered_map<K,V,C,A>& lhs, const ordered_map<K,V,C,A>& rhs)
+{
+    return !(lhs < rhs);
+}
+
+template<typename K, typename V, typename C, typename A>
+void swap(ordered_map<K,V,C,A>& lhs, ordered_map<K,V,C,A>& rhs)
+{
+    lhs.swap(rhs);
+    return;
+}
+
+
+} // toml
+#endif // TOML11_ORDERED_MAP_HPP
+#ifndef TOML11_INTO_HPP
+#define TOML11_INTO_HPP
+
+namespace toml
+{
+
+template<typename T>
+struct into;
+// {
+//     static toml::value into_toml(const T& user_defined_type)
+//     {
+//         // User-defined conversions ...
+//     }
+// };
+
+} // toml
+#endif // TOML11_INTO_HPP
+#ifndef TOML11_FROM_HPP
+#define TOML11_FROM_HPP
+
+namespace toml
+{
+
+template<typename T>
+struct from;
+// {
+//     static T from_toml(const toml::value& v)
+//     {
+//         // User-defined conversions ...
+//     }
+// };
+
+} // toml
+#endif // TOML11_FROM_HPP
+#ifndef TOML11_TRAITS_HPP
+#define TOML11_TRAITS_HPP
+
+
+#include <array>
+#include <chrono>
+#include <forward_list>
+#include <string>
+#include <tuple>
+#include <type_traits>
+#include <utility>
+
+#if defined(TOML11_HAS_STRING_VIEW)
+#include <string_view>
+#endif
+
+#if defined(TOML11_HAS_OPTIONAL)
+#include <optional>
+#endif
+
+namespace toml
+{
+template<typename TypeConcig>
+class basic_value;
+
+namespace detail
+{
+// ---------------------------------------------------------------------------
+// check whether type T is a kind of container/map class
+
+struct has_iterator_impl
+{
+    template<typename T> static std::true_type  check(typename T::iterator*);
+    template<typename T> static std::false_type check(...);
+};
+struct has_value_type_impl
+{
+    template<typename T> static std::true_type  check(typename T::value_type*);
+    template<typename T> static std::false_type check(...);
+};
+struct has_key_type_impl
+{
+    template<typename T> static std::true_type  check(typename T::key_type*);
+    template<typename T> static std::false_type check(...);
+};
+struct has_mapped_type_impl
+{
+    template<typename T> static std::true_type  check(typename T::mapped_type*);
+    template<typename T> static std::false_type check(...);
+};
+struct has_reserve_method_impl
+{
+    template<typename T> static std::false_type check(...);
+    template<typename T> static std::true_type  check(
+        decltype(std::declval<T>().reserve(std::declval<std::size_t>()))*);
+};
+struct has_push_back_method_impl
+{
+    template<typename T> static std::false_type check(...);
+    template<typename T> static std::true_type  check(
+        decltype(std::declval<T>().push_back(std::declval<typename T::value_type>()))*);
+};
+struct is_comparable_impl
+{
+    template<typename T> static std::false_type check(...);
+    template<typename T> static std::true_type  check(
+        decltype(std::declval<T>() < std::declval<T>())*);
+};
+
+struct has_from_toml_method_impl
+{
+    template<typename T, typename TC>
+    static std::true_type  check(
+        decltype(std::declval<T>().from_toml(std::declval<::toml::basic_value<TC>>()))*);
+
+    template<typename T, typename TC>
+    static std::false_type check(...);
+};
+struct has_into_toml_method_impl
+{
+    template<typename T>
+    static std::true_type  check(decltype(std::declval<T>().into_toml())*);
+    template<typename T>
+    static std::false_type check(...);
+};
+
+struct has_template_into_toml_method_impl
+{
+    template<typename T, typename TypeConfig>
+    static std::true_type  check(decltype(std::declval<T>().template into_toml<TypeConfig>())*);
+    template<typename T, typename TypeConfig>
+    static std::false_type check(...);
+};
+
+struct has_specialized_from_impl
+{
+    template<typename T>
+    static std::false_type check(...);
+    template<typename T, std::size_t S = sizeof(::toml::from<T>)>
+    static std::true_type check(::toml::from<T>*);
+};
+struct has_specialized_into_impl
+{
+    template<typename T>
+    static std::false_type check(...);
+    template<typename T, std::size_t S = sizeof(::toml::into<T>)>
+    static std::true_type check(::toml::into<T>*);
+};
+
+
+/// Intel C++ compiler can not use decltype in parent class declaration, here
+/// is a hack to work around it. https://stackoverflow.com/a/23953090/4692076
+#ifdef __INTEL_COMPILER
+#define decltype(...) std::enable_if<true, decltype(__VA_ARGS__)>::type
+#endif
+
+template<typename T>
+struct has_iterator: decltype(has_iterator_impl::check<T>(nullptr)){};
+template<typename T>
+struct has_value_type: decltype(has_value_type_impl::check<T>(nullptr)){};
+template<typename T>
+struct has_key_type: decltype(has_key_type_impl::check<T>(nullptr)){};
+template<typename T>
+struct has_mapped_type: decltype(has_mapped_type_impl::check<T>(nullptr)){};
+template<typename T>
+struct has_reserve_method: decltype(has_reserve_method_impl::check<T>(nullptr)){};
+template<typename T>
+struct has_push_back_method: decltype(has_push_back_method_impl::check<T>(nullptr)){};
+template<typename T>
+struct is_comparable: decltype(is_comparable_impl::check<T>(nullptr)){};
+
+template<typename T, typename TC>
+struct has_from_toml_method: decltype(has_from_toml_method_impl::check<T, TC>(nullptr)){};
+
+template<typename T>
+struct has_into_toml_method: decltype(has_into_toml_method_impl::check<T>(nullptr)){};
+
+template<typename T, typename TypeConfig>
+struct has_template_into_toml_method: decltype(has_template_into_toml_method_impl::check<T, TypeConfig>(nullptr)){};
+
+template<typename T>
+struct has_specialized_from: decltype(has_specialized_from_impl::check<T>(nullptr)){};
+template<typename T>
+struct has_specialized_into: decltype(has_specialized_into_impl::check<T>(nullptr)){};
+
+#ifdef __INTEL_COMPILER
+#undef decltype
+#endif
+
+// ---------------------------------------------------------------------------
+// type checkers
+
+template<typename T> struct is_std_pair_impl : std::false_type{};
+template<typename T1, typename T2>
+struct is_std_pair_impl<std::pair<T1, T2>> : std::true_type{};
+template<typename T>
+using is_std_pair = is_std_pair_impl<cxx::remove_cvref_t<T>>;
+
+template<typename T> struct is_std_tuple_impl : std::false_type{};
+template<typename ... Ts>
+struct is_std_tuple_impl<std::tuple<Ts...>> : std::true_type{};
+template<typename T>
+using is_std_tuple = is_std_tuple_impl<cxx::remove_cvref_t<T>>;
+
+#if TOML11_CPLUSPLUS_STANDARD_VERSION >= TOML11_CXX17_VALUE
+#  if __has_include(<optional>)
+template<typename T> struct is_std_optional_impl : std::false_type{};
+template<typename T>
+struct is_std_optional_impl<std::optional<T>> : std::true_type{};
+template<typename T>
+using is_std_optional = is_std_optional_impl<cxx::remove_cvref_t<T>>;
+#  endif // <optional>
+#endif // > C++17
+
+template<typename T> struct is_std_array_impl : std::false_type{};
+template<typename T, std::size_t N>
+struct is_std_array_impl<std::array<T, N>> : std::true_type{};
+template<typename T>
+using is_std_array = is_std_array_impl<cxx::remove_cvref_t<T>>;
+
+template<typename T> struct is_std_forward_list_impl : std::false_type{};
+template<typename T>
+struct is_std_forward_list_impl<std::forward_list<T>> : std::true_type{};
+template<typename T>
+using is_std_forward_list = is_std_forward_list_impl<cxx::remove_cvref_t<T>>;
+
+template<typename T> struct is_std_basic_string_impl : std::false_type{};
+template<typename C, typename T, typename A>
+struct is_std_basic_string_impl<std::basic_string<C, T, A>> : std::true_type{};
+template<typename T>
+using is_std_basic_string = is_std_basic_string_impl<cxx::remove_cvref_t<T>>;
+
+template<typename T> struct is_1byte_std_basic_string_impl : std::false_type{};
+template<typename C, typename T, typename A>
+struct is_1byte_std_basic_string_impl<std::basic_string<C, T, A>>
+    : std::integral_constant<bool, sizeof(C) == sizeof(char)> {};
+template<typename T>
+using is_1byte_std_basic_string = is_std_basic_string_impl<cxx::remove_cvref_t<T>>;
+
+#if defined(TOML11_HAS_STRING_VIEW)
+template<typename T> struct is_std_basic_string_view_impl : std::false_type{};
+template<typename C, typename T>
+struct is_std_basic_string_view_impl<std::basic_string_view<C, T>> : std::true_type{};
+template<typename T>
+using is_std_basic_string_view = is_std_basic_string_view_impl<cxx::remove_cvref_t<T>>;
+
+template<typename V, typename S>
+struct is_string_view_of : std::false_type {};
+template<typename C, typename T>
+struct is_string_view_of<std::basic_string_view<C, T>, std::basic_string<C, T>> : std::true_type {};
+#endif
+
+template<typename T> struct is_chrono_duration_impl: std::false_type{};
+template<typename Rep, typename Period>
+struct is_chrono_duration_impl<std::chrono::duration<Rep, Period>>: std::true_type{};
+template<typename T>
+using is_chrono_duration = is_chrono_duration_impl<cxx::remove_cvref_t<T>>;
+
+template<typename T>
+struct is_map_impl : cxx::conjunction< // map satisfies all the following conditions
+    has_iterator<T>,         // has T::iterator
+    has_value_type<T>,       // has T::value_type
+    has_key_type<T>,         // has T::key_type
+    has_mapped_type<T>       // has T::mapped_type
+    >{};
+template<typename T>
+using is_map = is_map_impl<cxx::remove_cvref_t<T>>;
+
+template<typename T>
+struct is_container_impl : cxx::conjunction<
+    cxx::negation<is_map<T>>,                         // not a map
+    cxx::negation<std::is_same<T, std::string>>,      // not a std::string
+#ifdef TOML11_HAS_STRING_VIEW
+    cxx::negation<std::is_same<T, std::string_view>>, // not a std::string_view
+#endif
+    has_iterator<T>,                             // has T::iterator
+    has_value_type<T>                            // has T::value_type
+    >{};
+template<typename T>
+using is_container = is_container_impl<cxx::remove_cvref_t<T>>;
+
+template<typename T>
+struct is_basic_value_impl: std::false_type{};
+template<typename TC>
+struct is_basic_value_impl<::toml::basic_value<TC>>: std::true_type{};
+template<typename T>
+using is_basic_value = is_basic_value_impl<cxx::remove_cvref_t<T>>;
+
+}// detail
+}//toml
+#endif // TOML11_TRAITS_HPP
+#ifndef TOML11_EXCEPTION_HPP
+#define TOML11_EXCEPTION_HPP
+
+#include <exception>
+
+namespace toml
+{
+
+struct exception : public std::exception
+{
+  public:
+    virtual ~exception() noexcept override = default;
+    virtual const char* what() const noexcept override {return "";}
+};
+
+} // toml
+#endif // TOMl11_EXCEPTION_HPP
+#ifndef TOML11_RESULT_HPP
+#define TOML11_RESULT_HPP
+
+
+#include <ostream>
+#include <string>
+#include <type_traits>
+#include <utility>
+
+#include <cassert>
+
+namespace toml
+{
+
+struct bad_result_access final : public ::toml::exception
+{
+  public:
+    explicit bad_result_access(std::string what_arg)
+        : what_(std::move(what_arg))
+    {}
+    ~bad_result_access() noexcept override = default;
+    const char* what() const noexcept override {return what_.c_str();}
+
+  private:
+    std::string what_;
+};
+
+// -----------------------------------------------------------------------------
+
+template<typename T>
+struct success
+{
+    static_assert( ! std::is_void<T>::value, "");
+
+    using value_type = T;
+
+    explicit success(value_type v)
+        noexcept(std::is_nothrow_move_constructible<value_type>::value)
+        : value(std::move(v))
+    {}
+
+    template<typename U, cxx::enable_if_t<
+        std::is_convertible<cxx::remove_cvref_t<U>, T>::value,
+        std::nullptr_t> = nullptr>
+    explicit success(U&& v): value(std::forward<U>(v)) {}
+
+    template<typename U>
+    explicit success(success<U> v): value(std::move(v.value)) {}
+
+    ~success() = default;
+    success(const success&) = default;
+    success(success&&)      = default;
+    success& operator=(const success&) = default;
+    success& operator=(success&&)      = default;
+
+    value_type&       get()       noexcept {return value;}
+    value_type const& get() const noexcept {return value;}
+
+  private:
+
+    value_type value;
+};
+
+template<typename T>
+struct success<std::reference_wrapper<T>>
+{
+    static_assert( ! std::is_void<T>::value, "");
+
+    using value_type = T;
+
+    explicit success(std::reference_wrapper<value_type> v) noexcept
+        : value(std::move(v))
+    {}
+
+    ~success() = default;
+    success(const success&) = default;
+    success(success&&)      = default;
+    success& operator=(const success&) = default;
+    success& operator=(success&&)      = default;
+
+    value_type&       get()       noexcept {return value.get();}
+    value_type const& get() const noexcept {return value.get();}
+
+  private:
+
+    std::reference_wrapper<value_type> value;
+};
+
+template<typename T>
+success<typename std::decay<T>::type> ok(T&& v)
+{
+    return success<typename std::decay<T>::type>(std::forward<T>(v));
+}
+template<std::size_t N>
+success<std::string> ok(const char (&literal)[N])
+{
+    return success<std::string>(std::string(literal));
+}
+
+// -----------------------------------------------------------------------------
+
+template<typename T>
+struct failure
+{
+    using value_type = T;
+
+    explicit failure(value_type v)
+        noexcept(std::is_nothrow_move_constructible<value_type>::value)
+        : value(std::move(v))
+    {}
+
+    template<typename U, cxx::enable_if_t<
+        std::is_convertible<cxx::remove_cvref_t<U>, T>::value,
+        std::nullptr_t> = nullptr>
+    explicit failure(U&& v): value(std::forward<U>(v)) {}
+
+    template<typename U>
+    explicit failure(failure<U> v): value(std::move(v.value)) {}
+
+    ~failure() = default;
+    failure(const failure&) = default;
+    failure(failure&&)      = default;
+    failure& operator=(const failure&) = default;
+    failure& operator=(failure&&)      = default;
+
+    value_type&       get()       noexcept {return value;}
+    value_type const& get() const noexcept {return value;}
+
+  private:
+
+    value_type value;
+};
+
+template<typename T>
+struct failure<std::reference_wrapper<T>>
+{
+    using value_type = T;
+
+    explicit failure(std::reference_wrapper<value_type> v) noexcept
+        : value(std::move(v))
+    {}
+
+    ~failure() = default;
+    failure(const failure&) = default;
+    failure(failure&&)      = default;
+    failure& operator=(const failure&) = default;
+    failure& operator=(failure&&)      = default;
+
+    value_type&       get()       noexcept {return value.get();}
+    value_type const& get() const noexcept {return value.get();}
+
+  private:
+
+    std::reference_wrapper<value_type> value;
+};
+
+template<typename T>
+failure<typename std::decay<T>::type> err(T&& v)
+{
+    return failure<typename std::decay<T>::type>(std::forward<T>(v));
+}
+
+template<std::size_t N>
+failure<std::string> err(const char (&literal)[N])
+{
+    return failure<std::string>(std::string(literal));
+}
+
+/* ============================================================================
+ *                  _ _
+ *  _ _ ___ ____  _| | |_
+ * | '_/ -_|_-< || | |  _|
+ * |_| \___/__/\_,_|_|\__|
+ */
+
+template<typename T, typename E>
+struct result
+{
+    using success_type = success<T>;
+    using failure_type = failure<E>;
+    using value_type = typename success_type::value_type;
+    using error_type = typename failure_type::value_type;
+
+    result(success_type s): is_ok_(true),  succ_(std::move(s)) {}
+    result(failure_type f): is_ok_(false), fail_(std::move(f)) {}
+
+    template<typename U, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<U>, value_type>>,
+            std::is_convertible<cxx::remove_cvref_t<U>, value_type>
+        >::value, std::nullptr_t> = nullptr>
+    result(success<U> s): is_ok_(true),  succ_(std::move(s.value)) {}
+
+    template<typename U, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<U>, error_type>>,
+            std::is_convertible<cxx::remove_cvref_t<U>, error_type>
+        >::value, std::nullptr_t> = nullptr>
+    result(failure<U> f): is_ok_(false), fail_(std::move(f.value)) {}
+
+    result& operator=(success_type s)
+    {
+        this->cleanup();
+        this->is_ok_ = true;
+        auto tmp = ::new(std::addressof(this->succ_)) success_type(std::move(s));
+        assert(tmp == std::addressof(this->succ_));
+        (void)tmp;
+        return *this;
+    }
+    result& operator=(failure_type f)
+    {
+        this->cleanup();
+        this->is_ok_ = false;
+        auto tmp = ::new(std::addressof(this->fail_)) failure_type(std::move(f));
+        assert(tmp == std::addressof(this->fail_));
+        (void)tmp;
+        return *this;
+    }
+
+    template<typename U>
+    result& operator=(success<U> s)
+    {
+        this->cleanup();
+        this->is_ok_ = true;
+        auto tmp = ::new(std::addressof(this->succ_)) success_type(std::move(s.value));
+        assert(tmp == std::addressof(this->succ_));
+        (void)tmp;
+        return *this;
+    }
+    template<typename U>
+    result& operator=(failure<U> f)
+    {
+        this->cleanup();
+        this->is_ok_ = false;
+        auto tmp = ::new(std::addressof(this->fail_)) failure_type(std::move(f.value));
+        assert(tmp == std::addressof(this->fail_));
+        (void)tmp;
+        return *this;
+    }
+
+    ~result() noexcept {this->cleanup();}
+
+    result(const result& other): is_ok_(other.is_ok())
+    {
+        if(other.is_ok())
+        {
+            auto tmp = ::new(std::addressof(this->succ_)) success_type(other.succ_);
+            assert(tmp == std::addressof(this->succ_));
+            (void)tmp;
+        }
+        else
+        {
+            auto tmp = ::new(std::addressof(this->fail_)) failure_type(other.fail_);
+            assert(tmp == std::addressof(this->fail_));
+            (void)tmp;
+        }
+    }
+    result(result&& other): is_ok_(other.is_ok())
+    {
+        if(other.is_ok())
+        {
+            auto tmp = ::new(std::addressof(this->succ_)) success_type(std::move(other.succ_));
+            assert(tmp == std::addressof(this->succ_));
+            (void)tmp;
+        }
+        else
+        {
+            auto tmp = ::new(std::addressof(this->fail_)) failure_type(std::move(other.fail_));
+            assert(tmp == std::addressof(this->fail_));
+            (void)tmp;
+        }
+    }
+
+    result& operator=(const result& other)
+    {
+        this->cleanup();
+        if(other.is_ok())
+        {
+            auto tmp = ::new(std::addressof(this->succ_)) success_type(other.succ_);
+            assert(tmp == std::addressof(this->succ_));
+            (void)tmp;
+        }
+        else
+        {
+            auto tmp = ::new(std::addressof(this->fail_)) failure_type(other.fail_);
+            assert(tmp == std::addressof(this->fail_));
+            (void)tmp;
+        }
+        is_ok_ = other.is_ok();
+        return *this;
+    }
+    result& operator=(result&& other)
+    {
+        this->cleanup();
+        if(other.is_ok())
+        {
+            auto tmp = ::new(std::addressof(this->succ_)) success_type(std::move(other.succ_));
+            assert(tmp == std::addressof(this->succ_));
+            (void)tmp;
+        }
+        else
+        {
+            auto tmp = ::new(std::addressof(this->fail_)) failure_type(std::move(other.fail_));
+            assert(tmp == std::addressof(this->fail_));
+            (void)tmp;
+        }
+        is_ok_ = other.is_ok();
+        return *this;
+    }
+
+    template<typename U, typename F, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<U>, value_type>>,
+            cxx::negation<std::is_same<cxx::remove_cvref_t<F>, error_type>>,
+            std::is_convertible<cxx::remove_cvref_t<U>, value_type>,
+            std::is_convertible<cxx::remove_cvref_t<F>, error_type>
+        >::value, std::nullptr_t> = nullptr>
+    result(result<U, F> other): is_ok_(other.is_ok())
+    {
+        if(other.is_ok())
+        {
+            auto tmp = ::new(std::addressof(this->succ_)) success_type(std::move(other.as_ok()));
+            assert(tmp == std::addressof(this->succ_));
+            (void)tmp;
+        }
+        else
+        {
+            auto tmp = ::new(std::addressof(this->fail_)) failure_type(std::move(other.as_err()));
+            assert(tmp == std::addressof(this->fail_));
+            (void)tmp;
+        }
+    }
+
+    template<typename U, typename F, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<U>, value_type>>,
+            cxx::negation<std::is_same<cxx::remove_cvref_t<F>, error_type>>,
+            std::is_convertible<cxx::remove_cvref_t<U>, value_type>,
+            std::is_convertible<cxx::remove_cvref_t<F>, error_type>
+        >::value, std::nullptr_t> = nullptr>
+    result& operator=(result<U, F> other)
+    {
+        this->cleanup();
+        if(other.is_ok())
+        {
+            auto tmp = ::new(std::addressof(this->succ_)) success_type(std::move(other.as_ok()));
+            assert(tmp == std::addressof(this->succ_));
+            (void)tmp;
+        }
+        else
+        {
+            auto tmp = ::new(std::addressof(this->fail_)) failure_type(std::move(other.as_err()));
+            assert(tmp == std::addressof(this->fail_));
+            (void)tmp;
+        }
+        is_ok_ = other.is_ok();
+        return *this;
+    }
+
+    bool is_ok()  const noexcept {return is_ok_;}
+    bool is_err() const noexcept {return !is_ok_;}
+
+    explicit operator bool() const noexcept {return is_ok_;}
+
+    value_type& unwrap(cxx::source_location loc = cxx::source_location::current())
+    {
+        if(this->is_err())
+        {
+            throw bad_result_access("toml::result: bad unwrap" + cxx::to_string(loc));
+        }
+        return this->succ_.get();
+    }
+    value_type const& unwrap(cxx::source_location loc = cxx::source_location::current()) const
+    {
+        if(this->is_err())
+        {
+            throw bad_result_access("toml::result: bad unwrap" + cxx::to_string(loc));
+        }
+        return this->succ_.get();
+    }
+
+    value_type& unwrap_or(value_type& opt) noexcept
+    {
+        if(this->is_err()) {return opt;}
+        return this->succ_.get();
+    }
+    value_type const& unwrap_or(value_type const& opt) const noexcept
+    {
+        if(this->is_err()) {return opt;}
+        return this->succ_.get();
+    }
+
+    error_type& unwrap_err(cxx::source_location loc = cxx::source_location::current())
+    {
+        if(this->is_ok())
+        {
+            throw bad_result_access("toml::result: bad unwrap_err" + cxx::to_string(loc));
+        }
+        return this->fail_.get();
+    }
+    error_type const& unwrap_err(cxx::source_location loc = cxx::source_location::current()) const
+    {
+        if(this->is_ok())
+        {
+            throw bad_result_access("toml::result: bad unwrap_err" + cxx::to_string(loc));
+        }
+        return this->fail_.get();
+    }
+
+    value_type& as_ok() noexcept
+    {
+        assert(this->is_ok());
+        return this->succ_.get();
+    }
+    value_type const& as_ok() const noexcept
+    {
+        assert(this->is_ok());
+        return this->succ_.get();
+    }
+
+    error_type& as_err() noexcept
+    {
+        assert(this->is_err());
+        return this->fail_.get();
+    }
+    error_type const& as_err() const noexcept
+    {
+        assert(this->is_err());
+        return this->fail_.get();
+    }
+
+  private:
+
+    void cleanup() noexcept
+    {
+#if defined(__GNUC__) && ! defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wduplicated-branches"
+#endif
+
+        if(this->is_ok_) {this->succ_.~success_type();}
+        else             {this->fail_.~failure_type();}
+
+#if defined(__GNUC__) && ! defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+        return;
+    }
+
+  private:
+
+    bool      is_ok_;
+    union
+    {
+        success_type succ_;
+        failure_type fail_;
+    };
+};
+
+// ----------------------------------------------------------------------------
+
+namespace detail
+{
+struct none_t {};
+inline bool operator==(const none_t&, const none_t&) noexcept {return true;}
+inline bool operator!=(const none_t&, const none_t&) noexcept {return false;}
+inline bool operator< (const none_t&, const none_t&) noexcept {return false;}
+inline bool operator<=(const none_t&, const none_t&) noexcept {return true;}
+inline bool operator> (const none_t&, const none_t&) noexcept {return false;}
+inline bool operator>=(const none_t&, const none_t&) noexcept {return true;}
+inline std::ostream& operator<<(std::ostream& os, const none_t&)
+{
+    os << "none";
+    return os;
+}
+} // detail
+
+inline success<detail::none_t> ok() noexcept
+{
+    return success<detail::none_t>(detail::none_t{});
+}
+inline failure<detail::none_t> err() noexcept
+{
+    return failure<detail::none_t>(detail::none_t{});
+}
+
+} // toml
+#endif // TOML11_RESULT_HPP
+#ifndef TOML11_UTILITY_HPP
+#define TOML11_UTILITY_HPP
+
+
+#include <array>
+#include <sstream>
+
+#include <cassert>
+#include <cctype>
+#include <cstring>
+
+namespace toml
+{
+namespace detail
+{
+
+// to output character in an error message.
+inline std::string show_char(const int c)
+{
+    using char_type = unsigned char;
+    if(std::isgraph(c))
+    {
+        return std::string(1, static_cast<char>(c));
+    }
+    else
+    {
+        std::array<char, 5> buf;
+        buf.fill('\0');
+        const auto r = std::snprintf(buf.data(), buf.size(), "0x%02x", c & 0xFF);
+        assert(r == static_cast<int>(buf.size()) - 1);
+        (void) r; // Unused variable warning
+        auto in_hex = std::string(buf.data());
+        switch(c)
+        {
+            case char_type('\0'):   {in_hex += "(NUL)";             break;}
+            case char_type(' ') :   {in_hex += "(SPACE)";           break;}
+            case char_type('\n'):   {in_hex += "(LINE FEED)";       break;}
+            case char_type('\r'):   {in_hex += "(CARRIAGE RETURN)"; break;}
+            case char_type('\t'):   {in_hex += "(TAB)";             break;}
+            case char_type('\v'):   {in_hex += "(VERTICAL TAB)";    break;}
+            case char_type('\f'):   {in_hex += "(FORM FEED)";       break;}
+            case char_type('\x1B'): {in_hex += "(ESCAPE)";          break;}
+            default: break;
+        }
+        return in_hex;
+    }
+}
+
+// ---------------------------------------------------------------------------
+
+template<typename Container>
+void try_reserve_impl(Container& container, std::size_t N, std::true_type)
+{
+    container.reserve(N);
+    return;
+}
+template<typename Container>
+void try_reserve_impl(Container&, std::size_t, std::false_type) noexcept
+{
+    return;
+}
+
+template<typename Container>
+void try_reserve(Container& container, std::size_t N)
+{
+    try_reserve_impl(container, N, has_reserve_method<Container>{});
+    return;
+}
+
+// ---------------------------------------------------------------------------
+
+template<typename T>
+result<T, none_t> from_string(const std::string& str)
+{
+    T v;
+    std::istringstream iss(str);
+    iss >> v;
+    if(iss.fail())
+    {
+        return err();
+    }
+    return ok(v);
+}
+
+// ---------------------------------------------------------------------------
+
+// helper function to avoid std::string(0, 'c') or std::string(iter, iter)
+template<typename Iterator>
+std::string make_string(Iterator first, Iterator last)
+{
+    if(first == last) {return "";}
+    return std::string(first, last);
+}
+inline std::string make_string(std::size_t len, char c)
+{
+    if(len == 0) {return "";}
+    return std::string(len, c);
+}
+
+// ---------------------------------------------------------------------------
+
+template<typename Char,  typename Traits, typename Alloc,
+         typename Char2, typename Traits2, typename Alloc2>
+struct string_conv_impl
+{
+    static_assert(sizeof(Char)  == sizeof(char), "");
+    static_assert(sizeof(Char2) == sizeof(char), "");
+
+    static std::basic_string<Char, Traits, Alloc> invoke(std::basic_string<Char2, Traits2, Alloc2> s)
+    {
+        std::basic_string<Char, Traits, Alloc> retval;
+        std::transform(s.begin(), s.end(), std::back_inserter(retval),
+            [](const Char2 c) {return static_cast<Char>(c);});
+        return retval;
+    }
+    template<std::size_t N>
+    static std::basic_string<Char, Traits, Alloc> invoke(const Char2 (&s)[N])
+    {
+        std::basic_string<Char, Traits, Alloc> retval;
+        // "string literal" has null-char at the end. to skip it, we use prev.
+        std::transform(std::begin(s), std::prev(std::end(s)), std::back_inserter(retval),
+            [](const Char2 c) {return static_cast<Char>(c);});
+        return retval;
+    }
+};
+
+template<typename Char,  typename Traits, typename Alloc>
+struct string_conv_impl<Char, Traits, Alloc, Char, Traits, Alloc>
+{
+    static_assert(sizeof(Char) == sizeof(char), "");
+
+    static std::basic_string<Char, Traits, Alloc> invoke(std::basic_string<Char, Traits, Alloc> s)
+    {
+        return s;
+    }
+    template<std::size_t N>
+    static std::basic_string<Char, Traits, Alloc> invoke(const Char (&s)[N])
+    {
+        return std::basic_string<Char, Traits, Alloc>(s);
+    }
+};
+
+template<typename S, typename Char2, typename Traits2, typename Alloc2>
+cxx::enable_if_t<is_std_basic_string<S>::value, S>
+string_conv(std::basic_string<Char2, Traits2, Alloc2> s)
+{
+    using C = typename S::value_type;
+    using T = typename S::traits_type;
+    using A = typename S::allocator_type;
+    return string_conv_impl<C, T, A, Char2, Traits2, Alloc2>::invoke(std::move(s));
+}
+template<typename S, std::size_t N>
+cxx::enable_if_t<is_std_basic_string<S>::value, S>
+string_conv(const char (&s)[N])
+{
+    using C = typename S::value_type;
+    using T = typename S::traits_type;
+    using A = typename S::allocator_type;
+    using C2 = char;
+    using T2 = std::char_traits<C2>;
+    using A2 = std::allocator<C2>;
+
+    return string_conv_impl<C, T, A, C2, T2, A2>::template invoke<N>(s);
+}
+
+} // namespace detail
+} // namespace toml
+#endif // TOML11_UTILITY_HPP
+#ifndef TOML11_LOCATION_HPP
+#define TOML11_LOCATION_HPP
+
+#ifndef TOML11_LOCATION_FWD_HPP
+#define TOML11_LOCATION_FWD_HPP
+
+
+#include <memory>
+#include <string>
+#include <vector>
+
+namespace toml
+{
+namespace detail
+{
+
+class region; // fwd decl
+
+//
+// To represent where we are reading in the parse functions.
+// Since it "points" somewhere in the input stream, the length is always 1.
+//
+class location
+{
+  public:
+
+    using char_type       = unsigned char; // must be unsigned
+    using container_type  = std::vector<char_type>;
+    using difference_type = typename container_type::difference_type; // to suppress sign-conversion warning
+    using source_ptr      = std::shared_ptr<const container_type>;
+
+  public:
+
+    location(source_ptr src, std::string src_name)
+        : source_(std::move(src)), source_name_(std::move(src_name)),
+          location_(0), line_number_(1), column_number_(1)
+    {}
+
+    location(const location&) = default;
+    location(location&&)      = default;
+    location& operator=(const location&) = default;
+    location& operator=(location&&)      = default;
+    ~location() = default;
+
+    void advance(std::size_t n = 1) noexcept;
+    void retrace() noexcept;
+
+    bool is_ok() const noexcept { return static_cast<bool>(this->source_); }
+
+    bool eof() const noexcept;
+    char_type current() const;
+
+    char_type peek();
+
+    std::size_t get_location() const noexcept
+    {
+        return this->location_;
+    }
+
+    std::size_t line_number() const noexcept
+    {
+        return this->line_number_;
+    }
+    std::size_t column_number() const noexcept
+    {
+        return this->column_number_;
+    }
+    std::string get_line() const;
+
+    source_ptr const&  source()      const noexcept {return this->source_;}
+    std::string const& source_name() const noexcept {return this->source_name_;}
+
+  private:
+
+    void advance_impl(const std::size_t n);
+    void retrace_impl();
+    std::size_t calc_column_number() const noexcept;
+
+  private:
+
+    friend region;
+
+  private:
+
+    source_ptr  source_;
+    std::string source_name_;
+    std::size_t location_; // std::vector<>::difference_type is signed
+    std::size_t line_number_;
+    std::size_t column_number_;
+};
+
+bool operator==(const location& lhs, const location& rhs) noexcept;
+bool operator!=(const location& lhs, const location& rhs);
+
+location prev(const location& loc);
+location next(const location& loc);
+location make_temporary_location(const std::string& str) noexcept;
+
+template<typename F>
+result<location, none_t>
+find_if(const location& first, const location& last, const F& func) noexcept
+{
+    if(first.source() != last.source())             { return err(); }
+    if(first.get_location() >= last.get_location()) { return err(); }
+
+    auto loc = first;
+    while(loc.get_location() != last.get_location())
+    {
+        if(func(loc.current()))
+        {
+            return ok(loc);
+        }
+        loc.advance();
+    }
+    return err();
+}
+
+template<typename F>
+result<location, none_t>
+rfind_if(location first, const location& last, const F& func)
+{
+    if(first.source() != last.source())             { return err(); }
+    if(first.get_location() >= last.get_location()) { return err(); }
+
+    auto loc = last;
+    while(loc.get_location() != first.get_location())
+    {
+        if(func(loc.current()))
+        {
+            return ok(loc);
+        }
+        loc.retrace();
+    }
+    if(func(first.current()))
+    {
+        return ok(first);
+    }
+    return err();
+}
+
+result<location, none_t> find(const location& first, const location& last,
+                              const location::char_type val);
+result<location, none_t> rfind(const location& first, const location& last,
+                               const location::char_type val);
+
+std::size_t count(const location& first, const location& last,
+                  const location::char_type& c);
+
+} // detail
+} // toml
+#endif // TOML11_LOCATION_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_LOCATION_IMPL_HPP
+#define TOML11_LOCATION_IMPL_HPP
+
+
+namespace toml
+{
+namespace detail
+{
+
+TOML11_INLINE void location::advance(std::size_t n) noexcept
+{
+    assert(this->is_ok());
+    if(this->location_ + n < this->source_->size())
+    {
+        this->advance_impl(n);
+    }
+    else
+    {
+        this->advance_impl(this->source_->size() - this->location_);
+
+        assert(this->location_ == this->source_->size());
+    }
+}
+TOML11_INLINE void location::retrace(/*restricted to n=1*/) noexcept
+{
+    assert(this->is_ok());
+    if(this->location_ == 0)
+    {
+        this->location_ = 0;
+        this->line_number_ = 1;
+        this->column_number_ = 1;
+    }
+    else
+    {
+        this->retrace_impl();
+    }
+}
+
+TOML11_INLINE bool location::eof() const noexcept
+{
+    assert(this->is_ok());
+    return this->location_ >= this->source_->size();
+}
+TOML11_INLINE location::char_type location::current() const
+{
+    assert(this->is_ok());
+    if(this->eof()) {return '\0';}
+
+    assert(this->location_ < this->source_->size());
+    return this->source_->at(this->location_);
+}
+
+TOML11_INLINE location::char_type location::peek()
+{
+    assert(this->is_ok());
+    if(this->location_ >= this->source_->size())
+    {
+        return '\0';
+    }
+    else
+    {
+        return this->source_->at(this->location_ + 1);
+    }
+}
+
+TOML11_INLINE std::string location::get_line() const
+{
+    assert(this->is_ok());
+    const auto iter = std::next(this->source_->cbegin(), static_cast<difference_type>(this->location_));
+    const auto riter = cxx::make_reverse_iterator(iter);
+
+    const auto prev = std::find(riter, this->source_->crend(), char_type('\n'));
+    const auto next = std::find(iter,  this->source_->cend(),  char_type('\n'));
+
+    return make_string(std::next(prev.base()), next);
+}
+
+TOML11_INLINE std::size_t location::calc_column_number() const noexcept
+{
+    assert(this->is_ok());
+    const auto iter  = std::next(this->source_->cbegin(), static_cast<difference_type>(this->location_));
+    const auto riter = cxx::make_reverse_iterator(iter);
+    const auto prev  = std::find(riter, this->source_->crend(), char_type('\n'));
+
+    assert(prev.base() <= iter);
+    return static_cast<std::size_t>(std::distance(prev.base(), iter) + 1); // 1-origin
+}
+
+TOML11_INLINE void location::advance_impl(const std::size_t n)
+{
+    assert(this->is_ok());
+    assert(this->location_ + n <= this->source_->size());
+
+    auto iter = this->source_->cbegin();
+    std::advance(iter, static_cast<difference_type>(this->location_));
+
+    for(std::size_t i=0; i<n; ++i)
+    {
+        const auto c = *iter;
+        if(c == char_type('\n'))
+        {
+            this->line_number_  += 1;
+            this->column_number_ = 1;
+        }
+        else
+        {
+            this->column_number_ += 1;
+        }
+        iter++;
+    }
+    this->location_ += n;
+    return;
+}
+TOML11_INLINE void location::retrace_impl(/*n == 1*/)
+{
+    assert(this->is_ok());
+    assert(this->location_ != 0);
+
+    this->location_ -= 1;
+
+    auto iter = this->source_->cbegin();
+    std::advance(iter, static_cast<difference_type>(this->location_));
+    if(*iter == '\n')
+    {
+        this->line_number_ -= 1;
+        this->column_number_ = this->calc_column_number();
+    }
+    return;
+}
+
+TOML11_INLINE bool operator==(const location& lhs, const location& rhs) noexcept
+{
+    if( ! lhs.is_ok() || ! rhs.is_ok())
+    {
+        return (!lhs.is_ok()) && (!rhs.is_ok());
+    }
+    return lhs.source()       == rhs.source()      &&
+           lhs.source_name()  == rhs.source_name() &&
+           lhs.get_location() == rhs.get_location();
+}
+TOML11_INLINE bool operator!=(const location& lhs, const location& rhs)
+{
+    return !(lhs == rhs);
+}
+
+TOML11_INLINE location prev(const location& loc)
+{
+    location p(loc);
+    p.retrace();
+    return p;
+}
+TOML11_INLINE location next(const location& loc)
+{
+    location p(loc);
+    p.advance(1);
+    return p;
+}
+
+TOML11_INLINE location make_temporary_location(const std::string& str) noexcept
+{
+    location::container_type cont(str.size());
+    std::transform(str.begin(), str.end(), cont.begin(),
+        [](const std::string::value_type& c) {
+            return cxx::bit_cast<location::char_type>(c);
+        });
+    return location(std::make_shared<const location::container_type>(
+            std::move(cont)), "internal temporary");
+}
+
+TOML11_INLINE result<location, none_t>
+find(const location& first, const location& last, const location::char_type val)
+{
+    return find_if(first, last, [val](const location::char_type c) {
+            return c == val;
+        });
+}
+TOML11_INLINE result<location, none_t>
+rfind(const location& first, const location& last, const location::char_type val)
+{
+    return rfind_if(first, last, [val](const location::char_type c) {
+            return c == val;
+        });
+}
+
+TOML11_INLINE std::size_t
+count(const location& first, const location& last, const location::char_type& c)
+{
+    if(first.source() != last.source())             { return 0; }
+    if(first.get_location() >= last.get_location()) { return 0; }
+
+    auto loc = first;
+    std::size_t num = 0;
+    while(loc.get_location() != last.get_location())
+    {
+        if(loc.current() == c)
+        {
+            num += 1;
+        }
+        loc.advance();
+    }
+    return num;
+}
+
+} // detail
+} // toml
+#endif // TOML11_LOCATION_HPP
+#endif
+
+#endif // TOML11_LOCATION_HPP
+#ifndef TOML11_REGION_HPP
+#define TOML11_REGION_HPP
+
+#ifndef TOML11_REGION_FWD_HPP
+#define TOML11_REGION_FWD_HPP
+
+
+#include <string>
+#include <vector>
+
+#include <cassert>
+
+namespace toml
+{
+namespace detail
+{
+
+//
+// To represent where is a toml::value defined, or where does an error occur.
+// Stored in toml::value. source_location will be constructed based on this.
+//
+class region
+{
+  public:
+
+    using char_type       = location::char_type;
+    using container_type  = location::container_type;
+    using difference_type = location::difference_type;
+    using source_ptr      = location::source_ptr;
+
+    using iterator       = typename container_type::iterator;
+    using const_iterator = typename container_type::const_iterator;
+
+  public:
+
+    // a value that is constructed manually does not have input stream info
+    region()
+        : source_(nullptr), source_name_(""), length_(0),
+          first_(0), first_line_(0), first_column_(0), last_(0), last_line_(0),
+          last_column_(0)
+    {}
+
+    // a value defined in [first, last).
+    // Those source must be the same. Instread, `region` does not make sense.
+    region(const location& first, const location& last);
+
+    // shorthand of [loc, loc+1)
+    explicit region(const location& loc);
+
+    ~region() = default;
+    region(const region&) = default;
+    region(region&&)      = default;
+    region& operator=(const region&) = default;
+    region& operator=(region&&)      = default;
+
+    bool is_ok() const noexcept { return static_cast<bool>(this->source_); }
+
+    operator bool() const noexcept { return this->is_ok(); }
+
+    std::size_t length() const noexcept {return this->length_;}
+
+    std::size_t first_line_number() const noexcept
+    {
+        return this->first_line_;
+    }
+    std::size_t first_column_number() const noexcept
+    {
+        return this->first_column_;
+    }
+    std::size_t last_line_number() const noexcept
+    {
+        return this->last_line_;
+    }
+    std::size_t last_column_number() const noexcept
+    {
+        return this->last_column_;
+    }
+
+    char_type at(std::size_t i) const;
+
+    const_iterator begin() const noexcept;
+    const_iterator end() const noexcept;
+    const_iterator cbegin() const noexcept;
+    const_iterator cend() const noexcept;
+
+    std::string as_string() const;
+    std::vector<std::pair<std::string, std::size_t>> as_lines() const;
+
+    source_ptr const&  source()      const noexcept {return this->source_;}
+    std::string const& source_name() const noexcept {return this->source_name_;}
+
+  private:
+
+    std::pair<std::string, std::size_t>
+    take_line(const_iterator begin, const_iterator end) const;
+
+  private:
+
+    source_ptr  source_;
+    std::string source_name_;
+    std::size_t length_;
+    std::size_t first_;
+    std::size_t first_line_;
+    std::size_t first_column_;
+    std::size_t last_;
+    std::size_t last_line_;
+    std::size_t last_column_;
+};
+
+} // namespace detail
+} // namespace toml
+#endif // TOML11_REGION_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_REGION_IMPL_HPP
+#define TOML11_REGION_IMPL_HPP
+
+
+#include <algorithm>
+#include <iterator>
+#include <string>
+#include <sstream>
+#include <vector>
+#include <cassert>
+
+namespace toml
+{
+namespace detail
+{
+
+// a value defined in [first, last).
+// Those source must be the same. Instread, `region` does not make sense.
+TOML11_INLINE region::region(const location& first, const location& last)
+    : source_(first.source()), source_name_(first.source_name()),
+      length_(last.get_location() - first.get_location()),
+      first_(first.get_location()),
+      first_line_(first.line_number()),
+      first_column_(first.column_number()),
+      last_(last.get_location()),
+      last_line_(last.line_number()),
+      last_column_(last.column_number())
+{
+    assert(first.source()      == last.source());
+    assert(first.source_name() == last.source_name());
+}
+
+    // shorthand of [loc, loc+1)
+TOML11_INLINE region::region(const location& loc)
+    : source_(loc.source()), source_name_(loc.source_name()), length_(0),
+      first_line_(0), first_column_(0), last_line_(0), last_column_(0)
+{
+    // if the file ends with LF, the resulting region points no char.
+    if(loc.eof())
+    {
+        if(loc.get_location() == 0)
+        {
+            this->length_       = 0;
+            this->first_        = 0;
+            this->first_line_   = 0;
+            this->first_column_ = 0;
+            this->last_         = 0;
+            this->last_line_    = 0;
+            this->last_column_  = 0;
+        }
+        else
+        {
+            const auto first = prev(loc);
+            this->first_        = first.get_location();
+            this->first_line_   = first.line_number();
+            this->first_column_ = first.column_number();
+            this->last_         = loc.get_location();
+            this->last_line_    = loc.line_number();
+            this->last_column_  = loc.column_number();
+            this->length_       = 1;
+        }
+    }
+    else
+    {
+        this->first_        = loc.get_location();
+        this->first_line_   = loc.line_number();
+        this->first_column_ = loc.column_number();
+        this->last_         = loc.get_location() + 1;
+        this->last_line_    = loc.line_number();
+        this->last_column_  = loc.column_number() + 1;
+        this->length_       = 1;
+    }
+}
+
+TOML11_INLINE region::char_type region::at(std::size_t i) const
+{
+    if(this->last_ <= this->first_ + i)
+    {
+        throw std::out_of_range("range::at: index " + std::to_string(i) +
+                " exceeds length " + std::to_string(this->length_));
+    }
+    const auto iter = std::next(this->source_->cbegin(),
+            static_cast<difference_type>(this->first_ + i));
+    return *iter;
+}
+
+TOML11_INLINE region::const_iterator region::begin() const noexcept
+{
+    return std::next(this->source_->cbegin(),
+            static_cast<difference_type>(this->first_));
+}
+TOML11_INLINE region::const_iterator region::end() const noexcept
+{
+    return std::next(this->source_->cbegin(),
+            static_cast<difference_type>(this->last_));
+}
+TOML11_INLINE region::const_iterator region::cbegin() const noexcept
+{
+    return std::next(this->source_->cbegin(),
+            static_cast<difference_type>(this->first_));
+}
+TOML11_INLINE region::const_iterator region::cend() const noexcept
+{
+    return std::next(this->source_->cbegin(),
+            static_cast<difference_type>(this->last_));
+}
+
+TOML11_INLINE std::string region::as_string() const
+{
+    if(this->is_ok())
+    {
+        const auto begin = std::next(this->source_->cbegin(), static_cast<difference_type>(this->first_));
+        const auto end   = std::next(this->source_->cbegin(), static_cast<difference_type>(this->last_ ));
+        return ::toml::detail::make_string(begin, end);
+    }
+    else
+    {
+        return std::string("");
+    }
+}
+
+TOML11_INLINE std::pair<std::string, std::size_t>
+region::take_line(const_iterator begin, const_iterator end) const
+{
+    // To omit long line, we cap region by before/after 30 chars
+    const auto dist_before = std::distance(source_->cbegin(), begin);
+    const auto dist_after  = std::distance(end, source_->cend());
+
+    const const_iterator capped_begin = (dist_before <= 30) ? source_->cbegin() : std::prev(begin, 30);
+    const const_iterator capped_end   = (dist_after  <= 30) ? source_->cend()   : std::next(end,   30);
+
+    const auto lf = char_type('\n');
+    const auto lf_before = std::find(cxx::make_reverse_iterator(begin),
+                                     cxx::make_reverse_iterator(capped_begin), lf);
+    const auto lf_after  = std::find(end, capped_end, lf);
+
+    auto offset = static_cast<std::size_t>(std::distance(lf_before.base(), begin));
+
+    std::string retval = make_string(lf_before.base(), lf_after);
+
+    if(lf_before.base() != source_->cbegin() && *lf_before != lf)
+    {
+        retval = "... " + retval;
+        offset += 4;
+    }
+
+    if(lf_after != source_->cend() && *lf_after != lf)
+    {
+        retval = retval + " ...";
+    }
+
+    return std::make_pair(retval, offset);
+}
+
+TOML11_INLINE std::vector<std::pair<std::string, std::size_t>> region::as_lines() const
+{
+    assert(this->is_ok());
+    if(this->length_ == 0)
+    {
+        return std::vector<std::pair<std::string, std::size_t>>{
+            std::make_pair("", std::size_t(0))
+        };
+    }
+
+    // Consider the following toml file
+    // ```
+    // array = [
+    //   1, 2, 3,
+    // ] # comment
+    // ```
+    // and the region represnets
+    // ```
+    //         [
+    //   1, 2, 3,
+    // ]
+    // ```
+    // but we want to show the following.
+    // ```
+    // array = [
+    //   1, 2, 3,
+    // ] # comment
+    // ```
+    // So we need to find LFs before `begin` and after `end`.
+    //
+    // But, if region ends with LF, it should not include the next line.
+    // ```
+    // a = 42
+    //     ^^^- with the last LF
+    // ```
+    // So we start from `end-1` when looking for LF.
+
+    const auto begin_idx = static_cast<difference_type>(this->first_);
+    const auto end_idx   = static_cast<difference_type>(this->last_) - 1;
+
+    // length_ != 0, so begin < end. then begin <= end-1
+    assert(begin_idx <= end_idx);
+
+    const auto begin = std::next(this->source_->cbegin(), begin_idx);
+    const auto end   = std::next(this->source_->cbegin(), end_idx);
+
+    assert(this->first_line_number() <= this->last_line_number());
+
+    if(this->first_line_number() == this->last_line_number())
+    {
+        return std::vector<std::pair<std::string, std::size_t>>{
+            this->take_line(begin, end)
+        };
+    }
+
+    // we have multiple lines. `begin` and `end` points different lines.
+    // that means that there is at least one `LF` between `begin` and `end`.
+
+    const auto after_begin = std::distance(begin, this->source_->cend());
+    const auto before_end  = std::distance(this->source_->cbegin(), end);
+
+    const_iterator capped_file_end   = this->source_->cend();
+    const_iterator capped_file_begin = this->source_->cbegin();
+    if(60 < after_begin) {capped_file_end   = std::next(begin, 50);}
+    if(60 < before_end)  {capped_file_begin = std::prev(end,   50);}
+
+    const auto lf = char_type('\n');
+    const auto first_line_end  = std::find(begin, capped_file_end, lf);
+    const auto last_line_begin = std::find(capped_file_begin, end, lf);
+
+    const auto first_line = this->take_line(begin, first_line_end);
+    const auto last_line  = this->take_line(last_line_begin, end);
+
+    if(this->first_line_number() + 1 == this->last_line_number())
+    {
+        return std::vector<std::pair<std::string, std::size_t>>{
+            first_line, last_line
+        };
+    }
+    else
+    {
+        return std::vector<std::pair<std::string, std::size_t>>{
+            first_line, std::make_pair("...", 0), last_line
+        };
+    }
+}
+
+} // namespace detail
+} // namespace toml
+#endif // TOML11_REGION_IMPL_HPP
+#endif
+
+#endif // TOML11_REGION_HPP
+#ifndef TOML11_SOURCE_LOCATION_HPP
+#define TOML11_SOURCE_LOCATION_HPP
+
+#ifndef TOML11_SOURCE_LOCATION_FWD_HPP
+#define TOML11_SOURCE_LOCATION_FWD_HPP
+
+
+#include <sstream>
+#include <string>
+#include <vector>
+
+namespace toml
+{
+
+//
+// A struct to contain location in a toml file.
+//
+// To reduce memory consumption, it omits unrelated parts of long lines. like:
+//
+// 1. one long line, short region
+// ```
+//    |
+//  1 | ... "foo", "bar", baz, "qux", "foobar", ...
+//    |                   ^-- unknown value
+// ```
+// 2. long region
+// ```
+//    |
+//  1 | array = [ "foo", ... "bar" ]
+//    |         ^^^^^^^^^^^^^^^^^^^^- in this array
+// ```
+// 3. many lines
+//     |
+//   1 | array = [ "foo",
+//     |         ^^^^^^^^
+//     | ...
+//     | ^^^
+//     |
+//  10 | , "bar"]
+//     | ^^^^^^^^- in this array
+// ```
+//
+struct source_location
+{
+  public:
+
+    explicit source_location(const detail::region& r);
+    ~source_location() = default;
+    source_location(source_location const&) = default;
+    source_location(source_location &&)     = default;
+    source_location& operator=(source_location const&) = default;
+    source_location& operator=(source_location &&)     = default;
+
+    bool is_ok() const noexcept {return this->is_ok_;}
+    std::size_t length() const noexcept {return this->length_;}
+
+    std::size_t first_line_number()   const noexcept {return this->first_line_;}
+    std::size_t first_column_number() const noexcept {return this->first_column_;}
+    std::size_t last_line_number()    const noexcept {return this->last_line_;}
+    std::size_t last_column_number()  const noexcept {return this->last_column_;}
+
+    std::string const& file_name()  const noexcept {return this->file_name_;}
+
+    std::size_t num_lines() const noexcept {return this->line_str_.size();}
+
+    std::string const& first_line() const;
+    std::string const& last_line() const;
+
+    std::vector<std::string> const& lines() const noexcept {return line_str_;}
+
+    // for internal use
+    std::size_t first_column_offset() const noexcept {return this->first_offset_;}
+    std::size_t last_column_offset()  const noexcept {return this->last_offset_;}
+
+  private:
+
+    bool        is_ok_;
+    std::size_t first_line_;
+    std::size_t first_column_; // column num in the actual file
+    std::size_t first_offset_; // column num in the shown line
+    std::size_t last_line_;
+    std::size_t last_column_;  // column num in the actual file
+    std::size_t last_offset_;  // column num in the shown line
+    std::size_t length_;
+    std::string file_name_;
+    std::vector<std::string> line_str_;
+};
+
+namespace detail
+{
+
+std::size_t integer_width_base10(std::size_t i) noexcept;
+
+inline std::size_t line_width() noexcept {return 0;}
+
+template<typename ... Ts>
+std::size_t line_width(const source_location& loc, const std::string& /*msg*/,
+        const Ts& ... tail) noexcept
+{
+    return (std::max)(
+            integer_width_base10(loc.last_line_number()), line_width(tail...));
+}
+
+std::ostringstream&
+format_filename(std::ostringstream& oss, const source_location& loc);
+
+std::ostringstream&
+format_empty_line(std::ostringstream& oss, const std::size_t lnw);
+
+std::ostringstream& format_line(std::ostringstream& oss,
+    const std::size_t lnw, const std::size_t linenum, const std::string& line);
+
+std::ostringstream& format_underline(std::ostringstream& oss,
+        const std::size_t lnw, const std::size_t col, const std::size_t len,
+        const std::string& msg);
+
+std::string format_location_impl(const std::size_t lnw,
+    const std::string& prev_fname,
+    const source_location& loc, const std::string& msg);
+
+inline std::string format_location_rec(const std::size_t, const std::string&)
+{
+    return "";
+}
+
+template<typename ... Ts>
+std::string format_location_rec(const std::size_t lnw,
+        const std::string& prev_fname,
+        const source_location& loc, const std::string& msg,
+        const Ts& ... tail)
+{
+    return format_location_impl(lnw, prev_fname, loc, msg) +
+           format_location_rec(lnw, loc.file_name(), tail...);
+}
+
+} // namespace detail
+
+// format a location info without title
+template<typename ... Ts>
+std::string format_location(
+        const source_location& loc, const std::string& msg, const Ts& ... tail)
+{
+    const auto lnw = detail::line_width(loc, msg, tail...);
+
+    const std::string f(""); // at the 1st iteration, no prev_filename is given
+    return detail::format_location_rec(lnw, f, loc, msg, tail...);
+}
+
+} // toml
+#endif // TOML11_SOURCE_LOCATION_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_SOURCE_LOCATION_IMPL_HPP
+#define TOML11_SOURCE_LOCATION_IMPL_HPP
+
+
+
+#include <iomanip>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#include <cctype>
+
+namespace toml
+{
+
+TOML11_INLINE source_location::source_location(const detail::region& r)
+    : is_ok_(false),
+      first_line_(1),
+      first_column_(1),
+      first_offset_(1),
+      last_line_(1),
+      last_column_(1),
+      last_offset_(1),
+      length_(0),
+      file_name_("unknown file")
+{
+    if(r.is_ok())
+    {
+        this->is_ok_        = true;
+        this->file_name_    = r.source_name();
+        this->first_line_   = r.first_line_number();
+        this->first_column_ = r.first_column_number();
+        this->last_line_    = r.last_line_number();
+        this->last_column_  = r.last_column_number();
+        this->length_       = r.length();
+
+        const auto lines = r.as_lines();
+        assert( ! lines.empty());
+
+        for(const auto& l : lines)
+        {
+            this->line_str_.push_back(l.first);
+        }
+
+        this->first_offset_ = lines.at(             0).second + 1; // to 1-origin
+        this->last_offset_  = lines.at(lines.size()-1).second + 1;
+    }
+}
+
+TOML11_INLINE std::string const& source_location::first_line() const
+{
+    if(this->line_str_.size() == 0)
+    {
+        throw std::out_of_range("toml::source_location::first_line: `lines` is empty");
+    }
+    return this->line_str_.front();
+}
+TOML11_INLINE std::string const& source_location::last_line() const
+{
+    if(this->line_str_.size() == 0)
+    {
+        throw std::out_of_range("toml::source_location::first_line: `lines` is empty");
+    }
+    return this->line_str_.back();
+}
+
+namespace detail
+{
+
+TOML11_INLINE std::size_t integer_width_base10(std::size_t i) noexcept
+{
+    std::size_t width = 0;
+    while(i != 0)
+    {
+        i /= 10;
+        width += 1;
+    }
+    return width;
+}
+
+TOML11_INLINE std::ostringstream&
+format_filename(std::ostringstream& oss, const source_location& loc)
+{
+    // --> example.toml
+    oss << color::bold << color::blue << " --> " << color::reset
+        << color::bold << loc.file_name() << '\n' << color::reset;
+    return oss;
+}
+
+TOML11_INLINE std::ostringstream& format_empty_line(std::ostringstream& oss,
+        const std::size_t lnw)
+{
+    //    |
+    oss << detail::make_string(lnw + 1, ' ')
+        << color::bold << color::blue << " |\n"  << color::reset;
+    return oss;
+}
+
+TOML11_INLINE std::ostringstream& format_line(std::ostringstream& oss,
+    const std::size_t lnw, const std::size_t linenum, const std::string& line)
+{
+    // 10 | key = "value"
+    oss << ' ' << color::bold << color::blue
+        << std::setw(static_cast<int>(lnw))
+        << std::right << linenum << " | "  << color::reset;
+    for(const char c : line)
+    {
+        if(std::isgraph(c) || c == ' ')
+        {
+            oss << c;
+        }
+        else
+        {
+            oss << show_char(c);
+        }
+    }
+    oss << '\n';
+    return oss;
+}
+TOML11_INLINE std::ostringstream& format_underline(std::ostringstream& oss,
+        const std::size_t lnw, const std::size_t col, const std::size_t len,
+        const std::string& msg)
+{
+    //    |       ^^^^^^^-- this part
+    oss << make_string(lnw + 1, ' ')
+        << color::bold << color::blue << " | " << color::reset;
+
+    // in case col is 0, so we don't create a string with size_t max length
+    const std::size_t sanitized_col = col == 0 ? 0 : col - 1 /*1-origin*/;
+    oss << make_string(sanitized_col, ' ')
+        << color::bold << color::red
+        << make_string(len, '^') << "-- "
+        << color::reset << msg << '\n';
+
+    return oss;
+}
+
+TOML11_INLINE std::string format_location_impl(const std::size_t lnw,
+    const std::string& prev_fname,
+    const source_location& loc, const std::string& msg)
+{
+    std::ostringstream oss;
+
+    if(loc.file_name() != prev_fname)
+    {
+        format_filename(oss, loc);
+        if( ! loc.lines().empty())
+        {
+            format_empty_line(oss, lnw);
+        }
+    }
+
+    if(loc.lines().size() == 1)
+    {
+        // when column points LF, it exceeds the size of the first line.
+        std::size_t underline_limit = 1;
+        if(loc.first_line().size() < loc.first_column_offset())
+        {
+            underline_limit = 1;
+        }
+        else
+        {
+            underline_limit = loc.first_line().size() - loc.first_column_offset() + 1;
+        }
+        const auto underline_len = (std::min)(underline_limit, loc.length());
+
+        format_line(oss, lnw, loc.first_line_number(), loc.first_line());
+        format_underline(oss, lnw, loc.first_column_offset(), underline_len, msg);
+    }
+    else if(loc.lines().size() == 2)
+    {
+        const auto first_underline_len =
+            loc.first_line().size() - loc.first_column_offset() + 1;
+        format_line(oss, lnw, loc.first_line_number(), loc.first_line());
+        format_underline(oss, lnw, loc.first_column_offset(),
+                first_underline_len, "");
+
+        format_line(oss, lnw, loc.last_line_number(), loc.last_line());
+        format_underline(oss, lnw, 1, loc.last_column_offset(), msg);
+    }
+    else if(loc.lines().size() > 2)
+    {
+        const auto first_underline_len =
+            loc.first_line().size() - loc.first_column_offset() + 1;
+        format_line(oss, lnw, loc.first_line_number(), loc.first_line());
+        format_underline(oss, lnw, loc.first_column_offset(),
+                first_underline_len, "and");
+
+        if(loc.lines().size() == 3)
+        {
+            format_line(oss, lnw, loc.first_line_number()+1, loc.lines().at(1));
+            format_underline(oss, lnw, 1, loc.lines().at(1).size(), "and");
+        }
+        else
+        {
+            format_line(oss, lnw, loc.first_line_number()+1, " ...");
+            format_empty_line(oss, lnw);
+        }
+        format_line(oss, lnw, loc.last_line_number(), loc.last_line());
+        format_underline(oss, lnw, 1, loc.last_column_offset(), msg);
+    }
+    // if loc is empty, do nothing.
+    return oss.str();
+}
+
+} // namespace detail
+} // toml
+#endif // TOML11_SOURCE_LOCATION_IMPL_HPP
+#endif
+
+#endif // TOML11_SOURCE_LOCATION_HPP
+#ifndef TOML11_ERROR_INFO_HPP
+#define TOML11_ERROR_INFO_HPP
+
+#ifndef TOML11_ERROR_INFO_FWD_HPP
+#define TOML11_ERROR_INFO_FWD_HPP
+
+
+namespace toml
+{
+
+// error info returned from parser.
+struct error_info
+{
+    error_info(std::string t, source_location l, std::string m, std::string s = "")
+        : title_(std::move(t)), locations_{std::make_pair(std::move(l), std::move(m))},
+          suffix_(std::move(s))
+    {}
+
+    error_info(std::string t, std::vector<std::pair<source_location, std::string>> l,
+               std::string s = "")
+        : title_(std::move(t)), locations_(std::move(l)), suffix_(std::move(s))
+    {}
+
+    std::string const& title() const noexcept {return title_;}
+    std::string &      title()       noexcept {return title_;}
+
+    std::vector<std::pair<source_location, std::string>> const&
+    locations() const noexcept {return locations_;}
+
+    void add_locations(source_location loc, std::string msg) noexcept
+    {
+        locations_.emplace_back(std::move(loc), std::move(msg));
+    }
+
+    std::string const& suffix() const noexcept {return suffix_;}
+    std::string &      suffix()       noexcept {return suffix_;}
+
+  private:
+
+    std::string title_;
+    std::vector<std::pair<source_location, std::string>> locations_;
+    std::string suffix_; // hint or something like that
+};
+
+// forward decl
+template<typename TypeConfig>
+class basic_value;
+
+namespace detail
+{
+inline error_info make_error_info_rec(error_info e)
+{
+    return e;
+}
+inline error_info make_error_info_rec(error_info e, std::string s)
+{
+    e.suffix() = s;
+    return e;
+}
+
+template<typename TC, typename ... Ts>
+error_info make_error_info_rec(error_info e,
+        const basic_value<TC>& v, std::string msg, Ts&& ... tail);
+
+template<typename ... Ts>
+error_info make_error_info_rec(error_info e,
+        source_location loc, std::string msg, Ts&& ... tail)
+{
+    e.add_locations(std::move(loc), std::move(msg));
+    return make_error_info_rec(std::move(e), std::forward<Ts>(tail)...);
+}
+
+} // detail
+
+template<typename ... Ts>
+error_info make_error_info(
+    std::string title, source_location loc, std::string msg, Ts&& ... tail)
+{
+    error_info ei(std::move(title), std::move(loc), std::move(msg));
+    return detail::make_error_info_rec(ei, std::forward<Ts>(tail) ... );
+}
+
+std::string format_error(const std::string& errkind, const error_info& err);
+std::string format_error(const error_info& err);
+
+// for custom error message
+template<typename ... Ts>
+std::string format_error(std::string title,
+        source_location loc, std::string msg, Ts&& ... tail)
+{
+    return format_error("", make_error_info(std::move(title),
+                std::move(loc), std::move(msg), std::forward<Ts>(tail)...));
+}
+
+std::ostream& operator<<(std::ostream& os, const error_info& e);
+
+} // toml
+#endif // TOML11_ERROR_INFO_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_ERROR_INFO_IMPL_HPP
+#define TOML11_ERROR_INFO_IMPL_HPP
+
+
+#include <sstream>
+
+namespace toml
+{
+
+TOML11_INLINE std::string format_error(const std::string& errkind, const error_info& err)
+{
+    std::string errmsg;
+    if( ! errkind.empty())
+    {
+        errmsg = errkind;
+        errmsg += ' ';
+    }
+    errmsg += err.title();
+    errmsg += '\n';
+
+    const auto lnw = [&err]() {
+        std::size_t width = 0;
+        for(const auto& l : err.locations())
+        {
+            width = (std::max)(detail::integer_width_base10(l.first.last_line_number()), width);
+        }
+        return width;
+    }();
+
+    bool first = true;
+    std::string prev_fname;
+    for(const auto& lm : err.locations())
+    {
+        if( ! first)
+        {
+            std::ostringstream oss;
+            oss << detail::make_string(lnw + 1, ' ')
+                << color::bold << color::blue << " |" << color::reset
+                << color::bold << " ...\n" << color::reset;
+            oss << detail::make_string(lnw + 1, ' ')
+                << color::bold << color::blue << " |\n" << color::reset;
+            errmsg += oss.str();
+        }
+
+        const auto& l = lm.first;
+        const auto& m = lm.second;
+
+        errmsg += detail::format_location_impl(lnw, prev_fname, l, m);
+
+        prev_fname = l.file_name();
+        first = false;
+    }
+
+    errmsg += err.suffix();
+
+    return errmsg;
+}
+
+TOML11_INLINE std::string format_error(const error_info& err)
+{
+    std::ostringstream oss;
+    oss << color::red << color::bold << "[error]" << color::reset;
+    return format_error(oss.str(), err);
+}
+
+TOML11_INLINE std::ostream& operator<<(std::ostream& os, const error_info& e)
+{
+    os << format_error(e);
+    return os;
+}
+
+} // toml
+#endif // TOML11_ERROR_INFO_IMPL_HPP
+#endif
+
+#endif // TOML11_ERROR_INFO_HPP
+#ifndef TOML11_VALUE_HPP
+#define TOML11_VALUE_HPP
+
+
+#ifdef TOML11_HAS_STRING_VIEW
+#include <string_view>
+#endif
+
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+#include <atomic>
+#endif
+
+#include <cassert>
+
+namespace toml
+{
+template<typename TypeConfig>
+class basic_value;
+
+struct type_error final : public ::toml::exception
+{
+  public:
+    type_error(std::string what_arg, source_location loc)
+        : what_(std::move(what_arg)), loc_(std::move(loc))
+    {}
+    ~type_error() noexcept override = default;
+
+    const char* what() const noexcept override {return what_.c_str();}
+
+    source_location const& location() const noexcept {return loc_;}
+
+  private:
+    std::string what_;
+    source_location loc_;
+};
+
+// only for internal use
+namespace detail
+{
+template<typename TC>
+error_info make_type_error(const basic_value<TC>&, const std::string&, const value_t);
+
+template<typename TC>
+error_info make_not_found_error(const basic_value<TC>&, const std::string&, const typename basic_value<TC>::key_type&);
+
+template<typename TC>
+void change_region_of_value(basic_value<TC>&, const basic_value<TC>&);
+
+template<typename TC, value_t V>
+struct getter;
+
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+template<typename TC>
+void unset_access_flag(basic_value<TC>&);
+#endif
+} // detail
+
+template<typename TypeConfig>
+class basic_value
+{
+  public:
+
+    using config_type          = TypeConfig;
+    using key_type             = typename config_type::string_type;
+    using value_type           = basic_value<config_type>;
+    using boolean_type         = typename config_type::boolean_type;
+    using integer_type         = typename config_type::integer_type;
+    using floating_type        = typename config_type::floating_type;
+    using string_type          = typename config_type::string_type;
+    using local_time_type      = ::toml::local_time;
+    using local_date_type      = ::toml::local_date;
+    using local_datetime_type  = ::toml::local_datetime;
+    using offset_datetime_type = ::toml::offset_datetime;
+    using array_type           = typename config_type::template array_type<value_type>;
+    using table_type           = typename config_type::template table_type<key_type, value_type>;
+    using comment_type         = typename config_type::comment_type;
+    using char_type            = typename string_type::value_type;
+
+  private:
+
+    using region_type = detail::region;
+
+  public:
+
+    basic_value() noexcept
+        : type_(value_t::empty), empty_('\0'), region_{}, comments_{}
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    ~basic_value() noexcept {this->cleanup();}
+
+    // copy/move constructor/assigner ===================================== {{{
+
+    basic_value(const basic_value& v)
+        : type_(v.type_), region_(v.region_), comments_(v.comments_)
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{v.accessed()}
+#endif
+    {
+        switch(this->type_)
+        {
+            case value_t::boolean        : assigner(boolean_        , v.boolean_        ); break;
+            case value_t::integer        : assigner(integer_        , v.integer_        ); break;
+            case value_t::floating       : assigner(floating_       , v.floating_       ); break;
+            case value_t::string         : assigner(string_         , v.string_         ); break;
+            case value_t::offset_datetime: assigner(offset_datetime_, v.offset_datetime_); break;
+            case value_t::local_datetime : assigner(local_datetime_ , v.local_datetime_ ); break;
+            case value_t::local_date     : assigner(local_date_     , v.local_date_     ); break;
+            case value_t::local_time     : assigner(local_time_     , v.local_time_     ); break;
+            case value_t::array          : assigner(array_          , v.array_          ); break;
+            case value_t::table          : assigner(table_          , v.table_          ); break;
+            default                      : assigner(empty_          , '\0'              ); break;
+        }
+    }
+    basic_value(basic_value&& v)
+        : type_(v.type()), region_(std::move(v.region_)),
+          comments_(std::move(v.comments_))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{v.accessed()}
+#endif
+    {
+        switch(this->type_)
+        {
+            case value_t::boolean        : assigner(boolean_        , std::move(v.boolean_        )); break;
+            case value_t::integer        : assigner(integer_        , std::move(v.integer_        )); break;
+            case value_t::floating       : assigner(floating_       , std::move(v.floating_       )); break;
+            case value_t::string         : assigner(string_         , std::move(v.string_         )); break;
+            case value_t::offset_datetime: assigner(offset_datetime_, std::move(v.offset_datetime_)); break;
+            case value_t::local_datetime : assigner(local_datetime_ , std::move(v.local_datetime_ )); break;
+            case value_t::local_date     : assigner(local_date_     , std::move(v.local_date_     )); break;
+            case value_t::local_time     : assigner(local_time_     , std::move(v.local_time_     )); break;
+            case value_t::array          : assigner(array_          , std::move(v.array_          )); break;
+            case value_t::table          : assigner(table_          , std::move(v.table_          )); break;
+            default                      : assigner(empty_          , '\0'                         ); break;
+        }
+    }
+
+    basic_value& operator=(const basic_value& v)
+    {
+        if(this == std::addressof(v)) {return *this;}
+
+        this->cleanup();
+        this->type_     = v.type_;
+        this->region_   = v.region_;
+        this->comments_ = v.comments_;
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = v.accessed();
+#endif
+        switch(this->type_)
+        {
+            case value_t::boolean        : assigner(boolean_        , v.boolean_        ); break;
+            case value_t::integer        : assigner(integer_        , v.integer_        ); break;
+            case value_t::floating       : assigner(floating_       , v.floating_       ); break;
+            case value_t::string         : assigner(string_         , v.string_         ); break;
+            case value_t::offset_datetime: assigner(offset_datetime_, v.offset_datetime_); break;
+            case value_t::local_datetime : assigner(local_datetime_ , v.local_datetime_ ); break;
+            case value_t::local_date     : assigner(local_date_     , v.local_date_     ); break;
+            case value_t::local_time     : assigner(local_time_     , v.local_time_     ); break;
+            case value_t::array          : assigner(array_          , v.array_          ); break;
+            case value_t::table          : assigner(table_          , v.table_          ); break;
+            default                      : assigner(empty_          , '\0'              ); break;
+        }
+        return *this;
+    }
+    basic_value& operator=(basic_value&& v)
+    {
+        if(this == std::addressof(v)) {return *this;}
+
+        this->cleanup();
+        this->type_     = v.type_;
+        this->region_   = std::move(v.region_);
+        this->comments_ = std::move(v.comments_);
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = v.accessed();
+#endif
+        switch(this->type_)
+        {
+            case value_t::boolean        : assigner(boolean_        , std::move(v.boolean_        )); break;
+            case value_t::integer        : assigner(integer_        , std::move(v.integer_        )); break;
+            case value_t::floating       : assigner(floating_       , std::move(v.floating_       )); break;
+            case value_t::string         : assigner(string_         , std::move(v.string_         )); break;
+            case value_t::offset_datetime: assigner(offset_datetime_, std::move(v.offset_datetime_)); break;
+            case value_t::local_datetime : assigner(local_datetime_ , std::move(v.local_datetime_ )); break;
+            case value_t::local_date     : assigner(local_date_     , std::move(v.local_date_     )); break;
+            case value_t::local_time     : assigner(local_time_     , std::move(v.local_time_     )); break;
+            case value_t::array          : assigner(array_          , std::move(v.array_          )); break;
+            case value_t::table          : assigner(table_          , std::move(v.table_          )); break;
+            default                      : assigner(empty_          , '\0'                         ); break;
+        }
+        return *this;
+    }
+    // }}}
+
+    // constructor to overwrite commnets ================================== {{{
+
+    basic_value(basic_value v, std::vector<std::string> com)
+        : type_(v.type()), region_(std::move(v.region_)),
+          comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{v.accessed()}
+#endif
+    {
+        switch(this->type_)
+        {
+            case value_t::boolean        : assigner(boolean_        , std::move(v.boolean_        )); break;
+            case value_t::integer        : assigner(integer_        , std::move(v.integer_        )); break;
+            case value_t::floating       : assigner(floating_       , std::move(v.floating_       )); break;
+            case value_t::string         : assigner(string_         , std::move(v.string_         )); break;
+            case value_t::offset_datetime: assigner(offset_datetime_, std::move(v.offset_datetime_)); break;
+            case value_t::local_datetime : assigner(local_datetime_ , std::move(v.local_datetime_ )); break;
+            case value_t::local_date     : assigner(local_date_     , std::move(v.local_date_     )); break;
+            case value_t::local_time     : assigner(local_time_     , std::move(v.local_time_     )); break;
+            case value_t::array          : assigner(array_          , std::move(v.array_          )); break;
+            case value_t::table          : assigner(table_          , std::move(v.table_          )); break;
+            default                      : assigner(empty_          , '\0'                         ); break;
+        }
+    }
+    // }}}
+
+    // conversion between different basic_values ========================== {{{
+
+    template<typename TI>
+    basic_value(basic_value<TI> other)
+        : type_(other.type_),
+          region_(std::move(other.region_)),
+          comments_(std::move(other.comments_))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{other.accessed()}
+#endif
+    {
+        switch(other.type_)
+        {
+            // use auto-convert in constructor
+            case value_t::boolean        : assigner(boolean_        , std::move(other.boolean_        )); break;
+            case value_t::integer        : assigner(integer_        , std::move(other.integer_        )); break;
+            case value_t::floating       : assigner(floating_       , std::move(other.floating_       )); break;
+            case value_t::string         : assigner(string_         , std::move(other.string_         )); break;
+            case value_t::offset_datetime: assigner(offset_datetime_, std::move(other.offset_datetime_)); break;
+            case value_t::local_datetime : assigner(local_datetime_ , std::move(other.local_datetime_ )); break;
+            case value_t::local_date     : assigner(local_date_     , std::move(other.local_date_     )); break;
+            case value_t::local_time     : assigner(local_time_     , std::move(other.local_time_     )); break;
+
+            // may have different container type
+            case value_t::array          :
+            {
+                array_type tmp(
+                    std::make_move_iterator(other.array_.value.get().begin()),
+                    std::make_move_iterator(other.array_.value.get().end()));
+                assigner(array_, array_storage(
+                        detail::storage<array_type>(std::move(tmp)),
+                        other.array_.format
+                    ));
+                break;
+            }
+            case value_t::table          :
+            {
+                table_type tmp(
+                    std::make_move_iterator(other.table_.value.get().begin()),
+                    std::make_move_iterator(other.table_.value.get().end()));
+                assigner(table_, table_storage(
+                        detail::storage<table_type>(std::move(tmp)),
+                        other.table_.format
+                    ));
+                break;
+            }
+            default: break;
+        }
+    }
+
+    template<typename TI>
+    basic_value(basic_value<TI> other, std::vector<std::string> com)
+        : type_(other.type_),
+          region_(std::move(other.region_)),
+          comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{other.accessed()}
+#endif
+    {
+        switch(other.type_)
+        {
+            // use auto-convert in constructor
+            case value_t::boolean        : assigner(boolean_        , std::move(other.boolean_        )); break;
+            case value_t::integer        : assigner(integer_        , std::move(other.integer_        )); break;
+            case value_t::floating       : assigner(floating_       , std::move(other.floating_       )); break;
+            case value_t::string         : assigner(string_         , std::move(other.string_         )); break;
+            case value_t::offset_datetime: assigner(offset_datetime_, std::move(other.offset_datetime_)); break;
+            case value_t::local_datetime : assigner(local_datetime_ , std::move(other.local_datetime_ )); break;
+            case value_t::local_date     : assigner(local_date_     , std::move(other.local_date_     )); break;
+            case value_t::local_time     : assigner(local_time_     , std::move(other.local_time_     )); break;
+
+            // may have different container type
+            case value_t::array          :
+            {
+                array_type tmp(
+                    std::make_move_iterator(other.array_.value.get().begin()),
+                    std::make_move_iterator(other.array_.value.get().end()));
+                assigner(array_, array_storage(
+                        detail::storage<array_type>(std::move(tmp)),
+                        other.array_.format
+                    ));
+                break;
+            }
+            case value_t::table          :
+            {
+                table_type tmp(
+                    std::make_move_iterator(other.table_.value.get().begin()),
+                    std::make_move_iterator(other.table_.value.get().end()));
+                assigner(table_, table_storage(
+                        detail::storage<table_type>(std::move(tmp)),
+                        other.table_.format
+                    ));
+                break;
+            }
+            default: break;
+        }
+    }
+    template<typename TI>
+    basic_value& operator=(basic_value<TI> other)
+    {
+        this->cleanup();
+        this->region_ = other.region_;
+        this->comments_    = comment_type(other.comments_);
+        this->type_        = other.type_;
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = other.accessed();
+#endif
+
+        switch(other.type_)
+        {
+            // use auto-convert in constructor
+            case value_t::boolean        : assigner(boolean_        , std::move(other.boolean_        )); break;
+            case value_t::integer        : assigner(integer_        , std::move(other.integer_        )); break;
+            case value_t::floating       : assigner(floating_       , std::move(other.floating_       )); break;
+            case value_t::string         : assigner(string_         , std::move(other.string_         )); break;
+            case value_t::offset_datetime: assigner(offset_datetime_, std::move(other.offset_datetime_)); break;
+            case value_t::local_datetime : assigner(local_datetime_ , std::move(other.local_datetime_ )); break;
+            case value_t::local_date     : assigner(local_date_     , std::move(other.local_date_     )); break;
+            case value_t::local_time     : assigner(local_time_     , std::move(other.local_time_     )); break;
+
+            // may have different container type
+            case value_t::array          :
+            {
+                array_type tmp(
+                    std::make_move_iterator(other.array_.value.get().begin()),
+                    std::make_move_iterator(other.array_.value.get().end()));
+                assigner(array_, array_storage(
+                        detail::storage<array_type>(std::move(tmp)),
+                        other.array_.format
+                    ));
+                break;
+            }
+            case value_t::table          :
+            {
+                table_type tmp(
+                    std::make_move_iterator(other.table_.value.get().begin()),
+                    std::make_move_iterator(other.table_.value.get().end()));
+                assigner(table_, table_storage(
+                        detail::storage<table_type>(std::move(tmp)),
+                        other.table_.format
+                    ));
+                break;
+            }
+            default: break;
+        }
+        return *this;
+    }
+    // }}}
+
+    // constructor (boolean) ============================================== {{{
+
+    basic_value(boolean_type x)
+        : basic_value(x, boolean_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(boolean_type x, boolean_format_info fmt)
+        : basic_value(x, fmt, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(boolean_type x, std::vector<std::string> com)
+        : basic_value(x, boolean_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(boolean_type x, boolean_format_info fmt, std::vector<std::string> com)
+        : basic_value(x, fmt, std::move(com), region_type{})
+    {}
+    basic_value(boolean_type x, boolean_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::boolean), boolean_(boolean_storage(x, fmt)),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(boolean_type x)
+    {
+        boolean_format_info fmt;
+        if(this->is_boolean())
+        {
+            fmt = this->as_boolean_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::boolean;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->boolean_, boolean_storage(x, fmt));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (integer) ============================================== {{{
+
+    basic_value(integer_type x)
+        : basic_value(std::move(x), integer_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(integer_type x, integer_format_info fmt)
+        : basic_value(std::move(x), std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(integer_type x, std::vector<std::string> com)
+        : basic_value(std::move(x), integer_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(integer_type x, integer_format_info fmt, std::vector<std::string> com)
+        : basic_value(std::move(x), std::move(fmt), std::move(com), region_type{})
+    {}
+    basic_value(integer_type x, integer_format_info fmt, std::vector<std::string> com, region_type reg)
+        : type_(value_t::integer), integer_(integer_storage(std::move(x), std::move(fmt))),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(integer_type x)
+    {
+        integer_format_info fmt;
+        if(this->is_integer())
+        {
+            fmt = this->as_integer_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::integer;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->integer_, integer_storage(std::move(x), std::move(fmt)));
+        return *this;
+    }
+
+  private:
+
+    template<typename T>
+    using enable_if_integer_like_t = cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<T>, boolean_type>>,
+            cxx::negation<std::is_same<cxx::remove_cvref_t<T>, integer_type>>,
+            std::is_integral<cxx::remove_cvref_t<T>>
+        >::value, std::nullptr_t>;
+
+  public:
+
+    template<typename T, enable_if_integer_like_t<T> = nullptr>
+    basic_value(T x)
+        : basic_value(std::move(x), integer_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    template<typename T, enable_if_integer_like_t<T> = nullptr>
+    basic_value(T x, integer_format_info fmt)
+        : basic_value(std::move(x), std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    template<typename T, enable_if_integer_like_t<T> = nullptr>
+    basic_value(T x, std::vector<std::string> com)
+        : basic_value(std::move(x), integer_format_info{}, std::move(com), region_type{})
+    {}
+    template<typename T, enable_if_integer_like_t<T> = nullptr>
+    basic_value(T x, integer_format_info fmt, std::vector<std::string> com)
+        : basic_value(std::move(x), std::move(fmt), std::move(com), region_type{})
+    {}
+    template<typename T, enable_if_integer_like_t<T> = nullptr>
+    basic_value(T x, integer_format_info fmt, std::vector<std::string> com, region_type reg)
+        : type_(value_t::integer), integer_(integer_storage(std::move(x), std::move(fmt))),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    template<typename T, enable_if_integer_like_t<T> = nullptr>
+    basic_value& operator=(T x)
+    {
+        integer_format_info fmt;
+        if(this->is_integer())
+        {
+            fmt = this->as_integer_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::integer;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->integer_, integer_storage(x, std::move(fmt)));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (floating) ============================================= {{{
+
+    basic_value(floating_type x)
+        : basic_value(std::move(x), floating_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(floating_type x, floating_format_info fmt)
+        : basic_value(std::move(x), std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(floating_type x, std::vector<std::string> com)
+        : basic_value(std::move(x), floating_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(floating_type x, floating_format_info fmt, std::vector<std::string> com)
+        : basic_value(std::move(x), std::move(fmt), std::move(com), region_type{})
+    {}
+    basic_value(floating_type x, floating_format_info fmt, std::vector<std::string> com, region_type reg)
+        : type_(value_t::floating), floating_(floating_storage(std::move(x), std::move(fmt))),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(floating_type x)
+    {
+        floating_format_info fmt;
+        if(this->is_floating())
+        {
+            fmt = this->as_floating_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::floating;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->floating_, floating_storage(std::move(x), std::move(fmt)));
+        return *this;
+    }
+
+  private:
+
+    template<typename T>
+    using enable_if_floating_like_t = cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<T>, floating_type>>,
+            std::is_floating_point<cxx::remove_cvref_t<T>>
+        >::value, std::nullptr_t>;
+
+  public:
+
+    template<typename T, enable_if_floating_like_t<T> = nullptr>
+    basic_value(T x)
+        : basic_value(x, floating_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+
+    template<typename T, enable_if_floating_like_t<T> = nullptr>
+    basic_value(T x, floating_format_info fmt)
+        : basic_value(x, std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+
+    template<typename T, enable_if_floating_like_t<T> = nullptr>
+    basic_value(T x, std::vector<std::string> com)
+        : basic_value(x, floating_format_info{}, std::move(com), region_type{})
+    {}
+
+    template<typename T, enable_if_floating_like_t<T> = nullptr>
+    basic_value(T x, floating_format_info fmt, std::vector<std::string> com)
+        : basic_value(x, std::move(fmt), std::move(com), region_type{})
+    {}
+
+    template<typename T, enable_if_floating_like_t<T> = nullptr>
+    basic_value(T x, floating_format_info fmt, std::vector<std::string> com, region_type reg)
+        : type_(value_t::floating), floating_(floating_storage(x, std::move(fmt))),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+
+    template<typename T, enable_if_floating_like_t<T> = nullptr>
+    basic_value& operator=(T x)
+    {
+        floating_format_info fmt;
+        if(this->is_floating())
+        {
+            fmt = this->as_floating_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::floating;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->floating_, floating_storage(x, std::move(fmt)));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (string) =============================================== {{{
+
+    basic_value(string_type x)
+        : basic_value(std::move(x), string_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(string_type x, string_format_info fmt)
+        : basic_value(std::move(x), std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(string_type x, std::vector<std::string> com)
+        : basic_value(std::move(x), string_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(string_type x, string_format_info fmt, std::vector<std::string> com)
+        : basic_value(std::move(x), std::move(fmt), std::move(com), region_type{})
+    {}
+    basic_value(string_type x, string_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::string), string_(string_storage(std::move(x), std::move(fmt))),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(string_type x)
+    {
+        string_format_info fmt;
+        if(this->is_string())
+        {
+            fmt = this->as_string_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::string;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->string_, string_storage(x, std::move(fmt)));
+        return *this;
+    }
+
+    // "string literal"
+
+    basic_value(const typename string_type::value_type* x)
+        : basic_value(x, string_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(const typename string_type::value_type* x, string_format_info fmt)
+        : basic_value(x, std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(const typename string_type::value_type* x, std::vector<std::string> com)
+        : basic_value(x, string_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(const typename string_type::value_type* x, string_format_info fmt, std::vector<std::string> com)
+        : basic_value(x, std::move(fmt), std::move(com), region_type{})
+    {}
+    basic_value(const typename string_type::value_type* x, string_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::string), string_(string_storage(string_type(x), std::move(fmt))),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(const typename string_type::value_type* x)
+    {
+        string_format_info fmt;
+        if(this->is_string())
+        {
+            fmt = this->as_string_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::string;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->string_, string_storage(string_type(x), std::move(fmt)));
+        return *this;
+    }
+
+#if defined(TOML11_HAS_STRING_VIEW)
+    using string_view_type = std::basic_string_view<
+        typename string_type::value_type, typename string_type::traits_type>;
+
+    basic_value(string_view_type x)
+        : basic_value(x, string_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(string_view_type x, string_format_info fmt)
+        : basic_value(x, std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(string_view_type x, std::vector<std::string> com)
+        : basic_value(x, string_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(string_view_type x, string_format_info fmt, std::vector<std::string> com)
+        : basic_value(x, std::move(fmt), std::move(com), region_type{})
+    {}
+    basic_value(string_view_type x, string_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::string), string_(string_storage(string_type(x), std::move(fmt))),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(string_view_type x)
+    {
+        string_format_info fmt;
+        if(this->is_string())
+        {
+            fmt = this->as_string_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::string;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->string_, string_storage(string_type(x), std::move(fmt)));
+        return *this;
+    }
+
+#endif // TOML11_HAS_STRING_VIEW
+
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<T>, string_type>>,
+            detail::is_1byte_std_basic_string<T>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value(const T& x)
+        : basic_value(x, string_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<T>, string_type>>,
+            detail::is_1byte_std_basic_string<T>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value(const T& x, string_format_info fmt)
+        : basic_value(x, std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<T>, string_type>>,
+            detail::is_1byte_std_basic_string<T>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value(const T& x, std::vector<std::string> com)
+        : basic_value(x, string_format_info{}, std::move(com), region_type{})
+    {}
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<T>, string_type>>,
+            detail::is_1byte_std_basic_string<T>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value(const T& x, string_format_info fmt, std::vector<std::string> com)
+        : basic_value(x, std::move(fmt), std::move(com), region_type{})
+    {}
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<T>, string_type>>,
+            detail::is_1byte_std_basic_string<T>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value(const T& x, string_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::string),
+          string_(string_storage(detail::string_conv<string_type>(x), std::move(fmt))),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<cxx::remove_cvref_t<T>, string_type>>,
+            detail::is_1byte_std_basic_string<T>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value& operator=(const T& x)
+    {
+        string_format_info fmt;
+        if(this->is_string())
+        {
+            fmt = this->as_string_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::string;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->string_, string_storage(detail::string_conv<string_type>(x), std::move(fmt)));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (local_date) =========================================== {{{
+
+    basic_value(local_date_type x)
+        : basic_value(x, local_date_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(local_date_type x, local_date_format_info fmt)
+        : basic_value(x, fmt, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(local_date_type x, std::vector<std::string> com)
+        : basic_value(x, local_date_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(local_date_type x, local_date_format_info fmt, std::vector<std::string> com)
+        : basic_value(x, fmt, std::move(com), region_type{})
+    {}
+    basic_value(local_date_type x, local_date_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::local_date), local_date_(local_date_storage(x, fmt)),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(local_date_type x)
+    {
+        local_date_format_info fmt;
+        if(this->is_local_date())
+        {
+            fmt = this->as_local_date_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::local_date;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->local_date_, local_date_storage(x, fmt));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (local_time) =========================================== {{{
+
+    basic_value(local_time_type x)
+        : basic_value(x, local_time_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(local_time_type x, local_time_format_info fmt)
+        : basic_value(x, fmt, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(local_time_type x, std::vector<std::string> com)
+        : basic_value(x, local_time_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(local_time_type x, local_time_format_info fmt, std::vector<std::string> com)
+        : basic_value(x, fmt, std::move(com), region_type{})
+    {}
+    basic_value(local_time_type x, local_time_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::local_time), local_time_(local_time_storage(x, fmt)),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(local_time_type x)
+    {
+        local_time_format_info fmt;
+        if(this->is_local_time())
+        {
+            fmt = this->as_local_time_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::local_time;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->local_time_, local_time_storage(x, fmt));
+        return *this;
+    }
+
+    template<typename Rep, typename Period>
+    basic_value(const std::chrono::duration<Rep, Period>& x)
+        : basic_value(local_time_type(x), local_time_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    template<typename Rep, typename Period>
+    basic_value(const std::chrono::duration<Rep, Period>& x, local_time_format_info fmt)
+        : basic_value(local_time_type(x), std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    template<typename Rep, typename Period>
+    basic_value(const std::chrono::duration<Rep, Period>& x, std::vector<std::string> com)
+        : basic_value(local_time_type(x), local_time_format_info{}, std::move(com), region_type{})
+    {}
+    template<typename Rep, typename Period>
+    basic_value(const std::chrono::duration<Rep, Period>& x, local_time_format_info fmt, std::vector<std::string> com)
+        : basic_value(local_time_type(x), std::move(fmt), std::move(com), region_type{})
+    {}
+    template<typename Rep, typename Period>
+    basic_value(const std::chrono::duration<Rep, Period>& x,
+                local_time_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : basic_value(local_time_type(x), std::move(fmt), std::move(com), std::move(reg))
+    {}
+    template<typename Rep, typename Period>
+    basic_value& operator=(const std::chrono::duration<Rep, Period>& x)
+    {
+        local_time_format_info fmt;
+        if(this->is_local_time())
+        {
+            fmt = this->as_local_time_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::local_time;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->local_time_, local_time_storage(local_time_type(x), std::move(fmt)));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (local_datetime) =========================================== {{{
+
+    basic_value(local_datetime_type x)
+        : basic_value(x, local_datetime_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(local_datetime_type x, local_datetime_format_info fmt)
+        : basic_value(x, fmt, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(local_datetime_type x, std::vector<std::string> com)
+        : basic_value(x, local_datetime_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(local_datetime_type x, local_datetime_format_info fmt, std::vector<std::string> com)
+        : basic_value(x, fmt, std::move(com), region_type{})
+    {}
+    basic_value(local_datetime_type x, local_datetime_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::local_datetime), local_datetime_(local_datetime_storage(x, fmt)),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(local_datetime_type x)
+    {
+        local_datetime_format_info fmt;
+        if(this->is_local_datetime())
+        {
+            fmt = this->as_local_datetime_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::local_datetime;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->local_datetime_, local_datetime_storage(x, fmt));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (offset_datetime) =========================================== {{{
+
+    basic_value(offset_datetime_type x)
+        : basic_value(x, offset_datetime_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(offset_datetime_type x, offset_datetime_format_info fmt)
+        : basic_value(x, fmt, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(offset_datetime_type x, std::vector<std::string> com)
+        : basic_value(x, offset_datetime_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(offset_datetime_type x, offset_datetime_format_info fmt, std::vector<std::string> com)
+        : basic_value(x, fmt, std::move(com), region_type{})
+    {}
+    basic_value(offset_datetime_type x, offset_datetime_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::offset_datetime), offset_datetime_(offset_datetime_storage(x, fmt)),
+          region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(offset_datetime_type x)
+    {
+        offset_datetime_format_info fmt;
+        if(this->is_offset_datetime())
+        {
+            fmt = this->as_offset_datetime_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::offset_datetime;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->offset_datetime_, offset_datetime_storage(x, fmt));
+        return *this;
+    }
+
+    // system_clock::time_point
+
+    basic_value(std::chrono::system_clock::time_point x)
+        : basic_value(offset_datetime_type(x), offset_datetime_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(std::chrono::system_clock::time_point x, offset_datetime_format_info fmt)
+        : basic_value(offset_datetime_type(x), fmt, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(std::chrono::system_clock::time_point x, std::vector<std::string> com)
+        : basic_value(offset_datetime_type(x), offset_datetime_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(std::chrono::system_clock::time_point x, offset_datetime_format_info fmt, std::vector<std::string> com)
+        : basic_value(offset_datetime_type(x), fmt, std::move(com), region_type{})
+    {}
+    basic_value(std::chrono::system_clock::time_point x, offset_datetime_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : basic_value(offset_datetime_type(x), std::move(fmt), std::move(com), std::move(reg))
+    {}
+    basic_value& operator=(std::chrono::system_clock::time_point x)
+    {
+        offset_datetime_format_info fmt;
+        if(this->is_offset_datetime())
+        {
+            fmt = this->as_offset_datetime_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::offset_datetime;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->offset_datetime_, offset_datetime_storage(offset_datetime_type(x), fmt));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (array) ================================================ {{{
+
+    basic_value(array_type x)
+        : basic_value(std::move(x), array_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(array_type x, array_format_info fmt)
+        : basic_value(std::move(x), std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(array_type x, std::vector<std::string> com)
+        : basic_value(std::move(x), array_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(array_type x, array_format_info fmt, std::vector<std::string> com)
+        : basic_value(std::move(x), fmt, std::move(com), region_type{})
+    {}
+    basic_value(array_type x, array_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::array), array_(array_storage(
+              detail::storage<array_type>(std::move(x)), std::move(fmt)
+          )), region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(array_type x)
+    {
+        array_format_info fmt;
+        if(this->is_array())
+        {
+            fmt = this->as_array_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::array;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->array_, array_storage(
+                    detail::storage<array_type>(std::move(x)), std::move(fmt)));
+        return *this;
+    }
+
+  private:
+
+    template<typename T>
+    using enable_if_array_like_t = cxx::enable_if_t<cxx::conjunction<
+            detail::is_container<T>,
+            cxx::negation<std::is_same<T, array_type>>,
+            cxx::negation<detail::is_std_basic_string<T>>,
+#if defined(TOML11_HAS_STRING_VIEW)
+            cxx::negation<detail::is_std_basic_string_view<T>>,
+#endif
+            cxx::negation<detail::has_from_toml_method<T, config_type>>,
+            cxx::negation<detail::has_specialized_from<T>>
+        >::value, std::nullptr_t>;
+
+  public:
+
+    template<typename T, enable_if_array_like_t<T> = nullptr>
+    basic_value(T x)
+        : basic_value(std::move(x), array_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    template<typename T, enable_if_array_like_t<T> = nullptr>
+    basic_value(T x, array_format_info fmt)
+        : basic_value(std::move(x), std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    template<typename T, enable_if_array_like_t<T> = nullptr>
+    basic_value(T x, std::vector<std::string> com)
+        : basic_value(std::move(x), array_format_info{}, std::move(com), region_type{})
+    {}
+    template<typename T, enable_if_array_like_t<T> = nullptr>
+    basic_value(T x, array_format_info fmt, std::vector<std::string> com)
+        : basic_value(std::move(x), fmt, std::move(com), region_type{})
+    {}
+    template<typename T, enable_if_array_like_t<T> = nullptr>
+    basic_value(T x, array_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::array), array_(array_storage(
+              detail::storage<array_type>(array_type(
+                      std::make_move_iterator(x.begin()),
+                      std::make_move_iterator(x.end()))
+              ), std::move(fmt)
+          )), region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    template<typename T, enable_if_array_like_t<T> = nullptr>
+    basic_value& operator=(T x)
+    {
+        array_format_info fmt;
+        if(this->is_array())
+        {
+            fmt = this->as_array_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::array;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        array_type a(std::make_move_iterator(x.begin()),
+                     std::make_move_iterator(x.end()));
+        assigner(this->array_, array_storage(
+                    detail::storage<array_type>(std::move(a)), std::move(fmt)));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (table) ================================================ {{{
+
+    basic_value(table_type x)
+        : basic_value(std::move(x), table_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(table_type x, table_format_info fmt)
+        : basic_value(std::move(x), std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    basic_value(table_type x, std::vector<std::string> com)
+        : basic_value(std::move(x), table_format_info{}, std::move(com), region_type{})
+    {}
+    basic_value(table_type x, table_format_info fmt, std::vector<std::string> com)
+        : basic_value(std::move(x), fmt, std::move(com), region_type{})
+    {}
+    basic_value(table_type x, table_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::table), table_(table_storage(
+                detail::storage<table_type>(std::move(x)), std::move(fmt)
+          )), region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    basic_value& operator=(table_type x)
+    {
+        table_format_info fmt;
+        if(this->is_table())
+        {
+            fmt = this->as_table_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::table;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        assigner(this->table_, table_storage(
+            detail::storage<table_type>(std::move(x)), std::move(fmt)));
+        return *this;
+    }
+
+    // table-like
+
+  private:
+
+    template<typename T>
+    using enable_if_table_like_t = cxx::enable_if_t<cxx::conjunction<
+            cxx::negation<std::is_same<T, table_type>>,
+            detail::is_map<T>,
+            cxx::negation<detail::has_from_toml_method<T, config_type>>,
+            cxx::negation<detail::has_specialized_from<T>>
+        >::value, std::nullptr_t>;
+
+  public:
+
+    template<typename T, enable_if_table_like_t<T> = nullptr>
+    basic_value(T x)
+        : basic_value(std::move(x), table_format_info{}, std::vector<std::string>{}, region_type{})
+    {}
+    template<typename T, enable_if_table_like_t<T> = nullptr>
+    basic_value(T x, table_format_info fmt)
+        : basic_value(std::move(x), std::move(fmt), std::vector<std::string>{}, region_type{})
+    {}
+    template<typename T, enable_if_table_like_t<T> = nullptr>
+    basic_value(T x, std::vector<std::string> com)
+        : basic_value(std::move(x), table_format_info{}, std::move(com), region_type{})
+    {}
+    template<typename T, enable_if_table_like_t<T> = nullptr>
+    basic_value(T x, table_format_info fmt, std::vector<std::string> com)
+        : basic_value(std::move(x), fmt, std::move(com), region_type{})
+    {}
+    template<typename T, enable_if_table_like_t<T> = nullptr>
+    basic_value(T x, table_format_info fmt,
+                std::vector<std::string> com, region_type reg)
+        : type_(value_t::table), table_(table_storage(
+              detail::storage<table_type>(table_type(
+                      std::make_move_iterator(x.begin()),
+                      std::make_move_iterator(x.end())
+              )), std::move(fmt)
+          )), region_(std::move(reg)), comments_(std::move(com))
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+    template<typename T, enable_if_table_like_t<T> = nullptr>
+    basic_value& operator=(T x)
+    {
+        table_format_info fmt;
+        if(this->is_table())
+        {
+            fmt = this->as_table_fmt();
+        }
+        this->cleanup();
+        this->type_   = value_t::table;
+        this->region_ = region_type{};
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        table_type t(std::make_move_iterator(x.begin()),
+                     std::make_move_iterator(x.end()));
+        assigner(this->table_, table_storage(
+            detail::storage<table_type>(std::move(t)), std::move(fmt)));
+        return *this;
+    }
+
+    // }}}
+
+    // constructor (user_defined) ========================================= {{{
+
+    template<typename T, cxx::enable_if_t<
+        detail::has_specialized_into<T>::value, std::nullptr_t> = nullptr>
+    basic_value(const T& ud)
+        : basic_value(
+            into<cxx::remove_cvref_t<T>>::template into_toml<config_type>(ud))
+    {}
+    template<typename T, cxx::enable_if_t<
+        detail::has_specialized_into<T>::value, std::nullptr_t> = nullptr>
+    basic_value(const T& ud, std::vector<std::string> com)
+        : basic_value(
+            into<cxx::remove_cvref_t<T>>::template into_toml<config_type>(ud),
+            std::move(com))
+    {}
+    template<typename T, cxx::enable_if_t<
+        detail::has_specialized_into<T>::value, std::nullptr_t> = nullptr>
+    basic_value& operator=(const T& ud)
+    {
+        *this = into<cxx::remove_cvref_t<T>>::template into_toml<config_type>(ud);
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        return *this;
+    }
+
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            detail::has_into_toml_method<T>,
+            cxx::negation<detail::has_specialized_into<T>>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value(const T& ud): basic_value(ud.into_toml()) {}
+
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            detail::has_into_toml_method<T>,
+            cxx::negation<detail::has_specialized_into<T>>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value(const T& ud, std::vector<std::string> com)
+        : basic_value(ud.into_toml(), std::move(com))
+    {}
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            detail::has_into_toml_method<T>,
+            cxx::negation<detail::has_specialized_into<T>>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value& operator=(const T& ud)
+    {
+        *this = ud.into_toml();
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        return *this;
+    }
+
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            detail::has_template_into_toml_method<T, TypeConfig>,
+            cxx::negation<detail::has_specialized_into<T>>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value(const T& ud): basic_value(ud.template into_toml<TypeConfig>()) {}
+
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            detail::has_template_into_toml_method<T, TypeConfig>,
+            cxx::negation<detail::has_specialized_into<T>>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value(const T& ud, std::vector<std::string> com)
+        : basic_value(ud.template into_toml<TypeConfig>(), std::move(com))
+    {}
+    template<typename T, cxx::enable_if_t<cxx::conjunction<
+            detail::has_template_into_toml_method<T, TypeConfig>,
+            cxx::negation<detail::has_specialized_into<T>>
+        >::value, std::nullptr_t> = nullptr>
+    basic_value& operator=(const T& ud)
+    {
+        *this = ud.template into_toml<TypeConfig>();
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        return *this;
+    }
+    // }}}
+
+    // empty value with region info ======================================= {{{
+
+    // mainly for `null` extension
+    basic_value(detail::none_t, region_type reg) noexcept
+        : type_(value_t::empty), empty_('\0'), region_(std::move(reg)), comments_{}
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        , accessed_{false}
+#endif
+    {}
+
+    // }}}
+
+    // type checking ====================================================== {{{
+
+    template<typename T, cxx::enable_if_t<
+        detail::is_exact_toml_type<cxx::remove_cvref_t<T>, value_type>::value,
+        std::nullptr_t> = nullptr>
+    bool is() const noexcept
+    {
+        return this->is(detail::type_to_enum<T, value_type>::value);
+    }
+    bool is(value_t t) const noexcept
+    {
+        this->set_accessed();
+        return t == this->type_;
+    }
+
+    bool is_empty()           const noexcept {return this->is(value_t::empty          );}
+    bool is_boolean()         const noexcept {return this->is(value_t::boolean        );}
+    bool is_integer()         const noexcept {return this->is(value_t::integer        );}
+    bool is_floating()        const noexcept {return this->is(value_t::floating       );}
+    bool is_string()          const noexcept {return this->is(value_t::string         );}
+    bool is_offset_datetime() const noexcept {return this->is(value_t::offset_datetime);}
+    bool is_local_datetime()  const noexcept {return this->is(value_t::local_datetime );}
+    bool is_local_date()      const noexcept {return this->is(value_t::local_date     );}
+    bool is_local_time()      const noexcept {return this->is(value_t::local_time     );}
+    bool is_array()           const noexcept {return this->is(value_t::array          );}
+    bool is_table()           const noexcept {return this->is(value_t::table          );}
+
+    bool is_array_of_tables() const noexcept
+    {
+        this->set_accessed();
+        if( ! this->is_array()) {return false;}
+        const auto& a = this->as_array(std::nothrow); // already checked.
+
+        // when you define [[array.of.tables]], at least one empty table will be
+        // assigned. In case of array of inline tables, `array_of_tables = []`,
+        // there is no reason to consider this as an array of *tables*.
+        // So empty array is not an array-of-tables.
+        if(a.empty()) {return false;}
+
+        // since toml v1.0.0 allows array of heterogeneous types, we need to
+        // check all the elements. if any of the elements is not a table, it
+        // is a heterogeneous array and cannot be expressed by `[[aot]]` form.
+        for(const auto& e : a)
+        {
+            if( ! e.is_table()) {return false;}
+        }
+        return true;
+    }
+
+    value_t type() const noexcept
+    {
+        this->set_accessed();
+        return type_;
+    }
+
+    // }}}
+
+    // as_xxx (noexcept) version ========================================== {{{
+
+    template<value_t T>
+    detail::enum_to_type_t<T, basic_value<config_type>> const&
+    as(const std::nothrow_t&) const noexcept
+    {
+        this->set_accessed();
+        return detail::getter<config_type, T>::get_nothrow(*this);
+    }
+    template<value_t T>
+    detail::enum_to_type_t<T, basic_value<config_type>>&
+    as(const std::nothrow_t&) noexcept
+    {
+        this->set_accessed();
+        return detail::getter<config_type, T>::get_nothrow(*this);
+    }
+
+    boolean_type         const& as_boolean        (const std::nothrow_t&) const noexcept {this->set_accessed(); return this->boolean_.value;}
+    integer_type         const& as_integer        (const std::nothrow_t&) const noexcept {this->set_accessed(); return this->integer_.value;}
+    floating_type        const& as_floating       (const std::nothrow_t&) const noexcept {this->set_accessed(); return this->floating_.value;}
+    string_type          const& as_string         (const std::nothrow_t&) const noexcept {this->set_accessed(); return this->string_.value;}
+    offset_datetime_type const& as_offset_datetime(const std::nothrow_t&) const noexcept {this->set_accessed(); return this->offset_datetime_.value;}
+    local_datetime_type  const& as_local_datetime (const std::nothrow_t&) const noexcept {this->set_accessed(); return this->local_datetime_.value;}
+    local_date_type      const& as_local_date     (const std::nothrow_t&) const noexcept {this->set_accessed(); return this->local_date_.value;}
+    local_time_type      const& as_local_time     (const std::nothrow_t&) const noexcept {this->set_accessed(); return this->local_time_.value;}
+    array_type           const& as_array          (const std::nothrow_t&) const noexcept {this->set_accessed(); return this->array_.value.get();}
+    table_type           const& as_table          (const std::nothrow_t&) const noexcept {this->set_accessed(); return this->table_.value.get();}
+
+    boolean_type        & as_boolean        (const std::nothrow_t&) noexcept {this->set_accessed(); return this->boolean_.value;}
+    integer_type        & as_integer        (const std::nothrow_t&) noexcept {this->set_accessed(); return this->integer_.value;}
+    floating_type       & as_floating       (const std::nothrow_t&) noexcept {this->set_accessed(); return this->floating_.value;}
+    string_type         & as_string         (const std::nothrow_t&) noexcept {this->set_accessed(); return this->string_.value;}
+    offset_datetime_type& as_offset_datetime(const std::nothrow_t&) noexcept {this->set_accessed(); return this->offset_datetime_.value;}
+    local_datetime_type & as_local_datetime (const std::nothrow_t&) noexcept {this->set_accessed(); return this->local_datetime_.value;}
+    local_date_type     & as_local_date     (const std::nothrow_t&) noexcept {this->set_accessed(); return this->local_date_.value;}
+    local_time_type     & as_local_time     (const std::nothrow_t&) noexcept {this->set_accessed(); return this->local_time_.value;}
+    array_type          & as_array          (const std::nothrow_t&) noexcept {this->set_accessed(); return this->array_.value.get();}
+    table_type          & as_table          (const std::nothrow_t&) noexcept {this->set_accessed(); return this->table_.value.get();}
+
+    // }}}
+
+    // as_xxx (throw) ===================================================== {{{
+
+    template<value_t T>
+    detail::enum_to_type_t<T, basic_value<config_type>> const& as() const
+    {
+        return detail::getter<config_type, T>::get(*this);
+    }
+    template<value_t T>
+    detail::enum_to_type_t<T, basic_value<config_type>>& as()
+    {
+        return detail::getter<config_type, T>::get(*this);
+    }
+
+    boolean_type const& as_boolean() const
+    {
+        if(this->type_ != value_t::boolean)
+        {
+            this->throw_bad_cast("toml::value::as_boolean()", value_t::boolean);
+        }
+        this->set_accessed();
+        return this->boolean_.value;
+    }
+    integer_type const& as_integer() const
+    {
+        if(this->type_ != value_t::integer)
+        {
+            this->throw_bad_cast("toml::value::as_integer()", value_t::integer);
+        }
+        this->set_accessed();
+        return this->integer_.value;
+    }
+    floating_type const& as_floating() const
+    {
+        if(this->type_ != value_t::floating)
+        {
+            this->throw_bad_cast("toml::value::as_floating()", value_t::floating);
+        }
+        this->set_accessed();
+        return this->floating_.value;
+    }
+    string_type const& as_string() const
+    {
+        if(this->type_ != value_t::string)
+        {
+            this->throw_bad_cast("toml::value::as_string()", value_t::string);
+        }
+        this->set_accessed();
+        return this->string_.value;
+    }
+    offset_datetime_type const& as_offset_datetime() const
+    {
+        if(this->type_ != value_t::offset_datetime)
+        {
+            this->throw_bad_cast("toml::value::as_offset_datetime()", value_t::offset_datetime);
+        }
+        this->set_accessed();
+        return this->offset_datetime_.value;
+    }
+    local_datetime_type const& as_local_datetime() const
+    {
+        if(this->type_ != value_t::local_datetime)
+        {
+            this->throw_bad_cast("toml::value::as_local_datetime()", value_t::local_datetime);
+        }
+        this->set_accessed();
+        return this->local_datetime_.value;
+    }
+    local_date_type const& as_local_date() const
+    {
+        if(this->type_ != value_t::local_date)
+        {
+            this->throw_bad_cast("toml::value::as_local_date()", value_t::local_date);
+        }
+        this->set_accessed();
+        return this->local_date_.value;
+    }
+    local_time_type const& as_local_time() const
+    {
+        if(this->type_ != value_t::local_time)
+        {
+            this->throw_bad_cast("toml::value::as_local_time()", value_t::local_time);
+        }
+        this->set_accessed();
+        return this->local_time_.value;
+    }
+    array_type const& as_array() const
+    {
+        if(this->type_ != value_t::array)
+        {
+            this->throw_bad_cast("toml::value::as_array()", value_t::array);
+        }
+        this->set_accessed();
+        return this->array_.value.get();
+    }
+    table_type const& as_table() const
+    {
+        if(this->type_ != value_t::table)
+        {
+            this->throw_bad_cast("toml::value::as_table()", value_t::table);
+        }
+        this->set_accessed();
+        return this->table_.value.get();
+    }
+
+    // ------------------------------------------------------------------------
+    // nonconst reference
+
+    boolean_type& as_boolean()
+    {
+        if(this->type_ != value_t::boolean)
+        {
+            this->throw_bad_cast("toml::value::as_boolean()", value_t::boolean);
+        }
+        this->set_accessed();
+        return this->boolean_.value;
+    }
+    integer_type& as_integer()
+    {
+        if(this->type_ != value_t::integer)
+        {
+            this->throw_bad_cast("toml::value::as_integer()", value_t::integer);
+        }
+        this->set_accessed();
+        return this->integer_.value;
+    }
+    floating_type& as_floating()
+    {
+        if(this->type_ != value_t::floating)
+        {
+            this->throw_bad_cast("toml::value::as_floating()", value_t::floating);
+        }
+        this->set_accessed();
+        return this->floating_.value;
+    }
+    string_type& as_string()
+    {
+        if(this->type_ != value_t::string)
+        {
+            this->throw_bad_cast("toml::value::as_string()", value_t::string);
+        }
+        this->set_accessed();
+        return this->string_.value;
+    }
+    offset_datetime_type& as_offset_datetime()
+    {
+        if(this->type_ != value_t::offset_datetime)
+        {
+            this->throw_bad_cast("toml::value::as_offset_datetime()", value_t::offset_datetime);
+        }
+        this->set_accessed();
+        return this->offset_datetime_.value;
+    }
+    local_datetime_type& as_local_datetime()
+    {
+        if(this->type_ != value_t::local_datetime)
+        {
+            this->throw_bad_cast("toml::value::as_local_datetime()", value_t::local_datetime);
+        }
+        this->set_accessed();
+        return this->local_datetime_.value;
+    }
+    local_date_type& as_local_date()
+    {
+        if(this->type_ != value_t::local_date)
+        {
+            this->throw_bad_cast("toml::value::as_local_date()", value_t::local_date);
+        }
+        this->set_accessed();
+        return this->local_date_.value;
+    }
+    local_time_type& as_local_time()
+    {
+        if(this->type_ != value_t::local_time)
+        {
+            this->throw_bad_cast("toml::value::as_local_time()", value_t::local_time);
+        }
+        this->set_accessed();
+        return this->local_time_.value;
+    }
+    array_type& as_array()
+    {
+        if(this->type_ != value_t::array)
+        {
+            this->throw_bad_cast("toml::value::as_array()", value_t::array);
+        }
+        this->set_accessed();
+        return this->array_.value.get();
+    }
+    table_type& as_table()
+    {
+        if(this->type_ != value_t::table)
+        {
+            this->throw_bad_cast("toml::value::as_table()", value_t::table);
+        }
+        this->set_accessed();
+        return this->table_.value.get();
+    }
+
+    // }}}
+
+    // format accessors (noexcept) ======================================== {{{
+
+    template<value_t T>
+    detail::enum_to_fmt_type_t<T> const&
+    as_fmt(const std::nothrow_t&) const noexcept
+    {
+        return detail::getter<config_type, T>::get_fmt_nothrow(*this);
+    }
+    template<value_t T>
+    detail::enum_to_fmt_type_t<T>&
+    as_fmt(const std::nothrow_t&) noexcept
+    {
+        return detail::getter<config_type, T>::get_fmt_nothrow(*this);
+    }
+
+    boolean_format_info        & as_boolean_fmt        (const std::nothrow_t&) noexcept {return this->boolean_.format;}
+    integer_format_info        & as_integer_fmt        (const std::nothrow_t&) noexcept {return this->integer_.format;}
+    floating_format_info       & as_floating_fmt       (const std::nothrow_t&) noexcept {return this->floating_.format;}
+    string_format_info         & as_string_fmt         (const std::nothrow_t&) noexcept {return this->string_.format;}
+    offset_datetime_format_info& as_offset_datetime_fmt(const std::nothrow_t&) noexcept {return this->offset_datetime_.format;}
+    local_datetime_format_info & as_local_datetime_fmt (const std::nothrow_t&) noexcept {return this->local_datetime_.format;}
+    local_date_format_info     & as_local_date_fmt     (const std::nothrow_t&) noexcept {return this->local_date_.format;}
+    local_time_format_info     & as_local_time_fmt     (const std::nothrow_t&) noexcept {return this->local_time_.format;}
+    array_format_info          & as_array_fmt          (const std::nothrow_t&) noexcept {return this->array_.format;}
+    table_format_info          & as_table_fmt          (const std::nothrow_t&) noexcept {return this->table_.format;}
+
+    boolean_format_info         const& as_boolean_fmt        (const std::nothrow_t&) const noexcept {return this->boolean_.format;}
+    integer_format_info         const& as_integer_fmt        (const std::nothrow_t&) const noexcept {return this->integer_.format;}
+    floating_format_info        const& as_floating_fmt       (const std::nothrow_t&) const noexcept {return this->floating_.format;}
+    string_format_info          const& as_string_fmt         (const std::nothrow_t&) const noexcept {return this->string_.format;}
+    offset_datetime_format_info const& as_offset_datetime_fmt(const std::nothrow_t&) const noexcept {return this->offset_datetime_.format;}
+    local_datetime_format_info  const& as_local_datetime_fmt (const std::nothrow_t&) const noexcept {return this->local_datetime_.format;}
+    local_date_format_info      const& as_local_date_fmt     (const std::nothrow_t&) const noexcept {return this->local_date_.format;}
+    local_time_format_info      const& as_local_time_fmt     (const std::nothrow_t&) const noexcept {return this->local_time_.format;}
+    array_format_info           const& as_array_fmt          (const std::nothrow_t&) const noexcept {return this->array_.format;}
+    table_format_info           const& as_table_fmt          (const std::nothrow_t&) const noexcept {return this->table_.format;}
+
+    // }}}
+
+    // format accessors (throw) =========================================== {{{
+
+    template<value_t T>
+    detail::enum_to_fmt_type_t<T> const& as_fmt() const
+    {
+        return detail::getter<config_type, T>::get_fmt(*this);
+    }
+    template<value_t T>
+    detail::enum_to_fmt_type_t<T>& as_fmt()
+    {
+        return detail::getter<config_type, T>::get_fmt(*this);
+    }
+
+    boolean_format_info const& as_boolean_fmt() const
+    {
+        if(this->type_ != value_t::boolean)
+        {
+            this->throw_bad_cast("toml::value::as_boolean_fmt()", value_t::boolean);
+        }
+        return this->boolean_.format;
+    }
+    integer_format_info const& as_integer_fmt() const
+    {
+        if(this->type_ != value_t::integer)
+        {
+            this->throw_bad_cast("toml::value::as_integer_fmt()", value_t::integer);
+        }
+        return this->integer_.format;
+    }
+    floating_format_info const& as_floating_fmt() const
+    {
+        if(this->type_ != value_t::floating)
+        {
+            this->throw_bad_cast("toml::value::as_floating_fmt()", value_t::floating);
+        }
+        return this->floating_.format;
+    }
+    string_format_info const& as_string_fmt() const
+    {
+        if(this->type_ != value_t::string)
+        {
+            this->throw_bad_cast("toml::value::as_string_fmt()", value_t::string);
+        }
+        return this->string_.format;
+    }
+    offset_datetime_format_info const& as_offset_datetime_fmt() const
+    {
+        if(this->type_ != value_t::offset_datetime)
+        {
+            this->throw_bad_cast("toml::value::as_offset_datetime_fmt()", value_t::offset_datetime);
+        }
+        return this->offset_datetime_.format;
+    }
+    local_datetime_format_info const& as_local_datetime_fmt() const
+    {
+        if(this->type_ != value_t::local_datetime)
+        {
+            this->throw_bad_cast("toml::value::as_local_datetime_fmt()", value_t::local_datetime);
+        }
+        return this->local_datetime_.format;
+    }
+    local_date_format_info const& as_local_date_fmt() const
+    {
+        if(this->type_ != value_t::local_date)
+        {
+            this->throw_bad_cast("toml::value::as_local_date_fmt()", value_t::local_date);
+        }
+        return this->local_date_.format;
+    }
+    local_time_format_info const& as_local_time_fmt() const
+    {
+        if(this->type_ != value_t::local_time)
+        {
+            this->throw_bad_cast("toml::value::as_local_time_fmt()", value_t::local_time);
+        }
+        return this->local_time_.format;
+    }
+    array_format_info const& as_array_fmt() const
+    {
+        if(this->type_ != value_t::array)
+        {
+            this->throw_bad_cast("toml::value::as_array_fmt()", value_t::array);
+        }
+        return this->array_.format;
+    }
+    table_format_info const& as_table_fmt() const
+    {
+        if(this->type_ != value_t::table)
+        {
+            this->throw_bad_cast("toml::value::as_table_fmt()", value_t::table);
+        }
+        return this->table_.format;
+    }
+
+    // ------------------------------------------------------------------------
+    // nonconst reference
+
+    boolean_format_info& as_boolean_fmt()
+    {
+        if(this->type_ != value_t::boolean)
+        {
+            this->throw_bad_cast("toml::value::as_boolean_fmt()", value_t::boolean);
+        }
+        return this->boolean_.format;
+    }
+    integer_format_info& as_integer_fmt()
+    {
+        if(this->type_ != value_t::integer)
+        {
+            this->throw_bad_cast("toml::value::as_integer_fmt()", value_t::integer);
+        }
+        return this->integer_.format;
+    }
+    floating_format_info& as_floating_fmt()
+    {
+        if(this->type_ != value_t::floating)
+        {
+            this->throw_bad_cast("toml::value::as_floating_fmt()", value_t::floating);
+        }
+        return this->floating_.format;
+    }
+    string_format_info& as_string_fmt()
+    {
+        if(this->type_ != value_t::string)
+        {
+            this->throw_bad_cast("toml::value::as_string_fmt()", value_t::string);
+        }
+        return this->string_.format;
+    }
+    offset_datetime_format_info& as_offset_datetime_fmt()
+    {
+        if(this->type_ != value_t::offset_datetime)
+        {
+            this->throw_bad_cast("toml::value::as_offset_datetime_fmt()", value_t::offset_datetime);
+        }
+        return this->offset_datetime_.format;
+    }
+    local_datetime_format_info& as_local_datetime_fmt()
+    {
+        if(this->type_ != value_t::local_datetime)
+        {
+            this->throw_bad_cast("toml::value::as_local_datetime_fmt()", value_t::local_datetime);
+        }
+        return this->local_datetime_.format;
+    }
+    local_date_format_info& as_local_date_fmt()
+    {
+        if(this->type_ != value_t::local_date)
+        {
+            this->throw_bad_cast("toml::value::as_local_date_fmt()", value_t::local_date);
+        }
+        return this->local_date_.format;
+    }
+    local_time_format_info& as_local_time_fmt()
+    {
+        if(this->type_ != value_t::local_time)
+        {
+            this->throw_bad_cast("toml::value::as_local_time_fmt()", value_t::local_time);
+        }
+        return this->local_time_.format;
+    }
+    array_format_info& as_array_fmt()
+    {
+        if(this->type_ != value_t::array)
+        {
+            this->throw_bad_cast("toml::value::as_array_fmt()", value_t::array);
+        }
+        return this->array_.format;
+    }
+    table_format_info& as_table_fmt()
+    {
+        if(this->type_ != value_t::table)
+        {
+            this->throw_bad_cast("toml::value::as_table_fmt()", value_t::table);
+        }
+        return this->table_.format;
+    }
+    // }}}
+
+    // table accessors ==================================================== {{{
+
+    value_type& at(const key_type& k)
+    {
+        if(!this->is_table())
+        {
+            this->throw_bad_cast("toml::value::at(key_type)", value_t::table);
+        }
+        auto& table = this->as_table(std::nothrow);
+        const auto found = table.find(k);
+        if(found == table.end())
+        {
+            this->throw_key_not_found_error("toml::value::at", k);
+        }
+        assert(found->first == k);
+        return found->second;
+    }
+    value_type const& at(const key_type& k) const
+    {
+        if(!this->is_table())
+        {
+            this->throw_bad_cast("toml::value::at(key_type)", value_t::table);
+        }
+        const auto& table = this->as_table(std::nothrow);
+        const auto found = table.find(k);
+        if(found == table.end())
+        {
+            this->throw_key_not_found_error("toml::value::at", k);
+        }
+        assert(found->first == k);
+        return found->second;
+    }
+    value_type& operator[](const key_type& k)
+    {
+        if(this->is_empty())
+        {
+            (*this) = table_type{};
+        }
+        else if( ! this->is_table()) // initialized, but not a table
+        {
+            this->throw_bad_cast("toml::value::operator[](key_type)", value_t::table);
+        }
+        return (this->as_table(std::nothrow))[k];
+    }
+    std::size_t count(const key_type& k) const
+    {
+        if(!this->is_table())
+        {
+            this->throw_bad_cast("toml::value::count(key_type)", value_t::table);
+        }
+        return this->as_table(std::nothrow).count(k);
+    }
+    bool contains(const key_type& k) const
+    {
+        if(!this->is_table())
+        {
+            this->throw_bad_cast("toml::value::contains(key_type)", value_t::table);
+        }
+        const auto& table = this->as_table(std::nothrow);
+        return table.find(k) != table.end();
+    }
+    // }}}
+
+    // array accessors ==================================================== {{{
+
+    value_type& at(const std::size_t idx)
+    {
+        if(!this->is_array())
+        {
+            this->throw_bad_cast("toml::value::at(idx)", value_t::array);
+        }
+        auto& ar = this->as_array(std::nothrow);
+
+        if(ar.size() <= idx)
+        {
+            std::ostringstream oss;
+            oss << "actual length (" << ar.size()
+                << ") is shorter than the specified index (" << idx << ").";
+            throw std::out_of_range(format_error(
+                "toml::value::at(idx): no element corresponding to the index",
+                this->location(), oss.str()
+                ));
+        }
+        return ar.at(idx);
+    }
+    value_type const& at(const std::size_t idx) const
+    {
+        if(!this->is_array())
+        {
+            this->throw_bad_cast("toml::value::at(idx)", value_t::array);
+        }
+        const auto& ar = this->as_array(std::nothrow);
+
+        if(ar.size() <= idx)
+        {
+            std::ostringstream oss;
+            oss << "actual length (" << ar.size()
+                << ") is shorter than the specified index (" << idx << ").";
+
+            throw std::out_of_range(format_error(
+                "toml::value::at(idx): no element corresponding to the index",
+                this->location(), oss.str()
+                ));
+        }
+        return ar.at(idx);
+    }
+
+    value_type&       operator[](const std::size_t idx) noexcept
+    {
+        // no check...
+        return this->as_array(std::nothrow)[idx];
+    }
+    value_type const& operator[](const std::size_t idx) const noexcept
+    {
+        // no check...
+        return this->as_array(std::nothrow)[idx];
+    }
+
+    void push_back(const value_type& x)
+    {
+        if(!this->is_array())
+        {
+            this->throw_bad_cast("toml::value::push_back(idx)", value_t::array);
+        }
+        this->as_array(std::nothrow).push_back(x);
+        return;
+    }
+    void push_back(value_type&& x)
+    {
+        if(!this->is_array())
+        {
+            this->throw_bad_cast("toml::value::push_back(idx)", value_t::array);
+        }
+        this->as_array(std::nothrow).push_back(std::move(x));
+        return;
+    }
+
+    template<typename ... Ts>
+    value_type& emplace_back(Ts&& ... args)
+    {
+        if(!this->is_array())
+        {
+            this->throw_bad_cast("toml::value::emplace_back(idx)", value_t::array);
+        }
+        auto& ar = this->as_array(std::nothrow);
+        ar.emplace_back(std::forward<Ts>(args) ...);
+        return ar.back();
+    }
+
+    std::size_t size() const
+    {
+        switch(this->type_)
+        {
+            case value_t::array:
+            {
+                return this->as_array(std::nothrow).size();
+            }
+            case value_t::table:
+            {
+                return this->as_table(std::nothrow).size();
+            }
+            case value_t::string:
+            {
+                return this->as_string(std::nothrow).size();
+            }
+            default:
+            {
+                throw type_error(format_error(
+                    "toml::value::size(): bad_cast to container types",
+                    this->location(),
+                    "the actual type is " + to_string(this->type_)
+                    ), this->location());
+            }
+        }
+    }
+
+    // }}}
+
+    source_location location() const
+    {
+        return source_location(this->region_);
+    }
+
+    comment_type const& comments() const noexcept {return this->comments_;}
+    comment_type&       comments()       noexcept {return this->comments_;}
+
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+    bool accessed() const {return this->accessed_.load();}
+#endif
+
+  private:
+
+    // private helper functions =========================================== {{{
+
+    void set_accessed() const noexcept
+    {
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_.store(true);
+#endif
+        return;
+    }
+
+    void cleanup() noexcept
+    {
+        switch(this->type_)
+        {
+            case value_t::boolean         : { boolean_        .~boolean_storage         (); break; }
+            case value_t::integer         : { integer_        .~integer_storage         (); break; }
+            case value_t::floating        : { floating_       .~floating_storage        (); break; }
+            case value_t::string          : { string_         .~string_storage          (); break; }
+            case value_t::offset_datetime : { offset_datetime_.~offset_datetime_storage (); break; }
+            case value_t::local_datetime  : { local_datetime_ .~local_datetime_storage  (); break; }
+            case value_t::local_date      : { local_date_     .~local_date_storage      (); break; }
+            case value_t::local_time      : { local_time_     .~local_time_storage      (); break; }
+            case value_t::array           : { array_          .~array_storage           (); break; }
+            case value_t::table           : { table_          .~table_storage           (); break; }
+            default                       : { break; }
+        }
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+        this->accessed_ = false;
+#endif
+        this->type_ = value_t::empty;
+        return;
+    }
+
+    template<typename T, typename U>
+    static void assigner(T& dst, U&& v)
+    {
+        const auto tmp = ::new(std::addressof(dst)) T(std::forward<U>(v));
+        assert(tmp == std::addressof(dst));
+        (void)tmp;
+    }
+
+    [[noreturn]]
+    void throw_bad_cast(const std::string& funcname, const value_t ty) const
+    {
+        throw type_error(format_error(detail::make_type_error(*this, funcname, ty)),
+                         this->location());
+    }
+
+    [[noreturn]]
+    void throw_key_not_found_error(const std::string& funcname, const key_type& key) const
+    {
+        throw std::out_of_range(format_error(
+                    detail::make_not_found_error(*this, funcname, key)));
+    }
+
+    template<typename TC>
+    friend void detail::change_region_of_value(basic_value<TC>&, const basic_value<TC>&);
+
+    template<typename TC>
+    friend class basic_value;
+
+
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+    template<typename TC>
+    friend void detail::unset_access_flag(basic_value<TC>&);
+#endif
+
+    // }}}
+
+  private:
+
+    using boolean_storage         = detail::value_with_format<boolean_type,                boolean_format_info        >;
+    using integer_storage         = detail::value_with_format<integer_type,                integer_format_info        >;
+    using floating_storage        = detail::value_with_format<floating_type,               floating_format_info       >;
+    using string_storage          = detail::value_with_format<string_type,                 string_format_info         >;
+    using offset_datetime_storage = detail::value_with_format<offset_datetime_type,        offset_datetime_format_info>;
+    using local_datetime_storage  = detail::value_with_format<local_datetime_type,         local_datetime_format_info >;
+    using local_date_storage      = detail::value_with_format<local_date_type,             local_date_format_info     >;
+    using local_time_storage      = detail::value_with_format<local_time_type,             local_time_format_info     >;
+    using array_storage           = detail::value_with_format<detail::storage<array_type>, array_format_info          >;
+    using table_storage           = detail::value_with_format<detail::storage<table_type>, table_format_info          >;
+
+  private:
+
+    value_t type_;
+    union
+    {
+        char                    empty_; // the smallest type
+        boolean_storage         boolean_;
+        integer_storage         integer_;
+        floating_storage        floating_;
+        string_storage          string_;
+        offset_datetime_storage offset_datetime_;
+        local_datetime_storage  local_datetime_;
+        local_date_storage      local_date_;
+        local_time_storage      local_time_;
+        array_storage           array_;
+        table_storage           table_;
+    };
+    region_type  region_;
+    comment_type comments_;
+
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+    mutable std::atomic<bool> accessed_;
+#endif
+};
+
+template<typename TC>
+bool operator==(const basic_value<TC>& lhs, const basic_value<TC>& rhs)
+{
+    if(lhs.type()     != rhs.type())     {return false;}
+    if(lhs.comments() != rhs.comments()) {return false;}
+
+    switch(lhs.type())
+    {
+        case value_t::boolean  :
+        {
+            return lhs.as_boolean() == rhs.as_boolean();
+        }
+        case value_t::integer  :
+        {
+            return lhs.as_integer() == rhs.as_integer();
+        }
+        case value_t::floating :
+        {
+            return lhs.as_floating() == rhs.as_floating();
+        }
+        case value_t::string   :
+        {
+            return lhs.as_string() == rhs.as_string();
+        }
+        case value_t::offset_datetime:
+        {
+            return lhs.as_offset_datetime() == rhs.as_offset_datetime();
+        }
+        case value_t::local_datetime:
+        {
+            return lhs.as_local_datetime() == rhs.as_local_datetime();
+        }
+        case value_t::local_date:
+        {
+            return lhs.as_local_date() == rhs.as_local_date();
+        }
+        case value_t::local_time:
+        {
+            return lhs.as_local_time() == rhs.as_local_time();
+        }
+        case value_t::array    :
+        {
+            return lhs.as_array() == rhs.as_array();
+        }
+        case value_t::table    :
+        {
+            return lhs.as_table() == rhs.as_table();
+        }
+        case value_t::empty    : {return true; }
+        default:                 {return false;}
+    }
+}
+
+template<typename TC>
+bool operator!=(const basic_value<TC>& lhs, const basic_value<TC>& rhs)
+{
+    return !(lhs == rhs);
+}
+
+template<typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_comparable<typename basic_value<TC>::array_type>,
+    detail::is_comparable<typename basic_value<TC>::table_type>
+    >::value, bool>
+operator<(const basic_value<TC>& lhs, const basic_value<TC>& rhs)
+{
+    if(lhs.type() != rhs.type())
+    {
+        return (lhs.type() < rhs.type());
+    }
+    switch(lhs.type())
+    {
+        case value_t::boolean  :
+        {
+            return lhs.as_boolean() <  rhs.as_boolean() ||
+                  (lhs.as_boolean() == rhs.as_boolean() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::integer  :
+        {
+            return lhs.as_integer() <  rhs.as_integer() ||
+                  (lhs.as_integer() == rhs.as_integer() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::floating :
+        {
+            return lhs.as_floating() <  rhs.as_floating() ||
+                  (lhs.as_floating() == rhs.as_floating() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::string   :
+        {
+            return lhs.as_string() <  rhs.as_string() ||
+                  (lhs.as_string() == rhs.as_string() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::offset_datetime:
+        {
+            return lhs.as_offset_datetime() <  rhs.as_offset_datetime() ||
+                  (lhs.as_offset_datetime() == rhs.as_offset_datetime() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::local_datetime:
+        {
+            return lhs.as_local_datetime() <  rhs.as_local_datetime() ||
+                  (lhs.as_local_datetime() == rhs.as_local_datetime() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::local_date:
+        {
+            return lhs.as_local_date() <  rhs.as_local_date() ||
+                  (lhs.as_local_date() == rhs.as_local_date() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::local_time:
+        {
+            return lhs.as_local_time() <  rhs.as_local_time() ||
+                  (lhs.as_local_time() == rhs.as_local_time() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::array    :
+        {
+            return lhs.as_array() <  rhs.as_array() ||
+                  (lhs.as_array() == rhs.as_array() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::table    :
+        {
+            return lhs.as_table() <  rhs.as_table() ||
+                  (lhs.as_table() == rhs.as_table() &&
+                   lhs.comments() < rhs.comments());
+        }
+        case value_t::empty    :
+        {
+            return lhs.comments() < rhs.comments();
+        }
+        default:
+        {
+            return lhs.comments() < rhs.comments();
+        }
+    }
+}
+
+template<typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_comparable<typename basic_value<TC>::array_type>,
+    detail::is_comparable<typename basic_value<TC>::table_type>
+    >::value, bool>
+operator<=(const basic_value<TC>& lhs, const basic_value<TC>& rhs)
+{
+    return (lhs < rhs) || (lhs == rhs);
+}
+template<typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_comparable<typename basic_value<TC>::array_type>,
+    detail::is_comparable<typename basic_value<TC>::table_type>
+    >::value, bool>
+operator>(const basic_value<TC>& lhs, const basic_value<TC>& rhs)
+{
+    return !(lhs <= rhs);
+}
+template<typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_comparable<typename basic_value<TC>::array_type>,
+    detail::is_comparable<typename basic_value<TC>::table_type>
+    >::value, bool>
+operator>=(const basic_value<TC>& lhs, const basic_value<TC>& rhs)
+{
+    return !(lhs < rhs);
+}
+
+// error_info helper
+namespace detail
+{
+template<typename TC, typename ... Ts>
+error_info make_error_info_rec(error_info e,
+        const basic_value<TC>& v, std::string msg, Ts&& ... tail)
+{
+    return make_error_info_rec(std::move(e), v.location(), std::move(msg), std::forward<Ts>(tail)...);
+}
+} // detail
+
+template<typename TC, typename ... Ts>
+error_info make_error_info(
+        std::string title, const basic_value<TC>& v, std::string msg, Ts&& ... tail)
+{
+    return make_error_info(std::move(title),
+            v.location(), std::move(msg), std::forward<Ts>(tail)...);
+}
+template<typename TC, typename ... Ts>
+std::string format_error(std::string title,
+        const basic_value<TC>& v, std::string msg, Ts&& ... tail)
+{
+    return format_error(std::move(title),
+            v.location(), std::move(msg), std::forward<Ts>(tail)...);
+}
+
+namespace detail
+{
+
+template<typename TC>
+error_info make_type_error(const basic_value<TC>& v, const std::string& fname, const value_t ty)
+{
+    return make_error_info(fname + ": bad_cast to " + to_string(ty),
+        v.location(), "the actual type is " + to_string(v.type()));
+}
+template<typename TC>
+error_info make_not_found_error(const basic_value<TC>& v, const std::string& fname, const typename basic_value<TC>::key_type& key)
+{
+    const auto loc = v.location();
+    const std::string title = fname + ": key \"" + string_conv<std::string>(key) + "\" not found";
+
+    std::vector<std::pair<source_location, std::string>> locs;
+    if( ! loc.is_ok())
+    {
+        return error_info(title, locs);
+    }
+
+    if(loc.first_line_number() == 1 && loc.first_column_number() == 1 && loc.length() == 1)
+    {
+        // The top-level table has its region at the 0th character of the file.
+        // That means that, in the case when a key is not found in the top-level
+        // table, the error message points to the first character. If the file has
+        // the first table at the first line, the error message would be like this.
+        // ```console
+        // [error] key "a" not found
+        //  --> example.toml
+        //    |
+        //  1 | [table]
+        //    | ^------ in this table
+        // ```
+        // It actually points to the top-level table at the first character, not
+        // `[table]`. But it is too confusing. To avoid the confusion, the error
+        // message should explicitly say "key not found in the top-level table".
+        locs.emplace_back(v.location(), "at the top-level table");
+    }
+    else
+    {
+        locs.emplace_back(v.location(), "in this table");
+    }
+    return error_info(title, locs);
+}
+
+#define TOML11_DETAIL_GENERATE_COMPTIME_GETTER(ty)                              \
+    template<typename TC>                                                       \
+    struct getter<TC, value_t::ty>                                              \
+    {                                                                           \
+        using value_type = basic_value<TC>;                                     \
+        using result_type = enum_to_type_t<value_t::ty, value_type>;            \
+        using format_type = enum_to_fmt_type_t<value_t::ty>;                    \
+                                                                                \
+        static result_type&       get(value_type& v)                            \
+        {                                                                       \
+            return v.as_ ## ty();                                               \
+        }                                                                       \
+        static result_type const& get(const value_type& v)                      \
+        {                                                                       \
+            return v.as_ ## ty();                                               \
+        }                                                                       \
+                                                                                \
+        static result_type&       get_nothrow(value_type& v) noexcept           \
+        {                                                                       \
+            return v.as_ ## ty(std::nothrow);                                   \
+        }                                                                       \
+        static result_type const& get_nothrow(const value_type& v) noexcept     \
+        {                                                                       \
+            return v.as_ ## ty(std::nothrow);                                   \
+        }                                                                       \
+                                                                                \
+        static format_type&       get_fmt(value_type& v)                        \
+        {                                                                       \
+            return v.as_ ## ty ## _fmt();                                       \
+        }                                                                       \
+        static format_type const& get_fmt(const value_type& v)                  \
+        {                                                                       \
+            return v.as_ ## ty ## _fmt();                                       \
+        }                                                                       \
+                                                                                \
+        static format_type&       get_fmt_nothrow(value_type& v) noexcept       \
+        {                                                                       \
+            return v.as_ ## ty ## _fmt(std::nothrow);                           \
+        }                                                                       \
+        static format_type const& get_fmt_nothrow(const value_type& v) noexcept \
+        {                                                                       \
+            return v.as_ ## ty ## _fmt(std::nothrow);                           \
+        }                                                                       \
+    };
+
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(boolean        )
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(integer        )
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(floating       )
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(string         )
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(offset_datetime)
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(local_datetime )
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(local_date     )
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(local_time     )
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(array          )
+TOML11_DETAIL_GENERATE_COMPTIME_GETTER(table          )
+
+#undef TOML11_DETAIL_GENERATE_COMPTIME_GETTER
+
+template<typename TC>
+void change_region_of_value(basic_value<TC>& dst, const basic_value<TC>& src)
+{
+    dst.region_ = std::move(src.region_);
+    return;
+}
+
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+template<typename TC>
+void unset_access_flag(basic_value<TC>& v)
+{
+    v.accessed_.store(false);
+}
+
+template<typename TC>
+void unset_access_flag_recursively(basic_value<TC>& v)
+{
+    switch(v.type())
+    {
+        case value_t::empty            : { return unset_access_flag(v); }
+        case value_t::boolean          : { return unset_access_flag(v); }
+        case value_t::integer          : { return unset_access_flag(v); }
+        case value_t::floating         : { return unset_access_flag(v); }
+        case value_t::string           : { return unset_access_flag(v); }
+        case value_t::offset_datetime  : { return unset_access_flag(v); }
+        case value_t::local_datetime   : { return unset_access_flag(v); }
+        case value_t::local_date       : { return unset_access_flag(v); }
+        case value_t::local_time       : { return unset_access_flag(v); }
+        case value_t::array:
+        {
+            for(auto& elem : v.as_array())
+            {
+                unset_access_flag_recursively(elem);
+            }
+            return unset_access_flag(v);
+        }
+        case value_t::table:
+        {
+            for(auto& kv : v.as_table())
+            {
+                unset_access_flag_recursively(kv.second);
+            }
+            return unset_access_flag(v);
+        }
+        default: { return unset_access_flag(v); }
+    }
+}
+#endif
+
+} // namespace detail
+} // namespace toml
+#endif // TOML11_VALUE_HPP
+#ifndef TOML11_VISIT_HPP
+#define TOML11_VISIT_HPP
+
+
+namespace toml
+{
+
+namespace detail
+{
+
+template<typename F, typename ... Ts>
+using visit_result_t = decltype(std::declval<F>()(std::declval<Ts>().as_boolean() ...));
+
+template<typename F, typename T>
+struct front_binder
+{
+    template<typename ... Args>
+    auto operator()(Args&& ... args) -> decltype(std::declval<F>()(std::declval<T>(), std::forward<Args>(args)...))
+    {
+        return func(std::move(front), std::forward<Args>(args)...);
+    }
+    F func;
+    T front;
+};
+
+template<typename F, typename T>
+front_binder<cxx::remove_cvref_t<F>, cxx::remove_cvref_t<T>>
+bind_front(F&& f, T&& t)
+{
+    return front_binder<cxx::remove_cvref_t<F>, cxx::remove_cvref_t<T>>{
+        std::forward<F>(f), std::forward<T>(t)
+    };
+}
+
+template<typename Visitor, typename TC, typename ... Args>
+visit_result_t<Visitor, const basic_value<TC>&, Args...>
+visit_impl(Visitor&& visitor, const basic_value<TC>& v, Args&& ... args);
+
+template<typename Visitor, typename TC, typename ... Args>
+visit_result_t<Visitor, basic_value<TC>&, Args...>
+visit_impl(Visitor&& visitor, basic_value<TC>& v, Args&& ... args);
+
+template<typename Visitor, typename TC, typename ... Args>
+visit_result_t<Visitor, basic_value<TC>, Args...>
+visit_impl(Visitor&& visitor, basic_value<TC>&& v, Args&& ... args);
+
+
+template<typename Visitor>
+visit_result_t<Visitor> visit_impl(Visitor&& visitor)
+{
+    return visitor();
+}
+
+template<typename Visitor, typename TC, typename ... Args>
+visit_result_t<Visitor, basic_value<TC>&, Args...>
+visit_impl(Visitor&& visitor, basic_value<TC>& v, Args&& ... args)
+{
+    switch(v.type())
+    {
+        case value_t::boolean        : {return visit_impl(bind_front(visitor, std::ref(v.as_boolean        ())), std::forward<Args>(args)...);}
+        case value_t::integer        : {return visit_impl(bind_front(visitor, std::ref(v.as_integer        ())), std::forward<Args>(args)...);}
+        case value_t::floating       : {return visit_impl(bind_front(visitor, std::ref(v.as_floating       ())), std::forward<Args>(args)...);}
+        case value_t::string         : {return visit_impl(bind_front(visitor, std::ref(v.as_string         ())), std::forward<Args>(args)...);}
+        case value_t::offset_datetime: {return visit_impl(bind_front(visitor, std::ref(v.as_offset_datetime())), std::forward<Args>(args)...);}
+        case value_t::local_datetime : {return visit_impl(bind_front(visitor, std::ref(v.as_local_datetime ())), std::forward<Args>(args)...);}
+        case value_t::local_date     : {return visit_impl(bind_front(visitor, std::ref(v.as_local_date     ())), std::forward<Args>(args)...);}
+        case value_t::local_time     : {return visit_impl(bind_front(visitor, std::ref(v.as_local_time     ())), std::forward<Args>(args)...);}
+        case value_t::array          : {return visit_impl(bind_front(visitor, std::ref(v.as_array          ())), std::forward<Args>(args)...);}
+        case value_t::table          : {return visit_impl(bind_front(visitor, std::ref(v.as_table          ())), std::forward<Args>(args)...);}
+        case value_t::empty          : break;
+        default: break;
+    }
+    throw type_error(format_error("[error] toml::visit: toml::basic_value "
+            "does not have any valid type.", v.location(), "here"), v.location());
+}
+
+template<typename Visitor, typename TC, typename ... Args>
+visit_result_t<Visitor, const basic_value<TC>&, Args...>
+visit_impl(Visitor&& visitor, const basic_value<TC>& v, Args&& ... args)
+{
+    switch(v.type())
+    {
+        case value_t::boolean        : {return visit_impl(bind_front(visitor, std::cref(v.as_boolean        ())), std::forward<Args>(args)...);}
+        case value_t::integer        : {return visit_impl(bind_front(visitor, std::cref(v.as_integer        ())), std::forward<Args>(args)...);}
+        case value_t::floating       : {return visit_impl(bind_front(visitor, std::cref(v.as_floating       ())), std::forward<Args>(args)...);}
+        case value_t::string         : {return visit_impl(bind_front(visitor, std::cref(v.as_string         ())), std::forward<Args>(args)...);}
+        case value_t::offset_datetime: {return visit_impl(bind_front(visitor, std::cref(v.as_offset_datetime())), std::forward<Args>(args)...);}
+        case value_t::local_datetime : {return visit_impl(bind_front(visitor, std::cref(v.as_local_datetime ())), std::forward<Args>(args)...);}
+        case value_t::local_date     : {return visit_impl(bind_front(visitor, std::cref(v.as_local_date     ())), std::forward<Args>(args)...);}
+        case value_t::local_time     : {return visit_impl(bind_front(visitor, std::cref(v.as_local_time     ())), std::forward<Args>(args)...);}
+        case value_t::array          : {return visit_impl(bind_front(visitor, std::cref(v.as_array          ())), std::forward<Args>(args)...);}
+        case value_t::table          : {return visit_impl(bind_front(visitor, std::cref(v.as_table          ())), std::forward<Args>(args)...);}
+        case value_t::empty          : break;
+        default: break;
+    }
+    throw type_error(format_error("[error] toml::visit: toml::basic_value "
+            "does not have any valid type.", v.location(), "here"), v.location());
+}
+
+template<typename Visitor, typename TC, typename ... Args>
+visit_result_t<Visitor, basic_value<TC>, Args...>
+visit_impl(Visitor&& visitor, basic_value<TC>&& v, Args&& ... args)
+{
+    switch(v.type())
+    {
+        case value_t::boolean        : {return visit_impl(bind_front(visitor, std::move(v.as_boolean        ())), std::forward<Args>(args)...);}
+        case value_t::integer        : {return visit_impl(bind_front(visitor, std::move(v.as_integer        ())), std::forward<Args>(args)...);}
+        case value_t::floating       : {return visit_impl(bind_front(visitor, std::move(v.as_floating       ())), std::forward<Args>(args)...);}
+        case value_t::string         : {return visit_impl(bind_front(visitor, std::move(v.as_string         ())), std::forward<Args>(args)...);}
+        case value_t::offset_datetime: {return visit_impl(bind_front(visitor, std::move(v.as_offset_datetime())), std::forward<Args>(args)...);}
+        case value_t::local_datetime : {return visit_impl(bind_front(visitor, std::move(v.as_local_datetime ())), std::forward<Args>(args)...);}
+        case value_t::local_date     : {return visit_impl(bind_front(visitor, std::move(v.as_local_date     ())), std::forward<Args>(args)...);}
+        case value_t::local_time     : {return visit_impl(bind_front(visitor, std::move(v.as_local_time     ())), std::forward<Args>(args)...);}
+        case value_t::array          : {return visit_impl(bind_front(visitor, std::move(v.as_array          ())), std::forward<Args>(args)...);}
+        case value_t::table          : {return visit_impl(bind_front(visitor, std::move(v.as_table          ())), std::forward<Args>(args)...);}
+        case value_t::empty          : break;
+        default: break;
+    }
+    throw type_error(format_error("[error] toml::visit: toml::basic_value "
+            "does not have any valid type.", v.location(), "here"), v.location());
+}
+
+} // detail
+
+template<typename Visitor, typename ... Args>
+detail::visit_result_t<Visitor, Args...>
+visit(Visitor&& visitor, Args&& ... args)
+{
+    return detail::visit_impl(std::forward<Visitor>(visitor), std::forward<Args>(args)...);
+}
+
+} // toml
+#endif // TOML11_VISIT_HPP
+#ifndef TOML11_TYPES_HPP
+#define TOML11_TYPES_HPP
+
+
+#include <ostream>
+#include <sstream>
+#include <string>
+#include <type_traits>
+#include <unordered_map>
+#include <vector>
+
+#include <cstdint>
+#include <cstdio>
+
+namespace toml
+{
+
+// forward decl
+template<typename TypeConfig>
+class basic_value;
+
+// when you use a special integer type as toml::value::integer_type, parse must
+// be able to read it. So, type_config has static member functions that read the
+// integer_type as {dec, hex, oct, bin}-integer. But, in most cases, operator<<
+// is enough. To make config easy, we provide the default read functions.
+//
+// Before this functions is called, syntax is checked and prefix(`0x` etc) and
+// spacer(`_`) are removed.
+
+template<typename T>
+result<T, error_info>
+read_dec_int(const std::string& str, const source_location src)
+{
+    constexpr auto max_digits = std::numeric_limits<T>::digits;
+    assert( ! str.empty());
+
+    T val{0};
+    std::istringstream iss(str);
+    iss >> val;
+    if(iss.fail())
+    {
+        return err(make_error_info("toml::parse_dec_integer: "
+            "too large integer: current max digits = 2^" + std::to_string(max_digits),
+            std::move(src), "must be < 2^" + std::to_string(max_digits)));
+    }
+    return ok(val);
+}
+
+template<typename T>
+result<T, error_info>
+read_hex_int(const std::string& str, const source_location src)
+{
+    constexpr auto max_digits = std::numeric_limits<T>::digits;
+    assert( ! str.empty());
+
+    T val{0};
+    std::istringstream iss(str);
+    iss >> std::hex >> val;
+    if(iss.fail())
+    {
+        return err(make_error_info("toml::parse_hex_integer: "
+            "too large integer: current max value = 2^" + std::to_string(max_digits),
+            std::move(src), "must be < 2^" + std::to_string(max_digits)));
+    }
+    return ok(val);
+}
+
+template<typename T>
+result<T, error_info>
+read_oct_int(const std::string& str, const source_location src)
+{
+    constexpr auto max_digits = std::numeric_limits<T>::digits;
+    assert( ! str.empty());
+
+    T val{0};
+    std::istringstream iss(str);
+    iss >> std::oct >> val;
+    if(iss.fail())
+    {
+        return err(make_error_info("toml::parse_oct_integer: "
+            "too large integer: current max value = 2^" + std::to_string(max_digits),
+            std::move(src), "must be < 2^" + std::to_string(max_digits)));
+    }
+    return ok(val);
+}
+
+template<typename T>
+result<T, error_info>
+read_bin_int(const std::string& str, const source_location src)
+{
+    constexpr auto is_bounded =  std::numeric_limits<T>::is_bounded;
+    constexpr auto max_digits =  std::numeric_limits<T>::digits;
+    const auto max_value  = (std::numeric_limits<T>::max)();
+
+    T val{0};
+    T base{1};
+    for(auto i = str.rbegin(); i != str.rend(); ++i)
+    {
+        const auto c = *i;
+        if(c == '1')
+        {
+            val += base;
+            // prevent `base` from overflow
+            if(is_bounded && max_value / 2 < base && std::next(i) != str.rend())
+            {
+                base = 0;
+            }
+            else
+            {
+                base *= 2;
+            }
+        }
+        else
+        {
+            assert(c == '0');
+
+            if(is_bounded && max_value / 2 < base && std::next(i) != str.rend())
+            {
+                base = 0;
+            }
+            else
+            {
+                base *= 2;
+            }
+        }
+    }
+    if(base == 0)
+    {
+        return err(make_error_info("toml::parse_bin_integer: "
+            "too large integer: current max value = 2^" + std::to_string(max_digits),
+            std::move(src), "must be < 2^" + std::to_string(max_digits)));
+    }
+    return ok(val);
+}
+
+template<typename T>
+result<T, error_info>
+read_int(const std::string& str, const source_location src, const std::uint8_t base)
+{
+    assert(base == 10 || base == 16 || base == 8 || base == 2);
+    switch(base)
+    {
+        case  2: { return read_bin_int<T>(str, src); }
+        case  8: { return read_oct_int<T>(str, src); }
+        case 16: { return read_hex_int<T>(str, src); }
+        default:
+        {
+            assert(base == 10);
+            return read_dec_int<T>(str, src);
+        }
+    }
+}
+
+inline result<float, error_info>
+read_hex_float(const std::string& str, const source_location src, float val)
+{
+#if defined(_MSC_VER) && ! defined(__clang__)
+    const auto res = ::sscanf_s(str.c_str(), "%a", std::addressof(val));
+#else
+    const auto res = std::sscanf(str.c_str(), "%a", std::addressof(val));
+#endif
+    if(res != 1)
+    {
+        return err(make_error_info("toml::parse_floating: "
+            "failed to read hexadecimal floating point value ",
+            std::move(src), "here"));
+    }
+    return ok(val);
+}
+inline result<double, error_info>
+read_hex_float(const std::string& str, const source_location src, double val)
+{
+#if defined(_MSC_VER) && ! defined(__clang__)
+    const auto res = ::sscanf_s(str.c_str(), "%la", std::addressof(val));
+#else
+    const auto res = std::sscanf(str.c_str(), "%la", std::addressof(val));
+#endif
+    if(res != 1)
+    {
+        return err(make_error_info("toml::parse_floating: "
+            "failed to read hexadecimal floating point value ",
+            std::move(src), "here"));
+    }
+    return ok(val);
+}
+template<typename T>
+cxx::enable_if_t<cxx::conjunction<
+    cxx::negation<std::is_same<cxx::remove_cvref_t<T>, double>>,
+    cxx::negation<std::is_same<cxx::remove_cvref_t<T>, float>>
+    >::value, result<T, error_info>>
+read_hex_float(const std::string&, const source_location src, T)
+{
+    return err(make_error_info("toml::parse_floating: failed to read "
+        "floating point value because of unknown type in type_config",
+        std::move(src), "here"));
+}
+
+template<typename T>
+result<T, error_info>
+read_dec_float(const std::string& str, const source_location src)
+{
+    T val;
+    std::istringstream iss(str);
+    iss >> val;
+    if(iss.fail())
+    {
+        return err(make_error_info("toml::parse_floating: "
+            "failed to read floating point value from stream",
+            std::move(src), "here"));
+    }
+    return ok(val);
+}
+
+template<typename T>
+result<T, error_info>
+read_float(const std::string& str, const source_location src, const bool is_hex)
+{
+    if(is_hex)
+    {
+        return read_hex_float(str, src, T{});
+    }
+    else
+    {
+        return read_dec_float<T>(str, src);
+    }
+}
+
+struct type_config
+{
+    using comment_type  = preserve_comments;
+
+    using boolean_type  = bool;
+    using integer_type  = std::int64_t;
+    using floating_type = double;
+    using string_type   = std::string;
+
+    template<typename T>
+    using array_type = std::vector<T>;
+    template<typename K, typename T>
+    using table_type = std::unordered_map<K, T>;
+
+    static result<integer_type, error_info>
+    parse_int(const std::string& str, const source_location src, const std::uint8_t base)
+    {
+        return read_int<integer_type>(str, src, base);
+    }
+    static result<floating_type, error_info>
+    parse_float(const std::string& str, const source_location src, const bool is_hex)
+    {
+        return read_float<floating_type>(str, src, is_hex);
+    }
+};
+
+using value = basic_value<type_config>;
+using table = typename value::table_type;
+using array = typename value::array_type;
+
+struct ordered_type_config
+{
+    using comment_type  = preserve_comments;
+
+    using boolean_type  = bool;
+    using integer_type  = std::int64_t;
+    using floating_type = double;
+    using string_type   = std::string;
+
+    template<typename T>
+    using array_type = std::vector<T>;
+    template<typename K, typename T>
+    using table_type = ordered_map<K, T>;
+
+    static result<integer_type, error_info>
+    parse_int(const std::string& str, const source_location src, const std::uint8_t base)
+    {
+        return read_int<integer_type>(str, src, base);
+    }
+    static result<floating_type, error_info>
+    parse_float(const std::string& str, const source_location src, const bool is_hex)
+    {
+        return read_float<floating_type>(str, src, is_hex);
+    }
+};
+
+using ordered_value = basic_value<ordered_type_config>;
+using ordered_table = typename ordered_value::table_type;
+using ordered_array = typename ordered_value::array_type;
+
+// ----------------------------------------------------------------------------
+// meta functions for internal use
+
+namespace detail
+{
+
+// ----------------------------------------------------------------------------
+// check if type T has all the needed member types
+
+template<typename T, typename U = void>
+struct has_comment_type: std::false_type{};
+template<typename T>
+struct has_comment_type<T, cxx::void_t<typename T::comment_type>>: std::true_type{};
+
+template<typename T, typename U = void>
+struct has_integer_type: std::false_type{};
+template<typename T>
+struct has_integer_type<T, cxx::void_t<typename T::integer_type>>: std::true_type{};
+
+template<typename T, typename U = void>
+struct has_floating_type: std::false_type{};
+template<typename T>
+struct has_floating_type<T, cxx::void_t<typename T::floating_type>>: std::true_type{};
+
+template<typename T, typename U = void>
+struct has_string_type: std::false_type{};
+template<typename T>
+struct has_string_type<T, cxx::void_t<typename T::string_type>>: std::true_type{};
+
+template<typename T, typename U = void>
+struct has_array_type: std::false_type{};
+template<typename T>
+struct has_array_type<T, cxx::void_t<typename T::template array_type<int>>>: std::true_type{};
+
+template<typename T, typename U = void>
+struct has_table_type: std::false_type{};
+template<typename T>
+struct has_table_type<T, cxx::void_t<typename T::template table_type<int, int>>>: std::true_type{};
+
+template<typename T, typename U = void>
+struct has_parse_int: std::false_type{};
+template<typename T>
+struct has_parse_int<T, cxx::void_t<decltype(std::declval<T>().parse_int(
+        std::declval<std::string const&>(),
+        std::declval<::toml::source_location const&>(),
+        std::declval<std::uint8_t>()
+    ))>>: std::true_type{};
+
+template<typename T, typename U = void>
+struct has_parse_float: std::false_type{};
+template<typename T>
+struct has_parse_float<T, cxx::void_t<decltype(std::declval<T>().parse_float(
+        std::declval<std::string const&>(),
+        std::declval<::toml::source_location const&>(),
+        std::declval<bool>()
+    ))>>: std::true_type{};
+
+template<typename T>
+using is_type_config = cxx::conjunction<
+    has_comment_type<T>,
+    has_integer_type<T>,
+    has_floating_type<T>,
+    has_string_type<T>,
+    has_array_type<T>,
+    has_table_type<T>,
+    has_parse_int<T>,
+    has_parse_float<T>
+    >;
+
+} // namespace detail
+} // namespace toml
+
+#if defined(TOML11_COMPILE_SOURCES)
+namespace toml
+{
+extern template class basic_value<type_config>;
+extern template class basic_value<ordered_type_config>;
+} // toml
+#endif // TOML11_COMPILE_SOURCES
+
+#endif // TOML11_TYPES_HPP
+#ifndef TOML11_GET_HPP
+#define TOML11_GET_HPP
+
+#include <algorithm>
+
+
+#if defined(TOML11_HAS_STRING_VIEW)
+#include <string_view>
+#endif // string_view
+
+namespace toml
+{
+
+// ============================================================================
+// T is toml::value; identity transformation.
+
+template<typename T, typename TC>
+cxx::enable_if_t<std::is_same<T, basic_value<TC>>::value, T>&
+get(basic_value<TC>& v)
+{
+    return v;
+}
+
+template<typename T, typename TC>
+cxx::enable_if_t<std::is_same<T, basic_value<TC>>::value, T> const&
+get(const basic_value<TC>& v)
+{
+    return v;
+}
+
+template<typename T, typename TC>
+cxx::enable_if_t<std::is_same<T, basic_value<TC>>::value, T>
+get(basic_value<TC>&& v)
+{
+    return basic_value<TC>(std::move(v));
+}
+
+// ============================================================================
+// exact toml::* type
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_exact_toml_type<T, basic_value<TC>>::value, T> &
+get(basic_value<TC>& v)
+{
+    constexpr auto ty = detail::type_to_enum<T, basic_value<TC>>::value;
+    return detail::getter<TC, ty>::get(v);
+}
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_exact_toml_type<T, basic_value<TC>>::value, T> const&
+get(const basic_value<TC>& v)
+{
+    constexpr auto ty = detail::type_to_enum<T, basic_value<TC>>::value;
+    return detail::getter<TC, ty>::get(v);
+}
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_exact_toml_type<T, basic_value<TC>>::value, T>
+get(basic_value<TC>&& v)
+{
+    constexpr auto ty = detail::type_to_enum<T, basic_value<TC>>::value;
+    return detail::getter<TC, ty>::get(std::move(v));
+}
+
+// ============================================================================
+// T is toml::basic_value<U>
+
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_basic_value<T>,
+    cxx::negation<std::is_same<T, basic_value<TC>>>
+    >::value, T>
+get(basic_value<TC> v)
+{
+    return T(std::move(v));
+}
+
+// ============================================================================
+// integer convertible from toml::value::integer_type
+
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    std::is_integral<T>,
+    cxx::negation<std::is_same<T, bool>>,
+    detail::is_not_toml_type<T, basic_value<TC>>,
+    cxx::negation<detail::has_from_toml_method<T, TC>>,
+    cxx::negation<detail::has_specialized_from<T>>
+    >::value, T>
+get(const basic_value<TC>& v)
+{
+    return static_cast<T>(v.as_integer());
+}
+
+// ============================================================================
+// floating point convertible from toml::value::floating_type
+
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    std::is_floating_point<T>,
+    detail::is_not_toml_type<T, basic_value<TC>>,
+    cxx::negation<detail::has_from_toml_method<T, TC>>,
+    cxx::negation<detail::has_specialized_from<T>>
+    >::value, T>
+get(const basic_value<TC>& v)
+{
+    return static_cast<T>(v.as_floating());
+}
+
+// ============================================================================
+// std::string with different char/trait/allocator
+
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_not_toml_type<T, basic_value<TC>>,
+    detail::is_1byte_std_basic_string<T>
+    >::value, T>
+get(const basic_value<TC>& v)
+{
+    return detail::string_conv<cxx::remove_cvref_t<T>>(v.as_string());
+}
+
+// ============================================================================
+// std::string_view
+
+#if defined(TOML11_HAS_STRING_VIEW)
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_string_view_of<T, typename basic_value<TC>::string_type>::value, T>
+get(const basic_value<TC>& v)
+{
+    return T(v.as_string());
+}
+
+#endif // string_view
+
+// ============================================================================
+// std::chrono::duration from toml::local_time
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_chrono_duration<T>::value, T>
+get(const basic_value<TC>& v)
+{
+    return std::chrono::duration_cast<T>(
+            std::chrono::nanoseconds(v.as_local_time()));
+}
+
+// ============================================================================
+// std::chrono::system_clock::time_point from toml::datetime variants
+
+template<typename T, typename TC>
+cxx::enable_if_t<
+    std::is_same<std::chrono::system_clock::time_point, T>::value, T>
+get(const basic_value<TC>& v)
+{
+    switch(v.type())
+    {
+        case value_t::local_date:
+        {
+            return std::chrono::system_clock::time_point(v.as_local_date());
+        }
+        case value_t::local_datetime:
+        {
+            return std::chrono::system_clock::time_point(v.as_local_datetime());
+        }
+        case value_t::offset_datetime:
+        {
+            return std::chrono::system_clock::time_point(v.as_offset_datetime());
+        }
+        default:
+        {
+            const auto loc = v.location();
+            throw type_error(format_error("toml::get: "
+                "bad_cast to std::chrono::system_clock::time_point", loc,
+                "the actual type is " + to_string(v.type())), loc);
+        }
+    }
+}
+
+// ============================================================================
+// forward declaration to use this recursively. ignore this and go ahead.
+
+// array-like (w/ push_back)
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_container<T>,                            // T is a container
+    detail::has_push_back_method<T>,                    // .push_back() works
+    detail::is_not_toml_type<T, basic_value<TC>>,       // but not toml::array
+    cxx::negation<detail::is_std_basic_string<T>>,      // but not std::basic_string<CharT>
+#if defined(TOML11_HAS_STRING_VIEW)
+    cxx::negation<detail::is_std_basic_string_view<T>>,      // but not std::basic_string_view<CharT>
+#endif
+    cxx::negation<detail::has_from_toml_method<T, TC>>, // no T.from_toml()
+    cxx::negation<detail::has_specialized_from<T>>,     // no toml::from<T>
+    cxx::negation<std::is_constructible<T, const basic_value<TC>&>>
+    >::value, T>
+get(const basic_value<TC>&);
+
+// std::array
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_array<T>::value, T>
+get(const basic_value<TC>&);
+
+// std::forward_list
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_forward_list<T>::value, T>
+get(const basic_value<TC>&);
+
+// std::pair<T1, T2>
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_pair<T>::value, T>
+get(const basic_value<TC>&);
+
+// std::tuple<T1, T2, ...>
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_tuple<T>::value, T>
+get(const basic_value<TC>&);
+
+// std::map<key, value> (key is convertible from toml::value::key_type)
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_map<T>,                                  // T is map
+    detail::is_not_toml_type<T, basic_value<TC>>,       // but not toml::table
+    std::is_convertible<typename basic_value<TC>::key_type,
+                        typename T::key_type>,          // keys are convertible
+    cxx::negation<detail::has_from_toml_method<T, TC>>, // no T.from_toml()
+    cxx::negation<detail::has_specialized_from<T>>,     // no toml::from<T>
+    cxx::negation<std::is_constructible<T, const basic_value<TC>&>>
+    >::value, T>
+get(const basic_value<TC>& v);
+
+// std::map<key, value> (key is not convertible from toml::value::key_type, but
+// is a std::basic_string)
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_map<T>,                                  // T is map
+    detail::is_not_toml_type<T, basic_value<TC>>,       // but not toml::table
+    cxx::negation<std::is_convertible<typename basic_value<TC>::key_type,
+        typename T::key_type>>,                         // keys are NOT convertible
+    detail::is_1byte_std_basic_string<typename T::key_type>, // is std::basic_string
+    cxx::negation<detail::has_from_toml_method<T, TC>>, // no T.from_toml()
+    cxx::negation<detail::has_specialized_from<T>>,     // no toml::from<T>
+    cxx::negation<std::is_constructible<T, const basic_value<TC>&>>
+    >::value, T>
+get(const basic_value<TC>& v);
+
+// toml::from<T>::from_toml(v)
+template<typename T, typename TC>
+cxx::enable_if_t<detail::has_specialized_from<T>::value, T>
+get(const basic_value<TC>&);
+
+// has T.from_toml(v) but no from<T>
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::has_from_toml_method<T, TC>,            // has T.from_toml()
+    cxx::negation<detail::has_specialized_from<T>>, // no toml::from<T>
+    std::is_default_constructible<T>                // T{} works
+    >::value, T>
+get(const basic_value<TC>&);
+
+// T(const toml::value&) and T is not toml::basic_value,
+// and it does not have `from<T>` nor `from_toml`.
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    std::is_constructible<T, const basic_value<TC>&>,   // has T(const basic_value&)
+    cxx::negation<detail::is_basic_value<T>>,           // but not basic_value itself
+    cxx::negation<detail::has_from_toml_method<T, TC>>, // no .from_toml()
+    cxx::negation<detail::has_specialized_from<T>>      // no toml::from<T>
+    >::value, T>
+get(const basic_value<TC>&);
+
+// ============================================================================
+// array-like types; most likely STL container, like std::vector, etc.
+
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_container<T>,                            // T is a container
+    detail::has_push_back_method<T>,                    // .push_back() works
+    detail::is_not_toml_type<T, basic_value<TC>>,       // but not toml::array
+    cxx::negation<detail::is_std_basic_string<T>>,      // but not std::basic_string<CharT>
+#if defined(TOML11_HAS_STRING_VIEW)
+    cxx::negation<detail::is_std_basic_string_view<T>>, // but not std::basic_string_view<CharT>
+#endif
+    cxx::negation<detail::has_from_toml_method<T, TC>>, // no T.from_toml()
+    cxx::negation<detail::has_specialized_from<T>>,     // no toml::from<T>
+    cxx::negation<std::is_constructible<T, const basic_value<TC>&>>
+    >::value, T>
+get(const basic_value<TC>& v)
+{
+    using value_type = typename T::value_type;
+    const auto& a = v.as_array();
+
+    T container;
+    detail::try_reserve(container, a.size()); // if T has .reserve(), call it
+
+    for(const auto& elem : a)
+    {
+        container.push_back(get<value_type>(elem));
+    }
+    return container;
+}
+
+// ============================================================================
+// std::array
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_array<T>::value, T>
+get(const basic_value<TC>& v)
+{
+    using value_type = typename T::value_type;
+    const auto& a = v.as_array();
+
+    T container;
+    if(a.size() != container.size())
+    {
+        const auto loc = v.location();
+        throw std::out_of_range(format_error("toml::get: while converting to an array: "
+            " array size is " + std::to_string(container.size()) +
+            " but there are " + std::to_string(a.size()) + " elements in toml array.",
+            loc, "here"));
+    }
+    for(std::size_t i=0; i<a.size(); ++i)
+    {
+        container.at(i) = ::toml::get<value_type>(a.at(i));
+    }
+    return container;
+}
+
+// ============================================================================
+// std::forward_list
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_forward_list<T>::value, T>
+get(const basic_value<TC>& v)
+{
+    using value_type = typename T::value_type;
+
+    T container;
+    for(const auto& elem : v.as_array())
+    {
+        container.push_front(get<value_type>(elem));
+    }
+    container.reverse();
+    return container;
+}
+
+// ============================================================================
+// std::pair
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_pair<T>::value, T>
+get(const basic_value<TC>& v)
+{
+    using first_type  = typename T::first_type;
+    using second_type = typename T::second_type;
+
+    const auto& ar = v.as_array();
+    if(ar.size() != 2)
+    {
+        const auto loc = v.location();
+        throw std::out_of_range(format_error("toml::get: while converting std::pair: "
+            " but there are " + std::to_string(ar.size()) + " > 2 elements in toml array.",
+            loc, "here"));
+    }
+    return std::make_pair(::toml::get<first_type >(ar.at(0)),
+                          ::toml::get<second_type>(ar.at(1)));
+}
+
+// ============================================================================
+// std::tuple.
+
+namespace detail
+{
+template<typename T, typename Array, std::size_t ... I>
+T get_tuple_impl(const Array& a, cxx::index_sequence<I...>)
+{
+    return std::make_tuple(
+        ::toml::get<typename std::tuple_element<I, T>::type>(a.at(I))...);
+}
+} // detail
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_tuple<T>::value, T>
+get(const basic_value<TC>& v)
+{
+    const auto& ar = v.as_array();
+    if(ar.size() != std::tuple_size<T>::value)
+    {
+        const auto loc = v.location();
+        throw std::out_of_range(format_error("toml::get: while converting std::tuple: "
+            " there are " + std::to_string(ar.size()) + " > " +
+            std::to_string(std::tuple_size<T>::value) + " elements in toml array.",
+            loc, "here"));
+    }
+    return detail::get_tuple_impl<T>(ar,
+            cxx::make_index_sequence<std::tuple_size<T>::value>{});
+}
+
+// ============================================================================
+// map-like types; most likely STL map, like std::map or std::unordered_map.
+
+// key is convertible from toml::value::key_type
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_map<T>,                                  // T is map
+    detail::is_not_toml_type<T, basic_value<TC>>,       // but not toml::table
+    std::is_convertible<typename basic_value<TC>::key_type,
+                        typename T::key_type>,          // keys are convertible
+    cxx::negation<detail::has_from_toml_method<T, TC>>, // no T.from_toml()
+    cxx::negation<detail::has_specialized_from<T>>,     // no toml::from<T>
+    cxx::negation<std::is_constructible<T, const basic_value<TC>&>>
+    >::value, T>
+get(const basic_value<TC>& v)
+{
+    using key_type    = typename T::key_type;
+    using mapped_type = typename T::mapped_type;
+    static_assert(
+        std::is_convertible<typename basic_value<TC>::key_type, key_type>::value,
+        "toml::get only supports map type of which key_type is "
+        "convertible from toml::basic_value::key_type.");
+
+    T m;
+    for(const auto& kv : v.as_table())
+    {
+        m.emplace(key_type(kv.first), get<mapped_type>(kv.second));
+    }
+    return m;
+}
+
+// key is NOT convertible from toml::value::key_type but std::basic_string
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::is_map<T>,                                       // T is map
+    detail::is_not_toml_type<T, basic_value<TC>>,            // but not toml::table
+    cxx::negation<std::is_convertible<typename basic_value<TC>::key_type,
+        typename T::key_type>>,                              // keys are NOT convertible
+    detail::is_1byte_std_basic_string<typename T::key_type>, // is std::basic_string
+    cxx::negation<detail::has_from_toml_method<T, TC>>,      // no T.from_toml()
+    cxx::negation<detail::has_specialized_from<T>>,          // no toml::from<T>
+    cxx::negation<std::is_constructible<T, const basic_value<TC>&>>
+    >::value, T>
+get(const basic_value<TC>& v)
+{
+    using key_type    = typename T::key_type;
+    using mapped_type = typename T::mapped_type;
+
+    T m;
+    for(const auto& kv : v.as_table())
+    {
+        m.emplace(detail::string_conv<key_type>(kv.first), get<mapped_type>(kv.second));
+    }
+    return m;
+}
+
+// ============================================================================
+// user-defined, but convertible types.
+
+// toml::from<T>
+template<typename T, typename TC>
+cxx::enable_if_t<detail::has_specialized_from<T>::value, T>
+get(const basic_value<TC>& v)
+{
+    return ::toml::from<T>::from_toml(v);
+}
+
+// has T.from_toml(v) but no from<T>
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    detail::has_from_toml_method<T, TC>,            // has T.from_toml()
+    cxx::negation<detail::has_specialized_from<T>>, // no toml::from<T>
+    std::is_default_constructible<T>                // T{} works
+    >::value, T>
+get(const basic_value<TC>& v)
+{
+    T ud;
+    ud.from_toml(v);
+    return ud;
+}
+
+// T(const toml::value&) and T is not toml::basic_value,
+// and it does not have `from<T>` nor `from_toml`.
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    std::is_constructible<T, const basic_value<TC>&>,   // has T(const basic_value&)
+    cxx::negation<detail::is_basic_value<T>>,           // but not basic_value itself
+    cxx::negation<detail::has_from_toml_method<T, TC>>, // no .from_toml()
+    cxx::negation<detail::has_specialized_from<T>>      // no toml::from<T>
+    >::value, T>
+get(const basic_value<TC>& v)
+{
+    return T(v);
+}
+
+// ============================================================================
+// get_or(value, fallback)
+
+template<typename TC>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>> const&
+get_or(const basic_value<TC>& v, const basic_value<TC>&)
+{
+    return v;
+}
+
+template<typename TC>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>&
+get_or(basic_value<TC>& v, basic_value<TC>&)
+{
+    return v;
+}
+
+template<typename TC>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>
+get_or(basic_value<TC>&& v, basic_value<TC>&&)
+{
+    return v;
+}
+
+// ----------------------------------------------------------------------------
+// specialization for the exact toml types (return type becomes lvalue ref)
+
+template<typename T, typename TC>
+cxx::enable_if_t<
+    detail::is_exact_toml_type<T, basic_value<TC>>::value, T> const&
+get_or(const basic_value<TC>& v, const T& opt) noexcept
+{
+    try
+    {
+        return get<cxx::remove_cvref_t<T>>(v);
+    }
+    catch(...)
+    {
+        return opt;
+    }
+}
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+        cxx::negation<std::is_const<T>>,
+        detail::is_exact_toml_type<T, basic_value<TC>>
+    >::value, T>&
+get_or(basic_value<TC>& v, T& opt) noexcept
+{
+    try
+    {
+        return get<cxx::remove_cvref_t<T>>(v);
+    }
+    catch(...)
+    {
+        return opt;
+    }
+}
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_exact_toml_type<cxx::remove_cvref_t<T>,
+    basic_value<TC>>::value, cxx::remove_cvref_t<T>>
+get_or(basic_value<TC>&& v, T&& opt) noexcept
+{
+    try
+    {
+        return get<cxx::remove_cvref_t<T>>(std::move(v));
+    }
+    catch(...)
+    {
+        return cxx::remove_cvref_t<T>(std::forward<T>(opt));
+    }
+}
+
+// ----------------------------------------------------------------------------
+// specialization for string literal
+
+// template<std::size_t N, typename TC>
+// typename basic_value<TC>::string_type
+// get_or(const basic_value<TC>& v,
+//        const typename basic_value<TC>::string_type::value_type (&opt)[N])
+// {
+//     try
+//     {
+//         return v.as_string();
+//     }
+//     catch(...)
+//     {
+//         return typename basic_value<TC>::string_type(opt);
+//     }
+// }
+//
+// The above only matches to the literal, like `get_or(v, "foo");` but not
+// ```cpp
+// const auto opt = "foo";
+// const auto str = get_or(v, opt);
+// ```
+// . And the latter causes an error.
+// To match to both `"foo"` and `const auto opt = "foo"`, we take a pointer to
+// a character here.
+
+template<typename TC>
+typename basic_value<TC>::string_type
+get_or(const basic_value<TC>& v,
+       const typename basic_value<TC>::string_type::value_type* opt)
+{
+    try
+    {
+        return v.as_string();
+    }
+    catch(...)
+    {
+        return typename basic_value<TC>::string_type(opt);
+    }
+}
+
+// ----------------------------------------------------------------------------
+// others (require type conversion and return type cannot be lvalue reference)
+
+template<typename T, typename TC>
+cxx::enable_if_t<cxx::conjunction<
+    cxx::negation<detail::is_basic_value<T>>,
+    cxx::negation<detail::is_exact_toml_type<T, basic_value<TC>>>,
+    cxx::negation<std::is_same<cxx::remove_cvref_t<T>, typename basic_value<TC>::string_type::value_type const*>>
+    >::value, cxx::remove_cvref_t<T>>
+get_or(const basic_value<TC>& v, T&& opt)
+{
+    try
+    {
+        return get<cxx::remove_cvref_t<T>>(v);
+    }
+    catch(...)
+    {
+        return cxx::remove_cvref_t<T>(std::forward<T>(opt));
+    }
+}
+
+} // toml
+#endif // TOML11_GET_HPP
+#ifndef TOML11_FIND_HPP
+#define TOML11_FIND_HPP
+
+#include <algorithm>
+
+
+#if defined(TOML11_HAS_STRING_VIEW)
+#include <string_view>
+#endif
+
+namespace toml
+{
+
+// ----------------------------------------------------------------------------
+// find<T>(value, key);
+
+template<typename T, typename TC>
+decltype(::toml::get<T>(std::declval<basic_value<TC> const&>()))
+find(const basic_value<TC>& v, const typename basic_value<TC>::key_type& ky)
+{
+    return ::toml::get<T>(v.at(ky));
+}
+
+template<typename T, typename TC>
+decltype(::toml::get<T>(std::declval<basic_value<TC>&>()))
+find(basic_value<TC>& v, const typename basic_value<TC>::key_type& ky)
+{
+    return ::toml::get<T>(v.at(ky));
+}
+
+template<typename T, typename TC>
+decltype(::toml::get<T>(std::declval<basic_value<TC>&&>()))
+find(basic_value<TC>&& v, const typename basic_value<TC>::key_type& ky)
+{
+    return ::toml::get<T>(std::move(v.at(ky)));
+}
+
+// ----------------------------------------------------------------------------
+// find<T>(value, idx)
+
+template<typename T, typename TC>
+decltype(::toml::get<T>(std::declval<basic_value<TC> const&>()))
+find(const basic_value<TC>& v, const std::size_t idx)
+{
+    return ::toml::get<T>(v.at(idx));
+}
+template<typename T, typename TC>
+decltype(::toml::get<T>(std::declval<basic_value<TC>&>()))
+find(basic_value<TC>& v, const std::size_t idx)
+{
+    return ::toml::get<T>(v.at(idx));
+}
+template<typename T, typename TC>
+decltype(::toml::get<T>(std::declval<basic_value<TC>&&>()))
+find(basic_value<TC>&& v, const std::size_t idx)
+{
+    return ::toml::get<T>(std::move(v.at(idx)));
+}
+
+// ----------------------------------------------------------------------------
+// find(value, key/idx), w/o conversion
+
+template<typename TC>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>&
+find(basic_value<TC>& v, const typename basic_value<TC>::key_type& ky)
+{
+    return v.at(ky);
+}
+template<typename TC>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>> const&
+find(basic_value<TC> const& v, const typename basic_value<TC>::key_type& ky)
+{
+    return v.at(ky);
+}
+template<typename TC>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>
+find(basic_value<TC>&& v, const typename basic_value<TC>::key_type& ky)
+{
+    return basic_value<TC>(std::move(v.at(ky)));
+}
+
+template<typename TC>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>&
+find(basic_value<TC>& v, const std::size_t idx)
+{
+    return v.at(idx);
+}
+template<typename TC>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>> const&
+find(basic_value<TC> const& v, const std::size_t idx)
+{
+    return v.at(idx);
+}
+template<typename TC>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>
+find(basic_value<TC>&& v, const std::size_t idx)
+{
+    return basic_value<TC>(std::move(v.at(idx)));
+}
+
+// --------------------------------------------------------------------------
+// find<optional<T>>
+
+#if defined(TOML11_HAS_OPTIONAL)
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_optional<T>::value, T>
+find(const basic_value<TC>& v, const typename basic_value<TC>::key_type& ky)
+{
+    if(v.contains(ky))
+    {
+        return ::toml::get<typename T::value_type>(v.at(ky));
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_optional<T>::value, T>
+find(basic_value<TC>& v, const typename basic_value<TC>::key_type& ky)
+{
+    if(v.contains(ky))
+    {
+        return ::toml::get<typename T::value_type>(v.at(ky));
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+
+template<typename T, typename TC>
+cxx::enable_if_t<detail::is_std_optional<T>::value, T>
+find(basic_value<TC>&& v, const typename basic_value<TC>::key_type& ky)
+{
+    if(v.contains(ky))
+    {
+        return ::toml::get<typename T::value_type>(std::move(v.at(ky)));
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+
+template<typename T, typename K, typename TC>
+cxx::enable_if_t<detail::is_std_optional<T>::value && std::is_integral<K>::value, T>
+find(const basic_value<TC>& v, const K& k)
+{
+    if(static_cast<std::size_t>(k) < v.size())
+    {
+        return ::toml::get<typename T::value_type>(v.at(static_cast<std::size_t>(k)));
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+
+template<typename T, typename K, typename TC>
+cxx::enable_if_t<detail::is_std_optional<T>::value && std::is_integral<K>::value, T>
+find(basic_value<TC>& v, const K& k)
+{
+    if(static_cast<std::size_t>(k) < v.size())
+    {
+        return ::toml::get<typename T::value_type>(v.at(static_cast<std::size_t>(k)));
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+
+template<typename T, typename K, typename TC>
+cxx::enable_if_t<detail::is_std_optional<T>::value && std::is_integral<K>::value, T>
+find(basic_value<TC>&& v, const K& k)
+{
+    if(static_cast<std::size_t>(k) < v.size())
+    {
+        return ::toml::get<typename T::value_type>(std::move(v.at(static_cast<std::size_t>(k))));
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+#endif // optional
+
+// --------------------------------------------------------------------------
+// toml::find(toml::value, toml::key, Ts&& ... keys)
+
+namespace detail
+{
+
+// It suppresses warnings by -Wsign-conversion when we pass integer literal
+// to toml::find. integer literal `0` is deduced as an int, and will be
+// converted to std::size_t. This causes sign-conversion.
+
+template<typename TC>
+std::size_t key_cast(const std::size_t& v) noexcept
+{
+    return v;
+}
+template<typename TC, typename T>
+cxx::enable_if_t<std::is_integral<cxx::remove_cvref_t<T>>::value, std::size_t>
+key_cast(const T& v) noexcept
+{
+    return static_cast<std::size_t>(v);
+}
+
+// for string-like (string, string literal, string_view)
+
+template<typename TC>
+typename basic_value<TC>::key_type const&
+key_cast(const typename basic_value<TC>::key_type& v) noexcept
+{
+    return v;
+}
+template<typename TC>
+typename basic_value<TC>::key_type
+key_cast(const typename basic_value<TC>::key_type::value_type* v)
+{
+    return typename basic_value<TC>::key_type(v);
+}
+#if defined(TOML11_HAS_STRING_VIEW)
+template<typename TC>
+typename basic_value<TC>::key_type
+key_cast(const std::string_view v)
+{
+    return typename basic_value<TC>::key_type(v);
+}
+#endif // string_view
+
+} // detail
+
+// ----------------------------------------------------------------------------
+// find(v, keys...)
+
+template<typename TC, typename K1, typename K2, typename ... Ks>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>> const&
+find(const basic_value<TC>& v, const K1& k1, const K2& k2, const Ks& ... ks)
+{
+    return find(v.at(detail::key_cast<TC>(k1)), detail::key_cast<TC>(k2), ks...);
+}
+template<typename TC, typename K1, typename K2, typename ... Ks>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>&
+find(basic_value<TC>& v, const K1& k1, const K2& k2, const Ks& ... ks)
+{
+    return find(v.at(detail::key_cast<TC>(k1)), detail::key_cast<TC>(k2), ks...);
+}
+template<typename TC, typename K1, typename K2, typename ... Ks>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>
+find(basic_value<TC>&& v, const K1& k1, const K2& k2, const Ks& ... ks)
+{
+    return find(std::move(v.at(detail::key_cast<TC>(k1))), detail::key_cast<TC>(k2), ks...);
+}
+
+// ----------------------------------------------------------------------------
+// find<T>(v, keys...)
+
+template<typename T, typename TC, typename K1, typename K2, typename ... Ks>
+decltype(::toml::get<T>(std::declval<const basic_value<TC>&>()))
+find(const basic_value<TC>& v, const K1& k1, const K2& k2, const Ks& ... ks)
+{
+    return find<T>(v.at(detail::key_cast<TC>(k1)), detail::key_cast<TC>(k2), ks...);
+}
+template<typename T, typename TC, typename K1, typename K2, typename ... Ks>
+decltype(::toml::get<T>(std::declval<basic_value<TC>&>()))
+find(basic_value<TC>& v, const K1& k1, const K2& k2, const Ks& ... ks)
+{
+    return find<T>(v.at(detail::key_cast<TC>(k1)), detail::key_cast<TC>(k2), ks...);
+}
+template<typename T, typename TC, typename K1, typename K2, typename ... Ks>
+decltype(::toml::get<T>(std::declval<basic_value<TC>&&>()))
+find(basic_value<TC>&& v, const K1& k1, const K2& k2, const Ks& ... ks)
+{
+    return find<T>(std::move(v.at(detail::key_cast<TC>(k1))), detail::key_cast<TC>(k2), ks...);
+}
+
+#if defined(TOML11_HAS_OPTIONAL)
+template<typename T, typename TC, typename K2, typename ... Ks>
+cxx::enable_if_t<detail::is_std_optional<T>::value, T>
+find(const basic_value<TC>& v, const typename basic_value<TC>::key_type& k1, const K2& k2, const Ks& ... ks)
+{
+    if(v.contains(k1))
+    {
+        return find<T>(v.at(k1), detail::key_cast<TC>(k2), ks...);
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+template<typename T, typename TC, typename K2, typename ... Ks>
+cxx::enable_if_t<detail::is_std_optional<T>::value, T>
+find(basic_value<TC>& v, const typename basic_value<TC>::key_type& k1, const K2& k2, const Ks& ... ks)
+{
+    if(v.contains(k1))
+    {
+        return find<T>(v.at(k1), detail::key_cast<TC>(k2), ks...);
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+template<typename T, typename TC, typename K2, typename ... Ks>
+cxx::enable_if_t<detail::is_std_optional<T>::value, T>
+find(basic_value<TC>&& v, const typename basic_value<TC>::key_type& k1, const K2& k2, const Ks& ... ks)
+{
+    if(v.contains(k1))
+    {
+        return find<T>(v.at(k1), detail::key_cast<TC>(k2), ks...);
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+
+template<typename T, typename TC, typename K1, typename K2, typename ... Ks>
+cxx::enable_if_t<detail::is_std_optional<T>::value && std::is_integral<K1>::value, T>
+find(const basic_value<TC>& v, const K1& k1, const K2& k2, const Ks& ... ks)
+{
+    if(static_cast<std::size_t>(k1) < v.size())
+    {
+        return find<T>(v.at(static_cast<std::size_t>(k1)), detail::key_cast<TC>(k2), ks...);
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+template<typename T, typename TC, typename K1, typename K2, typename ... Ks>
+cxx::enable_if_t<detail::is_std_optional<T>::value && std::is_integral<K1>::value, T>
+find(basic_value<TC>& v, const K1& k1, const K2& k2, const Ks& ... ks)
+{
+    if(static_cast<std::size_t>(k1) < v.size())
+    {
+        return find<T>(v.at(static_cast<std::size_t>(k1)), detail::key_cast<TC>(k2), ks...);
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+template<typename T, typename TC, typename K1, typename K2, typename ... Ks>
+cxx::enable_if_t<detail::is_std_optional<T>::value && std::is_integral<K1>::value, T>
+find(basic_value<TC>&& v, const K1& k1, const K2& k2, const Ks& ... ks)
+{
+    if(static_cast<std::size_t>(k1) < v.size())
+    {
+        return find<T>(v.at(static_cast<std::size_t>(k1)), detail::key_cast<TC>(k2), ks...);
+    }
+    else
+    {
+        return std::nullopt;
+    }
+}
+#endif // optional
+
+// ===========================================================================
+// find_or<T>(value, key, fallback)
+
+// ---------------------------------------------------------------------------
+// find_or(v, key, other_v)
+
+template<typename TC, typename K>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>&
+find_or(basic_value<TC>& v, const K& k, basic_value<TC>& opt) noexcept
+{
+    try
+    {
+        return ::toml::find(v, detail::key_cast<TC>(k));
+    }
+    catch(...)
+    {
+        return opt;
+    }
+}
+template<typename TC, typename K>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>> const&
+find_or(const basic_value<TC>& v, const K& k, const basic_value<TC>& opt) noexcept
+{
+    try
+    {
+        return ::toml::find(v, detail::key_cast<TC>(k));
+    }
+    catch(...)
+    {
+        return opt;
+    }
+}
+template<typename TC, typename K>
+cxx::enable_if_t<detail::is_type_config<TC>::value, basic_value<TC>>
+find_or(basic_value<TC>&& v, const K& k, basic_value<TC>&& opt) noexcept
+{
+    try
+    {
+        return ::toml::find(v, detail::key_cast<TC>(k));
+    }
+    catch(...)
+    {
+        return opt;
+    }
+}
+
+// ---------------------------------------------------------------------------
+// toml types (return type can be a reference)
+
+template<typename T, typename TC, typename K>
+cxx::enable_if_t<detail::is_exact_toml_type<T, basic_value<TC>>::value,
+    cxx::remove_cvref_t<T> const&>
+find_or(const basic_value<TC>& v, const K& k, const T& opt)
+{
+    try
+    {
+        return ::toml::get<T>(v.at(detail::key_cast<TC>(k)));
+    }
+    catch(...)
+    {
+        return opt;
+    }
+}
+
+template<typename T, typename TC, typename K>
+cxx::enable_if_t<cxx::conjunction<
+        cxx::negation<std::is_const<T>>,
+        detail::is_exact_toml_type<T, basic_value<TC>>
+    >::value, cxx::remove_cvref_t<T>&>
+find_or(basic_value<TC>& v, const K& k, T& opt)
+{
+    try
+    {
+        return ::toml::get<T>(v.at(detail::key_cast<TC>(k)));
+    }
+    catch(...)
+    {
+        return opt;
+    }
+}
+
+template<typename T, typename TC, typename K>
+cxx::enable_if_t<detail::is_exact_toml_type<T, basic_value<TC>>::value,
+    cxx::remove_cvref_t<T>>
+find_or(basic_value<TC>&& v, const K& k, T opt)
+{
+    try
+    {
+        return ::toml::get<T>(std::move(v.at(detail::key_cast<TC>(k))));
+    }
+    catch(...)
+    {
+        return T(std::move(opt));
+    }
+}
+
+// ---------------------------------------------------------------------------
+// string literal (deduced as std::string)
+
+// XXX to avoid confusion when T is explicitly specified in find_or<T>(),
+//     we restrict the string type as std::string.
+template<typename TC, typename K>
+cxx::enable_if_t<detail::is_type_config<TC>::value, std::string>
+find_or(const basic_value<TC>& v, const K& k, const char* opt)
+{
+    try
+    {
+        return ::toml::get<std::string>(v.at(detail::key_cast<TC>(k)));
+    }
+    catch(...)
+    {
+        return std::string(opt);
+    }
+}
+
+// ---------------------------------------------------------------------------
+// other types (requires type conversion and return type cannot be a reference)
+
+template<typename T, typename TC, typename K>
+cxx::enable_if_t<cxx::conjunction<
+        cxx::negation<detail::is_basic_value<cxx::remove_cvref_t<T>>>,
+        detail::is_not_toml_type<cxx::remove_cvref_t<T>, basic_value<TC>>,
+        cxx::negation<std::is_same<cxx::remove_cvref_t<T>,
+            const typename basic_value<TC>::string_type::value_type*>>
+    >::value, cxx::remove_cvref_t<T>>
+find_or(const basic_value<TC>& v, const K& ky, T opt)
+{
+    try
+    {
+        return ::toml::get<cxx::remove_cvref_t<T>>(v.at(detail::key_cast<TC>(ky)));
+    }
+    catch(...)
+    {
+        return cxx::remove_cvref_t<T>(std::move(opt));
+    }
+}
+
+// ----------------------------------------------------------------------------
+// recursive
+
+namespace detail
+{
+
+template<typename ...Ts>
+auto last_one(Ts&&... args)
+ -> decltype(std::get<sizeof...(Ts)-1>(std::forward_as_tuple(std::forward<Ts>(args)...)))
+{
+    return std::get<sizeof...(Ts)-1>(std::forward_as_tuple(std::forward<Ts>(args)...));
+}
+
+} // detail
+
+template<typename Value, typename K1, typename K2, typename K3, typename ... Ks>
+auto find_or(Value&& v, const K1& k1, const K2& k2, K3&& k3, Ks&& ... keys) noexcept
+    -> cxx::enable_if_t<
+        detail::is_basic_value<cxx::remove_cvref_t<Value>>::value,
+        decltype(find_or(v, k2, std::forward<K3>(k3), std::forward<Ks>(keys)...))
+    >
+{
+    try
+    {
+        return find_or(v.at(k1), k2, std::forward<K3>(k3), std::forward<Ks>(keys)...);
+    }
+    catch(...)
+    {
+        return detail::last_one(k3, keys...);
+    }
+}
+
+template<typename T, typename TC, typename K1, typename K2, typename K3, typename ... Ks>
+T find_or(const basic_value<TC>& v, const K1& k1, const K2& k2, const K3& k3, const Ks& ... keys) noexcept
+{
+    try
+    {
+        return find_or<T>(v.at(k1), k2, k3, keys...);
+    }
+    catch(...)
+    {
+        return static_cast<T>(detail::last_one(k3, keys...));
+    }
+}
+
+// ===========================================================================
+// find_or_default<T>(value, key)
+
+template<typename T, typename TC, typename K>
+cxx::enable_if_t<std::is_default_constructible<T>::value, T>
+find_or_default(const basic_value<TC>& v, K&& k) noexcept(std::is_nothrow_default_constructible<T>::value)
+{
+    try
+    {
+        return ::toml::get<T>(v.at(detail::key_cast<TC>(std::forward<K>(k))));
+    }
+    catch(...)
+    {
+        return T();
+    }
+}
+
+template<typename T, typename TC, typename K1, typename ... Ks>
+cxx::enable_if_t<std::is_default_constructible<T>::value, T>
+find_or_default(const basic_value<TC>& v, K1&& k1, Ks&& ... keys) noexcept(std::is_nothrow_default_constructible<T>::value)
+{
+    try
+    {
+        return find_or_default<T>(v.at(std::forward<K1>(k1)), std::forward<Ks>(keys)...);
+    }
+    catch(...)
+    {
+        return T();
+    }
+}
+
+} // toml
+#endif // TOML11_FIND_HPP
+#ifndef TOML11_CONVERSION_HPP
+#define TOML11_CONVERSION_HPP
+
+
+#if defined(TOML11_HAS_OPTIONAL)
+
+#include <optional>
+
+namespace toml
+{
+namespace detail
+{
+
+template<typename T>
+inline constexpr bool is_optional_v = false;
+
+template<typename T>
+inline constexpr bool is_optional_v<std::optional<T>> = true;
+
+template<typename T, typename TC>
+void find_member_variable_from_value(T& obj, const basic_value<TC>& v, const char* var_name)
+{
+    if constexpr(is_optional_v<T>)
+    {
+        if(v.contains(var_name))
+        {
+            obj = toml::find<typename T::value_type>(v, var_name);
+        }
+        else
+        {
+            obj = std::nullopt;
+        }
+    }
+    else
+    {
+        obj = toml::find<T>(v, var_name);
+    }
+}
+
+template<typename T, typename TC>
+void assign_member_variable_to_value(const T& obj, basic_value<TC>& v, const char* var_name)
+{
+    if constexpr(is_optional_v<T>)
+    {
+        if(obj.has_value())
+        {
+            v[var_name] = obj.value();
+        }
+    }
+    else
+    {
+        v[var_name] = obj;
+    }
+}
+
+} // detail
+} // toml
+
+#else
+
+namespace toml
+{
+namespace detail
+{
+
+template<typename T, typename TC>
+void find_member_variable_from_value(T& obj, const basic_value<TC>& v, const char* var_name)
+{
+    obj = toml::find<T>(v, var_name);
+}
+
+template<typename T, typename TC>
+void assign_member_variable_to_value(const T& obj, basic_value<TC>& v, const char* var_name)
+{
+    v[var_name] = obj;
+}
+
+} // detail
+} // toml
+
+#endif // optional
+
+// use it in the following way.
+// ```cpp
+// namespace foo
+// {
+// struct Foo
+// {
+//     std::string s;
+//     double      d;
+//     int         i;
+// };
+// } // foo
+//
+// TOML11_DEFINE_CONVERSION_NON_INTRUSIVE(foo::Foo, s, d, i)
+// ```
+//
+// And then you can use `toml::get<foo::Foo>(v)` and `toml::find<foo::Foo>(file, "foo");`
+//
+
+#define TOML11_STRINGIZE_AUX(x) #x
+#define TOML11_STRINGIZE(x)     TOML11_STRINGIZE_AUX(x)
+
+#define TOML11_CONCATENATE_AUX(x, y) x##y
+#define TOML11_CONCATENATE(x, y)     TOML11_CONCATENATE_AUX(x, y)
+
+// ============================================================================
+// TOML11_DEFINE_CONVERSION_NON_INTRUSIVE
+
+#ifndef TOML11_WITHOUT_DEFINE_NON_INTRUSIVE
+
+// ----------------------------------------------------------------------------
+// TOML11_ARGS_SIZE
+
+#define TOML11_INDEX_RSEQ() \
+    32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 17, \
+    16, 15, 14, 13, 12, 11, 10,  9,  8,  7,  6,  5,  4,  3,  2,  1, 0
+#define TOML11_ARGS_SIZE_IMPL(\
+    ARG1,  ARG2,  ARG3,  ARG4,  ARG5,  ARG6,  ARG7,  ARG8,  ARG9,  ARG10, \
+    ARG11, ARG12, ARG13, ARG14, ARG15, ARG16, ARG17, ARG18, ARG19, ARG20, \
+    ARG21, ARG22, ARG23, ARG24, ARG25, ARG26, ARG27, ARG28, ARG29, ARG30, \
+    ARG31, ARG32, N, ...) N
+#define TOML11_ARGS_SIZE_AUX(...) TOML11_ARGS_SIZE_IMPL(__VA_ARGS__)
+#define TOML11_ARGS_SIZE(...) TOML11_ARGS_SIZE_AUX(__VA_ARGS__, TOML11_INDEX_RSEQ())
+
+// ----------------------------------------------------------------------------
+// TOML11_FOR_EACH_VA_ARGS
+
+#define TOML11_FOR_EACH_VA_ARGS_AUX_1( FUNCTOR, ARG1     ) FUNCTOR(ARG1)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_2( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_1( FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_3( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_2( FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_4( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_3( FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_5( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_4( FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_6( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_5( FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_7( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_6( FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_8( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_7( FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_9( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_8( FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_10(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_9( FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_11(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_10(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_12(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_11(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_13(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_12(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_14(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_13(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_15(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_14(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_16(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_15(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_17(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_16(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_18(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_17(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_19(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_18(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_20(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_19(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_21(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_20(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_22(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_21(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_23(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_22(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_24(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_23(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_25(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_24(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_26(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_25(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_27(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_26(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_28(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_27(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_29(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_28(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_30(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_29(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_31(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_30(FUNCTOR, __VA_ARGS__)
+#define TOML11_FOR_EACH_VA_ARGS_AUX_32(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_31(FUNCTOR, __VA_ARGS__)
+
+#define TOML11_FOR_EACH_VA_ARGS(FUNCTOR, ...)\
+    TOML11_CONCATENATE(TOML11_FOR_EACH_VA_ARGS_AUX_, TOML11_ARGS_SIZE(__VA_ARGS__))(FUNCTOR, __VA_ARGS__)
+
+
+#define TOML11_FIND_MEMBER_VARIABLE_FROM_VALUE(VAR_NAME)\
+    toml::detail::find_member_variable_from_value(obj.VAR_NAME, v, TOML11_STRINGIZE(VAR_NAME));
+
+#define TOML11_ASSIGN_MEMBER_VARIABLE_TO_VALUE(VAR_NAME)\
+    toml::detail::assign_member_variable_to_value(obj.VAR_NAME, v, TOML11_STRINGIZE(VAR_NAME));
+
+#define TOML11_DEFINE_CONVERSION_NON_INTRUSIVE(NAME, ...)\
+    namespace toml {                                                                     \
+    template<>                                                                           \
+    struct from<NAME>                                                                    \
+    {                                                                                    \
+        template<typename TC>                                                            \
+        static NAME from_toml(const basic_value<TC>& v)                                  \
+        {                                                                                \
+            NAME obj;                                                                    \
+            TOML11_FOR_EACH_VA_ARGS(TOML11_FIND_MEMBER_VARIABLE_FROM_VALUE, __VA_ARGS__) \
+            return obj;                                                                  \
+        }                                                                                \
+    };                                                                                   \
+    template<>                                                                           \
+    struct into<NAME>                                                                    \
+    {                                                                                    \
+        template<typename TC>                                                            \
+        static basic_value<TC> into_toml(const NAME& obj)                                \
+        {                                                                                \
+            ::toml::basic_value<TC> v = typename ::toml::basic_value<TC>::table_type{};  \
+            TOML11_FOR_EACH_VA_ARGS(TOML11_ASSIGN_MEMBER_VARIABLE_TO_VALUE, __VA_ARGS__) \
+            return v;                                                                    \
+        }                                                                                \
+    };                                                                                   \
+    } /* toml */
+
+#endif// TOML11_WITHOUT_DEFINE_NON_INTRUSIVE
+
+#endif // TOML11_CONVERSION_HPP
+#ifndef TOML11_CONTEXT_HPP
+#define TOML11_CONTEXT_HPP
+
+
+#include <vector>
+
+namespace toml
+{
+namespace detail
+{
+
+template<typename TypeConfig>
+class context
+{
+  public:
+
+    explicit context(const spec& toml_spec)
+        : toml_spec_(toml_spec), errors_{}
+    {}
+
+    bool has_error() const noexcept {return !errors_.empty();}
+
+    std::vector<error_info> const& errors() const noexcept {return errors_;}
+
+    semantic_version&       toml_version()       noexcept {return toml_spec_.version;}
+    semantic_version const& toml_version() const noexcept {return toml_spec_.version;}
+
+    spec&       toml_spec()       noexcept {return toml_spec_;}
+    spec const& toml_spec() const noexcept {return toml_spec_;}
+
+    void report_error(error_info err)
+    {
+        this->errors_.push_back(std::move(err));
+    }
+
+    error_info pop_last_error()
+    {
+        assert( ! errors_.empty());
+        auto e = std::move(errors_.back());
+        errors_.pop_back();
+        return e;
+    }
+
+  private:
+
+    spec toml_spec_;
+    std::vector<error_info> errors_;
+};
+
+} // detail
+} // toml
+
+#if defined(TOML11_COMPILE_SOURCES)
+namespace toml
+{
+struct type_config;
+struct ordered_type_config;
+namespace detail
+{
+extern template class context<::toml::type_config>;
+extern template class context<::toml::ordered_type_config>;
+} // detail
+} // toml
+#endif // TOML11_COMPILE_SOURCES
+
+#endif // TOML11_CONTEXT_HPP
+#ifndef TOML11_SCANNER_HPP
+#define TOML11_SCANNER_HPP
+
+#ifndef TOML11_SCANNER_FWD_HPP
+#define TOML11_SCANNER_FWD_HPP
+
+
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include <cassert>
+#include <cstdio>
+#include <cctype>
+
+namespace toml
+{
+namespace detail
+{
+
+class scanner_base
+{
+  public:
+    virtual ~scanner_base() = default;
+    virtual region scan(location& loc) const = 0;
+    virtual scanner_base* clone() const = 0;
+
+    // returns expected character or set of characters or literal.
+    // to show the error location, it changes loc (in `sequence`, especially).
+    virtual std::string expected_chars(location& loc) const = 0;
+    virtual std::string name() const = 0;
+};
+
+// make `scanner*` copyable
+struct scanner_storage
+{
+    template<typename Scanner, cxx::enable_if_t<
+        std::is_base_of<scanner_base, cxx::remove_cvref_t<Scanner>>::value,
+        std::nullptr_t> = nullptr>
+    explicit scanner_storage(Scanner&& s)
+        : scanner_(cxx::make_unique<cxx::remove_cvref_t<Scanner>>(std::forward<Scanner>(s)))
+    {}
+    ~scanner_storage() = default;
+
+    scanner_storage(const scanner_storage& other);
+    scanner_storage& operator=(const scanner_storage& other);
+    scanner_storage(scanner_storage&&) = default;
+    scanner_storage& operator=(scanner_storage&&) = default;
+
+    bool is_ok() const noexcept {return static_cast<bool>(scanner_);}
+
+    region scan(location& loc) const;
+
+    std::string expected_chars(location& loc) const;
+
+    scanner_base& get() const noexcept;
+
+    std::string name() const;
+
+  private:
+
+    std::unique_ptr<scanner_base> scanner_;
+};
+
+// ----------------------------------------------------------------------------
+
+class character final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  public:
+
+    explicit character(const char_type c) noexcept
+        : value_(c)
+    {}
+    ~character() override = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location&) const override;
+
+    scanner_base* clone() const override;
+
+    std::string name() const override;
+
+  private:
+    char_type value_;
+};
+
+// ----------------------------------------------------------------------------
+
+class character_either final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  public:
+
+    template<std::size_t N>
+    explicit character_either(const char (&cs)[N]) noexcept
+        : value_(cs), size_(N-1) // remove null character at the end
+    {}
+    ~character_either() override = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location&) const override;
+
+    scanner_base* clone() const override;
+
+    std::string name() const override;
+
+  private:
+    const char* value_;
+    std::size_t size_;
+};
+
+// ----------------------------------------------------------------------------
+
+class character_in_range final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  public:
+
+    explicit character_in_range(const char_type from, const char_type to) noexcept
+        : from_(from), to_(to)
+    {}
+    ~character_in_range() override = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location&) const override;
+
+    scanner_base* clone() const override;
+
+    std::string name() const override;
+
+  private:
+    char_type from_;
+    char_type to_;
+};
+
+// ----------------------------------------------------------------------------
+
+class literal final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  public:
+
+    template<std::size_t N>
+    explicit literal(const char (&cs)[N]) noexcept
+        : value_(cs), size_(N-1) // remove null character at the end
+    {}
+    ~literal() override = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location&) const override;
+
+    scanner_base* clone() const override;
+
+    std::string name() const override;
+
+  private:
+    const char* value_;
+    std::size_t size_;
+};
+
+// ----------------------------------------------------------------------------
+
+class sequence final: public scanner_base
+{
+  public:
+    using char_type = location::char_type;
+
+  public:
+
+    template<typename ... Ts>
+    explicit sequence(Ts&& ... args)
+    {
+        push_back_all(std::forward<Ts>(args)...);
+    }
+    sequence(const sequence&)            = default;
+    sequence(sequence&&)                 = default;
+    sequence& operator=(const sequence&) = default;
+    sequence& operator=(sequence&&)      = default;
+    ~sequence() override                 = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location& loc) const override;
+
+    scanner_base* clone() const override;
+
+    std::string name() const override;
+
+  private:
+
+    void push_back_all()
+    {
+        return;
+    }
+    template<typename T, typename ... Ts>
+    void push_back_all(T&& head, Ts&& ... args)
+    {
+        others_.emplace_back(std::forward<T>(head));
+        push_back_all(std::forward<Ts>(args)...);
+        return;
+    }
+
+  private:
+    std::vector<scanner_storage> others_;
+};
+
+// ----------------------------------------------------------------------------
+
+class either final: public scanner_base
+{
+  public:
+    using char_type = location::char_type;
+
+  public:
+
+    template<typename ... Ts>
+    explicit either(Ts&& ... args)
+    {
+        push_back_all(std::forward<Ts>(args)...);
+    }
+    either(const either&)            = default;
+    either(either&&)                 = default;
+    either& operator=(const either&) = default;
+    either& operator=(either&&)      = default;
+    ~either() override               = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location& loc) const override;
+
+    scanner_base* clone() const override;
+
+    std::string name() const override;
+
+  private:
+
+    void push_back_all()
+    {
+        return;
+    }
+    template<typename T, typename ... Ts>
+    void push_back_all(T&& head, Ts&& ... args)
+    {
+        others_.emplace_back(std::forward<T>(head));
+        push_back_all(std::forward<Ts>(args)...);
+        return;
+    }
+
+  private:
+    std::vector<scanner_storage> others_;
+};
+
+// ----------------------------------------------------------------------------
+
+class repeat_exact final: public scanner_base
+{
+  public:
+    using char_type = location::char_type;
+
+  public:
+
+    template<typename Scanner>
+    repeat_exact(const std::size_t length, Scanner&& other)
+        : length_(length), other_(std::forward<Scanner>(other))
+    {}
+    repeat_exact(const repeat_exact&)            = default;
+    repeat_exact(repeat_exact&&)                 = default;
+    repeat_exact& operator=(const repeat_exact&) = default;
+    repeat_exact& operator=(repeat_exact&&)      = default;
+    ~repeat_exact() override                     = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location& loc) const override;
+
+    scanner_base* clone() const override;
+
+    std::string name() const override;
+
+  private:
+    std::size_t length_;
+    scanner_storage other_;
+};
+
+// ----------------------------------------------------------------------------
+
+class repeat_at_least final: public scanner_base
+{
+  public:
+    using char_type = location::char_type;
+
+  public:
+
+    template<typename Scanner>
+    repeat_at_least(const std::size_t length, Scanner&& s)
+        : length_(length), other_(std::forward<Scanner>(s))
+    {}
+    repeat_at_least(const repeat_at_least&)            = default;
+    repeat_at_least(repeat_at_least&&)                 = default;
+    repeat_at_least& operator=(const repeat_at_least&) = default;
+    repeat_at_least& operator=(repeat_at_least&&)      = default;
+    ~repeat_at_least() override                        = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location& loc) const override;
+
+    scanner_base* clone() const override;
+
+    std::string name() const override;
+
+  private:
+    std::size_t length_;
+    scanner_storage other_;
+};
+
+// ----------------------------------------------------------------------------
+
+class maybe final: public scanner_base
+{
+  public:
+    using char_type = location::char_type;
+
+  public:
+
+    template<typename Scanner>
+    explicit maybe(Scanner&& s)
+        : other_(std::forward<Scanner>(s))
+    {}
+    maybe(const maybe&)            = default;
+    maybe(maybe&&)                 = default;
+    maybe& operator=(const maybe&) = default;
+    maybe& operator=(maybe&&)      = default;
+    ~maybe() override              = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location&) const override;
+
+    scanner_base* clone() const override;
+
+    std::string name() const override;
+
+  private:
+    scanner_storage other_;
+};
+
+} // detail
+} // toml
+#endif // TOML11_SCANNER_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_SCANNER_IMPL_HPP
+#define TOML11_SCANNER_IMPL_HPP
+
+
+namespace toml
+{
+namespace detail
+{
+
+TOML11_INLINE scanner_storage::scanner_storage(const scanner_storage& other)
+    : scanner_(nullptr)
+{
+    if(other.is_ok())
+    {
+        scanner_.reset(other.get().clone());
+    }
+}
+TOML11_INLINE scanner_storage& scanner_storage::operator=(const scanner_storage& other)
+{
+    if(this == std::addressof(other)) {return *this;}
+    if(other.is_ok())
+    {
+        scanner_.reset(other.get().clone());
+    }
+    return *this;
+}
+
+TOML11_INLINE region scanner_storage::scan(location& loc) const
+{
+    assert(this->is_ok());
+    return this->scanner_->scan(loc);
+}
+
+TOML11_INLINE std::string scanner_storage::expected_chars(location& loc) const
+{
+    assert(this->is_ok());
+    return this->scanner_->expected_chars(loc);
+}
+
+TOML11_INLINE scanner_base& scanner_storage::get() const noexcept
+{
+    assert(this->is_ok());
+    return *scanner_;
+}
+
+TOML11_INLINE std::string scanner_storage::name() const
+{
+    assert(this->is_ok());
+    return this->scanner_->name();
+}
+
+// ----------------------------------------------------------------------------
+
+TOML11_INLINE region character::scan(location& loc) const
+{
+    if(loc.eof()) {return region{};}
+
+    if(loc.current() == this->value_)
+    {
+        const auto first = loc;
+        loc.advance(1);
+        return region(first, loc);
+    }
+    return region{};
+}
+
+TOML11_INLINE std::string character::expected_chars(location&) const
+{
+    return show_char(value_);
+}
+
+TOML11_INLINE scanner_base* character::clone() const
+{
+    return new character(*this);
+}
+
+TOML11_INLINE std::string character::name() const
+{
+    return "character{" + show_char(value_) + "}";
+}
+
+// ----------------------------------------------------------------------------
+
+TOML11_INLINE region character_either::scan(location& loc) const
+{
+    if(loc.eof()) {return region{};}
+
+    for(std::size_t i=0; i<this->size_; ++i)
+    {
+        const auto c = char_type(this->value_[i]);
+        if(loc.current() == c)
+        {
+            const auto first = loc;
+            loc.advance(1);
+            return region(first, loc);
+        }
+    }
+    return region{};
+}
+
+TOML11_INLINE std::string character_either::expected_chars(location&) const
+{
+    assert( this->value_ );
+    assert( this->size_ != 0 );
+
+    std::string expected;
+    if(this->size_ == 1)
+    {
+        expected += show_char(char_type(value_[0]));
+    }
+    else if(this->size_ == 2)
+    {
+        expected += show_char(char_type(value_[0])) + " or " +
+                    show_char(char_type(value_[1]));
+    }
+    else
+    {
+        for(std::size_t i=0; i<this->size_; ++i)
+        {
+            if(i != 0)
+            {
+                expected += ", ";
+            }
+            if(i + 1 == this->size_)
+            {
+                expected += "or ";
+            }
+            expected += show_char(char_type(value_[i]));
+        }
+    }
+    return expected;
+}
+
+TOML11_INLINE scanner_base* character_either::clone() const
+{
+    return new character_either(*this);
+}
+
+TOML11_INLINE std::string character_either::name() const
+{
+    std::string n("character_either{");
+    for(std::size_t i=0; i<this->size_; ++i)
+    {
+        const auto c = char_type(this->value_[i]);
+        n += show_char(c);
+        n += ", ";
+    }
+    if(this->size_ != 0)
+    {
+        n.pop_back();
+        n.pop_back();
+    }
+    n += "}";
+    return n;
+}
+
+// ----------------------------------------------------------------------------
+// character_in_range
+
+TOML11_INLINE region character_in_range::scan(location& loc) const
+{
+    if(loc.eof()) {return region{};}
+
+    const auto curr = loc.current();
+    if(this->from_ <= curr && curr <= this->to_)
+    {
+        const auto first = loc;
+        loc.advance(1);
+        return region(first, loc);
+    }
+    return region{};
+}
+
+TOML11_INLINE std::string character_in_range::expected_chars(location&) const
+{
+    std::string expected("from `");
+    expected += show_char(from_);
+    expected += "` to `";
+    expected += show_char(to_);
+    expected += "`";
+    return expected;
+}
+
+TOML11_INLINE scanner_base* character_in_range::clone() const
+{
+    return new character_in_range(*this);
+}
+
+TOML11_INLINE std::string character_in_range::name() const
+{
+    return "character_in_range{" + show_char(from_) + "," + show_char(to_) + "}";
+}
+
+// ----------------------------------------------------------------------------
+// literal
+
+TOML11_INLINE region literal::scan(location& loc) const
+{
+    const auto first = loc;
+    for(std::size_t i=0; i<size_; ++i)
+    {
+        if(loc.eof() || char_type(value_[i]) != loc.current())
+        {
+            loc = first;
+            return region{};
+        }
+        loc.advance(1);
+    }
+    return region(first, loc);
+}
+
+TOML11_INLINE std::string literal::expected_chars(location&) const
+{
+    return std::string(value_);
+}
+
+TOML11_INLINE scanner_base* literal::clone() const
+{
+    return new literal(*this);
+}
+
+TOML11_INLINE std::string literal::name() const
+{
+    return std::string("literal{") + std::string(value_, size_) + "}";
+}
+
+// ----------------------------------------------------------------------------
+// sequence
+
+TOML11_INLINE region sequence::scan(location& loc) const
+{
+    const auto first = loc;
+    for(const auto& other : others_)
+    {
+        const auto reg = other.scan(loc);
+        if( ! reg.is_ok())
+        {
+            loc = first;
+            return region{};
+        }
+    }
+    return region(first, loc);
+}
+
+TOML11_INLINE std::string sequence::expected_chars(location& loc) const
+{
+    const auto first = loc;
+    for(const auto& other : others_)
+    {
+        const auto reg = other.scan(loc);
+        if( ! reg.is_ok())
+        {
+            return other.expected_chars(loc);
+        }
+    }
+    assert(false);
+    return ""; // XXX
+}
+
+TOML11_INLINE scanner_base* sequence::clone() const
+{
+    return new sequence(*this);
+}
+
+TOML11_INLINE std::string sequence::name() const
+{
+    std::string n("sequence{");
+    for(const auto& other : others_)
+    {
+        n += other.name();
+        n += ", ";
+    }
+    if( ! this->others_.empty())
+    {
+        n.pop_back();
+        n.pop_back();
+    }
+    n += "}";
+    return n;
+}
+
+// ----------------------------------------------------------------------------
+// either
+
+TOML11_INLINE region either::scan(location& loc) const
+{
+    for(const auto& other : others_)
+    {
+        const auto reg = other.scan(loc);
+        if(reg.is_ok())
+        {
+            return reg;
+        }
+    }
+    return region{};
+}
+
+TOML11_INLINE std::string either::expected_chars(location& loc) const
+{
+    assert( ! others_.empty());
+
+    std::string expected = others_.at(0).expected_chars(loc);
+    if(others_.size() == 2)
+    {
+        expected += " or ";
+        expected += others_.at(1).expected_chars(loc);
+    }
+    else
+    {
+        for(std::size_t i=1; i<others_.size(); ++i)
+        {
+            expected += ", ";
+            if(i + 1 == others_.size())
+            {
+                expected += "or ";
+            }
+            expected += others_.at(i).expected_chars(loc);
+        }
+    }
+    return expected;
+}
+
+TOML11_INLINE scanner_base* either::clone() const
+{
+    return new either(*this);
+}
+
+TOML11_INLINE std::string either::name() const
+{
+    std::string n("either{");
+    for(const auto& other : others_)
+    {
+        n += other.name();
+        n += ", ";
+    }
+    if( ! this->others_.empty())
+    {
+        n.pop_back();
+        n.pop_back();
+    }
+    n += "}";
+    return n;
+}
+
+// ----------------------------------------------------------------------------
+// repeat_exact
+
+TOML11_INLINE region repeat_exact::scan(location& loc) const
+{
+    const auto first = loc;
+    for(std::size_t i=0; i<length_; ++i)
+    {
+        const auto reg = other_.scan(loc);
+        if( ! reg.is_ok())
+        {
+            loc = first;
+            return region{};
+        }
+    }
+    return region(first, loc);
+}
+
+TOML11_INLINE std::string repeat_exact::expected_chars(location& loc) const
+{
+    for(std::size_t i=0; i<length_; ++i)
+    {
+        const auto reg = other_.scan(loc);
+        if( ! reg.is_ok())
+        {
+            return other_.expected_chars(loc);
+        }
+    }
+    assert(false);
+    return "";
+}
+
+TOML11_INLINE scanner_base* repeat_exact::clone() const
+{
+    return new repeat_exact(*this);
+}
+
+TOML11_INLINE std::string repeat_exact::name() const
+{
+    return "repeat_exact{" + std::to_string(length_) + ", " + other_.name() + "}";
+}
+
+// ----------------------------------------------------------------------------
+// repeat_at_least
+
+TOML11_INLINE region repeat_at_least::scan(location& loc) const
+{
+    const auto first = loc;
+    for(std::size_t i=0; i<length_; ++i)
+    {
+        const auto reg = other_.scan(loc);
+        if( ! reg.is_ok())
+        {
+            loc = first;
+            return region{};
+        }
+    }
+    while( ! loc.eof())
+    {
+        const auto checkpoint = loc;
+        const auto reg = other_.scan(loc);
+        if( ! reg.is_ok())
+        {
+            loc = checkpoint;
+            return region(first, loc);
+        }
+    }
+    return region(first, loc);
+}
+
+TOML11_INLINE std::string repeat_at_least::expected_chars(location& loc) const
+{
+    for(std::size_t i=0; i<length_; ++i)
+    {
+        const auto reg = other_.scan(loc);
+        if( ! reg.is_ok())
+        {
+            return other_.expected_chars(loc);
+        }
+    }
+    assert(false);
+    return "";
+}
+
+TOML11_INLINE scanner_base* repeat_at_least::clone() const
+{
+    return new repeat_at_least(*this);
+}
+
+TOML11_INLINE std::string repeat_at_least::name() const
+{
+    return "repeat_at_least{" + std::to_string(length_) + ", " + other_.name() + "}";
+}
+
+// ----------------------------------------------------------------------------
+// maybe
+
+TOML11_INLINE region maybe::scan(location& loc) const
+{
+    const auto first = loc;
+    const auto reg = other_.scan(loc);
+    if( ! reg.is_ok())
+    {
+        loc = first;
+    }
+    return region(first, loc);
+}
+
+TOML11_INLINE std::string maybe::expected_chars(location&) const
+{
+    return "";
+}
+
+TOML11_INLINE scanner_base* maybe::clone() const
+{
+    return new maybe(*this);
+}
+
+TOML11_INLINE std::string maybe::name() const
+{
+    return "maybe{" + other_.name() + "}";
+}
+
+} // detail
+} // toml
+#endif // TOML11_SCANNER_IMPL_HPP
+#endif
+
+#endif // TOML11_SCANNER_HPP
+#ifndef TOML11_SYNTAX_HPP
+#define TOML11_SYNTAX_HPP
+
+#ifndef TOML11_SYNTAX_FWD_HPP
+#define TOML11_SYNTAX_FWD_HPP
+
+
+namespace toml
+{
+namespace detail
+{
+namespace syntax
+{
+
+using char_type = location::char_type;
+
+// ===========================================================================
+// UTF-8
+
+// avoid redundant representation and out-of-unicode sequence
+
+character_in_range const& utf8_1byte (const spec&);
+sequence           const& utf8_2bytes(const spec&);
+sequence           const& utf8_3bytes(const spec&);
+sequence           const& utf8_4bytes(const spec&);
+
+class non_ascii final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  public:
+
+    explicit non_ascii(const spec& s) noexcept
+        : utf8_2B_(utf8_2bytes(s)),
+          utf8_3B_(utf8_3bytes(s)),
+          utf8_4B_(utf8_4bytes(s))
+    {}
+    ~non_ascii() override = default;
+
+    region scan(location& loc) const override
+    {
+        {
+            const auto reg = utf8_2B_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        {
+            const auto reg = utf8_3B_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        {
+            const auto reg = utf8_4B_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        return region{};
+    }
+
+    std::string expected_chars(location&) const override
+    {
+        return "non-ascii utf-8 bytes";
+    }
+
+    scanner_base* clone() const override
+    {
+        return new non_ascii(*this);
+    }
+
+    std::string name() const override
+    {
+        return "non_ascii";
+    }
+
+  private:
+    sequence utf8_2B_;
+    sequence utf8_3B_;
+    sequence utf8_4B_;
+};
+
+// ===========================================================================
+// Whitespace
+
+character_either const& wschar(const spec&);
+
+repeat_at_least const& ws(const spec& s);
+
+// ===========================================================================
+// Newline
+
+either const& newline(const spec&);
+
+// ===========================================================================
+// Comments
+
+either const& allowed_comment_char(const spec& s);
+
+// XXX Note that it does not take newline
+sequence const& comment(const spec& s);
+
+// ===========================================================================
+// Boolean
+
+either const& boolean(const spec&);
+
+// ===========================================================================
+// Integer
+
+class digit final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  public:
+
+    explicit digit(const spec&) noexcept
+      : scanner_(char_type('0'), char_type('9'))
+    {}
+
+
+    ~digit() override = default;
+
+    region scan(location& loc) const override
+    {
+        return scanner_.scan(loc);
+    }
+
+    std::string expected_chars(location&) const override
+    {
+        return "digit [0-9]";
+    }
+
+    scanner_base* clone() const override
+    {
+        return new digit(*this);
+    }
+
+    std::string name() const override
+    {
+        return "digit";
+    }
+
+  private:
+
+    character_in_range scanner_;
+};
+
+class alpha final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  public:
+
+    explicit alpha(const spec&) noexcept
+      : lowercase_(char_type('a'), char_type('z')),
+        uppercase_(char_type('A'), char_type('Z'))
+    {}
+    ~alpha() override = default;
+
+    region scan(location& loc) const override
+    {
+        {
+            const auto reg = lowercase_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        {
+            const auto reg = uppercase_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        return region{};
+    }
+
+    std::string expected_chars(location&) const override
+    {
+        return "alpha [a-zA-Z]";
+    }
+
+    scanner_base* clone() const override
+    {
+        return new alpha(*this);
+    }
+
+    std::string name() const override
+    {
+        return "alpha";
+    }
+
+  private:
+
+    character_in_range lowercase_;
+    character_in_range uppercase_;
+};
+
+class hexdig final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  public:
+
+    explicit hexdig(const spec& s) noexcept
+      : digit_(s),
+        lowercase_(char_type('a'), char_type('f')),
+        uppercase_(char_type('A'), char_type('F'))
+    {}
+    ~hexdig() override = default;
+
+    region scan(location& loc) const override
+    {
+        {
+            const auto reg = digit_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        {
+            const auto reg = lowercase_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        {
+            const auto reg = uppercase_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        return region{};
+    }
+
+    std::string expected_chars(location&) const override
+    {
+        return "hex [0-9a-fA-F]";
+    }
+
+    scanner_base* clone() const override
+    {
+        return new hexdig(*this);
+    }
+
+    std::string name() const override
+    {
+        return "hexdig";
+    }
+
+  private:
+
+    digit              digit_;
+    character_in_range lowercase_;
+    character_in_range uppercase_;
+};
+
+sequence const& num_suffix(const spec& s);
+
+sequence const& dec_int(const spec& s);
+sequence const& hex_int(const spec& s);
+sequence const& oct_int(const spec&);
+sequence const& bin_int(const spec&);
+either   const& integer(const spec& s);
+
+// ===========================================================================
+// Floating
+
+sequence const& zero_prefixable_int(const spec& s);
+sequence const& fractional_part(const spec& s);
+sequence const& exponent_part(const spec& s);
+sequence const& hex_floating(const spec& s);
+either   const& floating(const spec& s);
+
+// ===========================================================================
+// Datetime
+
+sequence const& local_date(const spec& s);
+sequence const& local_time(const spec& s);
+either   const& time_offset(const spec& s);
+sequence const& full_time(const spec& s);
+character_either const& time_delim(const spec&);
+sequence const& local_datetime(const spec& s);
+sequence const& offset_datetime(const spec& s);
+
+// ===========================================================================
+// String
+
+sequence const& escaped_x2(const spec& s);
+sequence const& escaped_u4(const spec& s);
+sequence const& escaped_U8(const spec& s);
+
+sequence const& escaped     (const spec& s);
+either   const& basic_char  (const spec& s);
+sequence const& basic_string(const spec& s);
+
+// ---------------------------------------------------------------------------
+// multiline string
+
+sequence const& escaped_newline(const spec& s);
+sequence const& ml_basic_string(const spec& s);
+
+// ---------------------------------------------------------------------------
+// literal string
+
+either   const& literal_char(const spec& s);
+sequence const& literal_string(const spec& s);
+sequence const& ml_literal_string(const spec& s);
+either   const& string(const spec& s);
+
+// ===========================================================================
+// Keys
+
+// to keep `expected_chars` simple
+class non_ascii_key_char final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  private:
+
+    using in_range = character_in_range; // make definition short
+
+  public:
+
+    explicit non_ascii_key_char(const spec& s) noexcept;
+    ~non_ascii_key_char() override = default;
+
+    region scan(location& loc) const override;
+
+    std::string expected_chars(location&) const override
+    {
+        return "bare key non-ASCII script";
+    }
+
+    scanner_base* clone() const override
+    {
+        return new non_ascii_key_char(*this);
+    }
+
+    std::string name() const override
+    {
+        return "non-ASCII bare key";
+    }
+
+  private:
+
+    std::uint32_t read_utf8(location& loc) const;
+};
+
+
+repeat_at_least const& unquoted_key(const spec& s);
+either   const& quoted_key(const spec& s);
+either   const& simple_key(const spec& s);
+sequence const& dot_sep(const spec& s);
+sequence const& dotted_key(const spec& s);
+
+class key final : public scanner_base
+{
+  public:
+
+    using char_type = location::char_type;
+
+  public:
+
+    explicit key(const spec& s) noexcept
+        : dotted_(dotted_key(s)),
+          simple_(simple_key(s))
+    {}
+    ~key() override = default;
+
+    region scan(location& loc) const override
+    {
+        {
+            const auto reg = dotted_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        {
+            const auto reg = simple_.scan(loc);
+            if(reg.is_ok()) {return reg;}
+        }
+        return region{};
+    }
+
+    std::string expected_chars(location&) const override
+    {
+        return "basic key([a-zA-Z0-9_-]) or quoted key(\" or ')";
+    }
+
+    scanner_base* clone() const override
+    {
+        return new key(*this);
+    }
+
+    std::string name() const override
+    {
+        return "key";
+    }
+
+  private:
+
+    sequence dotted_;
+    either   simple_;
+};
+
+sequence const& keyval_sep(const spec& s);
+
+// ===========================================================================
+// Table key
+
+sequence const& std_table(const spec& s);
+
+sequence const& array_table(const spec& s);
+
+// ===========================================================================
+// extension: null
+
+literal const& null_value(const spec&);
+
+} // namespace syntax
+} // namespace detail
+} // namespace toml
+#endif // TOML11_SYNTAX_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_SYNTAX_IMPL_HPP
+#define TOML11_SYNTAX_IMPL_HPP
+
+
+namespace toml
+{
+namespace detail
+{
+namespace syntax
+{
+
+using char_type = location::char_type;
+
+template<typename F>
+struct syntax_cache
+{
+    using value_type = cxx::return_type_of_t<F, const spec&>;
+    static_assert(std::is_base_of<scanner_base, value_type>::value, "");
+
+    explicit syntax_cache(F f)
+        : func_(std::move(f)), cache_(cxx::make_nullopt())
+    {}
+
+    value_type const& at(const spec& s)
+    {
+        if( ! this->cache_.has_value() || this->cache_.value().first != s)
+        {
+            this->cache_ = std::make_pair(s, func_(s));
+        }
+        return this->cache_.value().second;
+    }
+
+  private:
+    F func_;
+    cxx::optional<std::pair<spec, value_type>> cache_;
+};
+
+template<typename F>
+syntax_cache<cxx::remove_cvref_t<F>> make_cache(F&& f)
+{
+    return syntax_cache<cxx::remove_cvref_t<F>>(std::forward<F>(f));
+}
+
+// ===========================================================================
+// UTF-8
+
+// avoid redundant representation and out-of-unicode sequence
+
+TOML11_INLINE character_in_range const& utf8_1byte(const spec&)
+{
+    static thread_local character_in_range cache(0x00, 0x7F);
+    return cache;
+}
+
+TOML11_INLINE sequence const& utf8_2bytes(const spec&)
+{
+    static thread_local sequence cache(
+            character_in_range(0xC2, 0xDF),
+            character_in_range(0x80, 0xBF));
+    return cache;
+}
+
+TOML11_INLINE sequence const& utf8_3bytes(const spec&)
+{
+    static thread_local sequence cache(/*1~2 bytes = */either(
+        sequence(character         (0xE0),       character_in_range(0xA0, 0xBF)),
+        sequence(character_in_range(0xE1, 0xEC), character_in_range(0x80, 0xBF)),
+        sequence(character         (0xED),       character_in_range(0x80, 0x9F)),
+        sequence(character_in_range(0xEE, 0xEF), character_in_range(0x80, 0xBF))
+    ), /*3rd byte = */ character_in_range(0x80, 0xBF));
+
+    return cache;
+}
+
+TOML11_INLINE sequence const& utf8_4bytes(const spec&)
+{
+    static thread_local sequence cache(/*1~2 bytes = */either(
+        sequence(character         (0xF0),       character_in_range(0x90, 0xBF)),
+        sequence(character_in_range(0xF1, 0xF3), character_in_range(0x80, 0xBF)),
+        sequence(character         (0xF4),       character_in_range(0x80, 0x8F))
+    ), character_in_range(0x80, 0xBF), character_in_range(0x80, 0xBF));
+
+    return cache;
+}
+
+// ===========================================================================
+// Whitespace
+
+TOML11_INLINE character_either const& wschar(const spec&)
+{
+    static thread_local character_either cache(" \t");
+    return cache;
+}
+
+TOML11_INLINE repeat_at_least const& ws(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s){
+        return repeat_at_least(0, wschar(s));
+    });
+    return cache.at(sp);
+}
+
+// ===========================================================================
+// Newline
+
+TOML11_INLINE either const& newline(const spec&)
+{
+    static thread_local either cache(character(char_type('\n')), literal("\r\n"));
+    return cache;
+}
+
+// ===========================================================================
+// Comments
+
+TOML11_INLINE either const& allowed_comment_char(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s){
+            if(s.v1_1_0_allow_control_characters_in_comments)
+            {
+                return either(
+                    character_in_range(0x01, 0x09),
+                    character_in_range(0x0E, 0x7F),
+                    non_ascii(s)
+                );
+            }
+            else
+            {
+                return either(
+                    character(0x09),
+                    character_in_range(0x20, 0x7E),
+                    non_ascii(s)
+                );
+            }
+        });
+    return cache.at(sp);
+}
+
+// XXX Note that it does not take newline
+TOML11_INLINE sequence const& comment(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s){
+        return sequence(character(char_type('#')),
+                    repeat_at_least(0, allowed_comment_char(s)));
+    });
+    return cache.at(sp);
+}
+
+// ===========================================================================
+// Boolean
+
+TOML11_INLINE either const& boolean(const spec&)
+{
+    static thread_local either cache(literal("true"), literal("false"));
+    return cache;
+}
+
+// ===========================================================================
+// Integer
+
+// non-digit-graph = ([a-zA-Z]|unicode mb char)
+// graph           = ([a-zA-Z0-9]|unicode mb char)
+// suffix          = _ non-digit-graph (graph | _graph)
+TOML11_INLINE sequence const& num_suffix(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        const auto non_digit_graph = [&s]() {
+            return either(
+                alpha(s),
+                non_ascii(s)
+            );
+        };
+        const auto graph = [&s]() {
+            return either(
+                alpha(s),
+                digit(s),
+                non_ascii(s)
+            );
+        };
+
+        return sequence(
+                character(char_type('_')),
+                non_digit_graph(),
+                repeat_at_least(0,
+                    either(
+                        sequence(character(char_type('_')), graph()),
+                        graph()
+                    )
+                )
+            );
+        });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& dec_int(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        const auto digit19 = []() {
+            return character_in_range(char_type('1'), char_type('9'));
+        };
+        return sequence(
+                maybe(character_either("+-")),
+                either(
+                    sequence(
+                        digit19(),
+                        repeat_at_least(1,
+                            either(
+                                digit(s),
+                                sequence(character(char_type('_')), digit(s))
+                            )
+                        )
+                    ),
+                    digit(s)
+                )
+            );
+        });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& hex_int(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(
+                literal("0x"),
+                hexdig(s),
+                repeat_at_least(0,
+                    either(
+                        hexdig(s),
+                        sequence(character(char_type('_')), hexdig(s))
+                    )
+                )
+            );
+        });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& oct_int(const spec& s)
+{
+    static thread_local auto cache = make_cache([](const spec&) {
+        const auto digit07 = []() {
+            return character_in_range(char_type('0'), char_type('7'));
+        };
+        return sequence(
+                literal("0o"),
+                digit07(),
+                repeat_at_least(0,
+                    either(
+                        digit07(),
+                        sequence(character(char_type('_')), digit07())
+                    )
+                )
+            );
+        });
+    return cache.at(s);
+}
+
+TOML11_INLINE sequence const& bin_int(const spec& s)
+{
+    static thread_local auto cache = make_cache([](const spec&) {
+        const auto digit01 = []() {
+            return character_either("01");
+        };
+        return sequence(
+                literal("0b"),
+                digit01(),
+                repeat_at_least(0,
+                    either(
+                        digit01(),
+                        sequence(character(char_type('_')), digit01())
+                    )
+                )
+            );
+        });
+    return cache.at(s);
+}
+
+TOML11_INLINE either const& integer(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return either(
+                hex_int(s),
+                oct_int(s),
+                bin_int(s),
+                dec_int(s)
+            );
+        });
+    return cache.at(sp);
+}
+
+
+// ===========================================================================
+// Floating
+
+TOML11_INLINE sequence const& zero_prefixable_int(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(
+                digit(s),
+                repeat_at_least(0,
+                    either(
+                        digit(s),
+                        sequence(character('_'), digit(s))
+                    )
+                )
+            );
+        });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& fractional_part(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(
+                character('.'),
+                zero_prefixable_int(s)
+            );
+        });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& exponent_part(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(
+                character_either("eE"),
+                maybe(character_either("+-")),
+                zero_prefixable_int(s)
+            );
+        });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& hex_floating(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        // C99 hexfloat (%a)
+        // [+-]? 0x ( [0-9a-fA-F]*\.[0-9a-fA-F]+ | [0-9a-fA-F]+\.? ) [pP] [+-]? [0-9]+
+
+        // - 0x(int).(frac)p[+-](int)
+        // - 0x(int).p[+-](int)
+        // - 0x.(frac)p[+-](int)
+        // - 0x(int)p[+-](int)
+
+        return sequence(
+                maybe(character_either("+-")),
+                character('0'),
+                character_either("xX"),
+                either(
+                    sequence(
+                        repeat_at_least(0, hexdig(s)),
+                        character('.'),
+                        repeat_at_least(1, hexdig(s))
+                    ),
+                    sequence(
+                        repeat_at_least(1, hexdig(s)),
+                        maybe(character('.'))
+                    )
+                ),
+                character_either("pP"),
+                maybe(character_either("+-")),
+                repeat_at_least(1, character_in_range('0', '9'))
+            );
+        });
+    return cache.at(sp);
+}
+
+TOML11_INLINE either const& floating(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return either(
+                sequence(
+                    dec_int(s),
+                    either(
+                        exponent_part(s),
+                        sequence(fractional_part(s), maybe(exponent_part(s)))
+                    )
+                ),
+                sequence(
+                    maybe(character_either("+-")),
+                    either(literal("inf"), literal("nan"))
+                )
+            );
+        });
+    return cache.at(sp);
+}
+
+// ===========================================================================
+// Datetime
+
+TOML11_INLINE sequence const& local_date(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(
+                repeat_exact(4, digit(s)),
+                character('-'),
+                repeat_exact(2, digit(s)),
+                character('-'),
+                repeat_exact(2, digit(s))
+            );
+        });
+    return cache.at(sp);
+}
+TOML11_INLINE sequence const& local_time(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        if(s.v1_1_0_make_seconds_optional)
+        {
+            return sequence(
+                repeat_exact(2, digit(s)),
+                character(':'),
+                repeat_exact(2, digit(s)),
+                maybe(sequence(
+                    character(':'),
+                    repeat_exact(2, digit(s)),
+                    maybe(sequence(character('.'), repeat_at_least(1, digit(s))))
+                )));
+        }
+        else
+        {
+            return sequence(
+                repeat_exact(2, digit(s)),
+                character(':'),
+                repeat_exact(2, digit(s)),
+                character(':'),
+                repeat_exact(2, digit(s)),
+                maybe(sequence(character('.'), repeat_at_least(1, digit(s))))
+            );
+        }
+        });
+    return cache.at(sp);
+}
+TOML11_INLINE either const& time_offset(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return either(
+                character_either("zZ"),
+                sequence(character_either("+-"),
+                         repeat_exact(2, digit(s)),
+                         character(':'),
+                         repeat_exact(2, digit(s))
+                 )
+            );
+        });
+    return cache.at(sp);
+}
+TOML11_INLINE sequence const& full_time(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+            return sequence(local_time(s), time_offset(s));
+        });
+    return cache.at(sp);
+}
+TOML11_INLINE character_either const& time_delim(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec&) {
+            return character_either("Tt ");
+        });
+    return cache.at(sp);
+}
+TOML11_INLINE sequence const& local_datetime(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+            return sequence(local_date(s), time_delim(s), local_time(s));
+        });
+    return cache.at(sp);
+}
+TOML11_INLINE sequence const& offset_datetime(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+            return sequence(local_date(s), time_delim(s), full_time(s));
+        });
+    return cache.at(sp);
+}
+
+// ===========================================================================
+// String
+
+TOML11_INLINE sequence const& escaped_x2(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+            return sequence(character('x'), repeat_exact(2, hexdig(s)));
+        });
+    return cache.at(sp);
+}
+TOML11_INLINE sequence const& escaped_u4(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+            return sequence(character('u'), repeat_exact(4, hexdig(s)));
+        });
+    return cache.at(sp);
+}
+TOML11_INLINE sequence const& escaped_U8(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+            return sequence(character('U'), repeat_exact(8, hexdig(s)));
+        });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& escaped(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        const auto escape_char = [&s] {
+            if(s.v1_1_0_add_escape_sequence_e)
+            {
+                return character_either("\"\\bfnrte");
+            }
+            else
+            {
+                return character_either("\"\\bfnrt");
+            }
+        };
+
+        const auto escape_seq = [&s, &escape_char] {
+            if(s.v1_1_0_add_escape_sequence_x)
+            {
+                return either(
+                    escape_char(),
+                    escaped_u4(s),
+                    escaped_U8(s),
+                    escaped_x2(s)
+                );
+            }
+            else
+            {
+                return either(
+                    escape_char(),
+                    escaped_u4(s),
+                    escaped_U8(s)
+                );
+            }
+        };
+
+        return sequence(character('\\'), escape_seq());
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE either const& basic_char(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        const auto basic_unescaped = [&s]() {
+            return either(
+                    wschar(s),
+                    character(0x21),                // 22 is "
+                    character_in_range(0x23, 0x5B), // 5C is backslash
+                    character_in_range(0x5D, 0x7E), // 7F is DEL
+                    non_ascii(s)
+                );
+        };
+        return either(basic_unescaped(), escaped(s));
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& basic_string(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(
+                character('"'),
+                repeat_at_least(0, basic_char(s)),
+                character('"')
+            );
+    });
+    return cache.at(sp);
+}
+
+// ---------------------------------------------------------------------------
+// multiline string
+
+TOML11_INLINE sequence const& escaped_newline(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(
+                character('\\'), ws(s), newline(s),
+                repeat_at_least(0, either(wschar(s), newline(s)))
+            );
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& ml_basic_string(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        const auto mlb_content = [&s]() {
+            return either(basic_char(s), newline(s), escaped_newline(s));
+        };
+        const auto mlb_quotes = []() {
+            return either(literal("\"\""), character('\"'));
+        };
+
+        return sequence(
+                literal("\"\"\""),
+                maybe(newline(s)),
+                repeat_at_least(0, mlb_content()),
+                repeat_at_least(0,
+                    sequence(
+                        mlb_quotes(),
+                        repeat_at_least(1, mlb_content())
+                    )
+                ),
+                // XXX """ and mlb_quotes are intentionally reordered to avoid
+                //     unexpected match of mlb_quotes
+                literal("\"\"\""),
+                maybe(mlb_quotes())
+            );
+    });
+    return cache.at(sp);
+}
+
+// ---------------------------------------------------------------------------
+// literal string
+
+TOML11_INLINE either const& literal_char(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return either(
+                character         (0x09),
+                character_in_range(0x20, 0x26),
+                character_in_range(0x28, 0x7E),
+                non_ascii(s)
+            );
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& literal_string(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(
+                character('\''),
+                repeat_at_least(0, literal_char(s)),
+                character('\'')
+            );
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& ml_literal_string(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        const auto mll_quotes = []() {
+            return either(literal("''"), character('\''));
+        };
+        const auto mll_content = [&s]() {
+            return either(literal_char(s), newline(s));
+        };
+
+        return sequence(
+                literal("'''"),
+                maybe(newline(s)),
+                repeat_at_least(0, mll_content()),
+                repeat_at_least(0, sequence(
+                        mll_quotes(),
+                        repeat_at_least(1, mll_content())
+                    )
+                ),
+                literal("'''"),
+                maybe(mll_quotes())
+                // XXX ''' and mll_quotes are intentionally reordered to avoid
+                //     unexpected match of mll_quotes
+            );
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE either const& string(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return either(
+                ml_basic_string(s),
+                ml_literal_string(s),
+                basic_string(s),
+                literal_string(s)
+            );
+    });
+    return cache.at(sp);
+}
+
+// ===========================================================================
+// Keys
+
+// to keep `expected_chars` simple
+TOML11_INLINE non_ascii_key_char::non_ascii_key_char(const spec& s) noexcept
+{
+    assert(s.v1_1_0_allow_non_english_in_bare_keys);
+    (void)s; // for NDEBUG
+}
+
+TOML11_INLINE std::uint32_t non_ascii_key_char::read_utf8(location& loc) const
+{
+    // U+0000   ... U+0079  ; 0xxx_xxxx
+    // U+0080   ... U+07FF  ; 110y_yyyx 10xx_xxxx;
+    // U+0800   ... U+FFFF  ; 1110_yyyy 10yx_xxxx 10xx_xxxx
+    // U+010000 ... U+10FFFF; 1111_0yyy 10yy_xxxx 10xx_xxxx 10xx_xxxx
+
+    const unsigned char b1 = loc.current(); loc.advance(1);
+    if(b1 < 0x80)
+    {
+        return static_cast<std::uint32_t>(b1);
+    }
+    else if((b1 >> 5) == 6) // 0b110 == 6
+    {
+        const auto b2 = loc.current(); loc.advance(1);
+
+        const std::uint32_t c1 = b1 & ((1 << 5) - 1);
+        const std::uint32_t c2 = b2 & ((1 << 6) - 1);
+        const std::uint32_t codep = (c1 << 6) + c2;
+
+        if(codep < 0x80)
+        {
+            return 0xFFFFFFFF;
+        }
+        return codep;
+    }
+    else if((b1 >> 4) == 14) // 0b1110 == 14
+    {
+        const auto b2 = loc.current(); loc.advance(1); if(loc.eof()) {return 0xFFFFFFFF;}
+        const auto b3 = loc.current(); loc.advance(1);
+
+        const std::uint32_t c1 = b1 & ((1 << 4) - 1);
+        const std::uint32_t c2 = b2 & ((1 << 6) - 1);
+        const std::uint32_t c3 = b3 & ((1 << 6) - 1);
+
+        const std::uint32_t codep = (c1 << 12) + (c2 << 6) + c3;
+        if(codep < 0x800)
+        {
+            return 0xFFFFFFFF;
+        }
+        return codep;
+    }
+    else if((b1 >> 3) == 30) // 0b11110 == 30
+    {
+        const auto b2 = loc.current(); loc.advance(1); if(loc.eof()) {return 0xFFFFFFFF;}
+        const auto b3 = loc.current(); loc.advance(1); if(loc.eof()) {return 0xFFFFFFFF;}
+        const auto b4 = loc.current(); loc.advance(1);
+
+        const std::uint32_t c1 = b1 & ((1 << 3) - 1);
+        const std::uint32_t c2 = b2 & ((1 << 6) - 1);
+        const std::uint32_t c3 = b3 & ((1 << 6) - 1);
+        const std::uint32_t c4 = b4 & ((1 << 6) - 1);
+        const std::uint32_t codep = (c1 << 18) + (c2 << 12) + (c3 << 6) + c4;
+
+        if(codep < 0x10000)
+        {
+            return 0xFFFFFFFF;
+        }
+        return codep;
+    }
+    else // not a Unicode codepoint in UTF-8
+    {
+        return 0xFFFFFFFF;
+    }
+}
+
+TOML11_INLINE region non_ascii_key_char::scan(location& loc) const
+{
+    if(loc.eof()) {return region{};}
+
+    const auto first = loc;
+
+    const auto cp = read_utf8(loc);
+
+    if(cp == 0xFFFFFFFF)
+    {
+        return region{};
+    }
+
+    // ALPHA / DIGIT / %x2D / %x5F    ; a-z A-Z 0-9 - _
+    // / %xB2 / %xB3 / %xB9 / %xBC-BE ; superscript digits, fractions
+    // / %xC0-D6 / %xD8-F6 / %xF8-37D ; non-symbol chars in Latin block
+    // / %x37F-1FFF                   ; exclude GREEK QUESTION MARK, which is basically a semi-colon
+    // / %x200C-200D / %x203F-2040    ; from General Punctuation Block, include the two tie symbols and ZWNJ, ZWJ
+    // / %x2070-218F / %x2460-24FF    ; include super-/subscripts, letterlike/numberlike forms, enclosed alphanumerics
+    // / %x2C00-2FEF / %x3001-D7FF    ; skip arrows, math, box drawing etc, skip 2FF0-3000 ideographic up/down markers and spaces
+    // / %xF900-FDCF / %xFDF0-FFFD    ; skip D800-DFFF surrogate block, E000-F8FF Private Use area, FDD0-FDEF intended for process-internal use (unicode)
+    // / %x10000-EFFFF                ; all chars outside BMP range, excluding Private Use planes (F0000-10FFFF)
+
+    if(cp == 0xB2 || cp == 0xB3 || cp == 0xB9 || (0xBC <= cp && cp <= 0xBE) ||
+       (0xC0    <= cp && cp <= 0xD6  ) || (0xD8 <= cp && cp <= 0xF6) || (0xF8 <= cp && cp <= 0x37D) ||
+       (0x37F   <= cp && cp <= 0x1FFF) ||
+       (0x200C  <= cp && cp <= 0x200D) || (0x203F <= cp && cp <= 0x2040) ||
+       (0x2070  <= cp && cp <= 0x218F) || (0x2460 <= cp && cp <= 0x24FF) ||
+       (0x2C00  <= cp && cp <= 0x2FEF) || (0x3001 <= cp && cp <= 0xD7FF) ||
+       (0xF900  <= cp && cp <= 0xFDCF) || (0xFDF0 <= cp && cp <= 0xFFFD) ||
+       (0x10000 <= cp && cp <= 0xEFFFF) )
+    {
+        return region(first, loc);
+    }
+    loc = first;
+    return region{};
+}
+
+TOML11_INLINE repeat_at_least const& unquoted_key(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        const auto keychar = [&s] {
+            if(s.v1_1_0_allow_non_english_in_bare_keys)
+            {
+                return either(alpha(s), digit(s), character{0x2D}, character{0x5F},
+                              non_ascii_key_char(s));
+            }
+            else
+            {
+                return either(alpha(s), digit(s), character{0x2D}, character{0x5F});
+            }
+        };
+        return repeat_at_least(1, keychar());
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE either const& quoted_key(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+    return either(basic_string(s), literal_string(s));
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE either const& simple_key(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return either(unquoted_key(s), quoted_key(s));
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& dot_sep(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(ws(s), character('.'), ws(s));
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& dotted_key(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(
+            simple_key(s),
+            repeat_at_least(1, sequence(dot_sep(s), simple_key(s)))
+        );
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& keyval_sep(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(ws(s), character('='), ws(s));
+    });
+    return cache.at(sp);
+}
+
+// ===========================================================================
+// Table key
+
+TOML11_INLINE sequence const& std_table(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(character('['), ws(s), key(s), ws(s), character(']'));
+    });
+    return cache.at(sp);
+}
+
+TOML11_INLINE sequence const& array_table(const spec& sp)
+{
+    static thread_local auto cache = make_cache([](const spec& s) {
+        return sequence(literal("[["), ws(s), key(s), ws(s), literal("]]"));
+    });
+    return cache.at(sp);
+}
+
+// ===========================================================================
+// extension: null
+
+TOML11_INLINE literal const& null_value(const spec&)
+{
+    static thread_local literal cache("null");
+    return cache;
+}
+
+} // namespace syntax
+} // namespace detail
+} // namespace toml
+#endif // TOML11_SYNTAX_IMPL_HPP
+#endif
+
+#endif// TOML11_SYNTAX_HPP
+#ifndef TOML11_SKIP_HPP
+#define TOML11_SKIP_HPP
+
+
+#include <cassert>
+
+namespace toml
+{
+namespace detail
+{
+
+template<typename TC>
+bool skip_whitespace(location& loc, const context<TC>& ctx)
+{
+    return syntax::ws(ctx.toml_spec()).scan(loc).is_ok();
+}
+
+template<typename TC>
+bool skip_empty_lines(location& loc, const context<TC>& ctx)
+{
+    return repeat_at_least(1, sequence(
+            syntax::ws(ctx.toml_spec()),
+            syntax::newline(ctx.toml_spec())
+        )).scan(loc).is_ok();
+}
+
+// For error recovery.
+//
+// In case if a comment line contains an invalid character, we need to skip it
+// to advance parsing.
+template<typename TC>
+void skip_comment_block(location& loc, const context<TC>& ctx)
+{
+    while( ! loc.eof())
+    {
+        skip_whitespace(loc, ctx);
+        if(loc.current() == '#')
+        {
+            while( ! loc.eof())
+            {
+                // both CRLF and LF ends with LF.
+                if(loc.current() == '\n')
+                {
+                    loc.advance();
+                    break;
+                }
+            }
+        }
+        else if(syntax::newline(ctx.toml_spec()).scan(loc).is_ok())
+        {
+            ; // an empty line. skip this also
+        }
+        else
+        {
+            // the next token is neither a comment nor empty line.
+            return ;
+        }
+    }
+    return ;
+}
+
+template<typename TC>
+void skip_empty_or_comment_lines(location& loc, const context<TC>& ctx)
+{
+    const auto& spec = ctx.toml_spec();
+    repeat_at_least(0, sequence(
+            syntax::ws(spec),
+            maybe(syntax::comment(spec)),
+            syntax::newline(spec))
+        ).scan(loc);
+    return ;
+}
+
+// For error recovery.
+//
+// Sometimes we need to skip a value and find a delimiter, like `,`, `]`, or `}`.
+// To find delimiter, we need to skip delimiters in a string.
+// Since we are skipping invalid value while error recovery, we don't need
+// to check the syntax. Here we just skip string-like region until closing quote
+// is found.
+template<typename TC>
+void skip_string_like(location& loc, const context<TC>&)
+{
+    // if """ is found, skip until the closing """ is found.
+    if(literal("\"\"\"").scan(loc).is_ok())
+    {
+        while( ! loc.eof())
+        {
+            if(literal("\"\"\"").scan(loc).is_ok())
+            {
+                return;
+            }
+            loc.advance();
+        }
+    }
+    else if(literal("'''").scan(loc).is_ok())
+    {
+        while( ! loc.eof())
+        {
+            if(literal("'''").scan(loc).is_ok())
+            {
+                return;
+            }
+            loc.advance();
+        }
+    }
+    // if " is found, skip until the closing " or newline is found.
+    else if(loc.current() == '"')
+    {
+        while( ! loc.eof())
+        {
+            loc.advance();
+            if(loc.current() == '"' || loc.current() == '\n')
+            {
+                loc.advance();
+                return;
+            }
+        }
+    }
+    else if(loc.current() == '\'')
+    {
+        while( ! loc.eof())
+        {
+            loc.advance();
+            if(loc.current() == '\'' || loc.current() == '\n')
+            {
+                loc.advance();
+                return ;
+            }
+        }
+    }
+    return;
+}
+
+template<typename TC>
+void skip_value(location& loc, const context<TC>& ctx);
+template<typename TC>
+void skip_array_like(location& loc, const context<TC>& ctx);
+template<typename TC>
+void skip_inline_table_like(location& loc, const context<TC>& ctx);
+template<typename TC>
+void skip_key_value_pair(location& loc, const context<TC>& ctx);
+
+template<typename TC>
+result<value_t, error_info>
+guess_value_type(const location& loc, const context<TC>& ctx);
+
+template<typename TC>
+void skip_array_like(location& loc, const context<TC>& ctx)
+{
+    const auto& spec = ctx.toml_spec();
+    assert(loc.current() == '[');
+    loc.advance();
+
+    while( ! loc.eof())
+    {
+        if(loc.current() == '\"' || loc.current() == '\'')
+        {
+            skip_string_like(loc, ctx);
+        }
+        else if(loc.current() == '#')
+        {
+            skip_comment_block(loc, ctx);
+        }
+        else if(loc.current() == '{')
+        {
+            skip_inline_table_like(loc, ctx);
+        }
+        else if(loc.current() == '[')
+        {
+            const auto checkpoint = loc;
+            if(syntax::std_table(spec).scan(loc).is_ok() ||
+               syntax::array_table(spec).scan(loc).is_ok())
+            {
+                loc = checkpoint;
+                break;
+            }
+            // if it is not a table-definition, then it is an array.
+            skip_array_like(loc, ctx);
+        }
+        else if(loc.current() == '=')
+        {
+            // key-value pair cannot be inside the array.
+            // guessing the error is "missing closing bracket `]`".
+            // find the previous key just before `=`.
+            while(loc.get_location() != 0)
+            {
+                loc.retrace();
+                if(loc.current() == '\n')
+                {
+                    loc.advance();
+                    break;
+                }
+            }
+            break;
+        }
+        else if(loc.current() == ']')
+        {
+            break; // found closing bracket
+        }
+        else
+        {
+            loc.advance();
+        }
+    }
+    return ;
+}
+
+template<typename TC>
+void skip_inline_table_like(location& loc, const context<TC>& ctx)
+{
+    assert(loc.current() == '{');
+    loc.advance();
+
+    const auto& spec = ctx.toml_spec();
+
+    while( ! loc.eof())
+    {
+        if(loc.current() == '\n' && ! spec.v1_1_0_allow_newlines_in_inline_tables)
+        {
+            break; // missing closing `}`.
+        }
+        else if(loc.current() == '\"' || loc.current() == '\'')
+        {
+            skip_string_like(loc, ctx);
+        }
+        else if(loc.current() == '#')
+        {
+            skip_comment_block(loc, ctx);
+            if( ! spec.v1_1_0_allow_newlines_in_inline_tables)
+            {
+                // comment must end with newline.
+                break; // missing closing `}`.
+            }
+        }
+        else if(loc.current() == '[')
+        {
+            const auto checkpoint = loc;
+            if(syntax::std_table(spec).scan(loc).is_ok() ||
+               syntax::array_table(spec).scan(loc).is_ok())
+            {
+                loc = checkpoint;
+                break; // missing closing `}`.
+            }
+            // if it is not a table-definition, then it is an array.
+            skip_array_like(loc, ctx);
+        }
+        else if(loc.current() == '{')
+        {
+            skip_inline_table_like(loc, ctx);
+        }
+        else if(loc.current() == '}')
+        {
+            // closing brace found. guessing the error is inside the table.
+            break;
+        }
+        else
+        {
+            // skip otherwise.
+            loc.advance();
+        }
+    }
+    return ;
+}
+
+template<typename TC>
+void skip_value(location& loc, const context<TC>& ctx)
+{
+    value_t ty = guess_value_type(loc, ctx).unwrap_or(value_t::empty);
+    if(ty == value_t::string)
+    {
+        skip_string_like(loc, ctx);
+    }
+    else if(ty == value_t::array)
+    {
+        skip_array_like(loc, ctx);
+    }
+    else if(ty == value_t::table)
+    {
+        // In case of multiline tables, it may skip key-value pair but not the
+        // whole table.
+        skip_inline_table_like(loc, ctx);
+    }
+    else // others are an "in-line" values. skip until the next line
+    {
+        while( ! loc.eof())
+        {
+            if(loc.current() == '\n')
+            {
+                break;
+            }
+            else if(loc.current() == ',' || loc.current() == ']' || loc.current() == '}')
+            {
+                break;
+            }
+            loc.advance();
+        }
+    }
+    return;
+}
+
+template<typename TC>
+void skip_key_value_pair(location& loc, const context<TC>& ctx)
+{
+    while( ! loc.eof())
+    {
+        if(loc.current() == '=')
+        {
+            skip_whitespace(loc, ctx);
+            skip_value(loc, ctx);
+            return;
+        }
+        else if(loc.current() == '\n')
+        {
+            // newline is found before finding `=`. assuming "missing `=`".
+            return;
+        }
+        loc.advance();
+    }
+    return ;
+}
+
+template<typename TC>
+void skip_until_next_table(location& loc, const context<TC>& ctx)
+{
+    const auto& spec = ctx.toml_spec();
+    while( ! loc.eof())
+    {
+        if(loc.current() == '\n')
+        {
+            loc.advance();
+            const auto line_begin = loc;
+
+            skip_whitespace(loc, ctx);
+            if(syntax::std_table(spec).scan(loc).is_ok())
+            {
+                loc = line_begin;
+                return ;
+            }
+            if(syntax::array_table(spec).scan(loc).is_ok())
+            {
+                loc = line_begin;
+                return ;
+            }
+        }
+        loc.advance();
+    }
+}
+
+} // namespace detail
+} // namespace toml
+
+#if defined(TOML11_COMPILE_SOURCES)
+namespace toml
+{
+struct type_config;
+struct ordered_type_config;
+
+namespace detail
+{
+extern template bool skip_whitespace            <type_config>(location& loc, const context<type_config>&);
+extern template bool skip_empty_lines           <type_config>(location& loc, const context<type_config>&);
+extern template void skip_comment_block         <type_config>(location& loc, const context<type_config>&);
+extern template void skip_empty_or_comment_lines<type_config>(location& loc, const context<type_config>&);
+extern template void skip_string_like           <type_config>(location& loc, const context<type_config>&);
+extern template void skip_array_like            <type_config>(location& loc, const context<type_config>&);
+extern template void skip_inline_table_like     <type_config>(location& loc, const context<type_config>&);
+extern template void skip_value                 <type_config>(location& loc, const context<type_config>&);
+extern template void skip_key_value_pair        <type_config>(location& loc, const context<type_config>&);
+extern template void skip_until_next_table      <type_config>(location& loc, const context<type_config>&);
+
+extern template bool skip_whitespace            <ordered_type_config>(location& loc, const context<ordered_type_config>&);
+extern template bool skip_empty_lines           <ordered_type_config>(location& loc, const context<ordered_type_config>&);
+extern template void skip_comment_block         <ordered_type_config>(location& loc, const context<ordered_type_config>&);
+extern template void skip_empty_or_comment_lines<ordered_type_config>(location& loc, const context<ordered_type_config>&);
+extern template void skip_string_like           <ordered_type_config>(location& loc, const context<ordered_type_config>&);
+extern template void skip_array_like            <ordered_type_config>(location& loc, const context<ordered_type_config>&);
+extern template void skip_inline_table_like     <ordered_type_config>(location& loc, const context<ordered_type_config>&);
+extern template void skip_value                 <ordered_type_config>(location& loc, const context<ordered_type_config>&);
+extern template void skip_key_value_pair        <ordered_type_config>(location& loc, const context<ordered_type_config>&);
+extern template void skip_until_next_table      <ordered_type_config>(location& loc, const context<ordered_type_config>&);
+
+} // detail
+} // toml
+#endif // TOML11_COMPILE_SOURCES
+
+#endif // TOML11_SKIP_HPP
+#ifndef TOML11_PARSER_HPP
+#define TOML11_PARSER_HPP
+
+
+#include <fstream>
+#include <sstream>
+
+#include <cassert>
+#include <cmath>
+
+#if defined(TOML11_HAS_FILESYSTEM) && TOML11_HAS_FILESYSTEM
+#include <filesystem>
+#endif
+
+namespace toml
+{
+
+struct syntax_error final : public ::toml::exception
+{
+  public:
+    syntax_error(std::string what_arg, std::vector<error_info> err)
+        : what_(std::move(what_arg)), err_(std::move(err))
+    {}
+    ~syntax_error() noexcept override = default;
+
+    const char* what() const noexcept override {return what_.c_str();}
+
+    std::vector<error_info> const& errors() const noexcept
+    {
+        return err_;
+    }
+
+  private:
+    std::string what_;
+    std::vector<error_info> err_;
+};
+
+struct file_io_error final : public ::toml::exception
+{
+  public:
+
+    file_io_error(const std::string& msg, const std::string& fname)
+        : errno_(cxx::make_nullopt()),
+          what_(msg + " \"" + fname + "\"")
+    {}
+    file_io_error(int errnum, const std::string& msg, const std::string& fname)
+        : errno_(errnum),
+          what_(msg + " \"" + fname + "\": errno=" + std::to_string(errnum))
+    {}
+    ~file_io_error() noexcept override = default;
+
+    const char* what() const noexcept override {return what_.c_str();}
+
+    bool has_errno() const noexcept {return errno_.has_value();}
+    int  get_errno() const noexcept {return errno_.value_or(0);}
+
+  private:
+
+    cxx::optional<int> errno_;
+    std::string what_;
+};
+
+namespace detail
+{
+
+/* ============================================================================
+ *    __ ___ _ __  _ __  ___ _ _
+ *   / _/ _ \ '  \| '  \/ _ \ ' \
+ *   \__\___/_|_|_|_|_|_\___/_||_|
+ */
+
+template<typename S>
+error_info make_syntax_error(std::string title,
+        const S& scanner, location loc, std::string suffix = "")
+{
+    auto msg = std::string("expected ") + scanner.expected_chars(loc);
+    auto src = source_location(region(loc));
+    return make_error_info(
+        std::move(title), std::move(src), std::move(msg), std::move(suffix));
+}
+
+
+/* ============================================================================
+ *                             _
+ *  __ ___ _ __  _ __  ___ _ _| |_
+ * / _/ _ \ '  \| '  \/ -_) ' \  _|
+ * \__\___/_|_|_|_|_|_\___|_||_\__|
+ */
+
+template<typename TC>
+result<cxx::optional<std::string>, error_info>
+parse_comment_line(location& loc, context<TC>& ctx)
+{
+    const auto& spec = ctx.toml_spec();
+    const auto first = loc;
+
+    skip_whitespace(loc, ctx);
+
+    const auto com_reg = syntax::comment(spec).scan(loc);
+    if(com_reg.is_ok())
+    {
+        // once comment started, newline must follow (or reach EOF).
+        if( ! loc.eof() && ! syntax::newline(spec).scan(loc).is_ok())
+        {
+            while( ! loc.eof()) // skip until newline to continue parsing
+            {
+                loc.advance();
+                if(loc.current() == '\n') { /*skip LF*/ loc.advance(); break; }
+            }
+            return err(make_error_info("toml::parse_comment_line: "
+                "newline (LF / CRLF) or EOF is expected",
+                source_location(region(loc)), "but got this",
+                "Hint: most of the control characters are not allowed in comments"));
+        }
+        return ok(cxx::optional<std::string>(com_reg.as_string()));
+    }
+    else
+    {
+        loc = first; // rollback whitespace to parse indent
+        return ok(cxx::optional<std::string>(cxx::make_nullopt()));
+    }
+}
+
+/* ============================================================================
+ *  ___           _
+ * | _ ) ___  ___| |___ __ _ _ _
+ * | _ \/ _ \/ _ \ / -_) _` | ' \
+ * |___/\___/\___/_\___\__,_|_||_|
+ */
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_boolean(location& loc, const context<TC>& ctx)
+{
+    const auto& spec = ctx.toml_spec();
+
+    // ----------------------------------------------------------------------
+    // check syntax
+    auto reg = syntax::boolean(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_boolean: "
+            "invalid boolean: boolean must be `true` or `false`, in lowercase. "
+            "string must be surrounded by `\"`", syntax::boolean(spec), loc));
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+    const auto str = reg.as_string();
+    const auto val = [&str]() {
+        if(str == "true")
+        {
+            return true;
+        }
+        else
+        {
+            assert(str == "false");
+            return false;
+        }
+    }();
+
+    // ----------------------------------------------------------------------
+    // no format info for boolean
+    boolean_format_info fmt;
+
+    return ok(basic_value<TC>(val, std::move(fmt), {}, std::move(reg)));
+}
+
+/* ============================================================================
+ *  ___     _
+ * |_ _|_ _| |_ ___ __ _ ___ _ _
+ *  | || ' \  _/ -_) _` / -_) '_|
+ * |___|_||_\__\___\__, \___|_|
+ *                 |___/
+ */
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_bin_integer(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+    auto reg = syntax::bin_int(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_bin_integer: "
+            "invalid integer: bin_int must be like: 0b0101, 0b1111_0000",
+            syntax::bin_int(spec), loc));
+    }
+
+    auto str = reg.as_string();
+
+    integer_format_info fmt;
+    fmt.fmt   = integer_format::bin;
+    fmt.width = str.size() - 2 - static_cast<std::size_t>(std::count(str.begin(), str.end(), '_'));
+
+    const auto first_underscore = std::find(str.rbegin(), str.rend(), '_');
+    if(first_underscore != str.rend())
+    {
+        fmt.spacer = static_cast<std::size_t>(std::distance(str.rbegin(), first_underscore));
+    }
+
+    // skip prefix `0b` and zeros and underscores at the MSB
+    str.erase(str.begin(), std::find(std::next(str.begin(), 2), str.end(), '1'));
+
+    // remove all `_` before calling TC::parse_int
+    str.erase(std::remove(str.begin(), str.end(), '_'), str.end());
+
+    // 0b0000_0000 becomes empty.
+    if(str.empty()) { str = "0"; }
+
+    const auto val = TC::parse_int(str, source_location(region(loc)), 2);
+    if(val.is_ok())
+    {
+        return ok(basic_value<TC>(val.as_ok(), std::move(fmt), {}, std::move(reg)));
+    }
+    else
+    {
+        loc = first;
+        return err(val.as_err());
+    }
+}
+
+// ----------------------------------------------------------------------------
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_oct_integer(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+    auto reg = syntax::oct_int(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_oct_integer: "
+            "invalid integer: oct_int must be like: 0o775, 0o04_44",
+            syntax::oct_int(spec), loc));
+    }
+
+    auto str = reg.as_string();
+
+    integer_format_info fmt;
+    fmt.fmt   = integer_format::oct;
+    fmt.width = str.size() - 2 - static_cast<std::size_t>(std::count(str.begin(), str.end(), '_'));
+
+    const auto first_underscore = std::find(str.rbegin(), str.rend(), '_');
+    if(first_underscore != str.rend())
+    {
+        fmt.spacer = static_cast<std::size_t>(std::distance(str.rbegin(), first_underscore));
+    }
+
+    // skip prefix `0o` and zeros and underscores at the MSB
+    str.erase(str.begin(), std::find_if(
+                std::next(str.begin(), 2), str.end(), [](const char c) {
+                    return c != '0' && c != '_';
+                }));
+
+    // remove all `_` before calling TC::parse_int
+    str.erase(std::remove(str.begin(), str.end(), '_'), str.end());
+
+    // 0o0000_0000 becomes empty.
+    if(str.empty()) { str = "0"; }
+
+    const auto val = TC::parse_int(str, source_location(region(loc)), 8);
+    if(val.is_ok())
+    {
+        return ok(basic_value<TC>(val.as_ok(), std::move(fmt), {}, std::move(reg)));
+    }
+    else
+    {
+        loc = first;
+        return err(val.as_err());
+    }
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_hex_integer(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+    auto reg = syntax::hex_int(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_hex_integer: "
+            "invalid integer: hex_int must be like: 0xC0FFEE, 0xdead_beef",
+            syntax::hex_int(spec), loc));
+    }
+
+    auto str = reg.as_string();
+
+    integer_format_info fmt;
+    fmt.fmt   = integer_format::hex;
+    fmt.width = str.size() - 2 - static_cast<std::size_t>(std::count(str.begin(), str.end(), '_'));
+
+    const auto first_underscore = std::find(str.rbegin(), str.rend(), '_');
+    if(first_underscore != str.rend())
+    {
+        fmt.spacer = static_cast<std::size_t>(std::distance(str.rbegin(), first_underscore));
+    }
+
+    // skip prefix `0x` and zeros and underscores at the MSB
+    str.erase(str.begin(), std::find_if(
+                std::next(str.begin(), 2), str.end(), [](const char c) {
+                    return c != '0' && c != '_';
+                }));
+
+    // remove all `_` before calling TC::parse_int
+    str.erase(std::remove(str.begin(), str.end(), '_'), str.end());
+
+    // 0x0000_0000 becomes empty.
+    if(str.empty()) { str = "0"; }
+
+    // prefix zero and _ is removed. check if it uses upper/lower case.
+    // if both upper and lower case letters are found, set upper=true.
+    const auto lower_not_found = std::find_if(str.begin(), str.end(),
+        [](const char c) { return std::islower(static_cast<int>(c)) != 0; }) == str.end();
+    const auto upper_found = std::find_if(str.begin(), str.end(),
+        [](const char c) { return std::isupper(static_cast<int>(c)) != 0; }) != str.end();
+    fmt.uppercase = lower_not_found || upper_found;
+
+    const auto val = TC::parse_int(str, source_location(region(loc)), 16);
+    if(val.is_ok())
+    {
+        return ok(basic_value<TC>(val.as_ok(), std::move(fmt), {}, std::move(reg)));
+    }
+    else
+    {
+        loc = first;
+        return err(val.as_err());
+    }
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_dec_integer(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    // ----------------------------------------------------------------------
+    // check syntax
+    auto reg = syntax::dec_int(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_dec_integer: "
+            "invalid integer: dec_int must be like: 42, 123_456_789",
+            syntax::dec_int(spec), loc));
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+    auto str = reg.as_string();
+
+    integer_format_info fmt;
+    fmt.fmt = integer_format::dec;
+    fmt.width = str.size() - static_cast<std::size_t>(std::count(str.begin(), str.end(), '_'));
+
+    const auto first_underscore = std::find(str.rbegin(), str.rend(), '_');
+    if(first_underscore != str.rend())
+    {
+        fmt.spacer = static_cast<std::size_t>(std::distance(str.rbegin(), first_underscore));
+    }
+
+    // remove all `_` before calling TC::parse_int
+    str.erase(std::remove(str.begin(), str.end(), '_'), str.end());
+
+    auto src = source_location(region(loc));
+    const auto val = TC::parse_int(str, src, 10);
+    if(val.is_err())
+    {
+        loc = first;
+        return err(val.as_err());
+    }
+
+    // ----------------------------------------------------------------------
+    // parse suffix (extension)
+
+    if(spec.ext_num_suffix && loc.current() == '_')
+    {
+        const auto sfx_reg = syntax::num_suffix(spec).scan(loc);
+        if( ! sfx_reg.is_ok())
+        {
+            loc = first;
+            return err(make_error_info("toml::parse_dec_integer: "
+                "invalid suffix: should be `_ non-digit-graph (graph | _graph)`",
+                source_location(region(loc)), "here"));
+        }
+        auto sfx = sfx_reg.as_string();
+        assert( ! sfx.empty() && sfx.front() == '_');
+        sfx.erase(sfx.begin()); // remove the first `_`
+
+        fmt.suffix = sfx;
+    }
+
+    return ok(basic_value<TC>(val.as_ok(), std::move(fmt), {}, std::move(reg)));
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_integer(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+
+    if( ! loc.eof() && (loc.current() == '+' || loc.current() == '-'))
+    {
+        // skip +/- to diagnose +0xDEADBEEF or -0b0011 (invalid).
+        // without this, +0xDEAD_BEEF will be parsed as a decimal int and
+        // unexpected "xDEAD_BEEF" will appear after integer "+0".
+        loc.advance();
+    }
+
+    if( ! loc.eof() && loc.current() == '0')
+    {
+        loc.advance();
+        if(loc.eof())
+        {
+            // `[+-]?0`. parse as an decimal integer.
+            loc = first;
+            return parse_dec_integer(loc, ctx);
+        }
+
+        const auto prefix = loc.current();
+        auto prefix_src = source_location(region(loc));
+
+        loc = first;
+
+        if(prefix == 'b') {return parse_bin_integer(loc, ctx);}
+        if(prefix == 'o') {return parse_oct_integer(loc, ctx);}
+        if(prefix == 'x') {return parse_hex_integer(loc, ctx);}
+
+        if(std::isdigit(prefix))
+        {
+            auto src = source_location(region(loc));
+            return err(make_error_info("toml::parse_integer: "
+                "leading zero in an decimal integer is not allowed",
+                std::move(src), "leading zero"));
+        }
+    }
+
+    loc = first;
+    return parse_dec_integer(loc, ctx);
+}
+
+/* ============================================================================
+ *  ___ _           _   _
+ * | __| |___  __ _| |_(_)_ _  __ _
+ * | _|| / _ \/ _` |  _| | ' \/ _` |
+ * |_| |_\___/\__,_|\__|_|_||_\__, |
+ *                            |___/
+ */
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_floating(location& loc, const context<TC>& ctx)
+{
+    using floating_type = typename basic_value<TC>::floating_type;
+
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    // ----------------------------------------------------------------------
+    // check syntax
+    bool is_hex = false;
+    std::string str;
+    region reg;
+    if(spec.ext_hex_float && literal("0x").scan(loc).is_ok())
+    {
+        loc = first;
+        is_hex = true;
+
+        reg = syntax::hex_floating(spec).scan(loc);
+        if( ! reg.is_ok())
+        {
+            return err(make_syntax_error("toml::parse_floating: "
+                "invalid hex floating: float must be like: 0xABCp-3f",
+                syntax::floating(spec), loc));
+        }
+        str = reg.as_string();
+    }
+    else
+    {
+        reg = syntax::floating(spec).scan(loc);
+        if( ! reg.is_ok())
+        {
+            return err(make_syntax_error("toml::parse_floating: "
+                "invalid floating: float must be like: -3.14159_26535, 6.022e+23, "
+                "inf, or nan (lowercase).", syntax::floating(spec), loc));
+        }
+        str = reg.as_string();
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+
+    floating_format_info fmt;
+
+    if(is_hex)
+    {
+        fmt.fmt = floating_format::hex;
+    }
+    else
+    {
+        // since we already checked that the string conforms the TOML standard.
+        if(std::find(str.begin(), str.end(), 'e') != str.end() ||
+           std::find(str.begin(), str.end(), 'E') != str.end())
+        {
+            fmt.fmt = floating_format::scientific; // use exponent part
+        }
+        else
+        {
+            fmt.fmt = floating_format::fixed; // do not use exponent part
+        }
+    }
+
+    str.erase(std::remove(str.begin(), str.end(), '_'), str.end());
+
+    floating_type val{0};
+
+    if(str == "inf" || str == "+inf")
+    {
+        TOML11_CONSTEXPR_IF(std::numeric_limits<floating_type>::has_infinity)
+        {
+            val = std::numeric_limits<floating_type>::infinity();
+        }
+        else
+        {
+            return err(make_error_info("toml::parse_floating: inf value found"
+                " but the current environment does not support inf. Please"
+                " make sure that the floating-point implementation conforms"
+                " IEEE 754/ISO 60559 international standard.",
+                source_location(region(loc)),
+                "floating_type: inf is not supported"));
+        }
+    }
+    else if(str == "-inf")
+    {
+        TOML11_CONSTEXPR_IF(std::numeric_limits<floating_type>::has_infinity)
+        {
+            val = -std::numeric_limits<floating_type>::infinity();
+        }
+        else
+        {
+            return err(make_error_info("toml::parse_floating: inf value found"
+                " but the current environment does not support inf. Please"
+                " make sure that the floating-point implementation conforms"
+                " IEEE 754/ISO 60559 international standard.",
+                source_location(region(loc)),
+                "floating_type: inf is not supported"));
+        }
+    }
+    else if(str == "nan" || str == "+nan")
+    {
+        TOML11_CONSTEXPR_IF(std::numeric_limits<floating_type>::has_quiet_NaN)
+        {
+            val = std::numeric_limits<floating_type>::quiet_NaN();
+        }
+        else TOML11_CONSTEXPR_IF(std::numeric_limits<floating_type>::has_signaling_NaN)
+        {
+            val = std::numeric_limits<floating_type>::signaling_NaN();
+        }
+        else
+        {
+            return err(make_error_info("toml::parse_floating: NaN value found"
+                " but the current environment does not support NaN. Please"
+                " make sure that the floating-point implementation conforms"
+                " IEEE 754/ISO 60559 international standard.",
+                source_location(region(loc)),
+                "floating_type: NaN is not supported"));
+        }
+    }
+    else if(str == "-nan")
+    {
+        using std::copysign;
+        TOML11_CONSTEXPR_IF(std::numeric_limits<floating_type>::has_quiet_NaN)
+        {
+            val = copysign(std::numeric_limits<floating_type>::quiet_NaN(), floating_type(-1));
+        }
+        else TOML11_CONSTEXPR_IF(std::numeric_limits<floating_type>::has_signaling_NaN)
+        {
+            val = copysign(std::numeric_limits<floating_type>::signaling_NaN(), floating_type(-1));
+        }
+        else
+        {
+            return err(make_error_info("toml::parse_floating: NaN value found"
+                " but the current environment does not support NaN. Please"
+                " make sure that the floating-point implementation conforms"
+                " IEEE 754/ISO 60559 international standard.",
+                source_location(region(loc)),
+                "floating_type: NaN is not supported"));
+        }
+    }
+    else
+    {
+        // set precision
+        const auto has_sign = ! str.empty() && (str.front() == '+' || str.front() == '-');
+        const auto decpoint = std::find(str.begin(), str.end(), '.');
+        const auto exponent = std::find_if(str.begin(), str.end(),
+            [](const char c) { return c == 'e' || c == 'E'; });
+        if(decpoint != str.end() && exponent != str.end())
+        {
+            assert(decpoint < exponent);
+        }
+
+        if(fmt.fmt == floating_format::scientific)
+        {
+            // total width
+            fmt.prec = static_cast<std::size_t>(std::distance(str.begin(), exponent));
+            if(has_sign)
+            {
+                fmt.prec -= 1;
+            }
+            if(decpoint != str.end())
+            {
+                fmt.prec -= 1;
+            }
+        }
+        else if(fmt.fmt == floating_format::hex)
+        {
+            fmt.prec = std::numeric_limits<floating_type>::max_digits10;
+        }
+        else
+        {
+            // width after decimal point
+            fmt.prec = static_cast<std::size_t>(std::distance(std::next(decpoint), exponent));
+        }
+
+        auto src = source_location(region(loc));
+        const auto res = TC::parse_float(str, src, is_hex);
+        if(res.is_ok())
+        {
+            val = res.as_ok();
+        }
+        else
+        {
+            return err(res.as_err());
+        }
+    }
+
+    // ----------------------------------------------------------------------
+    // parse suffix (extension)
+
+    if(spec.ext_num_suffix && loc.current() == '_')
+    {
+        const auto sfx_reg = syntax::num_suffix(spec).scan(loc);
+        if( ! sfx_reg.is_ok())
+        {
+            auto src = source_location(region(loc));
+            loc = first;
+            return err(make_error_info("toml::parse_floating: "
+                "invalid suffix: should be `_ non-digit-graph (graph | _graph)`",
+                std::move(src), "here"));
+        }
+        auto sfx = sfx_reg.as_string();
+        assert( ! sfx.empty() && sfx.front() == '_');
+        sfx.erase(sfx.begin()); // remove the first `_`
+
+        fmt.suffix = sfx;
+    }
+
+    return ok(basic_value<TC>(val, std::move(fmt), {}, std::move(reg)));
+}
+
+/* ============================================================================
+ *  ___       _       _   _
+ * |   \ __ _| |_ ___| |_(_)_ __  ___
+ * | |) / _` |  _/ -_)  _| | '  \/ -_)
+ * |___/\__,_|\__\___|\__|_|_|_|_\___|
+ */
+
+// all the offset_datetime, local_datetime, local_date parses date part.
+template<typename TC>
+result<std::tuple<local_date, local_date_format_info, region>, error_info>
+parse_local_date_only(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    local_date_format_info fmt;
+
+    // ----------------------------------------------------------------------
+    // check syntax
+    auto reg = syntax::local_date(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_local_date: "
+            "invalid date: date must be like: 1234-05-06, yyyy-mm-dd.",
+            syntax::local_date(spec), loc));
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+    const auto str = reg.as_string();
+
+    // 0123456789
+    // yyyy-mm-dd
+    const auto year_r  = from_string<int>(str.substr(0, 4));
+    const auto month_r = from_string<int>(str.substr(5, 2));
+    const auto day_r   = from_string<int>(str.substr(8, 2));
+
+    if(year_r.is_err())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_date: "
+            "failed to read year `" + str.substr(0, 4) + "`",
+            std::move(src), "here"));
+    }
+    if(month_r.is_err())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_date: "
+            "failed to read month `" + str.substr(5, 2) + "`",
+            std::move(src), "here"));
+    }
+    if(day_r.is_err())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_date: "
+            "failed to read day `" + str.substr(8, 2) + "`",
+            std::move(src), "here"));
+    }
+
+    const auto year  = year_r.unwrap();
+    const auto month = month_r.unwrap();
+    const auto day   = day_r.unwrap();
+
+    {
+        // We briefly check whether the input date is valid or not.
+        //     Actually, because of the historical reasons, there are several
+        // edge cases, such as 1582/10/5-1582/10/14 (only in several countries).
+        // But here, we do not care about it.
+        // It makes the code complicated and there is only low probability
+        // that such a specific date is needed in practice. If someone need to
+        // validate date accurately, that means that the one need a specialized
+        // library for their purpose in another layer.
+
+        const bool is_leap = (year % 4 == 0) && ((year % 100 != 0) || (year % 400 == 0));
+        const auto max_day = [month, is_leap]() {
+            if(month == 2)
+            {
+                return is_leap ? 29 : 28;
+            }
+            if(month == 4 || month == 6 || month == 9 || month == 11)
+            {
+                return 30;
+            }
+            return 31;
+        }();
+
+        if((month < 1 || 12 < month) || (day < 1 || max_day < day))
+        {
+            auto src = source_location(region(first));
+            return err(make_error_info("toml::parse_local_date: invalid date.",
+                std::move(src), "month must be 01-12, day must be any of "
+                "01-28,29,30,31 depending on the month/year."));
+        }
+    }
+
+    return ok(std::make_tuple(
+            local_date(year, static_cast<month_t>(month - 1), day),
+            std::move(fmt), std::move(reg)
+        ));
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_local_date(location& loc, const context<TC>& ctx)
+{
+    auto val_fmt_reg = parse_local_date_only(loc, ctx);
+    if(val_fmt_reg.is_err())
+    {
+        return err(val_fmt_reg.unwrap_err());
+    }
+
+    auto val = std::move(std::get<0>(val_fmt_reg.unwrap()));
+    auto fmt = std::move(std::get<1>(val_fmt_reg.unwrap()));
+    auto reg = std::move(std::get<2>(val_fmt_reg.unwrap()));
+
+    return ok(basic_value<TC>(std::move(val), std::move(fmt), {}, std::move(reg)));
+}
+
+// all the offset_datetime, local_datetime, local_time parses date part.
+template<typename TC>
+result<std::tuple<local_time, local_time_format_info, region>, error_info>
+parse_local_time_only(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    local_time_format_info fmt;
+
+    // ----------------------------------------------------------------------
+    // check syntax
+    auto reg = syntax::local_time(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        if(spec.v1_1_0_make_seconds_optional)
+        {
+            return err(make_syntax_error("toml::parse_local_time: "
+                "invalid time: time must be HH:MM(:SS.sss) (seconds are optional)",
+                syntax::local_time(spec), loc));
+        }
+        else
+        {
+            return err(make_syntax_error("toml::parse_local_time: "
+                "invalid time: time must be HH:MM:SS(.sss) (subseconds are optional)",
+                syntax::local_time(spec), loc));
+        }
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+    const auto str = reg.as_string();
+
+    // at least we have HH:MM.
+    // 01234
+    // HH:MM
+    const auto hour_r   = from_string<int>(str.substr(0, 2));
+    const auto minute_r = from_string<int>(str.substr(3, 2));
+
+    if(hour_r.is_err())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_time: "
+            "failed to read hour `" + str.substr(0, 2) + "`",
+            std::move(src), "here"));
+    }
+    if(minute_r.is_err())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_time: "
+            "failed to read minute `" + str.substr(3, 2) + "`",
+            std::move(src), "here"));
+    }
+
+    const auto hour   = hour_r.unwrap();
+    const auto minute = minute_r.unwrap();
+
+    if((hour < 0 || 24 <= hour) || (minute < 0 || 60 <= minute))
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_time: invalid time.",
+            std::move(src), "hour must be 00-23, minute must be 00-59."));
+    }
+
+    // -----------------------------------------------------------------------
+    // we have hour and minute.
+    // Since toml v1.1.0, second and subsecond part becomes optional.
+    // Check the version and return if second does not exist.
+
+    if(str.size() == 5 && spec.v1_1_0_make_seconds_optional)
+    {
+        fmt.has_seconds = false;
+        fmt.subsecond_precision = 0;
+        return ok(std::make_tuple(local_time(hour, minute, 0), std::move(fmt), std::move(reg)));
+    }
+    assert(str.at(5) == ':');
+
+    // we have at least `:SS` part. `.subseconds` are optional.
+
+    // 0         1
+    // 012345678901234
+    // HH:MM:SS.subsec
+    const auto sec_r = from_string<int>(str.substr(6, 2));
+    if(sec_r.is_err())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_time: "
+            "failed to read second `" + str.substr(6, 2) + "`",
+            std::move(src), "here"));
+    }
+    const auto sec = sec_r.unwrap();
+
+    if(sec < 0 || 60 < sec) // :60 is allowed
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_time: invalid time.",
+                    std::move(src), "second must be 00-60."));
+    }
+
+    if(str.size() == 8)
+    {
+        fmt.has_seconds = true;
+        fmt.subsecond_precision = 0;
+        return ok(std::make_tuple(local_time(hour, minute, sec), std::move(fmt), std::move(reg)));
+    }
+
+    assert(str.at(8) == '.');
+
+    auto secfrac = str.substr(9, str.size() - 9);
+
+    fmt.has_seconds = true;
+    fmt.subsecond_precision = secfrac.size();
+
+    while(secfrac.size() < 9)
+    {
+        secfrac += '0';
+    }
+    assert(9 <= secfrac.size());
+    const auto ms_r = from_string<int>(secfrac.substr(0, 3));
+    const auto us_r = from_string<int>(secfrac.substr(3, 3));
+    const auto ns_r = from_string<int>(secfrac.substr(6, 3));
+
+    if(ms_r.is_err())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_time: "
+            "failed to read milliseconds `" + secfrac.substr(0, 3) + "`",
+            std::move(src), "here"));
+    }
+    if(us_r.is_err())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_time: "
+            "failed to read microseconds`" + str.substr(3, 3) + "`",
+            std::move(src), "here"));
+    }
+    if(ns_r.is_err())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_local_time: "
+            "failed to read nanoseconds`" + str.substr(6, 3) + "`",
+            std::move(src), "here"));
+    }
+    const auto ms = ms_r.unwrap();
+    const auto us = us_r.unwrap();
+    const auto ns = ns_r.unwrap();
+
+    return ok(std::make_tuple(local_time(hour, minute, sec, ms, us, ns), std::move(fmt), std::move(reg)));
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_local_time(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+
+    auto val_fmt_reg = parse_local_time_only(loc, ctx);
+    if(val_fmt_reg.is_err())
+    {
+        return err(val_fmt_reg.unwrap_err());
+    }
+
+    auto val = std::move(std::get<0>(val_fmt_reg.unwrap()));
+    auto fmt = std::move(std::get<1>(val_fmt_reg.unwrap()));
+    auto reg = std::move(std::get<2>(val_fmt_reg.unwrap()));
+
+    return ok(basic_value<TC>(std::move(val), std::move(fmt), {}, std::move(reg)));
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_local_datetime(location& loc, const context<TC>& ctx)
+{
+    using char_type = location::char_type;
+
+    const auto first = loc;
+
+    local_datetime_format_info fmt;
+
+    // ----------------------------------------------------------------------
+
+    auto date_fmt_reg = parse_local_date_only(loc, ctx);
+    if(date_fmt_reg.is_err())
+    {
+        return err(date_fmt_reg.unwrap_err());
+    }
+
+    if(loc.current() == char_type('T'))
+    {
+        loc.advance();
+        fmt.delimiter = datetime_delimiter_kind::upper_T;
+    }
+    else if(loc.current() == char_type('t'))
+    {
+        loc.advance();
+        fmt.delimiter = datetime_delimiter_kind::lower_t;
+    }
+    else if(loc.current() == char_type(' '))
+    {
+        loc.advance();
+        fmt.delimiter = datetime_delimiter_kind::space;
+    }
+    else
+    {
+        auto src = source_location(region(loc));
+        return err(make_error_info("toml::parse_local_datetime: "
+            "expect date-time delimiter `T`, `t` or ` `(space).",
+            std::move(src), "here"));
+    }
+
+    auto time_fmt_reg = parse_local_time_only(loc, ctx);
+    if(time_fmt_reg.is_err())
+    {
+        return err(time_fmt_reg.unwrap_err());
+    }
+
+    fmt.has_seconds         = std::get<1>(time_fmt_reg.unwrap()).has_seconds;
+    fmt.subsecond_precision = std::get<1>(time_fmt_reg.unwrap()).subsecond_precision;
+
+    // ----------------------------------------------------------------------
+
+    region reg(first, loc);
+    local_datetime val(std::get<0>(date_fmt_reg.unwrap()),
+                       std::get<0>(time_fmt_reg.unwrap()));
+
+    return ok(basic_value<TC>(val, std::move(fmt), {}, std::move(reg)));
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_offset_datetime(location& loc, const context<TC>& ctx)
+{
+    using char_type = location::char_type;
+
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    offset_datetime_format_info fmt;
+
+    // ----------------------------------------------------------------------
+    // date part
+
+    auto date_fmt_reg = parse_local_date_only(loc, ctx);
+    if(date_fmt_reg.is_err())
+    {
+        return err(date_fmt_reg.unwrap_err());
+    }
+
+    // ----------------------------------------------------------------------
+    // delimiter
+
+    if(loc.current() == char_type('T'))
+    {
+        loc.advance();
+        fmt.delimiter = datetime_delimiter_kind::upper_T;
+    }
+    else if(loc.current() == char_type('t'))
+    {
+        loc.advance();
+        fmt.delimiter = datetime_delimiter_kind::lower_t;
+    }
+    else if(loc.current() == char_type(' '))
+    {
+        loc.advance();
+        fmt.delimiter = datetime_delimiter_kind::space;
+    }
+    else
+    {
+        auto src = source_location(region(loc));
+        return err(make_error_info("toml::parse_offset_datetime: "
+            "expect date-time delimiter `T` or ` `(space).", std::move(src), "here"
+        ));
+    }
+
+    // ----------------------------------------------------------------------
+    // time part
+
+    auto time_fmt_reg = parse_local_time_only(loc, ctx);
+    if(time_fmt_reg.is_err())
+    {
+        return err(time_fmt_reg.unwrap_err());
+    }
+
+    fmt.has_seconds         = std::get<1>(time_fmt_reg.unwrap()).has_seconds;
+    fmt.subsecond_precision = std::get<1>(time_fmt_reg.unwrap()).subsecond_precision;
+
+    // ----------------------------------------------------------------------
+    // offset part
+
+    const auto ofs_reg = syntax::time_offset(spec).scan(loc);
+    if( ! ofs_reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_offset_datetime: "
+            "invalid offset: offset must be like: Z, +01:00, or -10:00.",
+            syntax::time_offset(spec), loc));
+    }
+
+    const auto ofs_str = ofs_reg.as_string();
+
+    time_offset offset(0, 0);
+
+    assert(ofs_str.size() != 0);
+
+    if(ofs_str.at(0) == char_type('+') || ofs_str.at(0) == char_type('-'))
+    {
+        const auto hour_r   = from_string<int>(ofs_str.substr(1, 2));
+        const auto minute_r = from_string<int>(ofs_str.substr(4, 2));
+        if(hour_r.is_err())
+        {
+            auto src = source_location(region(loc));
+            return err(make_error_info("toml::parse_offset_datetime: "
+                "Failed to read offset hour part", std::move(src), "here"));
+        }
+        if(minute_r.is_err())
+        {
+            auto src = source_location(region(loc));
+            return err(make_error_info("toml::parse_offset_datetime: "
+                "Failed to read offset minute part", std::move(src), "here"));
+        }
+        const auto hour   = hour_r.unwrap();
+        const auto minute = minute_r.unwrap();
+
+        if(ofs_str.at(0) == '+')
+        {
+            offset = time_offset(hour, minute);
+        }
+        else
+        {
+            offset = time_offset(-hour, -minute);
+        }
+    }
+    else
+    {
+        assert(ofs_str.at(0) == char_type('Z') || ofs_str.at(0) == char_type('z'));
+    }
+
+    if (offset.hour   < -24 || 24 < offset.hour ||
+        offset.minute < -60 || 60 < offset.minute)
+    {
+        return err(make_error_info("toml::parse_offset_datetime: "
+            "too large offset: |hour| <= 24, |minute| <= 60",
+            source_location(region(first, loc)), "here"));
+    }
+
+
+    // ----------------------------------------------------------------------
+
+    region reg(first, loc);
+    offset_datetime val(local_datetime(std::get<0>(date_fmt_reg.unwrap()),
+                                       std::get<0>(time_fmt_reg.unwrap())),
+                                       offset);
+
+    return ok(basic_value<TC>(val, std::move(fmt), {}, std::move(reg)));
+}
+
+/* ============================================================================
+ *   ___ _       _
+ *  / __| |_ _ _(_)_ _  __ _
+ *  \__ \  _| '_| | ' \/ _` |
+ *  |___/\__|_| |_|_||_\__, |
+ *                     |___/
+ */
+
+template<typename TC>
+result<typename basic_value<TC>::string_type, error_info>
+parse_utf8_codepoint(const region& reg)
+{
+    using string_type = typename basic_value<TC>::string_type;
+    using char_type = typename string_type::value_type;
+
+    // assert(reg.as_lines().size() == 1); // XXX heavy check
+
+    const auto str = reg.as_string();
+    assert( ! str.empty());
+    assert(str.front() == 'u' || str.front() == 'U' || str.front() == 'x');
+
+    std::uint_least32_t codepoint;
+    std::istringstream iss(str.substr(1));
+    iss >> std::hex >> codepoint;
+
+    const auto to_char = [](const std::uint_least32_t i) noexcept -> char_type {
+        const auto uc = static_cast<unsigned char>(i & 0xFF);
+        return cxx::bit_cast<char_type>(uc);
+    };
+
+    string_type character;
+    if(codepoint < 0x80) // U+0000 ... U+0079 ; just an ASCII.
+    {
+        character += static_cast<char>(codepoint);
+    }
+    else if(codepoint < 0x800) //U+0080 ... U+07FF
+    {
+        // 110yyyyx 10xxxxxx; 0x3f == 0b0011'1111
+        character += to_char(0xC0|(codepoint >> 6  ));
+        character += to_char(0x80|(codepoint & 0x3F));
+    }
+    else if(codepoint < 0x10000) // U+0800...U+FFFF
+    {
+        if(0xD800 <= codepoint && codepoint <= 0xDFFF)
+        {
+            auto src = source_location(reg);
+            return err(make_error_info("toml::parse_utf8_codepoint: "
+                "[0xD800, 0xDFFF] is not a valid UTF-8",
+                std::move(src), "here"));
+        }
+        assert(codepoint < 0xD800 || 0xDFFF < codepoint);
+        // 1110yyyy 10yxxxxx 10xxxxxx
+        character += to_char(0xE0| (codepoint >> 12));
+        character += to_char(0x80|((codepoint >> 6 ) & 0x3F));
+        character += to_char(0x80|((codepoint      ) & 0x3F));
+    }
+    else if(codepoint < 0x110000) // U+010000 ... U+10FFFF
+    {
+        // 11110yyy 10yyxxxx 10xxxxxx 10xxxxxx
+        character += to_char(0xF0| (codepoint >> 18));
+        character += to_char(0x80|((codepoint >> 12) & 0x3F));
+        character += to_char(0x80|((codepoint >> 6 ) & 0x3F));
+        character += to_char(0x80|((codepoint      ) & 0x3F));
+    }
+    else // out of UTF-8 region
+    {
+        auto src = source_location(reg);
+        return err(make_error_info("toml::parse_utf8_codepoint: "
+            "input codepoint is too large.",
+            std::move(src), "must be in range [0x00, 0x10FFFF]"));
+    }
+    return ok(character);
+}
+
+template<typename TC>
+result<typename basic_value<TC>::string_type, error_info>
+parse_escape_sequence(location& loc, const context<TC>& ctx)
+{
+    using string_type = typename basic_value<TC>::string_type;
+    using char_type = typename string_type::value_type;
+
+    const auto& spec = ctx.toml_spec();
+
+    assert( ! loc.eof());
+    assert(loc.current() == '\\');
+    loc.advance(); // consume the first backslash
+
+    string_type retval;
+
+    if     (loc.current() == '\\') { retval += char_type('\\'); loc.advance(); }
+    else if(loc.current() == '"')  { retval += char_type('\"'); loc.advance(); }
+    else if(loc.current() == 'b')  { retval += char_type('\b'); loc.advance(); }
+    else if(loc.current() == 'f')  { retval += char_type('\f'); loc.advance(); }
+    else if(loc.current() == 'n')  { retval += char_type('\n'); loc.advance(); }
+    else if(loc.current() == 'r')  { retval += char_type('\r'); loc.advance(); }
+    else if(loc.current() == 't')  { retval += char_type('\t'); loc.advance(); }
+    else if(spec.v1_1_0_add_escape_sequence_e && loc.current() == 'e')
+    {
+        retval += char_type('\x1b');
+        loc.advance();
+    }
+    else if(spec.v1_1_0_add_escape_sequence_x && loc.current() == 'x')
+    {
+        const auto reg = syntax::escaped_x2(spec).scan(loc);
+        if( ! reg.is_ok())
+        {
+            auto src = source_location(region(loc));
+            return err(make_error_info("toml::parse_escape_sequence: "
+                   "invalid token found in UTF-8 codepoint \\xhh",
+                   std::move(src), "here"));
+        }
+        const auto utf8 = parse_utf8_codepoint<TC>(reg);
+        if(utf8.is_err())
+        {
+            return err(utf8.as_err());
+        }
+        retval += utf8.unwrap();
+    }
+    else if(loc.current() == 'u')
+    {
+        const auto reg = syntax::escaped_u4(spec).scan(loc);
+        if( ! reg.is_ok())
+        {
+            auto src = source_location(region(loc));
+            return err(make_error_info("toml::parse_escape_sequence: "
+                   "invalid token found in UTF-8 codepoint \\uhhhh",
+                   std::move(src), "here"));
+        }
+        const auto utf8 = parse_utf8_codepoint<TC>(reg);
+        if(utf8.is_err())
+        {
+            return err(utf8.as_err());
+        }
+        retval += utf8.unwrap();
+    }
+    else if(loc.current() == 'U')
+    {
+        const auto reg = syntax::escaped_U8(spec).scan(loc);
+        if( ! reg.is_ok())
+        {
+            auto src = source_location(region(loc));
+            return err(make_error_info("toml::parse_escape_sequence: "
+                   "invalid token found in UTF-8 codepoint \\Uhhhhhhhh",
+                   std::move(src), "here"));
+        }
+        const auto utf8 = parse_utf8_codepoint<TC>(reg);
+        if(utf8.is_err())
+        {
+            return err(utf8.as_err());
+        }
+        retval += utf8.unwrap();
+    }
+    else
+    {
+        auto src = source_location(region(loc));
+        std::string escape_seqs = "allowed escape seqs: \\\\, \\\", \\b, \\f, \\n, \\r, \\t";
+        if(spec.v1_1_0_add_escape_sequence_e)
+        {
+            escape_seqs += ", \\e";
+        }
+        if(spec.v1_1_0_add_escape_sequence_x)
+        {
+            escape_seqs += ", \\xhh";
+        }
+        escape_seqs += ", \\uhhhh, or \\Uhhhhhhhh";
+
+        return err(make_error_info("toml::parse_escape_sequence: "
+               "unknown escape sequence.", std::move(src), escape_seqs));
+    }
+    return ok(retval);
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_ml_basic_string(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    string_format_info fmt;
+    fmt.fmt = string_format::multiline_basic;
+
+    auto reg = syntax::ml_basic_string(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_ml_basic_string: "
+            "invalid string format",
+            syntax::ml_basic_string(spec), loc));
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+
+    auto str = reg.as_string();
+
+    // we already checked that it starts with """ and ends with """.
+    assert(str.substr(0, 3) == "\"\"\"");
+    str.erase(0, 3);
+
+    assert(str.size() >= 3);
+    assert(str.substr(str.size()-3, 3) == "\"\"\"");
+    str.erase(str.size()-3, 3);
+
+    // the first newline just after """ is trimmed
+    if(str.size() >= 1 && str.at(0) == '\n')
+    {
+        str.erase(0, 1);
+        fmt.start_with_newline = true;
+    }
+    else if(str.size() >= 2 && str.at(0) == '\r' && str.at(1) == '\n')
+    {
+        str.erase(0, 2);
+        fmt.start_with_newline = true;
+    }
+
+    using string_type = typename basic_value<TC>::string_type;
+    string_type val;
+    {
+        auto iter = str.cbegin();
+        while(iter != str.cend())
+        {
+            if(*iter == '\\') // remove whitespaces around escaped-newline
+            {
+                // we assume that the string is not too long to copy
+                auto loc2 = make_temporary_location(make_string(iter, str.cend()));
+                if(syntax::escaped_newline(spec).scan(loc2).is_ok())
+                {
+                    std::advance(iter, loc2.get_location()); // skip escaped newline and indent
+                    // now iter points non-WS char
+                    assert(iter == str.end() || (*iter != ' ' && *iter != '\t'));
+                }
+                else // normal escape seq.
+                {
+                    auto esc = parse_escape_sequence(loc2, ctx);
+
+                    // syntax does not check its value. the unicode codepoint may be
+                    // invalid, e.g. out-of-bound, [0xD800, 0xDFFF]
+                    if(esc.is_err())
+                    {
+                        return err(esc.unwrap_err());
+                    }
+
+                    val += esc.unwrap();
+                    std::advance(iter, loc2.get_location());
+                }
+            }
+            else // we already checked the syntax. we don't need to check it again.
+            {
+                val += static_cast<typename string_type::value_type>(*iter);
+                ++iter;
+            }
+        }
+    }
+
+    return ok(basic_value<TC>(
+            std::move(val), std::move(fmt), {}, std::move(reg)
+        ));
+}
+
+template<typename TC>
+result<std::pair<typename basic_value<TC>::string_type, region>, error_info>
+parse_basic_string_only(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    auto reg = syntax::basic_string(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_basic_string: "
+            "invalid string format",
+            syntax::basic_string(spec), loc));
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+
+    auto str = reg.as_string();
+
+    assert(str.back() == '\"');
+    str.pop_back();
+    assert(str.at(0) == '\"');
+    str.erase(0, 1);
+
+    using string_type = typename basic_value<TC>::string_type;
+    using char_type   = typename string_type::value_type;
+    string_type val;
+
+    {
+        auto iter = str.begin();
+        while(iter != str.end())
+        {
+            if(*iter == '\\')
+            {
+                auto loc2 = make_temporary_location(make_string(iter, str.end()));
+
+                auto esc = parse_escape_sequence(loc2, ctx);
+
+                // syntax does not check its value. the unicode codepoint may be
+                // invalid, e.g. out-of-bound, [0xD800, 0xDFFF]
+                if(esc.is_err())
+                {
+                    return err(esc.unwrap_err());
+                }
+
+                val += esc.unwrap();
+                std::advance(iter, loc2.get_location());
+            }
+            else
+            {
+                val += char_type(*iter); // we already checked the syntax.
+                ++iter;
+            }
+        }
+    }
+    return ok(std::make_pair(val, reg));
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_basic_string(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+
+    string_format_info fmt;
+    fmt.fmt = string_format::basic;
+
+    auto val_res = parse_basic_string_only(loc, ctx);
+    if(val_res.is_err())
+    {
+        return err(std::move(val_res.unwrap_err()));
+    }
+    auto val = std::move(val_res.unwrap().first );
+    auto reg = std::move(val_res.unwrap().second);
+
+    return ok(basic_value<TC>(std::move(val), std::move(fmt), {}, std::move(reg)));
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_ml_literal_string(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    string_format_info fmt;
+    fmt.fmt = string_format::multiline_literal;
+
+    auto reg = syntax::ml_literal_string(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_ml_literal_string: "
+            "invalid string format",
+            syntax::ml_literal_string(spec), loc));
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+
+    auto str = reg.as_string();
+
+    assert(str.substr(0, 3) == "'''");
+    assert(str.substr(str.size()-3, 3) == "'''");
+    str.erase(0, 3);
+    str.erase(str.size()-3, 3);
+
+    // the first newline just after """ is trimmed
+    if(str.size() >= 1 && str.at(0) == '\n')
+    {
+        str.erase(0, 1);
+        fmt.start_with_newline = true;
+    }
+    else if(str.size() >= 2 && str.at(0) == '\r' && str.at(1) == '\n')
+    {
+        str.erase(0, 2);
+        fmt.start_with_newline = true;
+    }
+
+    using string_type = typename basic_value<TC>::string_type;
+    string_type val(str.begin(), str.end());
+
+    return ok(basic_value<TC>(
+            std::move(val), std::move(fmt), {}, std::move(reg)
+        ));
+}
+
+template<typename TC>
+result<std::pair<typename basic_value<TC>::string_type, region>, error_info>
+parse_literal_string_only(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    auto reg = syntax::literal_string(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_literal_string: "
+            "invalid string format",
+            syntax::literal_string(spec), loc));
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+
+    auto str = reg.as_string();
+
+    assert(str.back() == '\'');
+    str.pop_back();
+    assert(str.at(0) == '\'');
+    str.erase(0, 1);
+
+    using string_type = typename basic_value<TC>::string_type;
+    string_type val(str.begin(), str.end());
+
+    return ok(std::make_pair(std::move(val), std::move(reg)));
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_literal_string(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+
+    string_format_info fmt;
+    fmt.fmt = string_format::literal;
+
+    auto val_res = parse_literal_string_only(loc, ctx);
+    if(val_res.is_err())
+    {
+        return err(std::move(val_res.unwrap_err()));
+    }
+    auto val = std::move(val_res.unwrap().first );
+    auto reg = std::move(val_res.unwrap().second);
+
+    return ok(basic_value<TC>(
+            std::move(val), std::move(fmt), {}, std::move(reg)
+        ));
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_string(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+
+    if( ! loc.eof() && loc.current() == '"')
+    {
+        if(literal("\"\"\"").scan(loc).is_ok())
+        {
+            loc = first;
+            return parse_ml_basic_string(loc, ctx);
+        }
+        else
+        {
+            loc = first;
+            return parse_basic_string(loc, ctx);
+        }
+    }
+    else if( ! loc.eof() && loc.current() == '\'')
+    {
+        if(literal("'''").scan(loc).is_ok())
+        {
+            loc = first;
+            return parse_ml_literal_string(loc, ctx);
+        }
+        else
+        {
+            loc = first;
+            return parse_literal_string(loc, ctx);
+        }
+    }
+    else
+    {
+        auto src = source_location(region(loc));
+        return err(make_error_info("toml::parse_string: "
+            "not a string", std::move(src), "here"));
+    }
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_null(location& loc, const context<TC>& ctx)
+{
+    const auto& spec = ctx.toml_spec();
+    if( ! spec.ext_null_value)
+    {
+        return err(make_error_info("toml::parse_null: "
+            "invalid spec: spec.ext_null_value must be true.",
+            source_location(region(loc)), "here"));
+    }
+
+    // ----------------------------------------------------------------------
+    // check syntax
+    auto reg = syntax::null_value(spec).scan(loc);
+    if( ! reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_null: "
+            "invalid null: null must be lowercase. ",
+            syntax::null_value(spec), loc));
+    }
+
+    // ----------------------------------------------------------------------
+    // it matches. gen value
+
+    // ----------------------------------------------------------------------
+    // no format info for boolean
+
+    return ok(basic_value<TC>(detail::none_t{}, std::move(reg)));
+}
+
+/* ============================================================================
+ *   _  __
+ *  | |/ /___ _  _
+ *  | ' </ -_) || |
+ *  |_|\_\___|\_, |
+ *            |__/
+ */
+
+// non-dotted key.
+template<typename TC>
+result<typename basic_value<TC>::key_type, error_info>
+parse_simple_key(location& loc, const context<TC>& ctx)
+{
+    using key_type = typename basic_value<TC>::key_type;
+    const auto& spec = ctx.toml_spec();
+
+    if(loc.current() == '\"')
+    {
+        auto str_res = parse_basic_string_only(loc, ctx);
+        if(str_res.is_ok())
+        {
+            return ok(std::move(str_res.unwrap().first));
+        }
+        else
+        {
+            return err(std::move(str_res.unwrap_err()));
+        }
+    }
+    else if(loc.current() == '\'')
+    {
+        auto str_res = parse_literal_string_only(loc, ctx);
+        if(str_res.is_ok())
+        {
+            return ok(std::move(str_res.unwrap().first));
+        }
+        else
+        {
+            return err(std::move(str_res.unwrap_err()));
+        }
+    }
+
+    // bare key.
+
+    if(const auto bare = syntax::unquoted_key(spec).scan(loc))
+    {
+        return ok(string_conv<key_type>(bare.as_string()));
+    }
+    else
+    {
+        std::string postfix;
+        if(spec.v1_1_0_allow_non_english_in_bare_keys)
+        {
+            postfix = "Hint: Not all Unicode characters are allowed as bare key.\n";
+        }
+        else
+        {
+            postfix = "Hint: non-ASCII scripts are allowed in toml v1.1.0, but not in v1.0.0.\n";
+        }
+        return err(make_syntax_error("toml::parse_simple_key: "
+            "invalid key: key must be \"quoted\", 'quoted-literal', or bare key.",
+            syntax::unquoted_key(spec), loc, postfix));
+    }
+}
+
+// dotted key become vector of keys
+template<typename TC>
+result<std::pair<std::vector<typename basic_value<TC>::key_type>, region>, error_info>
+parse_key(location& loc, const context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    using key_type = typename basic_value<TC>::key_type;
+    std::vector<key_type> keys;
+    while( ! loc.eof())
+    {
+        auto key = parse_simple_key(loc, ctx);
+        if( ! key.is_ok())
+        {
+            return err(key.unwrap_err());
+        }
+        keys.push_back(std::move(key.unwrap()));
+
+        auto reg = syntax::dot_sep(spec).scan(loc);
+        if( ! reg.is_ok())
+        {
+            break;
+        }
+    }
+    if(keys.empty())
+    {
+        auto src = source_location(region(first));
+        return err(make_error_info("toml::parse_key: expected a new key, "
+                    "but got nothing", std::move(src), "reached EOF"));
+    }
+
+    return ok(std::make_pair(std::move(keys), region(first, loc)));
+}
+
+// ============================================================================
+
+// forward-decl to implement parse_array and parse_table
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_value(location&, context<TC>& ctx);
+
+template<typename TC>
+result<std::pair<
+        std::pair<std::vector<typename basic_value<TC>::key_type>, region>,
+        basic_value<TC>
+    >, error_info>
+parse_key_value_pair(location& loc, context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    auto key_res = parse_key(loc, ctx);
+    if(key_res.is_err())
+    {
+        loc = first;
+        return err(key_res.unwrap_err());
+    }
+
+    if( ! syntax::keyval_sep(spec).scan(loc).is_ok())
+    {
+        auto e = make_syntax_error("toml::parse_key_value_pair: "
+            "invalid key value separator `=`", syntax::keyval_sep(spec), loc);
+        loc = first;
+        return err(std::move(e));
+    }
+
+    auto v_res = parse_value(loc, ctx);
+    if(v_res.is_err())
+    {
+        // loc = first;
+        return err(v_res.unwrap_err());
+    }
+    return ok(std::make_pair(std::move(key_res.unwrap()), std::move(v_res.unwrap())));
+}
+
+/* ============================================================================
+ *    __ _ _ _ _ _ __ _ _  _
+ *   / _` | '_| '_/ _` | || |
+ *   \__,_|_| |_| \__,_|\_, |
+ *                      |__/
+ */
+
+// array(and multiline inline table with `{` and `}`) has the following format.
+// `[`
+// (ws|newline|comment-line)? (value) (ws|newline|comment-line)? `,`
+// (ws|newline|comment-line)? (value) (ws|newline|comment-line)? `,`
+// ...
+// (ws|newline|comment-line)? (value) (ws|newline|comment-line)? (`,`)?
+// (ws|newline|comment-line)? `]`
+// it skips (ws|newline|comment-line) and returns the token.
+template<typename TC>
+struct multiline_spacer
+{
+    using comment_type = typename TC::comment_type;
+    bool         newline_found;
+    indent_char  indent_type;
+    std::int32_t indent;
+    comment_type comments;
+};
+template<typename T>
+std::ostream& operator<<(std::ostream& os, const multiline_spacer<T>& sp)
+{
+    os << "{newline="    << sp.newline_found << ", ";
+    os << "indent_type=" << sp.indent_type << ", ";
+    os << "indent="      << sp.indent << ", ";
+    os << "comments="    << sp.comments.size() << "}";
+    return os;
+}
+
+template<typename TC>
+cxx::optional<multiline_spacer<TC>>
+skip_multiline_spacer(location& loc, context<TC>& ctx, const bool newline_found = false)
+{
+    const auto& spec = ctx.toml_spec();
+
+    multiline_spacer<TC> spacer;
+    spacer.newline_found = newline_found;
+    spacer.indent_type   = indent_char::none;
+    spacer.indent        = 0;
+    spacer.comments.clear();
+
+    bool spacer_found = false;
+    while( ! loc.eof())
+    {
+        if(auto comm = sequence(syntax::comment(spec), syntax::newline(spec)).scan(loc))
+        {
+            spacer.newline_found = true;
+            auto comment = comm.as_string();
+            if( ! comment.empty() && comment.back() == '\n')
+            {
+                comment.pop_back();
+                if (!comment.empty() && comment.back() == '\r')
+                {
+                    comment.pop_back();
+                }
+            }
+
+            spacer.comments.push_back(std::move(comment));
+            spacer.indent_type = indent_char::none;
+            spacer.indent = 0;
+            spacer_found = true;
+        }
+        else if(auto nl = syntax::newline(spec).scan(loc))
+        {
+            spacer.newline_found = true;
+            spacer.comments.clear();
+            spacer.indent_type = indent_char::none;
+            spacer.indent = 0;
+            spacer_found = true;
+        }
+        else if(auto sp = repeat_at_least(1, character(cxx::bit_cast<location::char_type>(' '))).scan(loc))
+        {
+            spacer.indent_type = indent_char::space;
+            spacer.indent      = static_cast<std::int32_t>(sp.length());
+            spacer_found = true;
+        }
+        else if(auto tabs = repeat_at_least(1, character(cxx::bit_cast<location::char_type>('\t'))).scan(loc))
+        {
+            spacer.indent_type = indent_char::tab;
+            spacer.indent      = static_cast<std::int32_t>(tabs.length());
+            spacer_found = true;
+        }
+        else
+        {
+            break; // done
+        }
+    }
+    if( ! spacer_found)
+    {
+        return cxx::make_nullopt();
+    }
+    return spacer;
+}
+
+// not an [[array.of.tables]]. It parses ["this", "type"]
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_array(location& loc, context<TC>& ctx)
+{
+    const auto num_errors = ctx.errors().size();
+
+    const auto first = loc;
+
+    if(loc.eof() || loc.current() != '[')
+    {
+        auto src = source_location(region(loc));
+        return err(make_error_info("toml::parse_array: "
+                "The next token is not an array", std::move(src), "here"));
+    }
+    loc.advance();
+
+    typename basic_value<TC>::array_type val;
+
+    array_format_info fmt;
+    fmt.fmt = array_format::oneline;
+    fmt.indent_type = indent_char::none;
+
+    auto spacer = skip_multiline_spacer(loc, ctx);
+    if(spacer.has_value() && spacer.value().newline_found)
+    {
+        fmt.fmt = array_format::multiline;
+    }
+
+    bool comma_found = true;
+    while( ! loc.eof())
+    {
+        if(loc.current() == location::char_type(']'))
+        {
+            if(spacer.has_value() && spacer.value().newline_found &&
+                spacer.value().indent_type != indent_char::none)
+            {
+                fmt.indent_type    = spacer.value().indent_type;
+                fmt.closing_indent = spacer.value().indent;
+            }
+            break;
+        }
+
+        if( ! comma_found)
+        {
+            auto src = source_location(region(loc));
+            return err(make_error_info("toml::parse_array: "
+                    "expected value-separator `,` or closing `]`",
+                    std::move(src), "here"));
+        }
+
+        if(spacer.has_value() && spacer.value().newline_found &&
+            spacer.value().indent_type != indent_char::none)
+        {
+            fmt.indent_type = spacer.value().indent_type;
+            fmt.body_indent = spacer.value().indent;
+        }
+
+        if(auto elem_res = parse_value(loc, ctx))
+        {
+            auto elem = std::move(elem_res.unwrap());
+
+            if(spacer.has_value()) // copy previous comments to value
+            {
+                elem.comments() = std::move(spacer.value().comments);
+            }
+
+            // parse spaces between a value and a comma
+            // array = [
+            //     42    , # the answer
+            //       ^^^^
+            //     3.14 # pi
+            //   , 2.71 ^^^^
+            // ^^
+            spacer = skip_multiline_spacer(loc, ctx);
+            if(spacer.has_value())
+            {
+                for(std::size_t i=0; i<spacer.value().comments.size(); ++i)
+                {
+                    elem.comments().push_back(std::move(spacer.value().comments.at(i)));
+                }
+                if(spacer.value().newline_found)
+                {
+                    fmt.fmt = array_format::multiline;
+                }
+            }
+
+            comma_found = character(',').scan(loc).is_ok();
+
+            // parse comment after a comma
+            // array = [
+            //     42    , # the answer
+            //             ^^^^^^^^^^^^
+            //     3.14 # pi
+            //          ^^^^
+            // ]
+            auto com_res = parse_comment_line(loc, ctx);
+            if(com_res.is_err())
+            {
+                ctx.report_error(com_res.unwrap_err());
+            }
+
+            const bool comment_found = com_res.is_ok() && com_res.unwrap().has_value();
+            if(comment_found)
+            {
+                fmt.fmt = array_format::multiline;
+                elem.comments().push_back(com_res.unwrap().value());
+            }
+            if(comma_found)
+            {
+                spacer = skip_multiline_spacer(loc, ctx, comment_found);
+                if(spacer.has_value() && spacer.value().newline_found)
+                {
+                    fmt.fmt = array_format::multiline;
+                }
+            }
+            val.push_back(std::move(elem));
+        }
+        else
+        {
+            // if err, push error to ctx and try recovery.
+            ctx.report_error(std::move(elem_res.unwrap_err()));
+
+            // if it looks like some value, then skip the value.
+            // otherwise, it may be a new key-value pair or a new table and
+            // the error is "missing closing ]". stop parsing.
+
+            const auto before_skip = loc.get_location();
+            skip_value(loc, ctx);
+            if(before_skip == loc.get_location()) // cannot skip! break...
+            {
+                break;
+            }
+        }
+    }
+
+    if(loc.current() != ']')
+    {
+        auto src = source_location(region(loc));
+        return err(make_error_info("toml::parse_array: missing closing bracket `]`",
+            std::move(src), "expected `]`, reached EOF"));
+    }
+    else
+    {
+        loc.advance();
+    }
+    // any error reported from this function
+    if(num_errors != ctx.errors().size())
+    {
+        assert(ctx.has_error()); // already reported
+        return err(ctx.errors().back());
+    }
+
+    return ok(basic_value<TC>(
+            std::move(val), std::move(fmt), {}, region(first, loc)
+        ));
+}
+
+/* ============================================================================
+ *   _      _ _            _        _    _
+ *  (_)_ _ | (_)_ _  ___  | |_ __ _| |__| |___
+ *  | | ' \| | | ' \/ -_) |  _/ _` | '_ \ / -_)
+ *  |_|_||_|_|_|_||_\___|  \__\__,_|_.__/_\___|
+ */
+
+// ----------------------------------------------------------------------------
+// insert_value is the most complicated part of the toml spec.
+//
+// To parse a toml file correctly, we sometimes need to check an exising value
+// is appendable or not.
+//
+// For example while parsing an inline array of tables,
+//
+// ```toml
+// aot = [
+//   {a = "foo"},
+//   {a = "bar", b = "baz"},
+// ]
+// ```
+//
+// this `aot` is appendable until parser reaches to `]`. After that, it becomes
+// non-appendable.
+//
+// On the other hand, a normal array of tables, such as
+//
+// ```toml
+// [[aot]]
+// a = "foo"
+//
+// [[aot]]
+// a = "bar"
+// b = "baz"
+// ```
+// This `[[aot]]` is appendable until the parser reaches to the EOF.
+//
+//
+// It becomes a bit more difficult in case of dotted keys.
+// In TOML, it is allowed to append a key-value pair to a table that is
+// *implicitly* defined by a subtable definitino.
+//
+// ```toml
+// [x.y.z]
+// w = 123
+//
+// [x]
+// a = "foo" # OK. x is defined implicitly by `[x.y.z]`.
+// ```
+//
+// But if the table is defined by a dotted keys, it is not appendable.
+//
+// ```toml
+// [x]
+// y.z.w = 123
+//
+// [x.y]
+// # ERROR. x.y is already defined by a dotted table in the previous table.
+// ```
+//
+// Also, reopening a table using dotted keys is invalid.
+//
+// ```toml
+// [x.y.z]
+// w = 123
+//
+// [x]
+// y.z.v = 42 # ERROR. [x.y.z] is already defined.
+// ```
+//
+//
+// ```toml
+// [a]
+// b.c = "foo"
+// b.d = "bar"
+// ```
+//
+//
+// ```toml
+// a.b = "foo"
+// [a]
+// c = "bar" # ERROR
+// ```
+//
+// In summary,
+// - a table must be defined only once.
+// - assignment to an exising table is possible only when:
+//   - defining a subtable [x.y] to an existing table [x].
+//   - defining supertable [x] explicitly after [x.y].
+//   - adding dotted keys in the same table.
+
+enum class inserting_value_kind : std::uint8_t
+{
+    std_table,   // insert [standard.table]
+    array_table, // insert [[array.of.tables]]
+    dotted_keys  // insert a.b.c = "this"
+};
+
+template<typename TC>
+result<basic_value<TC>*, error_info>
+insert_value(const inserting_value_kind kind,
+    typename basic_value<TC>::table_type* current_table_ptr,
+    const std::vector<typename basic_value<TC>::key_type>& keys, region key_reg,
+    basic_value<TC> val)
+{
+    using value_type = basic_value<TC>;
+    using array_type = typename basic_value<TC>::array_type;
+    using table_type = typename basic_value<TC>::table_type;
+
+    auto key_loc = source_location(key_reg);
+
+    assert( ! keys.empty());
+
+    // dotted key can insert to dotted key tables defined at the same level.
+    // dotted key can NOT reopen a table even if it is implcitly-defined one.
+    //
+    // [x.y.z] # define x and x.y implicitly.
+    // a = 42
+    //
+    // [x] # reopening implcitly defined table
+    // r.s.t = 3.14 # VALID r and r.s are new tables.
+    // r.s.u = 2.71 # VALID r and r.s are dotted-key tables. valid.
+    //
+    // y.z.b = "foo" # INVALID x.y.z are multiline table, not a dotted key.
+    // y.c   = "bar" # INVALID x.y is implicit multiline table, not a dotted key.
+
+    // a table cannot reopen dotted-key tables.
+    //
+    // [t1]
+    // t2.t3.v = 0
+    // [t1.t2] # INVALID t1.t2 is defined as a dotted-key table.
+
+    for(std::size_t i=0; i<keys.size(); ++i)
+    {
+        const auto& key = keys.at(i);
+        table_type& current_table = *current_table_ptr;
+
+        if(i+1 < keys.size()) // there are more keys. go down recursively...
+        {
+            const auto found = current_table.find(key);
+            if(found == current_table.end()) // not found. add new table
+            {
+                table_format_info fmt;
+                fmt.indent_type = indent_char::none;
+                if(kind == inserting_value_kind::dotted_keys)
+                {
+                    fmt.fmt = table_format::dotted;
+                }
+                else // table / array of tables
+                {
+                    fmt.fmt = table_format::implicit;
+                }
+                current_table.emplace(key, value_type(
+                    table_type{}, fmt, std::vector<std::string>{}, key_reg));
+
+                assert(current_table.at(key).is_table());
+                current_table_ptr = std::addressof(current_table.at(key).as_table());
+            }
+            else if (found->second.is_table())
+            {
+                const auto fmt = found->second.as_table_fmt().fmt;
+                if(fmt == table_format::oneline || fmt == table_format::multiline_oneline)
+                {
+                    // foo = {bar = "baz"} or foo = { \n bar = "baz" \n }
+                    return err(make_error_info("toml::insert_value: "
+                        "failed to insert a value: inline table is immutable",
+                        key_loc, "inserting this",
+                        found->second.location(), "to this table"));
+                }
+                // dotted key cannot reopen a table.
+                if(kind ==inserting_value_kind::dotted_keys && fmt != table_format::dotted)
+                {
+                    return err(make_error_info("toml::insert_value: "
+                        "reopening a table using dotted keys",
+                        key_loc, "dotted key cannot reopen a table",
+                        found->second.location(), "this table is already closed"));
+                }
+                assert(found->second.is_table());
+                current_table_ptr = std::addressof(found->second.as_table());
+            }
+            else if(found->second.is_array_of_tables())
+            {
+                // aot = [{this = "type", of = "aot"}] # cannot be reopened
+                if(found->second.as_array_fmt().fmt != array_format::array_of_tables)
+                {
+                    return err(make_error_info("toml::insert_value:"
+                        "inline array of tables are immutable",
+                        key_loc, "inserting this",
+                        found->second.location(), "inline array of tables"));
+                }
+                // appending to [[aot]]
+
+                if(kind == inserting_value_kind::dotted_keys)
+                {
+                    // [[array.of.tables]]
+                    // [array.of]          # reopening supertable is okay
+                    // tables.x = "foo"    # appending `x` to the first table
+                    return err(make_error_info("toml::insert_value:"
+                        "dotted key cannot reopen an array-of-tables",
+                        key_loc, "inserting this",
+                        found->second.location(), "to this array-of-tables."));
+                }
+
+                // insert_value_by_dotkeys::std_table
+                // [[array.of.tables]]
+                // [array.of.tables.subtable] # appending to the last aot
+                //
+                // insert_value_by_dotkeys::array_table
+                // [[array.of.tables]]
+                // [[array.of.tables.subtable]] # appending to the last aot
+                auto& current_array_table = found->second.as_array().back();
+
+                assert(current_array_table.is_table());
+                current_table_ptr = std::addressof(current_array_table.as_table());
+            }
+            else
+            {
+                return err(make_error_info("toml::insert_value: "
+                    "failed to insert a value, value already exists",
+                    key_loc, "while inserting this",
+                    found->second.location(), "non-table value already exists"));
+            }
+        }
+        else // this is the last key. insert a new value.
+        {
+            switch(kind)
+            {
+                case inserting_value_kind::dotted_keys:
+                {
+                    if(current_table.find(key) != current_table.end())
+                    {
+                        return err(make_error_info("toml::insert_value: "
+                            "failed to insert a value, value already exists",
+                            key_loc, "inserting this",
+                            current_table.at(key).location(), "but value already exists"));
+                    }
+                    current_table.emplace(key, std::move(val));
+                    return ok(std::addressof(current_table.at(key)));
+                }
+                case inserting_value_kind::std_table:
+                {
+                    // defining a new table or reopening supertable
+                    auto found = current_table.find(key);
+                    if(found == current_table.end()) // define a new aot
+                    {
+                        current_table.emplace(key, std::move(val));
+                        return ok(std::addressof(current_table.at(key)));
+                    }
+                    else // the table is already defined, reopen it
+                    {
+                        // assigning a [std.table]. it must be an implicit table.
+                        auto& target = found->second;
+                        if( ! target.is_table() || // could be an array-of-tables
+                            target.as_table_fmt().fmt != table_format::implicit)
+                        {
+                            return err(make_error_info("toml::insert_value: "
+                                "failed to insert a table, table already defined",
+                                key_loc, "inserting this",
+                                target.location(), "this table is explicitly defined"));
+                        }
+
+                        // merge table
+                        for(const auto& kv : val.as_table())
+                        {
+                            if(target.contains(kv.first))
+                            {
+                                // [x.y.z]
+                                // w = "foo"
+                                // [x]
+                                // y = "bar"
+                                return err(make_error_info("toml::insert_value: "
+                                    "failed to insert a table, table keys conflict to each other",
+                                    key_loc, "inserting this table",
+                                    kv.second.location(), "having this value",
+                                    target.at(kv.first).location(), "already defined here"));
+                            }
+                            else
+                            {
+                                target[kv.first] = kv.second;
+                            }
+                        }
+                        // change implicit -> explicit
+                        target.as_table_fmt().fmt = table_format::multiline;
+                        // change definition region
+                        change_region_of_value(target, val);
+
+                        return ok(std::addressof(current_table.at(key)));
+                    }
+                }
+                case inserting_value_kind::array_table:
+                {
+                    auto found = current_table.find(key);
+                    if(found == current_table.end()) // define a new aot
+                    {
+                        array_format_info fmt;
+                        fmt.fmt = array_format::array_of_tables;
+                        fmt.indent_type = indent_char::none;
+
+                        current_table.emplace(key, value_type(
+                                array_type{ std::move(val) }, std::move(fmt),
+                                std::vector<std::string>{}, std::move(key_reg)
+                            ));
+
+                        assert( ! current_table.at(key).as_array().empty());
+                        return ok(std::addressof(current_table.at(key).as_array().back()));
+                    }
+                    else // the array is already defined, append to it
+                    {
+                        if( ! found->second.is_array_of_tables())
+                        {
+                            return err(make_error_info("toml::insert_value: "
+                                "failed to insert an array of tables, value already exists",
+                                key_loc, "while inserting this",
+                                found->second.location(), "non-table value already exists"));
+                        }
+                        if(found->second.as_array_fmt().fmt != array_format::array_of_tables)
+                        {
+                            return err(make_error_info("toml::insert_value: "
+                                "failed to insert a table, inline array of tables is immutable",
+                                key_loc, "while inserting this",
+                                found->second.location(), "this is inline array-of-tables"));
+                        }
+                        found->second.as_array().push_back(std::move(val));
+                        assert( ! current_table.at(key).as_array().empty());
+                        return ok(std::addressof(current_table.at(key).as_array().back()));
+                    }
+                }
+                default: {assert(false);}
+            }
+        }
+    }
+    return err(make_error_info("toml::insert_key: no keys found",
+                std::move(key_loc), "here"));
+}
+
+// ----------------------------------------------------------------------------
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_inline_table(location& loc, context<TC>& ctx)
+{
+    using table_type = typename basic_value<TC>::table_type;
+
+    const auto num_errors = ctx.errors().size();
+
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    if(loc.eof() || loc.current() != '{')
+    {
+        auto src = source_location(region(loc));
+        return err(make_error_info("toml::parse_inline_table: "
+            "The next token is not an inline table", std::move(src), "here"));
+    }
+    loc.advance();
+
+    table_type table;
+    table_format_info fmt;
+    fmt.fmt = table_format::oneline;
+    fmt.indent_type = indent_char::none;
+
+    cxx::optional<multiline_spacer<TC>> spacer(cxx::make_nullopt());
+
+    if(spec.v1_1_0_allow_newlines_in_inline_tables)
+    {
+        spacer = skip_multiline_spacer(loc, ctx);
+        if(spacer.has_value() && spacer.value().newline_found)
+        {
+            fmt.fmt = table_format::multiline_oneline;
+        }
+    }
+    else
+    {
+        skip_whitespace(loc, ctx);
+    }
+
+    bool still_empty = true;
+    bool comma_found = false;
+    while( ! loc.eof())
+    {
+        // closing!
+        if(loc.current() == '}')
+        {
+            if(comma_found && ! spec.v1_1_0_allow_trailing_comma_in_inline_tables)
+            {
+                auto src = source_location(region(loc));
+                return err(make_error_info("toml::parse_inline_table: trailing "
+                    "comma is not allowed in TOML-v1.0.0)", std::move(src), "here"));
+            }
+
+            if(spec.v1_1_0_allow_newlines_in_inline_tables)
+            {
+                if(spacer.has_value() && spacer.value().newline_found &&
+                    spacer.value().indent_type != indent_char::none)
+                {
+                    fmt.indent_type    = spacer.value().indent_type;
+                    fmt.closing_indent = spacer.value().indent;
+                }
+            }
+            break;
+        }
+
+        // if we already found a value and didn't found `,` nor `}`, error.
+        if( ! comma_found && ! still_empty)
+        {
+            auto src = source_location(region(loc));
+            return err(make_error_info("toml::parse_inline_table: "
+                    "expected value-separator `,` or closing `}`",
+                    std::move(src), "here"));
+        }
+
+        // parse indent.
+        if(spacer.has_value() && spacer.value().newline_found &&
+            spacer.value().indent_type != indent_char::none)
+        {
+            fmt.indent_type = spacer.value().indent_type;
+            fmt.body_indent = spacer.value().indent;
+        }
+
+        still_empty = false; // parsing a value...
+        if(auto kv_res = parse_key_value_pair<TC>(loc, ctx))
+        {
+            auto keys    = std::move(kv_res.unwrap().first.first);
+            auto key_reg = std::move(kv_res.unwrap().first.second);
+            auto val     = std::move(kv_res.unwrap().second);
+
+            auto ins_res = insert_value(inserting_value_kind::dotted_keys,
+                std::addressof(table), keys, std::move(key_reg), std::move(val));
+            if(ins_res.is_err())
+            {
+                ctx.report_error(std::move(ins_res.unwrap_err()));
+                // we need to skip until the next value (or end of the table)
+                // because we don't have valid kv pair.
+                while( ! loc.eof())
+                {
+                    const auto c = loc.current();
+                    if(c == ',' || c == '\n' || c == '}')
+                    {
+                        comma_found = (c == ',');
+                        break;
+                    }
+                    loc.advance();
+                }
+                continue;
+            }
+
+            // if comment line follows immediately(without newline) after `,`, then
+            // the comment is for the elem. we need to check if comment follows `,`.
+            //
+            // (key) = (val) (ws|newline|comment-line)? `,` (ws)? (comment)?
+
+            if(spec.v1_1_0_allow_newlines_in_inline_tables)
+            {
+                if(spacer.has_value()) // copy previous comments to value
+                {
+                    for(std::size_t i=0; i<spacer.value().comments.size(); ++i)
+                    {
+                        ins_res.unwrap()->comments().push_back(spacer.value().comments.at(i));
+                    }
+                }
+                spacer = skip_multiline_spacer(loc, ctx);
+                if(spacer.has_value())
+                {
+                    for(std::size_t i=0; i<spacer.value().comments.size(); ++i)
+                    {
+                        ins_res.unwrap()->comments().push_back(spacer.value().comments.at(i));
+                    }
+                    if(spacer.value().newline_found)
+                    {
+                        fmt.fmt = table_format::multiline_oneline;
+                        if(spacer.value().indent_type != indent_char::none)
+                        {
+                            fmt.indent_type = spacer.value().indent_type;
+                            fmt.body_indent = spacer.value().indent;
+                        }
+                    }
+                }
+            }
+            else
+            {
+                skip_whitespace(loc, ctx);
+            }
+
+            comma_found = character(',').scan(loc).is_ok();
+
+            if(spec.v1_1_0_allow_newlines_in_inline_tables)
+            {
+                auto com_res = parse_comment_line(loc, ctx);
+                if(com_res.is_err())
+                {
+                    ctx.report_error(com_res.unwrap_err());
+                }
+                const bool comment_found = com_res.is_ok() && com_res.unwrap().has_value();
+                if(comment_found)
+                {
+                    fmt.fmt = table_format::multiline_oneline;
+                    ins_res.unwrap()->comments().push_back(com_res.unwrap().value());
+                }
+                if(comma_found)
+                {
+                    spacer = skip_multiline_spacer(loc, ctx, comment_found);
+                    if(spacer.has_value() && spacer.value().newline_found)
+                    {
+                        fmt.fmt = table_format::multiline_oneline;
+                    }
+                }
+            }
+            else
+            {
+                skip_whitespace(loc, ctx);
+            }
+        }
+        else
+        {
+            ctx.report_error(std::move(kv_res.unwrap_err()));
+            while( ! loc.eof())
+            {
+                if(loc.current() == '}')
+                {
+                    break;
+                }
+                if( ! spec.v1_1_0_allow_newlines_in_inline_tables && loc.current() == '\n')
+                {
+                    break;
+                }
+                loc.advance();
+            }
+            break;
+        }
+    }
+
+    if(loc.current() != '}')
+    {
+        auto src = source_location(region(loc));
+        return err(make_error_info("toml::parse_inline_table: "
+            "missing closing bracket `}`",
+            std::move(src), "expected `}`, reached line end"));
+    }
+    else
+    {
+        loc.advance(); // skip }
+    }
+
+    // any error reported from this function
+    if(num_errors < ctx.errors().size())
+    {
+        assert(ctx.has_error()); // already reported
+        return err(ctx.pop_last_error());
+    }
+
+    basic_value<TC> retval(
+        std::move(table), std::move(fmt), {}, region(first, loc));
+
+    return ok(std::move(retval));
+}
+
+/* ============================================================================
+ *            _
+ *  __ ____ _| |_  _ ___
+ *  \ V / _` | | || / -_)
+ *   \_/\__,_|_|\_,_\___|
+ */
+
+template<typename TC>
+result<value_t, error_info>
+guess_number_type(const location& first, const context<TC>& ctx)
+{
+    const auto& spec = ctx.toml_spec();
+    location loc = first;
+
+    if(syntax::offset_datetime(spec).scan(loc).is_ok())
+    {
+        return ok(value_t::offset_datetime);
+    }
+    loc = first;
+
+    if(syntax::local_datetime(spec).scan(loc).is_ok())
+    {
+        const auto curr = loc.current();
+        // if offset_datetime contains bad offset, it syntax::offset_datetime
+        // fails to scan it.
+        if(curr == '+' || curr == '-')
+        {
+            return err(make_syntax_error("bad offset: must be [+-]HH:MM or Z",
+                syntax::time_offset(spec), loc, std::string(
+                "Hint: valid  : +09:00, -05:30\n"
+                "Hint: invalid: +9:00,  -5:30\n")));
+        }
+        return ok(value_t::local_datetime);
+    }
+    loc = first;
+
+    if(syntax::local_date(spec).scan(loc).is_ok())
+    {
+        // bad time may appear after this.
+
+        if( ! loc.eof())
+        {
+            const auto c = loc.current();
+            if(c == 'T' || c == 't')
+            {
+                loc.advance();
+
+                return err(make_syntax_error("bad time: must be HH:MM:SS.subsec",
+                    syntax::local_time(spec), loc, std::string(
+                    "Hint: valid  : 1979-05-27T07:32:00, 1979-05-27 07:32:00.999999\n"
+                    "Hint: invalid: 1979-05-27T7:32:00, 1979-05-27 17:32\n")));
+            }
+            if(c == ' ')
+            {
+                // A space is allowed as a delimiter between local time.
+                // But there is a case where bad time follows a space.
+                // - invalid: 2019-06-16 7:00:00
+                // - valid  : 2019-06-16 07:00:00
+                loc.advance();
+                if( ! loc.eof() && ('0' <= loc.current() && loc.current() <= '9'))
+                {
+                    return err(make_syntax_error("bad time: must be HH:MM:SS.subsec",
+                        syntax::local_time(spec), loc, std::string(
+                        "Hint: valid  : 1979-05-27T07:32:00, 1979-05-27 07:32:00.999999\n"
+                        "Hint: invalid: 1979-05-27T7:32:00, 1979-05-27 17:32\n")));
+                }
+            }
+            if('0' <= c && c <= '9')
+            {
+                return err(make_syntax_error("bad datetime: missing T or space",
+                    character_either("Tt "), loc, std::string(
+                    "Hint: valid  : 1979-05-27T07:32:00, 1979-05-27 07:32:00.999999\n"
+                    "Hint: invalid: 1979-05-27T7:32:00, 1979-05-27 17:32\n")));
+            }
+        }
+        return ok(value_t::local_date);
+    }
+    loc = first;
+
+    if(syntax::local_time(spec).scan(loc).is_ok())
+    {
+        return ok(value_t::local_time);
+    }
+    loc = first;
+
+    if(syntax::floating(spec).scan(loc).is_ok())
+    {
+        if( ! loc.eof() && loc.current() == '_')
+        {
+            if(spec.ext_num_suffix && syntax::num_suffix(spec).scan(loc).is_ok())
+            {
+                return ok(value_t::floating);
+            }
+            auto src = source_location(region(loc));
+            return err(make_error_info(
+                "bad float: `_` must be surrounded by digits",
+                std::move(src), "invalid underscore",
+                "Hint: valid  : +1.0, -2e-2, 3.141_592_653_589, inf, nan\n"
+                "Hint: invalid: .0, 1., _1.0, 1.0_, 1_.0, 1.0__0\n"));
+        }
+        return ok(value_t::floating);
+    }
+    loc = first;
+
+    if(spec.ext_hex_float)
+    {
+        if(syntax::hex_floating(spec).scan(loc).is_ok())
+        {
+            if( ! loc.eof() && loc.current() == '_')
+            {
+                if(spec.ext_num_suffix && syntax::num_suffix(spec).scan(loc).is_ok())
+                {
+                    return ok(value_t::floating);
+                }
+                auto src = source_location(region(loc));
+                return err(make_error_info(
+                    "bad float: `_` must be surrounded by digits",
+                    std::move(src), "invalid underscore",
+                    "Hint: valid  : +1.0, -2e-2, 3.141_592_653_589, inf, nan\n"
+                    "Hint: invalid: .0, 1., _1.0, 1.0_, 1_.0, 1.0__0\n"));
+            }
+            return ok(value_t::floating);
+        }
+        loc = first;
+    }
+
+    if(auto int_reg = syntax::integer(spec).scan(loc))
+    {
+        if( ! loc.eof())
+        {
+            const auto c = loc.current();
+            if(c == '_')
+            {
+                if(spec.ext_num_suffix && syntax::num_suffix(spec).scan(loc).is_ok())
+                {
+                    return ok(value_t::integer);
+                }
+
+                if(int_reg.length() <= 2 && (int_reg.as_string() == "0" ||
+                    int_reg.as_string() == "-0" || int_reg.as_string() == "+0"))
+                {
+                    auto src = source_location(region(loc));
+                    return err(make_error_info(
+                        "bad integer: leading zero is not allowed in decimal int",
+                        std::move(src), "leading zero",
+                        "Hint: valid  : -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755\n"
+                        "Hint: invalid: _42, 1__000, 0123\n"));
+                }
+                else
+                {
+                    auto src = source_location(region(loc));
+                    return err(make_error_info(
+                        "bad integer: `_` must be surrounded by digits",
+                        std::move(src), "invalid underscore",
+                        "Hint: valid  : -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755\n"
+                        "Hint: invalid: _42, 1__000, 0123\n"));
+                }
+            }
+            if('0' <= c && c <= '9')
+            {
+                if(loc.current() == '0')
+                {
+                    loc.retrace();
+                    return err(make_error_info(
+                        "bad integer: leading zero",
+                        source_location(region(loc)), "leading zero is not allowed",
+                        std::string("Hint: valid  : -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755\n"
+                                    "Hint: invalid: _42, 1__000, 0123\n")
+                        ));
+                }
+                else // invalid digits, especially in oct/bin ints.
+                {
+                    return err(make_error_info(
+                        "bad integer: invalid digit after an integer",
+                        source_location(region(loc)), "this digit is not allowed",
+                        std::string("Hint: valid  : -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755\n"
+                                    "Hint: invalid: _42, 1__000, 0123\n")
+                        ));
+                }
+            }
+            if(c == ':' || c == '-')
+            {
+                auto src = source_location(region(loc));
+                return err(make_error_info("bad datetime: invalid format",
+                    std::move(src), "here",
+                    std::string("Hint: valid  : 1979-05-27T07:32:00-07:00, 1979-05-27 07:32:00.999999Z\n"
+                                "Hint: invalid: 1979-05-27T7:32:00-7:00, 1979-05-27 7:32-00:30")
+                    ));
+            }
+            if(c == '.' || c == 'e' || c == 'E')
+            {
+                auto src = source_location(region(loc));
+                return err(make_error_info("bad float: invalid format",
+                    std::move(src), "here", std::string(
+                    "Hint: valid  : +1.0, -2e-2, 3.141_592_653_589, inf, nan\n"
+                    "Hint: invalid: .0, 1., _1.0, 1.0_, 1_.0, 1.0__0\n")));
+            }
+        }
+        return ok(value_t::integer);
+    }
+    if( ! loc.eof() && loc.current() == '.')
+    {
+        auto src = source_location(region(loc));
+        return err(make_error_info("bad float: integer part is required before decimal point",
+            std::move(src), "missing integer part", std::string(
+            "Hint: valid  : +1.0, -2e-2, 3.141_592_653_589, inf, nan\n"
+            "Hint: invalid: .0, 1., _1.0, 1.0_, 1_.0, 1.0__0\n")
+            ));
+    }
+    if( ! loc.eof() && loc.current() == '_')
+    {
+        auto src = source_location(region(loc));
+        return err(make_error_info("bad number: `_` must be surrounded by digits",
+            std::move(src), "digits required before `_`", std::string(
+            "Hint: valid  : -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755\n"
+            "Hint: invalid: _42, 1__000, 0123\n")
+            ));
+    }
+
+    auto src = source_location(region(loc));
+    return err(make_error_info("bad format: unknown value appeared",
+                std::move(src), "here"));
+}
+
+template<typename TC>
+result<value_t, error_info>
+guess_value_type(const location& loc, const context<TC>& ctx)
+{
+    const auto& sp = ctx.toml_spec();
+    location inner(loc);
+
+    switch(loc.current())
+    {
+        case '"' : {return ok(value_t::string);  }
+        case '\'': {return ok(value_t::string);  }
+        case '[' : {return ok(value_t::array);   }
+        case '{' : {return ok(value_t::table);   }
+        case 't' :
+        {
+            return ok(value_t::boolean);
+        }
+        case 'f' :
+        {
+            return ok(value_t::boolean);
+        }
+        case 'T' : // invalid boolean.
+        {
+            return err(make_syntax_error("toml::parse_value: "
+                "`true` must be in lowercase. "
+                "A string must be surrounded by quotes.",
+                syntax::boolean(sp), inner));
+        }
+        case 'F' :
+        {
+            return err(make_syntax_error("toml::parse_value: "
+                "`false` must be in lowercase. "
+                "A string must be surrounded by quotes.",
+                syntax::boolean(sp), inner));
+        }
+        case 'i' : // inf or string without quotes(syntax error).
+        {
+            if(literal("inf").scan(inner).is_ok())
+            {
+                return ok(value_t::floating);
+            }
+            else
+            {
+                return err(make_syntax_error("toml::parse_value: "
+                    "`inf` must be in lowercase. "
+                    "A string must be surrounded by quotes.",
+                    syntax::floating(sp), inner));
+            }
+        }
+        case 'I' : // Inf or string without quotes(syntax error).
+        {
+            return err(make_syntax_error("toml::parse_value: "
+                "`inf` must be in lowercase. "
+                "A string must be surrounded by quotes.",
+                syntax::floating(sp), inner));
+        }
+        case 'n' : // nan or null-extension
+        {
+            if(sp.ext_null_value)
+            {
+                if(literal("nan").scan(inner).is_ok())
+                {
+                    return ok(value_t::floating);
+                }
+                else if(literal("null").scan(inner).is_ok())
+                {
+                    return ok(value_t::empty);
+                }
+                else
+                {
+                    return err(make_syntax_error("toml::parse_value: "
+                        "Both `nan` and `null` must be in lowercase. "
+                        "A string must be surrounded by quotes.",
+                        syntax::floating(sp), inner));
+                }
+            }
+            else // must be nan.
+            {
+                if(literal("nan").scan(inner).is_ok())
+                {
+                    return ok(value_t::floating);
+                }
+                else
+                {
+                    return err(make_syntax_error("toml::parse_value: "
+                        "`nan` must be in lowercase. "
+                        "A string must be surrounded by quotes.",
+                        syntax::floating(sp), inner));
+                }
+            }
+        }
+        case 'N' : // nan or null-extension
+        {
+            if(sp.ext_null_value)
+            {
+                return err(make_syntax_error("toml::parse_value: "
+                    "Both `nan` and `null` must be in lowercase. "
+                    "A string must be surrounded by quotes.",
+                    syntax::floating(sp), inner));
+            }
+            else
+            {
+                return err(make_syntax_error("toml::parse_value: "
+                    "`nan` must be in lowercase. "
+                    "A string must be surrounded by quotes.",
+                    syntax::floating(sp), inner));
+            }
+        }
+        default  :
+        {
+            return guess_number_type(loc, ctx);
+        }
+    }
+}
+
+template<typename TC>
+result<basic_value<TC>, error_info>
+parse_value(location& loc, context<TC>& ctx)
+{
+    const auto ty_res = guess_value_type(loc, ctx);
+    if(ty_res.is_err())
+    {
+        return err(ty_res.unwrap_err());
+    }
+
+    switch(ty_res.unwrap())
+    {
+        case value_t::empty:
+        {
+            if(ctx.toml_spec().ext_null_value)
+            {
+                return parse_null(loc, ctx);
+            }
+            else
+            {
+                auto src = source_location(region(loc));
+                return err(make_error_info("toml::parse_value: unknown value appeared",
+                            std::move(src), "here"));
+            }
+        }
+        case value_t::boolean        : {return parse_boolean        (loc, ctx);}
+        case value_t::integer        : {return parse_integer        (loc, ctx);}
+        case value_t::floating       : {return parse_floating       (loc, ctx);}
+        case value_t::string         : {return parse_string         (loc, ctx);}
+        case value_t::offset_datetime: {return parse_offset_datetime(loc, ctx);}
+        case value_t::local_datetime : {return parse_local_datetime (loc, ctx);}
+        case value_t::local_date     : {return parse_local_date     (loc, ctx);}
+        case value_t::local_time     : {return parse_local_time     (loc, ctx);}
+        case value_t::array          : {return parse_array          (loc, ctx);}
+        case value_t::table          : {return parse_inline_table   (loc, ctx);}
+        default:
+        {
+            auto src = source_location(region(loc));
+            return err(make_error_info("toml::parse_value: unknown value appeared",
+                        std::move(src), "here"));
+        }
+    }
+}
+
+/* ============================================================================
+ *  _____     _    _
+ * |_   _|_ _| |__| |___
+ *   | |/ _` | '_ \ / -_)
+ *   |_|\__,_|_.__/_\___|
+ */
+
+template<typename TC>
+result<std::pair<std::vector<typename basic_value<TC>::key_type>, region>, error_info>
+parse_table_key(location& loc, context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    auto reg = syntax::std_table(spec).scan(loc);
+    if(!reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_table_key: invalid table key",
+            syntax::std_table(spec), loc));
+    }
+
+    loc = first;
+    loc.advance(); // skip [
+    skip_whitespace(loc, ctx);
+
+    auto keys_res = parse_key(loc, ctx);
+    if(keys_res.is_err())
+    {
+        return err(std::move(keys_res.unwrap_err()));
+    }
+
+    skip_whitespace(loc, ctx);
+    loc.advance(); // ]
+
+    return ok(std::make_pair(std::move(keys_res.unwrap().first), std::move(reg)));
+}
+
+template<typename TC>
+result<std::pair<std::vector<typename basic_value<TC>::key_type>, region>, error_info>
+parse_array_table_key(location& loc, context<TC>& ctx)
+{
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    auto reg = syntax::array_table(spec).scan(loc);
+    if(!reg.is_ok())
+    {
+        return err(make_syntax_error("toml::parse_array_table_key: invalid array-of-tables key",
+            syntax::array_table(spec), loc));
+    }
+
+    loc = first;
+    loc.advance(); // [
+    loc.advance(); // [
+    skip_whitespace(loc, ctx);
+
+    auto keys_res = parse_key(loc, ctx);
+    if(keys_res.is_err())
+    {
+        return err(std::move(keys_res.unwrap_err()));
+    }
+
+    skip_whitespace(loc, ctx);
+    loc.advance(); // ]
+    loc.advance(); // ]
+
+    return ok(std::make_pair(std::move(keys_res.unwrap().first), std::move(reg)));
+}
+
+// called after reading [table.keys] and comments around it.
+// Since table may already contain a subtable ([x.y.z] can be defined before [x]),
+// the table that is being parsed is passed as an argument.
+template<typename TC>
+result<none_t, error_info>
+parse_table(location& loc, context<TC>& ctx, basic_value<TC>& table)
+{
+    assert(table.is_table());
+
+    const auto num_errors = ctx.errors().size();
+    const auto& spec = ctx.toml_spec();
+
+    // clear indent info
+    table.as_table_fmt().indent_type = indent_char::none;
+
+    bool newline_found = true;
+    while( ! loc.eof())
+    {
+        const auto start = loc;
+
+        auto sp = skip_multiline_spacer(loc, ctx, newline_found);
+
+        // if reached to EOF, the table ends here. return.
+        if(loc.eof())
+        {
+            break;
+        }
+        // if next table is comming, return.
+        if(sequence(syntax::ws(spec), character('[')).scan(loc).is_ok())
+        {
+            loc = start;
+            break;
+        }
+        // otherwise, it should be a key-value pair.
+        newline_found = newline_found || (sp.has_value() && sp.value().newline_found);
+        if( ! newline_found)
+        {
+            return err(make_error_info("toml::parse_table: "
+                "newline (LF / CRLF) or EOF is expected",
+                source_location(region(loc)), "here"));
+        }
+        if(sp.has_value() && sp.value().indent_type != indent_char::none)
+        {
+            table.as_table_fmt().indent_type = sp.value().indent_type;
+            table.as_table_fmt().body_indent = sp.value().indent;
+        }
+
+        newline_found = false; // reset
+        if(auto kv_res = parse_key_value_pair(loc, ctx))
+        {
+            auto keys    = std::move(kv_res.unwrap().first.first);
+            auto key_reg = std::move(kv_res.unwrap().first.second);
+            auto val     = std::move(kv_res.unwrap().second);
+
+            if(sp.has_value())
+            {
+                for(const auto& com : sp.value().comments)
+                {
+                    val.comments().push_back(com);
+                }
+            }
+
+            if(auto com_res = parse_comment_line(loc, ctx))
+            {
+                if(auto com_opt = com_res.unwrap())
+                {
+                    val.comments().push_back(com_opt.value());
+                    newline_found = true; // comment includes newline at the end
+                }
+            }
+            else
+            {
+                ctx.report_error(std::move(com_res.unwrap_err()));
+            }
+
+            auto ins_res = insert_value(inserting_value_kind::dotted_keys,
+                    std::addressof(table.as_table()),
+                    keys, std::move(key_reg), std::move(val));
+            if(ins_res.is_err())
+            {
+                ctx.report_error(std::move(ins_res.unwrap_err()));
+            }
+        }
+        else
+        {
+            ctx.report_error(std::move(kv_res.unwrap_err()));
+            skip_key_value_pair(loc, ctx);
+        }
+    }
+
+    if(num_errors < ctx.errors().size())
+    {
+        assert(ctx.has_error()); // already reported
+        return err(ctx.pop_last_error());
+    }
+    return ok();
+}
+
+template<typename TC>
+result<basic_value<TC>, std::vector<error_info>>
+parse_file(location& loc, context<TC>& ctx)
+{
+    using value_type = basic_value<TC>;
+    using table_type = typename value_type::table_type;
+
+    const auto first = loc;
+    const auto& spec = ctx.toml_spec();
+
+    if(loc.eof())
+    {
+        return ok(value_type(table_type(), table_format_info{}, {}, region(loc)));
+    }
+
+    value_type root(table_type(), table_format_info{}, {}, region(loc));
+    root.as_table_fmt().fmt = table_format::multiline;
+    root.as_table_fmt().indent_type = indent_char::none;
+
+    // parse top comment.
+    //
+    // ```toml
+    // # this is a comment for the top-level table.
+    //
+    // key = "the first value"
+    // ```
+    //
+    // ```toml
+    // # this is a comment for "the first value".
+    // key = "the first value"
+    // ```
+    while( ! loc.eof())
+    {
+        if(auto com_res = parse_comment_line(loc, ctx))
+        {
+            if(auto com_opt = com_res.unwrap())
+            {
+                root.comments().push_back(std::move(com_opt.value()));
+            }
+            else // no comment found.
+            {
+                // if it is not an empty line, clear the root comment.
+                if( ! sequence(syntax::ws(spec), syntax::newline(spec)).scan(loc).is_ok())
+                {
+                    loc = first;
+                    root.comments().clear();
+                }
+                break;
+            }
+        }
+        else
+        {
+            ctx.report_error(std::move(com_res.unwrap_err()));
+            skip_comment_block(loc, ctx);
+        }
+    }
+
+    // parse root table
+    {
+        const auto res = parse_table(loc, ctx, root);
+        if(res.is_err())
+        {
+            ctx.report_error(std::move(res.unwrap_err()));
+            skip_until_next_table(loc, ctx);
+        }
+    }
+
+    // parse tables
+
+    while( ! loc.eof())
+    {
+        auto sp = skip_multiline_spacer(loc, ctx, /*newline_found=*/true);
+
+        if(auto key_res = parse_array_table_key(loc, ctx))
+        {
+            auto key = std::move(std::get<0>(key_res.unwrap()));
+            auto reg = std::move(std::get<1>(key_res.unwrap()));
+
+            std::vector<std::string> com;
+            if(sp.has_value())
+            {
+                for(std::size_t i=0; i<sp.value().comments.size(); ++i)
+                {
+                    com.push_back(std::move(sp.value().comments.at(i)));
+                }
+            }
+
+            // [table.def] must be followed by one of
+            // - a comment line
+            // - whitespace + newline
+            // - EOF
+            if(auto com_res = parse_comment_line(loc, ctx))
+            {
+                if(auto com_opt = com_res.unwrap())
+                {
+                    com.push_back(com_opt.value());
+                }
+                else // if there is no comment, ws+newline must exist (or EOF)
+                {
+                    skip_whitespace(loc, ctx);
+                    if( ! loc.eof() && ! syntax::newline(ctx.toml_spec()).scan(loc).is_ok())
+                    {
+                        ctx.report_error(make_syntax_error("toml::parse_file: "
+                            "newline (or EOF) expected",
+                            syntax::newline(ctx.toml_spec()), loc));
+                        skip_until_next_table(loc, ctx);
+                        continue;
+                    }
+                }
+            }
+            else // comment syntax error (rare)
+            {
+                ctx.report_error(com_res.unwrap_err());
+                skip_until_next_table(loc, ctx);
+                continue;
+            }
+
+            table_format_info fmt;
+            fmt.fmt = table_format::multiline;
+            fmt.indent_type = indent_char::none;
+            auto tab = value_type(table_type{}, std::move(fmt), std::move(com), reg);
+
+            auto inserted = insert_value(inserting_value_kind::array_table,
+                std::addressof(root.as_table()),
+                key, std::move(reg), std::move(tab));
+
+            if(inserted.is_err())
+            {
+                ctx.report_error(inserted.unwrap_err());
+
+                // check errors in the table
+                auto tmp = basic_value<TC>(table_type());
+                auto res = parse_table(loc, ctx, tmp);
+                if(res.is_err())
+                {
+                    ctx.report_error(res.unwrap_err());
+                    skip_until_next_table(loc, ctx);
+                }
+                continue;
+            }
+
+            auto tab_ptr = inserted.unwrap();
+            assert(tab_ptr);
+
+            const auto tab_res = parse_table(loc, ctx, *tab_ptr);
+            if(tab_res.is_err())
+            {
+                ctx.report_error(tab_res.unwrap_err());
+                skip_until_next_table(loc, ctx);
+            }
+
+            // parse_table first clears `indent_type`.
+            // to keep header indent info, we must store it later.
+            if(sp.has_value() && sp.value().indent_type != indent_char::none)
+            {
+                tab_ptr->as_table_fmt().indent_type = sp.value().indent_type;
+                tab_ptr->as_table_fmt().name_indent = sp.value().indent;
+            }
+            continue;
+        }
+        if(auto key_res = parse_table_key(loc, ctx))
+        {
+            auto key = std::move(std::get<0>(key_res.unwrap()));
+            auto reg = std::move(std::get<1>(key_res.unwrap()));
+
+            std::vector<std::string> com;
+            if(sp.has_value())
+            {
+                for(std::size_t i=0; i<sp.value().comments.size(); ++i)
+                {
+                    com.push_back(std::move(sp.value().comments.at(i)));
+                }
+            }
+
+            // [table.def] must be followed by one of
+            // - a comment line
+            // - whitespace + newline
+            // - EOF
+            if(auto com_res = parse_comment_line(loc, ctx))
+            {
+                if(auto com_opt = com_res.unwrap())
+                {
+                    com.push_back(com_opt.value());
+                }
+                else // if there is no comment, ws+newline must exist (or EOF)
+                {
+                    skip_whitespace(loc, ctx);
+                    if( ! loc.eof() && ! syntax::newline(ctx.toml_spec()).scan(loc).is_ok())
+                    {
+                        ctx.report_error(make_syntax_error("toml::parse_file: "
+                            "newline (or EOF) expected",
+                            syntax::newline(ctx.toml_spec()), loc));
+                        skip_until_next_table(loc, ctx);
+                        continue;
+                    }
+                }
+            }
+            else // comment syntax error (rare)
+            {
+                ctx.report_error(com_res.unwrap_err());
+                skip_until_next_table(loc, ctx);
+                continue;
+            }
+
+            table_format_info fmt;
+            fmt.fmt = table_format::multiline;
+            fmt.indent_type = indent_char::none;
+            auto tab = value_type(table_type{}, std::move(fmt), std::move(com), reg);
+
+            auto inserted = insert_value(inserting_value_kind::std_table,
+                std::addressof(root.as_table()),
+                key, std::move(reg), std::move(tab));
+
+            if(inserted.is_err())
+            {
+                ctx.report_error(inserted.unwrap_err());
+
+                // check errors in the table
+                auto tmp = basic_value<TC>(table_type());
+                auto res = parse_table(loc, ctx, tmp);
+                if(res.is_err())
+                {
+                    ctx.report_error(res.unwrap_err());
+                    skip_until_next_table(loc, ctx);
+                }
+                continue;
+            }
+
+            auto tab_ptr = inserted.unwrap();
+            assert(tab_ptr);
+
+            const auto tab_res = parse_table(loc, ctx, *tab_ptr);
+            if(tab_res.is_err())
+            {
+                ctx.report_error(tab_res.unwrap_err());
+                skip_until_next_table(loc, ctx);
+            }
+            if(sp.has_value() && sp.value().indent_type != indent_char::none)
+            {
+                tab_ptr->as_table_fmt().indent_type = sp.value().indent_type;
+                tab_ptr->as_table_fmt().name_indent = sp.value().indent;
+            }
+            continue;
+        }
+
+        // does not match array_table nor std_table. report an error.
+        const auto keytop = loc;
+        const auto maybe_array_of_tables = literal("[[").scan(loc).is_ok();
+        loc = keytop;
+
+        if(maybe_array_of_tables)
+        {
+            ctx.report_error(make_syntax_error("toml::parse_file: invalid array-table key",
+                syntax::array_table(spec), loc));
+        }
+        else
+        {
+            ctx.report_error(make_syntax_error("toml::parse_file: invalid table key",
+                syntax::std_table(spec), loc));
+        }
+        skip_until_next_table(loc, ctx);
+    }
+
+    if( ! ctx.errors().empty())
+    {
+        return err(std::move(ctx.errors()));
+    }
+
+#ifdef TOML11_ENABLE_ACCESS_CHECK
+    detail::unset_access_flag_recursively(root);
+#endif
+
+    return ok(std::move(root));
+}
+
+template<typename TC>
+result<basic_value<TC>, std::vector<error_info>>
+parse_impl(std::vector<location::char_type> cs, std::string fname, const spec& s)
+{
+    using value_type = basic_value<TC>;
+    using table_type = typename value_type::table_type;
+
+    // an empty file is a valid toml file.
+    if(cs.empty())
+    {
+        auto src = std::make_shared<std::vector<location::char_type>>(std::move(cs));
+        location loc(std::move(src), std::move(fname));
+        return ok(value_type(table_type(), table_format_info{}, std::vector<std::string>{}, region(loc)));
+    }
+
+    // to simplify parser, add newline at the end if there is no LF.
+    // But, if it has raw CR, the file is invalid (in TOML, CR is not a valid
+    // newline char). if it ends with CR, do not add LF and report it.
+    if(cs.back() != '\n' && cs.back() != '\r')
+    {
+        cs.push_back('\n');
+    }
+
+    auto src = std::make_shared<std::vector<location::char_type>>(std::move(cs));
+
+    location loc(std::move(src), std::move(fname));
+
+    // skip BOM if found
+    if(loc.source()->size() >= 3)
+    {
+        auto first = loc;
+
+        const auto c0 = loc.current(); loc.advance();
+        const auto c1 = loc.current(); loc.advance();
+        const auto c2 = loc.current(); loc.advance();
+
+        const auto bom_found = (c0 == 0xEF) && (c1 == 0xBB) && (c2 == 0xBF);
+        if( ! bom_found)
+        {
+            loc = first;
+        }
+    }
+
+    context<TC> ctx(s);
+
+    return parse_file(loc, ctx);
+}
+
+} // detail
+
+// -----------------------------------------------------------------------------
+// parse(byte array)
+
+template<typename TC = type_config>
+result<basic_value<TC>, std::vector<error_info>>
+try_parse(std::vector<unsigned char> content, std::string filename,
+          spec s = spec::default_version())
+{
+    return detail::parse_impl<TC>(std::move(content), std::move(filename), std::move(s));
+}
+template<typename TC = type_config>
+basic_value<TC>
+parse(std::vector<unsigned char> content, std::string filename,
+      spec s = spec::default_version())
+{
+    auto res = try_parse<TC>(std::move(content), std::move(filename), std::move(s));
+    if(res.is_ok())
+    {
+        return res.unwrap();
+    }
+    else
+    {
+        std::string msg;
+        for(const auto& err : res.unwrap_err())
+        {
+            msg += format_error(err);
+        }
+        throw syntax_error(std::move(msg), std::move(res.unwrap_err()));
+    }
+}
+
+// -----------------------------------------------------------------------------
+// parse(istream)
+
+template<typename TC = type_config>
+result<basic_value<TC>, std::vector<error_info>>
+try_parse(std::istream& is, std::string fname = "unknown file", spec s = spec::default_version())
+{
+    const auto beg = is.tellg();
+    is.seekg(0, std::ios::end);
+    const auto end = is.tellg();
+    const auto fsize = end - beg;
+    is.seekg(beg);
+
+    // read whole file as a sequence of char
+    assert(fsize >= 0);
+    std::vector<detail::location::char_type> letters(static_cast<std::size_t>(fsize), '\0');
+    is.read(reinterpret_cast<char*>(letters.data()), static_cast<std::streamsize>(fsize));
+
+    return detail::parse_impl<TC>(std::move(letters), std::move(fname), std::move(s));
+}
+
+template<typename TC = type_config>
+basic_value<TC> parse(std::istream& is, std::string fname = "unknown file", spec s = spec::default_version())
+{
+    auto res = try_parse<TC>(is, std::move(fname), std::move(s));
+    if(res.is_ok())
+    {
+        return res.unwrap();
+    }
+    else
+    {
+        std::string msg;
+        for(const auto& err : res.unwrap_err())
+        {
+            msg += format_error(err);
+        }
+        throw syntax_error(std::move(msg), std::move(res.unwrap_err()));
+    }
+}
+
+// -----------------------------------------------------------------------------
+// parse(filename)
+
+template<typename TC = type_config>
+result<basic_value<TC>, std::vector<error_info>>
+try_parse(std::string fname, spec s = spec::default_version())
+{
+    std::ifstream ifs(fname, std::ios_base::binary);
+    if(!ifs.good())
+    {
+        std::vector<error_info> e;
+        e.push_back(error_info("toml::parse: Error opening file \"" + fname + "\"", {}));
+        return err(std::move(e));
+    }
+    ifs.exceptions(std::ifstream::failbit | std::ifstream::badbit);
+
+    return try_parse<TC>(ifs, std::move(fname), std::move(s));
+}
+
+template<typename TC = type_config>
+basic_value<TC> parse(std::string fname, spec s = spec::default_version())
+{
+    std::ifstream ifs(fname, std::ios_base::binary);
+    if(!ifs.good())
+    {
+        throw file_io_error("toml::parse: error opening file", fname);
+    }
+    ifs.exceptions(std::ifstream::failbit | std::ifstream::badbit);
+
+    return parse<TC>(ifs, std::move(fname), std::move(s));
+}
+
+template<typename TC = type_config, std::size_t N>
+result<basic_value<TC>, std::vector<error_info>>
+try_parse(const char (&fname)[N], spec s = spec::default_version())
+{
+    return try_parse<TC>(std::string(fname), std::move(s));
+}
+
+template<typename TC = type_config, std::size_t N>
+basic_value<TC> parse(const char (&fname)[N], spec s = spec::default_version())
+{
+    return parse<TC>(std::string(fname), std::move(s));
+}
+
+// ----------------------------------------------------------------------------
+// parse_str
+
+template<typename TC = type_config>
+result<basic_value<TC>, std::vector<error_info>>
+try_parse_str(std::string content, spec s = spec::default_version(),
+              cxx::source_location loc = cxx::source_location::current())
+{
+    std::istringstream iss(std::move(content));
+    std::string name("internal string" + cxx::to_string(loc));
+    return try_parse<TC>(iss, std::move(name), std::move(s));
+}
+
+template<typename TC = type_config>
+basic_value<TC> parse_str(std::string content, spec s = spec::default_version(),
+        cxx::source_location loc = cxx::source_location::current())
+{
+    auto res = try_parse_str<TC>(std::move(content), std::move(s), std::move(loc));
+    if(res.is_ok())
+    {
+        return res.unwrap();
+    }
+    else
+    {
+        std::string msg;
+        for(const auto& err : res.unwrap_err())
+        {
+            msg += format_error(err);
+        }
+        throw syntax_error(std::move(msg), std::move(res.unwrap_err()));
+    }
+}
+
+// ----------------------------------------------------------------------------
+// filesystem
+
+#if defined(TOML11_HAS_FILESYSTEM)
+
+template<typename TC = type_config, typename FSPATH>
+cxx::enable_if_t<std::is_same<FSPATH, std::filesystem::path>::value,
+    result<basic_value<TC>, std::vector<error_info>>>
+try_parse(const FSPATH& fpath, spec s = spec::default_version())
+{
+    std::ifstream ifs(fpath, std::ios_base::binary);
+    if(!ifs.good())
+    {
+        std::vector<error_info> e;
+        e.push_back(error_info("toml::parse: Error opening file \"" + fpath.string() + "\"", {}));
+        return err(std::move(e));
+    }
+    ifs.exceptions(std::ifstream::failbit | std::ifstream::badbit);
+
+    return try_parse<TC>(ifs, fpath.string(), std::move(s));
+}
+
+template<typename TC = type_config, typename FSPATH>
+cxx::enable_if_t<std::is_same<FSPATH, std::filesystem::path>::value,
+    basic_value<TC>>
+parse(const FSPATH& fpath, spec s = spec::default_version())
+{
+    std::ifstream ifs(fpath, std::ios_base::binary);
+    if(!ifs.good())
+    {
+        throw file_io_error("toml::parse: error opening file", fpath.string());
+    }
+    ifs.exceptions(std::ifstream::failbit | std::ifstream::badbit);
+
+    return parse<TC>(ifs, fpath.string(), std::move(s));
+}
+#endif
+
+// -----------------------------------------------------------------------------
+// FILE*
+
+template<typename TC = type_config>
+result<basic_value<TC>, std::vector<error_info>>
+try_parse(FILE* fp, std::string filename, spec s = spec::default_version())
+{
+    const long beg = std::ftell(fp);
+    if (beg == -1L)
+    {
+        return err(std::vector<error_info>{error_info(
+            std::string("Failed to access: \"") + filename +
+            "\", errno = " + std::to_string(errno), {}
+        )});
+    }
+
+    const int res_seekend = std::fseek(fp, 0, SEEK_END);
+    if (res_seekend != 0)
+    {
+        return err(std::vector<error_info>{error_info(
+            std::string("Failed to seek: \"") + filename +
+            "\", errno = " + std::to_string(errno), {}
+        )});
+    }
+
+    const long end = std::ftell(fp);
+    if (end == -1L)
+    {
+        return err(std::vector<error_info>{error_info(
+            std::string("Failed to access: \"") + filename +
+            "\", errno = " + std::to_string(errno), {}
+        )});
+    }
+
+    const auto fsize = end - beg;
+
+    const auto res_seekbeg = std::fseek(fp, beg, SEEK_SET);
+    if (res_seekbeg != 0)
+    {
+        return err(std::vector<error_info>{error_info(
+            std::string("Failed to seek: \"") + filename +
+            "\", errno = " + std::to_string(errno), {}
+        )});
+
+    }
+
+    // read whole file as a sequence of char
+    assert(fsize >= 0);
+    std::vector<detail::location::char_type> letters(static_cast<std::size_t>(fsize));
+    const auto actual = std::fread(letters.data(), sizeof(char), static_cast<std::size_t>(fsize), fp);
+    if(actual != static_cast<std::size_t>(fsize))
+    {
+        return err(std::vector<error_info>{error_info(
+            std::string("File size changed: \"") + filename +
+            std::string("\" make sure that FILE* is in binary mode "
+                        "to avoid LF <-> CRLF conversion"), {}
+        )});
+    }
+
+    return detail::parse_impl<TC>(std::move(letters), std::move(filename), std::move(s));
+}
+
+template<typename TC = type_config>
+basic_value<TC>
+parse(FILE* fp, std::string filename, spec s = spec::default_version())
+{
+    const long beg = std::ftell(fp);
+    if (beg == -1L)
+    {
+        throw file_io_error(errno, "Failed to access", filename);
+    }
+
+    const int res_seekend = std::fseek(fp, 0, SEEK_END);
+    if (res_seekend != 0)
+    {
+        throw file_io_error(errno, "Failed to seek", filename);
+    }
+
+    const long end = std::ftell(fp);
+    if (end == -1L)
+    {
+        throw file_io_error(errno, "Failed to access", filename);
+    }
+
+    const auto fsize = end - beg;
+
+    const auto res_seekbeg = std::fseek(fp, beg, SEEK_SET);
+    if (res_seekbeg != 0)
+    {
+        throw file_io_error(errno, "Failed to seek", filename);
+    }
+
+    // read whole file as a sequence of char
+    assert(fsize >= 0);
+    std::vector<detail::location::char_type> letters(static_cast<std::size_t>(fsize));
+    const auto actual = std::fread(letters.data(), sizeof(char), static_cast<std::size_t>(fsize), fp);
+    if(actual != static_cast<std::size_t>(fsize))
+    {
+        throw file_io_error(errno, "File size changed; make sure that "
+            "FILE* is in binary mode to avoid LF <-> CRLF conversion", filename);
+    }
+
+    auto res = detail::parse_impl<TC>(std::move(letters), std::move(filename), std::move(s));
+    if(res.is_ok())
+    {
+        return res.unwrap();
+    }
+    else
+    {
+        std::string msg;
+        for(const auto& err : res.unwrap_err())
+        {
+            msg += format_error(err);
+        }
+        throw syntax_error(std::move(msg), std::move(res.unwrap_err()));
+    }
+}
+
+} // namespace toml
+
+#if defined(TOML11_COMPILE_SOURCES)
+namespace toml
+{
+struct type_config;
+struct ordered_type_config;
+
+extern template result<basic_value<type_config>, std::vector<error_info>> try_parse<type_config>(std::vector<unsigned char>, std::string, spec);
+extern template result<basic_value<type_config>, std::vector<error_info>> try_parse<type_config>(std::istream&, std::string, spec);
+extern template result<basic_value<type_config>, std::vector<error_info>> try_parse<type_config>(std::string, spec);
+extern template result<basic_value<type_config>, std::vector<error_info>> try_parse<type_config>(FILE*, std::string, spec);
+extern template result<basic_value<type_config>, std::vector<error_info>> try_parse_str<type_config>(std::string, spec, cxx::source_location);
+
+extern template basic_value<type_config> parse<type_config>(std::vector<unsigned char>, std::string, spec);
+extern template basic_value<type_config> parse<type_config>(std::istream&, std::string, spec);
+extern template basic_value<type_config> parse<type_config>(std::string, spec);
+extern template basic_value<type_config> parse<type_config>(FILE*, std::string, spec);
+extern template basic_value<type_config> parse_str<type_config>(std::string, spec, cxx::source_location);
+
+extern template result<basic_value<ordered_type_config>, std::vector<error_info>> try_parse<ordered_type_config>(std::vector<unsigned char>, std::string, spec);
+extern template result<basic_value<ordered_type_config>, std::vector<error_info>> try_parse<ordered_type_config>(std::istream&, std::string, spec);
+extern template result<basic_value<ordered_type_config>, std::vector<error_info>> try_parse<ordered_type_config>(std::string, spec);
+extern template result<basic_value<ordered_type_config>, std::vector<error_info>> try_parse<ordered_type_config>(FILE*, std::string, spec);
+extern template result<basic_value<ordered_type_config>, std::vector<error_info>> try_parse_str<ordered_type_config>(std::string, spec, cxx::source_location);
+
+extern template basic_value<ordered_type_config> parse<ordered_type_config>(std::vector<unsigned char>, std::string, spec);
+extern template basic_value<ordered_type_config> parse<ordered_type_config>(std::istream&, std::string, spec);
+extern template basic_value<ordered_type_config> parse<ordered_type_config>(std::string, spec);
+extern template basic_value<ordered_type_config> parse<ordered_type_config>(FILE*, std::string, spec);
+extern template basic_value<ordered_type_config> parse_str<ordered_type_config>(std::string, spec, cxx::source_location);
+
+#if defined(TOML11_HAS_FILESYSTEM)
+extern template cxx::enable_if_t<std::is_same<std::filesystem::path, std::filesystem::path>::value, result<basic_value<type_config>,         std::vector<error_info>>> try_parse<type_config,         std::filesystem::path>(const std::filesystem::path&, spec);
+extern template cxx::enable_if_t<std::is_same<std::filesystem::path, std::filesystem::path>::value, result<basic_value<ordered_type_config>, std::vector<error_info>>> try_parse<ordered_type_config, std::filesystem::path>(const std::filesystem::path&, spec);
+extern template cxx::enable_if_t<std::is_same<std::filesystem::path, std::filesystem::path>::value, basic_value<type_config>                                         > parse    <type_config,         std::filesystem::path>(const std::filesystem::path&, spec);
+extern template cxx::enable_if_t<std::is_same<std::filesystem::path, std::filesystem::path>::value, basic_value<ordered_type_config>                                 > parse    <ordered_type_config, std::filesystem::path>(const std::filesystem::path&, spec);
+#endif // filesystem
+
+} // toml
+#endif // TOML11_COMPILE_SOURCES
+
+#endif // TOML11_PARSER_HPP
+#ifndef TOML11_LITERAL_HPP
+#define TOML11_LITERAL_HPP
+
+#ifndef TOML11_LITERAL_FWD_HPP
+#define TOML11_LITERAL_FWD_HPP
+
+
+namespace toml
+{
+
+namespace detail
+{
+// implementation
+::toml::value literal_internal_impl(location loc);
+} // detail
+
+inline namespace literals
+{
+inline namespace toml_literals
+{
+
+::toml::value operator"" _toml(const char* str, std::size_t len);
+
+#if defined(TOML11_HAS_CHAR8_T)
+// value of u8"" literal has been changed from char to char8_t and char8_t is
+// NOT compatible to char
+::toml::value operator"" _toml(const char8_t* str, std::size_t len);
+#endif
+
+} // toml_literals
+} // literals
+} // toml
+#endif // TOML11_LITERAL_FWD_HPP
+
+#if ! defined(TOML11_COMPILE_SOURCES)
+#ifndef TOML11_LITERAL_IMPL_HPP
+#define TOML11_LITERAL_IMPL_HPP
+
+
+namespace toml
+{
+
+namespace detail
+{
+// implementation
+TOML11_INLINE ::toml::value literal_internal_impl(location loc)
+{
+    const auto s = ::toml::spec::default_version();
+    context<type_config> ctx(s);
+
+    const auto front = loc;
+
+    // ------------------------------------------------------------------------
+    // check if it is a raw value.
+
+    // skip empty lines and comment lines
+    auto sp = skip_multiline_spacer(loc, ctx);
+    if(loc.eof())
+    {
+        ::toml::value val;
+        if(sp.has_value())
+        {
+            for(std::size_t i=0; i<sp.value().comments.size(); ++i)
+            {
+                val.comments().push_back(std::move(sp.value().comments.at(i)));
+            }
+        }
+        return val;
+    }
+
+    // to distinguish arrays and tables, first check it is a table or not.
+    //
+    // "[1,2,3]"_toml;   // json: [1, 2, 3]
+    // "[table]"_toml;   // json: {"table": {}}
+    // "[[1,2,3]]"_toml; // json: [[1, 2, 3]]
+    // "[[table]]"_toml; // json: {"table": [{}]}
+    //
+    // "[[1]]"_toml;     // json: {"1": [{}]}
+    // "1 = [{}]"_toml;  // json: {"1": [{}]}
+    // "[[1,]]"_toml;    // json: [[1]]
+    // "[[1],]"_toml;    // json: [[1]]
+    const auto val_start = loc;
+
+    const bool is_table_key = syntax::std_table(s).scan(loc).is_ok();
+    loc = val_start;
+    const bool is_aots_key  = syntax::array_table(s).scan(loc).is_ok();
+    loc = val_start;
+
+    // If it is neither a table-key or a array-of-table-key, it may be a value.
+    if(!is_table_key && !is_aots_key)
+    {
+        auto data = parse_value(loc, ctx);
+        if(data.is_ok())
+        {
+            auto val = std::move(data.unwrap());
+            if(sp.has_value())
+            {
+                for(std::size_t i=0; i<sp.value().comments.size(); ++i)
+                {
+                    val.comments().push_back(std::move(sp.value().comments.at(i)));
+                }
+            }
+            auto com_res = parse_comment_line(loc, ctx);
+            if(com_res.is_ok() && com_res.unwrap().has_value())
+            {
+                val.comments().push_back(com_res.unwrap().value());
+            }
+            return val;
+        }
+    }
+
+    // -------------------------------------------------------------------------
+    // Note that still it can be a table, because the literal might be something
+    // like the following.
+    // ```cpp
+    // // c++11 raw-string literal
+    // const auto val = R"(
+    //   key = "value"
+    //   int = 42
+    // )"_toml;
+    // ```
+    // It is a valid toml file.
+    // It should be parsed as if we parse a file with this content.
+
+    loc = front;
+    auto data = parse_file(loc, ctx);
+    if(data.is_ok())
+    {
+        return data.unwrap();
+    }
+    else // not a value && not a file. error.
+    {
+        std::string msg;
+        for(const auto& err : data.unwrap_err())
+        {
+            msg += format_error(err);
+        }
+        throw ::toml::syntax_error(std::move(msg), std::move(data.unwrap_err()));
+    }
+}
+
+} // detail
+
+inline namespace literals
+{
+inline namespace toml_literals
+{
+
+TOML11_INLINE ::toml::value
+operator"" _toml(const char* str, std::size_t len)
+{
+    if(len == 0)
+    {
+        return ::toml::value{};
+    }
+
+    ::toml::detail::location::container_type c(len);
+    std::copy(reinterpret_cast<const ::toml::detail::location::char_type*>(str),
+              reinterpret_cast<const ::toml::detail::location::char_type*>(str + len),
+              c.begin());
+    if( ! c.empty() && c.back())
+    {
+        c.push_back('\n'); // to make it easy to parse comment, we add newline
+    }
+
+    return literal_internal_impl(::toml::detail::location(
+        std::make_shared<const toml::detail::location::container_type>(std::move(c)),
+        "TOML literal encoded in a C++ code"));
+}
+
+#if defined(__cpp_char8_t)
+#  if __cpp_char8_t >= 201811L
+#    define TOML11_HAS_CHAR8_T 1
+#  endif
+#endif
+
+#if defined(TOML11_HAS_CHAR8_T)
+// value of u8"" literal has been changed from char to char8_t and char8_t is
+// NOT compatible to char
+TOML11_INLINE ::toml::value
+operator"" _toml(const char8_t* str, std::size_t len)
+{
+    if(len == 0)
+    {
+        return ::toml::value{};
+    }
+
+    ::toml::detail::location::container_type c(len);
+    std::copy(reinterpret_cast<const ::toml::detail::location::char_type*>(str),
+              reinterpret_cast<const ::toml::detail::location::char_type*>(str + len),
+              c.begin());
+    if( ! c.empty() && c.back())
+    {
+        c.push_back('\n'); // to make it easy to parse comment, we add newline
+    }
+
+    return literal_internal_impl(::toml::detail::location(
+        std::make_shared<const toml::detail::location::container_type>(std::move(c)),
+        "TOML literal encoded in a C++ code"));
+}
+#endif
+
+} // toml_literals
+} // literals
+} // toml
+#endif // TOML11_LITERAL_IMPL_HPP
+#endif
+
+#endif // TOML11_LITERAL_HPP
+#ifndef TOML11_SERIALIZER_HPP
+#define TOML11_SERIALIZER_HPP
+
+
+#include <iomanip>
+#include <iterator>
+#include <sstream>
+
+#include <cmath>
+#include <cstdio>
+
+namespace toml
+{
+
+struct serialization_error final : public ::toml::exception
+{
+  public:
+    explicit serialization_error(std::string what_arg, source_location loc)
+        : what_(std::move(what_arg)), loc_(std::move(loc))
+    {}
+    ~serialization_error() noexcept override = default;
+
+    const char* what() const noexcept override {return what_.c_str();}
+    source_location const& location() const noexcept {return loc_;}
+
+  private:
+    std::string what_;
+    source_location loc_;
+};
+
+namespace detail
+{
+template<typename TC>
+class serializer
+{
+  public:
+
+    using value_type           = basic_value<TC>;
+
+    using key_type             = typename value_type::key_type            ;
+    using comment_type         = typename value_type::comment_type        ;
+    using boolean_type         = typename value_type::boolean_type        ;
+    using integer_type         = typename value_type::integer_type        ;
+    using floating_type        = typename value_type::floating_type       ;
+    using string_type          = typename value_type::string_type         ;
+    using local_time_type      = typename value_type::local_time_type     ;
+    using local_date_type      = typename value_type::local_date_type     ;
+    using local_datetime_type  = typename value_type::local_datetime_type ;
+    using offset_datetime_type = typename value_type::offset_datetime_type;
+    using array_type           = typename value_type::array_type          ;
+    using table_type           = typename value_type::table_type          ;
+
+    using char_type            = typename string_type::value_type;
+
+  public:
+
+    explicit serializer(const spec& sp)
+        : spec_(sp), force_inline_(false), current_indent_(0)
+    {}
+
+    string_type operator()(const std::vector<key_type>& ks, const value_type& v)
+    {
+        for(const auto& k : ks)
+        {
+            this->keys_.push_back(k);
+        }
+        return (*this)(v);
+    }
+
+    string_type operator()(const key_type& k, const value_type& v)
+    {
+        this->keys_.push_back(k);
+        return (*this)(v);
+    }
+
+    string_type operator()(const value_type& v)
+    {
+        switch(v.type())
+        {
+            case value_t::boolean        : {return (*this)(v.as_boolean        (), v.as_boolean_fmt        (), v.location());}
+            case value_t::integer        : {return (*this)(v.as_integer        (), v.as_integer_fmt        (), v.location());}
+            case value_t::floating       : {return (*this)(v.as_floating       (), v.as_floating_fmt       (), v.location());}
+            case value_t::string         : {return (*this)(v.as_string         (), v.as_string_fmt         (), v.location());}
+            case value_t::offset_datetime: {return (*this)(v.as_offset_datetime(), v.as_offset_datetime_fmt(), v.location());}
+            case value_t::local_datetime : {return (*this)(v.as_local_datetime (), v.as_local_datetime_fmt (), v.location());}
+            case value_t::local_date     : {return (*this)(v.as_local_date     (), v.as_local_date_fmt     (), v.location());}
+            case value_t::local_time     : {return (*this)(v.as_local_time     (), v.as_local_time_fmt     (), v.location());}
+            case value_t::array          :
+            {
+                return (*this)(v.as_array(), v.as_array_fmt(), v.comments(), v.location());
+            }
+            case value_t::table          :
+            {
+                string_type retval;
+                if(this->keys_.empty()) // it might be the root table. emit comments here.
+                {
+                    retval += format_comments(v.comments(), v.as_table_fmt().indent_type);
+                }
+                if( ! retval.empty()) // we have comment.
+                {
+                    retval += char_type('\n');
+                }
+
+                retval += (*this)(v.as_table(), v.as_table_fmt(), v.comments(), v.location());
+                return retval;
+            }
+            case value_t::empty:
+            {
+                if(this->spec_.ext_null_value)
+                {
+                    return string_conv<string_type>("null");
+                }
+                break;
+            }
+            default:
+            {
+                break;
+            }
+        }
+        throw serialization_error(format_error(
+            "[error] toml::serializer: toml::basic_value "
+            "does not have any valid type.", v.location(), "here"), v.location());
+    }
+
+  private:
+
+    string_type operator()(const boolean_type& b, const boolean_format_info&, const source_location&) // {{{
+    {
+        if(b)
+        {
+            return string_conv<string_type>("true");
+        }
+        else
+        {
+            return string_conv<string_type>("false");
+        }
+    } // }}}
+
+    string_type operator()(const integer_type i, const integer_format_info& fmt, const source_location& loc) // {{{
+    {
+        std::ostringstream oss;
+        this->set_locale(oss);
+
+        const auto insert_spacer = [&fmt](std::string s) -> std::string {
+            if(fmt.spacer == 0) {return s;}
+
+            std::string sign;
+            if( ! s.empty() && (s.at(0) == '+' || s.at(0) == '-'))
+            {
+                sign += s.at(0);
+                s.erase(s.begin());
+            }
+
+            std::string spaced;
+            std::size_t counter = 0;
+            for(auto iter = s.rbegin(); iter != s.rend(); ++iter)
+            {
+                if(counter != 0 && counter % fmt.spacer == 0)
+                {
+                    spaced += '_';
+                }
+                spaced += *iter;
+                counter += 1;
+            }
+            if(!spaced.empty() && spaced.back() == '_') {spaced.pop_back();}
+
+            s.clear();
+            std::copy(spaced.rbegin(), spaced.rend(), std::back_inserter(s));
+            return sign + s;
+        };
+
+        std::string retval;
+        if(fmt.fmt == integer_format::dec)
+        {
+            oss << std::setw(static_cast<int>(fmt.width)) << std::dec << i;
+            retval = insert_spacer(oss.str());
+
+            if(this->spec_.ext_num_suffix && ! fmt.suffix.empty())
+            {
+                retval += '_';
+                retval += fmt.suffix;
+            }
+        }
+        else
+        {
+            if(i < 0)
+            {
+                throw serialization_error(format_error("binary, octal, hexadecimal "
+                    "integer does not allow negative value", loc, "here"), loc);
+            }
+            switch(fmt.fmt)
+            {
+                case integer_format::hex:
+                {
+                    oss << std::noshowbase
+                        << std::setw(static_cast<int>(fmt.width))
+                        << std::setfill('0')
+                        << std::hex;
+                    if(fmt.uppercase)
+                    {
+                        oss << std::uppercase;
+                    }
+                    else
+                    {
+                        oss << std::nouppercase;
+                    }
+                    oss << i;
+                    retval = std::string("0x") + insert_spacer(oss.str());
+                    break;
+                }
+                case integer_format::oct:
+                {
+                    oss << std::setw(static_cast<int>(fmt.width)) << std::setfill('0') << std::oct << i;
+                    retval = std::string("0o") + insert_spacer(oss.str());
+                    break;
+                }
+                case integer_format::bin:
+                {
+                    integer_type x{i};
+                    std::string tmp;
+                    std::size_t bits(0);
+                    while(x != 0)
+                    {
+                        if(fmt.spacer != 0)
+                        {
+                            if(bits != 0 && (bits % fmt.spacer) == 0) {tmp += '_';}
+                        }
+                        if(x % 2 == 1) { tmp += '1'; } else { tmp += '0'; }
+                        x >>= 1;
+                        bits += 1;
+                    }
+                    for(; bits < fmt.width; ++bits)
+                    {
+                        if(fmt.spacer != 0)
+                        {
+                            if(bits != 0 && (bits % fmt.spacer) == 0) {tmp += '_';}
+                        }
+                        tmp += '0';
+                    }
+                    for(auto iter = tmp.rbegin(); iter != tmp.rend(); ++iter)
+                    {
+                        oss << *iter;
+                    }
+                    retval = std::string("0b") + oss.str();
+                    break;
+                }
+                default:
+                {
+                    throw serialization_error(format_error(
+                        "none of dec, hex, oct, bin: " + to_string(fmt.fmt),
+                        loc, "here"), loc);
+                }
+            }
+        }
+        return string_conv<string_type>(retval);
+    } // }}}
+
+    string_type operator()(const floating_type f, const floating_format_info& fmt, const source_location&) // {{{
+    {
+        using std::isnan;
+        using std::isinf;
+        using std::signbit;
+
+        std::ostringstream oss;
+        this->set_locale(oss);
+
+        if(isnan(f))
+        {
+            if(signbit(f))
+            {
+                oss << '-';
+            }
+            oss << "nan";
+            if(this->spec_.ext_num_suffix && ! fmt.suffix.empty())
+            {
+                oss << '_';
+                oss << fmt.suffix;
+            }
+            return string_conv<string_type>(oss.str());
+        }
+
+        if(isinf(f))
+        {
+            if(signbit(f))
+            {
+                oss << '-';
+            }
+            oss << "inf";
+            if(this->spec_.ext_num_suffix && ! fmt.suffix.empty())
+            {
+                oss << '_';
+                oss << fmt.suffix;
+            }
+            return string_conv<string_type>(oss.str());
+        }
+
+        switch(fmt.fmt)
+        {
+            case floating_format::defaultfloat:
+            {
+                if(fmt.prec != 0)
+                {
+                    oss << std::setprecision(static_cast<int>(fmt.prec));
+                }
+                oss << f;
+                // since defaultfloat may omit point, we need to add it
+                std::string s = oss.str();
+                if (s.find('.') == std::string::npos &&
+                    s.find('e') == std::string::npos &&
+                    s.find('E') == std::string::npos )
+                {
+                    s += ".0";
+                }
+                if(this->spec_.ext_num_suffix && ! fmt.suffix.empty())
+                {
+                    s += '_';
+                    s += fmt.suffix;
+                }
+                return string_conv<string_type>(s);
+            }
+            case floating_format::fixed:
+            {
+                if(fmt.prec != 0)
+                {
+                    oss << std::setprecision(static_cast<int>(fmt.prec));
+                }
+                oss << std::fixed << f;
+                if(this->spec_.ext_num_suffix && ! fmt.suffix.empty())
+                {
+                    oss << '_' << fmt.suffix;
+                }
+                return string_conv<string_type>(oss.str());
+            }
+            case floating_format::scientific:
+            {
+                if(fmt.prec != 0)
+                {
+                    oss << std::setprecision(static_cast<int>(fmt.prec));
+                }
+                oss << std::scientific << f;
+                if(this->spec_.ext_num_suffix && ! fmt.suffix.empty())
+                {
+                    oss << '_' << fmt.suffix;
+                }
+                return string_conv<string_type>(oss.str());
+            }
+            case floating_format::hex:
+            {
+                if(this->spec_.ext_hex_float)
+                {
+                    oss << std::hexfloat << f;
+                    // suffix is only for decimal numbers.
+                    return string_conv<string_type>(oss.str());
+                }
+                else // no hex allowed. output with max precision.
+                {
+                    oss << std::setprecision(std::numeric_limits<floating_type>::max_digits10)
+                        << std::scientific << f;
+                    // suffix is only for decimal numbers.
+                    return string_conv<string_type>(oss.str());
+                }
+            }
+            default:
+            {
+                if(this->spec_.ext_num_suffix && ! fmt.suffix.empty())
+                {
+                    oss << '_' << fmt.suffix;
+                }
+                return string_conv<string_type>(oss.str());
+            }
+        }
+    } // }}}
+
+    string_type operator()(string_type s, const string_format_info& fmt, const source_location& loc) // {{{
+    {
+        string_type retval;
+        switch(fmt.fmt)
+        {
+            case string_format::basic:
+            {
+                retval += char_type('"');
+                retval += this->escape_basic_string(s);
+                retval += char_type('"');
+                return retval;
+            }
+            case string_format::literal:
+            {
+                if(std::find(s.begin(), s.end(), char_type('\n')) != s.end())
+                {
+                    throw serialization_error(format_error("toml::serializer: "
+                        "(non-multiline) literal string cannot have a newline",
+                        loc, "here"), loc);
+                }
+                retval += char_type('\'');
+                retval += s;
+                retval += char_type('\'');
+                return retval;
+            }
+            case string_format::multiline_basic:
+            {
+                retval += string_conv<string_type>("\"\"\"");
+                if(fmt.start_with_newline)
+                {
+                    retval += char_type('\n');
+                }
+
+                retval += this->escape_ml_basic_string(s);
+
+                retval += string_conv<string_type>("\"\"\"");
+                return retval;
+            }
+            case string_format::multiline_literal:
+            {
+                retval += string_conv<string_type>("'''");
+                if(fmt.start_with_newline)
+                {
+                    retval += char_type('\n');
+                }
+                retval += s;
+                retval += string_conv<string_type>("'''");
+                return retval;
+            }
+            default:
+            {
+                throw serialization_error(format_error(
+                    "[error] toml::serializer::operator()(string): "
+                    "invalid string_format value", loc, "here"), loc);
+            }
+        }
+    } // }}}
+
+    string_type operator()(const local_date_type& d, const local_date_format_info&, const source_location&) // {{{
+    {
+        std::ostringstream oss;
+        oss << d;
+        return string_conv<string_type>(oss.str());
+    } // }}}
+
+    string_type operator()(const local_time_type& t, const local_time_format_info& fmt, const source_location&) // {{{
+    {
+        return this->format_local_time(t, fmt.has_seconds, fmt.subsecond_precision);
+    } // }}}
+
+    string_type operator()(const local_datetime_type& dt, const local_datetime_format_info& fmt, const source_location&) // {{{
+    {
+        std::ostringstream oss;
+        oss << dt.date;
+        switch(fmt.delimiter)
+        {
+            case datetime_delimiter_kind::upper_T: { oss << 'T'; break; }
+            case datetime_delimiter_kind::lower_t: { oss << 't'; break; }
+            case datetime_delimiter_kind::space:   { oss << ' '; break; }
+            default:                               { oss << 'T'; break; }
+        }
+        return string_conv<string_type>(oss.str()) +
+            this->format_local_time(dt.time, fmt.has_seconds, fmt.subsecond_precision);
+    } // }}}
+
+    string_type operator()(const offset_datetime_type& odt, const offset_datetime_format_info& fmt, const source_location&) // {{{
+    {
+        std::ostringstream oss;
+        oss << odt.date;
+        switch(fmt.delimiter)
+        {
+            case datetime_delimiter_kind::upper_T: { oss << 'T'; break; }
+            case datetime_delimiter_kind::lower_t: { oss << 't'; break; }
+            case datetime_delimiter_kind::space:   { oss << ' '; break; }
+            default:                               { oss << 'T'; break; }
+        }
+        oss << string_conv<std::string>(this->format_local_time(odt.time, fmt.has_seconds, fmt.subsecond_precision));
+        oss << odt.offset;
+        return string_conv<string_type>(oss.str());
+    } // }}}
+
+    string_type operator()(const array_type& a, const array_format_info& fmt, const comment_type& com, const source_location& loc) // {{{
+    {
+        array_format f = fmt.fmt;
+        if(fmt.fmt == array_format::default_format)
+        {
+            // [[in.this.form]], you cannot add a comment to the array itself
+            // (but you can add a comment to each table).
+            // To keep comments, we need to avoid multiline array-of-tables
+            // if array itself has a comment.
+            if( ! this->keys_.empty() &&
+                ! a.empty() &&
+                com.empty() &&
+                std::all_of(a.begin(), a.end(), [](const value_type& e) {return e.is_table();}))
+            {
+                f = array_format::array_of_tables;
+            }
+            else
+            {
+                f = array_format::oneline;
+
+                // check if it becomes long
+                std::size_t approx_len = 0;
+                for(const auto& e : a)
+                {
+                    // have a comment. cannot be inlined
+                    if( ! e.comments().empty())
+                    {
+                        f = array_format::multiline;
+                        break;
+                    }
+                    // possibly long types ...
+                    if(e.is_array() || e.is_table() || e.is_offset_datetime() || e.is_local_datetime())
+                    {
+                        f = array_format::multiline;
+                        break;
+                    }
+                    else if(e.is_boolean())
+                    {
+                        approx_len += (*this)(e.as_boolean(), e.as_boolean_fmt(), e.location()).size();
+                    }
+                    else if(e.is_integer())
+                    {
+                        approx_len += (*this)(e.as_integer(), e.as_integer_fmt(), e.location()).size();
+                    }
+                    else if(e.is_floating())
+                    {
+                        approx_len += (*this)(e.as_floating(), e.as_floating_fmt(), e.location()).size();
+                    }
+                    else if(e.is_string())
+                    {
+                        if(e.as_string_fmt().fmt == string_format::multiline_basic ||
+                           e.as_string_fmt().fmt == string_format::multiline_literal)
+                        {
+                            f = array_format::multiline;
+                            break;
+                        }
+                        approx_len += 2 + (*this)(e.as_string(), e.as_string_fmt(), e.location()).size();
+                    }
+                    else if(e.is_local_date())
+                    {
+                        approx_len += 10; // 1234-56-78
+                    }
+                    else if(e.is_local_time())
+                    {
+                        approx_len += 15; // 12:34:56.789012
+                    }
+
+                    if(approx_len > 60) // key, ` = `, `[...]` < 80
+                    {
+                        f = array_format::multiline;
+                        break;
+                    }
+                    approx_len += 2; // `, `
+                }
+            }
+        }
+        if(this->force_inline_ && f == array_format::array_of_tables)
+        {
+            f = array_format::multiline;
+        }
+        if(a.empty() && f == array_format::array_of_tables)
+        {
+            f = array_format::oneline;
+        }
+
+        // --------------------------------------------------------------------
+
+        if(f == array_format::array_of_tables)
+        {
+            if(this->keys_.empty())
+            {
+                throw serialization_error("array of table must have its key. "
+                        "use format(key, v)", loc);
+            }
+            string_type retval;
+            for(const auto& e : a)
+            {
+                assert(e.is_table());
+
+                this->current_indent_ += e.as_table_fmt().name_indent;
+                retval += this->format_comments(e.comments(), e.as_table_fmt().indent_type);
+                retval += this->format_indent(e.as_table_fmt().indent_type);
+                this->current_indent_ -= e.as_table_fmt().name_indent;
+
+                retval += string_conv<string_type>("[[");
+                retval += this->format_keys(this->keys_).value();
+                retval += string_conv<string_type>("]]\n");
+
+                retval += this->format_ml_table(e.as_table(), e.as_table_fmt());
+            }
+            return retval;
+        }
+        else if(f == array_format::oneline)
+        {
+            // ignore comments. we cannot emit comments
+            string_type retval;
+            retval += char_type('[');
+            for(const auto& e : a)
+            {
+                this->force_inline_ = true;
+                retval += (*this)(e);
+                retval += string_conv<string_type>(", ");
+            }
+            if( ! a.empty())
+            {
+                retval.pop_back(); // ` `
+                retval.pop_back(); // `,`
+            }
+            retval += char_type(']');
+            this->force_inline_ = false;
+            return retval;
+        }
+        else
+        {
+            assert(f == array_format::multiline);
+
+            string_type retval;
+            retval += string_conv<string_type>("[\n");
+
+            for(const auto& e : a)
+            {
+                this->current_indent_ += fmt.body_indent;
+                retval += this->format_comments(e.comments(), fmt.indent_type);
+                retval += this->format_indent(fmt.indent_type);
+                this->current_indent_ -= fmt.body_indent;
+
+                this->force_inline_ = true;
+                retval += (*this)(e);
+                retval += string_conv<string_type>(",\n");
+            }
+            this->force_inline_ = false;
+
+            this->current_indent_ += fmt.closing_indent;
+            retval += this->format_indent(fmt.indent_type);
+            this->current_indent_ -= fmt.closing_indent;
+
+            retval += char_type(']');
+            return retval;
+        }
+    } // }}}
+
+    string_type operator()(const table_type& t, const table_format_info& fmt, const comment_type& com, const source_location& loc) // {{{
+    {
+        if(this->force_inline_)
+        {
+            if(fmt.fmt == table_format::multiline_oneline)
+            {
+                return this->format_ml_inline_table(t, fmt);
+            }
+            else
+            {
+                return this->format_inline_table(t, fmt);
+            }
+        }
+        else
+        {
+            if(fmt.fmt == table_format::multiline)
+            {
+                string_type retval;
+                // comment is emitted inside format_ml_table
+                if(auto k = this->format_keys(this->keys_))
+                {
+                    this->current_indent_ += fmt.name_indent;
+                    retval += this->format_comments(com, fmt.indent_type);
+                    retval += this->format_indent(fmt.indent_type);
+                    this->current_indent_ -= fmt.name_indent;
+                    retval += char_type('[');
+                    retval += k.value();
+                    retval += string_conv<string_type>("]\n");
+                }
+                // otherwise, its the root.
+
+                retval += this->format_ml_table(t, fmt);
+                return retval;
+            }
+            else if(fmt.fmt == table_format::oneline)
+            {
+                return this->format_inline_table(t, fmt);
+            }
+            else if(fmt.fmt == table_format::multiline_oneline)
+            {
+                return this->format_ml_inline_table(t, fmt);
+            }
+            else if(fmt.fmt == table_format::dotted)
+            {
+                std::vector<string_type> keys;
+                if(this->keys_.empty())
+                {
+                    throw serialization_error(format_error("toml::serializer: "
+                        "dotted table must have its key. use format(key, v)",
+                        loc, "here"), loc);
+                }
+                keys.push_back(this->keys_.back());
+
+                const auto retval = this->format_dotted_table(t, fmt, loc, keys);
+                keys.pop_back();
+                return retval;
+            }
+            else
+            {
+                assert(fmt.fmt == table_format::implicit);
+
+                string_type retval;
+                for(const auto& kv : t)
+                {
+                    const auto& k = kv.first;
+                    const auto& v = kv.second;
+
+                    if( ! v.is_table() && ! v.is_array_of_tables())
+                    {
+                        throw serialization_error(format_error("toml::serializer: "
+                            "an implicit table cannot have non-table value.",
+                            v.location(), "here"), v.location());
+                    }
+                    if(v.is_table())
+                    {
+                        if(v.as_table_fmt().fmt != table_format::multiline &&
+                           v.as_table_fmt().fmt != table_format::implicit)
+                        {
+                            throw serialization_error(format_error("toml::serializer: "
+                                "an implicit table cannot have non-multiline table",
+                                v.location(), "here"), v.location());
+                        }
+                    }
+                    else
+                    {
+                        assert(v.is_array());
+                        for(const auto& e : v.as_array())
+                        {
+                            if(e.as_table_fmt().fmt != table_format::multiline &&
+                               v.as_table_fmt().fmt != table_format::implicit)
+                            {
+                                throw serialization_error(format_error("toml::serializer: "
+                                    "an implicit table cannot have non-multiline table",
+                                    e.location(), "here"), e.location());
+                            }
+                        }
+                    }
+
+                    keys_.push_back(k);
+                    retval += (*this)(v);
+                    keys_.pop_back();
+                }
+                return retval;
+            }
+        }
+    } // }}}
+
+  private:
+
+    string_type escape_basic_string(const string_type& s) const // {{{
+    {
+        string_type retval;
+        for(const char_type c : s)
+        {
+            switch(c)
+            {
+                case char_type('\\'): {retval += string_conv<string_type>("\\\\"); break;}
+                case char_type('\"'): {retval += string_conv<string_type>("\\\""); break;}
+                case char_type('\b'): {retval += string_conv<string_type>("\\b" ); break;}
+                case char_type('\t'): {retval += string_conv<string_type>("\\t" ); break;}
+                case char_type('\f'): {retval += string_conv<string_type>("\\f" ); break;}
+                case char_type('\n'): {retval += string_conv<string_type>("\\n" ); break;}
+                case char_type('\r'): {retval += string_conv<string_type>("\\r" ); break;}
+                default  :
+                {
+                    if(c == char_type(0x1B) && spec_.v1_1_0_add_escape_sequence_e)
+                    {
+                        retval += string_conv<string_type>("\\e");
+                    }
+                    else if((char_type(0x00) <= c && c <= char_type(0x08)) ||
+                            (char_type(0x0A) <= c && c <= char_type(0x1F)) ||
+                             c == char_type(0x7F))
+                    {
+                        if(spec_.v1_1_0_add_escape_sequence_x)
+                        {
+                            retval += string_conv<string_type>("\\x");
+                        }
+                        else
+                        {
+                            retval += string_conv<string_type>("\\u00");
+                        }
+                        const auto c1 = c / 16;
+                        const auto c2 = c % 16;
+                        retval += static_cast<char_type>('0' + c1);
+                        if(c2 < 10)
+                        {
+                            retval += static_cast<char_type>('0' + c2);
+                        }
+                        else // 10 <= c2
+                        {
+                            retval += static_cast<char_type>('A' + (c2 - 10));
+                        }
+                    }
+                    else
+                    {
+                        retval += c;
+                    }
+                }
+            }
+        }
+        return retval;
+    } // }}}
+
+    string_type escape_ml_basic_string(const string_type& s) // {{{
+    {
+        string_type retval;
+        for(const char_type c : s)
+        {
+            switch(c)
+            {
+                case char_type('\\'): {retval += string_conv<string_type>("\\\\"); break;}
+                case char_type('\b'): {retval += string_conv<string_type>("\\b" ); break;}
+                case char_type('\t'): {retval += string_conv<string_type>("\\t" ); break;}
+                case char_type('\f'): {retval += string_conv<string_type>("\\f" ); break;}
+                case char_type('\n'): {retval += string_conv<string_type>("\n"  ); break;}
+                case char_type('\r'): {retval += string_conv<string_type>("\\r" ); break;}
+                default  :
+                {
+                    if(c == char_type(0x1B) && spec_.v1_1_0_add_escape_sequence_e)
+                    {
+                        retval += string_conv<string_type>("\\e");
+                    }
+                    else if((char_type(0x00) <= c && c <= char_type(0x08)) ||
+                            (char_type(0x0A) <= c && c <= char_type(0x1F)) ||
+                            c == char_type(0x7F))
+                    {
+                        if(spec_.v1_1_0_add_escape_sequence_x)
+                        {
+                            retval += string_conv<string_type>("\\x");
+                        }
+                        else
+                        {
+                            retval += string_conv<string_type>("\\u00");
+                        }
+                        const auto c1 = c / 16;
+                        const auto c2 = c % 16;
+                        retval += static_cast<char_type>('0' + c1);
+                        if(c2 < 10)
+                        {
+                            retval += static_cast<char_type>('0' + c2);
+                        }
+                        else // 10 <= c2
+                        {
+                            retval += static_cast<char_type>('A' + (c2 - 10));
+                        }
+                    }
+                    else
+                    {
+                        retval += c;
+                    }
+                }
+            }
+        }
+        // Only 1 or 2 consecutive `"`s are allowed in multiline basic string.
+        // 3 consecutive `"`s are considered as a closing delimiter.
+        // We need to check if there are 3 or more consecutive `"`s and insert
+        // backslash to break them down into several short `"`s like the `str6`
+        // in the following example.
+        // ```toml
+        // str4 = """Here are two quotation marks: "". Simple enough."""
+        // # str5 = """Here are three quotation marks: """."""  # INVALID
+        // str5 = """Here are three quotation marks: ""\"."""
+        // str6 = """Here are fifteen quotation marks: ""\"""\"""\"""\"""\"."""
+        // ```
+        auto found_3_quotes = retval.find(string_conv<string_type>("\"\"\""));
+        while(found_3_quotes != string_type::npos)
+        {
+            retval.replace(found_3_quotes, 3, string_conv<string_type>("\"\"\\\""));
+            found_3_quotes = retval.find(string_conv<string_type>("\"\"\""));
+        }
+        return retval;
+    } // }}}
+
+    string_type format_local_time(const local_time_type& t, const bool has_seconds, const std::size_t subsec_prec) // {{{
+    {
+        std::ostringstream oss;
+        oss << std::setfill('0') << std::setw(2) << static_cast<int>(t.hour);
+        oss << ':';
+        oss << std::setfill('0') << std::setw(2) << static_cast<int>(t.minute);
+        if(has_seconds)
+        {
+            oss << ':';
+            oss << std::setfill('0') << std::setw(2) << static_cast<int>(t.second);
+            if(subsec_prec != 0)
+            {
+                std::ostringstream subsec;
+                subsec << std::setfill('0') << std::setw(3) << static_cast<int>(t.millisecond);
+                subsec << std::setfill('0') << std::setw(3) << static_cast<int>(t.microsecond);
+                subsec << std::setfill('0') << std::setw(3) << static_cast<int>(t.nanosecond);
+                std::string subsec_str = subsec.str();
+                oss << '.' << subsec_str.substr(0, subsec_prec);
+            }
+        }
+        return string_conv<string_type>(oss.str());
+    } // }}}
+
+    string_type format_ml_table(const table_type& t, const table_format_info& fmt) // {{{
+    {
+        const auto format_later = [](const value_type& v) -> bool {
+
+            const bool is_ml_table = v.is_table() &&
+                v.as_table_fmt().fmt != table_format::oneline           &&
+                v.as_table_fmt().fmt != table_format::multiline_oneline &&
+                v.as_table_fmt().fmt != table_format::dotted ;
+
+            const bool is_ml_array_table = v.is_array_of_tables() &&
+                v.as_array_fmt().fmt != array_format::oneline &&
+                v.as_array_fmt().fmt != array_format::multiline;
+
+            return is_ml_table || is_ml_array_table;
+        };
+
+        string_type retval;
+        this->current_indent_ += fmt.body_indent;
+        for(const auto& kv : t)
+        {
+            const auto& key = kv.first;
+            const auto& val = kv.second;
+            if(format_later(val))
+            {
+                continue;
+            }
+            this->keys_.push_back(key);
+
+            retval += format_comments(val.comments(), fmt.indent_type);
+            retval += format_indent(fmt.indent_type);
+            if(val.is_table() && val.as_table_fmt().fmt == table_format::dotted)
+            {
+                retval += (*this)(val);
+            }
+            else
+            {
+                retval += format_key(key);
+                retval += string_conv<string_type>(" = ");
+                retval += (*this)(val);
+                retval += char_type('\n');
+            }
+            this->keys_.pop_back();
+        }
+        this->current_indent_ -= fmt.body_indent;
+
+        if( ! retval.empty())
+        {
+            retval += char_type('\n'); // for readability, add empty line between tables
+        }
+        for(const auto& kv : t)
+        {
+            if( ! format_later(kv.second))
+            {
+                continue;
+            }
+            // must be a [multiline.table] or [[multiline.array.of.tables]].
+            // comments will be generated inside it.
+            this->keys_.push_back(kv.first);
+            retval += (*this)(kv.second);
+            this->keys_.pop_back();
+        }
+        return retval;
+    } // }}}
+
+    string_type format_inline_table(const table_type& t, const table_format_info&) // {{{
+    {
+        // comments are ignored because we cannot write without newline
+        string_type retval;
+        retval += char_type('{');
+        for(const auto& kv : t)
+        {
+            this->force_inline_ = true;
+            retval += this->format_key(kv.first);
+            retval += string_conv<string_type>(" = ");
+            retval += (*this)(kv.second);
+            retval += string_conv<string_type>(", ");
+        }
+        if( ! t.empty())
+        {
+            retval.pop_back(); // ' '
+            retval.pop_back(); // ','
+        }
+        retval += char_type('}');
+        this->force_inline_ = false;
+        return retval;
+    } // }}}
+
+    string_type format_ml_inline_table(const table_type& t, const table_format_info& fmt) // {{{
+    {
+        string_type retval;
+        retval += string_conv<string_type>("{\n");
+        this->current_indent_ += fmt.body_indent;
+        for(const auto& kv : t)
+        {
+            this->force_inline_ = true;
+            retval += format_comments(kv.second.comments(), fmt.indent_type);
+            retval += format_indent(fmt.indent_type);
+            retval += kv.first;
+            retval += string_conv<string_type>(" = ");
+
+            this->force_inline_ = true;
+            retval += (*this)(kv.second);
+
+            retval += string_conv<string_type>(",\n");
+        }
+        if( ! t.empty())
+        {
+            retval.pop_back(); // '\n'
+            retval.pop_back(); // ','
+        }
+        this->current_indent_ -= fmt.body_indent;
+        this->force_inline_ = false;
+
+        this->current_indent_ += fmt.closing_indent;
+        retval += format_indent(fmt.indent_type);
+        this->current_indent_ -= fmt.closing_indent;
+
+        retval += char_type('}');
+        return retval;
+    } // }}}
+
+    string_type format_dotted_table(const table_type& t, const table_format_info& fmt, // {{{
+            const source_location&, std::vector<string_type>& keys)
+    {
+        // lets say we have: `{"a": {"b": {"c": {"d": "foo", "e": "bar"} } }`
+        // and `a` and `b` are `dotted`.
+        //
+        // - in case if `c` is `oneline`:
+        // ```toml
+        // a.b.c = {d = "foo", e = "bar"}
+        // ```
+        //
+        // - in case if and `c` is `dotted`:
+        // ```toml
+        // a.b.c.d = "foo"
+        // a.b.c.e = "bar"
+        // ```
+
+        string_type retval;
+
+        for(const auto& kv : t)
+        {
+            const auto& key = kv.first;
+            const auto& val = kv.second;
+
+            keys.push_back(key);
+
+            // format recursive dotted table?
+            if (val.is_table() &&
+                val.as_table_fmt().fmt != table_format::oneline &&
+                val.as_table_fmt().fmt != table_format::multiline_oneline)
+            {
+                retval += this->format_dotted_table(val.as_table(), val.as_table_fmt(), val.location(), keys);
+            }
+            else // non-table or inline tables. format normally
+            {
+                retval += format_comments(val.comments(), fmt.indent_type);
+                retval += format_indent(fmt.indent_type);
+                retval += format_keys(keys).value();
+                retval += string_conv<string_type>(" = ");
+                this->force_inline_ = true; // sub-table must be inlined
+                retval += (*this)(val);
+                retval += char_type('\n');
+                this->force_inline_ = false;
+            }
+            keys.pop_back();
+        }
+        return retval;
+    } // }}}
+
+    string_type format_key(const key_type& key) // {{{
+    {
+        if(key.empty())
+        {
+            return string_conv<string_type>("\"\"");
+        }
+
+        // check the key can be a bare (unquoted) key
+        auto loc = detail::make_temporary_location(string_conv<std::string>(key));
+        auto reg = detail::syntax::unquoted_key(this->spec_).scan(loc);
+        if(reg.is_ok() && loc.eof())
+        {
+            return key;
+        }
+
+        //if it includes special characters, then format it in a "quoted" key.
+        string_type formatted = string_conv<string_type>("\"");
+        for(const char_type c : key)
+        {
+            switch(c)
+            {
+                case char_type('\\'): {formatted += string_conv<string_type>("\\\\"); break;}
+                case char_type('\"'): {formatted += string_conv<string_type>("\\\""); break;}
+                case char_type('\b'): {formatted += string_conv<string_type>("\\b" ); break;}
+                case char_type('\t'): {formatted += string_conv<string_type>("\\t" ); break;}
+                case char_type('\f'): {formatted += string_conv<string_type>("\\f" ); break;}
+                case char_type('\n'): {formatted += string_conv<string_type>("\\n" ); break;}
+                case char_type('\r'): {formatted += string_conv<string_type>("\\r" ); break;}
+                default  :
+                {
+                    // ASCII ctrl char
+                    if( (char_type(0x00) <= c && c <= char_type(0x08)) ||
+                        (char_type(0x0A) <= c && c <= char_type(0x1F)) ||
+                        c == char_type(0x7F))
+                    {
+                        if(spec_.v1_1_0_add_escape_sequence_x)
+                        {
+                            formatted += string_conv<string_type>("\\x");
+                        }
+                        else
+                        {
+                            formatted += string_conv<string_type>("\\u00");
+                        }
+                        const auto c1 = c / 16;
+                        const auto c2 = c % 16;
+                        formatted += static_cast<char_type>('0' + c1);
+                        if(c2 < 10)
+                        {
+                            formatted += static_cast<char_type>('0' + c2);
+                        }
+                        else // 10 <= c2
+                        {
+                            formatted += static_cast<char_type>('A' + (c2 - 10));
+                        }
+                    }
+                    else
+                    {
+                        formatted += c;
+                    }
+                    break;
+                }
+            }
+        }
+        formatted += string_conv<string_type>("\"");
+        return formatted;
+    } // }}}
+    cxx::optional<string_type> format_keys(const std::vector<key_type>& keys) // {{{
+    {
+        if(keys.empty())
+        {
+            return cxx::make_nullopt();
+        }
+
+        string_type formatted;
+        for(const auto& ky : keys)
+        {
+            formatted += format_key(ky);
+            formatted += char_type('.');
+        }
+        formatted.pop_back(); // remove the last dot '.'
+        return formatted;
+    } // }}}
+
+    string_type format_comments(const discard_comments&, const indent_char) const // {{{
+    {
+        return string_conv<string_type>("");
+    } // }}}
+    string_type format_comments(const preserve_comments& comments, const indent_char indent_type) const // {{{
+    {
+        string_type retval;
+        for(const auto& c : comments)
+        {
+            if(c.empty()) {continue;}
+            retval += format_indent(indent_type);
+            if(c.front() != '#') {retval += char_type('#');}
+            retval += string_conv<string_type>(c);
+            if(c.back() != '\n') {retval += char_type('\n');}
+        }
+        return retval;
+    } // }}}
+
+    string_type format_indent(const indent_char indent_type) const // {{{
+    {
+        const auto indent = static_cast<std::size_t>((std::max)(0, this->current_indent_));
+        if(indent_type == indent_char::space)
+        {
+            return string_conv<string_type>(make_string(indent, ' '));
+        }
+        else if(indent_type == indent_char::tab)
+        {
+            return string_conv<string_type>(make_string(indent, '\t'));
+        }
+        else
+        {
+            return string_type{};
+        }
+    } // }}}
+
+    std::locale set_locale(std::ostream& os) const
+    {
+        return os.imbue(std::locale::classic());
+    }
+
+  private:
+
+    spec spec_;
+    bool force_inline_; // table inside an array without fmt specification
+    std::int32_t current_indent_;
+    std::vector<key_type> keys_;
+};
+} // detail
+
+template<typename TC>
+typename basic_value<TC>::string_type
+format(const basic_value<TC>& v, const spec s = spec::default_version())
+{
+    detail::serializer<TC> ser(s);
+    return ser(v);
+}
+template<typename TC>
+typename basic_value<TC>::string_type
+format(const typename basic_value<TC>::key_type& k,
+       const basic_value<TC>& v,
+       const spec s = spec::default_version())
+{
+    detail::serializer<TC> ser(s);
+    return ser(k, v);
+}
+template<typename TC>
+typename basic_value<TC>::string_type
+format(const std::vector<typename basic_value<TC>::key_type>& ks,
+       const basic_value<TC>& v,
+       const spec s = spec::default_version())
+{
+    detail::serializer<TC> ser(s);
+    return ser(ks, v);
+}
+
+template<typename TC>
+std::ostream& operator<<(std::ostream& os, const basic_value<TC>& v)
+{
+    os << format(v);
+    return os;
+}
+
+} // toml
+
+#if defined(TOML11_COMPILE_SOURCES)
+namespace toml
+{
+struct type_config;
+struct ordered_type_config;
+
+extern template typename basic_value<type_config>::string_type
+format<type_config>(const basic_value<type_config>&, const spec);
+
+extern template typename basic_value<type_config>::string_type
+format<type_config>(const typename basic_value<type_config>::key_type& k,
+                    const basic_value<type_config>& v, const spec);
+
+extern template typename basic_value<type_config>::string_type
+format<type_config>(const std::vector<typename basic_value<type_config>::key_type>& ks,
+                    const basic_value<type_config>& v, const spec s);
+
+extern template typename basic_value<type_config>::string_type
+format<ordered_type_config>(const basic_value<ordered_type_config>&, const spec);
+
+extern template typename basic_value<type_config>::string_type
+format<ordered_type_config>(const typename basic_value<ordered_type_config>::key_type& k,
+                            const basic_value<ordered_type_config>& v, const spec);
+
+extern template typename basic_value<type_config>::string_type
+format<ordered_type_config>(const std::vector<typename basic_value<ordered_type_config>::key_type>& ks,
+                            const basic_value<ordered_type_config>& v, const spec s);
+
+namespace detail
+{
+extern template class serializer<::toml::type_config>;
+extern template class serializer<::toml::ordered_type_config>;
+} // detail
+} // toml
+#endif // TOML11_COMPILE_SOURCES
+
+
+#endif // TOML11_SERIALIZER_HPP
+#ifndef TOML11_TOML_HPP
+#define TOML11_TOML_HPP
+
+// The MIT License (MIT)
+//
+// Copyright (c) 2017-now Toru Niina
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+// IWYU pragma: begin_exports
+// IWYU pragma: end_exports
+
+#endif// TOML11_TOML_HPP
diff --git a/translator/README.md b/translator/README.md
new file mode 100644
index 0000000..22ed11d
--- /dev/null
+++ b/translator/README.md
@@ -0,0 +1,145 @@
+
+# Wiicompiled Static Recompiler
+
+  
+
+The translator parses GameCube/Wii DOL files, decodes PowerPC instructions, lifts them through
+
+IR/SSA and type inference, and emits C++ that is compiled into a native executable together with
+
+a runtime in `runtime/`. Project-specific paths and addresses are supplied through a versioned
+
+YAML manifest, so the translator itself contains no game-specific data.
+
+  
+
+> Translating a DOL does not exempt you from owning the game it came from.
+
+  
+
+## How translating a DOL works
+
+  
+
+A project manifest (YAML) names the input DOL and pins its layout; everything else is derived.
+
+Translation is four commands:
+
+  
+
+1.  **`translate-recursive <entry-point> --project <manifest>`** - walks the call graph from the
+
+entry point, decodes every reachable function, and emits C++ (plus JSON metadata describing
+
+what was emitted).
+
+2.  **`generate-data-init --project <manifest>`** - writes the embedded `.data`/`.rodata`/`.sdata`
+
+section initializer and `RuntimeConfig.h`. 
+
+3.  **`emit-build-shards --project <manifest>`** - emits the CMake build graph (`shards.cmake`)
+
+covering both generated sources and `runtime/src`.
+
+4.  **CMake + Ninja with Clang** compiles `runtime/` plus the generated output into one executable.
+
+  
+
+Discovery is purely recursive from the entry point unless the manifest provides an optional
+
+`function_map` (one `hexaddr name` per line) that seeds additional function boundaries. Unsupported
+
+instructions fail translation by default.
+
+  
+
+See `projects/examples/generic-dol.yml` for a minimal manifest driven by `RECOMP_GENERIC_DOL`.
+
+  
+
+## Prerequisites
+
+  
+
+| Tool | Notes |
+
+| --- | --- |
+
+| .NET 8 SDK | Builds and runs the translator. |
+
+| CMake ≥ 3.16 and Ninja | Configures and drives the native build. |
+
+| Clang / LLVM | The shipped build uses LLVM-MinGW targeting `x86-64-v3`. MSVC is not the tested path. |
+
+  
+
+Build the CLI once and invoke the assembly directly:
+
+  
+
+```powershell
+
+dotnet build translator/src/Translator.Cli/Translator.Cli.csproj -c Release
+
+$translator = 'translator/src/Translator.Cli/bin/Release/net8.0/Translator.Cli.dll'
+
+```
+
+  
+
+## Manifest essentials
+
+  
+
+-  `inputs.dol.path` - the DOL to translate; optional SHA-256 pinning rejects wrong revisions.
+
+-  `memory.base` / `size` - guest address space.
+
+-  `memory.sda_base` / `sda2_base` - the r13/r2 Small Data Area bases your DOL's boot code installs
+
+(`lis`/`ori` pairs in `__init_registers`). Required by any command that writes `RuntimeConfig.h`;
+
+the translator does not guess them.
+
+-  `translation.function_map.path` - optional symbol map used as the discovery oracle.
+
+-  `translation.allow_unsupported_instructions` - off by default; enabling it emits runtime traps
+
+instead of failing, and such a build can never ship.
+
+  
+
+Relative paths resolve from `workspace_root`, which itself resolves from the manifest directory.
+
+  
+
+## Commands
+
+  
+
+-  `info [--project path]`
+
+-  `translate-recursive <address> --project path`
+
+-  `generate-data-init --project path`
+
+-  `emit-base-manifest --project path`
+
+-  `emit-build-shards --project path`
+
+-  `translate-mod --project path [--profile name] ...` - static Kamek/Pulsar module translation
+
+  
+
+Any command prints its own option list with `--help`.
+
+  
+
+## Test
+
+  
+```powershell
+
+dotnet test translator/Translator.sln -c Release
+
+```
diff --git a/translator/Translator.sln b/translator/Translator.sln
new file mode 100644
index 0000000..98c46a5
--- /dev/null
+++ b/translator/Translator.sln
@@ -0,0 +1,43 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.0.31903.59
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{4FC58505-F37D-4144-BB2A-7799E35E74F6}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Translator.Core", "src\Translator.Core\Translator.Core.csproj", "{3AA6B3E5-AA08-46CB-AED1-FE538953BF15}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Translator.Cli", "src\Translator.Cli\Translator.Cli.csproj", "{139F781E-A98F-4DB4-8E51-4BF044D130E9}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{670CFC5B-3E95-4565-83E8-2FEF6A562D62}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Translator.Tests", "tests\Translator.Tests\Translator.Tests.csproj", "{A5FE1FF8-59B1-48B8-BAF3-FC05E21A675E}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{3AA6B3E5-AA08-46CB-AED1-FE538953BF15}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{3AA6B3E5-AA08-46CB-AED1-FE538953BF15}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{3AA6B3E5-AA08-46CB-AED1-FE538953BF15}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{3AA6B3E5-AA08-46CB-AED1-FE538953BF15}.Release|Any CPU.Build.0 = Release|Any CPU
+		{139F781E-A98F-4DB4-8E51-4BF044D130E9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{139F781E-A98F-4DB4-8E51-4BF044D130E9}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{139F781E-A98F-4DB4-8E51-4BF044D130E9}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{139F781E-A98F-4DB4-8E51-4BF044D130E9}.Release|Any CPU.Build.0 = Release|Any CPU
+		{A5FE1FF8-59B1-48B8-BAF3-FC05E21A675E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A5FE1FF8-59B1-48B8-BAF3-FC05E21A675E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A5FE1FF8-59B1-48B8-BAF3-FC05E21A675E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A5FE1FF8-59B1-48B8-BAF3-FC05E21A675E}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(NestedProjects) = preSolution
+		{3AA6B3E5-AA08-46CB-AED1-FE538953BF15} = {4FC58505-F37D-4144-BB2A-7799E35E74F6}
+		{139F781E-A98F-4DB4-8E51-4BF044D130E9} = {4FC58505-F37D-4144-BB2A-7799E35E74F6}
+		{A5FE1FF8-59B1-48B8-BAF3-FC05E21A675E} = {670CFC5B-3E95-4565-83E8-2FEF6A562D62}
+	EndGlobalSection
+EndGlobal
diff --git a/translator/src/Translator.Cli/IndexedParallel.cs b/translator/src/Translator.Cli/IndexedParallel.cs
new file mode 100644
index 0000000..c1912b0
--- /dev/null
+++ b/translator/src/Translator.Cli/IndexedParallel.cs
@@ -0,0 +1,40 @@
+using System;
+using System.Threading.Tasks;
+
+/// <summary>
+/// Runs an indexed operation with the same sequential behavior used by the
+/// translator's parallel stages. Keeping the sequential path explicit makes
+/// single-threaded runs deterministic and avoids AggregateException wrapping.
+/// </summary>
+internal static class IndexedParallel
+{
+    internal static void For(int count, ParallelOptions parallelOptions, Action<int> body)
+    {
+        if (count <= 0)
+        {
+            return;
+        }
+
+        if (parallelOptions.MaxDegreeOfParallelism <= 1 || count == 1)
+        {
+            for (var index = 0; index < count; index++)
+            {
+                body(index);
+            }
+
+            return;
+        }
+
+        try
+        {
+            Parallel.For(0, count, parallelOptions, body);
+        }
+        catch (AggregateException ex)
+        {
+            // Preserve the recursive translator's historical behavior: a
+            // single worker failure is reported as that failure, while a
+            // genuinely multi-failure pass remains aggregate-shaped.
+            throw ex.InnerExceptions.Count == 1 ? ex.InnerExceptions[0] : ex;
+        }
+    }
+}
diff --git a/translator/src/Translator.Cli/ModTranslationWaveRunner.cs b/translator/src/Translator.Cli/ModTranslationWaveRunner.cs
new file mode 100644
index 0000000..c168c64
--- /dev/null
+++ b/translator/src/Translator.Cli/ModTranslationWaveRunner.cs
@@ -0,0 +1,63 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Translator.Core.Disassembly;
+using Translator.Core.Translation;
+
+/// <summary>One function a mod translation wave has to emit.</summary>
+sealed record ModTranslationWork(
+    uint Address,
+    TranslationOptions Options,
+    string OutputPath);
+
+/// <summary>
+/// The outcome of one work item: either a translation or the message explaining
+/// why that address could not be translated. Failures are values, not
+/// exceptions, so one bad address cannot abandon the rest of its wave.
+/// </summary>
+sealed record ModTranslationAttempt(
+    ModTranslationWork Work,
+    FunctionTranslationResult? Result,
+    string? Error);
+
+/// <summary>
+/// Translates one wave of mod work items in parallel and returns the attempts in
+/// a deterministic (Address, OutputPath) order, so the emitted bundle never
+/// depends on thread count or completion order.
+/// </summary>
+static class ModTranslationWaveRunner
+{
+    internal static ModTranslationAttempt[] Translate(
+        Func<FunctionTranslator> translatorFactory,
+        IReadOnlyList<ModTranslationWork> wave,
+        ParallelOptions parallelOptions)
+    {
+        var attempts = new ModTranslationAttempt[wave.Count];
+        void TranslateAt(int index)
+        {
+            var work = wave[index];
+            try
+            {
+                attempts[index] = new ModTranslationAttempt(
+                    work,
+                    translatorFactory().Translate(work.Address, work.Options),
+                    null);
+            }
+            catch (Exception ex) when (ex is InvalidOperationException or ArgumentOutOfRangeException or PpcDisassemblyLimitExceededException)
+            {
+                attempts[index] = new ModTranslationAttempt(
+                    work,
+                    null,
+                    $"0x{work.Address:X8} {work.Options.PreferredName}: {ex.Message}");
+            }
+        }
+
+        IndexedParallel.For(wave.Count, parallelOptions, TranslateAt);
+
+        return attempts
+            .OrderBy(attempt => attempt.Work.Address)
+            .ThenBy(attempt => attempt.Work.OutputPath, StringComparer.Ordinal)
+            .ToArray();
+    }
+}
diff --git a/translator/src/Translator.Cli/Program.cs b/translator/src/Translator.Cli/Program.cs
new file mode 100644
index 0000000..c8f7fe4
--- /dev/null
+++ b/translator/src/Translator.Cli/Program.cs
@@ -0,0 +1,4064 @@
+using System;
+using System.Buffers.Binary;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Numerics;
+using System.Reflection;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Translator.Cli.Configuration;
+using Translator.Core;
+using Translator.Core.CodeGen;
+using Translator.Core.Build;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.BasicBlocks;
+using Translator.Core.Disassembly;
+using Translator.Core.Loading;
+using Translator.Core.Mods;
+using Translator.Core.Mods.Mkwii;
+using Translator.Core.Ir;
+using Translator.Core.IO;
+using Translator.Core.Parsing.Kamek;
+using Translator.Core.Parsing.Dol;
+using Translator.Core.Parsing.Rel;
+using Translator.Core.Translation;
+
+// All formats here (YAML, JSON, hex, hashes) are culture-invariant. Under Turkish locale, YamlDotNet's
+// UnderscoredNamingConvention lowercased "Id" to dotless "ıd", breaking the "id" key match. Pin globally.
+CultureInfo.CurrentCulture = CultureInfo.InvariantCulture;
+CultureInfo.DefaultThreadCurrentCulture = CultureInfo.InvariantCulture;
+CultureInfo.DefaultThreadCurrentUICulture = CultureInfo.InvariantCulture;
+
+var command = args.Length > 0 ? args[0] : "info";
+var (projectOption, tailWithoutProject) = ExtractOption(args.Skip(1).ToArray(), "--project");
+var (profileOption, tail) = ExtractOption(tailWithoutProject, "--profile");
+var project = !string.IsNullOrWhiteSpace(projectOption)
+    ? TranslationProjectConfig.Load(projectOption)
+    : null;
+var profile = project?.GetProfile(profileOption);
+if (profile is not null)
+{
+    project!.ValidateProfile(profile);
+}
+// The function map is the project's function-start oracle. Loading it here
+// also publishes the CodeWarrior save/restore thunk ranges, which three static
+// passes (guest ABI contracts, inline-thunk emission, inferred ABI) look up by
+// symbol name instead of carrying the same four literal addresses each.
+var functionMap = project?.Translation.FunctionMapPath is { } functionMapPath
+    ? FunctionMap.Load(functionMapPath)
+    : null;
+if (functionMap is not null)
+{
+    GuestSaveRestoreThunks.Current = GuestSaveRestoreThunks.FromFunctionMap(functionMap);
+}
+var root = project?.WorkspaceRoot ?? Directory.GetCurrentDirectory();
+var preferCachedInputs = HasFlag(tail, "--prefer-cached-inputs");
+var dolFile = new Lazy<DolFile>(LoadDol);
+var relFile = new Lazy<RelFile?>(LoadRel);
+var image = new Lazy<ProgramImage>(LoadImage);
+var canonicalIrStore = new CanonicalIrStore();
+// Hoisted out of the translator factory so the base pipeline can prewarm the
+// recursive ABI cache in one stable pass, exactly like translate-mod does.
+var inferredGuestAbi = new Lazy<InferredGuestFunctionAbiProvider>(() =>
+    new InferredGuestFunctionAbiProvider(image.Value, canonicalIrStore));
+var runtimeNativeIndex = new Lazy<RuntimeNativeIndex>(() =>
+    RuntimeNativeIndexBuilder.Build(RequireProject().Runtime.NativeRegistrationRoot));
+// Void-stub signatures are only trusted as declared guest ABIs when the stub
+// lives under runtime.native_abi_directories (the vetted set); everywhere else
+// the C++ signature is documentation and the inferred ABI stays authoritative.
+var declaredNativeAbi = new Lazy<RuntimeNativeFunctionAbiProvider?>(() =>
+{
+    var runtime = RequireProject().Runtime;
+    if (runtime.NativeAbiDirectories.Count == 0)
+        return null;
+    var root = Path.GetFullPath(runtime.NativeRegistrationRoot);
+    var prefixes = runtime.NativeAbiDirectories
+        .Select(directory =>
+        {
+            var relative = Path.GetRelativePath(root, Path.GetFullPath(directory)).Replace('\\', '/');
+            return relative == "." ? "" : relative.TrimEnd('/') + "/";
+        })
+        .ToArray();
+    var scopedAddresses = runtimeNativeIndex.Value.Registrations
+        .Where(registration => prefixes.Any(prefix =>
+            registration.SourceFile.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)))
+        .Select(static registration => registration.Address)
+        .ToHashSet();
+    return RuntimeNativeFunctionAbiProvider.FromIndex(runtimeNativeIndex.Value, scopedAddresses);
+});
+var translator = new Lazy<FunctionTranslator>(() =>
+{
+    var inferredAbi = inferredGuestAbi.Value;
+    var providers = new List<IGuestFunctionAbiProvider>();
+    if (declaredNativeAbi.Value is { } nativeAbi)
+        providers.Add(nativeAbi);
+    providers.Add(inferredAbi);
+    var abiProvider = new CompositeGuestFunctionAbiProvider(providers.ToArray());
+    return new FunctionTranslator(image.Value, abiProvider);
+});
+// The runtime source index is built lazily once and shared by every consumer,
+// so ABI/effect analysis never rescans the C++ within one translator run.
+var runtimeNativeGuestEffects = new Lazy<RuntimeNativeGuestEffectSet>(() =>
+    runtimeNativeIndex.Value.ToGuestEffectSet());
+var baseTranslationExclusions = new Lazy<IReadOnlySet<uint>>(() =>
+    runtimeNativeIndex.Value.Registrations
+        .Where(static registration => registration.ExcludesBaseTranslation)
+        .Select(static registration => registration.Address)
+        .ToHashSet());
+// The base translation is shared across products, so mod-safety decisions must cover every enabled
+// profile's patch set, not just --profile. The launcher reuses one profile-less base for both vanilla
+// and Retro Rewind; keying on --profile alone let mod-patched callees get leaf-inlined into base
+// callers, baking vanilla code into the modded product (character-select corruption, LinkList panics).
+var modPatchProfiles = new Lazy<IReadOnlyList<Translator.Cli.Configuration.ProjectProfile>>(
+    () => CollectModPatchProfiles(project, profile));
+var modPatchedAddresses = new Lazy<IReadOnlySet<uint>>(() =>
+    BuildModPatchedAddresses(modPatchProfiles.Value));
+var leafInliningBlockedTargets = new Lazy<IReadOnlySet<uint>>(() =>
+    BuildLeafInliningBlockedTargets(
+        modPatchedAddresses.Value, runtimeNativeGuestEffects.Value, baseTranslationExclusions.Value));
+
+// Leaf inlining is a front-end decision: the splice happens before SSA, so the
+// canonical graph the emission wave lowers is already inlined and every
+// discovery entry point has to agree on it. The emission-time counterpart is
+// WithProjectCodegenPolicy.
+TranslationOptions WithProjectFrontEndPolicy(
+    TranslationOptions options, ProjectTranslation translation) =>
+    options with
+    {
+        AllowUnsupportedInstructions = translation.AllowUnsupportedInstructions,
+        // Splicing a body whose runtime winner is a native registration, a
+        // dropped translation or a Kamek overlay would silently keep executing
+        // the original bytes.
+        LeafInliningBlockedTargets = leafInliningBlockedTargets.Value
+    };
+string? translateModInputCacheDirectory = null;
+string? translateModPublishedOutputDirectory = null;
+List<AddressRange>? _executableRanges = null;
+// Callback discovery now runs on the discovery worker pool, so the range cache
+// must be built by exactly one thread and published only once it is complete.
+var _executableRangesGate = new object();
+// Argument registers checked for callback function pointers at every call site
+var argumentRegisters = new[] { "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10" };
+
+// Argument validation runs before any command can execute. `--help` used to
+// fall straight through to the command's parser, which ignored every argument
+// it did not recognise, so `emit-build-shards --help` ran the command with its
+// defaults and rewrote generated/build_shards.
+if (HandleCommandLineOptions(command, tail) is { } commandLineExitCode)
+{
+    return commandLineExitCode;
+}
+
+return command switch
+{
+    "help" or "--help" or "-h" or "-?" => ShowGlobalHelp(),
+    "info" or "--info" or "--version" => RunInfo(),
+    "generate-data-init" => RunGenerateDataInit(),
+    "translate-recursive" => RunTranslateRecursive(tail),
+    "translate-mod" => RunTranslateMod(tail),
+    "emit-build-shards" => RunEmitBuildShards(tail),
+    "emit-base-manifest" => RunEmitBaseManifest(tail),
+    "check-base-mod-awareness" => RunCheckBaseModAwareness(tail),
+    _ => ShowHelp(command)
+};
+
+/// <summary>
+/// May the workspace's completed base translation be reused for the Code.pul about to build?
+/// Exit 0 = yes, 3 = no, anything else = error (also treat as no). Answering wrong in the permissive
+/// direction bakes vanilla code into a modded product, so every uncertainty exits non-zero.
+/// </summary>
+int RunCheckBaseModAwareness(string[] argsTail)
+{
+    var metadataPath = OptionValue(argsTail, "--translation-output-metadata")
+        ?? Path.Combine(root, "generated", "base_translation_output.json");
+    var codePul = OptionValue(argsTail, "--code-pul") ?? profile?.CodePul;
+    if (string.IsNullOrWhiteSpace(codePul))
+    {
+        Console.Error.WriteLine("[translator] check-base-mod-awareness needs --code-pul or a profile that has one.");
+        return 1;
+    }
+    if (profile is null)
+    {
+        Console.Error.WriteLine("[translator] check-base-mod-awareness needs --profile.");
+        return 1;
+    }
+    if (!File.Exists(codePul))
+    {
+        Console.Error.WriteLine($"[translator] Code.pul not found: {codePul}");
+        return 1;
+    }
+
+    var awarenessPath = Path.Combine(
+        Path.GetDirectoryName(Path.GetFullPath(metadataPath))!, BaseTranslationModAwareness.FileName);
+    var awareness = BaseTranslationModAwarenessFile.TryRead(awarenessPath);
+    if (awareness is null)
+    {
+        Console.WriteLine(
+            $"[translator] No usable mod-patch awareness detail beside {metadataPath}; the base must retranslate.");
+        return 3;
+    }
+    if (!awareness.CoversCodePul(profile.Name, codePul, out var reason))
+    {
+        Console.WriteLine($"[translator] The base translation cannot be reused for this Code.pul: {reason}.");
+        return 3;
+    }
+    Console.WriteLine(
+        "[translator] This Code.pul patches exactly the translated functions the base translation was " +
+        "built around; the completed base translation stays valid.");
+    return 0;
+}
+
+int RunEmitBuildShards(string[] argsTail)
+{
+    var baseMetadata = OptionValue(argsTail, "--base-metadata") ?? Path.Combine(root, "generated", "base_translation_output.json");
+    var baseFunctions = OptionValue(argsTail, "--base-functions-dir") ?? Path.Combine(root, "generated", "functions");
+    var output = OptionValue(argsTail, "--out") ?? Path.Combine(root, "generated", "build_shards");
+    var nativeSources = OptionValue(argsTail, "--native-source-dir") ?? Path.Combine(root, "runtime", "src");
+    var resolvedProfile = OptionValue(argsTail, "--resolved-profile");
+    var retroCpp = OptionValue(argsTail, "--retro-cpp-dir");
+
+    try
+    {
+        var nativeSourcePath = Path.GetFullPath(nativeSources);
+        var nativeIndex = RuntimeNativeIndexBuilder.Build(nativeSourcePath);
+        var result = TranslatedBuildShardEmitter.Emit(new TranslatedBuildShardOptions(
+            Path.GetFullPath(baseMetadata),
+            Path.GetFullPath(baseFunctions),
+            Path.GetFullPath(output),
+            nativeSourcePath,
+            string.IsNullOrWhiteSpace(resolvedProfile) ? null : Path.GetFullPath(resolvedProfile),
+            string.IsNullOrWhiteSpace(retroCpp) ? null : Path.GetFullPath(retroCpp),
+            NativeIndex: nativeIndex));
+        Console.WriteLine("[translator] emitted stable translated build graph");
+        Console.WriteLine($"  base functions: {result.BaseFunctionCount:N0}");
+        Console.WriteLine($"  shared base functions: {result.SharedBaseFunctionCount:N0}");
+        Console.WriteLine($"  profile-sensitive targets/callers: {result.ProfileSensitiveTargetCount:N0}/{result.ProfileSensitiveCallerCount:N0}");
+        Console.WriteLine($"  mod functions: {result.ModFunctionCount:N0}");
+        Console.WriteLine($"  base/mod shards: {result.BaseShardCount:N0}/{result.ModShardCount:N0}");
+        if (result.BaseCommonShardMapPath is { } shardMapPath)
+        {
+            Console.WriteLine(result.BaseCommonBoundariesReused
+                ? $"  base_common boundaries: reused frozen table {shardMapPath}"
+                : $"  base_common boundaries: packed and recorded {shardMapPath}");
+        }
+        if (result.BaseCommonBalance is { } balance)
+        {
+            // Frozen membership drifts as new functions are translated into
+            // existing ranges. Surfacing the spread is what makes that visible
+            // before it starts costing build throughput.
+            Console.WriteLine(
+                $"  base_common weight spread: {balance.ShardCount:N0} shards, " +
+                $"min {balance.MinCompileCostWeight:N0}, mean {balance.MeanCompileCostWeight:N0}, " +
+                $"max {balance.MaxCompileCostWeight:N0} (max/min {balance.SpreadRatio:F2}x)");
+        }
+        Console.WriteLine($"  CMake graph: {result.CMakeManifestPath}");
+        return 0;
+    }
+    catch (Exception ex) when (ex is IOException or InvalidDataException or ArgumentException)
+    {
+        Console.Error.WriteLine($"emit-build-shards failed: {ex.Message}");
+        return 1;
+    }
+}
+
+byte[] LoadBinaryInput(string spec, string outDir, string downloadFileName)
+{
+    if (Uri.TryCreate(spec, UriKind.Absolute, out var uri) &&
+        (uri.Scheme == Uri.UriSchemeHttp || uri.Scheme == Uri.UriSchemeHttps))
+    {
+        Directory.CreateDirectory(outDir);
+        var downloadPath = Path.Combine(outDir, downloadFileName);
+        var cachedPath = ResolveCachedTranslateModInput(downloadPath, downloadFileName, spec);
+        if (preferCachedInputs && cachedPath is not null)
+        {
+            Console.Error.WriteLine($"[translator] using cached input {cachedPath}");
+            var cachedBytes = File.ReadAllBytes(cachedPath);
+            if (!string.Equals(cachedPath, downloadPath, StringComparison.OrdinalIgnoreCase))
+            {
+                File.WriteAllBytes(downloadPath, cachedBytes);
+                File.WriteAllText(downloadPath + ".source", spec);
+            }
+            return cachedBytes;
+        }
+        Console.Error.WriteLine($"[translator] fetching {uri}");
+        using var client = new System.Net.Http.HttpClient();
+        var bytes = client.GetByteArrayAsync(uri).GetAwaiter().GetResult();
+        File.WriteAllBytes(downloadPath, bytes);
+        File.WriteAllText(downloadPath + ".source", spec);
+        return bytes;
+    }
+
+    return File.ReadAllBytes(Path.GetFullPath(Path.Combine(root, spec)));
+}
+
+string? ResolveCachedTranslateModInput(string outputPath, string fileName, string spec)
+{
+    if (CachedTranslateModInputMatchesSpec(outputPath, spec))
+    {
+        return outputPath;
+    }
+
+    if (!string.IsNullOrWhiteSpace(translateModInputCacheDirectory))
+    {
+        var priorPublishedPath = Path.Combine(translateModInputCacheDirectory, fileName);
+        if (CachedTranslateModInputMatchesSpec(priorPublishedPath, spec))
+        {
+            return priorPublishedPath;
+        }
+    }
+
+    return null;
+}
+
+bool CachedTranslateModInputMatchesSpec(string path, string spec)
+{
+    // A cached download is only valid for the spec that produced it; the
+    // sidecar records that spec so a changed profile URL forces a re-fetch
+    // instead of silently reusing bytes from the previous endpoint.
+    var sourcePath = path + ".source";
+    return File.Exists(path) &&
+        File.Exists(sourcePath) &&
+        string.Equals(File.ReadAllText(sourcePath).Trim(), spec.Trim(), StringComparison.Ordinal);
+}
+
+static uint AlignUp(uint value, uint alignment)
+{
+    if (alignment == 0 || (alignment & (alignment - 1)) != 0)
+    {
+        throw new ArgumentException("Alignment must be a non-zero power of two.", nameof(alignment));
+    }
+    return checked((value + alignment - 1u) & ~(alignment - 1u));
+}
+
+int RunInfo()
+{
+    var asm = Assembly.GetExecutingAssembly();
+    var version = asm.GetName().Version?.ToString() ?? "0.0.0";
+    Console.WriteLine($"PowerPC static recompiler (C#)\nVersion : {version}\nRuntime : {System.Runtime.InteropServices.RuntimeInformation.FrameworkDescription}");
+    if (project is not null)
+    {
+        Console.WriteLine($"Project : {project.Identity.DisplayName} ({project.Identity.Id})");
+        Console.WriteLine($"Memory  : 0x{project.Memory.Base:X8}+0x{project.Memory.Size:X}");
+        Console.WriteLine($"DOL     : {project.Inputs.Dol.Path}");
+        Console.WriteLine(project.Inputs.Rel is null
+            ? "REL     : none"
+            : $"REL     : {project.Inputs.Rel.Path} @ 0x{project.Inputs.Rel.LoadAddress:X8}");
+    }
+    return 0;
+}
+
+int RunTranslateRecursive(string[] argsTail)
+{
+    if (argsTail.Length == 0 || argsTail[0].StartsWith("--", StringComparison.Ordinal))
+    {
+        Console.Error.WriteLine("Usage: translator translate-recursive <start_addr> [--outdir path] [--output-metadata path] [--threads N] [--prune-stale]");
+        return 1;
+    }
+
+    var startAddr = ParseAddress(argsTail[0]);
+    var allowUnsupportedInstructions = RequireProject().Translation.AllowUnsupportedInstructions;
+    var outDir = OptionValue(argsTail, "--outdir") ?? RequireProject().Output.Functions;
+    var outputMetadataPath = OptionValue(argsTail, "--output-metadata");
+    var productionSourceBundlePath = OptionValue(argsTail, "--production-source-bundle");
+    var emitFunctionFiles = !HasFlag(argsTail, "--no-function-files");
+    if (!emitFunctionFiles && string.IsNullOrWhiteSpace(productionSourceBundlePath))
+        throw new ArgumentException("--no-function-files requires --production-source-bundle.");
+    BaseTranslationOutputMetadata? previousOutputMetadata = null;
+    if (HasFlag(argsTail, "--prune-stale") &&
+        outputMetadataPath is not null &&
+        File.Exists(outputMetadataPath))
+    {
+        try
+        {
+            previousOutputMetadata = BaseTranslationOutputMetadataFile.Read(outputMetadataPath);
+        }
+        catch (Exception ex)
+        {
+            Console.Error.WriteLine(
+                $"[translator] Warning: existing output metadata could not be read; stale pruning will use one-time tree migration: {ex.Message}");
+        }
+    }
+    var pruneStale = HasFlag(argsTail, "--prune-stale");
+    var threadsOption = OptionValue(argsTail, "--threads");
+    var maxThreads = threadsOption != null ? Math.Max(1, ParseInt(threadsOption)) : Math.Max(1, Environment.ProcessorCount);
+    // Discovery batches: cheap front-end-only work items, so the batch is sized
+    // generously to keep queue overhead off the hot path. Deliberately larger
+    // than the mod emission wave below, which carries whole C++ emissions.
+    var batchSize = Math.Max(64, maxThreads * 8);
+    Console.WriteLine($"[translator] Using up to {maxThreads} worker thread(s).");
+
+    // Log start time
+    var startTime = DateTime.Now;
+    Console.WriteLine($"[translator] Starting translation at {startTime:HH:mm:ss}");
+
+    try
+    {
+        Directory.CreateDirectory(outDir);
+
+        var visited = new HashSet<uint>();
+        var translated = new HashSet<uint>();
+        // Per translated function: sorted, coalesced [start, endExclusive) pairs of
+        // the instruction addresses its own control flow executes (leaf-inlined
+        // callees are decoded separately and never appear here). Feeds the
+        // fall-through interior-entry detection for the base manifest.
+        var translatedFlowCoverage = new Dictionary<uint, uint[]>();
+        var gqrUnknownEntryRoots = new HashSet<uint> { startAddr };
+        var translatedFunctionEnds = new Dictionary<uint, uint>();
+        // Every map entry is a function start, so the whole boundary set is known
+        // before the first decode instead of accumulating as discovery proceeds.
+        var knownBaseFunctionEntryPoints = BuildKnownBaseFunctionEntryPoints(
+            outDir,
+            RequireProject().Translation.EntryPoints
+                .Append(startAddr)
+                .Concat(functionMap?.Addresses ?? Array.Empty<uint>()),
+            includeGeneratedHistory: false);
+        Console.WriteLine($"[translator] Loaded {knownBaseFunctionEntryPoints.Count:N0} known base function start(s) for tail-call boundary detection.");
+        if (functionMap is not null)
+        {
+            Console.WriteLine(
+                $"[translator] Function map: {functionMap.Addresses.Count:N0} entry point(s), " +
+                $"{functionMap.NamedCount:N0} named ({functionMap.SourcePath}).");
+        }
+
+        var nativeGuestEffects = runtimeNativeGuestEffects.Value;
+        Console.WriteLine($"[translator] Native guest-effect contracts: {nativeGuestEffects.Contracts.Count:N0} total, " +
+                          $"{nativeGuestEffects.PreciseContracts.Count:N0} precise, " +
+                          $"{nativeGuestEffects.ConservativeContracts.Count:N0} full-context.");
+        var residentTranslationExclusions = baseTranslationExclusions.Value;
+        Console.WriteLine(
+            $"[translator] Leaf inlining: {leafInliningBlockedTargets.Value.Count:N0} address(es) are not " +
+            "inlinable (native, excluded from translation, or mod-patched).");
+
+        var queue = new Queue<(uint addr, int depth)>();
+        queue.Enqueue((startAddr, 0));
+        visited.Add(startAddr);
+
+        // Map entries the call-graph walk never reaches. They are translated, but
+        // on a decode or lift failure they are skipped with a count instead of
+        // failing the run: unlike a walked call target, nothing proves the map
+        // entry is really code, and one noisy line must not block a release.
+        var speculativeSeeds = new Queue<uint>(functionMap?.Addresses ?? Array.Empty<uint>());
+        var speculativeSkips = new List<(uint Address, string Reason)>();
+
+        var count = 0;
+        var totals = new List<TranslationMetrics>();
+        var printedDepths = new HashSet<int>();
+        var filesUpdated = 0;
+        var filesUnchanged = 0;
+        var emittedPaths = pruneStale ? new HashSet<string>(StringComparer.OrdinalIgnoreCase) : null;
+        var baseSummaries = new Dictionary<uint, GqrFunctionSummary>();
+        var baseWork = new Dictionary<uint, (
+            string Name,
+            string Path,
+            int MaxInstructions,
+            int MaxBytes,
+            bool AllowUnsupported)>();
+        var baseOutputPaths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        BaseTranslationOutputMetadata? completedOutputMetadata = null;
+        BaseTranslationModAwareness? completedModAwareness = null;
+
+        void TrackEmittedPath(string path)
+        {
+            if (emittedPaths is null)
+            {
+                return;
+            }
+
+            lock (emittedPaths)
+            {
+                emittedPaths.Add(Path.GetFullPath(path));
+            }
+        }
+
+        var parallelOptions = new ParallelOptions { MaxDegreeOfParallelism = maxThreads };
+
+        void ProcessQueue(bool speculative = false)
+        {
+            while (queue.Count > 0)
+            {
+                var batch = new List<(uint Address, int Depth, string Name)>(batchSize);
+                var batchAddresses = new HashSet<uint>();
+                var candidates = QueueBatch.Dequeue(
+                    queue,
+                    batchSize,
+                    next => ShouldSkip(next) || !batchAddresses.Add(next.addr));
+                foreach (var next in candidates)
+                {
+                    var fallbackName = $"func_{next.addr:X8}";
+                    var name = ResolveFunctionName(next.addr, preferred: null, fallbackName);
+                    // Every queued item is a translator-discovered function start.
+                    // Register the whole wave before decoding so peer boundaries
+                    // are deterministic and cannot be swallowed by batch order.
+                    knownBaseFunctionEntryPoints.Add(next.addr);
+                    batch.Add((next.addr, next.depth, name));
+                }
+
+                if (batch.Count == 0)
+                {
+                    continue;
+                }
+
+                foreach (var depth in batch.Select(b => b.Depth).Distinct().OrderBy(d => d))
+                {
+                    LogDepth(depth);
+                }
+
+                TranslateBatch(batch, speculative);
+            }
+        }
+
+        // Batches drain one at a time so a callee of a prior speculative entry arrives with a known
+        // caller/GQR state instead of as another unknown root. Everything here is speculative, so a
+        // "call" decoded from an unreached map entry isn't proven code; treat failures as soft, not fatal.
+        void ProcessSpeculativeSeeds()
+        {
+            while (speculativeSeeds.Count > 0)
+            {
+                var batch = new List<(uint Address, int Depth, string Name)>(batchSize);
+                var candidates = QueueBatch.Dequeue(
+                    speculativeSeeds,
+                    batchSize,
+                    address => translated.Contains(address) || !visited.Add(address));
+                foreach (var address in candidates)
+                {
+                    // Nothing calls this from the translated set, so its entry
+                    // GQR state is unconstrained.
+                    gqrUnknownEntryRoots.Add(address);
+                    batch.Add((address, 0, ResolveFunctionName(address, preferred: null, $"func_{address:X8}")));
+                }
+
+                if (batch.Count == 0)
+                {
+                    continue;
+                }
+
+                TranslateBatch(batch, speculative: true);
+                ProcessQueue(speculative: true);
+            }
+        }
+
+        void LogDepth(int depth)
+        {
+            if (printedDepths.Add(depth))
+            {
+                Console.WriteLine($"Translating functions on depth {depth}...");
+            }
+        }
+
+        bool ShouldSkip((uint addr, int depth) item)
+        {
+            if (translated.Contains(item.addr))
+            {
+                return true;
+            }
+
+            return false;
+        }
+
+        // `speculative` selects the failure policy for the whole batch: a walked
+        // call target that will not decode is a translator bug and stops the run,
+        // while an address the configured map claims - directly, or through the calls
+        // decoded out of one - is dropped with a counted warning.
+        void TranslateBatch(List<(uint Address, int Depth, string Name)> batch, bool speculative = false)
+        {
+            var results = new FunctionDiscoveryResult?[batch.Count];
+            IndexedParallel.For(batch.Count, parallelOptions, i => results[i] = Attempt(batch[i], speculative));
+
+            // Re-run only translations that swallowed a newly revealed sibling entry, or direct
+            // branches could bypass a mod overlay registered there. Both scans are pure per-result
+            // so they run on the same worker pool; the dedup filter below keeps first sighting.
+            var discoveryTargets = new uint[results.Length][];
+            var swallowedSiblingEntries = new uint[results.Length][];
+            IndexedParallel.For(results.Length, parallelOptions, i =>
+            {
+                if (results[i] is not { } result) return;
+                discoveryTargets[i] = DiscoverDiscoveryTranslationTargets(result).ToArray();
+                swallowedSiblingEntries[i] = DiscoverSwallowedSiblingEntries(result).ToArray();
+            });
+            var newlyKnownEntries = Enumerable.Range(0, results.Length)
+                .Where(i => results[i] is not null)
+                .SelectMany(i => discoveryTargets[i].Concat(swallowedSiblingEntries[i]))
+                .Where(knownBaseFunctionEntryPoints.Add)
+                .ToHashSet();
+            if (newlyKnownEntries.Count != 0)
+            {
+                // The boundary set is final for this batch once the filter above has run,
+                // so the affected re-translations are independent of one another.
+                var affected = new List<int>();
+                for (var i = 0; i < results.Length; i++)
+                {
+                    if (results[i] is not { } result) continue;
+                    var entry = result.EntryPoint;
+                    if (result.Instructions.Any(instruction =>
+                            instruction.Address != entry && newlyKnownEntries.Contains(instruction.Address)))
+                    {
+                        affected.Add(i);
+                    }
+                }
+
+                IndexedParallel.For(affected.Count, parallelOptions, k =>
+                {
+                    var i = affected[k];
+                    results[i] = Attempt(batch[i], speculative);
+                    if (results[i] is { } result)
+                    {
+                        discoveryTargets[i] = DiscoverDiscoveryTranslationTargets(result).ToArray();
+                    }
+                });
+            }
+
+            // The compact GQR projection is a pure walk of the final SSA graph and the
+            // canonical store serializes its own dictionary, so both move off the serial
+            // commit. Every address in a batch is distinct and untranslated, so the store
+            // sees one Put per key regardless of completion order.
+            var summaries = new GqrFunctionSummary[results.Length];
+            IndexedParallel.For(results.Length, parallelOptions, i =>
+            {
+                if (results[i] is not { } result) return;
+                summaries[i] = GqrFunctionSummary.Create(result.Ssa.Function);
+                canonicalIrStore.Put(batch[i].Address, result.Ssa.Function);
+            });
+
+            // Update state sequentially (thread-safe)
+            for (var i = 0; i < batch.Count; i++)
+            {
+                if (results[i] is not { } result) continue;
+                CommitResult(batch[i], result, discoveryTargets[i], summaries[i]);
+            }
+        }
+
+        FunctionDiscoveryResult? Attempt((uint Address, int Depth, string Name) work, bool speculative)
+        {
+            if (!speculative)
+            {
+                return TranslateWork(work);
+            }
+
+            try
+            {
+                return TranslateWork(work);
+            }
+            catch (Exception ex)
+            {
+                lock (speculativeSkips)
+                {
+                    speculativeSkips.Add((work.Address, ex.Message));
+                }
+
+                return null;
+            }
+        }
+
+        static IEnumerable<uint> DiscoverSwallowedSiblingEntries(FunctionDiscoveryResult result)
+        {
+            var instructionsByAddress = result.Instructions.ToDictionary(instruction => instruction.Address);
+            foreach (var branch in result.Instructions.Where(instruction => instruction.IsUnconditionalBranch))
+            {
+                foreach (var target in branch.BranchTargets ?? Array.Empty<uint>())
+                {
+                    if (target == result.EntryPoint ||
+                        !instructionsByAddress.TryGetValue(target, out var targetInstruction))
+                    {
+                        continue;
+                    }
+
+                    if (targetInstruction.Mnemonic.Equals("stwu", StringComparison.OrdinalIgnoreCase) &&
+                        targetInstruction.OperandText.StartsWith("r1,", StringComparison.OrdinalIgnoreCase))
+                    {
+                        yield return target;
+                    }
+                }
+            }
+        }
+
+        FunctionDiscoveryResult TranslateWork((uint Address, int Depth, string Name) work)
+        {
+            var options = WithProjectFrontEndPolicy(new TranslationOptions(
+                work.Name,
+                KnownFunctionEntryPoints: knownBaseFunctionEntryPoints),
+                RequireProject().Translation);
+            return translator.Value.Discover(work.Address, options);
+        }
+
+        void CommitResult(
+            (uint Address, int Depth, string Name) work,
+            FunctionDiscoveryResult result,
+            IReadOnlyList<uint> discoveryTargets,
+            GqrFunctionSummary summary)
+        {
+            // File writing moved to parallel section above
+            totals.Add(result.Metrics);
+            count++;
+            translated.Add(work.Address);
+            translatedFunctionEnds[work.Address] = GetFunctionInstructionEnd(result);
+            translatedFlowCoverage[work.Address] = CoalesceInstructionRanges(result);
+
+            foreach (var target in discoveryTargets)
+            {
+                knownBaseFunctionEntryPoints.Add(target);
+                if (visited.Add(target))
+                {
+                    queue.Enqueue((target, work.Depth + 1));
+                }
+            }
+
+            // Discovery needs decoded PPC instructions and SSA temporarily. The
+            // whole-program pass only needs its compact GQR projection; release
+            // the full graph here and rebuild it once, with final facts, during
+            // the emission wave.
+            var outputPath = Path.Combine(outDir, $"{work.Name}.cpp");
+            if (!baseOutputPaths.Add(Path.GetFullPath(outputPath)))
+            {
+                throw new InvalidOperationException(
+                    $"Translator output path collision for '{outputPath}' while retaining function 0x{work.Address:X8}.");
+            }
+            // Both the projection and the canonical encoding were produced by the
+            // parallel stage above; this only records them.
+            baseSummaries[work.Address] = summary;
+            baseWork[work.Address] = (
+                work.Name,
+                outputPath,
+                TranslationOptions.Default.MaxInstructions,
+                TranslationOptions.Default.MaxBytes,
+                allowUnsupportedInstructions);
+        }
+
+        // The call-graph walk from the entry point, then everything the configured map
+        // knows about that the walk never reached. Those two sources replace the
+        // constructor, vtable, function-pointer and adjacent-prologue scans, which
+        // guessed at exactly this set - and the hand-maintained force-translate
+        // list that existed to paper over the addresses they still missed.
+        ProcessQueue();
+        var walkReachable = count;
+        ProcessSpeculativeSeeds();
+        if (functionMap is not null)
+        {
+            Console.WriteLine(
+                $"[translator] Function starts: {walkReachable:N0} reached by the call-graph walk, " +
+                $"{count - walkReachable:N0} added speculatively from the map.");
+            if (speculativeSkips.Count != 0)
+            {
+                foreach (var (address, reason) in speculativeSkips.OrderBy(static skip => skip.Address).Take(20))
+                {
+                    Console.WriteLine($"[translator]   skipped map entry 0x{address:X8}: {reason}");
+                }
+                Console.WriteLine(
+                    $"[translator] Skipped {speculativeSkips.Count:N0} map entry/entries that did not translate; " +
+                    "these are seeded only by the map and are never reached by a call.");
+            }
+        }
+
+        if (baseSummaries.Count > 0)
+        {
+            // Wall-clock accounting for the serial whole-program section; prints
+            // per-phase elapsed time so regressions are visible in build logs.
+            var lastPhaseSeconds = 0d;
+            void LogPhase(string label)
+            {
+                var now = (DateTime.Now - startTime).TotalSeconds;
+                Console.WriteLine($"[translator] phase '{label}': {now - lastPhaseSeconds:F1}s (t={now:F1}s)");
+                lastPhaseSeconds = now;
+            }
+            LogPhase("discovery");
+            // Function starts are discovered from the current inputs, not from a
+            // previous generated tree. If a later discovery source identified a
+            // boundary inside an earlier decode, rebuild only that owner's compact
+            // summary with the final deterministic boundary set.
+            var finalBoundaries = knownBaseFunctionEntryPoints.OrderBy(address => address).ToArray();
+            var boundaryRepairAddresses = translatedFunctionEnds
+                .Where(pair => ContainsInteriorBoundary(pair.Key, pair.Value, finalBoundaries))
+                .Select(pair => pair.Key)
+                .OrderBy(address => address)
+                .ToArray();
+            if (boundaryRepairAddresses.Length != 0)
+            {
+                Console.WriteLine($"[translator] Reanalyzing {boundaryRepairAddresses.Length:N0} function(s) affected by later-discovered boundaries...");
+                var repaired = new FunctionDiscoveryResult[boundaryRepairAddresses.Length];
+                IndexedParallel.For(boundaryRepairAddresses.Length, parallelOptions, i =>
+                {
+                    var address = boundaryRepairAddresses[i];
+                    var work = baseWork[address];
+                    repaired[i] = translator.Value.Discover(address, WithProjectFrontEndPolicy(new TranslationOptions(
+                        work.Name,
+                        MaxInstructions: work.MaxInstructions,
+                        MaxBytes: work.MaxBytes,
+                        AllowUnsupportedInstructions: work.AllowUnsupported,
+                        KnownFunctionEntryPoints: knownBaseFunctionEntryPoints),
+                        RequireProject().Translation));
+                });
+                for (var i = 0; i < boundaryRepairAddresses.Length; i++)
+                {
+                    var address = boundaryRepairAddresses[i];
+                    baseSummaries[address] = GqrFunctionSummary.Create(repaired[i].Ssa.Function);
+                    canonicalIrStore.Put(address, repaired[i].Ssa.Function);
+                    translatedFunctionEnds[address] = GetFunctionInstructionEnd(repaired[i]);
+                    translatedFlowCoverage[address] = CoalesceInstructionRanges(repaired[i]);
+                }
+            }
+
+            LogPhase("boundary repair");
+
+            // Entries another translation's own flow executes through. Branch
+            // targets surface as block labels and are excluded downstream by the
+            // manifest builder's label rule; this catches the label-less
+            // fall-through case (e.g. a function map's split-switch artifact),
+            // which must not split the patch-homing base function ranges.
+            var interiorEntryPoints = ComputeInteriorEntryPoints(translatedFlowCoverage);
+
+            {
+                var inlinedSites = totals.Sum(static metrics => metrics.InlinedCallSites);
+                var inlinedFunctions = totals.Count(static metrics => metrics.InlinedCallSites > 0);
+                var inlinedGuestInstructions = totals.Sum(static metrics => metrics.InlinedGuestInstructions);
+                Console.WriteLine(
+                    $"[translator] Leaf inlining: {inlinedSites:N0} direct call site(s) spliced across " +
+                    $"{inlinedFunctions:N0} function(s), {inlinedGuestInstructions:N0} guest instruction(s) duplicated.");
+            }
+
+            Console.WriteLine("[translator] Computing interprocedural GQR constants and callee write summaries...");
+            var gqrAnalysis = GqrInterproceduralAnalysis.Analyze(
+                baseSummaries,
+                gqrUnknownEntryRoots);
+            var directGqrTargets = baseSummaries.Values
+                .SelectMany(summary => summary.DirectGuestTargets)
+                .Where(baseSummaries.ContainsKey)
+                .ToHashSet();
+            var guardedRoots = baseSummaries.Keys.Where(address => !directGqrTargets.Contains(address)).ToHashSet();
+            guardedRoots.Add(startAddr);
+            var guardedGqrAnalysis = GqrInterproceduralAnalysis.Analyze(
+                baseSummaries,
+                guardedRoots);
+            var gqrSpecializedFunctions = gqrAnalysis.EntryConstants.Count(pair => pair.Value.Count != 0);
+            var gqrSpecializedRegisters = gqrAnalysis.EntryConstants.Sum(pair => pair.Value.Count);
+            var guardedGqrFunctions = guardedGqrAnalysis.EntryConstants.Count(pair =>
+                pair.Value.Count > gqrAnalysis.EntryConstants[pair.Key].Count);
+            Console.WriteLine($"[translator] Proven GQR entry constants: {gqrSpecializedRegisters:N0} across {gqrSpecializedFunctions:N0} function(s); reachable functions: {gqrAnalysis.ReachableFunctions.Count:N0}.");
+            Console.WriteLine($"[translator] Runtime-guarded direct-call GQR contexts: {guardedGqrFunctions:N0} function(s).");
+            LogPhase("GQR interprocedural x2");
+
+            var emissionAddresses = baseSummaries.Keys.OrderBy(address => address).ToArray();
+            var localGuestAbiContracts = new Dictionary<uint, GuestAbiContract>(emissionAddresses.Length);
+            var canonicalGuestFunctions = new Dictionary<uint, IrFunction>(emissionAddresses.Length);
+            var irInstructionCounts = new Dictionary<uint, int>(emissionAddresses.Length);
+            // Each slot is an independent pure decode plus contract analysis, so
+            // compute them in parallel into position-indexed arrays and fill the
+            // dictionaries afterwards in the original ascending order. Dictionary
+            // insertion order is preserved, so every downstream enumeration of
+            // these maps is byte-for-byte the same as the serial version.
+            var canonicalByIndex = new IrFunction[emissionAddresses.Length];
+            var localContractByIndex = new GuestAbiContract[emissionAddresses.Length];
+            var irInstructionCountByIndex = new int[emissionAddresses.Length];
+            IndexedParallel.For(emissionAddresses.Length, parallelOptions, i =>
+            {
+                var address = emissionAddresses[i];
+                if (!canonicalIrStore.TryGet(address, out var canonicalSsa))
+                    throw new InvalidOperationException($"Missing canonical SSA while building ABI contract for 0x{address:X8}.");
+                canonicalByIndex[i] = canonicalSsa;
+                localContractByIndex[i] = GuestAbiContractAnalyzer.Analyze(canonicalSsa);
+                irInstructionCountByIndex[i] = canonicalSsa.Blocks.Sum(block => block.Instructions.Count);
+            });
+            for (var i = 0; i < emissionAddresses.Length; i++)
+            {
+                var address = emissionAddresses[i];
+                canonicalGuestFunctions[address] = canonicalByIndex[i];
+                localGuestAbiContracts[address] = localContractByIndex[i];
+                irInstructionCounts[address] = irInstructionCountByIndex[i];
+            }
+
+            LogPhase("canonical decode + local contracts");
+
+            // Compose guest calls in execution order. This preserves a callee
+            // input only when it is still read-before-write at the caller entry,
+            // rather than retaining every descendant dependency forever.
+            var interproceduralGuestAbi = GuestAbiInterproceduralAnalyzer.Analyze(
+                canonicalGuestFunctions,
+                nativeGuestEffects.Contracts);
+            var guestAbiContracts = interproceduralGuestAbi.Contracts
+                .ToDictionary(static pair => pair.Key, static pair => pair.Value);
+            var recursiveComponents = interproceduralGuestAbi.StronglyConnectedComponents
+                .Count(component => component.Count > 1 ||
+                    guestAbiContracts[component[0]].DirectCallTargets.Contains(component[0]));
+            Console.WriteLine(
+                $"[translator] SSA guest-state call graph: " +
+                $"{interproceduralGuestAbi.StronglyConnectedComponents.Count:N0} component(s), " +
+                $"{recursiveComponents:N0} recursive.");
+
+            LogPhase("interprocedural guest ABI");
+
+            // Calls to a registered native observe the native implementation's
+            // contract, not the excluded PPC body that happens to share its address.
+            foreach (var pair in nativeGuestEffects.Contracts)
+                guestAbiContracts[pair.Key] = pair.Value;
+
+            // Determine the state that is actually consumed after each direct
+            // call. Public CpuContext wrappers retain the complete architectural
+            // behavior; native internal entries return only this union of
+            // call-site-live values.
+            var demandedStateFreeOutputs = new Dictionary<uint, GuestStateMask>();
+            var stateLivenessByFunction = new Dictionary<uint, GuestStateLivenessResult>(emissionAddresses.Length);
+            // The per-function liveness solve is pure; only the demanded-output
+            // union is order sensitive, so that stays sequential in ascending
+            // address order below.
+            var livenessByIndex = new GuestStateLivenessResult[emissionAddresses.Length];
+            IndexedParallel.For(emissionAddresses.Length, parallelOptions, i =>
+            {
+                var address = emissionAddresses[i];
+                var contract = guestAbiContracts[address];
+                // Start from the public CpuContext wrapper, not the ABI return masks alone: masks-only
+                // let compact descendant variants drop live volatile GPR/FPR/CR/LR effects (e.g. f2-f4
+                // through 0x8022F80C -> 0x80085040) that aren't source-language return values.
+                var exitLive = GuestStateLivenessAnalyzer.MaterializedContextExit(contract);
+                livenessByIndex[i] = GuestStateLivenessAnalyzer.Analyze(
+                    canonicalGuestFunctions[address], guestAbiContracts, exitLive);
+            });
+            for (var i = 0; i < emissionAddresses.Length; i++)
+            {
+                var address = emissionAddresses[i];
+                var liveness = livenessByIndex[i];
+                stateLivenessByFunction[address] = liveness;
+                foreach (var call in liveness.DirectCalls)
+                {
+                    demandedStateFreeOutputs[call.Target] = demandedStateFreeOutputs
+                        .GetValueOrDefault(call.Target)
+                        .Union(call.Outputs);
+                }
+            }
+
+            LogPhase("guest state liveness");
+
+            // Residency, boundary narrowing and the stack elisions all come from
+            // WithProjectCodegenPolicy below, which every emitting path shares.
+            var residentPolicy = RequireProject().Translation;
+            // A Kamek write into a translated function makes a mod overlay its runtime winner, with
+            // effects this liveness pass never computed, so callers need the full residency fence.
+            // Only raw patch addresses are needed here since the base manifest doesn't exist yet.
+            var modOverridableCallTargets = BuildModOverridableCallTargets(
+                modPatchedAddresses.Value, translatedFunctionEnds);
+            if (modOverridableCallTargets.Count != 0)
+            {
+                Console.WriteLine(
+                    $"[translator] Mod-overridable direct-call targets: {modOverridableCallTargets.Count:N0} " +
+                    "function(s) keep the full residency boundary.");
+            }
+            var directlyCalledGuestFunctions = localGuestAbiContracts.Values
+                .SelectMany(static contract => contract.DirectCallTargets)
+                .Where(localGuestAbiContracts.ContainsKey)
+                .ToHashSet();
+            static int StateFreeInputValueCount(GuestAbiContract contract) =>
+                BitOperations.PopCount(contract.GprReadBeforeWriteMask) +
+                BitOperations.PopCount(contract.FprReadBeforeWriteMask | contract.FprPossibleWriteMask) +
+                ((contract.CrReadBeforeWriteMask | contract.CrPossibleWriteMask) != 0 ? 1 : 0) +
+                (contract.ReadsXerBeforeWrite || contract.MayWriteXer ? 1 : 0) +
+                (contract.ReadsCtrBeforeWrite || contract.MayWriteCtr ? 1 : 0) +
+                (contract.ReadsLrBeforeWrite || contract.MayWriteLr ? 1 : 0) +
+                (contract.ReadsFpscrBeforeWrite || contract.MayWriteFpscr ? 1 : 0) +
+                BitOperations.PopCount((uint)(contract.GqrReadBeforeWriteMask | contract.GqrPossibleWriteMask)) +
+                BitOperations.PopCount((uint)(contract.HidReadBeforeWriteMask | contract.HidPossibleWriteMask));
+            static int StateFreeOutputValueCount(GuestAbiContract contract) =>
+                BitOperations.PopCount(contract.GprPossibleWriteMask) +
+                BitOperations.PopCount(contract.FprPossibleWriteMask) +
+                (contract.CrPossibleWriteMask != 0 ? 1 : 0) +
+                (contract.MayWriteXer ? 1 : 0) + (contract.MayWriteCtr ? 1 : 0) +
+                (contract.MayWriteLr ? 1 : 0) + (contract.MayWriteFpscr ? 1 : 0) +
+                BitOperations.PopCount((uint)contract.GqrPossibleWriteMask) +
+                BitOperations.PopCount((uint)contract.HidPossibleWriteMask);
+
+            GuestAbiContract PlannedStateFreeContract(uint address)
+            {
+                var publicContract = guestAbiContracts[address];
+                var demandedOutputs = demandedStateFreeOutputs.GetValueOrDefault(address);
+                var demandedGprOutputs = publicContract.GprPossibleWriteMask & demandedOutputs.Gpr;
+                return publicContract with
+                {
+                    // A may-write value is also an input unless every exit
+                    // overwrites it. On the no-write path the native result
+                    // must return the incoming architectural value.
+                    GprReadBeforeWriteMask = GuestStateLivenessAnalyzer.RequiredStateFreeGprInputs(
+                        publicContract, demandedOutputs.Gpr),
+                    GprPossibleWriteMask = demandedGprOutputs,
+                    FprPossibleWriteMask = publicContract.FprPossibleWriteMask & demandedOutputs.Fpr,
+                    CrPossibleWriteMask = (byte)(publicContract.CrPossibleWriteMask & demandedOutputs.Cr),
+                    MayWriteXer = publicContract.MayWriteXer && demandedOutputs.Xer,
+                    MayWriteCtr = publicContract.MayWriteCtr && demandedOutputs.Ctr,
+                    MayWriteLr = publicContract.MayWriteLr && demandedOutputs.Lr,
+                    MayWriteFpscr = publicContract.MayWriteFpscr && demandedOutputs.Fpscr,
+                    GqrPossibleWriteMask = (byte)(publicContract.GqrPossibleWriteMask & demandedOutputs.Gqr),
+                    HidPossibleWriteMask = (byte)(publicContract.HidPossibleWriteMask & demandedOutputs.Hid)
+                };
+            }
+
+            // Admit closed direct-call components as a unit. A region is
+            // state-free only when all of its translated descendants can use
+            // the same representation; external/native targets remain real
+            // synchronization boundaries and exclude that component for now.
+            var components = interproceduralGuestAbi.StronglyConnectedComponents;
+            var componentByAddress = components
+                .SelectMany(static (component, index) => component.Select(address => (address, index)))
+                .ToDictionary(static pair => pair.address, static pair => pair.index);
+            var eligibleComponents = components
+                .Select((component, index) => new
+                {
+                    index,
+                    eligible = component.All(address =>
+                        !residentTranslationExclusions.Contains(address) &&
+                        !localGuestAbiContracts[address].HasFullSynchronizationFence &&
+                        GuestStateLivenessAnalyzer.CanDeconstructWithoutContext(canonicalGuestFunctions[address]) &&
+                        (!directlyCalledGuestFunctions.Contains(address) ||
+                         (StateFreeInputValueCount(PlannedStateFreeContract(address)) <= 4 &&
+                          StateFreeOutputValueCount(PlannedStateFreeContract(address)) <= 2)))
+                })
+                .Where(static item => item.eligible)
+                .Select(static item => item.index)
+                .ToHashSet();
+            bool removedComponent;
+            do
+            {
+                removedComponent = false;
+                foreach (var componentIndex in eligibleComponents.ToArray())
+                {
+                    var hasUnsafeDescendant = components[componentIndex]
+                        .SelectMany(address => localGuestAbiContracts[address].DirectCallTargets)
+                        .Any(target => !componentByAddress.TryGetValue(target, out var targetComponent) ||
+                                       !eligibleComponents.Contains(targetComponent));
+                    if (!hasUnsafeDescendant) continue;
+                    eligibleComponents.Remove(componentIndex);
+                    removedComponent = true;
+                }
+            } while (removedComponent);
+            var stateFreeAbiFunctions = eligibleComponents
+                .SelectMany(index => components[index])
+                .Where(directlyCalledGuestFunctions.Contains)
+                .ToHashSet();
+            Console.WriteLine(
+                $"[translator] Automatic state-free region ABI: {stateFreeAbiFunctions.Count:N0} directly called function(s) " +
+                $"across {eligibleComponents.Count:N0} closed component(s).");
+
+            // The two suffixes are appended to the same sanitized stem rather than
+            // derived from each other: rewriting "_resident" into "_statefree"
+            // with an unanchored Replace also rewrote any guest symbol whose own
+            // name happened to contain that substring.
+            static string CxxSymbolStem(string name)
+            {
+                var builder = new StringBuilder(name.Length + 16);
+                foreach (var ch in name.StartsWith("0x", StringComparison.OrdinalIgnoreCase) ? name[2..] : name)
+                    builder.Append(char.IsLetterOrDigit(ch) || ch == '_' ? ch : '_');
+                if (builder.Length == 0 || !(char.IsLetter(builder[0]) || builder[0] == '_'))
+                    builder.Insert(0, "func_");
+                return builder.ToString();
+            }
+            var stateFreeCallSymbols = stateFreeAbiFunctions.ToDictionary(
+                address => address,
+                address => CxxSymbolStem(baseWork[address].Name) + "_statefree");
+            var stateFreeCallSiteVariantsByCaller = new Dictionary<
+                uint, IReadOnlyDictionary<GuestStateFreeCallSiteKey, GuestStateFreeCallVariant>>();
+            var stateFreeEntryVariantsByTarget = new Dictionary<
+                uint, IReadOnlyList<GuestStateFreeCallVariant>>();
+            Dictionary<string, uint> SelectGqrConstants(uint address, out bool useGuardedConstants)
+            {
+                var safeConstants = gqrAnalysis.EntryConstants[address];
+                var guardedConstants = guardedGqrAnalysis.EntryConstants[address];
+                useGuardedConstants = guardedConstants.Count > safeConstants.Count;
+                return new Dictionary<string, uint>(
+                    useGuardedConstants ? guardedConstants : safeConstants,
+                    StringComparer.OrdinalIgnoreCase);
+            }
+
+            TranslationOptions BuildEmissionOptions(
+                uint address,
+                IReadOnlyDictionary<uint, GuestAbiContract> stateFreeAbiContracts)
+            {
+                var work = baseWork[address];
+                var selectedGqrConstants = SelectGqrConstants(address, out var useGuardedConstants);
+                return WithProjectCodegenPolicy(
+                    new TranslationOptions(
+                        work.Name,
+                        MaxInstructions: work.MaxInstructions,
+                        MaxBytes: work.MaxBytes,
+                        AllowUnsupportedInstructions: work.AllowUnsupported,
+                        KnownFunctionEntryPoints: knownBaseFunctionEntryPoints,
+                        GqrEntryConstants: selectedGqrConstants,
+                        GqrCalleeWriteMasks: gqrAnalysis.WriteMasks,
+                        GqrConstantsRequireRuntimeGuard: useGuardedConstants && selectedGqrConstants.Count != 0,
+                        GuestAbiContracts: guestAbiContracts,
+                        EmitStateFreeLeafVariant: stateFreeAbiFunctions.Contains(address),
+                        StateFreeAbiContracts: stateFreeAbiContracts,
+                        StateFreeCallSymbols: stateFreeCallSymbols,
+                        StateFreeCallSiteVariants: stateFreeCallSiteVariantsByCaller.GetValueOrDefault(address),
+                         StateFreeEntryVariants: stateFreeEntryVariantsByTarget.GetValueOrDefault(address),
+                         ModOverridableCallTargets: modOverridableCallTargets),
+                    residentPolicy,
+                    address);
+            }
+
+            // Populate the recursive ABI inference cache once, in stable global order, before
+            // refinement and parallel emission, so cyclic call graphs don't depend on thread count.
+            LogPhase("state-free selection + leaf residency");
+            ReportAbiPrewarm(inferredGuestAbi.Value.Prewarm(emissionAddresses));
+            LogPhase("ABI prewarm");
+
+            // State-free entries use the transformed leaf's exact live-at-entry
+            // interface rather than the public architectural contract. Generate
+            // that signature first so direct callers never receive a state pointer
+            // or unrelated register dependencies.
+            var stateFreeAbiContracts = new Dictionary<uint, GuestAbiContract>(stateFreeAbiFunctions.Count);
+            var stateFreeInterfaceLeaves = stateFreeAbiFunctions
+                .OrderBy(static address => address)
+                .ToArray();
+            // Seed every admitted signature before lowering any body. A caller
+            // must never fall back to CpuContext merely because its callee has a
+            // numerically higher address and has not reached the prepass yet.
+            foreach (var address in stateFreeInterfaceLeaves)
+                stateFreeAbiContracts[address] = PlannedStateFreeContract(address);
+
+            GuestAbiContract RefineStateFreeContract(uint address)
+            {
+                if (!canonicalIrStore.TryGet(address, out var canonicalSsa))
+                    throw new InvalidOperationException($"Missing canonical SSA for state-free ABI prepass at 0x{address:X8}.");
+                var analyzed = translator.Value.LowerCanonical(
+                    address,
+                    canonicalSsa,
+                    BuildEmissionOptions(address, stateFreeAbiContracts));
+                // The emitter reports the refined interface directly now. The RECOMP_STATE_FREE_ABI
+                // comment it still emits is only for cross-run consumers that parse source files.
+                var emitted = analyzed.Emission?.StateFree;
+                if (emitted is null || emitted.EntryPoint != address)
+                    throw new InvalidOperationException($"Missing state-free ABI metadata for 0x{address:X8}.");
+                var plannedContract = PlannedStateFreeContract(address);
+                return plannedContract with
+                {
+                    GprReadBeforeWriteMask = emitted.GprInputMask,
+                    GprPossibleWriteMask = emitted.Contract.GprPossibleWriteMask & plannedContract.GprPossibleWriteMask,
+                    FprReadBeforeWriteMask = emitted.Contract.FprReadBeforeWriteMask,
+                    FprPossibleWriteMask = emitted.Contract.FprPossibleWriteMask & plannedContract.FprPossibleWriteMask,
+                    CrReadBeforeWriteMask = emitted.Contract.CrReadBeforeWriteMask,
+                    GqrReadBeforeWriteMask = emitted.Contract.GqrReadBeforeWriteMask,
+                    HidReadBeforeWriteMask = emitted.Contract.HidReadBeforeWriteMask,
+                    HidPossibleWriteMask = (byte)(emitted.Contract.HidPossibleWriteMask & plannedContract.HidPossibleWriteMask),
+                    ReadsXerBeforeWrite = emitted.Contract.ReadsXerBeforeWrite,
+                    ReadsCtrBeforeWrite = emitted.Contract.ReadsCtrBeforeWrite,
+                    ReadsLrBeforeWrite = emitted.Contract.ReadsLrBeforeWrite
+                };
+            }
+
+            // Refine callees before callers. Recursive SCC members are solved
+            // together to a stable signature; the component graph itself is a
+            // DAG, so every ordinary component needs only one lowering pass.
+            var eligibleComponentEdges = eligibleComponents.ToDictionary(
+                componentIndex => componentIndex,
+                componentIndex => components[componentIndex]
+                    .SelectMany(address => localGuestAbiContracts[address].DirectCallTargets)
+                    .Where(componentByAddress.ContainsKey)
+                    .Select(target => componentByAddress[target])
+                    .Where(targetComponent => targetComponent != componentIndex && eligibleComponents.Contains(targetComponent))
+                    .Distinct()
+                    .ToArray());
+            var callersByComponent = eligibleComponents.ToDictionary(
+                componentIndex => componentIndex,
+                static _ => new List<int>());
+            foreach (var (callerComponent, calleeComponents) in eligibleComponentEdges)
+                foreach (var calleeComponent in calleeComponents)
+                    callersByComponent[calleeComponent].Add(callerComponent);
+            var pendingCallees = eligibleComponentEdges.ToDictionary(
+                static pair => pair.Key,
+                static pair => pair.Value.Length);
+            var readyComponents = new SortedSet<int>(pendingCallees
+                .Where(static pair => pair.Value == 0)
+                .Select(static pair => pair.Key));
+            var processedComponents = 0;
+            while (readyComponents.Count != 0)
+            {
+                var componentIndex = readyComponents.Min;
+                readyComponents.Remove(componentIndex);
+                ++processedComponents;
+                var members = components[componentIndex]
+                    .Where(stateFreeAbiFunctions.Contains)
+                    .OrderBy(static address => address)
+                    .ToArray();
+                var changed = true;
+                var refinementPass = 0;
+                while (changed)
+                {
+                    if (++refinementPass > 64)
+                        throw new InvalidOperationException($"State-free ABI signatures did not converge for component {componentIndex}.");
+                    changed = false;
+                    foreach (var address in members)
+                    {
+                        var refined = RefineStateFreeContract(address);
+                        if (stateFreeAbiContracts[address] == refined) continue;
+                        stateFreeAbiContracts[address] = refined;
+                        changed = true;
+                    }
+                }
+
+                foreach (var callerComponent in callersByComponent[componentIndex])
+                    if (--pendingCallees[callerComponent] == 0)
+                        readyComponents.Add(callerComponent);
+            }
+            if (processedComponents != eligibleComponents.Count)
+                throw new InvalidOperationException("State-free component graph was not acyclic after SCC condensation.");
+
+            // A single union signature recreates CpuContext traffic as Win x64 stack args/hidden
+            // struct-return. Materialize compact variants instead; the four-input/two-output cap
+            // fits the native ABI, larger regions need inlining/fusion, not another oversized signature.
+            static string StateMaskSortKey(GuestStateMask mask) =>
+                $"{mask.Gpr:X8}:{mask.Fpr:X8}:{mask.Cr:X2}:{(mask.Xer ? 1 : 0)}:{(mask.Ctr ? 1 : 0)}:" +
+                $"{(mask.Lr ? 1 : 0)}:{(mask.Fpscr ? 1 : 0)}:{mask.Gqr:X2}:{mask.Hid:X2}";
+            var stateFreeLivenessContracts = new Dictionary<uint, GuestAbiContract>(guestAbiContracts);
+            foreach (var (address, contract) in stateFreeAbiContracts)
+                stateFreeLivenessContracts[address] = contract;
+            var callsByTarget = stateLivenessByFunction
+                .SelectMany(pair => pair.Value.DirectCalls.Select(call => (Caller: pair.Key, Call: call)))
+                .Where(item => stateFreeAbiFunctions.Contains(item.Call.Target))
+                .GroupBy(static item => item.Call.Target)
+                .OrderBy(static group => group.Key);
+            var mutableCallSiteVariants = new Dictionary<
+                uint, Dictionary<GuestStateFreeCallSiteKey, GuestStateFreeCallVariant>>();
+            var compactVariantCount = 0;
+            foreach (var targetGroup in callsByTarget)
+            {
+                var target = targetGroup.Key;
+                var variantsByOutput = new Dictionary<GuestStateMask, GuestStateFreeCallVariant>();
+                var rankedOutputs = targetGroup
+                    .GroupBy(static item => item.Call.Outputs)
+                    .OrderByDescending(static group => group.Count())
+                    .ThenBy(group => StateMaskSortKey(group.Key), StringComparer.Ordinal)
+                    .Take(4)
+                    .ToArray();
+                var variantIndex = 0;
+                foreach (var outputGroup in rankedOutputs)
+                {
+                    var output = outputGroup.Key;
+                    var targetFunction = canonicalGuestFunctions[target];
+                    var entryLive = GuestStateLivenessAnalyzer.Analyze(
+                        targetFunction, stateFreeLivenessContracts, output).BlockLiveIn[targetFunction.EntryLabel];
+                    var publicContract = guestAbiContracts[target];
+                    var specializedContract = publicContract with
+                    {
+                        GprReadBeforeWriteMask = entryLive.Gpr,
+                        FprReadBeforeWriteMask = entryLive.Fpr,
+                        CrReadBeforeWriteMask = entryLive.Cr,
+                        ReadsXerBeforeWrite = entryLive.Xer,
+                        ReadsCtrBeforeWrite = entryLive.Ctr,
+                        ReadsLrBeforeWrite = entryLive.Lr ||
+                            targetFunction.Blocks.SelectMany(static block => block.Instructions)
+                                .OfType<IrCall>()
+                                .Any(static call => string.IsNullOrWhiteSpace(call.Destination)),
+                        ReadsFpscrBeforeWrite = entryLive.Fpscr,
+                        // The state-free refinement pass also discovers GQR
+                        // reads hidden inside templated PSQ helpers.  Preserve
+                        // those body-derived inputs in every narrower variant;
+                        // otherwise its definition and caller prototype disagree.
+                        GqrReadBeforeWriteMask = (byte)(entryLive.Gqr |
+                            stateFreeAbiContracts[target].GqrReadBeforeWriteMask),
+                        HidReadBeforeWriteMask = entryLive.Hid,
+                        GprPossibleWriteMask = publicContract.GprPossibleWriteMask & output.Gpr,
+                        FprPossibleWriteMask = publicContract.FprPossibleWriteMask & output.Fpr,
+                        CrPossibleWriteMask = (byte)(publicContract.CrPossibleWriteMask & output.Cr),
+                        MayWriteXer = publicContract.MayWriteXer && output.Xer,
+                        MayWriteCtr = publicContract.MayWriteCtr && output.Ctr,
+                        MayWriteLr = publicContract.MayWriteLr && output.Lr,
+                        MayWriteFpscr = publicContract.MayWriteFpscr && output.Fpscr,
+                        GqrPossibleWriteMask = (byte)(publicContract.GqrPossibleWriteMask & output.Gqr),
+                        HidPossibleWriteMask = (byte)(publicContract.HidPossibleWriteMask & output.Hid)
+                    };
+                    if (StateFreeInputValueCount(specializedContract) > 4 ||
+                        StateFreeOutputValueCount(specializedContract) > 2 ||
+                        irInstructionCounts[target] > 96 ||
+                        specializedContract == stateFreeAbiContracts[target])
+                        continue;
+                    var variant = new GuestStateFreeCallVariant(
+                        target,
+                        $"{stateFreeCallSymbols[target]}_v{variantIndex++}",
+                        specializedContract);
+                    variantsByOutput[output] = variant;
+                    ++compactVariantCount;
+                }
+                if (variantsByOutput.Count == 0) continue;
+                stateFreeEntryVariantsByTarget[target] = variantsByOutput.Values
+                    .OrderBy(static variant => variant.Symbol, StringComparer.Ordinal)
+                    .ToArray();
+                foreach (var item in targetGroup)
+                {
+                    if (!variantsByOutput.TryGetValue(item.Call.Outputs, out var variant)) continue;
+                    if (!mutableCallSiteVariants.TryGetValue(item.Caller, out var callerVariants))
+                    {
+                        callerVariants = new Dictionary<GuestStateFreeCallSiteKey, GuestStateFreeCallVariant>();
+                        mutableCallSiteVariants[item.Caller] = callerVariants;
+                    }
+                    callerVariants[new GuestStateFreeCallSiteKey(
+                        item.Call.BlockLabel, item.Call.Target, item.Call.CallOrdinal)] = variant;
+                }
+            }
+            foreach (var (caller, variants) in mutableCallSiteVariants)
+                stateFreeCallSiteVariantsByCaller[caller] = variants;
+
+            if (stateFreeInterfaceLeaves.Length != 0)
+                Console.WriteLine($"[translator] Derived {stateFreeInterfaceLeaves.Length:N0} state-free interfaces and " +
+                                  $"{compactVariantCount:N0} compact call-site specialization(s) from liveness.");
+            LogPhase("state-free refinement");
+
+            var outputMetadata = outputMetadataPath is null
+                ? null
+                : new BaseTranslationFunctionMetadata[emissionAddresses.Length];
+            using var bundleWriter = productionSourceBundlePath is null
+                ? null
+                : TranslationSourceBundle.CreateWriter(productionSourceBundlePath, emissionAddresses.Length);
+            // Emission is one barrier-free parallel pass: waves used to re-synchronise every few
+            // hundred functions and ran only as fast as the slowest straggler. Now each worker
+            // publishes into an index slot and a single writer appends in ascending index order,
+            // so the bundle stays byte-identical without workers ever waiting on each other.
+            var collectSources = bundleWriter is not null;
+            var pendingSources = new string?[collectSources ? emissionAddresses.Length : 0];
+            // `emissionDone[i]` is published with a release write after the source
+            // slot is filled, so the writer's acquire read of it also makes the
+            // source visible. `completionPulse` only wakes the writer; it carries
+            // no state of its own.
+            var emissionDone = new bool[pendingSources.Length];
+            using var completionPulse = new ManualResetEventSlim(false);
+            var emissionAborted = false;
+            Task? pendingBundleWrite = null;
+            try
+            {
+                if (bundleWriter is not null && emissionAddresses.Length != 0)
+                {
+                    TranslationSourceBundleWriter writer = bundleWriter;
+                    // A dedicated thread rather than a pool thread: this task now
+                    // lives for the whole emission and spends most of it blocked
+                    // waiting on the next index, which is exactly the shape the
+                    // thread pool is worst at while the parallel pass saturates it.
+                    pendingBundleWrite = Task.Factory.StartNew(
+                        () =>
+                        {
+                            for (var nextToWrite = 0; nextToWrite < emissionAddresses.Length; nextToWrite++)
+                            {
+                                while (!Volatile.Read(ref emissionDone[nextToWrite]))
+                                {
+                                    // Reset before re-testing so a completion signalled
+                                    // between the test and the wait can never be lost,
+                                    // and re-test the abort flag so a failed emission
+                                    // never leaves this task waiting on an index that
+                                    // will never arrive.
+                                    completionPulse.Reset();
+                                    if (Volatile.Read(ref emissionDone[nextToWrite])) break;
+                                    if (Volatile.Read(ref emissionAborted)) return;
+                                    completionPulse.Wait();
+                                }
+
+                                var address = emissionAddresses[nextToWrite];
+                                writer.Write(new TranslationSourceBundleEntry(
+                                    address,
+                                    Path.GetRelativePath(outDir, baseWork[address].Path).Replace('\\', '/'),
+                                    pendingSources[nextToWrite]!));
+                                // Drop the reference once appended so completed-but-
+                                // unwritten source stays bounded by how far the writer
+                                // trails the workers.
+                                pendingSources[nextToWrite] = null;
+                            }
+                        },
+                        CancellationToken.None,
+                        TaskCreationOptions.LongRunning,
+                        TaskScheduler.Default);
+                }
+
+                try
+                {
+                    IndexedParallel.For(emissionAddresses.Length, parallelOptions, i =>
+                    {
+                        var address = emissionAddresses[i];
+                        var work = baseWork[address];
+                        var options = BuildEmissionOptions(address, stateFreeAbiContracts);
+                        if (!canonicalIrStore.TryGet(address, out var canonicalSsa))
+                            throw new InvalidOperationException($"Missing canonical SSA for final lowering at 0x{address:X8}.");
+                        var emitted = translator.Value.LowerCanonical(address, canonicalSsa, options);
+                        var path = work.Path;
+                        if (outputMetadata is not null)
+                        {
+                            var metadata = BaseTranslationFunctionMetadata.FromTranslation(outDir, path, emitted);
+                            if (interiorEntryPoints.Contains(address))
+                            {
+                                metadata = metadata with { InteriorToOtherTranslation = true };
+                            }
+                            outputMetadata[i] = metadata;
+                        }
+                        if (collectSources)
+                        {
+                            pendingSources[i] = emitted.CxxCode;
+                            Volatile.Write(ref emissionDone[i], true);
+                            completionPulse.Set();
+                        }
+                        if (emitFunctionFiles)
+                        {
+                            if (FileOutput.WriteTextIfChanged(path, emitted.CxxCode)) Interlocked.Increment(ref filesUpdated);
+                            else Interlocked.Increment(ref filesUnchanged);
+                            TrackEmittedPath(path);
+                        }
+                    });
+                }
+                catch
+                {
+                    // Release the writer before unwinding: the index it is waiting
+                    // on may never complete now.
+                    Volatile.Write(ref emissionAborted, true);
+                    completionPulse.Set();
+                    throw;
+                }
+
+                var last = pendingBundleWrite;
+                pendingBundleWrite = null;
+                last?.GetAwaiter().GetResult();
+            }
+            finally
+            {
+                // Only reached with work still in flight when emission itself threw.
+                // Wait without observing the writer's own fault so the original
+                // failure propagates, but never let the task outlive the writer the
+                // enclosing `using` is about to dispose.
+                if (pendingBundleWrite is not null)
+                {
+                    Task.WaitAny(pendingBundleWrite);
+                }
+            }
+            bundleWriter?.Complete();
+            LogPhase("emission wave + bundle write");
+            if (outputMetadata is not null)
+            {
+                var bundleReference = productionSourceBundlePath is null
+                    ? null
+                    : Path.GetRelativePath(
+                        Path.GetDirectoryName(Path.GetFullPath(outputMetadataPath!))!,
+                        Path.GetFullPath(productionSourceBundlePath)).Replace('\\', '/');
+                var metadataUnsupportedInstructionCount = emissionAddresses.Sum(address =>
+                {
+                    if (!canonicalIrStore.TryGet(address, out var canonicalSsa))
+                    {
+                        throw new InvalidOperationException(
+                            $"Missing canonical SSA while computing translation quality for 0x{address:X8}.");
+                    }
+                    return canonicalSsa.Blocks.Sum(block =>
+                        block.Instructions.Count(static instruction => instruction is IrUndefined));
+                });
+                completedOutputMetadata = BaseTranslationOutputMetadata.Create(
+                    outputMetadata,
+                    new TranslationQualityMetadata(
+                        metadataUnsupportedInstructionCount,
+                        InvalidSsaFunctionCount: 0),
+                    null,
+                    bundleReference,
+                    BuildModPatchAwareness(modPatchProfiles.Value));
+                // The digest stamp above answers "was this exact Code.pul present?". This record
+                // answers the question that actually decides reuse - "would a different Code.pul
+                // have changed anything here?" - by keeping the translated function ranges beside
+                // the patched addresses that landed inside them.
+                completedModAwareness = BaseTranslationModAwareness.Create(
+                    null,
+                    completedOutputMetadata.Functions.Count,
+                    BuildModPatchAwarenessDetail(modPatchProfiles.Value),
+                    translatedFunctionEnds);
+            }
+        }
+
+        static bool ContainsInteriorBoundary(uint start, uint end, uint[] boundaries)
+        {
+            var index = Array.BinarySearch(boundaries, start);
+            index = index >= 0 ? index + 1 : ~index;
+            return index < boundaries.Length && boundaries[index] < end;
+        }
+
+        Console.WriteLine($"Recursively translated {count} functions.");
+        var unsupportedInstructionCount = totals.Sum(item => item.UnsupportedInstructionCount);
+        if (unsupportedInstructionCount > 0)
+        {
+            Console.WriteLine(
+                $"[translator] DEVELOPER OUTPUT: preserved {unsupportedInstructionCount:N0} unsupported instruction(s) " +
+                "as runtime traps; release metadata will reject this translation.");
+        }
+        if (pruneStale && emittedPaths is not null)
+        {
+            var removed = PruneStaleGeneratedFiles(outDir, emittedPaths, previousOutputMetadata);
+            Console.WriteLine($"[translator] Pruned {removed} stale generated file(s).");
+        }
+        if (completedOutputMetadata is not null)
+        {
+            var updated = BaseTranslationOutputMetadataFile.WriteIfChangedAtomic(
+                outputMetadataPath!,
+                completedOutputMetadata);
+            Console.WriteLine(updated
+                ? $"[translator] Updated base translation metadata: {outputMetadataPath}"
+                : $"[translator] Base translation metadata unchanged: {outputMetadataPath}");
+        }
+        if (completedModAwareness is not null)
+        {
+            var awarenessPath = Path.Combine(
+                Path.GetDirectoryName(Path.GetFullPath(outputMetadataPath!))!,
+                BaseTranslationModAwareness.FileName);
+            BaseTranslationModAwarenessFile.WriteIfChangedAtomic(awarenessPath, completedModAwareness);
+            Console.WriteLine($"[translator] Recorded mod-patch awareness detail: {awarenessPath}");
+        }
+        Console.WriteLine($"[translator] File writes: {filesUpdated} updated, {filesUnchanged} unchanged.");
+    }
+    catch (Exception ex)
+    {
+        // Log end time and total duration even if there's an exception
+        var endTime = DateTime.Now;
+        var totalDuration = endTime - startTime;
+        Console.WriteLine($"[translator] Translation failed at {endTime:HH:mm:ss}, total time: {totalDuration.TotalSeconds:F2} seconds");
+        Console.WriteLine($"[translator] Error: {ex.Message}");
+        throw; // Re-throw the exception to maintain original behavior
+    }
+
+    // Log end time and total duration
+    var endTime2 = DateTime.Now;
+    var totalDuration2 = endTime2 - startTime;
+    Console.WriteLine($"[translator] Translation completed at {endTime2:HH:mm:ss}, total time: {totalDuration2.TotalSeconds:F2} seconds");
+
+    return 0;
+}
+
+int RunTranslateMod(string[] argsTail)
+{
+    var outDir = OptionValue(argsTail, "--out") ?? profile?.Output;
+    if (string.IsNullOrWhiteSpace(outDir))
+    {
+        return RunTranslateModCore(argsTail, null);
+    }
+
+    var publishedOutput = Path.GetFullPath(outDir);
+    var previousInputCache = translateModInputCacheDirectory;
+    var previousPublishedOutput = translateModPublishedOutputDirectory;
+    translateModInputCacheDirectory = publishedOutput;
+    translateModPublishedOutputDirectory = publishedOutput;
+    try
+    {
+        var result = TransactionalDirectoryOutput.GenerateAndPublish(
+            publishedOutput,
+            stagingDirectory => RunTranslateModCore(argsTail, stagingDirectory),
+            (stagingDirectory, exitCode) => PreserveTranslateModFailureDiagnostics(
+                stagingDirectory,
+                publishedOutput,
+                exitCode));
+        foreach (var warning in result.Warnings)
+        {
+            Console.Error.WriteLine($"[translator] Warning: {warning}");
+        }
+        if (result.Publication is { } publication)
+        {
+            Console.WriteLine(
+                $"[translator] published mod output: {publication.AddedFiles:N0} added, " +
+                $"{publication.UpdatedFiles:N0} updated, {publication.RemovedFiles:N0} removed, " +
+                $"{publication.UnchangedFiles:N0} unchanged");
+        }
+        return result.ExitCode;
+    }
+    finally
+    {
+        translateModInputCacheDirectory = previousInputCache;
+        translateModPublishedOutputDirectory = previousPublishedOutput;
+    }
+}
+
+void PreserveTranslateModFailureDiagnostics(string stagingDirectory, string publishedOutput, int exitCode)
+{
+    var diagnosticsDirectory = publishedOutput + ".failed";
+    if (Directory.Exists(diagnosticsDirectory))
+    {
+        Directory.Delete(diagnosticsDirectory, recursive: true);
+    }
+    Directory.CreateDirectory(diagnosticsDirectory);
+
+    var copied = 0;
+    foreach (var source in Directory.EnumerateFiles(stagingDirectory, "*", SearchOption.TopDirectoryOnly)
+                 .Where(path => path.EndsWith(".txt", StringComparison.OrdinalIgnoreCase) ||
+                                path.EndsWith(".json", StringComparison.OrdinalIgnoreCase)))
+    {
+        File.Copy(source, Path.Combine(diagnosticsDirectory, Path.GetFileName(source)), overwrite: true);
+        copied++;
+    }
+    File.WriteAllText(
+        Path.Combine(diagnosticsDirectory, "failure.txt"),
+        $"translate-mod exited with code {exitCode}. Preserved {copied} top-level diagnostic file(s).{Environment.NewLine}");
+    Console.Error.WriteLine($"[translator] Preserved failure diagnostics: {diagnosticsDirectory}");
+}
+
+int RunTranslateModCore(string[] argsTail, string? outputDirectoryOverride)
+{
+    // Wall-clock accounting mirroring RunTranslateRecursive's LogPhase output.
+    var modPhaseStart = DateTime.Now;
+    var modLastPhaseSeconds = 0d;
+    void LogModPhase(string label)
+    {
+        var now = (DateTime.Now - modPhaseStart).TotalSeconds;
+        Console.WriteLine($"[translator] mod phase '{label}': {now - modLastPhaseSeconds:F1}s (t={now:F1}s)");
+        modLastPhaseSeconds = now;
+    }
+
+    var codePul = OptionValue(argsTail, "--code-pul") ?? profile?.CodePul;
+    var baseManifestPath = OptionValue(argsTail, "--base-manifest");
+    var outDir = outputDirectoryOverride ?? OptionValue(argsTail, "--out") ?? profile?.Output;
+    if (string.IsNullOrWhiteSpace(codePul) ||
+        string.IsNullOrWhiteSpace(baseManifestPath) ||
+        string.IsNullOrWhiteSpace(outDir))
+    {
+        WriteUsage(Console.Error, new[] { "translate-mod" });
+        return 1;
+    }
+
+    var modRoot = OptionValue(argsTail, "--mod-root") ?? profile?.ModRoot;
+    var baseTranslationOutputMetadataPath = OptionValue(argsTail, "--base-translation-output-metadata")
+        ?? Path.Combine(root, "generated", "base_translation_output.json");
+    // The base translation bakes mod-safety decisions (leaf-inlining blocks, residency fences)
+    // around the patch set it knew about; a base tree that never saw this Code.pul can splice
+    // mod-patched callee bodies inline, silently running vanilla code where the mod's hooks must
+    // win (this shipped once as a character-select LinkList.h:573 panic).
+    if (File.Exists(baseTranslationOutputMetadataPath) && File.Exists(codePul))
+    {
+        var guardedBaseMetadata = BaseTranslationOutputMetadataFile.Read(baseTranslationOutputMetadataPath);
+        var codePulSha256 = ChecksumUtilities.Sha256HexOfFile(codePul);
+        var baseKnowsThisPul = guardedBaseMetadata.ModPatchAwareness is { } awareness &&
+            awareness.Any(entry => string.Equals(entry.CodePulSha256, codePulSha256, StringComparison.OrdinalIgnoreCase));
+        // A different Code.pul is not automatically a different base translation. The decisions the
+        // stamp above protects are made from the patched addresses alone, so a pul that patches the
+        // same translated functions produces the same base tree - and the awareness record beside
+        // the metadata is what proves that, address by address.
+        if (!baseKnowsThisPul && profile is not null)
+        {
+            var awarenessDetail = BaseTranslationModAwarenessFile.TryRead(Path.Combine(
+                Path.GetDirectoryName(Path.GetFullPath(baseTranslationOutputMetadataPath))!,
+                BaseTranslationModAwareness.FileName));
+            if (awarenessDetail is not null &&
+                awarenessDetail.TranslatedFunctionCount == guardedBaseMetadata.Functions.Count)
+            {
+                if (awarenessDetail.CoversCodePul(profile.Name, codePul, out var mismatch))
+                {
+                    Console.WriteLine(
+                        "[translator] The base translation predates this Code.pul but patches the same " +
+                        "translated functions, so its mod-safety decisions still hold.");
+                    baseKnowsThisPul = true;
+                }
+                else
+                {
+                    Console.Error.WriteLine(
+                        $"[translator] The base translation cannot be reused for this Code.pul: {mismatch}.");
+                }
+            }
+        }
+        if (!baseKnowsThisPul)
+        {
+            Console.Error.WriteLine(
+                $"[translator] The base translation ({baseTranslationOutputMetadataPath}) was produced without " +
+                $"awareness of this mod's Code.pul (sha256 {codePulSha256}). Its leaf-inlining and residency " +
+                "decisions may bypass the mod's patches, which silently breaks the modded product. " +
+                "Retranslate the base with this mod's Code.pul present (it is picked up automatically from " +
+                "every enabled project profile), then re-run translate-mod.");
+            return 1;
+        }
+    }
+    else if (!File.Exists(baseTranslationOutputMetadataPath))
+    {
+        Console.Error.WriteLine(
+            $"[translator] Warning: no base translation output metadata at {baseTranslationOutputMetadataPath}; " +
+            "cannot verify the base translation is aware of this mod's patch set.");
+    }
+    var skipRetroWfc = HasFlag(argsTail, "--skip-retro-wfc");
+    var explicitRetroWfcPayloadSpec = OptionValue(argsTail, "--retro-wfc-payload");
+    var retroWfcPayloadSpec = skipRetroWfc
+        ? null
+        : explicitRetroWfcPayloadSpec ??
+          (profile?.EnableRetroWfc == true ? profile.RetroWfcPayload : null);
+    var requestedRetroWfc = !string.IsNullOrWhiteSpace(retroWfcPayloadSpec);
+    if (requestedRetroWfc && profile?.EnableRetroWfc != true)
+    {
+        Console.Error.WriteLine("[translator] Retro WFC lowering is project-specific and requires a profile with enable_retro_wfc: true.");
+        return 1;
+    }
+    var modName = OptionValue(argsTail, "--mod-name")
+        ?? (!string.IsNullOrWhiteSpace(modRoot) ? Path.GetFileName(Path.GetFullPath(modRoot)) : "Pulsar Mod");
+    var region = OptionValue(argsTail, "--region") ?? profile?.Region ?? "P";
+    var moduleGuestBase = OptionValue(argsTail, "--module-guest-base") is { } moduleBaseText
+        ? ParseAddress(moduleBaseText)
+        : profile?.ModuleGuestBase ?? 0x81700000u;
+    var moduleLinkBaseText = OptionValue(argsTail, "--module-link-base");
+    var moduleLinkBase = moduleLinkBaseText is not null
+        ? ParseAddress(moduleLinkBaseText)
+        : profile?.ModuleLinkBase ?? 0x803992E0u;
+    Directory.CreateDirectory(outDir);
+
+    var pul = KamekPulFile.Load(codePul);
+    var selected = pul.SelectRegion(region);
+    if (requestedRetroWfc && profile?.RetroWfcLegacyBootstrapHook is { } legacyBootstrapHook)
+    {
+        selected = RetroWfcBootstrapSuppressor.Suppress(selected, legacyBootstrapHook);
+        Console.WriteLine(
+            $"[translator] Suppressed legacy Retro WFC payload bootstrap hook at 0x{legacyBootstrapHook:X8}; " +
+            "the shared payload is initialized statically.");
+    }
+    var baseManifest = JsonSerializer.Deserialize<BaseManifest>(File.ReadAllText(baseManifestPath))
+        ?? throw new InvalidDataException($"Failed to parse base manifest: {baseManifestPath}");
+    RetroWfcContractLoweringPlan? retroWfcLoweringPlan = null;
+    RetroWfcPayloadLoadResult? retroWfcPayload = null;
+
+    if (!string.IsNullOrWhiteSpace(retroWfcPayloadSpec))
+    {
+        byte[] payloadImage;
+        try
+        {
+            payloadImage = LoadBinaryInput(retroWfcPayloadSpec, outDir, "retro_wfc_payload.bin");
+            File.WriteAllBytes(Path.Combine(outDir, "retro_wfc_payload.bin"), payloadImage);
+        }
+        catch (Exception ex) when (ex is IOException or System.Net.Http.HttpRequestException or UnauthorizedAccessException)
+        {
+            Console.Error.WriteLine($"Failed to read Retro WFC payload '{retroWfcPayloadSpec}': {ex.Message}");
+            return 1;
+        }
+
+        var helperModuleOffset = AlignUp(checked(selected.CodeSize + selected.BssSize), 0x20u);
+        try
+        {
+            retroWfcPayload = RetroWfcPayload.Parse(
+                payloadImage,
+                baseManifest,
+                moduleGuestBase,
+                helperModuleOffset,
+                retroWfcPayloadSpec);
+        }
+        catch (InvalidDataException ex)
+        {
+            Console.Error.WriteLine($"Failed to parse Retro WFC payload '{retroWfcPayloadSpec}': {ex.Message}");
+            return 2;
+        }
+
+        retroWfcLoweringPlan = retroWfcPayload.LoweringPlan;
+        Console.WriteLine($"[translator] Retro WFC shared payload validated: {retroWfcLoweringPlan.StaticBytePatches.Count:N0} static byte patch(es), {retroWfcLoweringPlan.ExecutableHooks.Count:N0} executable hook(s), {retroWfcLoweringPlan.StaticPointers.Count:N0} static pointer(s).");
+    }
+
+    var patchPlan = KamekPatchPlanner.Build(selected, baseManifest, moduleGuestBase);
+    var continuationPlan = ContinuationPlanner.Build(selected, baseManifest, moduleGuestBase);
+
+    if (patchPlan.Unsupported.Any())
+    {
+        Console.Error.WriteLine("[translator] translate-mod failed: Code.pul has unsupported commands.");
+        Console.Error.WriteLine(patchPlan.BuildTextReport("Code.pul patch classification"));
+        return 2;
+    }
+
+    var droppedReservedWrites = patchPlan.DroppedReservedRegionWrites.Count();
+    if (droppedReservedWrites > 0)
+    {
+        Console.WriteLine(
+            $"[translator] Dropped {droppedReservedWrites} Code.pul write(s) to the WFC codehandler probe word " +
+            "(0x80001920); the recomp keeps it clean so the WFC anticheat probe reads an untouched console.");
+    }
+
+    var baseManifestDirectory = Path.GetDirectoryName(Path.GetFullPath(baseManifestPath))!;
+
+    var retroWfcOverlayStaticBytePatches = retroWfcLoweringPlan?.StaticBytePatches
+        .Where(p => string.Equals(p.LoweringKind, "overlayBytePatch", StringComparison.Ordinal))
+        .ToList();
+    var retroWfcResolvedExecutableHooks = retroWfcLoweringPlan?.ExecutableHooks
+        .Where(h => h.TargetAddress.HasValue)
+        .ToList();
+    var additionalModuleImage = retroWfcPayload?.RelocatedImage;
+    uint? additionalModuleImageOffset = retroWfcPayload?.Summary.HelperModuleOffset;
+    var overlayBuild = OverlayFunctionBuilder.BuildAndWrite(
+        selected,
+        baseManifest,
+        patchPlan,
+        baseManifestDirectory,
+        outDir,
+        additionalModuleImage: additionalModuleImage,
+        additionalModuleImageOffset: additionalModuleImageOffset,
+        retroWfcStaticBytePatches: retroWfcOverlayStaticBytePatches,
+        retroWfcExecutableHooks: retroWfcResolvedExecutableHooks);
+
+    if (retroWfcLoweringPlan is not null)
+    {
+        var overlayStaticBytePatchCount = retroWfcOverlayStaticBytePatches?.Count ?? 0;
+        var staticBytePatchesNeedingAnotherLowering = retroWfcLoweringPlan.StaticBytePatches.Count - overlayStaticBytePatchCount;
+        var failedRetroWfcOverlayPatches = overlayBuild.Diagnostics.Count(d => d.Target.StartsWith("RetroWFC#", StringComparison.Ordinal));
+        var unresolvedExecutableHooks = retroWfcLoweringPlan.ExecutableHooks.Count(h => !h.TargetAddress.HasValue);
+        var unresolvedStaticPointers = retroWfcLoweringPlan.StaticPointers.Count(p => !p.TargetAddress.HasValue);
+        var resolvedExecutablePointerWrites = retroWfcLoweringPlan.StaticPointers.Count(p => p.SectionExecutable && p.TargetAddress.HasValue);
+        if (staticBytePatchesNeedingAnotherLowering != 0 ||
+            failedRetroWfcOverlayPatches != 0 ||
+            unresolvedExecutableHooks != 0 ||
+            unresolvedStaticPointers != 0 ||
+            resolvedExecutablePointerWrites != 0)
+        {
+            Console.Error.WriteLine("[translator] translate-mod stopped: Retro WFC supported static overlay patches were emitted, but unresolved payload lowering remains.");
+            Console.Error.WriteLine($"[translator] Static byte overlays emitted: {overlayStaticBytePatchCount:N0}/{retroWfcLoweringPlan.StaticBytePatches.Count:N0}; semantic hooks resolved: {(retroWfcResolvedExecutableHooks?.Count ?? 0):N0}/{retroWfcLoweringPlan.ExecutableHooks.Count:N0}; failed overlay patches: {failedRetroWfcOverlayPatches:N0}; unresolved hooks: {unresolvedExecutableHooks:N0}; unresolved pointer writes: {unresolvedStaticPointers:N0}; executable pointer writes pending overlay support: {resolvedExecutablePointerWrites:N0}.");
+            Console.Error.WriteLine("[translator] This is fail-closed; no final translated mod build is emitted that ignores unresolved payload lowering.");
+            Console.Error.WriteLine(retroWfcLoweringPlan.BuildTextReport());
+            return 2;
+        }
+    }
+
+    var relocatedModuleImagePath = Path.Combine(outDir, "overlay_images", overlayBuild.ModuleImageFile);
+    var relocatedModuleImage = File.ReadAllBytes(relocatedModuleImagePath);
+
+    continuationPlan = ContinuationPlanner.AddModuleTailJumpContinuations(
+        continuationPlan,
+        baseManifest,
+        moduleGuestBase,
+        relocatedModuleImage);
+    if (retroWfcResolvedExecutableHooks is { Count: > 0 })
+    {
+        continuationPlan = ContinuationPlanner.AddRetroWfcExecutableHookContinuations(
+            continuationPlan,
+            baseManifest,
+            retroWfcResolvedExecutableHooks);
+    }
+
+    var discoveredKamekFunctionStarts = ModFunctionDiscovery.DiscoverKamekFunctions(
+        selected,
+        moduleGuestBase,
+        relocatedModuleImage);
+    var retroWfcSemanticFunctionStarts = retroWfcLoweringPlan is null
+        ? Enumerable.Empty<ModFunctionStart>()
+        : retroWfcLoweringPlan.ExecutableHooks
+            .Where(h => h.TargetAddress.HasValue && string.Equals(h.TargetKind, "moduleFunction", StringComparison.Ordinal))
+            .Select(h => new ModFunctionStart(h.TargetAddress!.Value, $"Retro WFC semantic action {h.TargetActionId ?? string.Join(",", h.SemanticActionIds)}"))
+            .Concat(retroWfcLoweringPlan.StaticPointers
+                .Where(p => p.TargetAddress.HasValue && string.Equals(p.TargetKind, "moduleFunction", StringComparison.Ordinal))
+                .Select(p => new ModFunctionStart(p.TargetAddress!.Value, $"Retro WFC semantic action {p.TargetActionId ?? string.Join(",", p.SemanticActionIds)}")));
+    var retroWfcInitializerTarget = retroWfcPayload?.Summary.InitializationTargetAddress;
+    var retroWfcInitializerFunctionStarts = retroWfcInitializerTarget is { } initializerTarget
+        ? new[] { new ModFunctionStart(initializerTarget, "Retro WFC payload initialization") }
+        : Enumerable.Empty<ModFunctionStart>();
+    var retroWfcInitializationCallbacks = retroWfcPayload?.Summary.InitializationCallbacks;
+    var retroWfcInitializationCallbackStarts = (retroWfcInitializationCallbacks ?? Array.Empty<RetroWfcHelperInitCallback>())
+        .Select(c => new ModFunctionStart(
+            c.TargetAddress,
+            string.IsNullOrWhiteSpace(c.Symbol)
+                ? $"Retro WFC payload initialization callback {c.Kind}"
+                : $"Retro WFC payload initialization callback {c.Kind} {c.Symbol}"));
+    var kamekFunctionStarts = discoveredKamekFunctionStarts
+        .Concat(retroWfcSemanticFunctionStarts)
+        .Concat(retroWfcInitializerFunctionStarts)
+        .Concat(retroWfcInitializationCallbackStarts)
+        .GroupBy(s => s.Address)
+        .Select(g => new ModFunctionStart(g.Key, string.Join("; ", g.Select(s => s.Reason).Distinct(StringComparer.Ordinal))))
+        .OrderBy(s => s.Address)
+        .ToList();
+    var cppFailureCount = 0;
+    var emitCpp = HasFlag(argsTail, "--emit-cpp");
+    var maxThreads = OptionValue(argsTail, "--threads") is { } threadsText
+        ? Math.Max(1, ParseInt(threadsText))
+        : Math.Max(1, Environment.ProcessorCount);
+    LogModPhase("setup + patch planning");
+    if (emitCpp)
+    {
+        var nonReturningModuleCallTargets = FindNonReturningModuleCallTargets(
+            continuationPlan,
+            kamekFunctionStarts,
+            moduleGuestBase,
+            checked(overlayBuild.ModuleGuestBase + (uint)relocatedModuleImage.Length));
+        cppFailureCount = EmitModCpp(
+            outDir,
+            baseManifest,
+            overlayBuild,
+            continuationPlan,
+            retroWfcResolvedExecutableHooks,
+            kamekFunctionStarts,
+            moduleLinkBase,
+            selected.CodeSize,
+            nonReturningModuleCallTargets,
+            maxThreads,
+            argsTail);
+    }
+
+    LogModPhase("mod C++ emission");
+    var dvdOverlayRoots = ModDvdOverlayRoots.Discover(modRoot);
+    var riivolutionOptions = profile?.Riivolution?.Options
+        .Select(option => new ModRiivolutionOption(option.Section, option.Option, option.Choice))
+        .ToList();
+    var emitFullInitializerSet = emitCpp &&
+        cppFailureCount == 0;
+    ModDataPatchWriter.Write(
+        Path.Combine(outDir, "cpp", "mod_data_patches.cpp"),
+        patchPlan,
+        moduleLinkBase,
+        baseManifest,
+        dvdOverlayRoots,
+        relocatedModuleImage,
+        SHA1.HashData(selected.CodeBlob),
+        retroWfcLoweringPlan?.StaticPointers,
+        selected.CodeSize,
+        selected.BssSize,
+        checked(moduleGuestBase + selected.CtorStart),
+        checked(moduleGuestBase + selected.CtorEnd),
+        emitFullInitializerSet,
+        emitFullInitializerSet ? retroWfcInitializerTarget : null,
+        emitFullInitializerSet
+            ? retroWfcPayload?.Summary.HelperModuleBase
+            : null,
+        emitFullInitializerSet
+            ? retroWfcPayload?.Summary.InitializationSuccessReturnValue
+            : null,
+        Path.Combine(
+            translateModPublishedOutputDirectory ?? outDir,
+            "cpp",
+            "mod_data_patches_blobs"),
+        profile?.Riivolution?.Xml,
+        riivolutionOptions);
+
+    if (emitCpp && cppFailureCount == 0)
+    {
+        WriteResolvedDispatchProfile(
+            outDir,
+            RequireProject().Output.Functions,
+            Path.Combine(root, "generated", "functions_manifest.txt"),
+            baseTranslationOutputMetadataPath,
+            Path.Combine(outDir, "cpp"),
+            RequireProject().Runtime.NativeRegistrationRoot,
+            translateModPublishedOutputDirectory ?? outDir);
+    }
+
+    LogModPhase("data patches + dispatch profile");
+    Console.WriteLine("[translator] translate-mod complete");
+    Console.WriteLine($"  mod: {modName}");
+    Console.WriteLine($"  region: {region}");
+    Console.WriteLine($"  module base: 0x{moduleGuestBase:X8}");
+    Console.WriteLine($"  module link base: 0x{moduleLinkBase:X8}");
+    Console.WriteLine($"  module image: overlay_images/{overlayBuild.ModuleImageFile}");
+    Console.WriteLine($"  module patches applied: {overlayBuild.ModulePatchCount:N0}");
+    Console.WriteLine($"  overlay functions: {overlayBuild.OverlayFunctions.Count:N0}");
+    Console.WriteLine($"  continuations: {continuationPlan.Entries.Count:N0}");
+    Console.WriteLine($"  discovered module functions: {kamekFunctionStarts.Count:N0}");
+    Console.WriteLine($"  data patches: {patchPlan.DataPatches.Count():N0}");
+    Console.WriteLine($"  dvd overlay roots: {dvdOverlayRoots.Count:N0}");
+    return overlayBuild.Diagnostics.Count == 0 && cppFailureCount == 0 ? 0 : 3;
+}
+
+void WriteResolvedDispatchProfile(
+    string outDir,
+    string baseFunctionsDir,
+    string baseFunctionsManifest,
+    string baseTranslationOutputMetadataPath,
+    string modCppDir,
+    string runtimeSourceDir,
+    string publishedOutDir)
+{
+    var candidates = new List<ResolvedDispatchEntry>();
+    // The per-function sources carry their registration facts as a
+    // RECOMP_REGISTRATION marker comment (see CxxLinearCodeGenerator); nothing
+    // registers per function at compile time any more.
+    var baseRegistration = GeneratedMarkers.BaseRegistrationPattern();
+    var modRegistration = GeneratedMarkers.ModRegistrationPattern();
+    var nativeRegistration = GeneratedMarkers.NativeFunctionRegistrationPattern();
+    var guestAbiMetadata = GeneratedMarkers.GuestAbiPattern();
+
+    IEnumerable<string> BaseFiles()
+    {
+        if (File.Exists(baseFunctionsManifest))
+        {
+            return File.ReadLines(baseFunctionsManifest)
+                .Where(line => !string.IsNullOrWhiteSpace(line))
+                .Select(line => Path.IsPathRooted(line) ? line : Path.Combine(baseFunctionsDir, Path.GetFileName(line)));
+        }
+        return Directory.EnumerateFiles(baseFunctionsDir, "*.cpp", SearchOption.AllDirectories);
+    }
+
+    static IEnumerable<(string File, string Text)> ReadFiles(IEnumerable<string> files)
+    {
+        foreach (var file in files)
+            if (File.Exists(file)) yield return (file, File.ReadAllText(file));
+    }
+
+    IEnumerable<(string File, string Text)> BaseSources()
+    {
+        var metadataPath = baseTranslationOutputMetadataPath;
+        if (File.Exists(metadataPath))
+        {
+            var metadata = BaseTranslationOutputMetadataFile.Read(metadataPath);
+            if (!string.IsNullOrWhiteSpace(metadata.SourceBundlePath))
+            {
+                var bundlePath = Path.IsPathRooted(metadata.SourceBundlePath)
+                    ? metadata.SourceBundlePath
+                    : Path.Combine(Path.GetDirectoryName(metadataPath)!, metadata.SourceBundlePath);
+                foreach (var entry in TranslationSourceBundle.Read(bundlePath).Entries)
+                    yield return (Path.Combine(baseFunctionsDir, entry.VirtualPath), entry.Source);
+                yield break;
+            }
+        }
+        foreach (var source in ReadFiles(BaseFiles())) yield return source;
+    }
+
+    IEnumerable<(string File, string Text)> ModSources()
+    {
+        var bundlePath = Path.Combine(Path.GetDirectoryName(modCppDir)!, "translated_sources.bin");
+        if (File.Exists(bundlePath))
+        {
+            foreach (var entry in TranslationSourceBundle.Read(bundlePath).Entries)
+                yield return (Path.Combine(modCppDir, entry.VirtualPath), entry.Source);
+            yield break;
+        }
+        foreach (var source in ReadFiles(Directory.EnumerateFiles(modCppDir, "*.cpp", SearchOption.AllDirectories)))
+            yield return source;
+    }
+
+    void ReadTranslated(
+        IEnumerable<(string File, string Text)> sources,
+        Regex regex,
+        string kind,
+        uint defaultPriority,
+        Func<string, string>? sourceFileMapper = null)
+    {
+        foreach (var (file, text) in sources)
+        {
+            var abi = guestAbiMetadata.Match(text);
+            uint AbiHex(string group, uint fallback = uint.MaxValue) => abi.Success
+                ? uint.Parse(abi.Groups[group].Value, NumberStyles.HexNumber, CultureInfo.InvariantCulture)
+                : fallback;
+            foreach (Match match in regex.Matches(text))
+            {
+                var address = GuestTargetParser.ParseHexAddress(match.Groups["address"].Value);
+                var publicSymbol = match.Groups["symbol"].Value;
+                var symbol = publicSymbol;
+                var nameGroup = match.Groups["name"];
+                var priorityGroup = match.Groups["priority"];
+                var priority = priorityGroup.Success
+                    ? uint.Parse(priorityGroup.Value, CultureInfo.InvariantCulture)
+                    : defaultPriority;
+                var preserves = bool.Parse(match.Groups["preserves"].Value);
+                var fprMask = GuestTargetParser.ParseHexAddress(match.Groups["mask"].Value);
+                candidates.Add(new ResolvedDispatchEntry(
+                    address, symbol, nameGroup.Success ? nameGroup.Value : publicSymbol, kind, priority,
+                    true, AbiHex("gr"), AbiHex("gw"), AbiHex("gw"), AbiHex("gret", 0),
+                    AbiHex("fr"), AbiHex("fw"), AbiHex("fret", 0),
+                    (byte)AbiHex("crr", byte.MaxValue), (byte)AbiHex("crw", byte.MaxValue),
+                    !abi.Success || abi.Groups["xr"].Value == "1",
+                    !abi.Success || abi.Groups["xw"].Value == "1",
+                    !abi.Success || abi.Groups["fence"].Value == "1",
+                    preserves, fprMask, true, sourceFileMapper?.Invoke(file) ?? Path.GetFullPath(file)));
+            }
+        }
+    }
+
+    // Every fact the base half of this profile needs - entry point, registration
+    // symbol, non-volatile FPR facts and the guest ABI marker - is already in the
+    // translator-owned output metadata. Re-reading and regex-scanning ~200 MiB of
+    // generated C++ to recover them was pure duplicated work. The bundle scan
+    // stays as the fallback for metadata written before build facts existed.
+    void ReadBaseTranslated()
+    {
+        BaseTranslationOutputMetadata? metadata = null;
+        if (File.Exists(baseTranslationOutputMetadataPath))
+        {
+            metadata = BaseTranslationOutputMetadataFile.Read(baseTranslationOutputMetadataPath);
+        }
+        if (metadata is null || metadata.Functions.Any(static function => function.Build is null))
+        {
+            ReadTranslated(BaseSources(), baseRegistration, "base", 0);
+            return;
+        }
+
+        foreach (var function in metadata.Functions)
+        {
+            var build = function.Build!;
+            // The marker text is identical to the `// RECOMP_GUEST_ABI ...` line
+            // the emitter writes into the source, so the same pattern and the
+            // same missing-metadata fallbacks apply.
+            var abi = guestAbiMetadata.Match(build.GuestAbiComment ?? string.Empty);
+            uint AbiHex(string group, uint fallback = uint.MaxValue) => abi.Success
+                ? uint.Parse(abi.Groups[group].Value, NumberStyles.HexNumber, CultureInfo.InvariantCulture)
+                : fallback;
+            candidates.Add(new ResolvedDispatchEntry(
+                function.EntryPoint, build.Symbol, build.Symbol, "base", 0,
+                true, AbiHex("gr"), AbiHex("gw"), AbiHex("gw"), AbiHex("gret", 0),
+                AbiHex("fr"), AbiHex("fw"), AbiHex("fret", 0),
+                (byte)AbiHex("crr", byte.MaxValue), (byte)AbiHex("crw", byte.MaxValue),
+                !abi.Success || abi.Groups["xr"].Value == "1",
+                !abi.Success || abi.Groups["xw"].Value == "1",
+                !abi.Success || abi.Groups["fence"].Value == "1",
+                build.PreservesNonvolatileFprs, build.NonvolatileFprWriteMask, true,
+                Path.GetFullPath(Path.Combine(baseFunctionsDir, function.RelativePath))));
+        }
+    }
+
+    ReadBaseTranslated();
+    ReadTranslated(
+        ModSources(),
+        modRegistration,
+        "rr",
+        100,
+        file => Path.GetFullPath(Path.Combine(
+            publishedOutDir,
+            "cpp",
+            Path.GetRelativePath(modCppDir, file))));
+
+    void AddNative(uint address, string symbol, string sourceFile)
+    {
+        candidates.Add(new ResolvedDispatchEntry(
+            address,
+            symbol,
+            symbol,
+            "native", 10000, false,
+            0xFFFFFFFFu, 0xFFFFFFFFu, 0xFFFFFFFFu, 0x00000018u,
+            0xFFFFFFFFu, 0xFFFFFFFFu, 0x00000002u,
+            byte.MaxValue, byte.MaxValue, true, true, true,
+            false, 0xFFFFC000u, true, Path.GetFullPath(sourceFile)));
+    }
+
+    // Generated mod support sources can own native winners too. Keep these in
+    // the same resolved profile as runtime-native registrations so direct-call
+    // traits and immutable indirect dispatch tables cannot bypass them.
+    var modDataPatchesPath = Path.Combine(modCppDir, "mod_data_patches.cpp");
+    if (File.Exists(modDataPatchesPath))
+    {
+        var text = Regex.Replace(File.ReadAllText(modDataPatchesPath), @"//[^\r\n]*", string.Empty);
+        foreach (Match match in nativeRegistration.Matches(text))
+        {
+            AddNative(
+                GuestTargetParser.ParseHexAddress(match.Groups["address"].Value),
+                match.Groups["symbol"].Value,
+                modDataPatchesPath);
+        }
+    }
+
+    foreach (var registration in runtimeNativeIndex.Value.Registrations
+                 .Where(static registration => !registration.IsTranslatedOverride))
+    {
+        AddNative(
+            registration.Address,
+            registration.Symbol,
+            Path.Combine(runtimeSourceDir, registration.SourceFile));
+    }
+
+    var indirectTargets = CollectDataSectionFunctionPointerTargets();
+    candidates = candidates
+        .Select(entry => entry with
+        {
+            MustRemainDynamicallyDispatchable = entry.Kind == "native" ||
+                                                entry.Address >= 0x81700000u ||
+                                                indirectTargets.Contains(entry.Address)
+        })
+        .ToList();
+
+    static int KindRank(string kind) => kind switch { "native" => 2, "rr" => 1, _ => 0 };
+    var groups = candidates.GroupBy(entry => entry.Address).ToArray();
+    var resolved = groups
+        .Select(group => group
+            .OrderByDescending(entry => entry.Priority)
+            .ThenByDescending(entry => KindRank(entry.Kind))
+            .First())
+        .OrderBy(entry => entry.Address)
+        .ToArray();
+
+    // A native registration always outranks a mod overlay at the same address, deliberately for
+    // functions the runtime must own (hardware, the strap scene). But when the mod's whole point
+    // is replacing that function, e.g. Retro Rewind's DVDOpen override at 0x8015E2BC, the overlay
+    // is silently dropped. Name every such address so the tradeoff is a choice, not an accident.
+    var nativeOverriddenModPatches = groups
+        .Where(group =>
+            group.Any(entry => entry.Kind == "rr") &&
+            group.OrderByDescending(entry => entry.Priority)
+                 .ThenByDescending(entry => KindRank(entry.Kind))
+                 .First().Kind == "native")
+        .Select(group => new
+        {
+            Address = group.Key,
+            Native = group.First(entry => entry.Kind == "native").Symbol,
+            NativeSource = group.First(entry => entry.Kind == "native").SourceFile,
+            Mod = group.First(entry => entry.Kind == "rr").Name
+        })
+        .OrderBy(entry => entry.Address)
+        .ToArray();
+
+    foreach (var collision in nativeOverriddenModPatches)
+    {
+        Console.WriteLine(
+            $"[translator] WARNING: mod overlay for 0x{collision.Address:X8} ({collision.Mod}) is " +
+            $"overridden by native {collision.Native} ({collision.NativeSource}); the mod's patch " +
+            "at that address will not run.");
+    }
+    if (nativeOverriddenModPatches.Length != 0)
+    {
+        Console.WriteLine(
+            $"[translator] {nativeOverriddenModPatches.Length} mod overlay(s) lost to native registrations; " +
+            "see resolved_dispatch_profile.json -> NativeOverriddenModPatches.");
+    }
+
+    JsonOutput.WriteIfChanged(
+        Path.Combine(outDir, "resolved_dispatch_profile.json"),
+        new
+        {
+            Format = "mkwii-resolved-dispatch-profile",
+            FormatVersion = 1,
+            NativeOverriddenModPatches = nativeOverriddenModPatches,
+            Entries = resolved
+        },
+        JsonOutput.Indented);
+
+    Console.WriteLine($"[translator] resolved dispatch profile: {resolved.Length:N0} winning address(es)");
+}
+
+int EmitModCpp(
+    string outDir,
+    BaseManifest baseManifest,
+    OverlayBuildResult overlayBuild,
+    ContinuationPlan continuationPlan,
+    IReadOnlyCollection<RetroWfcExecutableHookPlan>? retroWfcExecutableHooks,
+    IReadOnlyList<ModFunctionStart> kamekFunctionStarts,
+    uint moduleLinkBase,
+    uint moduleLinkedCodeSize,
+    IReadOnlySet<uint> nonReturningCallTargets,
+    int maxThreads,
+    // The translate-mod command line, so mod emission honours the same codegen
+    // policy overrides (residency, boundary narrowing) as base emission instead
+    // of quietly diverging from it.
+    string[] argsTail)
+{
+    var modImage = BuildSyntheticModProgramImage(outDir, overlayBuild);
+    var inferredAbi = new InferredGuestFunctionAbiProvider(modImage);
+    var abiProvider = declaredNativeAbi.Value is { } nativeAbi
+        ? new CompositeGuestFunctionAbiProvider(nativeAbi, inferredAbi)
+        : new CompositeGuestFunctionAbiProvider(inferredAbi);
+    var modTranslator = new FunctionTranslator(modImage, abiProvider);
+    var parallelOptions = new ParallelOptions { MaxDegreeOfParallelism = maxThreads };
+    // Mod emission waves: each item is a full translate+emit, and each wave is a
+    // barrier that also drains newly discovered continuations, so it is
+    // deliberately smaller than the discovery batch above - a long wave delays
+    // the discoveries the next wave has to translate.
+    var waveSize = Math.Max(16, maxThreads * 4);
+    Console.WriteLine($"  translating mod C++ with up to {maxThreads} worker thread(s) in waves of {waveSize}");
+
+    var cppRoot = Path.Combine(outDir, "cpp");
+    if (Directory.Exists(cppRoot))
+    {
+        Directory.Delete(cppRoot, recursive: true);
+    }
+    Directory.CreateDirectory(cppRoot);
+    var bundledModSources = new Dictionary<string, TranslationSourceBundleEntry>(StringComparer.OrdinalIgnoreCase);
+
+    var unresolved = new List<string>();
+    var translated = 0;
+    var baseFunctions = new BaseFunctionIndex(baseManifest.Functions);
+    var knownFunctionEntryPoints = baseManifest.Functions
+        .Select(f => f.Start)
+        .Concat(kamekFunctionStarts.Select(s => s.Address))
+        .ToHashSet();
+    var queuedContinuationAddresses = continuationPlan.Entries.Select(e => e.Address).ToHashSet();
+    var discoveredContinuationQueue = new Queue<ContinuationEntry>();
+    var linkedHookLrBasesByTarget = retroWfcExecutableHooks is null
+        ? new Dictionary<uint, uint[]>()
+        : retroWfcExecutableHooks
+            .Where(h => h.TargetAddress.HasValue && RetroWfcHookSetsLinkRegister(h))
+            .GroupBy(h => h.TargetAddress!.Value)
+            .ToDictionary(
+                g => g.Key,
+                g => g.Select(h => h.ContinuationAddress).Distinct().ToArray());
+    var lrContinuationCallTargets = linkedHookLrBasesByTarget.Keys.ToHashSet();
+    var linkedCallFallthroughLrOverrides = retroWfcExecutableHooks is null
+        ? new Dictionary<uint, uint>()
+        : retroWfcExecutableHooks
+            .Where(h => h.TargetAddress.HasValue && RetroWfcHookSetsLinkRegister(h))
+            .GroupBy(h => checked(h.Address + 4u))
+            .ToDictionary(g => g.Key, g => g.First().ContinuationAddress);
+
+    ModTranslationAttempt[] TranslateWave(IReadOnlyList<ModTranslationWork> wave)
+    {
+        // Some dynamically discovered module/continuation waves bypass
+        // ProcessBoundedWaves. Prewarm every parallel emission boundary as a
+        // final deterministic guard; phase-prewarmed entries are cheap hits.
+        ReportAbiPrewarm(inferredAbi.Prewarm(wave.Select(static work => work.Address)));
+        return ModTranslationWaveRunner.Translate(() => modTranslator, wave, parallelOptions);
+    }
+
+    void CommitWave(
+        IReadOnlyList<ModTranslationAttempt> attempts,
+        Action<FunctionTranslationResult, ModTranslationWork>? onSuccess = null)
+    {
+        foreach (var attempt in attempts)
+        {
+            if (attempt.Result is null)
+            {
+                unresolved.Add(attempt.Error!);
+                continue;
+            }
+
+            var virtualPath = Path.GetRelativePath(cppRoot, attempt.Work.OutputPath).Replace('\\', '/');
+            bundledModSources[virtualPath] = new TranslationSourceBundleEntry(
+                attempt.Work.Address,
+                virtualPath,
+                attempt.Result.CxxCode);
+            translated++;
+            onSuccess?.Invoke(attempt.Result, attempt.Work);
+        }
+    }
+
+    void ProcessBoundedWaves(
+        IEnumerable<ModTranslationWork> source,
+        Action<FunctionTranslationResult, ModTranslationWork>? onSuccess = null)
+    {
+        var ordered = source
+            .OrderBy(work => work.Address)
+            .ThenBy(work => work.OutputPath, StringComparer.Ordinal)
+            .ToArray();
+        // Populate the recursive ABI cache in a stable global order before any worker emits C++,
+        // so shared closure reuse and cyclic call graphs never depend on thread count, wave size,
+        // or worker order.
+        ReportAbiPrewarm(inferredAbi.Prewarm(ordered.Select(static work => work.Address)));
+        // Commit callbacks here only append to the discovered-continuation queue that a later
+        // phase drains, so nothing in this phase reads back its own commits; wave barriers would
+        // only cost idle workers, so it runs as one parallel batch and the runner re-sorts by the
+        // same key, leaving commit order and the emitted bundle unchanged.
+        CommitWave(TranslateWave(ordered), onSuccess);
+    }
+
+    void RecordDiscoveredBaseContinuations(FunctionTranslationResult result, string reason)
+    {
+        var targets = DiscoverTranslationTargets(result)
+            .Concat(DiscoverCallbackTargets(result, argumentRegisters, requireFunctionStart: false))
+            .Distinct();
+
+        foreach (var target in targets)
+        {
+            var section = baseManifest.Sections.FirstOrDefault(s => target >= s.GuestStart && target < s.GuestEnd);
+            if (section is null || !section.Executable)
+            {
+                continue;
+            }
+
+            var containing = baseFunctions.FindContaining(target);
+            if (containing is null || containing.Start == target)
+            {
+                continue;
+            }
+
+            if (!queuedContinuationAddresses.Add(target))
+            {
+                continue;
+            }
+
+            discoveredContinuationQueue.Enqueue(new ContinuationEntry(
+                target,
+                containing.Start,
+                containing.End,
+                section.Name,
+                result.EntryPoint,
+                KamekCommandId.Write32,
+                reason));
+        }
+    }
+
+    void RecordDiscoveredLrRelativeBaseContinuations(
+        FunctionTranslationResult result,
+        IReadOnlyList<uint> lrBases,
+        string reason)
+    {
+        if (lrBases.Count == 0)
+        {
+            return;
+        }
+
+        foreach (var offset in DiscoverLrRelativeIndirectJumpOffsets(result).Distinct())
+        {
+            foreach (var lrBase in lrBases)
+            {
+                var target = unchecked(lrBase + (uint)offset);
+                var section = baseManifest.Sections.FirstOrDefault(s => target >= s.GuestStart && target < s.GuestEnd);
+                if (section is null || !section.Executable)
+                {
+                    continue;
+                }
+
+                var containing = baseFunctions.FindContaining(target);
+                if (containing is null || containing.Start == target)
+                {
+                    continue;
+                }
+
+                if (!queuedContinuationAddresses.Add(target))
+                {
+                    continue;
+                }
+
+                discoveredContinuationQueue.Enqueue(new ContinuationEntry(
+                    target,
+                    containing.Start,
+                    containing.End,
+                    section.Name,
+                    result.EntryPoint,
+                    KamekCommandId.Branch,
+                    $"{reason}; LR-relative jump offset {offset:+#;-#;0}"));
+            }
+        }
+    }
+
+    ModTranslationWork CreateContinuationWork(ContinuationEntry continuation)
+    {
+        var name = $"rr_continue_{continuation.Address:X8}";
+        var options = WithProjectCodegenPolicy(
+            new TranslationOptions(
+                PreferredName: name,
+                MaxInstructions: TranslationOptions.Default.MaxInstructions,
+                MaxBytes: checked((int)(continuation.ContainingFunctionEnd - continuation.Address)),
+                EmitModRegistration: true,
+                ModRegistrationPriority: TranslationOptions.Default.ModRegistrationPriority,
+                ModRegistrationModuleId: 1,
+                NonReturningCallTargets: nonReturningCallTargets,
+                LrContinuationCallTargets: lrContinuationCallTargets,
+                LinkedCallFallthroughLrOverrides: linkedCallFallthroughLrOverrides,
+                KnownFunctionEntryPoints: knownFunctionEntryPoints),
+            RequireProject().Translation,
+            continuation.Address);
+        return new ModTranslationWork(
+            continuation.Address,
+            options,
+            Path.Combine(cppRoot, "continuations", $"{name}.cpp"));
+    }
+
+    var overlayWorks = overlayBuild.OverlayFunctions.Select(overlay =>
+    {
+        var name = $"rr_overlay_{overlay.Start:X8}";
+        var maxBytes = checked((int)(overlay.End - overlay.Start));
+        if (baseFunctions.FindContaining(overlay.Start) is { } baseFunction &&
+            baseFunction.Start == overlay.Start &&
+            overlay.End < baseFunction.End)
+        {
+            maxBytes = checked((int)(baseFunction.End - overlay.Start));
+        }
+        var options = WithProjectCodegenPolicy(
+            new TranslationOptions(
+                PreferredName: name,
+                MaxInstructions: TranslationOptions.Default.MaxInstructions,
+                MaxBytes: maxBytes,
+                EmitModRegistration: true,
+                ModRegistrationPriority: TranslationOptions.Default.ModRegistrationPriority,
+                ModRegistrationModuleId: 1,
+                NonReturningCallTargets: nonReturningCallTargets,
+                LrContinuationCallTargets: lrContinuationCallTargets,
+                LinkedCallFallthroughLrOverrides: linkedCallFallthroughLrOverrides,
+                KnownFunctionEntryPoints: knownFunctionEntryPoints),
+            RequireProject().Translation,
+            overlay.Start);
+        return new ModTranslationWork(
+            overlay.Start,
+            options,
+            Path.Combine(cppRoot, "overlays", $"{name}.cpp"));
+    });
+    ProcessBoundedWaves(overlayWorks, (result, work) =>
+        RecordDiscoveredBaseContinuations(result, $"base continuation discovered from overlay 0x{work.Address:X8}"));
+
+    ProcessBoundedWaves(
+        continuationPlan.Entries.Select(CreateContinuationWork),
+        (result, work) => RecordDiscoveredBaseContinuations(
+            result,
+            $"base continuation discovered from continuation 0x{work.Address:X8}"));
+
+    void DrainDiscoveredContinuations()
+    {
+        while (discoveredContinuationQueue.Count > 0)
+        {
+            var wave = QueueBatch.Dequeue(discoveredContinuationQueue, waveSize)
+                .Select(CreateContinuationWork)
+                .ToArray();
+            CommitWave(TranslateWave(wave), (result, work) =>
+                RecordDiscoveredBaseContinuations(
+                    result,
+                    $"base continuation discovered from continuation 0x{work.Address:X8}"));
+        }
+    }
+
+    DrainDiscoveredContinuations();
+
+    var moduleImagePath = Path.Combine(outDir, "overlay_images", overlayBuild.ModuleImageFile);
+    var moduleEnd = checked(overlayBuild.ModuleGuestBase + (uint)new FileInfo(moduleImagePath).Length);
+    var moduleQueue = new Queue<ModFunctionStart>(kamekFunctionStarts.OrderBy(s => s.Address));
+    var queuedModuleStarts = new HashSet<uint>(kamekFunctionStarts.Select(s => s.Address));
+    var emittedModuleStarts = new HashSet<uint>();
+    while (moduleQueue.Count > 0)
+    {
+        var wave = new List<ModTranslationWork>(waveSize);
+        foreach (var start in QueueBatch.Dequeue(
+                     moduleQueue,
+                     waveSize,
+                     start => !emittedModuleStarts.Add(start.Address)))
+        {
+            var name = ModuleFunctionName(start.Address);
+            var options = WithProjectCodegenPolicy(
+                new TranslationOptions(
+                    PreferredName: name,
+                    MaxInstructions: TranslationOptions.Default.MaxInstructions,
+                    MaxBytes: 0x10000,
+                    EmitModRegistration: true,
+                    ModRegistrationPriority: TranslationOptions.Default.ModRegistrationPriority,
+                    ModRegistrationModuleId: 1,
+                    NonReturningCallTargets: nonReturningCallTargets,
+                    LrContinuationCallTargets: lrContinuationCallTargets,
+                    LinkedCallFallthroughLrOverrides: linkedCallFallthroughLrOverrides,
+                    KnownFunctionEntryPoints: knownFunctionEntryPoints,
+                    ModuleLinkBase: moduleLinkBase,
+                    ModuleGuestBase: overlayBuild.ModuleGuestBase,
+                    ModuleLinkedCodeSize: moduleLinkedCodeSize),
+                RequireProject().Translation,
+                start.Address);
+            wave.Add(new ModTranslationWork(
+                start.Address,
+                options,
+                Path.Combine(cppRoot, "module", $"{name}.cpp")));
+        }
+
+        if (wave.Count == 0)
+        {
+            continue;
+        }
+
+        var attempts = TranslateWave(wave);
+        var discoveredModuleTargets = attempts
+            .Where(attempt => attempt.Result is not null)
+            .SelectMany(attempt => DirectModuleTargets(
+                    attempt.Result!, overlayBuild.ModuleGuestBase, moduleEnd)
+                .Select(target => (Target: target, Source: attempt.Work.Address)))
+            .GroupBy(item => item.Target)
+            .Select(group => (Target: group.Key, Source: group.Min(item => item.Source)))
+            .OrderBy(item => item.Target)
+            .ToArray();
+        var newlyKnownModuleTargets = new HashSet<uint>();
+        foreach (var (target, source) in discoveredModuleTargets)
+        {
+            if (queuedModuleStarts.Add(target))
+            {
+                newlyKnownModuleTargets.Add(target);
+                knownFunctionEntryPoints.Add(target);
+                moduleQueue.Enqueue(new ModFunctionStart(target, $"direct call from 0x{source:X8}"));
+            }
+        }
+
+        // A target discovered by one worker can be an interior entry swallowed by
+        // another function translated in the same wave. Re-run just those affected
+        // functions after publishing the new boundary, before any output is committed.
+        if (newlyKnownModuleTargets.Count != 0)
+        {
+            var retry = attempts
+                .Where(attempt => attempt.Result is not null &&
+                    attempt.Result.Instructions.Any(instruction =>
+                        instruction.Address != attempt.Work.Address &&
+                        newlyKnownModuleTargets.Contains(instruction.Address)))
+                .Select(attempt => attempt.Work)
+                .ToArray();
+            if (retry.Length != 0)
+            {
+                var replacements = TranslateWave(retry)
+                    .ToDictionary(attempt => attempt.Work.Address);
+                attempts = attempts
+                    .Select(attempt => replacements.TryGetValue(attempt.Work.Address, out var replacement)
+                        ? replacement
+                        : attempt)
+                    .ToArray();
+            }
+        }
+
+        CommitWave(attempts, (result, work) =>
+        {
+            RecordDiscoveredBaseContinuations(result, $"base continuation discovered from module 0x{work.Address:X8}");
+            if (linkedHookLrBasesByTarget.TryGetValue(work.Address, out var lrBases))
+            {
+                RecordDiscoveredLrRelativeBaseContinuations(
+                    result,
+                    lrBases,
+                    $"base continuation discovered from LR-relative hook target 0x{work.Address:X8}");
+            }
+        });
+    }
+
+    DrainDiscoveredContinuations();
+
+
+    TranslationSourceBundle.Write(
+        Path.Combine(outDir, "translated_sources.bin"),
+        bundledModSources.Values);
+
+    foreach (var failure in unresolved)
+    {
+        Console.Error.WriteLine($"[translator]   unresolved: {failure}");
+    }
+    Console.WriteLine($"  emitted C++ functions: {translated:N0}");
+    Console.WriteLine($"  C++ translation failures: {unresolved.Count:N0}");
+    return unresolved.Count;
+}
+
+static string ModuleFunctionName(uint address)
+{
+    // Keep the emitted module filename and C++ symbol compact. Kamek map names
+    // can contain complete C++ signatures, which makes MSVC object paths exceed
+    // CMAKE_OBJECT_PATH_MAX. The guest address is already a stable, unique
+    // identity for the translated function and remains useful when inspecting
+    // generated output.
+    return $"rr_kamek_{address:X8}";
+}
+
+ProgramImage BuildSyntheticModProgramImage(string outDir, OverlayBuildResult overlayBuild)
+{
+    var loadedProject = RequireProject();
+    var rel = relFile.Value ?? throw new InvalidOperationException("Kamek mod translation currently requires the project's single configured REL.");
+    var relImage = rel.BuildImage(loadedProject.Inputs.Rel!.LoadAddress);
+    var baseImage = new ProgramImageBuilder().Build(dolFile.Value, relImage, loadedProject.Memory.Base, loadedProject.Memory.Size);
+    var memory = baseImage.Memory.ToArray();
+
+    CopyFileToGuest(
+        memory,
+        baseImage.MemoryBase,
+        overlayBuild.ModuleGuestBase,
+        Path.Combine(outDir, "overlay_images", overlayBuild.ModuleImageFile));
+
+    foreach (var overlay in overlayBuild.OverlayFunctions)
+    {
+        CopyFileToGuest(
+            memory,
+            baseImage.MemoryBase,
+            overlay.Start,
+            Path.Combine(outDir, "overlay_images", overlay.ImageFile));
+    }
+
+    return new ProgramImage(
+        memory,
+        baseImage.UsedRange,
+        baseImage.DolRange,
+        baseImage.RelRange,
+        baseImage.Sha256 + "+mod",
+        baseImage.MemoryBase);
+}
+
+void CopyFileToGuest(byte[] memory, uint memoryBase, uint guestAddress, string path)
+{
+    var bytes = File.ReadAllBytes(path);
+    if (guestAddress < memoryBase)
+    {
+        throw new InvalidDataException($"Mod image '{path}' at 0x{guestAddress:X8} precedes configured memory base 0x{memoryBase:X8}.");
+    }
+    var offset = checked((int)(guestAddress - memoryBase));
+    if (offset < 0 || offset + bytes.Length > memory.Length)
+    {
+        throw new InvalidDataException($"Mod image '{path}' at 0x{guestAddress:X8} exceeds translator RAM image.");
+    }
+    bytes.CopyTo(memory.AsSpan(offset, bytes.Length));
+}
+
+IReadOnlySet<uint> FindNonReturningModuleCallTargets(
+    ContinuationPlan continuationPlan,
+    IReadOnlyList<ModFunctionStart> moduleFunctionStarts,
+    uint moduleStart,
+    uint moduleEnd)
+{
+    if (moduleFunctionStarts.Count == 0)
+    {
+        return new HashSet<uint>();
+    }
+
+    var sortedStarts = moduleFunctionStarts
+        .Where(start => start.Address >= moduleStart && start.Address < moduleEnd)
+        .GroupBy(start => start.Address)
+        .Select(group => group.First())
+        .OrderBy(start => start.Address)
+        .ToArray();
+    if (sortedStarts.Length == 0)
+    {
+        return new HashSet<uint>();
+    }
+
+    var result = new HashSet<uint>();
+    foreach (var continuation in continuationPlan.Entries)
+    {
+        if (continuation.SourceCommandId != KamekCommandId.Branch ||
+            continuation.SourceCommandAddress < moduleStart ||
+            continuation.SourceCommandAddress >= moduleEnd)
+        {
+            continue;
+        }
+
+        var sortedAddresses = sortedStarts.Select(start => start.Address).ToArray();
+        var index = Array.BinarySearch(sortedAddresses, continuation.SourceCommandAddress);
+        if (index < 0)
+        {
+            index = ~index - 1;
+        }
+
+        if (index >= 0)
+        {
+            result.Add(sortedStarts[index].Address);
+            for (var i = index - 1; i >= 0; --i)
+            {
+                var candidate = sortedStarts[i];
+                if (continuation.SourceCommandAddress - candidate.Address > 0x80u)
+                {
+                    break;
+                }
+                if (!candidate.Reason.Contains("scan", StringComparison.OrdinalIgnoreCase))
+                {
+                    result.Add(candidate.Address);
+                    break;
+                }
+            }
+        }
+    }
+
+    return result;
+}
+
+IEnumerable<uint> DirectModuleTargets(FunctionTranslationResult result, uint moduleStart, uint moduleEnd)
+{
+    var localInstructions = result.Instructions
+        .Select(instruction => instruction.Address)
+        .ToHashSet();
+
+    foreach (var instruction in result.Instructions)
+    {
+        foreach (var target in instruction.BranchTargets)
+        {
+            if (target >= moduleStart &&
+                target < moduleEnd &&
+                (target & 0x3u) == 0 &&
+                !localInstructions.Contains(target))
+            {
+                yield return target;
+            }
+        }
+    }
+}
+
+IEnumerable<int> DiscoverLrRelativeIndirectJumpOffsets(FunctionTranslationResult result)
+{
+    var lrOffsets = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+    int? ctrOffset = null;
+
+    foreach (var instruction in result.Instructions)
+    {
+        var mnemonic = instruction.Mnemonic.ToLowerInvariant();
+        if (mnemonic == "mflr" && TryGetInstructionReg(instruction, 0, out var lrDest))
+        {
+            lrOffsets[lrDest] = 0;
+            continue;
+        }
+
+        if ((mnemonic == "mr" || mnemonic == "or") &&
+            TryGetInstructionReg(instruction, 0, out var moveDest) &&
+            TryGetInstructionReg(instruction, 1, out var moveSource) &&
+            (mnemonic == "mr" ||
+             (instruction.Operands.Count >= 3 &&
+              instruction.Operands[2] is PpcRegisterOperand moveSource2 &&
+              string.Equals(NormalizeInstructionReg(moveSource2.Name), moveSource, StringComparison.OrdinalIgnoreCase))))
+        {
+            if (lrOffsets.TryGetValue(moveSource, out var sourceOffset))
+            {
+                lrOffsets[moveDest] = sourceOffset;
+            }
+            else
+            {
+                lrOffsets.Remove(moveDest);
+            }
+            continue;
+        }
+
+        if (mnemonic == "addi" &&
+            TryGetInstructionReg(instruction, 0, out var addDest) &&
+            TryGetInstructionReg(instruction, 1, out var addBase) &&
+            TryGetInstructionImm(instruction, 2, out var imm))
+        {
+            if (lrOffsets.TryGetValue(addBase, out var baseOffset))
+            {
+                lrOffsets[addDest] = checked(baseOffset + imm);
+            }
+            else
+            {
+                lrOffsets.Remove(addDest);
+            }
+            continue;
+        }
+
+        if (mnemonic == "mtctr" && TryGetInstructionReg(instruction, 0, out var ctrSource))
+        {
+            ctrOffset = lrOffsets.TryGetValue(ctrSource, out var sourceOffset) ? sourceOffset : null;
+            continue;
+        }
+
+        if (mnemonic == "bctr")
+        {
+            if (ctrOffset.HasValue)
+            {
+                yield return ctrOffset.Value;
+            }
+            ctrOffset = null;
+            continue;
+        }
+
+        if (TryInstructionWritesDest(instruction, out var dest))
+        {
+            lrOffsets.Remove(dest);
+        }
+    }
+
+    static bool TryGetInstructionReg(PpcInstruction instruction, int index, out string register)
+    {
+        if (instruction.Operands.Count > index && instruction.Operands[index] is PpcRegisterOperand operand)
+        {
+            register = NormalizeInstructionReg(operand.Name);
+            return true;
+        }
+
+        register = string.Empty;
+        return false;
+    }
+
+    static bool TryGetInstructionImm(PpcInstruction instruction, int index, out int immediate)
+    {
+        if (instruction.Operands.Count > index && instruction.Operands[index] is PpcImmediateOperand operand)
+        {
+            immediate = operand.Value;
+            return true;
+        }
+
+        immediate = 0;
+        return false;
+    }
+
+    static bool TryInstructionWritesDest(PpcInstruction instruction, out string destination)
+    {
+        destination = string.Empty;
+        if (instruction.Operands.Count == 0 || instruction.Operands[0] is not PpcRegisterOperand operand)
+        {
+            return false;
+        }
+
+        var mnemonic = instruction.Mnemonic.ToLowerInvariant();
+        if (mnemonic.StartsWith("st", StringComparison.Ordinal) ||
+            mnemonic.StartsWith("b", StringComparison.Ordinal) ||
+            mnemonic.StartsWith("cmp", StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        destination = NormalizeInstructionReg(operand.Name);
+        return true;
+    }
+
+    static string NormalizeInstructionReg(string register) => register.ToLowerInvariant();
+}
+
+static bool RetroWfcHookSetsLinkRegister(RetroWfcExecutableHookPlan hook) =>
+    hook.TypeName is "call" or "branchCtrLink" ||
+    hook.Intent.Contains("Call", StringComparison.Ordinal);
+
+int RunEmitBaseManifest(string[] argsTail)
+{
+    var loadedProject = RequireProject();
+    var outDir = OptionValue(argsTail, "--out") ?? Path.GetDirectoryName(loadedProject.Output.BaseManifest)!;
+    var functionsDir = OptionValue(argsTail, "--functions-dir") ?? loadedProject.Output.Functions;
+    var outputMetadataPath = OptionValue(argsTail, "--translation-output-metadata");
+    var outputMetadata = outputMetadataPath is null
+        ? null
+        : BaseTranslationOutputMetadataFile.Read(outputMetadataPath);
+    outputMetadata?.RequireReleaseEligible(outputMetadataPath!);
+    var region = OptionValue(argsTail, "--region") ?? loadedProject.Identity.Region ?? "unknown";
+
+    var rel = relFile.Value ?? throw new InvalidOperationException("Base mod manifest generation currently requires the project's single configured REL.");
+    var relImage = rel.BuildImage(loadedProject.Inputs.Rel!.LoadAddress);
+    var baseImage = new ProgramImageBuilder().Build(dolFile.Value, relImage, loadedProject.Memory.Base, loadedProject.Memory.Size);
+    var result = BaseManifestBuilder.BuildAndWrite(
+        dolFile.Value,
+        rel,
+        relImage,
+        baseImage,
+        functionsDir,
+        outDir,
+        loadedProject.Identity.BaseManifestFormat,
+        loadedProject.Identity.GameId ?? loadedProject.Identity.Id,
+        region,
+        loadedProject.Identity.BaseManifestStem,
+        loadedProject.Memory.Base,
+        dolFile.Value.MemoryRange.Start,
+        Path.GetFileName(loadedProject.Inputs.Dol.Path),
+        Path.GetFileName(loadedProject.Inputs.Rel.Path),
+        outputMetadata);
+
+    Console.WriteLine($"[translator] Wrote base manifest: {result.ManifestPath}");
+    Console.WriteLine($"[translator] Wrote function ranges: {result.FunctionRangesPath}");
+    Console.WriteLine($"[translator] Sections: {result.Manifest.Sections.Count}");
+    Console.WriteLine($"[translator] Function ranges: {result.Manifest.Functions.Count}");
+    return 0;
+}
+
+int RunGenerateDataInit()
+{
+    var loadedProject = RequireProject();
+    var output = loadedProject.Output.DataInitializer;
+    var runtimeConfigOutput = loadedProject.Output.RuntimeConfig;
+    var dolPath = loadedProject.Inputs.Dol.Path;
+    string? relPath = loadedProject.Inputs.Rel?.Path;
+
+    var dol = DolFile.Load(dolPath);
+    
+    // Generate runtime configuration header with the manifest's SDA base pointers
+    var (dataInitSda1Base, dataInitSda2Base) = loadedProject.RequireSdaBases();
+    RuntimeConfigGenerator.GenerateConfigHeader(
+        dataInitSda1Base, dataInitSda2Base, runtimeConfigOutput, loadedProject.Identity.DisplayName);
+
+    // Load the REL file for runtime embedding (apply relocations since runtime does not OSLink)
+    RelImage? relImage = null;
+    if (!string.IsNullOrWhiteSpace(relPath) && loadedProject.Inputs.Rel is { } configuredRel && File.Exists(relPath))
+    {
+        relImage = RelFile.Load(relPath).BuildImage(
+            configuredRel.LoadAddress,
+            applyRelocations: true);
+    }
+    
+    // Generate the data section initializer
+    var outputDir = Path.GetDirectoryName(output);
+    if (!string.IsNullOrEmpty(outputDir))
+    {
+        Directory.CreateDirectory(outputDir);
+    }
+    DataSectionGenerator.Generate(
+        dol,
+        relImage,
+        output,
+        loadedProject.Identity.DisplayName,
+        relPath is null ? "rel_module" : Path.GetFileNameWithoutExtension(relPath));
+    
+    // Emit the guest symbol table for crash-report symbolization. The function
+    // map is already the project's authoritative name source; the runtime only
+    // consults this table on the fatal-crash path.
+    var guestSymbolOutput = Path.Combine(string.IsNullOrEmpty(outputDir) ? "." : outputDir, "guest_symbol_table.cpp");
+    var guestSymbolCount = EmitGuestSymbolTable(functionMap, guestSymbolOutput);
+
+    // Calculate total size
+    var dolDataSize = dol.Sections.Where(s => s.HasData).Sum(s => s.Size);
+    var relDataSize = relImage?.Data.Length ?? 0;
+    var totalSize = dolDataSize + relDataSize;
+
+    Console.WriteLine($"[translator] Generated data section initializer: {output}");
+    Console.WriteLine($"[translator] Guest symbol table: {guestSymbolCount:N0} named entries -> {guestSymbolOutput}");
+    Console.WriteLine($"[translator] DOL sections: {dolDataSize:N0} bytes");
+    Console.WriteLine($"[translator] REL data: {relDataSize:N0} bytes");
+    Console.WriteLine($"[translator] Total embedded: {totalSize:N0} bytes ({totalSize / 1024.0 / 1024.0:F2} MB)");
+
+    return 0;
+}
+
+// Writes generated/guest_symbol_table.cpp: sorted guest addresses paired with function-map names,
+// skipping unnamed rows. Reuses the map already loaded at startup rather than re-parsing the file;
+// the hand-rolled loop this replaced split on spaces only and silently lost tab-separated entries.
+int EmitGuestSymbolTable(FunctionMap? map, string outputPath)
+{
+    var entries = new SortedDictionary<uint, string>();
+    if (map is not null)
+    {
+        foreach (var address in map.Addresses)
+        {
+            if (map.NameOf(address) is { } name)
+            {
+                entries[address] = name;
+            }
+        }
+    }
+
+    var sb = new StringBuilder(entries.Count * 48 + 1024);
+    sb.Append("// Auto-generated by generate-data-init from the project's function map.\n");
+    sb.Append("// Guest address -> symbol name table, consumed by the crash reporter.\n");
+    sb.Append("#include <cstdint>\n\n");
+    sb.Append("extern \"C\" {\n\n");
+    // The extern declarations force external linkage: namespace-scope const
+    // objects are internal-linkage by default in C++, even inside extern "C".
+    sb.Append("extern const uint32_t kGuestMapSymbolCount;\n");
+    sb.Append("extern const uint32_t kGuestMapSymbolAddresses[];\n");
+    sb.Append("extern const char* const kGuestMapSymbolNames[];\n\n");
+    sb.Append("const uint32_t kGuestMapSymbolCount = ")
+      .Append(entries.Count.ToString(System.Globalization.CultureInfo.InvariantCulture))
+      .Append("u;\n\n");
+    sb.Append("const uint32_t kGuestMapSymbolAddresses[] = {\n");
+    if (entries.Count == 0)
+    {
+        sb.Append("    0u,\n");
+    }
+    foreach (var entry in entries)
+    {
+        sb.Append("    0x").Append(entry.Key.ToString("X8", System.Globalization.CultureInfo.InvariantCulture)).Append("u,\n");
+    }
+    sb.Append("};\n\n");
+    sb.Append("const char* const kGuestMapSymbolNames[] = {\n");
+    if (entries.Count == 0)
+    {
+        sb.Append("    \"\",\n");
+    }
+    foreach (var entry in entries)
+    {
+        sb.Append("    \"");
+        foreach (var ch in entry.Value)
+        {
+            if (ch == '\\' || ch == '"')
+            {
+                sb.Append('\\').Append(ch);
+            }
+            else if (ch < 0x20 || ch > 0x7E)
+            {
+                sb.Append('?');
+            }
+            else
+            {
+                sb.Append(ch);
+            }
+        }
+        sb.Append("\",\n");
+    }
+    sb.Append("};\n\n} // extern \"C\"\n");
+    File.WriteAllText(outputPath, sb.ToString());
+    return entries.Count;
+}
+
+static uint GetFunctionInstructionEnd(FunctionDiscoveryResult result)
+{
+    return result.Instructions.Count == 0
+        ? result.EntryPoint
+        : result.Instructions.Max(i => i.EndAddress);
+}
+
+// Sorted, coalesced [start, endExclusive) pairs of the instruction addresses the
+// function's own control flow executes. Discovery decodes leaf-inlined callees
+// separately, so their addresses never appear in result.Instructions.
+static uint[] CoalesceInstructionRanges(FunctionDiscoveryResult result)
+{
+    var addresses = result.Instructions
+        .Select(instruction => instruction.Address)
+        .Distinct()
+        .ToArray();
+    Array.Sort(addresses);
+    var ranges = new List<uint>();
+    foreach (var address in addresses)
+    {
+        if (ranges.Count != 0 && ranges[^1] == address)
+        {
+            ranges[^1] = address + 4;
+            continue;
+        }
+        ranges.Add(address);
+        ranges.Add(address + 4);
+    }
+    return ranges.ToArray();
+}
+
+// Entry points that lie strictly inside another translation's executed flow: the
+// owner decodes and runs the instruction at that address as part of its own body.
+static HashSet<uint> ComputeInteriorEntryPoints(IReadOnlyDictionary<uint, uint[]> flowCoverage)
+{
+    var entries = flowCoverage.Keys.ToArray();
+    Array.Sort(entries);
+    var interior = new HashSet<uint>();
+    foreach (var (owner, ranges) in flowCoverage)
+    {
+        for (var i = 0; i < ranges.Length; i += 2)
+        {
+            var index = Array.BinarySearch(entries, ranges[i]);
+            if (index < 0) index = ~index;
+            for (; index < entries.Length && entries[index] < ranges[i + 1]; index++)
+            {
+                if (entries[index] != owner)
+                {
+                    interior.Add(entries[index]);
+                }
+            }
+        }
+    }
+    return interior;
+}
+
+/// <summary>
+/// Base functions where a Kamek-patched overlay could win direct-call dispatch at runtime, so
+/// callers can't narrow residency to the unpatched contract. Empty if no profile has a Code.pul.
+/// </summary>
+static IReadOnlySet<uint> BuildModOverridableCallTargets(
+    IReadOnlySet<uint> modPatchedAddresses,
+    IReadOnlyDictionary<uint, uint> translatedFunctionEnds)
+{
+    var overridable = new HashSet<uint>();
+    if (modPatchedAddresses.Count == 0)
+    {
+        return overridable;
+    }
+
+    var patched = modPatchedAddresses.ToArray();
+    Array.Sort(patched);
+
+    foreach (var (start, end) in translatedFunctionEnds)
+    {
+        // The recorded end is the last instruction's exclusive end, so a patch
+        // exactly at `end` belongs to the next function.
+        var index = Array.BinarySearch(patched, start);
+        if (index < 0) index = ~index;
+        if (index < patched.Length && patched[index] < end) overridable.Add(start);
+    }
+
+    return overridable;
+}
+
+int PruneStaleGeneratedFiles(
+    string baseOutDir,
+    HashSet<string> emittedPaths,
+    BaseTranslationOutputMetadata? previousOutputMetadata = null)
+{
+    var result = GeneratedOutputPruner.Prune(baseOutDir, emittedPaths, previousOutputMetadata);
+    foreach (var warning in result.Warnings)
+    {
+        Console.Error.WriteLine($"[translator] Warning: {warning}");
+    }
+    return result.RemovedFiles;
+}
+
+IEnumerable<uint> DiscoverTranslationTargets(FunctionTranslationResult result)
+{
+    return DiscoverTranslationTargetsCore(result.Instructions, result.LinearIr);
+}
+
+IEnumerable<uint> DiscoverDiscoveryTranslationTargets(FunctionDiscoveryResult result)
+{
+    return DiscoverTranslationTargetsCore(result.Instructions, result.LinearIr);
+}
+
+IEnumerable<uint> DiscoverTranslationTargetsCore(
+    IReadOnlyList<PpcInstruction> instructions,
+    IrFunction linearIr)
+{
+    var localInstructions = new HashSet<uint>(instructions.Select(i => i.Address));
+    var emitted = new HashSet<uint>();
+
+    foreach (var ins in instructions)
+    {
+        if (ins.BranchTargets.Count == 0)
+        {
+            continue;
+        }
+
+        var shouldFollow = ins.IsCall;
+        if (!shouldFollow && ins.IsUnconditionalBranch)
+        {
+            // If the branch jumps outside this function, treat it as a tail call.
+            shouldFollow = ins.BranchTargets.Any(target => !localInstructions.Contains(target));
+        }
+
+        if (!shouldFollow)
+        {
+            continue;
+        }
+
+        foreach (var target in ins.BranchTargets)
+        {
+            if (emitted.Add(target))
+            {
+                yield return target;
+            }
+        }
+    }
+
+    foreach (var target in DiscoverCallbackTargetsCore(instructions, argumentRegisters, requireFunctionStart: true))
+    {
+        if (emitted.Add(target))
+        {
+            yield return target;
+        }
+    }
+
+    foreach (var call in linearIr.Blocks.SelectMany(static block => block.Instructions.OfType<IrCall>()))
+    {
+        if (GuestTargetParser.TryParseAddress(call.Target, out var target) && emitted.Add(target))
+        {
+            yield return target;
+        }
+    }
+}
+
+// Discovers callback function pointers by checking all argument registers at every call site
+IEnumerable<uint> DiscoverCallbackTargets(
+    FunctionTranslationResult result,
+    string[] argRegs,
+    bool requireFunctionStart = true)
+{
+    return DiscoverCallbackTargetsCore(result.Instructions, argRegs, requireFunctionStart);
+}
+
+IEnumerable<uint> DiscoverCallbackTargetsCore(
+    IReadOnlyList<PpcInstruction> instructions,
+    string[] argRegs,
+    bool requireFunctionStart = true)
+{
+    var constants = new Dictionary<string, uint>(StringComparer.OrdinalIgnoreCase);
+
+    foreach (var ins in instructions)
+    {
+        TrackConstants(ins, constants);
+
+        // Discover function pointers stored to memory (vtable/dispatcher init).
+        if (IsStoreMnemonic(ins.Mnemonic) && TryGetReg(ins, 0, out var rs))
+        {
+            if (constants.TryGetValue(rs, out var stored) &&
+                LooksExecutable(stored) &&
+                (!requireFunctionStart || LooksLikeFunctionStart(stored)))
+            {
+                yield return stored;
+            }
+        }
+
+        // Discover function-pointer getters that return an executable callback in r3.
+        if (ins.IsReturn &&
+            constants.TryGetValue("r3", out var returned) &&
+            LooksExecutable(returned) &&
+            (!requireFunctionStart || LooksLikeFunctionStart(returned)))
+        {
+            yield return returned;
+        }
+
+        // Check both regular calls and tail calls (unconditional branches to external functions)
+        var isCallOrTailCall = ins.IsCall || ins.IsUnconditionalBranch;
+        if (isCallOrTailCall && ins.BranchTargets.Count == 1)
+        {
+            // Check all argument registers for values that look like function pointers
+            foreach (var reg in argRegs)
+            {
+                if (constants.TryGetValue(reg, out var candidate) && 
+                    LooksExecutable(candidate) && 
+                    (!requireFunctionStart || LooksLikeFunctionStart(candidate)))
+                {
+                    yield return candidate;
+                }
+            }
+
+            ClearVolatileAfterCall(constants);
+        }
+    }
+
+    // PpcDecoder only ever produces lowercase mnemonics (every literal and the
+    // `opc_`/`xo_`/`fp_` fallbacks), so the per-instruction ToLowerInvariant
+    // allocation this used to make was pure overhead.
+    static bool IsStoreMnemonic(string mnemonic) =>
+        mnemonic.StartsWith("stw", StringComparison.Ordinal) ||
+        mnemonic.StartsWith("std", StringComparison.Ordinal);
+
+    void ClearVolatileAfterCall(IDictionary<string, uint> constants)
+    {
+        constants.Remove("r3");
+        constants.Remove("r4");
+        constants.Remove("r5");
+        constants.Remove("r6");
+        constants.Remove("r7");
+        constants.Remove("r8");
+        constants.Remove("r9");
+        constants.Remove("r10");
+        constants.Remove("r11");
+        constants.Remove("r12");
+    }
+
+    void TrackConstants(PpcInstruction ins, IDictionary<string, uint> constants)
+    {
+        // Decoder mnemonics are lowercase by construction; comparing the string
+        // directly avoids one allocation per decoded instruction.
+        var mnem = ins.Mnemonic;
+
+        if (TryHandleMove(ins, mnem, constants))
+        {
+            return;
+        }
+
+        if (mnem == "li")
+        {
+            if (TryGetReg(ins, 0, out var rd) && TryGetImm(ins, 1, out var imm))
+            {
+                constants[rd] = unchecked((uint)imm);
+                return;
+            }
+        }
+        else if (mnem == "lis")
+        {
+            if (TryGetReg(ins, 0, out var rd) && TryGetImm(ins, 1, out var imm))
+            {
+                constants[rd] = unchecked((uint)(imm << 16));
+                return;
+            }
+        }
+        else if (mnem == "addi")
+        {
+            if (TryGetReg(ins, 0, out var rd) && TryGetReg(ins, 1, out var ra) && TryGetImm(ins, 2, out var imm))
+            {
+                if (TryGetBaseValue(ra, constants, out var baseVal))
+                {
+                    constants[rd] = AddImm(baseVal, imm);
+                }
+                else
+                {
+                    constants.Remove(rd);
+                }
+                return;
+            }
+        }
+        else if (mnem == "addis")
+        {
+            if (TryGetReg(ins, 0, out var rd) && TryGetReg(ins, 1, out var ra) && TryGetImm(ins, 2, out var imm))
+            {
+                if (TryGetBaseValue(ra, constants, out var baseValHi))
+                {
+                    constants[rd] = AddImm(baseValHi, imm << 16);
+                }
+                else
+                {
+                    constants.Remove(rd);
+                }
+                return;
+            }
+        }
+        else if (mnem == "ori")
+        {
+            if (TryGetReg(ins, 0, out var rd) && TryGetReg(ins, 1, out var ra) && TryGetImm(ins, 2, out var imm))
+            {
+                if (TryGetBaseValue(ra, constants, out var orBase))
+                {
+                    constants[rd] = unchecked(orBase | (uint)(imm & 0xFFFF));
+                }
+                else
+                {
+                    constants.Remove(rd);
+                }
+                return;
+            }
+        }
+        else if (mnem == "oris")
+        {
+            if (TryGetReg(ins, 0, out var rd) && TryGetReg(ins, 1, out var ra) && TryGetImm(ins, 2, out var imm))
+            {
+                if (TryGetBaseValue(ra, constants, out var orisBase))
+                {
+                    constants[rd] = unchecked(orisBase | ((uint)imm << 16));
+                }
+                else
+                {
+                    constants.Remove(rd);
+                }
+                return;
+            }
+        }
+
+        if (TryWritesDest(ins, out var dest))
+        {
+            constants.Remove(dest);
+        }
+    }
+
+    bool TryHandleMove(PpcInstruction ins, string mnemonic, IDictionary<string, uint> constants)
+    {
+        if (string.Equals(mnemonic, "mr", StringComparison.OrdinalIgnoreCase) && TryGetReg(ins, 0, out var rd) && TryGetReg(ins, 1, out var rs))
+        {
+            if (constants.TryGetValue(rs, out var value))
+            {
+                constants[rd] = value;
+            }
+            else
+            {
+                constants.Remove(rd);
+            }
+            return true;
+        }
+
+        if (string.Equals(mnemonic, "or", StringComparison.OrdinalIgnoreCase) &&
+            ins.Operands.Count == 3 &&
+            ins.Operands[0] is PpcRegisterOperand dest &&
+            ins.Operands[1] is PpcRegisterOperand src1 &&
+            ins.Operands[2] is PpcRegisterOperand src2 &&
+            string.Equals(src1.Name, src2.Name, StringComparison.OrdinalIgnoreCase))
+        {
+            var srcName = NormalizeReg(src1.Name);
+            var destName = NormalizeReg(dest.Name);
+            if (constants.TryGetValue(srcName, out var value))
+            {
+                constants[destName] = value;
+            }
+            else
+            {
+                constants.Remove(destName);
+            }
+            return true;
+        }
+
+        return false;
+    }
+
+    bool TryGetBaseValue(string reg, IDictionary<string, uint> constants, out uint value)
+    {
+        if (string.Equals(reg, "r0", StringComparison.OrdinalIgnoreCase))
+        {
+            value = 0;
+            return true;
+        }
+
+        return constants.TryGetValue(reg, out value);
+    }
+
+    bool TryWritesDest(PpcInstruction ins, out string dest)
+    {
+        dest = string.Empty;
+        if (ins.Operands.Count == 0 || ins.Operands[0] is not PpcRegisterOperand reg)
+        {
+            return false;
+        }
+
+        var m = ins.Mnemonic.ToLowerInvariant();
+        if (m.StartsWith("st", StringComparison.Ordinal) || m.StartsWith("b", StringComparison.Ordinal) || m.StartsWith("cmp", StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        dest = NormalizeReg(reg.Name);
+        return true;
+    }
+
+    bool TryGetReg(PpcInstruction ins, int index, out string reg)
+    {
+        if (ins.Operands.Count > index && ins.Operands[index] is PpcRegisterOperand r)
+        {
+            reg = NormalizeReg(r.Name);
+            return true;
+        }
+
+        reg = string.Empty;
+        return false;
+    }
+
+    bool TryGetImm(PpcInstruction ins, int index, out int imm)
+    {
+        if (ins.Operands.Count > index && ins.Operands[index] is PpcImmediateOperand i)
+        {
+            imm = i.Value;
+            return true;
+        }
+
+        imm = 0;
+        return false;
+    }
+
+    uint AddImm(uint baseVal, int imm) => unchecked(baseVal + (uint)imm);
+
+    string NormalizeReg(string reg) => reg.ToLowerInvariant();
+}
+
+/// <summary>
+/// Function entry points stored as a data-section word (vtables, dispatch tables, callbacks). Not a
+/// discovery seeder; answers which mod-build winners must stay reachable via dispatch table, not a static call.
+/// </summary>
+HashSet<uint> CollectDataSectionFunctionPointerTargets()
+{
+    var executableRanges = BuildExecutableRanges();
+    bool IsExecutable(uint addr) => executableRanges.Any(r => r.Contains(addr)) && (addr & 3) == 0;
+
+    var candidates = new HashSet<uint>();
+
+    // Scan DOL data sections for words that look like function pointers.
+    foreach (var section in dolFile.Value.Sections.Where(s => s.Kind == SectionKind.Data && s.HasData && s.Size >= 4))
+    {
+        var baseAddr = section.VirtualAddress;
+        var span = section.Data.Span;
+        for (var offset = 0; offset + 4 <= span.Length; offset += 4)
+        {
+            var value = BinaryPrimitives.ReadUInt32BigEndian(span.Slice(offset, 4));
+            if (!IsExecutable(value))
+            {
+                continue;
+            }
+
+            if (!LooksLikeFunctionStart(value))
+            {
+                continue;
+            }
+
+            candidates.Add(value);
+        }
+    }
+
+    // Scan REL data sections (non-executable) using the relocated image bytes.
+    var rel = relFile.Value;
+    if (rel is null)
+    {
+        return candidates;
+    }
+    var relBase = image.Value.RelRange.Start;
+    var memory = image.Value.Memory;
+
+    foreach (var section in rel.Sections.Where(s => !s.Executable && s.FileOffset != 0 && s.Size >= 4))
+    {
+        var absStart = relBase + section.FileOffset;
+        if (!image.Value.Contains(absStart, checked((int)section.Size)))
+        {
+            continue;
+        }
+        var memOffset = image.Value.GetOffset(absStart, checked((int)section.Size));
+
+        var span = memory.AsSpan(memOffset, (int)section.Size);
+        for (var offset = 0; offset + 4 <= span.Length; offset += 4)
+        {
+            var value = BinaryPrimitives.ReadUInt32BigEndian(span.Slice(offset, 4));
+            if (!IsExecutable(value))
+            {
+                continue;
+            }
+
+            if (!LooksLikeFunctionStart(value))
+            {
+                continue;
+            }
+
+            candidates.Add(value);
+        }
+    }
+
+    return candidates;
+}
+
+    bool LooksExecutable(uint address)
+    {
+        // Build into a local and publish the finished list under a gate. The
+        // previous shape assigned an empty list to the field and filled it in
+        // afterwards, which a concurrent reader could observe half-populated.
+        var ranges = Volatile.Read(ref _executableRanges);
+        if (ranges == null)
+        {
+            lock (_executableRangesGate)
+            {
+                ranges = _executableRanges;
+                if (ranges == null)
+                {
+                    ranges = new List<AddressRange>();
+                    if (dolFile.IsValueCreated)
+                    {
+                        foreach (var s in dolFile.Value.Sections)
+                        {
+                            if (s.IsExecutable && s.Size > 0)
+                            {
+                                ranges.Add(AddressRange.FromStartAndSize(s.VirtualAddress, s.Size));
+                            }
+                        }
+                    }
+
+                    if (relFile.IsValueCreated && relFile.Value is not null && image.IsValueCreated)
+                    {
+                        var relBase = image.Value.RelRange.Start;
+                        foreach (var s in relFile.Value.Sections)
+                        {
+                            if (s.Executable && s.Size > 0 && s.FileOffset != 0)
+                            {
+                                ranges.Add(AddressRange.FromStartAndSize(relBase + s.FileOffset, s.Size));
+                            }
+                        }
+                    }
+
+                    Volatile.Write(ref _executableRanges, ranges);
+                }
+            }
+        }
+
+        return ranges.Any(r => r.Contains(address)) && (address & 3) == 0;
+    }
+
+bool LooksLikeFunctionStart(uint address)
+{
+    var mem = image.Value.Memory;
+    if (!image.Value.Contains(address, sizeof(uint)))
+    {
+        return false;
+    }
+
+    var offset = image.Value.GetOffset(address, sizeof(uint));
+    var firstWord = BinaryPrimitives.ReadUInt32BigEndian(mem.AsSpan(offset, 4));
+    if (firstWord == 0 || firstWord == 0xFFFFFFFF)
+    {
+        return false;
+    }
+
+    // Decode the first instruction and reject if it's an unknown opcode.
+    // This prevents treating string data (e.g., "Metrowerks...") as code.
+    var firstIns = PpcDecoder.Decode(address, firstWord);
+    if (firstIns.Mnemonic.StartsWith("unk", StringComparison.OrdinalIgnoreCase))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+List<AddressRange> BuildExecutableRanges()
+{
+    var ranges = new List<AddressRange>();
+    ranges.AddRange(dolFile.Value.Sections.Where(s => s.IsExecutable).Select(s => s.Range));
+
+    if (relFile.Value is { } rel)
+    {
+        var relBase = image.Value.RelRange.Start;
+        ranges.AddRange(rel.Sections
+            .Where(s => s.Executable && s.FileOffset != 0 && s.Size > 0)
+            .Select(s => AddressRange.FromStartAndSize(relBase + s.FileOffset, s.Size)));
+    }
+
+    return ranges;
+}
+
+TranslationProjectConfig RequireProject() => project ?? throw new InvalidOperationException(
+    "This command requires --project <path>. See projects/mkwii/recomp.yml for an example.");
+
+int ShowHelp(string invalidCommand)
+{
+    Console.Error.WriteLine($"Unrecognized command '{invalidCommand}'.");
+    WriteUsage(Console.Error, KnownCommands());
+    return 1;
+}
+
+static int ShowGlobalHelp()
+{
+    WriteUsage(Console.Out, KnownCommands());
+    return 0;
+}
+
+static int ShowCommandHelp(string command)
+{
+    WriteUsage(Console.Out, new[] { command });
+    return 0;
+}
+
+static void WriteUsage(TextWriter writer, IReadOnlyList<string> commands)
+{
+    writer.WriteLine("Usage:");
+    foreach (var name in commands)
+    {
+        writer.WriteLine(CommandUsage(name));
+    }
+    writer.WriteLine("Every command also accepts [--project path] [--profile name] [--prefer-cached-inputs] [--help].");
+}
+
+static string[] KnownCommands() => new[]
+{
+    "info",
+    "generate-data-init",
+    "translate-recursive",
+    "translate-mod",
+    "emit-base-manifest",
+    "emit-build-shards",
+    "check-base-mod-awareness"
+};
+
+/// <summary>
+/// Single source of truth for what each command accepts; usage text and the argument validator
+/// both derive from this so a flag can't exist in one but not the other, as happened with the
+/// hand-written usage strings this replaced.
+/// </summary>
+static (string? Positional, CommandOption[] Options)? CommandSpec(string command) => command switch
+{
+    "info" or "--info" or "--version" =>
+        (null, Array.Empty<CommandOption>()),
+    "generate-data-init" => (null, Array.Empty<CommandOption>()),
+    "translate-recursive" => ("<start_addr>", new CommandOption[]
+    {
+        new("--outdir", "path"),
+        new("--output-metadata", "path"),
+        new("--production-source-bundle", "path"),
+        new("--threads", "N"),
+        new("--no-function-files"),
+        new("--prune-stale")
+    }),
+    "translate-mod" => (null, new CommandOption[]
+    {
+        new("--code-pul", "path/to/Code.pul", Required: true),
+        new("--base-manifest", "path", Required: true),
+        new("--out", "path", Required: true),
+        new("--mod-root", "path"),
+        new("--mod-name", "name"),
+        new("--base-translation-output-metadata", "path"),
+        new("--region", "P"),
+        new("--module-guest-base", "0x81700000"),
+        new("--module-link-base", "0x803992E0"),
+        new("--threads", "N"),
+        new("--retro-wfc-payload", "path-or-url"),
+        new("--skip-retro-wfc"),
+        new("--emit-cpp")
+    }),
+    "check-base-mod-awareness" => (null, new CommandOption[]
+    {
+        new("--translation-output-metadata", "path"),
+        new("--code-pul", "path")
+    }),
+    "emit-base-manifest" => (null, new CommandOption[]
+    {
+        new("--out", "path"),
+        new("--functions-dir", "generated/functions"),
+        new("--translation-output-metadata", "path"),
+        new("--region", "P")
+    }),
+    "emit-build-shards" => (null, new CommandOption[]
+    {
+        new("--base-metadata", "path"),
+        new("--base-functions-dir", "path"),
+        new("--native-source-dir", "path"),
+        new("--resolved-profile", "path"),
+        new("--retro-cpp-dir", "path"),
+        new("--out", "generated/build_shards")
+    }),
+    _ => null
+};
+
+static string CommandUsage(string command)
+{
+    if (CommandSpec(command) is not { } spec)
+    {
+        return $"  translator {command}";
+    }
+
+    var text = new StringBuilder("  translator ").Append(command);
+    if (spec.Positional is { } positional)
+    {
+        text.Append(' ').Append(positional);
+    }
+    foreach (var option in spec.Options)
+    {
+        var body = option.Value is null ? option.Name : $"{option.Name} {option.Value}";
+        text.Append(' ').Append(option.Required ? body : $"[{body}]");
+    }
+    return text.ToString();
+}
+
+// Options every command tolerates. --project and --profile are consumed before
+// dispatch, so they only reach a command's tail when they were repeated.
+static string[] GlobalValueOptions() => new[] { "--project", "--profile" };
+
+static string[] GlobalFlagOptions() => new[] { "--prefer-cached-inputs" };
+
+/// <summary>
+/// Returns an exit code when the command line was fully handled here (help, or an option the
+/// command's parser would discard), null otherwise. Only inspects option-like tokens; positional
+/// addresses, paths and passthrough values are never rejected.
+/// </summary>
+static int? HandleCommandLineOptions(string command, string[] argsTail)
+{
+    if (CommandSpec(command) is not { } spec)
+    {
+        return null;
+    }
+
+    if (argsTail.Any(static token =>
+            string.Equals(token, "--help", StringComparison.Ordinal) ||
+            string.Equals(token, "-h", StringComparison.Ordinal) ||
+            string.Equals(token, "-?", StringComparison.Ordinal)))
+    {
+        return ShowCommandHelp(command);
+    }
+
+    var values = new HashSet<string>(StringComparer.Ordinal);
+    values.UnionWith(spec.Options.Where(static option => option.Value is not null).Select(static option => option.Name));
+    values.UnionWith(GlobalValueOptions());
+    var flags = new HashSet<string>(StringComparer.Ordinal);
+    flags.UnionWith(spec.Options.Where(static option => option.Value is null).Select(static option => option.Name));
+    flags.UnionWith(GlobalFlagOptions());
+
+    for (var index = 0; index < argsTail.Length; index++)
+    {
+        var token = argsTail[index];
+        if (values.Contains(token))
+        {
+            // Step over the value so an option argument that happens to look
+            // like an option of its own is never rejected.
+            index++;
+            continue;
+        }
+        if (flags.Contains(token) || !token.StartsWith('-'))
+        {
+            continue;
+        }
+
+        Console.Error.WriteLine($"Unrecognized option '{token}' for command '{command}'.");
+        WriteUsage(Console.Error, new[] { command });
+        return 2;
+    }
+
+    return null;
+}
+
+ProgramImage LoadImage()
+{
+    var loadedProject = RequireProject();
+    var dol = dolFile.Value;
+
+    // Generate runtime configuration header with the manifest's SDA base pointers
+    var (sda1Base, sda2Base) = loadedProject.RequireSdaBases();
+    RuntimeConfigGenerator.GenerateConfigHeader(
+        sda1Base,
+        sda2Base,
+        loadedProject.Output.RuntimeConfig,
+        loadedProject.Identity.DisplayName);
+    Console.WriteLine(
+        $"[translator] SDA bases: r13 (_SDA_BASE_) 0x{sda1Base:X8}, r2 (_SDA2_BASE_) 0x{sda2Base:X8} " +
+        $"(entry 0x{dol.EntryPoint:X8}).");
+
+    var relImage = relFile.Value?.BuildImage(loadedProject.Inputs.Rel!.LoadAddress);
+    return new ProgramImageBuilder().Build(dol, relImage, loadedProject.Memory.Base, loadedProject.Memory.Size);
+}
+
+DolFile LoadDol()
+{
+    return DolFile.Load(RequireProject().Inputs.Dol.Path);
+}
+
+RelFile? LoadRel()
+{
+    return RequireProject().Inputs.Rel is { } rel ? RelFile.Load(rel.Path) : null;
+}
+
+static uint ParseAddress(string text) => GuestTargetParser.ParseHexAddress(text);
+
+// Small prewarm passes happen constantly (every discovered continuation wave);
+// only a whole-image-sized one is worth a line of output.
+static void ReportAbiPrewarm(GuestAbiPrewarmReport report)
+{
+    if (report.AddressCount <= 1024) return;
+    Console.WriteLine(
+        $"[translator] ABI prewarm: {report.AddressCount:N0} address(es); " +
+        $"phase A {report.PhaseASeconds:F1}s, phase B {report.PhaseBSeconds:F1}s " +
+        $"over {report.PhaseBComputedCount:N0} deferred address(es).");
+}
+
+string ResolveFunctionName(uint entry, string? preferred = null, string? fallback = null)
+{
+    var candidate = !string.IsNullOrWhiteSpace(preferred)
+        ? preferred!
+        : !string.IsNullOrWhiteSpace(fallback)
+            ? fallback!
+            : $"func_{entry:X8}";
+
+    var entryToken = entry.ToString("X8");
+    return NameContainsAddressToken(candidate, entryToken)
+        ? candidate
+        : $"{candidate}_{entryToken}";
+}
+
+static bool NameContainsAddressToken(string text, string addressToken)
+{
+    if (string.IsNullOrEmpty(text) || string.IsNullOrEmpty(addressToken))
+    {
+        return false;
+    }
+
+    return text.IndexOf(addressToken, StringComparison.OrdinalIgnoreCase) >= 0;
+}
+
+HashSet<uint> BuildKnownBaseFunctionEntryPoints(
+    string generatedFunctionsDir,
+    IEnumerable<uint> seeds,
+    bool includeGeneratedHistory = true)
+{
+    var starts = new HashSet<uint>(seeds);
+    if (includeGeneratedHistory)
+    {
+        foreach (var start in DiscoverFunctionStartAddressesFromFileNames(generatedFunctionsDir))
+        {
+            starts.Add(start);
+        }
+    }
+
+    return starts;
+}
+
+static IEnumerable<uint> DiscoverFunctionStartAddressesFromFileNames(string generatedFunctionsDir)
+{
+    if (!Directory.Exists(generatedFunctionsDir))
+    {
+        yield break;
+    }
+
+    var addressRegex = new Regex("([0-9A-Fa-f]{8})", RegexOptions.CultureInvariant);
+    foreach (var path in Directory.EnumerateFiles(generatedFunctionsDir, "*.cpp", SearchOption.AllDirectories))
+    {
+        var match = addressRegex.Match(Path.GetFileNameWithoutExtension(path));
+        if (match.Success &&
+            GuestTargetParser.TryParseHexAddress(match.Groups[1].Value, out var value))
+        {
+            yield return value;
+        }
+    }
+}
+
+static int ParseInt(string text) =>
+    text.StartsWith("0x", StringComparison.OrdinalIgnoreCase)
+        ? int.Parse(text[2..], NumberStyles.HexNumber, CultureInfo.InvariantCulture)
+        : int.Parse(text, CultureInfo.InvariantCulture);
+
+static string? OptionValue(string[] argsTail, string name)
+{
+    var index = Array.IndexOf(argsTail, name);
+    if (index >= 0 && index + 1 < argsTail.Length)
+    {
+        return argsTail[index + 1];
+    }
+    return null;
+}
+
+static (string? Value, string[] Remaining) ExtractOption(string[] values, string name)
+{
+    for (var index = 0; index < values.Length; index++)
+    {
+        if (!string.Equals(values[index], name, StringComparison.Ordinal))
+        {
+            continue;
+        }
+        if (index + 1 >= values.Length)
+        {
+            throw new ArgumentException($"{name} requires a value.");
+        }
+
+        var remaining = values.Where((_, itemIndex) => itemIndex != index && itemIndex != index + 1).ToArray();
+        return (values[index + 1], remaining);
+    }
+
+    return (null, values);
+}
+
+static bool HasFlag(string[] argsTail, string name) => argsTail.Any(a => string.Equals(a, name, StringComparison.Ordinal));
+
+/// <summary>
+/// Addresses a leaf splice must never cover: the decoded bytes aren't what the runtime
+/// executes there (native registration/fatal stub, exclusion, or a mod overlay rewrite).
+/// </summary>
+static IReadOnlySet<uint> BuildLeafInliningBlockedTargets(
+    IReadOnlySet<uint> modPatchedAddresses,
+    RuntimeNativeGuestEffectSet nativeGuestEffects,
+    IReadOnlySet<uint> translationExclusions)
+{
+    var blocked = new HashSet<uint>(nativeGuestEffects.Contracts.Keys);
+    blocked.UnionWith(translationExclusions);
+    blocked.UnionWith(modPatchedAddresses);
+    return blocked;
+}
+
+/// <summary>
+/// Every enabled project profile with a Code.pul on disk, ordered by name. Enumerating all
+/// of them (not just the selected one) keeps a profile-less base translation valid downstream.
+/// </summary>
+static IReadOnlyList<Translator.Cli.Configuration.ProjectProfile> CollectModPatchProfiles(
+    Translator.Cli.Configuration.TranslationProjectConfig? project,
+    Translator.Cli.Configuration.ProjectProfile? selectedProfile)
+{
+    var profiles = new Dictionary<string, Translator.Cli.Configuration.ProjectProfile>(StringComparer.OrdinalIgnoreCase);
+    if (project is not null)
+    {
+        foreach (var candidate in project.Profiles.Values)
+        {
+            if (candidate.Enabled &&
+                !string.IsNullOrWhiteSpace(candidate.CodePul) &&
+                File.Exists(candidate.CodePul))
+            {
+                profiles[candidate.Name] = candidate;
+            }
+        }
+    }
+    // An explicitly selected profile always participates, even if a future
+    // caller selects one that is marked disabled in the project file.
+    if (selectedProfile is not null &&
+        !string.IsNullOrWhiteSpace(selectedProfile.CodePul) &&
+        File.Exists(selectedProfile.CodePul))
+    {
+        profiles[selectedProfile.Name] = selectedProfile;
+    }
+
+    return profiles.Values.OrderBy(static p => p.Name, StringComparer.OrdinalIgnoreCase).ToArray();
+}
+
+/// <summary>
+/// The mod-patch awareness stamp recorded into the base translation output
+/// metadata: one entry per profile whose patch set shaped this translation.
+/// translate-mod refuses a base tree whose stamp does not cover its Code.pul.
+/// </summary>
+static IReadOnlyList<BaseTranslationModPatchAwareness> BuildModPatchAwareness(
+    IReadOnlyList<Translator.Cli.Configuration.ProjectProfile> patchProfiles) =>
+    patchProfiles
+        .Select(static patchProfile => new BaseTranslationModPatchAwareness(
+            patchProfile.Name,
+            ChecksumUtilities.Sha256HexOfFile(patchProfile.CodePul!)))
+        .ToArray();
+
+/// <summary>
+/// The same profiles, carrying the patch set itself rather than a digest of the file it came from.
+/// <see cref="BaseTranslationModAwareness"/> narrows that set down to the addresses this translation
+/// could actually see, which is what lets a later Code.pul reuse the completed base tree.
+/// </summary>
+static IReadOnlyList<(string Profile, string Region, string CodePulSha256, IReadOnlySet<uint> PatchedAddresses)>
+    BuildModPatchAwarenessDetail(IReadOnlyList<Translator.Cli.Configuration.ProjectProfile> patchProfiles) =>
+    patchProfiles
+        .Select(static patchProfile => (
+            Profile: patchProfile.Name,
+            Region: patchProfile.Region ?? string.Empty,
+            CodePulSha256: ChecksumUtilities.Sha256HexOfFile(patchProfile.CodePul!),
+            PatchedAddresses: BaseTranslationModAwareness.PatchedAddresses(
+                patchProfile.CodePul!, patchProfile.Region ?? string.Empty)))
+        .ToArray();
+
+/// <summary>
+/// Union of every absolute Kamek command address across the given profiles'
+/// Code.pul files: the addresses whose runtime winner can be a mod overlay.
+/// </summary>
+static IReadOnlySet<uint> BuildModPatchedAddresses(
+    IReadOnlyList<Translator.Cli.Configuration.ProjectProfile> patchProfiles)
+{
+    var patched = new HashSet<uint>();
+    foreach (var patchProfile in patchProfiles)
+    {
+        patched.UnionWith(BaseTranslationModAwareness.PatchedAddresses(
+            patchProfile.CodePul!, patchProfile.Region ?? string.Empty));
+    }
+
+    return patched;
+}
+
+// Every emitting translation path (base, mod overlay, continuation, module, payload) must run
+// its options through here so codegen policy can't diverge; mod paths once built TranslationOptions
+// independently and silently shipped pre-residency codegen. Leaf inlining stays out of here since it
+// rewrites IR before SSA and belongs to discovery (WithProjectFrontEndPolicy); mod, overlay and
+// payload builds use a different image and stay un-inlined.
+static TranslationOptions WithProjectCodegenPolicy(
+    TranslationOptions options,
+    ProjectTranslation translation,
+    uint entryPoint) =>
+    options with
+    {
+        AllowUnsupportedInstructions = translation.AllowUnsupportedInstructions,
+        // Leaf ABI spill elision is structurally self-guarding: it requires a
+        // matched save/restore pair inside the emitted body of a single-return
+        // leaf, so a partial mod chunk that only carries one half of an ABI
+        // prologue is rejected rather than mis-transformed.
+        EnableLeafAbiSpillElision = true,
+    };
+
+/// <summary>
+/// One option carried by one command. <paramref name="Value"/> is the metavariable
+/// printed after the option name, or null for a flag; <paramref name="Required"/>
+/// only controls whether usage brackets it.
+/// </summary>
+readonly record struct CommandOption(string Name, string? Value = null, bool Required = false);
+
+sealed record ResolvedDispatchEntry(
+    uint Address,
+    string Symbol,
+    string Name,
+    string Kind,
+    uint Priority,
+    bool DirectCallAvailable,
+    uint GprReadMask,
+    uint GprWriteMask,
+    uint GprClobberMask,
+    uint GprReturnMask,
+    uint FprReadMask,
+    uint FprWriteMask,
+    uint FprReturnMask,
+    byte CrReadMask,
+    byte CrWriteMask,
+    bool ReadsXer,
+    bool WritesXer,
+    bool IsFullSynchronizationFence,
+    bool PreservesNonvolatileFprs,
+    uint NonvolatileFprWriteMask,
+    bool MustRemainDynamicallyDispatchable,
+    string SourceFile);
+
+
diff --git a/translator/src/Translator.Cli/Properties/AssemblyInfo.cs b/translator/src/Translator.Cli/Properties/AssemblyInfo.cs
new file mode 100644
index 0000000..4930220
--- /dev/null
+++ b/translator/src/Translator.Cli/Properties/AssemblyInfo.cs
@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("Translator.Tests")]
diff --git a/translator/src/Translator.Cli/QueueBatch.cs b/translator/src/Translator.Cli/QueueBatch.cs
new file mode 100644
index 0000000..724e381
--- /dev/null
+++ b/translator/src/Translator.Cli/QueueBatch.cs
@@ -0,0 +1,35 @@
+using System;
+using System.Collections.Generic;
+
+/// <summary>
+/// Small FIFO primitive shared by the recursive and mod wave schedulers.
+/// Traversal-specific policy (depth, visited sets, retries, and failure
+/// handling) intentionally remains with each caller.
+/// </summary>
+internal static class QueueBatch
+{
+    internal static List<T> Dequeue<T>(
+        Queue<T> queue,
+        int maximumCount,
+        Func<T, bool>? skip = null)
+    {
+        if (maximumCount <= 0)
+        {
+            return new List<T>();
+        }
+
+        var batch = new List<T>(Math.Min(queue.Count, maximumCount));
+        while (queue.Count > 0 && batch.Count < maximumCount)
+        {
+            var item = queue.Dequeue();
+            if (skip is not null && skip(item))
+            {
+                continue;
+            }
+
+            batch.Add(item);
+        }
+
+        return batch;
+    }
+}
diff --git a/translator/src/Translator.Cli/TranslationProjectConfig.cs b/translator/src/Translator.Cli/TranslationProjectConfig.cs
new file mode 100644
index 0000000..2deb7df
--- /dev/null
+++ b/translator/src/Translator.Cli/TranslationProjectConfig.cs
@@ -0,0 +1,506 @@
+using System.Globalization;
+using YamlDotNet.Serialization;
+using YamlDotNet.Serialization.NamingConventions;
+using Translator.Core.Loading;
+
+namespace Translator.Cli.Configuration;
+
+internal sealed class TranslationProjectConfig
+{
+    private TranslationProjectConfig(
+        string sourcePath,
+        string workspaceRoot,
+        ProjectIdentity identity,
+        ProjectMemory memory,
+        ProjectInputs inputs,
+        ProjectTranslation translation,
+        ProjectRuntime runtime,
+        ProjectOutput output,
+        IReadOnlyDictionary<string, ProjectProfile> profiles)
+    {
+        SourcePath = sourcePath;
+        WorkspaceRoot = workspaceRoot;
+        Identity = identity;
+        Memory = memory;
+        Inputs = inputs;
+        Translation = translation;
+        Runtime = runtime;
+        Output = output;
+        Profiles = profiles;
+    }
+
+    public string SourcePath { get; }
+    public string WorkspaceRoot { get; }
+    public ProjectIdentity Identity { get; }
+    public ProjectMemory Memory { get; }
+    public ProjectInputs Inputs { get; }
+    public ProjectTranslation Translation { get; }
+    public ProjectRuntime Runtime { get; }
+    public ProjectOutput Output { get; }
+    public IReadOnlyDictionary<string, ProjectProfile> Profiles { get; }
+
+    public static TranslationProjectConfig Load(string path)
+    {
+        var sourcePath = Path.GetFullPath(path);
+        if (!File.Exists(sourcePath))
+        {
+            throw new FileNotFoundException("Translation project manifest not found.", sourcePath);
+        }
+
+        var deserializer = new DeserializerBuilder()
+            .WithNamingConvention(UnderscoredNamingConvention.Instance)
+            .Build();
+        var dto = deserializer.Deserialize<ProjectDto>(File.ReadAllText(sourcePath))
+            ?? throw new InvalidDataException($"Translation project manifest is empty: {sourcePath}");
+        if (dto.SchemaVersion != 1)
+        {
+            throw new InvalidDataException($"Unsupported translation project schema_version {dto.SchemaVersion}; expected 1.");
+        }
+
+        var manifestDirectory = Path.GetDirectoryName(sourcePath)!;
+        var workspaceRoot = ResolvePath(manifestDirectory, dto.WorkspaceRoot ?? ".");
+        var identity = new ProjectIdentity(
+            Require(dto.Project?.Id, "project.id"),
+            dto.Project?.DisplayName ?? dto.Project?.Id!,
+            dto.Project?.GameId,
+            dto.Project?.Region,
+            dto.Project?.BaseManifestFormat ?? "recomp-base-manifest",
+            dto.Project?.BaseManifestStem ?? "base");
+        var memory = new ProjectMemory(
+            ParseUInt32(dto.Memory?.Base, MemoryLayout.RamBase, "memory.base"),
+            ParseInt32(dto.Memory?.Size, MemoryLayout.RamSize, "memory.size"),
+            ParseOptionalUInt32(dto.Memory?.SdaBase, "memory.sda_base"),
+            ParseOptionalUInt32(dto.Memory?.Sda2Base, "memory.sda2_base"));
+
+        var dolDto = dto.Inputs?.Dol ?? throw new InvalidDataException("Translation project requires inputs.dol.");
+        var dol = ResolveInput(workspaceRoot, dolDto, "inputs.dol");
+        ProjectRelInput? rel = null;
+        if (dto.Inputs?.Rel is { Path.Length: > 0 } relDto)
+        {
+            var relInput = ResolveInput(workspaceRoot, relDto, "inputs.rel");
+            rel = new ProjectRelInput(
+                relInput.Path,
+                relInput.Sha256,
+                ParseUInt32(relDto.LoadAddress, null, "inputs.rel.load_address"));
+        }
+
+        var entryPoints = (dto.Translation?.EntryPoints ?? [])
+            .Select((value, index) => ParseUInt32(value, null, $"translation.entry_points[{index}]"))
+            .ToArray();
+        string? functionMapPath = null;
+        if (dto.Translation?.FunctionMap is { } functionMapDto)
+        {
+            functionMapPath = ResolvePath(
+                workspaceRoot,
+                Require(functionMapDto.Path, "translation.function_map.path"));
+        }
+        var translation = new ProjectTranslation(
+            entryPoints,
+            functionMapPath,
+            dto.Translation?.AllowUnsupportedInstructions ?? false);
+
+        var abiDirectories = (dto.Runtime?.NativeAbiDirectories ?? [])
+            .Select(pathValue => ResolvePath(workspaceRoot, pathValue))
+            .ToArray();
+        var runtime = new ProjectRuntime(
+            abiDirectories,
+            ResolvePath(workspaceRoot, dto.Runtime?.NativeRegistrationRoot ?? "runtime/src"));
+        var outputRoot = ResolvePath(workspaceRoot, dto.Output?.Root ?? "generated");
+        var output = new ProjectOutput(
+            outputRoot,
+            ResolveOutput(outputRoot, dto.Output?.Functions, "functions"),
+            ResolveOutput(outputRoot, dto.Output?.RuntimeConfig, "RuntimeConfig.h"),
+            ResolveOutput(outputRoot, dto.Output?.DataInitializer, "data_sections_init.cpp"),
+            ResolveOutput(outputRoot, dto.Output?.BaseManifest, Path.Combine("base", "base_manifest.json")));
+
+        var profiles = new Dictionary<string, ProjectProfile>(StringComparer.OrdinalIgnoreCase);
+        foreach (var (name, profileDto) in dto.Profiles ?? new Dictionary<string, ProfileDto>())
+        {
+            profiles[name] = new ProjectProfile(
+                name,
+                profileDto.Enabled ?? true,
+                ResolveOptionalPath(workspaceRoot, profileDto.CodePul),
+                ResolveOptionalPath(workspaceRoot, profileDto.ModRoot),
+                profileDto.Region,
+                ParseOptionalUInt32(profileDto.ModuleGuestBase, $"profiles.{name}.module_guest_base"),
+                ParseOptionalUInt32(profileDto.ModuleLinkBase, $"profiles.{name}.module_link_base"),
+                ResolveOptionalPath(workspaceRoot, profileDto.Output),
+                profileDto.EnableRetroWfc ?? false,
+                profileDto.RetroWfcPayload,
+                ParseOptionalUInt32(
+                    profileDto.RetroWfcLegacyBootstrapHook,
+                    $"profiles.{name}.retro_wfc_legacy_bootstrap_hook"),
+                profileDto.RequiresGameId,
+                NormalizeHash(profileDto.RequiresDolSha256),
+                ResolveRiivolution(profileDto.Riivolution, name));
+        }
+
+        var config = new TranslationProjectConfig(
+            sourcePath,
+            workspaceRoot,
+            identity,
+            memory,
+            new ProjectInputs(dol, rel),
+            translation,
+            runtime,
+            output,
+            profiles);
+        config.ValidateInputs();
+        return config;
+    }
+
+    public ProjectProfile? GetProfile(string? name)
+    {
+        if (string.IsNullOrWhiteSpace(name) || string.Equals(name, "base", StringComparison.OrdinalIgnoreCase))
+        {
+            return null;
+        }
+
+        return Profiles.TryGetValue(name, out var profile)
+            ? profile
+            : throw new InvalidDataException($"Project '{Identity.Id}' has no profile named '{name}'.");
+    }
+
+    public void ValidateProfile(ProjectProfile profile)
+    {
+        if (!profile.Enabled)
+        {
+            throw new InvalidDataException($"Profile '{profile.Name}' is disabled.");
+        }
+        if (!string.IsNullOrWhiteSpace(profile.RequiresGameId) &&
+            !string.Equals(profile.RequiresGameId, Identity.GameId, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidDataException(
+                $"Profile '{profile.Name}' requires game ID {profile.RequiresGameId}, but project is {Identity.GameId ?? "unspecified"}.");
+        }
+        if (!string.IsNullOrWhiteSpace(profile.RequiresDolSha256) &&
+            !string.Equals(profile.RequiresDolSha256, FileSha256(Inputs.Dol.Path), StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidDataException($"Profile '{profile.Name}' is not compatible with this DOL hash.");
+        }
+        if (profile.EnableRetroWfc && string.IsNullOrWhiteSpace(profile.RetroWfcPayload))
+        {
+            throw new InvalidDataException($"Profile '{profile.Name}' enables Retro WFC but has no payload.");
+        }
+    }
+
+    /// <summary>The pinned Small Data Area bases (r13/r2), or a diagnostic naming which manifest keys are missing.</summary>
+    public (uint Sda1Base, uint Sda2Base) RequireSdaBases()
+    {
+        if (Memory.SdaBase is { } sda1 && Memory.Sda2Base is { } sda2)
+        {
+            return (sda1, sda2);
+        }
+
+        var missing = Memory.SdaBase is null
+            ? Memory.Sda2Base is null ? "memory.sda_base and memory.sda2_base" : "memory.sda_base"
+            : "memory.sda2_base";
+        throw new InvalidDataException(
+            $"Translation project '{Identity.Id}' is missing {missing} in {SourcePath}. " +
+            "These are the r13/r2 Small Data Area bases the boot code installs (_SDA_BASE_ and _SDA2_BASE_); " +
+            "read them from the lis/ori pair in __init_registers of the pinned DOL and add them as hex strings " +
+            "under the manifest's memory: section.");
+    }
+
+    private void ValidateInputs()
+    {
+        ValidateInput(Inputs.Dol, "DOL");
+        if (Inputs.Rel is not null)
+        {
+            ValidateInput(Inputs.Rel, "REL");
+        }
+        if (Translation.FunctionMapPath is { } functionMapPath && !File.Exists(functionMapPath))
+        {
+            throw new FileNotFoundException("Configured function map was not found.", functionMapPath);
+        }
+        if (Memory.Size <= 0)
+        {
+            throw new InvalidDataException("memory.size must be positive.");
+        }
+    }
+
+    private static ProjectBinaryInput ResolveInput(string root, BinaryInputDto input, string field)
+    {
+        var path = ResolvePath(root, Require(input.Path, $"{field}.path"));
+        return new ProjectBinaryInput(path, NormalizeHash(input.Sha256));
+    }
+
+    private static void ValidateInput(ProjectBinaryInput input, string label)
+    {
+        if (!File.Exists(input.Path))
+        {
+            throw new FileNotFoundException($"Configured {label} input was not found.", input.Path);
+        }
+        if (!string.IsNullOrWhiteSpace(input.Sha256))
+        {
+            var actual = FileSha256(input.Path);
+            if (!string.Equals(actual, input.Sha256, StringComparison.OrdinalIgnoreCase))
+            {
+                throw new InvalidDataException($"Configured {label} SHA-256 does not match {input.Path}. Expected {input.Sha256}, got {actual}.");
+            }
+        }
+    }
+
+    private static string FileSha256(string path) =>
+        ChecksumUtilities.Sha256HexOfFile(path);
+
+    private static string? NormalizeHash(string? value) =>
+        string.IsNullOrWhiteSpace(value) ? null : value.Trim().ToLowerInvariant();
+
+    private static string ResolveOutput(string outputRoot, string? value, string fallback) =>
+        ResolvePath(outputRoot, string.IsNullOrWhiteSpace(value) ? fallback : value);
+
+    private static string? ResolveOptionalPath(string root, string? value) =>
+        string.IsNullOrWhiteSpace(value) ? null : ResolvePath(root, value);
+
+    private static string ResolvePath(string root, string value)
+    {
+        var expanded = Environment.ExpandEnvironmentVariables(value);
+        return Path.GetFullPath(Path.IsPathRooted(expanded) ? expanded : Path.Combine(root, expanded));
+    }
+
+    private static string Require(string? value, string field) =>
+        !string.IsNullOrWhiteSpace(value) ? value : throw new InvalidDataException($"Translation project requires {field}.");
+
+    // Riivolution declarations are verbatim distribution metadata, not paths on this machine:
+    // the XML lives inside the pack the runtime mounts, so it stays a forward-slashed
+    // pack-relative string and is never resolved against the workspace root.
+    private static ProjectRiivolution? ResolveRiivolution(RiivolutionDto? dto, string profileName)
+    {
+        if (dto is null)
+        {
+            return null;
+        }
+
+        var xml = NormalizePackRelativePath(dto.Xml);
+        if (xml.Length == 0)
+        {
+            throw new InvalidDataException($"Translation project requires profiles.{profileName}.riivolution.xml.");
+        }
+
+        var entries = dto.Options ?? [];
+        var options = new List<ProjectRiivolutionOption>(entries.Count);
+        for (var index = 0; index < entries.Count; index++)
+        {
+            var field = $"profiles.{profileName}.riivolution.options[{index}]";
+            var option = entries[index].Option?.Trim() ?? string.Empty;
+            if (option.Length == 0)
+            {
+                throw new InvalidDataException($"Translation project requires {field}.option.");
+            }
+            options.Add(new ProjectRiivolutionOption(
+                entries[index].Section?.Trim() ?? string.Empty,
+                option,
+                ParseUInt32(entries[index].Choice, 0u, $"{field}.choice")));
+        }
+
+        return new ProjectRiivolution(xml, options);
+    }
+
+    private static string NormalizePackRelativePath(string? value)
+    {
+        var text = (value ?? string.Empty).Trim().Replace('\\', '/');
+        while (true)
+        {
+            if (text.StartsWith("./", StringComparison.Ordinal))
+            {
+                text = text[2..];
+                continue;
+            }
+            if (text.StartsWith("/", StringComparison.Ordinal))
+            {
+                text = text[1..];
+                continue;
+            }
+            return text;
+        }
+    }
+
+    private static uint ParseUInt32(string? value, uint? fallback, string field)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return fallback ?? throw new InvalidDataException($"Translation project requires {field}.");
+        }
+        var text = value.Trim();
+        var style = NumberStyles.Integer;
+        if (text.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+        {
+            text = text[2..];
+            style = NumberStyles.HexNumber;
+        }
+        return uint.TryParse(text, style, CultureInfo.InvariantCulture, out var result)
+            ? result
+            : throw new InvalidDataException($"Invalid unsigned integer '{value}' for {field}.");
+    }
+
+    private static uint? ParseOptionalUInt32(string? value, string field) =>
+        string.IsNullOrWhiteSpace(value) ? null : ParseUInt32(value, null, field);
+
+    private static int ParseInt32(string? value, int fallback, string field)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return fallback;
+        }
+        var parsed = ParseUInt32(value, null, field);
+        return parsed <= int.MaxValue
+            ? (int)parsed
+            : throw new InvalidDataException($"{field} exceeds Int32 range.");
+    }
+
+    private sealed class ProjectDto
+    {
+        public int SchemaVersion { get; init; }
+        public string? WorkspaceRoot { get; init; }
+        public IdentityDto? Project { get; init; }
+        public MemoryDto? Memory { get; init; }
+        public InputsDto? Inputs { get; init; }
+        public TranslationDto? Translation { get; init; }
+        public RuntimeDto? Runtime { get; init; }
+        public OutputDto? Output { get; init; }
+        public Dictionary<string, ProfileDto>? Profiles { get; init; }
+    }
+
+    private sealed class IdentityDto
+    {
+        public string? Id { get; init; }
+        public string? DisplayName { get; init; }
+        public string? GameId { get; init; }
+        public string? Region { get; init; }
+        public string? BaseManifestFormat { get; init; }
+        public string? BaseManifestStem { get; init; }
+    }
+
+    private sealed class MemoryDto
+    {
+        public string? Base { get; init; }
+        public string? Size { get; init; }
+        public string? SdaBase { get; init; }
+        public string? Sda2Base { get; init; }
+    }
+
+    private sealed class InputsDto
+    {
+        public BinaryInputDto? Dol { get; init; }
+        public RelInputDto? Rel { get; init; }
+    }
+
+    private class BinaryInputDto
+    {
+        public string Path { get; init; } = string.Empty;
+        public string? Sha256 { get; init; }
+    }
+
+    private sealed class RelInputDto : BinaryInputDto
+    {
+        public string? LoadAddress { get; init; }
+    }
+
+    // Translation behaviour (state-free ABI, register residency, leaf inlining, flat guest memory) is
+    // unconditional; only inputs are declared here. function_map is one: every function start in the
+    // image, which the recursive pass seeds from.
+    private sealed class TranslationDto
+    {
+        public List<string>? EntryPoints { get; init; }
+        public FunctionMapDto? FunctionMap { get; init; }
+        public bool? AllowUnsupportedInstructions { get; init; }
+    }
+
+    private sealed class FunctionMapDto
+    {
+        public string? Path { get; init; }
+    }
+
+    private sealed class RuntimeDto
+    {
+        public List<string>? NativeAbiDirectories { get; init; }
+        public string? NativeRegistrationRoot { get; init; }
+    }
+
+    private sealed class OutputDto
+    {
+        public string? Root { get; init; }
+        public string? Functions { get; init; }
+        public string? RuntimeConfig { get; init; }
+        public string? DataInitializer { get; init; }
+        public string? BaseManifest { get; init; }
+    }
+
+    private sealed class ProfileDto
+    {
+        public bool? Enabled { get; init; }
+        public string? CodePul { get; init; }
+        public string? ModRoot { get; init; }
+        public string? Region { get; init; }
+        public string? ModuleGuestBase { get; init; }
+        public string? ModuleLinkBase { get; init; }
+        public string? Output { get; init; }
+        public bool? EnableRetroWfc { get; init; }
+        public string? RetroWfcPayload { get; init; }
+        public string? RetroWfcLegacyBootstrapHook { get; init; }
+        public string? RequiresGameId { get; init; }
+        public string? RequiresDolSha256 { get; init; }
+        public RiivolutionDto? Riivolution { get; init; }
+    }
+
+    private sealed class RiivolutionDto
+    {
+        public string? Xml { get; init; }
+        public List<RiivolutionOptionDto>? Options { get; init; }
+    }
+
+    private sealed class RiivolutionOptionDto
+    {
+        public string? Section { get; init; }
+        public string? Option { get; init; }
+        public string? Choice { get; init; }
+    }
+}
+
+internal sealed record ProjectIdentity(
+    string Id,
+    string DisplayName,
+    string? GameId,
+    string? Region,
+    string BaseManifestFormat,
+    string BaseManifestStem);
+internal sealed record ProjectMemory(uint Base, int Size, uint? SdaBase = null, uint? Sda2Base = null);
+internal record ProjectBinaryInput(string Path, string? Sha256);
+internal sealed record ProjectRelInput(string Path, string? Sha256, uint LoadAddress) : ProjectBinaryInput(Path, Sha256);
+internal sealed record ProjectInputs(ProjectBinaryInput Dol, ProjectRelInput? Rel);
+internal sealed record ProjectTranslation(
+    IReadOnlyList<uint> EntryPoints,
+    string? FunctionMapPath,
+    bool AllowUnsupportedInstructions);
+internal sealed record ProjectRuntime(
+    IReadOnlyList<string> NativeAbiDirectories,
+    string NativeRegistrationRoot);
+internal sealed record ProjectOutput(
+    string Root,
+    string Functions,
+    string RuntimeConfig,
+    string DataInitializer,
+    string BaseManifest);
+internal sealed record ProjectProfile(
+    string Name,
+    bool Enabled,
+    string? CodePul,
+    string? ModRoot,
+    string? Region,
+    uint? ModuleGuestBase,
+    uint? ModuleLinkBase,
+    string? Output,
+    bool EnableRetroWfc,
+    string? RetroWfcPayload,
+    uint? RetroWfcLegacyBootstrapHook,
+    string? RequiresGameId,
+    string? RequiresDolSha256,
+    ProjectRiivolution? Riivolution);
+internal sealed record ProjectRiivolution(
+    string Xml,
+    IReadOnlyList<ProjectRiivolutionOption> Options);
+internal sealed record ProjectRiivolutionOption(
+    string Section,
+    string Option,
+    uint Choice);
diff --git a/translator/src/Translator.Cli/Translator.Cli.csproj b/translator/src/Translator.Cli/Translator.Cli.csproj
new file mode 100644
index 0000000..d6f98c9
--- /dev/null
+++ b/translator/src/Translator.Cli/Translator.Cli.csproj
@@ -0,0 +1,24 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <ServerGarbageCollection>true</ServerGarbageCollection>
+    <ConcurrentGarbageCollection>true</ConcurrentGarbageCollection>
+    <VersionPrefix>0.5.0</VersionPrefix>
+    <Company>WiiCompiled</Company>
+    <Product>Mario Kart Wii Static Translator</Product>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Translator.Core\Translator.Core.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="YamlDotNet" Version="15.1.2" />
+  </ItemGroup>
+
+</Project>
diff --git a/translator/src/Translator.Core/Analysis/BasicBlocks/BasicBlock.cs b/translator/src/Translator.Core/Analysis/BasicBlocks/BasicBlock.cs
new file mode 100644
index 0000000..f5996d3
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/BasicBlocks/BasicBlock.cs
@@ -0,0 +1,24 @@
+using System.Collections.Generic;
+using Translator.Core.Disassembly;
+
+namespace Translator.Core.Analysis.BasicBlocks;
+
+public sealed class BasicBlock
+{
+    public BasicBlock(uint startAddress, IReadOnlyList<PpcInstruction> instructions)
+    {
+        StartAddress = startAddress;
+        Instructions = instructions;
+        Successors = new List<uint>();
+        Predecessors = new List<uint>();
+    }
+
+    public uint StartAddress { get; }
+    public IReadOnlyList<PpcInstruction> Instructions { get; }
+    public List<uint> Successors { get; }
+    public List<uint> Predecessors { get; }
+
+    public PpcInstruction Terminator => Instructions[^1];
+
+    public override string ToString() => $"BB 0x{StartAddress:X8} (len {Instructions.Count})";
+}
diff --git a/translator/src/Translator.Core/Analysis/BasicBlocks/BasicBlockBuilder.cs b/translator/src/Translator.Core/Analysis/BasicBlocks/BasicBlockBuilder.cs
new file mode 100644
index 0000000..41e8178
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/BasicBlocks/BasicBlockBuilder.cs
@@ -0,0 +1,169 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Disassembly;
+
+namespace Translator.Core.Analysis.BasicBlocks;
+
+/// <summary>
+/// Slices a linear instruction list into basic blocks and wires up successor/predecessor links.
+/// </summary>
+public static class BasicBlockBuilder
+{
+    public static IReadOnlyList<BasicBlock> Build(
+        IReadOnlyList<PpcInstruction> instructions,
+        IEnumerable<uint>? extraLeaders = null)
+    {
+        if (instructions.Count == 0)
+        {
+            return Array.Empty<BasicBlock>();
+        }
+
+        var leaders = new HashSet<uint> { instructions[0].Address };
+        if (extraLeaders is not null)
+        {
+            // Only the requested leaders need a containment structure; building
+            // one over every instruction address was the expensive half.
+            HashSet<uint>? requested = null;
+            foreach (var leader in extraLeaders)
+            {
+                (requested ??= new HashSet<uint>()).Add(leader);
+            }
+
+            if (requested is not null)
+            {
+                foreach (var instruction in instructions)
+                {
+                    if (requested.Contains(instruction.Address))
+                    {
+                        leaders.Add(instruction.Address);
+                    }
+                }
+            }
+        }
+
+        for (var i = 0; i < instructions.Count; i++)
+        {
+            var ins = instructions[i];
+            if (i > 0)
+            {
+                var previous = instructions[i - 1];
+                if (previous.IsReturn ||
+                    previous.IsUnconditionalBranch ||
+                    previous.EndAddress != ins.Address)
+                {
+                    leaders.Add(ins.Address);
+                }
+            }
+
+            if (ins.IsConditionalBranch)
+            {
+                foreach (var target in ins.BranchTargets)
+                {
+                    leaders.Add(target);
+                }
+
+                leaders.Add(ins.EndAddress); // fallthrough
+            }
+            else if (ins.IsUnconditionalBranch)
+            {
+                foreach (var target in ins.BranchTargets)
+                {
+                    leaders.Add(target);
+                }
+            }
+        }
+
+        var sortedLeaders = new uint[leaders.Count];
+        leaders.CopyTo(sortedLeaders);
+        Array.Sort(sortedLeaders);
+
+        // One pass over the instructions instead of a full rescan per leader.
+        // Each instruction lands in the block of the greatest leader that is not
+        // above it, which is exactly the half-open range the old filter used.
+        var buckets = new List<PpcInstruction>?[sortedLeaders.Length];
+        foreach (var instruction in instructions)
+        {
+            var address = instruction.Address;
+            var index = Array.BinarySearch(sortedLeaders, address);
+            if (index < 0)
+            {
+                index = ~index - 1;
+            }
+
+            if (index < 0)
+            {
+                continue;
+            }
+
+            // The final block's exclusive end was uint.MaxValue.
+            if (index == sortedLeaders.Length - 1 && address == uint.MaxValue)
+            {
+                continue;
+            }
+
+            (buckets[index] ??= new List<PpcInstruction>()).Add(instruction);
+        }
+
+        var blocks = new List<BasicBlock>();
+        for (var i = 0; i < sortedLeaders.Length; i++)
+        {
+            var blockInstructions = buckets[i];
+            if (blockInstructions is null || blockInstructions.Count == 0)
+            {
+                continue;
+            }
+
+            var block = new BasicBlock(sortedLeaders[i], blockInstructions);
+            blocks.Add(block);
+        }
+
+        // Wire successors/predecessors.
+        var lookup = blocks.ToDictionary(b => b.StartAddress, b => b);
+        foreach (var block in blocks)
+        {
+            var term = block.Terminator;
+            if (term.IsConditionalBranch)
+            {
+                foreach (var target in term.BranchTargets)
+                {
+                    AddEdge(block, lookup, target);
+                }
+
+                AddEdge(block, lookup, term.EndAddress);
+            }
+            else if (term.IsUnconditionalBranch || term.IsCall)
+            {
+                foreach (var target in term.BranchTargets)
+                {
+                    AddEdge(block, lookup, target);
+                }
+            }
+            else if (!term.IsReturn)
+            {
+                // Fallthrough
+                AddEdge(block, lookup, term.EndAddress);
+            }
+        }
+
+        return blocks;
+    }
+
+    private static void AddEdge(BasicBlock from, IDictionary<uint, BasicBlock> lookup, uint toAddress)
+    {
+        if (!lookup.TryGetValue(toAddress, out var to))
+        {
+            return;
+        }
+
+        if (!from.Successors.Contains(toAddress))
+        {
+            from.Successors.Add(toAddress);
+        }
+
+        if (!to.Predecessors.Contains(from.StartAddress))
+        {
+            to.Predecessors.Add(from.StartAddress);
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/Analysis/GuestAbiContractAnalyzer.cs b/translator/src/Translator.Core/Analysis/GuestAbiContractAnalyzer.cs
new file mode 100644
index 0000000..991bd04
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/GuestAbiContractAnalyzer.cs
@@ -0,0 +1,569 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Analysis;
+
+[Flags]
+public enum GuestCallBoundaryFlags
+{
+    None = 0,
+    RequiresCompleteContext = 1 << 0,
+    CanSuspend = 1 << 1,
+    CanSwitchThreads = 1 << 2,
+    InvokesGuestCode = 1 << 3
+}
+
+public sealed record GuestAbiContract(
+    uint GprReadBeforeWriteMask,
+    uint GprPossibleWriteMask,
+    uint GprReturnMask,
+    uint FprReadBeforeWriteMask,
+    uint FprPossibleWriteMask,
+    uint FprReturnMask,
+    byte CrReadBeforeWriteMask,
+    byte CrPossibleWriteMask,
+    bool ReadsXerBeforeWrite,
+    bool MayWriteXer,
+    bool ReadsCtrBeforeWrite,
+    bool MayWriteCtr,
+    bool ReadsLrBeforeWrite,
+    bool MayWriteLr,
+    GuestCallBoundaryFlags BoundaryFlags,
+    IReadOnlyList<uint> DirectCallTargets)
+{
+    public bool ReadsFpscrBeforeWrite { get; init; }
+    public bool MayWriteFpscr { get; init; }
+    public byte GqrReadBeforeWriteMask { get; init; }
+    public byte GqrPossibleWriteMask { get; init; }
+    public byte HidReadBeforeWriteMask { get; init; }
+    public byte HidPossibleWriteMask { get; init; }
+    public uint GprDefiniteWriteMask { get; init; }
+    public uint FprDefiniteWriteMask { get; init; }
+    public byte CrDefiniteWriteMask { get; init; }
+    public bool DefinitelyWritesXer { get; init; }
+    public bool DefinitelyWritesCtr { get; init; }
+    public bool DefinitelyWritesLr { get; init; }
+    public bool DefinitelyWritesFpscr { get; init; }
+    public byte GqrDefiniteWriteMask { get; init; }
+    public byte HidDefiniteWriteMask { get; init; }
+
+    public bool HasFullSynchronizationFence =>
+        (BoundaryFlags & GuestCallBoundaryFlags.RequiresCompleteContext) != 0;
+}
+
+public static class GuestAbiContractAnalyzer
+{
+    private readonly record struct RegisterSet(
+        uint Gpr, uint Fpr, byte Cr, bool Xer, bool Ctr, bool Lr, bool Fpscr, byte Gqr, byte Hid)
+    {
+        public static RegisterSet Empty => default;
+        public RegisterSet Union(RegisterSet other) =>
+            new(Gpr | other.Gpr, Fpr | other.Fpr, (byte)(Cr | other.Cr),
+                Xer || other.Xer, Ctr || other.Ctr, Lr || other.Lr,
+                Fpscr || other.Fpscr, (byte)(Gqr | other.Gqr), (byte)(Hid | other.Hid));
+        public RegisterSet Intersect(RegisterSet other) =>
+            new(Gpr & other.Gpr, Fpr & other.Fpr, (byte)(Cr & other.Cr),
+                Xer && other.Xer, Ctr && other.Ctr, Lr && other.Lr,
+                Fpscr && other.Fpscr, (byte)(Gqr & other.Gqr), (byte)(Hid & other.Hid));
+        public RegisterSet Except(RegisterSet other) =>
+            new(Gpr & ~other.Gpr, Fpr & ~other.Fpr, (byte)(Cr & ~other.Cr),
+                Xer && !other.Xer, Ctr && !other.Ctr, Lr && !other.Lr,
+                Fpscr && !other.Fpscr, (byte)(Gqr & ~other.Gqr), (byte)(Hid & ~other.Hid));
+    }
+
+    public static GuestAbiContract Analyze(
+        IrFunction function,
+        IReadOnlyDictionary<uint, GuestAbiContract>? calleeContracts = null)
+    {
+        // Block labels are replaced by ordinals for the duration of the
+        // analysis: the fixpoint below runs on every function several times per
+        // interprocedural round, and string-keyed dictionaries dominated it.
+        var blockList = function.Blocks;
+        var blockCount = blockList.Count;
+        var ordinals = new Dictionary<string, int>(blockCount, StringComparer.Ordinal);
+        for (var index = 0; index < blockCount; ++index)
+        {
+            ordinals.Add(blockList[index].Label, index);
+        }
+
+        var predecessors = new List<int>[blockCount];
+        for (var index = 0; index < blockCount; ++index) predecessors[index] = new List<int>();
+        for (var index = 0; index < blockCount; ++index)
+        {
+            var successorCount = Successors(blockList[index], out var first, out var second);
+            if (successorCount >= 1 && ordinals.TryGetValue(first, out var firstOrdinal))
+                predecessors[firstOrdinal].Add(index);
+            if (successorCount == 2 && ordinals.TryGetValue(second, out var secondOrdinal))
+                predecessors[secondOrdinal].Add(index);
+        }
+
+        var definiteWritesByBlock = new RegisterSet[blockCount];
+        for (var index = 0; index < blockCount; ++index)
+        {
+            var instructions = blockList[index].Instructions;
+            var set = RegisterSet.Empty;
+            for (var position = 0; position < instructions.Count; ++position)
+            {
+                Writes(instructions[position], calleeContracts, out _, out var definiteWrite);
+                set = set.Union(definiteWrite);
+            }
+            definiteWritesByBlock[index] = set;
+        }
+
+        var definiteIn = new RegisterSet[blockCount];
+        var definiteOut = new RegisterSet[blockCount];
+
+        bool changed;
+        do
+        {
+            changed = false;
+            for (var index = 0; index < blockCount; ++index)
+            {
+                var blockPredecessors = predecessors[index];
+                RegisterSet incoming;
+                if (blockList[index].Label == function.EntryLabel || blockPredecessors.Count == 0)
+                {
+                    incoming = RegisterSet.Empty;
+                }
+                else
+                {
+                    incoming = definiteOut[blockPredecessors[0]];
+                    for (var position = 1; position < blockPredecessors.Count; ++position)
+                        incoming = incoming.Intersect(definiteOut[blockPredecessors[position]]);
+                }
+
+                var outgoing = incoming.Union(definiteWritesByBlock[index]);
+                if (incoming != definiteIn[index] || outgoing != definiteOut[index])
+                {
+                    definiteIn[index] = incoming;
+                    definiteOut[index] = outgoing;
+                    changed = true;
+                }
+            }
+        } while (changed);
+
+        var readBeforeWrite = RegisterSet.Empty;
+        var possibleWrites = RegisterSet.Empty;
+        var directTargets = new SortedSet<uint>();
+        var boundaryFlags = GuestCallBoundaryFlags.None;
+        for (var index = 0; index < blockCount; ++index)
+        {
+            var written = definiteIn[index];
+            var instructions = blockList[index].Instructions;
+            for (var position = 0; position < instructions.Count; ++position)
+            {
+                var instruction = instructions[position];
+                readBeforeWrite = readBeforeWrite.Union(Reads(instruction, calleeContracts).Except(written));
+                Writes(instruction, calleeContracts, out var possibleInstructionWrites, out var definiteInstructionWrites);
+                possibleWrites = possibleWrites.Union(possibleInstructionWrites);
+                written = written.Union(definiteInstructionWrites);
+                if (instruction is IrCall call && GuestTargetParser.TryParseAddress(call.Target, out var target))
+                {
+                    if (!TryGetInlineThunk(target, out _, out _))
+                        directTargets.Add(target);
+                    if (calleeContracts?.TryGetValue(target, out var callee) == true)
+                        boundaryFlags |= callee.BoundaryFlags;
+                }
+                else if (instruction is IrCall helperCall)
+                {
+                    boundaryFlags |= GuestHelperEffectCatalog.Analyze(helperCall).BoundaryFlags;
+                }
+                if (instruction is IrIndirectCall or IrIndirectJump or IrUndefined)
+                {
+                    boundaryFlags |= GuestCallBoundaryFlags.RequiresCompleteContext;
+                }
+            }
+        }
+
+        var definiteWrites = RegisterSet.Empty;
+        var sawExitBlock = false;
+        for (var index = 0; index < blockCount; ++index)
+        {
+            var successorCount = Successors(blockList[index], out var first, out var second);
+            if ((successorCount >= 1 && ordinals.ContainsKey(first)) ||
+                (successorCount == 2 && ordinals.ContainsKey(second)))
+                continue;
+            definiteWrites = sawExitBlock ? definiteWrites.Intersect(definiteOut[index]) : definiteOut[index];
+            sawExitBlock = true;
+        }
+
+        const uint gprReturnMask = (1u << 3) | (1u << 4);
+        const uint fprReturnMask = 1u << 1;
+        return new GuestAbiContract(
+            readBeforeWrite.Gpr,
+            possibleWrites.Gpr,
+            possibleWrites.Gpr & gprReturnMask,
+            readBeforeWrite.Fpr,
+            possibleWrites.Fpr,
+            possibleWrites.Fpr & fprReturnMask,
+            readBeforeWrite.Cr,
+            possibleWrites.Cr,
+            readBeforeWrite.Xer,
+            possibleWrites.Xer,
+            readBeforeWrite.Ctr,
+            possibleWrites.Ctr,
+            readBeforeWrite.Lr,
+            possibleWrites.Lr,
+            boundaryFlags,
+            directTargets.ToArray())
+        {
+            ReadsFpscrBeforeWrite = readBeforeWrite.Fpscr,
+            MayWriteFpscr = possibleWrites.Fpscr,
+            GqrReadBeforeWriteMask = readBeforeWrite.Gqr,
+            GqrPossibleWriteMask = possibleWrites.Gqr,
+            HidReadBeforeWriteMask = readBeforeWrite.Hid,
+            HidPossibleWriteMask = possibleWrites.Hid,
+            GprDefiniteWriteMask = definiteWrites.Gpr,
+            FprDefiniteWriteMask = definiteWrites.Fpr,
+            CrDefiniteWriteMask = definiteWrites.Cr,
+            DefinitelyWritesXer = definiteWrites.Xer,
+            DefinitelyWritesCtr = definiteWrites.Ctr,
+            DefinitelyWritesLr = definiteWrites.Lr,
+            DefinitelyWritesFpscr = definiteWrites.Fpscr,
+            GqrDefiniteWriteMask = definiteWrites.Gqr,
+            HidDefiniteWriteMask = definiteWrites.Hid
+        };
+    }
+
+    /// <summary>
+    /// Successor count (0, 1, or 2) and labels for <paramref name="block"/>; count-plus-out-params
+    /// keeps the CFG walk allocation-free.
+    /// </summary>
+    private static int Successors(IrBasicBlock block, out string first, out string second)
+    {
+        var instructions = block.Instructions;
+        var terminator = instructions.Count == 0 ? null : instructions[instructions.Count - 1];
+        if (terminator is IrBranch branch)
+        {
+            first = branch.TrueLabel;
+            second = branch.FalseLabel;
+            return 2;
+        }
+
+        if (terminator is IrJump jump)
+        {
+            first = jump.TargetLabel;
+            second = string.Empty;
+            return 1;
+        }
+
+        first = string.Empty;
+        second = string.Empty;
+        return 0;
+    }
+
+    private static RegisterSet Reads(
+        IrInstruction instruction,
+        IReadOnlyDictionary<uint, GuestAbiContract>? calleeContracts)
+    {
+        var result = RegisterSet.Empty;
+        switch (instruction)
+        {
+            case IrAssign value: AddValue(ref result, value.Value); break;
+            case IrBinary value: AddValue(ref result, value.Left); AddValue(ref result, value.Right); break;
+            case IrLoad value: Add(ref result, value.Address.Base); break;
+            case IrStore value: Add(ref result, value.Address.Base); AddValue(ref result, value.Source); break;
+            case IrResolveGuestMemoryRange value: AddValue(ref result, value.Base); break;
+            case IrResolvedLoad value: Add(ref result, value.OriginalAddress.Base); break;
+            case IrResolvedStore value: Add(ref result, value.OriginalAddress.Base); AddValue(ref result, value.Source); break;
+            case IrResolvedPsqLoad value:
+                AddValue(ref result, value.OriginalAddress);
+                if (value.KnownGqr is null || value.GuardKnownGqr) AddGqr(ref result, value.I);
+                break;
+            case IrResolvedPsqStore value:
+                AddValue(ref result, value.OriginalAddress); AddValue(ref result, value.Source);
+                if (value.KnownGqr is null || value.GuardKnownGqr) AddGqr(ref result, value.I);
+                break;
+            case IrResolvedLoadPair value:
+                Add(ref result, value.FirstOriginalAddress.Base);
+                Add(ref result, value.SecondOriginalAddress.Base);
+                break;
+            case IrResolvedStorePair value:
+                Add(ref result, value.FirstOriginalAddress.Base);
+                Add(ref result, value.SecondOriginalAddress.Base);
+                AddValue(ref result, value.FirstSource);
+                AddValue(ref result, value.SecondSource);
+                break;
+            case IrCall value:
+                if (GuestTargetParser.TryParseAddress(value.Target, out var directTarget) &&
+                    calleeContracts?.TryGetValue(directTarget, out var callee) == true)
+                {
+                    // A decoded call carries the volatile ABI registers as generic IR arguments;
+                    // once the callee has a contract, only state it actually consumes is a real read.
+                    result = result.Union(ContractReads(callee));
+                }
+                else if (GuestTargetParser.TryParseAddress(value.Target, out var readThunkAddress) &&
+                    TryGetInlineThunk(readThunkAddress, out var readThunk, out var readStart) &&
+                    readThunk is InlineThunkKind.SaveGpr or InlineThunkKind.SaveFpr)
+                {
+                    AddRegisterRangeToTop(ref result, readThunk == InlineThunkKind.SaveGpr, readStart);
+                }
+                else if (!GuestTargetParser.TryParseAddress(value.Target, out _))
+                {
+                    foreach (var argument in value.Arguments) AddValue(ref result, argument);
+                    result = result.Union(HiddenReads(GuestHelperEffectCatalog.Analyze(value)));
+                }
+                else
+                {
+                    // An unresolved direct/native target has no stronger
+                    // contract, so its explicitly modelled ABI arguments remain
+                    // observable inputs.
+                    foreach (var argument in value.Arguments) AddValue(ref result, argument);
+                }
+                break;
+            case IrIndirectCall value:
+                AddValue(ref result, value.Target);
+                foreach (var argument in value.Arguments) AddValue(ref result, argument);
+                result = result.Union(FullState);
+                break;
+            case IrIndirectJump value:
+                AddValue(ref result, value.Target);
+                result = result.Union(FullState);
+                break;
+            case IrSetCrField value:
+                AddValue(ref result, value.Left);
+                AddValue(ref result, value.Right);
+                // Integer comparisons copy XER.SO into the CR field.
+                result = result with { Xer = true };
+                break;
+            case IrPhi value: foreach (var source in value.Sources.Values) Add(ref result, source); break;
+            case IrBranch value:
+                Add(ref result, value.ConditionRegister);
+                result = result.Union(SpecialRegistersInRawExpression(value.ConditionRegister));
+                break;
+            case IrJumpTable value: Add(ref result, value.Selector); break;
+            case IrReturn { Value: { } value }: AddValue(ref result, value); break;
+        }
+        return result;
+    }
+
+    /// <summary>
+    /// Classifies both write flavours of an instruction in one pass: <paramref name="definite"/> is
+    /// guaranteed, <paramref name="possible"/> is what it may write. Only call cases differ.
+    /// </summary>
+    private static void Writes(
+        IrInstruction instruction,
+        IReadOnlyDictionary<uint, GuestAbiContract>? calleeContracts,
+        out RegisterSet possible,
+        out RegisterSet definite)
+    {
+        var shared = RegisterSet.Empty;
+        var possibleOnly = RegisterSet.Empty;
+        var definiteOnly = RegisterSet.Empty;
+        switch (instruction)
+        {
+            case IrAssign value: Add(ref shared, value.Destination); break;
+            case IrBinary value: Add(ref shared, value.Destination); break;
+            case IrLoad value: Add(ref shared, value.Destination); break;
+            case IrResolveGuestMemoryRange value: Add(ref shared, value.Destination); break;
+            case IrResolvedLoad value: Add(ref shared, value.Destination); break;
+            case IrResolvedPsqLoad value: Add(ref shared, value.Destination); break;
+            case IrResolvedLoadPair value:
+                Add(ref shared, value.FirstDestination);
+                Add(ref shared, value.SecondDestination);
+                break;
+            case IrCall value:
+                var helperEffect = !GuestTargetParser.TryParseAddress(value.Target, out _)
+                    ? GuestHelperEffectCatalog.Analyze(value)
+                    : null;
+                var destination = Register(value.Destination);
+                // CR helpers return the complete packed CR only because that is
+                // the runtime helper ABI. Architecturally they change the fields
+                // described by the helper contract, not all eight fields.
+                if (!(destination.Cr == byte.MaxValue && helperEffect?.CrWriteMask != 0))
+                    shared = shared.Union(destination);
+                if (GuestTargetParser.TryParseAddress(value.Target, out var directTarget) &&
+                    calleeContracts?.TryGetValue(directTarget, out var callee) == true)
+                {
+                    possibleOnly = ContractWrites(callee);
+                    definiteOnly = ContractDefiniteWrites(callee);
+                }
+                else if (GuestTargetParser.TryParseAddress(value.Target, out var writeThunkAddress) &&
+                    TryGetInlineThunk(writeThunkAddress, out var writeThunk, out var writeStart) &&
+                    writeThunk is InlineThunkKind.RestGpr or InlineThunkKind.RestFpr)
+                {
+                    AddRegisterRangeToTop(ref shared, writeThunk == InlineThunkKind.RestGpr, writeStart);
+                }
+                else if (helperEffect is not null)
+                {
+                    // Hidden helper state is a possible write only: the definite
+                    // flavour deliberately ignores non-guest call targets.
+                    possibleOnly = HiddenWrites(helperEffect);
+                }
+                break;
+            case IrIndirectCall value:
+                Add(ref shared, value.Destination);
+                shared = shared.Union(FullState);
+                break;
+            case IrSetCrField value:
+                shared = shared with { Cr = (byte)(shared.Cr | (1 << value.FieldIndex)) };
+                break;
+            case IrPhi value: Add(ref shared, value.Destination); break;
+            case IrUndefined:
+                shared = FullState;
+                break;
+        }
+
+        possible = shared.Union(possibleOnly);
+        definite = shared.Union(definiteOnly);
+    }
+
+    /// <summary>
+    /// Unions <c>rN..r31</c> or <c>fN..f31</c>, the register window an inline
+    /// save/restore thunk touches.
+    /// </summary>
+    private static void AddRegisterRangeToTop(ref RegisterSet set, bool general, int startRegister)
+    {
+        var mask = uint.MaxValue << startRegister;
+        set = general
+            ? set with { Gpr = set.Gpr | mask }
+            : set with { Fpr = set.Fpr | mask };
+    }
+
+    private static void Add(ref RegisterSet set, string? name) => set = set.Union(Register(name));
+
+    private static void AddValue(ref RegisterSet set, IrValue value)
+    {
+        if (value.Kind == "register") Add(ref set, value.RegisterName);
+    }
+
+    private static void AddGqr(ref RegisterSet set, uint index)
+    {
+        // Mirrors Register("gqr{index}"): only the eight architectural
+        // quantization registers exist, anything else names nothing.
+        if (index <= 7) set = set with { Gqr = (byte)(set.Gqr | (1 << (int)index)) };
+    }
+
+    private static RegisterSet HiddenReads(GuestHelperEffect effect) =>
+        new(effect.GprReadMask, effect.FprReadMask, effect.CrReadMask,
+            effect.ReadsXer, effect.ReadsCtr, effect.ReadsLr, false, 0, 0);
+
+    private static RegisterSet HiddenWrites(GuestHelperEffect effect) =>
+        new(effect.GprWriteMask, effect.FprWriteMask, effect.CrWriteMask,
+            effect.WritesXer, effect.WritesCtr, effect.WritesLr, false, 0, 0);
+
+    private static RegisterSet ContractReads(GuestAbiContract contract) =>
+        new(contract.GprReadBeforeWriteMask, contract.FprReadBeforeWriteMask,
+            contract.CrReadBeforeWriteMask, contract.ReadsXerBeforeWrite,
+            contract.ReadsCtrBeforeWrite, contract.ReadsLrBeforeWrite,
+            contract.ReadsFpscrBeforeWrite, contract.GqrReadBeforeWriteMask,
+            contract.HidReadBeforeWriteMask);
+
+    private static RegisterSet ContractWrites(GuestAbiContract contract) =>
+        new(contract.GprPossibleWriteMask, contract.FprPossibleWriteMask,
+            contract.CrPossibleWriteMask, contract.MayWriteXer,
+            contract.MayWriteCtr, contract.MayWriteLr,
+            contract.MayWriteFpscr, contract.GqrPossibleWriteMask,
+            contract.HidPossibleWriteMask);
+
+    private static RegisterSet ContractDefiniteWrites(GuestAbiContract contract) =>
+        new(contract.GprDefiniteWriteMask, contract.FprDefiniteWriteMask,
+            contract.CrDefiniteWriteMask, contract.DefinitelyWritesXer,
+            contract.DefinitelyWritesCtr, contract.DefinitelyWritesLr,
+            contract.DefinitelyWritesFpscr, contract.GqrDefiniteWriteMask,
+            contract.HidDefiniteWriteMask);
+
+    private static RegisterSet FullState =>
+        new(uint.MaxValue, uint.MaxValue, byte.MaxValue, true, true, true, true, byte.MaxValue, byte.MaxValue);
+
+    private static RegisterSet Register(string? name)
+    {
+        if (string.IsNullOrWhiteSpace(name)) return RegisterSet.Empty;
+        // Classification runs on a span: an SSA name such as "r3_12" used to
+        // cost two substrings and a LINQ digit scan before anything was decided.
+        var baseName = SsaBaseName(name.AsSpan());
+        if (baseName.Length >= 2 && baseName[0] == 'r' && int.TryParse(baseName[1..], out var gpr) && gpr is >= 0 and < 32)
+            return RegisterSet.Empty with { Gpr = 1u << gpr };
+        if (baseName.Length >= 2 && baseName[0] == 'f' && int.TryParse(baseName[1..], out var fpr) && fpr is >= 0 and < 32)
+            return RegisterSet.Empty with { Fpr = 1u << fpr };
+        if (baseName.Length == 3 && baseName.StartsWith("cr", StringComparison.OrdinalIgnoreCase) &&
+            baseName[2] is >= '0' and <= '7')
+            return RegisterSet.Empty with { Cr = (byte)(1 << (baseName[2] - '0')) };
+        if (baseName.Length is >= 4 and <= 5 && baseName.StartsWith("crb", StringComparison.OrdinalIgnoreCase) &&
+            int.TryParse(baseName[3..], out var crBit) && crBit is >= 0 and < 32)
+            return RegisterSet.Empty with { Cr = (byte)(1 << (crBit / 4)) };
+        if (baseName.Equals("cr", StringComparison.OrdinalIgnoreCase))
+            return RegisterSet.Empty with { Cr = byte.MaxValue };
+        if (baseName.Equals("xer", StringComparison.OrdinalIgnoreCase))
+            return RegisterSet.Empty with { Xer = true };
+        if (baseName.Equals("ctr", StringComparison.OrdinalIgnoreCase))
+            return RegisterSet.Empty with { Ctr = true };
+        if (baseName.Equals("lr", StringComparison.OrdinalIgnoreCase))
+            return RegisterSet.Empty with { Lr = true };
+        if (baseName.Equals("fpscr", StringComparison.OrdinalIgnoreCase))
+            return RegisterSet.Empty with { Fpscr = true };
+        if (baseName.Length == 4 && baseName.StartsWith("gqr", StringComparison.OrdinalIgnoreCase) &&
+            baseName[3] is >= '0' and <= '7')
+            return RegisterSet.Empty with { Gqr = (byte)(1 << (baseName[3] - '0')) };
+        if (baseName.Length == 4 && baseName.StartsWith("hid", StringComparison.OrdinalIgnoreCase) &&
+            baseName[3] is >= '0' and <= '2')
+            return RegisterSet.Empty with { Hid = (byte)(1 << (baseName[3] - '0')) };
+        return RegisterSet.Empty;
+    }
+
+    /// <summary>
+    /// Drops a trailing SSA version suffix: everything after the first
+    /// underscore is removed when it consists solely of digits.
+    /// </summary>
+    private static ReadOnlySpan<char> SsaBaseName(ReadOnlySpan<char> name)
+    {
+        var underscore = name.IndexOf('_');
+        if (underscore <= 0) return name;
+        for (var index = underscore + 1; index < name.Length; ++index)
+        {
+            if (!char.IsDigit(name[index])) return name;
+        }
+
+        return name[..underscore];
+    }
+
+    private static RegisterSet SpecialRegistersInRawExpression(string expression) =>
+        new(
+            0,
+            0,
+            expression.Contains("ctx->cr", StringComparison.Ordinal) ||
+            expression.Contains("GetCRBit(ctx", StringComparison.Ordinal) ? byte.MaxValue : (byte)0,
+            expression.Contains("ctx->xer", StringComparison.Ordinal),
+            expression.Contains("ctx->ctr", StringComparison.Ordinal),
+            expression.Contains("ctx->lr", StringComparison.Ordinal),
+            expression.Contains("ctx->fpscr", StringComparison.Ordinal),
+            0,
+            (byte)((expression.Contains("ctx->hid0", StringComparison.Ordinal) ? 1 : 0) |
+                   (expression.Contains("ctx->hid1", StringComparison.Ordinal) ? 2 : 0) |
+                   (expression.Contains("ctx->hid2", StringComparison.Ordinal) ? 4 : 0)));
+
+    private enum InlineThunkKind { SaveGpr, RestGpr, SaveFpr, RestFpr }
+
+    private static bool TryGetInlineThunk(uint address, out InlineThunkKind kind, out int startRegister)
+    {
+        var thunks = GuestSaveRestoreThunks.Current;
+        if (TryRange(address, thunks.SaveGpr, out startRegister)) { kind = InlineThunkKind.SaveGpr; return true; }
+        if (TryRange(address, thunks.RestGpr, out startRegister)) { kind = InlineThunkKind.RestGpr; return true; }
+        if (TryRange(address, thunks.SaveFpr, out startRegister)) { kind = InlineThunkKind.SaveFpr; return true; }
+        if (TryRange(address, thunks.RestFpr, out startRegister)) { kind = InlineThunkKind.RestFpr; return true; }
+        kind = default;
+        startRegister = -1;
+        return false;
+
+        static bool TryRange(uint candidate, GuestSaveRestoreThunkRange? range, out int start)
+        {
+            if (range is null)
+            {
+                start = -1;
+                return false;
+            }
+
+            var (baseAddress, firstRegister, lastStartRegister) = range;
+            var lastAddress = baseAddress + checked((uint)((lastStartRegister - firstRegister) * 4));
+            if (candidate < baseAddress || candidate > lastAddress || ((candidate - baseAddress) & 3u) != 0)
+            {
+                start = -1;
+                return false;
+            }
+            start = firstRegister + checked((int)((candidate - baseAddress) / 4));
+            return true;
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/Analysis/GuestAbiInterproceduralAnalyzer.cs b/translator/src/Translator.Core/Analysis/GuestAbiInterproceduralAnalyzer.cs
new file mode 100644
index 0000000..f6817d3
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/GuestAbiInterproceduralAnalyzer.cs
@@ -0,0 +1,263 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Analysis;
+
+public sealed record GuestAbiInterproceduralResult(
+    IReadOnlyDictionary<uint, GuestAbiContract> Contracts,
+    IReadOnlyList<IReadOnlyList<uint>> StronglyConnectedComponents);
+
+/// <summary>
+/// Computes architectural effects in guest execution order, so a callee read is suppressed once
+/// the caller already defined that register, unlike a transitive union of descendant masks.
+/// </summary>
+public static class GuestAbiInterproceduralAnalyzer
+{
+    public static GuestAbiInterproceduralResult Analyze(
+        IReadOnlyDictionary<uint, IrFunction> functions,
+        IReadOnlyDictionary<uint, GuestAbiContract>? externalContracts = null)
+    {
+        externalContracts ??= new Dictionary<uint, GuestAbiContract>();
+        var addresses = functions.Keys.OrderBy(static address => address).ToArray();
+
+        // GuestAbiContractAnalyzer.Analyze is pure and the round's contract snapshot is frozen, so
+        // per-function analyses within a round can run on any thread. Determinism comes from
+        // applying results serially in ascending-ordinal order, matching the old single-threaded loop.
+        var parallelOptions = new ParallelOptions { MaxDegreeOfParallelism = Environment.ProcessorCount };
+
+        // Resolving the IR by ordinal once keeps the caller-supplied dictionary
+        // off every parallel path: only this loop and BuildComponents touch it.
+        var bodies = new IrFunction[addresses.Length];
+        for (var index = 0; index < addresses.Length; ++index) bodies[index] = functions[addresses[index]];
+
+        // Mirror of `contracts` keyed by ordinal.  The fixpoint compares against
+        // it from the parallel phase, where the dictionary must stay untouched.
+        var current = new GuestAbiContract[addresses.Length];
+        Parallel.For(
+            0,
+            addresses.Length,
+            parallelOptions,
+            index => current[index] = GuestAbiContractAnalyzer.Analyze(bodies[index]));
+
+        var contracts = new Dictionary<uint, GuestAbiContract>(addresses.Length);
+        for (var index = 0; index < addresses.Length; ++index) contracts.Add(addresses[index], current[index]);
+
+        var ordinals = new Dictionary<uint, int>(addresses.Length);
+        for (var index = 0; index < addresses.Length; ++index) ordinals.Add(addresses[index], index);
+
+        // Callers of each function. A function whose callees all kept their contracts reproduces
+        // the same contract and can be skipped for the round; that's the only liberty taken, since
+        // rounds still see a snapshot fixed at round start, preserving the original fixed point.
+        // The edge scan itself is a read-only IR walk, collected in parallel per ordinal then
+        // stitched serially in ascending caller order to match the single-threaded result.
+        var directCallees = new int[addresses.Length][];
+        Parallel.For(
+            0,
+            addresses.Length,
+            parallelOptions,
+            static () => new HashSet<int>(),
+            (index, _, scratch) =>
+            {
+                scratch.Clear();
+                CollectDirectCallees(bodies[index], ordinals, scratch);
+                directCallees[index] = scratch.ToArray();
+                return scratch;
+            },
+            static _ => { });
+
+        var callers = new List<int>?[addresses.Length];
+        for (var index = 0; index < addresses.Length; ++index)
+        {
+            foreach (var callee in directCallees[index]) (callers[callee] ??= new List<int>()).Add(index);
+        }
+
+        var visible = new Dictionary<uint, GuestAbiContract>(externalContracts);
+        foreach (var (address, contract) in contracts) visible[address] = contract;
+
+        var pending = new bool[addresses.Length];
+        var nextRound = new bool[addresses.Length];
+        Array.Fill(pending, true);
+        // Ascending ordinals of the functions this round re-analyzes, plus the
+        // slot each one writes its result into.  Both are reused every round.
+        var worklist = new int[addresses.Length];
+        var roundResults = new GuestAbiContract?[addresses.Length];
+        while (true)
+        {
+            var worklistCount = 0;
+            for (var index = 0; index < addresses.Length; ++index)
+            {
+                if (pending[index]) worklist[worklistCount++] = index;
+            }
+
+            Parallel.For(0, worklistCount, parallelOptions, position =>
+            {
+                var ordinal = worklist[position];
+                var next = GuestAbiContractAnalyzer.Analyze(bodies[ordinal], visible);
+                roundResults[position] = Equivalent(current[ordinal], next) ? null : next;
+            });
+
+            Array.Clear(nextRound);
+            var updated = false;
+            for (var position = 0; position < worklistCount; ++position)
+            {
+                var contract = roundResults[position];
+                if (contract is null) continue;
+                updated = true;
+                var ordinal = worklist[position];
+                var address = addresses[ordinal];
+                current[ordinal] = contract;
+                contracts[address] = contract;
+                visible[address] = contract;
+                var callerList = callers[ordinal];
+                if (callerList is null) continue;
+                foreach (var caller in callerList) nextRound[caller] = true;
+            }
+
+            if (!updated) break;
+
+            (pending, nextRound) = (nextRound, pending);
+        }
+
+        return new GuestAbiInterproceduralResult(contracts, BuildComponents(functions, contracts));
+    }
+
+    /// <summary>
+    /// Ordinals of functions this one calls directly, from raw IR rather than
+    /// <see cref="GuestAbiContract.DirectCallTargets"/>, which omits inline save/restore thunks
+    /// that the analyzer still consults when they happen to have a contract.
+    /// </summary>
+    private static void CollectDirectCallees(
+        IrFunction function,
+        Dictionary<uint, int> ordinals,
+        HashSet<int> result)
+    {
+        foreach (var block in function.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                if (instruction is IrCall call &&
+                    GuestTargetParser.TryParseAddress(call.Target, out var target) &&
+                    ordinals.TryGetValue(target, out var ordinal))
+                {
+                    result.Add(ordinal);
+                }
+            }
+        }
+    }
+
+    private static bool Equivalent(GuestAbiContract left, GuestAbiContract right) =>
+        left.GprReadBeforeWriteMask == right.GprReadBeforeWriteMask &&
+        left.GprPossibleWriteMask == right.GprPossibleWriteMask &&
+        left.GprReturnMask == right.GprReturnMask &&
+        left.FprReadBeforeWriteMask == right.FprReadBeforeWriteMask &&
+        left.FprPossibleWriteMask == right.FprPossibleWriteMask &&
+        left.FprReturnMask == right.FprReturnMask &&
+        left.CrReadBeforeWriteMask == right.CrReadBeforeWriteMask &&
+        left.CrPossibleWriteMask == right.CrPossibleWriteMask &&
+        left.ReadsXerBeforeWrite == right.ReadsXerBeforeWrite &&
+        left.MayWriteXer == right.MayWriteXer &&
+        left.ReadsCtrBeforeWrite == right.ReadsCtrBeforeWrite &&
+        left.MayWriteCtr == right.MayWriteCtr &&
+        left.ReadsLrBeforeWrite == right.ReadsLrBeforeWrite &&
+        left.MayWriteLr == right.MayWriteLr &&
+        left.ReadsFpscrBeforeWrite == right.ReadsFpscrBeforeWrite &&
+        left.MayWriteFpscr == right.MayWriteFpscr &&
+        left.GqrReadBeforeWriteMask == right.GqrReadBeforeWriteMask &&
+        left.GqrPossibleWriteMask == right.GqrPossibleWriteMask &&
+        left.HidReadBeforeWriteMask == right.HidReadBeforeWriteMask &&
+        left.HidPossibleWriteMask == right.HidPossibleWriteMask &&
+        left.GprDefiniteWriteMask == right.GprDefiniteWriteMask &&
+        left.FprDefiniteWriteMask == right.FprDefiniteWriteMask &&
+        left.CrDefiniteWriteMask == right.CrDefiniteWriteMask &&
+        left.DefinitelyWritesXer == right.DefinitelyWritesXer &&
+        left.DefinitelyWritesCtr == right.DefinitelyWritesCtr &&
+        left.DefinitelyWritesLr == right.DefinitelyWritesLr &&
+        left.DefinitelyWritesFpscr == right.DefinitelyWritesFpscr &&
+        left.GqrDefiniteWriteMask == right.GqrDefiniteWriteMask &&
+        left.HidDefiniteWriteMask == right.HidDefiniteWriteMask &&
+        left.BoundaryFlags == right.BoundaryFlags &&
+        SameTargets(left.DirectCallTargets, right.DirectCallTargets);
+
+    private static bool SameTargets(IReadOnlyList<uint> left, IReadOnlyList<uint> right)
+    {
+        if (ReferenceEquals(left, right)) return true;
+        if (left.Count != right.Count) return false;
+        for (var index = 0; index < left.Count; ++index)
+        {
+            if (left[index] != right[index]) return false;
+        }
+
+        return true;
+    }
+
+    private static IReadOnlyList<IReadOnlyList<uint>> BuildComponents(
+        IReadOnlyDictionary<uint, IrFunction> functions,
+        IReadOnlyDictionary<uint, GuestAbiContract> contracts)
+    {
+        // Iterative Kosaraju, not recursive Tarjan: production titles have call chains deep enough
+        // to exhaust the native .NET stack before a recursive Tarjan discovers a component.
+        var addresses = functions.Keys.OrderBy(static address => address).ToArray();
+        var adjacency = new Dictionary<uint, uint[]>(addresses.Length);
+        var reverse = addresses.ToDictionary(static address => address, static _ => new List<uint>());
+        foreach (var address in addresses)
+        {
+            var targets = contracts[address].DirectCallTargets
+                .Where(functions.ContainsKey)
+                .Distinct()
+                .OrderBy(static target => target)
+                .ToArray();
+            adjacency[address] = targets;
+            foreach (var target in targets) reverse[target].Add(address);
+        }
+
+        var visited = new HashSet<uint>();
+        var finishOrder = new List<uint>(addresses.Length);
+        foreach (var root in addresses)
+        {
+            if (!visited.Add(root)) continue;
+            var traversal = new Stack<(uint Address, int NextTarget)>();
+            traversal.Push((root, 0));
+            while (traversal.Count != 0)
+            {
+                var (address, nextTarget) = traversal.Pop();
+                var targets = adjacency[address];
+                if (nextTarget < targets.Length)
+                {
+                    traversal.Push((address, nextTarget + 1));
+                    var target = targets[nextTarget];
+                    if (visited.Add(target)) traversal.Push((target, 0));
+                    continue;
+                }
+
+                finishOrder.Add(address);
+            }
+        }
+
+        visited.Clear();
+        var result = new List<IReadOnlyList<uint>>();
+        for (var orderIndex = finishOrder.Count - 1; orderIndex >= 0; --orderIndex)
+        {
+            var root = finishOrder[orderIndex];
+            if (!visited.Add(root)) continue;
+            var component = new List<uint>();
+            var traversal = new Stack<uint>();
+            traversal.Push(root);
+            while (traversal.Count != 0)
+            {
+                var address = traversal.Pop();
+                component.Add(address);
+                foreach (var caller in reverse[address])
+                    if (visited.Add(caller)) traversal.Push(caller);
+            }
+
+            component.Sort();
+            result.Add(component);
+        }
+
+        result.Sort(static (left, right) => left[0].CompareTo(right[0]));
+        return result;
+    }
+}
diff --git a/translator/src/Translator.Core/Analysis/GuestFlagLivenessAnalyzer.cs b/translator/src/Translator.Core/Analysis/GuestFlagLivenessAnalyzer.cs
new file mode 100644
index 0000000..1a55f33
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/GuestFlagLivenessAnalyzer.cs
@@ -0,0 +1,306 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Analysis;
+
+/// <summary>
+/// The eight CR fields and the XER carry bit, tracked separately from <see cref="GuestStateMask"/> for
+/// sub-register granularity. Compare and carry read/modify/write helpers touch XER only to preserve
+/// bits they don't own, so that must not count as a carry read or every carry update would look live.
+/// </summary>
+public readonly record struct GuestFlagState(byte CrFields, bool Carry)
+{
+    public static GuestFlagState None => default;
+
+    /// <summary>Everything live. The conservative answer for any unknown boundary.</summary>
+    public static GuestFlagState All => new(byte.MaxValue, true);
+
+    public GuestFlagState Union(GuestFlagState other) =>
+        new((byte)(CrFields | other.CrFields), Carry || other.Carry);
+
+    public GuestFlagState Except(GuestFlagState other) =>
+        new((byte)(CrFields & ~other.CrFields), Carry && !other.Carry);
+
+    public bool HasCrField(int field) => (CrFields & (1 << field)) != 0;
+
+    public static GuestFlagState Cr(byte fields) => new(fields, false);
+
+    public static GuestFlagState CrField(int field) => new((byte)(1 << field), false);
+
+    public static GuestFlagState CarryOnly => new(0, true);
+}
+
+/// <summary>
+/// What the flag liveness transfer needs at a call site. A target missing from
+/// <see cref="CalleeContracts"/>, or listed in <see cref="OpaqueCallTargets"/> (a mod may replace
+/// it, so the published contract may not match what actually runs), is a complete flag boundary.
+/// </summary>
+public sealed record GuestFlagLivenessContext(
+    IReadOnlyDictionary<uint, GuestAbiContract> CalleeContracts,
+    IReadOnlySet<uint> OpaqueCallTargets)
+{
+    public static GuestFlagLivenessContext Empty { get; } = new(
+        new Dictionary<uint, GuestAbiContract>(), new HashSet<uint>());
+}
+
+public sealed record GuestFlagLivenessResult(
+    IReadOnlyDictionary<string, GuestFlagState> LiveIn,
+    IReadOnlyDictionary<string, GuestFlagState> LiveOut);
+
+/// <summary>
+/// Backward per-CR-field and XER.CA liveness over the emitted IR. Reads are collected aggressively
+/// while kills are limited to provably total writes (<see cref="IrSetCrField"/>, a full <c>xer</c>
+/// def), so a call never kills and a callee that may rewrite a flag can't erase a caller-side update.
+/// </summary>
+public static class GuestFlagLivenessAnalyzer
+{
+    /// <summary>
+    /// Helpers whose only carry effect is overwriting XER.CA; the surrounding-bit read to
+    /// preserve them doesn't count as a carry read.
+    /// </summary>
+    private static readonly HashSet<string> CarryProducingHelpers = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "PPC_UpdateCarryAdd", "PPC_UpdateCarrySub", "PPC_UpdateCarryShiftRight"
+    };
+
+    private static readonly Regex GetCrBitRegex = new(
+        @"GetCRBit\(\s*ctx\s*,\s*(?<field>\d+)\s*,\s*(?<bit>\d+)\s*\)",
+        RegexOptions.Compiled | RegexOptions.CultureInvariant);
+
+    public static bool IsCarryProducingHelper(string target) => CarryProducingHelpers.Contains(target);
+
+    public static GuestFlagLivenessResult Analyze(
+        IrFunction function,
+        IrCfg cfg,
+        GuestFlagLivenessContext context,
+        GuestFlagState exitLive)
+    {
+        var liveIn = function.Blocks.ToDictionary(
+            block => block.Label, _ => GuestFlagState.None, StringComparer.OrdinalIgnoreCase);
+        var liveOut = function.Blocks.ToDictionary(
+            block => block.Label, _ => GuestFlagState.None, StringComparer.OrdinalIgnoreCase);
+
+        bool changed;
+        do
+        {
+            changed = false;
+            for (var blockIndex = function.Blocks.Count - 1; blockIndex >= 0; --blockIndex)
+            {
+                var block = function.Blocks[blockIndex];
+                var successors = cfg.Successors(block.Label);
+                var outgoing = exitLive;
+                if (successors.Count != 0)
+                {
+                    outgoing = GuestFlagState.None;
+                    for (var successorIndex = 0; successorIndex < successors.Count; ++successorIndex)
+                    {
+                        outgoing = outgoing.Union(
+                            liveIn.TryGetValue(successors[successorIndex], out var successorIn)
+                                ? successorIn
+                                : exitLive);
+                    }
+                }
+
+                var incoming = outgoing;
+                for (var index = block.Instructions.Count - 1; index >= 0; --index)
+                {
+                    incoming = Transfer(block.Instructions[index], incoming, context);
+                }
+
+                if (outgoing != liveOut[block.Label] || incoming != liveIn[block.Label])
+                {
+                    liveOut[block.Label] = outgoing;
+                    liveIn[block.Label] = incoming;
+                    changed = true;
+                }
+            }
+        } while (changed);
+
+        return new GuestFlagLivenessResult(liveIn, liveOut);
+    }
+
+    /// <summary>
+    /// Backward transfer for one instruction: <c>(live \ kills) ∪ reads</c>.
+    /// </summary>
+    public static GuestFlagState Transfer(
+        IrInstruction instruction,
+        GuestFlagState live,
+        GuestFlagLivenessContext context) =>
+        live.Except(Kills(instruction)).Union(Reads(instruction, context));
+
+    public static GuestFlagState Kills(IrInstruction instruction)
+    {
+        if (instruction is IrSetCrField setCr)
+        {
+            return GuestFlagState.CrField(setCr.FieldIndex & 7);
+        }
+
+        // A definition of the whole XER register replaces the carry bit. That
+        // covers mtxer/mtspr as well as the carry read/modify/write helpers,
+        // whose IR destination is xer.
+        foreach (var definition in IrRegisterDataFlow.Definitions(instruction))
+        {
+            if (RegisterNameUtils.HardwareBase(definition.AsSpan()).Equals("xer", StringComparison.OrdinalIgnoreCase))
+            {
+                return GuestFlagState.CarryOnly;
+            }
+        }
+
+        return GuestFlagState.None;
+    }
+
+    public static GuestFlagState Reads(IrInstruction instruction, GuestFlagLivenessContext context)
+    {
+        switch (instruction)
+        {
+            case IrSetCrField:
+                // Reads XER.SO only, and no CR field: the compare overwrites the
+                // complete field from its two operands.
+                return GuestFlagState.None;
+
+            case IrBranch branch:
+                return GuestFlagState.Cr(BranchCrFields(branch));
+
+            case IrIndirectCall:
+            case IrIndirectJump:
+            case IrUndefined:
+                return GuestFlagState.All;
+
+            case IrCall call:
+                return CallReads(call, context);
+
+            default:
+                {
+                    var result = GuestFlagState.None;
+                    foreach (var use in IrRegisterDataFlow.Uses(instruction))
+                    {
+                        result = result.Union(RegisterFlags(use));
+                    }
+                    return result;
+                }
+        }
+    }
+
+    private static GuestFlagState CallReads(IrCall call, GuestFlagLivenessContext context)
+    {
+        if (GuestTargetParser.TryParseAddress(call.Target, out var target))
+        {
+            if (context.OpaqueCallTargets.Contains(target) ||
+                !context.CalleeContracts.TryGetValue(target, out var contract))
+            {
+                return GuestFlagState.All;
+            }
+
+            return contract.HasFullSynchronizationFence
+                ? GuestFlagState.All
+                : new GuestFlagState(contract.CrReadBeforeWriteMask, contract.ReadsXerBeforeWrite);
+        }
+
+        // Non-address targets are either runtime helpers with a cataloged
+        // effect, or guest symbols the emitter calls directly. The catalog
+        // classifies anything it does not recognize as a complete boundary.
+        var effect = GuestHelperEffectCatalog.Analyze(call);
+        var readsCarry = effect.ReadsXer && !CarryProducingHelpers.Contains(call.Target);
+        var result = new GuestFlagState(effect.CrReadMask, readsCarry);
+        foreach (var argument in call.Arguments)
+        {
+            if (argument.Kind == "register" && argument.RegisterName is { } name)
+            {
+                result = result.Union(RegisterFlags(name));
+            }
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    /// CR fields a branch condition observes. The lifter emits general <c>bc</c>/<c>bcctr</c> forms
+    /// as raw C++ text rather than a register operand, so the text must be inspected; anything that
+    /// can't be parsed conservatively reports every field.
+    /// </summary>
+    public static byte BranchCrFields(IrBranch branch)
+    {
+        var conditionRegister = branch.ConditionRegister;
+        if (string.IsNullOrEmpty(conditionRegister))
+        {
+            return 0;
+        }
+
+        if (conditionRegister.Contains("GetCRBit", StringComparison.Ordinal) ||
+            conditionRegister.Contains("ctx->cr", StringComparison.Ordinal) ||
+            conditionRegister.Contains("cached_cr", StringComparison.Ordinal))
+        {
+            if (conditionRegister.Contains("ctx->cr", StringComparison.Ordinal) ||
+                conditionRegister.Contains("cached_cr", StringComparison.Ordinal))
+            {
+                return byte.MaxValue;
+            }
+
+            byte mask = 0;
+            var matches = GetCrBitRegex.Matches(conditionRegister);
+            if (matches.Count != CountOccurrences(conditionRegister, "GetCRBit"))
+            {
+                return byte.MaxValue;
+            }
+
+            foreach (Match match in matches)
+            {
+                mask |= (byte)(1 << (int.Parse(match.Groups["field"].Value) & 7));
+            }
+
+            return mask;
+        }
+
+        return RegisterFlags(conditionRegister).CrFields;
+    }
+
+    private static int CountOccurrences(string text, string value)
+    {
+        var count = 0;
+        var index = text.IndexOf(value, StringComparison.Ordinal);
+        while (index >= 0)
+        {
+            ++count;
+            index = text.IndexOf(value, index + value.Length, StringComparison.Ordinal);
+        }
+
+        return count;
+    }
+
+    private static GuestFlagState RegisterFlags(string? name)
+    {
+        if (string.IsNullOrWhiteSpace(name))
+        {
+            return GuestFlagState.None;
+        }
+
+        var baseName = RegisterNameUtils.HardwareBase(name.AsSpan());
+        if (baseName.Length == 3 && baseName.StartsWith("cr", StringComparison.OrdinalIgnoreCase) &&
+            baseName[2] is >= '0' and <= '7')
+        {
+            return GuestFlagState.CrField(baseName[2] - '0');
+        }
+
+        if (baseName.Length is >= 4 and <= 5 && baseName.StartsWith("crb", StringComparison.OrdinalIgnoreCase) &&
+            int.TryParse(baseName[3..], out var crBit) && crBit is >= 0 and < 32)
+        {
+            return GuestFlagState.CrField(crBit / 4);
+        }
+
+        if (baseName.Equals("cr", StringComparison.OrdinalIgnoreCase))
+        {
+            return GuestFlagState.Cr(byte.MaxValue);
+        }
+
+        if (baseName.Equals("xer", StringComparison.OrdinalIgnoreCase))
+        {
+            return GuestFlagState.CarryOnly;
+        }
+
+        return GuestFlagState.None;
+    }
+}
diff --git a/translator/src/Translator.Core/Analysis/GuestHelperEffectCatalog.cs b/translator/src/Translator.Core/Analysis/GuestHelperEffectCatalog.cs
new file mode 100644
index 0000000..6a16ac4
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/GuestHelperEffectCatalog.cs
@@ -0,0 +1,224 @@
+using System;
+using System.Collections.Frozen;
+using System.Collections.Generic;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Analysis;
+
+public sealed record GuestHelperEffect(
+    uint GprReadMask = 0,
+    uint GprWriteMask = 0,
+    uint FprReadMask = 0,
+    uint FprWriteMask = 0,
+    byte CrReadMask = 0,
+    byte CrWriteMask = 0,
+    bool ReadsXer = false,
+    bool WritesXer = false,
+    bool ReadsCtr = false,
+    bool WritesCtr = false,
+    bool ReadsLr = false,
+    bool WritesLr = false,
+    GuestCallBoundaryFlags BoundaryFlags = GuestCallBoundaryFlags.None);
+
+/// <summary>
+/// Architectural effects hidden behind non-guest helper calls, reached implicitly through CpuContext
+/// (explicit IrCall args/destinations are handled by the ordinary IR analyzer). Unknown helpers default
+/// to complete-context boundaries so a new runtime helper can't silently invalidate resident ownership.
+/// </summary>
+public static class GuestHelperEffectCatalog
+{
+    // The effects below are constants, so one shared instance per distinct
+    // effect is handed out instead of allocating a record per call site.
+    // GuestHelperEffect is an immutable record: every member is init-only.
+    private static readonly GuestHelperEffect NoEffect = new();
+    private static readonly GuestHelperEffect CarryUpdate = new(ReadsXer: true, WritesXer: true);
+    private static readonly GuestHelperEffect CarryRead = new(ReadsXer: true);
+    private static readonly GuestHelperEffect UnboundedStringLoad = new(GprWriteMask: uint.MaxValue, ReadsXer: true);
+    private static readonly GuestHelperEffect UnboundedStringStore = new(GprReadMask: uint.MaxValue, ReadsXer: true);
+    private static readonly GuestHelperEffect ConditionalStore =
+        new(CrReadMask: byte.MaxValue, CrWriteMask: 1, ReadsXer: true);
+    private static readonly GuestHelperEffect CompleteBoundary = CreateComplete(GuestCallBoundaryFlags.None);
+    private static readonly GuestHelperEffect SystemCallBoundary = CreateComplete(
+        GuestCallBoundaryFlags.CanSuspend | GuestCallBoundaryFlags.CanSwitchThreads |
+        GuestCallBoundaryFlags.InvokesGuestCode);
+
+    /// <summary>Helpers whose effect is derived from a constant argument.</summary>
+    private enum ArgumentDependentHelper
+    {
+        LoadStringImmediate,
+        StoreStringImmediate,
+        MoveConditionFromXer,
+        MoveConditionField,
+        MoveConditionFromFpscr,
+        SetConditionBit,
+        ConditionLogical,
+        CompareIntoConditionField,
+        ReadSpr,
+        WriteSpr
+    }
+
+    private static readonly FrozenDictionary<string, ArgumentDependentHelper> ArgumentDependentHelpers =
+        new Dictionary<string, ArgumentDependentHelper>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["PPC_Lswi"] = ArgumentDependentHelper.LoadStringImmediate,
+            ["PPC_Stswi"] = ArgumentDependentHelper.StoreStringImmediate,
+            ["PPC_Mcrxr"] = ArgumentDependentHelper.MoveConditionFromXer,
+            ["PPC_Mcrf"] = ArgumentDependentHelper.MoveConditionField,
+            ["PPC_Mcrfs"] = ArgumentDependentHelper.MoveConditionFromFpscr,
+            ["PPC_CrSetBit"] = ArgumentDependentHelper.SetConditionBit,
+            ["PPC_CrLogical"] = ArgumentDependentHelper.ConditionLogical,
+            ["PPC_Fcmp"] = ArgumentDependentHelper.CompareIntoConditionField,
+            ["PPC_PsCmpo0"] = ArgumentDependentHelper.CompareIntoConditionField,
+            ["PPC_PsCmpo1"] = ArgumentDependentHelper.CompareIntoConditionField,
+            ["PPC_PsCmpu0"] = ArgumentDependentHelper.CompareIntoConditionField,
+            ["PPC_PsCmpu1"] = ArgumentDependentHelper.CompareIntoConditionField,
+            ["PPC_ReadSpr"] = ArgumentDependentHelper.ReadSpr,
+            ["PPC_WriteSpr"] = ArgumentDependentHelper.WriteSpr
+        }.ToFrozenDictionary(StringComparer.OrdinalIgnoreCase);
+
+    private static readonly string[] PureHelpers =
+    {
+        "memset_zero_32", "PPC_Cntlzw", "PPC_Eciwx", "PPC_Ecowx", "PPC_Lwarx",
+        "PPC_LoadHalfwordByteReverse", "PPC_LoadWordByteReverse",
+        "PPC_StoreHalfwordByteReverse", "PPC_StoreWordByteReverse", "PPC_Stfiwx",
+        "PPC_Fadds", "PPC_Fdivs", "PPC_Fmadd", "PPC_Fmadds", "PPC_Fmsub", "PPC_Fmsubs",
+        "PPC_Fmuls", "PPC_Fnmadd", "PPC_Fnmadds", "PPC_Fnmsub", "PPC_Fnmsubs",
+        "PPC_Fres", "PPC_Frsqrte", "PPC_Fsel", "PPC_Fsqrt", "PPC_Fsubs",
+        "PPC_PsAbs", "PPC_PsAdd", "PPC_PsDiv", "PPC_PsMadd", "PPC_PsMadds0",
+        "PPC_PsMadds1", "PPC_PsMerge00", "PPC_PsMerge01", "PPC_PsMerge10",
+        "PPC_PsMerge11", "PPC_PsMsub", "PPC_PsMul", "PPC_PsMuls0", "PPC_PsMuls1",
+        "PPC_PsNabs", "PPC_PsNeg", "PPC_PsNmadd", "PPC_PsNmsub", "PPC_PsRes",
+        "PPC_PsRsqrte", "PPC_PsSel", "PPC_PsSub", "PPC_PsSum0", "PPC_PsSum1",
+        "PPC_Mftb", "PPC_Mftbu", "PPC_TrapWord"
+    };
+
+    private static readonly string[] XerReadWriteHelpers =
+    {
+        "PPC_UpdateCarryAdd", "PPC_UpdateCarrySub", "PPC_UpdateCarryShiftRight",
+        "PPC_Addco", "PPC_Addeo", "PPC_Addmeo", "PPC_Addo", "PPC_Addzeo",
+        "PPC_Subfco", "PPC_Subfeo", "PPC_Subfmeo", "PPC_Subfo", "PPC_Subfzeo",
+        "PPC_Divwo", "PPC_Divwuo", "PPC_Mullwo", "PPC_Nego"
+    };
+
+    /// <summary>
+    /// Helpers that implicitly touch FPSCR or GQR state, which stays authoritative in CpuContext
+    /// so no GPR sync is needed; kept as explicit entries so they don't default to unknown
+    /// full-context fences.
+    /// </summary>
+    private static readonly string[] FpscrAndGqrHelpers =
+    {
+        "PPC_Mffs", "PPC_Mtfsb0", "PPC_Mtfsb1", "PPC_Mtfsf", "PPC_Mtfsfi", "PPC_PsqL", "PPC_PsqSt"
+    };
+
+    /// <summary>
+    /// Helpers whose effect doesn't depend on arguments, as one hash lookup instead of the linear
+    /// case-insensitive chain this used to walk per call site. Declared after the name tables above
+    /// since static field initializers run in textual order and this one reads them.
+    /// </summary>
+    private static readonly FrozenDictionary<string, GuestHelperEffect> ConstantEffectHelpers =
+        BuildConstantEffectHelpers();
+
+    private static FrozenDictionary<string, GuestHelperEffect> BuildConstantEffectHelpers()
+    {
+        var entries = new Dictionary<string, GuestHelperEffect>(StringComparer.OrdinalIgnoreCase);
+        foreach (var helper in PureHelpers) entries.Add(helper, NoEffect);
+        foreach (var helper in XerReadWriteHelpers) entries.Add(helper, CarryUpdate);
+        foreach (var helper in FpscrAndGqrHelpers) entries.Add(helper, NoEffect);
+        entries.Add("PPC_GetCarry", CarryRead);
+        entries.Add("OSSystemCall", SystemCallBoundary);
+        entries.Add("PPC_Lswx", UnboundedStringLoad);
+        entries.Add("PPC_Stswx", UnboundedStringStore);
+        entries.Add("PPC_Stwcx", ConditionalStore);
+        return entries.ToFrozenDictionary(StringComparer.OrdinalIgnoreCase);
+    }
+
+    public static GuestHelperEffect Analyze(IrCall call)
+    {
+        // The prefixed families are matched first, exactly as before: a name is
+        // only looked up once it is known not to be a known-GQR paired form.
+        if (call.Target.StartsWith("PPC_PsqLKnown_", StringComparison.OrdinalIgnoreCase) ||
+            call.Target.StartsWith("PPC_PsqLKnownGuarded_", StringComparison.OrdinalIgnoreCase) ||
+            call.Target.StartsWith("PPC_PsqStKnown_", StringComparison.OrdinalIgnoreCase) ||
+            call.Target.StartsWith("PPC_PsqStKnownGuarded_", StringComparison.OrdinalIgnoreCase))
+            return NoEffect;
+
+        if (ConstantEffectHelpers.TryGetValue(call.Target, out var constantEffect)) return constantEffect;
+
+        if (ArgumentDependentHelpers.TryGetValue(call.Target, out var helper))
+        {
+            return helper switch
+            {
+                ArgumentDependentHelper.LoadStringImmediate =>
+                    new GuestHelperEffect(GprWriteMask: StringRegisterMask(call, countArgument: 2)),
+                ArgumentDependentHelper.StoreStringImmediate =>
+                    new GuestHelperEffect(GprReadMask: StringRegisterMask(call, countArgument: 2)),
+                ArgumentDependentHelper.MoveConditionFromXer =>
+                    new GuestHelperEffect(
+                        CrReadMask: byte.MaxValue, CrWriteMask: FieldMask(call, 0),
+                        ReadsXer: true, WritesXer: true),
+                ArgumentDependentHelper.MoveConditionField =>
+                    new GuestHelperEffect(CrReadMask: byte.MaxValue, CrWriteMask: FieldMask(call, 0)),
+                ArgumentDependentHelper.MoveConditionFromFpscr =>
+                    new GuestHelperEffect(CrReadMask: byte.MaxValue, CrWriteMask: FieldMask(call, 0)),
+                ArgumentDependentHelper.SetConditionBit =>
+                    new GuestHelperEffect(CrReadMask: byte.MaxValue, CrWriteMask: BitFieldMask(call, 0)),
+                ArgumentDependentHelper.ConditionLogical =>
+                    new GuestHelperEffect(
+                        // Updates one field but preserves the other seven via a packed-CR
+                        // read/modify/write, so resident CR ownership needs the full packed value first.
+                        CrReadMask: byte.MaxValue,
+                        CrWriteMask: BitFieldMask(call, 1)),
+                ArgumentDependentHelper.CompareIntoConditionField =>
+                    new GuestHelperEffect(CrReadMask: byte.MaxValue, CrWriteMask: FieldMask(call, 0)),
+                ArgumentDependentHelper.ReadSpr => SprEffect(call, write: false),
+                ArgumentDependentHelper.WriteSpr => SprEffect(call, write: true),
+                _ => Complete()
+            };
+        }
+
+        return Complete();
+    }
+
+    private static GuestHelperEffect SprEffect(IrCall call, bool write)
+    {
+        if (call.Arguments.Count == 0 || call.Arguments[0].Constant is not long spr)
+            return Complete();
+        return spr switch
+        {
+            1 => new GuestHelperEffect(ReadsXer: !write, WritesXer: write),
+            8 => new GuestHelperEffect(ReadsLr: !write, WritesLr: write),
+            9 => new GuestHelperEffect(ReadsCtr: !write, WritesCtr: write),
+            _ => NoEffect
+        };
+    }
+
+    private static uint StringRegisterMask(IrCall call, int countArgument)
+    {
+        if (call.Arguments.Count <= countArgument || call.Arguments[0].Constant is not long startValue ||
+            call.Arguments[countArgument].Constant is not long countValue)
+            return uint.MaxValue;
+        var start = (int)(startValue & 31);
+        var count = (int)(countValue == 0 ? 32 : countValue);
+        var registers = Math.Min(32, (count + 3) / 4);
+        uint mask = 0;
+        for (var index = 0; index < registers; ++index) mask |= 1u << ((start + index) & 31);
+        return mask;
+    }
+
+    private static byte FieldMask(IrCall call, int argument) =>
+        call.Arguments.Count > argument && call.Arguments[argument].Constant is long field
+            ? (byte)(1 << ((int)field & 7))
+            : byte.MaxValue;
+
+    private static byte BitFieldMask(IrCall call, int argument) =>
+        call.Arguments.Count > argument && call.Arguments[argument].Constant is long bit
+            ? (byte)(1 << (((int)bit & 31) / 4))
+            : byte.MaxValue;
+
+    private static GuestHelperEffect Complete(GuestCallBoundaryFlags extra = GuestCallBoundaryFlags.None) =>
+        extra == GuestCallBoundaryFlags.None ? CompleteBoundary : CreateComplete(extra);
+
+    private static GuestHelperEffect CreateComplete(GuestCallBoundaryFlags extra) =>
+        new(uint.MaxValue, uint.MaxValue, uint.MaxValue, uint.MaxValue, byte.MaxValue, byte.MaxValue,
+            true, true, true, true, true, true, extra | GuestCallBoundaryFlags.RequiresCompleteContext);
+}
diff --git a/translator/src/Translator.Core/Analysis/GuestSaveRestoreThunks.cs b/translator/src/Translator.Core/Analysis/GuestSaveRestoreThunks.cs
new file mode 100644
index 0000000..d0ed9fd
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/GuestSaveRestoreThunks.cs
@@ -0,0 +1,91 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Analysis;
+
+/// <summary>
+/// One CodeWarrior save/restore thunk family: a run of one-instruction entry
+/// points, four bytes apart, where entry <c>k</c> saves or restores registers
+/// <c>FirstRegister + k</c> upwards.
+/// </summary>
+public sealed record GuestSaveRestoreThunkRange(uint BaseAddress, int FirstRegister, int LastRegister);
+
+/// <summary>
+/// The four CodeWarrior save/restore thunk ranges, derived once from the function map's symbol names
+/// (<c>_save_gpr_14</c>, <c>_rest_gpr_14</c>, <c>_save_fpr_23</c>, <c>_rest_fpr_23</c> ...) and published
+/// here instead of threaded as a parameter through the three passes that recognize these thunks.
+/// </summary>
+public sealed class GuestSaveRestoreThunks
+{
+    public static GuestSaveRestoreThunks None { get; } = new(null, null, null, null);
+
+    /// <summary>
+    /// Ranges in effect for this process. Set once from the loaded project;
+    /// <see cref="None"/> until then, which makes every thunk query answer "no",
+    /// exactly as it does for a project that configures no function map.
+    /// </summary>
+    public static GuestSaveRestoreThunks Current { get; set; } = None;
+
+    private GuestSaveRestoreThunks(
+        GuestSaveRestoreThunkRange? saveGpr,
+        GuestSaveRestoreThunkRange? restGpr,
+        GuestSaveRestoreThunkRange? saveFpr,
+        GuestSaveRestoreThunkRange? restFpr)
+    {
+        SaveGpr = saveGpr;
+        RestGpr = restGpr;
+        SaveFpr = saveFpr;
+        RestFpr = restFpr;
+    }
+
+    public GuestSaveRestoreThunkRange? SaveGpr { get; }
+    public GuestSaveRestoreThunkRange? RestGpr { get; }
+    public GuestSaveRestoreThunkRange? SaveFpr { get; }
+    public GuestSaveRestoreThunkRange? RestFpr { get; }
+
+    public bool IsEmpty => SaveGpr is null && RestGpr is null && SaveFpr is null && RestFpr is null;
+
+    public static GuestSaveRestoreThunks FromFunctionMap(FunctionMap map) =>
+        new(
+            ResolveRange(map, "_save_gpr_"),
+            ResolveRange(map, "_rest_gpr_"),
+            ResolveRange(map, "_save_fpr_"),
+            ResolveRange(map, "_rest_fpr_"));
+
+    /// <summary>
+    /// Recovers (base, first, last register) from the family's named entries, validating that the
+    /// run is exactly four bytes per register step since only the family's extremes are guaranteed named.
+    /// </summary>
+    private static GuestSaveRestoreThunkRange? ResolveRange(FunctionMap map, string prefix)
+    {
+        var family = map.NumberedFamily(prefix);
+        if (family.Count < 2) return null;
+
+        var first = family.Keys.Min();
+        var last = family.Keys.Max();
+        var baseAddress = family[first];
+        var expectedEnd = baseAddress + checked((uint)((last - first) * 4));
+        if (family[last] != expectedEnd)
+        {
+            throw new InvalidDataException(
+                $"Function map {map.SourcePath} describes '{prefix}' thunks at 0x{baseAddress:X8}..0x{family[last]:X8} " +
+                $"for registers {first}..{last}, which is not a four-byte-per-register run.");
+        }
+
+        foreach (var (register, address) in family)
+        {
+            var expected = baseAddress + checked((uint)((register - first) * 4));
+            if (address != expected)
+            {
+                throw new InvalidDataException(
+                    $"Function map {map.SourcePath} places '{prefix}{register}' at 0x{address:X8}; " +
+                    $"the surrounding run requires 0x{expected:X8}.");
+            }
+        }
+
+        return new GuestSaveRestoreThunkRange(baseAddress, first, last);
+    }
+}
diff --git a/translator/src/Translator.Core/Analysis/GuestStateLivenessAnalyzer.cs b/translator/src/Translator.Core/Analysis/GuestStateLivenessAnalyzer.cs
new file mode 100644
index 0000000..d8902ed
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/GuestStateLivenessAnalyzer.cs
@@ -0,0 +1,427 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Analysis;
+
+/// <summary>
+/// Architectural state that can remain as ordinary SSA values between known translated call
+/// sites. Memory is deliberately absent, it is an independently observable side effect, not part of the register file.
+/// </summary>
+public readonly record struct GuestStateMask(
+    uint Gpr,
+    uint Fpr,
+    byte Cr,
+    bool Xer,
+    bool Ctr,
+    bool Lr,
+    bool Fpscr,
+    byte Gqr,
+    byte Hid)
+{
+    public static GuestStateMask Empty => default;
+
+    public bool IsEmpty =>
+        Gpr == 0 && Fpr == 0 && Cr == 0 && !Xer && !Ctr && !Lr && !Fpscr && Gqr == 0 && Hid == 0;
+
+    public GuestStateMask Union(GuestStateMask other) =>
+        new(Gpr | other.Gpr, Fpr | other.Fpr, (byte)(Cr | other.Cr),
+            Xer || other.Xer, Ctr || other.Ctr, Lr || other.Lr,
+            Fpscr || other.Fpscr, (byte)(Gqr | other.Gqr), (byte)(Hid | other.Hid));
+
+    public GuestStateMask Intersect(GuestStateMask other) =>
+        new(Gpr & other.Gpr, Fpr & other.Fpr, (byte)(Cr & other.Cr),
+            Xer && other.Xer, Ctr && other.Ctr, Lr && other.Lr,
+            Fpscr && other.Fpscr, (byte)(Gqr & other.Gqr), (byte)(Hid & other.Hid));
+
+    public GuestStateMask Except(GuestStateMask other) =>
+        new(Gpr & ~other.Gpr, Fpr & ~other.Fpr, (byte)(Cr & ~other.Cr),
+            Xer && !other.Xer, Ctr && !other.Ctr, Lr && !other.Lr,
+            Fpscr && !other.Fpscr, (byte)(Gqr & ~other.Gqr), (byte)(Hid & ~other.Hid));
+
+    public static GuestStateMask FromContractReads(GuestAbiContract contract) =>
+        new(contract.GprReadBeforeWriteMask, contract.FprReadBeforeWriteMask,
+            contract.CrReadBeforeWriteMask, contract.ReadsXerBeforeWrite,
+            contract.ReadsCtrBeforeWrite, contract.ReadsLrBeforeWrite,
+            contract.ReadsFpscrBeforeWrite, contract.GqrReadBeforeWriteMask,
+            contract.HidReadBeforeWriteMask);
+
+    public static GuestStateMask FromContractWrites(GuestAbiContract contract) =>
+        new(contract.GprPossibleWriteMask, contract.FprPossibleWriteMask,
+            contract.CrPossibleWriteMask, contract.MayWriteXer,
+            contract.MayWriteCtr, contract.MayWriteLr,
+            contract.MayWriteFpscr, contract.GqrPossibleWriteMask,
+            contract.HidPossibleWriteMask);
+
+    public static GuestStateMask FromContractDefiniteWrites(GuestAbiContract contract) =>
+        new(contract.GprDefiniteWriteMask, contract.FprDefiniteWriteMask,
+            contract.CrDefiniteWriteMask, contract.DefinitelyWritesXer,
+            contract.DefinitelyWritesCtr, contract.DefinitelyWritesLr,
+            contract.DefinitelyWritesFpscr, contract.GqrDefiniteWriteMask,
+            contract.HidDefiniteWriteMask);
+}
+
+public sealed record GuestCallSiteStateContract(
+    string BlockLabel,
+    int InstructionIndex,
+    int CallOrdinal,
+    uint Target,
+    GuestStateMask Inputs,
+    GuestStateMask Outputs,
+    GuestStateMask LiveAfter);
+
+/// <summary>
+/// Stable identity for a direct call across codegen rewrites that remove unrelated instructions.
+/// The ordinal counts same-target calls in a block, so it survives rewrites that InstructionIndex does not.
+/// </summary>
+public readonly record struct GuestStateFreeCallSiteKey(
+    string BlockLabel,
+    uint Target,
+    int CallOrdinal);
+
+/// <summary>
+/// A compact native entry specialized for the state consumed after one or more
+/// equivalent direct call sites.
+/// </summary>
+public sealed record GuestStateFreeCallVariant(
+    uint Target,
+    string Symbol,
+    GuestAbiContract Contract);
+
+public sealed record GuestStateLivenessResult(
+    IReadOnlyDictionary<string, GuestStateMask> BlockLiveIn,
+    IReadOnlyDictionary<string, GuestStateMask> BlockLiveOut,
+    IReadOnlyList<GuestCallSiteStateContract> DirectCalls);
+
+/// <summary>
+/// Backward architectural-state liveness. A call kills the values it writes, introduces only its
+/// proven inputs, and reports only values live after that exact call site.
+/// </summary>
+public static class GuestStateLivenessAnalyzer
+{
+    /// <summary>
+    /// A public translated-function boundary materializes CpuContext, so every value the function
+    /// may change is observable there. Guest ABI return masks describe source-language return
+    /// values only, not a license to discard other instruction-level side effects.
+    /// </summary>
+    public static GuestStateMask MaterializedContextExit(GuestAbiContract contract) =>
+        GuestStateMask.FromContractWrites(contract);
+
+    public static uint RequiredStateFreeGprInputs(GuestAbiContract contract, uint demandedOutputMask)
+    {
+        var outputs = contract.GprPossibleWriteMask & demandedOutputMask;
+        return contract.GprReadBeforeWriteMask | (outputs & ~contract.GprDefiniteWriteMask);
+    }
+
+    public static bool CanDeconstructWithoutContext(IrFunction function)
+    {
+        foreach (var instruction in function.Blocks.SelectMany(static block => block.Instructions))
+        {
+            // Unknown control-flow targets have no static call-site contract,
+            // so the dispatcher must observe a materialized CpuContext.
+            if (instruction is IrIndirectCall or IrIndirectJump or IrJumpTable or IrUndefined)
+                return false;
+
+            foreach (var name in IrRegisterDataFlow.Uses(instruction))
+            {
+                if (IsSupervisorRegister(name)) return false;
+            }
+
+            foreach (var name in IrRegisterDataFlow.Definitions(instruction))
+            {
+                if (IsSupervisorRegister(name)) return false;
+            }
+        }
+        return true;
+    }
+
+    /// <summary>
+    /// Supervisor-level state the state-free calling convention cannot carry.
+    /// </summary>
+    private static bool IsSupervisorRegister(string name)
+    {
+        var baseName = RegisterNameUtils.HardwareBase(name.AsSpan());
+        return baseName.Equals("msr", StringComparison.Ordinal) ||
+               baseName.Equals("dar", StringComparison.Ordinal) ||
+               baseName.Equals("dsisr", StringComparison.Ordinal) ||
+               baseName.Equals("iccr", StringComparison.Ordinal) ||
+               baseName.Equals("tbr", StringComparison.Ordinal) ||
+               baseName.Equals("tbl", StringComparison.Ordinal) ||
+               baseName.Equals("tbu", StringComparison.Ordinal) ||
+               baseName.Equals("srr0", StringComparison.Ordinal) ||
+               baseName.Equals("srr1", StringComparison.Ordinal);
+    }
+
+    public static GuestStateLivenessResult Analyze(
+        IrFunction function,
+        IReadOnlyDictionary<uint, GuestAbiContract> calleeContracts,
+        GuestStateMask exitLive)
+    {
+        var blockList = function.Blocks;
+        var blockCount = blockList.Count;
+        var blocks = blockList.ToDictionary(block => block.Label, StringComparer.Ordinal);
+        // Successor labels are resolved once into per-block arrays; the fixpoint
+        // below re-reads them on every round and cannot afford the projection.
+        var successors = new string[blockCount][];
+        for (var index = 0; index < blockCount; ++index)
+        {
+            var successorCount = Successors(
+                blockList[index],
+                index + 1 < blockCount ? blockList[index + 1].Label : null,
+                out var first,
+                out var second);
+            var keepFirst = successorCount >= 1 && blocks.ContainsKey(first);
+            var keepSecond = successorCount == 2 && blocks.ContainsKey(second);
+            successors[index] =
+                keepFirst && keepSecond ? new[] { first, second }
+                : keepFirst ? new[] { first }
+                : keepSecond ? new[] { second }
+                : Array.Empty<string>();
+        }
+
+        var liveIn = blockList.ToDictionary(block => block.Label, _ => GuestStateMask.Empty, StringComparer.Ordinal);
+        var liveOut = blockList.ToDictionary(block => block.Label, _ => GuestStateMask.Empty, StringComparer.Ordinal);
+
+        bool changed;
+        do
+        {
+            changed = false;
+            for (var blockIndex = blockCount - 1; blockIndex >= 0; --blockIndex)
+            {
+                var block = blockList[blockIndex];
+                var blockSuccessors = successors[blockIndex];
+                var outgoing = exitLive;
+                if (blockSuccessors.Length != 0)
+                {
+                    outgoing = GuestStateMask.Empty;
+                    foreach (var label in blockSuccessors) outgoing = outgoing.Union(liveIn[label]);
+                }
+
+                var incoming = TransferBlock(block, outgoing, calleeContracts, calls: null);
+                if (outgoing != liveOut[block.Label] || incoming != liveIn[block.Label])
+                {
+                    liveOut[block.Label] = outgoing;
+                    liveIn[block.Label] = incoming;
+                    changed = true;
+                }
+            }
+        } while (changed);
+
+        var calls = new List<GuestCallSiteStateContract>();
+        foreach (var block in function.Blocks)
+            TransferBlock(block, liveOut[block.Label], calleeContracts, calls);
+        calls.Sort(static (left, right) =>
+        {
+            var block = string.CompareOrdinal(left.BlockLabel, right.BlockLabel);
+            return block != 0 ? block : left.InstructionIndex.CompareTo(right.InstructionIndex);
+        });
+        var ordinals = new Dictionary<(string Block, uint Target), int>();
+        for (var index = 0; index < calls.Count; ++index)
+        {
+            var call = calls[index];
+            var key = (call.BlockLabel, call.Target);
+            var ordinal = ordinals.GetValueOrDefault(key);
+            calls[index] = call with { CallOrdinal = ordinal };
+            ordinals[key] = ordinal + 1;
+        }
+        return new GuestStateLivenessResult(liveIn, liveOut, calls);
+    }
+
+    private static GuestStateMask TransferBlock(
+        IrBasicBlock block,
+        GuestStateMask live,
+        IReadOnlyDictionary<uint, GuestAbiContract> calleeContracts,
+        List<GuestCallSiteStateContract>? calls)
+    {
+        for (var index = block.Instructions.Count - 1; index >= 0; --index)
+        {
+            var instruction = block.Instructions[index];
+            if (instruction is IrCall call &&
+                GuestTargetParser.TryParseAddress(call.Target, out var target) &&
+                calleeContracts.TryGetValue(target, out var contract))
+            {
+                var inputs = GuestStateMask.FromContractReads(contract);
+                // A no-destination call is a lowered PPC tail branch, which forwards the caller's
+                // incoming LR to the eventual blr even if the callee's ABI summary omits it.
+                if (string.IsNullOrWhiteSpace(call.Destination))
+                    inputs = inputs.Union(GuestStateMask.Empty with { Lr = true });
+                var possibleWrites = GuestStateMask.FromContractWrites(contract);
+                var definiteWrites = GuestStateMask.FromContractDefiniteWrites(contract);
+                var liveAfter = live;
+                calls?.Add(new GuestCallSiteStateContract(
+                    block.Label, index, 0, target, inputs, liveAfter.Intersect(possibleWrites), liveAfter));
+                live = liveAfter.Except(definiteWrites).Union(inputs);
+                // The IR call destination (normally LR) is an instruction-level
+                // definition in addition to the callee's architectural effects.
+                var destination = Register(call.Destination);
+                live = live.Except(destination);
+                continue;
+            }
+
+            live = live.Except(Writes(instruction)).Union(Reads(instruction));
+        }
+        return live;
+    }
+
+    private static GuestStateMask Reads(IrInstruction instruction)
+    {
+        var result = GuestStateMask.Empty;
+        switch (instruction)
+        {
+            case IrAssign value: AddValue(ref result, value.Value); break;
+            case IrBinary value: AddValue(ref result, value.Left); AddValue(ref result, value.Right); break;
+            case IrLoad value: Add(ref result, value.Address.Base); break;
+            case IrStore value: Add(ref result, value.Address.Base); AddValue(ref result, value.Source); break;
+            case IrResolveGuestMemoryRange value: AddValue(ref result, value.Base); break;
+            case IrResolvedLoad value: Add(ref result, value.OriginalAddress.Base); break;
+            case IrResolvedStore value: Add(ref result, value.OriginalAddress.Base); AddValue(ref result, value.Source); break;
+            case IrResolvedPsqLoad value:
+                AddValue(ref result, value.OriginalAddress);
+                if (value.KnownGqr is null || value.GuardKnownGqr) AddGqr(ref result, value.I);
+                break;
+            case IrResolvedPsqStore value:
+                AddValue(ref result, value.OriginalAddress); AddValue(ref result, value.Source);
+                if (value.KnownGqr is null || value.GuardKnownGqr) AddGqr(ref result, value.I);
+                break;
+            case IrResolvedLoadPair value:
+                Add(ref result, value.FirstOriginalAddress.Base);
+                Add(ref result, value.SecondOriginalAddress.Base);
+                break;
+            case IrResolvedStorePair value:
+                Add(ref result, value.FirstOriginalAddress.Base); Add(ref result, value.SecondOriginalAddress.Base);
+                AddValue(ref result, value.FirstSource); AddValue(ref result, value.SecondSource);
+                break;
+            case IrCall value: foreach (var argument in value.Arguments) AddValue(ref result, argument); break;
+            case IrIndirectCall value:
+                AddValue(ref result, value.Target);
+                foreach (var argument in value.Arguments) AddValue(ref result, argument);
+                result = result.Union(FullState);
+                break;
+            case IrIndirectJump value: AddValue(ref result, value.Target); result = result.Union(FullState); break;
+            case IrSetCrField value:
+                AddValue(ref result, value.Left);
+                AddValue(ref result, value.Right);
+                // Same as unioning Register("xer").
+                result = result with { Xer = true };
+                break;
+            case IrPhi value: foreach (var source in value.Sources.Values) Add(ref result, source); break;
+            case IrBranch value: Add(ref result, value.ConditionRegister); break;
+            case IrJumpTable value: Add(ref result, value.Selector); break;
+            case IrReturn { Value: { } value }: AddValue(ref result, value); break;
+        }
+        return result;
+    }
+
+    private static GuestStateMask Writes(IrInstruction instruction)
+    {
+        var result = GuestStateMask.Empty;
+        switch (instruction)
+        {
+            case IrAssign value: Add(ref result, value.Destination); break;
+            case IrBinary value: Add(ref result, value.Destination); break;
+            case IrLoad value: Add(ref result, value.Destination); break;
+            case IrResolveGuestMemoryRange value: Add(ref result, value.Destination); break;
+            case IrResolvedLoad value: Add(ref result, value.Destination); break;
+            case IrResolvedPsqLoad value: Add(ref result, value.Destination); break;
+            case IrResolvedLoadPair value:
+                Add(ref result, value.FirstDestination);
+                Add(ref result, value.SecondDestination);
+                break;
+            case IrCall value: Add(ref result, value.Destination); break;
+            case IrIndirectCall value: Add(ref result, value.Destination); result = result.Union(FullState); break;
+            case IrSetCrField value:
+                result = result with { Cr = (byte)(result.Cr | (1 << value.FieldIndex)) };
+                break;
+            case IrPhi value: Add(ref result, value.Destination); break;
+            case IrUndefined: result = FullState; break;
+        }
+        return result;
+    }
+
+    private static void Add(ref GuestStateMask mask, string? name) => mask = mask.Union(Register(name));
+
+    private static void AddValue(ref GuestStateMask mask, IrValue value)
+    {
+        if (value.Kind == "register") Add(ref mask, value.RegisterName);
+    }
+
+    private static void AddGqr(ref GuestStateMask mask, uint index)
+    {
+        // Mirrors Register("gqr{index}"): only the eight architectural
+        // quantization registers exist, anything else names nothing.
+        if (index <= 7) mask = mask with { Gqr = (byte)(mask.Gqr | (1 << (int)index)) };
+    }
+
+    private static GuestStateMask Register(string? name)
+    {
+        if (string.IsNullOrWhiteSpace(name)) return GuestStateMask.Empty;
+        var baseName = RegisterNameUtils.HardwareBase(name.AsSpan());
+        if (baseName.Length >= 2 && baseName[0] == 'r' && int.TryParse(baseName[1..], out var gpr) && gpr is >= 0 and < 32)
+            return GuestStateMask.Empty with { Gpr = 1u << gpr };
+        if (baseName.Length >= 2 && baseName[0] == 'f' && int.TryParse(baseName[1..], out var fpr) && fpr is >= 0 and < 32)
+            return GuestStateMask.Empty with { Fpr = 1u << fpr };
+        if (baseName.Length == 3 && baseName.StartsWith("cr", StringComparison.OrdinalIgnoreCase) && baseName[2] is >= '0' and <= '7')
+            return GuestStateMask.Empty with { Cr = (byte)(1 << (baseName[2] - '0')) };
+        if (baseName.Length is >= 4 and <= 5 && baseName.StartsWith("crb", StringComparison.OrdinalIgnoreCase) &&
+            int.TryParse(baseName[3..], out var crBit) && crBit is >= 0 and < 32)
+            return GuestStateMask.Empty with { Cr = (byte)(1 << (crBit / 4)) };
+        if (baseName.Equals("cr", StringComparison.OrdinalIgnoreCase)) return GuestStateMask.Empty with { Cr = byte.MaxValue };
+        if (baseName.Equals("xer", StringComparison.OrdinalIgnoreCase)) return GuestStateMask.Empty with { Xer = true };
+        if (baseName.Equals("ctr", StringComparison.OrdinalIgnoreCase)) return GuestStateMask.Empty with { Ctr = true };
+        if (baseName.Equals("lr", StringComparison.OrdinalIgnoreCase)) return GuestStateMask.Empty with { Lr = true };
+        if (baseName.Equals("fpscr", StringComparison.OrdinalIgnoreCase)) return GuestStateMask.Empty with { Fpscr = true };
+        if (baseName.Length == 4 && baseName.StartsWith("gqr", StringComparison.OrdinalIgnoreCase) &&
+            baseName[3] is >= '0' and <= '7')
+            return GuestStateMask.Empty with { Gqr = (byte)(1 << (baseName[3] - '0')) };
+        if (baseName.Length == 4 && baseName.StartsWith("hid", StringComparison.OrdinalIgnoreCase) &&
+            baseName[3] is >= '0' and <= '2')
+            return GuestStateMask.Empty with { Hid = (byte)(1 << (baseName[3] - '0')) };
+        return GuestStateMask.Empty;
+    }
+
+    /// <summary>
+    /// Returns the number of syntactic successors of <paramref name="block"/>
+    /// (0, 1 or 2) and their labels, without allocating an iterator.
+    /// </summary>
+    private static int Successors(
+        IrBasicBlock block,
+        string? fallthroughLabel,
+        out string first,
+        out string second)
+    {
+        var instructions = block.Instructions;
+        var terminator = instructions.Count == 0 ? null : instructions[instructions.Count - 1];
+        if (terminator is IrBranch branch)
+        {
+            first = branch.TrueLabel;
+            second = branch.FalseLabel;
+            return 2;
+        }
+
+        if (terminator is IrJump jump)
+        {
+            first = jump.TargetLabel;
+            second = string.Empty;
+            return 1;
+        }
+
+        if (terminator is not (IrReturn or IrUndefined or IrIndirectJump or IrJumpTable) &&
+            fallthroughLabel is not null)
+        {
+            // The canonical IR deliberately leaves ordinary sequential PPC
+            // flow implicit.  Omitting this edge makes later-block inputs look
+            // dead at entry and is unsound for state deconstruction.
+            first = fallthroughLabel;
+            second = string.Empty;
+            return 1;
+        }
+
+        first = string.Empty;
+        second = string.Empty;
+        return 0;
+    }
+
+    private static GuestStateMask FullState =>
+        new(uint.MaxValue, uint.MaxValue, byte.MaxValue, true, true, true, true, byte.MaxValue, byte.MaxValue);
+}
diff --git a/translator/src/Translator.Core/Analysis/Representation/FunctionAbiClassifier.cs b/translator/src/Translator.Core/Analysis/Representation/FunctionAbiClassifier.cs
new file mode 100644
index 0000000..4631a83
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/Representation/FunctionAbiClassifier.cs
@@ -0,0 +1,218 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+
+namespace Translator.Core.Analysis.Representation;
+
+public sealed record FunctionAbiClassification(
+    string Name,
+    ValueRepresentation ReturnRepresentation);
+
+public sealed class FunctionAbiClassifier
+{
+    private static readonly string[] AbiIntegerReturnOrder = { "r3", "r4" };
+    private static readonly string[] AbiFloatReturnOrder = { "f1" };
+
+    public FunctionAbiClassification Classify(
+        string functionName,
+        IrFunction function,
+        RepresentationEnvironment representations) =>
+        new(functionName, InferReturnRepresentation(function, representations));
+
+    private static ValueRepresentation InferReturnRepresentation(IrFunction function, RepresentationEnvironment types)
+    {
+        var explicitReturnRepresentations = function.Blocks
+            .SelectMany(b => b.Instructions)
+            .OfType<IrReturn>()
+            .Where(r => r.Value != null)
+            .Select(r => InferReturnRepresentationFromValue(r.Value!, types))
+            .Where(t => t != null)
+            .Cast<ValueRepresentation>()
+            .ToList();
+
+        if (explicitReturnRepresentations.Count > 0)
+        {
+            return MergeReturnRepresentations(explicitReturnRepresentations);
+        }
+
+        var cfg = IrCfg.Build(function);
+        var inferredReturnRepresentations = new List<ValueRepresentation>();
+        foreach (var block in function.Blocks)
+        {
+            if (block.Instructions.LastOrDefault() is not IrReturn)
+            {
+                continue;
+            }
+
+            inferredReturnRepresentations.AddRange(CollectAbiReturnRepresentationsNearExit(block.Label, cfg, types, new HashSet<string>(StringComparer.OrdinalIgnoreCase)));
+        }
+
+        return inferredReturnRepresentations.Count == 0
+            ? ValueRepresentation.Void
+            : MergeReturnRepresentations(inferredReturnRepresentations);
+    }
+
+    private static ValueRepresentation? InferReturnRepresentationFromValue(IrValue val, RepresentationEnvironment types)
+    {
+        if (val.Kind == "register" && val.RegisterName != null)
+        {
+            return types.Get(Base(val.RegisterName));
+        }
+
+        return ValueRepresentation.Int32;
+    }
+
+    private static IEnumerable<ValueRepresentation> CollectAbiReturnRepresentationsNearExit(
+        string label,
+        IrCfg cfg,
+        RepresentationEnvironment types,
+        HashSet<string> visited)
+    {
+        if (!visited.Add(label) || !cfg.Blocks.TryGetValue(label, out var block))
+        {
+            yield break;
+        }
+
+        var localType = FindRecentAbiReturnRepresentation(block, types);
+        if (localType != null)
+        {
+            yield return localType;
+            yield break;
+        }
+
+        foreach (var pred in cfg.Predecessors(label))
+        {
+            foreach (var predType in CollectAbiReturnRepresentationsNearExit(pred, cfg, types, visited))
+            {
+                yield return predType;
+            }
+        }
+    }
+
+    private static ValueRepresentation? FindRecentAbiReturnRepresentation(IrBasicBlock block, RepresentationEnvironment types)
+    {
+        var limit = block.Instructions.Count;
+        var terminator = limit > 0 ? block.Instructions[limit - 1] : null;
+        var isDirectReturnBlock = terminator is IrReturn;
+        if (isDirectReturnBlock)
+        {
+            limit--;
+        }
+
+        for (var i = limit - 1; i >= 0; i--)
+        {
+            if (!TryGetDefinedRegister(block.Instructions[i], out var definedRegister))
+            {
+                continue;
+            }
+
+            var baseName = Base(definedRegister);
+            if (AbiFloatReturnOrder.Contains(baseName, StringComparer.OrdinalIgnoreCase))
+            {
+                if (!CanFloatDefineImplicitReturn(block, i, limit, terminator))
+                {
+                    continue;
+                }
+
+                return types.Get(baseName);
+            }
+
+            if (AbiIntegerReturnOrder.Contains(baseName, StringComparer.OrdinalIgnoreCase))
+            {
+                return types.Get(baseName);
+            }
+        }
+
+        return null;
+    }
+
+    private static bool CanFloatDefineImplicitReturn(IrBasicBlock block, int candidateIndex, int limit, IrInstruction? terminator)
+    {
+        if (terminator is not (IrReturn or IrJump))
+        {
+            return false;
+        }
+
+        var epilogueLimit = terminator is IrJump ? Math.Max(candidateIndex + 1, limit - 1) : limit;
+        for (var i = candidateIndex + 1; i < epilogueLimit; i++)
+        {
+            if (!IsDirectReturnFloatEpilogueInstruction(block.Instructions[i]))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private static bool IsDirectReturnFloatEpilogueInstruction(IrInstruction instruction)
+    {
+        return instruction switch
+        {
+            IrAssign => true,
+            IrBinary => true,
+            IrLoad load when string.Equals(Base(load.Address.Base), "r1", StringComparison.OrdinalIgnoreCase) => true,
+            IrComment => true,
+            IrTracePpc => true,
+            _ => false
+        };
+    }
+
+    private static bool TryGetDefinedRegister(IrInstruction ins, out string register)
+    {
+        register = string.Empty;
+        switch (ins)
+        {
+            case IrAssign a when !string.IsNullOrWhiteSpace(a.Destination):
+                register = a.Destination;
+                return true;
+            case IrBinary b when !string.IsNullOrWhiteSpace(b.Destination):
+                register = b.Destination;
+                return true;
+            case IrLoad l when !string.IsNullOrWhiteSpace(l.Destination):
+                register = l.Destination;
+                return true;
+            case IrCall c when !string.IsNullOrWhiteSpace(c.Destination):
+                register = c.Destination;
+                return true;
+            case IrIndirectCall ic when !string.IsNullOrWhiteSpace(ic.Destination):
+                register = ic.Destination;
+                return true;
+            case IrPhi p when !string.IsNullOrWhiteSpace(p.Destination):
+                register = p.Destination;
+                return true;
+            default:
+                return false;
+        }
+    }
+
+    private static ValueRepresentation MergeReturnRepresentations(IReadOnlyList<ValueRepresentation> returnTypes)
+    {
+        var distinct = returnTypes.Distinct().ToList();
+        if (distinct.Count == 1)
+        {
+            return distinct[0];
+        }
+
+        var floatCandidate = distinct.OfType<ValueRepresentation>().FirstOrDefault(t => t.IsFloat);
+        var nonFloatCandidate = distinct.OfType<ValueRepresentation>().FirstOrDefault(t => !t.IsFloat);
+
+        if (floatCandidate != null && nonFloatCandidate == null)
+        {
+            return floatCandidate;
+        }
+
+        if (nonFloatCandidate != null && floatCandidate == null)
+        {
+            return nonFloatCandidate;
+        }
+
+        return ValueRepresentation.Int32;
+    }
+
+    private static string Base(string name) => RegisterNameUtils.StripNumericSuffix(name);
+}
diff --git a/translator/src/Translator.Core/Analysis/RuntimeNativeGuestEffectAnalyzer.cs b/translator/src/Translator.Core/Analysis/RuntimeNativeGuestEffectAnalyzer.cs
new file mode 100644
index 0000000..5bc5f92
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/RuntimeNativeGuestEffectAnalyzer.cs
@@ -0,0 +1,368 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+
+namespace Translator.Core.Analysis;
+
+public sealed record RuntimeNativeGuestEffectSet(
+    IReadOnlyDictionary<uint, GuestAbiContract> Contracts,
+    IReadOnlySet<uint> PreciseContracts,
+    IReadOnlySet<uint> ConservativeContracts);
+
+/// <summary>
+/// Builds architectural effect contracts for every literal native registration. Typed stubs
+/// derive their contract from the host signature; CpuContext natives are precise only when the
+/// whole body reduces to direct, constant-index member access, otherwise they get a full-context contract.
+/// </summary>
+public static class RuntimeNativeGuestEffectAnalyzer
+{
+    private static readonly Regex StubRegex = GeneratedMarkers.NativeOverrideSignaturePattern();
+    private static readonly Regex RegistrationRegex = GeneratedMarkers.NativeFunctionRegistrationPattern();
+    private static readonly Regex FatalRegex = GeneratedMarkers.FatalStubPattern();
+
+    public static RuntimeNativeGuestEffectSet AnalyzeDirectory(string directory)
+        => AnalyzeSources(NativeSourceParsing.ReadDirectory(directory));
+
+    internal static RuntimeNativeGuestEffectSet AnalyzeSources(
+        IReadOnlyList<NativeSourceFile> sources)
+    {
+        var contracts = new Dictionary<uint, GuestAbiContract>();
+        var precise = new HashSet<uint>();
+        var conservative = new HashSet<uint>();
+
+        foreach (var sourceFile in sources)
+        {
+            var source = sourceFile.Content;
+            var stubAddresses = new HashSet<uint>();
+            foreach (Match match in StubRegex.Matches(source))
+            {
+                var address = ParseAddress(match.Groups["address"].Value);
+                stubAddresses.Add(address);
+                var symbol = match.Groups["symbol"].Value;
+                var tail = match.Groups["tail"].Value;
+                var isVoid = match.Groups["void"].Success;
+                if (TryParseStubTail(tail, isVoid, out var returnType, out var arguments) &&
+                    TryAnalyzeRegisteredFunction(source, symbol, returnType, arguments, out var contract))
+                {
+                    Add(address, contract, !contract.HasFullSynchronizationFence);
+                }
+                else
+                {
+                    Add(address, CompleteContextContract(), false);
+                }
+            }
+
+            foreach (Match match in RegistrationRegex.Matches(source))
+            {
+                var address = ParseAddress(match.Groups["address"].Value);
+                if (stubAddresses.Contains(address))
+                    continue;
+                var symbol = match.Groups["symbol"].Value;
+                if (TryExtractFunction(source, symbol, out var definition) &&
+                    TryAnalyzeRegisteredFunction(source, symbol, definition.ReturnRepresentation, definition.Arguments, out var contract))
+                {
+                    Add(address, contract, !contract.HasFullSynchronizationFence);
+                }
+                else
+                {
+                    Add(address, CompleteContextContract(), false);
+                }
+            }
+
+            foreach (Match match in FatalRegex.Matches(source))
+                Add(ParseAddress(match.Groups["address"].Value), CompleteContextContract(), false);
+        }
+
+        return new RuntimeNativeGuestEffectSet(contracts, precise, conservative);
+
+        void Add(uint address, GuestAbiContract contract, bool isPrecise)
+        {
+            // Multiple registrations for one address are safe only at the
+            // intersection of their precision. A conservative contender wins.
+            if (contracts.TryGetValue(address, out var previous))
+            {
+                contract = MergeAlternativeContracts(previous, contract);
+                isPrecise = precise.Contains(address) && isPrecise && !contract.HasFullSynchronizationFence;
+            }
+            contracts[address] = contract;
+            if (isPrecise)
+            {
+                precise.Add(address);
+                conservative.Remove(address);
+            }
+            else
+            {
+                precise.Remove(address);
+                conservative.Add(address);
+            }
+        }
+    }
+
+    private sealed record FunctionDefinition(string ReturnRepresentation, string Arguments, string Body, string ContextName);
+
+    private static bool TryAnalyzeRegisteredFunction(
+        string source,
+        string symbol,
+        string returnType,
+        string arguments,
+        out GuestAbiContract contract)
+    {
+        var argumentList = NativeSourceParsing.SplitArguments(arguments).ToArray();
+        var contextArgument = argumentList
+            .Select(argument => Regex.Match(argument, @"\bCpuContext\s*\*\s*(?<name>[A-Za-z_][A-Za-z0-9_]*)"))
+            .FirstOrDefault(static match => match.Success);
+        if (contextArgument is not null && contextArgument.Success)
+        {
+            if (!TryExtractFunction(source, symbol, out var definition))
+            {
+                contract = CompleteContextContract();
+                return false;
+            }
+            contract = AnalyzeContextBody(definition.Body, contextArgument.Groups["name"].Value);
+            return true;
+        }
+
+        if (!TryExtractFunction(source, symbol, out var typedDefinition))
+        {
+            contract = CompleteContextContract();
+            return false;
+        }
+        var typedBoundaryFlags = AnalyzeBoundaryFlags(typedDefinition.Body);
+        if ((typedBoundaryFlags & GuestCallBoundaryFlags.RequiresCompleteContext) != 0)
+        {
+            contract = CompleteContextContract(typedBoundaryFlags);
+            return true;
+        }
+
+        uint gprRead = 0;
+        uint fprRead = 0;
+        var gpr = 3;
+        var fpr = 1;
+        foreach (var argument in argumentList)
+        {
+            var trimmed = argument.Trim();
+            if (trimmed.Length == 0 || trimmed.Equals("void", StringComparison.OrdinalIgnoreCase))
+                continue;
+            if (NativeSourceParsing.IsFloatingPointValueArgument(trimmed))
+            {
+                if (fpr <= 13) fprRead |= 1u << fpr;
+                ++fpr;
+            }
+            else
+            {
+                if (gpr <= 10) gprRead |= 1u << gpr;
+                else gprRead |= 1u << 1; // stack argument area
+                ++gpr;
+            }
+        }
+
+        var normalizedReturn = returnType.Trim();
+        var returnsVoid = Regex.IsMatch(normalizedReturn, @"\bvoid\s*$", RegexOptions.CultureInvariant);
+        var returnsFloat = !returnsVoid && Regex.IsMatch(normalizedReturn, @"\b(float|double)\s*$", RegexOptions.CultureInvariant);
+        var gprWrite = !returnsVoid && !returnsFloat ? 1u << 3 : 0u;
+        var fprWrite = returnsFloat ? 1u << 1 : 0u;
+        contract = new GuestAbiContract(
+            gprRead, gprWrite, gprWrite,
+            fprRead, fprWrite, fprWrite,
+            0, 0, false, false, false, false, false, false,
+            typedBoundaryFlags, Array.Empty<uint>());
+        return true;
+    }
+
+    private static GuestAbiContract AnalyzeContextBody(string body, string contextName)
+    {
+        uint gprRead = 0, gprWrite = 0, fprRead = 0, fprWrite = 0;
+        byte crRead = 0, crWrite = 0;
+        var xerRead = false; var xerWrite = false;
+        var ctrRead = false; var ctrWrite = false;
+        var lrRead = false; var lrWrite = false;
+        var flags = GuestCallBoundaryFlags.None;
+        var escapedName = Regex.Escape(contextName);
+
+        AnalyzeIndexed("gpr", 32, (index, read, write) =>
+        {
+            if (read) gprRead |= 1u << index;
+            if (write) gprWrite |= 1u << index;
+        });
+        AnalyzeIndexed("fpr", 32, (index, read, write) =>
+        {
+            if (read) fprRead |= 1u << index;
+            if (write) fprWrite |= 1u << index;
+        });
+        AnalyzeScalar("cr", (read, write) => { if (read) crRead = byte.MaxValue; if (write) crWrite = byte.MaxValue; });
+        AnalyzeScalar("xer", (read, write) => { xerRead |= read; xerWrite |= write; });
+        AnalyzeScalar("ctr", (read, write) => { ctrRead |= read; ctrWrite |= write; });
+        AnalyzeScalar("lr", (read, write) => { lrRead |= read; lrWrite |= write; });
+
+        if (Regex.IsMatch(body, $@"\b{escapedName}\s*->\s*(gpr|fpr)\s*\[\s*[^0-9\s]", RegexOptions.CultureInvariant) ||
+            Regex.IsMatch(body, $@"\b{escapedName}\s*->\s*(?!gpr\b|fpr\b|cr\b|xer\b|ctr\b|lr\b)", RegexOptions.CultureInvariant))
+            flags |= GuestCallBoundaryFlags.RequiresCompleteContext;
+
+        // Passing or aliasing the context hides arbitrary architectural access.
+        if (Regex.IsMatch(body, $@"(?:\(|,)\s*{escapedName}\s*(?:,|\))", RegexOptions.CultureInvariant) ||
+            Regex.IsMatch(body, $@"[=&]\s*{escapedName}\s*;", RegexOptions.CultureInvariant))
+            flags |= GuestCallBoundaryFlags.RequiresCompleteContext;
+
+        flags |= AnalyzeBoundaryFlags(body);
+
+        if ((flags & GuestCallBoundaryFlags.RequiresCompleteContext) != 0)
+            return CompleteContextContract(flags);
+
+        return new GuestAbiContract(
+            gprRead, gprWrite, gprWrite & ((1u << 3) | (1u << 4)),
+            fprRead, fprWrite, fprWrite & (1u << 1),
+            crRead, crWrite, xerRead, xerWrite, ctrRead, ctrWrite, lrRead, lrWrite,
+            flags, Array.Empty<uint>());
+
+        void AnalyzeIndexed(string member, int count, Action<int, bool, bool> add)
+        {
+            var regex = new Regex($@"\b{escapedName}\s*->\s*{member}\s*\[\s*(?<index>[0-9]+)\s*\](?:\s*\.\s*[A-Za-z_][A-Za-z0-9_]*)?", RegexOptions.CultureInvariant);
+            foreach (Match match in regex.Matches(body))
+            {
+                if (!int.TryParse(match.Groups["index"].Value, out var index) || index < 0 || index >= count)
+                {
+                    flags |= GuestCallBoundaryFlags.RequiresCompleteContext;
+                    continue;
+                }
+                var (read, write) = ClassifyAccess(body, match.Index + match.Length);
+                add(index, read, write);
+            }
+        }
+
+        void AnalyzeScalar(string member, Action<bool, bool> add)
+        {
+            var regex = new Regex($@"\b{escapedName}\s*->\s*{member}\b", RegexOptions.CultureInvariant);
+            foreach (Match match in regex.Matches(body))
+            {
+                var (read, write) = ClassifyAccess(body, match.Index + match.Length);
+                add(read, write);
+            }
+        }
+    }
+
+    private static GuestCallBoundaryFlags AnalyzeBoundaryFlags(string body)
+    {
+        var flags = GuestCallBoundaryFlags.None;
+        // A typed stub's contract comes from its C++ signature alone, so a body that reaches for
+        // CpuContext can touch architectural state the signature never mentions. Real case:
+        // 0x801AAD7C (__OSGetSystemTime) is `uint32_t (...)` but writes r3 and r4 via
+        // CurrentCpuContext(); a narrowed boundary left r4 stale and wedged RFL's loader.
+        if (Regex.IsMatch(body,
+                @"\b(CurrentCpuContext|TryGetCpuContext|GetPersistentCpuContext|CpuContextScope)\b",
+                RegexOptions.CultureInvariant))
+            flags |= GuestCallBoundaryFlags.RequiresCompleteContext;
+        if (Regex.IsMatch(body, @"\b(InvokeDirectCpu|InvokeIndirectCpu|InvokeIndirectJump|InvokeGuestCallback)\b", RegexOptions.CultureInvariant))
+            flags |= GuestCallBoundaryFlags.InvokesGuestCode | GuestCallBoundaryFlags.RequiresCompleteContext;
+        if (Regex.IsMatch(body, @"\b(YieldToScheduler|SuspendCurrent|SleepCurrent|WaitFor|BlockCurrent)\b", RegexOptions.CultureInvariant))
+            flags |= GuestCallBoundaryFlags.CanSuspend | GuestCallBoundaryFlags.RequiresCompleteContext;
+        if (Regex.IsMatch(body, @"\b(SwitchTo|SelectThread|RunReadyThreads|ScheduleThread)\b", RegexOptions.CultureInvariant))
+            flags |= GuestCallBoundaryFlags.CanSwitchThreads | GuestCallBoundaryFlags.RequiresCompleteContext;
+        return flags;
+    }
+
+    private static (bool Read, bool Write) ClassifyAccess(string body, int end)
+    {
+        var tail = body.AsSpan(end).TrimStart();
+        if (tail.StartsWith("++", StringComparison.Ordinal) || tail.StartsWith("--", StringComparison.Ordinal)) return (true, true);
+        if (tail.StartsWith("+=", StringComparison.Ordinal) || tail.StartsWith("-=", StringComparison.Ordinal) ||
+            tail.StartsWith("*=", StringComparison.Ordinal) || tail.StartsWith("/=", StringComparison.Ordinal) ||
+            tail.StartsWith("|=", StringComparison.Ordinal) || tail.StartsWith("&=", StringComparison.Ordinal) ||
+            tail.StartsWith("^=", StringComparison.Ordinal)) return (true, true);
+        if (tail.StartsWith("=", StringComparison.Ordinal) && !tail.StartsWith("==", StringComparison.Ordinal)) return (false, true);
+        return (true, false);
+    }
+
+    private static bool TryParseStubTail(string tail, bool isVoid, out string returnType, out string arguments)
+    {
+        returnType = "void";
+        arguments = string.Empty;
+        var cursor = 0;
+        if (!isVoid)
+        {
+            var comma = FindTopLevelComma(tail, cursor);
+            if (comma < 0) return false;
+            returnType = tail[..comma].Trim();
+            cursor = comma + 1;
+        }
+        while (cursor < tail.Length && char.IsWhiteSpace(tail[cursor])) ++cursor;
+        if (cursor >= tail.Length || tail[cursor] != '(') return false;
+        var close = FindMatching(tail, cursor, '(', ')');
+        if (close < 0) return false;
+        arguments = tail[(cursor + 1)..close];
+        return true;
+    }
+
+    private static bool TryExtractFunction(string source, string symbol, out FunctionDefinition definition)
+    {
+        var regex = new Regex($@"(?:extern\s+\""C\""\s+)?(?<return>[A-Za-z_][A-Za-z0-9_:<>\s*&]*?)\b{Regex.Escape(symbol)}\s*\((?<args>[^)]*)\)\s*(?:noexcept\s*)?\{{", RegexOptions.CultureInvariant);
+        foreach (Match match in regex.Matches(source))
+        {
+            var open = match.Index + match.Length - 1;
+            var close = FindMatching(source, open, '{', '}');
+            if (close < 0) continue;
+            var args = match.Groups["args"].Value;
+            var context = Regex.Match(args, @"\bCpuContext\s*\*\s*(?<name>[A-Za-z_][A-Za-z0-9_]*)");
+            definition = new FunctionDefinition(
+                match.Groups["return"].Value.Trim(),
+                args,
+                source[(open + 1)..close],
+                context.Success ? context.Groups["name"].Value : string.Empty);
+            return true;
+        }
+        definition = null!;
+        return false;
+    }
+
+    private static GuestAbiContract CompleteContextContract(GuestCallBoundaryFlags extra = GuestCallBoundaryFlags.None) =>
+        new(uint.MaxValue, uint.MaxValue, (1u << 3) | (1u << 4),
+            uint.MaxValue, uint.MaxValue, 1u << 1,
+            byte.MaxValue, byte.MaxValue, true, true, true, true, true, true,
+            extra | GuestCallBoundaryFlags.RequiresCompleteContext, Array.Empty<uint>());
+
+    private static GuestAbiContract MergeAlternativeContracts(GuestAbiContract left, GuestAbiContract right) =>
+        new(left.GprReadBeforeWriteMask | right.GprReadBeforeWriteMask,
+            left.GprPossibleWriteMask | right.GprPossibleWriteMask,
+            left.GprReturnMask | right.GprReturnMask,
+            left.FprReadBeforeWriteMask | right.FprReadBeforeWriteMask,
+            left.FprPossibleWriteMask | right.FprPossibleWriteMask,
+            left.FprReturnMask | right.FprReturnMask,
+            (byte)(left.CrReadBeforeWriteMask | right.CrReadBeforeWriteMask),
+            (byte)(left.CrPossibleWriteMask | right.CrPossibleWriteMask),
+            left.ReadsXerBeforeWrite || right.ReadsXerBeforeWrite,
+            left.MayWriteXer || right.MayWriteXer,
+            left.ReadsCtrBeforeWrite || right.ReadsCtrBeforeWrite,
+            left.MayWriteCtr || right.MayWriteCtr,
+            left.ReadsLrBeforeWrite || right.ReadsLrBeforeWrite,
+            left.MayWriteLr || right.MayWriteLr,
+            left.BoundaryFlags | right.BoundaryFlags,
+            Array.Empty<uint>());
+
+    private static int FindTopLevelComma(string text, int start)
+    {
+        var depth = 0;
+        for (var index = start; index < text.Length; ++index)
+        {
+            if (text[index] is '(' or '[' or '<') ++depth;
+            else if (text[index] is ')' or ']' or '>') depth = Math.Max(0, depth - 1);
+            else if (text[index] == ',' && depth == 0) return index;
+        }
+        return -1;
+    }
+
+    private static int FindMatching(string text, int open, char openChar, char closeChar)
+    {
+        var depth = 0;
+        for (var index = open; index < text.Length; ++index)
+        {
+            if (text[index] == openChar) ++depth;
+            else if (text[index] == closeChar && --depth == 0) return index;
+        }
+        return -1;
+    }
+
+    private static uint ParseAddress(string value) => GuestTargetParser.ParseHexAddress(value);
+
+}
diff --git a/translator/src/Translator.Core/Analysis/Ssa/SsaTransformer.cs b/translator/src/Translator.Core/Analysis/Ssa/SsaTransformer.cs
new file mode 100644
index 0000000..5e7af95
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/Ssa/SsaTransformer.cs
@@ -0,0 +1,1265 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Numerics;
+using Translator.Core;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Analysis.Ssa;
+
+/// <summary>
+/// Converts an untyped IR function into SSA form with explicit phi nodes and performs
+/// a basic use-def validation. The implementation is intentionally conservative and
+/// works on the lightweight IR used in early translator phases.
+/// </summary>
+public sealed class SsaTransformer
+{
+    public SsaResult Convert(IrFunction function)
+    {
+        if (function.Blocks.Count == 0)
+        {
+            throw new ArgumentException("Function must contain at least one basic block.", nameof(function));
+        }
+
+        var cfg = IrCfg.Build(function);
+        var dominators = ComputeDominators(cfg);
+        var idom = ComputeImmediateDominators(dominators);
+        var dominanceFrontier = ComputeDominanceFrontier(cfg, dominators, idom);
+
+        // Insert minimal phi nodes based on dominance frontier of definitions.
+        var withPhis = InsertPhiNodes(function, cfg, dominanceFrontier);
+
+        // Rename to SSA.
+        var renamed = RenameToSsa(withPhis, cfg, idom);
+
+        return new SsaResult(renamed, cfg);
+    }
+
+    /// <summary>
+    /// Dominator sets kept as bitsets indexed by block ordinal. Expanding them into
+    /// <c>Dictionary&lt;string, HashSet&lt;string&gt;&gt;</c> costs O(B^2) string hashing and
+    /// allocation for no benefit, so every consumer works on the bitsets directly.
+    /// </summary>
+    private readonly struct DominatorBits
+    {
+        public DominatorBits(List<string> blocks, Dictionary<string, int> index, ulong[][] bits, int words)
+        {
+            Blocks = blocks;
+            Index = index;
+            Bits = bits;
+            Words = words;
+            LastWordMask = blocks.Count % 64 == 0 ? ulong.MaxValue : (1UL << (blocks.Count % 64)) - 1;
+        }
+
+        /// <summary>Block labels in CFG enumeration order; the ordinal of a block is its position here.</summary>
+        public List<string> Blocks { get; }
+
+        public Dictionary<string, int> Index { get; }
+
+        public ulong[][] Bits { get; }
+
+        public int Words { get; }
+
+        /// <summary>Valid bits of the final word; the solver leaves padding bits set.</summary>
+        public ulong LastWordMask { get; }
+
+        /// <summary>True when <paramref name="dominator"/> belongs to the dominator set of <paramref name="block"/>.</summary>
+        public bool Dominates(int dominator, int block) =>
+            (Bits[block][dominator / 64] & (1UL << (dominator % 64))) != 0;
+
+        /// <summary>Word <paramref name="word"/> of a dominator set with padding bits cleared.</summary>
+        public ulong Word(int block, int word) =>
+            word == Words - 1 ? Bits[block][word] & LastWordMask : Bits[block][word];
+    }
+
+    private static DominatorBits ComputeDominators(IrCfg cfg)
+    {
+        // Use a more efficient worklist-based approach
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var blockList = cfg.Blocks.Keys.ToList();
+        var blockIndex = blockList.Select((b, i) => (b, i)).ToDictionary(x => x.b, x => x.i, comparer);
+        var n = blockList.Count;
+        
+        // Use bit sets for faster intersection
+        var domBits = new ulong[n][];
+        var wordsNeeded = (n + 63) / 64;
+        for (var i = 0; i < n; i++)
+        {
+            domBits[i] = new ulong[wordsNeeded];
+            // Initialize all blocks to dominate by all (all bits set)
+            for (var w = 0; w < wordsNeeded; w++)
+            {
+                domBits[i][w] = ulong.MaxValue;
+            }
+        }
+        
+        // Entry dominates only itself
+        var entryIdx = blockIndex[cfg.Entry];
+        Array.Clear(domBits[entryIdx]);
+        domBits[entryIdx][entryIdx / 64] = 1UL << (entryIdx % 64);
+
+        var changed = true;
+        var temp = new ulong[wordsNeeded];
+        while (changed)
+        {
+            changed = false;
+            for (var i = 0; i < n; i++)
+            {
+                var block = blockList[i];
+                if (comparer.Equals(block, cfg.Entry))
+                {
+                    continue;
+                }
+
+                var preds = cfg.Predecessors(block);
+                if (preds.Count == 0)
+                {
+                    // Unreachable block - it only dominates itself. Only report
+                    // a change until the bitset reaches that fixed point.
+                    var differsFromSelfOnly = false;
+                    for (var w = 0; w < wordsNeeded; w++)
+                    {
+                        var expected = w == i / 64 ? 1UL << (i % 64) : 0UL;
+                        if (domBits[i][w] != expected)
+                        {
+                            differsFromSelfOnly = true;
+                            break;
+                        }
+                    }
+                    if (differsFromSelfOnly)
+                    {
+                        Array.Clear(domBits[i]);
+                        domBits[i][i / 64] |= 1UL << (i % 64);
+                        changed = true;
+                    }
+                    continue;
+                }
+
+                // Compute intersection of all predecessors
+                var firstPredIdx = blockIndex[preds[0]];
+                Array.Copy(domBits[firstPredIdx], temp, wordsNeeded);
+                for (var p = 1; p < preds.Count; p++)
+                {
+                    var predIdx = blockIndex[preds[p]];
+                    for (var w = 0; w < wordsNeeded; w++)
+                    {
+                        temp[w] &= domBits[predIdx][w];
+                    }
+                }
+                
+                // Add self
+                temp[i / 64] |= 1UL << (i % 64);
+
+                // Check if changed
+                for (var w = 0; w < wordsNeeded; w++)
+                {
+                    if (domBits[i][w] != temp[w])
+                    {
+                        changed = true;
+                        Array.Copy(temp, domBits[i], wordsNeeded);
+                        break;
+                    }
+                }
+            }
+        }
+
+        return new DominatorBits(blockList, blockIndex, domBits, wordsNeeded);
+    }
+
+    private static Dictionary<string, string?> ComputeImmediateDominators(DominatorBits dominators)
+    {
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var idom = new Dictionary<string, string?>(comparer);
+        var blocks = dominators.Blocks;
+        var n = blocks.Count;
+        var words = dominators.Words;
+
+        // Cardinality of every dominator set. The strict dominators of a block are totally
+        // ordered by dominance, so the immediate dominator is exactly the strict dominator
+        // with the largest dominator set - no O(B) "dominates nobody else" scan per candidate.
+        var domSize = new int[n];
+        for (var i = 0; i < n; i++)
+        {
+            var size = 0;
+            for (var w = 0; w < words; w++)
+            {
+                size += BitOperations.PopCount(dominators.Word(i, w));
+            }
+
+            domSize[i] = size;
+        }
+
+        // Candidates are enumerated by ascending ordinal, which is the insertion (and therefore
+        // enumeration) order the string dominator sets used to produce.
+        var candidates = new List<int>();
+        for (var i = 0; i < n; i++)
+        {
+            candidates.Clear();
+            var best = -1;
+            for (var w = 0; w < words; w++)
+            {
+                var word = dominators.Word(i, w);
+                if (w == i / 64)
+                {
+                    word &= ~(1UL << (i % 64));
+                }
+
+                while (word != 0)
+                {
+                    var candidate = (w * 64) + BitOperations.TrailingZeroCount(word);
+                    word &= word - 1;
+                    candidates.Add(candidate);
+                    if (best < 0 || domSize[candidate] > domSize[best])
+                    {
+                        best = candidate;
+                    }
+                }
+            }
+
+            if (candidates.Count == 0)
+            {
+                idom[blocks[i]] = null;
+                continue;
+            }
+
+            var chosen = IsImmediateDominator(dominators, i, candidates, best)
+                ? best
+                : ResolveImmediateDominatorExhaustive(dominators, candidates);
+            idom[blocks[i]] = chosen < 0 ? null : blocks[chosen];
+        }
+
+        return idom;
+    }
+
+    /// <summary>
+    /// Confirms that <paramref name="best"/> is the unique candidate that dominates no other
+    /// candidate, which is the property the exhaustive search selects on.
+    /// </summary>
+    private static bool IsImmediateDominator(DominatorBits dominators, int block, List<int> candidates, int best)
+    {
+        // Dom(best) must equal the strict dominator set of the block. That proves every other
+        // candidate dominates best, so no other candidate can qualify.
+        for (var w = 0; w < dominators.Words; w++)
+        {
+            var strict = dominators.Word(block, w);
+            if (w == block / 64)
+            {
+                strict &= ~(1UL << (block % 64));
+            }
+
+            if (strict != dominators.Word(best, w))
+            {
+                return false;
+            }
+        }
+
+        // ...and best itself must dominate none of them.
+        foreach (var candidate in candidates)
+        {
+            if (candidate != best && dominators.Dominates(best, candidate))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// Exact O(k^2) fallback for degenerate dominance relations (for example a cycle that is
+    /// unreachable from the entry keeps an all-ones dominator set, so its strict dominators are
+    /// not totally ordered). Returns the first candidate that dominates no other candidate.
+    /// </summary>
+    private static int ResolveImmediateDominatorExhaustive(DominatorBits dominators, List<int> candidates)
+    {
+        foreach (var candidate in candidates)
+        {
+            var isImmediate = true;
+            foreach (var other in candidates)
+            {
+                if (other == candidate)
+                {
+                    continue;
+                }
+
+                // If candidate dominates other, then candidate is not immediate.
+                if (dominators.Dominates(candidate, other))
+                {
+                    isImmediate = false;
+                    break;
+                }
+            }
+
+            if (isImmediate)
+            {
+                return candidate;
+            }
+        }
+
+        return -1;
+    }
+
+    private static Dictionary<string, HashSet<string>> ComputeDominanceFrontier(IrCfg cfg, DominatorBits dominators, Dictionary<string, string?> idom)
+    {
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var df = cfg.Blocks.Keys.ToDictionary(label => label, _ => new HashSet<string>(comparer), comparer);
+        var blocks = dominators.Blocks;
+        var n = blocks.Count;
+
+        // Ordinal views of the walk inputs so the runner loop is pure integer work.
+        var idomIndex = new int[n];
+        var frontiers = new HashSet<string>[n];
+        for (var i = 0; i < n; i++)
+        {
+            var immediate = idom.TryGetValue(blocks[i], out var value) ? value : null;
+            idomIndex[i] = immediate == null ? -1 : dominators.Index[immediate];
+            frontiers[i] = df[blocks[i]];
+        }
+
+        for (var i = 0; i < n; i++)
+        {
+            var block = blocks[i];
+            var preds = cfg.Predecessors(block);
+            if (preds.Count < 2)
+            {
+                continue;
+            }
+
+            for (var p = 0; p < preds.Count; p++)
+            {
+                var runner = dominators.Index[preds[p]];
+                while (!dominators.Dominates(runner, i) || runner == i)
+                {
+                    frontiers[runner].Add(block);
+                    var immediateRunner = idomIndex[runner];
+                    if (immediateRunner < 0 || immediateRunner == runner)
+                    {
+                        break;
+                    }
+
+                    runner = immediateRunner;
+                }
+            }
+        }
+
+        return df;
+    }
+
+    private static IrFunction InsertPhiNodes(IrFunction function, IrCfg cfg, Dictionary<string, HashSet<string>> dominanceFrontier)
+    {
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        // Map variable name -> blocks containing definitions.
+        var defSites = new Dictionary<string, HashSet<string>>(comparer);
+        foreach (var block in function.Blocks)
+        {
+            foreach (var def in DefinitionsIn(block))
+            {
+                if (IsBlockLocalTemp(def))
+                {
+                    continue;
+                }
+
+                if (!defSites.TryGetValue(def, out var set))
+                {
+                    set = new HashSet<string>(comparer);
+                    defSites[def] = set;
+                }
+                set.Add(block.Label);
+            }
+        }
+
+        var newBlocks = function.Blocks.ToDictionary(b => b.Label, b => b.Instructions.ToList(), comparer);
+        // Phis are always inserted at index 0; collecting them per block and prepending once
+        // avoids the O(n) memmove every Insert(0, ...) would cost.
+        var pendingPhis = new Dictionary<string, List<IrPhi>>(comparer);
+
+        foreach (var (variable, defBlocks) in defSites)
+        {
+            var worklist = new Queue<string>(defBlocks);
+            // The variable is fixed for this loop, so only the block has to be tracked.
+            var hasAlready = new HashSet<string>(StringComparer.Ordinal);
+
+            while (worklist.Count > 0)
+            {
+                var x = worklist.Dequeue();
+                if (!dominanceFrontier.TryGetValue(x, out var dfSet))
+                {
+                    continue;
+                }
+                foreach (var y in dfSet)
+                {
+                    if (!hasAlready.Add(y))
+                    {
+                        continue;
+                    }
+
+                    // Insert phi at start of block.
+                    if (!pendingPhis.TryGetValue(y, out var phis))
+                    {
+                        phis = new List<IrPhi>();
+                        pendingPhis[y] = phis;
+                    }
+                    phis.Add(new IrPhi(variable, new Dictionary<string, string>()));
+
+                    if (!defBlocks.Contains(y))
+                    {
+                        worklist.Enqueue(y);
+                    }
+                }
+            }
+        }
+
+        foreach (var (label, phis) in pendingPhis)
+        {
+            // Reversed: each phi was conceptually pushed in front of the previously inserted ones.
+            var body = newBlocks[label];
+            var merged = new List<IrInstruction>(phis.Count + body.Count);
+            for (var i = phis.Count - 1; i >= 0; i--)
+            {
+                merged.Add(phis[i]);
+            }
+            merged.AddRange(body);
+            newBlocks[label] = merged;
+        }
+
+        var rebuilt = newBlocks.Select(kv => new IrBasicBlock(kv.Key, kv.Value)).ToList();
+        return new IrFunction(function.Name, function.EntryLabel, rebuilt);
+    }
+
+    private static IEnumerable<string> DefinitionsIn(IrBasicBlock block)
+    {
+        foreach (var ins in block.Instructions)
+        {
+            switch (ins)
+            {
+                case IrAssign assign:
+                    yield return Base(assign.Destination);
+                    break;
+                case IrBinary binary:
+                    yield return Base(binary.Destination);
+                    break;
+                case IrLoad load:
+                    yield return Base(load.Destination);
+                    break;
+                case IrCall call when !string.IsNullOrWhiteSpace(call.Destination):
+                    yield return Base(call.Destination);
+                    break;
+                case IrIndirectCall icall when !string.IsNullOrWhiteSpace(icall.Destination):
+                    yield return Base(icall.Destination);
+                    break;
+                case IrPhi phi:
+                    yield return Base(phi.Destination);
+                    break;
+            }
+        }
+    }
+
+    private static bool IsBlockLocalTemp(string name) =>
+        name.StartsWith("addr_", StringComparison.OrdinalIgnoreCase) &&
+        name.EndsWith("_loc", StringComparison.OrdinalIgnoreCase);
+
+    private static IrFunction RenameToSsa(IrFunction withPhis, IrCfg cfg, Dictionary<string, string?> idom)
+    {
+        // Precompute dominated children using idom
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var domChildren = cfg.Blocks.Keys.ToDictionary(k => k, _ => new List<string>(), comparer);
+        foreach (var (block, immediateD) in idom)
+        {
+            if (immediateD != null)
+            {
+                domChildren[immediateD].Add(block);
+            }
+        }
+
+        // Work on mutable instruction lists so phi source updates are reflected in the final output.
+        var workingBlocks = withPhis.Blocks.ToDictionary(b => b.Label, b => b.Instructions.ToList(), comparer);
+
+        // Renaming replaces instructions in place only, so phi positions stay stable; caching them
+        // keeps the successor update from rescanning entire blocks per CFG edge.
+        var phiPositions = new Dictionary<string, int[]>(comparer);
+        foreach (var (label, instructions) in workingBlocks)
+        {
+            List<int>? positions = null;
+            for (var i = 0; i < instructions.Count; i++)
+            {
+                if (instructions[i] is IrPhi)
+                {
+                    (positions ??= new List<int>()).Add(i);
+                }
+            }
+
+            if (positions != null)
+            {
+                phiPositions[label] = positions.ToArray();
+            }
+        }
+
+        var stacks = new Dictionary<string, Stack<string>>(comparer);
+        var nextVersions = new Dictionary<string, int>(comparer);
+        var renamedBlocks = new Dictionary<string, List<IrInstruction>>(comparer);
+        var activeRenameBlocks = new HashSet<string>(comparer);
+
+        // Explicit work stack instead of recursion, since large functions' dominator trees can
+        // overflow the CLR stack. A frame with a non-null pop list is the post-order half of a visit.
+        var work = new Stack<(string Label, List<(string variable, string version)>? Pops)>();
+        work.Push((cfg.Entry, null));
+
+        while (work.Count > 0)
+        {
+            var (label, pops) = work.Pop();
+            if (pops != null)
+            {
+                // Pop definitions after children are processed.
+                for (var i = pops.Count - 1; i >= 0; i--)
+                {
+                    stacks[pops[i].variable].Pop();
+                }
+
+                activeRenameBlocks.Remove(label);
+                continue;
+            }
+
+            if (!activeRenameBlocks.Add(label))
+            {
+                throw new InvalidOperationException($"Cycle in dominator tree while renaming block {label}.");
+            }
+
+            var instructions = workingBlocks[label];
+            var definedHere = new List<(string variable, string version)>();
+
+            // Rename phi definitions first.
+            if (phiPositions.TryGetValue(label, out var phiIndices))
+            {
+                foreach (var i in phiIndices)
+                {
+                    if (instructions[i] is not IrPhi phi)
+                    {
+                        continue;
+                    }
+
+                    var newName = NewVersion(phi.Destination, stacks, nextVersions);
+                    definedHere.Add((Base(phi.Destination), newName));
+                    instructions[i] = new IrPhi(newName, new Dictionary<string, string>(phi.Sources));
+                }
+            }
+
+            for (var i = 0; i < instructions.Count; i++)
+            {
+                var ins = instructions[i];
+                instructions[i] = RenameInstruction(ins, stacks, nextVersions, definedHere);
+            }
+
+            renamedBlocks[label] = instructions;
+
+            // Update successor phi inputs using the current version at end of block.
+            foreach (var succ in cfg.Successors(label))
+            {
+                if (!workingBlocks.TryGetValue(succ, out var succList))
+                {
+                    continue;
+                }
+
+                if (!phiPositions.TryGetValue(succ, out var succPhiIndices))
+                {
+                    continue;
+                }
+
+                foreach (var i in succPhiIndices)
+                {
+                    if (succList[i] is not IrPhi phi)
+                    {
+                        continue;
+                    }
+
+                    var baseVar = Base(phi.Destination);
+                    var current = CurrentVersion(baseVar, stacks, nextVersions);
+                    var sources = new Dictionary<string, string>(phi.Sources)
+                    {
+                        [label] = current
+                    };
+                    succList[i] = new IrPhi(phi.Destination, sources);
+                }
+            }
+
+            work.Push((label, definedHere));
+
+            // Use precomputed dominated children.
+            var children = domChildren[label];
+            for (var i = children.Count - 1; i >= 0; i--)
+            {
+                work.Push((children[i], null));
+            }
+        }
+
+        // Some blocks may be unreachable due to conservative CFG pruning; keep their original
+        // instruction lists so consumers don't fail lookups.
+        foreach (var block in withPhis.Blocks)
+        {
+            if (!renamedBlocks.ContainsKey(block.Label))
+            {
+                renamedBlocks[block.Label] = block.Instructions.ToList();
+            }
+        }
+
+        // Preserve the original block order so later structuring keeps fallthrough semantics.
+        var rebuilt = withPhis.Blocks
+            .Select(b => new IrBasicBlock(b.Label, renamedBlocks[b.Label]))
+            .ToList();
+        return new IrFunction(withPhis.Name, withPhis.EntryLabel, rebuilt);
+    }
+
+    private static IrInstruction RenameInstruction(IrInstruction ins, Dictionary<string, Stack<string>> stacks,
+        Dictionary<string, int> nextVersions, List<(string variable, string version)> definedHere)
+    {
+        switch (ins)
+        {
+            case IrAssign assign:
+                return assign with
+                {
+                    Value = RenameValue(assign.Value, stacks, nextVersions),
+                    Destination = Register(NewVersion(assign.Destination, stacks, nextVersions), definedHere)
+                };
+
+            case IrBinary bin:
+                return bin with
+                {
+                    Left = RenameValue(bin.Left, stacks, nextVersions),
+                    Right = RenameValue(bin.Right, stacks, nextVersions),
+                    Destination = Register(NewVersion(bin.Destination, stacks, nextVersions), definedHere)
+                };
+
+            case IrLoad load:
+                return load with
+                {
+                    Address = RenameAddress(load.Address, stacks, nextVersions),
+                    Destination = Register(NewVersion(load.Destination, stacks, nextVersions), definedHere)
+                };
+
+            case IrStore store:
+                return store with
+                {
+                    Address = RenameAddress(store.Address, stacks, nextVersions),
+                    Source = RenameValue(store.Source, stacks, nextVersions)
+                };
+
+            case IrCall call:
+                var args = call.Arguments.Select(a => RenameValue(a, stacks, nextVersions)).ToList();
+                var dest = string.IsNullOrWhiteSpace(call.Destination)
+                    ? string.Empty
+                    : Register(NewVersion(call.Destination, stacks, nextVersions), definedHere);
+                return call with { Destination = dest, Arguments = args };
+
+            case IrIndirectCall icall:
+                // Important: rename the target before allocating a new version for the destination.
+                // When destination and target refer to the same register (e.g., LR for blrl),
+                // renaming in the opposite order would clobber the call target with the freshly
+                // assigned version, leading to null/garbage indirect calls in generated code.
+                var icallTarget = RenameValue(icall.Target, stacks, nextVersions);
+                var icallArgs = icall.Arguments.Select(a => RenameValue(a, stacks, nextVersions)).ToList();
+                var icallDest = string.IsNullOrWhiteSpace(icall.Destination)
+                    ? string.Empty
+                    : Register(NewVersion(icall.Destination, stacks, nextVersions), definedHere);
+                return icall with { Destination = icallDest, Arguments = icallArgs, Target = icallTarget };
+
+            case IrSetCrField setCr:
+                return setCr with
+                {
+                    Left = RenameValue(setCr.Left, stacks, nextVersions),
+                    Right = RenameValue(setCr.Right, stacks, nextVersions)
+                };
+
+            case IrBranch branch:
+                return IrRegisterDataFlow.IsRegisterName(branch.ConditionRegister)
+                    ? branch with { ConditionRegister = CurrentVersion(Base(branch.ConditionRegister), stacks, nextVersions) }
+                    : branch;
+
+            case IrIndirectJump ijump:
+                return ijump with { Target = RenameValue(ijump.Target, stacks, nextVersions) };
+
+            case IrJumpTable table:
+                return table with { Selector = CurrentVersion(Base(table.Selector), stacks, nextVersions) };
+
+            case IrJump or IrReturn or IrComment or IrTracePpc or IrUndefined:
+                return ins switch
+                {
+                    IrReturn r when r.Value != null => r with { Value = RenameValue(r.Value, stacks, nextVersions) },
+                    _ => ins
+                };
+
+            case IrPhi phi:
+                return phi; // already renamed at definition time; sources filled separately.
+
+            default:
+                return ins;
+        }
+    }
+
+    private static string Register(string name, List<(string variable, string version)> definedHere)
+    {
+        definedHere.Add((Base(name), name));
+        return name;
+    }
+
+    private static IrValue RenameValue(IrValue val, Dictionary<string, Stack<string>> stacks,
+        Dictionary<string, int> nextVersions) =>
+        val.Kind == "register" && val.RegisterName != null
+            ? val with { RegisterName = CurrentVersion(Base(val.RegisterName), stacks, nextVersions) }
+            : val;
+
+    private static IrAddress RenameAddress(IrAddress address, Dictionary<string, Stack<string>> stacks,
+        Dictionary<string, int> nextVersions)
+    {
+        var renamedBase = CurrentVersion(Base(address.Base), stacks, nextVersions);
+        return new IrAddress(renamedBase, address.Offset);
+    }
+
+    private static string NewVersion(string original, Dictionary<string, Stack<string>> stacks,
+        Dictionary<string, int> nextVersions)
+    {
+        var baseName = Base(original);
+        if (!stacks.TryGetValue(baseName, out var stack))
+        {
+            stack = new Stack<string>();
+            stacks[baseName] = stack;
+        }
+
+        var nextId = nextVersions.GetValueOrDefault(baseName);
+        nextVersions[baseName] = nextId + 1;
+        var version = $"{baseName}_{nextId}";
+        stack.Push(version);
+        return version;
+    }
+
+    private static string CurrentVersion(string baseName, Dictionary<string, Stack<string>> stacks,
+        Dictionary<string, int> nextVersions)
+    {
+        if (!stacks.TryGetValue(baseName, out var stack) || stack.Count == 0)
+        {
+            // If a use appears before any definition, treat it as an implicit parameter.
+            return NewVersion(baseName, stacks, nextVersions);
+        }
+
+        return stack.Peek();
+    }
+
+    private static string Base(string name) => RegisterNameUtils.StripNumericSuffix(name);
+
+}
+
+public sealed class IrCfg
+{
+    public Dictionary<string, IrBasicBlock> Blocks { get; }
+    public string Entry { get; }
+    public Dictionary<string, List<string>> Succ { get; }
+    private readonly Dictionary<string, List<string>> _pred;
+
+    public IrCfg(Dictionary<string, IrBasicBlock> blocks, string entry, Dictionary<string, List<string>> succ)
+    {
+        Blocks = blocks;
+        Entry = entry;
+        Succ = succ;
+        // Precompute predecessors once to avoid O(n) per query
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        _pred = blocks.Keys.ToDictionary(k => k, _ => new List<string>(), comparer);
+        foreach (var (from, targets) in succ)
+        {
+            foreach (var to in targets)
+            {
+                if (_pred.TryGetValue(to, out var list))
+                {
+                    list.Add(from);
+                }
+            }
+        }
+    }
+
+    public IReadOnlyList<string> Successors(string label) => Succ.TryGetValue(label, out var s) ? s : Array.Empty<string>();
+    public IReadOnlyList<string> Predecessors(string label) => _pred.TryGetValue(label, out var p) ? p : Array.Empty<string>();
+
+    public static IrCfg Build(IrFunction function)
+    {
+        // Use case-insensitive lookup so label casing differences (e.g. disassembler vs. lifter)
+        // don't break CFG construction for self-edges/back-edges such as "bdnz" loops.
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var blocks = function.Blocks.ToDictionary(b => b.Label, b => b, comparer);
+        var succ = function.Blocks.ToDictionary(b => b.Label, _ => new List<string>(), comparer);
+
+        for (var i = 0; i < function.Blocks.Count; i++)
+        {
+            var block = function.Blocks[i];
+            if (block.Instructions.Count == 0)
+            {
+                continue;
+            }
+
+            var term = block.Instructions[^1];
+            var addedEdge = false;
+            switch (term)
+            {
+                case IrBranch br:
+                    if (blocks.TryGetValue(br.TrueLabel, out var trueTarget))
+                    {
+                        succ[block.Label].Add(trueTarget.Label);
+                        addedEdge = true;
+                    }
+                    if (blocks.TryGetValue(br.FalseLabel, out var falseTarget))
+                    {
+                        succ[block.Label].Add(falseTarget.Label);
+                        addedEdge = true;
+                    }
+                    break;
+                case IrJump j:
+                    if (blocks.TryGetValue(j.TargetLabel, out var jumpTarget))
+                    {
+                        succ[block.Label].Add(jumpTarget.Label);
+                        addedEdge = true;
+                    }
+                    break;
+                case IrIndirectJump:
+                    // Indirect jumps have dynamic targets; conservatively no static successors.
+                    // The terminator check below will still prevent fallthrough.
+                    break;
+                case IrJumpTable table:
+                    foreach (var jt in table.Cases)
+                    {
+                        if (blocks.TryGetValue(jt.TargetLabel, out var jtTarget))
+                        {
+                            if (!succ[block.Label].Contains(jtTarget.Label))
+                            {
+                                succ[block.Label].Add(jtTarget.Label);
+                            }
+                            addedEdge = true;
+                        }
+                    }
+                    break;
+            }
+
+            // Implicit fallthrough when block doesn't end in an explicit control transfer.
+            var hasTerminator = term is IrBranch or IrJump or IrReturn or IrIndirectJump or IrJumpTable or IrUndefined;
+            if (!hasTerminator && !addedEdge && i + 1 < function.Blocks.Count)
+            {
+                var next = function.Blocks[i + 1];
+                if (!succ[block.Label].Contains(next.Label))
+                {
+                    succ[block.Label].Add(next.Label);
+                }
+            }
+        }
+
+        return new IrCfg(blocks, function.EntryLabel, succ);
+    }
+}
+
+public sealed record SsaResult(IrFunction Function, IrCfg Cfg)
+{
+    /// <summary>
+    /// Verifies that every register use has a dominating definition using a simple
+    /// forward data-flow analysis across the CFG.
+    /// </summary>
+    public void ValidateUseDef()
+    {
+        // Names are interned to dense indices so each block's set is a few ulong words and a
+        // fixpoint round is word-wise ANDs instead of hashing a fresh HashSet per block. Walk
+        // order and the ABI fallback are unchanged, so the pass/throw outcome is identical.
+        var blocks = Function.Blocks;
+        var blockCount = blocks.Count;
+        var names = new ValueNameTable();
+
+        // Definitions per block, walked in original order (definitions before label insert) so a
+        // duplicate block label still surfaces the identical ArgumentException at the same point.
+        var blockIndexByLabel = new Dictionary<string, int>(blockCount);
+        var defIds = new List<int>();
+        var defIdStart = new int[blockCount + 1];
+        for (var i = 0; i < blockCount; i++)
+        {
+            var block = blocks[i];
+            defIdStart[i] = defIds.Count;
+            foreach (var d in BlockDefs(block))
+            {
+                defIds.Add(names.Intern(d));
+            }
+
+            blockIndexByLabel.Add(block.Label, i);
+        }
+
+        defIdStart[blockCount] = defIds.Count;
+
+        // Seed entry block with implicit parameters (uses that occur before any local definition).
+        var entryBlock = Function.Blocks.Single(b => b.Label == Function.EntryLabel);
+        var entryIndex = blockIndexByLabel[entryBlock.Label];
+        // The "not defined by the entry block" filter is pure, so it can be applied once the
+        // definition bitsets exist instead of while walking the uses.
+        var entryUseIds = new List<int>();
+        foreach (var u in BlockUses(entryBlock))
+        {
+            entryUseIds.Add(names.Intern(u));
+        }
+
+        // Every possible in/out set member is now interned (sets only get ABI names or definitions,
+        // and TrySet makes later additions no-ops), so the bitset width is fixed from here on.
+        var wordCount = (names.Count + 63) >> 6;
+        var inBits = new ulong[blockCount * wordCount];
+        var outBits = new ulong[blockCount * wordCount];
+        var defBits = new ulong[blockCount * wordCount];
+
+        for (var i = 0; i < blockCount; i++)
+        {
+            var offset = i * wordCount;
+            var end = defIdStart[i + 1];
+            for (var d = defIdStart[i]; d < end; d++)
+            {
+                var id = defIds[d];
+                defBits[offset + (id >> 6)] |= 1UL << id;
+            }
+
+            // Seed every block with ABI params to model live-in registers. Indices [0, seed count)
+            // are reserved for them, so this is a constant mask OR.
+            SeedAbiRegisters(inBits, offset);
+            SeedAbiRegisters(outBits, offset);
+        }
+
+        var entryOffset = entryIndex * wordCount;
+        foreach (var id in entryUseIds)
+        {
+            var word = id >> 6;
+            var bit = 1UL << id;
+            if ((defBits[entryOffset + word] & bit) != 0)
+            {
+                continue;
+            }
+
+            inBits[entryOffset + word] |= bit;
+            outBits[entryOffset + word] |= bit;
+        }
+
+        // Self-loops are ignored for live-ins, or a loop header could never gain definitions from
+        // other predecessors. Computed once since the CFG doesn't change during the fixpoint.
+        var blockPreds = new int[blockCount][];
+        for (var i = 0; i < blockCount; i++)
+        {
+            var label = blocks[i].Label;
+            var preds = Cfg.Predecessors(label);
+            var kept = 0;
+            for (var p = 0; p < preds.Count; p++)
+            {
+                if (preds[p] != label)
+                {
+                    kept++;
+                }
+            }
+
+            var resolved = kept == 0 ? Array.Empty<int>() : new int[kept];
+            var next = 0;
+            for (var p = 0; p < preds.Count; p++)
+            {
+                var pred = preds[p];
+                if (pred != label)
+                {
+                    resolved[next++] = blockIndexByLabel[pred];
+                }
+            }
+
+            blockPreds[i] = resolved;
+        }
+
+        var scratch = new ulong[wordCount];
+        var changed = true;
+        while (changed)
+        {
+            changed = false;
+            for (var blockIndex = 0; blockIndex < blockCount; blockIndex++)
+            {
+                var offset = blockIndex * wordCount;
+                var preds = blockPreds[blockIndex];
+                var predOut = scratch.AsSpan();
+                if (preds.Length == 0)
+                {
+                    inBits.AsSpan(offset, wordCount).CopyTo(predOut); // entry block keeps implicit params
+                }
+                else
+                {
+                    outBits.AsSpan(preds[0] * wordCount, wordCount).CopyTo(predOut);
+                    for (var p = 1; p < preds.Length; p++)
+                    {
+                        var other = outBits.AsSpan(preds[p] * wordCount, wordCount);
+                        for (var w = 0; w < wordCount; w++)
+                        {
+                            predOut[w] &= other[w];
+                        }
+                    }
+                }
+
+                var inSpan = inBits.AsSpan(offset, wordCount);
+                var outSpan = outBits.AsSpan(offset, wordCount);
+                var defSpan = defBits.AsSpan(offset, wordCount);
+                for (var w = 0; w < wordCount; w++)
+                {
+                    var live = predOut[w];
+                    if (inSpan[w] != live)
+                    {
+                        inSpan[w] = live;
+                        changed = true;
+                    }
+
+                    var merged = live | defSpan[w];
+                    if (outSpan[w] != merged)
+                    {
+                        outSpan[w] = merged;
+                        changed = true;
+                    }
+                }
+            }
+        }
+
+        // Treat all ABI-visible architectural registers (GPRs, FPRs, CR fields, etc.) as potential live-ins.
+        var abiParamSet = AbiParamSet;
+        var available = new ulong[wordCount];
+        ulong[]? predUnion = null;
+
+        for (var blockIndex = 0; blockIndex < blockCount; blockIndex++)
+        {
+            var block = blocks[blockIndex];
+            inBits.AsSpan(blockIndex * wordCount, wordCount).CopyTo(available);
+            // Predecessor out-set union depends only on the block, so build it once lazily (phi-free
+            // blocks never pay for it) instead of once per phi.
+            var predUnionBuilt = false;
+            foreach (var ins in block.Instructions)
+            {
+                if (ins is IrPhi phi)
+                {
+                    // The buffer itself is allocated on first use so phi-free functions never pay for it.
+                    var union = predUnion ??= new ulong[wordCount];
+                    if (!predUnionBuilt)
+                    {
+                        Array.Clear(union);
+                        foreach (var p in Cfg.Predecessors(block.Label))
+                        {
+                            var predOut = outBits.AsSpan(blockIndexByLabel[p] * wordCount, wordCount);
+                            for (var w = 0; w < wordCount; w++)
+                            {
+                                union[w] |= predOut[w];
+                            }
+                        }
+
+                        predUnionBuilt = true;
+                    }
+
+                    foreach (var src in phi.Sources.Values)
+                    {
+                        if (names.Contains(union, src))
+                        {
+                            continue;
+                        }
+
+                        var baseName = BaseName(src);
+                        if (abiParamSet.Contains(baseName))
+                        {
+                            names.TrySet(union, src);
+                            continue;
+                        }
+
+                        throw new InvalidOperationException($"Use of {src} in phi at block {block.Label} has no incoming definition.");
+                    }
+
+                    names.TrySet(available, phi.Destination);
+                    continue;
+                }
+
+                foreach (var use in IrRegisterDataFlow.Uses(ins))
+                {
+                    if (!names.Contains(available, use))
+                    {
+                        var baseName = BaseName(use);
+                        if (abiParamSet.Contains(baseName))
+                        {
+                            // Treat as an additional live-in when dominance proof is inconclusive.
+                            names.TrySet(available, use);
+                            continue;
+                        }
+                        throw new InvalidOperationException($"Use of {use} in block {block.Label} has no dominating definition.");
+                    }
+                }
+
+                foreach (var def in IrRegisterDataFlow.Definitions(ins))
+                {
+                    names.TrySet(available, def);
+                }
+            }
+        }
+    }
+
+    private static void SeedAbiRegisters(ulong[] bits, int offset)
+    {
+        // The seed occupies the lowest indices, and every function's universe contains them, so the
+        // mask is never wider than a block's bitset.
+        var mask = AbiSeedMask;
+        for (var i = 0; i < mask.Length; i++)
+        {
+            bits[offset + i] |= mask[i];
+        }
+    }
+
+    /// <summary>
+    /// Dense interning of the value names <see cref="ValidateUseDef"/> reasons about, ordinal to
+    /// match the original <c>HashSet&lt;string&gt;</c> comparer. ABI seed names get indices
+    /// <c>[0, AbiSeedNames.Length)</c> so seeding a block is a constant mask OR.
+    /// </summary>
+    private sealed class ValueNameTable
+    {
+        private readonly Dictionary<string, int> _indices = new(AbiSeedIndices);
+        private int _count = AbiSeedNames.Length;
+        // HashSet<string> tolerates a null element while a dictionary key may not be null, so a null
+        // name (only reachable from malformed IR) gets its own reserved slot instead of throwing
+        // where the original code did not.
+        private int _nullIndex = -1;
+
+        public int Count => _count;
+
+        public int Intern(string name)
+        {
+            if (name is null)
+            {
+                if (_nullIndex < 0)
+                {
+                    _nullIndex = _count++;
+                }
+
+                return _nullIndex;
+            }
+
+            if (!_indices.TryGetValue(name, out var index))
+            {
+                index = _count++;
+                _indices.Add(name, index);
+            }
+
+            return index;
+        }
+
+        public bool Contains(ulong[] bits, string name)
+            => TryGetIndex(name, out var index) && (bits[index >> 6] & (1UL << index)) != 0;
+
+        /// <summary>
+        /// Sets <paramref name="name"/>'s bit when it's part of the interned universe. Names outside
+        /// it only ever come from the ABI fallback path, which is a pure re-check every time, so
+        /// skipping the insert can't change which violation gets reported.
+        /// </summary>
+        public void TrySet(ulong[] bits, string name)
+        {
+            if (TryGetIndex(name, out var index))
+            {
+                bits[index >> 6] |= 1UL << index;
+            }
+        }
+
+        private bool TryGetIndex(string name, out int index)
+        {
+            if (name is null)
+            {
+                index = _nullIndex;
+                return _nullIndex >= 0;
+            }
+
+            return _indices.TryGetValue(name, out index);
+        }
+    }
+
+    private static string BaseName(string name) => RegisterNameUtils.HardwareBase(name);
+
+    private static IEnumerable<string> BlockUses(IrBasicBlock block)
+    {
+        foreach (var ins in block.Instructions)
+        {
+            foreach (var u in IrRegisterDataFlow.Uses(ins))
+            {
+                yield return u;
+            }
+        }
+    }
+
+    private static IEnumerable<string> BlockDefs(IrBasicBlock block)
+    {
+        foreach (var ins in block.Instructions)
+        {
+            foreach (var d in IrRegisterDataFlow.Definitions(ins))
+            {
+                yield return d;
+            }
+        }
+    }
+
+    private static string[] BuildAbiRegisterList()
+    {
+        var regs = new List<string>();
+        regs.AddRange(Enumerable.Range(0, 32).Select(i => $"r{i}"));
+        regs.AddRange(Enumerable.Range(0, 32).Select(i => $"f{i}"));
+        regs.AddRange(Enumerable.Range(0, 8).Select(i => $"cr{i}"));
+        regs.AddRange(Enumerable.Range(0, 8).Select(i => $"gqr{i}"));
+        regs.AddRange(new[]
+        {
+            "cr",
+            "lr",
+            "ctr",
+            "xer",
+            "fpscr",
+            "msr",
+            "dar",
+            "dsisr",
+            "iccr",
+            "tbr",
+            "tbl",
+            "tbu",
+            "hid0",
+            "hid1",
+            "hid2",
+            "srr0",
+            "srr1"
+        });
+
+        return regs
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+    }
+
+    private static readonly string[] AbiRegisters = BuildAbiRegisterList();
+
+    // Immutable seeds shared by every validation run; they are only ever read.
+    private static readonly HashSet<string> AbiParamSet = AbiRegisters.ToHashSet(StringComparer.OrdinalIgnoreCase);
+
+    private static readonly HashSet<string> AbiRegistersWithVersions = AbiParamSet
+        .SelectMany(p => new[] { p, $"{p}_0" })
+        .ToHashSet(StringComparer.OrdinalIgnoreCase);
+
+    // ValidateUseDef seeds every block's in/out set with exactly these names. They are the same for
+    // every function, so they get the lowest interned indices: the per-block seed becomes a constant
+    // mask OR, and the per-call interning table is a bulk copy of a prebuilt dictionary.
+    private static readonly string[] AbiSeedNames = AbiRegistersWithVersions.ToArray();
+
+    // Ordinal (default) comparer on purpose: membership in the seeded HashSet<string> sets is ordinal
+    // even though the set was *built* from a case-insensitive one, so "R3" must not resolve to "r3".
+    private static readonly Dictionary<string, int> AbiSeedIndices = BuildAbiSeedIndices();
+
+    private static readonly ulong[] AbiSeedMask = BuildAbiSeedMask();
+
+    private static Dictionary<string, int> BuildAbiSeedIndices()
+    {
+        var map = new Dictionary<string, int>(AbiSeedNames.Length);
+        for (var i = 0; i < AbiSeedNames.Length; i++)
+        {
+            map[AbiSeedNames[i]] = i;
+        }
+
+        return map;
+    }
+
+    private static ulong[] BuildAbiSeedMask()
+    {
+        var mask = new ulong[(AbiSeedNames.Length + 63) >> 6];
+        for (var i = 0; i < AbiSeedNames.Length; i++)
+        {
+            mask[i >> 6] |= 1UL << i;
+        }
+
+        return mask;
+    }
+}
diff --git a/translator/src/Translator.Core/Analysis/StackAddressFacts.cs b/translator/src/Translator.Core/Analysis/StackAddressFacts.cs
new file mode 100644
index 0000000..44b709a
--- /dev/null
+++ b/translator/src/Translator.Core/Analysis/StackAddressFacts.cs
@@ -0,0 +1,190 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Analysis;
+
+/// <summary>
+/// Simple, intraprocedural stack-address facts for local codegen and stack helper selection. Scans the
+/// IR in block order following register copies and register-plus-constant add/sub, treating every SSA
+/// spelling of r1 as the stack root. No CFG joins or phi analysis; that's the entry-frame/affine passes' job.
+/// </summary>
+internal sealed class StackAddressFacts
+{
+    private readonly Dictionary<string, int> _temporaryOffsets;
+
+    private StackAddressFacts(Dictionary<string, int> temporaryOffsets)
+    {
+        _temporaryOffsets = temporaryOffsets;
+    }
+
+    public static StackAddressFacts Empty { get; } =
+        new(new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase));
+
+    public static StackAddressFacts Build(IrFunction function)
+    {
+        var temporaryOffsets = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+        foreach (var block in function.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                switch (instruction)
+                {
+                    // SSA form makes an architectural register destination as stable as a compiler
+                    // temporary (e.g. PPC prologues copying r1 to r11 for the save area).
+                    case IrAssign assign when
+                        TryResolveValue(assign.Value, temporaryOffsets, out var assignOffset):
+                        temporaryOffsets[assign.Destination] = assignOffset;
+                        break;
+
+                    case IrBinary binary when
+                        TryResolveBinary(binary, temporaryOffsets, out var binaryOffset):
+                        temporaryOffsets[binary.Destination] = binaryOffset;
+                        break;
+                }
+            }
+        }
+
+        return new StackAddressFacts(temporaryOffsets);
+    }
+
+    public bool TryResolve(IrAddress address, out int offset)
+    {
+        if (TryResolveRegister(address.Base, out var baseOffset))
+        {
+            offset = checked(baseOffset + address.Offset);
+            return true;
+        }
+
+        offset = 0;
+        return false;
+    }
+
+    public bool TryResolve(IrValue value, out int offset)
+    {
+        if (value.Kind == "register" &&
+            TryResolveRegister(value.RegisterName, out offset))
+        {
+            return true;
+        }
+
+        offset = 0;
+        return false;
+    }
+
+    public bool TryResolve(IrBinary binary, out int offset) =>
+        TryResolveBinary(binary, _temporaryOffsets, out offset);
+
+    public bool TryResolveRegister(string? registerName, out int offset)
+    {
+        if (string.IsNullOrWhiteSpace(registerName))
+        {
+            offset = 0;
+            return false;
+        }
+
+        if (GetRegisterBaseName(registerName).Equals("r1", StringComparison.OrdinalIgnoreCase))
+        {
+            offset = 0;
+            return true;
+        }
+
+        return _temporaryOffsets.TryGetValue(registerName, out offset);
+    }
+
+    public bool ContainsTemporary(string registerName) =>
+        _temporaryOffsets.ContainsKey(registerName);
+
+    private static bool TryResolveBinary(
+        IrBinary binary,
+        IReadOnlyDictionary<string, int> temporaryOffsets,
+        out int offset) =>
+        TryResolveValue(binary.Left, temporaryOffsets, out offset) &&
+        TryGetIntConstant(binary.Right, out var constant) &&
+        TryApplyOffset(binary.Op, offset, constant, out offset);
+
+    private static bool TryResolveValue(
+        IrValue value,
+        IReadOnlyDictionary<string, int> temporaryOffsets,
+        out int offset)
+    {
+        if (value.Kind == "register" &&
+            TryResolveRegister(value.RegisterName, temporaryOffsets, out offset))
+        {
+            return true;
+        }
+
+        offset = 0;
+        return false;
+    }
+
+    private static bool TryResolveRegister(
+        string? registerName,
+        IReadOnlyDictionary<string, int> temporaryOffsets,
+        out int offset)
+    {
+        if (string.IsNullOrWhiteSpace(registerName))
+        {
+            offset = 0;
+            return false;
+        }
+
+        if (GetRegisterBaseName(registerName).Equals("r1", StringComparison.OrdinalIgnoreCase))
+        {
+            offset = 0;
+            return true;
+        }
+
+        return temporaryOffsets.TryGetValue(registerName, out offset);
+    }
+
+    private static bool TryGetIntConstant(IrValue value, out int result)
+    {
+        if (value.Kind == "const" &&
+            value.Constant is { } constant &&
+            constant >= int.MinValue &&
+            constant <= int.MaxValue)
+        {
+            result = (int)constant;
+            return true;
+        }
+
+        result = 0;
+        return false;
+    }
+
+    private static bool TryApplyOffset(string op, int baseOffset, int constant, out int offset)
+    {
+        offset = 0;
+        switch (op)
+        {
+            case "add":
+                offset = checked(baseOffset + constant);
+                return true;
+            case "sub":
+                offset = checked(baseOffset - constant);
+                return true;
+            default:
+                return false;
+        }
+    }
+
+    private static string GetRegisterBaseName(string name)
+    {
+        var underscore = name.IndexOf('_');
+        if (underscore < 0 || underscore + 1 >= name.Length)
+        {
+            return name;
+        }
+
+        for (var index = underscore + 1; index < name.Length; index++)
+        {
+            if (!char.IsDigit(name[index]))
+            {
+                return name;
+            }
+        }
+
+        return name[..underscore];
+    }
+}
diff --git a/translator/src/Translator.Core/Build/GeneratedOutputPruner.cs b/translator/src/Translator.Core/Build/GeneratedOutputPruner.cs
new file mode 100644
index 0000000..b37d2ca
--- /dev/null
+++ b/translator/src/Translator.Core/Build/GeneratedOutputPruner.cs
@@ -0,0 +1,70 @@
+using Translator.Core.Mods;
+
+namespace Translator.Core.Build;
+
+/// <summary>
+/// What one prune pass did. Warnings are collected rather than printed: pruning
+/// runs inside Core, and the CLI owns every byte of console output.
+/// </summary>
+public sealed record GeneratedOutputPruneResult(int RemovedFiles, IReadOnlyList<string> Warnings)
+{
+    public static GeneratedOutputPruneResult Empty { get; } = new(0, Array.Empty<string>());
+}
+
+public static class GeneratedOutputPruner
+{
+    public static GeneratedOutputPruneResult Prune(
+        string baseOutDir,
+        IReadOnlySet<string> emittedPaths,
+        BaseTranslationOutputMetadata? previousOutputMetadata = null)
+    {
+        if (!Directory.Exists(baseOutDir))
+            return GeneratedOutputPruneResult.Empty;
+
+        var comparison = OperatingSystem.IsWindows()
+            ? StringComparison.OrdinalIgnoreCase
+            : StringComparison.Ordinal;
+        var root = Path.GetFullPath(baseOutDir)
+            .TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+        var rootPrefix = root + Path.DirectorySeparatorChar;
+        IEnumerable<string> candidates;
+        if (previousOutputMetadata is null)
+        {
+            // Compatibility migration for trees produced before translator-owned
+            // metadata: every generated body under the root is a prune candidate.
+            candidates = Directory.EnumerateFiles(root, "*.cpp", SearchOption.AllDirectories);
+        }
+        else
+        {
+            candidates = previousOutputMetadata.Functions.Select(function =>
+                Path.Combine(root, function.RelativePath.Replace('/', Path.DirectorySeparatorChar)));
+        }
+
+        var removed = 0;
+        var warnings = new List<string>();
+        foreach (var file in candidates.Distinct(
+                     OperatingSystem.IsWindows() ? StringComparer.OrdinalIgnoreCase : StringComparer.Ordinal))
+        {
+            var fullPath = Path.GetFullPath(file);
+            if (!fullPath.StartsWith(rootPrefix, comparison))
+            {
+                warnings.Add($"refused to prune generated path outside output root: {fullPath}");
+                continue;
+            }
+            if (emittedPaths.Contains(fullPath) || !File.Exists(fullPath))
+                continue;
+
+            try
+            {
+                File.Delete(fullPath);
+                removed++;
+            }
+            catch (Exception ex)
+            {
+                warnings.Add($"failed to prune stale generated file {fullPath}: {ex.Message}");
+            }
+        }
+
+        return new GeneratedOutputPruneResult(removed, warnings);
+    }
+}
diff --git a/translator/src/Translator.Core/Build/TranslatedBuildShardEmitter.cs b/translator/src/Translator.Core/Build/TranslatedBuildShardEmitter.cs
new file mode 100644
index 0000000..c29a0ca
--- /dev/null
+++ b/translator/src/Translator.Core/Build/TranslatedBuildShardEmitter.cs
@@ -0,0 +1,1136 @@
+using System.Globalization;
+using System.Text;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using Translator.Core.IO;
+using Translator.Core.Loading;
+using Translator.Core.Mods;
+
+namespace Translator.Core.Build;
+
+public sealed record TranslatedBuildShardOptions(
+    string BaseMetadataPath,
+    string BaseFunctionsDirectory,
+    string OutputDirectory,
+    string NativeSourceDirectory,
+    string? RetroResolvedProfilePath = null,
+    string? RetroCppDirectory = null,
+    int BaseShardCount = 72,
+    int ModShardCount = 48,
+    int RegistrationShardCount = 16,
+    RuntimeNativeIndex? NativeIndex = null);
+
+/// <summary>
+/// Per-shard compile-cost spread for one partition. Frozen membership does not
+/// rebalance, so this is the drift signal that says when a repack is due.
+/// </summary>
+public sealed record TranslatedShardBalance(
+    int ShardCount,
+    long MinCompileCostWeight,
+    long MaxCompileCostWeight,
+    long TotalCompileCostWeight)
+{
+    public double MeanCompileCostWeight =>
+        ShardCount == 0 ? 0d : (double)TotalCompileCostWeight / ShardCount;
+
+    public double SpreadRatio =>
+        MinCompileCostWeight <= 0 ? 0d : (double)MaxCompileCostWeight / MinCompileCostWeight;
+}
+
+public sealed record TranslatedBuildShardResult(
+    int BaseFunctionCount,
+    int SharedBaseFunctionCount,
+    int ProfileSensitiveTargetCount,
+    int ProfileSensitiveCallerCount,
+    int ModFunctionCount,
+    int BaseShardCount,
+    int ModShardCount,
+    string CMakeManifestPath,
+    string? BaseCommonShardMapPath = null,
+    bool BaseCommonBoundariesReused = false,
+    TranslatedShardBalance? BaseCommonBalance = null);
+
+/// <summary>
+/// Emits the only generated-C++ membership consumed by CMake. The small
+/// per-function files remain useful translator artifacts, but compiler and
+/// linker topology is expressed as deterministic, content-addressed shards.
+/// </summary>
+public static partial class TranslatedBuildShardEmitter
+{
+    private const string ShardBoundaryFormat = "mkw-base-common-shard-boundaries";
+    private const int ShardBoundaryVersion = 1;
+    // Translator-owned state, not a build product: it lives beside the shards it describes so a
+    // checkout carries its frozen membership with its sources. Not a prune candidate, same as
+    // shards.cmake.
+    private const string BaseCommonShardMapFileName = "base_common_shard_map.json";
+
+    private sealed class FunctionRecord
+    {
+        public required uint Address { get; init; }
+        public required string Symbol { get; init; }
+        public required string Name { get; init; }
+        public required string SourcePath { get; init; }
+        public required string SourceFingerprint { get; init; }
+        public required string RegistrationKind { get; init; }
+        public required uint Priority { get; init; }
+        public required ulong ModuleId { get; init; }
+        public required bool PreservesNonvolatileFprs { get; init; }
+        public required uint NonvolatileFprWriteMask { get; init; }
+        public required IReadOnlyList<uint> DirectCalls { get; init; }
+        public required long CompileCostWeight { get; init; }
+        public string? SourceText { get; init; }
+        public bool ExcludedByNativeOverride { get; set; }
+    }
+
+    private sealed record ProfileEntry(
+        uint Address,
+        string Symbol,
+        string Name,
+        string Kind,
+        uint Priority,
+        bool DirectCallAvailable,
+        bool PreservesNonvolatileFprs,
+        uint NonvolatileFprWriteMask,
+        bool MustRemainDynamicallyDispatchable);
+
+    private sealed record NativeOverrideSets(
+        IReadOnlySet<uint> Winners,
+        IReadOnlySet<uint> TranslationExclusions,
+        IReadOnlyDictionary<uint, RawTranslatedOverride> RawTranslatedOverrides);
+
+    private sealed record RawTranslatedOverride(
+        string Symbol,
+        bool PreservesNonvolatileFprs,
+        uint NonvolatileFprWriteMask);
+
+    private sealed record Trait(
+        bool Available,
+        bool PreservesNonvolatileFprs,
+        uint NonvolatileFprWriteMask,
+        bool MustRemainDynamicallyDispatchable,
+        string? WinnerSymbol,
+        string WinnerKind,
+        uint WinnerPriority);
+
+    private sealed record ShardInfo(
+        string Partition,
+        string Path,
+        string Fingerprint,
+        long CompileCostWeight,
+        IReadOnlyList<FunctionRecord> Functions);
+
+
+    /// <summary>
+    /// Frozen cut points for a weight-packed partition. Slot k owns every
+    /// address in [StartAddresses[k], StartAddresses[k + 1]); the last slot owns
+    /// everything from its start upwards. Starts are strictly ascending.
+    /// </summary>
+    private sealed record ShardBoundaryTable(IReadOnlyList<uint> StartAddresses);
+
+    private sealed record ShardBoundaryResolution(
+        ShardBoundaryTable Table,
+        string Path,
+        bool Reused);
+
+    public static TranslatedBuildShardResult Emit(TranslatedBuildShardOptions options)
+    {
+        ValidateOptions(options);
+        var outputRoot = Path.GetFullPath(options.OutputDirectory);
+        Directory.CreateDirectory(outputRoot);
+
+        var metadata = BaseTranslationOutputMetadataFile.Read(options.BaseMetadataPath);
+        metadata.RequireReleaseEligible(options.BaseMetadataPath);
+        TranslationSourceBundle? baseSourceBundle = null;
+        if (!string.IsNullOrWhiteSpace(metadata.SourceBundlePath))
+        {
+            var bundlePath = Path.IsPathRooted(metadata.SourceBundlePath)
+                ? metadata.SourceBundlePath
+                : Path.Combine(Path.GetDirectoryName(Path.GetFullPath(options.BaseMetadataPath))!, metadata.SourceBundlePath);
+            baseSourceBundle = TranslationSourceBundle.Read(bundlePath);
+        }
+        var nativeOverrides = ReadNativeOverrides(options.NativeSourceDirectory, options.NativeIndex);
+        var retroEntries = ReadResolvedProfile(options.RetroResolvedProfilePath);
+        var baseRecords = ReadBaseFunctions(metadata, options.BaseFunctionsDirectory, baseSourceBundle);
+        foreach (var record in baseRecords)
+        {
+            record.ExcludedByNativeOverride = nativeOverrides.TranslationExclusions.Contains(record.Address);
+        }
+
+        var activeBase = baseRecords.Where(static record => !record.ExcludedByNativeOverride).ToArray();
+        var baseTraits = activeBase.ToDictionary(
+            static record => record.Address,
+            record =>
+            {
+                var nativeWinner = nativeOverrides.Winners.Contains(record.Address);
+                return new Trait(
+                Available: !nativeWinner,
+                record.PreservesNonvolatileFprs,
+                record.NonvolatileFprWriteMask,
+                MustRemainDynamicallyDispatchable: nativeWinner,
+                WinnerSymbol: nativeWinner ? null : record.Symbol,
+                WinnerKind: nativeWinner ? "native" : "base",
+                WinnerPriority: nativeWinner ? 10_000u : 0u);
+            });
+        foreach (var (address, rawOverride) in nativeOverrides.RawTranslatedOverrides)
+        {
+            baseTraits[address] = new Trait(
+                Available: true,
+                rawOverride.PreservesNonvolatileFprs,
+                rawOverride.NonvolatileFprWriteMask,
+                MustRemainDynamicallyDispatchable: false,
+                rawOverride.Symbol,
+                WinnerKind: "base",
+                WinnerPriority: 0u);
+        }
+        var rrTraits = new Dictionary<uint, Trait>(BuildRetroTraits(activeBase, baseTraits, retroEntries));
+        foreach (var address in nativeOverrides.RawTranslatedOverrides.Keys)
+            rrTraits[address] = baseTraits[address];
+        var sensitiveTargets = FindProfileSensitiveTargets(baseTraits, rrTraits);
+        var sensitiveCallers = activeBase
+            .Where(record => record.DirectCalls.Any(sensitiveTargets.Contains))
+            .Select(static record => record.Address)
+            .ToHashSet();
+
+        var nonCoffSensitiveTargets = baseTraits.Keys
+            .Where(address => !rrTraits.TryGetValue(address, out var rr) ||
+                              baseTraits[address].Available != rr.Available ||
+                              !string.Equals(baseTraits[address].WinnerSymbol, rr.WinnerSymbol, StringComparison.Ordinal))
+            .ToHashSet();
+        var nonCoffSensitiveCallers = activeBase
+            .Where(record => record.DirectCalls.Any(nonCoffSensitiveTargets.Contains))
+            .Select(static record => record.Address)
+            .ToHashSet();
+        nonCoffSensitiveCallers.UnionWith(sensitiveCallers);
+
+        var commonBase = activeBase.Where(record => !sensitiveCallers.Contains(record.Address)).ToArray();
+        var portableCommonBase = activeBase.Where(record => !nonCoffSensitiveCallers.Contains(record.Address)).ToArray();
+        var portableSensitiveBase = activeBase.Where(record => nonCoffSensitiveCallers.Contains(record.Address)).ToArray();
+        var retroSourceBundlePath = options.RetroCppDirectory is { } retroCppDir && !string.IsNullOrWhiteSpace(retroCppDir)
+            ? Path.Combine(Path.GetDirectoryName(Path.GetFullPath(retroCppDir))!, "translated_sources.bin")
+            : null;
+        if (retroSourceBundlePath is not null && !File.Exists(retroSourceBundlePath)) retroSourceBundlePath = null;
+        var modRecords = ReadModFunctions(options.RetroCppDirectory, retroSourceBundlePath);
+
+        var shards = new List<ShardInfo>();
+        // base_common is weighted-sequential, so one function's weight changing would shift every
+        // downstream cut point and rename every shard after it. Freezing cut points in an emitted
+        // table keeps shard identity independent of other functions' compile cost.
+        var baseCommonBoundaries = ResolveBaseCommonBoundaries(
+            outputRoot, portableCommonBase, options.BaseShardCount);
+        var baseCommonShards = WriteFunctionShards(
+            outputRoot, "base_common", portableCommonBase, options.BaseShardCount, baseTraits,
+            "profile-neutral shared base", weightedSequential: true,
+            frozenBoundaries: baseCommonBoundaries?.Table);
+        shards.AddRange(baseCommonShards);
+        shards.AddRange(WriteFunctionShards(
+            outputRoot, "base_portable_sensitive", portableSensitiveBase,
+            Math.Min(24, Math.Max(1, portableSensitiveBase.Length)), baseTraits,
+            "base profile", weightedSequential: false));
+        shards.AddRange(WriteFunctionShards(
+            outputRoot, "retro_portable_sensitive", portableSensitiveBase,
+            Math.Min(24, Math.Max(1, portableSensitiveBase.Length)), rrTraits,
+            "Retro Rewind profile", weightedSequential: false));
+        shards.AddRange(WriteFunctionShards(
+            outputRoot, "retro_mod", modRecords, options.ModShardCount, rrTraits,
+            "Retro Rewind mod", weightedSequential: false));
+
+        var baseRegistration = WriteRegistrationShards(
+            outputRoot, "base", activeBase, baseTraits, options.RegistrationShardCount).ToList();
+        baseRegistration.Add(WriteIndirectDispatchTable(outputRoot, "base", baseTraits));
+        var rrRegistrationRecords = activeBase.Concat(modRecords).OrderBy(static record => record.Address).ThenBy(static record => record.RegistrationKind, StringComparer.Ordinal).ToArray();
+        var rrRegistration = WriteRegistrationShards(
+            outputRoot, "retro_rewind", rrRegistrationRecords, rrTraits, options.RegistrationShardCount).ToList();
+        rrRegistration.Add(WriteIndirectDispatchTable(outputRoot, "retro_rewind", rrTraits));
+
+        var extraRetroSources = ReadRetroExtraSources(options.RetroCppDirectory, modRecords);
+        var cmakeManifestPath = Path.Combine(outputRoot, "shards.cmake");
+        WriteCMakeManifest(
+            cmakeManifestPath,
+            outputRoot,
+            commonBase.Length,
+            portableCommonBase.Length,
+            activeBase.Length,
+            modRecords.Count,
+            sensitiveTargets.Count,
+            sensitiveCallers.Count,
+            shards,
+            baseRegistration,
+            rrRegistration,
+            extraRetroSources);
+        PruneStaleShardSources(outputRoot, shards, baseRegistration, rrRegistration);
+
+        return new TranslatedBuildShardResult(
+            baseRecords.Count,
+            commonBase.Length,
+            sensitiveTargets.Count,
+            sensitiveCallers.Count,
+            modRecords.Count,
+            shards.Count(shard => shard.Partition.StartsWith("base_", StringComparison.Ordinal)),
+            shards.Count(shard => shard.Partition == "retro_mod"),
+            cmakeManifestPath,
+            baseCommonBoundaries?.Path,
+            baseCommonBoundaries?.Reused ?? false,
+            MeasureBalance(baseCommonShards));
+    }
+
+    private static TranslatedShardBalance? MeasureBalance(IReadOnlyList<ShardInfo> shards) =>
+        shards.Count == 0
+            ? null
+            : new TranslatedShardBalance(
+                shards.Count,
+                shards.Min(static shard => shard.CompileCostWeight),
+                shards.Max(static shard => shard.CompileCostWeight),
+                shards.Sum(static shard => shard.CompileCostWeight));
+
+    private static void ValidateOptions(TranslatedBuildShardOptions options)
+    {
+        if (!File.Exists(options.BaseMetadataPath))
+        {
+            throw new FileNotFoundException("Required shard input is missing.", options.BaseMetadataPath);
+        }
+        foreach (var path in new[] { options.BaseFunctionsDirectory, options.NativeSourceDirectory })
+        {
+            if (!Directory.Exists(path)) throw new DirectoryNotFoundException(path);
+        }
+        if (options.BaseShardCount < 1 || options.ModShardCount < 1 || options.RegistrationShardCount < 1)
+        {
+            throw new ArgumentOutOfRangeException(nameof(options), "Shard counts must be positive.");
+        }
+    }
+
+    private static IReadOnlyList<FunctionRecord> ReadBaseFunctions(
+        BaseTranslationOutputMetadata metadata,
+        string functionsDirectory,
+        TranslationSourceBundle? sourceBundle)
+    {
+        var root = Path.GetFullPath(functionsDirectory);
+        var records = new List<FunctionRecord>(metadata.Functions.Count);
+        foreach (var item in metadata.Functions.OrderBy(static function => function.EntryPoint))
+        {
+            var path = Path.GetFullPath(Path.Combine(root, item.RelativePath.Replace('/', Path.DirectorySeparatorChar)));
+            string? source = null;
+            if (sourceBundle is not null)
+            {
+                if (!sourceBundle.TryGet(item.EntryPoint, out var bundled))
+                    throw new InvalidDataException($"Source bundle is missing base function 0x{item.EntryPoint:X8}.");
+                source = bundled.Source;
+                // Read already verified the digest, so compare it directly instead of re-hashing
+                // tens of thousands of sources again.
+                if (bundled.Sha256 is { } verifiedHash)
+                {
+                    if (bundled.SourceByteLength != item.Size ||
+                        !verifiedHash.Equals(item.Sha256, StringComparison.OrdinalIgnoreCase))
+                        throw new InvalidDataException($"Source bundle metadata mismatch for 0x{item.EntryPoint:X8}.");
+                }
+                else
+                {
+                    var bytes = Encoding.UTF8.GetBytes(source);
+                    var hash = ChecksumUtilities.Sha256Hex(bytes);
+                    if (bytes.LongLength != item.Size || !hash.Equals(item.Sha256, StringComparison.OrdinalIgnoreCase))
+                        throw new InvalidDataException($"Source bundle metadata mismatch for 0x{item.EntryPoint:X8}.");
+                }
+            }
+            else if (item.Build is null)
+            {
+                source = File.ReadAllText(path);
+            }
+            (uint Address, string Symbol, bool Preserves, uint FprMask) registration = item.Build is null
+                ? ParseBaseRegistration(source!, path)
+                : (item.EntryPoint, item.Build.Symbol, item.Build.PreservesNonvolatileFprs, item.Build.NonvolatileFprWriteMask);
+            if (registration.Address != item.EntryPoint)
+                throw new InvalidDataException($"Base registration address mismatch in '{path}'.");
+            var record = CreateRecord(
+                registration.Address,
+                registration.Symbol,
+                registration.Symbol,
+                path,
+                item.Sha256,
+                item.Size,
+                "base",
+                0,
+                0,
+                registration.Preserves,
+                registration.FprMask,
+                source,
+                item.Build?.DirectCallDependencies,
+                item.Build?.EstimatedIrInstructions);
+            records.Add(record);
+        }
+        return records;
+    }
+
+    private static IReadOnlyList<FunctionRecord> ReadModFunctions(string? cppDirectory, string? sourceBundlePath)
+    {
+        if (string.IsNullOrWhiteSpace(cppDirectory) ||
+            (!Directory.Exists(cppDirectory) && (string.IsNullOrWhiteSpace(sourceBundlePath) || !File.Exists(sourceBundlePath))))
+        {
+            return Array.Empty<FunctionRecord>();
+        }
+        var records = new List<FunctionRecord>();
+        var sources = !string.IsNullOrWhiteSpace(sourceBundlePath) && File.Exists(sourceBundlePath)
+            ? TranslationSourceBundle.Read(sourceBundlePath).Entries
+                .Select(entry => (Path: Path.GetFullPath(Path.Combine(cppDirectory, entry.VirtualPath)), entry.Source))
+            : Directory.EnumerateFiles(cppDirectory, "*.cpp", SearchOption.AllDirectories)
+                .Order(StringComparer.OrdinalIgnoreCase)
+                .Select(path => (Path: path, Source: File.ReadAllText(path)));
+        foreach (var (path, source) in sources)
+        {
+            var match = ModRegistrationRegex().Match(source);
+            if (!match.Success) continue;
+            var address = ParseHexUInt32(match.Groups["address"].Value);
+            var symbol = match.Groups["symbol"].Value;
+            var preserves = bool.Parse(match.Groups["preserves"].Value);
+            var mask = ParseHexUInt32(match.Groups["mask"].Value);
+            var priority = uint.Parse(match.Groups["priority"].Value, CultureInfo.InvariantCulture);
+            var moduleId = ulong.Parse(match.Groups["moduleId"].Value, CultureInfo.InvariantCulture);
+            var bytes = Encoding.UTF8.GetBytes(source);
+            records.Add(CreateRecord(
+                address,
+                symbol,
+                symbol,
+                Path.GetFullPath(path),
+                ChecksumUtilities.Sha256Hex(bytes),
+                bytes.LongLength,
+                "mod",
+                priority,
+                moduleId,
+                preserves,
+                mask,
+                source));
+        }
+        return records.OrderBy(static record => record.Address).ThenBy(static record => record.Symbol, StringComparer.Ordinal).ToArray();
+    }
+
+    private static FunctionRecord CreateRecord(
+        uint address,
+        string symbol,
+        string name,
+        string path,
+        string fingerprint,
+        long bytes,
+        string kind,
+        uint priority,
+        ulong moduleId,
+        bool preserves,
+        uint fprMask,
+        string? source,
+        IReadOnlyList<uint>? knownCalls = null,
+        int? knownEstimatedIr = null)
+    {
+        var calls = knownCalls?.Distinct().Order().ToArray() ?? DirectCallRegex().Matches(source!).Cast<Match>()
+            .Select(match => ParseHexUInt32(match.Groups["address"].Value)).Distinct().Order().ToArray();
+        var estimatedIr = Math.Max(1, knownEstimatedIr ?? source!.Count(static character => character == ';'));
+        var locality = calls.Count(target => (target >> 16) == (address >> 16));
+        var weight = checked(bytes + estimatedIr * 24L + calls.Length * 96L - locality * 16L);
+        var fullPath = Path.GetFullPath(path);
+        return new FunctionRecord
+        {
+            Address = address,
+            Symbol = symbol,
+            Name = name,
+            SourcePath = fullPath,
+            SourceFingerprint = fingerprint,
+            RegistrationKind = kind,
+            Priority = priority,
+            ModuleId = moduleId,
+            PreservesNonvolatileFprs = preserves,
+            NonvolatileFprWriteMask = fprMask,
+            DirectCalls = calls,
+            CompileCostWeight = Math.Max(1, weight),
+            SourceText = source
+        };
+    }
+
+    private static (uint Address, string Symbol, bool Preserves, uint FprMask) ParseBaseRegistration(string source, string path)
+    {
+        var match = BaseRegistrationRegex().Match(source);
+        if (!match.Success) throw new InvalidDataException($"Missing base registration metadata in '{path}'.");
+        return (
+            ParseHexUInt32(match.Groups["address"].Value),
+            match.Groups["symbol"].Value,
+            bool.Parse(match.Groups["preserves"].Value),
+            ParseHexUInt32(match.Groups["mask"].Value));
+    }
+
+    private static NativeOverrideSets ReadNativeOverrides(
+        string directory,
+        RuntimeNativeIndex? index = null)
+    {
+        var registrations = (index ?? RuntimeNativeIndexBuilder.Build(directory)).Registrations;
+        var winners = registrations.Select(static registration => registration.Address).ToHashSet();
+        var exclusions = registrations
+            .Where(static registration => registration.ExcludesBaseTranslation)
+            .Select(static registration => registration.Address)
+            .ToHashSet();
+        // REGISTER_TRANSLATED_FUNCTION carries no FPR metadata, so a hand-written
+        // runtime override stays fully conservative: assume it may write every
+        // nonvolatile FPR.
+        var rawTranslatedOverrides = registrations
+            .Where(static registration => registration.IsTranslatedOverride)
+            .GroupBy(static registration => registration.Address)
+            .ToDictionary(
+                static group => group.Key,
+                static group => new RawTranslatedOverride(
+                    group.First().Symbol,
+                    PreservesNonvolatileFprs: false,
+                    NonvolatileFprWriteMask: uint.MaxValue));
+        return new NativeOverrideSets(winners, exclusions, rawTranslatedOverrides);
+    }
+
+    private static IReadOnlyDictionary<uint, ProfileEntry> ReadResolvedProfile(string? path)
+    {
+        if (string.IsNullOrWhiteSpace(path) || !File.Exists(path)) return new Dictionary<uint, ProfileEntry>();
+        using var document = JsonDocument.Parse(File.ReadAllText(path));
+        return document.RootElement.GetProperty("Entries").EnumerateArray()
+            .Select(element => new ProfileEntry(
+                element.GetProperty("Address").GetUInt32(),
+                element.GetProperty("Symbol").GetString() ?? "",
+                element.GetProperty("Name").GetString() ?? "",
+                element.GetProperty("Kind").GetString() ?? "",
+                element.GetProperty("Priority").GetUInt32(),
+                element.GetProperty("DirectCallAvailable").GetBoolean(),
+                element.GetProperty("PreservesNonvolatileFprs").GetBoolean(),
+                element.GetProperty("NonvolatileFprWriteMask").GetUInt32(),
+                element.GetProperty("MustRemainDynamicallyDispatchable").GetBoolean()))
+            .GroupBy(static entry => entry.Address)
+            .ToDictionary(static group => group.Key, static group => group.First());
+    }
+
+    private static IReadOnlyDictionary<uint, Trait> BuildRetroTraits(
+        IReadOnlyList<FunctionRecord> baseFunctions,
+        IReadOnlyDictionary<uint, Trait> baseTraits,
+        IReadOnlyDictionary<uint, ProfileEntry> retroEntries)
+    {
+        if (retroEntries.Count == 0) return new Dictionary<uint, Trait>(baseTraits);
+        var traits = new Dictionary<uint, Trait>(baseTraits.Count + retroEntries.Count);
+        foreach (var function in baseFunctions)
+        {
+            if (!retroEntries.TryGetValue(function.Address, out var resolved))
+            {
+                traits[function.Address] = baseTraits[function.Address];
+                continue;
+            }
+            var translated = resolved.DirectCallAvailable &&
+                             (resolved.Kind.Equals("base", StringComparison.OrdinalIgnoreCase) ||
+                              resolved.Kind.Equals("mod", StringComparison.OrdinalIgnoreCase) ||
+                              resolved.Kind.Equals("rr", StringComparison.OrdinalIgnoreCase));
+            traits[function.Address] = new Trait(
+                translated,
+                resolved.PreservesNonvolatileFprs,
+                resolved.NonvolatileFprWriteMask,
+                resolved.MustRemainDynamicallyDispatchable,
+                translated ? resolved.Symbol : null,
+                resolved.Kind,
+                resolved.Priority);
+        }
+        foreach (var resolved in retroEntries.Values)
+        {
+            if (traits.ContainsKey(resolved.Address)) continue;
+            var translated = resolved.DirectCallAvailable &&
+                             (resolved.Kind.Equals("base", StringComparison.OrdinalIgnoreCase) ||
+                              resolved.Kind.Equals("mod", StringComparison.OrdinalIgnoreCase) ||
+                              resolved.Kind.Equals("rr", StringComparison.OrdinalIgnoreCase));
+            if (!translated) continue;
+            traits[resolved.Address] = new Trait(
+                true,
+                resolved.PreservesNonvolatileFprs,
+                resolved.NonvolatileFprWriteMask,
+                resolved.MustRemainDynamicallyDispatchable,
+                resolved.Symbol,
+                resolved.Kind,
+                resolved.Priority);
+        }
+        return traits;
+    }
+
+    private static HashSet<uint> FindProfileSensitiveTargets(
+        IReadOnlyDictionary<uint, Trait> baseTraits,
+        IReadOnlyDictionary<uint, Trait> rrTraits)
+    {
+        var result = new HashSet<uint>();
+        foreach (var (address, baseTrait) in baseTraits)
+        {
+            if (!rrTraits.TryGetValue(address, out var rrTrait) ||
+                baseTrait.Available != rrTrait.Available ||
+                baseTrait.PreservesNonvolatileFprs != rrTrait.PreservesNonvolatileFprs ||
+                baseTrait.NonvolatileFprWriteMask != rrTrait.NonvolatileFprWriteMask)
+            {
+                result.Add(address);
+            }
+        }
+        return result;
+    }
+
+    private static string BuildTraitsHeader(
+        IReadOnlyDictionary<uint, Trait> traits,
+        string label)
+    {
+        var output = new StringBuilder();
+        output.AppendLine("#pragma once");
+        output.AppendLine($"// Translator-owned direct-call traits: {label}.");
+        foreach (var (address, trait) in traits.OrderBy(static pair => pair.Key))
+        {
+            if (!trait.Available || string.IsNullOrWhiteSpace(trait.WinnerSymbol)) continue;
+            // Dynamic-dispatch and preserves_nonvolatile_fprs are deliberately not arguments here:
+            // direct calls are always non-overridable literal edges, and the macro guard is
+            // selected by the mask alone.
+            output.AppendLine(
+                $"MKW_TRANSLATED_TRAIT({address:X8}, {trait.WinnerSymbol}, 0x{trait.NonvolatileFprWriteMask:X8}u);");
+        }
+        return output.ToString();
+    }
+
+    private static IReadOnlyList<ShardInfo> WriteFunctionShards(
+        string outputRoot,
+        string partition,
+        IReadOnlyList<FunctionRecord> functions,
+        int requestedShardCount,
+        IReadOnlyDictionary<uint, Trait> traits,
+        string traitsLabel,
+        bool weightedSequential,
+        ShardBoundaryTable? frozenBoundaries = null)
+    {
+        if (functions.Count == 0) return Array.Empty<ShardInfo>();
+        var shardCount = Math.Min(requestedShardCount, functions.Count);
+        // A frozen boundary table supersedes the packer that produced it: the
+        // membership it encodes is identical to that packer run, and it stays
+        // identical when a later run reweights the very same functions.
+        var groups = (frozenBoundaries is not null
+            ? PartitionFrozenBoundaries(functions, frozenBoundaries)
+            : weightedSequential
+                ? PartitionWeightedSequential(functions, shardCount)
+                : PartitionStableHash(functions, shardCount))
+            .Select(static group => group.ToList())
+            .ToList();
+
+        var directory = Path.Combine(outputRoot, partition);
+        Directory.CreateDirectory(directory);
+        // Groups own disjoint records and distinct files, so they build concurrently; results are
+        // collected positionally to keep the emitted list byte-for-byte deterministic. Never widen
+        // this parallelism across WriteFunctionShards calls, base and Retro Rewind share records.
+        var emitted = new ShardInfo?[groups.Count];
+        Parallel.For(0, groups.Count, index =>
+        {
+            var group = groups[index];
+            if (group.Count == 0) return;
+            var dependencyTraits = group
+                .SelectMany(static function => function.DirectCalls)
+                .Distinct()
+                .Where(traits.ContainsKey)
+                .ToDictionary(address => address, address => traits[address]);
+            var traitIdentity = string.Join("\n", dependencyTraits.OrderBy(static pair => pair.Key).Select(pair =>
+                $"{pair.Key:X8}:{pair.Value.Available}:{pair.Value.PreservesNonvolatileFprs}:{pair.Value.NonvolatileFprWriteMask:X8}:{pair.Value.WinnerSymbol}"));
+            var identity = string.Join("\n", group.Select(function => $"{function.Address:X8}:{function.SourceFingerprint}")) + "\n" + traitIdentity;
+            var hash = ChecksumUtilities.Sha256Hex(Encoding.UTF8.GetBytes($"{partition}\n{identity}"));
+            // Membership, not the transient scheduling position, is the shard
+            // identity.  This lets an unchanged shard retain its source/object
+            // cache identity when another shard becomes heavier or lighter.
+            var path = Path.Combine(directory, $"shard_{hash[..24]}.cpp");
+            var traitsPath = Path.Combine(directory, $"shard_{hash[..24]}_traits.h");
+            var source = new StringBuilder();
+            source.AppendLine("// Translator-owned content-addressed aggregate shard; do not edit.");
+            source.AppendLine("#include \"abi_bridge.h\"");
+            // Quoted include resolves the sibling traits header on every toolchain and keeps
+            // the shard text free of the emitting machine's absolute paths.
+            source.AppendLine($"#include \"{Path.GetFileName(traitsPath)}\"");
+            source.AppendLine("#define MKW_STATIC_TRANSLATED_CALL(Target, Entry, Context) do { ApplyRuntimeCallOptions(Target, Context); Entry(Context); } while (false)");
+            foreach (var function in group
+                         .OrderBy(static function => function.Address)
+                         .ThenBy(static function => function.Symbol, StringComparer.Ordinal))
+            {
+                var functionSource = function.SourceText ?? File.ReadAllText(function.SourcePath);
+                functionSource = RegistrationMarkerRegex().Replace(functionSource, string.Empty);
+                functionSource = LowerStableDirectCalls(functionSource, traits);
+                // Diagnostics only; the named file no longer exists on disk (sources live in the
+                // bundle), so only the bare file name is kept, not the emitting machine's path.
+                source.Append($"#line 1 \"{Escape(Path.GetFileName(function.SourcePath))}\"{Environment.NewLine}");
+                source.Append(functionSource);
+                if (!functionSource.EndsWith('\n'))
+                {
+                    source.AppendLine();
+                }
+            }
+            source.AppendLine("#undef MKW_STATIC_TRANSLATED_CALL");
+            WriteIfChanged(traitsPath, BuildTraitsHeader(dependencyTraits, traitsLabel));
+            WriteIfChanged(path, source.ToString());
+            emitted[index] = new ShardInfo(
+                partition, path, hash, group.Sum(static function => function.CompileCostWeight), group);
+        });
+
+        var shards = new List<ShardInfo>(groups.Count);
+        foreach (var shard in emitted)
+        {
+            if (shard is not null) shards.Add(shard);
+        }
+        return shards;
+    }
+
+    private static string LowerStableDirectCalls(
+        string source,
+        IReadOnlyDictionary<uint, Trait> traits)
+    {
+        return DirectCallRegex().Replace(source, match =>
+        {
+            var address = ParseHexUInt32(match.Groups["address"].Value);
+            if (!traits.TryGetValue(address, out var trait) ||
+                !trait.Available ||
+                trait.NonvolatileFprWriteMask != 0 ||
+                trait.MustRemainDynamicallyDispatchable ||
+                trait.WinnerSymbol is null ||
+                trait.WinnerKind.Equals("native", StringComparison.OrdinalIgnoreCase) ||
+                RequiresGenericDirectCall(address))
+            {
+                return match.Value;
+            }
+
+            return $"MKW_STATIC_TRANSLATED_CALL(0x{address:X8}u, {trait.WinnerSymbol}, ctx)";
+        });
+    }
+
+    private static bool RequiresGenericDirectCall(uint address) => address switch
+    {
+        // Runtime-toggle diagnostics and phase tracing intentionally remain on
+        // the generic cold path. Ordinary calls have no runtime branch.
+        0x80008EF0 or 0x80008FB4 or 0x80009194 or 0x80243D18 or 0x80243D6C or 0x808897F0 or
+        0x802226D8 or 0x805C3218 or 0x805E7460 or 0x8063C470 or 0x8063C4D4 or 0x8063C560 or 0x8063C714 or
+        0x80198CA8 or 0x80199038 or 0x801992A8 or 0x801998A4 or 0x80226C78 or 0x80226EBC or 0x80229814 or 0x80229C5C or 0x80229DCC or 0x80229DD8 or
+        0x801A7424 or 0x80672CC8 => true,
+        _ => false
+    };
+
+    private static IReadOnlyList<List<FunctionRecord>> PartitionWeightedSequential(IReadOnlyList<FunctionRecord> functions, int count)
+    {
+        var ordered = functions.OrderBy(static function => function.Address).ToArray();
+        return PartitionWeightedIndices(ordered.Select(static function => function.CompileCostWeight).ToArray(), count)
+            .Select(indices => indices.Select(index => ordered[index]).ToList())
+            .ToArray();
+    }
+
+    internal static IReadOnlyList<IReadOnlyList<int>> PartitionWeightedIndices(
+        IReadOnlyList<long> weights,
+        int count)
+    {
+        if (count < 1 || count > weights.Count || weights.Any(static weight => weight <= 0))
+            throw new ArgumentOutOfRangeException(nameof(count));
+        var result = Enumerable.Range(0, count).Select(_ => new List<int>()).ToArray();
+        long remainingWeight = weights.Sum();
+        var nextFunction = 0;
+        for (var shard = 0; shard < count; shard++)
+        {
+            var remainingBins = count - shard;
+            long accumulated = 0;
+            while (nextFunction < weights.Count)
+            {
+                var remainingFunctions = weights.Count - nextFunction;
+                if (result[shard].Count != 0 && remainingFunctions == remainingBins - 1)
+                    break;
+
+                var weight = weights[nextFunction];
+                var target = (remainingWeight + remainingBins - 1) / remainingBins;
+                var without = Math.Abs(accumulated - target);
+                var with = Math.Abs(checked(accumulated + weight) - target);
+                if (result[shard].Count != 0 && without <= with)
+                    break;
+
+                result[shard].Add(nextFunction);
+                accumulated = checked(accumulated + weight);
+                nextFunction++;
+            }
+
+            remainingWeight -= accumulated;
+        }
+
+        if (nextFunction != weights.Count || result.Any(static group => group.Count == 0))
+            throw new InvalidOperationException("Weighted shard partitioning failed to produce non-empty deterministic bins.");
+        return result;
+    }
+
+    /// <summary>
+    /// Assigns each function to the frozen slot whose start address is the greatest one at or below it
+    /// (gaps join the range in front, addresses below the table join slot 0), ignoring compile cost
+    /// weight so one function's size changing can never move another function to a different shard.
+    /// </summary>
+    private static IReadOnlyList<List<FunctionRecord>> PartitionFrozenBoundaries(
+        IReadOnlyList<FunctionRecord> functions,
+        ShardBoundaryTable boundaries)
+    {
+        var starts = boundaries.StartAddresses;
+        var result = Enumerable.Range(0, starts.Count).Select(_ => new List<FunctionRecord>()).ToArray();
+        foreach (var function in functions.OrderBy(static function => function.Address))
+        {
+            // Slot counts are in the tens, so an ascending scan is both the
+            // cheapest and the most obviously deterministic lookup.
+            var slot = 0;
+            for (var index = 1; index < starts.Count; index++)
+            {
+                if (starts[index] > function.Address) break;
+                slot = index;
+            }
+            result[slot].Add(function);
+        }
+        return result;
+    }
+
+    /// <summary>
+    /// Reuses the recorded base_common boundary table if present, otherwise packs once and
+    /// records the cut points chosen. Rebalancing is never automatic: deleting the table is the
+    /// only way to move a frozen boundary, which renames every base_common shard.
+    /// </summary>
+    private static ShardBoundaryResolution? ResolveBaseCommonBoundaries(
+        string outputRoot,
+        IReadOnlyList<FunctionRecord> functions,
+        int requestedShardCount)
+    {
+        if (functions.Count == 0) return null;
+        var path = Path.Combine(outputRoot, BaseCommonShardMapFileName);
+        var shardCount = Math.Min(requestedShardCount, functions.Count);
+        // A different requested shard count is a topology change rather than
+        // drift, so the recorded table is replaced instead of silently
+        // overriding what the caller asked for.
+        var existing = ReadShardBoundaryTable(path, shardCount);
+        if (existing is not null)
+        {
+            // Content-gated, so an unchanged table keeps its modification time.
+            WriteShardBoundaryTable(path, "base_common", existing);
+            return new ShardBoundaryResolution(existing, path, Reused: true);
+        }
+
+        var packed = PartitionWeightedSequential(functions, shardCount);
+        for (var index = 1; index < packed.Count; index++)
+        {
+            // Containment lookup requires consecutive bins to not share an address; fail loudly
+            // rather than freeze a table that silently reshuffles membership later.
+            if (packed[index - 1][^1].Address >= packed[index][0].Address)
+            {
+                throw new InvalidOperationException(
+                    "Weighted shard partitioning produced overlapping address ranges; " +
+                    "base_common boundaries cannot be frozen.");
+            }
+        }
+
+        var table = new ShardBoundaryTable(packed.Select(static group => group[0].Address).ToArray());
+        WriteShardBoundaryTable(path, "base_common", table);
+        return new ShardBoundaryResolution(table, path, Reused: false);
+    }
+
+    private static ShardBoundaryTable? ReadShardBoundaryTable(string path, int expectedShardCount)
+    {
+        if (!File.Exists(path)) return null;
+        try
+        {
+            using var document = JsonDocument.Parse(File.ReadAllText(path));
+            var root = document.RootElement;
+            if (root.ValueKind != JsonValueKind.Object ||
+                !root.TryGetProperty("format", out var format) ||
+                !string.Equals(format.GetString(), ShardBoundaryFormat, StringComparison.Ordinal) ||
+                !root.TryGetProperty("formatVersion", out var version) ||
+                version.GetInt32() != ShardBoundaryVersion ||
+                !root.TryGetProperty("shardStartAddresses", out var starts) ||
+                starts.ValueKind != JsonValueKind.Array)
+            {
+                return null;
+            }
+
+            var parsed = new List<uint>(starts.GetArrayLength());
+            foreach (var element in starts.EnumerateArray())
+            {
+                var text = element.GetString();
+                if (string.IsNullOrWhiteSpace(text)) return null;
+                parsed.Add(ParseHexUInt32(text));
+            }
+            if (parsed.Count != expectedShardCount) return null;
+            for (var index = 1; index < parsed.Count; index++)
+            {
+                if (parsed[index] <= parsed[index - 1]) return null;
+            }
+            return new ShardBoundaryTable(parsed);
+        }
+        catch (Exception ex) when (ex is JsonException or IOException or FormatException
+                                       or OverflowException or InvalidOperationException)
+        {
+            // An unreadable or malformed table is treated as absent: the packer
+            // re-derives the cut points and the file is rewritten in canonical
+            // form. That costs one full rebuild, never a wrong build.
+            return null;
+        }
+    }
+
+    private static void WriteShardBoundaryTable(string path, string partition, ShardBoundaryTable table)
+    {
+        var starts = table.StartAddresses;
+        var output = new StringBuilder();
+        output.AppendLine("{");
+        output.AppendLine($"  \"format\": \"{ShardBoundaryFormat}\",");
+        output.AppendLine($"  \"formatVersion\": {ShardBoundaryVersion.ToString(CultureInfo.InvariantCulture)},");
+        output.AppendLine($"  \"partition\": \"{Escape(partition)}\",");
+        output.AppendLine($"  \"shardCount\": {starts.Count.ToString(CultureInfo.InvariantCulture)},");
+        // Ascending, fixed-width, invariant hexadecimal: the file is byte-stable
+        // for a given set of cut points regardless of host culture.
+        output.AppendLine("  \"shardStartAddresses\": [");
+        for (var index = 0; index < starts.Count; index++)
+        {
+            output.AppendLine($"    \"0x{starts[index]:X8}\"{(index == starts.Count - 1 ? "" : ",")}");
+        }
+        output.AppendLine("  ]");
+        output.AppendLine("}");
+        WriteIfChanged(path, output.ToString());
+    }
+
+    private static IReadOnlyList<List<FunctionRecord>> PartitionStableHash(IReadOnlyList<FunctionRecord> functions, int count)
+    {
+        var result = Enumerable.Range(0, count).Select(_ => new List<FunctionRecord>()).ToArray();
+        foreach (var function in functions)
+        {
+            var mixed = function.Address ^ (function.Address >> 11) ^ (function.Address >> 19);
+            result[(int)(mixed % (uint)count)].Add(function);
+        }
+        return result;
+    }
+
+    private static IReadOnlyList<string> WriteRegistrationShards(
+        string outputRoot,
+        string profile,
+        IReadOnlyList<FunctionRecord> records,
+        IReadOnlyDictionary<uint, Trait> traits,
+        int requestedCount)
+    {
+        if (records.Count == 0) return Array.Empty<string>();
+        var count = Math.Min(requestedCount, records.Count);
+        var groups = PartitionStableHash(records, count);
+        var directory = Path.Combine(outputRoot, $"{profile}_registration");
+        Directory.CreateDirectory(directory);
+        var paths = new List<string>();
+        for (var index = 0; index < count; index++)
+        {
+            var group = groups[index];
+            if (group.Count == 0) continue;
+            var identity = string.Join("\n", group.Select(record => $"{record.Address:X8}:{record.Symbol}:{record.SourceFingerprint}"));
+            var hash = ChecksumUtilities.Sha256Hex(Encoding.UTF8.GetBytes($"{profile}\n{identity}"));
+            var path = Path.Combine(directory, $"registration_{index:D2}_{hash[..16]}.cpp");
+            var source = new StringBuilder();
+            source.AppendLine("// Translator-owned bulk registration; do not edit.");
+            source.AppendLine("#include \"abi_bridge.h\"");
+            source.AppendLine("#include <cstddef>");
+            foreach (var symbol in group.Select(static record => record.Symbol).Distinct(StringComparer.Ordinal).Order(StringComparer.Ordinal))
+            {
+                source.AppendLine($"extern \"C\" void {symbol}(CpuContext* ctx);");
+            }
+            source.AppendLine("namespace {");
+            source.AppendLine("const BulkTranslatedFunctionRecord kRecords[] = {");
+            foreach (var record in group.OrderBy(static record => record.Address).ThenBy(static record => record.RegistrationKind, StringComparer.Ordinal))
+            {
+                var dynamic = traits.TryGetValue(record.Address, out var trait) && trait.MustRemainDynamicallyDispatchable;
+                var kind = record.RegistrationKind == "mod" ? "FunctionKind::ModTranslated" : "FunctionKind::BaseTranslated";
+                source.AppendLine(
+                    $"    {{0x{record.Address:X8}u, \"{Escape(record.Name)}\", &{record.Symbol}, {kind}, {Bool(record.PreservesNonvolatileFprs)}, 0x{record.NonvolatileFprWriteMask:X8}u, {record.Priority}u, {record.ModuleId}ull, {Bool(dynamic)}}},");
+            }
+            source.AppendLine("};");
+            source.AppendLine("const BulkTranslatedFunctionRegistrar kRegistrar(kRecords, std::size(kRecords));");
+            source.AppendLine("} // namespace");
+            WriteIfChanged(path, source.ToString());
+            paths.Add(path);
+        }
+        return paths;
+    }
+
+    private static string WriteIndirectDispatchTable(
+        string outputRoot,
+        string profile,
+        IReadOnlyDictionary<uint, Trait> traits)
+    {
+        var entries = traits
+            .Where(static pair => pair.Value.Available &&
+                                  pair.Value.WinnerSymbol is not null &&
+                                  !pair.Value.WinnerKind.Equals("native", StringComparison.OrdinalIgnoreCase))
+            .OrderBy(static pair => pair.Key)
+            .ToArray();
+        if (entries.Length == 0)
+            throw new InvalidDataException($"Profile '{profile}' has no verified translated indirect dispatch entries.");
+
+        var identity = string.Join("\n", entries.Select(static pair =>
+            $"{pair.Key:X8}:{pair.Value.WinnerSymbol}:{pair.Value.WinnerKind}:" +
+            $"{pair.Value.PreservesNonvolatileFprs}:{pair.Value.NonvolatileFprWriteMask:X8}"));
+        var hash = ChecksumUtilities.Sha256Hex(Encoding.UTF8.GetBytes($"{profile}\n{identity}"));
+        var directory = Path.Combine(outputRoot, $"{profile}_dispatch");
+        var path = Path.Combine(directory, $"indirect_dispatch_{hash[..16]}.cpp");
+        var source = new StringBuilder();
+        source.AppendLine("// Translator-owned immutable indirect dispatch table; do not edit.");
+        source.AppendLine("#include \"abi_bridge.h\"");
+        source.AppendLine("#include <iterator>");
+        foreach (var symbol in entries.Select(static pair => pair.Value.WinnerSymbol!)
+                     .Distinct(StringComparer.Ordinal).Order(StringComparer.Ordinal))
+        {
+            source.AppendLine($"extern \"C\" void {symbol}(CpuContext* ctx);");
+        }
+        source.AppendLine("namespace {");
+        source.AppendLine("const RawDispatchRecord kEntries[] = {");
+        foreach (var (address, trait) in entries)
+        {
+            var mask = trait.PreservesNonvolatileFprs
+                ? 0u
+                : trait.NonvolatileFprWriteMask & 0xFFFFC000u;
+            source.AppendLine(
+                $"    {{0x{address:X8}u, &{trait.WinnerSymbol}, 0x{mask:X8}u, false}},");
+        }
+        source.AppendLine("};");
+
+        var entryIndices = entries
+            .Select(static (pair, index) => (pair.Key, Index: index))
+            .ToDictionary(static pair => pair.Key, static pair => pair.Index);
+        var segments = entries
+            .GroupBy(static pair => (byte)(pair.Key >> 24))
+            .ToDictionary(static group => group.Key, static group => group.ToArray());
+        foreach (var (segmentNumber, segmentEntries) in segments.OrderBy(static pair => pair.Key))
+        {
+            var firstPage = segmentEntries.Min(static pair => (pair.Key >> 12) & 0x0FFFu);
+            var lastPage = segmentEntries.Max(static pair => (pair.Key >> 12) & 0x0FFFu);
+            source.AppendLine($"const StaticIndirectDispatchPage kPages_{segmentNumber:X2}[] = {{");
+            for (var page = firstPage; page <= lastPage; ++page)
+            {
+                var pageEntries = segmentEntries
+                    .Where(pair => ((pair.Key >> 12) & 0x0FFFu) == page)
+                    .OrderBy(static pair => pair.Key)
+                    .ToArray();
+                if (pageEntries.Length == 0)
+                {
+                    source.AppendLine("    {0u, 0u, 0u},");
+                    continue;
+                }
+                var firstEntry = entryIndices[pageEntries[0].Key];
+                source.AppendLine($"    {{{firstEntry}u, {pageEntries.Length}u, 0u}},");
+            }
+            source.AppendLine("};");
+        }
+
+        source.AppendLine("const StaticIndirectDispatchSegment kSegments[256] = {");
+        for (var segmentNumber = 0; segmentNumber < 256; ++segmentNumber)
+        {
+            if (!segments.TryGetValue((byte)segmentNumber, out var segmentEntries))
+            {
+                source.AppendLine("    {nullptr, 0u, 0u},");
+                continue;
+            }
+            var firstPage = segmentEntries.Min(static pair => (pair.Key >> 12) & 0x0FFFu);
+            var lastPage = segmentEntries.Max(static pair => (pair.Key >> 12) & 0x0FFFu);
+            source.AppendLine(
+                $"    {{kPages_{segmentNumber:X2}, 0x{firstPage:X3}u, {lastPage - firstPage + 1}u}},");
+        }
+        source.AppendLine("};");
+        source.AppendLine(
+            $"const StaticIndirectDispatchTable kTable{{\"{Escape(profile)}\", kSegments, kEntries, std::size(kEntries)}};");
+        source.AppendLine("const StaticIndirectDispatchTableRegistrar kRegistrar(&kTable);");
+        source.AppendLine("} // namespace");
+        WriteIfChanged(path, source.ToString());
+        return path;
+    }
+
+    private static IReadOnlyList<string> ReadRetroExtraSources(string? cppDirectory, IReadOnlyList<FunctionRecord> modRecords)
+    {
+        if (string.IsNullOrWhiteSpace(cppDirectory) || !Directory.Exists(cppDirectory)) return Array.Empty<string>();
+        var functionPaths = modRecords.Select(static record => record.SourcePath).ToHashSet(StringComparer.OrdinalIgnoreCase);
+        return Directory.EnumerateFiles(cppDirectory, "*.*", SearchOption.AllDirectories)
+            .Where(path => path.EndsWith(".cpp", StringComparison.OrdinalIgnoreCase) || path.EndsWith(".S", StringComparison.OrdinalIgnoreCase))
+            .Select(Path.GetFullPath)
+            .Where(path => !functionPaths.Contains(path))
+            .Order(StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+    }
+
+    private static void WriteCMakeManifest(
+        string path,
+        string outputRoot,
+        int sharedBaseCount,
+        int portableSharedBaseCount,
+        int activeBaseCount,
+        int modCount,
+        int sensitiveTargetCount,
+        int sensitiveCallerCount,
+        IReadOnlyList<ShardInfo> shards,
+        IReadOnlyList<string> baseRegistration,
+        IReadOnlyList<string> rrRegistration,
+        IReadOnlyList<string> retroExtras)
+    {
+        var output = new StringBuilder();
+        output.AppendLine("# Translator-owned stable shard graph; do not edit.");
+        output.AppendLine($"set(MKW_TRANSLATED_SHARD_ROOT \"{CMakePath(outputRoot)}\")");
+        output.AppendLine($"set(MKW_BASE_FUNCTION_COUNT {activeBaseCount})");
+        output.AppendLine($"set(MKW_SHARED_BASE_FUNCTION_COUNT {sharedBaseCount})");
+        output.AppendLine($"set(MKW_PORTABLE_SHARED_BASE_FUNCTION_COUNT {portableSharedBaseCount})");
+        output.AppendLine($"set(MKW_PROFILE_SENSITIVE_TARGET_COUNT {sensitiveTargetCount})");
+        output.AppendLine($"set(MKW_PROFILE_SENSITIVE_CALLER_COUNT {sensitiveCallerCount})");
+        output.AppendLine($"set(MKW_RETRO_REWIND_FUNCTION_COUNT {modCount})");
+        // Ninja seeds ready edges in manifest order.  Put longest predicted jobs
+        // first (LPT) so a large shard cannot become a serial tail.
+        IEnumerable<string> Scheduled(string partition) => shards
+            .Where(shard => shard.Partition == partition)
+            .OrderByDescending(static shard => shard.CompileCostWeight)
+            .ThenBy(static shard => shard.Fingerprint, StringComparer.Ordinal)
+            .Select(static shard => shard.Path);
+        AppendCMakeList(output, "MKW_BASE_COMMON_SHARDS", Scheduled("base_common"), preserveOrder: true);
+        AppendCMakeList(output, "MKW_BASE_PORTABLE_SENSITIVE_SHARDS", Scheduled("base_portable_sensitive"), preserveOrder: true);
+        AppendCMakeList(output, "MKW_RETRO_PORTABLE_SENSITIVE_SHARDS", Scheduled("retro_portable_sensitive"), preserveOrder: true);
+        AppendCMakeList(output, "MKW_RETRO_MOD_SHARDS", Scheduled("retro_mod"), preserveOrder: true);
+        AppendCMakeList(output, "MKW_BASE_REGISTRATION_SOURCES", baseRegistration);
+        AppendCMakeList(output, "MKW_RETRO_REGISTRATION_SOURCES", rrRegistration);
+        AppendCMakeList(output, "MKW_RETRO_EXTRA_SOURCES", retroExtras);
+        output.AppendLine($"set(MKW_HAVE_RETRO_REWIND_SHARDS {(modCount > 0 ? "ON" : "OFF")})");
+        WriteIfChanged(path, output.ToString());
+    }
+
+    private static void AppendCMakeList(
+        StringBuilder output,
+        string name,
+        IEnumerable<string> values,
+        bool preserveOrder = false)
+    {
+        output.AppendLine($"set({name}");
+        var ordered = preserveOrder ? values : values.Order(StringComparer.OrdinalIgnoreCase);
+        foreach (var value in ordered) output.AppendLine($"  \"{CMakePath(value)}\"");
+        output.AppendLine(")");
+    }
+
+    private static void PruneStaleShardSources(
+        string outputRoot,
+        IReadOnlyList<ShardInfo> shards,
+        IReadOnlyList<string> baseRegistration,
+        IReadOnlyList<string> rrRegistration)
+    {
+        var keep = shards.Select(static shard => Path.GetFullPath(shard.Path))
+            .Concat(shards.Select(static shard => Path.Combine(
+                Path.GetDirectoryName(shard.Path)!,
+                Path.GetFileNameWithoutExtension(shard.Path) + "_traits.h")))
+            .Concat(baseRegistration)
+            .Concat(rrRegistration)
+            .Select(Path.GetFullPath)
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        foreach (var directory in Directory.EnumerateDirectories(outputRoot))
+        {
+            foreach (var file in Directory.EnumerateFiles(directory, "*.*", SearchOption.AllDirectories)
+                         .Where(static file => file.EndsWith(".cpp", StringComparison.OrdinalIgnoreCase) ||
+                                               file.EndsWith(".h", StringComparison.OrdinalIgnoreCase)))
+            {
+                if (!keep.Contains(Path.GetFullPath(file))) File.Delete(file);
+            }
+        }
+    }
+
+    // Aggregate shards total hundreds of megabytes; the unchanged-check streams the
+    // live file instead of decoding all of it into a string just to throw it away.
+    private static void WriteIfChanged(string path, string content) =>
+        FileOutput.WriteTextIfChanged(path, content);
+
+    private static string Bool(bool value) => value ? "true" : "false";
+    private static string CMakePath(string value) => Path.GetFullPath(value).Replace('\\', '/').Replace("\"", "\\\"");
+    private static string Escape(string value) => value.Replace("\\", "\\\\").Replace("\"", "\\\"");
+    private static uint ParseHexUInt32(string value) => GuestTargetParser.ParseHexAddress(value);
+
+    private static Regex BaseRegistrationRegex() => GeneratedMarkers.BaseRegistrationPattern();
+
+    private static Regex ModRegistrationRegex() => GeneratedMarkers.ModRegistrationPattern();
+
+    private static Regex RegistrationMarkerRegex() => GeneratedMarkers.RegistrationLinePattern();
+
+    [GeneratedRegex(@"InvokeDirectCpu<0x(?<address>[0-9A-Fa-f]{8})u>\s*\(\s*ctx\s*\)")]
+    private static partial Regex DirectCallRegex();
+
+}
diff --git a/translator/src/Translator.Core/Build/TranslationSourceBundle.cs b/translator/src/Translator.Core/Build/TranslationSourceBundle.cs
new file mode 100644
index 0000000..6a18629
--- /dev/null
+++ b/translator/src/Translator.Core/Build/TranslationSourceBundle.cs
@@ -0,0 +1,211 @@
+using System.Security.Cryptography;
+using System.Text;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Build;
+
+/// <summary>
+/// One bundled translation unit. Sha256/SourceByteLength are populated by TranslationSourceBundle.Read
+/// from the already-verified on-disk record, so consumers can validate against external metadata
+/// without re-hashing; entries built by producers leave them unset.
+/// </summary>
+public sealed record TranslationSourceBundleEntry(
+    uint EntryPoint,
+    string VirtualPath,
+    string Source,
+    string? Sha256 = null,
+    long SourceByteLength = -1);
+
+/// <summary>Versioned deterministic source handoff between lowering and aggregate shard emission.</summary>
+public sealed class TranslationSourceBundle
+{
+    private static readonly byte[] Magic = "MKWSRC01"u8.ToArray();
+    public const int FormatVersion = 1;
+    private readonly IReadOnlyList<TranslationSourceBundleEntry> _entries;
+    // A null value marks an address carried by more than one virtual path. Such an
+    // address is ambiguous and must not resolve, exactly as the previous linear
+    // "exactly one match" probe behaved.
+    private readonly Dictionary<uint, TranslationSourceBundleEntry?> _byEntryPoint;
+
+    private TranslationSourceBundle(IReadOnlyList<TranslationSourceBundleEntry> entries)
+    {
+        _entries = entries;
+        _byEntryPoint = new Dictionary<uint, TranslationSourceBundleEntry?>(entries.Count);
+        foreach (var entry in entries)
+        {
+            if (!_byEntryPoint.TryAdd(entry.EntryPoint, entry)) _byEntryPoint[entry.EntryPoint] = null;
+        }
+    }
+
+    public IReadOnlyList<TranslationSourceBundleEntry> Entries => _entries;
+    public bool TryGet(uint entryPoint, out TranslationSourceBundleEntry entry)
+    {
+        if (_byEntryPoint.TryGetValue(entryPoint, out var match) && match is not null)
+        {
+            entry = match;
+            return true;
+        }
+        entry = null!;
+        return false;
+    }
+
+    public static void Write(string path, IEnumerable<TranslationSourceBundleEntry> entries)
+    {
+        var ordered = entries.OrderBy(static entry => entry.EntryPoint).ThenBy(static entry => entry.VirtualPath, StringComparer.Ordinal).ToArray();
+        if (ordered.Select(static entry => (entry.EntryPoint, entry.VirtualPath)).Distinct().Count() != ordered.Length)
+            throw new InvalidDataException("Translation source bundle contains duplicate address/path identities.");
+        var fullPath = Path.GetFullPath(path);
+        Directory.CreateDirectory(Path.GetDirectoryName(fullPath)!);
+        var temporary = $"{fullPath}.tmp.{Guid.NewGuid():N}";
+        using (var stream = File.Create(temporary))
+        using (var writer = new BinaryWriter(stream, Encoding.UTF8, leaveOpen: false))
+        {
+            writer.Write(Magic);
+            writer.Write(FormatVersion);
+            writer.Write(ordered.Length);
+            foreach (var entry in ordered)
+            {
+                var pathBytes = Encoding.UTF8.GetBytes(entry.VirtualPath.Replace('\\', '/'));
+                var sourceBytes = Encoding.UTF8.GetBytes(entry.Source);
+                writer.Write(entry.EntryPoint);
+                writer.Write(pathBytes.Length);
+                writer.Write(pathBytes);
+                writer.Write(sourceBytes.Length);
+                writer.Write(SHA256.HashData(sourceBytes));
+                writer.Write(sourceBytes);
+            }
+        }
+        File.Move(temporary, fullPath, overwrite: true);
+    }
+
+    public static TranslationSourceBundleWriter CreateWriter(string path, int entryCount) => new(path, entryCount, Magic, FormatVersion);
+
+    public static TranslationSourceBundle Read(string path)
+    {
+        using var stream = File.OpenRead(path);
+        using var reader = new BinaryReader(stream, Encoding.UTF8, leaveOpen: false);
+        if (!reader.ReadBytes(Magic.Length).SequenceEqual(Magic) || reader.ReadInt32() != FormatVersion)
+            throw new InvalidDataException($"Unsupported translation source bundle '{path}'.");
+        var count = reader.ReadInt32();
+        if (count < 0) throw new InvalidDataException("Negative translation source bundle entry count.");
+        var entries = new List<TranslationSourceBundleEntry>(count);
+        var identities = new HashSet<(uint, string)>();
+        for (var i = 0; i < count; i++)
+        {
+            var address = reader.ReadUInt32();
+            var virtualPath = Encoding.UTF8.GetString(ReadBoundedBytes(reader, 1 << 20));
+            var sourceLength = reader.ReadInt32();
+            var hash = reader.ReadBytes(32);
+            if (sourceLength < 0) throw new InvalidDataException("Negative translation source length.");
+            var sourceBytes = reader.ReadBytes(sourceLength);
+            if (sourceBytes.Length != sourceLength || !SHA256.HashData(sourceBytes).SequenceEqual(hash))
+                throw new InvalidDataException($"Translation source 0x{address:X8} is truncated or corrupt.");
+            if (!identities.Add((address, virtualPath)))
+                throw new InvalidDataException($"Duplicate translation source 0x{address:X8} '{virtualPath}'.");
+            entries.Add(new TranslationSourceBundleEntry(
+                address,
+                virtualPath,
+                Encoding.UTF8.GetString(sourceBytes),
+                ChecksumUtilities.ToHex(hash),
+                sourceLength));
+        }
+        if (stream.Position != stream.Length) throw new InvalidDataException("Translation source bundle has trailing data.");
+        return new TranslationSourceBundle(entries);
+    }
+
+    private static byte[] ReadBoundedBytes(BinaryReader reader, int maximum)
+    {
+        var length = reader.ReadInt32();
+        if (length < 0 || length > maximum) throw new InvalidDataException("Invalid translation bundle string length.");
+        var bytes = reader.ReadBytes(length);
+        if (bytes.Length != length) throw new EndOfStreamException();
+        return bytes;
+    }
+}
+
+public sealed class TranslationSourceBundleWriter : IDisposable
+{
+    private readonly string _path;
+    private readonly string _temporary;
+    private readonly int _expectedCount;
+    private readonly BinaryWriter _writer;
+    private int _written;
+    private bool _completed;
+    private (uint Address, string Path)? _previous;
+
+    internal TranslationSourceBundleWriter(string path, int entryCount, byte[] magic, int version)
+    {
+        if (entryCount < 0) throw new ArgumentOutOfRangeException(nameof(entryCount));
+        _path = Path.GetFullPath(path);
+        Directory.CreateDirectory(Path.GetDirectoryName(_path)!);
+        SweepAbandonedTemporaries(_path);
+        _temporary = $"{_path}.tmp.{Guid.NewGuid():N}";
+        _expectedCount = entryCount;
+        _writer = new BinaryWriter(File.Create(_temporary), Encoding.UTF8, leaveOpen: false);
+        _writer.Write(magic);
+        _writer.Write(version);
+        _writer.Write(entryCount);
+    }
+
+    /// <summary>
+    /// A killed run leaves its in-progress temporary behind, and those orphans are
+    /// hundreds of megabytes each. Only the exact "target.tmp." prefix is swept, and a
+    /// file another process still holds open is left alone.
+    /// </summary>
+    private static void SweepAbandonedTemporaries(string targetPath)
+    {
+        var directory = Path.GetDirectoryName(targetPath)!;
+        var prefix = Path.GetFileName(targetPath) + ".tmp.";
+        // The pattern is a Win32 wildcard, so re-check the prefix explicitly and
+        // snapshot the listing before deleting from it.
+        foreach (var candidate in Directory.GetFiles(directory, prefix + "*"))
+        {
+            if (!Path.GetFileName(candidate).StartsWith(prefix, StringComparison.Ordinal)) continue;
+            try
+            {
+                File.Delete(candidate);
+            }
+            catch (IOException)
+            {
+            }
+            catch (UnauthorizedAccessException)
+            {
+            }
+        }
+    }
+
+    public void Write(TranslationSourceBundleEntry entry)
+    {
+        if (_completed || _written >= _expectedCount) throw new InvalidOperationException("Translation source bundle writer is complete.");
+        var virtualPath = entry.VirtualPath.Replace('\\', '/');
+        if (_previous is { } previous &&
+            (entry.EntryPoint < previous.Address ||
+             (entry.EntryPoint == previous.Address && string.CompareOrdinal(virtualPath, previous.Path) <= 0)))
+            throw new InvalidDataException("Translation source bundle entries must be written in deterministic address/path order.");
+        var pathBytes = Encoding.UTF8.GetBytes(virtualPath);
+        var sourceBytes = Encoding.UTF8.GetBytes(entry.Source);
+        _writer.Write(entry.EntryPoint);
+        _writer.Write(pathBytes.Length);
+        _writer.Write(pathBytes);
+        _writer.Write(sourceBytes.Length);
+        _writer.Write(SHA256.HashData(sourceBytes));
+        _writer.Write(sourceBytes);
+        _previous = (entry.EntryPoint, virtualPath);
+        _written++;
+    }
+
+    public void Complete()
+    {
+        if (_written != _expectedCount)
+            throw new InvalidOperationException($"Translation source bundle expected {_expectedCount} entries but received {_written}.");
+        _writer.Dispose();
+        File.Move(_temporary, _path, overwrite: true);
+        _completed = true;
+    }
+
+    public void Dispose()
+    {
+        _writer.Dispose();
+        if (!_completed && File.Exists(_temporary)) File.Delete(_temporary);
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxEmissionResult.cs b/translator/src/Translator.Core/CodeGen/CxxEmissionResult.cs
new file mode 100644
index 0000000..135bf93
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxEmissionResult.cs
@@ -0,0 +1,38 @@
+using System.Collections.Generic;
+using Translator.Core.Analysis;
+
+namespace Translator.Core.CodeGen;
+
+/// <summary>
+/// The facts one emitted state-free interface published, mirroring the <c>// RECOMP_STATE_FREE_ABI ...</c>
+/// persistence comment so this record avoids re-parsing that text in the same process invocation.
+/// <see cref="GprInputMask"/> is the native GPR parameter mask, derived from the contract rather than stored on it.
+/// </summary>
+public sealed record GuestStateFreeEmissionFacts(
+    uint EntryPoint,
+    string Symbol,
+    GuestAbiContract Contract,
+    uint GprInputMask);
+
+/// <summary>
+/// Build registration facts for one emitted function. Present only for the base
+/// (non-mod) registration form.
+/// </summary>
+public sealed record CxxBuildRegistrationFacts(
+    string Symbol,
+    bool PreservesNonvolatileFprs,
+    uint NonvolatileFprWriteMask);
+
+/// <summary>
+/// Structured result of emitting one function: the C++ text plus every fact the emitter derived, for same-process
+/// consumers. The comment markers in <see cref="Code"/> remain the cross-run persistence format for build sharding and dispatch profiles.
+/// </summary>
+public sealed record CxxEmissionResult(
+    string Code,
+    GuestAbiContract GuestAbiContract,
+    string GuestAbiMarker,
+    CxxBuildRegistrationFacts? Registration,
+    IReadOnlyList<uint> EmittedDirectCallTargets,
+    IReadOnlyList<uint> EmittedLocalLabelAddresses,
+    GuestStateFreeEmissionFacts? StateFree,
+    IReadOnlyList<GuestStateFreeEmissionFacts> StateFreeEntryVariants);
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.DeadPureLocalTempElision.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.DeadPureLocalTempElision.cs
new file mode 100644
index 0000000..1e2ebe9
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.DeadPureLocalTempElision.cs
@@ -0,0 +1,210 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    private static IrFunction ElideDeadPureLocalTemps(IrFunction function)
+    {
+        var cfg = IrCfg.Build(function);
+        var liveIn = function.Blocks.ToDictionary(
+            block => block.Label,
+            _ => new HashSet<string>(StringComparer.OrdinalIgnoreCase),
+            StringComparer.OrdinalIgnoreCase);
+        var liveOut = function.Blocks.ToDictionary(
+            block => block.Label,
+            _ => new HashSet<string>(StringComparer.OrdinalIgnoreCase),
+            StringComparer.OrdinalIgnoreCase);
+
+        var changed = true;
+        while (changed)
+        {
+            changed = false;
+            for (var blockIndex = function.Blocks.Count - 1; blockIndex >= 0; blockIndex--)
+            {
+                var block = function.Blocks[blockIndex];
+                var nextOut = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+                foreach (var successor in cfg.Successors(block.Label))
+                {
+                    if (liveIn.TryGetValue(successor, out var successorIn))
+                    {
+                        nextOut.UnionWith(successorIn);
+                    }
+                }
+
+                var nextIn = new HashSet<string>(nextOut, StringComparer.OrdinalIgnoreCase);
+                for (var insIndex = block.Instructions.Count - 1; insIndex >= 0; insIndex--)
+                {
+                    UpdateLivePureLocalTemps(block.Instructions[insIndex], nextIn);
+                }
+
+                if (!nextOut.SetEquals(liveOut[block.Label]))
+                {
+                    liveOut[block.Label] = nextOut;
+                    changed = true;
+                }
+
+                if (!nextIn.SetEquals(liveIn[block.Label]))
+                {
+                    liveIn[block.Label] = nextIn;
+                    changed = true;
+                }
+            }
+        }
+
+        var rewrittenBlocks = new IrBasicBlock[function.Blocks.Count];
+        var removedAny = false;
+
+        for (var blockIndex = function.Blocks.Count - 1; blockIndex >= 0; blockIndex--)
+        {
+            var block = function.Blocks[blockIndex];
+            var rewritten = new List<IrInstruction>(block.Instructions.Count);
+            var live = new HashSet<string>(liveOut[block.Label], StringComparer.OrdinalIgnoreCase);
+
+            for (var insIndex = block.Instructions.Count - 1; insIndex >= 0; insIndex--)
+            {
+                var instruction = block.Instructions[insIndex];
+                if (instruction is IrAssign assign && IsDeadPureLocalDestination(assign.Destination, live))
+                {
+                    removedAny = true;
+                    continue;
+                }
+
+                if (instruction is IrBinary binary && IsDeadPureLocalDestination(binary.Destination, live))
+                {
+                    removedAny = true;
+                    continue;
+                }
+
+                rewritten.Add(instruction);
+                UpdateLivePureLocalTemps(instruction, live);
+            }
+
+            rewritten.Reverse();
+            rewrittenBlocks[blockIndex] = removedAny && rewritten.Count != block.Instructions.Count
+                ? block with { Instructions = rewritten }
+                : block;
+        }
+
+        return removedAny
+            ? function with { Blocks = rewrittenBlocks }
+            : function;
+    }
+
+    private static bool IsDeadPureLocalDestination(string destination, HashSet<string> live)
+    {
+        return !IsCpuRegister(destination) && !live.Contains(destination);
+    }
+
+    private static void UpdateLivePureLocalTemps(IrInstruction instruction, HashSet<string> live)
+    {
+        switch (instruction)
+        {
+            case IrAssign assign:
+                KillIfPureLocal(assign.Destination, live);
+                AddIfPureLocal(assign.Value, live);
+                break;
+
+            case IrBinary binary:
+                KillIfPureLocal(binary.Destination, live);
+                AddIfPureLocal(binary.Left, live);
+                AddIfPureLocal(binary.Right, live);
+                break;
+
+            case IrLoad load:
+                // Preserve all memory reads. They can validate guest addresses or expose
+                // unsupported hardware reads even when the loaded value is dead.
+                KillIfPureLocal(load.Destination, live);
+                AddIfPureLocal(load.Address.Base, live);
+                break;
+
+            case IrStore store:
+                AddIfPureLocal(store.Address.Base, live);
+                AddIfPureLocal(store.Source, live);
+                break;
+
+            case IrCall call:
+                if (!string.IsNullOrWhiteSpace(call.Destination))
+                {
+                    KillIfPureLocal(call.Destination, live);
+                }
+                foreach (var arg in call.Arguments)
+                {
+                    AddIfPureLocal(arg, live);
+                }
+                break;
+
+            case IrIndirectCall indirectCall:
+                if (!string.IsNullOrWhiteSpace(indirectCall.Destination))
+                {
+                    KillIfPureLocal(indirectCall.Destination, live);
+                }
+                AddIfPureLocal(indirectCall.Target, live);
+                foreach (var arg in indirectCall.Arguments)
+                {
+                    AddIfPureLocal(arg, live);
+                }
+                break;
+
+            case IrSetCrField setCr:
+                AddIfPureLocal(setCr.Left, live);
+                AddIfPureLocal(setCr.Right, live);
+                break;
+
+            case IrPhi phi:
+                if (!IsCpuRegister(phi.Destination))
+                {
+                    live.Remove(phi.Destination);
+                }
+                foreach (var source in phi.Sources.Values)
+                {
+                    AddIfPureLocal(source, live);
+                }
+                break;
+
+            case IrBranch branch when IsCpuRegister(branch.ConditionRegister):
+                AddIfPureLocal(branch.ConditionRegister, live);
+                break;
+
+            case IrIndirectJump indirectJump:
+                AddIfPureLocal(indirectJump.Target, live);
+                break;
+
+            case IrJumpTable jumpTable:
+                AddIfPureLocal(jumpTable.Selector, live);
+                break;
+
+            case IrReturn { Value: { } value }:
+                AddIfPureLocal(value, live);
+                break;
+        }
+    }
+
+    private static void AddIfPureLocal(IrValue value, HashSet<string> live)
+    {
+        if (value.Kind == "register" && value.RegisterName != null)
+        {
+            AddIfPureLocal(value.RegisterName, live);
+        }
+    }
+
+    private static void AddIfPureLocal(string name, HashSet<string> live)
+    {
+        if (!IsCpuRegister(name))
+        {
+            live.Add(name);
+        }
+    }
+
+    private static void KillIfPureLocal(string name, HashSet<string> live)
+    {
+        if (!IsCpuRegister(name))
+        {
+            live.Remove(name);
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.EmitInstruction.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.EmitInstruction.cs
new file mode 100644
index 0000000..6c2e0eb
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.EmitInstruction.cs
@@ -0,0 +1,775 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    private static void EmitInstruction(string currentLabel, int directCallOrdinal, IrInstruction ins, StringBuilder sb, int bufferBaseLength, int indent,
+        IrCfg cfg, Dictionary<string, string> labelNames, RepresentationEnvironment types, FunctionAbiClassification signature,
+        Dictionary<string, bool> localPaired, IGuestFunctionAbiProvider guestAbiProvider,
+        IReadOnlyDictionary<string, uint> knownConstants,
+        IReadOnlyDictionary<string, uint> localConstants,
+        LinkedAddressRemap? linkedAddressRemap,
+        IReadOnlySet<uint> nonReturningCallTargets,
+        IReadOnlySet<uint> lrContinuationCallTargets,
+        StackAddressFacts stackFacts,
+        bool inlineGuestThunkStackBase,
+        uint? localFallthroughLr,
+        IReadOnlyDictionary<uint, GuestAbiContract> guestAbiContracts,
+        IReadOnlyDictionary<uint, GuestAbiContract> stateFreeAbiContracts,
+        IReadOnlyDictionary<uint, string> stateFreeCallSymbols,
+        IReadOnlyDictionary<GuestStateFreeCallSiteKey, GuestStateFreeCallVariant> stateFreeCallSiteVariants,
+        IReadOnlySet<uint> modOverridableCallTargets)
+    {
+        if (ins is IrPhi)
+        {
+            return; // Phi nodes are eliminated before codegen.
+        }
+
+        var pad = IndentPad(indent);
+        switch (ins)
+        {
+            case IrAssign assign:
+                {
+                    var dest = ToDestination(assign.Destination, types);
+                    var src = ToRegisterAssignmentExpression(assign.Destination, assign.Value, types);
+                    sb.AppendLine($"{pad}{dest} = {src};");
+                    if (IsFloatRegister(assign.Destination))
+                    {
+                        var paired = false;
+                        if (assign.Value.Kind == "register" &&
+                            assign.Value.RegisterName != null &&
+                            IsFloatRegister(assign.Value.RegisterName))
+                        {
+                            var srcBase = GetRegisterBaseName(assign.Value.RegisterName);
+                            paired = localPaired.TryGetValue(srcBase, out var isPaired) && isPaired;
+                        }
+                        localPaired[GetRegisterBaseName(assign.Destination)] = paired;
+                    }
+                }
+                break;
+            case IrBinary bin:
+                {
+                    var dest = ToDestination(bin.Destination, types);
+                    var scalarFloatOperation = IsFloatRegister(bin.Destination);
+                    var left = scalarFloatOperation
+                        ? ToScalarFloatExpression(bin.Left, types, localPaired)
+                        : ToExpression(bin.Left, types);
+                    var right = scalarFloatOperation
+                        ? ToScalarFloatExpression(bin.Right, types, localPaired)
+                        : ToExpression(bin.Right, types);
+                    var expr = BinaryExpressionWithOperands(bin, left, right);
+                    sb.AppendLine($"{pad}{dest} = {expr};");
+                    if (IsFloatRegister(bin.Destination))
+                    {
+                        localPaired[GetRegisterBaseName(bin.Destination)] = false;
+                    }
+                }
+                break;
+            case IrLoad load:
+                {
+                    var dest = ToDestination(load.Destination, types);
+                    var destType = types.Get(load.Destination);
+                    var isFloatDest = (destType is ValueRepresentation pt && pt.IsFloat) ||
+                                      IsFloatRegister(load.Destination);
+
+                    if (TryEmitStackLoad(load, dest, isFloatDest, sb, pad, types, stackFacts))
+                    {
+                    }
+                    else if (isFloatDest && load.SizeBytes == 4)
+                    {
+                        sb.AppendLine($"{pad}{dest} = {GuestLoadHelper(4, isFloat: true)}({RemapAddress(load.Address, types, localConstants, linkedAddressRemap)});");
+                    }
+                    else if (isFloatDest && load.SizeBytes == 8)
+                    {
+                        sb.AppendLine($"{pad}{dest} = {GuestLoadHelper(8, isFloat: true)}({RemapAddress(load.Address, types, localConstants, linkedAddressRemap)});");
+                    }
+                    else
+                    {
+                        sb.AppendLine($"{pad}{dest} = {GuestLoadHelper(load.SizeBytes, isFloat: false)}({RemapAddress(load.Address, types, localConstants, linkedAddressRemap)});");
+                    }
+                    if (IsFloatRegister(load.Destination))
+                    {
+                        localPaired[GetRegisterBaseName(load.Destination)] = false;
+                    }
+                }
+                break;
+            case IrStore store:
+                {
+                    var srcExpr = ToExpression(store.Source, types);
+                    var isFloatStore = store.Source.Kind == "register" && 
+                                       store.Source.RegisterName != null &&
+                                       IsFloatRegister(store.Source.RegisterName);
+                    if (isFloatStore &&
+                        store.SizeBytes == 4 &&
+                        store.Source.RegisterName != null &&
+                        localPaired.TryGetValue(GetRegisterBaseName(store.Source.RegisterName), out var sourceIsPaired) &&
+                        sourceIsPaired)
+                    {
+                        srcExpr = $"PPC_PsToScalarInline({srcExpr})";
+                    }
+
+                    if (TryEmitKnownGpuFifoStore(store, srcExpr, isFloatStore, sb, pad, knownConstants))
+                    {
+                        break;
+                    }
+
+                    // A translate-time-constant address outside the MMIO window (gather-pipe already handled
+                    // above) always takes the flat helper's plain-store arm, so the runtime MMIO test is provably dead.
+                    var provenRamStore =
+                        TryGetKnownEffectiveAddress(store.Address, knownConstants, out var knownStoreAddress) &&
+                        IsProvenRamStore(knownStoreAddress, store.SizeBytes);
+                    string StoreHelper(int sizeBytes, bool isFloat) => provenRamStore
+                        ? FlatWriteRamHelper(Bits(sizeBytes), isFloat)
+                        : GuestStoreHelper(sizeBytes, isFloat);
+
+                    if (TryEmitStackStore(store, srcExpr, isFloatStore, sb, pad, types, stackFacts))
+                    {
+                    }
+                    else if (isFloatStore && store.SizeBytes == 4)
+                    {
+                        sb.AppendLine($"{pad}{StoreHelper(4, isFloat: true)}({RemapAddress(store.Address, types, localConstants, linkedAddressRemap)}, {srcExpr});");
+                    }
+                    else if (isFloatStore && store.SizeBytes == 8)
+                    {
+                        sb.AppendLine($"{pad}{StoreHelper(8, isFloat: true)}({RemapAddress(store.Address, types, localConstants, linkedAddressRemap)}, {srcExpr});");
+                    }
+                    else
+                    {
+                        // Memory::Write8/Write16 take uint8_t/uint16_t, so cast to
+                        // the exact parameter type instead of widening to
+                        // uint32_t and letting the call narrow it again. The
+                        // stored bytes are identical either way. Write64 keeps a
+                        // 32-bit cast: it has no 64-bit integer producer here.
+                        var integerSource = store.SizeBytes switch
+                        {
+                            4 => srcExpr,
+                            1 or 2 => $"static_cast<uint{Bits(store.SizeBytes)}_t>({srcExpr})",
+                            _ => $"static_cast<uint32_t>({srcExpr})"
+                        };
+                        sb.AppendLine($"{pad}{StoreHelper(store.SizeBytes, isFloat: false)}({RemapAddress(store.Address, types, localConstants, linkedAddressRemap)}, {integerSource});");
+                    }
+                }
+                break;
+            case IrResolveGuestMemoryRange resolve:
+                {
+                    var start = RemapAddress(
+                        new IrAddress(resolve.Base.RegisterName!, resolve.MinOffset),
+                        types, localConstants, linkedAddressRemap);
+                    sb.AppendLine($"{pad}{resolve.Destination} = MemoryInline::ResolveRangeHost({start}, 0, {resolve.Length}u, {(resolve.NeedsReadAccess ? "true" : "false")}, {(resolve.NeedsWriteAccess ? "true" : "false")});");
+                }
+                break;
+            case IrResolvedLoad load:
+                {
+                    var dest = ToDestination(load.Destination, types);
+                    var destType = types.Get(load.Destination);
+                    var isFloatDest = (destType is ValueRepresentation pt && pt.IsFloat) || IsFloatRegister(load.Destination);
+                    var address = RemapAddress(load.OriginalAddress, types, localConstants, linkedAddressRemap);
+                    var helper = isFloatDest ? $"Float{Bits(load.SizeBytes)}" : Bits(load.SizeBytes).ToString();
+                    sb.AppendLine($"{pad}{dest} = MemoryInline::ReadResolved{helper}({load.Range}, {load.RangeOffset}u, {address});");
+                    if (IsFloatRegister(load.Destination))
+                        localPaired[GetRegisterBaseName(load.Destination)] = false;
+                }
+                break;
+            case IrResolvedStore store:
+                {
+                    var srcExpr = ToExpression(store.Source, types);
+                    var isFloatStore = store.Source.Kind == "register" && store.Source.RegisterName is not null &&
+                                       IsFloatRegister(store.Source.RegisterName);
+                    if (isFloatStore && store.SizeBytes == 4 && store.Source.RegisterName is not null &&
+                        localPaired.TryGetValue(GetRegisterBaseName(store.Source.RegisterName), out var sourceIsPaired) && sourceIsPaired)
+                        srcExpr = $"PPC_PsToScalarInline({srcExpr})";
+                    var address = RemapAddress(store.OriginalAddress, types, localConstants, linkedAddressRemap);
+                    var helper = isFloatStore ? $"Float{Bits(store.SizeBytes)}" : Bits(store.SizeBytes).ToString();
+                    var value = isFloatStore || store.SizeBytes == 4 ? srcExpr : $"static_cast<uint{Bits(store.SizeBytes)}_t>({srcExpr})";
+                    sb.AppendLine($"{pad}MemoryInline::WriteResolved{helper}({store.Range}, {store.RangeOffset}u, {address}, {value});");
+                }
+                break;
+            case IrResolvedPsqLoad load:
+                {
+                    var helper = load.KnownGqr.HasValue
+                        ? "PPC_PsqLKnownResolvedInline"
+                        : "PPC_PsqLResolvedInline";
+                    var known = load.KnownGqr.HasValue ? $", 0x{load.KnownGqr.Value:X8}u" : string.Empty;
+                    var template = $"<{load.W}u, {load.I}u{known}>";
+                    var address = ToExpression(load.OriginalAddress, types);
+                    var knownCall = $"{helper}{template}(ctx, {load.Range}, {load.RangeOffset}u, {address})";
+                    if (load.GuardKnownGqr && load.KnownGqr.HasValue)
+                    {
+                        var fallback = $"PPC_PsqLResolvedInline<{load.W}u, {load.I}u>(ctx, {load.Range}, {load.RangeOffset}u, {address})";
+                        sb.AppendLine($"{pad}if ({GqrEntryGuardName(load.I, load.KnownGqr.Value)}) {{");
+                        sb.AppendLine($"{pad}    {PairedAssignment(load.Destination, knownCall, types)}");
+                        sb.AppendLine($"{pad}}} else {{");
+                        sb.AppendLine($"{pad}    {PairedAssignment(load.Destination, fallback, types)}");
+                        sb.AppendLine($"{pad}}}");
+                    }
+                    else sb.AppendLine($"{pad}{PairedAssignment(load.Destination, knownCall, types)}");
+                    if (IsFloatRegister(load.Destination))
+                        localPaired[GetRegisterBaseName(load.Destination)] = true;
+                }
+                break;
+            case IrResolvedPsqStore store:
+                {
+                    var helper = store.KnownGqr.HasValue
+                        ? "PPC_PsqStKnownResolvedInline"
+                        : "PPC_PsqStResolvedInline";
+                    var known = store.KnownGqr.HasValue ? $", 0x{store.KnownGqr.Value:X8}u" : string.Empty;
+                    var template = $"<{store.W}u, {store.I}u{known}>";
+                    var value = ToPairedFloatExpression(store.Source, types, localPaired);
+                    var address = ToExpression(store.OriginalAddress, types);
+                    var knownCall = $"{helper}{template}(ctx, {store.Range}, {store.RangeOffset}u, {address}, {value})";
+                    if (store.GuardKnownGqr && store.KnownGqr.HasValue)
+                    {
+                        sb.AppendLine($"{pad}if ({GqrEntryGuardName(store.I, store.KnownGqr.Value)}) {{");
+                        sb.AppendLine($"{pad}    {knownCall};");
+                        sb.AppendLine($"{pad}}} else {{");
+                        sb.AppendLine($"{pad}    PPC_PsqStResolvedInline<{store.W}u, {store.I}u>(ctx, {store.Range}, {store.RangeOffset}u, {address}, {value});");
+                        sb.AppendLine($"{pad}}}");
+                    }
+                    else sb.AppendLine($"{pad}{knownCall};");
+                }
+                break;
+            case IrResolvedLoadPair pair:
+                {
+                    bool IsFloat(string destination) =>
+                        (types.Get(destination) is ValueRepresentation primitive && primitive.IsFloat) || IsFloatRegister(destination);
+                    var firstFloat = IsFloat(pair.FirstDestination);
+                    var secondFloat = IsFloat(pair.SecondDestination);
+                    var firstAddress = RemapAddress(pair.FirstOriginalAddress, types, localConstants, linkedAddressRemap);
+                    var secondAddress = RemapAddress(pair.SecondOriginalAddress, types, localConstants, linkedAddressRemap);
+                    var pairHelper = pair.ElementSizeBytes == 2
+                        ? $"MemoryInline::ReadResolvedPair16({pair.Range}, {pair.RangeOffset}u)"
+                        : $"MemoryInline::ReadResolvedPair32({pair.Range}, {pair.RangeOffset}u)";
+                    string FastValue(string member, bool isFloat) => isFloat ? $"PpcBitCastToFloatInline(resolved_pair.{member})" : $"resolved_pair.{member}";
+                    string SlowHelper(bool isFloat) => isFloat ? $"Float{Bits(pair.ElementSizeBytes)}" : Bits(pair.ElementSizeBytes).ToString();
+                    var firstMember = pair.Descending ? "second" : "first";
+                    var secondMember = pair.Descending ? "first" : "second";
+                    var firstOffset = pair.Descending ? pair.RangeOffset + pair.ElementSizeBytes : pair.RangeOffset;
+                    var secondOffset = pair.Descending ? pair.RangeOffset : pair.RangeOffset + pair.ElementSizeBytes;
+                    sb.AppendLine($"{pad}{{");
+                    sb.AppendLine($"{pad}    const auto resolved_pair = {pairHelper};");
+                    sb.AppendLine($"{pad}    if (resolved_pair.valid) {{");
+                    sb.AppendLine($"{pad}        {ToDestination(pair.FirstDestination, types)} = {FastValue(firstMember, firstFloat)};");
+                    sb.AppendLine($"{pad}        {ToDestination(pair.SecondDestination, types)} = {FastValue(secondMember, secondFloat)};");
+                    sb.AppendLine($"{pad}    }} else {{");
+                    sb.AppendLine($"{pad}        {ToDestination(pair.FirstDestination, types)} = MemoryInline::ReadResolved{SlowHelper(firstFloat)}({pair.Range}, {firstOffset}u, {firstAddress});");
+                    sb.AppendLine($"{pad}        {ToDestination(pair.SecondDestination, types)} = MemoryInline::ReadResolved{SlowHelper(secondFloat)}({pair.Range}, {secondOffset}u, {secondAddress});");
+                    sb.AppendLine($"{pad}    }}");
+                    sb.AppendLine($"{pad}}}");
+                    if (IsFloatRegister(pair.FirstDestination)) localPaired[GetRegisterBaseName(pair.FirstDestination)] = false;
+                    if (IsFloatRegister(pair.SecondDestination)) localPaired[GetRegisterBaseName(pair.SecondDestination)] = false;
+                }
+                break;
+            case IrResolvedStorePair pair:
+                {
+                    bool IsFloat(IrValue source) => source.RegisterName is { } name && IsFloatRegister(name);
+                    string Source(IrValue source)
+                    {
+                        var expression = ToExpression(source, types);
+                        if (pair.ElementSizeBytes == 4 && source.RegisterName is { } name && IsFloatRegister(name) &&
+                            localPaired.TryGetValue(GetRegisterBaseName(name), out var paired) && paired)
+                            expression = $"PPC_PsToScalarInline({expression})";
+                        return expression;
+                    }
+                    var firstFloat = IsFloat(pair.FirstSource);
+                    var secondFloat = IsFloat(pair.SecondSource);
+                    var first = Source(pair.FirstSource);
+                    var second = Source(pair.SecondSource);
+                    string Raw(string value, bool isFloat) => isFloat
+                        ? $"PpcBitCastToU32Inline(static_cast<float>({value}))"
+                        : $"static_cast<uint32_t>({value})";
+                    var lowSource = pair.Descending ? second : first;
+                    var highSource = pair.Descending ? first : second;
+                    var lowFloat = pair.Descending ? secondFloat : firstFloat;
+                    var highFloat = pair.Descending ? firstFloat : secondFloat;
+                    var packed = pair.ElementSizeBytes == 2
+                        ? $"((static_cast<uint32_t>(static_cast<uint16_t>({lowSource})) << 16) | static_cast<uint16_t>({highSource}))"
+                        : $"((static_cast<uint64_t>({Raw(lowSource, lowFloat)}) << 32) | {Raw(highSource, highFloat)})";
+                    var firstAddress = RemapAddress(pair.FirstOriginalAddress, types, localConstants, linkedAddressRemap);
+                    var secondAddress = RemapAddress(pair.SecondOriginalAddress, types, localConstants, linkedAddressRemap);
+                    var fast = pair.ElementSizeBytes == 2
+                        ? $"MemoryInline::WriteResolvedPair16({pair.Range}, {pair.RangeOffset}u, {packed})"
+                        : $"MemoryInline::WriteResolvedPair32({pair.Range}, {pair.RangeOffset}u, {packed})";
+                    string Helper(bool isFloat) => isFloat ? $"Float{Bits(pair.ElementSizeBytes)}" : Bits(pair.ElementSizeBytes).ToString();
+                    var firstOffset = pair.Descending ? pair.RangeOffset + pair.ElementSizeBytes : pair.RangeOffset;
+                    var secondOffset = pair.Descending ? pair.RangeOffset : pair.RangeOffset + pair.ElementSizeBytes;
+                    sb.AppendLine($"{pad}if (!{fast}) {{");
+                    sb.AppendLine($"{pad}    MemoryInline::WriteResolved{Helper(firstFloat)}({pair.Range}, {firstOffset}u, {firstAddress}, {first});");
+                    sb.AppendLine($"{pad}    MemoryInline::WriteResolved{Helper(secondFloat)}({pair.Range}, {secondOffset}u, {secondAddress}, {second});");
+                    sb.AppendLine($"{pad}}}");
+                }
+                break;
+            case IrCall call:
+                if (TryParseAddress(call.Target, out var addr))
+                {
+                    if (TryEmitInlineGuestThunk(addr, sb, pad, types, inlineGuestThunkStackBase))
+                    {
+                        break;
+                    }
+
+                    // Guest call boundary: CpuContext becomes authoritative for the callee. Argument normalization
+                    // and state-free marshalling both read/write CpuContext directly, so the flush choice below
+                    // can't be narrowed when either is present; normalization is built into its own buffer first
+                    // so the emit order stays fixed.
+                    var argumentNormalization = new StringBuilder();
+                    EmitNormalizeGuestCallFloatArguments(
+                        call.Target, call.Arguments, argumentNormalization, pad, localPaired, guestAbiProvider);
+                    var callSiteKey = new GuestStateFreeCallSiteKey(currentLabel, addr, directCallOrdinal);
+                    var hasCallSiteVariant = stateFreeCallSiteVariants.TryGetValue(callSiteKey, out var callSiteVariant);
+                    var stateFreeSymbol = hasCallSiteVariant
+                        ? callSiteVariant!.Symbol
+                        : stateFreeCallSymbols.GetValueOrDefault(addr);
+                    var stateFreeContract = hasCallSiteVariant
+                        ? callSiteVariant!.Contract
+                        : stateFreeAbiContracts.GetValueOrDefault(addr);
+                    var usesStateFreeCall = stateFreeSymbol is not null && stateFreeContract is not null &&
+                                            IsStateFreeCallSafe(stateFreeContract);
+                    var resumesThroughLinkRegister =
+                        nonReturningCallTargets.Contains(addr) ||
+                        (lrContinuationCallTargets.Contains(addr) && localFallthroughLr.HasValue);
+                    // The explicit-state signature carries everything the callee reads/writes, so a resident caller
+                    // can pass host registers instead of spilling to CpuContext. Excluded: paired-single arg/return
+                    // normalization rewrites ctx->fpr[N] directly, and LR-continuation sites dispatch on ctx->lr
+                    // after the callee writes it, so those keep the full boundary.
+                    var marshalsStateFreeThroughResidency =
+                        usesStateFreeCall &&
+                        _activeResidency is not null &&
+                        argumentNormalization.Length == 0 &&
+                        !resumesThroughLinkRegister &&
+                        !IsGuestPairedScalarFloatReturn(guestAbiProvider, call.Target);
+                    if (marshalsStateFreeThroughResidency)
+                    {
+                        EmitResidentStateFreeCall(
+                            sb, pad, bufferBaseLength, addr, stateFreeSymbol!, stateFreeContract!,
+                            localFallthroughLr, stateFreeAbiContracts, stateFreeCallSymbols);
+                        // Emits nothing for this shape (the paired-scalar return
+                        // case is excluded above); it still owns the f1
+                        // representation tag every guest call boundary applies.
+                        EmitNormalizeGuestCallFloatReturn(call.Target, sb, pad, localPaired, guestAbiProvider);
+                        break;
+                    }
+                    var boundarySync = usesStateFreeCall || argumentNormalization.Length != 0
+                        ? ResidencyBoundarySync.Full
+                        : ResolveDirectCallBoundarySync(addr, guestAbiContracts, modOverridableCallTargets);
+                    if (!boundarySync.IsFull &&
+                        IsGuestPairedScalarFloatReturn(guestAbiProvider, call.Target))
+                    {
+                        // The return normalization below rewrites ctx->fpr[1]
+                        // directly, so f1 has to be part of this boundary even if
+                        // the callee contract does not mention it.
+                        boundarySync = boundarySync.WithFpr(1);
+                    }
+                    AppendFlush(sb, pad, boundarySync);
+                    sb.Append(argumentNormalization);
+                    if (usesStateFreeCall)
+                    {
+                        sb.AppendLine($"{pad}if ({StateFreeAvailabilityCondition(addr, stateFreeAbiContracts, stateFreeCallSymbols)}) {{");
+                        if (StateFreeHasOutputs(stateFreeContract!))
+                        {
+                            // Uniquified by the call site's position in the
+                            // translation unit. The body is built in its own
+                            // buffer, so the offset of that buffer inside the
+                            // unit has to be added back.
+                            var stateFreeResult = $"state_free_result_{addr:X8}_{bufferBaseLength + sb.Length:X}";
+                            sb.AppendLine($"{pad}    const auto {stateFreeResult} = {stateFreeSymbol}({StateFreeCallArguments(stateFreeContract!, localFallthroughLr)});");
+                            AppendStateFreeResultStores(sb, pad + "    ", addr, stateFreeContract!, stateFreeResult);
+                        }
+                        else
+                        {
+                            sb.AppendLine($"{pad}    {stateFreeSymbol}({StateFreeCallArguments(stateFreeContract!, localFallthroughLr)});");
+                        }
+                        sb.AppendLine($"{pad}}} else {{");
+                        RecordEmittedDirectCallTarget(addr);
+                        sb.AppendLine($"{pad}    InvokeDirectCpu<0x{addr:X8}u>(ctx);");
+                        sb.AppendLine($"{pad}}}");
+                    }
+                    else
+                    {
+                        RecordEmittedDirectCallTarget(addr);
+                        sb.AppendLine($"{pad}InvokeDirectCpu<0x{addr:X8}u>(ctx);");
+                    }
+                    if (resumesThroughLinkRegister)
+                    {
+                        // The callee may resume this body through a local LR
+                        // continuation label, so the locals must be refreshed
+                        // from the context it just wrote. The exit paths below
+                        // return without writing locals back.
+                        AppendReload(sb, pad, boundarySync);
+                        var fallbackPad = pad;
+                        if (localFallthroughLr.HasValue)
+                        {
+                            sb.AppendLine($"{pad}if (ctx->lr != 0x{localFallthroughLr.Value:X8}u) {{");
+                            fallbackPad = IndentPad(indent + 1);
+                        }
+
+                        EmitLocalLrContinuationDispatch(sb, fallbackPad, labelNames);
+                        sb.AppendLine($"{fallbackPad}if (TranslatedFunctionRegistry::FindByAddressPtr(ctx->lr) != nullptr) {{");
+                        sb.AppendLine($"{fallbackPad}    InvokeIndirectCpu(ctx->lr, ctx);");
+                        sb.AppendLine($"{fallbackPad}}}");
+                        sb.AppendLine($"{fallbackPad}return;");
+                        if (localFallthroughLr.HasValue)
+                        {
+                            sb.AppendLine($"{pad}}}");
+                        }
+                        break;
+                    }
+                    EmitNormalizeGuestCallFloatReturn(call.Target, sb, pad, localPaired, guestAbiProvider);
+                    AppendReload(sb, pad, boundarySync);
+                }
+                else if (IsGuestCallTarget(call.Target))
+                {
+                    var targetSymbol = FormatSymbol(call.Target);
+                    AppendFlush(sb, pad);
+                    EmitNormalizeGuestCallFloatArguments(call.Target, call.Arguments, sb, pad, localPaired, guestAbiProvider);
+                    sb.AppendLine($"{pad}{targetSymbol}(ctx);");
+                    EmitNormalizeGuestCallFloatReturn(call.Target, sb, pad, localPaired, guestAbiProvider);
+                    AppendReload(sb, pad);
+                }
+                else
+                {
+                    // Try inline expansion first for performance
+                    if (TryEmitInlinePpc(call, sb, pad, types, localPaired, stackFacts))
+                    {
+                        // Inline code was emitted - update paired tracking
+                        if (!string.IsNullOrWhiteSpace(call.Destination) && IsFloatRegister(call.Destination))
+                        {
+                            localPaired[GetRegisterBaseName(call.Destination)] = IsPairedProducerTarget(call.Target);
+                        }
+                        break;
+                    }
+
+                    // Helper function call (e.g., PPC_Ps*, memory helpers)
+                    var isPairedConsumer = IsPairedConsumerTarget(call.Target);
+                    var isSingleConsumer = IsSinglePrecisionConsumerTarget(call.Target);
+                    var isScalarConsumer = IsScalarFloatConsumerTarget(call.Target);
+                    var args = new List<string>(call.Arguments.Count);
+                    for (var argIndex = 0; argIndex < call.Arguments.Count; argIndex++)
+                    {
+                        var argVal = call.Arguments[argIndex];
+                        var expr = isPairedConsumer
+                            ? ToPairedFloatExpression(argVal, types, localPaired)
+                            : (isSingleConsumer || isScalarConsumer)
+                                ? ToScalarFloatExpression(argVal, types, localPaired)
+                                : ToExpression(argVal, types);
+                        args.Add(expr);
+                    }
+                    // Helpers can implicitly touch guest state through CpuContext (PPC_Stwcx writes CR0, PPC_Lswi
+                    // writes GPRs, OSSystemCall is a full boundary). Resident locals can't observe that, so the
+                    // cataloged effect becomes a mini boundary: flush what it may read, reload what it may write.
+                    var helperSync = _activeResidency is not null
+                        ? ResidencyBoundarySync.FromHelperEffect(AnalyzeGuestHelperEffect(call))
+                        : null;
+                    if (helperSync is not null && !helperSync.IsEmpty)
+                    {
+                        AppendFlush(sb, pad, helperSync);
+                    }
+                    var callExpr = $"{FormatSymbol(call.Target)}({string.Join(", ", args)})";
+                    if (!string.IsNullOrWhiteSpace(call.Destination))
+                    {
+                        sb.AppendLine(IsPairedProducerTarget(call.Target)
+                            ? $"{pad}{PairedAssignment(call.Destination, callExpr, types)}"
+                            : $"{pad}{ToDestination(call.Destination, types)} = {callExpr};");
+                    }
+                    else
+                    {
+                        sb.AppendLine($"{pad}{callExpr};");
+                    }
+                    if (helperSync is not null && !helperSync.IsEmpty)
+                    {
+                        // An explicit destination carries the helper's return
+                        // value in the local; reloading it from CpuContext would
+                        // clobber that result with stale state.
+                        var reloadSync = ExcludeDestinationFromReload(helperSync, call.Destination);
+                        AppendReload(sb, pad, reloadSync);
+                    }
+                }
+                if (!string.IsNullOrWhiteSpace(call.Destination) && IsFloatRegister(call.Destination))
+                {
+                    localPaired[GetRegisterBaseName(call.Destination)] = IsPairedProducerTarget(call.Target);
+                }
+                break;
+            case IrIndirectCall icall:
+                {
+                    var indirectTarget = ToExpression(icall.Target, types);
+                    AppendFlush(sb, pad);
+                    sb.AppendLine($"{pad}InvokeIndirectCpu({indirectTarget}, ctx);");
+                    AppendReload(sb, pad);
+                    // f1 is the conventional scalar floating-point return.
+                    // Do not retag the other volatile FPRs: a callee that leaves
+                    // one untouched also leaves its packed payload untouched.
+                    localPaired["f1"] = false;
+                }
+                break;
+            case IrIndirectJump ijump:
+                {
+                    var jumpTarget = ToExpression(ijump.Target, types);
+                    // Tail dispatch: the callee inherits authoritative context
+                    // and this frame never observes registers again, so the
+                    // locals must not be written back afterwards.
+                    AppendFlush(sb, pad);
+                    sb.AppendLine($"{pad}InvokeIndirectJump({jumpTarget}, ctx);");
+                    sb.AppendLine($"{pad}return;");
+                }
+                break;
+            case IrComment comment:
+                {
+                    // Emit as a C++ comment - these are legitimate comments like nop, mtcrf no-op, psq operations
+                    sb.AppendLine($"{pad}// {EscapeForCxxLiteral(comment.Text)}");
+                }
+                break;
+            case IrTracePpc trace:
+                {
+                }
+                break;
+            case IrUndefined undef:
+                {
+                    var details = undef.Reason == null
+                        ? $"{undef.Disassembly}"
+                        : $"{undef.Disassembly} | {undef.Reason}";
+                    var escaped = EscapeForCxxLiteral(details);
+                    sb.AppendLine($"{pad}UNDEFINED(0x{undef.Address:X8}u, 0x{undef.RawInstruction:X8}u, \"{escaped}\");");
+                }
+                break;
+            case IrSetCrField setCr:
+                {
+                    var leftExpr = ToExpression(setCr.Left, types);
+                    var rightExpr = ToExpression(setCr.Right, types);
+                    // The resident helpers take the CR by reference and XER by
+                    // value. Both are localized, so the summary-overflow copy
+                    // reads a host register instead of reloading CpuContext
+                    // after every potentially aliasing guest store.
+                    if (IsFloatValue(setCr.Left, types) || IsFloatValue(setCr.Right, types))
+                    {
+                        leftExpr = ToScalarFloatExpression(setCr.Left, types, localPaired);
+                        rightExpr = ToScalarFloatExpression(setCr.Right, types, localPaired);
+                        sb.AppendLine(_activeResidency is null
+                            ? $"{pad}SetCRFloat(ctx, {setCr.FieldIndex}, {leftExpr}, {rightExpr});"
+                            : $"{pad}SetCRFloatResident({_activeResidency.Cr(written: true)}, {setCr.FieldIndex}, {leftExpr}, {rightExpr});");
+                    }
+                    else
+                    {
+                        var leftCast = setCr.IsUnsigned
+                            ? $"static_cast<uint32_t>({leftExpr})"
+                            : $"static_cast<int32_t>({leftExpr})";
+                        var rightCast = setCr.IsUnsigned
+                            ? $"static_cast<uint32_t>({rightExpr})"
+                            : $"static_cast<int32_t>({rightExpr})";
+                        sb.AppendLine(_activeResidency is null
+                            ? $"{pad}SetCR(ctx, {setCr.FieldIndex}, {leftCast}, {rightCast});"
+                            : $"{pad}SetCRResident({_activeResidency.Cr(written: true)}, {_activeResidency.Xer(written: false)}, {setCr.FieldIndex}, {leftCast}, {rightCast});");
+                    }
+                }
+                break;
+        }
+    }
+
+    private static bool TryEmitStackLoad(
+        IrLoad load,
+        string dest,
+        bool isFloatDest,
+        StringBuilder sb,
+        string pad,
+        RepresentationEnvironment types,
+        StackAddressFacts stackFacts)
+    {
+        if (!stackFacts.TryResolve(load.Address, out _))
+        {
+            return false;
+        }
+
+        var address = Address(load.Address, types);
+        if (isFloatDest && load.SizeBytes == 4)
+        {
+            sb.AppendLine($"{pad}{dest} = {StackLoadHelper(4, isFloat: true)}({address});");
+            return true;
+        }
+        if (isFloatDest && load.SizeBytes == 8)
+        {
+            sb.AppendLine($"{pad}{dest} = {StackLoadHelper(8, isFloat: true)}({address});");
+            return true;
+        }
+
+        sb.AppendLine($"{pad}{dest} = {StackLoadHelper(load.SizeBytes, isFloat: false)}({address});");
+        return true;
+    }
+
+    private static bool TryEmitStackStore(
+        IrStore store,
+        string srcExpr,
+        bool isFloatStore,
+        StringBuilder sb,
+        string pad,
+        RepresentationEnvironment types,
+        StackAddressFacts stackFacts)
+    {
+        if (!stackFacts.TryResolve(store.Address, out _))
+        {
+            return false;
+        }
+
+        var address = Address(store.Address, types);
+        if (isFloatStore && store.SizeBytes == 4)
+        {
+            sb.AppendLine($"{pad}{StackStoreHelper(4, isFloat: true)}({address}, {srcExpr});");
+            return true;
+        }
+        if (isFloatStore && store.SizeBytes == 8)
+        {
+            sb.AppendLine($"{pad}{StackStoreHelper(8, isFloat: true)}({address}, {srcExpr});");
+            return true;
+        }
+
+        var bits = Bits(store.SizeBytes);
+        var integerSource = bits == 32 ? srcExpr : $"static_cast<uint{bits}_t>({srcExpr})";
+        sb.AppendLine($"{pad}{StackStoreHelper(store.SizeBytes, isFloat: false)}({address}, {integerSource});");
+        return true;
+    }
+
+    private static bool TryEmitKnownGpuFifoStore(
+        IrStore store,
+        string srcExpr,
+        bool isFloatStore,
+        StringBuilder sb,
+        string pad,
+        IReadOnlyDictionary<string, uint> knownConstants)
+    {
+        if (!TryGetKnownGpuFifoStore(store, isFloatStore, knownConstants, out var fifoStore))
+        {
+            return false;
+        }
+
+        if (isFloatStore)
+        {
+            if (_activeGpuFifoBurstSlot is { } floatSlot)
+            {
+                EmitGpuFifoBurstSlotStore(sb, pad, floatSlot, srcExpr);
+                return true;
+            }
+
+            sb.AppendLine($"{pad}GX_HLE_FIFO_WriteFloat(static_cast<float>({srcExpr}));");
+            return true;
+        }
+
+        if (_activeGpuFifoBurstSlot is { } slot)
+        {
+            EmitGpuFifoBurstSlotStore(sb, pad, slot, srcExpr);
+            return true;
+        }
+
+        var helper = fifoStore.ByteLength switch
+        {
+            1 => "GX_HLE_FIFO_Write8",
+            2 => "GX_HLE_FIFO_Write16",
+            4 => "GX_HLE_FIFO_Write32",
+            _ => throw new InvalidOperationException($"Unexpected GPU FIFO width {fifoStore.ByteLength}.")
+        };
+        sb.AppendLine($"{pad}{helper}(static_cast<uint{fifoStore.ByteLength * 8}_t>({srcExpr}));");
+        return true;
+    }
+
+    private static void EmitLocalLrContinuationDispatch(
+        StringBuilder sb,
+        string pad,
+        IReadOnlyDictionary<string, string> labelNames)
+    {
+        var localContinuations = labelNames
+            .Where(static pair => TryParseAddress(pair.Key, out _))
+            .Select(static pair =>
+            {
+                TryParseAddress(pair.Key, out var address);
+                return (Address: address, Label: pair.Value);
+            })
+            .OrderBy(static item => item.Address)
+            .ToArray();
+
+        if (localContinuations.Length == 0)
+        {
+            return;
+        }
+
+        sb.AppendLine($"{pad}switch (ctx->lr) {{");
+        foreach (var (address, label) in localContinuations)
+        {
+            RecordEmittedLocalLabel(label);
+            sb.AppendLine($"{pad}case 0x{address:X8}u:");
+            sb.AppendLine($"{pad}    goto {label};");
+        }
+
+        sb.AppendLine($"{pad}default:");
+        sb.AppendLine($"{pad}    break;");
+        sb.AppendLine($"{pad}}}");
+    }
+
+    private static bool TryGetKnownEffectiveAddress(
+        IrAddress address,
+        IReadOnlyDictionary<string, uint> knownConstants,
+        out uint effectiveAddress)
+    {
+        if (knownConstants.TryGetValue(address.Base, out var baseAddress))
+        {
+            effectiveAddress = unchecked(baseAddress + (uint)address.Offset);
+            return true;
+        }
+
+        effectiveAddress = 0;
+        return false;
+    }
+
+    private static bool IsGpuFifoAddress(uint address) =>
+        address >= 0xCC008000u && address < 0xCC008100u;
+
+    private static void EmitNormalizeGuestCallFloatArguments(
+        string target,
+        IReadOnlyList<IrValue> arguments,
+        StringBuilder sb,
+        string pad,
+        Dictionary<string, bool> localPaired,
+        IGuestFunctionAbiProvider guestAbiProvider)
+    {
+        foreach (var arg in arguments)
+        {
+            if (arg.Kind != "register" || arg.RegisterName == null)
+            {
+                continue;
+            }
+
+            var baseName = GetRegisterBaseName(arg.RegisterName);
+            if (!localPaired.TryGetValue(baseName, out var isPaired) ||
+                !isPaired ||
+                !IsGuestScalarFloatArgument(guestAbiProvider, target, baseName))
+            {
+                continue;
+            }
+
+            var regIndex = ParseFloatRegisterIndex(baseName);
+            sb.AppendLine($"{pad}ctx->fpr[{regIndex}].d = PPC_PsToScalarInline(ctx->fpr[{regIndex}].d);");
+            localPaired[baseName] = false;
+        }
+    }
+
+    private static void EmitNormalizeGuestCallFloatReturn(
+        string target,
+        StringBuilder sb,
+        string pad,
+        Dictionary<string, bool> localPaired,
+        IGuestFunctionAbiProvider guestAbiProvider)
+    {
+        if (IsGuestPairedScalarFloatReturn(guestAbiProvider, target))
+        {
+            sb.AppendLine($"{pad}ctx->fpr[1].d = PPC_PsToScalarInline(ctx->fpr[1].d);");
+        }
+
+        // f1 is the conventional scalar floating-point return. Preserve the
+        // representation tags for f2-f13: ABI volatility does not mean that an
+        // untouched packed payload has magically become a scalar value.
+        localPaired["f1"] = false;
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Expressions.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Expressions.cs
new file mode 100644
index 0000000..6884b6a
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Expressions.cs
@@ -0,0 +1,383 @@
+using System;
+using Translator.Core.Ir;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    private static string BinaryExpressionWithOperands(IrBinary bin, string left, string right)
+    {
+        if (bin.Op == "sext")
+        {
+            var widthBits = bin.Right.Constant.GetValueOrDefault(8);
+            return widthBits switch
+            {
+                16 => $"(static_cast<int32_t>(static_cast<int16_t>({left})))",
+                8 => $"(static_cast<int32_t>(static_cast<int8_t>({left})))",
+                _ => $"(static_cast<int32_t>({left}))",
+            };
+        }
+
+        return bin.Op switch
+        {
+            "add" => $"({left} + {right})",
+            "sub" => $"({left} - {right})",
+            "and" => $"({left} & {right})",
+            "andc" => $"({left} & ~{right})",
+            "or" => $"({left} | {right})",
+            "orc" => $"({left} | ~{right})",
+            "fdiv" => $"({left} / {right})",
+            "nor" => $"~({left} | {right})",
+            "nand" => $"~({left} & {right})",
+            "eqv" => $"~({left} ^ {right})",
+            "xor" => $"({left} ^ {right})",
+            "shl" => $"({left} << {right})",
+            "rotl" => $"PpcRotl32Inline(static_cast<uint32_t>({left}), static_cast<uint32_t>({right}))",
+            "shr" => $"({left} >> {right})",
+            "ppc_slw" => $"PPC_Slw(static_cast<uint32_t>({left}), static_cast<uint32_t>({right}))",
+            "ppc_srw" => $"PPC_Srw(static_cast<uint32_t>({left}), static_cast<uint32_t>({right}))",
+            "ppc_sraw" => $"PPC_Sraw(static_cast<uint32_t>({left}), static_cast<uint32_t>({right}))",
+            "fabs" => $"std::fabs({left})",
+            "fneg" => $"(-({left}))",
+            "frsp" => $"static_cast<double>(PpcForceSingleValueInline({left}))",
+            "frsp_noni" => $"static_cast<double>(static_cast<float>({left}))",
+            "fsqrt" => $"std::sqrt({left})",
+            "fcmp" => $"({left} - {right})",
+            "fctiw" => $"PPC_Fctiw({left})",
+            "fctiwz" => $"PPC_Fctiwz({left})",
+            "fpr_low_word" => $"PPC_FprLowWordInline({left})",
+            "sar" => $"(static_cast<int32_t>({left}) >> {right})",
+            "mul" => $"({left} * {right})",
+            "mulhwu" => $"(static_cast<uint32_t>((static_cast<uint64_t>({left}) * static_cast<uint64_t>({right})) >> 32))",
+            "mulhw" => $"(static_cast<int32_t>((static_cast<int64_t>(static_cast<int32_t>({left})) * static_cast<int64_t>(static_cast<int32_t>({right}))) >> 32))",
+            "divu" => $"PPC_Divwu(static_cast<uint32_t>({left}), static_cast<uint32_t>({right}))",
+            "div" => $"PPC_Divw(static_cast<int32_t>({left}), static_cast<int32_t>({right}))",
+            "sext16" => $"(static_cast<int32_t>(static_cast<int16_t>({left})))",
+            "not" => $"~({left})",
+            "sub_u" => $"(CompareUnsigned(static_cast<uint32_t>({left}), static_cast<uint32_t>({right})))",
+            _ => throw new ArgumentOutOfRangeException(nameof(bin.Op), bin.Op, null)
+        };
+    }
+
+    // Guest physical address window: MEM1 at 0x80000000 and MEM2 up to
+    // 0x94000000. A negative IR immediate whose unsigned form lands here is a
+    // code or data address that was only negative because IrValue carries a
+    // signed int.
+    private const uint GuestAddressWindowStart = 0x80000000u;
+    private const uint GuestAddressWindowEnd = 0x94000000u;
+
+    /// <summary>
+    /// Formats an assignment RHS. Negative <c>int</c> immediates that are really guest addresses (return
+    /// addresses, <c>lis/ori</c> constants) print as hex when the destination is an unsigned 32-bit guest
+    /// register, for readability only; small signed immediates like <c>-16</c> stay decimal.
+    /// </summary>
+    private static string ToRegisterAssignmentExpression(
+        string destination,
+        IrValue value,
+        RepresentationEnvironment types)
+    {
+        if (value.Kind == "const" &&
+            value.Constant is { } constant &&
+            constant < 0 &&
+            IsUnsigned32BitGuestRegister(destination))
+        {
+            var unsigned = unchecked((uint)constant);
+            if (unsigned is >= GuestAddressWindowStart and < GuestAddressWindowEnd)
+            {
+                return $"0x{unsigned:X8}u";
+            }
+        }
+
+        return ToExpression(value, types);
+    }
+
+    private static bool IsUnsigned32BitGuestRegister(string name)
+    {
+        if (!IsCpuRegister(name))
+        {
+            return false;
+        }
+
+        var baseName = BaseRegister(name);
+        if (baseName.Length > 1 && baseName[0] == 'r' &&
+            int.TryParse(baseName.AsSpan(1), out var gpr) && gpr is >= 0 and < 32)
+        {
+            return true;
+        }
+
+        // CR field destinations lower to ordinary locals whose host type comes
+        // from representation classification, so they are deliberately excluded.
+        return baseName.Equals("lr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("ctr", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static string ToExpression(IrValue val, RepresentationEnvironment types)
+    {
+        if (val.Kind == "const" && val.Constant.HasValue)
+        {
+            return val.Constant.Value.ToString();
+        }
+
+        if (val.Kind != "register" || val.RegisterName == null)
+        {
+            return "0";
+        }
+
+        var name = val.RegisterName;
+        if (IsCpuRegister(name))
+        {
+            return RegisterToReadExpression(name, types);
+        }
+
+        return name;
+    }
+
+    private static string RegisterToCtxRead(string name, RepresentationEnvironment types)
+    {
+        var baseName = BaseRegisterSpan(name);
+        var residency = _activeResidency;
+
+        if (baseName.Length > 1 && baseName[0] == 'r' && int.TryParse(baseName[1..], out var gpr) && gpr is >= 0 and < 32)
+        {
+            return residency is null ? CtxGprName(gpr) : residency.Gpr(gpr, written: false);
+        }
+
+        if (baseName.Length > 1 && baseName[0] == 'f' && int.TryParse(baseName[1..], out var fpr) && fpr is >= 0 and < 32)
+        {
+            return residency is null ? CtxFprScalarName(fpr) : residency.FprScalar(fpr, written: false);
+        }
+
+        if (baseName.Length == 3 && baseName.StartsWith("cr".AsSpan(), StringComparison.OrdinalIgnoreCase) && char.IsDigit(baseName[2]))
+        {
+            var crField = baseName[2] - '0';
+            if (crField is >= 0 and <= 7)
+            {
+                var shift = (7 - crField) * 4;
+                var crExpr = residency is null ? "ctx->cr" : residency.Cr(written: false);
+                return $"(({crExpr} >> {shift}) & 0xF)";
+            }
+        }
+
+        if (SpanEqualsIgnoreCase(baseName, "lr")) return "ctx->lr";
+        if (SpanEqualsIgnoreCase(baseName, "ctr")) return residency is null ? "ctx->ctr" : residency.Ctr(written: false);
+        if (SpanEqualsIgnoreCase(baseName, "cr")) return residency is null ? "ctx->cr" : residency.Cr(written: false);
+        if (SpanEqualsIgnoreCase(baseName, "xer")) return residency is null ? "ctx->xer" : residency.Xer(written: false);
+        if (SpanEqualsIgnoreCase(baseName, "srr0")) return "ctx->srr0";
+        if (SpanEqualsIgnoreCase(baseName, "srr1")) return "ctx->srr1";
+        if (SpanEqualsIgnoreCase(baseName, "msr")) return "ctx->msr";
+        if (SpanEqualsIgnoreCase(baseName, "hid0")) return "ctx->hid0";
+        if (SpanEqualsIgnoreCase(baseName, "hid1")) return "ctx->hid1";
+        if (SpanEqualsIgnoreCase(baseName, "hid2")) return "ctx->hid2";
+        if (baseName.StartsWith("gqr".AsSpan(), StringComparison.OrdinalIgnoreCase))
+        {
+            return int.TryParse(baseName[3..], out var gqrIdx) && gqrIdx is >= 0 and < 8
+                ? $"ctx->gqr[{gqrIdx}]"
+                : "0";
+        }
+
+        return "0";
+    }
+
+    private static string ToDestination(string name, RepresentationEnvironment types)
+    {
+        if (IsCpuRegister(name))
+        {
+            return RegisterToWriteExpression(name, types);
+        }
+
+        return name;
+    }
+
+    private static string RegisterToCtxWrite(string name, RepresentationEnvironment types)
+    {
+        var baseName = BaseRegisterSpan(name);
+        var residency = _activeResidency;
+
+        if (baseName.Length > 1 && baseName[0] == 'r' && int.TryParse(baseName[1..], out var gpr) && gpr is >= 0 and < 32)
+        {
+            return residency is null ? CtxGprName(gpr) : residency.Gpr(gpr, written: true);
+        }
+
+        if (baseName.Length > 1 && baseName[0] == 'f' && int.TryParse(baseName[1..], out var fpr) && fpr is >= 0 and < 32)
+        {
+            return residency is null ? CtxFprScalarName(fpr) : residency.FprScalar(fpr, written: true);
+        }
+
+        if (baseName.Length == 3 && baseName.StartsWith("cr".AsSpan(), StringComparison.OrdinalIgnoreCase) && char.IsDigit(baseName[2]))
+        {
+            return name;
+        }
+
+        if (SpanEqualsIgnoreCase(baseName, "lr")) return "ctx->lr";
+        if (SpanEqualsIgnoreCase(baseName, "ctr")) return residency is null ? "ctx->ctr" : residency.Ctr(written: true);
+        if (SpanEqualsIgnoreCase(baseName, "cr")) return residency is null ? "ctx->cr" : residency.Cr(written: true);
+        if (SpanEqualsIgnoreCase(baseName, "xer")) return residency is null ? "ctx->xer" : residency.Xer(written: true);
+        if (SpanEqualsIgnoreCase(baseName, "srr0")) return "ctx->srr0";
+        if (SpanEqualsIgnoreCase(baseName, "srr1")) return "ctx->srr1";
+        if (SpanEqualsIgnoreCase(baseName, "msr")) return "ctx->msr";
+        if (SpanEqualsIgnoreCase(baseName, "hid0")) return "ctx->hid0";
+        if (SpanEqualsIgnoreCase(baseName, "hid1")) return "ctx->hid1";
+        if (SpanEqualsIgnoreCase(baseName, "hid2")) return "ctx->hid2";
+        if (baseName.StartsWith("gqr".AsSpan(), StringComparison.OrdinalIgnoreCase))
+        {
+            return int.TryParse(baseName[3..], out var gqrIdx) && gqrIdx is >= 0 and < 8
+                ? $"ctx->gqr[{gqrIdx}]"
+                : name;
+        }
+
+        return name;
+    }
+
+    private static (int Mask, bool Set) CrFieldConditionTest(string condition)
+    {
+        if (EqualsIgnoreCase(condition, "bne")) return (2, false);
+        if (EqualsIgnoreCase(condition, "beq")) return (2, true);
+        if (EqualsIgnoreCase(condition, "bgt")) return (4, true);
+        if (EqualsIgnoreCase(condition, "ble")) return (4, false);
+        if (EqualsIgnoreCase(condition, "blt")) return (8, true);
+        if (EqualsIgnoreCase(condition, "bge")) return (8, false);
+        if (EqualsIgnoreCase(condition, "bso")) return (1, true);
+        if (EqualsIgnoreCase(condition, "bns")) return (1, false);
+        return (0, false);
+    }
+
+    private static bool EqualsIgnoreCase(string value, string candidate) =>
+        string.Equals(value, candidate, StringComparison.OrdinalIgnoreCase);
+
+    private static string ToCondition(string condition, string conditionRegister, RepresentationEnvironment types)
+    {
+        var conditionBase = BaseRegisterSpan(conditionRegister);
+        if (conditionBase.Length == 3 &&
+            conditionBase.StartsWith("cr".AsSpan(), StringComparison.OrdinalIgnoreCase) &&
+            conditionBase[2] is >= '0' and <= '7')
+        {
+            var field = conditionBase[2] - '0';
+            var fieldShift = (7 - field) * 4;
+            var (mask, set) = CrFieldConditionTest(condition);
+            if (mask != 0)
+            {
+                var shiftedMask = mask << fieldShift;
+                var crExpr = _activeResidency is null
+                    ? "ctx->cr"
+                    : _activeResidency.Cr(written: false);
+                return $"(({crExpr} & 0x{shiftedMask:X8}u) {(set ? "!=" : "==")} 0)";
+            }
+        }
+
+        var reg = IsCpuRegister(conditionRegister)
+            ? RegisterToReadExpression(conditionRegister, types)
+            : ResidentRawCondition(conditionRegister);
+
+        if (EqualsIgnoreCase(condition, "bdnz")) return $"({reg} != 0)";
+        if (EqualsIgnoreCase(condition, "bdz")) return $"({reg} == 0)";
+        if (EqualsIgnoreCase(condition, "bne")) return $"(({reg} & 0x2) == 0)";
+        if (EqualsIgnoreCase(condition, "beq")) return $"(({reg} & 0x2) != 0)";
+        if (EqualsIgnoreCase(condition, "bgt")) return $"(({reg} & 0x4) != 0)";
+        if (EqualsIgnoreCase(condition, "blt")) return $"(({reg} & 0x8) != 0)";
+        if (EqualsIgnoreCase(condition, "bge")) return $"(({reg} & 0x8) == 0)";
+        if (EqualsIgnoreCase(condition, "ble")) return $"(({reg} & 0x4) == 0)";
+        if (EqualsIgnoreCase(condition, "bso")) return $"(({reg} & 0x1) != 0)";
+        if (EqualsIgnoreCase(condition, "bns")) return $"(({reg} & 0x1) == 0)";
+        return reg;
+    }
+
+    /// <summary>
+    /// Maps the raw branch-condition text <c>PpcLifter</c> builds for <c>bc</c>/<c>bcctr</c> onto resident
+    /// locals. This is the only emitted register access that bypasses the expression layer, so missing a
+    /// rewrite here means reading a stale architectural CR/CTR instead of the live local.
+    /// </summary>
+    private static string ResidentRawCondition(string conditionText)
+    {
+        var residency = _activeResidency;
+        if (residency is null || string.IsNullOrEmpty(conditionText))
+        {
+            return conditionText;
+        }
+
+        var rewritten = conditionText;
+        if (rewritten.Contains("ctx->ctr", StringComparison.Ordinal))
+        {
+            rewritten = rewritten.Replace("ctx->ctr", residency.Ctr(written: false), StringComparison.Ordinal);
+        }
+
+        if (rewritten.Contains("GetCRBit(ctx,", StringComparison.Ordinal))
+        {
+            rewritten = rewritten.Replace(
+                "GetCRBit(ctx,",
+                $"GetCRBitResident({residency.Cr(written: false)},",
+                StringComparison.Ordinal);
+        }
+
+        return rewritten;
+    }
+
+    private static string Address(IrAddress addr, RepresentationEnvironment types)
+    {
+        var baseExpr = IsCpuRegister(addr.Base)
+            ? RegisterToReadExpression(addr.Base, types)
+            : addr.Base;
+
+        return addr.Offset == 0
+            ? baseExpr
+            : $"({baseExpr} + {addr.Offset})";
+    }
+
+    private static string RemapAddress(
+        IrAddress addr,
+        RepresentationEnvironment types,
+        IReadOnlyDictionary<string, uint> localConstants,
+        LinkedAddressRemap? remap)
+    {
+        if (remap is not null &&
+            (localConstants.TryGetValue(addr.Base, out var baseValue) ||
+             localConstants.TryGetValue(GetRegisterBaseName(addr.Base), out baseValue)))
+        {
+            var effective = unchecked(baseValue + (uint)addr.Offset);
+            var linkEnd = checked(remap.LinkBase + remap.CodeSize);
+            if (effective >= remap.LinkBase && effective < linkEnd)
+            {
+                var relocated = checked(remap.GuestBase + (effective - remap.LinkBase));
+                return $"0x{relocated:X8}u";
+            }
+        }
+
+        return Address(addr, types);
+    }
+
+    private static string BaseRegister(string name)
+    {
+        var idx = name.IndexOf('_');
+        return idx < 0 ? name : name[..idx];
+    }
+
+    /// <summary>
+    /// Allocation-free <see cref="BaseRegister"/>. The expression layer only
+    /// inspects the prefix, so the substring it used to build per access was
+    /// pure garbage.
+    /// </summary>
+    private static ReadOnlySpan<char> BaseRegisterSpan(string name)
+    {
+        var idx = name.IndexOf('_');
+        return idx < 0 ? name.AsSpan() : name.AsSpan(0, idx);
+    }
+
+    private static int Bits(int sizeBytes) => sizeBytes switch
+    {
+        1 => 8,
+        2 => 16,
+        8 => 64,
+        _ => 32
+    };
+
+    private static string RegisterToReadExpression(string name, RepresentationEnvironment types)
+    {
+        return RegisterToCtxRead(name, types);
+    }
+
+    private static string RegisterToWriteExpression(string name, RepresentationEnvironment types)
+    {
+        return RegisterToCtxWrite(name, types);
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.FctiwStackElision.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.FctiwStackElision.cs
new file mode 100644
index 0000000..477686b
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.FctiwStackElision.cs
@@ -0,0 +1,266 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    private readonly record struct StackAccessInfo(int Offset, int SizeBytes, bool IsStore);
+
+    private static IrFunction ElideFctiwStackLowWordLoads(IrFunction func, RepresentationEnvironment types)
+    {
+        var stackFacts = StackAddressFacts.Build(func);
+        var cfg = IrCfg.Build(func);
+        var changed = false;
+        var nextTemp = 0;
+        var rewrittenBlocks = new List<IrBasicBlock>(func.Blocks.Count);
+
+        foreach (var block in func.Blocks)
+        {
+            var insertedBefore = new Dictionary<int, List<IrInstruction>>();
+            var replacements = new Dictionary<int, IrInstruction>();
+            var removals = new HashSet<int>();
+            var claimedLoads = new HashSet<int>();
+            var convertedFprs = new Dictionary<string, bool>(StringComparer.OrdinalIgnoreCase);
+
+            for (var index = 0; index < block.Instructions.Count; index++)
+            {
+                var instruction = block.Instructions[index];
+                if (instruction is IrStore store &&
+                    store.SizeBytes == 8 &&
+                    store.Source.Kind == "register" &&
+                    store.Source.RegisterName is { } sourceRegister &&
+                    IsFloatRegister(sourceRegister) &&
+                    convertedFprs.TryGetValue(GetRegisterBaseName(sourceRegister), out var converted) &&
+                    converted &&
+                    stackFacts.TryResolve(store.Address, out var storeOffset) &&
+                    TryFindFctiwLowWordLoad(block.Instructions, index, stackFacts, storeOffset, claimedLoads, out var loadIndex))
+                {
+                    var temp = $"fctiwzword{nextTemp++}";
+                    AddInsertion(index, new IrBinary(temp, IrValue.Register(sourceRegister), IrValue.Imm(0), "fpr_low_word"));
+                    replacements[loadIndex] = new IrAssign(((IrLoad)block.Instructions[loadIndex]).Destination, IrValue.Register(temp));
+                    if (CanRemoveFctiwStackStore(func, cfg, block.Label, loadIndex + 1, stackFacts, storeOffset))
+                    {
+                        removals.Add(index);
+                    }
+                    claimedLoads.Add(loadIndex);
+                    types.Unify(temp, ValueRepresentation.UInt32);
+                    changed = true;
+                }
+
+                UpdateConvertedFprState(instruction, convertedFprs);
+            }
+
+            if (insertedBefore.Count == 0 && replacements.Count == 0 && removals.Count == 0)
+            {
+                rewrittenBlocks.Add(block);
+                continue;
+            }
+
+            var rewrittenInstructions = new List<IrInstruction>(block.Instructions.Count + insertedBefore.Count);
+            for (var index = 0; index < block.Instructions.Count; index++)
+            {
+                if (insertedBefore.TryGetValue(index, out var inserted))
+                {
+                    rewrittenInstructions.AddRange(inserted);
+                }
+
+                if (removals.Contains(index))
+                {
+                    continue;
+                }
+
+                rewrittenInstructions.Add(replacements.TryGetValue(index, out var replacement)
+                    ? replacement
+                    : block.Instructions[index]);
+            }
+
+            rewrittenBlocks.Add(new IrBasicBlock(block.Label, rewrittenInstructions));
+
+            void AddInsertion(int index, IrInstruction inserted)
+            {
+                if (!insertedBefore.TryGetValue(index, out var list))
+                {
+                    list = new List<IrInstruction>();
+                    insertedBefore[index] = list;
+                }
+
+                list.Add(inserted);
+            }
+        }
+
+        return changed
+            ? new IrFunction(func.Name, func.EntryLabel, rewrittenBlocks)
+            : func;
+    }
+
+    private static bool CanRemoveFctiwStackStore(
+        IrFunction func,
+        IrCfg cfg,
+        string startBlockLabel,
+        int startIndex,
+        StackAddressFacts stackFacts,
+        int storeOffset)
+    {
+        var pending = new Queue<(string BlockLabel, int StartIndex)>();
+        var visited = new HashSet<(string BlockLabel, int StartIndex)>();
+        pending.Enqueue((startBlockLabel, startIndex));
+
+        while (pending.Count > 0)
+        {
+            var (blockLabel, blockStartIndex) = pending.Dequeue();
+            if (!visited.Add((blockLabel, blockStartIndex)))
+            {
+                continue;
+            }
+
+            if (!cfg.Blocks.TryGetValue(blockLabel, out var block))
+            {
+                continue;
+            }
+
+            var overwrittenOnThisPath = false;
+            for (var index = Math.Max(0, blockStartIndex); index < block.Instructions.Count; index++)
+            {
+                var instruction = block.Instructions[index];
+                if (IsGuestMemoryBarrier(instruction))
+                {
+                    return false;
+                }
+
+                if (!TryGetStackAccessInfo(instruction, stackFacts, out var access) ||
+                    !RangesOverlap(storeOffset, 8, access.Offset, access.SizeBytes))
+                {
+                    continue;
+                }
+
+                if (!access.IsStore)
+                {
+                    return false;
+                }
+
+                overwrittenOnThisPath = true;
+                break;
+            }
+
+            if (overwrittenOnThisPath)
+            {
+                continue;
+            }
+
+            foreach (var successor in cfg.Successors(blockLabel))
+            {
+                pending.Enqueue((successor, 0));
+            }
+        }
+
+        return true;
+    }
+
+    private static bool TryFindFctiwLowWordLoad(
+        IReadOnlyList<IrInstruction> instructions,
+        int storeIndex,
+        StackAddressFacts stackFacts,
+        int storeOffset,
+        IReadOnlySet<int> claimedLoads,
+        out int loadIndex)
+    {
+        for (var index = storeIndex + 1; index < instructions.Count; index++)
+        {
+            if (!TryGetStackAccessInfo(instructions[index], stackFacts, out var access) ||
+                !RangesOverlap(storeOffset, 8, access.Offset, access.SizeBytes))
+            {
+                continue;
+            }
+
+            if (!access.IsStore &&
+                access.SizeBytes == 4 &&
+                access.Offset == storeOffset + 4 &&
+                !claimedLoads.Contains(index) &&
+                instructions[index] is IrLoad)
+            {
+                loadIndex = index;
+                return true;
+            }
+
+            break;
+        }
+
+        loadIndex = -1;
+        return false;
+    }
+
+    private static bool TryGetStackAccessInfo(
+        IrInstruction instruction,
+        StackAddressFacts stackFacts,
+        out StackAccessInfo access)
+    {
+        switch (instruction)
+        {
+            case IrStore store when stackFacts.TryResolve(store.Address, out var storeOffset):
+                access = new StackAccessInfo(storeOffset, store.SizeBytes, true);
+                return true;
+
+            case IrLoad load when stackFacts.TryResolve(load.Address, out var loadOffset):
+                access = new StackAccessInfo(loadOffset, load.SizeBytes, false);
+                return true;
+
+            case IrCall call when TryGetPsqStackAccess(call, stackFacts, out var psq):
+                access = new StackAccessInfo(psq.Offset, psq.SizeBytes, psq.IsStore);
+                return true;
+
+            default:
+                access = default;
+                return false;
+        }
+    }
+
+    private static void UpdateConvertedFprState(
+        IrInstruction instruction,
+        Dictionary<string, bool> convertedFprs)
+    {
+        switch (instruction)
+        {
+            case IrBinary binary when IsFloatRegister(binary.Destination):
+                convertedFprs[GetRegisterBaseName(binary.Destination)] = IsFctiwOp(binary.Op);
+                break;
+
+            case IrAssign assign when IsFloatRegister(assign.Destination):
+                convertedFprs[GetRegisterBaseName(assign.Destination)] = false;
+                break;
+
+            case IrLoad load when IsFloatRegister(load.Destination):
+                convertedFprs[GetRegisterBaseName(load.Destination)] = false;
+                break;
+
+            case IrCall call:
+                if (!string.IsNullOrWhiteSpace(call.Destination) &&
+                    IsFloatRegister(call.Destination))
+                {
+                    convertedFprs[GetRegisterBaseName(call.Destination)] = false;
+                }
+                else if (string.IsNullOrWhiteSpace(call.Destination) &&
+                         IsGuestCallTarget(call.Target))
+                {
+                    convertedFprs.Clear();
+                }
+                break;
+
+            case IrIndirectCall:
+                convertedFprs.Clear();
+                break;
+        }
+    }
+
+    private static bool IsFctiwOp(string op) =>
+        op.Equals("fctiw", StringComparison.OrdinalIgnoreCase) ||
+        op.Equals("fctiwz", StringComparison.OrdinalIgnoreCase);
+
+    private static bool IsGuestMemoryBarrier(IrInstruction instruction) =>
+        instruction is IrIndirectCall ||
+        instruction is IrCall call && IsGuestCallTarget(call.Target);
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.FlagElision.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.FlagElision.cs
new file mode 100644
index 0000000..695a715
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.FlagElision.cs
@@ -0,0 +1,606 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    internal enum FusedComparison
+    {
+        Equal,
+        NotEqual,
+        Less,
+        GreaterOrEqual,
+        Greater,
+        LessOrEqual
+    }
+
+    /// <summary>
+    /// A compare whose only consumer is the branch that terminates the same
+    /// block. The branch emits the C++ comparison directly and the CR field is
+    /// never materialized.
+    /// </summary>
+    internal sealed record FusedCompare(
+        IrValue Left,
+        IrValue Right,
+        bool IsUnsigned,
+        bool IsFloat,
+        FusedComparison Comparison);
+
+    /// <summary>
+    /// Everything the body emitter needs to drop condition-flag work: the
+    /// instructions it must not emit at all, and the branches that replace a
+    /// packed CR test with a direct comparison.
+    /// </summary>
+    internal sealed record FlagElisionPlan(
+        IReadOnlySet<(string Block, int Index)> SuppressedInstructions,
+        IReadOnlyDictionary<string, FusedCompare> FusedBranches)
+    {
+        public static FlagElisionPlan Empty { get; } = new(
+            new HashSet<(string, int)>(),
+            new Dictionary<string, FusedCompare>(StringComparer.OrdinalIgnoreCase));
+
+    }
+
+    /// <summary>
+    /// Materializes <see cref="FlagElisionPlan.SuppressedInstructions"/> as one dense flag array per block,
+    /// replacing a per-emission <c>(string, int)</c> tuple hash lookup for every instruction. Block keys use
+    /// ordinal comparison to match the set's tuple comparer.
+    /// </summary>
+    private static Dictionary<string, bool[]> BuildSuppressedInstructionMasks(
+        IrFunction function,
+        FlagElisionPlan plan)
+    {
+        var masks = new Dictionary<string, bool[]>(StringComparer.Ordinal);
+        if (plan.SuppressedInstructions.Count == 0)
+        {
+            return masks;
+        }
+
+        var blockSizes = new Dictionary<string, int>(StringComparer.Ordinal);
+        foreach (var block in function.Blocks)
+        {
+            blockSizes[block.Label] = block.Instructions.Count;
+        }
+
+        foreach (var (blockLabel, index) in plan.SuppressedInstructions)
+        {
+            if (index < 0)
+            {
+                continue;
+            }
+
+            if (!masks.TryGetValue(blockLabel, out var mask))
+            {
+                var size = blockSizes.TryGetValue(blockLabel, out var known) ? known : index + 1;
+                mask = new bool[Math.Max(size, index + 1)];
+                masks[blockLabel] = mask;
+            }
+            else if (index >= mask.Length)
+            {
+                Array.Resize(ref mask, index + 1);
+                masks[blockLabel] = mask;
+            }
+
+            mask[index] = true;
+        }
+
+        return masks;
+    }
+
+    /// <summary>
+    /// Condition-flag elision planner: one backward liveness pass drives compare+branch fusion, dead CR-field
+    /// writes, and dead XER.CA updates. Exit state is <see cref="GuestFlagState.All"/> since a return publishes
+    /// ctx-&gt;cr/ctx-&gt;xer with no caller info, so the last write on any path to a return is always kept.
+    /// </summary>
+    private static FlagElisionPlan PlanFlagElision(
+        IrFunction function,
+        IrCfg cfg,
+        RepresentationEnvironment types,
+        IReadOnlyDictionary<uint, GuestAbiContract> guestAbiContracts,
+        IReadOnlySet<uint> modOverridableCallTargets,
+        IReadOnlySet<uint> nonReturningCallTargets,
+        IReadOnlySet<uint> lrContinuationCallTargets)
+    {
+        // A body that dispatches on ctx->lr can re-enter any of its own labels,
+        // including positions inside a block. The static CFG does not model
+        // those edges, so no liveness statement derived from it holds and the
+        // whole plan is abandoned for such functions.
+        if (HasOutOfBandLocalEntry(function, nonReturningCallTargets, lrContinuationCallTargets))
+        {
+            return FlagElisionPlan.Empty;
+        }
+
+        var suppressed = new HashSet<(string Block, int Index)>();
+        var fused = new Dictionary<string, FusedCompare>(StringComparer.OrdinalIgnoreCase);
+
+        {
+            var context = new GuestFlagLivenessContext(guestAbiContracts, modOverridableCallTargets);
+            var liveness = GuestFlagLivenessAnalyzer.Analyze(function, cfg, context, GuestFlagState.All);
+            var fusedCompareSites = new HashSet<(string Block, int Index)>();
+
+            {
+                foreach (var block in function.Blocks)
+                {
+                    if (!TryPlanCompareBranchFusion(
+                            function, cfg, block, liveness.LiveOut[block.Label], types,
+                            out var compare, out var compareBlock, out var compareIndex))
+                    {
+                        continue;
+                    }
+
+                    fused[block.Label] = compare!;
+                    fusedCompareSites.Add((compareBlock!, compareIndex));
+                    suppressed.Add((compareBlock!, compareIndex));
+                }
+            }
+
+            {
+                foreach (var block in function.Blocks)
+                {
+                    var live = liveness.LiveOut[block.Label];
+                    for (var index = block.Instructions.Count - 1; index >= 0; --index)
+                    {
+                        var instruction = block.Instructions[index];
+                        if (fusedCompareSites.Contains((block.Label, index)))
+                        {
+                            // Already removed, but the branch that replaced it
+                            // still consumes the value: it kills the field for
+                            // everything above, exactly as the compare did.
+                            live = live.Except(GuestFlagLivenessAnalyzer.Kills(instruction));
+                            continue;
+                        }
+
+                        switch (instruction)
+                        {
+                            case IrSetCrField setCr when !live.HasCrField(setCr.FieldIndex & 7):
+                                suppressed.Add((block.Label, index));
+                                continue;
+
+                            case IrCall call when !live.Carry &&
+                                                  GuestFlagLivenessAnalyzer.IsCarryProducingHelper(call.Target) &&
+                                                  IsXerDestination(call.Destination):
+                                suppressed.Add((block.Label, index));
+                                continue;
+                        }
+
+                        live = GuestFlagLivenessAnalyzer.Transfer(instruction, live, context);
+                    }
+                }
+            }
+        }
+
+        {
+            foreach (var block in function.Blocks)
+            {
+                for (var index = 0; index + 1 < block.Instructions.Count; ++index)
+                {
+                    if (block.Instructions[index] is not IrAssign { Value.Kind: "const" } assign ||
+                        !GetRegisterBaseName(assign.Destination).Equals("lr", StringComparison.OrdinalIgnoreCase) ||
+                        block.Instructions[index + 1] is not IrCall call ||
+                        !CalleeIgnoresLinkRegister(
+                            call, guestAbiContracts, modOverridableCallTargets,
+                            nonReturningCallTargets, lrContinuationCallTargets))
+                    {
+                        continue;
+                    }
+
+                    suppressed.Add((block.Label, index));
+                }
+            }
+        }
+
+        if (suppressed.Count == 0 && fused.Count == 0)
+        {
+            return FlagElisionPlan.Empty;
+        }
+
+        return new FlagElisionPlan(suppressed, fused);
+    }
+
+    /// <summary>
+    /// True when the body has a call whose callee may resume it via <c>EmitLocalLrContinuationDispatch</c>,
+    /// which can jump to any <c>loc_</c> label including ones inside a block, so the static CFG understates edges.
+    /// </summary>
+    private static bool HasOutOfBandLocalEntry(
+        IrFunction function,
+        IReadOnlySet<uint> nonReturningCallTargets,
+        IReadOnlySet<uint> lrContinuationCallTargets)
+    {
+        if (nonReturningCallTargets.Count == 0 && lrContinuationCallTargets.Count == 0)
+        {
+            return false;
+        }
+
+        foreach (var block in function.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                if (instruction is IrCall call &&
+                    TryParseAddress(call.Target, out var target) &&
+                    (nonReturningCallTargets.Contains(target) || lrContinuationCallTargets.Contains(target)))
+                {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    private static bool IsXerDestination(string? destination) =>
+        !string.IsNullOrWhiteSpace(destination) &&
+        GetRegisterBaseName(destination!).Equals("xer", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// A call whose return address never becomes observable state: translated functions return via the C++
+    /// stack, not by branching to ctx-&gt;lr, so the LR store is skipped unless the callee reads LR, the call site
+    /// dispatches on ctx-&gt;lr, or the callee escapes the contract model entirely.
+    /// </summary>
+    private static bool CalleeIgnoresLinkRegister(
+        IrCall call,
+        IReadOnlyDictionary<uint, GuestAbiContract> guestAbiContracts,
+        IReadOnlySet<uint> modOverridableCallTargets,
+        IReadOnlySet<uint> nonReturningCallTargets,
+        IReadOnlySet<uint> lrContinuationCallTargets)
+    {
+        if (!TryParseAddress(call.Target, out var target) ||
+            modOverridableCallTargets.Contains(target) ||
+            nonReturningCallTargets.Contains(target) ||
+            lrContinuationCallTargets.Contains(target) ||
+            !guestAbiContracts.TryGetValue(target, out var contract))
+        {
+            return false;
+        }
+
+        const GuestCallBoundaryFlags escaping =
+            GuestCallBoundaryFlags.RequiresCompleteContext |
+            GuestCallBoundaryFlags.CanSuspend |
+            GuestCallBoundaryFlags.CanSwitchThreads |
+            GuestCallBoundaryFlags.InvokesGuestCode;
+
+        return !contract.ReadsLrBeforeWrite && (contract.BoundaryFlags & escaping) == 0;
+    }
+
+    /// <summary>
+    /// How many basic blocks back the compare feeding a branch is searched. Compare/branch pairs are adjacent
+    /// in PowerPC, but block builders often split a new block at the branch, so the producer is usually at the
+    /// end of the single predecessor.
+    /// </summary>
+    private const int MaxFusionBlockHops = 4;
+
+    /// <summary>
+    /// Finds the compare feeding a block's terminating branch when the branch is its only consumer, searching
+    /// back through a chain of blocks with exactly one predecessor/successor each and no conditional transfer.
+    /// </summary>
+    private static bool TryPlanCompareBranchFusion(
+        IrFunction function,
+        IrCfg cfg,
+        IrBasicBlock block,
+        GuestFlagState liveOut,
+        RepresentationEnvironment types,
+        out FusedCompare? compare,
+        out string? compareBlock,
+        out int compareIndex)
+    {
+        compare = null;
+        compareBlock = null;
+        compareIndex = -1;
+        if (block.Instructions.Count == 0 ||
+            block.Instructions[^1] is not IrBranch branch ||
+            !TryParseSingleCrBitTest(branch, out var field, out var bit, out var testSet))
+        {
+            return false;
+        }
+
+        // The summary-overflow copy is not reconstructible from the compare
+        // operands, so a branch on it can never be fused.
+        if (bit == CrBit.SummaryOverflow || liveOut.HasCrField(field))
+        {
+            return false;
+        }
+
+        // Instructions executed between the compare and the branch. The fused
+        // comparison is evaluated at the branch, so none of them may redefine an
+        // operand.
+        var between = new List<IrInstruction>();
+        var current = block;
+        var startIndex = block.Instructions.Count - 2;
+        var visited = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { block.Label };
+
+        for (var hop = 0; hop < MaxFusionBlockHops; ++hop)
+        {
+            for (var index = startIndex; index >= 0; --index)
+            {
+                var instruction = current.Instructions[index];
+                if (instruction is IrSetCrField setCr && (setCr.FieldIndex & 7) == field)
+                {
+                    if (between.Any(later => RedefinesFusedOperand(later, setCr)))
+                    {
+                        return false;
+                    }
+
+                    var candidate = BuildFusedCompare(setCr, bit, testSet, types);
+                    // Paired-single representation is normalized on CFG edges by
+                    // emitted code that no IR definition describes, so a float
+                    // compare is only re-evaluated inside its own block.
+                    if (candidate is null || (candidate.IsFloat && hop != 0))
+                    {
+                        return false;
+                    }
+
+                    compare = candidate;
+                    compareBlock = current.Label;
+                    compareIndex = index;
+                    return true;
+                }
+
+                if (!IsFusionTransparent(instruction, field))
+                {
+                    return false;
+                }
+
+                between.Add(instruction);
+            }
+
+            // The function entry is always reachable without executing any
+            // predecessor, so a single recorded predecessor proves nothing there.
+            if (current.Label.Equals(function.EntryLabel, StringComparison.OrdinalIgnoreCase))
+            {
+                return false;
+            }
+
+            var predecessors = cfg.Predecessors(current.Label);
+            if (predecessors.Count != 1)
+            {
+                return false;
+            }
+
+            var predecessorLabel = predecessors[0];
+            if (!visited.Add(predecessorLabel) ||
+                cfg.Successors(predecessorLabel).Count != 1 ||
+                !cfg.Blocks.TryGetValue(predecessorLabel, out var predecessor) ||
+                predecessor.Instructions.Count == 0)
+            {
+                return false;
+            }
+
+            // Only a plain fallthrough or unconditional goto may sit between the
+            // compare and the branch.
+            var terminator = predecessor.Instructions[^1];
+            if (terminator is IrBranch or IrJumpTable or IrIndirectJump or IrReturn or IrUndefined)
+            {
+                return false;
+            }
+
+            current = predecessor;
+            startIndex = terminator is IrJump
+                ? predecessor.Instructions.Count - 2
+                : predecessor.Instructions.Count - 1;
+        }
+
+        return false;
+    }
+
+    private enum CrBit
+    {
+        LessThan,
+        GreaterThan,
+        Equal,
+        SummaryOverflow
+    }
+
+    /// <summary>
+    /// An instruction that may sit between a compare and the branch it feeds. The fused comparison is evaluated
+    /// at the branch, so nothing between them may redefine an operand or observe the CR field; calls are
+    /// excluded outright since they can do both.
+    /// </summary>
+    private static bool IsFusionTransparent(IrInstruction instruction, int field)
+    {
+        switch (instruction)
+        {
+            case IrTracePpc:
+            case IrComment:
+                return true;
+            // A compare into a different field neither reads CR nor touches the
+            // field being fused; the matching field is resolved by the caller.
+            case IrSetCrField other:
+                return (other.FieldIndex & 7) != field;
+            case IrCall:
+            case IrIndirectCall:
+            case IrIndirectJump:
+            case IrJumpTable:
+            case IrUndefined:
+            case IrPhi:
+                return false;
+        }
+
+        foreach (var name in IrRegisterDataFlow.Definitions(instruction)
+                     .Concat(IrRegisterDataFlow.Uses(instruction)))
+        {
+            var baseName = RegisterNameUtils.HardwareBase(name);
+            if (baseName.Equals("cr", StringComparison.OrdinalIgnoreCase) ||
+                (baseName.Length == 3 && baseName.StartsWith("cr", StringComparison.OrdinalIgnoreCase) &&
+                 baseName[2] is >= '0' and <= '7' && baseName[2] - '0' == field) ||
+                baseName.StartsWith("crb", StringComparison.OrdinalIgnoreCase))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// The operand registers a fused comparison re-reads at the branch. Any
+    /// redefinition between the compare and the branch makes the fusion unsound.
+    /// </summary>
+    private static bool RedefinesFusedOperand(IrInstruction instruction, IrSetCrField compare)
+    {
+        foreach (var definition in IrRegisterDataFlow.Definitions(instruction))
+        {
+            var baseName = RegisterNameUtils.HardwareBase(definition);
+            if (MatchesOperand(compare.Left, baseName) || MatchesOperand(compare.Right, baseName))
+            {
+                return true;
+            }
+        }
+
+        return false;
+
+        static bool MatchesOperand(IrValue value, string baseName) =>
+            value.Kind == "register" && value.RegisterName is { } name &&
+            RegisterNameUtils.HardwareBase(name).Equals(baseName, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static FusedCompare? BuildFusedCompare(
+        IrSetCrField setCr,
+        CrBit bit,
+        bool testSet,
+        RepresentationEnvironment types)
+    {
+        var comparison = (bit, testSet) switch
+        {
+            (CrBit.Equal, true) => FusedComparison.Equal,
+            (CrBit.Equal, false) => FusedComparison.NotEqual,
+            (CrBit.LessThan, true) => FusedComparison.Less,
+            (CrBit.LessThan, false) => FusedComparison.GreaterOrEqual,
+            (CrBit.GreaterThan, true) => FusedComparison.Greater,
+            (CrBit.GreaterThan, false) => FusedComparison.LessOrEqual,
+            _ => (FusedComparison?)null
+        };
+
+        if (comparison is null)
+        {
+            return null;
+        }
+
+        var isFloat = IsFloatValue(setCr.Left, types) || IsFloatValue(setCr.Right, types);
+        return new FusedCompare(setCr.Left, setCr.Right, setCr.IsUnsigned, isFloat, comparison.Value);
+    }
+
+    /// <summary>
+    /// Decodes the single CR bit a conditional branch tests. Returns false for
+    /// counter-based forms, for multi-bit raw expressions, and for anything the
+    /// lifter produced that this decoder does not recognize exactly.
+    /// </summary>
+    private static bool TryParseSingleCrBitTest(IrBranch branch, out int field, out CrBit bit, out bool testSet)
+    {
+        field = 0;
+        bit = CrBit.SummaryOverflow;
+        testSet = false;
+
+        if (TryParseRawCrBitTest(branch.ConditionRegister, out field, out var rawBit, out testSet))
+        {
+            bit = rawBit;
+            return true;
+        }
+
+        var conditionBase = BaseRegister(branch.ConditionRegister ?? string.Empty);
+        if (conditionBase.Length != 3 ||
+            !conditionBase.StartsWith("cr", StringComparison.OrdinalIgnoreCase) ||
+            conditionBase[2] is < '0' or > '7')
+        {
+            return false;
+        }
+
+        field = conditionBase[2] - '0';
+        (bit, testSet) = branch.Condition.ToLowerInvariant() switch
+        {
+            "beq" => (CrBit.Equal, true),
+            "bne" => (CrBit.Equal, false),
+            "bgt" => (CrBit.GreaterThan, true),
+            "ble" => (CrBit.GreaterThan, false),
+            "blt" => (CrBit.LessThan, true),
+            "bge" => (CrBit.LessThan, false),
+            _ => (CrBit.SummaryOverflow, false)
+        };
+
+        return bit != CrBit.SummaryOverflow;
+    }
+
+    /// <summary>
+    /// Matches the exact text <c>PpcLifter.BuildBoConditionExpression</c> emits
+    /// for a <c>bc</c> form that tests one CR bit and ignores CTR. Anything else
+    /// - including a CTR-decrementing form - is rejected rather than guessed at.
+    /// </summary>
+    private static bool TryParseRawCrBitTest(string? conditionText, out int field, out CrBit bit, out bool testSet)
+    {
+        field = 0;
+        bit = CrBit.SummaryOverflow;
+        testSet = false;
+        if (string.IsNullOrEmpty(conditionText))
+        {
+            return false;
+        }
+
+        var match = RawBoConditionRegex.Match(conditionText);
+        if (!match.Success)
+        {
+            return false;
+        }
+
+        field = int.Parse(match.Groups["field"].Value) & 7;
+        var bitIndex = int.Parse(match.Groups["bit"].Value);
+        if (bitIndex is < 0 or > 3)
+        {
+            return false;
+        }
+
+        bit = (CrBit)bitIndex;
+        testSet = match.Groups["polarity"].Value == "true";
+        return true;
+    }
+
+    private static readonly System.Text.RegularExpressions.Regex RawBoConditionRegex = new(
+        @"^\(\(true\) && \(\(GetCRBit\(ctx, (?<field>\d+), (?<bit>\d+)\) == (?<polarity>true|false)\)\)\)$",
+        System.Text.RegularExpressions.RegexOptions.Compiled |
+        System.Text.RegularExpressions.RegexOptions.CultureInvariant);
+
+    /// <summary>
+    /// Formats a fused comparison. Integer forms keep the natural relational
+    /// operator; float forms keep the PowerPC bit semantics instead, where a
+    /// cleared LT bit means "not less than" and is therefore true for NaN.
+    /// </summary>
+    private static string FusedConditionExpression(
+        FusedCompare compare,
+        RepresentationEnvironment types,
+        Dictionary<string, bool> localPaired)
+    {
+        if (compare.IsFloat)
+        {
+            var leftFloat = ToScalarFloatExpression(compare.Left, types, localPaired);
+            var rightFloat = ToScalarFloatExpression(compare.Right, types, localPaired);
+            return compare.Comparison switch
+            {
+                FusedComparison.Equal => $"({leftFloat} == {rightFloat})",
+                FusedComparison.NotEqual => $"(!({leftFloat} == {rightFloat}))",
+                FusedComparison.Less => $"({leftFloat} < {rightFloat})",
+                FusedComparison.GreaterOrEqual => $"(!({leftFloat} < {rightFloat}))",
+                FusedComparison.Greater => $"({leftFloat} > {rightFloat})",
+                _ => $"(!({leftFloat} > {rightFloat}))"
+            };
+        }
+
+        var cast = compare.IsUnsigned ? "uint32_t" : "int32_t";
+        var left = $"static_cast<{cast}>({ToExpression(compare.Left, types)})";
+        var right = $"static_cast<{cast}>({ToExpression(compare.Right, types)})";
+        var op = compare.Comparison switch
+        {
+            FusedComparison.Equal => "==",
+            FusedComparison.NotEqual => "!=",
+            FusedComparison.Less => "<",
+            FusedComparison.GreaterOrEqual => ">=",
+            FusedComparison.Greater => ">",
+            _ => "<="
+        };
+
+        return $"({left} {op} {right})";
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.FlatGuestMemory.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.FlatGuestMemory.cs
new file mode 100644
index 0000000..ed2317f
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.FlatGuestMemory.cs
@@ -0,0 +1,115 @@
+namespace Translator.Core.CodeGen;
+
+/// <summary>
+/// Selects the runtime helper family for guest memory accesses. Checked helpers resolve through the 1 MiB page
+/// table each access; flat helpers use the 4 GiB guest reservation, so an access is just a byte swap with
+/// MMIO/EFB/executable-write interception moved to host page protections. Both families behave identically.
+/// </summary>
+public sealed partial class CxxLinearCodeGenerator
+{
+    private enum FlatMemoryHelperFamily
+    {
+        Read,
+        Write,
+        WriteRam
+    }
+
+    // Index order is 8, 16, 32, 64 bits. Keep the literal spellings in one
+    // table: the runtime deliberately exposes separate guarded and proven-RAM
+    // write families, while Bits(sizeBytes) supplies the same normalization at
+    // every call site.
+    private static readonly string[] FlatHelpers =
+    {
+        "MemoryInline::FlatRead8", "MemoryInline::FlatRead16",
+        "MemoryInline::FlatRead32", "MemoryInline::FlatRead64",
+        "MemoryInline::FlatReadFloat8", "MemoryInline::FlatReadFloat16",
+        "MemoryInline::FlatReadFloat32", "MemoryInline::FlatReadFloat64",
+        "MemoryInline::FlatWrite8", "MemoryInline::FlatWrite16",
+        "MemoryInline::FlatWrite32", "MemoryInline::FlatWrite64",
+        "MemoryInline::FlatWriteFloat8", "MemoryInline::FlatWriteFloat16",
+        "MemoryInline::FlatWriteFloat32", "MemoryInline::FlatWriteFloat64",
+        "MemoryInline::FlatWriteRam8", "MemoryInline::FlatWriteRam16",
+        "MemoryInline::FlatWriteRam32", "MemoryInline::FlatWriteRam64",
+        "MemoryInline::FlatWriteRamFloat8", "MemoryInline::FlatWriteRamFloat16",
+        "MemoryInline::FlatWriteRamFloat32", "MemoryInline::FlatWriteRamFloat64"
+    };
+
+    private static int FlatHelperIndex(int bits) => bits switch
+    {
+        8 => 0,
+        16 => 1,
+        64 => 3,
+        _ => 2
+    };
+
+    private static string FlatHelper(FlatMemoryHelperFamily family, int bits, bool isFloat)
+    {
+        var familyIndex = (int)family;
+        if ((uint)familyIndex >= 3u)
+            throw new ArgumentOutOfRangeException(nameof(family), family, null);
+        return FlatHelpers[((familyIndex * 2) + (isFloat ? 1 : 0)) * 4 + FlatHelperIndex(bits)];
+    }
+
+    /// <summary>
+    /// Helper spellings are a closed set of widths and families. Selection is
+    /// table-driven but remains allocation-free at each emitted access.
+    /// </summary>
+    private static string FlatReadHelper(int bits, bool isFloat) =>
+        FlatHelper(FlatMemoryHelperFamily.Read, bits, isFloat);
+
+    private static string FlatWriteHelper(int bits, bool isFloat) =>
+        FlatHelper(FlatMemoryHelperFamily.Write, bits, isFloat);
+
+    /// <summary>
+    /// The exact predicate <c>MemoryInline::FlatWriteNeedsPolicy</c> uses:
+    /// 0xCC000000..0xCDFFFFFF. Kept in sync by construction - the two must never
+    /// disagree, because that is what makes the check-free family sound.
+    /// </summary>
+    private static bool FlatWriteNeedsPolicy(uint address) =>
+        (address & 0xFE000000u) == 0xCC000000u;
+
+    /// <summary>
+    /// A translate-time-constant effective address whose complete span sits
+    /// outside the MMIO policy window, and which therefore provably takes the
+    /// plain-store arm of every <c>FlatWrite*</c> helper.
+    /// </summary>
+    private static bool IsProvenRamStore(uint address, int sizeBytes)
+    {
+        if (sizeBytes <= 0 || sizeBytes > 8) return false;
+        var last = unchecked(address + (uint)(sizeBytes - 1));
+        if (last < address) return false; // wraps past the end of the address space
+        return !FlatWriteNeedsPolicy(address) && !FlatWriteNeedsPolicy(last);
+    }
+
+    private static string GuestLoadHelper(int sizeBytes, bool isFloat) =>
+        FlatReadHelper(Bits(sizeBytes), isFloat);
+
+    private static string GuestStoreHelper(int sizeBytes, bool isFloat) =>
+        FlatWriteHelper(Bits(sizeBytes), isFloat);
+
+    /// <summary>
+    /// Stack slots are ordinary guest memory; the checked variants only skipped
+    /// the executable-write guard because a stack frame can never hold code. The
+    /// flat path has no per-access tables at all, so both collapse to one helper.
+    /// </summary>
+    private static string StackLoadHelper(int sizeBytes, bool isFloat) =>
+        FlatReadHelper(Bits(sizeBytes), isFloat);
+
+    /// <summary>
+    /// Check-free flat store family. Selected only where the caller has already
+    /// proven the effective address is ordinary guest RAM; see the contract on
+    /// <c>MemoryInline::FlatWriteRam*</c> in runtime/include/memory_access.h.
+    /// </summary>
+    private static string FlatWriteRamHelper(int bits, bool isFloat) =>
+        FlatHelper(FlatMemoryHelperFamily.WriteRam, bits, isFloat);
+
+    private static string StackStoreHelper(int sizeBytes, bool isFloat)
+    {
+        // A stack slot is `r1 + constant` with the whole chain back to r1
+        // visible in this body (StackAddressFacts). Guest stack frames
+        // live in MEM1/MEM2 and can never be MMIO, so the per-store MMIO
+        // policy test is provably dead here - and 45% of all emitted flat
+        // stores have this shape.
+        return FlatWriteRamHelper(Bits(sizeBytes), isFloat);
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.GpuFifoBurst.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.GpuFifoBurst.cs
new file mode 100644
index 0000000..4b58874
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.GpuFifoBurst.cs
@@ -0,0 +1,221 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Translator.Core.Ir;
+
+namespace Translator.Core.CodeGen;
+
+/// <summary>
+/// Coalesces consecutive statically-known gather-pipe stores into one <c>GX_HLE_FIFO_WriteBurst</c>
+/// call instead of one GX_HLE_FIFO_Write* per field, avoiding a display-list state re-walk each time.
+/// </summary>
+public sealed partial class CxxLinearCodeGenerator
+{
+    // Below this the saved call overhead does not pay for the buffer traffic
+    // and the extra stack slot.
+    private const int MinimumGpuFifoBurstStores = 4;
+
+    private readonly record struct GpuFifoStoreInfo(bool IsFloat, int ByteLength);
+
+    private sealed record GpuFifoBurstRun(string BufferName, int TotalBytes);
+
+    private sealed record GpuFifoBurstSlot(
+        GpuFifoBurstRun Run,
+        int ByteOffset,
+        GpuFifoStoreInfo Store);
+
+    private sealed class GpuFifoBurstPlan
+    {
+        public static readonly GpuFifoBurstPlan Empty = new(
+            new Dictionary<(string Block, int Index), GpuFifoBurstSlot>(),
+            new Dictionary<(string Block, int Index), GpuFifoBurstRun>(),
+            Array.Empty<GpuFifoBurstRun>());
+
+        private readonly IReadOnlyDictionary<(string Block, int Index), GpuFifoBurstSlot> _slots;
+        private readonly IReadOnlyDictionary<(string Block, int Index), GpuFifoBurstRun> _completions;
+
+        public GpuFifoBurstPlan(
+            IReadOnlyDictionary<(string Block, int Index), GpuFifoBurstSlot> slots,
+            IReadOnlyDictionary<(string Block, int Index), GpuFifoBurstRun> completions,
+            IReadOnlyList<GpuFifoBurstRun> runs)
+        {
+            _slots = slots;
+            _completions = completions;
+            Runs = runs;
+        }
+
+        public IReadOnlyList<GpuFifoBurstRun> Runs { get; }
+
+        public GpuFifoBurstSlot? Slot(string block, int index) =>
+            _slots.Count != 0 && _slots.TryGetValue((block, index), out var slot) ? slot : null;
+
+        public GpuFifoBurstRun? Completion(string block, int index) =>
+            _completions.Count != 0 && _completions.TryGetValue((block, index), out var run) ? run : null;
+    }
+
+    // The store currently being emitted, if it belongs to a burst run; set around its
+    // EmitInstruction call. Thread-static because translation runs Parallel.For over functions.
+    [ThreadStatic]
+    private static GpuFifoBurstSlot? _activeGpuFifoBurstSlot;
+
+    /// <summary>
+    /// Describes a store the emitter can turn into a direct GX_HLE_FIFO_Write* call; shared by the
+    /// burst planner and direct emitter so a rejected store can't leave a hole in a burst buffer.
+    /// </summary>
+    private static bool TryGetKnownGpuFifoStore(
+        IrStore store,
+        bool isFloatStore,
+        IReadOnlyDictionary<string, uint> knownConstants,
+        out GpuFifoStoreInfo info)
+    {
+        if (!TryGetKnownEffectiveAddress(store.Address, knownConstants, out var address) ||
+            !IsGpuFifoAddress(address))
+        {
+            info = default;
+            return false;
+        }
+
+        if (isFloatStore)
+        {
+            if (store.SizeBytes != 4)
+            {
+                info = default;
+                return false;
+            }
+
+            info = new GpuFifoStoreInfo(IsFloat: true, ByteLength: 4);
+            return true;
+        }
+
+        if (store.SizeBytes is not (1 or 2 or 4))
+        {
+            info = default;
+            return false;
+        }
+
+        info = new GpuFifoStoreInfo(IsFloat: false, ByteLength: store.SizeBytes);
+        return true;
+    }
+
+    private static bool TryClassifyKnownGpuFifoStore(
+        IrInstruction instruction,
+        IReadOnlyDictionary<string, uint> knownConstants,
+        out GpuFifoStoreInfo info)
+    {
+        if (instruction is not IrStore store)
+        {
+            info = default;
+            return false;
+        }
+
+        var isFloatStore = store.Source.Kind == "register" &&
+                           store.Source.RegisterName is not null &&
+                           IsFloatRegister(store.Source.RegisterName);
+        return TryGetKnownGpuFifoStore(store, isFloatStore, knownConstants, out info);
+    }
+
+    /// <summary>
+    /// Instructions a burst run may span: pure register/flag computation that can't read the FIFO,
+    /// fault, or observe the deferred write. Anything else (memory access, calls, control transfer) ends the run.
+    /// </summary>
+    private static bool IsGpuFifoBurstTransparent(IrInstruction instruction) =>
+        instruction is IrAssign or IrBinary or IrComment or IrTracePpc or IrPhi or IrSetCrField;
+
+    private static GpuFifoBurstPlan BuildGpuFifoBurstPlan(
+        IrFunction function,
+        IReadOnlyDictionary<string, uint> knownConstants,
+        bool enabled)
+    {
+        if (!enabled) return GpuFifoBurstPlan.Empty;
+
+        var slots = new Dictionary<(string Block, int Index), GpuFifoBurstSlot>();
+        var completions = new Dictionary<(string Block, int Index), GpuFifoBurstRun>();
+        var runs = new List<GpuFifoBurstRun>();
+
+        foreach (var block in function.Blocks)
+        {
+            var instructions = block.Instructions;
+            var index = 0;
+            while (index < instructions.Count)
+            {
+                if (!TryClassifyKnownGpuFifoStore(instructions[index], knownConstants, out var firstStore))
+                {
+                    index++;
+                    continue;
+                }
+
+                var members = new List<(int Index, GpuFifoStoreInfo Store)> { (index, firstStore) };
+                var scan = index + 1;
+                while (scan < instructions.Count)
+                {
+                    if (TryClassifyKnownGpuFifoStore(instructions[scan], knownConstants, out var store))
+                    {
+                        members.Add((scan, store));
+                        scan++;
+                        continue;
+                    }
+                    if (IsGpuFifoBurstTransparent(instructions[scan]))
+                    {
+                        scan++;
+                        continue;
+                    }
+                    break;
+                }
+
+                if (members.Count >= MinimumGpuFifoBurstStores)
+                {
+                    var total = members.Sum(static member => member.Store.ByteLength);
+                    var run = new GpuFifoBurstRun($"mkw_fifo_burst_{runs.Count}", total);
+                    runs.Add(run);
+                    var offset = 0;
+                    foreach (var (memberIndex, store) in members)
+                    {
+                        slots[(block.Label, memberIndex)] = new GpuFifoBurstSlot(run, offset, store);
+                        offset += store.ByteLength;
+                    }
+                    completions[(block.Label, members[^1].Index)] = run;
+                }
+
+                // Every store between the run's first member and `scan` is
+                // already accounted for, so no later run can start before it.
+                index = Math.Max(scan, members[^1].Index + 1);
+            }
+        }
+
+        return runs.Count == 0
+            ? GpuFifoBurstPlan.Empty
+            : new GpuFifoBurstPlan(slots, completions, runs);
+    }
+
+    /// <summary>
+    /// Serializes one store's value into its slot, big-endian, matching the bytes the corresponding
+    /// GX_HLE_FIFO_Write* call would push. Evaluated once into a temporary so multi-byte members don't re-evaluate per byte.
+    /// </summary>
+    private static void EmitGpuFifoBurstSlotStore(
+        StringBuilder sb,
+        string pad,
+        GpuFifoBurstSlot slot,
+        string srcExpr)
+    {
+        var buffer = slot.Run.BufferName;
+        if (!slot.Store.IsFloat && slot.Store.ByteLength == 1)
+        {
+            sb.AppendLine($"{pad}{buffer}[{slot.ByteOffset}] = static_cast<uint8_t>({srcExpr});");
+            return;
+        }
+
+        var word = slot.Store.IsFloat
+            ? $"PpcBitCastToU32Inline(static_cast<float>({srcExpr}))"
+            : $"static_cast<uint32_t>({srcExpr})";
+        sb.AppendLine($"{pad}{{");
+        sb.AppendLine($"{pad}    const uint32_t mkw_fifo_word = {word};");
+        for (var byteIndex = 0; byteIndex < slot.Store.ByteLength; byteIndex++)
+        {
+            var shift = (slot.Store.ByteLength - 1 - byteIndex) * 8;
+            var shifted = shift == 0 ? "mkw_fifo_word" : $"(mkw_fifo_word >> {shift})";
+            sb.AppendLine($"{pad}    {buffer}[{slot.ByteOffset + byteIndex}] = static_cast<uint8_t>({shifted});");
+        }
+        sb.AppendLine($"{pad}}}");
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.GqrHoisting.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.GqrHoisting.cs
new file mode 100644
index 0000000..921e80d
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.GqrHoisting.cs
@@ -0,0 +1,159 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Translator.Core.Analysis;
+using Translator.Core.Ir;
+using Translator.Core.Translation;
+
+namespace Translator.Core.CodeGen;
+
+/// <summary>
+/// Hoists GQR0-7 into locals read once per prologue instead of every psq_l/psq_st reload, re-reading
+/// only after an mtspr to that GQR or a call not proven to leave it alone. Only the generic helpers
+/// participate; stack forms have no GQR-value overload and <c>Known</c> forms template the value already.
+/// </summary>
+public sealed partial class CxxLinearCodeGenerator
+{
+    // Translation waves run Parallel.For over functions; ambient emitter state
+    // is per-thread, exactly like the active residency.
+    [ThreadStatic]
+    private static IReadOnlySet<uint>? _hoistedGqrIndices;
+
+    internal static string HoistedGqrName(long index) => $"mkw_gqr{index}";
+
+    private static bool IsGqrHoisted(long index) =>
+        _hoistedGqrIndices is { Count: > 0 } && _hoistedGqrIndices.Contains((uint)index);
+
+    /// <summary>
+    /// The GQR indices whose value a generic PSQ helper in this body would read
+    /// out of the context. Guarded known sites count: their fallback arm is the
+    /// generic helper.
+    /// </summary>
+    private static IReadOnlySet<uint> CollectHoistableGqrIndices(
+        IrFunction function,
+        StackAddressFacts stackFacts,
+        bool enabled)
+    {
+        var indices = new HashSet<uint>();
+        if (!enabled) return indices;
+
+        foreach (var call in function.Blocks.SelectMany(static block => block.Instructions).OfType<IrCall>())
+        {
+            if (!TryGetGenericGqrPsqSite(call, out var index, out var addressArgument)) continue;
+            // The stack forms resolve the host pointer through the frame cache
+            // and have no GQR-value overload in the runtime.
+            if (stackFacts.TryResolve(addressArgument, out _)) continue;
+            indices.Add(index);
+        }
+
+        return indices;
+    }
+
+    /// <summary>
+    /// True for the PSQ call shapes that emit a helper reading ctx-&gt;gqr[I]:
+    /// the plain PPC_PsqL/PPC_PsqSt forms and the guarded known forms, whose
+    /// else-arm is the plain form.
+    /// </summary>
+    private static bool TryGetGenericGqrPsqSite(IrCall call, out uint index, out IrValue addressArgument)
+    {
+        index = 0;
+        addressArgument = null!;
+        var isLoad = call.Target.Equals("PPC_PsqL", StringComparison.OrdinalIgnoreCase) ||
+                     call.Target.StartsWith("PPC_PsqLKnownGuarded_", StringComparison.OrdinalIgnoreCase);
+        var isStore = call.Target.Equals("PPC_PsqSt", StringComparison.OrdinalIgnoreCase) ||
+                      call.Target.StartsWith("PPC_PsqStKnownGuarded_", StringComparison.OrdinalIgnoreCase);
+        if (!isLoad && !isStore) return false;
+        var widthArgument = isLoad ? 1 : 2;
+        var indexArgument = isLoad ? 2 : 3;
+        if (call.Arguments.Count <= indexArgument) return false;
+        if (call.Arguments[widthArgument].Constant is not (0 or 1)) return false;
+        if (call.Arguments[indexArgument].Constant is not { } rawIndex || rawIndex is < 0 or > 7) return false;
+        index = (uint)rawIndex;
+        addressArgument = call.Arguments[0];
+        return true;
+    }
+
+    private static void EmitHoistedGqrPrologue(
+        StringBuilder body, IReadOnlySet<uint> hoistedGqrIndices)
+    {
+        if (hoistedGqrIndices.Count == 0) return;
+        foreach (var index in hoistedGqrIndices.OrderBy(static value => value))
+        {
+            // maybe_unused: guarded-store sites become `if constexpr` arms under
+            // _gqr_impl versioning, so one instantiation can discard every use.
+            body.AppendLine($"    [[maybe_unused]] uint32_t {HoistedGqrName(index)} = ctx->gqr[{index}];");
+        }
+        body.AppendLine();
+    }
+
+    /// <summary>
+    /// Re-reads hoisted locals after anything that can have written a GQR: an mtspr reloads just
+    /// that register, direct guest calls use the interprocedural write mask, everything else reloads all.
+    /// </summary>
+    private static void EmitHoistedGqrReloads(
+        StringBuilder body,
+        string pad,
+        IrInstruction instruction,
+        IReadOnlySet<uint> hoistedGqrIndices,
+        IReadOnlyDictionary<uint, byte>? gqrCalleeWriteMasks)
+    {
+        if (hoistedGqrIndices.Count == 0) return;
+
+        IEnumerable<uint>? reloaded = null;
+        switch (instruction)
+        {
+            case IrAssign assign when GqrConstantPropagation.TryGetGqrKey(assign.Destination) is { } assignKey:
+                reloaded = new[] { (uint)(assignKey[3] - '0') };
+                break;
+            case IrPhi phi when GqrConstantPropagation.TryGetGqrKey(phi.Destination) is { } phiKey:
+                reloaded = new[] { (uint)(phiKey[3] - '0') };
+                break;
+            case IrCall call when GqrConstantPropagation.TryGuestAddress(call.Target, out var target):
+                {
+                    var mask = gqrCalleeWriteMasks is not null &&
+                               gqrCalleeWriteMasks.TryGetValue(target, out var knownMask)
+                        ? knownMask
+                        : (byte)0xFF;
+                    if (mask == 0) return;
+                    reloaded = hoistedGqrIndices.Where(index => (mask & (1 << (int)index)) != 0);
+                    break;
+                }
+            case IrCall call:
+                if (!HelperCallCanWriteGqrs(call)) return;
+                reloaded = hoistedGqrIndices;
+                break;
+            case IrIndirectCall:
+                reloaded = hoistedGqrIndices;
+                break;
+        }
+
+        if (reloaded is null) return;
+        foreach (var index in reloaded.Where(hoistedGqrIndices.Contains).OrderBy(static value => value))
+        {
+            body.AppendLine($"{pad}{HoistedGqrName(index)} = ctx->gqr[{index}];");
+        }
+    }
+
+    /// <summary>
+    /// Whether a non-guest helper call can leave a GQR stale. The catalog is authoritative; anything it
+    /// doesn't model exactly reloads. One case it can't model: the generic SPR writer reaches GQR0-7
+    /// through SPR 912-919, so it must not slip through as if it left them alone.
+    /// </summary>
+    private static bool HelperCallCanWriteGqrs(IrCall call)
+    {
+        if (call.Target.Equals("PPC_WriteSpr", StringComparison.OrdinalIgnoreCase))
+        {
+            return call.Arguments.Count == 0 ||
+                   call.Arguments[0].Constant is not { } spr ||
+                   spr is >= 912 and <= 919;
+        }
+
+        const GuestCallBoundaryFlags opaque =
+            GuestCallBoundaryFlags.RequiresCompleteContext |
+            GuestCallBoundaryFlags.CanSuspend |
+            GuestCallBoundaryFlags.CanSwitchThreads |
+            GuestCallBoundaryFlags.InvokesGuestCode;
+        return (AnalyzeGuestHelperEffect(call).BoundaryFlags & opaque) != 0;
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.GuestThunkInlines.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.GuestThunkInlines.cs
new file mode 100644
index 0000000..d519e0d
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.GuestThunkInlines.cs
@@ -0,0 +1,126 @@
+using System.Text;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    private static bool TryEmitInlineGuestThunk(
+        uint address,
+        StringBuilder sb,
+        string pad,
+        RepresentationEnvironment types,
+        bool frameBaseIsStack)
+    {
+        if (!TryGetInlineGuestThunkSpec(address, out var spec))
+        {
+            return false;
+        }
+
+        var frameBase = RegisterToReadExpression("r11", types);
+        var isFloat = spec.Kind is InlineGuestThunkKind.SaveFpr or InlineGuestThunkKind.RestFpr;
+        var isStore = spec.Kind is InlineGuestThunkKind.SaveGpr or InlineGuestThunkKind.SaveFpr;
+        EmitInlineGuestThunkRange(spec, frameBase, sb, pad, types, frameBaseIsStack, isFloat, isStore);
+        return true;
+    }
+
+    private static void EmitInlineGuestThunkRange(
+        InlineGuestThunkSpec spec,
+        string frameBase,
+        StringBuilder sb,
+        string pad,
+        RepresentationEnvironment types,
+        bool frameBaseIsStack,
+        bool isFloat,
+        bool isStore)
+    {
+        var bytesPerRegister = isFloat ? 8 : 4;
+        var helperSize = bytesPerRegister;
+
+        if (frameBaseIsStack)
+        {
+            var firstOffset = (spec.StartRegister - 32) * bytesPerRegister;
+            var length = (32 - spec.StartRegister) * bytesPerRegister;
+            sb.AppendLine($"{pad}{{");
+            var needsRead = isStore ? "false" : "true";
+            var needsWrite = isStore ? "true" : "false";
+            sb.AppendLine($"{pad}    uint8_t* const guest_thunk_stack = MemoryInline::ResolveRangeHost(({frameBase} + {firstOffset}), 0, {length}u, {needsRead}, {needsWrite});");
+            for (var reg = spec.StartRegister; reg <= 31; reg++)
+            {
+                var offset = (reg - 32) * bytesPerRegister;
+                var rangeOffset = offset - firstOffset;
+                var registerName = isFloat ? FprRegisterName(reg) : GprRegisterName(reg);
+                var value = isStore
+                    ? RegisterToReadExpression(registerName, types)
+                    : RegisterToWriteExpression(registerName, types);
+                if (isStore)
+                {
+                    var storedValue = isFloat ? value : $"static_cast<uint32_t>({value})";
+                    var helper = isFloat ? "WriteResolvedFloat64" : "WriteResolved32";
+                    sb.AppendLine($"{pad}    MemoryInline::{helper}(guest_thunk_stack, {rangeOffset}u, ({frameBase} + {offset}), {storedValue});");
+                }
+                else
+                {
+                    var helper = isFloat ? "ReadResolvedFloat64" : "ReadResolved32";
+                    sb.AppendLine($"{pad}    {value} = MemoryInline::{helper}(guest_thunk_stack, {rangeOffset}u, ({frameBase} + {offset}));");
+                }
+            }
+            sb.AppendLine($"{pad}}}");
+            return;
+        }
+
+        for (var reg = spec.StartRegister; reg <= 31; reg++)
+        {
+            var offset = (reg - 32) * bytesPerRegister;
+            var registerName = isFloat ? FprRegisterName(reg) : GprRegisterName(reg);
+            var value = isStore
+                ? RegisterToReadExpression(registerName, types)
+                : RegisterToWriteExpression(registerName, types);
+            if (isStore)
+            {
+                var storedValue = isFloat ? value : $"static_cast<uint32_t>({value})";
+                sb.AppendLine($"{pad}{GuestStoreHelper(helperSize, isFloat)}(({frameBase} + {offset}), {storedValue});");
+            }
+            else
+            {
+                sb.AppendLine($"{pad}{value} = {GuestLoadHelper(helperSize, isFloat)}(({frameBase} + {offset}));");
+            }
+        }
+    }
+
+    private static bool HasLocallyProvenStackFrameBase(
+        IReadOnlyList<Translator.Core.Ir.IrInstruction> instructions,
+        int callIndex,
+        StackAddressFacts stackFacts)
+    {
+        // EABI save/restore thunks implicitly consume r11, so it is not present
+        // in the ordinary argument list. Prove the thunk's frame base from the
+        // nearest local SSA definition. Standard compiler prologues/epilogues
+        // establish r11 immediately before the thunk; anything less direct
+        // deliberately falls back to generic guest memory.
+        for (var index = callIndex - 1; index >= 0; --index)
+        {
+            var destination = instructions[index] switch
+            {
+                Translator.Core.Ir.IrAssign assign => assign.Destination,
+                Translator.Core.Ir.IrBinary binary => binary.Destination,
+                Translator.Core.Ir.IrLoad load => load.Destination,
+                Translator.Core.Ir.IrCall call => call.Destination,
+                Translator.Core.Ir.IrIndirectCall call => call.Destination,
+                Translator.Core.Ir.IrPhi phi => phi.Destination,
+                _ => null
+            };
+            if (destination is null ||
+                !GetRegisterBaseName(destination).Equals("r11", StringComparison.OrdinalIgnoreCase))
+            {
+                continue;
+            }
+
+            return stackFacts.ContainsTemporary(destination);
+        }
+
+        return false;
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Helpers.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Helpers.cs
new file mode 100644
index 0000000..9055608
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Helpers.cs
@@ -0,0 +1,283 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    private enum InlineGuestThunkKind
+    {
+        SaveGpr,
+        RestGpr,
+        SaveFpr,
+        RestFpr,
+    }
+
+    private readonly record struct InlineGuestThunkSpec(
+        InlineGuestThunkKind Kind,
+        int StartRegister,
+        uint Address);
+
+    /// <summary>
+    /// Indentation prefixes. <c>EmitInstruction</c> built one of these per
+    /// emitted instruction; the table is indexed by nesting depth and produces
+    /// exactly the same text.
+    /// </summary>
+    private static readonly string[] IndentPads = CreateIndentPads();
+
+    private static string[] CreateIndentPads()
+    {
+        var pads = new string[10];
+        for (var i = 0; i < pads.Length; i++)
+        {
+            pads[i] = new string(' ', i * 4);
+        }
+
+        return pads;
+    }
+
+    private static string IndentPad(int indent) =>
+        (uint)indent < (uint)IndentPads.Length ? IndentPads[indent] : new string(' ', indent * 4);
+
+    /// <summary>
+    /// Single entry point for helper-effect lookups from the emitter. Not memoized: the catalog
+    /// already resolves a target via one frozen-dictionary probe and hands out shared instances,
+    /// so a call-site memo would just duplicate the catalog's own lookup for no benefit.
+    /// </summary>
+    private static Translator.Core.Analysis.GuestHelperEffect AnalyzeGuestHelperEffect(IrCall call) =>
+        Translator.Core.Analysis.GuestHelperEffectCatalog.Analyze(call);
+
+    private static string SanitizeLabel(string label)
+    {
+        var clean = label.StartsWith("0x", StringComparison.OrdinalIgnoreCase) ? label[2..] : label;
+        clean = clean.Replace(":", "_").Replace("-", "_");
+        return $"loc_{clean}";
+    }
+
+    private static string SanitizeIdentifier(string name)
+    {
+        if (string.IsNullOrWhiteSpace(name))
+        {
+            return "_";
+        }
+
+        var trimmed = name.StartsWith("0x", StringComparison.OrdinalIgnoreCase)
+            ? name[2..]
+            : name;
+
+        var sb = new StringBuilder(trimmed.Length + 8);
+        foreach (var ch in trimmed)
+        {
+            sb.Append(char.IsLetterOrDigit(ch) || ch == '_' ? ch : '_');
+        }
+
+        var result = sb.ToString();
+        if (result.Length == 0 || !(char.IsLetter(result[0]) || result[0] == '_'))
+        {
+            result = "func_" + result;
+        }
+
+        return result;
+    }
+
+    private static string FormatSymbol(string target) => SanitizeIdentifier(target);
+
+    private static bool IsGuestCallTarget(string target)
+    {
+        if (string.IsNullOrWhiteSpace(target))
+        {
+            return false;
+        }
+
+        if (GuestTargetParser.TryParseAddress(target, out _))
+        {
+            return true;
+        }
+
+        var trimmed = target.Trim();
+        if (trimmed.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+        {
+            return true;
+        }
+
+        return trimmed.StartsWith("func_", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static bool TryParseAddress(string target, out uint address) =>
+        GuestTargetParser.TryParseAddress(target, out address);
+
+    private static bool IsGuestScalarFloatArgument(
+        IGuestFunctionAbiProvider guestAbiProvider,
+        string target,
+        string registerName)
+    {
+        var baseName = GetRegisterBaseName(registerName);
+        if (!IsAbiFloatArgumentRegister(baseName) ||
+            !guestAbiProvider.TryGetGuestFunctionAbi(target, out var abi))
+        {
+            return false;
+        }
+
+        return abi.HasScalarFloatArgument(baseName);
+    }
+
+    private static bool IsGuestPairedScalarFloatReturn(
+        IGuestFunctionAbiProvider guestAbiProvider,
+        string target) =>
+        guestAbiProvider.TryGetGuestFunctionAbi(target, out var abi) &&
+        abi.ReturnsPairedScalarFloat;
+
+    private static bool IsPairedProducerTarget(string target) =>
+        PpcFloatCallSemantics.IsPairedProducerTarget(target);
+
+    private static bool IsPairedConsumerTarget(string target) =>
+        PpcFloatCallSemantics.IsPairedConsumerTarget(target);
+
+    private static bool IsSinglePrecisionConsumerTarget(string target) =>
+        PpcFloatCallSemantics.IsSinglePrecisionConsumerTarget(target);
+
+    private static bool IsScalarFloatConsumerTarget(string target) =>
+        PpcFloatCallSemantics.IsScalarFloatConsumerTarget(target);
+
+    private static bool IsPairedFloatValue(
+        IrValue value,
+        IReadOnlyDictionary<string, bool> localPaired)
+    {
+        if (value is not { Kind: "register", RegisterName: { } register } ||
+            !IsFloatRegister(register))
+        {
+            return false;
+        }
+
+        return localPaired.TryGetValue(GetRegisterBaseName(register), out var paired) && paired;
+    }
+
+    /// <summary>
+    /// Materializes the scalar ps0 value when a scalar floating-point consumer
+    /// reads an FPR whose current authoritative representation is a packed pair.
+    /// </summary>
+    private static string ToScalarFloatExpression(
+        IrValue value,
+        RepresentationEnvironment types,
+        IReadOnlyDictionary<string, bool> localPaired)
+    {
+        var expression = ToExpression(value, types);
+        return IsPairedFloatValue(value, localPaired)
+            ? $"PPC_PsToScalarInline({expression})"
+            : expression;
+    }
+
+    /// <summary>
+    /// Materializes a packed pair when a paired-single consumer reads a scalar FPR.
+    /// </summary>
+    private static string ToPairedFloatExpression(
+        IrValue value,
+        RepresentationEnvironment types,
+        IReadOnlyDictionary<string, bool> localPaired,
+        bool fpscrNiDisabled = false)
+    {
+        var expression = ToExpression(value, types);
+        return IsPairedFloatValue(value, localPaired)
+            ? expression
+            : fpscrNiDisabled
+                ? $"PPC_PsFromScalarNoNiInline({expression})"
+                : $"PPC_PsFromScalarInline({expression})";
+    }
+
+    private static string FprStorageExpression(string register)
+    {
+        var index = ParseFloatRegisterIndex(register);
+        if (index is < 0 or >= 32)
+            throw new InvalidOperationException($"Invalid FPR register '{register}'.");
+        return _activeResidency is null
+            ? $"ctx->fpr[{index}]"
+            : _activeResidency.FprStorage(index, written: true);
+    }
+
+    private static string PairedAssignment(string destination, string expression, RepresentationEnvironment types)
+    {
+        if (IsFloatRegister(destination))
+            return $"PpcSetPairedFprInline({FprStorageExpression(destination)}, {expression});";
+        return $"{ToDestination(destination, types)} = {expression};";
+    }
+
+    private static bool TryGetInlineGuestThunkSpec(uint address, out InlineGuestThunkSpec spec)
+    {
+        var thunks = GuestSaveRestoreThunks.Current;
+        if (TryGetInlineGuestThunkRangeSpec(address, thunks.SaveGpr, InlineGuestThunkKind.SaveGpr, out spec))
+        {
+            return true;
+        }
+
+        if (TryGetInlineGuestThunkRangeSpec(address, thunks.RestGpr, InlineGuestThunkKind.RestGpr, out spec))
+        {
+            return true;
+        }
+
+        if (TryGetInlineGuestThunkRangeSpec(address, thunks.SaveFpr, InlineGuestThunkKind.SaveFpr, out spec))
+        {
+            return true;
+        }
+
+        if (TryGetInlineGuestThunkRangeSpec(address, thunks.RestFpr, InlineGuestThunkKind.RestFpr, out spec))
+        {
+            return true;
+        }
+
+        spec = default;
+        return false;
+    }
+
+    private static bool TryGetInlineGuestThunkRangeSpec(
+        uint address,
+        GuestSaveRestoreThunkRange? range,
+        InlineGuestThunkKind kind,
+        out InlineGuestThunkSpec spec)
+    {
+        if (range is null)
+        {
+            spec = default;
+            return false;
+        }
+
+        var (baseAddress, startRegister, endRegister) = range;
+        var rangeBytes = checked((uint)((endRegister - startRegister) * 4));
+        if (address < baseAddress || address > (baseAddress + rangeBytes) || ((address - baseAddress) & 0x3) != 0)
+        {
+            spec = default;
+            return false;
+        }
+
+        spec = new InlineGuestThunkSpec(
+            kind,
+            startRegister + (int)((address - baseAddress) / 4),
+            address);
+        return true;
+    }
+
+    private static string RequireLabel(string? label, Dictionary<string, string> labelNames, string fromLabel, string functionName)
+    {
+        if (string.IsNullOrWhiteSpace(label))
+        {
+            throw new InvalidOperationException($"Block '{fromLabel}' in '{functionName}' references an empty target label.");
+        }
+
+        if (!labelNames.TryGetValue(label, out var existing) || string.IsNullOrWhiteSpace(existing))
+        {
+            throw new InvalidOperationException($"Block '{fromLabel}' in '{functionName}' references missing target '{label}'.");
+        }
+
+        return existing;
+    }
+
+    private static string EscapeForCxxLiteral(string text) => text
+        .Replace("\\", "\\\\")
+        .Replace("\"", "\\\"");
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Inlines.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Inlines.cs
new file mode 100644
index 0000000..5ea4077
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Inlines.cs
@@ -0,0 +1,544 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text;
+using Translator.Core.Analysis;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    /// <summary>
+    /// Tries to emit inline C++ code for a PPC helper call instead of generating a function call.
+    /// Returns true if inline code was emitted, false if the caller should fall back to function call.
+    /// </summary>
+    private static bool TryEmitInlinePpc(
+        IrCall call,
+        StringBuilder sb,
+        string pad,
+        RepresentationEnvironment types,
+        Dictionary<string, bool> localPaired,
+        StackAddressFacts stackFacts)
+    {
+        var target = call.Target;
+        if (string.IsNullOrWhiteSpace(target))
+            return false;
+
+        // Get destination if any
+        var hasDest = !string.IsNullOrWhiteSpace(call.Destination);
+        var dest = hasDest ? ToDestination(call.Destination!, types) : null;
+
+        void EmitPairedResult(string expression)
+        {
+            if (!hasDest) return;
+            sb.AppendLine($"{pad}{PairedAssignment(call.Destination!, expression, types)}");
+        }
+
+        // Helper to get argument expression
+        string GetArg(int index)
+        {
+            if (index >= call.Arguments.Count)
+                return "0";
+            return ToExpression(call.Arguments[index], types);
+        }
+
+        bool TryGetConstArg(int index, out long value)
+        {
+            value = 0;
+            if (index >= call.Arguments.Count)
+                return false;
+            var argVal = call.Arguments[index];
+            if (argVal.Kind != "const" || !argVal.Constant.HasValue)
+                return false;
+            value = argVal.Constant.Value;
+            return true;
+        }
+
+        // Wrap scalar in PsFromScalar if needed for paired consumer
+        string WrapForPaired(int index, bool fpscrNiDisabled = false)
+        {
+            if (index >= call.Arguments.Count)
+                return "0";
+            return ToPairedFloatExpression(
+                call.Arguments[index], types, localPaired, fpscrNiDisabled);
+        }
+
+        // Extract ps0 for scalar consumers if the source is paired
+        string WrapForScalar(int index)
+        {
+            if (index >= call.Arguments.Count)
+                return "0";
+            return ToScalarFloatExpression(call.Arguments[index], types, localPaired);
+        }
+
+        var guardedKnown = target.StartsWith("PPC_PsqLKnownGuarded_", StringComparison.OrdinalIgnoreCase) ||
+                           target.StartsWith("PPC_PsqStKnownGuarded_", StringComparison.OrdinalIgnoreCase);
+        var knownPrefix = target.StartsWith("PPC_PsqLKnownGuarded_", StringComparison.OrdinalIgnoreCase)
+            ? "PPC_PsqLKnownGuarded_"
+            : target.StartsWith("PPC_PsqStKnownGuarded_", StringComparison.OrdinalIgnoreCase)
+                ? "PPC_PsqStKnownGuarded_"
+                : target.StartsWith("PPC_PsqLKnown_", StringComparison.OrdinalIgnoreCase)
+                    ? "PPC_PsqLKnown_"
+                    : target.StartsWith("PPC_PsqStKnown_", StringComparison.OrdinalIgnoreCase)
+                        ? "PPC_PsqStKnown_"
+                        : null;
+        if (knownPrefix != null &&
+            uint.TryParse(target.AsSpan(knownPrefix.Length), NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var knownGqr))
+        {
+            var knownLoad = knownPrefix.StartsWith("PPC_PsqL", StringComparison.OrdinalIgnoreCase);
+            var wIndex = knownLoad ? 1 : 2;
+            var iIndex = knownLoad ? 2 : 3;
+            if (TryGetConstArg(wIndex, out var knownW) && TryGetConstArg(iIndex, out var knownI) &&
+                knownW is 0 or 1 && knownI is >= 0 and < 8)
+            {
+                var address = GetArg(0);
+                var stack = stackFacts.TryResolve(call.Arguments[0], out _);
+                // The guard's else-arm is the generic helper, so it takes the
+                // hoisted GQR local exactly like an unguarded generic site.
+                var hoistedFallback = !stack && IsGqrHoisted(knownI);
+                if (knownLoad && hasDest)
+                {
+                    var helper = stack
+                        ? "PPC_PsqLKnownStackInline"
+                        : "PPC_PsqLKnownInline";
+                    var knownCall = $"{helper}<{knownW}u, {knownI}u, 0x{knownGqr:X8}u>(ctx, {address})";
+                    var knownExpression = knownCall;
+                    if (guardedKnown)
+                    {
+                        var fallback = hoistedFallback
+                            ? $"PPC_PsqLGqrInline<{knownW}u, {knownI}u>(ctx, {HoistedGqrName(knownI)}, {address})"
+                            : $"{(stack ? "PPC_PsqLStackInline" : "PPC_PsqLInline")}<{knownW}u, {knownI}u>(ctx, {address})";
+                        knownExpression = $"{GqrEntryGuardName((uint)knownI, knownGqr)} ? {knownCall} : {fallback}";
+                    }
+                    EmitPairedResult(knownExpression);
+                    return true;
+                }
+                if (!knownLoad)
+                {
+                    var helper = stack
+                        ? "PPC_PsqStKnownStackInline"
+                        : "PPC_PsqStKnownInline";
+                    var value = WrapForPaired(1);
+                    if (guardedKnown)
+                    {
+                        var fallback = hoistedFallback
+                            ? $"PPC_PsqStGqrInline<{knownW}u, {knownI}u>(ctx, {HoistedGqrName(knownI)}, {address}, {value})"
+                            : $"{(stack ? "PPC_PsqStStackInline" : "PPC_PsqStInline")}<{knownW}u, {knownI}u>(ctx, {address}, {value})";
+                        sb.AppendLine($"{pad}if ({GqrEntryGuardName((uint)knownI, knownGqr)}) {helper}<{knownW}u, {knownI}u, 0x{knownGqr:X8}u>(ctx, {address}, {value});");
+                        sb.AppendLine($"{pad}else {fallback};");
+                    }
+                    else sb.AppendLine($"{pad}{helper}<{knownW}u, {knownI}u, 0x{knownGqr:X8}u>(ctx, {address}, {value});");
+                    return true;
+                }
+            }
+        }
+
+        if (InlinePairedCallSpecs.TryGetValue(target, out var pairedSpec))
+        {
+            if (hasDest)
+            {
+                var arguments = new string[pairedSpec.ArgumentOrder.Length];
+                for (var i = 0; i < arguments.Length; i++)
+                {
+                    arguments[i] = WrapForPaired(
+                        pairedSpec.ArgumentOrder[i], pairedSpec.NoNiVariant);
+                }
+
+                EmitPairedResult($"{pairedSpec.Helper}({string.Join(", ", arguments)})");
+            }
+
+            // The hand-written arithmetic cases historically returned true
+            // without a destination, suppressing a malformed helper call. Keep
+            // that behavior in the table-driven path.
+            return true;
+        }
+
+        if (InlineScalarCallSpecs.TryGetValue(target, out var scalarSpec))
+        {
+            if (hasDest)
+            {
+                var arguments = new string[scalarSpec.ArgumentOrder.Length];
+                for (var i = 0; i < arguments.Length; i++)
+                {
+                    arguments[i] = WrapForScalar(scalarSpec.ArgumentOrder[i]);
+                }
+
+                var expression = scalarSpec.Kind switch
+                {
+                    ScalarInlineKind.HelperCall =>
+                        $"{scalarSpec.Helper}({string.Join(", ", arguments)})",
+                    ScalarInlineKind.RoundedBinary =>
+                        $"static_cast<double>({(scalarSpec.NoNiVariant
+                            ? $"static_cast<float>({arguments[0]} {scalarSpec.Operator} {arguments[1]})"
+                            : $"PpcForceSingleValueInline({arguments[0]} {scalarSpec.Operator} {arguments[1]})")})",
+                    _ => throw new InvalidOperationException(
+                        $"Unknown scalar inline kind '{scalarSpec.Kind}'.")
+                };
+                sb.AppendLine($"{pad}{dest} = {expression};");
+            }
+
+            // Match the old scalar helper cases: a missing destination is a
+            // handled call that emits no statement.
+            return true;
+        }
+
+        // Match and inline specific PPC helpers
+        switch (InlineHelperSwitchKey(target))
+        {
+            // fcmpo/fcmpu lower to IrSetCrField today, but the PPC_Fcmp helper
+            // writes a CR field through the thread-local CpuContext, which a
+            // resident CR local can never observe. Keep a resident expansion as
+            // a safety net in case a lifter path ever produces the helper form.
+            case "PPC_FCMP":
+                if (_activeResidency is null || !TryGetConstArg(0, out var fcmpField))
+                    return false;
+                sb.AppendLine($"{pad}SetCRFloatResident({_activeResidency.Cr(written: true)}, {fcmpField & 7}, {WrapForScalar(1)}, {WrapForScalar(2)});");
+                return true;
+
+            case "PPC_CRSETBIT":
+                if (!hasDest)
+                    return false;
+                sb.AppendLine($"{pad}{dest} = PpcCrSetBitResident({dest}, static_cast<uint32_t>({GetArg(0)}), static_cast<uint32_t>({GetArg(1)}));");
+                return true;
+
+            case "PPC_CRLOGICAL":
+                if (!hasDest)
+                    return false;
+                sb.AppendLine($"{pad}{dest} = PpcCrLogicalResident({dest}, static_cast<uint32_t>({GetArg(0)}), static_cast<uint32_t>({GetArg(1)}), static_cast<uint32_t>({GetArg(2)}), static_cast<uint32_t>({GetArg(3)}));");
+                return true;
+
+            case "PPC_MCRF":
+                if (!hasDest)
+                    return false;
+                sb.AppendLine($"{pad}{dest} = PpcMcrfResident({dest}, static_cast<uint32_t>({GetArg(0)}), static_cast<uint32_t>({GetArg(1)}));");
+                return true;
+
+            case "PPC_CNTLZW":
+                if (!hasDest)
+                    return false;
+                sb.AppendLine($"{pad}{dest} = PPC_CntlzwInline(static_cast<uint32_t>({GetArg(0)}));");
+                return true;
+
+            case "PPC_GETCARRY":
+                if (!hasDest)
+                    return false;
+                {
+                    var carrySource = _activeResidency is null
+                        ? "ctx->xer"
+                        : _activeResidency.Xer(written: false);
+                    sb.AppendLine($"{pad}{dest} = ({carrySource} >> 29) & 1u;");
+                }
+                return true;
+
+            case "PPC_UPDATECARRYSUB":
+                if (!hasDest)
+                    return false;
+                sb.AppendLine($"{pad}{dest} = ({dest} & 0xDFFFFFFFu) | " +
+                              $"((static_cast<uint32_t>({GetArg(0)}) >= static_cast<uint32_t>({GetArg(1)}) ? 1u : 0u) << 29);");
+                return true;
+
+            case "PPC_UPDATECARRYADD":
+                if (!hasDest)
+                    return false;
+                sb.AppendLine($"{pad}{{");
+                sb.AppendLine($"{pad}    const uint64_t ppcCarryWide = static_cast<uint64_t>(static_cast<uint32_t>({GetArg(0)})) + " +
+                              $"static_cast<uint64_t>(static_cast<uint32_t>({GetArg(1)})) + " +
+                              $"(static_cast<uint64_t>(static_cast<uint32_t>({GetArg(2)})) & 1u);");
+                sb.AppendLine($"{pad}    {dest} = ({dest} & 0xDFFFFFFFu) | " +
+                              "(static_cast<uint32_t>((ppcCarryWide >> 32) & 1u) << 29);");
+                sb.AppendLine($"{pad}}}");
+                return true;
+
+            case "PPC_UPDATECARRYSHIFTRIGHT":
+                if (!hasDest)
+                    return false;
+                sb.AppendLine($"{pad}{{");
+                sb.AppendLine($"{pad}    const uint32_t ppcCarryValue = static_cast<uint32_t>({GetArg(0)});");
+                sb.AppendLine($"{pad}    const uint32_t ppcCarryShift = static_cast<uint32_t>({GetArg(1)}) & 0x3Fu;");
+                sb.AppendLine($"{pad}    const bool ppcCarryNegative = (ppcCarryValue & 0x80000000u) != 0;");
+                sb.AppendLine($"{pad}    const uint32_t ppcCarry = ppcCarryShift == 0 ? 0u : " +
+                              "(ppcCarryShift >= 32 ? (ppcCarryNegative && ppcCarryValue != 0 ? 1u : 0u) : " +
+                              "(ppcCarryNegative && (ppcCarryValue & ((1u << ppcCarryShift) - 1u)) != 0 ? 1u : 0u));");
+                sb.AppendLine($"{pad}    {dest} = ({dest} & 0xDFFFFFFFu) | (ppcCarry << 29);");
+                sb.AppendLine($"{pad}}}");
+                return true;
+
+            case "PPC_PSFROMSCALAR":
+                // PPC_PsFromScalar(value): Pack scalar float into both ps0 and ps1
+                if (hasDest)
+                {
+                    var arg = WrapForScalar(0);
+                    EmitPairedResult($"PPC_PsFromScalarInline({arg})");
+                }
+                return true;
+
+            case "PPC_PSTOSCALAR":
+                // PPC_PsToScalar(value): Extract ps0 as double
+                if (hasDest)
+                {
+                    var arg = WrapForScalar(0);
+                    sb.AppendLine($"{pad}{dest} = {arg};");
+                }
+                return true;
+
+            case "PPC_PSMR":
+                // ps_mr owns both lanes; do not lower it through the scalar
+                // IrAssign path used by fmr.
+                if (hasDest)
+                    EmitPairedResult(GetArg(0));
+                return true;
+
+            case "PPC_PSCMPO0":
+            case "PPC_PSCMPU0":
+            case "PPC_PSCMPO1":
+            case "PPC_PSCMPU1":
+                {
+                    // ps_cmpX lifts with an empty destination and the CR field as argument 0, so the
+                    // resident CR local is the real destination. Falling through to the PPC_PsCmpX helper
+                    // on a missing destination wrote CR through CpuContext instead, invisible to the
+                    // resident local, which froze ps_cmp-gated loops and flipped branch decisions.
+                    var lane = target.EndsWith("1", StringComparison.OrdinalIgnoreCase) ? 1 : 0;
+                    var laneHelper = lane == 0 ? "PpcGetPs0Inline" : "PpcGetPs1Inline";
+                    var left = WrapForPaired(1);
+                    var right = WrapForPaired(2);
+                    var crDestination = hasDest
+                        ? dest
+                        : _activeResidency?.Cr(written: true);
+                    if (crDestination is null)
+                        return false;
+                    sb.AppendLine($"{pad}SetCRFloatResident({crDestination}, static_cast<uint32_t>({GetArg(0)}) & 7u, " +
+                                  $"{laneHelper}({left}), {laneHelper}({right}));");
+                    return true;
+                }
+
+            case "PPC_PSQL":
+                if (hasDest &&
+                    TryGetConstArg(1, out var loadW) &&
+                    TryGetConstArg(2, out var loadI) &&
+                    loadW is 0 or 1 &&
+                    loadI is >= 0 and < 8)
+                {
+                    var addr = GetArg(0);
+                    var stackLoad = stackFacts.TryResolve(call.Arguments[0], out _);
+                    EmitPairedResult(!stackLoad && IsGqrHoisted(loadI)
+                        ? $"PPC_PsqLGqrInline<{loadW}u, {loadI}u>(ctx, {HoistedGqrName(loadI)}, {addr})"
+                        : $"{(stackLoad ? "PPC_PsqLStackInline" : "PPC_PsqLInline")}<{loadW}u, {loadI}u>(ctx, {addr})");
+                    return true;
+                }
+                return false;
+
+            case "PPC_PSQST":
+                if (TryGetConstArg(2, out var storeW) &&
+                    TryGetConstArg(3, out var storeI) &&
+                    storeW is 0 or 1 &&
+                    storeI is >= 0 and < 8)
+                {
+                    var addr = GetArg(0);
+                    var value = WrapForPaired(1);
+                    var stackStore = stackFacts.TryResolve(call.Arguments[0], out _);
+                    sb.AppendLine(!stackStore && IsGqrHoisted(storeI)
+                        ? $"{pad}PPC_PsqStGqrInline<{storeW}u, {storeI}u>(ctx, {HoistedGqrName(storeI)}, {addr}, {value});"
+                        : $"{pad}{(stackStore ? "PPC_PsqStStackInline" : "PPC_PsqStInline")}<{storeW}u, {storeI}u>(ctx, {addr}, {value});");
+                    return true;
+                }
+                return false;
+
+            default:
+                // Not handled - fall back to function call
+                return false;
+        }
+    }
+
+    private enum ScalarInlineKind
+    {
+        HelperCall,
+        RoundedBinary,
+    }
+
+    private readonly record struct PairedInlineSpec(
+        string Helper,
+        bool NoNiVariant,
+        int[] ArgumentOrder);
+
+    private readonly record struct ScalarInlineSpec(
+        ScalarInlineKind Kind,
+        string? Helper,
+        string? Operator,
+        bool NoNiVariant,
+        int[] ArgumentOrder);
+
+    /// <summary>
+    /// Descriptor table for paired arithmetic helpers. NoNI aliases are
+    /// explicit entries so the helper name and scalar-to-paired conversion mode
+    /// cannot drift independently.
+    /// </summary>
+    private static readonly IReadOnlyDictionary<string, PairedInlineSpec> InlinePairedCallSpecs =
+        BuildPairedInlineCallSpecs();
+
+    private static IReadOnlyDictionary<string, PairedInlineSpec> BuildPairedInlineCallSpecs()
+    {
+        var specs = new Dictionary<string, PairedInlineSpec>(StringComparer.OrdinalIgnoreCase);
+
+        static void Add(
+            Dictionary<string, PairedInlineSpec> destination,
+            string target,
+            string helper,
+            bool noNiVariant,
+            params int[] argumentOrder) =>
+            destination.Add(
+                target,
+                new PairedInlineSpec(helper, noNiVariant, argumentOrder));
+
+        static void AddNoNi(
+            Dictionary<string, PairedInlineSpec> destination,
+            string target,
+            string noNiTarget,
+            string helper,
+            string noNiHelper,
+            params int[] argumentOrder)
+        {
+            Add(destination, target, helper, false, argumentOrder);
+            Add(destination, noNiTarget, noNiHelper, true, argumentOrder);
+        }
+
+        Add(specs, "PPC_PSMERGE00", "PPC_PsMerge00Inline", false, 0, 1);
+        Add(specs, "PPC_PSMERGE01", "PPC_PsMerge01Inline", false, 0, 1);
+        Add(specs, "PPC_PSMERGE10", "PPC_PsMerge10Inline", false, 0, 1);
+        Add(specs, "PPC_PSMERGE11", "PPC_PsMerge11Inline", false, 0, 1);
+
+        AddNoNi(
+            specs, "PPC_PSADD", "PPC_PSADDNONI",
+            "PPC_PsAddInline", "PPC_PsAddNoNiInline", 0, 1);
+        AddNoNi(
+            specs, "PPC_PSSUB", "PPC_PSSUBNONI",
+            "PPC_PsSubInline", "PPC_PsSubNoNiInline", 0, 1);
+        Add(specs, "PPC_PSDIV", "PPC_PsDivInline", false, 0, 1);
+        AddNoNi(
+            specs, "PPC_PSMUL", "PPC_PSMULNONI",
+            "PPC_PsMulInline", "PPC_PsMulNoNiInline", 0, 1);
+
+        Add(specs, "PPC_PSNEG", "PPC_PsNegInline", false, 0);
+        Add(specs, "PPC_PSABS", "PPC_PsAbsInline", false, 0);
+        Add(specs, "PPC_PSMULS0", "PPC_PsMuls0Inline", false, 0, 1);
+        Add(specs, "PPC_PSMULS1", "PPC_PsMuls1Inline", false, 0, 1);
+
+        AddNoNi(
+            specs, "PPC_PSMADD", "PPC_PSMADDNONI",
+            "PPC_PsMaddInline", "PPC_PsMaddNoNiInline", 0, 1, 2);
+        AddNoNi(
+            specs, "PPC_PSMSUB", "PPC_PSMSUBNONI",
+            "PPC_PsMsubInline", "PPC_PsMsubNoNiInline", 0, 1, 2);
+        AddNoNi(
+            specs, "PPC_PSNMSUB", "PPC_PSNMSUBNONI",
+            "PPC_PsNmsubInline", "PPC_PsNmsubNoNiInline", 0, 1, 2);
+        Add(specs, "PPC_PSNMADD", "PPC_PsNmaddInline", false, 0, 1, 2);
+        Add(specs, "PPC_PSMADDS0", "PPC_PsMadds0Inline", false, 0, 1, 2);
+        Add(specs, "PPC_PSMADDS1", "PPC_PsMadds1Inline", false, 0, 1, 2);
+        Add(specs, "PPC_PSSUM0", "PPC_PsSum0Inline", false, 0, 1, 2);
+        Add(specs, "PPC_PSSUM1", "PPC_PsSum1Inline", false, 0, 1, 2);
+
+        return specs;
+    }
+
+    /// <summary>
+    /// Descriptor table for scalar arithmetic helpers. Rounded binary operators
+    /// retain their distinct NI and NoNI expression forms; helper-call entries
+    /// retain the runtime primitive names directly.
+    /// </summary>
+    private static readonly IReadOnlyDictionary<string, ScalarInlineSpec> InlineScalarCallSpecs =
+        BuildScalarInlineCallSpecs();
+
+    private static IReadOnlyDictionary<string, ScalarInlineSpec> BuildScalarInlineCallSpecs()
+    {
+        var specs = new Dictionary<string, ScalarInlineSpec>(StringComparer.OrdinalIgnoreCase);
+
+        static void AddHelper(
+            Dictionary<string, ScalarInlineSpec> destination,
+            string target,
+            string helper,
+            params int[] argumentOrder) =>
+            destination.Add(
+                target,
+                new ScalarInlineSpec(
+                    ScalarInlineKind.HelperCall,
+                    helper,
+                    Operator: null,
+                    NoNiVariant: false,
+                    ArgumentOrder: argumentOrder));
+
+        static void AddHelperNoNi(
+            Dictionary<string, ScalarInlineSpec> destination,
+            string target,
+            string noNiTarget,
+            string helper,
+            string noNiHelper,
+            params int[] argumentOrder)
+        {
+            AddHelper(destination, target, helper, argumentOrder);
+            destination.Add(
+                noNiTarget,
+                new ScalarInlineSpec(
+                    ScalarInlineKind.HelperCall,
+                    noNiHelper,
+                    Operator: null,
+                    NoNiVariant: true,
+                    ArgumentOrder: argumentOrder));
+        }
+
+        static void AddRoundedBinary(
+            Dictionary<string, ScalarInlineSpec> destination,
+            string target,
+            string noNiTarget,
+            string @operator)
+        {
+            destination.Add(
+                target,
+                new ScalarInlineSpec(
+                    ScalarInlineKind.RoundedBinary,
+                    Helper: null,
+                    Operator: @operator,
+                    NoNiVariant: false,
+                    ArgumentOrder: new[] { 0, 1 }));
+            destination.Add(
+                noNiTarget,
+                new ScalarInlineSpec(
+                    ScalarInlineKind.RoundedBinary,
+                    Helper: null,
+                    Operator: @operator,
+                    NoNiVariant: true,
+                    ArgumentOrder: new[] { 0, 1 }));
+        }
+
+        AddRoundedBinary(specs, "PPC_FADDS", "PPC_FADDSNONI", "+");
+        AddRoundedBinary(specs, "PPC_FSUBS", "PPC_FSUBSNONI", "-");
+        AddHelperNoNi(
+            specs, "PPC_FMULS", "PPC_FMULSNONI",
+            "PpcFmulsInline", "PpcFmulsNoNiInline", 0, 1);
+        AddRoundedBinary(specs, "PPC_FDIVS", "PPC_FDIVSNONI", "/");
+
+        AddHelper(specs, "PPC_FSQRT", "std::sqrt", 0);
+        AddHelper(specs, "PPC_FMADD", "PpcFmaddInline", 0, 1, 2);
+        AddHelper(specs, "PPC_FMSUB", "PpcFmsubInline", 0, 1, 2);
+        AddHelper(specs, "PPC_FNMADD", "PpcFnmaddInline", 0, 1, 2);
+        AddHelper(specs, "PPC_FNMSUB", "PpcFnmsubInline", 0, 1, 2);
+
+        return specs;
+    }
+
+    /// <summary>
+    /// Case-insensitive lookup table for the remaining hand-written inline
+    /// cases. Table-driven arithmetic targets are looked up before this switch.
+    /// </summary>
+    private static readonly HashSet<string> InlineExpandedHelperTargets = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "PPC_FCMP", "PPC_CRSETBIT", "PPC_CRLOGICAL", "PPC_MCRF", "PPC_CNTLZW", "PPC_GETCARRY",
+        "PPC_UPDATECARRYSUB", "PPC_UPDATECARRYADD", "PPC_UPDATECARRYSHIFTRIGHT", "PPC_PSFROMSCALAR",
+        "PPC_PSTOSCALAR", "PPC_PSMR", "PPC_PSCMPO0", "PPC_PSCMPU0", "PPC_PSCMPO1", "PPC_PSCMPU1",
+        "PPC_PSQL", "PPC_PSQST"
+    };
+
+    private static string InlineHelperSwitchKey(string target) =>
+        InlineExpandedHelperTargets.TryGetValue(target, out var canonical) ? canonical : string.Empty;
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.LeafRegisterCache.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.LeafRegisterCache.cs
new file mode 100644
index 0000000..6d23932
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.LeafRegisterCache.cs
@@ -0,0 +1,1046 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    private sealed record LeafRegisterCache(
+        SortedSet<int> Gprs,
+        SortedSet<int> Fprs,
+        SortedSet<int> WrittenGprs,
+        SortedSet<int> WrittenFprs,
+        bool CacheSpecialRegisters = true)
+    {
+        public static LeafRegisterCache Empty { get; } = new(
+            new SortedSet<int>(),
+            new SortedSet<int>(),
+            new SortedSet<int>(),
+            new SortedSet<int>());
+
+        public bool IsEmpty => Gprs.Count == 0 && Fprs.Count == 0;
+        public bool HasFlushes => WrittenGprs.Count != 0 || WrittenFprs.Count != 0;
+    }
+
+    private sealed record LeafRegisterCacheInitializers(SortedSet<int> Gprs, SortedSet<int> Fprs)
+    {
+        public static LeafRegisterCacheInitializers Empty { get; } = new(new SortedSet<int>(), new SortedSet<int>());
+    }
+
+    private sealed record RegisterLiveness(
+        Dictionary<string, HashSet<string>> In);
+
+    /// <summary>
+    /// Helpers that touch cached architectural state via CpuContext instead of explicit args.
+    /// The leaf register cache can't see that traffic (e.g. cached_cr would go stale vs PPC_Fcmp),
+    /// so functions calling them are excluded; the residency path syncs them via inline expansion instead.
+    /// </summary>
+    private static readonly HashSet<string> TlsContextStateHelpers = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "PPC_Fcmp", "PPC_PsCmpo0", "PPC_PsCmpo1", "PPC_PsCmpu0", "PPC_PsCmpu1",
+        "PPC_Stwcx", "PPC_Mcrxr", "PPC_Mcrfs",
+        "PPC_Lswi", "PPC_Lswx", "PPC_Stswi", "PPC_Stswx",
+        "OSSystemCall"
+    };
+
+    private static bool FunctionEligibleForLeafRegisterCache(IrFunction func)
+    {
+        foreach (var block in func.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                switch (instruction)
+                {
+                    case IrIndirectCall:
+                    case IrIndirectJump:
+                    case IrJumpTable:
+                        return false;
+
+                    case IrCall call:
+                        if (TryParseAddress(call.Target, out var address))
+                        {
+                            if (TryGetInlineGuestThunkSpec(address, out _))
+                            {
+                                continue;
+                            }
+
+                            return false;
+                        }
+
+                        if (IsGuestCallTarget(call.Target))
+                        {
+                            return false;
+                        }
+
+                        if (TlsContextStateHelpers.Contains(call.Target))
+                        {
+                            return false;
+                        }
+                        break;
+                }
+            }
+        }
+
+        return true;
+    }
+
+    private static LeafRegisterCache CollectLeafRegisterCacheRegisters(
+        IrFunction func,
+        IGuestFunctionAbiProvider guestAbiProvider,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts = null)
+    {
+        var gprs = new SortedSet<int>();
+        var fprs = new SortedSet<int>();
+        var writtenGprs = new SortedSet<int>();
+        var writtenFprs = new SortedSet<int>();
+
+        void AddRegister(string? registerName, bool written = false)
+        {
+            if (string.IsNullOrWhiteSpace(registerName))
+            {
+                return;
+            }
+
+            var baseName = GetRegisterBaseName(registerName);
+            if (TryParseGprRegisterIndex(baseName, out var gpr))
+            {
+                gprs.Add(gpr);
+                if (written)
+                {
+                    writtenGprs.Add(gpr);
+                }
+
+                return;
+            }
+
+            if (TryParseFloatRegisterIndex(baseName, out var fpr))
+            {
+                fprs.Add(fpr);
+                if (written)
+                {
+                    writtenFprs.Add(fpr);
+                }
+            }
+        }
+
+        void AddValue(IrValue value)
+        {
+            if (value.Kind == "register")
+            {
+                AddRegister(value.RegisterName);
+            }
+        }
+
+        void AddAddress(IrAddress address) => AddRegister(address.Base);
+
+        foreach (var block in func.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                switch (instruction)
+                {
+                    case IrAssign assign:
+                        AddRegister(assign.Destination, written: true);
+                        AddValue(assign.Value);
+                        break;
+
+                    case IrBinary binary:
+                        AddRegister(binary.Destination, written: true);
+                        AddValue(binary.Left);
+                        AddValue(binary.Right);
+                        break;
+
+                    case IrLoad load:
+                        AddRegister(load.Destination, written: true);
+                        AddAddress(load.Address);
+                        break;
+
+                    case IrStore store:
+                        AddAddress(store.Address);
+                        AddValue(store.Source);
+                        break;
+
+                    case IrResolveGuestMemoryRange resolve:
+                        AddValue(resolve.Base);
+                        break;
+
+                    case IrResolvedLoad load:
+                        AddRegister(load.Destination, written: true);
+                        AddAddress(load.OriginalAddress);
+                        break;
+
+                    case IrResolvedStore store:
+                        AddAddress(store.OriginalAddress);
+                        AddValue(store.Source);
+                        break;
+
+                    case IrResolvedPsqLoad load:
+                        AddRegister(load.Destination, written: true);
+                        AddValue(load.OriginalAddress);
+                        break;
+
+
+                    case IrResolvedPsqStore store:
+                        AddValue(store.OriginalAddress);
+                        AddValue(store.Source);
+                        break;
+
+                    case IrResolvedLoadPair pair:
+                        AddRegister(pair.FirstDestination, written: true);
+                        AddRegister(pair.SecondDestination, written: true);
+                        AddAddress(pair.FirstOriginalAddress);
+                        AddAddress(pair.SecondOriginalAddress);
+                        break;
+
+                    case IrResolvedStorePair pair:
+                        AddAddress(pair.FirstOriginalAddress);
+                        AddAddress(pair.SecondOriginalAddress);
+                        AddValue(pair.FirstSource);
+                        AddValue(pair.SecondSource);
+                        break;
+
+                    case IrCall call:
+                        AddRegister(call.Destination, written: true);
+
+                        if (TryParseAddress(call.Target, out var address) &&
+                            TryGetInlineGuestThunkSpec(address, out _))
+                        {
+                            AddInlineGuestThunkReads(call);
+                            AddInlineGuestThunkWrites(call);
+                            break;
+                        }
+
+                        if (IsGuestCallTarget(call.Target))
+                        {
+                            var (readMask, writeMask) = GuestCallGprEffects(call, guestAbiContracts);
+                            for (var gpr = 0; gpr < 32; ++gpr)
+                            {
+                                if ((readMask & (1u << gpr)) != 0) AddRegister(GprRegisterName(gpr));
+                                if ((writeMask & (1u << gpr)) != 0) AddRegister(GprRegisterName(gpr), written: true);
+                            }
+                            var (fprReadMask, fprWriteMask) = GuestCallFprEffects(call, guestAbiContracts);
+                            for (var fpr = 0; fpr < 32; ++fpr)
+                            {
+                                if ((fprReadMask & (1u << fpr)) != 0) AddRegister(FprRegisterName(fpr));
+                                if ((fprWriteMask & (1u << fpr)) != 0) AddRegister(FprRegisterName(fpr), written: true);
+                            }
+                            break;
+                        }
+
+                        foreach (var argument in call.Arguments)
+                        {
+                            AddValue(argument);
+                        }
+                        var helperEffect = AnalyzeGuestHelperEffect(call);
+                        for (var gpr = 0; gpr < 32; ++gpr)
+                        {
+                            if ((helperEffect.GprReadMask & (1u << gpr)) != 0) AddRegister(GprRegisterName(gpr));
+                            if ((helperEffect.GprWriteMask & (1u << gpr)) != 0) AddRegister(GprRegisterName(gpr), written: true);
+                        }
+                        for (var fpr = 0; fpr < 32; ++fpr)
+                        {
+                            if ((helperEffect.FprReadMask & (1u << fpr)) != 0) AddRegister(FprRegisterName(fpr));
+                            if ((helperEffect.FprWriteMask & (1u << fpr)) != 0) AddRegister(FprRegisterName(fpr), written: true);
+                        }
+                        break;
+
+                    case IrIndirectCall indirectCall:
+                        AddRegister(indirectCall.Destination, written: true);
+                        AddValue(indirectCall.Target);
+                        foreach (var argument in indirectCall.Arguments)
+                        {
+                            AddValue(argument);
+                        }
+
+                        break;
+
+                    case IrIndirectJump indirectJump:
+                        AddValue(indirectJump.Target);
+                        break;
+
+                    case IrPhi phi:
+                        AddRegister(phi.Destination, written: true);
+                        foreach (var source in phi.Sources.Values)
+                        {
+                            AddRegister(source);
+                        }
+                        break;
+
+                    case IrReturn ret:
+                        if (ret.Value is { } value)
+                        {
+                            AddValue(value);
+                        }
+                        break;
+
+                    case IrBranch branch when IsCpuRegister(branch.ConditionRegister):
+                        AddRegister(branch.ConditionRegister);
+                        break;
+
+                    case IrJumpTable table:
+                        AddRegister(table.Selector);
+                        break;
+
+                    case IrSetCrField setCr:
+                        AddValue(setCr.Left);
+                        AddValue(setCr.Right);
+                        break;
+                }
+            }
+        }
+
+        return new LeafRegisterCache(gprs, fprs, writtenGprs, writtenFprs);
+
+        void AddInlineGuestThunkWrites(IrCall call)
+        {
+            if (!TryParseAddress(call.Target, out var address) ||
+                !TryGetInlineGuestThunkSpec(address, out var spec))
+            {
+                return;
+            }
+
+            switch (spec.Kind)
+            {
+                case InlineGuestThunkKind.RestGpr:
+                    for (var reg = spec.StartRegister; reg <= 31; reg++)
+                    {
+                        AddRegister(GprRegisterName(reg), written: true);
+                    }
+                    break;
+
+                case InlineGuestThunkKind.RestFpr:
+                    for (var reg = spec.StartRegister; reg <= 31; reg++)
+                    {
+                        AddRegister(FprRegisterName(reg), written: true);
+                    }
+                    break;
+            }
+        }
+
+        void AddInlineGuestThunkReads(IrCall call)
+        {
+            if (!TryParseAddress(call.Target, out var address) ||
+                !TryGetInlineGuestThunkSpec(address, out var spec))
+            {
+                return;
+            }
+
+            switch (spec.Kind)
+            {
+                case InlineGuestThunkKind.SaveGpr:
+                    for (var reg = spec.StartRegister; reg <= 31; reg++)
+                    {
+                        AddRegister(GprRegisterName(reg));
+                    }
+                    break;
+
+                case InlineGuestThunkKind.SaveFpr:
+                    for (var reg = spec.StartRegister; reg <= 31; reg++)
+                    {
+                        AddRegister(FprRegisterName(reg));
+                    }
+                    break;
+            }
+        }
+    }
+
+    private static LeafRegisterCacheInitializers BuildLeafRegisterCacheInitializers(
+        IrFunction func,
+        IrCfg cfg,
+        LeafRegisterCache registers,
+        IGuestFunctionAbiProvider guestAbiProvider,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts = null)
+    {
+        if (registers.IsEmpty)
+        {
+            return LeafRegisterCacheInitializers.Empty;
+        }
+
+        var liveness = ComputeRegisterLiveness(func, cfg, registers, guestAbiProvider, guestAbiContracts);
+        if (!liveness.In.TryGetValue(func.EntryLabel, out var entryLive))
+        {
+            return LeafRegisterCacheInitializers.Empty;
+        }
+
+        var gprs = new SortedSet<int>(registers.Gprs
+            .Where(gpr => entryLive.Contains(GprRegisterName(gpr))));
+        var fprs = new SortedSet<int>(registers.Fprs
+            .Where(fpr => entryLive.Contains(FprRegisterName(fpr))));
+        return new LeafRegisterCacheInitializers(gprs, fprs);
+    }
+
+    private static RegisterLiveness ComputeRegisterLiveness(
+        IrFunction func,
+        IrCfg cfg,
+        LeafRegisterCache registers,
+        IGuestFunctionAbiProvider guestAbiProvider,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts = null)
+    {
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var liveIn = func.Blocks.ToDictionary(
+            static block => block.Label,
+            _ => new HashSet<string>(comparer),
+            comparer);
+
+        // Materialized once: Enumerable.Reverse buffers the whole block list on
+        // every enumeration, and this loop enumerates it per fixpoint iteration.
+        var reversedBlocks = func.Blocks.Reverse().ToArray();
+        // Scratch sets, so a converged iteration (the common case, and always
+        // the last one) allocates nothing at all. A set is only copied into the
+        // result maps when it actually differs from the recorded state.
+        var newOut = new HashSet<string>(comparer);
+        var newIn = new HashSet<string>(comparer);
+
+        var changed = true;
+        while (changed)
+        {
+            changed = false;
+
+            foreach (var block in reversedBlocks)
+            {
+                newOut.Clear();
+                foreach (var successor in cfg.Successors(block.Label))
+                {
+                    if (liveIn.TryGetValue(successor, out var successorLiveIn))
+                    {
+                        newOut.UnionWith(successorLiveIn);
+                    }
+                }
+
+                newIn.Clear();
+                newIn.UnionWith(newOut);
+                for (var i = block.Instructions.Count - 1; i >= 0; i--)
+                {
+                    ApplyLivenessTransfer(block.Instructions[i], newIn, registers, guestAbiProvider, guestAbiContracts);
+                }
+
+                if (!newIn.SetEquals(liveIn[block.Label]))
+                {
+                    liveIn[block.Label] = new HashSet<string>(newIn, comparer);
+                    changed = true;
+                }
+            }
+        }
+
+        return new RegisterLiveness(liveIn);
+    }
+
+    private static void ApplyLivenessTransfer(
+        IrInstruction instruction,
+        HashSet<string> live,
+        LeafRegisterCache registers,
+        IGuestFunctionAbiProvider guestAbiProvider,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts)
+    {
+        if (instruction is IrPhi phi)
+        {
+            // Phi operands are edge uses only when the phi result is live.
+            // Treating every source as unconditional kept dead architectural
+            // FPRs live around loops and forced representation conversions.
+            var destination = NormalizeLivenessRegisterName(phi.Destination);
+            if (live.Remove(destination))
+            {
+                foreach (var source in phi.Sources.Values)
+                    live.Add(NormalizeLivenessRegisterName(source));
+            }
+            return;
+        }
+
+        foreach (var def in InstructionRegisterDefsForLiveness(instruction, guestAbiProvider, guestAbiContracts))
+        {
+            live.Remove(def);
+        }
+
+        foreach (var use in InstructionRegisterUsesForLiveness(instruction, registers, guestAbiContracts))
+        {
+            live.Add(use);
+        }
+    }
+
+    private static IEnumerable<string> InstructionRegisterUsesForLiveness(
+        IrInstruction instruction,
+        LeafRegisterCache registers,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts)
+    {
+        static IEnumerable<IrValue> Values(params IrValue[] values) => values;
+
+        IEnumerable<string> ReturnFlushUses()
+        {
+            foreach (var gpr in registers.WrittenGprs)
+            {
+                yield return GprRegisterName(gpr);
+            }
+
+            foreach (var fpr in registers.WrittenFprs)
+            {
+                yield return FprRegisterName(fpr);
+            }
+        }
+
+        switch (instruction)
+        {
+            case IrAssign assign:
+                foreach (var use in RegisterUsesFromValues(Values(assign.Value)))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrBinary binary:
+                foreach (var use in RegisterUsesFromValues(Values(binary.Left, binary.Right)))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrLoad load:
+                yield return NormalizeLivenessRegisterName(load.Address.Base);
+                break;
+
+            case IrStore store:
+                yield return NormalizeLivenessRegisterName(store.Address.Base);
+                foreach (var use in RegisterUsesFromValues(Values(store.Source)))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrResolveGuestMemoryRange resolve:
+                foreach (var use in RegisterUsesFromValues(Values(resolve.Base)))
+                    yield return use;
+                break;
+
+            case IrResolvedLoad load:
+                yield return NormalizeLivenessRegisterName(load.OriginalAddress.Base);
+                break;
+
+            case IrResolvedStore store:
+                yield return NormalizeLivenessRegisterName(store.OriginalAddress.Base);
+                foreach (var use in RegisterUsesFromValues(Values(store.Source)))
+                    yield return use;
+                break;
+
+            case IrCall call:
+                foreach (var use in InlineGuestThunkRegisterUses(call))
+                {
+                    yield return use;
+                }
+
+                foreach (var use in RegisterUsesFromValues(call.Arguments))
+                {
+                    yield return use;
+                }
+
+                if (IsGuestCallTarget(call.Target))
+                {
+                    var (readMask, _) = GuestCallGprEffects(call, guestAbiContracts);
+                    for (var gpr = 0; gpr < 32; ++gpr)
+                        if ((readMask & (1u << gpr)) != 0) yield return GprRegisterName(gpr);
+                    var (fprReadMask, _) = GuestCallFprEffects(call, guestAbiContracts);
+                    for (var fpr = 0; fpr < 32; ++fpr)
+                        if ((fprReadMask & (1u << fpr)) != 0) yield return FprRegisterName(fpr);
+                }
+                else if (!TryParseAddress(call.Target, out _))
+                {
+                    var helperEffect = AnalyzeGuestHelperEffect(call);
+                    for (var gpr = 0; gpr < 32; ++gpr)
+                        if ((helperEffect.GprReadMask & (1u << gpr)) != 0) yield return GprRegisterName(gpr);
+                }
+
+                break;
+
+            case IrIndirectCall indirectCall:
+                foreach (var use in RegisterUsesFromValues(Values(indirectCall.Target)) )
+                {
+                    yield return use;
+                }
+
+                foreach (var use in RegisterUsesFromValues(indirectCall.Arguments))
+                {
+                    yield return use;
+                }
+
+                break;
+
+            case IrIndirectJump indirectJump:
+                foreach (var use in RegisterUsesFromValues(Values(indirectJump.Target)))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrPhi phi:
+                foreach (var source in phi.Sources.Values)
+                {
+                    yield return NormalizeLivenessRegisterName(source);
+                }
+                break;
+
+            case IrResolvedPsqStore store:
+                foreach (var use in RegisterUsesFromValues(Values(store.OriginalAddress, store.Source)))
+                    yield return use;
+                break;
+
+            case IrResolvedPsqLoad load:
+                foreach (var use in RegisterUsesFromValues(Values(load.OriginalAddress)))
+                    yield return use;
+                break;
+
+
+            case IrResolvedLoadPair pair:
+                yield return NormalizeLivenessRegisterName(pair.FirstOriginalAddress.Base);
+                yield return NormalizeLivenessRegisterName(pair.SecondOriginalAddress.Base);
+                break;
+
+            case IrResolvedStorePair pair:
+                yield return NormalizeLivenessRegisterName(pair.FirstOriginalAddress.Base);
+                yield return NormalizeLivenessRegisterName(pair.SecondOriginalAddress.Base);
+                foreach (var use in RegisterUsesFromValues(Values(pair.FirstSource, pair.SecondSource)))
+                    yield return use;
+                break;
+
+            case IrReturn ret:
+                if (ret.Value is { } value)
+                {
+                    foreach (var use in RegisterUsesFromValues(Values(value)))
+                    {
+                        yield return use;
+                    }
+                }
+
+                foreach (var use in ReturnFlushUses())
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrBranch branch:
+                if (IsCpuRegister(branch.ConditionRegister))
+                {
+                    yield return NormalizeLivenessRegisterName(branch.ConditionRegister);
+                }
+                break;
+
+            case IrJumpTable table:
+                if (!string.IsNullOrWhiteSpace(table.Selector))
+                {
+                    yield return NormalizeLivenessRegisterName(table.Selector);
+                }
+                break;
+
+            case IrSetCrField setCr:
+                foreach (var use in RegisterUsesFromValues(Values(setCr.Left, setCr.Right)))
+                {
+                    yield return use;
+                }
+                break;
+        }
+    }
+
+    private static IEnumerable<string> InstructionRegisterDefsForLiveness(
+        IrInstruction instruction,
+        IGuestFunctionAbiProvider guestAbiProvider,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts)
+    {
+        switch (instruction)
+        {
+            case IrAssign assign:
+                yield return NormalizeLivenessRegisterName(assign.Destination);
+                break;
+
+            case IrBinary binary:
+                yield return NormalizeLivenessRegisterName(binary.Destination);
+                break;
+
+            case IrLoad load:
+                yield return NormalizeLivenessRegisterName(load.Destination);
+                break;
+
+            case IrResolveGuestMemoryRange resolve:
+                yield return NormalizeLivenessRegisterName(resolve.Destination);
+                break;
+
+            case IrResolvedLoad load:
+                yield return NormalizeLivenessRegisterName(load.Destination);
+                break;
+
+            case IrCall call:
+                if (!string.IsNullOrWhiteSpace(call.Destination))
+                {
+                    yield return NormalizeLivenessRegisterName(call.Destination);
+                }
+
+                foreach (var def in InlineGuestThunkRegisterDefs(call))
+                {
+                    yield return def;
+                }
+
+                if (IsGuestCallTarget(call.Target))
+                {
+                    var (_, writeMask) = GuestCallGprEffects(call, guestAbiContracts);
+                    for (var gpr = 0; gpr < 32; ++gpr)
+                        if ((writeMask & (1u << gpr)) != 0) yield return GprRegisterName(gpr);
+                    var (_, fprWriteMask) = GuestCallFprEffects(call, guestAbiContracts);
+                    for (var fpr = 0; fpr < 32; ++fpr)
+                        if ((fprWriteMask & (1u << fpr)) != 0) yield return FprRegisterName(fpr);
+                }
+                else if (!TryParseAddress(call.Target, out _))
+                {
+                    var helperEffect = AnalyzeGuestHelperEffect(call);
+                    for (var gpr = 0; gpr < 32; ++gpr)
+                        if ((helperEffect.GprWriteMask & (1u << gpr)) != 0) yield return GprRegisterName(gpr);
+                }
+
+                break;
+
+            case IrIndirectCall indirectCall:
+                if (!string.IsNullOrWhiteSpace(indirectCall.Destination))
+                {
+                    yield return NormalizeLivenessRegisterName(indirectCall.Destination);
+                }
+                break;
+
+            case IrPhi phi:
+                yield return NormalizeLivenessRegisterName(phi.Destination);
+                break;
+
+            case IrResolvedPsqLoad load:
+                yield return NormalizeLivenessRegisterName(load.Destination);
+                break;
+            case IrResolvedLoadPair pair:
+                yield return NormalizeLivenessRegisterName(pair.FirstDestination);
+                yield return NormalizeLivenessRegisterName(pair.SecondDestination);
+                break;
+        }
+    }
+
+    private static IEnumerable<string> RegisterUsesFromValues(IEnumerable<IrValue> values)
+    {
+        foreach (var value in values)
+        {
+            if (value.Kind == "register" && !string.IsNullOrWhiteSpace(value.RegisterName))
+            {
+                yield return NormalizeLivenessRegisterName(value.RegisterName);
+            }
+        }
+    }
+
+    private static (uint ReadMask, uint WriteMask) GuestCallGprEffects(
+        IrCall call,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts)
+    {
+        if (TryParseAddress(call.Target, out var address) &&
+            TryGetInlineGuestThunkSpec(address, out _))
+            return (0, 0);
+
+        if (TryParseAddress(call.Target, out address) &&
+            guestAbiContracts is not null &&
+            guestAbiContracts.TryGetValue(address, out var contract) &&
+            !contract.HasFullSynchronizationFence)
+            return (contract.GprReadBeforeWriteMask, contract.GprPossibleWriteMask);
+
+        // Unknown, indirect-capable, native, or full-context guest boundaries
+        // observe and may change the complete architectural GPR file.
+        return (uint.MaxValue, uint.MaxValue);
+    }
+
+    private static (uint ReadMask, uint WriteMask) GuestCallFprEffects(
+        IrCall call,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts)
+    {
+        if (TryParseAddress(call.Target, out var address) &&
+            TryGetInlineGuestThunkSpec(address, out _))
+            return (0, 0);
+
+        if (TryParseAddress(call.Target, out address) &&
+            guestAbiContracts is not null &&
+            guestAbiContracts.TryGetValue(address, out var contract) &&
+            !contract.HasFullSynchronizationFence)
+            return (contract.FprReadBeforeWriteMask, contract.FprPossibleWriteMask);
+
+        return (uint.MaxValue, uint.MaxValue);
+    }
+
+    private static IEnumerable<string> InlineGuestThunkRegisterDefs(IrCall call)
+    {
+        if (!TryParseAddress(call.Target, out var address) ||
+            !TryGetInlineGuestThunkSpec(address, out var spec))
+        {
+            yield break;
+        }
+
+        switch (spec.Kind)
+        {
+            case InlineGuestThunkKind.RestGpr:
+                for (var reg = spec.StartRegister; reg <= 31; reg++)
+                {
+                    yield return GprRegisterName(reg);
+                }
+                break;
+
+            case InlineGuestThunkKind.RestFpr:
+                for (var reg = spec.StartRegister; reg <= 31; reg++)
+                {
+                    yield return FprRegisterName(reg);
+                }
+                break;
+        }
+    }
+
+    private static IEnumerable<string> InlineGuestThunkRegisterUses(IrCall call)
+    {
+        if (!TryParseAddress(call.Target, out var address) ||
+            !TryGetInlineGuestThunkSpec(address, out var spec))
+        {
+            yield break;
+        }
+
+        switch (spec.Kind)
+        {
+            case InlineGuestThunkKind.SaveGpr:
+                for (var reg = spec.StartRegister; reg <= 31; reg++)
+                {
+                    yield return GprRegisterName(reg);
+                }
+                break;
+
+            case InlineGuestThunkKind.SaveFpr:
+                for (var reg = spec.StartRegister; reg <= 31; reg++)
+                {
+                    yield return FprRegisterName(reg);
+                }
+                break;
+        }
+    }
+
+    private static string ApplyLeafRegisterCache(
+        string code,
+        string cxxName,
+        LeafRegisterCache registers,
+        LeafRegisterCacheInitializers initializers)
+    {
+        var cacheCr = false;
+        var cacheXer = false;
+        var cacheCtr = false;
+        var writeCr = false;
+        var writeXer = false;
+        var writeCtr = false;
+        if (registers.CacheSpecialRegisters)
+        {
+            // GetCRBit(ctx, field, bit) is raw C++ text, not a register operand, so it must be
+            // listed explicitly: a body that only reads CR through it still needs cached_cr to
+            // exist, and one that also writes CR must not leave that read on stale ctx->cr.
+            cacheCr = code.Contains("cached_cr", StringComparison.Ordinal) ||
+                      code.Contains("ctx->cr", StringComparison.Ordinal) ||
+                      code.Contains("SetCR(ctx,", StringComparison.Ordinal) ||
+                      code.Contains("SetCRFloat(ctx,", StringComparison.Ordinal) ||
+                      code.Contains("GetCRBit(ctx,", StringComparison.Ordinal);
+            cacheXer = code.Contains("cached_xer", StringComparison.Ordinal) ||
+                       code.Contains("ctx->xer", StringComparison.Ordinal) ||
+                       code.Contains("SetCR(ctx,", StringComparison.Ordinal);
+            cacheCtr = code.Contains("cached_ctr", StringComparison.Ordinal) ||
+                       code.Contains("ctx->ctr", StringComparison.Ordinal);
+            writeCr = code.Contains("SetCR(ctx,", StringComparison.Ordinal) ||
+                      code.Contains("SetCRFloat(ctx,", StringComparison.Ordinal) ||
+                      code.Contains("ctx->cr =", StringComparison.Ordinal) ||
+                      code.Contains("ctx->cr |=", StringComparison.Ordinal) ||
+                      code.Contains("ctx->cr &=", StringComparison.Ordinal) ||
+                      code.Contains("ctx->cr ^=", StringComparison.Ordinal);
+            writeXer = code.Contains("ctx->xer =", StringComparison.Ordinal) ||
+                       code.Contains("ctx->xer |=", StringComparison.Ordinal) ||
+                       code.Contains("ctx->xer &=", StringComparison.Ordinal) ||
+                       code.Contains("ctx->xer ^=", StringComparison.Ordinal);
+            writeCtr = code.Contains("ctx->ctr =", StringComparison.Ordinal) ||
+                       code.Contains("ctx->ctr +=", StringComparison.Ordinal) ||
+                       code.Contains("ctx->ctr -=", StringComparison.Ordinal) ||
+                       code.Contains("ctx->ctr |=", StringComparison.Ordinal) ||
+                       code.Contains("ctx->ctr &=", StringComparison.Ordinal) ||
+                       code.Contains("ctx->ctr ^=", StringComparison.Ordinal);
+            if (cacheCr && cacheXer)
+                code = code.Replace("SetCR(ctx,", "SetCRResident(cached_cr, cached_xer,", StringComparison.Ordinal);
+            if (cacheCr)
+            {
+                code = code.Replace("SetCRFloat(ctx,", "SetCRFloatResident(cached_cr,", StringComparison.Ordinal);
+                code = code.Replace("GetCRBit(ctx,", "GetCRBitResident(cached_cr,", StringComparison.Ordinal);
+                code = code.Replace("ctx->cr", "cached_cr", StringComparison.Ordinal);
+            }
+            if (cacheXer)
+                code = code.Replace("ctx->xer", "cached_xer", StringComparison.Ordinal);
+            if (cacheCtr)
+                code = code.Replace("ctx->ctr", "cached_ctr", StringComparison.Ordinal);
+        }
+        foreach (var gpr in registers.Gprs)
+        {
+            code = code.Replace($"ctx->gpr[{gpr}]", $"cached_r{gpr}", StringComparison.Ordinal);
+        }
+
+        foreach (var fpr in registers.Fprs)
+        {
+            code = code.Replace($"ctx->fpr[{fpr}]", $"cached_f{fpr}", StringComparison.Ordinal);
+        }
+
+        registers = PruneUnusedRegisterCache(code, registers);
+        if (registers.IsEmpty && !cacheCr && !cacheXer && !cacheCtr)
+        {
+            return code;
+        }
+
+        var declarationsBuilder = new StringBuilder(
+            BuildLeafRegisterCacheDeclarations(registers, initializers));
+        if (cacheCr) declarationsBuilder.AppendLine("    uint32_t cached_cr = ctx->cr;");
+        if (cacheXer) declarationsBuilder.AppendLine("    uint32_t cached_xer = ctx->xer;");
+        if (cacheCtr) declarationsBuilder.AppendLine("    uint32_t cached_ctr = ctx->ctr;");
+        if (cacheCr || cacheXer || cacheCtr) declarationsBuilder.AppendLine();
+        var declarations = declarationsBuilder.ToString();
+        var returnFlushBuilder = new StringBuilder(BuildLeafRegisterCacheFlush(registers));
+        if (writeCr) returnFlushBuilder.AppendLine("    ctx->cr = cached_cr;");
+        if (writeXer) returnFlushBuilder.AppendLine("    ctx->xer = cached_xer;");
+        if (writeCtr) returnFlushBuilder.AppendLine("    ctx->ctr = cached_ctr;");
+        var returnFlush = returnFlushBuilder.ToString();
+        var hasFlushes = registers.HasFlushes || writeCr || writeXer || writeCtr;
+        var lines = code.Replace("\r\n", "\n", StringComparison.Ordinal).Split('\n');
+        var rewritten = new StringBuilder(code.Length + declarations.Length + (returnFlush.Length * 4));
+        var functionDecl = FunctionDefinitionSignature(cxxName);
+        var pendingFunctionOpen = false;
+        var inFunction = false;
+        var braceDepth = 0;
+
+        foreach (var line in lines)
+        {
+            if (!inFunction && string.Equals(line, functionDecl, StringComparison.Ordinal))
+            {
+                pendingFunctionOpen = true;
+            }
+
+            if (pendingFunctionOpen && string.Equals(line, "{", StringComparison.Ordinal))
+            {
+                rewritten.AppendLine(line);
+                rewritten.Append(declarations);
+                pendingFunctionOpen = false;
+                inFunction = true;
+                braceDepth = 1;
+                continue;
+            }
+
+            if (inFunction && hasFlushes && line.Trim().Equals("return;", StringComparison.Ordinal))
+            {
+                rewritten.Append(returnFlush);
+            }
+
+            rewritten.AppendLine(line);
+
+            if (inFunction)
+            {
+                braceDepth += CountChar(line, '{') - CountChar(line, '}');
+                if (braceDepth <= 0)
+                {
+                    inFunction = false;
+                }
+            }
+        }
+
+        return rewritten.ToString();
+    }
+
+    private static LeafRegisterCache PruneUnusedRegisterCache(string code, LeafRegisterCache registers)
+    {
+        var gprs = new SortedSet<int>(registers.Gprs
+            .Where(gpr => ContainsIdentifier(code, $"cached_r{gpr}")));
+        var fprs = new SortedSet<int>(registers.Fprs
+            .Where(fpr => ContainsIdentifier(code, $"cached_f{fpr}")));
+        var writtenGprs = new SortedSet<int>(registers.WrittenGprs
+            .Where(gprs.Contains));
+        var writtenFprs = new SortedSet<int>(registers.WrittenFprs
+            .Where(fprs.Contains));
+
+        return new LeafRegisterCache(
+            gprs, fprs, writtenGprs, writtenFprs, registers.CacheSpecialRegisters);
+    }
+
+    /// <summary>
+    /// Whole-identifier match, not substring: a plain Contains would treat cached_r1 as live
+    /// because cached_r10 appears in the body, leaving an unassigned slot that flushes
+    /// ctx->gpr[1] = cached_r1 = 0, zeroing a live architectural register.
+    /// </summary>
+    private static bool ContainsIdentifier(string code, string identifier)
+    {
+        var index = 0;
+        while (true)
+        {
+            index = code.IndexOf(identifier, index, StringComparison.Ordinal);
+            if (index < 0) return false;
+            var end = index + identifier.Length;
+            if (end >= code.Length || !IsIdentifierCharacter(code[end])) return true;
+            index = end;
+        }
+    }
+
+    private static bool IsIdentifierCharacter(char value) =>
+        value == '_' || char.IsLetterOrDigit(value);
+
+    private static string BuildLeafRegisterCacheDeclarations(
+        LeafRegisterCache registers,
+        LeafRegisterCacheInitializers initializers)
+    {
+        var sb = new StringBuilder();
+        foreach (var gpr in registers.Gprs)
+        {
+            var initializer = initializers.Gprs.Contains(gpr)
+                ? $"ctx->gpr[{gpr}]"
+                : "0";
+            sb.AppendLine($"    uint32_t cached_r{gpr} = {initializer};");
+        }
+
+        foreach (var fpr in registers.Fprs)
+        {
+            var initializer = initializers.Fprs.Contains(fpr)
+                ? $"ctx->fpr[{fpr}]"
+                : "PPC_FPR{}";
+            sb.AppendLine($"    PPC_FPR cached_f{fpr} = {initializer};");
+        }
+
+        if (!registers.IsEmpty)
+        {
+            sb.AppendLine();
+        }
+
+        return sb.ToString();
+    }
+
+    private static string BuildLeafRegisterCacheFlush(LeafRegisterCache registers)
+    {
+        var sb = new StringBuilder();
+        foreach (var gpr in registers.WrittenGprs)
+        {
+            sb.AppendLine($"    ctx->gpr[{gpr}] = cached_r{gpr};");
+        }
+
+        foreach (var fpr in registers.WrittenFprs)
+        {
+            sb.AppendLine($"    ctx->fpr[{fpr}] = cached_f{fpr};");
+        }
+
+        return sb.ToString();
+    }
+
+    private static string NormalizeLivenessRegisterName(string registerName) => GetRegisterBaseName(registerName);
+
+    private static int CountChar(string text, char value)
+    {
+        var count = 0;
+        foreach (var ch in text)
+        {
+            if (ch == value)
+            {
+                count++;
+            }
+        }
+
+        return count;
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Locals.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Locals.cs
new file mode 100644
index 0000000..6aac3df
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Locals.cs
@@ -0,0 +1,520 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Translation;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    internal const int MinimumGuardedGqrVersioningSites = 3;
+
+    private readonly record struct GqrEntryGuard(uint Index, uint Value);
+
+    private static string GqrEntryGuardName(uint index, uint value) =>
+        $"gqr_entry_{index}_{value:X8}";
+
+    private static IReadOnlyList<GqrEntryGuard> CollectGqrEntryGuards(IrFunction function)
+    {
+        var guards = new HashSet<GqrEntryGuard>();
+        foreach (var instruction in function.Blocks.SelectMany(static block => block.Instructions))
+        {
+            switch (instruction)
+            {
+                case IrResolvedPsqLoad load when load.GuardKnownGqr && load.KnownGqr.HasValue:
+                    guards.Add(new GqrEntryGuard(load.I, load.KnownGqr.Value));
+                    break;
+                case IrResolvedPsqStore store when store.GuardKnownGqr && store.KnownGqr.HasValue:
+                    guards.Add(new GqrEntryGuard(store.I, store.KnownGqr.Value));
+                    break;
+                case IrCall call when TryGetGuardedGqr(call, out var guard):
+                    guards.Add(guard);
+                    break;
+            }
+        }
+        return guards.OrderBy(static guard => guard.Index).ThenBy(static guard => guard.Value).ToArray();
+    }
+
+    private static bool TryGetGuardedGqr(IrCall call, out GqrEntryGuard guard)
+    {
+        guard = default;
+        const string loadPrefix = "PPC_PsqLKnownGuarded_";
+        const string storePrefix = "PPC_PsqStKnownGuarded_";
+        var isLoad = call.Target.StartsWith(loadPrefix, StringComparison.OrdinalIgnoreCase);
+        var prefix = isLoad ? loadPrefix : call.Target.StartsWith(storePrefix, StringComparison.OrdinalIgnoreCase)
+            ? storePrefix : null;
+        var indexArgument = isLoad ? 2 : 3;
+        var index = call.Arguments.Count > indexArgument
+            ? call.Arguments[indexArgument].Constant : null;
+        if (prefix is null || call.Arguments.Count <= indexArgument ||
+            index is not (>= 0 and < 8) ||
+            !uint.TryParse(call.Target.AsSpan(prefix.Length), System.Globalization.NumberStyles.HexNumber,
+                System.Globalization.CultureInfo.InvariantCulture, out var value))
+            return false;
+        guard = new GqrEntryGuard((uint)index.Value, value);
+        return true;
+    }
+
+    private static bool CanVersionGuardedGqrFunction(
+        IrFunction function,
+        IReadOnlyList<GqrEntryGuard> guards)
+    {
+        // Versioning trades cold code size for a branch-free hot body, so it only pays off with enough
+        // repeated PSQ work to amortize the second instantiation. Three sites already outweighs that
+        // cost; a higher threshold missed matrix helpers like PSMTXMultVec/PSMTXConcat that dominate
+        // the paired-single profile but only clear it after inlining.
+        if (guards.Count == 0 ||
+            guards.GroupBy(static guard => guard.Index).Any(static group => group.Count() != 1))
+        {
+            return false;
+        }
+
+        var guardedIndices = guards.Select(static guard => guard.Index).ToHashSet();
+        var guardedSites = 0;
+        foreach (var instruction in function.Blocks.SelectMany(static block => block.Instructions))
+        {
+            switch (instruction)
+            {
+                case IrAssign assign when GqrConstantPropagation.TryGetGqrKey(assign.Destination) is { } key &&
+                                          guardedIndices.Contains((uint)(key[3] - '0')):
+                    return false;
+                case IrResolvedPsqLoad load when load.GuardKnownGqr && load.KnownGqr.HasValue:
+                case IrResolvedPsqStore store when store.GuardKnownGqr && store.KnownGqr.HasValue:
+                    guardedSites++;
+                    break;
+                case IrCall call when TryGetGuardedGqr(call, out _):
+                    guardedSites++;
+                    break;
+            }
+        }
+
+        return guardedSites >= MinimumGuardedGqrVersioningSites;
+    }
+
+    private static string ApplyGuardedGqrFunctionVersioning(
+        string code,
+        string functionName,
+        IReadOnlyList<GqrEntryGuard> guards)
+    {
+        const string parameters = CpuContextDefinitionParameter;
+        const string callArguments = "ctx";
+        // Match the unqualified definition emitted before leaf-cache rewriting.
+        // The inline qualifier belongs on the rewritten definition below; if
+        // it is present here the cache pass cannot find the function opening.
+        var functionDecl = FunctionDefinitionSignature(functionName);
+        var implementationName = $"{functionName}_gqr_impl";
+        var lines = code.Replace("\r\n", "\n", StringComparison.Ordinal).Split('\n');
+        var rewritten = new StringBuilder(code.Length * 2);
+        var pendingFunctionOpen = false;
+        var inFunction = false;
+        var braceDepth = 0;
+
+        foreach (var originalLine in lines)
+        {
+            var line = originalLine;
+            if (!inFunction && string.Equals(line, functionDecl, StringComparison.Ordinal))
+            {
+                rewritten.AppendLine("template <bool gqr_entry_profile>");
+                rewritten.AppendLine($"MKW_PPC_NO_INLINE static void {implementationName}({parameters})");
+                pendingFunctionOpen = true;
+                continue;
+            }
+
+            if (pendingFunctionOpen && string.Equals(line, "{", StringComparison.Ordinal))
+            {
+                rewritten.AppendLine(line);
+                pendingFunctionOpen = false;
+                inFunction = true;
+                braceDepth = 1;
+                continue;
+            }
+
+            if (inFunction)
+            {
+                if (guards.Any(guard => line.Contains(
+                        $"const bool {GqrEntryGuardName(guard.Index, guard.Value)} =",
+                        StringComparison.Ordinal)))
+                {
+                    continue;
+                }
+
+                foreach (var guard in guards)
+                {
+                    line = line.Replace(
+                        GqrEntryGuardName(guard.Index, guard.Value),
+                        "gqr_entry_profile",
+                        StringComparison.Ordinal);
+                }
+                line = line.Replace(
+                    "if (gqr_entry_profile)",
+                    "if constexpr (gqr_entry_profile)",
+                    StringComparison.Ordinal);
+            }
+
+            rewritten.AppendLine(line);
+
+            if (!inFunction)
+            {
+                continue;
+            }
+
+            braceDepth += CountChar(line, '{') - CountChar(line, '}');
+            if (braceDepth > 0)
+            {
+                continue;
+            }
+
+            inFunction = false;
+            var condition = string.Join(" && ", guards.Select(static guard =>
+                $"ctx->gqr[{guard.Index}u] == 0x{guard.Value:X8}u"));
+            rewritten.AppendLine();
+            rewritten.AppendLine(FunctionDefinitionSignature(functionName));
+            rewritten.AppendLine("{");
+            rewritten.AppendLine($"    if ({condition})");
+            rewritten.AppendLine($"        {implementationName}<true>({callArguments});");
+            rewritten.AppendLine("    else");
+            rewritten.AppendLine($"        {implementationName}<false>({callArguments});");
+            rewritten.AppendLine("}");
+        }
+
+        return rewritten.ToString();
+    }
+
+    private sealed record PairedFlowStateMaps(
+        Dictionary<string, HashSet<string>> In,
+        Dictionary<string, HashSet<string>> Out);
+
+    private static HashSet<string> CollectNonRegisterLocals(IrFunction function)
+    {
+        var locals = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        void Add(string name)
+        {
+            // Only add if it's NOT a CPU register that uses direct ctx access.
+            // CR fields need local variables because direct CR field writes are complex.
+            if (!IsCpuRegisterNoLocalNeeded(name))
+            {
+                locals.Add(name);
+            }
+        }
+
+        foreach (var block in function.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                // Range destinations are host pointers declared separately in
+                // the function prologue. IrSetCrField writes CR through a
+                // helper and has no C++ destination expression. Everything
+                // else follows the canonical syntactic IR use/def walker.
+                if (instruction is not (IrResolveGuestMemoryRange or IrSetCrField))
+                {
+                    foreach (var definition in IrRegisterDataFlow.Definitions(instruction))
+                    {
+                        Add(definition);
+                    }
+                }
+
+                foreach (var use in IrRegisterDataFlow.Uses(instruction))
+                {
+                    Add(use);
+                }
+            }
+        }
+
+        return locals;
+    }
+
+    private static IEnumerable<string> CollectCallTargets(IrFunction function)
+    {
+        foreach (var block in function.Blocks)
+        {
+            foreach (var ins in block.Instructions)
+            {
+                switch (ins)
+                {
+                    case IrCall call when !string.IsNullOrWhiteSpace(call.Target):
+                        yield return call.Target;
+                        break;
+                }
+            }
+        }
+    }
+
+    /// <summary>
+    /// Bit position of a float register in a paired-state mask, or -1 if not a float register.
+    /// </summary>
+    private static int PairedFloatRegisterBit(string baseName) =>
+        ClassifyRegisterBase(RegisterBaseSpan(baseName), out var index) == GuestRegisterClass.Fpr
+            ? index
+            : -1;
+
+    private static HashSet<string> MaterializePairedFloatSet(uint mask, StringComparer comparer)
+    {
+        var set = new HashSet<string>(comparer);
+        for (var bit = 0; bit < 32; bit++)
+        {
+            if ((mask & (1u << bit)) != 0)
+            {
+                set.Add(FprRegisterName(bit));
+            }
+        }
+
+        return set;
+    }
+
+    private static PairedFlowStateMaps ComputePairedFlowStates(
+        IrFunction func,
+        IrCfg cfg,
+        IGuestFunctionAbiProvider guestAbiProvider)
+    {
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        // f0..f31 occupy bits 0..31. The fixpoint used to seed a fresh
+        // HashSet<string> holding all 32 register names for every block and to
+        // rebuild two more sets per block per iteration; the mask form has the
+        // same lattice, the same initial state and the same transfer.
+        const uint allFloatRegisters = uint.MaxValue;
+        const uint f1Bit = 1u << 1;
+        var blocks = func.Blocks;
+        var blockCount = blocks.Count;
+        var blockIndices = new Dictionary<string, int>(blockCount, comparer);
+        for (var i = 0; i < blockCount; i++)
+        {
+            blockIndices[blocks[i].Label] = i;
+        }
+
+        var isEntryBlock = new bool[blockCount];
+        var inMasks = new uint[blockCount];
+        var outMasks = new uint[blockCount];
+        // This is a forward must-analysis: non-entry blocks start at top so loop latches
+        // can converge on paired registers that are preserved through the cycle.
+        for (var i = 0; i < blockCount; i++)
+        {
+            isEntryBlock[i] = blocks[i].Label.Equals(func.EntryLabel, StringComparison.OrdinalIgnoreCase);
+            inMasks[i] = isEntryBlock[i] ? 0u : allFloatRegisters;
+            outMasks[i] = isEntryBlock[i] ? 0u : allFloatRegisters;
+        }
+
+        // The CFG is immutable for the whole fixpoint, so the filtered
+        // predecessor lists are built once instead of once per iteration.
+        var predecessors = new List<string>[blockCount];
+        for (var i = 0; i < blockCount; i++)
+        {
+            var label = blocks[i].Label;
+            predecessors[i] = cfg.Predecessors(label)
+                .Where(p => !p.Equals(label, StringComparison.OrdinalIgnoreCase))
+                .ToList();
+        }
+
+        var changed = true;
+        while (changed)
+        {
+            changed = false;
+            for (var b = 0; b < blockCount; b++)
+            {
+                var block = blocks[b];
+                var preds = predecessors[b];
+                uint newIn;
+                // A translated entry can have CFG backedges, but it also has an external
+                // predecessor whose live FPRs use the scalar CpuContext representation.
+                if (isEntryBlock[b] || preds.Count == 0)
+                {
+                    newIn = 0u;
+                }
+                else
+                {
+                    newIn = outMasks[blockIndices[preds[0]]];
+                    for (var p = 1; p < preds.Count; p++)
+                    {
+                        newIn &= outMasks[blockIndices[preds[p]]];
+                    }
+                }
+
+                var newOut = newIn;
+                foreach (var ins in block.Instructions)
+                {
+                    switch (ins)
+                    {
+                        case IrPhi phi:
+                            {
+                                var destBit = PairedFloatRegisterBit(phi.Destination);
+                                if (destBit < 0)
+                                {
+                                    break;
+                                }
+
+                                var allPaired = true;
+                                foreach (var (predLabel, src) in phi.Sources)
+                                {
+                                    var srcBit = PairedFloatRegisterBit(src);
+                                    if (srcBit < 0)
+                                    {
+                                        allPaired = false;
+                                        break;
+                                    }
+
+                                    if (!blockIndices.TryGetValue(predLabel, out var predIndex) ||
+                                        (outMasks[predIndex] & (1u << srcBit)) == 0)
+                                    {
+                                        allPaired = false;
+                                        break;
+                                    }
+                                }
+
+                                if (allPaired)
+                                {
+                                    newOut |= 1u << destBit;
+                                }
+                                else
+                                {
+                                    newOut &= ~(1u << destBit);
+                                }
+                                break;
+                            }
+                        case IrCall call:
+                            {
+                                if (IsGuestCallTarget(call.Target))
+                                {
+                                    // Normalize proven scalar arguments and treat f1 as the
+                                    // conventional scalar return. Preserve f2-f13 representation
+                                    // tags when the callee leaves their payloads untouched.
+                                    newOut = ClearPairedGuestScalarFloatArguments(
+                                        call.Target, call.Arguments, newOut, guestAbiProvider);
+                                    newOut &= ~f1Bit;
+                                }
+
+                                if (!string.IsNullOrWhiteSpace(call.Destination))
+                                {
+                                    var destBit = PairedFloatRegisterBit(call.Destination);
+                                    if (destBit < 0)
+                                    {
+                                        break;
+                                    }
+                                    if (IsPairedProducerTarget(call.Target))
+                                    {
+                                        newOut |= 1u << destBit;
+                                    }
+                                    else
+                                    {
+                                        newOut &= ~(1u << destBit);
+                                    }
+                                }
+                                break;
+                            }
+                        case IrIndirectCall icall when !string.IsNullOrWhiteSpace(icall.Destination):
+                            {
+                                newOut &= ~f1Bit;
+                                var destBit = PairedFloatRegisterBit(icall.Destination);
+                                if (destBit >= 0)
+                                {
+                                    newOut &= ~(1u << destBit);
+                                }
+                                break;
+                            }
+                        case IrIndirectCall icall:
+                            newOut &= ~f1Bit;
+                            break;
+                        case IrAssign assign:
+                            {
+                                var destBit = PairedFloatRegisterBit(assign.Destination);
+                                if (destBit < 0)
+                                {
+                                    break;
+                                }
+
+                                if (assign.Value.Kind == "register" && assign.Value.RegisterName != null)
+                                {
+                                    var srcBit = PairedFloatRegisterBit(assign.Value.RegisterName);
+                                    if (srcBit >= 0 && (newOut & (1u << srcBit)) != 0)
+                                    {
+                                        newOut |= 1u << destBit;
+                                    }
+                                    else
+                                    {
+                                        newOut &= ~(1u << destBit);
+                                    }
+                                }
+                                else
+                                {
+                                    newOut &= ~(1u << destBit);
+                                }
+                                break;
+                            }
+                        case IrBinary bin:
+                            {
+                                var destBit = PairedFloatRegisterBit(bin.Destination);
+                                if (destBit >= 0)
+                                {
+                                    newOut &= ~(1u << destBit);
+                                }
+                                break;
+                            }
+                        case IrLoad load:
+                            {
+                                var destBit = PairedFloatRegisterBit(load.Destination);
+                                if (destBit >= 0)
+                                {
+                                    newOut &= ~(1u << destBit);
+                                }
+                                break;
+                            }
+                    }
+                }
+
+                if (newIn != inMasks[b])
+                {
+                    inMasks[b] = newIn;
+                    changed = true;
+                }
+
+                if (newOut != outMasks[b])
+                {
+                    outMasks[b] = newOut;
+                    changed = true;
+                }
+            }
+        }
+
+        var inMap = new Dictionary<string, HashSet<string>>(blockCount, comparer);
+        var outMap = new Dictionary<string, HashSet<string>>(blockCount, comparer);
+        for (var i = 0; i < blockCount; i++)
+        {
+            inMap[blocks[i].Label] = MaterializePairedFloatSet(inMasks[i], comparer);
+            outMap[blocks[i].Label] = MaterializePairedFloatSet(outMasks[i], comparer);
+        }
+
+        return new PairedFlowStateMaps(inMap, outMap);
+    }
+
+    private static uint ClearPairedGuestScalarFloatArguments(
+        string target,
+        IReadOnlyList<IrValue> arguments,
+        uint pairedMask,
+        IGuestFunctionAbiProvider guestAbiProvider)
+    {
+        foreach (var arg in arguments)
+        {
+            if (arg.Kind != "register" || arg.RegisterName == null)
+            {
+                continue;
+            }
+
+            var bit = PairedFloatRegisterBit(arg.RegisterName);
+            if (bit < 0 || (pairedMask & (1u << bit)) == 0)
+            {
+                continue;
+            }
+
+            if (IsGuestScalarFloatArgument(guestAbiProvider, target, GetRegisterBaseName(arg.RegisterName)))
+            {
+                pairedMask &= ~(1u << bit);
+            }
+        }
+
+        return pairedMask;
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.RegisterResidency.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.RegisterResidency.cs
new file mode 100644
index 0000000..9c03dba
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.RegisterResidency.cs
@@ -0,0 +1,438 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Translator.Core.Analysis;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    /// <summary>
+    /// Guest register residency for one emitted function body: C++ locals are authoritative between call boundaries (host regs), synced via flush/reload at each one.
+    /// Emitted twice, a recording pass then the real pass, so any register reference outside the recorded set fails loud instead of silently reading stale <c>ctx-&gt;</c> state.
+    /// </summary>
+    private sealed class RegisterResidency
+    {
+        private readonly bool _recording;
+        private readonly SortedSet<int> _gprs = new();
+        private readonly SortedSet<int> _fprs = new();
+        private readonly SortedSet<int> _writtenGprs = new();
+        private readonly SortedSet<int> _writtenFprs = new();
+        private bool _cr;
+        private bool _ctr;
+        private bool _xer;
+        private bool _writesCr;
+        private bool _writesCtr;
+        private bool _writesXer;
+
+        private RegisterResidency(bool recording) => _recording = recording;
+
+        public static RegisterResidency CreateRecorder() => new(true);
+
+        public RegisterResidency Snapshot()
+        {
+            var snapshot = new RegisterResidency(false);
+            snapshot._gprs.UnionWith(_gprs);
+            snapshot._fprs.UnionWith(_fprs);
+            snapshot._writtenGprs.UnionWith(_writtenGprs);
+            snapshot._writtenFprs.UnionWith(_writtenFprs);
+            snapshot._cr = _cr;
+            snapshot._ctr = _ctr;
+            snapshot._xer = _xer;
+            snapshot._writesCr = _writesCr;
+            snapshot._writesCtr = _writesCtr;
+            snapshot._writesXer = _writesXer;
+            return snapshot;
+        }
+
+        public bool IsEmpty => _gprs.Count == 0 && _fprs.Count == 0 && !_cr && !_ctr && !_xer;
+
+        public static string GprLocal(int index) => GprRegisterName(index);
+        public static string FprLocal(int index) => FprRegisterName(index);
+        public const string CrLocal = "cr";
+        public const string CtrLocal = "ctr";
+        public const string XerLocal = "xer";
+
+        public IEnumerable<string> DeclaredLocalNames
+        {
+            get
+            {
+                foreach (var gpr in _gprs) yield return GprLocal(gpr);
+                foreach (var fpr in _fprs) yield return FprLocal(fpr);
+                if (_cr) yield return CrLocal;
+                if (_ctr) yield return CtrLocal;
+                if (_xer) yield return XerLocal;
+            }
+        }
+
+        public string Gpr(int index, bool written)
+        {
+            Track(_gprs, _writtenGprs, index, written, "r");
+            return GprLocal(index);
+        }
+
+        /// <summary>Scalar (PS0) view of a localized FPR.</summary>
+        public string FprScalar(int index, bool written)
+        {
+            Track(_fprs, _writtenFprs, index, written, "f");
+            return FprScalarLocalName(index);
+        }
+
+        /// <summary>Whole <c>PPC_FPR</c> value of a localized FPR.</summary>
+        public string FprStorage(int index, bool written)
+        {
+            Track(_fprs, _writtenFprs, index, written, "f");
+            return FprLocal(index);
+        }
+
+        public string Cr(bool written)
+        {
+            if (_recording)
+            {
+                _cr = true;
+                _writesCr |= written;
+            }
+            else if (!_cr || (written && !_writesCr))
+            {
+                throw new InvalidOperationException(
+                    "Register residency did not localize cr for this function body.");
+            }
+
+            return CrLocal;
+        }
+
+        public string Ctr(bool written)
+        {
+            if (_recording)
+            {
+                _ctr = true;
+                _writesCtr |= written;
+            }
+            else if (!_ctr || (written && !_writesCtr))
+            {
+                throw new InvalidOperationException(
+                    "Register residency did not localize ctr for this function body.");
+            }
+
+            return CtrLocal;
+        }
+
+        /// <summary>
+        /// XER, localized as one value (not just summary-overflow) because the carry helpers
+        /// read/modify/write it and every integer compare reads XER.SO into its CR field.
+        /// </summary>
+        public string Xer(bool written)
+        {
+            if (_recording)
+            {
+                _xer = true;
+                _writesXer |= written;
+            }
+            else if (!_xer || (written && !_writesXer))
+            {
+                throw new InvalidOperationException(
+                    "Register residency did not localize xer for this function body.");
+            }
+
+            return XerLocal;
+        }
+
+        private void Track(SortedSet<int> referenced, SortedSet<int> written, int index, bool isWrite, string prefix)
+        {
+            if (_recording)
+            {
+                referenced.Add(index);
+                if (isWrite) written.Add(index);
+                return;
+            }
+
+            if (!referenced.Contains(index) || (isWrite && !written.Contains(index)))
+            {
+                throw new InvalidOperationException(
+                    $"Register residency did not localize {prefix}{index} for this function body.");
+            }
+        }
+
+        /// <summary>
+        /// Entry loads. Every referenced register is loaded unconditionally:
+        /// liveness-narrowed initialization is a later optimization and reading
+        /// an architectural register is always well defined.
+        /// </summary>
+        public void AppendEntryLoads(StringBuilder sb)
+        {
+            if (_recording) return;
+            foreach (var gpr in _gprs)
+                sb.Append("    uint32_t ").Append(GprLocal(gpr)).Append(" = ctx->gpr[").Append(gpr).AppendLine("];");
+            foreach (var fpr in _fprs)
+                sb.Append("    PPC_FPR ").Append(FprLocal(fpr)).Append(" = ctx->fpr[").Append(fpr).AppendLine("];");
+            if (_cr) sb.AppendLine($"    uint32_t {CrLocal} = ctx->cr;");
+            if (_ctr) sb.AppendLine($"    uint32_t {CtrLocal} = ctx->ctr;");
+            if (_xer) sb.AppendLine($"    uint32_t {XerLocal} = ctx->xer;");
+        }
+
+        /// <summary>
+        /// Stores the possibly-written localized registers back into
+        /// <c>CpuContext</c>. Storing an unmodified register writes the same
+        /// value back, so the conservative write set stays correct.
+        /// </summary>
+        public void AppendFlush(StringBuilder sb, string pad) => AppendFlush(sb, pad, ResidencyBoundarySync.Full);
+
+        /// <summary>
+        /// Contract-narrowed flush. Only the registers the boundary can observe
+        /// or overwrite are published; see <see cref="ResidencyBoundarySync"/>
+        /// for why the write set has to participate in the flush mask.
+        /// </summary>
+        public void AppendFlush(StringBuilder sb, string pad, ResidencyBoundarySync sync)
+        {
+            if (_recording) return;
+            foreach (var gpr in _writtenGprs)
+                if (sync.FlushesGpr(gpr))
+                    sb.Append(pad).Append("ctx->gpr[").Append(gpr).Append("] = ").Append(GprLocal(gpr)).AppendLine(";");
+            foreach (var fpr in _writtenFprs)
+                if (sync.FlushesFpr(fpr))
+                    sb.Append(pad).Append("ctx->fpr[").Append(fpr).Append("] = ").Append(FprLocal(fpr)).AppendLine(";");
+            if (_writesCr && sync.FlushesCr) sb.Append(pad).AppendLine($"ctx->cr = {CrLocal};");
+            if (_writesCtr && sync.FlushesCtr) sb.Append(pad).AppendLine($"ctx->ctr = {CtrLocal};");
+            if (_writesXer && sync.FlushesXer) sb.Append(pad).AppendLine($"ctx->xer = {XerLocal};");
+        }
+
+        /// <summary>
+        /// Reloads the full localized set after a boundary returns, unconditionally: a callee can
+        /// change any volatile register and a nonvolatile one too if it restores it itself.
+        /// </summary>
+        public void AppendReload(StringBuilder sb, string pad) => AppendReload(sb, pad, ResidencyBoundarySync.Full);
+
+        /// <summary>Contract-narrowed reload.</summary>
+        public void AppendReload(StringBuilder sb, string pad, ResidencyBoundarySync sync)
+        {
+            if (_recording) return;
+            foreach (var gpr in _gprs)
+                if (sync.ReloadsGpr(gpr))
+                    sb.Append(pad).Append(GprLocal(gpr)).Append(" = ctx->gpr[").Append(gpr).AppendLine("];");
+            foreach (var fpr in _fprs)
+                if (sync.ReloadsFpr(fpr))
+                    sb.Append(pad).Append(FprLocal(fpr)).Append(" = ctx->fpr[").Append(fpr).AppendLine("];");
+            if (_cr && sync.ReloadsCr) sb.Append(pad).AppendLine($"{CrLocal} = ctx->cr;");
+            if (_ctr && sync.ReloadsCtr) sb.Append(pad).AppendLine($"{CtrLocal} = ctx->ctr;");
+            if (_xer && sync.ReloadsXer) sb.Append(pad).AppendLine($"{XerLocal} = ctx->xer;");
+        }
+    }
+
+    /// <summary>
+    /// Which localized registers one call boundary must sync. Flush mask is <c>read-before-write | possible-write</c>, not just callee reads, or an unflushed possibly-written register reloads stale.
+    /// Reload mask is the callee's possible-write mask (transitive union, not net effect); safe even for a spill/restore, which just re-reads a value already restored to what this frame flushed.
+    /// Falls back to <see cref="Full"/> without a precise contract (missing, full-fence, indirect, or CpuContext-touching marshalling).
+    /// </summary>
+    internal sealed record ResidencyBoundarySync(
+        uint FlushGprMask,
+        uint FlushFprMask,
+        bool FlushesCr,
+        bool FlushesCtr,
+        uint ReloadGprMask,
+        uint ReloadFprMask,
+        bool ReloadsCr,
+        bool ReloadsCtr,
+        bool FlushesXer = false,
+        bool ReloadsXer = false)
+    {
+        public static ResidencyBoundarySync Full { get; } = new(
+            uint.MaxValue, uint.MaxValue, true, true,
+            uint.MaxValue, uint.MaxValue, true, true,
+            FlushesXer: true, ReloadsXer: true);
+
+        /// <summary>
+        /// Fast arm of a state-free call site (explicit-state ABI, locals carry args/results) still flushes r1 and XER unconditionally, since a guest gather-pipe store can trigger GX HLE mid-call servicing a VI retrace or OS alarm whose handlers read them architecturally.
+        /// Flush-only; the slow arm (<c>InvokeDirectCpu</c>) keeps a full <see cref="Full"/> pair.
+        /// </summary>
+        public static ResidencyBoundarySync StateFreeResidentOuter { get; } = new(
+            FlushGprMask: 1u << 1,
+            FlushFprMask: 0u,
+            FlushesCr: false,
+            FlushesCtr: false,
+            ReloadGprMask: 0u,
+            ReloadFprMask: 0u,
+            ReloadsCr: false,
+            ReloadsCtr: false,
+            FlushesXer: true,
+            ReloadsXer: false);
+
+        public bool FlushesGpr(int index) => (FlushGprMask & (1u << index)) != 0;
+        public bool FlushesFpr(int index) => (FlushFprMask & (1u << index)) != 0;
+        public bool ReloadsGpr(int index) => (ReloadGprMask & (1u << index)) != 0;
+        public bool ReloadsFpr(int index) => (ReloadFprMask & (1u << index)) != 0;
+
+        public bool IsFull =>
+            FlushGprMask == uint.MaxValue && FlushFprMask == uint.MaxValue && FlushesCr && FlushesCtr &&
+            ReloadGprMask == uint.MaxValue && ReloadFprMask == uint.MaxValue && ReloadsCr && ReloadsCtr &&
+            FlushesXer && ReloadsXer;
+
+        /// <summary>
+        /// Adds a register class back to both masks, for call sites that emit their own architectural
+        /// <c>CpuContext</c> traffic (paired-single return normalization) the callee contract omits.
+        /// </summary>
+        public ResidencyBoundarySync WithFpr(int index) => this with
+        {
+            FlushFprMask = FlushFprMask | (1u << index),
+            ReloadFprMask = ReloadFprMask | (1u << index)
+        };
+
+        public bool IsEmpty =>
+            FlushGprMask == 0 && FlushFprMask == 0 && !FlushesCr && !FlushesCtr &&
+            ReloadGprMask == 0 && ReloadFprMask == 0 && !ReloadsCr && !ReloadsCtr &&
+            !FlushesXer && !ReloadsXer;
+
+        /// <summary>
+        /// Boundary set for a non-guest helper's implicit <c>CpuContext</c> effects, from
+        /// <see cref="Translator.Core.Analysis.GuestHelperEffectCatalog"/>. Explicit argument/destination registers
+        /// need no sync; unknown helpers catalog as complete boundaries and arrive as full masks; a pure helper is empty.
+        /// </summary>
+        public static ResidencyBoundarySync FromHelperEffect(Translator.Core.Analysis.GuestHelperEffect effect) => new(
+            FlushGprMask: effect.GprReadMask | effect.GprWriteMask,
+            FlushFprMask: effect.FprReadMask | effect.FprWriteMask,
+            FlushesCr: (effect.CrReadMask | effect.CrWriteMask) != 0,
+            FlushesCtr: effect.ReadsCtr || effect.WritesCtr,
+            ReloadGprMask: effect.GprWriteMask,
+            ReloadFprMask: effect.FprWriteMask,
+            ReloadsCr: effect.CrWriteMask != 0,
+            ReloadsCtr: effect.WritesCtr,
+            FlushesXer: effect.ReadsXer || effect.WritesXer,
+            ReloadsXer: effect.WritesXer);
+
+        /// <summary>
+        /// r1 flushes unconditionally: typed native stubs derive their contract from a host signature and can't see the body re-enter guest code via HLE interrupt delivery, whose callback chains build frames from <c>ctx-&gt;gpr[1]</c>.
+        /// A stale r1 once let such a callback overwrite a live frame's save area (return address landed in nw4r::ef's saved r29 at postVRetrace, 0x80210050, as a wild read). Flush-only; caller keeps its stack pointer.
+        /// </summary>
+        private const uint StackPointerFlushMask = 1u << 1;
+
+        public static ResidencyBoundarySync FromCalleeContract(GuestAbiContract contract)
+        {
+            if (contract.HasFullSynchronizationFence) return Full;
+            return new ResidencyBoundarySync(
+                FlushGprMask: contract.GprReadBeforeWriteMask | contract.GprPossibleWriteMask |
+                              StackPointerFlushMask,
+                FlushFprMask: contract.FprReadBeforeWriteMask | contract.FprPossibleWriteMask,
+                // The contract tracks CR per field while the local is the whole
+                // packed register, so any intersecting field forces the sync.
+                FlushesCr: (contract.CrReadBeforeWriteMask | contract.CrPossibleWriteMask) != 0,
+                FlushesCtr: contract.ReadsCtrBeforeWrite || contract.MayWriteCtr,
+                ReloadGprMask: contract.GprPossibleWriteMask,
+                ReloadFprMask: contract.FprPossibleWriteMask,
+                ReloadsCr: contract.CrPossibleWriteMask != 0,
+                ReloadsCtr: contract.MayWriteCtr,
+                // Flushed unconditionally for the same reason as r1: interrupt handlers read XER.SO out
+                // of the architectural copy. Reload stays contract-driven so a handler can't clobber it.
+                FlushesXer: true,
+                ReloadsXer: contract.MayWriteXer);
+        }
+    }
+
+    /// <summary>
+    /// Ambient residency for the body being emitted. Thread-local, not an explicit parameter, since threading one through 30+ static formatting helpers risks a missed path silently reading stale <c>ctx-&gt;gpr[N]</c>; also keeps parallel per-function emission independent.
+    /// </summary>
+    [ThreadStatic]
+    private static RegisterResidency? _activeResidency;
+
+    private static void AppendFlush(StringBuilder sb, string pad)
+    {
+        if (_activeResidency is { } residency) residency.AppendFlush(sb, pad);
+    }
+
+    private static void AppendReload(StringBuilder sb, string pad)
+    {
+        if (_activeResidency is { } residency) residency.AppendReload(sb, pad);
+    }
+
+    private static void AppendFlush(StringBuilder sb, string pad, ResidencyBoundarySync sync)
+    {
+        if (_activeResidency is { } residency) residency.AppendFlush(sb, pad, sync);
+    }
+
+    private static void AppendReload(StringBuilder sb, string pad, ResidencyBoundarySync sync)
+    {
+        if (_activeResidency is { } residency) residency.AppendReload(sb, pad, sync);
+    }
+
+    /// <summary>
+    /// Resolves the boundary sync set for a direct guest call, falling back to <see cref="ResidencyBoundarySync.Full"/> when narrowing is disabled, residency is inactive, the callee has no contract or a full-sync fence, or a mod could replace the callee with a re-translation this body's contract doesn't describe.
+    /// </summary>
+    private static ResidencyBoundarySync ResolveDirectCallBoundarySync(
+        uint target,
+        IReadOnlyDictionary<uint, GuestAbiContract> guestAbiContracts,
+        IReadOnlySet<uint> modOverridableCallTargets)
+    {
+        if (_activeResidency is null ||
+            modOverridableCallTargets.Contains(target) ||
+            !guestAbiContracts.TryGetValue(target, out var contract))
+        {
+            return ResidencyBoundarySync.Full;
+        }
+
+        return ResidencyBoundarySync.FromCalleeContract(contract);
+    }
+
+    /// <summary>
+    /// Removes an explicit helper destination register from a helper-effect
+    /// reload mask. The destination local holds the helper's return value; the
+    /// implicit-context reload must not overwrite it.
+    /// </summary>
+    private static ResidencyBoundarySync ExcludeDestinationFromReload(
+        ResidencyBoundarySync sync,
+        string? destination)
+    {
+        if (string.IsNullOrWhiteSpace(destination))
+        {
+            return sync;
+        }
+
+        var baseName = GetRegisterBaseName(destination);
+        if (baseName.Length > 1 && baseName[0] is 'r' or 'R' &&
+            int.TryParse(baseName.AsSpan(1), out var gpr) && gpr is >= 0 and < 32)
+        {
+            return sync with { ReloadGprMask = sync.ReloadGprMask & ~(1u << gpr) };
+        }
+
+        if (baseName.Length > 1 && baseName[0] is 'f' or 'F' &&
+            int.TryParse(baseName.AsSpan(1), out var fpr) && fpr is >= 0 and < 32)
+        {
+            return sync with { ReloadFprMask = sync.ReloadFprMask & ~(1u << fpr) };
+        }
+
+        if (baseName.Equals("cr", StringComparison.OrdinalIgnoreCase))
+        {
+            return sync with { ReloadsCr = false };
+        }
+
+        if (baseName.Equals("ctr", StringComparison.OrdinalIgnoreCase))
+        {
+            return sync with { ReloadsCtr = false };
+        }
+
+        if (baseName.Equals("xer", StringComparison.OrdinalIgnoreCase))
+        {
+            return sync with { ReloadsXer = false };
+        }
+
+        return sync;
+    }
+
+    /// <summary>
+    /// Rejects a residency whose local names would shadow an emitted temporary. A guard against a
+    /// future naming change, not an expected condition, since <see cref="IsCpuRegisterNoLocalNeeded"/>
+    /// already keeps machine register names out of the ordinary local set.
+    /// </summary>
+    private static void RequireResidencyNamesAreFree(
+        RegisterResidency residency,
+        uint entryPoint,
+        IEnumerable<string> emittedLocalNames)
+    {
+        var taken = new HashSet<string>(emittedLocalNames, StringComparer.Ordinal);
+        var collisions = residency.DeclaredLocalNames.Where(taken.Contains).ToArray();
+        if (collisions.Length != 0)
+        {
+            throw new InvalidOperationException(
+                $"Register residency local name(s) {string.Join(", ", collisions)} collide with an existing " +
+                $"local in 0x{entryPoint:X8}.");
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Registers.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Registers.cs
new file mode 100644
index 0000000..1daacc4
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.Registers.cs
@@ -0,0 +1,285 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using Translator.Core.Ir;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    /// <summary>
+    /// Machine register classes recognized by the emitter. Exactly one of these
+    /// applies to any base register name, which is what lets the individual
+    /// predicates share a single allocation-free classification pass.
+    /// </summary>
+    private enum GuestRegisterClass
+    {
+        None = 0,
+        Gpr,
+        Fpr,
+        CrField,
+        Special
+    }
+
+    /// <summary>Canonical <c>r0</c>..<c>r31</c> / <c>f0</c>..<c>f31</c> spellings, interned so the
+    /// dataflow passes and residency emitter stop reformatting them per instruction per iteration.</summary>
+    private static readonly string[] GprRegisterNames = CreateRegisterNames("r");
+    private static readonly string[] FprRegisterNames = CreateRegisterNames("f");
+
+    /// <summary>Scalar (PS0) spelling of a resident FPR local: <c>f0.d</c>..<c>f31.d</c>.</summary>
+    private static readonly string[] FprScalarLocalNames = CreateFprScalarLocalNames();
+
+    private static string[] CreateFprScalarLocalNames()
+    {
+        var names = new string[32];
+        for (var index = 0; index < names.Length; index++)
+        {
+            names[index] = "f" + index.ToString(CultureInfo.InvariantCulture) + ".d";
+        }
+
+        return names;
+    }
+
+    /// <summary>Architectural <c>CpuContext</c> spellings used when no residency is active.</summary>
+    private static readonly string[] CtxGprNames = CreateCtxNames("ctx->gpr[", "]");
+    private static readonly string[] CtxFprScalarNames = CreateCtxNames("ctx->fpr[", "].d");
+
+    private static string[] CreateCtxNames(string prefix, string suffix)
+    {
+        var names = new string[32];
+        for (var index = 0; index < names.Length; index++)
+        {
+            names[index] = prefix + index.ToString(CultureInfo.InvariantCulture) + suffix;
+        }
+
+        return names;
+    }
+
+    private static string CtxGprName(int index) =>
+        (uint)index < (uint)CtxGprNames.Length
+            ? CtxGprNames[index]
+            : "ctx->gpr[" + index.ToString(CultureInfo.InvariantCulture) + "]";
+
+    private static string CtxFprScalarName(int index) =>
+        (uint)index < (uint)CtxFprScalarNames.Length
+            ? CtxFprScalarNames[index]
+            : "ctx->fpr[" + index.ToString(CultureInfo.InvariantCulture) + "].d";
+
+    private static string FprScalarLocalName(int index) =>
+        (uint)index < (uint)FprScalarLocalNames.Length
+            ? FprScalarLocalNames[index]
+            : FprRegisterName(index) + ".d";
+
+    private static string[] CreateRegisterNames(string prefix)
+    {
+        var names = new string[32];
+        for (var index = 0; index < names.Length; index++)
+        {
+            names[index] = prefix + index.ToString(CultureInfo.InvariantCulture);
+        }
+
+        return names;
+    }
+
+    private static string GprRegisterName(int index) =>
+        (uint)index < (uint)GprRegisterNames.Length
+            ? GprRegisterNames[index]
+            : "r" + index.ToString(CultureInfo.InvariantCulture);
+
+    private static string FprRegisterName(int index) =>
+        (uint)index < (uint)FprRegisterNames.Length
+            ? FprRegisterNames[index]
+            : "f" + index.ToString(CultureInfo.InvariantCulture);
+
+    private static bool IsAsciiDigit(char value) => (uint)(value - '0') <= 9u;
+
+    /// <summary>
+    /// Base register name as a span over the original string. The SSA renamer
+    /// appends <c>_&lt;version&gt;</c>; anything else (including an underscore
+    /// followed by a non-numeric suffix) is already a base name.
+    /// </summary>
+    private static ReadOnlySpan<char> RegisterBaseSpan(string name)
+    {
+        var underscoreIdx = name.IndexOf('_');
+        if (underscoreIdx < 0) return name.AsSpan();
+
+        var suffixStart = underscoreIdx + 1;
+        if (suffixStart >= name.Length) return name.AsSpan();
+
+        for (var i = suffixStart; i < name.Length; i++)
+        {
+            if (!char.IsDigit(name[i])) return name.AsSpan();
+        }
+
+        return name.AsSpan(0, underscoreIdx);
+    }
+
+    /// <summary>
+    /// Memo for the substring produced when a name really carries an SSA
+    /// version suffix. The name universe of one function is small, so this
+    /// turns a per-call allocation into a dictionary probe.
+    /// </summary>
+    [ThreadStatic]
+    private static Dictionary<string, string>? _registerBaseNameMemo;
+
+    private static string GetRegisterBaseName(string name)
+    {
+        var baseSpan = RegisterBaseSpan(name);
+        if (baseSpan.Length == name.Length) return name;
+
+        var memo = _registerBaseNameMemo ??= new Dictionary<string, string>(StringComparer.Ordinal);
+        if (memo.TryGetValue(name, out var cached)) return cached;
+
+        // The emitter runs one function at a time per thread; the bound only
+        // exists so a very long translation cannot grow this without limit.
+        if (memo.Count >= 8192) memo.Clear();
+        var baseName = new string(baseSpan);
+        memo[name] = baseName;
+        return baseName;
+    }
+
+    private static bool SpanEqualsIgnoreCase(ReadOnlySpan<char> value, string candidate) =>
+        value.Equals(candidate.AsSpan(), StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// Classifies a base register name and decodes its index for the indexed classes. GPR/FPR require
+    /// a lowercase prefix; CR fields and special registers match case insensitively.
+    /// </summary>
+    private static GuestRegisterClass ClassifyRegisterBase(ReadOnlySpan<char> baseName, out int index)
+    {
+        index = -1;
+        var length = baseName.Length;
+        if (length is < 2 or > 4) return GuestRegisterClass.None;
+
+        var first = baseName[0];
+        if (length <= 3 && (first == 'r' || first == 'f') && IsAsciiDigit(baseName[1]))
+        {
+            if (length == 2)
+            {
+                index = baseName[1] - '0';
+                return first == 'r' ? GuestRegisterClass.Gpr : GuestRegisterClass.Fpr;
+            }
+
+            if (IsAsciiDigit(baseName[2]))
+            {
+                var value = ((baseName[1] - '0') * 10) + (baseName[2] - '0');
+                if (value >= 32) return GuestRegisterClass.None;
+                index = value;
+                return first == 'r' ? GuestRegisterClass.Gpr : GuestRegisterClass.Fpr;
+            }
+        }
+
+        if (length == 3 &&
+            (first is 'c' or 'C') && (baseName[1] is 'r' or 'R') &&
+            IsAsciiDigit(baseName[2]) && (baseName[2] - '0') <= 7)
+        {
+            index = baseName[2] - '0';
+            return GuestRegisterClass.CrField;
+        }
+
+        switch (length)
+        {
+            case 2:
+                if (SpanEqualsIgnoreCase(baseName, "lr") ||
+                    SpanEqualsIgnoreCase(baseName, "cr"))
+                {
+                    return GuestRegisterClass.Special;
+                }
+
+                break;
+
+            case 3:
+                if (SpanEqualsIgnoreCase(baseName, "ctr") ||
+                    SpanEqualsIgnoreCase(baseName, "xer") ||
+                    SpanEqualsIgnoreCase(baseName, "msr"))
+                {
+                    return GuestRegisterClass.Special;
+                }
+
+                break;
+
+            case 4:
+                if (SpanEqualsIgnoreCase(baseName, "srr0") ||
+                    SpanEqualsIgnoreCase(baseName, "srr1") ||
+                    SpanEqualsIgnoreCase(baseName, "hid0") ||
+                    SpanEqualsIgnoreCase(baseName, "hid1") ||
+                    SpanEqualsIgnoreCase(baseName, "hid2"))
+                {
+                    return GuestRegisterClass.Special;
+                }
+
+                if (SpanEqualsIgnoreCase(baseName[..3], "gqr") &&
+                    IsAsciiDigit(baseName[3]) && (baseName[3] - '0') < 8)
+                {
+                    index = baseName[3] - '0';
+                    return GuestRegisterClass.Special;
+                }
+
+                break;
+        }
+
+        return GuestRegisterClass.None;
+    }
+
+    private static GuestRegisterClass ClassifyRegister(string name, out int index) =>
+        ClassifyRegisterBase(RegisterBaseSpan(name), out index);
+
+    private static bool IsFloatRegister(string name) =>
+        ClassifyRegister(name, out _) == GuestRegisterClass.Fpr;
+
+    private static bool IsAbiFloatArgumentRegister(string name) =>
+        ClassifyRegister(name, out var index) == GuestRegisterClass.Fpr &&
+        index is >= 1 and <= 13;
+
+    private static bool IsFloatValue(IrValue value, RepresentationEnvironment types)
+    {
+        if (value.Kind != "register" || string.IsNullOrWhiteSpace(value.RegisterName))
+        {
+            return false;
+        }
+
+        if (IsFloatRegister(value.RegisterName))
+        {
+            return true;
+        }
+
+        var type = types.Get(value.RegisterName);
+        return type is ValueRepresentation primitive && primitive.IsFloat;
+    }
+
+    private static bool TryParseGprRegisterIndex(string registerName, out int index)
+    {
+        if (!string.IsNullOrWhiteSpace(registerName) &&
+            registerName.StartsWith("r", StringComparison.OrdinalIgnoreCase) &&
+            int.TryParse(RegisterBaseSpan(registerName)[1..], out index) &&
+            index is >= 0 and <= 31)
+        {
+            return true;
+        }
+
+        index = -1;
+        return false;
+    }
+
+    private static bool TryParseFloatRegisterIndex(string registerName, out int index)
+    {
+        if (!string.IsNullOrWhiteSpace(registerName) &&
+            registerName.StartsWith("f", StringComparison.OrdinalIgnoreCase) &&
+            int.TryParse(RegisterBaseSpan(registerName)[1..], out index) &&
+            index is >= 0 and <= 31)
+        {
+            return true;
+        }
+
+        index = -1;
+        return false;
+    }
+
+    private static bool IsCpuRegister(string name) =>
+        ClassifyRegister(name, out _) != GuestRegisterClass.None;
+
+    private static bool IsCpuRegisterNoLocalNeeded(string name) =>
+        ClassifyRegister(name, out _) is GuestRegisterClass.Gpr or GuestRegisterClass.Fpr or GuestRegisterClass.Special;
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.StackAnalysis.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.StackAnalysis.cs
new file mode 100644
index 0000000..2f0f4a7
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.StackAnalysis.cs
@@ -0,0 +1,538 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    /// <summary>Identifies one IR instruction by its position in the function.</summary>
+    private readonly record struct InstructionKey(string BlockLabel, int Index);
+
+    /// <summary>
+    /// An <see cref="InstructionKey"/> plus a whole-function ordinal, so two
+    /// sites in different blocks can be compared in emission order.
+    /// </summary>
+    private readonly record struct InstructionSite(string BlockLabel, int Index, int Order)
+    {
+        public InstructionKey Key => new(BlockLabel, Index);
+    }
+
+    private sealed record StackAccess(InstructionSite Site, int Offset, int SizeBytes);
+
+    private sealed class FprStackSaveSlot
+    {
+        public List<InstructionSite> DirectStores { get; } = new();
+        public List<InstructionSite> DirectLoads { get; } = new();
+        public List<InstructionSite> PsqStores { get; } = new();
+        public List<InstructionSite> PsqLoads { get; } = new();
+    }
+
+    /// <summary>Replaces a leaf function's private ABI FPR stack spill with a native local. Requires
+    /// one entry save, one epilogue restore, one return, no overlapping stack access, and, for paired
+    /// saves, canonical scalar+PSQ save / PSQ+scalar restore order.</summary>
+    private static IrFunction ElideLeafStackFprSaveRestore(
+        IrFunction func,
+        RepresentationEnvironment types)
+    {
+        if (!FunctionEligibleForLeafRegisterCache(func))
+            return func;
+
+        var stackFacts = StackAddressFacts.Build(func);
+        var stackAccesses = new List<StackAccess>();
+        var slots = new Dictionary<(int Fpr, int Offset), FprStackSaveSlot>();
+        var psqAddressTemps = new Dictionary<InstructionKey, string>();
+        var returnSites = new List<InstructionSite>();
+        var orderedInstructions = new List<(InstructionSite Site, IrInstruction Instruction)>();
+
+        var order = 0;
+        foreach (var block in func.Blocks)
+        {
+            for (var index = 0; index < block.Instructions.Count; ++index, ++order)
+            {
+                var instruction = block.Instructions[index];
+                var site = new InstructionSite(block.Label, index, order);
+                orderedInstructions.Add((site, instruction));
+                switch (instruction)
+                {
+                    case IrReturn:
+                        returnSites.Add(site);
+                        break;
+                    case IrStore store:
+                        RecordDirectStackStore(store, site);
+                        break;
+                    case IrLoad load:
+                        RecordDirectStackLoad(load, site);
+                        break;
+                    case IrCall call:
+                        RecordPsqStackAccess(call, site);
+                        break;
+                }
+            }
+        }
+
+        if (returnSites.Count != 1)
+            return func;
+
+        var replacements = new Dictionary<InstructionKey, IrInstruction>();
+        var removals = new HashSet<InstructionKey>();
+        var savedFprs = new SortedSet<int>();
+        var stackTempUseCounts = CountRegisterUses(func);
+        var stackTempDefinitions = CollectStackAddressTemporaryDefinitions(func, stackFacts);
+        var returnSite = returnSites[0];
+
+        foreach (var ((fpr, offset), slot) in slots.OrderBy(pair => pair.Key.Fpr).ThenBy(pair => pair.Key.Offset))
+        {
+            if (slot.DirectStores.Count != 1 || slot.DirectLoads.Count != 1)
+                continue;
+
+            var directStore = slot.DirectStores[0];
+            var directLoad = slot.DirectLoads[0];
+            if (!directStore.BlockLabel.Equals(func.EntryLabel, StringComparison.OrdinalIgnoreCase) ||
+                !directLoad.BlockLabel.Equals(returnSite.BlockLabel, StringComparison.OrdinalIgnoreCase) ||
+                directStore.Order >= directLoad.Order || directLoad.Order >= returnSite.Order ||
+                HasFprDefinitionBefore(fpr, directStore.Order))
+            {
+                continue;
+            }
+
+            var slotSites = new HashSet<InstructionKey> { directStore.Key, directLoad.Key };
+            var accessSize = 8;
+            var hasPairedSave = slot.PsqStores.Count == 1 && slot.PsqLoads.Count == 1;
+            if (hasPairedSave)
+            {
+                var psqStore = slot.PsqStores[0];
+                var psqLoad = slot.PsqLoads[0];
+                if (!psqStore.BlockLabel.Equals(func.EntryLabel, StringComparison.OrdinalIgnoreCase) ||
+                    !psqLoad.BlockLabel.Equals(returnSite.BlockLabel, StringComparison.OrdinalIgnoreCase) ||
+                    !(directStore.Order < psqStore.Order && psqStore.Order < psqLoad.Order &&
+                      psqLoad.Order < directLoad.Order) ||
+                    HasFprAccessBetween(fpr, psqLoad.Order, directLoad.Order))
+                {
+                    continue;
+                }
+
+                slotSites.Add(psqStore.Key);
+                slotSites.Add(psqLoad.Key);
+                accessSize = 16;
+            }
+            else if (slot.PsqStores.Count != 0 || slot.PsqLoads.Count != 0)
+            {
+                continue;
+            }
+
+            if (HasOverlappingStackAccess(stackAccesses, slotSites, offset, accessSize))
+                continue;
+
+            savedFprs.Add(fpr);
+            removals.Add(directStore.Key);
+            replacements[directLoad.Key] = new IrAssign($"f{fpr}", IrValue.Register(LeafStackSavedFprName(fpr)));
+
+            if (hasPairedSave)
+            {
+                var psqStore = slot.PsqStores[0];
+                var psqLoad = slot.PsqLoads[0];
+                removals.Add(psqStore.Key);
+                removals.Add(psqLoad.Key);
+                RemoveSingleUsePsqAddressTemporary(psqStore.Key);
+                RemoveSingleUsePsqAddressTemporary(psqLoad.Key);
+            }
+        }
+
+        if (savedFprs.Count == 0)
+            return func;
+
+        foreach (var fpr in savedFprs)
+            types.Unify(LeafStackSavedFprName(fpr), ValueRepresentation.Float64);
+
+        var rewrittenBlocks = new List<IrBasicBlock>(func.Blocks.Count);
+        foreach (var block in func.Blocks)
+        {
+            var rewritten = new List<IrInstruction>(block.Instructions.Count + savedFprs.Count);
+            if (block.Label.Equals(func.EntryLabel, StringComparison.OrdinalIgnoreCase))
+            {
+                foreach (var fpr in savedFprs)
+                    // This pass runs after SSA construction. Preserve the
+                    // explicit live-in version so later LLVM lowering never
+                    // mistakes the epilogue's synthetic fN definition for the
+                    // entry value being saved.
+                    rewritten.Add(new IrAssign(LeafStackSavedFprName(fpr), IrValue.Register($"f{fpr}_0")));
+            }
+
+            for (var index = 0; index < block.Instructions.Count; ++index)
+            {
+                var key = new InstructionKey(block.Label, index);
+                if (removals.Contains(key))
+                    continue;
+                rewritten.Add(replacements.TryGetValue(key, out var replacement)
+                    ? replacement
+                    : block.Instructions[index]);
+            }
+            rewrittenBlocks.Add(new IrBasicBlock(block.Label, rewritten));
+        }
+
+        return new IrFunction(func.Name, func.EntryLabel, rewrittenBlocks);
+
+        bool HasFprDefinitionBefore(int fpr, int limit)
+        {
+            var name = $"f{fpr}";
+            return orderedInstructions.Any(item => item.Site.Order < limit &&
+                InstructionDefinesRegister(item.Instruction, name));
+        }
+
+        bool HasFprAccessBetween(int fpr, int after, int before)
+        {
+            var name = $"f{fpr}";
+            return orderedInstructions.Any(item => item.Site.Order > after && item.Site.Order < before &&
+                (InstructionUsesRegister(item.Instruction, name) || InstructionDefinesRegister(item.Instruction, name)));
+        }
+
+        void RemoveSingleUsePsqAddressTemporary(InstructionKey psqKey)
+        {
+            if (psqAddressTemps.TryGetValue(psqKey, out var name) &&
+                stackTempUseCounts.TryGetValue(name, out var useCount) && useCount == 1 &&
+                stackTempDefinitions.TryGetValue(name, out var definition))
+            {
+                removals.Add(definition.Key);
+            }
+        }
+
+        FprStackSaveSlot GetSlot(int fpr, int offset)
+        {
+            var key = (fpr, offset);
+            if (!slots.TryGetValue(key, out var slot))
+                slots[key] = slot = new FprStackSaveSlot();
+            return slot;
+        }
+
+        void RecordDirectStackStore(IrStore store, InstructionSite site)
+        {
+            if (!stackFacts.TryResolve(store.Address, out var offset))
+                return;
+            stackAccesses.Add(new StackAccess(site, offset, store.SizeBytes));
+            if (store.SizeBytes == 8 && store.Source.Kind == "register" &&
+                TryParseNonvolatileFpr(store.Source.RegisterName, out var fpr))
+            {
+                GetSlot(fpr, offset).DirectStores.Add(site);
+            }
+        }
+
+        void RecordDirectStackLoad(IrLoad load, InstructionSite site)
+        {
+            if (!stackFacts.TryResolve(load.Address, out var offset))
+                return;
+            stackAccesses.Add(new StackAccess(site, offset, load.SizeBytes));
+            if (load.SizeBytes == 8 && TryParseNonvolatileFpr(load.Destination, out var fpr))
+                GetSlot(fpr, offset).DirectLoads.Add(site);
+        }
+
+        void RecordPsqStackAccess(IrCall call, InstructionSite site)
+        {
+            if (!TryGetPsqStackAccess(call, stackFacts, out var psq))
+                return;
+            stackAccesses.Add(new StackAccess(site, psq.Offset, psq.SizeBytes));
+            if (!psq.IsSaveRestoreCandidate || psq.SizeBytes != 8 || psq.Offset < 8)
+                return;
+            var slot = GetSlot(psq.Fpr, psq.Offset - 8);
+            if (call.Arguments.Count > 0 && call.Arguments[0].Kind == "register" &&
+                call.Arguments[0].RegisterName is { } temporary)
+            {
+                psqAddressTemps[site.Key] = temporary;
+            }
+            if (psq.IsStore) slot.PsqStores.Add(site); else slot.PsqLoads.Add(site);
+        }
+    }
+
+    private static string LeafStackSavedFprName(int fpr) => $"leaf_stack_saved_f{fpr}_entry";
+
+    private static IrFunction ElideOverwrittenPsqStackLoads(IrFunction func)
+    {
+        var stackFacts = StackAddressFacts.Build(func);
+        var stackTempUseCounts = CountRegisterUses(func);
+        var stackTempDefinitions = CollectStackAddressTemporaryDefinitions(func, stackFacts);
+        var removals = new HashSet<InstructionKey>();
+
+        foreach (var block in func.Blocks)
+        {
+            for (var index = 0; index + 1 < block.Instructions.Count; index++)
+            {
+                if (block.Instructions[index] is not IrCall call ||
+                    !TryGetPsqStackAccess(call, stackFacts, out var psq) ||
+                    psq.IsStore ||
+                    !psq.IsSaveRestoreCandidate ||
+                    psq.SizeBytes != 8 ||
+                    psq.Offset < 8 ||
+                    !TryFindOverwritingScalarFprLoad(block.Instructions, index, stackFacts, psq, out _))
+                {
+                    continue;
+                }
+
+                var callKey = new InstructionKey(block.Label, index);
+                removals.Add(callKey);
+
+                if (call.Arguments.Count > 0 &&
+                    call.Arguments[0].Kind == "register" &&
+                    call.Arguments[0].RegisterName is { } psqTemp &&
+                    stackTempUseCounts.TryGetValue(psqTemp, out var useCount) &&
+                    useCount == 1 &&
+                    stackTempDefinitions.TryGetValue(psqTemp, out var defSite))
+                {
+                    removals.Add(defSite.Key);
+                }
+            }
+        }
+
+        if (removals.Count == 0)
+        {
+            return func;
+        }
+
+        var rewrittenBlocks = new List<IrBasicBlock>(func.Blocks.Count);
+        foreach (var block in func.Blocks)
+        {
+            var rewrittenInstructions = new List<IrInstruction>(block.Instructions.Count);
+            for (var index = 0; index < block.Instructions.Count; index++)
+            {
+                if (!removals.Contains(new InstructionKey(block.Label, index)))
+                {
+                    rewrittenInstructions.Add(block.Instructions[index]);
+                }
+            }
+
+            rewrittenBlocks.Add(new IrBasicBlock(block.Label, rewrittenInstructions));
+        }
+
+        return new IrFunction(func.Name, func.EntryLabel, rewrittenBlocks);
+    }
+
+    private static bool TryFindOverwritingScalarFprLoad(
+        IReadOnlyList<IrInstruction> instructions,
+        int psqLoadIndex,
+        StackAddressFacts stackFacts,
+        PsqStackAccess psq,
+        out IrLoad load)
+    {
+        for (var index = psqLoadIndex + 1; index < instructions.Count; index++)
+        {
+            var instruction = instructions[index];
+            switch (instruction)
+            {
+                case IrComment:
+                case IrTracePpc:
+                    continue;
+
+                case IrLoad candidate
+                    when candidate.SizeBytes == 8 &&
+                         TryParseNonvolatileFpr(candidate.Destination, out var loadFpr) &&
+                         loadFpr == psq.Fpr &&
+                         stackFacts.TryResolve(candidate.Address, out var loadOffset) &&
+                         loadOffset == psq.Offset - 8:
+                    load = candidate;
+                    return true;
+
+                case IrCall:
+                case IrIndirectCall:
+                case IrBranch:
+                case IrJump:
+                case IrIndirectJump:
+                case IrJumpTable:
+                case IrReturn:
+                    load = default!;
+                    return false;
+
+                default:
+                    if (InstructionUsesRegister(instruction, $"f{psq.Fpr}") ||
+                        InstructionDefinesRegister(instruction, $"f{psq.Fpr}"))
+                    {
+                        load = default!;
+                        return false;
+                    }
+
+                    continue;
+            }
+        }
+
+        load = default!;
+        return false;
+    }
+
+    private static bool InstructionUsesRegister(IrInstruction instruction, string registerName)
+    {
+        var baseName = GetRegisterBaseName(registerName);
+        return IrRegisterDataFlow.Uses(instruction).Any(name =>
+            GetRegisterBaseName(name).Equals(baseName, StringComparison.OrdinalIgnoreCase));
+    }
+
+    private static bool InstructionDefinesRegister(IrInstruction instruction, string registerName)
+    {
+        var baseName = GetRegisterBaseName(registerName);
+        return IrRegisterDataFlow.Definitions(instruction).Any(name =>
+            GetRegisterBaseName(name).Equals(baseName, StringComparison.OrdinalIgnoreCase));
+    }
+
+    private static Dictionary<string, InstructionSite> CollectStackAddressTemporaryDefinitions(
+        IrFunction func,
+        StackAddressFacts stackFacts)
+    {
+        var definitions = new Dictionary<string, InstructionSite>(StringComparer.OrdinalIgnoreCase);
+        var order = 0;
+        foreach (var block in func.Blocks)
+        {
+            for (var index = 0; index < block.Instructions.Count; index++, order++)
+            {
+                var instruction = block.Instructions[index];
+                string? destination = instruction switch
+                {
+                    IrAssign assign => assign.Destination,
+                    IrBinary binary => binary.Destination,
+                    _ => null
+                };
+
+                if (destination != null && stackFacts.ContainsTemporary(destination))
+                {
+                    definitions[destination] = new InstructionSite(block.Label, index, order);
+                }
+            }
+        }
+
+        return definitions;
+    }
+
+    private static Dictionary<string, int> CountRegisterUses(IrFunction func)
+    {
+        var counts = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+
+        foreach (var block in func.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                // Keep every occurrence: stack-temp elision relies on a
+                // true use count, not a set of referenced names.
+                foreach (var name in IrRegisterDataFlow.Uses(instruction))
+                {
+                    if (!string.IsNullOrWhiteSpace(name))
+                    {
+                        counts[name] = counts.TryGetValue(name, out var count) ? count + 1 : 1;
+                    }
+                }
+            }
+        }
+
+        return counts;
+    }
+
+    private sealed record PsqStackAccess(
+        bool IsStore,
+        bool IsSaveRestoreCandidate,
+        int Fpr,
+        int Offset,
+        int SizeBytes);
+
+    private static bool TryGetPsqStackAccess(
+        IrCall call,
+        StackAddressFacts stackFacts,
+        out PsqStackAccess access)
+    {
+        access = default!;
+        var isStore = string.Equals(call.Target, "PPC_PsqSt", StringComparison.Ordinal);
+        var isLoad = string.Equals(call.Target, "PPC_PsqL", StringComparison.Ordinal);
+        if (!isStore && !isLoad)
+        {
+            return false;
+        }
+
+        if (call.Arguments.Count < (isStore ? 4 : 3) ||
+            !stackFacts.TryResolve(call.Arguments[0], out var offset))
+        {
+            return false;
+        }
+
+        var widthIndex = isStore ? 2 : 1;
+        var quantIndex = isStore ? 3 : 2;
+        var width = TryGetIntConstant(call.Arguments[widthIndex], out var widthValue)
+            ? widthValue
+            : -1;
+        var quant = TryGetIntConstant(call.Arguments[quantIndex], out var quantValue)
+            ? quantValue
+            : -1;
+        var sizeBytes = width == 1 ? 4 : 8;
+        var candidate = width == 0 && quant == 0;
+        var fpr = -1;
+
+        if (candidate)
+        {
+            if (isStore)
+            {
+                candidate = call.Arguments[1].Kind == "register" &&
+                            TryParseNonvolatileFpr(call.Arguments[1].RegisterName, out fpr);
+            }
+            else
+            {
+                candidate = TryParseNonvolatileFpr(call.Destination, out fpr);
+            }
+        }
+
+        access = new PsqStackAccess(isStore, candidate, fpr, offset, sizeBytes);
+        return true;
+    }
+
+    private static bool TryGetIntConstant(IrValue value, out int result)
+    {
+        if (value.Kind == "const" &&
+            value.Constant is { } constant &&
+            constant >= int.MinValue &&
+            constant <= int.MaxValue)
+        {
+            result = (int)constant;
+            return true;
+        }
+
+        result = 0;
+        return false;
+    }
+
+    private static bool TryParseNonvolatileFpr(string? registerName, out int fpr)
+    {
+        if (!string.IsNullOrWhiteSpace(registerName) &&
+            TryParseFloatRegisterIndex(GetRegisterBaseName(registerName), out fpr) &&
+            fpr is >= 14 and <= 31)
+        {
+            return true;
+        }
+
+        fpr = -1;
+        return false;
+    }
+
+    private static bool HasOverlappingStackAccess(
+        IReadOnlyList<StackAccess> accesses,
+        IReadOnlySet<InstructionKey> allowedSites,
+        int offset,
+        int sizeBytes)
+    {
+        foreach (var access in accesses)
+        {
+            if (allowedSites.Contains(access.Site.Key))
+            {
+                continue;
+            }
+
+            if (RangesOverlap(offset, sizeBytes, access.Offset, access.SizeBytes))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool RangesOverlap(int leftOffset, int leftSize, int rightOffset, int rightSize)
+    {
+        var leftEnd = leftOffset + leftSize;
+        var rightEnd = rightOffset + rightSize;
+        return leftOffset < rightEnd && rightOffset < leftEnd;
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.StateFreeAbi.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.StateFreeAbi.cs
new file mode 100644
index 0000000..224b303
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.StateFreeAbi.cs
@@ -0,0 +1,914 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using Translator.Core.Analysis;
+
+namespace Translator.Core.CodeGen;
+
+public sealed partial class CxxLinearCodeGenerator
+{
+    /// <summary>
+    /// Every pattern the state-free rewriter uses, built once. The static <c>Regex.*</c> helpers
+    /// cache only 15 patterns by default; this rewriter has more than that and used to build a
+    /// fresh pattern per register, thrashing the cache and re-parsing on every call.
+    /// </summary>
+    private static class StateFreePatterns
+    {
+        private const RegexOptions Options = RegexOptions.CultureInvariant | RegexOptions.Compiled;
+
+        public static readonly Regex DifferentialBlock = new(
+            @"(?s)\s*// MKW_STATE_FREE_DIFFERENTIAL_BEGIN.*?// MKW_STATE_FREE_DIFFERENTIAL_END\s*", Options);
+
+        public static readonly Regex CtxGqrAccess = new(@"ctx->gqr\[(\d+)u?\]", Options);
+
+        public static readonly Regex PsqInlineGqrOperand = new(
+            @"PPC_Psq(?:L|St)(?:Stack|Resolved)?Inline<\d+u,\s*(\d+)u>\(ctx,", Options);
+
+        public static readonly Regex CachedGprFlush = new(
+            @"(?m)^\s*ctx->gpr\[\d+\]\s*=\s*cached_r\d+;\s*\r?\n?", Options);
+
+        public static readonly Regex CachedSpecialFlush = new(
+            @"(?m)^\s*ctx->(?:cr|xer|ctr|lr)\s*=\s*cached_(?:cr|xer|ctr|lr);\s*\r?\n?", Options);
+
+        public static readonly Regex CachedFprFlush = new(
+            @"(?m)^\s*ctx->fpr\[\d+\]\s*=\s*cached_f\d+;\s*\r?\n?", Options);
+
+        public static readonly Regex LrStore = new(@"(?m)^\s*ctx->lr\s*=\s*[^;]+;\s*\r?\n?", Options);
+
+        public static readonly Regex PsqLInline = new(
+            @"PPC_PsqLInline<(?<w>\d+)u,\s*(?<i>\d+)u>\(ctx,\s*", Options);
+
+        public static readonly Regex PsqLStackInline = new(
+            @"PPC_PsqLStackInline<(?<w>\d+)u,\s*(?<i>\d+)u>\(ctx,\s*", Options);
+
+        public static readonly Regex PsqStInline = new(
+            @"PPC_PsqStInline<(?<w>\d+)u,\s*(?<i>\d+)u>\(ctx,\s*", Options);
+
+        public static readonly Regex PsqStStackInline = new(
+            @"PPC_PsqStStackInline<(?<w>\d+)u,\s*(?<i>\d+)u>\(ctx,\s*", Options);
+
+        public static readonly Regex PsqLResolvedInline = new(
+            @"PPC_PsqLResolvedInline<(?<w>\d+)u,\s*(?<i>\d+)u>\(ctx,\s*", Options);
+
+        public static readonly Regex PsqStResolvedInline = new(
+            @"PPC_PsqStResolvedInline<(?<w>\d+)u,\s*(?<i>\d+)u>\(ctx,\s*", Options);
+
+        public static readonly Regex PsqKnownInline = new(
+            @"(PPC_Psq(?:L|St)Known(?:Resolved|Stack)?Inline<[^>]+>)\(ctx,\s*", Options);
+
+        public static readonly Regex BareReturn = new(@"\breturn\s*;", Options);
+
+        public static readonly Regex AggregateReturn = new(@"\breturn\s*\{", Options);
+
+        public static readonly Regex ContextWord = new(@"\bctx\b", Options);
+
+        public static readonly Regex BoundaryDirectCall = new(
+            @"(?m)^(?<pad>\s*)InvokeDirectCpu<0x(?<address>[0-9A-Fa-f]{8})u>\(ctx\);\s*$", Options);
+
+        public static readonly Regex BoundaryDirectCallAddress = new(
+            @"\bInvokeDirectCpu<0x([0-9A-Fa-f]{8})u>\(ctx\);", Options);
+
+        /// <summary>
+        /// <c>uint32_t cached_&lt;name&gt;</c> declarations, found in a single scan (the old
+        /// per-register pattern ending in <c>\b</c> matched the same complete identifiers).
+        /// </summary>
+        public static readonly Regex CachedIntDeclaration = new(@"\buint32_t\s+(cached_\w+)\b", Options);
+
+        public static readonly Regex CachedFprDeclaration = new(@"\bPPC_FPR\s+(cached_\w+)\b", Options);
+    }
+
+    /// <summary>
+    /// Names of the <c>cached_*</c> locals declared in one body, collected in a
+    /// single pass. See <see cref="StateFreePatterns.CachedIntDeclaration"/>.
+    /// </summary>
+    private static HashSet<string> CollectStateFreeCachedDeclarations(string body)
+    {
+        var declared = new HashSet<string>(StringComparer.Ordinal);
+        foreach (Match match in StateFreePatterns.CachedIntDeclaration.Matches(body))
+        {
+            declared.Add(match.Groups[1].Value);
+        }
+
+        foreach (Match match in StateFreePatterns.CachedFprDeclaration.Matches(body))
+        {
+            declared.Add(match.Groups[1].Value);
+        }
+
+        return declared;
+    }
+
+    private static bool IsStateFreeCallSafe(GuestAbiContract contract) =>
+        !contract.HasFullSynchronizationFence;
+
+    private static bool StateFreeHasOutputs(GuestAbiContract contract) =>
+        contract.GprPossibleWriteMask != 0 || contract.FprPossibleWriteMask != 0 ||
+        contract.CrPossibleWriteMask != 0 || contract.MayWriteXer ||
+        contract.MayWriteCtr || contract.MayWriteLr || contract.MayWriteFpscr ||
+        contract.GqrPossibleWriteMask != 0 || contract.HidPossibleWriteMask != 0;
+
+    private static int StateFreeOutputCount(GuestAbiContract contract) =>
+        System.Numerics.BitOperations.PopCount(contract.GprPossibleWriteMask) +
+        System.Numerics.BitOperations.PopCount(contract.FprPossibleWriteMask) +
+        (contract.CrPossibleWriteMask != 0 ? 1 : 0) +
+        (contract.MayWriteXer ? 1 : 0) + (contract.MayWriteCtr ? 1 : 0) +
+        (contract.MayWriteLr ? 1 : 0) + (contract.MayWriteFpscr ? 1 : 0) +
+        System.Numerics.BitOperations.PopCount(contract.GqrPossibleWriteMask) +
+        System.Numerics.BitOperations.PopCount(contract.HidPossibleWriteMask);
+
+    private static uint StateFreeGprInputMask(GuestAbiContract contract) =>
+        contract.GprReadBeforeWriteMask;
+
+    private static int StateFreeInputCount(GuestAbiContract contract) =>
+        System.Numerics.BitOperations.PopCount(StateFreeGprInputMask(contract)) +
+        // Scalar writes preserve PS1, so every possible FPR output also needs
+        // the incoming packed value at the native boundary.
+        System.Numerics.BitOperations.PopCount(
+            contract.FprReadBeforeWriteMask | contract.FprPossibleWriteMask) +
+        (contract.CrReadBeforeWriteMask != 0 || contract.CrPossibleWriteMask != 0 ? 1 : 0) +
+        (contract.ReadsXerBeforeWrite || contract.MayWriteXer ? 1 : 0) +
+        (contract.ReadsCtrBeforeWrite || contract.MayWriteCtr ? 1 : 0) +
+        (contract.ReadsLrBeforeWrite || contract.MayWriteLr ? 1 : 0) +
+        (contract.ReadsFpscrBeforeWrite || contract.MayWriteFpscr ? 1 : 0) +
+        System.Numerics.BitOperations.PopCount(
+            (uint)(contract.GqrReadBeforeWriteMask | contract.GqrPossibleWriteMask)) +
+        System.Numerics.BitOperations.PopCount(
+            (uint)(contract.HidReadBeforeWriteMask | contract.HidPossibleWriteMask));
+
+    private static bool StateFreeFitsNativeRegisterBudget(GuestAbiContract contract) =>
+        StateFreeInputCount(contract) <= 4 && StateFreeOutputCount(contract) <= 2;
+
+    // Do not use Clang's __regcall here: a state-free callee using host r12 as scratch once collided
+    // with a caller that kept the guest-memory page table live in r12, crashing at address 0x4808. The
+    // platform ABI avoids that until regions can be fused before host register allocation.
+    private static string StateFreeCallingConvention(GuestAbiContract contract) => string.Empty;
+
+    private static string StateFreeResultType(uint address) => $"MkwStateFreeResult_{address:X8}";
+
+    private static string StateFreeAvailabilityCondition(
+        uint root,
+        IReadOnlyDictionary<uint, GuestAbiContract> contracts,
+        IReadOnlyDictionary<uint, string> symbols)
+    {
+        var region = new SortedSet<uint>();
+        void Visit(uint address)
+        {
+            if (!region.Add(address) || !contracts.TryGetValue(address, out var contract)) return;
+            foreach (var target in contract.DirectCallTargets)
+                if (symbols.ContainsKey(target)) Visit(target);
+        }
+        Visit(root);
+        // Ordinary no-inline native calls: on Windows x64, over four argument slots spill to the stack
+        // and over two results need an sret object, defeating register residency (first hit in the
+        // THP-heavy 0x80054460 region, 36 inputs / 31 outputs). Enable only when the whole transitive
+        // region fits the native register ABI; larger regions need region fusion, not a giant prototype.
+        if (region.Any(address =>
+                !contracts.TryGetValue(address, out var contract) ||
+                !StateFreeFitsNativeRegisterBudget(contract)))
+            return "false";
+        // Base shards are shared by base and Retro Rewind; profile-neutral dispatch can still pick a mod
+        // translation for any descendant even with compile-time-constant call traits. Every member must
+        // resolve to the base body before skipping CpuContext dispatch, or the region silently drops a
+        // Retro Rewind override and corrupts guest state.
+        return $"MkwStateFreeAbiEnabled(0x{root:X8}u) && " + string.Join(" && ", region.Select(static address =>
+            $"KnownTranslatedCpuCall<0x{address:X8}u>::kAvailable && " +
+            $"!KnownTranslatedCpuCall<0x{address:X8}u>::kMustRemainDynamicallyDispatchable && " +
+            $"IsBaseTranslatedCpuTargetActive<0x{address:X8}u>()"));
+    }
+
+    private static string StateFreeReturnType(uint address, GuestAbiContract contract) =>
+        StateFreeOutputCount(contract) switch
+        {
+            0 => "void",
+            1 => "uint64_t",
+            2 => "MkwStateFreeResult2",
+            _ => StateFreeResultType(address)
+        };
+
+    private static void AppendStateFreeResultDeclaration(StringBuilder sb, uint address, GuestAbiContract contract)
+    {
+        var outputCount = StateFreeOutputCount(contract);
+        if (outputCount <= 2) return;
+        sb.AppendLine($"#ifndef MKW_STATE_FREE_RESULT_{address:X8}_DEFINED");
+        sb.AppendLine($"#define MKW_STATE_FREE_RESULT_{address:X8}_DEFINED 1");
+        sb.AppendLine($"struct {StateFreeResultType(address)} {{");
+        for (var gpr = 0; gpr < 32; ++gpr)
+            if ((contract.GprPossibleWriteMask & (1u << gpr)) != 0) sb.AppendLine($"    uint32_t r{gpr};");
+        for (var fpr = 0; fpr < 32; ++fpr)
+            if ((contract.FprPossibleWriteMask & (1u << fpr)) != 0) sb.AppendLine($"    PPC_FPR f{fpr};");
+        if (contract.CrPossibleWriteMask != 0) sb.AppendLine("    uint32_t cr;");
+        if (contract.MayWriteXer) sb.AppendLine("    uint32_t xer;");
+        if (contract.MayWriteCtr) sb.AppendLine("    uint32_t ctr;");
+        if (contract.MayWriteLr) sb.AppendLine("    uint32_t lr;");
+        if (contract.MayWriteFpscr) sb.AppendLine("    uint32_t fpscr;");
+        for (var gqr = 0; gqr < 8; ++gqr)
+            if ((contract.GqrPossibleWriteMask & (1 << gqr)) != 0) sb.AppendLine($"    uint32_t gqr{gqr};");
+        for (var hid = 0; hid < 3; ++hid)
+            if ((contract.HidPossibleWriteMask & (1 << hid)) != 0) sb.AppendLine($"    uint32_t hid{hid};");
+        sb.AppendLine("};");
+        sb.AppendLine("#endif");
+    }
+
+    private static string StateFreeParameterList(GuestAbiContract contract, bool includeNames)
+    {
+        var parameters = new List<string>();
+        var gprInputs = StateFreeGprInputMask(contract);
+        for (var gpr = 0; gpr < 32; ++gpr)
+        {
+            if ((gprInputs & (1u << gpr)) != 0)
+                parameters.Add(includeNames ? $"uint32_t native_r{gpr}" : "uint32_t");
+        }
+        for (var fpr = 0; fpr < 32; ++fpr)
+        {
+            // Scalar writes preserve PS1, so the previous architectural FPR is
+            // conservatively an input until representation ownership proves a
+            // complete packed overwrite.
+            if (((contract.FprReadBeforeWriteMask | contract.FprPossibleWriteMask) & (1u << fpr)) != 0)
+                parameters.Add(includeNames ? $"PPC_FPR native_f{fpr}" : "PPC_FPR");
+        }
+        if (contract.CrReadBeforeWriteMask != 0 || contract.CrPossibleWriteMask != 0)
+            parameters.Add(includeNames ? "uint32_t native_cr" : "uint32_t");
+        if (contract.ReadsXerBeforeWrite || contract.MayWriteXer)
+            parameters.Add(includeNames ? "uint32_t native_xer" : "uint32_t");
+        if (contract.ReadsCtrBeforeWrite || contract.MayWriteCtr)
+            parameters.Add(includeNames ? "uint32_t native_ctr" : "uint32_t");
+        if (contract.ReadsLrBeforeWrite || contract.MayWriteLr)
+            parameters.Add(includeNames ? "uint32_t native_lr" : "uint32_t");
+        if (contract.ReadsFpscrBeforeWrite || contract.MayWriteFpscr)
+            parameters.Add(includeNames ? "uint32_t native_fpscr" : "uint32_t");
+        for (var gqr = 0; gqr < 8; ++gqr)
+            if (((contract.GqrReadBeforeWriteMask | contract.GqrPossibleWriteMask) & (1 << gqr)) != 0)
+                parameters.Add(includeNames ? $"uint32_t native_gqr{gqr}" : "uint32_t");
+        for (var hid = 0; hid < 3; ++hid)
+            if (((contract.HidReadBeforeWriteMask | contract.HidPossibleWriteMask) & (1 << hid)) != 0)
+                parameters.Add(includeNames ? $"uint32_t native_hid{hid}" : "uint32_t");
+        return string.Join(", ", parameters);
+    }
+
+    private static string StateFreeCallArguments(GuestAbiContract contract, uint? callSiteLr = null)
+    {
+        var arguments = new List<string>();
+        var gprInputs = StateFreeGprInputMask(contract);
+        for (var gpr = 0; gpr < 32; ++gpr)
+        {
+            if ((gprInputs & (1u << gpr)) != 0)
+                arguments.Add($"ctx->gpr[{gpr}]");
+        }
+        for (var fpr = 0; fpr < 32; ++fpr)
+            if (((contract.FprReadBeforeWriteMask | contract.FprPossibleWriteMask) & (1u << fpr)) != 0)
+                arguments.Add($"ctx->fpr[{fpr}]");
+        if (contract.CrReadBeforeWriteMask != 0 || contract.CrPossibleWriteMask != 0) arguments.Add("ctx->cr");
+        if (contract.ReadsXerBeforeWrite || contract.MayWriteXer) arguments.Add("ctx->xer");
+        if (contract.ReadsCtrBeforeWrite || contract.MayWriteCtr) arguments.Add("ctx->ctr");
+        if (contract.ReadsLrBeforeWrite || contract.MayWriteLr)
+            arguments.Add(callSiteLr.HasValue ? $"0x{callSiteLr.Value:X8}u" : "ctx->lr");
+        if (contract.ReadsFpscrBeforeWrite || contract.MayWriteFpscr) arguments.Add("ctx->fpscr");
+        for (var gqr = 0; gqr < 8; ++gqr)
+            if (((contract.GqrReadBeforeWriteMask | contract.GqrPossibleWriteMask) & (1 << gqr)) != 0)
+                arguments.Add($"ctx->gqr[{gqr}]");
+        for (var hid = 0; hid < 3; ++hid)
+            if (((contract.HidReadBeforeWriteMask | contract.HidPossibleWriteMask) & (1 << hid)) != 0)
+                arguments.Add($"ctx->hid{hid}");
+        return string.Join(", ", arguments);
+    }
+
+    // Resident marshalling: pass/receive the resident locals directly instead of naming ctx, which would
+    // force a full CpuContext spill/reload around every call even though residency already holds the
+    // values in host registers. The slow arm still flushes/reloads CpuContext; see EmitResidentStateFreeCall.
+
+    private static string StateFreeResidentCallArguments(
+        RegisterResidency residency, GuestAbiContract contract, uint? callSiteLr)
+    {
+        var arguments = new List<string>();
+        var gprInputs = StateFreeGprInputMask(contract);
+        for (var gpr = 0; gpr < 32; ++gpr)
+        {
+            if ((gprInputs & (1u << gpr)) != 0)
+                arguments.Add(residency.Gpr(gpr, written: false));
+        }
+        for (var fpr = 0; fpr < 32; ++fpr)
+            if (((contract.FprReadBeforeWriteMask | contract.FprPossibleWriteMask) & (1u << fpr)) != 0)
+                arguments.Add(residency.FprStorage(fpr, written: false));
+        if (contract.CrReadBeforeWriteMask != 0 || contract.CrPossibleWriteMask != 0)
+            arguments.Add(residency.Cr(written: false));
+        if (contract.ReadsXerBeforeWrite || contract.MayWriteXer) arguments.Add(residency.Xer(written: false));
+        if (contract.ReadsCtrBeforeWrite || contract.MayWriteCtr) arguments.Add(residency.Ctr(written: false));
+        // LR, FPSCR, the GQRs and the HID registers are never localized, so they
+        // keep their architectural spelling exactly as the ctx form uses.
+        if (contract.ReadsLrBeforeWrite || contract.MayWriteLr)
+            arguments.Add(callSiteLr.HasValue ? $"0x{callSiteLr.Value:X8}u" : "ctx->lr");
+        if (contract.ReadsFpscrBeforeWrite || contract.MayWriteFpscr) arguments.Add("ctx->fpscr");
+        for (var gqr = 0; gqr < 8; ++gqr)
+            if (((contract.GqrReadBeforeWriteMask | contract.GqrPossibleWriteMask) & (1 << gqr)) != 0)
+                arguments.Add($"ctx->gqr[{gqr}]");
+        for (var hid = 0; hid < 3; ++hid)
+            if (((contract.HidReadBeforeWriteMask | contract.HidPossibleWriteMask) & (1 << hid)) != 0)
+                arguments.Add($"ctx->hid{hid}");
+        return string.Join(", ", arguments);
+    }
+
+    /// <summary>
+    /// Result unpacking into the resident locals. Field/value order must match
+    /// <see cref="StateFreeReturnExpression"/> exactly, since this is a positional carrier for the
+    /// callee's packed one- and two-output shapes.
+    /// </summary>
+    private static void AppendStateFreeResidentResultStores(
+        StringBuilder sb, string pad, RegisterResidency residency,
+        GuestAbiContract contract, string resultName)
+    {
+        var outputCount = StateFreeOutputCount(contract);
+        var resultIndex = 0;
+        string Value(string field) => outputCount switch
+        {
+            1 => resultName,
+            2 => $"{resultName}[{resultIndex++}]",
+            _ => $"{resultName}.{field}"
+        };
+        for (var gpr = 0; gpr < 32; ++gpr)
+            if ((contract.GprPossibleWriteMask & (1u << gpr)) != 0)
+            {
+                var value = Value($"r{gpr}");
+                sb.AppendLine($"{pad}{residency.Gpr(gpr, written: true)} = static_cast<uint32_t>({value});");
+            }
+        for (var fpr = 0; fpr < 32; ++fpr)
+            if ((contract.FprPossibleWriteMask & (1u << fpr)) != 0)
+            {
+                var value = Value($"f{fpr}");
+                if (outputCount > 2) value += ".raw";
+                sb.AppendLine($"{pad}{residency.FprStorage(fpr, written: true)}.raw = static_cast<uint64_t>({value});");
+            }
+        if (contract.CrPossibleWriteMask != 0)
+            sb.AppendLine($"{pad}{residency.Cr(written: true)} = static_cast<uint32_t>({Value("cr")});");
+        if (contract.MayWriteXer)
+            sb.AppendLine($"{pad}{residency.Xer(written: true)} = static_cast<uint32_t>({Value("xer")});");
+        if (contract.MayWriteCtr)
+            sb.AppendLine($"{pad}{residency.Ctr(written: true)} = static_cast<uint32_t>({Value("ctr")});");
+        if (contract.MayWriteLr) sb.AppendLine($"{pad}ctx->lr = static_cast<uint32_t>({Value("lr")});");
+        if (contract.MayWriteFpscr) sb.AppendLine($"{pad}ctx->fpscr = static_cast<uint32_t>({Value("fpscr")});");
+        for (var gqr = 0; gqr < 8; ++gqr)
+            if ((contract.GqrPossibleWriteMask & (1 << gqr)) != 0)
+                sb.AppendLine($"{pad}ctx->gqr[{gqr}] = static_cast<uint32_t>({Value($"gqr{gqr}")});");
+        for (var hid = 0; hid < 3; ++hid)
+            if ((contract.HidPossibleWriteMask & (1 << hid)) != 0)
+                sb.AppendLine($"{pad}ctx->hid{hid} = static_cast<uint32_t>({Value($"hid{hid}")});");
+    }
+
+    /// <summary>
+    /// Emits one state-free call site whose fast arm marshals through the resident locals.
+    /// <para>The <c>InvokeDirectCpu</c> fallback arm is live code, not dead code, since a mod overlay
+    /// can replace any region member after this body was emitted, so it carries its own full
+    /// flush/reload pair; only the fast arm skips the CpuContext boundary.</para>
+    /// </summary>
+    private static void EmitResidentStateFreeCall(
+        StringBuilder sb,
+        string pad,
+        int bufferBaseLength,
+        uint address,
+        string symbol,
+        GuestAbiContract contract,
+        uint? callSiteLr,
+        IReadOnlyDictionary<uint, GuestAbiContract> stateFreeAbiContracts,
+        IReadOnlyDictionary<uint, string> stateFreeCallSymbols)
+    {
+        var residency = _activeResidency ?? throw new InvalidOperationException(
+            $"Resident state-free marshalling requested for 0x{address:X8} without an active residency.");
+
+        AppendFlush(sb, pad, ResidencyBoundarySync.StateFreeResidentOuter);
+        var inner = pad + "    ";
+        sb.AppendLine($"{pad}if ({StateFreeAvailabilityCondition(address, stateFreeAbiContracts, stateFreeCallSymbols)}) {{");
+        var arguments = StateFreeResidentCallArguments(residency, contract, callSiteLr);
+        if (StateFreeHasOutputs(contract))
+        {
+            // Uniquified by the call site's position in the translation unit,
+            // exactly like the CpuContext form.
+            var resultName = $"state_free_result_{address:X8}_{bufferBaseLength + sb.Length:X}";
+            sb.AppendLine($"{inner}const auto {resultName} = {symbol}({arguments});");
+            AppendStateFreeResidentResultStores(sb, inner, residency, contract, resultName);
+        }
+        else
+        {
+            sb.AppendLine($"{inner}{symbol}({arguments});");
+        }
+        sb.AppendLine($"{pad}}} else {{");
+        AppendFlush(sb, inner, ResidencyBoundarySync.Full);
+        RecordEmittedDirectCallTarget(address);
+        sb.AppendLine($"{inner}InvokeDirectCpu<0x{address:X8}u>(ctx);");
+        AppendReload(sb, inner, ResidencyBoundarySync.Full);
+        sb.AppendLine($"{pad}}}");
+    }
+
+    private static void AppendStateFreeResultStores(
+        StringBuilder sb, string pad, uint address, GuestAbiContract contract, string resultName)
+    {
+        var outputCount = StateFreeOutputCount(contract);
+        var resultIndex = 0;
+        string Value(string field) => outputCount switch
+        {
+            1 => resultName,
+            2 => $"{resultName}[{resultIndex++}]",
+            _ => $"{resultName}.{field}"
+        };
+        for (var gpr = 0; gpr < 32; ++gpr)
+            if ((contract.GprPossibleWriteMask & (1u << gpr)) != 0)
+            {
+                var value = Value($"r{gpr}");
+                sb.AppendLine($"{pad}ctx->gpr[{gpr}] = static_cast<uint32_t>({value});");
+            }
+        for (var fpr = 0; fpr < 32; ++fpr)
+            if ((contract.FprPossibleWriteMask & (1u << fpr)) != 0)
+            {
+                var value = Value($"f{fpr}");
+                if (outputCount > 2) value += ".raw";
+                sb.AppendLine($"{pad}ctx->fpr[{fpr}].raw = static_cast<uint64_t>({value});");
+            }
+        if (contract.CrPossibleWriteMask != 0) sb.AppendLine($"{pad}ctx->cr = static_cast<uint32_t>({Value("cr")});");
+        if (contract.MayWriteXer) sb.AppendLine($"{pad}ctx->xer = static_cast<uint32_t>({Value("xer")});");
+        if (contract.MayWriteCtr) sb.AppendLine($"{pad}ctx->ctr = static_cast<uint32_t>({Value("ctr")});");
+        if (contract.MayWriteLr) sb.AppendLine($"{pad}ctx->lr = static_cast<uint32_t>({Value("lr")});");
+        if (contract.MayWriteFpscr) sb.AppendLine($"{pad}ctx->fpscr = static_cast<uint32_t>({Value("fpscr")});");
+        for (var gqr = 0; gqr < 8; ++gqr)
+            if ((contract.GqrPossibleWriteMask & (1 << gqr)) != 0) sb.AppendLine($"{pad}ctx->gqr[{gqr}] = static_cast<uint32_t>({Value($"gqr{gqr}")});");
+        for (var hid = 0; hid < 3; ++hid)
+            if ((contract.HidPossibleWriteMask & (1 << hid)) != 0) sb.AppendLine($"{pad}ctx->hid{hid} = static_cast<uint32_t>({Value($"hid{hid}")});");
+    }
+
+    private static string StateFreeReturnExpression(GuestAbiContract contract, string body)
+    {
+        var values = new List<string>();
+        var packed = StateFreeOutputCount(contract) <= 2;
+        var declared = CollectStateFreeCachedDeclarations(body);
+        for (var gpr = 0; gpr < 32; ++gpr)
+            if ((contract.GprPossibleWriteMask & (1u << gpr)) != 0)
+            {
+                var cached = $"cached_r{gpr}";
+                var value = declared.Contains(cached) ? cached : $"native_r{gpr}";
+                values.Add(packed ? $"static_cast<uint64_t>({value})" : value);
+            }
+        for (var fpr = 0; fpr < 32; ++fpr)
+            if ((contract.FprPossibleWriteMask & (1u << fpr)) != 0)
+            {
+                var cached = $"cached_f{fpr}";
+                var value = declared.Contains(cached) ? cached : $"native_f{fpr}";
+                values.Add(packed ? $"{value}.raw" : value);
+            }
+        if (contract.CrPossibleWriteMask != 0)
+        {
+            var value = declared.Contains("cached_cr") ? "cached_cr" : "native_cr";
+            values.Add(packed ? $"static_cast<uint64_t>({value})" : value);
+        }
+        if (contract.MayWriteXer)
+        {
+            var value = declared.Contains("cached_xer") ? "cached_xer" : "native_xer";
+            values.Add(packed ? $"static_cast<uint64_t>({value})" : value);
+        }
+        if (contract.MayWriteCtr)
+        {
+            var value = declared.Contains("cached_ctr") ? "cached_ctr" : "native_ctr";
+            values.Add(packed ? $"static_cast<uint64_t>({value})" : value);
+        }
+        if (contract.MayWriteLr) values.Add(packed ? "static_cast<uint64_t>(native_lr)" : "native_lr");
+        if (contract.MayWriteFpscr) values.Add(packed ? "static_cast<uint64_t>(native_fpscr)" : "native_fpscr");
+        for (var gqr = 0; gqr < 8; ++gqr)
+            if ((contract.GqrPossibleWriteMask & (1 << gqr)) != 0)
+                values.Add(packed ? $"static_cast<uint64_t>(native_gqr{gqr})" : $"native_gqr{gqr}");
+        for (var hid = 0; hid < 3; ++hid)
+            if ((contract.HidPossibleWriteMask & (1 << hid)) != 0)
+                values.Add(packed ? $"static_cast<uint64_t>(native_hid{hid})" : $"native_hid{hid}");
+        return values.Count == 1
+            ? $"return {values[0]};"
+            : $"return {{ {string.Join(", ", values)} }};";
+    }
+
+    private static string RemoveStateFreeDirectCallFallbacks(string body)
+    {
+        const string prefix = "if (MkwStateFreeAbiEnabled(";
+        var search = 0;
+        while ((search = body.IndexOf(prefix, search, StringComparison.Ordinal)) >= 0)
+        {
+            var open = body.IndexOf('{', search);
+            if (open < 0) break;
+            var trueClose = FindMatchingBrace(body, open);
+            if (trueClose < 0) break;
+            var cursor = trueClose + 1;
+            while (cursor < body.Length && char.IsWhiteSpace(body[cursor])) ++cursor;
+            if (!body.AsSpan(cursor).StartsWith("else", StringComparison.Ordinal))
+            {
+                search = trueClose + 1;
+                continue;
+            }
+            cursor += 4;
+            while (cursor < body.Length && char.IsWhiteSpace(body[cursor])) ++cursor;
+            if (cursor >= body.Length || body[cursor] != '{')
+            {
+                search = trueClose + 1;
+                continue;
+            }
+            var falseClose = FindMatchingBrace(body, cursor);
+            if (falseClose < 0) break;
+            var fastBody = body[(open + 1)..trueClose];
+            body = body[..search] + fastBody + body[(falseClose + 1)..];
+            search += fastBody.Length;
+        }
+        return body;
+
+        static int FindMatchingBrace(string text, int open)
+        {
+            var depth = 0;
+            for (var index = open; index < text.Length; ++index)
+            {
+                if (text[index] == '{') ++depth;
+                else if (text[index] == '}' && --depth == 0) return index;
+            }
+            return -1;
+        }
+    }
+
+    private static string ExtractFunctionBody(string code, string implementationName)
+    {
+        var declaration = FunctionDefinitionSignature(implementationName);
+        var declarationStart = code.IndexOf(declaration, StringComparison.Ordinal);
+        if (declarationStart < 0)
+            throw new InvalidOperationException($"Could not find ordinary body for {implementationName}.");
+        var openBrace = code.IndexOf('{', declarationStart + declaration.Length);
+        if (openBrace < 0)
+            throw new InvalidOperationException($"Could not find opening brace for {implementationName}.");
+        var closeBrace = FindFunctionCloseBrace(code, openBrace, implementationName);
+        return code[openBrace..(closeBrace + 1)];
+    }
+
+    private static string ReplaceFunctionBody(string code, string implementationName, string replacementBody)
+    {
+        var declaration = FunctionDefinitionSignature(implementationName);
+        var declarationStart = code.IndexOf(declaration, StringComparison.Ordinal);
+        if (declarationStart < 0)
+            throw new InvalidOperationException($"Could not find cached body for {implementationName}.");
+        var openBrace = code.IndexOf('{', declarationStart + declaration.Length);
+        if (openBrace < 0)
+            throw new InvalidOperationException($"Could not find cached opening brace for {implementationName}.");
+        var closeBrace = FindFunctionCloseBrace(code, openBrace, implementationName);
+        return code[..openBrace] + replacementBody + code[(closeBrace + 1)..];
+    }
+
+    private static int FindFunctionCloseBrace(string code, int openBrace, string implementationName)
+    {
+        var depth = 0;
+        for (var index = openBrace; index < code.Length; ++index)
+        {
+            if (code[index] == '{') ++depth;
+            else if (code[index] == '}' && --depth == 0) return index;
+        }
+        throw new InvalidOperationException($"Found unterminated body for {implementationName}.");
+    }
+
+    /// <summary>
+    /// Appends one explicit-state clone. <paramref name="facts"/> reports the interface the clone
+    /// actually published, since the contract is refined while the body is rewritten (body-derived
+    /// GQR inputs) and the caller cannot predict it upfront.
+    /// </summary>
+    private static string AppendStateFreeLeafVariant(
+        string code,
+        string implementationName,
+        string stateFreeSymbol,
+        uint entryPoint,
+        GuestAbiContract contract,
+        out GuestStateFreeEmissionFacts facts,
+        bool preferInline = false,
+        IReadOnlySet<uint>? boundaryContextTargets = null,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts = null)
+    {
+        if (!IsStateFreeCallSafe(contract))
+            throw new InvalidOperationException($"State-free ABI at 0x{entryPoint:X8} crosses a full-context boundary.");
+
+        var declaration = FunctionDefinitionSignature(implementationName);
+        var declarationStart = code.IndexOf(declaration, StringComparison.Ordinal);
+        if (declarationStart < 0)
+            throw new InvalidOperationException($"State-free ABI could not find the leaf body for 0x{entryPoint:X8}.");
+        var openBrace = code.IndexOf('{', declarationStart + declaration.Length);
+        if (openBrace < 0)
+            throw new InvalidOperationException($"State-free ABI found no body for 0x{entryPoint:X8}.");
+
+        var depth = 0;
+        var closeBrace = -1;
+        for (var index = openBrace; index < code.Length; ++index)
+        {
+            if (code[index] == '{') ++depth;
+            else if (code[index] == '}' && --depth == 0)
+            {
+                closeBrace = index;
+                break;
+            }
+        }
+        if (closeBrace < 0)
+            throw new InvalidOperationException($"State-free ABI found an unterminated body for 0x{entryPoint:X8}.");
+
+        var body = code[(openBrace + 1)..closeBrace];
+        body = StateFreePatterns.DifferentialBlock.Replace(body, Environment.NewLine);
+        body = RemoveStateFreeDirectCallFallbacks(body);
+
+        // One scan per shape instead of one rebuilt pattern per GQR. The
+        // captured index text is compared literally, so a hypothetical
+        // zero-padded spelling stays a miss exactly as it was before.
+        var referencedGqrIndices = new HashSet<string>(StringComparer.Ordinal);
+        foreach (Match match in StateFreePatterns.CtxGqrAccess.Matches(body))
+        {
+            referencedGqrIndices.Add(match.Groups[1].Value);
+        }
+
+        foreach (Match match in StateFreePatterns.PsqInlineGqrOperand.Matches(body))
+        {
+            referencedGqrIndices.Add(match.Groups[1].Value);
+        }
+
+        byte bodyGqrInputs = 0;
+        for (var gqr = 0; gqr < 8; ++gqr)
+        {
+            if (referencedGqrIndices.Contains(gqr.ToString(System.Globalization.CultureInfo.InvariantCulture)))
+                bodyGqrInputs |= (byte)(1 << gqr);
+        }
+        contract = contract with
+        {
+            GqrReadBeforeWriteMask = (byte)(contract.GqrReadBeforeWriteMask | bodyGqrInputs)
+        };
+
+        // Public PPC ABI flushes are replaced by explicit native results.
+        body = StateFreePatterns.CachedGprFlush.Replace(body, string.Empty);
+        body = StateFreePatterns.CachedSpecialFlush.Replace(body, string.Empty);
+        body = StateFreePatterns.CachedFprFlush.Replace(body, string.Empty);
+
+        // The per-register replacements below are order sensitive and stay a
+        // sequential chain. These guards only skip scans that provably cannot
+        // match: nothing in the chain ever introduces one of these markers.
+        var containsCachedGpr = body.Contains("cached_r", StringComparison.Ordinal);
+        var containsCtxGpr = body.Contains("ctx->gpr[", StringComparison.Ordinal);
+        var containsCachedFpr = body.Contains("cached_f", StringComparison.Ordinal);
+        var containsCtxFpr = body.Contains("ctx->fpr[", StringComparison.Ordinal);
+        for (var gpr = 0; gpr < 32 && (containsCachedGpr || containsCtxGpr); ++gpr)
+        {
+            // A function can have several return blocks, and later formatting
+            // may place a flush beside a label instead of at the start of a
+            // physical line. Remove the exact architectural write wherever it
+            // occurs; the cached value remains authoritative inside this clone.
+            if (containsCachedGpr && containsCtxGpr)
+                body = body.Replace($"ctx->gpr[{gpr}] = cached_r{gpr};", string.Empty, StringComparison.Ordinal);
+            if ((StateFreeGprInputMask(contract) & (1u << gpr)) != 0)
+            {
+                if (containsCtxGpr)
+                    body = body.Replace($"ctx->gpr[{gpr}]", $"native_r{gpr}", StringComparison.Ordinal);
+            }
+            else if (containsCachedGpr && containsCtxGpr)
+            {
+                body = body.Replace(
+                    $"uint32_t cached_r{gpr} = ctx->gpr[{gpr}];",
+                    $"uint32_t cached_r{gpr}{{}};",
+                    StringComparison.Ordinal);
+            }
+        }
+        for (var fpr = 0; fpr < 32 && (containsCachedFpr || containsCtxFpr); ++fpr)
+        {
+            if (containsCachedFpr && containsCtxFpr)
+                body = body.Replace($"ctx->fpr[{fpr}] = cached_f{fpr};", string.Empty, StringComparison.Ordinal);
+            if (((contract.FprReadBeforeWriteMask | contract.FprPossibleWriteMask) & (1u << fpr)) != 0)
+            {
+                if (containsCtxFpr)
+                    body = body.Replace($"ctx->fpr[{fpr}]", $"native_f{fpr}", StringComparison.Ordinal);
+            }
+            else if (containsCachedFpr && containsCtxFpr)
+            {
+                body = body.Replace(
+                    $"PPC_FPR cached_f{fpr} = ctx->fpr[{fpr}];",
+                    $"PPC_FPR cached_f{fpr}{{}};",
+                    StringComparison.Ordinal);
+            }
+        }
+        body = body.Replace("ctx->cr = cached_cr;", string.Empty, StringComparison.Ordinal);
+        body = body.Replace("ctx->xer = cached_xer;", string.Empty, StringComparison.Ordinal);
+        body = body.Replace("ctx->ctr = cached_ctr;", string.Empty, StringComparison.Ordinal);
+        body = body.Replace("ctx->lr = cached_lr;", string.Empty, StringComparison.Ordinal);
+        if (contract.CrReadBeforeWriteMask != 0 || contract.CrPossibleWriteMask != 0)
+            body = body.Replace("ctx->cr", "native_cr", StringComparison.Ordinal);
+        if (contract.ReadsXerBeforeWrite || contract.MayWriteXer)
+            body = body.Replace("ctx->xer", "native_xer", StringComparison.Ordinal);
+        if (contract.ReadsCtrBeforeWrite || contract.MayWriteCtr)
+            body = body.Replace("ctx->ctr", "native_ctr", StringComparison.Ordinal);
+        if (contract.ReadsLrBeforeWrite || contract.MayWriteLr)
+            body = body.Replace("ctx->lr", "native_lr", StringComparison.Ordinal);
+        else
+            body = StateFreePatterns.LrStore.Replace(body, string.Empty);
+        if (contract.ReadsFpscrBeforeWrite || contract.MayWriteFpscr)
+            body = body.Replace("ctx->fpscr", "native_fpscr", StringComparison.Ordinal);
+        for (var gqr = 0; gqr < 8; ++gqr)
+            if (((contract.GqrReadBeforeWriteMask | contract.GqrPossibleWriteMask) & (1 << gqr)) != 0)
+            {
+                body = body.Replace($"ctx->gqr[{gqr}]", $"native_gqr{gqr}", StringComparison.Ordinal);
+                body = body.Replace($"ctx->gqr[{gqr}u]", $"native_gqr{gqr}", StringComparison.Ordinal);
+            }
+        for (var hid = 0; hid < 3; ++hid)
+            if (((contract.HidReadBeforeWriteMask | contract.HidPossibleWriteMask) & (1 << hid)) != 0)
+                body = body.Replace($"ctx->hid{hid}", $"native_hid{hid}", StringComparison.Ordinal);
+
+        if (boundaryContextTargets is { Count: > 0 })
+        {
+            var boundaryContracts = guestAbiContracts ?? throw new InvalidOperationException(
+                $"State-free boundary contracts are missing for 0x{entryPoint:X8}.");
+            body = EnsureStateFreeBoundarySpecialLocals(
+                body, entryPoint, boundaryContextTargets, boundaryContracts);
+            body = RewriteStateFreeBoundaryCalls(
+                body, entryPoint, boundaryContextTargets,
+                boundaryContracts);
+        }
+
+        // Generic PSQ helpers need only the selected GQR value. Keep that value
+        // in the native signature instead of reintroducing CpuContext solely to
+        // read one array element inside an otherwise direct memory operation.
+        body = StateFreePatterns.PsqLInline.Replace(body,
+            static match => $"PPC_PsqLStateInline<{match.Groups["w"].Value}u, {match.Groups["i"].Value}u, false>(native_gqr{match.Groups["i"].Value}, ");
+        body = StateFreePatterns.PsqLStackInline.Replace(body,
+            static match => $"PPC_PsqLStateInline<{match.Groups["w"].Value}u, {match.Groups["i"].Value}u, true>(native_gqr{match.Groups["i"].Value}, ");
+        body = StateFreePatterns.PsqStInline.Replace(body,
+            static match => $"PPC_PsqStStateInline<{match.Groups["w"].Value}u, {match.Groups["i"].Value}u, false>(native_gqr{match.Groups["i"].Value}, ");
+        body = StateFreePatterns.PsqStStackInline.Replace(body,
+            static match => $"PPC_PsqStStateInline<{match.Groups["w"].Value}u, {match.Groups["i"].Value}u, true>(native_gqr{match.Groups["i"].Value}, ");
+        body = StateFreePatterns.PsqLResolvedInline.Replace(body,
+            static match => $"PPC_PsqLResolvedStateInline<{match.Groups["w"].Value}u, {match.Groups["i"].Value}u>(native_gqr{match.Groups["i"].Value}, ");
+        body = StateFreePatterns.PsqStResolvedInline.Replace(body,
+            static match => $"PPC_PsqStResolvedStateInline<{match.Groups["w"].Value}u, {match.Groups["i"].Value}u>(native_gqr{match.Groups["i"].Value}, ");
+        body = StateFreePatterns.PsqKnownInline.Replace(body, "$1(nullptr, ");
+
+        // The process-wide A/B gate belongs only at CpuContext-to-explicit-state
+        // entry boundaries. Once execution is inside a context-free region its
+        // direct descendants must remain context-free as well.
+        if (contract.CrReadBeforeWriteMask == 0 && contract.CrPossibleWriteMask == 0)
+            body = body.Replace("uint32_t cached_cr = ctx->cr;", "uint32_t cached_cr = 0;", StringComparison.Ordinal);
+        if (!contract.ReadsXerBeforeWrite && !contract.MayWriteXer)
+            body = body.Replace("uint32_t cached_xer = ctx->xer;", "uint32_t cached_xer = 0;", StringComparison.Ordinal);
+        if (!contract.ReadsCtrBeforeWrite && !contract.MayWriteCtr)
+            body = body.Replace("uint32_t cached_ctr = ctx->ctr;", "uint32_t cached_ctr = 0;", StringComparison.Ordinal);
+
+        if (StateFreeHasOutputs(contract))
+        {
+            var result = StateFreeReturnExpression(contract, body);
+            body = StateFreePatterns.BareReturn.Replace(body, result);
+            if (!StateFreePatterns.AggregateReturn.IsMatch(body))
+                body += Environment.NewLine + "    " + result + Environment.NewLine;
+        }
+
+        if (StateFreePatterns.ContextWord.IsMatch(body))
+        {
+            var retained = string.Join(" | ", body
+                .Split(new[] { "\r\n", "\n" }, StringSplitOptions.None)
+                .Where(static line => StateFreePatterns.ContextWord.IsMatch(line))
+                .Select(static line => line.Trim()));
+            throw new InvalidOperationException(
+                $"State-free ABI at 0x{entryPoint:X8} retained CpuContext access: {retained}");
+        }
+
+        var variant = new StringBuilder(body.Length + 512);
+        variant.AppendLine();
+        AppendStateFreeResultDeclaration(variant, entryPoint, contract);
+        var bodyAttribute = preferInline ? "MKW_PPC_ALWAYS_INLINE_BODY" : "MKW_PPC_NO_INLINE";
+        variant.AppendLine($"extern \"C\" {bodyAttribute} {StateFreeReturnType(entryPoint, contract)} {StateFreeCallingConvention(contract)}{stateFreeSymbol}({StateFreeParameterList(contract, includeNames: true)})");
+        variant.AppendLine("{");
+        variant.Append(body);
+        if (!body.EndsWith('\n')) variant.AppendLine();
+        variant.AppendLine("}");
+        facts = new GuestStateFreeEmissionFacts(
+            entryPoint, stateFreeSymbol, contract, StateFreeGprInputMask(contract));
+        variant.AppendLine($"// RECOMP_STATE_FREE_ABI address=0x{entryPoint:X8} symbol={stateFreeSymbol} " +
+                           $"gpr_in=0x{StateFreeGprInputMask(contract):X8} gpr_out=0x{contract.GprPossibleWriteMask:X8} " +
+                           $"fpr_in=0x{contract.FprReadBeforeWriteMask:X8} fpr_out=0x{contract.FprPossibleWriteMask:X8} " +
+                           $"cr_in=0x{contract.CrReadBeforeWriteMask:X2} cr_out=0x{contract.CrPossibleWriteMask:X2} " +
+                           $"gqr_in=0x{contract.GqrReadBeforeWriteMask:X2} hid_in=0x{contract.HidReadBeforeWriteMask:X2} hid_out=0x{contract.HidPossibleWriteMask:X2} " +
+                           $"xer_in={(contract.ReadsXerBeforeWrite ? 1 : 0)} ctr_in={(contract.ReadsCtrBeforeWrite ? 1 : 0)} lr_in={(contract.ReadsLrBeforeWrite ? 1 : 0)}");
+        return code.Insert(closeBrace + 1, variant.ToString());
+    }
+
+    private static string RewriteStateFreeBoundaryCalls(
+        string body,
+        uint entryPoint,
+        IReadOnlySet<uint> boundaryTargets,
+        IReadOnlyDictionary<uint, GuestAbiContract> contracts)
+    {
+        // The body is fixed for the whole rewrite, so the cached-local inventory
+        // is collected once instead of once per register per matched call site.
+        var declared = CollectStateFreeCachedDeclarations(body);
+        return StateFreePatterns.BoundaryDirectCall.Replace(body, match =>
+        {
+            var address = uint.Parse(match.Groups["address"].Value,
+                System.Globalization.NumberStyles.HexNumber,
+                System.Globalization.CultureInfo.InvariantCulture);
+            if (!boundaryTargets.Contains(address))
+                return match.Value;
+            if (!contracts.TryGetValue(address, out var boundary) || boundary.HasFullSynchronizationFence)
+                throw new InvalidOperationException(
+                    $"Fused state-free boundary 0x{entryPoint:X8} -> 0x{address:X8} has no precise contract.");
+
+            var pad = match.Groups["pad"].Value;
+            var replacement = new StringBuilder();
+            string CurrentGpr(int index) =>
+                declared.Contains($"cached_r{index}") ? $"cached_r{index}" : $"native_r{index}";
+            string CurrentFpr(int index) =>
+                declared.Contains($"cached_f{index}") ? $"cached_f{index}" : $"native_f{index}";
+            var inputGprs = boundary.GprReadBeforeWriteMask | boundary.GprPossibleWriteMask;
+            var inputFprs = boundary.FprReadBeforeWriteMask | boundary.FprPossibleWriteMask;
+            for (var gpr = 0; gpr < 32; ++gpr)
+                if ((inputGprs & (1u << gpr)) != 0)
+                    replacement.AppendLine($"{pad}fused_boundary_ctx->gpr[{gpr}] = {CurrentGpr(gpr)};");
+            for (var fpr = 0; fpr < 32; ++fpr)
+                if ((inputFprs & (1u << fpr)) != 0)
+                    replacement.AppendLine($"{pad}fused_boundary_ctx->fpr[{fpr}] = {CurrentFpr(fpr)};");
+            if (boundary.CrReadBeforeWriteMask != 0 || boundary.CrPossibleWriteMask != 0)
+                replacement.AppendLine($"{pad}fused_boundary_ctx->cr = cached_cr;");
+            if (boundary.ReadsXerBeforeWrite || boundary.MayWriteXer)
+                replacement.AppendLine($"{pad}fused_boundary_ctx->xer = cached_xer;");
+            if (boundary.ReadsCtrBeforeWrite || boundary.MayWriteCtr)
+                replacement.AppendLine($"{pad}fused_boundary_ctx->ctr = cached_ctr;");
+            if (boundary.ReadsLrBeforeWrite || boundary.MayWriteLr)
+                replacement.AppendLine($"{pad}fused_boundary_ctx->lr = native_lr;");
+            if (boundary.ReadsFpscrBeforeWrite || boundary.MayWriteFpscr)
+                replacement.AppendLine($"{pad}fused_boundary_ctx->fpscr = native_fpscr;");
+            for (var gqr = 0; gqr < 8; ++gqr)
+                if (((boundary.GqrReadBeforeWriteMask | boundary.GqrPossibleWriteMask) & (1 << gqr)) != 0)
+                    replacement.AppendLine($"{pad}fused_boundary_ctx->gqr[{gqr}] = native_gqr{gqr};");
+            for (var hid = 0; hid < 3; ++hid)
+                if (((boundary.HidReadBeforeWriteMask | boundary.HidPossibleWriteMask) & (1 << hid)) != 0)
+                    replacement.AppendLine($"{pad}fused_boundary_ctx->hid{hid} = native_hid{hid};");
+
+            replacement.AppendLine($"{pad}InvokeDirectCpu<0x{address:X8}u>(fused_boundary_ctx);");
+
+            for (var gpr = 0; gpr < 32; ++gpr)
+                if ((boundary.GprPossibleWriteMask & (1u << gpr)) != 0)
+                    replacement.AppendLine($"{pad}{CurrentGpr(gpr)} = fused_boundary_ctx->gpr[{gpr}];");
+            for (var fpr = 0; fpr < 32; ++fpr)
+                if ((boundary.FprPossibleWriteMask & (1u << fpr)) != 0)
+                    replacement.AppendLine($"{pad}{CurrentFpr(fpr)} = fused_boundary_ctx->fpr[{fpr}];");
+            if (boundary.CrPossibleWriteMask != 0)
+                replacement.AppendLine($"{pad}cached_cr = fused_boundary_ctx->cr;");
+            if (boundary.MayWriteXer)
+                replacement.AppendLine($"{pad}cached_xer = fused_boundary_ctx->xer;");
+            if (boundary.MayWriteCtr)
+                replacement.AppendLine($"{pad}cached_ctr = fused_boundary_ctx->ctr;");
+            if (boundary.MayWriteLr)
+                replacement.AppendLine($"{pad}native_lr = fused_boundary_ctx->lr;");
+            if (boundary.MayWriteFpscr)
+                replacement.AppendLine($"{pad}native_fpscr = fused_boundary_ctx->fpscr;");
+            for (var gqr = 0; gqr < 8; ++gqr)
+                if ((boundary.GqrPossibleWriteMask & (1 << gqr)) != 0)
+                    replacement.AppendLine($"{pad}native_gqr{gqr} = fused_boundary_ctx->gqr[{gqr}];");
+            for (var hid = 0; hid < 3; ++hid)
+                if ((boundary.HidPossibleWriteMask & (1 << hid)) != 0)
+                    replacement.AppendLine($"{pad}native_hid{hid} = fused_boundary_ctx->hid{hid};");
+            return replacement.ToString().TrimEnd();
+        });
+    }
+
+    private static string EnsureStateFreeBoundarySpecialLocals(
+        string body,
+        uint entryPoint,
+        IReadOnlySet<uint> boundaryTargets,
+        IReadOnlyDictionary<uint, GuestAbiContract> contracts)
+    {
+        var needsCr = false;
+        var needsXer = false;
+        var needsCtr = false;
+        // Collected in one pass; the per-target patterns only differed in the
+        // literal address, and the address text they matched is captured here.
+        var presentBoundaryAddresses = new HashSet<string>(StringComparer.Ordinal);
+        foreach (Match match in StateFreePatterns.BoundaryDirectCallAddress.Matches(body))
+        {
+            presentBoundaryAddresses.Add(match.Groups[1].Value);
+        }
+
+        foreach (var address in boundaryTargets)
+        {
+            // The selector owns one boundary set for the whole fused region,
+            // while this method is producing one member clone. Only calls that
+            // actually occur in this member contribute to its local residency
+            // and signature requirements.
+            if (!presentBoundaryAddresses.Contains(address.ToString("X8", System.Globalization.CultureInfo.InvariantCulture)))
+                continue;
+            if (!contracts.TryGetValue(address, out var boundary) || boundary.HasFullSynchronizationFence)
+                throw new InvalidOperationException(
+                    $"Fused state-free boundary 0x{entryPoint:X8} -> 0x{address:X8} has no precise contract.");
+            needsCr |= boundary.CrReadBeforeWriteMask != 0 || boundary.CrPossibleWriteMask != 0;
+            needsXer |= boundary.ReadsXerBeforeWrite || boundary.MayWriteXer;
+            needsCtr |= boundary.ReadsCtrBeforeWrite || boundary.MayWriteCtr;
+        }
+
+        // A region's interprocedural contract can make special state live solely because an outlined
+        // descendant observes it, even when the root body never created the usual cached local. Derive
+        // these locals from the precise boundary contracts rather than incidental root-body instructions.
+        var declarations = new StringBuilder();
+        var declared = needsCr || needsXer || needsCtr
+            ? CollectStateFreeCachedDeclarations(body)
+            : null;
+        if (needsCr && !declared!.Contains("cached_cr"))
+            declarations.AppendLine("    uint32_t cached_cr = native_cr;");
+        if (needsXer && !declared!.Contains("cached_xer"))
+            declarations.AppendLine("    uint32_t cached_xer = native_xer;");
+        if (needsCtr && !declared!.Contains("cached_ctr"))
+            declarations.AppendLine("    uint32_t cached_ctr = native_ctr;");
+        return declarations.Length == 0 ? body : declarations + body;
+    }
+
+}
diff --git a/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.cs b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.cs
new file mode 100644
index 0000000..17b7fe4
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/CxxLinearCodeGenerator.cs
@@ -0,0 +1,1024 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Analysis;
+using Translator.Core.Ir;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Representation;
+using Translator.Core.Translation;
+
+namespace Translator.Core.CodeGen;
+
+/// <summary>
+/// Conservative C++ emitter that writes guest registers directly through CpuContext.
+/// Non-register temporaries still use ordinary local variables.
+/// </summary>
+public sealed partial class CxxLinearCodeGenerator
+{
+    /// <summary>
+    /// <c>MKW_RESTRICT</c> tells the host compiler guest memory via <c>Memory::</c> cannot alias ctx, so
+    /// resident locals stay in host registers. Restrict isn't part of the type, so forward decls use plain <c>CpuContext* ctx</c>.
+    /// </summary>
+    internal const string CpuContextDefinitionParameter = "CpuContext* MKW_RESTRICT ctx";
+
+    internal static string FunctionDefinitionSignature(string name) =>
+        $"extern \"C\" void {name}({CpuContextDefinitionParameter})";
+
+    private readonly IGuestFunctionAbiProvider _guestAbiProvider;
+
+    /// <summary>
+    /// Reused scratch buffer for <c>EmitFunctionBody</c>, which emits a body up to three times
+    /// (discovery, public entry, state-free fallback); checked out while in use so nested emission allocates its own.
+    /// </summary>
+    [ThreadStatic]
+    private static StringBuilder? _reusableFunctionBodyBuilder;
+
+    private const int FunctionBodyBuilderCapacity = 16 * 1024;
+
+    public CxxLinearCodeGenerator(IGuestFunctionAbiProvider? guestAbiProvider = null)
+    {
+        _guestAbiProvider = guestAbiProvider ?? EmptyGuestFunctionAbiProvider.Instance;
+    }
+
+    /// <summary>
+    /// Direct-call boundaries materialized by the body currently being emitted. The emitter is
+    /// the authority here, replacing scanning emitted text for <c>InvokeDirectCpu</c>; recording
+    /// is idempotent since a body can emit more than once (discovery, public entry, state-free fallback).
+    /// </summary>
+    [ThreadStatic]
+    private static SortedSet<uint>? _emittedDirectCallTargets;
+
+    private static void RecordEmittedDirectCallTarget(uint target) =>
+        _emittedDirectCallTargets?.Add(target);
+
+    /// <summary>
+    /// Guest addresses appearing as an emitted <c>loc_XXXXXXXX</c> label (definition or goto
+    /// target) in the body currently being emitted; replaces scanning emitted text to find a
+    /// translated function's interior resume points.
+    /// </summary>
+    [ThreadStatic]
+    private static SortedSet<uint>? _emittedLocalLabelAddresses;
+
+    private static void RecordEmittedLocalLabel(string cxxLabel)
+    {
+        if (_emittedLocalLabelAddresses is null) return;
+        const string prefix = "loc_";
+        if (!cxxLabel.StartsWith(prefix, StringComparison.Ordinal)) return;
+        if (uint.TryParse(
+                cxxLabel.AsSpan(prefix.Length),
+                System.Globalization.NumberStyles.HexNumber,
+                System.Globalization.CultureInfo.InvariantCulture,
+                out var address))
+        {
+            _emittedLocalLabelAddresses.Add(address);
+        }
+    }
+
+
+    public CxxEmissionResult EmitWithFacts(uint entryPoint,
+        SsaResult ssa,
+        FunctionAbiClassification signature,
+        RepresentationEnvironment types,
+        bool emitModRegistration = false,
+        uint modRegistrationPriority = 100,
+        ulong modRegistrationModuleId = 1,
+        IReadOnlySet<uint>? nonReturningCallTargets = null,
+        IReadOnlySet<uint>? lrContinuationCallTargets = null,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts = null,
+        bool emitStateFreeLeafVariant = false,
+        IReadOnlyDictionary<uint, GuestAbiContract>? stateFreeAbiContracts = null,
+        IReadOnlyDictionary<uint, string>? stateFreeCallSymbols = null,
+        IReadOnlyDictionary<GuestStateFreeCallSiteKey, GuestStateFreeCallVariant>? stateFreeCallSiteVariants = null,
+        IReadOnlyList<GuestStateFreeCallVariant>? stateFreeEntryVariants = null,
+        uint? moduleLinkBase = null,
+        uint? moduleGuestBase = null,
+        uint moduleLinkedCodeSize = 0,
+        IReadOnlyDictionary<string, uint>? gqrEntryConstants = null,
+        IReadOnlyDictionary<uint, byte>? gqrCalleeWriteMasks = null,
+        bool gqrConstantsRequireRuntimeGuard = false,
+        bool enableLeafAbiSpillElision = false,
+        IReadOnlySet<uint>? modOverridableCallTargets = null,
+        bool enableGpuFifoBurstCoalescing = true)
+    {
+        modOverridableCallTargets ??= new HashSet<uint>();
+        nonReturningCallTargets ??= new HashSet<uint>();
+        lrContinuationCallTargets ??= new HashSet<uint>();
+        guestAbiContracts ??= new Dictionary<uint, GuestAbiContract>();
+        stateFreeAbiContracts ??= new Dictionary<uint, GuestAbiContract>();
+        stateFreeCallSymbols ??= new Dictionary<uint, string>();
+        stateFreeCallSiteVariants ??= new Dictionary<GuestStateFreeCallSiteKey, GuestStateFreeCallVariant>();
+        stateFreeEntryVariants ??= Array.Empty<GuestStateFreeCallVariant>();
+        // Register-class selection is not a proof that guest ABI stack traffic
+        // can be removed. Keep that semantic transform independently gated.
+        var elideLeafAbiSpills = enableLeafAbiSpillElision;
+        // GPR spill elision is not enabled in the C++ backend. Public indirect
+        // entry can flow into resident/state-free bodies, so locally owning a
+        // cached register is insufficient to prove that the complete public
+        // call boundary preserves the PPC nonvolatile value.
+        var leafGprStackFunction = ssa.Function;
+        var leafStackFunction = elideLeafAbiSpills
+            ? ElideLeafStackFprSaveRestore(leafGprStackFunction, types)
+            : leafGprStackFunction;
+        var func = ElideDeadPureLocalTemps(
+            ElideFctiwStackLowWordLoads(
+                ElideOverwrittenPsqStackLoads(leafStackFunction),
+                types));
+        var isGuestCallFree = FunctionEligibleForLeafRegisterCache(func);
+        var hasProvenKernelEntry = isGuestCallFree && gqrEntryConstants is { Count: > 0 };
+        func = GqrConstantPropagation.Specialize(
+            func, gqrEntryConstants, gqrCalleeWriteMasks,
+            gqrConstantsRequireRuntimeGuard);
+        // Call-free proven kernels amortize very small ranges. Ordinary functions
+        // use the epoch-safe scalar form and a higher threshold to avoid adding
+        // pointer locals for incidental field pairs.
+        func = GuestMemoryRangeLowering.Lower(
+            func, minimumAccesses: hasProvenKernelEntry ? 2 : 8, ignoreDisabledPcTraces: true,
+            scalarOnly: !hasProvenKernelEntry);
+        var architecturalFunc = func;
+        var guestAbiContract = GuestAbiContractAnalyzer.Analyze(architecturalFunc, guestAbiContracts);
+        var cfg = IrCfg.Build(func);
+        // Condition-flag elision is planned once against the final IR so every
+        // emission of this body (recording pass, public entry, state-free
+        // fallback) suppresses exactly the same instruction positions.
+        var flagElision = PlanFlagElision(
+            func, cfg, types, guestAbiContracts, modOverridableCallTargets,
+            nonReturningCallTargets, lrContinuationCallTargets);
+        // Flattened once per function: the emitter used to hash a (block, index)
+        // tuple for every instruction of every emission of this body.
+        var suppressedInstructionMasks = BuildSuppressedInstructionMasks(func, flagElision);
+        var cxxName = SanitizeIdentifier(signature.Name);
+        var pairedFlow = ComputePairedFlowStates(func, cfg, _guestAbiProvider);
+        var pairedIn = pairedFlow.In;
+        var pairedOut = pairedFlow.Out;
+        var pairedEdgeLiveness = ComputeRegisterLiveness(
+            func, cfg,
+            new LeafRegisterCache(
+                new SortedSet<int>(), new SortedSet<int>(Enumerable.Range(0, 32)),
+                new SortedSet<int>(), new SortedSet<int>()),
+            _guestAbiProvider);
+        var leafPreservedFprMask = LeafStackPreservedFprMask(architecturalFunc);
+        var nonvolatileFprWriteMask = FunctionNonvolatileFprWriteMask(architecturalFunc) & ~leafPreservedFprMask;
+        var preservesNonvolatileFprs = nonvolatileFprWriteMask == 0;
+        var stackFacts = StackAddressFacts.Build(func);
+        // Register residency supersedes the leaf register cache (localizes state via the
+        // expression layer instead of rewriting text, and covers non-leaf bodies too);
+        // residency owns every primary body, so the text-rewriting cache survives only for the state-free clone below.
+        var residencyOwnsPrimaryBody = !emitStateFreeLeafVariant;
+        var cachedRegisters = emitStateFreeLeafVariant
+            ? CollectLeafRegisterCacheRegisters(func, _guestAbiProvider, guestAbiContracts)
+            : LeafRegisterCache.Empty;
+        var registerCacheInitializers = !cachedRegisters.IsEmpty
+            ? BuildLeafRegisterCacheInitializers(
+                func, cfg, cachedRegisters, _guestAbiProvider,
+                emitStateFreeLeafVariant ? guestAbiContracts : null)
+            : LeafRegisterCacheInitializers.Empty;
+        var sb = new StringBuilder();
+        sb.AppendLine("#include <cstdint>");
+        sb.AppendLine("#include \"ppc_runtime.h\"");
+        sb.AppendLine("#include \"abi_bridge.h\"");
+        sb.AppendLine("#include \"memory.h\"");
+        sb.AppendLine("#include \"recomp_mod_loader.h\"");
+        sb.AppendLine();
+
+        var forwardDecls = CollectCallTargets(func)
+            .Select(FormatSymbol)
+            .Where(t => t.StartsWith("func_", StringComparison.OrdinalIgnoreCase) && !string.Equals(t, cxxName, StringComparison.Ordinal) && !TryParseAddress(t, out _))
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToList();
+
+        foreach (var target in forwardDecls.OrderBy(t => t, StringComparer.OrdinalIgnoreCase))
+        {
+            sb.AppendLine($"extern \"C\" void {target}(CpuContext* ctx);");
+        }
+        if (forwardDecls.Count > 0)
+        {
+            sb.AppendLine();
+        }
+
+        var implementationName = cxxName;
+        foreach (var target in guestAbiContract.DirectCallTargets.Where(stateFreeCallSymbols.ContainsKey))
+        {
+            if (!stateFreeAbiContracts.TryGetValue(target, out var stateFreeContract))
+                continue;
+            AppendStateFreeResultDeclaration(sb, target, stateFreeContract);
+            sb.AppendLine($"extern \"C\" {StateFreeReturnType(target, stateFreeContract)} {StateFreeCallingConvention(stateFreeContract)}{stateFreeCallSymbols[target]}({StateFreeParameterList(stateFreeContract, includeNames: false)});");
+        }
+        foreach (var variant in stateFreeCallSiteVariants.Values
+                     .DistinctBy(static variant => variant.Symbol, StringComparer.Ordinal)
+                     .OrderBy(static variant => variant.Symbol, StringComparer.Ordinal))
+        {
+            sb.AppendLine($"extern \"C\" {StateFreeReturnType(variant.Target, variant.Contract)} {StateFreeCallingConvention(variant.Contract)}{variant.Symbol}({StateFreeParameterList(variant.Contract, includeNames: false)});");
+        }
+        if (guestAbiContract.DirectCallTargets.Any(stateFreeCallSymbols.ContainsKey)) sb.AppendLine();
+        // Collect and declare only non-register local variables (temporaries)
+        var locals = CollectNonRegisterLocals(func);
+        var orderedLocals = locals.OrderBy(x => x, StringComparer.Ordinal).ToArray();
+        var guestRangeResolves = func.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>()
+            .GroupBy(static resolve => resolve.Destination, StringComparer.Ordinal)
+            .Select(static group => group.First())
+            .OrderBy(static resolve => resolve.Destination, StringComparer.Ordinal)
+            .ToArray();
+        var gqrEntryGuards = CollectGqrEntryGuards(func);
+
+        var labelNames = func.Blocks.ToDictionary(b => b.Label, b => SanitizeLabel(b.Label), StringComparer.OrdinalIgnoreCase);
+        var instructionContinuationLabels = new Dictionary<uint, string>();
+        var needsInstructionContinuationLabels = func.Blocks
+            .SelectMany(static block => block.Instructions)
+            .OfType<IrCall>()
+            .Any(call =>
+                TryParseAddress(call.Target, out var target) &&
+                (nonReturningCallTargets.Contains(target) || lrContinuationCallTargets.Contains(target)));
+        if (needsInstructionContinuationLabels)
+        {
+            foreach (var trace in func.Blocks.SelectMany(static block => block.Instructions).OfType<IrTracePpc>())
+            {
+                var irLabel = $"0x{trace.Address:X8}";
+                if (!labelNames.ContainsKey(irLabel))
+                {
+                    var cxxLabel = SanitizeLabel(irLabel);
+                    labelNames.Add(irLabel, cxxLabel);
+                    instructionContinuationLabels.TryAdd(trace.Address, cxxLabel);
+                }
+            }
+        }
+        var nextBlockLabels = BuildNextBlockLabelMap(func);
+        var knownConstants = BuildKnownUIntConstants(func);
+        // Burst coalescing is planned once against the final IR so every
+        // emission of this body sees the same runs and the same buffer names.
+        var gpuFifoBurstPlan = BuildGpuFifoBurstPlan(func, knownConstants, enableGpuFifoBurstCoalescing);
+        // The state-free clone is derived by rewriting this body's text, and it
+        // rewrites the ctx-carrying PSQ helper spellings into the explicit-state
+        // ones. Hoisting changes those spellings, so leave it off for the bodies
+        // that clone is made from.
+        var hoistedGqrIndices = CollectHoistableGqrIndices(
+            func, stackFacts, !emitStateFreeLeafVariant);
+        var linkedAddressRemap = moduleLinkBase.HasValue && moduleGuestBase.HasValue && moduleLinkedCodeSize != 0
+            ? new LinkedAddressRemap(moduleLinkBase.Value, moduleGuestBase.Value, moduleLinkedCodeSize)
+            : null;
+        // The complete function body is produced by this local function so it
+        // can be emitted more than once with a different residency mode. The
+        // inputs above are all deterministic and immutable from here on, so two
+        // invocations with the same residency produce identical text.
+        var emittedDirectCallTargets = new SortedSet<uint>();
+        var emittedLocalLabelAddresses = new SortedSet<uint>();
+        string EmitFunctionBody(RegisterResidency? residency, int bufferBaseLength, bool discardResult = false)
+        {
+            var previousResidency = _activeResidency;
+            var previousDirectCallTargets = _emittedDirectCallTargets;
+            var previousLocalLabels = _emittedLocalLabelAddresses;
+            var previousFifoBurstSlot = _activeGpuFifoBurstSlot;
+            var previousHoistedGqrIndices = _hoistedGqrIndices;
+            _activeResidency = residency;
+            _emittedDirectCallTargets = emittedDirectCallTargets;
+            _emittedLocalLabelAddresses = emittedLocalLabelAddresses;
+            _activeGpuFifoBurstSlot = null;
+            _hoistedGqrIndices = hoistedGqrIndices;
+            var body = _reusableFunctionBodyBuilder ?? new StringBuilder(FunctionBodyBuilderCapacity);
+            _reusableFunctionBodyBuilder = null;
+            try
+            {
+                body.AppendLine("{");
+                foreach (var local in orderedLocals)
+                {
+                    var representation = types.Get(local);
+                    var type = RepresentationFormatter.ToCxx(representation);
+                    var initValue = RepresentationFormatter.DefaultValue(representation);
+                    var valueSuffix = string.IsNullOrWhiteSpace(initValue) ? string.Empty : $" = {initValue}";
+                    // ABI preservation locals stay in the native stack frame on purpose: a
+                    // callee-saved host register would raise pressure in exactly the call-heavy
+                    // paths this targets, and a volatile slot still beats guest address translation + byte swapping.
+                    var qualifier = local.StartsWith("abi_saved_lr_", StringComparison.Ordinal)
+                        ? "volatile "
+                        : string.Empty;
+                    body.AppendLine($"    {qualifier}{type} {local}{valueSuffix};");
+                }
+                foreach (var resolve in guestRangeResolves)
+                {
+                    body.AppendLine($"    uint8_t* {resolve.Destination} = nullptr;");
+                }
+                foreach (var guard in gqrEntryGuards)
+                {
+                    body.AppendLine($"    const bool {GqrEntryGuardName(guard.Index, guard.Value)} = ctx->gqr[{guard.Index}u] == 0x{guard.Value:X8}u;");
+                }
+                foreach (var run in gpuFifoBurstPlan.Runs)
+                {
+                    body.AppendLine($"    uint8_t {run.BufferName}[{run.TotalBytes}];");
+                }
+                if (orderedLocals.Length > 0 || guestRangeResolves.Length > 0 ||
+                    gqrEntryGuards.Count > 0 || gpuFifoBurstPlan.Runs.Count > 0)
+                {
+                    body.AppendLine();
+                }
+                if (residency is not null)
+                {
+                    var beforeEntryLoads = body.Length;
+                    residency.AppendEntryLoads(body);
+                    if (body.Length != beforeEntryLoads)
+                    {
+                        body.AppendLine();
+                    }
+                }
+                EmitHoistedGqrPrologue(body, hoistedGqrIndices);
+
+                body.AppendLine($"    goto {labelNames[func.EntryLabel]};");
+                body.AppendLine();
+
+                foreach (var block in func.Blocks)
+                {
+                    var localConstants = new Dictionary<string, uint>(StringComparer.OrdinalIgnoreCase);
+                    var label = labelNames[block.Label];
+                    RecordEmittedLocalLabel(label);
+                    body.AppendLine($"{label}:");
+                    body.AppendLine("{");
+                    var localPaired = new Dictionary<string, bool>(StringComparer.OrdinalIgnoreCase);
+                    if (pairedIn.TryGetValue(block.Label, out var pairedAtEntry))
+                    {
+                        foreach (var reg in pairedAtEntry)
+                        {
+                            localPaired[reg] = true;
+                        }
+                    }
+
+                    var term = block.Instructions.LastOrDefault();
+                    var nonTerminatorCount = term is IrBranch or IrJump or IrReturn or IrJumpTable or IrUndefined
+                        ? Math.Max(0, block.Instructions.Count - 1)
+                        : block.Instructions.Count;
+                    // Per-target call counter for this block. It replaces an
+                    // O(n^2) rescan of the prefix and must therefore advance for
+                    // every call position the rescan used to see, including the
+                    // ones the flag-elision plan suppresses below.
+                    var directCallOrdinals = new Dictionary<string, int>(StringComparer.Ordinal);
+                    var blockSuppressed = suppressedInstructionMasks.TryGetValue(block.Label, out var suppressedMask)
+                        ? suppressedMask
+                        : null;
+
+                    for (var i = 0; i < nonTerminatorCount; i++)
+                    {
+                        var directCallOrdinal = -1;
+                        if (block.Instructions[i] is IrCall ordinalCall)
+                        {
+                            directCallOrdinals.TryGetValue(ordinalCall.Target, out var priorCalls);
+                            directCallOrdinals[ordinalCall.Target] = priorCalls + 1;
+                            directCallOrdinal = priorCalls;
+                        }
+
+                        if (blockSuppressed is not null && i < blockSuppressed.Length && blockSuppressed[i])
+                        {
+                            // Provably dead condition-flag or link-register
+                            // traffic. The constant tracker still observes it so
+                            // address folding is unchanged.
+                            UpdateKnownUIntConstants(block.Instructions[i], localConstants);
+                            continue;
+                        }
+
+                        if (block.Instructions[i] is IrTracePpc trace &&
+                            instructionContinuationLabels.TryGetValue(trace.Address, out var continuationLabel))
+                        {
+                            RecordEmittedLocalLabel(continuationLabel);
+                            body.AppendLine($"{continuationLabel}:");
+                        }
+                        var localFallthroughLr = TryGetLocalFallthroughLr(block.Instructions, i, nonReturningCallTargets, lrContinuationCallTargets);
+                        // State-free bodies are cloned after register caching and lose their
+                        // direct-call fallbacks, so this initial emission (which must stay a
+                        // genuine CpuContext fallback) only requests cache-boundary sync for the legacy resident ABI.
+                        var inlineGuestThunkStackBase = block.Instructions[i] is IrCall &&
+                            HasLocallyProvenStackFrameBase(block.Instructions, i, stackFacts);
+                        _activeGpuFifoBurstSlot = gpuFifoBurstPlan.Slot(block.Label, i);
+                        try
+                        {
+                            EmitInstruction(block.Label, directCallOrdinal, block.Instructions[i], body, bufferBaseLength, 1, cfg, labelNames, types, signature, localPaired, _guestAbiProvider, knownConstants, localConstants, linkedAddressRemap, nonReturningCallTargets, lrContinuationCallTargets, stackFacts, inlineGuestThunkStackBase, localFallthroughLr, guestAbiContracts, stateFreeAbiContracts, stateFreeCallSymbols, stateFreeCallSiteVariants, modOverridableCallTargets);
+                        }
+                        finally
+                        {
+                            _activeGpuFifoBurstSlot = null;
+                        }
+                        UpdateKnownUIntConstants(block.Instructions[i], localConstants);
+                        if (gpuFifoBurstPlan.Completion(block.Label, i) is { } completedBurst)
+                        {
+                            body.AppendLine(
+                                $"    GX_HLE_FIFO_WriteBurst({completedBurst.BufferName}, {completedBurst.TotalBytes}u);");
+                        }
+                        EmitHoistedGqrReloads(body, "    ", block.Instructions[i], hoistedGqrIndices, gqrCalleeWriteMasks);
+                    }
+
+                    switch (term)
+                    {
+                        case IrUndefined undef:
+                            EmitInstruction(block.Label, -1, undef, body, bufferBaseLength, 1, cfg, labelNames, types, signature, localPaired, _guestAbiProvider, knownConstants, localConstants, linkedAddressRemap, nonReturningCallTargets, lrContinuationCallTargets, stackFacts, inlineGuestThunkStackBase: false, localFallthroughLr: null, guestAbiContracts, stateFreeAbiContracts, stateFreeCallSymbols, stateFreeCallSiteVariants, modOverridableCallTargets);
+                            AppendFlush(body, "    ");
+                            body.AppendLine("    return;");
+                            break;
+
+                        case IrReturn ret:
+                            AppendFlush(body, "    ");
+                            body.AppendLine("    return;");
+                            break;
+
+                        case IrJump jump:
+                            EmitNormalizePairedStateOnEdge(body, "    ", block.Label, jump.TargetLabel, pairedOut, pairedIn, pairedEdgeLiveness.In);
+                            EmitGotoUnlessFallthrough(body, "    ", block.Label, jump.TargetLabel, nextBlockLabels, labelNames, signature.Name);
+                            break;
+
+                        case IrBranch br:
+                            var trueLabel = RequireLabel(br.TrueLabel, labelNames, block.Label, signature.Name);
+                            var falseLabel = RequireLabel(br.FalseLabel, labelNames, block.Label, signature.Name);
+                            var cond = flagElision.FusedBranches.TryGetValue(block.Label, out var fusedCompare)
+                                ? FusedConditionExpression(fusedCompare, types, localPaired)
+                                : ToCondition(br.Condition, br.ConditionRegister, types);
+                            // The false edge is often pure fallthrough with no
+                            // representation normalization, which used to emit an
+                            // empty "} else {}". Build it first and keep the else
+                            // only when it actually carries something.
+                            var falseEdge = new StringBuilder();
+                            EmitNormalizePairedStateOnEdge(falseEdge, "        ", block.Label, br.FalseLabel, pairedOut, pairedIn, pairedEdgeLiveness.In);
+                            EmitGotoUnlessFallthrough(falseEdge, "        ", block.Label, br.FalseLabel, nextBlockLabels, labelNames, signature.Name);
+                            body.AppendLine($"    if ({cond}) {{");
+                            EmitNormalizePairedStateOnEdge(body, "        ", block.Label, br.TrueLabel, pairedOut, pairedIn, pairedEdgeLiveness.In);
+                            EmitGotoUnlessFallthrough(body, "        ", block.Label, br.TrueLabel, nextBlockLabels, labelNames, signature.Name);
+                            if (falseEdge.Length != 0)
+                            {
+                                body.AppendLine("    } else {");
+                                body.Append(falseEdge);
+                            }
+                            body.AppendLine("    }");
+                            break;
+
+                        case IrJumpTable table:
+                            var selectorExpr = ToExpression(IrValue.Register(table.Selector), types);
+                            body.AppendLine($"    switch (static_cast<uint32_t>({selectorExpr})) {{");
+                            foreach (var jt in table.Cases)
+                            {
+                                var caseLabel = RequireLabel(jt.TargetLabel, labelNames, block.Label, signature.Name);
+                                body.AppendLine($"    case 0x{jt.TargetAddress:X8}u:");
+                                EmitNormalizePairedStateOnEdge(body, "        ", block.Label, jt.TargetLabel, pairedOut, pairedIn, pairedEdgeLiveness.In);
+                                body.AppendLine($"        goto {caseLabel};");
+                                body.AppendLine("        break;");
+                            }
+                            body.AppendLine("    default:");
+                            // Unlisted selectors leave this frame through the
+                            // dispatcher: publish the locals and never write
+                            // them back afterwards.
+                            AppendFlush(body, "        ");
+                            body.AppendLine($"        InvokeIndirectJump({selectorExpr}, ctx);");
+                            body.AppendLine("        return;");
+                            body.AppendLine("    }");
+                            break;
+
+                        default:
+                            // Fallthrough to next block if present.
+                            var succ = cfg.Successors(block.Label).FirstOrDefault();
+                            if (!string.IsNullOrWhiteSpace(succ))
+                            {
+                                EmitNormalizePairedStateOnEdge(body, "    ", block.Label, succ!, pairedOut, pairedIn, pairedEdgeLiveness.In);
+                                EmitGotoUnlessFallthrough(body, "    ", block.Label, succ!, nextBlockLabels, labelNames, signature.Name);
+                            }
+                            else
+                            {
+                                // An indirect jump already published the locals
+                                // and returned; the trailing return below is
+                                // unreachable and must not write them back.
+                                if (term is not IrIndirectJump)
+                                {
+                                    AppendFlush(body, "    ");
+                                }
+                                body.AppendLine("    return;");
+                            }
+                            break;
+                    }
+
+                    body.AppendLine("}");
+                    body.AppendLine();
+                }
+
+                body.Append('}');
+                // The residency discovery pass only exists for its side effects
+                // on the recorder; materializing its text costs a full copy of
+                // the largest string this translator builds.
+                return discardResult ? string.Empty : body.ToString();
+            }
+            finally
+            {
+                body.Clear();
+                _reusableFunctionBodyBuilder = body;
+                _activeResidency = previousResidency;
+                _emittedDirectCallTargets = previousDirectCallTargets;
+                _emittedLocalLabelAddresses = previousLocalLabels;
+                _activeGpuFifoBurstSlot = previousFifoBurstSlot;
+                _hoistedGqrIndices = previousHoistedGqrIndices;
+            }
+        }
+
+        // Discovery pass: emit the body once with a recording residency to observe every register the emitter
+        // really formats (inline EABI thunks read r11 with no IR operand; raw branch conditions reference CR/CTR
+        // as plain text), then discard the result. The buffer offset below matters because call-site temporaries
+        // uniquify themselves by position in the translation unit.
+        var bodyBufferBaseLength = sb.Length +
+            FunctionDefinitionSignature(implementationName).Length +
+            Environment.NewLine.Length;
+        RegisterResidency? residency = null;
+        {
+            var recorder = RegisterResidency.CreateRecorder();
+            EmitFunctionBody(recorder, bodyBufferBaseLength, discardResult: true);
+            var discovered = recorder.Snapshot();
+            if (!discovered.IsEmpty)
+            {
+                RequireResidencyNamesAreFree(
+                    discovered,
+                    entryPoint,
+                    orderedLocals
+                        .Concat(guestRangeResolves.Select(static resolve => resolve.Destination))
+                        .Concat(gqrEntryGuards.Select(static guard => GqrEntryGuardName(guard.Index, guard.Value))));
+                residency = discovered;
+            }
+        }
+
+        sb.AppendLine(FunctionDefinitionSignature(implementationName));
+        sb.AppendLine(EmitFunctionBody(residencyOwnsPrimaryBody ? residency : null, bodyBufferBaseLength));
+
+        var aliasName = $"func_{entryPoint:X8}";
+        if (!emitModRegistration && !cxxName.Equals(aliasName, StringComparison.OrdinalIgnoreCase))
+        {
+            sb.AppendLine();
+            sb.AppendLine(FunctionDefinitionSignature(aliasName));
+            sb.AppendLine("{");
+            sb.AppendLine($"    {cxxName}(ctx);");
+            sb.AppendLine("}");
+        }
+
+        sb.AppendLine();
+        var guestAbiMarker = GeneratedMarkers.GuestAbi(guestAbiContract);
+        sb.AppendLine($"// {guestAbiMarker}");
+        // Registration is translator-internal, not code: real registration happens via the shard emitter's bulk
+        // registration TUs. This survives only as a marker comment (matching RECOMP_GUEST_ABI's shape) that the
+        // shard emitter and dispatch profile parse out, then strip when composing a compiled shard.
+        CxxBuildRegistrationFacts? registration = null;
+        if (emitModRegistration)
+        {
+            var prettyName = EscapeCxxStringLiteral(signature.Name);
+            sb.AppendLine(GeneratedMarkers.ModRegistration(
+                entryPoint,
+                cxxName,
+                prettyName,
+                preservesNonvolatileFprs,
+                nonvolatileFprWriteMask,
+                modRegistrationPriority,
+                modRegistrationModuleId));
+        }
+        else
+        {
+            sb.AppendLine(GeneratedMarkers.BaseRegistration(
+                entryPoint, cxxName, preservesNonvolatileFprs, nonvolatileFprWriteMask));
+            registration = new CxxBuildRegistrationFacts(
+                cxxName, preservesNonvolatileFprs, nonvolatileFprWriteMask);
+        }
+
+        var code = sb.ToString();
+        GuestStateFreeEmissionFacts? stateFreeFacts = null;
+        var stateFreeVariantFacts = new List<GuestStateFreeEmissionFacts>();
+        // The state-free clone is derived by rewriting this register-cached body's text, so the ordinary
+        // CpuContext body must be captured here, before caching is applied, since it's also the mandatory
+        // fallback for mod overrides and unavailable descendants. It's re-emitted with residency and swapped
+        // in after the clone is produced.
+        var ordinaryStateFreeFallbackBody = emitStateFreeLeafVariant
+            ? (residency is not null
+                ? EmitFunctionBody(residency, bodyBufferBaseLength)
+                : ExtractFunctionBody(code, implementationName))
+            : null;
+        if (!cachedRegisters.IsEmpty)
+        {
+            code = ApplyLeafRegisterCache(
+                code,
+                implementationName,
+                cachedRegisters,
+                registerCacheInitializers);
+        }
+        if (emitStateFreeLeafVariant)
+        {
+            if (!stateFreeCallSymbols.TryGetValue(entryPoint, out var stateFreeSymbol))
+                throw new InvalidOperationException($"Missing state-free symbol for 0x{entryPoint:X8}.");
+            static uint StateFreeRegisterMask(IEnumerable<int> values) =>
+                values.Aggregate(0u, static (mask, value) => mask | (1u << value));
+            var exactContract = guestAbiContract with
+            {
+                GprReadBeforeWriteMask = StateFreeRegisterMask(registerCacheInitializers.Gprs),
+                GprPossibleWriteMask = StateFreeRegisterMask(cachedRegisters.WrittenGprs),
+                // Full FPR caching can include values read only to preserve the
+                // public nonvolatile ABI. They are not semantic inputs to a
+                // state-free call and must not inflate its native signature.
+                FprReadBeforeWriteMask = StateFreeRegisterMask(registerCacheInitializers.Fprs) &
+                                         guestAbiContract.FprReadBeforeWriteMask,
+                // Native paired lowering can replace cached_fN completely with
+                FprPossibleWriteMask = guestAbiContract.FprPossibleWriteMask,
+                // An unlinked direct branch is a tail call.  Its callee returns
+                // through this function's incoming LR even when LR never appears
+                // as an ordinary register initializer in the caller body.
+                ReadsLrBeforeWrite = guestAbiContract.ReadsLrBeforeWrite ||
+                    func.Blocks.SelectMany(static block => block.Instructions)
+                        .OfType<IrCall>()
+                        .Any(static call => string.IsNullOrWhiteSpace(call.Destination))
+            };
+            if (stateFreeAbiContracts.TryGetValue(entryPoint, out var plannedContract))
+            {
+                exactContract = exactContract with
+                {
+                    GprPossibleWriteMask = exactContract.GprPossibleWriteMask & plannedContract.GprPossibleWriteMask,
+                    FprPossibleWriteMask = exactContract.FprPossibleWriteMask & plannedContract.FprPossibleWriteMask,
+                    CrPossibleWriteMask = (byte)(exactContract.CrPossibleWriteMask & plannedContract.CrPossibleWriteMask),
+                    MayWriteXer = exactContract.MayWriteXer && plannedContract.MayWriteXer,
+                    MayWriteCtr = exactContract.MayWriteCtr && plannedContract.MayWriteCtr,
+                    MayWriteLr = exactContract.MayWriteLr && plannedContract.MayWriteLr,
+                    MayWriteFpscr = exactContract.MayWriteFpscr && plannedContract.MayWriteFpscr,
+                    GqrPossibleWriteMask = (byte)(exactContract.GqrPossibleWriteMask & plannedContract.GqrPossibleWriteMask),
+                    HidPossibleWriteMask = (byte)(exactContract.HidPossibleWriteMask & plannedContract.HidPossibleWriteMask)
+                };
+            }
+            // Clone before GQR template versioning. The public CpuContext entry
+            // may retain its guarded template wrapper, while this clone owns
+            // the original cached register values and receives GQRs explicitly.
+            code = AppendStateFreeLeafVariant(
+                code, implementationName, stateFreeSymbol, entryPoint, exactContract,
+                out var primaryStateFreeFacts,
+                boundaryContextTargets: new HashSet<uint>(),
+                guestAbiContracts: guestAbiContracts);
+            stateFreeFacts = primaryStateFreeFacts;
+            foreach (var variant in stateFreeEntryVariants)
+            {
+                code = AppendStateFreeLeafVariant(
+                    code, implementationName, variant.Symbol, entryPoint, variant.Contract,
+                    out var variantFacts, preferInline: true);
+                stateFreeVariantFacts.Add(variantFacts);
+            }
+            code = ReplaceFunctionBody(
+                code,
+                implementationName,
+                ordinaryStateFreeFallbackBody ?? throw new InvalidOperationException(
+                    $"Missing ordinary state-free fallback body for 0x{entryPoint:X8}."));
+        }
+        if (CanVersionGuardedGqrFunction(func, gqrEntryGuards))
+        {
+            code = ApplyGuardedGqrFunctionVersioning(code, implementationName, gqrEntryGuards);
+        }
+
+        return new CxxEmissionResult(
+            code,
+            guestAbiContract,
+            guestAbiMarker,
+            registration,
+            emittedDirectCallTargets.ToArray(),
+            emittedLocalLabelAddresses.ToArray(),
+            stateFreeFacts,
+            stateFreeVariantFacts);
+    }
+
+    private static string EscapeCxxStringLiteral(string value) =>
+        value.Replace("\\", "\\\\", StringComparison.Ordinal)
+            .Replace("\"", "\\\"", StringComparison.Ordinal);
+
+    private static uint? TryGetLocalFallthroughLr(
+        IReadOnlyList<IrInstruction> instructions,
+        int index,
+        IReadOnlySet<uint> nonReturningCallTargets,
+        IReadOnlySet<uint> lrContinuationCallTargets)
+    {
+        if (index <= 0 ||
+            instructions[index] is not IrCall ||
+            instructions[index - 1] is not IrAssign { Value.Kind: "const", Value.Constant: { } lrValue } lrAssign ||
+            !string.Equals(GetRegisterBaseName(lrAssign.Destination), "lr", StringComparison.OrdinalIgnoreCase))
+        {
+            return null;
+        }
+
+        return unchecked((uint)lrValue);
+    }
+
+    // Shared with GuestMemoryRangeLowering: the range hoister has to decide
+    // whether a store is one the emitter will turn into a direct
+    // GX_HLE_FIFO_Write*, and the only way to guarantee that decision agrees is
+    // to consult the exact same constant map the emitter consults.
+    internal static Dictionary<string, uint> BuildKnownUIntConstants(IrFunction func)
+    {
+        var constants = new Dictionary<string, uint>(StringComparer.OrdinalIgnoreCase);
+
+        foreach (var block in func.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                switch (instruction)
+                {
+                    case IrAssign assign when TryGetUIntConstant(assign.Value, constants, out var value):
+                        constants[assign.Destination] = value;
+                        break;
+
+                    case IrBinary binary when TryEvaluateUIntBinary(binary, constants, out var value):
+                        constants[binary.Destination] = value;
+                        break;
+                }
+            }
+        }
+
+        return constants;
+    }
+
+    private static void UpdateKnownUIntConstants(IrInstruction instruction, Dictionary<string, uint> constants)
+    {
+        string? destination = instruction switch
+        {
+            IrAssign assign => assign.Destination,
+            IrBinary binary => binary.Destination,
+            IrLoad load => load.Destination,
+            IrCall call => call.Destination,
+            IrIndirectCall call => call.Destination,
+            _ => null
+        };
+
+        if (destination is null)
+        {
+            return;
+        }
+
+        if (instruction is IrAssign constantAssign && TryGetUIntConstant(constantAssign.Value, constants, out var assigned))
+        {
+            constants[destination] = assigned;
+            constants[GetRegisterBaseName(destination)] = assigned;
+        }
+        else if (instruction is IrBinary constantBinary && TryEvaluateUIntBinary(constantBinary, constants, out var calculated))
+        {
+            constants[destination] = calculated;
+            constants[GetRegisterBaseName(destination)] = calculated;
+        }
+        else
+        {
+            constants.Remove(destination);
+            constants.Remove(GetRegisterBaseName(destination));
+        }
+    }
+
+    private sealed record LinkedAddressRemap(uint LinkBase, uint GuestBase, uint CodeSize);
+
+    private static bool TryEvaluateUIntBinary(
+        IrBinary binary,
+        IReadOnlyDictionary<string, uint> constants,
+        out uint value)
+    {
+        value = 0;
+        if (!TryGetUIntConstant(binary.Left, constants, out var left) ||
+            !TryGetUIntConstant(binary.Right, constants, out var right))
+        {
+            return false;
+        }
+
+        value = binary.Op switch
+        {
+            "add" => unchecked(left + right),
+            "sub" => unchecked(left - right),
+            "and" => left & right,
+            "or" => left | right,
+            "xor" => left ^ right,
+            "shl" => unchecked(left << (int)(right & 31)),
+            "rotl" => unchecked((left << (int)(right & 31)) | (left >> (int)((32 - right) & 31))),
+            "shr" => left >> (int)(right & 31),
+            _ => 0
+        };
+
+        return binary.Op is "add" or "sub" or "and" or "or" or "xor" or "shl" or "shr" or "rotl";
+    }
+
+    private static bool TryGetUIntConstant(
+        IrValue value,
+        IReadOnlyDictionary<string, uint> constants,
+        out uint result)
+    {
+        if (value.Kind == "const" && value.Constant.HasValue)
+        {
+            result = unchecked((uint)value.Constant.Value);
+            return true;
+        }
+
+        if (value.Kind == "register" &&
+            value.RegisterName != null &&
+            constants.TryGetValue(value.RegisterName, out result))
+        {
+            return true;
+        }
+
+        result = 0;
+        return false;
+    }
+
+    private static Dictionary<string, string?> BuildNextBlockLabelMap(IrFunction func)
+    {
+        var nextBlockLabels = new Dictionary<string, string?>(StringComparer.OrdinalIgnoreCase);
+        for (var i = 0; i < func.Blocks.Count; i++)
+        {
+            nextBlockLabels[func.Blocks[i].Label] = i + 1 < func.Blocks.Count
+                ? func.Blocks[i + 1].Label
+                : null;
+        }
+
+        return nextBlockLabels;
+    }
+
+    private static void EmitGotoUnlessFallthrough(
+        StringBuilder sb,
+        string pad,
+        string currentLabel,
+        string targetLabel,
+        IReadOnlyDictionary<string, string?> nextBlockLabels,
+        Dictionary<string, string> labelNames,
+        string functionName)
+    {
+        if (nextBlockLabels.TryGetValue(currentLabel, out var nextLabel) &&
+            string.Equals(nextLabel, targetLabel, StringComparison.OrdinalIgnoreCase))
+        {
+            return;
+        }
+
+        var cxxLabel = RequireLabel(targetLabel, labelNames, currentLabel, functionName);
+        sb.AppendLine($"{pad}goto {cxxLabel};");
+    }
+
+    private static uint FunctionNonvolatileFprWriteMask(IrFunction func)
+    {
+        uint mask = 0;
+        foreach (var block in func.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                mask |= InstructionNonvolatileFprWriteMask(instruction);
+            }
+        }
+
+        return mask;
+    }
+
+    private static uint LeafStackPreservedFprMask(IrFunction func)
+    {
+        if (!FunctionEligibleForLeafRegisterCache(func))
+            return 0;
+
+        var order = 0;
+        var returns = new List<int>();
+        var saves = new Dictionary<int, int>();
+        var restores = new Dictionary<int, int>();
+        foreach (var block in func.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                if (instruction is IrReturn)
+                    returns.Add(order);
+                if (instruction is IrAssign assign)
+                {
+                    if (block.Label.Equals(func.EntryLabel, StringComparison.OrdinalIgnoreCase) &&
+                        assign.Value.Kind == "register" &&
+                        TryParseNonvolatileFpr(assign.Value.RegisterName, out var savedFpr) &&
+                        assign.Destination.Equals(LeafStackSavedFprName(savedFpr), StringComparison.OrdinalIgnoreCase))
+                    {
+                        saves[savedFpr] = order;
+                    }
+
+                    if (TryParseNonvolatileFpr(assign.Destination, out var restoredFpr) &&
+                        assign.Value.Kind == "register" &&
+                        assign.Value.RegisterName is { } source &&
+                        source.Equals(LeafStackSavedFprName(restoredFpr), StringComparison.OrdinalIgnoreCase))
+                    {
+                        restores[restoredFpr] = order;
+                    }
+                }
+                ++order;
+            }
+        }
+
+        if (returns.Count != 1)
+            return 0;
+
+        uint mask = 0;
+        foreach (var fpr in saves.Keys)
+        {
+            if (restores.TryGetValue(fpr, out var restoreOrder) &&
+                saves[fpr] < restoreOrder && restoreOrder < returns[0])
+            {
+                mask |= 1u << fpr;
+            }
+        }
+        return mask;
+    }
+
+    private static uint InstructionNonvolatileFprWriteMask(IrInstruction instruction)
+    {
+        switch (instruction)
+        {
+            case IrAssign assign:
+                return NonvolatileFprMask(assign.Destination);
+
+            case IrBinary binary:
+                return NonvolatileFprMask(binary.Destination);
+
+            case IrLoad load:
+                return NonvolatileFprMask(load.Destination);
+
+            case IrCall call:
+                return InlineRestoreNonvolatileFprMask(call) |
+                       (string.IsNullOrWhiteSpace(call.Destination) ? 0 : NonvolatileFprMask(call.Destination));
+
+            case IrIndirectCall indirectCall:
+                return string.IsNullOrWhiteSpace(indirectCall.Destination)
+                    ? 0
+                    : NonvolatileFprMask(indirectCall.Destination);
+
+            case IrPhi phi:
+                return NonvolatileFprMask(phi.Destination);
+
+            default:
+                return 0;
+        }
+    }
+
+    private static uint InlineRestoreNonvolatileFprMask(IrCall call)
+    {
+        if (!TryParseAddress(call.Target, out var address) ||
+            !TryGetInlineGuestThunkSpec(address, out var spec) ||
+            spec.Kind != InlineGuestThunkKind.RestFpr)
+        {
+            return 0;
+        }
+
+        uint mask = 0;
+        for (var fpr = Math.Max(14, spec.StartRegister); fpr <= 31; fpr++)
+        {
+            mask |= 1u << fpr;
+        }
+        return mask;
+    }
+
+    private static uint NonvolatileFprMask(string registerName)
+    {
+        if (string.IsNullOrWhiteSpace(registerName) ||
+            !IsFloatRegister(registerName))
+        {
+            return 0;
+        }
+
+        var index = ParseFloatRegisterIndex(registerName);
+        return index is >= 14 and <= 31 ? 1u << index : 0;
+    }
+
+    private static void EmitNormalizePairedStateOnEdge(
+        StringBuilder sb,
+        string pad,
+        string fromLabel,
+        string toLabel,
+        IReadOnlyDictionary<string, HashSet<string>> pairedOut,
+        IReadOnlyDictionary<string, HashSet<string>> pairedIn,
+        IReadOnlyDictionary<string, HashSet<string>> liveIn)
+    {
+        pairedOut.TryGetValue(fromLabel, out var fromSet);
+        pairedIn.TryGetValue(toLabel, out var toSet);
+
+        fromSet ??= new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        toSet ??= new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        var candidateRegs = new HashSet<string>(fromSet, StringComparer.OrdinalIgnoreCase);
+        candidateRegs.UnionWith(toSet);
+        if (liveIn.TryGetValue(toLabel, out var targetLive))
+            candidateRegs.IntersectWith(targetLive);
+        else
+            candidateRegs.Clear();
+
+        foreach (var reg in candidateRegs
+                     .Where(IsFloatRegister)
+                     .OrderBy(ParseFloatRegisterIndex)
+                     .ThenBy(r => r, StringComparer.OrdinalIgnoreCase))
+        {
+            var fromPaired = fromSet.Contains(reg);
+            var toPaired = toSet.Contains(reg);
+            if (fromPaired == toPaired)
+                continue;
+
+            var regIndex = ParseFloatRegisterIndex(reg);
+            // A CFG edge is not a call boundary: the resident local is the
+            // authoritative representation that has to be normalized here.
+            var regExpr = _activeResidency is null
+                ? $"ctx->fpr[{regIndex}].d"
+                : _activeResidency.FprScalar(regIndex, written: true);
+            sb.AppendLine(toPaired
+                ? $"{pad}{regExpr} = PPC_PsFromScalarInline({regExpr});"
+                : $"{pad}{regExpr} = PPC_PsToScalarInline({regExpr});");
+        }
+    }
+
+    private static int ParseFloatRegisterIndex(string name)
+    {
+        var baseName = GetRegisterBaseName(name);
+        if (baseName.Length > 1 &&
+            baseName[0] == 'f' &&
+            int.TryParse(baseName.AsSpan(1), out var index))
+        {
+            return index;
+        }
+
+        return int.MaxValue;
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/DataSectionGenerator.cs b/translator/src/Translator.Core/CodeGen/DataSectionGenerator.cs
new file mode 100644
index 0000000..4fda40f
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/DataSectionGenerator.cs
@@ -0,0 +1,180 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Text;
+using Translator.Core.IO;
+using Translator.Core.Loading;
+using Translator.Core.Parsing.Dol;
+using Translator.Core.Parsing.Rel;
+
+namespace Translator.Core.CodeGen;
+
+/// <summary>
+/// Generates C++ code to initialize DOL and REL data sections directly in the binary.
+/// This allows running without loading a RAM dump at runtime.
+/// </summary>
+public static class DataSectionGenerator
+{
+    /// <summary>
+    /// Generates a C++ header/source pair that initializes all data sections.
+    /// </summary>
+    public static void Generate(
+        DolFile dol,
+        RelImage? rel,
+        string outputPath,
+        string projectName = "PowerPC DOL",
+        string relName = "rel_module",
+        string? blobReferenceDirectory = null)
+    {
+        var sections = new List<DataSectionEntry>();
+        
+        // Add DOL data sections (skip .bss - it's zero-initialized)
+        foreach (var section in dol.Sections)
+        {
+            if (section.Kind == SectionKind.Bss || !section.HasData || section.Size == 0)
+            {
+                continue;
+            }
+            
+            // Include both code and data sections - they all need to be in memory
+            sections.Add(new DataSectionEntry(
+                Name: SanitizeName(section.Name),
+                Address: section.VirtualAddress,
+                Data: section.Data,
+                Source: "DOL"));
+        }
+        
+        // Add REL data if provided
+        if (rel != null && rel.Data.Length > 0)
+        {
+            sections.Add(new DataSectionEntry(
+                Name: SanitizeName(relName),
+                Address: rel.BaseAddress,
+                Data: rel.Data,
+                Source: "REL"));
+        }
+        
+        var blobDirectory = Path.Combine(
+            Path.GetDirectoryName(outputPath) ?? ".",
+            Path.GetFileNameWithoutExtension(outputPath) + "_blobs");
+        var blobAssemblyPath = Path.Combine(
+            Path.GetDirectoryName(outputPath) ?? ".",
+            Path.GetFileNameWithoutExtension(outputPath) + "_blobs.S");
+
+        WriteBlobFiles(
+            sections,
+            blobDirectory,
+            blobReferenceDirectory ?? blobDirectory,
+            blobAssemblyPath);
+        WriteSourceFile(sections, outputPath, dol.BssAddress, dol.BssSize, projectName);
+    }
+    
+    private static string SanitizeName(string name)
+    {
+        var sb = new StringBuilder();
+        foreach (var c in name)
+        {
+            if (char.IsLetterOrDigit(c))
+            {
+                sb.Append(c);
+            }
+            else
+            {
+                sb.Append('_');
+            }
+        }
+        return sb.ToString();
+    }
+
+    private static void WriteBlobFiles(
+        List<DataSectionEntry> sections,
+        string blobDirectory,
+        string blobReferenceDirectory,
+        string assemblyPath)
+    {
+        var blobs = sections.Select(section => new AssemblyBlob(
+            $"{section.Name}.bin",
+            $"kData_{section.Name}",
+            section.Data,
+            $"{section.Source}: {section.Name} @ 0x{section.Address:X8} ({section.Data.Length} bytes)"))
+            .ToList();
+        AssemblyBlobWriter.Write(
+            assemblyPath,
+            blobDirectory,
+            blobReferenceDirectory,
+            blobs,
+            "// AUTO-GENERATED - DO NOT EDIT",
+            "// Binary DOL/REL section payloads for data_sections_init.cpp.");
+    }
+    
+    private static void WriteSourceFile(
+        List<DataSectionEntry> sections,
+        string path,
+        uint bssAddress,
+        uint bssSize,
+        string projectName)
+    {
+        var sb = new StringBuilder(capacity: 8 * 1024 * 1024);
+        using var writer = new StringWriter(sb);
+        
+        writer.WriteLine("// AUTO-GENERATED - DO NOT EDIT");
+        writer.WriteLine($"// Data section initializer for {projectName}");
+        writer.WriteLine("// This file embeds the DOL and REL data sections directly in the binary.");
+        writer.WriteLine("#include \"memory.h\"");
+        writer.WriteLine("#include <cstring>");
+        writer.WriteLine("#include <cstddef>");
+        writer.WriteLine("#include <cstdint>");
+        writer.WriteLine("#include <iostream>");
+        writer.WriteLine();
+
+        writer.WriteLine("extern \"C\" {");
+        foreach (var section in sections)
+        {
+            writer.WriteLine($"extern const uint8_t kData_{section.Name}[];");
+        }
+        writer.WriteLine("} // extern \"C\"");
+        
+        // Write the initialization function with C linkage (for cross-compilation-unit linking)
+        writer.WriteLine();
+        writer.WriteLine("namespace {");
+        writer.WriteLine("bool g_dataInitialized = false;");
+        writer.WriteLine("} // namespace");
+        writer.WriteLine();
+        writer.WriteLine("extern \"C\" void InitializeDataSections() {");
+        writer.WriteLine("    if (g_dataInitialized) return;");
+        writer.WriteLine("    g_dataInitialized = true;");
+        writer.WriteLine();
+        writer.WriteLine("    std::cout << \"[runtime] Initializing embedded data sections...\" << std::endl;");
+        writer.WriteLine();
+        
+        foreach (var section in sections)
+        {
+            writer.WriteLine($"    // {section.Source} section: {section.Name} @ 0x{section.Address:X8}");
+            writer.WriteLine($"    constexpr size_t kSize_{section.Name} = {section.Data.Length}u;");
+            writer.WriteLine($"    if (Memory::Contains(0x{section.Address:X8}u, kSize_{section.Name})) {{");
+            writer.WriteLine($"        std::memcpy(Memory::GetPointer(0x{section.Address:X8}u, kSize_{section.Name}),");
+            writer.WriteLine($"                    kData_{section.Name}, kSize_{section.Name});");
+            writer.WriteLine($"        std::cout << \"[runtime]   Loaded {section.Name} ({section.Data.Length} bytes) @ 0x{section.Address:X8}\" << std::endl;");
+            writer.WriteLine("    }");
+            writer.WriteLine();
+        }
+        
+        // BSS is zero-initialized (memory starts at zero so we don't need to do anything)
+        if (bssSize > 0)
+        {
+            writer.WriteLine($"    // BSS section @ 0x{bssAddress:X8} ({bssSize} bytes) - memory already zero-initialized");
+        }
+        
+        writer.WriteLine("}");
+        writer.WriteLine();
+        
+        // Also provide a check function with C linkage
+        writer.WriteLine("extern \"C\" bool IsDataSectionsInitialized() {");
+        writer.WriteLine("    return g_dataInitialized;");
+        writer.WriteLine("}");
+
+        FileOutput.WriteTextIfChanged(path, sb.ToString());
+    }
+    
+    private record DataSectionEntry(string Name, uint Address, ReadOnlyMemory<byte> Data, string Source);
+}
diff --git a/translator/src/Translator.Core/CodeGen/GuestFunctionAbi.cs b/translator/src/Translator.Core/CodeGen/GuestFunctionAbi.cs
new file mode 100644
index 0000000..8b21dcb
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/GuestFunctionAbi.cs
@@ -0,0 +1,106 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core;
+
+namespace Translator.Core.CodeGen;
+
+public sealed class GuestFunctionAbi
+{
+    private readonly HashSet<string> _scalarFloatArgumentRegisters;
+    private readonly HashSet<string> _argumentRegisters;
+
+    public GuestFunctionAbi(
+        IEnumerable<string>? scalarFloatArgumentRegisters = null,
+        bool returnsPairedScalarFloat = false,
+        bool writesFloatReturnRegister = false,
+        IEnumerable<string>? argumentRegisters = null,
+        bool preservesVolatileContext = false,
+        bool writesGprReturnRegister = true)
+    {
+        _scalarFloatArgumentRegisters = (scalarFloatArgumentRegisters ?? Enumerable.Empty<string>())
+            .Select(RegisterNameUtils.StripNumericSuffix)
+            .Where(static r => !string.IsNullOrWhiteSpace(r))
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        _argumentRegisters = (argumentRegisters ?? Enumerable.Empty<string>())
+            .Select(RegisterNameUtils.StripNumericSuffix)
+            .Where(static r => !string.IsNullOrWhiteSpace(r))
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        ReturnsPairedScalarFloat = returnsPairedScalarFloat;
+        WritesFloatReturnRegister = writesFloatReturnRegister || returnsPairedScalarFloat;
+        PreservesVolatileContext = preservesVolatileContext;
+        WritesGprReturnRegister = writesGprReturnRegister;
+    }
+
+    public static GuestFunctionAbi Empty { get; } = new();
+
+    public IReadOnlySet<string> ScalarFloatArgumentRegisters => _scalarFloatArgumentRegisters;
+
+    public IReadOnlySet<string> ArgumentRegisters => _argumentRegisters;
+
+    public bool HasKnownArgumentRegisters => _argumentRegisters.Count != 0;
+
+    public bool ReturnsPairedScalarFloat { get; }
+
+    public bool WritesFloatReturnRegister { get; }
+
+    public bool WritesGprReturnRegister { get; }
+
+    public bool PreservesVolatileContext { get; }
+
+    public bool HasScalarFloatArgument(string registerName)
+    {
+        var baseName = RegisterNameUtils.StripNumericSuffix(registerName);
+        return _scalarFloatArgumentRegisters.Contains(baseName);
+    }
+
+    public bool HasArgumentRegister(string registerName)
+    {
+        var baseName = RegisterNameUtils.StripNumericSuffix(registerName);
+        return _argumentRegisters.Contains(baseName);
+    }
+}
+
+public interface IGuestFunctionAbiProvider
+{
+    bool TryGetGuestFunctionAbi(string target, out GuestFunctionAbi abi);
+}
+
+public sealed class CompositeGuestFunctionAbiProvider : IGuestFunctionAbiProvider
+{
+    private readonly IReadOnlyList<IGuestFunctionAbiProvider> _providers;
+
+    public CompositeGuestFunctionAbiProvider(params IGuestFunctionAbiProvider[] providers)
+    {
+        _providers = providers.Where(static p => p is not null).ToArray();
+    }
+
+    public bool TryGetGuestFunctionAbi(string target, out GuestFunctionAbi abi)
+    {
+        foreach (var provider in _providers)
+        {
+            if (provider.TryGetGuestFunctionAbi(target, out abi))
+            {
+                return true;
+            }
+        }
+
+        abi = GuestFunctionAbi.Empty;
+        return false;
+    }
+}
+
+public sealed class EmptyGuestFunctionAbiProvider : IGuestFunctionAbiProvider
+{
+    public static EmptyGuestFunctionAbiProvider Instance { get; } = new();
+
+    private EmptyGuestFunctionAbiProvider()
+    {
+    }
+
+    public bool TryGetGuestFunctionAbi(string target, out GuestFunctionAbi abi)
+    {
+        abi = GuestFunctionAbi.Empty;
+        return false;
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/GuestMemoryRangeLowering.cs b/translator/src/Translator.Core/CodeGen/GuestMemoryRangeLowering.cs
new file mode 100644
index 0000000..010a821
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/GuestMemoryRangeLowering.cs
@@ -0,0 +1,798 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Globalization;
+using Translator.Core.Ir;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Ssa;
+
+namespace Translator.Core.CodeGen;
+
+/// <summary>
+/// Converts repeated accesses through one SSA base into an explicit resolved
+/// guest-memory range. Lifetimes are deliberately bounded by calls and block
+/// edges; widening across CFG edges is a separate dominance proof.
+/// </summary>
+public static class GuestMemoryRangeLowering
+{
+    private const int MaxRangeLength = 4096;
+
+    // Hardware register window (gather pipe, CP/PE/PI registers, EFB aperture below 0xCE000000).
+    // Nothing here is backed by a host mapping, so hoisting it would only feed the cold unresolved
+    // chain, and it would also rewrite gather-pipe stores out of the IrStore shape that
+    // TryEmitKnownGpuFifoStore needs for its direct GX_HLE_FIFO_Write* fast path. Keep it unhoisted.
+    private const uint HardwareRegisterWindowStart = 0xCC000000u;
+    private const uint HardwareRegisterWindowEnd = 0xCE000000u;
+
+    public static IrFunction Lower(IrFunction function, int minimumAccesses = 8,
+        bool ignoreDisabledPcTraces = false,
+        bool scalarOnly = false)
+    {
+        var nextRange = 0;
+        var hardwareConstants = CxxLinearCodeGenerator.BuildKnownUIntConstants(function);
+        function = LowerFunctionLiveInRanges(
+            function, ref nextRange, minimumAccesses, ignoreDisabledPcTraces,
+            hardwareConstants);
+        var blocks = function.Blocks.Select(block =>
+            block with { Instructions = CombineAdjacentLoads(
+                LowerBlock(block.Instructions, ref nextRange, minimumAccesses,
+                    scalarOnly, hardwareConstants),
+                ignoreDisabledPcTraces) }).ToArray();
+        return function with { Blocks = blocks };
+    }
+
+    /// <summary>
+    /// True when the instruction's effective address is a compile-time constant inside the
+    /// hardware register window. Must use the same constant map as <see cref="CxxLinearCodeGenerator.BuildKnownUIntConstants"/>
+    /// so every gather-pipe write the emitter would classify is excluded here too.
+    /// </summary>
+    internal static bool IsProvenHardwareRegisterAccess(
+        IrInstruction instruction, IReadOnlyDictionary<string, uint>? constants)
+    {
+        if (constants is null || constants.Count == 0)
+            return false;
+        var address = instruction switch
+        {
+            IrLoad load => load.Address,
+            IrStore store => store.Address,
+            IrCall call when TryParsePsq(call, out _) &&
+                             call.Arguments[0].RegisterName is { } psqBase =>
+                new IrAddress(psqBase, 0),
+            _ => null
+        };
+        if (address is null || !constants.TryGetValue(address.Base, out var baseAddress))
+            return false;
+        var effective = unchecked(baseAddress + (uint)address.Offset);
+        return effective >= HardwareRegisterWindowStart && effective < HardwareRegisterWindowEnd;
+    }
+
+    /// <summary>
+    /// Reuses scalar ranges across CFG edges only when the first access dominates every consumer
+    /// and no invalidating call can occur on any path between them (the cross-CFG memory epoch proof).
+    /// </summary>
+    private static IrFunction LowerFunctionLiveInRanges(
+        IrFunction function, ref int nextRange, int minimumAccesses,
+        bool ignoreDisabledPcTraces,
+        IReadOnlyDictionary<string, uint>? hardwareConstants = null)
+    {
+        var definitions = new Dictionary<string, List<DefinitionSite>>(StringComparer.OrdinalIgnoreCase);
+        for (var blockIndex = 0; blockIndex < function.Blocks.Count; blockIndex++)
+        for (var instructionIndex = 0;
+             instructionIndex < function.Blocks[blockIndex].Instructions.Count;
+             instructionIndex++)
+        {
+            foreach (var destination in DefinedDestinations(
+                         function.Blocks[blockIndex].Instructions[instructionIndex]))
+            {
+                if (!definitions.TryGetValue(destination, out var sites))
+                    definitions[destination] = sites = new List<DefinitionSite>();
+                sites.Add(new DefinitionSite(blockIndex, instructionIndex));
+            }
+        }
+        var candidates = new List<FunctionAccess>();
+        for (var blockIndex = 0; blockIndex < function.Blocks.Count; blockIndex++)
+        {
+            foreach (var access in BuildAccesses(function.Blocks[blockIndex].Instructions,
+                         normalizeArchitecturalRegisters: false, hardwareConstants))
+                if (access.Psq is null)
+                    candidates.Add(new FunctionAccess(blockIndex, access));
+        }
+        if (!candidates.GroupBy(candidate => new AccessClass(
+                candidate.Access.Address.Base, candidate.Access.IsStore))
+            .Any(group => group.Count() >= minimumAccesses))
+            return function;
+
+        var cfg = IrCfg.Build(function);
+        var dominators = ComputeDominators(cfg);
+        var reachability = ComputeReachability(cfg);
+        var cyclicBlocks = cfg.Blocks.Keys.Where(label =>
+                cfg.Successors(label).Any(successor => reachability[successor].Contains(label)))
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+
+        var plans = new Dictionary<(int Block, int Instruction), Plan>();
+        var resolves = new Dictionary<int, List<PlacedResolve>>();
+        foreach (var group in candidates.GroupBy(candidate => new AccessClass(
+                     candidate.Access.Address.Base, candidate.Access.IsStore)))
+        {
+            var remaining = group.ToList();
+            if (remaining.Count < minimumAccesses) continue;
+            if (remaining.Any(candidate => HasOverlappingOppositeAccess(
+                    candidate.Access, candidates.Select(static item => item.Access))))
+                continue;
+            var invalidators = CollectInvalidators(function, group.Key.Base);
+            DefinitionSite? definition = null;
+            if (definitions.TryGetValue(group.Key.Base, out var definitionSites))
+            {
+                // The SSA value must have one authoritative definition and it
+                // must dominate every consumer.  Reused version names on
+                // mutually-exclusive edges are conservatively rejected.
+                if (definitionSites.Count != 1) continue;
+                definition = definitionSites[0];
+                var defined = definitionSites[0];
+                var definitionBlock = function.Blocks[defined.BlockIndex].Label;
+                if (remaining.Any(candidate =>
+                        !dominators[candidate.AccessBlockLabel(function)].Contains(definitionBlock) ||
+                        candidate.BlockIndex == defined.BlockIndex &&
+                        candidate.Access.Index <= defined.InstructionIndex))
+                    continue;
+            }
+            while (remaining.Count >= minimumAccesses)
+            {
+                FunctionAccess? bestAnchor = null;
+                FunctionAccess[] bestMembers = [];
+                foreach (var anchor in remaining)
+                {
+                    var members = remaining.Where(candidate =>
+                            DominatesAccess(function, dominators, anchor, candidate) &&
+                            !HasInvalidatingBoundaryOnPath(
+                                function, reachability, cyclicBlocks,
+                                invalidators, anchor, candidate))
+                        .OrderBy(candidate => candidate.Access.Index)
+                        .ToList();
+                    // Keep a bounded affine window around the real anchor. A
+                    // distant outlier must not suppress a useful safe fragment.
+                    var selected = new List<FunctionAccess>();
+                    long windowMin = anchor.Access.Address.Offset;
+                    long windowMax = windowMin + anchor.Access.SizeBytes;
+                    foreach (var candidate in members.OrderBy(candidate =>
+                                 Math.Abs((long)candidate.Access.Address.Offset - anchor.Access.Address.Offset)))
+                    {
+                        var nextMin = Math.Min(windowMin, candidate.Access.Address.Offset);
+                        var nextMax = Math.Max(windowMax,
+                            (long)candidate.Access.Address.Offset + candidate.Access.SizeBytes);
+                        if (nextMax - nextMin > MaxRangeLength) continue;
+                        windowMin = nextMin;
+                        windowMax = nextMax;
+                        selected.Add(candidate);
+                    }
+                    if (selected.Count > bestMembers.Length)
+                    {
+                        bestAnchor = anchor;
+                        bestMembers = selected.ToArray();
+                    }
+                }
+                if (bestAnchor is null || bestMembers.Length < minimumAccesses) break;
+
+                var min = bestMembers.Min(static candidate => (long)candidate.Access.Address.Offset);
+                var max = bestMembers.Max(static candidate =>
+                    (long)candidate.Access.Address.Offset + candidate.Access.SizeBytes);
+                var range = $"guest_range_{nextRange++}";
+                var plan = new Plan(range, (int)min, (int)(max - min),
+                    NeedsRead: !group.Key.IsStore, NeedsWrite: group.Key.IsStore);
+                var resolve = new IrResolveGuestMemoryRange(range, IrValue.Register(group.Key.Base),
+                    plan.MinOffset, plan.Length, plan.NeedsRead, plan.NeedsWrite);
+                if (!resolves.TryGetValue(bestAnchor.BlockIndex, out var placed))
+                    resolves[bestAnchor.BlockIndex] = placed = new List<PlacedResolve>();
+                // Placement is immediately before an access that executes on
+                // every path reaching the remaining consumers.
+                placed.Add(new PlacedResolve(bestAnchor.Access.Index - 1, resolve));
+                foreach (var candidate in bestMembers)
+                {
+                    plans[(candidate.BlockIndex, candidate.Access.Index)] = plan;
+                    remaining.Remove(candidate);
+                }
+            }
+        }
+        if (resolves.Count == 0) return function;
+
+        var blocks = new IrBasicBlock[function.Blocks.Count];
+        for (var blockIndex = 0; blockIndex < function.Blocks.Count; blockIndex++)
+        {
+            var source = function.Blocks[blockIndex].Instructions;
+            var accessMap = BuildAccesses(source, normalizeArchitecturalRegisters: false, hardwareConstants)
+                .ToDictionary(static access => access.Index);
+            resolves.TryGetValue(blockIndex, out var blockResolves);
+            var output = new List<IrInstruction>(source.Count + (blockResolves?.Count ?? 0));
+            // LLVM requires the phi set to stay a contiguous block prefix, so any resolve placed
+            // at or before a leading phi must be emitted after the whole phi set instead.
+            var leadingPhiEnd = -1;
+            var sawMaterialInstruction = false;
+            for (var index = 0; index < source.Count; ++index)
+            {
+                if (source[index] is IrPhi && !sawMaterialInstruction)
+                {
+                    leadingPhiEnd = index;
+                    continue;
+                }
+                if (source[index] is IrComment or IrTracePpc) continue;
+                sawMaterialInstruction = true;
+            }
+            var placedAfter = blockResolves?.GroupBy(placed =>
+                placed.AfterInstructionIndex < 0 ||
+                placed.AfterInstructionIndex <= leadingPhiEnd &&
+                source[placed.AfterInstructionIndex] is IrPhi
+                    ? leadingPhiEnd
+                    : placed.AfterInstructionIndex)
+                .ToDictionary(static group => group.Key,
+                    static group => group.Select(placed => placed.Resolve).ToArray());
+            if (placedAfter is not null && leadingPhiEnd < 0 && placedAfter.Remove(-1, out var entryResolves))
+                output.AddRange(entryResolves);
+            for (var instructionIndex = 0; instructionIndex < source.Count; instructionIndex++)
+            {
+                if (!plans.TryGetValue((blockIndex, instructionIndex), out var plan))
+                {
+                    output.Add(source[instructionIndex]);
+                    if (placedAfter is not null && placedAfter.TryGetValue(instructionIndex, out var afterUnchanged))
+                        output.AddRange(afterUnchanged);
+                    continue;
+                }
+                var access = accessMap[instructionIndex];
+                output.Add(ToResolved(source[instructionIndex], access, plan));
+                if (placedAfter is not null && placedAfter.TryGetValue(instructionIndex, out var afterResolved))
+                    output.AddRange(afterResolved);
+            }
+            blocks[blockIndex] = function.Blocks[blockIndex] with
+                { Instructions = CombineAdjacentLoads(output, ignoreDisabledPcTraces) };
+        }
+        return function with { Blocks = blocks };
+    }
+
+    private static bool DominatesAccess(
+        IrFunction function,
+        IReadOnlyDictionary<string, HashSet<string>> dominators,
+        FunctionAccess anchor,
+        FunctionAccess consumer)
+    {
+        if (anchor.BlockIndex == consumer.BlockIndex)
+            return anchor.Access.Index <= consumer.Access.Index;
+        return dominators[consumer.AccessBlockLabel(function)].Contains(
+            anchor.AccessBlockLabel(function));
+    }
+
+    private static bool HasOverlappingOppositeAccess(
+        Access access, IEnumerable<Access> candidates)
+    {
+        var accessStart = (long)access.Address.Offset;
+        var accessEnd = accessStart + access.SizeBytes;
+        return candidates.Any(candidate =>
+            candidate.IsStore != access.IsStore &&
+            candidate.Address.Base.Equals(
+                access.Address.Base, StringComparison.OrdinalIgnoreCase) &&
+            accessStart < (long)candidate.Address.Offset + candidate.SizeBytes &&
+            candidate.Address.Offset < accessEnd);
+    }
+
+    private static bool HasInvalidatingBoundaryOnPath(
+        IrFunction function,
+        IReadOnlyDictionary<string, HashSet<string>> reachability,
+        IReadOnlySet<string> cyclicBlocks,
+        IReadOnlyList<InstructionSite> invalidators,
+        FunctionAccess anchor,
+        FunctionAccess consumer)
+    {
+        var anchorLabel = anchor.AccessBlockLabel(function);
+        var consumerLabel = consumer.AccessBlockLabel(function);
+        foreach (var invalidator in invalidators)
+        {
+            var boundaryLabel = function.Blocks[invalidator.BlockIndex].Label;
+            var afterAnchor = invalidator.BlockIndex == anchor.BlockIndex
+                ? invalidator.InstructionIndex > anchor.Access.Index
+                : reachability[anchorLabel].Contains(boundaryLabel);
+            var beforeConsumer = invalidator.BlockIndex == consumer.BlockIndex
+                ? invalidator.InstructionIndex < consumer.Access.Index ||
+                  anchor.BlockIndex != consumer.BlockIndex &&
+                  cyclicBlocks.Contains(consumerLabel)
+                : reachability[boundaryLabel].Contains(consumerLabel);
+            if (afterAnchor && beforeConsumer) return true;
+        }
+        return false;
+    }
+
+    private static IReadOnlyList<InstructionSite> CollectInvalidators(
+        IrFunction function, string baseName)
+    {
+        var result = new List<InstructionSite>();
+        for (var blockIndex = 0; blockIndex < function.Blocks.Count; blockIndex++)
+        for (var instructionIndex = 0;
+             instructionIndex < function.Blocks[blockIndex].Instructions.Count;
+             instructionIndex++)
+        {
+            var instruction = function.Blocks[blockIndex].Instructions[instructionIndex];
+            if (IsMemoryEpochBoundary(instruction) ||
+                Defines(instruction, baseName, normalizeArchitecturalRegisters: true))
+                result.Add(new InstructionSite(blockIndex, instructionIndex));
+        }
+        return result;
+    }
+
+    private static Dictionary<string, HashSet<string>> ComputeDominators(IrCfg cfg)
+    {
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var labels = cfg.Blocks.Keys.ToArray();
+        var all = labels.ToHashSet(comparer);
+        var result = labels.ToDictionary(label => label,
+            label => label.Equals(cfg.Entry, StringComparison.OrdinalIgnoreCase)
+                ? new HashSet<string>([label], comparer)
+                : new HashSet<string>(all, comparer), comparer);
+        bool changed;
+        do
+        {
+            changed = false;
+            foreach (var label in labels)
+            {
+                if (label.Equals(cfg.Entry, StringComparison.OrdinalIgnoreCase)) continue;
+                var predecessors = cfg.Predecessors(label);
+                var next = predecessors.Count == 0
+                    ? new HashSet<string>(comparer)
+                    : new HashSet<string>(result[predecessors[0]], comparer);
+                foreach (var predecessor in predecessors.Skip(1)) next.IntersectWith(result[predecessor]);
+                next.Add(label);
+                if (result[label].SetEquals(next)) continue;
+                result[label] = next;
+                changed = true;
+            }
+        } while (changed);
+        return result;
+    }
+
+    private static Dictionary<string, HashSet<string>> ComputeReachability(IrCfg cfg)
+    {
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var result = new Dictionary<string, HashSet<string>>(comparer);
+        foreach (var start in cfg.Blocks.Keys)
+        {
+            var reachable = new HashSet<string>(comparer);
+            var pending = new Stack<string>();
+            pending.Push(start);
+            while (pending.Count != 0)
+            {
+                var current = pending.Pop();
+                if (!reachable.Add(current)) continue;
+                foreach (var successor in cfg.Successors(current)) pending.Push(successor);
+            }
+            result[start] = reachable;
+        }
+        return result;
+    }
+
+    private static IrInstruction ToResolved(IrInstruction instruction, Access access, Plan plan)
+    {
+        var relativeOffset = access.Address.Offset - plan.MinOffset;
+        return instruction switch
+        {
+            IrLoad load => new IrResolvedLoad(load.Destination, plan.Range, load.Address,
+                relativeOffset, load.SizeBytes),
+            IrStore store => new IrResolvedStore(plan.Range, store.Address, relativeOffset,
+                store.Source, store.SizeBytes),
+            IrCall call when access.Psq is { IsStore: false } psq =>
+                new IrResolvedPsqLoad(call.Destination, plan.Range, call.Arguments[0], relativeOffset,
+                    psq.W, psq.I, psq.KnownGqr, psq.GuardKnownGqr),
+            IrCall call when access.Psq is { IsStore: true } psq =>
+                new IrResolvedPsqStore(plan.Range, call.Arguments[0], relativeOffset, call.Arguments[1],
+                    psq.W, psq.I, psq.KnownGqr, psq.GuardKnownGqr),
+            _ => instruction
+        };
+    }
+
+    private static IReadOnlyList<IrInstruction> CombineAdjacentLoads(
+        IReadOnlyList<IrInstruction> instructions, bool ignoreDisabledPcTraces)
+    {
+        var result = new List<IrInstruction>(instructions.Count);
+        for (var index = 0; index < instructions.Count; index++)
+        {
+            var next = index + 1;
+            if (instructions[index] is IrResolvedLoad first)
+            {
+                while (next < instructions.Count &&
+                       ((ignoreDisabledPcTraces && instructions[next] is IrTracePpc) ||
+                        IsMovableAddressCalculation(instructions[next], first.Destination))) next++;
+            }
+            else if (instructions[index] is IrResolvedStore)
+            {
+                while (next < instructions.Count &&
+                       ((ignoreDisabledPcTraces && instructions[next] is IrTracePpc) ||
+                        IsMovableAddressCalculation(instructions[next], null))) next++;
+            }
+
+            if (next < instructions.Count &&
+                instructions[index] is IrResolvedLoad firstLoad &&
+                instructions[next] is IrResolvedLoad secondLoad &&
+                firstLoad.Range.Equals(secondLoad.Range, StringComparison.Ordinal) &&
+                firstLoad.SizeBytes == secondLoad.SizeBytes && firstLoad.SizeBytes is 2 or 4 &&
+                Math.Abs(secondLoad.RangeOffset - firstLoad.RangeOffset) == firstLoad.SizeBytes)
+            {
+                for (var movable = index + 1; movable < next; movable++) result.Add(instructions[movable]);
+                var descending = secondLoad.RangeOffset < firstLoad.RangeOffset;
+                result.Add(new IrResolvedLoadPair(firstLoad.Destination, secondLoad.Destination, firstLoad.Range,
+                    firstLoad.OriginalAddress, secondLoad.OriginalAddress,
+                    Math.Min(firstLoad.RangeOffset, secondLoad.RangeOffset), firstLoad.SizeBytes, descending));
+                index = next;
+                continue;
+            }
+            if (next < instructions.Count &&
+                instructions[index] is IrResolvedStore firstStore &&
+                instructions[next] is IrResolvedStore secondStore &&
+                firstStore.Range.Equals(secondStore.Range, StringComparison.Ordinal) &&
+                firstStore.SizeBytes == secondStore.SizeBytes && firstStore.SizeBytes is 2 or 4 &&
+                Math.Abs(secondStore.RangeOffset - firstStore.RangeOffset) == firstStore.SizeBytes)
+            {
+                for (var movable = index + 1; movable < next; movable++) result.Add(instructions[movable]);
+                var descending = secondStore.RangeOffset < firstStore.RangeOffset;
+                result.Add(new IrResolvedStorePair(firstStore.Range, firstStore.OriginalAddress,
+                    secondStore.OriginalAddress, Math.Min(firstStore.RangeOffset, secondStore.RangeOffset),
+                    firstStore.Source, secondStore.Source, firstStore.SizeBytes, descending));
+                index = next;
+                continue;
+            }
+            result.Add(instructions[index]);
+        }
+        return result;
+    }
+
+    private static bool IsMovableAddressCalculation(IrInstruction instruction, string? forbiddenUse)
+    {
+        static bool Uses(IrValue value, string name) =>
+            value.RegisterName?.Equals(name, StringComparison.OrdinalIgnoreCase) == true;
+
+        return instruction switch
+        {
+            IrAssign assign when !IsArchitecturalRegister(assign.Destination) =>
+                forbiddenUse is null || !Uses(assign.Value, forbiddenUse),
+            IrBinary binary when !IsArchitecturalRegister(binary.Destination) =>
+                forbiddenUse is null || (!Uses(binary.Left, forbiddenUse) && !Uses(binary.Right, forbiddenUse)),
+            _ => false
+        };
+    }
+
+    private static IReadOnlyList<IrInstruction> LowerBlock(
+        IReadOnlyList<IrInstruction> instructions,
+        ref int nextRange,
+        int minimumAccesses,
+        bool scalarOnly,
+        IReadOnlyDictionary<string, uint>? hardwareConstants = null)
+    {
+        var result = new List<IrInstruction>(instructions.Count);
+        var segment = new List<IrInstruction>();
+        var rangeCounter = nextRange;
+
+        void Flush()
+        {
+            if (segment.Count == 0) return;
+            LowerSegment(segment, result, ref rangeCounter, minimumAccesses,
+                scalarOnly, hardwareConstants);
+            segment.Clear();
+        }
+
+        foreach (var instruction in instructions)
+        {
+            if (IsOwnershipBoundary(instruction))
+            {
+                Flush();
+                result.Add(instruction);
+            }
+            else
+            {
+                segment.Add(instruction);
+            }
+        }
+        Flush();
+        nextRange = rangeCounter;
+        return result;
+    }
+
+    private static void LowerSegment(
+        IReadOnlyList<IrInstruction> segment,
+        List<IrInstruction> output,
+        ref int nextRange,
+        int minimumAccesses,
+        bool scalarOnly,
+        IReadOnlyDictionary<string, uint>? hardwareConstants = null)
+    {
+        var accesses = BuildAccesses(segment,
+                normalizeArchitecturalRegisters: true, hardwareConstants)
+            .Where(access => !scalarOnly || access.Psq is null)
+            .ToArray();
+        var accessesByIndex = accesses.ToDictionary(static access => access.Index);
+        var plans = new Dictionary<int, Plan>();
+
+        foreach (var group in accesses.GroupBy(access =>
+                     new AccessClass(access.Address.Base, access.IsStore)))
+        {
+            var grouped = group.OrderBy(static access => access.Index).ToArray();
+            if (grouped.Length < 2) continue;
+            // Resolving a range costs about as much as one checked access, so require enough
+            // consumers to amortize it; a per-function cache for just two accesses measurably
+            // increased stack traffic and CPU time.
+            if (grouped.Length < minimumAccesses) continue;
+            if (grouped.Any(access => HasOverlappingOppositeAccess(access, accesses)))
+                continue;
+            var min = grouped.Min(static access => (long)access.Address.Offset);
+            var max = grouped.Max(static access => (long)access.Address.Offset + access.SizeBytes);
+            var length = max - min;
+            if (length <= 0 || length > MaxRangeLength) continue;
+
+            var range = $"guest_range_{nextRange++}";
+            var plan = new Plan(range, (int)min, (int)length,
+                grouped.Any(static access => !access.IsStore), grouped.Any(static access => access.IsStore));
+            foreach (var access in grouped) plans[access.Index] = plan;
+        }
+
+        var emitted = new HashSet<string>(StringComparer.Ordinal);
+        for (var index = 0; index < segment.Count; index++)
+        {
+            if (!plans.TryGetValue(index, out var plan))
+            {
+                output.Add(segment[index]);
+                continue;
+            }
+
+            var access = accessesByIndex[index];
+            if (emitted.Add(plan.Range))
+            {
+                // The anchor's raw base register holds root + BaseDelta at
+                // this point, so shifting the canonical minimum back by the
+                // delta makes the emitted expression equal root + MinOffset.
+                output.Add(new IrResolveGuestMemoryRange(
+                    plan.Range, IrValue.Register(access.OriginalBase ?? access.Address.Base),
+                    checked(plan.MinOffset - access.BaseDelta),
+                    plan.Length, plan.NeedsRead, plan.NeedsWrite));
+            }
+
+            output.Add(ToResolved(segment[index], access, plan));
+        }
+    }
+
+    private static bool IsOwnershipBoundary(IrInstruction instruction) => instruction switch
+    {
+        IrCall call => IsMemoryEpochBoundary(call),
+        IrIndirectCall or IrBranch or IrJump or IrIndirectJump or IrJumpTable or IrReturn or IrUndefined => true,
+        _ => false
+    };
+
+    // Catalog effects, rather than helper-name prefixes, define transparency.
+    // Unknown/complete-context helpers, guest re-entry, suspension, thread
+    // switching, and hidden GPR writes all end the pointer lifetime.
+    private static bool IsMemoryEpochBoundary(IrInstruction instruction) => instruction switch
+    {
+        IrCall call => IsMemoryEpochBoundary(GuestHelperEffectCatalog.Analyze(call)),
+        IrIndirectCall => true,
+        _ => false
+    };
+
+    private static bool IsMemoryEpochBoundary(GuestHelperEffect effect)
+    {
+        const GuestCallBoundaryFlags unsafeFlags =
+            GuestCallBoundaryFlags.RequiresCompleteContext |
+            GuestCallBoundaryFlags.CanSuspend |
+            GuestCallBoundaryFlags.CanSwitchThreads |
+            GuestCallBoundaryFlags.InvokesGuestCode;
+        return effect.GprWriteMask != 0 || (effect.BoundaryFlags & unsafeFlags) != 0;
+    }
+
+    private static bool Defines(IrInstruction instruction, string name,
+        bool normalizeArchitecturalRegisters = true)
+    {
+        foreach (var destination in DefinedDestinations(instruction))
+        {
+            var matches = normalizeArchitecturalRegisters
+                ? NormalizeRegisterIdentity(destination).Equals(
+                    NormalizeRegisterIdentity(name), StringComparison.OrdinalIgnoreCase)
+                : destination.Equals(name, StringComparison.OrdinalIgnoreCase);
+            if (matches) return true;
+        }
+        return false;
+    }
+
+    private static IEnumerable<Access> BuildAccesses(IReadOnlyList<IrInstruction> segment,
+        bool normalizeArchitecturalRegisters = true,
+        IReadOnlyDictionary<string, uint>? hardwareConstants = null)
+    {
+        var affine = new Dictionary<string, (string Root, int Offset)>(StringComparer.OrdinalIgnoreCase);
+        // psq_stu/stwu-style pointer walks redefine the architectural base on
+        // every step. Tracking the redefinition as an affine update keeps the
+        // whole chain in one canonical root; an untrackable write instead
+        // starts a new generation ("r10#2") so accesses through different
+        // runtime values can never share a range proof.
+        var generations = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+
+        (string Root, int Offset) Lookup(string name)
+        {
+            if (affine.TryGetValue(name, out var known)) return known;
+            var normalized = normalizeArchitecturalRegisters
+                ? NormalizeRegisterIdentity(name) : name;
+            if (normalizeArchitecturalRegisters && IsArchitecturalRegister(name))
+            {
+                if (!normalized.Equals(name, StringComparison.OrdinalIgnoreCase) &&
+                    affine.TryGetValue(normalized, out var knownNormalized))
+                    return knownNormalized;
+                if (generations.TryGetValue(normalized, out var generation) && generation > 0)
+                    return (normalized + "#" + generation, 0);
+            }
+            return (normalized, 0);
+        }
+
+        void InvalidateDestination(string destination)
+        {
+            if (normalizeArchitecturalRegisters && IsArchitecturalRegister(destination))
+            {
+                var normalized = NormalizeRegisterIdentity(destination);
+                generations[normalized] =
+                    generations.TryGetValue(normalized, out var generation) ? generation + 1 : 1;
+                affine.Remove(normalized);
+                return;
+            }
+            affine.Remove(destination);
+        }
+
+        for (var index = 0; index < segment.Count; index++)
+        {
+            var instruction = segment[index];
+            // A hardware-register access is deliberately not an access at all
+            // as far as range proofs are concerned; the affine tracker below
+            // still observes the instruction's register writes.
+            var raw = IsProvenHardwareRegisterAccess(instruction, hardwareConstants)
+                ? null
+                : Access.TryCreate(instruction, index);
+            if (raw is not null)
+            {
+                var (root, delta) = Lookup(raw.Address.Base);
+                var canonical = new IrAddress(root, checked(delta + raw.Address.Offset));
+                yield return raw with
+                {
+                    Address = canonical,
+                    OriginalBase = raw.Address.Base,
+                    BaseDelta = delta,
+                };
+            }
+
+            switch (instruction)
+            {
+                case IrAssign assign when assign.Value is { Kind: "register", RegisterName: { } source }:
+                    if (IsArchitecturalRegister(assign.Destination))
+                    {
+                        if (normalizeArchitecturalRegisters)
+                            affine[NormalizeRegisterIdentity(assign.Destination)] = Lookup(source);
+                        else affine.Remove(assign.Destination);
+                    }
+                    else affine[assign.Destination] = Lookup(source);
+                    break;
+                case IrBinary binary when binary.Op.Equals("add", StringComparison.OrdinalIgnoreCase):
+                    if (TryAffineAdd(binary, Lookup, out var value) &&
+                        (normalizeArchitecturalRegisters || !IsArchitecturalRegister(binary.Destination)))
+                    {
+                        affine[normalizeArchitecturalRegisters &&
+                               IsArchitecturalRegister(binary.Destination)
+                            ? NormalizeRegisterIdentity(binary.Destination)
+                            : binary.Destination] = value;
+                    }
+                    else InvalidateDestination(binary.Destination);
+                    break;
+                default:
+                    foreach (var destination in DefinedDestinations(instruction))
+                        InvalidateDestination(destination);
+                    break;
+            }
+        }
+    }
+
+    private static bool TryAffineAdd(IrBinary binary,
+        Func<string, (string Root, int Offset)> lookup,
+        out (string Root, int Offset) result)
+    {
+        result = default;
+        IrValue register;
+        long constant;
+        if (binary.Left is { Kind: "register" } && binary.Right is { Kind: "const", Constant: { } right })
+        { register = binary.Left; constant = right; }
+        else if (binary.Right is { Kind: "register" } && binary.Left is { Kind: "const", Constant: { } left })
+        { register = binary.Right; constant = left; }
+        else return false;
+        if (register.RegisterName is null || constant is < int.MinValue or > int.MaxValue) return false;
+        var baseValue = lookup(register.RegisterName);
+        var sum = (long)baseValue.Offset + constant;
+        if (sum is < int.MinValue or > int.MaxValue) return false;
+        result = (baseValue.Root, (int)sum);
+        return true;
+    }
+
+    /// <summary>Every register this instruction writes. Must delegate to
+    /// <see cref="IrRegisterDataFlow.Definitions"/>, not a local node-kind switch: a prior switch missed
+    /// resolved-load kinds, which shared one range root across loads and caused the minimap shadow-pane
+    /// black-icon bug in CtrlRace2DMapCharacter::calcTransform.</summary>
+    private static IEnumerable<string> DefinedDestinations(IrInstruction instruction) =>
+        IrRegisterDataFlow.Definitions(instruction);
+
+    private static string NormalizeRegisterIdentity(string name)
+    {
+        if (!IsArchitecturalRegister(name)) return name;
+        var separator = name.IndexOf('_');
+        return separator < 0 ? name : name[..separator];
+    }
+
+    private static bool IsArchitecturalRegister(string name)
+    {
+        var separator = name.IndexOf('_');
+        var baseName = separator < 0 ? name : name[..separator];
+        if (separator >= 0 && !name[(separator + 1)..].All(char.IsDigit)) return false;
+        if (baseName.Length < 2) return false;
+        if (baseName[0] is not ('r' or 'R' or 'f' or 'F')) return false;
+        return int.TryParse(baseName.AsSpan(1), out var index) && index is >= 0 and < 32;
+    }
+
+    // Address is the canonical (root-relative) form used for grouping.
+    // OriginalBase/BaseDelta reconstruct the anchor-time expression: the raw
+    // base register plus the affine delta the tracker had accumulated for it,
+    // so a resolve emitted at the anchor can reference a register that is
+    // itself walked forward later in the chain.
+    private sealed record Access(int Index, IrAddress Address, int SizeBytes, bool IsStore, PsqAccess? Psq = null,
+        string? OriginalBase = null, int BaseDelta = 0)
+    {
+        public static Access? TryCreate(IrInstruction instruction, int index) => instruction switch
+        {
+            IrLoad load => new Access(index, load.Address, load.SizeBytes, false),
+            IrStore store => new Access(index, store.Address, store.SizeBytes, true),
+            IrCall call when TryParsePsq(call, out var psq) && call.Arguments[0].RegisterName is { } address =>
+                new Access(index, new IrAddress(address, 0), psq.W == 0 ? 8 : 4, psq.IsStore, psq),
+            _ => null
+        };
+    }
+
+    private sealed record PsqAccess(bool IsStore, uint W, uint I, uint? KnownGqr, bool GuardKnownGqr);
+
+    private static bool TryParsePsq(IrCall call, out PsqAccess psq)
+    {
+        psq = null!;
+        var isLoad = call.Target.Equals("PPC_PsqL", StringComparison.OrdinalIgnoreCase) ||
+                     call.Target.StartsWith("PPC_PsqLKnown_", StringComparison.OrdinalIgnoreCase) ||
+                     call.Target.StartsWith("PPC_PsqLKnownGuarded_", StringComparison.OrdinalIgnoreCase);
+        var isStore = call.Target.Equals("PPC_PsqSt", StringComparison.OrdinalIgnoreCase) ||
+                      call.Target.StartsWith("PPC_PsqStKnown_", StringComparison.OrdinalIgnoreCase) ||
+                      call.Target.StartsWith("PPC_PsqStKnownGuarded_", StringComparison.OrdinalIgnoreCase);
+        if ((!isLoad && !isStore) || call.Arguments.Count < (isLoad ? 3 : 4) ||
+            call.Arguments[0] is not { Kind: "register", RegisterName: not null }) return false;
+        var wArg = call.Arguments[isLoad ? 1 : 2];
+        var iArg = call.Arguments[isLoad ? 2 : 3];
+        if (wArg.Constant is not (0 or 1) || iArg.Constant is < 0 or > 7) return false;
+        uint? known = null;
+        var guardedMarker = isLoad ? "PPC_PsqLKnownGuarded_" : "PPC_PsqStKnownGuarded_";
+        var knownMarker = isLoad ? "PPC_PsqLKnown_" : "PPC_PsqStKnown_";
+        var guarded = call.Target.StartsWith(guardedMarker, StringComparison.OrdinalIgnoreCase);
+        var marker = guarded ? guardedMarker : knownMarker;
+        if (call.Target.StartsWith(marker, StringComparison.OrdinalIgnoreCase) &&
+            uint.TryParse(call.Target.AsSpan(marker.Length), NumberStyles.HexNumber,
+                CultureInfo.InvariantCulture, out var parsed)) known = parsed;
+        psq = new PsqAccess(isStore, (uint)wArg.Constant.GetValueOrDefault(),
+            (uint)iArg.Constant.GetValueOrDefault(), known, guarded);
+        return true;
+    }
+
+    private sealed record Plan(string Range, int MinOffset, int Length, bool NeedsRead, bool NeedsWrite);
+    private sealed record FunctionAccess(int BlockIndex, Access Access)
+    {
+        public string AccessBlockLabel(IrFunction function) => function.Blocks[BlockIndex].Label;
+    }
+
+    private sealed record DefinitionSite(int BlockIndex, int InstructionIndex);
+    private sealed record AccessClass(string Base, bool IsStore)
+    {
+        public bool Equals(AccessClass? other) => other is not null &&
+            Base.Equals(other.Base, StringComparison.OrdinalIgnoreCase) &&
+            IsStore == other.IsStore;
+
+        public override int GetHashCode() => HashCode.Combine(
+            StringComparer.OrdinalIgnoreCase.GetHashCode(Base),
+            IsStore);
+    }
+    private sealed record InstructionSite(int BlockIndex, int InstructionIndex);
+    private sealed record PlacedResolve(int AfterInstructionIndex, IrResolveGuestMemoryRange Resolve);
+}
diff --git a/translator/src/Translator.Core/CodeGen/InferredGuestFunctionAbiProvider.cs b/translator/src/Translator.Core/CodeGen/InferredGuestFunctionAbiProvider.cs
new file mode 100644
index 0000000..f4d9fb0
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/InferredGuestFunctionAbiProvider.cs
@@ -0,0 +1,1293 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.BasicBlocks;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+using Translator.Core.Lifting;
+using Translator.Core.Loading;
+using Translator.Core.Representation;
+using Translator.Core.Translation;
+
+namespace Translator.Core.CodeGen;
+
+/// <summary>What one <see cref="InferredGuestFunctionAbiProvider.Prewarm(IEnumerable{uint}, int)"/> pass did.
+/// Returned rather than printed, since only the CLI knows if a pass is worth logging.</summary>
+public sealed record GuestAbiPrewarmReport(
+    int AddressCount,
+    double PhaseASeconds,
+    double PhaseBSeconds,
+    int PhaseBComputedCount)
+{
+    public static GuestAbiPrewarmReport Empty { get; } = new(0, 0d, 0d, 0);
+}
+
+public sealed class InferredGuestFunctionAbiProvider : IGuestFunctionAbiProvider
+{
+    private static readonly string[] AbiFloatArgumentRegisters =
+        Enumerable.Range(1, 13).Select(static i => $"f{i}").ToArray();
+
+    private static readonly HashSet<string> AbiFloatArgumentSet =
+        new(AbiFloatArgumentRegisters, StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// Sentinel stored in <see cref="_resolvedTargets"/> for targets that are not guest
+    /// addresses inside the image's used range.
+    /// </summary>
+    private const long UnresolvedTarget = -1;
+
+    private readonly ProgramImage _image;
+    private readonly ICanonicalIrProvider? _canonicalIr;
+
+    /// <summary>Lock-free ABI cache so parallel emission never serializes on ABI queries. A plain
+    /// dictionary rather than a lazy is deliberate: mutually recursive queries would deadlock under a
+    /// per-key computation lock. Worst case is two threads redundantly computing the same value.</summary>
+    private readonly ConcurrentDictionary<uint, GuestFunctionAbi> _cache = new();
+
+    /// <summary>Memoizes the (pure) target-string -&gt; guest-address resolution step.</summary>
+    private readonly ConcurrentDictionary<string, long> _resolvedTargets = new(StringComparer.Ordinal);
+
+    /// <summary>Recursion/cycle guard plus the phase-A taint stack. Per-thread so a cycle breaks only
+    /// within its own call chain, without one thread's in-flight analysis aborting another's query.</summary>
+    private readonly ThreadLocal<ThreadAnalysisState> _threadState =
+        new(static () => new ThreadAnalysisState());
+
+    /// <summary>Per-thread analysis state; see <see cref="_threadState"/>.</summary>
+    private sealed class ThreadAnalysisState
+    {
+        /// <summary>Addresses whose analysis is in flight on this thread, innermost last.</summary>
+        public readonly HashSet<uint> InProgress = new();
+
+        /// <summary>Taint flag per in-flight frame, innermost last. Non-null only during Prewarm phase A;
+        /// every other caller sees null and takes the untracked publish-always path.</summary>
+        public List<bool>? FrameTaint;
+
+        /// <summary>Reusable backing list for <see cref="FrameTaint"/>; phase A is never reentrant.</summary>
+        public readonly List<bool> FrameTaintBuffer = new();
+
+        /// <summary>Addresses already known tainted, shared by every phase-A worker of the current Prewarm
+        /// call and reset each invocation. Without this memoization an unpublishable address gets
+        /// re-analyzed, subtree and all, by every caller that reaches it, which compounds combinatorially
+        /// over deep call chains.</summary>
+        public ConcurrentDictionary<uint, byte>? TaintedAddresses;
+    }
+
+    public InferredGuestFunctionAbiProvider(
+        ProgramImage image,
+        ICanonicalIrProvider? canonicalIr = null)
+    {
+        _image = image;
+        _canonicalIr = canonicalIr;
+    }
+
+    public bool TryGetGuestFunctionAbi(string target, out GuestFunctionAbi abi)
+    {
+        if (!TryResolveTargetAddress(target, out var address))
+        {
+            abi = GuestFunctionAbi.Empty;
+            return false;
+        }
+
+        if (_cache.TryGetValue(address, out abi!))
+        {
+            return true;
+        }
+
+        var state = _threadState.Value!;
+        var inProgress = state.InProgress;
+        var frameTaint = state.FrameTaint;
+
+        if (frameTaint is not null && state.TaintedAddresses!.ContainsKey(address))
+        {
+            // Phase A only: this address is already known unpublishable, so skip re-analyzing its whole
+            // uncached subtree and just taint the consumers, matching what would happen anyway.
+            TaintFramesInFlight(frameTaint);
+            abi = GuestFunctionAbi.Empty;
+            return false;
+        }
+
+        if (!inProgress.Add(address))
+        {
+            // Cycle break: the only schedule-dependent event in this analysis. The returned value depends
+            // on which entry point started the call chain, so every frame in flight here is tainted.
+            if (frameTaint is not null)
+            {
+                TaintFramesInFlight(frameTaint);
+                state.TaintedAddresses!.TryAdd(address, 0);
+            }
+
+            abi = GuestFunctionAbi.Empty;
+            return false;
+        }
+
+        if (frameTaint is null)
+        {
+            // Untracked path: normal emission-time queries and Prewarm phase B. Publishes
+            // unconditionally, exactly as this method always has.
+            try
+            {
+                abi = Analyze(address);
+                _cache[address] = abi;
+                return true;
+            }
+            catch
+            {
+                abi = GuestFunctionAbi.Empty;
+                _cache[address] = abi;
+                return false;
+            }
+            finally
+            {
+                inProgress.Remove(address);
+            }
+        }
+
+        // Prewarm phase A: track taint for this frame and publish only if it stayed clean.
+        frameTaint.Add(false);
+        var frameIndex = frameTaint.Count - 1;
+        bool succeeded;
+        bool tainted;
+        try
+        {
+            try
+            {
+                abi = Analyze(address);
+                succeeded = true;
+            }
+            catch
+            {
+                // Whether Analyze throws can itself depend on values this frame consumed, so the fallback
+                // follows the same taint rule as a success: a tainted frame publishes nothing.
+                abi = GuestFunctionAbi.Empty;
+                succeeded = false;
+            }
+        }
+        finally
+        {
+            inProgress.Remove(address);
+            tainted = frameTaint[frameIndex];
+            frameTaint.RemoveAt(frameIndex);
+            if (tainted && frameIndex > 0)
+            {
+                // The caller consumed a locally computed, unpublished (schedule-dependent) value.
+                frameTaint[frameIndex - 1] = true;
+            }
+        }
+
+        if (tainted)
+        {
+            // Remember that this address cannot be published so no other frame - on this thread or any
+            // other - ever pays for analyzing it (or its subtree) again during this Prewarm.
+            state.TaintedAddresses!.TryAdd(address, 0);
+        }
+        else
+        {
+            _cache[address] = abi;
+        }
+
+        return succeeded;
+    }
+
+    /// <summary>Marks every frame in flight on this thread as tainted: it consumed a
+    /// schedule-dependent value and is therefore unpublishable.</summary>
+    private static void TaintFramesInFlight(List<bool> frameTaint)
+    {
+        for (var index = 0; index < frameTaint.Count; index++)
+        {
+            frameTaint[index] = true;
+        }
+    }
+
+    /// <summary>Populates the cache so a later parallel emission wave sees pure cache hits and mutually
+    /// recursive ABI cycles resolve deterministically. Byte-identical to a sequential ascending prewarm;
+    /// see the two-parameter overload for why.</summary>
+    public GuestAbiPrewarmReport Prewarm(IEnumerable<uint> addresses) =>
+        Prewarm(addresses, degreeOfParallelism: 0);
+
+    /// <summary>
+    /// Two-phase prewarm, provably identical to the old sequential ascending pass (~38.7s for the full
+    /// image). Phase A analyzes addresses in parallel with taint tracking: a frame taints if a cycle
+    /// break happens while it's in flight or it consumes a tainted result, and only untainted
+    /// (schedule-independent) frames publish to the cache, so parallel order can never change a cached
+    /// value. A shared already-tainted set stops combinatorial blowup on deep call chains (measured
+    /// 12,500+ CPU-seconds without it, vs. ~39s sequential). Phase B then walks the same list ascending,
+    /// filling in whatever phase A left uncached exactly like the old loop, which reproduces identical
+    /// SCC cycle-break results since ascending order is what picks each SCC's entry point.
+    /// </summary>
+    /// <param name="addresses">Addresses to analyze; de-duplicated and sorted internally.</param>
+    /// <param name="degreeOfParallelism">
+    /// Phase A worker count. Zero or negative selects <see cref="Environment.ProcessorCount"/>.
+    /// </param>
+    public GuestAbiPrewarmReport Prewarm(IEnumerable<uint> addresses, int degreeOfParallelism)
+    {
+        var ordered = addresses.Distinct().OrderBy(static address => address).ToArray();
+        if (ordered.Length == 0)
+        {
+            return GuestAbiPrewarmReport.Empty;
+        }
+
+        var workers = degreeOfParallelism > 0 ? degreeOfParallelism : Environment.ProcessorCount;
+        var phaseClock = System.Diagnostics.Stopwatch.StartNew();
+        if (workers > 1 && ordered.Length > 1)
+        {
+            // Fresh per invocation: taint is only meaningful relative to the cache state this pass
+            // started from, and phase B may well have cached some of it by the next call.
+            var taintedAddresses = new ConcurrentDictionary<uint, byte>();
+            var options = new ParallelOptions { MaxDegreeOfParallelism = workers };
+            Parallel.ForEach(ordered, options, address => PrewarmTracked(address, taintedAddresses));
+        }
+        var phaseASeconds = phaseClock.Elapsed.TotalSeconds;
+
+        var phaseBComputed = 0;
+        foreach (var address in ordered)
+        {
+            if (_cache.ContainsKey(address))
+            {
+                continue;
+            }
+
+            phaseBComputed++;
+            TryGetGuestFunctionAbi(FunctionTargetName(address), out _);
+        }
+        return new GuestAbiPrewarmReport(
+            ordered.Length,
+            phaseASeconds,
+            phaseClock.Elapsed.TotalSeconds - phaseASeconds,
+            phaseBComputed);
+    }
+
+    /// <summary>Phase A body: analyze one address with taint tracking enabled for this thread.</summary>
+    private void PrewarmTracked(uint address, ConcurrentDictionary<uint, byte> taintedAddresses)
+    {
+        if (_cache.ContainsKey(address) || taintedAddresses.ContainsKey(address))
+        {
+            return;
+        }
+
+        var state = _threadState.Value!;
+        var frames = state.FrameTaintBuffer;
+        frames.Clear();
+        state.TaintedAddresses = taintedAddresses;
+        state.FrameTaint = frames;
+        try
+        {
+            TryGetGuestFunctionAbi(FunctionTargetName(address), out _);
+        }
+        catch
+        {
+            // Phase A is pure speculation: anything that escapes here leaves the address uncached, and
+            // phase B reproduces the original sequential behaviour (including rethrowing) for it. Never
+            // let it tear down the parallel loop, which the sequential prewarm could not have done.
+        }
+        finally
+        {
+            state.FrameTaint = null;
+            state.TaintedAddresses = null;
+        }
+    }
+
+    private static string FunctionTargetName(uint address) => $"func_{address:X8}";
+
+    private bool TryResolveTargetAddress(string target, out uint address)
+    {
+        if (_resolvedTargets.TryGetValue(target, out var cached))
+        {
+            address = cached == UnresolvedTarget ? 0u : (uint)cached;
+            return cached != UnresolvedTarget;
+        }
+
+        var resolved = UnresolvedTarget;
+        if (GuestTargetParser.TryParseAddress(target, out var parsed) && _image.UsedRange.Contains(parsed))
+        {
+            resolved = parsed;
+        }
+
+        _resolvedTargets[target] = resolved;
+        address = resolved == UnresolvedTarget ? 0u : (uint)resolved;
+        return resolved != UnresolvedTarget;
+    }
+
+    private GuestFunctionAbi Analyze(uint entryPoint)
+    {
+        IrFunction? canonical = null;
+        var hasCanonical = _canonicalIr?.TryGet(entryPoint, out canonical!) == true;
+        var linear = hasCanonical ? canonical! : BuildLinearIr(entryPoint);
+
+        // IrCfg.Build is pure; build the linear CFG once and share it across every consumer that
+        // used to rebuild it (argument inference, scalar-float inference and the canonical SsaResult).
+        var linearCfg = IrCfg.Build(linear);
+        var argumentRegisters = InferArgumentRegisters(linear, linearCfg);
+        var scalarFloatArgs = InferScalarFloatArguments(linear, linearCfg);
+        var returnsPairedScalarFloat = false;
+        var writesFloatReturnRegister = false;
+
+        try
+        {
+            var ssa = hasCanonical
+                ? new SsaResult(linear, linearCfg)
+                : new SsaTransformer().Convert(linear);
+            ssa.ValidateUseDef();
+            var types = new RepresentationClassifier().Classify(ssa.Function);
+            var signature = new FunctionAbiClassifier().Classify($"func_{entryPoint:X8}", ssa.Function, types);
+            writesFloatReturnRegister = signature.ReturnRepresentation is ValueRepresentation { IsFloat: true };
+
+            if (writesFloatReturnRegister)
+            {
+                // The SSA transformer returns a *renamed* function with phi nodes inserted, so its
+                // CFG is not necessarily the linear one; only reuse linearCfg for the same function.
+                // Kept behind the float-return check so the CFG is built exactly when it was before.
+                var ssaCfg = ReferenceEquals(ssa.Function, linear) ? linearCfg : IrCfg.Build(ssa.Function);
+                returnsPairedScalarFloat = InferReturnsPairedScalarFloat(ssa.Function, ssaCfg, signature);
+            }
+        }
+        catch
+        {
+            returnsPairedScalarFloat = false;
+            writesFloatReturnRegister = false;
+        }
+
+        return new GuestFunctionAbi(
+            scalarFloatArgs,
+            returnsPairedScalarFloat,
+            writesFloatReturnRegister,
+            argumentRegisters: argumentRegisters);
+    }
+
+    private IrFunction BuildLinearIr(uint entryPoint)
+    {
+        using var disassembler = new PpcDisassembler();
+        var instructions = disassembler.DisassembleFunction(_image, entryPoint, maxInstructions: 8192, maxBytes: 0x10000);
+        var basicBlocks = BasicBlockBuilder.Build(instructions);
+        var lifted = new PpcLifter().Lift(instructions, true);
+        var liftedByAddress = lifted.ToDictionary(x => x.Origin.Address, x => x.Ir);
+
+        var irBlocks = new List<IrBasicBlock>(basicBlocks.Count);
+        foreach (var block in basicBlocks)
+        {
+            var ir = new List<IrInstruction>();
+            foreach (var ins in block.Instructions)
+            {
+                if (!liftedByAddress.TryGetValue(ins.Address, out var lowered))
+                {
+                    throw new InvalidOperationException($"Failed to lift instruction at 0x{ins.Address:X8}");
+                }
+
+                ir.AddRange(lowered);
+            }
+
+            irBlocks.Add(new IrBasicBlock(LabelFor(block.StartAddress), ir));
+        }
+
+        AddMissingReferencedBlocks(irBlocks);
+        return new IrFunction($"func_{entryPoint:X8}", irBlocks.FirstOrDefault()?.Label ?? "entry", irBlocks);
+    }
+
+    private static void AddMissingReferencedBlocks(List<IrBasicBlock> irBlocks)
+    {
+        var existingLabels = new HashSet<string>(irBlocks.Select(static b => b.Label), StringComparer.OrdinalIgnoreCase);
+        var referencedLabels = irBlocks
+            .SelectMany(static b => b.Instructions.OfType<IrBranch>().SelectMany(static br => new[] { br.TrueLabel, br.FalseLabel }))
+            .Concat(irBlocks.SelectMany(static b => b.Instructions.OfType<IrJump>().Select(static j => j.TargetLabel)))
+            .Concat(irBlocks.SelectMany(static b => b.Instructions.OfType<IrJumpTable>().SelectMany(static jt => jt.Cases.Select(static c => c.TargetLabel))))
+            .Where(static l => !string.IsNullOrWhiteSpace(l))
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToList();
+
+        foreach (var label in referencedLabels)
+        {
+            if (existingLabels.Contains(label))
+            {
+                continue;
+            }
+
+            IrInstruction instruction = string.Equals(label, "return", StringComparison.OrdinalIgnoreCase)
+                ? new IrReturn(null)
+                : new IrComment("synthetic missing target");
+            irBlocks.Add(new IrBasicBlock(label, new IrInstruction[] { instruction }));
+            existingLabels.Add(label);
+        }
+    }
+
+    private HashSet<string> InferArgumentRegisters(IrFunction function, IrCfg cfg)
+    {
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var blockUses = new Dictionary<string, HashSet<string>>(comparer);
+        var blockDefs = new Dictionary<string, HashSet<string>>(comparer);
+
+        foreach (var block in function.Blocks)
+        {
+            var uses = new HashSet<string>(comparer);
+            var defs = new HashSet<string>(comparer);
+            foreach (var instruction in block.Instructions)
+            {
+                foreach (var use in InstructionRegisterUsesForArgumentInference(instruction))
+                {
+                    if (!defs.Contains(use))
+                    {
+                        uses.Add(use);
+                    }
+                }
+
+                foreach (var def in InstructionRegisterDefsForArgumentInference(instruction))
+                {
+                    defs.Add(def);
+                }
+            }
+
+            blockUses[block.Label] = uses;
+            blockDefs[block.Label] = defs;
+        }
+
+        var liveIn = function.Blocks.ToDictionary(
+            static block => block.Label,
+            _ => new HashSet<string>(comparer),
+            comparer);
+        var liveOut = function.Blocks.ToDictionary(
+            static block => block.Label,
+            _ => new HashSet<string>(comparer),
+            comparer);
+
+        var changed = true;
+        while (changed)
+        {
+            changed = false;
+            for (var blockIndex = function.Blocks.Count - 1; blockIndex >= 0; blockIndex--)
+            {
+                var block = function.Blocks[blockIndex];
+                var newOut = new HashSet<string>(comparer);
+                foreach (var successor in cfg.Successors(block.Label))
+                {
+                    if (liveIn.TryGetValue(successor, out var successorLiveIn))
+                    {
+                        newOut.UnionWith(successorLiveIn);
+                    }
+                }
+
+                var newIn = new HashSet<string>(blockUses[block.Label], comparer);
+                var outMinusDefs = new HashSet<string>(newOut, comparer);
+                outMinusDefs.ExceptWith(blockDefs[block.Label]);
+                newIn.UnionWith(outMinusDefs);
+
+                if (!newOut.SetEquals(liveOut[block.Label]))
+                {
+                    liveOut[block.Label] = newOut;
+                    changed = true;
+                }
+
+                if (!newIn.SetEquals(liveIn[block.Label]))
+                {
+                    liveIn[block.Label] = newIn;
+                    changed = true;
+                }
+            }
+        }
+
+        return liveIn.TryGetValue(function.EntryLabel, out var entryLive)
+            ? entryLive
+                .Where(IsGprOrFprRegister)
+                .ToHashSet(comparer)
+            : new HashSet<string>(comparer);
+    }
+
+    private IEnumerable<string> InstructionRegisterUsesForArgumentInference(IrInstruction instruction)
+    {
+        static IEnumerable<IrValue> Values(params IrValue[] values) => values;
+
+        switch (instruction)
+        {
+            case IrAssign assign:
+                foreach (var use in RegisterUsesFromValues(Values(assign.Value)))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrBinary binary:
+                foreach (var use in RegisterUsesFromValues(Values(binary.Left, binary.Right)))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrLoad load:
+                if (!string.IsNullOrWhiteSpace(load.Address.Base))
+                {
+                    yield return Base(load.Address.Base);
+                }
+                break;
+
+            case IrStore store:
+                if (!string.IsNullOrWhiteSpace(store.Address.Base))
+                {
+                    yield return Base(store.Address.Base);
+                }
+                foreach (var use in RegisterUsesFromValues(Values(store.Source)))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrCall call:
+                if (IsInlineSaveThunk(call))
+                {
+                    break;
+                }
+
+                foreach (var use in RegisterUsesFromValues(CallArgumentsForArgumentInference(call)))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrIndirectCall indirectCall:
+                foreach (var use in RegisterUsesFromValues(Values(indirectCall.Target)))
+                {
+                    yield return use;
+                }
+                foreach (var use in RegisterUsesFromValues(indirectCall.Arguments))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrIndirectJump indirectJump:
+                foreach (var use in RegisterUsesFromValues(Values(indirectJump.Target)))
+                {
+                    yield return use;
+                }
+                break;
+
+            case IrPhi phi:
+                foreach (var source in phi.Sources.Values)
+                {
+                    yield return Base(source);
+                }
+                break;
+
+            case IrReturn ret:
+                if (ret.Value is { } value)
+                {
+                    foreach (var use in RegisterUsesFromValues(Values(value)))
+                    {
+                        yield return use;
+                    }
+                }
+                break;
+
+            case IrBranch branch:
+                if (IsGuestRegisterName(branch.ConditionRegister))
+                {
+                    yield return Base(branch.ConditionRegister);
+                }
+                break;
+
+            case IrJumpTable table:
+                if (!string.IsNullOrWhiteSpace(table.Selector))
+                {
+                    yield return Base(table.Selector);
+                }
+                break;
+
+            case IrSetCrField setCr:
+                foreach (var use in RegisterUsesFromValues(Values(setCr.Left, setCr.Right)))
+                {
+                    yield return use;
+                }
+                break;
+        }
+    }
+
+    private static IEnumerable<string> InstructionRegisterDefsForArgumentInference(IrInstruction instruction)
+    {
+        switch (instruction)
+        {
+            case IrAssign assign:
+                yield return Base(assign.Destination);
+                break;
+
+            case IrBinary binary:
+                yield return Base(binary.Destination);
+                break;
+
+            case IrLoad load:
+                yield return Base(load.Destination);
+                break;
+
+            case IrCall call:
+                if (!string.IsNullOrWhiteSpace(call.Destination))
+                {
+                    yield return Base(call.Destination);
+                }
+                foreach (var def in InlineThunkDefs(call))
+                {
+                    yield return def;
+                }
+                if (IsGuestCallTarget(call.Target))
+                {
+                    yield return "r3";
+                    yield return "r4";
+                    yield return "f1";
+                }
+                break;
+
+            case IrIndirectCall indirectCall:
+                if (!string.IsNullOrWhiteSpace(indirectCall.Destination))
+                {
+                    yield return Base(indirectCall.Destination);
+                }
+                yield return "r3";
+                yield return "r4";
+                yield return "f1";
+                break;
+
+            case IrPhi phi:
+                yield return Base(phi.Destination);
+                break;
+        }
+    }
+
+    private IReadOnlyList<IrValue> CallArgumentsForArgumentInference(IrCall call)
+    {
+        if (!IsGuestCallTarget(call.Target) ||
+            !TryGetGuestFunctionAbi(call.Target, out var abi) ||
+            !abi.HasKnownArgumentRegisters)
+        {
+            return call.Arguments;
+        }
+
+        return call.Arguments
+            .Where(arg =>
+                arg.Kind != "register" ||
+                arg.RegisterName is null ||
+                abi.HasArgumentRegister(arg.RegisterName))
+            .ToArray();
+    }
+
+    private static IEnumerable<string> RegisterUsesFromValues(IEnumerable<IrValue> values)
+    {
+        foreach (var value in values)
+        {
+            if (value.Kind == "register" && !string.IsNullOrWhiteSpace(value.RegisterName))
+            {
+                yield return Base(value.RegisterName);
+            }
+        }
+    }
+
+    // The three thunk-aware passes share one set of ranges from the project's function map. This site is
+    // the odd one out: it feeds (FirstRegister, LastRegister) into params IsInlineThunkRange reads as
+    // (index bound, register base), so it accepts a shorter run and reports different start registers
+    // than the other two callers. Preserved verbatim since every shipped translation used it, but it's
+    // almost certainly a latent bug, not a design.
+    private static bool IsInlineSaveThunk(IrCall call) =>
+        GuestTargetParser.TryParseAddress(call.Target, out var address) &&
+        (IsInlineThunkRange(address, GuestSaveRestoreThunks.Current.SaveGpr) ||
+         IsInlineThunkRange(address, GuestSaveRestoreThunks.Current.SaveFpr));
+
+    private static IEnumerable<string> InlineThunkDefs(IrCall call)
+    {
+        if (!GuestTargetParser.TryParseAddress(call.Target, out var address))
+        {
+            yield break;
+        }
+
+        if (IsInlineThunkRange(address, GuestSaveRestoreThunks.Current.RestGpr, out var gprStart))
+        {
+            for (var reg = gprStart; reg <= 31; reg++)
+            {
+                yield return $"r{reg}";
+            }
+            yield break;
+        }
+
+        if (IsInlineThunkRange(address, GuestSaveRestoreThunks.Current.RestFpr, out var fprStart))
+        {
+            for (var reg = fprStart; reg <= 31; reg++)
+            {
+                yield return $"f{reg}";
+            }
+        }
+    }
+
+    private static bool IsInlineThunkRange(uint address, GuestSaveRestoreThunkRange? range) =>
+        IsInlineThunkRange(address, range, out _);
+
+    private static bool IsInlineThunkRange(
+        uint address,
+        GuestSaveRestoreThunkRange? range,
+        out int startRegister)
+    {
+        startRegister = 0;
+        if (range is null)
+        {
+            return false;
+        }
+
+        var (baseAddress, count, baseRegister) = range;
+        if (address < baseAddress)
+        {
+            return false;
+        }
+
+        var delta = address - baseAddress;
+        if ((delta % 4) != 0)
+        {
+            return false;
+        }
+
+        var index = (int)(delta / 4);
+        if (index < 0 || index > count)
+        {
+            return false;
+        }
+
+        startRegister = baseRegister + index;
+        return startRegister <= 31;
+    }
+
+    private HashSet<string> InferScalarFloatArguments(IrFunction function, IrCfg cfg)
+    {
+        var scalarArgs = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var comparer = StringComparer.OrdinalIgnoreCase;
+        var inMap = function.Blocks.ToDictionary(
+            static b => b.Label,
+            b => b.Label.Equals(function.EntryLabel, StringComparison.OrdinalIgnoreCase)
+                ? CreateInitialArgumentAliasState()
+                : new Dictionary<string, HashSet<string>>(comparer),
+            comparer);
+        var outMap = function.Blocks.ToDictionary(
+            static b => b.Label,
+            b => b.Label.Equals(function.EntryLabel, StringComparison.OrdinalIgnoreCase)
+                ? CreateInitialArgumentAliasState()
+                : new Dictionary<string, HashSet<string>>(comparer),
+            comparer);
+
+        var changed = true;
+        while (changed)
+        {
+            changed = false;
+            foreach (var block in function.Blocks)
+            {
+                var newIn = block.Label.Equals(function.EntryLabel, StringComparison.OrdinalIgnoreCase)
+                    ? CreateInitialArgumentAliasState()
+                    : UnionPredecessorStates(cfg.Predecessors(block.Label), outMap);
+
+                var newOut = CopyAliasState(newIn);
+                foreach (var ins in block.Instructions)
+                {
+                    ProcessScalarArgumentInstruction(ins, newOut, scalarArgs);
+                }
+
+                if (!AliasStatesEqual(newIn, inMap[block.Label]))
+                {
+                    inMap[block.Label] = newIn;
+                    changed = true;
+                }
+
+                if (!AliasStatesEqual(newOut, outMap[block.Label]))
+                {
+                    outMap[block.Label] = newOut;
+                    changed = true;
+                }
+            }
+        }
+
+        return scalarArgs;
+    }
+
+    private void ProcessScalarArgumentInstruction(
+        IrInstruction ins,
+        Dictionary<string, HashSet<string>> aliases,
+        HashSet<string> scalarArgs)
+    {
+        switch (ins)
+        {
+            case IrAssign assign:
+                PropagateFloatAlias(assign.Destination, assign.Value, aliases);
+                break;
+
+            case IrBinary bin:
+                MarkScalarUse(bin.Left, aliases, scalarArgs);
+                MarkScalarUse(bin.Right, aliases, scalarArgs);
+                KillFloatAlias(bin.Destination, aliases);
+                break;
+
+            case IrLoad load:
+                KillFloatAlias(load.Destination, aliases);
+                break;
+
+            case IrStore store:
+                if (store.SizeBytes is 4 or 8)
+                {
+                    MarkScalarUse(store.Source, aliases, scalarArgs);
+                }
+                break;
+
+            case IrCall call:
+                ProcessScalarArgumentCall(call.Target, call.Arguments, aliases, scalarArgs);
+                KillFloatAlias(call.Destination, aliases);
+                break;
+
+            case IrIndirectCall icall:
+                foreach (var arg in icall.Arguments)
+                {
+                    MarkScalarUse(arg, aliases, scalarArgs);
+                }
+                aliases.Remove("f1");
+                KillFloatAlias(icall.Destination, aliases);
+                break;
+
+            case IrSetCrField setCr:
+                MarkScalarUse(setCr.Left, aliases, scalarArgs);
+                MarkScalarUse(setCr.Right, aliases, scalarArgs);
+                break;
+
+            case IrPhi phi:
+                KillFloatAlias(phi.Destination, aliases);
+                break;
+        }
+    }
+
+    private void ProcessScalarArgumentCall(
+        string target,
+        IReadOnlyList<IrValue> arguments,
+        Dictionary<string, HashSet<string>> aliases,
+        HashSet<string> scalarArgs)
+    {
+        if (IsGuestCallTarget(target))
+        {
+            var writesFloatReturnRegister = true;
+            if (TryGetGuestFunctionAbi(target, out var abi))
+            {
+                writesFloatReturnRegister = abi.WritesFloatReturnRegister;
+                foreach (var arg in arguments)
+                {
+                    if (arg.Kind == "register" &&
+                        arg.RegisterName != null &&
+                        abi.HasScalarFloatArgument(Base(arg.RegisterName)))
+                    {
+                        MarkScalarUse(arg, aliases, scalarArgs);
+                    }
+                }
+            }
+
+            if (writesFloatReturnRegister)
+            {
+                aliases.Remove("f1");
+            }
+            return;
+        }
+
+        if (!IsScalarHelperConsumer(target))
+        {
+            return;
+        }
+
+        foreach (var arg in arguments)
+        {
+            MarkScalarUse(arg, aliases, scalarArgs);
+        }
+    }
+
+    private static bool IsScalarHelperConsumer(string target)
+    {
+        if (target.Equals("PPC_Fres", StringComparison.OrdinalIgnoreCase) ||
+            target.Equals("PPC_Frsqrte", StringComparison.OrdinalIgnoreCase))
+        {
+            return true;
+        }
+
+        return !PpcFloatCallSemantics.IsPairedConsumerTarget(target) &&
+               PpcFloatCallSemantics.IsScalarFloatConsumerTarget(target);
+    }
+
+    private static bool InferReturnsPairedScalarFloat(
+        IrFunction function,
+        IrCfg cfg,
+        FunctionAbiClassification signature)
+    {
+        if (signature.ReturnRepresentation is not ValueRepresentation { IsFloat: true })
+        {
+            return false;
+        }
+
+        var allFloatRegisters = Enumerable.Range(0, 32)
+            .Select(static i => $"f{i}")
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        var inMap = function.Blocks.ToDictionary(
+            static b => b.Label,
+            b => b.Label.Equals(function.EntryLabel, StringComparison.OrdinalIgnoreCase)
+                ? new HashSet<string>(StringComparer.OrdinalIgnoreCase)
+                : new HashSet<string>(allFloatRegisters, StringComparer.OrdinalIgnoreCase),
+            StringComparer.OrdinalIgnoreCase);
+        var outMap = function.Blocks.ToDictionary(
+            static b => b.Label,
+            b => b.Label.Equals(function.EntryLabel, StringComparison.OrdinalIgnoreCase)
+                ? new HashSet<string>(StringComparer.OrdinalIgnoreCase)
+                : new HashSet<string>(allFloatRegisters, StringComparer.OrdinalIgnoreCase),
+            StringComparer.OrdinalIgnoreCase);
+
+        var changed = true;
+        while (changed)
+        {
+            changed = false;
+            foreach (var block in function.Blocks)
+            {
+                var preds = cfg.Predecessors(block.Label).Where(p => !p.Equals(block.Label, StringComparison.OrdinalIgnoreCase)).ToList();
+                HashSet<string> newIn;
+                if (preds.Count == 0)
+                {
+                    newIn = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+                }
+                else
+                {
+                    newIn = new HashSet<string>(outMap[preds[0]], StringComparer.OrdinalIgnoreCase);
+                    foreach (var pred in preds.Skip(1))
+                    {
+                        newIn.IntersectWith(outMap[pred]);
+                    }
+                }
+
+                var newOut = new HashSet<string>(newIn, StringComparer.OrdinalIgnoreCase);
+                foreach (var ins in block.Instructions)
+                {
+                    ProcessReturnPairedInstruction(ins, outMap, newOut);
+                }
+
+                if (!newIn.SetEquals(inMap[block.Label]))
+                {
+                    inMap[block.Label] = newIn;
+                    changed = true;
+                }
+
+                if (!newOut.SetEquals(outMap[block.Label]))
+                {
+                    outMap[block.Label] = newOut;
+                    changed = true;
+                }
+            }
+        }
+
+        var returnBlocks = function.Blocks
+            .Where(static b => b.Instructions.LastOrDefault() is IrReturn)
+            .ToList();
+        return returnBlocks.Count > 0 &&
+               returnBlocks.All(b => outMap.TryGetValue(b.Label, out var state) && state.Contains("f1"));
+    }
+
+    private static void ProcessReturnPairedInstruction(
+        IrInstruction ins,
+        IReadOnlyDictionary<string, HashSet<string>> blockOut,
+        HashSet<string> pairedSet)
+    {
+        switch (ins)
+        {
+            case IrPhi phi:
+                {
+                    var destBase = Base(phi.Destination);
+                    if (!IsFloatRegister(destBase))
+                    {
+                        break;
+                    }
+
+                    var allPaired = true;
+                    foreach (var (predLabel, src) in phi.Sources)
+                    {
+                        var srcBase = Base(src);
+                        if (!IsFloatRegister(srcBase) ||
+                            !blockOut.TryGetValue(predLabel, out var predOut) ||
+                            !predOut.Contains(srcBase))
+                        {
+                            allPaired = false;
+                            break;
+                        }
+                    }
+
+                    if (allPaired)
+                    {
+                        pairedSet.Add(destBase);
+                    }
+                    else
+                    {
+                        pairedSet.Remove(destBase);
+                    }
+                    break;
+                }
+
+            case IrCall call:
+                if (IsGuestCallTarget(call.Target))
+                {
+                    pairedSet.Remove("f1");
+                }
+
+                if (!string.IsNullOrWhiteSpace(call.Destination))
+                {
+                    var destBase = Base(call.Destination);
+                    if (IsFloatRegister(destBase))
+                    {
+                        if (PpcFloatCallSemantics.IsPairedProducerTarget(call.Target))
+                        {
+                            pairedSet.Add(destBase);
+                        }
+                        else
+                        {
+                            pairedSet.Remove(destBase);
+                        }
+                    }
+                }
+                break;
+
+            case IrIndirectCall icall:
+                pairedSet.Remove("f1");
+                KillFloatPairedState(icall.Destination, pairedSet);
+                break;
+
+            case IrAssign assign:
+                {
+                    var destBase = Base(assign.Destination);
+                    if (!IsFloatRegister(destBase))
+                    {
+                        break;
+                    }
+
+                    if (assign.Value.Kind == "register" &&
+                        assign.Value.RegisterName != null &&
+                        IsFloatRegister(Base(assign.Value.RegisterName)) &&
+                        pairedSet.Contains(Base(assign.Value.RegisterName)))
+                    {
+                        pairedSet.Add(destBase);
+                    }
+                    else
+                    {
+                        pairedSet.Remove(destBase);
+                    }
+                    break;
+                }
+
+            case IrBinary bin:
+                KillFloatPairedState(bin.Destination, pairedSet);
+                break;
+
+            case IrLoad load:
+                KillFloatPairedState(load.Destination, pairedSet);
+                break;
+        }
+    }
+
+    private static void MarkScalarUse(
+        IrValue value,
+        IReadOnlyDictionary<string, HashSet<string>> aliases,
+        HashSet<string> scalarArgs)
+    {
+        if (value.Kind != "register" || value.RegisterName == null)
+        {
+            return;
+        }
+
+        var baseName = Base(value.RegisterName);
+        if (!IsFloatRegister(baseName) || !aliases.TryGetValue(baseName, out var sources))
+        {
+            return;
+        }
+
+        foreach (var source in sources)
+        {
+            if (AbiFloatArgumentSet.Contains(source))
+            {
+                scalarArgs.Add(source);
+            }
+        }
+    }
+
+    private static void PropagateFloatAlias(
+        string destination,
+        IrValue value,
+        Dictionary<string, HashSet<string>> aliases)
+    {
+        var destBase = Base(destination);
+        if (!IsFloatRegister(destBase))
+        {
+            return;
+        }
+
+        if (value.Kind == "register" &&
+            value.RegisterName != null &&
+            IsFloatRegister(Base(value.RegisterName)) &&
+            aliases.TryGetValue(Base(value.RegisterName), out var srcAliases))
+        {
+            aliases[destBase] = new HashSet<string>(srcAliases, StringComparer.OrdinalIgnoreCase);
+        }
+        else
+        {
+            aliases.Remove(destBase);
+        }
+    }
+
+    private static void KillFloatAlias(string destination, Dictionary<string, HashSet<string>> aliases)
+    {
+        if (!string.IsNullOrWhiteSpace(destination) && IsFloatRegister(Base(destination)))
+        {
+            aliases.Remove(Base(destination));
+        }
+    }
+
+    private static void KillFloatPairedState(string destination, HashSet<string> pairedSet)
+    {
+        if (!string.IsNullOrWhiteSpace(destination) && IsFloatRegister(Base(destination)))
+        {
+            pairedSet.Remove(Base(destination));
+        }
+    }
+
+    private static Dictionary<string, HashSet<string>> CreateInitialArgumentAliasState()
+    {
+        return AbiFloatArgumentRegisters.ToDictionary(
+            static r => r,
+            static r => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { r },
+            StringComparer.OrdinalIgnoreCase);
+    }
+
+    private static Dictionary<string, HashSet<string>> UnionPredecessorStates(
+        IReadOnlyList<string> predecessors,
+        IReadOnlyDictionary<string, Dictionary<string, HashSet<string>>> outMap)
+    {
+        var result = new Dictionary<string, HashSet<string>>(StringComparer.OrdinalIgnoreCase);
+        foreach (var pred in predecessors)
+        {
+            if (!outMap.TryGetValue(pred, out var predState))
+            {
+                continue;
+            }
+
+            foreach (var (register, sources) in predState)
+            {
+                if (!result.TryGetValue(register, out var destSources))
+                {
+                    destSources = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+                    result[register] = destSources;
+                }
+
+                destSources.UnionWith(sources);
+            }
+        }
+
+        return result;
+    }
+
+    private static Dictionary<string, HashSet<string>> CopyAliasState(
+        IReadOnlyDictionary<string, HashSet<string>> state)
+    {
+        return state.ToDictionary(
+            static kv => kv.Key,
+            static kv => new HashSet<string>(kv.Value, StringComparer.OrdinalIgnoreCase),
+            StringComparer.OrdinalIgnoreCase);
+    }
+
+    private static bool AliasStatesEqual(
+        IReadOnlyDictionary<string, HashSet<string>> left,
+        IReadOnlyDictionary<string, HashSet<string>> right)
+    {
+        if (left.Count != right.Count)
+        {
+            return false;
+        }
+
+        foreach (var (key, leftSet) in left)
+        {
+            if (!right.TryGetValue(key, out var rightSet) || !leftSet.SetEquals(rightSet))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private static bool IsGuestCallTarget(string target)
+    {
+        if (string.IsNullOrWhiteSpace(target))
+        {
+            return false;
+        }
+
+        if (GuestTargetParser.TryParseAddress(target, out _))
+        {
+            return true;
+        }
+
+        var trimmed = target.Trim();
+        return trimmed.StartsWith("0x", StringComparison.OrdinalIgnoreCase) ||
+               trimmed.StartsWith("func_", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static bool IsFloatRegister(string name)
+    {
+        var baseName = Base(name);
+        if (baseName.Length < 2 || baseName.Length > 3) return false;
+        if (baseName[0] != 'f') return false;
+        if (!char.IsDigit(baseName[1])) return false;
+        if (baseName.Length == 2) return true;
+        return char.IsDigit(baseName[2]) && int.Parse(baseName[1..], CultureInfo.InvariantCulture) < 32;
+    }
+
+    private static bool IsGprOrFprRegister(string name)
+    {
+        var baseName = Base(name);
+        if (baseName.Length < 2 || baseName.Length > 3)
+        {
+            return false;
+        }
+
+        if (baseName[0] is not ('r' or 'f') || !char.IsDigit(baseName[1]))
+        {
+            return false;
+        }
+
+        if (!int.TryParse(baseName[1..], NumberStyles.None, CultureInfo.InvariantCulture, out var index))
+        {
+            return false;
+        }
+
+        return index is >= 0 and < 32;
+    }
+
+    private static string Base(string name) => RegisterNameUtils.StripNumericSuffix(name);
+
+    private static bool IsGuestRegisterName(string name)
+    {
+        if (string.IsNullOrWhiteSpace(name))
+        {
+            return false;
+        }
+
+        var baseName = Base(name);
+        if (IsGprOrFprRegister(baseName))
+        {
+            return true;
+        }
+
+        if (baseName.Length == 3 &&
+            baseName.StartsWith("cr", StringComparison.OrdinalIgnoreCase) &&
+            char.IsDigit(baseName[2]) &&
+            (baseName[2] - '0') is >= 0 and <= 7)
+        {
+            return true;
+        }
+
+        return baseName.Equals("cr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("lr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("ctr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("xer", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("fpscr", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static string LabelFor(uint address) => $"0x{address:X8}";
+
+}
diff --git a/translator/src/Translator.Core/CodeGen/PpcFloatCallSemantics.cs b/translator/src/Translator.Core/CodeGen/PpcFloatCallSemantics.cs
new file mode 100644
index 0000000..7dc6336
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/PpcFloatCallSemantics.cs
@@ -0,0 +1,82 @@
+using System;
+
+namespace Translator.Core.CodeGen;
+
+public static class PpcFloatCallSemantics
+{
+    public static bool IsPairedProducerTarget(string target)
+    {
+        // PPC_PsToScalar returns a scalar value, not a paired-single payload.
+        if (target.Equals("PPC_PsToScalar", StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        return target.StartsWith("PPC_Ps", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_PsqL", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_LoadPairedSingle", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fres", StringComparison.OrdinalIgnoreCase);
+        // Note: PPC_Frsqrte is NOT a paired-single producer - it's a double-precision instruction (opcode 63).
+    }
+
+    public static bool IsPairedConsumerTarget(string target)
+    {
+        // Paired-single consumers expect their operands to already be in paired form.
+        // PPC_PsqL consumes an address and returns paired output, while
+        // PPC_StorePairedSingle writes raw paired payloads directly.
+        if (target.Equals("PPC_PsqL", StringComparison.OrdinalIgnoreCase) ||
+            target.Equals("PPC_StorePairedSingle", StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        // PPC_PsFromScalar consumes a scalar input and produces paired output.
+        if (target.Equals("PPC_PsFromScalar", StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        if (target.Equals("PPC_Fres", StringComparison.OrdinalIgnoreCase))
+        {
+            return true;
+        }
+
+        return target.StartsWith("PPC_Ps", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_LoadPairedSingle", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_PsqSt", StringComparison.OrdinalIgnoreCase);
+    }
+
+    public static bool IsSinglePrecisionConsumerTarget(string target)
+    {
+        return target.Equals("PPC_Fadds", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fsubs", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fmuls", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fdivs", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fmadds", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fmsubs", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fnmadds", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fnmsubs", StringComparison.OrdinalIgnoreCase);
+    }
+
+    public static bool IsScalarFloatConsumerTarget(string target)
+    {
+        return target.Equals("PPC_Fctiwz", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fsqrt", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Frsqrte", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fsel", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fmadd", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fmsub", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fnmadd", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fnmsub", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fadds", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fsubs", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fmuls", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fdivs", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fmadds", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fmsubs", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fnmadds", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fnmsubs", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_Fcmp", StringComparison.OrdinalIgnoreCase) ||
+               target.Equals("PPC_PsFromScalar", StringComparison.OrdinalIgnoreCase);
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/RepresentationFormatter.cs b/translator/src/Translator.Core/CodeGen/RepresentationFormatter.cs
new file mode 100644
index 0000000..3e1feac
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/RepresentationFormatter.cs
@@ -0,0 +1,27 @@
+using Translator.Core.Representation;
+
+namespace Translator.Core.CodeGen;
+
+public static class RepresentationFormatter
+{
+    public static string ToCxx(ValueRepresentation representation)
+    {
+        if (representation == ValueRepresentation.Void) return "void";
+        if (representation == ValueRepresentation.Int32) return "int32_t";
+        if (representation == ValueRepresentation.UInt32) return "uint32_t";
+        if (representation == ValueRepresentation.Int64) return "int64_t";
+        if (representation == ValueRepresentation.UInt64) return "uint64_t";
+        if (representation == ValueRepresentation.Float32) return "float";
+        if (representation == ValueRepresentation.Float64) return "double";
+        return "uint32_t";
+    }
+
+    public static string DefaultValue(ValueRepresentation representation)
+    {
+        if (representation == ValueRepresentation.Void) return string.Empty;
+        if (representation == ValueRepresentation.Float32) return "0.0f";
+        if (representation == ValueRepresentation.Float64) return "0.0";
+        return "0";
+    }
+}
+
diff --git a/translator/src/Translator.Core/CodeGen/RuntimeConfigGenerator.cs b/translator/src/Translator.Core/CodeGen/RuntimeConfigGenerator.cs
new file mode 100644
index 0000000..24858f2
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/RuntimeConfigGenerator.cs
@@ -0,0 +1,58 @@
+using System.IO;
+using System.Text;
+using Translator.Core.IO;
+
+namespace Translator.Core.CodeGen;
+
+/// <summary>
+/// Generates runtime configuration metadata for the C++ runtime harness.
+/// This includes critical architectural values like SDA base pointers that
+/// must be initialized before any translated code can execute.
+/// </summary>
+public sealed class RuntimeConfigGenerator
+{
+    /// <summary>
+    /// Generates a C++ header file containing runtime configuration metadata. SDA bases come from the
+    /// project manifest, not from scanning the boot code: they're data pinned to the DOL's SHA-256, and
+    /// guessing them from section midpoints could silently produce a wrong runtime.
+    /// </summary>
+    public static void GenerateConfigHeader(
+        uint sda1Base,
+        uint sda2Base,
+        string outputPath,
+        string projectName = "PowerPC DOL")
+    {
+        var sb = new StringBuilder();
+        sb.AppendLine($"// AUTO-GENERATED for {projectName}");
+        sb.AppendLine("// DO NOT EDIT THIS FILE MANUALLY");
+        sb.AppendLine("//");
+        sb.AppendLine("// The runtime loads these into r2/r13 before executing any translated code.");
+        sb.AppendLine();
+        sb.AppendLine("#pragma once");
+        sb.AppendLine();
+        sb.AppendLine("#include <cstdint>");
+        sb.AppendLine();
+        sb.AppendLine("namespace RuntimeConfig {");
+        sb.AppendLine();
+        sb.AppendLine("// PowerPC ABI Small Data Area base pointers");
+        sb.AppendLine("// These MUST be loaded into r2 and r13 before executing any translated code.");
+        sb.AppendLine();
+
+        // SDA1 (r13) - read/write small data
+        sb.AppendLine($"// _SDA_BASE_ (r13): Base pointer for .sdata/.sbss sections");
+        sb.AppendLine($"constexpr uint32_t SDA1_BASE = 0x{sda1Base:X8}u;  // memory.sda_base");
+        sb.AppendLine();
+
+        // SDA2 (r2) - read-only small data
+        sb.AppendLine($"// _SDA2_BASE_ (r2): Base pointer for .sdata2/.sbss2 sections");
+        sb.AppendLine($"constexpr uint32_t SDA2_BASE = 0x{sda2Base:X8}u;  // memory.sda2_base");
+        sb.AppendLine();
+
+
+        sb.AppendLine("} // namespace RuntimeConfig");
+        sb.AppendLine();
+
+        Directory.CreateDirectory(Path.GetDirectoryName(outputPath)!);
+        FileOutput.WriteTextIfChanged(outputPath, sb.ToString());
+    }
+}
diff --git a/translator/src/Translator.Core/CodeGen/RuntimeNativeFunctionAbiProvider.cs b/translator/src/Translator.Core/CodeGen/RuntimeNativeFunctionAbiProvider.cs
new file mode 100644
index 0000000..ccbc712
--- /dev/null
+++ b/translator/src/Translator.Core/CodeGen/RuntimeNativeFunctionAbiProvider.cs
@@ -0,0 +1,132 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+
+namespace Translator.Core.CodeGen;
+
+public sealed class RuntimeNativeFunctionAbiProvider : IGuestFunctionAbiProvider
+{
+    private static readonly Regex StubVoidRegex = GeneratedMarkers.NativeOverrideVoidArgumentsPattern();
+
+    private readonly Dictionary<string, GuestFunctionAbi> _abis;
+
+    public RuntimeNativeFunctionAbiProvider(IReadOnlyDictionary<uint, GuestFunctionAbi> abis)
+    {
+        _abis = abis.ToDictionary(
+            static item => $"func_{item.Key:X8}",
+            static item => item.Value,
+            StringComparer.OrdinalIgnoreCase);
+    }
+
+    public bool TryGetGuestFunctionAbi(string target, out GuestFunctionAbi abi)
+    {
+        if (GuestTargetParser.TryParseAddress(target, out var address))
+        {
+            return _abis.TryGetValue($"func_{address:X8}", out abi!);
+        }
+
+        return _abis.TryGetValue(target, out abi!);
+    }
+
+    public static RuntimeNativeFunctionAbiProvider LoadVoidStubAbisFromDirectory(string directory)
+    {
+        return new RuntimeNativeFunctionAbiProvider(AnalyzeVoidStubAbisFromDirectory(directory));
+    }
+
+    /// <summary>
+    /// Builds the declared-ABI provider, trusting only void stubs whose addresses are in
+    /// <paramref name="includeAddresses"/> (the project's <c>native_abi_directories</c>); stub
+    /// signatures outside that set are documentation, not ABI contracts.
+    /// </summary>
+    public static RuntimeNativeFunctionAbiProvider FromIndex(
+        RuntimeNativeIndex index, IReadOnlySet<uint> includeAddresses)
+    {
+        var abis = index.VoidStubAbis
+            .Where(entry => includeAddresses.Contains(entry.Address))
+            .ToDictionary(
+            static entry => entry.Address,
+            static entry => new GuestFunctionAbi(
+                argumentRegisters: entry.ArgumentRegisters,
+                preservesVolatileContext: true,
+                writesGprReturnRegister: false,
+                writesFloatReturnRegister: false,
+                scalarFloatArgumentRegisters: entry.ScalarFloatArgumentRegisters));
+        return new RuntimeNativeFunctionAbiProvider(abis);
+    }
+
+    public static IReadOnlyDictionary<uint, GuestFunctionAbi> AnalyzeVoidStubAbisFromDirectory(string directory)
+        => AnalyzeVoidStubAbis(NativeSourceParsing.ReadDirectory(directory));
+
+    internal static IReadOnlyDictionary<uint, GuestFunctionAbi> AnalyzeVoidStubAbis(
+        IReadOnlyList<NativeSourceFile> sources)
+    {
+        var abis = new Dictionary<uint, GuestFunctionAbi>();
+
+        foreach (var sourceFile in sources.Where(static source =>
+                     source.FullPath.EndsWith(".cpp", StringComparison.OrdinalIgnoreCase)))
+        {
+            var content = sourceFile.Content;
+            foreach (Match match in StubVoidRegex.Matches(content))
+            {
+                var args = match.Groups["args"].Value;
+                if (args.Contains("CpuContext", StringComparison.Ordinal))
+                {
+                    continue;
+                }
+
+                if (!GuestTargetParser.TryParseHexAddress(match.Groups["addr"].Value, out var address))
+                {
+                    continue;
+                }
+
+                var argumentRegisters = InferArgumentRegisters(args);
+                abis[address] = new GuestFunctionAbi(
+                    argumentRegisters: argumentRegisters,
+                    preservesVolatileContext: true,
+                    writesGprReturnRegister: false,
+                    writesFloatReturnRegister: false,
+                    scalarFloatArgumentRegisters: argumentRegisters.Where(static r => r.StartsWith("f", StringComparison.OrdinalIgnoreCase)));
+            }
+        }
+
+        return abis;
+    }
+
+    private static IReadOnlyList<string> InferArgumentRegisters(string args)
+    {
+        var result = new List<string>();
+        var gpr = 3;
+        var fpr = 1;
+        foreach (var argument in NativeSourceParsing.SplitArguments(args))
+        {
+            var trimmed = argument.Trim();
+            if (trimmed.Length == 0 || string.Equals(trimmed, "void", StringComparison.OrdinalIgnoreCase))
+            {
+                continue;
+            }
+
+            if (NativeSourceParsing.IsFloatingPointValueArgument(trimmed))
+            {
+                if (fpr <= 13)
+                {
+                    result.Add($"f{fpr}");
+                }
+                fpr++;
+            }
+            else
+            {
+                if (gpr <= 10)
+                {
+                    result.Add($"r{gpr}");
+                }
+                gpr++;
+            }
+        }
+
+        return result;
+    }
+
+}
diff --git a/translator/src/Translator.Core/Disassembly/JumpTableDetector.cs b/translator/src/Translator.Core/Disassembly/JumpTableDetector.cs
new file mode 100644
index 0000000..73a0eb6
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/JumpTableDetector.cs
@@ -0,0 +1,451 @@
+using System;
+using System.Buffers.Binary;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Disassembly;
+
+internal static class JumpTableDetector
+{
+    private const int MaxBacktrackInstructions = 192;
+    private const int MaxEntryCount = 512;
+
+    public static bool TryRecognize(
+        IReadOnlyList<PpcInstruction> ordered,
+        IReadOnlyDictionary<uint, int> indexByAddress,
+        uint bctrAddress,
+        uint functionStart,
+        uint functionEnd,
+        ProgramImage image,
+        out IReadOnlyList<uint> targets)
+    {
+        targets = Array.Empty<uint>();
+        if (!indexByAddress.TryGetValue(bctrAddress, out var bctrIndex))
+        {
+            return false;
+        }
+
+        var mtctrIndex = FindPrevious(ordered, bctrIndex, "mtctr", limit: 6);
+        if (mtctrIndex < 0)
+        {
+            return false;
+        }
+
+        if (ordered[mtctrIndex].Operands.Count == 0 || ordered[mtctrIndex].Operands[0] is not PpcRegisterOperand ctrOperand)
+        {
+            return false;
+        }
+        var targetRegister = ctrOperand.Name;
+
+        var loadIndex = FindPreviousLoad(ordered, mtctrIndex, targetRegister);
+        if (loadIndex < 0)
+        {
+            return false;
+        }
+
+        var load = ordered[loadIndex];
+        if (!string.Equals(load.Mnemonic, "lwzx", StringComparison.OrdinalIgnoreCase))
+        {
+            return false; // Only handle lwzx-based tables for now.
+        }
+
+        if (load.Operands.Count < 3 || load.Operands[0] is not PpcRegisterOperand dest ||
+            load.Operands[1] is not PpcRegisterOperand baseReg ||
+            load.Operands[2] is not PpcRegisterOperand indexReg)
+        {
+            return false;
+        }
+
+        if (!string.Equals(dest.Name, targetRegister, StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        var entriesAreRelative = false;
+        if (!TryResolveLisAddiConstant(ordered, loadIndex, baseReg.Name, out var tableBase) &&
+            !TryResolvePcRelativeLoadedConstant(ordered, loadIndex, baseReg.Name, image, out tableBase))
+        {
+            return false;
+        }
+        entriesAreRelative = HasRelativeEntryAdd(ordered, loadIndex, mtctrIndex, targetRegister, baseReg.Name);
+
+        if (!TryFindUpperBound(ordered, loadIndex, indexReg.Name, out var upperBound) || upperBound < 0 || upperBound >= MaxEntryCount)
+        {
+            return false;
+        }
+
+        var entryCount = upperBound + 1;
+        var dedupList = new List<uint>();
+        var seen = new HashSet<uint>();
+        for (var i = 0; i < entryCount; i++)
+        {
+            var entryAddress = unchecked(tableBase + (uint)(i * 4));
+            if (!TryReadWord(image, entryAddress, out var entry))
+            {
+                return false;
+            }
+            var target = entriesAreRelative ? unchecked(tableBase + entry) : entry;
+
+            if (!indexByAddress.ContainsKey(target))
+            {
+                // Allow targets that haven't been decoded yet as long as they
+                // fall within the current function's decoding window.
+                if (target < functionStart || target >= functionEnd || (target & 3) != 0)
+                {
+                    return false;
+                }
+            }
+
+            if (seen.Add(target))
+            {
+                dedupList.Add(target);
+            }
+        }
+
+        if (dedupList.Count == 0)
+        {
+            return false; // Not a real switch.
+        }
+
+        targets = dedupList;
+        return true;
+    }
+
+    private static int FindPrevious(IReadOnlyList<PpcInstruction> ordered, int startIndex, string mnemonic, int limit)
+    {
+        for (var i = startIndex - 1; i >= 0 && startIndex - i <= limit; i--)
+        {
+            // Comparison already ignores case, so lowering the needle only
+            // allocated a copy of it.
+            if (string.Equals(ordered[i].Mnemonic, mnemonic, StringComparison.OrdinalIgnoreCase))
+            {
+                return i;
+            }
+        }
+        return -1;
+    }
+
+    private static bool HasRelativeEntryAdd(
+        IReadOnlyList<PpcInstruction> ordered,
+        int loadIndex,
+        int mtctrIndex,
+        string targetRegister,
+        string tableBaseRegister)
+    {
+        for (var i = loadIndex + 1; i < mtctrIndex; i++)
+        {
+            var ins = ordered[i];
+            if (!string.Equals(ins.Mnemonic, "add", StringComparison.OrdinalIgnoreCase) ||
+                ins.Operands.Count < 3 ||
+                ins.Operands[0] is not PpcRegisterOperand dest ||
+                ins.Operands[1] is not PpcRegisterOperand left ||
+                ins.Operands[2] is not PpcRegisterOperand right ||
+                !RegistersEqual(dest.Name, targetRegister))
+            {
+                continue;
+            }
+
+            if ((RegistersEqual(left.Name, targetRegister) && RegistersEqual(right.Name, tableBaseRegister)) ||
+                (RegistersEqual(right.Name, targetRegister) && RegistersEqual(left.Name, tableBaseRegister)))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static int FindPreviousLoad(IReadOnlyList<PpcInstruction> ordered, int startIndex, string register)
+    {
+        for (var i = startIndex - 1; i >= 0 && startIndex - i <= MaxBacktrackInstructions; i--)
+        {
+            var ins = ordered[i];
+            if (ins.Operands.Count == 0 || ins.Operands[0] is not PpcRegisterOperand dest)
+            {
+                continue;
+            }
+
+            if (!string.Equals(dest.Name, register, StringComparison.OrdinalIgnoreCase))
+            {
+                continue;
+            }
+
+            // Decoder mnemonics are lowercase by construction.
+            if (ins.Mnemonic is "lwzx" or "lwz")
+            {
+                return i;
+            }
+        }
+
+        return -1;
+    }
+
+    private static bool TryResolveLisAddiConstant(IReadOnlyList<PpcInstruction> ordered, int startIndex, string register, out uint value)
+    {
+        var haveOffset = false;
+        int offset = 0;
+        var baseRegister = register;
+        for (var i = startIndex - 1; i >= 0 && startIndex - i <= MaxBacktrackInstructions; i--)
+        {
+            var ins = ordered[i];
+            if (ins.Operands.Count == 0 || ins.Operands[0] is not PpcRegisterOperand dest)
+            {
+                continue;
+            }
+
+            if (!string.Equals(dest.Name, baseRegister, StringComparison.OrdinalIgnoreCase))
+            {
+                continue;
+            }
+
+            var mnemonic = ins.Mnemonic;
+            if (!haveOffset && mnemonic == "addi" && ins.Operands.Count >= 3 && ins.Operands[1] is PpcRegisterOperand addBase &&
+                ins.Operands[2] is PpcImmediateOperand addImm)
+            {
+                offset = (short)addImm.Value;
+                haveOffset = true;
+                // Track the source register so we can resolve lis/addi from a different base.
+                baseRegister = addBase.Name;
+                continue;
+            }
+
+            if (mnemonic == "lis" && ins.Operands.Count >= 2 && ins.Operands[1] is PpcImmediateOperand hiImm)
+            {
+                var hi = hiImm.Value << 16;
+                var low = haveOffset ? offset : 0;
+                value = unchecked((uint)(hi + low));
+                return true;
+            }
+        }
+
+        value = 0;
+        return false;
+    }
+
+    private static bool TryResolvePcRelativeLoadedConstant(
+        IReadOnlyList<PpcInstruction> ordered,
+        int startIndex,
+        string register,
+        ProgramImage image,
+        out uint value)
+    {
+        for (var i = startIndex - 1; i >= 0 && startIndex - i <= MaxBacktrackInstructions; i--)
+        {
+            var ins = ordered[i];
+            if (!string.Equals(ins.Mnemonic, "lwz", StringComparison.OrdinalIgnoreCase) ||
+                ins.Operands.Count < 2 ||
+                ins.Operands[0] is not PpcRegisterOperand dest ||
+                ins.Operands[1] is not PpcDisplacementOperand displacement ||
+                !RegistersEqual(dest.Name, register))
+            {
+                continue;
+            }
+
+            if (!TryResolvePicBaseRegister(ordered, i, displacement.BaseRegister, image, out var picBase))
+            {
+                continue;
+            }
+
+            var literalAddress = AddSigned(picBase, displacement.Offset);
+            if (TryReadWord(image, literalAddress, out value))
+            {
+                return true;
+            }
+        }
+
+        value = 0;
+        return false;
+    }
+
+    private static bool TryResolvePicBaseRegister(
+        IReadOnlyList<PpcInstruction> ordered,
+        int startIndex,
+        string register,
+        ProgramImage image,
+        out uint value)
+    {
+        for (var addIndex = startIndex - 1; addIndex >= 0 && startIndex - addIndex <= MaxBacktrackInstructions; addIndex--)
+        {
+            var add = ordered[addIndex];
+            if (!string.Equals(add.Mnemonic, "add", StringComparison.OrdinalIgnoreCase) ||
+                add.Operands.Count < 3 ||
+                add.Operands[0] is not PpcRegisterOperand dest ||
+                add.Operands[1] is not PpcRegisterOperand left ||
+                add.Operands[2] is not PpcRegisterOperand right ||
+                !RegistersEqual(dest.Name, register))
+            {
+                continue;
+            }
+
+            string offsetRegister;
+            if (RegistersEqual(left.Name, register))
+            {
+                offsetRegister = right.Name;
+            }
+            else if (RegistersEqual(right.Name, register))
+            {
+                offsetRegister = left.Name;
+            }
+            else
+            {
+                continue;
+            }
+
+            if (!TryFindRegisterDisplacementLoadBefore(ordered, addIndex, offsetRegister, register, out var offsetLoad) ||
+                !TryFindMflrBefore(ordered, offsetLoad.Index, register, out var mflrIndex) ||
+                !TryFindLinkCallBefore(ordered, mflrIndex, out var linkAddress))
+            {
+                continue;
+            }
+
+            var offsetAddress = AddSigned(linkAddress, offsetLoad.Displacement);
+            if (!TryReadWord(image, offsetAddress, out var picOffset))
+            {
+                continue;
+            }
+
+            value = unchecked(linkAddress + picOffset);
+            return true;
+        }
+
+        value = 0;
+        return false;
+    }
+
+    private static bool TryFindRegisterDisplacementLoadBefore(
+        IReadOnlyList<PpcInstruction> ordered,
+        int startIndex,
+        string destinationRegister,
+        string baseRegister,
+        out (int Index, int Displacement) result)
+    {
+        for (var i = startIndex - 1; i >= 0 && startIndex - i <= MaxBacktrackInstructions; i--)
+        {
+            var ins = ordered[i];
+            if (string.Equals(ins.Mnemonic, "lwz", StringComparison.OrdinalIgnoreCase) &&
+                ins.Operands.Count >= 2 &&
+                ins.Operands[0] is PpcRegisterOperand dest &&
+                ins.Operands[1] is PpcDisplacementOperand displacement &&
+                RegistersEqual(dest.Name, destinationRegister) &&
+                RegistersEqual(displacement.BaseRegister, baseRegister))
+            {
+                result = (i, displacement.Offset);
+                return true;
+            }
+        }
+
+        result = default;
+        return false;
+    }
+
+    private static bool TryFindMflrBefore(
+        IReadOnlyList<PpcInstruction> ordered,
+        int startIndex,
+        string destinationRegister,
+        out int mflrIndex)
+    {
+        for (var i = startIndex - 1; i >= 0 && startIndex - i <= MaxBacktrackInstructions; i--)
+        {
+            var ins = ordered[i];
+            if (string.Equals(ins.Mnemonic, "mflr", StringComparison.OrdinalIgnoreCase) &&
+                ins.Operands.Count >= 1 &&
+                ins.Operands[0] is PpcRegisterOperand dest &&
+                RegistersEqual(dest.Name, destinationRegister))
+            {
+                mflrIndex = i;
+                return true;
+            }
+        }
+
+        mflrIndex = -1;
+        return false;
+    }
+
+    private static bool TryFindLinkCallBefore(
+        IReadOnlyList<PpcInstruction> ordered,
+        int startIndex,
+        out uint linkAddress)
+    {
+        for (var i = startIndex - 1; i >= 0 && startIndex - i <= MaxBacktrackInstructions; i--)
+        {
+            var ins = ordered[i];
+            if (ins.IsCall)
+            {
+                linkAddress = ins.EndAddress;
+                return true;
+            }
+        }
+
+        linkAddress = 0;
+        return false;
+    }
+
+    private static bool TryFindUpperBound(IReadOnlyList<PpcInstruction> ordered, int startIndex, string register, out int upperBound)
+    {
+        // Preferred: compare directly on the same register used for lwzx indexing.
+        for (var i = startIndex - 1; i >= 0 && startIndex - i <= MaxBacktrackInstructions; i--)
+        {
+            var ins = ordered[i];
+            if (ins.Operands.Count < 2 || ins.Operands[0] is not PpcRegisterOperand reg ||
+                !string.Equals(reg.Name, register, StringComparison.OrdinalIgnoreCase) ||
+                ins.Operands[1] is not PpcImmediateOperand imm)
+            {
+                continue;
+            }
+
+            if (ins.Mnemonic is "cmplwi" or "cmpwi")
+            {
+                upperBound = imm.Value;
+                return true;
+            }
+        }
+
+        // Fallback: some loops compare a logical counter (e.g. r18) distinct from the byte-offset
+        // register (e.g. r30) that feeds lwzx, so the bound check may not target the index register.
+        for (var i = startIndex - 1; i >= 0 && startIndex - i <= MaxBacktrackInstructions; i--)
+        {
+            var ins = ordered[i];
+            if (ins.Operands.Count < 2 || ins.Operands[1] is not PpcImmediateOperand imm)
+            {
+                continue;
+            }
+
+            if (ins.Mnemonic is not ("cmplwi" or "cmpwi"))
+            {
+                continue;
+            }
+
+            if (imm.Value < 0 || imm.Value >= MaxEntryCount)
+            {
+                continue;
+            }
+
+            upperBound = imm.Value;
+            return true;
+        }
+
+        upperBound = 0;
+        return false;
+    }
+
+    private static bool TryReadWord(ProgramImage image, uint address, out uint value)
+    {
+        if (!image.Contains(address, sizeof(uint)))
+        {
+            value = 0;
+            return false;
+        }
+
+        var span = image.Memory.AsSpan(image.GetOffset(address, sizeof(uint)), sizeof(uint));
+        value = BinaryPrimitives.ReadUInt32BigEndian(span);
+        return true;
+    }
+
+    private static bool RegistersEqual(string left, string right) =>
+        string.Equals(left, right, StringComparison.OrdinalIgnoreCase);
+
+    private static uint AddSigned(uint value, int offset) =>
+        unchecked(value + (uint)offset);
+
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcDecoder.Helpers.cs b/translator/src/Translator.Core/Disassembly/PpcDecoder.Helpers.cs
new file mode 100644
index 0000000..32cefe3
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcDecoder.Helpers.cs
@@ -0,0 +1,126 @@
+using System.Buffers.Binary;
+
+namespace Translator.Core.Disassembly;
+
+public static partial class PpcDecoder
+{
+    private static int GetField(uint word, int startBit, int width = 5)
+    {
+        var mask = (1 << width) - 1;
+        return (int)((word >> startBit) & (uint)mask);
+    }
+
+    private static int SignExtend(uint value, int bits)
+    {
+        var shift = 32 - bits;
+        return (int)(value << shift) >> shift;
+    }
+
+    private static string? TryDecodeCrBranchMnemonic(int bo, int bi)
+    {
+        // Mask off the hint bits: BO=001zy (4/5) branches when the CR bit is false, BO=011zy (12/13) when true.
+        var baseBo = bo & 0x1E;
+        if (baseBo is not (4 or 12))
+        {
+            return null;
+        }
+
+        var crBit = bi % 4;
+        var table = baseBo == 12 ? TrueCrBranchMnemonics : FalseCrBranchMnemonics;
+
+        return table[crBit];
+    }
+
+    private static readonly string[] TrueCrBranchMnemonics = { "blt", "bgt", "beq", "bso" };
+
+    private static readonly string[] FalseCrBranchMnemonics = { "bge", "ble", "bne", "bns" };
+
+    // Operands are immutable records compared by value, so caching one shared instance per
+    // register number avoids an allocation on every decoded operand without changing behavior.
+    private const int RegisterFileSize = 32;
+
+    private static readonly string[] GprNames = BuildRegisterNames("r");
+
+    private static readonly string[] FprNames = BuildRegisterNames("f");
+
+    private static readonly PpcRegisterOperand[] GprOperands = BuildRegisterOperands(GprNames);
+
+    private static readonly PpcRegisterOperand[] FprOperands = BuildRegisterOperands(FprNames);
+
+    private static readonly PpcConditionRegisterOperand[] CrFieldOperands = BuildCrFieldOperands();
+
+    private static readonly PpcConditionRegisterOperand[] CrBitOperands = BuildCrBitOperands();
+
+    private static string[] BuildRegisterNames(string prefix)
+    {
+        var names = new string[RegisterFileSize];
+        for (var i = 0; i < names.Length; i++)
+        {
+            names[i] = prefix + i.ToString(System.Globalization.CultureInfo.InvariantCulture);
+        }
+
+        return names;
+    }
+
+    private static PpcRegisterOperand[] BuildRegisterOperands(string[] names)
+    {
+        var operands = new PpcRegisterOperand[names.Length];
+        for (var i = 0; i < operands.Length; i++)
+        {
+            operands[i] = new PpcRegisterOperand(names[i], i);
+        }
+
+        return operands;
+    }
+
+    private static PpcConditionRegisterOperand[] BuildCrFieldOperands()
+    {
+        var operands = new PpcConditionRegisterOperand[8];
+        for (var i = 0; i < operands.Length; i++)
+        {
+            operands[i] = new PpcConditionRegisterOperand($"cr{i}", i * 4);
+        }
+
+        return operands;
+    }
+
+    private static PpcConditionRegisterOperand[] BuildCrBitOperands()
+    {
+        var operands = new PpcConditionRegisterOperand[RegisterFileSize];
+        for (var i = 0; i < operands.Length; i++)
+        {
+            operands[i] = new PpcConditionRegisterOperand($"crb{i}", i);
+        }
+
+        return operands;
+    }
+
+    private static PpcRegisterOperand Reg(int number) =>
+        (uint)number < (uint)GprOperands.Length
+            ? GprOperands[number]
+            : new PpcRegisterOperand($"r{number}", number);
+
+    private static string RegName(int number) =>
+        (uint)number < (uint)GprNames.Length ? GprNames[number] : $"r{number}";
+
+    private static PpcRegisterOperand FReg(int number) =>
+        (uint)number < (uint)FprOperands.Length
+            ? FprOperands[number]
+            : new PpcRegisterOperand($"f{number}", number);
+
+    private static PpcConditionRegisterOperand CrField(int field) =>
+        (uint)field < (uint)CrFieldOperands.Length
+            ? CrFieldOperands[field]
+            : new PpcConditionRegisterOperand($"cr{field}", field * 4);
+
+    private static PpcConditionRegisterOperand CrBit(int bit) =>
+        (uint)bit < (uint)CrBitOperands.Length
+            ? CrBitOperands[bit]
+            : new PpcConditionRegisterOperand($"crb{bit}", bit);
+
+    private static int DecodeSpr(uint word)
+    {
+        // SPR is split across bits 11-15 (high) and 16-20 (low)
+        return ((int)(word >> 16) & 0x1F) | (((int)word >> 6) & 0x3E0);
+    }
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary19.cs b/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary19.cs
new file mode 100644
index 0000000..63de23d
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary19.cs
@@ -0,0 +1,131 @@
+using System.Buffers.Binary;
+
+namespace Translator.Core.Disassembly;
+
+public static partial class PpcDecoder
+{
+    private static void DecodePrimary19(uint address, uint word, List<PpcOperand> operands, List<uint> branches,
+        ref string mnemonic, ref bool isReturn, ref bool isCall, ref bool isCond)
+    {
+        var field0 = GetField(word, 21, 5);
+        var field1 = GetField(word, 16, 5);
+        var field2 = GetField(word, 11, 5);
+        var xo = GetField(word, 1, 10);
+        var lk = (word & 1) != 0;
+        var bo = field0;
+        var bi = field1;
+
+        if (xo == 16) // bclr
+        {
+            var isAlways = bo == 20;  // BI is ignored when BO says "always"
+            var crField = bi / 4;
+            if (isAlways)
+            {
+                mnemonic = lk ? "blrl" : "blr";
+            }
+            else if (lk)
+            {
+                // Conditional with link - use extended mnemonics with 'l' suffix if possible
+                var crBit = bi % 4;
+                mnemonic = (bo, crBit) switch
+                {
+                    (12, 0) => "bltlrl",
+                    (12, 1) => "bgtlrl",
+                    (12, 2) => "beqlrl",
+                    (12, 3) => "bsolrl",
+                    (4, 0) => "bgelrl",
+                    (4, 1) => "blelrl",
+                    (4, 2) => "bnelrl",
+                    (4, 3) => "bnslrl",
+                    _ => "bclrl"
+                };
+            }
+            else
+            {
+                // Conditional without link - extended mnemonics for common CR-based returns.
+                // BO=12 branches when the CR bit is 1, BO=4 branches when it is 0.
+                var crBit = bi % 4;
+                mnemonic = (bo, crBit) switch
+                {
+                    (12, 0) => "bltlr",
+                    (12, 1) => "bgtlr",
+                    (12, 2) => "beqlr",
+                    (12, 3) => "bsolr",
+                    (4, 0) => "bgelr",
+                    (4, 1) => "blelr",
+                    (4, 2) => "bnelr",
+                    (4, 3) => "bnslr",
+                    _ => "bclr"
+                };
+            }
+
+            isCall = lk;
+            isReturn = !lk && mnemonic.EndsWith("lr", StringComparison.OrdinalIgnoreCase);
+            isCond = !isAlways;
+            if (isCond && crField != 0)
+            {
+                operands.Add(CrField(crField));
+            }
+        }
+        else if (xo == 528) // bcctr
+        {
+            var isAlways = bo == 20;  // BI is ignored when BO says "always"
+            var crField = bi / 4;
+            if (isAlways)
+            {
+                mnemonic = lk ? "bctrl" : "bctr";
+            }
+            else
+            {
+                mnemonic = lk ? "bcctrl" : "bcctr";
+            }
+            isCall = lk;
+            // Unconditional bctr never falls through (tail/virtual dispatch, or later a switch
+            // terminator via JumpTableDetector); the disassembler must not treat it as linear code.
+            isReturn = !lk && isAlways;
+            isCond = !isAlways;
+            if (isCond && crField != 0)
+            {
+                operands.Add(CrField(crField));
+            }
+        }
+        else if (xo == 50)
+        {
+            mnemonic = "rfi";
+            isReturn = true;
+        }
+        else if (xo == 150)
+        {
+            mnemonic = "isync";
+        }
+        else if (xo == 0)
+        {
+            mnemonic = "mcrf";
+            operands.Add(CrField(field0 / 4));
+            operands.Add(CrField(field1 / 4));
+        }
+        else if (xo is 33 or 129 or 193 or 225 or 257 or 289 or 417 or 449)
+        {
+            mnemonic = xo switch
+            {
+                33 => "crnor",
+                129 => "crandc",
+                193 => "crxor",
+                225 => "crnand",
+                257 => "crand",
+                289 => "creqv",
+                417 => "crorc",
+                449 => "cror",
+                _ => "unk19"
+            };
+
+            operands.Add(CrBit(field0));
+            operands.Add(CrBit(field1));
+            operands.Add(CrBit(field2));
+        }
+        else
+        {
+            mnemonic = "unk19";
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary31.cs b/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary31.cs
new file mode 100644
index 0000000..f74bd8f
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary31.cs
@@ -0,0 +1,698 @@
+using System.Buffers.Binary;
+
+namespace Translator.Core.Disassembly;
+
+public static partial class PpcDecoder
+{
+    private static void DecodePrimary31(uint address, uint word, List<PpcOperand> operands, List<uint> branches,
+        ref string mnemonic, ref bool isReturn, ref bool isCall, ref bool isCond)
+    {
+        // For XO-form arithmetic instructions, bit 21 (our bit 10) is the OE bit.
+        // We extract both the full 10-bit XO and the 9-bit XO with separate OE.
+        var xo10 = GetField(word, 1, 10);  // Full 10-bit XO for X-form instructions
+        var xo = GetField(word, 1, 9);     // 9-bit XO for XO-form instructions
+        var oe = ((word >> 10) & 1) != 0;  // OE bit (bit 21)
+        var rc = (word & 1) != 0;
+        var rs = GetField(word, 21);
+        var ra = GetField(word, 16);
+        var rb = GetField(word, 11);
+
+        // Helper for arithmetic mnemonics with OE and Rc support
+        string ArithMnemonic(string baseName) => baseName + (oe ? "o" : "") + (rc ? "." : "");
+
+        switch (xo)
+        {
+            case 0: // cmp (cmpw)
+            {
+                if (xo10 == 512)
+                {
+                    mnemonic = "mcrxr";
+                    operands.Add(CrField(rs / 4));
+                    break;
+                }
+
+                var crfD = GetField(word, 23, 3);
+                var lBit = GetField(word, 21, 1);
+                if (lBit != 0)
+                    mnemonic = "invalid_cmp";
+                else
+                    mnemonic = "cmpw";
+
+                operands.Add(CrField(crfD));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                isCond = true;
+                break;
+            }
+
+            case 4: // tw
+                mnemonic = "tw";
+                operands.Add(new PpcImmediateOperand(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+            case 8: // subfc rD,rA,rB
+                mnemonic = ArithMnemonic("subfc");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+            case 10: // addc rD,rA,rB
+                mnemonic = ArithMnemonic("addc");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+            case 19: // mfcr rD
+                mnemonic = "mfcr";
+                operands.Add(Reg(rs));
+                break;
+
+            case 20: // lwarx rD,rA,rB
+                mnemonic = "lwarx";
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+
+
+
+
+            case 28: // and rA,rS,rB
+                mnemonic = rc ? "and." : "and";
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rs));
+                operands.Add(Reg(rb));
+                break;
+
+            case 26: // cntlzw rA,rS
+                mnemonic = rc ? "cntlzw." : "cntlzw";
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rs));
+                break;
+
+            case 32: // cmplw
+            {
+                var crfD = GetField(word, 23, 3);
+                mnemonic = "cmplw";
+                if (crfD != 0)
+                    operands.Add(CrField(crfD));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                isCond = true;
+                break;
+            }
+
+            case 60: // andc rA,rS,rB
+                mnemonic = rc ? "andc." : "andc";
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rs));
+                operands.Add(Reg(rb));
+                break;
+
+
+
+            case 83: // mfmsr rD
+                if (xo10 == 595)
+                {
+                    mnemonic = "mfsr";
+                    operands.Add(Reg(rs));
+                    operands.Add(new PpcImmediateOperand(ra & 0xF));
+                }
+                else
+                {
+                    mnemonic = "mfmsr";
+                    operands.Add(Reg(rs));
+                }
+                break;
+
+            case 146: // mtmsr rS
+                mnemonic = "mtmsr";
+                operands.Add(Reg(rs));
+                break;
+
+            case 144: // mtcrf CRM,rS
+                mnemonic = "mtcrf";
+                operands.Add(new PpcImmediateOperand((int)((word >> 12) & 0xFF)));
+                operands.Add(Reg(rs));
+                break;
+
+
+
+            case 124: // nor rA,rS,rB
+                mnemonic = rc ? "nor." : "nor";
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rs));
+                operands.Add(Reg(rb));
+                break;
+
+            case 476: // nand rA,rS,rB
+                mnemonic = rc ? "nand." : "nand";
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rs));
+                operands.Add(Reg(rb));
+                break;
+
+            case 104: // neg rD,rA
+                mnemonic = ArithMnemonic("neg");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                break;
+
+            case 136: // subfe rD,rA,rB
+                mnemonic = ArithMnemonic("subfe");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+
+
+            case 40: // subf rD,rA,rB
+                mnemonic = ArithMnemonic("subf");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+            case 232: // subfme rD,rA
+                mnemonic = ArithMnemonic("subfme");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                break;
+
+
+
+
+
+            case 202: // addze rD,rA
+                mnemonic = ArithMnemonic("addze");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                break;
+
+            case 234: // addme rD,rA
+                mnemonic = ArithMnemonic("addme");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                break;
+
+            case 235: // mullw rD,rA,rB
+                mnemonic = ArithMnemonic("mullw");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+            case 266: // add rD,rA,rB
+                mnemonic = ArithMnemonic("add");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+
+
+            case 316: // xor rA,rS,rB
+                mnemonic = rc ? "xor." : "xor";
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rs));
+                operands.Add(Reg(rb));
+                break;
+
+            case 284: // eqv rA,rS,rB
+                mnemonic = rc ? "eqv." : "eqv";
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rs));
+                operands.Add(Reg(rb));
+                break;
+
+            case 339: // mfspr rD,SPR
+                var spr = DecodeSpr(word);
+                mnemonic = spr switch
+                {
+                    8 => "mflr",
+                    9 => "mfctr",
+                    1 => "mfxer",
+                    _ => "mfspr"
+                };
+                operands.Add(Reg(rs));
+                if (mnemonic == "mfspr")
+                {
+                    operands.Add(new PpcImmediateOperand(spr));
+                }
+                break;
+
+
+
+
+
+            case 412: // orc rA,rS,rB
+                mnemonic = rc ? "orc." : "orc";
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rs));
+                operands.Add(Reg(rb));
+                break;
+
+
+
+            case 444: // or / mr alias
+                mnemonic = (!rc && rs == rb) ? "mr" : (rc ? "or." : "or");
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rs));
+                operands.Add(Reg(rb));
+                break;
+
+            case 11: // mulhwu rD,rA,rB
+                mnemonic = rc ? "mulhwu." : "mulhwu";
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+            case 75: // mulhw rD,rA,rB (signed multiply high word)
+                mnemonic = rc ? "mulhw." : "mulhw";
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+            case 459: // divwu rD,rA,rB
+                mnemonic = ArithMnemonic("divwu");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+            case 467: // mtspr SPR,rS
+                spr = DecodeSpr(word);
+                mnemonic = spr switch
+                {
+                    8 => "mtlr",
+                    9 => "mtctr",
+                    1 => "mtxer",
+                    _ => "mtspr"
+                };
+                if (mnemonic == "mtspr")
+                {
+                    operands.Add(new PpcImmediateOperand(spr));
+                    operands.Add(Reg(rs));
+                }
+                else
+                {
+                    operands.Add(Reg(rs));
+                }
+                break;
+
+            case 210: // mtsr SR,rS
+                mnemonic = "mtsr";
+                operands.Add(new PpcImmediateOperand(ra & 0xF));
+                operands.Add(Reg(rs));
+                break;
+
+            case 242: // mtsrin rS,rB
+                mnemonic = "mtsrin";
+                operands.Add(Reg(rs));
+                operands.Add(Reg(rb));
+                break;
+
+            case 491: // divw rD,rA,rB
+                mnemonic = ArithMnemonic("divw");
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                break;
+
+            case 498: // stwcx. rS,rA,rB
+                mnemonic = "stwcx.";
+                operands.Add(Reg(rs));
+                operands.Add(Reg(ra));
+                operands.Add(Reg(rb));
+                isCond = true;
+                break;
+
+
+
+            default:
+                // X-form instructions use the full 10-bit XO (no OE bit)
+                // Handle them here with a secondary switch on xo10
+                switch (xo10)
+                {
+                    case 23: // lwzx rD,rA,rB
+                        mnemonic = "lwzx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 24: // slw rA,rS,rB
+                        mnemonic = rc ? "slw." : "slw";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 54: // dcbst rA,rB
+                        mnemonic = "dcbst";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 86: // dcbf rA,rB
+                        mnemonic = "dcbf";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 55: // lwzux rD,rA,rB
+                        mnemonic = "lwzux";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 87: // lbzx rD,rA,rB
+                        mnemonic = "lbzx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 151: // stwx rS,rA,rB
+                        mnemonic = "stwx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 183: // stwux rS,rA,rB
+                        mnemonic = "stwux";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 246: // dcbtst rA,rB
+                        mnemonic = "dcbtst";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 215: // stbx rS,rA,rB
+                        mnemonic = "stbx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 247: // stbux rS,rA,rB
+                        mnemonic = "stbux";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 278: // dcbt rA,rB
+                        mnemonic = "dcbt";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 310: // eciwx rD,rA,rB
+                        mnemonic = "eciwx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 306: // tlbie rB
+                        mnemonic = "tlbie";
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 279: // lhzx rD,rA,rB
+                        mnemonic = "lhzx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 311: // lhzux rD,rA,rB
+                        mnemonic = "lhzux";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 343: // lhax rD,rA,rB
+                        mnemonic = "lhax";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 375: // lhaux rD,rA,rB
+                        mnemonic = "lhaux";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 407: // sthx rS,rA,rB
+                        mnemonic = "sthx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 438: // ecowx rS,rA,rB
+                        mnemonic = "ecowx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 439: // sthux rS,rA,rB
+                        mnemonic = "sthux";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 470: // dcbi rA,rB
+                        mnemonic = "dcbi";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 536: // srw rA,rS,rB
+                        mnemonic = rc ? "srw." : "srw";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 598: // sync
+                        mnemonic = "sync";
+                        break;
+
+                    case 566: // tlbsync
+                        mnemonic = "tlbsync";
+                        break;
+
+                    case 533: // lswx rD,rA,rB
+                        mnemonic = "lswx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 597: // lswi rD,rA,NB
+                        mnemonic = "lswi";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(new PpcImmediateOperand((int)rb));
+                        break;
+
+                    case 792: // sraw rA,rS,rB
+                        mnemonic = rc ? "sraw." : "sraw";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 824: // srawi rA,rS,SH
+                        var sh5 = GetField(word, 11, 5);
+                        mnemonic = rc ? "srawi." : "srawi";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rs));
+                        operands.Add(new PpcImmediateOperand(sh5));
+                        break;
+
+                    case 535: // lfsx frD,rA,rB
+                        mnemonic = "lfsx";
+                        operands.Add(FReg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 567: // lfsux frD,rA,rB
+                        mnemonic = "lfsux";
+                        operands.Add(FReg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 599: // lfdx frD,rA,rB
+                        mnemonic = "lfdx";
+                        operands.Add(FReg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 631: // lfdux frD,rA,rB
+                        mnemonic = "lfdux";
+                        operands.Add(FReg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 663: // stfsx frS,rA,rB
+                        mnemonic = "stfsx";
+                        operands.Add(FReg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 661: // stswx rS,rA,rB
+                        mnemonic = "stswx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 695: // stfsux frS,rA,rB
+                        mnemonic = "stfsux";
+                        operands.Add(FReg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 725: // stswi rS,rA,NB
+                        mnemonic = "stswi";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(new PpcImmediateOperand((int)rb));
+                        break;
+
+                    case 727: // stfdx frS,rA,rB
+                        mnemonic = "stfdx";
+                        operands.Add(FReg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 758: // dcba rA,rB
+                        mnemonic = "dcba";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 759: // stfdux frS,rA,rB
+                        mnemonic = "stfdux";
+                        operands.Add(FReg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 854: // eieio
+                        mnemonic = "eieio";
+                        break;
+
+                    case 371: // mftb rD,TBR
+                        var tbr = DecodeSpr(word);
+                        mnemonic = tbr == 269 ? "mftbu" : "mftb";
+                        operands.Add(Reg(rs));
+                        if (tbr is not (268 or 269))
+                        {
+                            operands.Add(new PpcImmediateOperand(tbr));
+                        }
+                        break;
+
+                    case 534: // lwbrx rD,rA,rB
+                        mnemonic = "lwbrx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 662: // stwbrx rS,rA,rB
+                        mnemonic = "stwbrx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 659: // mfsrin rD,rB
+                        mnemonic = "mfsrin";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 790: // lhbrx rD,rA,rB
+                        mnemonic = "lhbrx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 918: // sthbrx rS,rA,rB
+                        mnemonic = "sthbrx";
+                        operands.Add(Reg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 982: // icbi rA,rB
+                        mnemonic = "icbi";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 983: // stfiwx frS,rA,rB
+                        mnemonic = "stfiwx";
+                        operands.Add(FReg(rs));
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 1014: // dcbz rA,rB
+                        mnemonic = "dcbz";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rb));
+                        break;
+
+                    case 922: // extsh rA,rS
+                        mnemonic = rc ? "extsh." : "extsh";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rs));
+                        break;
+
+                    case 954: // extsb rA,rS
+                        mnemonic = rc ? "extsb." : "extsb";
+                        operands.Add(Reg(ra));
+                        operands.Add(Reg(rs));
+                        break;
+
+                    default:
+                        mnemonic = $"xo_{xo10}";
+                        break;
+                }
+                break;
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary59.cs b/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary59.cs
new file mode 100644
index 0000000..22c83ca
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary59.cs
@@ -0,0 +1,79 @@
+namespace Translator.Core.Disassembly;
+
+public static partial class PpcDecoder
+{
+    private static void DecodePrimary59(uint address, uint word, List<PpcOperand> operands, List<uint> branches,
+        ref string mnemonic, ref bool isReturn, ref bool isCall, ref bool isCond)
+    {
+        var xo = GetField(word, 1, 5);
+        var rc = (word & 1) != 0;
+        var frt = GetField(word, 21);
+        var fra = GetField(word, 16);
+        var frb = GetField(word, 11);
+        var frc = GetField(word, 6);
+
+        switch (xo)
+        {
+            case 18:
+                mnemonic = rc ? "fdivs." : "fdivs";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frb));
+                break;
+            case 20:
+                mnemonic = rc ? "fsubs." : "fsubs";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frb));
+                break;
+            case 21:
+                mnemonic = rc ? "fadds." : "fadds";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frb));
+                break;
+            case 24:
+                mnemonic = rc ? "fres." : "fres";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+            case 25:
+                mnemonic = rc ? "fmuls." : "fmuls";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                break;
+            case 28:
+                mnemonic = rc ? "fmsubs." : "fmsubs";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                operands.Add(FReg(frb));
+                break;
+            case 29:
+                mnemonic = rc ? "fmadds." : "fmadds";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                operands.Add(FReg(frb));
+                break;
+            case 30:
+                mnemonic = rc ? "fnmsubs." : "fnmsubs";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                operands.Add(FReg(frb));
+                break;
+            case 31:
+                mnemonic = rc ? "fnmadds." : "fnmadds";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                operands.Add(FReg(frb));
+                break;
+            default:
+                mnemonic = "opc_59";
+                break;
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary63.cs b/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary63.cs
new file mode 100644
index 0000000..b9cf574
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcDecoder.Primary63.cs
@@ -0,0 +1,205 @@
+using System.Buffers.Binary;
+
+namespace Translator.Core.Disassembly;
+
+public static partial class PpcDecoder
+{
+    private static void DecodePrimary63(uint address, uint word, List<PpcOperand> operands, List<uint> branches,
+        ref string mnemonic, ref bool isReturn, ref bool isCall, ref bool isCond)
+    {
+        var xo = GetField(word, 1, 10);
+        var rc = (word & 1) != 0;
+        var frt = GetField(word, 21);
+        var fra = GetField(word, 16);
+        var frb = GetField(word, 11);
+        var frc = GetField(word, 6);
+        var xo5 = xo & 0x1F;
+
+        switch (xo5)
+        {
+            case 23: // fsel
+                mnemonic = rc ? "fsel." : "fsel";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                operands.Add(FReg(frb));
+                return;
+            case 25: // fmul
+                mnemonic = rc ? "fmul." : "fmul";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                return;
+            case 28: // fmsub
+                mnemonic = rc ? "fmsub." : "fmsub";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                operands.Add(FReg(frb));
+                return;
+            case 29: // fmadd
+                mnemonic = rc ? "fmadd." : "fmadd";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                operands.Add(FReg(frb));
+                return;
+            case 30: // fnmsub
+                mnemonic = rc ? "fnmsub." : "fnmsub";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                operands.Add(FReg(frb));
+                return;
+            case 31: // fnmadd
+                mnemonic = rc ? "fnmadd." : "fnmadd";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frc));
+                operands.Add(FReg(frb));
+                return;
+        }
+
+        switch (xo)
+        {
+            case 64: // mcrfs
+            {
+                var crfD = GetField(word, 23, 3);
+                var crfS = GetField(word, 18, 3);
+                mnemonic = "mcrfs";
+                operands.Add(CrField(crfD));
+                operands.Add(CrField(crfS));
+                isCond = true;
+                break;
+            }
+
+            case 0: // fcmpu
+            {
+                var crfD = GetField(word, 23, 3);
+                mnemonic = "fcmpu";
+                operands.Add(CrField(crfD));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frb));
+                isCond = true;
+                break;
+            }
+
+            case 32: // fcmpo
+            {
+                var crfD = GetField(word, 23, 3);
+                mnemonic = "fcmpo";
+                operands.Add(CrField(crfD));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frb));
+                isCond = true;
+                break;
+            }
+
+            case 38: // mtfsb1
+                mnemonic = rc ? "mtfsb1." : "mtfsb1";
+                operands.Add(new PpcImmediateOperand(frt));
+                break;
+
+            case 70: // mtfsb0
+                mnemonic = rc ? "mtfsb0." : "mtfsb0";
+                operands.Add(new PpcImmediateOperand(frt));
+                break;
+
+            case 134: // mtfsfi
+                mnemonic = rc ? "mtfsfi." : "mtfsfi";
+                operands.Add(new PpcImmediateOperand(GetField(word, 23, 3)));
+                operands.Add(new PpcImmediateOperand(GetField(word, 12, 4)));
+                break;
+
+            case 583: // mffs
+                mnemonic = rc ? "mffs." : "mffs";
+                operands.Add(FReg(frt));
+                break;
+
+            case 711: // mtfsf
+                mnemonic = rc ? "mtfsf." : "mtfsf";
+                operands.Add(new PpcImmediateOperand((int)((word >> 17) & 0xFF)));
+                operands.Add(FReg(frb));
+                break;
+
+            case 14: // fctiw
+                mnemonic = rc ? "fctiw." : "fctiw";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+
+            case 15: // fctiwz
+                mnemonic = rc ? "fctiwz." : "fctiwz";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+
+            case 12: // frsp
+                mnemonic = rc ? "frsp." : "frsp";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+
+            case 18: // fdiv
+                mnemonic = rc ? "fdiv." : "fdiv";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frb));
+                break;
+
+            case 20: // fsub
+                mnemonic = rc ? "fsub." : "fsub";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frb));
+                break;
+
+            case 21: // fadd
+                mnemonic = rc ? "fadd." : "fadd";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(fra));
+                operands.Add(FReg(frb));
+                break;
+
+            case 24: // fres
+                mnemonic = rc ? "fres." : "fres";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+
+            case 26: // frsqrte
+                mnemonic = rc ? "frsqrte." : "frsqrte";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+
+            case 40: // fneg
+                mnemonic = rc ? "fneg." : "fneg";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+
+            case 136: // fnabs
+                mnemonic = rc ? "fnabs." : "fnabs";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+
+            case 72: // fmr
+                mnemonic = rc ? "fmr." : "fmr";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+
+            case 264: // fabs
+                mnemonic = rc ? "fabs." : "fabs";
+                operands.Add(FReg(frt));
+                operands.Add(FReg(frb));
+                break;
+
+            default:
+                mnemonic = $"fp_{xo}";
+                break;
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcDecoder.cs b/translator/src/Translator.Core/Disassembly/PpcDecoder.cs
new file mode 100644
index 0000000..aaa7217
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcDecoder.cs
@@ -0,0 +1,820 @@
+
+namespace Translator.Core.Disassembly;
+
+/// <summary>
+/// Minimal in-house PowerPC decoder for the Wii/Gekko instruction set. It returns typed
+/// operands so later stages never have to parse disassembly strings.
+/// </summary>
+public static partial class PpcDecoder
+{
+    public static PpcInstruction Decode(uint address, uint word)
+    {
+        var primary = (int)((word >> 26) & 0x3F);
+        var operands = new List<PpcOperand>();
+        var branches = new List<uint>();
+        var mnemonic = "unknown";
+        var isReturn = false;
+        var isCall = false;
+        var isCond = false;
+
+        int rD, rA, rS;
+
+        switch (primary)
+        {
+            case 3: // twi
+                rA = GetField(word, 16);
+                mnemonic = "twi";
+                operands.Add(new PpcImmediateOperand(GetField(word, 21, 5)));
+                operands.Add(Reg(rA));
+                operands.Add(new PpcImmediateOperand((short)(word & 0xFFFF)));
+                break;
+
+            case 7: // mulli
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "mulli";
+                operands.Add(Reg(rD));
+                operands.Add(Reg(rA));
+                operands.Add(new PpcImmediateOperand((short)(word & 0xFFFF)));
+                break;
+
+            case 8: // subfic
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "subfic";
+                operands.Add(Reg(rD));
+                operands.Add(Reg(rA));
+                operands.Add(new PpcImmediateOperand((short)(word & 0xFFFF)));
+                break;
+
+            case 10: // cmplwi
+            {
+                var crfD = GetField(word, 23, 3); // Bits 6-8 (3 bits)
+                rA = GetField(word, 16);
+                mnemonic = "cmplwi";
+                if (crfD != 0)
+                    operands.Add(CrField(crfD));
+                operands.Add(Reg(rA));
+                operands.Add(new PpcImmediateOperand((int)(word & 0xFFFF)));
+                isCond = true;
+                break;
+            }
+
+            case 11: // cmpwi
+            {
+                var crfD = GetField(word, 23, 3); // Bits 6-8 (3 bits)
+                rA = GetField(word, 16);
+                mnemonic = "cmpwi";
+                if (crfD != 0)
+                    operands.Add(CrField(crfD));
+                operands.Add(Reg(rA));
+                operands.Add(new PpcImmediateOperand((short)(word & 0xFFFF)));
+                isCond = true;
+                break;
+            }
+
+            case 12: // addic
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "addic";
+                operands.Add(Reg(rD));
+                operands.Add(Reg(rA));
+                operands.Add(new PpcImmediateOperand((short)(word & 0xFFFF)));
+                break;
+
+            case 13: // addic.
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "addic.";
+                operands.Add(Reg(rD));
+                operands.Add(Reg(rA));
+                operands.Add(new PpcImmediateOperand((short)(word & 0xFFFF)));
+                isCond = true;
+                break;
+
+            case 14: // addi / li
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                var simm = (short)(word & 0xFFFF);
+                if (rA == 0)
+                {
+                    mnemonic = "li";
+                    operands.Add(Reg(rD));
+                    operands.Add(new PpcImmediateOperand(simm));
+                }
+                else
+                {
+                    mnemonic = "addi";
+                    operands.Add(Reg(rD));
+                    operands.Add(Reg(rA));
+                    operands.Add(new PpcImmediateOperand(simm));
+                }
+                break;
+
+            case 15: // addis / lis
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                simm = (short)(word & 0xFFFF);
+                if (rA == 0)
+                {
+                    mnemonic = "lis";
+                    operands.Add(Reg(rD));
+                    operands.Add(new PpcImmediateOperand(simm));
+                }
+                else
+                {
+                    mnemonic = "addis";
+                    operands.Add(Reg(rD));
+                    operands.Add(Reg(rA));
+                    operands.Add(new PpcImmediateOperand(simm));
+                }
+                break;
+
+            case 16: // bc and its extended mnemonics
+                var bo = GetField(word, 21, 5);
+                var bi = GetField(word, 16, 5);
+                var bd = SignExtend((word >> 2) & 0x3FFFu, 14) << 2;
+                var aa = ((word >> 1) & 1) != 0;
+                var lk = (word & 1) != 0;  // LK bit - set link register
+                var target = aa ? (uint)bd : address + (uint)bd;
+                var crField = bi / 4;  // CR0-CR7 field
+
+                var branchMnemonic = TryDecodeCrBranchMnemonic(bo, bi);
+                if (branchMnemonic is not null)
+                {
+                    mnemonic = lk ? branchMnemonic + "l" : branchMnemonic;
+                }
+                else if ((bo & 0x1E) == 16)
+                {
+                    mnemonic = lk ? "bdnzl" : "bdnz";
+                }
+                else if ((bo & 0x1E) == 18)
+                {
+                    mnemonic = lk ? "bdzl" : "bdz";
+                }
+                else
+                {
+                    mnemonic = lk ? "bcl" : "bc";
+                    operands.Add(new PpcImmediateOperand(bo));
+                    operands.Add(new PpcImmediateOperand(bi));
+                }
+
+                // Add CR field operand for non-cr0 branches so the lifter knows which field to check
+                if (crField != 0)
+                {
+                    operands.Add(CrField(crField));
+                }
+                operands.Add(new PpcBranchTargetOperand(target));
+                branches.Add(target);
+                isCond = true;
+                isCall = lk;  // LK bit means this is a call (sets LR)
+                break;
+
+            case 17: // sc
+                mnemonic = "sc";
+                break;
+
+
+            case 18: // b / bl
+                var li = SignExtend((word >> 2) & 0x00FFFFFFu, 24) << 2;
+                aa = ((word >> 1) & 1) != 0;
+                lk = (word & 1) != 0;
+                target = aa ? (uint)li : address + (uint)li;
+                mnemonic = lk ? "bl" : "b";
+                operands.Add(new PpcBranchTargetOperand(target));
+                branches.Add(target);
+                isCall = lk;
+                break;
+
+            case 19:
+                DecodePrimary19(address, word, operands, branches, ref mnemonic, ref isReturn, ref isCall, ref isCond);
+                break;
+            case 20: // rlwimi
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                var sh = GetField(word, 11, 5);
+                var mb = GetField(word, 6, 5);
+                var me = GetField(word, 1, 5);
+                mnemonic = (word & 1) != 0 ? "rlwimi." : "rlwimi";
+                operands.Add(Reg(rA));
+                operands.Add(Reg(rS));
+                operands.Add(new PpcImmediateOperand(sh));
+                operands.Add(new PpcImmediateOperand(mb));
+                operands.Add(new PpcImmediateOperand(me));
+                isCond = (word & 1) != 0;
+                break;
+
+            case 21: // rlwinm
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                sh = GetField(word, 11, 5);
+                mb = GetField(word, 6, 5);
+                me = GetField(word, 1, 5);
+                mnemonic = (word & 1) != 0 ? "rlwinm." : "rlwinm";
+                operands.Add(Reg(rA));
+                operands.Add(Reg(rS));
+                operands.Add(new PpcImmediateOperand(sh));
+                operands.Add(new PpcImmediateOperand(mb));
+                operands.Add(new PpcImmediateOperand(me));
+                isCond = (word & 1) != 0;
+                break;
+
+            case 23: // rlwnm - Rotate Left Word then AND with Mask (register shift)
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                var rB = GetField(word, 11);  // Register containing shift amount
+                mb = GetField(word, 6, 5);
+                me = GetField(word, 1, 5);
+                mnemonic = (word & 1) != 0 ? "rlwnm." : "rlwnm";
+                operands.Add(Reg(rA));
+                operands.Add(Reg(rS));
+                operands.Add(Reg(rB));  // Register instead of immediate
+                operands.Add(new PpcImmediateOperand(mb));
+                operands.Add(new PpcImmediateOperand(me));
+                isCond = (word & 1) != 0;
+                break;
+
+            case 4: // paired-single arithmetic/select
+            {
+                // Extract full 10-bit XO (bits 21-30)
+                var xo = (int)((word >> 1) & 0x3FF);
+                // Extract lower 5 bits (bits 26-30)
+                var xo5 = xo & 0x1F;
+                var rc = (word & 1) != 0;
+
+                var frt = GetField(word, 21);
+                var fra = GetField(word, 16);
+                var frb = GetField(word, 11);
+                var frc = GetField(word, 6);
+
+                // First handle A-form instructions (which use bits 21-25 as frC operand, not part of opcode)
+                // These are identified by the lower 5 bits of XO (bits 26-30 in word)
+                switch (xo5)
+                {
+                    case 29: // ps_madd (XO=29)
+                        mnemonic = rc ? "ps_madd." : "ps_madd";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        operands.Add(FReg(frb));
+                        break;
+
+                    case 28: // ps_msub (XO=28)
+                        mnemonic = rc ? "ps_msub." : "ps_msub";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        operands.Add(FReg(frb));
+                        break;
+
+                    case 30: // ps_nmsub (XO=30)
+                        mnemonic = rc ? "ps_nmsub." : "ps_nmsub";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        operands.Add(FReg(frb));
+                        break;
+
+                    case 31: // ps_nmadd (XO=31)
+                        mnemonic = rc ? "ps_nmadd." : "ps_nmadd";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        operands.Add(FReg(frb));
+                        break;
+
+                    case 25: // ps_mul (XO=25)
+                        mnemonic = rc ? "ps_mul." : "ps_mul";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        break;
+
+                    case 23: // ps_sel (XO=23)
+                        mnemonic = rc ? "ps_sel." : "ps_sel";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        operands.Add(FReg(frb));
+                        break;
+
+                    case 14: // ps_madds0 (XO5=14)
+                        mnemonic = rc ? "ps_madds0." : "ps_madds0";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        operands.Add(FReg(frb));
+                        break;
+
+                    case 15: // ps_madds1 (XO5=15)
+                        mnemonic = rc ? "ps_madds1." : "ps_madds1";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        operands.Add(FReg(frb));
+                        break;
+
+                    case 10: // ps_sum0 (XO5=10)
+                        mnemonic = rc ? "ps_sum0." : "ps_sum0";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        operands.Add(FReg(frb));
+                        break;
+
+                    case 11: // ps_sum1 (XO5=11)
+                        mnemonic = rc ? "ps_sum1." : "ps_sum1";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        operands.Add(FReg(frb));
+                        break;
+
+                    case 12: // ps_muls0 (XO5=12)
+                        mnemonic = rc ? "ps_muls0." : "ps_muls0";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        break;
+
+                    case 13: // ps_muls1 (XO5=13)
+                        mnemonic = rc ? "ps_muls1." : "ps_muls1";
+                        operands.Add(FReg(frt));
+                        operands.Add(FReg(fra));
+                        operands.Add(FReg(frc));
+                        break;
+
+                    default:
+                        // If not A-form, check full 10-bit XO for X-form instructions
+                        var psqIndexedXo = xo & 0x3F;
+                        if (psqIndexedXo is 6 or 38)
+                        {
+                            var w = (word >> 10) & 0x1;
+                            var quant = (word >> 7) & 0x7;
+                            mnemonic = psqIndexedXo == 38 ? "psq_lux" : "psq_lx";
+                            operands.Add(FReg(frt));
+                            operands.Add(Reg(fra));
+                            operands.Add(Reg(frb));
+                            operands.Add(new PpcImmediateOperand((int)w));
+                            operands.Add(new PpcImmediateOperand((int)quant));
+                            break;
+                        }
+
+                        if (psqIndexedXo is 7 or 39)
+                        {
+                            var w = (word >> 10) & 0x1;
+                            var quant = (word >> 7) & 0x7;
+                            mnemonic = psqIndexedXo == 39 ? "psq_stux" : "psq_stx";
+                            operands.Add(FReg(frt));
+                            operands.Add(Reg(fra));
+                            operands.Add(Reg(frb));
+                            operands.Add(new PpcImmediateOperand((int)w));
+                            operands.Add(new PpcImmediateOperand((int)quant));
+                            break;
+                        }
+
+                        switch (xo)
+                        {
+                            case 21: // ps_add (XO=21)
+                                mnemonic = rc ? "ps_add." : "ps_add";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 20: // ps_sub (XO=20)
+                                mnemonic = rc ? "ps_sub." : "ps_sub";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 18: // ps_div (XO=18)
+                                mnemonic = rc ? "ps_div." : "ps_div";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 24: // ps_res (XO=24)
+                                mnemonic = rc ? "ps_res." : "ps_res";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 26: // ps_rsqrte (XO=26)
+                                mnemonic = rc ? "ps_rsqrte." : "ps_rsqrte";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 528: // ps_merge00 (XO=528)
+                                mnemonic = rc ? "ps_merge00." : "ps_merge00";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 560: // ps_merge01 (XO=560)
+                                mnemonic = rc ? "ps_merge01." : "ps_merge01";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 592: // ps_merge10 (XO=592)
+                                mnemonic = rc ? "ps_merge10." : "ps_merge10";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 624: // ps_merge11 (XO=624)
+                                mnemonic = rc ? "ps_merge11." : "ps_merge11";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 72: // ps_mr (XO=72)
+                                mnemonic = rc ? "ps_mr." : "ps_mr";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 40: // ps_neg (XO=40)
+                                mnemonic = rc ? "ps_neg." : "ps_neg";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 264: // ps_abs (XO=264)
+                                mnemonic = rc ? "ps_abs." : "ps_abs";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 136: // ps_nabs (XO=136)
+                                mnemonic = rc ? "ps_nabs." : "ps_nabs";
+                                operands.Add(FReg(frt));
+                                operands.Add(FReg(frb));
+                                break;
+
+                            case 0: // ps_cmpu0 (XO=0)
+                            {
+                                var crfD = GetField(word, 23, 3);
+                                mnemonic = "ps_cmpu0";
+                                operands.Add(CrField(crfD));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                isCond = true;
+                                break;
+                            }
+
+                            case 32: // ps_cmpo0 (XO=32)
+                            {
+                                var crfD = GetField(word, 23, 3);
+                                mnemonic = "ps_cmpo0";
+                                operands.Add(CrField(crfD));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                isCond = true;
+                                break;
+                            }
+
+                            case 64: // ps_cmpu1 (XO=64)
+                            {
+                                var crfD = GetField(word, 23, 3);
+                                mnemonic = "ps_cmpu1";
+                                operands.Add(CrField(crfD));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                isCond = true;
+                                break;
+                            }
+
+                            case 96: // ps_cmpo1 (XO=96)
+                            {
+                                var crfD = GetField(word, 23, 3);
+                                mnemonic = "ps_cmpo1";
+                                operands.Add(CrField(crfD));
+                                operands.Add(FReg(fra));
+                                operands.Add(FReg(frb));
+                                isCond = true;
+                                break;
+                            }
+
+                            case 1014: // dcbz_l (XO=1014)
+                                mnemonic = "dcbz_l";
+                                operands.Add(Reg(fra));
+                                operands.Add(Reg(frb));
+                                break;
+
+                            default:
+                                mnemonic = $"opc_4_{xo}";
+                                break;
+                        }
+                        break;
+                }
+                break;
+            }
+
+            case 24: // ori / nop alias
+                rA = GetField(word, 16);
+                rS = GetField(word, 21);
+                var uimm16 = (int)(word & 0xFFFF);
+                mnemonic = (rA == 0 && rS == 0 && uimm16 == 0) ? "nop" : "ori";
+                operands.Add(Reg(rA));
+                operands.Add(Reg(rS));
+                operands.Add(new PpcImmediateOperand(uimm16));
+                break;
+
+            case 25: // oris
+                rA = GetField(word, 16);
+                rS = GetField(word, 21);
+                uimm16 = (int)(word & 0xFFFF);
+                mnemonic = "oris";
+                operands.Add(Reg(rA));
+                operands.Add(Reg(rS));
+                operands.Add(new PpcImmediateOperand(uimm16));
+                break;
+
+            case 26: // xori
+                rA = GetField(word, 16);
+                rS = GetField(word, 21);
+                uimm16 = (int)(word & 0xFFFF);
+                mnemonic = "xori";
+                operands.Add(Reg(rA));
+                operands.Add(Reg(rS));
+                operands.Add(new PpcImmediateOperand(uimm16));
+                break;
+
+            case 27: // xoris
+                rA = GetField(word, 16);
+                rS = GetField(word, 21);
+                uimm16 = (int)(word & 0xFFFF);
+                mnemonic = "xoris";
+                operands.Add(Reg(rA));
+                operands.Add(Reg(rS));
+                operands.Add(new PpcImmediateOperand(uimm16));
+                break;
+
+            case 28: // andi.
+                rA = GetField(word, 16);
+                rS = GetField(word, 21);
+                uimm16 = (int)(word & 0xFFFF);
+                mnemonic = "andi.";
+                operands.Add(Reg(rA));
+                operands.Add(Reg(rS));
+                operands.Add(new PpcImmediateOperand(uimm16));
+                isCond = true;
+                break;
+
+            case 29: // andis.
+                rA = GetField(word, 16);
+                rS = GetField(word, 21);
+                uimm16 = (int)(word & 0xFFFF);
+                mnemonic = "andis.";
+                operands.Add(Reg(rA));
+                operands.Add(Reg(rS));
+                operands.Add(new PpcImmediateOperand(uimm16));
+                isCond = true;
+                break;
+
+            case 32: // lwz
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lwz";
+                operands.Add(Reg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 33: // lwzu
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lwzu";
+                operands.Add(Reg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 34: // lbz
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lbz";
+                operands.Add(Reg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 35: // lbzu
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lbzu";
+                operands.Add(Reg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 36: // stw
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "stw";
+                operands.Add(Reg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 37: // stwu
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "stwu";
+                operands.Add(Reg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 38: // stb
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "stb";
+                operands.Add(Reg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 39: // stbu
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "stbu";
+                operands.Add(Reg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 40: // lhz
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lhz";
+                operands.Add(Reg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 41: // lhzu
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lhzu";
+                operands.Add(Reg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 42: // lha
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lha";
+                operands.Add(Reg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 43: // lhau
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lhau";
+                operands.Add(Reg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 44: // sth
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "sth";
+                operands.Add(Reg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 45: // sthu
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "sthu";
+                operands.Add(Reg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 46: // lmw
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lmw";
+                operands.Add(Reg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 47: // stmw
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "stmw";
+                operands.Add(Reg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 48: // lfs
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lfs";
+                operands.Add(FReg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 49: // lfsu
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lfsu";
+                operands.Add(FReg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 50: // lfd
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lfd";
+                operands.Add(FReg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 51: // lfdu
+                rD = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "lfdu";
+                operands.Add(FReg(rD));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 52: // stfs
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "stfs";
+                operands.Add(FReg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 53: // stfsu
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "stfsu";
+                operands.Add(FReg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 54: // stfd
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "stfd";
+                operands.Add(FReg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 55: // stfdu
+                rS = GetField(word, 21);
+                rA = GetField(word, 16);
+                mnemonic = "stfdu";
+                operands.Add(FReg(rS));
+                operands.Add(new PpcDisplacementOperand((short)(word & 0xFFFF), RegName(rA), rA));
+                break;
+
+            case 56: // psq_l
+            case 57: // psq_lu
+            case 60: // psq_st
+            case 61: // psq_stu
+                {
+                    var fr = GetField(word, 21);
+                    rA = GetField(word, 16);
+                    var w = (word >> 15) & 0x1;
+                    var quant = (word >> 12) & 0x7;
+                    var disp = SignExtend(word & 0xFFFu, 12);
+
+                    mnemonic = primary switch
+                    {
+                        56 => "psq_l",
+                        57 => "psq_lu",
+                        60 => "psq_st",
+                        61 => "psq_stu",
+                        _ => $"opc_{primary}"
+                    };
+
+                    operands.Add(FReg(fr));
+                    operands.Add(new PpcDisplacementOperand(disp, RegName(rA), rA));
+                    operands.Add(new PpcImmediateOperand((int)w));
+                    operands.Add(new PpcImmediateOperand((int)quant));
+                    break;
+                }
+
+            case 63:
+                DecodePrimary63(address, word, operands, branches, ref mnemonic, ref isReturn, ref isCall, ref isCond);
+                break;
+            case 59:
+                DecodePrimary59(address, word, operands, branches, ref mnemonic, ref isReturn, ref isCall, ref isCond);
+                break;
+            case 31:
+                DecodePrimary31(address, word, operands, branches, ref mnemonic, ref isReturn, ref isCall, ref isCond);
+                break;
+            default:
+                mnemonic = $"opc_{primary}";
+                break;
+        }
+
+        return new PpcInstruction(address, word, mnemonic, operands, branches, isReturn, isCall, isCond);
+    }
+
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcDisassembler.cs b/translator/src/Translator.Core/Disassembly/PpcDisassembler.cs
new file mode 100644
index 0000000..413db4b
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcDisassembler.cs
@@ -0,0 +1,301 @@
+using System;
+using System.Buffers;
+using System.Buffers.Binary;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Disassembly;
+
+/// <summary>
+/// Simple disassembler that walks reachable instructions using the in-process PPC decoder.
+/// Optimized for demand-driven decoding to avoid decoding unreachable instructions.
+/// </summary>
+public sealed class PpcDisassemblyLimitExceededException : InvalidOperationException
+{
+    public PpcDisassemblyLimitExceededException(
+        uint entryPoint,
+        int maxInstructions,
+        int maxBytes,
+        int decodedInstructions,
+        uint blockedAddress)
+        : base(
+            $"Disassembly budget exhausted for 0x{entryPoint:X8} after {decodedInstructions} reachable instructions; " +
+            $"next reachable address was 0x{blockedAddress:X8} (maxInstructions={maxInstructions}, maxBytes=0x{maxBytes:X}). " +
+            "Increase the disassembly budget before trusting the generated control flow.")
+    {
+        EntryPoint = entryPoint;
+        MaxInstructions = maxInstructions;
+        MaxBytes = maxBytes;
+        DecodedInstructions = decodedInstructions;
+        BlockedAddress = blockedAddress;
+    }
+
+    public uint EntryPoint { get; }
+    public int MaxInstructions { get; }
+    public int MaxBytes { get; }
+    public int DecodedInstructions { get; }
+    public uint BlockedAddress { get; }
+}
+
+/// <summary>
+/// Records every membership question asked of the known-function entry point set.
+/// A cached decode is replayable only while all of these still answer the same way.
+/// </summary>
+public sealed class BoundaryProbeLog
+{
+    private List<uint>? _absent;
+
+    /// <summary>Addresses that were asked about and were not boundaries.</summary>
+    public IReadOnlyList<uint> AbsentBoundaries => (IReadOnlyList<uint>?)_absent ?? Array.Empty<uint>();
+
+    public void RecordAbsent(uint address)
+    {
+        _absent ??= new List<uint>();
+        if (!_absent.Contains(address))
+        {
+            _absent.Add(address);
+        }
+    }
+
+    /// <summary>
+    /// True while every recorded question still has the same answer. Boundary
+    /// sets only ever grow during a run, so only the negative answers can flip.
+    /// </summary>
+    public bool IsStillValid(IReadOnlySet<uint>? knownFunctionEntryPoints)
+    {
+        if (_absent is null || knownFunctionEntryPoints is null)
+        {
+            return true;
+        }
+
+        for (var i = 0; i < _absent.Count; i++)
+        {
+            if (knownFunctionEntryPoints.Contains(_absent[i]))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}
+
+public sealed class PpcDisassembler : IDisposable
+{
+    public IReadOnlyList<PpcInstruction> DisassembleFunction(
+        ProgramImage image,
+        uint entryPoint,
+        int maxInstructions = 256,
+        int maxBytes = 0x800,
+        IReadOnlySet<uint>? knownFunctionEntryPoints = null,
+        BoundaryProbeLog? boundaryProbes = null)
+    {
+        var instructions = DisassembleFunctionCore(
+            image, entryPoint, maxInstructions, maxBytes, knownFunctionEntryPoints, boundaryProbes, throwOnBudget: true);
+        return instructions!;
+    }
+
+    /// <summary>
+    /// Budget-tolerant variant for speculative decoding (leaf inlining), where an
+    /// oversized body is a normal "not a candidate" answer, not an error to throw and swallow.
+    /// </summary>
+    public IReadOnlyList<PpcInstruction>? TryDisassembleFunction(
+        ProgramImage image,
+        uint entryPoint,
+        int maxInstructions,
+        int maxBytes,
+        IReadOnlySet<uint>? knownFunctionEntryPoints = null,
+        BoundaryProbeLog? boundaryProbes = null)
+        => DisassembleFunctionCore(
+            image, entryPoint, maxInstructions, maxBytes, knownFunctionEntryPoints, boundaryProbes, throwOnBudget: false);
+
+    private static IReadOnlyList<PpcInstruction>? DisassembleFunctionCore(
+        ProgramImage image,
+        uint entryPoint,
+        int maxInstructions,
+        int maxBytes,
+        IReadOnlySet<uint>? knownFunctionEntryPoints,
+        BoundaryProbeLog? boundaryProbes,
+        bool throwOnBudget)
+    {
+        if (!image.Contains(entryPoint, sizeof(uint)))
+        {
+            throw new ArgumentOutOfRangeException(nameof(entryPoint), $"Address 0x{entryPoint:X8} is outside the loaded RAM image.");
+        }
+        var offset = image.GetOffset(entryPoint, sizeof(uint));
+
+        var available = Math.Min(maxBytes, image.Memory.Length - offset);
+
+        // Demand-driven decoding: decode only the instructions we actually visit
+        var instructionMap = new Dictionary<uint, PpcInstruction>();
+        var reachable = new HashSet<uint>();
+        var localControlFlowTargets = new HashSet<uint>();
+        var worklist = new Queue<uint>();
+        worklist.Enqueue(entryPoint);
+
+        var endAddress = entryPoint + (uint)available;
+
+        // Ordered view used by jump-table recognition, rebuilt lazily when the decoded set grows.
+        List<PpcInstruction>? orderedCache = null;
+        Dictionary<uint, int>? indexByAddressCache = null;
+        var orderedCacheCount = -1;
+
+        while (worklist.Count > 0)
+        {
+            if (reachable.Count >= maxInstructions)
+            {
+                if (!throwOnBudget)
+                {
+                    return null;
+                }
+
+                throw new PpcDisassemblyLimitExceededException(
+                    entryPoint,
+                    maxInstructions,
+                    maxBytes,
+                    reachable.Count,
+                    worklist.Peek());
+            }
+
+            var cursor = worklist.Dequeue();
+            while (cursor >= entryPoint && cursor < endAddress)
+            {
+                if (reachable.Count >= maxInstructions)
+                {
+                    if (!throwOnBudget)
+                    {
+                        return null;
+                    }
+
+                    throw new PpcDisassemblyLimitExceededException(
+                        entryPoint,
+                        maxInstructions,
+                        maxBytes,
+                        reachable.Count,
+                        cursor);
+                }
+
+                // Decode on demand
+                if (!instructionMap.TryGetValue(cursor, out var ins))
+                {
+                    if (!image.Contains(cursor, sizeof(uint)))
+                    {
+                        break;
+                    }
+                    var cursorOffset = image.GetOffset(cursor, sizeof(uint));
+                    var word = BinaryPrimitives.ReadUInt32BigEndian(image.Memory.AsSpan(cursorOffset, 4));
+                    ins = PpcDecoder.Decode(cursor, word);
+                    instructionMap[cursor] = ins;
+                }
+
+                if (!reachable.Add(ins.Address))
+                {
+                    break;
+                }
+
+                var recognizedJumpTable = false;
+                if (ins.BranchTargets.Count == 0 && string.Equals(ins.Mnemonic, "bctr", StringComparison.OrdinalIgnoreCase))
+                {
+                    // For jump tables, we need the ordered list - build it lazily
+                    if (orderedCache is null || indexByAddressCache is null || orderedCacheCount != instructionMap.Count)
+                    {
+                        orderedCache = instructionMap.Values.OrderBy(i => i.Address).ToList();
+                        indexByAddressCache = new Dictionary<uint, int>(orderedCache.Count);
+                        for (var idx = 0; idx < orderedCache.Count; idx++)
+                        {
+                            indexByAddressCache[orderedCache[idx].Address] = idx;
+                        }
+
+                        orderedCacheCount = instructionMap.Count;
+                    }
+
+                    if (JumpTableDetector.TryRecognize(orderedCache, indexByAddressCache, ins.Address, entryPoint, endAddress, image, out var jtTargets))
+                    {
+                        ins = new PpcInstruction(ins.Address, ins.Word, ins.Mnemonic, ins.Operands, jtTargets, isReturn: false, ins.IsCall, ins.IsConditionalBranch);
+                        instructionMap[ins.Address] = ins;
+                        // Same address, so the ordered view's count is unchanged but its content is stale; drop it.
+                        orderedCache = null;
+                        indexByAddressCache = null;
+                        orderedCacheCount = -1;
+                        foreach (var target in jtTargets)
+                        {
+                            localControlFlowTargets.Add(target);
+                        }
+                        recognizedJumpTable = true;
+                    }
+                }
+
+                if (ins.IsConditionalBranch)
+                {
+                    foreach (var target in ins.BranchTargets)
+                    {
+                        localControlFlowTargets.Add(target);
+                        if (!reachable.Contains(target))
+                        {
+                            worklist.Enqueue(target);
+                        }
+                    }
+                    cursor = ins.EndAddress;
+                    continue;
+                }
+
+                if (ins.IsUnconditionalBranch)
+                {
+                    foreach (var target in ins.BranchTargets)
+                    {
+                        if ((recognizedJumpTable || !IsKnownExternalFunctionEntry(target)) && !reachable.Contains(target))
+                        {
+                            worklist.Enqueue(target);
+                        }
+                    }
+                    break; // no fallthrough
+                }
+
+                if (ins.IsReturn)
+                {
+                    break;
+                }
+
+                cursor = ins.EndAddress;
+            }
+        }
+
+        var addresses = new uint[reachable.Count];
+        reachable.CopyTo(addresses);
+        Array.Sort(addresses);
+        var ordered = new List<PpcInstruction>(addresses.Length);
+        foreach (var address in addresses)
+        {
+            ordered.Add(instructionMap[address]);
+        }
+
+        return ordered;
+
+        bool IsKnownExternalFunctionEntry(uint target)
+        {
+            if (target == entryPoint || localControlFlowTargets.Contains(target))
+            {
+                return false;
+            }
+
+            if (knownFunctionEntryPoints is null)
+            {
+                return false;
+            }
+
+            var known = knownFunctionEntryPoints.Contains(target);
+            if (!known)
+            {
+                boundaryProbes?.RecordAbsent(target);
+            }
+
+            return known;
+        }
+    }
+
+    public void Dispose()
+    {
+        // nothing to dispose currently
+    }
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcInstruction.cs b/translator/src/Translator.Core/Disassembly/PpcInstruction.cs
new file mode 100644
index 0000000..f34e2dc
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcInstruction.cs
@@ -0,0 +1,86 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace Translator.Core.Disassembly;
+
+/// <summary>
+/// Light wrapper over a decoded PowerPC instruction with semantic flags and typed operands.
+/// This type is intentionally immutable so tests can compare instances by value.
+/// </summary>
+public sealed class PpcInstruction
+{
+    public PpcInstruction(
+        uint address,
+        uint word,
+        string mnemonic,
+        IReadOnlyList<PpcOperand> operands,
+        IReadOnlyList<uint> branchTargets,
+        bool isReturn,
+        bool isCall,
+        bool isConditionalBranch)
+    {
+        Address = address;
+        Word = word;
+        Mnemonic = mnemonic;
+        Operands = operands;
+        BranchTargets = branchTargets;
+        IsReturn = isReturn;
+        IsCall = isCall;
+        IsConditionalBranch = isConditionalBranch;
+    }
+
+    public uint Address { get; }
+
+    /// <summary>
+    /// The raw big-endian instruction word, replacing the former byte array to save two
+    /// allocations per decoded instruction.
+    /// </summary>
+    public uint Word { get; }
+
+    public string Mnemonic { get; }
+    public IReadOnlyList<PpcOperand> Operands { get; }
+    public IReadOnlyList<uint> BranchTargets { get; }
+    public bool IsReturn { get; }
+    public bool IsCall { get; }
+    public bool IsConditionalBranch { get; }
+
+    public string OperandText => string.Join(", ", Operands.Select(o => o.ToOperandString()));
+
+    public uint EndAddress => checked(Address + 4u);
+
+    public bool IsUnconditionalBranch => BranchTargets.Count > 0 && !IsConditionalBranch && !IsCall && !IsReturn;
+
+    public override string ToString() => $"0x{Address:X8}: {Mnemonic} {OperandText}".Trim();
+
+    public static PpcInstruction Synthetic(
+        uint address,
+        uint opcode,
+        string mnemonic,
+        IReadOnlyList<PpcOperand> operands,
+        IReadOnlyList<uint>? branchTargets = null,
+        bool? isReturn = null,
+        bool? isCall = null,
+        bool? isConditional = null)
+    {
+        var (ret, call, cond) = InferFlags(mnemonic, isReturn, isCall, isConditional);
+        return new PpcInstruction(address, opcode, mnemonic, operands, branchTargets ?? Array.Empty<uint>(), ret, call, cond);
+    }
+
+    private static (bool ret, bool call, bool cond) InferFlags(string mnemonic, bool? retOpt, bool? callOpt, bool? condOpt)
+    {
+        if (retOpt.HasValue || callOpt.HasValue || condOpt.HasValue)
+        {
+            return (retOpt ?? false, callOpt ?? false, condOpt ?? false);
+        }
+
+        var lower = mnemonic.ToLowerInvariant();
+        var ret = lower is "bctr" or "rfi" ||
+              (lower.StartsWith("b", StringComparison.Ordinal) && lower.EndsWith("lr", StringComparison.Ordinal) &&
+               !lower.Contains("lrl", StringComparison.Ordinal));
+        var call = lower is "bl" or "bcl" or "blrl" || lower.Contains("bctrl") || lower.Contains("bclrl");
+        var cond = lower.StartsWith("bc") || lower.StartsWith("bge") || lower.StartsWith("ble") || lower.StartsWith("beq") ||
+                   lower.StartsWith("bne") || lower.StartsWith("bgt") || lower.StartsWith("blt") || lower.StartsWith("bd");
+        return (ret, call, cond);
+    }
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcOperand.cs b/translator/src/Translator.Core/Disassembly/PpcOperand.cs
new file mode 100644
index 0000000..429df2a
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcOperand.cs
@@ -0,0 +1,50 @@
+using System;
+
+namespace Translator.Core.Disassembly;
+
+/// <summary>
+/// Typed representation of a PowerPC instruction operand to avoid any string parsing in later stages.
+/// </summary>
+public abstract record PpcOperand
+{
+    public abstract string ToOperandString();
+
+    public override string ToString() => ToOperandString();
+}
+
+public sealed record PpcRegisterOperand(string Name, int Number) : PpcOperand
+{
+    public override string ToOperandString() => Name;
+}
+
+public sealed record PpcImmediateOperand(int Value, bool PreferHex = false) : PpcOperand
+{
+    public override string ToOperandString()
+    {
+        if (!PreferHex)
+        {
+            return Value.ToString();
+        }
+
+        return Value < 0 ? $"-0x{Math.Abs(Value):X}" : $"0x{Value:X}";
+    }
+}
+
+public sealed record PpcDisplacementOperand(int Offset, string BaseRegister, int BaseRegisterNumber) : PpcOperand
+{
+    public override string ToOperandString()
+    {
+        var text = Offset == 0 ? "0" : (Offset < 0 ? $"-0x{Math.Abs(Offset):X}" : $"0x{Offset:X}");
+        return $"{text}({BaseRegister})";
+    }
+}
+
+public sealed record PpcBranchTargetOperand(uint TargetAddress) : PpcOperand
+{
+    public override string ToOperandString() => $"0x{TargetAddress:X8}";
+}
+
+public sealed record PpcConditionRegisterOperand(string Name, int BitIndex) : PpcOperand
+{
+    public override string ToOperandString() => Name;
+}
diff --git a/translator/src/Translator.Core/Disassembly/PpcWordAnalysis.cs b/translator/src/Translator.Core/Disassembly/PpcWordAnalysis.cs
new file mode 100644
index 0000000..c8487e0
--- /dev/null
+++ b/translator/src/Translator.Core/Disassembly/PpcWordAnalysis.cs
@@ -0,0 +1,285 @@
+namespace Translator.Core.Disassembly;
+
+/// <summary>
+/// Allocation-free view of the fixed fields shared by the raw PowerPC instruction scanners.
+/// Not a second semantic decoder: callers still decide which fields matter for a given opcode.
+/// </summary>
+internal readonly struct PpcWordFields
+{
+    private readonly uint Word;
+
+    public PpcWordFields(uint word) => Word = word;
+
+    /// <summary>
+    /// The big-endian instruction word at <paramref name="offset"/>. Three raw
+    /// scanners carried a byte-identical private copy of this one-liner.
+    /// </summary>
+    public static uint ReadBigEndianWord(byte[] data, int offset) =>
+        System.Buffers.Binary.BinaryPrimitives.ReadUInt32BigEndian(data.AsSpan(offset, 4));
+
+    public int PrimaryOpcode => (int)((Word >> 26) & 0x3Fu);
+
+    /// <summary>Bits 21-25, named RS/RT depending on the instruction form.</summary>
+    public int GprField0 => (int)((Word >> 21) & 0x1Fu);
+
+    /// <summary>Bits 16-20, normally RA.</summary>
+    public int GprField1 => (int)((Word >> 16) & 0x1Fu);
+
+    /// <summary>Bits 11-15, normally RB.</summary>
+    public int GprField2 => (int)((Word >> 11) & 0x1Fu);
+
+    public int ExtendedOpcode => (int)((Word >> 1) & 0x3FFu);
+
+    /// <summary>
+    /// The split SPR field used by mfspr/mtspr. The low five SPR bits are in
+    /// bits 16-20 and the high five bits are in bits 11-15.
+    /// </summary>
+    public int Spr => (int)(((Word >> 16) & 0x1Fu) | ((Word >> 6) & 0x3E0u));
+
+    public short SignedImmediate16 => unchecked((short)(Word & 0xFFFFu));
+
+    public uint UnsignedImmediate16 => Word & 0xFFFFu;
+
+}
+
+/// <summary>
+/// Small raw-word recognizers shared by module and patch scanners, ordered by the names in
+/// each instruction form rather than the decoder's alias-oriented operand list.
+/// </summary>
+internal static class PpcInstructionPatterns
+{
+    public static bool TryGetLis(uint word, out int destination, out uint highImmediate)
+    {
+        var fields = new PpcWordFields(word);
+        if (fields.PrimaryOpcode == 15 && fields.GprField1 == 0)
+        {
+            destination = fields.GprField0;
+            highImmediate = fields.UnsignedImmediate16;
+            return true;
+        }
+
+        destination = 0;
+        highImmediate = 0;
+        return false;
+    }
+
+    public static bool TryGetAddi(uint word, out int destination, out int source, out int immediate)
+    {
+        var fields = new PpcWordFields(word);
+        if (fields.PrimaryOpcode == 14)
+        {
+            destination = fields.GprField0;
+            source = fields.GprField1;
+            immediate = fields.SignedImmediate16;
+            return true;
+        }
+
+        destination = 0;
+        source = 0;
+        immediate = 0;
+        return false;
+    }
+
+    public static bool TryGetOri(uint word, out int source, out int destination, out uint immediate) =>
+        TryGetLogicalImmediate(word, 24, out source, out destination, out immediate);
+
+    public static bool TryGetOris(uint word, out int source, out int destination, out uint immediate) =>
+        TryGetLogicalImmediate(word, 25, out source, out destination, out immediate);
+
+    private static bool TryGetLogicalImmediate(
+        uint word,
+        int opcode,
+        out int source,
+        out int destination,
+        out uint immediate)
+    {
+        var fields = new PpcWordFields(word);
+        if (fields.PrimaryOpcode == opcode)
+        {
+            source = fields.GprField0;
+            destination = fields.GprField1;
+            immediate = fields.UnsignedImmediate16;
+            return true;
+        }
+
+        source = 0;
+        destination = 0;
+        immediate = 0;
+        return false;
+    }
+
+    public static bool TryGetOr(uint word, out int source, out int destination, out int otherSource)
+    {
+        var fields = new PpcWordFields(word);
+        if (fields.PrimaryOpcode == 31 && fields.ExtendedOpcode == 444)
+        {
+            source = fields.GprField0;
+            destination = fields.GprField1;
+            otherSource = fields.GprField2;
+            return true;
+        }
+
+        source = 0;
+        destination = 0;
+        otherSource = 0;
+        return false;
+    }
+
+    public static bool TryGetRlwinm(
+        uint word,
+        out int source,
+        out int destination,
+        out int shift,
+        out int maskBegin,
+        out int maskEnd)
+    {
+        var fields = new PpcWordFields(word);
+        if (fields.PrimaryOpcode == 21)
+        {
+            source = fields.GprField0;
+            destination = fields.GprField1;
+            shift = fields.GprField2;
+            maskBegin = (int)((word >> 6) & 0x1Fu);
+            maskEnd = (int)((word >> 1) & 0x1Fu);
+            return true;
+        }
+
+        source = 0;
+        destination = 0;
+        shift = 0;
+        maskBegin = 0;
+        maskEnd = 0;
+        return false;
+    }
+
+    public static bool TryGetMtspr(uint word, int expectedSpr, out int source)
+    {
+        var fields = new PpcWordFields(word);
+        if (fields.PrimaryOpcode == 31 &&
+            fields.ExtendedOpcode == 467 &&
+            fields.Spr == expectedSpr)
+        {
+            source = fields.GprField0;
+            return true;
+        }
+
+        source = 0;
+        return false;
+    }
+}
+
+/// <summary>
+/// Branch recognizers for raw image scanners. Separate linked/unlinked forms preserve the
+/// b/bl distinction and avoid accepting absolute or indirect branches.
+/// </summary>
+internal static class PpcControlFlow
+{
+    private const uint RelativeBranchMask = 0xFC000003u;
+    private const uint RelativeBranch = 0x48000000u;
+    private const uint RelativeBranchLink = 0x48000001u;
+
+    public static bool IsRelativeUnlinkedBranch(uint word) =>
+        (word & RelativeBranchMask) == RelativeBranch;
+
+    public static bool IsRelativeLinkedBranch(uint word) =>
+        (word & RelativeBranchMask) == RelativeBranchLink;
+
+    public static bool TryDecodeRelativeBranchTarget(uint address, uint word, out uint target)
+    {
+        if (!IsRelativeUnlinkedBranch(word))
+        {
+            target = 0;
+            return false;
+        }
+
+        target = DecodeRelative24Target(address, word);
+        return true;
+    }
+
+    public static bool TryDecodeRelativeBranchLinkTarget(uint address, uint word, out uint target)
+    {
+        if (!IsRelativeLinkedBranch(word))
+        {
+            target = 0;
+            return false;
+        }
+
+        target = DecodeRelative24Target(address, word);
+        return true;
+    }
+
+    public static bool TryDecodeConditionalRelativeBranchTarget(uint address, uint word, out uint target)
+    {
+        var fields = new PpcWordFields(word);
+        if (fields.PrimaryOpcode != 16 || (word & 0x2u) != 0)
+        {
+            target = 0;
+            return false;
+        }
+
+        var offset = word & 0xFFFCu;
+        if ((offset & 0x8000u) != 0)
+        {
+            offset |= 0xFFFF0000u;
+        }
+
+        target = unchecked((uint)((int)address + (int)offset));
+        return true;
+    }
+
+    public static bool MayChangeControlFlow(uint word) =>
+        new PpcWordFields(word).PrimaryOpcode is 16 or 18 or 19;
+
+    public static bool IsReturn(uint word) => word == 0x4E800020u;
+
+    public static bool IsBctr(uint word) => word == 0x4E800420u;
+
+    private static uint DecodeRelative24Target(uint address, uint word)
+    {
+        var offset = word & 0x03FFFFFCu;
+        if ((offset & 0x02000000u) != 0)
+        {
+            offset |= 0xFC000000u;
+        }
+
+        return unchecked((uint)((int)address + (int)offset));
+    }
+}
+
+/// <summary>
+/// One conservative "which GPR can this raw word clobber" policy, shared by every raw scanner tracking
+/// a register across straight-line code. <c>ori</c>/<c>rlwinm</c>/<c>andi.</c> write RA (bits 16-20),
+/// not RS; every arm over-approximates on purpose, since "no" wrongly emits a patch at the wrong address.
+/// </summary>
+internal static class PpcRegisterEffects
+{
+    /// <summary>
+    /// True when this word can write <paramref name="register"/>. FPR/CR/memory destinations
+    /// answer false for every GPR, except update forms which also write back to RA.
+    /// </summary>
+    public static bool MayWriteGpr(uint word, int register)
+    {
+        var fields = new PpcWordFields(word);
+        var rt = fields.GprField0;
+        var ra = fields.GprField1;
+        return fields.PrimaryOpcode switch
+        {
+            // D-form arithmetic and plain loads: destination is RT.
+            7 or 8 or 12 or 13 or 14 or 15 or 32 or 34 or 40 or 42 => rt == register,
+            // Load with update: RT and the RA base are both written.
+            33 or 35 or 41 or 43 => rt == register || ra == register,
+            // D-form logical and rotate: destination is RA, not RS.
+            20 or 21 or 23 or 24 or 25 or 26 or 27 or 28 or 29 => ra == register,
+            // X-form: not worth splitting by sub-opcode, so treat RT or RA as clobbered.
+            31 => rt == register || ra == register,
+            // Store with update writes the RA base back.
+            37 or 39 or 45 => ra == register,
+            // lmw loads RT through r31.
+            46 => register >= rt,
+            // Float load/store with update writes the RA base back; the value
+            // register is an FPR.
+            49 or 51 or 53 or 55 or 57 or 61 => ra == register,
+            _ => false
+        };
+    }
+}
diff --git a/translator/src/Translator.Core/GeneratedMarkers.cs b/translator/src/Translator.Core/GeneratedMarkers.cs
new file mode 100644
index 0000000..6ce362d
--- /dev/null
+++ b/translator/src/Translator.Core/GeneratedMarkers.cs
@@ -0,0 +1,119 @@
+using System.Text.RegularExpressions;
+using Translator.Core.Analysis;
+
+namespace Translator.Core;
+
+/// <summary>
+/// The one definition of every marker the translator writes into generated C++ and every macro
+/// spelling it reads back out of hand-written runtime C++. Emitter and parsers share these members
+/// so copies can't drift the way hand-duplicated literals once did, silently dropping a registration.
+/// </summary>
+public static partial class GeneratedMarkers
+{
+    // ---------------------------------------------------------------------
+    // Markers emitted into generated C++ (see CxxLinearCodeGenerator).
+    // ---------------------------------------------------------------------
+
+    /// <summary>The guest ABI contract line, without its comment prefix.</summary>
+    public static string GuestAbi(GuestAbiContract contract) =>
+        $"RECOMP_GUEST_ABI gpr_read=0x{contract.GprReadBeforeWriteMask:X8} " +
+        $"gpr_write=0x{contract.GprPossibleWriteMask:X8} " +
+        $"gpr_return=0x{contract.GprReturnMask:X8} " +
+        $"fpr_read=0x{contract.FprReadBeforeWriteMask:X8} " +
+        $"fpr_write=0x{contract.FprPossibleWriteMask:X8} " +
+        $"fpr_return=0x{contract.FprReturnMask:X8} " +
+        $"cr_read=0x{contract.CrReadBeforeWriteMask:X2} " +
+        $"cr_write=0x{contract.CrPossibleWriteMask:X2} " +
+        $"xer_read={(contract.ReadsXerBeforeWrite ? 1 : 0)} " +
+        $"xer_write={(contract.MayWriteXer ? 1 : 0)} " +
+        $"fence={(contract.HasFullSynchronizationFence ? 1 : 0)}";
+
+    /// <summary>The registration facts of a base-translation function.</summary>
+    public static string BaseRegistration(
+        uint entryPoint,
+        string symbol,
+        bool preservesNonvolatileFprs,
+        uint nonvolatileFprWriteMask) =>
+        $"// RECOMP_REGISTRATION base 0x{entryPoint:X8} {symbol} " +
+        $"preserves={Bool(preservesNonvolatileFprs)} fpr_mask=0x{nonvolatileFprWriteMask:X8}";
+
+    /// <summary>
+    /// The registration facts of a mod overlay function. <paramref name="prettyName"/>
+    /// is already escaped for a C++ string literal by the caller.
+    /// </summary>
+    public static string ModRegistration(
+        uint entryPoint,
+        string symbol,
+        string prettyName,
+        bool preservesNonvolatileFprs,
+        uint nonvolatileFprWriteMask,
+        uint priority,
+        ulong moduleId) =>
+        $"// RECOMP_REGISTRATION mod 0x{entryPoint:X8} {symbol} \"{prettyName}\" " +
+        $"preserves={Bool(preservesNonvolatileFprs)} fpr_mask=0x{nonvolatileFprWriteMask:X8} " +
+        $"priority={priority} module_id={moduleId}";
+
+    private static string Bool(bool value) => value ? "true" : "false";
+
+    [GeneratedRegex(@"RECOMP_GUEST_ABI gpr_read=0x(?<gr>[0-9A-Fa-f]{8}) gpr_write=0x(?<gw>[0-9A-Fa-f]{8}) gpr_return=0x(?<gret>[0-9A-Fa-f]{8}) fpr_read=0x(?<fr>[0-9A-Fa-f]{8}) fpr_write=0x(?<fw>[0-9A-Fa-f]{8}) fpr_return=0x(?<fret>[0-9A-Fa-f]{8}) cr_read=0x(?<crr>[0-9A-Fa-f]{2}) cr_write=0x(?<crw>[0-9A-Fa-f]{2}) xer_read=(?<xr>[01]) xer_write=(?<xw>[01]) fence=(?<fence>[01])", RegexOptions.CultureInvariant)]
+    public static partial Regex GuestAbiPattern();
+
+    [GeneratedRegex(@"// RECOMP_REGISTRATION base 0x(?<address>[0-9A-Fa-f]{8}) (?<symbol>[A-Za-z_][A-Za-z0-9_]*) preserves=(?<preserves>true|false) fpr_mask=0x(?<mask>[0-9A-Fa-f]+)", RegexOptions.CultureInvariant)]
+    public static partial Regex BaseRegistrationPattern();
+
+    /// <summary>
+    /// Every group the emitter writes, module id included. A copy of this pattern
+    /// used to stop at the priority field, so the resolved dispatch profile and
+    /// the shard emitter disagreed about what a well-formed marker even was.
+    /// </summary>
+    [GeneratedRegex("""// RECOMP_REGISTRATION mod 0x(?<address>[0-9A-Fa-f]{8}) (?<symbol>[A-Za-z_][A-Za-z0-9_]*) "(?<name>[^"]*)" preserves=(?<preserves>true|false) fpr_mask=0x(?<mask>[0-9A-Fa-f]+) priority=(?<priority>[0-9]+) module_id=(?<moduleId>[0-9]+)""", RegexOptions.CultureInvariant)]
+    public static partial Regex ModRegistrationPattern();
+
+    /// <summary>
+    /// Matches a whole registration marker line. The marker is translator-internal
+    /// metadata: a compiled shard has no use for it, so it is dropped rather than
+    /// carried into tens of thousands of lines of shard text.
+    /// </summary>
+    [GeneratedRegex(@"^// RECOMP_REGISTRATION [^\r\n]*\r?\n?", RegexOptions.Multiline | RegexOptions.CultureInvariant)]
+    public static partial Regex RegistrationLinePattern();
+
+    // ---------------------------------------------------------------------
+    // Registration macros in hand-written runtime C++.
+    // ---------------------------------------------------------------------
+
+    /// <summary>
+    /// <c>REGISTER_NATIVE_FUNCTION(0x…, symbol)</c> and its <c>_AS</c> alias form;
+    /// the <c>as</c> group tells the two apart.
+    /// </summary>
+    [GeneratedRegex(@"REGISTER_NATIVE_FUNCTION(?<as>_AS)?\s*\(\s*0x(?<address>[0-9A-Fa-f]{8})\s*,\s*(?<symbol>[A-Za-z_][A-Za-z0-9_]*)", RegexOptions.CultureInvariant)]
+    public static partial Regex NativeFunctionRegistrationPattern();
+
+    [GeneratedRegex(@"REGISTER_TRANSLATED_FUNCTION\s*\(\s*0x(?<address>[0-9A-Fa-f]{8})\s*,\s*(?<symbol>[A-Za-z_][A-Za-z0-9_]*)", RegexOptions.CultureInvariant)]
+    public static partial Regex TranslatedFunctionRegistrationPattern();
+
+    /// <summary>
+    /// The registration half of <c>PPC_NATIVE_OVERRIDE</c>: address and symbol
+    /// only. Deliberately a prefix match, so an override whose argument list
+    /// contains a semicolon still registers.
+    /// </summary>
+    [GeneratedRegex(@"PPC_NATIVE_OVERRIDE(?:_VOID)?\s*\(\s*(?<address>[0-9A-Fa-f]{8})\s*,\s*(?<symbol>[A-Za-z_][A-Za-z0-9_]*)", RegexOptions.CultureInvariant)]
+    public static partial Regex NativeOverridePattern();
+
+    /// <summary>
+    /// The same macro read for its signature rather than its registration: the
+    /// effect analyzer needs the argument list, which only the full
+    /// statement-terminated form can capture.
+    /// </summary>
+    [GeneratedRegex(@"PPC_NATIVE_OVERRIDE(?<void>_VOID)?\s*\(\s*(?<address>[0-9A-Fa-f]{8})\s*,\s*(?<symbol>[A-Za-z_][A-Za-z0-9_]*)\s*,?\s*(?<tail>[^;]*?)\);", RegexOptions.CultureInvariant | RegexOptions.Singleline)]
+    public static partial Regex NativeOverrideSignaturePattern();
+
+    /// <summary>
+    /// The void-stub form read for its declared host parameter list, which is
+    /// what the void-stub ABI provider infers argument registers from.
+    /// </summary>
+    [GeneratedRegex(@"PPC_NATIVE_OVERRIDE_VOID\s*\(\s*(?<addr>[0-9A-Fa-f]+)\s*,\s*[^,]+,\s*\((?<args>[^)]*)\)\s*,", RegexOptions.CultureInvariant | RegexOptions.Singleline)]
+    public static partial Regex NativeOverrideVoidArgumentsPattern();
+
+    [GeneratedRegex(@"GX_FATAL_STUB\s*\(\s*(?<address>[0-9A-Fa-f]{8})", RegexOptions.CultureInvariant)]
+    public static partial Regex FatalStubPattern();
+}
diff --git a/translator/src/Translator.Core/GuestTargetParser.cs b/translator/src/Translator.Core/GuestTargetParser.cs
new file mode 100644
index 0000000..ade153d
--- /dev/null
+++ b/translator/src/Translator.Core/GuestTargetParser.cs
@@ -0,0 +1,80 @@
+using System;
+using System.Globalization;
+
+namespace Translator.Core;
+
+/// <summary>
+/// The one place guest addresses are parsed out of text. Every spelling must be culture-invariant;
+/// a culture-sensitive parse is what broke translation under tr-TR once already.
+/// </summary>
+public static class GuestTargetParser
+{
+    /// <summary>
+    /// An IR call/jump target: <c>0x8000ABCD</c> or <c>func_8000ABCD</c>.
+    /// Anything else - a runtime helper name, a native symbol - is deliberately
+    /// not an address.
+    /// </summary>
+    public static bool TryParseAddress(string target, out uint address)
+    {
+        address = 0;
+        if (string.IsNullOrWhiteSpace(target)) return false;
+
+        var trimmed = target.Trim();
+        var hex = trimmed.StartsWith("0x", StringComparison.OrdinalIgnoreCase)
+            ? trimmed.AsSpan(2)
+            : trimmed.StartsWith("func_", StringComparison.OrdinalIgnoreCase)
+                ? trimmed.AsSpan(5)
+                : default;
+        return !hex.IsEmpty && TryParseHexDigits(hex, out address);
+    }
+
+    /// <summary>
+    /// As <see cref="TryParseAddress"/>, but a target with neither prefix is read as a bare decimal,
+    /// for the GQR propagation pass's synthetic edges spelled as plain numbers.
+    /// </summary>
+    public static bool TryParseAddressOrDecimal(string target, out uint address) =>
+        TryParseAddress(target, out address) ||
+        uint.TryParse(target, NumberStyles.Integer, CultureInfo.InvariantCulture, out address);
+
+    /// <summary>
+    /// A hexadecimal guest address whose <c>0x</c> prefix is optional: the
+    /// spelling used by CLI options, generated file names, marker groups and
+    /// JSON records.
+    /// </summary>
+    public static bool TryParseHexAddress(string text, out uint address)
+    {
+        address = 0;
+        if (string.IsNullOrWhiteSpace(text)) return false;
+
+        var hex = text.AsSpan().Trim();
+        if (hex.StartsWith("0x", StringComparison.OrdinalIgnoreCase)) hex = hex[2..];
+        return TryParseHexDigits(hex, out address);
+    }
+
+    /// <summary>Throwing form of <see cref="TryParseHexAddress"/>, for command-line arguments.</summary>
+    public static uint ParseHexAddress(string text) =>
+        TryParseHexAddress(text, out var address)
+            ? address
+            : throw new FormatException($"'{text}' is not a hexadecimal guest address.");
+
+    /// <summary>
+    /// A generated local-label name: <c>loc_8000ABCD</c>, or the raw
+    /// <c>0x8000ABCD</c> spelling the emitter uses before a label is named.
+    /// Returns null for any other identifier.
+    /// </summary>
+    public static uint? TryParseLocalLabelAddress(string label)
+    {
+        if (string.IsNullOrWhiteSpace(label)) return null;
+
+        var trimmed = label.Trim();
+        var hex = trimmed.StartsWith("0x", StringComparison.OrdinalIgnoreCase)
+            ? trimmed.AsSpan(2)
+            : trimmed.StartsWith("loc_", StringComparison.OrdinalIgnoreCase)
+                ? trimmed.AsSpan(4)
+                : default;
+        return !hex.IsEmpty && TryParseHexDigits(hex, out var address) ? address : null;
+    }
+
+    private static bool TryParseHexDigits(ReadOnlySpan<char> hex, out uint address) =>
+        uint.TryParse(hex, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out address);
+}
diff --git a/translator/src/Translator.Core/IO/AssemblyBlobWriter.cs b/translator/src/Translator.Core/IO/AssemblyBlobWriter.cs
new file mode 100644
index 0000000..2b515dc
--- /dev/null
+++ b/translator/src/Translator.Core/IO/AssemblyBlobWriter.cs
@@ -0,0 +1,51 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+using Translator.Core.Loading;
+
+namespace Translator.Core.IO;
+
+internal sealed record AssemblyBlob(string FileName, string Symbol, ReadOnlyMemory<byte> Data, string Comment);
+
+internal static class AssemblyBlobWriter
+{
+    public static void Write(
+        string assemblyPath,
+        string blobDirectory,
+        string blobReferenceDirectory,
+        IReadOnlyList<AssemblyBlob> blobs,
+        params string[] headerLines)
+    {
+        Directory.CreateDirectory(blobDirectory);
+        var expectedFiles = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var assembly = new StringBuilder();
+        foreach (var header in headerLines) assembly.AppendLine(header);
+        assembly.AppendLine(".section .rdata,\"dr\"");
+        assembly.AppendLine();
+
+        foreach (var blob in blobs)
+        {
+            var blobPath = Path.Combine(blobDirectory, blob.FileName);
+            expectedFiles.Add(Path.GetFullPath(blobPath));
+            FileOutput.WriteBytesIfChanged(blobPath, blob.Data.Span);
+            var hash = ChecksumUtilities.Sha256Hex(blob.Data.Span);
+            assembly.AppendLine($"// {blob.Comment}; sha256={hash}");
+            assembly.AppendLine(".p2align 4");
+            assembly.AppendLine($".globl {blob.Symbol}");
+            assembly.AppendLine($"{blob.Symbol}:");
+            var referencePath = Path.Combine(blobReferenceDirectory, blob.FileName);
+            assembly.AppendLine($".incbin \"{SanitizeAssemblyPath(referencePath)}\"");
+            assembly.AppendLine();
+        }
+
+        foreach (var stalePath in Directory.EnumerateFiles(blobDirectory, "*.bin"))
+        {
+            if (!expectedFiles.Contains(Path.GetFullPath(stalePath))) File.Delete(stalePath);
+        }
+        FileOutput.WriteTextIfChanged(assemblyPath, assembly.ToString());
+    }
+
+    private static string SanitizeAssemblyPath(string path) => Path.GetFullPath(path).Replace('\\', '/');
+}
diff --git a/translator/src/Translator.Core/IO/BigEndianBinaryReader.cs b/translator/src/Translator.Core/IO/BigEndianBinaryReader.cs
new file mode 100644
index 0000000..16606ec
--- /dev/null
+++ b/translator/src/Translator.Core/IO/BigEndianBinaryReader.cs
@@ -0,0 +1,59 @@
+using System.Buffers.Binary;
+using System.Text;
+
+namespace Translator.Core.IO;
+
+internal sealed class BigEndianBinaryReader : IDisposable
+{
+    private readonly BinaryReader _reader;
+
+    public BigEndianBinaryReader(Stream stream, bool leaveOpen = false)
+    {
+        _reader = new BinaryReader(stream, Encoding.ASCII, leaveOpen);
+    }
+
+    public long Position => _reader.BaseStream.Position;
+
+    public void Seek(long offset, SeekOrigin origin) => _reader.BaseStream.Seek(offset, origin);
+
+    public byte ReadByte() => _reader.ReadByte();
+
+    public ushort ReadUInt16()
+    {
+        Span<byte> buffer = stackalloc byte[2];
+        EnsureRead(buffer);
+        return BinaryPrimitives.ReadUInt16BigEndian(buffer);
+    }
+
+    public uint ReadUInt32()
+    {
+        Span<byte> buffer = stackalloc byte[4];
+        EnsureRead(buffer);
+        return BinaryPrimitives.ReadUInt32BigEndian(buffer);
+    }
+
+    public byte[] ReadBytes(int count)
+    {
+        ArgumentOutOfRangeException.ThrowIfNegative(count);
+        var data = new byte[count];
+        EnsureRead(data);
+        return data;
+    }
+
+    private void EnsureRead(Span<byte> destination)
+    {
+        var start = Position;
+        try
+        {
+            _reader.BaseStream.ReadExactly(destination);
+        }
+        catch (EndOfStreamException exception)
+        {
+            throw new EndOfStreamException(
+                $"Expected {destination.Length} bytes at 0x{start:X}, but the stream ended early.",
+                exception);
+        }
+    }
+
+    public void Dispose() => _reader.Dispose();
+}
diff --git a/translator/src/Translator.Core/IO/FileOutput.cs b/translator/src/Translator.Core/IO/FileOutput.cs
new file mode 100644
index 0000000..4746d6b
--- /dev/null
+++ b/translator/src/Translator.Core/IO/FileOutput.cs
@@ -0,0 +1,99 @@
+using System;
+using System.Buffers;
+using System.IO;
+using System.Text;
+
+namespace Translator.Core.IO;
+
+/// <summary>
+/// The one generated-file writer. Every write is content-gated (so an unchanged
+/// file keeps its modification time and Ninja does not rebuild the world) and
+/// atomic (so an interrupted run never leaves a truncated artifact behind).
+/// </summary>
+public static class FileOutput
+{
+    private const int CompareBufferSize = 128 * 1024;
+
+    public static bool WriteTextIfChanged(string path, string content) =>
+        WriteBytesIfChanged(path, Encoding.UTF8.GetBytes(content));
+
+    public static bool WriteBytesIfChanged(string path, ReadOnlySpan<byte> content)
+    {
+        var fullPath = Path.GetFullPath(path);
+        if (ContentEquals(fullPath, content)) return false;
+        Directory.CreateDirectory(Path.GetDirectoryName(fullPath)!);
+        var temporary = $"{fullPath}.tmp.{Guid.NewGuid():N}";
+        using (var stream = new FileStream(
+                   temporary, FileMode.CreateNew, FileAccess.Write, FileShare.None, CompareBufferSize))
+        {
+            stream.Write(content);
+        }
+        File.Move(temporary, fullPath, overwrite: true);
+        return true;
+    }
+
+    /// <summary>
+    /// Byte-compares an existing file against in-memory content without materializing it, since
+    /// generated payloads are hundreds of megabytes in aggregate.
+    /// </summary>
+    public static bool ContentEquals(string path, ReadOnlySpan<byte> content)
+    {
+        var info = new FileInfo(path);
+        if (!info.Exists || info.Length != content.Length) return false;
+
+        using var stream = new FileStream(
+            path, FileMode.Open, FileAccess.Read, FileShare.Read, CompareBufferSize, FileOptions.SequentialScan);
+        var buffer = ArrayPool<byte>.Shared.Rent(CompareBufferSize);
+        try
+        {
+            var offset = 0;
+            while (offset < content.Length)
+            {
+                var read = stream.Read(buffer, 0, Math.Min(buffer.Length, content.Length - offset));
+                if (read <= 0) return false;
+                if (!buffer.AsSpan(0, read).SequenceEqual(content.Slice(offset, read))) return false;
+                offset += read;
+            }
+            return true;
+        }
+        finally
+        {
+            ArrayPool<byte>.Shared.Return(buffer);
+        }
+    }
+
+    /// <summary>
+    /// Byte-compares two files with the same streamed, pooled-buffer strategy as
+    /// <see cref="ContentEquals"/>, so publication and gating agree on what
+    /// "identical" means and neither materialises a large generated file.
+    /// </summary>
+    public static bool FilesEqual(string left, string right)
+    {
+        var leftInfo = new FileInfo(left);
+        var rightInfo = new FileInfo(right);
+        if (leftInfo.Length != rightInfo.Length) return false;
+
+        using var leftStream = new FileStream(
+            left, FileMode.Open, FileAccess.Read, FileShare.Read, CompareBufferSize, FileOptions.SequentialScan);
+        using var rightStream = new FileStream(
+            right, FileMode.Open, FileAccess.Read, FileShare.Read, CompareBufferSize, FileOptions.SequentialScan);
+        var leftBuffer = ArrayPool<byte>.Shared.Rent(CompareBufferSize);
+        var rightBuffer = ArrayPool<byte>.Shared.Rent(CompareBufferSize);
+        try
+        {
+            while (true)
+            {
+                var leftRead = leftStream.Read(leftBuffer, 0, CompareBufferSize);
+                var rightRead = rightStream.Read(rightBuffer, 0, CompareBufferSize);
+                if (leftRead != rightRead) return false;
+                if (leftRead == 0) return true;
+                if (!leftBuffer.AsSpan(0, leftRead).SequenceEqual(rightBuffer.AsSpan(0, rightRead))) return false;
+            }
+        }
+        finally
+        {
+            ArrayPool<byte>.Shared.Return(leftBuffer);
+            ArrayPool<byte>.Shared.Return(rightBuffer);
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/IO/JsonOutput.cs b/translator/src/Translator.Core/IO/JsonOutput.cs
new file mode 100644
index 0000000..ed7b128
--- /dev/null
+++ b/translator/src/Translator.Core/IO/JsonOutput.cs
@@ -0,0 +1,39 @@
+using System;
+using System.Text;
+using System.Text.Json;
+
+namespace Translator.Core.IO;
+
+/// <summary>
+/// The one JSON artifact writer and the only serializer options the translator owns.
+/// Publishes through <see cref="FileOutput.WriteBytesIfChanged"/>, so writes are content-gated and atomic.
+/// </summary>
+public static class JsonOutput
+{
+    /// <summary>
+    /// Machine-read documents. Indentation only inflates files that already
+    /// measure tens of megabytes and that no human opens.
+    /// </summary>
+    public static readonly JsonSerializerOptions Compact = new() { WriteIndented = false };
+
+    /// <summary>Machine-read documents whose schema is spelled in camelCase.</summary>
+    public static readonly JsonSerializerOptions CompactCamelCase = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        WriteIndented = false
+    };
+
+    /// <summary>Documents small enough - and read by people often enough - to indent.</summary>
+    public static readonly JsonSerializerOptions Indented = new() { WriteIndented = true };
+
+    private static readonly byte[] TrailingNewLine = Encoding.UTF8.GetBytes(Environment.NewLine);
+
+    public static bool WriteIfChanged<T>(string path, T value, JsonSerializerOptions options)
+    {
+        var json = JsonSerializer.SerializeToUtf8Bytes(value, options);
+        var content = new byte[json.Length + TrailingNewLine.Length];
+        json.CopyTo(content, 0);
+        TrailingNewLine.CopyTo(content, json.Length);
+        return FileOutput.WriteBytesIfChanged(path, content);
+    }
+}
diff --git a/translator/src/Translator.Core/IO/TransactionalDirectoryOutput.cs b/translator/src/Translator.Core/IO/TransactionalDirectoryOutput.cs
new file mode 100644
index 0000000..b0d4d64
--- /dev/null
+++ b/translator/src/Translator.Core/IO/TransactionalDirectoryOutput.cs
@@ -0,0 +1,196 @@
+namespace Translator.Core.IO;
+
+/// <summary>
+/// Generates a complete directory tree away from the live output and publishes it only
+/// after the producer succeeds. Byte-identical files retain their live last-write time so
+/// incremental build systems do not rebuild unchanged generated sources.
+/// </summary>
+public static class TransactionalDirectoryOutput
+{
+    private const int FileSystemRetryCount = 8;
+
+    public sealed record PublishResult(
+        int AddedFiles,
+        int UpdatedFiles,
+        int RemovedFiles,
+        int UnchangedFiles);
+
+    /// <summary>
+    /// The producer's exit code, the publication counts when one happened, and any
+    /// non-fatal cleanup warnings. Warnings are returned rather than printed: this
+    /// is Core, and only the CLI writes to the console.
+    /// </summary>
+    public sealed record GenerateAndPublishResult(
+        int ExitCode,
+        PublishResult? Publication,
+        IReadOnlyList<string> Warnings);
+
+    public static GenerateAndPublishResult GenerateAndPublish(
+        string destinationDirectory,
+        Func<string, int> producer,
+        Action<string, int>? onProducerFailure = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(destinationDirectory);
+        ArgumentNullException.ThrowIfNull(producer);
+
+        var destination = Path.GetFullPath(destinationDirectory);
+        var parent = Directory.GetParent(destination)?.FullName
+            ?? throw new InvalidOperationException($"Output directory has no parent: {destination}");
+        Directory.CreateDirectory(parent);
+
+        var leaf = Path.GetFileName(destination.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar));
+        var staging = Path.Combine(parent, $".{leaf}.translate-mod-staging-{Guid.NewGuid():N}");
+        // The same list instance is handed to the result record, so warnings the
+        // staging cleanup below adds still reach the caller.
+        var warnings = new List<string>();
+        Directory.CreateDirectory(staging);
+
+        try
+        {
+            var producerResult = producer(staging);
+            if (producerResult != 0)
+            {
+                onProducerFailure?.Invoke(staging, producerResult);
+                return new GenerateAndPublishResult(producerResult, null, warnings);
+            }
+
+            return new GenerateAndPublishResult(0, Publish(staging, destination, warnings), warnings);
+        }
+        finally
+        {
+            if (Directory.Exists(staging))
+            {
+                TryDeleteDirectory(staging, "staging output", warnings);
+            }
+        }
+    }
+
+    private static PublishResult Publish(string staging, string destination, List<string> warnings)
+    {
+        var stagedFiles = EnumerateRelativeFiles(staging);
+        var liveFiles = Directory.Exists(destination)
+            ? EnumerateRelativeFiles(destination)
+            : new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+
+        var added = 0;
+        var updated = 0;
+        var unchanged = 0;
+        foreach (var (relativePath, stagedPath) in stagedFiles)
+        {
+            if (!liveFiles.TryGetValue(relativePath, out var livePath))
+            {
+                added++;
+                continue;
+            }
+
+            if (!FilesEqual(stagedPath, livePath))
+            {
+                updated++;
+                continue;
+            }
+
+            // Ninja/MSBuild use last-write time to determine whether generated C++ must
+            // be rebuilt. The clean stage is authoritative for membership, while the live
+            // tree is authoritative for the timestamp of identical content.
+            File.SetLastWriteTimeUtc(stagedPath, File.GetLastWriteTimeUtc(livePath));
+            unchanged++;
+        }
+
+        var removed = liveFiles.Keys.Count(path => !stagedFiles.ContainsKey(path));
+        if (!Directory.Exists(destination))
+        {
+            MoveDirectoryWithRetry(staging, destination);
+            return new PublishResult(added, updated, removed, unchanged);
+        }
+
+        var parent = Directory.GetParent(destination)!.FullName;
+        var leaf = Path.GetFileName(destination.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar));
+        var backup = Path.Combine(parent, $".{leaf}.translate-mod-backup-{Guid.NewGuid():N}");
+
+        MoveDirectoryWithRetry(destination, backup);
+        try
+        {
+            MoveDirectoryWithRetry(staging, destination);
+        }
+        catch (Exception publishError)
+        {
+            if (!Directory.Exists(destination) && Directory.Exists(backup))
+            {
+                try
+                {
+                    MoveDirectoryWithRetry(backup, destination);
+                }
+                catch (Exception rollbackError)
+                {
+                    throw new AggregateException(
+                        $"Failed to publish generated output and restore last-known-good directory {destination}.",
+                        publishError,
+                        rollbackError);
+                }
+            }
+            throw;
+        }
+
+        // Publication already succeeded. A stale backup is safe and should not make a
+        // correct generated tree appear to have failed.
+        TryDeleteDirectory(backup, "prior output backup", warnings);
+
+        return new PublishResult(added, updated, removed, unchanged);
+    }
+
+    private static void MoveDirectoryWithRetry(string source, string destination)
+    {
+        RetryTransientFileSystemAction(
+            () => Directory.Move(source, destination),
+            $"move directory '{source}' to '{destination}'");
+    }
+
+    private static void TryDeleteDirectory(string path, string description, List<string> warnings)
+    {
+        try
+        {
+            RetryTransientFileSystemAction(
+                () => Directory.Delete(path, recursive: true),
+                $"delete {description} '{path}'");
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            warnings.Add($"failed to delete {description} {path}: {ex.Message}");
+        }
+    }
+
+    private static void RetryTransientFileSystemAction(Action action, string description)
+    {
+        for (var attempt = 1; ; attempt++)
+        {
+            try
+            {
+                action();
+                return;
+            }
+            catch (Exception ex) when ((ex is IOException || ex is UnauthorizedAccessException) &&
+                                       attempt < FileSystemRetryCount)
+            {
+                // Antivirus/indexer/build-system handles can briefly prevent directory
+                // renames on Windows. Use bounded backoff; persistent failures still
+                // trigger the last-known-good rollback above.
+                Thread.Sleep(50 * attempt);
+            }
+            catch (Exception ex) when (ex is IOException || ex is UnauthorizedAccessException)
+            {
+                throw new IOException(
+                    $"Unable to {description} after {FileSystemRetryCount} attempts.",
+                    ex);
+            }
+        }
+    }
+
+    private static Dictionary<string, string> EnumerateRelativeFiles(string root) =>
+        Directory.EnumerateFiles(root, "*", SearchOption.AllDirectories)
+            .ToDictionary(
+                path => Path.GetRelativePath(root, path),
+                path => path,
+                StringComparer.OrdinalIgnoreCase);
+
+    private static bool FilesEqual(string left, string right) => FileOutput.FilesEqual(left, right);
+}
diff --git a/translator/src/Translator.Core/Ir/IrNodes.cs b/translator/src/Translator.Core/Ir/IrNodes.cs
new file mode 100644
index 0000000..9e3866c
--- /dev/null
+++ b/translator/src/Translator.Core/Ir/IrNodes.cs
@@ -0,0 +1,123 @@
+using System.Collections.Generic;
+
+namespace Translator.Core.Ir;
+
+public abstract record IrNode(string Kind);
+
+public abstract record IrInstruction(string Kind) : IrNode(Kind);
+
+public sealed record IrAssign(string Destination, IrValue Value) : IrInstruction("assign");
+
+public sealed record IrBinary(string Destination, IrValue Left, IrValue Right, string Op) : IrInstruction("binary");
+
+public sealed record IrLoad(string Destination, IrAddress Address, int SizeBytes) : IrInstruction("load");
+
+public sealed record IrStore(IrAddress Address, IrValue Source, int SizeBytes) : IrInstruction("store");
+
+/// <summary>
+/// Proves that [Base + MinOffset, Base + MinOffset + Length) is a contiguous
+/// mapped guest-RAM range and materializes its host pointer. A null host value
+/// records a failed proof and makes resolved accesses use their exact slow path.
+/// </summary>
+public sealed record IrResolveGuestMemoryRange(
+    string Destination,
+    IrValue Base,
+    int MinOffset,
+    int Length,
+    bool NeedsReadAccess,
+    bool NeedsWriteAccess) : IrInstruction("resolve_guest_memory_range");
+
+public sealed record IrResolvedLoad(
+    string Destination,
+    string Range,
+    IrAddress OriginalAddress,
+    int RangeOffset,
+    int SizeBytes) : IrInstruction("resolved_load");
+
+public sealed record IrResolvedStore(
+    string Range,
+    IrAddress OriginalAddress,
+    int RangeOffset,
+    IrValue Source,
+    int SizeBytes) : IrInstruction("resolved_store");
+
+public sealed record IrResolvedPsqLoad(
+    string Destination, string Range, IrValue OriginalAddress, int RangeOffset,
+    uint W, uint I, uint? KnownGqr, bool GuardKnownGqr = false) : IrInstruction("resolved_psq_load");
+
+public sealed record IrResolvedPsqStore(
+    string Range, IrValue OriginalAddress, int RangeOffset, IrValue Source,
+    uint W, uint I, uint? KnownGqr, bool GuardKnownGqr = false) : IrInstruction("resolved_psq_store");
+
+public sealed record IrResolvedLoadPair(
+    string FirstDestination, string SecondDestination, string Range,
+    IrAddress FirstOriginalAddress, IrAddress SecondOriginalAddress,
+    int RangeOffset, int ElementSizeBytes, bool Descending = false) : IrInstruction("resolved_load_pair");
+
+public sealed record IrResolvedStorePair(
+    string Range, IrAddress FirstOriginalAddress, IrAddress SecondOriginalAddress,
+    int RangeOffset, IrValue FirstSource, IrValue SecondSource, int ElementSizeBytes,
+    bool Descending = false)
+    : IrInstruction("resolved_store_pair");
+
+public sealed record IrCall(string Destination, string Target, IReadOnlyList<IrValue> Arguments) : IrInstruction("call");
+
+/// <summary>
+/// Indirect call through a register or computed address (e.g., blrl/bctrl).
+/// Destination captures the link register write or return value slot, mirroring IrCall semantics.
+/// </summary>
+public sealed record IrIndirectCall(string Destination, IrValue Target, IReadOnlyList<IrValue> Arguments) : IrInstruction("indirect_call");
+
+public sealed record IrSetCrField(int FieldIndex, IrValue Left, IrValue Right, bool IsUnsigned) : IrInstruction("set_cr_field");
+
+/// <summary>
+/// SSA merge of values coming from predecessor blocks.
+/// Sources map predecessor label -> SSA value name.
+/// </summary>
+public sealed record IrPhi(string Destination, IReadOnlyDictionary<string, string> Sources) : IrInstruction("phi");
+
+public sealed record IrBranch(string Condition, string TrueLabel, string FalseLabel, string ConditionRegister = "cr0") : IrInstruction("branch");
+
+public sealed record IrJump(string TargetLabel) : IrInstruction("jump");
+
+/// <summary>
+/// Indirect jump through a register (e.g., bctr without link).
+/// Unlike IrIndirectCall, this represents an intra-function jump (e.g., switch statement)
+/// and should not perform a function call.
+/// </summary>
+public sealed record IrIndirectJump(IrValue Target) : IrInstruction("indirect_jump");
+
+/// <summary>
+/// Jump table produced from a recognized switch statement. Selector is the register
+/// holding the computed target address, and each case maps a literal address to a
+/// basic block label within the same function.
+/// </summary>
+public sealed record IrJumpTable(string Selector, IReadOnlyList<IrJumpTableCase> Cases) : IrInstruction("jump_table");
+
+public sealed record IrJumpTableCase(uint TargetAddress, string TargetLabel);
+
+public sealed record IrReturn(IrValue? Value) : IrInstruction("return");
+
+public sealed record IrComment(string Text) : IrInstruction("comment");
+
+public sealed record IrTracePpc(uint Address, string Disassembly, string RawHex)
+    : IrInstruction("trace_ppc");
+
+/// <summary>
+/// Marks an instruction as intentionally untranslatable in the current runtime model.
+/// Codegen should emit a runtime UNDEFINED trap that reports PC + raw opcode.
+/// </summary>
+public sealed record IrUndefined(uint Address, uint RawInstruction, string Disassembly, string? Reason = null)
+    : IrInstruction("undefined");
+
+public sealed record IrAddress(string Base, int Offset);
+
+public sealed record IrValue(string Kind, string? RegisterName = null, long? Constant = null)
+{
+    public static IrValue Register(string name) => new("register", RegisterName: name);
+    public static IrValue Imm(long value) => new("const", Constant: value);
+}
+
+public sealed record IrBasicBlock(string Label, IReadOnlyList<IrInstruction> Instructions);
+
+public sealed record IrFunction(string Name, string EntryLabel, IReadOnlyList<IrBasicBlock> Blocks);
diff --git a/translator/src/Translator.Core/Ir/IrRegisterDataFlow.cs b/translator/src/Translator.Core/Ir/IrRegisterDataFlow.cs
new file mode 100644
index 0000000..357f134
--- /dev/null
+++ b/translator/src/Translator.Core/Ir/IrRegisterDataFlow.cs
@@ -0,0 +1,184 @@
+using System;
+using System.Collections.Generic;
+
+namespace Translator.Core.Ir;
+
+internal static class IrRegisterDataFlow
+{
+    public static IEnumerable<string> Uses(IrInstruction instruction)
+    {
+        switch (instruction)
+        {
+            case IrAssign assign when TryRegister(assign.Value, out var source):
+                yield return source;
+                break;
+            case IrBinary binary:
+                if (TryRegister(binary.Left, out var left)) yield return left;
+                if (TryRegister(binary.Right, out var right)) yield return right;
+                break;
+            case IrLoad load:
+                yield return load.Address.Base;
+                break;
+            case IrStore store:
+                yield return store.Address.Base;
+                if (TryRegister(store.Source, out var stored)) yield return stored;
+                break;
+            case IrResolveGuestMemoryRange resolve when TryRegister(resolve.Base, out var rangeBase):
+                yield return rangeBase;
+                break;
+            case IrResolvedLoad load:
+                yield return load.OriginalAddress.Base;
+                break;
+            case IrResolvedStore store:
+                yield return store.OriginalAddress.Base;
+                if (TryRegister(store.Source, out var resolvedStored)) yield return resolvedStored;
+                break;
+            case IrResolvedPsqLoad load:
+                if (TryRegister(load.OriginalAddress, out var psqLoadAddress)) yield return psqLoadAddress;
+                if (load.KnownGqr is null || load.GuardKnownGqr) yield return $"gqr{load.I}";
+                break;
+            case IrResolvedPsqStore store:
+                if (TryRegister(store.OriginalAddress, out var psqStoreAddress)) yield return psqStoreAddress;
+                if (TryRegister(store.Source, out var psqStored)) yield return psqStored;
+                if (store.KnownGqr is null || store.GuardKnownGqr) yield return $"gqr{store.I}";
+                break;
+            case IrResolvedLoadPair pair:
+                yield return pair.FirstOriginalAddress.Base;
+                yield return pair.SecondOriginalAddress.Base;
+                break;
+            case IrResolvedStorePair pair:
+                yield return pair.FirstOriginalAddress.Base;
+                yield return pair.SecondOriginalAddress.Base;
+                if (TryRegister(pair.FirstSource, out var firstStored)) yield return firstStored;
+                if (TryRegister(pair.SecondSource, out var secondStored)) yield return secondStored;
+                break;
+            case IrCall call:
+                foreach (var argument in call.Arguments)
+                    if (TryRegister(argument, out var name)) yield return name;
+                break;
+            case IrIndirectCall call:
+                if (TryRegister(call.Target, out var target)) yield return target;
+                foreach (var argument in call.Arguments)
+                    if (TryRegister(argument, out var name)) yield return name;
+                break;
+            case IrIndirectJump jump when TryRegister(jump.Target, out var jumpTarget):
+                yield return jumpTarget;
+                break;
+            case IrReturn ret when ret.Value is not null && TryRegister(ret.Value, out var returned):
+                yield return returned;
+                break;
+            case IrBranch branch when IsRegisterName(branch.ConditionRegister):
+                yield return branch.ConditionRegister;
+                break;
+            case IrPhi phi:
+                foreach (var source in phi.Sources.Values) yield return source;
+                break;
+            case IrSetCrField setCr:
+                if (TryRegister(setCr.Left, out var compareLeft)) yield return compareLeft;
+                if (TryRegister(setCr.Right, out var compareRight)) yield return compareRight;
+                yield return "xer";
+                break;
+            case IrJumpTable table:
+                yield return table.Selector;
+                break;
+        }
+    }
+
+    public static IEnumerable<string> Definitions(IrInstruction instruction)
+    {
+        switch (instruction)
+        {
+            case IrAssign assign:
+                yield return assign.Destination;
+                break;
+            case IrBinary binary:
+                yield return binary.Destination;
+                break;
+            case IrLoad load:
+                yield return load.Destination;
+                break;
+            case IrResolveGuestMemoryRange resolve:
+                yield return resolve.Destination;
+                break;
+            case IrResolvedLoad load:
+                yield return load.Destination;
+                break;
+            case IrResolvedPsqLoad load:
+                yield return load.Destination;
+                break;
+            case IrResolvedLoadPair pair:
+                yield return pair.FirstDestination;
+                yield return pair.SecondDestination;
+                break;
+            case IrCall call when !string.IsNullOrWhiteSpace(call.Destination):
+                yield return call.Destination;
+                break;
+            case IrIndirectCall call when !string.IsNullOrWhiteSpace(call.Destination):
+                yield return call.Destination;
+                break;
+            case IrPhi phi:
+                yield return phi.Destination;
+                break;
+            case IrSetCrField setCr:
+                yield return $"cr{setCr.FieldIndex}";
+                break;
+        }
+    }
+
+    public static bool IsRegisterName(string name)
+    {
+        if (string.IsNullOrWhiteSpace(name)) return false;
+
+        var baseName = BaseName(name);
+        if (baseName.Length is >= 2 and <= 3 &&
+            (baseName[0] == 'r' || baseName[0] == 'f') &&
+            int.TryParse(baseName.AsSpan(1), out var register) && register is >= 0 and < 32)
+            return true;
+
+        if (baseName.Length == 3 &&
+            baseName.StartsWith("cr", StringComparison.OrdinalIgnoreCase) &&
+            char.IsDigit(baseName[2]) && (baseName[2] - '0') is >= 0 and <= 7)
+            return true;
+
+        if (baseName.Length is >= 4 and <= 5 &&
+            baseName.StartsWith("crb", StringComparison.OrdinalIgnoreCase) &&
+            int.TryParse(baseName.AsSpan(3), out var crBit) && crBit is >= 0 and < 32)
+            return true;
+
+        if (baseName.Length == 4 && baseName.StartsWith("gqr", StringComparison.OrdinalIgnoreCase) &&
+            baseName[3] is >= '0' and <= '7')
+            return true;
+
+        return baseName.Equals("cr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("lr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("ctr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("xer", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("fpscr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("msr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("dar", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("dsisr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("iccr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("tbr", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("tbl", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("tbu", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("hid0", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("hid1", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("hid2", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("srr0", StringComparison.OrdinalIgnoreCase) ||
+               baseName.Equals("srr1", StringComparison.OrdinalIgnoreCase);
+    }
+
+    /// <summary>
+    /// Returns the architectural/SSA base spelling for a value name. Only a numeric suffix is an SSA
+    /// version, so lifter temporaries like <c>r3_addc_left</c> stay temporaries instead of being
+    /// mistaken for architectural <c>r3</c>.
+    /// </summary>
+    public static string BaseName(string name) =>
+        RegisterNameUtils.StripNumericSuffix(name);
+
+    private static bool TryRegister(IrValue value, out string register)
+    {
+        register = value.RegisterName ?? string.Empty;
+        return value.Kind == "register" && register.Length > 0;
+    }
+}
diff --git a/translator/src/Translator.Core/Lifting/LiftedInstruction.cs b/translator/src/Translator.Core/Lifting/LiftedInstruction.cs
new file mode 100644
index 0000000..3870d7f
--- /dev/null
+++ b/translator/src/Translator.Core/Lifting/LiftedInstruction.cs
@@ -0,0 +1,6 @@
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Lifting;
+
+public sealed record LiftedInstruction(PpcInstruction Origin, IReadOnlyList<IrInstruction> Ir);
diff --git a/translator/src/Translator.Core/Lifting/PpcLifter.Floating.cs b/translator/src/Translator.Core/Lifting/PpcLifter.Floating.cs
new file mode 100644
index 0000000..e6ee396
--- /dev/null
+++ b/translator/src/Translator.Core/Lifting/PpcLifter.Floating.cs
@@ -0,0 +1,274 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Lifting;
+
+public sealed partial class PpcLifter
+{
+    private static IReadOnlyList<IrInstruction>? TryLiftFloating(
+        PpcInstruction ins,
+        string mnemonic,
+        IReadOnlyList<PpcOperand> ops,
+        IReadOnlyList<string> operands)
+    {
+        switch (mnemonic)
+        {
+            case "mffs":
+            case "mffs.":
+            case "fp_583":
+                return LiftMffs(ins);
+
+            case "mtfsf":
+            case "mtfsf.":
+            case "fp_711":
+                return LiftMtfsf(ins);
+
+            case "mtfsfi":
+            case "mtfsfi.":
+            case "fp_134":
+                return LiftMtfsfi(ins);
+
+            case "mtfsb0":
+            case "mtfsb0.":
+            case "fp_70":
+                return LiftMtfsb0(ins);
+
+            case "mtfsb1":
+            case "mtfsb1.":
+            case "fp_38":
+                return LiftMtfsb1(ins);
+
+            case "fadd" when operands.Count == 3:
+            case "fadd." when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "add") };
+
+            case "fsub" when operands.Count == 3:
+            case "fsub." when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "sub") };
+
+            case "fmul" when operands.Count == 3:
+            case "fmul." when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "mul") };
+
+            case "fdiv" when operands.Count == 3:
+            case "fdiv." when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "fdiv") };
+
+            case "fadds" when operands.Count == 3:
+            case "fadds." when operands.Count == 3:
+                return new[] { new IrCall(operands[0], "PPC_Fadds", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]) }) };
+
+            case "fsubs" when operands.Count == 3:
+            case "fsubs." when operands.Count == 3:
+                return new[] { new IrCall(operands[0], "PPC_Fsubs", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]) }) };
+
+            case "fmuls" when operands.Count == 3:
+            case "fmuls." when operands.Count == 3:
+                return new[] { new IrCall(operands[0], "PPC_Fmuls", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]) }) };
+
+            case "fdivs" when operands.Count == 3:
+            case "fdivs." when operands.Count == 3:
+                return new[] { new IrCall(operands[0], "PPC_Fdivs", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]) }) };
+
+            case "fres" when operands.Count == 2:
+            case "fres." when operands.Count == 2:
+                return new[] { new IrCall(operands[0], "PPC_Fres", new[] { IrValue.Register(operands[1]) }) };
+
+            case "fmsubs" when operands.Count == 4:
+            case "fmsubs." when operands.Count == 4:
+                return new[] { new IrCall(operands[0], "PPC_Fmsubs", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]), IrValue.Register(operands[3]) }) };
+
+            case "fmadds" when operands.Count == 4:
+            case "fmadds." when operands.Count == 4:
+                return new[] { new IrCall(operands[0], "PPC_Fmadds", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]), IrValue.Register(operands[3]) }) };
+
+            case "fnmsubs" when operands.Count == 4:
+            case "fnmsubs." when operands.Count == 4:
+                return new[] { new IrCall(operands[0], "PPC_Fnmsubs", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]), IrValue.Register(operands[3]) }) };
+
+            case "fnmadds" when operands.Count == 4:
+            case "fnmadds." when operands.Count == 4:
+                return new[] { new IrCall(operands[0], "PPC_Fnmadds", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]), IrValue.Register(operands[3]) }) };
+
+            case "fp_57":
+                {
+                    // fp_57 corresponds to Opcode 63 with bits 21-30 = 57.
+                    // This splits into C=1 and XO=25 (fmul).
+                    // We decode as A-Form to be safe.
+                    uint raw1 = ReadRawInstruction(ins);
+                    int rD = (int)((raw1 >> 21) & 0x1F);
+                    int rA = (int)((raw1 >> 16) & 0x1F);
+                    int rC = (int)((raw1 >> 6) & 0x1F);
+                    // XO is at bits 26-30 (raw >> 1 & 0x1F). 
+                    // We assume fmul based on the ID, but decoding standard A-form logic works too.
+                    return new[] { new IrBinary($"f{rD}", IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), "mul") };
+                }
+
+            case "frsp":
+            case "frsp.":
+            case "fp_12":
+                {
+                    string dest, src;
+                    // Handle cases where disassembler fallback (fp_12) might not provide parsed operands
+                    if (operands.Count >= 2)
+                    {
+                        dest = operands[0];
+                        src = operands[1];
+                    }
+                    else
+                    {
+                        uint raw1 = ReadRawInstruction(ins);
+                        int rD = (int)((raw1 >> 21) & 0x1F);
+                        int rB = (int)((raw1 >> 11) & 0x1F);
+                        dest = $"f{rD}";
+                        src = $"f{rB}";
+                    }
+                    
+                    // frsp is a unary operation, mapped here as a binary op with a dummy 0 immediate
+                    // similar to how fneg/fabs are often handled in this lifter.
+                    return new[] { new IrBinary(dest, IrValue.Register(src), IrValue.Imm(0), "frsp") };
+                }
+            case "fp_281":
+                {
+                    // fp_281 is fmul with rC=8. 
+                    // 281 = (8 << 5) | 25. XO 25 is fmul.
+                    uint raw1 = ReadRawInstruction(ins);
+                    int rD = (int)((raw1 >> 21) & 0x1F);
+                    int rA = (int)((raw1 >> 16) & 0x1F);
+                    int rC = (int)((raw1 >> 6) & 0x1F);
+                    return new[] { new IrBinary($"f{rD}", IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), "mul") };
+                }
+            case "fneg" when operands.Count == 2:
+            case "fneg." when operands.Count == 2:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Imm(0), "fneg") };
+
+            case "fabs" when operands.Count == 2:
+            case "fabs." when operands.Count == 2:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Imm(0), "fabs") };
+
+            case "fnabs" when operands.Count == 2:
+            case "fnabs." when operands.Count == 2:
+                return new[]
+                {
+                    new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Imm(0), "fabs"),
+                    new IrBinary(operands[0], IrValue.Register(operands[0]), IrValue.Imm(0), "fneg")
+                };
+
+            case "fmr" when operands.Count == 2:
+            case "fmr." when operands.Count == 2:
+                return new[] { new IrAssign(operands[0], IrValue.Register(operands[1])) };
+
+            case "fctiw" when operands.Count == 2:
+            case "fctiw." when operands.Count == 2:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Imm(0), "fctiw") };
+
+            case "fctiwz" when operands.Count == 2:
+            case "fctiwz." when operands.Count == 2:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Imm(0), "fctiwz") };
+
+            case "fsel" when operands.Count == 4:
+            case "fsel." when operands.Count == 4:
+                return new[] { new IrCall(operands[0], "PPC_Fsel", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[3]), IrValue.Register(operands[2]) }) };
+
+            case "frsqrte" when operands.Count == 2:
+            case "frsqrte." when operands.Count == 2:
+                return new[] { new IrCall(operands[0], "PPC_Frsqrte", new[] { IrValue.Register(operands[1]) }) };
+
+            case "fmsub" when operands.Count == 4:
+            case "fmsub." when operands.Count == 4:
+                return new[] { new IrCall(operands[0], "PPC_Fmsub", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]), IrValue.Register(operands[3]) }) };
+
+            case "fmadd" when operands.Count == 4:
+            case "fmadd." when operands.Count == 4:
+                return new[] { new IrCall(operands[0], "PPC_Fmadd", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]), IrValue.Register(operands[3]) }) };
+
+            case "fnmsub" when operands.Count == 4:
+            case "fnmsub." when operands.Count == 4:
+                return new[] { new IrCall(operands[0], "PPC_Fnmsub", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]), IrValue.Register(operands[3]) }) };
+
+            case "fnmadd" when operands.Count == 4:
+            case "fnmadd." when operands.Count == 4:
+                return new[] { new IrCall(operands[0], "PPC_Fnmadd", new[] { IrValue.Register(operands[1]), IrValue.Register(operands[2]), IrValue.Register(operands[3]) }) };
+
+            case "fcmpu" when operands.Count == 3:
+            case "fcmpo" when operands.Count == 3:
+                {
+                    // Model the CR write explicitly so leaf/resident register caches update
+                    // the authoritative CR storage instead of a stale CpuContext shadow.
+                    var destCr = ParseCrFieldIndex(operands[0]);
+                    return new[]
+                    {
+                        new IrSetCrField(destCr, IrValue.Register(operands[1]),
+                            IrValue.Register(operands[2]), false)
+                    };
+                }
+
+            case "opc_59":
+                {
+                    uint raw1 = ReadRawInstruction(ins);
+                    // Decode fields for A-Form instruction
+                    // XO is at bits 26-30 (bits 1-5 in our raw uint from LSB)
+                    int xo = (int)((raw1 >> 1) & 0x1F);
+                    int rD = (int)((raw1 >> 21) & 0x1F);
+                    int rA = (int)((raw1 >> 16) & 0x1F);
+                    int rB = (int)((raw1 >> 11) & 0x1F);
+                    int rC = (int)((raw1 >> 6) & 0x1F);
+
+                    return xo switch
+                    {
+                        18 => new[] { new IrCall($"f{rD}", "PPC_Fdivs", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}") }) }, // fdivs
+                        20 => new[] { new IrCall($"f{rD}", "PPC_Fsubs", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}") }) }, // fsubs
+                        21 => new[] { new IrCall($"f{rD}", "PPC_Fadds", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}") }) }, // fadds
+                        22 => new[] { new IrCall($"f{rD}", "PPC_Fsqrt", new[] { IrValue.Register($"f{rB}") }) }, // fsqrts
+                        23 => new[] { new IrCall($"f{rD}", "PPC_Fsel", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}"), IrValue.Register($"f{rC}") }) }, // fsel
+                        24 => new[] { new IrCall($"f{rD}", "PPC_Fres", new[] { IrValue.Register($"f{rB}") }) }, // fres
+                        25 => new[] { new IrCall($"f{rD}", "PPC_Fmuls", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}") }) }, // fmuls (uses A and C)
+                        26 => new[] { new IrCall($"f{rD}", "PPC_Frsqrte", new[] { IrValue.Register($"f{rB}") }) }, // frsqrtes
+                        28 => new[] { new IrCall($"f{rD}", "PPC_Fmsubs", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // fmsubs
+                        29 => new[] { new IrCall($"f{rD}", "PPC_Fmadds", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // fmadds
+                        30 => new[] { new IrCall($"f{rD}", "PPC_Fnmsubs", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // fnmsubs
+                        31 => new[] { new IrCall($"f{rD}", "PPC_Fnmadds", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // fnmadds
+                        _ => throw new NotImplementedException($"UNIMPLEMENTED opc_59 XO {xo} @ 0x{ins.Address:X8}")
+                    };
+                }
+
+            case var s when s.StartsWith("fp_"):
+                {
+                    uint raw1 = ReadRawInstruction(ins);
+                    // Extract real XO from bits 26-30
+                    int xo = (int)((raw1 >> 1) & 0x1F);
+                    
+                    int rD = (int)((raw1 >> 21) & 0x1F);
+                    int rA = (int)((raw1 >> 16) & 0x1F);
+                    int rB = (int)((raw1 >> 11) & 0x1F);
+                    int rC = (int)((raw1 >> 6) & 0x1F);
+
+                    return xo switch
+                    {
+                        18 => new[] { new IrBinary($"f{rD}", IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}"), "fdiv") },
+                        20 => new[] { new IrBinary($"f{rD}", IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}"), "sub") },
+                        21 => new[] { new IrBinary($"f{rD}", IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}"), "add") },
+                        22 => new[] { new IrCall($"f{rD}", "PPC_Fsqrt", new[] { IrValue.Register($"f{rB}") }) }, // fsqrt
+                        23 => new[] { new IrCall($"f{rD}", "PPC_Fsel", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}"), IrValue.Register($"f{rC}") }) }, // fsel
+                        24 => new[] { new IrCall($"f{rD}", "PPC_Fres", new[] { IrValue.Register($"f{rB}") }) }, // fres
+                        25 => new[] { new IrBinary($"f{rD}", IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), "mul") }, // fmul uses A and C
+                        26 => new[] { new IrCall($"f{rD}", "PPC_Frsqrte", new[] { IrValue.Register($"f{rB}") }) }, // frsqrte
+                        28 => new[] { new IrCall($"f{rD}", "PPC_Fmsub", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // fmsub
+                        29 => new[] { new IrCall($"f{rD}", "PPC_Fmadd", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // fmadd
+                        30 => new[] { new IrCall($"f{rD}", "PPC_Fnmsub", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // fnmsub
+                        31 => new[] { new IrCall($"f{rD}", "PPC_Fnmadd", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // fnmadd
+                        32 => new[] { new IrBinary($"f{rD}", IrValue.Register($"f{rB}"), IrValue.Imm(0), "fneg") }, // fneg (unary)
+                        12 => new[] { new IrBinary($"f{rD}", IrValue.Register($"f{rB}"), IrValue.Imm(0), "frsp") }, // frsp (unary)
+                        8  => new[] { new IrBinary($"f{rD}", IrValue.Register($"f{rB}"), IrValue.Imm(0), "fcmp") }, // fcmp
+                        _ => throw new NotImplementedException($"UNIMPLEMENTED fp_ fallback with XO {xo} @ 0x{ins.Address:X8}")
+                    };
+                }
+        }
+
+        return null;
+    }
+}
diff --git a/translator/src/Translator.Core/Lifting/PpcLifter.PairedSingle.cs b/translator/src/Translator.Core/Lifting/PpcLifter.PairedSingle.cs
new file mode 100644
index 0000000..75df153
--- /dev/null
+++ b/translator/src/Translator.Core/Lifting/PpcLifter.PairedSingle.cs
@@ -0,0 +1,272 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Lifting;
+
+public sealed partial class PpcLifter
+{
+    private static IReadOnlyList<IrInstruction>? TryLiftPairedSingle(
+        PpcInstruction ins,
+        string mnemonic,
+        IReadOnlyList<PpcOperand> ops,
+        IReadOnlyList<string> operands)
+    {
+        string Reg(int idx) => RegisterOperandName(ops, idx);
+        int Imm(int idx) => ImmediateOperandValue(ops, idx);
+        switch (mnemonic)
+        {
+            case "psq_l" when ops.Count == 4:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return EmitPairedSingleLoad(Reg(0), reg, offset, Imm(2), Imm(3), updateBase: false, ins.Address);
+                }
+
+            case "psq_lu" when ops.Count == 4:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return EmitPairedSingleLoad(Reg(0), reg, offset, Imm(2), Imm(3), updateBase: true, ins.Address);
+                }
+
+            case "psq_st" when ops.Count == 4:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return EmitPairedSingleStore(Reg(0), reg, offset, Imm(2), Imm(3), updateBase: false, ins.Address);
+                }
+
+            case "psq_stu" when ops.Count == 4:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return EmitPairedSingleStore(Reg(0), reg, offset, Imm(2), Imm(3), updateBase: true, ins.Address);
+                }
+
+            case "psq_lx":
+                return LiftPairedSingleIndexedLoad(ins, ReadRawInstruction(ins), updateBase: false);
+
+            case "psq_lux":
+                return LiftPairedSingleIndexedLoad(ins, ReadRawInstruction(ins), updateBase: true);
+
+            case "psq_stx":
+                return LiftPairedSingleIndexedStore(ins, ReadRawInstruction(ins), updateBase: false);
+
+            case "psq_stux":
+                return LiftPairedSingleIndexedStore(ins, ReadRawInstruction(ins), updateBase: true);
+
+            case "ps_add" when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsAdd", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_sub" when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsSub", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_div" when ops.Count == 3:
+            case "ps_div." when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsDiv", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_mul" when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsMul", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_msub" when ops.Count == 4:
+                return new[] { new IrCall(Reg(0), "PPC_PsMsub", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), IrValue.Register(Reg(3)) }) };
+
+            case "ps_madd" when ops.Count == 4:
+                return new[] { new IrCall(Reg(0), "PPC_PsMadd", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), IrValue.Register(Reg(3)) }) };
+
+            case "ps_nmsub" when ops.Count == 4:
+                return new[] { new IrCall(Reg(0), "PPC_PsNmsub", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), IrValue.Register(Reg(3)) }) };
+
+            case "ps_nmadd" when ops.Count == 4:
+                return new[] { new IrCall(Reg(0), "PPC_PsNmadd", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), IrValue.Register(Reg(3)) }) };
+
+            case "ps_madds0" when ops.Count == 4:
+            case "ps_madds0." when ops.Count == 4:
+                return new[] { new IrCall(Reg(0), "PPC_PsMadds0", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), IrValue.Register(Reg(3)) }) };
+
+            case "ps_madds1" when ops.Count == 4:
+            case "ps_madds1." when ops.Count == 4:
+                return new[] { new IrCall(Reg(0), "PPC_PsMadds1", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), IrValue.Register(Reg(3)) }) };
+
+            case "ps_sum0" when ops.Count == 4:
+            case "ps_sum0." when ops.Count == 4:
+                // Decoder outputs (D, A, C, B) per IBM syntax, but PPC_PsSum0 expects (frA, frB, frC)
+                // So we pass Reg(1)=frA, Reg(3)=frB, Reg(2)=frC
+                return new[] { new IrCall(Reg(0), "PPC_PsSum0", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(3)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_sum1" when ops.Count == 4:
+            case "ps_sum1." when ops.Count == 4:
+                // Decoder outputs (D, A, C, B) per IBM syntax, but PPC_PsSum1 expects (frA, frB, frC)
+                // So we pass Reg(1)=frA, Reg(3)=frB, Reg(2)=frC
+                return new[] { new IrCall(Reg(0), "PPC_PsSum1", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(3)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_muls0" when ops.Count == 3:
+            case "ps_muls0." when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsMuls0", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_muls1" when ops.Count == 3:
+            case "ps_muls1." when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsMuls1", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_sel" when ops.Count == 4:
+                {
+                    // Check for misidentified ps_neg (XO 40 encoded in bits 21-30)
+                    uint rawSel = ReadRawInstruction(ins);
+                    int selXo = (int)((rawSel >> 1) & 0x3FF);
+                    if (selXo == 40)
+                    {
+                        // ps_neg frD, frB (D is bits 6-10, B is bits 16-20)
+                        int selRD = (int)((rawSel >> 21) & 0x1F);
+                        int selRB = (int)((rawSel >> 11) & 0x1F);
+                        return new[] { new IrCall($"f{selRD}", "PPC_PsNeg", new[] { IrValue.Register($"f{selRB}") }) };
+                    }
+
+                    // ps_sel frD, frA, frC, frB
+                    // frD = frA >= 0 ? frC : frB
+                    // PPC_PsSel(lhs=frC, control=frA, rhs=frB)
+                    return new[] { new IrCall(Reg(0), "PPC_PsSel", new[] { IrValue.Register(Reg(2)), IrValue.Register(Reg(1)), IrValue.Register(Reg(3)) }) };
+                }
+
+            case "ps_res" when ops.Count == 2:
+                return new[] { new IrCall(Reg(0), "PPC_PsRes", new[] { IrValue.Register(Reg(1)) }) };
+
+            case "ps_rsqrte" when ops.Count == 2:
+                return new[] { new IrCall(Reg(0), "PPC_PsRsqrte", new[] { IrValue.Register(Reg(1)) }) };
+
+            case "ps_neg":
+            case "ps_neg.":
+                return new[] { new IrCall(Reg(0), "PPC_PsNeg", new[] { IrValue.Register(Reg(1)) }) };
+
+            case "ps_abs":
+            case "ps_abs.":
+                return new[] { new IrCall(Reg(0), "PPC_PsAbs", new[] { IrValue.Register(Reg(1)) }) };
+
+            case "ps_nabs":
+            case "ps_nabs.":
+                return new[] { new IrCall(Reg(0), "PPC_PsNabs", new[] { IrValue.Register(Reg(1)) }) };
+
+            case "ps_merge00" when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsMerge00", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_merge01" when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsMerge01", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_merge10" when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsMerge10", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_merge11" when ops.Count == 3:
+                return new[] { new IrCall(Reg(0), "PPC_PsMerge11", new[] { IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+
+            case "ps_mr" when ops.Count == 2:
+            case "ps_mr." when ops.Count == 2:
+                // ps_mr copies both lanes, unlike scalar fmr which writes only PS0
+                // and preserves the destination's existing PS1 lane.
+                return new[] { new IrCall(Reg(0), "PPC_PsMr", new[] { IrValue.Register(Reg(1)) }) };
+
+            case "ps_cmpo0" when ops.Count == 3:
+            case "ps_cmpo0." when ops.Count == 3: // Dot form doesn't really exist for compare but just in case
+                {
+                    var dest = operands[0]; // cr field
+                    var crField = ParseCrFieldName(dest);
+                    // PPC_PsCmpo0(crField, frA, frB)
+                    return new[] { new IrCall(string.Empty, "PPC_PsCmpo0", new[] { IrValue.Imm(crField), IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+                }
+
+            case "ps_cmpu0" when ops.Count == 3:
+            case "ps_cmpu0." when ops.Count == 3:
+                {
+                    var dest = operands[0];
+                    var crField = ParseCrFieldName(dest);
+                    return new[] { new IrCall(string.Empty, "PPC_PsCmpu0", new[] { IrValue.Imm(crField), IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+                }
+
+            case "ps_cmpo1" when ops.Count == 3:
+            case "ps_cmpo1." when ops.Count == 3:
+                {
+                    var dest = operands[0];
+                    var crField = ParseCrFieldName(dest);
+                    return new[] { new IrCall(string.Empty, "PPC_PsCmpo1", new[] { IrValue.Imm(crField), IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+                }
+
+            case "ps_cmpu1" when ops.Count == 3:
+            case "ps_cmpu1." when ops.Count == 3:
+                {
+                    var dest = operands[0];
+                    var crField = ParseCrFieldName(dest);
+                    return new[] { new IrCall(string.Empty, "PPC_PsCmpu1", new[] { IrValue.Imm(crField), IrValue.Register(Reg(1)), IrValue.Register(Reg(2)) }) };
+                }
+
+            // Some toolchains emit raw opcode labels (opc_4_XX) for paired-single ops.
+            // Map the ones we know we use back to the corresponding ps_* helpers.
+            case "opc_4_50": // ps_mul (XO 25, Rc=0)
+            case "opc_4_51": // ps_mul. (XO 25, Rc=1)
+                {
+                    uint raw1 = ReadRawInstruction(ins);
+                    int rD = (int)((raw1 >> 21) & 0x1F);
+                    int rA = (int)((raw1 >> 16) & 0x1F);
+                    int rC = (int)((raw1 >> 6) & 0x1F);
+                    return new[] { new IrCall($"f{rD}", "PPC_PsMul", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}") }) };
+                }
+
+            case var s when s.StartsWith("opc_4_"):
+                {
+                    if (!int.TryParse(s.Split('_').Last(), NumberStyles.Integer, CultureInfo.InvariantCulture, out var subop))
+                    {
+                        throw new NotImplementedException($"UNIMPLEMENTED paired-single opcode '{s}' @ 0x{ins.Address:X8}");
+                    }
+
+                    uint raw1 = ReadRawInstruction(ins);
+                    int rD = (int)((raw1 >> 21) & 0x1F);
+                    int rA = (int)((raw1 >> 16) & 0x1F);
+                    int rB = (int)((raw1 >> 11) & 0x1F);
+                    int rC = (int)((raw1 >> 6) & 0x1F);
+
+                    // Some paired-single instructions use X-form encoding with 10-bit XO in bits 1-10.
+                    // The disassembler may give us the wrong A-form subop, so check X-form XO first.
+                    int xformXO = (int)((raw1 >> 1) & 0x3FF); // bits 1-10
+                    if (xformXO == 40) // ps_neg: frD = -frB (paired)
+                    {
+                        return new[] { new IrCall($"f{rD}", "PPC_PsNeg", new[] { IrValue.Register($"f{rB}") }) };
+                    }
+
+                    return subop switch
+                    {
+                        0 or 1 or 2 or 3 => LiftCompare("cr0", IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}"), "sub", isUnsigned: false),
+                        4 => new[] { new IrCall($"f{rD}", "PPC_PsMr", new[] { IrValue.Register($"f{rB}") }) },
+                        5 => new[] { new IrCall($"f{rD}", "PPC_PsNabs", new[] { IrValue.Register($"f{rB}") }) },
+                        6 or 12 => LiftPairedSingleIndexedLoad(ins, raw1, updateBase: false), // psq_lx (XO=6, 6<<1=12)
+                        7 or 14 => LiftPairedSingleIndexedStore(ins, raw1, updateBase: false), // psq_stx (XO=7, 7<<1=14)
+                        
+                        // Validated Arithmetic Ops (XO << 1 | Rc)
+                        20 or 21 => new[] { new IrCall($"f{rD}", "PPC_PsSum0", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}"), IrValue.Register($"f{rC}") }) }, // ps_sum0 (XO=10)
+                        22 or 23 => new[] { new IrCall($"f{rD}", "PPC_PsSum1", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}"), IrValue.Register($"f{rC}") }) }, // ps_sum1 (XO=11)
+                        24 or 25 => new[] { new IrCall($"f{rD}", "PPC_PsMuls0", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}") }) }, // ps_muls0 (XO=12)
+                        26 or 27 => new[] { new IrCall($"f{rD}", "PPC_PsMuls1", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}") }) }, // ps_muls1 (XO=13)
+                        28 or 29 => new[] { new IrCall($"f{rD}", "PPC_PsMadds0", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // ps_madds0 (XO=14)
+                        30 or 31 => new[] { new IrCall($"f{rD}", "PPC_PsMadds1", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // ps_madds1 (XO=15)
+                        
+                        36 or 37 => new[] { new IrCall($"f{rD}", "PPC_PsDiv", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}") }) }, // ps_div (XO=18)
+                        40 or 41 => new[] { new IrCall($"f{rD}", "PPC_PsSub", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}") }) }, // ps_sub (XO=20)
+                        42 or 43 => new[] { new IrCall($"f{rD}", "PPC_PsAdd", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}") }) }, // ps_add (XO=21)
+                        44 or 45 => new[] { new IrCall($"f{rD}", "PPC_PsAbs", new[] { IrValue.Register($"f{rB}") }) }, // ps_abs (XO=22)
+                        46 or 47 => new[] { new IrCall($"f{rD}", "PPC_PsSel", new[] { IrValue.Register($"f{rC}"), IrValue.Register($"f{rA}"), IrValue.Register($"f{rB}") }) }, // ps_sel (XO=23)
+                        48 or 49 => new[] { new IrCall($"f{rD}", "PPC_PsRes", new[] { IrValue.Register($"f{rB}") }) }, // ps_res (XO=24)
+                        50 or 51 => new[] { new IrCall($"f{rD}", "PPC_PsMul", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}") }) }, // ps_mul (XO=25)
+                        52 or 53 => new[] { new IrCall($"f{rD}", "PPC_PsRsqrte", new[] { IrValue.Register($"f{rB}") }) }, // ps_rsqrte (XO=26)
+                        
+                        56 or 57 => new[] { new IrCall($"f{rD}", "PPC_PsMsub", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // ps_msub (XO=28)
+                        58 or 59 => new[] { new IrCall($"f{rD}", "PPC_PsMadd", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // ps_madd (XO=29)
+                        60 or 61 => new[] { new IrCall($"f{rD}", "PPC_PsNmsub", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // ps_nmsub (XO=30)
+                        62 or 63 => new[] { new IrCall($"f{rD}", "PPC_PsNmadd", new[] { IrValue.Register($"f{rA}"), IrValue.Register($"f{rC}"), IrValue.Register($"f{rB}") }) }, // ps_nmadd (XO=31)
+                        
+                        // Memory Ops (using raw XO?)
+                        38 or 76 => LiftPairedSingleIndexedLoad(ins, raw1, updateBase: true), // psq_lux (XO=38, 38<<1=76)
+                        39 or 78 => LiftPairedSingleIndexedStore(ins, raw1, updateBase: true), // psq_stux (XO=39, 39<<1=78)
+                        _ => throw new NotImplementedException($"UNIMPLEMENTED paired-single opcode '{s}' @ 0x{ins.Address:X8}")
+                    };
+                }
+        }
+
+        return null;
+    }
+}
diff --git a/translator/src/Translator.Core/Lifting/PpcLifter.cs b/translator/src/Translator.Core/Lifting/PpcLifter.cs
new file mode 100644
index 0000000..c32cdc6
--- /dev/null
+++ b/translator/src/Translator.Core/Lifting/PpcLifter.cs
@@ -0,0 +1,3157 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Lifting;
+
+/// <summary> 
+/// Very small lifter...
+/// </summary>
+public sealed partial class PpcLifter
+{
+    public IReadOnlyList<LiftedInstruction> Lift(
+        IReadOnlyList<PpcInstruction> instructions,
+        bool allowUnsupported = false,
+        uint? functionEntryPoint = null,
+        IReadOnlySet<uint>? knownFunctionEntryPoints = null)
+    {
+        var validAddresses = new HashSet<uint>(instructions.Select(i => i.Address));
+        var instructionsByAddress = instructions.ToDictionary(i => i.Address);
+        var result = new List<LiftedInstruction>(instructions.Count);
+        foreach (var ins in instructions)
+        {
+            var ir = LiftInstruction(
+                ins,
+                validAddresses,
+                instructionsByAddress,
+                allowUnsupported,
+                functionEntryPoint,
+                knownFunctionEntryPoints);
+            result.Add(new LiftedInstruction(ins, ir));
+        }
+        return result;
+    }
+
+    private static string NormalizeRegister(string name)
+    {
+        // Capstone sometimes reports condition register fields as the starting bit (e.g., cr28)
+        // instead of the field index (cr7). Normalize these so SSA sees consistent names.
+        if (name.StartsWith("cr", StringComparison.OrdinalIgnoreCase))
+        {
+            var rest = name.AsSpan(2);
+            if (int.TryParse(rest, NumberStyles.Integer, CultureInfo.InvariantCulture, out var val) && val >= 8)
+            {
+                return $"cr{val / 4}";
+            }
+        }
+
+        return name;
+    }
+
+    private static string RegisterOperandName(IReadOnlyList<PpcOperand> ops, int idx) =>
+        ops[idx] is PpcRegisterOperand r
+            ? NormalizeRegister(r.Name)
+            : throw new FormatException($"Operand {idx} is not a register");
+
+    private static int ImmediateOperandValue(IReadOnlyList<PpcOperand> ops, int idx) => ops[idx] switch
+    {
+        PpcImmediateOperand imm => imm.Value,
+        _ => throw new FormatException($"Operand {idx} is not an immediate")
+    };
+
+    /// <summary>
+    /// EABI argument registers in call order. Shared across every call site since
+    /// <see cref="IrValue"/> is immutable and <c>IrCall.Arguments</c> is read-only.
+    /// </summary>
+    internal static readonly IrValue[] AbiCallArguments = BuildAbiCallArguments();
+
+    private static IrValue[] BuildAbiCallArguments()
+    {
+        var args = new IrValue[8 + 13];
+        var next = 0;
+        for (var i = 3; i <= 10; i++) args[next++] = IrValue.Register($"r{i}");
+        for (var i = 1; i <= 13; i++) args[next++] = IrValue.Register($"f{i}");
+        return args;
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftInstruction(
+        PpcInstruction ins,
+        HashSet<uint> validAddresses,
+        IReadOnlyDictionary<uint, PpcInstruction> instructionsByAddress,
+        bool allowUnsupported,
+        uint? functionEntryPoint,
+        IReadOnlySet<uint>? knownFunctionEntryPoints)
+    {
+        var mnemonic = ins.Mnemonic.ToLowerInvariant();
+        var ops = ins.Operands ?? Array.Empty<PpcOperand>();
+
+        // Local functions, not delegates: keeps the captured operand list in a by-ref struct
+        // closure instead of heap-allocating a closure object plus two delegates per instruction.
+        string Reg(int idx) => RegisterOperandName(ops, idx);
+        int Imm(int idx) => ImmediateOperandValue(ops, idx);
+
+        // Legacy string view to minimize churn in the existing switch body. The numeric helpers
+        // above should be used for anything that needs values, not parsing these strings.
+        var operands = ops.Select(o => NormalizeRegister(o.ToOperandString())).ToList();
+
+        var pairedSingle = TryLiftPairedSingle(ins, mnemonic, ops, operands);
+        if (pairedSingle != null)
+        {
+            return pairedSingle;
+        }
+
+        var floating = TryLiftFloating(ins, mnemonic, ops, operands);
+        if (floating != null)
+        {
+            return floating;
+        }
+
+        try
+        {
+            switch (mnemonic)
+            {
+            case "nop" when ops.Count == 0:
+                {
+                    //pass / ignore
+                    return Array.Empty<IrInstruction>();
+                }
+
+            case "li" when ops.Count == 2:
+                return new[] { new IrAssign(Reg(0), IrValue.Imm(SignExtend16(Imm(1)))) };
+
+            case "lis" when ops.Count == 2:
+                {
+                    // lis rD, SIMM -> rD = SIMM << 16
+                    var simm = Imm(1);
+                    return new[] { new IrAssign(Reg(0), IrValue.Imm(simm << 16)) };
+                }
+
+            case "addi" when ops.Count == 3:
+                return new[] { new IrBinary(Reg(0), BaseOrZero(Reg(1)), IrValue.Imm(SignExtend16(Imm(2))), "add") };
+
+            case "mr":
+            case "or" when operands.Count == 3 && operands[1] == operands[2]:
+                return new[] { new IrAssign(Reg(0), IrValue.Register(Reg(1))) };
+
+            case "or" when operands.Count == 3:
+            case "or." when operands.Count == 3:
+                return BinWithCrFlag(Reg(0), IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), "or", mnemonic.EndsWith('.'));
+
+            case "orc" when operands.Count == 3:
+            case "orc." when operands.Count == 3:
+                return BinWithCrFlag(Reg(0), IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), "orc", mnemonic.EndsWith('.'));
+
+            case "oris" when operands.Count == 3:
+                {
+                    var uimm = MaskUimm(Imm(2)) << 16;
+                    return new[] { new IrBinary(Reg(0), IrValue.Register(Reg(1)), IrValue.Imm(uimm), "or") };
+                }
+
+            case "xoris" when operands.Count == 3:
+                {
+                    var uimm = MaskUimm(Imm(2)) << 16;
+                    return new[] { new IrBinary(Reg(0), IrValue.Register(Reg(1)), IrValue.Imm(uimm), "xor") };
+                }
+
+            case "xori" when operands.Count == 3:
+                {
+                    var uimm = Imm(2) & 0xFFFF;
+                    return new[] { new IrBinary(Reg(0), IrValue.Register(Reg(1)), IrValue.Imm(uimm), "xor") };
+                }
+
+            case "xori." when operands.Count == 3:
+                {
+                    var uimm = Imm(2) & 0xFFFF;
+                    return BinWithCrFlag(Reg(0), IrValue.Register(Reg(1)), IrValue.Imm(uimm), "xor", true);
+                }
+
+            case "mfcr" when operands.Count == 1:
+                return new[] { new IrAssign(operands[0], IrValue.Register("cr")) };
+
+            case "sync":
+            case "isync":
+            case "eieio":
+            case "xo_598": // sync
+                // Memory barrier/sync instructions - no-op in HLE (no real cache)
+                return new[] { new IrComment($"{mnemonic} @ 0x{ins.Address:X8} (no-op)") };
+
+            case "addc" when operands.Count == 3:
+            case "addc." when operands.Count == 3:
+                {
+                    var dest = Reg(0);
+                    var left = Reg(1);
+                    var right = Reg(2);
+                    var instructions = new List<IrInstruction>();
+                    var leftValue = PreserveIfAliased(dest, left, "addc_left", instructions);
+                    var rightValue = PreserveIfAliased(dest, right, "addc_right", instructions);
+
+                    instructions.Add(new IrBinary(dest, IrValue.Register(leftValue), IrValue.Register(rightValue), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(leftValue),
+                        IrValue.Register(rightValue),
+                        IrValue.Imm(0)
+                    }));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "addco" when operands.Count == 3:
+            case "addco." when operands.Count == 3:
+                return CallBinaryWithCr(Reg(0), "PPC_Addco", Reg(1), Reg(2), mnemonic.EndsWith('.'));
+
+            case "subfc" when operands.Count == 3:
+            case "subfc." when operands.Count == 3:
+                {
+                    // subfc rD, rA, rB -> rD = rB - rA, CA = carry from subtraction (1 when no borrow)
+                    var dest = Reg(0);
+                    var minuend = Reg(2);   // rB
+                    var subtrahend = Reg(1); // rA
+                    var instructions = new List<IrInstruction>();
+                    var minuendValue = PreserveIfAliased(dest, minuend, "subfc_min", instructions);
+                    var subtrahendValue = PreserveIfAliased(dest, subtrahend, "subfc_sub", instructions);
+
+                    instructions.Add(new IrBinary(dest, IrValue.Register(minuendValue), IrValue.Register(subtrahendValue), "sub"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarrySub", new[]
+                    {
+                        IrValue.Register(minuendValue),
+                        IrValue.Register(subtrahendValue)
+                    }));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "subfco" when operands.Count == 3:
+            case "subfco." when operands.Count == 3:
+                return CallBinaryWithCr(Reg(0), "PPC_Subfco", Reg(1), Reg(2), mnemonic.EndsWith('.'));
+
+            case "lmw" when operands.Count == 2:
+                {
+                    var startReg = ParseRegisterNumber(operands[0]);
+                    var (offset, baseReg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>();
+                    for (int i = startReg; i <= 31; i++)
+                    {
+                        instructions.AddRange(DFormLoad($"r{i}", baseReg, offset + (i - startReg) * 4, 4));
+                    }
+                    return instructions;
+                }
+
+            case "srw" when operands.Count == 3:
+            case "srw." when operands.Count == 3:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var shReg = operands[2];
+
+                    var list = new List<IrInstruction>
+                    {
+                        new IrBinary(dest, IrValue.Register(src), IrValue.Register(shReg), "ppc_srw")
+                    };
+
+                    if (mnemonic.EndsWith('.'))
+                        list.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+
+                    return list;
+                }
+
+            case "divwu" when operands.Count == 3:
+            case "divwu." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "divu", mnemonic.EndsWith('.'));
+
+            case "divwuo" when operands.Count == 3:
+            case "divwuo." when operands.Count == 3:
+                return CallBinaryWithCr(Reg(0), "PPC_Divwuo", Reg(1), Reg(2), mnemonic.EndsWith('.'));
+
+            case "mullw" when operands.Count == 3:
+            case "mullw." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "mul", mnemonic.EndsWith('.'));
+
+            case "mullwo" when operands.Count == 3:
+            case "mullwo." when operands.Count == 3:
+                return CallBinaryWithCr(Reg(0), "PPC_Mullwo", Reg(1), Reg(2), mnemonic.EndsWith('.'));
+
+            case "lbzx" when operands.Count == 3:
+                {
+                    var rD = operands[0];
+                    var rA = operands[1];
+                    var rB = operands[2];
+                    var addr = $"{rA}_addr";
+                    return BuildIndexedAddress(rA, rB, addr, a => new[] { new IrLoad(rD, new IrAddress(a, 0), 1) });
+                }
+
+            case "lwarx" when operands.Count == 3:
+                {
+                    var addr = $"addr_lwarx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress(Reg(1), Reg(2), addr, a => new[]
+                    {
+                        new IrCall(Reg(0), "PPC_Lwarx", new[] { IrValue.Register(a) })
+                    });
+                }
+
+            case "lswx" when operands.Count == 3:
+                {
+                    var rD = ParseRegisterNumber(Reg(0));
+                    var addr = $"addr_lswx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress(Reg(1), Reg(2), addr, a => new[]
+                    {
+                        new IrCall(string.Empty, "PPC_Lswx", new[] { IrValue.Imm(rD), IrValue.Register(a) })
+                    });
+                }
+
+            case "lswi" when operands.Count == 3:
+                {
+                    var rD = ParseRegisterNumber(Reg(0));
+                    var rA = Reg(1);
+                    var nb = ParseImmediate(operands[2]);
+                    var addr = $"addr_lswi_{ins.Address:X8}_loc";
+                    IrInstruction address = rA == "r0"
+                        ? new IrAssign(addr, IrValue.Imm(0))
+                        : new IrAssign(addr, IrValue.Register(rA));
+                    return new IrInstruction[]
+                    {
+                        address,
+                        new IrCall(string.Empty, "PPC_Lswi", new[] { IrValue.Imm(rD), IrValue.Register(addr), IrValue.Imm(nb) })
+                    };
+                }
+
+            case "eciwx" when operands.Count == 3:
+                {
+                    var addr = $"addr_eciwx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress(Reg(1), Reg(2), addr, a => new[]
+                    {
+                        new IrCall(Reg(0), "PPC_Eciwx", new[] { IrValue.Register(a) })
+                    });
+                }
+
+            case "lbzux":
+            case "xo_119":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    if (rA == 0)
+                        throw new InvalidOperationException($"lbzux with rA=0 is invalid @ 0x{ins.Address:X8}");
+
+                    string addrReg = $"addr_lbzux_{ins.Address:X8}_loc";
+                    var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrLoad($"r{rD}", new IrAddress(addr, 0), 1)
+                    }));
+                    instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+                    return instructions;
+                }
+
+            case "stbx" when operands.Count == 3:
+                {
+                    var rS = operands[0];
+                    var rA = operands[1];
+                    var rB = operands[2];
+                    var addr = $"{rA}_addr";
+                    // FIX: Use BuildIndexedAddress to handle r0 correctly
+                    return BuildIndexedAddress(rA, rB, addr, a => new[] { new IrStore(new IrAddress(a, 0), IrValue.Register(rS), 1) });
+                }
+
+            case "stwcx." when operands.Count == 3:
+                {
+                    var addr = $"addr_stwcx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress(Reg(1), Reg(2), addr, a => new[]
+                    {
+                        new IrCall(string.Empty, "PPC_Stwcx", new[] { IrValue.Register(a), IrValue.Register(Reg(0)) })
+                    });
+                }
+
+            case "stswx" when operands.Count == 3:
+                {
+                    var rS = ParseRegisterNumber(Reg(0));
+                    var addr = $"addr_stswx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress(Reg(1), Reg(2), addr, a => new[]
+                    {
+                        new IrCall(string.Empty, "PPC_Stswx", new[] { IrValue.Imm(rS), IrValue.Register(a) })
+                    });
+                }
+
+            case "stswi" when operands.Count == 3:
+                {
+                    var rS = ParseRegisterNumber(Reg(0));
+                    var rA = Reg(1);
+                    var nb = ParseImmediate(operands[2]);
+                    var addr = $"addr_stswi_{ins.Address:X8}_loc";
+                    IrInstruction address = rA == "r0"
+                        ? new IrAssign(addr, IrValue.Imm(0))
+                        : new IrAssign(addr, IrValue.Register(rA));
+                    return new IrInstruction[]
+                    {
+                        address,
+                        new IrCall(string.Empty, "PPC_Stswi", new[] { IrValue.Imm(rS), IrValue.Register(addr), IrValue.Imm(nb) })
+                    };
+                }
+
+            case "ecowx" when operands.Count == 3:
+                {
+                    var addr = $"addr_ecowx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress(Reg(1), Reg(2), addr, a => new[]
+                    {
+                        new IrCall(string.Empty, "PPC_Ecowx", new[] { IrValue.Register(a), IrValue.Register(Reg(0)) })
+                    });
+                }
+
+            case "stbux":
+            case "xo_247":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+                    
+                    if (rA == 0)
+                    {
+                        throw new InvalidOperationException($"stbux with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    }
+
+                    string addrReg = $"addr_stbux_{ins.Address:X8}_loc";
+                    var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrStore(new IrAddress(addr, 0), IrValue.Register($"r{rS}"), 1)
+                    }));
+                    instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+                    return instructions;
+                }
+
+            case "extsb" when operands.Count == 2:
+            case "extsb." when operands.Count == 2:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Imm(8), "sext", mnemonic.EndsWith('.'));
+
+            case "adde" when operands.Count == 3:
+            case "adde." when operands.Count == 3:
+                {
+                    var dest = operands[0];
+                    var left = operands[1];
+                    var right = operands[2];
+                    var carry = $"{dest}_ca";
+
+                    var instructions = new List<IrInstruction>();
+                    var leftValue = PreserveIfAliased(dest, left, "adde_left", instructions);
+                    var rightValue = PreserveIfAliased(dest, right, "adde_right", instructions);
+
+                    instructions.Add(new IrCall(carry, "PPC_GetCarry", Array.Empty<IrValue>()));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(leftValue), IrValue.Register(rightValue), "add"));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(dest), IrValue.Register(carry), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(leftValue),
+                        IrValue.Register(rightValue),
+                        IrValue.Register(carry)
+                    }));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "addeo" when operands.Count == 3:
+            case "addeo." when operands.Count == 3:
+                return CallBinaryWithCr(Reg(0), "PPC_Addeo", Reg(1), Reg(2), mnemonic.EndsWith('.'));
+
+            case "addze" when operands.Count == 2:
+            case "addze." when operands.Count == 2:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var carry = $"{dest}_ca";
+
+                    var instructions = new List<IrInstruction>();
+                    var srcValue = PreserveIfAliased(dest, src, "addze_src", instructions);
+
+                    instructions.Add(new IrCall(carry, "PPC_GetCarry", Array.Empty<IrValue>()));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(srcValue), IrValue.Register(carry), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(srcValue),
+                        IrValue.Imm(0),
+                        IrValue.Register(carry)
+                    }));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "addzeo" when operands.Count == 2:
+            case "addzeo." when operands.Count == 2:
+                return CallUnaryWithCr(Reg(0), "PPC_Addzeo", Reg(1), mnemonic.EndsWith('.'));
+
+            case "addme" when operands.Count == 2:
+            case "addme." when operands.Count == 2:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var carry = $"{dest}_ca";
+
+                    var instructions = new List<IrInstruction>();
+                    var srcValue = PreserveIfAliased(dest, src, "addme_src", instructions);
+
+                    instructions.Add(new IrCall(carry, "PPC_GetCarry", Array.Empty<IrValue>()));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(srcValue), IrValue.Imm(-1), "add"));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(dest), IrValue.Register(carry), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(srcValue),
+                        IrValue.Imm(-1),
+                        IrValue.Register(carry)
+                    }));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "addmeo" when operands.Count == 2:
+            case "addmeo." when operands.Count == 2:
+                return CallUnaryWithCr(Reg(0), "PPC_Addmeo", Reg(1), mnemonic.EndsWith('.'));
+
+            case "subfze" when operands.Count == 2:
+            case "subfze." when operands.Count == 2:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var tmpNot = $"{dest}_not";
+                    var carry = $"{dest}_ca";
+
+                    var instructions = new List<IrInstruction>();
+                    var srcValue = PreserveIfAliased(dest, src, "subfze_src", instructions);
+
+                    instructions.Add(new IrBinary(tmpNot, IrValue.Register(srcValue), IrValue.Imm(0), "not"));
+                    instructions.Add(new IrCall(carry, "PPC_GetCarry", Array.Empty<IrValue>()));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(tmpNot), IrValue.Register(carry), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(tmpNot),
+                        IrValue.Register(carry),
+                        IrValue.Imm(0)
+                    }));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "subfzeo" when operands.Count == 2:
+            case "subfzeo." when operands.Count == 2:
+                return CallUnaryWithCr(Reg(0), "PPC_Subfzeo", Reg(1), mnemonic.EndsWith('.'));
+
+            case "subfme" when operands.Count == 2:
+            case "subfme." when operands.Count == 2:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var tmpNot = $"{dest}_not";
+                    var carry = $"{dest}_ca";
+
+                    var instructions = new List<IrInstruction>();
+                    var srcValue = PreserveIfAliased(dest, src, "subfme_src", instructions);
+
+                    instructions.Add(new IrBinary(tmpNot, IrValue.Register(srcValue), IrValue.Imm(0), "not"));
+                    instructions.Add(new IrCall(carry, "PPC_GetCarry", Array.Empty<IrValue>()));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(tmpNot), IrValue.Imm(-1), "add"));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(dest), IrValue.Register(carry), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(tmpNot),
+                        IrValue.Imm(-1),
+                        IrValue.Register(carry)
+                    }));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "subfmeo" when operands.Count == 2:
+            case "subfmeo." when operands.Count == 2:
+                return CallUnaryWithCr(Reg(0), "PPC_Subfmeo", Reg(1), mnemonic.EndsWith('.'));
+
+            case "dcbz_l" when operands.Count == 2:
+            case "dcbz" when operands.Count == 2:
+                {
+                    var rA = operands[0];
+                    var rB = operands[1];
+                    var addrReg = $"{rB}_addr_dcbz";
+
+                    // If rA is r0, EA = rB, otherwise EA = rA + rB
+                    IrInstruction addrCalc = rA == "r0"
+                        ? new IrAssign(addrReg, IrValue.Register(rB))
+                        : new IrBinary(addrReg, IrValue.Register(rA), IrValue.Register(rB), "add");
+
+                    var aligned = $"{addrReg}_al";
+                    return new IrInstruction[]
+                    {
+                        addrCalc,
+                        new IrBinary(aligned, IrValue.Register(addrReg), IrValue.Imm(unchecked((int)~31)), "and"),
+                        new IrCall(string.Empty, "memset_zero_32", new[] { IrValue.Register(aligned) })
+                    };
+                }
+
+            case "icbi":
+            case "dcbi":
+            case "dcbf":
+                // Cache invalidate/flush - no-op in HLE (no real cache)
+                return new[] { new IrComment($"{mnemonic} @ 0x{ins.Address:X8} (no-op)") };
+
+            case "lfd" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormLoad(operands[0], reg, offset, 8);
+                }
+
+            case "lfdu" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    var addr = $"{reg}_addr";
+                    var instructions = new List<IrInstruction>();
+                    if (reg == "r0")
+                        throw new InvalidOperationException($"lfdu with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    instructions.Add(new IrBinary(addr, IrValue.Register(reg), IrValue.Imm(offset), "add"));
+                    instructions.Add(new IrLoad(operands[0], new IrAddress(addr, 0), 8));
+                    instructions.Add(new IrAssign(reg, IrValue.Register(addr)));
+                    return instructions;
+                }
+
+            case "lfs" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormLoad(operands[0], reg, offset, 4);
+                }
+
+            case "lfsu" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>();
+                    if (reg == "r0")
+                        throw new InvalidOperationException($"lfsu with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    instructions.Add(new IrBinary(reg, IrValue.Register(reg), IrValue.Imm(offset), "add"));
+                    instructions.Add(new IrLoad(operands[0], new IrAddress(reg, 0), 4));
+                    return instructions;
+                }
+
+
+            case "rfi":
+                // Return From Interrupt: in HLE, treat as return since exception vectors
+                // are typically stubbed. The OS would restore state from context.
+                return new[] { new IrReturn(null) };
+
+            case "neg" when operands.Count == 2:
+            case "neg." when operands.Count == 2:
+                return BinWithCrFlag(operands[0], IrValue.Imm(0), IrValue.Register(operands[1]), "sub", mnemonic.EndsWith('.'));
+
+            case "nego" when operands.Count == 2:
+            case "nego." when operands.Count == 2:
+                return CallUnaryWithCr(Reg(0), "PPC_Nego", Reg(1), mnemonic.EndsWith('.'));
+
+            case "cmpw" or "cmpd" when operands.Count == 2:
+                return LiftCompare("cr0", IrValue.Register(operands[0]), IrValue.Register(operands[1]), "sub", isUnsigned: false);
+
+            case "cmpw" or "cmpd" when operands.Count == 3:
+                return LiftCompare(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "sub", isUnsigned: false);
+
+            case "bcctr":
+            case "bcctrl":
+                {
+                    var rawInstr = ReadRawInstruction(ins);
+                    var bo = (int)((rawInstr >> 21) & 0x1F);
+                    var bi = (int)((rawInstr >> 16) & 0x1F);
+                    var fallthrough = $"0x{ins.EndAddress:X8}";
+                    var targetLabel = mnemonic == "bcctr"
+                        ? $"indirect_ctr_{ins.Address:X8}"
+                        : $"call_ctr_{ins.Address:X8}_{ins.EndAddress:X8}";
+
+                    return new[] { new IrBranch("raw", targetLabel, fallthrough, BuildBoConditionExpression(bo, bi, allowCtr: false)) };
+                }
+
+            case "bctr":
+                if (ins.BranchTargets.Count > 0)
+                {
+                    var cases = ins.BranchTargets
+                        .Distinct()
+                        .Select(addr => new IrJumpTableCase(addr, $"0x{addr:X8}"))
+                        .ToList();
+                    return new IrInstruction[] { new IrJumpTable("ctr", cases) };
+                }
+
+                // bctr (without link) is an indirect JUMP, not a call.
+                // Typically used for switch statements jumping within the same function.
+                return new[] { new IrIndirectJump(IrValue.Register("ctr")) };
+
+            case "ori" when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Imm(MaskUimm(ParseImmediate(operands[2]))), "or") };
+
+            case "nor" when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "nor") };
+
+            case "nand" when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "nand") };
+
+            case "nand." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "nand", true);
+
+            case "eqv" when operands.Count == 3:
+            case "eqv." when operands.Count == 3:
+                return BinWithCrFlag(Reg(0), IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), "eqv", mnemonic.EndsWith('.'));
+
+            case "mfdar" when operands.Count == 1:
+                return new[] { new IrAssign(operands[0], IrValue.Imm(0)) };
+
+            case "mfmsr" when operands.Count == 1:
+                return new[] { new IrAssign(operands[0], IrValue.Register("msr")) };
+
+            case "mfpvr" when operands.Count == 1:
+                return new[] { new IrAssign(operands[0], IrValue.Imm(0)) };
+
+            case "mfdsisr" when operands.Count == 1:
+                return new[] { new IrAssign(operands[0], IrValue.Imm(0)) };
+
+            case "mtcrf" when operands.Count == 2:
+                {
+                    var crm = ParseImmediate(operands[0]);
+                    return LiftMtcrfMasked(crm, operands[1]);
+                }
+
+            case "mcrxr" when operands.Count == 1:
+                return new[] { new IrCall("cr", "PPC_Mcrxr", new[] { IrValue.Imm(ParseCrFieldName(operands[0])) }) };
+
+            case "mcrfs" when operands.Count == 2:
+                return new[] { new IrCall("cr", "PPC_Mcrfs", new[] { IrValue.Imm(ParseCrFieldName(operands[0])), IrValue.Imm(ParseCrFieldName(operands[1])) }) };
+
+            case "extsh" when operands.Count == 2:
+            case "extsh." when operands.Count == 2:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Imm(16), "sext", mnemonic.EndsWith('.'));
+
+            case "sraw" when operands.Count == 3:
+            case "sraw." when operands.Count == 3:
+                {
+                    var rA = operands[0];
+                    var rS = operands[1];
+                    var rB = operands[2];
+                    var instructions = new List<IrInstruction>();
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryShiftRight", new[]
+                    {
+                        IrValue.Register(rS),
+                        IrValue.Register(rB)
+                    }));
+                    instructions.Add(new IrBinary(rA, IrValue.Register(rS), IrValue.Register(rB), "ppc_sraw"));
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(rA), IrValue.Imm(0), false));
+                    }
+                    return instructions;
+                }
+
+            case "crclr" when operands.Count == 1:
+                {
+                    var bit = ParseCrBitIndex(operands[0]);
+                    return new[]
+                    {
+                        new IrCall("cr", "PPC_CrSetBit", new[]
+                        {
+                            IrValue.Imm(bit),
+                            IrValue.Imm(0)
+                        })
+                    };
+                }
+
+            case "mcrf" when operands.Count == 2:
+                {
+                    var destField = ParseCrFieldName(operands[0]);
+                    var srcField = ParseCrFieldName(operands[1]);
+                    return new[]
+                    {
+                        new IrCall("cr", "PPC_Mcrf", new[]
+                        {
+                            IrValue.Imm(destField),
+                            IrValue.Imm(srcField)
+                        })
+                    };
+                }
+
+            case "crnor":
+            case "crandc":
+            case "crxor":
+            case "crnand":
+            case "crand":
+            case "creqv":
+            case "crorc":
+            case "cror":
+                return LiftCrLogical(mnemonic, operands[0], operands[1], operands[2]);
+
+            case "lwz" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormLoad(operands[0], reg, offset, 4);
+                }
+
+            case "stw" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormStore(reg, offset, IrValue.Register(operands[0]), 4);
+                }
+
+            case "stwu" when operands.Count == 2:
+                {
+                    // stwu rS, d(rA) -> Store rS at d(rA), then rA = rA + d
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>(DFormStore(reg, offset, IrValue.Register(operands[0]), 4));
+                    if (reg == "r0")
+                        throw new InvalidOperationException($"stwu with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    instructions.Add(new IrBinary(reg, IrValue.Register(reg), IrValue.Imm(offset), "add"));
+                    return instructions;
+                }
+
+            case "cmplwi" when operands.Count >= 2:
+                {
+                    var dest = operands.Count == 3 ? operands[0] : "cr0";
+                    var rA = operands.Count == 3 ? operands[1] : operands[0];
+                    var uimm = operands.Count == 3 ? operands[2] : operands[1];
+                    return LiftCompare(dest, IrValue.Register(rA), IrValue.Imm(MaskUimm(ParseImmediate(uimm))), "sub_u", isUnsigned: true);
+                }
+
+            case "cmpwi" when operands.Count >= 2:
+                {
+                    var dest = operands.Count == 3 ? operands[0] : "cr0";
+                    var rA = operands.Count == 3 ? operands[1] : operands[0];
+                    var simm = operands.Count == 3 ? operands[2] : operands[1];
+                    return LiftCompare(dest, IrValue.Register(rA), IrValue.Imm(SignExtend16(ParseImmediate(simm))), "sub", isUnsigned: false);
+                }
+
+            case "cmplw" when operands.Count == 2:
+                return LiftCompare("cr0", IrValue.Register(operands[0]), IrValue.Register(operands[1]), "sub_u", isUnsigned: true);
+
+            case "cmplw" when operands.Count == 3:
+                return LiftCompare(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "sub_u", isUnsigned: true);
+
+            case "mficcr" when operands.Count == 1:
+                return new[] { new IrAssign(operands[0], IrValue.Register("iccr")) };
+
+            case "mticcr" when operands.Count == 1:
+                throw new NotImplementedException($"UNIMPLEMENTED instruction '{mnemonic} {operands[0]}' @ 0x{ins.Address:X8}");
+
+            case "mttbu" when operands.Count == 1:
+                throw new NotImplementedException($"UNIMPLEMENTED instruction '{mnemonic} {operands[0]}' @ 0x{ins.Address:X8}");
+
+            case "mttbl" when operands.Count == 1:
+                throw new NotImplementedException($"UNIMPLEMENTED instruction '{mnemonic} {operands[0]}' @ 0x{ins.Address:X8}");
+
+            case "mtdar" when operands.Count == 1:
+                throw new NotImplementedException($"UNIMPLEMENTED instruction '{mnemonic} {operands[0]}' @ 0x{ins.Address:X8}");
+
+            case "mtdsisr" when operands.Count == 1:
+                throw new NotImplementedException($"UNIMPLEMENTED instruction '{mnemonic} {operands[0]}' @ 0x{ins.Address:X8}");
+
+            case "mfibatu" when operands.Count == 2:
+                return new[] { new IrAssign(operands[0], IrValue.Imm(0)) };
+
+            case "mtibatu" when operands.Count == 2:
+            case "mtibatl" when operands.Count == 2:
+            case "mtdbatu" when operands.Count == 2:
+            case "mtdbatl" when operands.Count == 2:
+                throw new NotImplementedException($"UNIMPLEMENTED instruction '{mnemonic} {operands[0]}, {operands[1]}' @ 0x{ins.Address:X8}");
+
+            case "mfibatl" when operands.Count == 2:
+            case "mfdbatu" when operands.Count == 2:
+            case "mfdbatl" when operands.Count == 2:
+                return new[] { new IrAssign(operands[0], IrValue.Imm(0)) };
+
+            case "mtxer" when operands.Count == 1:
+                return new[] { new IrAssign("xer", IrValue.Register(operands[0])) };
+
+            case "mfxer" when operands.Count == 1:
+                return new[] { new IrAssign(operands[0], IrValue.Register("xer")) };
+
+            case "divw" when operands.Count == 3:
+            case "divw." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "div", mnemonic.EndsWith('.'));
+
+            case "divwo" when operands.Count == 3:
+            case "divwo." when operands.Count == 3:
+                return CallBinaryWithCr(Reg(0), "PPC_Divwo", Reg(1), Reg(2), mnemonic.EndsWith('.'));
+
+            case "lha" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>(DFormLoad(operands[0], reg, offset, 2))
+                    {
+                        new IrBinary(operands[0], IrValue.Register(operands[0]), IrValue.Imm(16), "shl"),
+                        new IrBinary(operands[0], IrValue.Register(operands[0]), IrValue.Imm(16), "sar")
+                    };
+                    return instructions;
+                }
+
+            case "lhau":
+            case "opc_43":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    short d = (short)(rawInstr & 0xFFFF);
+
+                    if (rA == 0)
+                        throw new InvalidOperationException($"lhau with rA=0 is invalid @ 0x{ins.Address:X8}");
+
+                    // EA = (rA) + d -> update rA
+                    // rD = EXTS(MEM(EA, 2))
+                    
+                    return new IrInstruction[] 
+                    {
+                        new IrBinary($"r{rA}", IrValue.Register($"r{rA}"), IrValue.Imm(d), "add"),
+                        new IrLoad($"r{rD}", new IrAddress($"r{rA}", 0), 2),
+                        new IrBinary($"r{rD}", IrValue.Register($"r{rD}"), IrValue.Imm(16), "shl"),
+                        new IrBinary($"r{rD}", IrValue.Register($"r{rD}"), IrValue.Imm(16), "sar")
+                    };
+                }
+
+            case "lhz" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormLoad(operands[0], reg, offset, 2);
+                }
+
+            case "lhzu" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>();
+                    if (reg == "r0")
+                        throw new InvalidOperationException($"lhzu with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    instructions.Add(new IrBinary(reg, IrValue.Register(reg), IrValue.Imm(offset), "add"));
+                    instructions.Add(new IrLoad(operands[0], new IrAddress(reg, 0), 2));
+                    return instructions;
+                }
+
+            case "lbz" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormLoad(operands[0], reg, offset, 1);
+                }
+
+            case "lbzu" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>();
+                    if (reg == "r0")
+                        throw new InvalidOperationException($"lbzu with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    instructions.Add(new IrBinary(reg, IrValue.Register(reg), IrValue.Imm(offset), "add"));
+                    instructions.Add(new IrLoad(operands[0], new IrAddress(reg, 0), 1));
+                    return instructions;
+                }
+
+            case "stb" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormStore(reg, offset, IrValue.Register(operands[0]), 1);
+                }
+
+            case "stbu" when operands.Count == 2:
+                {
+                    // stbu rS, d(rA) -> EA = (rA) + d, MEM(EA, 1) = rS, rA = EA
+                    // Fix: compute EA into temp first to preserve rS if rS == rA
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    if (reg == "r0")
+                        throw new InvalidOperationException($"stbu with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    var ea = $"{reg}_stbu_ea";
+                    return new IrInstruction[]
+                    {
+                        new IrBinary(ea, IrValue.Register(reg), IrValue.Imm(offset), "add"),
+                        new IrStore(new IrAddress(ea, 0), IrValue.Register(operands[0]), 1),
+                        new IrAssign(reg, IrValue.Register(ea))
+                    };
+                }
+
+            case "mtmsr" when operands.Count == 1:
+                return new[] { new IrAssign("msr", IrValue.Register(operands[0])) };
+
+            case "sth" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormStore(reg, offset, IrValue.Register(operands[0]), 2);
+                }
+
+            case "sthu" when operands.Count == 2:
+                {
+                    // sthu rS, d(rA) -> EA = (rA) + d, MEM(EA, 2) = rS, rA = EA
+                    // Fix: compute EA into temp first to preserve rS if rS == rA
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    if (reg == "r0")
+                        throw new InvalidOperationException($"sthu with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    var ea = $"{reg}_sthu_ea";
+                    return new IrInstruction[]
+                    {
+                        new IrBinary(ea, IrValue.Register(reg), IrValue.Imm(offset), "add"),
+                        new IrStore(new IrAddress(ea, 0), IrValue.Register(operands[0]), 2),
+                        new IrAssign(reg, IrValue.Register(ea))
+                    };
+                }
+
+            case "stmw" when operands.Count == 2:
+                {
+                    var startReg = ParseRegisterNumber(operands[0]);
+                    var (offset, baseReg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>();
+                    for (int i = startReg; i <= 31; i++)
+                    {
+                        instructions.AddRange(DFormStore(baseReg, offset + (i - startReg) * 4, IrValue.Register($"r{i}"), 4));
+                    }
+                    return instructions;
+                }
+
+            case "opc_29": // andis. (opcode 0x1D) not decoded by disassembler
+                {
+                    // andis. rA, rS, UIMM -> rA = rS & (UIMM << 16), sets CR0
+                    uint rawInstr29 = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr29 >> 21) & 0x1F);
+                    int rA = (int)((rawInstr29 >> 16) & 0x1F);
+                    int uimm = (int)(rawInstr29 & 0xFFFF);
+                    int shifted = uimm << 16;
+
+                    return BinWithCrFlag($"r{rA}", IrValue.Register($"r{rS}"), IrValue.Imm(shifted), "and", true);
+                }
+
+            case "opc_45": // sthu (opcode 0x2D) not decoded by disassembler
+                {
+                    // sthu rS, d(rA) -> EA = (rA) + d, MEM(EA, 2) = rS, rA = EA
+                    // Fix: compute EA into temp first to preserve rS if rS == rA
+                    uint rawInstr45 = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr45 >> 21) & 0x1F);
+                    int rA = (int)((rawInstr45 >> 16) & 0x1F);
+                    int d = (short)(rawInstr45 & 0xFFFF);
+
+                    string baseReg = $"r{rA}";
+                    string ea = $"{baseReg}_sthu_ea";
+                    return new IrInstruction[]
+                    {
+                        new IrBinary(ea, IrValue.Register(baseReg), IrValue.Imm(d), "add"),
+                        new IrStore(new IrAddress(ea, 0), IrValue.Register($"r{rS}"), 2),
+                        new IrAssign(baseReg, IrValue.Register(ea))
+                    };
+                }
+
+            case "slwi" when operands.Count == 3:
+            case "slwi." when operands.Count == 3:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var shift = ParseImmediate(operands[2]);
+                    return BinWithCrFlag(dest, IrValue.Register(src), IrValue.Imm(shift), "shl", mnemonic.EndsWith('.'));
+                }
+
+            case "addic" when operands.Count == 3:
+            case "addic." when operands.Count == 3:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var imm = SignExtend16(ParseImmediate(operands[2]));
+
+                    var instructions = new List<IrInstruction>();
+                    var srcValue = PreserveIfAliased(dest, src, "addic_src", instructions);
+
+                    instructions.Add(new IrBinary(dest, IrValue.Register(srcValue), IrValue.Imm(imm), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(srcValue),
+                        IrValue.Imm(imm),
+                        IrValue.Imm(0)
+                    }));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "subfe" when operands.Count == 3:
+            case "subfe." when operands.Count == 3:
+                // subfe rD, rA, rB -> rD = rB + ~rA + CA
+                {
+                    var dest = operands[0];
+                    var rA = operands[1];
+                    var rB = operands[2];
+                    var tmpNot = $"{dest}_not";
+                    var carry = $"{dest}_ca";
+
+                    var instructions = new List<IrInstruction>();
+                    var rBValue = PreserveIfAliased(dest, rB, "subfe_rb", instructions);
+
+                    instructions.Add(new IrBinary(tmpNot, IrValue.Register(rA), IrValue.Imm(0), "not"));
+                    instructions.Add(new IrCall(carry, "PPC_GetCarry", Array.Empty<IrValue>()));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(tmpNot), IrValue.Register(rBValue), "add"));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(dest), IrValue.Register(carry), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(tmpNot),
+                        IrValue.Register(rBValue),
+                        IrValue.Register(carry)
+                    }));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "subfeo" when operands.Count == 3:
+            case "subfeo." when operands.Count == 3:
+                return CallBinaryWithCr(Reg(0), "PPC_Subfeo", Reg(1), Reg(2), mnemonic.EndsWith('.'));
+
+            case "sthx" when operands.Count == 3:
+                {
+                    var rS = operands[0];
+                    var rA = operands[1];
+                    var rB = operands[2];
+                    var addr = $"{rA}_addr";
+                    // FIX: Use BuildIndexedAddress to handle r0 correctly
+                    return BuildIndexedAddress(rA, rB, addr, a => new[] { new IrStore(new IrAddress(a, 0), IrValue.Register(rS), 2) });
+                }
+
+
+            case "mfctr" when operands.Count == 1:
+                return new[] { new IrAssign(operands[0], IrValue.Register("ctr")) };
+
+            case "sc":
+                // System call; side effects only, no value.
+                return new[] { new IrCall(string.Empty, "OSSystemCall", Array.Empty<IrValue>()) };
+
+            case "addis" when operands.Count == 3:
+                {
+                    var imm = SignExtend16(ParseImmediate(operands[2])) << 16;
+                    return new[] { new IrBinary(operands[0], BaseOrZero(operands[1]), IrValue.Imm(imm), "add") };
+                }
+
+            case "lfdx":
+            case "xo_599":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    // lfdx frD, rA, rB -> Load double into float register D from address (rA|0) + rB
+                    // Use a unique temp variable to avoid corrupting rB if it's also used as the address reg
+                    string addrReg = $"addr_lfdx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[] 
+                    {
+                        new IrLoad($"f{rD}", new IrAddress(addr, 0), 8)
+                    });
+                }
+
+            case "lfdux":
+            case "xo_631":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    if (rA == 0)
+                        throw new InvalidOperationException($"lfdux with rA=0 is invalid @ 0x{ins.Address:X8}");
+
+                    string addrReg = $"addr_lfdux_{ins.Address:X8}_loc";
+                    var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrLoad($"f{rD}", new IrAddress(addr, 0), 8)
+                    }));
+                    instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+                    return instructions;
+                }
+
+            case "lfsx":
+            case "xo_535":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    string addrReg = $"addr_lfsx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[] 
+                    {
+                        new IrLoad($"f{rD}", new IrAddress(addr, 0), 4)
+                    });
+                }
+
+            case "lfsux":
+            case "xo_567":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    if (rA == 0)
+                        throw new InvalidOperationException($"lfsux with rA=0 is invalid @ 0x{ins.Address:X8}");
+
+                    // For update instructions, we need to use a temp then update rA
+                    string addrReg = $"addr_lfsux_{ins.Address:X8}_loc";
+                    var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrLoad($"f{rD}", new IrAddress(addr, 0), 4)
+                    }));
+                    instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+                    return instructions;
+                }
+
+            case "stfdx":
+            case "xo_727":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    string addrReg = $"addr_stfdx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[] 
+                    {
+                        new IrStore(new IrAddress(addr, 0), IrValue.Register($"f{rS}"), 8)
+                    });
+                }
+
+            case "stfdux":
+            case "xo_759":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    if (rA == 0)
+                        throw new InvalidOperationException($"stfdux with rA=0 is invalid @ 0x{ins.Address:X8}");
+
+                    string addrReg = $"addr_stfdux_{ins.Address:X8}_loc";
+                    var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrStore(new IrAddress(addr, 0), IrValue.Register($"f{rS}"), 8)
+                    }));
+                    instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+                    return instructions;
+                }
+
+            case "stfsx":
+            case "xo_663":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    string addrReg = $"addr_stfsx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[] 
+                    {
+                        new IrStore(new IrAddress(addr, 0), IrValue.Register($"f{rS}"), 4)
+                    });
+                }
+
+            case "stfsux":
+            case "xo_695":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    if (rA == 0)
+                        throw new InvalidOperationException($"stfsux with rA=0 is invalid @ 0x{ins.Address:X8}");
+
+                    // EA = (rA) + (rB) -> update rA
+                    // MEM(EA, 4) = fS
+                    
+                    return new IrInstruction[] 
+                    {
+                        new IrBinary($"r{rA}", IrValue.Register($"r{rA}"), IrValue.Register($"r{rB}"), "add"),
+                        new IrStore(new IrAddress($"r{rA}", 0), IrValue.Register($"f{rS}"), 4)
+                    };
+                }
+
+            case "sthux":
+            case "xo_439":
+                {
+                    // sthux rS, rA, rB -> EA = (rA) + (rB), MEM(EA, 2) = rS, rA = EA
+                    // Fix: compute EA into temp first to preserve rS if rS == rA
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    if (rA == 0)
+                        throw new InvalidOperationException($"sthux with rA=0 is invalid @ 0x{ins.Address:X8}");
+
+                    string addrReg = $"addr_sthux_{ins.Address:X8}_loc";
+                    var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrStore(new IrAddress(addr, 0), IrValue.Register($"r{rS}"), 2)
+                    }));
+                    instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+                    return instructions;
+                }
+
+            case "stfiwx":
+            case "xo_983":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    string addrReg = $"addr_stfiwx_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[] 
+                    {
+                        // Use dedicated helper that writes raw lower 32 bits, NOT float conversion
+                        new IrCall(string.Empty, "PPC_Stfiwx", new[] { IrValue.Register(addr), IrValue.Register($"f{rS}") })
+                    });
+                }
+                
+            case "add" when operands.Count == 3:
+            case "add." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "add", mnemonic.EndsWith('.'));
+
+            case "addo" when operands.Count == 3:
+            case "addo." when operands.Count == 3:
+                return CallBinaryWithCr(Reg(0), "PPC_Addo", Reg(1), Reg(2), mnemonic.EndsWith('.'));
+
+            case "clrlwi" when operands.Count == 3:
+            case "clrlwi." when operands.Count == 3:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var shift = ParseImmediate(operands[2]);
+                    var mask = unchecked((int)GetMask(shift, 31));
+
+                    var instructions = new List<IrInstruction>
+                    {
+                        // clrlwi clears the leftmost `shift` bits; no rotation occurs.
+                        new IrBinary(dest, IrValue.Register(src), IrValue.Imm(mask), "and")
+                    };
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "rlwinm" when operands.Count == 5:
+            case "rlwinm." when operands.Count == 5:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var sh = ParseImmediate(operands[2]);
+                    var mb = ParseImmediate(operands[3]);
+                    var me = ParseImmediate(operands[4]);
+                    var mask = GetMask(mb, me);
+
+                    var instructions = new List<IrInstruction>();
+                    var val = src;
+
+                    if (sh != 0)
+                    {
+                        var rot = $"{dest}_rot";
+                        instructions.Add(new IrBinary(rot, IrValue.Register(src), IrValue.Imm(sh), "rotl"));
+                        val = rot;
+                    }
+
+                    instructions.Add(new IrBinary(dest, IrValue.Register(val), IrValue.Imm(unchecked((int)mask)), "and"));
+                    
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "rlwimi" when operands.Count == 5:
+            case "rlwimi." when operands.Count == 5:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var sh = ParseImmediate(operands[2]);
+                    var mb = ParseImmediate(operands[3]);
+                    var me = ParseImmediate(operands[4]);
+                    var mask = unchecked((int)GetMask(mb, me));
+
+                    var instructions = new List<IrInstruction>();
+                    var val = src;
+
+                    if (sh != 0)
+                    {
+                        var rot = $"{dest}_rot";
+                        instructions.Add(new IrBinary(rot, IrValue.Register(src), IrValue.Imm(sh), "rotl"));
+                        val = rot;
+                    }
+
+                    // (rA & ~mask) | (rot & mask)
+                    var maskedRot = $"{dest}_mrot";
+                    var maskedDest = $"{dest}_mdest";
+                    instructions.Add(new IrBinary(maskedRot, IrValue.Register(val), IrValue.Imm(mask), "and"));
+                    instructions.Add(new IrBinary(maskedDest, IrValue.Register(dest), IrValue.Imm(~mask), "and"));
+                    instructions.Add(new IrBinary(dest, IrValue.Register(maskedDest), IrValue.Register(maskedRot), "or"));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "rlwnm" when operands.Count == 5:
+            case "rlwnm." when operands.Count == 5:
+                {
+                    // rlwnm rA, rS, rB, MB, ME
+                    // rA = rotl32(rS, rB[27:31]) & MASK(MB, ME)
+                    // Uses register rB for rotation amount (only low 5 bits used)
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var shiftReg = operands[2];  // Register containing shift amount
+                    var mb = ParseImmediate(operands[3]);
+                    var me = ParseImmediate(operands[4]);
+                    var mask = unchecked((int)GetMask(mb, me));
+
+                    var instructions = new List<IrInstruction>();
+
+                    var rot = $"{dest}_rot";
+                    instructions.Add(new IrBinary(rot, IrValue.Register(src), IrValue.Register(shiftReg), "rotl"));
+
+                    // Apply mask
+                    instructions.Add(new IrBinary(dest, IrValue.Register(rot), IrValue.Imm(mask), "and"));
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "mfspr" when operands.Count == 2:
+                {
+                    var dest = operands[0];
+                    var spr = ParseImmediate(operands[1]);
+
+                    switch (spr)
+                    {
+                        case 8: return new[] { new IrAssign(dest, IrValue.Register("lr")) };
+                        case 9: return new[] { new IrAssign(dest, IrValue.Register("ctr")) };
+                        case 1: return new[] { new IrAssign(dest, IrValue.Register("xer")) };
+                        case >= 912 and <= 919: return new[] { new IrAssign(dest, IrValue.Register($"gqr{spr - 912}")) };
+                        case 920: return new[] { new IrAssign(dest, IrValue.Register("hid2")) };
+                        case 1008: return new[] { new IrAssign(dest, IrValue.Register("hid0")) };
+                        case 1009: return new[] { new IrAssign(dest, IrValue.Register("hid1")) };
+                        case 26: return new[] { new IrAssign(dest, IrValue.Register("srr0")) };
+                        case 27: return new[] { new IrAssign(dest, IrValue.Register("srr1")) };
+                    }
+
+                    return new IrInstruction[]
+                    {
+                        new IrComment($"mfspr {spr} unsupported @ 0x{ins.Address:X8}"),
+                        new IrCall(dest, "PPC_ReadSpr", new[] { IrValue.Imm(spr) })
+                    };
+                }
+
+            case "mtspr" when operands.Count == 2:
+                {
+                    var spr = ParseImmediate(operands[0]);
+                    var src = operands[1];
+
+                    switch (spr)
+                    {
+                        case 8: return new[] { new IrAssign("lr", IrValue.Register(src)) };
+                        case 9: return new[] { new IrAssign("ctr", IrValue.Register(src)) };
+                        case 1: return new[] { new IrAssign("xer", IrValue.Register(src)) };
+                        case >= 912 and <= 919: return new[] { new IrAssign($"gqr{spr - 912}", IrValue.Register(src)) };
+                        case 26: return new[] { new IrAssign("srr0", IrValue.Register(src)) };
+                        case 27: return new[] { new IrAssign("srr1", IrValue.Register(src)) };
+                        // HID registers (hardware implementation dependent)
+                        case 920: return new[] { new IrAssign("hid2", IrValue.Register(src)) };
+                        case 1008: return new[] { new IrAssign("hid0", IrValue.Register(src)) };
+                        case 1009: return new[] { new IrAssign("hid1", IrValue.Register(src)) };
+                        // Debug/Breakpoint registers - delegate to runtime helper (no-op in HLE)
+                        case 22:   // DEC (Decrementer)
+                        case 1010: // IABR (Instruction Address Breakpoint Register)
+                        case 1011: // HID4 / L2CR
+                        case 1013: // DABR (Data Address Breakpoint Register)
+                        case 1017: // L2CR/DMA ancillary
+                        case 952:  // PMC1-4 Performance counters
+                        case 953:
+                        case 954:
+                        case 956:
+                        case 957:
+                        case 958:
+                        // SPRG0-7 (Software Program Registers - OS scratch space)
+                        case >= 272 and <= 279:
+                        // MSR (Machine State Register)
+                        case 16:
+                            return new IrInstruction[]
+                            {
+                                new IrComment($"mtspr {spr} (privileged/OS register) @ 0x{ins.Address:X8}"),
+                                new IrCall(string.Empty, "PPC_WriteSpr", new[] { IrValue.Imm(spr), IrValue.Register(src) })
+                            };
+                    }
+
+                    // Any other SPR write is delegated to the runtime helper.
+                    // The runtime will log a warning and shadow the value for reads.
+                    return new IrInstruction[]
+                    {
+                        new IrComment($"mtspr {spr} (unknown SPR) @ 0x{ins.Address:X8}"),
+                        new IrCall(string.Empty, "PPC_WriteSpr", new[] { IrValue.Imm(spr), IrValue.Register(src) })
+                    };
+                }
+
+            case "mtsr" when operands.Count == 2:
+                {
+                    var sr = ParseImmediate(operands[0]);
+                    // Move To Segment Register - no-op in HLE (no real MMU)
+                    return new[] { new IrComment($"mtsr {sr} @ 0x{ins.Address:X8} (no-op)") };
+                }
+
+            case "mtsrin" when operands.Count == 2:
+                return new[] { new IrComment($"mtsrin @ 0x{ins.Address:X8} (no-op)") };
+
+            case "mfsr" when operands.Count == 2:
+                {
+                    var dest = operands[0];
+                    var sr = ParseImmediate(operands[1]);
+                    return new[] { new IrAssign(dest, IrValue.Imm(0)) };
+                }
+
+            case "mfsrin" when operands.Count == 2:
+                return new[] { new IrAssign(operands[0], IrValue.Imm(0)) };
+
+
+            case "stfd" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormStore(reg, offset, IrValue.Register(operands[0]), 8);
+                }
+
+            case "stfdu" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>();
+                    if (reg == "r0")
+                        throw new InvalidOperationException("stfdu with rA=0 is invalid");
+                    instructions.Add(new IrBinary(reg, IrValue.Register(reg), IrValue.Imm(offset), "add"));
+                    instructions.Add(new IrStore(new IrAddress(reg, 0), IrValue.Register(operands[0]), 8));
+                    return instructions;
+                }
+
+            case "stfs" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    return DFormStore(reg, offset, IrValue.Register(operands[0]), 4);
+                }
+
+            case "stfsu" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>();
+                    if (reg == "r0")
+                        throw new InvalidOperationException("stfsu with rA=0 is invalid");
+                    instructions.Add(new IrBinary(reg, IrValue.Register(reg), IrValue.Imm(offset), "add"));
+                    instructions.Add(new IrStore(new IrAddress(reg, 0), IrValue.Register(operands[0]), 4));
+                    return instructions;
+                }
+
+            case "stwux" when operands.Count == 3:
+                {
+                    var rS = operands[0];
+                    var rA = operands[1];
+                    var rB = operands[2];
+                    var addr = $"{rA}_addr";
+                    if (rA == "r0")
+                        throw new InvalidOperationException($"stwux with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    return new IrInstruction[]
+                    {
+                        new IrBinary(addr, IrValue.Register(rA), IrValue.Register(rB), "add"),
+                        new IrStore(new IrAddress(addr, 0), IrValue.Register(rS), 4),
+                        new IrAssign(rA, IrValue.Register(addr))
+                    };
+                }
+
+            case "stwx" when operands.Count == 3:
+                {
+                    var rS = operands[0];
+                    var rA = operands[1];
+                    var rB = operands[2];
+                    var addr = $"{rA}_addr";
+                    return BuildIndexedAddress(rA, rB, addr, a => new[]
+                    {
+                        new IrStore(new IrAddress(a, 0), IrValue.Register(rS), 4)
+                    });
+                }
+
+            case "lwzux" when operands.Count == 3:
+                {
+                    var rD = operands[0];
+                    var rA = operands[1];
+                    var rB = operands[2];
+                    var addr = $"{rA}_addr";
+                    if (rA == "r0")
+                        throw new InvalidOperationException($"lwzux with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    return new IrInstruction[]
+                    {
+                        new IrBinary(addr, IrValue.Register(rA), IrValue.Register(rB), "add"),
+                        new IrLoad(rD, new IrAddress(addr, 0), 4),
+                        new IrAssign(rA, IrValue.Register(addr))
+                    };
+                }
+
+            case "lwzx" when operands.Count == 3:
+                {
+                    var rD = operands[0];
+                    var rA = operands[1];
+                    var rB = operands[2];
+                    var addr = $"{rA}_addr";
+                    // FIX: Use BuildIndexedAddress to handle r0 correctly
+                    return BuildIndexedAddress(rA, rB, addr, a => new[] { new IrLoad(rD, new IrAddress(a, 0), 4) });
+                }
+
+            case "lhzx" when operands.Count == 3:
+                {
+                    var rD = operands[0];
+                    var rA = operands[1];
+                    var rB = operands[2];
+                    var addr = $"{rA}_addr";
+                    // FIX: Use BuildIndexedAddress to handle r0 correctly
+                    return BuildIndexedAddress(rA, rB, addr, a => new[] { new IrLoad(rD, new IrAddress(a, 0), 2) });
+                }
+
+            case "lhax":
+            case "xo_343":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    string addrReg = $"addr_lhax_{ins.Address:X8}_loc";
+                    var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrLoad($"r{rD}", new IrAddress(addr, 0), 2)
+                    }));
+                    instructions.Add(new IrBinary($"r{rD}", IrValue.Register($"r{rD}"), IrValue.Imm(16), "shl"));
+                    instructions.Add(new IrBinary($"r{rD}", IrValue.Register($"r{rD}"), IrValue.Imm(16), "sar"));
+                    return instructions;
+                }
+
+            case "lhaux":
+            case "xo_375":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    if (rA == 0)
+                        throw new InvalidOperationException($"lhaux with rA=0 is invalid @ 0x{ins.Address:X8}");
+
+                    string addrReg = $"addr_lhaux_{ins.Address:X8}_loc";
+                    var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrLoad($"r{rD}", new IrAddress(addr, 0), 2)
+                    }));
+                    instructions.Add(new IrBinary($"r{rD}", IrValue.Register($"r{rD}"), IrValue.Imm(16), "shl"));
+                    instructions.Add(new IrBinary($"r{rD}", IrValue.Register($"r{rD}"), IrValue.Imm(16), "sar"));
+                    instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+                    return instructions;
+                }
+
+            case "lhzux":
+            case "xo_311":
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+
+                    if (rA == 0)
+                        throw new InvalidOperationException($"lhzux with rA=0 is invalid @ 0x{ins.Address:X8}");
+
+                    string addrReg = $"addr_lhzux_{ins.Address:X8}_loc";
+                    var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrLoad($"r{rD}", new IrAddress(addr, 0), 2)
+                    }));
+                    instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+                    return instructions;
+                }
+
+            case "mulli" when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Imm(SignExtend16(ParseImmediate(operands[2]))), "mul") };
+
+            case "mulhwu" when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "mulhwu") };
+
+            case "mulhwu." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "mulhwu", true);
+
+            case "mulhw" when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "mulhw") };
+
+            case "mulhw." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "mulhw", true);
+
+            case "srawi" when operands.Count == 3:
+            case "srawi." when operands.Count == 3:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var sh = ParseImmediate(operands[2]) & 0x1F;
+
+                    var instructions = new List<IrInstruction>
+                    {
+                        new IrCall("xer", "PPC_UpdateCarryShiftRight", new[]
+                        {
+                            IrValue.Register(src),
+                            IrValue.Imm(sh)
+                        }),
+                        new IrBinary(dest, IrValue.Register(src), IrValue.Imm(sh), "sar")
+                    };
+
+                    if (mnemonic.EndsWith('.'))
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "bdnz" when operands.Count == 1:
+            case "bdz" when operands.Count == 1:
+                {
+                    var target = operands[0];
+                    var fallthrough = $"0x{ins.EndAddress:X8}";
+                    return new IrInstruction[]
+                    {
+                        new IrBinary("ctr", IrValue.Register("ctr"), IrValue.Imm(-1), "add"),
+                        // Use the mnemonic as the condition type to indicate CTR-based branch
+                        new IrBranch(mnemonic, target, fallthrough, "ctr")
+                    };
+                }
+
+            case "mtctr" when operands.Count == 1:
+                return new[] { new IrAssign("ctr", IrValue.Register(operands[0])) };
+
+            case "mflr" when operands.Count == 1:
+                return new[] { new IrAssign(operands[0], IrValue.Register("lr")) };
+
+            case "mtlr" when operands.Count == 1:
+                return new[] { new IrAssign("lr", IrValue.Register(operands[0])) };
+
+            case "srwi" when operands.Count == 3:
+                return new[] { new IrBinary(operands[0], IrValue.Register(operands[1]), IrValue.Imm(ParseImmediate(operands[2])), "shr") };
+
+            case "slw" when operands.Count == 3:
+            case "slw." when operands.Count == 3:
+                {
+                    var dest = operands[0];
+                    var src = operands[1];
+                    var shReg = operands[2];
+
+                    var list = new List<IrInstruction>
+                    {
+                        new IrBinary(dest, IrValue.Register(src), IrValue.Register(shReg), "ppc_slw")
+                    };
+
+                    if (mnemonic.EndsWith('.'))
+                        list.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+
+                    return list;
+                }
+
+            case "andi." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Imm(MaskUimm(ParseImmediate(operands[2]))), "and", true);
+
+            case "andis." when operands.Count == 3:
+                {
+                    // andis. rA, rS, UIMM -> rA = rS & (UIMM << 16), sets CR0
+                    var uimm = MaskUimm(ParseImmediate(operands[2])) << 16;
+                    return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Imm(uimm), "and", true);
+                }
+
+            case "and" when operands.Count == 3:
+            case "and." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "and", mnemonic.EndsWith('.'));
+
+            case "andc" when operands.Count == 3:
+            case "andc." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "andc", mnemonic.EndsWith('.'));
+
+            case "xor" when operands.Count == 3:
+            case "xor." when operands.Count == 3:
+                return BinWithCrFlag(operands[0], IrValue.Register(operands[1]), IrValue.Register(operands[2]), "xor", mnemonic.EndsWith('.'));
+
+            case "subfic" when operands.Count == 3:
+                {
+                    // subfic rD, rA, IMM -> rD = IMM - rA, CA set if no borrow (IMM >= rA)
+                    var dest = Reg(0);
+                    var immVal = SignExtend16(ParseImmediate(operands[2]));
+                    var rA = Reg(1);
+                    var instructions = new List<IrInstruction>();
+                    var rAValue = PreserveIfAliased(dest, rA, "subfic_ra", instructions);
+
+                    instructions.Add(new IrBinary(dest, IrValue.Imm(immVal), IrValue.Register(rAValue), "sub"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarrySub", new[]
+                    {
+                        IrValue.Imm(immVal),
+                        IrValue.Register(rAValue)
+                    }));
+                    return instructions;
+                }
+
+            case "subf" when operands.Count == 3:
+            case "subf." when operands.Count == 3:
+                return BinWithCrFlag(
+                    operands[0],
+                    IrValue.Register(operands[2]),
+                    IrValue.Register(operands[1]),
+                    "sub",
+                    mnemonic.EndsWith('.'));
+
+            case "subfo" when operands.Count == 3:
+            case "subfo." when operands.Count == 3:
+                return CallBinaryWithCr(Reg(0), "PPC_Subfo", Reg(1), Reg(2), mnemonic.EndsWith('.'));
+
+            case "beqlr":
+            case "bnelr":
+            case "bltlr":
+            case "bgtlr":
+            case "bgelr":
+            case "blelr":
+            case "bsolr":
+            case "bnslr":
+                {
+                    var crField = "cr0";
+                    if (ops.Count > 0 && ops[0] is PpcConditionRegisterOperand crOp)
+                    {
+                        crField = NormalizeRegister(crOp.Name);
+                    }
+
+                    var cond = mnemonic.Replace("lr", string.Empty, StringComparison.OrdinalIgnoreCase);
+                    return new[] { new IrBranch(cond, "return", $"0x{ins.EndAddress:X8}", crField) };
+                }
+
+            case "bctrl":
+                // PowerPC EABI: pass argument registers for indirect calls too
+                var bctrlArgs = AbiCallArguments;
+
+                return new IrInstruction[] {
+                    new IrAssign("lr", IrValue.Imm((int)ins.EndAddress)),
+                    new IrIndirectCall(string.Empty, IrValue.Register("ctr"), bctrlArgs) 
+                };
+
+            case "cntlzw" when operands.Count == 2:
+            case "cntlzw." when operands.Count == 2:
+            case "cntlz" when operands.Count == 2:  // Keep for compatibility
+                {
+                    var instructions = new List<IrInstruction> { new IrCall(operands[0], "PPC_Cntlzw", new[] { IrValue.Register(operands[1]) }) };
+                    if (mnemonic.EndsWith('.'))
+                        instructions.Add(new IrSetCrField(0, IrValue.Register(operands[0]), IrValue.Imm(0), false));
+                    return instructions;
+                }
+
+            case "lwzu" when operands.Count == 2:
+                {
+                    var (offset, reg) = ParseDisplacement(operands[1]);
+                    var instructions = new List<IrInstruction>();
+                    if (reg == "r0")
+                        throw new InvalidOperationException($"lwzu with rA=0 is invalid @ 0x{ins.Address:X8}");
+                    instructions.Add(new IrBinary(reg, IrValue.Register(reg), IrValue.Imm(offset), "add"));
+                    instructions.Add(new IrLoad(operands[0], new IrAddress(reg, 0), 4));
+                    return instructions;
+                }
+
+            case "b":
+                {
+                    var targetAddr = ins.BranchTargets.FirstOrDefault();
+                    if (validAddresses.Contains(targetAddr))
+                    {
+                        return new[] { new IrJump(TargetLabel(ins, validAddresses)) };
+                    }
+
+                    var branchesToKnownFunction =
+                        functionEntryPoint.HasValue &&
+                        targetAddr != functionEntryPoint.Value &&
+                        knownFunctionEntryPoints?.Contains(targetAddr) == true;
+
+                    // Tail call to external function
+                    var tailCallArgs = AbiCallArguments;
+                    return new IrInstruction[]
+                    {
+                        new IrCall(string.Empty, TargetLabel(ins, validAddresses, preferFallthrough: false), tailCallArgs),
+                        new IrReturn(null)
+                    };
+                }
+
+            case "bl":
+                // PowerPC EABI passes arguments in r3-r10, f1-f13
+                var blTargetAddr = ins.BranchTargets.FirstOrDefault();
+                if (blTargetAddr == ins.EndAddress &&
+                    instructionsByAddress.TryGetValue(blTargetAddr, out var fallthroughIns) &&
+                    string.Equals(fallthroughIns.Mnemonic, "mflr", StringComparison.OrdinalIgnoreCase))
+                {
+                    return new IrInstruction[] {
+                        new IrAssign("lr", IrValue.Imm((int)ins.EndAddress))
+                    };
+                }
+
+                var blArgs = AbiCallArguments;
+
+                return new IrInstruction[] {
+                    new IrAssign("lr", IrValue.Imm((int)ins.EndAddress)),
+                    new IrCall(string.Empty, TargetLabel(ins, validAddresses, preferFallthrough: false), blArgs) 
+                };
+
+            case "bcl":
+                {
+                    var rawInstr = ReadRawInstruction(ins);
+                    var bo = (int)((rawInstr >> 21) & 0x1F);
+                    var bi = (int)((rawInstr >> 16) & 0x1F);
+                    var fallthrough = $"0x{ins.EndAddress:X8}";
+                    var targetAddr = ins.BranchTargets.FirstOrDefault();
+                    var linkedTarget = $"link_branch_{ins.EndAddress:X8}_{targetAddr:X8}";
+                    var instructions = new List<IrInstruction>();
+                    if ((bo & 0x04) == 0)
+                    {
+                        instructions.Add(new IrBinary("ctr", IrValue.Register("ctr"), IrValue.Imm(-1), "add"));
+                    }
+                    instructions.Add(new IrBranch("raw", linkedTarget, fallthrough, BuildBoConditionExpression(bo, bi, allowCtr: true)));
+                    return instructions;
+                }
+
+            case "blrl":
+                // Branch to address in LR and update LR with the return address.
+                var blrlArgs = AbiCallArguments;
+
+                // Save current LR (target) to temp, update LR, then call temp
+                var blrlTemp = $"addr_blrl_{ins.Address:X8}_loc";
+                return new IrInstruction[] { 
+                    new IrAssign(blrlTemp, IrValue.Register("lr")),
+                    new IrAssign("lr", IrValue.Imm((int)ins.EndAddress)),
+                    new IrIndirectCall(string.Empty, IrValue.Register(blrlTemp), blrlArgs) 
+                };
+
+            case "bclrl":
+                {
+                    var rawInstr = ReadRawInstruction(ins);
+                    var bo = (int)((rawInstr >> 21) & 0x1F);
+                    var bi = (int)((rawInstr >> 16) & 0x1F);
+                    var fallthrough = $"0x{ins.EndAddress:X8}";
+                    var targetLabel = $"call_lr_{ins.Address:X8}_{ins.EndAddress:X8}";
+                    var instructions = new List<IrInstruction>();
+                    if ((bo & 0x04) == 0)
+                    {
+                        instructions.Add(new IrBinary("ctr", IrValue.Register("ctr"), IrValue.Imm(-1), "add"));
+                    }
+                    instructions.Add(new IrBranch("raw", targetLabel, fallthrough, BuildBoConditionExpression(bo, bi, allowCtr: true)));
+                    return instructions;
+                }
+
+            case "beqlrl":
+            case "bnelrl":
+            case "bltlrl":
+            case "bgtlrl":
+            case "bgelrl":
+            case "blelrl":
+            case "bsolrl":
+            case "bnslrl":
+                {
+                    var crField = "cr0";
+                    if (ops.Count > 0 && ops[0] is PpcConditionRegisterOperand crOp)
+                    {
+                        crField = NormalizeRegister(crOp.Name);
+                    }
+
+                    var fallthrough = $"0x{ins.EndAddress:X8}";
+                    var targetLabel = $"call_lr_{ins.Address:X8}_{ins.EndAddress:X8}";
+                    var cond = mnemonic.Replace("lrl", string.Empty, StringComparison.OrdinalIgnoreCase);
+                    return new[] { new IrBranch(cond, targetLabel, fallthrough, crField) };
+                }
+
+            case "bne":
+            case "beq":
+            case "blt":
+            case "bgt":
+            case "ble":
+            case "bge":
+                {
+                    // Extract CR field from operand if present (for cr1-cr7), otherwise default to cr0
+                    var crField = "cr0";
+                    if (ops.Count > 0 && ops[0] is PpcConditionRegisterOperand crOp)
+                    {
+                        crField = NormalizeRegister(crOp.Name);
+                    }
+                    return new[] { new IrBranch(mnemonic, TargetLabel(ins, validAddresses, preferFallthrough: false), $"0x{ins.EndAddress:X8}", crField) };
+                }
+
+            case "bc":
+                {
+                    // Generic bc instruction.
+                    // If we have BO and BI as operands, we can lift it correctly.
+                    if (ops.Count >= 3 && ops[0] is PpcImmediateOperand boOp && ops[1] is PpcImmediateOperand biOp)
+                    {
+                        var bo = boOp.Value;
+                        var bi = biOp.Value;
+                        var crFieldIdx = bi / 4;
+                        var crBitIdx = bi % 4;
+                        var target = operands[2];
+                        var fallthrough = $"0x{ins.EndAddress:X8}";
+
+                        var instructions = new List<IrInstruction>();
+                        if ((bo & 0x04) == 0)
+                        {
+                            instructions.Add(new IrBinary("ctr", IrValue.Register("ctr"), IrValue.Imm(-1), "add"));
+                        }
+                        instructions.Add(new IrBranch("raw", target, fallthrough, BuildBoConditionExpression(bo, bi, allowCtr: true)));
+                        return instructions;
+                    }
+
+                    // Extract CR field from operand if present, otherwise default to cr0
+                    var crField = "cr0";
+                    if (ops.Count > 0 && ops[0] is PpcConditionRegisterOperand crOp)
+                    {
+                        crField = NormalizeRegister(crOp.Name);
+                    }
+                    return new[] { new IrBranch("bc", TargetLabel(ins, validAddresses, preferFallthrough: false), $"0x{ins.EndAddress:X8}", crField) };
+                }
+
+
+            case "blr":
+                return new[] { new IrReturn(null) };
+
+            case "bclr":
+                {
+                    var rawInstr = ReadRawInstruction(ins);
+                    var bo = (int)((rawInstr >> 21) & 0x1F);
+                    var bi = (int)((rawInstr >> 16) & 0x1F);
+                    var fallthrough = $"0x{ins.EndAddress:X8}";
+                    var bo2 = (bo & 0x04) != 0;
+                    var instructions = new List<IrInstruction>();
+                    if (!bo2)
+                    {
+                        instructions.Add(new IrBinary("ctr", IrValue.Register("ctr"), IrValue.Imm(-1), "add"));
+                    }
+                    instructions.Add(new IrBranch("raw", "return", fallthrough, BuildBoConditionExpression(bo, bi, allowCtr: true)));
+                    return instructions;
+                }
+
+            case "xo_54": // dcbst
+            case "dcbst":
+                // Data Cache Block Store - no-op in HLE (no real cache)
+                return new[] { new IrComment($"dcbst @ 0x{ins.Address:X8} (no-op)") };
+
+            case "xo_138": // adde
+                // adde rD, rA, rB
+                // Opcode 31, XO 138
+                {
+                    uint rawInstrAdde = ins.Word;
+                    int rD = (int)((rawInstrAdde >> 21) & 0x1F);
+                    int rA = (int)((rawInstrAdde >> 16) & 0x1F);
+                    int rB = (int)((rawInstrAdde >> 11) & 0x1F);
+                    bool rc = (rawInstrAdde & 1) != 0;
+
+                    var carry = $"r{rD}_ca";
+                    var instructions = new List<IrInstruction>();
+                    var leftValue = PreserveIfAliased($"r{rD}", $"r{rA}", "adde_left", instructions);
+                    var rightValue = PreserveIfAliased($"r{rD}", $"r{rB}", "adde_right", instructions);
+
+                    instructions.Add(new IrCall(carry, "PPC_GetCarry", Array.Empty<IrValue>()));
+                    instructions.Add(new IrBinary($"r{rD}", IrValue.Register(leftValue), IrValue.Register(rightValue), "add"));
+                    instructions.Add(new IrBinary($"r{rD}", IrValue.Register($"r{rD}"), IrValue.Register(carry), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(leftValue),
+                        IrValue.Register(rightValue),
+                        IrValue.Register(carry)
+                    }));
+
+                    if (rc)
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register($"r{rD}"), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "xo_202": // addze
+                // addze rD, rA
+                // Opcode 31, XO 202
+                {
+                    uint rawInstrAddze = ins.Word;
+                    int rD = (int)((rawInstrAddze >> 21) & 0x1F);
+                    int rA = (int)((rawInstrAddze >> 16) & 0x1F);
+                    bool rc = (rawInstrAddze & 1) != 0;
+
+                    var carry = $"r{rD}_ca";
+                    var instructions = new List<IrInstruction>();
+                    var srcValue = PreserveIfAliased($"r{rD}", $"r{rA}", "addze_src", instructions);
+
+                    instructions.Add(new IrCall(carry, "PPC_GetCarry", Array.Empty<IrValue>()));
+                    instructions.Add(new IrBinary($"r{rD}", IrValue.Register(srcValue), IrValue.Register(carry), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(srcValue),
+                        IrValue.Imm(0),
+                        IrValue.Register(carry)
+                    }));
+
+                    if (rc)
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register($"r{rD}"), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "xo_0": // cmp fallback
+                // cmp crfD, L, rA, rB
+                // Opcode 31, XO 0
+                {
+                    uint rawInstrCmp = ins.Word;
+                    int crfD = (int)((rawInstrCmp >> 23) & 0x7);
+                    int rA = (int)((rawInstrCmp >> 16) & 0x1F);
+                    int rB = (int)((rawInstrCmp >> 11) & 0x1F);
+                    
+                    return LiftCompare($"cr{crfD}", IrValue.Register($"r{rA}"), IrValue.Register($"r{rB}"), "sub", isUnsigned: false);
+                }
+
+            case "xo_470": // dcbi
+                // Data Cache Block Invalidate - no-op in HLE (no real cache)
+                return new[] { new IrComment($"dcbi @ 0x{ins.Address:X8} (no-op)") };
+
+            case "dcbt":
+            case "xo_278": // dcbt - Data Cache Block Touch (prefetch hint)
+            case "dcbtst":
+            case "xo_246": // dcbtst - Data Cache Block Touch for Store
+            case "dcba":
+            case "xo_758": // dcba - Data Cache Block Allocate
+            case "tlbie":
+            case "xo_306": // tlbie - no software TLB in this runtime
+            case "tlbsync":
+            case "xo_566": // tlbsync - no software TLB in this runtime
+                // Cache prefetch hint - no-op in HLE
+                return new[] { new IrComment($"{mnemonic} @ 0x{ins.Address:X8} (no-op)") };
+
+            case "stwbrx":
+            case "xo_662": // stwbrx - Store Word Byte-Reverse Indexed
+                {
+                    // stwbrx rS, rA, rB -> stores rS byte-reversed to address (rA|0)+rB
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+                    
+                    string addrReg = $"addr_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrCall("", "PPC_StoreWordByteReverse", new[] 
+                        { 
+                            IrValue.Register(addr), 
+                            IrValue.Register($"r{rS}") 
+                        })
+                    });
+                }
+
+            case "lwbrx":
+            case "xo_534": // lwbrx - Load Word Byte-Reverse Indexed
+                {
+                    // lwbrx rD, rA, rB -> loads byte-reversed word from address (rA|0)+rB into rD
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+                    
+                    string addrReg = $"addr_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrCall($"r{rD}", "PPC_LoadWordByteReverse", new[] { IrValue.Register(addr) })
+                    });
+                }
+
+            case "lhbrx":
+            case "xo_790": // lhbrx - Load Halfword Byte-Reverse Indexed
+                {
+                    // lhbrx rD, rA, rB -> loads byte-reversed halfword from address (rA|0)+rB into rD
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rD = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+                    
+                    string addrReg = $"addr_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrCall($"r{rD}", "PPC_LoadHalfwordByteReverse", new[] { IrValue.Register(addr) })
+                    });
+                }
+
+            case "sthbrx":
+            case "xo_918": // sthbrx - Store Halfword Byte-Reverse Indexed
+                {
+                    // sthbrx rS, rA, rB -> stores rS byte-reversed (halfword) to address (rA|0)+rB
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+                    
+                    string addrReg = $"addr_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrCall("", "PPC_StoreHalfwordByteReverse", new[] 
+                        { 
+                            IrValue.Register(addr), 
+                            IrValue.Register($"r{rS}") 
+                        })
+                    });
+                }
+
+            case "nand":
+            case "nand.":
+                return BinWithCrFlag(Reg(0), IrValue.Register(Reg(1)), IrValue.Register(Reg(2)), "nand", mnemonic.EndsWith('.'));
+
+            case "xo_476": // nand
+                {
+                    uint rawInstr = ReadRawInstruction(ins);
+                    int rS = (int)((rawInstr >> 21) & 0x1F);
+                    int rA = (int)((rawInstr >> 16) & 0x1F);
+                    int rB = (int)((rawInstr >> 11) & 0x1F);
+                    bool rc = (rawInstr & 1) != 0;
+                    
+                    // nand RA, RS, RB -> RA = ~(RS & RB)
+                    return BinWithCrFlag($"r{rA}", IrValue.Register($"r{rS}"), IrValue.Register($"r{rB}"), "nand", rc);
+                }
+
+            case "xo_11": // mulhwu
+                // mulhwu rD, rA, rB
+                // Opcode 31, XO 11
+                {
+                    uint rawInstrMulhwu = ins.Word;
+                    int rD = (int)((rawInstrMulhwu >> 21) & 0x1F);
+                    int rA = (int)((rawInstrMulhwu >> 16) & 0x1F);
+                    int rB = (int)((rawInstrMulhwu >> 11) & 0x1F);
+                    
+                    return new[] { new IrBinary($"r{rD}", IrValue.Register($"r{rA}"), IrValue.Register($"r{rB}"), "mulhwu") };
+                }
+    
+
+            case "xo_595": // mfsr
+            case "mfsr":
+                // mfsr rD, SR
+                // Opcode 31, XO 595
+                {
+                    uint rawInstrMfsr = ins.Word;
+                    int rD = (int)((rawInstrMfsr >> 21) & 0x1F);
+                    
+                    throw new NotImplementedException($"UNIMPLEMENTED instruction 'mfsr r{rD}, SR' @ 0x{ins.Address:X8}");
+                }
+            case "xo_151": // stwx
+                // stwx rS, rA, rB
+                // Opcode 31, XO 151
+                {
+                    uint rawInstrStwx = ins.Word;
+                    int rS = (int)((rawInstrStwx >> 21) & 0x1F);
+                    int rA = (int)((rawInstrStwx >> 16) & 0x1F);
+                    int rB = (int)((rawInstrStwx >> 11) & 0x1F);
+                    
+                    string addrReg = $"addr_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrStore(new IrAddress(addr, 0), IrValue.Register($"r{rS}"), 4)
+                    });
+                }
+
+            case "xo_215": // stbx
+                // stbx rS, rA, rB
+                // Opcode 31, XO 215
+                {
+                    uint rawInstrStbx = ins.Word;
+                    int rS = (int)((rawInstrStbx >> 21) & 0x1F);
+                    int rA = (int)((rawInstrStbx >> 16) & 0x1F);
+                    int rB = (int)((rawInstrStbx >> 11) & 0x1F);
+                    
+                    string addrReg = $"addr_{ins.Address:X8}_loc";
+                    return BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => new[]
+                    {
+                        new IrStore(new IrAddress(addr, 0), IrValue.Register($"r{rS}"), 1)
+                    });
+                }
+            case "mftb":
+            case "xo_371":
+                {
+                    string dest;
+                    bool isUpper = false;
+
+                    // xo_371 often loses its operands in the disassembler; decode manually. rD is bits 6-10,
+                    // and the TBR id splits as high5(bits 16-20) << 5 | low5(bits 11-15). TBR 269 = TBU.
+                    if (operands.Count == 0)
+                    {
+                        uint raw1 = ReadRawInstruction(ins);
+                        int rD = (int)((raw1 >> 21) & 0x1F);
+                        dest = $"r{rD}";
+
+                        uint sprLow5 = (raw1 >> 16) & 0x1F;
+                        uint sprHigh5 = (raw1 >> 11) & 0x1F;
+
+                        int tbr = (int)((sprHigh5 << 5) | sprLow5);
+                        
+                        if (tbr == 269) isUpper = true;
+                    }
+                    else
+                    {
+                        dest = operands[0];
+                        // Check if explicit TBR provided in operands
+                        if (operands.Count > 1)
+                        {
+                            int tbr = ParseImmediate(operands[1]);
+                            if (tbr == 269) isUpper = true;
+                        }
+                    }
+
+                    string helper = isUpper ? "PPC_Mftbu" : "PPC_Mftb";
+                    return new[] { new IrCall(dest, helper, Array.Empty<IrValue>()) };
+                }
+
+            case "mftbu":
+                // mftbu rD
+                // Be defensive: if operands missing, read rD from raw instruction
+                if (operands.Count == 0)
+                {
+                    uint rawInstrMftbu = ins.Word;
+                    int rD = (int)((rawInstrMftbu >> 21) & 0x1F);
+                    return new[] { new IrCall($"r{rD}", "PPC_Mftbu", Array.Empty<IrValue>()) };
+                }
+                return new[] { new IrCall(operands[0], "PPC_Mftbu", Array.Empty<IrValue>()) };
+
+            case "xo_954": // extsb
+                // extsb rA, rS
+                // Opcode 31, XO 954
+                {
+                    uint rawInstrExtsb = ins.Word;
+                    int rS = (int)((rawInstrExtsb >> 21) & 0x1F);
+                    int rA = (int)((rawInstrExtsb >> 16) & 0x1F);
+                    bool rc = (rawInstrExtsb & 1) != 0;
+                    
+                    return BinWithCrFlag($"r{rA}", IrValue.Register($"r{rS}"), IrValue.Imm(8), "sext", rc);
+                }
+
+            case "xo_200": // subfze
+                // subfze rD, rA
+                // Opcode 31, XO 200
+                {
+                    uint rawInstrSubfze = ins.Word;
+                    int rD = (int)((rawInstrSubfze >> 21) & 0x1F);
+                    int rA = (int)((rawInstrSubfze >> 16) & 0x1F);
+
+                    bool rc = (rawInstrSubfze & 1) != 0;
+                    var tmpNot = $"r{rD}_not";
+                    var tmpCa = $"r{rD}_ca";
+
+                    var instructions = new List<IrInstruction>();
+                    var srcValue = PreserveIfAliased($"r{rD}", $"r{rA}", "subfze_src", instructions);
+
+                    instructions.Add(new IrBinary(tmpNot, IrValue.Register(srcValue), IrValue.Imm(0), "not"));
+                    instructions.Add(new IrCall(tmpCa, "PPC_GetCarry", Array.Empty<IrValue>()));
+                    instructions.Add(new IrBinary($"r{rD}", IrValue.Register(tmpNot), IrValue.Register(tmpCa), "add"));
+                    instructions.Add(new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                    {
+                        IrValue.Register(tmpNot),
+                        IrValue.Register(tmpCa),
+                        IrValue.Imm(0)
+                    }));
+
+                    if (rc)
+                    {
+                        instructions.Add(new IrSetCrField(0, IrValue.Register($"r{rD}"), IrValue.Imm(0), false));
+                    }
+
+                    return instructions;
+                }
+
+            case "xo_144": // mtcrf
+                // mtcrf CRM, rS
+                // Opcode 31, XO 144
+                {
+                    uint rawInstrMtcrf = ins.Word;
+                    int rS = (int)((rawInstrMtcrf >> 21) & 0x1F);
+                    int crm = (int)((rawInstrMtcrf >> 12) & 0xFF);
+                    
+                    return LiftMtcrfMasked(crm, $"r{rS}");
+                }
+
+            case "xo_210": // mtsr
+            case "mtsr":
+                // Move To Segment Register - no-op in HLE (no real MMU)
+                return new[] { new IrComment($"mtsr @ 0x{ins.Address:X8} (no-op)") };
+
+            case "xo_86": // dcbf
+                // Data Cache Block Flush - no-op in HLE (no real cache)
+                return new[] { new IrComment($"dcbf @ 0x{ins.Address:X8} (no-op)") };
+
+            case "opc_17": // sc
+                return new[] { new IrCall(string.Empty, "OSSystemCall", Array.Empty<IrValue>()) };
+
+            case "twi":
+            case "opc_3": // twi (Trap Word Immediate)
+                {
+                    uint raw1 = ReadRawInstruction(ins);
+                    int to = (int)((raw1 >> 21) & 0x1F);  // Trap condition
+                    int rA = (int)((raw1 >> 16) & 0x1F);  // Register A
+                    int si = (int)(raw1 & 0xFFFF);        // Signed immediate
+                    if ((si & 0x8000) != 0) si |= unchecked((int)0xFFFF0000); // Sign extend
+                    
+                    return new[]
+                    {
+                        new IrCall(string.Empty, "PPC_TrapWord", new[]
+                        {
+                            IrValue.Imm(to), IrValue.Register($"r{rA}"), IrValue.Imm(si)
+                        })
+                    };
+                }
+
+            case "tw":
+                {
+                    uint raw1 = ReadRawInstruction(ins);
+                    int to = (int)((raw1 >> 21) & 0x1F);
+                    int rA = (int)((raw1 >> 16) & 0x1F);
+                    int rB = (int)((raw1 >> 11) & 0x1F);
+                    return new[]
+                    {
+                        new IrCall(string.Empty, "PPC_TrapWord", new[]
+                        {
+                            IrValue.Imm(to), IrValue.Register($"r{rA}"), IrValue.Register($"r{rB}")
+                        })
+                    };
+                }
+
+            case "xo_75": // mulhw
+                {
+                    uint raw1 = ReadRawInstruction(ins);
+                    int rD = (int)((raw1 >> 21) & 0x1F);
+                    int rA = (int)((raw1 >> 16) & 0x1F);
+                    int rB = (int)((raw1 >> 11) & 0x1F);
+                    bool rc = (raw1 & 1) != 0;
+
+                    return BinWithCrFlag($"r{rD}", IrValue.Register($"r{rA}"), IrValue.Register($"r{rB}"), "mulhw", rc);
+                }
+
+            // Catch-all for misidentified Double Precision instructions (Opcode 63)
+            // The disassembler often labels these as fp_{Value}, where Value = (rC << 5) | XO.
+            case "nop":
+            case "opc_0":
+                return new[] { new IrComment("nop") };
+        }
+        }
+        catch (NotImplementedException ex)
+        {
+            if (allowUnsupported)
+            {
+                return LiftUndefined(ins, ex.Message);
+            }
+
+            throw;
+        }
+
+        // BitConverter.ToString over the big-endian bytes produced exactly this
+        // uppercase eight-digit form.
+        var raw = ins.Word.ToString("X8", CultureInfo.InvariantCulture);
+        var message = $"UNIMPLEMENTED 0x{ins.Address:X8}: {ins.Mnemonic} {ins.OperandText} (0x{raw})".Trim();
+        if (allowUnsupported)
+        {
+            return LiftUndefined(ins, message);
+        }
+
+        throw new InvalidOperationException(message);
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftUndefined(PpcInstruction ins, string reason)
+    {
+        var operandText = ins.OperandText;
+        var disasm = string.IsNullOrWhiteSpace(operandText)
+            ? ins.Mnemonic
+            : $"{ins.Mnemonic} {operandText}";
+        var raw = ReadRawInstruction(ins);
+        return new IrInstruction[] { new IrUndefined(ins.Address, raw, disasm, reason) };
+    }
+
+    private static uint ReadRawInstruction(PpcInstruction ins) => ins.Word;
+
+    private static IReadOnlyList<IrInstruction> LiftMtfsf(PpcInstruction ins)
+    {
+        var raw = ReadRawInstruction(ins);
+        var flm = (int)((raw >> 17) & 0xFF);
+        var frb = (int)((raw >> 11) & 0x1F);
+        return new[] { new IrCall(string.Empty, "PPC_Mtfsf", new[] { IrValue.Imm(flm), IrValue.Register($"f{frb}") }) };
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftMtfsfi(PpcInstruction ins)
+    {
+        var raw = ReadRawInstruction(ins);
+        var field = (int)((raw >> 23) & 0x7);
+        var value = (int)((raw >> 12) & 0xF);
+        return new[] { new IrCall(string.Empty, "PPC_Mtfsfi", new[] { IrValue.Imm(field), IrValue.Imm(value) }) };
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftMtfsb1(PpcInstruction ins)
+    {
+        var raw = ReadRawInstruction(ins);
+        var bt = (int)((raw >> 21) & 0x1F);
+        return new[] { new IrCall(string.Empty, "PPC_Mtfsb1", new[] { IrValue.Imm(bt) }) };
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftMtfsb0(PpcInstruction ins)
+    {
+        var raw = ReadRawInstruction(ins);
+        var bt = (int)((raw >> 21) & 0x1F);
+        return new[] { new IrCall(string.Empty, "PPC_Mtfsb0", new[] { IrValue.Imm(bt) }) };
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftMffs(PpcInstruction ins)
+    {
+        var raw = ReadRawInstruction(ins);
+        var fD = (int)((raw >> 21) & 0x1F);
+        return new[] { new IrCall($"f{fD}", "PPC_Mffs", Array.Empty<IrValue>()) };
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftCompare(string destination, IrValue left, IrValue right, string op, bool isUnsigned)
+    {
+        var field = ParseCrFieldIndex(destination);
+        return new IrInstruction[]
+        {
+            new IrSetCrField(field, left, right, isUnsigned)
+        };
+    }
+
+    private static int ParseCrFieldIndex(string name)
+    {
+        if (string.IsNullOrWhiteSpace(name))
+        {
+            return 0;
+        }
+
+        var baseName = name;
+        var underscore = name.IndexOf('_');
+        if (underscore >= 0)
+        {
+            baseName = name[..underscore];
+        }
+
+        if (baseName.Equals("cr", StringComparison.OrdinalIgnoreCase))
+        {
+            return 0;
+        }
+
+        if (baseName.StartsWith("cr", StringComparison.OrdinalIgnoreCase) &&
+            int.TryParse(baseName.AsSpan(2), out var parsed) && parsed is >= 0 and < 8)
+        {
+            return parsed;
+        }
+
+        return 0;
+    }
+
+    private static IReadOnlyList<IrInstruction> BinWithCrFlag(string dest, IrValue left, IrValue right, string op, bool setsCr)
+    {
+        var ops = new List<IrInstruction>
+        {
+            new IrBinary(dest, left, right, op)
+        };
+
+        if (setsCr)
+        {
+            ops.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+        }
+
+        return ops;
+    }
+
+    private static IReadOnlyList<IrInstruction> CallBinaryWithCr(string dest, string target, string left, string right, bool setsCr)
+    {
+        var ops = new List<IrInstruction>
+        {
+            new IrCall(dest, target, new[] { IrValue.Register(left), IrValue.Register(right) })
+        };
+        if (setsCr)
+        {
+            ops.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+        }
+        return ops;
+    }
+
+    private static IReadOnlyList<IrInstruction> CallUnaryWithCr(string dest, string target, string source, bool setsCr)
+    {
+        var ops = new List<IrInstruction>
+        {
+            new IrCall(dest, target, new[] { IrValue.Register(source) })
+        };
+        if (setsCr)
+        {
+            ops.Add(new IrSetCrField(0, IrValue.Register(dest), IrValue.Imm(0), false));
+        }
+        return ops;
+    }
+
+    private static int ParseImmediate(string text)
+    {
+        var trimmed = text.Trim();
+        var negative = trimmed.StartsWith("-", StringComparison.Ordinal);
+        if (negative)
+        {
+            trimmed = trimmed[1..];
+        }
+
+        int value = trimmed.StartsWith("0x", StringComparison.OrdinalIgnoreCase)
+            ? int.Parse(trimmed[2..], NumberStyles.HexNumber, CultureInfo.InvariantCulture)
+            : int.Parse(trimmed, CultureInfo.InvariantCulture);
+
+        return negative ? -value : value;
+    }
+
+private static int SignExtend16(int value)
+    {
+        return (short)(value & 0xFFFF);
+    }
+
+    private static int MaskUimm(int value)
+    {
+        return value & 0xFFFF;
+    }
+
+    private static IrValue BaseOrZero(string reg) => reg == "r0" || reg == "0" ? IrValue.Imm(0) : IrValue.Register(reg);
+
+    private static string PreserveIfAliased(string dest, string source, string tag, List<IrInstruction> instructions)
+    {
+        if (!string.Equals(dest, source, StringComparison.OrdinalIgnoreCase))
+        {
+            return source;
+        }
+
+        var temp = $"{source}_{tag}";
+        instructions.Add(new IrAssign(temp, IrValue.Register(source)));
+        return temp;
+    }
+
+    private static IReadOnlyList<IrInstruction> DFormLoad(string dest, string baseReg, int offset, int size)
+    {
+        if (baseReg == "r0" || baseReg == "0")
+        {
+            var ea = $"{dest}_ea";
+            return new IrInstruction[]
+            {
+                new IrAssign(ea, IrValue.Imm(offset)),
+                new IrLoad(dest, new IrAddress(ea, 0), size)
+            };
+        }
+
+        return new IrInstruction[] { new IrLoad(dest, new IrAddress(baseReg, offset), size) };
+    }
+
+    private static IReadOnlyList<IrInstruction> DFormStore(string baseReg, int offset, IrValue src, int size)
+    {
+        if (baseReg == "r0" || baseReg == "0")
+        {
+            var ea = $"{src.RegisterName ?? "addr"}_ea";
+            return new IrInstruction[]
+            {
+                new IrAssign(ea, IrValue.Imm(offset)),
+                new IrStore(new IrAddress(ea, 0), src, size)
+            };
+        }
+
+        return new IrInstruction[] { new IrStore(new IrAddress(baseReg, offset), src, size) };
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftMtcrfMasked(int crm, string sourceReg)
+    {
+        // CRM bit 7 maps to CR0 (bits 28-31), bit 0 maps to CR7 (bits 0-3).
+        uint mask = 0;
+        for (int i = 0; i < 8; i++)
+        {
+            if ((crm & (1 << i)) != 0)
+            {
+                mask |= 0xFu << (i * 4);
+            }
+        }
+
+        if (mask == 0)
+        {
+            return new IrInstruction[] { new IrComment("mtcrf crm=0 (no-op)") };
+        }
+
+        var maskedSrc = $"{sourceReg}_mtcrf_src";
+        var maskedCr = $"{sourceReg}_mtcrf_preserve";
+        return new IrInstruction[]
+        {
+            new IrBinary(maskedSrc, IrValue.Register(sourceReg), IrValue.Imm(unchecked((int)mask)), "and"),
+            new IrBinary(maskedCr, IrValue.Register("cr"), IrValue.Imm(unchecked((int)~mask)), "and"),
+            new IrBinary("cr", IrValue.Register(maskedCr), IrValue.Register(maskedSrc), "or")
+        };
+    }
+
+    private static (int offset, string @base) ParseDisplacement(string text)
+    {
+        // pattern: 0x10(r1) or -4(r31)
+        var open = text.IndexOf('(');
+        var close = text.IndexOf(')');
+
+        if (open == -1 && close == -1)
+        {
+            // No parentheses. Could be "0x1234" (absolute) or "r3" (implied 0 offset?)
+            // If it's a register name, assume 0(reg).
+            if (text.StartsWith("r") || text == "sp" || text == "rtoc")
+            {
+                return (0, text);
+            }
+            // Assume immediate (absolute address)
+            return (ParseImmediate(text), "0");
+        }
+
+        if (open == 0 && close > 0)
+        {
+            // (r3) -> 0(r3)
+            var reg = text.Substring(1, close - 1);
+            return (0, reg);
+        }
+
+        if (open <= 0 || close <= open)
+        {
+            throw new FormatException($"Unexpected displacement syntax '{text}'.");
+        }
+
+        var offsetText = text.Substring(0, open);
+        var reg2 = text.Substring(open + 1, close - open - 1);
+        return (SignExtend16(ParseImmediate(offsetText)), reg2);
+    }
+
+    private static IReadOnlyList<IrInstruction> EmitPairedSingleLoad(string destination, string baseReg, int offset, int w, int quant, bool updateBase, uint address)
+    {
+        // PPC rule: if rA=0 in D-form, EA = signext(d), not r0 + d
+        bool isBaseZero = baseReg == "r0" || baseReg == "0";
+
+        // Update forms (psq_lu) with rA=0 are invalid
+        if (updateBase && isBaseZero)
+        {
+            throw new InvalidOperationException($"psq_lu with rA=0 is invalid (cannot update r0) @ 0x{address:X8}");
+        }
+
+        var instructions = new List<IrInstruction>
+        {
+            new IrComment($"psq_load w={w} quant={quant} (using PPC_PsqL)")
+        };
+
+        string addrReg;
+        
+        if (isBaseZero)
+        {
+            // EA = signext(d) - just use the offset as the absolute address
+            addrReg = $"{destination}_psq_ea";
+            instructions.Add(new IrAssign(addrReg, IrValue.Imm(offset)));
+            instructions.Add(new IrCall(destination, "PPC_PsqL", new[] { 
+                IrValue.Register(addrReg),
+                IrValue.Imm(w),
+                IrValue.Imm(quant)
+            }));
+        }
+        else if (updateBase)
+        {
+            addrReg = $"{baseReg}_psq_addr";
+            instructions.Add(new IrBinary(addrReg, IrValue.Register(baseReg), IrValue.Imm(offset), "add"));
+            // Call helper with w and quant (GQR index)
+            instructions.Add(new IrCall(destination, "PPC_PsqL", new[] { 
+                IrValue.Register(addrReg),
+                IrValue.Imm(w),
+                IrValue.Imm(quant)
+            }));
+            instructions.Add(new IrAssign(baseReg, IrValue.Register(addrReg)));
+        }
+        else
+        {
+            // We need a temporary address calculation if offset != 0
+            if (offset != 0)
+            {
+                addrReg = $"{baseReg}_psq_tmp";
+                instructions.Add(new IrBinary(addrReg, IrValue.Register(baseReg), IrValue.Imm(offset), "add"));
+            }
+            else
+            {
+                addrReg = baseReg;
+            }
+            instructions.Add(new IrCall(destination, "PPC_PsqL", new[] { 
+                IrValue.Register(addrReg),
+                IrValue.Imm(w),
+                IrValue.Imm(quant)
+            }));
+        }
+
+        return instructions;
+    }
+
+    private static IReadOnlyList<IrInstruction> EmitPairedSingleStore(string source, string baseReg, int offset, int w, int quant, bool updateBase, uint address)
+    {
+        // PPC rule: if rA=0 in D-form, EA = signext(d), not r0 + d
+        bool isBaseZero = baseReg == "r0" || baseReg == "0";
+
+        // Update forms (psq_stu) with rA=0 are invalid
+        if (updateBase && isBaseZero)
+        {
+            throw new InvalidOperationException($"psq_stu with rA=0 is invalid (cannot update r0) @ 0x{address:X8}");
+        }
+
+        var instructions = new List<IrInstruction>
+        {
+            new IrComment($"psq_store w={w} quant={quant} (using PPC_PsqSt)")
+        };
+
+        string addrReg;
+
+        if (isBaseZero)
+        {
+            // EA = signext(d) - just use the offset as the absolute address
+            addrReg = $"{source}_psq_ea";
+            instructions.Add(new IrAssign(addrReg, IrValue.Imm(offset)));
+            instructions.Add(new IrCall(string.Empty, "PPC_PsqSt", new[] { 
+                IrValue.Register(addrReg),
+                IrValue.Register(source),
+                IrValue.Imm(w),
+                IrValue.Imm(quant)
+            }));
+        }
+        else if (updateBase)
+        {
+            // Calculate EA into temp, Store, then Assign EA to baseReg.
+            // Manual says: EA = (RA) + d. MEM(EA, ...) = ... RA <- EA.
+            var ea = $"{baseReg}_psq_ea";
+            instructions.Add(new IrBinary(ea, IrValue.Register(baseReg), IrValue.Imm(offset), "add"));
+            
+            // Call PPC_PsqSt with W and I (quant/GQR index)
+            instructions.Add(new IrCall(string.Empty, "PPC_PsqSt", new[] { 
+                IrValue.Register(ea),
+                IrValue.Register(source),
+                IrValue.Imm(w),
+                IrValue.Imm(quant)
+            }));
+            instructions.Add(new IrAssign(baseReg, IrValue.Register(ea)));
+        }
+        else
+        {
+            if (offset != 0)
+            {
+                addrReg = $"{baseReg}_psq_tmp";
+                instructions.Add(new IrBinary(addrReg, IrValue.Register(baseReg), IrValue.Imm(offset), "add"));
+            }
+            else
+            {
+                addrReg = baseReg;
+            }
+            // Call PPC_PsqSt with W and I (quant/GQR index)
+            instructions.Add(new IrCall(string.Empty, "PPC_PsqSt", new[] { 
+                IrValue.Register(addrReg),
+                IrValue.Register(source),
+                IrValue.Imm(w),
+                IrValue.Imm(quant)
+            }));
+        }
+
+        return instructions;
+    }
+
+    private static readonly Dictionary<string, int> CrBitAliasLookup = new(StringComparer.OrdinalIgnoreCase)
+    {
+        ["cr0lt"] = 0, ["cr0gt"] = 1, ["cr0eq"] = 2, ["cr0so"] = 3,
+        ["cr1lt"] = 4, ["cr1gt"] = 5, ["cr1eq"] = 6, ["cr1so"] = 7,
+        ["cr2lt"] = 8, ["cr2gt"] = 9, ["cr2eq"] = 10, ["cr2so"] = 11,
+        ["cr3lt"] = 12, ["cr3gt"] = 13, ["cr3eq"] = 14, ["cr3so"] = 15,
+        ["cr4lt"] = 16, ["cr4gt"] = 17, ["cr4eq"] = 18, ["cr4so"] = 19,
+        ["cr5lt"] = 20, ["cr5gt"] = 21, ["cr5eq"] = 22, ["cr5so"] = 23,
+        ["cr6lt"] = 24, ["cr6gt"] = 25, ["cr6eq"] = 26, ["cr6so"] = 27,
+        ["cr7lt"] = 28, ["cr7gt"] = 29, ["cr7eq"] = 30, ["cr7so"] = 31
+    };
+
+    private static int ParseCrBitIndex(string operand)
+    {
+        if (string.IsNullOrWhiteSpace(operand))
+        {
+            return 0;
+        }
+
+        if (CrBitAliasLookup.TryGetValue(operand, out var aliasBit))
+        {
+            return aliasBit;
+        }
+
+        var trimmed = operand.Trim();
+        
+        // Handle the crb{N} format (explicit CR bit number)
+        if (trimmed.StartsWith("crb", StringComparison.OrdinalIgnoreCase))
+        {
+            var bitSuffix = trimmed[3..];
+            if (int.TryParse(bitSuffix, NumberStyles.Integer, CultureInfo.InvariantCulture, out var bitNum))
+            {
+                return Math.Clamp(bitNum, 0, 31);
+            }
+        }
+        
+        // Handle cr{N} format (could be CR field or CR bit depending on context)
+        if (trimmed.StartsWith("cr", StringComparison.OrdinalIgnoreCase))
+        {
+            var suffix = trimmed[2..];
+            if (int.TryParse(suffix, NumberStyles.Integer, CultureInfo.InvariantCulture, out var direct))
+            {
+                return Math.Clamp(direct, 0, 31);
+            }
+
+            var digits = new string(suffix.TakeWhile(char.IsDigit).ToArray());
+            if (digits.Length > 0 && int.TryParse(digits, NumberStyles.Integer, CultureInfo.InvariantCulture, out var field))
+            {
+                var remainder = suffix[digits.Length..].ToLowerInvariant();
+                var bitInField = remainder switch
+                {
+                    "lt" => 0,
+                    "gt" => 1,
+                    "eq" => 2,
+                    "so" => 3,
+                    _ => 0
+                };
+                return Math.Clamp(field * 4 + bitInField, 0, 31);
+            }
+        }
+
+        if (int.TryParse(trimmed, NumberStyles.Integer, CultureInfo.InvariantCulture, out var numeric))
+        {
+            return Math.Clamp(numeric, 0, 31);
+        }
+
+        return 0;
+    }
+
+    private static int ParseCrFieldName(string operand)
+    {
+        if (string.IsNullOrWhiteSpace(operand))
+        {
+            return 0;
+        }
+
+        var trimmed = operand.Trim();
+        if (trimmed.StartsWith("crf", StringComparison.OrdinalIgnoreCase))
+        {
+            trimmed = trimmed[3..];
+        }
+        else if (trimmed.StartsWith("cr", StringComparison.OrdinalIgnoreCase))
+        {
+            trimmed = trimmed[2..];
+        }
+
+        if (int.TryParse(trimmed, NumberStyles.Integer, CultureInfo.InvariantCulture, out var field))
+        {
+            return Math.Clamp(field, 0, 7);
+        }
+
+        return 0;
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftCrLogical(string mnemonic, string targetBit, string leftBit, string rightBit)
+    {
+        var opcode = mnemonic switch
+        {
+            "crnor" => 0,
+            "crandc" => 1,
+            "crxor" => 2,
+            "crnand" => 3,
+            "crand" => 4,
+            "creqv" => 5,
+            "crorc" => 6,
+            "cror" => 7,
+            _ => 0
+        };
+
+        return new[]
+        {
+            new IrCall("cr", "PPC_CrLogical", new[]
+            {
+                IrValue.Imm(opcode),
+                IrValue.Imm(ParseCrBitIndex(targetBit)),
+                IrValue.Imm(ParseCrBitIndex(leftBit)),
+                IrValue.Imm(ParseCrBitIndex(rightBit))
+            })
+        };
+    }
+
+private static string TargetLabel(PpcInstruction ins, HashSet<uint> validAddresses, bool preferFallthrough = true)
+{
+    // FIX: Check if any targets exist rather than checking if the value is 0
+    if (ins.BranchTargets == null || ins.BranchTargets.Count == 0)
+    {
+        throw new InvalidOperationException($"Branch target missing for instruction at 0x{ins.Address:X8}");
+    }
+    
+    var target = ins.BranchTargets[0];
+    if (!validAddresses.Contains(target) && preferFallthrough)
+    {
+        // If the target wasn't decoded in this slice, prefer the fallthrough so SSA stays consistent.
+        return $"0x{ins.EndAddress:X8}";
+    }
+    return $"0x{target:X8}";
+}
+
+    private static string BuildBoConditionExpression(int bo, int bi, bool allowCtr)
+    {
+        var crFieldIdx = bi / 4;
+        var crBitIdx = bi % 4;
+        var branchIfTrue = ((bo >> 3) & 1) != 0;
+        var dontCheckCtr = ((bo >> 2) & 1) != 0;
+        var dontCheckCondition = ((bo >> 4) & 1) != 0;
+        var ctrZero = ((bo >> 1) & 1) != 0;
+
+        var ctrExpr = !allowCtr || dontCheckCtr
+            ? "true"
+            : $"(((ctx->ctr != 0) ^ {(ctrZero ? "true" : "false")}))";
+        var crExpr = dontCheckCondition
+            ? "true"
+            : $"(GetCRBit(ctx, {crFieldIdx}, {crBitIdx}) == {(branchIfTrue ? "true" : "false")})";
+        return $"(({ctrExpr}) && ({crExpr}))";
+    }
+
+    private static uint GetMask(int mb, int me)
+    {
+        uint mask = 0;
+        if (mb <= me)
+        {
+            for (int i = mb; i <= me; i++) mask |= (0x80000000u >> i);
+        }
+        else
+        {
+            for (int i = mb; i <= 31; i++) mask |= (0x80000000u >> i);
+            for (int i = 0; i <= me; i++) mask |= (0x80000000u >> i);
+        }
+        return mask;
+    }
+
+    private static int ParseRegisterNumber(string reg)
+    {
+        if (reg.StartsWith("r", StringComparison.OrdinalIgnoreCase) && int.TryParse(reg.Substring(1), out var num))
+        {
+            return num;
+        }
+        throw new FormatException($"Invalid register: {reg}");
+    }
+
+    private static IrInstruction[] BuildIndexedAddress(string rA, string rB, string addrReg, Func<string, IrInstruction[]> buildOps)
+{
+    var ops = new List<IrInstruction>();
+    
+    if (string.Equals(rA, "r0", StringComparison.OrdinalIgnoreCase))
+    {
+        // (rA|0) + rB => base is 0 when rA is r0
+        ops.Add(new IrAssign(addrReg, IrValue.Register(rB)));
+    }
+    else
+    {
+        ops.Add(new IrBinary(addrReg, IrValue.Register(rA), IrValue.Register(rB), "add"));
+    }
+    
+    ops.AddRange(buildOps(addrReg));
+    return ops.ToArray();
+}
+
+    private static IReadOnlyList<IrInstruction> LiftPairedSingleIndexedLoad(PpcInstruction ins, uint rawInstr, bool updateBase)
+    {
+        int rD = (int)((rawInstr >> 21) & 0x1F);
+        int rA = (int)((rawInstr >> 16) & 0x1F);
+        int rB = (int)((rawInstr >> 11) & 0x1F);
+        int w = (int)((rawInstr >> 10) & 1);
+        int i = (int)((rawInstr >> 7) & 7);
+
+        // EA = (rA|0) + rB
+        string addrReg = $"addr_psqx_{ins.Address:X8}_loc";
+        var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => 
+        {
+            // Call PPC_PsqL with w and i (GQR index)
+            return new[] 
+            { 
+               new IrCall($"f{rD}", "PPC_PsqL", new[] { 
+                   IrValue.Register(addr),
+                   IrValue.Imm(w),
+                   IrValue.Imm(i)
+               })
+            };
+        }));
+        
+        if (updateBase)
+        {
+             if (rA == 0) throw new InvalidOperationException($"psq_lux/stux with rA=0 is invalid @ 0x{ins.Address:X8}");
+             instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+        }
+        
+        return instructions;
+    }
+
+    private static IReadOnlyList<IrInstruction> LiftPairedSingleIndexedStore(PpcInstruction ins, uint rawInstr, bool updateBase)
+    {
+        int rS = (int)((rawInstr >> 21) & 0x1F);
+        int rA = (int)((rawInstr >> 16) & 0x1F);
+        int rB = (int)((rawInstr >> 11) & 0x1F);
+        int w = (int)((rawInstr >> 10) & 1);
+        int i = (int)((rawInstr >> 7) & 7);
+
+        string addrReg = $"addr_psqx_{ins.Address:X8}_loc";
+        var instructions = new List<IrInstruction>(BuildIndexedAddress($"r{rA}", $"r{rB}", addrReg, addr => 
+        {
+            // Call PPC_PsqSt with w and i (GQR index)
+            return new[] 
+            { 
+               new IrCall(string.Empty, "PPC_PsqSt", new[] { 
+                   IrValue.Register(addr), 
+                   IrValue.Register($"f{rS}"),
+                   IrValue.Imm(w),
+                   IrValue.Imm(i)
+               })
+            };
+        }));
+        
+        if (updateBase)
+        {
+             if (rA == 0) throw new InvalidOperationException($"psq_lux/stux with rA=0 is invalid @ 0x{ins.Address:X8}");
+             instructions.Add(new IrAssign($"r{rA}", IrValue.Register(addrReg)));
+        }
+
+        return instructions;
+    }
+}
diff --git a/translator/src/Translator.Core/Loading/AddressRange.cs b/translator/src/Translator.Core/Loading/AddressRange.cs
new file mode 100644
index 0000000..6868db4
--- /dev/null
+++ b/translator/src/Translator.Core/Loading/AddressRange.cs
@@ -0,0 +1,16 @@
+using System;
+
+namespace Translator.Core.Loading;
+
+public readonly record struct AddressRange(uint Start, uint End)
+{
+    public uint Length => checked(End - Start);
+
+    public bool Contains(uint address) => address >= Start && address < End;
+
+    public static AddressRange FromStartAndSize(uint start, uint size) => new(start, checked(start + size));
+
+    public static AddressRange Union(AddressRange a, AddressRange b) => new(
+        Math.Min(a.Start, b.Start),
+        Math.Max(a.End, b.End));
+}
diff --git a/translator/src/Translator.Core/Loading/ChecksumUtilities.cs b/translator/src/Translator.Core/Loading/ChecksumUtilities.cs
new file mode 100644
index 0000000..5865714
--- /dev/null
+++ b/translator/src/Translator.Core/Loading/ChecksumUtilities.cs
@@ -0,0 +1,27 @@
+using System.Security.Cryptography;
+
+namespace Translator.Core.Loading;
+
+/// <summary>
+/// The single SHA-256 hex spelling used everywhere identities are compared. Lower-case is load-bearing:
+/// a divergent casing anywhere would silently invalidate content-addressed reuse.
+/// </summary>
+public static class ChecksumUtilities
+{
+    public static string Sha256Hex(ReadOnlySpan<byte> data) =>
+        Convert.ToHexString(SHA256.HashData(data)).ToLowerInvariant();
+
+    public static string Sha256Hex(byte[] data) =>
+        Sha256Hex((ReadOnlySpan<byte>)data);
+
+    /// <summary>Digest of raw hash bytes that were already computed elsewhere.</summary>
+    public static string ToHex(ReadOnlySpan<byte> hash) =>
+        Convert.ToHexString(hash).ToLowerInvariant();
+
+    /// <summary>Streams the file rather than materializing it, so hashing a REL costs no copy.</summary>
+    public static string Sha256HexOfFile(string path)
+    {
+        using var stream = File.OpenRead(path);
+        return ToHex(SHA256.HashData(stream));
+    }
+}
diff --git a/translator/src/Translator.Core/Loading/FunctionMap.cs b/translator/src/Translator.Core/Loading/FunctionMap.cs
new file mode 100644
index 0000000..f04413d
--- /dev/null
+++ b/translator/src/Translator.Core/Loading/FunctionMap.cs
@@ -0,0 +1,131 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+
+namespace Translator.Core.Loading;
+
+/// <summary>
+/// The authoritative list of function entry points and, where known, symbol names: one
+/// <c>hexaddr name</c> line each (unnamed entries repeat the address). Replaces the old heuristic
+/// discovery seeders and the hand-maintained force-translate list that patched their misses.
+/// </summary>
+public sealed class FunctionMap
+{
+    private readonly uint[] _addresses;
+    private readonly Dictionary<uint, string> _namesByAddress;
+    private readonly Dictionary<string, uint> _addressesByName;
+
+    private FunctionMap(
+        string sourcePath,
+        uint[] addresses,
+        Dictionary<uint, string> namesByAddress,
+        Dictionary<string, uint> addressesByName)
+    {
+        SourcePath = sourcePath;
+        _addresses = addresses;
+        _namesByAddress = namesByAddress;
+        _addressesByName = addressesByName;
+    }
+
+    /// <summary>Path the map was read from, for diagnostics.</summary>
+    public string SourcePath { get; }
+
+    /// <summary>Every function start in the map, ascending and distinct.</summary>
+    public IReadOnlyList<uint> Addresses => _addresses;
+
+    /// <summary>Entries that carry a real symbol name.</summary>
+    public int NamedCount => _namesByAddress.Count;
+
+    public bool Contains(uint address) => _namesByAddress.ContainsKey(address) || IndexOf(address) >= 0;
+
+    /// <summary>The map's symbol for <paramref name="address"/>, or null when unnamed or absent.</summary>
+    public string? NameOf(uint address) =>
+        _namesByAddress.TryGetValue(address, out var name) ? name : null;
+
+    /// <summary>Resolves a symbol name to its address.</summary>
+    public bool TryGetAddress(string symbol, out uint address) =>
+        _addressesByName.TryGetValue(symbol, out address);
+
+    /// <summary>
+    /// Named entries matching "<paramref name="prefix"/>{int}", keyed by that integer. Recovers CodeWarrior
+    /// save/restore thunk ranges from the map instead of hardcoding addresses.
+    /// </summary>
+    public IReadOnlyDictionary<int, uint> NumberedFamily(string prefix)
+    {
+        var family = new Dictionary<int, uint>();
+        foreach (var (address, name) in _namesByAddress)
+        {
+            if (!name.StartsWith(prefix, StringComparison.Ordinal)) continue;
+            var suffix = name.AsSpan(prefix.Length);
+            if (suffix.Length == 0) continue;
+            if (!int.TryParse(suffix, NumberStyles.None, CultureInfo.InvariantCulture, out var index)) continue;
+            family[index] = address;
+        }
+
+        return family;
+    }
+
+    public static FunctionMap Load(string path)
+    {
+        if (!File.Exists(path))
+        {
+            throw new FileNotFoundException("Configured function map was not found.", path);
+        }
+
+        return Parse(File.ReadLines(path), path);
+    }
+
+    public static FunctionMap Parse(IEnumerable<string> lines, string sourcePath)
+    {
+        var namesByAddress = new Dictionary<uint, string>();
+        var addressesByName = new Dictionary<string, uint>(StringComparer.Ordinal);
+        var addresses = new HashSet<uint>();
+        var lineNumber = 0;
+
+        foreach (var rawLine in lines)
+        {
+            lineNumber++;
+            var line = rawLine.Trim();
+            if (line.Length == 0 || line[0] == '#') continue;
+
+            var separator = line.IndexOfAny([' ', '\t']);
+            var addressText = separator < 0 ? line : line[..separator];
+            if (!uint.TryParse(addressText, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var address))
+            {
+                throw new InvalidDataException(
+                    $"Invalid function map entry at {sourcePath}:{lineNumber}: '{rawLine}' does not start with a hexadecimal address.");
+            }
+
+            addresses.Add(address);
+
+            var name = separator < 0 ? string.Empty : line[(separator + 1)..].Trim();
+            // Unnamed entries repeat the address as "0x{addr}"; that is a
+            // placeholder, not a symbol, so it must never become a lookup key.
+            if (name.Length == 0 || name.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+            {
+                continue;
+            }
+
+            namesByAddress[address] = name;
+            // A symbol can legitimately repeat (static functions in different
+            // translation units); the lowest address wins so lookups are stable.
+            if (!addressesByName.TryGetValue(name, out var existing) || address < existing)
+            {
+                addressesByName[name] = address;
+            }
+        }
+
+        if (addresses.Count == 0)
+        {
+            throw new InvalidDataException($"Function map {sourcePath} contains no entries.");
+        }
+
+        var sorted = addresses.ToArray();
+        Array.Sort(sorted);
+        return new FunctionMap(sourcePath, sorted, namesByAddress, addressesByName);
+    }
+
+    private int IndexOf(uint address) => Array.BinarySearch(_addresses, address);
+}
diff --git a/translator/src/Translator.Core/Loading/MemoryLayout.cs b/translator/src/Translator.Core/Loading/MemoryLayout.cs
new file mode 100644
index 0000000..bf1aac7
--- /dev/null
+++ b/translator/src/Translator.Core/Loading/MemoryLayout.cs
@@ -0,0 +1,8 @@
+namespace Translator.Core.Loading;
+
+public static class MemoryLayout
+{
+    public const uint RamBase = 0x80000000;
+    public const int RamSize = 24 * 1024 * 1024; // 24 MiB MEM1
+    public const uint DolBaseAddress = 0x80004000; // First executable section start
+}
diff --git a/translator/src/Translator.Core/Loading/ProgramImage.cs b/translator/src/Translator.Core/Loading/ProgramImage.cs
new file mode 100644
index 0000000..42c37a6
--- /dev/null
+++ b/translator/src/Translator.Core/Loading/ProgramImage.cs
@@ -0,0 +1,55 @@
+using Translator.Core.Parsing.Dol;
+using Translator.Core.Parsing.Rel;
+
+namespace Translator.Core.Loading;
+
+public sealed class ProgramImage
+{
+    public ProgramImage(
+        byte[] memory,
+        AddressRange usedRange,
+        AddressRange dolRange,
+        AddressRange relRange,
+        string sha256,
+        uint memoryBase = MemoryLayout.RamBase)
+    {
+        Memory = memory;
+        UsedRange = usedRange;
+        DolRange = dolRange;
+        RelRange = relRange;
+        Sha256 = sha256;
+        MemoryBase = memoryBase;
+    }
+
+    public byte[] Memory { get; }
+    public uint MemoryBase { get; }
+    public uint MemoryEnd => checked(MemoryBase + (uint)Memory.Length);
+    public AddressRange UsedRange { get; }
+    public AddressRange DolRange { get; }
+    public AddressRange RelRange { get; }
+    public bool HasRel => RelRange.End > RelRange.Start;
+    public string Sha256 { get; }
+
+    public bool Contains(uint address, int size = 1)
+    {
+        if (size < 0 || address < MemoryBase)
+        {
+            return false;
+        }
+
+        var offset = (ulong)address - MemoryBase;
+        return offset + (uint)size <= (ulong)Memory.Length;
+    }
+
+    public int GetOffset(uint address, int size = 1)
+    {
+        if (!Contains(address, size))
+        {
+            throw new ArgumentOutOfRangeException(
+                nameof(address),
+                $"Guest range 0x{address:X8}+0x{size:X} is outside 0x{MemoryBase:X8}-0x{MemoryEnd:X8}.");
+        }
+
+        return checked((int)(address - MemoryBase));
+    }
+}
diff --git a/translator/src/Translator.Core/Loading/ProgramImageBuilder.cs b/translator/src/Translator.Core/Loading/ProgramImageBuilder.cs
new file mode 100644
index 0000000..fbafcd1
--- /dev/null
+++ b/translator/src/Translator.Core/Loading/ProgramImageBuilder.cs
@@ -0,0 +1,80 @@
+using System;
+using System.Linq;
+using Translator.Core.Parsing.Dol;
+using Translator.Core.Parsing.Rel;
+
+namespace Translator.Core.Loading;
+
+public sealed class ProgramImageBuilder
+{
+    public ProgramImage Build(string dolPath, string relPath, uint relBaseAddress)
+    {
+        var dol = DolFile.Load(dolPath);
+        var rel = RelFile.Load(relPath).BuildImage(relBaseAddress);
+        return Build(dol, rel);
+    }
+
+    public ProgramImage Build(
+        DolFile dol,
+        RelImage? rel = null,
+        uint ramBase = MemoryLayout.RamBase,
+        int ramSize = MemoryLayout.RamSize)
+    {
+        if (ramSize <= 0)
+        {
+            throw new ArgumentOutOfRangeException(nameof(ramSize));
+        }
+
+        var ram = new byte[ramSize];
+
+        // Some DOL headers report a coarse BSS span that overlaps initialized small-data sections.
+        // Clear first so the bytes that exist in the file win when ranges overlap.
+        foreach (var bss in dol.Sections.Where(s => s.Kind == SectionKind.Bss))
+        {
+            var offset = checked((int)(bss.VirtualAddress - ramBase));
+            var end = offset + (int)bss.Size;
+            if (offset < 0 || end > ram.Length)
+            {
+                throw new InvalidOperationException($"BSS section spills outside RAM window (offset {offset}, end {end})");
+            }
+
+            ram.AsSpan(offset, (int)bss.Size).Clear();
+        }
+
+        foreach (var section in dol.Sections)
+        {
+            if (section.Size == 0 || section.Kind == SectionKind.Bss)
+            {
+                continue;
+            }
+
+            var offset = checked((int)(section.VirtualAddress - ramBase));
+            var end = offset + (int)section.Size;
+            if (offset < 0 || end > ram.Length)
+            {
+                throw new InvalidOperationException($"DOL section {section.Name} spills outside RAM window (offset {offset}, end {end})");
+            }
+
+            section.Data.Span.CopyTo(ram.AsSpan(offset, (int)section.Size));
+        }
+
+        var relRange = new AddressRange(0, 0);
+        if (rel is not null)
+        {
+            var relOffset = checked((int)(rel.BaseAddress - ramBase));
+            var relEnd = relOffset + rel.Data.Length;
+            if (relOffset < 0 || relEnd > ram.Length)
+            {
+                throw new InvalidOperationException($"REL image spills outside RAM window (offset {relOffset}, end {relEnd})");
+            }
+
+            rel.Data.CopyTo(ram, relOffset);
+            relRange = rel.Range;
+        }
+
+        var usedRange = rel is null ? dol.MemoryRange : AddressRange.Union(dol.MemoryRange, rel.Range);
+
+        var sha = ChecksumUtilities.Sha256Hex(ram);
+        return new ProgramImage(ram, usedRange, dol.MemoryRange, relRange, sha, ramBase);
+    }
+}
diff --git a/translator/src/Translator.Core/Mods/BaseManifest.cs b/translator/src/Translator.Core/Mods/BaseManifest.cs
new file mode 100644
index 0000000..d0e69b4
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/BaseManifest.cs
@@ -0,0 +1,76 @@
+using System.Text.Json;
+
+namespace Translator.Core.Mods;
+
+public sealed record BaseManifest(
+    string Format,
+    int FormatVersion,
+    string GameId,
+    string Region,
+    string ImageSha256,
+    uint RelBaseAddress,
+    IReadOnlyList<BaseSectionMetadata> Sections,
+    IReadOnlyList<BaseFunctionRangeMetadata> Functions,
+    string FunctionRangesFile);
+
+public sealed record BaseSectionMetadata(
+    string Name,
+    string Source,
+    uint GuestStart,
+    uint GuestEnd,
+    bool Executable,
+    bool Writable,
+    string? ImageFile,
+    uint ImageOffset);
+
+public sealed record BaseFunctionRangeMetadata(
+    uint Start,
+    uint End,
+    string Name,
+    string SourceSection,
+    uint SourceImageOffset,
+    string RangeSource,
+    IReadOnlyList<string> Flags);
+
+public sealed class BaseFunctionIndex
+{
+    private readonly List<BaseFunctionRangeMetadata> _functions;
+
+    public BaseFunctionIndex(IEnumerable<BaseFunctionRangeMetadata> functions)
+    {
+        _functions = functions.OrderBy(f => f.Start).ToList();
+    }
+
+    public static BaseFunctionIndex Load(string path)
+    {
+        var json = File.ReadAllText(path);
+        var manifest = JsonSerializer.Deserialize<BaseManifest>(json)
+            ?? throw new InvalidDataException($"Failed to parse base manifest: {path}");
+        return new BaseFunctionIndex(manifest.Functions);
+    }
+
+    public BaseFunctionRangeMetadata? FindContaining(uint address)
+    {
+        var lo = 0;
+        var hi = _functions.Count - 1;
+        while (lo <= hi)
+        {
+            var mid = lo + ((hi - lo) / 2);
+            var function = _functions[mid];
+            if (address < function.Start)
+            {
+                hi = mid - 1;
+            }
+            else if (address >= function.End)
+            {
+                lo = mid + 1;
+            }
+            else
+            {
+                return function;
+            }
+        }
+
+        return null;
+    }
+}
diff --git a/translator/src/Translator.Core/Mods/BaseManifestBuilder.cs b/translator/src/Translator.Core/Mods/BaseManifestBuilder.cs
new file mode 100644
index 0000000..c543291
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/BaseManifestBuilder.cs
@@ -0,0 +1,260 @@
+using System.Text.RegularExpressions;
+using Translator.Core.IO;
+using Translator.Core.Loading;
+using Translator.Core.Parsing.Dol;
+using Translator.Core.Parsing.Rel;
+
+namespace Translator.Core.Mods;
+
+public sealed class BaseManifestBuildResult
+{
+    public required BaseManifest Manifest { get; init; }
+    public required string ManifestPath { get; init; }
+    public required string FunctionRangesPath { get; init; }
+}
+
+public static partial class BaseManifestBuilder
+{
+    public static BaseManifestBuildResult BuildAndWrite(
+        DolFile dol,
+        RelFile rel,
+        RelImage relImage,
+        ProgramImage image,
+        string generatedFunctionsDir,
+        string outputDir,
+        string manifestFormat,
+        string gameId,
+        string region,
+        string fileStem = "base",
+        uint lowMemoryStart = MemoryLayout.RamBase,
+        uint lowMemoryEnd = 0x80004000u,
+        string dolSourceName = "main.dol",
+        string relSourceName = "module.rel",
+        BaseTranslationOutputMetadata? translationOutput = null)
+    {
+        Directory.CreateDirectory(outputDir);
+
+        var sections = new List<BaseSectionMetadata>();
+        var dolTextPath = Path.Combine(outputDir, $"{fileStem}_main_text.bin");
+        var relTextPath = Path.Combine(outputDir, $"{fileStem}_rel_text.bin");
+
+        var dolTextOffsets = WriteDolExecutableImage(dol, dolTextPath);
+        sections.Add(new BaseSectionMetadata(
+            "lowmem",
+            "runtime-lowmem",
+            lowMemoryStart,
+            lowMemoryEnd,
+            Executable: false,
+            Writable: true,
+            ImageFile: null,
+            ImageOffset: 0));
+
+        foreach (var section in dol.Sections.Where(s => s.Size > 0))
+        {
+            sections.Add(new BaseSectionMetadata(
+                section.Name,
+                dolSourceName,
+                section.VirtualAddress,
+                checked(section.VirtualAddress + section.Size),
+                section.IsExecutable,
+                section.Kind is SectionKind.Data or SectionKind.Bss,
+                section.IsExecutable ? Path.GetFileName(dolTextPath) : null,
+                section.IsExecutable && dolTextOffsets.TryGetValue(section.Name, out var imageOffset) ? imageOffset : 0));
+        }
+
+        var relTextOffsets = WriteRelExecutableImage(rel, relImage, relTextPath);
+        foreach (var section in rel.Sections.Where(s => s.Size > 0))
+        {
+            var guestStart = relImage.BaseAddress + section.FileOffset;
+            sections.Add(new BaseSectionMetadata(
+                $"{relSourceName}:{section.Index}",
+                relSourceName,
+                guestStart,
+                checked(guestStart + section.Size),
+                section.Executable,
+                !section.Executable,
+                section.Executable ? Path.GetFileName(relTextPath) : null,
+                section.Executable && relTextOffsets.TryGetValue(section.Index, out var imageOffset) ? imageOffset : 0));
+        }
+
+        var functions = BuildFunctionRanges(sections, generatedFunctionsDir, translationOutput);
+        var manifest = new BaseManifest(
+            manifestFormat,
+            1,
+            gameId,
+            region,
+            image.Sha256,
+            relImage.BaseAddress,
+            sections,
+            functions,
+            $"{fileStem}_function_ranges.json");
+
+        var manifestPath = Path.Combine(outputDir, $"{fileStem}_manifest.json");
+        var functionRangesPath = Path.Combine(outputDir, manifest.FunctionRangesFile);
+
+        JsonWrite(manifestPath, manifest);
+        JsonWrite(functionRangesPath, functions);
+
+        return new BaseManifestBuildResult
+        {
+            Manifest = manifest,
+            ManifestPath = manifestPath,
+            FunctionRangesPath = functionRangesPath
+        };
+    }
+
+    private static Dictionary<string, uint> WriteDolExecutableImage(DolFile dol, string path)
+    {
+        var offsets = new Dictionary<string, uint>(StringComparer.OrdinalIgnoreCase);
+        using var output = File.Create(path);
+        foreach (var section in dol.Sections.Where(s => s.IsExecutable && s.Size > 0).OrderBy(s => s.VirtualAddress))
+        {
+            offsets[section.Name] = checked((uint)output.Position);
+            output.Write(section.Data.Span);
+        }
+        return offsets;
+    }
+
+    private static Dictionary<int, uint> WriteRelExecutableImage(RelFile rel, RelImage relImage, string path)
+    {
+        var offsets = new Dictionary<int, uint>();
+        using var output = File.Create(path);
+        foreach (var section in rel.Sections.Where(s => s.Executable && s.Size > 0).OrderBy(s => s.FileOffset))
+        {
+            if (section.FileOffset + section.Size > relImage.Data.Length)
+            {
+                continue;
+            }
+
+            offsets[section.Index] = checked((uint)output.Position);
+            output.Write(relImage.Data.AsSpan(checked((int)section.FileOffset), checked((int)section.Size)));
+        }
+        return offsets;
+    }
+
+    private static IReadOnlyList<BaseFunctionRangeMetadata> BuildFunctionRanges(
+        IReadOnlyList<BaseSectionMetadata> sections,
+        string generatedFunctionsDir,
+        BaseTranslationOutputMetadata? translationOutput)
+    {
+        var starts = (translationOutput is null
+                ? DiscoverCanonicalGeneratedFunctionStarts(generatedFunctionsDir)
+                : DiscoverCanonicalGeneratedFunctionStarts(translationOutput))
+            .Where(start => sections.Any(s => s.Executable && start >= s.GuestStart && start < s.GuestEnd))
+            .Distinct()
+            .OrderBy(x => x)
+            .ToList();
+
+        var bySection = sections.Where(s => s.Executable).OrderBy(s => s.GuestStart).ToList();
+        var result = new List<BaseFunctionRangeMetadata>(starts.Count);
+
+        foreach (var section in bySection)
+        {
+            var sectionStarts = starts.Where(start => start >= section.GuestStart && start < section.GuestEnd).ToList();
+            for (var i = 0; i < sectionStarts.Count; i++)
+            {
+                var start = sectionStarts[i];
+                var end = i + 1 < sectionStarts.Count ? sectionStarts[i + 1] : section.GuestEnd;
+                if (end <= start)
+                {
+                    continue;
+                }
+
+                result.Add(new BaseFunctionRangeMetadata(
+                    start,
+                    end,
+                    $"func_{start:X8}",
+                    section.Name,
+                    checked(section.ImageOffset + (start - section.GuestStart)),
+                    "generated-function-starts-next-start-or-section-end",
+                    ["Executable", "BaseFunction", "CanBeOverridden", "HasKnownTranslation"]));
+            }
+        }
+
+        return result;
+    }
+
+    internal static IReadOnlyList<uint> DiscoverCanonicalGeneratedFunctionStarts(string generatedFunctionsDir)
+    {
+        var files = new List<(uint Start, string Path)>();
+        if (!Directory.Exists(generatedFunctionsDir))
+        {
+            return Array.Empty<uint>();
+        }
+
+        foreach (var path in Directory.EnumerateFiles(generatedFunctionsDir, "*.cpp", SearchOption.AllDirectories))
+        {
+            var fileName = Path.GetFileNameWithoutExtension(path);
+            var match = AddressRegex().Match(fileName);
+            if (match.Success && GuestTargetParser.TryParseHexAddress(match.Groups[1].Value, out var start))
+            {
+                files.Add((start, path));
+            }
+        }
+
+        // Recursive discovery can emit a standalone translation for a switch
+        // case label as well as the real function containing that label. Such
+        // aliases must not split the base function range: an executable patch
+        // in the case block has to rebuild and override the enclosing function,
+        // otherwise its internal goto bypasses the alias overlay entirely.
+        var embeddedAliases = new HashSet<uint>();
+        foreach (var (ownerStart, path) in files)
+        {
+            var source = File.ReadAllText(path);
+            foreach (Match match in LocalLabelRegex().Matches(source))
+            {
+                if (GuestTargetParser.TryParseHexAddress(match.Groups[1].Value, out var label) &&
+                    label > ownerStart)
+                {
+                    embeddedAliases.Add(label);
+                }
+            }
+        }
+
+        return files
+            .Select(f => f.Start)
+            .Where(start => !embeddedAliases.Contains(start))
+            .Distinct()
+            .OrderBy(start => start)
+            .ToList();
+    }
+
+    internal static IReadOnlyList<uint> DiscoverCanonicalGeneratedFunctionStarts(
+        BaseTranslationOutputMetadata translationOutput)
+    {
+        // Fall-through interior entries (no branch target, so the label check below can't see them)
+        // are excluded, or splitting the ranges there would re-home a mod patch onto an entry no
+        // caller dispatches to while real callers keep running the enclosing translation unpatched.
+        var provenFunctions = translationOutput.Functions
+            .Where(static function => !function.InteriorToOtherTranslation)
+            .ToList();
+
+        // A separately emitted switch case can share an address with an internal
+        // block of its owning translation. The analysis-owned labels retain that
+        // relationship without parsing generated C++.
+        var embeddedAliases = provenFunctions
+            .SelectMany(function => function.LocalLabelAddresses
+                .Where(label => label > function.EntryPoint))
+            .ToHashSet();
+
+        return provenFunctions
+            .Select(function => function.EntryPoint)
+            .Where(start => !embeddedAliases.Contains(start))
+            .Distinct()
+            .OrderBy(start => start)
+            .ToList();
+    }
+
+    // The manifest and the function-range table are machine-read build inputs, so
+    // they are written compact. The shared writer also makes them gated and
+    // atomic; File.Create truncated the live file first, so an interrupted run
+    // could publish a half-written manifest that later commands would parse.
+    private static void JsonWrite<T>(string path, T value) =>
+        JsonOutput.WriteIfChanged(path, value, JsonOutput.Compact);
+
+    [GeneratedRegex("([0-9A-Fa-f]{8})")]
+    private static partial Regex AddressRegex();
+
+    [GeneratedRegex(@"\bloc_([0-9A-Fa-f]{8})\s*:")]
+    private static partial Regex LocalLabelRegex();
+}
diff --git a/translator/src/Translator.Core/Mods/BaseTranslationModAwareness.cs b/translator/src/Translator.Core/Mods/BaseTranslationModAwareness.cs
new file mode 100644
index 0000000..3343f14
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/BaseTranslationModAwareness.cs
@@ -0,0 +1,252 @@
+using System.Text.Json;
+using Translator.Core.IO;
+using Translator.Core.Parsing.Kamek;
+
+namespace Translator.Core.Mods;
+
+/// <summary>
+/// A base translation only really depends on the Kamek patch addresses that land inside a translated
+/// function. This record stores those ranges plus which patched addresses fell inside them, so reuse
+/// can key on that instead of retranslating on every Code.pul digest change.
+/// </summary>
+public sealed record BaseTranslationModAwareness(
+    string Format,
+    int FormatVersion,
+    /// <summary>
+    /// Echo of the translation identity, when the caller supplied one. The launcher's local build
+    /// does not, so this is not what ties the record to a translation: living in the same
+    /// <c>generated</c> directory under the same success-only provenance stamp is.
+    /// </summary>
+    string? TranslationIdentityHash,
+    /// <summary>
+    /// How many functions the translation that wrote this record emitted. A consumer that also reads
+    /// the output metadata compares the two, so a record left behind by a different translation of
+    /// the same workspace cannot be mistaken for this one's.
+    /// </summary>
+    int TranslatedFunctionCount,
+    IReadOnlyList<BaseTranslationModAwarenessProfile> Profiles,
+    /// <summary>
+    /// Sorted, coalesced <c>[start, endExclusive)</c> guest ranges of every translated function,
+    /// flattened to <c>start0, end0, start1, end1, ...</c>. Containment in one of these is the whole
+    /// test for whether a patched address was consequential.
+    /// </summary>
+    IReadOnlyList<uint> TranslatedFunctionRanges)
+{
+    public const string CurrentFormat = "mkw-base-translation-mod-awareness";
+    public const int CurrentFormatVersion = 1;
+
+    /// <summary>The file name this record is always written under, beside the output metadata.</summary>
+    public const string FileName = "base_translation_mod_awareness.json";
+
+    public static BaseTranslationModAwareness Create(
+        string? translationIdentityHash,
+        int translatedFunctionCount,
+        IEnumerable<(string Profile, string Region, string CodePulSha256, IReadOnlySet<uint> PatchedAddresses)> profiles,
+        IReadOnlyDictionary<uint, uint> translatedFunctionEnds)
+    {
+        ArgumentNullException.ThrowIfNull(profiles);
+        ArgumentNullException.ThrowIfNull(translatedFunctionEnds);
+
+        var ranges = CoalesceRanges(translatedFunctionEnds);
+        var recorded = profiles
+            .Select(profile => new BaseTranslationModAwarenessProfile(
+                profile.Profile,
+                profile.Region,
+                profile.CodePulSha256,
+                Consequential(profile.PatchedAddresses, ranges)))
+            .OrderBy(static profile => profile.Profile, StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+
+        return new BaseTranslationModAwareness(CurrentFormat, CurrentFormatVersion, translationIdentityHash,
+            translatedFunctionCount, recorded, ranges);
+    }
+
+    /// <summary>Whether a base translation carrying this record may be reused for
+    /// <paramref name="codePulPath"/> under <paramref name="profileName"/>. Everything unexpected
+    /// answers false with a reason, since a wrong "yes" silently mis-translates the product.</summary>
+    public bool CoversCodePul(string profileName, string codePulPath, out string reason)
+    {
+        reason = string.Empty;
+        if (Profiles.Count != 1)
+        {
+            // The recorded sets are per profile, but the decisions they describe were made from the
+            // union of every profile the translation saw. Testing one profile's replacement against
+            // that union is only equivalent when it is the only profile there is.
+            reason = $"the base translation was produced from {Profiles.Count} mod profile(s), " +
+                "so a single profile's Code.pul cannot be substituted in isolation";
+            return false;
+        }
+
+        var recorded = Profiles[0];
+        if (!string.Equals(recorded.Profile, profileName, StringComparison.OrdinalIgnoreCase))
+        {
+            reason = $"the base translation knows profile '{recorded.Profile}', not '{profileName}'";
+            return false;
+        }
+
+        IReadOnlyList<uint> candidate;
+        try
+        {
+            candidate = Consequential(PatchedAddresses(codePulPath, recorded.Region), TranslatedFunctionRanges);
+        }
+        catch (Exception ex) when (ex is IOException or InvalidDataException or ArgumentException)
+        {
+            reason = $"the candidate Code.pul could not be read as a Kamek patch set ({ex.Message})";
+            return false;
+        }
+
+        if (candidate.Count != recorded.ConsequentialPatchedAddresses.Count)
+        {
+            reason = $"it patches {candidate.Count} translated function address(es), " +
+                $"against the {recorded.ConsequentialPatchedAddresses.Count} this translation was built around";
+            return false;
+        }
+        for (var i = 0; i < candidate.Count; i++)
+        {
+            if (candidate[i] == recorded.ConsequentialPatchedAddresses[i]) continue;
+            reason = $"it moves a patch onto translated function address 0x{candidate[i]:X8}";
+            return false;
+        }
+        return true;
+    }
+
+    /// <summary>The absolute Kamek command addresses one Code.pul applies in one region.</summary>
+    public static IReadOnlySet<uint> PatchedAddresses(string codePulPath, string region)
+    {
+        var chunk = KamekPulFile.Load(codePulPath).SelectRegion(region);
+        var patched = new HashSet<uint>();
+        foreach (var command in chunk.Commands)
+        {
+            if (command.AddressIsAbsolute) patched.Add(command.Address);
+        }
+        return patched;
+    }
+
+    private static IReadOnlyList<uint> Consequential(IReadOnlySet<uint> patched, IReadOnlyList<uint> ranges)
+    {
+        var consequential = new List<uint>();
+        foreach (var address in patched)
+        {
+            if (Contains(ranges, address)) consequential.Add(address);
+        }
+        consequential.Sort();
+        return consequential;
+    }
+
+    /// <summary>Binary search over the flattened, non-overlapping, ascending range pairs.</summary>
+    private static bool Contains(IReadOnlyList<uint> ranges, uint address)
+    {
+        var low = 0;
+        var high = (ranges.Count / 2) - 1;
+        while (low <= high)
+        {
+            var middle = low + ((high - low) / 2);
+            var start = ranges[middle * 2];
+            var end = ranges[(middle * 2) + 1];
+            if (address < start) high = middle - 1;
+            else if (address >= end) low = middle + 1;
+            else return true;
+        }
+        return false;
+    }
+
+    private static uint[] CoalesceRanges(IReadOnlyDictionary<uint, uint> translatedFunctionEnds)
+    {
+        var ordered = translatedFunctionEnds
+            .Where(static entry => entry.Value > entry.Key)
+            .OrderBy(static entry => entry.Key)
+            .ToArray();
+        var flattened = new List<uint>(ordered.Length * 2);
+        foreach (var (start, end) in ordered)
+        {
+            if (flattened.Count != 0 && start <= flattened[^1])
+            {
+                if (end > flattened[^1]) flattened[^1] = end;
+                continue;
+            }
+            flattened.Add(start);
+            flattened.Add(end);
+        }
+        return flattened.ToArray();
+    }
+}
+
+/// <summary>One mod profile's contribution to a base translation's mod-patch awareness.</summary>
+public sealed record BaseTranslationModAwarenessProfile(
+    string Profile,
+    string Region,
+    string CodePulSha256,
+    /// <summary>Ascending; the patched addresses that landed inside a translated function.</summary>
+    IReadOnlyList<uint> ConsequentialPatchedAddresses);
+
+public static class BaseTranslationModAwarenessFile
+{
+    private static readonly JsonSerializerOptions JsonOptions = JsonOutput.CompactCamelCase;
+
+    public static BaseTranslationModAwareness Read(string path)
+    {
+        var awareness = JsonSerializer.Deserialize<BaseTranslationModAwareness>(File.ReadAllText(path), JsonOptions)
+            ?? throw new InvalidDataException($"Base translation mod-awareness record is empty: {path}");
+        Validate(awareness, path);
+        return awareness;
+    }
+
+    public static BaseTranslationModAwareness? TryRead(string path)
+    {
+        if (!File.Exists(path)) return null;
+        try { return Read(path); }
+        catch (Exception ex) when (ex is IOException or JsonException or InvalidDataException) { return null; }
+    }
+
+    public static bool WriteIfChangedAtomic(string path, BaseTranslationModAwareness awareness)
+    {
+        Validate(awareness, path);
+        return JsonOutput.WriteIfChanged(path, awareness, JsonOptions);
+    }
+
+    private static void Validate(BaseTranslationModAwareness awareness, string source)
+    {
+        if (!string.Equals(awareness.Format, BaseTranslationModAwareness.CurrentFormat, StringComparison.Ordinal) ||
+            awareness.FormatVersion != BaseTranslationModAwareness.CurrentFormatVersion)
+        {
+            throw new InvalidDataException(
+                $"Unsupported base translation mod-awareness record in '{source}': " +
+                $"{awareness.Format} v{awareness.FormatVersion}.");
+        }
+        if (awareness.TranslatedFunctionCount <= 0)
+        {
+            throw new InvalidDataException(
+                $"Base translation mod-awareness record has no translated function count in '{source}'.");
+        }
+        if (awareness.TranslatedFunctionRanges.Count == 0 || (awareness.TranslatedFunctionRanges.Count % 2) != 0)
+        {
+            throw new InvalidDataException(
+                $"Base translation mod-awareness record has a malformed range table in '{source}'.");
+        }
+        for (var i = 0; i < awareness.TranslatedFunctionRanges.Count; i += 2)
+        {
+            if (awareness.TranslatedFunctionRanges[i] >= awareness.TranslatedFunctionRanges[i + 1] ||
+                (i > 0 && awareness.TranslatedFunctionRanges[i] < awareness.TranslatedFunctionRanges[i - 1]))
+            {
+                throw new InvalidDataException(
+                    $"Base translation mod-awareness ranges are not ascending and disjoint in '{source}'.");
+            }
+        }
+        foreach (var profile in awareness.Profiles)
+        {
+            if (string.IsNullOrWhiteSpace(profile.Profile) || profile.CodePulSha256.Length != 64)
+            {
+                throw new InvalidDataException(
+                    $"Base translation mod-awareness record has an invalid profile in '{source}'.");
+            }
+            for (var i = 1; i < profile.ConsequentialPatchedAddresses.Count; i++)
+            {
+                if (profile.ConsequentialPatchedAddresses[i] <= profile.ConsequentialPatchedAddresses[i - 1])
+                {
+                    throw new InvalidDataException(
+                        $"Base translation mod-awareness addresses are not ascending in '{source}'.");
+                }
+            }
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/Mods/BaseTranslationOutputMetadata.cs b/translator/src/Translator.Core/Mods/BaseTranslationOutputMetadata.cs
new file mode 100644
index 0000000..08ce2dc
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/BaseTranslationOutputMetadata.cs
@@ -0,0 +1,244 @@
+using System.Text;
+using System.Text.Json;
+using Translator.Core.IO;
+using Translator.Core.Translation;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Mods;
+
+/// <summary>Compact, deterministic description of a base translation output tree, the source of truth
+/// for downstream manifests and pruning so they don't need to parse tens of thousands of C++ files.</summary>
+public sealed record BaseTranslationOutputMetadata(
+    string Format,
+    int FormatVersion,
+    string? TranslationIdentityHash,
+    TranslationQualityMetadata Quality,
+    IReadOnlyList<BaseTranslationFunctionMetadata> Functions,
+    string? SourceBundlePath = null,
+    IReadOnlyList<BaseTranslationModPatchAwareness>? ModPatchAwareness = null)
+{
+    public const string CurrentFormat = "mkw-base-translation-output";
+    public const int CurrentFormatVersion = 2;
+
+    public static BaseTranslationOutputMetadata Create(
+        IEnumerable<BaseTranslationFunctionMetadata> functions,
+        TranslationQualityMetadata quality,
+        string? translationIdentityHash = null,
+        string? sourceBundlePath = null,
+        IReadOnlyList<BaseTranslationModPatchAwareness>? modPatchAwareness = null)
+    {
+        var ordered = functions
+            .OrderBy(function => function.RelativePath, StringComparer.Ordinal)
+            .ToArray();
+        if (ordered.Length == 0)
+        {
+            throw new InvalidOperationException("Base translation output metadata cannot be empty.");
+        }
+        quality.Validate("base translation output metadata");
+
+        var duplicatePath = ordered
+            .GroupBy(function => function.RelativePath, StringComparer.OrdinalIgnoreCase)
+            .FirstOrDefault(group => group.Count() > 1);
+        if (duplicatePath is not null)
+        {
+            throw new InvalidOperationException(
+                $"Base translation output metadata contains duplicate path '{duplicatePath.Key}'.");
+        }
+
+        return new BaseTranslationOutputMetadata(
+            CurrentFormat,
+            CurrentFormatVersion,
+            translationIdentityHash,
+            quality,
+            ordered,
+            sourceBundlePath,
+            modPatchAwareness);
+    }
+
+    public void RequireReleaseEligible(string source)
+    {
+        Quality.Validate(source);
+        if (Quality.UnsupportedInstructionCount != 0 || Quality.InvalidSsaFunctionCount != 0)
+        {
+            throw new InvalidDataException(
+                $"Release translation quality failure in '{source}': " +
+                $"{Quality.UnsupportedInstructionCount} unsupported instruction(s), " +
+                $"{Quality.InvalidSsaFunctionCount} invalid SSA function(s).");
+        }
+    }
+}
+
+public sealed record TranslationQualityMetadata(
+    int UnsupportedInstructionCount,
+    int InvalidSsaFunctionCount)
+{
+    public static TranslationQualityMetadata Clean { get; } = new(0, 0);
+
+    internal void Validate(string source)
+    {
+        if (UnsupportedInstructionCount < 0 || InvalidSsaFunctionCount < 0)
+        {
+            throw new InvalidDataException($"Translation quality counts cannot be negative in '{source}'.");
+        }
+    }
+}
+
+/// <summary>
+/// Records that the base translation knows one mod profile's patch set (leaf-inlining blocks and
+/// residency fences at every address the mod can win). A mod translation must refuse a base tree
+/// whose awareness doesn't cover its own Code.pul, or it silently bakes in vanilla code paths.
+/// </summary>
+public sealed record BaseTranslationModPatchAwareness(
+    string Profile,
+    string CodePulSha256);
+
+public sealed record BaseTranslationFunctionMetadata(
+    string RelativePath,
+    long Size,
+    string Sha256,
+    uint EntryPoint,
+    IReadOnlyList<uint> LocalLabelAddresses,
+    BaseTranslationFunctionBuildMetadata? Build = null,
+    // True for a fall-through interior address (e.g. a split-switch artifact) that another
+    // translated function's control flow already executes. Registered and dispatchable, but the
+    // base manifest must not let it split function ranges: patches have to rebuild the enclosing
+    // function since every real caller runs its inline copy of the bytes, not this alias.
+    bool InteriorToOtherTranslation = false)
+{
+    public static BaseTranslationFunctionMetadata FromTranslation(
+        string outputRoot,
+        string outputPath,
+        FunctionTranslationResult translation)
+    {
+        var root = Path.GetFullPath(outputRoot).TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+        var path = Path.GetFullPath(outputPath);
+        var prefix = root + Path.DirectorySeparatorChar;
+        if (!path.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidOperationException(
+                $"Generated function path '{path}' is outside output root '{root}'.");
+        }
+
+        var relativePath = path[prefix.Length..].Replace(Path.DirectorySeparatorChar, '/');
+        var bytes = Encoding.UTF8.GetBytes(translation.CxxCode);
+        var localLabels = translation.Ssa.Function.Blocks
+            .Select(block => TryParseLocalLabelAddress(block.Label))
+            .Where(address => address.HasValue)
+            .Select(address => address!.Value)
+            .Where(address => address > translation.EntryPoint)
+            .Distinct()
+            .OrderBy(address => address)
+            .ToArray();
+
+        // The emitter reports what it emitted. Recovering these facts by running
+        // regular expressions over C++ text produced in this same process was a
+        // silent-failure hazard; the comment markers inside the text remain the
+        // cross-run persistence format that build sharding parses from files.
+        var emission = translation.Emission;
+        var registration = emission?.Registration
+            ?? throw new InvalidDataException(
+                $"Translated function 0x{translation.EntryPoint:X8} has no build registration metadata.");
+        var directCalls = emission!.EmittedDirectCallTargets;
+        var abiComment = emission.GuestAbiMarker;
+        var build = new BaseTranslationFunctionBuildMetadata(
+            registration.Symbol,
+            registration.PreservesNonvolatileFprs,
+            registration.NonvolatileFprWriteMask,
+            directCalls,
+            string.IsNullOrWhiteSpace(abiComment) ? null : abiComment,
+            translation.Ssa.Function.Blocks.Sum(block => block.Instructions.Count));
+
+        return new BaseTranslationFunctionMetadata(
+            relativePath,
+            bytes.LongLength,
+            ChecksumUtilities.Sha256Hex(bytes),
+            translation.EntryPoint,
+            localLabels,
+            build);
+    }
+
+    private static uint? TryParseLocalLabelAddress(string label) =>
+        GuestTargetParser.TryParseLocalLabelAddress(label);
+}
+
+public sealed record BaseTranslationFunctionBuildMetadata(
+    string Symbol,
+    bool PreservesNonvolatileFprs,
+    uint NonvolatileFprWriteMask,
+    IReadOnlyList<uint> DirectCallDependencies,
+    string? GuestAbiComment,
+    int EstimatedIrInstructions);
+
+public static class BaseTranslationOutputMetadataFile
+{
+    // Machine-read only: indentation tripled the payload of a file that already
+    // measures tens of megabytes and is never opened by a human.
+    private static readonly JsonSerializerOptions JsonOptions = JsonOutput.CompactCamelCase;
+
+    public static BaseTranslationOutputMetadata Read(string path)
+    {
+        var metadata = JsonSerializer.Deserialize<BaseTranslationOutputMetadata>(File.ReadAllText(path), JsonOptions)
+            ?? throw new InvalidDataException($"Base translation output metadata is empty: {path}");
+        Validate(metadata, path);
+        return metadata;
+    }
+
+    public static bool WriteIfChangedAtomic(string path, BaseTranslationOutputMetadata metadata)
+    {
+        Validate(metadata, path);
+        // Serialise straight into a byte buffer. The previous shape built a
+        // multi-megabyte UTF-16 string and then read the whole live file back as a
+        // second one purely to answer "did anything change?".
+        return JsonOutput.WriteIfChanged(path, metadata, JsonOptions);
+    }
+
+    private static void Validate(BaseTranslationOutputMetadata metadata, string source)
+    {
+        if (!string.Equals(metadata.Format, BaseTranslationOutputMetadata.CurrentFormat, StringComparison.Ordinal) ||
+            metadata.FormatVersion != BaseTranslationOutputMetadata.CurrentFormatVersion)
+        {
+            throw new InvalidDataException(
+                $"Unsupported base translation output metadata in '{source}': {metadata.Format} v{metadata.FormatVersion}.");
+        }
+        if (metadata.Quality is null)
+        {
+            throw new InvalidDataException($"Base translation output metadata has no quality counters in '{source}'.");
+        }
+        metadata.Quality.Validate(source);
+
+        var seenPaths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var seenEntries = new HashSet<uint>();
+        foreach (var function in metadata.Functions)
+        {
+            if (string.IsNullOrWhiteSpace(function.RelativePath) ||
+                Path.IsPathRooted(function.RelativePath) ||
+                function.RelativePath.Split('/', '\\').Any(component => component == "..") ||
+                !function.RelativePath.EndsWith(".cpp", StringComparison.OrdinalIgnoreCase))
+            {
+                throw new InvalidDataException(
+                    $"Invalid generated function path '{function.RelativePath}' in '{source}'.");
+            }
+            if (!seenPaths.Add(function.RelativePath) || !seenEntries.Add(function.EntryPoint))
+            {
+                throw new InvalidDataException($"Duplicate generated function entry in '{source}'.");
+            }
+            if (function.Size < 0 || function.Sha256.Length != 64 ||
+                !IsHexadecimal(function.Sha256))
+            {
+                throw new InvalidDataException(
+                    $"Invalid size or SHA-256 for '{function.RelativePath}' in '{source}'.");
+            }
+        }
+    }
+
+    // Enumerable.All over a string allocates a char enumerator and a delegate
+    // invocation per character, for tens of thousands of digests per run.
+    private static bool IsHexadecimal(string value)
+    {
+        foreach (var character in value.AsSpan())
+        {
+            if (!Uri.IsHexDigit(character)) return false;
+        }
+        return true;
+    }
+}
diff --git a/translator/src/Translator.Core/Mods/ContinuationPlanner.cs b/translator/src/Translator.Core/Mods/ContinuationPlanner.cs
new file mode 100644
index 0000000..7027278
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/ContinuationPlanner.cs
@@ -0,0 +1,276 @@
+using System.Buffers.Binary;
+using System.Text.Json;
+using Translator.Core.Disassembly;
+using Translator.Core.Parsing.Kamek;
+using Translator.Core.Mods.Mkwii;
+
+namespace Translator.Core.Mods;
+
+public sealed record ContinuationEntry(
+    uint Address,
+    uint ContainingFunctionStart,
+    uint ContainingFunctionEnd,
+    string SectionName,
+    uint SourceCommandAddress,
+    KamekCommandId SourceCommandId,
+    string Reason);
+
+public sealed class ContinuationPlan
+{
+    public required IReadOnlyList<ContinuationEntry> Entries { get; init; }
+}
+
+public static class ContinuationPlanner
+{
+    private const uint BctrInstruction = 0x4E800420u;
+    private const uint BlrInstruction = 0x4E800020u;
+    private const int MaxTailJumpConstantLookbackBytes = 64;
+
+    public static ContinuationPlan Build(KamekChunk chunk, BaseManifest baseManifest, uint moduleGuestBase)
+    {
+        var functionIndex = new BaseFunctionIndex(baseManifest.Functions);
+        var entries = new Dictionary<uint, ContinuationEntry>();
+
+        foreach (var command in chunk.Commands)
+        {
+            if (!IsBranchLikeTarget(command.Id) || command.Arguments.Count == 0)
+            {
+                continue;
+            }
+
+            var target = KamekAddress.Resolve(command.Arguments[0], moduleGuestBase);
+            var section = FindSection(baseManifest, target);
+            if (section is null || !section.Executable)
+            {
+                continue;
+            }
+
+            var function = functionIndex.FindContaining(target);
+            if (function is null || function.Start == target)
+            {
+                continue;
+            }
+
+            entries.TryAdd(target, new ContinuationEntry(
+                target,
+                function.Start,
+                function.End,
+                section.Name,
+                command.AddressIsRelative ? checked(moduleGuestBase + command.Address) : command.Address,
+                command.Id,
+                "branch-like Code.pul target lands inside a base function"));
+        }
+
+        return new ContinuationPlan
+        {
+            Entries = entries.Values.OrderBy(e => e.Address).ToList()
+        };
+    }
+
+    public static ContinuationPlan AddModuleTailJumpContinuations(
+        ContinuationPlan plan,
+        BaseManifest baseManifest,
+        uint moduleGuestBase,
+        byte[] relocatedModuleImage)
+    {
+        if (relocatedModuleImage.Length < 4)
+        {
+            return plan;
+        }
+
+        var functionIndex = new BaseFunctionIndex(baseManifest.Functions);
+        var entries = plan.Entries.ToDictionary(e => e.Address);
+
+        foreach (var tailJump in DiscoverModuleTailJumps(moduleGuestBase, relocatedModuleImage))
+        {
+            var section = FindSection(baseManifest, tailJump.TargetAddress);
+            if (section is null || !section.Executable)
+            {
+                continue;
+            }
+
+            var function = functionIndex.FindContaining(tailJump.TargetAddress);
+            if (function is null || function.Start == tailJump.TargetAddress)
+            {
+                continue;
+            }
+
+            entries.TryAdd(tailJump.TargetAddress, new ContinuationEntry(
+                tailJump.TargetAddress,
+                function.Start,
+                function.End,
+                section.Name,
+                tailJump.SourceAddress,
+                KamekCommandId.Branch,
+                "Kamek module tail jump lands inside a base function"));
+        }
+
+        return new ContinuationPlan
+        {
+            Entries = entries.Values.OrderBy(e => e.Address).ToList()
+        };
+    }
+
+    public static ContinuationPlan AddRetroWfcExecutableHookContinuations(
+        ContinuationPlan plan,
+        BaseManifest baseManifest,
+        IEnumerable<RetroWfcExecutableHookPlan> hooks)
+    {
+        var functionIndex = new BaseFunctionIndex(baseManifest.Functions);
+        var entries = plan.Entries.ToDictionary(e => e.Address);
+
+        foreach (var hook in hooks)
+        {
+            var target = hook.ContinuationAddress;
+            var section = FindSection(baseManifest, target);
+            if (section is null || !section.Executable)
+            {
+                continue;
+            }
+
+            var function = functionIndex.FindContaining(target);
+            if (function is null || function.Start == target)
+            {
+                continue;
+            }
+
+            var action = hook.TargetActionId ?? string.Join(",", hook.SemanticActionIds);
+            entries.TryAdd(target, new ContinuationEntry(
+                target,
+                function.Start,
+                function.End,
+                section.Name,
+                hook.Address,
+                KamekCommandId.Branch,
+                $"Retro WFC executable hook continuation {action}"));
+        }
+
+        return new ContinuationPlan
+        {
+            Entries = entries.Values.OrderBy(e => e.Address).ToList()
+        };
+    }
+
+
+    private static bool IsBranchLikeTarget(KamekCommandId id) =>
+        id is KamekCommandId.Rel24 or KamekCommandId.Branch or KamekCommandId.BranchLink;
+
+    private static BaseSectionMetadata? FindSection(BaseManifest manifest, uint address) =>
+        manifest.Sections.FirstOrDefault(section => address >= section.GuestStart && address < section.GuestEnd);
+
+    private static IEnumerable<ModuleTailJump> DiscoverModuleTailJumps(
+        uint moduleGuestBase,
+        byte[] relocatedModuleImage)
+    {
+        for (var offset = 0; offset + 4 <= relocatedModuleImage.Length; offset += 4)
+        {
+            var word = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset);
+            if (word != BctrInstruction && word != BlrInstruction)
+            {
+                continue;
+            }
+
+            var sprWriteOffset = offset - 4;
+            if (sprWriteOffset < 0)
+            {
+                continue;
+            }
+
+            var sprWrite = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, sprWriteOffset);
+            int sourceRegister;
+            var hasRegisterSource = word == BctrInstruction
+                ? PpcInstructionPatterns.TryGetMtspr(sprWrite, 9, out sourceRegister)
+                : PpcInstructionPatterns.TryGetMtspr(sprWrite, 8, out sourceRegister);
+            if (!hasRegisterSource)
+            {
+                continue;
+            }
+
+            if (!TryResolveConstantRegisterValue(
+                    relocatedModuleImage,
+                    sprWriteOffset,
+                    sourceRegister,
+                    out var targetAddress))
+            {
+                continue;
+            }
+
+            yield return new ModuleTailJump(
+                checked(moduleGuestBase + (uint)offset),
+                targetAddress);
+        }
+    }
+
+    private static bool TryResolveConstantRegisterValue(
+        byte[] relocatedModuleImage,
+        int beforeOffset,
+        int register,
+        out uint value)
+    {
+        var lowOperation = LowImmediateOperation.None;
+        var lowImmediate = 0u;
+        var scanStart = Math.Max(0, beforeOffset - MaxTailJumpConstantLookbackBytes);
+
+        for (var offset = beforeOffset - 4; offset >= scanStart; offset -= 4)
+        {
+            var word = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset);
+
+            if (PpcInstructionPatterns.TryGetOri(word, out var oriSource, out var oriDestination, out var oriImmediate) &&
+                oriDestination == register)
+            {
+                if (oriSource != register || lowOperation != LowImmediateOperation.None)
+                {
+                    break;
+                }
+
+                lowOperation = LowImmediateOperation.Or;
+                lowImmediate = oriImmediate;
+                continue;
+            }
+
+            if (PpcInstructionPatterns.TryGetAddi(word, out var addiDestination, out var addiSource, out var addiImmediate) &&
+                addiDestination == register)
+            {
+                if (addiSource != register || lowOperation != LowImmediateOperation.None)
+                {
+                    break;
+                }
+
+                lowOperation = LowImmediateOperation.AddSigned;
+                lowImmediate = unchecked((uint)addiImmediate);
+                continue;
+            }
+
+            if (PpcInstructionPatterns.TryGetLis(word, out var lisDestination, out var highImmediate) &&
+                lisDestination == register)
+            {
+                var baseValue = highImmediate << 16;
+                value = lowOperation switch
+                {
+                    LowImmediateOperation.None => baseValue,
+                    LowImmediateOperation.Or => baseValue | lowImmediate,
+                    LowImmediateOperation.AddSigned => unchecked(baseValue + (uint)(short)lowImmediate),
+                    _ => baseValue
+                };
+                return true;
+            }
+
+            if (PpcRegisterEffects.MayWriteGpr(word, register))
+            {
+                break;
+            }
+        }
+
+        value = 0;
+        return false;
+    }
+
+    private sealed record ModuleTailJump(uint SourceAddress, uint TargetAddress);
+
+    private enum LowImmediateOperation
+    {
+        None,
+        Or,
+        AddSigned
+    }
+}
diff --git a/translator/src/Translator.Core/Mods/KamekPatchPlanner.cs b/translator/src/Translator.Core/Mods/KamekPatchPlanner.cs
new file mode 100644
index 0000000..e587a52
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/KamekPatchPlanner.cs
@@ -0,0 +1,218 @@
+using System.Text.Json;
+using Translator.Core.Parsing.Kamek;
+
+namespace Translator.Core.Mods;
+
+public enum KamekPatchClassificationKind
+{
+    ModuleCommand,
+    BaseExecutablePatch,
+    BaseDataPatch,
+    DroppedReservedRegion,
+    Unsupported
+}
+
+public sealed record KamekPatchClassification(
+    KamekPatchClassificationKind Kind,
+    KamekCommandId CommandId,
+    uint CommandAddress,
+    bool CommandAddressIsAbsolute,
+    uint? ContainingFunctionStart,
+    uint? ContainingFunctionEnd,
+    string? SectionName,
+    string Reason,
+    IReadOnlyList<uint> Arguments);
+
+public sealed class KamekPatchPlan
+{
+    public required uint ModuleGuestBase { get; init; }
+    public required IReadOnlyList<KamekPatchClassification> Classifications { get; init; }
+
+    public IEnumerable<KamekPatchClassification> ModuleCommands =>
+        Classifications.Where(c => c.Kind == KamekPatchClassificationKind.ModuleCommand);
+
+    public IEnumerable<KamekPatchClassification> ExecutablePatches =>
+        Classifications.Where(c => c.Kind == KamekPatchClassificationKind.BaseExecutablePatch);
+
+    public IEnumerable<KamekPatchClassification> DataPatches =>
+        Classifications.Where(c => c.Kind == KamekPatchClassificationKind.BaseDataPatch);
+
+    public IEnumerable<KamekPatchClassification> DroppedReservedRegionWrites =>
+        Classifications.Where(c => c.Kind == KamekPatchClassificationKind.DroppedReservedRegion);
+
+    public IEnumerable<KamekPatchClassification> Unsupported =>
+        Classifications.Where(c => c.Kind == KamekPatchClassificationKind.Unsupported);
+
+    public string BuildTextReport(string title)
+    {
+        using var writer = new StringWriter();
+        writer.WriteLine(title);
+        writer.WriteLine($"Module base: 0x{ModuleGuestBase:X8}");
+        writer.WriteLine();
+        writer.WriteLine("Classification summary:");
+        foreach (var group in Classifications.GroupBy(c => c.Kind).OrderBy(g => g.Key.ToString()))
+        {
+            writer.WriteLine($"  {group.Key,-22} {group.Count(),8:N0}");
+        }
+        writer.WriteLine();
+
+        writer.WriteLine("Executable overlays:");
+        foreach (var group in ExecutablePatches
+            .Where(c => c.ContainingFunctionStart.HasValue && c.ContainingFunctionEnd.HasValue)
+            .GroupBy(c => (Start: c.ContainingFunctionStart!.Value, End: c.ContainingFunctionEnd!.Value, c.SectionName))
+            .OrderBy(g => g.Key.Start))
+        {
+            writer.WriteLine($"  0x{group.Key.Start:X8}-0x{group.Key.End:X8} {group.Key.SectionName}");
+            foreach (var item in group.OrderBy(c => c.CommandAddress).Take(32))
+            {
+                writer.WriteLine($"    0x{item.CommandAddress:X8} {item.CommandId} {FormatArgs(item.Arguments)}");
+            }
+            if (group.Count() > 32)
+            {
+                writer.WriteLine($"    ... {group.Count() - 32:N0} more");
+            }
+        }
+        if (!ExecutablePatches.Any())
+        {
+            writer.WriteLine("  none");
+        }
+        writer.WriteLine();
+
+        writer.WriteLine("Data patches:");
+        foreach (var group in DataPatches.GroupBy(c => c.SectionName ?? "<unknown>").OrderBy(g => g.Key))
+        {
+            writer.WriteLine($"  {group.Key}: {group.Count():N0}");
+        }
+        if (!DataPatches.Any())
+        {
+            writer.WriteLine("  none");
+        }
+        writer.WriteLine();
+
+        writer.WriteLine("Unsupported:");
+        foreach (var item in Unsupported.Take(128))
+        {
+            writer.WriteLine($"  0x{item.CommandAddress:X8} {item.CommandId}: {item.Reason}");
+        }
+        if (!Unsupported.Any())
+        {
+            writer.WriteLine("  none");
+        }
+        else if (Unsupported.Count() > 128)
+        {
+            writer.WriteLine($"  ... {Unsupported.Count() - 128:N0} more");
+        }
+
+        return writer.ToString();
+    }
+
+    private static string FormatArgs(IReadOnlyList<uint> args) =>
+        args.Count == 0 ? string.Empty : string.Join(", ", args.Select(a => $"0x{a:X8}"));
+}
+
+public static class KamekPatchPlanner
+{
+    private const uint CodehandlerRegionStart = 0x80001920;
+    private const uint CodehandlerRegionEnd = 0x80001924;
+
+    public static KamekPatchPlan Build(KamekChunk chunk, BaseManifest baseManifest, uint moduleGuestBase)
+    {
+        var functionIndex = new BaseFunctionIndex(baseManifest.Functions);
+        var classifications = new List<KamekPatchClassification>(chunk.Commands.Count);
+
+        foreach (var command in chunk.Commands)
+        {
+            if (command.AddressIsRelative)
+            {
+                classifications.Add(new KamekPatchClassification(
+                    KamekPatchClassificationKind.ModuleCommand,
+                    command.Id,
+                    moduleGuestBase + command.Address,
+                    false,
+                    null,
+                    null,
+                    "Kamek module",
+                    "relative command applies to Kamek module image",
+                    command.Arguments));
+                continue;
+            }
+
+            var section = FindSection(baseManifest, command.Address);
+            if (section is null)
+            {
+                classifications.Add(Unsupported(command, "absolute command address is outside known base sections"));
+                continue;
+            }
+
+            if (!section.Executable &&
+                command.Address >= CodehandlerRegionStart && command.Address < CodehandlerRegionEnd)
+            {
+                classifications.Add(new KamekPatchClassification(
+                    KamekPatchClassificationKind.DroppedReservedRegion,
+                    command.Id,
+                    command.Address,
+                    true,
+                    null,
+                    null,
+                    section.Name,
+                    "write to the WFC codehandler probe word is dropped; the recomp keeps 0x80001920 clean for the WFC anticheat probe",
+                    command.Arguments));
+                continue;
+            }
+
+            if (section.Executable)
+            {
+                var function = functionIndex.FindContaining(command.Address);
+                if (function is null)
+                {
+                    classifications.Add(Unsupported(command, $"executable address is in {section.Name} but no containing function range was found"));
+                    continue;
+                }
+
+                classifications.Add(new KamekPatchClassification(
+                    KamekPatchClassificationKind.BaseExecutablePatch,
+                    command.Id,
+                    command.Address,
+                    true,
+                    function.Start,
+                    function.End,
+                    section.Name,
+                    "absolute executable command requires patched base overlay",
+                    command.Arguments));
+                continue;
+            }
+
+            classifications.Add(new KamekPatchClassification(
+                KamekPatchClassificationKind.BaseDataPatch,
+                command.Id,
+                command.Address,
+                true,
+                null,
+                null,
+                section.Name,
+                "absolute non-executable command applies as data patch",
+                command.Arguments));
+        }
+
+        return new KamekPatchPlan
+        {
+            ModuleGuestBase = moduleGuestBase,
+            Classifications = classifications
+        };
+    }
+
+    private static KamekPatchClassification Unsupported(KamekCommand command, string reason) =>
+        new(
+            KamekPatchClassificationKind.Unsupported,
+            command.Id,
+            command.Address,
+            command.AddressIsAbsolute,
+            null,
+            null,
+            null,
+            reason,
+            command.Arguments);
+
+    private static BaseSectionMetadata? FindSection(BaseManifest manifest, uint address) =>
+        manifest.Sections.FirstOrDefault(section => address >= section.GuestStart && address < section.GuestEnd);
+}
diff --git a/translator/src/Translator.Core/Mods/Mkwii/RetroWfcBootstrapSuppressor.cs b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcBootstrapSuppressor.cs
new file mode 100644
index 0000000..c621159
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcBootstrapSuppressor.cs
@@ -0,0 +1,37 @@
+using Translator.Core.Parsing.Kamek;
+
+namespace Translator.Core.Mods.Mkwii;
+
+public static class RetroWfcBootstrapSuppressor
+{
+    public static KamekChunk Suppress(KamekChunk chunk, uint hookAddress)
+    {
+        ArgumentNullException.ThrowIfNull(chunk);
+
+        var matching = chunk.Commands
+            .Where(command => command.AddressIsAbsolute && command.Address == hookAddress)
+            .ToArray();
+        if (matching.Length != 1 ||
+            matching[0].Id != KamekCommandId.Branch ||
+            matching[0].Arguments.Count != 1)
+        {
+            throw new InvalidDataException(
+                $"Expected exactly one absolute Branch command at the configured Retro WFC legacy bootstrap hook " +
+                $"0x{hookAddress:X8}, but found {matching.Length} matching command(s).");
+        }
+
+        var commands = chunk.Commands
+            .Where(command => !ReferenceEquals(command, matching[0]))
+            .ToArray();
+        return new KamekChunk(
+            chunk.Index,
+            chunk.FileOffset,
+            chunk.BssSize,
+            chunk.CodeSize,
+            chunk.CtorStart,
+            chunk.CtorEnd,
+            chunk.ChunkSize,
+            chunk.CodeBlob,
+            commands);
+    }
+}
diff --git a/translator/src/Translator.Core/Mods/Mkwii/RetroWfcContractLoweringPlanner.cs b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcContractLoweringPlanner.cs
new file mode 100644
index 0000000..66dd4e4
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcContractLoweringPlanner.cs
@@ -0,0 +1,439 @@
+using System.Text.Json;
+using static Translator.Core.Mods.Mkwii.RetroWfcJson;
+
+namespace Translator.Core.Mods.Mkwii;
+
+public sealed record RetroWfcStaticBytePatchPlan(
+    int RecordIndex,
+    string Intent,
+    uint Address,
+    int Size,
+    string SectionName,
+    bool SectionExecutable,
+    uint? ContainingFunctionStart,
+    uint? ContainingFunctionEnd,
+    string SourceSha256,
+    string BytesHex,
+    string LoweringKind);
+
+public sealed record RetroWfcExecutableHookPlan(
+    int RecordIndex,
+    string Intent,
+    string TypeName,
+    uint Address,
+    int InstructionCount,
+    uint ContainingFunctionStart,
+    uint ContainingFunctionEnd,
+    string SectionName,
+    IReadOnlyList<string> SemanticActionIds,
+    string LoweringKind,
+    uint? TargetAddress,
+    string? TargetActionId,
+    string? TargetKind,
+    string? TargetSymbol,
+    uint ContinuationAddress);
+
+public sealed record RetroWfcStaticPointerPlan(
+    int RecordIndex,
+    uint Address,
+    string SectionName,
+    bool SectionExecutable,
+    uint? ContainingFunctionStart,
+    uint? ContainingFunctionEnd,
+    IReadOnlyList<string> SemanticActionIds,
+    string LoweringKind,
+    uint? TargetAddress,
+    string? TargetActionId,
+    string? TargetKind,
+    string? TargetSymbol);
+
+public sealed record RetroWfcLoweringIssue(
+    string Severity,
+    string Code,
+    string Message,
+    string? Path);
+
+public sealed record RetroWfcContractLoweringPlan(
+    string? Source,
+    int PatchRecordCount,
+    IReadOnlyList<RetroWfcStaticBytePatchPlan> StaticBytePatches,
+    IReadOnlyList<RetroWfcExecutableHookPlan> ExecutableHooks,
+    IReadOnlyList<RetroWfcStaticPointerPlan> StaticPointers,
+    IReadOnlyList<RetroWfcLoweringIssue> Issues)
+{
+    public bool IsPlannable => Issues.All(i => !string.Equals(i.Severity, "error", StringComparison.OrdinalIgnoreCase));
+
+    public string BuildTextReport()
+    {
+        using var writer = new StringWriter();
+        writer.WriteLine("Retro WFC recomp contract lowering plan");
+        if (!string.IsNullOrWhiteSpace(Source))
+        {
+            writer.WriteLine($"  source: {Source}");
+        }
+        writer.WriteLine($"  patch records: {PatchRecordCount:N0}");
+        writer.WriteLine($"  static byte patches: {StaticBytePatches.Count:N0}");
+        writer.WriteLine($"  executable hooks: {ExecutableHooks.Count:N0}");
+        writer.WriteLine($"  static pointer writes: {StaticPointers.Count:N0}");
+        writer.WriteLine($"  plannable: {IsPlannable}");
+        writer.WriteLine();
+
+        writer.WriteLine("Static byte patches:");
+        foreach (var patch in StaticBytePatches.OrderBy(p => p.Address))
+        {
+            var function = patch.ContainingFunctionStart.HasValue
+                ? $" function=0x{patch.ContainingFunctionStart.Value:X8}-0x{patch.ContainingFunctionEnd!.Value:X8}"
+                : "";
+            writer.WriteLine($"  #{patch.RecordIndex} 0x{patch.Address:X8}+0x{patch.Size:X} {patch.LoweringKind} section={patch.SectionName}{function}");
+        }
+        if (StaticBytePatches.Count == 0)
+        {
+            writer.WriteLine("  none");
+        }
+        writer.WriteLine();
+
+        writer.WriteLine("Executable hooks:");
+        foreach (var hook in ExecutableHooks.OrderBy(h => h.Address))
+        {
+            writer.WriteLine($"  #{hook.RecordIndex} 0x{hook.Address:X8} {hook.TypeName}/{hook.Intent} instructions={hook.InstructionCount} function=0x{hook.ContainingFunctionStart:X8}-0x{hook.ContainingFunctionEnd:X8}");
+            writer.WriteLine($"    actions: {string.Join(", ", hook.SemanticActionIds)}");
+            writer.WriteLine(hook.TargetAddress.HasValue
+                ? $"    target: 0x{hook.TargetAddress.Value:X8} ({hook.TargetKind}, {hook.TargetActionId}) continuation=0x{hook.ContinuationAddress:X8}"
+                : $"    target: unresolved continuation=0x{hook.ContinuationAddress:X8}");
+        }
+        if (ExecutableHooks.Count == 0)
+        {
+            writer.WriteLine("  none");
+        }
+        writer.WriteLine();
+
+        writer.WriteLine("Static pointer writes:");
+        foreach (var pointer in StaticPointers.OrderBy(p => p.Address))
+        {
+            var function = pointer.ContainingFunctionStart.HasValue
+                ? $" function=0x{pointer.ContainingFunctionStart.Value:X8}-0x{pointer.ContainingFunctionEnd!.Value:X8}"
+                : "";
+            writer.WriteLine($"  #{pointer.RecordIndex} 0x{pointer.Address:X8} {pointer.LoweringKind} section={pointer.SectionName}{function}");
+            writer.WriteLine($"    actions: {string.Join(", ", pointer.SemanticActionIds)}");
+            writer.WriteLine(pointer.TargetAddress.HasValue
+                ? $"    target: 0x{pointer.TargetAddress.Value:X8} ({pointer.TargetKind}, {pointer.TargetActionId})"
+                : "    target: unresolved");
+        }
+        if (StaticPointers.Count == 0)
+        {
+            writer.WriteLine("  none");
+        }
+        writer.WriteLine();
+
+        var errors = Issues.Where(i => string.Equals(i.Severity, "error", StringComparison.OrdinalIgnoreCase)).ToList();
+        var warnings = Issues.Where(i => string.Equals(i.Severity, "warning", StringComparison.OrdinalIgnoreCase)).ToList();
+        writer.WriteLine($"Errors: {errors.Count:N0}");
+        foreach (var issue in errors)
+        {
+            writer.WriteLine($"  [{issue.Code}] {issue.Message}{FormatIssuePath(issue.Path)}");
+        }
+        writer.WriteLine($"Warnings: {warnings.Count:N0}");
+        foreach (var issue in warnings)
+        {
+            writer.WriteLine($"  [{issue.Code}] {issue.Message}{FormatIssuePath(issue.Path)}");
+        }
+
+        return writer.ToString();
+    }
+
+    private static string FormatIssuePath(string? path) =>
+        string.IsNullOrWhiteSpace(path) ? "" : $" ({path})";
+}
+
+public static class RetroWfcContractLoweringPlanner
+{
+    public static RetroWfcContractLoweringPlan Build(
+        string json,
+        BaseManifest baseManifest,
+        string? source = null,
+        IReadOnlyDictionary<string, RetroWfcSemanticActionTarget>? semanticActionTargets = null)
+    {
+        using var document = JsonDocument.Parse(json);
+        var root = document.RootElement;
+        var issues = new List<RetroWfcLoweringIssue>();
+        var staticBytePatches = new List<RetroWfcStaticBytePatchPlan>();
+        var executableHooks = new List<RetroWfcExecutableHookPlan>();
+        var staticPointers = new List<RetroWfcStaticPointerPlan>();
+        var functionIndex = new BaseFunctionIndex(baseManifest.Functions);
+
+        if (!root.TryGetProperty("patchRecords", out var records) || records.ValueKind != JsonValueKind.Array)
+        {
+            issues.Add(Error("MissingPatchRecords", "Contract is missing patchRecords.", "$.patchRecords"));
+            return new RetroWfcContractLoweringPlan(source, 0, staticBytePatches, executableHooks, staticPointers, issues);
+        }
+
+        var ordinal = 0;
+        foreach (var record in records.EnumerateArray())
+        {
+            var path = $"$.patchRecords[{ordinal}]";
+            var recordIndex = GetInt(record, "index") ?? ordinal;
+            var intent = GetString(record, "intent") ?? "";
+            switch (intent)
+            {
+                case "staticBytes":
+                    TryPlanStaticBytes(record, recordIndex, path, baseManifest, functionIndex, staticBytePatches, issues);
+                    break;
+                case "executableHook":
+                case "executableHookWithContinuation":
+                case "executableCall":
+                case "executableCtrHook":
+                case "executableCtrCall":
+                    TryPlanExecutableHook(record, recordIndex, path, baseManifest, functionIndex, semanticActionTargets, executableHooks, issues);
+                    break;
+                case "staticPointer":
+                    TryPlanStaticPointer(record, recordIndex, path, baseManifest, functionIndex, semanticActionTargets, staticPointers, issues);
+                    break;
+                default:
+                    issues.Add(Error("UnsupportedIntent", $"Unsupported Retro WFC patch intent '{intent}'.", path + ".intent"));
+                    break;
+            }
+            ordinal++;
+        }
+
+        return new RetroWfcContractLoweringPlan(source, records.GetArrayLength(), staticBytePatches, executableHooks, staticPointers, issues);
+    }
+
+    private static void TryPlanStaticBytes(
+        JsonElement record,
+        int recordIndex,
+        string path,
+        BaseManifest baseManifest,
+        BaseFunctionIndex functionIndex,
+        List<RetroWfcStaticBytePatchPlan> result,
+        List<RetroWfcLoweringIssue> issues)
+    {
+        if (!TryReadAddress(record, "address", out var address))
+        {
+            issues.Add(Error("MissingPatchAddress", "Static byte patch is missing a valid address.", path + ".address"));
+            return;
+        }
+        var section = FindSection(baseManifest, address);
+        if (section is null)
+        {
+            issues.Add(Error("PatchAddressOutsideBase", $"Static byte patch address 0x{address:X8} is outside known base sections.", path + ".address"));
+            return;
+        }
+
+        var sourceBytes = GetObject(record, "sourceBytes");
+        if (sourceBytes is null || GetString(sourceBytes.Value, "kind") != "payloadSlice")
+        {
+            issues.Add(Error("StaticBytesNotResolved", "Static byte patch must contain sourceBytes kind payloadSlice.", path + ".sourceBytes"));
+            return;
+        }
+        var hex = GetString(sourceBytes.Value, "hex");
+        var sha = GetString(sourceBytes.Value, "sha256");
+        if (string.IsNullOrWhiteSpace(hex) || !IsEvenHex(hex))
+        {
+            issues.Add(Error("InvalidStaticBytesHex", "Static byte patch sourceBytes.hex must be even-length hex.", path + ".sourceBytes.hex"));
+            return;
+        }
+        var size = hex.Length / 2;
+        if ((ulong)address + (ulong)size > section.GuestEnd)
+        {
+            issues.Add(Error("StaticBytesCrossSectionBoundary", $"Static byte patch 0x{address:X8}+0x{size:X} crosses section '{section.Name}'.", path + ".address"));
+            return;
+        }
+        if (GetObject(record, "target") is not { } target ||
+            GetString(target, "resolvedBy") != "sourceBytes" ||
+            GetBool(target, "resolutionRequired") != false)
+        {
+            issues.Add(Error("StaticBytesTargetNotResolved", "Static byte patch target must be resolved by sourceBytes.", path + ".target"));
+            return;
+        }
+
+        BaseFunctionRangeMetadata? function = null;
+        if (section.Executable)
+        {
+            function = functionIndex.FindContaining(address);
+            if (function is null)
+            {
+                issues.Add(Error("StaticExecutablePatchMissingFunction", $"Executable static byte patch 0x{address:X8} has no containing function.", path + ".address"));
+                return;
+            }
+        }
+
+        result.Add(new RetroWfcStaticBytePatchPlan(
+            recordIndex,
+            "staticBytes",
+            address,
+            size,
+            section.Name,
+            section.Executable,
+            function?.Start,
+            function?.End,
+            sha ?? "",
+            hex,
+            section.Executable ? "overlayBytePatch" : "dataBytePatch"));
+    }
+
+    private static void TryPlanExecutableHook(
+        JsonElement record,
+        int recordIndex,
+        string path,
+        BaseManifest baseManifest,
+        BaseFunctionIndex functionIndex,
+        IReadOnlyDictionary<string, RetroWfcSemanticActionTarget>? semanticActionTargets,
+        List<RetroWfcExecutableHookPlan> result,
+        List<RetroWfcLoweringIssue> issues)
+    {
+        if (!TryReadAddress(record, "address", out var address))
+        {
+            issues.Add(Error("MissingHookAddress", "Executable hook is missing a valid address.", path + ".address"));
+            return;
+        }
+        var section = FindSection(baseManifest, address);
+        if (section is null || !section.Executable)
+        {
+            issues.Add(Error("HookAddressNotExecutable", $"Executable hook address 0x{address:X8} is not in an executable base section.", path + ".address"));
+            return;
+        }
+        var function = functionIndex.FindContaining(address);
+        if (function is null)
+        {
+            issues.Add(Error("HookMissingFunction", $"Executable hook address 0x{address:X8} has no containing function.", path + ".address"));
+            return;
+        }
+
+        var actionIds = ReadStringArray(record, "semanticActionIds");
+        if (actionIds.Count == 0)
+        {
+            issues.Add(Error("HookMissingSemanticAction", "Executable hook has no semantic action id.", path + ".semanticActionIds"));
+            return;
+        }
+
+        var typeName = GetString(record, "typeName") ?? "";
+        var instructionCount = GetInt(record, "instructionCount") ?? (typeName is "branchCtr" or "branchCtrLink" ? 4 : 1);
+        if (instructionCount <= 0)
+        {
+            issues.Add(Error("InvalidHookInstructionCount", "Executable hook instruction count must be positive.", path + ".instructionCount"));
+            return;
+        }
+        var target = ResolveActionTarget(actionIds, semanticActionTargets, issues, path + ".semanticActionIds");
+        var continuationAddress = checked(address + (uint)(instructionCount * 4));
+
+        result.Add(new RetroWfcExecutableHookPlan(
+            recordIndex,
+            GetString(record, "intent") ?? "",
+            typeName,
+            address,
+            instructionCount,
+            function.Start,
+            function.End,
+            section.Name,
+            actionIds,
+            target is null ? "overlayHookPatchPendingAction" : "overlayHookPatch",
+            target?.GuestAddress,
+            target?.ActionId,
+            target?.Kind,
+            target?.Symbol,
+            continuationAddress));
+    }
+
+    private static void TryPlanStaticPointer(
+        JsonElement record,
+        int recordIndex,
+        string path,
+        BaseManifest baseManifest,
+        BaseFunctionIndex functionIndex,
+        IReadOnlyDictionary<string, RetroWfcSemanticActionTarget>? semanticActionTargets,
+        List<RetroWfcStaticPointerPlan> result,
+        List<RetroWfcLoweringIssue> issues)
+    {
+        if (!TryReadAddress(record, "address", out var address))
+        {
+            issues.Add(Error("MissingStaticPointerAddress", "Static pointer write is missing a valid address.", path + ".address"));
+            return;
+        }
+        var section = FindSection(baseManifest, address);
+        if (section is null)
+        {
+            issues.Add(Error("StaticPointerOutsideBase", $"Static pointer address 0x{address:X8} is outside known base sections.", path + ".address"));
+            return;
+        }
+
+        var actionIds = ReadStringArray(record, "semanticActionIds");
+        if (actionIds.Count == 0)
+        {
+            issues.Add(Error("StaticPointerMissingSemanticAction", "Static pointer write has no semantic action id.", path + ".semanticActionIds"));
+            return;
+        }
+
+        BaseFunctionRangeMetadata? function = null;
+        if (section.Executable)
+        {
+            function = functionIndex.FindContaining(address);
+            if (function is null)
+            {
+                issues.Add(Error("StaticPointerExecutableMissingFunction", $"Executable static pointer address 0x{address:X8} has no containing function.", path + ".address"));
+                return;
+            }
+        }
+        var target = ResolveActionTarget(actionIds, semanticActionTargets, issues, path + ".semanticActionIds");
+
+        result.Add(new RetroWfcStaticPointerPlan(
+            recordIndex,
+            address,
+            section.Name,
+            section.Executable,
+            function?.Start,
+            function?.End,
+            actionIds,
+            target is null
+                ? (section.Executable ? "overlayPointerPatchPendingAction" : "dataPointerPatchPendingAction")
+                : (section.Executable ? "overlayPointerPatch" : "dataPointerPatch"),
+            target?.GuestAddress,
+            target?.ActionId,
+            target?.Kind,
+            target?.Symbol));
+    }
+
+    private static RetroWfcSemanticActionTarget? ResolveActionTarget(
+        IReadOnlyList<string> actionIds,
+        IReadOnlyDictionary<string, RetroWfcSemanticActionTarget>? semanticActionTargets,
+        List<RetroWfcLoweringIssue> issues,
+        string path)
+    {
+        if (semanticActionTargets is null || semanticActionTargets.Count == 0)
+        {
+            return null;
+        }
+
+        var matches = actionIds
+            .Select(id => semanticActionTargets.TryGetValue(id, out var target) ? target : null)
+            .Where(target => target is not null)
+            .Cast<RetroWfcSemanticActionTarget>()
+            .ToList();
+        if (matches.Count == 0)
+        {
+            return null;
+        }
+        if (matches.Count != actionIds.Count)
+        {
+            issues.Add(Error("PartialSemanticResolution", "Only some semantic action IDs for this record have resolutions.", path));
+            return null;
+        }
+
+        var first = matches[0];
+        if (matches.Any(m => m.GuestAddress != first.GuestAddress || !string.Equals(m.Kind, first.Kind, StringComparison.Ordinal)))
+        {
+            issues.Add(Error("ConflictingSemanticResolution", "Semantic action IDs for this record resolve to conflicting targets.", path));
+            return null;
+        }
+
+        return first;
+    }
+
+    private static BaseSectionMetadata? FindSection(BaseManifest manifest, uint address) =>
+        manifest.Sections.FirstOrDefault(section => address >= section.GuestStart && address < section.GuestEnd);
+
+    private static bool IsEvenHex(string text) =>
+        text.Length % 2 == 0 && text.All(c => char.IsAsciiHexDigit(c));
+
+    private static RetroWfcLoweringIssue Error(string code, string message, string? path) =>
+        new("error", code, message, path);
+}
diff --git a/translator/src/Translator.Core/Mods/Mkwii/RetroWfcJson.cs b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcJson.cs
new file mode 100644
index 0000000..c40aa84
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcJson.cs
@@ -0,0 +1,59 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+
+namespace Translator.Core.Mods.Mkwii;
+
+internal static class RetroWfcJson
+{
+    public static JsonElement? GetObject(JsonElement obj, string name) =>
+        obj.ValueKind == JsonValueKind.Object &&
+        obj.TryGetProperty(name, out var value) &&
+        value.ValueKind == JsonValueKind.Object ? value : null;
+
+    public static JsonElement? GetArray(JsonElement obj, string name) =>
+        obj.ValueKind == JsonValueKind.Object &&
+        obj.TryGetProperty(name, out var value) &&
+        value.ValueKind == JsonValueKind.Array ? value : null;
+
+    public static string? GetString(JsonElement obj, string name) =>
+        obj.ValueKind == JsonValueKind.Object &&
+        obj.TryGetProperty(name, out var value) &&
+        value.ValueKind == JsonValueKind.String ? value.GetString() : null;
+
+    public static bool? GetBool(JsonElement obj, string name) =>
+        obj.ValueKind == JsonValueKind.Object &&
+        obj.TryGetProperty(name, out var value) &&
+        value.ValueKind is JsonValueKind.True or JsonValueKind.False ? value.GetBoolean() : null;
+
+    public static int? GetInt(JsonElement obj, string name) =>
+        obj.ValueKind == JsonValueKind.Object &&
+        obj.TryGetProperty(name, out var value) &&
+        value.ValueKind == JsonValueKind.Number && value.TryGetInt32(out var result) ? result : null;
+
+    public static IReadOnlyList<string> ReadStringArray(JsonElement obj, string name)
+    {
+        if (GetArray(obj, name) is not { } array) return Array.Empty<string>();
+        return array.EnumerateArray()
+            .Where(static item => item.ValueKind == JsonValueKind.String && !string.IsNullOrWhiteSpace(item.GetString()))
+            .Select(static item => item.GetString()!)
+            .ToList();
+    }
+
+    public static bool TryReadAddress(JsonElement obj, string name, out uint value)
+    {
+        value = 0;
+        return obj.ValueKind == JsonValueKind.Object &&
+               obj.TryGetProperty(name, out var element) &&
+               TryReadAddress(element, out value);
+    }
+
+    public static bool TryReadAddress(JsonElement element, out uint value)
+    {
+        value = 0;
+        var text = element.ValueKind == JsonValueKind.String ? element.GetString() : null;
+        return text is not null && GuestTargetParser.TryParseHexAddress(text, out value);
+    }
+}
diff --git a/translator/src/Translator.Core/Mods/Mkwii/RetroWfcModels.cs b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcModels.cs
new file mode 100644
index 0000000..8d53ccb
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcModels.cs
@@ -0,0 +1,21 @@
+namespace Translator.Core.Mods.Mkwii;
+
+/// <summary>
+/// A target synthesized while parsing the active WWFC payload descriptor.
+/// </summary>
+public sealed record RetroWfcSemanticActionTarget(
+    string ActionId,
+    string Kind,
+    uint GuestAddress,
+    uint ModuleOffset,
+    string? Symbol,
+    string? Source);
+
+/// <summary>
+/// A constructor or initialization callback discovered in the active payload image.
+/// </summary>
+public sealed record RetroWfcHelperInitCallback(
+    string Kind,
+    uint TargetAddress,
+    uint ModuleOffset,
+    string? Symbol);
diff --git a/translator/src/Translator.Core/Mods/Mkwii/RetroWfcPayload.cs b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcPayload.cs
new file mode 100644
index 0000000..ddefe71
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/Mkwii/RetroWfcPayload.cs
@@ -0,0 +1,524 @@
+using System.Buffers.Binary;
+using System.Text;
+using System.Text.Json;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Mods.Mkwii;
+
+public sealed record RetroWfcPayloadSummary(
+    string? Source,
+    string Game,
+    uint FormatVersion,
+    uint PayloadVersion,
+    string PayloadSha256,
+    uint HelperModuleOffset,
+    uint HelperModuleBase,
+    int PayloadImageSize,
+    uint InitializationTargetAddress,
+    uint InitializationSuccessReturnValue,
+    uint ConstructorsStartOffset,
+    uint ConstructorsEndOffset,
+    uint ExecutableStartOffset,
+    uint ExecutableEndOffset,
+    IReadOnlyList<RetroWfcHelperInitCallback> InitializationCallbacks)
+{
+}
+
+public sealed record RetroWfcPayloadLoadResult(
+    RetroWfcPayloadSummary Summary,
+    byte[] RelocatedImage,
+    RetroWfcContractLoweringPlan LoweringPlan);
+
+/// <summary>
+/// Reads the normal WWFC payload format directly. The only recomp-specific
+/// extension is the static-consumer descriptor referenced by payload info v3.
+/// </summary>
+public static class RetroWfcPayload
+{
+    private const int HeaderInfoOffset = 0x130;
+    private const int InfoSizeV3 = 0x74;
+    private const int PatchRecordSize = 0x10;
+    private const uint SupportedPayloadFormat = 3;
+    private const uint SupportedStaticConsumerFormat = 1;
+
+    private sealed record PendingBranchBack(int RecordIndex, uint PayloadOffset, uint DestinationAddress);
+
+    public static RetroWfcPayloadLoadResult Parse(
+        byte[] payloadImage,
+        BaseManifest baseManifest,
+        uint moduleGuestBase,
+        uint helperModuleOffset,
+        string? source = null)
+    {
+        ArgumentNullException.ThrowIfNull(payloadImage);
+        ArgumentNullException.ThrowIfNull(baseManifest);
+
+        RequireRange(payloadImage, 0, HeaderInfoOffset + InfoSizeV3, "payload header");
+        if (!payloadImage.AsSpan(0, 12).SequenceEqual("WWFC/Payload"u8))
+        {
+            throw new InvalidDataException("Retro WFC payload has an invalid magic value.");
+        }
+
+        var totalSize = ReadU32(payloadImage, 0x0C);
+        if (totalSize != payloadImage.Length)
+        {
+            throw new InvalidDataException(
+                $"Retro WFC payload header size 0x{totalSize:X} does not match the supplied image size 0x{payloadImage.Length:X}.");
+        }
+
+        var formatVersion = ReadInfo(payloadImage, 0x00);
+        var compatibleVersion = ReadInfo(payloadImage, 0x04);
+        if (formatVersion < SupportedPayloadFormat || compatibleVersion > SupportedPayloadFormat)
+        {
+            throw new InvalidDataException(
+                $"Retro WFC payload format {formatVersion} (compatible with {compatibleVersion}) cannot be read by format {SupportedPayloadFormat}.");
+        }
+
+        var game = Encoding.ASCII.GetString(payloadImage, HeaderInfoOffset + 0x08, 0x0C).TrimEnd('\0');
+        ValidateGame(game, baseManifest.GameId);
+        for (var offset = HeaderInfoOffset + 0x3C; offset < HeaderInfoOffset + 0x50; offset += 4)
+        {
+            if (ReadU32(payloadImage, offset) != 0)
+            {
+                throw new InvalidDataException($"Retro WFC payload reserved info word at 0x{offset:X} must be zero.");
+            }
+        }
+
+        var gotStart = ReadInfo(payloadImage, 0x18);
+        var gotEnd = ReadInfo(payloadImage, 0x1C);
+        var fixupStart = ReadInfo(payloadImage, 0x20);
+        var fixupEnd = ReadInfo(payloadImage, 0x24);
+        var patchStart = ReadInfo(payloadImage, 0x28);
+        var patchEnd = ReadInfo(payloadImage, 0x2C);
+        var staticInfoOffset = ReadInfo(payloadImage, 0x70);
+        ValidateAlignedRange(payloadImage, gotStart, gotEnd, 4, "GOT");
+        ValidateAlignedRange(payloadImage, fixupStart, fixupEnd, 4, "fixup table");
+        ValidateAlignedRange(payloadImage, patchStart, patchEnd, PatchRecordSize, "patch list");
+
+        RequireRange(payloadImage, staticInfoOffset, 0x10, "static-consumer descriptor");
+        var staticInfoVersion = ReadU32(payloadImage, staticInfoOffset);
+        if (staticInfoVersion != SupportedStaticConsumerFormat)
+        {
+            throw new InvalidDataException(
+                $"Retro WFC static-consumer descriptor format {staticInfoVersion} is not supported.");
+        }
+
+        var patchFreeEntry = ReadU32(payloadImage, checked((int)staticInfoOffset + 0x04));
+        var constructorsStart = patchEnd;
+        var constructorsEnd = ReadU32(payloadImage, checked((int)staticInfoOffset + 0x08));
+        var executableStart = constructorsEnd;
+        var executableEnd = ReadU32(payloadImage, checked((int)staticInfoOffset + 0x0C));
+        ValidateAlignedRange(payloadImage, constructorsStart, constructorsEnd, 4, "constructor table");
+        ValidateAlignedRange(payloadImage, executableStart, executableEnd, 4, "executable payload");
+        RequireExecutableOffset(patchFreeEntry, executableStart, executableEnd, "patch-free entry point");
+
+        var helperModuleBase = checked(moduleGuestBase + helperModuleOffset);
+        var semanticTargets = new Dictionary<string, RetroWfcSemanticActionTarget>(StringComparer.Ordinal);
+        var contractRecords = new List<Dictionary<string, object?>>();
+        var pendingBranchBacks = new List<PendingBranchBack>();
+        var recordCount = checked((int)((patchEnd - patchStart) / PatchRecordSize));
+
+        for (var index = 0; index < recordCount; index++)
+        {
+            var offset = checked((int)patchStart + index * PatchRecordSize);
+            var level = payloadImage[offset];
+            var type = payloadImage[offset + 1];
+            var address = ReadU32(payloadImage, offset + 4);
+            var arg0 = ReadU32(payloadImage, offset + 8);
+            var arg1 = ReadU32(payloadImage, offset + 12);
+            if ((level & 0x10) != 0 || address == 0)
+            {
+                continue;
+            }
+
+            switch (type)
+            {
+                case 0:
+                    AddStaticBytePatch(payloadImage, contractRecords, index, address, arg0, arg1);
+                    break;
+                case 1:
+                case 2:
+                case 3:
+                case 4:
+                case 5:
+                    AddExecutablePatch(
+                        payloadImage,
+                        baseManifest,
+                        semanticTargets,
+                        contractRecords,
+                        pendingBranchBacks,
+                        index,
+                        type,
+                        address,
+                        arg0,
+                        arg1,
+                        helperModuleOffset,
+                        helperModuleBase,
+                        executableStart,
+                        executableEnd);
+                    break;
+                case 6:
+                    AddStaticPointerPatch(
+                        payloadImage,
+                        baseManifest,
+                        semanticTargets,
+                        contractRecords,
+                        index,
+                        address,
+                        arg0,
+                        helperModuleOffset,
+                        helperModuleBase,
+                        executableStart,
+                        executableEnd);
+                    break;
+                default:
+                    throw new InvalidDataException($"Retro WFC patch #{index} has unsupported type {type}.");
+            }
+        }
+
+        var relocatedImage = payloadImage.ToArray();
+        RelocatePayload(relocatedImage, helperModuleBase, gotStart, gotEnd, fixupStart, fixupEnd);
+        foreach (var branchBack in pendingBranchBacks)
+        {
+            var branchAddress = checked(helperModuleBase + branchBack.PayloadOffset);
+            var instruction = 0x48000000u | ((branchBack.DestinationAddress - branchAddress) & 0x03FFFFFCu);
+            WriteU32(relocatedImage, branchBack.PayloadOffset, instruction);
+        }
+
+        var callbacks = ReadConstructors(
+            payloadImage,
+            helperModuleOffset,
+            helperModuleBase,
+            constructorsStart,
+            constructorsEnd,
+            executableStart,
+            executableEnd);
+        var contractJson = JsonSerializer.Serialize(new { patchRecords = contractRecords });
+        var loweringPlan = RetroWfcContractLoweringPlanner.Build(
+            contractJson,
+            baseManifest,
+            source,
+            semanticTargets);
+        if (!loweringPlan.IsPlannable)
+        {
+            throw new InvalidDataException(
+                "Retro WFC payload patch list could not be lowered statically." +
+                Environment.NewLine +
+                loweringPlan.BuildTextReport());
+        }
+
+        var summary = new RetroWfcPayloadSummary(
+            source,
+            game,
+            formatVersion,
+            ReadInfo(payloadImage, 0x14),
+            ChecksumUtilities.Sha256Hex(payloadImage),
+            helperModuleOffset,
+            helperModuleBase,
+            payloadImage.Length,
+            checked(helperModuleBase + patchFreeEntry),
+            0,
+            constructorsStart,
+            constructorsEnd,
+            executableStart,
+            executableEnd,
+            callbacks);
+        return new RetroWfcPayloadLoadResult(summary, relocatedImage, loweringPlan);
+    }
+
+    private static void AddStaticBytePatch(
+        byte[] payloadImage,
+        List<Dictionary<string, object?>> records,
+        int index,
+        uint address,
+        uint sourceOffset,
+        uint size)
+    {
+        RequireRange(payloadImage, sourceOffset, size, $"patch #{index} source bytes");
+        var bytes = payloadImage.AsSpan(checked((int)sourceOffset), checked((int)size));
+        records.Add(new Dictionary<string, object?>
+        {
+            ["index"] = index,
+            ["intent"] = "staticBytes",
+            ["typeName"] = "write",
+            ["address"] = $"0x{address:X8}",
+            ["sourceBytes"] = new
+            {
+                kind = "payloadSlice",
+                hex = ChecksumUtilities.ToHex(bytes),
+                sha256 = ChecksumUtilities.Sha256Hex(bytes),
+            },
+            ["target"] = new
+            {
+                resolvedBy = "sourceBytes",
+                resolutionRequired = false,
+            },
+        });
+    }
+
+    private static void AddExecutablePatch(
+        byte[] payloadImage,
+        BaseManifest baseManifest,
+        Dictionary<string, RetroWfcSemanticActionTarget> semanticTargets,
+        List<Dictionary<string, object?>> records,
+        List<PendingBranchBack> pendingBranchBacks,
+        int index,
+        byte type,
+        uint address,
+        uint targetValue,
+        uint arg1,
+        uint helperModuleOffset,
+        uint helperModuleBase,
+        uint executableStart,
+        uint executableEnd)
+    {
+        var (targetAddress, targetKind, moduleOffset) = ResolveTarget(
+            payloadImage,
+            baseManifest,
+            targetValue,
+            helperModuleOffset,
+            helperModuleBase,
+            executableStart,
+            executableEnd,
+            requireExecutable: true,
+            $"patch #{index} branch target");
+        if ((type is 4 or 5) && arg1 > 31)
+        {
+            throw new InvalidDataException($"Retro WFC patch #{index} uses invalid CTR scratch register {arg1}.");
+        }
+
+        if (type == 2)
+        {
+            if ((arg1 & 0x80000000u) != 0)
+            {
+                throw new InvalidDataException(
+                    $"Retro WFC patch #{index} writes its branch-back outside the payload; static lowering does not support that layout.");
+            }
+            RequireExecutableOffset(arg1, executableStart, executableEnd, $"patch #{index} branch-back");
+            pendingBranchBacks.Add(new PendingBranchBack(index, arg1, checked(address + 4)));
+        }
+
+        var actionId = $"payload.patch.{index}.target";
+        semanticTargets.Add(
+            actionId,
+            new RetroWfcSemanticActionTarget(actionId, targetKind, targetAddress, moduleOffset, null, "wwfc-payload"));
+        var (intent, typeName, instructionCount) = type switch
+        {
+            1 => ("executableHook", "branch", 1),
+            2 => ("executableHookWithContinuation", "branchHook", 1),
+            3 => ("executableCall", "call", 1),
+            4 => ("executableCtrHook", "branchCtr", 4),
+            5 => ("executableCtrCall", "branchCtrLink", 4),
+            _ => throw new InvalidOperationException(),
+        };
+        records.Add(new Dictionary<string, object?>
+        {
+            ["index"] = index,
+            ["intent"] = intent,
+            ["typeName"] = typeName,
+            ["address"] = $"0x{address:X8}",
+            ["instructionCount"] = instructionCount,
+            ["semanticActionIds"] = new[] { actionId },
+        });
+    }
+
+    private static void AddStaticPointerPatch(
+        byte[] payloadImage,
+        BaseManifest baseManifest,
+        Dictionary<string, RetroWfcSemanticActionTarget> semanticTargets,
+        List<Dictionary<string, object?>> records,
+        int index,
+        uint address,
+        uint targetValue,
+        uint helperModuleOffset,
+        uint helperModuleBase,
+        uint executableStart,
+        uint executableEnd)
+    {
+        var (targetAddress, targetKind, moduleOffset) = ResolveTarget(
+            payloadImage,
+            baseManifest,
+            targetValue,
+            helperModuleOffset,
+            helperModuleBase,
+            executableStart,
+            executableEnd,
+            requireExecutable: false,
+            $"patch #{index} pointer target");
+        var actionId = $"payload.patch.{index}.target";
+        semanticTargets.Add(
+            actionId,
+            new RetroWfcSemanticActionTarget(actionId, targetKind, targetAddress, moduleOffset, null, "wwfc-payload"));
+        records.Add(new Dictionary<string, object?>
+        {
+            ["index"] = index,
+            ["intent"] = "staticPointer",
+            ["typeName"] = "writePointer",
+            ["address"] = $"0x{address:X8}",
+            ["semanticActionIds"] = new[] { actionId },
+        });
+    }
+
+    private static (uint Address, string Kind, uint ModuleOffset) ResolveTarget(
+        byte[] payloadImage,
+        BaseManifest baseManifest,
+        uint value,
+        uint helperModuleOffset,
+        uint helperModuleBase,
+        uint executableStart,
+        uint executableEnd,
+        bool requireExecutable,
+        string description)
+    {
+        if ((value & 0x80000000u) == 0)
+        {
+            RequireRange(payloadImage, value, requireExecutable ? 4u : 1u, description);
+            var executable = value >= executableStart && value < executableEnd;
+            if (requireExecutable && !executable)
+            {
+                throw new InvalidDataException(
+                    $"Retro WFC {description} offset 0x{value:X} is outside the declared executable range.");
+            }
+            return (
+                checked(helperModuleBase + value),
+                executable ? "moduleFunction" : "moduleData",
+                checked(helperModuleOffset + value));
+        }
+
+        var section = baseManifest.Sections.FirstOrDefault(s => value >= s.GuestStart && value < s.GuestEnd);
+        if (section is null || (requireExecutable && !section.Executable))
+        {
+            throw new InvalidDataException(
+                $"Retro WFC {description} address 0x{value:X8} is outside a compatible base section.");
+        }
+        return (value, section.Executable ? "baseFunction" : "baseData", 0);
+    }
+
+    private static IReadOnlyList<RetroWfcHelperInitCallback> ReadConstructors(
+        byte[] payloadImage,
+        uint helperModuleOffset,
+        uint helperModuleBase,
+        uint start,
+        uint end,
+        uint executableStart,
+        uint executableEnd)
+    {
+        var callbacks = new List<RetroWfcHelperInitCallback>();
+        for (var offset = start; offset < end; offset += 4)
+        {
+            var targetOffset = ReadU32(payloadImage, offset);
+            if (targetOffset is 0 or 0xFFFFFFFFu)
+            {
+                continue;
+            }
+            RequireExecutableOffset(targetOffset, executableStart, executableEnd, "constructor");
+            callbacks.Add(new RetroWfcHelperInitCallback(
+                "constructor",
+                checked(helperModuleBase + targetOffset),
+                checked(helperModuleOffset + targetOffset),
+                null));
+        }
+        return callbacks;
+    }
+
+    private static void RelocatePayload(
+        byte[] image,
+        uint payloadBase,
+        uint gotStart,
+        uint gotEnd,
+        uint fixupStart,
+        uint fixupEnd)
+    {
+        for (var offset = gotStart; offset < gotEnd; offset += 4)
+        {
+            RelocateWord(image, offset, payloadBase);
+        }
+
+        for (var offset = fixupStart; offset < fixupEnd; offset += 4)
+        {
+            var targetOffset = ReadU32(image, offset);
+            RequireRange(image, targetOffset, 4, "fixup target");
+            RelocateWord(image, targetOffset, payloadBase);
+        }
+    }
+
+    private static void RelocateWord(byte[] image, uint offset, uint payloadBase)
+    {
+        var value = ReadU32(image, offset);
+        if ((value & 0x80000000u) == 0)
+        {
+            WriteU32(image, offset, checked(payloadBase + value));
+        }
+    }
+
+    private static uint ReadInfo(byte[] image, int relativeOffset) =>
+        ReadU32(image, HeaderInfoOffset + relativeOffset);
+
+    private static uint ReadU32(byte[] image, uint offset) =>
+        ReadU32(image, checked((int)offset));
+
+    private static uint ReadU32(byte[] image, int offset)
+    {
+        RequireRange(image, offset, 4, "32-bit value");
+        return BinaryPrimitives.ReadUInt32BigEndian(image.AsSpan(offset, 4));
+    }
+
+    private static void WriteU32(byte[] image, uint offset, uint value)
+    {
+        RequireRange(image, offset, 4, "32-bit value");
+        BinaryPrimitives.WriteUInt32BigEndian(image.AsSpan(checked((int)offset), 4), value);
+    }
+
+    private static void ValidateGame(string payloadGame, string baseGame)
+    {
+        if (payloadGame.Length < 5 ||
+            baseGame.Length < 4 ||
+            !payloadGame.StartsWith(baseGame[..4], StringComparison.OrdinalIgnoreCase) ||
+            payloadGame[4] != 'D')
+        {
+            throw new InvalidDataException(
+                $"Retro WFC payload game '{payloadGame}' is not compatible with base game '{baseGame}'.");
+        }
+    }
+
+    private static void ValidateAlignedRange(
+        byte[] image,
+        uint start,
+        uint end,
+        int elementSize,
+        string description)
+    {
+        if (end < start || (start & 3u) != 0 || ((end - start) % elementSize) != 0)
+        {
+            throw new InvalidDataException($"Retro WFC payload {description} range 0x{start:X}-0x{end:X} is malformed.");
+        }
+        RequireRange(image, start, end - start, description);
+    }
+
+    private static void RequireExecutableOffset(uint offset, uint start, uint end, string description)
+    {
+        if ((offset & 3) != 0 || offset < start || offset >= end)
+        {
+            throw new InvalidDataException(
+                $"Retro WFC payload {description} offset 0x{offset:X} is outside executable range 0x{start:X}-0x{end:X}.");
+        }
+    }
+
+    private static void RequireRange(byte[] image, uint offset, uint size, string description)
+    {
+        if (offset > image.Length || size > image.Length - offset)
+        {
+            throw new InvalidDataException(
+                $"Retro WFC payload {description} range 0x{offset:X}+0x{size:X} is outside the image.");
+        }
+    }
+
+    private static void RequireRange(byte[] image, int offset, int size, string description)
+    {
+        if (offset < 0 || size < 0 || offset > image.Length || size > image.Length - offset)
+        {
+            throw new InvalidDataException(
+                $"Retro WFC payload {description} range 0x{offset:X}+0x{size:X} is outside the image.");
+        }
+    }
+}
diff --git a/translator/src/Translator.Core/Mods/ModDataPatchWriter.cs b/translator/src/Translator.Core/Mods/ModDataPatchWriter.cs
new file mode 100644
index 0000000..2992d1e
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/ModDataPatchWriter.cs
@@ -0,0 +1,477 @@
+using System.Text;
+using Translator.Core.IO;
+using Translator.Core.Parsing.Kamek;
+using Translator.Core.Mods.Mkwii;
+
+namespace Translator.Core.Mods;
+
+public static class ModDataPatchWriter
+{
+    public static void Write(
+        string path,
+        KamekPatchPlan patchPlan,
+        uint moduleLinkBase,
+        BaseManifest baseManifest,
+        IReadOnlyList<string> dvdOverlayRoots,
+        byte[] relocatedModuleImage,
+        byte[]? sourceKamekCodeSha1Digest,
+        IReadOnlyCollection<RetroWfcStaticPointerPlan>? retroWfcStaticPointers,
+        uint moduleBssOffset,
+        uint moduleBssSize,
+        uint ctorStart,
+        uint ctorEnd,
+        bool emitCtorRunner,
+        uint? retroWfcInitializerAddress = null,
+        uint? retroWfcInitializerPayloadBase = null,
+        uint? retroWfcInitializerSuccessReturnValue = null,
+        string? publishedBlobDirectory = null,
+        string? riivolutionXml = null,
+        IReadOnlyList<ModRiivolutionOption>? riivolutionOptions = null)
+    {
+        var blobAssemblyPath = Path.Combine(
+            Path.GetDirectoryName(path) ?? ".",
+            Path.GetFileNameWithoutExtension(path) + "_blobs.S");
+        var blobDirectory = Path.Combine(
+            Path.GetDirectoryName(path) ?? ".",
+            Path.GetFileNameWithoutExtension(path) + "_blobs");
+        var blobs = new List<ModDataBlob>
+        {
+            new("kModuleImage", "module_image.bin", relocatedModuleImage),
+        };
+        if (sourceKamekCodeSha1Digest is { Length: 20 })
+        {
+            blobs.Add(new ModDataBlob("kKamekCodeSha1Digest", "kamek_code_sha1.bin", sourceKamekCodeSha1Digest));
+        }
+        WriteBlobFiles(
+            blobAssemblyPath,
+            blobDirectory,
+            publishedBlobDirectory ?? blobDirectory,
+            blobs);
+
+        var sb = new StringBuilder();
+        var emitRetroWfcInitializer =
+            retroWfcInitializerAddress.HasValue &&
+            retroWfcInitializerPayloadBase.HasValue &&
+            retroWfcInitializerSuccessReturnValue.HasValue;
+        sb.AppendLine("// Generated by translator translate-mod.");
+        sb.AppendLine("#include \"abi_bridge.h\"");
+        sb.AppendLine("#include \"memory.h\"");
+        sb.AppendLine("#include \"recomp_mod_loader.h\"");
+        sb.AppendLine();
+        sb.AppendLine("#include <cstdint>");
+        sb.AppendLine("#include <cstring>");
+        sb.AppendLine("#include <iostream>");
+        sb.AppendLine();
+        sb.AppendLine("extern \"C\" {");
+        foreach (var blob in blobs)
+        {
+            sb.AppendLine($"extern const uint8_t {blob.Symbol}[];");
+        }
+        sb.AppendLine("} // extern \"C\"");
+        sb.AppendLine();
+        sb.AppendLine("namespace {");
+        sb.AppendLine();
+        sb.AppendLine($"constexpr uint32_t kModuleGuestBase = 0x{patchPlan.ModuleGuestBase:X8}u;");
+        sb.AppendLine($"constexpr uint32_t kModuleImageSize = 0x{relocatedModuleImage.Length:X8}u;");
+        sb.AppendLine($"constexpr uint32_t kModuleBssOffset = 0x{moduleBssOffset:X8}u;");
+        sb.AppendLine($"constexpr uint32_t kModuleBssSize = 0x{moduleBssSize:X8}u;");
+        sb.AppendLine("constexpr uint32_t kModuleBssEnd = kModuleBssOffset + kModuleBssSize;");
+        sb.AppendLine("constexpr uint32_t kModuleReservedSize = kModuleImageSize > kModuleBssEnd ? kModuleImageSize : kModuleBssEnd;");
+        sb.AppendLine($"constexpr uint32_t kCtorStart = 0x{ctorStart:X8}u;");
+        sb.AppendLine($"constexpr uint32_t kCtorEnd = 0x{ctorEnd:X8}u;");
+        if (emitRetroWfcInitializer)
+        {
+            sb.AppendLine($"constexpr uint32_t kRetroWfcInitializerAddress = 0x{retroWfcInitializerAddress!.Value:X8}u;");
+            sb.AppendLine($"constexpr uint32_t kRetroWfcInitializerPayloadBase = 0x{retroWfcInitializerPayloadBase!.Value:X8}u;");
+            sb.AppendLine($"constexpr uint32_t kRetroWfcInitializerSuccessReturnValue = 0x{retroWfcInitializerSuccessReturnValue!.Value:X8}u;");
+        }
+        sb.AppendLine("constexpr uint32_t kModuleReservedEnd = kModuleGuestBase + kModuleReservedSize;");
+        sb.AppendLine();
+        sb.AppendLine("void InitializeModuleImage() {");
+        sb.AppendLine("    std::memcpy(Memory::GetPointer(kModuleGuestBase, kModuleImageSize), kModuleImage, kModuleImageSize);");
+        sb.AppendLine("    if (kModuleBssSize != 0) {");
+        sb.AppendLine("        std::memset(Memory::GetPointer(kModuleGuestBase + kModuleBssOffset, kModuleBssSize), 0, kModuleBssSize);");
+        sb.AppendLine("    }");
+        if (sourceKamekCodeSha1Digest is { Length: 20 })
+        {
+            sb.AppendLine("    std::memcpy(Memory::GetPointer(0x800017B0u, 20u), kKamekCodeSha1Digest, 20u);");
+        }
+        sb.AppendLine("}");
+        sb.AppendLine();
+        EmitStaticPatchHelpers(sb);
+        sb.AppendLine();
+        sb.AppendLine("void RegisterExecutableRanges() {");
+        var knownFunctionsBySection = baseManifest.Functions
+            .Where(f => f.End > f.Start && f.Flags.Contains("HasKnownTranslation"))
+            .GroupBy(f => f.SourceSection)
+            .ToDictionary(g => g.Key, g => g.OrderBy(f => f.Start).First());
+        foreach (var section in baseManifest.Sections
+                     .Where(s => s.Executable && s.GuestEnd > s.GuestStart)
+                     .OrderBy(s => s.GuestStart))
+        {
+            var guardedStart = knownFunctionsBySection.TryGetValue(section.Name, out var firstFunction)
+                ? firstFunction.Start
+                : section.GuestStart;
+            if (guardedStart >= section.GuestEnd)
+            {
+                continue;
+            }
+
+            var name = $"{section.Source}:{section.Name}";
+            sb.AppendLine(
+                $"    RecompMod::RegisterExecutableRange(0x{guardedStart:X8}u, 0x{section.GuestEnd:X8}u, \"{EscapeCxxStringLiteral(name)}\");");
+        }
+        sb.AppendLine("}");
+        sb.AppendLine();
+        sb.AppendLine("void ApplyExecutableBasePatches() {");
+        foreach (var patch in patchPlan.ExecutablePatches.OrderBy(p => p.CommandAddress))
+        {
+            EmitBaseExecutablePatch(sb, patch, moduleLinkBase);
+        }
+        sb.AppendLine("}");
+        sb.AppendLine();
+        if (emitCtorRunner)
+        {
+            sb.AppendLine("void RunCtors() {");
+            sb.AppendLine("    InitializePersistentCpuContext();");
+            sb.AppendLine("    CpuContext& cpu = GetPersistentCpuContext();");
+            sb.AppendLine("    for (uint32_t ptr = kCtorStart; ptr + 4 <= kCtorEnd; ptr += 4) {");
+            sb.AppendLine("        const uint32_t ctor = Memory::Read32(ptr);");
+            sb.AppendLine("        if (ctor != 0) {");
+            sb.AppendLine("            InvokeIndirectCpu(ctor, &cpu);");
+            sb.AppendLine("        }");
+            sb.AppendLine("    }");
+            sb.AppendLine("}");
+            sb.AppendLine();
+        }
+        if (emitRetroWfcInitializer)
+        {
+            sb.AppendLine("void RunRetroWfcInitializer() {");
+            sb.AppendLine("    InitializePersistentCpuContext();");
+            sb.AppendLine("    CpuContext& cpu = GetPersistentCpuContext();");
+            sb.AppendLine("    cpu.gpr[3] = kRetroWfcInitializerPayloadBase;");
+            sb.AppendLine("    InvokeIndirectCpu(kRetroWfcInitializerAddress, &cpu);");
+            sb.AppendLine("    if (cpu.gpr[3] != kRetroWfcInitializerSuccessReturnValue) {");
+            sb.AppendLine("        std::cerr << \"[mod] FATAL Retro WFC helper initialization failed: result=0x\" << std::hex << cpu.gpr[3]");
+            sb.AppendLine("                  << \" expected=0x\" << kRetroWfcInitializerSuccessReturnValue << std::dec << std::endl;");
+            sb.AppendLine("        std::abort();");
+            sb.AppendLine("    }");
+            sb.AppendLine("}");
+            sb.AppendLine();
+        }
+        sb.AppendLine("void ApplyDataPatches() {");
+        sb.AppendLine("    InitializeModuleImage();");
+        sb.AppendLine("    ApplyExecutableBasePatches();");
+        foreach (var patch in patchPlan.DataPatches.OrderBy(p => p.CommandAddress))
+        {
+            EmitPatch(sb, patch, patchPlan.ModuleGuestBase);
+        }
+        foreach (var pointer in (retroWfcStaticPointers ?? Array.Empty<RetroWfcStaticPointerPlan>())
+                     .Where(p => !p.SectionExecutable && p.TargetAddress.HasValue)
+                     .OrderBy(p => p.Address)
+                     .ThenBy(p => p.RecordIndex))
+        {
+            sb.AppendLine($"    Memory::Write32(0x{pointer.Address:X8}u, 0x{pointer.TargetAddress!.Value:X8}u); // Retro WFC {EscapeCxxStringLiteral(pointer.TargetActionId ?? string.Join(",", pointer.SemanticActionIds))}");
+        }
+        sb.AppendLine("    RegisterExecutableRanges();");
+        sb.AppendLine("}");
+        sb.AppendLine();
+        sb.AppendLine("struct RegisterModDataPatches {");
+        sb.AppendLine("    RegisterModDataPatches() {");
+        sb.AppendLine("        RecompMod::RegisterMemoryReservation(kModuleGuestBase, kModuleReservedEnd, \"Kamek module\");");
+        sb.AppendLine("        RecompMod::RegisterMemoryInitializer(&ApplyDataPatches);");
+        if (emitCtorRunner)
+        {
+            sb.AppendLine("        RecompMod::RegisterPostRelInitializer(&RunCtors);");
+        }
+        if (emitRetroWfcInitializer)
+        {
+            sb.AppendLine("        RecompMod::RegisterPostRelInitializer(&RunRetroWfcInitializer);");
+        }
+        foreach (var root in dvdOverlayRoots)
+        {
+            sb.AppendLine($"        RecompMod::RegisterDvdOverlayRoot(\"{EscapeCxxStringLiteral(root)}\");");
+        }
+        if (!string.IsNullOrWhiteSpace(riivolutionXml))
+        {
+            sb.AppendLine($"        RecompMod::RegisterRiivolutionXml(\"{EscapeCxxStringLiteral(riivolutionXml)}\");");
+        }
+        foreach (var option in riivolutionOptions ?? [])
+        {
+            sb.AppendLine(
+                $"        RecompMod::RegisterRiivolutionOption(\"{EscapeCxxStringLiteral(option.Section)}\", \"{EscapeCxxStringLiteral(option.Option)}\", {option.Choice}u);");
+        }
+        sb.AppendLine("    }");
+        sb.AppendLine("};");
+        sb.AppendLine();
+        sb.AppendLine("RegisterModDataPatches g_registerModDataPatches;");
+        sb.AppendLine();
+        sb.AppendLine("} // namespace");
+
+        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+        FileOutput.WriteTextIfChanged(path, sb.ToString());
+    }
+
+    private static void WriteBlobFiles(
+        string assemblyPath,
+        string blobDirectory,
+        string blobReferenceDirectory,
+        IReadOnlyList<ModDataBlob> blobs)
+    {
+        var assemblyBlobs = blobs.Select(blob => new AssemblyBlob(
+            blob.FileName,
+            blob.Symbol,
+            blob.Data,
+            $"{blob.FileName}: {blob.Data.Length} bytes"))
+            .ToList();
+        AssemblyBlobWriter.Write(
+            assemblyPath,
+            blobDirectory,
+            blobReferenceDirectory,
+            assemblyBlobs,
+            "// Generated by translator translate-mod.",
+            "// Binary payloads referenced by mod_data_patches.cpp.");
+    }
+
+    private sealed record ModDataBlob(string Symbol, string FileName, byte[] Data);
+
+    private static void EmitStaticPatchHelpers(StringBuilder sb)
+    {
+        sb.AppendLine("void PatchGuestU8(uint32_t address, uint32_t value) {");
+        sb.AppendLine("    auto* ptr = Memory::GetPointer(address, 1);");
+        sb.AppendLine("    ptr[0] = static_cast<uint8_t>(value);");
+        sb.AppendLine("}");
+        sb.AppendLine();
+        sb.AppendLine("void PatchGuestU16(uint32_t address, uint32_t value) {");
+        sb.AppendLine("    auto* ptr = Memory::GetPointer(address, 2);");
+        sb.AppendLine("    ptr[0] = static_cast<uint8_t>((value >> 8) & 0xFFu);");
+        sb.AppendLine("    ptr[1] = static_cast<uint8_t>(value & 0xFFu);");
+        sb.AppendLine("}");
+        sb.AppendLine();
+        sb.AppendLine("void PatchGuestU32(uint32_t address, uint32_t value) {");
+        sb.AppendLine("    auto* ptr = Memory::GetPointer(address, 4);");
+        sb.AppendLine("    ptr[0] = static_cast<uint8_t>((value >> 24) & 0xFFu);");
+        sb.AppendLine("    ptr[1] = static_cast<uint8_t>((value >> 16) & 0xFFu);");
+        sb.AppendLine("    ptr[2] = static_cast<uint8_t>((value >> 8) & 0xFFu);");
+        sb.AppendLine("    ptr[3] = static_cast<uint8_t>(value & 0xFFu);");
+        sb.AppendLine("}");
+        sb.AppendLine();
+        sb.AppendLine("bool EncodeStaticPpcBranch(uint32_t from, uint32_t to, bool link, uint32_t& instruction) {");
+        sb.AppendLine("    const int32_t delta = static_cast<int32_t>(to) - static_cast<int32_t>(from);");
+        sb.AppendLine("    if ((delta & 0x3) != 0 || delta < -0x02000000 || delta > 0x01FFFFFC) {");
+        sb.AppendLine("        return false;");
+        sb.AppendLine("    }");
+        sb.AppendLine("    instruction = 0x48000000u | (static_cast<uint32_t>(delta) & 0x03FFFFFCu) | (link ? 1u : 0u);");
+        sb.AppendLine("    return true;");
+        sb.AppendLine("}");
+        sb.AppendLine();
+        sb.AppendLine("void FatalStaticPatchRange(uint32_t address, uint32_t target) {");
+        sb.AppendLine("    std::cerr << \"[mod] FATAL static executable branch target out of range\" << std::endl;");
+        sb.AppendLine("    std::cerr << \"  address: 0x\" << std::hex << address << std::endl;");
+        sb.AppendLine("    std::cerr << \"  target:  0x\" << target << std::dec << std::endl;");
+        sb.AppendLine("    std::abort();");
+        sb.AppendLine("}");
+    }
+
+    private static void EmitBaseExecutablePatch(StringBuilder sb, KamekPatchClassification patch, uint moduleLinkBase)
+    {
+        var address = patch.CommandAddress;
+        switch (patch.CommandId)
+        {
+            case KamekCommandId.Addr32:
+            {
+                var value = KamekAddress.Resolve(patch.Arguments[0], moduleLinkBase);
+                sb.AppendLine($"    PatchGuestU32(0x{address:X8}u, 0x{value:X8}u);");
+                return;
+            }
+            case KamekCommandId.Addr16Lo:
+            {
+                var value = KamekAddress.Resolve(patch.Arguments[0], moduleLinkBase) & 0xFFFFu;
+                sb.AppendLine($"    PatchGuestU16(0x{address:X8}u, 0x{value:X4}u);");
+                return;
+            }
+            case KamekCommandId.Addr16Hi:
+            {
+                var value = KamekAddress.Resolve(patch.Arguments[0], moduleLinkBase) >> 16;
+                sb.AppendLine($"    PatchGuestU16(0x{address:X8}u, 0x{value:X4}u);");
+                return;
+            }
+            case KamekCommandId.Addr16Ha:
+            {
+                var value = (KamekAddress.Resolve(patch.Arguments[0], moduleLinkBase) + 0x8000u) >> 16;
+                sb.AppendLine($"    PatchGuestU16(0x{address:X8}u, 0x{value:X4}u);");
+                return;
+            }
+            case KamekCommandId.Rel24:
+            {
+                var target = KamekAddress.Resolve(patch.Arguments[0], moduleLinkBase);
+                sb.AppendLine("    {");
+                sb.AppendLine($"        const uint32_t address = 0x{address:X8}u;");
+                sb.AppendLine($"        const uint32_t target = 0x{target:X8}u;");
+                sb.AppendLine("        const uint32_t original = Memory::Read32(address);");
+                sb.AppendLine("        const int32_t delta = static_cast<int32_t>(target) - static_cast<int32_t>(address);");
+                sb.AppendLine("        if ((delta & 0x3) != 0 || delta < -0x02000000 || delta > 0x01FFFFFC) {");
+                sb.AppendLine("            FatalStaticPatchRange(address, target);");
+                sb.AppendLine("        }");
+                sb.AppendLine("        PatchGuestU32(address, (original & 0xFC000003u) | (static_cast<uint32_t>(delta) & 0x03FFFFFCu));");
+                sb.AppendLine("    }");
+                return;
+            }
+            case KamekCommandId.Write32:
+                sb.AppendLine($"    PatchGuestU32(0x{address:X8}u, 0x{patch.Arguments[0]:X8}u);");
+                return;
+            case KamekCommandId.Write16:
+                sb.AppendLine($"    PatchGuestU16(0x{address:X8}u, 0x{patch.Arguments[0] & 0xFFFFu:X4}u);");
+                return;
+            case KamekCommandId.Write8:
+                sb.AppendLine($"    PatchGuestU8(0x{address:X8}u, 0x{patch.Arguments[0] & 0xFFu:X2}u);");
+                return;
+            case KamekCommandId.CondWritePointer:
+            {
+                var value = KamekAddress.Resolve(patch.Arguments[0], moduleLinkBase);
+                EmitConditionalShadowWrite32(sb, address, patch.Arguments[1], value);
+                return;
+            }
+            case KamekCommandId.CondWrite32:
+                EmitConditionalShadowWrite32(sb, address, patch.Arguments[1], patch.Arguments[0]);
+                return;
+            case KamekCommandId.CondWrite16:
+                EmitConditionalShadowWrite16(sb, address, patch.Arguments[1], patch.Arguments[0]);
+                return;
+            case KamekCommandId.CondWrite8:
+                EmitConditionalShadowWrite8(sb, address, patch.Arguments[1], patch.Arguments[0]);
+                return;
+            case KamekCommandId.Branch:
+            case KamekCommandId.BranchLink:
+            {
+                var target = KamekAddress.Resolve(patch.Arguments[0], moduleLinkBase);
+                sb.AppendLine("    {");
+                sb.AppendLine($"        uint32_t instruction = 0;");
+                sb.AppendLine($"        if (!EncodeStaticPpcBranch(0x{address:X8}u, 0x{target:X8}u, {(patch.CommandId == KamekCommandId.BranchLink ? "true" : "false")}, instruction)) {{");
+                sb.AppendLine($"            FatalStaticPatchRange(0x{address:X8}u, 0x{target:X8}u);");
+                sb.AppendLine("        }");
+                sb.AppendLine($"        PatchGuestU32(0x{address:X8}u, instruction);");
+                sb.AppendLine("    }");
+                return;
+            }
+            default:
+                throw new InvalidDataException($"Cannot emit executable shadow patch for {patch.CommandId} at 0x{address:X8}.");
+        }
+    }
+
+    private static void EmitPatch(StringBuilder sb, KamekPatchClassification patch, uint moduleGuestBase)
+    {
+        var address = patch.CommandAddress;
+        switch (patch.CommandId)
+        {
+            case KamekCommandId.Addr32:
+            {
+                var value = KamekAddress.Resolve(patch.Arguments[0], moduleGuestBase);
+                sb.AppendLine($"    Memory::Write32(0x{address:X8}u, 0x{value:X8}u);");
+                return;
+            }
+            case KamekCommandId.Addr16Lo:
+            {
+                var value = KamekAddress.Resolve(patch.Arguments[0], moduleGuestBase) & 0xFFFFu;
+                sb.AppendLine($"    Memory::Write16(0x{address:X8}u, 0x{value:X4}u);");
+                return;
+            }
+            case KamekCommandId.Addr16Hi:
+            {
+                var value = KamekAddress.Resolve(patch.Arguments[0], moduleGuestBase) >> 16;
+                sb.AppendLine($"    Memory::Write16(0x{address:X8}u, 0x{value:X4}u);");
+                return;
+            }
+            case KamekCommandId.Addr16Ha:
+            {
+                var value = (KamekAddress.Resolve(patch.Arguments[0], moduleGuestBase) + 0x8000u) >> 16;
+                sb.AppendLine($"    Memory::Write16(0x{address:X8}u, 0x{value:X4}u);");
+                return;
+            }
+            case KamekCommandId.Write32:
+                sb.AppendLine($"    Memory::Write32(0x{address:X8}u, 0x{patch.Arguments[0]:X8}u);");
+                return;
+            case KamekCommandId.Write16:
+                sb.AppendLine($"    Memory::Write16(0x{address:X8}u, 0x{patch.Arguments[0] & 0xFFFFu:X4}u);");
+                return;
+            case KamekCommandId.Write8:
+                sb.AppendLine($"    Memory::Write8(0x{address:X8}u, 0x{patch.Arguments[0] & 0xFFu:X2}u);");
+                return;
+            case KamekCommandId.CondWritePointer:
+            {
+                var value = KamekAddress.Resolve(patch.Arguments[0], moduleGuestBase);
+                EmitConditionalWrite32(sb, address, patch.Arguments[1], value);
+                return;
+            }
+            case KamekCommandId.CondWrite32:
+                EmitConditionalWrite32(sb, address, patch.Arguments[1], patch.Arguments[0]);
+                return;
+            case KamekCommandId.CondWrite16:
+                EmitConditionalWrite16(sb, address, patch.Arguments[1] & 0xFFFFu, patch.Arguments[0] & 0xFFFFu);
+                return;
+            case KamekCommandId.CondWrite8:
+                EmitConditionalWrite8(sb, address, patch.Arguments[1] & 0xFFu, patch.Arguments[0] & 0xFFu);
+                return;
+            default:
+                throw new InvalidDataException($"Cannot emit data patch for {patch.CommandId} at 0x{address:X8}.");
+        }
+    }
+
+    private static void EmitConditionalWrite32(StringBuilder sb, uint address, uint expected, uint value)
+    {
+        sb.AppendLine($"    if (Memory::Read32(0x{address:X8}u) == 0x{expected:X8}u) {{");
+        sb.AppendLine($"        Memory::Write32(0x{address:X8}u, 0x{value:X8}u);");
+        sb.AppendLine("    } else {");
+        sb.AppendLine($"        std::cerr << \"[mod] Skipped CondWrite32 at 0x{address:X8}\" << std::endl;");
+        sb.AppendLine("    }");
+    }
+
+    private static void EmitConditionalWrite16(StringBuilder sb, uint address, uint expected, uint value)
+    {
+        sb.AppendLine($"    if (Memory::Read16(0x{address:X8}u) == 0x{expected:X4}u) {{");
+        sb.AppendLine($"        Memory::Write16(0x{address:X8}u, 0x{value:X4}u);");
+        sb.AppendLine("    } else {");
+        sb.AppendLine($"        std::cerr << \"[mod] Skipped CondWrite16 at 0x{address:X8}\" << std::endl;");
+        sb.AppendLine("    }");
+    }
+
+    private static void EmitConditionalWrite8(StringBuilder sb, uint address, uint expected, uint value)
+    {
+        sb.AppendLine($"    if (Memory::Read8(0x{address:X8}u) == 0x{expected:X2}u) {{");
+        sb.AppendLine($"        Memory::Write8(0x{address:X8}u, 0x{value:X2}u);");
+        sb.AppendLine("    } else {");
+        sb.AppendLine($"        std::cerr << \"[mod] Skipped CondWrite8 at 0x{address:X8}\" << std::endl;");
+        sb.AppendLine("    }");
+    }
+
+    private static void EmitConditionalShadowWrite32(StringBuilder sb, uint address, uint expected, uint value)
+    {
+        sb.AppendLine($"    if (Memory::Read32(0x{address:X8}u) == 0x{expected:X8}u) {{");
+        sb.AppendLine($"        PatchGuestU32(0x{address:X8}u, 0x{value:X8}u);");
+        sb.AppendLine("    } else {");
+        sb.AppendLine($"        std::cerr << \"[mod] Skipped executable CondWrite32 shadow patch at 0x{address:X8}\" << std::endl;");
+        sb.AppendLine("    }");
+    }
+
+    private static void EmitConditionalShadowWrite16(StringBuilder sb, uint address, uint expected, uint value)
+    {
+        sb.AppendLine($"    if (Memory::Read16(0x{address:X8}u) == 0x{expected & 0xFFFFu:X4}u) {{");
+        sb.AppendLine($"        PatchGuestU16(0x{address:X8}u, 0x{value & 0xFFFFu:X4}u);");
+        sb.AppendLine("    } else {");
+        sb.AppendLine($"        std::cerr << \"[mod] Skipped executable CondWrite16 shadow patch at 0x{address:X8}\" << std::endl;");
+        sb.AppendLine("    }");
+    }
+
+    private static void EmitConditionalShadowWrite8(StringBuilder sb, uint address, uint expected, uint value)
+    {
+        sb.AppendLine($"    if (Memory::Read8(0x{address:X8}u) == 0x{expected & 0xFFu:X2}u) {{");
+        sb.AppendLine($"        PatchGuestU8(0x{address:X8}u, 0x{value & 0xFFu:X2}u);");
+        sb.AppendLine("    } else {");
+        sb.AppendLine($"        std::cerr << \"[mod] Skipped executable CondWrite8 shadow patch at 0x{address:X8}\" << std::endl;");
+        sb.AppendLine("    }");
+    }
+
+    private static string EscapeCxxStringLiteral(string value) =>
+        value.Replace("\\", "\\\\", StringComparison.Ordinal)
+            .Replace("\"", "\\\"", StringComparison.Ordinal);
+}
diff --git a/translator/src/Translator.Core/Mods/ModDvdOverlayRoots.cs b/translator/src/Translator.Core/Mods/ModDvdOverlayRoots.cs
new file mode 100644
index 0000000..6a748dd
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/ModDvdOverlayRoots.cs
@@ -0,0 +1,42 @@
+namespace Translator.Core.Mods;
+
+/// <summary>
+/// A Riivolution option choice pinned by the distribution spec. Section may be empty,
+/// meaning "match any section"; Choice is the 1-based choice index, 0 meaning disabled.
+/// </summary>
+public sealed record ModRiivolutionOption(string Section, string Option, uint Choice);
+
+/// <summary>
+/// The pack-relative directories the runtime mounts over the disc file system.
+/// These reach the runtime as <c>RecompMod::RegisterDvdOverlayRoot</c> calls in the
+/// generated mod data-patch translation unit, not as a side-car manifest.
+/// </summary>
+public static class ModDvdOverlayRoots
+{
+    public static IReadOnlyList<string> Discover(string? modRoot)
+    {
+        if (string.IsNullOrWhiteSpace(modRoot))
+        {
+            return [];
+        }
+
+        var sourceRoot = Path.GetFullPath(modRoot);
+        var packageRoot = Path.GetFileName(sourceRoot.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar));
+        if (string.IsNullOrWhiteSpace(packageRoot))
+        {
+            return [];
+        }
+
+        var candidates = new[]
+        {
+            (Source: sourceRoot, Package: packageRoot),
+            (Source: Path.Combine(sourceRoot, "files"), Package: Path.Combine(packageRoot, "files"))
+        };
+
+        return candidates
+            .Where(candidate => Directory.Exists(candidate.Source))
+            .Select(candidate => candidate.Package.Replace('\\', '/'))
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToList();
+    }
+}
diff --git a/translator/src/Translator.Core/Mods/ModFunctionDiscovery.cs b/translator/src/Translator.Core/Mods/ModFunctionDiscovery.cs
new file mode 100644
index 0000000..c5f8a8e
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/ModFunctionDiscovery.cs
@@ -0,0 +1,733 @@
+using System.Buffers.Binary;
+using Translator.Core.Disassembly;
+using Translator.Core.Parsing.Kamek;
+
+namespace Translator.Core.Mods;
+
+public sealed record ModFunctionStart(uint Address, string Reason);
+
+/// <summary>
+/// Recovers module entry points from the relocated Kamek image alone. Retro Rewind
+/// packs ship no Code.map, so these heuristics are the only source of module
+/// function boundaries.
+/// </summary>
+public static class ModFunctionDiscovery
+{
+    public static IReadOnlyList<ModFunctionStart> DiscoverKamekFunctions(
+        KamekChunk chunk,
+        uint moduleGuestBase,
+        byte[] relocatedModuleImage)
+    {
+        var starts = new Dictionary<uint, string>();
+        var moduleCodeEnd = checked(moduleGuestBase + chunk.CodeSize);
+        var moduleImageEnd = checked(moduleGuestBase + (uint)relocatedModuleImage.Length);
+
+        void Add(uint address, string reason, uint moduleEnd)
+        {
+            if (address < moduleGuestBase || address >= moduleEnd || (address & 0x3u) != 0)
+            {
+                return;
+            }
+
+            starts.TryAdd(address, reason);
+        }
+
+        void AddCodeAddress(uint address, string reason) => Add(address, reason, moduleCodeEnd);
+
+        void AddImageAddress(uint address, string reason) => Add(address, reason, moduleImageEnd);
+
+        if (LooksLikeFunctionPointerTarget(moduleGuestBase, moduleGuestBase, moduleCodeEnd, relocatedModuleImage))
+        {
+            AddCodeAddress(moduleGuestBase, "module base");
+        }
+
+        foreach (var command in chunk.Commands)
+        {
+            if (command.Arguments.Count == 0)
+            {
+                continue;
+            }
+
+            switch (command.Id)
+            {
+                case KamekCommandId.Rel24:
+                case KamekCommandId.Branch:
+                case KamekCommandId.BranchLink:
+                    AddImageAddress(KamekAddress.Resolve(command.Arguments[0], moduleGuestBase), command.Id.ToString());
+                    break;
+            }
+        }
+
+        if (chunk.CtorStart <= chunk.CtorEnd && chunk.CtorEnd <= relocatedModuleImage.Length)
+        {
+            for (var offset = checked((int)chunk.CtorStart); offset + 4 <= chunk.CtorEnd; offset += 4)
+            {
+                var target = BinaryPrimitives.ReadUInt32BigEndian(relocatedModuleImage.AsSpan(offset, 4));
+                AddImageAddress(target, "ctor");
+            }
+        }
+
+        // Kamek modules frequently register callbacks through static tables or lists that are
+        // walked indirectly by module startup code. Seed those native translations ahead of time.
+        for (var offset = 0; offset + 4 <= relocatedModuleImage.Length; offset += 4)
+        {
+            var value = BinaryPrimitives.ReadUInt32BigEndian(relocatedModuleImage.AsSpan(offset, 4));
+            if (LooksLikeFunctionPointerTarget(value, moduleGuestBase, moduleImageEnd, relocatedModuleImage))
+            {
+                AddImageAddress(value, "module data pointer");
+            }
+        }
+
+        for (var offset = 0; offset + 4 <= relocatedModuleImage.Length; offset += 4)
+        {
+            var address = checked(moduleGuestBase + (uint)offset);
+            if (LooksLikeFunctionPrologue(address, moduleGuestBase, moduleCodeEnd, relocatedModuleImage))
+            {
+                AddCodeAddress(address, "module prologue scan");
+            }
+        }
+
+        foreach (var address in DiscoverSynthesizedFunctionPointers(moduleGuestBase, moduleImageEnd, relocatedModuleImage))
+        {
+            AddImageAddress(address, "module synthesized pointer");
+        }
+
+        foreach (var address in DiscoverLeafBoundaryFunctions(moduleGuestBase, moduleCodeEnd, relocatedModuleImage, starts.Keys))
+        {
+            AddCodeAddress(address, "module leaf boundary scan");
+        }
+
+        foreach (var address in DiscoverTailEntryFunctions(moduleGuestBase, moduleImageEnd, relocatedModuleImage, starts.Keys))
+        {
+            AddImageAddress(address, "module tail-entry scan");
+        }
+
+        return starts
+            .OrderBy(kvp => kvp.Key)
+            .Select(kvp => new ModFunctionStart(kvp.Key, kvp.Value))
+            .ToList();
+    }
+
+    private static bool LooksLikeFunctionPrologue(
+        uint address,
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage)
+    {
+        if (address < moduleGuestBase ||
+            address >= moduleEnd ||
+            (address & 0x3u) != 0)
+        {
+            return false;
+        }
+
+        var offset = checked((int)(address - moduleGuestBase));
+        if (offset < 0 || offset + 4 > relocatedModuleImage.Length)
+        {
+            return false;
+        }
+
+        var firstWord = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset);
+        if (IsStackFramePrologue(firstWord))
+        {
+            return true;
+        }
+
+        if (offset + 8 <= relocatedModuleImage.Length)
+        {
+            var secondWord = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset + 4);
+            if (firstWord == 0x7C0802A6u && IsStackFramePrologue(secondWord))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool LooksLikeFunctionPointerTarget(
+        uint address,
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage)
+    {
+        if (address < moduleGuestBase || address >= moduleEnd || (address & 0x3u) != 0)
+        {
+            return false;
+        }
+
+        var offset = checked((int)(address - moduleGuestBase));
+        if (offset < 0 || offset + 4 > relocatedModuleImage.Length)
+        {
+            return false;
+        }
+
+        var firstWord = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset);
+        if (firstWord == 0 || firstWord == 0xFFFFFFFFu)
+        {
+            return false;
+        }
+
+        return LooksLikeFunctionPrologue(address, moduleGuestBase, moduleEnd, relocatedModuleImage) ||
+            LooksLikeBranchTrampoline(address, firstWord, moduleGuestBase, moduleEnd) ||
+            PpcControlFlow.IsReturn(firstWord) ||
+            LooksLikeLeafFunction(address, moduleGuestBase, moduleEnd, relocatedModuleImage);
+    }
+
+    private static bool LooksLikeBranchTrampoline(uint address, uint word, uint moduleGuestBase, uint moduleEnd) =>
+        // ASCII data starting with 'H' or 'I' (0x48/0x49) decodes as a forward
+        // unconditional branch, so a lone branch word only counts as a
+        // trampoline when it lands somewhere code can actually live: base-game
+        // MEM1 or the module image itself, which sits above kGuestExecutableLimit
+        // now that the overlay is based at 0x81800000.
+        PpcControlFlow.IsRelativeUnlinkedBranch(word) &&
+        PpcControlFlow.TryDecodeRelativeBranchTarget(address, word, out var target) &&
+        (target & 0x3u) == 0 &&
+        ((target >= 0x80000000u && target < kGuestExecutableLimit) ||
+         (target >= moduleGuestBase && target < moduleEnd));
+
+    private static IEnumerable<uint> DiscoverSynthesizedFunctionPointers(
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage)
+    {
+        for (var offset = 0; offset + 8 <= relocatedModuleImage.Length; offset += 4)
+        {
+            var first = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset);
+            if (!PpcInstructionPatterns.TryGetLis(first, out var register, out var high))
+            {
+                continue;
+            }
+
+            var baseValue = high << 16;
+            var scanEnd = Math.Min(offset + 36, relocatedModuleImage.Length);
+            for (var cursor = offset + 4; cursor + 4 <= scanEnd; cursor += 4)
+            {
+                var word = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, cursor);
+                if (TryBuildAddress(word, register, baseValue, out var candidate, out var valueRegister))
+                {
+                    if (LooksLikeSynthesizedFunctionPointerTarget(candidate, moduleGuestBase, moduleEnd, relocatedModuleImage) &&
+                        IsPointerValueUsed(relocatedModuleImage, cursor + 4, valueRegister, moduleGuestBase, moduleEnd))
+                    {
+                        yield return candidate;
+                    }
+
+                    if (valueRegister == register)
+                    {
+                        break;
+                    }
+
+                    continue;
+                }
+
+                if (WritesRegister(word, register))
+                {
+                    break;
+                }
+            }
+        }
+    }
+
+    private static IEnumerable<uint> DiscoverLeafBoundaryFunctions(
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage,
+        IEnumerable<uint> knownStarts)
+    {
+        var knownStartSet = knownStarts.ToHashSet();
+        var sortedKnownStarts = knownStartSet.Order().ToArray();
+
+        for (var offset = 4; offset + 4 <= relocatedModuleImage.Length; offset += 4)
+        {
+            var address = checked(moduleGuestBase + (uint)offset);
+            if (knownStartSet.Contains(address))
+            {
+                continue;
+            }
+
+            var previousAddress = checked(moduleGuestBase + (uint)(offset - 4));
+            var previousWord = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset - 4);
+            if (!IsFunctionBoundaryInstruction(previousAddress, previousWord, knownStartSet, moduleGuestBase, moduleEnd))
+            {
+                continue;
+            }
+
+            var nextKnownStart = NextKnownStartAfter(sortedKnownStarts, address);
+            if (nextKnownStart is null || nextKnownStart.Value - address > 0x200u)
+            {
+                continue;
+            }
+
+            if (LooksLikeFunctionPrologue(address, moduleGuestBase, moduleEnd, relocatedModuleImage))
+            {
+                continue;
+            }
+
+            if (LooksLikeBoundedLeafFunction(address, nextKnownStart.Value, moduleGuestBase, moduleEnd, relocatedModuleImage, knownStartSet))
+            {
+                yield return address;
+            }
+        }
+    }
+
+    private static uint? NextKnownStartAfter(uint[] sortedKnownStarts, uint address)
+    {
+        foreach (var start in sortedKnownStarts)
+        {
+            if (start > address)
+            {
+                return start;
+            }
+        }
+
+        return null;
+    }
+
+    private static IEnumerable<uint> DiscoverTailEntryFunctions(
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage,
+        IEnumerable<uint> knownStarts)
+    {
+        var knownStartSet = knownStarts.ToHashSet();
+        var sortedKnownStarts = knownStartSet.Order().ToArray();
+
+        for (var offset = 4; offset + 4 <= relocatedModuleImage.Length; offset += 4)
+        {
+            var address = checked(moduleGuestBase + (uint)offset);
+            if (knownStartSet.Contains(address) ||
+                LooksLikeFunctionPrologue(address, moduleGuestBase, moduleEnd, relocatedModuleImage))
+            {
+                continue;
+            }
+
+            var previousWord = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset - 4);
+            if (!IsFunctionTerminator(previousWord) && !PpcControlFlow.IsRelativeUnlinkedBranch(previousWord))
+            {
+                continue;
+            }
+
+            var nextBoundary = NextKnownStartOrPrologueAfter(sortedKnownStarts, address, moduleGuestBase, moduleEnd, relocatedModuleImage);
+            if (nextBoundary is null || nextBoundary.Value - address > 0x40u)
+            {
+                continue;
+            }
+
+            if (LooksLikeShortTailEntry(address, nextBoundary.Value, moduleGuestBase, moduleEnd, relocatedModuleImage))
+            {
+                yield return address;
+            }
+        }
+    }
+
+    private static uint? NextKnownStartOrPrologueAfter(
+        uint[] sortedKnownStarts,
+        uint address,
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage)
+    {
+        var nextKnownStart = NextKnownStartAfter(sortedKnownStarts, address);
+        var scanEnd = nextKnownStart ?? moduleEnd;
+
+        for (var cursor = checked(address + 4); cursor < scanEnd; cursor += 4)
+        {
+            if (LooksLikeFunctionPrologue(cursor, moduleGuestBase, moduleEnd, relocatedModuleImage))
+            {
+                return cursor;
+            }
+        }
+
+        return nextKnownStart;
+    }
+
+    private static bool LooksLikeShortTailEntry(
+        uint address,
+        uint nextBoundary,
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage)
+    {
+        if (address >= nextBoundary ||
+            address < moduleGuestBase ||
+            nextBoundary > moduleEnd ||
+            (address & 0x3u) != 0)
+        {
+            return false;
+        }
+
+        var offset = checked((int)(address - moduleGuestBase));
+        var endOffset = checked((int)Math.Min(nextBoundary - moduleGuestBase, (uint)relocatedModuleImage.Length));
+        if (offset < 0 || offset + 8 > endOffset || LooksLikeInlineAsciiData(relocatedModuleImage, offset, endOffset))
+        {
+            return false;
+        }
+
+        var sawNonBranchInstruction = false;
+        for (var cursor = offset; cursor + 4 <= endOffset; cursor += 4)
+        {
+            var word = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, cursor);
+            if (!LooksLikeInstruction(word))
+            {
+                return false;
+            }
+
+            var currentAddress = checked(moduleGuestBase + (uint)cursor);
+            if (PpcControlFlow.IsRelativeUnlinkedBranch(word) &&
+                PpcControlFlow.TryDecodeRelativeBranchTarget(currentAddress, word, out var branchTarget))
+            {
+                return sawNonBranchInstruction &&
+                    (branchTarget < address || branchTarget >= nextBoundary) &&
+                    LooksLikeExecutableTailTarget(branchTarget, moduleGuestBase, moduleEnd, relocatedModuleImage);
+            }
+
+            if (IsFunctionTerminator(word))
+            {
+                return false;
+            }
+
+            sawNonBranchInstruction = true;
+        }
+
+        return false;
+    }
+
+    private static bool LooksLikeExecutableTailTarget(
+        uint address,
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage) =>
+        LooksLikeExternalExecutableBranchTarget(address, moduleGuestBase, moduleEnd) ||
+        LooksLikeFunctionPointerTarget(address, moduleGuestBase, moduleEnd, relocatedModuleImage);
+
+    private static bool TryBuildAddress(uint word, int baseRegister, uint baseValue, out uint address, out int valueRegister)
+    {
+        if (PpcInstructionPatterns.TryGetAddi(word, out var destination, out var source, out var immediate))
+        {
+            if (source != baseRegister)
+            {
+                address = 0;
+                valueRegister = 0;
+                return false;
+            }
+
+            address = unchecked(baseValue + (uint)immediate);
+            valueRegister = destination;
+            return true;
+        }
+
+        if (PpcInstructionPatterns.TryGetOri(word, out var oriSource, out var oriDestination, out var oriImmediate))
+        {
+            if (oriSource != baseRegister)
+            {
+                address = 0;
+                valueRegister = 0;
+                return false;
+            }
+
+            address = baseValue | oriImmediate;
+            valueRegister = oriDestination;
+            return true;
+        }
+
+        address = 0;
+        valueRegister = 0;
+        return false;
+    }
+
+    private static bool IsPointerValueUsed(
+        byte[] relocatedModuleImage,
+        int startOffset,
+        int register,
+        uint moduleGuestBase,
+        uint moduleEnd)
+    {
+        // Bounded to cover typical constructor prologue/setup before the value is stored or used;
+        // a write to the value register still ends the search so a later unrelated store can't fake liveness.
+        var scanEnd = Math.Min(startOffset + 128, relocatedModuleImage.Length);
+        for (var offset = startOffset; offset + 4 <= scanEnd; offset += 4)
+        {
+            var word = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset);
+            if (PpcRegisterEffects.MayWriteGpr(word, register))
+            {
+                return false;
+            }
+
+            if (StoresRegister(word, register) || MovesRegisterToCtr(word, register))
+            {
+                return true;
+            }
+
+            if (IsBranchWithLink(word))
+            {
+                // A call passes r3-r10 into the callee and clobbers the other
+                // volatile registers, so the pointer either escapes here as an
+                // argument or dies with the call. Callee-saved values survive.
+                if (IsArgumentRegister(register))
+                {
+                    return true;
+                }
+                if (!IsCalleeSavedRegister(register))
+                {
+                    return false;
+                }
+                continue;
+            }
+
+            if (PpcControlFlow.IsRelativeUnlinkedBranch(word))
+            {
+                // An unconditional branch out of the module is a tail call into
+                // base code: argument registers flow into the callee unchanged.
+                if (PpcControlFlow.TryDecodeRelativeBranchTarget(checked(moduleGuestBase + (uint)offset), word, out var branchTarget) &&
+                    LooksLikeExternalExecutableBranchTarget(branchTarget, moduleGuestBase, moduleEnd))
+                {
+                    return IsArgumentRegister(register);
+                }
+                continue;
+            }
+
+            if (IsFunctionTerminator(word))
+            {
+                // bctr is an indirect tail call, so argument registers escape;
+                // blr only publishes the pointer through the r3 return value.
+                // Either way the linear scan must not run into the next function.
+                return word == 0x4E800420u ? IsArgumentRegister(register) : register == 3;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool IsArgumentRegister(int register) => register is >= 3 and <= 10;
+
+    private static bool IsCalleeSavedRegister(int register) => register is 1 or 2 or >= 13;
+
+    private static bool IsBranchWithLink(uint word)
+    {
+        var fields = new PpcWordFields(word);
+        return (fields.PrimaryOpcode == 18 && (word & 0x1u) != 0) || // bl / bla
+            word == 0x4E800021u || // blrl
+            word == 0x4E800421u;   // bctrl
+    }
+
+    private static bool LooksLikeSynthesizedFunctionPointerTarget(
+        uint address,
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage)
+    {
+        if (!LooksLikeFunctionPointerTarget(address, moduleGuestBase, moduleEnd, relocatedModuleImage))
+        {
+            return LooksLikeLeafFunction(address, moduleGuestBase, moduleEnd, relocatedModuleImage);
+        }
+
+        return true;
+    }
+
+    private static bool LooksLikeLeafFunction(
+        uint address,
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage)
+    {
+        if (address < moduleGuestBase || address >= moduleEnd || (address & 0x3u) != 0)
+        {
+            return false;
+        }
+
+        var offset = checked((int)(address - moduleGuestBase));
+        if (offset < 0 || offset + 4 > relocatedModuleImage.Length)
+        {
+            return false;
+        }
+
+        var firstWord = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset);
+        if (firstWord == 0 || firstWord == 0xFFFFFFFFu)
+        {
+            return false;
+        }
+
+        var scanEnd = Math.Min(offset + 128, relocatedModuleImage.Length);
+        for (var cursor = offset; cursor + 4 <= scanEnd; cursor += 4)
+        {
+            var word = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, cursor);
+            if (IsFunctionTerminator(word))
+            {
+                return true;
+            }
+
+            if (cursor != offset && LooksLikeFunctionPrologue(checked(moduleGuestBase + (uint)cursor), moduleGuestBase, moduleEnd, relocatedModuleImage))
+            {
+                return false;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool LooksLikeBoundedLeafFunction(
+        uint address,
+        uint nextKnownStart,
+        uint moduleGuestBase,
+        uint moduleEnd,
+        byte[] relocatedModuleImage,
+        IReadOnlySet<uint> knownStarts)
+    {
+        if (address >= nextKnownStart ||
+            address < moduleGuestBase ||
+            address >= moduleEnd ||
+            (address & 0x3u) != 0)
+        {
+            return false;
+        }
+
+        var offset = checked((int)(address - moduleGuestBase));
+        var endOffset = checked((int)Math.Min(nextKnownStart - moduleGuestBase, (uint)relocatedModuleImage.Length));
+        if (offset < 0 || offset + 4 > endOffset)
+        {
+            return false;
+        }
+
+        var firstWord = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, offset);
+        if (!LooksLikeInstruction(firstWord) || IsFunctionTerminator(firstWord) || LooksLikeInlineAsciiData(relocatedModuleImage, offset, endOffset))
+        {
+            return false;
+        }
+
+        var sawNonBranchInstruction = false;
+        for (var cursor = offset; cursor + 4 <= endOffset; cursor += 4)
+        {
+            var word = PpcWordFields.ReadBigEndianWord(relocatedModuleImage, cursor);
+            if (!LooksLikeInstruction(word))
+            {
+                return false;
+            }
+
+            if (IsFunctionTerminator(word))
+            {
+                return sawNonBranchInstruction;
+            }
+
+            var currentAddress = checked(moduleGuestBase + (uint)cursor);
+            if (PpcControlFlow.TryDecodeConditionalRelativeBranchTarget(currentAddress, word, out var conditionalTarget) &&
+                (conditionalTarget < address || conditionalTarget >= nextKnownStart))
+            {
+                return false;
+            }
+
+            if (PpcControlFlow.IsRelativeUnlinkedBranch(word) &&
+                PpcControlFlow.TryDecodeRelativeBranchTarget(currentAddress, word, out var branchTarget) &&
+                (branchTarget < address || branchTarget >= nextKnownStart))
+            {
+                if (knownStarts.Contains(branchTarget) ||
+                    LooksLikeExternalExecutableBranchTarget(branchTarget, moduleGuestBase, moduleEnd))
+                {
+                    return sawNonBranchInstruction;
+                }
+            }
+
+            if (!PpcControlFlow.IsRelativeUnlinkedBranch(word))
+            {
+                sawNonBranchInstruction = true;
+            }
+
+            if (cursor != offset && LooksLikeFunctionPrologue(checked(moduleGuestBase + (uint)cursor), moduleGuestBase, moduleEnd, relocatedModuleImage))
+            {
+                return false;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool LooksLikeInlineAsciiData(byte[] relocatedModuleImage, int offset, int endOffset)
+    {
+        var scanEnd = Math.Min(offset + 16, endOffset);
+        var examined = 0;
+        var printableOrZero = 0;
+
+        for (var cursor = offset; cursor < scanEnd; cursor++)
+        {
+            var value = relocatedModuleImage[cursor];
+            examined++;
+            if (value == 0 || (value >= 0x20 && value <= 0x7E))
+            {
+                printableOrZero++;
+            }
+        }
+
+        return examined >= 8 && printableOrZero == examined;
+    }
+
+    private static bool WritesRegister(uint word, int register)
+        => PpcRegisterEffects.MayWriteGpr(word, register);
+
+    private static bool StoresRegister(uint word, int register)
+    {
+        var fields = new PpcWordFields(word);
+        var opcode = fields.PrimaryOpcode;
+        var rs = fields.GprField0;
+        return (opcode is 36 or 37 or 38 or 44 or 45 or 46 or 52 or 53 or 54) &&
+            rs == register;
+    }
+
+    private static bool MovesRegisterToCtr(uint word, int register)
+    {
+        // mtctr rS is mtspr 9,rS. The split SPR field encodes CTR as 0x120.
+        return PpcInstructionPatterns.TryGetMtspr(word, 9, out var source) && source == register;
+    }
+
+    private static bool IsStackFramePrologue(uint word) =>
+        (word & 0xFFFF0000u) == 0x94210000u &&
+        (short)(word & 0xFFFFu) < 0;
+
+    private static bool IsFunctionBoundaryInstruction(
+        uint address,
+        uint word,
+        IReadOnlySet<uint> knownStarts,
+        uint moduleGuestBase,
+        uint moduleEnd)
+    {
+        if (IsFunctionTerminator(word))
+        {
+            return true;
+        }
+
+        return PpcControlFlow.IsRelativeUnlinkedBranch(word) &&
+            PpcControlFlow.TryDecodeRelativeBranchTarget(address, word, out var branchTarget) &&
+            (knownStarts.Contains(branchTarget) ||
+             LooksLikeExternalExecutableBranchTarget(branchTarget, moduleGuestBase, moduleEnd));
+    }
+
+    // End of cached MEM1 (0x80000000-0x817FFFFF); guest code never executes
+    // above it, so branch targets beyond this are data misread as instructions.
+    private const uint kGuestExecutableLimit = 0x81800000u;
+
+    private static bool LooksLikeExternalExecutableBranchTarget(uint address, uint moduleGuestBase, uint moduleEnd) =>
+        address >= 0x80000000u &&
+        address < kGuestExecutableLimit &&
+        (address & 0x3u) == 0 &&
+        (address < moduleGuestBase || address >= moduleEnd);
+
+    private static bool LooksLikeInstruction(uint word)
+    {
+        if (word == 0 || word == 0xFFFFFFFFu)
+        {
+            return false;
+        }
+
+        var opcode = new PpcWordFields(word).PrimaryOpcode;
+        return opcode is
+            3 or 4 or
+            7 or 8 or 10 or 11 or 12 or 13 or 14 or 15 or 16 or 17 or 18 or 19 or
+            20 or 21 or 23 or 24 or 26 or 28 or 29 or 31 or
+            32 or 33 or 34 or 35 or 36 or 37 or 38 or 39 or
+            40 or 41 or 42 or 43 or 44 or 45 or 46 or 47 or
+            48 or 49 or 50 or 51 or 52 or 53 or 54 or 55 or
+            56 or 57 or 58 or 59 or 60 or 61 or 62 or 63;
+    }
+
+    private static bool IsFunctionTerminator(uint word) =>
+        PpcControlFlow.IsBctr(word) ||
+        PpcControlFlow.IsReturn(word);
+}
diff --git a/translator/src/Translator.Core/Mods/OverlayFunctionBuilder.cs b/translator/src/Translator.Core/Mods/OverlayFunctionBuilder.cs
new file mode 100644
index 0000000..26a7758
--- /dev/null
+++ b/translator/src/Translator.Core/Mods/OverlayFunctionBuilder.cs
@@ -0,0 +1,587 @@
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+using System.Text.Json;
+using Translator.Core.Parsing.Kamek;
+using Translator.Core.Mods.Mkwii;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Mods;
+
+public sealed record PatchApplicationRecord(
+    uint Address,
+    KamekCommandId CommandId,
+    string Target,
+    string Status,
+    string Detail);
+
+public sealed record OverlayFunctionImage(
+    uint Start,
+    uint End,
+    string Name,
+    string SectionName,
+    string ImageFile,
+    string Sha256,
+    int PatchCount,
+    IReadOnlyList<PatchApplicationRecord> Patches);
+
+public sealed record OverlayBuildResult(
+    uint ModuleGuestBase,
+    string ModuleImageFile,
+    uint ModuleImageSize,
+    string ModuleImageSha256,
+    int ModulePatchCount,
+    IReadOnlyList<OverlayFunctionImage> OverlayFunctions,
+    IReadOnlyList<PatchApplicationRecord> Diagnostics);
+
+public static class OverlayFunctionBuilder
+{
+    public static OverlayBuildResult BuildAndWrite(
+        KamekChunk chunk,
+        BaseManifest baseManifest,
+        KamekPatchPlan patchPlan,
+        string baseManifestDirectory,
+        string outputDirectory,
+        IReadOnlyCollection<uint>? additionalOverlayFunctionStarts = null,
+        byte[]? additionalModuleImage = null,
+        uint? additionalModuleImageOffset = null,
+        IReadOnlyCollection<RetroWfcStaticBytePatchPlan>? retroWfcStaticBytePatches = null,
+        IReadOnlyCollection<RetroWfcExecutableHookPlan>? retroWfcExecutableHooks = null)
+    {
+        var overlayDir = Path.Combine(outputDirectory, "overlay_images");
+        Directory.CreateDirectory(overlayDir);
+
+        var diagnostics = new List<PatchApplicationRecord>();
+        var moduleImage = BuildModuleImage(chunk.CodeBlob, additionalModuleImage, additionalModuleImageOffset);
+        var modulePatchCount = 0;
+        foreach (var command in chunk.Commands.Where(c => c.AddressIsRelative))
+        {
+            var target = patchPlan.ModuleGuestBase + command.Address;
+            if (TryApplyPatch(
+                    moduleImage,
+                    patchPlan.ModuleGuestBase,
+                    target,
+                    command,
+                    patchPlan.ModuleGuestBase,
+                    out var record))
+            {
+                modulePatchCount++;
+            }
+            diagnostics.Add(record);
+        }
+
+        var moduleImageFile = $"kamek_module_{patchPlan.ModuleGuestBase:X8}.bin";
+        File.WriteAllBytes(Path.Combine(overlayDir, moduleImageFile), moduleImage);
+
+        var sectionsByName = baseManifest.Sections.ToDictionary(s => s.Name, StringComparer.OrdinalIgnoreCase);
+        var imageCache = new Dictionary<string, byte[]>(StringComparer.OrdinalIgnoreCase);
+        var functionIndex = new BaseFunctionIndex(baseManifest.Functions);
+        var overlays = new List<OverlayFunctionImage>();
+
+        var executablePatchGroups = patchPlan.ExecutablePatches
+            .Where(c => c.ContainingFunctionStart.HasValue)
+            .GroupBy(c => c.ContainingFunctionStart!.Value)
+            .ToDictionary(g => g.Key, g => g.ToList());
+        var retroWfcStaticBytePatchSource = retroWfcStaticBytePatches is null
+            ? Enumerable.Empty<RetroWfcStaticBytePatchPlan>()
+            : retroWfcStaticBytePatches;
+        var retroWfcStaticBytePatchGroups = retroWfcStaticBytePatchSource
+            .Where(p => p.SectionExecutable && p.ContainingFunctionStart.HasValue)
+            .GroupBy(p => p.ContainingFunctionStart!.Value)
+            .ToDictionary(g => g.Key, g => g.ToList());
+        var retroWfcExecutableHookSource = retroWfcExecutableHooks is null
+            ? Enumerable.Empty<RetroWfcExecutableHookPlan>()
+            : retroWfcExecutableHooks;
+        var retroWfcExecutableHookGroups = retroWfcExecutableHookSource
+            .Where(h => h.TargetAddress.HasValue)
+            .GroupBy(h => h.ContainingFunctionStart)
+            .ToDictionary(g => g.Key, g => g.ToList());
+        var overlayStarts = new SortedSet<uint>(executablePatchGroups.Keys);
+        foreach (var start in retroWfcStaticBytePatchGroups.Keys)
+        {
+            overlayStarts.Add(start);
+        }
+        foreach (var start in retroWfcExecutableHookGroups.Keys)
+        {
+            overlayStarts.Add(start);
+        }
+        if (additionalOverlayFunctionStarts is not null)
+        {
+            foreach (var start in additionalOverlayFunctionStarts)
+            {
+                overlayStarts.Add(start);
+            }
+        }
+
+        foreach (var functionStart in overlayStarts)
+        {
+            var function = functionIndex.FindContaining(functionStart)
+                ?? throw new InvalidDataException($"No base function found for overlay 0x{functionStart:X8}.");
+
+            if (!sectionsByName.TryGetValue(function.SourceSection, out var section))
+            {
+                throw new InvalidDataException($"Base function 0x{function.Start:X8} references unknown section '{function.SourceSection}'.");
+            }
+            if (string.IsNullOrWhiteSpace(section.ImageFile))
+            {
+                throw new InvalidDataException($"Base section '{section.Name}' has no executable image file.");
+            }
+
+            var sourceImage = LoadImage(baseManifestDirectory, section.ImageFile, imageCache);
+            var sourceOffset = checked((int)function.SourceImageOffset);
+            var functionSize = checked((int)(function.End - function.Start));
+            if (sourceOffset < 0 || sourceOffset + functionSize > sourceImage.Length)
+            {
+                throw new InvalidDataException(
+                    $"Base function 0x{function.Start:X8}-0x{function.End:X8} exceeds source image '{section.ImageFile}'.");
+            }
+
+            var bytes = new byte[functionSize];
+            Array.Copy(sourceImage, sourceOffset, bytes, 0, functionSize);
+
+            var patchRecords = new List<PatchApplicationRecord>();
+            executablePatchGroups.TryGetValue(function.Start, out var group);
+            foreach (var classification in (group ?? new List<KamekPatchClassification>()).OrderBy(c => c.CommandAddress))
+            {
+                var command = FindMatchingCommand(chunk, classification);
+                if (TryApplyPatch(
+                        bytes,
+                        function.Start,
+                        classification.CommandAddress,
+                        command,
+                        patchPlan.ModuleGuestBase,
+                        out var record))
+                {
+                    patchRecords.Add(record);
+                }
+                else
+                {
+                    patchRecords.Add(record);
+                    diagnostics.Add(record);
+                }
+            }
+            retroWfcExecutableHookGroups.TryGetValue(function.Start, out var executableHookGroup);
+            var executableHooks = executableHookGroup is null
+                ? Enumerable.Empty<RetroWfcExecutableHookPlan>()
+                : executableHookGroup;
+            foreach (var hook in executableHooks.OrderBy(h => h.Address).ThenBy(h => h.RecordIndex))
+            {
+                if (TryApplyRetroWfcExecutableHookPatch(
+                        bytes,
+                        function.Start,
+                        hook,
+                        out var record))
+                {
+                    patchRecords.Add(record);
+                }
+                else
+                {
+                    patchRecords.Add(record);
+                    diagnostics.Add(record);
+                }
+            }
+            retroWfcStaticBytePatchGroups.TryGetValue(function.Start, out var staticByteGroup);
+            var staticBytePatches = staticByteGroup is null
+                ? Enumerable.Empty<RetroWfcStaticBytePatchPlan>()
+                : staticByteGroup;
+            foreach (var patch in staticBytePatches.OrderBy(p => p.Address).ThenBy(p => p.RecordIndex))
+            {
+                if (TryApplyRetroWfcStaticBytePatch(
+                        bytes,
+                        function.Start,
+                        patch,
+                        out var record))
+                {
+                    patchRecords.Add(record);
+                }
+                else
+                {
+                    patchRecords.Add(record);
+                    diagnostics.Add(record);
+                }
+            }
+
+            var imageFile = $"overlay_{function.Start:X8}.bin";
+            File.WriteAllBytes(Path.Combine(overlayDir, imageFile), bytes);
+
+            overlays.Add(new OverlayFunctionImage(
+                function.Start,
+                function.End,
+                function.Name,
+                function.SourceSection,
+                imageFile,
+                ChecksumUtilities.Sha256Hex(bytes),
+                patchRecords.Count(p => p.Status == "applied"),
+                patchRecords));
+        }
+
+        var result = new OverlayBuildResult(
+            patchPlan.ModuleGuestBase,
+            moduleImageFile,
+            checked((uint)moduleImage.Length),
+            ChecksumUtilities.Sha256Hex(moduleImage),
+            modulePatchCount,
+            overlays,
+            diagnostics.Where(d => d.Status != "applied").ToList());
+
+        return result;
+    }
+
+    private const uint kPpcNop = 0x60000000;
+
+    private static byte[] BuildModuleImage(byte[] baseImage, byte[]? additionalImage, uint? additionalOffset)
+    {
+        if (additionalImage is not { Length: > 0 })
+        {
+            return baseImage.ToArray();
+        }
+        if (!additionalOffset.HasValue)
+        {
+            throw new InvalidDataException("Additional module image bytes require an explicit module offset.");
+        }
+        if (additionalOffset.Value < baseImage.Length)
+        {
+            throw new InvalidDataException(
+                $"Additional module image offset 0x{additionalOffset.Value:X} overlaps base module image length 0x{baseImage.Length:X}.");
+        }
+
+        var totalSize = checked((int)additionalOffset.Value + additionalImage.Length);
+        var result = new byte[totalSize];
+        Array.Copy(baseImage, result, baseImage.Length);
+        Array.Copy(additionalImage, 0, result, checked((int)additionalOffset.Value), additionalImage.Length);
+        return result;
+    }
+
+    private static bool RetroWfcHookUsesLink(RetroWfcExecutableHookPlan hook) =>
+        hook.TypeName is "call" or "branchCtrLink" ||
+        hook.Intent.Contains("Call", StringComparison.Ordinal);
+
+    private static KamekCommand FindMatchingCommand(KamekChunk chunk, KamekPatchClassification classification)
+    {
+        return chunk.Commands.FirstOrDefault(command =>
+            command.Id == classification.CommandId &&
+            command.Address == classification.CommandAddress &&
+            command.AddressIsAbsolute == classification.CommandAddressIsAbsolute &&
+            command.Arguments.SequenceEqual(classification.Arguments))
+            ?? throw new InvalidDataException(
+                $"Could not match classified command {classification.CommandId} at 0x{classification.CommandAddress:X8} back to Code.pul command stream.");
+    }
+
+    private static byte[] LoadImage(string baseManifestDirectory, string imageFile, Dictionary<string, byte[]> cache)
+    {
+        if (cache.TryGetValue(imageFile, out var bytes))
+        {
+            return bytes;
+        }
+
+        var path = Path.Combine(baseManifestDirectory, imageFile);
+        bytes = File.ReadAllBytes(path);
+        cache[imageFile] = bytes;
+        return bytes;
+    }
+
+    private static bool TryApplyPatch(
+        byte[] image,
+        uint imageGuestStart,
+        uint patchAddress,
+        KamekCommand command,
+        uint moduleGuestBase,
+        out PatchApplicationRecord record)
+    {
+        try
+        {
+            var applied = ApplyPatch(image, imageGuestStart, patchAddress, command, moduleGuestBase, out var detail);
+            record = new PatchApplicationRecord(patchAddress, command.Id, FormatTarget(command, moduleGuestBase), applied ? "applied" : "skipped", detail);
+            return applied;
+        }
+        catch (Exception ex) when (ex is InvalidDataException or ArgumentOutOfRangeException or OverflowException)
+        {
+            record = new PatchApplicationRecord(patchAddress, command.Id, FormatTarget(command, moduleGuestBase), "failed", ex.Message);
+            return false;
+        }
+    }
+
+    private static bool TryApplyRetroWfcExecutableHookPatch(
+        byte[] image,
+        uint imageGuestStart,
+        RetroWfcExecutableHookPlan hook,
+        out PatchApplicationRecord record)
+    {
+        try
+        {
+            if (!hook.TargetAddress.HasValue)
+            {
+                throw new InvalidDataException($"Retro WFC executable hook #{hook.RecordIndex} has no resolved semantic target.");
+            }
+            if (hook.InstructionCount <= 0)
+            {
+                throw new InvalidDataException($"Retro WFC executable hook #{hook.RecordIndex} has invalid instruction count {hook.InstructionCount}.");
+            }
+
+            var offset = checked((int)(hook.Address - imageGuestStart));
+            EnsureRange(image, offset, checked(hook.InstructionCount * sizeof(uint)));
+            var link = RetroWfcHookUsesLink(hook);
+            var branch = KamekPpcEncoding.EncodeBranch(hook.Address, hook.TargetAddress.Value, link);
+            WriteUInt32(image, offset, branch);
+            for (var i = 1; i < hook.InstructionCount; i++)
+            {
+                WriteUInt32(image, offset + i * sizeof(uint), kPpcNop);
+            }
+
+            var action = hook.TargetActionId ?? string.Join(",", hook.SemanticActionIds);
+            record = new PatchApplicationRecord(
+                hook.Address,
+                link ? KamekCommandId.BranchLink : KamekCommandId.Branch,
+                $"RetroWFC#{hook.RecordIndex}",
+                "applied",
+                $"retro wfc semantic hook {action} -> 0x{hook.TargetAddress.Value:X8}, continuation=0x{hook.ContinuationAddress:X8}, instructions={hook.InstructionCount:N0}");
+            return true;
+        }
+        catch (Exception ex) when (ex is InvalidDataException or ArgumentOutOfRangeException or OverflowException)
+        {
+            record = new PatchApplicationRecord(
+                hook.Address,
+                RetroWfcHookUsesLink(hook) ? KamekCommandId.BranchLink : KamekCommandId.Branch,
+                $"RetroWFC#{hook.RecordIndex}",
+                "failed",
+                ex.Message);
+            return false;
+        }
+    }
+
+    private static bool TryApplyRetroWfcStaticBytePatch(
+        byte[] image,
+        uint imageGuestStart,
+        RetroWfcStaticBytePatchPlan patch,
+        out PatchApplicationRecord record)
+    {
+        try
+        {
+            var patchBytes = Convert.FromHexString(patch.BytesHex);
+            if (patchBytes.Length != patch.Size)
+            {
+                throw new InvalidDataException(
+                    $"Retro WFC static byte patch #{patch.RecordIndex} declares {patch.Size:N0} byte(s) but contains {patchBytes.Length:N0} byte(s).");
+            }
+
+            var offset = checked((int)(patch.Address - imageGuestStart));
+            EnsureRange(image, offset, patchBytes.Length);
+            patchBytes.CopyTo(image.AsSpan(offset, patchBytes.Length));
+
+            record = new PatchApplicationRecord(
+                patch.Address,
+                KamekCommandId.Write8,
+                $"RetroWFC#{patch.RecordIndex}",
+                "applied",
+                $"retro wfc static byte patch {patchBytes.Length:N0} byte(s) sha256={patch.SourceSha256}");
+            return true;
+        }
+        catch (Exception ex) when (ex is FormatException or InvalidDataException or ArgumentOutOfRangeException or OverflowException)
+        {
+            record = new PatchApplicationRecord(
+                patch.Address,
+                KamekCommandId.Write8,
+                $"RetroWFC#{patch.RecordIndex}",
+                "failed",
+                ex.Message);
+            return false;
+        }
+    }
+
+    private static bool ApplyPatch(
+        byte[] image,
+        uint imageGuestStart,
+        uint patchAddress,
+        KamekCommand command,
+        uint moduleGuestBase,
+        out string detail)
+    {
+        var offset = checked((int)(patchAddress - imageGuestStart));
+        switch (command.Id)
+        {
+            case KamekCommandId.Addr32:
+            {
+                var target = KamekAddress.Resolve(command.Arguments[0], moduleGuestBase);
+                WriteUInt32(image, offset, target);
+                detail = $"write pointer 0x{target:X8}";
+                return true;
+            }
+            case KamekCommandId.Addr16Lo:
+            {
+                var target = KamekAddress.Resolve(command.Arguments[0], moduleGuestBase);
+                WriteUInt16(image, offset, (ushort)(target & 0xFFFFu));
+                detail = $"write lo16(0x{target:X8})";
+                return true;
+            }
+            case KamekCommandId.Addr16Hi:
+            {
+                var target = KamekAddress.Resolve(command.Arguments[0], moduleGuestBase);
+                WriteUInt16(image, offset, (ushort)(target >> 16));
+                detail = $"write hi16(0x{target:X8})";
+                return true;
+            }
+            case KamekCommandId.Addr16Ha:
+            {
+                var target = KamekAddress.Resolve(command.Arguments[0], moduleGuestBase);
+                WriteUInt16(image, offset, (ushort)((target + 0x8000u) >> 16));
+                detail = $"write ha16(0x{target:X8})";
+                return true;
+            }
+            case KamekCommandId.Rel24:
+            {
+                var target = KamekAddress.Resolve(command.Arguments[0], moduleGuestBase);
+                var original = ReadUInt32(image, offset);
+                var delta = unchecked((int)target - (int)patchAddress);
+                if ((delta & 0x3) != 0 || delta < -0x02000000 || delta > 0x01FFFFFC)
+                {
+                    throw new ArgumentOutOfRangeException(nameof(command), $"rel24 target 0x{target:X8} is out of range from 0x{patchAddress:X8}.");
+                }
+
+                var patched = (original & 0xFC000003u) | (unchecked((uint)delta) & 0x03FFFFFCu);
+                WriteUInt32(image, offset, patched);
+                detail = $"rel24 0x{target:X8} encoded 0x{patched:X8}";
+                return true;
+            }
+            case KamekCommandId.Write32:
+                WriteUInt32(image, offset, command.Arguments[0]);
+                detail = $"write32 0x{command.Arguments[0]:X8}";
+                return true;
+            case KamekCommandId.Write16:
+                WriteUInt16(image, offset, checked((ushort)command.Arguments[0]));
+                detail = $"write16 0x{command.Arguments[0] & 0xFFFFu:X4}";
+                return true;
+            case KamekCommandId.Write8:
+                WriteByte(image, offset, checked((byte)command.Arguments[0]));
+                detail = $"write8 0x{command.Arguments[0] & 0xFFu:X2}";
+                return true;
+            case KamekCommandId.CondWritePointer:
+                return ApplyConditionalWrite32(image, offset, command.Arguments[1], KamekAddress.Resolve(command.Arguments[0], moduleGuestBase), out detail);
+            case KamekCommandId.CondWrite32:
+                return ApplyConditionalWrite32(image, offset, command.Arguments[1], command.Arguments[0], out detail);
+            case KamekCommandId.CondWrite16:
+                return ApplyConditionalWrite16(image, offset, checked((ushort)command.Arguments[1]), checked((ushort)command.Arguments[0]), out detail);
+            case KamekCommandId.CondWrite8:
+                return ApplyConditionalWrite8(image, offset, checked((byte)command.Arguments[1]), checked((byte)command.Arguments[0]), out detail);
+            case KamekCommandId.Branch:
+            case KamekCommandId.BranchLink:
+            {
+                var target = KamekAddress.Resolve(command.Arguments[0], moduleGuestBase);
+                var patched = KamekPpcEncoding.EncodeBranch(patchAddress, target, command.Id == KamekCommandId.BranchLink);
+                WriteUInt32(image, offset, patched);
+                detail = $"{command.Id} 0x{target:X8} encoded 0x{patched:X8}";
+                return true;
+            }
+            default:
+                throw new InvalidDataException($"Unsupported Code.pul command id {command.Id}.");
+        }
+    }
+
+    private static bool ApplyConditionalWrite32(byte[] image, int offset, uint expected, uint value, out string detail)
+    {
+        var actual = ReadUInt32(image, offset);
+        if (actual != expected)
+        {
+            detail = $"conditional write32 skipped; expected 0x{expected:X8}, actual 0x{actual:X8}";
+            return false;
+        }
+
+        WriteUInt32(image, offset, value);
+        detail = $"conditional write32 applied 0x{value:X8}";
+        return true;
+    }
+
+    private static bool ApplyConditionalWrite16(byte[] image, int offset, ushort expected, ushort value, out string detail)
+    {
+        var actual = ReadUInt16(image, offset);
+        if (actual != expected)
+        {
+            detail = $"conditional write16 skipped; expected 0x{expected:X4}, actual 0x{actual:X4}";
+            return false;
+        }
+
+        WriteUInt16(image, offset, value);
+        detail = $"conditional write16 applied 0x{value:X4}";
+        return true;
+    }
+
+    private static bool ApplyConditionalWrite8(byte[] image, int offset, byte expected, byte value, out string detail)
+    {
+        var actual = ReadByte(image, offset);
+        if (actual != expected)
+        {
+            detail = $"conditional write8 skipped; expected 0x{expected:X2}, actual 0x{actual:X2}";
+            return false;
+        }
+
+        WriteByte(image, offset, value);
+        detail = $"conditional write8 applied 0x{value:X2}";
+        return true;
+    }
+
+    private static string FormatTarget(KamekCommand command, uint moduleGuestBase)
+    {
+        if (command.Arguments.Count == 0)
+        {
+            return string.Empty;
+        }
+
+        return command.Id switch
+        {
+            KamekCommandId.Addr32 or
+            KamekCommandId.Addr16Lo or
+            KamekCommandId.Addr16Hi or
+            KamekCommandId.Addr16Ha or
+            KamekCommandId.Rel24 or
+            KamekCommandId.Branch or
+            KamekCommandId.BranchLink or
+            KamekCommandId.CondWritePointer => $"0x{KamekAddress.Resolve(command.Arguments[0], moduleGuestBase):X8}",
+            _ => string.Join(", ", command.Arguments.Select(arg => $"0x{arg:X8}"))
+        };
+    }
+
+    private static uint ReadUInt32(byte[] image, int offset)
+    {
+        EnsureRange(image, offset, sizeof(uint));
+        return BinaryPrimitives.ReadUInt32BigEndian(image.AsSpan(offset, sizeof(uint)));
+    }
+
+    private static ushort ReadUInt16(byte[] image, int offset)
+    {
+        EnsureRange(image, offset, sizeof(ushort));
+        return BinaryPrimitives.ReadUInt16BigEndian(image.AsSpan(offset, sizeof(ushort)));
+    }
+
+    private static byte ReadByte(byte[] image, int offset)
+    {
+        EnsureRange(image, offset, sizeof(byte));
+        return image[offset];
+    }
+
+    private static void WriteUInt32(byte[] image, int offset, uint value)
+    {
+        EnsureRange(image, offset, sizeof(uint));
+        BinaryPrimitives.WriteUInt32BigEndian(image.AsSpan(offset, sizeof(uint)), value);
+    }
+
+    private static void WriteUInt16(byte[] image, int offset, ushort value)
+    {
+        EnsureRange(image, offset, sizeof(ushort));
+        BinaryPrimitives.WriteUInt16BigEndian(image.AsSpan(offset, sizeof(ushort)), value);
+    }
+
+    private static void WriteByte(byte[] image, int offset, byte value)
+    {
+        EnsureRange(image, offset, sizeof(byte));
+        image[offset] = value;
+    }
+
+    private static void EnsureRange(byte[] image, int offset, int size)
+    {
+        if (offset < 0 || offset + size > image.Length)
+        {
+            throw new ArgumentOutOfRangeException(nameof(offset), $"Patch offset 0x{offset:X} size {size} exceeds image length 0x{image.Length:X}.");
+        }
+    }
+
+
+
+}
diff --git a/translator/src/Translator.Core/NativeSourceParsing.cs b/translator/src/Translator.Core/NativeSourceParsing.cs
new file mode 100644
index 0000000..d65fcb1
--- /dev/null
+++ b/translator/src/Translator.Core/NativeSourceParsing.cs
@@ -0,0 +1,88 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+using System.Text.RegularExpressions;
+
+namespace Translator.Core;
+
+internal sealed record NativeSourceFile(string FullPath, string RelativePath, string Content);
+
+internal static class NativeSourceParsing
+{
+    public static IReadOnlyList<NativeSourceFile> ReadDirectory(string directory)
+    {
+        var root = Path.GetFullPath(directory);
+        if (!Directory.Exists(root))
+            return [];
+
+        return Directory.EnumerateFiles(root, "*.*", SearchOption.AllDirectories)
+            .Where(static path => path.EndsWith(".cpp", StringComparison.OrdinalIgnoreCase) ||
+                                  path.EndsWith(".h", StringComparison.OrdinalIgnoreCase) ||
+                                  path.EndsWith(".hpp", StringComparison.OrdinalIgnoreCase))
+            .Order(StringComparer.OrdinalIgnoreCase)
+            .Select(path => new NativeSourceFile(
+                path,
+                Path.GetRelativePath(root, path).Replace('\\', '/'),
+                StripCommentsAndLiterals(File.ReadAllText(path))))
+            .ToArray();
+    }
+
+    public static IEnumerable<string> SplitArguments(string arguments)
+    {
+        var start = 0;
+        var depth = 0;
+        for (var index = 0; index < arguments.Length; index++)
+        {
+            var character = arguments[index];
+            if (character is '(' or '[' or '<') depth++;
+            else if (character is ')' or ']' or '>') depth = Math.Max(0, depth - 1);
+            else if (character == ',' && depth == 0)
+            {
+                yield return arguments[start..index];
+                start = index + 1;
+            }
+        }
+        yield return arguments[start..];
+    }
+
+    public static bool IsFloatingPointValueArgument(string argument) =>
+        !argument.Contains('*', StringComparison.Ordinal) &&
+        !argument.Contains('&', StringComparison.Ordinal) &&
+        Regex.IsMatch(argument, @"\b(float|double)\b", RegexOptions.CultureInvariant);
+
+    public static string StripCommentsAndLiterals(string content)
+    {
+        var output = new StringBuilder(content.Length);
+        var inLineComment = false;
+        var inBlockComment = false;
+        var inLiteral = false;
+        var quote = '\0';
+        for (var index = 0; index < content.Length; index++)
+        {
+            var character = content[index];
+            var next = index + 1 < content.Length ? content[index + 1] : '\0';
+            if (inLineComment)
+            {
+                if (character == '\n') { inLineComment = false; output.Append(character); }
+                continue;
+            }
+            if (inBlockComment)
+            {
+                if (character == '*' && next == '/') { inBlockComment = false; index++; }
+                continue;
+            }
+            if (inLiteral)
+            {
+                output.Append(' ');
+                if (character == '\\' && index + 1 < content.Length) { output.Append(' '); index++; }
+                else if (character == quote) inLiteral = false;
+                continue;
+            }
+            if (character == '/' && next == '/') { inLineComment = true; index++; continue; }
+            if (character == '/' && next == '*') { inBlockComment = true; index++; continue; }
+            if (character is '\'' or '"') { inLiteral = true; quote = character; output.Append(' '); continue; }
+            output.Append(character);
+        }
+        return output.ToString();
+    }
+}
diff --git a/translator/src/Translator.Core/Parsing/Dol/DolFile.cs b/translator/src/Translator.Core/Parsing/Dol/DolFile.cs
new file mode 100644
index 0000000..ef13cb6
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Dol/DolFile.cs
@@ -0,0 +1,182 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.IO;
+using System.Linq;
+using Translator.Core.IO;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Parsing.Dol;
+
+public sealed class DolFile
+{
+    private const int TextCount = 7;
+    private const int DataCount = 11;
+    private static readonly string[] TextNames = {".init", ".text", "text2", "text3", "text4", "text5", "text6"};
+    private static readonly string[] DataNames = {"extab", "extabindex", ".ctors", ".dtors", ".rodata", ".data", ".sdata", ".sdata2", "data8", "data9", "data10"};
+
+    private DolFile(IReadOnlyList<DolSection> sections, uint entryPoint, uint bssAddress, uint bssSize)
+    {
+        Sections = sections;
+        EntryPoint = entryPoint;
+        BssAddress = bssAddress;
+        BssSize = bssSize;
+        MemoryRange = CalculateRange(sections, bssAddress, bssSize);
+    }
+
+    public IReadOnlyList<DolSection> Sections { get; }
+    public uint EntryPoint { get; }
+    public uint BssAddress { get; }
+    public uint BssSize { get; }
+    public AddressRange MemoryRange { get; }
+
+    public IEnumerable<DolSection> ExecutableSections => Sections.Where(s => s.IsExecutable);
+
+    public static DolFile Load(string path)
+    {
+        using var stream = File.OpenRead(path);
+        return Load(stream);
+    }
+
+    public static DolFile Load(Stream stream)
+    {
+        if (!stream.CanSeek)
+        {
+            throw new ArgumentException("DOL parsing requires a seekable stream", nameof(stream));
+        }
+
+        using var reader = new BigEndianBinaryReader(stream, leaveOpen: true);
+
+        var textOffsets = ReadArray(reader, offset: 0x00, count: TextCount);
+        var dataOffsets = ReadArray(reader, offset: 0x1C, count: DataCount);
+        var textAddresses = ReadArray(reader, offset: 0x48, count: TextCount);
+        var dataAddresses = ReadArray(reader, offset: 0x64, count: DataCount);
+        var textSizes = ReadArray(reader, offset: 0x90, count: TextCount);
+        var dataSizes = ReadArray(reader, offset: 0xAC, count: DataCount);
+
+        reader.Seek(0xD8, SeekOrigin.Begin);
+        var bssAddress = reader.ReadUInt32();
+        var bssSize = reader.ReadUInt32();
+        var entryPoint = reader.ReadUInt32();
+
+        var sections = new List<DolSection>();
+
+        for (var i = 0; i < TextCount; i++)
+        {
+            if (textSizes[i] == 0)
+            {
+                continue;
+            }
+
+            var data = ReadSectionData(stream, textOffsets[i], textSizes[i]);
+            sections.Add(new DolSection(
+                index: i,
+                name: TextNames.ElementAtOrDefault(i) ?? $"text{i}",
+                kind: SectionKind.Text,
+                fileOffset: textOffsets[i],
+                virtualAddress: textAddresses[i],
+                size: textSizes[i],
+                data: data));
+        }
+
+        for (var i = 0; i < DataCount; i++)
+        {
+            if (dataSizes[i] == 0)
+            {
+                continue;
+            }
+
+            var data = ReadSectionData(stream, dataOffsets[i], dataSizes[i]);
+            sections.Add(new DolSection(
+                index: i,
+                name: DataNames.ElementAtOrDefault(i) ?? $"data{i}",
+                kind: SectionKind.Data,
+                fileOffset: dataOffsets[i],
+                virtualAddress: dataAddresses[i],
+                size: dataSizes[i],
+                data: data));
+        }
+
+        if (bssSize > 0)
+        {
+            sections.Add(new DolSection(
+                index: sections.Count,
+                name: ".bss",
+                kind: SectionKind.Bss,
+                fileOffset: 0,
+                virtualAddress: bssAddress,
+                size: bssSize,
+                data: ReadOnlyMemory<byte>.Empty));
+        }
+
+        return new DolFile(new ReadOnlyCollection<DolSection>(sections), entryPoint, bssAddress, bssSize);
+    }
+
+    private static AddressRange CalculateRange(IEnumerable<DolSection> sections, uint bssAddress, uint bssSize)
+    {
+        var hasAny = false;
+        uint start = uint.MaxValue;
+        uint end = 0;
+
+        foreach (var section in sections)
+        {
+            if (section.Size == 0)
+            {
+                continue;
+            }
+
+            hasAny = true;
+            start = Math.Min(start, section.VirtualAddress);
+            end = Math.Max(end, section.Range.End);
+        }
+
+        if (bssSize > 0)
+        {
+            hasAny = true;
+            start = Math.Min(start, bssAddress);
+            end = Math.Max(end, checked(bssAddress + bssSize));
+        }
+
+        if (!hasAny)
+        {
+            return new AddressRange(0, 0);
+        }
+
+        return new AddressRange(start, end);
+    }
+
+    private static uint[] ReadArray(BigEndianBinaryReader reader, int offset, int count)
+    {
+        reader.Seek(offset, SeekOrigin.Begin);
+        var values = new uint[count];
+        for (var i = 0; i < count; i++)
+        {
+            values[i] = reader.ReadUInt32();
+        }
+        return values;
+    }
+
+    private static ReadOnlyMemory<byte> ReadSectionData(Stream stream, uint offset, uint size)
+    {
+        if (size == 0)
+        {
+            return ReadOnlyMemory<byte>.Empty;
+        }
+
+        var length = checked((int)size);
+        var data = new byte[length];
+        stream.Seek(offset, SeekOrigin.Begin);
+        try
+        {
+            stream.ReadExactly(data);
+        }
+        catch (EndOfStreamException exception)
+        {
+            throw new InvalidDataException(
+                $"Section at file offset 0x{offset:X} is truncated; expected {data.Length} bytes.",
+                exception);
+        }
+
+        return data;
+    }
+}
diff --git a/translator/src/Translator.Core/Parsing/Dol/DolSection.cs b/translator/src/Translator.Core/Parsing/Dol/DolSection.cs
new file mode 100644
index 0000000..cb789ed
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Dol/DolSection.cs
@@ -0,0 +1,36 @@
+using System;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Parsing.Dol;
+
+public enum SectionKind
+{
+    Text,
+    Data,
+    Bss
+}
+
+public sealed class DolSection
+{
+    public DolSection(int index, string name, SectionKind kind, uint fileOffset, uint virtualAddress, uint size, ReadOnlyMemory<byte> data)
+    {
+        Index = index;
+        Name = name;
+        Kind = kind;
+        FileOffset = fileOffset;
+        VirtualAddress = virtualAddress;
+        Size = size;
+        Data = data;
+    }
+
+    public int Index { get; }
+    public string Name { get; }
+    public SectionKind Kind { get; }
+    public uint FileOffset { get; }
+    public uint VirtualAddress { get; }
+    public uint Size { get; }
+    public AddressRange Range => AddressRange.FromStartAndSize(VirtualAddress, Size);
+    public ReadOnlyMemory<byte> Data { get; }
+    public bool HasData => Data.Length > 0;
+    public bool IsExecutable => Kind == SectionKind.Text;
+}
diff --git a/translator/src/Translator.Core/Parsing/Kamek/KamekAddress.cs b/translator/src/Translator.Core/Parsing/Kamek/KamekAddress.cs
new file mode 100644
index 0000000..fa1888e
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Kamek/KamekAddress.cs
@@ -0,0 +1,12 @@
+namespace Translator.Core.Parsing.Kamek;
+
+/// <summary>
+/// Kamek command operands are either an absolute guest address or an offset into
+/// the loaded module. The 0x80000000 split is the whole rule, and every planner
+/// that walks a command stream needs it.
+/// </summary>
+public static class KamekAddress
+{
+    public static uint Resolve(uint raw, uint moduleGuestBase) =>
+        raw >= 0x80000000u ? raw : checked(moduleGuestBase + raw);
+}
diff --git a/translator/src/Translator.Core/Parsing/Kamek/KamekChunk.cs b/translator/src/Translator.Core/Parsing/Kamek/KamekChunk.cs
new file mode 100644
index 0000000..c8af538
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Kamek/KamekChunk.cs
@@ -0,0 +1,174 @@
+using System.Buffers.Binary;
+using Translator.Core.IO;
+
+namespace Translator.Core.Parsing.Kamek;
+
+public sealed class KamekChunk
+{
+    public const uint Magic0 = 0x4B616D65;
+    public const uint Magic1 = 0x6B000003;
+    public const int HeaderSize = 0x20;
+
+    public KamekChunk(
+        int index,
+        long fileOffset,
+        uint bssSize,
+        uint codeSize,
+        uint ctorStart,
+        uint ctorEnd,
+        uint chunkSize,
+        byte[] codeBlob,
+        IReadOnlyList<KamekCommand> commands)
+    {
+        Index = index;
+        FileOffset = fileOffset;
+        BssSize = bssSize;
+        CodeSize = codeSize;
+        CtorStart = ctorStart;
+        CtorEnd = ctorEnd;
+        ChunkSize = chunkSize;
+        CodeBlob = codeBlob;
+        Commands = commands;
+    }
+
+    public int Index { get; }
+    public long FileOffset { get; }
+    public uint BssSize { get; }
+    public uint CodeSize { get; }
+    public uint CtorStart { get; }
+    public uint CtorEnd { get; }
+    public uint ChunkSize { get; }
+    public byte[] CodeBlob { get; }
+    public IReadOnlyList<KamekCommand> Commands { get; }
+
+    public int RelativeCommandCount => Commands.Count(c => c.AddressIsRelative);
+    public int AbsoluteCommandCount => Commands.Count(c => c.AddressIsAbsolute);
+
+    public IReadOnlyDictionary<KamekCommandId, int> CommandCounts =>
+        Commands
+            .GroupBy(c => c.Id)
+            .OrderBy(g => (byte)g.Key)
+            .ToDictionary(g => g.Key, g => g.Count());
+
+    public static bool HasMagic(ReadOnlySpan<byte> data, int offset)
+    {
+        if (offset < 0 || offset + 8 > data.Length)
+        {
+            return false;
+        }
+
+        return BinaryPrimitives.ReadUInt32BigEndian(data.Slice(offset, 4)) == Magic0 &&
+            BinaryPrimitives.ReadUInt32BigEndian(data.Slice(offset + 4, 4)) == Magic1;
+    }
+
+    public static KamekChunk Parse(byte[] data, int offset, int expectedSize, int index)
+    {
+        if (offset < 0 || offset + HeaderSize > data.Length)
+        {
+            throw new InvalidDataException($"Kamek chunk {index} header at 0x{offset:X} is outside file.");
+        }
+
+        using var stream = new MemoryStream(data, writable: false);
+        using var reader = new BigEndianBinaryReader(stream);
+        reader.Seek(offset, SeekOrigin.Begin);
+
+        var magic0 = reader.ReadUInt32();
+        var magic1 = reader.ReadUInt32();
+        if (magic0 != Magic0 || magic1 != Magic1)
+        {
+            throw new InvalidDataException($"Kamek chunk {index} at 0x{offset:X} has invalid magic 0x{magic0:X8}/0x{magic1:X8}.");
+        }
+
+        var bssSize = reader.ReadUInt32();
+        var codeSize = reader.ReadUInt32();
+        var ctorStart = reader.ReadUInt32();
+        var ctorEnd = reader.ReadUInt32();
+        var chunkSize = reader.ReadUInt32();
+        _ = reader.ReadUInt32(); // reserved
+
+        if (chunkSize < HeaderSize + codeSize)
+        {
+            throw new InvalidDataException($"Kamek chunk {index} chunkSize 0x{chunkSize:X} is smaller than header+code.");
+        }
+
+        if (expectedSize != 0 && chunkSize != expectedSize)
+        {
+            throw new InvalidDataException($"Kamek chunk {index} chunkSize 0x{chunkSize:X} does not match combined size 0x{expectedSize:X}.");
+        }
+
+        if (offset + chunkSize > data.Length)
+        {
+            throw new InvalidDataException($"Kamek chunk {index} extends past file end.");
+        }
+
+        if (ctorStart > codeSize || ctorEnd > codeSize || ctorStart > ctorEnd || ((ctorEnd - ctorStart) % 4) != 0)
+        {
+            throw new InvalidDataException($"Kamek chunk {index} has invalid ctor range 0x{ctorStart:X}-0x{ctorEnd:X} for codeSize 0x{codeSize:X}.");
+        }
+
+        var codeBlob = reader.ReadBytes(checked((int)codeSize));
+        var commandEnd = offset + checked((int)chunkSize);
+        var commands = new List<KamekCommand>();
+
+        while (reader.Position < commandEnd)
+        {
+            var commandOffset = reader.Position;
+            var commandWord = reader.ReadUInt32();
+            var rawId = (byte)(commandWord >> 24);
+            if (!Enum.IsDefined(typeof(KamekCommandId), rawId))
+            {
+                throw new InvalidDataException($"Unknown Kamek command id {rawId} at file offset 0x{commandOffset:X}.");
+            }
+
+            var id = (KamekCommandId)rawId;
+            var addressEnc = commandWord & 0x00FFFFFFu;
+            bool addressIsAbsolute;
+            uint address;
+            if (addressEnc == 0x00FFFFFEu)
+            {
+                addressIsAbsolute = true;
+                address = reader.ReadUInt32();
+            }
+            else
+            {
+                addressIsAbsolute = false;
+                address = addressEnc;
+            }
+
+            var argCount = ArgumentCount(id);
+            var args = new uint[argCount];
+            for (var i = 0; i < argCount; i++)
+            {
+                args[i] = reader.ReadUInt32();
+            }
+
+            commands.Add(new KamekCommand(commandOffset, commandWord, id, addressIsAbsolute, address, args));
+        }
+
+        if (reader.Position != commandEnd)
+        {
+            throw new InvalidDataException($"Kamek chunk {index} command stream ended at 0x{reader.Position:X}, expected 0x{commandEnd:X}.");
+        }
+
+        return new KamekChunk(index, offset, bssSize, codeSize, ctorStart, ctorEnd, chunkSize, codeBlob, commands);
+    }
+
+    public static int ArgumentCount(KamekCommandId id) => id switch
+    {
+        KamekCommandId.Addr32 => 1,
+        KamekCommandId.Addr16Lo => 1,
+        KamekCommandId.Addr16Hi => 1,
+        KamekCommandId.Addr16Ha => 1,
+        KamekCommandId.Rel24 => 1,
+        KamekCommandId.Write32 => 1,
+        KamekCommandId.Write16 => 1,
+        KamekCommandId.Write8 => 1,
+        KamekCommandId.CondWritePointer => 2,
+        KamekCommandId.CondWrite32 => 2,
+        KamekCommandId.CondWrite16 => 2,
+        KamekCommandId.CondWrite8 => 2,
+        KamekCommandId.Branch => 1,
+        KamekCommandId.BranchLink => 1,
+        _ => throw new ArgumentOutOfRangeException(nameof(id), id, "Unsupported Kamek command id")
+    };
+}
diff --git a/translator/src/Translator.Core/Parsing/Kamek/KamekCommand.cs b/translator/src/Translator.Core/Parsing/Kamek/KamekCommand.cs
new file mode 100644
index 0000000..9d00c62
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Kamek/KamekCommand.cs
@@ -0,0 +1,12 @@
+namespace Translator.Core.Parsing.Kamek;
+
+public sealed record KamekCommand(
+    long StreamOffset,
+    uint CommandWord,
+    KamekCommandId Id,
+    bool AddressIsAbsolute,
+    uint Address,
+    IReadOnlyList<uint> Arguments)
+{
+    public bool AddressIsRelative => !AddressIsAbsolute;
+}
diff --git a/translator/src/Translator.Core/Parsing/Kamek/KamekCommandId.cs b/translator/src/Translator.Core/Parsing/Kamek/KamekCommandId.cs
new file mode 100644
index 0000000..1ceb237
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Kamek/KamekCommandId.cs
@@ -0,0 +1,20 @@
+namespace Translator.Core.Parsing.Kamek;
+
+public enum KamekCommandId : byte
+{
+    Addr32 = 1,
+    WritePointer = 1,
+    Addr16Lo = 4,
+    Addr16Hi = 5,
+    Addr16Ha = 6,
+    Rel24 = 10,
+    Write32 = 32,
+    Write16 = 33,
+    Write8 = 34,
+    CondWritePointer = 35,
+    CondWrite32 = 36,
+    CondWrite16 = 37,
+    CondWrite8 = 38,
+    Branch = 64,
+    BranchLink = 65
+}
diff --git a/translator/src/Translator.Core/Parsing/Kamek/KamekPpcEncoding.cs b/translator/src/Translator.Core/Parsing/Kamek/KamekPpcEncoding.cs
new file mode 100644
index 0000000..f1de4b3
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Kamek/KamekPpcEncoding.cs
@@ -0,0 +1,20 @@
+namespace Translator.Core.Parsing.Kamek;
+
+public static class KamekPpcEncoding
+{
+    public static uint EncodeBranch(uint from, uint to, bool link)
+    {
+        var delta = unchecked((int)to - (int)from);
+        if ((delta & 0x3) != 0)
+        {
+            throw new ArgumentOutOfRangeException(nameof(to), $"PPC branch target 0x{to:X8} is not word aligned from 0x{from:X8}.");
+        }
+
+        if (delta < -0x02000000 || delta > 0x01FFFFFC)
+        {
+            throw new ArgumentOutOfRangeException(nameof(to), $"PPC branch target 0x{to:X8} is out of rel24 range from 0x{from:X8}.");
+        }
+
+        return 0x48000000u | (unchecked((uint)delta) & 0x03FFFFFCu) | (link ? 1u : 0u);
+    }
+}
diff --git a/translator/src/Translator.Core/Parsing/Kamek/KamekPulFile.cs b/translator/src/Translator.Core/Parsing/Kamek/KamekPulFile.cs
new file mode 100644
index 0000000..75306fe
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Kamek/KamekPulFile.cs
@@ -0,0 +1,109 @@
+using System.Buffers.Binary;
+
+namespace Translator.Core.Parsing.Kamek;
+
+public sealed class KamekPulFile
+{
+    private static readonly char[] DefaultRegionOrder = ['P', 'E', 'J', 'K'];
+
+    public KamekPulFile(bool isCombined, IReadOnlyList<uint> combinedChunkSizes, IReadOnlyList<KamekChunk> chunks)
+    {
+        IsCombined = isCombined;
+        CombinedChunkSizes = combinedChunkSizes;
+        Chunks = chunks;
+    }
+
+    public bool IsCombined { get; }
+    public IReadOnlyList<uint> CombinedChunkSizes { get; }
+    public IReadOnlyList<KamekChunk> Chunks { get; }
+
+    public static KamekPulFile Load(string path) => Parse(File.ReadAllBytes(path));
+
+    public static KamekPulFile Parse(byte[] data)
+    {
+        if (data.Length < KamekChunk.HeaderSize)
+        {
+            throw new InvalidDataException("File is too small to contain a Kamek chunk.");
+        }
+
+        if (TryParseCombined(data, out var combined))
+        {
+            return combined;
+        }
+
+        if (!KamekChunk.HasMagic(data, 0))
+        {
+            throw new InvalidDataException("File is neither a combined Code.pul nor a raw Kamek v3 chunk.");
+        }
+
+        var rawChunk = KamekChunk.Parse(data, 0, expectedSize: 0, index: 0);
+        if (rawChunk.ChunkSize != data.Length)
+        {
+            throw new InvalidDataException($"Raw Kamek chunk size 0x{rawChunk.ChunkSize:X} does not match file length 0x{data.Length:X}.");
+        }
+
+        return new KamekPulFile(false, Array.Empty<uint>(), [rawChunk]);
+    }
+
+    public KamekChunk SelectRegion(string region)
+    {
+        if (region is not ("P" or "E" or "J" or "K"))
+        {
+            throw new ArgumentException("Region must be exactly P, E, J, or K.", nameof(region));
+        }
+
+        var regionChar = region[0];
+        var regionIndex = Array.IndexOf(DefaultRegionOrder, regionChar);
+        var chunk = Chunks.FirstOrDefault(c => c.Index == regionIndex);
+        return chunk ?? throw new InvalidDataException($"Code.pul does not contain a non-empty chunk for region {regionChar} at index {regionIndex}.");
+    }
+
+    private static bool TryParseCombined(byte[] data, out KamekPulFile file)
+    {
+        file = null!;
+        if (data.Length < 0x10 + KamekChunk.HeaderSize)
+        {
+            return false;
+        }
+
+        Span<uint> sizes = stackalloc uint[4];
+        long totalSize = 0x10;
+        var nonzeroCount = 0;
+        for (var i = 0; i < 4; i++)
+        {
+            sizes[i] = BinaryPrimitives.ReadUInt32BigEndian(data.AsSpan(i * 4, 4));
+            totalSize += sizes[i];
+            if (sizes[i] != 0)
+            {
+                nonzeroCount++;
+            }
+        }
+
+        if (nonzeroCount == 0 || totalSize != data.Length)
+        {
+            return false;
+        }
+
+        var chunks = new List<KamekChunk>();
+        var offset = 0x10;
+        for (var i = 0; i < 4; i++)
+        {
+            var size = sizes[i];
+            if (size == 0)
+            {
+                continue;
+            }
+
+            if (size < KamekChunk.HeaderSize || offset + size > data.Length || !KamekChunk.HasMagic(data, offset))
+            {
+                return false;
+            }
+
+            chunks.Add(KamekChunk.Parse(data, offset, checked((int)size), i));
+            offset += checked((int)size);
+        }
+
+        file = new KamekPulFile(true, sizes.ToArray(), chunks);
+        return true;
+    }
+}
diff --git a/translator/src/Translator.Core/Parsing/Rel/RelFile.cs b/translator/src/Translator.Core/Parsing/Rel/RelFile.cs
new file mode 100644
index 0000000..d0f6113
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Rel/RelFile.cs
@@ -0,0 +1,336 @@
+using System;
+using System.Buffers.Binary;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.IO;
+using System.Linq;
+using Translator.Core.IO;
+using Translator.Core.Loading;
+
+namespace Translator.Core.Parsing.Rel;
+
+public sealed class RelFile
+{
+    private readonly byte[] _raw;
+
+    private RelFile(byte[] raw,
+        IReadOnlyList<RelSection> sections,
+        IReadOnlyList<RelImportEntry> imports,
+        uint totalSize)
+    {
+        _raw = raw;
+        Sections = sections;
+        _imports = imports;
+        _totalSize = totalSize;
+    }
+
+    private readonly IReadOnlyList<RelImportEntry> _imports;
+    private readonly uint _totalSize;
+
+    /// <summary>The only REL header surface any caller outside this file reads.</summary>
+    public IReadOnlyList<RelSection> Sections { get; }
+
+    public static RelFile Load(string path)
+    {
+        var raw = File.ReadAllBytes(path);
+        using var stream = new MemoryStream(raw, writable: false);
+        using var reader = new BigEndianBinaryReader(stream, leaveOpen: true);
+
+        reader.Seek(0x0C, SeekOrigin.Begin);
+        var sectionCount = reader.ReadUInt32();
+        var sectionTableOffset = reader.ReadUInt32();
+
+        reader.Seek(0x1C, SeekOrigin.Begin);
+        _ = reader.ReadUInt32(); // version (unused for now)
+        var bssSize = reader.ReadUInt32();
+
+        reader.Seek(0x28, SeekOrigin.Begin);
+        var importTableOffset = reader.ReadUInt32();
+        var importTableSize = reader.ReadUInt32();
+
+        _ = reader.ReadByte(); // prolog section (0x30)
+        _ = reader.ReadByte(); // epilog section (0x31)
+        _ = reader.ReadByte(); // unresolved section (0x32)
+        var bssSectionIndex = reader.ReadByte(); // 0x33
+
+        // Offsets used by the runtime loader (kept for debugging / layout checks)
+        _ = reader.ReadUInt32(); // prolog offset within prolog section (0x34)
+        _ = reader.ReadUInt32(); // epilog offset within epilog section (0x38)
+        _ = reader.ReadUInt32(); // unresolved offset within unresolved section (0x3C)
+
+        _ = reader.ReadUInt32(); // align (0x40)
+        var bssAlign = reader.ReadUInt32(); // 0x44
+
+        // Basic validation
+        if (sectionTableOffset + sectionCount * 8 > raw.Length)
+        {
+            throw new InvalidDataException("Section table extends beyond REL bounds");
+        }
+
+        if (importTableOffset + importTableSize > raw.Length)
+        {
+            throw new InvalidDataException("Import table extends beyond REL bounds");
+        }
+
+        var sections = ParseSections(raw, sectionTableOffset, sectionCount);
+        if (bssAlign == 0)
+        {
+            bssAlign = 0x20;
+        }
+        var bssOffset = AlignUp(CalculateBssOffset(raw.Length), bssAlign);
+        var totalSize = checked(bssOffset + bssSize);
+        var adjustedSections = ApplyBssLayout(sections, bssSectionIndex, bssOffset, bssSize);
+        var imports = ParseImports(raw, importTableOffset, importTableSize);
+
+        return new RelFile(
+            raw,
+            new ReadOnlyCollection<RelSection>(adjustedSections),
+            new ReadOnlyCollection<RelImportEntry>(imports),
+            totalSize);
+    }
+
+    private static List<RelSection> ParseSections(byte[] raw, uint offset, uint count)
+    {
+        var sections = new List<RelSection>((int)count);
+        for (var i = 0; i < count; i++)
+        {
+            var entryOffset = checked((int)(offset + (uint)(i * 8)));
+            var offRaw = ReadUInt32(raw, entryOffset);
+            var size = ReadUInt32(raw, entryOffset + 4);
+            var executable = (offRaw & 1) != 0;
+            var fileOffset = offRaw & ~1u;
+            sections.Add(new RelSection(i, fileOffset, size, executable));
+        }
+        return sections;
+    }
+
+    private static List<RelSection> ApplyBssLayout(List<RelSection> sections, byte bssSectionIndex, uint bssOffset, uint bssSize)
+    {
+        // REL BSS sections have fileOffset==0; the runtime loader fills the real address in at load
+        // time. We place BSS right after the loaded REL bytes in our flat image so relocations that
+        // target or write into BSS resolve in-bounds.
+        var bssCursor = bssOffset;
+        var bssEnd = checked(bssOffset + bssSize);
+
+        var adjusted = new List<RelSection>(sections.Count);
+        foreach (var section in sections)
+        {
+            var isBss = section.FileOffset == 0 && (section.Size != 0 || section.Index == bssSectionIndex);
+            if (!isBss)
+            {
+                adjusted.Add(section);
+                continue;
+            }
+
+            if (bssCursor > bssEnd)
+            {
+                throw new InvalidDataException("BSS layout exceeded declared BSS size");
+            }
+
+            adjusted.Add(new RelSection(section.Index, bssCursor, section.Size, section.Executable));
+            bssCursor = checked(bssCursor + section.Size);
+        }
+
+        if (bssCursor > bssEnd)
+        {
+            throw new InvalidDataException($"BSS section sizes exceed header bssSize (cursor=0x{bssCursor:X8}, end=0x{bssEnd:X8})");
+        }
+
+        return adjusted;
+    }
+
+    private static List<RelImportEntry> ParseImports(byte[] raw, uint offset, uint size)
+    {
+        var imports = new List<RelImportEntry>((int)(size / 8));
+        for (var cursor = offset; cursor < offset + size; cursor += 8)
+        {
+            var moduleId = ReadUInt32(raw, (int)cursor);
+            var relocationOffset = ReadUInt32(raw, (int)cursor + 4);
+            imports.Add(new RelImportEntry(moduleId, relocationOffset));
+        }
+        return imports;
+    }
+
+    private static uint CalculateBssOffset(int fileSize)
+    {
+        // BSS placement must be deterministic for offline relocation. We assume the common
+        // OSAllocFromHeap layout, alignUp(size + 0x20 header, 0x20) = (size + 0x20 + 0x1F) & ~0x1F,
+        // and place BSS right after the heap-rounded REL allocation; a future REL consumer with a
+        // different allocator would need its own placement policy.
+        const uint heapAlign = 0x20;
+        const uint heapHeaderSize = 0x20;
+        return AlignUp(checked((uint)fileSize + heapHeaderSize), heapAlign);
+    }
+
+    private static uint AlignUp(uint value, uint alignment)
+    {
+        if (alignment == 0)
+        {
+            return value;
+        }
+
+        if ((alignment & (alignment - 1)) != 0)
+        {
+            throw new InvalidDataException($"Alignment must be a power of two (got 0x{alignment:X})");
+        }
+
+        var mask = alignment - 1;
+        return checked((value + mask) & ~mask);
+    }
+
+    public RelImage BuildImage(uint baseAddress,
+        uint dolBaseAddress = MemoryLayout.DolBaseAddress,
+        bool applyRelocations = true)
+    {
+        var buffer = new byte[checked((int)_totalSize)];
+        Buffer.BlockCopy(_raw, 0, buffer, 0, _raw.Length);
+
+        if (applyRelocations)
+        {
+            ApplyRelocations(buffer, baseAddress, dolBaseAddress);
+        }
+
+        return new RelImage(buffer, baseAddress);
+    }
+    
+    private void ApplyRelocations(byte[] memory, uint baseAddress, uint dolBaseAddress)
+    {
+        foreach (var import in _imports)
+        {
+            uint currentOffset = 0;
+            byte currentSection = 0;
+            var cursor = import.RelocationOffset;
+
+            while (true)
+            {
+                var delta = ReadUInt16(_raw, (int)cursor);
+                var type = (RelocationType)_raw[cursor + 2];
+                var symbolSection = _raw[cursor + 3];
+                var addend = ReadUInt32(_raw, (int)cursor + 4);
+                cursor += 8;
+
+                if (type == RelocationType.R_RVL_STOP)
+                {
+                    break;
+                }
+
+                if (type == RelocationType.R_RVL_SECT)
+                {
+                    currentSection = symbolSection;
+                    currentOffset = 0;
+                    continue;
+                }
+
+                currentOffset = checked(currentOffset + delta);
+                if (currentSection >= Sections.Count)
+                {
+                    throw new InvalidDataException($"Relocation referenced unknown section index {currentSection}");
+                }
+
+                var dstSection = Sections[currentSection];
+                var dst = baseAddress + dstSection.FileOffset + currentOffset;
+
+                uint target;
+                if (import.ModuleId == 0)
+                {
+                    target = addend;
+                    if (target < MemoryLayout.RamBase)
+                    {
+                        target = dolBaseAddress + target;
+                    }
+                }
+                else
+                {
+                    if (symbolSection >= Sections.Count)
+                    {
+                        throw new InvalidDataException($"Relocation referenced unknown symbol section {symbolSection}");
+                    }
+
+                    var symbol = Sections[symbolSection];
+                    target = baseAddress + symbol.FileOffset + addend;
+                }
+
+                var memIndex = checked((int)(dst - baseAddress));
+                var orig = ReadUInt32(memory, memIndex);
+
+                switch (type)
+                {
+                    // StaticR.rel uses exactly these five relocation types; any
+                    // other encoding reaches the default arm and fails loudly.
+                    case RelocationType.R_RVL_NONE:
+                        break;
+                    case RelocationType.R_PPC_ADDR32:
+                        WriteUInt32(memory, memIndex, target);
+                        break;
+                    case RelocationType.R_PPC_ADDR16_LO:
+                        WriteUInt16(memory, memIndex, (ushort)(target & 0xFFFF));
+                        break;
+                    case RelocationType.R_PPC_ADDR16_HA:
+                        WriteUInt16(memory, memIndex, (ushort)(((target + 0x8000) >> 16) & 0xFFFF));
+                        break;
+                    case RelocationType.R_PPC_REL24:
+                        {
+                            var disp = (target - dst) & 0x03FFFFFC;
+                            var patched = (orig & 0xFC000003) | disp;
+                            WriteUInt32(memory, memIndex, patched);
+                            break;
+                        }
+                    default:
+                        throw new NotSupportedException($"Unhandled relocation type {type} at 0x{dst:X8}");
+                }
+            }
+        }
+    }
+
+    private static ushort ReadUInt16(IReadOnlyList<byte> data, int offset)
+    {
+        if (offset + 2 > data.Count)
+        {
+            throw new InvalidDataException("Attempted to read past end of REL payload");
+        }
+        Span<byte> buffer = stackalloc byte[2];
+        buffer[0] = data[offset];
+        buffer[1] = data[offset + 1];
+        return BinaryPrimitives.ReadUInt16BigEndian(buffer);
+    }
+
+    private static uint ReadUInt32(IReadOnlyList<byte> data, int offset)
+    {
+        if (offset + 4 > data.Count)
+        {
+            throw new InvalidDataException("Attempted to read past end of REL payload");
+        }
+        Span<byte> buffer = stackalloc byte[4];
+        buffer[0] = data[offset];
+        buffer[1] = data[offset + 1];
+        buffer[2] = data[offset + 2];
+        buffer[3] = data[offset + 3];
+        return BinaryPrimitives.ReadUInt32BigEndian(buffer);
+    }
+
+    private static void WriteUInt16(IList<byte> data, int offset, ushort value)
+    {
+        if (offset < 0 || offset + 2 > data.Count)
+        {
+            throw new InvalidDataException("Attempted to write past end of REL memory");
+        }
+        Span<byte> buffer = stackalloc byte[2];
+        BinaryPrimitives.WriteUInt16BigEndian(buffer, value);
+        data[offset] = buffer[0];
+        data[offset + 1] = buffer[1];
+    }
+
+    private static void WriteUInt32(IList<byte> data, int offset, uint value)
+    {
+        if (offset < 0 || offset + 4 > data.Count)
+        {
+            throw new InvalidDataException("Attempted to write past end of REL memory");
+        }
+        Span<byte> buffer = stackalloc byte[4];
+        BinaryPrimitives.WriteUInt32BigEndian(buffer, value);
+        data[offset] = buffer[0];
+        data[offset + 1] = buffer[1];
+        data[offset + 2] = buffer[2];
+        data[offset + 3] = buffer[3];
+    }
+}
diff --git a/translator/src/Translator.Core/Parsing/Rel/RelImage.cs b/translator/src/Translator.Core/Parsing/Rel/RelImage.cs
new file mode 100644
index 0000000..6bbb2ec
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Rel/RelImage.cs
@@ -0,0 +1,17 @@
+using Translator.Core.Loading;
+
+namespace Translator.Core.Parsing.Rel;
+
+public sealed class RelImage
+{
+    public RelImage(byte[] data, uint baseAddress)
+    {
+        Data = data;
+        BaseAddress = baseAddress;
+        Range = AddressRange.FromStartAndSize(baseAddress, (uint)data.Length);
+    }
+
+    public byte[] Data { get; }
+    public uint BaseAddress { get; }
+    public AddressRange Range { get; }
+}
diff --git a/translator/src/Translator.Core/Parsing/Rel/RelImportEntry.cs b/translator/src/Translator.Core/Parsing/Rel/RelImportEntry.cs
new file mode 100644
index 0000000..17eaf82
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Rel/RelImportEntry.cs
@@ -0,0 +1,13 @@
+namespace Translator.Core.Parsing.Rel;
+
+public sealed class RelImportEntry
+{
+    public RelImportEntry(uint moduleId, uint relocationOffset)
+    {
+        ModuleId = moduleId;
+        RelocationOffset = relocationOffset;
+    }
+
+    public uint ModuleId { get; }
+    public uint RelocationOffset { get; }
+}
diff --git a/translator/src/Translator.Core/Parsing/Rel/RelSection.cs b/translator/src/Translator.Core/Parsing/Rel/RelSection.cs
new file mode 100644
index 0000000..7d52afe
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Rel/RelSection.cs
@@ -0,0 +1,21 @@
+using Translator.Core.Loading;
+
+namespace Translator.Core.Parsing.Rel;
+
+public sealed class RelSection
+{
+    public RelSection(int index, uint fileOffset, uint size, bool executable)
+    {
+        Index = index;
+        FileOffset = fileOffset;
+        Size = size;
+        Executable = executable;
+        Range = AddressRange.FromStartAndSize(fileOffset, size);
+    }
+
+    public int Index { get; }
+    public uint FileOffset { get; }
+    public uint Size { get; }
+    public bool Executable { get; }
+    public AddressRange Range { get; }
+}
diff --git a/translator/src/Translator.Core/Parsing/Rel/RelocationType.cs b/translator/src/Translator.Core/Parsing/Rel/RelocationType.cs
new file mode 100644
index 0000000..953625c
--- /dev/null
+++ b/translator/src/Translator.Core/Parsing/Rel/RelocationType.cs
@@ -0,0 +1,23 @@
+namespace Translator.Core.Parsing.Rel;
+
+public enum RelocationType : byte
+{
+    R_PPC_NONE = 0,
+    R_PPC_ADDR32 = 1,
+    R_PPC_ADDR24 = 2,
+    R_PPC_ADDR16 = 3,
+    R_PPC_ADDR16_LO = 4,
+    R_PPC_ADDR16_HI = 5,
+    R_PPC_ADDR16_HA = 6,
+    R_PPC_ADDR14 = 7,
+    R_PPC_ADDR14_BRTAKEN = 8,
+    R_PPC_ADDR14_BRNTAKEN = 9,
+    R_PPC_REL24 = 10,
+    R_PPC_REL14 = 11,
+    R_PPC_REL14_BRTAKEN = 12,
+    R_PPC_REL14_BRNTAKEN = 13,
+    R_RVL_NONE = 201,
+    R_RVL_SECT = 202,
+    R_RVL_STOP = 203,
+    R_DOLPHIN_MRKREF = 204
+}
diff --git a/translator/src/Translator.Core/Properties/AssemblyInfo.cs b/translator/src/Translator.Core/Properties/AssemblyInfo.cs
new file mode 100644
index 0000000..4930220
--- /dev/null
+++ b/translator/src/Translator.Core/Properties/AssemblyInfo.cs
@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("Translator.Tests")]
diff --git a/translator/src/Translator.Core/RegisterNameUtils.cs b/translator/src/Translator.Core/RegisterNameUtils.cs
new file mode 100644
index 0000000..9e057c0
--- /dev/null
+++ b/translator/src/Translator.Core/RegisterNameUtils.cs
@@ -0,0 +1,65 @@
+using System;
+
+namespace Translator.Core;
+
+internal static class RegisterNameUtils
+{
+    public static string StripNumericSuffix(string name)
+    {
+        if (string.IsNullOrEmpty(name))
+        {
+            return name;
+        }
+
+        var stripped = StripNumericSuffixSpan(name.AsSpan());
+        // The span result is always a prefix of the input, so an unchanged
+        // length means the original instance can be handed back untouched.
+        return stripped.Length == name.Length ? name : new string(stripped);
+    }
+
+    /// <summary>
+    /// Allocation-free form of <see cref="StripNumericSuffix(string)"/>. Not an overload on purpose:
+    /// <c>StripNumericSuffix</c> is converted to a delegate as a method group elsewhere.
+    /// </summary>
+    public static ReadOnlySpan<char> StripNumericSuffixSpan(ReadOnlySpan<char> name)
+    {
+        if (name.IsEmpty)
+        {
+            return name;
+        }
+
+        var idx = name.LastIndexOf('_');
+        if (idx <= 0)
+        {
+            return name;
+        }
+
+        for (var i = idx + 1; i < name.Length; i++)
+        {
+            if (!char.IsDigit(name[i]))
+            {
+                return name;
+            }
+        }
+
+        return name[..idx];
+    }
+
+    public static string HardwareBase(string name)
+    {
+        if (string.IsNullOrEmpty(name))
+        {
+            return name;
+        }
+
+        var hardware = HardwareBase(name.AsSpan());
+        return hardware.Length == name.Length ? name : new string(hardware);
+    }
+
+    public static ReadOnlySpan<char> HardwareBase(ReadOnlySpan<char> name)
+    {
+        var stripped = StripNumericSuffixSpan(name);
+        var idx = stripped.IndexOf('_');
+        return idx <= 0 ? stripped : stripped[..idx];
+    }
+}
diff --git a/translator/src/Translator.Core/Representation/RepresentationClassifier.cs b/translator/src/Translator.Core/Representation/RepresentationClassifier.cs
new file mode 100644
index 0000000..9c94b22
--- /dev/null
+++ b/translator/src/Translator.Core/Representation/RepresentationClassifier.cs
@@ -0,0 +1,127 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Representation;
+
+public sealed class RepresentationClassifier
+{
+    public RepresentationEnvironment Classify(
+        IrFunction function,
+        IReadOnlyDictionary<string, ValueRepresentation>? seeds = null)
+    {
+        var environment = seeds is null
+            ? new RepresentationEnvironment()
+            : new RepresentationEnvironment(seeds);
+
+        var changed = true;
+        var iterations = 0;
+        while (changed && iterations++ < 20)
+        {
+            changed = false;
+            foreach (var instruction in function.Blocks.SelectMany(static block => block.Instructions))
+            {
+                changed |= Propagate(instruction, environment);
+            }
+        }
+
+        return environment;
+    }
+
+    private static bool Propagate(IrInstruction instruction, RepresentationEnvironment environment)
+    {
+        switch (instruction)
+        {
+            case IrAssign assign:
+                return environment.Unify(assign.Destination, RepresentationOf(assign.Value, environment));
+
+            case IrBinary binary:
+            {
+                var left = RepresentationOf(binary.Left, environment);
+                var right = RepresentationOf(binary.Right, environment);
+                var result = Merge(left, right);
+                if (IsCrField(binary.Destination)) result = ValueRepresentation.UInt32;
+                var changed = environment.Unify(binary.Destination, result);
+                if (binary.Left.RegisterName is { } leftRegister)
+                    changed |= environment.Unify(leftRegister, left);
+                if (binary.Right.RegisterName is { } rightRegister)
+                    changed |= environment.Unify(rightRegister, right);
+                return changed;
+            }
+
+            case IrLoad load:
+                return environment.Unify(load.Destination, RepresentationFromSize(load.SizeBytes));
+
+            case IrStore store:
+            {
+                var changed = environment.Unify(store.Address.Base, ValueRepresentation.UInt32);
+                if (store.Source.RegisterName is { } source)
+                    changed |= environment.Unify(source, RepresentationOf(store.Source, environment));
+                return changed;
+            }
+
+            case IrCall call when !string.IsNullOrWhiteSpace(call.Destination):
+                return environment.Unify(
+                    call.Destination,
+                    IsFloatRegister(call.Destination) ? ValueRepresentation.Float64 : ValueRepresentation.UInt32);
+
+            case IrIndirectCall call when !string.IsNullOrWhiteSpace(call.Destination):
+                return environment.Unify(
+                    call.Destination,
+                    IsFloatRegister(call.Destination) ? ValueRepresentation.Float64 : ValueRepresentation.UInt32);
+
+            case IrPhi phi:
+                return environment.Unify(
+                    phi.Destination,
+                    phi.Sources.Values
+                        .Select(environment.Get)
+                        .Aggregate(ValueRepresentation.Unknown, Merge));
+
+            case IrJumpTable table:
+                return environment.Unify(table.Selector, ValueRepresentation.UInt32);
+
+            default:
+                return false;
+        }
+    }
+
+    private static ValueRepresentation RepresentationOf(
+        IrValue value,
+        RepresentationEnvironment environment) =>
+        value.RegisterName is { } register
+            ? environment.Get(register)
+            : value.Kind == "const"
+                ? ValueRepresentation.Int32
+                : ValueRepresentation.Unknown;
+
+    private static ValueRepresentation RepresentationFromSize(int size) =>
+        size == 8 ? ValueRepresentation.UInt64 :
+        size is 1 or 2 or 4 ? ValueRepresentation.UInt32 :
+        ValueRepresentation.Unknown;
+
+    private static ValueRepresentation Merge(ValueRepresentation left, ValueRepresentation right)
+    {
+        if (left == ValueRepresentation.Unknown) return right;
+        if (right == ValueRepresentation.Unknown) return left;
+        return left.Size >= right.Size ? left : right;
+    }
+
+    private static bool IsFloatRegister(string name)
+    {
+        var baseName = RegisterNameUtils.StripNumericSuffix(name);
+        return baseName.Length > 1 &&
+               (baseName[0] == 'f' || baseName[0] == 'F') &&
+               int.TryParse(baseName.AsSpan(1), out var index) &&
+               index is >= 0 and < 32;
+    }
+
+    private static bool IsCrField(string name)
+    {
+        var baseName = RegisterNameUtils.StripNumericSuffix(name);
+        return baseName.Length == 3 &&
+               baseName.StartsWith("cr", StringComparison.OrdinalIgnoreCase) &&
+               baseName[2] is >= '0' and <= '7';
+    }
+}
+
diff --git a/translator/src/Translator.Core/Representation/RepresentationModel.cs b/translator/src/Translator.Core/Representation/RepresentationModel.cs
new file mode 100644
index 0000000..ca86220
--- /dev/null
+++ b/translator/src/Translator.Core/Representation/RepresentationModel.cs
@@ -0,0 +1,96 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core;
+
+namespace Translator.Core.Representation;
+
+public sealed record ValueRepresentation(string Name, int Size, bool IsFloat = false)
+{
+    public static readonly ValueRepresentation Void = new("void", 0);
+    public static readonly ValueRepresentation Int32 = new("int32", 4);
+    public static readonly ValueRepresentation UInt32 = new("uint32", 4);
+    public static readonly ValueRepresentation Int64 = new("int64", 8);
+    public static readonly ValueRepresentation UInt64 = new("uint64", 8);
+    public static readonly ValueRepresentation Float32 = new("float", 4, true);
+    public static readonly ValueRepresentation Float64 = new("double", 8, true);
+    public static readonly ValueRepresentation Unknown = new("unknown", 0);
+}
+
+public sealed class RepresentationEnvironment
+{
+    private static readonly IReadOnlyDictionary<string, ValueRepresentation> DefaultRegisterRepresentations =
+        BuildDefaultRegisterRepresentations();
+
+    private readonly Dictionary<string, ValueRepresentation> _representations =
+        new(StringComparer.OrdinalIgnoreCase);
+
+    public RepresentationEnvironment()
+    {
+        foreach (var (name, representation) in DefaultRegisterRepresentations)
+        {
+            _representations[name] = representation;
+        }
+    }
+
+    public RepresentationEnvironment(IReadOnlyDictionary<string, ValueRepresentation> seeded)
+        : this()
+    {
+        foreach (var (name, representation) in seeded)
+        {
+            _representations[Base(name)] = representation;
+        }
+    }
+
+    public ValueRepresentation Get(string variable)
+    {
+        var key = Base(variable);
+        return _representations.TryGetValue(key, out var representation)
+            ? representation
+            : ValueRepresentation.Unknown;
+    }
+
+    public bool Unify(string variable, ValueRepresentation representation)
+    {
+        if (string.IsNullOrWhiteSpace(variable))
+        {
+            return false;
+        }
+
+        var key = Base(variable);
+        var existing = Get(key);
+        var merged = Merge(existing, representation);
+        if (existing == merged)
+        {
+            return false;
+        }
+
+        _representations[key] = merged;
+        return true;
+    }
+
+    private static ValueRepresentation Merge(ValueRepresentation left, ValueRepresentation right)
+    {
+        if (left == ValueRepresentation.Unknown) return right;
+        if (right == ValueRepresentation.Unknown) return left;
+        if (left.IsFloat != right.IsFloat) return left.Size >= right.Size ? left : right;
+        return left.Size >= right.Size ? left : right;
+    }
+
+    private static IReadOnlyDictionary<string, ValueRepresentation> BuildDefaultRegisterRepresentations()
+    {
+        var defaults = new Dictionary<string, ValueRepresentation>(StringComparer.OrdinalIgnoreCase);
+        for (var index = 0; index < 32; index++) defaults[$"r{index}"] = ValueRepresentation.UInt32;
+        for (var index = 0; index < 32; index++) defaults[$"f{index}"] = ValueRepresentation.Float64;
+        for (var index = 0; index < 8; index++) defaults[$"gqr{index}"] = ValueRepresentation.UInt32;
+
+        foreach (var register in new[] { "hid0", "hid1", "hid2", "lr", "ctr", "cr", "xer", "srr0", "srr1", "msr" })
+        {
+            defaults[register] = ValueRepresentation.UInt32;
+        }
+
+        return defaults;
+    }
+
+    private static string Base(string name) => RegisterNameUtils.StripNumericSuffix(name);
+}
+
diff --git a/translator/src/Translator.Core/RuntimeNativeIndex.cs b/translator/src/Translator.Core/RuntimeNativeIndex.cs
new file mode 100644
index 0000000..9783c3f
--- /dev/null
+++ b/translator/src/Translator.Core/RuntimeNativeIndex.cs
@@ -0,0 +1,102 @@
+using System.Text.RegularExpressions;
+using Translator.Core.Analysis;
+using Translator.Core.CodeGen;
+
+namespace Translator.Core;
+
+// todo: the entire reading of cpp/h files using regex is a bit fragile, but it works for now. 
+// however this does eventually need to be replaced with another solution.
+public sealed record RuntimeNativeRegistration(
+    uint Address,
+    string Symbol,
+    string SourceFile,
+    bool IsTranslatedOverride,
+    bool ExcludesBaseTranslation);
+
+public sealed record RuntimeNativeAbiEntry(
+    uint Address,
+    string[] ArgumentRegisters,
+    string[] ScalarFloatArgumentRegisters);
+
+public sealed record RuntimeNativeEffectEntry(
+    uint Address,
+    GuestAbiContract Contract,
+    bool IsPrecise);
+
+/// <summary>
+/// One process-local view of the runtime's native registrations and their guest
+/// ABI contracts. C++ remains the only source of truth: the translator builds
+/// this index once, shares it across all consumers, and writes nothing to disk.
+/// </summary>
+public sealed record RuntimeNativeIndex(
+    RuntimeNativeRegistration[] Registrations,
+    RuntimeNativeAbiEntry[] VoidStubAbis,
+    RuntimeNativeEffectEntry[] Effects)
+{
+    public RuntimeNativeGuestEffectSet ToGuestEffectSet()
+    {
+        var contracts = Effects.ToDictionary(static entry => entry.Address, static entry => entry.Contract);
+        var precise = Effects.Where(static entry => entry.IsPrecise)
+            .Select(static entry => entry.Address).ToHashSet();
+        var conservative = Effects.Where(static entry => !entry.IsPrecise)
+            .Select(static entry => entry.Address).ToHashSet();
+        return new RuntimeNativeGuestEffectSet(contracts, precise, conservative);
+    }
+}
+
+public static class RuntimeNativeIndexBuilder
+{
+    public static RuntimeNativeIndex Build(string nativeSourceDirectory)
+    {
+        var sourceRoot = Path.GetFullPath(nativeSourceDirectory);
+        if (!Directory.Exists(sourceRoot))
+            return new RuntimeNativeIndex([], [], []);
+
+        var sources = NativeSourceParsing.ReadDirectory(sourceRoot);
+        var effects = RuntimeNativeGuestEffectAnalyzer.AnalyzeSources(sources);
+        var abis = RuntimeNativeFunctionAbiProvider.AnalyzeVoidStubAbis(sources);
+        return new RuntimeNativeIndex(
+            ScanRegistrations(sources).ToArray(),
+            abis.OrderBy(static item => item.Key)
+                .Select(static item => new RuntimeNativeAbiEntry(
+                    item.Key,
+                    item.Value.ArgumentRegisters.Order(StringComparer.OrdinalIgnoreCase).ToArray(),
+                    item.Value.ScalarFloatArgumentRegisters.Order(StringComparer.OrdinalIgnoreCase).ToArray()))
+                .ToArray(),
+            effects.Contracts.OrderBy(static item => item.Key)
+                .Select(item => new RuntimeNativeEffectEntry(
+                    item.Key, item.Value, effects.PreciseContracts.Contains(item.Key)))
+                .ToArray());
+    }
+
+    private static IEnumerable<RuntimeNativeRegistration> ScanRegistrations(
+        IReadOnlyList<NativeSourceFile> sources)
+    {
+        var registrations = new List<RuntimeNativeRegistration>();
+        foreach (var sourceFile in sources)
+        {
+            var source = sourceFile.Content;
+            foreach (Match match in GeneratedMarkers.NativeFunctionRegistrationPattern().Matches(source))
+                Add(match, match.Groups["symbol"].Value, false, !match.Groups["as"].Success);
+            foreach (Match match in GeneratedMarkers.TranslatedFunctionRegistrationPattern().Matches(source))
+                Add(match, match.Groups["symbol"].Value, true, true);
+            foreach (Match match in GeneratedMarkers.NativeOverridePattern().Matches(source))
+                Add(match, match.Groups["symbol"].Value, false, true);
+            foreach (Match match in GeneratedMarkers.FatalStubPattern().Matches(source))
+                Add(match, $"GX_FATAL_STUB_{match.Groups["address"].Value}", false, true);
+
+            void Add(Match match, string symbol, bool translated, bool excludesBase) =>
+                registrations.Add(new RuntimeNativeRegistration(
+                    ParseAddress(match.Groups["address"].Value), symbol, sourceFile.RelativePath,
+                    translated, excludesBase));
+        }
+
+        return registrations
+            .Distinct()
+            .OrderBy(static registration => registration.Address)
+            .ThenBy(static registration => registration.Symbol, StringComparer.Ordinal)
+            .ThenBy(static registration => registration.SourceFile, StringComparer.Ordinal);
+    }
+
+    private static uint ParseAddress(string value) => GuestTargetParser.ParseHexAddress(value);
+}
diff --git a/translator/src/Translator.Core/Translation/CanonicalIrStore.cs b/translator/src/Translator.Core/Translation/CanonicalIrStore.cs
new file mode 100644
index 0000000..e47ec2e
--- /dev/null
+++ b/translator/src/Translator.Core/Translation/CanonicalIrStore.cs
@@ -0,0 +1,276 @@
+using System.Text;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Translation;
+
+public interface ICanonicalIrProvider
+{
+    bool TryGet(uint entryPoint, out IrFunction function);
+}
+
+/// <summary>
+/// Bounded, deterministic canonical SSA ownership for a translation wave. Each
+/// graph is immediately encoded to numeric opcodes and interned string IDs, so
+/// the discovery object graph can be collected without repeating front-end work.
+/// </summary>
+public sealed class CanonicalIrStore : ICanonicalIrProvider
+{
+    public const int FormatVersion = 1;
+    private readonly object _gate = new();
+    private readonly Dictionary<uint, byte[]> _entries = new();
+
+    public int Count { get { lock (_gate) return _entries.Count; } }
+
+    public void Put(uint entryPoint, IrFunction ssaFunction)
+    {
+        var encoded = CanonicalIrBinaryCodec.Encode(ssaFunction);
+        lock (_gate)
+        {
+            _entries[entryPoint] = encoded;
+        }
+    }
+
+    public bool TryGet(uint entryPoint, out IrFunction function)
+    {
+        byte[]? encoded;
+        lock (_gate) _entries.TryGetValue(entryPoint, out encoded);
+        if (encoded is null)
+        {
+            function = null!;
+            return false;
+        }
+        function = CanonicalIrBinaryCodec.Decode(encoded);
+        return true;
+    }
+}
+
+internal static class CanonicalIrBinaryCodec
+{
+    private static readonly byte[] Magic = "MKWSSA01"u8.ToArray();
+
+    private enum Op : byte
+    {
+        Assign, Binary,
+        Load, Store, Call, IndirectCall, SetCrField, Phi, Branch, Jump,
+        IndirectJump, JumpTable, Return, Comment, TracePpc, Undefined
+    }
+
+    public static byte[] Encode(IrFunction function)
+    {
+        var strings = BuildStringTable(function);
+        var ids = strings.Select((value, index) => (value, index))
+            .ToDictionary(static pair => pair.value, static pair => pair.index, StringComparer.Ordinal);
+        using var stream = new MemoryStream();
+        using var writer = new BinaryWriter(stream, Encoding.UTF8, leaveOpen: true);
+        writer.Write(Magic);
+        WriteVarUInt(writer, (uint)CanonicalIrStore.FormatVersion);
+        WriteVarUInt(writer, checked((uint)strings.Count));
+        foreach (var value in strings)
+        {
+            var bytes = Encoding.UTF8.GetBytes(value);
+            WriteVarUInt(writer, checked((uint)bytes.Length));
+            writer.Write(bytes);
+        }
+        WriteId(writer, ids, function.Name);
+        WriteId(writer, ids, function.EntryLabel);
+        WriteVarUInt(writer, checked((uint)function.Blocks.Count));
+        foreach (var block in function.Blocks)
+        {
+            WriteId(writer, ids, block.Label);
+            WriteVarUInt(writer, checked((uint)block.Instructions.Count));
+            foreach (var instruction in block.Instructions)
+                WriteInstruction(writer, ids, instruction);
+        }
+        writer.Flush();
+        return stream.ToArray();
+    }
+
+    public static IrFunction Decode(ReadOnlySpan<byte> encoded)
+    {
+        using var stream = new MemoryStream(encoded.ToArray(), writable: false);
+        using var reader = new BinaryReader(stream, Encoding.UTF8, leaveOpen: true);
+        if (!reader.ReadBytes(Magic.Length).SequenceEqual(Magic) ||
+            ReadVarUInt(reader) != CanonicalIrStore.FormatVersion)
+            throw new InvalidDataException("Unsupported canonical SSA function payload.");
+        var stringCount = CheckedCount(ReadVarUInt(reader));
+        var strings = new string[stringCount];
+        for (var i = 0; i < strings.Length; i++)
+        {
+            var length = CheckedCount(ReadVarUInt(reader));
+            var bytes = reader.ReadBytes(length);
+            if (bytes.Length != length) throw new EndOfStreamException();
+            strings[i] = Encoding.UTF8.GetString(bytes);
+        }
+        string Id() => strings[CheckedIndex(ReadVarUInt(reader), strings.Length)];
+        var name = Id();
+        var entry = Id();
+        var blocks = new IrBasicBlock[CheckedCount(ReadVarUInt(reader))];
+        for (var blockIndex = 0; blockIndex < blocks.Length; blockIndex++)
+        {
+            var label = Id();
+            var instructions = new IrInstruction[CheckedCount(ReadVarUInt(reader))];
+            for (var instructionIndex = 0; instructionIndex < instructions.Length; instructionIndex++)
+                instructions[instructionIndex] = ReadInstruction(reader, strings);
+            blocks[blockIndex] = new IrBasicBlock(label, instructions);
+        }
+        if (stream.Position != stream.Length)
+            throw new InvalidDataException("Canonical SSA function payload has trailing data.");
+        return new IrFunction(name, entry, blocks);
+    }
+
+    private static List<string> BuildStringTable(IrFunction function)
+    {
+        var result = new List<string>();
+        var seen = new HashSet<string>(StringComparer.Ordinal);
+        void Add(string? value) { if (value is not null && seen.Add(value)) result.Add(value); }
+        void Value(IrValue value) { Add(value.RegisterName); if (value.Kind is not ("register" or "const")) Add(value.Kind); }
+        Add(function.Name); Add(function.EntryLabel);
+        foreach (var block in function.Blocks)
+        {
+            Add(block.Label);
+            foreach (var instruction in block.Instructions)
+            {
+                switch (instruction)
+                {
+                    case IrAssign x: Add(x.Destination); Value(x.Value); break;
+                    case IrBinary x: Add(x.Destination); Value(x.Left); Value(x.Right); Add(x.Op); break;
+                    case IrLoad x: Add(x.Destination); Add(x.Address.Base); break;
+                    case IrStore x: Add(x.Address.Base); Value(x.Source); break;
+                    case IrCall x: Add(x.Destination); Add(x.Target); foreach (var v in x.Arguments) Value(v); break;
+                    case IrIndirectCall x: Add(x.Destination); Value(x.Target); foreach (var v in x.Arguments) Value(v); break;
+                    case IrSetCrField x: Value(x.Left); Value(x.Right); break;
+                    case IrPhi x: Add(x.Destination); foreach (var pair in x.Sources.OrderBy(static p => p.Key, StringComparer.Ordinal)) { Add(pair.Key); Add(pair.Value); } break;
+                    case IrBranch x: Add(x.Condition); Add(x.TrueLabel); Add(x.FalseLabel); Add(x.ConditionRegister); break;
+                    case IrJump x: Add(x.TargetLabel); break;
+                    case IrIndirectJump x: Value(x.Target); break;
+                    case IrJumpTable x: Add(x.Selector); foreach (var item in x.Cases) Add(item.TargetLabel); break;
+                    case IrReturn x: if (x.Value is not null) Value(x.Value); break;
+                    case IrComment x: Add(x.Text); break;
+                    case IrTracePpc x: Add(x.Disassembly); Add(x.RawHex); break;
+                    case IrUndefined x: Add(x.Disassembly); Add(x.Reason); break;
+                    default: throw new InvalidDataException($"Instruction {instruction.GetType().Name} is not valid in canonical front-end SSA.");
+                }
+            }
+        }
+        return result;
+    }
+
+    private static void WriteInstruction(BinaryWriter writer, IReadOnlyDictionary<string, int> ids, IrInstruction instruction)
+    {
+        void Id(string value) => WriteId(writer, ids, value);
+        void Value(IrValue value) => WriteValue(writer, ids, value);
+        void Values(IReadOnlyList<IrValue> values) { WriteVarUInt(writer, checked((uint)values.Count)); foreach (var value in values) Value(value); }
+        switch (instruction)
+        {
+            case IrAssign x: writer.Write((byte)Op.Assign); Id(x.Destination); Value(x.Value); break;
+            case IrBinary x: writer.Write((byte)Op.Binary); Id(x.Destination); Value(x.Left); Value(x.Right); Id(x.Op); break;
+            case IrLoad x: writer.Write((byte)Op.Load); Id(x.Destination); WriteAddress(writer, ids, x.Address); WriteVarInt(writer, x.SizeBytes); break;
+            case IrStore x: writer.Write((byte)Op.Store); WriteAddress(writer, ids, x.Address); Value(x.Source); WriteVarInt(writer, x.SizeBytes); break;
+            case IrCall x: writer.Write((byte)Op.Call); Id(x.Destination); Id(x.Target); Values(x.Arguments); break;
+            case IrIndirectCall x: writer.Write((byte)Op.IndirectCall); Id(x.Destination); Value(x.Target); Values(x.Arguments); break;
+            case IrSetCrField x: writer.Write((byte)Op.SetCrField); WriteVarInt(writer, x.FieldIndex); Value(x.Left); Value(x.Right); writer.Write(x.IsUnsigned); break;
+            case IrPhi x:
+                writer.Write((byte)Op.Phi); Id(x.Destination);
+                var sources = x.Sources.OrderBy(static pair => pair.Key, StringComparer.Ordinal).ToArray();
+                WriteVarUInt(writer, checked((uint)sources.Length));
+                foreach (var pair in sources) { Id(pair.Key); Id(pair.Value); }
+                break;
+            case IrBranch x: writer.Write((byte)Op.Branch); Id(x.Condition); Id(x.TrueLabel); Id(x.FalseLabel); Id(x.ConditionRegister); break;
+            case IrJump x: writer.Write((byte)Op.Jump); Id(x.TargetLabel); break;
+            case IrIndirectJump x: writer.Write((byte)Op.IndirectJump); Value(x.Target); break;
+            case IrJumpTable x:
+                writer.Write((byte)Op.JumpTable); Id(x.Selector); WriteVarUInt(writer, checked((uint)x.Cases.Count));
+                foreach (var item in x.Cases) { writer.Write(item.TargetAddress); Id(item.TargetLabel); }
+                break;
+            case IrReturn x: writer.Write((byte)Op.Return); writer.Write(x.Value is not null); if (x.Value is not null) Value(x.Value); break;
+            case IrComment x: writer.Write((byte)Op.Comment); Id(x.Text); break;
+            case IrTracePpc x: writer.Write((byte)Op.TracePpc); writer.Write(x.Address); Id(x.Disassembly); Id(x.RawHex); break;
+            case IrUndefined x: writer.Write((byte)Op.Undefined); writer.Write(x.Address); writer.Write(x.RawInstruction); Id(x.Disassembly); writer.Write(x.Reason is not null); if (x.Reason is not null) Id(x.Reason); break;
+            default: throw new InvalidDataException($"Instruction {instruction.GetType().Name} is not valid in canonical front-end SSA.");
+        }
+    }
+
+    private static IrInstruction ReadInstruction(BinaryReader reader, IReadOnlyList<string> strings)
+    {
+        string Id() => strings[CheckedIndex(ReadVarUInt(reader), strings.Count)];
+        IrValue Value() => ReadValue(reader, strings);
+        IrValue[] Values() { var values = new IrValue[CheckedCount(ReadVarUInt(reader))]; for (var i = 0; i < values.Length; i++) values[i] = Value(); return values; }
+        return (Op)reader.ReadByte() switch
+        {
+            Op.Assign => new IrAssign(Id(), Value()),
+            Op.Binary => new IrBinary(Id(), Value(), Value(), Id()),
+            Op.Load => new IrLoad(Id(), ReadAddress(reader, strings), ReadVarInt(reader)),
+            Op.Store => new IrStore(ReadAddress(reader, strings), Value(), ReadVarInt(reader)),
+            Op.Call => new IrCall(Id(), Id(), Values()),
+            Op.IndirectCall => new IrIndirectCall(Id(), Value(), Values()),
+            Op.SetCrField => new IrSetCrField(ReadVarInt(reader), Value(), Value(), reader.ReadBoolean()),
+            Op.Phi => ReadPhi(reader, strings),
+            Op.Branch => new IrBranch(Id(), Id(), Id(), Id()),
+            Op.Jump => new IrJump(Id()),
+            Op.IndirectJump => new IrIndirectJump(Value()),
+            Op.JumpTable => ReadJumpTable(reader, strings),
+            Op.Return => new IrReturn(reader.ReadBoolean() ? Value() : null),
+            Op.Comment => new IrComment(Id()),
+            Op.TracePpc => new IrTracePpc(reader.ReadUInt32(), Id(), Id()),
+            Op.Undefined => ReadUndefined(reader, strings),
+            var op => throw new InvalidDataException($"Unknown canonical SSA opcode {(byte)op}.")
+        };
+    }
+
+    private static IrPhi ReadPhi(BinaryReader reader, IReadOnlyList<string> strings)
+    {
+        string Id() => strings[CheckedIndex(ReadVarUInt(reader), strings.Count)];
+        var destination = Id();
+        var count = CheckedCount(ReadVarUInt(reader));
+        var sources = new Dictionary<string, string>(count, StringComparer.Ordinal);
+        for (var i = 0; i < count; i++) sources.Add(Id(), Id());
+        return new IrPhi(destination, sources);
+    }
+
+    private static IrJumpTable ReadJumpTable(BinaryReader reader, IReadOnlyList<string> strings)
+    {
+        string Id() => strings[CheckedIndex(ReadVarUInt(reader), strings.Count)];
+        var selector = Id();
+        var cases = new IrJumpTableCase[CheckedCount(ReadVarUInt(reader))];
+        for (var i = 0; i < cases.Length; i++) cases[i] = new IrJumpTableCase(reader.ReadUInt32(), Id());
+        return new IrJumpTable(selector, cases);
+    }
+
+    private static IrUndefined ReadUndefined(BinaryReader reader, IReadOnlyList<string> strings)
+    {
+        string Id() => strings[CheckedIndex(ReadVarUInt(reader), strings.Count)];
+        var address = reader.ReadUInt32();
+        var raw = reader.ReadUInt32();
+        var disassembly = Id();
+        return new IrUndefined(address, raw, disassembly, reader.ReadBoolean() ? Id() : null);
+    }
+
+    private static void WriteValue(BinaryWriter writer, IReadOnlyDictionary<string, int> ids, IrValue value)
+    {
+        if (value.Kind == "register") { writer.Write((byte)0); WriteId(writer, ids, value.RegisterName!); }
+        else if (value.Kind == "const") { writer.Write((byte)1); writer.Write(value.Constant!.Value); }
+        else { writer.Write((byte)2); WriteId(writer, ids, value.Kind); writer.Write(value.RegisterName is not null); if (value.RegisterName is not null) WriteId(writer, ids, value.RegisterName); writer.Write(value.Constant.HasValue); if (value.Constant.HasValue) writer.Write(value.Constant.Value); }
+    }
+
+    private static IrValue ReadValue(BinaryReader reader, IReadOnlyList<string> strings)
+    {
+        string Id() => strings[CheckedIndex(ReadVarUInt(reader), strings.Count)];
+        return reader.ReadByte() switch
+        {
+            0 => IrValue.Register(Id()),
+            1 => IrValue.Imm(reader.ReadInt64()),
+            2 => new IrValue(Id(), reader.ReadBoolean() ? Id() : null, reader.ReadBoolean() ? reader.ReadInt64() : null),
+            var kind => throw new InvalidDataException($"Unknown canonical SSA value kind {kind}.")
+        };
+    }
+
+    private static void WriteAddress(BinaryWriter writer, IReadOnlyDictionary<string, int> ids, IrAddress address) { WriteId(writer, ids, address.Base); WriteVarInt(writer, address.Offset); }
+    private static IrAddress ReadAddress(BinaryReader reader, IReadOnlyList<string> strings) => new(strings[CheckedIndex(ReadVarUInt(reader), strings.Count)], ReadVarInt(reader));
+    private static void WriteId(BinaryWriter writer, IReadOnlyDictionary<string, int> ids, string value) => WriteVarUInt(writer, checked((uint)ids[value]));
+    private static int CheckedCount(uint value) => value <= 16_000_000 ? checked((int)value) : throw new InvalidDataException("Canonical SSA count is unreasonable.");
+    private static int CheckedIndex(uint value, int count) => value < count ? checked((int)value) : throw new InvalidDataException("Canonical SSA string ID is out of range.");
+    private static void WriteVarInt(BinaryWriter writer, int value) => WriteVarUInt(writer, unchecked((uint)((value << 1) ^ (value >> 31))));
+    private static int ReadVarInt(BinaryReader reader) { var value = ReadVarUInt(reader); return unchecked((int)((value >> 1) ^ (uint)-(int)(value & 1))); }
+    private static void WriteVarUInt(BinaryWriter writer, uint value) { while (value >= 0x80) { writer.Write((byte)(value | 0x80)); value >>= 7; } writer.Write((byte)value); }
+    private static uint ReadVarUInt(BinaryReader reader) { uint value = 0; for (var shift = 0; shift <= 28; shift += 7) { var next = reader.ReadByte(); value |= (uint)(next & 0x7F) << shift; if ((next & 0x80) == 0) return value; } throw new InvalidDataException("Canonical SSA varint is too long."); }
+}
diff --git a/translator/src/Translator.Core/Translation/FunctionTranslator.cs b/translator/src/Translator.Core/Translation/FunctionTranslator.cs
new file mode 100644
index 0000000..34bb2aa
--- /dev/null
+++ b/translator/src/Translator.Core/Translation/FunctionTranslator.cs
@@ -0,0 +1,968 @@
+using System;
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using Translator.Core.Analysis.BasicBlocks;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis;
+using Translator.Core.CodeGen;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+using Translator.Core.Lifting;
+using Translator.Core.Loading;
+using Translator.Core.Representation;
+using Translator.Core;
+
+namespace Translator.Core.Translation;
+
+/// <summary>
+/// Options that control how a single function is translated.
+/// </summary>
+public sealed record TranslationOptions(
+    string? PreferredName = null,
+    int MaxInstructions = 8192,
+    int MaxBytes = 0x10000,
+    bool AllowUnsupportedInstructions = false,
+    bool EmitModRegistration = false,
+    uint ModRegistrationPriority = 100,
+    ulong ModRegistrationModuleId = 1,
+    IReadOnlySet<uint>? NonReturningCallTargets = null,
+    IReadOnlySet<uint>? LrContinuationCallTargets = null,
+    IReadOnlyDictionary<uint, uint>? LinkedCallFallthroughLrOverrides = null,
+    IReadOnlySet<uint>? KnownFunctionEntryPoints = null,
+    IReadOnlyDictionary<uint, GuestAbiContract>? GuestAbiContracts = null,
+    bool EmitStateFreeLeafVariant = false,
+    IReadOnlyDictionary<uint, GuestAbiContract>? StateFreeAbiContracts = null,
+    IReadOnlyDictionary<uint, string>? StateFreeCallSymbols = null,
+    IReadOnlyDictionary<GuestStateFreeCallSiteKey, GuestStateFreeCallVariant>? StateFreeCallSiteVariants = null,
+    IReadOnlyList<GuestStateFreeCallVariant>? StateFreeEntryVariants = null,
+    uint? ModuleLinkBase = null,
+    uint? ModuleGuestBase = null,
+    uint ModuleLinkedCodeSize = 0,
+    IReadOnlyDictionary<string, uint>? GqrEntryConstants = null,
+    IReadOnlyDictionary<uint, byte>? GqrCalleeWriteMasks = null,
+    bool GqrConstantsRequireRuntimeGuard = false,
+    bool EnableLeafAbiSpillElision = false,
+    IReadOnlySet<uint>? ModOverridableCallTargets = null,
+    bool GenerateCxx = true,
+    bool DiscoveryOnly = false,
+    /// <summary>
+    /// Splices tiny, call-free leaf callees into their direct callers at the IR level; the callee
+    /// is still translated separately, only the caller's call edge disappears. Always on: the
+    /// inliner clears it on callee-decode options to stop a splice from recursing into another.
+    /// </summary>
+    bool EnableLeafInlining = true,
+    /// <summary>
+    /// Addresses whose translated body is not the runtime winner - native
+    /// registrations, base-translation exclusions and mod patch sites. These are
+    /// never inlined, because the splice would bypass the replacement.
+    /// </summary>
+    IReadOnlySet<uint>? LeafInliningBlockedTargets = null,
+    int LeafInliningMaxCalleeInstructions = 56,
+    int LeafInliningMaxCallerGrowthPercent = 50,
+    /// <summary>
+    /// Admit a callee whose blocks are not a straight line, provided its CFG is
+    /// acyclic and every exit is a plain return. Emergency opt-out; the
+    /// straight-line shape keeps working with this off.
+    /// </summary>
+    bool LeafInliningAllowMultiBlockCallees = true)
+{
+    public static TranslationOptions Default { get; } = new();
+}
+
+/// <summary>
+/// Lightweight profiling and quality metrics captured during translation.
+/// </summary>
+public sealed class TranslationMetrics
+{
+    public TimeSpan Total { get; internal set; }
+    public TimeSpan Disassembly { get; internal set; }
+    public TimeSpan BasicBlocks { get; internal set; }
+    public TimeSpan Lifting { get; internal set; }
+    public TimeSpan Ssa { get; internal set; }
+    public TimeSpan RepresentationClassification { get; internal set; }
+    public TimeSpan CodeGen { get; internal set; }
+
+    public int PpcInstructionCount { get; internal set; }
+    public int BasicBlockCount { get; internal set; }
+    public int IrInstructionCount { get; internal set; }
+    public int IrBlockCount { get; internal set; }
+    public int UnsupportedInstructionCount { get; internal set; }
+
+    /// <summary>Direct call sites replaced by a spliced leaf body.</summary>
+    public int InlinedCallSites { get; internal set; }
+
+    /// <summary>Guest instructions contributed by those spliced bodies.</summary>
+    public int InlinedGuestInstructions { get; internal set; }
+}
+
+/// <summary>
+/// Full set of artifacts emitted by a translation of a single function.
+/// </summary>
+public sealed record FunctionTranslationResult(
+    uint EntryPoint,
+    string Name,
+    IReadOnlyList<PpcInstruction> Instructions,
+    IReadOnlyList<BasicBlock> Blocks,
+    IrFunction LinearIr,
+    SsaResult Ssa,
+    RepresentationEnvironment Representations,
+    FunctionAbiClassification AbiClassification,
+    string CxxCode,
+    TranslationMetrics Metrics,
+    /// <summary>
+    /// Facts the emitter derived while producing <see cref="CxxCode"/>. Null when
+    /// C++ generation was skipped. Consumers must read emission facts from here
+    /// rather than re-parsing <see cref="CxxCode"/>.
+    /// </summary>
+    CxxEmissionResult? Emission = null);
+
+/// <summary>
+/// Front-end artifacts needed while recursively discovering a program. This
+/// deliberately excludes representation and return-ABI classification, ABI contracts, and C++ output.
+/// </summary>
+public sealed record FunctionDiscoveryResult(
+    uint EntryPoint,
+    string Name,
+    IReadOnlyList<PpcInstruction> Instructions,
+    IReadOnlyList<BasicBlock> Blocks,
+    IrFunction LinearIr,
+    SsaResult Ssa,
+    TranslationMetrics Metrics);
+
+/// <summary>
+/// End-to-end pipeline that takes a RAM image and produces classified C++ for a
+/// single PowerPC function while recording per-stage metrics.
+/// </summary>
+public sealed class FunctionTranslator
+{
+    private readonly ProgramImage _image;
+    private readonly IGuestFunctionAbiProvider _guestAbiProvider;
+
+    /// <summary>
+    /// Program-wide memo of speculative leaf-inline decodes, keyed by front-end context, so a
+    /// callee (a pure function of image/boundary answers/policy) is never redecoded per caller.
+    /// </summary>
+    private readonly ConcurrentDictionary<LeafInlineMemoContext, ConcurrentDictionary<uint, LeafInlineMemoEntry>>
+        _leafInlineMemo = new();
+
+    public FunctionTranslator(
+        ProgramImage image,
+        IGuestFunctionAbiProvider? guestAbiProvider = null)
+    {
+        _image = image;
+        _guestAbiProvider = guestAbiProvider ?? new InferredGuestFunctionAbiProvider(_image);
+    }
+
+    /// <summary>
+    /// Everything besides the callee address that a speculative decode depends on. Compared by
+    /// identity since contents mutate during a run; content drift is handled by the probe log instead.
+    /// </summary>
+    private sealed record LeafInlineMemoContext(
+        IReadOnlySet<uint>? KnownFunctionEntryPoints,
+        IReadOnlySet<uint>? BlockedTargets,
+        int MaxCalleeGuestInstructions,
+        int MaxCalleeBlocks,
+        bool AllowAcyclicMultiBlockCallees,
+        int MaxCalleeAcyclicBlocks,
+        int MaxInstructions,
+        int MaxBytes,
+        bool AllowUnsupportedInstructions);
+
+    /// <summary>
+    /// A memoized decision plus the boundary questions it was derived from.
+    /// Replaying the decode is equivalent to reusing this entry exactly while
+    /// every one of those questions still has the same answer.
+    /// </summary>
+    private sealed record LeafInlineMemoEntry(LeafInlineCandidate? Candidate, BoundaryProbeLog Probes);
+
+    public FunctionTranslationResult Translate(uint entryPoint, TranslationOptions? options = null)
+    {
+        options ??= TranslationOptions.Default;
+        var metrics = new TranslationMetrics();
+        var total = Stopwatch.StartNew();
+
+        // Disassemble
+        using var disassembler = new PpcDisassembler();
+        // The full pipeline never tolerates a budget overrun, so the result is
+        // non-null here.
+        var irFunction = BuildLinearIr(
+            disassembler, entryPoint, options, metrics, out var instructions, out var basicBlocks)!;
+        irFunction = ApplyLeafInlining(disassembler, entryPoint, irFunction, options, metrics);
+        metrics.IrInstructionCount = irFunction.Blocks.Sum(static b => b.Instructions.Count);
+        metrics.IrBlockCount = irFunction.Blocks.Count;
+
+        // SSA + validation.
+        var ssaSw = Stopwatch.StartNew();
+        SsaResult ssa;
+        try
+        {
+            ssa = new SsaTransformer().Convert(irFunction);
+            ssa.ValidateUseDef();
+        }
+        finally
+        {
+            ssaSw.Stop();
+        }
+        metrics.Ssa = ssaSw.Elapsed;
+
+        var functionName = irFunction.Name;
+        return FinishTranslation(
+            entryPoint, functionName, instructions, basicBlocks, irFunction, ssa, options, metrics, total);
+    }
+
+    /// <summary>Front-end stages (decode, blocks, lifting, linear IR), reused so a leaf-inlining
+    /// candidate goes through the exact same pipeline as the caller.</summary>
+    /// <param name="boundaryProbes">Records every "not a boundary" answer so the result can later be
+    /// proven still current.</param>
+    /// <param name="toleratesBudgetOverrun">Speculative decoding treats an oversized body as null
+    /// instead of throwing.</param>
+    private IrFunction? BuildLinearIr(
+        PpcDisassembler disassembler,
+        uint entryPoint,
+        TranslationOptions options,
+        TranslationMetrics? metrics,
+        out IReadOnlyList<PpcInstruction> instructions,
+        out IReadOnlyList<BasicBlock> basicBlocks,
+        BoundaryProbeLog? boundaryProbes = null,
+        bool toleratesBudgetOverrun = false)
+    {
+        var disSw = Stopwatch.StartNew();
+        if (toleratesBudgetOverrun)
+        {
+            var decoded = disassembler.TryDisassembleFunction(
+                _image,
+                entryPoint,
+                options.MaxInstructions,
+                options.MaxBytes,
+                options.KnownFunctionEntryPoints,
+                boundaryProbes);
+            if (decoded is null)
+            {
+                instructions = Array.Empty<PpcInstruction>();
+                basicBlocks = Array.Empty<BasicBlock>();
+                return null;
+            }
+
+            instructions = decoded;
+        }
+        else
+        {
+            instructions = disassembler.DisassembleFunction(
+                _image,
+                entryPoint,
+                options.MaxInstructions,
+                options.MaxBytes,
+                options.KnownFunctionEntryPoints,
+                boundaryProbes);
+        }
+        disSw.Stop();
+        if (metrics is not null)
+        {
+            metrics.Disassembly = disSw.Elapsed;
+            metrics.PpcInstructionCount = instructions.Count;
+        }
+
+        // Build CFG-ready basic blocks.
+        var bbSw = Stopwatch.StartNew();
+        basicBlocks = BasicBlockBuilder.Build(instructions, new[] { entryPoint });
+        bbSw.Stop();
+        if (metrics is not null)
+        {
+            metrics.BasicBlocks = bbSw.Elapsed;
+            metrics.BasicBlockCount = basicBlocks.Count;
+        }
+
+        // Lift to linear IR.
+        var lifter = new PpcLifter();
+        var liftSw = Stopwatch.StartNew();
+        var lifted = lifter.Lift(
+            instructions,
+            options.AllowUnsupportedInstructions,
+            entryPoint,
+            options.KnownFunctionEntryPoints);
+        if (metrics is not null)
+        {
+            var unsupported = 0;
+            foreach (var instruction in lifted)
+            {
+                foreach (var ir in instruction.Ir)
+                {
+                    if (ir is IrUndefined)
+                    {
+                        unsupported++;
+                    }
+                }
+            }
+
+            metrics.UnsupportedInstructionCount = unsupported;
+        }
+        liftSw.Stop();
+        if (metrics is not null)
+        {
+            metrics.Lifting = liftSw.Elapsed;
+        }
+
+        var liftedByAddress = new Dictionary<uint, IReadOnlyList<IrInstruction>>(lifted.Count);
+        foreach (var entry in lifted)
+        {
+            liftedByAddress[entry.Origin.Address] = entry.Ir;
+        }
+
+        var decodedAddresses = new HashSet<uint>(instructions.Count);
+        foreach (var instruction in instructions)
+        {
+            decodedAddresses.Add(instruction.Address);
+        }
+
+        var irBlocks = new List<IrBasicBlock>(basicBlocks.Count);
+        foreach (var block in basicBlocks)
+        {
+            var ir = new List<IrInstruction>();
+            foreach (var ins in block.Instructions)
+            {
+                if (!liftedByAddress.TryGetValue(ins.Address, out var lowered))
+                {
+                    throw new InvalidOperationException($"Failed to lift instruction at 0x{ins.Address:X8}");
+                }
+
+                AppendLoweredWithTrace(ir, lowered, CreateTrace(ins));
+            }
+
+            var last = block.Instructions[^1];
+            if (!last.IsReturn &&
+                !last.IsConditionalBranch &&
+                !last.IsUnconditionalBranch &&
+                !decodedAddresses.Contains(last.EndAddress))
+            {
+                var fallthroughAddress = last.EndAddress;
+                var fallthroughIsBoundary = options.KnownFunctionEntryPoints?.Contains(fallthroughAddress) == true;
+                if (fallthroughIsBoundary)
+                {
+                    ir.Add(new IrJump(LabelFor(fallthroughAddress)));
+                }
+                else
+                {
+                    boundaryProbes?.RecordAbsent(fallthroughAddress);
+                }
+            }
+
+            var label = LabelFor(block.StartAddress);
+            irBlocks.Add(new IrBasicBlock(label, ir));
+        }
+
+        // Ensure every referenced label has a basic block so SSA construction cannot fail on missing targets.
+        var existingLabels = new HashSet<string>();
+        foreach (var block in irBlocks)
+        {
+            existingLabels.Add(block.Label);
+        }
+
+        // Branch labels first, then jump labels - the order synthetic blocks get
+        // appended in depends on it. Collected in one traversal, and the
+        // return-block question is answered by the same pass because no
+        // synthetic block below ever contributes an IrBranch.
+        var branchLabels = new List<string>();
+        var jumpLabels = new List<string>();
+        var needsReturnBlock = false;
+        foreach (var block in irBlocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                switch (instruction)
+                {
+                    case IrBranch branch:
+                        if (!string.IsNullOrWhiteSpace(branch.TrueLabel))
+                        {
+                            branchLabels.Add(branch.TrueLabel);
+                        }
+
+                        if (!string.IsNullOrWhiteSpace(branch.FalseLabel))
+                        {
+                            branchLabels.Add(branch.FalseLabel);
+                        }
+
+                        if (string.Equals(branch.TrueLabel, "return", StringComparison.OrdinalIgnoreCase) ||
+                            string.Equals(branch.FalseLabel, "return", StringComparison.OrdinalIgnoreCase))
+                        {
+                            needsReturnBlock = true;
+                        }
+
+                        break;
+                    case IrJump jump:
+                        if (!string.IsNullOrWhiteSpace(jump.TargetLabel))
+                        {
+                            jumpLabels.Add(jump.TargetLabel);
+                        }
+
+                        break;
+                }
+            }
+        }
+
+        var referencedLabels = new List<string>(branchLabels.Count + jumpLabels.Count);
+        referencedLabels.AddRange(branchLabels);
+        referencedLabels.AddRange(jumpLabels);
+
+        foreach (var label in referencedLabels)
+        {
+            if (!existingLabels.Contains(label))
+            {
+                if (string.Equals(label, "return", StringComparison.OrdinalIgnoreCase))
+                {
+                    // Defer creation of the return block so the dedicated return-creation logic below can
+                    // insert a proper block that emits an IrReturn instruction with the ABI return register.
+                    continue;
+                }
+
+                if (TryBuildSyntheticBlock(label, out var synth))
+                {
+                    irBlocks.Add(synth);
+                    existingLabels.Add(label);
+                    continue;
+                }
+
+                var missing = new IrBasicBlock(label, new IrInstruction[] { new IrComment("synthetic missing target") });
+                irBlocks.Add(missing);
+                existingLabels.Add(label);
+            }
+        }
+
+        // Some branch forms (e.g., beqlr) target the link register; model these as jumps
+        // to a synthetic return block if referenced.
+        if (needsReturnBlock)
+        {
+            var hasReturnBlock = false;
+            foreach (var block in irBlocks)
+            {
+                if (string.Equals(block.Label, "return", StringComparison.OrdinalIgnoreCase))
+                {
+                    hasReturnBlock = true;
+                    break;
+                }
+            }
+
+            if (!hasReturnBlock)
+            {
+                irBlocks.Add(new IrBasicBlock("return", new IrInstruction[] { new IrReturn(null) }));
+            }
+        }
+        if (options.LinkedCallFallthroughLrOverrides is { Count: > 0 })
+        {
+            irBlocks = ApplyLinkedCallFallthroughLrOverrides(irBlocks, options.LinkedCallFallthroughLrOverrides);
+        }
+
+        var functionName = options.PreferredName ?? $"func_{entryPoint:X8}";
+        var entryLabel = LabelFor(entryPoint);
+        var hasEntryBlock = false;
+        foreach (var block in irBlocks)
+        {
+            if (string.Equals(block.Label, entryLabel, StringComparison.OrdinalIgnoreCase))
+            {
+                hasEntryBlock = true;
+                break;
+            }
+        }
+
+        if (!hasEntryBlock)
+        {
+            entryLabel = irBlocks.Count > 0 ? irBlocks[0].Label : "entry";
+        }
+        return new IrFunction(functionName, entryLabel, irBlocks);
+    }
+
+    /// <summary>
+    /// Replaces admitted direct calls with the callee's IR before SSA runs, so
+    /// the spliced guest instructions become ordinary instructions of the
+    /// caller for every later analysis and lowering.
+    /// </summary>
+    private IrFunction ApplyLeafInlining(
+        PpcDisassembler disassembler,
+        uint entryPoint,
+        IrFunction function,
+        TranslationOptions options,
+        TranslationMetrics metrics)
+    {
+        if (!IsLeafInliningEligibleCaller(options))
+        {
+            return function;
+        }
+
+        var policy = new LeafInliningPolicy(
+            MaxCalleeGuestInstructions: Math.Max(1, options.LeafInliningMaxCalleeInstructions),
+            MaxCallerGrowthPercent: Math.Max(0, options.LeafInliningMaxCallerGrowthPercent),
+            BlockedTargets: options.LeafInliningBlockedTargets,
+            AllowAcyclicMultiBlockCallees: options.LeafInliningAllowMultiBlockCallees);
+
+        // Shared across callers: a callee decode is a pure function of (image, boundary answers,
+        // policy). Each entry carries the boundary questions it asked, so it gets recomputed the
+        // moment discovery adds an entry point that would answer one of them differently.
+        var memoContext = new LeafInlineMemoContext(
+            options.KnownFunctionEntryPoints,
+            policy.BlockedTargets,
+            policy.MaxCalleeGuestInstructions,
+            policy.MaxCalleeBlocks,
+            policy.AllowAcyclicMultiBlockCallees,
+            policy.MaxCalleeAcyclicBlocks,
+            options.MaxInstructions,
+            options.MaxBytes,
+            options.AllowUnsupportedInstructions);
+        var candidates = _leafInlineMemo.GetOrAdd(memoContext, static _ => new ConcurrentDictionary<uint, LeafInlineMemoEntry>());
+        var knownEntryPoints = options.KnownFunctionEntryPoints;
+
+        LeafInlineCandidate? Resolve(uint target)
+        {
+            // A self-call is a caller-local fact and must never enter the
+            // shared memo.
+            if (target == entryPoint)
+            {
+                return null;
+            }
+
+            if (candidates.TryGetValue(target, out var cached) && cached.Probes.IsStillValid(knownEntryPoints))
+            {
+                return cached.Candidate;
+            }
+
+            var probes = new BoundaryProbeLog();
+            LeafInlineCandidate? candidate = null;
+            try
+            {
+                // Decoding is capped one instruction past the admissible
+                // size, so an oversized callee is refused by the decoder
+                // instead of being fully lifted.
+                var maximum = policy.MaxCalleeGuestInstructions + 1;
+                var calleeOptions = options with
+                {
+                    PreferredName = null,
+                    MaxInstructions = Math.Min(options.MaxInstructions, maximum),
+                    MaxBytes = Math.Min(options.MaxBytes, maximum * 4),
+                    EnableLeafInlining = false,
+                    LinkedCallFallthroughLrOverrides = null
+                };
+                var calleeIr = BuildLinearIr(
+                    disassembler,
+                    target,
+                    calleeOptions,
+                    null,
+                    out var calleeInstructions,
+                    out _,
+                    probes,
+                    toleratesBudgetOverrun: true);
+                candidate = calleeIr is null
+                    ? null
+                    : LeafFunctionInliner.TryCreateCandidate(
+                        target, calleeIr, calleeInstructions, policy, out _);
+            }
+            catch (Exception ex) when (ex is InvalidOperationException or ArgumentException
+                                          or IndexOutOfRangeException or NotSupportedException
+                                          or OverflowException)
+            {
+                // Speculative decoding is extra work the caller's own translation never depended
+                // on, so a failure here must never abort that translation; treat it as "not a
+                // candidate" and keep the ordinary call. Probes recorded before the failure remain valid.
+                candidate = null;
+            }
+
+            candidates[target] = new LeafInlineMemoEntry(candidate, probes);
+            return candidate;
+        }
+
+        var inlined = LeafFunctionInliner.Inline(function, policy, Resolve);
+        metrics.InlinedCallSites = inlined.InlinedCallSites;
+        metrics.InlinedGuestInstructions = inlined.InlinedGuestInstructions;
+        return inlined.Function;
+    }
+
+    /// <summary>
+    /// Excludes bodies whose call sites carry extra structure (continuation/non-returning dispatch
+    /// labels keyed by guest address, module link-address remapping) that can't survive duplication.
+    /// </summary>
+    private static bool IsLeafInliningEligibleCaller(TranslationOptions options) =>
+        options.EnableLeafInlining &&
+        options.LrContinuationCallTargets is not { Count: > 0 } &&
+        options.NonReturningCallTargets is not { Count: > 0 } &&
+        options.LinkedCallFallthroughLrOverrides is not { Count: > 0 } &&
+        options.ModuleLinkBase is null &&
+        options.ModuleGuestBase is null &&
+        !options.EmitModRegistration;
+
+    private FunctionTranslationResult FinishTranslation(
+        uint entryPoint,
+        string functionName,
+        IReadOnlyList<PpcInstruction> instructions,
+        IReadOnlyList<BasicBlock> basicBlocks,
+        IrFunction irFunction,
+        SsaResult ssa,
+        TranslationOptions options,
+        TranslationMetrics metrics,
+        Stopwatch total)
+    {
+        if (options.DiscoveryOnly)
+        {
+            total.Stop();
+            metrics.Total = total.Elapsed;
+            return new FunctionTranslationResult(
+                entryPoint,
+                functionName,
+                instructions,
+                basicBlocks,
+                irFunction,
+                ssa,
+                new RepresentationEnvironment(),
+                new FunctionAbiClassification(functionName, ValueRepresentation.Void),
+                string.Empty,
+                metrics);
+        }
+
+        // Coarse host representation and return-ABI classification.
+        var classificationSw = Stopwatch.StartNew();
+        var types = new RepresentationClassifier().Classify(ssa.Function);
+        classificationSw.Stop();
+        metrics.RepresentationClassification = classificationSw.Elapsed;
+
+        var signature = new FunctionAbiClassifier().Classify(functionName, ssa.Function, types);
+
+        CxxEmissionResult? emission = null;
+        if (options.GenerateCxx)
+        {
+            var codeGenSw = Stopwatch.StartNew();
+            emission = EmitCxx(entryPoint, ssa, signature, types, options);
+            codeGenSw.Stop();
+            metrics.CodeGen = codeGenSw.Elapsed;
+        }
+
+        total.Stop();
+        metrics.Total = total.Elapsed;
+
+        return new FunctionTranslationResult(
+            entryPoint,
+            functionName,
+            instructions,
+            basicBlocks,
+            irFunction,
+            ssa,
+            types,
+            signature,
+             emission?.Code ?? string.Empty,
+             metrics,
+             emission);
+    }
+
+    /// <summary>
+    /// Runs only the front-end stages required for recursive target discovery
+    /// and compact whole-program summaries.
+    /// </summary>
+    public FunctionDiscoveryResult Discover(uint entryPoint, TranslationOptions? options = null)
+    {
+        options ??= TranslationOptions.Default;
+        var result = Translate(entryPoint, options with { GenerateCxx = false, DiscoveryOnly = true });
+        return new FunctionDiscoveryResult(
+            result.EntryPoint,
+            result.Name,
+            result.Instructions,
+            result.Blocks,
+            result.LinearIr,
+            result.Ssa,
+            result.Metrics);
+    }
+
+    /// <summary>
+    /// Performs only the post-SSA lowering stages. Production discovery stores
+    /// this canonical graph once, so final whole-program facts do not force a
+    /// second disassembly/CFG/lifting/SSA pass.
+    /// </summary>
+    public FunctionTranslationResult LowerCanonical(
+        uint entryPoint,
+        IrFunction canonicalSsa,
+        TranslationOptions options)
+    {
+        var metrics = new TranslationMetrics
+        {
+            IrInstructionCount = canonicalSsa.Blocks.Sum(static block => block.Instructions.Count),
+            IrBlockCount = canonicalSsa.Blocks.Count
+        };
+        var total = Stopwatch.StartNew();
+        var ssa = new SsaResult(canonicalSsa, IrCfg.Build(canonicalSsa));
+        var classificationSw = Stopwatch.StartNew();
+        var types = new RepresentationClassifier().Classify(canonicalSsa);
+        var signature = new FunctionAbiClassifier().Classify(canonicalSsa.Name, canonicalSsa, types);
+        classificationSw.Stop();
+        metrics.RepresentationClassification = classificationSw.Elapsed;
+        var codegen = Stopwatch.StartNew();
+        var emission = options.GenerateCxx
+            ? EmitCxx(entryPoint, ssa, signature, types, options)
+            : null;
+        codegen.Stop();
+        metrics.CodeGen = codegen.Elapsed;
+        total.Stop();
+        metrics.Total = total.Elapsed;
+        return new FunctionTranslationResult(
+            entryPoint,
+            canonicalSsa.Name,
+            Array.Empty<PpcInstruction>(),
+            Array.Empty<BasicBlock>(),
+            canonicalSsa,
+            ssa,
+            types,
+            signature,
+             emission?.Code ?? string.Empty,
+             metrics,
+             emission);
+    }
+
+    private CxxEmissionResult EmitCxx(
+        uint entryPoint,
+        SsaResult ssa,
+        FunctionAbiClassification signature,
+        RepresentationEnvironment types,
+        TranslationOptions options)
+    {
+        return new CxxLinearCodeGenerator(_guestAbiProvider).EmitWithFacts(
+            entryPoint,
+            ssa,
+            signature,
+            types,
+            options.EmitModRegistration,
+            options.ModRegistrationPriority,
+            options.ModRegistrationModuleId,
+            options.NonReturningCallTargets,
+            options.LrContinuationCallTargets,
+            options.GuestAbiContracts,
+            options.EmitStateFreeLeafVariant,
+            options.StateFreeAbiContracts,
+            options.StateFreeCallSymbols,
+            options.StateFreeCallSiteVariants,
+            options.StateFreeEntryVariants,
+            options.ModuleLinkBase,
+            options.ModuleGuestBase,
+            options.ModuleLinkedCodeSize,
+            gqrEntryConstants: options.GqrEntryConstants,
+            gqrCalleeWriteMasks: options.GqrCalleeWriteMasks,
+            gqrConstantsRequireRuntimeGuard: options.GqrConstantsRequireRuntimeGuard,
+            enableLeafAbiSpillElision: options.EnableLeafAbiSpillElision,
+            modOverridableCallTargets: options.ModOverridableCallTargets);
+    }
+
+    private static IrTracePpc CreateTrace(PpcInstruction instruction)
+    {
+        var operandText = instruction.OperandText;
+        var disasm = string.IsNullOrWhiteSpace(operandText)
+            ? instruction.Mnemonic
+            : $"{instruction.Mnemonic} {operandText}";
+        // PowerPC instructions are exactly one big-endian word, which is the
+        // form the old byte-array path always took.
+        var rawHex = $"0x{instruction.Word:X8}";
+        return new IrTracePpc(instruction.Address, disasm, rawHex);
+    }
+
+    /// <summary>Appends a guest instruction's lowered IR to <paramref name="destination"/>, trace placed
+    /// before the first terminator (or last if none), written in place with no per-instruction copy.</summary>
+    private static void AppendLoweredWithTrace(
+        List<IrInstruction> destination,
+        IReadOnlyList<IrInstruction> instructions,
+        IrTracePpc trace)
+    {
+        var count = instructions.Count;
+        if (count == 0)
+        {
+            destination.Add(trace);
+            return;
+        }
+
+        var terminatorIndex = -1;
+        for (var i = 0; i < count; i++)
+        {
+            if (instructions[i] is IrBranch or IrJump or IrReturn or IrIndirectJump or IrJumpTable or IrUndefined)
+            {
+                terminatorIndex = i;
+                break;
+            }
+        }
+
+        if (terminatorIndex < 0)
+        {
+            for (var i = 0; i < count; i++)
+            {
+                destination.Add(instructions[i]);
+            }
+
+            destination.Add(trace);
+            return;
+        }
+
+        for (var i = 0; i < terminatorIndex; i++)
+        {
+            destination.Add(instructions[i]);
+        }
+
+        destination.Add(trace);
+        for (var i = terminatorIndex; i < count; i++)
+        {
+            destination.Add(instructions[i]);
+        }
+    }
+
+    private static string Base(string name) => RegisterNameUtils.StripNumericSuffix(name);
+
+    private static string LabelFor(uint address) => $"0x{address:X8}";
+
+    private static List<IrBasicBlock> ApplyLinkedCallFallthroughLrOverrides(
+        IReadOnlyList<IrBasicBlock> blocks,
+        IReadOnlyDictionary<uint, uint> overrides)
+    {
+        var rewritten = new List<IrBasicBlock>(blocks.Count);
+        foreach (var block in blocks)
+        {
+            var instructions = block.Instructions.ToArray();
+            var changed = false;
+            for (var i = 0; i + 1 < instructions.Length; i++)
+            {
+                if (instructions[i] is IrAssign { Value.Kind: "const", Value.Constant: { } lrValue } assign &&
+                    string.Equals(Base(assign.Destination), "lr", StringComparison.OrdinalIgnoreCase) &&
+                    instructions[i + 1] is IrCall &&
+                    overrides.TryGetValue(unchecked((uint)lrValue), out var overrideLr))
+                {
+                    instructions[i] = assign with { Value = IrValue.Imm(unchecked((int)overrideLr)) };
+                    changed = true;
+                }
+            }
+
+            rewritten.Add(changed ? new IrBasicBlock(block.Label, instructions) : block);
+        }
+
+        return rewritten;
+    }
+
+    private static bool TryBuildSyntheticBlock(string label, out IrBasicBlock block)
+    {
+        const string IndirectCtrPrefix = "indirect_ctr_";
+        const string CallCtrPrefix = "call_ctr_";
+        const string CallLrPrefix = "call_lr_";
+        const string LinkBranchPrefix = "link_branch_";
+
+        if (label.StartsWith(IndirectCtrPrefix, StringComparison.OrdinalIgnoreCase))
+        {
+            block = new IrBasicBlock(label, new IrInstruction[]
+            {
+                new IrIndirectJump(IrValue.Register("ctr"))
+            });
+            return true;
+        }
+
+        if (TryParseCallLabel(label, CallCtrPrefix, out _, out var fallthrough))
+        {
+            var args = BuildAbiCallArgs();
+            block = new IrBasicBlock(label, new IrInstruction[]
+            {
+                new IrAssign("lr", IrValue.Imm((int)fallthrough)),
+                new IrIndirectCall(string.Empty, IrValue.Register("ctr"), args),
+                new IrJump($"0x{fallthrough:X8}")
+            });
+            return true;
+        }
+
+        if (TryParseCallLabel(label, CallLrPrefix, out var callAddr, out fallthrough))
+        {
+            var args = BuildAbiCallArgs();
+            var temp = $"addr_bclrl_{callAddr:X8}_loc";
+            block = new IrBasicBlock(label, new IrInstruction[]
+            {
+                new IrAssign(temp, IrValue.Register("lr")),
+                new IrAssign("lr", IrValue.Imm((int)fallthrough)),
+                new IrIndirectCall(string.Empty, IrValue.Register(temp), args),
+                new IrJump($"0x{fallthrough:X8}")
+            });
+            return true;
+        }
+
+        if (TryParseLinkBranchLabel(label, LinkBranchPrefix, out fallthrough, out var target))
+        {
+            block = new IrBasicBlock(label, new IrInstruction[]
+            {
+                new IrAssign("lr", IrValue.Imm((int)fallthrough)),
+                new IrJump($"0x{target:X8}")
+            });
+            return true;
+        }
+
+        if (TryParseHex(label, out var absoluteTarget))
+        {
+            block = new IrBasicBlock(label, new IrInstruction[]
+            {
+                new IrCall(string.Empty, $"0x{absoluteTarget:X8}", BuildAbiCallArgs()),
+                new IrReturn(null)
+            });
+            return true;
+        }
+
+        block = null!;
+        return false;
+    }
+
+    private static bool TryParseCallLabel(string label, string prefix, out uint addr, out uint fallthrough)
+    {
+        addr = 0;
+        fallthrough = 0;
+
+        if (!label.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        var rest = label[prefix.Length..];
+        var parts = rest.Split('_', StringSplitOptions.RemoveEmptyEntries);
+        if (parts.Length < 2)
+        {
+            return false;
+        }
+
+        if (!TryParseHex(parts[0], out addr) || !TryParseHex(parts[1], out fallthrough))
+        {
+            return false;
+        }
+
+        return true;
+    }
+
+    private static bool TryParseLinkBranchLabel(string label, string prefix, out uint fallthrough, out uint target)
+    {
+        fallthrough = 0;
+        target = 0;
+
+        if (!label.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))
+        {
+            return false;
+        }
+
+        var rest = label[prefix.Length..];
+        var parts = rest.Split('_', StringSplitOptions.RemoveEmptyEntries);
+        if (parts.Length < 2)
+        {
+            return false;
+        }
+
+        if (!TryParseHex(parts[0], out fallthrough) || !TryParseHex(parts[1], out target))
+        {
+            return false;
+        }
+
+        return true;
+    }
+
+    private static bool TryParseHex(string text, out uint value) =>
+        GuestTargetParser.TryParseHexAddress(text, out value);
+
+    /// <summary>
+    /// The EABI argument registers in the order the lifter passes them. Shares
+    /// the lifter's single immutable instance instead of rebuilding an
+    /// identical list per synthetic call block.
+    /// </summary>
+    private static IReadOnlyList<IrValue> BuildAbiCallArgs() => PpcLifter.AbiCallArguments;
+
+}
diff --git a/translator/src/Translator.Core/Translation/GqrConstantPropagation.cs b/translator/src/Translator.Core/Translation/GqrConstantPropagation.cs
new file mode 100644
index 0000000..630e651
--- /dev/null
+++ b/translator/src/Translator.Core/Translation/GqrConstantPropagation.cs
@@ -0,0 +1,232 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Translation;
+
+public sealed record GqrConstantFlow(
+    IReadOnlyDictionary<string, IReadOnlyDictionary<string, uint>> In);
+
+/// <summary>Forward must-constant propagation used only to specialize PSQ helpers.</summary>
+public static class GqrConstantPropagation
+{
+    private static readonly StringComparer Comparer = StringComparer.OrdinalIgnoreCase;
+
+    public static GqrConstantFlow Analyze(
+        IrFunction function,
+        IReadOnlyDictionary<string, uint>? entryConstants = null,
+        IReadOnlyDictionary<uint, byte>? calleeWriteMasks = null)
+    {
+        var cfg = IrCfg.Build(function);
+        var input = function.Blocks.ToDictionary(b => b.Label, _ => new Dictionary<string, uint>(Comparer), Comparer);
+        var output = function.Blocks.ToDictionary(b => b.Label, _ => new Dictionary<string, uint>(Comparer), Comparer);
+        var outputInitialized = function.Blocks.ToDictionary(b => b.Label, _ => false, Comparer);
+        var changed = true;
+        var iterations = 0;
+        while (changed)
+        {
+            var iterationLimit = Math.Max(256, function.Blocks.Count * 4 + 16);
+            if (++iterations > iterationLimit)
+                return UnknownFlow(function);
+            changed = false;
+            foreach (var block in function.Blocks)
+            {
+                var isEntry = Comparer.Equals(block.Label, function.EntryLabel);
+                var predecessors = cfg.Predecessors(block.Label)
+                    .Where(p => !Comparer.Equals(p, block.Label) && outputInitialized[p]).ToArray();
+                // An uninitialized predecessor is lattice top, not an empty
+                // constant map. Do not manufacture a bottom state for blocks
+                // that have not become reachable from the entry yet.
+                if (!isEntry && predecessors.Length == 0)
+                    continue;
+                var state = isEntry
+                    ? new Dictionary<string, uint>(entryConstants ?? new Dictionary<string, uint>(), Comparer)
+                    : Intersect(predecessors.Select(p => output[p]));
+                var newInput = new Dictionary<string, uint>(state, Comparer);
+                foreach (var instruction in block.Instructions)
+                    Transfer(instruction, state, output, calleeWriteMasks);
+                if (!Same(input[block.Label], newInput)) { input[block.Label] = newInput; changed = true; }
+                if (!Same(output[block.Label], state)) { output[block.Label] = state; changed = true; }
+                if (!outputInitialized[block.Label]) { outputInitialized[block.Label] = true; changed = true; }
+            }
+        }
+        return new GqrConstantFlow(
+            input.ToDictionary(p => p.Key, p => (IReadOnlyDictionary<string, uint>)p.Value, Comparer));
+    }
+
+    public static IrFunction Specialize(
+        IrFunction function,
+        IReadOnlyDictionary<string, uint>? entryConstants = null,
+        IReadOnlyDictionary<uint, byte>? calleeWriteMasks = null,
+        bool requireRuntimeGuard = false,
+        bool resolvedOnly = false)
+    {
+        var flow = Analyze(function, entryConstants, calleeWriteMasks);
+        var blocks = new List<IrBasicBlock>(function.Blocks.Count);
+        foreach (var block in function.Blocks)
+        {
+            var state = new Dictionary<string, uint>(flow.In[block.Label], Comparer);
+            var instructions = new List<IrInstruction>(block.Instructions.Count);
+            foreach (var instruction in block.Instructions)
+            {
+                var rewritten = TrySpecializePsq(instruction, state, requireRuntimeGuard, resolvedOnly);
+                instructions.Add(rewritten);
+                Transfer(instruction, state, null, calleeWriteMasks);
+            }
+            blocks.Add(new IrBasicBlock(block.Label, instructions));
+        }
+        return new IrFunction(function.Name, function.EntryLabel, blocks);
+    }
+
+    private static IrInstruction TrySpecializePsq(
+        IrInstruction instruction,
+        IReadOnlyDictionary<string, uint> state,
+        bool requireRuntimeGuard,
+        bool resolvedOnly)
+    {
+        if (instruction is IrResolvedPsqLoad load && load.KnownGqr is null &&
+            state.TryGetValue($"gqr{load.I}", out var loadGqr))
+            return load with { KnownGqr = loadGqr, GuardKnownGqr = requireRuntimeGuard };
+        if (instruction is IrResolvedPsqStore store && store.KnownGqr is null &&
+            state.TryGetValue($"gqr{store.I}", out var storeGqr))
+            return store with { KnownGqr = storeGqr, GuardKnownGqr = requireRuntimeGuard };
+        if (resolvedOnly) return instruction;
+        if (instruction is not IrCall call) return instruction;
+        var isLoad = call.Target.Equals("PPC_PsqL", StringComparison.OrdinalIgnoreCase);
+        var isStore = call.Target.Equals("PPC_PsqSt", StringComparison.OrdinalIgnoreCase);
+        var indexArgument = isLoad ? 2 : isStore ? 3 : -1;
+        if (indexArgument < 0 || call.Arguments.Count <= indexArgument ||
+            !TryValue(call.Arguments[indexArgument], state, out var index) || index >= 8 ||
+            !state.TryGetValue($"gqr{index}", out var gqr)) return instruction;
+        var suffix = requireRuntimeGuard ? "KnownGuarded" : "Known";
+        return call with { Target = $"{call.Target}{suffix}_{gqr:X8}" };
+    }
+
+    private static void Transfer(IrInstruction instruction, Dictionary<string, uint> state,
+        IReadOnlyDictionary<string, Dictionary<string, uint>>? predecessorOut,
+        IReadOnlyDictionary<uint, byte>? calleeWriteMasks)
+    {
+        switch (instruction)
+        {
+            case IrAssign assign:
+                SetOrKill(assign.Destination, assign.Value, state);
+                break;
+            case IrBinary binary:
+                if (TryValue(binary.Left, state, out var left) && TryValue(binary.Right, state, out var right) &&
+                    TryBinary(binary.Op, left, right, out var result)) state[binary.Destination] = result;
+                else state.Remove(binary.Destination);
+                break;
+            case IrPhi phi:
+                if (predecessorOut != null && phi.Sources.Count != 0)
+                {
+                    uint? value = null;
+                    var valid = true;
+                    foreach (var source in phi.Sources)
+                    {
+                        if (!predecessorOut.TryGetValue(source.Key, out var pred) || !pred.TryGetValue(source.Value, out var incoming) ||
+                            (value.HasValue && value.Value != incoming)) { valid = false; break; }
+                        value = incoming;
+                    }
+                    if (valid && value.HasValue) state[phi.Destination] = value.Value; else state.Remove(phi.Destination);
+                }
+                else state.Remove(phi.Destination);
+                break;
+            case IrLoad load:
+                state.Remove(load.Destination);
+                break;
+            case IrCall call when IsGuestCall(call.Target):
+                PreserveUnmodifiedGqrsAcrossCall(call.Target, state, calleeWriteMasks);
+                break;
+            case IrCall call when !string.IsNullOrWhiteSpace(call.Destination):
+                state.Remove(call.Destination);
+                break;
+            case IrIndirectCall:
+                state.Clear();
+                break;
+        }
+    }
+
+    private static void SetOrKill(string destination, IrValue value, Dictionary<string, uint> state)
+    {
+        var key = GqrKey(destination) ?? destination;
+        if (TryValue(value, state, out var constant)) state[key] = constant;
+        else state.Remove(key);
+    }
+
+    private static bool TryValue(IrValue value, IReadOnlyDictionary<string, uint> state, out uint constant)
+    {
+        if (value is { Kind: "const", Constant: { } immediate }) { constant = unchecked((uint)immediate); return true; }
+        if (value is { Kind: "register", RegisterName: { } name } && state.TryGetValue(name, out constant)) return true;
+        constant = 0; return false;
+    }
+
+    private static bool TryBinary(string op, uint left, uint right, out uint value)
+    {
+        value = op.ToLowerInvariant() switch
+        {
+            "add" or "add_u" => unchecked(left + right),
+            "sub" or "sub_u" => unchecked(left - right),
+            "or" => left | right,
+            "and" => left & right,
+            "xor" => left ^ right,
+            "shl" => left << ((int)right & 31),
+            "rotl" => (left << ((int)right & 31)) | (left >> ((32 - (int)right) & 31)),
+            "shr" or "shr_u" => left >> ((int)right & 31),
+            _ => 0
+        };
+        return op.ToLowerInvariant() is "add" or "add_u" or "sub" or "sub_u" or "or" or "and" or "xor" or "shl" or "shr" or "shr_u" or "rotl";
+    }
+
+    private static Dictionary<string, uint> Intersect(IEnumerable<Dictionary<string, uint>> maps)
+    {
+        var list = maps.ToArray();
+        var result = new Dictionary<string, uint>(list[0], Comparer);
+        foreach (var key in result.Keys.ToArray())
+            if (list.Skip(1).Any(map => !map.TryGetValue(key, out var value) || value != result[key])) result.Remove(key);
+        return result;
+    }
+    private static bool Same(IReadOnlyDictionary<string, uint> a, IReadOnlyDictionary<string, uint> b) =>
+        a.Count == b.Count && a.All(p => b.TryGetValue(p.Key, out var value) && value == p.Value);
+    private static bool IsGuestCall(string target) => target.StartsWith("func_", StringComparison.OrdinalIgnoreCase) ||
+        target.StartsWith("0x", StringComparison.OrdinalIgnoreCase) || uint.TryParse(target, out _);
+
+    private static void PreserveUnmodifiedGqrsAcrossCall(
+        string target,
+        Dictionary<string, uint> state,
+        IReadOnlyDictionary<uint, byte>? calleeWriteMasks)
+    {
+        var writeMask = TryGuestAddress(target, out var address) &&
+                        calleeWriteMasks is not null &&
+                        calleeWriteMasks.TryGetValue(address, out var knownMask)
+            ? knownMask
+            : (byte)0xFF;
+        var preserved = state
+            .Where(pair => GqrKey(pair.Key) is { } key &&
+                           (writeMask & (1 << (key[3] - '0'))) == 0)
+            .ToArray();
+        state.Clear();
+        foreach (var pair in preserved)
+            state[GqrKey(pair.Key)!] = pair.Value;
+    }
+
+    public static bool TryGuestAddress(string target, out uint address) =>
+        GuestTargetParser.TryParseAddressOrDecimal(target, out address);
+
+    internal static string? TryGetGqrKey(string name) => GqrKey(name);
+    private static GqrConstantFlow UnknownFlow(IrFunction function)
+    {
+        var unknown = function.Blocks.ToDictionary(
+            block => block.Label,
+            _ => (IReadOnlyDictionary<string, uint>)new Dictionary<string, uint>(Comparer),
+            Comparer);
+        return new GqrConstantFlow(unknown);
+    }
+    private static string? GqrKey(string name)
+    {
+        var baseName = RegisterNameUtils.StripNumericSuffix(name);
+        return baseName.Length == 4 && baseName.StartsWith("gqr", StringComparison.OrdinalIgnoreCase) &&
+               baseName[3] is >= '0' and <= '7' ? baseName.ToLowerInvariant() : null;
+    }
+}
diff --git a/translator/src/Translator.Core/Translation/GqrFunctionSummary.cs b/translator/src/Translator.Core/Translation/GqrFunctionSummary.cs
new file mode 100644
index 0000000..7214137
--- /dev/null
+++ b/translator/src/Translator.Core/Translation/GqrFunctionSummary.cs
@@ -0,0 +1,243 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Translation;
+
+/// <summary>
+/// Compact projection of a function's SSA IR, keeping only what can affect interprocedural GQR
+/// propagation (unlike the full <see cref="IrFunction"/>, which is discarded between discovery and emission).
+/// </summary>
+public sealed class GqrFunctionSummary
+{
+    private const int GqrCount = 8;
+
+    private GqrFunctionSummary(
+        int entryBlock,
+        GqrSummaryBlock[] blocks,
+        uint[] directGuestTargets,
+        sbyte[] gqrAffinityByVariable,
+        byte localWriteMask,
+        bool hasUnknownGuestOrIndirectCall)
+    {
+        EntryBlock = entryBlock;
+        Blocks = blocks;
+        DirectGuestTargets = directGuestTargets;
+        GqrAffinityByVariable = gqrAffinityByVariable;
+        LocalWriteMask = localWriteMask;
+        HasUnknownGuestOrIndirectCall = hasUnknownGuestOrIndirectCall;
+    }
+
+    internal int EntryBlock { get; }
+    internal IReadOnlyList<GqrSummaryBlock> Blocks { get; }
+    public IReadOnlyList<uint> DirectGuestTargets { get; }
+    private sbyte[] GqrAffinityByVariable { get; }
+    internal byte LocalWriteMask { get; }
+    internal bool HasUnknownGuestOrIndirectCall { get; }
+
+    public static GqrFunctionSummary Create(IrFunction function)
+    {
+        ArgumentNullException.ThrowIfNull(function);
+
+        var blockIndices = function.Blocks
+            .Select((block, index) => (block.Label, index))
+            .ToDictionary(pair => pair.Label, pair => pair.index, StringComparer.OrdinalIgnoreCase);
+        var cfg = IrCfg.Build(function);
+        var variableIds = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+        var gqrAffinityByVariable = Enumerable.Range(0, GqrCount)
+            .Select(index => checked((sbyte)index))
+            .ToList();
+        var nextVariableId = GqrCount;
+        var directGuestTargets = new HashSet<uint>();
+        byte localWriteMask = 0;
+        var hasUnknownGuestOrIndirectCall = false;
+
+        int ExactVariable(string name)
+        {
+            if (name.Length == 4 && name.StartsWith("gqr", StringComparison.OrdinalIgnoreCase) &&
+                name[3] is >= '0' and <= '7')
+            {
+                return name[3] - '0';
+            }
+
+            if (!variableIds.TryGetValue(name, out var id))
+            {
+                id = nextVariableId++;
+                variableIds.Add(name, id);
+                var gqrKey = GqrConstantPropagation.TryGetGqrKey(name);
+                gqrAffinityByVariable.Add(gqrKey is null ? (sbyte)-1 : checked((sbyte)(gqrKey[3] - '0')));
+            }
+            return id;
+        }
+
+        int AssignDestination(string name)
+        {
+            var key = GqrConstantPropagation.TryGetGqrKey(name);
+            return key is null ? ExactVariable(name) : key[3] - '0';
+        }
+
+        GqrSummaryValue Value(IrValue value)
+        {
+            if (value is { Kind: "const", Constant: { } immediate })
+                return GqrSummaryValue.ConstantValue(unchecked((uint)immediate));
+            if (value is { Kind: "register", RegisterName: { } register })
+                return GqrSummaryValue.VariableValue(ExactVariable(register));
+            return GqrSummaryValue.Unknown;
+        }
+
+        var blocks = new GqrSummaryBlock[function.Blocks.Count];
+        for (var blockIndex = 0; blockIndex < function.Blocks.Count; blockIndex++)
+        {
+            var block = function.Blocks[blockIndex];
+            var instructions = new List<GqrSummaryInstruction>();
+            foreach (var instruction in block.Instructions)
+            {
+                switch (instruction)
+                {
+                    case IrAssign assign:
+                    {
+                        var destination = AssignDestination(assign.Destination);
+                        if (destination < GqrCount)
+                            localWriteMask |= (byte)(1 << destination);
+                        instructions.Add(GqrSummaryInstruction.Assign(destination, Value(assign.Value)));
+                        break;
+                    }
+                    case IrBinary binary:
+                        instructions.Add(GqrSummaryInstruction.Binary(
+                            ExactVariable(binary.Destination),
+                            Value(binary.Left),
+                            Value(binary.Right),
+                            ParseBinary(binary.Op)));
+                        break;
+                    case IrPhi phi:
+                        instructions.Add(GqrSummaryInstruction.Phi(
+                            ExactVariable(phi.Destination),
+                            phi.Sources.Select(source => new GqrPhiSource(
+                                blockIndices.TryGetValue(source.Key, out var predecessor) ? predecessor : -1,
+                                ExactVariable(source.Value))).ToArray()));
+                        break;
+                    case IrLoad load:
+                        instructions.Add(GqrSummaryInstruction.Kill(ExactVariable(load.Destination)));
+                        break;
+                    case IrCall call when IsGuestCall(call.Target):
+                    {
+                        var targetKnown = GqrConstantPropagation.TryGuestAddress(call.Target, out var target);
+                        if (targetKnown)
+                            directGuestTargets.Add(target);
+                        else
+                            hasUnknownGuestOrIndirectCall = true;
+                        instructions.Add(GqrSummaryInstruction.GuestCall(target, targetKnown));
+                        break;
+                    }
+                    case IrCall call when !string.IsNullOrWhiteSpace(call.Destination):
+                        instructions.Add(GqrSummaryInstruction.Kill(ExactVariable(call.Destination)));
+                        break;
+                    case IrIndirectCall:
+                        hasUnknownGuestOrIndirectCall = true;
+                        instructions.Add(GqrSummaryInstruction.IndirectCall());
+                        break;
+                }
+            }
+
+            var predecessors = cfg.Predecessors(block.Label)
+                .Select(label => blockIndices.TryGetValue(label, out var predecessor) ? predecessor : -1)
+                .Where(predecessor => predecessor >= 0)
+                .ToArray();
+            blocks[blockIndex] = new GqrSummaryBlock(predecessors, instructions.ToArray());
+        }
+
+        return new GqrFunctionSummary(
+            blockIndices.TryGetValue(function.EntryLabel, out var entryBlock) ? entryBlock : 0,
+            blocks,
+            directGuestTargets.OrderBy(target => target).ToArray(),
+            gqrAffinityByVariable.ToArray(),
+            localWriteMask,
+            hasUnknownGuestOrIndirectCall);
+    }
+
+    internal int GetGqrAffinity(int variable) =>
+        variable >= 0 && variable < GqrAffinityByVariable.Length
+            ? GqrAffinityByVariable[variable]
+            : -1;
+
+    private static bool IsGuestCall(string target) =>
+        target.StartsWith("func_", StringComparison.OrdinalIgnoreCase) ||
+        target.StartsWith("0x", StringComparison.OrdinalIgnoreCase) ||
+        uint.TryParse(target, out _);
+
+    private static GqrBinaryOperation ParseBinary(string op) => op.ToLowerInvariant() switch
+    {
+        "add" or "add_u" => GqrBinaryOperation.Add,
+        "sub" or "sub_u" => GqrBinaryOperation.Subtract,
+        "or" => GqrBinaryOperation.Or,
+        "and" => GqrBinaryOperation.And,
+        "xor" => GqrBinaryOperation.Xor,
+        "shl" => GqrBinaryOperation.ShiftLeft,
+        "rotl" => GqrBinaryOperation.RotateLeft,
+        "shr" or "shr_u" => GqrBinaryOperation.ShiftRight,
+        _ => GqrBinaryOperation.Unknown
+    };
+}
+
+internal sealed record GqrSummaryBlock(
+    int[] Predecessors,
+    GqrSummaryInstruction[] Instructions);
+
+internal enum GqrSummaryOperation : byte
+{
+    Assign,
+    Binary,
+    Phi,
+    Kill,
+    GuestCall,
+    IndirectCall
+}
+
+internal enum GqrBinaryOperation : byte
+{
+    Unknown,
+    Add,
+    Subtract,
+    Or,
+    And,
+    Xor,
+    ShiftLeft,
+    RotateLeft,
+    ShiftRight
+}
+
+internal readonly record struct GqrSummaryValue(byte Kind, int Variable, uint Constant)
+{
+    public static GqrSummaryValue Unknown => default;
+    public static GqrSummaryValue VariableValue(int variable) => new(1, variable, 0);
+    public static GqrSummaryValue ConstantValue(uint constant) => new(2, 0, constant);
+}
+
+internal readonly record struct GqrPhiSource(int Predecessor, int Variable);
+
+internal readonly record struct GqrSummaryInstruction(
+    GqrSummaryOperation Operation,
+    int Destination,
+    GqrSummaryValue Left,
+    GqrSummaryValue Right,
+    GqrBinaryOperation BinaryOperation,
+    uint CallTarget,
+    bool CallTargetKnown,
+    GqrPhiSource[]? PhiSources)
+{
+    public static GqrSummaryInstruction Assign(int destination, GqrSummaryValue value) =>
+        new(GqrSummaryOperation.Assign, destination, value, default, default, 0, false, null);
+    public static GqrSummaryInstruction Binary(
+        int destination, GqrSummaryValue left, GqrSummaryValue right, GqrBinaryOperation operation) =>
+        new(GqrSummaryOperation.Binary, destination, left, right, operation, 0, false, null);
+    public static GqrSummaryInstruction Phi(int destination, GqrPhiSource[] sources) =>
+        new(GqrSummaryOperation.Phi, destination, default, default, default, 0, false, sources);
+    public static GqrSummaryInstruction Kill(int destination) =>
+        new(GqrSummaryOperation.Kill, destination, default, default, default, 0, false, null);
+    public static GqrSummaryInstruction GuestCall(uint target, bool targetKnown) =>
+        new(GqrSummaryOperation.GuestCall, 0, default, default, default, target, targetKnown, null);
+    public static GqrSummaryInstruction IndirectCall() =>
+        new(GqrSummaryOperation.IndirectCall, 0, default, default, default, 0, false, null);
+}
diff --git a/translator/src/Translator.Core/Translation/GqrInterproceduralAnalysis.cs b/translator/src/Translator.Core/Translation/GqrInterproceduralAnalysis.cs
new file mode 100644
index 0000000..e8c2c0a
--- /dev/null
+++ b/translator/src/Translator.Core/Translation/GqrInterproceduralAnalysis.cs
@@ -0,0 +1,674 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace Translator.Core.Translation;
+
+public sealed record GqrInterproceduralResult(
+    IReadOnlyDictionary<uint, IReadOnlyDictionary<string, uint>> EntryConstants,
+    IReadOnlyDictionary<uint, byte> WriteMasks,
+    IReadOnlySet<uint> ReachableFunctions);
+
+/// <summary>
+/// Computes closed-world GQR effects and must-constant entry facts for direct
+/// guest calls. Unknown and indirect calls conservatively write every GQR.
+/// </summary>
+public static class GqrInterproceduralAnalysis
+{
+    private const int GqrCount = 8;
+
+    /// <summary>Minimum dirty-caller count before a round is farmed out to the thread pool.</summary>
+    private const int ParallelRoundThreshold = 8;
+
+    private static readonly StringComparer Comparer = StringComparer.OrdinalIgnoreCase;
+
+    private static readonly string[] GqrKeys =
+        ["gqr0", "gqr1", "gqr2", "gqr3", "gqr4", "gqr5", "gqr6", "gqr7"];
+
+    /// <summary>Bulk-translation path: same closed-world fixpoint as the naive formulation, but over
+    /// compact GQR projections and a caller-side worklist that only re-evaluates movers. The per-callee
+    /// merge is a commutative/associative intersection, so visit order never affects the result.</summary>
+    public static GqrInterproceduralResult Analyze(
+        IReadOnlyDictionary<uint, GqrFunctionSummary> functions,
+        IEnumerable<uint> roots)
+    {
+        var writeMasks = ComputeCompactWriteMasks(functions);
+        var rootSet = roots.Where(functions.ContainsKey).ToHashSet();
+        var reachable = ComputeCompactReachable(functions, rootSet);
+
+        // Dense, deterministic indexing over the reachable set. Reachability and
+        // the callee write masks are round-invariant, so both are computed once.
+        var count = reachable.Count;
+        var addresses = new uint[count];
+        reachable.CopyTo(addresses);
+        Array.Sort(addresses);
+        var indices = new Dictionary<uint, int>(count);
+        for (var i = 0; i < count; i++) indices[addresses[i]] = i;
+
+        var summaries = new GqrFunctionSummary[count];
+        var isRoot = new bool[count];
+        for (var i = 0; i < count; i++)
+        {
+            summaries[i] = functions[addresses[i]];
+            isRoot[i] = rootSet.Contains(addresses[i]);
+        }
+
+        // Entry facts as a bitmask plus one value per GQR slot; the string keys
+        // only exist at the public boundary.
+        var entryMasks = new byte[count];
+        var entryValues = new uint[count * GqrCount];
+
+        // Call-site shape (which sites exist and where they point) is invariant;
+        // only the constants flowing into them change between rounds.
+        var contributions = BuildCompactCallSites(summaries, indices);
+
+        // Reverse index (callee -> contributing call sites) in CSR form. A callee
+        // only has to be re-merged when one of its callers was re-evaluated, and
+        // every other callee keeps the entry fact it already agreed with.
+        var edgeCount = 0;
+        for (var caller = 0; caller < count; caller++)
+            edgeCount += contributions[caller].Targets.Length;
+        var targetStart = new int[count + 1];
+        for (var caller = 0; caller < count; caller++)
+        {
+            var targets = contributions[caller].Targets;
+            for (var site = 0; site < targets.Length; site++) targetStart[targets[site] + 1]++;
+        }
+        for (var i = 0; i < count; i++) targetStart[i + 1] += targetStart[i];
+        var edgeCaller = new int[edgeCount];
+        var edgeSite = new int[edgeCount];
+        var edgeFill = new int[count];
+        Array.Copy(targetStart, edgeFill, count);
+        for (var caller = 0; caller < count; caller++)
+        {
+            var targets = contributions[caller].Targets;
+            for (var site = 0; site < targets.Length; site++)
+            {
+                var position = edgeFill[targets[site]]++;
+                edgeCaller[position] = caller;
+                edgeSite[position] = site;
+            }
+        }
+
+        var mergedValues = new uint[GqrCount];
+        var affected = new int[count];
+        var affectedFlag = new bool[count];
+
+        // Callers without a single reachable outgoing call site can never
+        // contribute anything, so they never need their flow analysed.
+        var dirty = new int[count];
+        var dirtyCount = 0;
+        for (var i = 0; i < count; i++)
+            if (contributions[i].Targets.Length != 0) dirty[dirtyCount++] = i;
+
+        var changed = true;
+        var iterations = 0;
+        while (changed)
+        {
+            if (++iterations > Math.Max(256, functions.Count * 2 + 16))
+                throw new InvalidOperationException("Interprocedural compact GQR entry propagation did not converge.");
+
+            EvaluateCompactCallers(
+                summaries, entryMasks, entryValues, writeMasks, indices, contributions, dirty, dirtyCount);
+
+            var affectedCount = 0;
+            for (var d = 0; d < dirtyCount; d++)
+            {
+                var targets = contributions[dirty[d]].Targets;
+                for (var site = 0; site < targets.Length; site++)
+                {
+                    var target = targets[site];
+                    if (affectedFlag[target]) continue;
+                    affectedFlag[target] = true;
+                    affected[affectedCount++] = target;
+                }
+            }
+
+            changed = false;
+            dirtyCount = 0;
+            for (var a = 0; a < affectedCount; a++)
+            {
+                var target = affected[a];
+                affectedFlag[target] = false;
+
+                // Intersection of the must-constant facts of every call site that
+                // targets this callee; commutative and associative, so the merged
+                // value never depends on the caller visit order.
+                byte mask = 0;
+                var first = true;
+                for (var edge = targetStart[target]; edge < targetStart[target + 1]; edge++)
+                {
+                    var sites = contributions[edgeCaller[edge]];
+                    var site = edgeSite[edge];
+                    var sourceBase = site * GqrCount;
+                    var siteMask = sites.Masks[site];
+                    if (first)
+                    {
+                        first = false;
+                        mask = siteMask;
+                        for (var slot = 0; slot < GqrCount; slot++)
+                            if ((mask & (1 << slot)) != 0)
+                                mergedValues[slot] = sites.Values[sourceBase + slot];
+                        continue;
+                    }
+
+                    var combined = (byte)(mask & siteMask);
+                    for (var slot = 0; slot < GqrCount; slot++)
+                    {
+                        var bit = 1 << slot;
+                        if ((combined & bit) == 0) continue;
+                        if (mergedValues[slot] != sites.Values[sourceBase + slot])
+                            combined &= (byte)~bit;
+                    }
+                    mask = combined;
+                    if (mask == 0) break;
+                }
+
+                var nextMask = isRoot[target] ? (byte)0 : mask;
+                var entryBase = target * GqrCount;
+                var same = entryMasks[target] == nextMask;
+                for (var slot = 0; slot < GqrCount && same; slot++)
+                    if ((nextMask & (1 << slot)) != 0 &&
+                        entryValues[entryBase + slot] != mergedValues[slot])
+                        same = false;
+                if (same) continue;
+
+                entryMasks[target] = nextMask;
+                for (var slot = 0; slot < GqrCount; slot++)
+                    if ((nextMask & (1 << slot)) != 0)
+                        entryValues[entryBase + slot] = mergedValues[slot];
+                changed = true;
+                if (contributions[target].Targets.Length != 0) dirty[dirtyCount++] = target;
+            }
+        }
+
+        var entries = new Dictionary<uint, IReadOnlyDictionary<string, uint>>(functions.Count);
+        foreach (var address in functions.Keys)
+        {
+            var constants = new Dictionary<string, uint>(Comparer);
+            if (indices.TryGetValue(address, out var index))
+            {
+                var mask = entryMasks[index];
+                var entryBase = index * GqrCount;
+                for (var slot = 0; slot < GqrCount; slot++)
+                    if ((mask & (1 << slot)) != 0)
+                        constants[GqrKeys[slot]] = entryValues[entryBase + slot];
+            }
+            entries[address] = constants;
+        }
+
+        return new GqrInterproceduralResult(entries, writeMasks, reachable);
+    }
+
+    /// <summary>
+    /// Per-caller outgoing call sites. <see cref="Targets"/> is round-invariant;
+    /// the mask/value payload is overwritten in place each time the caller is
+    /// re-evaluated.
+    /// </summary>
+    private sealed class CompactCallSites
+    {
+        public CompactCallSites(int[] targets)
+        {
+            Targets = targets;
+            Masks = new byte[targets.Length];
+            Values = new uint[targets.Length * GqrCount];
+        }
+
+        public int[] Targets { get; }
+        public byte[] Masks { get; }
+        public uint[] Values { get; }
+    }
+
+    private static CompactCallSites[] BuildCompactCallSites(
+        GqrFunctionSummary[] summaries,
+        Dictionary<uint, int> indices)
+    {
+        var result = new CompactCallSites[summaries.Length];
+        void Build(int index)
+        {
+            var function = summaries[index];
+            var targets = new List<int>();
+            for (var blockIndex = 0; blockIndex < function.Blocks.Count; blockIndex++)
+            {
+                var instructions = function.Blocks[blockIndex].Instructions;
+                for (var i = 0; i < instructions.Length; i++)
+                {
+                    ref readonly var instruction = ref instructions[i];
+                    if (instruction.Operation == GqrSummaryOperation.GuestCall &&
+                        instruction.CallTargetKnown &&
+                        indices.TryGetValue(instruction.CallTarget, out var target))
+                        targets.Add(target);
+                }
+            }
+            result[index] = new CompactCallSites(targets.ToArray());
+        }
+
+        if (summaries.Length >= ParallelRoundThreshold)
+            Parallel.For(0, summaries.Length, CreateParallelOptions(), Build);
+        else
+            for (var i = 0; i < summaries.Length; i++) Build(i);
+        return result;
+    }
+
+    private static void EvaluateCompactCallers(
+        GqrFunctionSummary[] summaries,
+        byte[] entryMasks,
+        uint[] entryValues,
+        Dictionary<uint, byte> calleeWriteMasks,
+        Dictionary<uint, int> indices,
+        CompactCallSites[] contributions,
+        int[] dirty,
+        int dirtyCount)
+    {
+        if (dirtyCount <= 0) return;
+
+        void Evaluate(int slot)
+        {
+            var index = dirty[slot];
+            EvaluateCompactCaller(
+                summaries[index],
+                entryMasks[index],
+                entryValues,
+                index * GqrCount,
+                calleeWriteMasks,
+                indices,
+                contributions[index]);
+        }
+
+        // Re-evaluating a caller only reads that caller's summary and the frozen
+        // entry snapshot, and only writes that caller's own contribution buffer.
+        if (dirtyCount >= ParallelRoundThreshold)
+            Parallel.For(0, dirtyCount, CreateParallelOptions(), Evaluate);
+        else
+            for (var slot = 0; slot < dirtyCount; slot++) Evaluate(slot);
+    }
+
+    private static ParallelOptions CreateParallelOptions() =>
+        new() { MaxDegreeOfParallelism = Environment.ProcessorCount };
+
+    /// <summary>
+    /// Runs the per-block must-constant fixpoint for a single function and records
+    /// the constants reaching each outgoing direct call site.
+    /// </summary>
+    private static void EvaluateCompactCaller(
+        GqrFunctionSummary function,
+        byte entryMask,
+        uint[] entryValues,
+        int entryBase,
+        Dictionary<uint, byte> calleeWriteMasks,
+        Dictionary<uint, int> indices,
+        CompactCallSites sites)
+    {
+        var blockCount = function.Blocks.Count;
+        var input = new Dictionary<int, uint>[blockCount];
+        var output = new Dictionary<int, uint>[blockCount];
+        var maxPredecessors = 0;
+        for (var i = 0; i < blockCount; i++)
+        {
+            input[i] = new Dictionary<int, uint>();
+            output[i] = new Dictionary<int, uint>();
+            var predecessorCount = function.Blocks[i].Predecessors.Length;
+            if (predecessorCount > maxPredecessors) maxPredecessors = predecessorCount;
+        }
+
+        var outputInitialized = new bool[blockCount];
+        var predecessors = new int[maxPredecessors];
+        var state = new Dictionary<int, uint>();
+        var iterationLimit = Math.Max(256, blockCount * 4 + 16);
+        var converged = true;
+
+        var changed = true;
+        var iterations = 0;
+        while (changed)
+        {
+            if (++iterations > iterationLimit)
+            {
+                converged = false;
+                break;
+            }
+
+            changed = false;
+            for (var blockIndex = 0; blockIndex < blockCount; blockIndex++)
+            {
+                var block = function.Blocks[blockIndex];
+                var isEntry = blockIndex == function.EntryBlock;
+                var predecessorCount = 0;
+                var blockPredecessors = block.Predecessors;
+                for (var i = 0; i < blockPredecessors.Length; i++)
+                {
+                    var predecessor = blockPredecessors[i];
+                    if (predecessor != blockIndex && outputInitialized[predecessor])
+                        predecessors[predecessorCount++] = predecessor;
+                }
+                // An uninitialized predecessor is lattice top, not an empty
+                // constant map, so blocks that are not reachable from the entry
+                // yet must not be given a bottom state.
+                if (!isEntry && predecessorCount == 0) continue;
+
+                state.Clear();
+                if (isEntry)
+                {
+                    for (var slot = 0; slot < GqrCount; slot++)
+                        if ((entryMask & (1 << slot)) != 0)
+                            state[slot] = entryValues[entryBase + slot];
+                }
+                else
+                {
+                    CompactIntersectInto(output, predecessors, predecessorCount, state);
+                }
+
+                // The block input is the pre-transfer state; compare before the
+                // transfer functions mutate it so the copy is only made when the
+                // fact actually moved.
+                if (!CompactSame(input[blockIndex], state))
+                {
+                    input[blockIndex] = new Dictionary<int, uint>(state);
+                    changed = true;
+                }
+
+                var instructions = block.Instructions;
+                for (var i = 0; i < instructions.Length; i++)
+                    TransferCompact(function, in instructions[i], state, output, calleeWriteMasks);
+
+                if (!CompactSame(output[blockIndex], state))
+                {
+                    output[blockIndex] = new Dictionary<int, uint>(state);
+                    changed = true;
+                }
+                if (!outputInitialized[blockIndex])
+                {
+                    outputInitialized[blockIndex] = true;
+                    changed = true;
+                }
+            }
+        }
+
+        if (!converged)
+            for (var i = 0; i < blockCount; i++) input[i] = new Dictionary<int, uint>();
+
+        var site = 0;
+        for (var blockIndex = 0; blockIndex < blockCount; blockIndex++)
+        {
+            state.Clear();
+            foreach (var pair in input[blockIndex]) state[pair.Key] = pair.Value;
+            var instructions = function.Blocks[blockIndex].Instructions;
+            for (var i = 0; i < instructions.Length; i++)
+            {
+                ref readonly var instruction = ref instructions[i];
+                if (instruction.Operation == GqrSummaryOperation.GuestCall &&
+                    instruction.CallTargetKnown &&
+                    indices.ContainsKey(instruction.CallTarget))
+                {
+                    byte mask = 0;
+                    var valueBase = site * GqrCount;
+                    foreach (var pair in state)
+                    {
+                        var affinity = function.GetGqrAffinity(pair.Key);
+                        if (affinity < 0) continue;
+                        mask |= (byte)(1 << affinity);
+                        sites.Values[valueBase + affinity] = pair.Value;
+                    }
+                    sites.Masks[site] = mask;
+                    site++;
+                }
+                TransferCompact(function, in instruction, state, null, calleeWriteMasks);
+            }
+        }
+    }
+
+    private static Dictionary<uint, byte> ComputeCompactWriteMasks(
+        IReadOnlyDictionary<uint, GqrFunctionSummary> functions)
+    {
+        var count = functions.Count;
+        var addresses = new uint[count];
+        var indices = new Dictionary<uint, int>(count);
+        var position = 0;
+        foreach (var address in functions.Keys)
+        {
+            addresses[position] = address;
+            indices[address] = position;
+            position++;
+        }
+
+        var local = new byte[count];
+        var callees = new int[count][];
+        var callerCounts = new int[count];
+        var known = new List<int>();
+        for (var i = 0; i < count; i++)
+        {
+            var function = functions[addresses[i]];
+            var mask = function.HasUnknownGuestOrIndirectCall ? (byte)0xFF : function.LocalWriteMask;
+            var targets = function.DirectGuestTargets;
+            known.Clear();
+            for (var t = 0; t < targets.Count; t++)
+            {
+                if (indices.TryGetValue(targets[t], out var target)) known.Add(target);
+                else mask = 0xFF;
+            }
+            local[i] = mask;
+            var edges = known.ToArray();
+            callees[i] = edges;
+            for (var e = 0; e < edges.Length; e++) callerCounts[edges[e]]++;
+        }
+
+        // Reverse (callee -> caller) edges in CSR form so the union fixpoint can
+        // run as a worklist instead of a global round-robin sweep. Both compute
+        // the same least fixpoint of a monotone union.
+        var callerStart = new int[count + 1];
+        for (var i = 0; i < count; i++) callerStart[i + 1] = callerStart[i] + callerCounts[i];
+        var callerEdges = new int[callerStart[count]];
+        var fill = new int[count];
+        Array.Copy(callerStart, fill, count);
+        for (var i = 0; i < count; i++)
+        {
+            var edges = callees[i];
+            for (var e = 0; e < edges.Length; e++) callerEdges[fill[edges[e]]++] = i;
+        }
+
+        var result = new byte[count];
+        Array.Copy(local, result, count);
+        var queued = new bool[count];
+        var queue = new Queue<int>(count);
+        for (var i = 0; i < count; i++)
+        {
+            queue.Enqueue(i);
+            queued[i] = true;
+        }
+        while (queue.TryDequeue(out var index))
+        {
+            queued[index] = false;
+            var mask = local[index];
+            var edges = callees[index];
+            for (var e = 0; e < edges.Length; e++) mask |= result[edges[e]];
+            if (mask == result[index]) continue;
+            result[index] = mask;
+            for (var e = callerStart[index]; e < callerStart[index + 1]; e++)
+            {
+                var caller = callerEdges[e];
+                if (queued[caller]) continue;
+                queued[caller] = true;
+                queue.Enqueue(caller);
+            }
+        }
+
+        var masks = new Dictionary<uint, byte>(count);
+        for (var i = 0; i < count; i++) masks[addresses[i]] = result[i];
+        return masks;
+    }
+
+    private static HashSet<uint> ComputeCompactReachable(
+        IReadOnlyDictionary<uint, GqrFunctionSummary> functions,
+        IReadOnlySet<uint> roots)
+    {
+        var reachable = new HashSet<uint>();
+        var queue = new Queue<uint>(roots);
+        while (queue.TryDequeue(out var address))
+        {
+            if (!reachable.Add(address)) continue;
+            foreach (var target in functions[address].DirectGuestTargets)
+                if (functions.ContainsKey(target) && !reachable.Contains(target))
+                    queue.Enqueue(target);
+        }
+        return reachable;
+    }
+
+    private static void TransferCompact(
+        GqrFunctionSummary function,
+        in GqrSummaryInstruction instruction,
+        Dictionary<int, uint> state,
+        Dictionary<int, uint>[]? predecessorOut,
+        Dictionary<uint, byte> calleeWriteMasks)
+    {
+        switch (instruction.Operation)
+        {
+            case GqrSummaryOperation.Assign:
+                SetOrKillCompact(instruction.Destination, instruction.Left, state);
+                break;
+            case GqrSummaryOperation.Binary:
+                if (TryCompactValue(instruction.Left, state, out var left) &&
+                    TryCompactValue(instruction.Right, state, out var right) &&
+                    TryCompactBinary(instruction.BinaryOperation, left, right, out var result))
+                    state[instruction.Destination] = result;
+                else
+                    state.Remove(instruction.Destination);
+                break;
+            case GqrSummaryOperation.Phi:
+            {
+                var phiSources = instruction.PhiSources;
+                if (predecessorOut is not null && phiSources is { Length: > 0 })
+                {
+                    uint? value = null;
+                    var valid = true;
+                    foreach (var source in phiSources)
+                    {
+                        if (source.Predecessor < 0 ||
+                            !predecessorOut[source.Predecessor].TryGetValue(source.Variable, out var incoming) ||
+                            (value.HasValue && value.Value != incoming))
+                        {
+                            valid = false;
+                            break;
+                        }
+                        value = incoming;
+                    }
+                    if (valid && value.HasValue) state[instruction.Destination] = value.Value;
+                    else state.Remove(instruction.Destination);
+                }
+                else
+                    state.Remove(instruction.Destination);
+                break;
+            }
+            case GqrSummaryOperation.Kill:
+                state.Remove(instruction.Destination);
+                break;
+            case GqrSummaryOperation.GuestCall:
+            {
+                var writeMask = instruction.CallTargetKnown &&
+                                calleeWriteMasks.TryGetValue(instruction.CallTarget, out var knownMask)
+                    ? knownMask
+                    : (byte)0xFF;
+                if (writeMask == 0xFF)
+                {
+                    state.Clear();
+                    break;
+                }
+
+                byte preservedMask = 0;
+                Span<uint> preserved = stackalloc uint[GqrCount];
+                foreach (var pair in state)
+                {
+                    var affinity = function.GetGqrAffinity(pair.Key);
+                    if (affinity < 0 || (writeMask & (1 << affinity)) != 0) continue;
+                    preservedMask |= (byte)(1 << affinity);
+                    preserved[affinity] = pair.Value;
+                }
+                state.Clear();
+                for (var slot = 0; slot < GqrCount; slot++)
+                    if ((preservedMask & (1 << slot)) != 0)
+                        state[slot] = preserved[slot];
+                break;
+            }
+            case GqrSummaryOperation.IndirectCall:
+                state.Clear();
+                break;
+        }
+    }
+
+    private static void SetOrKillCompact(
+        int destination,
+        GqrSummaryValue value,
+        Dictionary<int, uint> state)
+    {
+        if (TryCompactValue(value, state, out var constant)) state[destination] = constant;
+        else state.Remove(destination);
+    }
+
+    private static bool TryCompactValue(
+        GqrSummaryValue value,
+        Dictionary<int, uint> state,
+        out uint constant)
+    {
+        if (value.Kind == 2) { constant = value.Constant; return true; }
+        if (value.Kind == 1 && state.TryGetValue(value.Variable, out constant)) return true;
+        constant = 0;
+        return false;
+    }
+
+    private static bool TryCompactBinary(
+        GqrBinaryOperation operation,
+        uint left,
+        uint right,
+        out uint value)
+    {
+        value = operation switch
+        {
+            GqrBinaryOperation.Add => unchecked(left + right),
+            GqrBinaryOperation.Subtract => unchecked(left - right),
+            GqrBinaryOperation.Or => left | right,
+            GqrBinaryOperation.And => left & right,
+            GqrBinaryOperation.Xor => left ^ right,
+            GqrBinaryOperation.ShiftLeft => left << ((int)right & 31),
+            GqrBinaryOperation.RotateLeft => (left << ((int)right & 31)) | (left >> ((32 - (int)right) & 31)),
+            GqrBinaryOperation.ShiftRight => left >> ((int)right & 31),
+            _ => 0
+        };
+        return operation != GqrBinaryOperation.Unknown;
+    }
+
+    /// <summary>
+    /// Writes the must-constant intersection of the selected predecessor outputs
+    /// into <paramref name="destination"/>, preserving the first predecessor's
+    /// key order exactly as the copy-then-prune formulation did.
+    /// </summary>
+    private static void CompactIntersectInto(
+        Dictionary<int, uint>[] output,
+        int[] predecessors,
+        int predecessorCount,
+        Dictionary<int, uint> destination)
+    {
+        var first = output[predecessors[0]];
+        foreach (var pair in first)
+        {
+            var keep = true;
+            for (var i = 1; i < predecessorCount; i++)
+            {
+                if (output[predecessors[i]].TryGetValue(pair.Key, out var value) && value == pair.Value) continue;
+                keep = false;
+                break;
+            }
+            if (keep) destination[pair.Key] = pair.Value;
+        }
+    }
+
+    private static bool CompactSame(
+        Dictionary<int, uint> left,
+        Dictionary<int, uint> right)
+    {
+        if (left.Count != right.Count) return false;
+        foreach (var pair in left)
+            if (!right.TryGetValue(pair.Key, out var value) || value != pair.Value)
+                return false;
+        return true;
+    }
+
+}
diff --git a/translator/src/Translator.Core/Translation/LeafFunctionInliner.cs b/translator/src/Translator.Core/Translation/LeafFunctionInliner.cs
new file mode 100644
index 0000000..59c727f
--- /dev/null
+++ b/translator/src/Translator.Core/Translation/LeafFunctionInliner.cs
@@ -0,0 +1,757 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using Translator.Core.Analysis;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+
+namespace Translator.Core.Translation;
+
+/// <summary>
+/// Why a direct call target was not admitted for inlining. Recorded so the
+/// classifier can be exercised directly by tests and reported by tooling
+/// without re-deriving the decision from emitted text.
+/// </summary>
+public enum LeafInlineRejection
+{
+    None = 0,
+    ExcludedAddress,
+    BlockedAddress,
+    DecodeFailed,
+    MultipleBlocks,
+    NoTerminatingReturn,
+    ControlFlow,
+    GuestCall,
+    OpaqueHelper,
+    TouchesLinkRegister,
+    TouchesStackPointer,
+    Undefined,
+    TooLarge,
+    FullSynchronizationFence,
+
+    /// <summary>
+    /// The callee's control flow contains a back edge. A loop cannot be spliced
+    /// by the block-copying path, which reproduces the callee's CFG as a
+    /// one-way region between the call point and its continuation.
+    /// </summary>
+    CyclicControlFlow
+}
+
+/// <summary>A leaf callee that may be spliced into its callers.</summary>
+/// <param name="EntryPoint">Guest entry point of the callee.</param>
+/// <param name="Body">Straight-line IR with the terminating <see cref="IrReturn"/> removed so it falls
+/// into the caller's continuation. Empty when <paramref name="Blocks"/> carries the callee instead.</param>
+/// <param name="GuestInstructionCount">Distinct guest instructions covered.</param>
+/// <param name="Blocks">Null for a straight line, otherwise the callee's own basic blocks; the splice
+/// renames labels per call site and turns each return into a jump to the continuation.</param>
+public sealed record LeafInlineCandidate(
+    uint EntryPoint,
+    IReadOnlyList<IrInstruction> Body,
+    int GuestInstructionCount,
+    IReadOnlyList<IrBasicBlock>? Blocks = null)
+{
+    /// <summary>
+    /// IR instructions the splice adds to the caller, which is what the growth
+    /// budget is spent on.
+    /// </summary>
+    public int SplicedInstructionCount { get; } = Blocks is null
+        ? Body.Count
+        : Blocks.Sum(static block => block.Instructions.Count);
+}
+
+/// <summary>Admission rules for leaf inlining.</summary>
+/// <param name="MaxCalleeGuestInstructions">Largest callee that may be spliced.</param>
+/// <param name="MaxCallerGrowthPercent">Growth budget as a percentage of the caller's own IR size.</param>
+/// <param name="MinCallerGrowthInstructions">Floor for the growth budget, so a small caller can still absorb one leaf.</param>
+/// <param name="BlockedTargets">Addresses whose translated body loses to a native override, base-translation
+/// exclusion, or mod patch; inlining one would bypass that replacement.</param>
+public sealed record LeafInliningPolicy(
+    int MaxCalleeGuestInstructions = 32,
+    int MaxCallerGrowthPercent = 50,
+    int MinCallerGrowthInstructions = 48,
+    IReadOnlySet<uint>? BlockedTargets = null,
+    /// <summary>
+    /// Upper bound on the callee's IR block count. More than one block is admitted only for a
+    /// proven straight line, e.g. a <c>cmpwi</c>/<c>blr</c> leaf the decoder splits into a
+    /// conditional-branch group of two blocks that still execute in sequence.
+    /// </summary>
+    int MaxCalleeBlocks = 4,
+    /// <summary>
+    /// Admit a callee whose blocks are not a straight line, provided its CFG is
+    /// a one-way region: no back edge, every block reachable from the entry and
+    /// every exit a return. Emergency opt-out for the whole transform.
+    /// </summary>
+    bool AllowAcyclicMultiBlockCallees = true,
+    /// <summary>
+    /// Upper bound on the block count of an acyclic multi-block callee. Every
+    /// block becomes a block of the caller, so this bounds how much CFG a single
+    /// call site can add.
+    /// </summary>
+    int MaxCalleeAcyclicBlocks = 8)
+{
+    public bool IsBlocked(uint address) => BlockedTargets?.Contains(address) == true;
+}
+
+public sealed record LeafInliningResult(
+    IrFunction Function,
+    int InlinedCallSites,
+    int InlinedGuestInstructions);
+
+/// <summary>
+/// IR-level inlining of tiny, call-free leaf functions. Splices on linear IR before SSA construction
+/// so the callee's guest instructions become ordinary caller instructions for every downstream analysis.
+/// The callee is still emitted standalone too; only the caller's direct-call edge disappears.
+/// </summary>
+public static class LeafFunctionInliner
+{
+    /// <summary>
+    /// Rewrites <paramref name="function"/> so that every admitted direct call
+    /// is replaced by the callee's body. <paramref name="candidateProvider"/>
+    /// returns null for a target that cannot be inlined.
+    /// </summary>
+    public static LeafInliningResult Inline(
+        IrFunction function,
+        LeafInliningPolicy policy,
+        Func<uint, LeafInlineCandidate?> candidateProvider)
+    {
+        ArgumentNullException.ThrowIfNull(function);
+        ArgumentNullException.ThrowIfNull(policy);
+        ArgumentNullException.ThrowIfNull(candidateProvider);
+
+        var baseline = function.Blocks.Sum(static block => block.Instructions.Count);
+        var allowance = Math.Max(
+            policy.MinCallerGrowthInstructions,
+            (int)((long)baseline * policy.MaxCallerGrowthPercent / 100));
+        var spent = 0;
+        var sites = 0;
+        var guestInstructions = 0;
+        var rewritten = new List<IrBasicBlock>(function.Blocks.Count);
+        var changed = false;
+
+        foreach (var block in function.Blocks)
+        {
+            List<IrInstruction>? output = null;
+            // The block being filled. A multi-block splice cuts the caller's
+            // block in two, and everything after the call site continues in the
+            // continuation block instead of the original one.
+            var currentLabel = block.Label;
+            var source = block.Instructions;
+            for (var index = 0; index < source.Count; index++)
+            {
+                var instruction = source[index];
+                if (spent < allowance &&
+                    TryMatchCallSite(source, index, out var target, out var shape) &&
+                    candidateProvider(target) is { } candidate &&
+                    spent + candidate.SplicedInstructionCount <= allowance)
+                {
+                    output ??= new List<IrInstruction>(source.Take(index));
+                    if (shape == CallSiteShape.Linked)
+                    {
+                        // Drop the `lr = <return address>` the call form wrote; nothing can observe it
+                        // once the call is gone, since the callee is proven not to touch LR.
+                        output.RemoveAt(output.Count - 1);
+                    }
+
+                    output.Add(new IrComment(
+                        $"inline leaf 0x{candidate.EntryPoint:X8} ({candidate.GuestInstructionCount} guest instruction(s))"));
+                    if (candidate.Blocks is null)
+                    {
+                        output.AddRange(candidate.Body);
+                        output.Add(new IrComment($"end of inlined leaf 0x{candidate.EntryPoint:X8}"));
+                    }
+                    else
+                    {
+                        // The callee's blocks become caller blocks between the call site and the
+                        // continuation. Labels are suffixed with the call site's ordinal, so the same
+                        // callee can be spliced twice and no spliced label reads back as a guest address.
+                        var continuation = ContinuationLabel(sites, candidate.EntryPoint);
+                        var spliced = RenameSplicedBlocks(candidate.Blocks, sites, continuation);
+                        output.Add(new IrJump(spliced[0].Label));
+                        rewritten.Add(new IrBasicBlock(currentLabel, output));
+                        rewritten.AddRange(spliced);
+                        currentLabel = continuation;
+                        output = new List<IrInstruction>
+                        {
+                            new IrComment($"end of inlined leaf 0x{candidate.EntryPoint:X8}")
+                        };
+                    }
+
+                    spent += candidate.SplicedInstructionCount;
+                    sites++;
+                    guestInstructions += candidate.GuestInstructionCount;
+                    changed = true;
+                    continue;
+                }
+
+                output?.Add(instruction);
+            }
+
+            rewritten.Add(output is null ? block : new IrBasicBlock(currentLabel, output));
+        }
+
+        return changed
+            ? new LeafInliningResult(
+                new IrFunction(function.Name, function.EntryLabel, rewritten), sites, guestInstructions)
+            : new LeafInliningResult(function, 0, 0);
+    }
+
+    /// <summary>
+    /// Classifies a decoded callee, returning null and a reason when it's outside the safe subset.
+    /// Tried against the straight-line classifier first, so a body admitted before this file grew a
+    /// second shape still produces the same splice.
+    /// </summary>
+    public static LeafInlineCandidate? TryCreateCandidate(
+        uint entryPoint,
+        IrFunction callee,
+        IReadOnlyList<PpcInstruction> calleeInstructions,
+        LeafInliningPolicy policy,
+        out LeafInlineRejection rejection)
+    {
+        ArgumentNullException.ThrowIfNull(callee);
+        ArgumentNullException.ThrowIfNull(policy);
+
+        // A replacement anywhere inside the decoded body counts, not just at the
+        // entry: splicing would silently keep running the original bytes of a
+        // region that the runtime resolves elsewhere.
+        if (policy.IsBlocked(entryPoint) ||
+            (calleeInstructions is not null &&
+             calleeInstructions.Any(instruction => policy.IsBlocked(instruction.Address))))
+        {
+            rejection = LeafInlineRejection.BlockedAddress;
+            return null;
+        }
+
+        if (callee.Blocks.Count == 0 ||
+            !string.Equals(callee.Blocks[0].Label, callee.EntryLabel, StringComparison.OrdinalIgnoreCase))
+        {
+            rejection = LeafInlineRejection.MultipleBlocks;
+            return null;
+        }
+
+        var straightLine = TryCreateStraightLineCandidate(entryPoint, callee, policy, out rejection);
+        if (straightLine is not null)
+        {
+            return straightLine;
+        }
+
+        if (!policy.AllowAcyclicMultiBlockCallees || callee.Blocks.Count < 2)
+        {
+            return null;
+        }
+
+        var acyclic = TryCreateAcyclicCandidate(entryPoint, callee, policy, out var acyclicRejection);
+        if (acyclic is not null)
+        {
+            rejection = LeafInlineRejection.None;
+            return acyclic;
+        }
+
+        // Both shapes refused. "This is not a straight line" is no longer a
+        // reason on its own, so whichever scan found a substantive blocker gets
+        // to report it; when the acyclic scan only objected to the shape as
+        // well, the straight-line verdict stands.
+        if (acyclicRejection is not (LeafInlineRejection.ControlFlow or LeafInlineRejection.MultipleBlocks))
+        {
+            rejection = acyclicRejection;
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// The original admission rule: one to <see cref="LeafInliningPolicy.MaxCalleeBlocks"/>
+    /// blocks that provably execute as one straight line, spliced as a flat
+    /// statement list.
+    /// </summary>
+    private static LeafInlineCandidate? TryCreateStraightLineCandidate(
+        uint entryPoint,
+        IrFunction callee,
+        LeafInliningPolicy policy,
+        out LeafInlineRejection rejection)
+    {
+        if (callee.Blocks.Count > policy.MaxCalleeBlocks)
+        {
+            rejection = LeafInlineRejection.MultipleBlocks;
+            return null;
+        }
+
+        // Concatenating the blocks is only sound for a straight line. The
+        // per-instruction check below rejects every control transfer, and the
+        // guest addresses are then verified to run contiguously from the entry
+        // point, which proves the blocks execute in this order with nothing
+        // else able to enter them.
+        var instructions = callee.Blocks.Count == 1
+            ? callee.Blocks[0].Instructions
+            : callee.Blocks.SelectMany(static block => block.Instructions).ToArray();
+        if (instructions.Count == 0 || instructions[^1] is not IrReturn)
+        {
+            rejection = LeafInlineRejection.NoTerminatingReturn;
+            return null;
+        }
+
+        var guestAddresses = new HashSet<uint>();
+        var expectedAddress = entryPoint;
+        for (var index = 0; index < instructions.Count - 1; index++)
+        {
+            var instruction = instructions[index];
+            if (instruction is IrTracePpc trace)
+            {
+                if (trace.Address != expectedAddress)
+                {
+                    rejection = LeafInlineRejection.ControlFlow;
+                    return null;
+                }
+
+                expectedAddress += 4;
+                guestAddresses.Add(trace.Address);
+                continue;
+            }
+
+            rejection = ClassifyBodyInstruction(instruction);
+            if (rejection != LeafInlineRejection.None)
+            {
+                return null;
+            }
+        }
+
+        if (guestAddresses.Count > policy.MaxCalleeGuestInstructions)
+        {
+            rejection = LeafInlineRejection.TooLarge;
+            return null;
+        }
+
+        var wholeBodyRejection = ClassifyWholeBody(callee);
+        if (wholeBodyRejection != LeafInlineRejection.None)
+        {
+            rejection = wholeBodyRejection;
+            return null;
+        }
+
+        rejection = LeafInlineRejection.None;
+        // The terminating blr becomes a fall-through into the caller.
+        return new LeafInlineCandidate(
+            entryPoint,
+            instructions.Take(instructions.Count - 1).ToArray(),
+            guestAddresses.Count);
+    }
+
+    /// <summary>
+    /// Admits a callee whose blocks form a one-way region (reachable from entry, no back edge, every
+    /// exit a plain return) instead of a straight line. Label renaming plus rewriting returns as jumps
+    /// to one continuation reconnects it; the no-back-edge rule is what keeps it a region, not a loop.
+    /// </summary>
+    private static LeafInlineCandidate? TryCreateAcyclicCandidate(
+        uint entryPoint,
+        IrFunction callee,
+        LeafInliningPolicy policy,
+        out LeafInlineRejection rejection)
+    {
+        if (callee.Blocks.Count > policy.MaxCalleeAcyclicBlocks)
+        {
+            rejection = LeafInlineRejection.MultipleBlocks;
+            return null;
+        }
+
+        var indexByLabel = new Dictionary<string, int>(
+            callee.Blocks.Count, StringComparer.OrdinalIgnoreCase);
+        for (var index = 0; index < callee.Blocks.Count; index++)
+        {
+            if (!indexByLabel.TryAdd(callee.Blocks[index].Label, index))
+            {
+                rejection = LeafInlineRejection.ControlFlow;
+                return null;
+            }
+        }
+
+        var normalized = new IrBasicBlock[callee.Blocks.Count];
+        var successors = new int[callee.Blocks.Count][];
+        var guestAddresses = new HashSet<uint>();
+        var hasReturn = false;
+
+        for (var index = 0; index < callee.Blocks.Count; index++)
+        {
+            var block = callee.Blocks[index];
+            if (block.Instructions.Count == 0)
+            {
+                // The CFG builder gives an empty block no successor at all while
+                // the emitter falls through it. Refuse the disagreement rather
+                // than pick a side.
+                rejection = LeafInlineRejection.ControlFlow;
+                return null;
+            }
+
+            var terminator = block.Instructions[^1];
+            switch (terminator)
+            {
+                case IrReturn { Value: null }:
+                    successors[index] = Array.Empty<int>();
+                    normalized[index] = block;
+                    hasReturn = true;
+                    break;
+                case IrJump jump when indexByLabel.TryGetValue(jump.TargetLabel, out var jumpTarget):
+                    successors[index] = [jumpTarget];
+                    normalized[index] = block;
+                    break;
+                case IrBranch branch
+                    when indexByLabel.TryGetValue(branch.TrueLabel, out var trueTarget) &&
+                         indexByLabel.TryGetValue(branch.FalseLabel, out var falseTarget):
+                    successors[index] = [trueTarget, falseTarget];
+                    normalized[index] = block;
+                    break;
+                case IrReturn or IrJump or IrBranch or IrIndirectJump or IrJumpTable:
+                    // A return that carries a value, or a transfer to a label
+                    // outside the decoded body.
+                    rejection = LeafInlineRejection.ControlFlow;
+                    return null;
+                case IrUndefined:
+                    rejection = LeafInlineRejection.Undefined;
+                    return null;
+                default:
+                    if (index + 1 >= callee.Blocks.Count)
+                    {
+                        rejection = LeafInlineRejection.NoTerminatingReturn;
+                        return null;
+                    }
+
+                    successors[index] = [index + 1];
+                    normalized[index] = new IrBasicBlock(
+                        block.Label,
+                        [.. block.Instructions, new IrJump(callee.Blocks[index + 1].Label)]);
+                    break;
+            }
+
+            var scanCount = terminator is IrReturn or IrJump or IrBranch
+                ? block.Instructions.Count - 1
+                : block.Instructions.Count;
+            var sawGuestInstruction = false;
+            for (var position = 0; position < scanCount; position++)
+            {
+                var instruction = block.Instructions[position];
+                if (instruction is IrTracePpc trace)
+                {
+                    if (!guestAddresses.Add(trace.Address))
+                    {
+                        // The same guest instruction reached twice means the
+                        // decode overlapped itself, not a region.
+                        rejection = LeafInlineRejection.ControlFlow;
+                        return null;
+                    }
+
+                    sawGuestInstruction = true;
+                    continue;
+                }
+
+                rejection = ClassifyBodyInstruction(instruction);
+                if (rejection != LeafInlineRejection.None)
+                {
+                    return null;
+                }
+            }
+
+            if (!sawGuestInstruction &&
+                (block.Instructions.Count != 1 || block.Instructions[0] is not IrReturn))
+            {
+                // The synthetic return block is the only block the front end
+                // creates with no guest instruction behind it. Anything else
+                // with no trace is a stand-in for a target that was never
+                // decoded, and its behaviour is not this callee's.
+                rejection = LeafInlineRejection.ControlFlow;
+                return null;
+            }
+        }
+
+        if (!hasReturn)
+        {
+            rejection = LeafInlineRejection.NoTerminatingReturn;
+            return null;
+        }
+
+        if (guestAddresses.Count == 0)
+        {
+            rejection = LeafInlineRejection.ControlFlow;
+            return null;
+        }
+
+        if (guestAddresses.Count > policy.MaxCalleeGuestInstructions)
+        {
+            rejection = LeafInlineRejection.TooLarge;
+            return null;
+        }
+
+        // The decoded body must be exactly the contiguous run that starts at the
+        // entry point. A gap, or an address below the entry, means the decode
+        // covered something other than the function this splice claims to be.
+        var lastAddress = entryPoint + (uint)((guestAddresses.Count - 1) * 4);
+        foreach (var address in guestAddresses)
+        {
+            if (address < entryPoint || address > lastAddress || (address - entryPoint) % 4 != 0)
+            {
+                rejection = LeafInlineRejection.ControlFlow;
+                return null;
+            }
+        }
+
+        var visitState = new byte[normalized.Length];
+        if (!IsAcyclicFrom(0, successors, visitState))
+        {
+            rejection = LeafInlineRejection.CyclicControlFlow;
+            return null;
+        }
+
+        foreach (var state in visitState)
+        {
+            if (state != VisitedCompletely)
+            {
+                // An unreachable block is dead code the caller would still have
+                // to carry, and it is evidence the decode is not the shape this
+                // classifier thinks it is.
+                rejection = LeafInlineRejection.ControlFlow;
+                return null;
+            }
+        }
+
+        var wholeBodyRejection = ClassifyWholeBody(callee);
+        if (wholeBodyRejection != LeafInlineRejection.None)
+        {
+            rejection = wholeBodyRejection;
+            return null;
+        }
+
+        rejection = LeafInlineRejection.None;
+        return new LeafInlineCandidate(
+            entryPoint, Array.Empty<IrInstruction>(), guestAddresses.Count, normalized);
+    }
+
+    private const byte VisitedInProgress = 1;
+    private const byte VisitedCompletely = 2;
+
+    /// <summary>
+    /// Depth-first walk that fails on the first back edge and marks everything
+    /// it reaches, so the caller can also read off reachability.
+    /// </summary>
+    private static bool IsAcyclicFrom(int index, int[][] successors, byte[] visitState)
+    {
+        visitState[index] = VisitedInProgress;
+        foreach (var next in successors[index])
+        {
+            if (visitState[next] == VisitedInProgress)
+            {
+                return false;
+            }
+
+            if (visitState[next] != VisitedCompletely && !IsAcyclicFrom(next, successors, visitState))
+            {
+                return false;
+            }
+        }
+
+        visitState[index] = VisitedCompletely;
+        return true;
+    }
+
+    /// <summary>
+    /// Per-instruction rules shared by both admission shapes: no control transfer, nothing opaque,
+    /// nothing touching the link register whose write the call form just dropped. Terminators are
+    /// classified by the callers, which know where a block ends.
+    /// </summary>
+    private static LeafInlineRejection ClassifyBodyInstruction(IrInstruction instruction)
+    {
+        switch (instruction)
+        {
+            case IrBranch or IrJump or IrIndirectJump or IrJumpTable or IrReturn or IrPhi:
+                return LeafInlineRejection.ControlFlow;
+            case IrIndirectCall:
+                return LeafInlineRejection.GuestCall;
+            case IrUndefined:
+                return LeafInlineRejection.Undefined;
+            case IrCall call:
+                if (TryParseGuestAddress(call.Target, out _))
+                {
+                    return LeafInlineRejection.GuestCall;
+                }
+
+                var effect = GuestHelperEffectCatalog.Analyze(call);
+                if (effect.BoundaryFlags != GuestCallBoundaryFlags.None)
+                {
+                    // Unknown helpers and every synchronization boundary
+                    // (OSSystemCall and friends) are complete-context by
+                    // construction, so this also covers requirement of no
+                    // full-synchronization fences inside the callee.
+                    return LeafInlineRejection.OpaqueHelper;
+                }
+
+                if (effect.ReadsLr || effect.WritesLr)
+                {
+                    return LeafInlineRejection.TouchesLinkRegister;
+                }
+
+                break;
+        }
+
+        return TouchesLinkRegister(instruction)
+            ? LeafInlineRejection.TouchesLinkRegister
+            : LeafInlineRejection.None;
+    }
+
+    /// <summary>
+    /// Rejects effects only visible once the whole body is analyzed. A callee that adjusts r1 would
+    /// create a nested stack-pointer epoch when copied into the caller, but the stack-address/save-restore
+    /// passes model one entry stack pointer per function, risking aliased caller stack slots.
+    /// </summary>
+    private static LeafInlineRejection ClassifyWholeBody(IrFunction callee)
+    {
+        var contract = GuestAbiContractAnalyzer.Analyze(callee);
+        if (contract.HasFullSynchronizationFence)
+        {
+            return LeafInlineRejection.FullSynchronizationFence;
+        }
+
+        return (contract.GprPossibleWriteMask & (1u << 1)) != 0
+            ? LeafInlineRejection.TouchesStackPointer
+            : LeafInlineRejection.None;
+    }
+
+    /// <summary>
+    /// Label of the block the spliced region's returns jump to, which is where
+    /// the caller resumes. It cannot be read back as a guest address, so the
+    /// emitter never mistakes it for an interior resume point of the caller.
+    /// </summary>
+    private static string ContinuationLabel(int callSiteOrdinal, uint entryPoint) =>
+        $"inl{callSiteOrdinal}_cont_{entryPoint:X8}";
+
+    private static string SplicedBlockLabel(int callSiteOrdinal, string calleeLabel) =>
+        $"inl{callSiteOrdinal}_{calleeLabel}";
+
+    /// <summary>
+    /// Copies the callee's blocks under call-site-local labels and reconnects their returns to
+    /// <paramref name="continuation"/>. The classifier already proved return/jump/branch only
+    /// appear as block terminators, so the rewrite below cannot fire on anything else.
+    /// </summary>
+    private static IrBasicBlock[] RenameSplicedBlocks(
+        IReadOnlyList<IrBasicBlock> blocks, int callSiteOrdinal, string continuation)
+    {
+        // Targets are resolved through the block they name rather than by
+        // suffixing the target string, so a transfer and its block agree
+        // character for character even where the front end spelled the same
+        // label with different casing.
+        var renamedByLabel = new Dictionary<string, string>(
+            blocks.Count, StringComparer.OrdinalIgnoreCase);
+        foreach (var block in blocks)
+        {
+            renamedByLabel[block.Label] = SplicedBlockLabel(callSiteOrdinal, block.Label);
+        }
+
+        string Target(string label) => renamedByLabel.TryGetValue(label, out var renamed)
+            ? renamed
+            : SplicedBlockLabel(callSiteOrdinal, label);
+
+        var spliced = new IrBasicBlock[blocks.Count];
+        for (var index = 0; index < blocks.Count; index++)
+        {
+            var block = blocks[index];
+            var instructions = new List<IrInstruction>(block.Instructions.Count);
+            foreach (var instruction in block.Instructions)
+            {
+                instructions.Add(instruction switch
+                {
+                    IrReturn => new IrJump(continuation),
+                    IrJump jump => new IrJump(Target(jump.TargetLabel)),
+                    IrBranch branch => branch with
+                    {
+                        TrueLabel = Target(branch.TrueLabel),
+                        FalseLabel = Target(branch.FalseLabel)
+                    },
+                    _ => instruction
+                });
+            }
+
+            spliced[index] = new IrBasicBlock(renamedByLabel[block.Label], instructions);
+        }
+
+        return spliced;
+    }
+
+    internal enum CallSiteShape
+    {
+        Linked,
+        Tail
+    }
+
+    /// <summary>
+    /// Recognizes only the two direct-call forms the lifter produces: <c>bl</c> lowers to
+    /// <c>lr = &lt;return address&gt;</c> then the call, and <c>b</c> to an external function lowers to
+    /// a call immediately followed by the caller's return.
+    /// </summary>
+    internal static bool TryMatchCallSite(
+        IReadOnlyList<IrInstruction> instructions,
+        int index,
+        out uint target,
+        out CallSiteShape shape)
+    {
+        target = 0;
+        shape = CallSiteShape.Linked;
+        if (instructions[index] is not IrCall call ||
+            !string.IsNullOrWhiteSpace(call.Destination) ||
+            !TryParseGuestAddress(call.Target, out target))
+        {
+            return false;
+        }
+
+        // Every decoded guest instruction contributes one trace, appended after
+        // the call it was lifted from.
+        if (index + 1 >= instructions.Count || instructions[index + 1] is not IrTracePpc trace)
+        {
+            return false;
+        }
+
+        if (index > 0 &&
+            instructions[index - 1] is IrAssign { Value.Kind: "const" } assign &&
+            IsLinkRegister(assign.Destination))
+        {
+            if (assign.Value.Constant is not { } linkValue ||
+                unchecked((uint)linkValue) != trace.Address + 4u)
+            {
+                return false;
+            }
+
+            shape = CallSiteShape.Linked;
+            return true;
+        }
+
+        if (index + 2 < instructions.Count && instructions[index + 2] is IrReturn)
+        {
+            shape = CallSiteShape.Tail;
+            return true;
+        }
+
+        return false;
+    }
+
+    internal static bool TryParseGuestAddress(string? target, out uint address)
+    {
+        address = 0;
+        return target is { Length: > 2 } &&
+               target.StartsWith("0x", StringComparison.OrdinalIgnoreCase) &&
+               uint.TryParse(
+                   target.AsSpan(2), NumberStyles.HexNumber, CultureInfo.InvariantCulture, out address);
+    }
+
+    private static bool TouchesLinkRegister(IrInstruction instruction)
+    {
+        foreach (var name in IrRegisterDataFlow.Definitions(instruction))
+        {
+            if (IsLinkRegister(name)) return true;
+        }
+
+        foreach (var name in IrRegisterDataFlow.Uses(instruction))
+        {
+            if (IsLinkRegister(name)) return true;
+        }
+
+        return false;
+    }
+
+    private static bool IsLinkRegister(string name) =>
+        RegisterNameUtils.HardwareBase(name).Equals("lr", StringComparison.OrdinalIgnoreCase);
+}
diff --git a/translator/src/Translator.Core/Translator.Core.csproj b/translator/src/Translator.Core/Translator.Core.csproj
new file mode 100644
index 0000000..37eaff5
--- /dev/null
+++ b/translator/src/Translator.Core/Translator.Core.csproj
@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+  </PropertyGroup>
+</Project>
diff --git a/translator/tests/README.md b/translator/tests/README.md
new file mode 100644
index 0000000..8fc649f
--- /dev/null
+++ b/translator/tests/README.md
@@ -0,0 +1,21 @@
+# Translator tests
+
+`Translator.Tests` is the default binary-free suite. It covers the decoder, IR/SSA, code
+generation helpers, parsers with synthetic inputs, project-manifest loading, DOL-only image
+construction, and generic entry-point translation.
+
+The older asset-backed and host-C++-compiler-backed test sources are intentionally retained in
+`Translator.Tests` but excluded in its project file. They mixed MKWii fixtures, several compiler
+selection strategies, and private-method reflection checks, which made the normal suite both slow
+and red on a clean Windows setup. They should become a separate opt-in integration project when
+that work is useful again.
+
+An external generic DOL can be included without adding it to the repository:
+
+```powershell
+$env:RECOMP_GENERIC_DOL = 'D:\path\to\main.dol'
+dotnet test translator/Translator.sln -c Release
+```
+
+The test treats the file as a generic DOL: it reads the DOL entry point, builds a DOL-only image,
+and translates that entry point without game-specific addresses or bindings.
diff --git a/translator/tests/Translator.Tests/AbiStackSaveRestoreCodeGenTests.cs b/translator/tests/Translator.Tests/AbiStackSaveRestoreCodeGenTests.cs
new file mode 100644
index 0000000..dcbf62f
--- /dev/null
+++ b/translator/tests/Translator.Tests/AbiStackSaveRestoreCodeGenTests.cs
@@ -0,0 +1,671 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class ResidentAbiCodeGenTests
+{
+    [Fact]
+    public void StateFreeLeafVariantHasOnlyLiveNativeInputsAndNoCpuContext()
+    {
+        var function = new IrFunction("state_free_store", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrStore(new IrAddress("r3", 4), IrValue.Register("r4"), 4),
+                new IrReturn(null)
+            })
+        });
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80063FF0,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_store", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+            {
+                ["r3"] = ValueRepresentation.UInt32,
+                ["r4"] = ValueRepresentation.UInt32
+            }),
+            emitStateFreeLeafVariant: true,
+            stateFreeCallSymbols: new Dictionary<uint, string>
+            {
+                [0x80063FF0] = "state_free_store_native"
+            },
+            stateFreeEntryVariants: new[]
+            {
+                new GuestStateFreeCallVariant(
+                    0x80063FF0, "state_free_store_native_v0", GuestAbiContractAnalyzer.Analyze(function))
+            });
+
+        var variantStart = code.IndexOf(
+            "state_free_store_native(uint32_t native_r3, uint32_t native_r4)",
+            StringComparison.Ordinal);
+        Assert.True(variantStart >= 0, code);
+        var markerEnd = code.IndexOf('\n', code.IndexOf("RECOMP_STATE_FREE_ABI", variantStart, StringComparison.Ordinal));
+        var variant = code[variantStart..markerEnd];
+        Assert.Contains("uint32_t native_r3, uint32_t native_r4", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("CpuContext", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("native_r5", variant, StringComparison.Ordinal);
+        Assert.Contains("RECOMP_STATE_FREE_ABI", variant, StringComparison.Ordinal);
+        Assert.Contains(
+            "extern \"C\" MKW_PPC_ALWAYS_INLINE_BODY void state_free_store_native_v0(",
+            code,
+            StringComparison.Ordinal);
+
+        var publicStart = code.IndexOf(
+            "extern \"C\" void state_free_store(CpuContext* MKW_RESTRICT ctx)",
+            StringComparison.Ordinal);
+        var publicEnd = code.IndexOf(
+            "extern \"C\" MKW_PPC_ALWAYS_INLINE_BODY",
+            publicStart,
+            StringComparison.Ordinal);
+        var publicBody = code[publicStart..publicEnd];
+        Assert.Contains("r3", publicBody, StringComparison.Ordinal);
+        Assert.DoesNotContain("cached_r3", publicBody, StringComparison.Ordinal);
+        Assert.Contains("cached_r3", variant, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StateFreeLeafElidesDeadLrAssignmentWithNoncanonicalSource()
+    {
+        const uint address = 0x80063FE0u;
+        var function = new IrFunction("state_free_dead_lr", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("lr", IrValue.Register("r0")),
+                new IrReturn(null)
+            })
+        });
+        var planned = GuestAbiContractAnalyzer.Analyze(function) with { MayWriteLr = false };
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            address,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_dead_lr", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+            {
+                ["r0"] = ValueRepresentation.UInt32,
+                ["lr"] = ValueRepresentation.UInt32
+            }),
+            emitStateFreeLeafVariant: true,
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract> { [address] = planned },
+            stateFreeCallSymbols: new Dictionary<uint, string> { [address] = "state_free_dead_lr_native" });
+
+        var start = code.IndexOf("state_free_dead_lr_native(", StringComparison.Ordinal);
+        var marker = code.IndexOf("RECOMP_STATE_FREE_ABI", start, StringComparison.Ordinal);
+        var variant = code[start..marker];
+        Assert.DoesNotContain("ctx->lr", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("CpuContext", variant, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void DirectStateFreeCallUsesLiveArgumentsAndRetainsNormalAbiFallback()
+    {
+        const uint calleeAddress = 0x80063FF0u;
+        var function = new IrFunction("state_free_caller", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, $"0x{calleeAddress:X8}", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+        var contract = new GuestAbiContract(
+            GprReadBeforeWriteMask: (1u << 3) | (1u << 4),
+            GprPossibleWriteMask: 0,
+            GprReturnMask: 0,
+            FprReadBeforeWriteMask: 0,
+            FprPossibleWriteMask: 0,
+            FprReturnMask: 0,
+            CrReadBeforeWriteMask: 0,
+            CrPossibleWriteMask: 0,
+            ReadsXerBeforeWrite: false,
+            MayWriteXer: false,
+            ReadsCtrBeforeWrite: false,
+            MayWriteCtr: false,
+            ReadsLrBeforeWrite: false,
+            MayWriteLr: false,
+            BoundaryFlags: GuestCallBoundaryFlags.None,
+            DirectCallTargets: Array.Empty<uint>());
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80063FE0,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_caller", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            // The caller itself is emitted as a state-free interface so its own
+            // architectural GPRs live in native locals; that is what makes the
+            // direct state-free call site pass cached values instead of context.
+            emitStateFreeLeafVariant: true,
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract>
+            {
+                [calleeAddress] = contract,
+                [0x80063FE0u] = contract
+            },
+            stateFreeCallSymbols: new Dictionary<uint, string>
+            {
+                [calleeAddress] = "state_free_store_native",
+                [0x80063FE0u] = "state_free_caller_native"
+            });
+
+        Assert.Contains($"IsBaseTranslatedCpuTargetActive<0x{calleeAddress:X8}u>()", code, StringComparison.Ordinal);
+        Assert.Contains($"InvokeDirectCpu<0x{calleeAddress:X8}u>(ctx);", code, StringComparison.Ordinal);
+        // Inside the caller's own state-free body the call site must consume the
+        // native register locals; the retained public CpuContext entry keeps the
+        // ordinary ctx-based fallback and is deliberately excluded here.
+        var variantStart = code.IndexOf("void state_free_caller_native(", StringComparison.Ordinal);
+        Assert.True(variantStart >= 0, "Missing state-free variant for the caller.");
+        var variant = code[variantStart..code.IndexOf("RECOMP_STATE_FREE_ABI", variantStart, StringComparison.Ordinal)];
+        Assert.Contains("state_free_store_native(cached_r3, cached_r4);", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("state_free_store_native(ctx", variant, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void OversizedStateFreeRegionCannotBypassContextBoundary()
+    {
+        const uint calleeAddress = 0x80063FF0u;
+        var function = new IrFunction("oversized_state_free_caller", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, $"0x{calleeAddress:X8}", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+        var contract = new GuestAbiContract(
+            GprReadBeforeWriteMask: 0x1Fu,
+            GprPossibleWriteMask: 1u << 3,
+            GprReturnMask: 1u << 3,
+            FprReadBeforeWriteMask: 0,
+            FprPossibleWriteMask: 0,
+            FprReturnMask: 0,
+            CrReadBeforeWriteMask: 0,
+            CrPossibleWriteMask: 0,
+            ReadsXerBeforeWrite: false,
+            MayWriteXer: false,
+            ReadsCtrBeforeWrite: false,
+            MayWriteCtr: false,
+            ReadsLrBeforeWrite: false,
+            MayWriteLr: false,
+            BoundaryFlags: GuestCallBoundaryFlags.None,
+            DirectCallTargets: Array.Empty<uint>());
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80063FE0,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("oversized_state_free_caller", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract>
+            {
+                [calleeAddress] = contract
+            },
+            stateFreeCallSymbols: new Dictionary<uint, string>
+            {
+                [calleeAddress] = "oversized_state_free_native"
+            });
+
+        Assert.Contains("if (false) {", code, StringComparison.Ordinal);
+        Assert.Contains($"InvokeDirectCpu<0x{calleeAddress:X8}u>(ctx);", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ExactCallSiteCanSelectCompactSpecializedResultContract()
+    {
+        const uint calleeAddress = 0x80063FF0u;
+        var function = new IrFunction("state_free_specialized_caller", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, $"0x{calleeAddress:X8}", Array.Empty<IrValue>()),
+                new IrAssign("r7", IrValue.Imm(1)),
+                new IrCall(string.Empty, $"0x{calleeAddress:X8}", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+        var globalContract = new GuestAbiContract(
+            (1u << 3) | (1u << 5), (1u << 4) | (1u << 6), 0,
+            0, 0, 0, 0, 0,
+            false, false, false, false, false, false,
+            GuestCallBoundaryFlags.None, Array.Empty<uint>());
+        var specializedContract = globalContract with
+        {
+            GprReadBeforeWriteMask = 1u << 3,
+            GprPossibleWriteMask = 1u << 4
+        };
+        var variant = new GuestStateFreeCallVariant(
+            calleeAddress, "state_free_store_native_v0", specializedContract);
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80063FE0,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_specialized_caller", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract> { [calleeAddress] = globalContract },
+            stateFreeCallSymbols: new Dictionary<uint, string> { [calleeAddress] = "state_free_store_native" },
+            stateFreeCallSiteVariants: new Dictionary<GuestStateFreeCallSiteKey, GuestStateFreeCallVariant>
+            {
+                [new GuestStateFreeCallSiteKey("entry", calleeAddress, 0)] = variant
+            });
+
+        Assert.Contains("state_free_store_native_v0(r3)", code, StringComparison.Ordinal);
+        Assert.Contains("state_free_store_native(r3, r5)", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("state_free_store_native_v0(r5)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StateFreeDirectCallPassesDefinedFallthroughLrInsteadOfContextLr()
+    {
+        const uint calleeAddress = 0x80063FF0u;
+        var function = new IrFunction("state_free_lr_caller", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("lr", IrValue.Imm(0x80064008u)),
+                new IrCall("lr", $"0x{calleeAddress:X8}", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+        var contract = new GuestAbiContract(
+            1u << 3, 0, 0, 0, 0, 0, 0, 0,
+            false, false, false, false, true, false,
+            GuestCallBoundaryFlags.None, Array.Empty<uint>());
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80064000u,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_lr_caller", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract> { [calleeAddress] = contract },
+            stateFreeCallSymbols: new Dictionary<uint, string> { [calleeAddress] = "state_free_lr_native" });
+
+        Assert.Contains("state_free_lr_native(r3, 0x80064008u)", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("state_free_lr_native(r3, ctx->lr)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StateFreeLeafReturnsExplicitGprAndFprStateWithoutCpuContext()
+    {
+        var function = new IrFunction("state_free_results", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("r3", IrValue.Register("r4")),
+                new IrAssign("f1", IrValue.Register("f2")),
+                new IrReturn(null)
+            })
+        });
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80063FD0,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_results", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+            {
+                ["r3"] = ValueRepresentation.UInt32,
+                ["r4"] = ValueRepresentation.UInt32,
+                ["f1"] = ValueRepresentation.Float64,
+                ["f2"] = ValueRepresentation.Float64
+            }),
+            emitStateFreeLeafVariant: true,
+            stateFreeCallSymbols: new Dictionary<uint, string>
+            {
+                [0x80063FD0] = "state_free_results_native"
+            });
+
+        var variantStart = code.IndexOf("MkwStateFreeResult2 state_free_results_native(", StringComparison.Ordinal);
+        var markerEnd = code.IndexOf('\n', code.IndexOf("RECOMP_STATE_FREE_ABI", variantStart, StringComparison.Ordinal));
+        var variant = code[variantStart..markerEnd];
+        Assert.Contains("MkwStateFreeResult2", variant, StringComparison.Ordinal);
+        Assert.Contains("state_free_results_native(", variant, StringComparison.Ordinal);
+        Assert.Contains("PPC_FPR native_f1", variant, StringComparison.Ordinal);
+        Assert.Contains("PPC_FPR native_f2", variant, StringComparison.Ordinal);
+        Assert.Contains("return { static_cast<uint64_t>(cached_r3), cached_f1.raw };", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->", variant, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TwoValueSpecializationDoesNotReuseLargerAddressResultStruct()
+    {
+        const uint address = 0x80063FC0u;
+        var function = new IrFunction("state_free_result_collision", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("r3", IrValue.Imm(1)),
+                new IrAssign("r4", IrValue.Imm(2)),
+                new IrAssign("r5", IrValue.Imm(3)),
+                new IrReturn(null)
+            })
+        });
+        var publicContract = GuestAbiContractAnalyzer.Analyze(function);
+        var compactContract = publicContract with { GprPossibleWriteMask = (1u << 3) | (1u << 4) };
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            address,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_result_collision", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            emitStateFreeLeafVariant: true,
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract> { [address] = publicContract },
+            stateFreeCallSymbols: new Dictionary<uint, string> { [address] = "state_free_result_collision_native" },
+            stateFreeEntryVariants: new[]
+            {
+                new GuestStateFreeCallVariant(address, "state_free_result_collision_native_v0", compactContract)
+            });
+
+        Assert.Contains("MkwStateFreeResult_80063FC0 state_free_result_collision_native(", code, StringComparison.Ordinal);
+        Assert.Contains("MkwStateFreeResult2 state_free_result_collision_native_v0(", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("using MkwStateFreeResult_80063FC0", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void DirectStateFreeCallWritesOnlyExplicitResults()
+    {
+        const uint calleeAddress = 0x80063FD0u;
+        var function = new IrFunction("state_free_result_caller", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, $"0x{calleeAddress:X8}", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+        var contract = new GuestAbiContract(
+            GprReadBeforeWriteMask: 1u << 4,
+            GprPossibleWriteMask: 1u << 3,
+            GprReturnMask: 1u << 3,
+            FprReadBeforeWriteMask: 1u << 2,
+            FprPossibleWriteMask: 1u << 1,
+            FprReturnMask: 1u << 1,
+            CrReadBeforeWriteMask: 0,
+            CrPossibleWriteMask: 0,
+            ReadsXerBeforeWrite: false,
+            MayWriteXer: false,
+            ReadsCtrBeforeWrite: false,
+            MayWriteCtr: false,
+            ReadsLrBeforeWrite: false,
+            MayWriteLr: false,
+            BoundaryFlags: GuestCallBoundaryFlags.None,
+            DirectCallTargets: Array.Empty<uint>());
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80063FC0,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_result_caller", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract> { [calleeAddress] = contract },
+            stateFreeCallSymbols: new Dictionary<uint, string> { [calleeAddress] = "state_free_results_native" });
+
+        Assert.Matches(@"const auto state_free_result_[0-9A-F_]+ = state_free_results_native\(", code);
+        Assert.Matches(@"r3 = static_cast<uint32_t>\(state_free_result_[0-9A-F_]+\[0\]\);", code);
+        Assert.Matches(@"f1\.raw = static_cast<uint64_t>\(state_free_result_[0-9A-F_]+\[1\]\);", code);
+        Assert.DoesNotContain("r4 = state_free_result", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("f2 = state_free_result", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void DirectStateFreeCallExtractsRawBitsFromStructFprResults()
+    {
+        const uint calleeAddress = 0x80063FBCu;
+        var function = new IrFunction("state_free_struct_result_caller", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, $"0x{calleeAddress:X8}", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+        var contract = new GuestAbiContract(
+            0, 0, 0, 0, (1u << 0) | (1u << 2) | (1u << 3) | (1u << 4), 0,
+            0, 0, false, false, false, false, false, false,
+            GuestCallBoundaryFlags.None, Array.Empty<uint>());
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80063FB8,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_struct_result_caller", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract> { [calleeAddress] = contract },
+            stateFreeCallSymbols: new Dictionary<uint, string> { [calleeAddress] = "state_free_struct_native" });
+
+        Assert.Matches(@"f0\.raw = static_cast<uint64_t>\(state_free_result_[0-9A-F_]+\.f0\.raw\);", code);
+        Assert.Matches(@"f4\.raw = static_cast<uint64_t>\(state_free_result_[0-9A-F_]+\.f4\.raw\);", code);
+    }
+
+    [Fact]
+    public void NonLeafStateFreeVariantCallsNativeCalleeWithoutContextFallback()
+    {
+        const uint callerAddress = 0x80063FB0u;
+        const uint calleeAddress = 0x80063FA0u;
+        var callee = new GuestAbiContract(
+            1u << 3, 1u << 4, 1u << 4, 0, 0, 0, 0, 0,
+            false, false, false, false, false, false,
+            GuestCallBoundaryFlags.None, Array.Empty<uint>());
+        var caller = new GuestAbiContract(
+            1u << 3, (1u << 4) | (1u << 5), 0, 0, 0, 0, 0, 0,
+            false, false, false, false, false, false,
+            GuestCallBoundaryFlags.None, new[] { calleeAddress });
+        var function = new IrFunction("state_free_nonleaf", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall("lr", $"0x{calleeAddress:X8}", Array.Empty<IrValue>()),
+                new IrAssign("r5", IrValue.Register("r4")),
+                new IrReturn(null)
+            })
+        });
+        var code = new CxxLinearCodeGenerator().Emit(
+            callerAddress,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_nonleaf", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            emitStateFreeLeafVariant: true,
+            guestAbiContracts: new Dictionary<uint, GuestAbiContract> { [calleeAddress] = callee },
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract>
+            {
+                [callerAddress] = caller with { GprPossibleWriteMask = 1u << 5 },
+                [calleeAddress] = callee
+            },
+            stateFreeCallSymbols: new Dictionary<uint, string>
+            {
+                [callerAddress] = "state_free_nonleaf_native",
+                [calleeAddress] = "state_free_callee_native"
+            });
+
+        var start = code.IndexOf("state_free_nonleaf_native(", StringComparison.Ordinal);
+        var marker = code.IndexOf("RECOMP_STATE_FREE_ABI", start, StringComparison.Ordinal);
+        var variant = code[start..marker];
+        Assert.Contains("state_free_callee_native(", variant, StringComparison.Ordinal);
+        Assert.Contains("return static_cast<uint64_t>(cached_r5);", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("CpuContext", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("InvokeDirectCpu", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("KnownTranslatedCpuCall", variant, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StateFreeTailCallerForwardsIncomingLrWithoutContextAccess()
+    {
+        const uint callerAddress = 0x80063FB0u;
+        const uint calleeAddress = 0x80063FA0u;
+        var callee = new GuestAbiContract(
+            1u << 3, 1u << 3, 1u << 3, 0, 0, 0, 0, 0,
+            false, false, false, false, true, false,
+            GuestCallBoundaryFlags.None, Array.Empty<uint>());
+        var caller = new GuestAbiContract(
+            1u << 3, 1u << 3, 1u << 3, 0, 0, 0, 0, 0,
+            false, false, false, false, false, false,
+            GuestCallBoundaryFlags.None, new[] { calleeAddress });
+        var function = new IrFunction("state_free_tail_caller", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, $"0x{calleeAddress:X8}", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            callerAddress,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("state_free_tail_caller", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            emitStateFreeLeafVariant: true,
+            guestAbiContracts: new Dictionary<uint, GuestAbiContract> { [calleeAddress] = callee },
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract>
+            {
+                [callerAddress] = caller,
+                [calleeAddress] = callee
+            },
+            stateFreeCallSymbols: new Dictionary<uint, string>
+            {
+                [callerAddress] = "state_free_tail_caller_native",
+                [calleeAddress] = "state_free_tail_callee_native"
+            });
+
+        var start = code.IndexOf("state_free_tail_caller_native(", StringComparison.Ordinal);
+        var marker = code.IndexOf("RECOMP_STATE_FREE_ABI", start, StringComparison.Ordinal);
+        var variant = code[start..marker];
+        Assert.Contains("uint32_t native_lr", variant, StringComparison.Ordinal);
+        Assert.Contains("state_free_tail_callee_native(cached_r3, native_lr)", variant, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->", variant, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PublicLeafDoesNotElideNonvolatileGprStackRoundTrip()
+    {
+        var function = new IrFunction("public_leaf_gpr_save", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrStore(new IrAddress("r1", 12), IrValue.Register("r31"), 4),
+                new IrAssign("r31", IrValue.Imm(7)),
+                new IrLoad("r31", new IrAddress("r1", 12), 4),
+                new IrReturn(null)
+            })
+        });
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80064008,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("public_leaf_gpr_save", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            enableLeafAbiSpillElision: true);
+
+        Assert.Contains("FlatWriteRam32", code, StringComparison.Ordinal);
+        Assert.Contains("FlatRead32", code, StringComparison.Ordinal);
+        Assert.Contains("r31 = 7", code, StringComparison.Ordinal);
+        Assert.Contains("r31 = MemoryInline::FlatRead32", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void GprOnlyLeafCacheDoesNotImplicitlyElideGuestAbiSpills()
+    {
+        var function = new IrFunction("cached_leaf_gpr_save", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrStore(new IrAddress("r1", 12), IrValue.Register("r31"), 4),
+                new IrAssign("r31", IrValue.Imm(7)),
+                new IrLoad("r31", new IrAddress("r1", 12), 4),
+                new IrReturn(null)
+            })
+        });
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80064010,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("cached_leaf_gpr_save", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()));
+
+        Assert.Contains("FlatWriteRam32", code, StringComparison.Ordinal);
+        Assert.Contains("FlatRead32", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StackFastPathFollowsFramePointerCopiedIntoArchitecturalGpr()
+    {
+        var function = new IrFunction("derived_stack_gpr", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r1", IrValue.Register("r1"), IrValue.Imm(64), "sub"),
+                new IrBinary("r11", IrValue.Register("r1"), IrValue.Imm(64), "add"),
+                new IrStore(new IrAddress("r11", -28), IrValue.Register("r25"), 4),
+                new IrLoad("r25", new IrAddress("r11", -28), 4),
+                new IrReturn(null)
+            })
+        });
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80064014,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("derived_stack_gpr", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()));
+
+        // A stack slot store skips the MMIO policy check (FlatWriteRam) instead of the general guarded
+        // write (FlatWrite); reads have no such distinction, both spell as FlatRead.
+        Assert.Contains("MemoryInline::FlatWriteRam32", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatRead32", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("MemoryInline::FlatWrite32", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StackFastPathFollowsMultipleSsaDerivedAddressRegisters()
+    {
+        var function = new IrFunction("transitive_stack_gpr", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("r11", IrValue.Register("r1")),
+                new IrBinary("r12", IrValue.Register("r11"), IrValue.Imm(32), "add"),
+                new IrStore(new IrAddress("r12", -8), IrValue.Register("r31"), 4),
+                new IrLoad("r31", new IrAddress("r12", -8), 4),
+                new IrReturn(null)
+            })
+        });
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80064018,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("transitive_stack_gpr", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()));
+
+        // See StackFastPathFollowsFramePointerCopiedIntoArchitecturalGpr: only
+        // the store side still distinguishes the stack fast path in the emitted
+        // helper name.
+        Assert.Contains("MemoryInline::FlatWriteRam32", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatRead32", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("MemoryInline::FlatWrite32", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void GuestAbiContractModelsInlineGprThunkRegisterEffects()
+    {
+        var function = new IrFunction("thunk_contract", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, "0x80021580", Array.Empty<IrValue>()), // save r19-r31
+                new IrCall(string.Empty, "0x800215CC", Array.Empty<IrValue>()), // rest r19-r31
+                new IrReturn(null)
+            })
+        });
+
+        var contract = GuestAbiContractAnalyzer.Analyze(function);
+        const uint expected = 0xFFF80000u;
+        Assert.Equal(expected, contract.GprReadBeforeWriteMask & expected);
+        Assert.Equal(expected, contract.GprPossibleWriteMask & expected);
+        Assert.Empty(contract.DirectCallTargets);
+    }
+
+}
diff --git a/translator/tests/Translator.Tests/BaseFunctionIndexTests.cs b/translator/tests/Translator.Tests/BaseFunctionIndexTests.cs
new file mode 100644
index 0000000..a924588
--- /dev/null
+++ b/translator/tests/Translator.Tests/BaseFunctionIndexTests.cs
@@ -0,0 +1,37 @@
+using Translator.Core.Mods;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class BaseFunctionIndexTests
+{
+    [Fact]
+    public void FindContainingUsesHalfOpenRanges()
+    {
+        var index = new BaseFunctionIndex(
+        [
+            new BaseFunctionRangeMetadata(
+                0x80533600,
+                0x80533820,
+                "func_80533600",
+                "StaticR.rel:1",
+                0x123600,
+                "test",
+                ["Executable"]),
+            new BaseFunctionRangeMetadata(
+                0x80533820,
+                0x80533900,
+                "func_80533820",
+                "StaticR.rel:1",
+                0x123820,
+                "test",
+                ["Executable"])
+        ]);
+
+        Assert.Null(index.FindContaining(0x805335FC));
+        Assert.Equal(0x80533600u, index.FindContaining(0x80533600)!.Start);
+        Assert.Equal(0x80533600u, index.FindContaining(0x8053381C)!.Start);
+        Assert.Equal(0x80533820u, index.FindContaining(0x80533820)!.Start);
+        Assert.Null(index.FindContaining(0x80533900));
+    }
+}
diff --git a/translator/tests/Translator.Tests/BaseManifestBuilderTests.cs b/translator/tests/Translator.Tests/BaseManifestBuilderTests.cs
new file mode 100644
index 0000000..20a357f
--- /dev/null
+++ b/translator/tests/Translator.Tests/BaseManifestBuilderTests.cs
@@ -0,0 +1,95 @@
+using System;
+using System.IO;
+using Translator.Core.Mods;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class BaseManifestBuilderTests
+{
+    [Fact]
+    public void EmbeddedSwitchCaseTranslationDoesNotSplitOwningFunctionRange()
+    {
+        var directory = Path.Combine(Path.GetTempPath(), $"translator-base-manifest-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(directory);
+        try
+        {
+            File.WriteAllText(
+                Path.Combine(directory, "func_8062C3A4.cpp"),
+                "extern \"C\" void func_8062C3A4() { goto loc_8062C64C; loc_8062C64C:; }");
+            File.WriteAllText(
+                Path.Combine(directory, "func_8062C64C.cpp"),
+                "extern \"C\" void func_8062C64C() { loc_8062C64C:; }");
+            File.WriteAllText(
+                Path.Combine(directory, "func_80630094.cpp"),
+                "extern \"C\" void func_80630094() { loc_80630094:; }");
+
+            var starts = BaseManifestBuilder.DiscoverCanonicalGeneratedFunctionStarts(directory);
+
+            Assert.Equal([0x8062C3A4u, 0x80630094u], starts);
+        }
+        finally
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void MetadataEmbeddedLabelDoesNotSplitOwningFunctionRange()
+    {
+        var metadata = BaseTranslationOutputMetadata.Create([
+            new BaseTranslationFunctionMetadata("func_8062C3A4.cpp", 100, new string('a', 64), 0x8062C3A4u, [0x8062C64Cu]),
+            new BaseTranslationFunctionMetadata("func_8062C64C.cpp", 40, new string('b', 64), 0x8062C64Cu, []),
+            new BaseTranslationFunctionMetadata("func_80630094.cpp", 80, new string('c', 64), 0x80630094u, [])
+        ], TranslationQualityMetadata.Clean);
+
+        var starts = BaseManifestBuilder.DiscoverCanonicalGeneratedFunctionStarts(metadata);
+
+        Assert.Equal([0x8062C3A4u, 0x80630094u], starts);
+    }
+
+    [Fact]
+    public void OutputMetadataWriteIsDeterministicAndChangeAware()
+    {
+        var directory = Path.Combine(Path.GetTempPath(), $"translator-output-metadata-{Guid.NewGuid():N}");
+        var path = Path.Combine(directory, "base_output.json");
+        var metadata = BaseTranslationOutputMetadata.Create([
+            new BaseTranslationFunctionMetadata("b.cpp", 2, new string('b', 64), 2, []),
+            new BaseTranslationFunctionMetadata("a.cpp", 1, new string('a', 64), 1, [3])
+        ], TranslationQualityMetadata.Clean, "identity");
+        try
+        {
+            Assert.True(BaseTranslationOutputMetadataFile.WriteIfChangedAtomic(path, metadata));
+            var timestamp = File.GetLastWriteTimeUtc(path);
+            Assert.False(BaseTranslationOutputMetadataFile.WriteIfChangedAtomic(path, metadata));
+            Assert.Equal(timestamp, File.GetLastWriteTimeUtc(path));
+
+            var roundTrip = BaseTranslationOutputMetadataFile.Read(path);
+            Assert.Equal("a.cpp", roundTrip.Functions[0].RelativePath);
+            Assert.Equal("identity", roundTrip.TranslationIdentityHash);
+            Assert.Equal(TranslationQualityMetadata.Clean, roundTrip.Quality);
+        }
+        finally
+        {
+            if (Directory.Exists(directory)) Directory.Delete(directory, recursive: true);
+        }
+    }
+
+    [Theory]
+    [InlineData(1, 0)]
+    [InlineData(0, 1)]
+    public void ReleaseEligibilityRejectsTranslationQualityFailures(
+        int unsupportedInstructionCount,
+        int invalidSsaFunctionCount)
+    {
+        var metadata = BaseTranslationOutputMetadata.Create([
+            new BaseTranslationFunctionMetadata(
+                "func_80001000.cpp", 1, new string('a', 64), 0x80001000u, [])
+        ], new TranslationQualityMetadata(unsupportedInstructionCount, invalidSsaFunctionCount));
+
+        var error = Assert.Throws<InvalidDataException>(() =>
+            metadata.RequireReleaseEligible("test metadata"));
+
+        Assert.Contains("Release translation quality failure", error.Message, StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/BaseTranslationModAwarenessTests.cs b/translator/tests/Translator.Tests/BaseTranslationModAwarenessTests.cs
new file mode 100644
index 0000000..b144f89
--- /dev/null
+++ b/translator/tests/Translator.Tests/BaseTranslationModAwarenessTests.cs
@@ -0,0 +1,162 @@
+using System.Buffers.Binary;
+using Translator.Core.Mods;
+using Translator.Core.Parsing.Kamek;
+using Xunit;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Pins base-translation reuse decisions: a Code.pul that touches nothing inside a translated
+/// function should be reusable, and one that moves a patch on/off a translated function must not be.
+/// </summary>
+public class BaseTranslationModAwarenessTests
+{
+    // Two translated functions with a gap between them, so an address can be provably outside both.
+    private static readonly Dictionary<uint, uint> FunctionEnds = new()
+    {
+        [0x80005F34] = 0x8000608C,
+        [0x80543BB4] = 0x80543C40
+    };
+
+    [Fact]
+    public void ReusesTheBaseTranslationForAPulThatPatchesTheSameTranslatedFunctions()
+    {
+        using var original = TemporaryPul(
+            Absolute(KamekCommandId.BranchLink, 0x80005F40),
+            Absolute(KamekCommandId.Write32, 0x80001920));
+        using var candidate = TemporaryPul(
+            // The low-memory write is gone and a new one appears, but neither is inside a translated
+            // function, so the translation could not have seen either.
+            Absolute(KamekCommandId.BranchLink, 0x80005F40),
+            Absolute(KamekCommandId.Write32, 0x80003000));
+
+        var awareness = Awareness(original.Path);
+
+        Assert.True(awareness.CoversCodePul("retro-rewind", candidate.Path, out var reason), reason);
+    }
+
+    [Fact]
+    public void RefusesAPulThatMovesAPatchOntoADifferentTranslatedFunction()
+    {
+        using var original = TemporaryPul(Absolute(KamekCommandId.BranchLink, 0x80005F40));
+        using var candidate = TemporaryPul(Absolute(KamekCommandId.BranchLink, 0x80543BB8));
+
+        var awareness = Awareness(original.Path);
+
+        Assert.False(awareness.CoversCodePul("retro-rewind", candidate.Path, out var reason));
+        Assert.Contains("80543BB8", reason, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void RefusesAPulThatStopsPatchingATranslatedFunction()
+    {
+        using var original = TemporaryPul(
+            Absolute(KamekCommandId.BranchLink, 0x80005F40),
+            Absolute(KamekCommandId.Branch, 0x80543BB8));
+        using var candidate = TemporaryPul(Absolute(KamekCommandId.BranchLink, 0x80005F40));
+
+        var awareness = Awareness(original.Path);
+
+        Assert.False(awareness.CoversCodePul("retro-rewind", candidate.Path, out _));
+    }
+
+    [Fact]
+    public void RefusesAProfileTheBaseTranslationNeverSaw()
+    {
+        using var original = TemporaryPul(Absolute(KamekCommandId.BranchLink, 0x80005F40));
+        var awareness = Awareness(original.Path);
+
+        Assert.False(awareness.CoversCodePul("some-other-mod", original.Path, out var reason));
+        Assert.Contains("retro-rewind", reason, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RefusesWhenSeveralProfilesShapedTheTranslation()
+    {
+        using var first = TemporaryPul(Absolute(KamekCommandId.BranchLink, 0x80005F40));
+        using var second = TemporaryPul(Absolute(KamekCommandId.Branch, 0x80543BB8));
+        var awareness = BaseTranslationModAwareness.Create(null, 2,
+            [
+                ("retro-rewind", "P", new string('a', 64),
+                    BaseTranslationModAwareness.PatchedAddresses(first.Path, "P")),
+                ("other", "P", new string('b', 64),
+                    BaseTranslationModAwareness.PatchedAddresses(second.Path, "P"))
+            ],
+            FunctionEnds);
+
+        Assert.False(awareness.CoversCodePul("retro-rewind", first.Path, out var reason));
+        Assert.Contains("2 mod profile", reason, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SurvivesAWriteAndReadRoundTrip()
+    {
+        using var original = TemporaryPul(
+            Absolute(KamekCommandId.BranchLink, 0x80005F40),
+            Absolute(KamekCommandId.Write32, 0x80001920));
+        var path = Path.Combine(Path.GetTempPath(), $"mkwc-awareness-{Guid.NewGuid():N}.json");
+        try
+        {
+            BaseTranslationModAwarenessFile.WriteIfChangedAtomic(path, Awareness(original.Path));
+            var round = BaseTranslationModAwarenessFile.Read(path);
+
+            Assert.Equal(2, round.TranslatedFunctionCount);
+            Assert.Equal(4, round.TranslatedFunctionRanges.Count);
+            // Only the patch inside a translated function is recorded as consequential.
+            Assert.Equal([0x80005F40u], round.Profiles[0].ConsequentialPatchedAddresses);
+            Assert.True(round.CoversCodePul("retro-rewind", original.Path, out var reason), reason);
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+
+    private static BaseTranslationModAwareness Awareness(string codePulPath) =>
+        BaseTranslationModAwareness.Create(null, FunctionEnds.Count,
+            [("retro-rewind", "P", new string('a', 64),
+                BaseTranslationModAwareness.PatchedAddresses(codePulPath, "P"))],
+            FunctionEnds);
+
+    private static TemporaryFile TemporaryPul(params byte[][] commands)
+    {
+        var file = new TemporaryFile();
+        File.WriteAllBytes(file.Path, BuildChunk([0x60, 0x00, 0x00, 0x00], commands));
+        return file;
+    }
+
+    private static byte[] BuildChunk(byte[] code, byte[][] commands)
+    {
+        var chunkSize = KamekChunk.HeaderSize + code.Length + commands.Sum(command => command.Length);
+        var data = new byte[chunkSize];
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(0x00), KamekChunk.Magic0);
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(0x04), KamekChunk.Magic1);
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(0x08), 0x10);
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(0x0C), (uint)code.Length);
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(0x18), (uint)chunkSize);
+        code.CopyTo(data, KamekChunk.HeaderSize);
+        var offset = KamekChunk.HeaderSize + code.Length;
+        foreach (var command in commands)
+        {
+            command.CopyTo(data, offset);
+            offset += command.Length;
+        }
+        return data;
+    }
+
+    private static byte[] Absolute(KamekCommandId id, uint address)
+    {
+        var data = new byte[12];
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(0), ((uint)(byte)id << 24) | 0x00FFFFFEu);
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(4), address);
+        return data;
+    }
+
+    private sealed class TemporaryFile : IDisposable
+    {
+        public string Path { get; } =
+            System.IO.Path.Combine(System.IO.Path.GetTempPath(), $"mkwc-pul-{Guid.NewGuid():N}.pul");
+
+        public void Dispose() => File.Delete(Path);
+    }
+}
diff --git a/translator/tests/Translator.Tests/BasicBlockTests.cs b/translator/tests/Translator.Tests/BasicBlockTests.cs
new file mode 100644
index 0000000..50a9bc4
--- /dev/null
+++ b/translator/tests/Translator.Tests/BasicBlockTests.cs
@@ -0,0 +1,69 @@
+using System.IO;
+using System.Linq;
+using Translator.Core.Analysis.BasicBlocks;
+using Translator.Core.Disassembly;
+using Translator.Core.Loading;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class BasicBlockTests
+{
+    private static (ProgramImage image, PpcDisassembler disassembler) Setup()
+    {
+        var root = ProjectPaths.FindRepositoryRoot();
+        var assets = Path.Combine(root, "assets");
+        var image = new ProgramImageBuilder().Build(Path.Combine(assets, "main.dol"), Path.Combine(assets, "StaticR.rel"));
+        return (image, new PpcDisassembler());
+    }
+
+    [Fact]
+    public void BuildsBasicBlocksWithTerminatingBranches()
+    {
+        var (image, dis) = Setup();
+        using (dis)
+        {
+            var instructions = dis.DisassembleFunction(image, 0x800060A4, maxInstructions: 128);
+            var blocks = BasicBlockBuilder.Build(instructions);
+
+            Assert.NotEmpty(blocks);
+            Assert.True(blocks.All(b => b.Instructions.Count > 0), "Every block should contain at least one instruction.");
+            Assert.True(blocks.All(b =>
+                    b.Terminator.IsReturn ||
+                    b.Terminator.IsConditionalBranch ||
+                    b.Terminator.IsUnconditionalBranch ||
+                    b.Terminator.IsCall ||
+                    b.Successors.Count > 0),
+                "Each block must either end with a control-transfer or have an explicit fallthrough successor.");
+
+            // CFG stitching: every successor must list this block as predecessor.
+            foreach (var block in blocks)
+            {
+                foreach (var succAddr in block.Successors)
+                {
+                    var succ = blocks.Single(b => b.StartAddress == succAddr);
+                    Assert.Contains(block.StartAddress, succ.Predecessors);
+                }
+            }
+        }
+    }
+
+    [Fact]
+    public void BuildSplitsAtRequestedEntryLeaderInsideDecodedRange()
+    {
+        var instructions = new[]
+        {
+            PpcInstruction.Synthetic(0x8064F7EC, 0x60000000, "nop", []),
+            PpcInstruction.Synthetic(0x8064F7F0, 0x60000000, "nop", []),
+            PpcInstruction.Synthetic(0x8064F7F4, 0x60000000, "nop", []),
+            PpcInstruction.Synthetic(0x8064F7F8, 0x60000000, "nop", []),
+            PpcInstruction.Synthetic(0x8064F7FC, 0x4E800020, "blr", [], isReturn: true)
+        };
+
+        var blocks = BasicBlockBuilder.Build(instructions, new[] { 0x8064F7F4u });
+
+        Assert.Contains(blocks, b => b.StartAddress == 0x8064F7ECu);
+        Assert.Contains(blocks, b => b.StartAddress == 0x8064F7F4u);
+        Assert.Equal(new[] { 0x8064F7ECu, 0x8064F7F4u }, blocks.Select(b => b.StartAddress).ToArray());
+    }
+}
diff --git a/translator/tests/Translator.Tests/BigEndianBinaryReaderTests.cs b/translator/tests/Translator.Tests/BigEndianBinaryReaderTests.cs
new file mode 100644
index 0000000..13ece9b
--- /dev/null
+++ b/translator/tests/Translator.Tests/BigEndianBinaryReaderTests.cs
@@ -0,0 +1,72 @@
+using System;
+using System.IO;
+using Translator.Core.IO;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class BigEndianBinaryReaderTests
+{
+    [Fact]
+    public void ReadsBigEndianValuesAndTracksPosition()
+    {
+        using var stream = new MemoryStream(new byte[]
+        {
+            0x12,
+            0x34, 0x56,
+            0x78, 0x9A, 0xBC, 0xDE,
+            0xF0, 0x0D
+        });
+        using var reader = new BigEndianBinaryReader(stream);
+
+        Assert.Equal(0, reader.Position);
+        Assert.Equal(0x12, reader.ReadByte());
+        Assert.Equal(1, reader.Position);
+        Assert.Equal(0x3456, reader.ReadUInt16());
+        Assert.Equal(0x789ABCDEu, reader.ReadUInt32());
+        Assert.Equal(new byte[] { 0xF0, 0x0D }, reader.ReadBytes(2));
+        Assert.Equal(stream.Length, reader.Position);
+    }
+
+    [Fact]
+    public void SeekMovesWithinStream()
+    {
+        using var stream = new MemoryStream(new byte[] { 0x00, 0x01, 0xAA, 0xBB, 0xCC, 0xDD });
+        using var reader = new BigEndianBinaryReader(stream);
+
+        reader.Seek(2, SeekOrigin.Begin);
+        Assert.Equal(2, reader.Position);
+        Assert.Equal(0xAABB, reader.ReadUInt16());
+
+        reader.Seek(-2, SeekOrigin.Current);
+        Assert.Equal(2, reader.Position);
+        Assert.Equal(0xAABBCCDDu, reader.ReadUInt32());
+    }
+
+    [Fact]
+    public void ThrowsOnShortReads()
+    {
+        using var stream = new MemoryStream(new byte[] { 0x12, 0x34, 0x56 });
+        using var reader = new BigEndianBinaryReader(stream);
+
+        Assert.Throws<EndOfStreamException>(() => reader.ReadUInt32());
+        reader.Seek(0, SeekOrigin.Begin);
+        Assert.Throws<EndOfStreamException>(() => reader.ReadBytes(4));
+    }
+
+    [Fact]
+    public void LeaveOpenPreservesUnderlyingStream()
+    {
+        var stream = new MemoryStream(new byte[] { 0xDE, 0xAD, 0xBE, 0xEF });
+        using (var reader = new BigEndianBinaryReader(stream, leaveOpen: true))
+        {
+            Assert.Equal(0xDEAD, reader.ReadUInt16());
+        }
+
+        Assert.True(stream.CanRead);
+        Assert.Equal(2, stream.Position);
+        using var reader2 = new BigEndianBinaryReader(stream, leaveOpen: true);
+        Assert.Equal(0xBEEF, reader2.ReadUInt16());
+        stream.Dispose();
+    }
+}
diff --git a/translator/tests/Translator.Tests/CanonicalIrStoreTests.cs b/translator/tests/Translator.Tests/CanonicalIrStoreTests.cs
new file mode 100644
index 0000000..365796d
--- /dev/null
+++ b/translator/tests/Translator.Tests/CanonicalIrStoreTests.cs
@@ -0,0 +1,39 @@
+using System.Buffers.Binary;
+using Translator.Core.Loading;
+using Translator.Core.Translation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class CanonicalIrStoreTests
+{
+    [Fact]
+    public void RoundTripFeedsIdenticalFinalLowering()
+    {
+        var memory = new byte[8];
+        BinaryPrimitives.WriteUInt32BigEndian(memory.AsSpan(0, 4), 0x38630001u); // addi r3,r3,1
+        BinaryPrimitives.WriteUInt32BigEndian(memory.AsSpan(4, 4), 0x4E800020u); // blr
+        var image = new ProgramImage(
+            memory,
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, (uint)memory.Length),
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, (uint)memory.Length),
+            default,
+            "canonical-test");
+        var translator = new FunctionTranslator(image);
+        var options = TranslationOptions.Default with
+        {
+            PreferredName = "canonical_test",
+            AllowUnsupportedInstructions = true
+        };
+        var direct = translator.Translate(MemoryLayout.RamBase, options);
+        var discovery = translator.Discover(MemoryLayout.RamBase, options);
+        var store = new CanonicalIrStore();
+        store.Put(MemoryLayout.RamBase, discovery.Ssa.Function);
+
+        Assert.Equal(1, store.Count);
+        Assert.True(store.TryGet(MemoryLayout.RamBase, out var restored));
+        var lowered = translator.LowerCanonical(MemoryLayout.RamBase, restored, options);
+        Assert.Equal(direct.CxxCode, lowered.CxxCode);
+
+    }
+}
diff --git a/translator/tests/Translator.Tests/CarryHelperCodeGenTests.cs b/translator/tests/Translator.Tests/CarryHelperCodeGenTests.cs
new file mode 100644
index 0000000..efd1a89
--- /dev/null
+++ b/translator/tests/Translator.Tests/CarryHelperCodeGenTests.cs
@@ -0,0 +1,77 @@
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using System.Text;
+using Translator.Core.Analysis;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class CarryHelperCodeGenTests
+{
+    [Fact]
+    public void CarryHelpersUseCpuContextWithoutRuntimeCalls()
+    {
+        var method = typeof(CxxLinearCodeGenerator).GetMethod(
+            "TryEmitInlinePpc",
+            BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(method);
+
+        var cases = new[]
+        {
+            new IrCall("xer", "PPC_UpdateCarrySub", new[] { IrValue.Register("r3"), IrValue.Register("r4") }),
+            new IrCall("xer", "PPC_UpdateCarryAdd", new[] { IrValue.Register("r5"), IrValue.Register("r6"), IrValue.Imm(1) }),
+            new IrCall("xer", "PPC_UpdateCarryShiftRight", new[] { IrValue.Register("r7"), IrValue.Register("r8") }),
+            new IrCall("r9_ca", "PPC_GetCarry", Array.Empty<IrValue>())
+        };
+
+        foreach (var call in cases)
+        {
+            var output = new StringBuilder();
+            var emitted = (bool)method!.Invoke(null, new object?[]
+            {
+                call,
+                output,
+                "    ",
+                new RepresentationEnvironment(),
+                new Dictionary<string, bool>(StringComparer.OrdinalIgnoreCase),
+                StackAddressFacts.Empty
+            })!;
+
+            Assert.True(emitted, call.Target);
+            Assert.Contains("ctx->xer", output.ToString(), StringComparison.Ordinal);
+            Assert.DoesNotContain($"{call.Target}(", output.ToString(), StringComparison.Ordinal);
+            if (call.Target == "PPC_UpdateCarryAdd")
+            {
+                Assert.Contains("static_cast<uint64_t>(static_cast<uint32_t>", output.ToString(), StringComparison.Ordinal);
+            }
+        }
+    }
+
+    [Fact]
+    public void CountLeadingZerosUsesInlinePrimitive()
+    {
+        var method = typeof(CxxLinearCodeGenerator).GetMethod(
+            "TryEmitInlinePpc", BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(method);
+        var output = new StringBuilder();
+        var call = new IrCall("r4", "PPC_Cntlzw", new[] { IrValue.Register("r3") });
+
+        var emitted = (bool)method!.Invoke(null, new object?[]
+        {
+            call,
+            output,
+            "    ",
+            new RepresentationEnvironment(),
+            new Dictionary<string, bool>(StringComparer.OrdinalIgnoreCase),
+            StackAddressFacts.Empty
+        })!;
+
+        Assert.True(emitted);
+        Assert.Contains("PPC_CntlzwInline", output.ToString(), StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_Cntlzw(", output.ToString(), StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/CliHelperTests.cs b/translator/tests/Translator.Tests/CliHelperTests.cs
new file mode 100644
index 0000000..dcf3660
--- /dev/null
+++ b/translator/tests/Translator.Tests/CliHelperTests.cs
@@ -0,0 +1,57 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class CliHelperTests
+{
+    [Fact]
+    public void IndexedParallelPreservesIndexedResultsAcrossExecutionModes()
+    {
+        var sequential = new int[8];
+        var parallel = new int[8];
+
+        IndexedParallel.For(
+            sequential.Length,
+            new ParallelOptions { MaxDegreeOfParallelism = 1 },
+            index => sequential[index] = index * 3);
+        IndexedParallel.For(
+            parallel.Length,
+            new ParallelOptions { MaxDegreeOfParallelism = 4 },
+            index => parallel[index] = index * 3);
+
+        Assert.Equal(sequential, parallel);
+        Assert.Equal(Enumerable.Range(0, sequential.Length).Select(index => index * 3), sequential);
+    }
+
+    [Fact]
+    public void IndexedParallelUnwrapsA_singleWorkerFailure()
+    {
+        var exception = Assert.Throws<InvalidOperationException>(() => IndexedParallel.For(
+            8,
+            new ParallelOptions { MaxDegreeOfParallelism = 4 },
+            index =>
+            {
+                if (index == 0)
+                {
+                    throw new InvalidOperationException("indexed failure");
+                }
+            }));
+
+        Assert.Equal("indexed failure", exception.Message);
+    }
+
+    [Fact]
+    public void QueueBatchPreservesFifoAndSkipsUntilTheBatchIsFull()
+    {
+        var queue = new Queue<int>(new[] { 1, 2, 3, 4, 5 });
+
+        var first = QueueBatch.Dequeue(queue, 2, value => value % 2 == 0);
+
+        Assert.Equal(new[] { 1, 3 }, first);
+        Assert.Equal(new[] { 4, 5 }, queue);
+    }
+}
diff --git a/translator/tests/Translator.Tests/CodeGenExpressionCoverageTests.cs b/translator/tests/Translator.Tests/CodeGenExpressionCoverageTests.cs
new file mode 100644
index 0000000..20c2c37
--- /dev/null
+++ b/translator/tests/Translator.Tests/CodeGenExpressionCoverageTests.cs
@@ -0,0 +1,115 @@
+using System;
+using System.Reflection;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class CodeGenExpressionCoverageTests
+{
+    private static readonly Type GeneratorType = typeof(CxxLinearCodeGenerator);
+
+    private static T InvokePrivate<T>(string name, params object?[] args)
+    {
+        var method = GeneratorType.GetMethod(name, BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(method);
+        return (T)method!.Invoke(null, args)!;
+    }
+
+    private static string FormatBinary(IrBinary binary, RepresentationEnvironment types)
+    {
+        var left = InvokePrivate<string>("ToExpression", binary.Left, types);
+        var right = InvokePrivate<string>("ToExpression", binary.Right, types);
+        return InvokePrivate<string>("BinaryExpressionWithOperands", binary, left, right);
+    }
+
+    [Fact]
+    public void BinaryExpression_FormatsRareOperations()
+    {
+        var types = new RepresentationEnvironment();
+
+        Assert.Equal(
+            "(static_cast<int32_t>(ctx->gpr[3]))",
+            FormatBinary(new IrBinary("r4", IrValue.Register("r3"), IrValue.Imm(12), "sext"), types));
+        Assert.Equal(
+            "~(ctx->gpr[3] & ctx->gpr[4])",
+            FormatBinary(new IrBinary("r5", IrValue.Register("r3"), IrValue.Register("r4"), "nand"), types));
+        Assert.Equal(
+            "~(ctx->gpr[3] ^ ctx->gpr[4])",
+            FormatBinary(new IrBinary("r5", IrValue.Register("r3"), IrValue.Register("r4"), "eqv"), types));
+        Assert.Equal(
+            "std::sqrt(ctx->fpr[1].d)",
+            FormatBinary(new IrBinary("f2", IrValue.Register("f1"), IrValue.Register("f3"), "fsqrt"), types));
+        Assert.Equal(
+            "(ctx->fpr[1].d - ctx->fpr[2].d)",
+            FormatBinary(new IrBinary("f3", IrValue.Register("f1"), IrValue.Register("f2"), "fcmp"), types));
+        Assert.Equal(
+            "PPC_Divw(static_cast<int32_t>(ctx->gpr[7]), static_cast<int32_t>(ctx->gpr[8]))",
+            FormatBinary(new IrBinary("r9", IrValue.Register("r7"), IrValue.Register("r8"), "div"), types));
+        Assert.Equal(
+            "(static_cast<int32_t>(static_cast<int16_t>(ctx->gpr[9])))",
+            FormatBinary(new IrBinary("r10", IrValue.Register("r9"), IrValue.Imm(0), "sext16"), types));
+        Assert.Equal(
+            "(CompareUnsigned(static_cast<uint32_t>(ctx->gpr[11]), static_cast<uint32_t>(ctx->gpr[12])))",
+            FormatBinary(new IrBinary("r13", IrValue.Register("r11"), IrValue.Register("r12"), "sub_u"), types));
+        Assert.Equal(
+            "PPC_Fctiwz(ctx->fpr[4].d)",
+            FormatBinary(new IrBinary("f5", IrValue.Register("f4"), IrValue.Imm(0), "fctiwz"), types));
+        Assert.Equal(
+            "PPC_Fctiw(ctx->fpr[4].d)",
+            FormatBinary(new IrBinary("f5", IrValue.Register("f4"), IrValue.Imm(0), "fctiw"), types));
+        Assert.Equal(
+            "PPC_Slw(static_cast<uint32_t>(ctx->gpr[3]), static_cast<uint32_t>(ctx->gpr[4]))",
+            FormatBinary(new IrBinary("r5", IrValue.Register("r3"), IrValue.Register("r4"), "ppc_slw"), types));
+        Assert.Equal(
+            "PPC_Srw(static_cast<uint32_t>(ctx->gpr[3]), static_cast<uint32_t>(ctx->gpr[4]))",
+            FormatBinary(new IrBinary("r5", IrValue.Register("r3"), IrValue.Register("r4"), "ppc_srw"), types));
+        Assert.Equal(
+            "PPC_Sraw(static_cast<uint32_t>(ctx->gpr[3]), static_cast<uint32_t>(ctx->gpr[4]))",
+            FormatBinary(new IrBinary("r5", IrValue.Register("r3"), IrValue.Register("r4"), "ppc_sraw"), types));
+    }
+
+    [Fact]
+    public void RegisterHelpers_MapSpecialRegistersAndConditions()
+    {
+        var types = new RepresentationEnvironment();
+
+        Assert.Equal("ctx->cr", InvokePrivate<string>("RegisterToCtxRead", "cr", types));
+        Assert.Equal("((ctx->cr >> 0) & 0xF)", InvokePrivate<string>("RegisterToCtxRead", "cr7", types));
+        Assert.Equal("ctx->srr0", InvokePrivate<string>("RegisterToCtxRead", "srr0", types));
+        Assert.Equal("ctx->srr1", InvokePrivate<string>("RegisterToCtxRead", "srr1", types));
+        Assert.Equal("ctx->hid0", InvokePrivate<string>("RegisterToCtxRead", "hid0", types));
+        Assert.Equal("ctx->hid1", InvokePrivate<string>("RegisterToCtxRead", "hid1", types));
+        Assert.Equal("ctx->hid2", InvokePrivate<string>("RegisterToCtxRead", "hid2", types));
+        Assert.Equal("ctx->gqr[3]", InvokePrivate<string>("RegisterToCtxRead", "gqr3", types));
+        Assert.Equal("0", InvokePrivate<string>("RegisterToCtxRead", "gqr9", types));
+
+        Assert.Equal("ctx->cr", InvokePrivate<string>("RegisterToCtxWrite", "cr", types));
+        Assert.Equal("cr6", InvokePrivate<string>("RegisterToCtxWrite", "cr6", types));
+        Assert.Equal("ctx->hid2", InvokePrivate<string>("RegisterToCtxWrite", "hid2", types));
+        Assert.Equal("ctx->gqr[5]", InvokePrivate<string>("RegisterToCtxWrite", "gqr5", types));
+        Assert.Equal("gqr8", InvokePrivate<string>("RegisterToCtxWrite", "gqr8", types));
+
+        Assert.Equal("0", InvokePrivate<string>("ToExpression", new IrValue("temporary"), types));
+        Assert.Equal("tmp_local", InvokePrivate<string>("ToExpression", IrValue.Register("tmp_local"), types));
+
+        Assert.Equal("(ctx->ctr != 0)", InvokePrivate<string>("ToCondition", "bdnz", "ctr", types));
+        Assert.Equal("(ctx->ctr == 0)", InvokePrivate<string>("ToCondition", "bdz", "ctr", types));
+        Assert.Equal("((ctx->cr & 0x00000001u) != 0)", InvokePrivate<string>("ToCondition", "bso", "cr7", types));
+        Assert.Equal("((ctx->cr & 0x00000001u) == 0)", InvokePrivate<string>("ToCondition", "bns", "cr7", types));
+        Assert.Equal("flag_local", InvokePrivate<string>("ToCondition", "custom", "flag_local", types));
+
+        Assert.Equal("ctx->gpr[4]", InvokePrivate<string>("Address", new IrAddress("r4", 0), types));
+        Assert.Equal("(ctx->gpr[4] + 16)", InvokePrivate<string>("Address", new IrAddress("r4", 16), types));
+        Assert.Equal("r3", InvokePrivate<string>("BaseRegister", "r3_17"));
+        Assert.Equal("tmp", InvokePrivate<string>("BaseRegister", "tmp_local"));
+
+        Assert.Equal(8, InvokePrivate<int>("Bits", 1));
+        Assert.Equal(16, InvokePrivate<int>("Bits", 2));
+        Assert.Equal(64, InvokePrivate<int>("Bits", 8));
+        Assert.Equal(32, InvokePrivate<int>("Bits", 4));
+    }
+}
diff --git a/translator/tests/Translator.Tests/CodeGenInlineCoverageTests.cs b/translator/tests/Translator.Tests/CodeGenInlineCoverageTests.cs
new file mode 100644
index 0000000..7ad3dd2
--- /dev/null
+++ b/translator/tests/Translator.Tests/CodeGenInlineCoverageTests.cs
@@ -0,0 +1,99 @@
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using System.Text;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class CodeGenInlineCoverageTests
+{
+    private static readonly Type GeneratorType = typeof(CxxLinearCodeGenerator);
+
+    private static bool InvokeTryEmitInline(
+        IrCall call,
+        StringBuilder sb,
+        RepresentationEnvironment types,
+        Dictionary<string, bool> localPaired)
+    {
+        var method = GeneratorType.GetMethod("TryEmitInlinePpc", BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(method);
+        return (bool)method!.Invoke(null, new object?[] { call, sb, "    ", types, localPaired })!;
+    }
+
+    [Fact]
+    public void TryEmitInlinePpc_EmitsSupportedHelperBodies()
+    {
+        var types = new RepresentationEnvironment();
+        var paired = new Dictionary<string, bool>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["f1"] = true,
+            ["f2"] = false,
+            ["f3"] = true
+        };
+
+        var supported = new (IrCall Call, string Fragment)[]
+        {
+            (new IrCall("f5", "PPC_PsFromScalar", new[] { IrValue.Register("f2") }), "PPC_PsFromScalarInline"),
+            (new IrCall("f6", "PPC_PsToScalar", new[] { IrValue.Register("f1") }), "PPC_PsToScalarInline"),
+            (new IrCall("f7", "PPC_PsNeg", new[] { IrValue.Imm(7) }), "PPC_PsNegInline"),
+            (new IrCall("f8", "PPC_PsAbs", new[] { IrValue.Register("f2") }), "PPC_PsAbsInline"),
+            (new IrCall("f9", "PPC_PsSum0", new[] { IrValue.Register("f2"), IrValue.Register("f3"), IrValue.Register("f1") }), "PPC_PsSum0Inline"),
+            (new IrCall("f10", "PPC_PsSum1", new[] { IrValue.Register("f2"), IrValue.Register("f3"), IrValue.Register("f1") }), "PPC_PsSum1Inline"),
+            (new IrCall("f21", "PPC_PsDiv", new[] { IrValue.Register("f1"), IrValue.Register("f3") }), "PPC_PsDivInline"),
+            (new IrCall("f11", "PPC_Fadds", new[] { IrValue.Register("f1"), IrValue.Register("f2") }), "PpcForceSingleValueInline"),
+            (new IrCall("f12", "PPC_Fsubs", new[] { IrValue.Register("f2"), IrValue.Register("f1") }), "PpcForceSingleValueInline"),
+            (new IrCall("f13", "PPC_Fmuls", new[] { IrValue.Register("f1"), IrValue.Register("f2") }), "PpcFmulsInline"),
+            (new IrCall("f14", "PPC_Fdivs", new[] { IrValue.Register("f2"), IrValue.Register("f1") }), "PpcForceSingleValueInline"),
+            (new IrCall("f15", "PPC_Fsqrt", new[] { IrValue.Register("f1") }), "std::sqrt"),
+            (new IrCall("f16", "PPC_Fmadd", new[] { IrValue.Register("f2"), IrValue.Register("f1"), IrValue.Register("f3") }), "PpcFmaddInline"),
+            (new IrCall("f17", "PPC_Fmsub", new[] { IrValue.Register("f2"), IrValue.Register("f1"), IrValue.Register("f3") }), "PpcFmsubInline"),
+            (new IrCall("f18", "PPC_Fnmadd", new[] { IrValue.Register("f2"), IrValue.Register("f1"), IrValue.Register("f3") }), "PpcFnmaddInline"),
+            (new IrCall("f19", "PPC_Fnmsub", new[] { IrValue.Register("f2"), IrValue.Register("f1"), IrValue.Register("f3") }), "PpcFnmsubInline"),
+            (new IrCall("f20", "PPC_PsqL", new[] { IrValue.Register("r3"), IrValue.Imm(1), IrValue.Imm(5) }), "PPC_PsqLInline<1u, 5u>"),
+            (new IrCall(string.Empty, "PPC_PsqSt", new[] { IrValue.Register("r3"), IrValue.Register("f1"), IrValue.Imm(0), IrValue.Imm(4) }), "PPC_PsqStInline<0u, 4u>")
+        };
+
+        foreach (var (call, fragment) in supported)
+        {
+            var sb = new StringBuilder();
+            Assert.True(InvokeTryEmitInline(call, sb, types, paired), call.Target);
+            Assert.Contains(fragment, sb.ToString(), StringComparison.Ordinal);
+        }
+    }
+
+    [Fact]
+    public void TryEmitInlinePpc_CoversFallbacksAndMissingArguments()
+    {
+        var types = new RepresentationEnvironment();
+        var paired = new Dictionary<string, bool>(StringComparer.OrdinalIgnoreCase);
+
+        Assert.False(InvokeTryEmitInline(new IrCall("f1", "", Array.Empty<IrValue>()), new StringBuilder(), types, paired));
+
+        foreach (var target in new[]
+        {
+            "unknown_helper"
+        })
+        {
+            var sb = new StringBuilder();
+            Assert.False(InvokeTryEmitInline(new IrCall("f1", target, new[] { IrValue.Register("f1") }), sb, types, paired), target);
+            Assert.Equal(0, sb.Length);
+        }
+
+        var psqMissingImmediates = new StringBuilder();
+        Assert.False(
+            InvokeTryEmitInline(
+                new IrCall("f1", "PPC_PsqL", new[] { IrValue.Register("r3"), IrValue.Register("r4"), IrValue.Imm(0) }),
+                psqMissingImmediates,
+                types,
+                paired));
+        Assert.Equal(0, psqMissingImmediates.Length);
+
+        var missingArgs = new StringBuilder();
+        Assert.True(InvokeTryEmitInline(new IrCall("f3", "PPC_Fsqrt", Array.Empty<IrValue>()), missingArgs, types, paired));
+        Assert.Contains("std::sqrt(0);", missingArgs.ToString(), StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/CodeGenTests.cs b/translator/tests/Translator.Tests/CodeGenTests.cs
new file mode 100644
index 0000000..2051006
--- /dev/null
+++ b/translator/tests/Translator.Tests/CodeGenTests.cs
@@ -0,0 +1,1552 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Text;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class CodeGenTests
+{
+    private sealed class FixedGuestAbiProvider : IGuestFunctionAbiProvider
+    {
+        private readonly Dictionary<string, GuestFunctionAbi> _abis;
+
+        public FixedGuestAbiProvider(params (string Target, GuestFunctionAbi Abi)[] abis)
+        {
+            _abis = abis.ToDictionary(
+                static item => item.Target,
+                static item => item.Abi,
+                StringComparer.OrdinalIgnoreCase);
+        }
+
+        public bool TryGetGuestFunctionAbi(string target, out GuestFunctionAbi abi) =>
+            _abis.TryGetValue(target, out abi!);
+    }
+
+    [Fact]
+    public void CodeGenerator_CompilesAndRunsThroughBridge()
+    {
+        var function = new IrFunction(
+            "add_two",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                    new IrReturn(IrValue.Register("r3"))
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.Int32,
+            ["r4"] = ValueRepresentation.Int32,
+            ["r3_0"] = ValueRepresentation.Int32,
+            ["r3_1"] = ValueRepresentation.Int32 // SSA versions
+        });
+        var signature = new FunctionAbiClassification("add_two", ValueRepresentation.Int32);
+
+        // Convert to SSA
+        var ssa = new SsaTransformer().Convert(function);
+        // Linear generator expects entryPoint for function mapping
+        var code = new CxxLinearCodeGenerator().Emit(0x80001000, ssa, signature, types);
+
+        var root = Translator.Core.Loading.ProjectPaths.FindRepositoryRoot();
+        var tempDir = Path.Combine(Path.GetTempPath(), "mkw_codegen_tests");
+        Directory.CreateDirectory(tempDir);
+
+        var genPath = Path.Combine(tempDir, "generated.cpp");
+        var harnessPath = Path.Combine(tempDir, "harness.cpp");
+        File.WriteAllText(genPath, code);
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <iostream>");
+        harness.AppendLine("#include \"ppc_runtime.h\"");
+        harness.AppendLine("#include \"abi_bridge.h\"");
+        harness.AppendLine("// Mocks for runtime symbols");
+        harness.AppendLine("void TranslatedFunctionRegistry::Register(TranslatedFunctionInfo info) {}");
+        harness.AppendLine("CpuContext& GetPersistentCpuContext() { static CpuContext ctx; return ctx; }");
+        
+        harness.AppendLine("extern \"C\" void add_two(CpuContext* ctx);");
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    CpuContext ctx{};");
+        harness.AppendLine("    ctx.gpr[3] = 5;");
+        harness.AppendLine("    ctx.gpr[4] = 7;");
+        harness.AppendLine("    add_two(&ctx);");
+        harness.AppendLine("    if (ctx.gpr[3] != 12) { return 1; }");
+        harness.AppendLine("    std::cout << ctx.gpr[3];");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var exePath = Path.Combine(tempDir, "a.out");
+        var gpp = new ProcessStartInfo
+        {
+            FileName = "g++",
+            ArgumentList =
+            {
+                "-std=c++20",
+                "-Wall",
+                "-Werror",
+                "-Wno-error=unused-but-set-variable",
+                "-I", Path.Combine(root, "runtime", "include"),
+                genPath,
+                harnessPath,
+                "-o", exePath
+            },
+            RedirectStandardError = true,
+            RedirectStandardOutput = true
+        };
+
+        using (var proc = Process.Start(gpp)!)
+        {
+            proc.WaitForExit(20000);
+            if (proc.ExitCode != 0)
+            {
+                var output = proc.StandardOutput.ReadToEnd() + proc.StandardError.ReadToEnd();
+                throw new InvalidOperationException($"g++ failed: {output}\n\nGenerated Code:\n{code}");
+            }
+        }
+
+        var run = new ProcessStartInfo
+        {
+            FileName = exePath,
+            RedirectStandardOutput = true
+        };
+        using var runProc = Process.Start(run)!;
+        runProc.WaitForExit(5000);
+        var outputText = runProc.StandardOutput.ReadToEnd().Trim();
+
+        Assert.Equal(0, runProc.ExitCode);
+        Assert.Equal("12", outputText);
+    }
+
+    [Fact]
+    public void CodeGenerator_ReturnsAfterNonReturningGuestCallTarget()
+    {
+        var function = new IrFunction(
+            "tail_call_bridge",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall(string.Empty, "func_8170B834", Array.Empty<IrValue>()),
+                    new IrAssign("r3", IrValue.Imm(1)),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("tail_call_bridge", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80008004,
+            ssa,
+            signature,
+            types,
+            nonReturningCallTargets: new HashSet<uint> { 0x8170B834u });
+
+        var callIndex = code.IndexOf("InvokeDirectCpu<0x8170B834u>(ctx);", StringComparison.Ordinal);
+        Assert.True(callIndex >= 0);
+        var returnIndex = code.IndexOf("return;", callIndex, StringComparison.Ordinal);
+        var assignmentIndex = code.IndexOf("ctx->gpr[3] = 1;", callIndex, StringComparison.Ordinal);
+        Assert.True(returnIndex > callIndex);
+        Assert.True(assignmentIndex > returnIndex);
+    }
+
+    [Fact]
+    public void CodeGenerator_DispatchesNonReturningGuestCallLrToLocalContinuation()
+    {
+        var function = new IrFunction(
+            "local_lr_continuation",
+            "0x80661104",
+            new[]
+            {
+                new IrBasicBlock("0x80661104", new IrInstruction[]
+                {
+                    new IrCall(string.Empty, "func_8172CC0C", Array.Empty<IrValue>()),
+                    new IrReturn(null)
+                }),
+                new IrBasicBlock("0x80661144", new IrInstruction[]
+                {
+                    new IrAssign("r3", IrValue.Imm(1)),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("local_lr_continuation", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80661078,
+            ssa,
+            signature,
+            types,
+            nonReturningCallTargets: new HashSet<uint> { 0x8172CC0Cu });
+
+        var callIndex = code.IndexOf("InvokeDirectCpu<0x8172CC0Cu>(ctx);", StringComparison.Ordinal);
+        var localCaseIndex = code.IndexOf("case 0x80661144u:", callIndex, StringComparison.Ordinal);
+        var localGotoIndex = code.IndexOf("goto loc_80661144;", localCaseIndex, StringComparison.Ordinal);
+        var registryIndex = code.IndexOf("TranslatedFunctionRegistry::FindByAddressPtr(ctx->lr)", callIndex, StringComparison.Ordinal);
+
+        Assert.True(callIndex >= 0);
+        Assert.True(localCaseIndex > callIndex);
+        Assert.True(localGotoIndex > localCaseIndex);
+        Assert.True(registryIndex > localGotoIndex);
+    }
+
+    [Fact]
+    public void CodeGenerator_FallsThroughAfterNonReturningGuestCallWhenLrIsNextInstruction()
+    {
+        var function = new IrFunction(
+            "same_block_lr_continuation",
+            "0x80661104",
+            new[]
+            {
+                new IrBasicBlock("0x80661104", new IrInstruction[]
+                {
+                    new IrAssign("lr", IrValue.Imm(unchecked((int)0x80661144u))),
+                    new IrCall(string.Empty, "func_8172CC0C", Array.Empty<IrValue>()),
+                    new IrAssign("r3", IrValue.Imm(1)),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["lr"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("same_block_lr_continuation", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80661078,
+            ssa,
+            signature,
+            types,
+            nonReturningCallTargets: new HashSet<uint> { 0x8172CC0Cu });
+
+        var callIndex = code.IndexOf("InvokeDirectCpu<0x8172CC0Cu>(ctx);", StringComparison.Ordinal);
+        var fallthroughGuardIndex = code.IndexOf("if (ctx->lr != 0x80661144u)", callIndex, StringComparison.Ordinal);
+        var returnIndex = code.IndexOf("return;", fallthroughGuardIndex, StringComparison.Ordinal);
+        var assignmentIndex = code.IndexOf("ctx->gpr[3] = 1;", callIndex, StringComparison.Ordinal);
+
+        Assert.True(callIndex >= 0);
+        Assert.True(fallthroughGuardIndex > callIndex);
+        Assert.True(returnIndex > fallthroughGuardIndex);
+        Assert.True(assignmentIndex > returnIndex);
+    }
+
+    [Fact]
+    public void CodeGenerator_DispatchesGuestCallLrContinuationWithoutMarkingTargetNonReturning()
+    {
+        var function = new IrFunction(
+            "lr_continuation_call",
+            "0x800E591C",
+            new[]
+            {
+                new IrBasicBlock("0x800E591C", new IrInstruction[]
+                {
+                    new IrAssign("lr", IrValue.Imm(unchecked((int)0x800E5920u))),
+                    new IrCall(string.Empty, "0x8179AC3C", Array.Empty<IrValue>()),
+                    new IrAssign("r3", IrValue.Imm(8)),
+                    new IrReturn(null)
+                }),
+                new IrBasicBlock("0x800E5934", new IrInstruction[]
+                {
+                    new IrAssign("r3", IrValue.Imm(1)),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["lr"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("lr_continuation_call", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x800E591C,
+            ssa,
+            signature,
+            types,
+            lrContinuationCallTargets: new HashSet<uint> { 0x8179AC3Cu });
+
+        var callIndex = code.IndexOf("InvokeDirectCpu<0x8179AC3Cu>(ctx);", StringComparison.Ordinal);
+        var fallthroughGuardIndex = code.IndexOf("if (ctx->lr != 0x800E5920u)", callIndex, StringComparison.Ordinal);
+        var localCaseIndex = code.IndexOf("case 0x800E5934u:", fallthroughGuardIndex, StringComparison.Ordinal);
+        var returnIndex = code.IndexOf("return;", localCaseIndex, StringComparison.Ordinal);
+        var fallthroughAssignmentIndex = code.IndexOf("ctx->gpr[3] = 8;", callIndex, StringComparison.Ordinal);
+
+        Assert.True(callIndex >= 0);
+        Assert.True(fallthroughGuardIndex > callIndex);
+        Assert.True(localCaseIndex > fallthroughGuardIndex);
+        Assert.True(returnIndex > localCaseIndex);
+        Assert.True(fallthroughAssignmentIndex > returnIndex);
+    }
+
+    [Fact]
+    public void CodeGenerator_DispatchesGuestCallLrToInstructionInsideBasicBlock()
+    {
+        var function = new IrFunction(
+            "mid_block_lr_continuation",
+            "0x80535118",
+            new[]
+            {
+                new IrBasicBlock("0x80535118", new IrInstruction[]
+                {
+                    new IrTracePpc(0x80535118u, "lhz r0, 0x1a(r3)", "0xA003001A"),
+                    new IrAssign("lr", IrValue.Imm(unchecked((int)0x80535130u))),
+                    new IrCall(string.Empty, "0x8179B000", Array.Empty<IrValue>()),
+                    new IrTracePpc(0x80535130u, "addi r4, r4, 1", "0x38840001"),
+                    new IrAssign("r4", IrValue.Imm(1)),
+                    new IrTracePpc(0x8053513Cu, "cmpwi r0, 0", "0x2C000000"),
+                    new IrAssign("r3", IrValue.Imm(2)),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["lr"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32,
+            ["r4"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("mid_block_lr_continuation", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80534DF8,
+            ssa,
+            signature,
+            types,
+            lrContinuationCallTargets: new HashSet<uint> { 0x8179B000u });
+
+        var callIndex = code.IndexOf("InvokeDirectCpu<0x8179B000u>(ctx);", StringComparison.Ordinal);
+        var localCaseIndex = code.IndexOf("case 0x8053513Cu:", callIndex, StringComparison.Ordinal);
+        var localGotoIndex = code.IndexOf("goto loc_8053513C;", localCaseIndex, StringComparison.Ordinal);
+        var instructionLabelIndex = code.IndexOf("loc_8053513C:", localGotoIndex, StringComparison.Ordinal);
+        var assignmentIndex = code.IndexOf("ctx->gpr[3] = 2;", instructionLabelIndex, StringComparison.Ordinal);
+
+        Assert.True(callIndex >= 0);
+        Assert.True(localCaseIndex > callIndex);
+        Assert.True(localGotoIndex > localCaseIndex);
+        Assert.True(instructionLabelIndex > localGotoIndex);
+        Assert.True(assignmentIndex > instructionLabelIndex);
+    }
+
+    [Fact]
+    public void CodeGenerator_WrapsScalarPpcPsqStPayloadAsScalarPair()
+    {
+        var function = new IrFunction(
+            "psq_store_passthrough",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall(
+                        string.Empty,
+                        "PPC_PsqSt",
+                        new[]
+                        {
+                            IrValue.Register("r3"),
+                            IrValue.Register("f1"),
+                            IrValue.Imm(0),
+                            IrValue.Imm(0)
+                        }),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.Int32,
+            ["f1"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("psq_store_passthrough", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80008000, ssa, signature, types);
+
+        Assert.Contains("PPC_PsqStInline<0u, 0u>(", code, StringComparison.Ordinal);
+        Assert.Contains("PPC_PsFromScalarInline", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_ExtractsPs0WhenScalarStoreConsumesPairedRegister()
+    {
+        var function = new IrFunction(
+            "paired_stfs_source",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall(
+                        "f2",
+                        "PPC_PsqL",
+                        new[]
+                        {
+                            IrValue.Register("r3"),
+                            IrValue.Imm(0),
+                            IrValue.Imm(0)
+                        }),
+                    new IrStore(new IrAddress("r4", 0), IrValue.Register("f2"), 4),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.Int32,
+            ["r4"] = ValueRepresentation.Int32,
+            ["f2"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification(
+            "paired_stfs_source",
+            ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80008010, ssa, signature, types);
+
+        Assert.Contains("ctx->fpr[2].d = PPC_PsqLInline<0u, 0u>(ctx, ctx->gpr[3]);", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteFloat32(ctx->gpr[4], PPC_PsToScalarInline(ctx->fpr[2].d));", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_EmitsDirectGpuFifoStoresForKnownGatherPipeAddress()
+    {
+        var function = new IrFunction(
+            "known_gx_fifo_stores",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrAssign("r5", IrValue.Imm(unchecked((int)0xCC010000))),
+                    new IrAssign("r6", IrValue.Imm(unchecked((int)0xCC010100))),
+                    new IrStore(new IrAddress("r5", -32768), IrValue.Register("r3"), 1),
+                    new IrStore(new IrAddress("r5", -32768), IrValue.Register("r4"), 2),
+                    new IrStore(new IrAddress("r5", -32768), IrValue.Register("r7"), 4),
+                    new IrStore(new IrAddress("r5", -32768), IrValue.Register("f1"), 4),
+                    new IrStore(new IrAddress("r6", -32768), IrValue.Register("r3"), 1),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.UInt32,
+            ["r4"] = ValueRepresentation.UInt32,
+            ["r5"] = ValueRepresentation.UInt32,
+            ["r6"] = ValueRepresentation.UInt32,
+            ["r7"] = ValueRepresentation.UInt32,
+            ["f1"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification(
+            "known_gx_fifo_stores",
+            ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80008018, ssa, signature, types);
+
+        Assert.Contains("GX_HLE_FIFO_Write8(static_cast<uint8_t>(ctx->gpr[3]));", code, StringComparison.Ordinal);
+        Assert.Contains("GX_HLE_FIFO_Write16(static_cast<uint16_t>(ctx->gpr[4]));", code, StringComparison.Ordinal);
+        Assert.Contains("GX_HLE_FIFO_Write32(static_cast<uint32_t>(ctx->gpr[7]));", code, StringComparison.Ordinal);
+        Assert.Contains("GX_HLE_FIFO_WriteFloat(static_cast<float>(ctx->fpr[1].d));", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWrite8((ctx->gpr[6] + -32768), static_cast<uint32_t>(ctx->gpr[3]));", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_ReusesFctiwzStackLowWordForMatchingLoad()
+    {
+        var function = new IrFunction(
+            "fctiwz_low_word_stack_load",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("f0", IrValue.Register("f1"), IrValue.Imm(0), "fctiwz"),
+                    new IrStore(new IrAddress("r1", -16), IrValue.Register("f0"), 8),
+                    new IrLoad("r3", new IrAddress("r1", -12), 4),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r1"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32,
+            ["f0"] = ValueRepresentation.Float64,
+            ["f1"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification(
+            "fctiwz_low_word_stack_load",
+            ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x8000801C, ssa, signature, types);
+
+        Assert.Contains("fctiwzword0 = PPC_FprLowWordInline(ctx->fpr[0].d);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("MemoryInline::FlatWriteFloat64((ctx->gpr[1] + -16), ctx->fpr[0].d);", code, StringComparison.Ordinal);
+        Assert.Contains("ctx->gpr[3] = fctiwzword0;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->gpr[3] = MemoryInline::FlatRead32((ctx->gpr[1] + -12));", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_KeepsFctiwzStackStoreAcrossGuestCallBarrier()
+    {
+        var function = new IrFunction(
+            "fctiwz_low_word_call_barrier",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("f0", IrValue.Register("f1"), IrValue.Imm(0), "fctiwz"),
+                    new IrStore(new IrAddress("r1", -16), IrValue.Register("f0"), 8),
+                    new IrLoad("r3", new IrAddress("r1", -12), 4),
+                    new IrCall(string.Empty, "func_80001234", Array.Empty<IrValue>()),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r1"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32,
+            ["f0"] = ValueRepresentation.Float64,
+            ["f1"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification(
+            "fctiwz_low_word_call_barrier",
+            ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x8000801E, ssa, signature, types);
+
+        Assert.Contains("fctiwzword0 = PPC_FprLowWordInline(ctx->fpr[0].d);", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteFloat64((ctx->gpr[1] + -16), ctx->fpr[0].d);", code, StringComparison.Ordinal);
+        Assert.Contains("ctx->gpr[3] = fctiwzword0;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_DoesNotReuseFctiwzStackLowWordAcrossOverlappingAccess()
+    {
+        var function = new IrFunction(
+            "fctiwz_low_word_overlap",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("f0", IrValue.Register("f1"), IrValue.Imm(0), "fctiwz"),
+                    new IrStore(new IrAddress("r1", -16), IrValue.Register("f0"), 8),
+                    new IrStore(new IrAddress("r1", -12), IrValue.Register("r4"), 4),
+                    new IrLoad("r3", new IrAddress("r1", -12), 4),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r1"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32,
+            ["r4"] = ValueRepresentation.UInt32,
+            ["f0"] = ValueRepresentation.Float64,
+            ["f1"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification(
+            "fctiwz_low_word_overlap",
+            ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x8000801D, ssa, signature, types);
+
+        Assert.DoesNotContain("PPC_FprLowWordInline", code, StringComparison.Ordinal);
+        Assert.Contains("ctx->gpr[3] = MemoryInline::FlatRead32((ctx->gpr[1] + -12));", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_InlinesMidRangeSaveFprThunkEntries()
+    {
+        var function = new IrFunction(
+            "save_fpr_midrange_thunk",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall(string.Empty, "func_80021504", Array.Empty<IrValue>()),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r11"] = ValueRepresentation.Int32,
+            ["f26"] = ValueRepresentation.Float64,
+            ["f27"] = ValueRepresentation.Float64,
+            ["f28"] = ValueRepresentation.Float64,
+            ["f29"] = ValueRepresentation.Float64,
+            ["f30"] = ValueRepresentation.Float64,
+            ["f31"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("save_fpr_midrange_thunk", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80008020, ssa, signature, types);
+
+        Assert.DoesNotContain("InvokeDirectCpu<0x80021504u>(ctx);", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteFloat64((ctx->gpr[11] + -48), ctx->fpr[26].d);", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteFloat64((ctx->gpr[11] + -8), ctx->fpr[31].d);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("DebugTrackPcIfLightweight", code, StringComparison.Ordinal);
+        Assert.Contains("// RECOMP_REGISTRATION base 0x80008020 save_fpr_midrange_thunk preserves=true fpr_mask=0x00000000", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_InlinesMidRangeRestFprThunkEntries()
+    {
+        var function = new IrFunction(
+            "rest_fpr_midrange_thunk",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall(string.Empty, "func_80021550", Array.Empty<IrValue>()),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r11"] = ValueRepresentation.Int32,
+            ["f26"] = ValueRepresentation.Float64,
+            ["f27"] = ValueRepresentation.Float64,
+            ["f28"] = ValueRepresentation.Float64,
+            ["f29"] = ValueRepresentation.Float64,
+            ["f30"] = ValueRepresentation.Float64,
+            ["f31"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("rest_fpr_midrange_thunk", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80008024, ssa, signature, types);
+
+        Assert.DoesNotContain("InvokeDirectCpu<0x80021550u>(ctx);", code, StringComparison.Ordinal);
+        Assert.Contains("ctx->fpr[26].d = MemoryInline::FlatReadFloat64((ctx->gpr[11] + -48));", code, StringComparison.Ordinal);
+        Assert.Contains("ctx->fpr[31].d = MemoryInline::FlatReadFloat64((ctx->gpr[11] + -8));", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("DebugTrackPcIfLightweight", code, StringComparison.Ordinal);
+        Assert.Contains("// RECOMP_REGISTRATION base 0x80008024 rest_fpr_midrange_thunk preserves=false fpr_mask=0xFC000000", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Bridge_PassesFloatingPointRegisters()
+    {
+        var function = new IrFunction(
+            "float_passthrough",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrReturn(IrValue.Register("f1"))
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float32
+        });
+        var signature = new FunctionAbiClassification("float_passthrough", ValueRepresentation.Float32);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80002000, ssa, signature, types);
+
+        var root = Translator.Core.Loading.ProjectPaths.FindRepositoryRoot();
+        var tempDir = Path.Combine(Path.GetTempPath(), "mkw_codegen_float_tests");
+        Directory.CreateDirectory(tempDir);
+
+        var genPath = Path.Combine(tempDir, "generated_float.cpp");
+        var harnessPath = Path.Combine(tempDir, "harness_float.cpp");
+        File.WriteAllText(genPath, code);
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <cmath>");
+        harness.AppendLine("#include <iostream>");
+        harness.AppendLine("#include \"ppc_runtime.h\"");
+        harness.AppendLine("#include \"abi_bridge.h\"");
+        harness.AppendLine("// Mocks for runtime symbols");
+        harness.AppendLine("void TranslatedFunctionRegistry::Register(TranslatedFunctionInfo info) {}");
+        harness.AppendLine("CpuContext& GetPersistentCpuContext() { static CpuContext ctx; return ctx; }");
+
+        harness.AppendLine("extern \"C\" void float_passthrough(CpuContext* ctx);");
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    CpuContext ctx{};");
+        harness.AppendLine("    ctx.gpr[3] = 123; // ensure we don't accidentally read gpr for float args");
+        harness.AppendLine("    ctx.fpr[1].d = 3.5;");
+        harness.AppendLine("    float_passthrough(&ctx);");
+        harness.AppendLine("    if (std::fabs(ctx.fpr[1].d - 3.5) > 0.0001) { return 1; }");
+        harness.AppendLine("    std::cout << ctx.fpr[1].d;");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var exePath = Path.Combine(tempDir, "float_test.out");
+        var gpp = new ProcessStartInfo
+        {
+            FileName = "g++",
+            ArgumentList =
+            {
+                "-std=c++20",
+                "-Wall",
+                "-Werror",
+                "-Wno-error=unused-but-set-variable",
+                "-I", Path.Combine(root, "runtime", "include"),
+                genPath,
+                harnessPath,
+                "-o", exePath
+            },
+            RedirectStandardError = true,
+            RedirectStandardOutput = true
+        };
+
+        using (var proc = Process.Start(gpp)!)
+        {
+            proc.WaitForExit(20000);
+            if (proc.ExitCode != 0)
+            {
+                var output = proc.StandardOutput.ReadToEnd() + proc.StandardError.ReadToEnd();
+                throw new InvalidOperationException($"g++ failed: {output}");
+            }
+        }
+
+        var run = new ProcessStartInfo
+        {
+            FileName = exePath,
+            RedirectStandardOutput = true
+        };
+        using var runProc = Process.Start(run)!;
+        runProc.WaitForExit(5000);
+        var outputText = runProc.StandardOutput.ReadToEnd().Trim();
+
+        Assert.Equal(0, runProc.ExitCode);
+        Assert.Equal("3.5", outputText);
+    }
+
+    [Fact]
+    public void Bridge_SimpleIntegerPassThrough()
+    {
+        var function = new IrFunction(
+            "simple_int",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r3", IrValue.Register("r3"), IrValue.Imm(1), "add"),
+                    new IrReturn(IrValue.Register("r3"))
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.Int32
+        });
+        var signature = new FunctionAbiClassification("simple_int", ValueRepresentation.Int32);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80003000, ssa, signature, types);
+
+        var root = Translator.Core.Loading.ProjectPaths.FindRepositoryRoot();
+        var tempDir = Path.Combine(Path.GetTempPath(), "mkw_codegen_int_tests");
+        Directory.CreateDirectory(tempDir);
+
+        var genPath = Path.Combine(tempDir, "generated_int.cpp");
+        var harnessPath = Path.Combine(tempDir, "harness_int.cpp");
+        File.WriteAllText(genPath, code);
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <iostream>");
+        harness.AppendLine("#include \"ppc_runtime.h\"");
+        harness.AppendLine("#include \"abi_bridge.h\"");
+        harness.AppendLine("// Mocks for runtime symbols");
+        harness.AppendLine("void TranslatedFunctionRegistry::Register(TranslatedFunctionInfo info) {}");
+        harness.AppendLine("CpuContext& GetPersistentCpuContext() { static CpuContext ctx; return ctx; }");
+
+        harness.AppendLine("extern \"C\" void simple_int(CpuContext* ctx);");
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    CpuContext ctx{};");
+        harness.AppendLine("    ctx.gpr[3] = 10;");
+        harness.AppendLine("    simple_int(&ctx);");
+        harness.AppendLine("    // Should be 11");
+        harness.AppendLine("    if (ctx.gpr[3] != 11) { return 1; }");
+        harness.AppendLine("    std::cout << ctx.gpr[3];");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var exePath = Path.Combine(tempDir, "int_test.out");
+        var gpp = new ProcessStartInfo
+        {
+            FileName = "g++",
+            ArgumentList =
+            {
+                "-std=c++20",
+                "-Wall",
+                "-Werror",
+                "-Wno-error=unused-but-set-variable",
+                "-I", Path.Combine(root, "runtime", "include"),
+                genPath,
+                harnessPath,
+                "-o", exePath
+            },
+            RedirectStandardError = true,
+            RedirectStandardOutput = true
+        };
+
+        using (var proc = Process.Start(gpp)!)
+        {
+            proc.WaitForExit(20000);
+            if (proc.ExitCode != 0)
+            {
+                var output = proc.StandardOutput.ReadToEnd() + proc.StandardError.ReadToEnd();
+                throw new InvalidOperationException($"g++ failed: {output}");
+            }
+        }
+
+        var run = new ProcessStartInfo
+        {
+            FileName = exePath,
+            RedirectStandardOutput = true
+        };
+        using var runProc = Process.Start(run)!;
+        runProc.WaitForExit(5000);
+        var outputText = runProc.StandardOutput.ReadToEnd().Trim();
+
+        Assert.Equal(0, runProc.ExitCode);
+        Assert.Equal("11", outputText);
+    }
+
+    [Fact]
+    public void CodeGenerator_EmitsDirectRegisterAccessWithinBasicBlock()
+    {
+        var function = new IrFunction(
+            "cache_test",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r5", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                    new IrBinary("r6", IrValue.Register("r3"), IrValue.Register("r5"), "add"),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.Int32,
+            ["r4"] = ValueRepresentation.Int32,
+            ["r5"] = ValueRepresentation.Int32,
+            ["r6"] = ValueRepresentation.Int32
+        });
+        var signature = new FunctionAbiClassification("cache_test", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80004000, ssa, signature, types);
+
+        Assert.DoesNotContain("_cached_", code);
+        Assert.Contains("ctx->gpr[5] = (ctx->gpr[3] + ctx->gpr[4]);", code);
+        Assert.Contains("ctx->gpr[6] = (ctx->gpr[3] + ctx->gpr[5]);", code);
+    }
+
+    [Fact]
+    public void CodeGenerator_UsesPowerPcDivisionHelpers()
+    {
+        var function = new IrFunction(
+            "div_test",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "div"),
+                    new IrBinary("r5", IrValue.Register("r5"), IrValue.Register("r6"), "divu"),
+                    new IrReturn(IrValue.Register("r3"))
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.Int32,
+            ["r4"] = ValueRepresentation.Int32,
+            ["r5"] = ValueRepresentation.Int32,
+            ["r6"] = ValueRepresentation.Int32
+        });
+        var signature = new FunctionAbiClassification("div_test", ValueRepresentation.Int32);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80005000, ssa, signature, types);
+
+        Assert.Contains("PPC_Divw(", code, StringComparison.Ordinal);
+        Assert.Contains("PPC_Divwu(", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("? static_cast<int32_t>", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("? static_cast<uint32_t>", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_NormalizesMixedPairedStateAcrossMergeEdges()
+    {
+        var function = new IrFunction(
+            "mixed_ps_merge",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBranch("beq", "paired", "scalar")
+                }),
+                new IrBasicBlock("paired", new IrInstruction[]
+                {
+                    new IrCall("f5", "PPC_PsMul", new[] { IrValue.Register("f1"), IrValue.Register("f2") }),
+                    new IrJump("merge")
+                }),
+                new IrBasicBlock("scalar", new IrInstruction[]
+                {
+                    new IrAssign("f5", IrValue.Register("f3")),
+                    new IrJump("merge")
+                }),
+                new IrBasicBlock("merge", new IrInstruction[]
+                {
+                    new IrCall("f6", "PPC_PsNeg", new[] { IrValue.Register("f5") }),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64,
+            ["f5"] = ValueRepresentation.Float64,
+            ["f6"] = ValueRepresentation.Float64,
+            ["cr0"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("mixed_ps_merge", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80006000, ssa, signature, types);
+
+        Assert.Contains("ctx->fpr[5].d = PPC_PsToScalarInline(ctx->fpr[5].d);", code, StringComparison.Ordinal);
+        Assert.Contains("goto loc_merge;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_ClearsImplicitF1PairedStateAfterGuestCallForFlowAnalysis()
+    {
+        var function = new IrFunction(
+            "guest_call_scalar_return",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall("f1", "PPC_PsMul", new[] { IrValue.Register("f2"), IrValue.Register("f3") }),
+                    new IrCall(string.Empty, "func_80001234", Array.Empty<IrValue>()),
+                    new IrAssign("f31", IrValue.Register("f1")),
+                    new IrJump("merge")
+                }),
+                new IrBasicBlock("merge", new IrInstruction[]
+                {
+                    new IrCall(string.Empty, "PPC_Fcmp", new[] { IrValue.Imm(0), IrValue.Register("f31"), IrValue.Register("f4") }),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64,
+            ["f4"] = ValueRepresentation.Float64,
+            ["f31"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("guest_call_scalar_return", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80006100, ssa, signature, types);
+
+        Assert.Contains("InvokeDirectCpu<0x80001234u>(ctx);", code, StringComparison.Ordinal);
+        Assert.Contains("ctx->fpr[31].d = ctx->fpr[1].d;", code, StringComparison.Ordinal);
+        Assert.Contains("PPC_Fcmp(0, ctx->fpr[31].d, ctx->fpr[4].d);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_Fcmp(0, PPC_PsToScalarInline(ctx->fpr[31].d)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_NormalizesProvidedPairedScalarFloatReturnAfterGuestCall()
+    {
+        var function = new IrFunction(
+            "guest_call_paired_scalar_return",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall("f1", "PPC_PsMul", new[] { IrValue.Register("f2"), IrValue.Register("f3") }),
+                    new IrCall(string.Empty, "func_8019ADE0", Array.Empty<IrValue>()),
+                    new IrAssign("f31", IrValue.Register("f1")),
+                    new IrCall(string.Empty, "PPC_Fcmp", new[] { IrValue.Imm(0), IrValue.Register("f31"), IrValue.Register("f4") }),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64,
+            ["f4"] = ValueRepresentation.Float64,
+            ["f31"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("guest_call_paired_scalar_return", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator(
+            new FixedGuestAbiProvider(
+                ("func_8019ADE0", new GuestFunctionAbi(returnsPairedScalarFloat: true))))
+            .Emit(0x80006108, ssa, signature, types);
+
+        var callIndex = code.IndexOf("InvokeDirectCpu<0x8019ADE0u>(ctx);", StringComparison.Ordinal);
+        var normalizeIndex = code.IndexOf("ctx->fpr[1].d = PPC_PsToScalarInline(ctx->fpr[1].d);", StringComparison.Ordinal);
+        var assignIndex = code.IndexOf("ctx->fpr[31].d = ctx->fpr[1].d;", StringComparison.Ordinal);
+
+        Assert.True(callIndex >= 0, code);
+        Assert.True(normalizeIndex > callIndex, code);
+        Assert.True(assignIndex > normalizeIndex, code);
+        Assert.Contains("PPC_Fcmp(0, ctx->fpr[31].d, ctx->fpr[4].d);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_Fcmp(0, PPC_PsToScalarInline(ctx->fpr[31].d)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_NormalizesPairedAbiFloatArgumentsBeforeGuestCall()
+    {
+        var function = new IrFunction(
+            "guest_call_float_arg",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall("f29", "PPC_PsMul", new[] { IrValue.Register("f1"), IrValue.Register("f2") }),
+                    new IrAssign("f3", IrValue.Register("f29")),
+                    new IrCall(string.Empty, "func_807D5B38", new[] { IrValue.Register("f3") }),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64,
+            ["f29"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("guest_call_float_arg", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator(
+            new FixedGuestAbiProvider(
+                ("func_807D5B38", new GuestFunctionAbi(new[] { "f3" }))))
+            .Emit(0x80006110, ssa, signature, types);
+
+        Assert.Contains("ctx->fpr[3].d = ctx->fpr[29].d;", code, StringComparison.Ordinal);
+        Assert.Contains("ctx->fpr[3].d = PPC_PsToScalarInline(ctx->fpr[3].d);", code, StringComparison.Ordinal);
+        Assert.Contains("InvokeDirectCpu<0x807D5B38u>(ctx);", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_PreservesPairedAbiFloatRegistersForPointerOnlyGuestCall()
+    {
+        var function = new IrFunction(
+            "guest_call_pointer_only",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall("f3", "PPC_PsMul", new[] { IrValue.Register("f1"), IrValue.Register("f2") }),
+                    new IrCall(string.Empty, "func_8019ACCC", new[] { IrValue.Register("f3") }),
+                    new IrCall("f4", "PPC_PsNeg", new[] { IrValue.Register("f3") }),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64,
+            ["f4"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("guest_call_pointer_only", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80006120, ssa, signature, types);
+
+        Assert.Contains("InvokeDirectCpu<0x8019ACCCu>(ctx);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->fpr[3].d = PPC_PsToScalarInline(ctx->fpr[3].d);", code, StringComparison.Ordinal);
+        Assert.Contains("ctx->fpr[4].d = PPC_PsNegInline(ctx->fpr[3].d);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_PsFromScalarInline(ctx->fpr[3].d)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_CachesContextRegistersForLeafFunctionsWhenEnabled()
+    {
+        var function = new IrFunction(
+            "leaf_register_cache",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                    new IrCall("f1", "PPC_PsMul", new[] { IrValue.Register("f2"), IrValue.Register("f3") }),
+                    new IrStore(new IrAddress("r3", 4), IrValue.Register("f1"), 8),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.UInt32,
+            ["r4"] = ValueRepresentation.UInt32,
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("leaf_register_cache", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006200,
+            ssa,
+            signature,
+            types);
+
+        Assert.Contains("uint32_t cached_r3 = ctx->gpr[3];", code, StringComparison.Ordinal);
+        Assert.Contains("uint32_t cached_r4 = ctx->gpr[4];", code, StringComparison.Ordinal);
+        Assert.Contains("double cached_f1 = 0.0;", code, StringComparison.Ordinal);
+        Assert.Contains("cached_r3 = (cached_r3 + cached_r4);", code, StringComparison.Ordinal);
+        Assert.Contains("cached_f1 = PPC_PsMulInline(PPC_PsFromScalarInline(cached_f2), PPC_PsFromScalarInline(cached_f3));", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteFloat64((cached_r3 + 4), cached_f1);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->gpr[4] = cached_r4;", code, StringComparison.Ordinal);
+
+        var flushIndex = code.IndexOf("ctx->gpr[3] = cached_r3;", StringComparison.Ordinal);
+        var returnIndex = code.IndexOf("    return;", flushIndex, StringComparison.Ordinal);
+        Assert.True(flushIndex >= 0, code);
+        Assert.True(returnIndex > flushIndex, code);
+    }
+
+    [Fact]
+    public void CodeGenerator_KeepsEntryLoadWhenReturnFlushCanObserveUnwrittenPath()
+    {
+        var function = new IrFunction(
+            "conditional_register_cache_initializer",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBranch("bne", "write", "exit", "cr0")
+                }),
+                new IrBasicBlock("write", new IrInstruction[]
+                {
+                    new IrBinary("r3", IrValue.Register("r4"), IrValue.Imm(1), "add"),
+                    new IrReturn(null)
+                }),
+                new IrBasicBlock("exit", new IrInstruction[]
+                {
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["cr0"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32,
+            ["r4"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("conditional_register_cache_initializer", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006204,
+            ssa,
+            signature,
+            types);
+
+        Assert.Contains("uint32_t cached_r3 = ctx->gpr[3];", code, StringComparison.Ordinal);
+        Assert.Contains("uint32_t cached_r4 = ctx->gpr[4];", code, StringComparison.Ordinal);
+    }
+    [Fact]
+    public void CodeGenerator_DoesNotElideDirectOnlyFprSaveAfterRegisterModification()
+    {
+        var function = new IrFunction(
+            "modified_direct_fpr_save_no_elision",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r1", IrValue.Register("r1"), IrValue.Imm(-64), "add"),
+                    new IrCall("f31", "PPC_PsMul", new[] { IrValue.Register("f1"), IrValue.Register("f2") }),
+                    new IrStore(new IrAddress("r1", 40), IrValue.Register("f31"), 8),
+                    new IrCall("f31", "PPC_PsAdd", new[] { IrValue.Register("f1"), IrValue.Register("f2") }),
+                    new IrLoad("f31", new IrAddress("r1", 40), 8),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r1"] = ValueRepresentation.UInt32,
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f31"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("modified_direct_fpr_save_no_elision", ValueRepresentation.Void);
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006223,
+            new SsaTransformer().Convert(function),
+            signature,
+            types);
+
+        Assert.Contains("MemoryInline::FlatWriteRamFloat64((cached_r1 + 40), cached_f31);", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatReadFloat64((cached_r1 + 40))", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("leaf_stack_saved_f31_entry", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_DoesNotElideFprStackRestoresAcrossGuestCalls()
+    {
+        var function = new IrFunction(
+            "nonleaf_fpr_restore_no_elision",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r1", IrValue.Register("r1"), IrValue.Imm(-128), "add"),
+                    new IrStore(new IrAddress("r1", 112), IrValue.Register("f31"), 8),
+                    new IrBinary("tmp_psq_store", IrValue.Register("r1"), IrValue.Imm(120), "add"),
+                    new IrCall(string.Empty, "PPC_PsqSt", new[] { IrValue.Register("tmp_psq_store"), IrValue.Register("f31"), IrValue.Imm(0), IrValue.Imm(0) }),
+                    new IrCall(string.Empty, "func_80001234", Array.Empty<IrValue>()),
+                    new IrBinary("tmp_psq_load", IrValue.Register("r1"), IrValue.Imm(120), "add"),
+                    new IrCall("f31", "PPC_PsqL", new[] { IrValue.Register("tmp_psq_load"), IrValue.Imm(0), IrValue.Imm(0) }),
+                    new IrLoad("f31", new IrAddress("r1", 112), 8),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r1"] = ValueRepresentation.UInt32,
+            ["f31"] = ValueRepresentation.Float64,
+            ["tmp_psq_store"] = ValueRepresentation.UInt32,
+            ["tmp_psq_load"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("nonleaf_fpr_restore_no_elision", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006224,
+            ssa,
+            signature,
+            types);
+
+        Assert.Contains("InvokeDirectCpu<0x80001234u>(ctx);", code, StringComparison.Ordinal);
+        Assert.Contains("PPC_PsqStInline<0u, 0u>", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_PsqLInline<0u, 0u>", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatReadFloat64((cached_r1 + 112))", code, StringComparison.Ordinal);
+        Assert.Contains("tmp_psq_store", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("tmp_psq_load", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("leaf_stack_saved_f31_entry", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_DoesNotElidePsqStackLoadWhenValueIsUsedBeforeScalarRestore()
+    {
+        var function = new IrFunction(
+            "used_psq_restore_no_elision",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r1", IrValue.Register("r1"), IrValue.Imm(-128), "add"),
+                    new IrStore(new IrAddress("r1", 112), IrValue.Register("f31"), 8),
+                    new IrBinary("tmp_psq_store", IrValue.Register("r1"), IrValue.Imm(120), "add"),
+                    new IrCall(string.Empty, "PPC_PsqSt", new[] { IrValue.Register("tmp_psq_store"), IrValue.Register("f31"), IrValue.Imm(0), IrValue.Imm(0) }),
+                    new IrCall(string.Empty, "func_80001234", Array.Empty<IrValue>()),
+                    new IrBinary("tmp_psq_load", IrValue.Register("r1"), IrValue.Imm(120), "add"),
+                    new IrCall("f31", "PPC_PsqL", new[] { IrValue.Register("tmp_psq_load"), IrValue.Imm(0), IrValue.Imm(0) }),
+                    new IrStore(new IrAddress("r1", 40), IrValue.Register("f31"), 8),
+                    new IrLoad("f31", new IrAddress("r1", 112), 8),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r1"] = ValueRepresentation.UInt32,
+            ["f31"] = ValueRepresentation.Float64,
+            ["tmp_psq_store"] = ValueRepresentation.UInt32,
+            ["tmp_psq_load"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("used_psq_restore_no_elision", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006226,
+            ssa,
+            signature,
+            types);
+
+        Assert.Contains("PPC_PsqLInline<0u, 0u>", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteFloat64((cached_r1 + 40), cached_f31);", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatReadFloat64((cached_r1 + 112))", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("leaf_stack_saved_f31_entry", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_DoesNotElideFprStackRestoresWhenSlotIsOtherwiseAccessed()
+    {
+        var function = new IrFunction(
+            "overlapping_fpr_restore_no_elision",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r1", IrValue.Register("r1"), IrValue.Imm(-128), "add"),
+                    new IrStore(new IrAddress("r1", 112), IrValue.Register("f31"), 8),
+                    new IrBinary("tmp_psq_store", IrValue.Register("r1"), IrValue.Imm(120), "add"),
+                    new IrCall(string.Empty, "PPC_PsqSt", new[] { IrValue.Register("tmp_psq_store"), IrValue.Register("f31"), IrValue.Imm(0), IrValue.Imm(0) }),
+                    new IrLoad("f1", new IrAddress("r1", 116), 4),
+                    new IrBinary("tmp_psq_load", IrValue.Register("r1"), IrValue.Imm(120), "add"),
+                    new IrCall("f31", "PPC_PsqL", new[] { IrValue.Register("tmp_psq_load"), IrValue.Imm(0), IrValue.Imm(0) }),
+                    new IrLoad("f31", new IrAddress("r1", 112), 8),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r1"] = ValueRepresentation.UInt32,
+            ["f1"] = ValueRepresentation.Float64,
+            ["f31"] = ValueRepresentation.Float64,
+            ["tmp_psq_store"] = ValueRepresentation.UInt32,
+            ["tmp_psq_load"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("overlapping_fpr_restore_no_elision", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006228,
+            ssa,
+            signature,
+            types);
+
+        Assert.DoesNotContain("PPC_PsqLInline<0u, 0u>", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatReadFloat32((cached_r1 + 116))", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatReadFloat64((cached_r1 + 112))", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("leaf_stack_saved_f31_entry", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RuntimeNativeAbiProvider_LoadsTypedVoidStubsButSkipsCpuContextStubs()
+    {
+        var tempDir = Path.Combine(Path.GetTempPath(), "mkw_native_abi_tests", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(tempDir);
+        File.WriteAllText(
+            Path.Combine(tempDir, "gx_test.cpp"),
+            """
+            PPC_NATIVE_OVERRIDE_VOID(801733b4, GX__SetViewport_801733b4, (float l, uint32_t t, uint32_t out), (l, t, out));
+            PPC_NATIVE_OVERRIDE_VOID(801A0870, OSSetAlarm_HLE_801a0870, (CpuContext* ctx), (ctx));
+            """);
+
+        var provider = RuntimeNativeFunctionAbiProvider.LoadVoidStubAbisFromDirectory(tempDir);
+
+        Assert.True(provider.TryGetGuestFunctionAbi("func_801733B4", out var abi));
+        Assert.True(abi.PreservesVolatileContext);
+        Assert.False(abi.WritesGprReturnRegister);
+        Assert.True(abi.HasScalarFloatArgument("f1"));
+        Assert.True(abi.HasArgumentRegister("f1"));
+        Assert.True(abi.HasArgumentRegister("r3"));
+        Assert.True(abi.HasArgumentRegister("r4"));
+        Assert.False(provider.TryGetGuestFunctionAbi("func_801A0870", out _));
+    }
+
+    [Fact]
+    public void CodeGenerator_EmitsForwardDeclarationsAndAliasStub()
+    {
+        var function = new IrFunction(
+            "named-call-target",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall(string.Empty, "func_helper_target", Array.Empty<IrValue>()),
+                    new IrReturn(null)
+                })
+            });
+
+        var types = new RepresentationEnvironment();
+        var signature = new FunctionAbiClassification("named-call-target", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80007000, ssa, signature, types);
+
+        Assert.Contains("extern \"C\" void func_helper_target(CpuContext* ctx);", code, StringComparison.Ordinal);
+        Assert.Contains("extern \"C\" void func_80007000(CpuContext* MKW_RESTRICT ctx)", code, StringComparison.Ordinal);
+        Assert.Contains("named_call_target(ctx);", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_EmitsUndefinedJumpTableAndImplicitReturnPaths()
+    {
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.UInt32,
+            ["cr0"] = ValueRepresentation.UInt32,
+            ["f5"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("coverage_codegen", ValueRepresentation.Void);
+
+        var undefinedFunction = new IrFunction(
+            "undefined_case",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrUndefined(0x80008000, 0x7C000008, "trap for coverage")
+                })
+            });
+        var undefinedCode = new CxxLinearCodeGenerator().Emit(
+            0x80008000,
+            new SsaTransformer().Convert(undefinedFunction),
+            signature,
+            types,
+            );
+        Assert.Contains("UNDEFINED(0x80008000u, 0x7C000008u, \"trap for coverage\");", undefinedCode, StringComparison.Ordinal);
+        Assert.Contains("return;", undefinedCode, StringComparison.Ordinal);
+
+        var jumpTableFunction = new IrFunction(
+            "jump_table_case",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrJumpTable("r3", new[]
+                    {
+                        new IrJumpTableCase(0x80008100, "case_a"),
+                        new IrJumpTableCase(0x80008110, "case_b")
+                    })
+                }),
+                new IrBasicBlock("case_a", new IrInstruction[] { new IrReturn(null) }),
+                new IrBasicBlock("case_b", new IrInstruction[] { new IrReturn(null) })
+            });
+        var jumpTableCode = new CxxLinearCodeGenerator().Emit(
+            0x80008010,
+            new SsaTransformer().Convert(jumpTableFunction),
+            signature,
+            types,
+            );
+        Assert.Contains("switch (static_cast<uint32_t>(ctx->gpr[3]))", jumpTableCode, StringComparison.Ordinal);
+        Assert.Contains("case 0x80008100u:", jumpTableCode, StringComparison.Ordinal);
+        Assert.Contains("InvokeIndirectJump(ctx->gpr[3], ctx);", jumpTableCode, StringComparison.Ordinal);
+
+        var implicitReturnFunction = new IrFunction(
+            "implicit_return_case",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrAssign("tmp_local", IrValue.Imm(1))
+                })
+            });
+        var implicitReturnCode = new CxxLinearCodeGenerator().Emit(
+            0x80008020,
+            new SsaTransformer().Convert(implicitReturnFunction),
+            signature,
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation> { ["tmp_local"] = ValueRepresentation.Int32 }),
+            );
+        Assert.DoesNotContain("tmp_local_0 = 1;", implicitReturnCode, StringComparison.Ordinal);
+        Assert.Contains("return;", implicitReturnCode, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CodeGenerator_NormalizesScalarInputsToPairedAndParsesInvalidFloatRegisters()
+    {
+        var normalizeMethod = typeof(CxxLinearCodeGenerator).GetMethod(
+            "EmitNormalizePairedStateOnEdge",
+            BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(normalizeMethod);
+
+        var sb = new StringBuilder();
+        normalizeMethod!.Invoke(
+            null,
+            new object?[]
+            {
+                sb,
+                "    ",
+                "from",
+                "to",
+                new Dictionary<string, HashSet<string>>(StringComparer.OrdinalIgnoreCase)
+                {
+                    ["from"] = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
+                },
+                new Dictionary<string, HashSet<string>>(StringComparer.OrdinalIgnoreCase)
+                {
+                    ["to"] = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "f5" }
+                }
+            });
+
+        Assert.Contains("ctx->fpr[5].d = PPC_PsFromScalarInline(ctx->fpr[5].d);", sb.ToString(), StringComparison.Ordinal);
+
+        var parseMethod = typeof(CxxLinearCodeGenerator).GetMethod("ParseFloatRegisterIndex", BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(parseMethod);
+        Assert.Equal(int.MaxValue, (int)parseMethod!.Invoke(null, new object?[] { "not_a_float_reg" })!);
+    }
+}
diff --git a/translator/tests/Translator.Tests/ContinuationPlannerTests.cs b/translator/tests/Translator.Tests/ContinuationPlannerTests.cs
new file mode 100644
index 0000000..efa2c51
--- /dev/null
+++ b/translator/tests/Translator.Tests/ContinuationPlannerTests.cs
@@ -0,0 +1,161 @@
+using System.Buffers.Binary;
+using Translator.Core.Mods;
+using Translator.Core.Mods.Mkwii;
+using Translator.Core.Parsing.Kamek;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class ContinuationPlannerTests
+{
+    [Fact]
+    public void AddModuleTailJumpContinuationsAddsInternalBaseTarget()
+    {
+        const uint moduleBase = 0x81200000u;
+        var moduleImage = new byte[0x20];
+        WriteU32(moduleImage, 0x00, 0x3D80807Eu); // lis r12,0x807E
+        WriteU32(moduleImage, 0x04, 0x618C3064u); // ori r12,r12,0x3064
+        WriteU32(moduleImage, 0x08, 0x7D8903A6u); // mtctr r12
+        WriteU32(moduleImage, 0x0C, 0x4E800420u); // bctr
+
+        var plan = ContinuationPlanner.Build(EmptyChunk(), TestManifest(), moduleBase);
+        var result = ContinuationPlanner.AddModuleTailJumpContinuations(
+            plan,
+            TestManifest(),
+            moduleBase,
+            moduleImage);
+
+        var entry = Assert.Single(result.Entries);
+        Assert.Equal(0x807E3064u, entry.Address);
+        Assert.Equal(0x807E2D18u, entry.ContainingFunctionStart);
+        Assert.Equal(0x807E30ACu, entry.ContainingFunctionEnd);
+        Assert.Equal(0x8120000Cu, entry.SourceCommandAddress);
+        Assert.Contains("tail jump", entry.Reason);
+    }
+
+    [Fact]
+    public void AddModuleTailJumpContinuationsSupportsSignedAddiLowImmediate()
+    {
+        const uint moduleBase = 0x81200000u;
+        var moduleImage = new byte[0x20];
+        WriteU32(moduleImage, 0x00, 0x3D80807Fu); // lis r12,0x807F
+        WriteU32(moduleImage, 0x04, 0x398CFFF0u); // addi r12,r12,-0x10
+        WriteU32(moduleImage, 0x08, 0x7D8903A6u); // mtctr r12
+        WriteU32(moduleImage, 0x0C, 0x4E800420u); // bctr
+
+        var manifest = new BaseManifest(
+            "test",
+            1,
+            "RMCP01",
+            "P",
+            "",
+            0,
+            [
+                new BaseSectionMetadata(".text", "StaticR.rel", 0x807EFFF0u, 0x807F0100u, true, false, "base_text.bin", 0)
+            ],
+            [
+                new BaseFunctionRangeMetadata(0x807EFFE0u, 0x807F0100u, "func_807EFFE0", ".text", 0, "test", ["Executable"])
+            ],
+            "ranges.json");
+
+        var plan = ContinuationPlanner.Build(EmptyChunk(), manifest, moduleBase);
+        var result = ContinuationPlanner.AddModuleTailJumpContinuations(plan, manifest, moduleBase, moduleImage);
+
+        var entry = Assert.Single(result.Entries);
+        Assert.Equal(0x807EFFF0u, entry.Address);
+        Assert.Equal(0x807EFFE0u, entry.ContainingFunctionStart);
+    }
+
+    [Fact]
+    public void AddModuleTailJumpContinuationsIgnoresFunctionEntries()
+    {
+        const uint moduleBase = 0x81200000u;
+        var moduleImage = new byte[0x20];
+        WriteU32(moduleImage, 0x00, 0x3D80807Eu); // lis r12,0x807E
+        WriteU32(moduleImage, 0x04, 0x618C2D18u); // ori r12,r12,0x2D18
+        WriteU32(moduleImage, 0x08, 0x7D8903A6u); // mtctr r12
+        WriteU32(moduleImage, 0x0C, 0x4E800420u); // bctr
+
+        var manifest = TestManifest();
+        var plan = ContinuationPlanner.Build(EmptyChunk(), manifest, moduleBase);
+        var result = ContinuationPlanner.AddModuleTailJumpContinuations(plan, manifest, moduleBase, moduleImage);
+
+        Assert.Empty(result.Entries);
+    }
+
+    [Fact]
+    public void AddRetroWfcExecutableHookContinuationsAddsInternalBaseTarget()
+    {
+        var manifest = new BaseManifest(
+            "test",
+            1,
+            "RMCP01",
+            "P",
+            "",
+            0,
+            [
+                new BaseSectionMetadata(".text", "main.dol", 0x800F164Cu, 0x800F1BC8u, true, false, "base_text.bin", 0)
+            ],
+            [
+                new BaseFunctionRangeMetadata(0x800F164Cu, 0x800F1BC8u, "func_800F164C", ".text", 0, "test", ["Executable"])
+            ],
+            "ranges.json");
+        var hook = new RetroWfcExecutableHookPlan(
+            5,
+            "executableHookWithContinuation",
+            "branchCtr",
+            0x800F164Cu,
+            4,
+            0x800F164Cu,
+            0x800F1BC8u,
+            ".text",
+            ["support.hostnameRewrite.gethostbyname"],
+            "overlayHookPatch",
+            0x8179E1A4u,
+            "support.hostnameRewrite.gethostbyname",
+            "moduleFunction",
+            null,
+            0x800F165Cu);
+
+        var plan = ContinuationPlanner.Build(EmptyChunk(), manifest, 0x81200000u);
+        var result = ContinuationPlanner.AddRetroWfcExecutableHookContinuations(plan, manifest, [hook]);
+
+        var entry = Assert.Single(result.Entries);
+        Assert.Equal(0x800F165Cu, entry.Address);
+        Assert.Equal(0x800F164Cu, entry.ContainingFunctionStart);
+        Assert.Equal(0x800F1BC8u, entry.ContainingFunctionEnd);
+        Assert.Equal(0x800F164Cu, entry.SourceCommandAddress);
+        Assert.Contains("Retro WFC executable hook continuation", entry.Reason);
+    }
+
+    private static KamekChunk EmptyChunk() =>
+        new(
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            KamekChunk.HeaderSize,
+            [],
+            []);
+
+    private static BaseManifest TestManifest() =>
+        new(
+            "test",
+            1,
+            "RMCP01",
+            "P",
+            "",
+            0,
+            [
+                new BaseSectionMetadata(".text", "StaticR.rel", 0x807E2D18u, 0x807E30ACu, true, false, "base_text.bin", 0)
+            ],
+            [
+                new BaseFunctionRangeMetadata(0x807E2D18u, 0x807E30ACu, "func_807E2D18", ".text", 0, "test", ["Executable"])
+            ],
+            "ranges.json");
+
+    private static void WriteU32(byte[] data, int offset, uint value) =>
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(offset, 4), value);
+}
diff --git a/translator/tests/Translator.Tests/CxxLinearCodeGeneratorEmitExtensions.cs b/translator/tests/Translator.Tests/CxxLinearCodeGeneratorEmitExtensions.cs
new file mode 100644
index 0000000..9ea4f49
--- /dev/null
+++ b/translator/tests/Translator.Tests/CxxLinearCodeGeneratorEmitExtensions.cs
@@ -0,0 +1,67 @@
+using System.Collections.Generic;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Representation;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Test-only wrapper around <see cref="CxxLinearCodeGenerator.EmitWithFacts"/> that returns just the
+/// emitted C++ text, so codegen tests don't have to thread an unused facts object through every call.
+/// </summary>
+internal static class CxxLinearCodeGeneratorEmitExtensions
+{
+    public static string Emit(
+        this CxxLinearCodeGenerator generator,
+        uint entryPoint,
+        SsaResult ssa,
+        FunctionAbiClassification signature,
+        RepresentationEnvironment types,
+        bool emitModRegistration = false,
+        uint modRegistrationPriority = 100,
+        ulong modRegistrationModuleId = 1,
+        IReadOnlySet<uint>? nonReturningCallTargets = null,
+        IReadOnlySet<uint>? lrContinuationCallTargets = null,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts = null,
+        bool emitStateFreeLeafVariant = false,
+        IReadOnlyDictionary<uint, GuestAbiContract>? stateFreeAbiContracts = null,
+        IReadOnlyDictionary<uint, string>? stateFreeCallSymbols = null,
+        IReadOnlyDictionary<GuestStateFreeCallSiteKey, GuestStateFreeCallVariant>? stateFreeCallSiteVariants = null,
+        IReadOnlyList<GuestStateFreeCallVariant>? stateFreeEntryVariants = null,
+        uint? moduleLinkBase = null,
+        uint? moduleGuestBase = null,
+        uint moduleLinkedCodeSize = 0,
+        IReadOnlyDictionary<string, uint>? gqrEntryConstants = null,
+        IReadOnlyDictionary<uint, byte>? gqrCalleeWriteMasks = null,
+        bool gqrConstantsRequireRuntimeGuard = false,
+        bool enableLeafAbiSpillElision = false,
+        IReadOnlySet<uint>? modOverridableCallTargets = null,
+        bool enableGpuFifoBurstCoalescing = true) =>
+        generator.EmitWithFacts(
+            entryPoint: entryPoint,
+            ssa: ssa,
+            signature: signature,
+            types: types,
+            emitModRegistration: emitModRegistration,
+            modRegistrationPriority: modRegistrationPriority,
+            modRegistrationModuleId: modRegistrationModuleId,
+            nonReturningCallTargets: nonReturningCallTargets,
+            lrContinuationCallTargets: lrContinuationCallTargets,
+            guestAbiContracts: guestAbiContracts,
+            emitStateFreeLeafVariant: emitStateFreeLeafVariant,
+            stateFreeAbiContracts: stateFreeAbiContracts,
+            stateFreeCallSymbols: stateFreeCallSymbols,
+            stateFreeCallSiteVariants: stateFreeCallSiteVariants,
+            stateFreeEntryVariants: stateFreeEntryVariants,
+            moduleLinkBase: moduleLinkBase,
+            moduleGuestBase: moduleGuestBase,
+            moduleLinkedCodeSize: moduleLinkedCodeSize,
+            gqrEntryConstants: gqrEntryConstants,
+            gqrCalleeWriteMasks: gqrCalleeWriteMasks,
+            gqrConstantsRequireRuntimeGuard: gqrConstantsRequireRuntimeGuard,
+            enableLeafAbiSpillElision: enableLeafAbiSpillElision,
+            modOverridableCallTargets: modOverridableCallTargets,
+            enableGpuFifoBurstCoalescing: enableGpuFifoBurstCoalescing).Code;
+}
diff --git a/translator/tests/Translator.Tests/DifferentialDisassemblyTests.cs b/translator/tests/Translator.Tests/DifferentialDisassemblyTests.cs
new file mode 100644
index 0000000..d635ad6
--- /dev/null
+++ b/translator/tests/Translator.Tests/DifferentialDisassemblyTests.cs
@@ -0,0 +1,137 @@
+using System;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Text.RegularExpressions;
+using Translator.Core.Disassembly;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class DifferentialDisassemblyTests
+{
+    [Theory]
+    [InlineData(0x7C032800u, 0x80000000u, "cmpw")]
+    [InlineData(0x41820010u, 0x80000000u, "beq")]
+    [InlineData(0x3C608038u, 0x80000000u, "lis")]
+    [InlineData(0x6063F780u, 0x80000004u, "ori")]
+    [InlineData(0x7C0903A6u, 0x80000000u, "mtctr")]
+    public void DecoderMnemonicMatchesDolphinOracle(uint opcode, uint address, string expectedMnemonic)
+    {
+        if (!LlvmDisassemblerOracle.IsAvailable())
+        {
+            return;
+        }
+
+        var oracle = LlvmDisassemblerOracle.Disassemble(opcode, address);
+        var decoded = PpcDecoder.Decode(address, opcode);
+
+        Assert.Equal(expectedMnemonic, decoded.Mnemonic);
+        Assert.Equal(expectedMnemonic, NormalizeMnemonic(oracle));
+    }
+
+    private static string NormalizeMnemonic(string disassembly)
+    {
+        foreach (var line in disassembly.Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries))
+        {
+            var match = Regex.Match(line.ToLowerInvariant(), @"^\s*[0-9a-f]+:\s+(?:[0-9a-f]{2}\s+){4}([a-z0-9_.]+)");
+            if (match.Success)
+            {
+                return match.Groups[1].Value;
+            }
+        }
+
+        throw new Xunit.Sdk.XunitException($"Failed to parse oracle disassembly '{disassembly}'.");
+    }
+
+    private static class LlvmDisassemblerOracle
+    {
+        public static bool IsAvailable()
+        {
+            try
+            {
+                if (OperatingSystem.IsWindows())
+                {
+                    var output = Run("wsl.exe", "bash -lc 'command -v llvm-mc-18 >/dev/null && command -v llvm-objdump-18 >/dev/null && echo ok'");
+                    return output.Contains("ok", StringComparison.OrdinalIgnoreCase);
+                }
+
+                return !string.IsNullOrWhiteSpace(Run("bash", "-lc 'command -v llvm-mc-18 && command -v llvm-objdump-18'"));
+            }
+            catch
+            {
+                return false;
+            }
+        }
+
+        public static string Disassemble(uint opcode, uint address)
+        {
+            var tempDir = Path.Combine(Path.GetTempPath(), "mkw_llvm_disasm_oracle");
+            Directory.CreateDirectory(tempDir);
+            var asmPath = Path.Combine(tempDir, "oracle.s");
+            var objPath = Path.Combine(tempDir, "oracle.o");
+            File.WriteAllText(
+                asmPath,
+                $".text{Environment.NewLine}.long 0x{opcode.ToString("X8", CultureInfo.InvariantCulture)}{Environment.NewLine}");
+
+            if (OperatingSystem.IsWindows())
+            {
+                var asmWsl = ToWslPath(asmPath);
+                var objWsl = ToWslPath(objPath);
+                RunWsl($"/usr/bin/llvm-mc-18 -triple=powerpc-unknown-unknown -filetype=obj -o '{objWsl}' '{asmWsl}'");
+                return RunWsl(
+                    $"/usr/bin/llvm-objdump-18 --triple=powerpc-unknown-unknown --adjust-vma=0x{address.ToString("X", CultureInfo.InvariantCulture)} -d '{objWsl}'");
+            }
+
+            Run("llvm-mc-18", $"-triple=powerpc-unknown-unknown -filetype=obj -o \"{objPath}\" \"{asmPath}\"");
+            return Run(
+                "llvm-objdump-18",
+                $"--triple=powerpc-unknown-unknown --adjust-vma=0x{address.ToString("X", CultureInfo.InvariantCulture)} -d \"{objPath}\"");
+        }
+
+        private static string Run(string fileName, string arguments)
+        {
+            var psi = new ProcessStartInfo
+            {
+                FileName = fileName,
+                Arguments = arguments,
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false
+            };
+
+            using var process = Process.Start(psi)!;
+            process.WaitForExit(10000);
+            var stdout = process.StandardOutput.ReadToEnd();
+            var stderr = process.StandardError.ReadToEnd();
+            Assert.True(process.ExitCode == 0, $"{fileName} {arguments}\nstdout:\n{stdout}\nstderr:\n{stderr}");
+            return stdout + stderr;
+        }
+
+        private static string RunWsl(string command)
+        {
+            var escaped = command.Replace("'", "'\"'\"'");
+            return Run("wsl.exe", $"bash -lc '{escaped}'");
+        }
+
+        private static string ToWslPath(string windowsPath)
+        {
+            var psi = new ProcessStartInfo
+            {
+                FileName = "wsl.exe",
+                Arguments = $"wslpath -a \"{windowsPath}\"",
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false
+            };
+
+            using var process = Process.Start(psi)!;
+            process.WaitForExit(10000);
+            var stdout = process.StandardOutput.ReadToEnd().Trim();
+            var stderr = process.StandardError.ReadToEnd();
+            Assert.True(process.ExitCode == 0, $"wslpath failed for '{windowsPath}': {stderr}");
+            Assert.False(string.IsNullOrWhiteSpace(stdout), $"wslpath returned empty output for '{windowsPath}'.");
+            return stdout;
+        }
+    }
+}
diff --git a/translator/tests/Translator.Tests/DolFileTests.cs b/translator/tests/Translator.Tests/DolFileTests.cs
new file mode 100644
index 0000000..dfb261e
--- /dev/null
+++ b/translator/tests/Translator.Tests/DolFileTests.cs
@@ -0,0 +1,60 @@
+using System.IO;
+using System.Linq;
+using System.Buffers.Binary;
+using Translator.Core.Loading;
+using Translator.Core.Parsing.Dol;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class DolFileTests
+{
+    private static string DolPath => Path.Combine(ProjectPaths.FindRepositoryRoot(), "assets", "main.dol");
+
+    [Fact]
+    public void ParsesExpectedSectionsAndRanges()
+    {
+        var dol = DolFile.Load(DolPath);
+
+        Assert.Equal(0x800060A4u, dol.EntryPoint);
+        Assert.Equal(0x80004000u, dol.MemoryRange.Start);
+        Assert.Equal(0x8038917Cu, dol.MemoryRange.End);
+
+        Assert.Equal(11, dol.Sections.Count);
+        Assert.Equal(2, dol.Sections.Count(s => s.Kind == SectionKind.Text));
+        Assert.Equal(8, dol.Sections.Count(s => s.Kind == SectionKind.Data));
+        Assert.Equal(1, dol.Sections.Count(s => s.Kind == SectionKind.Bss));
+
+        var init = dol.Sections.Single(s => s.Name == ".init");
+        Assert.Equal(0x80004000u, init.VirtualAddress);
+        Assert.Equal(0x2460u, init.Size);
+
+        var text = dol.Sections.Single(s => s.Name == ".text");
+        Assert.Equal(0x800072C0u, text.VirtualAddress);
+        Assert.Equal(0x23DB20u, text.Size);
+
+        var data = dol.Sections.Single(s => s.Name == ".data");
+        Assert.Equal(0x80258580u, data.VirtualAddress);
+        Assert.Equal(0x4BAC0u, data.Size);
+
+        var bss = dol.Sections.Single(s => s.Kind == SectionKind.Bss);
+        Assert.Equal(0x802A4080u, bss.VirtualAddress);
+        Assert.Equal(0xE50FCu, bss.Size);
+    }
+
+    [Fact]
+    public void MkwOutlineEffectConstantLivesInInitializedSdata2DespiteDolHeaderBssOverlap()
+    {
+        var dol = DolFile.Load(DolPath);
+        var sdata2 = dol.Sections.Single(s => s.Name == ".sdata2");
+        const uint outlineEffectScaleAddress = 0x80389060;
+
+        Assert.True(sdata2.Range.Contains(outlineEffectScaleAddress));
+        Assert.True(dol.Sections.Single(s => s.Kind == SectionKind.Bss).Range.Contains(outlineEffectScaleAddress));
+
+        var offset = checked((int)(outlineEffectScaleAddress - sdata2.VirtualAddress));
+        var rawValue = BinaryPrimitives.ReadUInt32BigEndian(sdata2.Data.Span.Slice(offset, sizeof(uint)));
+
+        Assert.Equal(0x41200000u, rawValue);
+    }
+}
diff --git a/translator/tests/Translator.Tests/EmittedOutputShapeTests.cs b/translator/tests/Translator.Tests/EmittedOutputShapeTests.cs
new file mode 100644
index 0000000..6fbb0c2
--- /dev/null
+++ b/translator/tests/Translator.Tests/EmittedOutputShapeTests.cs
@@ -0,0 +1,156 @@
+using System.Collections.Generic;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Shape of the emitted text. These assertions are about readability of the
+/// generated C++; each one is semantics-preserving by construction.
+/// </summary>
+public class EmittedOutputShapeTests
+{
+    private static string Emit(IrFunction function, RepresentationEnvironment types, uint entryPoint = 0x80001000u) =>
+        new CxxLinearCodeGenerator().Emit(
+            entryPoint,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification(function.Name, ValueRepresentation.Void),
+            types);
+
+    private static RepresentationEnvironment UInt32Registers(params string[] names)
+    {
+        var map = new Dictionary<string, ValueRepresentation>();
+        foreach (var name in names) map[name] = ValueRepresentation.UInt32;
+        return new RepresentationEnvironment(map);
+    }
+
+    [Fact]
+    public void BranchWithAPureFallthroughFalseEdgeOmitsTheElseBlock()
+    {
+        var function = new IrFunction("branch_fallthrough", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrBranch("beq", "taken", "next", "cr0")
+            }),
+            new IrBasicBlock("next", new IrInstruction[]
+            {
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Imm(1), "add"),
+                new IrReturn(null)
+            }),
+            new IrBasicBlock("taken", new IrInstruction[] { new IrReturn(null) })
+        });
+
+        var code = Emit(function, UInt32Registers("r3"));
+
+        Assert.Contains("goto loc_taken;", code, StringComparison.Ordinal);
+        // The false edge falls through to the next emitted block and needs no
+        // representation normalization, so there is nothing to put in an else.
+        Assert.DoesNotContain("} else {", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BranchWithARealFalseEdgeKeepsTheElseBlock()
+    {
+        var function = new IrFunction("branch_two_gotos", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrBranch("beq", "taken", "other", "cr0")
+            }),
+            new IrBasicBlock("filler", new IrInstruction[] { new IrReturn(null) }),
+            new IrBasicBlock("taken", new IrInstruction[] { new IrReturn(null) }),
+            new IrBasicBlock("other", new IrInstruction[] { new IrReturn(null) })
+        });
+
+        var code = Emit(function, UInt32Registers("r3"));
+
+        Assert.Contains("} else {", code, StringComparison.Ordinal);
+        Assert.Contains("goto loc_other;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AddressConstantsAssignedToUnsignedRegistersPrintAsHex()
+    {
+        var function = new IrFunction("address_constants", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                // 0x801B4ABC as a signed int immediate.
+                new IrAssign("lr", IrValue.Imm(unchecked((int)0x801B4ABCu))),
+                new IrAssign("r4", IrValue.Imm(unchecked((int)0x80000000u))),
+                // Not an address: a genuinely signed small immediate, and a
+                // negative value outside the guest address window.
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Imm(-16), "add"),
+                new IrAssign("r5", IrValue.Imm(-1)),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function, UInt32Registers("r3", "r4", "r5"));
+
+        Assert.Contains("ctx->lr = 0x801B4ABCu;", code, StringComparison.Ordinal);
+        Assert.Contains("r4 = 0x80000000u;", code, StringComparison.Ordinal);
+        Assert.Contains("r3 = (r3 + -16);", code, StringComparison.Ordinal);
+        Assert.Contains("r5 = -1;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SubWordStoresCastToTheExactMemoryParameterType()
+    {
+        var function = new IrFunction("sub_word_stores", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrStore(new IrAddress("r4", 0), IrValue.Register("r3"), 1),
+                new IrStore(new IrAddress("r4", 4), IrValue.Register("r3"), 2),
+                new IrStore(new IrAddress("r4", 8), IrValue.Register("r3"), 4),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function, UInt32Registers("r3", "r4"));
+
+        Assert.Contains("MemoryInline::FlatWrite8(r4, static_cast<uint8_t>(r3));", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWrite16((r4 + 4), static_cast<uint16_t>(r3));", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWrite32((r4 + 8), r3);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("static_cast<uint32_t>(r3)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FloatFlatHelpersPreserveTheWidthMapping()
+    {
+        var function = new IrFunction("float_width_helpers", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrStore(new IrAddress("r4", 0), IrValue.Register("f1"), 4),
+                new IrStore(new IrAddress("r4", 8), IrValue.Register("f2"), 8),
+                new IrLoad("f3", new IrAddress("r4", 16), 4),
+                new IrLoad("f4", new IrAddress("r4", 24), 8),
+                new IrReturn(null)
+            })
+        });
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r4"] = ValueRepresentation.UInt32,
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64,
+            ["f4"] = ValueRepresentation.Float64
+        });
+
+        var code = Emit(function, types);
+
+        Assert.Contains("MemoryInline::FlatWriteFloat32(r4, f1.d);", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteFloat64((r4 + 8), f2.d);", code, StringComparison.Ordinal);
+        Assert.Contains("f3.d = MemoryInline::FlatReadFloat32((r4 + 16));", code, StringComparison.Ordinal);
+        Assert.Contains("f4.d = MemoryInline::FlatReadFloat64((r4 + 24));", code, StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/FlagElisionCodeGenTests.cs b/translator/tests/Translator.Tests/FlagElisionCodeGenTests.cs
new file mode 100644
index 0000000..71ae2ca
--- /dev/null
+++ b/translator/tests/Translator.Tests/FlagElisionCodeGenTests.cs
@@ -0,0 +1,672 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Compare+branch fusion, dead CR-field/XER.CA elimination, and LR store elision. Negative cases
+/// outnumber positive ones because each would be a silent-corruption bug if it started firing.
+/// </summary>
+public class FlagElisionCodeGenTests
+{
+    private static string Emit(
+        IrFunction function,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts = null,
+        IReadOnlySet<uint>? modOverridableCallTargets = null,
+        IReadOnlySet<uint>? lrContinuationCallTargets = null) =>
+        new CxxLinearCodeGenerator().Emit(
+            0x80001000u,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification(function.Name, ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            guestAbiContracts: guestAbiContracts,
+            lrContinuationCallTargets: lrContinuationCallTargets,
+            modOverridableCallTargets: modOverridableCallTargets);
+
+    private static GuestAbiContract Contract(
+        bool readsLr = false,
+        bool readsXer = false,
+        bool writesXer = false,
+        byte crRead = 0,
+        byte crWrite = 0,
+        GuestCallBoundaryFlags flags = GuestCallBoundaryFlags.None) =>
+        new(
+            GprReadBeforeWriteMask: 0,
+            GprPossibleWriteMask: 0,
+            GprReturnMask: 0,
+            FprReadBeforeWriteMask: 0,
+            FprPossibleWriteMask: 0,
+            FprReturnMask: 0,
+            CrReadBeforeWriteMask: crRead,
+            CrPossibleWriteMask: crWrite,
+            ReadsXerBeforeWrite: readsXer,
+            MayWriteXer: writesXer,
+            ReadsCtrBeforeWrite: false,
+            MayWriteCtr: false,
+            ReadsLrBeforeWrite: readsLr,
+            MayWriteLr: false,
+            BoundaryFlags: flags,
+            DirectCallTargets: Array.Empty<uint>());
+
+    /// <summary>A block that overwrites CR0 and returns, so reaching it on every outgoing edge
+    /// makes the CR0 producer dead (the function's return boundary always counts as a reader).</summary>
+    private static IrBasicBlock Cr0KillingExit(string label, string register) =>
+        new(label, new IrInstruction[]
+        {
+            new IrSetCrField(0, IrValue.Register(register), IrValue.Imm(0), false),
+            new IrReturn(null)
+        });
+
+    private static IrFunction CompareThenBranch(
+        string name,
+        string condition,
+        bool isUnsigned,
+        IrValue right)
+    {
+        return new IrFunction(name, "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), right, isUnsigned),
+                new IrBranch(condition, "taken", "fallthrough", "cr0")
+            }),
+            Cr0KillingExit("taken", "r4"),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+    }
+
+    [Theory]
+    [InlineData("beq", false, "(static_cast<int32_t>(r3) == static_cast<int32_t>(0))")]
+    [InlineData("bne", false, "(static_cast<int32_t>(r3) != static_cast<int32_t>(0))")]
+    [InlineData("blt", false, "(static_cast<int32_t>(r3) < static_cast<int32_t>(0))")]
+    [InlineData("bge", false, "(static_cast<int32_t>(r3) >= static_cast<int32_t>(0))")]
+    [InlineData("bgt", false, "(static_cast<int32_t>(r3) > static_cast<int32_t>(0))")]
+    [InlineData("ble", false, "(static_cast<int32_t>(r3) <= static_cast<int32_t>(0))")]
+    [InlineData("blt", true, "(static_cast<uint32_t>(r3) < static_cast<uint32_t>(0))")]
+    [InlineData("bge", true, "(static_cast<uint32_t>(r3) >= static_cast<uint32_t>(0))")]
+    public void CompareFeedingItsOnlyBranchBecomesADirectComparison(
+        string condition, bool isUnsigned, string expected)
+    {
+        var code = Emit(CompareThenBranch($"fuse_{condition}", condition, isUnsigned, IrValue.Imm(0)));
+
+        Assert.Contains($"if ({expected})", code, StringComparison.Ordinal);
+        // The two exit blocks still write CR0, so exactly two compares survive.
+        Assert.Equal(2, CountOccurrences(code, "SetCRResident("));
+    }
+
+    [Fact]
+    public void FusionUsesTheRegisterOperandOfARegisterToRegisterCompare()
+    {
+        var code = Emit(CompareThenBranch("fuse_reg", "bgt", isUnsigned: false, IrValue.Register("r6")));
+
+        Assert.Contains(
+            "if ((static_cast<int32_t>(r3) > static_cast<int32_t>(r6)))",
+            code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FusionReachesTheCompareThroughASingleEntrySinglExitPredecessor()
+    {
+        // The basic-block builder frequently starts a new block at the branch,
+        // which puts the compare in the sole predecessor.
+        var function = new IrFunction("fuse_across_block", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(7), false)
+            }),
+            new IrBasicBlock("branch", new IrInstruction[]
+            {
+                new IrBranch("beq", "taken", "fallthrough", "cr0")
+            }),
+            Cr0KillingExit("taken", "r4"),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains(
+            "if ((static_cast<int32_t>(r3) == static_cast<int32_t>(7)))",
+            code, StringComparison.Ordinal);
+        Assert.Equal(2, CountOccurrences(code, "SetCRResident("));
+    }
+
+    [Theory]
+    [InlineData("blt", "if ((f1.d < f2.d))")]
+    [InlineData("bge", "if ((!(f1.d < f2.d)))")]
+    [InlineData("beq", "if ((f1.d == f2.d))")]
+    [InlineData("ble", "if ((!(f1.d > f2.d)))")]
+    public void FloatCompareFusionKeepsThePowerPcBitSemantics(string condition, string expected)
+    {
+        // A cleared LT bit means "not less than", which is true for an unordered
+        // compare; spelling it as >= would be wrong for NaN.
+        var function = new IrFunction($"fuse_float_{condition}", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("f1"), IrValue.Register("f2"), false),
+                new IrBranch(condition, "taken", "fallthrough", "cr0")
+            }),
+            Cr0KillingExit("taken", "r4"),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains(expected, code, StringComparison.Ordinal);
+        Assert.DoesNotContain("SetCRFloatResident(", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CompareIsNotFusedWhenTheFieldIsStillReadAfterTheBranch()
+    {
+        var function = new IrFunction("live_across_branch", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrBranch("beq", "taken", "fallthrough", "cr0")
+            }),
+            // Reads CR0 again before writing it: the packed field is live.
+            new IrBasicBlock("taken", new IrInstruction[]
+            {
+                new IrBranch("bgt", "fallthrough", "second", "cr0")
+            }),
+            Cr0KillingExit("second", "r4"),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+
+        var code = Emit(function);
+
+        Assert.DoesNotContain("static_cast<int32_t>(r3) == static_cast<int32_t>(0)", code, StringComparison.Ordinal);
+        Assert.Contains("SetCRResident(cr, xer, 0, static_cast<int32_t>(r3)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CompareIsNotFusedWhenTheBranchTestsTheSummaryOverflowBit()
+    {
+        // bso reads the XER.SO copy, which a direct comparison cannot rebuild.
+        var code = Emit(CompareThenBranch("so_consumer", "bso", isUnsigned: false, IrValue.Imm(0)));
+
+        Assert.Contains("SetCRResident(cr, xer, 0, static_cast<int32_t>(r3)", code, StringComparison.Ordinal);
+        Assert.Equal(3, CountOccurrences(code, "SetCRResident("));
+    }
+
+    [Fact]
+    public void CompareIsNotFusedWhenAnMfcrObservesThePackedRegister()
+    {
+        var function = new IrFunction("mfcr_reader", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrBranch("beq", "taken", "fallthrough", "cr0")
+            }),
+            new IrBasicBlock("taken", new IrInstruction[]
+            {
+                new IrAssign("r7", IrValue.Register("cr")),
+                new IrReturn(null)
+            }),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains("SetCRResident(cr, xer, 0, static_cast<int32_t>(r3)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CompareIsNotFusedWhenAnOperandIsRedefinedBeforeTheBranch()
+    {
+        // The fused comparison is evaluated at the branch, where r3 no longer
+        // holds the compared value.
+        var function = new IrFunction("clobbered_operand", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Imm(1), "add"),
+                new IrBranch("beq", "taken", "fallthrough", "cr0")
+            }),
+            Cr0KillingExit("taken", "r4"),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains("SetCRResident(cr, xer, 0, static_cast<int32_t>(r3)", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("if ((static_cast<int32_t>(r3) == static_cast<int32_t>(0)))", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CompareIsNotFusedAcrossACall()
+    {
+        var function = new IrFunction("call_between", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrBranch("beq", "taken", "fallthrough", "cr0")
+            }),
+            Cr0KillingExit("taken", "r4"),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+
+        var code = Emit(
+            function,
+            guestAbiContracts: new Dictionary<uint, GuestAbiContract> { [0x80002000u] = Contract() });
+
+        Assert.Contains("SetCRResident(cr, xer, 0, static_cast<int32_t>(r3)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CompareIsNotFusedIntoTheFunctionEntryBlock()
+    {
+        // "branch" is the entry label, so control reaches it without ever
+        // executing the block that happens to be its only recorded predecessor.
+        var function = new IrFunction("entry_is_branch", "branch", new[]
+        {
+            new IrBasicBlock("branch", new IrInstruction[]
+            {
+                new IrBranch("beq", "taken", "fallthrough", "cr0")
+            }),
+            new IrBasicBlock("producer", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrJump("branch")
+            }),
+            Cr0KillingExit("taken", "r4"),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+
+        var code = Emit(function);
+
+        Assert.DoesNotContain("static_cast<int32_t>(r3) == static_cast<int32_t>(0)", code, StringComparison.Ordinal);
+        Assert.Contains("SetCRResident(cr, xer, 0, static_cast<int32_t>(r3)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void NoFlagIsElidedInABodyThatCanResumeThroughALinkRegisterDispatch()
+    {
+        // A callee that returns into one of this function's own labels makes the
+        // static CFG incomplete, so every flag statement derived from it is void.
+        var function = new IrFunction("lr_continuation", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("lr", IrValue.Imm(0x80001010)),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrBranch("beq", "taken", "fallthrough", "cr0")
+            }),
+            Cr0KillingExit("taken", "r4"),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+
+        var code = Emit(
+            function,
+            guestAbiContracts: new Dictionary<uint, GuestAbiContract> { [0x80002000u] = Contract() },
+            lrContinuationCallTargets: new HashSet<uint> { 0x80002000u });
+
+        Assert.Equal(3, CountOccurrences(code, "SetCRResident("));
+        Assert.Contains("ctx->lr = 2147487760;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ACalleeThatDoesNotReadTheFieldDoesNotKeepItAlive()
+    {
+        // This is what makes the transform pay off in a real build: without an
+        // ABI contract every call after the branch is a potential CR reader.
+        var function = new IrFunction("call_after_branch", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrBranch("beq", "taken", "fallthrough", "cr0")
+            }),
+            new IrBasicBlock("taken", new IrInstruction[]
+            {
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrSetCrField(0, IrValue.Register("r4"), IrValue.Imm(0), false),
+                new IrReturn(null)
+            }),
+            Cr0KillingExit("fallthrough", "r5")
+        });
+
+        var contracts = new Dictionary<uint, GuestAbiContract> { [0x80002000u] = Contract() };
+        Assert.Contains(
+            "if ((static_cast<int32_t>(r3) == static_cast<int32_t>(0)))",
+            Emit(function, guestAbiContracts: contracts), StringComparison.Ordinal);
+
+        // The same callee declared as a CR0 reader keeps the compare.
+        var readerContracts = new Dictionary<uint, GuestAbiContract>
+        {
+            [0x80002000u] = Contract(crRead: 0x01)
+        };
+        Assert.Contains(
+            "SetCRResident(cr, xer, 0, static_cast<int32_t>(r3)",
+            Emit(function, guestAbiContracts: readerContracts), StringComparison.Ordinal);
+
+        // ...and so does an unknown callee.
+        Assert.Contains(
+            "SetCRResident(cr, xer, 0, static_cast<int32_t>(r3)",
+            Emit(function), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RecordFormWriteOverwrittenBeforeAnyReadIsRemoved()
+    {
+        // add. followed by cmpwi into the same field with no reader in between:
+        // only the compare can be observed.
+        var function = new IrFunction("dead_record_form", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrBinary("r5", IrValue.Register("r5"), IrValue.Register("r6"), "add"),
+                new IrSetCrField(0, IrValue.Register("r5"), IrValue.Imm(0), false),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function);
+
+        Assert.DoesNotContain("SetCRResident(cr, xer, 0, static_cast<int32_t>(r3)", code, StringComparison.Ordinal);
+        Assert.Contains("SetCRResident(cr, xer, 0, static_cast<int32_t>(r5)", code, StringComparison.Ordinal);
+        Assert.Equal(1, CountOccurrences(code, "SetCRResident("));
+    }
+
+    [Fact]
+    public void LastCrWriteBeforeReturnIsAlwaysKept()
+    {
+        // The return boundary publishes ctx->cr and the emitter has no caller
+        // information there.
+        var function = new IrFunction("cr_live_out", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(3, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains("SetCRResident(cr, xer, 3,", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RedundantCrWriteIsEliminated()
+    {
+        var function = new IrFunction("dead_cr_off", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrSetCrField(0, IrValue.Register("r5"), IrValue.Imm(0), false),
+                new IrReturn(null)
+            })
+        });
+
+        Assert.Equal(1, CountOccurrences(Emit(function), "SetCRResident("));
+    }
+
+    [Fact]
+    public void XerBecomesAResidentLocal()
+    {
+        var function = new IrFunction("resident_xer", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains("uint32_t xer = ctx->xer;", code, StringComparison.Ordinal);
+        Assert.Contains("SetCRResident(cr, xer, 0,", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("SetCRResident(cr, ctx->xer", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CarryUpdatesAndReadsUseTheResidentXerLocal()
+    {
+        var function = new IrFunction("resident_carry", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                {
+                    IrValue.Register("r3"), IrValue.Register("r4"), IrValue.Imm(0)
+                }),
+                new IrCall("r7", "PPC_GetCarry", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains("xer = (xer & 0xDFFFFFFFu)", code, StringComparison.Ordinal);
+        Assert.Contains("r7 = (xer >> 29) & 1u;", code, StringComparison.Ordinal);
+        Assert.Contains("ctx->xer = xer;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->xer >> 29", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CarryUpdateOverwrittenBeforeAnyReadIsRemoved()
+    {
+        var function = new IrFunction("dead_carry", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                {
+                    IrValue.Register("r3"), IrValue.Register("r4"), IrValue.Imm(0)
+                }),
+                new IrCall("xer", "PPC_UpdateCarrySub", new[]
+                {
+                    IrValue.Register("r5"), IrValue.Register("r6")
+                }),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function);
+
+        Assert.Equal(0, CountOccurrences(code, "const uint64_t ppcCarryWide"));
+        Assert.Contains(
+            "xer = (xer & 0xDFFFFFFFu) | ((static_cast<uint32_t>(r5) >= static_cast<uint32_t>(r6) ? 1u : 0u) << 29);",
+            code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CarryUpdateIsKeptWhenAnAddeChainReadsIt()
+    {
+        var function = new IrFunction("live_carry", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                {
+                    IrValue.Register("r3"), IrValue.Register("r4"), IrValue.Imm(0)
+                }),
+                new IrCall("r8", "PPC_GetCarry", Array.Empty<IrValue>()),
+                new IrCall("xer", "PPC_UpdateCarrySub", new[]
+                {
+                    IrValue.Register("r5"), IrValue.Register("r6")
+                }),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function);
+
+        Assert.Equal(1, CountOccurrences(code, "const uint64_t ppcCarryWide"));
+    }
+
+    [Fact]
+    public void CarryUpdateIsKeptWhenTheOnlyReaderIsTheReturnBoundary()
+    {
+        var function = new IrFunction("carry_live_out", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                {
+                    IrValue.Register("r3"), IrValue.Register("r4"), IrValue.Imm(0)
+                }),
+                new IrReturn(null)
+            })
+        });
+
+        Assert.Equal(1, CountOccurrences(Emit(function), "const uint64_t ppcCarryWide"));
+    }
+
+    [Fact]
+    public void CarryUpdateIsKeptAcrossACalleeThatReadsXer()
+    {
+        var function = new IrFunction("carry_across_call", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall("xer", "PPC_UpdateCarryAdd", new[]
+                {
+                    IrValue.Register("r3"), IrValue.Register("r4"), IrValue.Imm(0)
+                }),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrCall("xer", "PPC_UpdateCarrySub", new[]
+                {
+                    IrValue.Register("r5"), IrValue.Register("r6")
+                }),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(
+            function,
+            guestAbiContracts: new Dictionary<uint, GuestAbiContract>
+            {
+                [0x80002000u] = Contract(readsXer: true)
+            });
+
+        Assert.Equal(1, CountOccurrences(code, "const uint64_t ppcCarryWide"));
+    }
+
+    private static IrFunction CallWithLinkRegister(string name, uint target) =>
+        new(name, "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("lr", IrValue.Imm(0x80001010)),
+                new IrCall(string.Empty, $"0x{target:X8}", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+
+    [Fact]
+    public void LinkRegisterStoreIsElidedForACalleeThatNeverReadsLr()
+    {
+        var code = Emit(
+            CallWithLinkRegister("leaf_caller", 0x80002000u),
+            guestAbiContracts: new Dictionary<uint, GuestAbiContract> { [0x80002000u] = Contract() });
+
+        Assert.Contains("InvokeDirectCpu<0x80002000u>(ctx);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->lr = ", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LinkRegisterStoreIsKeptForAnMflrCallee()
+    {
+        var code = Emit(
+            CallWithLinkRegister("nonleaf_caller", 0x80002000u),
+            guestAbiContracts: new Dictionary<uint, GuestAbiContract>
+            {
+                [0x80002000u] = Contract(readsLr: true)
+            });
+
+        Assert.Contains("ctx->lr = 2147487760;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LinkRegisterStoreIsKeptWithoutACalleeContract()
+    {
+        var code = Emit(CallWithLinkRegister("unknown_callee", 0x80002000u));
+
+        Assert.Contains("ctx->lr = 2147487760;", code, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(GuestCallBoundaryFlags.RequiresCompleteContext)]
+    [InlineData(GuestCallBoundaryFlags.CanSuspend)]
+    [InlineData(GuestCallBoundaryFlags.CanSwitchThreads)]
+    [InlineData(GuestCallBoundaryFlags.InvokesGuestCode)]
+    public void LinkRegisterStoreIsKeptForACalleeThatEscapesAnalysis(GuestCallBoundaryFlags flags)
+    {
+        // setjmp-style natives (OSSaveContext) and anything that re-enters guest
+        // code can observe the architectural return address.
+        var code = Emit(
+            CallWithLinkRegister("escaping_callee", 0x80002000u),
+            guestAbiContracts: new Dictionary<uint, GuestAbiContract>
+            {
+                [0x80002000u] = Contract(flags: flags)
+            });
+
+        Assert.Contains("ctx->lr = 2147487760;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LinkRegisterStoreIsKeptForAModOverridableCallee()
+    {
+        var code = Emit(
+            CallWithLinkRegister("mod_callee", 0x80002000u),
+            guestAbiContracts: new Dictionary<uint, GuestAbiContract> { [0x80002000u] = Contract() },
+            modOverridableCallTargets: new HashSet<uint> { 0x80002000u });
+
+        Assert.Contains("ctx->lr = 2147487760;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void DefinitionsCarryRestrictWhileDeclarationsDoNot()
+    {
+        var function = new IrFunction("restrict_probe", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, "func_helper_target", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains("extern \"C\" void restrict_probe(CpuContext* MKW_RESTRICT ctx)", code, StringComparison.Ordinal);
+        Assert.Contains("extern \"C\" void func_80001000(CpuContext* MKW_RESTRICT ctx)", code, StringComparison.Ordinal);
+        // Top-level restrict is not part of the function type, so forward
+        // declarations stay plain and still match.
+        Assert.Contains("extern \"C\" void func_helper_target(CpuContext* ctx);", code, StringComparison.Ordinal);
+    }
+
+    private static int CountOccurrences(string text, string value)
+    {
+        var count = 0;
+        var index = text.IndexOf(value, StringComparison.Ordinal);
+        while (index >= 0)
+        {
+            ++count;
+            index = text.IndexOf(value, index + value.Length, StringComparison.Ordinal);
+        }
+
+        return count;
+    }
+}
diff --git a/translator/tests/Translator.Tests/FloatingLifterTests.cs b/translator/tests/Translator.Tests/FloatingLifterTests.cs
new file mode 100644
index 0000000..366f0d1
--- /dev/null
+++ b/translator/tests/Translator.Tests/FloatingLifterTests.cs
@@ -0,0 +1,264 @@
+using System;
+using System.Linq;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+using Translator.Core.Lifting;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class FloatingLifterTests
+{
+    private static PpcRegisterOperand Fpr(int index) => new($"f{index}", index);
+
+    private static PpcInstruction FloatingInstruction(uint raw, string mnemonic, params PpcOperand[] operands)
+        => PpcInstruction.Synthetic(0x80000000, raw, mnemonic, operands);
+
+    [Fact]
+    public void LiftsFloatingStatusRegisterHelpersFromRawBits()
+    {
+        var lifter = new PpcLifter();
+
+        var mffs = FloatingInstruction((63u << 26) | (5u << 21), "mffs");
+        var mffsIr = Assert.Single(lifter.Lift(new[] { mffs })).Ir;
+        var mffsCall = Assert.IsType<IrCall>(Assert.Single(mffsIr));
+        Assert.Equal("PPC_Mffs", mffsCall.Target);
+        Assert.Equal("f5", mffsCall.Destination);
+        Assert.Empty(mffsCall.Arguments);
+
+        var mtfsf = FloatingInstruction((63u << 26) | (0xAAu << 17) | (7u << 11), "mtfsf");
+        var mtfsfIr = Assert.Single(lifter.Lift(new[] { mtfsf })).Ir;
+        var mtfsfCall = Assert.IsType<IrCall>(Assert.Single(mtfsfIr));
+        Assert.Equal("PPC_Mtfsf", mtfsfCall.Target);
+        Assert.Equal(0xAA, mtfsfCall.Arguments[0].Constant);
+        Assert.Equal("f7", mtfsfCall.Arguments[1].RegisterName);
+
+        var mtfsb1 = FloatingInstruction((63u << 26) | (9u << 21), "mtfsb1");
+        var mtfsb1Ir = Assert.Single(lifter.Lift(new[] { mtfsb1 })).Ir;
+        var mtfsb1Call = Assert.IsType<IrCall>(Assert.Single(mtfsb1Ir));
+        Assert.Equal("PPC_Mtfsb1", mtfsb1Call.Target);
+        Assert.Equal(9, Assert.Single(mtfsb1Call.Arguments).Constant);
+
+        var mtfsb0 = FloatingInstruction((63u << 26) | (10u << 21), "mtfsb0");
+        var mtfsb0Ir = Assert.Single(lifter.Lift(new[] { mtfsb0 })).Ir;
+        var mtfsb0Call = Assert.IsType<IrCall>(Assert.Single(mtfsb0Ir));
+        Assert.Equal("PPC_Mtfsb0", mtfsb0Call.Target);
+        Assert.Equal(10, Assert.Single(mtfsb0Call.Arguments).Constant);
+
+        var mtfsfi = FloatingInstruction((63u << 26) | (3u << 23) | (0xCu << 12), "mtfsfi");
+        var mtfsfiIr = Assert.Single(lifter.Lift(new[] { mtfsfi })).Ir;
+        var mtfsfiCall = Assert.IsType<IrCall>(Assert.Single(mtfsfiIr));
+        Assert.Equal("PPC_Mtfsfi", mtfsfiCall.Target);
+        Assert.Equal(new long?[] { 3, 0xC }, mtfsfiCall.Arguments.Select(a => a.Constant).ToArray());
+    }
+
+    [Theory]
+    [InlineData("fadd", "add")]
+    [InlineData("fsub", "sub")]
+    [InlineData("fmul", "mul")]
+    [InlineData("fdiv", "fdiv")]
+    public void LiftsFloatingBinaryMnemonics(string mnemonic, string op)
+    {
+        var instruction = FloatingInstruction(0, mnemonic, Fpr(1), Fpr(2), Fpr(3));
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var binary = Assert.IsType<IrBinary>(Assert.Single(ir));
+        Assert.Equal("f1", binary.Destination);
+        Assert.Equal(op, binary.Op);
+        Assert.Equal("f2", binary.Left.RegisterName);
+        Assert.Equal("f3", binary.Right.RegisterName);
+    }
+
+    [Theory]
+    [InlineData("fadd.", "add")]
+    [InlineData("fsub.", "sub")]
+    [InlineData("fmul.", "mul")]
+    [InlineData("fdiv.", "fdiv")]
+    public void LiftsFloatingBinaryDotMnemonics(string mnemonic, string op)
+    {
+        var instruction = FloatingInstruction(0, mnemonic, Fpr(1), Fpr(2), Fpr(3));
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var binary = Assert.IsType<IrBinary>(Assert.Single(ir));
+        Assert.Equal("f1", binary.Destination);
+        Assert.Equal(op, binary.Op);
+    }
+
+    [Theory]
+    [InlineData("frsp", "frsp")]
+    [InlineData("fneg", "fneg")]
+    [InlineData("fabs", "fabs")]
+    [InlineData("fctiw", "fctiw")]
+    [InlineData("fctiwz", "fctiwz")]
+    public void LiftsFloatingUnaryMnemonics(string mnemonic, string op)
+    {
+        var instruction = FloatingInstruction(0, mnemonic, Fpr(4), Fpr(7));
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var binary = Assert.IsType<IrBinary>(Assert.Single(ir));
+        Assert.Equal("f4", binary.Destination);
+        Assert.Equal(op, binary.Op);
+        Assert.Equal("f7", binary.Left.RegisterName);
+        Assert.Equal(0, binary.Right.Constant);
+    }
+
+    [Theory]
+    [InlineData("frsp.", "frsp")]
+    [InlineData("fneg.", "fneg")]
+    [InlineData("fabs.", "fabs")]
+    [InlineData("fctiw.", "fctiw")]
+    [InlineData("fctiwz.", "fctiwz")]
+    public void LiftsFloatingUnaryDotMnemonics(string mnemonic, string op)
+    {
+        var instruction = FloatingInstruction(0, mnemonic, Fpr(4), Fpr(7));
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var binary = Assert.IsType<IrBinary>(Assert.Single(ir));
+        Assert.Equal("f4", binary.Destination);
+        Assert.Equal(op, binary.Op);
+    }
+
+    [Fact]
+    public void LiftsFmrAsRegisterAssign()
+    {
+        var instruction = FloatingInstruction(0, "fmr", Fpr(6), Fpr(2));
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var assign = Assert.IsType<IrAssign>(Assert.Single(ir));
+        Assert.Equal("f6", assign.Destination);
+        Assert.Equal("f2", assign.Value.RegisterName);
+    }
+
+    [Fact]
+    public void LiftsFnabsAsNegativeAbsoluteValue()
+    {
+        var instruction = FloatingInstruction(0, "fnabs", Fpr(6), Fpr(2));
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        Assert.Equal("fabs", Assert.IsType<IrBinary>(ir[0]).Op);
+        Assert.Equal("fneg", Assert.IsType<IrBinary>(ir[1]).Op);
+    }
+
+    [Fact]
+    public void LiftsFloatingRawAliasesAndFallbacks()
+    {
+        var lifter = new PpcLifter();
+
+        var fp57 = FloatingInstruction((63u << 26) | (3u << 21) | (1u << 16) | (4u << 6), "fp_57");
+        var fp57Ir = Assert.Single(lifter.Lift(new[] { fp57 })).Ir;
+        var fp57Binary = Assert.IsType<IrBinary>(Assert.Single(fp57Ir));
+        Assert.Equal("f3", fp57Binary.Destination);
+        Assert.Equal("mul", fp57Binary.Op);
+        Assert.Equal("f1", fp57Binary.Left.RegisterName);
+        Assert.Equal("f4", fp57Binary.Right.RegisterName);
+
+        var fp12 = FloatingInstruction((63u << 26) | (6u << 21) | (9u << 11), "fp_12");
+        var fp12Ir = Assert.Single(lifter.Lift(new[] { fp12 })).Ir;
+        var fp12Binary = Assert.IsType<IrBinary>(Assert.Single(fp12Ir));
+        Assert.Equal("f6", fp12Binary.Destination);
+        Assert.Equal("frsp", fp12Binary.Op);
+        Assert.Equal("f9", fp12Binary.Left.RegisterName);
+
+        var fp281 = FloatingInstruction((63u << 26) | (8u << 21) | (2u << 16) | (5u << 6), "fp_281");
+        var fp281Ir = Assert.Single(lifter.Lift(new[] { fp281 })).Ir;
+        var fp281Binary = Assert.IsType<IrBinary>(Assert.Single(fp281Ir));
+        Assert.Equal("f8", fp281Binary.Destination);
+        Assert.Equal("mul", fp281Binary.Op);
+        Assert.Equal("f2", fp281Binary.Left.RegisterName);
+        Assert.Equal("f5", fp281Binary.Right.RegisterName);
+    }
+
+    [Fact]
+    public void LiftsFloatingCompareAndRawOpc59Forms()
+    {
+        var lifter = new PpcLifter();
+
+        var compare = FloatingInstruction(
+            0,
+            "fcmpu",
+            new PpcOperand[]
+            {
+                new PpcConditionRegisterOperand("cr6", 24),
+                Fpr(2),
+                Fpr(3)
+            });
+
+        var compareIr = Assert.Single(lifter.Lift(new[] { compare })).Ir;
+        var compareSet = Assert.IsType<IrSetCrField>(Assert.Single(compareIr));
+        Assert.Equal(6, compareSet.FieldIndex);
+        Assert.Equal("f2", compareSet.Left.RegisterName);
+        Assert.Equal("f3", compareSet.Right.RegisterName);
+
+        var opc59 = FloatingInstruction((59u << 26) | (4u << 21) | (1u << 16) | (2u << 11) | (3u << 6) | (23u << 1), "opc_59");
+        var opc59Ir = Assert.Single(lifter.Lift(new[] { opc59 })).Ir;
+        var opc59Call = Assert.IsType<IrCall>(Assert.Single(opc59Ir));
+        Assert.Equal("PPC_Fsel", opc59Call.Target);
+        Assert.Equal("f4", opc59Call.Destination);
+        Assert.Equal(new[] { "f1", "f2", "f3" }, opc59Call.Arguments.Select(a => a.RegisterName));
+
+        var fallback = FloatingInstruction((63u << 26) | (4u << 21) | (1u << 16) | (2u << 11) | (3u << 6) | (28u << 1), "fp_999");
+        var fallbackIr = Assert.Single(lifter.Lift(new[] { fallback })).Ir;
+        var fallbackCall = Assert.IsType<IrCall>(Assert.Single(fallbackIr));
+        Assert.Equal("PPC_Fmsub", fallbackCall.Target);
+        Assert.Equal("f4", fallbackCall.Destination);
+        Assert.Equal(new[] { "f1", "f3", "f2" }, fallbackCall.Arguments.Select(a => a.RegisterName));
+    }
+
+    [Theory]
+    [InlineData(22u, "PPC_Fsqrt", "f2")]
+    [InlineData(26u, "PPC_Frsqrte", "f2")]
+    [InlineData(29u, "PPC_Fmadds", "f1")]
+    [InlineData(30u, "PPC_Fnmsubs", "f1")]
+    [InlineData(31u, "PPC_Fnmadds", "f1")]
+    public void LiftsAdditionalOpc59Branches(uint xo, string target, string expectedFirstArgument)
+    {
+        var instruction = FloatingInstruction(
+            (59u << 26) | (4u << 21) | (1u << 16) | (2u << 11) | (3u << 6) | (xo << 1),
+            "opc_59");
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var call = Assert.IsType<IrCall>(Assert.Single(ir));
+        Assert.Equal(target, call.Target);
+        Assert.Equal("f4", call.Destination);
+        Assert.Equal(expectedFirstArgument, call.Arguments[0].RegisterName);
+    }
+
+    [Fact]
+    public void RejectsUnknownOpc59Subop()
+    {
+        var instruction = FloatingInstruction((59u << 26) | (3u << 21) | (27u << 1), "opc_59");
+        Assert.Throws<NotImplementedException>(() => new PpcLifter().Lift(new[] { instruction }));
+    }
+
+    [Theory]
+    [InlineData(18u, "binary", "fdiv")]
+    [InlineData(20u, "binary", "sub")]
+    [InlineData(21u, "binary", "add")]
+    [InlineData(22u, "call", "PPC_Fsqrt")]
+    [InlineData(23u, "call", "PPC_Fsel")]
+    [InlineData(24u, "call", "PPC_Fres")]
+    [InlineData(26u, "call", "PPC_Frsqrte")]
+    [InlineData(29u, "call", "PPC_Fmadd")]
+    [InlineData(30u, "call", "PPC_Fnmsub")]
+    [InlineData(31u, "call", "PPC_Fnmadd")]
+    [InlineData(12u, "binary", "frsp")]
+    [InlineData(8u, "binary", "fcmp")]
+    public void LiftsAdditionalFpFallbackBranches(uint xo, string kind, string opOrTarget)
+    {
+        var instruction = FloatingInstruction(
+            (63u << 26) | (6u << 21) | (1u << 16) | (2u << 11) | (3u << 6) | (xo << 1),
+            "fp_4242");
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        if (kind == "call")
+        {
+            var call = Assert.IsType<IrCall>(Assert.Single(ir));
+            Assert.Equal(opOrTarget, call.Target);
+        }
+        else
+        {
+            var binary = Assert.IsType<IrBinary>(Assert.Single(ir));
+            Assert.Equal(opOrTarget, binary.Op);
+        }
+    }
+}
diff --git a/translator/tests/Translator.Tests/FunctionMapTests.cs b/translator/tests/Translator.Tests/FunctionMapTests.cs
new file mode 100644
index 0000000..df0eb09
--- /dev/null
+++ b/translator/tests/Translator.Tests/FunctionMapTests.cs
@@ -0,0 +1,94 @@
+using System.IO;
+using Translator.Core.Analysis;
+using Translator.Core.Loading;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class FunctionMapTests
+{
+    private static FunctionMap Parse(params string[] lines) => FunctionMap.Parse(lines, "test-map");
+
+    [Fact]
+    public void ParsesNamedAndUnnamedEntriesInAscendingOrder()
+    {
+        var map = Parse(
+            "80006210 __init_registers",
+            "800018a8 0x800018a8",
+            "",
+            "# comment",
+            "800060a4 __start",
+            "800018a8 0x800018a8");
+
+        Assert.Equal(new uint[] { 0x800018A8u, 0x800060A4u, 0x80006210u }, map.Addresses);
+        Assert.Equal(3, map.Addresses.Count);
+        Assert.Equal(2, map.NamedCount);
+        Assert.True(map.Contains(0x800060A4u));
+        Assert.False(map.Contains(0x800060A8u));
+    }
+
+    [Fact]
+    public void LooksUpBothWaysAndTreatsRepeatedAddressPlaceholdersAsUnnamed()
+    {
+        var map = Parse(
+            "800018a8 0x800018a8",
+            "800060a4 __start");
+
+        Assert.Equal("__start", map.NameOf(0x800060A4u));
+        Assert.Null(map.NameOf(0x800018A8u));
+        Assert.Null(map.NameOf(0x80009999u));
+
+        Assert.True(map.TryGetAddress("__start", out var start));
+        Assert.Equal(0x800060A4u, start);
+        Assert.False(map.TryGetAddress("0x800018a8", out _));
+    }
+
+    [Fact]
+    public void RejectsNonHexAndEmptyMaps()
+    {
+        Assert.Throws<InvalidDataException>(() => Parse("not_an_address foo"));
+        Assert.Throws<InvalidDataException>(() => Parse("# only a comment"));
+    }
+
+    [Fact]
+    public void RecoversSaveRestoreThunkRangesFromNamedFamilies()
+    {
+        var map = Parse(
+            "800214f8 _save_fpr_23",
+            "8002150c _save_fpr_28",
+            "80021544 _rest_fpr_23",
+            "80021558 _rest_fpr_28",
+            "8002156c _save_gpr_14",
+            "80021570 _save_gpr_15",
+            "800215a0 _save_gpr_27",
+            "800215b8 _rest_gpr_14",
+            "800215ec _rest_gpr_27");
+
+        var thunks = GuestSaveRestoreThunks.FromFunctionMap(map);
+
+        Assert.Equal(new GuestSaveRestoreThunkRange(0x8002156Cu, 14, 27), thunks.SaveGpr);
+        Assert.Equal(new GuestSaveRestoreThunkRange(0x800215B8u, 14, 27), thunks.RestGpr);
+        Assert.Equal(new GuestSaveRestoreThunkRange(0x800214F8u, 23, 28), thunks.SaveFpr);
+        Assert.Equal(new GuestSaveRestoreThunkRange(0x80021544u, 23, 28), thunks.RestFpr);
+        Assert.False(thunks.IsEmpty);
+    }
+
+    [Fact]
+    public void ThunkRecoveryRejectsRunsThatAreNotFourBytesPerRegister()
+    {
+        var map = Parse(
+            "8002156c _save_gpr_14",
+            "800215a4 _save_gpr_27"); // one slot too far
+
+        Assert.Throws<InvalidDataException>(() => GuestSaveRestoreThunks.FromFunctionMap(map));
+    }
+
+    [Fact]
+    public void MapWithoutThunkSymbolsYieldsNoRanges()
+    {
+        var thunks = GuestSaveRestoreThunks.FromFunctionMap(Parse("800060a4 __start"));
+
+        Assert.True(thunks.IsEmpty);
+        Assert.Null(thunks.SaveGpr);
+    }
+}
diff --git a/translator/tests/Translator.Tests/FunctionTranslatorCoverageTests.cs b/translator/tests/Translator.Tests/FunctionTranslatorCoverageTests.cs
new file mode 100644
index 0000000..f7d09e2
--- /dev/null
+++ b/translator/tests/Translator.Tests/FunctionTranslatorCoverageTests.cs
@@ -0,0 +1,478 @@
+using System;
+using System.Buffers.Binary;
+using System.Collections.Generic;
+using System.Reflection;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Ir;
+using Translator.Core.Loading;
+using Translator.Core.Translation;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class FunctionTranslatorCoverageTests
+{
+    private static readonly Type TranslatorType = typeof(FunctionTranslator);
+
+    private static T InvokePrivate<T>(string name, params object?[] args)
+    {
+        var method = TranslatorType.GetMethod(name, BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(method);
+        return (T)method!.Invoke(null, args)!;
+    }
+
+    [Fact]
+    public void DiscoverStopsAfterSsaWithoutTypingOrCodeGeneration()
+    {
+        var memory = new byte[4];
+        WriteWord(memory, MemoryLayout.RamBase, 0x4E800020);
+        var image = new ProgramImage(
+            memory,
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, 4),
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, 4),
+            default,
+            "discovery-only");
+
+        var discovery = new FunctionTranslator(image).Discover(
+            MemoryLayout.RamBase,
+            TranslationOptions.Default with { AllowUnsupportedInstructions = true });
+
+        Assert.Single(discovery.Instructions);
+        Assert.NotEmpty(discovery.Ssa.Function.Blocks);
+        Assert.Equal(TimeSpan.Zero, discovery.Metrics.RepresentationClassification);
+        Assert.Equal(TimeSpan.Zero, discovery.Metrics.CodeGen);
+    }
+
+    [Fact]
+    public void Translate_PreservesFallthroughAfterDirectLinkBranch()
+    {
+        var memory = new byte[MemoryLayout.RamSize];
+        WriteWord(memory, 0x80001000, 0x48001001); // bl 0x80002000
+        WriteWord(memory, 0x80001004, 0x80630048); // lwz r3, 0x48(r3)
+        WriteWord(memory, 0x80001008, 0x38800000); // li r4, 0
+        WriteWord(memory, 0x8000100C, 0x80630000); // lwz r3, 0(r3)
+        WriteWord(memory, 0x80001010, 0x48000FF0); // b 0x80002000
+        WriteWord(memory, 0x80002000, 0x4E800020); // blr
+
+        var image = new ProgramImage(
+            memory,
+            AddressRange.FromStartAndSize(0x80001000, 0x1004),
+            AddressRange.FromStartAndSize(0x80001000, 0x1004),
+            default,
+            "test");
+        // Leaf inlining would otherwise splice the trivial (blr-only) 0x80002000
+        // callee straight into the caller, eliding the direct-call boundary this
+        // test exists to check the fallthrough ordering around.
+        var result = new FunctionTranslator(image).Translate(
+            0x80001000,
+            TranslationOptions.Default with
+            {
+                MaxBytes = 0x20,
+                AllowUnsupportedInstructions = true,
+                EnableLeafInlining = false
+            });
+
+        var callIndex = result.CxxCode.IndexOf("InvokeDirectCpu<0x80002000u>(ctx);", StringComparison.Ordinal);
+        var fallthroughIndex = result.CxxCode.IndexOf("MemoryInline::FlatRead32((r3 + 72))", StringComparison.Ordinal);
+
+        Assert.True(callIndex >= 0, result.CxxCode);
+        Assert.True(fallthroughIndex > callIndex);
+        // 0x80001004 as an unsigned address rather than the signed decimal the
+        // int-typed IR immediate used to print.
+        Assert.Contains("ctx->lr = 0x80001004u;", result.CxxCode, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Translate_KnownSiblingEntryBranchEmitsTailCallInsteadOfInliningBody()
+    {
+        var memory = new byte[MemoryLayout.RamSize];
+        WriteWord(memory, 0x80001000, 0x48000020); // b 0x80001020
+        WriteWord(memory, 0x80001020, 0x38600007); // li r3, 7
+        WriteWord(memory, 0x80001024, 0x4E800020); // blr
+
+        var image = new ProgramImage(
+            memory,
+            AddressRange.FromStartAndSize(0x80001000, 0x28),
+            AddressRange.FromStartAndSize(0x80001000, 0x28),
+            default,
+            "test");
+        // Leaf inlining would otherwise treat this unconditional branch to a
+        // known sibling entry as an inlinable leaf; isolate the tail-call
+        // boundary this test exists to check.
+        var result = new FunctionTranslator(image).Translate(
+            0x80001000,
+            TranslationOptions.Default with
+            {
+                MaxBytes = 0x40,
+                AllowUnsupportedInstructions = true,
+                KnownFunctionEntryPoints = new HashSet<uint> { 0x80001000u, 0x80001020u },
+                EnableLeafInlining = false
+            });
+
+        Assert.Single(result.Instructions);
+        Assert.Contains("InvokeDirectCpu<0x80001020u>(ctx);", result.CxxCode, StringComparison.Ordinal);
+        Assert.DoesNotContain("loc_80001020", result.CxxCode, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Translate_RecognizesFramePointerBasedMultipleRegisterSaveAreaAsStackMemory()
+    {
+        const uint entry = 0x80001000;
+        var image = TranslatorCppTestHarness.CreateImage(
+            (entry + 0x00, 0x9421FFC0), // stwu r1, -64(r1)
+            (entry + 0x04, 0x7C0802A6), // mflr r0
+            (entry + 0x08, 0x90010044), // stw r0, 68(r1)
+            (entry + 0x0C, 0x39610040), // addi r11, r1, 64
+            (entry + 0x10, 0xBF2BFFE4), // stmw r25, -28(r11)
+            (entry + 0x14, 0xBB2BFFE4), // lmw r25, -28(r11)
+            (entry + 0x18, 0x80010044), // lwz r0, 68(r1)
+            (entry + 0x1C, 0x7C0803A6), // mtlr r0
+            (entry + 0x20, 0x38210040), // addi r1, r1, 64
+            (entry + 0x24, 0x4E800020)); // blr
+
+        var result = new FunctionTranslator(image).Translate(
+            entry,
+            TranslationOptions.Default with { MaxBytes = 0x28 });
+
+        // Stores still distinguish the stack fast path (FlatWriteRam skips the MMIO policy check)
+        // from the general guarded write (FlatWrite); reads have no such distinction, both spell FlatRead.
+        Assert.Contains("MemoryInline::FlatWriteRam32((r11 + -28)", result.CxxCode,
+            StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatRead32((r11 + -28)", result.CxxCode,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("MemoryInline::FlatWrite32((r11 + -28)", result.CxxCode,
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Translate_UsesStackFastPathForLocallyProvenEabiSaveRestoreThunks()
+    {
+        const uint entry = 0x80001000;
+        var image = TranslatorCppTestHarness.CreateImage(
+            (entry + 0x00, 0x9421FFC0), // stwu r1, -64(r1)
+            (entry + 0x04, 0x39610040), // addi r11, r1, 64
+            (entry + 0x08, EncodeB(entry + 0x08, 0x80021598, link: true)), // _savegpr_25
+            (entry + 0x0C, 0x39610040), // addi r11, r1, 64
+            (entry + 0x10, EncodeB(entry + 0x10, 0x800215E4, link: true)), // _restgpr_25
+            (entry + 0x14, 0x38210040), // addi r1, r1, 64
+            (entry + 0x18, 0x4E800020)); // blr
+
+        var result = new FunctionTranslator(image).Translate(
+            entry,
+            TranslationOptions.Default with { MaxBytes = 0x1C });
+
+        Assert.Contains("MemoryInline::ResolveRangeHost((r11 + -28), 0, 28u, false, true)", result.CxxCode,
+            StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::ResolveRangeHost((r11 + -28), 0, 28u, true, false)", result.CxxCode,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("MemoryInline::FlatWrite32((r11 + -28)", result.CxxCode,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("MemoryInline::FlatRead32((r11 + -28)", result.CxxCode,
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Translate_KeepsEabiThunkOnGenericMemoryWithoutLocalStackProof()
+    {
+        const uint entry = 0x80001000;
+        var image = TranslatorCppTestHarness.CreateImage(
+            (entry + 0x00, 0x39630000), // addi r11, r3, 0
+            (entry + 0x04, EncodeB(entry + 0x04, 0x80021598, link: true)), // _savegpr_25
+            (entry + 0x08, 0x4E800020)); // blr
+
+        var result = new FunctionTranslator(image).Translate(
+            entry,
+            TranslationOptions.Default with { MaxBytes = 0xC });
+
+        Assert.Contains("MemoryInline::FlatWrite32((r11 + -28)", result.CxxCode,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("MemoryInline::FlatWriteRam32((r11 + -28)", result.CxxCode,
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Translate_KnownSiblingEntryFallthroughEmitsTailCall()
+    {
+        var memory = new byte[MemoryLayout.RamSize];
+        WriteWord(memory, 0x80001000, 0x38600007); // li r3, 7
+        WriteWord(memory, 0x80001004, 0x38800009); // li r4, 9
+        WriteWord(memory, 0x80001008, 0x4E800020); // sibling continuation: blr
+
+        var image = new ProgramImage(
+            memory,
+            AddressRange.FromStartAndSize(0x80001000, 0xC),
+            AddressRange.FromStartAndSize(0x80001000, 0xC),
+            default,
+            "test");
+        var result = new FunctionTranslator(image).Translate(
+            0x80001000,
+            TranslationOptions.Default with
+            {
+                MaxBytes = 0x8,
+                AllowUnsupportedInstructions = true,
+                KnownFunctionEntryPoints = new HashSet<uint> { 0x80001000u, 0x80001008u }
+            });
+
+        Assert.Contains("InvokeDirectCpu<0x80001008u>(ctx);", result.CxxCode, StringComparison.Ordinal);
+        Assert.Contains("return;", result.CxxCode, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Translate_KnownConditionalBranchTargetRemainsLocalControlFlow()
+    {
+        var memory = new byte[MemoryLayout.RamSize];
+        WriteWord(memory, 0x80001000, 0x2C030000); // cmpwi r3, 0
+        WriteWord(memory, 0x80001004, EncodeBc(12, 2, 0x10)); // beq 0x80001014
+        WriteWord(memory, 0x80001008, 0x38800001); // li r4, 1
+        WriteWord(memory, 0x8000100C, 0x4E800020); // blr
+        WriteWord(memory, 0x80001014, 0x38800002); // li r4, 2
+        WriteWord(memory, 0x80001018, 0x4E800020); // blr
+
+        var image = new ProgramImage(
+            memory,
+            AddressRange.FromStartAndSize(0x80001000, 0x1C),
+            AddressRange.FromStartAndSize(0x80001000, 0x1C),
+            default,
+            "test");
+        var result = new FunctionTranslator(image).Translate(
+            0x80001000,
+            TranslationOptions.Default with
+            {
+                MaxBytes = 0x40,
+                AllowUnsupportedInstructions = true,
+                KnownFunctionEntryPoints = new HashSet<uint> { 0x80001000u, 0x80001014u }
+            });
+
+        Assert.Contains("loc_80001014", result.CxxCode, StringComparison.Ordinal);
+        Assert.DoesNotContain("InvokeDirectCpu<0x80001014u>(ctx);", result.CxxCode, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Translate_JumpTableKnownContinuationRemainsLocalControlFlow()
+    {
+        const uint entry = 0x80000000;
+        const uint table = 0x80000100;
+        const uint case0 = entry + 0x1C;
+        const uint case1 = entry + 0x28;
+        const uint common = entry + 0x34;
+
+        var image = TranslatorCppTestHarness.CreateImage(
+            (entry + 0x00, 0x28030002), // cmplwi r3, 2
+            (entry + 0x04, 0x5463103A), // slwi r3, r3, 2
+            (entry + 0x08, 0x3D808000), // lis r12, 0x8000
+            (entry + 0x0C, 0x398C0100), // addi r12, r12, 0x100
+            (entry + 0x10, 0x7C0C182E), // lwzx r0, r12, r3
+            (entry + 0x14, 0x7C0903A6), // mtctr r0
+            (entry + 0x18, 0x4E800420), // bctr
+            (case0 + 0x00, 0x38600007), // li r3, 7
+            (case0 + 0x04, 0x48000014), // b common
+            (case1 + 0x00, 0x38600009), // li r3, 9
+            (case1 + 0x04, 0x48000008), // b common
+            (common + 0x00, 0x4E800020), // blr
+            (table + 0x00, case0),
+            (table + 0x04, case1),
+            (table + 0x08, common));
+        var result = new FunctionTranslator(image).Translate(
+            entry,
+            TranslationOptions.Default with
+            {
+                MaxBytes = 0x80,
+                AllowUnsupportedInstructions = true,
+                KnownFunctionEntryPoints = new HashSet<uint> { entry, case0, case1, common }
+            });
+
+        Assert.Contains("loc_80000034", result.CxxCode, StringComparison.Ordinal);
+        Assert.DoesNotContain("InvokeDirectCpu<0x80000034u>(ctx);", result.CxxCode, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Translate_ExternalConditionalBranchEmitsTailCallBlock()
+    {
+        var memory = new byte[MemoryLayout.RamSize];
+        WriteWord(memory, 0x80001000, EncodeBc(12, 2, 0x1000)); // beq 0x80002000
+        WriteWord(memory, 0x80001004, 0x4E800020); // blr
+
+        var image = new ProgramImage(
+            memory,
+            AddressRange.FromStartAndSize(0x80001000, 0x8),
+            AddressRange.FromStartAndSize(0x80001000, 0x8),
+            default,
+            "test");
+        var result = new FunctionTranslator(image).Translate(
+            0x80001000,
+            TranslationOptions.Default with { MaxBytes = 0x8, AllowUnsupportedInstructions = true });
+
+        Assert.Contains("InvokeDirectCpu<0x80002000u>(ctx);", result.CxxCode, StringComparison.Ordinal);
+        Assert.DoesNotContain("synthetic missing target", result.CxxCode, StringComparison.Ordinal);
+    }
+
+    private static void WriteWord(byte[] memory, uint address, uint word)
+    {
+        var offset = checked((int)(address - MemoryLayout.RamBase));
+        BinaryPrimitives.WriteUInt32BigEndian(memory.AsSpan(offset, 4), word);
+    }
+
+    private static uint EncodeBc(uint bo, uint bi, int branchDelta, bool aa = false, bool lk = false)
+        => (16u << 26) | (bo << 21) | (bi << 16) | ((((uint)branchDelta >> 2) & 0x3FFFu) << 2) | ((aa ? 1u : 0u) << 1) | (lk ? 1u : 0u);
+
+    private static uint EncodeB(uint address, uint target, bool link = false)
+        => (18u << 26) | ((target - address) & 0x03FFFFFCu) | (link ? 1u : 0u);
+
+    [Fact]
+    public void TranslationHelpers_ParseHexCallLabelsAndAbiArgs()
+    {
+        var hexArgs = new object?[] { "0x8000ABCD", 0u };
+        Assert.True(InvokePrivate<bool>("TryParseHex", hexArgs));
+        Assert.Equal(0x8000ABCDu, (uint)hexArgs[1]!);
+
+        var plainArgs = new object?[] { "DEADBEEF", 0u };
+        Assert.True(InvokePrivate<bool>("TryParseHex", plainArgs));
+        Assert.Equal(0xDEADBEEFu, (uint)plainArgs[1]!);
+
+        var invalidArgs = new object?[] { "not_hex", 0u };
+        Assert.False(InvokePrivate<bool>("TryParseHex", invalidArgs));
+        Assert.Equal(0u, (uint)invalidArgs[1]!);
+
+        var callLabelArgs = new object?[] { "call_ctr_80001000_80001004", "call_ctr_", 0u, 0u };
+        Assert.True(InvokePrivate<bool>("TryParseCallLabel", callLabelArgs));
+        Assert.Equal(0x80001000u, (uint)callLabelArgs[2]!);
+        Assert.Equal(0x80001004u, (uint)callLabelArgs[3]!);
+
+        var shortLabelArgs = new object?[] { "call_ctr_80001000", "call_ctr_", 0u, 0u };
+        Assert.False(InvokePrivate<bool>("TryParseCallLabel", shortLabelArgs));
+
+        var wrongPrefixArgs = new object?[] { "indirect_ctr_80001000", "call_ctr_", 0u, 0u };
+        Assert.False(InvokePrivate<bool>("TryParseCallLabel", wrongPrefixArgs));
+
+        var abiArgs = InvokePrivate<IReadOnlyList<IrValue>>("BuildAbiCallArgs");
+        Assert.Equal(21, abiArgs.Count);
+        Assert.Equal("r3", abiArgs[0].RegisterName);
+        Assert.Equal("r10", abiArgs[7].RegisterName);
+        Assert.Equal("f1", abiArgs[8].RegisterName);
+        Assert.Equal("f13", abiArgs[^1].RegisterName);
+    }
+
+    [Fact]
+    public void TryBuildSyntheticBlock_CoversIndirectAndCallForms()
+    {
+        var indirectArgs = new object?[] { "indirect_ctr_80001234", null! };
+        Assert.True(InvokePrivate<bool>("TryBuildSyntheticBlock", indirectArgs));
+        var indirect = Assert.IsType<IrBasicBlock>(indirectArgs[1]);
+        Assert.Equal("indirect_ctr_80001234", indirect.Label);
+        Assert.Equal("ctr", Assert.IsType<IrIndirectJump>(Assert.Single(indirect.Instructions)).Target.RegisterName);
+
+        var callCtrArgs = new object?[] { "call_ctr_80001000_80001004", null! };
+        Assert.True(InvokePrivate<bool>("TryBuildSyntheticBlock", callCtrArgs));
+        var callCtr = Assert.IsType<IrBasicBlock>(callCtrArgs[1]);
+        Assert.Collection(
+            callCtr.Instructions,
+            ins =>
+            {
+                var assign = Assert.IsType<IrAssign>(ins);
+                Assert.Equal("lr", assign.Destination);
+                Assert.Equal(unchecked((int)0x80001004u), assign.Value.Constant);
+            },
+            ins =>
+            {
+                var call = Assert.IsType<IrIndirectCall>(ins);
+                Assert.Equal("ctr", call.Target.RegisterName);
+                Assert.Equal(21, call.Arguments.Count);
+            },
+            ins => Assert.Equal("0x80001004", Assert.IsType<IrJump>(ins).TargetLabel));
+
+        var callLrArgs = new object?[] { "call_lr_80002000_80002004", null! };
+        Assert.True(InvokePrivate<bool>("TryBuildSyntheticBlock", callLrArgs));
+        var callLr = Assert.IsType<IrBasicBlock>(callLrArgs[1]);
+        Assert.Collection(
+            callLr.Instructions,
+            ins =>
+            {
+                var assign = Assert.IsType<IrAssign>(ins);
+                Assert.Equal("addr_bclrl_80002000_loc", assign.Destination);
+                Assert.Equal("lr", assign.Value.RegisterName);
+            },
+            ins =>
+            {
+                var assign = Assert.IsType<IrAssign>(ins);
+                Assert.Equal("lr", assign.Destination);
+                Assert.Equal(unchecked((int)0x80002004u), assign.Value.Constant);
+            },
+            ins =>
+            {
+                var call = Assert.IsType<IrIndirectCall>(ins);
+                Assert.Equal("addr_bclrl_80002000_loc", call.Target.RegisterName);
+                Assert.Equal(21, call.Arguments.Count);
+            },
+            ins => Assert.Equal("0x80002004", Assert.IsType<IrJump>(ins).TargetLabel));
+
+        var absoluteArgs = new object?[] { "0x800D7FCC", null! };
+        Assert.True(InvokePrivate<bool>("TryBuildSyntheticBlock", absoluteArgs));
+        var absolute = Assert.IsType<IrBasicBlock>(absoluteArgs[1]);
+        Assert.Equal("0x800D7FCC", absolute.Label);
+        Assert.Collection(
+            absolute.Instructions,
+            ins =>
+            {
+                var call = Assert.IsType<IrCall>(ins);
+                Assert.Equal("0x800D7FCC", call.Target);
+                Assert.Equal(21, call.Arguments.Count);
+            },
+            ins => Assert.Null(Assert.IsType<IrReturn>(ins).Value));
+
+        var invalidArgs = new object?[] { "plain_label", null! };
+        Assert.False(InvokePrivate<bool>("TryBuildSyntheticBlock", invalidArgs));
+        Assert.Null(invalidArgs[1]);
+    }
+
+    [Fact]
+    public void PublicRecordsExposeStoredValues()
+    {
+        var metrics = new TranslationMetrics();
+        Assert.Same(TranslationOptions.Default, TranslationOptions.Default);
+
+        var instructions = new[]
+        {
+            Translator.Core.Disassembly.PpcInstruction.Synthetic(
+                0x800060A4,
+                0x4E800020,
+                "blr",
+                Array.Empty<Translator.Core.Disassembly.PpcOperand>())
+        };
+        var blocks = new[] { new Translator.Core.Analysis.BasicBlocks.BasicBlock(0x800060A4, instructions) };
+        var irFunction = new IrFunction(
+            "coverage_result",
+            "entry",
+            new[] { new IrBasicBlock("entry", new IrInstruction[] { new IrReturn(IrValue.Register("r3")) }) });
+        var cfg = new IrCfg(
+            new Dictionary<string, IrBasicBlock>(StringComparer.OrdinalIgnoreCase) { ["entry"] = irFunction.Blocks[0] },
+            "entry",
+            new Dictionary<string, List<string>>(StringComparer.OrdinalIgnoreCase) { ["entry"] = new() });
+        var ssa = new SsaResult(irFunction, cfg);
+        var types = new RepresentationEnvironment();
+        var signature = new FunctionAbiClassification("coverage_result", ValueRepresentation.Void);
+        var result = new FunctionTranslationResult(
+            0x800060A4,
+            "coverage_result",
+            instructions,
+            blocks,
+            irFunction,
+            ssa,
+            types,
+            signature,
+            "// generated",
+            metrics);
+
+        Assert.Equal(0x800060A4u, result.EntryPoint);
+        Assert.Equal("coverage_result", result.Name);
+        Assert.Same(instructions, result.Instructions);
+        Assert.Same(blocks, result.Blocks);
+        Assert.Same(irFunction, result.LinearIr);
+        Assert.Same(ssa, result.Ssa);
+        Assert.Same(types, result.Representations);
+        Assert.Same(signature, result.AbiClassification);
+        Assert.Equal("// generated", result.CxxCode);
+        Assert.Same(metrics, result.Metrics);
+    }
+}
diff --git a/translator/tests/Translator.Tests/GeneratedMarkersTests.cs b/translator/tests/Translator.Tests/GeneratedMarkersTests.cs
new file mode 100644
index 0000000..db60023
--- /dev/null
+++ b/translator/tests/Translator.Tests/GeneratedMarkersTests.cs
@@ -0,0 +1,90 @@
+using Translator.Core;
+using Translator.Core.Analysis;
+using Xunit;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Proves marker text and its read-back patterns stay in sync: every marker the emitter writes
+/// must be matched, group for group, by the pattern consumers parse it with.
+/// </summary>
+public sealed class GeneratedMarkersTests
+{
+    [Fact]
+    public void GuestAbiMarkerRoundTripsThroughItsPattern()
+    {
+        var contract = new GuestAbiContract(
+            GprReadBeforeWriteMask: 0x00000018u,
+            GprPossibleWriteMask: 0x0000000Cu,
+            GprReturnMask: 0x00000008u,
+            FprReadBeforeWriteMask: 0x00000002u,
+            FprPossibleWriteMask: 0x00000006u,
+            FprReturnMask: 0x00000002u,
+            CrReadBeforeWriteMask: 0x12,
+            CrPossibleWriteMask: 0x34,
+            ReadsXerBeforeWrite: true,
+            MayWriteXer: false,
+            ReadsCtrBeforeWrite: false,
+            MayWriteCtr: false,
+            ReadsLrBeforeWrite: false,
+            MayWriteLr: false,
+            BoundaryFlags: GuestCallBoundaryFlags.None,
+            DirectCallTargets: Array.Empty<uint>());
+
+        var marker = GeneratedMarkers.GuestAbi(contract);
+        var match = GeneratedMarkers.GuestAbiPattern().Match(marker);
+
+        Assert.True(match.Success, marker);
+        Assert.Equal("00000018", match.Groups["gr"].Value);
+        Assert.Equal("0000000C", match.Groups["gw"].Value);
+        Assert.Equal("00000008", match.Groups["gret"].Value);
+        Assert.Equal("00000002", match.Groups["fr"].Value);
+        Assert.Equal("00000006", match.Groups["fw"].Value);
+        Assert.Equal("00000002", match.Groups["fret"].Value);
+        Assert.Equal("12", match.Groups["crr"].Value);
+        Assert.Equal("34", match.Groups["crw"].Value);
+        Assert.Equal("1", match.Groups["xr"].Value);
+        Assert.Equal("0", match.Groups["xw"].Value);
+        Assert.Equal(contract.HasFullSynchronizationFence ? "1" : "0", match.Groups["fence"].Value);
+    }
+
+    [Fact]
+    public void BaseRegistrationMarkerRoundTripsThroughItsPattern()
+    {
+        var marker = GeneratedMarkers.BaseRegistration(0x80001234u, "func_80001234", true, 0xFC000000u);
+
+        Assert.Equal(
+            "// RECOMP_REGISTRATION base 0x80001234 func_80001234 preserves=true fpr_mask=0xFC000000",
+            marker);
+
+        var match = GeneratedMarkers.BaseRegistrationPattern().Match(marker);
+        Assert.True(match.Success);
+        Assert.Equal("80001234", match.Groups["address"].Value);
+        Assert.Equal("func_80001234", match.Groups["symbol"].Value);
+        Assert.Equal("true", match.Groups["preserves"].Value);
+        Assert.Equal("FC000000", match.Groups["mask"].Value);
+        Assert.Matches(GeneratedMarkers.RegistrationLinePattern(), marker + "\n");
+    }
+
+    [Fact]
+    public void ModRegistrationMarkerRoundTripsThroughItsPattern()
+    {
+        var marker = GeneratedMarkers.ModRegistration(
+            0x80002000u, "rr_80002000", "Pretty::Name", false, 0x00004000u, 100u, 7ul);
+
+        Assert.Equal(
+            "// RECOMP_REGISTRATION mod 0x80002000 rr_80002000 \"Pretty::Name\" " +
+            "preserves=false fpr_mask=0x00004000 priority=100 module_id=7",
+            marker);
+
+        var match = GeneratedMarkers.ModRegistrationPattern().Match(marker);
+        Assert.True(match.Success);
+        Assert.Equal("80002000", match.Groups["address"].Value);
+        Assert.Equal("rr_80002000", match.Groups["symbol"].Value);
+        Assert.Equal("Pretty::Name", match.Groups["name"].Value);
+        Assert.Equal("false", match.Groups["preserves"].Value);
+        Assert.Equal("00004000", match.Groups["mask"].Value);
+        Assert.Equal("100", match.Groups["priority"].Value);
+        Assert.Equal("7", match.Groups["moduleId"].Value);
+    }
+}
diff --git a/translator/tests/Translator.Tests/GeneratedOutputPrunerTests.cs b/translator/tests/Translator.Tests/GeneratedOutputPrunerTests.cs
new file mode 100644
index 0000000..f714bb1
--- /dev/null
+++ b/translator/tests/Translator.Tests/GeneratedOutputPrunerTests.cs
@@ -0,0 +1,88 @@
+using Translator.Core.Build;
+using Translator.Core.Mods;
+
+namespace Translator.Tests;
+
+public sealed class GeneratedOutputPrunerTests
+{
+    [Fact]
+    public void MetadataPruningRemovesStaleTranslatedBody()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkw_prune_test", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        try
+        {
+            var currentCpp = Path.Combine(root, "current.cpp");
+            var staleCpp = Path.Combine(root, "stale.cpp");
+            File.WriteAllText(currentCpp, "// current");
+            File.WriteAllText(staleCpp, "// stale");
+
+            var metadata = BaseTranslationOutputMetadata.Create([
+                FunctionMetadata("current.cpp", 0x80001000),
+                FunctionMetadata("stale.cpp", 0x80001004)
+            ], TranslationQualityMetadata.Clean);
+            var emitted = new HashSet<string>(
+                [Path.GetFullPath(currentCpp)],
+                OperatingSystem.IsWindows() ? StringComparer.OrdinalIgnoreCase : StringComparer.Ordinal);
+
+            var result = GeneratedOutputPruner.Prune(root, emitted, metadata);
+
+            Assert.Equal(1, result.RemovedFiles);
+            Assert.Empty(result.Warnings);
+            Assert.True(File.Exists(currentCpp));
+            Assert.False(File.Exists(staleCpp));
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+                Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void MetadataPruningRefusesPathOutsideOutputRoot()
+    {
+        var parent = Path.Combine(Path.GetTempPath(), "mkw_prune_test", Guid.NewGuid().ToString("N"));
+        var root = Path.Combine(parent, "generated");
+        Directory.CreateDirectory(root);
+        var outside = Path.Combine(parent, "outside.cpp");
+        File.WriteAllText(outside, "// user owned");
+        try
+        {
+            var metadata = BaseTranslationOutputMetadata.Create([
+                FunctionMetadata("../outside.cpp", 0x80001000)
+            ], TranslationQualityMetadata.Clean);
+
+            var result = GeneratedOutputPruner.Prune(root, new HashSet<string>(), metadata);
+
+            Assert.Equal(0, result.RemovedFiles);
+            Assert.Contains(result.Warnings, warning => warning.Contains("outside output root", StringComparison.Ordinal));
+            Assert.True(File.Exists(outside));
+        }
+        finally
+        {
+            if (Directory.Exists(parent))
+                Directory.Delete(parent, recursive: true);
+        }
+    }
+
+    private static BaseTranslationFunctionMetadata FunctionMetadata(
+        string relativePath,
+        uint address)
+    {
+        var build = new BaseTranslationFunctionBuildMetadata(
+            $"func_{address:X8}",
+            true,
+            0,
+            [],
+            null,
+            1);
+        return new BaseTranslationFunctionMetadata(
+            relativePath,
+            1,
+            new string('b', 64),
+            address,
+            [],
+            build);
+    }
+}
diff --git a/translator/tests/Translator.Tests/GenericProjectTests.cs b/translator/tests/Translator.Tests/GenericProjectTests.cs
new file mode 100644
index 0000000..6893137
--- /dev/null
+++ b/translator/tests/Translator.Tests/GenericProjectTests.cs
@@ -0,0 +1,165 @@
+using Translator.Cli.Configuration;
+using Translator.Core.Loading;
+using Translator.Core.Parsing.Dol;
+using Translator.Core.Translation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class GenericProjectTests
+{
+    [Fact]
+    public void FunctionMapIsPathOnlyWhileBinaryHashesRemainEnforced()
+    {
+        var temp = CreateTempDirectory();
+        try
+        {
+            File.WriteAllBytes(Path.Combine(temp, "main.dol"), new byte[0x100]);
+            var mapPath = Path.Combine(temp, "MAP.txt");
+            File.WriteAllText(mapPath, "80001000 entry\n");
+            var projectPath = Path.Combine(temp, "recomp.yml");
+            const string manifest = """
+                schema_version: 1
+                workspace_root: .
+                project:
+                  id: map-config-test
+                inputs:
+                  dol:
+                    path: main.dol
+                """;
+
+            File.WriteAllText(
+                projectPath,
+                manifest + Environment.NewLine + """
+                translation:
+                  function_map:
+                    path: MAP.txt
+                """);
+
+            var project = TranslationProjectConfig.Load(projectPath);
+            Assert.Equal(mapPath, project.Translation.FunctionMapPath);
+            Assert.Equal(0x80001000u, Assert.Single(FunctionMap.Load(project.Translation.FunctionMapPath!).Addresses));
+
+            File.WriteAllText(
+                projectPath,
+                manifest + Environment.NewLine + """
+                translation:
+                  function_map:
+                    path: MAP.txt
+                    sha256: deliberately-rejected-legacy-key
+                """);
+
+            // The function map binds by path alone; the legacy sha256 key is an
+            // unknown property and rejects the whole manifest.
+            var mapHashError = Assert.ThrowsAny<Exception>(() => TranslationProjectConfig.Load(projectPath));
+            Assert.Contains("sha256", mapHashError.Message, StringComparison.Ordinal);
+
+            File.WriteAllText(
+                projectPath,
+                manifest.Replace(
+                    "    path: main.dol",
+                    "    path: main.dol\n    sha256: deliberately-wrong",
+                    StringComparison.Ordinal));
+
+            var dolError = Assert.Throws<InvalidDataException>(() => TranslationProjectConfig.Load(projectPath));
+
+            Assert.Contains("Configured DOL SHA-256 does not match", dolError.Message, StringComparison.Ordinal);
+
+            File.WriteAllText(
+                projectPath,
+                manifest + Environment.NewLine + """
+                translation:
+                  function_map:
+                    sha256: rejected-and-not-a-path
+                """);
+
+            var mapError = Assert.ThrowsAny<Exception>(() => TranslationProjectConfig.Load(projectPath));
+
+            Assert.Contains("sha256", mapError.Message, StringComparison.Ordinal);
+        }
+        finally
+        {
+            Directory.Delete(temp, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void DolOnlyProjectLoadsAndTranslatesItsConfiguredEntryPoint()
+    {
+        var temp = CreateTempDirectory();
+        try
+        {
+            const uint entry = 0x80001000u;
+            var dolPath = Path.Combine(temp, "main.dol");
+            File.WriteAllBytes(
+                dolPath,
+                SyntheticDolFactory.CreateBytes(
+                    entry,
+                    sections: [SyntheticDolFactory.Text(0, entry, 0x38630001u, 0x4E800020u)]));
+            var projectPath = Path.Combine(temp, "recomp.yml");
+            File.WriteAllText(
+                projectPath,
+                """
+                schema_version: 1
+                project:
+                  id: synthetic-dol
+                  display_name: Synthetic DOL
+                inputs:
+                  dol:
+                    path: main.dol
+                translation:
+                  entry_points: [0x80001000]
+                  allow_unsupported_instructions: true
+                output:
+                  root: out
+                """);
+
+            var project = TranslationProjectConfig.Load(projectPath);
+            Assert.Null(project.Inputs.Rel);
+            Assert.Equal(entry, Assert.Single(project.Translation.EntryPoints));
+
+            var dol = DolFile.Load(project.Inputs.Dol.Path);
+            var image = new ProgramImageBuilder().Build(dol, ramBase: project.Memory.Base, ramSize: project.Memory.Size);
+            var result = new FunctionTranslator(image).Translate(
+                entry,
+                new TranslationOptions(AllowUnsupportedInstructions: true));
+
+            Assert.Equal(2, result.Metrics.PpcInstructionCount);
+            Assert.Contains("func_80001000", result.CxxCode, StringComparison.Ordinal);
+        }
+        finally
+        {
+            Directory.Delete(temp, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void ExternalGenericDolParsesAndTranslatesWhenConfigured()
+    {
+        var path = Environment.GetEnvironmentVariable("RECOMP_GENERIC_DOL");
+        if (string.IsNullOrWhiteSpace(path) || !File.Exists(path))
+        {
+            return;
+        }
+
+        var dol = DolFile.Load(path);
+        var image = new ProgramImageBuilder().Build(dol);
+        var result = new FunctionTranslator(image).Translate(
+            dol.EntryPoint,
+            new TranslationOptions(
+                MaxInstructions: 2048,
+                MaxBytes: 0x10000,
+                AllowUnsupportedInstructions: true));
+
+        Assert.NotEmpty(dol.ExecutableSections);
+        Assert.NotEmpty(result.CxxCode);
+        Assert.True(result.Metrics.PpcInstructionCount > 0);
+    }
+
+    private static string CreateTempDirectory()
+    {
+        var path = Path.Combine(Path.GetTempPath(), "generic_recomp_project", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(path);
+        return path;
+    }
+}
diff --git a/translator/tests/Translator.Tests/GlobalUsings.cs b/translator/tests/Translator.Tests/GlobalUsings.cs
new file mode 100644
index 0000000..8c927eb
--- /dev/null
+++ b/translator/tests/Translator.Tests/GlobalUsings.cs
@@ -0,0 +1 @@
+global using Xunit;
\ No newline at end of file
diff --git a/translator/tests/Translator.Tests/GpuFifoBurstCodeGenTests.cs b/translator/tests/Translator.Tests/GpuFifoBurstCodeGenTests.cs
new file mode 100644
index 0000000..b793ccb
--- /dev/null
+++ b/translator/tests/Translator.Tests/GpuFifoBurstCodeGenTests.cs
@@ -0,0 +1,265 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Coalesces consecutive statically-known gather-pipe stores into one <c>GX_HLE_FIFO_WriteBurst</c>.
+/// Output must stay byte-identical to individual GX_HLE_FIFO_Write* calls, and a run must never span
+/// a guest load, since a recording display list can observe the deferred write in guest memory.
+/// </summary>
+public class GpuFifoBurstCodeGenTests
+{
+    // lis rX, 0xCC01 / stX rY, -0x8000(rX) - how every nw4r GD* helper spells a
+    // gather-pipe write.
+    private const int GatherPipeBase = unchecked((int)0xCC010000);
+    private const int GatherPipeDisplacement = -32768;
+
+    private static string Emit(IrFunction function) =>
+        new CxxLinearCodeGenerator().Emit(
+            0x80001000u,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification(function.Name, ValueRepresentation.Void),
+            new RepresentationEnvironment(Enumerable.Range(0, 12)
+                .ToDictionary(index => $"r{index}", _ => ValueRepresentation.UInt32)));
+
+    private static IrStore FifoStore(string source, int sizeBytes) =>
+        new(new IrAddress("r10", GatherPipeDisplacement), IrValue.Register(source), sizeBytes);
+
+    private static IrFunction Function(string name, params IrInstruction[] body) =>
+        new(name, "entry",
+        [
+            new IrBasicBlock("entry",
+                new IrInstruction[] { new IrAssign("r10", IrValue.Imm(GatherPipeBase)) }
+                    .Concat(body).ToArray())
+        ]);
+
+    [Fact]
+    public void ThirteenMixedWidthStoresBecomeOneBurstWithBigEndianLayout()
+    {
+        // Alternating byte/word fields, the shape a GD command header plus its
+        // payload registers has.
+        var stores = new List<IrInstruction>();
+        for (var index = 0; index < 13; index++)
+            stores.Add(FifoStore("r3", index % 2 == 0 ? 1 : 4));
+        stores.Add(new IrReturn(null));
+
+        var code = Emit(Function("burst_mixed", stores.ToArray()));
+
+        // 7 single bytes + 6 words = 31 bytes, one buffer, one call.
+        Assert.Contains("uint8_t mkw_fifo_burst_0[31];", code, StringComparison.Ordinal);
+        Assert.Contains("GX_HLE_FIFO_WriteBurst(mkw_fifo_burst_0, 31u);", code, StringComparison.Ordinal);
+        Assert.Equal(1, CountOccurrences(code, "GX_HLE_FIFO_WriteBurst("));
+        Assert.DoesNotContain("GX_HLE_FIFO_Write8(", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("GX_HLE_FIFO_Write32(", code, StringComparison.Ordinal);
+
+        // Byte 0 is the first 8-bit field; bytes 1..4 are the first word,
+        // most-significant byte first.
+        Assert.Contains("mkw_fifo_burst_0[0] = static_cast<uint8_t>(r3);", code, StringComparison.Ordinal);
+        Assert.Contains("mkw_fifo_burst_0[1] = static_cast<uint8_t>((mkw_fifo_word >> 24));", code, StringComparison.Ordinal);
+        Assert.Contains("mkw_fifo_burst_0[2] = static_cast<uint8_t>((mkw_fifo_word >> 16));", code, StringComparison.Ordinal);
+        Assert.Contains("mkw_fifo_burst_0[3] = static_cast<uint8_t>((mkw_fifo_word >> 8));", code, StringComparison.Ordinal);
+        Assert.Contains("mkw_fifo_burst_0[4] = static_cast<uint8_t>(mkw_fifo_word);", code, StringComparison.Ordinal);
+        // ... and the run ends on the 13th store, at byte 30.
+        Assert.Contains("mkw_fifo_burst_0[30] = static_cast<uint8_t>(r3);", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SixteenBitStoresSerializeTwoBigEndianBytes()
+    {
+        var stores = Enumerable.Range(0, 4)
+            .Select(_ => (IrInstruction)FifoStore("r3", 2))
+            .Append(new IrReturn(null))
+            .ToArray();
+
+        var code = Emit(Function("burst_halfwords", stores));
+
+        Assert.Contains("uint8_t mkw_fifo_burst_0[8];", code, StringComparison.Ordinal);
+        Assert.Contains("mkw_fifo_burst_0[0] = static_cast<uint8_t>((mkw_fifo_word >> 8));", code, StringComparison.Ordinal);
+        Assert.Contains("mkw_fifo_burst_0[1] = static_cast<uint8_t>(mkw_fifo_word);", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FloatStoresSerializeTheirIeeeBitsBigEndian()
+    {
+        var stores = Enumerable.Range(0, 4)
+            .Select(_ => (IrInstruction)new IrStore(
+                new IrAddress("r10", GatherPipeDisplacement), IrValue.Register("f1"), 4))
+            .Append(new IrReturn(null))
+            .ToArray();
+
+        var code = Emit(Function("burst_floats", stores));
+
+        Assert.Contains("uint8_t mkw_fifo_burst_0[16];", code, StringComparison.Ordinal);
+        Assert.Contains("PpcBitCastToU32Inline(static_cast<float>(", code, StringComparison.Ordinal);
+        Assert.Contains("GX_HLE_FIFO_WriteBurst(mkw_fifo_burst_0, 16u);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("GX_HLE_FIFO_WriteFloat(", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RegisterArithmeticBetweenStoresStaysInsideTheRun()
+    {
+        var stores = new List<IrInstruction>();
+        for (var index = 0; index < 4; index++)
+        {
+            stores.Add(new IrBinary("r3", IrValue.Register("r3"), IrValue.Imm(1), "add"));
+            stores.Add(FifoStore("r3", 4));
+        }
+        stores.Add(new IrReturn(null));
+
+        var code = Emit(Function("burst_with_arithmetic", stores.ToArray()));
+
+        Assert.Contains("GX_HLE_FIFO_WriteBurst(mkw_fifo_burst_0, 16u);", code, StringComparison.Ordinal);
+        Assert.Equal(1, CountOccurrences(code, "GX_HLE_FIFO_WriteBurst("));
+    }
+
+    [Fact]
+    public void RunOfThreeIsNotCoalesced()
+    {
+        var stores = Enumerable.Range(0, 3)
+            .Select(_ => (IrInstruction)FifoStore("r3", 4))
+            .Append(new IrReturn(null))
+            .ToArray();
+
+        var code = Emit(Function("short_run", stores));
+
+        Assert.DoesNotContain("GX_HLE_FIFO_WriteBurst", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("mkw_fifo_burst_0", code, StringComparison.Ordinal);
+        Assert.Equal(3, CountOccurrences(code, "GX_HLE_FIFO_Write32("));
+    }
+
+    [Fact]
+    public void OrdinaryGuestStoreSplitsTheRun()
+    {
+        // A store to guest RAM cannot be reordered past a FIFO write: while a
+        // display list is recording, the FIFO writer itself writes guest memory.
+        var instructions = new List<IrInstruction>();
+        for (var index = 0; index < 4; index++) instructions.Add(FifoStore("r3", 4));
+        instructions.Add(new IrStore(new IrAddress("r4", 0), IrValue.Register("r5"), 4));
+        for (var index = 0; index < 4; index++) instructions.Add(FifoStore("r3", 4));
+        instructions.Add(new IrReturn(null));
+
+        var code = Emit(Function("split_by_store", instructions.ToArray()));
+
+        Assert.Equal(2, CountOccurrences(code, "GX_HLE_FIFO_WriteBurst("));
+        Assert.Contains("GX_HLE_FIFO_WriteBurst(mkw_fifo_burst_0, 16u);", code, StringComparison.Ordinal);
+        Assert.Contains("GX_HLE_FIFO_WriteBurst(mkw_fifo_burst_1, 16u);", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void GuestLoadSplitsTheRun()
+    {
+        var instructions = new List<IrInstruction>();
+        for (var index = 0; index < 4; index++) instructions.Add(FifoStore("r3", 4));
+        instructions.Add(new IrLoad("r5", new IrAddress("r4", 0), 4));
+        for (var index = 0; index < 4; index++) instructions.Add(FifoStore("r3", 4));
+        instructions.Add(new IrReturn(null));
+
+        var code = Emit(Function("split_by_load", instructions.ToArray()));
+
+        Assert.Equal(2, CountOccurrences(code, "GX_HLE_FIFO_WriteBurst("));
+    }
+
+    [Fact]
+    public void CallSplitsTheRun()
+    {
+        var instructions = new List<IrInstruction>();
+        for (var index = 0; index < 4; index++) instructions.Add(FifoStore("r3", 4));
+        instructions.Add(new IrCall(string.Empty, "func_80002000", []));
+        for (var index = 0; index < 4; index++) instructions.Add(FifoStore("r3", 4));
+        instructions.Add(new IrReturn(null));
+
+        var code = Emit(Function("split_by_call", instructions.ToArray()));
+
+        Assert.Equal(2, CountOccurrences(code, "GX_HLE_FIFO_WriteBurst("));
+    }
+
+    [Fact]
+    public void BranchSplitsTheRunAndEachSideBurstsIndependently()
+    {
+        IrInstruction[] Stores(int count, IrInstruction terminator) =>
+            Enumerable.Range(0, count)
+                .Select(_ => (IrInstruction)FifoStore("r3", 4))
+                .Append(terminator)
+                .ToArray();
+
+        var function = new IrFunction("split_by_branch", "entry",
+        [
+            new IrBasicBlock("entry",
+                new IrInstruction[] { new IrAssign("r10", IrValue.Imm(GatherPipeBase)) }
+                    .Concat(Stores(4, new IrBranch("ne", "left", "right"))).ToArray()),
+            new IrBasicBlock("left", Stores(4, new IrReturn(null))),
+            // Three stores on this side stay individual: below the run minimum.
+            new IrBasicBlock("right", Stores(3, new IrReturn(null)))
+        ]);
+
+        var code = Emit(function);
+
+        Assert.Equal(2, CountOccurrences(code, "GX_HLE_FIFO_WriteBurst("));
+        Assert.Equal(3, CountOccurrences(code, "GX_HLE_FIFO_Write32("));
+    }
+
+    [Fact]
+    public void StoresOutsideTheGatherPipeAreNeverCoalesced()
+    {
+        var instructions = new List<IrInstruction>
+        {
+            new IrAssign("r10", IrValue.Imm(unchecked((int)0x80300000)))
+        };
+        for (var index = 0; index < 8; index++)
+            instructions.Add(new IrStore(new IrAddress("r10", index * 4), IrValue.Register("r3"), 4));
+        instructions.Add(new IrReturn(null));
+
+        var code = Emit(new IrFunction("not_gather_pipe", "entry",
+            [new IrBasicBlock("entry", instructions)]));
+
+        Assert.DoesNotContain("GX_HLE_FIFO_WriteBurst", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void UnsupportedIntegerWidthFallsBackToGuestMemory()
+    {
+        var code = Emit(Function(
+            "fifo_integer_width8",
+            FifoStore("r3", 8),
+            new IrReturn(null)));
+
+        Assert.DoesNotContain("GX_HLE_FIFO_Write", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWrite64", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void UnsupportedFloatWidthFallsBackToGuestMemory()
+    {
+        var code = Emit(Function(
+            "fifo_float_width8",
+            new IrStore(
+                new IrAddress("r10", GatherPipeDisplacement),
+                IrValue.Register("f1"),
+                8),
+            new IrReturn(null)));
+
+        Assert.DoesNotContain("GX_HLE_FIFO_Write", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteFloat64", code, StringComparison.Ordinal);
+    }
+
+    private static int CountOccurrences(string text, string value)
+    {
+        var count = 0;
+        var index = text.IndexOf(value, StringComparison.Ordinal);
+        while (index >= 0)
+        {
+            ++count;
+            index = text.IndexOf(value, index + value.Length, StringComparison.Ordinal);
+        }
+
+        return count;
+    }
+}
diff --git a/translator/tests/Translator.Tests/GqrConstantPropagationTests.cs b/translator/tests/Translator.Tests/GqrConstantPropagationTests.cs
new file mode 100644
index 0000000..937dbec
--- /dev/null
+++ b/translator/tests/Translator.Tests/GqrConstantPropagationTests.cs
@@ -0,0 +1,242 @@
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Translation;
+using Translator.Core.Representation;
+
+namespace Translator.Tests;
+
+public sealed class GqrConstantPropagationTests
+{
+    [Fact]
+    public void SpecializesKnownGqrAfterConstantWrite()
+    {
+        var function = Function(new IrInstruction[]
+        {
+            new IrAssign("r3", IrValue.Imm(0x00040004)),
+            new IrAssign("gqr2", IrValue.Register("r3")),
+            PsqLoad(2),
+            new IrReturn(null)
+        });
+        var specialized = GqrConstantPropagation.Specialize(function);
+        var call = Assert.IsType<IrCall>(specialized.Blocks[0].Instructions[2]);
+        Assert.Equal("PPC_PsqLKnown_00040004", call.Target);
+    }
+
+    [Fact]
+    public void MergeKeepsOnlyEqualMustConstants()
+    {
+        var equal = Diamond(0x00040004, 0x00040004);
+        var unequal = Diamond(0x00040004, 0x00050005);
+        Assert.Contains(GqrConstantPropagation.Specialize(equal).Blocks.Single(b => b.Label == "join").Instructions,
+            i => i is IrCall { Target: "PPC_PsqLKnown_00040004" });
+        Assert.Contains(GqrConstantPropagation.Specialize(unequal).Blocks.Single(b => b.Label == "join").Instructions,
+            i => i is IrCall { Target: "PPC_PsqL" });
+    }
+
+    [Fact]
+    public void LoopAndOutOfOrderBlocksDoNotEraseEstablishedConstants()
+    {
+        var function = new IrFunction("gqr_loop", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("gqr5", IrValue.Imm(0x00070007)),
+                new IrJump("loop")
+            }),
+            // Deliberately precedes its only reachable predecessor in storage order.
+            new IrBasicBlock("exit", new IrInstruction[] { PsqLoad(5), new IrReturn(null) }),
+            new IrBasicBlock("loop", new IrInstruction[] { new IrBranch("beq", "loop", "exit") })
+        });
+
+        var specialized = GqrConstantPropagation.Specialize(function);
+
+        Assert.Contains(specialized.Blocks.Single(block => block.Label == "exit").Instructions,
+            instruction => instruction is IrCall { Target: "PPC_PsqLKnown_00070007" });
+    }
+
+    [Fact]
+    public void UnknownWriteAndGuestCallsInvalidateGqrConstants()
+    {
+        var unknownWrite = Function(new IrInstruction[]
+        {
+            new IrAssign("gqr2", IrValue.Imm(0x00040004)),
+            new IrLoad("r4", new IrAddress("r3", 0), 4),
+            new IrAssign("gqr2", IrValue.Register("r4")),
+            PsqLoad(2), new IrReturn(null)
+        });
+        var guestCall = Function(new IrInstruction[]
+        {
+            new IrAssign("gqr2", IrValue.Imm(0x00040004)),
+            new IrCall(string.Empty, "func_80001000", Array.Empty<IrValue>()),
+            PsqLoad(2), new IrReturn(null)
+        });
+        Assert.Contains(GqrConstantPropagation.Specialize(unknownWrite).Blocks[0].Instructions,
+            i => i is IrCall { Target: "PPC_PsqL" });
+        Assert.Contains(GqrConstantPropagation.Specialize(guestCall).Blocks[0].Instructions,
+            i => i is IrCall { Target: "PPC_PsqL" });
+    }
+
+    [Fact]
+    public void CodegenEmitsKnownGqrTemplateWithoutContextRead()
+    {
+        var function = Function(new IrInstruction[]
+        {
+            new IrAssign("r3", IrValue.Imm(0x3D043D04)),
+            new IrAssign("gqr2", IrValue.Register("r3")),
+            new IrCall(string.Empty, "PPC_PsqSt", new[] { IrValue.Register("r4"), IrValue.Register("f1"), IrValue.Imm(0), IrValue.Imm(2) }),
+            new IrReturn(null)
+        });
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80001000, ssa,
+            new FunctionAbiClassification("known_gqr", ValueRepresentation.Void),
+            new RepresentationEnvironment());
+        Assert.Contains("PPC_PsqStKnownInline<0u, 2u, 0x3D043D04u>", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void GuardedEntryConstantEmitsKnownFastPathAndDynamicFallback()
+    {
+        var function = Function(new IrInstruction[] { PsqLoad(5), new IrReturn(null) });
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80001000, ssa,
+            new FunctionAbiClassification("guarded_gqr", ValueRepresentation.Void),
+            new RepresentationEnvironment(),
+            gqrEntryConstants: new Dictionary<string, uint> { ["gqr5"] = 0x00070007u },
+            gqrConstantsRequireRuntimeGuard: true);
+
+        Assert.Contains("ctx->gqr[5u] == 0x00070007u", code, StringComparison.Ordinal);
+        Assert.Contains("PPC_PsqLKnownInline<0u, 5u, 0x00070007u>", code, StringComparison.Ordinal);
+        // The guard's dynamic arm is the generic helper, reading the GQR value
+        // hoisted into the prologue rather than ctx->gqr[5] per access.
+        Assert.Contains("[[maybe_unused]] uint32_t mkw_gqr5 = ctx->gqr[5];", code, StringComparison.Ordinal);
+        Assert.Contains("PPC_PsqLGqrInline<0u, 5u>(ctx, mkw_gqr5,", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RepeatedGuardedPsqSitesUseOneFunctionVersionGuard()
+    {
+        var instructions = Enumerable.Range(0, 8)
+            .Select(_ => (IrInstruction)PsqLoad(5))
+            .Append(new IrReturn(null))
+            .ToArray();
+        var function = Function(instructions);
+        var code = new CxxLinearCodeGenerator().Emit(0x80001000,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("versioned_gqr", ValueRepresentation.Void),
+            new RepresentationEnvironment(),
+            gqrEntryConstants: new Dictionary<string, uint> { ["gqr5"] = 0x00070007u },
+            gqrConstantsRequireRuntimeGuard: true);
+
+        Assert.Contains("template <bool gqr_entry_profile>", code, StringComparison.Ordinal);
+        Assert.Contains("versioned_gqr_gqr_impl<true>(ctx);", code, StringComparison.Ordinal);
+        Assert.Contains("versioned_gqr_gqr_impl<false>(ctx);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("const bool gqr_entry_5_00070007", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void InterproceduralAnalysisPropagatesConstantsThroughDirectCalls()
+    {
+        var functions = new Dictionary<uint, IrFunction>
+        {
+            [0x80001000] = Function(new IrInstruction[]
+            {
+                new IrAssign("gqr5", IrValue.Imm(0x00070007)),
+                new IrAssign("gqr6", IrValue.Imm(0x3D043D04)),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            }),
+            [0x80002000] = Function(new IrInstruction[]
+            {
+                new IrCall(string.Empty, "0x80003000", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            }),
+            [0x80003000] = Function(new IrInstruction[] { PsqLoad(5), new IrReturn(null) })
+        };
+
+        var result = GqrInterproceduralAnalysis.Analyze(
+            functions.ToDictionary(pair => pair.Key, pair => GqrFunctionSummary.Create(pair.Value)),
+            new[] { 0x80001000u });
+
+        Assert.Equal(0x00070007u, result.EntryConstants[0x80002000]["gqr5"]);
+        Assert.Equal(0x3D043D04u, result.EntryConstants[0x80003000]["gqr6"]);
+        var specialized = GqrConstantPropagation.Specialize(
+            functions[0x80003000], result.EntryConstants[0x80003000], result.WriteMasks);
+        Assert.Contains(specialized.Blocks[0].Instructions,
+            instruction => instruction is IrCall { Target: "PPC_PsqLKnown_00070007" });
+    }
+
+    [Fact]
+    public void InterproceduralAnalysisIntersectsConflictingCallers()
+    {
+        var functions = new Dictionary<uint, IrFunction>
+        {
+            [0x80001000] = Function(new IrInstruction[]
+            {
+                new IrAssign("gqr5", IrValue.Imm(0x00070007)),
+                new IrCall(string.Empty, "0x80003000", Array.Empty<IrValue>()),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            }),
+            [0x80002000] = Function(new IrInstruction[]
+            {
+                new IrAssign("gqr5", IrValue.Imm(0x00050005)),
+                new IrCall(string.Empty, "0x80003000", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            }),
+            [0x80003000] = Function(new IrInstruction[] { PsqLoad(5), new IrReturn(null) })
+        };
+
+        var result = GqrInterproceduralAnalysis.Analyze(
+            functions.ToDictionary(pair => pair.Key, pair => GqrFunctionSummary.Create(pair.Value)),
+            new[] { 0x80001000u });
+
+        Assert.False(result.EntryConstants[0x80003000].ContainsKey("gqr5"));
+    }
+
+    [Fact]
+    public void CalleeWriteSummaryPreservesOnlyUnmodifiedGqrs()
+    {
+        var functions = new Dictionary<uint, IrFunction>
+        {
+            [0x80001000] = Function(new IrInstruction[]
+            {
+                new IrAssign("gqr5", IrValue.Imm(0x00070007)),
+                new IrAssign("gqr6", IrValue.Imm(0x3D043D04)),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                PsqLoad(5),
+                PsqLoad(6),
+                new IrReturn(null)
+            }),
+            [0x80002000] = Function(new IrInstruction[]
+            {
+                new IrAssign("gqr6", IrValue.Register("r3")),
+                new IrReturn(null)
+            })
+        };
+        var result = GqrInterproceduralAnalysis.Analyze(
+            functions.ToDictionary(pair => pair.Key, pair => GqrFunctionSummary.Create(pair.Value)),
+            new[] { 0x80001000u });
+        var specialized = GqrConstantPropagation.Specialize(
+            functions[0x80001000], result.EntryConstants[0x80001000], result.WriteMasks);
+
+        Assert.Equal(1 << 6, result.WriteMasks[0x80002000]);
+        Assert.Contains(specialized.Blocks[0].Instructions,
+            instruction => instruction is IrCall { Target: "PPC_PsqLKnown_00070007" });
+        Assert.Contains(specialized.Blocks[0].Instructions,
+            instruction => instruction is IrCall { Target: "PPC_PsqL" } call &&
+                           call.Arguments[2].Constant == 6);
+    }
+
+    private static IrCall PsqLoad(int index) => new("f1", "PPC_PsqL", new[] { IrValue.Register("r4"), IrValue.Imm(0), IrValue.Imm(index) });
+    private static IrFunction Function(IReadOnlyList<IrInstruction> instructions) =>
+        new("gqr_test", "entry", new[] { new IrBasicBlock("entry", instructions) });
+    private static IrFunction Diamond(uint left, uint right) => new("gqr_diamond", "entry", new[]
+    {
+        new IrBasicBlock("entry", new IrInstruction[] { new IrBranch("beq", "left", "right") }),
+        new IrBasicBlock("left", new IrInstruction[] { new IrAssign("gqr2", IrValue.Imm(left)), new IrJump("join") }),
+        new IrBasicBlock("right", new IrInstruction[] { new IrAssign("gqr2", IrValue.Imm(right)), new IrJump("join") }),
+        new IrBasicBlock("join", new IrInstruction[] { PsqLoad(2), new IrReturn(null) })
+    });
+}
diff --git a/translator/tests/Translator.Tests/GqrPrologueHoistingCodeGenTests.cs b/translator/tests/Translator.Tests/GqrPrologueHoistingCodeGenTests.cs
new file mode 100644
index 0000000..e707911
--- /dev/null
+++ b/translator/tests/Translator.Tests/GqrPrologueHoistingCodeGenTests.cs
@@ -0,0 +1,269 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Prologue hoisting of ctx-&gt;gqr[I] (audit T-GQR). Pins that the hoisted local is re-read after
+/// anything that could write the register (mtspr to GQR0-7, unproven calls), so it stays valid on
+/// entry to every block regardless of how control flow reaches it.
+/// </summary>
+public class GqrPrologueHoistingCodeGenTests
+{
+    private static string Emit(
+        IrFunction function,
+        IReadOnlyDictionary<uint, byte>? gqrCalleeWriteMasks = null) =>
+        new CxxLinearCodeGenerator().Emit(
+            0x80001000u,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification(function.Name, ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            gqrCalleeWriteMasks: gqrCalleeWriteMasks);
+
+    private static IrCall PsqLoad(int index, string address = "r4") =>
+        new("f1", "PPC_PsqL", [IrValue.Register(address), IrValue.Imm(0), IrValue.Imm(index)]);
+
+    private static IrCall PsqStore(int index, string address = "r4") =>
+        new(string.Empty, "PPC_PsqSt",
+            [IrValue.Register(address), IrValue.Register("f1"), IrValue.Imm(0), IrValue.Imm(index)]);
+
+    private static IrFunction Function(string name, params IrInstruction[] instructions) =>
+        new(name, "entry", [new IrBasicBlock("entry", instructions)]);
+
+    [Fact]
+    public void GenericPsqAccessesReadTheHoistedLocalInsteadOfTheContext()
+    {
+        var code = Emit(Function("hoisted",
+            PsqLoad(0), PsqLoad(0), PsqStore(0), new IrReturn(null)));
+
+        Assert.Contains("[[maybe_unused]] uint32_t mkw_gqr0 = ctx->gqr[0];", code, StringComparison.Ordinal);
+        Assert.Equal(1, CountOccurrences(code, "ctx->gqr[0]"));
+        Assert.Equal(2, CountOccurrences(code, "PPC_PsqLGqrInline<0u, 0u>(ctx, mkw_gqr0,"));
+        Assert.Equal(1, CountOccurrences(code, "PPC_PsqStGqrInline<0u, 0u>(ctx, mkw_gqr0,"));
+        Assert.DoesNotContain("PPC_PsqLInline<", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_PsqStInline<", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EachUsedIndexGetsItsOwnLocalAndUnusedIndicesGetNone()
+    {
+        var code = Emit(Function("two_indices",
+            PsqLoad(0), PsqLoad(5), new IrReturn(null)));
+
+        Assert.Contains("[[maybe_unused]] uint32_t mkw_gqr0 = ctx->gqr[0];", code, StringComparison.Ordinal);
+        Assert.Contains("[[maybe_unused]] uint32_t mkw_gqr5 = ctx->gqr[5];", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("mkw_gqr1", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void MtsprToTheGraphicsQuantizationRegisterReloadsTheLocal()
+    {
+        var code = Emit(Function("mtspr_reload",
+            PsqLoad(3),
+            new IrAssign("gqr3", IrValue.Register("r5")),
+            PsqLoad(3),
+            new IrReturn(null)));
+
+        // Prologue read plus the mtspr's own write, then the reload.
+        Assert.Contains("[[maybe_unused]] uint32_t mkw_gqr3 = ctx->gqr[3];", code, StringComparison.Ordinal);
+        Assert.Contains("mkw_gqr3 = ctx->gqr[3];", code, StringComparison.Ordinal);
+        Assert.Equal(2, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void MtsprToADifferentIndexDoesNotReloadTheOther()
+    {
+        var code = Emit(Function("unrelated_mtspr",
+            PsqLoad(3),
+            new IrAssign("gqr6", IrValue.Register("r5")),
+            PsqLoad(3),
+            new IrReturn(null)));
+
+        Assert.Equal(1, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void GuestCallWithoutAWriteMaskReloadsConservatively()
+    {
+        var code = Emit(Function("call_reload",
+            PsqLoad(3),
+            new IrCall(string.Empty, "func_80002000", []),
+            PsqLoad(3),
+            new IrReturn(null)));
+
+        Assert.Equal(2, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void IndirectCallAlwaysReloads()
+    {
+        var code = Emit(Function("indirect_reload",
+            PsqLoad(3),
+            new IrIndirectCall(string.Empty, IrValue.Register("ctr"), []),
+            PsqLoad(3),
+            new IrReturn(null)));
+
+        Assert.Equal(2, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void CalleeWriteMaskProvingTheRegisterUntouchedSkipsTheReload()
+    {
+        var code = Emit(
+            Function("masked_call",
+                PsqLoad(3),
+                new IrCall(string.Empty, "func_80002000", []),
+                PsqLoad(3),
+                new IrReturn(null)),
+            gqrCalleeWriteMasks: new Dictionary<uint, byte> { [0x80002000u] = 0b0100_0000 });
+
+        Assert.Equal(1, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void CalleeWriteMaskCoveringTheRegisterStillReloads()
+    {
+        var code = Emit(
+            Function("masked_call_hit",
+                PsqLoad(3),
+                new IrCall(string.Empty, "func_80002000", []),
+                PsqLoad(3),
+                new IrReturn(null)),
+            gqrCalleeWriteMasks: new Dictionary<uint, byte> { [0x80002000u] = 0b0000_1000 });
+
+        Assert.Equal(2, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void RuntimeHelperCallsDoNotForceAReload()
+    {
+        var code = Emit(Function("helper_call",
+            PsqLoad(3),
+            new IrCall("r5", "PPC_Cntlzw", [IrValue.Register("r6")]),
+            PsqLoad(3),
+            new IrReturn(null)));
+
+        Assert.Equal(1, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void GenericSprWriterTargetingAGqrForcesAReload()
+    {
+        var code = Emit(Function("write_spr",
+            PsqLoad(3),
+            new IrCall(string.Empty, "PPC_WriteSpr", [IrValue.Imm(915), IrValue.Register("r5")]),
+            PsqLoad(3),
+            new IrReturn(null)));
+
+        Assert.Equal(2, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void GenericSprWriterTargetingAnUnrelatedSprDoesNotReload()
+    {
+        var code = Emit(Function("write_spr_other",
+            PsqLoad(3),
+            new IrCall(string.Empty, "PPC_WriteSpr", [IrValue.Imm(9), IrValue.Register("r5")]),
+            PsqLoad(3),
+            new IrReturn(null)));
+
+        Assert.Equal(1, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void SchedulerBoundaryHelpersForceAReload()
+    {
+        var code = Emit(Function("scheduler_boundary",
+            PsqLoad(3),
+            new IrCall(string.Empty, "Fiber_YieldToScheduler", []),
+            PsqLoad(3),
+            new IrReturn(null)));
+
+        Assert.Equal(2, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void AnotherPairedAccessDoesNotForceAReload()
+    {
+        // PPC_PsqL/PPC_PsqSt read the register; they never write it.
+        var code = Emit(Function("psq_only",
+            PsqLoad(3), PsqLoad(3), PsqStore(3), new IrReturn(null)));
+
+        Assert.Equal(1, CountOccurrences(code, "mkw_gqr3 = ctx->gqr[3];"));
+    }
+
+    [Fact]
+    public void StackAddressedAccessesKeepTheStackHelper()
+    {
+        // There is no GQR-value overload of the stack form, so those sites must
+        // keep reading the register through the context.
+        var code = Emit(Function("stack_psq",
+            new IrBinary("tmp_psq_addr", IrValue.Register("r1"), IrValue.Imm(16), "add"),
+            new IrCall("f1", "PPC_PsqL",
+                [IrValue.Register("tmp_psq_addr"), IrValue.Imm(0), IrValue.Imm(0)]),
+            new IrReturn(null)));
+
+        Assert.DoesNotContain("PPC_PsqLGqrInline", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("mkw_gqr0", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThreeGuardedSitesAreEnoughToVersionTheFunction()
+    {
+        var instructions = Enumerable.Range(0, 3)
+            .Select(_ => (IrInstruction)PsqLoad(5))
+            .Append(new IrReturn(null))
+            .ToArray();
+
+        var code = new CxxLinearCodeGenerator().Emit(0x80001000u,
+            new SsaTransformer().Convert(Function("versioned_three", instructions)),
+            new FunctionAbiClassification("versioned_three", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            gqrEntryConstants: new Dictionary<string, uint> { ["gqr5"] = 0x00070007u },
+            gqrConstantsRequireRuntimeGuard: true);
+
+        Assert.Contains("template <bool gqr_entry_profile>", code, StringComparison.Ordinal);
+        Assert.Contains("versioned_three_gqr_impl<true>(ctx);", code, StringComparison.Ordinal);
+        Assert.Contains("versioned_three_gqr_impl<false>(ctx);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("const bool gqr_entry_5_00070007", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TwoGuardedSitesStayOnTheRuntimeGuard()
+    {
+        var instructions = Enumerable.Range(0, 2)
+            .Select(_ => (IrInstruction)PsqLoad(5))
+            .Append(new IrReturn(null))
+            .ToArray();
+
+        var code = new CxxLinearCodeGenerator().Emit(0x80001000u,
+            new SsaTransformer().Convert(Function("unversioned_two", instructions)),
+            new FunctionAbiClassification("unversioned_two", ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            gqrEntryConstants: new Dictionary<string, uint> { ["gqr5"] = 0x00070007u },
+            gqrConstantsRequireRuntimeGuard: true);
+
+        Assert.DoesNotContain("_gqr_impl", code, StringComparison.Ordinal);
+        Assert.Contains("const bool gqr_entry_5_00070007", code, StringComparison.Ordinal);
+    }
+
+    private static int CountOccurrences(string text, string value)
+    {
+        var count = 0;
+        var index = text.IndexOf(value, StringComparison.Ordinal);
+        while (index >= 0)
+        {
+            ++count;
+            index = text.IndexOf(value, index + value.Length, StringComparison.Ordinal);
+        }
+
+        return count;
+    }
+}
diff --git a/translator/tests/Translator.Tests/GuestAbiContractAnalyzerTests.cs b/translator/tests/Translator.Tests/GuestAbiContractAnalyzerTests.cs
new file mode 100644
index 0000000..25bcff0
--- /dev/null
+++ b/translator/tests/Translator.Tests/GuestAbiContractAnalyzerTests.cs
@@ -0,0 +1,120 @@
+using Translator.Core.Analysis;
+using Translator.Core.Ir;
+
+namespace Translator.Tests;
+
+public sealed class GuestAbiContractAnalyzerTests
+{
+    [Fact]
+    public void TracksResolvedMemoryAddressesSourcesAndDestinations()
+    {
+        var function = new IrFunction("resolved_contract", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrResolveGuestMemoryRange("range", IrValue.Register("r3"), 0, 64, true, true),
+                new IrResolvedLoad("r4", "range", new IrAddress("r3", 0), 0, 4),
+                new IrResolvedStore("range", new IrAddress("r3", 4), 4, IrValue.Register("r5"), 4),
+                new IrResolvedPsqLoad("f1", "range", IrValue.Register("r6"), 8, 0, 0, 0),
+                new IrResolvedPsqStore("range", IrValue.Register("r8"), 24, IrValue.Register("f2"), 0, 0, 0),
+                new IrResolvedLoadPair("r9", "f3", "range", new IrAddress("r10", 0), new IrAddress("r10", 4), 32, 4),
+                new IrResolvedStorePair("range", new IrAddress("r11", 0), new IrAddress("r11", 4), 40,
+                    IrValue.Register("r12"), IrValue.Register("f4"), 4),
+                new IrReturn(null)
+            })
+        });
+
+        var contract = GuestAbiContractAnalyzer.Analyze(function);
+        var expectedGprReads = (1u << 3) | (1u << 5) | (1u << 6) |
+                               (1u << 8) | (1u << 10) | (1u << 11) | (1u << 12);
+        var expectedGprWrites = (1u << 4) | (1u << 9);
+        var expectedFprReads = (1u << 2) | (1u << 4);
+        var expectedFprWrites = (1u << 1) | (1u << 3);
+
+        Assert.Equal(expectedGprReads, contract.GprReadBeforeWriteMask);
+        Assert.Equal(expectedGprWrites, contract.GprPossibleWriteMask);
+        Assert.Equal(expectedFprReads, contract.FprReadBeforeWriteMask);
+        Assert.Equal(expectedFprWrites, contract.FprPossibleWriteMask);
+    }
+
+    [Fact]
+    public void TracksPreciseHiddenStringAndCrHelperEffects()
+    {
+        var function = new IrFunction("helper_contract", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, "PPC_Stswi", new[]
+                {
+                    IrValue.Imm(30), IrValue.Register("r3"), IrValue.Imm(12)
+                }),
+                new IrCall(string.Empty, "PPC_Lswi", new[]
+                {
+                    IrValue.Imm(4), IrValue.Register("r3"), IrValue.Imm(8)
+                }),
+                new IrCall("cr", "PPC_CrLogical", new[]
+                {
+                    IrValue.Imm(0), IrValue.Imm(12), IrValue.Imm(4), IrValue.Imm(28)
+                }),
+                new IrReturn(null)
+            })
+        });
+
+        var contract = GuestAbiContractAnalyzer.Analyze(function);
+
+        Assert.Equal((1u << 3) | (1u << 30) | (1u << 31) | 1u, contract.GprReadBeforeWriteMask);
+        Assert.Equal((1u << 4) | (1u << 5), contract.GprPossibleWriteMask);
+        Assert.Equal(byte.MaxValue, contract.CrReadBeforeWriteMask);
+        Assert.Equal((byte)(1 << 3), contract.CrPossibleWriteMask);
+        Assert.False(contract.HasFullSynchronizationFence);
+    }
+
+    [Fact]
+    public void UnknownHelperIsACompleteContextBoundary()
+    {
+        var function = new IrFunction("unknown_helper", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall(string.Empty, "PPC_NewUncataloguedHelper", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+
+        var contract = GuestAbiContractAnalyzer.Analyze(function);
+
+        Assert.True(contract.HasFullSynchronizationFence);
+        Assert.Equal(uint.MaxValue, contract.GprReadBeforeWriteMask);
+        Assert.Equal(uint.MaxValue, contract.GprPossibleWriteMask);
+        Assert.Equal(uint.MaxValue, contract.FprReadBeforeWriteMask);
+        Assert.Equal(uint.MaxValue, contract.FprPossibleWriteMask);
+        Assert.Equal(byte.MaxValue, contract.CrReadBeforeWriteMask);
+        Assert.Equal(byte.MaxValue, contract.CrPossibleWriteMask);
+        Assert.True(contract.ReadsXerBeforeWrite);
+        Assert.True(contract.MayWriteXer);
+        Assert.True(contract.ReadsCtrBeforeWrite);
+        Assert.True(contract.MayWriteCtr);
+        Assert.True(contract.ReadsLrBeforeWrite);
+        Assert.True(contract.MayWriteLr);
+    }
+
+    [Fact]
+    public void TracksSpecialRegistersEmbeddedInRawBranchConditions()
+    {
+        var function = new IrFunction("raw_branch", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBranch("raw", "taken", "fallthrough",
+                    "((ctx->ctr != 0) && GetCRBit(ctx, 2, 1))")
+            }),
+            new IrBasicBlock("taken", new IrInstruction[] { new IrReturn(null) }),
+            new IrBasicBlock("fallthrough", new IrInstruction[] { new IrReturn(null) })
+        });
+
+        var contract = GuestAbiContractAnalyzer.Analyze(function);
+
+        Assert.True(contract.ReadsCtrBeforeWrite);
+        Assert.Equal(byte.MaxValue, contract.CrReadBeforeWriteMask);
+    }
+}
diff --git a/translator/tests/Translator.Tests/GuestAbiInterproceduralAnalyzerTests.cs b/translator/tests/Translator.Tests/GuestAbiInterproceduralAnalyzerTests.cs
new file mode 100644
index 0000000..9c9daa1
--- /dev/null
+++ b/translator/tests/Translator.Tests/GuestAbiInterproceduralAnalyzerTests.cs
@@ -0,0 +1,111 @@
+using Translator.Core.Analysis;
+using Translator.Core.Ir;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class GuestAbiInterproceduralAnalyzerTests
+{
+    [Fact]
+    public void CallerDefinitionSuppressesCalleeReadAtFunctionEntry()
+    {
+        const uint caller = 0x80001000u;
+        const uint callee = 0x80002000u;
+        var functions = new Dictionary<uint, IrFunction>
+        {
+            [caller] = Function("caller",
+                new IrAssign("r3", IrValue.Imm(7)),
+                new IrCall("lr", "0x80002000", Array.Empty<IrValue>()),
+                new IrReturn(null)),
+            [callee] = Function("callee",
+                new IrAssign("r4", IrValue.Register("r3")),
+                new IrReturn(null))
+        };
+
+        var result = GuestAbiInterproceduralAnalyzer.Analyze(functions);
+
+        Assert.Equal(0u, result.Contracts[caller].GprReadBeforeWriteMask & (1u << 3));
+        Assert.NotEqual(0u, result.Contracts[caller].GprPossibleWriteMask & ((1u << 3) | (1u << 4)));
+        Assert.Equal(1u << 3, result.Contracts[callee].GprReadBeforeWriteMask);
+    }
+
+    [Fact]
+    public void KnownDirectCallIgnoresSyntacticAbiArgumentsNotReadByCallee()
+    {
+        const uint caller = 0x80001000u;
+        const uint callee = 0x80002000u;
+        var functions = new Dictionary<uint, IrFunction>
+        {
+            [caller] = Function("caller",
+                new IrCall("lr", "0x80002000", new[]
+                {
+                    IrValue.Register("r3"),
+                    IrValue.Register("r10"),
+                    IrValue.Register("f1"),
+                    IrValue.Register("f13")
+                }),
+                new IrReturn(null)),
+            [callee] = Function("callee",
+                new IrAssign("r4", IrValue.Register("r3")),
+                new IrReturn(null))
+        };
+
+        var result = GuestAbiInterproceduralAnalyzer.Analyze(functions);
+        var callerContract = result.Contracts[caller];
+
+        Assert.Equal(1u << 3, callerContract.GprReadBeforeWriteMask);
+        Assert.Equal(0u, callerContract.FprReadBeforeWriteMask);
+    }
+
+    [Fact]
+    public void RecursiveFunctionsFormOneComponentAndReachFixedPoint()
+    {
+        const uint first = 0x80001000u;
+        const uint second = 0x80002000u;
+        var functions = new Dictionary<uint, IrFunction>
+        {
+            [first] = Function("first",
+                new IrAssign("r5", IrValue.Register("r3")),
+                new IrCall("lr", "0x80002000", Array.Empty<IrValue>()),
+                new IrReturn(null)),
+            [second] = Function("second",
+                new IrAssign("r6", IrValue.Register("r4")),
+                new IrCall("lr", "0x80001000", Array.Empty<IrValue>()),
+                new IrReturn(null))
+        };
+
+        var result = GuestAbiInterproceduralAnalyzer.Analyze(functions);
+
+        Assert.Contains(result.StronglyConnectedComponents,
+            component => component.SequenceEqual(new[] { first, second }));
+        Assert.Equal((1u << 3) | (1u << 4),
+            result.Contracts[first].GprReadBeforeWriteMask & ((1u << 3) | (1u << 4)));
+        Assert.Equal((1u << 3) | (1u << 4),
+            result.Contracts[second].GprReadBeforeWriteMask & ((1u << 3) | (1u << 4)));
+    }
+
+    [Fact]
+    public void DeepCallGraphDoesNotConsumeTheNativeStack()
+    {
+        const int count = 20_000;
+        const uint start = 0x80000000u;
+        var functions = new Dictionary<uint, IrFunction>(count);
+        for (var index = 0; index < count; ++index)
+        {
+            var address = start + (uint)(index * 4);
+            functions[address] = index + 1 == count
+                ? Function($"f{index}", new IrReturn(null))
+                : Function($"f{index}",
+                    new IrCall("lr", $"0x{address + 4:X8}", Array.Empty<IrValue>()),
+                    new IrReturn(null));
+        }
+
+        var result = GuestAbiInterproceduralAnalyzer.Analyze(functions);
+
+        Assert.Equal(count, result.StronglyConnectedComponents.Count);
+        Assert.All(result.StronglyConnectedComponents, static component => Assert.Single(component));
+    }
+
+    private static IrFunction Function(string name, params IrInstruction[] instructions) =>
+        new(name, "entry", new[] { new IrBasicBlock("entry", instructions) });
+}
diff --git a/translator/tests/Translator.Tests/GuestMemoryRangeLoweringTests.cs b/translator/tests/Translator.Tests/GuestMemoryRangeLoweringTests.cs
new file mode 100644
index 0000000..de84462
--- /dev/null
+++ b/translator/tests/Translator.Tests/GuestMemoryRangeLoweringTests.cs
@@ -0,0 +1,636 @@
+using System.Linq;
+using System.Collections.Generic;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class GuestMemoryRangeLoweringTests
+{
+    [Fact]
+    public void KeepsNonOverlappingReadAndWriteRangesSeparate()
+    {
+        var lowered = Lower(
+            new IrLoad("r4", new IrAddress("r3", 12), 4),
+            new IrLoad("r5", new IrAddress("r3", 16), 4),
+            new IrStore(new IrAddress("r3", 20), IrValue.Register("r6"), 4),
+            new IrStore(new IrAddress("r3", 24), IrValue.Register("r7"), 4));
+
+        var resolves = lowered.OfType<IrResolveGuestMemoryRange>().ToArray();
+        Assert.Equal(2, resolves.Length);
+        Assert.Contains(resolves, resolve => resolve.NeedsReadAccess && !resolve.NeedsWriteAccess);
+        Assert.Contains(resolves, resolve => !resolve.NeedsReadAccess && resolve.NeedsWriteAccess);
+        Assert.Single(lowered.OfType<IrResolvedLoadPair>());
+        Assert.Single(lowered.OfType<IrResolvedStorePair>());
+    }
+
+    [Fact]
+    public void DoesNotSplitOverlappingReadAndWriteAliasesIntoIndependentRanges()
+    {
+        var lowered = Lower(
+            new IrLoad("r4", new IrAddress("r3", 0), 8),
+            new IrLoad("r5", new IrAddress("r3", 8), 8),
+            new IrStore(new IrAddress("r3", 4), IrValue.Register("r6"), 8),
+            new IrStore(new IrAddress("r3", 12), IrValue.Register("r7"), 8));
+
+        Assert.Empty(lowered.OfType<IrResolveGuestMemoryRange>());
+        Assert.Equal(2, lowered.OfType<IrLoad>().Count());
+        Assert.Equal(2, lowered.OfType<IrStore>().Count());
+    }
+
+    [Fact]
+    public void CanonicalizesReusedEffectiveAddressCalculations()
+    {
+        var lowered = Lower(
+            new IrBinary("ea0", IrValue.Register("r3"), IrValue.Imm(16), "add"),
+            new IrLoad("r4", new IrAddress("ea0", 0), 4),
+            new IrBinary("ea1", IrValue.Register("r3"), IrValue.Imm(20), "add"),
+            new IrLoad("r5", new IrAddress("ea1", 0), 4),
+            new IrLoad("r6", new IrAddress("r3", 24), 4));
+
+        var resolve = Assert.Single(lowered.OfType<IrResolveGuestMemoryRange>());
+        Assert.Equal("r3", resolve.Base.RegisterName);
+        Assert.Equal(16, resolve.MinOffset);
+        Assert.Equal(12, resolve.Length);
+    }
+
+    [Fact]
+    public void DoesNotRetainRangeAcrossCallBoundary()
+    {
+        var lowered = Lower(
+            new IrLoad("r4", new IrAddress("r3", 0), 4),
+            new IrCall("", "func_80001000", []),
+            new IrLoad("r5", new IrAddress("r3", 4), 4));
+
+        Assert.Empty(lowered.OfType<IrResolveGuestMemoryRange>());
+        Assert.Equal(2, lowered.OfType<IrLoad>().Count());
+    }
+
+    [Fact]
+    public void ReusesLiveInRangeAcrossCfgInsideCallFreeSuffixEpoch()
+    {
+        var function = new IrFunction("call_suffix", "entry",
+        [
+            new IrBasicBlock("entry",
+            [
+                new IrCall("", "func_80001000", []),
+                new IrJump("body")
+            ]),
+            new IrBasicBlock("body",
+            [
+                new IrLoad("r4", new IrAddress("r3_0", 0), 4),
+                new IrJump("tail")
+            ]),
+            new IrBasicBlock("tail",
+            [
+                new IrLoad("r5", new IrAddress("r3_0", 4), 4),
+                new IrReturn(null)
+            ])
+        ]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+        Assert.DoesNotContain(lowered.Blocks[0].Instructions,
+            instruction => instruction is IrResolveGuestMemoryRange);
+        Assert.IsType<IrResolveGuestMemoryRange>(lowered.Blocks[1].Instructions[0]);
+        Assert.IsType<IrResolvedLoad>(lowered.Blocks[1].Instructions[1]);
+        Assert.Equal(2, lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolvedLoad>().Count());
+    }
+
+    [Fact]
+    public void ReusesRangeAcrossBranchesWhenAnActualAccessDominatesConsumers()
+    {
+        var function = new IrFunction("branch", "entry",
+        [
+            new IrBasicBlock("entry",
+            [
+                new IrLoad("r4", new IrAddress("r3_0", 0), 4),
+                new IrBranch("ne", "left", "right")
+            ]),
+            new IrBasicBlock("left",
+            [
+                new IrLoad("r5", new IrAddress("r3_0", 4), 4),
+                new IrReturn(null)
+            ]),
+            new IrBasicBlock("right",
+            [
+                new IrLoad("r6", new IrAddress("r3_0", 8), 4),
+                new IrReturn(null)
+            ])
+        ]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+        Assert.IsType<IrResolveGuestMemoryRange>(lowered.Blocks[0].Instructions[0]);
+        Assert.Equal(3, lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolvedLoad>().Count());
+    }
+
+    [Fact]
+    public void CallOnLoopBackedgePreventsLoopCarriedHostPointer()
+    {
+        var function = new IrFunction("loop_boundary", "entry",
+        [
+            new IrBasicBlock("entry", [new IrJump("loop")]),
+            new IrBasicBlock("loop",
+            [
+                new IrLoad("r4", new IrAddress("r3_0", 0), 4),
+                new IrCall("", "func_80001000", []),
+                new IrLoad("r5", new IrAddress("r3_0", 4), 4),
+                new IrJump("loop")
+            ])
+        ]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+        Assert.Empty(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>());
+    }
+
+    [Fact]
+    public void ArchitecturalRegisterRedefinitionOnOnePathPreventsReuseAtJoin()
+    {
+        var function = new IrFunction("base_redefinition", "entry",
+        [
+            new IrBasicBlock("entry",
+            [
+                new IrLoad("r4_1", new IrAddress("r3_0", 0), 4),
+                new IrBranch("ne", "stable", "changed")
+            ]),
+            new IrBasicBlock("stable", [new IrJump("join")]),
+            new IrBasicBlock("changed",
+            [
+                new IrAssign("r3_1", IrValue.Register("r5_0")),
+                new IrJump("join")
+            ]),
+            new IrBasicBlock("join",
+            [
+                new IrLoad("r6_1", new IrAddress("r3_0", 4), 4),
+                new IrReturn(null)
+            ])
+        ]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+        Assert.Empty(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>());
+    }
+
+    [Fact]
+    public void BaseRedefinitionAfterLoopConsumerPreventsReuseOnNextIteration()
+    {
+        var function = new IrFunction("loop_redefinition", "entry",
+        [
+            new IrBasicBlock("entry",
+            [
+                new IrLoad("r4_1", new IrAddress("r3_0", 0), 4),
+                new IrJump("loop")
+            ]),
+            new IrBasicBlock("loop",
+            [
+                new IrLoad("r5_1", new IrAddress("r3_0", 4), 4),
+                new IrAssign("r3_1", IrValue.Register("r6_0")),
+                new IrJump("loop")
+            ])
+        ]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+        Assert.Empty(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>());
+    }
+
+    [Fact]
+    public void CatalogHiddenGprWriteEndsEpochEvenForPpcNamedHelper()
+    {
+        var lowered = Lower(
+            new IrLoad("r4", new IrAddress("r3", 0), 4),
+            new IrCall("", "PPC_Lswi", [IrValue.Imm(4), IrValue.Register("r5"), IrValue.Imm(4)]),
+            new IrLoad("r5", new IrAddress("r3", 4), 4));
+
+        Assert.Empty(lowered.OfType<IrResolveGuestMemoryRange>());
+    }
+
+    [Fact]
+    public void OrdinaryCxxPipelineEnablesEightAccessScalarSuffixAfterCall()
+    {
+        var instructions = new List<IrInstruction>
+        {
+            new IrCall("", "func_80002000", [])
+        };
+        for (var index = 0; index < 8; index++)
+            instructions.Add(new IrLoad($"r{index + 4}", new IrAddress("r3", index * 4), 4));
+        instructions.Add(new IrReturn(null));
+        var function = new IrFunction("ordinary_epoch", "entry",
+            [new IrBasicBlock("entry", instructions)]);
+        var types = new RepresentationEnvironment(Enumerable.Range(0, 12)
+            .ToDictionary(index => $"r{index}", _ => ValueRepresentation.UInt32));
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80001000,
+            new SsaResult(function, IrCfg.Build(function)),
+            new FunctionAbiClassification("ordinary_epoch", ValueRepresentation.UInt32),
+            types);
+
+        Assert.Contains("MemoryInline::ResolveRangeHost", code, System.StringComparison.Ordinal);
+        Assert.Equal(8, System.Text.RegularExpressions.Regex.Matches(code, "ReadResolved32").Count);
+    }
+
+    [Theory]
+    [InlineData("Memory_RemapGuestPages")]
+    [InlineData("Fiber_YieldToScheduler")]
+    public void RemapAndSchedulerCallsAlwaysSplitMemoryEpochs(string target)
+    {
+        var function = new IrFunction("boundary", "entry",
+        [
+            new IrBasicBlock("entry",
+            [
+                new IrLoad("r4", new IrAddress("r3_0", 0), 4),
+                new IrCall("", target, []),
+                new IrJump("tail")
+            ]),
+            new IrBasicBlock("tail",
+            [
+                new IrLoad("r5", new IrAddress("r3_0", 4), 4),
+                new IrReturn(null)
+            ])
+        ]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+        Assert.Empty(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>());
+        Assert.Equal(2, lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrLoad>().Count());
+    }
+
+    [Fact]
+    public void IndirectCallAlwaysSplitsMemoryEpochs()
+    {
+        var function = new IrFunction("indirect_boundary", "entry",
+        [
+            new IrBasicBlock("entry",
+            [
+                new IrLoad("r4", new IrAddress("r3_0", 0), 4),
+                new IrIndirectCall("", IrValue.Register("ctr_0"), []),
+                new IrJump("tail")
+            ]),
+            new IrBasicBlock("tail",
+            [
+                new IrLoad("r5", new IrAddress("r3_0", 4), 4),
+                new IrReturn(null)
+            ])
+        ]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+        Assert.Empty(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>());
+    }
+
+    [Fact]
+    public void KeepsSeparateRangesForBasesLoadedThroughAFunctionLiveInRange()
+    {
+        // Regression: the affine tracker must recognize IrResolvedLoad results (from the
+        // function-level live-in pass) as fresh r3 definitions, or every store after the
+        // first redirects through the first pointer and the minimap shadow panes lose their scale.
+        var lowered = Lower(
+            new IrLoad("r3", new IrAddress("r28", 440), 4),
+            new IrStore(new IrAddress("r3", 68), IrValue.Register("f0"), 4),
+            new IrStore(new IrAddress("r3", 72), IrValue.Register("f0"), 4),
+            new IrLoad("r3", new IrAddress("r28", 444), 4),
+            new IrStore(new IrAddress("r3", 68), IrValue.Register("f1"), 4),
+            new IrStore(new IrAddress("r3", 72), IrValue.Register("f1"), 4),
+            new IrLoad("r3", new IrAddress("r28", 448), 4),
+            new IrStore(new IrAddress("r3", 68), IrValue.Register("f2"), 4),
+            new IrStore(new IrAddress("r3", 72), IrValue.Register("f2"), 4));
+
+        // One write range per pane, each spanning only that pane's scale pair.
+        var writeRanges = lowered.OfType<IrResolveGuestMemoryRange>()
+            .Where(static range => range.NeedsWriteAccess)
+            .ToArray();
+        Assert.Equal(3, writeRanges.Length);
+        Assert.All(writeRanges, static range => Assert.Equal(8, range.Length));
+    }
+
+    [Fact]
+    public void TracksAffineBaseUpdateBetweenAccesses()
+    {
+        // lwzu-style walk: the affine tracker folds the constant base update into the
+        // second access's offset, so both loads share one range anchored at the original base.
+        var lowered = Lower(
+            new IrLoad("r4", new IrAddress("r3", 0), 4),
+            new IrBinary("r3", IrValue.Register("r3"), IrValue.Imm(4), "add"),
+            new IrLoad("r5", new IrAddress("r3", 0), 4));
+
+        var resolve = Assert.Single(lowered.OfType<IrResolveGuestMemoryRange>());
+        Assert.Equal("r3", resolve.Base.RegisterName);
+        Assert.Equal(0, resolve.MinOffset);
+        Assert.Equal(8, resolve.Length);
+    }
+
+    [Fact]
+    public void TracksAffineBaseUpdateThroughTemporaryReassignment()
+    {
+        // psq_stu emission shape: the effective address lives in a temp and is
+        // then copied back into the architectural base.
+        var lowered = Lower(
+            new IrStore(new IrAddress("r10", 8), IrValue.Register("r6"), 8),
+            new IrBinary("r10_psq_ea_0", IrValue.Register("r10"), IrValue.Imm(8), "add"),
+            new IrAssign("r10", IrValue.Register("r10_psq_ea_0")),
+            new IrStore(new IrAddress("r10", 8), IrValue.Register("r7"), 8),
+            new IrBinary("r10_psq_ea_1", IrValue.Register("r10"), IrValue.Imm(8), "add"),
+            new IrAssign("r10", IrValue.Register("r10_psq_ea_1")),
+            new IrStore(new IrAddress("r10", 8), IrValue.Register("r8"), 8));
+
+        var resolve = Assert.Single(lowered.OfType<IrResolveGuestMemoryRange>());
+        Assert.Equal("r10", resolve.Base.RegisterName);
+        Assert.Equal(8, resolve.MinOffset);
+        Assert.Equal(24, resolve.Length);
+        var stores = lowered.OfType<IrResolvedStore>().ToArray();
+        Assert.Equal(3, stores.Length);
+        Assert.Equal(0, stores[0].RangeOffset);
+        Assert.Equal(8, stores[1].RangeOffset);
+        Assert.Equal(16, stores[2].RangeOffset);
+    }
+
+    [Fact]
+    public void RejectsGroupWhenBaseChangesUnpredictablyBetweenAccesses()
+    {
+        // A base redefinition the tracker can't follow starts a new generation, so accesses
+        // through different runtime values never share one range proof.
+        var lowered = Lower(
+            new IrLoad("r4", new IrAddress("r3", 0), 4),
+            new IrLoad("r3", new IrAddress("r4", 0), 4),
+            new IrLoad("r5", new IrAddress("r3", 0), 4));
+
+        Assert.Empty(lowered.OfType<IrResolveGuestMemoryRange>());
+    }
+
+    [Fact]
+    public void RejectsCrossPageSizedRanges()
+    {
+        var lowered = Lower(
+            new IrLoad("r4", new IrAddress("r3", 0), 4),
+            new IrLoad("r5", new IrAddress("r3", 5000), 4));
+
+        Assert.Empty(lowered.OfType<IrResolveGuestMemoryRange>());
+    }
+
+    [Fact]
+    public void GroupsAdjacentPairedSingleLoadsAndPreservesKnownGqr()
+    {
+        var lowered = Lower(
+            new IrCall("f1", "PPC_PsqLKnown_00050000", [IrValue.Register("r3"), IrValue.Imm(0), IrValue.Imm(2)]),
+            new IrBinary("ea", IrValue.Register("r3"), IrValue.Imm(4), "add"),
+            new IrCall("f2", "PPC_PsqLKnown_00050000", [IrValue.Register("ea"), IrValue.Imm(1), IrValue.Imm(2)]),
+            new IrCall("f3", "PPC_PsqLKnown_00050000", [IrValue.Register("r3"), IrValue.Imm(1), IrValue.Imm(2)]));
+
+        var resolve = Assert.Single(lowered.OfType<IrResolveGuestMemoryRange>());
+        Assert.True(resolve.NeedsReadAccess);
+        Assert.False(resolve.NeedsWriteAccess);
+        Assert.Equal(8, resolve.Length);
+        var loads = lowered.OfType<IrResolvedPsqLoad>().ToArray();
+        Assert.Equal(3, loads.Length);
+        Assert.Equal(0x00050000u, loads[0].KnownGqr);
+        Assert.Equal(4, loads[1].RangeOffset);
+    }
+
+    [Fact]
+    public void CombinesConsecutiveAdjacentHalfwordLoads()
+    {
+        var lowered = Lower(
+            new IrLoad("r4", new IrAddress("r3", 8), 2),
+            new IrLoad("r5", new IrAddress("r3", 10), 2));
+
+        var pair = Assert.Single(lowered.OfType<IrResolvedLoadPair>());
+        Assert.Equal(2, pair.ElementSizeBytes);
+        Assert.Equal(0, pair.RangeOffset);
+        Assert.Equal("r4", pair.FirstDestination);
+        Assert.Equal("r5", pair.SecondDestination);
+    }
+
+    [Fact]
+    public void CombinesConsecutiveAdjacentWordStores()
+    {
+        var lowered = Lower(
+            new IrStore(new IrAddress("r3", 0), IrValue.Register("r4"), 4),
+            new IrStore(new IrAddress("r3", 4), IrValue.Register("r5"), 4));
+
+        var pair = Assert.Single(lowered.OfType<IrResolvedStorePair>());
+        Assert.Equal(4, pair.ElementSizeBytes);
+        Assert.Equal(0, pair.RangeOffset);
+    }
+
+    [Fact]
+    public void CombinesAdjacentStoresAcrossPureEffectiveAddressCalculation()
+    {
+        var lowered = Lower(
+            new IrStore(new IrAddress("r3", 0), IrValue.Register("r4"), 4),
+            new IrBinary("ea_next", IrValue.Register("r3"), IrValue.Imm(4), "add"),
+            new IrStore(new IrAddress("ea_next", 0), IrValue.Register("r5"), 4));
+
+        var pair = Assert.Single(lowered.OfType<IrResolvedStorePair>());
+        Assert.False(pair.Descending);
+        Assert.Contains(lowered, instruction => instruction is IrBinary { Destination: "ea_next" });
+    }
+
+    [Fact]
+    public void CombinesDescendingAdjacentLoadsAndPreservesDirection()
+    {
+        var lowered = Lower(
+            new IrLoad("r4", new IrAddress("r3", 12), 4),
+            new IrLoad("r5", new IrAddress("r3", 8), 4));
+
+        var pair = Assert.Single(lowered.OfType<IrResolvedLoadPair>());
+        Assert.True(pair.Descending);
+        Assert.Equal(0, pair.RangeOffset);
+        Assert.Equal("r4", pair.FirstDestination);
+        Assert.Equal("r5", pair.SecondDestination);
+    }
+
+    [Fact]
+    public void DoesNotInferRuntimeCachingFromCfgCycleAlone()
+    {
+        var function = new IrFunction("loop", "entry",
+        [
+            new IrBasicBlock("entry", [new IrJump("loop")]),
+            new IrBasicBlock("loop",
+            [
+                new IrLoad("r4", new IrAddress("r3", 0), 4),
+                new IrLoad("r5", new IrAddress("r3", 4), 4),
+                new IrLoad("r6", new IrAddress("r3", 8), 4),
+                new IrJump("loop")
+            ])
+        ]);
+
+        var resolve = Assert.Single(GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2).Blocks
+            .SelectMany(static block => block.Instructions).OfType<IrResolveGuestMemoryRange>());
+    }
+
+    [Fact]
+    public void RejectsSmallStraightLineGroupAsUnprofitable()
+    {
+        var function = new IrFunction("straight", "entry",
+        [
+            new IrBasicBlock("entry",
+            [
+                new IrLoad("r4", new IrAddress("r3", 0), 4),
+                new IrLoad("r5", new IrAddress("r3", 4), 4),
+                new IrReturn(null)
+            ])
+        ]);
+        Assert.Empty(GuestMemoryRangeLowering.Lower(function).Blocks[0].Instructions
+            .OfType<IrResolveGuestMemoryRange>());
+    }
+
+    [Fact]
+    public void RetainsLiveInRangeAcrossDominatedCfgBlocks()
+    {
+        var function = new IrFunction("cfg", "entry",
+        [
+            new IrBasicBlock("entry",
+            [
+                new IrLoad("r4", new IrAddress("r3_0", 0), 4),
+                new IrJump("body")
+            ]),
+            new IrBasicBlock("body",
+            [
+                new IrLoad("r5", new IrAddress("r3_0", 4), 4),
+                new IrReturn(null)
+            ])
+        ]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+        Assert.Single(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>());
+        Assert.Equal(2, lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolvedLoad>().Count());
+    }
+
+    [Fact]
+    public void PlacesLoopCarriedPhiRangeAfterAuthoritativeDefinition()
+    {
+        var function = new IrFunction("phi_loop", "entry",
+        [
+            new IrBasicBlock("entry", [new IrJump("loop")]),
+            new IrBasicBlock("loop",
+            [
+                new IrPhi("r3_1", new Dictionary<string, string>
+                {
+                    ["entry"] = "r3_0",
+                    ["loop"] = "r3_2"
+                }),
+                new IrLoad("r4", new IrAddress("r3_1", 0), 4),
+                new IrLoad("r5", new IrAddress("r3_1", 4), 4),
+                new IrBinary("r3_2", IrValue.Register("r3_1"), IrValue.Imm(8), "add"),
+                new IrJump("loop")
+            ])
+        ]);
+
+        var loop = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2).Blocks[1].Instructions;
+        Assert.IsType<IrPhi>(loop[0]);
+        Assert.IsType<IrResolveGuestMemoryRange>(loop[1]);
+        Assert.Single(loop.OfType<IrResolvedLoadPair>());
+    }
+
+    [Fact]
+    public void KeepsProvenGatherPipeStoresOutOfResolvedRanges()
+    {
+        // Gather-pipe writes (`lis rX, 0xCC01; stX rY, -0x8000(rX)`) must not get hoisted into a
+        // resolved range: ResolveRangeHost returns nullptr for that address at runtime, which
+        // would drop the write into the cold path instead of the emitter's direct GX_HLE_FIFO_Write*.
+        var instructions = new List<IrInstruction>
+        {
+            new IrAssign("r10", IrValue.Imm(unchecked((int)0xCC010000)))
+        };
+        for (var index = 0; index < 13; index++)
+            instructions.Add(new IrStore(new IrAddress("r10", -32768), IrValue.Register($"r{index % 8}"), 4));
+        instructions.Add(new IrReturn(null));
+        var function = new IrFunction("gather_pipe", "entry",
+            [new IrBasicBlock("entry", instructions)]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+
+        Assert.Empty(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>());
+        Assert.Equal(13, lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrStore>().Count());
+    }
+
+    [Fact]
+    public void KeepsProvenHardwareRegisterLoadsOutOfResolvedRanges()
+    {
+        var instructions = new List<IrInstruction>
+        {
+            new IrAssign("r10", IrValue.Imm(unchecked((int)0xCD000000)))
+        };
+        for (var index = 0; index < 8; index++)
+            instructions.Add(new IrLoad($"r{index + 3}", new IrAddress("r10", index * 4), 4));
+        instructions.Add(new IrReturn(null));
+        var function = new IrFunction("hardware_reads", "entry",
+            [new IrBasicBlock("entry", instructions)]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+
+        Assert.Empty(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>());
+        Assert.Equal(8, lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrLoad>().Count());
+    }
+
+    [Fact]
+    public void StillHoistsStoresThroughAProvenMainMemoryBase()
+    {
+        // The exclusion is keyed on the hardware window only: an ordinary
+        // absolute MEM1 base must keep its range proof.
+        var instructions = new List<IrInstruction>
+        {
+            new IrAssign("r10", IrValue.Imm(unchecked((int)0x80300000)))
+        };
+        for (var index = 0; index < 13; index++)
+            instructions.Add(new IrStore(new IrAddress("r10", index * 4), IrValue.Register($"r{index % 8}"), 4));
+        instructions.Add(new IrReturn(null));
+        var function = new IrFunction("main_memory", "entry",
+            [new IrBasicBlock("entry", instructions)]);
+
+        var lowered = GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2);
+
+        Assert.NotEmpty(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrResolveGuestMemoryRange>());
+        Assert.Empty(lowered.Blocks.SelectMany(static block => block.Instructions)
+            .OfType<IrStore>());
+    }
+
+    [Fact]
+    public void EmitsDirectFifoWritesForProvenGatherPipeStores()
+    {
+        var instructions = new List<IrInstruction>
+        {
+            new IrAssign("r10", IrValue.Imm(unchecked((int)0xCC010000)))
+        };
+        for (var index = 0; index < 13; index++)
+            instructions.Add(new IrStore(new IrAddress("r10", -32768), IrValue.Register("r3"), 4));
+        instructions.Add(new IrReturn(null));
+        var function = new IrFunction("gather_pipe_emit", "entry",
+            [new IrBasicBlock("entry", instructions)]);
+        var types = new RepresentationEnvironment(Enumerable.Range(0, 12)
+            .ToDictionary(index => $"r{index}", _ => ValueRepresentation.UInt32));
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x800605C0,
+            new SsaResult(function, IrCfg.Build(function)),
+            new FunctionAbiClassification("gather_pipe_emit", ValueRepresentation.UInt32),
+            types);
+
+        Assert.DoesNotContain("MemoryInline::ResolveRangeHost", code, System.StringComparison.Ordinal);
+        Assert.DoesNotContain("WriteResolved", code, System.StringComparison.Ordinal);
+        Assert.Contains("GX_HLE_FIFO_", code, System.StringComparison.Ordinal);
+    }
+
+    private static IrInstruction[] Lower(params IrInstruction[] instructions)
+    {
+        var loopInstructions = instructions.Append<IrInstruction>(new IrJump("entry")).ToArray();
+        var function = new IrFunction("test", "entry",
+            [new IrBasicBlock("entry", loopInstructions)]);
+        return GuestMemoryRangeLowering.Lower(function, minimumAccesses: 2).Blocks[0].Instructions.ToArray();
+    }
+}
diff --git a/translator/tests/Translator.Tests/GuestSaveRestoreThunkTestDefaults.cs b/translator/tests/Translator.Tests/GuestSaveRestoreThunkTestDefaults.cs
new file mode 100644
index 0000000..78c61d8
--- /dev/null
+++ b/translator/tests/Translator.Tests/GuestSaveRestoreThunkTestDefaults.cs
@@ -0,0 +1,29 @@
+using System.Runtime.CompilerServices;
+using Translator.Core.Analysis;
+using Translator.Core.Loading;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Installs the MKWii PAL save/restore thunk address ranges once for the whole test assembly,
+/// since several suites translate hand-assembled fragments that call these thunks by address.
+/// </summary>
+internal static class GuestSaveRestoreThunkTestDefaults
+{
+    [ModuleInitializer]
+    internal static void Install()
+    {
+        GuestSaveRestoreThunks.Current = GuestSaveRestoreThunks.FromFunctionMap(FunctionMap.Parse(
+            [
+                "800214f8 _save_fpr_23",
+                "8002150c _save_fpr_28",
+                "80021544 _rest_fpr_23",
+                "80021558 _rest_fpr_28",
+                "8002156c _save_gpr_14",
+                "800215a0 _save_gpr_27",
+                "800215b8 _rest_gpr_14",
+                "800215ec _rest_gpr_27"
+            ],
+            "mkwii-pal-test-defaults"));
+    }
+}
diff --git a/translator/tests/Translator.Tests/GuestStateLivenessAnalyzerTests.cs b/translator/tests/Translator.Tests/GuestStateLivenessAnalyzerTests.cs
new file mode 100644
index 0000000..5ca91a8
--- /dev/null
+++ b/translator/tests/Translator.Tests/GuestStateLivenessAnalyzerTests.cs
@@ -0,0 +1,259 @@
+using Translator.Core.Analysis;
+using Translator.Core.Ir;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class GuestStateLivenessAnalyzerTests
+{
+    [Fact]
+    public void IndirectControlFlowRequiresMaterializedContext()
+    {
+        var indirectCall = Function(
+            new IrIndirectCall("lr", IrValue.Register("ctr"), Array.Empty<IrValue>()),
+            new IrReturn(null));
+        var indirectJump = Function(new IrIndirectJump(IrValue.Register("ctr")));
+        var jumpTable = Function(new IrJumpTable("r3", new[]
+        {
+            new IrJumpTableCase(0x80001000u, "case_0")
+        }));
+
+        Assert.False(GuestStateLivenessAnalyzer.CanDeconstructWithoutContext(indirectCall));
+        Assert.False(GuestStateLivenessAnalyzer.CanDeconstructWithoutContext(indirectJump));
+        Assert.False(GuestStateLivenessAnalyzer.CanDeconstructWithoutContext(jumpTable));
+    }
+
+    [Fact]
+    public void DirectCallPassesOnlyCalleeInputsAndReturnsOnlyCallerLiveWrites()
+    {
+        const uint target = 0x80002000u;
+        var callee = Contract(
+            gprRead: (1u << 3) | (1u << 7),
+            gprWrite: (1u << 3) | (1u << 4) | (1u << 8));
+        var function = Function(
+            new IrCall("lr", "0x80002000", Array.Empty<IrValue>()),
+            new IrBinary("r9", IrValue.Register("r4"), IrValue.Imm(1), "add"),
+            new IrReturn(null));
+
+        var result = GuestStateLivenessAnalyzer.Analyze(
+            function,
+            new Dictionary<uint, GuestAbiContract> { [target] = callee },
+            GuestStateMask.Empty);
+
+        var call = Assert.Single(result.DirectCalls);
+        Assert.Equal((1u << 3) | (1u << 7), call.Inputs.Gpr);
+        Assert.Equal(1u << 4, call.Outputs.Gpr);
+        Assert.Equal(0u, call.Outputs.Gpr & ((1u << 3) | (1u << 8)));
+    }
+
+    [Fact]
+    public void CalleeWriteKillsTheIncomingVersion()
+    {
+        const uint target = 0x80002000u;
+        var callee = Contract(gprRead: 0, gprWrite: 1u << 6) with
+        {
+            GprDefiniteWriteMask = 1u << 6
+        };
+        var function = Function(
+            new IrCall("lr", "0x80002000", Array.Empty<IrValue>()),
+            new IrAssign("r8", IrValue.Register("r6")),
+            new IrReturn(null));
+
+        var result = GuestStateLivenessAnalyzer.Analyze(
+            function,
+            new Dictionary<uint, GuestAbiContract> { [target] = callee },
+            GuestStateMask.Empty);
+
+        Assert.Equal(0u, result.BlockLiveIn["entry"].Gpr & (1u << 6));
+        Assert.Equal(1u << 6, Assert.Single(result.DirectCalls).Outputs.Gpr);
+    }
+
+    [Fact]
+    public void ConditionalCalleeWriteDoesNotKillTheIncomingVersion()
+    {
+        const uint target = 0x80002000u;
+        var callee = Contract(gprRead: 0, gprWrite: 1u << 6);
+        var function = Function(
+            new IrCall("lr", "0x80002000", Array.Empty<IrValue>()),
+            new IrAssign("r8", IrValue.Register("r6")),
+            new IrReturn(null));
+
+        var result = GuestStateLivenessAnalyzer.Analyze(
+            function,
+            new Dictionary<uint, GuestAbiContract> { [target] = callee },
+            GuestStateMask.Empty);
+
+        Assert.Equal(1u << 6, result.BlockLiveIn["entry"].Gpr & (1u << 6));
+        Assert.Equal(1u << 6, Assert.Single(result.DirectCalls).Outputs.Gpr);
+    }
+
+    [Fact]
+    public void StateFreeConditionalOutputAlsoRequiresTheIncomingGpr()
+    {
+        var contract = Contract(gprRead: 1u << 3, gprWrite: (1u << 4) | (1u << 6)) with
+        {
+            GprDefiniteWriteMask = 1u << 4
+        };
+
+        var inputs = GuestStateLivenessAnalyzer.RequiredStateFreeGprInputs(
+            contract, (1u << 4) | (1u << 6));
+
+        Assert.Equal((1u << 3) | (1u << 6), inputs);
+    }
+
+    [Fact]
+    public void DirectCallOrdinalsRemainStableWhenUnrelatedInstructionsDiffer()
+    {
+        const uint target = 0x80002000u;
+        var function = Function(
+            new IrCall("lr", "0x80002000", Array.Empty<IrValue>()),
+            new IrAssign("r9", IrValue.Imm(1)),
+            new IrCall("lr", "0x80002000", Array.Empty<IrValue>()),
+            new IrReturn(null));
+
+        var calls = GuestStateLivenessAnalyzer.Analyze(
+            function,
+            new Dictionary<uint, GuestAbiContract> { [target] = Contract(1u << 3, 0) },
+            GuestStateMask.Empty).DirectCalls;
+
+        Assert.Equal(new[] { 0, 1 }, calls.Select(static call => call.CallOrdinal));
+        Assert.Equal(new[] { 0, 2 }, calls.Select(static call => call.InstructionIndex));
+    }
+
+    [Fact]
+    public void TailCallWithoutLinkDestinationKeepsIncomingLrLive()
+    {
+        const uint target = 0x80002000u;
+        var function = Function(
+            new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+            new IrReturn(null));
+
+        var result = GuestStateLivenessAnalyzer.Analyze(
+            function,
+            new Dictionary<uint, GuestAbiContract> { [target] = Contract(1u << 3, 0) },
+            GuestStateMask.Empty);
+
+        Assert.True(result.BlockLiveIn["entry"].Lr);
+        Assert.True(Assert.Single(result.DirectCalls).Inputs.Lr);
+    }
+
+    [Fact]
+    public void ImplicitSequentialBlockFallthroughPropagatesLaterInputsToEntry()
+    {
+        var function = new IrFunction("fallthrough", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrLoad("r3", new IrAddress("r3", 0), 4),
+                new IrTracePpc(0x80001000u, "lwz r3, 0(r3)", "0x80630000")
+            }),
+            new IrBasicBlock("next", new IrInstruction[]
+            {
+                new IrLoad("f0", new IrAddress("r2", -4), 4),
+                new IrReturn(null)
+            })
+        });
+
+        var result = GuestStateLivenessAnalyzer.Analyze(
+            function, new Dictionary<uint, GuestAbiContract>(), GuestStateMask.Empty);
+
+        Assert.Equal((1u << 2) | (1u << 3), result.BlockLiveIn["entry"].Gpr);
+        Assert.Equal(1u << 2, result.BlockLiveOut["entry"].Gpr);
+    }
+
+    [Fact]
+    public void TracksPairedFprCrXerFpscrAndGqrState()
+    {
+        const uint target = 0x80002000u;
+        var callee = Contract(gprRead: 0, gprWrite: 0) with
+        {
+            FprReadBeforeWriteMask = 1u << 2,
+            FprPossibleWriteMask = (1u << 1) | (1u << 2),
+            CrReadBeforeWriteMask = 1 << 3,
+            CrPossibleWriteMask = (1 << 2) | (1 << 3),
+            ReadsXerBeforeWrite = true,
+            MayWriteXer = true,
+            ReadsFpscrBeforeWrite = true,
+            MayWriteFpscr = true,
+            GqrReadBeforeWriteMask = 1 << 5,
+            GqrPossibleWriteMask = (1 << 4) | (1 << 5)
+        };
+        var function = Function(
+            new IrCall("lr", "0x80002000", Array.Empty<IrValue>()),
+            new IrAssign("f6", IrValue.Register("f1")),
+            new IrAssign("r3", IrValue.Register("cr2")),
+            new IrAssign("r4", IrValue.Register("fpscr")),
+            new IrAssign("r5", IrValue.Register("gqr4")),
+            new IrReturn(null));
+
+        var call = Assert.Single(GuestStateLivenessAnalyzer.Analyze(
+            function,
+            new Dictionary<uint, GuestAbiContract> { [target] = callee },
+            GuestStateMask.Empty).DirectCalls);
+
+        Assert.Equal(1u << 2, call.Inputs.Fpr);
+        Assert.Equal(1u << 1, call.Outputs.Fpr);
+        Assert.Equal(1 << 3, call.Inputs.Cr);
+        Assert.Equal(1 << 2, call.Outputs.Cr);
+        Assert.True(call.Inputs.Xer);
+        Assert.False(call.Outputs.Xer);
+        Assert.True(call.Inputs.Fpscr);
+        Assert.True(call.Outputs.Fpscr);
+        Assert.Equal(1 << 5, call.Inputs.Gqr);
+        Assert.Equal(1 << 4, call.Outputs.Gqr);
+    }
+
+    [Fact]
+    public void MaterializedContextExitKeepsNonReturnArchitecturalWritesLive()
+    {
+        const uint target = 0x80002000u;
+        var callee = Contract(gprRead: 0, gprWrite: 0) with
+        {
+            FprPossibleWriteMask = 0x1Fu,
+            FprReturnMask = 1u << 1,
+            CrPossibleWriteMask = 1,
+            MayWriteLr = true
+        };
+        var callerContract = Contract(gprRead: 0, gprWrite: 0) with
+        {
+            FprPossibleWriteMask = 0x1Fu,
+            FprReturnMask = 1u << 1,
+            CrPossibleWriteMask = 1,
+            MayWriteLr = true
+        };
+        var function = Function(
+            new IrCall("lr", "0x80002000", Array.Empty<IrValue>()),
+            new IrReturn(null));
+
+        var call = Assert.Single(GuestStateLivenessAnalyzer.Analyze(
+            function,
+            new Dictionary<uint, GuestAbiContract> { [target] = callee },
+            GuestStateLivenessAnalyzer.MaterializedContextExit(callerContract)).DirectCalls);
+
+        Assert.Equal(0x1Fu, call.Outputs.Fpr);
+        Assert.Equal(1, call.Outputs.Cr);
+        Assert.True(call.Outputs.Lr);
+    }
+
+    private static IrFunction Function(params IrInstruction[] instructions) =>
+        new("caller", "entry", new[] { new IrBasicBlock("entry", instructions) });
+
+    private static GuestAbiContract Contract(uint gprRead, uint gprWrite) =>
+        new(
+            gprRead,
+            gprWrite,
+            gprWrite & ((1u << 3) | (1u << 4)),
+            0,
+            0,
+            0,
+            0,
+            0,
+            false,
+            false,
+            false,
+            false,
+            false,
+            false,
+            GuestCallBoundaryFlags.None,
+            Array.Empty<uint>());
+}
diff --git a/translator/tests/Translator.Tests/GuestThunkCodeGenTests.cs b/translator/tests/Translator.Tests/GuestThunkCodeGenTests.cs
new file mode 100644
index 0000000..752f8ef
--- /dev/null
+++ b/translator/tests/Translator.Tests/GuestThunkCodeGenTests.cs
@@ -0,0 +1,93 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class GuestThunkCodeGenTests
+{
+    [Fact]
+    public void GprSaveAndRestoreUseTheSameInlineRangeShape()
+    {
+        var save = Emit(
+            "gpr_save",
+            0x8002156Cu,
+            new Dictionary<string, ValueRepresentation>
+            {
+                ["r11"] = ValueRepresentation.UInt32,
+                ["r14"] = ValueRepresentation.UInt32,
+                ["r31"] = ValueRepresentation.UInt32
+            });
+        var restore = Emit(
+            "gpr_restore",
+            0x800215B8u,
+            new Dictionary<string, ValueRepresentation>
+            {
+                ["r11"] = ValueRepresentation.UInt32,
+                ["r14"] = ValueRepresentation.UInt32,
+                ["r31"] = ValueRepresentation.UInt32
+            });
+
+        Assert.Contains(
+            "MemoryInline::FlatWrite32((r11 + -72), static_cast<uint32_t>(r14));",
+            save,
+            StringComparison.Ordinal);
+        Assert.Contains(
+            "r14 = MemoryInline::FlatRead32((r11 + -72));",
+            restore,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("InvokeDirectCpu<0x8002156Cu>(ctx);", save, StringComparison.Ordinal);
+        Assert.DoesNotContain("InvokeDirectCpu<0x800215B8u>(ctx);", restore, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FprSaveAndRestoreUseEightByteInlineHelpers()
+    {
+        var types = new Dictionary<string, ValueRepresentation>
+        {
+            ["r11"] = ValueRepresentation.UInt32,
+            ["f23"] = ValueRepresentation.Float64,
+            ["f31"] = ValueRepresentation.Float64
+        };
+        var save = Emit("fpr_save", 0x800214F8u, types);
+        var restore = Emit("fpr_restore", 0x80021544u, types);
+
+        Assert.Contains(
+            "MemoryInline::FlatWriteFloat64((r11 + -72), f23.d);",
+            save,
+            StringComparison.Ordinal);
+        Assert.Contains(
+            "f23.d = MemoryInline::FlatReadFloat64((r11 + -72));",
+            restore,
+            StringComparison.Ordinal);
+    }
+
+    private static string Emit(
+        string name,
+        uint thunkAddress,
+        IReadOnlyDictionary<string, ValueRepresentation> typeMap)
+    {
+        var function = new IrFunction(
+            name,
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall(string.Empty, $"func_{thunkAddress:X8}", Array.Empty<IrValue>()),
+                    new IrReturn(null)
+                })
+            });
+        var code = new CxxLinearCodeGenerator().Emit(
+            thunkAddress,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification(name, ValueRepresentation.Void),
+            new RepresentationEnvironment(typeMap));
+        return code;
+    }
+}
diff --git a/translator/tests/Translator.Tests/InferredGuestFunctionAbiProviderDeterminismTests.cs b/translator/tests/Translator.Tests/InferredGuestFunctionAbiProviderDeterminismTests.cs
new file mode 100644
index 0000000..e51524a
--- /dev/null
+++ b/translator/tests/Translator.Tests/InferredGuestFunctionAbiProviderDeterminismTests.cs
@@ -0,0 +1,98 @@
+using System.Buffers.Binary;
+using Translator.Core.CodeGen;
+using Translator.Core.Loading;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class InferredGuestFunctionAbiProviderDeterminismTests
+{
+    private const uint FunctionA = MemoryLayout.RamBase;
+    private const uint FunctionB = MemoryLayout.RamBase + 0x10;
+
+    [Fact]
+    public void MutuallyRecursiveFunctions_AreIndependentOfRootRequestOrder()
+    {
+        var forward = CreateProvider();
+        forward.Prewarm(new[] { FunctionA, FunctionB });
+        var forwardA = GetSnapshot(forward, FunctionA);
+        var forwardB = GetSnapshot(forward, FunctionB);
+
+        var reverse = CreateProvider();
+        reverse.Prewarm(new[] { FunctionB, FunctionA });
+        var reverseB = GetSnapshot(reverse, FunctionB);
+        var reverseA = GetSnapshot(reverse, FunctionA);
+
+        Assert.Equal(forwardA, reverseA);
+        Assert.Equal(forwardB, reverseB);
+    }
+
+    [Fact]
+    public void MutuallyRecursiveFunctions_AreDeterministicUnderConcurrentRequests()
+    {
+        var expectedProvider = CreateProvider();
+        expectedProvider.Prewarm(new[] { FunctionA, FunctionB });
+        var expected = new Dictionary<uint, AbiSnapshot>
+        {
+            [FunctionA] = GetSnapshot(expectedProvider, FunctionA),
+            [FunctionB] = GetSnapshot(expectedProvider, FunctionB)
+        };
+        var provider = CreateProvider();
+        var addresses = Enumerable.Range(0, 64)
+            .Select(index => index % 2 == 0 ? FunctionB : FunctionA)
+            .ToArray();
+        provider.Prewarm(addresses);
+        var actual = new AbiSnapshot[addresses.Length];
+
+        Parallel.For(0, addresses.Length, index =>
+        {
+            actual[index] = GetSnapshot(provider, addresses[index]);
+        });
+
+        for (var index = 0; index < addresses.Length; index++)
+        {
+            Assert.Equal(expected[addresses[index]], actual[index]);
+        }
+    }
+
+    private static InferredGuestFunctionAbiProvider CreateProvider()
+    {
+        var memory = new byte[0x18];
+        WriteWord(memory, 0x00, 0x38800000); // li r4, 0
+        WriteWord(memory, 0x04, LinkBranch(FunctionA + 4, FunctionB));
+        WriteWord(memory, 0x08, 0x4E800020); // blr
+        WriteWord(memory, 0x0C, 0x4E800020);
+        WriteWord(memory, 0x10, LinkBranch(FunctionB, FunctionA));
+        WriteWord(memory, 0x14, 0x4E800020); // blr
+        var range = AddressRange.FromStartAndSize(MemoryLayout.RamBase, (uint)memory.Length);
+        var image = new ProgramImage(memory, range, range, default, "abi-cycle-determinism");
+        return new InferredGuestFunctionAbiProvider(image);
+    }
+
+    private static AbiSnapshot GetSnapshot(InferredGuestFunctionAbiProvider provider, uint address)
+    {
+        Assert.True(provider.TryGetGuestFunctionAbi($"func_{address:X8}", out var abi));
+        return new AbiSnapshot(
+            string.Join(",", abi.ArgumentRegisters.Order(StringComparer.OrdinalIgnoreCase)),
+            string.Join(",", abi.ScalarFloatArgumentRegisters.Order(StringComparer.OrdinalIgnoreCase)),
+            abi.ReturnsPairedScalarFloat,
+            abi.WritesFloatReturnRegister,
+            abi.WritesGprReturnRegister,
+            abi.PreservesVolatileContext);
+    }
+
+    private static uint LinkBranch(uint from, uint to) =>
+        0x48000001u | ((to - from) & 0x03FFFFFCu);
+
+    private static void WriteWord(byte[] memory, int offset, uint value) =>
+        BinaryPrimitives.WriteUInt32BigEndian(memory.AsSpan(offset, 4), value);
+
+    private sealed record AbiSnapshot(
+        string ArgumentRegisters,
+        string ScalarFloatArgumentRegisters,
+        bool ReturnsPairedScalarFloat,
+        bool WritesFloatReturnRegister,
+        bool WritesGprReturnRegister,
+        bool PreservesVolatileContext);
+}
diff --git a/translator/tests/Translator.Tests/InlineArithmeticTableCodeGenTests.cs b/translator/tests/Translator.Tests/InlineArithmeticTableCodeGenTests.cs
new file mode 100644
index 0000000..df79821
--- /dev/null
+++ b/translator/tests/Translator.Tests/InlineArithmeticTableCodeGenTests.cs
@@ -0,0 +1,191 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Coverage for the descriptor-driven arithmetic inline emitters, going through the public
+/// C++ generator (not the private emitter directly) so lookup and output are tested together.
+/// </summary>
+public sealed class InlineArithmeticTableCodeGenTests
+{
+    public static IEnumerable<object[]> PairedCases()
+    {
+        yield return Case("PPC_PsMerge00", "PPC_PsMerge00Inline");
+        yield return Case("PPC_PsMerge01", "PPC_PsMerge01Inline");
+        yield return Case("PPC_PsMerge10", "PPC_PsMerge10Inline");
+        yield return Case("PPC_PsMerge11", "PPC_PsMerge11Inline");
+        yield return Case("PPC_PsAdd", "PPC_PsAddInline");
+        yield return Case("PPC_PsAddNoNi", "PPC_PsAddNoNiInline");
+        yield return Case("PPC_PsSub", "PPC_PsSubInline");
+        yield return Case("PPC_PsSubNoNi", "PPC_PsSubNoNiInline");
+        yield return Case("PPC_PsDiv", "PPC_PsDivInline");
+        yield return Case("PPC_PsMul", "PPC_PsMulInline");
+        yield return Case("PPC_PsMulNoNi", "PPC_PsMulNoNiInline");
+        yield return Case("PPC_PsNeg", "PPC_PsNegInline");
+        yield return Case("PPC_PsAbs", "PPC_PsAbsInline");
+        yield return Case("PPC_PsMuls0", "PPC_PsMuls0Inline");
+        yield return Case("PPC_PsMuls1", "PPC_PsMuls1Inline");
+        yield return Case("PPC_PsMadd", "PPC_PsMaddInline");
+        yield return Case("PPC_PsMaddNoNi", "PPC_PsMaddNoNiInline");
+        yield return Case("PPC_PsMsub", "PPC_PsMsubInline");
+        yield return Case("PPC_PsMsubNoNi", "PPC_PsMsubNoNiInline");
+        yield return Case("PPC_PsNmsub", "PPC_PsNmsubInline");
+        yield return Case("PPC_PsNmsubNoNi", "PPC_PsNmsubNoNiInline");
+        yield return Case("PPC_PsNmadd", "PPC_PsNmaddInline");
+        yield return Case("PPC_PsMadds0", "PPC_PsMadds0Inline");
+        yield return Case("PPC_PsMadds1", "PPC_PsMadds1Inline");
+        yield return Case("PPC_PsSum0", "PPC_PsSum0Inline");
+        yield return Case("PPC_PsSum1", "PPC_PsSum1Inline");
+    }
+
+    public static IEnumerable<object[]> ScalarCases()
+    {
+        yield return Case("PPC_Fadds", "PpcForceSingleValueInline");
+        yield return Case("PPC_FaddsNoNi", "static_cast<float>");
+        yield return Case("PPC_Fsubs", "PpcForceSingleValueInline");
+        yield return Case("PPC_FsubsNoNi", "static_cast<float>");
+        yield return Case("PPC_Fmuls", "PpcFmulsInline");
+        yield return Case("PPC_FmulsNoNi", "PpcFmulsNoNiInline");
+        yield return Case("PPC_Fdivs", "PpcForceSingleValueInline");
+        yield return Case("PPC_FdivsNoNi", "static_cast<float>");
+        yield return Case("PPC_Fsqrt", "std::sqrt");
+        yield return Case("PPC_Fmadd", "PpcFmaddInline");
+        yield return Case("PPC_Fmsub", "PpcFmsubInline");
+        yield return Case("PPC_Fnmadd", "PpcFnmaddInline");
+        yield return Case("PPC_Fnmsub", "PpcFnmsubInline");
+    }
+
+    [Theory]
+    [MemberData(nameof(PairedCases))]
+    public void PairedArithmeticTargetsUseExpectedInlineHelper(string target, string expected)
+    {
+        var code = EmitCall(
+            target,
+            "f0",
+            IrValue.Register("f1"),
+            IrValue.Register("f2"),
+            IrValue.Register("f3"));
+
+        Assert.Contains(expected + "(", code, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [MemberData(nameof(ScalarCases))]
+    public void ScalarArithmeticTargetsUseExpectedInlineHelper(string target, string expected)
+    {
+        var code = EmitCall(
+            target,
+            "f0",
+            IrValue.Register("f1"),
+            IrValue.Register("f2"),
+            IrValue.Register("f3"));
+
+        Assert.Contains(expected, code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PairedTablePreservesOperandOrderAndNoNiPacking()
+    {
+        var code = EmitCall(
+            "PPC_PsMaddNoNi",
+            "f0",
+            IrValue.Imm(1),
+            IrValue.Imm(2),
+            IrValue.Imm(3));
+
+        Assert.Contains(
+            "PPC_PsMaddNoNiInline(PPC_PsFromScalarNoNiInline(1), PPC_PsFromScalarNoNiInline(2), PPC_PsFromScalarNoNiInline(3))",
+            code,
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ScalarTablePreservesFmaOperandOrder()
+    {
+        var code = EmitCall(
+            "PPC_Fmsub",
+            "f0",
+            IrValue.Imm(1),
+            IrValue.Imm(2),
+            IrValue.Imm(3));
+
+        Assert.Contains("PpcFmsubInline(1, 2, 3)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TableTargetsRemainCaseInsensitive()
+    {
+        var code = EmitCall(
+            "ppc_psaddnoni",
+            "f0",
+            IrValue.Imm(1),
+            IrValue.Imm(2));
+
+        Assert.Contains("PPC_PsAddNoNiInline(", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TableTargetsKeepMissingDestinationSuppression()
+    {
+        var code = EmitCall(
+            "PPC_PsAdd",
+            string.Empty,
+            IrValue.Imm(1),
+            IrValue.Imm(2));
+
+        Assert.DoesNotContain("PPC_PsAddInline(", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_PsAdd(", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TableTargetsKeepMissingArgumentLiteralZeroFallback()
+    {
+        var code = EmitCall("PPC_PsAdd", "f0", IrValue.Imm(1));
+
+        Assert.Contains(
+            "PPC_PsAddInline(PPC_PsFromScalarInline(1), 0)",
+            code,
+            StringComparison.Ordinal);
+    }
+
+    private static object[] Case(string target, string expected) => new object[] { target, expected };
+
+    private static string EmitCall(string target, string destination, params IrValue[] arguments)
+    {
+        var function = new IrFunction(
+            "inline_table_probe",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock(
+                    "entry",
+                    new IrInstruction[]
+                    {
+                        new IrCall(destination, target, arguments),
+                        new IrReturn(null)
+                    })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f0"] = ValueRepresentation.Float64,
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("inline_table_probe", ValueRepresentation.Void);
+
+        return new CxxLinearCodeGenerator().Emit(
+            0x80040000,
+            new SsaTransformer().Convert(function),
+            signature,
+            types);
+    }
+}
diff --git a/translator/tests/Translator.Tests/IrRegisterDataFlowTests.cs b/translator/tests/Translator.Tests/IrRegisterDataFlowTests.cs
new file mode 100644
index 0000000..aa71538
--- /dev/null
+++ b/translator/tests/Translator.Tests/IrRegisterDataFlowTests.cs
@@ -0,0 +1,103 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class IrRegisterDataFlowTests
+{
+    [Fact]
+    public void ResolvedInstructionsExposeAllRegisterOperandsAndDestinations()
+    {
+        var instructions = new IrInstruction[]
+        {
+            new IrResolvedLoad(
+                "r3", "range", new IrAddress("r4", 4), 0, 4),
+            new IrResolvedStore(
+                "range", new IrAddress("r5", 8), 0, IrValue.Register("r6"), 4),
+            new IrResolvedPsqLoad(
+                "f1", "range", IrValue.Register("r7"), 0, 0, 2, KnownGqr: null),
+            new IrResolvedPsqStore(
+                "range", IrValue.Register("r8"), 0, IrValue.Register("r9"),
+                0, 3, KnownGqr: 0x1234u),
+            new IrResolvedLoadPair(
+                "r10", "r11", "range", new IrAddress("r12", 0),
+                new IrAddress("r13", 4), 0, 4),
+            new IrResolvedStorePair(
+                "range", new IrAddress("r14", 0), new IrAddress("r15", 4),
+                0, IrValue.Register("r16"), IrValue.Register("r17"), 4)
+        };
+
+        var uses = instructions.SelectMany(IrRegisterDataFlow.Uses).ToArray();
+        var definitions = instructions.SelectMany(IrRegisterDataFlow.Definitions).ToArray();
+
+        Assert.Equal(
+            new[] { "r4", "r5", "r6", "r7", "gqr2", "r8", "r9", "r12", "r13", "r14", "r15", "r16", "r17" },
+            uses);
+        Assert.Equal(new[] { "r3", "f1", "r10", "r11" }, definitions);
+    }
+
+    [Fact]
+    public void JumpTableSelectorsAndRepeatedOperandsRemainVisible()
+    {
+        var selector = new IrJumpTable(
+            "r9_jump_selector",
+            new[] { new IrJumpTableCase(0x80001000u, "case_0") });
+        var duplicateUse = new IrBinary(
+            "temporary", IrValue.Register("r3"), IrValue.Register("r3"), "add");
+
+        Assert.Equal(new[] { "r9_jump_selector" }, IrRegisterDataFlow.Uses(selector));
+        Assert.Equal(new[] { "r3", "r3" }, IrRegisterDataFlow.Uses(duplicateUse));
+    }
+
+    [Fact]
+    public void NumericSsaSuffixIsArchitecturalButNamedLifterSuffixIsTemporary()
+    {
+        Assert.Equal("r3", IrRegisterDataFlow.BaseName("r3_7"));
+        Assert.Equal("r3_addc_left", IrRegisterDataFlow.BaseName("r3_addc_left"));
+        Assert.True(IrRegisterDataFlow.IsRegisterName("r3_7"));
+        Assert.False(IrRegisterDataFlow.IsRegisterName("r3_addc_left"));
+    }
+
+    [Fact]
+    public void RangePointerDestinationIsNotDeclaredAsAValueLocal()
+    {
+        var function = new IrFunction(
+            "range_pointer_local_policy",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrResolveGuestMemoryRange(
+                        "range", IrValue.Register("r13"), 0, 64,
+                        NeedsReadAccess: true, NeedsWriteAccess: false),
+                    new IrResolvedLoad(
+                        "r3", "range", new IrAddress("r2", 4), 4, 4),
+                    new IrReturn(IrValue.Register("r3"))
+                })
+            });
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r2"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32,
+            ["r13"] = ValueRepresentation.UInt32
+        });
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006203,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("range_pointer_local_policy", ValueRepresentation.UInt32),
+            types);
+
+        Assert.Equal(new[] { "range" }, IrRegisterDataFlow.Definitions(function.Blocks[0].Instructions[0]));
+        Assert.Contains("uint8_t* range = nullptr;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("uint32_t range", code, StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/JumpTableDetectorTests.cs b/translator/tests/Translator.Tests/JumpTableDetectorTests.cs
new file mode 100644
index 0000000..5a59cda
--- /dev/null
+++ b/translator/tests/Translator.Tests/JumpTableDetectorTests.cs
@@ -0,0 +1,334 @@
+using System.Collections.Generic;
+using Translator.Core.Disassembly;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class JumpTableDetectorTests
+{
+    private static IReadOnlyDictionary<uint, int> BuildIndex(IReadOnlyList<PpcInstruction> ordered)
+        => ordered.Select((ins, idx) => new { ins.Address, idx }).ToDictionary(x => x.Address, x => x.idx);
+
+    [Fact]
+    public void RecognizesLwzxBackedSwitchTable()
+    {
+        const uint baseAddr = 0x80000000;
+        const uint tableAddr = 0x80000100;
+        var ordered = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "cmplwi", new PpcOperand[] { new PpcRegisterOperand("r3", 3), new PpcImmediateOperand(2) }),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "slwi", new PpcOperand[] { new PpcRegisterOperand("r3", 3), new PpcRegisterOperand("r3", 3), new PpcImmediateOperand(2) }),
+            PpcInstruction.Synthetic(baseAddr + 0x08, 0, "lis", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(unchecked((short)0x8000)) }),
+            PpcInstruction.Synthetic(baseAddr + 0x0C, 0, "addi", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(0x0100) }),
+            PpcInstruction.Synthetic(baseAddr + 0x10, 0, "lwzx", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r3", 3) }),
+            PpcInstruction.Synthetic(baseAddr + 0x14, 0, "mtctr", new PpcOperand[] { new PpcRegisterOperand("r0", 0) }),
+            PpcInstruction.Synthetic(baseAddr + 0x18, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        };
+
+        var indexByAddress = BuildIndex(ordered);
+
+        var image = TranslatorCppTestHarness.CreateImage(
+            (tableAddr + 0x00, baseAddr + 0x40),
+            (tableAddr + 0x04, baseAddr + 0x50),
+            (tableAddr + 0x08, baseAddr + 0x60));
+
+        var recognized = JumpTableDetector.TryRecognize(
+            ordered,
+            indexByAddress,
+            baseAddr + 0x18,
+            baseAddr,
+            baseAddr + 0x100,
+            image,
+            out var targets);
+
+        Assert.True(recognized);
+        Assert.Equal(new uint[] { baseAddr + 0x40, baseAddr + 0x50, baseAddr + 0x60 }, targets);
+    }
+
+    [Fact]
+    public void UsesFallbackUpperBoundWhenCompareUsesLogicalCounter()
+    {
+        const uint baseAddr = 0x80001000;
+        const uint tableAddr = 0x80001200;
+        var ordered = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "cmplwi", new PpcOperand[] { new PpcRegisterOperand("r18", 18), new PpcImmediateOperand(1) }),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "slwi", new PpcOperand[] { new PpcRegisterOperand("r30", 30), new PpcRegisterOperand("r18", 18), new PpcImmediateOperand(2) }),
+            PpcInstruction.Synthetic(baseAddr + 0x08, 0, "lis", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(unchecked((short)0x8000)) }),
+            PpcInstruction.Synthetic(baseAddr + 0x0C, 0, "addi", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(0x1200) }),
+            PpcInstruction.Synthetic(baseAddr + 0x10, 0, "lwzx", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r30", 30) }),
+            PpcInstruction.Synthetic(baseAddr + 0x14, 0, "mtctr", new PpcOperand[] { new PpcRegisterOperand("r0", 0) }),
+            PpcInstruction.Synthetic(baseAddr + 0x18, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        };
+
+        var indexByAddress = BuildIndex(ordered);
+
+        var image = TranslatorCppTestHarness.CreateImage(
+            (tableAddr + 0x00, baseAddr + 0x30),
+            (tableAddr + 0x04, baseAddr + 0x34));
+
+        var recognized = JumpTableDetector.TryRecognize(
+            ordered,
+            indexByAddress,
+            baseAddr + 0x18,
+            baseAddr,
+            baseAddr + 0x100,
+            image,
+            out var targets);
+
+        Assert.True(recognized);
+        Assert.Equal(new uint[] { baseAddr + 0x30, baseAddr + 0x34 }, targets);
+    }
+
+    [Fact]
+    public void RecognizesPcRelativeTablePointerWithRelativeEntries()
+    {
+        const uint baseAddr = 0x80010000;
+        const uint linkAddress = baseAddr + 0x04;
+        const uint picBase = 0x80011000;
+        const uint tableAddr = 0x80012000;
+        var ordered = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "bl", new PpcOperand[] { new PpcBranchTargetOperand(linkAddress) }, [linkAddress], isCall: true),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "mflr", new PpcOperand[] { new PpcRegisterOperand("r30", 30) }),
+            PpcInstruction.Synthetic(baseAddr + 0x08, 0, "lwz", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcDisplacementOperand(-20, "r30", 30) }),
+            PpcInstruction.Synthetic(baseAddr + 0x0C, 0, "add", new PpcOperand[] { new PpcRegisterOperand("r30", 30), new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r30", 30) }),
+            PpcInstruction.Synthetic(baseAddr + 0x10, 0, "cmplwi", new PpcOperand[] { new PpcRegisterOperand("r9", 9), new PpcImmediateOperand(1) }),
+            PpcInstruction.Synthetic(baseAddr + 0x14, 0, "slwi", new PpcOperand[] { new PpcRegisterOperand("r9", 9), new PpcRegisterOperand("r9", 9), new PpcImmediateOperand(2) }),
+            PpcInstruction.Synthetic(baseAddr + 0x18, 0, "lwz", new PpcOperand[] { new PpcRegisterOperand("r10", 10), new PpcDisplacementOperand(-0x20, "r30", 30) }),
+            PpcInstruction.Synthetic(baseAddr + 0x1C, 0, "lwzx", new PpcOperand[] { new PpcRegisterOperand("r9", 9), new PpcRegisterOperand("r10", 10), new PpcRegisterOperand("r9", 9) }),
+            PpcInstruction.Synthetic(baseAddr + 0x20, 0, "add", new PpcOperand[] { new PpcRegisterOperand("r9", 9), new PpcRegisterOperand("r9", 9), new PpcRegisterOperand("r10", 10) }),
+            PpcInstruction.Synthetic(baseAddr + 0x24, 0, "mtctr", new PpcOperand[] { new PpcRegisterOperand("r9", 9) }),
+            PpcInstruction.Synthetic(baseAddr + 0x28, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        };
+
+        var image = TranslatorCppTestHarness.CreateImage(
+            (linkAddress - 20, unchecked(picBase - linkAddress)),
+            (picBase - 0x20, tableAddr),
+            (tableAddr + 0x00, unchecked((baseAddr + 0x40) - tableAddr)),
+            (tableAddr + 0x04, unchecked((baseAddr + 0x50) - tableAddr)));
+
+        var recognized = JumpTableDetector.TryRecognize(
+            ordered,
+            BuildIndex(ordered),
+            baseAddr + 0x28,
+            baseAddr,
+            baseAddr + 0x100,
+            image,
+            out var targets);
+
+        Assert.True(recognized);
+        Assert.Equal(new uint[] { baseAddr + 0x40, baseAddr + 0x50 }, targets);
+    }
+
+    [Fact]
+    public void RecognizesPcRelativeTablePointerWhenTocSetupIsFarBack()
+    {
+        const uint baseAddr = 0x80018000;
+        const uint linkAddress = baseAddr + 0x04;
+        const uint picBase = 0x8001A000;
+        const uint tableAddr = 0x8001B000;
+        var ordered = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "bl", new PpcOperand[] { new PpcBranchTargetOperand(linkAddress) }, [linkAddress], isCall: true),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "mflr", new PpcOperand[] { new PpcRegisterOperand("r30", 30) }),
+            PpcInstruction.Synthetic(baseAddr + 0x08, 0, "lwz", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcDisplacementOperand(-20, "r30", 30) }),
+            PpcInstruction.Synthetic(baseAddr + 0x0C, 0, "add", new PpcOperand[] { new PpcRegisterOperand("r30", 30), new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r30", 30) }),
+        };
+
+        for (var i = 0; i < 76; i++)
+        {
+            ordered.Add(PpcInstruction.Synthetic(baseAddr + 0x10 + (uint)(i * 4), 0, "nop", System.Array.Empty<PpcOperand>()));
+        }
+
+        var switchBase = baseAddr + 0x10 + (76u * 4);
+        ordered.AddRange(new[]
+        {
+            PpcInstruction.Synthetic(switchBase + 0x00, 0, "cmplwi", new PpcOperand[] { new PpcRegisterOperand("r9", 9), new PpcImmediateOperand(1) }),
+            PpcInstruction.Synthetic(switchBase + 0x04, 0, "slwi", new PpcOperand[] { new PpcRegisterOperand("r9", 9), new PpcRegisterOperand("r9", 9), new PpcImmediateOperand(2) }),
+            PpcInstruction.Synthetic(switchBase + 0x08, 0, "lwz", new PpcOperand[] { new PpcRegisterOperand("r10", 10), new PpcDisplacementOperand(-0x20, "r30", 30) }),
+            PpcInstruction.Synthetic(switchBase + 0x0C, 0, "lwzx", new PpcOperand[] { new PpcRegisterOperand("r9", 9), new PpcRegisterOperand("r10", 10), new PpcRegisterOperand("r9", 9) }),
+            PpcInstruction.Synthetic(switchBase + 0x10, 0, "add", new PpcOperand[] { new PpcRegisterOperand("r9", 9), new PpcRegisterOperand("r9", 9), new PpcRegisterOperand("r10", 10) }),
+            PpcInstruction.Synthetic(switchBase + 0x14, 0, "mtctr", new PpcOperand[] { new PpcRegisterOperand("r9", 9) }),
+            PpcInstruction.Synthetic(switchBase + 0x18, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        });
+
+        var image = TranslatorCppTestHarness.CreateImage(
+            (linkAddress - 20, unchecked(picBase - linkAddress)),
+            (picBase - 0x20, tableAddr),
+            (tableAddr + 0x00, unchecked((baseAddr + 0x180) - tableAddr)),
+            (tableAddr + 0x04, unchecked((baseAddr + 0x190) - tableAddr)));
+
+        var recognized = JumpTableDetector.TryRecognize(
+            ordered,
+            BuildIndex(ordered),
+            switchBase + 0x18,
+            baseAddr,
+            baseAddr + 0x200,
+            image,
+            out var targets);
+
+        Assert.True(recognized);
+        Assert.Equal(new uint[] { baseAddr + 0x180, baseAddr + 0x190 }, targets);
+    }
+
+    [Fact]
+    public void RejectsWhenEntryPointOrMtctrChainIsMissing()
+    {
+        const uint baseAddr = 0x80002000;
+        var ordered = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "lwzx", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r3", 3) }),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        };
+
+        var image = TranslatorCppTestHarness.CreateImage((0x80002100u, baseAddr + 0x20));
+
+        Assert.False(JumpTableDetector.TryRecognize(
+            ordered,
+            BuildIndex(ordered),
+            baseAddr + 0x10,
+            baseAddr,
+            baseAddr + 0x100,
+            image,
+            out _));
+
+        Assert.False(JumpTableDetector.TryRecognize(
+            ordered,
+            BuildIndex(ordered),
+            baseAddr + 0x04,
+            baseAddr,
+            baseAddr + 0x100,
+            image,
+            out _));
+    }
+
+    [Fact]
+    public void RejectsWhenCtrLoadChainIsInvalid()
+    {
+        const uint baseAddr = 0x80003000;
+        const uint tableAddr = 0x80003100;
+        var image = TranslatorCppTestHarness.CreateImage((tableAddr + 0x00, baseAddr + 0x20));
+
+        var wrongMtctrOperand = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "cmplwi", new PpcOperand[] { new PpcRegisterOperand("r3", 3), new PpcImmediateOperand(0) }),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "lis", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(unchecked((short)0x8000)) }),
+            PpcInstruction.Synthetic(baseAddr + 0x08, 0, "addi", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(0x0100) }),
+            PpcInstruction.Synthetic(baseAddr + 0x0C, 0, "lwzx", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r3", 3) }),
+            PpcInstruction.Synthetic(baseAddr + 0x10, 0, "mtctr", System.Array.Empty<PpcOperand>()),
+            PpcInstruction.Synthetic(baseAddr + 0x14, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        };
+
+        Assert.False(JumpTableDetector.TryRecognize(
+            wrongMtctrOperand,
+            BuildIndex(wrongMtctrOperand),
+            baseAddr + 0x14,
+            baseAddr,
+            baseAddr + 0x100,
+            image,
+            out _));
+
+        var wrongLoadDest = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "cmplwi", new PpcOperand[] { new PpcRegisterOperand("r3", 3), new PpcImmediateOperand(0) }),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "lis", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(unchecked((short)0x8000)) }),
+            PpcInstruction.Synthetic(baseAddr + 0x08, 0, "addi", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(0x0100) }),
+            PpcInstruction.Synthetic(baseAddr + 0x0C, 0, "lbzx", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r3", 3) }),
+            PpcInstruction.Synthetic(baseAddr + 0x10, 0, "mtctr", new PpcOperand[] { new PpcRegisterOperand("r0", 0) }),
+            PpcInstruction.Synthetic(baseAddr + 0x14, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        };
+
+        Assert.False(JumpTableDetector.TryRecognize(
+            wrongLoadDest,
+            BuildIndex(wrongLoadDest),
+            baseAddr + 0x14,
+            baseAddr,
+            baseAddr + 0x100,
+            image,
+            out _));
+    }
+
+    [Fact]
+    public void RejectsWhenTableBaseOrUpperBoundCannotBeResolved()
+    {
+        const uint baseAddr = 0x80004000;
+        const uint tableAddr = 0x80004100;
+        var image = TranslatorCppTestHarness.CreateImage((tableAddr + 0x00, baseAddr + 0x20));
+
+        var unresolvedBase = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "cmplwi", new PpcOperand[] { new PpcRegisterOperand("r3", 3), new PpcImmediateOperand(0) }),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "addi", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r11", 11), new PpcImmediateOperand(0x0100) }),
+            PpcInstruction.Synthetic(baseAddr + 0x08, 0, "lwzx", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r3", 3) }),
+            PpcInstruction.Synthetic(baseAddr + 0x0C, 0, "mtctr", new PpcOperand[] { new PpcRegisterOperand("r0", 0) }),
+            PpcInstruction.Synthetic(baseAddr + 0x10, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        };
+
+        Assert.False(JumpTableDetector.TryRecognize(
+            unresolvedBase,
+            BuildIndex(unresolvedBase),
+            baseAddr + 0x10,
+            baseAddr,
+            baseAddr + 0x100,
+            image,
+            out _));
+
+        var oversizeBound = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "cmplwi", new PpcOperand[] { new PpcRegisterOperand("r3", 3), new PpcImmediateOperand(600) }),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "lis", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(unchecked((short)0x8000)) }),
+            PpcInstruction.Synthetic(baseAddr + 0x08, 0, "addi", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(0x0100) }),
+            PpcInstruction.Synthetic(baseAddr + 0x0C, 0, "lwzx", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r3", 3) }),
+            PpcInstruction.Synthetic(baseAddr + 0x10, 0, "mtctr", new PpcOperand[] { new PpcRegisterOperand("r0", 0) }),
+            PpcInstruction.Synthetic(baseAddr + 0x14, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        };
+
+        Assert.False(JumpTableDetector.TryRecognize(
+            oversizeBound,
+            BuildIndex(oversizeBound),
+            baseAddr + 0x14,
+            baseAddr,
+            baseAddr + 0x100,
+            image,
+            out _));
+    }
+
+    [Fact]
+    public void RejectsUnreadableAndOutOfWindowTargets()
+    {
+        const uint baseAddr = 0x80005000;
+        const uint tableAddr = 0x80005100;
+        var ordered = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(baseAddr + 0x00, 0, "cmplwi", new PpcOperand[] { new PpcRegisterOperand("r3", 3), new PpcImmediateOperand(1) }),
+            PpcInstruction.Synthetic(baseAddr + 0x04, 0, "lis", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(unchecked((short)0x8000)) }),
+            PpcInstruction.Synthetic(baseAddr + 0x08, 0, "addi", new PpcOperand[] { new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r12", 12), new PpcImmediateOperand(0x0100) }),
+            PpcInstruction.Synthetic(baseAddr + 0x0C, 0, "lwzx", new PpcOperand[] { new PpcRegisterOperand("r0", 0), new PpcRegisterOperand("r12", 12), new PpcRegisterOperand("r3", 3) }),
+            PpcInstruction.Synthetic(baseAddr + 0x10, 0, "mtctr", new PpcOperand[] { new PpcRegisterOperand("r0", 0) }),
+            PpcInstruction.Synthetic(baseAddr + 0x14, 0, "bctr", System.Array.Empty<PpcOperand>(), isReturn: false, isCall: false, isConditional: false),
+        };
+
+        var missingEntryImage = TranslatorCppTestHarness.CreateImage((tableAddr + 0x00, baseAddr + 0x20));
+        Assert.False(JumpTableDetector.TryRecognize(
+            ordered,
+            BuildIndex(ordered),
+            baseAddr + 0x14,
+            baseAddr,
+            baseAddr + 0x100,
+            missingEntryImage,
+            out _));
+
+        var outOfWindowImage = TranslatorCppTestHarness.CreateImage(
+            (tableAddr + 0x00, 0x90000000u),
+            (tableAddr + 0x04, baseAddr + 0x20));
+        Assert.False(JumpTableDetector.TryRecognize(
+            ordered,
+            BuildIndex(ordered),
+            baseAddr + 0x14,
+            baseAddr,
+            baseAddr + 0x100,
+            outOfWindowImage,
+            out _));
+    }
+}
diff --git a/translator/tests/Translator.Tests/KamekPulFileTests.cs b/translator/tests/Translator.Tests/KamekPulFileTests.cs
new file mode 100644
index 0000000..528b7bb
--- /dev/null
+++ b/translator/tests/Translator.Tests/KamekPulFileTests.cs
@@ -0,0 +1,151 @@
+using System.Buffers.Binary;
+using Translator.Core.Parsing.Kamek;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class KamekPulFileTests
+{
+    [Fact]
+    public void ParsesRawSingleChunk()
+    {
+        var chunk = BuildChunk(
+            bssSize: 0x20,
+            code: [0x60, 0x00, 0x00, 0x00],
+            commands:
+            [
+                BuildCommand(KamekCommandId.Write32, absolute: true, address: 0x805850BC, args: [0x60000000])
+            ]);
+
+        var pul = KamekPulFile.Parse(chunk);
+        var selected = pul.SelectRegion("P");
+
+        Assert.False(pul.IsCombined);
+        Assert.Single(pul.Chunks);
+        Assert.Equal(0x20u, selected.BssSize);
+        Assert.Equal(4u, selected.CodeSize);
+        Assert.Single(selected.Commands);
+        Assert.Equal(KamekCommandId.Write32, selected.Commands[0].Id);
+        Assert.True(selected.Commands[0].AddressIsAbsolute);
+        Assert.Equal(0x805850BCu, selected.Commands[0].Address);
+    }
+
+    [Fact]
+    public void ParsesCombinedChunksAndSelectsRegion()
+    {
+        var p = BuildChunk(0x10, [0x4E, 0x80, 0x00, 0x20], [BuildCommand(KamekCommandId.Branch, true, 0x8053369C, [0x100])]);
+        var e = BuildChunk(0x20, [0x60, 0x00, 0x00, 0x00], [BuildCommand(KamekCommandId.Write8, false, 0x10, [0x7F])]);
+        var combined = new byte[0x10 + p.Length + e.Length];
+        WriteU32(combined, 0, (uint)p.Length);
+        WriteU32(combined, 4, (uint)e.Length);
+        p.CopyTo(combined, 0x10);
+        e.CopyTo(combined, 0x10 + p.Length);
+
+        var pul = KamekPulFile.Parse(combined);
+
+        Assert.True(pul.IsCombined);
+        Assert.Equal(2, pul.Chunks.Count);
+        Assert.Equal(0x10u, pul.SelectRegion("P").BssSize);
+        Assert.Equal(0x20u, pul.SelectRegion("E").BssSize);
+    }
+
+    [Fact]
+    public void EncodesPpcBranchLikeKamek()
+    {
+        Assert.Equal(0x48000144u, KamekPpcEncoding.EncodeBranch(0x8053369C, 0x805337E0, link: false));
+        Assert.Equal(0x4BFFFFFDu, KamekPpcEncoding.EncodeBranch(0x8053369C, 0x80533698, link: true));
+        Assert.Throws<ArgumentOutOfRangeException>(() => KamekPpcEncoding.EncodeBranch(0x8053369C, 0x8053369D, link: false));
+    }
+
+    [Fact]
+    public void ParsesBundledRetroRewindCodePulWhenPresent()
+    {
+        var repoRoot = ProjectPathsForTests.FindRepositoryRoot();
+        var codePul = Path.Combine(repoRoot, "PulsarPacks", "completed", "RetroRewind", "RetroRewind6", "Binaries", "Code.pul");
+        if (!File.Exists(codePul))
+        {
+            return;
+        }
+
+        var pul = KamekPulFile.Load(codePul);
+        var chunk = pul.SelectRegion("P");
+
+        Assert.True(pul.IsCombined);
+        Assert.Equal(3, pul.Chunks.Count);
+        Assert.All(pul.CombinedChunkSizes.Take(3), size => Assert.True(size >= KamekChunk.HeaderSize));
+        Assert.Equal(0u, pul.CombinedChunkSizes[3]);
+        Assert.NotEmpty(chunk.CodeBlob);
+        Assert.True(chunk.BssSize > 0);
+        Assert.True(chunk.CtorStart <= chunk.CtorEnd);
+        Assert.True(chunk.CtorEnd <= chunk.CodeSize);
+        Assert.NotEmpty(chunk.Commands);
+        Assert.Equal(chunk.Commands.Count, chunk.RelativeCommandCount + chunk.AbsoluteCommandCount);
+        Assert.Equal(chunk.Commands.Count, chunk.CommandCounts.Values.Sum());
+    }
+
+    private static byte[] BuildChunk(uint bssSize, byte[] code, byte[][] commands)
+    {
+        var commandSize = commands.Sum(c => c.Length);
+        var chunkSize = KamekChunk.HeaderSize + code.Length + commandSize;
+        var data = new byte[chunkSize];
+        WriteU32(data, 0x00, KamekChunk.Magic0);
+        WriteU32(data, 0x04, KamekChunk.Magic1);
+        WriteU32(data, 0x08, bssSize);
+        WriteU32(data, 0x0C, (uint)code.Length);
+        WriteU32(data, 0x10, 0);
+        WriteU32(data, 0x14, 0);
+        WriteU32(data, 0x18, (uint)chunkSize);
+        code.CopyTo(data, KamekChunk.HeaderSize);
+
+        var offset = KamekChunk.HeaderSize + code.Length;
+        foreach (var command in commands)
+        {
+            command.CopyTo(data, offset);
+            offset += command.Length;
+        }
+
+        return data;
+    }
+
+    private static byte[] BuildCommand(KamekCommandId id, bool absolute, uint address, uint[] args)
+    {
+        var size = 4 + (absolute ? 4 : 0) + args.Length * 4;
+        var data = new byte[size];
+        var commandWord = ((uint)(byte)id << 24) | (absolute ? 0x00FFFFFEu : address);
+        WriteU32(data, 0, commandWord);
+        var offset = 4;
+        if (absolute)
+        {
+            WriteU32(data, offset, address);
+            offset += 4;
+        }
+        foreach (var arg in args)
+        {
+            WriteU32(data, offset, arg);
+            offset += 4;
+        }
+        return data;
+    }
+
+    private static void WriteU32(byte[] data, int offset, uint value) =>
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(offset, 4), value);
+}
+
+internal static class ProjectPathsForTests
+{
+    public static string FindRepositoryRoot()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null)
+        {
+            if (File.Exists(Path.Combine(dir.FullName, "translator", "Translator.sln")) &&
+                File.Exists(Path.Combine(dir.FullName, "projects", "mkwii", "recomp.yml")))
+            {
+                return dir.FullName;
+            }
+            dir = dir.Parent;
+        }
+
+        throw new DirectoryNotFoundException("Could not find repository root.");
+    }
+}
diff --git a/translator/tests/Translator.Tests/LeafFprStackElisionCodeGenTests.cs b/translator/tests/Translator.Tests/LeafFprStackElisionCodeGenTests.cs
new file mode 100644
index 0000000..9d64d7b
--- /dev/null
+++ b/translator/tests/Translator.Tests/LeafFprStackElisionCodeGenTests.cs
@@ -0,0 +1,71 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class LeafFprStackElisionCodeGenTests
+{
+    [Fact]
+    public void ProvenScalarAndPairedAbiSpillUsesNativeLocal()
+    {
+        var function = new IrFunction(
+            "leaf_fpr_abi_spill_elision",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBinary("r1", IrValue.Register("r1"), IrValue.Imm(-128), "add"),
+                    new IrStore(new IrAddress("r1", 112), IrValue.Register("f31"), 8),
+                    new IrBinary("save_ps1", IrValue.Register("r1"), IrValue.Imm(120), "add"),
+                    new IrCall(string.Empty, "PPC_PsqSt", new[]
+                    {
+                        IrValue.Register("save_ps1"), IrValue.Register("f31"), IrValue.Imm(0), IrValue.Imm(0)
+                    }),
+                    new IrCall("f31", "PPC_PsAdd", new[] { IrValue.Register("f1"), IrValue.Register("f2") }),
+                    new IrBinary("restore_ps1", IrValue.Register("r1"), IrValue.Imm(120), "add"),
+                    new IrCall("f31", "PPC_PsqL", new[]
+                    {
+                        IrValue.Register("restore_ps1"), IrValue.Imm(0), IrValue.Imm(0)
+                    }),
+                    new IrLoad("f31", new IrAddress("r1", 112), 8),
+                    new IrBinary("r1", IrValue.Register("r1"), IrValue.Imm(128), "add"),
+                    new IrReturn(null)
+                })
+            });
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r1"] = ValueRepresentation.UInt32,
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f31"] = ValueRepresentation.Float64,
+            ["save_ps1"] = ValueRepresentation.UInt32,
+            ["restore_ps1"] = ValueRepresentation.UInt32
+        });
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006221,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("leaf_fpr_abi_spill_elision", ValueRepresentation.Void),
+            types,
+            enableLeafAbiSpillElision: true);
+
+        Assert.Contains("double leaf_stack_saved_f31_entry", code, StringComparison.Ordinal);
+        Assert.Contains("leaf_stack_saved_f31_entry = f31.d;", code, StringComparison.Ordinal);
+        Assert.Contains("f31.d = leaf_stack_saved_f31_entry;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("WriteStackFloat64", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ReadStackFloat64", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_PsqSt", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_PsqL", code, StringComparison.Ordinal);
+        Assert.Contains(
+            "// RECOMP_REGISTRATION base 0x80006221 leaf_fpr_abi_spill_elision preserves=true fpr_mask=0x00000000",
+            code,
+            StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/LeafInliningTests.cs b/translator/tests/Translator.Tests/LeafInliningTests.cs
new file mode 100644
index 0000000..10b84c5
--- /dev/null
+++ b/translator/tests/Translator.Tests/LeafInliningTests.cs
@@ -0,0 +1,901 @@
+using System;
+using System.Buffers.Binary;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using Translator.Core.Ir;
+using Translator.Core.Loading;
+using Translator.Core.Translation;
+using Xunit;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// IR-level leaf inlining (performance audit T-INLINE). The splice happens before SSA, so every
+/// negative case is a silent-corruption bug if it starts firing; hence more rejection tests than positive ones.
+/// </summary>
+public class LeafInliningTests
+{
+    private const uint Caller = MemoryLayout.RamBase;
+    private const uint Callee = MemoryLayout.RamBase + 0x100;
+    private const uint Callee2 = MemoryLayout.RamBase + 0x180;
+    private const int ImageSize = 0x400;
+
+    // --- minimal PowerPC encoder -------------------------------------------
+
+    private static uint Blr() => 0x4E800020u;
+    private static uint Bl(uint from, uint to) => 0x48000001u | ((to - from) & 0x03FFFFFCu);
+    private static uint B(uint from, uint to) => 0x48000000u | ((to - from) & 0x03FFFFFCu);
+    private static uint Bne(uint from, uint to) => 0x40820000u | ((to - from) & 0xFFFCu);
+    private static uint Addi(int d, int a, int simm) =>
+        0x38000000u | ((uint)d << 21) | ((uint)a << 16) | (uint)(simm & 0xFFFF);
+    private static uint Lwz(int d, int a, int offset) =>
+        0x80000000u | ((uint)d << 21) | ((uint)a << 16) | (uint)(offset & 0xFFFF);
+    private static uint Stwu(int s, int a, int offset) =>
+        0x94000000u | ((uint)s << 21) | ((uint)a << 16) | (uint)(offset & 0xFFFF);
+    private static uint Add(int d, int a, int b) =>
+        0x7C000214u | ((uint)d << 21) | ((uint)a << 16) | ((uint)b << 11);
+    private static uint Cmpwi(int crf, int a, int simm) =>
+        0x2C000000u | ((uint)crf << 23) | ((uint)a << 16) | (uint)(simm & 0xFFFF);
+    private static uint Mflr(int d) => 0x7C0802A6u | ((uint)d << 21);
+    private static uint Bctrl() => 0x4E800421u;
+    private static uint Bctr() => 0x4E800420u;
+
+    private static ProgramImage BuildImage(params (uint Address, uint Word)[] words)
+    {
+        var memory = new byte[ImageSize];
+        foreach (var (address, word) in words)
+        {
+            BinaryPrimitives.WriteUInt32BigEndian(
+                memory.AsSpan((int)(address - MemoryLayout.RamBase), 4), word);
+        }
+
+        return new ProgramImage(
+            memory,
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, ImageSize),
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, ImageSize),
+            default,
+            "leaf-inlining");
+    }
+
+    private static TranslationOptions Options(
+        bool inlining = true,
+        IReadOnlySet<uint>? blocked = null,
+        int maxCalleeInstructions = 32,
+        int maxGrowthPercent = 50,
+        bool multiBlock = true) =>
+        TranslationOptions.Default with
+        {
+            AllowUnsupportedInstructions = true,
+            KnownFunctionEntryPoints = new HashSet<uint> { Caller, Callee, Callee2 },
+            EnableLeafInlining = inlining,
+            LeafInliningBlockedTargets = blocked,
+            LeafInliningMaxCalleeInstructions = maxCalleeInstructions,
+            LeafInliningMaxCallerGrowthPercent = maxGrowthPercent,
+            LeafInliningAllowMultiBlockCallees = multiBlock
+        };
+
+    private static FunctionTranslationResult Translate(
+        ProgramImage image, uint entryPoint, TranslationOptions options) =>
+        new FunctionTranslator(image).Translate(entryPoint, options);
+
+    /// <summary>Caller that calls the leaf once and returns.</summary>
+    private static (uint Address, uint Word)[] SimpleCaller(uint callee = Callee) =>
+    [
+        (Caller + 0, Addi(3, 3, 4)),
+        (Caller + 4, Bl(Caller + 4, callee)),
+        (Caller + 8, Addi(3, 3, 1)),
+        (Caller + 12, Blr())
+    ];
+
+    // --- positive cases -----------------------------------------------------
+
+    [Fact]
+    public void CalleeWritesLandInTheCallerAndTheCallDisappears()
+    {
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Lwz(3, 3, 8)),
+                (Callee + 4, Blr())
+            ]);
+
+        var inlined = Translate(image, Caller, Options());
+        var reference = Translate(image, Caller, Options(inlining: false));
+
+        Assert.Equal(1, inlined.Metrics.InlinedCallSites);
+        Assert.Equal(2, inlined.Metrics.InlinedGuestInstructions);
+        Assert.Equal(0, reference.Metrics.InlinedCallSites);
+        Assert.Contains("InvokeDirectCpu<0x80000100u>(ctx);", reference.CxxCode, StringComparison.Ordinal);
+        Assert.DoesNotContain("InvokeDirectCpu<0x80000100u>(ctx);", inlined.CxxCode);
+        // The callee's load is now a load of the caller's own r3.
+        Assert.Contains("MemoryInline::FlatRead32", inlined.CxxCode, StringComparison.Ordinal);
+        Assert.Contains("inline leaf 0x80000100", inlined.CxxCode, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ArgumentRegistersAreReadFromTheCallerStateAtTheCallPoint()
+    {
+        // The caller computes r3 = r3 + 4 immediately before the call, and the
+        // callee's first act is to consume r3. After the splice, the callee's
+        // read must see the +4 value without any context round trip.
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Add(3, 3, 4)),
+                (Callee + 4, Blr())
+            ]);
+
+        var result = Translate(image, Caller, Options());
+
+        Assert.Equal(1, result.Metrics.InlinedCallSites);
+        // Residency keeps r3 in a local across the splice, so there is no flush
+        // or reload of the guest register file where the call used to be.
+        Assert.DoesNotContain("InvokeDirectCpu<0x80000100u>(ctx);", result.CxxCode);
+        Assert.Contains("r3 = ", result.CxxCode, StringComparison.Ordinal);
+        var ir = result.LinearIr.Blocks.SelectMany(block => block.Instructions).ToArray();
+        Assert.DoesNotContain(ir, instruction => instruction is IrCall call && call.Target == "0x80000100");
+    }
+
+    [Fact]
+    public void ConditionRegisterWrittenInsideTheSpliceReachesTheCallersBranch()
+    {
+        // The callee sets CR0; the caller branches on it. Fusing the two across
+        // the splice is only possible because the compare became an ordinary
+        // instruction of the caller.
+        var image = BuildImage(
+            [
+                (Caller + 0, Bl(Caller + 0, Callee)),
+                (Caller + 4, Bne(Caller + 4, Caller + 12)),
+                (Caller + 8, Addi(3, 3, 1)),
+                (Caller + 12, Blr()),
+                (Callee + 0, Cmpwi(0, 4, 0)),
+                (Callee + 4, Blr())
+            ]);
+
+        var inlined = Translate(image, Caller, Options());
+        var reference = Translate(image, Caller, Options(inlining: false));
+
+        Assert.Equal(1, inlined.Metrics.InlinedCallSites);
+        // Without inlining the branch has to reload the architectural CR after
+        // the call because the producing compare lives in another function.
+        Assert.Contains("InvokeDirectCpu<0x80000100u>(ctx);", reference.CxxCode, StringComparison.Ordinal);
+        Assert.Equal(2, CountOccurrences(reference.CxxCode, "cr = ctx->cr;"));
+        // With inlining the compare writes the caller's resident CR directly and
+        // the branch reads it with no context round trip at all.
+        Assert.Contains(
+            "SetCRResident(cr, xer, 0, static_cast<int32_t>(r4), static_cast<int32_t>(0));",
+            inlined.CxxCode, StringComparison.Ordinal);
+        Assert.Equal(1, CountOccurrences(inlined.CxxCode, "cr = ctx->cr;"));
+    }
+
+    [Fact]
+    public void CompareInsideTheSpliceIsFusedIntoTheFollowingBranch()
+    {
+        // Both successors immediately overwrite CR0, which is what makes the
+        // spliced compare's only consumer the caller's branch.
+        var image = BuildImage(
+            [
+                (Caller + 0, Bl(Caller + 0, Callee)),
+                (Caller + 4, Bne(Caller + 4, Caller + 16)),
+                (Caller + 8, Cmpwi(0, 3, 0)),
+                (Caller + 12, Blr()),
+                (Caller + 16, Cmpwi(0, 5, 0)),
+                (Caller + 20, Blr()),
+                (Callee + 0, Cmpwi(0, 4, 7)),
+                (Callee + 4, Blr())
+            ]);
+
+        var code = Translate(image, Caller, Options()).CxxCode;
+
+        Assert.Contains(
+            "if ((static_cast<int32_t>(r4) != static_cast<int32_t>(7)))",
+            code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void TheLinkRegisterWriteOfAnInlinedCallIsNotEmitted()
+    {
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Addi(4, 4, 1)),
+                (Callee + 4, Blr())
+            ]);
+
+        var code = Translate(image, Caller, Options()).CxxCode;
+
+        Assert.DoesNotContain("ctx->lr = 0x80000008", code);
+        Assert.DoesNotContain("lr = 0x80000008u", code);
+    }
+
+    [Fact]
+    public void TheStandaloneCalleeBodyIsStillTranslatedOnItsOwn()
+    {
+        // Indirect dispatch, mod overrides and the registry all resolve the
+        // callee by address, so the splice must never be a replacement for it.
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Lwz(3, 3, 8)),
+                (Callee + 4, Blr())
+            ]);
+
+        var standalone = Translate(image, Callee, Options());
+
+        Assert.Contains("func_80000100", standalone.CxxCode, StringComparison.Ordinal);
+        Assert.Equal(0, standalone.Metrics.InlinedCallSites);
+    }
+
+    [Fact]
+    public void EveryCallSiteOfTheSameCalleeIsSplicedIndependently()
+    {
+        var image = BuildImage(
+            [
+                (Caller + 0, Bl(Caller + 0, Callee)),
+                (Caller + 4, Bl(Caller + 4, Callee)),
+                (Caller + 8, Blr()),
+                (Callee + 0, Lwz(3, 3, 8)),
+                (Callee + 4, Blr())
+            ]);
+
+        var result = Translate(image, Caller, Options());
+
+        Assert.Equal(2, result.Metrics.InlinedCallSites);
+        Assert.Equal(2, CountOccurrences(result.CxxCode, "inline leaf 0x80000100"));
+        Assert.DoesNotContain("InvokeDirectCpu<0x80000100u>(ctx);", result.CxxCode);
+    }
+
+    [Fact]
+    public void TailCallToALeafIsSplicedAheadOfTheCallersReturn()
+    {
+        var image = BuildImage(
+            [
+                (Caller + 0, Addi(3, 3, 4)),
+                (Caller + 4, B(Caller + 4, Callee)),
+                (Callee + 0, Lwz(3, 3, 8)),
+                (Callee + 4, Blr())
+            ]);
+
+        var result = Translate(image, Caller, Options());
+
+        Assert.Equal(1, result.Metrics.InlinedCallSites);
+        Assert.DoesNotContain("InvokeDirectCpu<0x80000100u>(ctx);", result.CxxCode);
+    }
+
+    // --- acyclic multi-block callees ----------------------------------------
+
+    /// <summary>Compare, branch, one arm, join - the shape of nw4r list walkers.</summary>
+    private static (uint Address, uint Word)[] DiamondCallee() =>
+    [
+        (Callee + 0, Cmpwi(0, 3, 0)),
+        (Callee + 4, Bne(Callee + 4, Callee + 12)),
+        (Callee + 8, Addi(3, 3, 1)),
+        (Callee + 12, Blr())
+    ];
+
+    [Fact]
+    public void AnAcyclicMultiBlockCalleeIsSplicedWithItsOwnControlFlow()
+    {
+        var image = BuildImage([.. SimpleCaller(), .. DiamondCallee()]);
+
+        var result = Translate(image, Caller, Options());
+
+        Assert.Equal(1, result.Metrics.InlinedCallSites);
+        Assert.Equal(4, result.Metrics.InlinedGuestInstructions);
+        Assert.DoesNotContain("InvokeDirectCpu<0x80000100u>(ctx);", result.CxxCode);
+        // The callee's blocks are now blocks of the caller, under call-site
+        // local labels, and the branch skips the arm exactly as it did inside
+        // the callee.
+        Assert.Contains("loc_inl0_0x80000100:", result.CxxCode, StringComparison.Ordinal);
+        Assert.Contains("loc_inl0_0x80000108:", result.CxxCode, StringComparison.Ordinal);
+        Assert.Contains("loc_inl0_0x8000010C:", result.CxxCode, StringComparison.Ordinal);
+        Assert.Contains("goto loc_inl0_0x8000010C;", result.CxxCode, StringComparison.Ordinal);
+        // The callee's return became the caller's continuation, which is where
+        // the code after the call site now lives.
+        Assert.Contains("loc_inl0_cont_80000100:", result.CxxCode, StringComparison.Ordinal);
+        Assert.Equal(
+            new IrJump("inl0_cont_80000100"),
+            Block(result, "inl0_0x8000010C").Instructions[^1]);
+        result.Ssa.ValidateUseDef();
+    }
+
+    [Fact]
+    public void TheCallersOwnCodeAroundAMultiBlockSpliceStillRuns()
+    {
+        // The call site sits in the middle of the caller's only block, so the
+        // splice has to cut that block in two and keep both halves wired up.
+        var image = BuildImage([.. SimpleCaller(), .. DiamondCallee()]);
+
+        var result = Translate(image, Caller, Options());
+        var labels = result.LinearIr.Blocks.Select(block => block.Label).ToArray();
+
+        // Entry block keeps its label, so the function still starts where the
+        // emitter's prologue jumps.
+        Assert.Equal("0x80000000", labels[0]);
+        Assert.Equal(result.LinearIr.EntryLabel, labels[0]);
+        Assert.Equal(labels.Length, labels.Distinct(StringComparer.OrdinalIgnoreCase).Count());
+        // Caller prefix, the callee's three blocks, then the continuation that
+        // carries everything the caller did after the call.
+        Assert.Equal(
+            [
+                "0x80000000",
+                "inl0_0x80000100",
+                "inl0_0x80000104",
+                "inl0_0x80000108",
+                "inl0_0x8000010C",
+                "inl0_cont_80000100"
+            ],
+            labels);
+        Assert.IsType<IrReturn>(result.LinearIr.Blocks[^1].Instructions[^1]);
+    }
+
+    [Fact]
+    public void EachMultiBlockCallSiteGetsItsOwnCopyOfTheCalleesLabels()
+    {
+        var image = BuildImage(
+            [
+                (Caller + 0, Bl(Caller + 0, Callee)),
+                (Caller + 4, Bl(Caller + 4, Callee)),
+                (Caller + 8, Blr()),
+                .. DiamondCallee()
+            ]);
+
+        var result = Translate(image, Caller, Options(maxGrowthPercent: 100_000));
+
+        Assert.Equal(2, result.Metrics.InlinedCallSites);
+        Assert.Contains("loc_inl0_cont_80000100:", result.CxxCode, StringComparison.Ordinal);
+        Assert.Contains("loc_inl1_cont_80000100:", result.CxxCode, StringComparison.Ordinal);
+        result.Ssa.ValidateUseDef();
+    }
+
+    [Fact]
+    public void SplicedLabelsCanNeverBeReadBackAsAGuestAddress()
+    {
+        // A `loc_XXXXXXXX` label is how the emitter reports an interior resume
+        // point of the caller. A spliced copy of the callee is not one, so its
+        // labels must not parse as an address.
+        var image = BuildImage([.. SimpleCaller(), .. DiamondCallee()]);
+
+        var result = Translate(image, Caller, Options());
+
+        var spliced = result.LinearIr.Blocks
+            .Select(block => block.Label)
+            .Where(label => label.StartsWith("inl", StringComparison.Ordinal))
+            .ToArray();
+        Assert.NotEmpty(spliced);
+        foreach (var label in spliced)
+        {
+            Assert.False(
+                uint.TryParse(label, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out _),
+                $"Spliced label '{label}' is readable as a guest address.");
+        }
+    }
+
+    [Fact]
+    public void ARaisedInstructionCapAdmitsALeafTheOldCapRefused()
+    {
+        // 45 arithmetic instructions plus the terminating blr: past the old cap
+        // of 32, inside the current one.
+        var words = new List<(uint, uint)>(SimpleCaller());
+        for (var index = 0; index < 45; index++)
+        {
+            words.Add((Callee + (uint)(index * 4), Addi(3, 3, 1)));
+        }
+
+        words.Add((Callee + 180, Blr()));
+        var image = BuildImage([.. words]);
+
+        Assert.Equal(56, TranslationOptions.Default.LeafInliningMaxCalleeInstructions);
+        Assert.Equal(
+            1,
+            Translate(image, Caller, Options(maxCalleeInstructions: 56, maxGrowthPercent: 100_000))
+                .Metrics.InlinedCallSites);
+        Assert.Equal(
+            0,
+            Translate(image, Caller, Options(maxCalleeInstructions: 32, maxGrowthPercent: 100_000))
+                .Metrics.InlinedCallSites);
+    }
+
+    // --- rejection cases ----------------------------------------------------
+
+    [Fact]
+    public void AMultiBlockCalleeIsRejectedWhenMultiBlockSplicingIsOff()
+    {
+        var image = BuildImage([.. SimpleCaller(), .. DiamondCallee()]);
+
+        Assert.Equal(0, Translate(image, Caller, Options(multiBlock: false)).Metrics.InlinedCallSites);
+        Assert.Equal(1, Translate(image, Caller, Options()).Metrics.InlinedCallSites);
+    }
+
+    [Fact]
+    public void ACalleeWithALoopIsRejected()
+    {
+        // The back edge to the entry makes this a loop, not a one-way region
+        // between the call point and its continuation.
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Addi(4, 4, -1)),
+                (Callee + 4, Cmpwi(0, 4, 0)),
+                (Callee + 8, Bne(Callee + 8, Callee + 0)),
+                (Callee + 12, Blr())
+            ]);
+
+        AssertNotInlined(image);
+    }
+
+    [Fact]
+    public void AMultiBlockCalleeThatTouchesTheLinkRegisterIsRejected()
+    {
+        // Reachable only on one arm, and still disqualifying: the call's own LR
+        // write is dropped, so the mflr would read the caller's incoming value.
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Cmpwi(0, 3, 0)),
+                (Callee + 4, Bne(Callee + 4, Callee + 12)),
+                (Callee + 8, Mflr(0)),
+                (Callee + 12, Blr())
+            ]);
+
+        AssertNotInlined(image);
+    }
+
+    [Fact]
+    public void AMultiBlockCalleeThatCallsAnotherFunctionIsRejected()
+    {
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Cmpwi(0, 3, 0)),
+                (Callee + 4, Bne(Callee + 4, Callee + 12)),
+                (Callee + 8, Bl(Callee + 8, Callee2)),
+                (Callee + 12, Blr()),
+                (Callee2 + 0, Addi(3, 3, 1)),
+                (Callee2 + 4, Blr())
+            ]);
+
+        AssertNotInlined(image);
+    }
+
+    [Fact]
+    public void AMultiBlockCalleeIsStillSubjectToTheBlockList()
+    {
+        var image = BuildImage([.. SimpleCaller(), .. DiamondCallee()]);
+
+        // A patch site on the callee's second block is still a patch site.
+        Assert.Equal(
+            0,
+            Translate(image, Caller, Options(blocked: new HashSet<uint> { Callee + 8 })).Metrics.InlinedCallSites);
+    }
+
+    [Fact]
+    public void AdmittingMultiBlockCalleesCannotChangeACallerThatHasNone()
+    {
+        // The invariant the whole transform rests on: a caller whose admitted
+        // set does not change must emit byte-identical text.
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Lwz(3, 3, 8)),
+                (Callee + 4, Blr())
+            ]);
+
+        var withMultiBlock = Translate(image, Caller, Options());
+        var withoutMultiBlock = Translate(image, Caller, Options(multiBlock: false));
+        var atTheOldCap = Translate(image, Caller, Options(maxCalleeInstructions: 32));
+        var atTheNewCap = Translate(image, Caller, Options(maxCalleeInstructions: 56));
+
+        Assert.Equal(1, withMultiBlock.Metrics.InlinedCallSites);
+        Assert.Equal(withoutMultiBlock.CxxCode, withMultiBlock.CxxCode);
+        Assert.Equal(atTheOldCap.CxxCode, atTheNewCap.CxxCode);
+    }
+
+    [Fact]
+    public void InliningIsOffUnlessRequested()
+    {
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Lwz(3, 3, 8)),
+                (Callee + 4, Blr())
+            ]);
+
+        var result = Translate(image, Caller, Options(inlining: false));
+
+        Assert.Equal(0, result.Metrics.InlinedCallSites);
+        Assert.Contains("InvokeDirectCpu<0x80000100u>(ctx);", result.CxxCode, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ACalleeThatCallsAnotherFunctionIsRejected()
+    {
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Bl(Callee + 0, Callee2)),
+                (Callee + 4, Blr()),
+                (Callee2 + 0, Addi(3, 3, 1)),
+                (Callee2 + 4, Blr())
+            ]);
+
+        AssertNotInlined(image);
+    }
+
+    [Fact]
+    public void ACalleeWithAnIndirectCallIsRejected()
+    {
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Bctrl()),
+                (Callee + 4, Blr())
+            ]);
+
+        AssertNotInlined(image);
+    }
+
+    [Fact]
+    public void ACalleeWithAnIndirectBranchIsRejected()
+    {
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Bctr())
+            ]);
+
+        AssertNotInlined(image);
+    }
+
+    [Fact]
+    public void ACalleeThatTouchesTheLinkRegisterIsRejected()
+    {
+        // The call's own LR write is dropped, so a callee that observes LR
+        // would read the caller's incoming value instead of a return address.
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Mflr(0)),
+                (Callee + 4, Blr())
+            ]);
+
+        AssertNotInlined(image);
+    }
+
+    [Fact]
+    public void ACalleeThatCreatesAStackFrameIsRejected()
+    {
+        // Splicing a second r1 epoch into the caller invalidates the stack
+        // aliasing model used after inlining, even when the callee restores r1.
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Stwu(1, 1, -16)),
+                (Callee + 4, Addi(3, 3, 1)),
+                (Callee + 8, Addi(1, 1, 16)),
+                (Callee + 12, Blr())
+            ]);
+
+        AssertNotInlined(image);
+    }
+
+    [Fact]
+    public void AnOversizedCalleeIsRejected()
+    {
+        var body = new List<(uint, uint)>(SimpleCaller());
+        for (var index = 0; index < 8; index++)
+        {
+            body.Add((Callee + (uint)(index * 4), Addi(3, 3, 1)));
+        }
+        body.Add((Callee + 32, Blr()));
+
+        var image = BuildImage([.. body]);
+
+        Assert.Equal(1, Translate(image, Caller, Options(maxCalleeInstructions: 16)).Metrics.InlinedCallSites);
+        Assert.Equal(0, Translate(image, Caller, Options(maxCalleeInstructions: 4)).Metrics.InlinedCallSites);
+    }
+
+    [Fact]
+    public void ABlockedAddressAnywhereInsideTheCalleeIsRejected()
+    {
+        // A native registration or mod patch inside the decoded body means the
+        // runtime winner is not these bytes.
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Lwz(3, 3, 8)),
+                (Callee + 4, Addi(3, 3, 1)),
+                (Callee + 8, Blr())
+            ]);
+
+        Assert.Equal(
+            0,
+            Translate(image, Caller, Options(blocked: new HashSet<uint> { Callee })).Metrics.InlinedCallSites);
+        Assert.Equal(
+            0,
+            Translate(image, Caller, Options(blocked: new HashSet<uint> { Callee + 4 })).Metrics.InlinedCallSites);
+        Assert.Equal(1, Translate(image, Caller, Options()).Metrics.InlinedCallSites);
+    }
+
+    [Fact]
+    public void GrowthBudgetStopsInliningOnceTheCallerWouldBalloon()
+    {
+        var words = new List<(uint, uint)>
+        {
+            (Caller + 0, Bl(Caller + 0, Callee)),
+            (Caller + 4, Bl(Caller + 4, Callee)),
+            (Caller + 8, Bl(Caller + 8, Callee)),
+            (Caller + 12, Blr())
+        };
+        for (var index = 0; index < 12; index++)
+        {
+            words.Add((Callee + (uint)(index * 4), Addi(3, 3, 1)));
+        }
+        words.Add((Callee + 48, Blr()));
+
+        var image = BuildImage([.. words]);
+
+        var generous = Translate(image, Caller, Options(maxGrowthPercent: 100_000)).Metrics.InlinedCallSites;
+        var stingy = Translate(image, Caller, Options(maxGrowthPercent: 0)).Metrics.InlinedCallSites;
+
+        Assert.Equal(3, generous);
+        Assert.InRange(stingy, 0, 2);
+    }
+
+    [Fact]
+    public void ContinuationDispatchDisablesInliningForTheWholeCaller()
+    {
+        // Non-returning and continuation call sites place labels keyed by guest
+        // instruction address inside the emitted body; a duplicated guest
+        // instruction stream cannot coexist with that.
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Lwz(3, 3, 8)),
+                (Callee + 4, Blr())
+            ]);
+
+        var options = Options() with
+        {
+            LrContinuationCallTargets = new HashSet<uint> { Callee2 }
+        };
+
+        Assert.Equal(0, Translate(image, Caller, options).Metrics.InlinedCallSites);
+    }
+
+    [Fact]
+    public void ModuleTranslationsAreNeverInlined()
+    {
+        var image = BuildImage(
+            [
+                .. SimpleCaller(),
+                (Callee + 0, Lwz(3, 3, 8)),
+                (Callee + 4, Blr())
+            ]);
+
+        var options = Options() with
+        {
+            ModuleLinkBase = 0x80800000u,
+            ModuleGuestBase = 0x80900000u,
+            ModuleLinkedCodeSize = 0x1000
+        };
+
+        Assert.Equal(0, Translate(image, Caller, options).Metrics.InlinedCallSites);
+    }
+
+    [Fact]
+    public void ASelfRecursiveCallIsNeverInlined()
+    {
+        var image = BuildImage(
+            [
+                (Caller + 0, Bl(Caller + 0, Caller)),
+                (Caller + 4, Blr())
+            ]);
+
+        Assert.Equal(0, Translate(image, Caller, Options()).Metrics.InlinedCallSites);
+    }
+
+    // --- classifier unit tests ---------------------------------------------
+
+    [Fact]
+    public void CandidateClassifierReportsWhyACalleeWasRefused()
+    {
+        var policy = new LeafInliningPolicy();
+
+        LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            new IrFunction("two_blocks", "a",
+            [
+                new IrBasicBlock("a", [new IrJump("b")]),
+                new IrBasicBlock("b", [new IrReturn(null)])
+            ]),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var jumpBetweenBlocks);
+        Assert.Equal(LeafInlineRejection.ControlFlow, jumpBetweenBlocks);
+
+        LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            new IrFunction("many_blocks", "a",
+            [
+                new IrBasicBlock("a", []),
+                new IrBasicBlock("b", []),
+                new IrBasicBlock("c", []),
+                new IrBasicBlock("d", []),
+                new IrBasicBlock("e", [new IrReturn(null)])
+            ]),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var multiBlock);
+        Assert.Equal(LeafInlineRejection.MultipleBlocks, multiBlock);
+
+        LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            Single(new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()), new IrReturn(null)),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var guestCall);
+        Assert.Equal(LeafInlineRejection.GuestCall, guestCall);
+
+        LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            Single(new IrCall(string.Empty, "OSSystemCall", Array.Empty<IrValue>()), new IrReturn(null)),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var fence);
+        Assert.Equal(LeafInlineRejection.OpaqueHelper, fence);
+
+        LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            Single(new IrAssign("r0", IrValue.Register("lr")), new IrReturn(null)),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var link);
+        Assert.Equal(LeafInlineRejection.TouchesLinkRegister, link);
+
+        LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            Single(new IrAssign("r1", IrValue.Imm(0)), new IrReturn(null)),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var stackPointer);
+        Assert.Equal(LeafInlineRejection.TouchesStackPointer, stackPointer);
+
+        LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            Single(new IrAssign("r3", IrValue.Imm(1))),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var noReturn);
+        Assert.Equal(LeafInlineRejection.NoTerminatingReturn, noReturn);
+
+        var accepted = LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            Single(
+                new IrTracePpc(0x80000100u, "addi r3,r3,1", "0x38630001"),
+                new IrAssign("r3", IrValue.Imm(1)),
+                new IrReturn(null)),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var none);
+        Assert.Equal(LeafInlineRejection.None, none);
+        Assert.NotNull(accepted);
+        Assert.Equal(1, accepted!.GuestInstructionCount);
+        // The terminating return became a fall-through.
+        Assert.DoesNotContain(accepted.Body, instruction => instruction is IrReturn);
+    }
+
+    [Fact]
+    public void CandidateClassifierAdmitsAnAcyclicRegionAndRefusesALoop()
+    {
+        var policy = new LeafInliningPolicy();
+
+        // if (cr0) goto join; arm; join: return
+        var diamond = LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            new IrFunction("diamond", "0x80000100",
+            [
+                new IrBasicBlock("0x80000100",
+                [
+                    new IrTracePpc(0x80000100u, "cmpwi r3,0", "0x2C030000"),
+                    new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                    new IrTracePpc(0x80000104u, "bne 0x8000010C", "0x40820008"),
+                    new IrBranch("ne", "0x8000010C", "0x80000108")
+                ]),
+                new IrBasicBlock("0x80000108",
+                [
+                    new IrTracePpc(0x80000108u, "addi r3,r3,1", "0x38630001"),
+                    new IrAssign("r3", IrValue.Imm(1))
+                ]),
+                new IrBasicBlock("0x8000010C",
+                [
+                    new IrTracePpc(0x8000010Cu, "blr", "0x4E800020"),
+                    new IrReturn(null)
+                ])
+            ]),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var acyclic);
+        Assert.Equal(LeafInlineRejection.None, acyclic);
+        Assert.NotNull(diamond);
+        Assert.Equal(4, diamond!.GuestInstructionCount);
+        Assert.Empty(diamond.Body);
+        Assert.NotNull(diamond.Blocks);
+        Assert.Equal(3, diamond.Blocks!.Count);
+        // The arm's implicit fall-through onto the join is materialized, so the
+        // splice does not depend on where the caller places these blocks.
+        Assert.Equal(new IrJump("0x8000010C"), diamond.Blocks[1].Instructions[^1]);
+
+        // Same shape, but the branch goes back to the entry.
+        LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            new IrFunction("loop", "0x80000100",
+            [
+                new IrBasicBlock("0x80000100",
+                [
+                    new IrTracePpc(0x80000100u, "cmpwi r3,0", "0x2C030000"),
+                    new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                    new IrTracePpc(0x80000104u, "bne 0x80000100", "0x4082FFFC"),
+                    new IrBranch("ne", "0x80000100", "0x80000108")
+                ]),
+                new IrBasicBlock("0x80000108",
+                [
+                    new IrTracePpc(0x80000108u, "blr", "0x4E800020"),
+                    new IrReturn(null)
+                ])
+            ]),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy,
+            out var cyclic);
+        Assert.Equal(LeafInlineRejection.CyclicControlFlow, cyclic);
+
+        // Turning the shape off restores the straight-line-only verdict.
+        LeafFunctionInliner.TryCreateCandidate(
+            0x80000100u,
+            new IrFunction("diamond", "0x80000100",
+            [
+                new IrBasicBlock("0x80000100",
+                [
+                    new IrTracePpc(0x80000100u, "b 0x80000104", "0x48000004"),
+                    new IrJump("0x80000104")
+                ]),
+                new IrBasicBlock("0x80000104",
+                [
+                    new IrTracePpc(0x80000104u, "blr", "0x4E800020"),
+                    new IrReturn(null)
+                ])
+            ]),
+            Array.Empty<Translator.Core.Disassembly.PpcInstruction>(),
+            policy with { AllowAcyclicMultiBlockCallees = false },
+            out var disabled);
+        Assert.Equal(LeafInlineRejection.ControlFlow, disabled);
+    }
+
+    private static IrFunction Single(params IrInstruction[] instructions) =>
+        new("leaf", "entry", [new IrBasicBlock("entry", instructions)]);
+
+    private static IrBasicBlock Block(FunctionTranslationResult result, string label) =>
+        result.LinearIr.Blocks.Single(
+            block => string.Equals(block.Label, label, StringComparison.Ordinal));
+
+    private static void AssertNotInlined(ProgramImage image)
+    {
+        var result = Translate(image, Caller, Options());
+        Assert.Equal(0, result.Metrics.InlinedCallSites);
+        Assert.Contains("InvokeDirectCpu<0x80000100u>(ctx);", result.CxxCode, StringComparison.Ordinal);
+    }
+
+    private static int CountOccurrences(string haystack, string needle)
+    {
+        var count = 0;
+        var index = haystack.IndexOf(needle, StringComparison.Ordinal);
+        while (index >= 0)
+        {
+            count++;
+            index = haystack.IndexOf(needle, index + needle.Length, StringComparison.Ordinal);
+        }
+
+        return count;
+    }
+}
diff --git a/translator/tests/Translator.Tests/LeafRegisterCacheCodeGenTests.cs b/translator/tests/Translator.Tests/LeafRegisterCacheCodeGenTests.cs
new file mode 100644
index 0000000..dc89173
--- /dev/null
+++ b/translator/tests/Translator.Tests/LeafRegisterCacheCodeGenTests.cs
@@ -0,0 +1,100 @@
+using System.Collections.Generic;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class LeafRegisterCacheCodeGenTests
+{
+    // Text-rewritten "cached_*" locals survive only for the state-free clone.
+    // Register residency owns every primary body and achieves the same property
+    // (a CR access promoted once to a local, reused for every subsequent
+    // read/write in the function) directly at emission time, under its own
+    // plain-named locals - so that is what these tests exercise.
+    private static string Emit(IrFunction function, RepresentationEnvironment types, uint entryPoint) =>
+        new CxxLinearCodeGenerator().Emit(
+            entryPoint,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification(function.Name, ValueRepresentation.Void),
+            types);
+
+    [Fact]
+    public void LeafCachedConditionRegisterBitReadUsesTheResidentHelper()
+    {
+        // PpcLifter builds the general bc/bcctr condition as raw C++ text
+        // containing GetCRBit(ctx, field, bit). When the leaf register cache owns
+        // CR, that read has to move onto the local as well: otherwise the branch
+        // observes the stale architectural CR while SetCRResident is updating
+        // cached_cr, which is a live miscompile in shipped shards.
+        var function = new IrFunction(
+            "leaf_cached_cr_bit",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrSetCrField(0, IrValue.Register("r3"), IrValue.Register("r4"), false),
+                    new IrBranch("raw", "taken", "exit", "((true) && ((GetCRBit(ctx, 0, 0) == true)))")
+                }),
+                new IrBasicBlock("taken", new IrInstruction[]
+                {
+                    new IrBinary("r3", IrValue.Register("r3"), IrValue.Imm(1), "add"),
+                    new IrReturn(null)
+                }),
+                new IrBasicBlock("exit", new IrInstruction[] { new IrReturn(null) })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.UInt32,
+            ["r4"] = ValueRepresentation.UInt32
+        });
+
+        var code = Emit(function, types, 0x8000622Au);
+
+        Assert.Contains("uint32_t cr = ctx->cr;", code, StringComparison.Ordinal);
+        Assert.Contains("SetCRResident(cr, xer, 0,", code, StringComparison.Ordinal);
+        Assert.Contains("GetCRBitResident(cr, 0, 0)", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("GetCRBit(ctx,", code, StringComparison.Ordinal);
+        Assert.Contains("    ctx->cr = cr;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LeafCachedConditionRegisterBitReadWithoutAnyCrWriteStillLocalizesTheRead()
+    {
+        // A body whose only CR access is the raw condition read must declare the
+        // local, use it, and not write CR back: cached_cr is a pure copy there.
+        var function = new IrFunction(
+            "leaf_cached_cr_bit_read_only",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBranch("raw", "taken", "exit", "((true) && ((GetCRBit(ctx, 1, 2) == true)))")
+                }),
+                new IrBasicBlock("taken", new IrInstruction[]
+                {
+                    new IrBinary("r3", IrValue.Register("r3"), IrValue.Imm(1), "add"),
+                    new IrReturn(null)
+                }),
+                new IrBasicBlock("exit", new IrInstruction[] { new IrReturn(null) })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r3"] = ValueRepresentation.UInt32
+        });
+
+        var code = Emit(function, types, 0x8000622Cu);
+
+        Assert.Contains("uint32_t cr = ctx->cr;", code, StringComparison.Ordinal);
+        Assert.Contains("GetCRBitResident(cr, 1, 2)", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("GetCRBit(ctx,", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->cr = cr;", code, StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/LifterTests.cs b/translator/tests/Translator.Tests/LifterTests.cs
new file mode 100644
index 0000000..ca709fd
--- /dev/null
+++ b/translator/tests/Translator.Tests/LifterTests.cs
@@ -0,0 +1,30 @@
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+using Translator.Core.Lifting;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class LifterTests
+{
+    [Fact]
+    public void LiftsSimpleBlock()
+    {
+        // Synthetic block: li r3,5; mr r4,r3; blr
+        var instructions = new List<PpcInstruction>
+        {
+            PpcInstruction.Synthetic(0x80000000, 0x38600005, "li", new PpcOperand[] { new PpcRegisterOperand("r3", 3), new PpcImmediateOperand(5) }),
+            PpcInstruction.Synthetic(0x80000004, 0x7C832378, "mr", new PpcOperand[] { new PpcRegisterOperand("r4", 4), new PpcRegisterOperand("r3", 3), new PpcRegisterOperand("r3", 3) }),
+            PpcInstruction.Synthetic(0x80000008, 0x4E800020, "blr", Array.Empty<PpcOperand>())
+        };
+
+        var lifter = new PpcLifter();
+        var lifted = lifter.Lift(instructions);
+        Assert.Equal(instructions, lifted.Select(item => item.Origin));
+        Assert.IsType<IrAssign>(lifted[0].Ir.First());
+        Assert.IsType<IrAssign>(lifted[1].Ir.First());
+        Assert.IsType<IrReturn>(lifted[2].Ir.Single());
+    }
+}
diff --git a/translator/tests/Translator.Tests/LocalCodeGenOptimizationTests.cs b/translator/tests/Translator.Tests/LocalCodeGenOptimizationTests.cs
new file mode 100644
index 0000000..04fd20e
--- /dev/null
+++ b/translator/tests/Translator.Tests/LocalCodeGenOptimizationTests.cs
@@ -0,0 +1,145 @@
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+
+namespace Translator.Tests;
+
+public sealed class LocalCodeGenOptimizationTests
+{
+    [Fact]
+    public void DeadPureLocalAssignmentsAreRemovedButMemoryReadsRemainObservable()
+    {
+        var function = new IrFunction("dead_pure_locals", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("dead0", IrValue.Imm(7)),
+                new IrBinary("dead1", IrValue.Register("dead0"), IrValue.Imm(5), "add"),
+                new IrLoad("dead_load", new IrAddress("r3", 0), 4),
+                new IrReturn(null)
+            })
+        });
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["dead0"] = ValueRepresentation.UInt32,
+            ["dead1"] = ValueRepresentation.UInt32,
+            ["dead_load"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32
+        });
+
+        var code = Emit(function, types, 0x80008010);
+
+        Assert.DoesNotContain("dead0", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("dead1", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatRead32(r3)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FctiwLowWordLoadUsesNativeExtractionAndElidesPrivateStackStore()
+    {
+        var function = FctiwFunction(includeGuestCallAfterLoad: false);
+        var code = Emit(function, FctiwTypes(), 0x80008014);
+
+        Assert.Contains("PPC_FprLowWordInline(f0.d)", code, StringComparison.Ordinal);
+        Assert.Contains("r3 = fctiwzword0;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("MemoryInline::FlatWriteFloat64((r1 + -16)", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("MemoryInline::FlatRead32((r1 + -12))", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FctiwPrivateStackStoreRemainsVisibleAcrossGuestCall()
+    {
+        var function = FctiwFunction(includeGuestCallAfterLoad: true);
+        var code = Emit(function, FctiwTypes(), 0x80008018);
+
+        Assert.Contains("PPC_FprLowWordInline(f0.d)", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteRamFloat64((r1 + -16)", code, StringComparison.Ordinal);
+        Assert.Contains("InvokeDirectCpu<0x80001234u>(ctx);", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void OverwrittenPairedStackRestoreIsRemoved()
+    {
+        var function = PairedRestoreFunction(usePairedValue: false);
+        var code = Emit(function, PairedRestoreTypes(), 0x8000801C);
+
+        Assert.DoesNotContain("PPC_PsqL", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("tmp_psq_load", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatReadFloat64((r1 + 112))", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PairedStackRestoreIsKeptWhenConsumedBeforeScalarRestore()
+    {
+        var function = PairedRestoreFunction(usePairedValue: true);
+        var code = Emit(function, PairedRestoreTypes(), 0x80008020);
+
+        Assert.Contains("PPC_PsqLStackInline<0u, 0u>", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::FlatWriteRamFloat64((r1 + 40), f31.d)", code, StringComparison.Ordinal);
+    }
+
+    private static IrFunction FctiwFunction(bool includeGuestCallAfterLoad)
+    {
+        var instructions = new List<IrInstruction>
+        {
+            new IrBinary("f0", IrValue.Register("f1"), IrValue.Imm(0), "fctiwz"),
+            new IrStore(new IrAddress("r1", -16), IrValue.Register("f0"), 8),
+            new IrLoad("r3", new IrAddress("r1", -12), 4)
+        };
+        if (includeGuestCallAfterLoad)
+            instructions.Add(new IrCall(string.Empty, "func_80001234", Array.Empty<IrValue>()));
+        instructions.Add(new IrReturn(null));
+        return new IrFunction("fctiw_stack", "entry", new[]
+        {
+            new IrBasicBlock("entry", instructions)
+        });
+    }
+
+    private static RepresentationEnvironment FctiwTypes() => new(new Dictionary<string, ValueRepresentation>
+    {
+        ["r1"] = ValueRepresentation.UInt32,
+        ["r3"] = ValueRepresentation.UInt32,
+        ["f0"] = ValueRepresentation.Float64,
+        ["f1"] = ValueRepresentation.Float64
+    });
+
+    private static IrFunction PairedRestoreFunction(bool usePairedValue)
+    {
+        var instructions = new List<IrInstruction>
+        {
+            new IrBinary("tmp_psq_load", IrValue.Register("r1"), IrValue.Imm(120), "add"),
+            new IrCall("f31", "PPC_PsqL", new[]
+            {
+                IrValue.Register("tmp_psq_load"), IrValue.Imm(0), IrValue.Imm(0)
+            })
+        };
+        if (usePairedValue)
+            instructions.Add(new IrStore(new IrAddress("r1", 40), IrValue.Register("f31"), 8));
+        instructions.Add(new IrLoad("f31", new IrAddress("r1", 112), 8));
+        instructions.Add(new IrReturn(null));
+        return new IrFunction("paired_stack_restore", "entry", new[]
+        {
+            new IrBasicBlock("entry", instructions)
+        });
+    }
+
+    private static RepresentationEnvironment PairedRestoreTypes() => new(new Dictionary<string, ValueRepresentation>
+    {
+        ["r1"] = ValueRepresentation.UInt32,
+        ["f31"] = ValueRepresentation.Float64,
+        ["tmp_psq_load"] = ValueRepresentation.UInt32
+    });
+
+    private static string Emit(
+        IrFunction function,
+        RepresentationEnvironment types,
+        uint address)
+    {
+        var ssa = new SsaTransformer().Convert(function);
+        var signature = new FunctionAbiClassification(function.Name, ValueRepresentation.Void);
+        return new CxxLinearCodeGenerator().Emit(address, ssa, signature, types);
+    }
+}
diff --git a/translator/tests/Translator.Tests/ModDataPatchWriterTests.cs b/translator/tests/Translator.Tests/ModDataPatchWriterTests.cs
new file mode 100644
index 0000000..bc7d2a6
--- /dev/null
+++ b/translator/tests/Translator.Tests/ModDataPatchWriterTests.cs
@@ -0,0 +1,151 @@
+using Translator.Core.Mods;
+
+namespace Translator.Tests;
+
+public sealed class ModDataPatchWriterTests
+{
+    [Fact]
+    public void WriteEmitsBinaryBlobsAndStableAssemblyWithoutHexArrays()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkw-mod-data-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var cppPath = Path.Combine(root, "cpp", "mod_data_patches.cpp");
+            var moduleImage = Enumerable.Range(0, 257).Select(i => (byte)(i * 37)).ToArray();
+            var digest = Enumerable.Range(0, 20).Select(i => (byte)(0xA0 + i)).ToArray();
+
+            Write(cppPath, moduleImage, digest);
+
+            var blobRoot = Path.Combine(root, "cpp", "mod_data_patches_blobs");
+            Assert.Equal(moduleImage, File.ReadAllBytes(Path.Combine(blobRoot, "module_image.bin")));
+            Assert.Equal(digest, File.ReadAllBytes(Path.Combine(blobRoot, "kamek_code_sha1.bin")));
+
+            var cpp = File.ReadAllText(cppPath);
+            Assert.Contains("extern const uint8_t kModuleImage[];", cpp, StringComparison.Ordinal);
+            Assert.Contains("Memory::GetPointer(kModuleGuestBase, kModuleImageSize), kModuleImage, kModuleImageSize", cpp, StringComparison.Ordinal);
+            Assert.DoesNotContain("alignas(16) const uint8_t", cpp, StringComparison.Ordinal);
+            Assert.DoesNotContain("0x00, 0x25,", cpp, StringComparison.Ordinal);
+
+            var assemblyPath = Path.Combine(root, "cpp", "mod_data_patches_blobs.S");
+            var assembly = File.ReadAllText(assemblyPath);
+            Assert.Contains(".globl kModuleImage", assembly, StringComparison.Ordinal);
+            Assert.Contains(".globl kKamekCodeSha1Digest", assembly, StringComparison.Ordinal);
+            Assert.Contains(".incbin", assembly, StringComparison.Ordinal);
+
+            var timestamps = new[] { cppPath, assemblyPath }
+                .Concat(Directory.GetFiles(blobRoot, "*.bin"))
+                .ToDictionary(path => path, File.GetLastWriteTimeUtc);
+            Write(cppPath, moduleImage, digest);
+            foreach (var (path, timestamp) in timestamps)
+            {
+                Assert.Equal(timestamp, File.GetLastWriteTimeUtc(path));
+            }
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+            {
+                Directory.Delete(root, recursive: true);
+            }
+        }
+    }
+
+    [Fact]
+    public void WritePrunesOptionalDigestWhenItDisappears()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkw-mod-data-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var cppPath = Path.Combine(root, "mod_data_patches.cpp");
+            Write(cppPath, [1, 2, 3, 4], new byte[20]);
+            Write(cppPath, [1, 2, 3, 4], null);
+
+            var blobRoot = Path.Combine(root, "mod_data_patches_blobs");
+            Assert.Equal(["module_image.bin"], Directory.GetFiles(blobRoot, "*.bin").Select(Path.GetFileName).ToArray());
+            var assembly = File.ReadAllText(Path.Combine(root, "mod_data_patches_blobs.S"));
+            Assert.DoesNotContain("kKamekCodeSha1Digest", assembly, StringComparison.Ordinal);
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+            {
+                Directory.Delete(root, recursive: true);
+            }
+        }
+    }
+
+    [Fact]
+    public void WriteCanReferencePublishedBlobsFromTransactionalStaging()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkw-mod-data-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var stagingCpp = Path.Combine(root, ".staging", "cpp", "mod_data_patches.cpp");
+            var publishedBlobs = Path.Combine(root, "published", "cpp", "mod_data_patches_blobs");
+            Write(stagingCpp, [1, 2, 3, 4], null, publishedBlobDirectory: publishedBlobs);
+
+            var assembly = File.ReadAllText(Path.Combine(root, ".staging", "cpp", "mod_data_patches_blobs.S"));
+            var expected = Path.GetFullPath(Path.Combine(publishedBlobs, "module_image.bin")).Replace('\\', '/');
+            Assert.Contains($".incbin \"{expected}\"", assembly, StringComparison.Ordinal);
+            Assert.DoesNotContain(".staging", assembly, StringComparison.OrdinalIgnoreCase);
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+            {
+                Directory.Delete(root, recursive: true);
+            }
+        }
+    }
+
+    [Fact]
+    public void WriteChangesAssemblyWhenSameSizeBlobContentChanges()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "mkw-mod-data-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var cppPath = Path.Combine(root, "mod_data_patches.cpp");
+            Write(cppPath, [1, 2, 3, 4], null);
+            var assemblyPath = Path.Combine(root, "mod_data_patches_blobs.S");
+            var before = File.ReadAllText(assemblyPath);
+
+            Write(cppPath, [1, 2, 3, 5], null);
+            var after = File.ReadAllText(assemblyPath);
+
+            Assert.NotEqual(before, after);
+            Assert.Contains("sha256=", after, StringComparison.Ordinal);
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+            {
+                Directory.Delete(root, recursive: true);
+            }
+        }
+    }
+
+    private static void Write(
+        string path,
+        byte[] moduleImage,
+        byte[]? digest,
+        string? publishedBlobDirectory = null)
+    {
+        var plan = new KamekPatchPlan { ModuleGuestBase = 0x81700000u, Classifications = [] };
+        var manifest = new BaseManifest("test", 1, "RMCP01", "P", "hash", 0, [], [], "ranges.json");
+        ModDataPatchWriter.Write(
+            path,
+            plan,
+            0x803992E0u,
+            manifest,
+            [],
+            moduleImage,
+            digest,
+            null,
+            (uint)moduleImage.Length,
+            0x40u,
+            0x81700000u,
+            0x81700000u,
+            false,
+            publishedBlobDirectory: publishedBlobDirectory);
+    }
+}
diff --git a/translator/tests/Translator.Tests/ModFunctionDiscoveryTests.cs b/translator/tests/Translator.Tests/ModFunctionDiscoveryTests.cs
new file mode 100644
index 0000000..614af61
--- /dev/null
+++ b/translator/tests/Translator.Tests/ModFunctionDiscoveryTests.cs
@@ -0,0 +1,666 @@
+using System.Buffers.Binary;
+using Translator.Core.Mods;
+using Translator.Core.Parsing.Kamek;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class ModFunctionDiscoveryTests
+{
+    [Fact]
+    public void DiscoversModuleDataPointersAndPrologues()
+    {
+        const uint moduleBase = 0x81200000u;
+        var code = new byte[0x80];
+        WriteU32(code, 0x20, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(code, 0x24, 0x7C0802A6u); // mflr r0
+        WriteU32(code, 0x28, 0x90010014u); // stw r0,0x14(r1)
+        WriteU32(code, 0x2C, 0x4E800020u); // blr
+        WriteU32(code, 0x40, moduleBase + 0x50);
+        WriteU32(code, 0x50, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(KamekChunk.HeaderSize + code.Length),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module prologue scan", starts[moduleBase + 0x20]);
+        Assert.Equal("module data pointer", starts[moduleBase + 0x50]);
+    }
+
+    [Fact]
+    public void DiscoversModuleBaseBctrThunk()
+    {
+        const uint moduleBase = 0x81200000u;
+        var code = new byte[0x40];
+        WriteU32(code, 0x00, 0x7C6C1B78u); // mr r12,r3
+        WriteU32(code, 0x04, 0x7D8903A6u); // mtctr r12
+        WriteU32(code, 0x08, 0x4E800420u); // bctr
+        WriteU32(code, 0x24, 0x9421FFF0u); // stwu r1,-0x10(r1)
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module base", starts[moduleBase]);
+    }
+
+    [Fact]
+    public void DiscoversSynthesizedLeafFunctionPointers()
+    {
+        const uint moduleBase = 0x81200000u;
+        var code = new byte[0x9800];
+        WriteU32(code, 0x40, 0x3C608121u); // lis r3,0x8121
+        WriteU32(code, 0x44, 0x38639710u); // addi r3,r3,-0x68f0 => 0x81209710
+        WriteU32(code, 0x48, 0x907EAD54u); // stw r3,-0x52ac(r30)
+        WriteU32(code, 0x9710, 0x3C808038u); // lis r4,0x8038
+        WriteU32(code, 0x9714, 0x38600016u); // li r3,0x16
+        WriteU32(code, 0x9718, 0x80846E3Cu); // lwz r4,0x6e3c(r4)
+        WriteU32(code, 0x971C, 0x38000010u); // li r0,0x10
+        WriteU32(code, 0x9720, 0xB0640020u); // sth r3,0x20(r4)
+        WriteU32(code, 0x9724, 0xB004001Cu); // sth r0,0x1c(r4)
+        WriteU32(code, 0x9728, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module synthesized pointer", starts[0x81209710]);
+    }
+
+    [Fact]
+    public void DiscoversSynthesizedCallbackStoredAfterRegisterSaveSetup()
+    {
+        const uint moduleBase = 0x81700000u;
+        var code = new byte[0x300];
+
+        // Placed past the declared code size so only the synthesized-pointer
+        // scan, and not the prologue scan, can attribute this start.
+        WriteU32(code, 0x80, 0x9421FFF0u); // callback: stwu r1,-0x10(r1)
+        WriteU32(code, 0x84, 0x4E800020u); // blr
+        WriteU32(code, 0x40, 0x9421FFF0u); // outer function
+        WriteU32(code, 0x44, 0x7C0802A6u); // mflr r0
+
+        WriteU32(code, 0x100, 0x3C608170u); // lis r3,0x8170
+        WriteU32(code, 0x104, 0x3CA0817Bu); // unrelated setup
+        WriteU32(code, 0x108, 0x90010024u); // save r0
+        WriteU32(code, 0x10C, 0x38630080u); // addi r3,r3,0x80
+        WriteU32(code, 0x110, 0x93E1001Cu); // save r31
+        WriteU32(code, 0x114, 0x3FE08177u); // more setup
+        WriteU32(code, 0x118, 0x38DFEC94u);
+        WriteU32(code, 0x11C, 0x93C10018u);
+        WriteU32(code, 0x120, 0x3FC08170u);
+        WriteU32(code, 0x124, 0x93A10014u);
+        WriteU32(code, 0x128, 0x3FA08174u);
+        WriteU32(code, 0x12C, 0x389DCCB4u);
+        WriteU32(code, 0x130, 0x93810010u);
+        WriteU32(code, 0x134, 0x3F80817Bu);
+        WriteU32(code, 0x138, 0x907C0180u); // stw r3,0x180(r28)
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: 0x80,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module synthesized pointer", starts[moduleBase + 0x80]);
+    }
+
+    [Fact]
+    public void DiscoversSynthesizedLongLeafFunctionPointers()
+    {
+        const uint moduleBase = 0x81200000u;
+        var code = new byte[0x40000];
+        WriteU32(code, 0xF574, 0x3C608124u); // lis r3,0x8124
+        WriteU32(code, 0xF578, 0x38800003u); // li r4,3
+        WriteU32(code, 0xF57C, 0x90010014u); // stw r0,0x14(r1)
+        WriteU32(code, 0xF580, 0x3863F1C0u); // addi r3,r3,-0xe40 => 0x8123F1C0
+        WriteU32(code, 0xF584, 0x907E1D50u); // stw r3,0x1d50(r30)
+
+        WriteU32(code, 0x3F1C0, 0x3D008129u); // lis r8,0x8129
+        for (var offset = 0x3F1C4; offset < 0x3F204; offset += 4)
+        {
+            WriteU32(code, offset, 0x60000000u); // nop-like body
+        }
+
+        WriteU32(code, 0x3F204, 0x4E800020u); // blr, past the old 64-byte leaf scan window
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module synthesized pointer", starts[0x8123F1C0]);
+    }
+
+    [Fact]
+    public void DiscoversSynthesizedPointersWrittenToDifferentRegister()
+    {
+        const uint moduleBase = 0x81200000u;
+        var code = new byte[0x40000];
+        WriteU32(code, 0x200, 0x3FE08124u); // lis r31,0x8124
+        WriteU32(code, 0x204, 0x389FE6B4u); // addi r4,r31,-0x194c => 0x8123E6B4, not directly stored
+        WriteU32(code, 0x208, 0x38A50000u); // addi r5,r5,0
+        WriteU32(code, 0x20C, 0x381FE6B4u); // addi r0,r31,-0x194c => 0x8123E6B4
+        WriteU32(code, 0x210, 0x901E003Cu); // stw r0,0x3c(r30)
+
+        WriteU32(code, 0x3E6B4, 0x3C60801Cu); // lis r3,0x801c
+        WriteU32(code, 0x3E6B8, 0x8063AB20u); // lwz r3,-0x54e0(r3)
+        WriteU32(code, 0x3E6BC, 0x3C03B180u); // addis r0,r3,-0x4e80
+        WriteU32(code, 0x3E6C0, 0x28000020u); // cmplwi r0,0x20
+        WriteU32(code, 0x3E6C4, 0x4D820020u); // beqlr
+        WriteU32(code, 0x3E6C8, 0x3C608126u); // lis r3,0x8126
+        WriteU32(code, 0x3E6CC, 0x38636650u); // addi r3,r3,0x6650
+        WriteU32(code, 0x3E6D0, 0x4BFCAF08u); // b some helper
+        WriteU32(code, 0x3E6D4, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module synthesized pointer", starts[0x8123E6B4]);
+    }
+
+    [Fact]
+    public void DiscoversSynthesizedComparatorPassedThroughExternalTailCall()
+    {
+        const uint moduleBase = 0x81700000u;
+        var code = new byte[0x20000];
+
+        // Mirrors the Retro Rewind trampoline at 0x8171FCB4: a lone backward
+        // branch referenced only as a callback argument to a base-game routine.
+        WriteU32(code, 0x1FBC8, 0x9421FFF0u); // helper: stwu r1,-0x10(r1)
+        WriteU32(code, 0x1FBCC, 0x7C0802A6u); // mflr r0
+        WriteU32(code, 0x1FBD0, 0x4E800020u); // blr
+        WriteU32(code, 0x1FCB4, EncodeBranch(moduleBase + 0x1FCB4, moduleBase + 0x1FBC8)); // trampoline
+
+        WriteU32(code, 0x1FCCC, 0x3CC08172u); // lis r6,0x8172
+        WriteU32(code, 0x1FCD0, 0x38A00018u); // li r5,0x18
+        WriteU32(code, 0x1FCD4, 0x38C6FCB4u); // addi r6,r6,-0x34c => 0x8171FCB4
+        WriteU32(code, 0x1FCD8, EncodeBranch(moduleBase + 0x1FCD8, 0x80011B00u)); // tail call into base sort routine
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module synthesized pointer", starts[moduleBase + 0x1FCB4]);
+    }
+
+    [Fact]
+    public void DiscoversSynthesizedCallbackPassedAsCallArgument()
+    {
+        const uint moduleBase = 0x81700000u;
+        var code = new byte[0x20000];
+
+        WriteU32(code, 0x1000, 0x38600001u); // prologue-less leaf callback: li r3,1
+        WriteU32(code, 0x1004, 0x4E800020u); // blr
+
+        WriteU32(code, 0x2000, 0x3C808170u); // lis r4,0x8170
+        WriteU32(code, 0x2004, 0x38841000u); // addi r4,r4,0x1000 => callback
+        WriteU32(code, 0x2008, 0x48000001u | (0x3000u - 0x2008u)); // bl moduleBase+0x3000
+        WriteU32(code, 0x3000, 0x4E800020u); // callee: blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module synthesized pointer", starts[moduleBase + 0x1000]);
+    }
+
+    [Fact]
+    public void IgnoresAsciiDataThatDecodesAsForwardBranch()
+    {
+        const uint moduleBase = 0x81700000u;
+        var code = new byte[0x20000];
+
+        // "HeyhoShipGBA.brres" - 'H' (0x48) decodes as an unconditional forward
+        // branch whose target lands far outside executable MEM1.
+        var name = "HeyhoShipGBA.brres\0\0"u8.ToArray();
+        name.CopyTo(code, 0x1B5FC);
+
+        WriteU32(code, 0x2000, 0x3C808172u); // lis r4,0x8172
+        WriteU32(code, 0x2004, 0x3884B5FCu); // addi r4,r4,-0x4a04 => 0x8171B5FC string address
+        WriteU32(code, 0x2008, 0x48000001u | (0x3000u - 0x2008u)); // bl: string passed as argument
+        WriteU32(code, 0x3000, 0x4E800020u); // callee: blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.False(starts.ContainsKey(moduleBase + 0x1B5FC));
+    }
+
+    [Fact]
+    public void IgnoresSynthesizedAddressWhoseRegisterDiesAtCall()
+    {
+        const uint moduleBase = 0x81700000u;
+        var code = new byte[0x20000];
+
+        WriteU32(code, 0x1000, 0x38600001u); // leaf-looking target: li r3,1
+        WriteU32(code, 0x1004, 0x4E800020u); // blr
+
+        WriteU32(code, 0x2000, 0x3D808170u); // lis r12,0x8170
+        WriteU32(code, 0x2004, 0x398C1000u); // addi r12,r12,0x1000
+        WriteU32(code, 0x2008, 0x48000001u | (0x3000u - 0x2008u)); // bl clobbers r12 before any use
+        WriteU32(code, 0x3000, 0x4E800020u); // callee: blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.DoesNotContain(starts, kvp => kvp.Value == "module synthesized pointer");
+    }
+
+    [Fact]
+    public void DiscoversModuleDataPointerToLeafFunction()
+    {
+        const uint moduleBase = 0x81200000u;
+        var code = new byte[0x200];
+        WriteU32(code, 0x20, moduleBase + 0x100);
+        WriteU32(code, 0x100, 0x806300DCu); // lwz r3,0xdc(r3)
+        WriteU32(code, 0x104, 0x7C802378u); // mr r0,r4
+        WriteU32(code, 0x108, 0x2C030000u); // cmpwi r3,0
+        WriteU32(code, 0x10C, 0x38600000u); // li r3,0
+        WriteU32(code, 0x110, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module data pointer", starts[moduleBase + 0x100]);
+    }
+
+    [Fact]
+    public void DiscoversAppendedModuleDataPointerToLeafFunction()
+    {
+        const uint moduleBase = 0x81200000u;
+        var relocatedImage = new byte[0x300];
+        WriteU32(relocatedImage, 0x20, moduleBase + 0x200);
+        WriteU32(relocatedImage, 0x200, 0x38600001u); // li r3,1
+        WriteU32(relocatedImage, 0x204, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: 0x100,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(0x100 + KamekChunk.HeaderSize),
+            codeBlob: relocatedImage[..0x100],
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, relocatedImage)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module data pointer", starts[moduleBase + 0x200]);
+    }
+
+    [Fact]
+    public void DiscoversShortTailEntryInsideMappedPayloadFunction()
+    {
+        const uint moduleBase = 0x81700000u;
+        var relocatedImage = new byte[0x300];
+
+        WriteU32(relocatedImage, 0x150, 0x9421FFF0u); // stwu r1,-0x10(r1), executable tail target
+        WriteU32(relocatedImage, 0x154, 0x4E800020u); // blr
+        WriteU32(relocatedImage, 0x200, 0x9421FFF0u); // mapped public payload function
+        WriteU32(relocatedImage, 0x204, 0x4E800020u); // blr
+        WriteU32(relocatedImage, 0x230, EncodeBranch(moduleBase + 0x230, moduleBase + 0x200)); // previous helper tail
+        WriteU32(relocatedImage, 0x234, 0x38800001u); // li r4,1
+        WriteU32(relocatedImage, 0x238, EncodeBranch(moduleBase + 0x238, moduleBase + 0x150)); // b target
+        WriteU32(relocatedImage, 0x23C, 0x000058B4u); // inline data between tail entry and next prologue
+        WriteU32(relocatedImage, 0x240, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(relocatedImage, 0x244, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: 0x100,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(0x100 + KamekChunk.HeaderSize),
+            codeBlob: relocatedImage[..0x100],
+            commands: []);
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, relocatedImage)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module tail-entry scan", starts[moduleBase + 0x234]);
+        Assert.False(starts.ContainsKey(moduleBase + 0x23C));
+    }
+
+    [Fact]
+    public void KeepsPrologueScanScopedToOriginalCodeSize()
+    {
+        const uint moduleBase = 0x81200000u;
+        var relocatedImage = new byte[0x300];
+        WriteU32(relocatedImage, 0x200, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(relocatedImage, 0x204, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: 0x100,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(0x100 + KamekChunk.HeaderSize),
+            codeBlob: relocatedImage[..0x100],
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, relocatedImage);
+
+        Assert.DoesNotContain(starts, start => start.Address == moduleBase + 0x200);
+    }
+
+    [Fact]
+    public void DiscoversLeafFunctionBetweenReturnedFunctionAndNextPrologue()
+    {
+        const uint moduleBase = 0x81200000u;
+        var code = new byte[0x500];
+        WriteU32(code, 0x320, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(code, 0x324, 0x7C0802A6u); // mflr r0
+        WriteU32(code, 0x328, 0x90010014u); // stw r0,0x14(r1)
+        WriteU32(code, 0x32C, 0x80010014u); // lwz r0,0x14(r1)
+        WriteU32(code, 0x330, 0x7C0803A6u); // mtlr r0
+        WriteU32(code, 0x334, 0x38210010u); // addi r1,r1,0x10
+        WriteU32(code, 0x338, 0x4E800020u); // blr
+
+        WriteU32(code, 0x33C, 0x3C60809Cu); // lis r3,0x809c
+        WriteU32(code, 0x340, 0x3CA08129u); // lis r5,0x8129
+        WriteU32(code, 0x344, 0x80831E38u); // lwz r4,0x1e38(r3)
+        WriteU32(code, 0x348, 0x8065FD1Cu); // lwz r3,-0x2e4(r5)
+        WriteU32(code, 0x34C, 0x2C040048u); // cmpwi r4,0x48
+        WriteU32(code, 0x350, 0x4D820020u); // beqlr
+        WriteU32(code, 0x354, 0x38000000u); // li r0,0
+        WriteU32(code, 0x358, 0x90030060u); // stw r0,0x60(r3)
+        WriteU32(code, 0x35C, 0x4E800020u); // blr
+
+        WriteU32(code, 0x3A0, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(code, 0x3A4, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module leaf boundary scan", starts[moduleBase + 0x33C]);
+    }
+
+    [Fact]
+    public void DiscoversTailThunkBetweenBranchedFunctionAndNextPrologue()
+    {
+        const uint moduleBase = 0x81200000u;
+        var code = new byte[0x500];
+        WriteU32(code, 0x240, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(code, 0x244, 0x4E800020u); // blr
+
+        WriteU32(code, 0x320, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(code, 0x324, 0x7C0802A6u); // mflr r0
+        WriteU32(code, 0x328, 0x90010014u); // stw r0,0x14(r1)
+        WriteU32(code, 0x32C, 0x38630020u); // addi r3,r3,0x20
+        WriteU32(code, 0x330, 0x48000010u); // b moduleBase+0x340
+
+        WriteU32(code, 0x334, 0x3C608129u); // lis r3,0x8129
+        WriteU32(code, 0x338, 0x38631C5Cu); // addi r3,r3,0x1c5c
+        WriteU32(code, 0x33C, 0x4BFFFF04u); // b moduleBase+0x240
+
+        WriteU32(code, 0x340, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(code, 0x344, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module leaf boundary scan", starts[moduleBase + 0x334]);
+    }
+
+    [Fact]
+    public void DoesNotSplitCountedLoopContinuationAfterConditionalReturn()
+    {
+        const uint moduleBase = 0x81750000u;
+        var code = new byte[0x200];
+
+        WriteU32(code, 0x100, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(code, 0x120, 0x80050008u); // lwz r0,8(r5)
+        WriteU32(code, 0x124, 0x7C002000u); // cmpw r0,r4
+        WriteU32(code, 0x128, 0x40820008u); // bne moduleBase+0x130
+        WriteU32(code, 0x12C, 0x4E800020u); // blr
+        WriteU32(code, 0x130, 0x38A50004u); // addi r5,r5,4
+        WriteU32(code, 0x134, 0x4200FFECu); // bdnz moduleBase+0x120
+        WriteU32(code, 0x138, 0x4E800020u); // blr
+
+        WriteU32(code, 0x180, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(code, 0x184, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.False(starts.ContainsKey(moduleBase + 0x130));
+    }
+
+    [Fact]
+    public void DiscoversLeafFunctionThatTailBranchesToBaseCode()
+    {
+        const uint moduleBase = 0x8174FBA0u;
+        var code = new byte[0x500];
+
+        WriteU32(code, 0x300, 0x9421FFF0u); // stwu r1,-0x10(r1)
+        WriteU32(code, 0x304, 0x38210010u); // addi r1,r1,0x10
+        WriteU32(code, 0x308, 0x4E800020u); // blr
+
+        WriteU32(code, 0x30C, 0x38000008u); // li r0,8
+        WriteU32(code, 0x310, 0x3880FFFFu); // li r4,-1
+        WriteU32(code, 0x314, 0x90832AB4u); // stw r4,0x2ab4(r3)
+        WriteU32(code, 0x318, 0x38A00000u); // li r5,0
+        WriteU32(code, 0x31C, 0x80C3072Cu); // lwz r6,0x72c(r3)
+        WriteU32(code, 0x320, 0x7C0903A6u); // mtctr r0
+        WriteU32(code, 0x324, 0x80860000u); // lwz r4,0(r6)
+        WriteU32(code, 0x328, 0x38C60004u); // addi r6,r6,4
+        WriteU32(code, 0x32C, 0x98A401E9u); // stb r5,0x1e9(r4)
+        WriteU32(code, 0x330, 0x4200FFF4u); // bdnz -0xc
+        WriteU32(code, 0x334, 0x38000000u); // li r0,0
+        WriteU32(code, 0x338, EncodeBranch(moduleBase + 0x338, 0x80841010u)); // b base code
+
+        WriteU32(code, 0x33C, 0x9421FFC0u); // stwu r1,-0x40(r1)
+        WriteU32(code, 0x340, 0x7C0802A6u); // mflr r0
+        WriteU32(code, 0x344, 0x4E800020u); // blr
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module leaf boundary scan", starts[moduleBase + 0x30C]);
+    }
+
+    [Fact]
+    public void DiscoversLeafFunctionAfterExternalTailBranch()
+    {
+        const uint moduleBase = 0x81700000u;
+        var code = new byte[0x44000];
+
+        WriteU32(code, 0x42FF8, 0x806302BCu); // lwz r3,0x2bc(r3)
+        WriteU32(code, 0x42FFC, 0x38843000u); // addi r4,r4,0x3000
+        WriteU32(code, 0x43000, EncodeBranch(moduleBase + 0x43000, 0x807E9A38u)); // b base code
+
+        WriteU32(code, 0x43004, 0x80630048u); // lwz r3,0x48(r3)
+        WriteU32(code, 0x43008, 0x38800000u); // li r4,0
+        WriteU32(code, 0x4300C, 0x80630000u); // lwz r3,0(r3)
+        WriteU32(code, 0x43010, EncodeBranch(moduleBase + 0x43010, 0x805BDF44u)); // b base code
+
+        WriteU32(code, 0x43014, 0x9421FFE0u); // stwu r1,-0x20(r1)
+        WriteU32(code, 0x43018, 0x7C0802A6u); // mflr r0
+
+        var chunk = new KamekChunk(
+            index: 0,
+            fileOffset: 0,
+            bssSize: 0,
+            codeSize: (uint)code.Length,
+            ctorStart: 0,
+            ctorEnd: 0,
+            chunkSize: (uint)(code.Length + KamekChunk.HeaderSize),
+            codeBlob: code,
+            commands: []);
+
+        var starts = ModFunctionDiscovery.DiscoverKamekFunctions(chunk, moduleBase, code)
+            .ToDictionary(start => start.Address, start => start.Reason);
+
+        Assert.Equal("module leaf boundary scan", starts[moduleBase + 0x43004]);
+    }
+
+    private static void WriteU32(byte[] data, int offset, uint value) =>
+        BinaryPrimitives.WriteUInt32BigEndian(data.AsSpan(offset, 4), value);
+
+    private static uint EncodeBranch(uint source, uint target)
+    {
+        var delta = unchecked((int)(target - source));
+        return 0x48000000u | ((uint)delta & 0x03FFFFFCu);
+    }
+}
diff --git a/translator/tests/Translator.Tests/ModTranslationWaveRunnerTests.cs b/translator/tests/Translator.Tests/ModTranslationWaveRunnerTests.cs
new file mode 100644
index 0000000..33e6eff
--- /dev/null
+++ b/translator/tests/Translator.Tests/ModTranslationWaveRunnerTests.cs
@@ -0,0 +1,68 @@
+using System.Buffers.Binary;
+using Translator.Core.Loading;
+using Translator.Core.Translation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class ModTranslationWaveRunnerTests
+{
+    [Fact]
+    public void Translate_IsDeterministicAcrossThreadCounts()
+    {
+        var memory = new byte[24];
+        WriteWord(memory, 0, 0x38600001); // li r3, 1
+        WriteWord(memory, 4, 0x4E800020); // blr
+        WriteWord(memory, 8, 0x38600002); // li r3, 2
+        WriteWord(memory, 12, 0x4E800020); // blr
+        WriteWord(memory, 16, 0x38600003); // li r3, 3
+        WriteWord(memory, 20, 0x4E800020); // blr
+        var image = new ProgramImage(
+            memory,
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, (uint)memory.Length),
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, (uint)memory.Length),
+            default,
+            "mod-wave-test");
+        var knownEntries = new HashSet<uint>
+        {
+            MemoryLayout.RamBase,
+            MemoryLayout.RamBase + 8,
+            MemoryLayout.RamBase + 16
+        };
+        ModTranslationWork Work(uint address) => new(
+            address,
+            TranslationOptions.Default with
+            {
+                PreferredName = $"wave_{address:X8}",
+                MaxBytes = 8,
+                AllowUnsupportedInstructions = true,
+                KnownFunctionEntryPoints = knownEntries
+            },
+            $"{address:X8}.cpp");
+        var shuffled = new[]
+        {
+            Work(MemoryLayout.RamBase + 16),
+            Work(MemoryLayout.RamBase),
+            Work(MemoryLayout.RamBase + 8)
+        };
+
+        var sequentialTranslator = new FunctionTranslator(image);
+        var parallelTranslator = new FunctionTranslator(image);
+        var sequential = ModTranslationWaveRunner.Translate(
+            () => sequentialTranslator,
+            shuffled,
+            new ParallelOptions { MaxDegreeOfParallelism = 1 });
+        var parallel = ModTranslationWaveRunner.Translate(
+            () => parallelTranslator,
+            shuffled,
+            new ParallelOptions { MaxDegreeOfParallelism = 4 });
+
+        Assert.Equal(sequential.Select(item => item.Work.Address), parallel.Select(item => item.Work.Address));
+        Assert.Equal(sequential.Select(item => item.Error), parallel.Select(item => item.Error));
+        Assert.Equal(sequential.Select(item => item.Result!.CxxCode), parallel.Select(item => item.Result!.CxxCode));
+        Assert.Equal(knownEntries.Order(), parallel.Select(item => item.Work.Address));
+    }
+
+    private static void WriteWord(byte[] memory, int offset, uint value) =>
+        BinaryPrimitives.WriteUInt32BigEndian(memory.AsSpan(offset, 4), value);
+}
diff --git a/translator/tests/Translator.Tests/MtxIntegrationTests.cs b/translator/tests/Translator.Tests/MtxIntegrationTests.cs
new file mode 100644
index 0000000..5a4c718
--- /dev/null
+++ b/translator/tests/Translator.Tests/MtxIntegrationTests.cs
@@ -0,0 +1,926 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Loading;
+using Translator.Core.Parsing.Dol;
+using Translator.Core.Parsing.Rel;
+using Translator.Core.Translation;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class MtxIntegrationTests
+{
+    private static string RepositoryRoot => Path.GetFullPath(Path.Combine(
+        AppContext.BaseDirectory, "..", "..", "..", "..", "..", ".."));
+
+    private enum ParamKind
+    {
+        Gpr,
+        Fpr
+    }
+
+    private enum ReturnKind
+    {
+        Void,
+        Gpr,
+        Float
+    }
+
+    private record MtxFuncSpec(uint Address, string Name, ReturnKind Return, IReadOnlyList<ParamKind> Params);
+
+    private static (int ExitCode, string Output) RunProcess(string fileName, string arguments, TimeSpan? timeout = null)
+    {
+        using var process = new Process
+        {
+            StartInfo = new ProcessStartInfo
+            {
+                FileName = fileName,
+                Arguments = arguments,
+                RedirectStandardError = true,
+                RedirectStandardOutput = true,
+                UseShellExecute = false
+            }
+        };
+
+        process.Start();
+        var stdoutTask = process.StandardOutput.ReadToEndAsync();
+        var stderrTask = process.StandardError.ReadToEndAsync();
+        var exitedInTime = true;
+        if (timeout.HasValue)
+        {
+            exitedInTime = process.WaitForExit((int)timeout.Value.TotalMilliseconds);
+        }
+        else
+        {
+            process.WaitForExit();
+        }
+
+        if (!exitedInTime)
+        {
+            try
+            {
+                process.Kill(entireProcessTree: true);
+            }
+            catch
+            {
+                // ignored: process might have already exited between WaitForExit and Kill
+            }
+
+            process.WaitForExit();
+            var staleOutput = stdoutTask.GetAwaiter().GetResult() + stderrTask.GetAwaiter().GetResult();
+            throw new TimeoutException($"Process '{fileName}' timed out after {timeout!.Value.TotalSeconds:F0}s. Output before kill:\n{staleOutput}");
+        }
+
+        process.WaitForExit();
+        var output = stdoutTask.GetAwaiter().GetResult() + stderrTask.GetAwaiter().GetResult();
+        return (process.ExitCode, output);
+    }
+
+    private static FunctionTranslator BuildTranslator()
+    {
+        var root = RepositoryRoot;
+        var dol = DolFile.Load(Path.Combine(root, "assets", "main.dol"));
+        var rel = RelFile.Load(Path.Combine(root, "assets", "StaticR.rel"))
+            .BuildImage(0x805102E0);
+        var image = new ProgramImageBuilder().Build(dol, rel);
+        return new FunctionTranslator(image);
+    }
+
+    [Fact]
+    public void Translated_MTX_Primitives_ExecuteCorrectly()
+    {
+        var specs = new[]
+        {
+            Spec(0x80199D04, "PSMTXIdentity_80199d04", ReturnKind.Void, ParamKind.Gpr),
+            Spec(0x80199D30, "PSMTXCopy_80199d30", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x80199D64, "PSMTXConcat_80199d64", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x80199E30, "PSMTXConcatArray_80199e30", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x80199FC8, "PSMTXInverse_80199fc8", ReturnKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019A0C0, "PSMTXInvXpose_8019a0c0", ReturnKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019A188, "PSMTXRotRad_8019a188", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr),
+            Spec(0x8019A204, "PSMTXRotTrig_8019a204", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019A2B4, "PSMTXRotAxisRadInternal_8019a2b4", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019A364, "PSMTXRotAxisRad_8019a364", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr),
+            Spec(0x8019A3E0, "PSMTXTrans_8019a3e0", ReturnKind.Void, ParamKind.Gpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019A414, "PSMTXTransApply_8019a414", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019A460, "PSMTXScale_8019a460", ReturnKind.Void, ParamKind.Gpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019A488, "PSMTXScaleApply_8019a488", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019A4E0, "PSMTXQuat_8019a4e0", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019A584, "C_MTXLookAt_8019a584", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019A6F8, "C_MTXLightFrustum_8019a6f8", ReturnKind.Void, ParamKind.Gpr,
+                ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019A79C, "C_MTXLightPerspective_8019a79c", ReturnKind.Void, ParamKind.Gpr,
+                ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019A894, "C_MTXLightOrtho_8019a894", ReturnKind.Void, ParamKind.Gpr,
+                ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019A91C, "PSMTXMultVec_8019a91c", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019A970, "PSMTXMultVecSR_8019a970", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019A9C4, "C_MTXFrustum_8019a9c4", ReturnKind.Void, ParamKind.Gpr,
+                ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019AA60, "C_MTXPerspective_8019aa60", ReturnKind.Void, ParamKind.Gpr,
+                ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019AB4C, "C_MTXOrtho_8019ab4c", ReturnKind.Void, ParamKind.Gpr,
+                ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr, ParamKind.Fpr),
+            Spec(0x8019ABE4, "MTX__PSVECAdd_8019abe4", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019AC08, "MTX__PSVECScale_8019ac08", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr),
+            Spec(0x8019AC24, "MTX__PSVECNormalize_8019ac24", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019AC68, "MTX__PSVECMag_8019ac68", ReturnKind.Float, ParamKind.Gpr),
+            Spec(0x8019ACAC, "MTX__PSVECDotProduct_8019acac", ReturnKind.Float, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019ACCC, "MTX__PSVECCrossProduct_8019accc", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019AD08, "MTX__C_VECHalfAngle_8019ad08", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019ADE0, "MTX__PSVECSquareDistance_8019ade0", ReturnKind.Float, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019AE08, "MTX__PSQUATMultiply_8019ae08", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019AE64, "MTX__PSQUATScale_8019ae64", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr),
+            Spec(0x8019AE80, "MTX__PSQUATDotProduct_8019ae80", ReturnKind.Float, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019AEA0, "MTX__PSQUATNormalize_8019aea0", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019AEF4, "MTX__PSQUATInverse_8019aef4", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019AF48, "MTX__C_QUATMtx_8019af48", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr),
+            Spec(0x8019B114, "MTX__C_QUATLerp_8019b114", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr),
+            Spec(0x8019B178, "MTX__C_QUATSlerp_8019b178", ReturnKind.Void, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Gpr, ParamKind.Fpr),
+        };
+
+        var translator = BuildTranslator();
+        var repoRoot = RepositoryRoot;
+        var tempRoot = Path.Combine(repoRoot, "test_output", "mtx");
+        Directory.CreateDirectory(tempRoot);
+
+        var generatedFiles = new List<string>();
+        var translations = TranslateWithDependencies(
+            translator,
+            specs.Select(s => (s.Address, s.Name)),
+            tempRoot,
+            generatedFiles);
+
+        var translationMap = translations.ToDictionary(t => t.Name, StringComparer.Ordinal);
+        foreach (var spec in specs)
+        {
+            Assert.True(translationMap.TryGetValue(spec.Name, out var translation), $"Missing translation for {spec.Name}.");
+            AssertReturnAbiMatches(spec, translation.AbiClassification);
+        }
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <cassert>");
+        harness.AppendLine("#include <cmath>");
+        harness.AppendLine("#include <cstdlib>");
+        harness.AppendLine("#include <cstdint>");
+        harness.AppendLine("#include <cstdio>");
+        harness.AppendLine("#include <array>");
+        harness.AppendLine("#include <type_traits>");
+        harness.AppendLine("#include \"memory.h\"");
+        harness.AppendLine("#include \"ppc_runtime.h\"");
+        harness.AppendLine("#include \"RuntimeConfig.h\"");
+
+        // Stubs for runtime dependencies
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write8(uint8_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write16(uint16_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write32(uint32_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_WriteFloat(float) {}");
+        harness.AppendLine("extern \"C\" void InsertAlarm_801a0620(CpuContext*) {}");
+        harness.AppendLine("extern \"C\" void OS____TimeToSystemTime_801aade0(CpuContext*) {}");
+        harness.AppendLine("void VI_HLE_SimulateRetrace(CpuContext*) {}");
+        harness.AppendLine("void DumpRecentPcTrace(size_t) {}");
+        harness.AppendLine("void MarkFatalErrorReported() {}");
+        harness.AppendLine("extern \"C\" void InitializeDataSections();");
+
+        foreach (var translation in translations)
+        {
+            harness.AppendLine(PrototypeFor(translation.AbiClassification));
+        }
+
+        harness.AppendLine("template <typename T>");
+        harness.AppendLine("uint32_t ToGpr(T v) {");
+        harness.AppendLine("    if constexpr (std::is_pointer_v<T>) {");
+        harness.AppendLine("        return static_cast<uint32_t>(reinterpret_cast<uintptr_t>(v));");
+        harness.AppendLine("    } else {");
+        harness.AppendLine("        return static_cast<uint32_t>(v);");
+        harness.AppendLine("    }");
+        harness.AppendLine("}");
+
+        harness.AppendLine("static void WriteF32(uint32_t addr, float value) {");
+        harness.AppendLine("    Memory::WriteFloat32(addr, value);");
+        harness.AppendLine("}");
+        harness.AppendLine("static float ReadF32(uint32_t addr) {");
+        harness.AppendLine("    return Memory::ReadFloat32(addr);");
+        harness.AppendLine("}");
+        harness.AppendLine("static void WriteMat34(uint32_t addr, const float* m) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) WriteF32(addr + static_cast<uint32_t>(i * 4), m[i]);");
+        harness.AppendLine("}");
+        harness.AppendLine("static void ReadMat34(uint32_t addr, float* m) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) m[i] = ReadF32(addr + static_cast<uint32_t>(i * 4));");
+        harness.AppendLine("}");
+        harness.AppendLine("static void WriteMat44(uint32_t addr, const float* m) {");
+        harness.AppendLine("    for (int i = 0; i < 16; ++i) WriteF32(addr + static_cast<uint32_t>(i * 4), m[i]);");
+        harness.AppendLine("}");
+        harness.AppendLine("static void ReadMat44(uint32_t addr, float* m) {");
+        harness.AppendLine("    for (int i = 0; i < 16; ++i) m[i] = ReadF32(addr + static_cast<uint32_t>(i * 4));");
+        harness.AppendLine("}");
+        harness.AppendLine("static void WriteVec3(uint32_t addr, const float* v) {");
+        harness.AppendLine("    for (int i = 0; i < 3; ++i) WriteF32(addr + static_cast<uint32_t>(i * 4), v[i]);");
+        harness.AppendLine("}");
+        harness.AppendLine("static void ReadVec3(uint32_t addr, float* v) {");
+        harness.AppendLine("    for (int i = 0; i < 3; ++i) v[i] = ReadF32(addr + static_cast<uint32_t>(i * 4));");
+        harness.AppendLine("}");
+        harness.AppendLine("static void WriteQuat(uint32_t addr, const float* q) {");
+        harness.AppendLine("    for (int i = 0; i < 4; ++i) WriteF32(addr + static_cast<uint32_t>(i * 4), q[i]);");
+        harness.AppendLine("}");
+        harness.AppendLine("static void ReadQuat(uint32_t addr, float* q) {");
+        harness.AppendLine("    for (int i = 0; i < 4; ++i) q[i] = ReadF32(addr + static_cast<uint32_t>(i * 4));");
+        harness.AppendLine("}");
+        harness.AppendLine("static float ReadFprPs0(const CpuContext& cpu, int index) {");
+        harness.AppendLine("    return static_cast<float>(PPC_PsToScalar(cpu.fpr[index].d));");
+        harness.AppendLine("}");
+        harness.AppendLine("static float ReadFprFloat(const CpuContext& cpu, int index) {");
+        harness.AppendLine("    return static_cast<float>(cpu.fpr[index].d);");
+        harness.AppendLine("}");
+        harness.AppendLine("static bool Near(float a, float b, float eps = 1e-4f) {");
+        harness.AppendLine("    const float diff = std::fabs(a - b);");
+        harness.AppendLine("    const float scale = std::fmax(1.0f, std::fmax(std::fabs(a), std::fabs(b)));\n    return diff <= eps * scale;\n}");
+        harness.AppendLine("static float VecDot(const float* a, const float* b) {");
+        harness.AppendLine("    return a[0] * b[0] + a[1] * b[1] + a[2] * b[2];");
+        harness.AppendLine("}");
+        harness.AppendLine("static float VecMag(const float* v) {");
+        harness.AppendLine("    return std::sqrt(VecDot(v, v));");
+        harness.AppendLine("}");
+        harness.AppendLine("static void VecNormalize(const float* v, float* out) {");
+        harness.AppendLine("    const float m = VecMag(v);\n    if (m == 0.0f) { out[0] = out[1] = out[2] = 0.0f; return; }\n    out[0] = v[0] / m; out[1] = v[1] / m; out[2] = v[2] / m;");
+        harness.AppendLine("}");
+        harness.AppendLine("static void VecCross(const float* a, const float* b, float* out) {");
+        harness.AppendLine("    out[0] = a[1] * b[2] - a[2] * b[1];\n    out[1] = a[2] * b[0] - a[0] * b[2];\n    out[2] = a[0] * b[1] - a[1] * b[0];");
+        harness.AppendLine("}");
+        harness.AppendLine("static float VecSquareDistance(const float* a, const float* b) {");
+        harness.AppendLine("    const float dx = a[0] - b[0]; const float dy = a[1] - b[1]; const float dz = a[2] - b[2];");
+        harness.AppendLine("    return dx * dx + dy * dy + dz * dz;");
+        harness.AppendLine("}");
+        harness.AppendLine("static void VecHalfAngle(const float* a, const float* b, float* out) {");
+        harness.AppendLine("    float an[3] = { -a[0], -a[1], -a[2] };");
+        harness.AppendLine("    float bn[3] = { -b[0], -b[1], -b[2] };");
+        harness.AppendLine("    VecNormalize(an, an);");
+        harness.AppendLine("    VecNormalize(bn, bn);");
+        harness.AppendLine("    float sum[3] = { an[0] + bn[0], an[1] + bn[1], an[2] + bn[2] };");
+        harness.AppendLine("    const float len2 = VecDot(sum, sum);");
+        harness.AppendLine("    if (len2 <= 1e-7f) { out[0] = sum[0]; out[1] = sum[1]; out[2] = sum[2]; return; }");
+        harness.AppendLine("    VecNormalize(sum, out);");
+        harness.AppendLine("}");
+        harness.AppendLine("static void QuatMul(const float* a, const float* b, float* out) {");
+        harness.AppendLine("    const float ax = a[0], ay = a[1], az = a[2], aw = a[3];");
+        harness.AppendLine("    const float bx = b[0], by = b[1], bz = b[2], bw = b[3];");
+        harness.AppendLine("    out[0] = aw * bx + bw * ax + ay * bz - az * by;");
+        harness.AppendLine("    out[1] = aw * by + bw * ay + az * bx - ax * bz;");
+        harness.AppendLine("    out[2] = aw * bz + bw * az + ax * by - ay * bx;");
+        harness.AppendLine("    out[3] = aw * bw - (ax * bx + ay * by + az * bz);");
+        harness.AppendLine("}");
+        harness.AppendLine("static float QuatDot(const float* a, const float* b) {");
+        harness.AppendLine("    return a[0] * b[0] + a[1] * b[1] + a[2] * b[2] + a[3] * b[3];");
+        harness.AppendLine("}");
+        harness.AppendLine("static void QuatNormalize(const float* q, float* out) {");
+        harness.AppendLine("    const float d = QuatDot(q, q);\n    if (d == 0.0f) { out[0] = out[1] = out[2] = 0.0f; out[3] = 1.0f; return; }\n    const float inv = 1.0f / std::sqrt(d);\n    out[0] = q[0] * inv; out[1] = q[1] * inv; out[2] = q[2] * inv; out[3] = q[3] * inv;");
+        harness.AppendLine("}");
+        harness.AppendLine("static void QuatInverse(const float* q, float* out) {");
+        harness.AppendLine("    const float d = QuatDot(q, q);\n    if (d == 0.0f) { out[0] = out[1] = out[2] = 0.0f; out[3] = 1.0f; return; }\n    const float inv = 1.0f / d;\n    out[0] = -q[0] * inv; out[1] = -q[1] * inv; out[2] = -q[2] * inv; out[3] = q[3] * inv;");
+        harness.AppendLine("}");
+        harness.AppendLine("static void QuatLerp(const float* a, const float* b, float t, float* out) {");
+        harness.AppendLine("    out[0] = a[0] + (b[0] - a[0]) * t;\n    out[1] = a[1] + (b[1] - a[1]) * t;\n    out[2] = a[2] + (b[2] - a[2]) * t;\n    out[3] = a[3] + (b[3] - a[3]) * t;");
+        harness.AppendLine("}");
+        harness.AppendLine("static void QuatSlerp(const float* a, const float* bIn, float t, float* out) {");
+        harness.AppendLine("    float b[4] = { bIn[0], bIn[1], bIn[2], bIn[3] };");
+        harness.AppendLine("    float dot = QuatDot(a, b);");
+        harness.AppendLine("    if (dot < 0.0f) { dot = -dot; b[0] = -b[0]; b[1] = -b[1]; b[2] = -b[2]; b[3] = -b[3]; }");
+        harness.AppendLine("    if (dot > 0.9995f) { QuatLerp(a, b, t, out); QuatNormalize(out, out); return; }");
+        harness.AppendLine("    const float theta = std::acos(dot);\n    const float sinT = std::sin(theta);\n    const float w1 = std::sin((1.0f - t) * theta) / sinT;\n    const float w2 = std::sin(t * theta) / sinT;");
+        harness.AppendLine("    out[0] = a[0] * w1 + b[0] * w2;\n    out[1] = a[1] * w1 + b[1] * w2;\n    out[2] = a[2] * w1 + b[2] * w2;\n    out[3] = a[3] * w1 + b[3] * w2;");
+        harness.AppendLine("}");
+        harness.AppendLine("static void ExpectMat34(const float* got, const float* exp, const char* label) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) {");
+        harness.AppendLine("        if (!Near(got[i], exp[i])) {");
+        harness.AppendLine("            std::printf(\"[mtx] %s mismatch at %d: got %.6f exp %.6f\\n\", label, i, got[i], exp[i]);");
+        harness.AppendLine("            assert(false);");
+        harness.AppendLine("        }");
+        harness.AppendLine("    }");
+        harness.AppendLine("}");
+        harness.AppendLine("static void ExpectMat44(const float* got, const float* exp, const char* label) {");
+        harness.AppendLine("    for (int i = 0; i < 16; ++i) {");
+        harness.AppendLine("        if (!Near(got[i], exp[i])) {");
+        harness.AppendLine("            std::printf(\"[mtx] %s mismatch at %d: got %.6f exp %.6f\\n\", label, i, got[i], exp[i]);");
+        harness.AppendLine("            assert(false);");
+        harness.AppendLine("        }");
+        harness.AppendLine("    }");
+        harness.AppendLine("}");
+
+        harness.AppendLine("static void RefIdentity(float* m) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) m[i] = 0.0f;");
+        harness.AppendLine("    m[0] = 1.0f; m[5] = 1.0f; m[10] = 1.0f;");
+        harness.AppendLine("}");
+        harness.AppendLine("static void RefScale(float* m, float x, float y, float z) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) m[i] = 0.0f;");
+        harness.AppendLine("    m[0] = x; m[5] = y; m[10] = z;");
+        harness.AppendLine("}");
+        harness.AppendLine("static void RefTrans(float* m, float x, float y, float z) {");
+        harness.AppendLine("    RefIdentity(m);");
+        harness.AppendLine("    m[3] = x; m[7] = y; m[11] = z;");
+        harness.AppendLine("}");
+        harness.AppendLine("static void RefRotTrig(float* m, char axis, float sinA, float cosA) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) m[i] = 0.0f;");
+        harness.AppendLine("    switch (axis) {");
+        harness.AppendLine("        case 'x': case 'X':");
+        harness.AppendLine("            m[0] = 1.0f; m[5] = cosA; m[6] = -sinA; m[9] = sinA; m[10] = cosA; break;");
+        harness.AppendLine("        case 'y': case 'Y':");
+        harness.AppendLine("            m[0] = cosA; m[2] = sinA; m[5] = 1.0f; m[8] = -sinA; m[10] = cosA; break;");
+        harness.AppendLine("        case 'z': case 'Z':");
+        harness.AppendLine("            m[0] = cosA; m[1] = -sinA; m[4] = sinA; m[5] = cosA; m[10] = 1.0f; break;");
+        harness.AppendLine("        default: break;");
+        harness.AppendLine("    }");
+        harness.AppendLine("}");
+        harness.AppendLine("static void RefRotRad(float* m, char axis, float rad) {");
+        harness.AppendLine("    RefRotTrig(m, axis, sinf(rad), cosf(rad));");
+        harness.AppendLine("}");
+        harness.AppendLine("static void RefRotAxisRadInternal(float* m, const float* axis, float sinA, float cosA) {");
+        harness.AppendLine("    float x = axis[0], y = axis[1], z = axis[2];");
+        harness.AppendLine("    float len = std::sqrt(x * x + y * y + z * z);");
+        harness.AppendLine("    if (len == 0.0f) { RefIdentity(m); return; }");
+        harness.AppendLine("    x /= len; y /= len; z /= len;\n    const float t = 1.0f - cosA;\n    m[0] = t * x * x + cosA;\n    m[1] = t * x * y - sinA * z;\n    m[2] = t * x * z + sinA * y;\n    m[3] = 0.0f;\n    m[4] = t * x * y + sinA * z;\n    m[5] = t * y * y + cosA;\n    m[6] = t * y * z - sinA * x;\n    m[7] = 0.0f;\n    m[8] = t * x * z - sinA * y;\n    m[9] = t * y * z + sinA * x;\n    m[10] = t * z * z + cosA;\n    m[11] = 0.0f;\n}");
+        harness.AppendLine("static void RefRotAxisRad(float* m, const float* axis, float rad) {");
+        harness.AppendLine("    RefRotAxisRadInternal(m, axis, sinf(rad), cosf(rad));");
+        harness.AppendLine("}");
+        harness.AppendLine("static void RefQuat(float* m, const float* q) {");
+        harness.AppendLine("    const float x = q[0], y = q[1], z = q[2], w = q[3];");
+        harness.AppendLine("    const float norm = x*x + y*y + z*z + w*w;\n    const float s = norm == 0.0f ? 0.0f : (2.0f / norm);\n    m[0] = 1.0f - (y*y + z*z) * s;\n    m[1] = (x*y - z*w) * s;\n    m[2] = (x*z + y*w) * s;\n    m[3] = 0.0f;\n    m[4] = (x*y + z*w) * s;\n    m[5] = 1.0f - (x*x + z*z) * s;\n    m[6] = (y*z - x*w) * s;\n    m[7] = 0.0f;\n    m[8] = (x*z - y*w) * s;\n    m[9] = (y*z + x*w) * s;\n    m[10] = 1.0f - (x*x + y*y) * s;\n    m[11] = 0.0f;\n}");
+        harness.AppendLine("static void RefConcat(const float* a, const float* b, float* out) {");
+        harness.AppendLine("    for (int r = 0; r < 3; ++r) {\n        const int r0 = r * 4;\n        out[r0 + 0] = a[r0 + 0] * b[0] + a[r0 + 1] * b[4] + a[r0 + 2] * b[8];\n        out[r0 + 1] = a[r0 + 0] * b[1] + a[r0 + 1] * b[5] + a[r0 + 2] * b[9];\n        out[r0 + 2] = a[r0 + 0] * b[2] + a[r0 + 1] * b[6] + a[r0 + 2] * b[10];\n        out[r0 + 3] = a[r0 + 0] * b[3] + a[r0 + 1] * b[7] + a[r0 + 2] * b[11] + a[r0 + 3];\n    }\n}");
+        harness.AppendLine("static void RefConcatArray(const float* a, const float* b, float* out, int count) {");
+        harness.AppendLine("    for (int i = 0; i < count; ++i) { RefConcat(a, b + i * 12, out + i * 12); }");
+        harness.AppendLine("}");
+        harness.AppendLine("static bool RefInverse(const float* src, float* inv) {");
+        harness.AppendLine("    const float a00 = src[0], a01 = src[1], a02 = src[2];\n    const float a10 = src[4], a11 = src[5], a12 = src[6];\n    const float a20 = src[8], a21 = src[9], a22 = src[10];\n    const float b00 = a11 * a22 - a12 * a21;\n    const float b01 = a12 * a20 - a10 * a22;\n    const float b02 = a10 * a21 - a11 * a20;\n    const float det = a00 * b00 + a01 * b01 + a02 * b02;\n    if (det == 0.0f) { return false; }\n    const float invDet = 1.0f / det;\n    const float r00 = b00 * invDet;\n    const float r01 = (a02 * a21 - a01 * a22) * invDet;\n    const float r02 = (a01 * a12 - a02 * a11) * invDet;\n    const float r10 = b01 * invDet;\n    const float r11 = (a00 * a22 - a02 * a20) * invDet;\n    const float r12 = (a02 * a10 - a00 * a12) * invDet;\n    const float r20 = b02 * invDet;\n    const float r21 = (a01 * a20 - a00 * a21) * invDet;\n    const float r22 = (a00 * a11 - a01 * a10) * invDet;\n    inv[0] = r00; inv[1] = r01; inv[2] = r02;\n    inv[4] = r10; inv[5] = r11; inv[6] = r12;\n    inv[8] = r20; inv[9] = r21; inv[10] = r22;\n    inv[3] = -(r00 * src[3] + r01 * src[7] + r02 * src[11]);\n    inv[7] = -(r10 * src[3] + r11 * src[7] + r12 * src[11]);\n    inv[11] = -(r20 * src[3] + r21 * src[7] + r22 * src[11]);\n    return true;\n}");
+        harness.AppendLine("static bool RefInvXpose(const float* src, float* out) {");
+        harness.AppendLine("    const float a00 = src[0], a01 = src[1], a02 = src[2];\n    const float a10 = src[4], a11 = src[5], a12 = src[6];\n    const float a20 = src[8], a21 = src[9], a22 = src[10];\n    const float c00 = a11 * a22 - a12 * a21;\n    const float c01 = a12 * a20 - a10 * a22;\n    const float c02 = a10 * a21 - a11 * a20;\n    const float c10 = a02 * a21 - a01 * a22;\n    const float c11 = a00 * a22 - a02 * a20;\n    const float c12 = a01 * a20 - a00 * a21;\n    const float c20 = a01 * a12 - a02 * a11;\n    const float c21 = a02 * a10 - a00 * a12;\n    const float c22 = a00 * a11 - a01 * a10;\n    const float det = a00 * c00 + a01 * c01 + a02 * c02;\n    if (det == 0.0f) { return false; }\n    const float invDet = 1.0f / det;\n    out[0] = c00 * invDet; out[1] = c01 * invDet; out[2] = c02 * invDet; out[3] = 0.0f;\n    out[4] = c10 * invDet; out[5] = c11 * invDet; out[6] = c12 * invDet; out[7] = 0.0f;\n    out[8] = c20 * invDet; out[9] = c21 * invDet; out[10] = c22 * invDet; out[11] = 0.0f;\n    return true;\n}");
+        harness.AppendLine("static void RefTransApply(const float* src, float* dst, float x, float y, float z) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) dst[i] = src[i];\n    dst[3] += x; dst[7] += y; dst[11] += z;\n}");
+        harness.AppendLine("static void RefScaleApply(const float* src, float* dst, float x, float y, float z) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) dst[i] = src[i];\n    for (int c = 0; c < 4; ++c) { dst[c] *= x; dst[4 + c] *= y; dst[8 + c] *= z; }\n}");
+        harness.AppendLine("static void RefMultVec(const float* m, const float* v, float* out) {");
+        harness.AppendLine("    out[0] = m[0] * v[0] + m[1] * v[1] + m[2] * v[2] + m[3];\n    out[1] = m[4] * v[0] + m[5] * v[1] + m[6] * v[2] + m[7];\n    out[2] = m[8] * v[0] + m[9] * v[1] + m[10] * v[2] + m[11];\n}");
+        harness.AppendLine("static void RefMultVecSR(const float* m, const float* v, float* out) {");
+        harness.AppendLine("    out[0] = m[0] * v[0] + m[1] * v[1] + m[2] * v[2];\n    out[1] = m[4] * v[0] + m[5] * v[1] + m[6] * v[2];\n    out[2] = m[8] * v[0] + m[9] * v[1] + m[10] * v[2];\n}");
+        harness.AppendLine("static void RefLookAt(float* m, const float* camPos, const float* camUp, const float* target) {");
+        harness.AppendLine("    float f[3] = { camPos[0] - target[0], camPos[1] - target[1], camPos[2] - target[2] };\n    auto norm = [](float* v) { float len = std::sqrt(v[0]*v[0] + v[1]*v[1] + v[2]*v[2]); if (len != 0.0f) { v[0] /= len; v[1] /= len; v[2] /= len; } };\n    norm(f);\n    float s[3] = { camUp[1] * f[2] - camUp[2] * f[1], camUp[2] * f[0] - camUp[0] * f[2], camUp[0] * f[1] - camUp[1] * f[0] };\n    norm(s);\n    float u[3] = { f[1] * s[2] - f[2] * s[1], f[2] * s[0] - f[0] * s[2], f[0] * s[1] - f[1] * s[0] };\n    m[0] = s[0]; m[1] = s[1]; m[2] = s[2]; m[3] = -(camPos[0]*s[0] + camPos[1]*s[1] + camPos[2]*s[2]);\n    m[4] = u[0]; m[5] = u[1]; m[6] = u[2]; m[7] = -(camPos[0]*u[0] + camPos[1]*u[1] + camPos[2]*u[2]);\n    m[8] = f[0]; m[9] = f[1]; m[10] = f[2]; m[11] = -(camPos[0]*f[0] + camPos[1]*f[1] + camPos[2]*f[2]);\n}");
+        harness.AppendLine("static void RefFrustum(float* m, float t, float b, float l, float r, float n, float f) {");
+        harness.AppendLine("    for (int i = 0; i < 16; ++i) m[i] = 0.0f;\n    const float invRL = 1.0f / (r - l);\n    const float invTB = 1.0f / (t - b);\n    const float invFN = 1.0f / (f - n);\n    m[0] = 2.0f * n * invRL;\n    m[5] = 2.0f * n * invTB;\n    m[2] = (r + l) * invRL;\n    m[6] = (t + b) * invTB;\n    m[10] = -n * invFN;\n    m[11] = -(f * n) * invFN;\n    m[14] = -1.0f;\n}");
+        harness.AppendLine("static void RefPerspective(float* m, float fovY, float aspect, float n, float f) {");
+        harness.AppendLine("    for (int i = 0; i < 16; ++i) m[i] = 0.0f;\n    const float fov = 0.5f * (3.14159265358979323846f / 180.0f) * fovY;\n    const float cot = 1.0f / tanf(fov);\n    const float invFN = 1.0f / (f - n);\n    m[0] = cot / aspect;\n    m[5] = cot;\n    m[10] = -n * invFN;\n    m[11] = -(f * n) * invFN;\n    m[14] = -1.0f;\n}");
+        harness.AppendLine("static void RefOrtho(float* m, float t, float b, float l, float r, float n, float f) {");
+        harness.AppendLine("    for (int i = 0; i < 16; ++i) m[i] = 0.0f;\n    const float invRL = 1.0f / (r - l);\n    const float invTB = 1.0f / (t - b);\n    const float invFN = 1.0f / (f - n);\n    m[0] = 2.0f * invRL;\n    m[3] = -(r + l) * invRL;\n    m[5] = 2.0f * invTB;\n    m[7] = -(t + b) * invTB;\n    m[10] = -1.0f * invFN;\n    m[11] = -f * invFN;\n    m[15] = 1.0f;\n}");
+        harness.AppendLine("static void RefLightPerspective(float* m, float fovY, float aspect, float scaleS, float scaleT, float transS, float transT) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) m[i] = 0.0f;\n    const float fov = 0.5f * (3.14159265358979323846f / 180.0f) * fovY;\n    const float cot = 1.0f / tanf(fov);\n    m[0] = scaleS * (cot / aspect);\n    m[5] = scaleT * cot;\n    m[2] = -transS;\n    m[6] = -transT;\n    m[10] = -1.0f;\n}");
+        harness.AppendLine("static void RefLightFrustum(float* m, float t, float b, float l, float r, float n, float scaleS, float scaleT, float transS, float transT) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) m[i] = 0.0f;\n    const float invRL = 1.0f / (r - l);\n    const float invTB = 1.0f / (t - b);\n    m[0] = scaleS * (2.0f * n * invRL);\n    m[2] = scaleS * (invRL * (r + l)) - transS;\n    m[5] = scaleT * (2.0f * n * invTB);\n    m[6] = scaleT * (invTB * (t + b)) - transT;\n    m[10] = -1.0f;\n}");
+        harness.AppendLine("static void RefLightOrtho(float* m, float t, float b, float l, float r, float scaleS, float scaleT, float transS, float transT) {");
+        harness.AppendLine("    for (int i = 0; i < 12; ++i) m[i] = 0.0f;\n    const float invRL = 1.0f / (r - l);\n    const float invTB = 1.0f / (t - b);\n    m[0] = scaleS * (2.0f * invRL);\n    m[3] = transS + scaleS * (invRL * -(r + l));\n    m[5] = scaleT * (2.0f * invTB);\n    m[7] = transT + scaleT * (invTB * -(t + b));\n    m[11] = 1.0f;\n}");
+
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    std::puts(\"mtx harness start\");");
+        harness.AppendLine("    Memory::Init(0x02000000);");
+        harness.AppendLine("    InitializeDataSections();");
+        harness.AppendLine("    CpuContext g_cpu{};");
+        harness.AppendLine("    g_cpu.gpr[1] = 0x81700000;");
+        harness.AppendLine("    g_cpu.gpr[2] = RuntimeConfig::SDA2_BASE;");
+        harness.AppendLine("    g_cpu.gpr[13] = RuntimeConfig::SDA1_BASE;");
+        harness.AppendLine("    CpuContextScope cpuScope(&g_cpu);");
+        harness.AppendLine("    const uint32_t base = 0x80000000;");
+        harness.AppendLine("    const uint32_t matA = base + 0x100;");
+        harness.AppendLine("    const uint32_t matB = base + 0x200;");
+        harness.AppendLine("    const uint32_t matC = base + 0x300;");
+        harness.AppendLine("    const uint32_t matD = base + 0x400;");
+        harness.AppendLine("    const uint32_t matArr = base + 0x500;");
+        harness.AppendLine("    const uint32_t vecA = base + 0x800;");
+        harness.AppendLine("    const uint32_t vecB = base + 0x820;");
+        harness.AppendLine("    const uint32_t vecC = base + 0x840;");
+        harness.AppendLine("    const uint32_t quatA = base + 0x900;");
+        harness.AppendLine("    const uint32_t quatB = base + 0x920;");
+        harness.AppendLine("    const uint32_t quatC = base + 0x940;");
+        harness.AppendLine("    const uint32_t mat44A = base + 0xA00;");
+        harness.AppendLine("    const uint32_t mat44B = base + 0xB00;");
+        harness.AppendLine("    float a[12] = { 1.2f, 0.3f, -0.7f, 2.0f, -0.4f, 1.5f, 0.25f, -1.0f, 0.8f, -0.2f, 1.1f, 0.5f };");
+        harness.AppendLine("    float b[12] = { 0.9f, -0.1f, 0.4f, -0.3f, 0.2f, 1.3f, -0.6f, 0.7f, -0.5f, 0.8f, 1.2f, -0.9f };");
+        harness.AppendLine("    float c[12] = { -0.2f, 1.1f, 0.0f, 0.3f, 0.4f, -0.7f, 0.9f, -0.1f, 0.6f, 0.2f, 1.3f, -0.8f };");
+        harness.AppendLine("    float vec[3] = { 1.0f, 2.0f, -3.0f };");
+        harness.AppendLine("    float vecOut[3] = { 0.0f, 0.0f, 0.0f };");
+        harness.AppendLine("    float quat[4] = { 0.2f, -0.5f, 0.3f, 0.7f };");
+        harness.AppendLine("    float zero34[12] = {};");
+        harness.AppendLine("    float zero44[16] = {};");
+
+        // PSMTXIdentity
+        harness.AppendLine("    { float got[12]; float exp[12]; RefIdentity(exp); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXIdentity_80199d04", new[] { "matA" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"PSMTXIdentity\"); }");
+
+        // PSMTXCopy
+        harness.AppendLine("    { float got[12]; WriteMat34(matA, a); WriteMat34(matB, b);");
+        EmitCall(harness, specs, "PSMTXCopy_80199d30", new[] { "matA", "matB" });
+        harness.AppendLine("      ReadMat34(matB, got); ExpectMat34(got, a, \"PSMTXCopy\"); }");
+
+        // PSMTXConcat
+        harness.AppendLine("    { float got[12]; float exp[12]; RefConcat(a, b, exp); WriteMat34(matA, a); WriteMat34(matB, b);");
+        EmitCall(harness, specs, "PSMTXConcat_80199d64", new[] { "matA", "matB", "matC" });
+        harness.AppendLine("      ReadMat34(matC, got); ExpectMat34(got, exp, \"PSMTXConcat\"); }");
+
+        // PSMTXConcatArray
+        harness.AppendLine("    { float got[24]; float exp[24]; WriteMat34(matA, a); WriteMat34(matArr, b); WriteMat34(matArr + 0x30, c);\n      RefConcat(a, b, exp);\n      RefConcat(a, c, exp + 12);\n      for (int i = 0; i < 24; ++i) got[i] = 0.0f;\n      WriteMat34(matC, zero34);\n      WriteMat34(matC + 0x30, zero34);\n      ");
+        EmitCall(harness, specs, "PSMTXConcatArray_80199e30", new[] { "matA", "matArr", "matC", "2" });
+        harness.AppendLine("      ReadMat34(matC, got); ReadMat34(matC + 0x30, got + 12); ExpectMat34(got, exp, \"PSMTXConcatArray[0]\"); ExpectMat34(got + 12, exp + 12, \"PSMTXConcatArray[1]\"); }");
+
+        // PSMTXInverse
+        harness.AppendLine("    { float got[12]; float exp[12]; WriteMat34(matA, a);\n      bool ok = RefInverse(a, exp);\n      assert(ok);\n");
+        EmitCall(harness, specs, "PSMTXInverse_80199fc8", new[] { "matA", "matB" }, resultVar: "ret");
+        harness.AppendLine("      ReadMat34(matB, got); ExpectMat34(got, exp, \"PSMTXInverse\"); assert(ret == 1); }");
+
+        // PSMTXInvXpose
+        harness.AppendLine("    { float got[12]; float exp[12]; WriteMat34(matA, a);\n      bool ok = RefInvXpose(a, exp);\n      assert(ok);\n");
+        EmitCall(harness, specs, "PSMTXInvXpose_8019a0c0", new[] { "matA", "matB" }, resultVar: "ret");
+        harness.AppendLine("      ReadMat34(matB, got); ExpectMat34(got, exp, \"PSMTXInvXpose\"); assert(ret == 1); }");
+
+        // PSMTXRotRad
+        harness.AppendLine("    { float got[12]; float exp[12]; const float rad = 0.7f; RefRotRad(exp, 'y', rad);\n      WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXRotRad_8019a188", new[] { "matA", "'y'", "rad" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"PSMTXRotRad\"); }");
+
+        // PSMTXRotTrig (test x,y,z)
+        harness.AppendLine("    { float got[12]; float exp[12]; const float rad = 0.4f; const float s = sinf(rad); const float c = cosf(rad);\n");
+        harness.AppendLine("      RefRotTrig(exp, 'x', s, c); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXRotTrig_8019a204", new[] { "matA", "'x'", "s", "c" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"PSMTXRotTrigX\");\n      RefRotTrig(exp, 'z', s, c); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXRotTrig_8019a204", new[] { "matA", "'z'", "s", "c" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"PSMTXRotTrigZ\"); }");
+
+        // PSMTXRotAxisRadInternal
+        harness.AppendLine("    { float got[12]; float exp[12]; float axis[3] = { 1.0f, 2.0f, 3.0f }; const float rad = 0.9f;\n      const float s = sinf(rad); const float c0 = cosf(rad); RefRotAxisRadInternal(exp, axis, s, c0);\n      WriteVec3(vecA, axis); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXRotAxisRadInternal_8019a2b4", new[] { "matA", "vecA", "s", "c0" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"PSMTXRotAxisRadInternal\"); }");
+
+        // PSMTXRotAxisRad
+        harness.AppendLine("    { float got[12]; float exp[12]; float axis[3] = { -0.5f, 1.3f, 0.8f }; const float rad = -0.6f; RefRotAxisRad(exp, axis, rad);\n      WriteVec3(vecA, axis); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXRotAxisRad_8019a364", new[] { "matA", "vecA", "rad" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"PSMTXRotAxisRad\"); }");
+
+        // PSMTXTrans
+        harness.AppendLine("    { float got[12]; float exp[12]; RefTrans(exp, 1.5f, -2.0f, 0.75f);\n      WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXTrans_8019a3e0", new[] { "matA", "1.5f", "-2.0f", "0.75f" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"PSMTXTrans\"); }");
+
+        // PSMTXTransApply
+        harness.AppendLine("    { float got[12]; float exp[12]; RefTransApply(a, exp, 0.25f, -0.5f, 1.2f); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXTransApply_8019a414", new[] { "matA", "matB", "0.25f", "-0.5f", "1.2f" });
+        harness.AppendLine("      ReadMat34(matB, got); ExpectMat34(got, exp, \"PSMTXTransApply\"); }");
+
+        // PSMTXScale
+        harness.AppendLine("    { float got[12]; float exp[12]; RefScale(exp, 2.0f, 0.5f, -1.5f); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXScale_8019a460", new[] { "matA", "2.0f", "0.5f", "-1.5f" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"PSMTXScale\"); }");
+
+        // PSMTXScaleApply
+        harness.AppendLine("    { float got[12]; float exp[12]; RefScaleApply(a, exp, 1.1f, -0.7f, 0.6f); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXScaleApply_8019a488", new[] { "matA", "matB", "1.1f", "-0.7f", "0.6f" });
+        harness.AppendLine("      ReadMat34(matB, got); ExpectMat34(got, exp, \"PSMTXScaleApply\"); }");
+
+        // PSMTXQuat
+        harness.AppendLine("    { float got[12]; float exp[12]; RefQuat(exp, quat);\n      WriteF32(quatA + 0, quat[0]); WriteF32(quatA + 4, quat[1]); WriteF32(quatA + 8, quat[2]); WriteF32(quatA + 12, quat[3]);\n      WriteMat34(matA, a);");
+        EmitCall(harness, specs, "PSMTXQuat_8019a4e0", new[] { "matA", "quatA" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"PSMTXQuat\"); }");
+
+        // C_MTXLookAt
+        harness.AppendLine("    { float got[12]; float exp[12]; float camPos[3] = { 1.0f, 2.0f, 3.0f }; float camUp[3] = { 0.0f, 1.0f, 0.0f }; float target[3] = { 0.0f, 0.0f, 0.0f };\n      RefLookAt(exp, camPos, camUp, target); WriteVec3(vecA, camPos); WriteVec3(vecB, camUp); WriteVec3(vecC, target);\n      WriteMat34(matA, a);");
+        EmitCall(harness, specs, "C_MTXLookAt_8019a584", new[] { "matA", "vecA", "vecB", "vecC" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"C_MTXLookAt\"); }");
+
+        // C_MTXLightPerspective
+        harness.AppendLine("    { float got[12]; float exp[12]; RefLightPerspective(exp, 30.0f, 1.2f, 0.5f, 0.75f, 0.5f, 0.25f); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "C_MTXLightPerspective_8019a79c", new[] { "matA", "30.0f", "1.2f", "0.5f", "0.75f", "0.5f", "0.25f" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"C_MTXLightPerspective\"); }");
+
+        // C_MTXLightFrustum (with stack arg for transT)
+        harness.AppendLine("    { float got[12]; float exp[12]; RefLightFrustum(exp, 1.2f, -0.8f, -1.0f, 1.4f, 0.6f, 0.5f, 0.5f, 0.4f, 0.6f); WriteMat34(matA, a);\n      WriteF32(g_cpu.gpr[1] + 8, 0.6f);");
+        EmitCall(harness, specs, "C_MTXLightFrustum_8019a6f8", new[] { "matA", "1.2f", "-0.8f", "-1.0f", "1.4f", "0.6f", "0.5f", "0.5f", "0.4f" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"C_MTXLightFrustum\"); }");
+
+        // C_MTXLightOrtho
+        harness.AppendLine("    { float got[12]; float exp[12]; RefLightOrtho(exp, 1.0f, -1.0f, -2.0f, 2.0f, 0.5f, 0.7f, 0.2f, 0.3f); WriteMat34(matA, a);");
+        EmitCall(harness, specs, "C_MTXLightOrtho_8019a894", new[] { "matA", "1.0f", "-1.0f", "-2.0f", "2.0f", "0.5f", "0.7f", "0.2f", "0.3f" });
+        harness.AppendLine("      ReadMat34(matA, got); ExpectMat34(got, exp, \"C_MTXLightOrtho\"); }");
+
+        // PSMTXMultVec
+        harness.AppendLine("    { float got[3]; float exp[3]; RefMultVec(a, vec, exp); WriteMat34(matA, a); WriteVec3(vecA, vec);\n");
+        EmitCall(harness, specs, "PSMTXMultVec_8019a91c", new[] { "matA", "vecA", "vecB" });
+        harness.AppendLine("      ReadVec3(vecB, got); for (int i = 0; i < 3; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSMTXMultVec mismatch %d\\n\", i); assert(false);} } }");
+
+        // PSMTXMultVecSR
+        harness.AppendLine("    { float got[3]; float exp[3]; RefMultVecSR(a, vec, exp); WriteMat34(matA, a); WriteVec3(vecA, vec);\n");
+        EmitCall(harness, specs, "PSMTXMultVecSR_8019a970", new[] { "matA", "vecA", "vecB" });
+        harness.AppendLine("      ReadVec3(vecB, got); for (int i = 0; i < 3; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSMTXMultVecSR mismatch %d\\n\", i); assert(false);} } }");
+
+        // C_MTXFrustum
+        harness.AppendLine("    { float got[16]; float exp[16]; RefFrustum(exp, 1.0f, -1.0f, -1.5f, 1.5f, 1.0f, 10.0f);\n      WriteMat44(mat44A, zero44);");
+        EmitCall(harness, specs, "C_MTXFrustum_8019a9c4", new[] { "mat44A", "1.0f", "-1.0f", "-1.5f", "1.5f", "1.0f", "10.0f" });
+        harness.AppendLine("      ReadMat44(mat44A, got); ExpectMat44(got, exp, \"C_MTXFrustum\"); }");
+
+        // C_MTXPerspective
+        harness.AppendLine("    { float got[16]; float exp[16]; RefPerspective(exp, 60.0f, 1.3333f, 1.0f, 100.0f);\n      WriteMat44(mat44A, zero44);");
+        EmitCall(harness, specs, "C_MTXPerspective_8019aa60", new[] { "mat44A", "60.0f", "1.3333f", "1.0f", "100.0f" });
+        harness.AppendLine("      ReadMat44(mat44A, got); ExpectMat44(got, exp, \"C_MTXPerspective\"); }");
+
+        // C_MTXOrtho
+        harness.AppendLine("    { float got[16]; float exp[16]; RefOrtho(exp, 1.0f, -1.0f, -2.0f, 2.0f, 0.5f, 20.0f);\n      WriteMat44(mat44A, zero44);");
+        EmitCall(harness, specs, "C_MTXOrtho_8019ab4c", new[] { "mat44A", "1.0f", "-1.0f", "-2.0f", "2.0f", "0.5f", "20.0f" });
+        harness.AppendLine("      ReadMat44(mat44A, got); ExpectMat44(got, exp, \"C_MTXOrtho\"); }");
+
+        // MTX__PSVECAdd
+        harness.AppendLine("    { float aV[3] = { 1.0f, 2.0f, 3.0f }; float bV[3] = { 4.0f, -5.0f, 6.0f }; float got[3]; float exp[3] = { 5.0f, -3.0f, 9.0f };");
+        harness.AppendLine("      WriteVec3(vecA, aV); WriteVec3(vecB, bV);");
+        EmitCall(harness, specs, "MTX__PSVECAdd_8019abe4", new[] { "vecA", "vecB", "vecC" });
+        harness.AppendLine("      ReadVec3(vecC, got); for (int i = 0; i < 3; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSVECAdd mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__PSVECScale
+        harness.AppendLine("    { float src[3] = { 1.5f, -2.0f, 3.0f }; float got[3]; float exp[3] = { 3.0f, -4.0f, 6.0f };");
+        harness.AppendLine("      WriteVec3(vecA, src);");
+        EmitCall(harness, specs, "MTX__PSVECScale_8019ac08", new[] { "vecA", "vecB", "2.0f" });
+        harness.AppendLine("      ReadVec3(vecB, got); for (int i = 0; i < 3; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSVECScale mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__PSVECNormalize
+        harness.AppendLine("    { float src[3] = { 3.0f, 4.0f, 0.0f }; float got[3]; float exp[3]; VecNormalize(src, exp);");
+        harness.AppendLine("      WriteVec3(vecA, src);");
+        EmitCall(harness, specs, "MTX__PSVECNormalize_8019ac24", new[] { "vecA", "vecB" });
+        harness.AppendLine("      ReadVec3(vecB, got); for (int i = 0; i < 3; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSVECNormalize mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__PSVECMag
+        harness.AppendLine("    { float src[3] = { 3.0f, 4.0f, 0.0f }; WriteVec3(vecA, src);");
+        EmitCall(harness, specs, "MTX__PSVECMag_8019ac68", new[] { "vecA" });
+        harness.AppendLine("      const float got = ReadFprFloat(g_cpu, 1); const float exp = VecMag(src); if (!Near(got, exp)) { std::printf(\"[mtx] PSVECMag mismatch got %.6f exp %.6f\\n\", got, exp); assert(false); } }");
+
+        // MTX__PSVECDotProduct
+        harness.AppendLine("    { float aV[3] = { 1.0f, 2.0f, 3.0f }; float bV[3] = { 4.0f, -5.0f, 6.0f }; WriteVec3(vecA, aV); WriteVec3(vecB, bV);");
+        EmitCall(harness, specs, "MTX__PSVECDotProduct_8019acac", new[] { "vecA", "vecB" });
+        harness.AppendLine("      const float got = ReadFprPs0(g_cpu, 1); const float exp = VecDot(aV, bV); if (!Near(got, exp)) { std::printf(\"[mtx] PSVECDotProduct mismatch got %.6f exp %.6f\\n\", got, exp); assert(false); } }");
+
+        // MTX__PSVECCrossProduct
+        harness.AppendLine("    { float aV[3] = { 1.0f, 0.0f, 0.0f }; float bV[3] = { 0.0f, 1.0f, 0.0f }; float got[3]; float exp[3]; VecCross(aV, bV, exp);");
+        harness.AppendLine("      WriteVec3(vecA, aV); WriteVec3(vecB, bV);");
+        EmitCall(harness, specs, "MTX__PSVECCrossProduct_8019accc", new[] { "vecA", "vecB", "vecC" });
+        harness.AppendLine("      ReadVec3(vecC, got); for (int i = 0; i < 3; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSVECCrossProduct mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__C_VECHalfAngle
+        harness.AppendLine("    { float aV[3] = { 1.0f, 0.0f, 0.0f }; float bV[3] = { 0.0f, 1.0f, 0.0f }; float got[3]; float exp[3]; VecHalfAngle(aV, bV, exp);");
+        harness.AppendLine("      WriteVec3(vecA, aV); WriteVec3(vecB, bV);");
+        EmitCall(harness, specs, "MTX__C_VECHalfAngle_8019ad08", new[] { "vecA", "vecB", "vecC" });
+        harness.AppendLine("      ReadVec3(vecC, got); for (int i = 0; i < 3; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] C_VECHalfAngle mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__PSVECSquareDistance
+        harness.AppendLine("    { float aV[3] = { 1.0f, 2.0f, 3.0f }; float bV[3] = { 4.0f, -2.0f, 6.0f }; WriteVec3(vecA, aV); WriteVec3(vecB, bV);");
+        EmitCall(harness, specs, "MTX__PSVECSquareDistance_8019ade0", new[] { "vecA", "vecB" });
+        harness.AppendLine("      const float got = ReadFprPs0(g_cpu, 1); const float exp = VecSquareDistance(aV, bV); if (!Near(got, exp)) { std::printf(\"[mtx] PSVECSquareDistance mismatch got %.6f exp %.6f\\n\", got, exp); assert(false); } }");
+
+        // MTX__PSQUATMultiply
+        harness.AppendLine("    { float aQ[4] = { 0.1f, 0.2f, 0.3f, 0.9f }; float bQ[4] = { -0.3f, 0.5f, 0.1f, 0.8f }; float got[4]; float exp[4]; QuatMul(aQ, bQ, exp);");
+        harness.AppendLine("      WriteQuat(quatA, aQ); WriteQuat(quatB, bQ);");
+        EmitCall(harness, specs, "MTX__PSQUATMultiply_8019ae08", new[] { "quatA", "quatB", "quatC" });
+        harness.AppendLine("      ReadQuat(quatC, got); for (int i = 0; i < 4; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSQUATMultiply mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__PSQUATScale
+        harness.AppendLine("    { float src[4] = { 1.0f, -2.0f, 3.0f, -4.0f }; float got[4]; float exp[4] = { 0.5f, -1.0f, 1.5f, -2.0f };");
+        harness.AppendLine("      WriteQuat(quatA, src);");
+        EmitCall(harness, specs, "MTX__PSQUATScale_8019ae64", new[] { "quatA", "quatB", "0.5f" });
+        harness.AppendLine("      ReadQuat(quatB, got); for (int i = 0; i < 4; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSQUATScale mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__PSQUATDotProduct
+        harness.AppendLine("    { float aQ[4] = { 1.0f, 2.0f, 3.0f, 4.0f }; float bQ[4] = { -2.0f, 0.5f, 1.0f, -1.5f }; WriteQuat(quatA, aQ); WriteQuat(quatB, bQ);");
+        EmitCall(harness, specs, "MTX__PSQUATDotProduct_8019ae80", new[] { "quatA", "quatB" });
+        harness.AppendLine("      const float got = ReadFprPs0(g_cpu, 1); const float exp = QuatDot(aQ, bQ); if (!Near(got, exp)) { std::printf(\"[mtx] PSQUATDotProduct mismatch got %.6f exp %.6f\\n\", got, exp); assert(false); } }");
+
+        // MTX__PSQUATNormalize
+        harness.AppendLine("    { float src[4] = { 0.0f, 0.0f, 0.0f, 2.0f }; float got[4]; float exp[4]; QuatNormalize(src, exp);");
+        harness.AppendLine("      WriteQuat(quatA, src);");
+        EmitCall(harness, specs, "MTX__PSQUATNormalize_8019aea0", new[] { "quatA", "quatB" });
+        harness.AppendLine("      ReadQuat(quatB, got); for (int i = 0; i < 4; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSQUATNormalize mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__PSQUATInverse
+        harness.AppendLine("    { float src[4] = { 0.2f, -0.3f, 0.4f, 0.5f }; float got[4]; float exp[4]; QuatInverse(src, exp);");
+        harness.AppendLine("      WriteQuat(quatA, src);");
+        EmitCall(harness, specs, "MTX__PSQUATInverse_8019aef4", new[] { "quatA", "quatB" });
+        harness.AppendLine("      ReadQuat(quatB, got); for (int i = 0; i < 4; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] PSQUATInverse mismatch %d got %.6f exp %.6f\\n\", i, got[i], exp[i]); assert(false); } } }");
+
+        // MTX__C_QUATMtx
+        harness.AppendLine("    { float ident[12] = { 1.0f, 0.0f, 0.0f, 0.0f, 0.0f, 1.0f, 0.0f, 0.0f, 0.0f, 0.0f, 1.0f, 0.0f }; float got[4]; float exp[4] = { 0.0f, 0.0f, 0.0f, 1.0f };");
+        harness.AppendLine("      WriteMat34(matA, ident);");
+        EmitCall(harness, specs, "MTX__C_QUATMtx_8019af48", new[] { "quatA", "matA" });
+        harness.AppendLine("      ReadQuat(quatA, got); for (int i = 0; i < 4; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] C_QUATMtx mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__C_QUATLerp
+        harness.AppendLine("    { float aQ[4] = { 0.0f, 0.5f, 0.0f, 0.5f }; float bQ[4] = { 1.0f, -0.5f, 0.5f, 0.0f }; float got[4]; float exp[4]; QuatLerp(aQ, bQ, 0.25f, exp);");
+        harness.AppendLine("      WriteQuat(quatA, aQ); WriteQuat(quatB, bQ);");
+        EmitCall(harness, specs, "MTX__C_QUATLerp_8019b114", new[] { "quatA", "quatB", "quatC", "0.25f" });
+        harness.AppendLine("      ReadQuat(quatC, got); for (int i = 0; i < 4; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] C_QUATLerp mismatch %d\\n\", i); assert(false); } } }");
+
+        // MTX__C_QUATSlerp
+        harness.AppendLine("    { float aQ[4] = { 0.0f, 0.0f, 0.0f, 1.0f }; float bQ[4] = { 0.1f, 0.2f, 0.3f, 0.9f }; float got[4]; float exp[4]; QuatSlerp(aQ, bQ, 0.5f, exp);");
+        harness.AppendLine("      WriteQuat(quatA, aQ); WriteQuat(quatB, bQ);");
+        EmitCall(harness, specs, "MTX__C_QUATSlerp_8019b178", new[] { "quatA", "quatB", "quatC", "0.5f" });
+        harness.AppendLine("      ReadQuat(quatC, got); for (int i = 0; i < 4; ++i) { if (!Near(got[i], exp[i])) { std::printf(\"[mtx] C_QUATSlerp mismatch %d\\n\", i); assert(false); } } }");
+
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+
+        var harnessPath = Path.Combine(tempRoot, "harness_mtx.cpp");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var root = RepositoryRoot;
+        var runnerBasePath = Path.Combine(tempRoot, "runner_mtx");
+        var compileArgs = TranslatorCppTestHarness.BuildCompileArguments(root, tempRoot, generatedFiles, harnessPath, runnerBasePath);
+        compileArgs += " -ldbghelp";
+
+        Console.WriteLine("[compile] clang++ (mtx)");
+        var (exitCode, compileOutput) = RunProcess("clang++", compileArgs.ToString());
+        Assert.True(exitCode == 0, $"clang++ failed: {compileOutput}");
+
+        var runnerPath = runnerBasePath;
+        if (OperatingSystem.IsWindows() && !File.Exists(runnerPath))
+        {
+            runnerPath += ".exe";
+        }
+
+        Console.WriteLine($"[run] {runnerPath}");
+        var (runExitCode, runOutput) = RunProcess(runnerPath, string.Empty, TimeSpan.FromSeconds(60));
+        Console.Write(runOutput);
+        Assert.True(runExitCode == 0, $"Runner failed (exit code {runExitCode}). Output:\n{runOutput}");
+    }
+
+    /// <summary>
+    /// Leaf-inlining admission checked against real MTX bodies. Stackless primitives stay eligible,
+    /// while <c>PSMTXConcat</c> must not: its 64-byte r1 frame is unsafe to splice into a caller's stack analysis.
+    /// </summary>
+    [Fact]
+    public void LeafInliningRejectsStackFramedMatrixPrimitives()
+    {
+        var translator = BuildTranslator();
+        var options = TranslationOptions.Default with
+        {
+            AllowUnsupportedInstructions = true
+        };
+
+        LeafInlineCandidate? Classify(uint address, LeafInliningPolicy policy, out LeafInlineRejection rejection)
+        {
+            var translation = translator.Translate(address, options);
+            return LeafFunctionInliner.TryCreateCandidate(
+                address, translation.LinearIr, translation.Instructions, policy, out rejection);
+        }
+
+        var shipped = new LeafInliningPolicy(
+            MaxCalleeGuestInstructions: TranslationOptions.Default.LeafInliningMaxCalleeInstructions);
+        var oldCap = new LeafInliningPolicy(MaxCalleeGuestInstructions: 32);
+
+        // PSMTXCopy was admitted before the cap moved and must be admitted in
+        // exactly the same form afterwards - a flat statement list, not a
+        // spliced region - or every caller that already inlines it changes.
+        var copy = Classify(0x80199D30u, shipped, out var copyRejection);
+        Assert.Equal(LeafInlineRejection.None, copyRejection);
+        Assert.NotNull(copy);
+        Assert.Null(copy!.Blocks);
+        Assert.Equal(13, copy.GuestInstructionCount);
+        Classify(0x80199D30u, oldCap, out var copyAtOldCap);
+        Assert.Equal(LeafInlineRejection.None, copyAtOldCap);
+
+        var concat = Classify(0x80199D64u, shipped, out var concatRejection);
+        Assert.Equal(LeafInlineRejection.TouchesStackPointer, concatRejection);
+        Assert.Null(concat);
+        Classify(0x80199D64u, oldCap, out var concatAtOldCap);
+        Assert.Equal(LeafInlineRejection.TooLarge, concatAtOldCap);
+    }
+
+    /// <summary>
+    /// <c>nw4r::ut::List_GetNext</c> is the acyclic multi-block case: eight guest instructions across
+    /// four blocks, a compare/branch and two return arms that must converge on one caller continuation.
+    /// </summary>
+    [Fact]
+    public void LeafInliningAdmitsAnAcyclicMultiBlockListWalker()
+    {
+        var translator = BuildTranslator();
+        var options = TranslationOptions.Default with
+        {
+            AllowUnsupportedInstructions = true
+        };
+        var translation = translator.Translate(0x800AF180u, options);
+
+        var candidate = LeafFunctionInliner.TryCreateCandidate(
+            0x800AF180u,
+            translation.LinearIr,
+            translation.Instructions,
+            new LeafInliningPolicy(),
+            out var rejection);
+
+        Assert.Equal(LeafInlineRejection.None, rejection);
+        Assert.NotNull(candidate);
+        Assert.Equal(8, candidate!.GuestInstructionCount);
+        Assert.NotNull(candidate.Blocks);
+        Assert.Equal(4, candidate.Blocks!.Count);
+        Assert.Equal(2, candidate.Blocks.Count(block => block.Instructions[^1] is IrReturn));
+        // Every block leaves through an explicit terminator, so the spliced copy
+        // does not depend on where the caller places these blocks.
+        Assert.All(
+            candidate.Blocks,
+            block => Assert.True(block.Instructions[^1] is IrReturn or IrJump or IrBranch));
+
+        // Turning the shape off puts the callee straight back outside the
+        // admissible set.
+        LeafFunctionInliner.TryCreateCandidate(
+            0x800AF180u,
+            translation.LinearIr,
+            translation.Instructions,
+            new LeafInliningPolicy(AllowAcyclicMultiBlockCallees: false),
+            out var withoutMultiBlock);
+        Assert.Equal(LeafInlineRejection.ControlFlow, withoutMultiBlock);
+    }
+
+    /// <summary>
+    /// <c>EGG::Math::Sqrt</c> looked like a multi-block leaf from a profile, but
+    /// it saves the link register and calls out, so no relaxation of the block
+    /// shape can admit it. Pinned so a future rule change has to notice.
+    /// </summary>
+    [Fact]
+    public void EggMathSqrtIsNotALeafAndStaysRefused()
+    {
+        var translator = BuildTranslator();
+        var options = TranslationOptions.Default with
+        {
+            AllowUnsupportedInstructions = true
+        };
+        var translation = translator.Translate(0x8022F80Cu, options);
+
+        LeafFunctionInliner.TryCreateCandidate(
+            0x8022F80Cu,
+            translation.LinearIr,
+            translation.Instructions,
+            new LeafInliningPolicy(),
+            out var rejection);
+
+        Assert.Equal(LeafInlineRejection.TouchesLinkRegister, rejection);
+    }
+
+    private static MtxFuncSpec Spec(uint address, string name, ReturnKind ret, params ParamKind[] paramKinds)
+        => new(address, name, ret, paramKinds);
+
+    private static void AssertReturnAbiMatches(MtxFuncSpec spec, FunctionAbiClassification classification)
+    {
+        if (spec.Return == ReturnKind.Void)
+        {
+            var isFloatReturn = classification.ReturnRepresentation is ValueRepresentation prim && prim.IsFloat;
+            Assert.False(isFloatReturn, $"{spec.Name} expected non-float return, got {classification.ReturnRepresentation}.");
+        }
+        else if (spec.Return == ReturnKind.Float)
+        {
+            Assert.True(classification.ReturnRepresentation is ValueRepresentation prim && prim.IsFloat,
+                $"{spec.Name} expected float return, got {classification.ReturnRepresentation}.");
+        }
+        else
+        {
+            Assert.True(classification.ReturnRepresentation is ValueRepresentation prim && !prim.IsFloat,
+                $"{spec.Name} expected integer return, got {classification.ReturnRepresentation}.");
+        }
+    }
+
+    private static IReadOnlyList<FunctionTranslationResult> TranslateWithDependencies(
+        FunctionTranslator translator,
+        IEnumerable<(uint Address, string Name)> seeds,
+        string outputDirectory,
+        List<string> generatedFiles)
+    {
+        const int MaxTranslations = 256;
+        var translations = new List<FunctionTranslationResult>();
+        var scheduled = new HashSet<uint>();
+        var translated = new HashSet<uint>();
+        var queue = new Queue<(uint Address, string Name)>();
+
+        foreach (var spec in seeds)
+        {
+            if (scheduled.Add(spec.Address))
+            {
+                queue.Enqueue(spec);
+            }
+        }
+
+        while (queue.Count > 0)
+        {
+            if (scheduled.Count > MaxTranslations)
+            {
+                throw new InvalidOperationException($"Auto-translation queue exceeded {MaxTranslations} functions. Check for runaway dependency discovery.");
+            }
+
+            var spec = queue.Dequeue();
+            if (translated.Contains(spec.Address))
+            {
+                continue;
+            }
+
+            var preferredName = string.IsNullOrWhiteSpace(spec.Name) ? $"func_{spec.Address:X8}" : spec.Name;
+            Console.WriteLine($"[translate] {preferredName} 0x{spec.Address:X8}");
+            var result = translator.Translate(spec.Address, new TranslationOptions(preferredName));
+
+            var classification = result.AbiClassification;
+            Console.WriteLine($"  [abi] {classification.Name} -> {classification.ReturnRepresentation}");
+
+            var path = Path.Combine(outputDirectory, $"{result.Name}.cpp");
+            File.WriteAllText(path, result.CxxCode);
+            generatedFiles.Add(path);
+            translations.Add(result);
+            translated.Add(result.EntryPoint);
+
+            foreach (var dependency in DiscoverCallTargets(result))
+            {
+                if (translated.Contains(dependency))
+                {
+                    continue;
+                }
+
+                if (scheduled.Add(dependency))
+                {
+                    queue.Enqueue((dependency, $"func_{dependency:X8}"));
+                }
+            }
+        }
+
+        return translations;
+    }
+
+    private static IEnumerable<uint> DiscoverCallTargets(FunctionTranslationResult translation)
+    {
+        var discovered = new HashSet<uint>();
+        foreach (var block in translation.LinearIr.Blocks)
+        {
+            foreach (var instruction in block.Instructions)
+            {
+                if (instruction is not IrCall call)
+                {
+                    continue;
+                }
+
+                if (string.IsNullOrWhiteSpace(call.Target) || !call.Target.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+                {
+                    continue;
+                }
+
+                if (!uint.TryParse(call.Target.Substring(2), NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var address))
+                {
+                    continue;
+                }
+
+                if (address == translation.EntryPoint)
+                {
+                    continue;
+                }
+
+                if (discovered.Add(address))
+                {
+                    yield return address;
+                }
+            }
+        }
+    }
+
+    private static string PrototypeFor(FunctionAbiClassification signature)
+    {
+        return $"extern \"C\" void {signature.Name}(CpuContext* ctx);";
+    }
+
+    private static void EmitCall(StringBuilder sb, IReadOnlyList<MtxFuncSpec> specs, string name, string[] args, string? resultVar = null)
+    {
+        var spec = specs.Single(s => s.Name == name);
+        var gprIndex = 3;
+        var fprIndex = 1;
+
+        for (int i = 0; i < spec.Params.Count; i++)
+        {
+            var arg = args.Length > i ? args[i] : "0";
+            if (spec.Params[i] == ParamKind.Fpr)
+            {
+                sb.AppendLine($"      g_cpu.fpr[{fprIndex}].d = {arg};");
+                fprIndex++;
+            }
+            else
+            {
+                sb.AppendLine($"      g_cpu.gpr[{gprIndex}] = ToGpr({arg});");
+                gprIndex++;
+            }
+        }
+
+        sb.AppendLine($"      {name}(&g_cpu);");
+        if (!string.IsNullOrWhiteSpace(resultVar))
+        {
+            sb.AppendLine($"      auto {resultVar} = g_cpu.gpr[3];");
+        }
+    }
+}
diff --git a/translator/tests/Translator.Tests/OverlayFunctionBuilderTests.cs b/translator/tests/Translator.Tests/OverlayFunctionBuilderTests.cs
new file mode 100644
index 0000000..8b54df0
--- /dev/null
+++ b/translator/tests/Translator.Tests/OverlayFunctionBuilderTests.cs
@@ -0,0 +1,79 @@
+using System.Buffers.Binary;
+using Translator.Core.Mods;
+using Translator.Core.Parsing.Kamek;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class OverlayFunctionBuilderTests
+{
+    [Fact]
+    public void BuildAndWriteAppliesModuleAndBaseOverlayPatches()
+    {
+        var tempRoot = Path.Combine(Path.GetTempPath(), "mkw_overlay_test_" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(tempRoot);
+        try
+        {
+            var baseDir = Path.Combine(tempRoot, "base");
+            var outDir = Path.Combine(tempRoot, "out");
+            Directory.CreateDirectory(baseDir);
+            Directory.CreateDirectory(outDir);
+
+            var baseImage = new byte[0x10];
+            File.WriteAllBytes(Path.Combine(baseDir, "base_text.bin"), baseImage);
+
+            const uint moduleBase = 0x81200000u;
+            var chunk = new KamekChunk(
+                0,
+                0,
+                0,
+                0x10,
+                0,
+                0,
+                0x30,
+                new byte[0x10],
+                [
+                    new KamekCommand(0, 0, KamekCommandId.Write32, false, 0x4, [0xDEADBEEFu]),
+                    new KamekCommand(4, 0, KamekCommandId.BranchLink, true, 0x80001004u, [0x100u]),
+                    new KamekCommand(8, 0, KamekCommandId.Write32, true, 0x80001008u, [0x60000000u])
+                ]);
+
+            var manifest = new BaseManifest(
+                "test",
+                1,
+                "RMCP01",
+                "P",
+                "",
+                0,
+                [
+                    new BaseSectionMetadata(".text", "main.dol", 0x80001000u, 0x80001010u, true, false, "base_text.bin", 0)
+                ],
+                [
+                    new BaseFunctionRangeMetadata(0x80001000u, 0x80001010u, "func_80001000", ".text", 0, "test", ["Executable"])
+                ],
+                "ranges.json");
+
+            var plan = KamekPatchPlanner.Build(chunk, manifest, moduleBase);
+            var result = OverlayFunctionBuilder.BuildAndWrite(chunk, manifest, plan, baseDir, outDir);
+
+            var moduleImage = File.ReadAllBytes(Path.Combine(outDir, "overlay_images", result.ModuleImageFile));
+            Assert.Equal(0xDEADBEEFu, BinaryPrimitives.ReadUInt32BigEndian(moduleImage.AsSpan(4, 4)));
+
+            var overlay = Assert.Single(result.OverlayFunctions);
+            var overlayImage = File.ReadAllBytes(Path.Combine(outDir, "overlay_images", overlay.ImageFile));
+            Assert.Equal(
+                KamekPpcEncoding.EncodeBranch(0x80001004u, moduleBase + 0x100u, link: true),
+                BinaryPrimitives.ReadUInt32BigEndian(overlayImage.AsSpan(4, 4)));
+            Assert.Equal(0x60000000u, BinaryPrimitives.ReadUInt32BigEndian(overlayImage.AsSpan(8, 4)));
+            Assert.Equal(2, overlay.PatchCount);
+            Assert.Empty(result.Diagnostics);
+        }
+        finally
+        {
+            if (Directory.Exists(tempRoot))
+            {
+                Directory.Delete(tempRoot, recursive: true);
+            }
+        }
+    }
+}
diff --git a/translator/tests/Translator.Tests/PairedFlowCodeGenTests.cs b/translator/tests/Translator.Tests/PairedFlowCodeGenTests.cs
new file mode 100644
index 0000000..0279a63
--- /dev/null
+++ b/translator/tests/Translator.Tests/PairedFlowCodeGenTests.cs
@@ -0,0 +1,155 @@
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+
+namespace Translator.Tests;
+
+public sealed class PairedFlowCodeGenTests
+{
+    [Fact]
+    public void MixedScalarAndPairedPredecessorsNormalizeLiveFprOnTheEdge()
+    {
+        var function = new IrFunction(
+            "mixed_ps_merge",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrBranch("beq", "paired", "scalar")
+                }),
+                new IrBasicBlock("paired", new IrInstruction[]
+                {
+                    new IrCall("f5", "PPC_PsMul", new[]
+                    {
+                        IrValue.Register("f1"), IrValue.Register("f2")
+                    }),
+                    new IrJump("merge")
+                }),
+                new IrBasicBlock("scalar", new IrInstruction[]
+                {
+                    new IrAssign("f5", IrValue.Register("f3")),
+                    new IrJump("merge")
+                }),
+                new IrBasicBlock("merge", new IrInstruction[]
+                {
+                    new IrCall("f6", "PPC_PsNeg", new[] { IrValue.Register("f5") }),
+                    new IrReturn(null)
+                })
+            });
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64,
+            ["f5"] = ValueRepresentation.Float64,
+            ["f6"] = ValueRepresentation.Float64,
+            ["cr0"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("mixed_ps_merge", ValueRepresentation.Void);
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006000, new SsaTransformer().Convert(function), signature, types);
+
+        Assert.Contains(
+            "f5.d = PPC_PsToScalarInline(f5.d);",
+            code,
+            StringComparison.Ordinal);
+        Assert.Contains(
+            "PPC_PsNegInline(PPC_PsFromScalarInline(f5.d))",
+            code,
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FloatingCrCompareExtractsPs0FromPairedOperands()
+    {
+        var function = new IrFunction("paired_fcmp", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall("f2", "PPC_PsMul", new[] { IrValue.Register("f3"), IrValue.Register("f4") }),
+                new IrCall("f5", "PPC_PsAdd", new[] { IrValue.Register("f6"), IrValue.Register("f7") }),
+                new IrSetCrField(0, IrValue.Register("f2"), IrValue.Register("f5"), false),
+                new IrReturn(null)
+            })
+        });
+        var types = new RepresentationEnvironment(Enumerable.Range(0, 8)
+            .ToDictionary(index => $"f{index}", _ => (ValueRepresentation)ValueRepresentation.Float64));
+        var signature = new FunctionAbiClassification("paired_fcmp", ValueRepresentation.Void);
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006004, new SsaTransformer().Convert(function), signature, types);
+
+        Assert.Contains(
+            "SetCRFloatResident(cr, 0, PPC_PsToScalarInline(f2.d), PPC_PsToScalarInline(f5.d));",
+            code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FloatingCrCompareLeavesScalarOperandsUnchanged()
+    {
+        var function = new IrFunction("scalar_fcmp", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(3, IrValue.Register("f1"), IrValue.Register("f2"), false),
+                new IrReturn(null)
+            })
+        });
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64
+        });
+        var signature = new FunctionAbiClassification("scalar_fcmp", ValueRepresentation.Void);
+
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006004, new SsaTransformer().Convert(function), signature, types);
+
+        Assert.Contains("SetCRFloatResident(cr, 3, f1.d, f2.d);", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ExternalEntryFprsStayScalarAcrossBackedge()
+    {
+        var function = new IrFunction(
+            "entry_backedge_ps_state",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrCall(string.Empty, "PPC_Fcmp", new[] { IrValue.Imm(0), IrValue.Register("f31"), IrValue.Register("f1") }),
+                    new IrBranch("beq", "loop", "exit")
+                }),
+                new IrBasicBlock("loop", new IrInstruction[]
+                {
+                    new IrCall("f31", "PPC_PsMul", new[] { IrValue.Register("f2"), IrValue.Register("f3") }),
+                    new IrJump("entry")
+                }),
+                new IrBasicBlock("exit", new IrInstruction[] { new IrReturn(null) })
+            });
+
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64,
+            ["f3"] = ValueRepresentation.Float64,
+            ["f31"] = ValueRepresentation.Float64,
+            ["cr0"] = ValueRepresentation.UInt32
+        });
+        var signature = new FunctionAbiClassification("entry_backedge_ps_state", ValueRepresentation.Void);
+
+        var ssa = new SsaTransformer().Convert(function);
+        var code = new CxxLinearCodeGenerator().Emit(0x80006008, ssa, signature, types);
+
+        // A raw "PPC_Fcmp" IrCall isn't normal decoder output, but residency treats it as a
+        // safety-net form of fcmpo/fcmpu and fuses it into the resident CR write like IrSetCrField,
+        // using the operands directly instead of PPC_PsToScalarInline (CxxLinearCodeGenerator.Inlines.cs "PPC_FCMP").
+        Assert.Contains("SetCRFloatResident(cr, 0, f31.d, f1.d);", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("SetCRFloatResident(cr, 0, PPC_PsToScalarInline(f31.d)", code, StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/PairedSingleLifterTests.cs b/translator/tests/Translator.Tests/PairedSingleLifterTests.cs
new file mode 100644
index 0000000..6b6f83d
--- /dev/null
+++ b/translator/tests/Translator.Tests/PairedSingleLifterTests.cs
@@ -0,0 +1,539 @@
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+using Translator.Core.Lifting;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PairedSingleLifterTests
+{
+    private static PpcRegisterOperand Fpr(int index) => new($"f{index}", index);
+    private static PpcRegisterOperand Gpr(int index) => new($"r{index}", index);
+
+    [Fact]
+    public void LiftsPsSum0UsingPpcHelperOperandOrder()
+    {
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "ps_sum0",
+            new PpcOperand[] { Fpr(1), Fpr(2), Fpr(3), Fpr(4) });
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var call = Assert.IsType<IrCall>(Assert.Single(ir));
+        Assert.Equal("f1", call.Destination);
+        Assert.Equal("PPC_PsSum0", call.Target);
+        Assert.Equal(new[] { "f2", "f4", "f3" }, call.Arguments.Select(a => a.RegisterName));
+    }
+
+    [Fact]
+    public void LiftsPsSelWithControlInSecondArgument()
+    {
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "ps_sel",
+            new PpcOperand[] { Fpr(1), Fpr(2), Fpr(3), Fpr(4) });
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var call = Assert.IsType<IrCall>(Assert.Single(ir));
+        Assert.Equal("PPC_PsSel", call.Target);
+        Assert.Equal(new[] { "f3", "f2", "f4" }, call.Arguments.Select(a => a.RegisterName));
+    }
+
+    [Fact]
+    public void LiftsRawOpcodeAliasForPsMul()
+    {
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0x106100B2u,
+            "opc_4_50",
+            System.Array.Empty<PpcOperand>());
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var call = Assert.IsType<IrCall>(Assert.Single(ir));
+        Assert.Equal("PPC_PsMul", call.Target);
+        Assert.Equal("f3", call.Destination);
+        Assert.Equal(new[] { "f1", "f2" }, call.Arguments.Select(a => a.RegisterName));
+    }
+
+    [Fact]
+    public void LiftsPsNegFromExplicitMnemonic()
+    {
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "ps_neg",
+            new PpcOperand[] { Fpr(4), Fpr(7) });
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var call = Assert.IsType<IrCall>(Assert.Single(ir));
+        Assert.Equal("f4", call.Destination);
+        Assert.Equal("PPC_PsNeg", call.Target);
+        Assert.Equal("f7", Assert.Single(call.Arguments).RegisterName);
+    }
+
+    [Fact]
+    public void LiftsPsqLoadWithAbsoluteBaseZeroAddress()
+    {
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "psq_l",
+            new PpcOperand[]
+            {
+                Fpr(2),
+                new PpcDisplacementOperand(0x24, "r0", 0),
+                new PpcImmediateOperand(1),
+                new PpcImmediateOperand(3)
+            });
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        Assert.Equal(3, ir.Count);
+        Assert.IsType<IrComment>(ir[0]);
+        var assign = Assert.IsType<IrAssign>(ir[1]);
+        Assert.Equal("f2_psq_ea", assign.Destination);
+        Assert.Equal(0x24, assign.Value.Constant);
+        var call = Assert.IsType<IrCall>(ir[2]);
+        Assert.Equal("PPC_PsqL", call.Target);
+        Assert.Equal("f2", call.Destination);
+        Assert.Equal(new long?[] { null, 1, 3 }, call.Arguments.Select(a => a.Constant).ToArray());
+    }
+
+    [Fact]
+    public void LiftsPsqStoreUpdateFormAndWritesBackBase()
+    {
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "psq_stu",
+            new PpcOperand[]
+            {
+                Fpr(2),
+                new PpcDisplacementOperand(0x10, "r4", 4),
+                new PpcImmediateOperand(0),
+                new PpcImmediateOperand(6)
+            });
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        Assert.Equal(4, ir.Count);
+        Assert.IsType<IrComment>(ir[0]);
+        var addr = Assert.IsType<IrBinary>(ir[1]);
+        Assert.Equal("r4_psq_ea", addr.Destination);
+        var store = Assert.IsType<IrCall>(ir[2]);
+        Assert.Equal("PPC_PsqSt", store.Target);
+        Assert.Equal("r4_psq_ea", store.Arguments[0].RegisterName);
+        Assert.Equal("f2", store.Arguments[1].RegisterName);
+        var writeback = Assert.IsType<IrAssign>(ir[3]);
+        Assert.Equal("r4", writeback.Destination);
+        Assert.Equal("r4_psq_ea", writeback.Value.RegisterName);
+    }
+
+    [Fact]
+    public void RejectsInvalidPsqUpdateWithR0Base()
+    {
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "psq_lu",
+            new PpcOperand[]
+            {
+                Fpr(1),
+                new PpcDisplacementOperand(4, "r0", 0),
+                new PpcImmediateOperand(0),
+                new PpcImmediateOperand(0)
+            });
+
+        Assert.Throws<InvalidOperationException>(() => new PpcLifter().Lift(new[] { instruction }));
+    }
+
+    [Fact]
+    public void LiftsPsCompareUsingCrFieldImmediate()
+    {
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "ps_cmpu1",
+            new PpcOperand[]
+            {
+                new PpcConditionRegisterOperand("cr7", 28),
+                Fpr(2),
+                Fpr(3)
+            });
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var call = Assert.IsType<IrCall>(Assert.Single(ir));
+        Assert.Equal("PPC_PsCmpu1", call.Target);
+        Assert.Equal(7, call.Arguments[0].Constant);
+        Assert.Equal("f2", call.Arguments[1].RegisterName);
+        Assert.Equal("f3", call.Arguments[2].RegisterName);
+    }
+
+    [Fact]
+    public void LiftsPsSelAliasAsPsNegWhenRawXformMatches()
+    {
+        var raw = (4u << 21) | (7u << 11) | (40u << 1);
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            raw,
+            "ps_sel",
+            new PpcOperand[] { Fpr(4), Fpr(1), Fpr(2), Fpr(3) });
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var call = Assert.IsType<IrCall>(Assert.Single(ir));
+        Assert.Equal("PPC_PsNeg", call.Target);
+        Assert.Equal("f4", call.Destination);
+        Assert.Equal("f7", Assert.Single(call.Arguments).RegisterName);
+    }
+
+    [Fact]
+    public void LiftsRawOpcodeVariantsForMaddsAndIndexedLoadStore()
+    {
+        var maddsRaw = (3u << 21) | (1u << 16) | (2u << 11) | (4u << 6);
+        var madds = PpcInstruction.Synthetic(0x80000000, maddsRaw, "opc_4_28", System.Array.Empty<PpcOperand>());
+        var maddsIr = Assert.Single(new PpcLifter().Lift(new[] { madds })).Ir;
+        var maddsCall = Assert.IsType<IrCall>(Assert.Single(maddsIr));
+        Assert.Equal("PPC_PsMadds0", maddsCall.Target);
+        Assert.Equal("f3", maddsCall.Destination);
+        Assert.Equal(new[] { "f1", "f4", "f2" }, maddsCall.Arguments.Select(a => a.RegisterName));
+
+        var loadRaw = (3u << 21) | (4u << 16) | (5u << 11) | (1u << 10) | (6u << 7);
+        var load = PpcInstruction.Synthetic(0x80000004, loadRaw, "opc_4_76", System.Array.Empty<PpcOperand>());
+        var loadIr = Assert.Single(new PpcLifter().Lift(new[] { load })).Ir;
+        Assert.Equal(3, loadIr.Count);
+        var loadCall = Assert.IsType<IrCall>(loadIr[1]);
+        Assert.Equal("PPC_PsqL", loadCall.Target);
+        Assert.Equal("f3", loadCall.Destination);
+        Assert.Equal(1, loadCall.Arguments[1].Constant);
+        Assert.Equal(6, loadCall.Arguments[2].Constant);
+        var loadWriteback = Assert.IsType<IrAssign>(loadIr[2]);
+        Assert.Equal("r4", loadWriteback.Destination);
+
+        var storeRaw = (2u << 21) | (4u << 16) | (5u << 11) | (1u << 10) | (3u << 7);
+        var store = PpcInstruction.Synthetic(0x80000008, storeRaw, "opc_4_78", System.Array.Empty<PpcOperand>());
+        var storeIr = Assert.Single(new PpcLifter().Lift(new[] { store })).Ir;
+        Assert.Equal(3, storeIr.Count);
+        var storeCall = Assert.IsType<IrCall>(storeIr[1]);
+        Assert.Equal("PPC_PsqSt", storeCall.Target);
+        Assert.Equal("f2", storeCall.Arguments[1].RegisterName);
+        Assert.Equal(1, storeCall.Arguments[2].Constant);
+        Assert.Equal(3, storeCall.Arguments[3].Constant);
+        var storeWriteback = Assert.IsType<IrAssign>(storeIr[2]);
+        Assert.Equal("r4", storeWriteback.Destination);
+    }
+
+    [Fact]
+    public void LiftsMergeAndScalarEstimateHelpers()
+    {
+        var merge = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "ps_merge10",
+            new PpcOperand[] { Fpr(1), Fpr(2), Fpr(3) });
+        var mergeIr = Assert.Single(new PpcLifter().Lift(new[] { merge })).Ir;
+        var mergeCall = Assert.IsType<IrCall>(Assert.Single(mergeIr));
+        Assert.Equal("PPC_PsMerge10", mergeCall.Target);
+
+        var res = PpcInstruction.Synthetic(
+            0x80000004,
+            0,
+            "ps_rsqrte",
+            new PpcOperand[] { Fpr(4), Fpr(5) });
+        var resIr = Assert.Single(new PpcLifter().Lift(new[] { res })).Ir;
+        var resCall = Assert.IsType<IrCall>(Assert.Single(resIr));
+        Assert.Equal("PPC_PsRsqrte", resCall.Target);
+        Assert.Equal("f4", resCall.Destination);
+
+        var nabs = PpcInstruction.Synthetic(
+            0x80000008,
+            0,
+            "ps_nabs",
+            new PpcOperand[] { Fpr(6), Fpr(7) });
+        var nabsIr = Assert.Single(new PpcLifter().Lift(new[] { nabs })).Ir;
+        var nabsCall = Assert.IsType<IrCall>(Assert.Single(nabsIr));
+        Assert.Equal("PPC_PsNabs", nabsCall.Target);
+        Assert.Equal("f6", nabsCall.Destination);
+    }
+
+    [Fact]
+    public void KeepsPairedMoveDistinctFromScalarFmr()
+    {
+        var move = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "ps_mr",
+            new PpcOperand[] { Fpr(2), Fpr(7) });
+        var moveIr = Assert.Single(new PpcLifter().Lift(new[] { move })).Ir;
+        var moveCall = Assert.IsType<IrCall>(Assert.Single(moveIr));
+
+        Assert.Equal("PPC_PsMr", moveCall.Target);
+        Assert.Equal("f2", moveCall.Destination);
+        Assert.Equal("f7", Assert.Single(moveCall.Arguments).RegisterName);
+    }
+
+    [Fact]
+    public void LiftsDotVariantsForPairedSingleArithmetic()
+    {
+        var div = PpcInstruction.Synthetic(
+            0x7FFFFFFC,
+            0,
+            "ps_div.",
+            new PpcOperand[] { Fpr(1), Fpr(2), Fpr(3) });
+        var divIr = Assert.Single(new PpcLifter().Lift(new[] { div })).Ir;
+        var divCall = Assert.IsType<IrCall>(Assert.Single(divIr));
+        Assert.Equal("PPC_PsDiv", divCall.Target);
+        Assert.Equal(new[] { "f2", "f3" }, divCall.Arguments.Select(a => a.RegisterName));
+
+        var madds0 = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "ps_madds0.",
+            new PpcOperand[] { Fpr(1), Fpr(2), Fpr(3), Fpr(4) });
+        var madds0Ir = Assert.Single(new PpcLifter().Lift(new[] { madds0 })).Ir;
+        Assert.Equal("PPC_PsMadds0", Assert.IsType<IrCall>(Assert.Single(madds0Ir)).Target);
+
+        var madds1 = PpcInstruction.Synthetic(
+            0x80000004,
+            0,
+            "ps_madds1.",
+            new PpcOperand[] { Fpr(1), Fpr(2), Fpr(3), Fpr(4) });
+        var madds1Ir = Assert.Single(new PpcLifter().Lift(new[] { madds1 })).Ir;
+        var madds1Call = Assert.IsType<IrCall>(Assert.Single(madds1Ir));
+        Assert.Equal("PPC_PsMadds1", madds1Call.Target);
+        Assert.Equal(new[] { "f2", "f3", "f4" }, madds1Call.Arguments.Select(a => a.RegisterName));
+
+        var sum0 = PpcInstruction.Synthetic(
+            0x80000008,
+            0,
+            "ps_sum0.",
+            new PpcOperand[] { Fpr(5), Fpr(6), Fpr(7), Fpr(8) });
+        var sum0Ir = Assert.Single(new PpcLifter().Lift(new[] { sum0 })).Ir;
+        var sum0Call = Assert.IsType<IrCall>(Assert.Single(sum0Ir));
+        Assert.Equal("PPC_PsSum0", sum0Call.Target);
+        Assert.Equal(new[] { "f6", "f8", "f7" }, sum0Call.Arguments.Select(a => a.RegisterName));
+
+        var sum1 = PpcInstruction.Synthetic(
+            0x8000000C,
+            0,
+            "ps_sum1.",
+            new PpcOperand[] { Fpr(5), Fpr(6), Fpr(7), Fpr(8) });
+        var sum1Ir = Assert.Single(new PpcLifter().Lift(new[] { sum1 })).Ir;
+        var sum1Call = Assert.IsType<IrCall>(Assert.Single(sum1Ir));
+        Assert.Equal("PPC_PsSum1", sum1Call.Target);
+        Assert.Equal(new[] { "f6", "f8", "f7" }, sum1Call.Arguments.Select(a => a.RegisterName));
+
+        var muls0 = PpcInstruction.Synthetic(
+            0x80000008,
+            0,
+            "ps_muls0.",
+            new PpcOperand[] { Fpr(9), Fpr(10), Fpr(11) });
+        var muls0Ir = Assert.Single(new PpcLifter().Lift(new[] { muls0 })).Ir;
+        Assert.Equal("PPC_PsMuls0", Assert.IsType<IrCall>(Assert.Single(muls0Ir)).Target);
+
+        var muls1 = PpcInstruction.Synthetic(
+            0x8000000C,
+            0,
+            "ps_muls1.",
+            new PpcOperand[] { Fpr(12), Fpr(13), Fpr(14) });
+        var muls1Ir = Assert.Single(new PpcLifter().Lift(new[] { muls1 })).Ir;
+        Assert.Equal("PPC_PsMuls1", Assert.IsType<IrCall>(Assert.Single(muls1Ir)).Target);
+    }
+
+    [Fact]
+    public void LiftsExplicitUnaryMoveAndCompareVariants()
+    {
+        var res = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "ps_res",
+            new PpcOperand[] { Fpr(1), Fpr(2) });
+        var resIr = Assert.Single(new PpcLifter().Lift(new[] { res })).Ir;
+        Assert.Equal("PPC_PsRes", Assert.IsType<IrCall>(Assert.Single(resIr)).Target);
+
+        var abs = PpcInstruction.Synthetic(
+            0x80000004,
+            0,
+            "ps_abs.",
+            new PpcOperand[] { Fpr(3), Fpr(4) });
+        var absIr = Assert.Single(new PpcLifter().Lift(new[] { abs })).Ir;
+        Assert.Equal("PPC_PsAbs", Assert.IsType<IrCall>(Assert.Single(absIr)).Target);
+
+        var mr = PpcInstruction.Synthetic(
+            0x80000008,
+            0,
+            "ps_mr",
+            new PpcOperand[] { Fpr(5), Fpr(6) });
+        var mrIr = Assert.Single(new PpcLifter().Lift(new[] { mr })).Ir;
+        var mrCall = Assert.IsType<IrCall>(Assert.Single(mrIr));
+        Assert.Equal("PPC_PsMr", mrCall.Target);
+        Assert.Equal("f5", mrCall.Destination);
+        Assert.Equal("f6", Assert.Single(mrCall.Arguments).RegisterName);
+
+        var mrDot = PpcInstruction.Synthetic(
+            0x8000000A,
+            0,
+            "ps_mr.",
+            new PpcOperand[] { Fpr(5), Fpr(6) });
+        Assert.Equal(
+            "PPC_PsMr",
+            Assert.IsType<IrCall>(Assert.Single(Assert.Single(new PpcLifter().Lift(new[] { mrDot })).Ir)).Target);
+
+        var cmpo0 = PpcInstruction.Synthetic(
+            0x8000000C,
+            0,
+            "ps_cmpo0.",
+            new PpcOperand[] { new PpcConditionRegisterOperand("cr5", 20), Fpr(7), Fpr(8) });
+        var cmpo0Ir = Assert.Single(new PpcLifter().Lift(new[] { cmpo0 })).Ir;
+        var cmpo0Call = Assert.IsType<IrCall>(Assert.Single(cmpo0Ir));
+        Assert.Equal("PPC_PsCmpo0", cmpo0Call.Target);
+        Assert.Equal(5, cmpo0Call.Arguments[0].Constant);
+
+        var cmpu0 = PpcInstruction.Synthetic(
+            0x80000010,
+            0,
+            "ps_cmpu0",
+            new PpcOperand[] { new PpcConditionRegisterOperand("cr3", 12), Fpr(9), Fpr(10) });
+        var cmpu0Ir = Assert.Single(new PpcLifter().Lift(new[] { cmpu0 })).Ir;
+        var cmpu0Call = Assert.IsType<IrCall>(Assert.Single(cmpu0Ir));
+        Assert.Equal("PPC_PsCmpu0", cmpu0Call.Target);
+        Assert.Equal(3, cmpu0Call.Arguments[0].Constant);
+
+        var cmpo1 = PpcInstruction.Synthetic(
+            0x80000014,
+            0,
+            "ps_cmpo1",
+            new PpcOperand[] { new PpcConditionRegisterOperand("cr2", 8), Fpr(11), Fpr(12) });
+        var cmpo1Ir = Assert.Single(new PpcLifter().Lift(new[] { cmpo1 })).Ir;
+        var cmpo1Call = Assert.IsType<IrCall>(Assert.Single(cmpo1Ir));
+        Assert.Equal("PPC_PsCmpo1", cmpo1Call.Target);
+        Assert.Equal(2, cmpo1Call.Arguments[0].Constant);
+
+        var cmpu1 = PpcInstruction.Synthetic(
+            0x80000018,
+            0,
+            "ps_cmpu1.",
+            new PpcOperand[] { new PpcConditionRegisterOperand("cr1", 4), Fpr(13), Fpr(14) });
+        var cmpu1Ir = Assert.Single(new PpcLifter().Lift(new[] { cmpu1 })).Ir;
+        var cmpu1Call = Assert.IsType<IrCall>(Assert.Single(cmpu1Ir));
+        Assert.Equal("PPC_PsCmpu1", cmpu1Call.Target);
+        Assert.Equal(1, cmpu1Call.Arguments[0].Constant);
+    }
+
+    [Fact]
+    public void LiftsRawOpc4AliasesForCompareMoveAndIndexedMemory()
+    {
+        var compare = PpcInstruction.Synthetic(
+            0x80000000,
+            (1u << 16) | (2u << 11),
+            "opc_4_0",
+            System.Array.Empty<PpcOperand>());
+        var compareIr = Assert.Single(new PpcLifter().Lift(new[] { compare })).Ir;
+        var compareSetCr = Assert.IsType<IrSetCrField>(Assert.Single(compareIr));
+        Assert.Equal(0, compareSetCr.FieldIndex);
+        Assert.Equal("f1", compareSetCr.Left.RegisterName);
+        Assert.Equal("f2", compareSetCr.Right.RegisterName);
+
+        var move = PpcInstruction.Synthetic(
+            0x80000004,
+            (4u << 21) | (7u << 11),
+            "opc_4_4",
+            System.Array.Empty<PpcOperand>());
+        var moveIr = Assert.Single(new PpcLifter().Lift(new[] { move })).Ir;
+        var moveCall = Assert.IsType<IrCall>(Assert.Single(moveIr));
+        Assert.Equal("PPC_PsMr", moveCall.Target);
+        Assert.Equal("f4", moveCall.Destination);
+        Assert.Equal("f7", Assert.Single(moveCall.Arguments).RegisterName);
+
+        var neg = PpcInstruction.Synthetic(
+            0x80000008,
+            (5u << 21) | (8u << 11),
+            "opc_4_5",
+            System.Array.Empty<PpcOperand>());
+        var negIr = Assert.Single(new PpcLifter().Lift(new[] { neg })).Ir;
+        var negCall = Assert.IsType<IrCall>(Assert.Single(negIr));
+        Assert.Equal("PPC_PsNabs", negCall.Target);
+        Assert.Equal("f5", negCall.Destination);
+        Assert.Equal("f8", Assert.Single(negCall.Arguments).RegisterName);
+
+        var load = PpcInstruction.Synthetic(
+            0x8000000C,
+            (3u << 21) | (4u << 16) | (5u << 11) | (1u << 10) | (6u << 7),
+            "opc_4_12",
+            System.Array.Empty<PpcOperand>());
+        var loadIr = Assert.Single(new PpcLifter().Lift(new[] { load })).Ir;
+        Assert.Equal(2, loadIr.Count);
+        var loadCall = Assert.IsType<IrCall>(loadIr[1]);
+        Assert.Equal("PPC_PsqL", loadCall.Target);
+        Assert.Equal("f3", loadCall.Destination);
+        Assert.Equal(1, loadCall.Arguments[1].Constant);
+        Assert.Equal(6, loadCall.Arguments[2].Constant);
+
+        var store = PpcInstruction.Synthetic(
+            0x80000010,
+            (2u << 21) | (4u << 16) | (5u << 11) | (1u << 10) | (3u << 7),
+            "opc_4_14",
+            System.Array.Empty<PpcOperand>());
+        var storeIr = Assert.Single(new PpcLifter().Lift(new[] { store })).Ir;
+        Assert.Equal(2, storeIr.Count);
+        var storeCall = Assert.IsType<IrCall>(storeIr[1]);
+        Assert.Equal("PPC_PsqSt", storeCall.Target);
+        Assert.Equal("f2", storeCall.Arguments[1].RegisterName);
+        Assert.Equal(1, storeCall.Arguments[2].Constant);
+        Assert.Equal(3, storeCall.Arguments[3].Constant);
+    }
+
+    [Fact]
+    public void RejectsMalformedAndUnknownRawOpc4Variants()
+    {
+        var malformed = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "opc_4_bad",
+            System.Array.Empty<PpcOperand>());
+        Assert.Throws<NotImplementedException>(() => new PpcLifter().Lift(new[] { malformed }));
+
+        var unknown = PpcInstruction.Synthetic(
+            0x80000004,
+            0,
+            "opc_4_999",
+            System.Array.Empty<PpcOperand>());
+        Assert.Throws<NotImplementedException>(() => new PpcLifter().Lift(new[] { unknown }));
+    }
+
+    [Theory]
+    [InlineData("opc_4_20", "call", "PPC_PsSum0")]
+    [InlineData("opc_4_22", "call", "PPC_PsSum1")]
+    [InlineData("opc_4_24", "call", "PPC_PsMuls0")]
+    [InlineData("opc_4_26", "call", "PPC_PsMuls1")]
+    [InlineData("opc_4_30", "call", "PPC_PsMadds1")]
+    [InlineData("opc_4_36", "call", "PPC_PsDiv")]
+    [InlineData("opc_4_40", "call", "PPC_PsSub")]
+    [InlineData("opc_4_42", "call", "PPC_PsAdd")]
+    [InlineData("opc_4_44", "call", "PPC_PsAbs")]
+    [InlineData("opc_4_46", "call", "PPC_PsSel")]
+    [InlineData("opc_4_48", "call", "PPC_PsRes")]
+    [InlineData("opc_4_52", "call", "PPC_PsRsqrte")]
+    [InlineData("opc_4_56", "call", "PPC_PsMsub")]
+    [InlineData("opc_4_58", "call", "PPC_PsMadd")]
+    [InlineData("opc_4_60", "call", "PPC_PsNmsub")]
+    [InlineData("opc_4_62", "call", "PPC_PsNmadd")]
+    public void LiftsAdditionalRawOpc4ArithmeticVariants(string mnemonic, string kind, string opOrTarget)
+    {
+        var raw = (3u << 21) | (1u << 16) | (2u << 11) | (4u << 6);
+        var instruction = PpcInstruction.Synthetic(0x80000000, raw, mnemonic, System.Array.Empty<PpcOperand>());
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+
+        if (kind == "call")
+        {
+            var call = Assert.IsType<IrCall>(Assert.Single(ir));
+            Assert.Equal(opOrTarget, call.Target);
+            Assert.Equal("f3", call.Destination);
+        }
+        else
+        {
+            var binary = Assert.IsType<IrBinary>(Assert.Single(ir));
+            Assert.Equal(opOrTarget, binary.Op);
+            Assert.Equal("f3", binary.Destination);
+        }
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcDecoderAdditionalTests.cs b/translator/tests/Translator.Tests/PpcDecoderAdditionalTests.cs
new file mode 100644
index 0000000..3e5354d
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcDecoderAdditionalTests.cs
@@ -0,0 +1,278 @@
+using Translator.Core.Disassembly;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcDecoderAdditionalTests
+{
+    private static PpcInstruction Decode(uint word, uint address = 0x80000000u) => PpcDecoder.Decode(address, word);
+
+    private static uint EncodeDForm(uint primary, uint rsOrRd, uint ra, int imm)
+        => (primary << 26) | (rsOrRd << 21) | (ra << 16) | (uint)(ushort)imm;
+
+    private static uint EncodeBc(uint bo, uint bi, int branchDelta, bool aa = false, bool lk = false)
+        => (16u << 26) | (bo << 21) | (bi << 16) | ((((uint)branchDelta >> 2) & 0x3FFFu) << 2) | ((aa ? 1u : 0u) << 1) | (lk ? 1u : 0u);
+
+    private static uint EncodeB(int branchDelta, bool aa = false, bool lk = false)
+        => (18u << 26) | ((((uint)branchDelta >> 2) & 0x00FFFFFFu) << 2) | ((aa ? 1u : 0u) << 1) | (lk ? 1u : 0u);
+
+    private static uint EncodeRotate(uint primary, uint rs, uint ra, uint shOrRb, uint mb, uint me, bool rc = false)
+        => (primary << 26) | (rs << 21) | (ra << 16) | (shOrRb << 11) | (mb << 6) | (me << 1) | (rc ? 1u : 0u);
+
+    private static uint EncodePs(uint frt, uint fra, uint frb, uint frc, uint xo, bool rc = false)
+        => (4u << 26) | (frt << 21) | (fra << 16) | (frb << 11) | (frc << 6) | (xo << 1) | (rc ? 1u : 0u);
+
+    private static uint EncodePsCmp(uint xo, uint crfD, uint fra, uint frb)
+        => (4u << 26) | (crfD << 23) | (fra << 16) | (frb << 11) | (xo << 1);
+
+    private static uint EncodePrimary63(uint frt, uint fra, uint frb, uint frc, uint xo, bool rc = false)
+        => (63u << 26) | (frt << 21) | (fra << 16) | (frb << 11) | (frc << 6) | (xo << 1) | (rc ? 1u : 0u);
+
+    private static uint EncodePrimary59(uint frt, uint fra, uint frb, uint frc, uint xo, bool rc = false)
+        => (59u << 26) | (frt << 21) | (fra << 16) | (frb << 11) | (frc << 6) | (xo << 1) | (rc ? 1u : 0u);
+
+    [Fact]
+    public void DecodesImmediateBranchAndRotatePrimaries()
+    {
+        var twi = Decode(EncodeDForm(3, 31, 4, -2));
+        Assert.Equal("twi", twi.Mnemonic);
+        Assert.Collection(
+            twi.Operands,
+            op => Assert.Equal(31, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => Assert.Equal("r4", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal(-2, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        var mulli = Decode(EncodeDForm(7, 3, 4, -2));
+        Assert.Equal("mulli", mulli.Mnemonic);
+        Assert.Collection(
+            mulli.Operands,
+            op => Assert.Equal("r3", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal("r4", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal(-2, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        var subfic = Decode(EncodeDForm(8, 5, 6, 0x1234));
+        Assert.Equal("subfic", subfic.Mnemonic);
+
+        var cmplwiCr0 = Decode(EncodeDForm(10, 0, 7, 0x55AA));
+        Assert.Equal("cmplwi", cmplwiCr0.Mnemonic);
+        Assert.Collection(
+            cmplwiCr0.Operands,
+            op => Assert.Equal("r7", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal(0x55AA, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        var addic = Decode(EncodeDForm(12, 8, 9, -4));
+        Assert.Equal("addic", addic.Mnemonic);
+        Assert.False(addic.IsConditionalBranch);
+
+        var addicDot = Decode(EncodeDForm(13, 8, 9, -4));
+        Assert.Equal("addic.", addicDot.Mnemonic);
+        Assert.True(addicDot.IsConditionalBranch);
+
+        Assert.Equal("li", Decode(EncodeDForm(14, 10, 0, -1)).Mnemonic);
+        Assert.Equal("addi", Decode(EncodeDForm(14, 10, 11, 4)).Mnemonic);
+        Assert.Equal("lis", Decode(EncodeDForm(15, 12, 0, 0x1234)).Mnemonic);
+        Assert.Equal("addis", Decode(EncodeDForm(15, 12, 13, 0x1234)).Mnemonic);
+
+        var genericBc = Decode(EncodeBc(0, 5, 0x20, aa: true, lk: true), address: 0x81234560);
+        Assert.Equal("bcl", genericBc.Mnemonic);
+        Assert.True(genericBc.IsCall);
+        Assert.True(genericBc.IsConditionalBranch);
+        Assert.Collection(
+            genericBc.Operands,
+            op => Assert.Equal(0, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => Assert.Equal(5, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => Assert.Equal("cr1", Assert.IsType<PpcConditionRegisterOperand>(op).Name),
+            op => Assert.Equal(0x20u, Assert.IsType<PpcBranchTargetOperand>(op).TargetAddress));
+
+        Assert.Equal("bdnz", Decode(EncodeBc(16, 0, 0x10)).Mnemonic);
+        Assert.Equal("bdzl", Decode(EncodeBc(18, 0, 0x10, lk: true)).Mnemonic);
+
+        var absoluteBl = Decode(EncodeB(0x40, aa: true, lk: true), address: 0x80001000);
+        Assert.Equal("bl", absoluteBl.Mnemonic);
+        Assert.True(absoluteBl.IsCall);
+        Assert.Equal(0x40u, Assert.IsType<PpcBranchTargetOperand>(Assert.Single(absoluteBl.Operands)).TargetAddress);
+
+        var sc = Decode(17u << 26);
+        Assert.Equal("sc", sc.Mnemonic);
+        Assert.Empty(sc.Operands);
+
+        Assert.Equal("rlwimi.", Decode(EncodeRotate(20, 3, 4, 5, 6, 7, rc: true)).Mnemonic);
+        Assert.Equal("rlwinm", Decode(EncodeRotate(21, 8, 9, 10, 11, 12)).Mnemonic);
+        Assert.Equal("rlwnm.", Decode(EncodeRotate(23, 13, 14, 15, 16, 17, rc: true)).Mnemonic);
+    }
+
+    [Fact]
+    public void DecodesPrimaryFourPairedSingleVariants()
+    {
+        Assert.Equal("ps_div.", Decode(EncodePs(1, 2, 3, 0, 18, rc: true)).Mnemonic);
+        Assert.Equal("ps_sub", Decode(EncodePs(5, 6, 7, 0, 20)).Mnemonic);
+        Assert.Equal("ps_add.", Decode(EncodePs(9, 10, 11, 0, 21, rc: true)).Mnemonic);
+        Assert.Equal("ps_res", Decode(EncodePs(13, 14, 15, 0, 24)).Mnemonic);
+        Assert.Equal("ps_rsqrte.", Decode(EncodePs(17, 18, 19, 0, 26, rc: true)).Mnemonic);
+
+        Assert.Equal("ps_merge00", Decode(EncodePs(1, 2, 3, 0, 528)).Mnemonic);
+        Assert.Equal("ps_merge01.", Decode(EncodePs(4, 5, 6, 0, 560, rc: true)).Mnemonic);
+        Assert.Equal("ps_merge10", Decode(EncodePs(7, 8, 9, 0, 592)).Mnemonic);
+        Assert.Equal("ps_merge11.", Decode(EncodePs(10, 11, 12, 0, 624, rc: true)).Mnemonic);
+
+        Assert.Equal("ps_mr", Decode(EncodePs(13, 0, 14, 0, 72)).Mnemonic);
+        Assert.Equal("ps_neg.", Decode(EncodePs(15, 0, 16, 0, 40, rc: true)).Mnemonic);
+        Assert.Equal("ps_abs", Decode(EncodePs(17, 0, 18, 0, 264)).Mnemonic);
+        Assert.Equal("ps_nabs.", Decode(EncodePs(19, 0, 20, 0, 136, rc: true)).Mnemonic);
+
+        var cmpu0 = Decode(EncodePsCmp(0, 3, 4, 5));
+        Assert.Equal("ps_cmpu0", cmpu0.Mnemonic);
+        Assert.True(cmpu0.IsConditionalBranch);
+        Assert.Equal("cr3", Assert.IsType<PpcConditionRegisterOperand>(cmpu0.Operands[0]).Name);
+
+        Assert.Equal("ps_cmpo0", Decode(EncodePsCmp(32, 2, 6, 7)).Mnemonic);
+        Assert.Equal("ps_cmpu1", Decode(EncodePsCmp(64, 1, 8, 9)).Mnemonic);
+        Assert.Equal("ps_cmpo1", Decode(EncodePsCmp(96, 7, 10, 11)).Mnemonic);
+
+        var dcbzL = Decode(EncodePs(0, 12, 13, 0, 1014));
+        Assert.Equal("dcbz_l", dcbzL.Mnemonic);
+        Assert.Collection(
+            dcbzL.Operands,
+            op => Assert.Equal("r12", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal("r13", Assert.IsType<PpcRegisterOperand>(op).Name));
+
+        var psqLx = Decode(EncodePs(1, 2, 3, 0, 6) | (1u << 10) | (4u << 7));
+        Assert.Equal("psq_lx", psqLx.Mnemonic);
+        Assert.Collection(
+            psqLx.Operands,
+            op => Assert.Equal("f1", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal("r2", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal("r3", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal(1, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => Assert.Equal(4, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        Assert.Equal("psq_stx", Decode(EncodePs(4, 5, 6, 0, 7)).Mnemonic);
+        Assert.Equal("psq_lux", Decode(EncodePs(7, 8, 9, 0, 38)).Mnemonic);
+        Assert.Equal("psq_stux", Decode(EncodePs(10, 11, 12, 0, 39)).Mnemonic);
+
+        Assert.Equal("opc_4_17", Decode(EncodePs(1, 2, 3, 0, 17)).Mnemonic);
+    }
+
+    [Fact]
+    public void DecodesLogicalDFormAndPsqMemoryPrimaries()
+    {
+        var nop = Decode(24u << 26);
+        Assert.Equal("nop", nop.Mnemonic);
+        Assert.Collection(
+            nop.Operands,
+            op => Assert.Equal("r0", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal("r0", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal(0, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        Assert.Equal("oris", Decode(EncodeDForm(25, 3, 4, 0x22)).Mnemonic);
+        Assert.Equal("xori", Decode(EncodeDForm(26, 5, 6, 0x33)).Mnemonic);
+        Assert.Equal("xoris", Decode(EncodeDForm(27, 7, 8, 0x44)).Mnemonic);
+
+        var andi = Decode(EncodeDForm(28, 9, 10, 0x55));
+        Assert.Equal("andi.", andi.Mnemonic);
+        Assert.True(andi.IsConditionalBranch);
+
+        var andis = Decode(EncodeDForm(29, 11, 12, 0x1234));
+        Assert.Equal("andis.", andis.Mnemonic);
+        Assert.True(andis.IsConditionalBranch);
+        Assert.Collection(
+            andis.Operands,
+            op => Assert.Equal("r12", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal("r11", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal(0x1234, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        Assert.Equal("lhz", Decode(EncodeDForm(40, 11, 12, -8)).Mnemonic);
+        Assert.Equal("lhzu", Decode(EncodeDForm(41, 13, 14, 4)).Mnemonic);
+        Assert.Equal("lha", Decode(EncodeDForm(42, 15, 16, 6)).Mnemonic);
+        Assert.Equal("lhau", Decode(EncodeDForm(43, 16, 17, -6)).Mnemonic);
+        Assert.Equal("sth", Decode(EncodeDForm(44, 17, 18, 8)).Mnemonic);
+        Assert.Equal("sthu", Decode(EncodeDForm(45, 18, 19, -10)).Mnemonic);
+        Assert.Equal("lmw", Decode(EncodeDForm(46, 19, 20, 12)).Mnemonic);
+        Assert.Equal("stmw", Decode(EncodeDForm(47, 21, 22, 16)).Mnemonic);
+        Assert.Equal("lfs", Decode(EncodeDForm(48, 1, 23, 20)).Mnemonic);
+        Assert.Equal("lfsu", Decode(EncodeDForm(49, 2, 24, 24)).Mnemonic);
+        Assert.Equal("lfd", Decode(EncodeDForm(50, 3, 25, 28)).Mnemonic);
+        Assert.Equal("lfdu", Decode(EncodeDForm(51, 4, 26, 32)).Mnemonic);
+        Assert.Equal("stfs", Decode(EncodeDForm(52, 5, 27, 36)).Mnemonic);
+        Assert.Equal("stfsu", Decode(EncodeDForm(53, 6, 28, 40)).Mnemonic);
+        Assert.Equal("stfd", Decode(EncodeDForm(54, 7, 29, 44)).Mnemonic);
+        Assert.Equal("stfdu", Decode(EncodeDForm(55, 8, 30, 48)).Mnemonic);
+
+        var psqLu = Decode(EncodeDForm(57, 9, 31, 0x5AB) | (1u << 15) | (3u << 12));
+        Assert.Equal("psq_lu", psqLu.Mnemonic);
+        Assert.Collection(
+            psqLu.Operands,
+            op => Assert.Equal("f9", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op =>
+            {
+                var disp = Assert.IsType<PpcDisplacementOperand>(op);
+                Assert.Equal(0x5AB, disp.Offset);
+                Assert.Equal("r31", disp.BaseRegister);
+            },
+            op => Assert.Equal(1, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => Assert.Equal(3, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        var psqStu = Decode(EncodeDForm(61, 10, 30, -1) | (1u << 15) | (7u << 12));
+        Assert.Equal("psq_stu", psqStu.Mnemonic);
+        Assert.Equal(-1, Assert.IsType<PpcDisplacementOperand>(psqStu.Operands[1]).Offset);
+    }
+
+    [Fact]
+    public void DecodesPrimary63FloatingFormsAndFallback()
+    {
+        var fcmpu = Decode(EncodePrimary63(0, 2, 3, 0, 0));
+        Assert.Equal("fcmpu", fcmpu.Mnemonic);
+        Assert.True(fcmpu.IsConditionalBranch);
+
+        Assert.Equal("fcmpo", Decode(EncodePrimary63(0, 4, 5, 0, 32)).Mnemonic);
+        Assert.Equal("fctiw.", Decode(EncodePrimary63(6, 0, 7, 0, 14, rc: true)).Mnemonic);
+        Assert.Equal("fctiwz.", Decode(EncodePrimary63(6, 0, 7, 0, 15, rc: true)).Mnemonic);
+        Assert.Equal("fdiv", Decode(EncodePrimary63(8, 9, 10, 0, 18)).Mnemonic);
+        Assert.Equal("fsub.", Decode(EncodePrimary63(11, 12, 13, 0, 20, rc: true)).Mnemonic);
+        Assert.Equal("fadd", Decode(EncodePrimary63(14, 15, 16, 0, 21)).Mnemonic);
+        Assert.Equal("frsp", Decode(EncodePrimary63(14, 0, 16, 0, 12)).Mnemonic);
+        Assert.Equal("fsel.", Decode(EncodePrimary63(14, 15, 16, 17, 23, rc: true)).Mnemonic);
+        Assert.Equal("fres", Decode(EncodePrimary63(14, 0, 16, 0, 24)).Mnemonic);
+        Assert.Equal("fmul.", Decode(EncodePrimary63(17, 18, 19, 0, 25, rc: true)).Mnemonic);
+        Assert.Equal("frsqrte", Decode(EncodePrimary63(17, 0, 19, 0, 26)).Mnemonic);
+        Assert.Equal("fmsub", Decode(EncodePrimary63(17, 18, 19, 20, 28)).Mnemonic);
+        Assert.Equal("fmadd", Decode(EncodePrimary63(17, 18, 19, 20, 29)).Mnemonic);
+        Assert.Equal("fnmsub", Decode(EncodePrimary63(17, 18, 19, 20, 30)).Mnemonic);
+        Assert.Equal("fnmadd", Decode(EncodePrimary63(17, 18, 19, 20, 31)).Mnemonic);
+        Assert.Equal("mtfsb1", Decode(EncodePrimary63(17, 0, 0, 0, 38)).Mnemonic);
+        Assert.Equal("mtfsb0", Decode(EncodePrimary63(18, 0, 0, 0, 70)).Mnemonic);
+        var mtfsfi = Decode((63u << 26) | (3u << 23) | (0xCu << 12) | (134u << 1));
+        Assert.Equal("mtfsfi", mtfsfi.Mnemonic);
+        Assert.Collection(
+            mtfsfi.Operands,
+            op => Assert.Equal(3, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => Assert.Equal(0xC, Assert.IsType<PpcImmediateOperand>(op).Value));
+        Assert.Equal("fneg", Decode(EncodePrimary63(21, 0, 22, 0, 40)).Mnemonic);
+        Assert.Equal("fmr.", Decode(EncodePrimary63(23, 0, 24, 0, 72, rc: true)).Mnemonic);
+        Assert.Equal("fnabs", Decode(EncodePrimary63(25, 0, 26, 0, 136)).Mnemonic);
+        Assert.Equal("fabs", Decode(EncodePrimary63(25, 0, 26, 0, 264)).Mnemonic);
+        Assert.Equal("mffs", Decode(EncodePrimary63(27, 0, 0, 0, 583)).Mnemonic);
+        var mtfsf = Decode(EncodePrimary63(0, 0, 7, 0, 711) | (0xAAu << 17));
+        Assert.Equal("mtfsf", mtfsf.Mnemonic);
+        Assert.Collection(
+            mtfsf.Operands,
+            op => Assert.Equal(0xAA, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => Assert.Equal("f7", Assert.IsType<PpcRegisterOperand>(op).Name));
+        Assert.Equal("fp_27", Decode(EncodePrimary63(1, 2, 3, 0, 27)).Mnemonic);
+    }
+
+    [Fact]
+    public void DecodesPrimaryFiftyNineSinglePrecisionForms()
+    {
+        Assert.Equal("fdivs", Decode(EncodePrimary59(1, 2, 3, 4, 18)).Mnemonic);
+        Assert.Equal("fsubs.", Decode(EncodePrimary59(1, 2, 3, 4, 20, rc: true)).Mnemonic);
+        Assert.Equal("fadds", Decode(EncodePrimary59(1, 2, 3, 4, 21)).Mnemonic);
+        Assert.Equal("fres", Decode(EncodePrimary59(1, 2, 3, 4, 24)).Mnemonic);
+        Assert.Equal("fmuls.", Decode(EncodePrimary59(1, 2, 3, 4, 25, rc: true)).Mnemonic);
+        Assert.Equal("fmsubs", Decode(EncodePrimary59(1, 2, 3, 4, 28)).Mnemonic);
+        Assert.Equal("fmadds", Decode(EncodePrimary59(1, 2, 3, 4, 29)).Mnemonic);
+        Assert.Equal("fnmsubs", Decode(EncodePrimary59(1, 2, 3, 4, 30)).Mnemonic);
+        Assert.Equal("fnmadds", Decode(EncodePrimary59(1, 2, 3, 4, 31)).Mnemonic);
+        Assert.Equal("opc_59", Decode(EncodePrimary59(1, 2, 3, 4, 27)).Mnemonic);
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcDecoderPrimary19Tests.cs b/translator/tests/Translator.Tests/PpcDecoderPrimary19Tests.cs
new file mode 100644
index 0000000..29b343a
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcDecoderPrimary19Tests.cs
@@ -0,0 +1,136 @@
+using System;
+using Translator.Core.Disassembly;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcDecoderPrimary19Tests
+{
+    private static uint EncodePrimary19(uint field0, uint field1, uint field2, uint xo, bool lk = false)
+        => (19u << 26) | (field0 << 21) | (field1 << 16) | (field2 << 11) | (xo << 1) | (lk ? 1u : 0u);
+
+    private static PpcInstruction Decode(uint field0, uint field1, uint field2, uint xo, bool lk = false)
+        => PpcDecoder.Decode(0x80000000, EncodePrimary19(field0, field1, field2, xo, lk));
+
+    [Fact]
+    public void DecodesBclrVariantsWithCorrectFlags()
+    {
+        var blr = Decode(20, 0, 0, 16);
+        Assert.Equal("blr", blr.Mnemonic);
+        Assert.True(blr.IsReturn);
+        Assert.False(blr.IsCall);
+        Assert.False(blr.IsConditionalBranch);
+        Assert.Empty(blr.Operands);
+
+        var blrl = Decode(20, 0, 0, 16, lk: true);
+        Assert.Equal("blrl", blrl.Mnemonic);
+        Assert.False(blrl.IsReturn);
+        Assert.True(blrl.IsCall);
+        Assert.False(blrl.IsConditionalBranch);
+        Assert.Empty(blrl.Operands);
+
+        var beqlr = Decode(12, 6, 0, 16);
+        Assert.Equal("beqlr", beqlr.Mnemonic);
+        Assert.True(beqlr.IsReturn);
+        Assert.True(beqlr.IsConditionalBranch);
+        Assert.Equal("cr1", Assert.IsType<PpcConditionRegisterOperand>(Assert.Single(beqlr.Operands)).Name);
+
+        var bnslrl = Decode(4, 7, 0, 16, lk: true);
+        Assert.Equal("bnslrl", bnslrl.Mnemonic);
+        Assert.False(bnslrl.IsReturn);
+        Assert.True(bnslrl.IsCall);
+        Assert.True(bnslrl.IsConditionalBranch);
+        Assert.Equal("cr1", Assert.IsType<PpcConditionRegisterOperand>(Assert.Single(bnslrl.Operands)).Name);
+    }
+
+    [Fact]
+    public void DecodesBcctrVariantsAndCrFieldOperands()
+    {
+        var bctr = Decode(20, 0, 0, 528);
+        Assert.Equal("bctr", bctr.Mnemonic);
+        Assert.True(bctr.IsReturn);
+        Assert.False(bctr.IsCall);
+        Assert.False(bctr.IsConditionalBranch);
+        Assert.Empty(bctr.Operands);
+
+        var bctrl = Decode(20, 0, 0, 528, lk: true);
+        Assert.Equal("bctrl", bctrl.Mnemonic);
+        Assert.False(bctrl.IsReturn);
+        Assert.True(bctrl.IsCall);
+        Assert.False(bctrl.IsConditionalBranch);
+        Assert.Empty(bctrl.Operands);
+
+        var bcctr = Decode(4, 9, 0, 528);
+        Assert.Equal("bcctr", bcctr.Mnemonic);
+        Assert.False(bcctr.IsReturn);
+        Assert.False(bcctr.IsCall);
+        Assert.True(bcctr.IsConditionalBranch);
+        Assert.Equal("cr2", Assert.IsType<PpcConditionRegisterOperand>(Assert.Single(bcctr.Operands)).Name);
+    }
+
+    [Fact]
+    public void DecodesSystemAndCrMoveForms()
+    {
+        var rfi = Decode(0, 0, 0, 50);
+        Assert.Equal("rfi", rfi.Mnemonic);
+        Assert.True(rfi.IsReturn);
+
+        var isync = Decode(0, 0, 0, 150);
+        Assert.Equal("isync", isync.Mnemonic);
+        Assert.False(isync.IsReturn);
+
+        var mcrf = Decode(12, 4, 0, 0);
+        Assert.Equal("mcrf", mcrf.Mnemonic);
+        Assert.Collection(
+            mcrf.Operands,
+            op => Assert.Equal("cr3", Assert.IsType<PpcConditionRegisterOperand>(op).Name),
+            op => Assert.Equal("cr1", Assert.IsType<PpcConditionRegisterOperand>(op).Name));
+    }
+
+    [Theory]
+    [InlineData(33u, "crnor")]
+    [InlineData(129u, "crandc")]
+    [InlineData(193u, "crxor")]
+    [InlineData(225u, "crnand")]
+    [InlineData(257u, "crand")]
+    [InlineData(289u, "creqv")]
+    [InlineData(417u, "crorc")]
+    [InlineData(449u, "cror")]
+    public void DecodesCrLogicalOps(uint xo, string expectedMnemonic)
+    {
+        var instruction = Decode(1, 2, 3, xo);
+
+        Assert.Equal(expectedMnemonic, instruction.Mnemonic);
+        Assert.Collection(
+            instruction.Operands,
+            op =>
+            {
+                var cr = Assert.IsType<PpcConditionRegisterOperand>(op);
+                Assert.Equal("crb1", cr.Name);
+                Assert.Equal(1, cr.BitIndex);
+            },
+            op =>
+            {
+                var cr = Assert.IsType<PpcConditionRegisterOperand>(op);
+                Assert.Equal("crb2", cr.Name);
+                Assert.Equal(2, cr.BitIndex);
+            },
+            op =>
+            {
+                var cr = Assert.IsType<PpcConditionRegisterOperand>(op);
+                Assert.Equal("crb3", cr.Name);
+                Assert.Equal(3, cr.BitIndex);
+            });
+    }
+
+    [Fact]
+    public void UnknownPrimary19XoFallsBackToUnk19()
+    {
+        var instruction = Decode(0, 0, 0, 511);
+
+        Assert.Equal("unk19", instruction.Mnemonic);
+        Assert.Empty(instruction.Operands);
+        Assert.False(instruction.IsReturn);
+        Assert.False(instruction.IsCall);
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcDecoderPrimary31Tests.cs b/translator/tests/Translator.Tests/PpcDecoderPrimary31Tests.cs
new file mode 100644
index 0000000..a800494
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcDecoderPrimary31Tests.cs
@@ -0,0 +1,290 @@
+using System;
+using Translator.Core.Disassembly;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcDecoderPrimary31Tests
+{
+    private static uint EncodeXoForm(uint rs, uint ra, uint rb, uint xo, bool rc = false, bool oe = false)
+        => (31u << 26) | (rs << 21) | (ra << 16) | (rb << 11) | ((oe ? 1u : 0u) << 10) | (xo << 1) | (rc ? 1u : 0u);
+
+    private static uint EncodeXForm(uint rs, uint ra, uint rb, uint xo10, bool rc = false)
+        => (31u << 26) | (rs << 21) | (ra << 16) | (rb << 11) | (xo10 << 1) | (rc ? 1u : 0u);
+
+    private static uint EncodeSprWord(uint rs, uint spr, uint xo)
+    {
+        var sprLo = spr & 0x1F;
+        var sprHi = (spr >> 5) & 0x1F;
+        return (31u << 26) | (rs << 21) | (sprLo << 16) | (sprHi << 11) | (xo << 1);
+    }
+
+    private static PpcInstruction Decode(uint word) => PpcDecoder.Decode(0x80000000, word);
+
+    private static void AssertGpr(PpcOperand operand, string expected)
+        => Assert.Equal(expected, Assert.IsType<PpcRegisterOperand>(operand).Name);
+
+    private static void AssertFpr(PpcOperand operand, string expected)
+        => Assert.Equal(expected, Assert.IsType<PpcRegisterOperand>(operand).Name);
+
+    [Fact]
+    public void DecodesXoFormArithmeticAndCompareMnemonics()
+    {
+        var cmpw = Decode((31u << 26) | (2u << 23) | (3u << 16) | (5u << 11));
+        Assert.Equal("cmpw", cmpw.Mnemonic);
+        Assert.True(cmpw.IsConditionalBranch);
+        Assert.Collection(
+            cmpw.Operands,
+            op => Assert.Equal("cr2", Assert.IsType<PpcConditionRegisterOperand>(op).Name),
+            op => AssertGpr(op, "r3"),
+            op => AssertGpr(op, "r5"));
+
+        var invalidCmp = Decode((31u << 26) | (1u << 21));
+        Assert.Equal("invalid_cmp", invalidCmp.Mnemonic);
+
+        var tw = Decode(EncodeXoForm(31, 4, 5, 4));
+        Assert.Equal("tw", tw.Mnemonic);
+        Assert.Collection(
+            tw.Operands,
+            op => Assert.Equal(31, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => AssertGpr(op, "r4"),
+            op => AssertGpr(op, "r5"));
+
+        var addc = Decode(EncodeXoForm(3, 4, 5, 10, rc: true, oe: true));
+        Assert.Equal("addco.", addc.Mnemonic);
+        Assert.Collection(addc.Operands, op => AssertGpr(op, "r3"), op => AssertGpr(op, "r4"), op => AssertGpr(op, "r5"));
+
+        var subfe = Decode(EncodeXoForm(6, 7, 8, 136, oe: true));
+        Assert.Equal("subfeo", subfe.Mnemonic);
+
+        var addze = Decode(EncodeXoForm(9, 10, 0, 202, rc: true));
+        Assert.Equal("addze.", addze.Mnemonic);
+        Assert.Collection(addze.Operands, op => AssertGpr(op, "r9"), op => AssertGpr(op, "r10"));
+
+        var addme = Decode(EncodeXoForm(9, 10, 0, 234, rc: true));
+        Assert.Equal("addme.", addme.Mnemonic);
+        Assert.Collection(addme.Operands, op => AssertGpr(op, "r9"), op => AssertGpr(op, "r10"));
+
+        var subfme = Decode(EncodeXoForm(9, 10, 0, 232, rc: true));
+        Assert.Equal("subfme.", subfme.Mnemonic);
+        Assert.Collection(subfme.Operands, op => AssertGpr(op, "r9"), op => AssertGpr(op, "r10"));
+
+        var neg = Decode(EncodeXoForm(11, 12, 0, 104, rc: true));
+        Assert.Equal("neg.", neg.Mnemonic);
+
+        var mullw = Decode(EncodeXoForm(13, 14, 15, 235, oe: true));
+        Assert.Equal("mullwo", mullw.Mnemonic);
+
+        var add = Decode(EncodeXoForm(16, 17, 18, 266, rc: true));
+        Assert.Equal("add.", add.Mnemonic);
+
+        var divwu = Decode(EncodeXoForm(19, 20, 21, 459, oe: true));
+        Assert.Equal("divwuo", divwu.Mnemonic);
+
+        var divw = Decode(EncodeXoForm(22, 23, 24, 491, rc: true));
+        Assert.Equal("divw.", divw.Mnemonic);
+    }
+
+    [Fact]
+    public void DecodesSprAndLogicalRegisterForms()
+    {
+        var mfcr = Decode(EncodeXoForm(4, 0, 0, 19));
+        Assert.Equal("mfcr", mfcr.Mnemonic);
+        AssertGpr(Assert.Single(mfcr.Operands), "r4");
+
+        var and = Decode(EncodeXoForm(5, 6, 7, 28, rc: true));
+        Assert.Equal("and.", and.Mnemonic);
+        Assert.Collection(and.Operands, op => AssertGpr(op, "r6"), op => AssertGpr(op, "r5"), op => AssertGpr(op, "r7"));
+
+        var andc = Decode(EncodeXoForm(5, 6, 7, 60, rc: true));
+        Assert.Equal("andc.", andc.Mnemonic);
+
+        var mfmsr = Decode(EncodeXoForm(8, 0, 0, 83));
+        Assert.Equal("mfmsr", mfmsr.Mnemonic);
+        AssertGpr(Assert.Single(mfmsr.Operands), "r8");
+
+        var mtmsr = Decode(EncodeXoForm(9, 0, 0, 146));
+        Assert.Equal("mtmsr", mtmsr.Mnemonic);
+        AssertGpr(Assert.Single(mtmsr.Operands), "r9");
+
+        var mtcrf = Decode((31u << 26) | (10u << 21) | (0x80u << 12) | (144u << 1));
+        Assert.Equal("mtcrf", mtcrf.Mnemonic);
+        Assert.Collection(
+            mtcrf.Operands,
+            op => Assert.Equal(0x80, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => AssertGpr(op, "r10"));
+
+        var nor = Decode(EncodeXoForm(10, 11, 12, 124, rc: true));
+        Assert.Equal("nor.", nor.Mnemonic);
+
+        var nand = Decode(EncodeXoForm(13, 14, 15, 476));
+        Assert.Equal("nand", nand.Mnemonic);
+
+        var eqv = Decode(EncodeXoForm(13, 14, 15, 284, rc: true));
+        Assert.Equal("eqv.", eqv.Mnemonic);
+
+        var xor = Decode(EncodeXoForm(16, 17, 18, 316, rc: true));
+        Assert.Equal("xor.", xor.Mnemonic);
+
+        var mflr = Decode(EncodeSprWord(3, 8, 339));
+        Assert.Equal("mflr", mflr.Mnemonic);
+        AssertGpr(Assert.Single(mflr.Operands), "r3");
+
+        var mfctr = Decode(EncodeSprWord(4, 9, 339));
+        Assert.Equal("mfctr", mfctr.Mnemonic);
+
+        var mfxer = Decode(EncodeSprWord(5, 1, 339));
+        Assert.Equal("mfxer", mfxer.Mnemonic);
+
+        var mfspr = Decode(EncodeSprWord(6, 912, 339));
+        Assert.Equal("mfspr", mfspr.Mnemonic);
+        Assert.Collection(
+            mfspr.Operands,
+            op => AssertGpr(op, "r6"),
+            op => Assert.Equal(912, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        var mtlr = Decode(EncodeSprWord(7, 8, 467));
+        Assert.Equal("mtlr", mtlr.Mnemonic);
+        AssertGpr(Assert.Single(mtlr.Operands), "r7");
+
+        var mtctr = Decode(EncodeSprWord(8, 9, 467));
+        Assert.Equal("mtctr", mtctr.Mnemonic);
+
+        var mtxer = Decode(EncodeSprWord(9, 1, 467));
+        Assert.Equal("mtxer", mtxer.Mnemonic);
+
+        var mtspr = Decode(EncodeSprWord(10, 913, 467));
+        Assert.Equal("mtspr", mtspr.Mnemonic);
+        Assert.Collection(
+            mtspr.Operands,
+            op => Assert.Equal(913, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => AssertGpr(op, "r10"));
+
+        var mtsr = Decode(EncodeXoForm(11, 3, 0, 210));
+        Assert.Equal("mtsr", mtsr.Mnemonic);
+        Assert.Collection(
+            mtsr.Operands,
+            op => Assert.Equal(3, Assert.IsType<PpcImmediateOperand>(op).Value),
+            op => AssertGpr(op, "r11"));
+
+        Assert.Equal("mtsrin", Decode(EncodeXForm(11, 0, 12, 242)).Mnemonic);
+    }
+
+    [Fact]
+    public void DecodesIndexedMemoryAndByteReverseForms()
+    {
+        Assert.Equal("lwzx", Decode(EncodeXForm(3, 4, 5, 23)).Mnemonic);
+        Assert.Equal("lwzux", Decode(EncodeXForm(6, 7, 8, 55)).Mnemonic);
+        Assert.Equal("lbzx", Decode(EncodeXForm(9, 10, 11, 87)).Mnemonic);
+        Assert.Equal("stwx", Decode(EncodeXForm(12, 13, 14, 151)).Mnemonic);
+        Assert.Equal("stwux", Decode(EncodeXForm(15, 16, 17, 183)).Mnemonic);
+        Assert.Equal("stbx", Decode(EncodeXForm(18, 19, 20, 215)).Mnemonic);
+        Assert.Equal("stbux", Decode(EncodeXForm(21, 22, 23, 247)).Mnemonic);
+        Assert.Equal("lhzx", Decode(EncodeXForm(24, 25, 26, 279)).Mnemonic);
+        Assert.Equal("lhzux", Decode(EncodeXForm(24, 25, 26, 311)).Mnemonic);
+        Assert.Equal("lhax", Decode(EncodeXForm(24, 25, 26, 343)).Mnemonic);
+        Assert.Equal("lhaux", Decode(EncodeXForm(24, 25, 26, 375)).Mnemonic);
+        Assert.Equal("sthx", Decode(EncodeXForm(27, 28, 29, 407)).Mnemonic);
+        Assert.Equal("sthux", Decode(EncodeXForm(27, 28, 29, 439)).Mnemonic);
+
+        var stwcx = Decode(EncodeXoForm(3, 4, 5, 498));
+        Assert.Equal("stwcx.", stwcx.Mnemonic);
+        Assert.True(stwcx.IsConditionalBranch);
+
+        Assert.Equal("lwbrx", Decode(EncodeXForm(3, 4, 5, 534)).Mnemonic);
+        Assert.Equal("stwbrx", Decode(EncodeXForm(6, 7, 8, 662)).Mnemonic);
+        Assert.Equal("lhbrx", Decode(EncodeXForm(9, 10, 11, 790)).Mnemonic);
+        Assert.Equal("sthbrx", Decode(EncodeXForm(12, 13, 14, 918)).Mnemonic);
+
+        var stfiwx = Decode(EncodeXForm(2, 3, 4, 983));
+        Assert.Equal("stfiwx", stfiwx.Mnemonic);
+        Assert.Collection(stfiwx.Operands, op => AssertFpr(op, "f2"), op => AssertGpr(op, "r3"), op => AssertGpr(op, "r4"));
+    }
+
+    [Fact]
+    public void DecodesShiftFloatingAndCacheForms()
+    {
+        Assert.Equal("slw.", Decode(EncodeXForm(5, 6, 7, 24, rc: true)).Mnemonic);
+        Assert.Equal("dcbst", Decode(EncodeXForm(0, 6, 7, 54)).Mnemonic);
+        Assert.Equal("dcbf", Decode(EncodeXForm(0, 6, 7, 86)).Mnemonic);
+        Assert.Equal("dcbtst", Decode(EncodeXForm(0, 6, 7, 246)).Mnemonic);
+        Assert.Equal("dcbt", Decode(EncodeXForm(0, 6, 7, 278)).Mnemonic);
+        Assert.Equal("tlbie", Decode(EncodeXForm(0, 0, 7, 306)).Mnemonic);
+        Assert.Equal("dcbi", Decode(EncodeXForm(0, 6, 7, 470)).Mnemonic);
+        Assert.Equal("mcrxr", Decode(EncodeXForm(28, 0, 0, 512)).Mnemonic);
+        Assert.Equal("srw.", Decode(EncodeXForm(8, 9, 10, 536, rc: true)).Mnemonic);
+        Assert.Equal("tlbsync", Decode(EncodeXForm(0, 0, 0, 566)).Mnemonic);
+
+        var mfsr = Decode(EncodeXForm(8, 9, 0, 595));
+        Assert.Equal("mfsr", mfsr.Mnemonic);
+        Assert.Collection(
+            mfsr.Operands,
+            op => AssertGpr(op, "r8"),
+            op => Assert.Equal(9, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        Assert.Equal("mfsrin", Decode(EncodeXForm(8, 0, 9, 659)).Mnemonic);
+        Assert.Equal("sync", Decode(EncodeXForm(0, 0, 0, 598)).Mnemonic);
+        Assert.Equal("sraw.", Decode(EncodeXForm(11, 12, 13, 792, rc: true)).Mnemonic);
+
+        var srawi = Decode(EncodeXForm(14, 15, 7, 824, rc: true));
+        Assert.Equal("srawi.", srawi.Mnemonic);
+        Assert.Collection(
+            srawi.Operands,
+            op => AssertGpr(op, "r15"),
+            op => AssertGpr(op, "r14"),
+            op => Assert.Equal(7, Assert.IsType<PpcImmediateOperand>(op).Value));
+
+        var lfsx = Decode(EncodeXForm(1, 2, 3, 535));
+        Assert.Equal("lfsx", lfsx.Mnemonic);
+        Assert.Collection(lfsx.Operands, op => AssertFpr(op, "f1"), op => AssertGpr(op, "r2"), op => AssertGpr(op, "r3"));
+
+        Assert.Equal("lfsux", Decode(EncodeXForm(1, 2, 3, 567)).Mnemonic);
+
+        var lfdx = Decode(EncodeXForm(4, 5, 6, 599));
+        Assert.Equal("lfdx", lfdx.Mnemonic);
+
+        Assert.Equal("lfdux", Decode(EncodeXForm(4, 5, 6, 631)).Mnemonic);
+
+        var stfsx = Decode(EncodeXForm(7, 8, 9, 663));
+        Assert.Equal("stfsx", stfsx.Mnemonic);
+
+        Assert.Equal("stfsux", Decode(EncodeXForm(7, 8, 9, 695)).Mnemonic);
+
+        var stfdx = Decode(EncodeXForm(10, 11, 12, 727));
+        Assert.Equal("stfdx", stfdx.Mnemonic);
+
+        Assert.Equal("dcba", Decode(EncodeXForm(0, 11, 12, 758)).Mnemonic);
+
+        Assert.Equal("stfdux", Decode(EncodeXForm(10, 11, 12, 759)).Mnemonic);
+
+        Assert.Equal("eieio", Decode(EncodeXForm(0, 0, 0, 854)).Mnemonic);
+
+        Assert.Equal("mftb", Decode(EncodeSprWord(13, 268, 371)).Mnemonic);
+        Assert.Equal("mftbu", Decode(EncodeSprWord(14, 269, 371)).Mnemonic);
+
+        var icbi = Decode(EncodeXForm(0, 13, 14, 982));
+        Assert.Equal("icbi", icbi.Mnemonic);
+        Assert.Collection(icbi.Operands, op => AssertGpr(op, "r13"), op => AssertGpr(op, "r14"));
+
+        var dcbz = Decode(EncodeXForm(0, 15, 16, 1014));
+        Assert.Equal("dcbz", dcbz.Mnemonic);
+
+        var extsh = Decode(EncodeXForm(17, 18, 0, 922, rc: true));
+        Assert.Equal("extsh.", extsh.Mnemonic);
+        Assert.Collection(extsh.Operands, op => AssertGpr(op, "r18"), op => AssertGpr(op, "r17"));
+
+        var extsb = Decode(EncodeXForm(19, 20, 0, 954, rc: true));
+        Assert.Equal("extsb.", extsb.Mnemonic);
+        Assert.Collection(extsb.Operands, op => AssertGpr(op, "r20"), op => AssertGpr(op, "r19"));
+    }
+
+    [Fact]
+    public void FallsBackToXoMnemonicForUnknownCodes()
+    {
+        var instruction = Decode(EncodeXForm(1, 2, 3, 321));
+
+        Assert.Equal("xo_321", instruction.Mnemonic);
+        Assert.Empty(instruction.Operands);
+        Assert.False(instruction.IsConditionalBranch);
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcDisassemblerTests.cs b/translator/tests/Translator.Tests/PpcDisassemblerTests.cs
new file mode 100644
index 0000000..2037ebd
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcDisassemblerTests.cs
@@ -0,0 +1,201 @@
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using Translator.Core.Disassembly;
+using Translator.Core.Loading;
+using Translator.Core.Parsing.Dol;
+using Translator.Core.Parsing.Rel;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcDisassemblerTests
+{
+    private static ProgramImage LoadImage()
+    {
+        var root = ProjectPaths.FindRepositoryRoot();
+        var assets = Path.Combine(root, "assets");
+        var builder = new ProgramImageBuilder();
+        return builder.Build(Path.Combine(assets, "main.dol"), Path.Combine(assets, "StaticR.rel"));
+    }
+
+    [Fact]
+    public void DisassemblesKnownFunctionWithStableInstructionCount()
+    {
+        var image = LoadImage();
+        using var disassembler = new PpcDisassembler();
+
+        var instructions = disassembler.DisassembleFunction(image, 0x800060A4, maxInstructions: 128);
+
+        Assert.NotEmpty(instructions);
+        Assert.True(instructions.Last().IsReturn || instructions.Last().IsUnconditionalBranch || instructions.Last().IsConditionalBranch,
+            "Function should terminate with a control-transfer instruction");
+        Assert.Equal(0x800060A4u, instructions[0].Address);
+
+        // Regression guard: reachable-walk should pull in the whole control-flow region (was ~90 after CFG-aware disasm).
+        Assert.InRange(instructions.Count, 60, 120);
+    }
+
+    [Fact]
+    public void ThrowsWhenLargeFunctionExceedsLegacyInstructionBudget()
+    {
+        var image = LoadImage();
+        using var disassembler = new PpcDisassembler();
+
+        var ex = Assert.Throws<PpcDisassemblyLimitExceededException>(
+            () => disassembler.DisassembleFunction(image, 0x80821E14, maxInstructions: 4096, maxBytes: 0x8000));
+
+        Assert.Contains("0x80821E14", ex.Message);
+        Assert.Equal(0x80821E14u, ex.EntryPoint);
+        Assert.Equal(4096, ex.MaxInstructions);
+        Assert.Equal(0x8000, ex.MaxBytes);
+        Assert.True(ex.DecodedInstructions >= 4096);
+        Assert.True(ex.BlockedAddress >= ex.EntryPoint);
+    }
+
+    [Fact]
+    public void DecodesCmpwFromXo0()
+    {
+        var instruction = PpcDecoder.Decode(0x80000000, 0x7C032800);
+
+        Assert.Equal("cmpw", instruction.Mnemonic);
+        Assert.Collection(
+            instruction.Operands,
+            op => Assert.Equal("cr0", Assert.IsType<PpcConditionRegisterOperand>(op).Name),
+            op => Assert.Equal("r3", Assert.IsType<PpcRegisterOperand>(op).Name),
+            op => Assert.Equal("r5", Assert.IsType<PpcRegisterOperand>(op).Name));
+    }
+
+    [Fact]
+    public void JumpTableTargetsIgnoreKnownExternalFunctionEntries()
+    {
+        const uint entry = 0x80000000;
+        const uint table = 0x80000100;
+        const uint case0 = entry + 0x1C;
+        const uint case1 = entry + 0x24;
+
+        var image = TranslatorCppTestHarness.CreateImage(
+            (entry + 0x00, 0x28030001), // cmplwi r3, 1
+            (entry + 0x04, 0x5463103A), // slwi r3, r3, 2
+            (entry + 0x08, 0x3D808000), // lis r12, 0x8000
+            (entry + 0x0C, 0x398C0100), // addi r12, r12, 0x100
+            (entry + 0x10, 0x7C0C182E), // lwzx r0, r12, r3
+            (entry + 0x14, 0x7C0903A6), // mtctr r0
+            (entry + 0x18, 0x4E800420), // bctr
+            (case0 + 0x00, 0x38600007), // li r3, 7
+            (case0 + 0x04, 0x4E800020), // blr
+            (case1 + 0x00, 0x38600009), // li r3, 9
+            (case1 + 0x04, 0x4E800020), // blr
+            (table + 0x00, case0),
+            (table + 0x04, case1));
+
+        using var disassembler = new PpcDisassembler();
+        var instructions = disassembler.DisassembleFunction(
+            image,
+            entry,
+            maxInstructions: 32,
+            maxBytes: 0x80,
+            knownFunctionEntryPoints: new HashSet<uint> { entry, case1 });
+
+        Assert.Contains(instructions, ins => ins.Address == case0);
+        Assert.Contains(instructions, ins => ins.Address == case1);
+    }
+
+    [Fact]
+    public void JumpTableCaseBranchCanTargetKnownLocalContinuation()
+    {
+        const uint entry = 0x80000000;
+        const uint table = 0x80000100;
+        const uint case0 = entry + 0x1C;
+        const uint case1 = entry + 0x28;
+        const uint common = entry + 0x34;
+
+        var image = TranslatorCppTestHarness.CreateImage(
+            (entry + 0x00, 0x28030002), // cmplwi r3, 2
+            (entry + 0x04, 0x5463103A), // slwi r3, r3, 2
+            (entry + 0x08, 0x3D808000), // lis r12, 0x8000
+            (entry + 0x0C, 0x398C0100), // addi r12, r12, 0x100
+            (entry + 0x10, 0x7C0C182E), // lwzx r0, r12, r3
+            (entry + 0x14, 0x7C0903A6), // mtctr r0
+            (entry + 0x18, 0x4E800420), // bctr
+            (case0 + 0x00, 0x38600007), // li r3, 7
+            (case0 + 0x04, 0x48000014), // b common
+            (case1 + 0x00, 0x38600009), // li r3, 9
+            (case1 + 0x04, 0x48000008), // b common
+            (common + 0x00, 0x4E800020), // blr
+            (table + 0x00, case0),
+            (table + 0x04, case1),
+            (table + 0x08, common));
+
+        using var disassembler = new PpcDisassembler();
+        var instructions = disassembler.DisassembleFunction(
+            image,
+            entry,
+            maxInstructions: 32,
+            maxBytes: 0x80,
+            knownFunctionEntryPoints: new HashSet<uint> { entry, case0, case1, common });
+
+        Assert.Contains(instructions, ins => ins.Address == common);
+    }
+
+    [Fact]
+    public void ConditionalBranchesStillFollowKnownFunctionEntryTargets()
+    {
+        const uint entry = 0x80001000;
+        const uint branchTarget = 0x80001014;
+
+        var image = TranslatorCppTestHarness.CreateImage(
+            (entry + 0x00, 0x2C030000), // cmpwi r3, 0
+            (entry + 0x04, EncodeBc(12, 2, 0x10)), // beq branchTarget
+            (entry + 0x08, 0x38800001), // li r4, 1
+            (entry + 0x0C, 0x4E800020), // blr
+            (branchTarget + 0x00, 0x38800002), // li r4, 2
+            (branchTarget + 0x04, 0x4E800020)); // blr
+
+        using var disassembler = new PpcDisassembler();
+        var instructions = disassembler.DisassembleFunction(
+            image,
+            entry,
+            maxInstructions: 16,
+            maxBytes: 0x40,
+            knownFunctionEntryPoints: new HashSet<uint> { entry, branchTarget });
+
+        Assert.Contains(instructions, ins => ins.Address == branchTarget);
+    }
+
+    [Fact]
+    public void DisassemblerThrowsWhenEntryPointIsOutsideLoadedImage()
+    {
+        var image = new ProgramImage(
+            new byte[8],
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, 8),
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, 8),
+            AddressRange.FromStartAndSize(MemoryLayout.RamBase, 0),
+            "test");
+
+        using var disassembler = new PpcDisassembler();
+        Assert.Throws<ArgumentOutOfRangeException>(
+            () => disassembler.DisassembleFunction(image, MemoryLayout.RamBase + 0x100));
+    }
+
+    [Fact]
+    public void LimitExceededExceptionExposesAllRecordedProperties()
+    {
+        var ex = new PpcDisassemblyLimitExceededException(
+            entryPoint: 0x800060A4,
+            maxInstructions: 32,
+            maxBytes: 0x100,
+            decodedInstructions: 32,
+            blockedAddress: 0x80006100);
+
+        Assert.Equal(0x800060A4u, ex.EntryPoint);
+        Assert.Equal(32, ex.MaxInstructions);
+        Assert.Equal(0x100, ex.MaxBytes);
+        Assert.Equal(32, ex.DecodedInstructions);
+        Assert.Equal(0x80006100u, ex.BlockedAddress);
+        Assert.Contains("0x80006100", ex.Message);
+    }
+
+    private static uint EncodeBc(uint bo, uint bi, int branchDelta, bool aa = false, bool lk = false)
+        => (16u << 26) | (bo << 21) | (bi << 16) | ((((uint)branchDelta >> 2) & 0x3FFFu) << 2) | ((aa ? 1u : 0u) << 1) | (lk ? 1u : 0u);
+}
diff --git a/translator/tests/Translator.Tests/PpcLifterAdditionalCoverageTests.cs b/translator/tests/Translator.Tests/PpcLifterAdditionalCoverageTests.cs
new file mode 100644
index 0000000..3fc944d
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcLifterAdditionalCoverageTests.cs
@@ -0,0 +1,390 @@
+using System;
+using System.Linq;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+using Translator.Core.Lifting;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcLifterAdditionalCoverageTests
+{
+    private static PpcRegisterOperand Gpr(int index) => new($"r{index}", index);
+
+    private static PpcInstruction Instruction(uint raw, string mnemonic, params PpcOperand[] operands)
+        => PpcInstruction.Synthetic(0x80000000, raw, mnemonic, operands);
+
+    [Fact]
+    public void LiftsAdditionalNonDotArithmeticAndLogicalForms()
+    {
+        var lifter = new PpcLifter();
+
+        var orc = Instruction(0, "orc", Gpr(3), Gpr(4), Gpr(5));
+        var orcIr = Assert.Single(lifter.Lift(new[] { orc })).Ir;
+        Assert.Equal("orc", Assert.IsType<IrBinary>(Assert.Single(orcIr)).Op);
+
+        var addc = Instruction(0, "addc", Gpr(6), Gpr(6), Gpr(7));
+        var addcIr = Assert.Single(lifter.Lift(new[] { addc })).Ir;
+        Assert.Equal("r6_addc_left", Assert.IsType<IrAssign>(addcIr[0]).Destination);
+        Assert.DoesNotContain(addcIr, ins => ins is IrSetCrField);
+
+        var subfc = Instruction(0, "subfc", Gpr(8), Gpr(9), Gpr(8));
+        var subfcIr = Assert.Single(lifter.Lift(new[] { subfc })).Ir;
+        Assert.Equal("r8_subfc_min", Assert.IsType<IrAssign>(subfcIr[0]).Destination);
+        Assert.DoesNotContain(subfcIr, ins => ins is IrSetCrField);
+
+        var extsb = Instruction(0, "extsb", Gpr(10), Gpr(11));
+        var extsbBinary = Assert.IsType<IrBinary>(Assert.Single(Assert.Single(lifter.Lift(new[] { extsb })).Ir));
+        Assert.Equal("sext", extsbBinary.Op);
+        Assert.Equal(8, extsbBinary.Right.Constant);
+
+        var adde = Instruction(0, "adde", Gpr(12), Gpr(12), Gpr(13));
+        var addeIr = Assert.Single(lifter.Lift(new[] { adde })).Ir;
+        Assert.Equal("PPC_GetCarry", Assert.IsType<IrCall>(addeIr[1]).Target);
+        Assert.DoesNotContain(addeIr, ins => ins is IrSetCrField);
+
+        var subfze = Instruction(0, "subfze", Gpr(14), Gpr(14));
+        var subfzeIr = Assert.Single(lifter.Lift(new[] { subfze })).Ir;
+        Assert.Equal("r14_not", Assert.IsType<IrBinary>(subfzeIr[1]).Destination);
+        Assert.DoesNotContain(subfzeIr, ins => ins is IrSetCrField);
+
+        var cmpwTwoOperand = Instruction(0, "cmpw", Gpr(15), Gpr(16));
+        var cmpwIr = Assert.Single(lifter.Lift(new[] { cmpwTwoOperand })).Ir;
+        var cmpwSetCr = Assert.IsType<IrSetCrField>(Assert.Single(cmpwIr));
+        Assert.Equal(0, cmpwSetCr.FieldIndex);
+        Assert.False(cmpwSetCr.IsUnsigned);
+        Assert.Equal("r15", cmpwSetCr.Left.RegisterName);
+        Assert.Equal("r16", cmpwSetCr.Right.RegisterName);
+
+        var nand = Instruction(0, "nand", Gpr(17), Gpr(18), Gpr(19));
+        Assert.Equal("nand", Assert.IsType<IrBinary>(Assert.Single(Assert.Single(lifter.Lift(new[] { nand })).Ir)).Op);
+
+        var eqv = Instruction(0, "eqv.", Gpr(17), Gpr(18), Gpr(19));
+        var eqvIr = Assert.Single(lifter.Lift(new[] { eqv })).Ir;
+        Assert.Equal("eqv", Assert.IsType<IrBinary>(eqvIr[0]).Op);
+        Assert.IsType<IrSetCrField>(eqvIr[1]);
+
+        var extsh = Instruction(0, "extsh", Gpr(20), Gpr(21));
+        var extshBinary = Assert.IsType<IrBinary>(Assert.Single(Assert.Single(lifter.Lift(new[] { extsh })).Ir));
+        Assert.Equal("sext", extshBinary.Op);
+        Assert.Equal(16, extshBinary.Right.Constant);
+
+        var divw = Instruction(0, "divw", Gpr(22), Gpr(23), Gpr(24));
+        Assert.Equal("div", Assert.IsType<IrBinary>(Assert.Single(Assert.Single(lifter.Lift(new[] { divw })).Ir)).Op);
+
+        var slwi = Instruction(0, "slwi", Gpr(25), Gpr(26), new PpcImmediateOperand(3));
+        Assert.Equal("shl", Assert.IsType<IrBinary>(Assert.Single(Assert.Single(lifter.Lift(new[] { slwi })).Ir)).Op);
+
+        var addic = Instruction(0, "addic", Gpr(27), Gpr(27), new PpcImmediateOperand(4));
+        var addicIr = Assert.Single(lifter.Lift(new[] { addic })).Ir;
+        Assert.Equal("r27_addic_src", Assert.IsType<IrAssign>(addicIr[0]).Destination);
+        Assert.DoesNotContain(addicIr, ins => ins is IrSetCrField);
+    }
+
+    [Fact]
+    public void LiftsAdditionalMemoryAndControlFormsAndRejectsInvalidUpdateBases()
+    {
+        var lifter = new PpcLifter();
+
+        var dcbzL = Instruction(0, "dcbz_l", Gpr(3), Gpr(4));
+        var dcbzLIr = Assert.Single(lifter.Lift(new[] { dcbzL })).Ir;
+        Assert.Equal("r4_addr_dcbz", Assert.IsType<IrBinary>(dcbzLIr[0]).Destination);
+        Assert.Equal("memset_zero_32", Assert.IsType<IrCall>(dcbzLIr[2]).Target);
+
+        var rfi = Instruction(0, "rfi");
+        Assert.IsType<IrReturn>(Assert.Single(Assert.Single(lifter.Lift(new[] { rfi })).Ir));
+
+        var lfdu = Instruction(0, "lfdu", new PpcRegisterOperand("f1", 1), new PpcDisplacementOperand(8, "r2", 2));
+        var lfduIr = Assert.Single(lifter.Lift(new[] { lfdu })).Ir;
+        Assert.Equal("r2_addr", Assert.IsType<IrBinary>(lfduIr[0]).Destination);
+        Assert.Equal("f1", Assert.IsType<IrLoad>(lfduIr[1]).Destination);
+        Assert.Equal("r2", Assert.IsType<IrAssign>(lfduIr[2]).Destination);
+
+        var invalidLfdu = Instruction(0, "lfdu", new PpcRegisterOperand("f1", 1), new PpcDisplacementOperand(8, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLfdu }));
+
+        var invalidLfsu = Instruction(0, "lfsu", new PpcRegisterOperand("f2", 2), new PpcDisplacementOperand(4, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLfsu }));
+
+        var invalidLhzu = Instruction(0, "lhzu", Gpr(3), new PpcDisplacementOperand(2, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLhzu }));
+
+        var invalidStbu = Instruction(0, "stbu", Gpr(4), new PpcDisplacementOperand(1, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidStbu }));
+
+        var invalidSthu = Instruction(0, "sthu", Gpr(5), new PpcDisplacementOperand(2, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidSthu }));
+    }
+
+    [Fact]
+    public void LiftsLegacyOpcodeAliasesAndR0StoreForms()
+    {
+        var lifter = new PpcLifter();
+
+        var andis = Instruction((3u << 21) | (4u << 16) | 0x1234u, "opc_29");
+        var andisIr = Assert.Single(lifter.Lift(new[] { andis })).Ir;
+        var andisBinary = Assert.IsType<IrBinary>(andisIr[0]);
+        Assert.Equal("r4", andisBinary.Destination);
+        Assert.Equal("and", andisBinary.Op);
+        Assert.IsType<IrSetCrField>(andisIr[1]);
+
+        var legacySthu = Instruction((5u << 21) | (6u << 16) | 0x0002u, "opc_45");
+        var legacySthuIr = Assert.Single(lifter.Lift(new[] { legacySthu })).Ir;
+        Assert.Equal("r6_sthu_ea", Assert.IsType<IrBinary>(legacySthuIr[0]).Destination);
+        Assert.Equal("r6", Assert.IsType<IrAssign>(legacySthuIr[2]).Destination);
+
+        var stwR0 = Instruction(0, "stw", Gpr(7), new PpcDisplacementOperand(12, "r0", 0));
+        var stwR0Ir = Assert.Single(lifter.Lift(new[] { stwR0 })).Ir;
+        Assert.Collection(
+            stwR0Ir,
+            ins =>
+            {
+                var assign = Assert.IsType<IrAssign>(ins);
+                Assert.Equal("r7_ea", assign.Destination);
+                Assert.Equal(12, assign.Value.Constant);
+            },
+            ins =>
+            {
+                var store = Assert.IsType<IrStore>(ins);
+                Assert.Equal("r7_ea", store.Address.Base);
+            });
+    }
+
+    [Fact]
+    public void LiftsAdditionalIndexedFloatingAndRotateMaskForms()
+    {
+        var lifter = new PpcLifter();
+
+        var bgtlr = Instruction(0, "bgtlr");
+        var bgtlrBranch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bgtlr })).Ir));
+        Assert.Equal("bgt", bgtlrBranch.Condition);
+        Assert.Equal("return", bgtlrBranch.TrueLabel);
+
+        var sc = Instruction(0, "sc");
+        Assert.Equal("OSSystemCall", Assert.IsType<IrCall>(Assert.Single(Assert.Single(lifter.Lift(new[] { sc })).Ir)).Target);
+
+        var tw = Instruction((31u << 21) | (4u << 16) | (5u << 11), "tw");
+        var trap = Assert.IsType<IrCall>(Assert.Single(Assert.Single(lifter.Lift(new[] { tw })).Ir));
+        Assert.Equal("PPC_TrapWord", trap.Target);
+        Assert.Equal(31, trap.Arguments[0].Constant);
+        Assert.Equal("r4", trap.Arguments[1].RegisterName);
+        Assert.Equal("r5", trap.Arguments[2].RegisterName);
+
+        var twi = Instruction((12u << 21) | (6u << 16) | 0xFFFEu, "twi");
+        var immediateTrap = Assert.IsType<IrCall>(Assert.Single(Assert.Single(lifter.Lift(new[] { twi })).Ir));
+        Assert.Equal("PPC_TrapWord", immediateTrap.Target);
+        Assert.Equal(12, immediateTrap.Arguments[0].Constant);
+        Assert.Equal("r6", immediateTrap.Arguments[1].RegisterName);
+        Assert.Equal(-2, immediateTrap.Arguments[2].Constant);
+
+        var addis = Instruction(0, "addis", Gpr(3), Gpr(0), new PpcImmediateOperand(0x1234));
+        var addisBinary = Assert.IsType<IrBinary>(Assert.Single(Assert.Single(lifter.Lift(new[] { addis })).Ir));
+        Assert.Equal("add", addisBinary.Op);
+        Assert.Equal(0x12340000, addisBinary.Right.Constant);
+        Assert.Equal(0, addisBinary.Left.Constant);
+
+        var lfdx = Instruction((1u << 21) | (2u << 16) | (3u << 11), "lfdx");
+        var lfdxIr = Assert.Single(lifter.Lift(new[] { lfdx })).Ir;
+        Assert.Equal("addr_lfdx_80000000_loc", Assert.IsType<IrBinary>(lfdxIr[0]).Destination);
+        Assert.Equal("f1", Assert.IsType<IrLoad>(lfdxIr[1]).Destination);
+
+        var lfsx = Instruction((4u << 21) | (5u << 16) | (6u << 11), "lfsx");
+        var lfsxIr = Assert.Single(lifter.Lift(new[] { lfsx })).Ir;
+        Assert.Equal("f4", Assert.IsType<IrLoad>(lfsxIr[1]).Destination);
+
+        var lfsux = Instruction((7u << 21) | (8u << 16) | (9u << 11), "lfsux");
+        var lfsuxIr = Assert.Single(lifter.Lift(new[] { lfsux })).Ir;
+        Assert.Equal("addr_lfsux_80000000_loc", Assert.IsType<IrBinary>(lfsuxIr[0]).Destination);
+        Assert.Equal("r8", Assert.IsType<IrAssign>(lfsuxIr[2]).Destination);
+        var badLfsux = Instruction((7u << 21) | (0u << 16) | (9u << 11), "lfsux");
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { badLfsux }));
+
+        var lfdux = Instruction((7u << 21) | (8u << 16) | (9u << 11), "lfdux");
+        var lfduxIr = Assert.Single(lifter.Lift(new[] { lfdux })).Ir;
+        Assert.Equal("addr_lfdux_80000000_loc", Assert.IsType<IrBinary>(lfduxIr[0]).Destination);
+        Assert.Equal("f7", Assert.IsType<IrLoad>(lfduxIr[1]).Destination);
+        Assert.Equal("r8", Assert.IsType<IrAssign>(lfduxIr[2]).Destination);
+        var badLfdux = Instruction((7u << 21) | (0u << 16) | (9u << 11), "lfdux");
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { badLfdux }));
+
+        var stfdx = Instruction((10u << 21) | (11u << 16) | (12u << 11), "stfdx");
+        var stfdxStore = Assert.IsType<IrStore>(Assert.Single(Assert.Single(lifter.Lift(new[] { stfdx })).Ir.Skip(1)));
+        Assert.Equal("f10", stfdxStore.Source.RegisterName);
+
+        var stfsx = Instruction((13u << 21) | (14u << 16) | (15u << 11), "stfsx");
+        var stfsxStore = Assert.IsType<IrStore>(Assert.Single(Assert.Single(lifter.Lift(new[] { stfsx })).Ir.Skip(1)));
+        Assert.Equal("f13", stfsxStore.Source.RegisterName);
+
+        var stfsux = Instruction((16u << 21) | (17u << 16) | (18u << 11), "stfsux");
+        var stfsuxIr = Assert.Single(lifter.Lift(new[] { stfsux })).Ir;
+        Assert.Equal("r17", Assert.IsType<IrBinary>(stfsuxIr[0]).Destination);
+        Assert.Equal("f16", Assert.IsType<IrStore>(stfsuxIr[1]).Source.RegisterName);
+        var badStfsux = Instruction((16u << 21) | (0u << 16) | (18u << 11), "stfsux");
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { badStfsux }));
+
+        var stfdux = Instruction((16u << 21) | (17u << 16) | (18u << 11), "stfdux");
+        var stfduxIr = Assert.Single(lifter.Lift(new[] { stfdux })).Ir;
+        Assert.Equal("addr_stfdux_80000000_loc", Assert.IsType<IrBinary>(stfduxIr[0]).Destination);
+        Assert.Equal("f16", Assert.IsType<IrStore>(stfduxIr[1]).Source.RegisterName);
+        Assert.Equal("r17", Assert.IsType<IrAssign>(stfduxIr[2]).Destination);
+        var badStfdux = Instruction((16u << 21) | (0u << 16) | (18u << 11), "stfdux");
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { badStfdux }));
+
+        var sthux = Instruction((19u << 21) | (20u << 16) | (21u << 11), "sthux");
+        var sthuxIr = Assert.Single(lifter.Lift(new[] { sthux })).Ir;
+        Assert.Equal("addr_sthux_80000000_loc", Assert.IsType<IrBinary>(sthuxIr[0]).Destination);
+        Assert.Equal("r20", Assert.IsType<IrAssign>(sthuxIr[2]).Destination);
+        var badSthux = Instruction((19u << 21) | (0u << 16) | (21u << 11), "sthux");
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { badSthux }));
+
+        var stfiwx = Instruction((22u << 21) | (23u << 16) | (24u << 11), "stfiwx");
+        var stfiwxCall = Assert.IsType<IrCall>(Assert.Single(Assert.Single(lifter.Lift(new[] { stfiwx })).Ir.Skip(1)));
+        Assert.Equal("PPC_Stfiwx", stfiwxCall.Target);
+        Assert.Equal("f22", stfiwxCall.Arguments[1].RegisterName);
+
+        var clrlwi = Instruction(0, "clrlwi", Gpr(25), Gpr(26), new PpcImmediateOperand(8));
+        var clrlwiIr = Assert.Single(lifter.Lift(new[] { clrlwi })).Ir;
+        Assert.Single(clrlwiIr);
+        Assert.Equal("and", Assert.IsType<IrBinary>(clrlwiIr[0]).Op);
+
+        var rlwinm = Instruction(0, "rlwinm", Gpr(27), Gpr(28), new PpcImmediateOperand(5), new PpcImmediateOperand(3), new PpcImmediateOperand(7));
+        var rlwinmIr = Assert.Single(lifter.Lift(new[] { rlwinm })).Ir;
+        Assert.Contains(rlwinmIr, ins => ins is IrBinary binary && binary.Destination == "r27_rot");
+
+        var rlwimi = Instruction(0, "rlwimi", Gpr(29), Gpr(30), new PpcImmediateOperand(4), new PpcImmediateOperand(8), new PpcImmediateOperand(12));
+        var rlwimiIr = Assert.Single(lifter.Lift(new[] { rlwimi })).Ir;
+        Assert.Contains(rlwimiIr, ins => ins is IrBinary binary && binary.Destination == "r29_mdest");
+
+        var rlwnm = Instruction(0, "rlwnm", Gpr(31), Gpr(1), Gpr(2), new PpcImmediateOperand(4), new PpcImmediateOperand(9));
+        var rlwnmIr = Assert.Single(lifter.Lift(new[] { rlwnm })).Ir;
+        Assert.Contains(rlwnmIr, ins => ins is IrBinary binary && binary.Destination == "r31_rot");
+        Assert.Contains(rlwnmIr, ins => ins is IrBinary binary && binary.Destination == "r31" && binary.Op == "and");
+    }
+
+    [Fact]
+    public void LiftsAdditionalSprShiftAndControlDotForms()
+    {
+        var lifter = new PpcLifter();
+
+        var orcDot = Instruction(0, "orc.", Gpr(3), Gpr(4), Gpr(5));
+        Assert.Contains(Assert.Single(lifter.Lift(new[] { orcDot })).Ir, ins => ins is IrSetCrField);
+
+        var divwuDot = Instruction(0, "divwu.", Gpr(6), Gpr(7), Gpr(8));
+        Assert.Contains(Assert.Single(lifter.Lift(new[] { divwuDot })).Ir, ins => ins is IrSetCrField);
+
+        var rlwnmDot = Instruction(0, "rlwnm.", Gpr(9), Gpr(10), Gpr(11), new PpcImmediateOperand(3), new PpcImmediateOperand(9));
+        Assert.Contains(Assert.Single(lifter.Lift(new[] { rlwnmDot })).Ir, ins => ins is IrSetCrField);
+
+        var mfsprHid0 = Instruction(0, "mfspr", Gpr(12), new PpcImmediateOperand(1008));
+        Assert.Equal("hid0", Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mfsprHid0 })).Ir)).Value.RegisterName);
+
+        var mfsprFallback = Instruction(0, "mfspr", Gpr(13), new PpcImmediateOperand(31));
+        var mfsprFallbackIr = Assert.Single(lifter.Lift(new[] { mfsprFallback })).Ir;
+        Assert.IsType<IrComment>(mfsprFallbackIr[0]);
+        Assert.Equal("PPC_ReadSpr", Assert.IsType<IrCall>(mfsprFallbackIr[1]).Target);
+
+        var mtsprHid1 = Instruction(0, "mtspr", new PpcImmediateOperand(1009), Gpr(14));
+        Assert.Equal("hid1", Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mtsprHid1 })).Ir)).Destination);
+
+        var mtsprFallback = Instruction(0, "mtspr", new PpcImmediateOperand(16), Gpr(15));
+        var mtsprFallbackIr = Assert.Single(lifter.Lift(new[] { mtsprFallback })).Ir;
+        Assert.IsType<IrComment>(mtsprFallbackIr[0]);
+        Assert.Equal("PPC_WriteSpr", Assert.IsType<IrCall>(mtsprFallbackIr[1]).Target);
+
+        var mtsr = Instruction(0, "mtsr", new PpcImmediateOperand(3), Gpr(16));
+        Assert.IsType<IrComment>(Assert.Single(Assert.Single(lifter.Lift(new[] { mtsr })).Ir));
+
+        var mtsrin = Instruction(0, "mtsrin", Gpr(16), Gpr(17));
+        Assert.IsType<IrComment>(Assert.Single(Assert.Single(lifter.Lift(new[] { mtsrin })).Ir));
+
+        var mfsr = Instruction(0, "mfsr", Gpr(17), new PpcImmediateOperand(3));
+        Assert.Equal(0, Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mfsr })).Ir)).Value.Constant);
+
+        var mfsrin = Instruction(0, "mfsrin", Gpr(18), Gpr(19));
+        Assert.Equal(0, Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mfsrin })).Ir)).Value.Constant);
+
+        var mulhwuDot = Instruction(0, "mulhwu.", Gpr(18), Gpr(19), Gpr(20));
+        Assert.Contains(Assert.Single(lifter.Lift(new[] { mulhwuDot })).Ir, ins => ins is IrSetCrField);
+
+        var mulhwDot = Instruction(0, "mulhw.", Gpr(21), Gpr(22), Gpr(23));
+        Assert.Contains(Assert.Single(lifter.Lift(new[] { mulhwDot })).Ir, ins => ins is IrSetCrField);
+
+        var bdz = Instruction(0, "bdz", new PpcImmediateOperand(unchecked((int)0x80000010)));
+        Assert.Equal("bdz", Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bdz })).Ir.Skip(1))).Condition);
+
+        var srwi = Instruction(0, "srwi", Gpr(24), Gpr(25), new PpcImmediateOperand(5));
+        Assert.Equal("shr", Assert.IsType<IrBinary>(Assert.Single(Assert.Single(lifter.Lift(new[] { srwi })).Ir)).Op);
+
+        var slwDot = Instruction(0, "slw.", Gpr(26), Gpr(27), Gpr(28));
+        Assert.Contains(Assert.Single(lifter.Lift(new[] { slwDot })).Ir, ins => ins is IrSetCrField);
+
+        var andisDot = Instruction(0, "andis.", Gpr(29), Gpr(30), new PpcImmediateOperand(0x1234));
+        var andisDotIr = Assert.Single(lifter.Lift(new[] { andisDot })).Ir;
+        var andisDotBinary = Assert.IsType<IrBinary>(andisDotIr[0]);
+        Assert.Equal(0x12340000, andisDotBinary.Right.Constant);
+        Assert.Contains(andisDotIr, ins => ins is IrSetCrField);
+
+        var andcDot = Instruction(0, "andc.", Gpr(31), Gpr(1), Gpr(2));
+        Assert.Contains(Assert.Single(lifter.Lift(new[] { andcDot })).Ir, ins => ins is IrSetCrField);
+
+        var xorDot = Instruction(0, "xor.", Gpr(3), Gpr(4), Gpr(5));
+        Assert.Contains(Assert.Single(lifter.Lift(new[] { xorDot })).Ir, ins => ins is IrSetCrField);
+
+        var bltlr = Instruction(0, "bltlr");
+        Assert.Equal("blt", Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bltlr })).Ir)).Condition);
+
+        var cntlzwDot = Instruction(0, "cntlzw.", Gpr(6), Gpr(7));
+        Assert.Contains(Assert.Single(lifter.Lift(new[] { cntlzwDot })).Ir, ins => ins is IrSetCrField);
+
+        var invalidLwzu = Instruction(0, "lwzu", Gpr(8), new PpcDisplacementOperand(4, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLwzu }));
+
+        var bclrl = Instruction((12u << 21) | (8u << 16), "bclrl", new PpcConditionRegisterOperand("cr2", 8));
+        var bclrlBranch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bclrl })).Ir));
+        Assert.Contains("call_lr_80000000_80000004", bclrlBranch.TrueLabel, StringComparison.Ordinal);
+        Assert.Equal("raw", bclrlBranch.Condition);
+        Assert.Contains("GetCRBit(ctx, 2, 0)", bclrlBranch.ConditionRegister, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LiftsAdditionalIndexedHalfwordAndStoreUpdateForms()
+    {
+        var lifter = new PpcLifter();
+
+        var stfdu = Instruction(0, "stfdu", new PpcRegisterOperand("f1", 1), new PpcDisplacementOperand(8, "r2", 2));
+        var stfduIr = Assert.Single(lifter.Lift(new[] { stfdu })).Ir;
+        Assert.Equal("r2", Assert.IsType<IrBinary>(stfduIr[0]).Destination);
+        Assert.Equal("f1", Assert.IsType<IrStore>(stfduIr[1]).Source.RegisterName);
+
+        var stfsu = Instruction(0, "stfsu", new PpcRegisterOperand("f3", 3), new PpcDisplacementOperand(4, "r4", 4));
+        var stfsuIr = Assert.Single(lifter.Lift(new[] { stfsu })).Ir;
+        Assert.Equal("r4", Assert.IsType<IrBinary>(stfsuIr[0]).Destination);
+        Assert.Equal("f3", Assert.IsType<IrStore>(stfsuIr[1]).Source.RegisterName);
+
+        var invalidStwux = Instruction(0, "stwux", Gpr(5), Gpr(0), Gpr(6));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidStwux }));
+
+        var invalidLwzux = Instruction(0, "lwzux", Gpr(7), Gpr(0), Gpr(8));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLwzux }));
+
+        var lhzx = Instruction((9u << 21) | (10u << 16) | (11u << 11), "lhzx", Gpr(9), Gpr(10), Gpr(11));
+        var lhzxIr = Assert.Single(lifter.Lift(new[] { lhzx })).Ir;
+        Assert.Equal("r9", Assert.IsType<IrLoad>(lhzxIr[1]).Destination);
+
+        var lhaux = Instruction((12u << 21) | (13u << 16) | (14u << 11), "lhaux", Gpr(12), Gpr(13), Gpr(14));
+        var lhauxIr = Assert.Single(lifter.Lift(new[] { lhaux })).Ir;
+        Assert.Equal("r12", Assert.IsType<IrLoad>(lhauxIr[1]).Destination);
+        Assert.Equal("r13", Assert.IsType<IrAssign>(lhauxIr[4]).Destination);
+
+        var invalidLhaux = Instruction((12u << 21) | (0u << 16) | (14u << 11), "lhaux", Gpr(12), Gpr(0), Gpr(14));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLhaux }));
+
+        var lhzux = Instruction((15u << 21) | (16u << 16) | (17u << 11), "lhzux", Gpr(15), Gpr(16), Gpr(17));
+        var lhzuxIr = Assert.Single(lifter.Lift(new[] { lhzux })).Ir;
+        Assert.Equal("r15", Assert.IsType<IrLoad>(lhzuxIr[1]).Destination);
+        Assert.Equal("r16", Assert.IsType<IrAssign>(lhzuxIr[2]).Destination);
+
+        var invalidLhzux = Instruction((15u << 21) | (0u << 16) | (17u << 11), "lhzux", Gpr(15), Gpr(0), Gpr(17));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLhzux }));
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcLifterCoverageTests.cs b/translator/tests/Translator.Tests/PpcLifterCoverageTests.cs
new file mode 100644
index 0000000..c8ee8af
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcLifterCoverageTests.cs
@@ -0,0 +1,678 @@
+using System;
+using System.Linq;
+using System.Reflection;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+using Translator.Core.Lifting;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcLifterCoverageTests
+{
+    private static PpcRegisterOperand Gpr(int index) => new($"r{index}", index);
+    private static readonly Type LifterType = typeof(PpcLifter);
+
+    private static PpcInstruction Instruction(uint raw, string mnemonic, params PpcOperand[] operands)
+        => PpcInstruction.Synthetic(0x80000000, raw, mnemonic, operands);
+
+    private static T InvokePrivate<T>(string name, params object?[] args)
+    {
+        var method = LifterType.GetMethod(name, BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(method);
+        return (T)method!.Invoke(null, args)!;
+    }
+
+    [Fact]
+    public void NormalizesCrBitStyleConditionRegistersDuringCompare()
+    {
+        var instruction = Instruction(
+            0x7C032800,
+            "cmpw",
+            new PpcOperand[]
+            {
+                new PpcConditionRegisterOperand("cr28", 28),
+                Gpr(3),
+                Gpr(5)
+            });
+
+        var ir = Assert.Single(new PpcLifter().Lift(new[] { instruction })).Ir;
+        var setCr = Assert.IsType<IrSetCrField>(Assert.Single(ir));
+        Assert.Equal(7, setCr.FieldIndex);
+        Assert.Equal("r3", setCr.Left.RegisterName);
+        Assert.Equal("r5", setCr.Right.RegisterName);
+    }
+
+    [Fact]
+    public void LiftsXoriDotAndBarrierInstructions()
+    {
+        var lifter = new PpcLifter();
+
+        var nop = Instruction(0, "nop");
+        Assert.Empty(Assert.Single(lifter.Lift(new[] { nop })).Ir);
+
+        var xori = Instruction(0, "xori.", Gpr(4), Gpr(5), new PpcImmediateOperand(-1));
+        var xoriIr = Assert.Single(lifter.Lift(new[] { xori })).Ir;
+        var xoriBinary = Assert.IsType<IrBinary>(xoriIr[0]);
+        Assert.Equal("r4", xoriBinary.Destination);
+        Assert.Equal("xor", xoriBinary.Op);
+        Assert.Equal(0xFFFF, xoriBinary.Right.Constant);
+        Assert.IsType<IrSetCrField>(xoriIr[1]);
+
+        var sync = Instruction(0, "sync");
+        var syncIr = Assert.Single(lifter.Lift(new[] { sync })).Ir;
+        Assert.Contains("sync", Assert.IsType<IrComment>(Assert.Single(syncIr)).Text, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void LiftsAliasingCarryInstructions()
+    {
+        var lifter = new PpcLifter();
+
+        var addc = Instruction(0, "addc.", Gpr(3), Gpr(3), Gpr(4));
+        var addcIr = Assert.Single(lifter.Lift(new[] { addc })).Ir;
+        var addcTemp = Assert.IsType<IrAssign>(addcIr[0]);
+        Assert.Equal("r3_addc_left", addcTemp.Destination);
+        Assert.Equal("r3", addcTemp.Value.RegisterName);
+        Assert.Equal("add", Assert.IsType<IrBinary>(addcIr[1]).Op);
+        Assert.Equal("PPC_UpdateCarryAdd", Assert.IsType<IrCall>(addcIr[2]).Target);
+        Assert.IsType<IrSetCrField>(addcIr[3]);
+
+        var subfc = Instruction(0, "subfc.", Gpr(5), Gpr(1), Gpr(5));
+        var subfcIr = Assert.Single(lifter.Lift(new[] { subfc })).Ir;
+        var subfcTemp = Assert.IsType<IrAssign>(subfcIr[0]);
+        Assert.Equal("r5_subfc_min", subfcTemp.Destination);
+        Assert.Equal("r5", subfcTemp.Value.RegisterName);
+        Assert.Equal("sub", Assert.IsType<IrBinary>(subfcIr[1]).Op);
+        Assert.Equal("PPC_UpdateCarrySub", Assert.IsType<IrCall>(subfcIr[2]).Target);
+        Assert.IsType<IrSetCrField>(subfcIr[3]);
+
+        var lmw = Instruction(0, "lmw", Gpr(30), new PpcDisplacementOperand(8, "r4", 4));
+        var lmwIr = Assert.Single(lifter.Lift(new[] { lmw })).Ir;
+        Assert.Collection(
+            lmwIr,
+            op => Assert.Equal("r30", Assert.IsType<IrLoad>(op).Destination),
+            op => Assert.Equal("r31", Assert.IsType<IrLoad>(op).Destination));
+    }
+
+    [Fact]
+    public void LiftsIndexedByteUpdateFormsAndRejectsZeroBase()
+    {
+        var lifter = new PpcLifter();
+
+        var lbzux = Instruction((3u << 21) | (4u << 16) | (5u << 11), "lbzux");
+        var lbzuxIr = Assert.Single(lifter.Lift(new[] { lbzux })).Ir;
+        Assert.Equal(3, lbzuxIr.Count);
+        Assert.Equal("addr_lbzux_80000000_loc", Assert.IsType<IrBinary>(lbzuxIr[0]).Destination);
+        Assert.Equal("r3", Assert.IsType<IrLoad>(lbzuxIr[1]).Destination);
+        Assert.Equal("r4", Assert.IsType<IrAssign>(lbzuxIr[2]).Destination);
+
+        var stbux = Instruction((2u << 21) | (4u << 16) | (5u << 11), "stbux");
+        var stbuxIr = Assert.Single(lifter.Lift(new[] { stbux })).Ir;
+        Assert.Equal(3, stbuxIr.Count);
+        Assert.Equal("addr_stbux_80000000_loc", Assert.IsType<IrBinary>(stbuxIr[0]).Destination);
+        Assert.IsType<IrStore>(stbuxIr[1]);
+        Assert.Equal("r4", Assert.IsType<IrAssign>(stbuxIr[2]).Destination);
+
+        var invalidLbzux = Instruction((1u << 21) | (0u << 16) | (5u << 11), "lbzux");
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLbzux }));
+
+        var invalidStbux = Instruction((1u << 21) | (0u << 16) | (5u << 11), "stbux");
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidStbux }));
+    }
+
+    [Fact]
+    public void LiftsChainedCarryAndZeroingVariants()
+    {
+        var lifter = new PpcLifter();
+
+        var adde = Instruction(0, "adde.", Gpr(7), Gpr(7), Gpr(8));
+        var addeIr = Assert.Single(lifter.Lift(new[] { adde })).Ir;
+        Assert.Equal("r7_adde_left", Assert.IsType<IrAssign>(addeIr[0]).Destination);
+        Assert.Equal("PPC_GetCarry", Assert.IsType<IrCall>(addeIr[1]).Target);
+        Assert.Equal("add", Assert.IsType<IrBinary>(addeIr[2]).Op);
+        Assert.Equal("add", Assert.IsType<IrBinary>(addeIr[3]).Op);
+        Assert.Equal("PPC_UpdateCarryAdd", Assert.IsType<IrCall>(addeIr[4]).Target);
+        Assert.IsType<IrSetCrField>(addeIr[5]);
+
+        var addze = Instruction(0, "addze.", Gpr(9), Gpr(9));
+        var addzeIr = Assert.Single(lifter.Lift(new[] { addze })).Ir;
+        Assert.Equal("r9_addze_src", Assert.IsType<IrAssign>(addzeIr[0]).Destination);
+        Assert.Equal("PPC_GetCarry", Assert.IsType<IrCall>(addzeIr[1]).Target);
+        Assert.Equal("PPC_UpdateCarryAdd", Assert.IsType<IrCall>(addzeIr[3]).Target);
+        Assert.IsType<IrSetCrField>(addzeIr[4]);
+
+        var addme = Instruction(0, "addme.", Gpr(11), Gpr(11));
+        var addmeIr = Assert.Single(lifter.Lift(new[] { addme })).Ir;
+        Assert.Equal("r11_addme_src", Assert.IsType<IrAssign>(addmeIr[0]).Destination);
+        Assert.Equal("PPC_GetCarry", Assert.IsType<IrCall>(addmeIr[1]).Target);
+        Assert.Equal(-1, Assert.IsType<IrBinary>(addmeIr[2]).Right.Constant);
+        Assert.Equal("PPC_UpdateCarryAdd", Assert.IsType<IrCall>(addmeIr[4]).Target);
+        Assert.IsType<IrSetCrField>(addmeIr[5]);
+
+        var subfze = Instruction(0, "subfze.", Gpr(10), Gpr(10));
+        var subfzeIr = Assert.Single(lifter.Lift(new[] { subfze })).Ir;
+        Assert.Equal("r10_subfze_src", Assert.IsType<IrAssign>(subfzeIr[0]).Destination);
+        Assert.Equal("not", Assert.IsType<IrBinary>(subfzeIr[1]).Op);
+        Assert.Equal("PPC_GetCarry", Assert.IsType<IrCall>(subfzeIr[2]).Target);
+        Assert.Equal("PPC_UpdateCarryAdd", Assert.IsType<IrCall>(subfzeIr[4]).Target);
+        Assert.IsType<IrSetCrField>(subfzeIr[5]);
+
+        var subfme = Instruction(0, "subfme.", Gpr(12), Gpr(12));
+        var subfmeIr = Assert.Single(lifter.Lift(new[] { subfme })).Ir;
+        Assert.Equal("r12_subfme_src", Assert.IsType<IrAssign>(subfmeIr[0]).Destination);
+        Assert.Equal("not", Assert.IsType<IrBinary>(subfmeIr[1]).Op);
+        Assert.Equal("PPC_GetCarry", Assert.IsType<IrCall>(subfmeIr[2]).Target);
+        Assert.Equal(-1, Assert.IsType<IrBinary>(subfmeIr[3]).Right.Constant);
+        Assert.Equal("PPC_UpdateCarryAdd", Assert.IsType<IrCall>(subfmeIr[5]).Target);
+        Assert.IsType<IrSetCrField>(subfmeIr[6]);
+    }
+
+    [Fact]
+    public void LiftsBranchCtrCrAndMaskedRegisterForms()
+    {
+        var lifter = new PpcLifter();
+
+        var bcctr = Instruction((4u << 21) | (9u << 16), "bcctr");
+        var bcctrIr = Assert.Single(lifter.Lift(new[] { bcctr })).Ir;
+        var bcctrBranch = Assert.IsType<IrBranch>(Assert.Single(bcctrIr));
+        Assert.Equal("raw", bcctrBranch.Condition);
+        Assert.Equal("indirect_ctr_80000000", bcctrBranch.TrueLabel);
+        Assert.Equal("0x80000004", bcctrBranch.FalseLabel);
+        Assert.Contains("GetCRBit(ctx, 2, 1)", bcctrBranch.ConditionRegister, StringComparison.Ordinal);
+
+        var bctr = PpcInstruction.Synthetic(
+            0x80000010,
+            0,
+            "bctr",
+            Array.Empty<PpcOperand>(),
+            branchTargets: new[] { 0x80000030u, 0x80000020u, 0x80000030u });
+        var bctrIr = Assert.Single(lifter.Lift(new[] { bctr })).Ir;
+        var jumpTable = Assert.IsType<IrJumpTable>(Assert.Single(bctrIr));
+        Assert.Equal("ctr", jumpTable.Selector);
+        Assert.Equal(new uint[] { 0x80000030u, 0x80000020u }, jumpTable.Cases.Select(c => c.TargetAddress));
+
+        var directBctr = Instruction(0, "bctr");
+        var directBctrIr = Assert.Single(lifter.Lift(new[] { directBctr })).Ir;
+        Assert.Equal("ctr", Assert.IsType<IrIndirectJump>(Assert.Single(directBctrIr)).Target.RegisterName);
+
+        var crclr = Instruction(0, "crclr", new PpcConditionRegisterOperand("cr7eq", 30));
+        var crclrIr = Assert.Single(lifter.Lift(new[] { crclr })).Ir;
+        var crclrCall = Assert.IsType<IrCall>(Assert.Single(crclrIr));
+        Assert.Equal("PPC_CrSetBit", crclrCall.Target);
+        Assert.Equal(new long?[] { 30, 0 }, crclrCall.Arguments.Select(a => a.Constant).ToArray());
+
+        var cror = Instruction(
+            0,
+            "cror",
+            new PpcOperand[]
+            {
+                new PpcConditionRegisterOperand("crb1", 1),
+                new PpcConditionRegisterOperand("crb2", 2),
+                new PpcConditionRegisterOperand("crb3", 3)
+            });
+        var crorIr = Assert.Single(lifter.Lift(new[] { cror })).Ir;
+        var crorCall = Assert.IsType<IrCall>(Assert.Single(crorIr));
+        Assert.Equal("PPC_CrLogical", crorCall.Target);
+        Assert.Equal(new long?[] { 7, 1, 2, 3 }, crorCall.Arguments.Select(a => a.Constant).ToArray());
+
+        var mtcrfNoOp = Instruction(0, "mtcrf", new PpcImmediateOperand(0), Gpr(3));
+        var mtcrfNoOpIr = Assert.Single(lifter.Lift(new[] { mtcrfNoOp })).Ir;
+        Assert.Contains("no-op", Assert.IsType<IrComment>(Assert.Single(mtcrfNoOpIr)).Text, StringComparison.Ordinal);
+
+        var mtcrfMasked = Instruction(0, "mtcrf", new PpcImmediateOperand(0x80), Gpr(4));
+        var mtcrfMaskedIr = Assert.Single(lifter.Lift(new[] { mtcrfMasked })).Ir;
+        Assert.Equal(3, mtcrfMaskedIr.Count);
+        var maskedSrc = Assert.IsType<IrBinary>(mtcrfMaskedIr[0]);
+        Assert.Equal("r4_mtcrf_src", maskedSrc.Destination);
+        Assert.Equal(unchecked((int)0xF0000000), maskedSrc.Right.Constant);
+        Assert.Equal("cr", Assert.IsType<IrBinary>(mtcrfMaskedIr[2]).Destination);
+    }
+
+    [Fact]
+    public void LiftsComparisonShiftAndUpdateMemoryForms()
+    {
+        var lifter = new PpcLifter();
+
+        var cmplwi = Instruction(0, "cmplwi", Gpr(6), new PpcImmediateOperand(0x1234));
+        var cmplwiIr = Assert.Single(lifter.Lift(new[] { cmplwi })).Ir;
+        var cmplwiSetCr = Assert.IsType<IrSetCrField>(Assert.Single(cmplwiIr));
+        Assert.True(cmplwiSetCr.IsUnsigned);
+        Assert.Equal("r6", cmplwiSetCr.Left.RegisterName);
+        Assert.Equal(0x1234, cmplwiSetCr.Right.Constant);
+
+        var cmpwi = Instruction(0, "cmpwi", new PpcConditionRegisterOperand("cr2", 8), Gpr(6), new PpcImmediateOperand(-1));
+        var cmpwiIr = Assert.Single(lifter.Lift(new[] { cmpwi })).Ir;
+        var cmpwiSetCr = Assert.IsType<IrSetCrField>(Assert.Single(cmpwiIr));
+        Assert.Equal(2, cmpwiSetCr.FieldIndex);
+        Assert.False(cmpwiSetCr.IsUnsigned);
+        Assert.Equal("r6", cmpwiSetCr.Left.RegisterName);
+        Assert.Equal(-1, cmpwiSetCr.Right.Constant);
+
+        var sraw = Instruction(0, "sraw.", Gpr(11), Gpr(12), Gpr(13));
+        var srawIr = Assert.Single(lifter.Lift(new[] { sraw })).Ir;
+        Assert.Equal("PPC_UpdateCarryShiftRight", Assert.IsType<IrCall>(srawIr[0]).Target);
+        Assert.Equal("r13", Assert.IsType<IrCall>(srawIr[0]).Arguments[1].RegisterName);
+        Assert.Equal("ppc_sraw", Assert.IsType<IrBinary>(srawIr[1]).Op);
+        Assert.IsType<IrSetCrField>(srawIr[2]);
+
+        var srw = Instruction(0, "srw.", Gpr(7), Gpr(8), Gpr(9));
+        var srwIr = Assert.Single(lifter.Lift(new[] { srw })).Ir;
+        var srwBinary = Assert.IsType<IrBinary>(srwIr[0]);
+        Assert.Equal("ppc_srw", srwBinary.Op);
+        Assert.Equal("r9", srwBinary.Right.RegisterName);
+        Assert.IsType<IrSetCrField>(srwIr[1]);
+
+        var slw = Instruction(0, "slw.", Gpr(10), Gpr(11), Gpr(12));
+        var slwIr = Assert.Single(lifter.Lift(new[] { slw })).Ir;
+        var slwBinary = Assert.IsType<IrBinary>(slwIr[0]);
+        Assert.Equal("ppc_slw", slwBinary.Op);
+        Assert.Equal("r12", slwBinary.Right.RegisterName);
+        Assert.IsType<IrSetCrField>(slwIr[1]);
+
+        var lhau = Instruction((3u << 21) | (4u << 16) | 0x0010u, "lhau");
+        var lhauIr = Assert.Single(lifter.Lift(new[] { lhau })).Ir;
+        Assert.Equal("r4", Assert.IsType<IrBinary>(lhauIr[0]).Destination);
+        Assert.Equal("r3", Assert.IsType<IrLoad>(lhauIr[1]).Destination);
+        Assert.Equal("sar", Assert.IsType<IrBinary>(lhauIr[3]).Op);
+        var invalidLhau = Instruction((3u << 21) | (0u << 16) | 0x0010u, "lhau");
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLhau }));
+
+        var stbu = Instruction(0, "stbu", Gpr(7), new PpcDisplacementOperand(4, "r8", 8));
+        var stbuIr = Assert.Single(lifter.Lift(new[] { stbu })).Ir;
+        Assert.Equal("r8_stbu_ea", Assert.IsType<IrBinary>(stbuIr[0]).Destination);
+        Assert.IsType<IrStore>(stbuIr[1]);
+        Assert.Equal("r8", Assert.IsType<IrAssign>(stbuIr[2]).Destination);
+
+        var sthu = Instruction(0, "sthu", Gpr(7), new PpcDisplacementOperand(6, "r8", 8));
+        var sthuIr = Assert.Single(lifter.Lift(new[] { sthu })).Ir;
+        Assert.Equal("r8_sthu_ea", Assert.IsType<IrBinary>(sthuIr[0]).Destination);
+        Assert.IsType<IrStore>(sthuIr[1]);
+        Assert.Equal("r8", Assert.IsType<IrAssign>(sthuIr[2]).Destination);
+
+        var addic = Instruction(0, "addic.", Gpr(15), Gpr(15), new PpcImmediateOperand(4));
+        var addicIr = Assert.Single(lifter.Lift(new[] { addic })).Ir;
+        Assert.Equal("r15_addic_src", Assert.IsType<IrAssign>(addicIr[0]).Destination);
+        Assert.Equal("PPC_UpdateCarryAdd", Assert.IsType<IrCall>(addicIr[2]).Target);
+        Assert.IsType<IrSetCrField>(addicIr[3]);
+
+        var subfe = Instruction(0, "subfe.", Gpr(16), Gpr(1), Gpr(16));
+        var subfeIr = Assert.Single(lifter.Lift(new[] { subfe })).Ir;
+        Assert.Equal("r16_subfe_rb", Assert.IsType<IrAssign>(subfeIr[0]).Destination);
+        Assert.Equal("not", Assert.IsType<IrBinary>(subfeIr[1]).Op);
+        Assert.Equal("PPC_GetCarry", Assert.IsType<IrCall>(subfeIr[2]).Target);
+        Assert.Equal("PPC_UpdateCarryAdd", Assert.IsType<IrCall>(subfeIr[5]).Target);
+        Assert.IsType<IrSetCrField>(subfeIr[6]);
+    }
+
+    [Fact]
+    public void LiftsMiscUnaryStatusAndLogicalForms()
+    {
+        var lifter = new PpcLifter();
+
+        var neg = Instruction(0, "neg.", Gpr(3), Gpr(4));
+        var negIr = Assert.Single(lifter.Lift(new[] { neg })).Ir;
+        var negBinary = Assert.IsType<IrBinary>(negIr[0]);
+        Assert.Equal("sub", negBinary.Op);
+        Assert.Equal(0, negBinary.Left.Constant);
+        Assert.Equal("r4", negBinary.Right.RegisterName);
+        Assert.IsType<IrSetCrField>(negIr[1]);
+
+        var nor = Instruction(0, "nor", Gpr(5), Gpr(6), Gpr(7));
+        var norIr = Assert.Single(lifter.Lift(new[] { nor })).Ir;
+        Assert.Equal("nor", Assert.IsType<IrBinary>(Assert.Single(norIr)).Op);
+
+        var nand = Instruction(0, "nand.", Gpr(8), Gpr(9), Gpr(10));
+        var nandIr = Assert.Single(lifter.Lift(new[] { nand })).Ir;
+        Assert.Equal("nand", Assert.IsType<IrBinary>(nandIr[0]).Op);
+        Assert.IsType<IrSetCrField>(nandIr[1]);
+
+        var mfdar = Instruction(0, "mfdar", Gpr(11));
+        Assert.Equal(0, Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mfdar })).Ir)).Value.Constant);
+
+        var mfmsr = Instruction(0, "mfmsr", Gpr(12));
+        Assert.Equal("msr", Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mfmsr })).Ir)).Value.RegisterName);
+
+        var mfpvr = Instruction(0, "mfpvr", Gpr(13));
+        Assert.Equal(0, Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mfpvr })).Ir)).Value.Constant);
+
+        var mfdsisr = Instruction(0, "mfdsisr", Gpr(14));
+        Assert.Equal(0, Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mfdsisr })).Ir)).Value.Constant);
+
+        var blelr = Instruction(0, "blelr");
+        var blelrBranch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { blelr })).Ir));
+        Assert.Equal("ble", blelrBranch.Condition);
+        Assert.Equal("return", blelrBranch.TrueLabel);
+    }
+
+    [Fact]
+    public void LiftsUpdateLoadFormsAndCacheNoOps()
+    {
+        var lifter = new PpcLifter();
+
+        var dcbzR0 = Instruction(0, "dcbz", Gpr(0), Gpr(5));
+        var dcbzR0Ir = Assert.Single(lifter.Lift(new[] { dcbzR0 })).Ir;
+        Assert.Equal("r5_addr_dcbz", Assert.IsType<IrAssign>(dcbzR0Ir[0]).Destination);
+        Assert.Equal("memset_zero_32", Assert.IsType<IrCall>(dcbzR0Ir[2]).Target);
+
+        var dcbz = Instruction(0, "dcbz_l", Gpr(4), Gpr(5));
+        var dcbzIr = Assert.Single(lifter.Lift(new[] { dcbz })).Ir;
+        Assert.Equal("add", Assert.IsType<IrBinary>(dcbzIr[0]).Op);
+        Assert.Equal("and", Assert.IsType<IrBinary>(dcbzIr[1]).Op);
+
+        foreach (var mnemonic in new[] { "icbi", "dcbi", "dcbf" })
+        {
+            var ins = Instruction(0, mnemonic);
+            var ir = Assert.Single(lifter.Lift(new[] { ins })).Ir;
+            Assert.Contains(mnemonic, Assert.IsType<IrComment>(Assert.Single(ir)).Text, StringComparison.Ordinal);
+        }
+
+        var lfsu = Instruction(0, "lfsu", Gpr(1), new PpcDisplacementOperand(4, "r3", 3));
+        var lfsuIr = Assert.Single(lifter.Lift(new[] { lfsu })).Ir;
+        Assert.Equal("r3", Assert.IsType<IrBinary>(lfsuIr[0]).Destination);
+        Assert.Equal("r1", Assert.IsType<IrLoad>(lfsuIr[1]).Destination);
+        var invalidLfsu = Instruction(0, "lfsu", Gpr(1), new PpcDisplacementOperand(4, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLfsu }));
+
+        var lhzu = Instruction(0, "lhzu", Gpr(2), new PpcDisplacementOperand(6, "r4", 4));
+        var lhzuIr = Assert.Single(lifter.Lift(new[] { lhzu })).Ir;
+        Assert.Equal("r4", Assert.IsType<IrBinary>(lhzuIr[0]).Destination);
+        Assert.Equal("r2", Assert.IsType<IrLoad>(lhzuIr[1]).Destination);
+        var invalidLhzu = Instruction(0, "lhzu", Gpr(2), new PpcDisplacementOperand(6, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLhzu }));
+
+        var lbzu = Instruction(0, "lbzu", Gpr(3), new PpcDisplacementOperand(8, "r5", 5));
+        var lbzuIr = Assert.Single(lifter.Lift(new[] { lbzu })).Ir;
+        Assert.Equal("r5", Assert.IsType<IrBinary>(lbzuIr[0]).Destination);
+        Assert.Equal("r3", Assert.IsType<IrLoad>(lbzuIr[1]).Destination);
+        var invalidLbzu = Instruction(0, "lbzu", Gpr(3), new PpcDisplacementOperand(8, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidLbzu }));
+
+        var stwu = Instruction(0, "stwu", Gpr(6), new PpcDisplacementOperand(0x10, "r7", 7));
+        var stwuIr = Assert.Single(lifter.Lift(new[] { stwu })).Ir;
+        Assert.IsType<IrStore>(stwuIr[0]);
+        Assert.Equal("r7", Assert.IsType<IrBinary>(stwuIr[1]).Destination);
+        var invalidStwu = Instruction(0, "stwu", Gpr(6), new PpcDisplacementOperand(0x10, "r0", 0));
+        Assert.Throws<InvalidOperationException>(() => lifter.Lift(new[] { invalidStwu }));
+    }
+
+    [Fact]
+    public void LiftsControlRegisterTableAndDivisionForms()
+    {
+        var lifter = new PpcLifter();
+
+        var cmplw = Instruction(0, "cmplw", new PpcConditionRegisterOperand("cr4", 16), Gpr(8), Gpr(9));
+        var cmplwIr = Assert.Single(lifter.Lift(new[] { cmplw })).Ir;
+        var cmplwSetCr = Assert.IsType<IrSetCrField>(Assert.Single(cmplwIr));
+        Assert.Equal(4, cmplwSetCr.FieldIndex);
+        Assert.True(cmplwSetCr.IsUnsigned);
+        Assert.Equal("r8", cmplwSetCr.Left.RegisterName);
+        Assert.Equal("r9", cmplwSetCr.Right.RegisterName);
+
+        foreach (var mnemonic in new[] { "mticcr", "mttbu", "mttbl", "mtdar", "mtdsisr" })
+        {
+            var ins = Instruction(0, mnemonic, Gpr(3));
+            Assert.Throws<NotImplementedException>(() => lifter.Lift(new[] { ins }));
+        }
+
+        var mfibatu = Instruction(0, "mfibatu", Gpr(4), Gpr(5));
+        Assert.Equal(0, Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mfibatu })).Ir)).Value.Constant);
+
+        foreach (var mnemonic in new[] { "mtibatu", "mtibatl", "mtdbatu", "mtdbatl" })
+        {
+            var ins = Instruction(0, mnemonic, Gpr(4), Gpr(5));
+            Assert.Throws<NotImplementedException>(() => lifter.Lift(new[] { ins }));
+        }
+
+        foreach (var mnemonic in new[] { "mfibatl", "mfdbatu", "mfdbatl" })
+        {
+            var ins = Instruction(0, mnemonic, Gpr(4), Gpr(5));
+            var ir = Assert.Single(lifter.Lift(new[] { ins })).Ir;
+            Assert.Equal(0, Assert.IsType<IrAssign>(Assert.Single(ir)).Value.Constant);
+        }
+
+        var mtxer = Instruction(0, "mtxer", Gpr(6));
+        Assert.Equal("xer", Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mtxer })).Ir)).Destination);
+
+        var mfxer = Instruction(0, "mfxer", Gpr(7));
+        Assert.Equal("xer", Assert.IsType<IrAssign>(Assert.Single(Assert.Single(lifter.Lift(new[] { mfxer })).Ir)).Value.RegisterName);
+
+        var divw = Instruction(0, "divw.", Gpr(10), Gpr(11), Gpr(12));
+        var divwIr = Assert.Single(lifter.Lift(new[] { divw })).Ir;
+        Assert.Equal("div", Assert.IsType<IrBinary>(divwIr[0]).Op);
+        Assert.IsType<IrSetCrField>(divwIr[1]);
+    }
+
+    [Fact]
+    public void LiftsExtraCrShiftAndUnsupportedFallbackForms()
+    {
+        var lifter = new PpcLifter();
+
+        var srw = Instruction(0, "srw.", Gpr(3), Gpr(4), Gpr(5));
+        var srwIr = Assert.Single(lifter.Lift(new[] { srw })).Ir;
+        Assert.Equal("r3", Assert.IsType<IrBinary>(srwIr[0]).Destination);
+        Assert.Equal("ppc_srw", Assert.IsType<IrBinary>(srwIr[0]).Op);
+        Assert.IsType<IrSetCrField>(srwIr[1]);
+
+        var divwu = Instruction(0, "divwu.", Gpr(6), Gpr(7), Gpr(8));
+        var divwuIr = Assert.Single(lifter.Lift(new[] { divwu })).Ir;
+        Assert.Equal("divu", Assert.IsType<IrBinary>(divwuIr[0]).Op);
+        Assert.IsType<IrSetCrField>(divwuIr[1]);
+
+        var extsb = Instruction(0, "extsb.", Gpr(9), Gpr(10));
+        var extsbIr = Assert.Single(lifter.Lift(new[] { extsb })).Ir;
+        var extsbBinary = Assert.IsType<IrBinary>(extsbIr[0]);
+        Assert.Equal("sext", extsbBinary.Op);
+        Assert.Equal(8, extsbBinary.Right.Constant);
+        Assert.IsType<IrSetCrField>(extsbIr[1]);
+
+        var mcrf = Instruction(0, "mcrf", new PpcConditionRegisterOperand("cr7", 28), new PpcConditionRegisterOperand("cr2", 8));
+        var mcrfCall = Assert.IsType<IrCall>(Assert.Single(Assert.Single(lifter.Lift(new[] { mcrf })).Ir));
+        Assert.Equal("PPC_Mcrf", mcrfCall.Target);
+        Assert.Equal(new long?[] { 7, 2 }, mcrfCall.Arguments.Select(a => a.Constant).ToArray());
+
+        var mcrxr = Instruction(0, "mcrxr", new PpcConditionRegisterOperand("cr7", 28));
+        var mcrxrCall = Assert.IsType<IrCall>(Assert.Single(Assert.Single(lifter.Lift(new[] { mcrxr })).Ir));
+        Assert.Equal("PPC_Mcrxr", mcrxrCall.Target);
+        Assert.Equal(7, Assert.Single(mcrxrCall.Arguments).Constant);
+
+        var crxor = Instruction(
+            0,
+            "crxor",
+            new PpcConditionRegisterOperand("cr7eq", 30),
+            new PpcConditionRegisterOperand("crb2", 2),
+            new PpcConditionRegisterOperand("31", 31));
+        var crxorCall = Assert.IsType<IrCall>(Assert.Single(Assert.Single(lifter.Lift(new[] { crxor })).Ir));
+        Assert.Equal("PPC_CrLogical", crxorCall.Target);
+        Assert.Equal(new long?[] { 2, 30, 2, 31 }, crxorCall.Arguments.Select(a => a.Constant).ToArray());
+
+        var slwi = Instruction(0, "slwi.", Gpr(11), Gpr(12), new PpcImmediateOperand(5));
+        var slwiIr = Assert.Single(lifter.Lift(new[] { slwi })).Ir;
+        Assert.Equal("shl", Assert.IsType<IrBinary>(slwiIr[0]).Op);
+        Assert.IsType<IrSetCrField>(slwiIr[1]);
+
+        var unknown = Instruction(0x12345678, "totally_unknown", Gpr(3));
+        var undefined = Assert.IsType<IrUndefined>(Assert.Single(Assert.Single(lifter.Lift(new[] { unknown }, allowUnsupported: true)).Ir));
+        Assert.Contains("totally_unknown", undefined.Disassembly, StringComparison.Ordinal);
+        Assert.Equal(0x12345678u, undefined.RawInstruction);
+
+        var unsupported = Instruction(0, "mticcr", Gpr(3));
+        var unsupportedUndefined = Assert.IsType<IrUndefined>(Assert.Single(Assert.Single(lifter.Lift(new[] { unsupported }, allowUnsupported: true)).Ir));
+        Assert.Contains("UNIMPLEMENTED", unsupportedUndefined.Reason ?? string.Empty, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PrivateHelpersParseDisplacementsCrBitsAndBranchConditions()
+    {
+        Assert.Equal((0, "r3"), InvokePrivate<(int offset, string @base)>("ParseDisplacement", "r3"));
+        Assert.Equal((0x1234, "0"), InvokePrivate<(int offset, string @base)>("ParseDisplacement", "0x1234"));
+        Assert.Equal((0, "r4"), InvokePrivate<(int offset, string @base)>("ParseDisplacement", "(r4)"));
+        Assert.Throws<TargetInvocationException>(() => InvokePrivate<(int offset, string @base)>("ParseDisplacement", "broken("));
+
+        Assert.Equal(30, InvokePrivate<int>("ParseCrBitIndex", "cr7eq"));
+        Assert.Equal(2, InvokePrivate<int>("ParseCrBitIndex", "crb2"));
+        Assert.Equal(25, InvokePrivate<int>("ParseCrBitIndex", "cr6gt"));
+        Assert.Equal(31, InvokePrivate<int>("ParseCrBitIndex", "31"));
+        Assert.Equal(0, InvokePrivate<int>("ParseCrBitIndex", "mystery"));
+
+        Assert.Equal(7, InvokePrivate<int>("ParseCrFieldName", "crf7"));
+        Assert.Equal(3, InvokePrivate<int>("ParseCrFieldName", "cr3"));
+        Assert.Equal(0, InvokePrivate<int>("ParseCrFieldName", "bogus"));
+
+        var absoluteLoad = InvokePrivate<IReadOnlyList<IrInstruction>>("DFormLoad", "r5", "0", 12, 4);
+        Assert.Equal("r5_ea", Assert.IsType<IrAssign>(absoluteLoad[0]).Destination);
+        Assert.Equal("r5", Assert.IsType<IrLoad>(absoluteLoad[1]).Destination);
+
+        var registerLoad = InvokePrivate<IReadOnlyList<IrInstruction>>("DFormLoad", "r6", "r7", 16, 2);
+        var registerLoadIr = Assert.Single(registerLoad);
+        var load = Assert.IsType<IrLoad>(registerLoadIr);
+        Assert.Equal("r6", load.Destination);
+        Assert.Equal("r7", load.Address.Base);
+        Assert.Equal(16, load.Address.Offset);
+    }
+
+    [Fact]
+    public void PrivateCrLogicalHelperMapsAllRemainingOpcodes()
+    {
+        foreach (var (mnemonic, opcode) in new[]
+        {
+            ("crnor", 0L),
+            ("crandc", 1L),
+            ("crnand", 3L),
+            ("crand", 4L),
+            ("creqv", 5L),
+            ("crorc", 6L)
+        })
+        {
+            var ir = Assert.Single(InvokePrivate<IReadOnlyList<IrInstruction>>("LiftCrLogical", mnemonic, "cr7eq", "crb2", "31"));
+            var call = Assert.IsType<IrCall>(ir);
+            Assert.Equal("PPC_CrLogical", call.Target);
+            Assert.Equal(opcode, call.Arguments[0].Constant);
+            Assert.Equal(30, call.Arguments[1].Constant);
+            Assert.Equal(2, call.Arguments[2].Constant);
+            Assert.Equal(31, call.Arguments[3].Constant);
+        }
+    }
+
+    [Fact]
+    public void LiftsLinkRegisterBranchFamiliesAndGenericBcFallbacks()
+    {
+        var lifter = new PpcLifter();
+
+        var beqlrl = Instruction(0, "beqlrl", new PpcConditionRegisterOperand("cr3", 12));
+        var beqlrlBranch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { beqlrl })).Ir));
+        Assert.Equal("beq", beqlrlBranch.Condition);
+        Assert.Equal("cr3", beqlrlBranch.ConditionRegister);
+        Assert.Contains("call_lr_80000000_80000004", beqlrlBranch.TrueLabel, StringComparison.Ordinal);
+
+        var bgtlrl = Instruction(0, "bgtlrl");
+        var bgtlrlBranch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bgtlrl })).Ir));
+        Assert.Equal("bgt", bgtlrlBranch.Condition);
+        Assert.Equal("cr0", bgtlrlBranch.ConditionRegister);
+
+        var bnelrCr6 = Instruction(0, "bnelr", new PpcConditionRegisterOperand("cr6", 24));
+        var bnelrCr6Branch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bnelrCr6 })).Ir));
+        Assert.Equal("bne", bnelrCr6Branch.Condition);
+        Assert.Equal("return", bnelrCr6Branch.TrueLabel);
+        Assert.Equal("cr6", bnelrCr6Branch.ConditionRegister);
+
+        var bnelrCr7 = Instruction(0, "bnelr", new PpcConditionRegisterOperand("cr7", 28));
+        var bnelrCr7Branch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bnelrCr7 })).Ir));
+        Assert.Equal("bne", bnelrCr7Branch.Condition);
+        Assert.Equal("cr7", bnelrCr7Branch.ConditionRegister);
+
+        var bcImmediate = Instruction(
+            0,
+            "bc",
+            new PpcImmediateOperand(4),
+            new PpcImmediateOperand(3),
+            new PpcImmediateOperand(unchecked((int)0x80000020)));
+        var bcImmediateBranch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bcImmediate })).Ir));
+        Assert.Equal("raw", bcImmediateBranch.Condition);
+        Assert.Contains("GetCRBit(ctx, 0, 3)", bcImmediateBranch.ConditionRegister, StringComparison.Ordinal);
+
+        var bcFallback = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "bc",
+            new PpcOperand[] { new PpcConditionRegisterOperand("cr4", 16) },
+            new[] { 0x80000010u },
+            isConditional: true);
+        var bcFallbackBranch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bcFallback })).Ir));
+        Assert.Equal("bc", bcFallbackBranch.Condition);
+        Assert.Equal("cr4", bcFallbackBranch.ConditionRegister);
+
+        var ctrBc = Assert.Single(lifter.Lift(new[] { Instruction(0, "bc", new PpcImmediateOperand(0), new PpcImmediateOperand(0), new PpcImmediateOperand(4)) })).Ir;
+        Assert.Equal("ctr", Assert.IsType<IrBinary>(ctrBc[0]).Destination);
+        Assert.Equal("raw", Assert.IsType<IrBranch>(ctrBc[1]).Condition);
+
+        var bclrReturn = Instruction((20u << 21), "bclr");
+        var bclrReturnBranch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bclrReturn })).Ir));
+        Assert.Equal("raw", bclrReturnBranch.Condition);
+        Assert.Equal("return", bclrReturnBranch.TrueLabel);
+
+        var bclrCr = Instruction((12u << 21) | (2u << 16), "bclr");
+        var bclrCrBranch = Assert.IsType<IrBranch>(Assert.Single(Assert.Single(lifter.Lift(new[] { bclrCr })).Ir));
+        Assert.Equal("raw", bclrCrBranch.Condition);
+        Assert.Equal("return", bclrCrBranch.TrueLabel);
+
+        var bclrCtr = Instruction((16u << 21), "bclr");
+        var bclrCtrIr = Assert.Single(lifter.Lift(new[] { bclrCtr })).Ir;
+        Assert.Equal("ctr", Assert.IsType<IrBinary>(bclrCtrIr[0]).Destination);
+        Assert.Equal("raw", Assert.IsType<IrBranch>(bclrCtrIr[1]).Condition);
+
+        var combinedBclr = Assert.Single(lifter.Lift(new[] { Instruction(0, "bclr") })).Ir;
+        Assert.Equal("ctr", Assert.IsType<IrBinary>(combinedBclr[0]).Destination);
+        Assert.Equal("raw", Assert.IsType<IrBranch>(combinedBclr[1]).Condition);
+    }
+
+    [Fact]
+    public void LiftsCacheHintsByteReverseAndRawXoFallbacks()
+    {
+        var lifter = new PpcLifter();
+
+        foreach (var mnemonic in new[] { "dcbst", "xo_54", "xo_470", "dcbt", "xo_278", "dcbtst", "xo_246", "dcba", "xo_758", "tlbie", "xo_306", "tlbsync", "xo_566" })
+        {
+            var ir = Assert.Single(lifter.Lift(new[] { Instruction(0, mnemonic) })).Ir;
+            Assert.IsType<IrComment>(Assert.Single(ir));
+        }
+
+        var stwbrx = Assert.Single(lifter.Lift(new[] { Instruction((3u << 21) | (4u << 16) | (5u << 11), "stwbrx") })).Ir;
+        Assert.Equal("PPC_StoreWordByteReverse", Assert.IsType<IrCall>(stwbrx[1]).Target);
+
+        var lwbrx = Assert.Single(lifter.Lift(new[] { Instruction((6u << 21) | (7u << 16) | (8u << 11), "lwbrx") })).Ir;
+        Assert.Equal("PPC_LoadWordByteReverse", Assert.IsType<IrCall>(lwbrx[1]).Target);
+
+        var lhbrx = Assert.Single(lifter.Lift(new[] { Instruction((9u << 21) | (10u << 16) | (11u << 11), "lhbrx") })).Ir;
+        Assert.Equal("PPC_LoadHalfwordByteReverse", Assert.IsType<IrCall>(lhbrx[1]).Target);
+
+        var sthbrx = Assert.Single(lifter.Lift(new[] { Instruction((12u << 21) | (13u << 16) | (14u << 11), "sthbrx") })).Ir;
+        Assert.Equal("PPC_StoreHalfwordByteReverse", Assert.IsType<IrCall>(sthbrx[1]).Target);
+
+        var xoNand = Assert.Single(lifter.Lift(new[] { Instruction((4u << 21) | (5u << 16) | (6u << 11) | 1u, "xo_476") })).Ir;
+        Assert.Equal("nand", Assert.IsType<IrBinary>(xoNand[0]).Op);
+        Assert.IsType<IrSetCrField>(xoNand[1]);
+
+        var xoMulhwu = Assert.Single(lifter.Lift(new[] { Instruction((7u << 21) | (8u << 16) | (9u << 11), "xo_11") })).Ir;
+        Assert.Equal("mulhwu", Assert.IsType<IrBinary>(Assert.Single(xoMulhwu)).Op);
+
+        var xoStwx = Assert.Single(lifter.Lift(new[] { Instruction((10u << 21) | (11u << 16) | (12u << 11), "xo_151") })).Ir;
+        Assert.Equal(4, Assert.IsType<IrStore>(xoStwx[1]).SizeBytes);
+
+        var xoStbx = Assert.Single(lifter.Lift(new[] { Instruction((13u << 21) | (14u << 16) | (15u << 11), "xo_215") })).Ir;
+        Assert.Equal(1, Assert.IsType<IrStore>(xoStbx[1]).SizeBytes);
+
+        var xoAddze = Assert.Single(lifter.Lift(new[] { Instruction((16u << 21) | (17u << 16) | 1u, "xo_202") })).Ir;
+        Assert.Equal("PPC_GetCarry", Assert.IsType<IrCall>(xoAddze[0]).Target);
+        Assert.IsType<IrSetCrField>(xoAddze[^1]);
+
+        var xoCmp = Assert.Single(lifter.Lift(new[] { Instruction((3u << 23) | (18u << 16) | (19u << 11), "xo_0") })).Ir;
+        var xoCmpSetCr = Assert.IsType<IrSetCrField>(Assert.Single(xoCmp));
+        Assert.Equal(3, xoCmpSetCr.FieldIndex);
+        Assert.Equal("r18", xoCmpSetCr.Left.RegisterName);
+        Assert.Equal("r19", xoCmpSetCr.Right.RegisterName);
+
+        var xoMfsr = Instruction((20u << 21), "xo_595");
+        Assert.Throws<NotImplementedException>(() => lifter.Lift(new[] { xoMfsr }));
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcLifterHelperCoverageTests.cs b/translator/tests/Translator.Tests/PpcLifterHelperCoverageTests.cs
new file mode 100644
index 0000000..ea12260
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcLifterHelperCoverageTests.cs
@@ -0,0 +1,225 @@
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+using Translator.Core.Lifting;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcLifterHelperCoverageTests
+{
+    private static readonly Type LifterType = typeof(PpcLifter);
+
+    private static T InvokePrivate<T>(string name, params object?[] args)
+    {
+        var method = LifterType.GetMethod(name, BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(method);
+        return (T)method!.Invoke(null, args)!;
+    }
+
+    private static PpcRegisterOperand Gpr(int index) => new($"r{index}", index);
+
+    [Fact]
+    public void HelperMethods_ReadParseAndNormalizeRegisters()
+    {
+        var instruction = PpcInstruction.Synthetic(0x80000000, 0x12345678, "addi", new PpcOperand[] { Gpr(3), Gpr(4), new PpcImmediateOperand(1) });
+        Assert.Equal(0x12345678u, InvokePrivate<uint>("ReadRawInstruction", instruction));
+
+        // PpcInstruction stores the raw big-endian word itself, so an instruction
+        // can no longer be missing its encoding; a zero word still reads back.
+        var zeroWord = new PpcInstruction(
+            0x80000000,
+            0u,
+            "nop",
+            Array.Empty<PpcOperand>(),
+            Array.Empty<uint>(),
+            isReturn: false,
+            isCall: false,
+            isConditionalBranch: false);
+        Assert.Equal(0u, InvokePrivate<uint>("ReadRawInstruction", zeroWord));
+
+        Assert.Equal(0, InvokePrivate<int>("ParseCrFieldIndex", string.Empty));
+        Assert.Equal(0, InvokePrivate<int>("ParseCrFieldIndex", "cr"));
+        Assert.Equal(7, InvokePrivate<int>("ParseCrFieldIndex", "cr7_3"));
+        Assert.Equal(3, InvokePrivate<int>("ParseCrFieldIndex", "cr3"));
+        Assert.Equal(0, InvokePrivate<int>("ParseCrFieldIndex", "bad"));
+
+        var zeroBase = InvokePrivate<IrValue>("BaseOrZero", "r0");
+        Assert.Equal("const", zeroBase.Kind);
+        Assert.Equal(0, zeroBase.Constant);
+
+        var regBase = InvokePrivate<IrValue>("BaseOrZero", "r5");
+        Assert.Equal("register", regBase.Kind);
+        Assert.Equal("r5", regBase.RegisterName);
+
+        Assert.Equal(31, InvokePrivate<int>("ParseRegisterNumber", "r31"));
+        var badRegister = Assert.Throws<TargetInvocationException>(() => InvokePrivate<int>("ParseRegisterNumber", "ctr"));
+        Assert.IsType<FormatException>(badRegister.InnerException);
+    }
+
+    [Fact]
+    public void HelperMethods_EmitDFormAndPairedSingleMemoryAccesses()
+    {
+        var zeroBasedStore = InvokePrivate<IReadOnlyList<IrInstruction>>("DFormStore", "r0", 24, IrValue.Register("r7"), 4);
+        Assert.Collection(
+            zeroBasedStore,
+            ins =>
+            {
+                var assign = Assert.IsType<IrAssign>(ins);
+                Assert.Equal("r7_ea", assign.Destination);
+                Assert.Equal(24, assign.Value.Constant);
+            },
+            ins =>
+            {
+                var store = Assert.IsType<IrStore>(ins);
+                Assert.Equal("r7_ea", store.Address.Base);
+                Assert.Equal("r7", store.Source.RegisterName);
+                Assert.Equal(4, store.SizeBytes);
+            });
+
+        var normalStore = InvokePrivate<IReadOnlyList<IrInstruction>>("DFormStore", "r4", -8, IrValue.Register("r6"), 8);
+        var storeIns = Assert.IsType<IrStore>(Assert.Single(normalStore));
+        Assert.Equal("r4", storeIns.Address.Base);
+        Assert.Equal(-8, storeIns.Address.Offset);
+        Assert.Equal(8, storeIns.SizeBytes);
+
+        var zeroBasedLoad = InvokePrivate<IReadOnlyList<IrInstruction>>("EmitPairedSingleLoad", "f1", "r0", 32, 1, 5, false, 0x80001000u);
+        Assert.Collection(
+            zeroBasedLoad,
+            ins => Assert.Contains("psq_load", Assert.IsType<IrComment>(ins).Text, StringComparison.Ordinal),
+            ins =>
+            {
+                var assign = Assert.IsType<IrAssign>(ins);
+                Assert.Equal("f1_psq_ea", assign.Destination);
+                Assert.Equal(32, assign.Value.Constant);
+            },
+            ins =>
+            {
+                var call = Assert.IsType<IrCall>(ins);
+                Assert.Equal("PPC_PsqL", call.Target);
+                Assert.Equal("f1_psq_ea", call.Arguments[0].RegisterName);
+            });
+
+        var updatingLoad = InvokePrivate<IReadOnlyList<IrInstruction>>("EmitPairedSingleLoad", "f2", "r9", 12, 0, 3, true, 0x80001004u);
+        Assert.Equal("r9_psq_addr", Assert.IsType<IrBinary>(updatingLoad[1]).Destination);
+        Assert.Equal("PPC_PsqL", Assert.IsType<IrCall>(updatingLoad[2]).Target);
+        Assert.Equal("r9", Assert.IsType<IrAssign>(updatingLoad[3]).Destination);
+
+        var zeroOffsetLoad = InvokePrivate<IReadOnlyList<IrInstruction>>("EmitPairedSingleLoad", "f3", "r8", 0, 0, 2, false, 0x80001008u);
+        var directLoadCall = Assert.IsType<IrCall>(zeroOffsetLoad[1]);
+        Assert.Equal("r8", directLoadCall.Arguments[0].RegisterName);
+
+        var invalidLoad = Assert.Throws<TargetInvocationException>(() =>
+            InvokePrivate<IReadOnlyList<IrInstruction>>("EmitPairedSingleLoad", "f4", "r0", 4, 0, 0, true, 0x8000100Cu));
+        Assert.IsType<InvalidOperationException>(invalidLoad.InnerException);
+
+        var zeroBasedStorePs = InvokePrivate<IReadOnlyList<IrInstruction>>("EmitPairedSingleStore", "f5", "r0", 48, 1, 6, false, 0x80001010u);
+        Assert.Collection(
+            zeroBasedStorePs,
+            ins => Assert.Contains("psq_store", Assert.IsType<IrComment>(ins).Text, StringComparison.Ordinal),
+            ins =>
+            {
+                var assign = Assert.IsType<IrAssign>(ins);
+                Assert.Equal("f5_psq_ea", assign.Destination);
+                Assert.Equal(48, assign.Value.Constant);
+            },
+            ins =>
+            {
+                var call = Assert.IsType<IrCall>(ins);
+                Assert.Equal("PPC_PsqSt", call.Target);
+                Assert.Equal("f5", call.Arguments[1].RegisterName);
+            });
+
+        var updatingStore = InvokePrivate<IReadOnlyList<IrInstruction>>("EmitPairedSingleStore", "f6", "r10", 16, 0, 7, true, 0x80001014u);
+        Assert.Equal("r10_psq_ea", Assert.IsType<IrBinary>(updatingStore[1]).Destination);
+        Assert.Equal("PPC_PsqSt", Assert.IsType<IrCall>(updatingStore[2]).Target);
+        Assert.Equal("r10", Assert.IsType<IrAssign>(updatingStore[3]).Destination);
+
+        var zeroOffsetStore = InvokePrivate<IReadOnlyList<IrInstruction>>("EmitPairedSingleStore", "f7", "r11", 0, 0, 1, false, 0x80001018u);
+        var directStoreCall = Assert.IsType<IrCall>(zeroOffsetStore[1]);
+        Assert.Equal("r11", directStoreCall.Arguments[0].RegisterName);
+
+        var invalidStore = Assert.Throws<TargetInvocationException>(() =>
+            InvokePrivate<IReadOnlyList<IrInstruction>>("EmitPairedSingleStore", "f8", "r0", 4, 0, 0, true, 0x8000101Cu));
+        Assert.IsType<InvalidOperationException>(invalidStore.InnerException);
+    }
+
+    [Fact]
+    public void HelperMethods_ParseCrBitsBuildTargetLabelsAndLiftUndefined()
+    {
+        Assert.Equal(0, InvokePrivate<int>("ParseCrBitIndex", string.Empty));
+        Assert.Equal(30, InvokePrivate<int>("ParseCrBitIndex", "cr7eq"));
+        Assert.Equal(31, InvokePrivate<int>("ParseCrBitIndex", "crb40"));
+        Assert.Equal(13, InvokePrivate<int>("ParseCrBitIndex", "cr3gt"));
+        Assert.Equal(29, InvokePrivate<int>("ParseCrBitIndex", "29"));
+        Assert.Equal(0, InvokePrivate<int>("ParseCrBitIndex", "bogus"));
+
+        Assert.Equal(0, InvokePrivate<int>("ParseCrFieldName", string.Empty));
+        Assert.Equal(7, InvokePrivate<int>("ParseCrFieldName", "crf7"));
+        Assert.Equal(3, InvokePrivate<int>("ParseCrFieldName", "cr3"));
+        Assert.Equal(7, InvokePrivate<int>("ParseCrFieldName", "cr99"));
+        Assert.Equal(0, InvokePrivate<int>("ParseCrFieldName", "bogus"));
+
+        var noTarget = PpcInstruction.Synthetic(0x80002000, 0x48000000, "b", Array.Empty<PpcOperand>());
+        var noTargetEx = Assert.Throws<TargetInvocationException>(() =>
+            InvokePrivate<string>("TargetLabel", noTarget, new HashSet<uint>(), true));
+        Assert.IsType<InvalidOperationException>(noTargetEx.InnerException);
+
+        var branch = PpcInstruction.Synthetic(0x80002010, 0x48000000, "b", Array.Empty<PpcOperand>(), branchTargets: new[] { 0x80003000u });
+        Assert.Equal("0x80002014", InvokePrivate<string>("TargetLabel", branch, new HashSet<uint>(), true));
+        Assert.Equal("0x80003000", InvokePrivate<string>("TargetLabel", branch, new HashSet<uint>(), false));
+        Assert.Equal("0x80003000", InvokePrivate<string>("TargetLabel", branch, new HashSet<uint> { 0x80003000u }, true));
+
+        var withOperands = PpcInstruction.Synthetic(0x80003000, 0x38630001, "addi", new PpcOperand[] { Gpr(3), Gpr(3), new PpcImmediateOperand(1) });
+        var undefinedWithOperands = Assert.IsType<IrUndefined>(Assert.Single(InvokePrivate<IReadOnlyList<IrInstruction>>("LiftUndefined", withOperands, "unsupported")));
+        Assert.Equal("addi r3, r3, 1", undefinedWithOperands.Disassembly);
+        Assert.Equal("unsupported", undefinedWithOperands.Reason);
+
+        var withoutOperands = PpcInstruction.Synthetic(0x80003004, 0x60000000, "nop", Array.Empty<PpcOperand>());
+        var undefinedWithoutOperands = Assert.IsType<IrUndefined>(Assert.Single(InvokePrivate<IReadOnlyList<IrInstruction>>("LiftUndefined", withoutOperands, "no-op")));
+        Assert.Equal("nop", undefinedWithoutOperands.Disassembly);
+    }
+
+    [Fact]
+    public void HelperMethods_LiftCrLogicalAndIndexedPairedSingles()
+    {
+        var creqv = Assert.IsType<IrCall>(Assert.Single(InvokePrivate<IReadOnlyList<IrInstruction>>("LiftCrLogical", "creqv", "crb1", "crb2", "crb3")));
+        Assert.Equal("PPC_CrLogical", creqv.Target);
+        Assert.Equal(new long?[] { 5, 1, 2, 3 }, new[] { creqv.Arguments[0].Constant, creqv.Arguments[1].Constant, creqv.Arguments[2].Constant, creqv.Arguments[3].Constant });
+
+        var unknownLogical = Assert.IsType<IrCall>(Assert.Single(InvokePrivate<IReadOnlyList<IrInstruction>>("LiftCrLogical", "unknown", "cr0lt", "cr0gt", "cr0eq")));
+        Assert.Equal(0, unknownLogical.Arguments[0].Constant);
+
+        var indexedLoad = PpcInstruction.Synthetic(0x80004000, 0, "psq_lx", Array.Empty<PpcOperand>());
+        var indexedLoadOps = InvokePrivate<IReadOnlyList<IrInstruction>>("LiftPairedSingleIndexedLoad", indexedLoad, (3u << 21) | (4u << 16) | (5u << 11) | (1u << 10) | (2u << 7), false);
+        Assert.Equal("addr_psqx_80004000_loc", Assert.IsType<IrBinary>(indexedLoadOps[0]).Destination);
+        Assert.Equal("PPC_PsqL", Assert.IsType<IrCall>(indexedLoadOps[1]).Target);
+
+        var indexedLoadZeroBase = InvokePrivate<IReadOnlyList<IrInstruction>>("LiftPairedSingleIndexedLoad", indexedLoad, (3u << 21) | (0u << 16) | (5u << 11), false);
+        Assert.Equal("addr_psqx_80004000_loc", Assert.IsType<IrAssign>(indexedLoadZeroBase[0]).Destination);
+
+        var indexedLoadUpdate = InvokePrivate<IReadOnlyList<IrInstruction>>("LiftPairedSingleIndexedLoad", indexedLoad, (3u << 21) | (4u << 16) | (5u << 11), true);
+        Assert.Equal("r4", Assert.IsType<IrAssign>(indexedLoadUpdate[2]).Destination);
+
+        var badIndexedLoad = Assert.Throws<TargetInvocationException>(() =>
+            InvokePrivate<IReadOnlyList<IrInstruction>>("LiftPairedSingleIndexedLoad", indexedLoad, (3u << 21) | (0u << 16) | (5u << 11), true));
+        Assert.IsType<InvalidOperationException>(badIndexedLoad.InnerException);
+
+        var indexedStore = PpcInstruction.Synthetic(0x80004004, 0, "psq_stx", Array.Empty<PpcOperand>());
+        var indexedStoreOps = InvokePrivate<IReadOnlyList<IrInstruction>>("LiftPairedSingleIndexedStore", indexedStore, (6u << 21) | (7u << 16) | (8u << 11) | (1u << 10) | (3u << 7), false);
+        Assert.Equal("addr_psqx_80004004_loc", Assert.IsType<IrBinary>(indexedStoreOps[0]).Destination);
+        Assert.Equal("PPC_PsqSt", Assert.IsType<IrCall>(indexedStoreOps[1]).Target);
+
+        var indexedStoreZeroBase = InvokePrivate<IReadOnlyList<IrInstruction>>("LiftPairedSingleIndexedStore", indexedStore, (6u << 21) | (0u << 16) | (8u << 11), false);
+        Assert.Equal("addr_psqx_80004004_loc", Assert.IsType<IrAssign>(indexedStoreZeroBase[0]).Destination);
+
+        var indexedStoreUpdate = InvokePrivate<IReadOnlyList<IrInstruction>>("LiftPairedSingleIndexedStore", indexedStore, (6u << 21) | (7u << 16) | (8u << 11), true);
+        Assert.Equal("r7", Assert.IsType<IrAssign>(indexedStoreUpdate[2]).Destination);
+
+        var badIndexedStore = Assert.Throws<TargetInvocationException>(() =>
+            InvokePrivate<IReadOnlyList<IrInstruction>>("LiftPairedSingleIndexedStore", indexedStore, (6u << 21) | (0u << 16) | (8u << 11), true));
+        Assert.IsType<InvalidOperationException>(badIndexedStore.InnerException);
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcLifterTests.cs b/translator/tests/Translator.Tests/PpcLifterTests.cs
new file mode 100644
index 0000000..5c13384
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcLifterTests.cs
@@ -0,0 +1,70 @@
+using System;
+using System.Linq;
+using Translator.Core.Disassembly;
+using Translator.Core.Ir;
+using Translator.Core.Lifting;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcLifterTests
+{
+    [Fact]
+    public void LiftsMficcrIntoRegisterRead()
+    {
+        var lifter = new PpcLifter();
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0,
+            "mficcr",
+            new PpcOperand[] { new PpcRegisterOperand("r4", 4) });
+
+        var lifted = lifter.Lift(new[] { instruction });
+
+        var ir = Assert.Single(Assert.Single(lifted).Ir);
+        var assign = Assert.IsType<IrAssign>(ir);
+        Assert.Equal("r4", assign.Destination);
+        Assert.Equal("iccr", assign.Value.RegisterName);
+    }
+
+    [Fact]
+    public void LiftsCmpwWithBothOperands()
+    {
+        var lifter = new PpcLifter();
+        var instruction = PpcInstruction.Synthetic(
+            0x80000000,
+            0x7C032800,
+            "cmpw",
+            new PpcOperand[]
+            {
+                new PpcConditionRegisterOperand("cr0", 0),
+                new PpcRegisterOperand("r3", 3),
+                new PpcRegisterOperand("r5", 5)
+            });
+
+        var lifted = lifter.Lift(new[] { instruction });
+
+        var sequence = Assert.Single(lifted).Ir;
+        var setCr = Assert.IsType<IrSetCrField>(Assert.Single(sequence));
+        Assert.Equal(0, setCr.FieldIndex);
+        Assert.False(setCr.IsUnsigned);
+        Assert.Equal("r3", setCr.Left.RegisterName);
+        Assert.Equal("r5", setCr.Right.RegisterName);
+    }
+
+    [Fact]
+    public void UnsupportedInstructionProducesCommentWhenAllowed()
+    {
+        var lifter = new PpcLifter();
+        var instruction = PpcInstruction.Synthetic(
+            0x801D1FD4,
+            0x7C00FD2C,
+            "xo_662",
+            Array.Empty<PpcOperand>());
+
+        var lifted = lifter.Lift(new[] { instruction }, allowUnsupported: true);
+
+        var irList = Assert.Single(lifted).Ir;
+        Assert.NotEmpty(irList);
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcOperandTests.cs b/translator/tests/Translator.Tests/PpcOperandTests.cs
new file mode 100644
index 0000000..0120841
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcOperandTests.cs
@@ -0,0 +1,44 @@
+using Translator.Core.Disassembly;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcOperandTests
+{
+    private sealed record CustomOperand(string Text) : PpcOperand
+    {
+        public override string ToOperandString() => Text;
+        public override string ToString() => base.ToString();
+    }
+
+    [Fact]
+    public void FormatsImmediateOperandsInDecimalAndHex()
+    {
+        Assert.Equal("42", new PpcImmediateOperand(42).ToOperandString());
+        Assert.Equal("0x2A", new PpcImmediateOperand(42, PreferHex: true).ToOperandString());
+        Assert.Equal("-0x2A", new PpcImmediateOperand(-42, PreferHex: true).ToOperandString());
+    }
+
+    [Fact]
+    public void FormatsDisplacementOperands()
+    {
+        Assert.Equal("0(r3)", new PpcDisplacementOperand(0, "r3", 3).ToOperandString());
+        Assert.Equal("0x20(r4)", new PpcDisplacementOperand(0x20, "r4", 4).ToOperandString());
+        Assert.Equal("-0x20(r5)", new PpcDisplacementOperand(-0x20, "r5", 5).ToOperandString());
+    }
+
+    [Fact]
+    public void FormatsBranchAndConditionOperands()
+    {
+        Assert.Equal("0x8000ABCD", new PpcBranchTargetOperand(0x8000ABCD).ToOperandString());
+        Assert.Equal("cr7", new PpcConditionRegisterOperand("cr7", 28).ToOperandString());
+        Assert.Equal("r12", new PpcRegisterOperand("r12", 12).ToOperandString());
+    }
+
+    [Fact]
+    public void BaseOperandToStringDelegatesToTypedFormatter()
+    {
+        PpcOperand operand = new CustomOperand("custom");
+        Assert.Equal("custom", operand.ToString());
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcRuntimeHelperTests.cs b/translator/tests/Translator.Tests/PpcRuntimeHelperTests.cs
new file mode 100644
index 0000000..2614619
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcRuntimeHelperTests.cs
@@ -0,0 +1,686 @@
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+using Translator.Core.Loading;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class PpcRuntimeHelperTests
+{
+    private static (int ExitCode, string Output) RunProcess(string fileName, string arguments, TimeSpan? timeout = null)
+    {
+        using var process = new Process
+        {
+            StartInfo = new ProcessStartInfo
+            {
+                FileName = fileName,
+                Arguments = arguments,
+                RedirectStandardError = true,
+                RedirectStandardOutput = true,
+                UseShellExecute = false
+            }
+        };
+
+        process.Start();
+        var stdoutTask = process.StandardOutput.ReadToEndAsync();
+        var stderrTask = process.StandardError.ReadToEndAsync();
+        var exitedInTime = timeout.HasValue
+            ? process.WaitForExit((int)timeout.Value.TotalMilliseconds)
+            : process.WaitForExit(60000);
+
+        if (!exitedInTime)
+        {
+            try
+            {
+                process.Kill(entireProcessTree: true);
+            }
+            catch
+            {
+                // ignored
+            }
+
+            process.WaitForExit();
+            var staleOutput = stdoutTask.GetAwaiter().GetResult() + stderrTask.GetAwaiter().GetResult();
+            throw new TimeoutException($"Process '{fileName}' timed out. Output before kill:\n{staleOutput}");
+        }
+
+        var output = stdoutTask.GetAwaiter().GetResult() + stderrTask.GetAwaiter().GetResult();
+        return (process.ExitCode, output);
+    }
+
+    private static string CppCompiler()
+    {
+        var envCompiler = Environment.GetEnvironmentVariable("CXX");
+        if (!string.IsNullOrWhiteSpace(envCompiler) && ExecutableExists(envCompiler))
+        {
+            return envCompiler;
+        }
+
+        foreach (var candidate in new[] { "g++", "clang++" })
+        {
+            if (ExecutableExists(candidate))
+            {
+                return candidate;
+            }
+        }
+
+        throw new FileNotFoundException("No C++ compiler found. Set CXX or install g++/clang++ on PATH.");
+    }
+
+    private static bool ExecutableExists(string fileName)
+    {
+        if (Path.IsPathFullyQualified(fileName))
+        {
+            return File.Exists(fileName);
+        }
+
+        var path = Environment.GetEnvironmentVariable("PATH") ?? string.Empty;
+        var extensions = OperatingSystem.IsWindows()
+            ? (Environment.GetEnvironmentVariable("PATHEXT") ?? ".EXE;.BAT;.CMD").Split(';', StringSplitOptions.RemoveEmptyEntries)
+            : new[] { string.Empty };
+
+        foreach (var directory in path.Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries))
+        {
+            foreach (var extension in extensions)
+            {
+                var candidate = Path.Combine(directory, fileName);
+                if (!candidate.EndsWith(extension, StringComparison.OrdinalIgnoreCase))
+                {
+                    candidate += extension;
+                }
+
+                if (File.Exists(candidate))
+                {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    private static string RunnerPath(string runnerBasePath)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            var exePath = runnerBasePath + ".exe";
+            if (File.Exists(exePath))
+            {
+                return exePath;
+            }
+        }
+
+        return runnerBasePath;
+    }
+
+    [Fact]
+    public void FselAndPsSelMatchDolphinForNaNAndSignedZeroControls()
+    {
+        var root = ProjectPaths.FindRepositoryRoot();
+        var tempRoot = Path.Combine(root, "test_output", "ppc_runtime_helpers");
+        Directory.CreateDirectory(tempRoot);
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <cmath>");
+        harness.AppendLine("#include <cstdint>");
+        harness.AppendLine("#include <cstring>");
+        harness.AppendLine("#include <iostream>");
+        harness.AppendLine("#include <limits>");
+        harness.AppendLine("#include \"ppc_runtime.h\"");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write8(uint8_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write16(uint16_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write32(uint32_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_WriteFloat(float) {}");
+        harness.AppendLine("extern \"C\" void DumpRecentPcTrace(size_t) {}");
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    const double nan = std::numeric_limits<double>::quiet_NaN();");
+        harness.AppendLine("    if (PPC_Fsel(nan, 11.0, 22.0) != 11.0) return 1;");
+        harness.AppendLine("    if (PPC_Fsel(-1.0, 11.0, 22.0) != 11.0) return 2;");
+        harness.AppendLine("    if (PPC_Fsel(-0.0, 11.0, 22.0) != 22.0) return 3;");
+        harness.AppendLine("    if (PPC_Fsel(0.0, 11.0, 22.0) != 22.0) return 4;");
+        harness.AppendLine("    PPC_FPR lhs{}; lhs.paired.ps0 = 10.0f; lhs.paired.ps1 = 20.0f;");
+        harness.AppendLine("    PPC_FPR rhs{}; rhs.paired.ps0 = -10.0f; rhs.paired.ps1 = -20.0f;");
+        harness.AppendLine("    PPC_FPR control{}; control.paired.ps0 = std::numeric_limits<float>::quiet_NaN(); control.paired.ps1 = -0.0f;");
+        harness.AppendLine("    PPC_FPR out{}; out.d = PPC_PsSel(lhs.d, control.d, rhs.d);");
+        harness.AppendLine("    if (out.paired.ps0 != rhs.paired.ps0) return 5;");
+        harness.AppendLine("    if (out.paired.ps1 != lhs.paired.ps1) return 6;");
+        harness.AppendLine("    control.paired.ps0 = 1.0f; control.paired.ps1 = -1.0f;");
+        harness.AppendLine("    out.d = PPC_PsSel(lhs.d, control.d, rhs.d);");
+        harness.AppendLine("    if (out.paired.ps0 != lhs.paired.ps0) return 7;");
+        harness.AppendLine("    if (out.paired.ps1 != rhs.paired.ps1) return 8;");
+        harness.AppendLine("    std::cout << \"ok\";");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+
+        var harnessPath = Path.Combine(tempRoot, "harness_ppc_runtime_helpers.cpp");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var runnerBasePath = Path.Combine(tempRoot, "runner_ppc_runtime_helpers");
+        var args = TranslatorCppTestHarness.BuildCompileArguments(
+            root,
+            tempRoot,
+            Array.Empty<string>(),
+            harnessPath,
+            runnerBasePath,
+            includeDataSections: false);
+
+        var compiler = CppCompiler();
+        var (compileExitCode, compileOutput) = RunProcess(compiler, args, TimeSpan.FromSeconds(60));
+        Assert.True(compileExitCode == 0, $"{compiler} failed: {compileOutput}");
+
+        var runnerPath = RunnerPath(runnerBasePath);
+        var (runExitCode, runOutput) = RunProcess(runnerPath, "", TimeSpan.FromSeconds(10));
+        Assert.True(runExitCode == 0, $"Runner failed ({runExitCode}). Output:\n{runOutput}");
+        Assert.Equal("ok", runOutput.Trim());
+    }
+
+    [Fact]
+    public void InlinePsqFloatFastPathPreservesGuestLaneOrder()
+    {
+        var root = ProjectPaths.FindRepositoryRoot();
+        var tempRoot = Path.Combine(root, "test_output", "ppc_runtime_psq_lane_order");
+        Directory.CreateDirectory(tempRoot);
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <cstdint>");
+        harness.AppendLine("#include <cstring>");
+        harness.AppendLine("#include <iostream>");
+        harness.AppendLine("#include \"memory.h\"");
+        harness.AppendLine("#include \"ppc_runtime.h\"");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write8(uint8_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write16(uint16_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write32(uint32_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_WriteFloat(float) {}");
+        harness.AppendLine("extern \"C\" void DumpRecentPcTrace(size_t) {}");
+        harness.AppendLine("static uint32_t Bits(float value) { uint32_t raw = 0; std::memcpy(&raw, &value, sizeof(raw)); return raw; }");
+        harness.AppendLine("static uint64_t DBits(double value) { uint64_t raw = 0; std::memcpy(&raw, &value, sizeof(raw)); return raw; }");
+        harness.AppendLine("template <uint32_t GQR> static int CheckKnown(CpuContext& ctx, uint8_t* range, uint32_t base, double source, uint32_t slot) {");
+        harness.AppendLine("    ctx.gqr[0] = GQR; const uint32_t addr = base + 256 + slot * 96;");
+        harness.AppendLine("    Memory::Write64(addr, 0x81FE1234A5C35A7Eull + slot);");
+        harness.AppendLine("    const double pair = PPC_PsqLInline<0u, 0u>(&ctx, addr);");
+        harness.AppendLine("    if (DBits(pair) != DBits(PPC_PsqLKnownInline<0u, 0u, GQR>(&ctx, addr))) return 1;");
+        harness.AppendLine("    if (DBits(pair) != DBits(PPC_PsqLKnownStackInline<0u, 0u, GQR>(&ctx, addr))) return 2;");
+        harness.AppendLine("    if (DBits(pair) != DBits(PPC_PsqLKnownResolvedInline<0u, 0u, GQR>(&ctx, range, addr - base, addr))) return 3;");
+        harness.AppendLine("    if (DBits(pair) != DBits(PPC_PsqLKnownResolvedInline<0u, 0u, GQR>(&ctx, nullptr, 0, addr))) return 9;");
+        harness.AppendLine("    const double single = PPC_PsqLInline<1u, 0u>(&ctx, addr);");
+        harness.AppendLine("    if (DBits(single) != DBits(PPC_PsqLKnownInline<1u, 0u, GQR>(&ctx, addr))) return 4;");
+        harness.AppendLine("    if (DBits(single) != DBits(PPC_PsqLKnownStackInline<1u, 0u, GQR>(&ctx, addr))) return 5;");
+        harness.AppendLine("    if (DBits(single) != DBits(PPC_PsqLKnownResolvedInline<1u, 0u, GQR>(&ctx, range, addr - base, addr))) return 6;");
+        harness.AppendLine("    if (DBits(single) != DBits(PPC_PsqLKnownResolvedInline<1u, 0u, GQR>(&ctx, nullptr, 0, addr))) return 10;");
+        harness.AppendLine("    const uint32_t a = addr + 16, b = addr + 32, c = addr + 48, d = addr + 64, e = addr + 80;");
+        harness.AppendLine("    Memory::Write64(a, ~0ull); Memory::Write64(b, ~0ull); Memory::Write64(c, ~0ull); Memory::Write64(d, ~0ull); Memory::Write64(e, ~0ull);");
+        harness.AppendLine("    PPC_PsqStInline<0u, 0u>(&ctx, a, source);");
+        harness.AppendLine("    PPC_PsqStKnownInline<0u, 0u, GQR>(&ctx, b, source);");
+        harness.AppendLine("    PPC_PsqStKnownStackInline<0u, 0u, GQR>(&ctx, c, source);");
+        harness.AppendLine("    PPC_PsqStKnownResolvedInline<0u, 0u, GQR>(&ctx, range, d - base, d, source);");
+        harness.AppendLine("    PPC_PsqStKnownResolvedInline<0u, 0u, GQR>(&ctx, nullptr, 0, e, source);");
+        harness.AppendLine("    if (Memory::Read64(a) != Memory::Read64(b) || Memory::Read64(a) != Memory::Read64(c) || Memory::Read64(a) != Memory::Read64(d) || Memory::Read64(a) != Memory::Read64(e)) return 7;");
+        harness.AppendLine("    Memory::Write64(a, ~0ull); Memory::Write64(b, ~0ull); Memory::Write64(c, ~0ull); Memory::Write64(d, ~0ull); Memory::Write64(e, ~0ull);");
+        harness.AppendLine("    PPC_PsqStInline<1u, 0u>(&ctx, a, source);");
+        harness.AppendLine("    PPC_PsqStKnownInline<1u, 0u, GQR>(&ctx, b, source);");
+        harness.AppendLine("    PPC_PsqStKnownStackInline<1u, 0u, GQR>(&ctx, c, source);");
+        harness.AppendLine("    PPC_PsqStKnownResolvedInline<1u, 0u, GQR>(&ctx, range, d - base, d, source);");
+        harness.AppendLine("    PPC_PsqStKnownResolvedInline<1u, 0u, GQR>(&ctx, nullptr, 0, e, source);");
+        harness.AppendLine("    if (Memory::Read64(a) != Memory::Read64(b) || Memory::Read64(a) != Memory::Read64(c) || Memory::Read64(a) != Memory::Read64(d) || Memory::Read64(a) != Memory::Read64(e)) return 8;");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    Memory::Init(Memory::Config::WiiDefaults());");
+        harness.AppendLine("    CpuContext ctx{};");
+        harness.AppendLine("    ctx.gpr[1] = 0x817FF000u;");
+        harness.AppendLine("    ctx.gqr[0] = 0;");
+        harness.AppendLine("    CpuContextScope scope(&ctx);");
+        harness.AppendLine("    const auto RefLoadPair = [](uint64_t v) { return (static_cast<uint64_t>(PpcLoadPsqFloatBitsInline(static_cast<uint32_t>(v >> 32))) << 32) | PpcLoadPsqFloatBitsInline(static_cast<uint32_t>(v)); };");
+        harness.AppendLine("    const auto RefStorePair = [](uint64_t v) { return (static_cast<uint64_t>(PpcStorePsqFloatBitsInline(static_cast<uint32_t>(v >> 32))) << 32) | PpcStorePsqFloatBitsInline(static_cast<uint32_t>(v)); };");
+        harness.AppendLine("    const uint32_t floatEdges[] = { 0u, 0x80000000u, 1u, 0x007FFFFFu, 0x00800000u, 0x7F7FFFFFu, 0x7F800000u, 0x7F800001u, 0x7FC00000u, 0xFF800001u }; ");
+        harness.AppendLine("    for (uint32_t hi : floatEdges) for (uint32_t lo : floatEdges) { const uint64_t v = (static_cast<uint64_t>(hi) << 32) | lo; if (PpcLoadPairPsqFloatBitsPackedInline(v) != RefLoadPair(v)) return 90; if (PpcStorePairPsqFloatBitsPackedInline(v) != RefStorePair(v)) return 91; }");
+        harness.AppendLine("    uint32_t pairState = 0x7E57A11Du; for (uint32_t i = 0; i < 1000000u; ++i) { pairState = pairState * 1664525u + 1013904223u; const uint64_t hi = pairState; pairState = pairState * 1664525u + 1013904223u; const uint64_t v = (hi << 32) | pairState; if (PpcLoadPairPsqFloatBitsPackedInline(v) != RefLoadPair(v)) return 92; if (PpcStorePairPsqFloatBitsPackedInline(v) != RefStorePair(v)) return 93; }");
+        harness.AppendLine("    constexpr uint32_t base = 0x80010000u;");
+        harness.AppendLine("    Memory::Write32(base, Bits(12.5f));");
+        harness.AppendLine("    Memory::Write32(base + 4, Bits(-7.25f));");
+        harness.AppendLine("    auto* range = MemoryInline::ResolveRangeHost(base, 0, 2048, true, true);");
+        harness.AppendLine("    if (!range) return 20;");
+        harness.AppendLine("    PPC_FPR loaded{};");
+        harness.AppendLine("    loaded.d = PPC_PsqLInline<0u, 0u>(base);");
+        harness.AppendLine("    if (DBits(loaded.d) != DBits(PPC_PsqLResolvedInline<0u, 0u>(&ctx, range, 0, base))) return 21;");
+        harness.AppendLine("    if (loaded.paired.ps0 != 12.5f) return 1;");
+        harness.AppendLine("    if (loaded.paired.ps1 != -7.25f) return 2;");
+        harness.AppendLine("    PPC_FPR source{};");
+        harness.AppendLine("    source.paired.ps0 = 3.5f;");
+        harness.AppendLine("    source.paired.ps1 = -9.75f;");
+        harness.AppendLine("    PPC_PsqStInline<0u, 0u>(base + 8, source.d);");
+        harness.AppendLine("    if (Memory::Read32(base + 8) != Bits(3.5f)) return 3;");
+        harness.AppendLine("    if (Memory::Read32(base + 12) != Bits(-9.75f)) return 4;");
+        harness.AppendLine("    PPC_PsqStResolvedInline<0u, 0u>(&ctx, range, 24, base + 24, source.d);");
+        harness.AppendLine("    if (Memory::Read32(base + 24) != Bits(3.5f) || Memory::Read32(base + 28) != Bits(-9.75f)) return 22;");
+        harness.AppendLine("    Memory::Write32(base + 16, 0xDEADBEEFu);");
+        harness.AppendLine("    PPC_PsqStInline<1u, 0u>(base + 16, source.d);");
+        harness.AppendLine("    if (Memory::Read32(base + 16) != Bits(3.5f)) return 5;");
+        harness.AppendLine("    Memory::Write32(base + 20, Bits(22.0f));");
+        harness.AppendLine("    loaded.d = PPC_PsqLInline<1u, 0u>(base + 20);");
+        harness.AppendLine("    if (loaded.paired.ps0 != 22.0f) return 6;");
+        harness.AppendLine("    if (loaded.paired.ps1 != 1.0f) return 7;");
+        harness.AppendLine("    const uint32_t gqrs[] = { 0x00040004u, 0x00050005u, 0x00060006u, 0x00070007u, 0x3D043D04u };");
+        harness.AppendLine("    for (uint32_t n = 0; n < 5; ++n) {");
+        harness.AppendLine("        ctx.gqr[0] = gqrs[n];");
+        harness.AppendLine("        const uint32_t input = base + 40 + n * 8;");
+        harness.AppendLine("        Memory::Write64(input, 0x81FE1234A5C35A7Eu + n);");
+        harness.AppendLine("        const double ordinary = PPC_PsqLInline<0u, 0u>(&ctx, input);");
+        harness.AppendLine("        const double resolved = PPC_PsqLResolvedInline<0u, 0u>(&ctx, range, 40 + n * 8, input);");
+        harness.AppendLine("        if (DBits(ordinary) != DBits(resolved)) return 30 + n;");
+        harness.AppendLine("        const uint32_t a = base + 88 + n * 8; const uint32_t b = base + 128 + n * 8;");
+        harness.AppendLine("        Memory::Write64(a, 0xCCCCCCCCCCCCCCCCull); Memory::Write64(b, 0xCCCCCCCCCCCCCCCCull);");
+        harness.AppendLine("        PPC_PsqStInline<0u, 0u>(&ctx, a, source.d);");
+        harness.AppendLine("        PPC_PsqStResolvedInline<0u, 0u>(&ctx, range, 128 + n * 8, b, source.d);");
+        harness.AppendLine("        if (Memory::Read64(a) != Memory::Read64(b)) return 40 + n;");
+        harness.AppendLine("    }");
+        harness.AppendLine("    if (const int e = CheckKnown<0x00000000u>(ctx, range, base, source.d, 0)) return 100 + e;");
+        harness.AppendLine("    if (const int e = CheckKnown<0x00040004u>(ctx, range, base, source.d, 1)) return 110 + e;");
+        harness.AppendLine("    if (const int e = CheckKnown<0x00050005u>(ctx, range, base, source.d, 2)) return 120 + e;");
+        harness.AppendLine("    if (const int e = CheckKnown<0x00060006u>(ctx, range, base, source.d, 3)) return 130 + e;");
+        harness.AppendLine("    if (const int e = CheckKnown<0x00070007u>(ctx, range, base, source.d, 4)) return 140 + e;");
+        harness.AppendLine("    if (const int e = CheckKnown<0x3D043D04u>(ctx, range, base, source.d, 5)) return 150 + e;");
+        harness.AppendLine("    if (const int e = CheckKnown<0x05050505u>(ctx, range, base, source.d, 6)) return 160 + e;");
+        harness.AppendLine("    if (const int e = CheckKnown<0x21062106u>(ctx, range, base, source.d, 7)) return 170 + e;");
+        harness.AppendLine("    if (const int e = CheckKnown<0x0C070C07u>(ctx, range, base, source.d, 8)) return 180 + e;");
+        harness.AppendLine("    std::cout << \"ok\";");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+
+        var harnessPath = Path.Combine(tempRoot, "harness_psq_lane_order.cpp");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var runnerBasePath = Path.Combine(tempRoot, "runner_psq_lane_order");
+        var args = TranslatorCppTestHarness.BuildCompileArguments(
+            root,
+            tempRoot,
+            Array.Empty<string>(),
+            harnessPath,
+            runnerBasePath,
+            includeDataSections: false);
+
+        var compiler = CppCompiler();
+        var (compileExitCode, compileOutput) = RunProcess(compiler, args, TimeSpan.FromSeconds(60));
+        Assert.True(compileExitCode == 0, $"{compiler} failed: {compileOutput}");
+
+        var runnerPath = RunnerPath(runnerBasePath);
+        var (runExitCode, runOutput) = RunProcess(runnerPath, "", TimeSpan.FromSeconds(10));
+        Assert.True(runExitCode == 0, $"Runner failed ({runExitCode}). Output:\n{runOutput}");
+        Assert.Equal("ok", runOutput.Trim());
+    }
+
+    [Fact]
+    public void KnownU8Scale61PairedStoreMatchesExactQuantizationOnFastAndColdPaths()
+    {
+        var root = ProjectPaths.FindRepositoryRoot();
+        var tempRoot = Path.Combine(root, "test_output", "ppc_runtime_psq_u8_scale61");
+        Directory.CreateDirectory(tempRoot);
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <cmath>");
+        harness.AppendLine("#include <cstdint>");
+        harness.AppendLine("#include <cstring>");
+        harness.AppendLine("#include <iostream>");
+        harness.AppendLine("#include <limits>");
+        harness.AppendLine("#include \"memory.h\"");
+        harness.AppendLine("#include \"ppc_runtime.h\"");
+        harness.AppendLine("static uint16_t g_fifo16 = 0; static uint32_t g_fifo16Count = 0;");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write8(uint8_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write16(uint16_t value) { g_fifo16 = value; ++g_fifo16Count; }");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write32(uint32_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_WriteFloat(float) {}");
+        harness.AppendLine("extern \"C\" void DumpRecentPcTrace(size_t) {}");
+        harness.AppendLine("static uint16_t Reference(double value) {");
+        harness.AppendLine("    PPC_FPR fpr{}; fpr.d = value;");
+        harness.AppendLine("    return static_cast<uint16_t>((static_cast<uint16_t>(PpcQuantizePsqU8Scale61Inline(fpr.paired.ps0)) << 8) | PpcQuantizePsqU8Scale61Inline(fpr.paired.ps1));");
+        harness.AppendLine("}");
+        harness.AppendLine("static float FromBits(uint32_t bits) { float value; std::memcpy(&value, &bits, sizeof(value)); return value; }");
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    const float edges[] = { -std::numeric_limits<float>::infinity(), -2040.0f, -1.0f, -0.0f, 0.0f,");
+        harness.AppendLine("        std::nextafter(0.0f, 1.0f), 7.999f, 8.0f, 2039.0f, std::nextafter(2040.0f, 0.0f), 2040.0f,");
+        harness.AppendLine("        std::numeric_limits<float>::infinity(), std::numeric_limits<float>::quiet_NaN(), FromBits(0x7F800001u) };");
+        harness.AppendLine("    for (float ps0 : edges) for (float ps1 : edges) {");
+        harness.AppendLine("        PPC_FPR pair{}; pair.paired.ps0 = ps0; pair.paired.ps1 = ps1;");
+        harness.AppendLine("        if (PpcQuantizePairPsqU8Scale61PackedInline(pair.d) != Reference(pair.d)) return 1;");
+        harness.AppendLine("    }");
+        harness.AppendLine("    uint32_t state = 0xC001D00Du;");
+        harness.AppendLine("    for (uint32_t i = 0; i < 1000000u; ++i) {");
+        harness.AppendLine("        state = state * 1664525u + 1013904223u; const uint32_t a = state;");
+        harness.AppendLine("        state = state * 1664525u + 1013904223u; const uint32_t b = state;");
+        harness.AppendLine("        PPC_FPR pair{}; pair.paired.ps0 = FromBits(a); pair.paired.ps1 = FromBits(b);");
+        harness.AppendLine("        if (PpcQuantizePairPsqU8Scale61PackedInline(pair.d) != Reference(pair.d)) return 2;");
+        harness.AppendLine("    }");
+        harness.AppendLine("    Memory::Init(Memory::Config::WiiDefaults()); CpuContext ctx{}; CpuContextScope scope(&ctx);");
+        harness.AppendLine("    constexpr uint32_t base = 0x80010000u; PPC_FPR pair{}; pair.paired.ps0 = 2039.0f; pair.paired.ps1 = 15.9f;");
+        harness.AppendLine("    const uint16_t expected = Reference(pair.d);");
+        harness.AppendLine("    PPC_PsqStKnownInline<0u, 6u, 0x3D043D04u>(&ctx, base, pair.d);");
+        harness.AppendLine("    if (Memory::Read16(base) != expected) return 3;");
+        harness.AppendLine("    const uint32_t page = base >> MemoryInline::kPageShift;");
+        harness.AppendLine("    const uintptr_t savedBias = MemoryInline::g_fullWritablePageBias[page];");
+        harness.AppendLine("    if (savedBias == 0) return 4;");
+        harness.AppendLine("    MemoryInline::g_fullWritablePageBias[page] = 0;");
+        harness.AppendLine("    PPC_PsqStKnownInline<0u, 6u, 0x3D043D04u>(&ctx, base + 2, pair.d);");
+        harness.AppendLine("    MemoryInline::g_fullWritablePageBias[page] = savedBias;");
+        harness.AppendLine("    if (Memory::Read16(base + 2) != expected) return 5;");
+        harness.AppendLine("    uint8_t* range = MemoryInline::ResolveRangeHost(base, 0, 64, false, true);");
+        harness.AppendLine("    if (!range) return 6;");
+        harness.AppendLine("    PPC_PsqStKnownResolvedInline<0u, 6u, 0x3D043D04u>(&ctx, range, 4, base + 4, pair.d);");
+        harness.AppendLine("    if (Memory::Read16(base + 4) != expected) return 7;");
+        harness.AppendLine("    PPC_PsqStKnownStackInline<0u, 6u, 0x3D043D04u>(&ctx, base + 6, pair.d);");
+        harness.AppendLine("    if (Memory::Read16(base + 6) != expected) return 8;");
+        harness.AppendLine("    PPC_FPR exceptional{}; exceptional.paired.ps0 = std::numeric_limits<float>::quiet_NaN(); exceptional.paired.ps1 = std::numeric_limits<float>::infinity();");
+        harness.AppendLine("    PPC_PsqStKnownInline<0u, 6u, 0x3D043D04u>(&ctx, 0xCC008000u, exceptional.d);");
+        harness.AppendLine("    if (g_fifo16Count != 1 || g_fifo16 != Reference(exceptional.d)) return 9;");
+        harness.AppendLine("    std::cout << \"ok\"; return 0;");
+        harness.AppendLine("}");
+
+        var harnessPath = Path.Combine(tempRoot, "harness_psq_u8_scale61.cpp");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var runnerBasePath = Path.Combine(tempRoot, "runner_psq_u8_scale61");
+        var args = TranslatorCppTestHarness.BuildCompileArguments(
+            root,
+            tempRoot,
+            Array.Empty<string>(),
+            harnessPath,
+            runnerBasePath,
+            includeDataSections: false);
+
+        var compiler = CppCompiler();
+        var (compileExitCode, compileOutput) = RunProcess(compiler, args, TimeSpan.FromSeconds(60));
+        Assert.True(compileExitCode == 0, $"{compiler} failed: {compileOutput}");
+
+        var runnerPath = RunnerPath(runnerBasePath);
+        var (runExitCode, runOutput) = RunProcess(runnerPath, "", TimeSpan.FromSeconds(10));
+        Assert.True(runExitCode == 0, $"Runner failed ({runExitCode}). Output:\n{runOutput}");
+        Assert.Equal("ok", runOutput.Trim());
+    }
+
+    [Fact]
+    public void InlinePairedSingleArithmeticPreservesLaneOrder()
+    {
+        var root = ProjectPaths.FindRepositoryRoot();
+        var tempRoot = Path.Combine(root, "test_output", "ppc_runtime_ps_arithmetic");
+        Directory.CreateDirectory(tempRoot);
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <cmath>");
+        harness.AppendLine("#include <cstdint>");
+        harness.AppendLine("#include <iostream>");
+        harness.AppendLine("#include <limits>");
+        harness.AppendLine("#include \"ppc_runtime.h\"");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write8(uint8_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write16(uint16_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write32(uint32_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_WriteFloat(float) {}");
+        harness.AppendLine("extern \"C\" void DumpRecentPcTrace(size_t) {}");
+        harness.AppendLine("static bool Near(float a, float b) { return std::fabs(a - b) < 0.0001f; }");
+        harness.AppendLine("static int Check(PPC_FPR f, float ps0, float ps1, int code) {");
+        harness.AppendLine("    if (!Near(f.paired.ps0, ps0)) return code;");
+        harness.AppendLine("    if (!Near(f.paired.ps1, ps1)) return code + 1;");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+        harness.AppendLine("static uint64_t Bits(double value) {");
+        harness.AppendLine("    uint64_t bits = 0;");
+        harness.AppendLine("    std::memcpy(&bits, &value, sizeof(bits));");
+        harness.AppendLine("    return bits;");
+        harness.AppendLine("}");
+        harness.AppendLine("static double FromBits(uint64_t bits) {");
+        harness.AppendLine("    double value = 0.0;");
+        harness.AppendLine("    std::memcpy(&value, &bits, sizeof(value));");
+        harness.AppendLine("    return value;");
+        harness.AppendLine("}");
+        harness.AppendLine("static float FloatFromBits(uint32_t bits) {");
+        harness.AppendLine("    float value = 0.0f;");
+        harness.AppendLine("    std::memcpy(&value, &bits, sizeof(value));");
+        harness.AppendLine("    return value;");
+        harness.AppendLine("}");
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    PPC_FPR a{}; a.paired.ps0 = 2.0f; a.paired.ps1 = -4.0f;");
+        harness.AppendLine("    PPC_FPR b{}; b.paired.ps0 = 8.0f; b.paired.ps1 = 0.5f;");
+        harness.AppendLine("    PPC_FPR c{}; c.paired.ps0 = 3.0f; c.paired.ps1 = 10.0f;");
+        harness.AppendLine("    PPC_FPR out{};");
+        harness.AppendLine("    out.d = PPC_PsAddInline(a.d, b.d); if (int rc = Check(out, 10.0f, -3.5f, 1)) return rc;");
+        harness.AppendLine("    out.d = PPC_PsSubInline(a.d, b.d); if (int rc = Check(out, -6.0f, -4.5f, 3)) return rc;");
+        harness.AppendLine("    out.d = PPC_PsDivInline(a.d, b.d); if (int rc = Check(out, 0.25f, -8.0f, 21)) return rc;");
+        harness.AppendLine("    out.d = PPC_PsMulInline(a.d, b.d); if (int rc = Check(out, 16.0f, -2.0f, 5)) return rc;");
+        harness.AppendLine("    out.d = PPC_PsMaddInline(a.d, b.d, c.d); if (int rc = Check(out, 19.0f, 8.0f, 7)) return rc;");
+        harness.AppendLine("    out.d = PPC_PsMsubInline(a.d, b.d, c.d); if (int rc = Check(out, 13.0f, -12.0f, 9)) return rc;");
+        harness.AppendLine("    out.d = PPC_PsNmsubInline(a.d, b.d, c.d); if (int rc = Check(out, -13.0f, 12.0f, 11)) return rc;");
+        harness.AppendLine("    out.d = PPC_PsMuls0Inline(a.d, b.d); if (int rc = Check(out, 16.0f, -32.0f, 13)) return rc;");
+        harness.AppendLine("    out.d = PPC_PsMuls1Inline(a.d, b.d); if (int rc = Check(out, 1.0f, -2.0f, 15)) return rc;");
+        harness.AppendLine("    if (PPC_Divwu(0x12345678u, 0u) != 0u) return 17;");
+        harness.AppendLine("    if (PPC_Divw(123, 0) != 0) return 18;");
+        harness.AppendLine("    if (PPC_Divw(-123, 0) != -1) return 19;");
+        harness.AppendLine("    if (PPC_Divw(INT32_MIN, -1) != -1) return 20;");
+        harness.AppendLine("    // Exact Gekko estimate bits, including interpolation and exponent parity.");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(1.0)) != 0x3FEFFE8000000000ULL) return 23;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(2.0)) != 0x3FE69FA000000000ULL) return 24;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(4.0)) != 0x3FDFFE8000000000ULL) return 25;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(3.14159265358979323846)) != 0x3FE20DD740000000ULL) return 26;");
+        harness.AppendLine("    // Subnormal normalization must extend the encoded exponent below zero.");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(FromBits(0x0000000000000001ULL))) != 0x617FFE8000000000ULL) return 27;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(FromBits(0x000FFFFFFFFFFFFFULL))) != 0x5FE000082C000000ULL) return 28;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(FromBits(0x0010000000000000ULL))) != 0x5FDFFE8000000000ULL) return 29;");
+        harness.AppendLine("    // These values drive the architectural zero/invalid/NaN paths; the helper's");
+        harness.AppendLine("    // contract is result bits, while instruction emission owns FPSCR effects.");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(0.0)) != 0x7FF0000000000000ULL) return 30;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(-0.0)) != 0xFFF0000000000000ULL) return 31;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(std::numeric_limits<double>::infinity())) != 0x0000000000000000ULL) return 32;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(-std::numeric_limits<double>::infinity())) != 0x7FF8000000000000ULL) return 33;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(-4.0)) != 0x7FF8000000000000ULL) return 34;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(FromBits(0x7FF0000000000001ULL))) != 0x7FF8000000000001ULL) return 35;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(FromBits(0xFFF0000000000123ULL))) != 0xFFF8000000000123ULL) return 36;");
+        harness.AppendLine("    if (Bits(PPC_Frsqrte(FromBits(0x7FF8000000001234ULL))) != 0x7FF8000000001234ULL) return 37;");
+        harness.AppendLine("    // Paired multiply-add has one float32 rounding point, not a rounded");
+        harness.AppendLine("    // float multiply followed by a second rounded add.");
+        harness.AppendLine("    PPC_FPR edgeA{}; edgeA.paired.ps0 = FloatFromBits(0x42480000u); edgeA.paired.ps1 = edgeA.paired.ps0;");
+        harness.AppendLine("    PPC_FPR edgeC{}; edgeC.paired.ps0 = FloatFromBits(0xBC88CC38u); edgeC.paired.ps1 = edgeC.paired.ps0;");
+        harness.AppendLine("    PPC_FPR edgeB{}; edgeB.paired.ps0 = FloatFromBits(0x1B1C72A0u); edgeB.paired.ps1 = edgeB.paired.ps0;");
+        harness.AppendLine("    out.d = PPC_PsMaddInline(edgeA.d, edgeC.d, edgeB.d);");
+        harness.AppendLine("    if (PpcBitCastToU32Inline(out.paired.ps0) != 0xBF55BF17u || PpcBitCastToU32Inline(out.paired.ps1) != 0xBF55BF17u) return 38;");
+        harness.AppendLine("    if (PpcBitCastToU32Inline(static_cast<float>(PpcFmaddsInline(edgeA.paired.ps0, edgeC.paired.ps0, edgeB.paired.ps0))) != 0xBF55BF17u) return 39;");
+        harness.AppendLine("    // Double fused arithmetic must retain the product error cancelled by B.");
+        harness.AppendLine("    const double fmaA = 1.0 + 0x1p-27;");
+        harness.AppendLine("    const double fmaC = 1.0 - 0x1p-27;");
+        harness.AppendLine("    if (Bits(PpcFmaddInline(fmaA, fmaC, -1.0)) != 0xBC90000000000000ULL) return 40;");
+        harness.AppendLine("    // Exact Broadway reciprocal estimates, including lane replication.");
+        harness.AppendLine("    PPC_FPR estimateIn{}; estimateIn.paired.ps0 = 1.0f; estimateIn.paired.ps1 = 2.0f;");
+        harness.AppendLine("    if (Bits(PPC_Fres(estimateIn.d)) != 0x3F7FF8003F7FF800ULL) return 41;");
+        harness.AppendLine("    if (Bits(PPC_PsRes(estimateIn.d)) != 0x3F7FF8003EFFF800ULL) return 42;");
+        harness.AppendLine("    estimateIn.paired.ps0 = 1.0f; estimateIn.paired.ps1 = 4.0f;");
+        harness.AppendLine("    if (Bits(PPC_PsRsqrte(estimateIn.d)) != 0x3F7FF4003EFFF400ULL) return 43;");
+        harness.AppendLine("    estimateIn.paired.ps0 = -0.0f; estimateIn.paired.ps1 = -4.0f;");
+        harness.AppendLine("    if (Bits(PPC_PsRsqrte(estimateIn.d)) != 0xFF8000007FC00000ULL) return 44;");
+        harness.AppendLine("    // stfs narrows the FPR payload with Gekko's bit conversion, not a host cast.");
+        harness.AppendLine("    if (MemoryInline::ConvertPpcDoubleToSingleBits(1.0 + 0x1.8p-23) != 0x3F800001u) return 45;");
+        harness.AppendLine("    if (MemoryInline::ConvertPpcDoubleToSingleBits(1.0 + 0x1.8p-24) != 0x3F800000u) return 46;");
+        harness.AppendLine("    // FPSCR[NI] flushes single subnormal results while preserving their sign.");
+        harness.AppendLine("    CpuContext niCpu{}; niCpu.fpscr = 4u;");
+        harness.AppendLine("    { CpuContextScope niScope(&niCpu);");
+        harness.AppendLine("      if (PpcBitCastToU32Inline(PpcForceSingleValueInline(0x1p-149)) != 0u) return 47;");
+        harness.AppendLine("      if (PpcBitCastToU32Inline(PpcForceSingleValueInline(-0x1p-149)) != 0x80000000u) return 48;");
+        harness.AppendLine("    }");
+        harness.AppendLine("    std::cout << \"ok\";");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+
+        var harnessPath = Path.Combine(tempRoot, "harness_ps_arithmetic.cpp");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var runnerBasePath = Path.Combine(tempRoot, "runner_ps_arithmetic");
+        var args = TranslatorCppTestHarness.BuildCompileArguments(
+            root,
+            tempRoot,
+            Array.Empty<string>(),
+            harnessPath,
+            runnerBasePath,
+            includeDataSections: false);
+
+        var compiler = CppCompiler();
+        var (compileExitCode, compileOutput) = RunProcess(compiler, args, TimeSpan.FromSeconds(60));
+        Assert.True(compileExitCode == 0, $"{compiler} failed: {compileOutput}");
+
+        var runnerPath = RunnerPath(runnerBasePath);
+        var (runExitCode, runOutput) = RunProcess(runnerPath, "", TimeSpan.FromSeconds(10));
+        Assert.True(runExitCode == 0, $"Runner failed ({runExitCode}). Output:\n{runOutput}");
+        Assert.Equal("ok", runOutput.Trim());
+    }
+
+    [Fact]
+    public void NonvolatileFprGuardPreservesPackedPairedAndScalarFprs()
+    {
+        var root = ProjectPaths.FindRepositoryRoot();
+        var tempRoot = Path.Combine(root, "test_output", "ppc_nonvolatile_fpr_guard");
+        Directory.CreateDirectory(tempRoot);
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <cstdint>");
+        harness.AppendLine("#include <iostream>");
+        harness.AppendLine("#include \"abi_bridge.h\"");
+        harness.AppendLine("extern \"C\" void ClobberNonvolatileFprs(CpuContext* ctx) {");
+        harness.AppendLine("    ctx->fpr[14].raw = 0x0102030405060708ull;");
+        harness.AppendLine("    ctx->fpr[31].raw = 0x8877665544332211ull;");
+        harness.AppendLine("}");
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    CpuContext ctx{};");
+        harness.AppendLine("    PPC_FPR saved14{}; saved14.paired.ps0 = 12.5f; saved14.paired.ps1 = -7.25f;");
+        harness.AppendLine("    PPC_FPR saved31{}; saved31.d = 3.141592653589793;");
+        harness.AppendLine("    PPC_FPR volatile13{}; volatile13.paired.ps0 = 1.0f; volatile13.paired.ps1 = 2.0f;");
+        harness.AppendLine("    ctx.fpr[14] = saved14;");
+        harness.AppendLine("    ctx.fpr[31] = saved31;");
+        harness.AppendLine("    ctx.fpr[13] = volatile13;");
+        harness.AppendLine("    {");
+        harness.AppendLine("        PpcNonvolatileFprGuard guard(&ctx);");
+        harness.AppendLine("        ctx.fpr[14].paired.ps0 = 1000.0f;");
+        harness.AppendLine("        ctx.fpr[14].paired.ps1 = 2000.0f;");
+        harness.AppendLine("        ctx.fpr[31].raw = 0x123456789ABCDEF0ull;");
+        harness.AppendLine("        ctx.fpr[13].paired.ps0 = 9.0f;");
+        harness.AppendLine("        ctx.fpr[13].paired.ps1 = 10.0f;");
+        harness.AppendLine("    }");
+        harness.AppendLine("    if (ctx.fpr[14].raw != saved14.raw) return 1;");
+        harness.AppendLine("    if (ctx.fpr[31].raw != saved31.raw) return 2;");
+        harness.AppendLine("    if (ctx.fpr[13].raw == volatile13.raw) return 3;");
+        harness.AppendLine("    {");
+        harness.AppendLine("        PpcNonvolatileFprGuard guard(&ctx, 1u << 31);");
+        harness.AppendLine("        ctx.fpr[14].raw = 0x1111111111111111ull;");
+        harness.AppendLine("        ctx.fpr[31].raw = 0x2222222222222222ull;");
+        harness.AppendLine("    }");
+        harness.AppendLine("    if (ctx.fpr[14].raw == saved14.raw) return 4;");
+        harness.AppendLine("    if (ctx.fpr[31].raw != saved31.raw) return 5;");
+        harness.AppendLine("    ctx.fpr[14] = saved14;");
+        harness.AppendLine("    TranslatedFunctionInfo info{};");
+        harness.AppendLine("    info.entryPoint = reinterpret_cast<void*>(&ClobberNonvolatileFprs);");
+        harness.AppendLine("    info.nonvolatileFprWriteMask = 1u << 31;");
+        harness.AppendLine("    if (!TryDispatchResolvedCpuTarget(&info, &ctx)) return 6;");
+        harness.AppendLine("    if (ctx.fpr[14].raw == saved14.raw) return 7;");
+        harness.AppendLine("    if (ctx.fpr[31].raw != saved31.raw) return 8;");
+        harness.AppendLine("    ctx.fpr[14] = saved14;");
+        harness.AppendLine("    ctx.fpr[31] = saved31;");
+        harness.AppendLine("    info.nonvolatileFprWriteMask = kPpcAllNonvolatileFprMask;");
+        harness.AppendLine("    if (!TryDispatchResolvedCpuTarget(&info, &ctx)) return 9;");
+        harness.AppendLine("    if (ctx.fpr[14].raw != saved14.raw) return 10;");
+        harness.AppendLine("    if (ctx.fpr[31].raw != saved31.raw) return 11;");
+        harness.AppendLine("    info.nonvolatileFprWriteMask = 0;");
+        harness.AppendLine("    if (!TryDispatchResolvedCpuTarget(&info, &ctx)) return 12;");
+        harness.AppendLine("    if (ctx.fpr[14].raw == saved14.raw) return 13;");
+        harness.AppendLine("    if (ctx.fpr[31].raw == saved31.raw) return 14;");
+        harness.AppendLine("    std::cout << \"ok\";");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+
+        var harnessPath = Path.Combine(tempRoot, "harness_nonvolatile_fpr_guard.cpp");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var runnerBasePath = Path.Combine(tempRoot, "runner_nonvolatile_fpr_guard");
+        var args =
+            "-std=c++17 " +
+            $"\"{harnessPath}\" " +
+            $"-I\"{Path.Combine(root, "runtime", "include")}\" " +
+            $"-o \"{runnerBasePath}\"";
+
+        var compiler = CppCompiler();
+        var (compileExitCode, compileOutput) = RunProcess(compiler, args, TimeSpan.FromSeconds(60));
+        Assert.True(compileExitCode == 0, $"{compiler} failed: {compileOutput}");
+
+        var runnerPath = RunnerPath(runnerBasePath);
+        var (runExitCode, runOutput) = RunProcess(runnerPath, "", TimeSpan.FromSeconds(10));
+        Assert.True(runExitCode == 0, $"Runner failed ({runExitCode}). Output:\n{runOutput}");
+        Assert.Equal("ok", runOutput.Trim());
+    }
+
+    [Fact]
+    public void DirectCpuDispatchSeesModOverrideRegisteredAfterFirstBaseCall()
+    {
+        var root = ProjectPaths.FindRepositoryRoot();
+        var tempRoot = Path.Combine(root, "test_output", "ppc_direct_mod_override_refresh");
+        Directory.CreateDirectory(tempRoot);
+
+        var harness = new StringBuilder();
+        harness.AppendLine("#include <cstdint>");
+        harness.AppendLine("#include <iostream>");
+        harness.AppendLine("#include <utility>");
+        harness.AppendLine("#include \"abi_bridge.h\"");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write8(uint8_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write16(uint16_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_Write32(uint32_t) {}");
+        harness.AppendLine("extern \"C\" void GX_HLE_FIFO_WriteFloat(float) {}");
+        harness.AppendLine("extern \"C\" void BaseTranslated(CpuContext* ctx) { ctx->gpr[3] = 0xBACE0001u; }");
+        harness.AppendLine("extern \"C\" void ModTranslated(CpuContext* ctx) { ctx->gpr[3] = 0xC0DE0002u; }");
+        harness.AppendLine("template <> struct KnownTranslatedCpuCall<0x81234568u> {");
+        harness.AppendLine("    static constexpr bool kAvailable = true;");
+        harness.AppendLine("    static constexpr uint32_t kNonvolatileFprWriteMask = 0;");
+        harness.AppendLine("    static constexpr bool kMayBeOverridden = true;");
+        harness.AppendLine("    static constexpr void (*Entry)(CpuContext*) = &BaseTranslated;");
+        harness.AppendLine("};");
+        harness.AppendLine("static void Register(uint32_t priority, FunctionKind kind, const char* name, void (*entry)(CpuContext*)) {");
+        harness.AppendLine("    TranslatedFunctionInfo info{};");
+        harness.AppendLine("    info.address = 0x81234568u;");
+        harness.AppendLine("    info.name = name;");
+        harness.AppendLine("    info.kind = kind;");
+        harness.AppendLine("    info.priority = priority;");
+        harness.AppendLine("    info.entryPoint = reinterpret_cast<void*>(entry);");
+        harness.AppendLine("    info.nonvolatileFprWriteMask = 0;");
+        harness.AppendLine("    TranslatedFunctionRegistry::Register(std::move(info));");
+        harness.AppendLine("}");
+        harness.AppendLine("int main() {");
+        harness.AppendLine("    CpuContext ctx{};");
+        harness.AppendLine("    Register(0, FunctionKind::BaseTranslated, \"base\", &BaseTranslated);");
+        harness.AppendLine("    InvokeDirectCpu<0x81234568u>(&ctx);");
+        harness.AppendLine("    if (ctx.gpr[3] != 0xBACE0001u) return 1;");
+        harness.AppendLine("    Register(100, FunctionKind::ModTranslated, \"mod\", &ModTranslated);");
+        harness.AppendLine("    ctx.gpr[3] = 0;");
+        harness.AppendLine("    InvokeDirectCpu<0x81234568u>(&ctx);");
+        harness.AppendLine("    if (ctx.gpr[3] != 0xC0DE0002u) return 2;");
+        harness.AppendLine("    TranslatedFunctionRegistry::Finalize();");
+        harness.AppendLine("    ctx.gpr[3] = 0;");
+        harness.AppendLine("    InvokeDirectCpu<0x81234568u>(&ctx);");
+        harness.AppendLine("    if (ctx.gpr[3] != 0xC0DE0002u) return 3;");
+        harness.AppendLine("    std::cout << \"ok\";");
+        harness.AppendLine("    return 0;");
+        harness.AppendLine("}");
+
+        var harnessPath = Path.Combine(tempRoot, "harness_direct_mod_override_refresh.cpp");
+        File.WriteAllText(harnessPath, harness.ToString());
+
+        var runnerBasePath = Path.Combine(tempRoot, "runner_direct_mod_override_refresh");
+        var args = TranslatorCppTestHarness.BuildCompileArguments(
+            root,
+            tempRoot,
+            Array.Empty<string>(),
+            harnessPath,
+            runnerBasePath,
+            includeDataSections: false);
+
+        var compiler = CppCompiler();
+        var (compileExitCode, compileOutput) = RunProcess(compiler, args, TimeSpan.FromSeconds(60));
+        Assert.True(compileExitCode == 0, $"{compiler} failed: {compileOutput}");
+
+        var runnerPath = RunnerPath(runnerBasePath);
+        var (runExitCode, runOutput) = RunProcess(runnerPath, "", TimeSpan.FromSeconds(10));
+        Assert.True(runExitCode == 0, $"Runner failed ({runExitCode}). Output:\n{runOutput}");
+        Assert.Contains("ok", runOutput);
+    }
+}
diff --git a/translator/tests/Translator.Tests/PpcWordAnalysisTests.cs b/translator/tests/Translator.Tests/PpcWordAnalysisTests.cs
new file mode 100644
index 0000000..5f07097
--- /dev/null
+++ b/translator/tests/Translator.Tests/PpcWordAnalysisTests.cs
@@ -0,0 +1,162 @@
+using Translator.Core.Disassembly;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class PpcWordAnalysisTests
+{
+    [Fact]
+    public void FieldsExposeSplitSprAndImmediateForms()
+    {
+        var fields = new PpcWordFields(0x7D8903A6u); // mtctr r12
+
+        Assert.Equal(31, fields.PrimaryOpcode);
+        Assert.Equal(12, fields.GprField0);
+        Assert.Equal(9, fields.Spr);
+        Assert.Equal(467, fields.ExtendedOpcode);
+
+        var immediateFields = new PpcWordFields(0x398CFFF0u); // addi r12,r12,-0x10
+        Assert.Equal(-16, immediateFields.SignedImmediate16);
+        Assert.Equal(0xFFF0u, immediateFields.UnsignedImmediate16);
+    }
+
+    [Fact]
+    public void ImmediateAndRegisterPatternsPreserveArchitecturalFieldOrder()
+    {
+        Assert.True(PpcInstructionPatterns.TryGetLis(0x3D80807Eu, out var lisDestination, out var high));
+        Assert.Equal(12, lisDestination);
+        Assert.Equal(0x807Eu, high);
+
+        Assert.True(PpcInstructionPatterns.TryGetAddi(0x398CFFF0u, out var addiDestination, out var addiSource, out var addiImmediate));
+        Assert.Equal(12, addiDestination);
+        Assert.Equal(12, addiSource);
+        Assert.Equal(-16, addiImmediate);
+
+        Assert.True(PpcInstructionPatterns.TryGetOri(0x618C3064u, out var oriSource, out var oriDestination, out var oriImmediate));
+        Assert.Equal(12, oriSource);
+        Assert.Equal(12, oriDestination);
+        Assert.Equal(0x3064u, oriImmediate);
+
+        var oris = EncodeImmediate(25, source: 12, destination: 9, immediate: 0x1234);
+        Assert.True(PpcInstructionPatterns.TryGetOris(oris, out var orisSource, out var orisDestination, out var orisImmediate));
+        Assert.Equal(12, orisSource);
+        Assert.Equal(9, orisDestination);
+        Assert.Equal(0x1234u, orisImmediate);
+
+        var orWord = EncodeXForm(source: 12, destination: 9, otherSource: 12, extendedOpcode: 444);
+        Assert.True(PpcInstructionPatterns.TryGetOr(orWord, out var source, out var destination, out var otherSource));
+        Assert.Equal(12, source);
+        Assert.Equal(9, destination);
+        Assert.Equal(12, otherSource);
+
+        var rlwinm = EncodeRlwinm(source: 3, destination: 4, shift: 0, maskBegin: 16, maskEnd: 31);
+        Assert.True(PpcInstructionPatterns.TryGetRlwinm(rlwinm, out var rotateSource, out var rotateDestination, out var shift, out var maskBegin, out var maskEnd));
+        Assert.Equal(3, rotateSource);
+        Assert.Equal(4, rotateDestination);
+        Assert.Equal(0, shift);
+        Assert.Equal(16, maskBegin);
+        Assert.Equal(31, maskEnd);
+    }
+
+    [Fact]
+    public void SprPatternsRecognizeOnlyTheRequestedSpecialRegister()
+    {
+        Assert.True(PpcInstructionPatterns.TryGetMtspr(0x7D8903A6u, 9, out var ctrSource));
+        Assert.Equal(12, ctrSource);
+        Assert.False(PpcInstructionPatterns.TryGetMtspr(0x7D8903A6u, 8, out _));
+
+        Assert.True(PpcInstructionPatterns.TryGetMtspr(0x7C0803A6u, 8, out var lrSource));
+        Assert.Equal(0, lrSource);
+    }
+
+    [Fact]
+    public void BranchPatternsPreserveLinkAbsoluteAndConditionalDistinctions()
+    {
+        const uint address = 0x80000100u;
+
+        Assert.True(PpcControlFlow.IsRelativeUnlinkedBranch(0x48000008u));
+        Assert.True(PpcControlFlow.TryDecodeRelativeBranchTarget(address, 0x48000008u, out var forward));
+        Assert.Equal(0x80000108u, forward);
+
+        Assert.True(PpcControlFlow.IsRelativeLinkedBranch(0x48000001u));
+        Assert.True(PpcControlFlow.TryDecodeRelativeBranchLinkTarget(address, 0x48000001u, out var linked));
+        Assert.Equal(address, linked);
+
+        Assert.False(PpcControlFlow.IsRelativeUnlinkedBranch(0x48000002u)); // absolute b
+        Assert.False(PpcControlFlow.TryDecodeRelativeBranchTarget(address, 0x48000001u, out _)); // bl
+
+        Assert.True(PpcControlFlow.TryDecodeConditionalRelativeBranchTarget(address, 0x4182FFFCu, out var conditional));
+        Assert.Equal(0x800000FCu, conditional);
+        Assert.True(PpcControlFlow.MayChangeControlFlow(0x4182FFFCu));
+        Assert.True(PpcControlFlow.MayChangeControlFlow(0x48000000u));
+        Assert.True(PpcControlFlow.MayChangeControlFlow(0x4E800020u));
+        Assert.False(PpcControlFlow.MayChangeControlFlow(0x398CFFF0u));
+    }
+
+    [Fact]
+    public void ConservativeWritePolicyUsesTheArchitecturalDestinationRegister()
+    {
+        // ori RA, RS, UIMM writes RA. Two of the three scanners used to key this
+        // on RS, so they evicted the source and kept a stale value in the
+        // register the instruction actually overwrote.
+        var ori = EncodeImmediate(24, source: 3, destination: 4, immediate: 1);
+        Assert.True(PpcRegisterEffects.MayWriteGpr(ori, 4));
+        Assert.False(PpcRegisterEffects.MayWriteGpr(ori, 3));
+
+        // addi RT, RA, SIMM writes RT, which this encoder puts in the source field.
+        var addi = EncodeImmediate(14, source: 5, destination: 6, immediate: 8);
+        Assert.True(PpcRegisterEffects.MayWriteGpr(addi, 5));
+        Assert.False(PpcRegisterEffects.MayWriteGpr(addi, 6));
+
+        // lwzu RT, d(RA) writes both RT and the RA base.
+        var lwzu = EncodeImmediate(33, source: 7, destination: 8, immediate: 4);
+        Assert.True(PpcRegisterEffects.MayWriteGpr(lwzu, 7));
+        Assert.True(PpcRegisterEffects.MayWriteGpr(lwzu, 8));
+
+        // stwu RS, d(RA) writes the RA base back; stw writes no register.
+        var stwu = EncodeImmediate(37, source: 1, destination: 1, immediate: 0xFFF0);
+        Assert.True(PpcRegisterEffects.MayWriteGpr(stwu, 1));
+        var stw = EncodeImmediate(36, source: 9, destination: 10, immediate: 0);
+        Assert.False(PpcRegisterEffects.MayWriteGpr(stw, 9));
+        Assert.False(PpcRegisterEffects.MayWriteGpr(stw, 10));
+
+        // lfd writes an FPR, so no GPR dies; lfdu still writes its RA base.
+        var lfd = EncodeImmediate(50, source: 11, destination: 12, immediate: 0);
+        Assert.False(PpcRegisterEffects.MayWriteGpr(lfd, 11));
+        Assert.False(PpcRegisterEffects.MayWriteGpr(lfd, 12));
+        var lfdu = EncodeImmediate(51, source: 11, destination: 12, immediate: 8);
+        Assert.True(PpcRegisterEffects.MayWriteGpr(lfdu, 12));
+
+        // cmpi writes a CR field, not a GPR.
+        var cmpi = EncodeImmediate(11, source: 0, destination: 13, immediate: 0);
+        Assert.False(PpcRegisterEffects.MayWriteGpr(cmpi, 0));
+        Assert.False(PpcRegisterEffects.MayWriteGpr(cmpi, 13));
+
+        // X-form is treated as clobbering either candidate: `add r5,r5,r6` and
+        // `or r5,r6,r6` share a primary opcode but not a destination field.
+        var xform = EncodeImmediate(31, source: 14, destination: 15, immediate: 0);
+        Assert.True(PpcRegisterEffects.MayWriteGpr(xform, 14));
+        Assert.True(PpcRegisterEffects.MayWriteGpr(xform, 15));
+    }
+
+    private static uint EncodeImmediate(int opcode, int source, int destination, int immediate) =>
+        ((uint)opcode << 26) |
+        ((uint)source << 21) |
+        ((uint)destination << 16) |
+        (uint)(immediate & 0xFFFF);
+
+    private static uint EncodeXForm(int source, int destination, int otherSource, int extendedOpcode) =>
+        (31u << 26) |
+        ((uint)source << 21) |
+        ((uint)destination << 16) |
+        ((uint)otherSource << 11) |
+        ((uint)extendedOpcode << 1);
+
+    private static uint EncodeRlwinm(int source, int destination, int shift, int maskBegin, int maskEnd) =>
+        (21u << 26) |
+        ((uint)source << 21) |
+        ((uint)destination << 16) |
+        ((uint)shift << 11) |
+        ((uint)maskBegin << 6) |
+        ((uint)maskEnd << 1);
+}
diff --git a/translator/tests/Translator.Tests/ProductionTranslationPolicyTests.cs b/translator/tests/Translator.Tests/ProductionTranslationPolicyTests.cs
new file mode 100644
index 0000000..d200f41
--- /dev/null
+++ b/translator/tests/Translator.Tests/ProductionTranslationPolicyTests.cs
@@ -0,0 +1,14 @@
+namespace Translator.Tests;
+
+public sealed class ProductionTranslationPolicyTests
+{
+    [Fact]
+    public void ProductionProjectIsStrict()
+    {
+        var repositoryRoot = ProjectPathsForTests.FindRepositoryRoot();
+        var productionProject = File.ReadAllText(
+            Path.Combine(repositoryRoot, "projects", "mkwii", "recomp.yml"));
+        Assert.Contains("allow_unsupported_instructions: false", productionProject, StringComparison.Ordinal);
+        Assert.DoesNotContain("allow_unsupported_instructions: true", productionProject, StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/RegisterResidencyCodeGenTests.cs b/translator/tests/Translator.Tests/RegisterResidencyCodeGenTests.cs
new file mode 100644
index 0000000..67f9a78
--- /dev/null
+++ b/translator/tests/Translator.Tests/RegisterResidencyCodeGenTests.cs
@@ -0,0 +1,427 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class RegisterResidencyCodeGenTests
+{
+    private static string Emit(
+        IrFunction function,
+        RepresentationEnvironment? types = null,
+        bool stateFree = false,
+        uint entryPoint = 0x80001000u,
+        IReadOnlyDictionary<uint, GuestAbiContract>? guestAbiContracts = null)
+    {
+        var contract = GuestAbiContractAnalyzer.Analyze(function);
+        return new CxxLinearCodeGenerator().Emit(
+            entryPoint,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification(function.Name, ValueRepresentation.Void),
+            types ?? new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            guestAbiContracts: guestAbiContracts,
+            emitStateFreeLeafVariant: stateFree,
+            stateFreeAbiContracts: stateFree
+                ? new Dictionary<uint, GuestAbiContract> { [entryPoint] = contract }
+                : null,
+            stateFreeCallSymbols: stateFree
+                ? new Dictionary<uint, string> { [entryPoint] = $"{function.Name}_native" }
+                : null);
+    }
+
+    /// <summary>
+    /// A synthetic callee contract. Everything not named here is empty, which is
+    /// what makes the narrowing observable.
+    /// </summary>
+    private static GuestAbiContract NarrowContract(
+        uint gprRead = 0,
+        uint gprWrite = 0,
+        uint fprRead = 0,
+        uint fprWrite = 0,
+        byte crRead = 0,
+        byte crWrite = 0,
+        bool readsCtr = false,
+        bool writesCtr = false,
+        GuestCallBoundaryFlags flags = GuestCallBoundaryFlags.None) =>
+        new(
+            GprReadBeforeWriteMask: gprRead,
+            GprPossibleWriteMask: gprWrite,
+            GprReturnMask: 0,
+            FprReadBeforeWriteMask: fprRead,
+            FprPossibleWriteMask: fprWrite,
+            FprReturnMask: 0,
+            CrReadBeforeWriteMask: crRead,
+            CrPossibleWriteMask: crWrite,
+            ReadsXerBeforeWrite: false,
+            MayWriteXer: false,
+            ReadsCtrBeforeWrite: readsCtr,
+            MayWriteCtr: writesCtr,
+            ReadsLrBeforeWrite: false,
+            MayWriteLr: false,
+            BoundaryFlags: flags,
+            DirectCallTargets: Array.Empty<uint>());
+
+    private static IrFunction CallerAcross(string name, string target) =>
+        new(name, "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrBinary("r5", IrValue.Register("r5"), IrValue.Register("r6"), "add"),
+                new IrCall(string.Empty, target, Array.Empty<IrValue>()),
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r5"), "add"),
+                new IrReturn(null)
+            })
+        });
+
+    private static string FunctionBody(string code, string name)
+    {
+        var declaration = $"extern \"C\" void {name}(CpuContext* MKW_RESTRICT ctx)";
+        var start = code.IndexOf(declaration, StringComparison.Ordinal);
+        Assert.True(start >= 0, $"missing definition of {name}");
+        var open = code.IndexOf('{', start);
+        var depth = 0;
+        for (var index = open; index < code.Length; ++index)
+        {
+            if (code[index] == '{') ++depth;
+            else if (code[index] == '}' && --depth == 0) return code[open..(index + 1)];
+        }
+
+        throw new InvalidOperationException("unterminated body");
+    }
+
+    [Fact]
+    public void ResidentBodyLoadsAtEntryAndWritesBackAtReturn()
+    {
+        var function = new IrFunction("resident_add", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains("uint32_t r3 = ctx->gpr[3];", code, StringComparison.Ordinal);
+        Assert.Contains("uint32_t r4 = ctx->gpr[4];", code, StringComparison.Ordinal);
+        Assert.Contains("    r3 = (r3 + r4);", code, StringComparison.Ordinal);
+        // r4 is never written, so it is not part of the write-back set.
+        Assert.Contains("    ctx->gpr[3] = r3;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->gpr[4] = r4;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->gpr[3] = (", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void GuestCallIsBracketedByFlushAndReload()
+    {
+        var function = new IrFunction("resident_call", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrReturn(null)
+            })
+        });
+
+        var body = FunctionBody(Emit(function), "resident_call");
+        var flush = body.IndexOf("    ctx->gpr[3] = r3;", StringComparison.Ordinal);
+        var call = body.IndexOf("InvokeDirectCpu<0x80002000u>(ctx);", StringComparison.Ordinal);
+        var reload = body.IndexOf("    r3 = ctx->gpr[3];", StringComparison.Ordinal);
+
+        Assert.True(flush > 0 && call > flush && reload > call,
+            "the call must be preceded by a flush and followed by a reload");
+        // A register that is only read still has to be reloaded: the callee may
+        // clobber it. It must not be flushed, because it was never modified.
+        Assert.Contains("    r4 = ctx->gpr[4];", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->gpr[4] = r4;", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void IndirectJumpFlushesWithoutWritingLocalsBack()
+    {
+        var function = new IrFunction("resident_tail", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrIndirectJump(IrValue.Register("r3"))
+            })
+        });
+
+        var body = FunctionBody(Emit(function), "resident_tail");
+        var flush = body.IndexOf("ctx->gpr[3] = r3;", StringComparison.Ordinal);
+        var jump = body.IndexOf("InvokeIndirectJump(r3, ctx);", StringComparison.Ordinal);
+
+        Assert.True(flush > 0 && jump > flush);
+        // Exactly one publication: nothing may be written back after the tail
+        // dispatch, because the callee owns the architectural state from there.
+        Assert.Equal(
+            1,
+            body.Split("ctx->gpr[3] = r3;", StringSplitOptions.None).Length - 1);
+    }
+
+    [Fact]
+    public void ConditionRegisterAndCountRegisterBecomeLocals()
+    {
+        var function = new IrFunction("resident_loop", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("ctr", IrValue.Register("r3")),
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrBranch("bdnz", "entry", "exit", "ctr")
+            }),
+            new IrBasicBlock("exit", new IrInstruction[] { new IrReturn(null) })
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains("uint32_t cr = ctx->cr;", code, StringComparison.Ordinal);
+        Assert.Contains("uint32_t ctr = ctx->ctr;", code, StringComparison.Ordinal);
+        Assert.Contains("uint32_t xer = ctx->xer;", code, StringComparison.Ordinal);
+        Assert.Contains("SetCRResident(cr, xer, 0,", code, StringComparison.Ordinal);
+        Assert.Contains("if ((ctr != 0))", code, StringComparison.Ordinal);
+        Assert.Contains("    ctx->cr = cr;", code, StringComparison.Ordinal);
+        Assert.Contains("    ctx->ctr = ctr;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("SetCR(ctx,", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RawBranchConditionTextIsRoutedThroughTheResidentCondition()
+    {
+        // PpcLifter emits the general bc/bcctr condition as raw C++ text. It is
+        // the only register access that bypasses the expression layer, so a
+        // resident body must rewrite it or silently read a stale CR/CTR.
+        var function = new IrFunction("resident_raw_condition", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBranch(
+                    "raw",
+                    "entry",
+                    "exit",
+                    "(((((ctx->ctr != 0)) ^ false)) && ((GetCRBit(ctx, 0, 2) == true)))")
+            }),
+            new IrBasicBlock("exit", new IrInstruction[] { new IrReturn(null) })
+        });
+
+        var code = Emit(function);
+
+        Assert.Contains("(((ctr != 0)) ^ false)", code, StringComparison.Ordinal);
+        Assert.Contains("GetCRBitResident(cr, 0, 2)", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->ctr !=", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("GetCRBit(ctx,", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void FloatRegistersUseValueLocalsAndPreservePairedLanes()
+    {
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["f1"] = ValueRepresentation.Float64,
+            ["f2"] = ValueRepresentation.Float64
+        });
+        var function = new IrFunction("resident_float", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrCall("f1", "PPC_PsAdd", new[] { IrValue.Register("f1"), IrValue.Register("f2") }),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function, types);
+
+        Assert.Contains("PPC_FPR f1 = ctx->fpr[1];", code, StringComparison.Ordinal);
+        Assert.Contains("PPC_FPR f2 = ctx->fpr[2];", code, StringComparison.Ordinal);
+        Assert.Contains("PpcSetPairedFprInline(f1,", code, StringComparison.Ordinal);
+        // The whole union is written back so PS1 survives the boundary.
+        Assert.Contains("    ctx->fpr[1] = f1;", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->fpr[2] = f2;", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StateFreeVariantIsUnchangedWhileThePublicEntryBecomesResident()
+    {
+        var function = new IrFunction("resident_state_free", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function, stateFree: true);
+
+        // The explicit-state clone is derived from the legacy cached body, so it
+        // keeps the cached form while the public CpuContext entry is resident.
+        var start = code.IndexOf("resident_state_free_native(", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var variant = code[start..code.IndexOf("RECOMP_STATE_FREE_ABI", start, StringComparison.Ordinal)];
+        Assert.DoesNotContain("ctx->gpr[3] = r3;", variant, StringComparison.Ordinal);
+
+        var publicBody = FunctionBody(code, "resident_state_free");
+        Assert.Contains("uint32_t r3 = ctx->gpr[3];", publicBody, StringComparison.Ordinal);
+        Assert.Contains("    r3 = (r3 + r4);", publicBody, StringComparison.Ordinal);
+        Assert.DoesNotContain("cached_r3", publicBody, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BoundaryNarrowingSyncsOnlyTheContractIntersectionAtADirectCall()
+    {
+        // The callee reads r4 before writing it and can only write r3, so the
+        // boundary needs r3 (it is in this frame's write set and in the callee
+        // write set), r4 (the callee reads it), and nothing else on the flush;
+        // the reload is limited to r3.
+        var contracts = new Dictionary<uint, GuestAbiContract>
+        {
+            [0x80002000u] = NarrowContract(gprRead: 1u << 4, gprWrite: 1u << 3)
+        };
+
+        var body = FunctionBody(
+            Emit(
+                CallerAcross("narrowed_call", "0x80002000"),
+                guestAbiContracts: contracts),
+            "narrowed_call");
+        var call = body.IndexOf("InvokeDirectCpu<0x80002000u>(ctx);", StringComparison.Ordinal);
+        Assert.True(call > 0);
+        var beforeCall = body[..call];
+        var afterCall = body[call..];
+
+        Assert.Contains("ctx->gpr[3] = r3;", beforeCall, StringComparison.Ordinal);
+        // r5 is written by this frame but the callee neither reads nor writes it.
+        Assert.DoesNotContain("ctx->gpr[5] = r5;", beforeCall, StringComparison.Ordinal);
+        Assert.Contains("    r3 = ctx->gpr[3];", afterCall, StringComparison.Ordinal);
+        Assert.DoesNotContain("r4 = ctx->gpr[4];", afterCall, StringComparison.Ordinal);
+        Assert.DoesNotContain("r5 = ctx->gpr[5];", afterCall, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BoundaryNarrowingFlushesRegistersTheCalleeOnlyMayWrite()
+    {
+        // A register the callee may write has to be flushed even though the
+        // callee never reads it: the write is only possible, so on the paths
+        // where it does not happen the reload after the call would otherwise
+        // load a stale architectural value back into the local.
+        var contracts = new Dictionary<uint, GuestAbiContract>
+        {
+            [0x80002000u] = NarrowContract(gprWrite: (1u << 3) | (1u << 5))
+        };
+
+        var body = FunctionBody(
+            Emit(
+                CallerAcross("narrowed_possible_write", "0x80002000"),
+                guestAbiContracts: contracts),
+            "narrowed_possible_write");
+        var call = body.IndexOf("InvokeDirectCpu<0x80002000u>(ctx);", StringComparison.Ordinal);
+        var beforeCall = body[..call];
+        var afterCall = body[call..];
+
+        Assert.Contains("ctx->gpr[3] = r3;", beforeCall, StringComparison.Ordinal);
+        Assert.Contains("ctx->gpr[5] = r5;", beforeCall, StringComparison.Ordinal);
+        Assert.Contains("    r3 = ctx->gpr[3];", afterCall, StringComparison.Ordinal);
+        Assert.Contains("    r5 = ctx->gpr[5];", afterCall, StringComparison.Ordinal);
+        Assert.DoesNotContain("r4 = ctx->gpr[4];", afterCall, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BoundaryNarrowingSyncsConditionAndCountRegistersOnAnyIntersectingField()
+    {
+        // The contract describes CR per field while the local is the packed
+        // register, so a single intersecting field forces the whole sync. CTR is
+        // synced whenever the contract cannot prove the callee leaves it alone.
+        var function = new IrFunction("narrowed_special", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("ctr", IrValue.Register("r3")),
+                new IrSetCrField(2, IrValue.Register("r3"), IrValue.Imm(0), false),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrBranch("bdnz", "entry", "exit", "ctr")
+            }),
+            new IrBasicBlock("exit", new IrInstruction[] { new IrReturn(null) })
+        });
+
+        string BodyFor(GuestAbiContract contract) => FunctionBody(
+            Emit(
+                function,
+                guestAbiContracts: new Dictionary<uint, GuestAbiContract> { [0x80002000u] = contract }),
+            "narrowed_special");
+
+        var touched = BodyFor(NarrowContract(crRead: 1 << 5, crWrite: 1 << 1, writesCtr: true));
+        Assert.Contains("ctx->cr = cr;", touched, StringComparison.Ordinal);
+        Assert.Contains("    cr = ctx->cr;", touched, StringComparison.Ordinal);
+        Assert.Contains("ctx->ctr = ctr;", touched, StringComparison.Ordinal);
+        Assert.Contains("    ctr = ctx->ctr;", touched, StringComparison.Ordinal);
+
+        var untouched = BodyFor(NarrowContract(gprWrite: 1u << 3));
+        var call = untouched.IndexOf("InvokeDirectCpu<0x80002000u>(ctx);", StringComparison.Ordinal);
+        // The exit flush still publishes CR/CTR; only the call boundary drops it.
+        Assert.DoesNotContain("ctx->cr = cr;", untouched[..call], StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->ctr = ctr;", untouched[..call], StringComparison.Ordinal);
+        Assert.DoesNotContain("    cr = ctx->cr;", untouched[call..], StringComparison.Ordinal);
+        Assert.DoesNotContain("    ctr = ctx->ctr;", untouched[call..], StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public void BoundaryNarrowingFallsBackToAFullSyncWithoutAPreciseContract(bool haveContract)
+    {
+        // A missing contract and a full-synchronization fence are the same thing
+        // here: neither proves anything about the callee's register usage.
+        var contracts = haveContract
+            ? new Dictionary<uint, GuestAbiContract>
+            {
+                [0x80002000u] = NarrowContract(
+                    gprWrite: 1u << 3,
+                    flags: GuestCallBoundaryFlags.RequiresCompleteContext)
+            }
+            : new Dictionary<uint, GuestAbiContract>();
+
+        var caller = CallerAcross("narrowed_fence", "0x80002000");
+        var narrowed = FunctionBody(
+            Emit(caller, guestAbiContracts: contracts),
+            "narrowed_fence");
+
+        // Full synchronization, asserted by shape: r5 is flushed even though the
+        // callee is declared unable to write it, and r4 is reloaded even though
+        // this frame only reads it. Narrowing would have dropped both.
+        var call = narrowed.IndexOf("InvokeDirectCpu<0x80002000u>(ctx);", StringComparison.Ordinal);
+        Assert.Contains("ctx->gpr[5] = r5;", narrowed[..call], StringComparison.Ordinal);
+        Assert.Contains("    r4 = ctx->gpr[4];", narrowed[call..], StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void BoundaryNarrowingDoesNotApplyToIndirectCalls()
+    {
+        var function = new IrFunction("narrowed_indirect", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrIndirectCall(string.Empty, IrValue.Register("r12"), Array.Empty<IrValue>()),
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrReturn(null)
+            })
+        });
+
+        var narrowed = FunctionBody(Emit(function), "narrowed_indirect");
+
+        // There is no callee contract to narrow against, so the boundary stays
+        // full: r4 is reloaded after the call even though this frame only reads it.
+        Assert.Contains("    r4 = ctx->gpr[4];", narrowed, StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/ResolvedMemoryLeafCacheCodeGenTests.cs b/translator/tests/Translator.Tests/ResolvedMemoryLeafCacheCodeGenTests.cs
new file mode 100644
index 0000000..f4a9294
--- /dev/null
+++ b/translator/tests/Translator.Tests/ResolvedMemoryLeafCacheCodeGenTests.cs
@@ -0,0 +1,55 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class ResolvedMemoryLeafCacheCodeGenTests
+{
+    [Fact]
+    public void AddressBasesUsedOnlyByResolvedOperationsStayCached()
+    {
+        var function = new IrFunction(
+            "resolved_memory_register_cache",
+            "entry",
+            new[]
+            {
+                new IrBasicBlock("entry", new IrInstruction[]
+                {
+                    new IrResolveGuestMemoryRange(
+                        "range", IrValue.Register("r13"), 0, 64,
+                        NeedsReadAccess: true, NeedsWriteAccess: false),
+                    new IrResolvedLoad(
+                        "r3", "range", new IrAddress("r2", 4), 4, 4),
+                    new IrReturn(IrValue.Register("r3"))
+                })
+            });
+        var types = new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>
+        {
+            ["r2"] = ValueRepresentation.UInt32,
+            ["r3"] = ValueRepresentation.UInt32,
+            ["r13"] = ValueRepresentation.UInt32
+        });
+
+        // Register residency owns every primary body and achieves the property
+        // under test (an address base used only by resolved operations promoted
+        // once to a local) directly at emission time, under its own plain-named
+        // locals.
+        var code = new CxxLinearCodeGenerator().Emit(
+            0x80006202,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification("resolved_memory_register_cache", ValueRepresentation.UInt32),
+            types);
+
+        Assert.Contains("uint32_t r2 = ctx->gpr[2];", code, StringComparison.Ordinal);
+        Assert.Contains("uint32_t r13 = ctx->gpr[13];", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::ResolveRangeHost(r13", code, StringComparison.Ordinal);
+        Assert.Contains("MemoryInline::ReadResolved32(range, 4u, (r2 + 4))", code, StringComparison.Ordinal);
+    }
+}
diff --git a/translator/tests/Translator.Tests/RetroWfcBootstrapSuppressorTests.cs b/translator/tests/Translator.Tests/RetroWfcBootstrapSuppressorTests.cs
new file mode 100644
index 0000000..2663384
--- /dev/null
+++ b/translator/tests/Translator.Tests/RetroWfcBootstrapSuppressorTests.cs
@@ -0,0 +1,37 @@
+using Translator.Core.Mods.Mkwii;
+using Translator.Core.Parsing.Kamek;
+
+namespace Translator.Tests;
+
+public class RetroWfcBootstrapSuppressorTests
+{
+    [Fact]
+    public void SuppressRemovesOnlyConfiguredLegacyBootstrapBranch()
+    {
+        var bootstrap = Command(KamekCommandId.Branch, 0x800ED6E8u, 0x0003437Cu);
+        var other = Command(KamekCommandId.Write32, 0x800EE3A0u, 0x2C030000u);
+        var chunk = Chunk([bootstrap, other]);
+
+        var result = RetroWfcBootstrapSuppressor.Suppress(chunk, 0x800ED6E8u);
+
+        Assert.Equal([other], result.Commands);
+        Assert.Equal(2, chunk.Commands.Count);
+    }
+
+    [Fact]
+    public void SuppressRejectsStaleOrIncorrectProfileAddress()
+    {
+        var chunk = Chunk([Command(KamekCommandId.Branch, 0x800ED6E8u, 0x0003437Cu)]);
+
+        var error = Assert.Throws<InvalidDataException>(
+            () => RetroWfcBootstrapSuppressor.Suppress(chunk, 0x800ED6ECu));
+
+        Assert.Contains("0x800ED6EC", error.Message, StringComparison.Ordinal);
+    }
+
+    private static KamekCommand Command(KamekCommandId id, uint address, uint argument) =>
+        new(0, 0, id, true, address, [argument]);
+
+    private static KamekChunk Chunk(IReadOnlyList<KamekCommand> commands) =>
+        new(0, 0, 0, 4, 0, 0, 4, [0, 0, 0, 0], commands);
+}
diff --git a/translator/tests/Translator.Tests/RetroWfcPayloadLoweringTests.cs b/translator/tests/Translator.Tests/RetroWfcPayloadLoweringTests.cs
new file mode 100644
index 0000000..4a11b0d
--- /dev/null
+++ b/translator/tests/Translator.Tests/RetroWfcPayloadLoweringTests.cs
@@ -0,0 +1,99 @@
+using System.Buffers.Binary;
+using System.Text;
+using Translator.Core.Mods;
+using Translator.Core.Mods.Mkwii;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class RetroWfcPayloadLoweringTests
+{
+    [Fact]
+    public void SharedPayloadDescriptorDrivesRelocationAndStaticLowering()
+    {
+        const uint moduleBase = 0x81700000u;
+        const uint payloadModuleOffset = 0x2000u;
+        var payload = BuildSharedPayloadFixture();
+
+        var result = RetroWfcPayload.Parse(payload, TestManifest(), moduleBase, payloadModuleOffset, "fixture");
+
+        Assert.Equal("RMCPD00", result.Summary.Game);
+        Assert.Equal(3u, result.Summary.FormatVersion);
+        Assert.Equal(moduleBase + payloadModuleOffset + 0x1E4u, result.Summary.InitializationTargetAddress);
+        Assert.Equal(moduleBase + payloadModuleOffset + 0x210u, ReadU32(result.RelocatedImage, 0x1B4));
+        Assert.Equal(moduleBase + payloadModuleOffset + 0x214u, ReadU32(result.RelocatedImage, 0x220));
+
+        var callback = Assert.Single(result.Summary.InitializationCallbacks);
+        Assert.Equal(moduleBase + payloadModuleOffset + 0x208u, callback.TargetAddress);
+
+        var hook = Assert.Single(result.LoweringPlan.ExecutableHooks);
+        Assert.Equal(moduleBase + payloadModuleOffset + 0x200u, hook.TargetAddress);
+        Assert.Equal("moduleFunction", hook.TargetKind);
+
+        var pointer = Assert.Single(result.LoweringPlan.StaticPointers);
+        Assert.Equal(moduleBase + payloadModuleOffset + 0x204u, pointer.TargetAddress);
+        Assert.Equal("moduleFunction", pointer.TargetKind);
+    }
+
+    private static BaseManifest TestManifest() =>
+        new(
+            "test",
+            1,
+            "RMCP01",
+            "P",
+            "",
+            0,
+            [
+                new BaseSectionMetadata(".text", "main.dol", 0x80001000u, 0x80001020u, true, false, "base_text.bin", 0),
+                new BaseSectionMetadata(".data", "main.dol", 0x80002000u, 0x80002020u, false, true, "base_data.bin", 0)
+            ],
+            [
+                new BaseFunctionRangeMetadata(0x80001000u, 0x80001020u, "func_80001000", ".text", 0, "test", ["Executable"])
+            ],
+            "ranges.json");
+
+    private static byte[] BuildSharedPayloadFixture()
+    {
+        var payload = new byte[0x240];
+        Encoding.ASCII.GetBytes("WWFC/Payload").CopyTo(payload, 0);
+        WriteU32(payload, 0x0C, (uint)payload.Length);
+        WriteU32(payload, 0x130, 3);
+        WriteU32(payload, 0x134, 1);
+        Encoding.ASCII.GetBytes("RMCPD00").CopyTo(payload, 0x138);
+        WriteU32(payload, 0x144, 0x00010000);
+        WriteU32(payload, 0x148, 0x1B4);
+        WriteU32(payload, 0x14C, 0x1B8);
+        WriteU32(payload, 0x150, 0x1B8);
+        WriteU32(payload, 0x154, 0x1BC);
+        WriteU32(payload, 0x158, 0x1BC);
+        WriteU32(payload, 0x15C, 0x1DC);
+        WriteU32(payload, 0x1A0, 0x1A4);
+
+        WriteU32(payload, 0x1A4, 1);
+        WriteU32(payload, 0x1A8, 0x1E4);
+        WriteU32(payload, 0x1AC, 0x1E4);
+        WriteU32(payload, 0x1B0, 0x230);
+
+        WriteU32(payload, 0x1B4, 0x210);
+        WriteU32(payload, 0x1B8, 0x220);
+
+        payload[0x1BC + 1] = 3;
+        WriteU32(payload, 0x1BC + 4, 0x80001000);
+        WriteU32(payload, 0x1BC + 8, 0x200);
+
+        payload[0x1CC + 1] = 6;
+        WriteU32(payload, 0x1CC + 4, 0x80002000);
+        WriteU32(payload, 0x1CC + 8, 0x204);
+
+        WriteU32(payload, 0x1DC, 0xFFFFFFFF);
+        WriteU32(payload, 0x1E0, 0x208);
+        WriteU32(payload, 0x220, 0x214);
+        return payload;
+    }
+
+    private static uint ReadU32(byte[] image, int offset) =>
+        BinaryPrimitives.ReadUInt32BigEndian(image.AsSpan(offset, 4));
+
+    private static void WriteU32(byte[] image, int offset, uint value) =>
+        BinaryPrimitives.WriteUInt32BigEndian(image.AsSpan(offset, 4), value);
+}
diff --git a/translator/tests/Translator.Tests/RiivolutionProfileConfigTests.cs b/translator/tests/Translator.Tests/RiivolutionProfileConfigTests.cs
new file mode 100644
index 0000000..40c305f
--- /dev/null
+++ b/translator/tests/Translator.Tests/RiivolutionProfileConfigTests.cs
@@ -0,0 +1,135 @@
+using Translator.Cli.Configuration;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class RiivolutionProfileConfigTests
+{
+    [Fact]
+    public void ParsesRiivolutionSectionAndNormalizesPackRelativeXmlPath()
+    {
+        var root = CreateTempRoot();
+        try
+        {
+            var projectPath = WriteProject(
+                root,
+                "    riivolution:",
+                "      xml: .\\xml\\RetroRewind6.xml",
+                "      options:",
+                "        - section: Retro Rewind",
+                "          option: Pack",
+                "          choice: 1",
+                "        - option: Extra");
+
+            var profile = TranslationProjectConfig.Load(projectPath).Profiles["retro-rewind"];
+
+            Assert.NotNull(profile.Riivolution);
+            Assert.Equal("xml/RetroRewind6.xml", profile.Riivolution!.Xml);
+            Assert.Collection(
+                profile.Riivolution.Options,
+                option => Assert.Equal(new ProjectRiivolutionOption("Retro Rewind", "Pack", 1u), option),
+                option => Assert.Equal(new ProjectRiivolutionOption(string.Empty, "Extra", 0u), option));
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void ProfileWithoutRiivolutionLeavesItUnset()
+    {
+        var root = CreateTempRoot();
+        try
+        {
+            var projectPath = WriteProject(root);
+            Assert.Null(TranslationProjectConfig.Load(projectPath).Profiles["retro-rewind"].Riivolution);
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void RiivolutionWithoutXmlIsRejected()
+    {
+        var root = CreateTempRoot();
+        try
+        {
+            var projectPath = WriteProject(
+                root,
+                "    riivolution:",
+                "      options:",
+                "        - option: Pack",
+                "          choice: 1");
+
+            var error = Assert.Throws<InvalidDataException>(() => TranslationProjectConfig.Load(projectPath));
+            Assert.Contains("profiles.retro-rewind.riivolution.xml", error.Message, StringComparison.Ordinal);
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void RiivolutionOptionWithoutOptionNameIsRejected()
+    {
+        var root = CreateTempRoot();
+        try
+        {
+            var projectPath = WriteProject(
+                root,
+                "    riivolution:",
+                "      xml: xml/RetroRewind6.xml",
+                "      options:",
+                "        - section: Retro Rewind",
+                "          choice: 1");
+
+            var error = Assert.Throws<InvalidDataException>(() => TranslationProjectConfig.Load(projectPath));
+            Assert.Contains("riivolution.options[0].option", error.Message, StringComparison.Ordinal);
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static string WriteProject(string root, params string[] profileLines)
+    {
+        File.WriteAllBytes(Path.Combine(root, "main.dol"), new byte[0x100]);
+        var lines = new List<string>
+        {
+            "schema_version: 1",
+            "workspace_root: .",
+            "",
+            "project:",
+            "  id: riivolution-test",
+            "",
+            "inputs:",
+            "  dol:",
+            "    path: main.dol",
+            "",
+            "translation:",
+            "  entry_points:",
+            "    - 0x80001000",
+            "",
+            "profiles:",
+            "  retro-rewind:",
+            "    enabled: true",
+        };
+        lines.AddRange(profileLines);
+
+        var path = Path.Combine(root, "recomp.yml");
+        File.WriteAllLines(path, lines);
+        return path;
+    }
+
+    private static string CreateTempRoot()
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"translator-riivolution-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(root);
+        return root;
+    }
+}
diff --git a/translator/tests/Translator.Tests/RuntimeNativeGuestEffectAnalyzerTests.cs b/translator/tests/Translator.Tests/RuntimeNativeGuestEffectAnalyzerTests.cs
new file mode 100644
index 0000000..a6ef10a
--- /dev/null
+++ b/translator/tests/Translator.Tests/RuntimeNativeGuestEffectAnalyzerTests.cs
@@ -0,0 +1,102 @@
+using System;
+using System.IO;
+using Translator.Core.Analysis;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class RuntimeNativeGuestEffectAnalyzerTests
+{
+    [Fact]
+    public void TypedStubDerivesArgumentsAndReturnWithoutContextFence()
+    {
+        using var fixture = new SourceFixture("""
+            extern "C" uint32_t Plain(uint32_t first, float second) { return first; }
+            PPC_NATIVE_OVERRIDE(80001234, Plain, uint32_t, (uint32_t first, float second), (first, second));
+            """);
+
+        var effects = RuntimeNativeGuestEffectAnalyzer.AnalyzeDirectory(fixture.Directory);
+        var contract = effects.Contracts[0x80001234u];
+        Assert.Equal(1u << 3, contract.GprReadBeforeWriteMask);
+        Assert.Equal(1u << 1, contract.FprReadBeforeWriteMask);
+        Assert.Equal(1u << 3, contract.GprPossibleWriteMask);
+        Assert.False(contract.HasFullSynchronizationFence);
+        Assert.Contains(0x80001234u, effects.PreciseContracts);
+    }
+
+    [Fact]
+    public void DirectContextNativeDerivesConstantRegisterReadsAndWrites()
+    {
+        using var fixture = new SourceFixture("""
+            extern "C" void Matrix(CpuContext* ctx) {
+                const auto a = ctx->gpr[3];
+                const auto b = ctx->gpr[4];
+                ctx->gpr[6] = a + b;
+            }
+            REGISTER_NATIVE_FUNCTION(0x80005678, Matrix);
+            """);
+
+        var contract = RuntimeNativeGuestEffectAnalyzer.AnalyzeDirectory(fixture.Directory).Contracts[0x80005678u];
+        Assert.Equal((1u << 3) | (1u << 4), contract.GprReadBeforeWriteMask);
+        Assert.Equal(1u << 6, contract.GprPossibleWriteMask);
+        Assert.False(contract.HasFullSynchronizationFence);
+    }
+
+    [Fact]
+    public void EscapedContextAndSchedulerCallsRemainExplicitFullBoundaries()
+    {
+        using var fixture = new SourceFixture("""
+            extern "C" void Sleep(CpuContext* ctx) {
+                Fiber::YieldToScheduler(ctx);
+            }
+            REGISTER_NATIVE_FUNCTION(0x80009ABC, Sleep);
+            """);
+
+        var contract = RuntimeNativeGuestEffectAnalyzer.AnalyzeDirectory(fixture.Directory).Contracts[0x80009ABCu];
+        Assert.True(contract.HasFullSynchronizationFence);
+        Assert.True((contract.BoundaryFlags & GuestCallBoundaryFlags.CanSuspend) != 0);
+        Assert.Contains(0x80009ABCu,
+            RuntimeNativeGuestEffectAnalyzer.AnalyzeDirectory(fixture.Directory).ConservativeContracts);
+    }
+
+    [Fact]
+    public void TypedStubReachingForAmbientContextIsAFullFence()
+    {
+        // A typed stub's contract comes from its host signature alone. This one
+        // is shaped exactly like 0x801AAD7C (__OSGetSystemTime): declared to
+        // return a single uint32_t, but it publishes a 64-bit result by storing
+        // r3 and r4 through the ambient context. Deriving "writes r3" from the
+        // signature would let a narrowed call boundary skip reloading r4.
+        using var fixture = new SourceFixture("""
+            extern "C" uint32_t GetSystemTime(uint32_t low, uint32_t high) {
+                const uint64_t now = ReadSystemTime();
+                if (CpuContext* ctx = CurrentCpuContext()) {
+                    ctx->gpr[3] = static_cast<uint32_t>(now >> 32);
+                    ctx->gpr[4] = static_cast<uint32_t>(now);
+                }
+                return static_cast<uint32_t>(now >> 32);
+            }
+            PPC_NATIVE_OVERRIDE(801AAD7C, GetSystemTime, uint32_t, (uint32_t low, uint32_t high), (low, high));
+            """);
+
+        var effects = RuntimeNativeGuestEffectAnalyzer.AnalyzeDirectory(fixture.Directory);
+        var contract = effects.Contracts[0x801AAD7Cu];
+        Assert.True(contract.HasFullSynchronizationFence);
+        Assert.Equal(uint.MaxValue, contract.GprPossibleWriteMask);
+        Assert.Contains(0x801AAD7Cu, effects.ConservativeContracts);
+    }
+
+    private sealed class SourceFixture : IDisposable
+    {
+        public SourceFixture(string source)
+        {
+            Directory = Path.Combine(Path.GetTempPath(), $"mkw-native-effects-{Guid.NewGuid():N}");
+            System.IO.Directory.CreateDirectory(Directory);
+            File.WriteAllText(Path.Combine(Directory, "fixture.cpp"), source);
+        }
+
+        public string Directory { get; }
+
+        public void Dispose() => System.IO.Directory.Delete(Directory, recursive: true);
+    }
+}
diff --git a/translator/tests/Translator.Tests/RuntimeNativeIndexTests.cs b/translator/tests/Translator.Tests/RuntimeNativeIndexTests.cs
new file mode 100644
index 0000000..e630654
--- /dev/null
+++ b/translator/tests/Translator.Tests/RuntimeNativeIndexTests.cs
@@ -0,0 +1,83 @@
+using Translator.Core;
+using Translator.Core.CodeGen;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class RuntimeNativeIndexTests
+{
+    [Fact]
+    public void BuildCapturesEveryRuntimeRegistrationKind()
+    {
+        var directory = Path.Combine(Path.GetTempPath(), $"mkw-native-kinds-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(directory);
+        try
+        {
+            File.WriteAllText(Path.Combine(directory, "registrations.cpp"), """
+                REGISTER_NATIVE_FUNCTION(0x80000010, Direct);
+                REGISTER_NATIVE_FUNCTION_AS(0x80000020, Aliased, "alias");
+                REGISTER_TRANSLATED_FUNCTION(0x80000030, Translated);
+                PPC_NATIVE_OVERRIDE_VOID(80000040, Stub, (void), ());
+                GX_FATAL_STUB(80000050, "Fatal")
+                // REGISTER_NATIVE_FUNCTION(0x80000060, CommentedOut);
+                """);
+
+            var registrations = RuntimeNativeIndexBuilder.Build(directory).Registrations;
+            Assert.Equal(5, registrations.Length);
+            Assert.Contains(registrations, static entry =>
+                entry.Address == 0x80000010u && entry.ExcludesBaseTranslation);
+            Assert.Contains(registrations, static entry =>
+                entry.Address == 0x80000020u && !entry.ExcludesBaseTranslation);
+            Assert.Contains(registrations, static entry =>
+                entry.Address == 0x80000030u && entry.IsTranslatedOverride);
+            Assert.Contains(registrations, static entry =>
+                entry.Address == 0x80000040u && entry.Symbol == "Stub");
+            Assert.Contains(registrations, static entry =>
+                entry.Address == 0x80000050u && entry.Symbol == "GX_FATAL_STUB_80000050");
+            Assert.DoesNotContain(registrations, static entry => entry.Address == 0x80000060u);
+        }
+        finally
+        {
+            if (Directory.Exists(directory))
+                Directory.Delete(directory, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void BuildSharesTypedAbiAndEffectDataWithoutCreatingSidecarFiles()
+    {
+        var directory = Path.Combine(Path.GetTempPath(), $"mkw-native-index-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(directory);
+        var sourcePath = Path.Combine(directory, "fixture.cpp");
+        try
+        {
+            File.WriteAllText(sourcePath, """
+                extern "C" void Typed(float value, uint32_t count) { (void)value; (void)count; }
+                PPC_NATIVE_OVERRIDE_VOID(80001234, Typed, (float value, uint32_t count), (value, count));
+                """);
+
+            var index = RuntimeNativeIndexBuilder.Build(directory);
+            Assert.Single(index.Registrations);
+            Assert.Single(index.VoidStubAbis);
+            Assert.Single(index.Effects);
+            Assert.True(index.ToGuestEffectSet().Contracts.ContainsKey(0x80001234u));
+
+            var provider = RuntimeNativeFunctionAbiProvider.FromIndex(
+                index, new HashSet<uint> { 0x80001234u });
+            Assert.True(provider.TryGetGuestFunctionAbi("func_80001234", out var abi));
+            Assert.Contains("f1", abi.ArgumentRegisters);
+            Assert.Contains("r3", abi.ArgumentRegisters);
+            Assert.Contains("f1", abi.ScalarFloatArgumentRegisters);
+
+            var outOfScope = RuntimeNativeFunctionAbiProvider.FromIndex(index, new HashSet<uint>());
+            Assert.False(outOfScope.TryGetGuestFunctionAbi("func_80001234", out _));
+
+            Assert.Equal([sourcePath], Directory.GetFiles(directory));
+        }
+        finally
+        {
+            if (Directory.Exists(directory))
+                Directory.Delete(directory, recursive: true);
+        }
+    }
+}
diff --git a/translator/tests/Translator.Tests/ScalarPairedBoundaryCodeGenTests.cs b/translator/tests/Translator.Tests/ScalarPairedBoundaryCodeGenTests.cs
new file mode 100644
index 0000000..c523a8c
--- /dev/null
+++ b/translator/tests/Translator.Tests/ScalarPairedBoundaryCodeGenTests.cs
@@ -0,0 +1,265 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class ScalarPairedBoundaryCodeGenTests
+{
+    [Theory]
+    [InlineData("add", true)]
+    [InlineData("sub", true)]
+    [InlineData("mul", true)]
+    [InlineData("fdiv", true)]
+    [InlineData("fcmp", true)]
+    [InlineData("fabs", false)]
+    [InlineData("fneg", false)]
+    [InlineData("frsp", false)]
+    [InlineData("fsqrt", false)]
+    [InlineData("fctiw", false)]
+    [InlineData("fctiwz", false)]
+    public void NormalizesPairedOperandsForEveryScalarFloatOperator(
+        string operation,
+        bool consumesRightOperand)
+    {
+        var code = Emit(
+            new IrCall("f2", "PPC_PsSum0", new[]
+            {
+                IrValue.Register("f5"), IrValue.Register("f6"), IrValue.Register("f7")
+            }),
+            new IrCall("f3", "PPC_PsSum0", new[]
+            {
+                IrValue.Register("f8"), IrValue.Register("f9"), IrValue.Register("f10")
+            }),
+            new IrBinary(
+                "f4",
+                IrValue.Register("f2"),
+                consumesRightOperand ? IrValue.Register("f3") : IrValue.Imm(0),
+                operation));
+
+        Assert.Contains("PPC_PsToScalarInline(f2.d)", code, StringComparison.Ordinal);
+        if (consumesRightOperand)
+            Assert.Contains("PPC_PsToScalarInline(f3.d)", code, StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("PPC_PsFromScalar", 1)]
+    [InlineData("PPC_Fadds", 2)]
+    [InlineData("PPC_Fsubs", 2)]
+    [InlineData("PPC_Fmuls", 2)]
+    [InlineData("PPC_Fdivs", 2)]
+    [InlineData("PPC_Fsqrt", 1)]
+    [InlineData("PPC_Frsqrte", 1)]
+    [InlineData("PPC_Fmadd", 3)]
+    [InlineData("PPC_Fmsub", 3)]
+    [InlineData("PPC_Fnmadd", 3)]
+    [InlineData("PPC_Fnmsub", 3)]
+    public void NormalizesEveryPairedScalarHelperOperand(string target, int argumentCount)
+    {
+        var arguments = Enumerable.Repeat(IrValue.Register("f1"), argumentCount).ToArray();
+        var code = Emit(
+            new IrCall("f1", "PPC_PsMul", new[]
+            {
+                IrValue.Register("f5"), IrValue.Register("f6")
+            }),
+            new IrCall("f2", target, arguments));
+
+        const string conversion = "PPC_PsToScalarInline(f1.d)";
+        Assert.Equal(
+            argumentCount,
+            code.Split(conversion, StringSplitOptions.None).Length - 1);
+    }
+
+    [Fact]
+    public void PreservesScalarDoubleInputForFrsqrte()
+    {
+        var code = Emit(new IrCall("f2", "PPC_Frsqrte", new[] { IrValue.Register("f1") }));
+
+        Assert.Contains("PPC_Frsqrte(f1.d)", code, StringComparison.Ordinal);
+        Assert.DoesNotContain("PPC_PsFromScalarInline(f1.d)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PreservesPairedArgumentsAtUnprovenIndirectCallBoundary()
+    {
+        var code = Emit(
+            new IrCall("f1", "PPC_PsMul", new[]
+            {
+                IrValue.Register("f5"), IrValue.Register("f6")
+            }),
+            new IrIndirectCall(string.Empty, IrValue.Register("ctr"), new[]
+            {
+                IrValue.Register("r3"), IrValue.Register("f1")
+            }),
+            new IrCall("f2", "PPC_PsNeg", new[] { IrValue.Register("f1") }));
+        var call = code.IndexOf("InvokeIndirectCpu(ctr, ctx);", StringComparison.Ordinal);
+
+        Assert.True(call >= 0, code);
+        Assert.DoesNotContain(
+            "f1.d = PPC_PsToScalarInline(f1.d);",
+            code[..call],
+            StringComparison.Ordinal);
+        Assert.Contains(
+            "PPC_PsNegInline(PPC_PsFromScalarInline(f1.d))",
+            code[call..],
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PreservesUntouchedPairedPayloadAcrossIndirectCall()
+    {
+        var code = Emit(
+            new IrCall("f2", "PPC_PsMul", new[]
+            {
+                IrValue.Register("f5"), IrValue.Register("f6")
+            }),
+            new IrIndirectCall(string.Empty, IrValue.Register("ctr"), new[]
+            {
+                IrValue.Register("r3")
+            }),
+            new IrCall("f3", "PPC_PsNeg", new[] { IrValue.Register("f2") }));
+        var call = code.IndexOf("InvokeIndirectCpu(ctr, ctx);", StringComparison.Ordinal);
+
+        Assert.True(call >= 0, code);
+        Assert.Contains(
+            "PPC_PsNegInline(f2.d)",
+            code[call..],
+            StringComparison.Ordinal);
+        Assert.DoesNotContain(
+            "PPC_PsFromScalarInline(f2.d)",
+            code[call..],
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void UnprovenIndirectF1RemainsConventionalScalarForMixedConsumers()
+    {
+        var code = Emit(
+            new IrIndirectCall(string.Empty, IrValue.Register("ctr"), new[]
+            {
+                IrValue.Register("r3")
+            }),
+            new IrSetCrField(0, IrValue.Register("f1"), IrValue.Register("f14"), false),
+            new IrCall("f2", "PPC_PsNeg", new[] { IrValue.Register("f1") }));
+        var call = code.IndexOf("InvokeIndirectCpu(ctr, ctx);", StringComparison.Ordinal);
+
+        Assert.True(call >= 0, code);
+        Assert.Contains(
+            "SetCRFloatResident(cr, 0, f1.d, f14.d);",
+            code[call..],
+            StringComparison.Ordinal);
+        Assert.Contains(
+            "PPC_PsNegInline(PPC_PsFromScalarInline(f1.d))",
+            code[call..],
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void UnprovenDirectF1RemainsConventionalScalarForMixedConsumers()
+    {
+        var code = Emit(
+            new IrCall(string.Empty, "func_80002000", Array.Empty<IrValue>()),
+            new IrSetCrField(0, IrValue.Register("f1"), IrValue.Register("f14"), false),
+            new IrCall("f2", "PPC_PsNeg", new[] { IrValue.Register("f1") }));
+        var call = code.IndexOf("InvokeDirectCpu<0x80002000u>(ctx);", StringComparison.Ordinal);
+
+        Assert.True(call >= 0, code);
+        Assert.Contains(
+            "SetCRFloatResident(cr, 0, f1.d, f14.d);",
+            code[call..],
+            StringComparison.Ordinal);
+        Assert.Contains(
+            "PPC_PsNegInline(PPC_PsFromScalarInline(f1.d))",
+            code[call..],
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PacksImmediateForPairedConsumer()
+    {
+        var code = Emit(new IrCall("f2", "PPC_PsNeg", new[] { IrValue.Imm(7) }));
+
+        Assert.Contains(
+            "PPC_PsNegInline(PPC_PsFromScalarInline(7))",
+            code,
+            StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void PairedMoveCopiesBothArchitecturalLanes()
+    {
+        var code = Emit(new IrCall("f2", "PPC_PsMr", new[] { IrValue.Register("f7") }));
+
+        Assert.Contains(
+            "PpcSetPairedFprInline(f2, f7.d);",
+            code,
+            StringComparison.Ordinal);
+        Assert.DoesNotContain("f2.d = f7.d", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void EmitsArchitecturallyAccurateScalarFloatHelpers()
+    {
+        var code = Emit(
+            new IrCall("f2", "PPC_Fmuls", new[]
+            {
+                IrValue.Register("f3"), IrValue.Register("f4")
+            }),
+            new IrCall("f5", "PPC_Fmadd", new[]
+            {
+                IrValue.Register("f6"), IrValue.Register("f7"), IrValue.Register("f8")
+            }),
+            new IrCall("f9", "PPC_Fmsub", new[]
+            {
+                IrValue.Register("f10"), IrValue.Register("f11"), IrValue.Register("f12")
+            }),
+            new IrCall("f13", "PPC_Fnmadd", new[]
+            {
+                IrValue.Register("f14"), IrValue.Register("f15"), IrValue.Register("f16")
+            }),
+            new IrCall("f17", "PPC_Fnmsub", new[]
+            {
+                IrValue.Register("f18"), IrValue.Register("f19"), IrValue.Register("f20")
+            }),
+            new IrBinary(
+                "f21",
+                IrValue.Register("f22"),
+                IrValue.Imm(0),
+                "frsp"));
+
+        Assert.Contains("PpcFmulsInline(", code, StringComparison.Ordinal);
+        Assert.Contains("PpcFmaddInline(", code, StringComparison.Ordinal);
+        Assert.Contains("PpcFmsubInline(", code, StringComparison.Ordinal);
+        Assert.Contains("PpcFnmaddInline(", code, StringComparison.Ordinal);
+        Assert.Contains("PpcFnmsubInline(", code, StringComparison.Ordinal);
+        Assert.Contains("PpcForceSingleValueInline(", code, StringComparison.Ordinal);
+    }
+
+    private static string Emit(params IrInstruction[] instructions)
+    {
+        var body = instructions.Concat(new[] { new IrReturn(null) }).ToArray();
+        var function = new IrFunction(
+            "scalar_paired_boundary",
+            "entry",
+            new[] { new IrBasicBlock("entry", body) });
+        var types = Enumerable.Range(0, 32).ToDictionary(
+            index => $"f{index}",
+            _ => (ValueRepresentation)ValueRepresentation.Float64,
+            StringComparer.OrdinalIgnoreCase);
+        types["r3"] = ValueRepresentation.UInt32;
+        types["ctr"] = ValueRepresentation.UInt32;
+        return new CxxLinearCodeGenerator().Emit(
+            0x80006200,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification(
+                "scalar_paired_boundary",
+                ValueRepresentation.Void),
+            new RepresentationEnvironment(types));
+    }
+}
diff --git a/translator/tests/Translator.Tests/SdaAndGeneratorTests.cs b/translator/tests/Translator.Tests/SdaAndGeneratorTests.cs
new file mode 100644
index 0000000..0f97360
--- /dev/null
+++ b/translator/tests/Translator.Tests/SdaAndGeneratorTests.cs
@@ -0,0 +1,180 @@
+using System;
+using System.IO;
+using Translator.Core;
+using Translator.Core.CodeGen;
+using Translator.Core.Parsing.Dol;
+using Translator.Core.Parsing.Rel;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class SdaAndGeneratorTests
+{
+    [Fact]
+    public void RuntimeConfigGeneratorEmitsConfiguredConstants()
+    {
+        const uint entry = 0x80006000;
+        var dol = SyntheticDolFactory.Create(
+            entry,
+            sections:
+            [
+                SyntheticDolFactory.Text(0, entry, 0x60000000)
+            ]);
+
+        var tempDir = Path.Combine(Path.GetTempPath(), "mkw_runtime_config_tests");
+        Directory.CreateDirectory(tempDir);
+        var output = Path.Combine(tempDir, "RuntimeConfig.generated.h");
+
+        RuntimeConfigGenerator.GenerateConfigHeader(0x8038F780u, 0x8038E9C8u, output);
+        var text = File.ReadAllText(output);
+
+        Assert.Contains("constexpr uint32_t SDA1_BASE = 0x8038F780u;", text);
+        Assert.Contains("constexpr uint32_t SDA2_BASE = 0x8038E9C8u;", text);
+    }
+
+    [Fact]
+    public void RuntimeConfigGeneratorDoesNotRewriteIdenticalContent()
+    {
+        const uint entry = 0x80006000;
+        var dol = SyntheticDolFactory.Create(
+            entry,
+            sections:
+            [
+                SyntheticDolFactory.Text(0, entry, 0x60000000)
+            ]);
+
+        var tempDir = Path.Combine(Path.GetTempPath(), "mkw_runtime_config_write_tests");
+        Directory.CreateDirectory(tempDir);
+        var output = Path.Combine(tempDir, "RuntimeConfig.generated.h");
+
+        RuntimeConfigGenerator.GenerateConfigHeader(0x8038F780u, 0x8038E9C8u, output);
+        var sentinel = new DateTime(2001, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+        File.SetLastWriteTimeUtc(output, sentinel);
+
+        RuntimeConfigGenerator.GenerateConfigHeader(0x8038F780u, 0x8038E9C8u, output);
+
+        Assert.Equal(sentinel, File.GetLastWriteTimeUtc(output));
+    }
+
+    [Fact]
+    public void DataSectionGeneratorEmbedsDolAndRelSections()
+    {
+        var dol = SyntheticDolFactory.Create(
+            0x80004000,
+            bssAddress: 0x80009000,
+            bssSize: 0x40,
+            sections:
+            [
+                SyntheticDolFactory.Text(0, 0x80004000, 0x60000000),
+                SyntheticDolFactory.Data(5, 0x80008000, 0xAA, 0xBB, 0xCC)
+            ]);
+
+        var rel = new RelImage(new byte[] { 0x11, 0x22, 0x33 }, 0x80510000);
+        var tempDir = Path.Combine(Path.GetTempPath(), "mkw_data_section_tests");
+        Directory.CreateDirectory(tempDir);
+        var output = Path.Combine(tempDir, "data_sections_init_test.cpp");
+
+        DataSectionGenerator.Generate(dol, rel, output);
+        var text = File.ReadAllText(output);
+
+        Assert.Contains("kData__data", text);
+        Assert.Contains("kData_rel_module", text);
+        Assert.Contains("InitializeDataSections", text);
+        Assert.Contains("g_dataInitialized", text);
+        Assert.Contains("0x80008000", text);
+        Assert.Contains("0x80510000", text);
+    }
+
+    [Fact]
+    public void DataSectionGeneratorDoesNotEmitRuntimeBssClearAfterInitializedSections()
+    {
+        var dol = SyntheticDolFactory.Create(
+            0x80004000,
+            bssAddress: 0x80008000,
+            bssSize: 0x100,
+            sections:
+            [
+                SyntheticDolFactory.Data(5, 0x80008020, 0x41, 0x20, 0x00, 0x00)
+            ]);
+
+        var tempDir = Path.Combine(Path.GetTempPath(), "mkw_data_section_bss_overlap_tests");
+        Directory.CreateDirectory(tempDir);
+        var output = Path.Combine(tempDir, "data_sections_init_overlap_test.cpp");
+
+        DataSectionGenerator.Generate(dol, rel: null, output);
+        var text = File.ReadAllText(output);
+
+        Assert.Contains("0x80008020", text);
+        Assert.Contains("BSS section @ 0x80008000 (256 bytes) - memory already zero-initialized", text);
+        Assert.DoesNotContain("std::memset", text);
+    }
+
+    [Fact]
+    public void DataSectionGeneratorCanWriteStagedBlobsWithFinalIncbinReferences()
+    {
+        var dol = SyntheticDolFactory.Create(
+            0x80004000,
+            sections:
+            [
+                SyntheticDolFactory.Data(5, 0x80008000, 0xAA, 0xBB, 0xCC)
+            ]);
+        var tempDir = Path.Combine(Path.GetTempPath(), $"mkw_data_section_staging_{Guid.NewGuid():N}");
+        try
+        {
+            var stagedDirectory = Path.Combine(tempDir, "staging");
+            var finalBlobDirectory = Path.Combine(tempDir, "published", "data_sections_init_blobs");
+            var output = Path.Combine(stagedDirectory, "data_sections_init.cpp");
+
+            DataSectionGenerator.Generate(
+                dol,
+                rel: null,
+                output,
+                blobReferenceDirectory: finalBlobDirectory);
+
+            var assembly = File.ReadAllText(Path.Combine(stagedDirectory, "data_sections_init_blobs.S"));
+            var expectedReference = Path.GetFullPath(Path.Combine(finalBlobDirectory, "_data.bin")).Replace('\\', '/');
+            Assert.Contains($".incbin \"{expectedReference}\"", assembly, StringComparison.Ordinal);
+            Assert.True(File.Exists(Path.Combine(stagedDirectory, "data_sections_init_blobs", "_data.bin")));
+            Assert.False(File.Exists(Path.Combine(finalBlobDirectory, "_data.bin")));
+        }
+        finally
+        {
+            if (Directory.Exists(tempDir))
+            {
+                Directory.Delete(tempDir, recursive: true);
+            }
+        }
+    }
+
+    [Fact]
+    public void DataSectionGeneratorChangesAssemblyWhenSameSizeBlobContentChanges()
+    {
+        var tempDir = Path.Combine(Path.GetTempPath(), $"mkw_data_section_hash_{Guid.NewGuid():N}");
+        try
+        {
+            var output = Path.Combine(tempDir, "data_sections_init.cpp");
+            var first = SyntheticDolFactory.Create(
+                0x80004000,
+                sections: [SyntheticDolFactory.Data(5, 0x80008000, 1, 2, 3, 4)]);
+            DataSectionGenerator.Generate(first, rel: null, output);
+            var assemblyPath = Path.Combine(tempDir, "data_sections_init_blobs.S");
+            var before = File.ReadAllText(assemblyPath);
+
+            var second = SyntheticDolFactory.Create(
+                0x80004000,
+                sections: [SyntheticDolFactory.Data(5, 0x80008000, 1, 2, 3, 5)]);
+            DataSectionGenerator.Generate(second, rel: null, output);
+            var after = File.ReadAllText(assemblyPath);
+
+            Assert.NotEqual(before, after);
+            Assert.Contains("sha256=", after, StringComparison.Ordinal);
+        }
+        finally
+        {
+            if (Directory.Exists(tempDir))
+            {
+                Directory.Delete(tempDir, recursive: true);
+            }
+        }
+    }
+}
diff --git a/translator/tests/Translator.Tests/SsaTests.cs b/translator/tests/Translator.Tests/SsaTests.cs
new file mode 100644
index 0000000..dda0035
--- /dev/null
+++ b/translator/tests/Translator.Tests/SsaTests.cs
@@ -0,0 +1,247 @@
+using System.Collections.Generic;
+using System.Linq;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.Ir;
+using Xunit;
+
+namespace Translator.Tests;
+
+public class SsaTests
+{
+    [Fact]
+    public void InsertsPhiAndRenamesUses()
+    {
+        var blocks = new List<IrBasicBlock>
+        {
+            new("entry", new List<IrInstruction>
+            {
+                new IrAssign("r3", IrValue.Imm(5)),
+                new IrBranch("bne", "then", "else")
+            }),
+            new("then", new List<IrInstruction>
+            {
+                new IrAssign("r3", IrValue.Imm(1)),
+                new IrJump("merge")
+            }),
+            new("else", new List<IrInstruction>
+            {
+                new IrAssign("r3", IrValue.Imm(2)),
+                new IrJump("merge")
+            }),
+            new("merge", new List<IrInstruction>
+            {
+                new IrBinary("r4", IrValue.Register("r3"), IrValue.Imm(0), "add"),
+                new IrReturn(IrValue.Register("r4"))
+            })
+        };
+
+        var func = new IrFunction("test", "entry", blocks);
+        var ssa = new SsaTransformer().Convert(func);
+        ssa.ValidateUseDef();
+
+        var merge = ssa.Function.Blocks.Single(b => b.Label == "merge");
+        Assert.IsType<IrPhi>(merge.Instructions[0]);
+        var phi = (IrPhi)merge.Instructions[0];
+
+        Assert.Equal(2, phi.Sources.Count);
+        Assert.Contains("then", phi.Sources.Keys);
+        Assert.Contains("else", phi.Sources.Keys);
+
+        // All registers should be versioned.
+        Assert.All(ssa.Function.Blocks.SelectMany(b => b.Instructions), ins =>
+        {
+            switch (ins)
+            {
+                case IrAssign a:
+                    Assert.Contains("_", a.Destination);
+                    break;
+                case IrBinary b:
+                    Assert.Contains("_", b.Destination);
+                    Assert.Contains("_", b.Left.RegisterName ?? string.Empty);
+                    break;
+            }
+        });
+    }
+
+    [Fact]
+    public void FloatPhiAllowsImplicitLiveIn()
+    {
+        var blocks = new List<IrBasicBlock>
+        {
+            new("entry", new List<IrInstruction>
+            {
+                new IrBranch("bne", "left", "right")
+            }),
+            new("left", new List<IrInstruction>
+            {
+                new IrAssign("f1", IrValue.Imm(0)),
+                new IrJump("merge")
+            }),
+            new("right", new List<IrInstruction>
+            {
+                new IrJump("merge")
+            }),
+            new("merge", new List<IrInstruction>
+            {
+                new IrReturn(IrValue.Register("f1"))
+            })
+        };
+
+        var func = new IrFunction("float_phi", "entry", blocks);
+        var ssa = new SsaTransformer().Convert(func);
+        ssa.ValidateUseDef();
+
+        var merge = ssa.Function.Blocks.Single(b => b.Label == "merge");
+        var phi = Assert.IsType<IrPhi>(merge.Instructions[0]);
+        Assert.True(phi.Sources.ContainsKey("left"));
+        Assert.True(phi.Sources.ContainsKey("right"));
+    }
+
+    [Fact]
+    public void ConditionRegisterPhiAllowsImplicitLiveIn()
+    {
+        var blocks = new List<IrBasicBlock>
+        {
+            new("entry", new List<IrInstruction>
+            {
+                new IrBranch("bne", "left", "right")
+            }),
+            new("left", new List<IrInstruction>
+            {
+                new IrBinary("cr1", IrValue.Register("r3"), IrValue.Imm(0), "sub"),
+                new IrJump("merge")
+            }),
+            new("right", new List<IrInstruction>
+            {
+                new IrJump("merge")
+            }),
+            new("merge", new List<IrInstruction>
+            {
+                new IrBranch("eq", "exit_true", "exit_false", "cr1")
+            }),
+            new("exit_true", new List<IrInstruction>
+            {
+                new IrReturn(null)
+            }),
+            new("exit_false", new List<IrInstruction>
+            {
+                new IrReturn(null)
+            })
+        };
+
+        var func = new IrFunction("cr_phi", "entry", blocks);
+        var ssa = new SsaTransformer().Convert(func);
+        ssa.ValidateUseDef();
+
+        var merge = ssa.Function.Blocks.Single(b => b.Label == "merge");
+        var phi = Assert.IsType<IrPhi>(merge.Instructions[0]);
+        Assert.True(phi.Sources.ContainsKey("left"));
+        Assert.True(phi.Sources.ContainsKey("right"));
+    }
+
+    [Theory]
+    [InlineData("gqr0")]
+    [InlineData("gqr7")]
+    [InlineData("hid0")]
+    [InlineData("hid1")]
+    [InlineData("hid2")]
+    [InlineData("srr0")]
+    [InlineData("srr1")]
+    public void ContextBackedSpecialRegisterPhiAllowsImplicitLiveIn(string register)
+    {
+        var function = new IrFunction("special_phi", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBranch("bne", "written", "live_in")
+            }),
+            new IrBasicBlock("written", new IrInstruction[]
+            {
+                new IrAssign(register, IrValue.Imm(1)),
+                new IrJump("merge")
+            }),
+            new IrBasicBlock("live_in", new IrInstruction[]
+            {
+                new IrJump("merge")
+            }),
+            new IrBasicBlock("merge", new IrInstruction[]
+            {
+                new IrReturn(IrValue.Register(register))
+            })
+        });
+
+        var ssa = new SsaTransformer().Convert(function);
+        ssa.ValidateUseDef();
+
+        var phi = Assert.IsType<IrPhi>(
+            ssa.Function.Blocks.Single(block => block.Label == "merge").Instructions[0]);
+        Assert.Equal(2, phi.Sources.Count);
+        Assert.Contains("written", phi.Sources.Keys);
+        Assert.Contains("live_in", phi.Sources.Keys);
+    }
+
+    [Fact]
+    public void SetCrOperandsAreRenamed()
+    {
+        var blocks = new List<IrBasicBlock>
+        {
+            new("entry", new List<IrInstruction>
+            {
+                new IrAssign("r3", IrValue.Imm(1)),
+                new IrAssign("r4", IrValue.Imm(2)),
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Register("r4"), true),
+                new IrReturn(IrValue.Register("r3"))
+            })
+        };
+
+        var func = new IrFunction("set_cr", "entry", blocks);
+        var ssa = new SsaTransformer().Convert(func);
+
+        var block = ssa.Function.Blocks.Single();
+        var setCr = Assert.IsType<IrSetCrField>(block.Instructions[2]);
+        Assert.NotNull(setCr.Left.RegisterName);
+        Assert.NotNull(setCr.Right.RegisterName);
+        Assert.Contains('_', setCr.Left.RegisterName!);
+        Assert.Contains('_', setCr.Right.RegisterName!);
+    }
+
+    [Fact]
+    public void SiblingDefinitionsReceiveGloballyUniqueVersions()
+    {
+        var function = new IrFunction("sibling_versions", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBranch("bne", "left", "right")
+            }),
+            new IrBasicBlock("left", new IrInstruction[]
+            {
+                new IrAssign("f1", IrValue.Imm(1)),
+                new IrJump("merge")
+            }),
+            new IrBasicBlock("right", new IrInstruction[]
+            {
+                new IrAssign("f1", IrValue.Imm(2)),
+                new IrJump("merge")
+            }),
+            new IrBasicBlock("merge", new IrInstruction[]
+            {
+                new IrReturn(IrValue.Register("f1"))
+            })
+        });
+
+        var ssa = new SsaTransformer().Convert(function);
+        ssa.ValidateUseDef();
+
+        var leftDefinition = Assert.IsType<IrAssign>(
+            ssa.Function.Blocks.Single(block => block.Label == "left").Instructions[0]).Destination;
+        var rightDefinition = Assert.IsType<IrAssign>(
+            ssa.Function.Blocks.Single(block => block.Label == "right").Instructions[0]).Destination;
+        var phi = Assert.IsType<IrPhi>(
+            ssa.Function.Blocks.Single(block => block.Label == "merge").Instructions[0]);
+
+        Assert.NotEqual(leftDefinition, rightDefinition);
+        Assert.Equal(leftDefinition, phi.Sources["left"]);
+        Assert.Equal(rightDefinition, phi.Sources["right"]);
+    }
+}
diff --git a/translator/tests/Translator.Tests/StackAddressFactsTests.cs b/translator/tests/Translator.Tests/StackAddressFactsTests.cs
new file mode 100644
index 0000000..8b8016f
--- /dev/null
+++ b/translator/tests/Translator.Tests/StackAddressFactsTests.cs
@@ -0,0 +1,66 @@
+using Translator.Core.Analysis;
+using Translator.Core.Ir;
+
+namespace Translator.Tests;
+
+public sealed class StackAddressFactsTests
+{
+    [Fact]
+    public void TracksFramePointerCopiesAndSubtractions()
+    {
+        var function = new IrFunction("stack_facts", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r11", IrValue.Register("r1"), IrValue.Imm(64), "add"),
+                new IrAssign("save_area", IrValue.Register("r11")),
+                new IrBinary("slot", IrValue.Register("save_area"), IrValue.Imm(8), "sub")
+            })
+        });
+
+        var facts = StackAddressFacts.Build(function);
+
+        Assert.True(facts.TryResolve(new IrAddress("r11", -28), out var frameOffset));
+        Assert.Equal(36, frameOffset);
+        Assert.True(facts.TryResolve(new IrAddress("slot", 0), out var slotOffset));
+        Assert.Equal(56, slotOffset);
+        Assert.True(facts.ContainsTemporary("r11"));
+        Assert.True(facts.ContainsTemporary("save_area"));
+    }
+
+    [Fact]
+    public void TreatsEveryR1VersionAsTheCurrentStackRoot()
+    {
+        var facts = StackAddressFacts.Build(new IrFunction("r1_versions", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrAssign("r1_7", IrValue.Register("r4"))
+            })
+        }));
+
+        Assert.True(facts.TryResolve(new IrAddress("r1_7", 12), out var offset));
+        Assert.Equal(12, offset);
+    }
+
+    [Fact]
+    public void DoesNotAddCfgOrCommutedExpressionSemantics()
+    {
+        var facts = StackAddressFacts.Build(new IrFunction("simple_only", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("commuted", IrValue.Imm(8), IrValue.Register("r1"), "add"),
+                new IrPhi("joined", new Dictionary<string, string>
+                {
+                    ["entry"] = "r1",
+                    ["other"] = "r1"
+                })
+            })
+        }));
+
+        Assert.False(facts.ContainsTemporary("commuted"));
+        Assert.False(facts.ContainsTemporary("joined"));
+        Assert.False(facts.TryResolve(new IrAddress("commuted", 0), out _));
+    }
+}
diff --git a/translator/tests/Translator.Tests/StateFreeResidentMarshallingTests.cs b/translator/tests/Translator.Tests/StateFreeResidentMarshallingTests.cs
new file mode 100644
index 0000000..1b465a3
--- /dev/null
+++ b/translator/tests/Translator.Tests/StateFreeResidentMarshallingTests.cs
@@ -0,0 +1,141 @@
+using System;
+using System.Collections.Generic;
+using Translator.Core.Analysis;
+using Translator.Core.Analysis.Representation;
+using Translator.Core.Analysis.Ssa;
+using Translator.Core.CodeGen;
+using Translator.Core.Ir;
+using Translator.Core.Representation;
+using Xunit;
+
+namespace Translator.Tests;
+
+/// <summary>
+/// Pins that a resident call's fast arm carries no CpuContext traffic, while the
+/// <c>InvokeDirectCpu</c> arm (used when a mod overlay replaces the callee) keeps
+/// its own flush/reload pair.
+/// </summary>
+public class StateFreeResidentMarshallingTests
+{
+    private const uint CallerAddress = 0x80001000u;
+    private const uint CalleeAddress = 0x80002000u;
+
+    private static GuestAbiContract Contract(
+        uint gprRead = 0,
+        uint gprWrite = 0,
+        byte crRead = 0,
+        byte crWrite = 0,
+        bool readsXer = false,
+        bool writesXer = false) =>
+        new(
+            GprReadBeforeWriteMask: gprRead,
+            GprPossibleWriteMask: gprWrite,
+            GprReturnMask: 0,
+            FprReadBeforeWriteMask: 0,
+            FprPossibleWriteMask: 0,
+            FprReturnMask: 0,
+            CrReadBeforeWriteMask: crRead,
+            CrPossibleWriteMask: crWrite,
+            ReadsXerBeforeWrite: readsXer,
+            MayWriteXer: writesXer,
+            ReadsCtrBeforeWrite: false,
+            MayWriteCtr: false,
+            ReadsLrBeforeWrite: false,
+            MayWriteLr: false,
+            BoundaryFlags: GuestCallBoundaryFlags.None,
+            DirectCallTargets: Array.Empty<uint>());
+
+    private static string Emit(IrFunction function, GuestAbiContract calleeContract)
+    {
+        return new CxxLinearCodeGenerator().Emit(
+            CallerAddress,
+            new SsaTransformer().Convert(function),
+            new FunctionAbiClassification(function.Name, ValueRepresentation.Void),
+            new RepresentationEnvironment(new Dictionary<string, ValueRepresentation>()),
+            stateFreeAbiContracts: new Dictionary<uint, GuestAbiContract> { [CalleeAddress] = calleeContract },
+            stateFreeCallSymbols: new Dictionary<uint, string> { [CalleeAddress] = "callee_native" });
+    }
+
+    private static IrFunction Caller() =>
+        new("state_free_caller", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrBinary("r3", IrValue.Register("r3"), IrValue.Register("r4"), "add"),
+                new IrReturn(null)
+            })
+        });
+
+    [Fact]
+    public void FastArmPassesResidentLocalsAndWritesResultsBackIntoThem()
+    {
+        var code = Emit(Caller(), Contract(gprRead: 1u << 3, gprWrite: 1u << 3));
+
+        var fastArm = code.IndexOf("callee_native(r3)", StringComparison.Ordinal);
+        Assert.True(fastArm > 0, $"expected the fast arm to pass the resident local:\n{code}");
+        Assert.DoesNotContain("callee_native(ctx->gpr[3])", code, StringComparison.Ordinal);
+
+        // One output packs into a bare uint64_t, unpacked straight into the local.
+        var resultStore = code.IndexOf("    r3 = static_cast<uint32_t>(state_free_result_80002000_", StringComparison.Ordinal);
+        Assert.True(resultStore > fastArm, $"expected the result to land in the local:\n{code}");
+    }
+
+    [Fact]
+    public void SlowArmKeepsItsOwnCompleteFlushAndReload()
+    {
+        var code = Emit(Caller(), Contract(gprRead: 1u << 3, gprWrite: 1u << 3));
+        var elseArm = code.IndexOf("} else {", StringComparison.Ordinal);
+        var call = code.IndexOf("InvokeDirectCpu<0x80002000u>(ctx);", StringComparison.Ordinal);
+        var flush = code.IndexOf("        ctx->gpr[3] = r3;", StringComparison.Ordinal);
+        var reload = code.IndexOf("        r3 = ctx->gpr[3];", StringComparison.Ordinal);
+
+        Assert.True(elseArm > 0 && flush > elseArm && call > flush && reload > call,
+            $"the InvokeDirectCpu arm must publish and re-read the locals itself:\n{code}");
+    }
+
+    /// <summary>
+    /// The flush that used to bracket the whole call site is gone; only the two
+    /// registers an HLE interrupt handler reads out of the architectural copy
+    /// survive, and only when this frame actually wrote them.
+    /// </summary>
+    [Fact]
+    public void FastArmEmitsNoBoundaryFlushOrReload()
+    {
+        var code = Emit(Caller(), Contract(gprRead: 1u << 3, gprWrite: 1u << 3));
+        var fastArm = code.IndexOf("if (MkwStateFreeAbiEnabled(", StringComparison.Ordinal);
+        Assert.True(fastArm > 0);
+
+        // Nothing between the last body statement and the guard.
+        var beforeGuard = code[..fastArm];
+        Assert.DoesNotContain("ctx->gpr[3] = r3;", beforeGuard, StringComparison.Ordinal);
+        Assert.DoesNotContain("ctx->gpr[4] = r4;", beforeGuard, StringComparison.Ordinal);
+        // r4 is only read by this frame and is not part of the callee interface,
+        // so it is neither passed nor reloaded on the fast arm.
+        Assert.DoesNotContain("callee_native(r3, r4)", code, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void CrAndXerInterfaceRegistersUseTheResidentLocals()
+    {
+        var contract = Contract(gprRead: 1u << 3, crRead: 0x80, crWrite: 0x80, readsXer: true);
+        var function = new IrFunction("state_free_cr_caller", "entry", new[]
+        {
+            new IrBasicBlock("entry", new IrInstruction[]
+            {
+                new IrSetCrField(0, IrValue.Register("r3"), IrValue.Imm(0), true),
+                new IrCall(string.Empty, "0x80002000", Array.Empty<IrValue>()),
+                new IrReturn(null)
+            })
+        });
+
+        var code = Emit(function, contract);
+
+        Assert.Contains("callee_native(r3, cr, xer)", code, StringComparison.Ordinal);
+        Assert.Contains("    cr = static_cast<uint32_t>(state_free_result_80002000_", code, StringComparison.Ordinal);
+        // XER is published for the interrupt-handler invariant, never reloaded.
+        Assert.DoesNotContain("    xer = ctx->xer;\n    r3", code, StringComparison.Ordinal);
+    }
+
+}
diff --git a/translator/tests/Translator.Tests/SyntheticDolFactory.cs b/translator/tests/Translator.Tests/SyntheticDolFactory.cs
new file mode 100644
index 0000000..af74158
--- /dev/null
+++ b/translator/tests/Translator.Tests/SyntheticDolFactory.cs
@@ -0,0 +1,94 @@
+using System;
+using System.Buffers.Binary;
+using System.Collections.Generic;
+using System.IO;
+using Translator.Core.Parsing.Dol;
+
+namespace Translator.Tests;
+
+internal static class SyntheticDolFactory
+{
+    private const int HeaderSize = 0x100;
+
+    internal readonly record struct SectionSpec(bool IsText, int Slot, uint Address, byte[] Data);
+
+    public static SectionSpec Text(int slot, uint address, params uint[] words) =>
+        new(true, slot, address, WordsToBytes(words));
+
+    public static SectionSpec Data(int slot, uint address, params byte[] data) =>
+        new(false, slot, address, data);
+
+    public static DolFile Create(uint entryPoint, uint bssAddress = 0, uint bssSize = 0, params SectionSpec[] sections)
+        => DolFile.Load(new MemoryStream(CreateBytes(entryPoint, bssAddress, bssSize, sections), writable: false));
+
+    public static byte[] CreateBytes(uint entryPoint, uint bssAddress = 0, uint bssSize = 0, params SectionSpec[] sections)
+    {
+        var textOffsets = new uint[7];
+        var dataOffsets = new uint[11];
+        var textAddresses = new uint[7];
+        var dataAddresses = new uint[11];
+        var textSizes = new uint[7];
+        var dataSizes = new uint[11];
+        var blobs = new List<(uint Offset, byte[] Data)>();
+
+        var nextOffset = (uint)HeaderSize;
+        foreach (var section in sections)
+        {
+            if (section.IsText)
+            {
+                textOffsets[section.Slot] = nextOffset;
+                textAddresses[section.Slot] = section.Address;
+                textSizes[section.Slot] = (uint)section.Data.Length;
+            }
+            else
+            {
+                dataOffsets[section.Slot] = nextOffset;
+                dataAddresses[section.Slot] = section.Address;
+                dataSizes[section.Slot] = (uint)section.Data.Length;
+            }
+
+            blobs.Add((nextOffset, section.Data));
+            nextOffset += (uint)section.Data.Length;
+        }
+
+        var image = new byte[nextOffset];
+        WriteArray(image, 0x00, textOffsets);
+        WriteArray(image, 0x1C, dataOffsets);
+        WriteArray(image, 0x48, textAddresses);
+        WriteArray(image, 0x64, dataAddresses);
+        WriteArray(image, 0x90, textSizes);
+        WriteArray(image, 0xAC, dataSizes);
+        WriteU32(image, 0xD8, bssAddress);
+        WriteU32(image, 0xDC, bssSize);
+        WriteU32(image, 0xE0, entryPoint);
+
+        foreach (var (offset, data) in blobs)
+        {
+            data.CopyTo(image.AsSpan((int)offset));
+        }
+
+        return image;
+    }
+
+    private static byte[] WordsToBytes(params uint[] words)
+    {
+        var bytes = new byte[words.Length * 4];
+        for (var i = 0; i < words.Length; i++)
+        {
+            BinaryPrimitives.WriteUInt32BigEndian(bytes.AsSpan(i * 4, 4), words[i]);
+        }
+
+        return bytes;
+    }
+
+    private static void WriteArray(byte[] image, int offset, IReadOnlyList<uint> values)
+    {
+        for (var i = 0; i < values.Count; i++)
+        {
+            WriteU32(image, offset + (i * 4), values[i]);
+        }
+    }
+
+    private static void WriteU32(byte[] image, int offset, uint value) =>
+        BinaryPrimitives.WriteUInt32BigEndian(image.AsSpan(offset, 4), value);
+}
diff --git a/translator/tests/Translator.Tests/TransactionalDirectoryOutputTests.cs b/translator/tests/Translator.Tests/TransactionalDirectoryOutputTests.cs
new file mode 100644
index 0000000..1dfa924
--- /dev/null
+++ b/translator/tests/Translator.Tests/TransactionalDirectoryOutputTests.cs
@@ -0,0 +1,159 @@
+using Translator.Core.IO;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class TransactionalDirectoryOutputTests
+{
+    [Fact]
+    public void SuccessfulGenerationPreservesUnchangedTimestampsAndReconcilesMembership()
+    {
+        var root = CreateTempRoot();
+        try
+        {
+            var output = Path.Combine(root, "generated-mod");
+            Directory.CreateDirectory(Path.Combine(output, "cpp"));
+            var unchangedPath = Path.Combine(output, "cpp", "unchanged.cpp");
+            File.WriteAllText(unchangedPath, "same");
+            File.WriteAllText(Path.Combine(output, "cpp", "changed.cpp"), "old");
+            File.WriteAllText(Path.Combine(output, "cpp", "removed.cpp"), "stale");
+            var originalTimestamp = new DateTime(2001, 2, 3, 4, 5, 6, DateTimeKind.Utc);
+            File.SetLastWriteTimeUtc(unchangedPath, originalTimestamp);
+
+            var outcome = TransactionalDirectoryOutput.GenerateAndPublish(
+                output,
+                staging =>
+                {
+                    Assert.Empty(Directory.EnumerateFileSystemEntries(staging));
+                    Directory.CreateDirectory(Path.Combine(staging, "cpp"));
+                    File.WriteAllText(Path.Combine(staging, "cpp", "unchanged.cpp"), "same");
+                    File.WriteAllText(Path.Combine(staging, "cpp", "changed.cpp"), "new");
+                    File.WriteAllText(Path.Combine(staging, "cpp", "added.cpp"), "added");
+                    return 0;
+                });
+
+            Assert.Equal(0, outcome.ExitCode);
+            Assert.Empty(outcome.Warnings);
+            var result = Assert.IsType<TransactionalDirectoryOutput.PublishResult>(outcome.Publication);
+            Assert.Equal(1, result.AddedFiles);
+            Assert.Equal(1, result.UpdatedFiles);
+            Assert.Equal(1, result.RemovedFiles);
+            Assert.Equal(1, result.UnchangedFiles);
+            Assert.Equal(originalTimestamp, File.GetLastWriteTimeUtc(Path.Combine(output, "cpp", "unchanged.cpp")));
+            Assert.Equal("new", File.ReadAllText(Path.Combine(output, "cpp", "changed.cpp")));
+            Assert.Equal("added", File.ReadAllText(Path.Combine(output, "cpp", "added.cpp")));
+            Assert.False(File.Exists(Path.Combine(output, "cpp", "removed.cpp")));
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void FailedGenerationLeavesLastKnownGoodOutputUntouched()
+    {
+        var root = CreateTempRoot();
+        try
+        {
+            var output = Path.Combine(root, "generated-mod");
+            Directory.CreateDirectory(output);
+            var livePath = Path.Combine(output, "mod_manifest.json");
+            File.WriteAllText(livePath, "last-known-good");
+            var originalTimestamp = new DateTime(2002, 3, 4, 5, 6, 7, DateTimeKind.Utc);
+            File.SetLastWriteTimeUtc(livePath, originalTimestamp);
+
+            var outcome = TransactionalDirectoryOutput.GenerateAndPublish(
+                output,
+                staging =>
+                {
+                    File.WriteAllText(Path.Combine(staging, "mod_manifest.json"), "incomplete");
+                    File.WriteAllText(Path.Combine(staging, "stale-discovery.cpp"), "must not publish");
+                    return 3;
+                });
+
+            Assert.Equal(3, outcome.ExitCode);
+            Assert.Null(outcome.Publication);
+            Assert.Equal("last-known-good", File.ReadAllText(livePath));
+            Assert.Equal(originalTimestamp, File.GetLastWriteTimeUtc(livePath));
+            Assert.False(File.Exists(Path.Combine(output, "stale-discovery.cpp")));
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void CleanupFailureDoesNotMaskProducerFailure()
+    {
+        var root = CreateTempRoot();
+        FileStream? lockedStagingFile = null;
+        try
+        {
+            var output = Path.Combine(root, "generated-mod");
+            var error = Assert.Throws<InvalidOperationException>(() =>
+                TransactionalDirectoryOutput.GenerateAndPublish(
+                    output,
+                    staging =>
+                    {
+                        lockedStagingFile = new FileStream(
+                            Path.Combine(staging, "locked.cpp"),
+                            FileMode.Create,
+                            FileAccess.ReadWrite,
+                            FileShare.None);
+                        throw new InvalidOperationException("producer failure");
+                    }));
+
+            Assert.Equal("producer failure", error.Message);
+            Assert.False(Directory.Exists(output));
+        }
+        finally
+        {
+            lockedStagingFile?.Dispose();
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void FailedGenerationExposesStagingDiagnosticsBeforeCleanup()
+    {
+        var root = CreateTempRoot();
+        try
+        {
+            var output = Path.Combine(root, "generated-mod");
+            string? capturedReport = null;
+            var capturedExitCode = 0;
+
+            var outcome = TransactionalDirectoryOutput.GenerateAndPublish(
+                output,
+                staging =>
+                {
+                    File.WriteAllText(Path.Combine(staging, "runtime_patch_slots.txt"), "two executable writes");
+                    return 2;
+                },
+                (staging, producerExitCode) =>
+                {
+                    capturedExitCode = producerExitCode;
+                    capturedReport = File.ReadAllText(Path.Combine(staging, "runtime_patch_slots.txt"));
+                });
+
+            Assert.Equal(2, outcome.ExitCode);
+            Assert.Null(outcome.Publication);
+            Assert.Equal(2, capturedExitCode);
+            Assert.Equal("two executable writes", capturedReport);
+            Assert.False(Directory.Exists(output));
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static string CreateTempRoot()
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"translator-transactional-output-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(root);
+        return root;
+    }
+}
diff --git a/translator/tests/Translator.Tests/TranslateRecursiveRuntimeConfigTests.cs b/translator/tests/Translator.Tests/TranslateRecursiveRuntimeConfigTests.cs
new file mode 100644
index 0000000..7f9254f
--- /dev/null
+++ b/translator/tests/Translator.Tests/TranslateRecursiveRuntimeConfigTests.cs
@@ -0,0 +1,210 @@
+using System.Reflection;
+using System.Threading.Tasks;
+using Translator.Cli.Configuration;
+using Translator.Core.Mods;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class TranslateRecursiveRuntimeConfigTests
+{
+    [Fact]
+    public void UnsupportedOpcodeFailsStrictTranslation()
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"translator-unsupported-opcode-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(root);
+        try
+        {
+            const uint entry = 0x80001000u;
+            File.WriteAllBytes(
+                Path.Combine(root, "main.dol"),
+                SyntheticDolFactory.CreateBytes(
+                    entry,
+                    sections: [SyntheticDolFactory.Text(
+                        0,
+                        entry,
+                        0x04000000u, // unassigned primary opcode; deliberately unsupported by the lifter
+                        0x4E800020u)])); // blr
+            var projectPath = Path.Combine(root, "recomp.yml");
+            File.WriteAllText(
+                projectPath,
+                """
+                schema_version: 1
+                project:
+                  id: unsupported-opcode-test
+                memory:
+                  sda_base: 0x80002000
+                  sda2_base: 0x80003000
+                inputs:
+                  dol:
+                    path: main.dol
+                translation:
+                  entry_points: [0x80001000]
+                output:
+                  root: generated
+                """);
+            Assert.False(TranslationProjectConfig.Load(projectPath).Translation.AllowUnsupportedInstructions);
+
+            var strictError = Assert.Throws<TargetInvocationException>(() => InvokeCli(
+                "translate-recursive",
+                $"0x{entry:X8}",
+                "--project", projectPath,
+                "--outdir", Path.Combine(root, "strict", "functions"),
+                "--output-metadata", Path.Combine(root, "strict", "metadata.json"),
+                "--threads", "1"));
+            Assert.Contains("UNIMPLEMENTED", strictError.InnerException?.ToString(), StringComparison.Ordinal);
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void RepeatedRunsReuseUnchangedOutputsAndPruneStaleFiles()
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"translator-recursive-prune-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(root);
+        try
+        {
+            const uint entry = 0x80001000u;
+            File.WriteAllBytes(
+                Path.Combine(root, "main.dol"),
+                SyntheticDolFactory.CreateBytes(
+                    entry,
+                    sections: [SyntheticDolFactory.Text(
+                        0,
+                        entry,
+                        0x60000000u, // nop
+                        0x60000000u, // nop
+                        0x4E800020u)])); // blr
+            var projectPath = Path.Combine(root, "recomp.yml");
+            File.WriteAllText(
+                projectPath,
+                """
+                schema_version: 1
+                project:
+                  id: recursive-prune-test
+                  display_name: Recursive Prune Test
+                memory:
+                  sda_base: 0x80002000
+                  sda2_base: 0x80003000
+                inputs:
+                  dol:
+                    path: main.dol
+                translation:
+                  entry_points: [0x80001000]
+                output:
+                  root: generated
+                """);
+
+            var stagedFunctions = Path.Combine(root, "staging", "functions");
+            var stagedOutputMetadata = Path.Combine(root, "staging", "functions_metadata.json");
+            var exitCode = InvokeCli(
+                "translate-recursive",
+                $"0x{entry:X8}",
+                "--project",
+                projectPath,
+                "--outdir",
+                stagedFunctions,
+                "--output-metadata",
+                stagedOutputMetadata,
+                "--threads",
+                "1");
+
+            Assert.Equal(0, exitCode);
+            var firstMetadata = BaseTranslationOutputMetadataFile.Read(stagedOutputMetadata);
+            Assert.Null(firstMetadata.TranslationIdentityHash);
+            Assert.Equal(0, firstMetadata.Quality.UnsupportedInstructionCount);
+            Assert.Equal(0, firstMetadata.Quality.InvalidSsaFunctionCount);
+            Assert.Single(firstMetadata.Functions);
+            Assert.Single(Directory.GetFiles(stagedFunctions, "*.cpp"));
+            var generatedPath = Directory.GetFiles(stagedFunctions, "*.cpp").Single();
+            var unchangedTimestamp = new DateTime(2004, 5, 6, 7, 8, 10, DateTimeKind.Utc);
+            File.SetLastWriteTimeUtc(generatedPath, unchangedTimestamp);
+            // A populated output tree is not an input to recursive discovery.
+            // This stale filename used to become a synthetic function boundary
+            // and truncate the second translation at entry + 4.
+            File.WriteAllText(Path.Combine(stagedFunctions, $"func_{entry + 4:X8}.cpp"), "stale output hint");
+            var metadataTimestamp = new DateTime(2004, 5, 6, 7, 8, 12, DateTimeKind.Utc);
+            File.SetLastWriteTimeUtc(stagedOutputMetadata, metadataTimestamp);
+
+            var secondExitCode = InvokeCli(
+                "translate-recursive",
+                $"0x{entry:X8}",
+                "--project",
+                projectPath,
+                "--outdir",
+                stagedFunctions,
+                "--output-metadata",
+                stagedOutputMetadata,
+                "--threads",
+                "1");
+
+            Assert.Equal(0, secondExitCode);
+            Assert.Equal(unchangedTimestamp, File.GetLastWriteTimeUtc(generatedPath));
+            Assert.Equal(metadataTimestamp, File.GetLastWriteTimeUtc(stagedOutputMetadata));
+
+            var stalePath = Path.Combine(stagedFunctions, "func_80001004.cpp");
+            var unlistedPath = Path.Combine(stagedFunctions, "unlisted.cpp");
+            File.WriteAllText(stalePath, "// stale");
+            File.WriteAllText(unlistedPath, "// not translator-owned");
+            BaseTranslationOutputMetadataFile.WriteIfChangedAtomic(
+                stagedOutputMetadata,
+                BaseTranslationOutputMetadata.Create(
+                    firstMetadata.Functions.Concat([
+                        new BaseTranslationFunctionMetadata(
+                            "func_80001004.cpp",
+                            8,
+                            new string('e', 64),
+                            0x80001004u,
+                            [])
+                    ]),
+                    TranslationQualityMetadata.Clean));
+
+            var pruneExitCode = InvokeCli(
+                "translate-recursive",
+                $"0x{entry:X8}",
+                "--project",
+                projectPath,
+                "--outdir",
+                stagedFunctions,
+                "--output-metadata",
+                stagedOutputMetadata,
+                "--prune-stale",
+                "--threads",
+                "1");
+            Assert.Equal(0, pruneExitCode);
+            Assert.False(File.Exists(stalePath));
+            Assert.True(File.Exists(unlistedPath));
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+            {
+                Directory.Delete(root, recursive: true);
+            }
+        }
+    }
+
+    private static int InvokeCli(params string[] args)
+    {
+        var entryPoint = typeof(TranslationProjectConfig).Assembly.EntryPoint;
+        Assert.NotNull(entryPoint);
+        var result = entryPoint!.Invoke(null, new object?[] { args });
+        return result switch
+        {
+            int exitCode => exitCode,
+            Task<int> intTask => intTask.GetAwaiter().GetResult(),
+            Task task => CompleteTask(task),
+            null => 0,
+            _ => throw new InvalidOperationException($"Unexpected CLI entry point result type: {result.GetType().FullName}")
+        };
+    }
+
+    private static int CompleteTask(Task task)
+    {
+        task.GetAwaiter().GetResult();
+        return 0;
+    }
+}
diff --git a/translator/tests/Translator.Tests/TranslatedBuildShardEmitterTests.cs b/translator/tests/Translator.Tests/TranslatedBuildShardEmitterTests.cs
new file mode 100644
index 0000000..f0a0f78
--- /dev/null
+++ b/translator/tests/Translator.Tests/TranslatedBuildShardEmitterTests.cs
@@ -0,0 +1,374 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using Translator.Core.Build;
+using Translator.Core.Mods;
+using Xunit;
+
+namespace Translator.Tests;
+
+public sealed class TranslatedBuildShardEmitterTests
+{
+    [Fact]
+    public void RemainingWeightPartitionDoesNotCreateOversizedTailBin()
+    {
+        var weights = Enumerable.Repeat(300L, 10).ToArray();
+        var first = TranslatedBuildShardEmitter.PartitionWeightedIndices(weights, 4);
+        var second = TranslatedBuildShardEmitter.PartitionWeightedIndices(weights, 4);
+
+        Assert.Equal(new[] { 2, 3, 2, 3 }, first.Select(static group => group.Count));
+        Assert.Equal(
+            first.Select(static group => string.Join(",", group)),
+            second.Select(static group => string.Join(",", group)));
+        Assert.All(first, group => Assert.InRange(group.Sum(index => weights[index]), 600, 900));
+    }
+
+    [Fact]
+    public void EmitsDeterministicSmallTraitShardsWithoutCodeMap()
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"translator-build-shards-{Guid.NewGuid():N}");
+        var functions = Path.Combine(root, "functions");
+        var native = Path.Combine(root, "runtime", "src");
+        var mod = Path.Combine(root, "mod", "cpp");
+        var output = Path.Combine(root, "out");
+        Directory.CreateDirectory(functions);
+        Directory.CreateDirectory(native);
+        Directory.CreateDirectory(mod);
+        try
+        {
+            const string caller = """
+                #include "abi_bridge.h"
+                extern "C" void func_80001000(CpuContext* ctx) {
+                    InvokeDirectCpu<0x80002000u>(ctx);
+                }
+                // RECOMP_REGISTRATION base 0x80001000 func_80001000 preserves=true fpr_mask=0x00000000
+                """;
+            const string target = """
+                #include "abi_bridge.h"
+                extern "C" void func_80002000(CpuContext*) {}
+                // RECOMP_REGISTRATION base 0x80002000 func_80002000 preserves=true fpr_mask=0x00000000
+                """;
+            const string runtimeOverridden = """
+                #include "abi_bridge.h"
+                extern "C" void func_80003000(CpuContext*) {}
+                // RECOMP_REGISTRATION base 0x80003000 func_80003000 preserves=true fpr_mask=0x00000000
+                """;
+            const string nativeOverridden = """
+                #include "abi_bridge.h"
+                extern "C" void func_80004000(CpuContext*) {}
+                // RECOMP_REGISTRATION base 0x80004000 func_80004000 preserves=true fpr_mask=0x00000000
+                """;
+            Write(Path.Combine(functions, "func_80001000.cpp"), caller);
+            Write(Path.Combine(functions, "func_80002000.cpp"), target);
+            Write(Path.Combine(functions, "func_80003000.cpp"), runtimeOverridden);
+            Write(Path.Combine(functions, "func_80004000.cpp"), nativeOverridden);
+            Write(Path.Combine(native, "override.cpp"),
+                "REGISTER_TRANSLATED_FUNCTION(0x80003000, RuntimeOverride_80003000);\n" +
+                "REGISTER_NATIVE_FUNCTION(0x80004000, NativeOverride_80004000);\n");
+            const string modSource = """
+                #include "abi_bridge.h"
+                extern "C" void rr_80002000(CpuContext*) {}
+                // RECOMP_REGISTRATION mod 0x80002000 rr_80002000 "rr_80002000" preserves=false fpr_mask=0x00004000 priority=100 module_id=7
+                """;
+            Write(Path.Combine(mod, "rr_80002000.cpp"), modSource);
+
+            var metadataPath = Path.Combine(root, "base_output.json");
+            BaseTranslationOutputMetadataFile.WriteIfChangedAtomic(metadataPath,
+                BaseTranslationOutputMetadata.Create([
+                    Metadata("func_80001000.cpp", 0x80001000u, caller),
+                    Metadata("func_80002000.cpp", 0x80002000u, target),
+                    Metadata("func_80003000.cpp", 0x80003000u, runtimeOverridden),
+                    Metadata("func_80004000.cpp", 0x80004000u, nativeOverridden)
+                ], TranslationQualityMetadata.Clean, "identity"));
+            var manifestPath = Path.Combine(root, "base_manifest.json");
+            Write(manifestPath, """
+                {"Functions":[
+                  {"Start":2147487744,"End":2147487748,"Name":"func_80001000"},
+                  {"Start":2147491840,"End":2147491844,"Name":"func_80002000"},
+                  {"Start":2147495936,"End":2147495940,"Name":"func_80003000"},
+                  {"Start":2147500032,"End":2147500036,"Name":"func_80004000"}
+                ]}
+                """);
+            var resolvedPath = Path.Combine(root, "mod", "resolved_dispatch_profile.json");
+            Write(resolvedPath, """
+                {"Entries":[
+                  {"Address":2147487744,"Symbol":"func_80001000","Name":"func_80001000","Kind":"base","Priority":0,"DirectCallAvailable":true,"PreservesNonvolatileFprs":true,"NonvolatileFprWriteMask":0,"MustRemainDynamicallyDispatchable":false},
+                  {"Address":2147491840,"Symbol":"rr_80002000","Name":"rr_80002000","Kind":"rr","Priority":100,"DirectCallAvailable":true,"PreservesNonvolatileFprs":false,"NonvolatileFprWriteMask":16384,"MustRemainDynamicallyDispatchable":true}
+                ]}
+                """);
+
+            var options = new TranslatedBuildShardOptions(
+                metadataPath, functions, output, native,
+                resolvedPath, mod, BaseShardCount: 2, ModShardCount: 1, RegistrationShardCount: 1);
+            var first = TranslatedBuildShardEmitter.Emit(options);
+            Assert.Equal(1, first.SharedBaseFunctionCount);
+            Assert.Equal(1, first.ProfileSensitiveTargetCount);
+            Assert.Equal(1, first.ProfileSensitiveCallerCount);
+            Assert.Equal(1, first.ModFunctionCount);
+            Assert.False(File.Exists(Path.Combine(root, "mod", "code.map")));
+
+            var shard = Directory.GetFiles(Path.Combine(output, "base_portable_sensitive"), "*.cpp").Single();
+            var shardText = File.ReadAllText(shard);
+            Assert.Contains("#include \"abi_bridge.h\"", shardText);
+            Assert.DoesNotContain("#include \"" + Path.GetFullPath(Path.Combine(functions, "func_80001000.cpp")).Replace('\\', '/'), shardText);
+            Assert.Contains("MKW_STATIC_TRANSLATED_CALL(0x80002000u, func_80002000, ctx);", shardText);
+            Assert.Contains("ApplyRuntimeCallOptions(Target, Context)", shardText);
+
+            var portableBaseTraits = Directory.GetFiles(Path.Combine(output, "base_portable_sensitive"), "*_traits.h").Single();
+            var portableRetroTraits = Directory.GetFiles(Path.Combine(output, "retro_portable_sensitive"), "*_traits.h").Single();
+            Assert.Contains("MKW_TRANSLATED_TRAIT(80002000, func_80002000,", File.ReadAllText(portableBaseTraits));
+            Assert.Contains("MKW_TRANSLATED_TRAIT(80002000, rr_80002000,", File.ReadAllText(portableRetroTraits));
+            var baseDispatch = Directory.GetFiles(Path.Combine(output, "base_dispatch"), "*.cpp").Single();
+            var baseDispatchText = File.ReadAllText(baseDispatch);
+            Assert.Contains("const StaticIndirectDispatchSegment kSegments[256]", baseDispatchText);
+            Assert.Contains("{0x80001000u, &func_80001000, 0x00000000u, false}", baseDispatchText);
+            Assert.Contains("{0x80002000u, &func_80002000, 0x00000000u, false}", baseDispatchText);
+            Assert.Contains("{0x80003000u, &RuntimeOverride_80003000, 0xFFFFC000u, false}", baseDispatchText);
+            Assert.DoesNotContain("0x80004000u", baseDispatchText);
+            var retroDispatch = Directory.GetFiles(Path.Combine(output, "retro_rewind_dispatch"), "*.cpp").Single();
+            var retroDispatchText = File.ReadAllText(retroDispatch);
+            Assert.Contains("{0x80002000u, &rr_80002000, 0x00004000u, false}", retroDispatchText);
+            Assert.DoesNotContain("{0x80002000u, &func_80002000", retroDispatchText);
+
+            // A function claimed by a native registration is excluded from the
+            // translated graph entirely rather than emitted and then overridden.
+            Assert.DoesNotContain(
+                "func_80003000",
+                Directory.GetFiles(output, "*.cpp", SearchOption.AllDirectories)
+                    .Select(File.ReadAllText)
+                    .Aggregate(string.Concat));
+
+            var timestamps = Directory.GetFiles(output, "*", SearchOption.AllDirectories)
+                .ToDictionary(Path.GetFullPath, File.GetLastWriteTimeUtc, StringComparer.OrdinalIgnoreCase);
+            TranslatedBuildShardEmitter.Emit(options);
+            foreach (var (path, timestamp) in timestamps)
+                Assert.Equal(timestamp, File.GetLastWriteTimeUtc(path));
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void BindsDirectCallsToTheSelectedProfileWinner()
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"translator-same-tu-calls-{Guid.NewGuid():N}");
+        var functions = Path.Combine(root, "functions");
+        var native = Path.Combine(root, "runtime", "src");
+        var output = Path.Combine(root, "out");
+        Directory.CreateDirectory(functions);
+        Directory.CreateDirectory(native);
+        try
+        {
+            // 0x80001000 shares a shard with both of its targets: 0x80002000 has
+            // the same winner in every profile, 0x80003000 writes nonvolatile FPRs.
+            const string commonCaller = """
+                #include "abi_bridge.h"
+                extern "C" void func_80001000(CpuContext* ctx) {
+                    InvokeDirectCpu<0x80002000u>(ctx);
+                    InvokeDirectCpu<0x80003000u>(ctx);
+                }
+                // RECOMP_REGISTRATION base 0x80001000 func_80001000 preserves=true fpr_mask=0x00000000
+                """;
+            const string invariantTarget = """
+                #include "abi_bridge.h"
+                extern "C" void func_80002000(CpuContext*) {}
+                // RECOMP_REGISTRATION base 0x80002000 func_80002000 preserves=true fpr_mask=0x00000000
+                """;
+            const string fprWritingTarget = """
+                #include "abi_bridge.h"
+                extern "C" void func_80003000(CpuContext*) {}
+                // RECOMP_REGISTRATION base 0x80003000 func_80003000 preserves=false fpr_mask=0x00004000
+                """;
+            // 0x80004000 and 0x80005000 both call the profile-sensitive winner at
+            // 0x80005000, so they land in the product-specific partition.
+            const string sharedCaller = """
+                #include "abi_bridge.h"
+                extern "C" void func_80004000(CpuContext* ctx) {
+                    InvokeDirectCpu<0x80005000u>(ctx);
+                    InvokeDirectCpu<0x80002000u>(ctx);
+                }
+                // RECOMP_REGISTRATION base 0x80004000 func_80004000 preserves=true fpr_mask=0x00000000
+                """;
+            const string profileSensitiveTarget = """
+                #include "abi_bridge.h"
+                extern "C" void func_80005000(CpuContext* ctx) {
+                    InvokeDirectCpu<0x80005000u>(ctx);
+                }
+                // RECOMP_REGISTRATION base 0x80005000 func_80005000 preserves=true fpr_mask=0x00000000
+                """;
+            Write(Path.Combine(functions, "func_80001000.cpp"), commonCaller);
+            Write(Path.Combine(functions, "func_80002000.cpp"), invariantTarget);
+            Write(Path.Combine(functions, "func_80003000.cpp"), fprWritingTarget);
+            Write(Path.Combine(functions, "func_80004000.cpp"), sharedCaller);
+            Write(Path.Combine(functions, "func_80005000.cpp"), profileSensitiveTarget);
+
+            var metadataPath = Path.Combine(root, "base_output.json");
+            BaseTranslationOutputMetadataFile.WriteIfChangedAtomic(metadataPath,
+                BaseTranslationOutputMetadata.Create([
+                    Metadata("func_80001000.cpp", 0x80001000u, commonCaller),
+                    Metadata("func_80002000.cpp", 0x80002000u, invariantTarget),
+                    Metadata("func_80003000.cpp", 0x80003000u, fprWritingTarget),
+                    Metadata("func_80004000.cpp", 0x80004000u, sharedCaller),
+                    Metadata("func_80005000.cpp", 0x80005000u, profileSensitiveTarget)
+                ], TranslationQualityMetadata.Clean, "identity"));
+            var manifestPath = Path.Combine(root, "base_manifest.json");
+            Write(manifestPath, """
+                {"Functions":[
+                  {"Start":2147487744,"End":2147487748,"Name":"func_80001000"},
+                  {"Start":2147491840,"End":2147491844,"Name":"func_80002000"},
+                  {"Start":2147495936,"End":2147495940,"Name":"func_80003000"},
+                  {"Start":2147500032,"End":2147500036,"Name":"func_80004000"},
+                  {"Start":2147504128,"End":2147504132,"Name":"func_80005000"}
+                ]}
+                """);
+            // Retro Rewind resolves 0x80005000 to its own translation, so that
+            // winner is not profile-invariant even inside one shard.
+            var resolvedPath = Path.Combine(root, "resolved_dispatch_profile.json");
+            Write(resolvedPath, """
+                {"Entries":[
+                  {"Address":2147504128,"Symbol":"rr_80005000","Name":"rr_80005000","Kind":"rr","Priority":100,"DirectCallAvailable":true,"PreservesNonvolatileFprs":true,"NonvolatileFprWriteMask":0,"MustRemainDynamicallyDispatchable":false}
+                ]}
+                """);
+
+            var options = new TranslatedBuildShardOptions(
+                metadataPath, functions, output, native,
+                resolvedPath, BaseShardCount: 1, ModShardCount: 1, RegistrationShardCount: 1);
+            TranslatedBuildShardEmitter.Emit(options);
+
+            var commonShard = File.ReadAllText(
+                Directory.GetFiles(Path.Combine(output, "base_common"), "*.cpp").Single());
+            // Same shard, same winner in both profiles: call the definition in
+            // this translation unit so the host optimizer can still inline it.
+            Assert.Contains("MKW_STATIC_TRANSLATED_CALL(0x80002000u, func_80002000, ctx);", commonShard);
+            // A nonvolatile-FPR writer keeps the generic dynamically guarded call.
+            Assert.Contains("InvokeDirectCpu<0x80003000u>(ctx);", commonShard);
+            var baseSpecific = Directory.GetFiles(Path.Combine(output, "base_portable_sensitive"), "*.cpp")
+                .Select(File.ReadAllText)
+                .Aggregate(string.Concat);
+            Assert.Contains("MKW_STATIC_TRANSLATED_CALL(0x80005000u, func_80005000, ctx);", baseSpecific);
+            Assert.Contains("MKW_STATIC_TRANSLATED_CALL(0x80002000u, func_80002000, ctx);", baseSpecific);
+
+            // The lowering choice participates in shard identity, so a rebuild is
+            // byte-identical and file identities are stable.
+            var timestamps = Directory.GetFiles(output, "*", SearchOption.AllDirectories)
+                .ToDictionary(Path.GetFullPath, File.GetLastWriteTimeUtc, StringComparer.OrdinalIgnoreCase);
+            TranslatedBuildShardEmitter.Emit(options);
+            foreach (var (path, timestamp) in timestamps)
+                Assert.Equal(timestamp, File.GetLastWriteTimeUtc(path));
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void FrozenBaseCommonBoundariesKeepUnchangedShardIdentityAcrossAFunctionBodyChange()
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"translator-frozen-shards-{Guid.NewGuid():N}");
+        var functions = Path.Combine(root, "functions");
+        var native = Path.Combine(root, "runtime", "src");
+        var output = Path.Combine(root, "out");
+        Directory.CreateDirectory(functions);
+        Directory.CreateDirectory(native);
+        try
+        {
+            // Six equally weighted profile-neutral functions pack 3/3 across two
+            // base_common shards.
+            var addresses = new uint[] { 0x80001000, 0x80002000, 0x80003000, 0x80004000, 0x80005000, 0x80006000 };
+            static string Body(uint address, string filler) =>
+                "#include \"abi_bridge.h\"\n" +
+                $"extern \"C\" void func_{address:X8}(CpuContext*) {{}}\n" +
+                $"// {filler}\n" +
+                $"// RECOMP_REGISTRATION base 0x{address:X8} func_{address:X8} preserves=true fpr_mask=0x00000000\n";
+
+            var metadataPath = Path.Combine(root, "base_output.json");
+            var manifestPath = Path.Combine(root, "base_manifest.json");
+            void WriteInputs(string lastFunctionFiller)
+            {
+                var entries = new List<BaseTranslationFunctionMetadata>();
+                foreach (var address in addresses)
+                {
+                    var filler = address == addresses[^1] ? lastFunctionFiller : "";
+                    var source = Body(address, filler);
+                    var relative = $"func_{address:X8}.cpp";
+                    Write(Path.Combine(functions, relative), source);
+                    entries.Add(Metadata(relative, address, source));
+                }
+                BaseTranslationOutputMetadataFile.WriteIfChangedAtomic(
+                    metadataPath, BaseTranslationOutputMetadata.Create(
+                        entries, TranslationQualityMetadata.Clean, "identity"));
+                Write(manifestPath,
+                    "{\"Functions\":[" +
+                    string.Join(",", addresses.Select(address =>
+                        $"{{\"Start\":{address},\"End\":{address + 4},\"Name\":\"func_{address:X8}\"}}")) +
+                    "]}");
+            }
+
+            string[] BaseCommonShards() =>
+                Directory.GetFiles(Path.Combine(output, "base_common"), "*.cpp")
+                    .Select(static path => Path.GetFileName(path)!)
+                    .Order(StringComparer.Ordinal)
+                    .ToArray();
+
+            var options = new TranslatedBuildShardOptions(
+                metadataPath, functions, output, native,
+                BaseShardCount: 2, ModShardCount: 1, RegistrationShardCount: 1);
+
+            WriteInputs("");
+            var first = TranslatedBuildShardEmitter.Emit(options);
+            Assert.False(first.BaseCommonBoundariesReused);
+            Assert.NotNull(first.BaseCommonShardMapPath);
+            var mapPath = first.BaseCommonShardMapPath!;
+            Assert.Equal("base_common_shard_map.json", Path.GetFileName(mapPath));
+            Assert.True(File.Exists(mapPath));
+            Assert.NotNull(first.BaseCommonBalance);
+            Assert.Equal(2, first.BaseCommonBalance!.ShardCount);
+            var frozenMap = File.ReadAllText(mapPath);
+            Assert.Contains("\"0x80001000\"", frozenMap);
+            Assert.Contains("\"0x80004000\"", frozenMap);
+            var before = BaseCommonShards();
+            Assert.Equal(2, before.Length);
+
+            // Only the last function's body changes, and it changes enough to
+            // move every greedy cut point behind it. Frozen membership keeps the
+            // shard that owns the first three functions byte-identical, so its
+            // content-addressed name - and its object file - survive.
+            WriteInputs(new string('x', 4096));
+            var second = TranslatedBuildShardEmitter.Emit(options);
+            Assert.True(second.BaseCommonBoundariesReused);
+            Assert.Equal(frozenMap, File.ReadAllText(mapPath));
+            var after = BaseCommonShards();
+            Assert.Equal(2, after.Length);
+            Assert.Single(before.Intersect(after, StringComparer.Ordinal));
+
+            // Discarding the recorded table is the only thing that moves a boundary.
+            File.Delete(mapPath);
+            var repacked = TranslatedBuildShardEmitter.Emit(options);
+            Assert.False(repacked.BaseCommonBoundariesReused);
+            var repackedMap = File.ReadAllText(mapPath);
+            Assert.NotEqual(frozenMap, repackedMap);
+            Assert.Contains("\"0x80006000\"", repackedMap);
+            Assert.Empty(after.Intersect(BaseCommonShards(), StringComparer.Ordinal));
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static BaseTranslationFunctionMetadata Metadata(string path, uint address, string content)
+    {
+        var bytes = Encoding.UTF8.GetBytes(content);
+        return new BaseTranslationFunctionMetadata(
+            path, bytes.Length, Convert.ToHexString(SHA256.HashData(bytes)).ToLowerInvariant(), address, []);
+    }
+
+    private static void Write(string path, string content)
+    {
+        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+        File.WriteAllText(path, content, new UTF8Encoding(false));
+    }
+}
diff --git a/translator/tests/Translator.Tests/Translator.Tests.csproj b/translator/tests/Translator.Tests/Translator.Tests.csproj
new file mode 100644
index 0000000..4e37ccd
--- /dev/null
+++ b/translator/tests/Translator.Tests/Translator.Tests.csproj
@@ -0,0 +1,49 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.6.0" />
+    <PackageReference Include="xunit" Version="2.4.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+    <PackageReference Include="coverlet.collector" Version="6.0.0">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\Translator.Core\Translator.Core.csproj" />
+    <ProjectReference Include="..\..\src\Translator.Cli\Translator.Cli.csproj" />
+  </ItemGroup>
+
+  <!--
+    The default suite is intentionally binary-free and host-compiler-free. These
+    files need either MKWii game data or a working host C++ toolchain, so they are
+    excluded until they are moved into a separate asset-backed integration project.
+    Every excluded file still compiles against this repository; the ones that did
+    not (they referenced a REL base-address constant that does not exist here) were
+    deleted rather than left as permanently broken source.
+  -->
+  <ItemGroup>
+    <Compile Remove="MtxIntegrationTests.cs" />
+    <Compile Remove="CodeGenInlineCoverageTests.cs" />
+    <Compile Remove="CodeGenTests.cs" />
+    <Compile Remove="DolFileTests.cs" />
+    <Compile Remove="BasicBlockTests.cs" />
+    <Compile Remove="PpcDisassemblerTests.cs" />
+    <Compile Remove="PpcRuntimeHelperTests.cs" />
+  </ItemGroup>
+
+</Project>
diff --git a/translator/tests/Translator.Tests/TranslatorCppTestHarness.cs b/translator/tests/Translator.Tests/TranslatorCppTestHarness.cs
new file mode 100644
index 0000000..e251b61
--- /dev/null
+++ b/translator/tests/Translator.Tests/TranslatorCppTestHarness.cs
@@ -0,0 +1,182 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using Translator.Core.Loading;
+
+namespace Translator.Tests;
+
+internal static class TranslatorCppTestHarness
+{
+    private static readonly string[] LeanRuntimeSources =
+    {
+        Path.Combine("runtime", "src", "abi_bridge.cpp"),
+        Path.Combine("runtime", "src", "fpu_helpers.cpp"),
+        Path.Combine("runtime", "src", "memory.cpp"),
+        Path.Combine("runtime", "src", "ppc_helpers.cpp"),
+    };
+
+    public static string BuildCompileArguments(
+        string repoRoot,
+        string tempRoot,
+        IEnumerable<string> generatedFiles,
+        string harnessPath,
+        string outputPath,
+        bool includeDataSections = true)
+    {
+        var supportSource = EnsureSupportSource(tempRoot);
+        var runtimeSources = LeanRuntimeSources.Select(path => Path.Combine(repoRoot, path));
+        var args = new StringBuilder();
+        args.Append("-std=c++17 ");
+        args.Append("-D_CRT_SECURE_NO_WARNINGS ");
+        args.Append("-march=x86-64-v3 ");
+        if (!RuntimeHeadersDefineRestrictMacro(repoRoot))
+        {
+            // Fallback for the window between an emitter change using MKW_RESTRICT and the runtime
+            // headers defining it. Stops firing once headers catch up, so it can't hide a real regression.
+            args.Append("-DMKW_RESTRICT=__restrict ");
+        }
+        args.Append("-Wno-error=unused-but-set-variable ");
+        args.Append(string.Join(' ', runtimeSources.Select(Quote))).Append(' ');
+        args.Append(Quote(supportSource)).Append(' ');
+        args.Append(string.Join(' ', generatedFiles.Select(Quote))).Append(' ');
+
+        if (includeDataSections)
+        {
+            var dataSectionsInit = Path.Combine(repoRoot, "generated", "data_sections_init.cpp");
+            if (File.Exists(dataSectionsInit))
+            {
+                args.Append(Quote(dataSectionsInit)).Append(' ');
+            }
+
+            var dataSectionsBlobs = Path.Combine(repoRoot, "generated", "data_sections_init_blobs.S");
+            if (File.Exists(dataSectionsBlobs))
+            {
+                args.Append(Quote(dataSectionsBlobs)).Append(' ');
+            }
+        }
+
+        args.Append(Quote(harnessPath)).Append(' ');
+        args.Append($"-I{Quote(Path.Combine(repoRoot, "runtime", "include"))} ");
+        args.Append($"-I{Quote(Path.Combine(repoRoot, "generated"))} ");
+        args.Append($"-o {Quote(outputPath)}");
+        return args.ToString();
+    }
+
+    private static bool RuntimeHeadersDefineRestrictMacro(string repoRoot)
+    {
+        var includeDirectory = Path.Combine(repoRoot, "runtime", "include");
+        if (!Directory.Exists(includeDirectory))
+        {
+            return false;
+        }
+
+        foreach (var header in Directory.EnumerateFiles(includeDirectory, "*.h", SearchOption.AllDirectories))
+        {
+            if (File.ReadAllText(header).Contains("define MKW_RESTRICT", StringComparison.Ordinal))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public static ProgramImage CreateImage(params (uint Address, uint Value)[] words)
+    {
+        var maxOffset = 0;
+        foreach (var (address, _) in words)
+        {
+            var offset = checked((int)(address - MemoryLayout.RamBase));
+            maxOffset = Math.Max(maxOffset, offset + 4);
+        }
+
+        var memory = new byte[Math.Max(maxOffset, 4)];
+        foreach (var (address, value) in words)
+        {
+            var offset = checked((int)(address - MemoryLayout.RamBase));
+            memory[offset + 0] = (byte)(value >> 24);
+            memory[offset + 1] = (byte)(value >> 16);
+            memory[offset + 2] = (byte)(value >> 8);
+            memory[offset + 3] = (byte)value;
+        }
+
+        return new ProgramImage(
+            memory,
+            new AddressRange(MemoryLayout.RamBase, checked(MemoryLayout.RamBase + (uint)memory.Length)),
+            new AddressRange(MemoryLayout.RamBase, checked(MemoryLayout.RamBase + (uint)memory.Length)),
+            new AddressRange(0, 0),
+            sha256: "test");
+    }
+
+    private static string EnsureSupportSource(string tempRoot)
+    {
+        Directory.CreateDirectory(tempRoot);
+        var path = Path.Combine(tempRoot, "translator_test_support.cpp");
+        const string contents = """
+            #include "system_bridge.h"
+            #include "ppc_runtime.h"
+            #include "recomp_mod_loader.h"
+
+            #include <csetjmp>
+            #include <atomic>
+            #include <cstddef>
+            #include <cstdint>
+            #include <cstdlib>
+            #include <ostream>
+            #include <string_view>
+
+            bool g_suppressSehReporting = false;
+            thread_local jmp_buf* g_sehJumpTarget = nullptr;
+            thread_local uint32_t g_sehLastExceptionCode = 0;
+            thread_local uintptr_t g_sehLastExceptionAddress = 0;
+            thread_local uintptr_t g_sehLastAccessedAddress = 0;
+            thread_local uint32_t g_sehLastAccessType = 0;
+
+            void DebugTrackPcImpl(uint32_t) {}
+            void DebugPumpAurora() {}
+            #if defined(__GNUC__) || defined(__clang__)
+            extern "C" void DumpRecentPcTrace(size_t) __attribute__((weak));
+            void MarkFatalErrorReported() __attribute__((weak));
+            #endif
+            extern "C" void DumpRecentPcTrace(size_t) {}
+            void MarkFatalErrorReported() {}
+            extern "C" void DumpHostStackTraceForRuntimeHelper() {}
+            extern "C" void OS_HLE_ProcessAlarms(int) {}
+            void ShowRuntimeFatalPopup(std::string_view, std::string_view) noexcept
+            {
+                std::abort();
+            }
+
+            namespace RecompMod {
+            std::atomic<bool> g_executableWriteGuardEnabled{false};
+            std::atomic<uint8_t> g_executableWriteGuardPages[kExecutableWriteGuardPageCount]{};
+            std::atomic<uint8_t> g_executableWriteGuardCoarsePages[kExecutableWriteGuardCoarsePageCount]{};
+            std::atomic<uint8_t> g_executableWriteGuardMidPages[kExecutableWriteGuardMidPageCount]{};
+            ScopedTranslatedExecutionAddress::ScopedTranslatedExecutionAddress(uint32_t) noexcept {}
+            ScopedTranslatedExecutionAddress::~ScopedTranslatedExecutionAddress() noexcept {}
+            uint32_t CurrentTranslatedExecutionAddress() noexcept { return 0; }
+            bool HandleExecutableWrite(uint32_t, size_t, uint64_t) { return false; }
+            void CheckExecutableWrite(uint32_t, size_t, uint64_t) {}
+            }
+
+            RuntimeOptions SystemBridge::ParseCommandLine(int, char**) { return {}; }
+            void SystemBridge::Initialize(const RuntimeOptions&) {}
+            void SystemBridge::DumpRegisteredFunctions() {}
+            void SystemBridge::DumpMemoryLayout() {}
+            void SystemBridge::PrintUsage() {}
+            void SystemBridge::DumpCpuState(const CpuContext*) {}
+            void SystemBridge::DumpCpuState(std::ostream&, const CpuContext*) {}
+            """;
+
+        if (!File.Exists(path) || !string.Equals(File.ReadAllText(path), contents, StringComparison.Ordinal))
+        {
+            File.WriteAllText(path, contents);
+        }
+
+        return path;
+    }
+
+    private static string Quote(string path) => $"\"{path}\"";
+}
diff --git a/translator/tests/fixtures/statefree_regcall_sret_proof.cpp b/translator/tests/fixtures/statefree_regcall_sret_proof.cpp
new file mode 100644
index 0000000..a94b26e
--- /dev/null
+++ b/translator/tests/fixtures/statefree_regcall_sret_proof.cpp
@@ -0,0 +1,47 @@
+#include <cstdint>
+#include <cstdio>
+
+#if defined(__clang__) && defined(_WIN64)
+#define INTERNAL_CALL __regcall
+#else
+#define INTERNAL_CALL
+#endif
+
+struct Result15 {
+    uint32_t r0, r1, r3, r4, r5, r6, r7, r8;
+    uint32_t r9, r10, r11, r12, r30, r31, cr;
+};
+
+extern "C" __declspec(noinline) Result15 INTERNAL_CALL callee(
+    uint32_t r1, uint32_t r3, uint32_t r4, uint32_t r5,
+    uint32_t r6, uint32_t r7, uint32_t r8, uint32_t r9,
+    uint32_t r10, uint32_t r11, uint32_t r12, uint32_t r30,
+    uint32_t r31, uint32_t cr, uint32_t xer, uint32_t lr) {
+    return {lr, r1, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, r30, r31, cr ^ xer};
+}
+
+extern "C" __declspec(noinline) Result15 INTERNAL_CALL recurse(
+    uint32_t depth, uint32_t pointer, uint32_t salt) {
+    if (depth == 0) {
+        return callee(0x80398be8u, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12,
+                      30, pointer, 0x44000088u, salt, 0x80124d08u);
+    }
+    auto nested = recurse(depth - 1, pointer, salt);
+    return callee(nested.r1, nested.r3, nested.r4, nested.r5, nested.r6,
+                  nested.r7, nested.r8, nested.r9, nested.r10, nested.r11,
+                  nested.r12, nested.r30, nested.r31, nested.cr, salt,
+                  nested.r0);
+}
+
+int main() {
+    constexpr uint32_t expected = 0x802f12ccu;
+    for (uint32_t i = 0; i < 1000000; ++i) {
+        const auto result = recurse(4, expected, i);
+        if (result.r31 != expected) {
+            std::printf("mismatch iteration=%u expected=%08X actual=%08X\n", i, expected, result.r31);
+            return 1;
+        }
+    }
+    std::puts("statefree regcall+sret proof passed");
+    return 0;
+}